Bounce openssh to version 5.2p1
This commit is contained in:
parent
c5f25a5f48
commit
a3ba41c854
@ -1,14 +0,0 @@
|
||||
diff -up openssh-5.1p1/sshconnect2.c.bannerlen openssh-5.1p1/sshconnect2.c
|
||||
--- openssh-5.1p1/sshconnect2.c.bannerlen 2008-07-23 19:18:15.000000000 +0200
|
||||
+++ openssh-5.1p1/sshconnect2.c 2008-07-31 11:16:51.000000000 +0200
|
||||
@@ -387,8 +387,9 @@ input_userauth_banner(int type, u_int32_
|
||||
if (options.log_level >= SYSLOG_LEVEL_INFO) {
|
||||
if (len > 65536)
|
||||
len = 65536;
|
||||
- msg = xmalloc(len * 4); /* max expansion from strnvis() */
|
||||
+ msg = xmalloc(len * 4 + 1); /* max expansion from strnvis() */
|
||||
strnvis(msg, raw, len * 4, VIS_SAFE|VIS_OCTAL);
|
||||
+ msg[len*4] = '\0';
|
||||
fprintf(stderr, "%s", msg);
|
||||
xfree(msg);
|
||||
}
|
@ -1,49 +0,0 @@
|
||||
diff -up openssh-5.1p1/nchan.c.compat-sessions openssh-5.1p1/nchan.c
|
||||
--- openssh-5.1p1/nchan.c.compat-sessions 2008-07-02 14:32:43.000000000 +0200
|
||||
+++ openssh-5.1p1/nchan.c 2008-10-17 09:40:37.000000000 +0200
|
||||
@@ -387,6 +387,8 @@ chan_send_eow2(Channel *c)
|
||||
c->self);
|
||||
return;
|
||||
}
|
||||
+ if (!(datafellows & SSH_NEW_OPENSSH))
|
||||
+ return;
|
||||
packet_start(SSH2_MSG_CHANNEL_REQUEST);
|
||||
packet_put_int(c->remote_id);
|
||||
packet_put_cstring("eow@openssh.com");
|
||||
diff -up openssh-5.1p1/compat.c.compat-sessions openssh-5.1p1/compat.c
|
||||
--- openssh-5.1p1/compat.c.compat-sessions 2007-01-05 06:26:46.000000000 +0100
|
||||
+++ openssh-5.1p1/compat.c 2008-10-17 09:40:37.000000000 +0200
|
||||
@@ -91,7 +91,8 @@ compat_datafellows(const char *version)
|
||||
"OpenSSH_3.1*", SSH_BUG_EXTEOF|SSH_OLD_FORWARD_ADDR},
|
||||
{ "OpenSSH_3.*", SSH_OLD_FORWARD_ADDR },
|
||||
{ "Sun_SSH_1.0*", SSH_BUG_NOREKEY|SSH_BUG_EXTEOF},
|
||||
- { "OpenSSH*", 0 },
|
||||
+ { "OpenSSH_4*", 0 },
|
||||
+ { "OpenSSH*", SSH_NEW_OPENSSH },
|
||||
{ "*MindTerm*", 0 },
|
||||
{ "2.1.0*", SSH_BUG_SIGBLOB|SSH_BUG_HMAC|
|
||||
SSH_OLD_SESSIONID|SSH_BUG_DEBUG|
|
||||
diff -up openssh-5.1p1/compat.h.compat-sessions openssh-5.1p1/compat.h
|
||||
--- openssh-5.1p1/compat.h.compat-sessions 2007-01-05 06:26:46.000000000 +0100
|
||||
+++ openssh-5.1p1/compat.h 2008-10-17 09:40:37.000000000 +0200
|
||||
@@ -57,6 +57,7 @@
|
||||
#define SSH_BUG_FIRSTKEX 0x00800000
|
||||
#define SSH_OLD_FORWARD_ADDR 0x01000000
|
||||
#define SSH_BUG_RFWD_ADDR 0x02000000
|
||||
+#define SSH_NEW_OPENSSH 0x04000000
|
||||
|
||||
void enable_compat13(void);
|
||||
void enable_compat20(void);
|
||||
diff -up openssh-5.1p1/ssh.c.compat-sessions openssh-5.1p1/ssh.c
|
||||
--- openssh-5.1p1/ssh.c.compat-sessions 2008-09-12 11:03:32.000000000 +0200
|
||||
+++ openssh-5.1p1/ssh.c 2008-10-17 09:40:37.000000000 +0200
|
||||
@@ -1203,7 +1203,8 @@ ssh_session2(void)
|
||||
id = ssh_session2_open();
|
||||
|
||||
/* If we don't expect to open a new session, then disallow it */
|
||||
- if (options.control_master == SSHCTL_MASTER_NO) {
|
||||
+ if (options.control_master == SSHCTL_MASTER_NO &&
|
||||
+ (datafellows & SSH_NEW_OPENSSH)) {
|
||||
debug("Requesting no-more-sessions@openssh.com");
|
||||
packet_start(SSH2_MSG_GLOBAL_REQUEST);
|
||||
packet_put_cstring("no-more-sessions@openssh.com");
|
@ -1,328 +0,0 @@
|
||||
diff -up openssh-5.1p1/configure.ac.selinux openssh-5.1p1/configure.ac
|
||||
--- openssh-5.1p1/configure.ac.selinux 2008-07-23 16:32:13.000000000 +0200
|
||||
+++ openssh-5.1p1/configure.ac 2008-07-23 16:32:13.000000000 +0200
|
||||
@@ -3309,6 +3309,7 @@ AC_ARG_WITH(selinux,
|
||||
AC_CHECK_LIB(selinux, setexeccon, [ LIBSELINUX="-lselinux" ],
|
||||
AC_MSG_ERROR(SELinux support requires libselinux library))
|
||||
SSHDLIBS="$SSHDLIBS $LIBSELINUX"
|
||||
+ LIBS="$LIBS $LIBSELINUX"
|
||||
AC_CHECK_FUNCS(getseuserbyname get_default_context_with_level)
|
||||
LIBS="$save_LIBS"
|
||||
fi ]
|
||||
diff -up openssh-5.1p1/auth1.c.selinux openssh-5.1p1/auth1.c
|
||||
--- openssh-5.1p1/auth1.c.selinux 2008-07-23 16:32:13.000000000 +0200
|
||||
+++ openssh-5.1p1/auth1.c 2008-07-23 16:32:13.000000000 +0200
|
||||
@@ -391,7 +391,7 @@ void
|
||||
do_authentication(Authctxt *authctxt)
|
||||
{
|
||||
u_int ulen;
|
||||
- char *user, *style = NULL;
|
||||
+ char *user, *style = NULL, *role=NULL;
|
||||
|
||||
/* Get the name of the user that we wish to log in as. */
|
||||
packet_read_expect(SSH_CMSG_USER);
|
||||
@@ -400,11 +400,19 @@ do_authentication(Authctxt *authctxt)
|
||||
user = packet_get_string(&ulen);
|
||||
packet_check_eom();
|
||||
|
||||
+ if ((role = strchr(user, '/')) != NULL)
|
||||
+ *role++ = '\0';
|
||||
+
|
||||
if ((style = strchr(user, ':')) != NULL)
|
||||
*style++ = '\0';
|
||||
+ else
|
||||
+ if (role && (style = strchr(role, ':')) != NULL)
|
||||
+ *style++ = '\0';
|
||||
+
|
||||
|
||||
authctxt->user = user;
|
||||
authctxt->style = style;
|
||||
+ authctxt->role = role;
|
||||
|
||||
/* Verify that the user is a valid user. */
|
||||
if ((authctxt->pw = PRIVSEP(getpwnamallow(user))) != NULL)
|
||||
diff -up openssh-5.1p1/auth2-pubkey.c.selinux openssh-5.1p1/auth2-pubkey.c
|
||||
--- openssh-5.1p1/auth2-pubkey.c.selinux 2008-07-04 04:54:25.000000000 +0200
|
||||
+++ openssh-5.1p1/auth2-pubkey.c 2008-07-23 16:32:13.000000000 +0200
|
||||
@@ -117,7 +117,14 @@ userauth_pubkey(Authctxt *authctxt)
|
||||
}
|
||||
/* reconstruct packet */
|
||||
buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
|
||||
- buffer_put_cstring(&b, authctxt->user);
|
||||
+ if (authctxt->role) {
|
||||
+ buffer_put_int(&b, strlen(authctxt->user)+strlen(authctxt->role)+1);
|
||||
+ buffer_append(&b, authctxt->user, strlen(authctxt->user));
|
||||
+ buffer_put_char(&b, '/');
|
||||
+ buffer_append(&b, authctxt->role, strlen(authctxt->role));
|
||||
+ } else {
|
||||
+ buffer_put_cstring(&b, authctxt->user);
|
||||
+ }
|
||||
buffer_put_cstring(&b,
|
||||
datafellows & SSH_BUG_PKSERVICE ?
|
||||
"ssh-userauth" :
|
||||
diff -up openssh-5.1p1/monitor_wrap.h.selinux openssh-5.1p1/monitor_wrap.h
|
||||
--- openssh-5.1p1/monitor_wrap.h.selinux 2006-08-05 04:39:40.000000000 +0200
|
||||
+++ openssh-5.1p1/monitor_wrap.h 2008-07-23 16:32:13.000000000 +0200
|
||||
@@ -41,6 +41,7 @@ int mm_is_monitor(void);
|
||||
DH *mm_choose_dh(int, int, int);
|
||||
int mm_key_sign(Key *, u_char **, u_int *, u_char *, u_int);
|
||||
void mm_inform_authserv(char *, char *);
|
||||
+void mm_inform_authrole(char *);
|
||||
struct passwd *mm_getpwnamallow(const char *);
|
||||
char *mm_auth2_read_banner(void);
|
||||
int mm_auth_password(struct Authctxt *, char *);
|
||||
diff -up openssh-5.1p1/monitor.h.selinux openssh-5.1p1/monitor.h
|
||||
--- openssh-5.1p1/monitor.h.selinux 2006-03-26 05:30:02.000000000 +0200
|
||||
+++ openssh-5.1p1/monitor.h 2008-07-23 16:32:13.000000000 +0200
|
||||
@@ -30,7 +30,7 @@
|
||||
|
||||
enum monitor_reqtype {
|
||||
MONITOR_REQ_MODULI, MONITOR_ANS_MODULI,
|
||||
- MONITOR_REQ_FREE, MONITOR_REQ_AUTHSERV,
|
||||
+ MONITOR_REQ_FREE, MONITOR_REQ_AUTHSERV,MONITOR_REQ_AUTHROLE,
|
||||
MONITOR_REQ_SIGN, MONITOR_ANS_SIGN,
|
||||
MONITOR_REQ_PWNAM, MONITOR_ANS_PWNAM,
|
||||
MONITOR_REQ_AUTH2_READ_BANNER, MONITOR_ANS_AUTH2_READ_BANNER,
|
||||
diff -up openssh-5.1p1/auth2-hostbased.c.selinux openssh-5.1p1/auth2-hostbased.c
|
||||
--- openssh-5.1p1/auth2-hostbased.c.selinux 2008-07-17 10:57:19.000000000 +0200
|
||||
+++ openssh-5.1p1/auth2-hostbased.c 2008-07-23 16:32:13.000000000 +0200
|
||||
@@ -106,7 +106,14 @@ userauth_hostbased(Authctxt *authctxt)
|
||||
buffer_put_string(&b, session_id2, session_id2_len);
|
||||
/* reconstruct packet */
|
||||
buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
|
||||
- buffer_put_cstring(&b, authctxt->user);
|
||||
+ if (authctxt->role) {
|
||||
+ buffer_put_int(&b, strlen(authctxt->user)+strlen(authctxt->role)+1);
|
||||
+ buffer_append(&b, authctxt->user, strlen(authctxt->user));
|
||||
+ buffer_put_char(&b, '/');
|
||||
+ buffer_append(&b, authctxt->role, strlen(authctxt->role));
|
||||
+ } else {
|
||||
+ buffer_put_cstring(&b, authctxt->user);
|
||||
+ }
|
||||
buffer_put_cstring(&b, service);
|
||||
buffer_put_cstring(&b, "hostbased");
|
||||
buffer_put_string(&b, pkalg, alen);
|
||||
diff -up openssh-5.1p1/monitor_wrap.c.selinux openssh-5.1p1/monitor_wrap.c
|
||||
--- openssh-5.1p1/monitor_wrap.c.selinux 2008-07-11 09:36:48.000000000 +0200
|
||||
+++ openssh-5.1p1/monitor_wrap.c 2008-07-23 16:32:13.000000000 +0200
|
||||
@@ -296,6 +296,23 @@ mm_inform_authserv(char *service, char *
|
||||
buffer_free(&m);
|
||||
}
|
||||
|
||||
+/* Inform the privileged process about role */
|
||||
+
|
||||
+void
|
||||
+mm_inform_authrole(char *role)
|
||||
+{
|
||||
+ Buffer m;
|
||||
+
|
||||
+ debug3("%s entering", __func__);
|
||||
+
|
||||
+ buffer_init(&m);
|
||||
+ buffer_put_cstring(&m, role ? role : "");
|
||||
+
|
||||
+ mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUTHROLE, &m);
|
||||
+
|
||||
+ buffer_free(&m);
|
||||
+}
|
||||
+
|
||||
/* Do the password authentication */
|
||||
int
|
||||
mm_auth_password(Authctxt *authctxt, char *password)
|
||||
