[gssapi-openssh.git] / openssh / auth-options.c

/* $OpenBSD: auth-options.c,v 1.44 2009/01/22 10:09:16 djm Exp $ */
/*
 * Author: Tatu Ylonen <ylo@cs.hut.fi>
 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
 *                    All rights reserved
 * As far as I am concerned, the code I have written for this software
 * can be used freely for any purpose.  Any derived versions of this
 * software must be clearly marked as such, and if the derived work is
 * incompatible with the protocol description in the RFC file, it must be
 * called by a name other than "ssh" or "Secure Shell".
 */

#include "includes.h"

#include <sys/types.h>

#include <netdb.h>
#include <pwd.h>
#include <string.h>
#include <stdio.h>
#include <stdarg.h>

#include "openbsd-compat/sys-queue.h"
#include "xmalloc.h"
#include "match.h"
#include "log.h"
#include "canohost.h"
#include "buffer.h"
#include "channels.h"
#include "auth-options.h"
#include "servconf.h"
#include "misc.h"
#include "key.h"
#include "hostfile.h"
#include "auth.h"
#ifdef GSSAPI
#include "ssh-gss.h"
#endif
#include "monitor_wrap.h"

/* Flags set authorized_keys flags */
int no_port_forwarding_flag = 0;
int no_agent_forwarding_flag = 0;
int no_x11_forwarding_flag = 0;
int no_pty_flag = 0;
int no_user_rc = 0;

/* "command=" option. */
char *forced_command = NULL;

/* "environment=" options. */
struct envstring *custom_environment = NULL;

/* "tunnel=" option. */
int forced_tun_device = -1;

extern ServerOptions options;

void
auth_clear_options(void)
{
	no_agent_forwarding_flag = 0;
	no_port_forwarding_flag = 0;
	no_pty_flag = 0;
	no_x11_forwarding_flag = 0;
	no_user_rc = 0;
	while (custom_environment) {
		struct envstring *ce = custom_environment;
		custom_environment = ce->next;
		xfree(ce->s);
		xfree(ce);
	}
	if (forced_command) {
		xfree(forced_command);
		forced_command = NULL;
	}
	forced_tun_device = -1;
	channel_clear_permitted_opens();
	auth_debug_reset();
}

/*
 * return 1 if access is granted, 0 if not.
 * side effect: sets key option flags
 */
int
auth_parse_options(struct passwd *pw, char *opts, char *file, u_long linenum)
{
	const char *cp;
	int i;

	/* reset options */
	auth_clear_options();

	if (!opts)
		return 1;

	while (*opts && *opts != ' ' && *opts != '\t') {
		cp = "no-port-forwarding";
		if (strncasecmp(opts, cp, strlen(cp)) == 0) {
			auth_debug_add("Port forwarding disabled.");
			no_port_forwarding_flag = 1;
			opts += strlen(cp);
			goto next_option;
		}
		cp = "no-agent-forwarding";
		if (strncasecmp(opts, cp, strlen(cp)) == 0) {
			auth_debug_add("Agent forwarding disabled.");
			no_agent_forwarding_flag = 1;
			opts += strlen(cp);
			goto next_option;
		}
		cp = "no-X11-forwarding";
		if (strncasecmp(opts, cp, strlen(cp)) == 0) {
			auth_debug_add("X11 forwarding disabled.");
			no_x11_forwarding_flag = 1;
			opts += strlen(cp);
			goto next_option;
		}
		cp = "no-pty";
		if (strncasecmp(opts, cp, strlen(cp)) == 0) {
			auth_debug_add("Pty allocation disabled.");
			no_pty_flag = 1;
			opts += strlen(cp);
			goto next_option;
		}
		cp = "no-user-rc";
		if (strncasecmp(opts, cp, strlen(cp)) == 0) {
			auth_debug_add("User rc file execution disabled.");
			no_user_rc = 1;
			opts += strlen(cp);
			goto next_option;
		}
		cp = "command=\"";
		if (strncasecmp(opts, cp, strlen(cp)) == 0) {
			opts += strlen(cp);
			forced_command = xmalloc(strlen(opts) + 1);
			i = 0;
			while (*opts) {
				if (*opts == '"')
					break;
				if (*opts == '\\' && opts[1] == '"') {
					opts += 2;
					forced_command[i++] = '"';
					continue;
				}
				forced_command[i++] = *opts++;
			}
			if (!*opts) {
				debug("%.100s, line %lu: missing end quote",
				    file, linenum);
				auth_debug_add("%.100s, line %lu: missing end quote",
				    file, linenum);
				xfree(forced_command);
				forced_command = NULL;
				goto bad_option;
			}
			forced_command[i] = '\0';
			auth_debug_add("Forced command: %.900s", forced_command);
			opts++;
			goto next_option;
		}
		cp = "environment=\"";
		if (options.permit_user_env &&
		    strncasecmp(opts, cp, strlen(cp)) == 0) {
			char *s;
			struct envstring *new_envstring;

