1 /* $OpenBSD: servconf.c,v 1.178 2008/05/07 05:49:37 pyr Exp $ */
3 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
6 * As far as I am concerned, the code I have written for this software
7 * can be used freely for any purpose. Any derived versions of this
8 * software must be clearly marked as such, and if the derived work is
9 * incompatible with the protocol description in the RFC file, it must be
10 * called by a name other than "ssh" or "Secure Shell".
15 #include <sys/types.h>
16 #include <sys/socket.h>
33 #include "pathnames.h"
41 #include "groupaccess.h"
43 static void add_listen_addr(ServerOptions *, char *, u_short);
44 static void add_one_listen_addr(ServerOptions *, char *, u_short);
46 /* Use of privilege separation or not */
47 extern int use_privsep;
50 /* Initializes the server options to their default values. */
53 initialize_server_options(ServerOptions *options)
55 memset(options, 0, sizeof(*options));
57 /* Portable-specific options */
58 options->use_pam = -1;
60 /* Standard Options */
61 options->num_ports = 0;
62 options->ports_from_cmdline = 0;
63 options->listen_addrs = NULL;
64 options->address_family = -1;
65 options->num_host_key_files = 0;
66 options->pid_file = NULL;
67 options->server_key_bits = -1;
68 options->login_grace_time = -1;
69 options->key_regeneration_time = -1;
70 options->permit_root_login = PERMIT_NOT_SET;
71 options->ignore_rhosts = -1;
72 options->ignore_user_known_hosts = -1;
73 options->print_motd = -1;
74 options->print_lastlog = -1;
75 options->x11_forwarding = -1;
76 options->x11_display_offset = -1;
77 options->x11_use_localhost = -1;
78 options->xauth_location = NULL;
79 options->strict_modes = -1;
80 options->tcp_keep_alive = -1;
81 options->log_facility = SYSLOG_FACILITY_NOT_SET;
82 options->log_level = SYSLOG_LEVEL_NOT_SET;
83 options->rhosts_rsa_authentication = -1;
84 options->hostbased_authentication = -1;
85 options->hostbased_uses_name_from_packet_only = -1;
86 options->rsa_authentication = -1;
87 options->pubkey_authentication = -1;
88 options->kerberos_authentication = -1;
89 options->kerberos_or_local_passwd = -1;
90 options->kerberos_ticket_cleanup = -1;
91 options->kerberos_get_afs_token = -1;
92 options->gss_authentication=-1;
93 options->gss_cleanup_creds = -1;
94 options->password_authentication = -1;
95 options->kbd_interactive_authentication = -1;
96 options->challenge_response_authentication = -1;
97 options->permit_empty_passwd = -1;
98 options->permit_user_env = -1;
99 options->use_login = -1;
100 options->compression = -1;
101 options->allow_tcp_forwarding = -1;
102 options->allow_agent_forwarding = -1;
103 options->num_allow_users = 0;
104 options->num_deny_users = 0;
105 options->num_allow_groups = 0;
106 options->num_deny_groups = 0;
107 options->ciphers = NULL;
108 options->macs = NULL;
109 options->protocol = SSH_PROTO_UNKNOWN;
110 options->gateway_ports = -1;
111 options->num_subsystems = 0;
112 options->max_startups_begin = -1;
113 options->max_startups_rate = -1;
114 options->max_startups = -1;
115 options->max_authtries = -1;
116 options->banner = NULL;
117 options->use_dns = -1;
118 options->client_alive_interval = -1;
119 options->client_alive_count_max = -1;
120 options->authorized_keys_file = NULL;
121 options->authorized_keys_file2 = NULL;
122 options->num_accept_env = 0;
123 options->permit_tun = -1;
124 options->num_permitted_opens = -1;
125 options->adm_forced_command = NULL;
126 options->chroot_directory = NULL;
130 fill_default_server_options(ServerOptions *options)
132 /* Portable-specific options */
133 if (options->use_pam == -1)
134 options->use_pam = 0;
136 /* Standard Options */
137 if (options->protocol == SSH_PROTO_UNKNOWN)
138 options->protocol = SSH_PROTO_1|SSH_PROTO_2;
139 if (options->num_host_key_files == 0) {
140 /* fill default hostkeys for protocols */
141 if (options->protocol & SSH_PROTO_1)
142 options->host_key_files[options->num_host_key_files++] =
144 if (options->protocol & SSH_PROTO_2) {
145 options->host_key_files[options->num_host_key_files++] =
146 _PATH_HOST_RSA_KEY_FILE;
147 options->host_key_files[options->num_host_key_files++] =
148 _PATH_HOST_DSA_KEY_FILE;
151 if (options->num_ports == 0)
152 options->ports[options->num_ports++] = SSH_DEFAULT_PORT;
153 if (options->listen_addrs == NULL)
154 add_listen_addr(options, NULL, 0);
155 if (options->pid_file == NULL)
156 options->pid_file = _PATH_SSH_DAEMON_PID_FILE;
157 if (options->server_key_bits == -1)
158 options->server_key_bits = 768;
