1 /* $OpenBSD: servconf.c,v 1.194 2009/01/22 10:02:34 djm Exp $ */
3 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
6 * As far as I am concerned, the code I have written for this software
7 * can be used freely for any purpose. Any derived versions of this
8 * software must be clearly marked as such, and if the derived work is
9 * incompatible with the protocol description in the RFC file, it must be
10 * called by a name other than "ssh" or "Secure Shell".
15 #include <sys/types.h>
16 #include <sys/socket.h>
28 #include "openbsd-compat/sys-queue.h"
35 #include "pathnames.h"
43 #include "groupaccess.h"
45 static void add_listen_addr(ServerOptions *, char *, int);
46 static void add_one_listen_addr(ServerOptions *, char *, int);
48 /* Use of privilege separation or not */
49 extern int use_privsep;
52 /* Initializes the server options to their default values. */
55 initialize_server_options(ServerOptions *options)
57 memset(options, 0, sizeof(*options));
59 /* Portable-specific options */
60 options->use_pam = -1;
61 options->permit_pam_user_change = -1;
63 /* Standard Options */
64 options->num_ports = 0;
65 options->ports_from_cmdline = 0;
66 options->listen_addrs = NULL;
67 options->address_family = -1;
68 options->num_host_key_files = 0;
69 options->pid_file = NULL;
70 options->server_key_bits = -1;
71 options->login_grace_time = -1;
72 options->key_regeneration_time = -1;
73 options->permit_root_login = PERMIT_NOT_SET;
74 options->ignore_rhosts = -1;
75 options->ignore_user_known_hosts = -1;
76 options->print_motd = -1;
77 options->print_lastlog = -1;
78 options->x11_forwarding = -1;
79 options->x11_display_offset = -1;
80 options->x11_use_localhost = -1;
81 options->xauth_location = NULL;
82 options->strict_modes = -1;
83 options->tcp_keep_alive = -1;
84 options->log_facility = SYSLOG_FACILITY_NOT_SET;
85 options->log_level = SYSLOG_LEVEL_NOT_SET;
86 options->rhosts_rsa_authentication = -1;
87 options->hostbased_authentication = -1;
88 options->hostbased_uses_name_from_packet_only = -1;
89 options->rsa_authentication = -1;
90 options->pubkey_authentication = -1;
91 options->kerberos_authentication = -1;
92 options->kerberos_or_local_passwd = -1;
93 options->kerberos_ticket_cleanup = -1;
95 options->session_hooks_allow = -1;
96 options->session_hooks_startup_cmd = NULL;
97 options->session_hooks_shutdown_cmd = NULL;
99 options->kerberos_get_afs_token = -1;
100 options->gss_authentication = -1;
101 options->gss_deleg_creds = -1;
102 options->gss_keyex = -1;
103 options->gss_cleanup_creds = -1;
104 options->gss_strict_acceptor = -1;
105 options->gsi_allow_limited_proxy = -1;
106 options->gss_store_rekey = -1;
107 options->password_authentication = -1;
108 options->kbd_interactive_authentication = -1;
109 options->challenge_response_authentication = -1;
110 options->permit_empty_passwd = -1;
111 options->permit_user_env = -1;
112 options->use_login = -1;
113 options->compression = -1;
114 options->allow_tcp_forwarding = -1;
115 options->allow_agent_forwarding = -1;
116 options->num_allow_users = 0;
117 options->num_deny_users = 0;
118 options->num_allow_groups = 0;
119 options->num_deny_groups = 0;
120 options->ciphers = NULL;
121 options->macs = NULL;
122 options->protocol = SSH_PROTO_UNKNOWN;
123 options->gateway_ports = -1;
124 options->num_subsystems = 0;
125 options->max_startups_begin = -1;
126 options->max_startups_rate = -1;
127 options->max_startups = -1;
128 options->max_authtries = -1;
129 options->max_sessions = -1;
130 options->banner = NULL;
131 options->use_dns = -1;
132 options->client_alive_interval = -1;
133 options->client_alive_count_max = -1;
134 options->authorized_keys_file = NULL;
135 options->authorized_keys_file2 = NULL;
136 options->num_accept_env = 0;
137 options->permit_tun = -1;
138 options->num_permitted_opens = -1;
139 options->adm_forced_command = NULL;
140 options->chroot_directory = NULL;
141 options->zero_knowledge_password_authentication = -1;
142 options->none_enabled = -1;
143 options->tcp_rcv_buf_poll = -1;
144 options->hpn_disabled = -1;
145 options->hpn_buffer_size = -1;
149 fill_default_server_options(ServerOptions *options)
151 /* needed for hpn socket tests */
154 int socksizelen = sizeof(int);
156 /* Portable-specific options */
157 if (options->use_pam == -1)
158 options->use_pam = 0;
159 if (options->permit_pam_user_change == -1)
160 options->permit_pam_user_change = 0;
162 /* Standard Options */
163 if (options->protocol == SSH_PROTO_UNKNOWN)
164 options->protocol = SSH_PROTO_1|SSH_PROTO_2;
165 if (options->num_host_key_files == 0) {
166 /* fill default hostkeys for protocols */
167 if (options->protocol & SSH_PROTO_1)
168 options->host_key_files[options->num_host_key_files++] =
170 if (options->protocol & SSH_PROTO_2) {
171 options->host_key_files[options->num_host_key_files++] =
172 _PATH_HOST_RSA_KEY_FILE;
173 options->host_key_files[options->num_host_key_files++] =
174 _PATH_HOST_DSA_KEY_FILE;
177 if (options->num_ports == 0)
178 options->ports[options->num_ports++] = SSH_DEFAULT_PORT;
179 if (options->listen_addrs == NULL)
180 add_listen_addr(options, NULL, 0);
181 if (options->pid_file == NULL)
182 options->pid_file = _PATH_SSH_DAEMON_PID_FILE;
183 if (options->server_key_bits == -1)
184 options->server_key_bits = 1024;
185 if (options->login_grace_time == -1)
186 options->login_grace_time = 120;
187 if (options->key_regeneration_time == -1)
188 options->key_regeneration_time = 3600;
189 if (options->permit_root_login == PERMIT_NOT_SET)
190 options->permit_root_login = PERMIT_YES;
191 if (options->ignore_rhosts == -1)
192 options->ignore_rhosts = 1;
193 if (options->ignore_user_known_hosts == -1)
194 options->ignore_user_known_hosts = 0;
195 if (options->print_motd == -1)
196 options->print_motd = 1;
197 if (options->print_lastlog == -1)
198 options->print_lastlog = 1;
199 if (options->x11_forwarding == -1)
200 options->x11_forwarding = 0;
201 if (options->x11_display_offset == -1)
202 options->x11_display_offset = 10;
203 if (options->x11_use_localhost == -1)
204 options->x11_use_localhost = 1;
205 if (options->xauth_location == NULL)
206 options->xauth_location = _PATH_XAUTH;
207 if (options->strict_modes == -1)
208 options->strict_modes = 1;
209 if (options->tcp_keep_alive == -1)
210 options->tcp_keep_alive = 1;
211 if (options->log_facility == SYSLOG_FACILITY_NOT_SET)
212 options->log_facility = SYSLOG_FACILITY_AUTH;
213 if (options->log_level == SYSLOG_LEVEL_NOT_SET)
214 options->log_level = SYSLOG_LEVEL_INFO;
215 if (options->rhosts_rsa_authentication == -1)
216 options->rhosts_rsa_authentication = 0;
217 if (options->hostbased_authentication == -1)
218 options->hostbased_authentication = 0;
219 if (options->hostbased_uses_name_from_packet_only == -1)
