*/
#include "includes.h"
-RCSID("$OpenBSD: servconf.c,v 1.78 2001/04/15 21:28:35 stevesk Exp $");
+RCSID("$OpenBSD: servconf.c,v 1.88 2001/07/11 00:24:53 itojun Exp $");
-#ifdef KRB4
+#if defined(KRB4) || defined(KRB5)
#include <krb.h>
#endif
#ifdef AFS
#include "kex.h"
#include "mac.h"
-void add_listen_addr(ServerOptions *options, char *addr, u_short port);
-void add_one_listen_addr(ServerOptions *options, char *addr, u_short port);
+static void add_listen_addr(ServerOptions *, char *, u_short);
+static void add_one_listen_addr(ServerOptions *, char *, u_short);
/* AF_UNSPEC or AF_INET or AF_INET6 */
extern int IPv4or6;
options->hostbased_uses_name_from_packet_only = -1;
options->rsa_authentication = -1;
options->pubkey_authentication = -1;
-#ifdef KRB4
+#if defined(KRB4) || defined(KRB5)
options->kerberos_authentication = -1;
options->kerberos_or_local_passwd = -1;
options->kerberos_ticket_cleanup = -1;
#endif
-#ifdef AFS
+#if defined(AFS) || defined(KRB5)
options->kerberos_tgt_passing = -1;
+#endif
+#ifdef AFS
options->afs_token_passing = -1;
#endif
options->password_authentication = -1;
options->kbd_interactive_authentication = -1;
- options->challenge_reponse_authentication = -1;
+ options->challenge_response_authentication = -1;
options->permit_empty_passwd = -1;
options->use_login = -1;
options->allow_tcp_forwarding = -1;
options->reverse_mapping_check = -1;
options->client_alive_interval = -1;
options->client_alive_count_max = -1;
+ options->authorized_keys_file = NULL;
+ options->authorized_keys_file2 = NULL;
options->pam_authentication_via_kbd_int = -1;
}
options->x11_forwarding = 0;
if (options->x11_display_offset == -1)
options->x11_display_offset = 10;
-#ifdef XAUTH_PATH
+#ifdef _PATH_XAUTH
if (options->xauth_location == NULL)
- options->xauth_location = XAUTH_PATH;
-#endif /* XAUTH_PATH */
+ options->xauth_location = _PATH_XAUTH;
+#endif
if (options->strict_modes == -1)
options->strict_modes = 1;
if (options->keepalives == -1)
options->rsa_authentication = 1;
if (options->pubkey_authentication == -1)
options->pubkey_authentication = 1;
-#ifdef KRB4
+#if defined(KRB4) || defined(KRB5)
if (options->kerberos_authentication == -1)
options->kerberos_authentication = (access(KEYFILE, R_OK) == 0);
if (options->kerberos_or_local_passwd == -1)
options->kerberos_or_local_passwd = 1;
if (options->kerberos_ticket_cleanup == -1)
options->kerberos_ticket_cleanup = 1;
-#endif /* KRB4 */
-#ifdef AFS
+#endif
+#if defined(AFS) || defined(KRB5)
if (options->kerberos_tgt_passing == -1)
options->kerberos_tgt_passing = 0;
+#endif
+#ifdef AFS
if (options->afs_token_passing == -1)
options->afs_token_passing = k_hasafs();
-#endif /* AFS */
+#endif
if (options->password_authentication == -1)
options->password_authentication = 1;
if (options->kbd_interactive_authentication == -1)
options->kbd_interactive_authentication = 0;
- if (options->challenge_reponse_authentication == -1)
- options->challenge_reponse_authentication = 1;
+ if (options->challenge_response_authentication == -1)
+ options->challenge_response_authentication = 1;
if (options->permit_empty_passwd == -1)
options->permit_empty_passwd = 0;
if (options->use_login == -1)
options->client_alive_interval = 0;
if (options->client_alive_count_max == -1)
options->client_alive_count_max = 3;
+ if (options->authorized_keys_file == NULL)
+ options->authorized_keys_file = _PATH_SSH_USER_PERMITTED_KEYS;
+ if (options->authorized_keys_file2 == NULL)
+ options->authorized_keys_file2 = _PATH_SSH_USER_PERMITTED_KEYS2;
if (options->pam_authentication_via_kbd_int == -1)
options->pam_authentication_via_kbd_int = 0;
}
sPort, sHostKeyFile, sServerKeyBits, sLoginGraceTime, sKeyRegenerationTime,
sPermitRootLogin, sLogFacility, sLogLevel,
sRhostsAuthentication, sRhostsRSAAuthentication, sRSAAuthentication,
-#ifdef KRB4
+#if defined(KRB4) || defined(KRB5)
sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup,
#endif
+#if defined(AFS) || defined(KRB5)
+ sKerberosTgtPassing,
+#endif
#ifdef AFS
- sKerberosTgtPassing, sAFSTokenPassing,
+ sAFSTokenPassing,
#endif
sChallengeResponseAuthentication,
sPasswordAuthentication, sKbdInteractiveAuthentication, sListenAddress,
sGatewayPorts, sPubkeyAuthentication, sXAuthLocation, sSubsystem, sMaxStartups,
sBanner, sReverseMappingCheck, sHostbasedAuthentication,
sHostbasedUsesNameFromPacketOnly, sClientAliveInterval,
- sClientAliveCountMax, sPAMAuthenticationViaKbdInt
+ sClientAliveCountMax, sAuthorizedKeysFile, sAuthorizedKeysFile2,
+ sPAMAuthenticationViaKbdInt
} ServerOpCodes;
/* Textual representation of the tokens. */
{ "rsaauthentication", sRSAAuthentication },
{ "pubkeyauthentication", sPubkeyAuthentication },
{ "dsaauthentication", sPubkeyAuthentication }, /* alias */
-#ifdef KRB4
+#if defined(KRB4) || defined(KRB5)
{ "kerberosauthentication", sKerberosAuthentication },
{ "kerberosorlocalpasswd", sKerberosOrLocalPasswd },
{ "kerberosticketcleanup", sKerberosTicketCleanup },
#endif
-#ifdef AFS
+#if defined(AFS) || defined(KRB5)
{ "kerberostgtpassing", sKerberosTgtPassing },
+#endif
+#ifdef AFS
{ "afstokenpassing", sAFSTokenPassing },
#endif
{ "passwordauthentication", sPasswordAuthentication },
{ "reversemappingcheck", sReverseMappingCheck },
{ "clientaliveinterval", sClientAliveInterval },
{ "clientalivecountmax", sClientAliveCountMax },
+ { "authorizedkeysfile", sAuthorizedKeysFile },
+ { "authorizedkeysfile2", sAuthorizedKeysFile2 },
{ "PAMAuthenticationViaKbdInt", sPAMAuthenticationViaKbdInt },
{ NULL, 0 }
};
return sBadOption;
}
-void
+static void
add_listen_addr(ServerOptions *options, char *addr, u_short port)
{
int i;
add_one_listen_addr(options, addr, port);
}
-void
+static void
add_one_listen_addr(ServerOptions *options, char *addr, u_short port)
{
struct addrinfo hints, *ai, *aitop;
int linenum, *intptr, value;
int bad_options = 0;
ServerOpCodes opcode;
- int i;
+ int i, n;
f = fopen(filename, "r");
if (!f) {
continue;
if (options->listen_addrs != NULL)
fatal("%s line %d: ports must be specified before "
- "ListenAdress.\n", filename, linenum);
+ "ListenAdress.", filename, linenum);
if (options->num_ports >= MAX_PORTS)
fatal("%s line %d: too many ports.",
filename, linenum);
case sLoginGraceTime:
intptr = &options->login_grace_time;
- goto parse_int;
+parse_time:
+ arg = strdelim(&cp);
+ if (!arg || *arg == '\0')
+ fatal("%s line %d: missing time value.",
+ filename, linenum);
+ if ((value = convtime(arg)) == -1)
+ fatal("%s line %d: invalid time value.",
+ filename, linenum);
+ if (*intptr == -1)
+ *intptr = value;
+ break;
case sKeyRegenerationTime:
intptr = &options->key_regeneration_time;
- goto parse_int;
+ goto parse_time;
case sListenAddress:
arg = strdelim(&cp);
case sPubkeyAuthentication:
intptr = &options->pubkey_authentication;
goto parse_flag;
-
-#ifdef KRB4
+#if defined(KRB4) || defined(KRB5)
case sKerberosAuthentication:
intptr = &options->kerberos_authentication;
goto parse_flag;
intptr = &options->kerberos_ticket_cleanup;
goto parse_flag;
#endif
-
-#ifdef AFS
+#if defined(AFS) || defined(KRB5)
case sKerberosTgtPassing:
intptr = &options->kerberos_tgt_passing;
goto parse_flag;
-
+#endif
+#ifdef AFS
case sAFSTokenPassing:
intptr = &options->afs_token_passing;
goto parse_flag;
goto parse_flag;
case sChallengeResponseAuthentication:
- intptr = &options->challenge_reponse_authentication;
+ intptr = &options->challenge_response_authentication;
goto parse_flag;
case sPrintMotd:
if (!arg || *arg == '\0')
fatal("%s line %d: Missing MaxStartups spec.",
filename, linenum);
- if (sscanf(arg, "%d:%d:%d",
+ if ((n = sscanf(arg, "%d:%d:%d",
&options->max_startups_begin,
&options->max_startups_rate,
- &options->max_startups) == 3) {
+ &options->max_startups)) == 3) {
if (options->max_startups_begin >
options->max_startups ||
options->max_startups_rate > 100 ||
options->max_startups_rate < 1)
+ fatal("%s line %d: Illegal MaxStartups spec.",
+ filename, linenum);
+ } else if (n != 1)
fatal("%s line %d: Illegal MaxStartups spec.",
- filename, linenum);
- break;
- }
- intptr = &options->max_startups;
- goto parse_int;
+ filename, linenum);
+ else
+ options->max_startups = options->max_startups_begin;
+ break;
case sBanner:
charptr = &options->banner;
goto parse_filename;
+ /*
+ * These options can contain %X options expanded at
+ * connect time, so that you can specify paths like:
+ *
+ * AuthorizedKeysFile /etc/ssh_keys/%u
+ */
+ case sAuthorizedKeysFile:
+ case sAuthorizedKeysFile2:
+ charptr = (opcode == sAuthorizedKeysFile ) ?
+ &options->authorized_keys_file :
+ &options->authorized_keys_file2;
+ goto parse_filename;
+
case sClientAliveInterval:
intptr = &options->client_alive_interval;
- goto parse_int;
+ goto parse_time;
+
case sClientAliveCountMax:
intptr = &options->client_alive_count_max;
goto parse_int;
+
case sPAMAuthenticationViaKbdInt:
intptr = &options->pam_authentication_via_kbd_int;
goto parse_flag;