diff -up openssh-5.1p1/openbsd-compat/port-linux.c.selinux openssh-5.1p1/openbsd-compat/port-linux.c
|
||||
--- openssh-5.1p1/openbsd-compat/port-linux.c.selinux 2008-03-26 21:27:21.000000000 +0100
|
||||
+++ openssh-5.1p1/openbsd-compat/port-linux.c 2008-07-23 16:32:13.000000000 +0200
|
||||
@@ -30,11 +30,16 @@
|
||||
#ifdef WITH_SELINUX
|
||||
#include "log.h"
|
||||
#include "port-linux.h"
|
||||
+#include "key.h"
|
||||
+#include "hostfile.h"
|
||||
+#include "auth.h"
|
||||
|
||||
#include <selinux/selinux.h>
|
||||
#include <selinux/flask.h>
|
||||
#include <selinux/get_context_list.h>
|
||||
|
||||
+extern Authctxt *the_authctxt;
|
||||
+
|
||||
/* Wrapper around is_selinux_enabled() to log its return value once only */
|
||||
int
|
||||
ssh_selinux_enabled(void)
|
||||
@@ -53,23 +58,36 @@ ssh_selinux_enabled(void)
|
||||
static security_context_t
|
||||
ssh_selinux_getctxbyname(char *pwname)
|
||||
{
|
||||
- security_context_t sc;
|
||||
- char *sename = NULL, *lvl = NULL;
|
||||
- int r;
|
||||
+ security_context_t sc = NULL;
|
||||
+ char *sename, *lvl;
|
||||
+ char *role = NULL;
|
||||
+ int r = 0;
|
||||
|
||||
+ if (the_authctxt)
|
||||
+ role=the_authctxt->role;
|
||||
#ifdef HAVE_GETSEUSERBYNAME
|
||||
- if (getseuserbyname(pwname, &sename, &lvl) != 0)
|
||||
- return NULL;
|
||||
+ if ((r=getseuserbyname(pwname, &sename, &lvl)) != 0) {
|
||||
+ sename = NULL;
|
||||
+ lvl = NULL;
|
||||
+ }
|
||||
#else
|
||||
sename = pwname;
|
||||
lvl = NULL;
|
||||
#endif
|
||||
|
||||
+ if (r == 0) {
|
||||
#ifdef HAVE_GET_DEFAULT_CONTEXT_WITH_LEVEL
|
||||
- r = get_default_context_with_level(sename, lvl, NULL, &sc);
|
||||
+ if (role != NULL && role[0])
|
||||
+ r = get_default_context_with_rolelevel(sename, role, lvl, NULL, &sc);
|
||||
+ else
|
||||
+ r = get_default_context_with_level(sename, lvl, NULL, &sc);
|
||||
#else
|
||||
- r = get_default_context(sename, NULL, &sc);
|
||||
+ if (role != NULL && role[0])
|
||||
+ r = get_default_context_with_role(sename, role, NULL, &sc);
|
||||
+ else
|
||||
+ r = get_default_context(sename, NULL, &sc);
|
||||
#endif
|
||||
+ }
|
||||
|
||||
if (r != 0) {
|
||||
switch (security_getenforce()) {
|
||||
diff -up openssh-5.1p1/auth.h.selinux openssh-5.1p1/auth.h
|
||||
--- openssh-5.1p1/auth.h.selinux 2008-07-02 14:37:30.000000000 +0200
|
||||
+++ openssh-5.1p1/auth.h 2008-07-23 16:32:13.000000000 +0200
|
||||
@@ -58,6 +58,7 @@ struct Authctxt {
|
||||
char *service;
|
||||
struct passwd *pw; /* set if 'valid' */
|
||||
char *style;
|
||||
+ char *role;
|
||||
void *kbdintctxt;
|
||||
#ifdef BSD_AUTH
|
||||
auth_session_t *as;
|
||||
diff -up openssh-5.1p1/auth2.c.selinux openssh-5.1p1/auth2.c
|
||||
--- openssh-5.1p1/auth2.c.selinux 2008-07-05 01:44:53.000000000 +0200
|
||||
+++ openssh-5.1p1/auth2.c 2008-07-23 16:32:13.000000000 +0200
|
||||
@@ -209,7 +209,7 @@ input_userauth_request(int type, u_int32
|
||||
{
|
||||
Authctxt *authctxt = ctxt;
|
||||
Authmethod *m = NULL;
|
||||
- char *user, *service, *method, *style = NULL;
|
||||
+ char *user, *service, *method, *style = NULL, *role = NULL;
|
||||
int authenticated = 0;
|
||||
|
||||
if (authctxt == NULL)
|
||||
@@ -221,6 +221,9 @@ input_userauth_request(int type, u_int32
|
||||
debug("userauth-request for user %s service %s method %s", user, service, method);
|
||||
debug("attempt %d failures %d", authctxt->attempt, authctxt->failures);
|
||||
|
||||
+ if ((role = strchr(user, '/')) != NULL)
|
||||
+ *role++ = 0;
|
||||
+
|
||||
if ((style = strchr(user, ':')) != NULL)
|
||||
*style++ = 0;
|
||||
|
||||
@@ -246,8 +249,11 @@ input_userauth_request(int type, u_int32
|
||||
use_privsep ? " [net]" : "");
|
||||
authctxt->service = xstrdup(service);
|
||||
authctxt->style = style ? xstrdup(style) : NULL;
|
||||
- if (use_privsep)
|
||||
+ authctxt->role = role ? xstrdup(role) : NULL;
|
||||
+ if (use_privsep) {
|
||||
mm_inform_authserv(service, style);
|
||||
+ mm_inform_authrole(role);
|
||||
+ }
|
||||
userauth_banner();
|
||||
} else if (strcmp(user, authctxt->user) != 0 ||
|
||||
strcmp(service, authctxt->service) != 0) {
|
||||
diff -up openssh-5.1p1/monitor.c.selinux openssh-5.1p1/monitor.c
|
||||
--- openssh-5.1p1/monitor.c.selinux 2008-07-11 09:36:48.000000000 +0200
|
||||
+++ openssh-5.1p1/monitor.c 2008-07-23 16:36:10.000000000 +0200
|
||||
@@ -134,6 +134,7 @@ int mm_answer_sign(int, Buffer *);
|
||||
int mm_answer_pwnamallow(int, Buffer *);
|
||||
int mm_answer_auth2_read_banner(int, Buffer *);
|
||||
int mm_answer_authserv(int, Buffer *);
|
||||
+int mm_answer_authrole(int, Buffer *);
|
||||
int mm_answer_authpassword(int, Buffer *);
|
||||
int mm_answer_bsdauthquery(int, Buffer *);
|
||||
int mm_answer_bsdauthrespond(int, Buffer *);
|
||||
@@ -205,6 +206,7 @@ struct mon_table mon_dispatch_proto20[]
|
||||
{MONITOR_REQ_SIGN, MON_ONCE, mm_answer_sign},
|
||||
{MONITOR_REQ_PWNAM, MON_ONCE, mm_answer_pwnamallow},
|
||||
{MONITOR_REQ_AUTHSERV, MON_ONCE, mm_answer_authserv},
|
||||
+ {MONITOR_REQ_AUTHROLE, MON_ONCE, mm_answer_authrole},
|
||||
{MONITOR_REQ_AUTH2_READ_BANNER, MON_ONCE, mm_answer_auth2_read_banner},
|
||||
{MONITOR_REQ_AUTHPASSWORD, MON_AUTH, mm_answer_authpassword},
|
||||
#ifdef USE_PAM
|
||||
@@ -658,6 +660,7 @@ mm_answer_pwnamallow(int sock, Buffer *m
|
||||
else {
|
||||
/* Allow service/style information on the auth context */
|
||||
monitor_permit(mon_dispatch, MONITOR_REQ_AUTHSERV, 1);
|
||||
+ monitor_permit(mon_dispatch, MONITOR_REQ_AUTHROLE, 1);
|
||||
monitor_permit(mon_dispatch, MONITOR_REQ_AUTH2_READ_BANNER, 1);
|
||||
}
|
||||
|
||||
@@ -703,6 +706,23 @@ mm_answer_authserv(int sock, Buffer *m)
|
||||
}
|
||||
|
||||
int
|
||||
+mm_answer_authrole(int sock, Buffer *m)
|
||||
+{
|
||||
+ monitor_permit_authentications(1);
|
||||
+
|
||||
+ authctxt->role = buffer_get_string(m, NULL);
|
||||
+ debug3("%s: role=%s",
|
||||
+ __func__, authctxt->role);
|
||||
+
|
||||
+ if (strlen(authctxt->role) == 0) {
|
||||
+ xfree(authctxt->role);
|
||||
+ authctxt->role = NULL;
|
||||
+ }
|
||||
+
|
||||
+ return (0);
|
||||
+}
|
||||
+
|
||||
+int
|
||||
mm_answer_authpassword(int sock, Buffer *m)
|
||||
{
|
||||
static int call_count;
|
||||
@@ -1080,7 +1100,7 @@ static int
|
||||
monitor_valid_userblob(u_char *data, u_int datalen)
|
||||
{
|
||||
Buffer b;
|
||||
- char *p;
|
||||
+ char *p, *r;
|
||||
u_int len;
|
||||
int fail = 0;
|
||||
|
||||
@@ -1106,6 +1126,8 @@ monitor_valid_userblob(u_char *data, u_i
|
||||
if (buffer_get_char(&b) != SSH2_MSG_USERAUTH_REQUEST)
|
||||
fail++;
|
||||
p = buffer_get_string(&b, NULL);
|
||||
+ if ((r = strchr(p, '/')) != NULL)
|
||||
+ *r = '\0';
|
||||
if (strcmp(authctxt->user, p) != 0) {
|
||||
logit("wrong user name passed to monitor: expected %s != %.100s",
|
||||
authctxt->user, p);
|
||||
@@ -1137,7 +1159,7 @@ monitor_valid_hostbasedblob(u_char *data
|
||||
char *chost)
|
||||
{
|
||||
Buffer b;
|
||||
- char *p;
|
||||
+ char *p, *r;
|
||||
u_int len;
|
||||
int fail = 0;
|
||||
|
||||
@@ -1154,6 +1176,8 @@ monitor_valid_hostbasedblob(u_char *data
|
||||
if (buffer_get_char(&b) != SSH2_MSG_USERAUTH_REQUEST)
|
||||
fail++;
|
||||
p = buffer_get_string(&b, NULL);
|
||||
+ if ((r = strchr(p, '/')) != NULL)
|
||||
+ *r = '\0';
|
||||
if (strcmp(authctxt->user, p) != 0) {
|
||||
logit("wrong user name passed to monitor: expected %s != %.100s",
|
||||
authctxt->user, p);
|
@ -1,158 +0,0 @@
|
||||
diff -up openssh-5.1p1/configure.ac.vendor openssh-5.1p1/configure.ac
|
||||
--- openssh-5.1p1/configure.ac.vendor 2008-07-23 14:13:22.000000000 +0200
|
||||
+++ openssh-5.1p1/configure.ac 2008-07-23 14:13:22.000000000 +0200
|
||||
@@ -3890,6 +3890,12 @@ AC_ARG_WITH(lastlog,
|
||||
fi
|
||||
]
|
||||
)
|
||||
+AC_ARG_ENABLE(vendor-patchlevel,
|
||||
+ [ --enable-vendor-patchlevel=TAG specify a vendor patch level],
|
||||
+ [AC_DEFINE_UNQUOTED(SSH_VENDOR_PATCHLEVEL,[SSH_RELEASE "-" "$enableval"],[Define to your vendor patch level, if it has been modified from the upstream source release.])
|
||||
+ SSH_VENDOR_PATCHLEVEL="$enableval"],
|
||||
+ [AC_DEFINE(SSH_VENDOR_PATCHLEVEL,SSH_RELEASE,[Define to your vendor patch level, if it has been modified from the upstream source release.])
|
||||
+ SSH_VENDOR_PATCHLEVEL=none])
|
||||
|
||||
dnl lastlog, [uw]tmpx? detection
|
||||
dnl NOTE: set the paths in the platform section to avoid the
|
||||
@@ -4146,6 +4152,7 @@ echo " IP address in \$DISPLAY hac
|
||||
echo " Translate v4 in v6 hack: $IPV4_IN6_HACK_MSG"
|
||||
echo " BSD Auth support: $BSD_AUTH_MSG"
|
||||
echo " Random number source: $RAND_MSG"
|
||||
+echo " Vendor patch level: $SSH_VENDOR_PATCHLEVEL"
|
||||
if test ! -z "$USE_RAND_HELPER" ; then
|
||||
echo " ssh-rand-helper collects from: $RAND_HELPER_MSG"
|
||||
fi
|
||||
diff -up openssh-5.1p1/sshd_config.5.vendor openssh-5.1p1/sshd_config.5
|
||||
--- openssh-5.1p1/sshd_config.5.vendor 2008-07-23 14:13:22.000000000 +0200
|
||||
+++ openssh-5.1p1/sshd_config.5 2008-07-23 14:19:23.000000000 +0200
|
||||
@@ -812,6 +812,14 @@ This option applies to protocol version
|
||||
.It Cm ServerKeyBits
|
||||
Defines the number of bits in the ephemeral protocol version 1 server key.
