Commit Graph

605 Commits

Author SHA1 Message Date
des
f4ca4d4385 document the current default value for VersionAddendum. 2003-02-11 12:11:15 +00:00
des
a6e843c458 Set the ruid to the euid at startup as a workaround for a bug in pam_ssh.
MFC after:	3 days
2003-02-07 15:48:27 +00:00
trhodes
914d9fc8a8 The manual page lists only 2 files, however it reads as `three files' which is
obviously incorrect.

PR:		46841
Submitted by:	Sakamoto Seiji <s-siji@hyper.ocn.ne.jp>
2003-02-05 02:14:03 +00:00
des
b9730314a0 Linux-PAM's pam_start(3) fails with a bogus error message if passed the
pam_conv argument is NULL.  OpenPAM doesn't care, but to make things
easier for people porting this code to other systems (or -STABLE), use
a dummy struct pam_conv instead of NULL.

Pointed out by:	Damien Miller <djm@mindrot.org>
2003-02-03 14:10:28 +00:00
des
8da928f615 Bump patch date to 2003-02-01 (the day after I fixed PAM authentication
for ssh1)
2003-02-03 11:11:36 +00:00
des
a428b35290 Fix keyboard-interactive authentication for ssh1. The problem was twofold:
- The PAM kbdint device sometimes doesn't know authentication succeeded
   until you re-query it.  The ssh1 kbdint code would never re-query the
   device, so authentication would always fail.  This patch has been
   submitted to the OpenSSH developers.

 - The monitor code for PAM sometimes forgot to tell the monitor that
   authentication had succeeded.  This caused the monitor to veto the
   privsep child's decision to allow the connection.

These patches have been tested with OpenSSH clients on -STABLE, NetBSD and
Linux, and with ssh.com's ssh1 on Solaris.

Sponsored by:	DARPA, NAI Labs
2003-01-31 11:08:07 +00:00
nectar
637cc179f5 Background:
When libdes was replaced with OpenSSL's libcrypto, there were a few
 interfaces that the former implemented but the latter did not.  Because
 some software in the base system still depended upon these interfaces,
 we simply included them in our libcrypto (rnd_keys.c).

Now, finally get around to removing the dependencies on these
interfaces.  There were basically two cases:

  des_new_random_key -- This is just a wrapper for des_random_key, and
     these calls were replaced.

  des_init_random_number_generator et. al. -- A few functions were used
     by the application to seed libdes's PRNG.  These are not necessary
     when using libcrypto, as OpenSSL internally seeds the PRNG from
     /dev/random.  These calls were simply removed.

Again, some of the Kerberos 4 files have been taken off the vendor
branch.  I do not expect there to be future imports of KTH Kerberos 4.
2003-01-29 18:14:29 +00:00
nectar
b6c07e9a21 = Fix a bug in UI_UTIL_read_pw's error handling that caused
des_read_pw_string to break (and thus rather mysteriously
  breaking utilities such as kinit).

= Enable the BSD /dev/crypto interface.

(These changes are being imported on the vendor branch, as they have
already been accepted and committed to the OpenSSL CVS repository.)
2003-01-29 02:25:30 +00:00
nectar
e99b3c8426 This commit was generated by cvs2svn to compensate for changes in r110018,
which included commits to RCS files with non-trunk default branches.
2003-01-29 02:25:30 +00:00
markm
3f245d6325 Merge conflicts.
This is cunning doublespeak for "use vendor code".
2003-01-28 22:34:21 +00:00
markm
ad7148cc98 Remove files no longer on OpenSSL 0.9.7. crypto/des/rnd_keys.c is
retained as it is still used.
2003-01-28 22:12:30 +00:00
markm
aad1d64cb5 Vendor import of OpenSSL release 0.9.7. This release includes
support for AES and OpenBSD's hardware crypto.
2003-01-28 21:43:22 +00:00
markm
33af127a88 This commit was generated by cvs2svn to compensate for changes in r109998,
which included commits to RCS files with non-trunk default branches.
2003-01-28 21:43:22 +00:00
nectar
4bcab33bf9 Make the Kerberos 4 bits build against OpenSSL 0.9.7. This required
two basic changes (both of which should be no-ops until OpenSSL 0.9.7
is imported):

 = Define OPENSSL_DES_LIBDES_COMPATIBILITY wherever we include
   openssl/des.h.

