- djm@cvs.openbsd.org 2004/03/03 09:31:20

[openssh.git] / servconf.c

diff --git a/servconf.c b/servconf.c
index 6df2a255bd3e5afd197fdd430204f4d2c014abd8..a72246b6cbd8653bde4c670f13199e90529a34df 100644 (file)
--- a/servconf.c
+++ b/servconf.c
@@ -10,15 +10,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: servconf.c,v 1.122 2003/06/02 09:17:34 markus Exp $");
-
-#if defined(KRB4)
-#include <krb.h>
-#endif
-
-#ifdef AFS
-#include <kafs.h>
-#endif
+RCSID("$OpenBSD: servconf.c,v 1.130 2003/12/23 16:12:10 jakob Exp $");
 
 #include "ssh.h"
 #include "log.h"
@@ -69,10 +61,9 @@ initialize_server_options(ServerOptions *options)
        options->x11_use_localhost = -1;
        options->xauth_location = NULL;
        options->strict_modes = -1;
-       options->keepalives = -1;
+       options->tcp_keep_alive = -1;
        options->log_facility = SYSLOG_FACILITY_NOT_SET;
        options->log_level = SYSLOG_LEVEL_NOT_SET;
-       options->rhosts_authentication = -1;
        options->rhosts_rsa_authentication = -1;
        options->hostbased_authentication = -1;
        options->hostbased_uses_name_from_packet_only = -1;
@@ -81,8 +72,9 @@ initialize_server_options(ServerOptions *options)
        options->kerberos_authentication = -1;
        options->kerberos_or_local_passwd = -1;
        options->kerberos_ticket_cleanup = -1;
-       options->kerberos_tgt_passing = -1;
-       options->afs_token_passing = -1;
+       options->kerberos_get_afs_token = -1;
+       options->gss_authentication=-1;
+       options->gss_cleanup_creds = -1;
        options->password_authentication = -1;
        options->kbd_interactive_authentication = -1;
        options->challenge_response_authentication = -1;
@@ -119,7 +111,7 @@ fill_default_server_options(ServerOptions *options)
 {
        /* Portable-specific options */
        if (options->use_pam == -1)
-               options->use_pam = 1;
+               options->use_pam = 0;
 