159 if (options->login_grace_time == -1)
160 options->login_grace_time = 120;
161 if (options->key_regeneration_time == -1)
162 options->key_regeneration_time = 3600;
163 if (options->permit_root_login == PERMIT_NOT_SET)
164 options->permit_root_login = PERMIT_YES;
165 if (options->ignore_rhosts == -1)
166 options->ignore_rhosts = 1;
167 if (options->ignore_user_known_hosts == -1)
168 options->ignore_user_known_hosts = 0;
169 if (options->print_motd == -1)
170 options->print_motd = 1;
171 if (options->print_lastlog == -1)
172 options->print_lastlog = 1;
173 if (options->x11_forwarding == -1)
174 options->x11_forwarding = 0;
175 if (options->x11_display_offset == -1)
176 options->x11_display_offset = 10;
177 if (options->x11_use_localhost == -1)
178 options->x11_use_localhost = 1;
179 if (options->xauth_location == NULL)
180 options->xauth_location = _PATH_XAUTH;
181 if (options->strict_modes == -1)
182 options->strict_modes = 1;
183 if (options->tcp_keep_alive == -1)
184 options->tcp_keep_alive = 1;
185 if (options->log_facility == SYSLOG_FACILITY_NOT_SET)
186 options->log_facility = SYSLOG_FACILITY_AUTH;
187 if (options->log_level == SYSLOG_LEVEL_NOT_SET)
188 options->log_level = SYSLOG_LEVEL_INFO;
189 if (options->rhosts_rsa_authentication == -1)
190 options->rhosts_rsa_authentication = 0;
191 if (options->hostbased_authentication == -1)
192 options->hostbased_authentication = 0;
193 if (options->hostbased_uses_name_from_packet_only == -1)
194 options->hostbased_uses_name_from_packet_only = 0;
195 if (options->rsa_authentication == -1)
196 options->rsa_authentication = 1;
197 if (options->pubkey_authentication == -1)
198 options->pubkey_authentication = 1;
199 if (options->kerberos_authentication == -1)
200 options->kerberos_authentication = 0;
201 if (options->kerberos_or_local_passwd == -1)
202 options->kerberos_or_local_passwd = 1;
203 if (options->kerberos_ticket_cleanup == -1)
204 options->kerberos_ticket_cleanup = 1;
205 if (options->kerberos_get_afs_token == -1)
206 options->kerberos_get_afs_token = 0;
207 if (options->gss_authentication == -1)
208 options->gss_authentication = 0;
209 if (options->gss_cleanup_creds == -1)
210 options->gss_cleanup_creds = 1;
211 if (options->password_authentication == -1)
212 options->password_authentication = 1;
213 if (options->kbd_interactive_authentication == -1)
214 options->kbd_interactive_authentication = 0;
215 if (options->challenge_response_authentication == -1)
216 options->challenge_response_authentication = 1;
217 if (options->permit_empty_passwd == -1)
218 options->permit_empty_passwd = 0;
219 if (options->permit_user_env == -1)
220 options->permit_user_env = 0;
221 if (options->use_login == -1)
222 options->use_login = 0;
223 if (options->compression == -1)
224 options->compression = COMP_DELAYED;
225 if (options->allow_tcp_forwarding == -1)
226 options->allow_tcp_forwarding = 1;
227 if (options->allow_agent_forwarding == -1)
228 options->allow_agent_forwarding = 1;
229 if (options->gateway_ports == -1)
230 options->gateway_ports = 0;
231 if (options->max_startups == -1)
232 options->max_startups = 10;
233 if (options->max_startups_rate == -1)
234 options->max_startups_rate = 100; /* 100% */
235 if (options->max_startups_begin == -1)
236 options->max_startups_begin = options->max_startups;
237 if (options->max_authtries == -1)
238 options->max_authtries = DEFAULT_AUTH_FAIL_MAX;
239 if (options->use_dns == -1)
240 options->use_dns = 1;
241 if (options->client_alive_interval == -1)
242 options->client_alive_interval = 0;
243 if (options->client_alive_count_max == -1)
244 options->client_alive_count_max = 3;
245 if (options->authorized_keys_file2 == NULL) {
246 /* authorized_keys_file2 falls back to authorized_keys_file */
247 if (options->authorized_keys_file != NULL)
248 options->authorized_keys_file2 = options->authorized_keys_file;
250 options->authorized_keys_file2 = _PATH_SSH_USER_PERMITTED_KEYS2;
252 if (options->authorized_keys_file == NULL)
253 options->authorized_keys_file = _PATH_SSH_USER_PERMITTED_KEYS;
254 if (options->permit_tun == -1)
255 options->permit_tun = SSH_TUNMODE_NO;
257 /* Turn privilege separation on by default */
258 if (use_privsep == -1)
262 if (use_privsep && options->compression == 1) {
263 error("This platform does not support both privilege "
264 "separation and compression");
265 error("Compression disabled");
266 options->compression = 0;
272 /* Keyword tokens. */
274 sBadOption, /* == unknown option */
275 /* Portable-specific options */