|
||||
The minimum value is 512, and the default is 1024.
|
||||
+.It Cm ShowPatchLevel
|
||||
+Specifies whether
|
||||
+.Nm sshd
|
||||
+will display the patch level of the binary in the identification string.
|
||||
+The patch level is set at compile-time.
|
||||
+The default is
|
||||
+.Dq no .
|
||||
+This option applies to protocol version 1 only.
|
||||
.It Cm StrictModes
|
||||
Specifies whether
|
||||
.Xr sshd 8
|
||||
diff -up openssh-5.1p1/servconf.h.vendor openssh-5.1p1/servconf.h
|
||||
--- openssh-5.1p1/servconf.h.vendor 2008-06-10 15:01:51.000000000 +0200
|
||||
+++ openssh-5.1p1/servconf.h 2008-07-23 14:13:22.000000000 +0200
|
||||
@@ -126,6 +126,7 @@ typedef struct {
|
||||
int max_authtries;
|
||||
int max_sessions;
|
||||
char *banner; /* SSH-2 banner message */
|
||||
+ int show_patchlevel; /* Show vendor patch level to clients */
|
||||
int use_dns;
|
||||
int client_alive_interval; /*
|
||||
* poke the client this often to
|
||||
diff -up openssh-5.1p1/servconf.c.vendor openssh-5.1p1/servconf.c
|
||||
--- openssh-5.1p1/servconf.c.vendor 2008-07-04 05:51:12.000000000 +0200
|
||||
+++ openssh-5.1p1/servconf.c 2008-07-23 14:32:27.000000000 +0200
|
||||
@@ -117,6 +117,7 @@ initialize_server_options(ServerOptions
|
||||
options->max_authtries = -1;
|
||||
options->max_sessions = -1;
|
||||
options->banner = NULL;
|
||||
+ options->show_patchlevel = -1;
|
||||
options->use_dns = -1;
|
||||
options->client_alive_interval = -1;
|
||||
options->client_alive_count_max = -1;
|
||||
@@ -259,6 +260,9 @@ fill_default_server_options(ServerOption
|
||||
if (options->permit_tun == -1)
|
||||
options->permit_tun = SSH_TUNMODE_NO;
|
||||
|
||||
+ if (options->show_patchlevel == -1)
|
||||
+ options->show_patchlevel = 0;
|
||||
+
|
||||
/* Turn privilege separation on by default */
|
||||
if (use_privsep == -1)
|
||||
use_privsep = 1;
|
||||
@@ -296,7 +300,7 @@ typedef enum {
|
||||
sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile,
|
||||
sGatewayPorts, sPubkeyAuthentication, sXAuthLocation, sSubsystem,
|
||||
sMaxStartups, sMaxAuthTries, sMaxSessions,
|
||||
- sBanner, sUseDNS, sHostbasedAuthentication,
|
||||
+ sBanner, sShowPatchLevel, sUseDNS, sHostbasedAuthentication,
|
||||
sHostbasedUsesNameFromPacketOnly, sClientAliveInterval,
|
||||
sClientAliveCountMax, sAuthorizedKeysFile, sAuthorizedKeysFile2,
|
||||
sGssAuthentication, sGssCleanupCreds, sAcceptEnv, sPermitTunnel,
|
||||
@@ -401,6 +405,7 @@ static struct {
|
||||
{ "maxauthtries", sMaxAuthTries, SSHCFG_ALL },
|
||||
{ "maxsessions", sMaxSessions, SSHCFG_ALL },
|
||||
{ "banner", sBanner, SSHCFG_ALL },
|
||||
+ { "showpatchlevel", sShowPatchLevel, SSHCFG_GLOBAL },
|
||||
{ "usedns", sUseDNS, SSHCFG_GLOBAL },
|
||||
{ "verifyreversemapping", sDeprecated, SSHCFG_GLOBAL },
|
||||
{ "reversemappingcheck", sDeprecated, SSHCFG_GLOBAL },
|
||||
@@ -1020,6 +1025,10 @@ process_server_config_line(ServerOptions
|
||||
intptr = &use_privsep;
|
||||
goto parse_flag;
|
||||
|
||||
+ case sShowPatchLevel:
|
||||
+ intptr = &options->show_patchlevel;
|
||||
+ goto parse_flag;
|
||||
+
|
||||
case sAllowUsers:
|
||||
while ((arg = strdelim(&cp)) && *arg != '\0') {
|
||||
if (options->num_allow_users >= MAX_ALLOW_USERS)
|
||||
@@ -1584,6 +1593,7 @@ dump_config(ServerOptions *o)
|
||||
dump_cfg_fmtint(sUseLogin, o->use_login);
|
||||
dump_cfg_fmtint(sCompression, o->compression);
|
||||
dump_cfg_fmtint(sGatewayPorts, o->gateway_ports);
|
||||
+ dump_cfg_fmtint(sShowPatchLevel, o->show_patchlevel);
|
||||
dump_cfg_fmtint(sUseDNS, o->use_dns);
|
||||
dump_cfg_fmtint(sAllowTcpForwarding, o->allow_tcp_forwarding);
|
||||
dump_cfg_fmtint(sUsePrivilegeSeparation, use_privsep);
|
||||
diff -up openssh-5.1p1/sshd_config.0.vendor openssh-5.1p1/sshd_config.0
|
||||
--- openssh-5.1p1/sshd_config.0.vendor 2008-07-23 14:13:22.000000000 +0200
|
||||
+++ openssh-5.1p1/sshd_config.0 2008-07-23 14:13:22.000000000 +0200
|
||||
@@ -466,6 +466,11 @@ DESCRIPTION
|
||||
Defines the number of bits in the ephemeral protocol version 1
|
||||
server key. The minimum value is 512, and the default is 1024.
|
||||
|
||||
+ ShowPatchLevel
|
||||
+ Specifies whether sshd will display the specific patch level of
|
||||
+ the binary in the server identification string. The patch level
|
||||
+ is set at compile-time. The default is M-bM-^@M-^\noM-bM-^@M-^].
|
||||
+
|
||||
StrictModes
|
||||
Specifies whether sshd(8) should check file modes and ownership
|
||||
of the user's files and home directory before accepting login.
|
||||
diff -up openssh-5.1p1/sshd_config.vendor openssh-5.1p1/sshd_config
|
||||
--- openssh-5.1p1/sshd_config.vendor 2008-07-23 14:13:22.000000000 +0200
|
||||
+++ openssh-5.1p1/sshd_config 2008-07-23 14:13:22.000000000 +0200
|
||||
@@ -112,6 +112,7 @@ X11Forwarding yes
|
||||
#Compression delayed
|
||||
#ClientAliveInterval 0
|
||||
#ClientAliveCountMax 3
|
||||
+#ShowPatchLevel no
|
||||
#UseDNS yes
|
||||
#PidFile /var/run/sshd.pid
|
||||
#MaxStartups 10
|
||||
diff -up openssh-5.1p1/sshd.c.vendor openssh-5.1p1/sshd.c
|
||||
--- openssh-5.1p1/sshd.c.vendor 2008-07-11 09:36:49.000000000 +0200
|
||||
+++ openssh-5.1p1/sshd.c 2008-07-23 14:35:43.000000000 +0200
|
||||
@@ -416,7 +416,7 @@ sshd_exchange_identification(int sock_in
|
||||
minor = PROTOCOL_MINOR_1;
|
||||
}
|
||||
snprintf(buf, sizeof buf, "SSH-%d.%d-%.100s%s", major, minor,
|
||||
- SSH_VERSION, newline);
|
||||
+ (options.show_patchlevel == 1) ? SSH_VENDOR_PATCHLEVEL : SSH_VERSION, newline);
|
||||
server_version_string = xstrdup(buf);
|
||||
|
||||
/* Send our protocol version identification. */
|
||||
@@ -1484,7 +1484,8 @@ main(int ac, char **av)
|
||||
exit(1);
|
||||
}
|
||||
|
||||
- debug("sshd version %.100s", SSH_RELEASE);
|
||||
+ debug("sshd version %.100s",
|
||||
+ (options.show_patchlevel == 1) ? SSH_VENDOR_PATCHLEVEL : SSH_RELEASE);
|
||||
|
||||
/* Store privilege separation user for later use if required. */
|
||||
if ((privsep_pw = getpwnam(SSH_PRIVSEP_USER)) == NULL) {
|
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@ -1,6 +1,78 @@
|
||||
diff -up openssh-5.1p1/sshd_config.redhat openssh-5.1p1/sshd_config
|
||||
--- openssh-5.1p1/sshd_config.redhat 2008-07-02 14:35:43.000000000 +0200
|
||||
+++ openssh-5.1p1/sshd_config 2008-07-23 14:11:12.000000000 +0200
|
||||
diff -up openssh-5.2p1/ssh_config.redhat openssh-5.2p1/ssh_config
|
||||
--- openssh-5.2p1/ssh_config.redhat 2009-02-21 02:45:02.000000000 +0100
|
||||
+++ openssh-5.2p1/ssh_config 2009-03-10 03:51:54.749290375 +0100
|
||||
@@ -44,3 +44,13 @@
|
||||
# TunnelDevice any:any
|
||||
# PermitLocalCommand no
|
||||
# VisualHostKey no
|
||||
+Host *
|
||||
+ GSSAPIAuthentication yes
|
||||
+# If this option is set to yes then remote X11 clients will have full access
|
||||
+# to the original X11 display. As virtually no X11 client supports the untrusted
|
||||
+# mode correctly we set this to yes.
|
||||
+ ForwardX11Trusted yes
|
||||
+# Send locale-related environment variables
|
||||
+ SendEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
|
||||
+ SendEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
|
||||
+ SendEnv LC_IDENTIFICATION LC_ALL LANGUAGE
|
||||
diff -up openssh-5.2p1/sshd_config.0.redhat openssh-5.2p1/sshd_config.0
|
||||
--- openssh-5.2p1/sshd_config.0.redhat 2009-02-23 01:18:15.000000000 +0100
|
||||
+++ openssh-5.2p1/sshd_config.0 2009-03-10 03:51:54.958364611 +0100
|
||||
@@ -467,6 +467,11 @@ DESCRIPTION
|
||||
Defines the number of bits in the ephemeral protocol version 1
|
||||
server key. The minimum value is 512, and the default is 1024.
|
||||
|
||||
+ ShowPatchLevel
|
||||
+ Specifies whether sshd will display the specific patch level of
|
||||
+ the binary in the server identification string. The patch level
|
||||
+ is set at compile-time. The default is M-bM-^@M-^\noM-bM-^@M-^].
|
||||
+
|
||||
StrictModes
|
||||
Specifies whether sshd(8) should check file modes and ownership
|
||||
of the user's files and home directory before accepting login.
|
||||
@@ -491,9 +496,9 @@ DESCRIPTION
|
||||
|
||||
SyslogFacility
|
||||
Gives the facility code that is used when logging messages from
|
||||
- sshd(8). The possible values are: DAEMON, USER, AUTH, LOCAL0,
|
||||
- LOCAL1, LOCAL2, LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7. The de-
|
||||
- fault is AUTH.
|
||||
+ sshd(8). The possible values are: DAEMON, USER, AUTH, AUTHPRIV,
|
||||
+ LOCAL0, LOCAL1, LOCAL2, LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.
|
||||
+ The default is AUTH.
|
||||
|
||||
TCPKeepAlive
|
||||
Specifies whether the system should send TCP keepalive messages
|
||||
diff -up openssh-5.2p1/sshd_config.5.redhat openssh-5.2p1/sshd_config.5
|
||||
--- openssh-5.2p1/sshd_config.5.redhat 2009-02-23 01:00:24.000000000 +0100
|
||||
+++ openssh-5.2p1/sshd_config.5 2009-03-10 03:51:54.931352756 +0100
|
||||
@@ -814,6 +814,14 @@ This option applies to protocol version
|
||||
.It Cm ServerKeyBits
|
||||
Defines the number of bits in the ephemeral protocol version 1 server key.
|
||||
The minimum value is 512, and the default is 1024.
|
||||
+.It Cm ShowPatchLevel
|
||||
+Specifies whether
|
||||
+.Nm sshd
|
||||
+will display the patch level of the binary in the identification string.
|
||||
+The patch level is set at compile-time.
|
||||
+The default is
|
||||
+.Dq no .
|
||||
+This option applies to protocol version 1 only.
|
||||
.It Cm StrictModes
|
||||
Specifies whether
|
||||
.Xr sshd 8
|
||||
@@ -848,7 +856,7 @@ Note that this option applies to protoco
|
||||
.It Cm SyslogFacility
|
||||
Gives the facility code that is used when logging messages from
|
||||
.Xr sshd 8 .
