diff options
Diffstat (limited to 'sshd.c')
-rw-r--r-- | sshd.c | 110 |
1 files changed, 110 insertions, 0 deletions
@@ -119,6 +119,10 @@ | |||
119 | #include "monitor_wrap.h" | 119 | #include "monitor_wrap.h" |
120 | #include "version.h" | 120 | #include "version.h" |
121 | 121 | ||
122 | #ifdef USE_SECURITY_SESSION_API | ||
123 | #include <Security/AuthSession.h> | ||
124 | #endif | ||
125 | |||
122 | #ifdef LIBWRAP | 126 | #ifdef LIBWRAP |
123 | #include <tcpd.h> | 127 | #include <tcpd.h> |
124 | #include <syslog.h> | 128 | #include <syslog.h> |
@@ -1530,10 +1534,13 @@ main(int ac, char **av) | |||
1530 | logit("Disabling protocol version 1. Could not load host key"); | 1534 | logit("Disabling protocol version 1. Could not load host key"); |
1531 | options.protocol &= ~SSH_PROTO_1; | 1535 | options.protocol &= ~SSH_PROTO_1; |
1532 | } | 1536 | } |
1537 | #ifndef GSSAPI | ||
1538 | /* The GSSAPI key exchange can run without a host key */ | ||
1533 | if ((options.protocol & SSH_PROTO_2) && !sensitive_data.have_ssh2_key) { | 1539 | if ((options.protocol & SSH_PROTO_2) && !sensitive_data.have_ssh2_key) { |
1534 | logit("Disabling protocol version 2. Could not load host key"); | 1540 | logit("Disabling protocol version 2. Could not load host key"); |
1535 | options.protocol &= ~SSH_PROTO_2; | 1541 | options.protocol &= ~SSH_PROTO_2; |
1536 | } | 1542 | } |
1543 | #endif | ||
1537 | if (!(options.protocol & (SSH_PROTO_1|SSH_PROTO_2))) { | 1544 | if (!(options.protocol & (SSH_PROTO_1|SSH_PROTO_2))) { |
1538 | logit("sshd: no hostkeys available -- exiting."); | 1545 | logit("sshd: no hostkeys available -- exiting."); |
1539 | exit(1); | 1546 | exit(1); |
@@ -1817,6 +1824,60 @@ main(int ac, char **av) | |||
1817 | /* Log the connection. */ | 1824 | /* Log the connection. */ |
1818 | verbose("Connection from %.500s port %d", remote_ip, remote_port); | 1825 | verbose("Connection from %.500s port %d", remote_ip, remote_port); |
1819 | 1826 | ||
1827 | #ifdef USE_SECURITY_SESSION_API | ||
1828 | /* | ||
1829 | * Create a new security session for use by the new user login if | ||
1830 | * the current session is the root session or we are not launched | ||
1831 | * by inetd (eg: debugging mode or server mode). We do not | ||
1832 | * necessarily need to create a session if we are launched from | ||
1833 | * inetd because Panther xinetd will create a session for us. | ||
1834 | * | ||
1835 | * The only case where this logic will fail is if there is an | ||
1836 | * inetd running in a non-root session which is not creating | ||
1837 | * new sessions for us. Then all the users will end up in the | ||
1838 | * same session (bad). | ||
1839 | * | ||
1840 | * When the client exits, the session will be destroyed for us | ||
1841 | * automatically. | ||
1842 | * | ||
1843 | * We must create the session before any credentials are stored | ||
1844 | * (including AFS pags, which happens a few lines below). | ||
1845 | */ | ||
1846 | { | ||
1847 | OSStatus err = 0; | ||
1848 | SecuritySessionId sid = 0; | ||
1849 | SessionAttributeBits sattrs = 0; | ||
1850 | |||
1851 | err = SessionGetInfo(callerSecuritySession, &sid, &sattrs); | ||
1852 | if (err) | ||
1853 | error("SessionGetInfo() failed with error %.8X", | ||
1854 | (unsigned) err); | ||
1855 | else | ||
1856 | debug("Current Session ID is %.8X / Session Attributes are %.8X", | ||
1857 | (unsigned) sid, (unsigned) sattrs); | ||
1858 | |||
1859 | if (inetd_flag && !(sattrs & sessionIsRoot)) | ||
1860 | debug("Running in inetd mode in a non-root session... " | ||
1861 | "assuming inetd created the session for us."); | ||
1862 | else { | ||
1863 | debug("Creating new security session..."); | ||