277 /* Standard Options */
278 sPort, sHostKeyFile, sServerKeyBits, sLoginGraceTime, sKeyRegenerationTime,
279 sPermitRootLogin, sLogFacility, sLogLevel,
280 sRhostsRSAAuthentication, sRSAAuthentication,
281 sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup,
282 sKerberosGetAFSToken,
283 sKerberosTgtPassing, sChallengeResponseAuthentication,
284 sPasswordAuthentication, sKbdInteractiveAuthentication,
285 sListenAddress, sAddressFamily,
286 sPrintMotd, sPrintLastLog, sIgnoreRhosts,
287 sX11Forwarding, sX11DisplayOffset, sX11UseLocalhost,
288 sStrictModes, sEmptyPasswd, sTCPKeepAlive,
289 sPermitUserEnvironment, sUseLogin, sAllowTcpForwarding, sCompression,
290 sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups,
291 sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile,
292 sGatewayPorts, sPubkeyAuthentication, sXAuthLocation, sSubsystem,
293 sMaxStartups, sMaxAuthTries,
294 sBanner, sUseDNS, sHostbasedAuthentication,
295 sHostbasedUsesNameFromPacketOnly, sClientAliveInterval,
296 sClientAliveCountMax, sAuthorizedKeysFile, sAuthorizedKeysFile2,
297 sGssAuthentication, sGssCleanupCreds, sAcceptEnv, sPermitTunnel,
298 sMatch, sPermitOpen, sForceCommand, sChrootDirectory,
299 sUsePrivilegeSeparation, sAllowAgentForwarding,
300 sDeprecated, sUnsupported
303 #define SSHCFG_GLOBAL 0x01 /* allowed in main section of sshd_config */
304 #define SSHCFG_MATCH 0x02 /* allowed inside a Match section */
305 #define SSHCFG_ALL (SSHCFG_GLOBAL|SSHCFG_MATCH)
307 /* Textual representation of the tokens. */
310 ServerOpCodes opcode;
313 /* Portable-specific options */
315 { "usepam", sUsePAM, SSHCFG_GLOBAL },
317 { "usepam", sUnsupported, SSHCFG_GLOBAL },
319 { "pamauthenticationviakbdint", sDeprecated, SSHCFG_GLOBAL },
320 /* Standard Options */
321 { "port", sPort, SSHCFG_GLOBAL },
322 { "hostkey", sHostKeyFile, SSHCFG_GLOBAL },
323 { "hostdsakey", sHostKeyFile, SSHCFG_GLOBAL }, /* alias */
324 { "pidfile", sPidFile, SSHCFG_GLOBAL },
325 { "serverkeybits", sServerKeyBits, SSHCFG_GLOBAL },
326 { "logingracetime", sLoginGraceTime, SSHCFG_GLOBAL },
327 { "keyregenerationinterval", sKeyRegenerationTime, SSHCFG_GLOBAL },
328 { "permitrootlogin", sPermitRootLogin, SSHCFG_ALL },
329 { "syslogfacility", sLogFacility, SSHCFG_GLOBAL },
330 { "loglevel", sLogLevel, SSHCFG_GLOBAL },
331 { "rhostsauthentication", sDeprecated, SSHCFG_GLOBAL },
332 { "rhostsrsaauthentication", sRhostsRSAAuthentication, SSHCFG_ALL },
333 { "hostbasedauthentication", sHostbasedAuthentication, SSHCFG_ALL },
334 { "hostbasedusesnamefrompacketonly", sHostbasedUsesNameFromPacketOnly, SSHCFG_GLOBAL },
335 { "rsaauthentication", sRSAAuthentication, SSHCFG_ALL },
336 { "pubkeyauthentication", sPubkeyAuthentication, SSHCFG_ALL },
337 { "dsaauthentication", sPubkeyAuthentication, SSHCFG_GLOBAL }, /* alias */
339 { "kerberosauthentication", sKerberosAuthentication, SSHCFG_ALL },
340 { "kerberosorlocalpasswd", sKerberosOrLocalPasswd, SSHCFG_GLOBAL },
341 { "kerberosticketcleanup", sKerberosTicketCleanup, SSHCFG_GLOBAL },
343 { "kerberosgetafstoken", sKerberosGetAFSToken, SSHCFG_GLOBAL },
345 { "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL },
348 { "kerberosauthentication", sUnsupported, SSHCFG_ALL },
349 { "kerberosorlocalpasswd", sUnsupported, SSHCFG_GLOBAL },
350 { "kerberosticketcleanup", sUnsupported, SSHCFG_GLOBAL },
351 { "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL },
353 { "kerberostgtpassing", sUnsupported, SSHCFG_GLOBAL },
354 { "afstokenpassing", sUnsupported, SSHCFG_GLOBAL },
356 { "gssapiauthentication", sGssAuthentication, SSHCFG_ALL },
357 { "gssapicleanupcredentials", sGssCleanupCreds, SSHCFG_GLOBAL },
359 { "gssapiauthentication", sUnsupported, SSHCFG_ALL },
360 { "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL },
362 { "passwordauthentication", sPasswordAuthentication, SSHCFG_ALL },
363 { "kbdinteractiveauthentication", sKbdInteractiveAuthentication, SSHCFG_ALL },
364 { "challengeresponseauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL },
365 { "skeyauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL }, /* alias */
366 { "checkmail", sDeprecated, SSHCFG_GLOBAL },
367 { "listenaddress", sListenAddress, SSHCFG_GLOBAL },
368 { "addressfamily", sAddressFamily, SSHCFG_GLOBAL },
369 { "printmotd", sPrintMotd, SSHCFG_GLOBAL },
370 { "printlastlog", sPrintLastLog, SSHCFG_GLOBAL },
371 { "ignorerhosts", sIgnoreRhosts, SSHCFG_GLOBAL },
372 { "ignoreuserknownhosts", sIgnoreUserKnownHosts, SSHCFG_GLOBAL },