220 options->hostbased_uses_name_from_packet_only = 0;
221 if (options->rsa_authentication == -1)
222 options->rsa_authentication = 1;
223 if (options->pubkey_authentication == -1)
224 options->pubkey_authentication = 1;
225 if (options->kerberos_authentication == -1)
226 options->kerberos_authentication = 0;
227 if (options->kerberos_or_local_passwd == -1)
228 options->kerberos_or_local_passwd = 1;
229 if (options->kerberos_ticket_cleanup == -1)
230 options->kerberos_ticket_cleanup = 1;
231 if (options->kerberos_get_afs_token == -1)
232 options->kerberos_get_afs_token = 0;
233 if (options->gss_authentication == -1)
234 options->gss_authentication = 1;
235 if (options->gss_deleg_creds == -1)
236 options->gss_deleg_creds = 1;
237 if (options->gss_keyex == -1)
238 options->gss_keyex = 1;
239 if (options->gss_cleanup_creds == -1)
240 options->gss_cleanup_creds = 1;
241 if (options->gss_strict_acceptor == -1)
242 options->gss_strict_acceptor = 1;
243 if (options->gsi_allow_limited_proxy == -1)
244 options->gsi_allow_limited_proxy = 0;
245 if (options->gss_store_rekey == -1)
246 options->gss_store_rekey = 0;
247 if (options->password_authentication == -1)
248 options->password_authentication = 1;
249 if (options->kbd_interactive_authentication == -1)
250 options->kbd_interactive_authentication = 0;
251 if (options->challenge_response_authentication == -1)
252 options->challenge_response_authentication = 1;
253 if (options->permit_empty_passwd == -1)
254 options->permit_empty_passwd = 0;
255 if (options->permit_user_env == -1)
256 options->permit_user_env = 0;
257 if (options->use_login == -1)
258 options->use_login = 0;
259 if (options->compression == -1)
260 options->compression = COMP_DELAYED;
261 if (options->allow_tcp_forwarding == -1)
262 options->allow_tcp_forwarding = 1;
263 if (options->allow_agent_forwarding == -1)
264 options->allow_agent_forwarding = 1;
265 if (options->gateway_ports == -1)
266 options->gateway_ports = 0;
267 if (options->max_startups == -1)
268 options->max_startups = 10;
269 if (options->max_startups_rate == -1)
270 options->max_startups_rate = 100; /* 100% */
271 if (options->max_startups_begin == -1)
272 options->max_startups_begin = options->max_startups;
273 if (options->max_authtries == -1)
274 options->max_authtries = DEFAULT_AUTH_FAIL_MAX;
275 if (options->max_sessions == -1)
276 options->max_sessions = DEFAULT_SESSIONS_MAX;
277 if (options->use_dns == -1)
278 options->use_dns = 1;
279 if (options->client_alive_interval == -1)
280 options->client_alive_interval = 0;
281 if (options->client_alive_count_max == -1)
282 options->client_alive_count_max = 3;
283 if (options->authorized_keys_file2 == NULL) {
284 /* authorized_keys_file2 falls back to authorized_keys_file */
285 if (options->authorized_keys_file != NULL)
286 options->authorized_keys_file2 = options->authorized_keys_file;
288 options->authorized_keys_file2 = _PATH_SSH_USER_PERMITTED_KEYS2;
290 if (options->authorized_keys_file == NULL)
291 options->authorized_keys_file = _PATH_SSH_USER_PERMITTED_KEYS;
292 if (options->permit_tun == -1)
293 options->permit_tun = SSH_TUNMODE_NO;
294 if (options->zero_knowledge_password_authentication == -1)
295 options->zero_knowledge_password_authentication = 0;
297 if (options->hpn_disabled == -1)
298 options->hpn_disabled = 0;
300 if (options->hpn_buffer_size == -1) {
301 /* option not explicitly set. Now we have to figure out */
302 /* what value to use */
303 if (options->hpn_disabled == 1) {
304 options->hpn_buffer_size = CHAN_SES_WINDOW_DEFAULT;
306 /* get the current RCV size and set it to that */
307 /*create a socket but don't connect it */
308 /* we use that the get the rcv socket size */
309 sock = socket(AF_INET, SOCK_STREAM, 0);
310 getsockopt(sock, SOL_SOCKET, SO_RCVBUF,
311 &socksize, &socksizelen);
313 options->hpn_buffer_size = socksize;
314 debug ("HPN Buffer Size: %d", options->hpn_buffer_size);
318 /* we have to do this incase the user sets both values in a contradictory */
319 /* manner. hpn_disabled overrrides hpn_buffer_size*/
320 if (options->hpn_disabled <= 0) {
321 if (options->hpn_buffer_size == 0)
322 options->hpn_buffer_size = 1;
323 /* limit the maximum buffer to 64MB */
324 if (options->hpn_buffer_size > 64*1024) {
325 options->hpn_buffer_size = 64*1024*1024;
327 options->hpn_buffer_size *= 1024;
330 options->hpn_buffer_size = CHAN_TCP_WINDOW_DEFAULT;
333 /* Turn privilege separation on by default */
334 if (use_privsep == -1)
338 if (use_privsep && options->compression == 1) {
339 error("This platform does not support both privilege "
340 "separation and compression");
341 error("Compression disabled");
342 options->compression = 0;
348 /* Keyword tokens. */
350 sBadOption, /* == unknown option */
351 /* Portable-specific options */
352 sUsePAM, sPermitPAMUserChange,
353 /* Standard Options */
354 sPort, sHostKeyFile, sServerKeyBits, sLoginGraceTime, sKeyRegenerationTime,
355 sPermitRootLogin, sLogFacility, sLogLevel,
356 sRhostsRSAAuthentication, sRSAAuthentication,
357 sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup,
358 sKerberosGetAFSToken,
359 sKerberosTgtPassing, sChallengeResponseAuthentication,
361 sAllowSessionHooks, sSessionHookStartupCmd, sSessionHookShutdownCmd,
363 sPasswordAuthentication, sKbdInteractiveAuthentication,
364 sListenAddress, sAddressFamily,
365 sPrintMotd, sPrintLastLog, sIgnoreRhosts,
366 sX11Forwarding, sX11DisplayOffset, sX11UseLocalhost,
367 sStrictModes, sEmptyPasswd, sTCPKeepAlive,
368 sPermitUserEnvironment, sUseLogin, sAllowTcpForwarding, sCompression,
369 sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups,
370 sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile,
371 sGatewayPorts, sPubkeyAuthentication, sXAuthLocation, sSubsystem,
372 sMaxStartups, sMaxAuthTries, sMaxSessions,
373 sBanner, sUseDNS, sHostbasedAuthentication,
374 sHostbasedUsesNameFromPacketOnly, sClientAliveInterval,
375 sClientAliveCountMax, sAuthorizedKeysFile, sAuthorizedKeysFile2,
378 sGsiAllowLimitedProxy,
379 sGssAuthentication, sGssCleanupCreds, sGssStrictAcceptor,
380 sGssKeyEx, sGssStoreRekey,
381 sAcceptEnv, sPermitTunnel,
382 sMatch, sPermitOpen, sForceCommand, sChrootDirectory,
383 sUsePrivilegeSeparation, sAllowAgentForwarding,
384 sZeroKnowledgePasswordAuthentication,
385 sNoneEnabled, sTcpRcvBufPoll, sHPNDisabled, sHPNBufferSize,
386 sDeprecated, sUnsupported
389 #define SSHCFG_GLOBAL 0x01 /* allowed in main section of sshd_config */
390 #define SSHCFG_MATCH 0x02 /* allowed inside a Match section */
391 #define SSHCFG_ALL (SSHCFG_GLOBAL|SSHCFG_MATCH)
393 /* Textual representation of the tokens. */
396 ServerOpCodes opcode;
399 /* Portable-specific options */
401 { "usepam", sUsePAM, SSHCFG_GLOBAL },
