- markus@cvs.openbsd.org 2001/08/30 22:22:32

[openssh.git] / sshd.c

diff --git a/sshd.c b/sshd.c
index 936e861a9ce1e0c4f3715e9f892951d446dda93b..aa822df1786315a841e48a8a0f40d26cebbfe21c 100644 (file)
--- a/sshd.c
+++ b/sshd.c
@@ -40,7 +40,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: sshd.c,v 1.201 2001/06/23 19:12:43 markus Exp $");
+RCSID("$OpenBSD: sshd.c,v 1.204 2001/08/23 17:59:31 camield Exp $");
 
 #include <openssl/dh.h>
 #include <openssl/bn.h>
@@ -113,6 +113,9 @@ int IPv4or6 = AF_UNSPEC;
  */
 int debug_flag = 0;
 
+/* Flag indicating that the daemon should only test the configuration and keys. */
+int test_flag = 0;
+
 /* Flag indicating that the daemon is being started from inetd. */
 int inetd_flag = 0;
 
@@ -560,7 +563,7 @@ main(int ac, char **av)
        initialize_server_options(&options);
 
        /* Parse command-line arguments. */
-       while ((opt = getopt(ac, av, "f:p:b:k:h:g:V:u:dDeiqQ46")) != -1) {
+       while ((opt = getopt(ac, av, "f:p:b:k:h:g:V:u:dDeiqtQ46")) != -1) {
                switch (opt) {
                case '4':
                        IPv4or6 = AF_INET;
@@ -636,6 +639,9 @@ main(int ac, char **av)
                        /* only makes sense with inetd_flag, i.e. no listen() */
                        inetd_flag = 1;
                        break;
+               case 't':
+                       test_flag = 1;
+                       break;
                case 'u':
                        utmp_len = atoi(optarg);
                        break;
@@ -648,6 +654,7 @@ main(int ac, char **av)
                        fprintf(stderr, "  -d         Debugging mode (multiple -d means more debugging)\n");
                        fprintf(stderr, "  -i         Started from inetd\n");
                        fprintf(stderr, "  -D         Do not fork into daemon mode\n");
+                       fprintf(stderr, "  -t         Only test configuration file and keys\n");
                        fprintf(stderr, "  -q         Quiet (no logging)\n");
                        fprintf(stderr, "  -p port    Listen on the specified port (default: 22)\n");
                        fprintf(stderr, "  -k seconds Regenerate server key every this many seconds (default: 3600)\n");
@@ -672,6 +679,13 @@ main(int ac, char **av)
            options.log_facility == -1 ? SYSLOG_FACILITY_AUTH : options.log_facility,
            !inetd_flag);
 
+#ifdef _CRAY
+       /* Cray can define user privs drop all prives now!
+        * Not needed on PRIV_SU systems!
+        */
+       drop_cray_privs();
+#endif
+
        seed_rng();
 
        /* Read server configuration options from the configuration file. */
@@ -755,6 +769,10 @@ main(int ac, char **av)
                }
        }
 
+       /* Configuration looks good, so exit if in test mode. */
+       if (test_flag)
+               exit(0);
+
 #ifdef HAVE_SCO_PROTECTED_PW
        (void) set_auth_parameters(ac, av);
 #endif
@@ -1120,7 +1138,7 @@ main(int ac, char **av)
        {
                struct request_info req;
 
-               request_init(&req, RQ_DAEMON, __progname, RQ_FILE, sock_in, NULL);
+               request_init(&req, RQ_DAEMON, __progname, RQ_FILE, sock_in, 0);
                fromhost(&req);
 
                if (!hosts_access(&req)) {
@@ -1160,13 +1178,13 @@ main(int ac, char **av)
                    "originating port not trusted.");
                options.rhosts_authentication = 0;
        }
-#ifdef KRB4
+#if defined(KRB4) && !defined(KRB5)
        if (!packet_connection_is_ipv4() &&
            options.kerberos_authentication) {
                debug("Kerberos Authentication disabled, only available for IPv4.");
                options.kerberos_authentication = 0;
        }
-#endif /* KRB4 */
+#endif /* KRB4 && !KRB5 */
 #ifdef AFS
        /* If machine has AFS, set process authentication group. */
        if (k_hasafs()) {
@@ -1186,13 +1204,6 @@ main(int ac, char **av)
                do_ssh1_kex();
                do_authentication();
        }
-
-#ifdef KRB4
-       /* Cleanup user's ticket cache file. */
-       if (options.kerberos_ticket_cleanup)
-               (void) dest_tkt();
-#endif /* KRB4 */
-
        /* The connection has been terminated. */
        verbose("Closing connection to %.100s", remote_ip);
 
@@ -1268,13 +1279,15 @@ do_ssh1_kex(void)
                auth_mask |= 1 << SSH_AUTH_RHOSTS_RSA;
        if (options.rsa_authentication)
                auth_mask |= 1 << SSH_AUTH_RSA;
-#ifdef KRB4
+#if defined(KRB4) || defined(KRB5)
        if (options.kerberos_authentication)
                auth_mask |= 1 << SSH_AUTH_KERBEROS;
 #endif
-#ifdef AFS
+#if defined(AFS) || defined(KRB5)
        if (options.kerberos_tgt_passing)
                auth_mask |= 1 << SSH_PASS_KERBEROS_TGT;
+#endif
+#ifdef AFS
        if (options.afs_token_passing)
                auth_mask |= 1 << SSH_PASS_AFS_TOKEN;
 #endif