|
||||
-The possible values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2,
|
||||
+The possible values are: DAEMON, USER, AUTH, AUTHPRIV, LOCAL0, LOCAL1, LOCAL2,
|
||||
LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.
|
||||
The default is AUTH.
|
||||
.It Cm TCPKeepAlive
|
||||
diff -up openssh-5.2p1/sshd_config.redhat openssh-5.2p1/sshd_config
|
||||
--- openssh-5.2p1/sshd_config.redhat 2008-07-02 14:35:43.000000000 +0200
|
||||
+++ openssh-5.2p1/sshd_config 2009-03-10 03:51:54.960221540 +0100
|
||||
@@ -33,6 +33,7 @@ Protocol 2
|
||||
# Logging
|
||||
# obsoletes QuietMode and FascistLogging
|
||||
@ -50,48 +122,11 @@ diff -up openssh-5.1p1/sshd_config.redhat openssh-5.1p1/sshd_config
|
||||
#X11DisplayOffset 10
|
||||
#X11UseLocalhost yes
|
||||
#PrintMotd yes
|
||||
diff -up openssh-5.1p1/ssh_config.redhat openssh-5.1p1/ssh_config
|
||||
--- openssh-5.1p1/ssh_config.redhat 2007-06-11 06:04:42.000000000 +0200
|
||||
+++ openssh-5.1p1/ssh_config 2008-07-23 14:07:29.000000000 +0200
|
||||
@@ -43,3 +43,13 @@
|
||||
# Tunnel no
|
||||
# TunnelDevice any:any
|
||||
# PermitLocalCommand no
|
||||
+Host *
|
||||
+ GSSAPIAuthentication yes
|
||||
+# If this option is set to yes then remote X11 clients will have full access
|
||||
+# to the original X11 display. As virtually no X11 client supports the untrusted
|
||||
+# mode correctly we set this to yes.
|
||||
+ ForwardX11Trusted yes
|
||||
+# Send locale-related environment variables
|
||||
+ SendEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
|
||||
+ SendEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
|
||||
+ SendEnv LC_IDENTIFICATION LC_ALL LANGUAGE
|
||||
diff -up openssh-5.1p1/sshd_config.0.redhat openssh-5.1p1/sshd_config.0
|
||||
--- openssh-5.1p1/sshd_config.0.redhat 2008-07-21 10:30:51.000000000 +0200
|
||||
+++ openssh-5.1p1/sshd_config.0 2008-07-23 14:07:29.000000000 +0200
|
||||
@@ -490,9 +490,9 @@ DESCRIPTION
|
||||
|
||||
SyslogFacility
|
||||
Gives the facility code that is used when logging messages from
|
||||
- sshd(8). The possible values are: DAEMON, USER, AUTH, LOCAL0,
|
||||
- LOCAL1, LOCAL2, LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7. The de-
|
||||
- fault is AUTH.
|
||||
+ sshd(8). The possible values are: DAEMON, USER, AUTH, AUTHPRIV,
|
||||
+ LOCAL0, LOCAL1, LOCAL2, LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.
|
||||
+ The default is AUTH.
|
||||
|
||||
TCPKeepAlive
|
||||
Specifies whether the system should send TCP keepalive messages
|
||||
diff -up openssh-5.1p1/sshd_config.5.redhat openssh-5.1p1/sshd_config.5
|
||||
--- openssh-5.1p1/sshd_config.5.redhat 2008-07-02 14:35:43.000000000 +0200
|
||||
+++ openssh-5.1p1/sshd_config.5 2008-07-23 14:07:29.000000000 +0200
|
||||
@@ -846,7 +846,7 @@ Note that this option applies to protoco
|
||||
.It Cm SyslogFacility
|
||||
Gives the facility code that is used when logging messages from
|
||||
.Xr sshd 8 .
|
||||
-The possible values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2,
|
||||
+The possible values are: DAEMON, USER, AUTH, AUTHPRIV, LOCAL0, LOCAL1, LOCAL2,
|
||||
LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.
|
||||
The default is AUTH.
|
||||
.It Cm TCPKeepAlive
|
||||
@@ -100,6 +112,7 @@ Protocol 2
|
||||
#Compression delayed
|
||||
#ClientAliveInterval 0
|
||||
#ClientAliveCountMax 3
|
||||
+#ShowPatchLevel no
|
||||
#UseDNS yes
|
||||
#PidFile /var/run/sshd.pid
|
||||
#MaxStartups 10
|
771
openssh-5.2p1-selinux.patch
Normal file
771
openssh-5.2p1-selinux.patch
Normal file
@ -0,0 +1,771 @@
|
||||
diff -up openssh-5.2p1/auth1.c.selinux openssh-5.2p1/auth1.c
|
||||
--- openssh-5.2p1/auth1.c.selinux 2009-03-10 03:51:54.813223420 +0100
|
||||
+++ openssh-5.2p1/auth1.c 2009-03-10 03:51:55.045214236 +0100
|
||||
@@ -391,7 +391,7 @@ void
|
||||
do_authentication(Authctxt *authctxt)
|
||||
{
|
||||
u_int ulen;
|
||||
- char *user, *style = NULL;
|
||||
+ char *user, *style = NULL, *role=NULL;
|
||||
|
||||
/* Get the name of the user that we wish to log in as. */
|
||||
packet_read_expect(SSH_CMSG_USER);
|
||||
@@ -400,11 +400,19 @@ do_authentication(Authctxt *authctxt)
|
||||
user = packet_get_string(&ulen);
|
||||
packet_check_eom();
|
||||
|
||||
+ if ((role = strchr(user, '/')) != NULL)
|
||||
+ *role++ = '\0';
|
||||
+
|
||||
if ((style = strchr(user, ':')) != NULL)
|
||||
*style++ = '\0';
|
||||
+ else
|
||||
+ if (role && (style = strchr(role, ':')) != NULL)
|
||||
+ *style++ = '\0';
|
||||
+
|
||||
|
||||
authctxt->user = user;
|
||||
authctxt->style = style;
|
||||
+ authctxt->role = role;
|
||||
|
||||
/* Verify that the user is a valid user. */
|
||||
if ((authctxt->pw = PRIVSEP(getpwnamallow(user))) != NULL)
|
||||
diff -up openssh-5.2p1/auth2.c.selinux openssh-5.2p1/auth2.c
|
||||
--- openssh-5.2p1/auth2.c.selinux 2008-11-05 06:20:46.000000000 +0100
|
||||
+++ openssh-5.2p1/auth2.c 2009-03-10 03:51:55.071216534 +0100
|
||||
@@ -215,7 +215,7 @@ input_userauth_request(int type, u_int32
|
||||
{
|
||||
Authctxt *authctxt = ctxt;
|
||||
Authmethod *m = NULL;
|
||||
- char *user, *service, *method, *style = NULL;
|
||||
+ char *user, *service, *method, *style = NULL, *role = NULL;
|
||||
int authenticated = 0;
|
||||
|
||||
if (authctxt == NULL)
|
||||
@@ -227,6 +227,9 @@ input_userauth_request(int type, u_int32
|
||||
debug("userauth-request for user %s service %s method %s", user, service, method);
|
||||
debug("attempt %d failures %d", authctxt->attempt, authctxt->failures);
|
||||
|
||||
+ if ((role = strchr(user, '/')) != NULL)
|
||||
+ *role++ = 0;
|
||||
+
|
||||
if ((style = strchr(user, ':')) != NULL)
|
||||
*style++ = 0;
|
||||
|
||||
@@ -252,8 +255,11 @@ input_userauth_request(int type, u_int32
|
||||
use_privsep ? " [net]" : "");
|
||||
authctxt->service = xstrdup(service);
|
||||
authctxt->style = style ? xstrdup(style) : NULL;
|
||||
- if (use_privsep)
|
||||
+ authctxt->role = role ? xstrdup(role) : NULL;
|
||||
+ if (use_privsep) {
|
||||
mm_inform_authserv(service, style);
|
||||
+ mm_inform_authrole(role);
|
||||
+ }
|
||||
userauth_banner();
|
||||
} else if (strcmp(user, authctxt->user) != 0 ||
|
||||
strcmp(service, authctxt->service) != 0) {
|
||||
diff -up openssh-5.2p1/auth2-hostbased.c.selinux openssh-5.2p1/auth2-hostbased.c
|
||||
--- openssh-5.2p1/auth2-hostbased.c.selinux 2008-07-17 10:57:19.000000000 +0200
|
||||
+++ openssh-5.2p1/auth2-hostbased.c 2009-03-10 03:51:55.052265447 +0100
|
||||
@@ -106,7 +106,14 @@ userauth_hostbased(Authctxt *authctxt)
|
||||
buffer_put_string(&b, session_id2, session_id2_len);
|
||||
/* reconstruct packet */
|
||||
buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
|
||||
- buffer_put_cstring(&b, authctxt->user);
|
||||
+ if (authctxt->role) {
|
||||
+ buffer_put_int(&b, strlen(authctxt->user)+strlen(authctxt->role)+1);
|
||||
+ buffer_append(&b, authctxt->user, strlen(authctxt->user));
|
||||
+ buffer_put_char(&b, '/');
|
||||
+ buffer_append(&b, authctxt->role, strlen(authctxt->role));
|
||||
+ } else {
|
||||
+ buffer_put_cstring(&b, authctxt->user);
|
||||
+ }
|
||||
buffer_put_cstring(&b, service);
|
||||
buffer_put_cstring(&b, "hostbased");
|
||||
buffer_put_string(&b, pkalg, alen);
|
||||
diff -up openssh-5.2p1/auth2-pubkey.c.selinux openssh-5.2p1/auth2-pubkey.c
|
||||
--- openssh-5.2p1/auth2-pubkey.c.selinux 2008-07-04 04:54:25.000000000 +0200
|
||||
+++ openssh-5.2p1/auth2-pubkey.c 2009-03-10 03:51:56.174214480 +0100
|
||||
@@ -33,6 +33,7 @@
|
||||
#include <stdio.h>
|
||||
#include <stdarg.h>
|
||||
#include <unistd.h>
|
||||
+#include <openssl/fips.h>
|
||||
|
||||
#include "xmalloc.h"
|
||||
#include "ssh.h"
|
||||
@@ -117,7 +118,14 @@ userauth_pubkey(Authctxt *authctxt)
|
||||
}
|
||||
/* reconstruct packet */
|
||||
buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
|
||||
- buffer_put_cstring(&b, authctxt->user);
|
||||
+ if (authctxt->role) {
|
||||
+ buffer_put_int(&b, strlen(authctxt->user)+strlen(authctxt->role)+1);
|
||||
+ buffer_append(&b, authctxt->user, strlen(authctxt->user));
|
||||
+ buffer_put_char(&b, '/');
|
||||
+ buffer_append(&b, authctxt->role, strlen(authctxt->role));
|
||||
+ } else {
|
||||
+ buffer_put_cstring(&b, authctxt->user);
|
||||
+ }
|
||||
buffer_put_cstring(&b,
|
||||
datafellows & SSH_BUG_PKSERVICE ?
|
||||
"ssh-userauth" :
|
||||
@@ -236,7 +244,7 @@ user_key_allowed2(struct passwd *pw, Key
|
||||
found_key = 1;
|
||||
debug("matching key found: file %s, line %lu",
|
||||
file, linenum);
|
||||
- fp = key_fingerprint(found, SSH_FP_MD5, SSH_FP_HEX);
|
||||
+ fp = key_fingerprint(found, FIPS_mode() ? SSH_FP_SHA1 : SSH_FP_MD5, SSH_FP_HEX);
|
||||
verbose("Found matching %s key: %s",
|
||||
key_type(found), fp);
|
||||
xfree(fp);
|
||||
diff -up openssh-5.2p1/auth.h.selinux openssh-5.2p1/auth.h
|
||||
--- openssh-5.2p1/auth.h.selinux 2008-11-05 06:20:46.000000000 +0100
|
||||
+++ openssh-5.2p1/auth.h 2009-03-10 03:51:55.069276014 +0100
|
||||
@@ -58,6 +58,7 @@ struct Authctxt {
|
||||
char *service;
|
||||
struct passwd *pw; /* set if 'valid' */
|
||||
char *style;
|
||||
+ char *role;
|
||||
void *kbdintctxt;
|
||||
void *jpake_ctx;
|
||||
#ifdef BSD_AUTH
|
||||
diff -up openssh-5.2p1/configure.ac.selinux openssh-5.2p1/configure.ac
|
||||
--- openssh-5.2p1/configure.ac.selinux 2009-03-10 03:51:54.901396765 +0100
|
||||
+++ openssh-5.2p1/configure.ac 2009-03-10 03:51:55.850215090 +0100
|
||||
@@ -3335,11 +3335,25 @@ AC_ARG_WITH(selinux,
|
||||
AC_CHECK_LIB(selinux, setexeccon, [ LIBSELINUX="-lselinux" ],
|
||||
AC_MSG_ERROR(SELinux support requires libselinux library))
|
||||
SSHDLIBS="$SSHDLIBS $LIBSELINUX"
|
||||
+ LIBS="$LIBS $LIBSELINUX"
|
||||
AC_CHECK_FUNCS(getseuserbyname get_default_context_with_level)
|
||||
+ AC_CHECK_FUNCS(setkeycreatecon)
|
||||
LIBS="$save_LIBS"
|
||||
fi ]
|
||||
)
|
||||
|
||||
+# Check whether user wants Linux audit support
|
||||
+LINUX_AUDIT_MSG="no"
|
||||
+AC_ARG_WITH(linux-audit,
|
||||
+ [ --with-linux-audit Enable Linux audit support],
|
||||
+ [ if test "x$withval" != "xno" ; then
|
||||
+ AC_DEFINE(HAVE_LINUX_AUDIT,1,[Define if you want Linux audit support.])