402 { "permitpamuserchange", sPermitPAMUserChange, SSHCFG_GLOBAL }
404 { "usepam", sUnsupported, SSHCFG_GLOBAL },
405 { "permitpamuserchange", sUnsupported, SSHCFG_GLOBAL },
407 { "pamauthenticationviakbdint", sDeprecated, SSHCFG_GLOBAL },
408 /* Standard Options */
409 { "port", sPort, SSHCFG_GLOBAL },
410 { "hostkey", sHostKeyFile, SSHCFG_GLOBAL },
411 { "hostdsakey", sHostKeyFile, SSHCFG_GLOBAL }, /* alias */
412 { "pidfile", sPidFile, SSHCFG_GLOBAL },
413 { "serverkeybits", sServerKeyBits, SSHCFG_GLOBAL },
414 { "logingracetime", sLoginGraceTime, SSHCFG_GLOBAL },
415 { "keyregenerationinterval", sKeyRegenerationTime, SSHCFG_GLOBAL },
416 { "permitrootlogin", sPermitRootLogin, SSHCFG_ALL },
417 { "syslogfacility", sLogFacility, SSHCFG_GLOBAL },
418 { "loglevel", sLogLevel, SSHCFG_GLOBAL },
419 { "rhostsauthentication", sDeprecated, SSHCFG_GLOBAL },
420 { "rhostsrsaauthentication", sRhostsRSAAuthentication, SSHCFG_ALL },
421 { "hostbasedauthentication", sHostbasedAuthentication, SSHCFG_ALL },
422 { "hostbasedusesnamefrompacketonly", sHostbasedUsesNameFromPacketOnly, SSHCFG_GLOBAL },
423 { "rsaauthentication", sRSAAuthentication, SSHCFG_ALL },
424 { "pubkeyauthentication", sPubkeyAuthentication, SSHCFG_ALL },
425 { "dsaauthentication", sPubkeyAuthentication, SSHCFG_GLOBAL }, /* alias */
427 { "kerberosauthentication", sKerberosAuthentication, SSHCFG_ALL },
428 { "kerberosorlocalpasswd", sKerberosOrLocalPasswd, SSHCFG_GLOBAL },
429 { "kerberosticketcleanup", sKerberosTicketCleanup, SSHCFG_GLOBAL },
431 { "kerberosgetafstoken", sKerberosGetAFSToken, SSHCFG_GLOBAL },
433 { "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL },
436 { "kerberosauthentication", sUnsupported, SSHCFG_ALL },
437 { "kerberosorlocalpasswd", sUnsupported, SSHCFG_GLOBAL },
438 { "kerberosticketcleanup", sUnsupported, SSHCFG_GLOBAL },
439 { "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL },
441 { "kerberostgtpassing", sUnsupported, SSHCFG_GLOBAL },
442 { "afstokenpassing", sUnsupported, SSHCFG_GLOBAL },
444 { "gssapiauthentication", sGssAuthentication, SSHCFG_ALL },
445 { "gssapidelegatecredentials", sGssDelegateCreds, SSHCFG_ALL },
446 { "gssapicleanupcredentials", sGssCleanupCreds, SSHCFG_GLOBAL },
447 { "gssapicredentialspath", sGssCredsPath, SSHCFG_GLOBAL },
449 { "gsiallowlimitedproxy", sGsiAllowLimitedProxy, SSHCFG_GLOBAL },
451 { "gssapistrictacceptorcheck", sGssStrictAcceptor, SSHCFG_GLOBAL },
452 { "gssapikeyexchange", sGssKeyEx, SSHCFG_GLOBAL },
453 { "gssapistorecredentialsonrekey", sGssStoreRekey, SSHCFG_GLOBAL },
455 { "gssapiauthentication", sUnsupported, SSHCFG_ALL },
456 { "gssapidelegatecredentials", sUnsupported, SSHCFG_ALL },
457 { "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL },
458 { "gssapicredentialspath", sUnsupported, SSHCFG_GLOBAL },
460 { "gsiallowlimitedproxy", sUnsupported, SSHCFG_GLOBAL },
462 { "gssapistrictacceptorcheck", sUnsupported, SSHCFG_GLOBAL },
463 { "gssapikeyexchange", sUnsupported, SSHCFG_GLOBAL },
464 { "gssapistorecredentialsonrekey", sUnsupported, SSHCFG_GLOBAL },
467 { "allowsessionhooks", sAllowSessionHooks, SSHCFG_GLOBAL },
468 { "sessionhookstartupcmd", sSessionHookStartupCmd, SSHCFG_GLOBAL },
469 { "sessionhookshutdowncmd", sSessionHookShutdownCmd, SSHCFG_GLOBAL },
471 { "passwordauthentication", sPasswordAuthentication, SSHCFG_ALL },
472 { "kbdinteractiveauthentication", sKbdInteractiveAuthentication, SSHCFG_ALL },
473 { "challengeresponseauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL },
474 { "skeyauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL }, /* alias */
476 { "zeroknowledgepasswordauthentication", sZeroKnowledgePasswordAuthentication, SSHCFG_ALL },
478 { "zeroknowledgepasswordauthentication", sUnsupported, SSHCFG_ALL },
480 { "checkmail", sDeprecated, SSHCFG_GLOBAL },
481 { "listenaddress", sListenAddress, SSHCFG_GLOBAL },
482 { "addressfamily", sAddressFamily, SSHCFG_GLOBAL },
483 { "printmotd", sPrintMotd, SSHCFG_GLOBAL },
484 { "printlastlog", sPrintLastLog, SSHCFG_GLOBAL },
485 { "ignorerhosts", sIgnoreRhosts, SSHCFG_GLOBAL },
486 { "ignoreuserknownhosts", sIgnoreUserKnownHosts, SSHCFG_GLOBAL },
487 { "x11forwarding", sX11Forwarding, SSHCFG_ALL },
488 { "x11displayoffset", sX11DisplayOffset, SSHCFG_ALL },
489 { "x11uselocalhost", sX11UseLocalhost, SSHCFG_ALL },
490 { "xauthlocation", sXAuthLocation, SSHCFG_GLOBAL },
491 { "strictmodes", sStrictModes, SSHCFG_GLOBAL },
492 { "permitemptypasswords", sEmptyPasswd, SSHCFG_ALL },
493 { "permituserenvironment", sPermitUserEnvironment, SSHCFG_GLOBAL },
494 { "uselogin", sUseLogin, SSHCFG_GLOBAL },
495 { "compression", sCompression, SSHCFG_GLOBAL },
496 { "tcpkeepalive", sTCPKeepAlive, SSHCFG_GLOBAL },
497 { "keepalive", sTCPKeepAlive, SSHCFG_GLOBAL }, /* obsolete alias */
498 { "allowtcpforwarding", sAllowTcpForwarding, SSHCFG_ALL },
499 { "allowagentforwarding", sAllowAgentForwarding, SSHCFG_ALL },
500 { "allowusers", sAllowUsers, SSHCFG_GLOBAL },
501 { "denyusers", sDenyUsers, SSHCFG_GLOBAL },
502 { "allowgroups", sAllowGroups, SSHCFG_GLOBAL },
503 { "denygroups", sDenyGroups, SSHCFG_GLOBAL },
504 { "ciphers", sCiphers, SSHCFG_GLOBAL },
505 { "macs", sMacs, SSHCFG_GLOBAL },
506 { "protocol", sProtocol, SSHCFG_GLOBAL },
507 { "gatewayports", sGatewayPorts, SSHCFG_ALL },
508 { "subsystem", sSubsystem, SSHCFG_GLOBAL },
509 { "maxstartups", sMaxStartups, SSHCFG_GLOBAL },
510 { "maxauthtries", sMaxAuthTries, SSHCFG_ALL },
511 { "maxsessions", sMaxSessions, SSHCFG_ALL },
512 { "banner", sBanner, SSHCFG_ALL },
513 { "usedns", sUseDNS, SSHCFG_GLOBAL },
514 { "verifyreversemapping", sDeprecated, SSHCFG_GLOBAL },
515 { "reversemappingcheck", sDeprecated, SSHCFG_GLOBAL },
516 { "clientaliveinterval", sClientAliveInterval, SSHCFG_GLOBAL },
517 { "clientalivecountmax", sClientAliveCountMax, SSHCFG_GLOBAL },
518 { "authorizedkeysfile", sAuthorizedKeysFile, SSHCFG_GLOBAL },
519 { "authorizedkeysfile2", sAuthorizedKeysFile2, SSHCFG_GLOBAL },
520 { "useprivilegeseparation", sUsePrivilegeSeparation, SSHCFG_GLOBAL },
521 { "acceptenv", sAcceptEnv, SSHCFG_GLOBAL },
522 { "permittunnel", sPermitTunnel, SSHCFG_GLOBAL },
523 { "match", sMatch, SSHCFG_ALL },
524 { "permitopen", sPermitOpen, SSHCFG_ALL },
525 { "forcecommand", sForceCommand, SSHCFG_ALL },
526 { "chrootdirectory", sChrootDirectory, SSHCFG_ALL },
527 { "noneenabled", sNoneEnabled },
528 { "hpndisabled", sHPNDisabled },
529 { "hpnbuffersize", sHPNBufferSize },
530 { "tcprcvbufpoll", sTcpRcvBufPoll },
531 { NULL, sBadOption, 0 }
538 { SSH_TUNMODE_NO, "no" },
539 { SSH_TUNMODE_POINTOPOINT, "point-to-point" },
540 { SSH_TUNMODE_ETHERNET, "ethernet" },
541 { SSH_TUNMODE_YES, "yes" },
546 * Returns the number of the token pointed to by cp or sBadOption.
550 parse_token(const char *cp, const char *filename,
551 int linenum, u_int *flags)
555 for (i = 0; keywords[i].name; i++)
556 if (strcasecmp(cp, keywords[i].name) == 0) {
557 debug ("Config token is %s", keywords[i].name);
558 *flags = keywords[i].flags;
559 return keywords[i].opcode;
562 error("%s: line %d: Bad configuration option: %s",
563 filename, linenum, cp);
568 add_listen_addr(ServerOptions *options, char *addr, int port)
572 if (options->num_ports == 0)
573 options->ports[options->num_ports++] = SSH_DEFAULT_PORT;
574 if (options->address_family == -1)
575 options->address_family = AF_UNSPEC;
577 for (i = 0; i < options->num_ports; i++)
578 add_one_listen_addr(options, addr, options->ports[i]);
580 add_one_listen_addr(options, addr, port);
584 add_one_listen_addr(ServerOptions *options, char *addr, int port)
586 struct addrinfo hints, *ai, *aitop;
587 char strport[NI_MAXSERV];
590 memset(&hints, 0, sizeof(hints));
591 hints.ai_family = options->address_family;
592 hints.ai_socktype = SOCK_STREAM;
593 hints.ai_flags = (addr == NULL) ? AI_PASSIVE : 0;
594 snprintf(strport, sizeof strport, "%d", port);
595 if ((gaierr = getaddrinfo(addr, strport, &hints, &aitop)) != 0)
596 fatal("bad addr or host: %s (%s)",
597 addr ? addr : "<NULL>",
598 ssh_gai_strerror(gaierr));
599 for (ai = aitop; ai->ai_next; ai = ai->ai_next)
601 ai->ai_next = options->listen_addrs;
602 options->listen_addrs = aitop;
606 * The strategy for the Match blocks is that the config file is parsed twice.
608 * The first time is at startup. activep is initialized to 1 and the
609 * directives in the global context are processed and acted on. Hitting a
610 * Match directive unsets activep and the directives inside the block are
611 * checked for syntax only.
613 * The second time is after a connection has been established but before
614 * authentication. activep is initialized to 2 and global config directives
615 * are ignored since they have already been processed. If the criteria in a
616 * Match block is met, activep is set and the subsequent directives
617 * processed and actioned until EOF or another Match block unsets it. Any
618 * options set are copied into the main server config.
620 * Potential additions/improvements:
621 * - Add Match support for pre-kex directives, eg Protocol, Ciphers.
623 * - Add a Tag directive (idea from David Leonard) ala pf, eg:
624 * Match Address 192.168.0.*
629 * AllowTcpForwarding yes
630 * GatewayPorts clientspecified
633 * - Add a PermittedChannelRequests directive
635 * PermittedChannelRequests session,forwarded-tcpip
639 match_cfg_line_group(const char *grps, int line, const char *user)
647 if ((pw = getpwnam(user)) == NULL) {
648 debug("Can't match group at line %d because user %.100s does "
649 "not exist", line, user);
650 } else if (ga_init(pw->pw_name, pw->pw_gid) == 0) {
651 debug("Can't Match group because user %.100s not in any group "
652 "at line %d", user, line);
653 } else if (ga_match_pattern_list(grps) != 1) {
654 debug("user %.100s does not match group list %.100s at line %d",
657 debug("user %.100s matched group list %.100s at line %d", user,
667 match_cfg_line(char **condition, int line, const char *user, const char *host,
671 char *arg, *attrib, *cp = *condition;
675 debug3("checking syntax for 'Match %s'", cp);
677 debug3("checking match for '%s' user %s host %s addr %s", cp,
678 user ? user : "(null)", host ? host : "(null)",
679 address ? address : "(null)");
681 while ((attrib = strdelim(&cp)) && *attrib != '\0') {
682 if ((arg = strdelim(&cp)) == NULL || *arg == '\0') {
683 error("Missing Match criteria for %s", attrib);
687 if (strcasecmp(attrib, "user") == 0) {
692 if (match_pattern_list(user, arg, len, 0) != 1)
695 debug("user %.100s matched 'User %.100s' at "
696 "line %d", user, arg, line);
697 } else if (strcasecmp(attrib, "group") == 0) {
698 switch (match_cfg_line_group(arg, line, user)) {
704 } else if (strcasecmp(attrib, "host") == 0) {
709 if (match_hostname(host, arg, len) != 1)
712 debug("connection from %.100s matched 'Host "
713 "%.100s' at line %d", host, arg, line);
714 } else if (strcasecmp(attrib, "address") == 0) {
715 switch (addr_match_list(address, arg)) {
717 debug("connection from %.100s matched 'Address "
718 "%.100s' at line %d", address, arg, line);
728 error("Unsupported Match attribute %s", attrib);
733 debug3("match %sfound", result ? "" : "not ");
738 #define WHITESPACE " \t\r\n"
741 process_server_config_line(ServerOptions *options, char *line,
742 const char *filename, int linenum, int *activep, const char *user,
743 const char *host, const char *address)
745 char *cp, **charptr, *arg, *p;
746 int cmdline = 0, *intptr, value, n;
747 SyslogFacility *log_facility_ptr;
748 LogLevel *log_level_ptr;
749 ServerOpCodes opcode;
755 if ((arg = strdelim(&cp)) == NULL)
757 /* Ignore leading whitespace */
760 if (!arg || !*arg || *arg == '#')
764 opcode = parse_token(arg, filename, linenum, &flags);
766 if (activep == NULL) { /* We are processing a command line directive */
770 if (*activep && opcode != sMatch)
771 debug3("%s:%d setting %s %s", filename, linenum, arg, cp);
772 if (*activep == 0 && !(flags & SSHCFG_MATCH)) {
774 fatal("%s line %d: Directive '%s' is not allowed "
775 "within a Match block", filename, linenum, arg);
776 } else { /* this is a directive we have already processed */
784 /* Portable-specific options */
786 intptr = &options->use_pam;
789 case sPermitPAMUserChange:
790 intptr = &options->permit_pam_user_change;
793 /* Standard Options */
797 /* ignore ports from configfile if cmdline specifies ports */
798 if (options->ports_from_cmdline)
800 if (options->listen_addrs != NULL)
801 fatal("%s line %d: ports must be specified before "
802 "ListenAddress.", filename, linenum);
803 if (options->num_ports >= MAX_PORTS)
804 fatal("%s line %d: too many ports.",
807 if (!arg || *arg == '\0')
