- markus@cvs.openbsd.org 2002/07/03 14:21:05

     [ssh-keysign.8 ssh-keysign.c ssh.c ssh_config]
     re-enable ssh-keysign's sbit, but make ssh-keysign read
     /etc/ssh/ssh_config and exit if HostbasedAuthentication is disabled
     globally. based on discussions with deraadt, itojun and sommerfeld;
     ok itojun@

diff --git a/ChangeLog b/ChangeLog
index 2f9b6731cd6ca484984b2b28941746295e56a39e..ccc21527c78138f441e6d11213fdc0a3a39dbbe2 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -50,6 +50,12 @@
      use RSA_blinding_on() for rsa hostkeys (suggested by Bill Sommerfeld)
      in order to avoid a possible Kocher timing attack pointed out by Charles
      Hannum; ok provos@
+   - markus@cvs.openbsd.org 2002/07/03 14:21:05
+     [ssh-keysign.8 ssh-keysign.c ssh.c ssh_config]
+     re-enable ssh-keysign's sbit, but make ssh-keysign read 
+     /etc/ssh/ssh_config and exit if HostbasedAuthentication is disabled 
+     globally. based on discussions with deraadt, itojun and sommerfeld; 
+     ok itojun@
 
 20020702
  - (djm) Use PAM_MSG_MEMBER for PAM_TEXT_INFO messages, use xmalloc & 

diff --git a/ssh-keysign.8 b/ssh-keysign.8
index ab2cf21bab3fb37c087712ef5cb1e8bb6d241c7a..cea4a8244a63b56e332263e1509cd528bb08b867 100644 (file)
--- a/ssh-keysign.8
+++ b/ssh-keysign.8
@@ -1,4 +1,4 @@
-.\" $OpenBSD: ssh-keysign.8,v 1.2 2002/06/10 16:56:30 stevesk Exp $
+.\" $OpenBSD: ssh-keysign.8,v 1.3 2002/07/03 14:21:05 markus Exp $
 .\"
 .\" Copyright (c) 2002 Markus Friedl.  All rights reserved.
 .\"
@@ -36,6 +36,16 @@ is used by
 .Xr ssh 1
 to access the local host keys and generate the digital signature
 required during hostbased authentication with SSH protocol version 2.
+.Pp
+.Nm
+is disabled by default and can only be enabled in the
+the global client configuration file
+.Pa /etc/ssh/ssh_config
+by setting
+.Cm HostbasedAuthentication
+to
+.Dq yes .
+.Pp
 .Nm
 is not intended to be invoked by the user, but from
 .Xr ssh 1 .
@@ -46,6 +56,10 @@ and
 for more information about hostbased authentication.
 .Sh FILES
 .Bl -tag -width Ds
+.It Pa /etc/ssh/ssh_config
+Controls whether
+.Nm
+is enabled.
 .It Pa /etc/ssh/ssh_host_dsa_key, /etc/ssh/ssh_host_rsa_key
 These files contain the private parts of the host keys used to
 generate the digital signature.  They
@@ -58,6 +72,7 @@ must be set-uid root if hostbased authentication is used.
 .Sh SEE ALSO
 .Xr ssh 1 ,
 .Xr ssh-keygen 1 ,
+.Xr ssh_config 5 ,
 .Xr sshd 8
 .Sh AUTHORS
 Markus Friedl <markus@openbsd.org>

diff --git a/ssh-keysign.c b/ssh-keysign.c
index bed2b987488192d3cda86bcb5dbe73ef6d20bca0..06d28efa8b36a5bf8bc43b401c38726bbd132137 100644 (file)
--- a/ssh-keysign.c
+++ b/ssh-keysign.c
@@ -22,7 +22,7 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 #include "includes.h"
-RCSID("$OpenBSD: ssh-keysign.c,v 1.6 2002/07/03 09:55:38 markus Exp $");
+RCSID("$OpenBSD: ssh-keysign.c,v 1.7 2002/07/03 14:21:05 markus Exp $");
 