 = Spell `struct des_ks_struct []' using the existing
   `des_key_schedule' typedef.

When OpenSSL 0.9.7 is imported, `des_key_schedule' (among other
things) will be a macro invocation instead of a typedef, and things
should `just work'.

Yes, this commit does take several files off the vendor branch.
I do not expect there to be future imports of KTH Kerberos 4.
2003-01-28 20:18:26 +00:00
des
d37413d05a Force early initialization of the resolver library, since the resolver
configuration files will no longer be available once sshd is chrooted.

PR:		39953, 40894
Submitted by:	dinoex
MFC after:	3 days
2003-01-22 14:12:59 +00:00
nectar
12eb3dee85 Add a missing include, needed to get a prototype for `des_read_pw_string'.
This is particularly important for OpenSSL 0.9.7, as `des_read_pw_string'
is a macro there.  (This fix brought in on the vendor branch, because I
already committed it to Heimdal's CVS.)
2003-01-21 14:19:06 +00:00
nectar
d729ef0795 This commit was generated by cvs2svn to compensate for changes in r109641,
which included commits to RCS files with non-trunk default branches.
2003-01-21 14:19:06 +00:00
billf
75d164a3d8 add more RFC defined telnet options
Reviewed by:	ps
2003-01-18 06:10:21 +00:00
des
a9741e060a The previous commit contained a stupid mistake: ctxt->pam_[cp]sock was
initialized after the call to pthread_create() instead of before.  It just
happened to work with threads enabled because ctxt is shared, but of
course it doesn't work when we use a child process instead of threads.
2002-12-21 15:09:58 +00:00
des
06b0ce4f65 If possible, use pthreads instead of a child process for PAM.
Reimplement the necessary bits from auth_pam.c and auth2_pam.c so that
they share the PAM context used by the keyboard-interactive thread.  If
a child process is used instead, they will (necessarily) use a separate
context.

Constify do_pam_account() and do_pam_session().

Sponsored by:	DARPA, NAI Labs
2002-12-14 13:52:39 +00:00
des
b6985eb271 Add a missing #include "canohost.h". 2002-12-14 13:48:47 +00:00
des
a46b8cda04 Remove code related to the PAMAuthenticationViaKbdInt option (which we've
disabled).  This removes the only reference to auth2_pam().
2002-12-14 13:48:13 +00:00
des
9f8ff3709f Back out a lastlog-related change which is no longer relevant. 2002-12-14 13:40:21 +00:00
des
bb06b52b06 Fix a rounding error in the block size calculation.
Submitted by:	tjr
2002-12-14 13:38:49 +00:00
des
81fe169630 Since OpenSSH drops privileges before calling pam_open_session(3),
pam_lastlog(8) can't possibly work, so let OpenSSH handle lastlog.

Approved by:	re (rwatson)
2002-12-03 15:48:11 +00:00
eric
7153bb5d55 Merge argument parsing changes into this copy of telnet.
Submitted by:	markm
Approved by:	bmah
2002-11-27 06:34:24 +00:00
nectar
1abd325d28 Import of Heimdal 0.5.1.
Approved by:	re
2002-11-24 20:59:25 +00:00
nectar
d13cd487f6 This commit was generated by cvs2svn to compensate for changes in r107207,
which included commits to RCS files with non-trunk default branches.
2002-11-24 20:59:25 +00:00
des
66bd92dc49 Add caveats regarding the effect of PAM on PasswordAuthentication and
PermitRootLogin.