808 fatal("%s line %d: missing port number.",
810 options->ports[options->num_ports++] = a2port(arg);
811 if (options->ports[options->num_ports-1] <= 0)
812 fatal("%s line %d: Badly formatted port number.",
817 intptr = &options->server_key_bits;
820 if (!arg || *arg == '\0')
821 fatal("%s line %d: missing integer value.",
824 if (*activep && *intptr == -1)
828 case sLoginGraceTime:
829 intptr = &options->login_grace_time;
832 if (!arg || *arg == '\0')
833 fatal("%s line %d: missing time value.",
835 if ((value = convtime(arg)) == -1)
836 fatal("%s line %d: invalid time value.",
842 case sKeyRegenerationTime:
843 intptr = &options->key_regeneration_time;
848 if (arg == NULL || *arg == '\0')
849 fatal("%s line %d: missing address",
851 /* check for bare IPv6 address: no "[]" and 2 or more ":" */
852 if (strchr(arg, '[') == NULL && (p = strchr(arg, ':')) != NULL
853 && strchr(p+1, ':') != NULL) {
854 add_listen_addr(options, arg, 0);
859 fatal("%s line %d: bad address:port usage",
861 p = cleanhostname(p);
864 else if ((port = a2port(arg)) <= 0)
865 fatal("%s line %d: bad port number", filename, linenum);
867 add_listen_addr(options, p, port);
873 if (!arg || *arg == '\0')
874 fatal("%s line %d: missing address family.",
876 intptr = &options->address_family;
877 if (options->listen_addrs != NULL)
878 fatal("%s line %d: address family must be specified before "
879 "ListenAddress.", filename, linenum);
880 if (strcasecmp(arg, "inet") == 0)
882 else if (strcasecmp(arg, "inet6") == 0)
884 else if (strcasecmp(arg, "any") == 0)
887 fatal("%s line %d: unsupported address family \"%s\".",
888 filename, linenum, arg);
894 intptr = &options->num_host_key_files;
895 if (*intptr >= MAX_HOSTKEYS)
896 fatal("%s line %d: too many host keys specified (max %d).",
897 filename, linenum, MAX_HOSTKEYS);
898 charptr = &options->host_key_files[*intptr];
901 if (!arg || *arg == '\0')
902 fatal("%s line %d: missing file name.",
904 if (*activep && *charptr == NULL) {
905 *charptr = tilde_expand_filename(arg, getuid());
906 /* increase optional counter */
908 *intptr = *intptr + 1;
913 charptr = &options->pid_file;
916 case sPermitRootLogin:
917 intptr = &options->permit_root_login;
919 if (!arg || *arg == '\0')
920 fatal("%s line %d: missing yes/"
921 "without-password/forced-commands-only/no "
922 "argument.", filename, linenum);
923 value = 0; /* silence compiler */
924 if (strcmp(arg, "without-password") == 0)
925 value = PERMIT_NO_PASSWD;
926 else if (strcmp(arg, "forced-commands-only") == 0)
927 value = PERMIT_FORCED_ONLY;
928 else if (strcmp(arg, "yes") == 0)
930 else if (strcmp(arg, "no") == 0)
933 fatal("%s line %d: Bad yes/"
934 "without-password/forced-commands-only/no "
935 "argument: %s", filename, linenum, arg);
936 if (*activep && *intptr == -1)
941 intptr = &options->ignore_rhosts;
944 if (!arg || *arg == '\0')
945 fatal("%s line %d: missing yes/no argument.",
947 value = 0; /* silence compiler */
948 if (strcmp(arg, "yes") == 0)
950 else if (strcmp(arg, "no") == 0)
953 fatal("%s line %d: Bad yes/no argument: %s",
954 filename, linenum, arg);
955 if (*activep && *intptr == -1)
960 intptr = &options->none_enabled;
964 intptr = &options->tcp_rcv_buf_poll;
968 intptr = &options->hpn_disabled;
972 intptr = &options->hpn_buffer_size;
975 case sIgnoreUserKnownHosts:
976 intptr = &options->ignore_user_known_hosts;
979 case sRhostsRSAAuthentication:
980 intptr = &options->rhosts_rsa_authentication;
983 case sHostbasedAuthentication:
984 intptr = &options->hostbased_authentication;
987 case sHostbasedUsesNameFromPacketOnly:
988 intptr = &options->hostbased_uses_name_from_packet_only;
991 case sRSAAuthentication:
992 intptr = &options->rsa_authentication;
995 case sPubkeyAuthentication:
996 intptr = &options->pubkey_authentication;
999 case sKerberosAuthentication:
1000 intptr = &options->kerberos_authentication;
1003 case sKerberosOrLocalPasswd:
1004 intptr = &options->kerberos_or_local_passwd;
1007 case sKerberosTicketCleanup:
1008 intptr = &options->kerberos_ticket_cleanup;
1011 case sKerberosGetAFSToken:
1012 intptr = &options->kerberos_get_afs_token;
1015 case sGssAuthentication:
1016 intptr = &options->gss_authentication;
1019 case sGssDelegateCreds:
1020 intptr = &options->gss_deleg_creds;
1024 intptr = &options->gss_keyex;
1027 case sGssCleanupCreds:
1028 intptr = &options->gss_cleanup_creds;
1032 charptr = &options->gss_creds_path;
1033 goto parse_filename;
1035 case sGssStrictAcceptor:
1036 intptr = &options->gss_strict_acceptor;
1039 case sGssStoreRekey:
1040 intptr = &options->gss_store_rekey;
1044 case sGsiAllowLimitedProxy:
1045 intptr = &options->gsi_allow_limited_proxy;
1049 #ifdef SESSION_HOOKS
1050 case sAllowSessionHooks:
1051 intptr = &options->session_hooks_allow;
1053 case sSessionHookStartupCmd:
1054 case sSessionHookShutdownCmd:
1055 arg = strdelim(&cp);
1056 if (!arg || *arg == '\0')
1057 fatal("%s line %d: empty session hook command",
1059 if (opcode==sSessionHookStartupCmd)
1060 options->session_hooks_startup_cmd = strdup(arg);
1062 options->session_hooks_shutdown_cmd = strdup(arg);
1066 case sPasswordAuthentication:
1067 intptr = &options->password_authentication;
1070 case sZeroKnowledgePasswordAuthentication:
1071 intptr = &options->zero_knowledge_password_authentication;
1074 case sKbdInteractiveAuthentication:
1075 intptr = &options->kbd_interactive_authentication;
1078 case sChallengeResponseAuthentication:
1079 intptr = &options->challenge_response_authentication;
1083 intptr = &options->print_motd;
1087 intptr = &options->print_lastlog;
1090 case sX11Forwarding:
1091 intptr = &options->x11_forwarding;
1094 case sX11DisplayOffset:
1095 intptr = &options->x11_display_offset;
1098 case sX11UseLocalhost:
1099 intptr = &options->x11_use_localhost;
1102 case sXAuthLocation:
1103 charptr = &options->xauth_location;
1104 goto parse_filename;
1107 intptr = &options->strict_modes;