373 { "x11forwarding", sX11Forwarding, SSHCFG_ALL },
374 { "x11displayoffset", sX11DisplayOffset, SSHCFG_ALL },
375 { "x11uselocalhost", sX11UseLocalhost, SSHCFG_ALL },
376 { "xauthlocation", sXAuthLocation, SSHCFG_GLOBAL },
377 { "strictmodes", sStrictModes, SSHCFG_GLOBAL },
378 { "permitemptypasswords", sEmptyPasswd, SSHCFG_GLOBAL },
379 { "permituserenvironment", sPermitUserEnvironment, SSHCFG_GLOBAL },
380 { "uselogin", sUseLogin, SSHCFG_GLOBAL },
381 { "compression", sCompression, SSHCFG_GLOBAL },
382 { "tcpkeepalive", sTCPKeepAlive, SSHCFG_GLOBAL },
383 { "keepalive", sTCPKeepAlive, SSHCFG_GLOBAL }, /* obsolete alias */
384 { "allowtcpforwarding", sAllowTcpForwarding, SSHCFG_ALL },
385 { "allowagentforwarding", sAllowAgentForwarding, SSHCFG_ALL },
386 { "allowusers", sAllowUsers, SSHCFG_GLOBAL },
387 { "denyusers", sDenyUsers, SSHCFG_GLOBAL },
388 { "allowgroups", sAllowGroups, SSHCFG_GLOBAL },
389 { "denygroups", sDenyGroups, SSHCFG_GLOBAL },
390 { "ciphers", sCiphers, SSHCFG_GLOBAL },
391 { "macs", sMacs, SSHCFG_GLOBAL },
392 { "protocol", sProtocol, SSHCFG_GLOBAL },
393 { "gatewayports", sGatewayPorts, SSHCFG_ALL },
394 { "subsystem", sSubsystem, SSHCFG_GLOBAL },
395 { "maxstartups", sMaxStartups, SSHCFG_GLOBAL },
396 { "maxauthtries", sMaxAuthTries, SSHCFG_GLOBAL },
397 { "banner", sBanner, SSHCFG_ALL },
398 { "usedns", sUseDNS, SSHCFG_GLOBAL },
399 { "verifyreversemapping", sDeprecated, SSHCFG_GLOBAL },
400 { "reversemappingcheck", sDeprecated, SSHCFG_GLOBAL },
401 { "clientaliveinterval", sClientAliveInterval, SSHCFG_GLOBAL },
402 { "clientalivecountmax", sClientAliveCountMax, SSHCFG_GLOBAL },
403 { "authorizedkeysfile", sAuthorizedKeysFile, SSHCFG_GLOBAL },
404 { "authorizedkeysfile2", sAuthorizedKeysFile2, SSHCFG_GLOBAL },
405 { "useprivilegeseparation", sUsePrivilegeSeparation, SSHCFG_GLOBAL },
406 { "acceptenv", sAcceptEnv, SSHCFG_GLOBAL },
407 { "permittunnel", sPermitTunnel, SSHCFG_GLOBAL },
408 { "match", sMatch, SSHCFG_ALL },
409 { "permitopen", sPermitOpen, SSHCFG_ALL },
410 { "forcecommand", sForceCommand, SSHCFG_ALL },
411 { "chrootdirectory", sChrootDirectory, SSHCFG_ALL },
412 { NULL, sBadOption, 0 }
416 * Returns the number of the token pointed to by cp or sBadOption.
420 parse_token(const char *cp, const char *filename,
421 int linenum, u_int *flags)
425 for (i = 0; keywords[i].name; i++)
426 if (strcasecmp(cp, keywords[i].name) == 0) {
427 *flags = keywords[i].flags;
428 return keywords[i].opcode;
431 error("%s: line %d: Bad configuration option: %s",
432 filename, linenum, cp);
437 add_listen_addr(ServerOptions *options, char *addr, u_short port)
441 if (options->num_ports == 0)
442 options->ports[options->num_ports++] = SSH_DEFAULT_PORT;
443 if (options->address_family == -1)
444 options->address_family = AF_UNSPEC;
446 for (i = 0; i < options->num_ports; i++)
447 add_one_listen_addr(options, addr, options->ports[i]);
449 add_one_listen_addr(options, addr, port);
453 add_one_listen_addr(ServerOptions *options, char *addr, u_short port)
455 struct addrinfo hints, *ai, *aitop;
456 char strport[NI_MAXSERV];
459 memset(&hints, 0, sizeof(hints));
460 hints.ai_family = options->address_family;
461 hints.ai_socktype = SOCK_STREAM;
462 hints.ai_flags = (addr == NULL) ? AI_PASSIVE : 0;
463 snprintf(strport, sizeof strport, "%u", port);
464 if ((gaierr = getaddrinfo(addr, strport, &hints, &aitop)) != 0)
465 fatal("bad addr or host: %s (%s)",
466 addr ? addr : "<NULL>",
467 ssh_gai_strerror(gaierr));
468 for (ai = aitop; ai->ai_next; ai = ai->ai_next)
470 ai->ai_next = options->listen_addrs;
471 options->listen_addrs = aitop;
475 * The strategy for the Match blocks is that the config file is parsed twice.
477 * The first time is at startup. activep is initialized to 1 and the
478 * directives in the global context are processed and acted on. Hitting a
479 * Match directive unsets activep and the directives inside the block are
480 * checked for syntax only.
482 * The second time is after a connection has been established but before
483 * authentication. activep is initialized to 2 and global config directives
484 * are ignored since they have already been processed. If the criteria in a
485 * Match block is met, activep is set and the subsequent directives
486 * processed and actioned until EOF or another Match block unsets it. Any
487 * options set are copied into the main server config.
489 * Potential additions/improvements:
490 * - Add Match support for pre-kex directives, eg Protocol, Ciphers.