PR:		docs/43776
MFC after:	1 week
2002-11-06 08:04:56 +00:00
des
398f2c44aa Document the current default for VersionAddendum. 2002-11-05 17:25:15 +00:00
des
b0ec3f5077 Accurately reflect our local changes and additions. 2002-11-05 17:24:01 +00:00
des
e08b64e978 Document the current default value for VersionAddendum. 2002-11-05 17:17:09 +00:00
des
d6d0eadd15 Switch to two-clause license, with NAI's permission. 2002-11-02 19:55:23 +00:00
des
279b0fa809 Resolve conflicts. 2002-10-29 10:16:02 +00:00
des
ce26c10eda Protect against tag expansion + fix some brainos. 2002-10-29 10:12:51 +00:00
des
4d499f34f8 Some tricks I use when I upgrade. 2002-10-29 09:56:16 +00:00
des
9f3147578a Correct shell code to expand globs in FREEBSD-Xlist 2002-10-29 09:55:28 +00:00
des
b057cae3d7 More cruft. 2002-10-29 09:54:53 +00:00
des
099d1a58f7 Vendor import of OpenSSH-portable 3.5p1. 2002-10-29 09:43:00 +00:00
des
85f71815b9 This commit was generated by cvs2svn to compensate for changes in r106121,
which included commits to RCS files with non-trunk default branches.
2002-10-29 09:43:00 +00:00
assar
36fdd564c7 This commit was generated by cvs2svn to compensate for changes in r105765,
which included commits to RCS files with non-trunk default branches.
2002-10-23 06:10:08 +00:00
assar
1b79516e3f import 1.29 to fix buffer overflow:
check the length of the authenticator and rlen

Obtained from:	Heimdal CVS
2002-10-23 06:10:08 +00:00
assar
3d945415d6 import 1.27 to fix buffer overflow:
check size of rlen

Obtained from:	Heimdal CVS
2002-10-22 02:13:32 +00:00
assar
4e7f1e8a5d This commit was generated by cvs2svn to compensate for changes in r105672,
which included commits to RCS files with non-trunk default branches.
2002-10-22 02:13:32 +00:00
dd
f5801700f4 Permit the argument to the -s option to be a hostname. I see no
reason to restrict this to a numeric address.

PR:		41841
Submitted by:	Dmitry Pryanishnikov <dmitry@atlantis.dp.ua>,
		Maxim Maximov <mcsi@agava.com>
2002-10-02 00:27:14 +00:00
nectar
93b309dcff Fix an annoying bug that causes a spurious error message when changing
passwords, even when the operation actually succeeded.

    % k5passwd
    luser@REA.LM's Password: **************
    New password: **************
    Verifying password - New password: **************
    k5passwd: krb5_change_password: unable to reach any changepw server  in realm REA.LM

[In reality, the password was changed.]

Obtained from:	Heimdal CVS
2002-09-30 11:48:23 +00:00
nectar
5a5cffa0bd This commit was generated by cvs2svn to compensate for changes in r104204,
which included commits to RCS files with non-trunk default branches.
2002-09-30 11:48:23 +00:00
markm
7a2e60f0e3 Catch up with "base" telnet.
s/FALL THROUGH/FALLTHROUGH/ for lint(1).
2002-09-25 07:28:04 +00:00
markm
0ec9e3f996 Catch up with "base" telnet.
s/FALL THROUGH/FALLTHROUGH/ for lint(1).
s/Usage/usage/ for consistency.
2002-09-25 07:26:25 +00:00
markm
8466db9d92 From the requestor:
"Could you do me a favor and fix sys_bsd.c to get the howmany() macro
from <sys/param.h>, instead of <sys/types.h>?  This will save me from
having to worry about the unsync'd bits before making the change."

Requested by:	mike
2002-09-25 07:24:01 +00:00
nectar
7458827ad1 These RFCs and internet-drafts are not really needed in the base
system, and I've not been importing them lately.  cvs rm them now
so they can be cleaned out of the attic later.

Requested by:	obrien
2002-09-18 14:17:14 +00:00
nectar
ed53d8e233 Resolve conflicts. 2002-09-16 21:07:11 +00:00
nectar
8707f88659 Import of Heimdal Kerberos from KTH repository circa 2002/09/16. 2002-09-16 21:04:40 +00:00
nectar
a876cfedd8 This commit was generated by cvs2svn to compensate for changes in r103423,
which included commits to RCS files with non-trunk default branches.
2002-09-16 21:04:40 +00:00
ume
03b3b78217 sshd didn't handle actual size of struct sockaddr correctly,
and did copy it as long as just size of struct sockaddr.  So,
If connection is via IPv6, sshd didn't log hostname into utmp
correctly.
This problem occured only under FreeBSD because of our hack.
However, this is potential problem of OpenSSH-portable, and
they agreed to fix this.
Though, there is no fixed version of OpenSSH-portable available
yet, since this problem is serious for IPv6 users, I commit the
fix.

