kentpeacock / rpms / openssh

Forked from rpms/openssh 2 years ago
Clone
017ff1
diff --git a/gss-serv-krb5.c b/gss-serv-krb5.c
017ff1
index 0a4930e..a7c0c5f 100644
017ff1
--- a/gss-serv-krb5.c
017ff1
+++ b/gss-serv-krb5.c
017ff1
@@ -260,7 +260,6 @@ ssh_gssapi_krb5_cmdok(krb5_principal principal, const char *name,
017ff1
 	FILE *fp;
017ff1
 	char file[MAXPATHLEN];
017ff1
 	char line[BUFSIZ];
017ff1
-	char kuser[65]; /* match krb5_kuserok() */
017ff1
 	struct stat st;
017ff1
 	struct passwd *pw = the_authctxt->pw;
017ff1
 	int found_principal = 0;
017ff1
@@ -269,7 +268,7 @@ ssh_gssapi_krb5_cmdok(krb5_principal principal, const char *name,
017ff1
 
017ff1
 	snprintf(file, sizeof(file), "%s/.k5users", pw->pw_dir);
017ff1
 	/* If both .k5login and .k5users DNE, self-login is ok. */
017ff1
-	if (!k5login_exists && (access(file, F_OK) == -1)) {
017ff1
+	if ( !options.enable_k5users || (!k5login_exists && (access(file, F_OK) == -1))) {
017ff1
                 return ssh_krb5_kuserok(krb_context, principal, luser,
017ff1
                                         k5login_exists);
017ff1
 	}
017ff1
diff --git a/servconf.c b/servconf.c
017ff1
index d482e79..ad5869b 100644
017ff1
--- a/servconf.c
017ff1
+++ b/servconf.c
017ff1
@@ -158,6 +158,7 @@ initialize_server_options(ServerOptions *options)
017ff1
 	options->ip_qos_bulk = -1;
017ff1
 	options->version_addendum = NULL;
017ff1
 	options->use_kuserok = -1;
017ff1
+	options->enable_k5users = -1;
017ff1
 }
017ff1
 
017ff1
 void
017ff1
@@ -315,6 +316,8 @@ fill_default_server_options(ServerOptions *options)
017ff1
 		options->show_patchlevel = 0;
017ff1
 	if (options->use_kuserok == -1)
017ff1
 		options->use_kuserok = 1;
017ff1
+	if (options->enable_k5users == -1)
017ff1
+		options->enable_k5users = 0;
017ff1
 
017ff1
 	/* Turn privilege separation on by default */
017ff1
 	if (use_privsep == -1)
017ff1
@@ -356,7 +359,7 @@ typedef enum {
017ff1
 	sBanner, sShowPatchLevel, sUseDNS, sHostbasedAuthentication,
017ff1
 	sHostbasedUsesNameFromPacketOnly, sClientAliveInterval,
017ff1
 	sClientAliveCountMax, sAuthorizedKeysFile,
017ff1
-	sGssAuthentication, sGssCleanupCreds, sGssStrictAcceptor,
017ff1
+	sGssAuthentication, sGssCleanupCreds, sGssEnablek5users, sGssStrictAcceptor,
017ff1
 	sGssKeyEx, sGssStoreRekey, sAcceptEnv, sPermitTunnel,
017ff1
 	sMatch, sPermitOpen, sForceCommand, sChrootDirectory,
017ff1
 	sUsePrivilegeSeparation, sAllowAgentForwarding,
017ff1
@@ -430,6 +433,7 @@ static struct {
017ff1
 	{ "gssapistrictacceptorcheck", sGssStrictAcceptor, SSHCFG_GLOBAL },
017ff1
 	{ "gssapikeyexchange", sGssKeyEx, SSHCFG_GLOBAL },
017ff1
 	{ "gssapistorecredentialsonrekey", sGssStoreRekey, SSHCFG_GLOBAL },
017ff1
+	{ "gssapienablek5users", sGssEnablek5users, SSHCFG_ALL },
017ff1
 #else
017ff1
 	{ "gssapiauthentication", sUnsupported, SSHCFG_ALL },
017ff1
 	{ "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL },
017ff1
@@ -437,6 +441,7 @@ static struct {
017ff1
 	{ "gssapistrictacceptorcheck", sUnsupported, SSHCFG_GLOBAL },
017ff1
 	{ "gssapikeyexchange", sUnsupported, SSHCFG_GLOBAL },
017ff1
 	{ "gssapistorecredentialsonrekey", sUnsupported, SSHCFG_GLOBAL },
017ff1
+	{ "gssapienablek5users", sUnsupported, SSHCFG_ALL },
017ff1
 #endif
017ff1
 	{ "gssusesessionccache", sUnsupported, SSHCFG_GLOBAL },
017ff1
 	{ "gssapiusesessioncredcache", sUnsupported, SSHCFG_GLOBAL },
017ff1
@@ -1536,6 +1541,10 @@ process_server_config_line(ServerOptions *options, char *line,
017ff1
 		intptr = &options->use_kuserok;
017ff1
 		goto parse_flag;
017ff1
 