492 * - Add a Tag directive (idea from David Leonard) ala pf, eg:
493 * Match Address 192.168.0.*
498 * AllowTcpForwarding yes
499 * GatewayPorts clientspecified
502 * - Add a PermittedChannelRequests directive
504 * PermittedChannelRequests session,forwarded-tcpip
508 match_cfg_line_group(const char *grps, int line, const char *user)
512 char *arg, *p, *cp, *grplist[MAX_MATCH_GROUPS];
516 * Even if we do not have a user yet, we still need to check for
519 arg = cp = xstrdup(grps);
520 while ((p = strsep(&cp, ",")) != NULL && *p != '\0') {
521 if (ngrps >= MAX_MATCH_GROUPS) {
522 error("line %d: too many groups in Match Group", line);
526 grplist[ngrps++] = p;
532 if ((pw = getpwnam(user)) == NULL) {
533 debug("Can't match group at line %d because user %.100s does "
534 "not exist", line, user);
535 } else if (ga_init(pw->pw_name, pw->pw_gid) == 0) {
536 debug("Can't Match group because user %.100s not in any group "
537 "at line %d", user, line);
538 } else if (ga_match(grplist, ngrps) != 1) {
539 debug("user %.100s does not match group %.100s at line %d",
542 debug("user %.100s matched group %.100s at line %d", user,
553 match_cfg_line(char **condition, int line, const char *user, const char *host,
557 char *arg, *attrib, *cp = *condition;
561 debug3("checking syntax for 'Match %s'", cp);
563 debug3("checking match for '%s' user %s host %s addr %s", cp,
564 user ? user : "(null)", host ? host : "(null)",
565 address ? address : "(null)");
567 while ((attrib = strdelim(&cp)) && *attrib != '\0') {
568 if ((arg = strdelim(&cp)) == NULL || *arg == '\0') {
569 error("Missing Match criteria for %s", attrib);
573 if (strcasecmp(attrib, "user") == 0) {
578 if (match_pattern_list(user, arg, len, 0) != 1)
581 debug("user %.100s matched 'User %.100s' at "
582 "line %d", user, arg, line);
583 } else if (strcasecmp(attrib, "group") == 0) {
584 switch (match_cfg_line_group(arg, line, user)) {
590 } else if (strcasecmp(attrib, "host") == 0) {
595 if (match_hostname(host, arg, len) != 1)
598 debug("connection from %.100s matched 'Host "
599 "%.100s' at line %d", host, arg, line);
600 } else if (strcasecmp(attrib, "address") == 0) {
605 if (match_hostname(address, arg, len) != 1)
608 debug("connection from %.100s matched 'Address "
609 "%.100s' at line %d", address, arg, line);
611 error("Unsupported Match attribute %s", attrib);
616 debug3("match %sfound", result ? "" : "not ");
621 #define WHITESPACE " \t\r\n"
624 process_server_config_line(ServerOptions *options, char *line,
625 const char *filename, int linenum, int *activep, const char *user,
626 const char *host, const char *address)
628 char *cp, **charptr, *arg, *p;
629 int cmdline = 0, *intptr, value, n;
630 SyslogFacility *log_facility_ptr;
631 LogLevel *log_level_ptr;
632 ServerOpCodes opcode;
638 if ((arg = strdelim(&cp)) == NULL)
640 /* Ignore leading whitespace */
643 if (!arg || !*arg || *arg == '#')
647 opcode = parse_token(arg, filename, linenum, &flags);
649 if (activep == NULL) { /* We are processing a command line directive */
653 if (*activep && opcode != sMatch)
654 debug3("%s:%d setting %s %s", filename, linenum, arg, cp);
655 if (*activep == 0 && !(flags & SSHCFG_MATCH)) {
657 fatal("%s line %d: Directive '%s' is not allowed "
658 "within a Match block", filename, linenum, arg);
659 } else { /* this is a directive we have already processed */
667 /* Portable-specific options */
669 intptr = &options->use_pam;
672 /* Standard Options */
676 /* ignore ports from configfile if cmdline specifies ports */
677 if (options->ports_from_cmdline)
679 if (options->listen_addrs != NULL)
680 fatal("%s line %d: ports must be specified before "
681 "ListenAddress.", filename, linenum);
682 if (options->num_ports >= MAX_PORTS)
683 fatal("%s line %d: too many ports.",
686 if (!arg || *arg == '\0')
687 fatal("%s line %d: missing port number.",
689 options->ports[options->num_ports++] = a2port(arg);
690 if (options->ports[options->num_ports-1] == 0)
691 fatal("%s line %d: Badly formatted port number.",
696 intptr = &options->server_key_bits;
699 if (!arg || *arg == '\0')
700 fatal("%s line %d: missing integer value.",
703 if (*activep && *intptr == -1)
707 case sLoginGraceTime:
708 intptr = &options->login_grace_time;
711 if (!arg || *arg == '\0')
712 fatal("%s line %d: missing time value.",
714 if ((value = convtime(arg)) == -1)
715 fatal("%s line %d: invalid time value.",
721 case sKeyRegenerationTime:
722 intptr = &options->key_regeneration_time;
727 if (arg == NULL || *arg == '\0')
728 fatal("%s line %d: missing address",
730 /* check for bare IPv6 address: no "[]" and 2 or more ":" */
731 if (strchr(arg, '[') == NULL && (p = strchr(arg, ':')) != NULL
732 && strchr(p+1, ':') != NULL) {
733 add_listen_addr(options, arg, 0);