			opts += strlen(cp);
			s = xmalloc(strlen(opts) + 1);
			i = 0;
			while (*opts) {
				if (*opts == '"')
					break;
				if (*opts == '\\' && opts[1] == '"') {
					opts += 2;
					s[i++] = '"';
					continue;
				}
				s[i++] = *opts++;
			}
			if (!*opts) {
				debug("%.100s, line %lu: missing end quote",
				    file, linenum);
				auth_debug_add("%.100s, line %lu: missing end quote",
				    file, linenum);
				xfree(s);
				goto bad_option;
			}
			s[i] = '\0';
			auth_debug_add("Adding to environment: %.900s", s);
			debug("Adding to environment: %.900s", s);
			opts++;
			new_envstring = xmalloc(sizeof(struct envstring));
			new_envstring->s = s;
			new_envstring->next = custom_environment;
			custom_environment = new_envstring;
			goto next_option;
		}
		cp = "from=\"";
		if (strncasecmp(opts, cp, strlen(cp)) == 0) {
			const char *remote_ip = get_remote_ipaddr();
			const char *remote_host = get_canonical_hostname(
			    options.use_dns);
			char *patterns = xmalloc(strlen(opts) + 1);

			opts += strlen(cp);
			i = 0;
			while (*opts) {
				if (*opts == '"')
					break;
				if (*opts == '\\' && opts[1] == '"') {
					opts += 2;
					patterns[i++] = '"';
					continue;
				}
				patterns[i++] = *opts++;
			}
			if (!*opts) {
				debug("%.100s, line %lu: missing end quote",
				    file, linenum);
				auth_debug_add("%.100s, line %lu: missing end quote",
				    file, linenum);
				xfree(patterns);
				goto bad_option;
			}
			patterns[i] = '\0';
			opts++;
			switch (match_host_and_ip(remote_host, remote_ip,
			    patterns)) {
			case 1:
				xfree(patterns);
				/* Host name matches. */
				goto next_option;
			case -1:
				debug("%.100s, line %lu: invalid criteria",
				    file, linenum);
				auth_debug_add("%.100s, line %lu: "
				    "invalid criteria", file, linenum);
				/* FALLTHROUGH */
			case 0:
				xfree(patterns);
				logit("Authentication tried for %.100s with "
				    "correct key but not from a permitted "
				    "host (host=%.200s, ip=%.200s).",
				    pw->pw_name, remote_host, remote_ip);
				auth_debug_add("Your host '%.200s' is not "
				    "permitted to use this key for login.",
				    remote_host);
				break;
			}
			/* deny access */
			return 0;
		}
		cp = "permitopen=\"";
		if (strncasecmp(opts, cp, strlen(cp)) == 0) {
			char *host, *p;
			int port;
			char *patterns = xmalloc(strlen(opts) + 1);