017ff1
+	case sGssEnablek5users:
017ff1
+		intptr = &options->enable_k5users;
017ff1
+		goto parse_flag;
017ff1
+
017ff1
 	case sPermitOpen:
017ff1
 		arg = strdelim(&cp;;
017ff1
 		if (!arg || *arg == '\0')
017ff1
@@ -1824,6 +1833,7 @@ copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
017ff1
 	M_CP_INTOPT(ip_qos_interactive);
017ff1
 	M_CP_INTOPT(ip_qos_bulk);
017ff1
 	M_CP_INTOPT(use_kuserok);
017ff1
+	M_CP_INTOPT(enable_k5users);
017ff1
 	M_CP_INTOPT(rekey_limit);
017ff1
 	M_CP_INTOPT(rekey_interval);
017ff1
 
017ff1
@@ -2076,6 +2086,7 @@ dump_config(ServerOptions *o)
017ff1
 	dump_cfg_fmtint(sAllowTcpForwarding, o->allow_tcp_forwarding);
017ff1
 	dump_cfg_fmtint(sUsePrivilegeSeparation, use_privsep);
017ff1
 	dump_cfg_fmtint(sKerberosUseKuserok, o->use_kuserok);
017ff1
+	dump_cfg_fmtint(sGssEnablek5users, o->enable_k5users);
017ff1
 
017ff1
 	/* string arguments */
017ff1
 	dump_cfg_string(sPidFile, o->pid_file);
017ff1
diff --git a/servconf.h b/servconf.h
017ff1
index 5117dfa..d63cb71 100644
017ff1
--- a/servconf.h
017ff1
+++ b/servconf.h
017ff1
@@ -173,7 +173,8 @@ typedef struct {
017ff1
 
017ff1
 	int	num_permitted_opens;
017ff1
 
017ff1
-	int	use_kuserok;
017ff1
+	int		use_kuserok;
017ff1
+	int		enable_k5users;
017ff1
 	char   *chroot_directory;
017ff1
 	char   *revoked_keys_file;
017ff1
 	char   *trusted_user_ca_keys;
017ff1
diff --git a/sshd_config b/sshd_config
017ff1
index 43671f6..6ab00ed 100644
017ff1
--- a/sshd_config
017ff1
+++ b/sshd_config
017ff1
@@ -94,6 +94,7 @@ GSSAPIAuthentication yes
017ff1
 GSSAPICleanupCredentials no
017ff1
 #GSSAPIStrictAcceptorCheck yes
017ff1
 #GSSAPIKeyExchange no
017ff1
+#GSSAPIEnablek5users no
017ff1
 
017ff1
 # Set this to 'yes' to enable PAM authentication, account processing,
017ff1
 # and session processing. If this is enabled, PAM authentication will
017ff1
diff --git a/sshd_config.5 b/sshd_config.5
017ff1
index e0e5fff..aa9525d 100644
017ff1
--- a/sshd_config.5
017ff1
+++ b/sshd_config.5
017ff1
@@ -505,6 +505,12 @@ on logout.
017ff1
 The default is
017ff1
 .Dq yes .
017ff1
 Note that this option applies to protocol version 2 only.
017ff1
+.It Cm GSSAPIEnablek5users
017ff1
+Specifies whether to look at .k5users file for GSSAPI authentication
017ff1
+access control. Further details are described in
017ff1
+.Xr ksu 1 .
017ff1
+The default is
017ff1
+.Dq no .
017ff1
 .It Cm GSSAPIStrictAcceptorCheck
017ff1
 Determines whether to be strict about the identity of the GSSAPI acceptor 
017ff1
 a client authenticates against. If