738 fatal("%s line %d: bad address:port usage",
740 p = cleanhostname(p);
743 else if ((port = a2port(arg)) == 0)
744 fatal("%s line %d: bad port number", filename, linenum);
746 add_listen_addr(options, p, port);
752 if (!arg || *arg == '\0')
753 fatal("%s line %d: missing address family.",
755 intptr = &options->address_family;
756 if (options->listen_addrs != NULL)
757 fatal("%s line %d: address family must be specified before "
758 "ListenAddress.", filename, linenum);
759 if (strcasecmp(arg, "inet") == 0)
761 else if (strcasecmp(arg, "inet6") == 0)
763 else if (strcasecmp(arg, "any") == 0)
766 fatal("%s line %d: unsupported address family \"%s\".",
767 filename, linenum, arg);
773 intptr = &options->num_host_key_files;
774 if (*intptr >= MAX_HOSTKEYS)
775 fatal("%s line %d: too many host keys specified (max %d).",
776 filename, linenum, MAX_HOSTKEYS);
777 charptr = &options->host_key_files[*intptr];
780 if (!arg || *arg == '\0')
781 fatal("%s line %d: missing file name.",
783 if (*activep && *charptr == NULL) {
784 *charptr = tilde_expand_filename(arg, getuid());
785 /* increase optional counter */
787 *intptr = *intptr + 1;
792 charptr = &options->pid_file;
795 case sPermitRootLogin:
796 intptr = &options->permit_root_login;
798 if (!arg || *arg == '\0')
799 fatal("%s line %d: missing yes/"
800 "without-password/forced-commands-only/no "
801 "argument.", filename, linenum);
802 value = 0; /* silence compiler */
803 if (strcmp(arg, "without-password") == 0)
804 value = PERMIT_NO_PASSWD;
805 else if (strcmp(arg, "forced-commands-only") == 0)
806 value = PERMIT_FORCED_ONLY;
807 else if (strcmp(arg, "yes") == 0)
809 else if (strcmp(arg, "no") == 0)
812 fatal("%s line %d: Bad yes/"
813 "without-password/forced-commands-only/no "
814 "argument: %s", filename, linenum, arg);
815 if (*activep && *intptr == -1)
820 intptr = &options->ignore_rhosts;
823 if (!arg || *arg == '\0')
824 fatal("%s line %d: missing yes/no argument.",
826 value = 0; /* silence compiler */
827 if (strcmp(arg, "yes") == 0)
829 else if (strcmp(arg, "no") == 0)
832 fatal("%s line %d: Bad yes/no argument: %s",
833 filename, linenum, arg);
834 if (*activep && *intptr == -1)
838 case sIgnoreUserKnownHosts:
839 intptr = &options->ignore_user_known_hosts;
842 case sRhostsRSAAuthentication:
843 intptr = &options->rhosts_rsa_authentication;
846 case sHostbasedAuthentication:
847 intptr = &options->hostbased_authentication;
850 case sHostbasedUsesNameFromPacketOnly:
851 intptr = &options->hostbased_uses_name_from_packet_only;
854 case sRSAAuthentication:
855 intptr = &options->rsa_authentication;
858 case sPubkeyAuthentication:
859 intptr = &options->pubkey_authentication;
862 case sKerberosAuthentication:
863 intptr = &options->kerberos_authentication;
866 case sKerberosOrLocalPasswd:
867 intptr = &options->kerberos_or_local_passwd;
870 case sKerberosTicketCleanup:
871 intptr = &options->kerberos_ticket_cleanup;
874 case sKerberosGetAFSToken:
875 intptr = &options->kerberos_get_afs_token;
878 case sGssAuthentication:
879 intptr = &options->gss_authentication;
882 case sGssCleanupCreds:
883 intptr = &options->gss_cleanup_creds;
886 case sPasswordAuthentication:
887 intptr = &options->password_authentication;
890 case sKbdInteractiveAuthentication:
891 intptr = &options->kbd_interactive_authentication;
894 case sChallengeResponseAuthentication:
895 intptr = &options->challenge_response_authentication;
899 intptr = &options->print_motd;
903 intptr = &options->print_lastlog;
907 intptr = &options->x11_forwarding;
910 case sX11DisplayOffset:
911 intptr = &options->x11_display_offset;
914 case sX11UseLocalhost:
915 intptr = &options->x11_use_localhost;
919 charptr = &options->xauth_location;
923 intptr = &options->strict_modes;
927 intptr = &options->tcp_keep_alive;
931 intptr = &options->permit_empty_passwd;
934 case sPermitUserEnvironment:
935 intptr = &options->permit_user_env;
939 intptr = &options->use_login;
943 intptr = &options->compression;
945 if (!arg || *arg == '\0')
946 fatal("%s line %d: missing yes/no/delayed "
947 "argument.", filename, linenum);
948 value = 0; /* silence compiler */
949 if (strcmp(arg, "delayed") == 0)
950 value = COMP_DELAYED;
951 else if (strcmp(arg, "yes") == 0)
953 else if (strcmp(arg, "no") == 0)
956 fatal("%s line %d: Bad yes/no/delayed "
957 "argument: %s", filename, linenum, arg);
963 intptr = &options->gateway_ports;
965 if (!arg || *arg == '\0')
966 fatal("%s line %d: missing yes/no/clientspecified "
967 "argument.", filename, linenum);
968 value = 0; /* silence compiler */
969 if (strcmp(arg, "clientspecified") == 0)
971 else if (strcmp(arg, "yes") == 0)
973 else if (strcmp(arg, "no") == 0)
976 fatal("%s line %d: Bad yes/no/clientspecified "