1111 intptr = &options->tcp_keep_alive;
1115 intptr = &options->permit_empty_passwd;
1118 case sPermitUserEnvironment:
1119 intptr = &options->permit_user_env;
1123 intptr = &options->use_login;
1127 intptr = &options->compression;
1128 arg = strdelim(&cp);
1129 if (!arg || *arg == '\0')
1130 fatal("%s line %d: missing yes/no/delayed "
1131 "argument.", filename, linenum);
1132 value = 0; /* silence compiler */
1133 if (strcmp(arg, "delayed") == 0)
1134 value = COMP_DELAYED;
1135 else if (strcmp(arg, "yes") == 0)
1137 else if (strcmp(arg, "no") == 0)
1140 fatal("%s line %d: Bad yes/no/delayed "
1141 "argument: %s", filename, linenum, arg);
1147 intptr = &options->gateway_ports;
1148 arg = strdelim(&cp);
1149 if (!arg || *arg == '\0')
1150 fatal("%s line %d: missing yes/no/clientspecified "
1151 "argument.", filename, linenum);
1152 value = 0; /* silence compiler */
1153 if (strcmp(arg, "clientspecified") == 0)
1155 else if (strcmp(arg, "yes") == 0)
1157 else if (strcmp(arg, "no") == 0)
1160 fatal("%s line %d: Bad yes/no/clientspecified "
1161 "argument: %s", filename, linenum, arg);
1162 if (*activep && *intptr == -1)
1167 intptr = &options->use_dns;
1171 log_facility_ptr = &options->log_facility;
1172 arg = strdelim(&cp);
1173 value = log_facility_number(arg);
1174 if (value == SYSLOG_FACILITY_NOT_SET)
1175 fatal("%.200s line %d: unsupported log facility '%s'",
1176 filename, linenum, arg ? arg : "<NONE>");
1177 if (*log_facility_ptr == -1)
1178 *log_facility_ptr = (SyslogFacility) value;
1182 log_level_ptr = &options->log_level;
1183 arg = strdelim(&cp);
1184 value = log_level_number(arg);
1185 if (value == SYSLOG_LEVEL_NOT_SET)
1186 fatal("%.200s line %d: unsupported log level '%s'",
1187 filename, linenum, arg ? arg : "<NONE>");
1188 if (*log_level_ptr == -1)
1189 *log_level_ptr = (LogLevel) value;
1192 case sAllowTcpForwarding:
1193 intptr = &options->allow_tcp_forwarding;
1196 case sAllowAgentForwarding:
1197 intptr = &options->allow_agent_forwarding;
1200 case sUsePrivilegeSeparation:
1201 intptr = &use_privsep;
1205 while ((arg = strdelim(&cp)) && *arg != '\0') {
1206 if (options->num_allow_users >= MAX_ALLOW_USERS)
1207 fatal("%s line %d: too many allow users.",
1209 options->allow_users[options->num_allow_users++] =
1215 while ((arg = strdelim(&cp)) && *arg != '\0') {
1216 if (options->num_deny_users >= MAX_DENY_USERS)
1217 fatal("%s line %d: too many deny users.",
1219 options->deny_users[options->num_deny_users++] =
1225 while ((arg = strdelim(&cp)) && *arg != '\0') {
1226 if (options->num_allow_groups >= MAX_ALLOW_GROUPS)
1227 fatal("%s line %d: too many allow groups.",
1229 options->allow_groups[options->num_allow_groups++] =
1235 while ((arg = strdelim(&cp)) && *arg != '\0') {
1236 if (options->num_deny_groups >= MAX_DENY_GROUPS)
1237 fatal("%s line %d: too many deny groups.",
1239 options->deny_groups[options->num_deny_groups++] = xstrdup(arg);
1244 arg = strdelim(&cp);
1245 if (!arg || *arg == '\0')
1246 fatal("%s line %d: Missing argument.", filename, linenum);
1247 if (!ciphers_valid(arg))
1248 fatal("%s line %d: Bad SSH2 cipher spec '%s'.",
1249 filename, linenum, arg ? arg : "<NONE>");
1250 if (options->ciphers == NULL)
1251 options->ciphers = xstrdup(arg);
1255 arg = strdelim(&cp);
1256 if (!arg || *arg == '\0')
1257 fatal("%s line %d: Missing argument.", filename, linenum);
1258 if (!mac_valid(arg))
1259 fatal("%s line %d: Bad SSH2 mac spec '%s'.",
1260 filename, linenum, arg ? arg : "<NONE>");
1261 if (options->macs == NULL)
1262 options->macs = xstrdup(arg);
1266 intptr = &options->protocol;
1267 arg = strdelim(&cp);
1268 if (!arg || *arg == '\0')
1269 fatal("%s line %d: Missing argument.", filename, linenum);
1270 value = proto_spec(arg);
1271 if (value == SSH_PROTO_UNKNOWN)
1272 fatal("%s line %d: Bad protocol spec '%s'.",
1273 filename, linenum, arg ? arg : "<NONE>");
1274 if (*intptr == SSH_PROTO_UNKNOWN)
1279 if (options->num_subsystems >= MAX_SUBSYSTEMS) {
1280 fatal("%s line %d: too many subsystems defined.",
1283 arg = strdelim(&cp);
1284 if (!arg || *arg == '\0')
1285 fatal("%s line %d: Missing subsystem name.",
1288 arg = strdelim(&cp);
1291 for (i = 0; i < options->num_subsystems; i++)
1292 if (strcmp(arg, options->subsystem_name[i]) == 0)
1293 fatal("%s line %d: Subsystem '%s' already defined.",
1294 filename, linenum, arg);
1295 options->subsystem_name[options->num_subsystems] = xstrdup(arg);
1296 arg = strdelim(&cp);
1297 if (!arg || *arg == '\0')
1298 fatal("%s line %d: Missing subsystem command.",
1300 options->subsystem_command[options->num_subsystems] = xstrdup(arg);
1302 /* Collect arguments (separate to executable) */
1304 len = strlen(p) + 1;
1305 while ((arg = strdelim(&cp)) != NULL && *arg != '\0') {
1306 len += 1 + strlen(arg);
1307 p = xrealloc(p, 1, len);
1308 strlcat(p, " ", len);
1309 strlcat(p, arg, len);
1311 options->subsystem_args[options->num_subsystems] = p;
1312 options->num_subsystems++;
1316 arg = strdelim(&cp);
1317 if (!arg || *arg == '\0')
1318 fatal("%s line %d: Missing MaxStartups spec.",
1320 if ((n = sscanf(arg, "%d:%d:%d",
1321 &options->max_startups_begin,
1322 &options->max_startups_rate,
1323 &options->max_startups)) == 3) {
1324 if (options->max_startups_begin >
1325 options->max_startups ||
1326 options->max_startups_rate > 100 ||
1327 options->max_startups_rate < 1)
1328 fatal("%s line %d: Illegal MaxStartups spec.",
1331 fatal("%s line %d: Illegal MaxStartups spec.",
1334 options->max_startups = options->max_startups_begin;
1338 intptr = &options->max_authtries;
1342 intptr = &options->max_sessions;
1346 charptr = &options->banner;
1347 goto parse_filename;
1350 * These options can contain %X options expanded at
1351 * connect time, so that you can specify paths like:
1353 * AuthorizedKeysFile /etc/ssh_keys/%u
1355 case sAuthorizedKeysFile:
1356 case sAuthorizedKeysFile2:
1357 charptr = (opcode == sAuthorizedKeysFile) ?