 #include <openssl/evp.h>
 #include <openssl/rand.h>
@@ -30,6 +30,7 @@ RCSID("$OpenBSD: ssh-keysign.c,v 1.6 2002/07/03 09:55:38 markus Exp $");
 
 #include "log.h"
 #include "key.h"
+#include "ssh.h"
 #include "ssh2.h"
 #include "misc.h"
 #include "xmalloc.h"
@@ -39,6 +40,9 @@ RCSID("$OpenBSD: ssh-keysign.c,v 1.6 2002/07/03 09:55:38 markus Exp $");
 #include "msg.h"
 #include "canohost.h"
 #include "pathnames.h"
+#include "readconf.h"
+
+uid_t original_real_uid;       /* XXX readconf.c needs this */
 
 #ifdef HAVE___PROGNAME
 extern char *__progname;
@@ -136,6 +140,7 @@ int
 main(int argc, char **argv)
 {
        Buffer b;
+       Options options;
        Key *keys[2], *key;
        struct passwd *pw;
        int key_fd[2], i, found, version = 2, fd;
@@ -158,6 +163,15 @@ main(int argc, char **argv)
        log_init("ssh-keysign", SYSLOG_LEVEL_DEBUG3, SYSLOG_FACILITY_AUTH, 0);
 #endif
 
+       /* verify that ssh-keysign is enabled by the admin */
+       original_real_uid = getuid();   /* XXX readconf.c needs this */
+       initialize_options(&options);
+       (void)read_config_file(_PATH_HOST_CONFIG_FILE, "", &options);
+       fill_default_options(&options);
+       if (options.hostbased_authentication != 1)
+               fatal("Hostbased authentication not enabled in %s",
+                   _PATH_HOST_CONFIG_FILE);
+
        if (key_fd[0] == -1 && key_fd[1] == -1)
                fatal("could not open any host key");
 

diff --git a/ssh.c b/ssh.c
index 67d297c0a60c963cb83451ee0a16e824fdbe1189..77e709dafad876b28c95b0db65ac2052edd1d3b9 100644 (file)
--- a/ssh.c
+++ b/ssh.c
@@ -40,7 +40,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: ssh.c,v 1.180 2002/06/30 21:59:45 deraadt Exp $");
+RCSID("$OpenBSD: ssh.c,v 1.181 2002/07/03 14:21:05 markus Exp $");
 
 #include <openssl/evp.h>
 #include <openssl/err.h>
@@ -649,7 +649,8 @@ again:
                    _PATH_HOST_RSA_KEY_FILE, "", NULL);
                PRIV_END;
 
-               if (sensitive_data.keys[0] == NULL &&
+               if (options.hostbased_authentication == 1 &&
+                   sensitive_data.keys[0] == NULL &&
                    sensitive_data.keys[1] == NULL &&
                    sensitive_data.keys[2] == NULL) {
                        sensitive_data.keys[1] = key_load_public(

diff --git a/ssh_config b/ssh_config
index ef31d4336bfc9697ffdd0d1bc96c497b25302229..94cffbf395aa64ba8820e53cf415aadbc341d1d7 100644 (file)
--- a/ssh_config
+++ b/ssh_config
@@ -1,4 +1,4 @@
-#      $OpenBSD: ssh_config,v 1.15 2002/06/20 20:03:34 stevesk Exp $
+#      $OpenBSD: ssh_config,v 1.16 2002/07/03 14:21:05 markus Exp $
 
 # This is the ssh client system-wide configuration file.  See
 # ssh_config(5) for more information.  This file provides defaults for
@@ -22,6 +22,7 @@
 #   RhostsRSAAuthentication no
 #   RSAAuthentication yes
 #   PasswordAuthentication yes
+#   HostbasedAuthentication no
 #   BatchMode no
 #   CheckHostIP yes
 #   StrictHostKeyChecking ask