977 "argument: %s", filename, linenum, arg);
978 if (*activep && *intptr == -1)
983 intptr = &options->use_dns;
987 log_facility_ptr = &options->log_facility;
989 value = log_facility_number(arg);
990 if (value == SYSLOG_FACILITY_NOT_SET)
991 fatal("%.200s line %d: unsupported log facility '%s'",
992 filename, linenum, arg ? arg : "<NONE>");
993 if (*log_facility_ptr == -1)
994 *log_facility_ptr = (SyslogFacility) value;
998 log_level_ptr = &options->log_level;
1000 value = log_level_number(arg);
1001 if (value == SYSLOG_LEVEL_NOT_SET)
1002 fatal("%.200s line %d: unsupported log level '%s'",
1003 filename, linenum, arg ? arg : "<NONE>");
1004 if (*log_level_ptr == -1)
1005 *log_level_ptr = (LogLevel) value;
1008 case sAllowTcpForwarding:
1009 intptr = &options->allow_tcp_forwarding;
1012 case sAllowAgentForwarding:
1013 intptr = &options->allow_agent_forwarding;
1016 case sUsePrivilegeSeparation:
1017 intptr = &use_privsep;
1021 while ((arg = strdelim(&cp)) && *arg != '\0') {
1022 if (options->num_allow_users >= MAX_ALLOW_USERS)
1023 fatal("%s line %d: too many allow users.",
1025 options->allow_users[options->num_allow_users++] =
1031 while ((arg = strdelim(&cp)) && *arg != '\0') {
1032 if (options->num_deny_users >= MAX_DENY_USERS)
1033 fatal("%s line %d: too many deny users.",
1035 options->deny_users[options->num_deny_users++] =
1041 while ((arg = strdelim(&cp)) && *arg != '\0') {
1042 if (options->num_allow_groups >= MAX_ALLOW_GROUPS)
1043 fatal("%s line %d: too many allow groups.",
1045 options->allow_groups[options->num_allow_groups++] =
1051 while ((arg = strdelim(&cp)) && *arg != '\0') {
1052 if (options->num_deny_groups >= MAX_DENY_GROUPS)
1053 fatal("%s line %d: too many deny groups.",
1055 options->deny_groups[options->num_deny_groups++] = xstrdup(arg);
1060 arg = strdelim(&cp);
1061 if (!arg || *arg == '\0')
1062 fatal("%s line %d: Missing argument.", filename, linenum);
1063 if (!ciphers_valid(arg))
1064 fatal("%s line %d: Bad SSH2 cipher spec '%s'.",
1065 filename, linenum, arg ? arg : "<NONE>");
1066 if (options->ciphers == NULL)
1067 options->ciphers = xstrdup(arg);
1071 arg = strdelim(&cp);
1072 if (!arg || *arg == '\0')
1073 fatal("%s line %d: Missing argument.", filename, linenum);
1074 if (!mac_valid(arg))
1075 fatal("%s line %d: Bad SSH2 mac spec '%s'.",
1076 filename, linenum, arg ? arg : "<NONE>");
1077 if (options->macs == NULL)
1078 options->macs = xstrdup(arg);
1082 intptr = &options->protocol;
1083 arg = strdelim(&cp);
1084 if (!arg || *arg == '\0')
1085 fatal("%s line %d: Missing argument.", filename, linenum);
1086 value = proto_spec(arg);
1087 if (value == SSH_PROTO_UNKNOWN)
1088 fatal("%s line %d: Bad protocol spec '%s'.",
1089 filename, linenum, arg ? arg : "<NONE>");
1090 if (*intptr == SSH_PROTO_UNKNOWN)
1095 if (options->num_subsystems >= MAX_SUBSYSTEMS) {
1096 fatal("%s line %d: too many subsystems defined.",
1099 arg = strdelim(&cp);
1100 if (!arg || *arg == '\0')
1101 fatal("%s line %d: Missing subsystem name.",
1104 arg = strdelim(&cp);
1107 for (i = 0; i < options->num_subsystems; i++)
1108 if (strcmp(arg, options->subsystem_name[i]) == 0)
1109 fatal("%s line %d: Subsystem '%s' already defined.",
1110 filename, linenum, arg);
1111 options->subsystem_name[options->num_subsystems] = xstrdup(arg);
1112 arg = strdelim(&cp);
1113 if (!arg || *arg == '\0')
1114 fatal("%s line %d: Missing subsystem command.",
1116 options->subsystem_command[options->num_subsystems] = xstrdup(arg);
1118 /* Collect arguments (separate to executable) */
1120 len = strlen(p) + 1;
1121 while ((arg = strdelim(&cp)) != NULL && *arg != '\0') {
1122 len += 1 + strlen(arg);
1123 p = xrealloc(p, 1, len);
1124 strlcat(p, " ", len);
1125 strlcat(p, arg, len);
1127 options->subsystem_args[options->num_subsystems] = p;
1128 options->num_subsystems++;
1132 arg = strdelim(&cp);
1133 if (!arg || *arg == '\0')
1134 fatal("%s line %d: Missing MaxStartups spec.",
1136 if ((n = sscanf(arg, "%d:%d:%d",
1137 &options->max_startups_begin,
1138 &options->max_startups_rate,
1139 &options->max_startups)) == 3) {
1140 if (options->max_startups_begin >
1141 options->max_startups ||
1142 options->max_startups_rate > 100 ||
1143 options->max_startups_rate < 1)
1144 fatal("%s line %d: Illegal MaxStartups spec.",
1147 fatal("%s line %d: Illegal MaxStartups spec.",
1150 options->max_startups = options->max_startups_begin;
1154 intptr = &options->max_authtries;
1158 charptr = &options->banner;
1159 goto parse_filename;
1162 * These options can contain %X options expanded at
1163 * connect time, so that you can specify paths like:
1165 * AuthorizedKeysFile /etc/ssh_keys/%u
1167 case sAuthorizedKeysFile:
1168 case sAuthorizedKeysFile2:
1169 charptr = (opcode == sAuthorizedKeysFile) ?