Reported by:	many people
Reviewed by:	current@ and stable@ (no objection)
MFC after:	3 days
2002-09-09 16:49:11 +00:00
kuriyama
aae5a5f01d Fix typo (s@src/crypto/openssh-portable@src/crypto/openssh@). 2002-09-09 02:00:28 +00:00
nectar
7817fdfb01 Pass the pointy hat! Remove accidently imported files. 2002-08-30 21:53:25 +00:00
nectar
d2a1eec363 Remove some parts of the Heimdal distribution which we do not use
and have never used.
2002-08-30 21:37:10 +00:00
nectar
0816241251 Remove files no longer relevant after latest import. 2002-08-30 21:28:12 +00:00
nectar
d397dcfbc0 Resolve conflicts after import of Heimdal Kerberos circa 2002/08/29. 2002-08-30 21:25:14 +00:00
nectar
a77dba08ca Import of Heimdal Kerberos from KTH repository circa 2002/08/29. 2002-08-30 21:23:27 +00:00
nectar
820d4243ea This commit was generated by cvs2svn to compensate for changes in r102644,
which included commits to RCS files with non-trunk default branches.
2002-08-30 21:23:27 +00:00
nsayer
3781c72cd9 Encrypted strings (after hex decoding) aren't null terminated, because
0 might simply be part of the ciphertext.

PR:		bin/40266
Submitted by:	andr@dgap.mipt.ru
MFC after:	3 days
2002-08-22 06:19:07 +00:00
nectar
f779e835e5 Resolve conflicts. 2002-08-10 01:50:50 +00:00
nectar
eba366e36e Import of OpenSSL 0.9.6g. 2002-08-10 01:48:01 +00:00
nectar
fdead658fb This commit was generated by cvs2svn to compensate for changes in r101618,
which included commits to RCS files with non-trunk default branches.
2002-08-10 01:48:01 +00:00
nectar
c99c2264cb Import of OpenSSL 0.9.6f. 2002-08-10 01:46:10 +00:00
nectar
45bf128dcc This commit was generated by cvs2svn to compensate for changes in r101615,
which included commits to RCS files with non-trunk default branches.
2002-08-10 01:46:10 +00:00
nectar
c48e8e3d25 Import of OpenSSL 0.9.6f. 2002-08-10 01:40:00 +00:00
nectar
15e4ff204e This commit was generated by cvs2svn to compensate for changes in r101613,
which included commits to RCS files with non-trunk default branches.
2002-08-10 01:40:00 +00:00
nectar
2836f6786d Correct a bug in the ASN.1 decoder which was introduced with the
recent OpenSSL update.

Obtained from:	OpenSSL CVS
2002-08-05 16:25:17 +00:00
nectar
5a59c1aa36 This commit was generated by cvs2svn to compensate for changes in r101386,
which included commits to RCS files with non-trunk default branches.
2002-08-05 16:25:17 +00:00
ache
15b8a90686 Do login cap calls _before_ descriptors are hardly closed because close may
invalidate login cap descriptor.

