- itojun@cvs.openbsd.org 2001/06/23 15:12:20

[openssh.git] / servconf.c

diff --git a/servconf.c b/servconf.c
index 3d0c9efa6f2d28bcb214c2e9402ceaa828844f75..55b0b0039731ba73fb93c33f6a9270eb447e4c80 100644 (file)
--- a/servconf.c
+++ b/servconf.c
@@ -10,7 +10,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: servconf.c,v 1.78 2001/04/15 21:28:35 stevesk Exp $");
+RCSID("$OpenBSD: servconf.c,v 1.84 2001/06/23 15:12:19 itojun Exp $");
 
 #ifdef KRB4
 #include <krb.h>
@@ -31,8 +31,8 @@ RCSID("$OpenBSD: servconf.c,v 1.78 2001/04/15 21:28:35 stevesk Exp $");
 #include "kex.h"
 #include "mac.h"
 
-void add_listen_addr(ServerOptions *options, char *addr, u_short port);
-void add_one_listen_addr(ServerOptions *options, char *addr, u_short port);
+static void add_listen_addr(ServerOptions *, char *, u_short);
+static void add_one_listen_addr(ServerOptions *, char *, u_short);
 
 /* AF_UNSPEC or AF_INET or AF_INET6 */
 extern int IPv4or6;
@@ -81,7 +81,7 @@ initialize_server_options(ServerOptions *options)
 #endif
        options->password_authentication = -1;
        options->kbd_interactive_authentication = -1;
-       options->challenge_reponse_authentication = -1;
+       options->challenge_response_authentication = -1;
        options->permit_empty_passwd = -1;
        options->use_login = -1;
        options->allow_tcp_forwarding = -1;
@@ -101,6 +101,9 @@ initialize_server_options(ServerOptions *options)
        options->reverse_mapping_check = -1;
        options->client_alive_interval = -1;
        options->client_alive_count_max = -1;
+       options->authorized_keys_file = NULL;
+       options->authorized_keys_file2 = NULL;
+       options->pam_authentication_via_kbd_int = -1;
 }
 
 void
@@ -143,10 +146,10 @@ fill_default_server_options(ServerOptions *options)
                options->x11_forwarding = 0;
        if (options->x11_display_offset == -1)
                options->x11_display_offset = 10;
-#ifdef XAUTH_PATH
+#ifdef _PATH_XAUTH
        if (options->xauth_location == NULL)
-               options->xauth_location = XAUTH_PATH;
-#endif /* XAUTH_PATH */
+               options->xauth_location = _PATH_XAUTH;
+#endif
        if (options->strict_modes == -1)
                options->strict_modes = 1;
        if (options->keepalives == -1)
@@ -185,8 +188,8 @@ fill_default_server_options(ServerOptions *options)
                options->password_authentication = 1;
        if (options->kbd_interactive_authentication == -1)
                options->kbd_interactive_authentication = 0;
-       if (options->challenge_reponse_authentication == -1)
-               options->challenge_reponse_authentication = 1;
+       if (options->challenge_response_authentication == -1)
+               options->challenge_response_authentication = 1;
        if (options->permit_empty_passwd == -1)
                options->permit_empty_passwd = 0;
        if (options->use_login == -1)
@@ -207,6 +210,12 @@ fill_default_server_options(ServerOptions *options)
                options->client_alive_interval = 0;  
        if (options->client_alive_count_max == -1)
                options->client_alive_count_max = 3;
+       if (options->authorized_keys_file == NULL)
+               options->authorized_keys_file = _PATH_SSH_USER_PERMITTED_KEYS;  
+       if (options->authorized_keys_file2 == NULL)
+               options->authorized_keys_file2 = _PATH_SSH_USER_PERMITTED_KEYS2;
+       if (options->pam_authentication_via_kbd_int == -1)
+               options->pam_authentication_via_kbd_int = 0;
 }
 