			opts += strlen(cp);
			i = 0;
			while (*opts) {
				if (*opts == '"')
					break;
				if (*opts == '\\' && opts[1] == '"') {
					opts += 2;
					patterns[i++] = '"';
					continue;
				}
				patterns[i++] = *opts++;
			}
			if (!*opts) {
				debug("%.100s, line %lu: missing end quote",
				    file, linenum);
				auth_debug_add("%.100s, line %lu: missing "
				    "end quote", file, linenum);
				xfree(patterns);
				goto bad_option;
			}
			patterns[i] = '\0';
			opts++;
			p = patterns;
			host = hpdelim(&p);
			if (host == NULL || strlen(host) >= NI_MAXHOST) {
				debug("%.100s, line %lu: Bad permitopen "
				    "specification <%.100s>", file, linenum,
				    patterns);
				auth_debug_add("%.100s, line %lu: "
				    "Bad permitopen specification", file,
				    linenum);
				xfree(patterns);
				goto bad_option;
			}
			host = cleanhostname(host);
			if (p == NULL || (port = a2port(p)) <= 0) {
				debug("%.100s, line %lu: Bad permitopen port "
				    "<%.100s>", file, linenum, p ? p : "");
				auth_debug_add("%.100s, line %lu: "
				    "Bad permitopen port", file, linenum);
				xfree(patterns);
				goto bad_option;
			}
			if (options.allow_tcp_forwarding)
				channel_add_permitted_opens(host, port);
			xfree(patterns);
			goto next_option;
		}
		cp = "tunnel=\"";
		if (strncasecmp(opts, cp, strlen(cp)) == 0) {
			char *tun = NULL;
			opts += strlen(cp);
			tun = xmalloc(strlen(opts) + 1);
			i = 0;
			while (*opts) {
				if (*opts == '"')
					break;
				tun[i++] = *opts++;
			}
			if (!*opts) {
				debug("%.100s, line %lu: missing end quote",
				    file, linenum);
				auth_debug_add("%.100s, line %lu: missing end quote",
				    file, linenum);
				xfree(tun);
				forced_tun_device = -1;
				goto bad_option;
			}
			tun[i] = '\0';
			forced_tun_device = a2tun(tun, NULL);
			xfree(tun);
			if (forced_tun_device == SSH_TUNID_ERR) {
				debug("%.100s, line %lu: invalid tun device",
				    file, linenum);
				auth_debug_add("%.100s, line %lu: invalid tun device",
				    file, linenum);
				forced_tun_device = -1;
				goto bad_option;
			}
			auth_debug_add("Forced tun device: %d", forced_tun_device);
			opts++;
			goto next_option;
		}
next_option:
		/*
		 * Skip the comma, and move to the next option
		 * (or break out if there are no more).
		 */
		if (!*opts)
			fatal("Bugs in auth-options.c option processing.");
		if (*opts == ' ' || *opts == '\t')
			break;		/* End of options. */
		if (*opts != ',')
			goto bad_option;
		opts++;
		/* Process the next option. */
	}

	if (!use_privsep)
		auth_debug_send();

	/* grant access */
	return 1;

bad_option:
	logit("Bad options in %.100s file, line %lu: %.50s",
	    file, linenum, opts);
	auth_debug_add("Bad options in %.100s file, line %lu: %.50s",
	    file, linenum, opts);

	if (!use_privsep)
		auth_debug_send();