1358 &options->authorized_keys_file :
1359 &options->authorized_keys_file2;
1360 goto parse_filename;
1362 case sClientAliveInterval:
1363 intptr = &options->client_alive_interval;
1366 case sClientAliveCountMax:
1367 intptr = &options->client_alive_count_max;
1371 while ((arg = strdelim(&cp)) && *arg != '\0') {
1372 if (strchr(arg, '=') != NULL)
1373 fatal("%s line %d: Invalid environment name.",
1375 if (options->num_accept_env >= MAX_ACCEPT_ENV)
1376 fatal("%s line %d: too many allow env.",
1380 options->accept_env[options->num_accept_env++] =
1386 intptr = &options->permit_tun;
1387 arg = strdelim(&cp);
1388 if (!arg || *arg == '\0')
1389 fatal("%s line %d: Missing yes/point-to-point/"
1390 "ethernet/no argument.", filename, linenum);
1392 for (i = 0; tunmode_desc[i].val != -1; i++)
1393 if (strcmp(tunmode_desc[i].text, arg) == 0) {
1394 value = tunmode_desc[i].val;
1398 fatal("%s line %d: Bad yes/point-to-point/ethernet/"
1399 "no argument: %s", filename, linenum, arg);
1406 fatal("Match directive not supported as a command-line "
1408 value = match_cfg_line(&cp, linenum, user, host, address);
1410 fatal("%s line %d: Bad Match condition", filename,
1416 arg = strdelim(&cp);
1417 if (!arg || *arg == '\0')
1418 fatal("%s line %d: missing PermitOpen specification",
1420 n = options->num_permitted_opens; /* modified later */
1421 if (strcmp(arg, "any") == 0) {
1422 if (*activep && n == -1) {
1423 channel_clear_adm_permitted_opens();
1424 options->num_permitted_opens = 0;
1428 if (*activep && n == -1)
1429 channel_clear_adm_permitted_opens();
1430 for (; arg != NULL && *arg != '\0'; arg = strdelim(&cp)) {
1433 fatal("%s line %d: missing host in PermitOpen",
1435 p = cleanhostname(p);
1436 if (arg == NULL || (port = a2port(arg)) <= 0)
1437 fatal("%s line %d: bad port number in "
1438 "PermitOpen", filename, linenum);
1439 if (*activep && n == -1)
1440 options->num_permitted_opens =
1441 channel_add_adm_permitted_opens(p, port);
1447 fatal("%.200s line %d: Missing argument.", filename,
1449 len = strspn(cp, WHITESPACE);
1450 if (*activep && options->adm_forced_command == NULL)
1451 options->adm_forced_command = xstrdup(cp + len);
1454 case sChrootDirectory:
1455 charptr = &options->chroot_directory;
1457 arg = strdelim(&cp);
1458 if (!arg || *arg == '\0')
1459 fatal("%s line %d: missing file name.",
1461 if (*activep && *charptr == NULL)
1462 *charptr = xstrdup(arg);
1466 logit("%s line %d: Deprecated option %s",
1467 filename, linenum, arg);
1469 arg = strdelim(&cp);
1473 logit("%s line %d: Unsupported option %s",
1474 filename, linenum, arg);
1476 arg = strdelim(&cp);
1480 fatal("%s line %d: Missing handler for opcode %s (%d)",
1481 filename, linenum, arg, opcode);
1483 if ((arg = strdelim(&cp)) != NULL && *arg != '\0')
1484 fatal("%s line %d: garbage at end of line; \"%.200s\".",
1485 filename, linenum, arg);
1489 /* Reads the server configuration file. */
1492 load_server_config(const char *filename, Buffer *conf)
1494 char line[1024], *cp;
1497 debug2("%s: filename %s", __func__, filename);
1498 if ((f = fopen(filename, "r")) == NULL) {
1503 while (fgets(line, sizeof(line), f)) {
1505 * Trim out comments and strip whitespace
1506 * NB - preserve newlines, they are needed to reproduce
1507 * line numbers later for error messages
1509 if ((cp = strchr(line, '#')) != NULL)
1510 memcpy(cp, "\n", 2);
1511 cp = line + strspn(line, " \t\r");
1513 buffer_append(conf, cp, strlen(cp));
1515 buffer_append(conf, "\0", 1);
1517 debug2("%s: done config len = %d", __func__, buffer_len(conf));
1521 parse_server_match_config(ServerOptions *options, const char *user,
1522 const char *host, const char *address)
1526 initialize_server_options(&mo);
1527 parse_server_config(&mo, "reprocess config", &cfg, user, host, address);
1528 copy_set_server_options(options, &mo, 0);
1532 #define M_CP_INTOPT(n) do {\
1536 #define M_CP_STROPT(n) do {\
1537 if (src->n != NULL) { \
1538 if (dst->n != NULL) \
1545 * Copy any supported values that are set.
1547 * If the preauth flag is set, we do not bother copying the the string or
1548 * array values that are not used pre-authentication, because any that we
1549 * do use must be explictly sent in mm_getpwnamallow().
1552 copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
1554 M_CP_INTOPT(password_authentication);
1555 M_CP_INTOPT(gss_authentication);
1556 M_CP_INTOPT(gss_deleg_creds);
1557 M_CP_INTOPT(rsa_authentication);
1558 M_CP_INTOPT(pubkey_authentication);
1559 M_CP_INTOPT(kerberos_authentication);
1560 M_CP_INTOPT(hostbased_authentication);
1561 M_CP_INTOPT(kbd_interactive_authentication);
1562 M_CP_INTOPT(zero_knowledge_password_authentication);
1563 M_CP_INTOPT(permit_root_login);
1564 M_CP_INTOPT(permit_empty_passwd);
1566 M_CP_INTOPT(allow_tcp_forwarding);
1567 M_CP_INTOPT(allow_agent_forwarding);
1568 M_CP_INTOPT(gateway_ports);
1569 M_CP_INTOPT(x11_display_offset);
1570 M_CP_INTOPT(x11_forwarding);
1571 M_CP_INTOPT(x11_use_localhost);
1572 M_CP_INTOPT(max_sessions);
1573 M_CP_INTOPT(max_authtries);
1575 M_CP_STROPT(banner);
1578 M_CP_STROPT(adm_forced_command);
1579 M_CP_STROPT(chroot_directory);
1586 parse_server_config(ServerOptions *options, const char *filename, Buffer *conf,
1587 const char *user, const char *host, const char *address)
1589 int active, linenum, bad_options = 0;
1590 char *cp, *obuf, *cbuf;
1592 debug2("%s: config %s len %d", __func__, filename, buffer_len(conf));
1594 obuf = cbuf = xstrdup(buffer_ptr(conf));
1595 active = user ? 0 : 1;
1597 while ((cp = strsep(&cbuf, "\n")) != NULL) {
1598 if (process_server_config_line(options, cp, filename,
1599 linenum++, &active, user, host, address) != 0)
1603 if (bad_options > 0)
1604 fatal("%s: terminating, %d bad configuration options",
1605 filename, bad_options);
1609 fmt_intarg(ServerOpCodes code, int val)
1611 if (code == sAddressFamily) {
1623 if (code == sPermitRootLogin) {
1625 case PERMIT_NO_PASSWD:
1626 return "without-password";
1627 case PERMIT_FORCED_ONLY:
1628 return "forced-commands-only";