 /* Keyword tokens. */
@@ -232,7 +241,8 @@ typedef enum {
        sGatewayPorts, sPubkeyAuthentication, sXAuthLocation, sSubsystem, sMaxStartups,
        sBanner, sReverseMappingCheck, sHostbasedAuthentication,
        sHostbasedUsesNameFromPacketOnly, sClientAliveInterval, 
-       sClientAliveCountMax
+       sClientAliveCountMax, sAuthorizedKeysFile, sAuthorizedKeysFile2,
+       sPAMAuthenticationViaKbdInt
 } ServerOpCodes;
 
 /* Textual representation of the tokens. */
@@ -298,6 +308,9 @@ static struct {
        { "reversemappingcheck", sReverseMappingCheck },
        { "clientaliveinterval", sClientAliveInterval },
        { "clientalivecountmax", sClientAliveCountMax },
+       { "authorizedkeysfile", sAuthorizedKeysFile },
+       { "authorizedkeysfile2", sAuthorizedKeysFile2 },
+       { "PAMAuthenticationViaKbdInt", sPAMAuthenticationViaKbdInt },
        { NULL, 0 }
 };
 
@@ -320,7 +333,7 @@ parse_token(const char *cp, const char *filename,
        return sBadOption;
 }
 
-void
+static void
 add_listen_addr(ServerOptions *options, char *addr, u_short port)
 {
        int i;
@@ -334,7 +347,7 @@ add_listen_addr(ServerOptions *options, char *addr, u_short port)
                add_one_listen_addr(options, addr, port);
 }
 
-void
+static void
 add_one_listen_addr(ServerOptions *options, char *addr, u_short port)
 {
        struct addrinfo hints, *ai, *aitop;
@@ -397,7 +410,7 @@ read_server_config(ServerOptions *options, const char *filename)
                                continue;
                        if (options->listen_addrs != NULL)
                                fatal("%s line %d: ports must be specified before "
-                                   "ListenAdress.\n", filename, linenum);
+                                   "ListenAdress.", filename, linenum);
                        if (options->num_ports >= MAX_PORTS)
                                fatal("%s line %d: too many ports.",
                                    filename, linenum);
@@ -425,11 +438,21 @@ parse_int:
 
                case sLoginGraceTime:
                        intptr = &options->login_grace_time;
-                       goto parse_int;
+parse_time:
+                       arg = strdelim(&cp);
+                       if (!arg || *arg == '\0')
+                               fatal("%s line %d: missing time value.",
+                                   filename, linenum);
+                       if ((value = convtime(arg)) == -1)
+                               fatal("%s line %d: invalid time value.",
+                                   filename, linenum);
+                       if (*intptr == -1)
+                               *intptr = value;
+                       break;
 
                case sKeyRegenerationTime:
                        intptr = &options->key_regeneration_time;
-                       goto parse_int;
+                       goto parse_time;
 
                case sListenAddress:
                        arg = strdelim(&cp);
@@ -599,7 +622,7 @@ parse_flag:
                        goto parse_flag;
 
                case sChallengeResponseAuthentication:
-                       intptr = &options->challenge_reponse_authentication;
+                       intptr = &options->challenge_response_authentication;
                        goto parse_flag;
 
                case sPrintMotd:
@@ -788,12 +811,31 @@ parse_flag:
                case sBanner:
                        charptr = &options->banner;
                        goto parse_filename;
+               /*
+                * These options can contain %X options expanded at
+                * connect time, so that you can specify paths like:
+                *
+                * AuthorizedKeysFile   /etc/ssh_keys/%u
+                */
+               case sAuthorizedKeysFile:
+               case sAuthorizedKeysFile2:
+                       charptr = (opcode == sAuthorizedKeysFile ) ?
+                           &options->authorized_keys_file :
+                           &options->authorized_keys_file2;
+                       goto parse_filename;
+
                case sClientAliveInterval:
                        intptr = &options->client_alive_interval;
-                       goto parse_int;
+                       goto parse_time;
+
                case sClientAliveCountMax:
                        intptr = &options->client_alive_count_max;
                        goto parse_int;
+
+               case sPAMAuthenticationViaKbdInt:
+                       intptr = &options->pam_authentication_via_kbd_int;
+                       goto parse_flag;
+
                default:
                        fatal("%s line %d: Missing handler for opcode %s (%d)",
                            filename, linenum, arg, opcode);