	/* deny access */
	return 0;
}
Commit	Line	Data
91d9cdd3	1	/* $OpenBSD: auth-options.c,v 1.44 2009/01/22 10:09:16 djm Exp $ */
3c0ef626	2	/*
	3	* Author: Tatu Ylonen <ylo@cs.hut.fi>
	4	* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
	5	* All rights reserved
	6	* As far as I am concerned, the code I have written for this software
	7	* can be used freely for any purpose. Any derived versions of this
	8	* software must be clearly marked as such, and if the derived work is
	9	* incompatible with the protocol description in the RFC file, it must be
	10	* called by a name other than "ssh" or "Secure Shell".
	11	*/
	12
	13	#include "includes.h"
9108f8d9	14
	15	#include <sys/types.h>
	16
	17	#include <netdb.h>
	18	#include <pwd.h>
	19	#include <string.h>
	20	#include <stdio.h>
	21	#include <stdarg.h>
3c0ef626	22
22616013	23	#include "openbsd-compat/sys-queue.h"
3c0ef626	24	#include "xmalloc.h"
	25	#include "match.h"
	26	#include "log.h"
	27	#include "canohost.h"
9108f8d9	28	#include "buffer.h"
3c0ef626	29	#include "channels.h"
	30	#include "auth-options.h"
	31	#include "servconf.h"
	32	#include "misc.h"
9108f8d9	33	#include "key.h"
9108f8d9	34	#include "hostfile.h"
700318f3	35	#include "auth.h"
9108f8d9	36	#ifdef GSSAPI
	37	#include "ssh-gss.h"
	38	#endif
	39	#include "monitor_wrap.h"
3c0ef626	40
	41	/* Flags set authorized_keys flags */
	42	int no_port_forwarding_flag = 0;
	43	int no_agent_forwarding_flag = 0;
	44	int no_x11_forwarding_flag = 0;
	45	int no_pty_flag = 0;
47686178	46	int no_user_rc = 0;
3c0ef626	47
	48	/* "command=" option. */
	49	char *forced_command = NULL;
	50
	51	/* "environment=" options. */
	52	struct envstring *custom_environment = NULL;
	53
2c06c99b	54	/* "tunnel=" option. */
	55	int forced_tun_device = -1;
	56
3c0ef626	57	extern ServerOptions options;
	58
	59	void
	60	auth_clear_options(void)
	61	{
	62	no_agent_forwarding_flag = 0;
	63	no_port_forwarding_flag = 0;
	64	no_pty_flag = 0;
	65	no_x11_forwarding_flag = 0;
47686178	66	no_user_rc = 0;
3c0ef626	67	while (custom_environment) {
	68	struct envstring *ce = custom_environment;
	69	custom_environment = ce->next;
	70	xfree(ce->s);
	71	xfree(ce);
	72	}
	73	if (forced_command) {
	74	xfree(forced_command);
	75	forced_command = NULL;
	76	}
2c06c99b	77	forced_tun_device = -1;
3c0ef626	78	channel_clear_permitted_opens();
700318f3	79	auth_debug_reset();
3c0ef626	80	}
	81
	82	/*
	83	* return 1 if access is granted, 0 if not.
	84	* side effect: sets key option flags
	85	*/
	86	int
	87	auth_parse_options(struct passwd pw, char opts, char *file, u_long linenum)
	88	{
	89	const char *cp;
	90	int i;
	91
	92	/* reset options */
	93	auth_clear_options();
	94
	95	if (!opts)
	96	return 1;
	97
	98	while (opts && opts != ' ' && *opts != '\t') {
	99	cp = "no-port-forwarding";
	100	if (strncasecmp(opts, cp, strlen(cp)) == 0) {
700318f3	101	auth_debug_add("Port forwarding disabled.");
3c0ef626	102	no_port_forwarding_flag = 1;
	103	opts += strlen(cp);
	104	goto next_option;
	105	}
	106	cp = "no-agent-forwarding";
	107	if (strncasecmp(opts, cp, strlen(cp)) == 0) {
700318f3	108	auth_debug_add("Agent forwarding disabled.");
3c0ef626	109	no_agent_forwarding_flag = 1;
	110	opts += strlen(cp);
	111	goto next_option;
	112	}
	113	cp = "no-X11-forwarding";
	114	if (strncasecmp(opts, cp, strlen(cp)) == 0) {
700318f3	115	auth_debug_add("X11 forwarding disabled.");
3c0ef626	116	no_x11_forwarding_flag = 1;
	117	opts += strlen(cp);
	118	goto next_option;
	119	}
	120	cp = "no-pty";
	121	if (strncasecmp(opts, cp, strlen(cp)) == 0) {
700318f3	122	auth_debug_add("Pty allocation disabled.");
3c0ef626	123	no_pty_flag = 1;