|
||||
+ LINUX_AUDIT_MSG="yes"
|
||||
+ AC_CHECK_HEADERS(libaudit.h)
|
||||
+ SSHDLIBS="$SSHDLIBS -laudit"
|
||||
+ fi ]
|
||||
+)
|
||||
+
|
||||
# Check whether user wants Kerberos 5 support
|
||||
KRB5_MSG="no"
|
||||
AC_ARG_WITH(kerberos5,
|
||||
@@ -3448,6 +3462,20 @@ AC_ARG_WITH(kerberos5,
|
||||
]
|
||||
)
|
||||
|
||||
+# Check whether user wants NSS support
|
||||
+LIBNSS_MSG="no"
|
||||
+AC_ARG_WITH(nss,
|
||||
+ [ --with-nss Enable NSS support],
|
||||
+ [ if test "x$withval" != "xno" ; then
|
||||
+ AC_DEFINE(HAVE_LIBNSS,1,[Define if you want NSS support.])
|
||||
+ LIBNSS_MSG="yes"
|
||||
+ CPPFLAGS="$CPPFLAGS -I/usr/include/nss3 -I/usr/include/nspr4"
|
||||
+ AC_CHECK_HEADERS(pk11pub.h)
|
||||
+ LIBS="$LIBS -lnss3"
|
||||
+ fi
|
||||
+ ])
|
||||
+AC_SUBST(LIBNSS)
|
||||
+
|
||||
# Looking for programs, paths and files
|
||||
|
||||
PRIVSEP_PATH=/var/empty
|
||||
@@ -4168,12 +4196,14 @@ echo " PAM support
|
||||
echo " OSF SIA support: $SIA_MSG"
|
||||
echo " KerberosV support: $KRB5_MSG"
|
||||
echo " SELinux support: $SELINUX_MSG"
|
||||
+echo " Linux audit support: $LINUX_AUDIT_MSG"
|
||||
echo " Smartcard support: $SCARD_MSG"
|
||||
echo " S/KEY support: $SKEY_MSG"
|
||||
echo " TCP Wrappers support: $TCPW_MSG"
|
||||
echo " MD5 password support: $MD5_MSG"
|
||||
echo " libedit support: $LIBEDIT_MSG"
|
||||
echo " Solaris process contract support: $SPC_MSG"
|
||||
+echo " NSS support: $LIBNSS_MSG"
|
||||
echo " IP address in \$DISPLAY hack: $DISPLAY_HACK_MSG"
|
||||
echo " Translate v4 in v6 hack: $IPV4_IN6_HACK_MSG"
|
||||
echo " BSD Auth support: $BSD_AUTH_MSG"
|
||||
diff -up openssh-5.2p1/monitor.c.selinux openssh-5.2p1/monitor.c
|
||||
--- openssh-5.2p1/monitor.c.selinux 2009-02-14 06:33:31.000000000 +0100
|
||||
+++ openssh-5.2p1/monitor.c 2009-03-10 03:51:55.099559692 +0100
|
||||
@@ -135,6 +135,7 @@ int mm_answer_sign(int, Buffer *);
|
||||
int mm_answer_pwnamallow(int, Buffer *);
|
||||
int mm_answer_auth2_read_banner(int, Buffer *);
|
||||
int mm_answer_authserv(int, Buffer *);
|
||||
+int mm_answer_authrole(int, Buffer *);
|
||||
int mm_answer_authpassword(int, Buffer *);
|
||||
int mm_answer_bsdauthquery(int, Buffer *);
|
||||
int mm_answer_bsdauthrespond(int, Buffer *);
|
||||
@@ -211,6 +212,7 @@ struct mon_table mon_dispatch_proto20[]
|
||||
{MONITOR_REQ_SIGN, MON_ONCE, mm_answer_sign},
|
||||
{MONITOR_REQ_PWNAM, MON_ONCE, mm_answer_pwnamallow},
|
||||
{MONITOR_REQ_AUTHSERV, MON_ONCE, mm_answer_authserv},
|
||||
+ {MONITOR_REQ_AUTHROLE, MON_ONCE, mm_answer_authrole},
|
||||
{MONITOR_REQ_AUTH2_READ_BANNER, MON_ONCE, mm_answer_auth2_read_banner},
|
||||
{MONITOR_REQ_AUTHPASSWORD, MON_AUTH, mm_answer_authpassword},
|
||||
#ifdef USE_PAM
|
||||
@@ -680,6 +682,7 @@ mm_answer_pwnamallow(int sock, Buffer *m
|
||||
else {
|
||||
/* Allow service/style information on the auth context */
|
||||
monitor_permit(mon_dispatch, MONITOR_REQ_AUTHSERV, 1);
|
||||
+ monitor_permit(mon_dispatch, MONITOR_REQ_AUTHROLE, 1);
|
||||
monitor_permit(mon_dispatch, MONITOR_REQ_AUTH2_READ_BANNER, 1);
|
||||
}
|
||||
|
||||
@@ -725,6 +728,23 @@ mm_answer_authserv(int sock, Buffer *m)
|
||||
}
|
||||
|
||||
int
|
||||
+mm_answer_authrole(int sock, Buffer *m)
|
||||
+{
|
||||
+ monitor_permit_authentications(1);
|
||||
+
|
||||
+ authctxt->role = buffer_get_string(m, NULL);
|
||||
+ debug3("%s: role=%s",
|
||||
+ __func__, authctxt->role);
|
||||
+
|
||||
+ if (strlen(authctxt->role) == 0) {
|
||||
+ xfree(authctxt->role);
|
||||
+ authctxt->role = NULL;
|
||||
+ }
|
||||
+
|
||||
+ return (0);
|
||||
+}
|
||||
+
|
||||
+int
|
||||
mm_answer_authpassword(int sock, Buffer *m)
|
||||
{
|
||||
static int call_count;
|
||||
@@ -1102,7 +1122,7 @@ static int
|
||||
monitor_valid_userblob(u_char *data, u_int datalen)
|
||||
{
|
||||
Buffer b;
|
||||
- char *p;
|
||||
+ char *p, *r;
|
||||
u_int len;
|
||||
int fail = 0;
|
||||
|
||||
@@ -1128,6 +1148,8 @@ monitor_valid_userblob(u_char *data, u_i
|
||||
if (buffer_get_char(&b) != SSH2_MSG_USERAUTH_REQUEST)
|
||||
fail++;
|
||||
p = buffer_get_string(&b, NULL);
|
||||
+ if ((r = strchr(p, '/')) != NULL)
|
||||
+ *r = '\0';
|
||||
if (strcmp(authctxt->user, p) != 0) {
|
||||
logit("wrong user name passed to monitor: expected %s != %.100s",
|
||||
authctxt->user, p);
|
||||
@@ -1159,7 +1181,7 @@ monitor_valid_hostbasedblob(u_char *data
|
||||
char *chost)
|
||||
{
|
||||
Buffer b;
|
||||
- char *p;
|
||||
+ char *p, *r;
|
||||
u_int len;
|
||||
int fail = 0;
|
||||
|
||||
@@ -1176,6 +1198,8 @@ monitor_valid_hostbasedblob(u_char *data
|
||||
if (buffer_get_char(&b) != SSH2_MSG_USERAUTH_REQUEST)
|
||||
fail++;
|
||||
p = buffer_get_string(&b, NULL);
|
||||
+ if ((r = strchr(p, '/')) != NULL)
|
||||
+ *r = '\0';
|
||||
if (strcmp(authctxt->user, p) != 0) {
|
||||
logit("wrong user name passed to monitor: expected %s != %.100s",
|
||||
authctxt->user, p);
|
||||
diff -up openssh-5.2p1/monitor.h.selinux openssh-5.2p1/monitor.h
|
||||
--- openssh-5.2p1/monitor.h.selinux 2008-11-05 06:20:46.000000000 +0100
|
||||
+++ openssh-5.2p1/monitor.h 2009-03-10 03:51:55.050519421 +0100
|
||||
@@ -30,7 +30,7 @@
|
||||
|
||||
enum monitor_reqtype {
|
||||
MONITOR_REQ_MODULI, MONITOR_ANS_MODULI,
|
||||
- MONITOR_REQ_FREE, MONITOR_REQ_AUTHSERV,
|
||||
+ MONITOR_REQ_FREE, MONITOR_REQ_AUTHSERV,MONITOR_REQ_AUTHROLE,
|
||||
MONITOR_REQ_SIGN, MONITOR_ANS_SIGN,
|
||||
MONITOR_REQ_PWNAM, MONITOR_ANS_PWNAM,
|
||||
MONITOR_REQ_AUTH2_READ_BANNER, MONITOR_ANS_AUTH2_READ_BANNER,
|
||||
diff -up openssh-5.2p1/monitor_wrap.c.selinux openssh-5.2p1/monitor_wrap.c
|
||||
--- openssh-5.2p1/monitor_wrap.c.selinux 2008-11-05 06:20:47.000000000 +0100
|
||||
+++ openssh-5.2p1/monitor_wrap.c 2009-03-10 03:51:55.066210099 +0100
|
||||
@@ -297,6 +297,23 @@ mm_inform_authserv(char *service, char *
|
||||
buffer_free(&m);
|
||||
}
|
||||
|
||||
+/* Inform the privileged process about role */
|
||||
+
|
||||
+void
|
||||
+mm_inform_authrole(char *role)
|
||||
+{
|
||||
+ Buffer m;
|
||||
+
|
||||
+ debug3("%s entering", __func__);
|
||||
+
|
||||
+ buffer_init(&m);
|
||||
+ buffer_put_cstring(&m, role ? role : "");
|
||||
+
|
||||
+ mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUTHROLE, &m);
|
||||
+
|
||||
+ buffer_free(&m);
|
||||
+}
|
||||
+
|
||||
/* Do the password authentication */
|
||||
int
|
||||
mm_auth_password(Authctxt *authctxt, char *password)
|
||||
diff -up openssh-5.2p1/monitor_wrap.h.selinux openssh-5.2p1/monitor_wrap.h
|
||||
--- openssh-5.2p1/monitor_wrap.h.selinux 2008-11-05 06:20:47.000000000 +0100
|
||||
+++ openssh-5.2p1/monitor_wrap.h 2009-03-10 03:51:55.048731957 +0100
|
||||
@@ -41,6 +41,7 @@ int mm_is_monitor(void);
|
||||
DH *mm_choose_dh(int, int, int);
|
||||
int mm_key_sign(Key *, u_char **, u_int *, u_char *, u_int);
|
||||
void mm_inform_authserv(char *, char *);
|
||||
+void mm_inform_authrole(char *);
|
||||
struct passwd *mm_getpwnamallow(const char *);
|
||||
char *mm_auth2_read_banner(void);
|
||||
int mm_auth_password(struct Authctxt *, char *);
|
||||
diff -up openssh-5.2p1/openbsd-compat/port-linux.c.selinux openssh-5.2p1/openbsd-compat/port-linux.c
|
||||
--- openssh-5.2p1/openbsd-compat/port-linux.c.selinux 2008-03-26 21:27:21.000000000 +0100
|
||||
+++ openssh-5.2p1/openbsd-compat/port-linux.c 2009-03-10 03:51:55.407292576 +0100
|
||||
@@ -30,10 +30,28 @@
|
||||
#ifdef WITH_SELINUX
|
||||
#include "log.h"
|
||||
#include "port-linux.h"
|
||||
+#include "key.h"
|
||||
+#include "hostfile.h"
|
||||
+#include "auth.h"
|
||||
+#include "xmalloc.h"
|
||||
+#include "servconf.h"
|
||||
|
||||
#include <selinux/selinux.h>
|
||||
#include <selinux/flask.h>
|
||||
+#include <selinux/context.h>
|
||||
#include <selinux/get_context_list.h>
|
||||
+#include <selinux/get_default_type.h>
|
||||
+#include <selinux/av_permissions.h>
|
||||
+
|
||||
+#ifdef HAVE_LINUX_AUDIT
|
||||
+#include <libaudit.h>
|
||||
+#include <unistd.h>
|
||||
+#endif
|
||||
+
|
||||
+extern ServerOptions options;
|
||||
+extern Authctxt *the_authctxt;
|
||||
+extern int inetd_flag;
|
||||
+extern int rexeced_flag;
|
||||
|
||||
/* Wrapper around is_selinux_enabled() to log its return value once only */
|
||||
int
|
||||
@@ -49,42 +67,245 @@ ssh_selinux_enabled(void)
|
||||
return (enabled);
|
||||
}
|
||||
|
||||
+/* Send audit message */
|
||||
+static int
|
||||
+send_audit_message(int success, security_context_t default_context,
|
||||
+ security_context_t selected_context)
|
||||
+{
|
||||
+ int rc=0;
|
||||
+#ifdef HAVE_LINUX_AUDIT
|
||||
+ char *msg = NULL;
|
||||
+ int audit_fd = audit_open();
|
||||
+ security_context_t default_raw=NULL;
|
||||
+ security_context_t selected_raw=NULL;
|
||||
+ rc = -1;
|
||||
+ if (audit_fd < 0) {
|
||||
+ if (errno == EINVAL || errno == EPROTONOSUPPORT ||
|
||||
+ errno == EAFNOSUPPORT)
|
||||
+ return 0; /* No audit support in kernel */
|
||||
+ error("Error connecting to audit system.");
|
||||
+ return rc;
|
||||
+ }
|
||||
+ if (selinux_trans_to_raw_context(default_context, &default_raw) < 0) {
|
||||
+ error("Error translating default context.");
|
||||
+ default_raw = NULL;
|
||||
+ }
|
||||
+ if (selinux_trans_to_raw_context(selected_context, &selected_raw) < 0) {
|
||||
+ error("Error translating selected context.");
|
||||
+ selected_raw = NULL;
|
||||
+ }
|
||||
+ if (asprintf(&msg, "sshd: default-context=%s selected-context=%s",
|
||||
+ default_raw ? default_raw : (default_context ? default_context: "?"),
|
||||
+ selected_context ? selected_raw : (selected_context ? selected_context :"?")) < 0) {
|
||||
+ error("Error allocating memory.");
|
||||
+ goto out;
|
||||
+ }
|
||||
+ if (audit_log_user_message(audit_fd, AUDIT_USER_ROLE_CHANGE,
|
||||
+ msg, NULL, NULL, NULL, success) <= 0) {
|
||||
+ error("Error sending audit message.");
|
||||
+ goto out;
|
||||
+ }
|
||||
+ rc = 0;
|
||||
+ out:
|
||||
+ free(msg);
|
||||
+ freecon(default_raw);
|
||||
+ freecon(selected_raw);
|
||||
+ close(audit_fd);
|
||||
+#endif
|
||||
+ return rc;
|
||||
+}
|
||||
+
|
||||
+static int
|
||||
+mls_range_allowed(security_context_t src, security_context_t dst)
|
||||
+{
|
||||
+ struct av_decision avd;
|
||||
+ int retval;
|
||||
+ unsigned int bit = CONTEXT__CONTAINS;
|
||||
+
|
||||
+ debug("%s: src:%s dst:%s", __func__, src, dst);
|
||||
+ retval = security_compute_av(src, dst, SECCLASS_CONTEXT, bit, &avd);
|
||||
+ if (retval || ((bit & avd.allowed) != bit))
|
||||
+ return 0;
|
||||
+
|
||||
+ return 1;
|
||||
+}
|
||||
+
|
||||
+static int
|
||||
+get_user_context(const char *sename, const char *role, const char *lvl,
|
||||
+ security_context_t *sc) {
|
||||
+#ifdef HAVE_GET_DEFAULT_CONTEXT_WITH_LEVEL
|
||||
+ if (lvl == NULL || lvl[0] == '\0' || get_default_context_with_level(sename, lvl, NULL, sc) != 0) {
|
||||
+ /* User may have requested a level completely outside of his
|
||||
+ allowed range. We get a context just for auditing as the
|
||||
+ range check below will certainly fail for default context. */
|
||||
+#endif
|
||||
+ if (get_default_context(sename, NULL, sc) != 0) {
|
||||
+ *sc = NULL;
|
||||
+ return -1;
|
||||
+ }
|
||||
+#ifdef HAVE_GET_DEFAULT_CONTEXT_WITH_LEVEL
|
||||
+ }
|
||||
+#endif
|
||||
+ if (role != NULL && role[0]) {
|
||||
+ context_t con;
|
||||
+ char *type=NULL;
|
||||
+ if (get_default_type(role, &type) != 0) {
|
||||
+ error("get_default_type: failed to get default type for '%s'",
|
||||
+ role);
|
||||
+ goto out;
|
||||
+ }
|
||||
+ con = context_new(*sc);
|
||||
+ if (!con) {
|
||||
+ goto out;
|
||||
+ }
|
||||
+ context_role_set(con, role);
|
||||
+ context_type_set(con, type);
|
||||
+ freecon(*sc);
|
||||
+ *sc = strdup(context_str(con));
|
||||
+ context_free(con);
|
||||
+ if (!*sc)
|
||||
+ return -1;
|
||||
+ }
|
||||
+#ifdef HAVE_GET_DEFAULT_CONTEXT_WITH_LEVEL
|
||||
+ if (lvl != NULL && lvl[0]) {
|
||||
+ /* verify that the requested range is obtained */
|
||||
+ context_t con;
|
||||
+ security_context_t obtained_raw;
|
||||
+ security_context_t requested_raw;
|
||||
+ con = context_new(*sc);
|
||||
+ if (!con) {
|
||||
+ goto out;
|
||||
+ }
|
||||
+ context_range_set(con, lvl);
|
||||
+ if (selinux_trans_to_raw_context(*sc, &obtained_raw) < 0) {
|
||||
+ context_free(con);
|
||||
+ goto out;
|
||||
+ }
|
||||
+ if (selinux_trans_to_raw_context(context_str(con), &requested_raw) < 0) {
|
||||
+ freecon(obtained_raw);
|
||||
+ context_free(con);
|
||||
+ goto out;
|
||||
+ }
|
||||
+
|
||||
+ debug("get_user_context: obtained context '%s' requested context '%s'",
|
||||
+ obtained_raw, requested_raw);
|
||||
+ if (strcmp(obtained_raw, requested_raw)) {
|
||||
+ /* set the context to the real requested one but fail */
|
||||
+ freecon(requested_raw);
|
||||
+ freecon(obtained_raw);
|
||||
+ freecon(*sc);
|
||||
+ *sc = strdup(context_str(con));
|
||||
+ context_free(con);
|
||||
+ return -1;
|
||||
+ }
|
||||
+ freecon(requested_raw);
|
||||
+ freecon(obtained_raw);
|
||||
+ context_free(con);
|
||||
+ }
|
||||
+#endif
|
||||
+ return 0;
|
||||
+ out:
|
||||
+ freecon(*sc);
|
||||
+ *sc = NULL;
|
||||
+ return -1;
|
||||
+}
|
||||
+
|
||||
+static void
|
||||
+ssh_selinux_get_role_level(char **role, const char **level)
|
||||
+{
|
||||
+ *role = NULL;
|
||||
+ *level = NULL;
|
||||
+ if (the_authctxt) {
|
||||
+ if (the_authctxt->role != NULL) {
|
||||
+ char *slash;
|
||||
+ *role = xstrdup(the_authctxt->role);
|
||||
+ if ((slash = strchr(*role, '/')) != NULL) {
|
||||
+ *slash = '\0';
|
||||
+ *level = slash + 1;
|
||||
+ }
|
||||
+ }
|
||||
+ }
|
||||
+}
|
||||
+
|
||||
/* Return the default security context for the given username */
|
||||
-static security_context_t
|
||||
-ssh_selinux_getctxbyname(char *pwname)
|
||||
+static int
|
||||
+ssh_selinux_getctxbyname(char *pwname,
|
||||
+ security_context_t *default_sc, security_context_t *user_sc)
|
||||
{
|
||||
- security_context_t sc;
|
||||
- char *sename = NULL, *lvl = NULL;
|
||||
- int r;
|
||||
+ char *sename, *lvl;
|
||||
+ const char *reqlvl;
|
||||
+ char *role;
|
||||
+ int r = -1;
|
||||
+ context_t con = NULL;
|
||||
+
|
||||
+ *default_sc = NULL;
|
||||
+ *user_sc = NULL;
|
||||
+
|
||||
+ ssh_selinux_get_role_level(&role, &reqlvl);
|
||||
|
||||
#ifdef HAVE_GETSEUSERBYNAME
|
||||
- if (getseuserbyname(pwname, &sename, &lvl) != 0)
|
||||
- return NULL;
|
||||
+ if ((r=getseuserbyname(pwname, &sename, &lvl)) != 0) {
|
||||
+ sename = NULL;
|
||||
+ lvl = NULL;
|
||||
+ }
|
||||
#else
|
||||
sename = pwname;
|
||||
- lvl = NULL;
|
||||
+ lvl = "";
|
||||
#endif
|
||||
|
||||
+ if (r == 0) {
|
||||
#ifdef HAVE_GET_DEFAULT_CONTEXT_WITH_LEVEL
|
||||
- r = get_default_context_with_level(sename, lvl, NULL, &sc);
|
||||
+ r = get_default_context_with_level(sename, lvl, NULL, default_sc);
|
||||
#else
|
||||
- r = get_default_context(sename, NULL, &sc);
|
||||
+ r = get_default_context(sename, NULL, default_sc);
|
||||
#endif
|
||||
+ }
|
||||
|
||||
- if (r != 0) {
|
||||
- switch (security_getenforce()) {
|
||||
- case -1:
|
||||
- fatal("%s: ssh_selinux_getctxbyname: "
|
||||
- "security_getenforce() failed", __func__);
|
||||
- case 0:
|
||||
- error("%s: Failed to get default SELinux security "
|
||||
- "context for %s", __func__, pwname);
|
||||
- break;
|
||||
- default:
|
||||
- fatal("%s: Failed to get default SELinux security "
|
||||
- "context for %s (in enforcing mode)",
|
||||
- __func__, pwname);
|
||||
+ if (r == 0) {
|
||||
+ /* If launched from xinetd, we must use current level */
|
||||
+ if (inetd_flag && !rexeced_flag) {
|
||||
+ security_context_t sshdsc=NULL;
|
||||
+
|
||||
+ if (getcon_raw(&sshdsc) < 0)
|
||||
+ fatal("failed to allocate security context");
|
||||
+
|
||||
+ if ((con=context_new(sshdsc)) == NULL)
|
||||
+ fatal("failed to allocate selinux context");
|
||||
+ reqlvl = context_range_get(con);
|
||||
+ freecon(sshdsc);
|
||||
+ if (reqlvl !=NULL && lvl != NULL && strcmp(reqlvl, lvl) == 0)
|
||||
+ /* we actually don't change level */
|
||||
+ reqlvl = "";
|
||||
+
|
||||
+ debug("%s: current connection level '%s'", __func__, reqlvl);
|
||||
}
|
||||
+
|
||||
+ if ((reqlvl != NULL && reqlvl[0]) || (role != NULL && role[0])) {
|
||||
+ r = get_user_context(sename, role, reqlvl, user_sc);
|
||||
+
|
||||
+ if (r == 0 && reqlvl != NULL && reqlvl[0]) {
|
||||
+ security_context_t default_level_sc = *default_sc;
|
||||
+ if (role != NULL && role[0]) {
|
||||
+ if (get_user_context(sename, role, lvl, &default_level_sc) < 0)
|
||||
+ default_level_sc = *default_sc;
|
||||
+ }
|
||||
+ /* verify that the requested range is contained in the user range */
|
||||
+ if (mls_range_allowed(default_level_sc, *user_sc)) {
|
||||
+ logit("permit MLS level %s (user range %s)", reqlvl, lvl);
|
||||
+ } else {
|
||||
+ r = -1;
|
||||
+ error("deny MLS level %s (user range %s)", reqlvl, lvl);
|
||||
+ }
|
||||
+ if (default_level_sc != *default_sc)
|
||||
+ freecon(default_level_sc);
|
||||
+ }
|
||||
+ } else {
|
||||
+ *user_sc = *default_sc;
|
||||
+ }
|
||||
+ }
|
||||
+ if (r != 0) {
|
||||
+ error("%s: Failed to get default SELinux security "
|
||||
+ "context for %s", __func__, pwname);
|
||||
}
|
||||
|
||||
#ifdef HAVE_GETSEUSERBYNAME
|
||||
@@ -93,37 +314,114 @@ ssh_selinux_getctxbyname(char *pwname)
|
||||
if (lvl != NULL)
|
||||
xfree(lvl);
|
||||
#endif
|
||||
+ if (role != NULL)
|
||||
+ xfree(role);
|
||||
+ if (con)
|
||||
+ context_free(con);
|
||||
|
||||
- return (sc);
|
||||
+ return (r);
|
||||
+}
|
||||
+
|
||||
+/* Setup environment variables for pam_selinux */
|
||||
+static int
|
||||
+ssh_selinux_setup_pam_variables(void)
|
||||
+{
|
||||
+ const char *reqlvl;
|
||||
+ char *role;
|
||||
+ char *use_current;
|
||||
+ int rv;
|
||||
+
|
||||
+ debug3("%s: setting execution context", __func__);
|
||||
+
|
||||
+ ssh_selinux_get_role_level(&role, &reqlvl);
|
||||
+
|
||||
+ rv = do_pam_putenv("SELINUX_ROLE_REQUESTED", role ? role : "");
|
||||
+
|
||||
+ if (inetd_flag && !rexeced_flag) {
|
||||
+ use_current = "1";
|
||||
+ } else {
|
||||
+ use_current = "";
|
||||
+ rv = rv || do_pam_putenv("SELINUX_LEVEL_REQUESTED", reqlvl ? reqlvl: "");
|
||||
+ }
|
||||
+
|
||||
+ rv = rv || do_pam_putenv("SELINUX_USE_CURRENT_RANGE", use_current);
|
||||
+
|
||||
+ if (role != NULL)
|
||||
+ xfree(role);
|
||||
+
|
||||
+ return rv;
|
||||
}
|
||||
|
||||
/* Set the execution context to the default for the specified user */
|
||||
void
|
||||
ssh_selinux_setup_exec_context(char *pwname)
|
||||
{
|
||||
+ int r = 0;
|
||||
+ security_context_t default_ctx = NULL;
|
||||
security_context_t user_ctx = NULL;
|
||||
|
||||
if (!ssh_selinux_enabled())
|
||||
return;
|
||||
|
||||
+ if (options.use_pam) {
|
||||
+ /* do not compute context, just setup environment for pam_selinux */
|
||||
+ if (ssh_selinux_setup_pam_variables()) {
|
||||
+ switch (security_getenforce()) {
|
||||
+ case -1:
|
||||
+ fatal("%s: security_getenforce() failed", __func__);
|
||||
+ case 0:
|
||||
+ error("%s: SELinux PAM variable setup failure. Continuing in permissive mode.",
|
||||
+ __func__);
|
||||
+ break;
|
||||
+ default:
|
||||
+ fatal("%s: SELinux PAM variable setup failure. Aborting connection.",
|
||||
+ __func__);
|
||||
+ }
|
||||
+ }
|
||||
+ return;
|
||||
+ }
|
||||
+
|
||||
debug3("%s: setting execution context", __func__);
|
||||
|
||||
- user_ctx = ssh_selinux_getctxbyname(pwname);
|
||||
- if (setexeccon(user_ctx) != 0) {
|
||||
+ r = ssh_selinux_getctxbyname(pwname, &default_ctx, &user_ctx);
|
||||
+ if (r >= 0) {
|
||||
+ r = setexeccon(user_ctx);
|
||||
+ if (r < 0) {
|
||||
+ error("%s: Failed to set SELinux execution context %s for %s",
|
||||
+ __func__, user_ctx, pwname);
|
||||
+ }
|
||||
+#ifdef HAVE_SETKEYCREATECON
|
||||
+ else if (setkeycreatecon(user_ctx) < 0) {
|
||||
+ error("%s: Failed to set SELinux keyring creation context %s for %s",
|
||||
+ __func__, user_ctx, pwname);
|
||||
+ }
|
||||
+#endif
|
||||
+ }
|
||||
+ if (user_ctx == NULL) {
|
||||
+ user_ctx = default_ctx;
|
||||
+ }
|
||||
+ if (r < 0 || user_ctx != default_ctx) {
|
||||
+ /* audit just the case when user changed a role or there was
|
||||
+ a failure */
|
||||
+ send_audit_message(r >= 0, default_ctx, user_ctx);
|
||||
+ }
|
||||
+ if (r < 0) {
|
||||
switch (security_getenforce()) {
|
||||
case -1:
|
||||
fatal("%s: security_getenforce() failed", __func__);
|
||||
case 0:
|
||||
- error("%s: Failed to set SELinux execution "
|
||||
- "context for %s", __func__, pwname);
|
||||
+ error("%s: SELinux failure. Continuing in permissive mode.",
|
||||
+ __func__);
|
||||
break;
|
||||
default:
|
||||
- fatal("%s: Failed to set SELinux execution context "
|
||||
- "for %s (in enforcing mode)", __func__, pwname);
|
||||
+ fatal("%s: SELinux failure. Aborting connection.",
|
||||
+ __func__);
|
||||
}
|
||||
}
|
||||
- if (user_ctx != NULL)
|
||||
+ if (user_ctx != NULL && user_ctx != default_ctx)
|
||||
freecon(user_ctx);
|
||||
+ if (default_ctx != NULL)
|
||||
+ freecon(default_ctx);
|
||||
|
||||
debug3("%s: done", __func__);
|
||||
}
|
||||
@@ -141,7 +439,10 @@ ssh_selinux_setup_pty(char *pwname, cons
|
||||
|
||||
debug3("%s: setting TTY context on %s", __func__, tty);
|
||||
|
||||
- user_ctx = ssh_selinux_getctxbyname(pwname);
|
||||
+ if (getexeccon(&user_ctx) < 0) {
|
||||
+ error("%s: getexeccon: %s", __func__, strerror(errno));
|
||||
+ goto out;
|
||||
+ }
|
||||
|
||||
/* XXX: should these calls fatal() upon failure in enforcing mode? */
|
||||
|
289
openssh-5.2p1-vendor.patch
Normal file
289
openssh-5.2p1-vendor.patch
Normal file
@ -0,0 +1,289 @@
|
||||
diff -up openssh-5.2p1/configure.ac.vendor openssh-5.2p1/configure.ac
|
||||
--- openssh-5.2p1/configure.ac.vendor 2009-03-10 03:51:54.862255585 +0100
|
||||
+++ openssh-5.2p1/configure.ac 2009-03-10 03:51:55.850215090 +0100
|
||||
@@ -3335,11 +3335,25 @@ AC_ARG_WITH(selinux,
|
||||
AC_CHECK_LIB(selinux, setexeccon, [ LIBSELINUX="-lselinux" ],
|
||||
AC_MSG_ERROR(SELinux support requires libselinux library))
|
||||
SSHDLIBS="$SSHDLIBS $LIBSELINUX"
|
||||
+ LIBS="$LIBS $LIBSELINUX"
|
||||
AC_CHECK_FUNCS(getseuserbyname get_default_context_with_level)
|
||||
+ AC_CHECK_FUNCS(setkeycreatecon)
|
||||
LIBS="$save_LIBS"
|
||||
fi ]
|
||||
)
|
||||
|
||||
+# Check whether user wants Linux audit support
|
||||
+LINUX_AUDIT_MSG="no"
|
||||
+AC_ARG_WITH(linux-audit,
|
||||
+ [ --with-linux-audit Enable Linux audit support],
|
||||
+ [ if test "x$withval" != "xno" ; then
|
||||
+ AC_DEFINE(HAVE_LINUX_AUDIT,1,[Define if you want Linux audit support.])
|
||||
+ LINUX_AUDIT_MSG="yes"
|
||||
+ AC_CHECK_HEADERS(libaudit.h)
|
||||
+ SSHDLIBS="$SSHDLIBS -laudit"
|
||||
+ fi ]
|
||||
+)
|
||||
+
|
||||
# Check whether user wants Kerberos 5 support
|
||||
KRB5_MSG="no"
|
||||
AC_ARG_WITH(kerberos5,
|
||||
@@ -3448,6 +3462,20 @@ AC_ARG_WITH(kerberos5,
|
||||
]
|
||||
)
|
||||
|
||||
+# Check whether user wants NSS support
|
||||
+LIBNSS_MSG="no"
|
||||
+AC_ARG_WITH(nss,
|
||||
+ [ --with-nss Enable NSS support],
|
||||
+ [ if test "x$withval" != "xno" ; then
|
||||
+ AC_DEFINE(HAVE_LIBNSS,1,[Define if you want NSS support.])
|
||||
+ LIBNSS_MSG="yes"
|
||||
+ CPPFLAGS="$CPPFLAGS -I/usr/include/nss3 -I/usr/include/nspr4"
|
||||
+ AC_CHECK_HEADERS(pk11pub.h)
|
||||
+ LIBS="$LIBS -lnss3"
|
||||
+ fi
|
||||
+ ])
|
||||
+AC_SUBST(LIBNSS)
|
||||
+
|
||||
# Looking for programs, paths and files
|
||||
|
||||
PRIVSEP_PATH=/var/empty
|
||||
@@ -3916,6 +3944,12 @@ AC_ARG_WITH(lastlog,
|
||||
fi
|
||||
]
|
||||
)
|
||||
+AC_ARG_ENABLE(vendor-patchlevel,
|
||||
+ [ --enable-vendor-patchlevel=TAG specify a vendor patch level],
|
||||
+ [AC_DEFINE_UNQUOTED(SSH_VENDOR_PATCHLEVEL,[SSH_RELEASE "-" "$enableval"],[Define to your vendor patch level, if it has been modified from the upstream source release.])
|
||||
+ SSH_VENDOR_PATCHLEVEL="$enableval"],
|
||||
+ [AC_DEFINE(SSH_VENDOR_PATCHLEVEL,SSH_RELEASE,[Define to your vendor patch level, if it has been modified from the upstream source release.])
|
||||
+ SSH_VENDOR_PATCHLEVEL=none])
|
||||
|
||||
dnl lastlog, [uw]tmpx? detection
|
||||
dnl NOTE: set the paths in the platform section to avoid the
|
||||
@@ -4162,16 +4196,19 @@ echo " PAM support
|
||||
echo " OSF SIA support: $SIA_MSG"
|
||||
echo " KerberosV support: $KRB5_MSG"
|
||||
echo " SELinux support: $SELINUX_MSG"
|
||||
+echo " Linux audit support: $LINUX_AUDIT_MSG"
|
||||
echo " Smartcard support: $SCARD_MSG"
|
||||
echo " S/KEY support: $SKEY_MSG"
|
||||
echo " TCP Wrappers support: $TCPW_MSG"
|
||||
echo " MD5 password support: $MD5_MSG"
|
||||
echo " libedit support: $LIBEDIT_MSG"
|
||||
echo " Solaris process contract support: $SPC_MSG"
|
||||
+echo " NSS support: $LIBNSS_MSG"
|
||||
echo " IP address in \$DISPLAY hack: $DISPLAY_HACK_MSG"
|
||||
echo " Translate v4 in v6 hack: $IPV4_IN6_HACK_MSG"
|
||||
echo " BSD Auth support: $BSD_AUTH_MSG"
|
||||
echo " Random number source: $RAND_MSG"
|
||||
+echo " Vendor patch level: $SSH_VENDOR_PATCHLEVEL"
|
||||
if test ! -z "$USE_RAND_HELPER" ; then
|
||||
echo " ssh-rand-helper collects from: $RAND_HELPER_MSG"
|
||||
fi
|
||||
diff -up openssh-5.2p1/servconf.c.vendor openssh-5.2p1/servconf.c
|
||||
--- openssh-5.2p1/servconf.c.vendor 2009-01-28 06:31:23.000000000 +0100
|
||||
+++ openssh-5.2p1/servconf.c 2009-03-10 03:51:54.956273911 +0100
|
||||
@@ -117,6 +117,7 @@ initialize_server_options(ServerOptions
|
||||
options->max_authtries = -1;
|
||||
options->max_sessions = -1;
|
||||
options->banner = NULL;
|
||||
+ options->show_patchlevel = -1;
|
||||
options->use_dns = -1;
|
||||
options->client_alive_interval = -1;
|
||||
options->client_alive_count_max = -1;
|
||||
@@ -262,6 +263,9 @@ fill_default_server_options(ServerOption
|
||||
if (options->zero_knowledge_password_authentication == -1)
|
||||
options->zero_knowledge_password_authentication = 0;
|
||||
|
||||
+ if (options->show_patchlevel == -1)
|
||||
+ options->show_patchlevel = 0;
|
||||
+
|
||||
/* Turn privilege separation on by default */
|
||||
if (use_privsep == -1)
|
||||
use_privsep = 1;
|
||||
@@ -299,7 +303,7 @@ typedef enum {
|
||||
sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile,
|
||||
sGatewayPorts, sPubkeyAuthentication, sXAuthLocation, sSubsystem,
|
||||
sMaxStartups, sMaxAuthTries, sMaxSessions,
|
||||
- sBanner, sUseDNS, sHostbasedAuthentication,
|
||||
+ sBanner, sShowPatchLevel, sUseDNS, sHostbasedAuthentication,
|
||||
sHostbasedUsesNameFromPacketOnly, sClientAliveInterval,
|
||||
sClientAliveCountMax, sAuthorizedKeysFile, sAuthorizedKeysFile2,
|
||||
sGssAuthentication, sGssCleanupCreds, sAcceptEnv, sPermitTunnel,
|
||||
@@ -410,6 +414,7 @@ static struct {
|
||||
{ "maxauthtries", sMaxAuthTries, SSHCFG_ALL },
|
||||
{ "maxsessions", sMaxSessions, SSHCFG_ALL },
|
||||
{ "banner", sBanner, SSHCFG_ALL },
|
||||
+ { "showpatchlevel", sShowPatchLevel, SSHCFG_GLOBAL },
|
||||
{ "usedns", sUseDNS, SSHCFG_GLOBAL },
|
||||
{ "verifyreversemapping", sDeprecated, SSHCFG_GLOBAL },
|
||||
{ "reversemappingcheck", sDeprecated, SSHCFG_GLOBAL },
|
||||
@@ -1033,6 +1038,10 @@ process_server_config_line(ServerOptions
|
||||
intptr = &use_privsep;
|
||||
goto parse_flag;
|
||||
|
||||
+ case sShowPatchLevel:
|
||||
+ intptr = &options->show_patchlevel;
|
||||
+ goto parse_flag;
|
||||
+
|
||||
case sAllowUsers:
|
||||
while ((arg = strdelim(&cp)) && *arg != '\0') {
|
||||
if (options->num_allow_users >= MAX_ALLOW_USERS)
|
||||
@@ -1613,6 +1622,7 @@ dump_config(ServerOptions *o)
|
||||
dump_cfg_fmtint(sUseLogin, o->use_login);
|
||||
dump_cfg_fmtint(sCompression, o->compression);
|
||||
dump_cfg_fmtint(sGatewayPorts, o->gateway_ports);
|
||||
+ dump_cfg_fmtint(sShowPatchLevel, o->show_patchlevel);
|
||||
dump_cfg_fmtint(sUseDNS, o->use_dns);
|
||||
dump_cfg_fmtint(sAllowTcpForwarding, o->allow_tcp_forwarding);
|
||||
dump_cfg_fmtint(sUsePrivilegeSeparation, use_privsep);
|
||||
diff -up openssh-5.2p1/servconf.h.vendor openssh-5.2p1/servconf.h
|
||||
--- openssh-5.2p1/servconf.h.vendor 2009-01-28 06:31:23.000000000 +0100
|
||||
+++ openssh-5.2p1/servconf.h 2009-03-10 03:51:54.933236643 +0100
|
||||
@@ -128,6 +128,7 @@ typedef struct {
|
||||
int max_authtries;
|
||||
int max_sessions;
|
||||
char *banner; /* SSH-2 banner message */
|
||||
+ int show_patchlevel; /* Show vendor patch level to clients */
|
||||
int use_dns;
|
||||
int client_alive_interval; /*
|
||||
* poke the client this often to
|
||||
diff -up openssh-5.2p1/sshd_config.0.vendor openssh-5.2p1/sshd_config.0
|
||||
--- openssh-5.2p1/sshd_config.0.vendor 2009-03-10 03:51:54.775230993 +0100
|
||||
+++ openssh-5.2p1/sshd_config.0 2009-03-10 03:51:54.958364611 +0100
|
||||
@@ -467,6 +467,11 @@ DESCRIPTION
|
||||
Defines the number of bits in the ephemeral protocol version 1
|
||||
server key. The minimum value is 512, and the default is 1024.
