d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Switch over to using pam_login_access(8) module in sshd(8).

Browse Source 
(Fixes static compilation.  Reduces diffs to OpenSSH.)

Reviewed by:	bde
This commit is contained in:
Ruslan Ermilov 2002-03-26 12:52:28 +00:00
parent 70f8353a04
commit 2735cfee64
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=93221
4 changed files with 8 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
crypto/openssh/auth1.c
View File

@ -88,12 +88,12 @@ do_authloop(Authctxt *authctxt)
#ifdef USE_PAM #ifdef USE_PAM
struct inverted_pam_cookie *pam_cookie; struct inverted_pam_cookie *pam_cookie;
#endif /* USE_PAM */ #endif /* USE_PAM */
#if defined(HAVE_LOGIN_CAP) || defined(LOGIN_ACCESS) #if defined(HAVE_LOGIN_CAP)
const char *from_host, *from_ip; const char *from_host, *from_ip;
from_host = get_canonical_hostname(options.verify_reverse_mapping); from_host = get_canonical_hostname(options.verify_reverse_mapping);
from_ip = get_remote_ipaddr(); from_ip = get_remote_ipaddr();
#endif /* HAVE_LOGIN_CAP || LOGIN_ACCESS */ #endif /* HAVE_LOGIN_CAP */
debug("Attempting authentication for %s%.100s.", debug("Attempting authentication for %s%.100s.",
authctxt->valid ? "" : "illegal user ", authctxt->user); authctxt->valid ? "" : "illegal user ", authctxt->user);
@ -369,13 +369,6 @@ do_authloop(Authctxt *authctxt)
lc = NULL; lc = NULL;
} }
#endif /* HAVE_LOGIN_CAP */ #endif /* HAVE_LOGIN_CAP */
#ifdef LOGIN_ACCESS
if (pw != NULL && !login_access(pw->pw_name, from_host)) {
log("Denied connection for %.200s from %.200s [%.200s].",
pw->pw_name, from_host, from_ip);
packet_disconnect("Sorry, you are not allowed to connect.");
}
#endif /* LOGIN_ACCESS */
#ifdef BSD_AUTH #ifdef BSD_AUTH
if (authctxt->as) { if (authctxt->as) {
auth_close(authctxt->as); auth_close(authctxt->as);

12
crypto/openssh/auth2.c
View File

@ -174,12 +174,12 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt)
#ifdef HAVE_LOGIN_CAP #ifdef HAVE_LOGIN_CAP
login_cap_t *lc; login_cap_t *lc;
#endif /* HAVE_LOGIN_CAP */ #endif /* HAVE_LOGIN_CAP */
#if defined(HAVE_LOGIN_CAP) || defined(LOGIN_ACCESS) #if defined(HAVE_LOGIN_CAP)
const char *from_host, *from_ip; const char *from_host, *from_ip;
from_host = get_canonical_hostname(options.verify_reverse_mapping); from_host = get_canonical_hostname(options.verify_reverse_mapping);
from_ip = get_remote_ipaddr(); from_ip = get_remote_ipaddr();
#endif /* HAVE_LOGIN_CAP || LOGIN_ACCESS */ #endif /* HAVE_LOGIN_CAP */
if (authctxt == NULL) if (authctxt == NULL)
fatal("input_userauth_request: no authctxt"); fatal("input_userauth_request: no authctxt");
@ -238,14 +238,6 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt)
lc = NULL; lc = NULL;
} }
#endif /* HAVE_LOGIN_CAP */ #endif /* HAVE_LOGIN_CAP */
#ifdef LOGIN_ACCESS
if (authctxt->pw != NULL &&
!login_access(authctxt->pw->pw_name, from_host)) {
log("Denied connection for %.200s from %.200s [%.200s].",
authctxt->pw->pw_name, from_host, from_ip);
packet_disconnect("Sorry, you are not allowed to connect.");
}
#endif /* LOGIN_ACCESS */
/* reset state */ /* reset state */
auth2_challenge_stop(authctxt); auth2_challenge_stop(authctxt);
authctxt->postponed = 0; authctxt->postponed = 0;

1
etc/pam.d/sshd
View File

@ -9,6 +9,7 @@ auth required pam_nologin.so no_warn
auth required pam_unix.so no_warn try_first_pass auth required pam_unix.so no_warn try_first_pass
# account # account
account required pam_login_access.so
account required pam_unix.so account required pam_unix.so
# session # session

8
secure/usr.sbin/sshd/Makefile
View File

@ -1,17 +1,15 @@
# $FreeBSD$ # $FreeBSD$
# #
LOGINSRC= ${.CURDIR}/../../../usr.bin/login
PROG= sshd PROG= sshd
SRCS= sshd.c auth-rhosts.c auth-passwd.c auth-rsa.c auth-rh-rsa.c \ SRCS= sshd.c auth-rhosts.c auth-passwd.c auth-rsa.c auth-rh-rsa.c \
sshpty.c sshlogin.c servconf.c serverloop.c \ sshpty.c sshlogin.c servconf.c serverloop.c \
auth.c auth1.c auth2.c auth-options.c session.c \ auth.c auth1.c auth2.c auth-options.c session.c \
auth-chall.c auth2-chall.c auth-skey.c auth-pam.c auth2-pam.c \ auth-chall.c auth2-chall.c auth-skey.c auth-pam.c auth2-pam.c \
groupaccess.c login_access.c groupaccess.c
MAN= sshd.8 MAN= sshd.8
CFLAGS+= -DLIBWRAP -DHAVE_LOGIN_CAP -DLOGIN_ACCESS -I${LOGINSRC} -DUSE_PAM -DHAVE_PAM_GETENVLIST CFLAGS+= -DLIBWRAP -DHAVE_LOGIN_CAP -DUSE_PAM -DHAVE_PAM_GETENVLIST
.if defined(MAKE_KERBEROS4) && \ .if defined(MAKE_KERBEROS4) && \
((${MAKE_KERBEROS4} == "yes") || (${MAKE_KERBEROS4} == "YES")) ((${MAKE_KERBEROS4} == "yes") || (${MAKE_KERBEROS4} == "YES"))
@ -44,4 +42,4 @@ DPADD+= ${LIBSSH} ${LIBCRYPT} ${LIBCRYPTO} ${LIBUTIL} ${LIBZ} ${LIBWRAP} ${LIBPA
.include <bsd.prog.mk> .include <bsd.prog.mk>
.PATH: ${SSHDIR} ${LOGINSRC} .PATH: ${SSHDIR}