	124	opts += strlen(cp);
	125	goto next_option;
	126	}
47686178	127	cp = "no-user-rc";
	128	if (strncasecmp(opts, cp, strlen(cp)) == 0) {
	129	auth_debug_add("User rc file execution disabled.");
	130	no_user_rc = 1;
	131	opts += strlen(cp);
	132	goto next_option;
	133	}
3c0ef626	134	cp = "command=\"";
	135	if (strncasecmp(opts, cp, strlen(cp)) == 0) {
	136	opts += strlen(cp);
	137	forced_command = xmalloc(strlen(opts) + 1);
	138	i = 0;
	139	while (*opts) {
	140	if (*opts == '"')
	141	break;
	142	if (*opts == '\\' && opts[1] == '"') {
	143	opts += 2;
	144	forced_command[i++] = '"';
	145	continue;
	146	}
	147	forced_command[i++] = *opts++;
	148	}
	149	if (!*opts) {
	150	debug("%.100s, line %lu: missing end quote",
	151	file, linenum);
700318f3	152	auth_debug_add("%.100s, line %lu: missing end quote",
3c0ef626	153	file, linenum);
	154	xfree(forced_command);
	155	forced_command = NULL;
	156	goto bad_option;
	157	}
9108f8d9	158	forced_command[i] = '\0';
700318f3	159	auth_debug_add("Forced command: %.900s", forced_command);
3c0ef626	160	opts++;
	161	goto next_option;
	162	}
	163	cp = "environment=\"";
41b2f314	164	if (options.permit_user_env &&
41b2f314	165	strncasecmp(opts, cp, strlen(cp)) == 0) {
3c0ef626	166	char *s;
	167	struct envstring *new_envstring;
	168
	169	opts += strlen(cp);
	170	s = xmalloc(strlen(opts) + 1);
	171	i = 0;
	172	while (*opts) {
	173	if (*opts == '"')
	174	break;
	175	if (*opts == '\\' && opts[1] == '"') {
	176	opts += 2;
	177	s[i++] = '"';
	178	continue;
	179	}
	180	s[i++] = *opts++;
	181	}
	182	if (!*opts) {
	183	debug("%.100s, line %lu: missing end quote",
	184	file, linenum);
700318f3	185	auth_debug_add("%.100s, line %lu: missing end quote",
3c0ef626	186	file, linenum);
	187	xfree(s);
	188	goto bad_option;
	189	}
9108f8d9	190	s[i] = '\0';
700318f3	191	auth_debug_add("Adding to environment: %.900s", s);
3c0ef626	192	debug("Adding to environment: %.900s", s);
	193	opts++;
	194	new_envstring = xmalloc(sizeof(struct envstring));
	195	new_envstring->s = s;
	196	new_envstring->next = custom_environment;
	197	custom_environment = new_envstring;
	198	goto next_option;
	199	}
	200	cp = "from=\"";
	201	if (strncasecmp(opts, cp, strlen(cp)) == 0) {
	202	const char *remote_ip = get_remote_ipaddr();
	203	const char *remote_host = get_canonical_hostname(
0fff78ff	204	options.use_dns);
3c0ef626	205	char *patterns = xmalloc(strlen(opts) + 1);
	206
	207	opts += strlen(cp);
	208	i = 0;
	209	while (*opts) {
	210	if (*opts == '"')
	211	break;
	212	if (*opts == '\\' && opts[1] == '"') {
	213	opts += 2;
	214	patterns[i++] = '"';
	215	continue;
	216	}
	217	patterns[i++] = *opts++;
	218	}
	219	if (!*opts) {
	220	debug("%.100s, line %lu: missing end quote",
	221	file, linenum);
700318f3	222	auth_debug_add("%.100s, line %lu: missing end quote",
3c0ef626	223	file, linenum);
	224	xfree(patterns);
	225	goto bad_option;
	226	}
9108f8d9	227	patterns[i] = '\0';
3c0ef626	228	opts++;
22616013	229	switch (match_host_and_ip(remote_host, remote_ip,
	230	patterns)) {
	231	case 1:
	232	xfree(patterns);
	233	/* Host name matches. */
	234	goto next_option;
	235	case -1:
	236	debug("%.100s, line %lu: invalid criteria",
	237	file, linenum);
	238	auth_debug_add("%.100s, line %lu: "
	239	"invalid criteria", file, linenum);
	240	/* FALLTHROUGH */
	241	case 0:
3c0ef626	242	xfree(patterns);
0fff78ff	243	logit("Authentication tried for %.100s with "
3c0ef626	244	"correct key but not from a permitted "
	245	"host (host=%.200s, ip=%.200s).",
	246	pw->pw_name, remote_host, remote_ip);
700318f3	247	auth_debug_add("Your host '%.200s' is not "
3c0ef626	248	"permitted to use this key for login.",
