118 lines
5.2 KiB
Diff
118 lines
5.2 KiB
Diff
diff --color -ruNp a/gss-serv.c b/gss-serv.c
|
|
--- a/gss-serv.c 2026-03-11 13:54:53.076924823 +0100
|
|
+++ b/gss-serv.c 2026-03-11 14:10:41.232855086 +0100
|
|
@@ -493,6 +493,11 @@ ssh_gssapi_cleanup_creds(void)
|
|
int
|
|
ssh_gssapi_storecreds(void)
|
|
{
|
|
+ if (options.gss_deleg_creds == 0) {
|
|
+ debug_f("delegate credential is disabled, doing nothing");
|
|
+ return 0;
|
|
+ }
|
|
+
|
|
if (gssapi_client.mech && gssapi_client.mech->storecreds) {
|
|
return (*gssapi_client.mech->storecreds)(&gssapi_client);
|
|
} else
|
|
diff --color -ruNp a/servconf.c b/servconf.c
|
|
--- a/servconf.c 2026-03-11 13:54:53.086263187 +0100
|
|
+++ b/servconf.c 2026-03-11 14:03:10.708713524 +0100
|
|
@@ -143,6 +143,7 @@ initialize_server_options(ServerOptions
|
|
options->gss_authentication=-1;
|
|
options->gss_keyex = -1;
|
|
options->gss_cleanup_creds = -1;
|
|
+ options->gss_deleg_creds = -1;
|
|
options->gss_strict_acceptor = -1;
|
|
options->gss_indicators = NULL;
|
|
options->gss_store_rekey = -1;
|
|
@@ -402,6 +403,8 @@ fill_default_server_options(ServerOption
|
|
options->gss_keyex = 0;
|
|
if (options->gss_cleanup_creds == -1)
|
|
options->gss_cleanup_creds = 1;
|
|
+ if (options->gss_deleg_creds == -1)
|
|
+ options->gss_deleg_creds = 1;
|
|
if (options->gss_strict_acceptor == -1)
|
|
options->gss_strict_acceptor = 1;
|
|
if (options->gss_store_rekey == -1)
|
|
@@ -598,7 +601,8 @@ typedef enum {
|
|
sHostKeyAlgorithms, sPerSourceMaxStartups, sPerSourceNetBlockSize,
|
|
sPerSourcePenalties, sPerSourcePenaltyExemptList,
|
|
sClientAliveInterval, sClientAliveCountMax, sAuthorizedKeysFile,
|
|
- sGssAuthentication, sGssCleanupCreds, sGssEnablek5users, sGssStrictAcceptor,
|
|
+ sGssAuthentication, sGssCleanupCreds, sGssDelegateCreds,
|
|
+ sGssEnablek5users, sGssStrictAcceptor,
|
|
sGssKeyEx, sGssIndicators, sGssKexAlgorithms, sGssStoreRekey,
|
|
sAcceptEnv, sSetEnv, sPermitTunnel,
|
|
sMatch, sPermitOpen, sPermitListen, sForceCommand, sChrootDirectory,
|
|
@@ -690,6 +694,7 @@ static struct {
|
|
{ "gssapiauthentication", sGssAuthentication, SSHCFG_ALL },
|
|
{ "gssapicleanupcredentials", sGssCleanupCreds, SSHCFG_GLOBAL },
|
|
{ "gssapicleanupcreds", sGssCleanupCreds, SSHCFG_GLOBAL },
|
|
+ { "gssapidelegatecredentials", sGssDelegateCreds, SSHCFG_GLOBAL },
|
|
{ "gssapistrictacceptorcheck", sGssStrictAcceptor, SSHCFG_GLOBAL },
|
|
{ "gssapikeyexchange", sGssKeyEx, SSHCFG_GLOBAL },
|
|
{ "gssapistorecredentialsonrekey", sGssStoreRekey, SSHCFG_GLOBAL },
|
|
@@ -700,6 +705,7 @@ static struct {
|
|
{ "gssapiauthentication", sUnsupported, SSHCFG_ALL },
|
|
{ "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL },
|
|
{ "gssapicleanupcreds", sUnsupported, SSHCFG_GLOBAL },
|
|
+ { "gssapidelegatecredentials", sUnsupported, SSHCFG_GLOBAL },