1633 if (code == sProtocol) {
1639 case (SSH_PROTO_1|SSH_PROTO_2):
1645 if (code == sGatewayPorts && val == 2)
1646 return "clientspecified";
1647 if (code == sCompression && val == COMP_DELAYED)
1661 lookup_opcode_name(ServerOpCodes code)
1665 for (i = 0; keywords[i].name != NULL; i++)
1666 if (keywords[i].opcode == code)
1667 return(keywords[i].name);
1672 dump_cfg_int(ServerOpCodes code, int val)
1674 printf("%s %d\n", lookup_opcode_name(code), val);
1678 dump_cfg_fmtint(ServerOpCodes code, int val)
1680 printf("%s %s\n", lookup_opcode_name(code), fmt_intarg(code, val));
1684 dump_cfg_string(ServerOpCodes code, const char *val)
1688 printf("%s %s\n", lookup_opcode_name(code), val);
1692 dump_cfg_strarray(ServerOpCodes code, u_int count, char **vals)
1696 for (i = 0; i < count; i++)
1697 printf("%s %s\n", lookup_opcode_name(code), vals[i]);
1701 dump_config(ServerOptions *o)
1705 struct addrinfo *ai;
1706 char addr[NI_MAXHOST], port[NI_MAXSERV], *s = NULL;
1708 /* these are usually at the top of the config */
1709 for (i = 0; i < o->num_ports; i++)
1710 printf("port %d\n", o->ports[i]);
1711 dump_cfg_fmtint(sProtocol, o->protocol);
1712 dump_cfg_fmtint(sAddressFamily, o->address_family);
1714 /* ListenAddress must be after Port */
1715 for (ai = o->listen_addrs; ai; ai = ai->ai_next) {
1716 if ((ret = getnameinfo(ai->ai_addr, ai->ai_addrlen, addr,
1717 sizeof(addr), port, sizeof(port),
1718 NI_NUMERICHOST|NI_NUMERICSERV)) != 0) {
1719 error("getnameinfo failed: %.100s",
1720 (ret != EAI_SYSTEM) ? gai_strerror(ret) :
1723 if (ai->ai_family == AF_INET6)
1724 printf("listenaddress [%s]:%s\n", addr, port);
1726 printf("listenaddress %s:%s\n", addr, port);
1730 /* integer arguments */
1732 dump_cfg_int(sUsePAM, o->use_pam);
1734 dump_cfg_int(sServerKeyBits, o->server_key_bits);
1735 dump_cfg_int(sLoginGraceTime, o->login_grace_time);
1736 dump_cfg_int(sKeyRegenerationTime, o->key_regeneration_time);
1737 dump_cfg_int(sX11DisplayOffset, o->x11_display_offset);
1738 dump_cfg_int(sMaxAuthTries, o->max_authtries);
1739 dump_cfg_int(sMaxSessions, o->max_sessions);
1740 dump_cfg_int(sClientAliveInterval, o->client_alive_interval);
1741 dump_cfg_int(sClientAliveCountMax, o->client_alive_count_max);
1743 /* formatted integer arguments */
1744 dump_cfg_fmtint(sPermitRootLogin, o->permit_root_login);
1745 dump_cfg_fmtint(sIgnoreRhosts, o->ignore_rhosts);
1746 dump_cfg_fmtint(sIgnoreUserKnownHosts, o->ignore_user_known_hosts);
1747 dump_cfg_fmtint(sRhostsRSAAuthentication, o->rhosts_rsa_authentication);
1748 dump_cfg_fmtint(sHostbasedAuthentication, o->hostbased_authentication);
1749 dump_cfg_fmtint(sHostbasedUsesNameFromPacketOnly,
1750 o->hostbased_uses_name_from_packet_only);
1751 dump_cfg_fmtint(sRSAAuthentication, o->rsa_authentication);
1752 dump_cfg_fmtint(sPubkeyAuthentication, o->pubkey_authentication);
1754 dump_cfg_fmtint(sKerberosAuthentication, o->kerberos_authentication);
1755 dump_cfg_fmtint(sKerberosOrLocalPasswd, o->kerberos_or_local_passwd);
1756 dump_cfg_fmtint(sKerberosTicketCleanup, o->kerberos_ticket_cleanup);
1758 dump_cfg_fmtint(sKerberosGetAFSToken, o->kerberos_get_afs_token);
1762 dump_cfg_fmtint(sGssAuthentication, o->gss_authentication);
1763 dump_cfg_fmtint(sGssCleanupCreds, o->gss_cleanup_creds);
1766 dump_cfg_fmtint(sZeroKnowledgePasswordAuthentication,
1767 o->zero_knowledge_password_authentication);
1769 dump_cfg_fmtint(sPasswordAuthentication, o->password_authentication);
1770 dump_cfg_fmtint(sKbdInteractiveAuthentication,
1771 o->kbd_interactive_authentication);
1772 dump_cfg_fmtint(sChallengeResponseAuthentication,
1773 o->challenge_response_authentication);
1774 dump_cfg_fmtint(sPrintMotd, o->print_motd);
1775 dump_cfg_fmtint(sPrintLastLog, o->print_lastlog);
1776 dump_cfg_fmtint(sX11Forwarding, o->x11_forwarding);
1777 dump_cfg_fmtint(sX11UseLocalhost, o->x11_use_localhost);
1778 dump_cfg_fmtint(sStrictModes, o->strict_modes);
1779 dump_cfg_fmtint(sTCPKeepAlive, o->tcp_keep_alive);
1780 dump_cfg_fmtint(sEmptyPasswd, o->permit_empty_passwd);
1781 dump_cfg_fmtint(sPermitUserEnvironment, o->permit_user_env);
1782 dump_cfg_fmtint(sUseLogin, o->use_login);
1783 dump_cfg_fmtint(sCompression, o->compression);
1784 dump_cfg_fmtint(sGatewayPorts, o->gateway_ports);
1785 dump_cfg_fmtint(sUseDNS, o->use_dns);
1786 dump_cfg_fmtint(sAllowTcpForwarding, o->allow_tcp_forwarding);
1787 dump_cfg_fmtint(sUsePrivilegeSeparation, use_privsep);
1789 /* string arguments */
1790 dump_cfg_string(sPidFile, o->pid_file);
1791 dump_cfg_string(sXAuthLocation, o->xauth_location);
1792 dump_cfg_string(sCiphers, o->ciphers);
1793 dump_cfg_string(sMacs, o->macs);
1794 dump_cfg_string(sBanner, o->banner);
1795 dump_cfg_string(sAuthorizedKeysFile, o->authorized_keys_file);
1796 dump_cfg_string(sAuthorizedKeysFile2, o->authorized_keys_file2);
1797 dump_cfg_string(sForceCommand, o->adm_forced_command);
1799 /* string arguments requiring a lookup */
1800 dump_cfg_string(sLogLevel, log_level_name(o->log_level));
1801 dump_cfg_string(sLogFacility, log_facility_name(o->log_facility));
1803 /* string array arguments */
1804 dump_cfg_strarray(sHostKeyFile, o->num_host_key_files,
1806 dump_cfg_strarray(sAllowUsers, o->num_allow_users, o->allow_users);
1807 dump_cfg_strarray(sDenyUsers, o->num_deny_users, o->deny_users);
1808 dump_cfg_strarray(sAllowGroups, o->num_allow_groups, o->allow_groups);
1809 dump_cfg_strarray(sDenyGroups, o->num_deny_groups, o->deny_groups);
1810 dump_cfg_strarray(sAcceptEnv, o->num_accept_env, o->accept_env);
1812 /* other arguments */
1813 for (i = 0; i < o->num_subsystems; i++)
1814 printf("subsystem %s %s\n", o->subsystem_name[i],
1815 o->subsystem_args[i]);
1817 printf("maxstartups %d:%d:%d\n", o->max_startups_begin,
1818 o->max_startups_rate, o->max_startups);
1820 for (i = 0; tunmode_desc[i].val != -1; i++)
1821 if (tunmode_desc[i].val == o->permit_tun) {
1822 s = tunmode_desc[i].text;
1825 dump_cfg_string(sPermitTunnel, s);
1827 channel_print_adm_permitted_opens();