        /* Standard Options */
        if (options->protocol == SSH_PROTO_UNKNOWN)
@@ -168,14 +160,12 @@ fill_default_server_options(ServerOptions *options)
                options->xauth_location = _PATH_XAUTH;
        if (options->strict_modes == -1)
                options->strict_modes = 1;
-       if (options->keepalives == -1)
-               options->keepalives = 1;
+       if (options->tcp_keep_alive == -1)
+               options->tcp_keep_alive = 1;
        if (options->log_facility == SYSLOG_FACILITY_NOT_SET)
                options->log_facility = SYSLOG_FACILITY_AUTH;
        if (options->log_level == SYSLOG_LEVEL_NOT_SET)
                options->log_level = SYSLOG_LEVEL_INFO;
-       if (options->rhosts_authentication == -1)
-               options->rhosts_authentication = 0;
        if (options->rhosts_rsa_authentication == -1)
                options->rhosts_rsa_authentication = 0;
        if (options->hostbased_authentication == -1)
@@ -192,10 +182,12 @@ fill_default_server_options(ServerOptions *options)
                options->kerberos_or_local_passwd = 1;
        if (options->kerberos_ticket_cleanup == -1)
                options->kerberos_ticket_cleanup = 1;
-       if (options->kerberos_tgt_passing == -1)
-               options->kerberos_tgt_passing = 0;
-       if (options->afs_token_passing == -1)
-               options->afs_token_passing = 0;
+       if (options->kerberos_get_afs_token == -1)
+               options->kerberos_get_afs_token = 0;
+       if (options->gss_authentication == -1)
+               options->gss_authentication = 0;
+       if (options->gss_cleanup_creds == -1)
+               options->gss_cleanup_creds = 1;
        if (options->password_authentication == -1)
                options->password_authentication = 1;
        if (options->kbd_interactive_authentication == -1)
@@ -259,13 +251,14 @@ typedef enum {
        /* Standard Options */
        sPort, sHostKeyFile, sServerKeyBits, sLoginGraceTime, sKeyRegenerationTime,
        sPermitRootLogin, sLogFacility, sLogLevel,
-       sRhostsAuthentication, sRhostsRSAAuthentication, sRSAAuthentication,
+       sRhostsRSAAuthentication, sRSAAuthentication,
        sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup,
-       sKerberosTgtPassing, sAFSTokenPassing, sChallengeResponseAuthentication,
+       sKerberosGetAFSToken,
+       sKerberosTgtPassing, sChallengeResponseAuthentication,
        sPasswordAuthentication, sKbdInteractiveAuthentication, sListenAddress,
        sPrintMotd, sPrintLastLog, sIgnoreRhosts,
        sX11Forwarding, sX11DisplayOffset, sX11UseLocalhost,
-       sStrictModes, sEmptyPasswd, sKeepAlives,
+       sStrictModes, sEmptyPasswd, sTCPKeepAlive,
        sPermitUserEnvironment, sUseLogin, sAllowTcpForwarding, sCompression,
        sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups,
        sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile,
@@ -273,6 +266,7 @@ typedef enum {
        sBanner, sUseDNS, sHostbasedAuthentication,
        sHostbasedUsesNameFromPacketOnly, sClientAliveInterval,
        sClientAliveCountMax, sAuthorizedKeysFile, sAuthorizedKeysFile2,
+       sGssAuthentication, sGssCleanupCreds,
        sUsePrivilegeSeparation,
        sDeprecated, sUnsupported
 } ServerOpCodes;
@@ -284,10 +278,11 @@ static struct {
 } keywords[] = {
        /* Portable-specific options */
 #ifdef USE_PAM
-       { "UsePAM", sUsePAM },
+       { "usepam", sUsePAM },
 #else
-       { "UsePAM", sUnsupported },
+       { "usepam", sUnsupported },
 #endif
+       { "pamauthenticationviakbdint", sDeprecated },
        /* Standard Options */
        { "port", sPort },
        { "hostkey", sHostKeyFile },
@@ -299,28 +294,36 @@ static struct {
        { "permitrootlogin", sPermitRootLogin },
        { "syslogfacility", sLogFacility },
        { "loglevel", sLogLevel },
-       { "rhostsauthentication", sRhostsAuthentication },
+       { "rhostsauthentication", sDeprecated },
        { "rhostsrsaauthentication", sRhostsRSAAuthentication },
        { "hostbasedauthentication", sHostbasedAuthentication },
        { "hostbasedusesnamefrompacketonly", sHostbasedUsesNameFromPacketOnly },
        { "rsaauthentication", sRSAAuthentication },
        { "pubkeyauthentication", sPubkeyAuthentication },
        { "dsaauthentication", sPubkeyAuthentication },                 /* alias */
-#if defined(KRB4) || defined(KRB5)
+#ifdef KRB5
        { "kerberosauthentication", sKerberosAuthentication },
        { "kerberosorlocalpasswd", sKerberosOrLocalPasswd },
        { "kerberosticketcleanup", sKerberosTicketCleanup },
-       { "kerberostgtpassing", sKerberosTgtPassing },
+#ifdef USE_AFS
+       { "kerberosgetafstoken", sKerberosGetAFSToken },
+#else
+       { "kerberosgetafstoken", sUnsupported },
+#endif
 #else
        { "kerberosauthentication", sUnsupported },
        { "kerberosorlocalpasswd", sUnsupported },
        { "kerberosticketcleanup", sUnsupported },
-       { "kerberostgtpassing", sUnsupported },
+       { "kerberosgetafstoken", sUnsupported },
 #endif
-#if defined(AFS)
-       { "afstokenpassing", sAFSTokenPassing },
-#else
+       { "kerberostgtpassing", sUnsupported },
        { "afstokenpassing", sUnsupported },
+#ifdef GSSAPI
+       { "gssapiauthentication", sGssAuthentication },
+       { "gssapicleanupcredentials", sGssCleanupCreds },
+#else
+       { "gssapiauthentication", sUnsupported },
+       { "gssapicleanupcredentials", sUnsupported },
 #endif
        { "passwordauthentication", sPasswordAuthentication },
        { "kbdinteractiveauthentication", sKbdInteractiveAuthentication },
@@ -341,7 +344,8 @@ static struct {
        { "permituserenvironment", sPermitUserEnvironment },
        { "uselogin", sUseLogin },
        { "compression", sCompression },
-       { "keepalive", sKeepAlives },
+       { "tcpkeepalive", sTCPKeepAlive },
+       { "keepalive", sTCPKeepAlive },                         /* obsolete alias */
        { "allowtcpforwarding", sAllowTcpForwarding },
        { "allowusers", sAllowUsers },
        { "denyusers", sDenyUsers },
@@ -604,10 +608,6 @@ parse_flag:
                intptr = &options->ignore_user_known_hosts;
                goto parse_flag;
 
-       case sRhostsAuthentication:
-               intptr = &options->rhosts_authentication;
-               goto parse_flag;
-
        case sRhostsRSAAuthentication:
                intptr = &options->rhosts_rsa_authentication;
                goto parse_flag;
@@ -640,12 +640,16 @@ parse_flag:
                intptr = &options->kerberos_ticket_cleanup;
                goto parse_flag;
 
-       case sKerberosTgtPassing:
-               intptr = &options->kerberos_tgt_passing;
+       case sKerberosGetAFSToken:
+               intptr = &options->kerberos_get_afs_token;
+               goto parse_flag;
+
+       case sGssAuthentication:
+               intptr = &options->gss_authentication;
                goto parse_flag;
 
-       case sAFSTokenPassing:
-               intptr = &options->afs_token_passing;
+       case sGssCleanupCreds:
+               intptr = &options->gss_cleanup_creds;
                goto parse_flag;
 
        case sPasswordAuthentication:
@@ -688,8 +692,8 @@ parse_flag:
                intptr = &options->strict_modes;
                goto parse_flag;
 
-       case sKeepAlives:
-               intptr = &options->keepalives;
+       case sTCPKeepAlive:
+               intptr = &options->tcp_keep_alive;
                goto parse_flag;
 
        case sEmptyPasswd: