- markus@cvs.openbsd.org 2001/11/09 19:08:35

[openssh.git] / sshd.c

diff --git a/sshd.c b/sshd.c
index 936e861a9ce1e0c4f3715e9f892951d446dda93b..22ea8990e868fb66a2e1d859ed9fced590e246b9 100644 (file)
--- a/sshd.c
+++ b/sshd.c
@@ -40,7 +40,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: sshd.c,v 1.201 2001/06/23 19:12:43 markus Exp $");
+RCSID("$OpenBSD: sshd.c,v 1.208 2001/11/09 19:08:35 markus Exp $");
 
 #include <openssl/dh.h>
 #include <openssl/bn.h>
@@ -71,6 +71,7 @@ RCSID("$OpenBSD: sshd.c,v 1.201 2001/06/23 19:12:43 markus Exp $");
 #include "auth.h"
 #include "misc.h"
 #include "dispatch.h"
+#include "channels.h"
 
 #ifdef LIBWRAP
 #include <tcpd.h>
@@ -113,6 +114,9 @@ int IPv4or6 = AF_UNSPEC;
  */
 int debug_flag = 0;
 
+/* Flag indicating that the daemon should only test the configuration and keys. */
+int test_flag = 0;
+
 /* Flag indicating that the daemon is being started from inetd. */
 int inetd_flag = 0;
 
@@ -333,7 +337,7 @@ sshd_exchange_identification(int sock_in, int sock_out)
                /* Send our protocol version identification. */
                if (atomicio(write, sock_out, server_version_string, strlen(server_version_string))
                    != strlen(server_version_string)) {
-                       log("Could not write ident string to %s.", get_remote_ipaddr());
+                       log("Could not write ident string to %s", get_remote_ipaddr());
                        fatal_cleanup();
                }
 
@@ -341,7 +345,7 @@ sshd_exchange_identification(int sock_in, int sock_out)
                memset(buf, 0, sizeof(buf));
                for (i = 0; i < sizeof(buf) - 1; i++) {
                        if (atomicio(read, sock_in, &buf[i], 1) != 1) {
-                               log("Did not receive identification string from %s.",
+                               log("Did not receive identification string from %s",
                                    get_remote_ipaddr());
                                fatal_cleanup();
                        }
@@ -560,7 +564,7 @@ main(int ac, char **av)
        initialize_server_options(&options);
 
        /* Parse command-line arguments. */
-       while ((opt = getopt(ac, av, "f:p:b:k:h:g:V:u:dDeiqQ46")) != -1) {
+       while ((opt = getopt(ac, av, "f:p:b:k:h:g:V:u:dDeiqtQ46")) != -1) {
                switch (opt) {
                case '4':
                        IPv4or6 = AF_INET;
@@ -636,6 +640,9 @@ main(int ac, char **av)
                        /* only makes sense with inetd_flag, i.e. no listen() */
                        inetd_flag = 1;
                        break;
+               case 't':
+                       test_flag = 1;
+                       break;
                case 'u':
                        utmp_len = atoi(optarg);
                        break;
@@ -648,6 +655,7 @@ main(int ac, char **av)
                        fprintf(stderr, "  -d         Debugging mode (multiple -d means more debugging)\n");
                        fprintf(stderr, "  -i         Started from inetd\n");
                        fprintf(stderr, "  -D         Do not fork into daemon mode\n");
+                       fprintf(stderr, "  -t         Only test configuration file and keys\n");
                        fprintf(stderr, "  -q         Quiet (no logging)\n");
                        fprintf(stderr, "  -p port    Listen on the specified port (default: 22)\n");
                        fprintf(stderr, "  -k seconds Regenerate server key every this many seconds (default: 3600)\n");
@@ -662,6 +670,7 @@ main(int ac, char **av)
                }
        }
        SSLeay_add_all_algorithms();
+       channel_set_af(IPv4or6);
 
        /*
         * Force logging to stderr until we have loaded the private host
@@ -672,6 +681,13 @@ main(int ac, char **av)
            options.log_facility == -1 ? SYSLOG_FACILITY_AUTH : options.log_facility,
            !inetd_flag);
 
+#ifdef _CRAY
+       /* Cray can define user privs drop all prives now!
+        * Not needed on PRIV_SU systems!
+        */
+       drop_cray_privs();
+#endif
+
        seed_rng();
 
        /* Read server configuration options from the configuration file. */
@@ -755,6 +771,10 @@ main(int ac, char **av)
                }
        }
 
+       /* Configuration looks good, so exit if in test mode. */
+       if (test_flag)
+               exit(0);
+
 #ifdef HAVE_SCO_PROTECTED_PW
        (void) set_auth_parameters(ac, av);
 #endif
@@ -1120,7 +1140,7 @@ main(int ac, char **av)
        {
                struct request_info req;
 
-               request_init(&req, RQ_DAEMON, __progname, RQ_FILE, sock_in, NULL);
+               request_init(&req, RQ_DAEMON, __progname, RQ_FILE, sock_in, 0);
                fromhost(&req);
 
                if (!hosts_access(&req)) {
@@ -1157,16 +1177,16 @@ main(int ac, char **av)
        if (remote_port >= IPPORT_RESERVED ||
            remote_port < IPPORT_RESERVED / 2) {
                debug("Rhosts Authentication disabled, "
-                   "originating port not trusted.");
+                   "originating port %d not trusted.", remote_port);
                options.rhosts_authentication = 0;
        }
-#ifdef KRB4
+#if defined(KRB4) && !defined(KRB5)
        if (!packet_connection_is_ipv4() &&
            options.kerberos_authentication) {
                debug("Kerberos Authentication disabled, only available for IPv4.");
                options.kerberos_authentication = 0;
        }
-#endif /* KRB4 */
+#endif /* KRB4 && !KRB5 */
 #ifdef AFS
        /* If machine has AFS, set process authentication group. */
        if (k_hasafs()) {
@@ -1186,13 +1206,6 @@ main(int ac, char **av)
                do_ssh1_kex();
                do_authentication();
        }
-
-#ifdef KRB4
-       /* Cleanup user's ticket cache file. */
-       if (options.kerberos_ticket_cleanup)
-               (void) dest_tkt();
-#endif /* KRB4 */
-
        /* The connection has been terminated. */
        verbose("Closing connection to %.100s", remote_ip);
 
@@ -1268,13 +1281,15 @@ do_ssh1_kex(void)
                auth_mask |= 1 << SSH_AUTH_RHOSTS_RSA;
        if (options.rsa_authentication)
                auth_mask |= 1 << SSH_AUTH_RSA;
-#ifdef KRB4
+#if defined(KRB4) || defined(KRB5)
        if (options.kerberos_authentication)
                auth_mask |= 1 << SSH_AUTH_KERBEROS;
 #endif
-#ifdef AFS
+#if defined(AFS) || defined(KRB5)
        if (options.kerberos_tgt_passing)
                auth_mask |= 1 << SSH_PASS_KERBEROS_TGT;
+#endif
+#ifdef AFS
        if (options.afs_token_passing)
                auth_mask |= 1 << SSH_PASS_AFS_TOKEN;
 #endif