70 lines
2.1 KiB
Plaintext
70 lines
2.1 KiB
Plaintext
(pulled from the PR)
|
|
|
|
commit 27ceebbc2402e4c98203c7eef9696f4bd3d326f8
|
|
Author: Ed Maste <emaste@FreeBSD.org>
|
|
Date: Tue Aug 31 15:30:50 2021 -0400
|
|
|
|
openssh: simplify login class restrictions
|
|
|
|
Login class-based restrictions were introduced in 5b400a39b8ad. The
|
|
code was adapted for sshd's Capsicum sandbox and received many changes
|
|
over time, including at least fc3c19a9fcee, bd393de91cc3, and
|
|
e8c56fba2926.
|
|
|
|
During an attempt to upstream the work a much simpler approach was
|
|
suggested. Adopt it now in the in-tree OpenSSH to reduce conflicts with
|
|
future updates.
|
|
|
|
Submitted by: Yuchiro Naito (against OpenSSH-portable on GitHub)
|
|
Obtained from: https://github.com/openssh/openssh-portable/pull/262
|
|
Reviewed by: allanjude, kevans
|
|
MFC after: 2 weeks
|
|
Differential Revision: https://reviews.freebsd.org/D31760
|
|
|
|
|
|
--- auth.c
|
|
+++ auth.c
|
|
@@ -566,6 +566,9 @@ getpwnamallow(struct ssh *ssh, const char *user)
|
|
{
|
|
#ifdef HAVE_LOGIN_CAP
|
|
extern login_cap_t *lc;
|
|
+#ifdef HAVE_AUTH_HOSTOK
|
|
+ const char *from_host, *from_ip;
|
|
+#endif
|
|
#ifdef BSD_AUTH
|
|
auth_session_t *as;
|
|
#endif
|
|
@@ -611,6 +614,21 @@ getpwnamallow(struct ssh *ssh, const char *user)
|
|
debug("unable to get login class: %s", user);
|
|
return (NULL);
|
|
}
|
|
+#ifdef HAVE_AUTH_HOSTOK
|
|
+ from_host = auth_get_canonical_hostname(ssh, options.use_dns);
|
|
+ from_ip = ssh_remote_ipaddr(ssh);
|
|
+ if (!auth_hostok(lc, from_host, from_ip)) {
|
|
+ debug("Denied connection for %.200s from %.200s [%.200s].",
|
|
+ pw->pw_name, from_host, from_ip);
|
|
+ return (NULL);
|
|
+ }
|
|
+#endif /* HAVE_AUTH_HOSTOK */
|
|
+#ifdef HAVE_AUTH_TIMEOK
|
|
+ if (!auth_timeok(lc, time(NULL))) {
|
|
+ debug("LOGIN %.200s REFUSED (TIME)", pw->pw_name);
|
|
+ return (NULL);
|
|
+ }
|
|
+#endif /* HAVE_AUTH_TIMEOK */
|
|
#ifdef BSD_AUTH
|
|
if ((as = auth_open()) == NULL || auth_setpwd(as, pw) != 0 ||
|
|
auth_approval(as, lc, pw->pw_name, "ssh") <= 0) {
|
|
--- configure.ac
|
|
+++ configure.ac
|
|
@@ -1784,6 +1784,8 @@ AC_SUBST([PICFLAG])
|
|
|
|
dnl Checks for library functions. Please keep in alphabetical order
|
|
AC_CHECK_FUNCS([ \
|
|
+ auth_hostok \
|
|
+ auth_timeok \
|
|
Blowfish_initstate \
|
|
Blowfish_expandstate \
|
|
Blowfish_expand0state \
|