|
|
{ "gssapistrictacceptorcheck", sUnsupported, SSHCFG_GLOBAL },
|
|
{ "gssapikeyexchange", sUnsupported, SSHCFG_GLOBAL },
|
|
{ "gssapistorecredentialsonrekey", sUnsupported, SSHCFG_GLOBAL },
|
|
@@ -1703,6 +1709,10 @@ process_server_config_line_depth(ServerO
|
|
intptr = &options->gss_cleanup_creds;
|
|
goto parse_flag;
|
|
|
|
+ case sGssDelegateCreds:
|
|
+ intptr = &options->gss_deleg_creds;
|
|
+ goto parse_flag;
|
|
+
|
|
case sGssStrictAcceptor:
|
|
intptr = &options->gss_strict_acceptor;
|
|
goto parse_flag;
|
|
@@ -3348,6 +3358,7 @@ dump_config(ServerOptions *o)
|
|
#ifdef GSSAPI
|
|
dump_cfg_fmtint(sGssAuthentication, o->gss_authentication);
|
|
dump_cfg_fmtint(sGssCleanupCreds, o->gss_cleanup_creds);
|
|
+ dump_cfg_fmtint(sGssDelegateCreds, o->gss_deleg_creds);
|
|
dump_cfg_fmtint(sGssKeyEx, o->gss_keyex);
|
|
dump_cfg_fmtint(sGssStrictAcceptor, o->gss_strict_acceptor);
|
|
dump_cfg_fmtint(sGssStoreRekey, o->gss_store_rekey);
|
|
diff --color -ruNp a/servconf.h b/servconf.h
|
|
--- a/servconf.h 2026-03-11 13:54:53.086763709 +0100
|
|
+++ b/servconf.h 2026-03-11 14:13:51.130708769 +0100
|
|
@@ -158,6 +158,7 @@ typedef struct {
|
|
int gss_authentication; /* If true, permit GSSAPI authentication */
|
|
int gss_keyex; /* If true, permit GSSAPI key exchange */
|
|
int gss_cleanup_creds; /* If true, destroy cred cache on logout */
|
|
+ int gss_deleg_creds; /* If true, accept delegated GSS credentials */
|
|
int gss_strict_acceptor; /* If true, restrict the GSSAPI acceptor name */
|
|
int gss_store_rekey;
|
|
char *gss_kex_algorithms; /* GSSAPI kex methods to be offered by client. */
|
|
diff --color -ruNp a/sshd_config.0 b/sshd_config.0
|
|
--- a/sshd_config.0 2026-03-11 13:54:52.904233471 +0100
|
|
+++ b/sshd_config.0 2026-03-11 14:12:35.341170737 +0100
|
|
@@ -451,6 +451,9 @@ DESCRIPTION
|
|
Specifies whether to automatically destroy the user's credentials
|
|
cache on logout. The default is yes.
|
|
|
|
+ GSSAPIDelegateCredentials
|
|
+ Accept delegated credentials on the server side. The default is yes.
|
|
+
|
|
GSSAPIStrictAcceptorCheck
|
|
Determines whether to be strict about the identity of the GSSAPI
|
|
acceptor a client authenticates against. If set to yes then the
|
|
diff --color -ruNp a/sshd_config.5 b/sshd_config.5
|
|
--- a/sshd_config.5 2026-03-11 13:54:53.087046352 +0100
|
|
+++ b/sshd_config.5 2026-03-11 14:05:15.657248031 +0100
|
|
@@ -733,6 +733,9 @@ Specifies whether to automatically destr
|
|
on logout.
|
|
The default is
|
|
.Cm yes .
|
|
+.It Cm GSSAPIDelegateCredentials
|
|
+Accept delegated credentials on the server side. The default is
|
|
+.Cm yes .
|
|
.It Cm GSSAPIEnablek5users
|
|
Specifies whether to look at .k5users file for GSSAPI authentication
|
|
access control. Further details are described in
|