1864 | err = SessionCreate(0, sessionHasTTY | sessionIsRemote); | ||
1865 | if (err) | ||
1866 | error("SessionCreate() failed with error %.8X", | ||
1867 | (unsigned) err); | ||
1868 | |||
1869 | err = SessionGetInfo(callerSecuritySession, &sid, | ||
1870 | &sattrs); | ||
1871 | if (err) | ||
1872 | error("SessionGetInfo() failed with error %.8X", | ||
1873 | (unsigned) err); | ||
1874 | else | ||
1875 | debug("New Session ID is %.8X / Session Attributes are %.8X", | ||
1876 | (unsigned) sid, (unsigned) sattrs); | ||
1877 | } | ||
1878 | } | ||
1879 | #endif | ||
1880 | |||
1820 | /* | 1881 | /* |
1821 | * We don't want to listen forever unless the other side | 1882 | * We don't want to listen forever unless the other side |
1822 | * successfully authenticates itself. So we set up an alarm which is | 1883 | * successfully authenticates itself. So we set up an alarm which is |
@@ -2194,12 +2255,61 @@ do_ssh2_kex(void) | |||
2194 | 2255 | ||
2195 | myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = list_hostkey_types(); | 2256 | myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = list_hostkey_types(); |
2196 | 2257 | ||
2258 | #ifdef GSSAPI | ||
2259 | { | ||
2260 | char *orig; | ||
2261 | char *gss = NULL; | ||
2262 | char *newstr = NULL; | ||
2263 | orig = myproposal[PROPOSAL_KEX_ALGS]; | ||
2264 | |||
2265 | /* | ||
2266 | * If we don't have a host key, then there's no point advertising | ||
2267 | * the other key exchange algorithms | ||
2268 | */ | ||
2269 | |||
2270 | if (strlen(myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS]) == 0) | ||
2271 | orig = NULL; | ||
2272 | |||
2273 | if (options.gss_keyex) | ||
2274 | gss = ssh_gssapi_server_mechanisms(); | ||
2275 | else | ||
2276 | gss = NULL; | ||
2277 | |||
2278 | if (gss && orig) | ||
2279 | xasprintf(&newstr, "%s,%s", gss, orig); | ||
2280 | else if (gss) | ||
2281 | newstr = gss; | ||
2282 | else if (orig) | ||
2283 | newstr = orig; | ||
2284 | |||
2285 | /* | ||
2286 | * If we've got GSSAPI mechanisms, then we've got the 'null' host | ||
2287 | * key alg, but we can't tell people about it unless its the only | ||
2288 | * host key algorithm we support | ||
2289 | */ | ||
2290 | if (gss && (strlen(myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS])) == 0) | ||
2291 | myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = "null"; | ||
2292 | |||
2293 | if (newstr) | ||
2294 | myproposal[PROPOSAL_KEX_ALGS] = newstr; | ||
2295 | else | ||
2296 | fatal("No supported key exchange algorithms"); | ||
2297 | } | ||
2298 | #endif | ||
2299 | |||
2197 | /* start key exchange */ | 2300 | /* start key exchange */ |
2198 | kex = kex_setup(myproposal); | 2301 | kex = kex_setup(myproposal); |
2199 | kex->kex[KEX_DH_GRP1_SHA1] = kexdh_server; | 2302 | kex->kex[KEX_DH_GRP1_SHA1] = kexdh_server; |
2200 | kex->kex[KEX_DH_GRP14_SHA1] = kexdh_server; | 2303 | kex->kex[KEX_DH_GRP14_SHA1] = kexdh_server; |
2201 | kex->kex[KEX_DH_GEX_SHA1] = kexgex_server; | 2304 | kex->kex[KEX_DH_GEX_SHA1] = kexgex_server; |
2202 | kex->kex[KEX_DH_GEX_SHA256] = kexgex_server; | 2305 | kex->kex[KEX_DH_GEX_SHA256] = kexgex_server; |
2306 | #ifdef GSSAPI | ||
2307 | if (options.gss_keyex) { | ||
2308 | kex->kex[KEX_GSS_GRP1_SHA1] = kexgss_server; | ||
2309 | kex->kex[KEX_GSS_GRP14_SHA1] = kexgss_server; | ||
2310 | kex->kex[KEX_GSS_GEX_SHA1] = kexgss_server; | ||
2311 | } | ||
2312 | #endif | ||
2203 | kex->server = 1; | 2313 | kex->server = 1; |
2204 | kex->client_version_string=client_version_string; | 2314 | kex->client_version_string=client_version_string; |
2205 | kex->server_version_string=server_version_string; | 2315 | kex->server_version_string=server_version_string; |