3c0ef626	249	remote_host);
22616013	250	break;
3c0ef626	251	}
22616013	252	/* deny access */
22616013	253	return 0;
3c0ef626	254	}
	255	cp = "permitopen=\"";
	256	if (strncasecmp(opts, cp, strlen(cp)) == 0) {
996d5e62	257	char host, p;
91d9cdd3	258	int port;
3c0ef626	259	char *patterns = xmalloc(strlen(opts) + 1);
	260
	261	opts += strlen(cp);
	262	i = 0;
	263	while (*opts) {
	264	if (*opts == '"')
	265	break;
	266	if (*opts == '\\' && opts[1] == '"') {
	267	opts += 2;
	268	patterns[i++] = '"';
	269	continue;
	270	}
	271	patterns[i++] = *opts++;
	272	}
	273	if (!*opts) {
	274	debug("%.100s, line %lu: missing end quote",
	275	file, linenum);
996d5e62	276	auth_debug_add("%.100s, line %lu: missing "
996d5e62	277	"end quote", file, linenum);
3c0ef626	278	xfree(patterns);
	279	goto bad_option;
	280	}
9108f8d9	281	patterns[i] = '\0';
3c0ef626	282	opts++;
996d5e62	283	p = patterns;
	284	host = hpdelim(&p);
	285	if (host == NULL \|\| strlen(host) >= NI_MAXHOST) {
	286	debug("%.100s, line %lu: Bad permitopen "
dec6d9fe	287	"specification <%.100s>", file, linenum,
996d5e62	288	patterns);
700318f3	289	auth_debug_add("%.100s, line %lu: "
996d5e62	290	"Bad permitopen specification", file,
996d5e62	291	linenum);
3c0ef626	292	xfree(patterns);
	293	goto bad_option;
	294	}
dec6d9fe	295	host = cleanhostname(host);
91d9cdd3	296	if (p == NULL \|\| (port = a2port(p)) <= 0) {
996d5e62	297	debug("%.100s, line %lu: Bad permitopen port "
996d5e62	298	"<%.100s>", file, linenum, p ? p : "");
700318f3	299	auth_debug_add("%.100s, line %lu: "
3c0ef626	300	"Bad permitopen port", file, linenum);
	301	xfree(patterns);
	302	goto bad_option;
	303	}
	304	if (options.allow_tcp_forwarding)
	305	channel_add_permitted_opens(host, port);
	306	xfree(patterns);
	307	goto next_option;
	308	}
2c06c99b	309	cp = "tunnel=\"";
	310	if (strncasecmp(opts, cp, strlen(cp)) == 0) {
	311	char *tun = NULL;
	312	opts += strlen(cp);
	313	tun = xmalloc(strlen(opts) + 1);
	314	i = 0;
	315	while (*opts) {
	316	if (*opts == '"')
	317	break;
	318	tun[i++] = *opts++;
	319	}
	320	if (!*opts) {
	321	debug("%.100s, line %lu: missing end quote",
	322	file, linenum);
	323	auth_debug_add("%.100s, line %lu: missing end quote",
	324	file, linenum);
	325	xfree(tun);
	326	forced_tun_device = -1;
	327	goto bad_option;
	328	}
9108f8d9	329	tun[i] = '\0';
2c06c99b	330	forced_tun_device = a2tun(tun, NULL);
	331	xfree(tun);
	332	if (forced_tun_device == SSH_TUNID_ERR) {
	333	debug("%.100s, line %lu: invalid tun device",
	334	file, linenum);
	335	auth_debug_add("%.100s, line %lu: invalid tun device",
	336	file, linenum);
	337	forced_tun_device = -1;
	338	goto bad_option;
	339	}
	340	auth_debug_add("Forced tun device: %d", forced_tun_device);
	341	opts++;
	342	goto next_option;
	343	}
3c0ef626	344	next_option:
	345	/*
	346	* Skip the comma, and move to the next option
	347	* (or break out if there are no more).
	348	*/
	349	if (!*opts)
	350	fatal("Bugs in auth-options.c option processing.");
	351	if (opts == ' ' \|\| opts == '\t')
	352	break; /* End of options. */
	353	if (*opts != ',')
	354	goto bad_option;
	355	opts++;
	356	/* Process the next option. */
	357	}
700318f3	358
	359	if (!use_privsep)
	360	auth_debug_send();
	361
3c0ef626	362	/* grant access */
	363	return 1;
	364
	365	bad_option:
0fff78ff	366	logit("Bad options in %.100s file, line %lu: %.50s",
3c0ef626	367	file, linenum, opts);
700318f3	368	auth_debug_add("Bad options in %.100s file, line %lu: %.50s",
3c0ef626	369	file, linenum, opts);
700318f3	370
	371	if (!use_privsep)
	372	auth_debug_send();
	373
3c0ef626	374	/* deny access */
	375	return 0;
	376	}