|
||||
|
||||
+ ShowPatchLevel
|
||||
+ Specifies whether sshd will display the specific patch level of
|
||||
+ the binary in the server identification string. The patch level
|
||||
+ is set at compile-time. The default is M-bM-^@M-^\noM-bM-^@M-^].
|
||||
+
|
||||
StrictModes
|
||||
Specifies whether sshd(8) should check file modes and ownership
|
||||
of the user's files and home directory before accepting login.
|
||||
diff -up openssh-5.2p1/sshd_config.5.vendor openssh-5.2p1/sshd_config.5
|
||||
--- openssh-5.2p1/sshd_config.5.vendor 2009-03-10 03:51:54.785628316 +0100
|
||||
+++ openssh-5.2p1/sshd_config.5 2009-03-10 03:51:54.931352756 +0100
|
||||
@@ -814,6 +814,14 @@ This option applies to protocol version
|
||||
.It Cm ServerKeyBits
|
||||
Defines the number of bits in the ephemeral protocol version 1 server key.
|
||||
The minimum value is 512, and the default is 1024.
|
||||
+.It Cm ShowPatchLevel
|
||||
+Specifies whether
|
||||
+.Nm sshd
|
||||
+will display the patch level of the binary in the identification string.
|
||||
+The patch level is set at compile-time.
|
||||
+The default is
|
||||
+.Dq no .
|
||||
+This option applies to protocol version 1 only.
|
||||
.It Cm StrictModes
|
||||
Specifies whether
|
||||
.Xr sshd 8
|
||||
diff -up openssh-5.2p1/sshd_config.vendor openssh-5.2p1/sshd_config
|
||||
--- openssh-5.2p1/sshd_config.vendor 2009-03-10 03:51:54.747256884 +0100
|
||||
+++ openssh-5.2p1/sshd_config 2009-03-10 03:51:54.960221540 +0100
|
||||
@@ -112,6 +112,7 @@ X11Forwarding yes
|
||||
#Compression delayed
|
||||
#ClientAliveInterval 0
|
||||
#ClientAliveCountMax 3
|
||||
+#ShowPatchLevel no
|
||||
#UseDNS yes
|
||||
#PidFile /var/run/sshd.pid
|
||||
#MaxStartups 10
|
||||
diff -up openssh-5.2p1/sshd.c.vendor openssh-5.2p1/sshd.c
|
||||
--- openssh-5.2p1/sshd.c.vendor 2009-01-28 06:31:23.000000000 +0100
|
||||
+++ openssh-5.2p1/sshd.c 2009-03-10 03:51:56.224238563 +0100
|
||||
@@ -76,6 +76,8 @@
|
||||
#include <openssl/bn.h>
|
||||
#include <openssl/md5.h>
|
||||
#include <openssl/rand.h>
|
||||
+#include <openssl/fips.h>
|
||||
+#include <fipscheck.h>
|
||||
#include "openbsd-compat/openssl-compat.h"
|
||||
|
||||
#ifdef HAVE_SECUREWARE
|
||||
@@ -415,7 +417,7 @@ sshd_exchange_identification(int sock_in
|
||||
minor = PROTOCOL_MINOR_1;
|
||||
}
|
||||
snprintf(buf, sizeof buf, "SSH-%d.%d-%.100s%s", major, minor,
|
||||
- SSH_VERSION, newline);
|
||||
+ (options.show_patchlevel == 1) ? SSH_VENDOR_PATCHLEVEL : SSH_VERSION, newline);
|
||||
server_version_string = xstrdup(buf);
|
||||
|
||||
/* Send our protocol version identification. */
|
||||
@@ -590,6 +592,10 @@ privsep_preauth_child(void)
|
||||
/* Demote the private keys to public keys. */
|
||||
demote_sensitive_data();
|
||||
|
||||
+ /* Open the syslog permanently so the chrooted process still
|
||||
+ can write to syslog. */
|
||||
+ open_log();
|
||||
+
|
||||
/* Change our root directory */
|
||||
if (chroot(_PATH_PRIVSEP_CHROOT_DIR) == -1)
|
||||
fatal("chroot(\"%s\"): %s", _PATH_PRIVSEP_CHROOT_DIR,
|
||||
@@ -1256,6 +1262,12 @@ main(int ac, char **av)
|
||||
(void)set_auth_parameters(ac, av);
|
||||
#endif
|
||||
__progname = ssh_get_progname(av[0]);
|
||||
+
|
||||
+ SSLeay_add_all_algorithms();
|
||||
+ if (FIPS_mode() && !FIPSCHECK_verify(NULL, NULL)) {
|
||||
+ fatal("FIPS integrity verification test failed.");
|
||||
+ }
|
||||
+
|
||||
init_rng();
|
||||
|
||||
/* Save argv. Duplicate so setproctitle emulation doesn't clobber it */
|
||||
@@ -1408,8 +1420,6 @@ main(int ac, char **av)
|
||||
else
|
||||
closefrom(REEXEC_DEVCRYPTO_RESERVED_FD);
|
||||
|
||||
- SSLeay_add_all_algorithms();
|
||||
-
|
||||
/*
|
||||
* Force logging to stderr until we have loaded the private host
|
||||
* key (unless started from inetd)
|
||||
@@ -1483,7 +1493,8 @@ main(int ac, char **av)
|
||||
exit(1);
|
||||
}
|
||||
|
||||
- debug("sshd version %.100s", SSH_RELEASE);
|
||||
+ debug("sshd version %.100s",
|
||||
+ (options.show_patchlevel == 1) ? SSH_VENDOR_PATCHLEVEL : SSH_RELEASE);
|
||||
|
||||
/* Store privilege separation user for later use if required. */
|
||||
if ((privsep_pw = getpwnam(SSH_PRIVSEP_USER)) == NULL) {
|
||||
@@ -1894,6 +1905,9 @@ main(int ac, char **av)
|
||||
restore_uid();
|
||||
}
|
||||
#endif
|
||||
+#ifdef WITH_SELINUX
|
||||
+ ssh_selinux_setup_exec_context(authctxt->pw->pw_name);
|
||||
+#endif
|
||||
#ifdef USE_PAM
|
||||
if (options.use_pam) {
|
||||
do_pam_setcred(1);
|
||||
@@ -2174,6 +2188,9 @@ do_ssh2_kex(void)
|
||||
if (options.ciphers != NULL) {
|
||||
myproposal[PROPOSAL_ENC_ALGS_CTOS] =
|
||||
myproposal[PROPOSAL_ENC_ALGS_STOC] = options.ciphers;
|
||||
+ } else if (FIPS_mode()) {
|
||||
+ myproposal[PROPOSAL_ENC_ALGS_CTOS] =
|
||||
+ myproposal[PROPOSAL_ENC_ALGS_STOC] = KEX_FIPS_ENCRYPT;
|
||||
}
|
||||
myproposal[PROPOSAL_ENC_ALGS_CTOS] =
|
||||
compat_cipher_proposal(myproposal[PROPOSAL_ENC_ALGS_CTOS]);
|
||||
@@ -2183,6 +2200,9 @@ do_ssh2_kex(void)
|
||||
if (options.macs != NULL) {
|
||||
myproposal[PROPOSAL_MAC_ALGS_CTOS] =
|
||||
myproposal[PROPOSAL_MAC_ALGS_STOC] = options.macs;
|
||||
+ } else if (FIPS_mode()) {
|
||||
+ myproposal[PROPOSAL_MAC_ALGS_CTOS] =
|
||||
+ myproposal[PROPOSAL_MAC_ALGS_STOC] = KEX_FIPS_MAC;
|
||||
}
|
||||
if (options.compression == COMP_NONE) {
|
||||
myproposal[PROPOSAL_COMP_ALGS_CTOS] =
|
21
openssh.spec
21
openssh.spec
@ -62,8 +62,8 @@
|
||||
|
||||
Summary: An open source implementation of SSH protocol versions 1 and 2
|
||||
Name: openssh
|
||||
Version: 5.1p1
|
||||
Release: 8%{?dist}%{?rescue_rel}
|
||||
Version: 5.2p1
|
||||
Release: 1%{?dist}%{?rescue_rel}
|
||||
URL: http://www.openssh.com/portable.html
|
||||
#Source0: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz
|
||||
#Source1: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz.asc
|
||||
@ -74,11 +74,11 @@ Source0: openssh-%{version}-noacss.tar.bz2
|
||||
Source1: openssh-nukeacss.sh
|
||||
Source2: sshd.pam
|
||||
Source3: sshd.init
|
||||
Patch0: openssh-5.1p1-redhat.patch
|
||||
Patch0: openssh-5.2p1-redhat.patch
|
||||
Patch2: openssh-5.1p1-skip-initial.patch
|
||||
Patch3: openssh-3.8.1p1-krb5-config.patch
|
||||
Patch4: openssh-5.1p1-vendor.patch
|
||||
Patch12: openssh-5.1p1-selinux.patch
|
||||
Patch4: openssh-5.2p1-vendor.patch
|
||||
Patch12: openssh-5.2p1-selinux.patch
|
||||
Patch13: openssh-5.1p1-mls.patch
|
||||
Patch16: openssh-4.7p1-audit.patch
|
||||
Patch17: openssh-4.3p2-cve-2007-3102.patch
|
||||
@ -92,13 +92,11 @@ Patch38: openssh-4.3p2-askpass-grab-info.patch
|
||||
Patch39: openssh-4.3p2-no-v6only.patch
|
||||
Patch44: openssh-4.3p2-allow-ip-opts.patch
|
||||
Patch49: openssh-4.3p2-gssapi-canohost.patch
|
||||
Patch51: openssh-5.1p1-nss-keys.patch
|
||||
Patch51: openssh-5.2p1-nss-keys.patch
|
||||
Patch54: openssh-5.1p1-gssapi-role.patch
|
||||
Patch55: openssh-5.1p1-cloexec.patch
|
||||
Patch62: openssh-5.1p1-scp-manpage.patch
|
||||
Patch63: openssh-5.1p1-bannerlen.patch
|
||||
Patch64: openssh-5.1p1-compat-sessions.patch
|
||||
Patch65: openssh-5.1p1-fips.patch
|
||||
Patch65: openssh-5.2p1-fips.patch
|
||||
|
||||
License: BSD
|
||||
Group: Applications/Internet
|
||||
@ -229,8 +227,6 @@ an X11 passphrase dialog for OpenSSH.
|
||||
%patch54 -p1 -b .gssapi-role
|
||||
%patch55 -p1 -b .cloexec
|
||||
%patch62 -p1 -b .manpage
|
||||
%patch63 -p1 -b .bannerlen
|
||||
%patch64 -p1 -b .compat-sessions
|
||||
%patch65 -p1 -b .fips
|
||||
|
||||
autoreconf
|
||||
@ -476,6 +472,9 @@ fi
|
||||
%endif
|
||||
|
||||
%changelog
|
||||
* Thu Mar 9 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-1
|
||||
- upgrade to new upstream release
|
||||
|
||||
* Thu Feb 26 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 5.1p1-8
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user