Reviewed by:	des
2002-08-05 16:06:35 +00:00
nectar
9b13f71fee Resolve conflicts after import of OpenSSL 0.9.6e. 2002-07-30 13:58:53 +00:00
nectar
2f13e09165 Import of OpenSSL 0.9.6e. 2002-07-30 13:38:06 +00:00
nectar
9b2d850453 This commit was generated by cvs2svn to compensate for changes in r100936,
which included commits to RCS files with non-trunk default branches.
2002-07-30 13:38:06 +00:00
nectar
7515065745 This man page has not been referenced by anything for a while,
and is not part of the OpenSSL distribution.  Remove it.
2002-07-30 12:54:03 +00:00
nectar
0518ae8674 Remove many obsolete files. The majority of these are simply no
longer included as part of the OpenSSL distribution.  However, a few
we just don't need and are explicitly excluded in FREEBSD-Xlist.
2002-07-30 12:51:09 +00:00
nectar
8b62a95bfc Resolve conflicts after import of OpenSSL 0.9.6d. 2002-07-30 12:46:49 +00:00
nectar
0aed2eea83 Import of OpenSSL 0.9.6d. 2002-07-30 12:44:15 +00:00
nectar
050218e0d0 This commit was generated by cvs2svn to compensate for changes in r100928,
which included commits to RCS files with non-trunk default branches.
2002-07-30 12:44:15 +00:00
nectar
ef94fba97d Update list of files to remove prior to import of OpenSSL 0.9.6d 2002-07-30 12:38:41 +00:00
fanf
1ae0b432fe Use login_getpwclass() instead of login_getclass() so that the root
vs. default login class distinction is made correctly.

PR:		37416
Approved by:	des
MFC after:	4 days
2002-07-29 00:36:24 +00:00
fanf
b26a01d35d FreeBSD doesn't use the host RSA key by default.
Reviewed by:	des
2002-07-26 15:16:56 +00:00
ache
57a3dbab09 Problems addressed:
1) options.print_lastlog was not honored.
2) "Last login: ..." was printed twice.
3) "copyright" was not printed
4) No newline was before motd.

Reviewed by:	maintainer's silence in 2 weeks (with my constant reminders)
2002-07-26 02:20:00 +00:00
fanf
8e466364e9 Document the FreeBSD default for CheckHostIP, which was changed in
rev 1.2 of readconf.c.

Approved by:	des
2002-07-25 15:59:40 +00:00
des
0aa82e6d90 Whitespace nit. 2002-07-23 17:57:17 +00:00
des
5aaa4a883f In pam_init_ctx(), register a cleanup function that will kill the child
process if a fatal error occurs.  Deregister it in pam_free_ctx().
2002-07-17 17:44:02 +00:00
des
71869d2ebd Use realhostname_sa(3) so the IP address will be used instead of the
hostname if the latter is too long for utmp.

Submitted by:	ru
MFC after:	3 days
2002-07-11 10:36:10 +00:00
des
ed67e10a93 Do not try to use PAM for password authentication, as it is
already (and far better) supported by the challenge/response
authentication mechanism.
2002-07-10 23:05:13 +00:00
des
1983859ac6 Don't forget to clear the buffer before reusing it. 2002-07-10 23:04:07 +00:00
des
ac9c3868c1 Rewrite to use the buffer API instead of roll-your-own messaging.
Suggested by:	Markus Friedl <markus@openbsd.org>
Sponsored by:	DARPA, NAI Labs
2002-07-05 15:27:26 +00:00
des
cd66807aa2 (forgot to commit) We don't need --with-opie since PAM takes care of it. 2002-07-05 15:25:55 +00:00
des
7e54a0bbed - Don't enable OpenSSH's OPIE support, since we let PAM handle OPIE.
- We don't have setutent(3) etc., and I have no idea why configure ever
   thought we did.
2002-07-03 00:12:09 +00:00
des
f450aaf037 Two FreeBSD-specific nits in comments:
- ChallengeResponseAuthentication controls PAM, not S/Key
 - We don't honor PAMAuthenticationViaKbdInt, because the code path it
   controls doesn't make sense for us, so don't mention it.

Sponsored by:	DARPA, NAI Labs
2002-07-03 00:08:19 +00:00
des
e9db3343e8 Version bump for mm_answer_pam_respond() fix. 2002-07-02 13:07:37 +00:00
des
7523600be4 Fix a braino in mm_answer_pam_respond() which would cause sshd to abort if
PAM authentication failed due to an incorrect response.
2002-07-02 13:07:17 +00:00
des
9cc7de0fcd Forgot to update the addendum in the config files. 2002-06-30 10:32:09 +00:00
des
3cde2270d8 Regenerate. 2002-06-29 11:58:32 +00:00
des
437db953e0 <sys/mman.h> requires <sys/types.h>. 2002-06-29 11:57:51 +00:00