1170 &options->authorized_keys_file :
1171 &options->authorized_keys_file2;
1172 goto parse_filename;
1174 case sClientAliveInterval:
1175 intptr = &options->client_alive_interval;
1178 case sClientAliveCountMax:
1179 intptr = &options->client_alive_count_max;
1183 while ((arg = strdelim(&cp)) && *arg != '\0') {
1184 if (strchr(arg, '=') != NULL)
1185 fatal("%s line %d: Invalid environment name.",
1187 if (options->num_accept_env >= MAX_ACCEPT_ENV)
1188 fatal("%s line %d: too many allow env.",
1192 options->accept_env[options->num_accept_env++] =
1198 intptr = &options->permit_tun;
1199 arg = strdelim(&cp);
1200 if (!arg || *arg == '\0')
1201 fatal("%s line %d: Missing yes/point-to-point/"
1202 "ethernet/no argument.", filename, linenum);
1203 value = 0; /* silence compiler */
1204 if (strcasecmp(arg, "ethernet") == 0)
1205 value = SSH_TUNMODE_ETHERNET;
1206 else if (strcasecmp(arg, "point-to-point") == 0)
1207 value = SSH_TUNMODE_POINTOPOINT;
1208 else if (strcasecmp(arg, "yes") == 0)
1209 value = SSH_TUNMODE_YES;
1210 else if (strcasecmp(arg, "no") == 0)
1211 value = SSH_TUNMODE_NO;
1213 fatal("%s line %d: Bad yes/point-to-point/ethernet/"
1214 "no argument: %s", filename, linenum, arg);
1221 fatal("Match directive not supported as a command-line "
1223 value = match_cfg_line(&cp, linenum, user, host, address);
1225 fatal("%s line %d: Bad Match condition", filename,
1231 arg = strdelim(&cp);
1232 if (!arg || *arg == '\0')
1233 fatal("%s line %d: missing PermitOpen specification",
1235 n = options->num_permitted_opens; /* modified later */
1236 if (strcmp(arg, "any") == 0) {
1237 if (*activep && n == -1) {
1238 channel_clear_adm_permitted_opens();
1239 options->num_permitted_opens = 0;
1243 if (*activep && n == -1)
1244 channel_clear_adm_permitted_opens();
1245 for (; arg != NULL && *arg != '\0'; arg = strdelim(&cp)) {
1248 fatal("%s line %d: missing host in PermitOpen",
1250 p = cleanhostname(p);
1251 if (arg == NULL || (port = a2port(arg)) == 0)
1252 fatal("%s line %d: bad port number in "
1253 "PermitOpen", filename, linenum);
1254 if (*activep && n == -1)
1255 options->num_permitted_opens =
1256 channel_add_adm_permitted_opens(p, port);
1262 fatal("%.200s line %d: Missing argument.", filename,
1264 len = strspn(cp, WHITESPACE);
1265 if (*activep && options->adm_forced_command == NULL)
1266 options->adm_forced_command = xstrdup(cp + len);
1269 case sChrootDirectory:
1270 charptr = &options->chroot_directory;
1272 arg = strdelim(&cp);
1273 if (!arg || *arg == '\0')
1274 fatal("%s line %d: missing file name.",
1276 if (*activep && *charptr == NULL)
1277 *charptr = xstrdup(arg);
1281 logit("%s line %d: Deprecated option %s",
1282 filename, linenum, arg);
1284 arg = strdelim(&cp);
1288 logit("%s line %d: Unsupported option %s",
1289 filename, linenum, arg);
1291 arg = strdelim(&cp);
1295 fatal("%s line %d: Missing handler for opcode %s (%d)",
1296 filename, linenum, arg, opcode);
1298 if ((arg = strdelim(&cp)) != NULL && *arg != '\0')
1299 fatal("%s line %d: garbage at end of line; \"%.200s\".",
1300 filename, linenum, arg);
1304 /* Reads the server configuration file. */
1307 load_server_config(const char *filename, Buffer *conf)
1309 char line[1024], *cp;
1312 debug2("%s: filename %s", __func__, filename);
1313 if ((f = fopen(filename, "r")) == NULL) {
1318 while (fgets(line, sizeof(line), f)) {
1320 * Trim out comments and strip whitespace
1321 * NB - preserve newlines, they are needed to reproduce
1322 * line numbers later for error messages
1324 if ((cp = strchr(line, '#')) != NULL)
1325 memcpy(cp, "\n", 2);
1326 cp = line + strspn(line, " \t\r");
1328 buffer_append(conf, cp, strlen(cp));
1330 buffer_append(conf, "\0", 1);
1332 debug2("%s: done config len = %d", __func__, buffer_len(conf));
1336 parse_server_match_config(ServerOptions *options, const char *user,
1337 const char *host, const char *address)
1341 initialize_server_options(&mo);
1342 parse_server_config(&mo, "reprocess config", &cfg, user, host, address);
1343 copy_set_server_options(options, &mo, 0);
1347 #define M_CP_INTOPT(n) do {\
1351 #define M_CP_STROPT(n) do {\
1352 if (src->n != NULL) { \
1353 if (dst->n != NULL) \
1360 * Copy any supported values that are set.
1362 * If the preauth flag is set, we do not bother copying the the string or
1363 * array values that are not used pre-authentication, because any that we
1364 * do use must be explictly sent in mm_getpwnamallow().
1367 copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
1369 M_CP_INTOPT(password_authentication);
1370 M_CP_INTOPT(gss_authentication);
1371 M_CP_INTOPT(rsa_authentication);
1372 M_CP_INTOPT(pubkey_authentication);
1373 M_CP_INTOPT(kerberos_authentication);
1374 M_CP_INTOPT(hostbased_authentication);
1375 M_CP_INTOPT(kbd_interactive_authentication);
1376 M_CP_INTOPT(permit_root_login);
1378 M_CP_INTOPT(allow_tcp_forwarding);
1379 M_CP_INTOPT(allow_agent_forwarding);
1380 M_CP_INTOPT(gateway_ports);
1381 M_CP_INTOPT(x11_display_offset);
1382 M_CP_INTOPT(x11_forwarding);
1383 M_CP_INTOPT(x11_use_localhost);
1385 M_CP_STROPT(banner);
1388 M_CP_STROPT(adm_forced_command);
1389 M_CP_STROPT(chroot_directory);
1396 parse_server_config(ServerOptions *options, const char *filename, Buffer *conf,
1397 const char *user, const char *host, const char *address)
1399 int active, linenum, bad_options = 0;
1400 char *cp, *obuf, *cbuf;
1402 debug2("%s: config %s len %d", __func__, filename, buffer_len(conf));
1404 obuf = cbuf = xstrdup(buffer_ptr(conf));
1405 active = user ? 0 : 1;
1407 while ((cp = strsep(&cbuf, "\n")) != NULL) {
1408 if (process_server_config_line(options, cp, filename,
1409 linenum++, &active, user, host, address) != 0)
1413 if (bad_options > 0)
1414 fatal("%s: terminating, %d bad configuration options",
1415 filename, bad_options);