kentpeacock / rpms / openssh

Forked from rpms/openssh 2 years ago
Clone
aedd00
diff -up openssh-6.8p1/HOWTO.ldap-keys.ldap openssh-6.8p1/HOWTO.ldap-keys
aedd00
--- openssh-6.8p1/HOWTO.ldap-keys.ldap	2015-03-18 11:11:29.029801467 +0100
aedd00
+++ openssh-6.8p1/HOWTO.ldap-keys	2015-03-18 11:11:29.029801467 +0100
aedd00
@@ -0,0 +1,122 @@
aedd00
+
aedd00
+HOW TO START
aedd00
+
aedd00
+1) configure LDAP server
aedd00
+  * Use LDAP server documentation
aedd00
+2) add appropriate LDAP schema
aedd00
+  * For OpenLDAP or SunONE Use attached schema, otherwise you have to create it. 
aedd00
+  * LDAP user entry
aedd00
+        User entry:
aedd00
+	- attached to the 'ldapPublicKey' objectclass
aedd00
+	- attached to the 'posixAccount' objectclass
aedd00
+	- with a filled 'sshPublicKey' attribute 
aedd00
+3) insert users into LDAP
aedd00
+  * Use LDAP Tree management tool as useful
aedd00
+  * Entry in the LDAP server must respect 'posixAccount' and 'ldapPublicKey' which are defined in core.schema and the additionnal lpk.schema.
aedd00
+  * Example:
aedd00
+	dn: uid=captain,ou=commanders,dc=enterprise,dc=universe
aedd00
+	objectclass: top
aedd00
+	objectclass: person
aedd00
+	objectclass: organizationalPerson
aedd00
+	objectclass: posixAccount
aedd00
+	objectclass: ldapPublicKey
aedd00
+	description: Jonathan Archer
aedd00
+	userPassword: Porthos
aedd00
+	cn: onathan Archer
aedd00
+	sn: onathan Archer
aedd00
+	uid: captain
aedd00
+	uidNumber: 1001
aedd00
+	gidNumber: 1001
aedd00
+	homeDirectory: /home/captain
aedd00
+	sshPublicKey: ssh-rss AAAAB3.... =captain@universe
aedd00
+	sshPublicKey: command="kill -9 1" ssh-rss AAAAM5...
aedd00
+4) on the ssh side set in sshd_config
aedd00
+  * Set up the backend
aedd00
+	AuthorizedKeysCommand /usr/libexec/openssh/ssh-ldap-wrapper
aedd00
+	AuthorizedKeysCommandUser <appropriate user to run LDAP>
aedd00
+  * Do not forget to set
aedd00
+	PubkeyAuthentication yes
aedd00
+  * Swith off unnecessary auth methods
aedd00
+5) confugure ldap.conf
aedd00
+  * Default ldap.conf is placed in /etc/ssh
aedd00
+  * The configuration style is the same as other ldap based aplications
aedd00
+6) if necessary edit ssh-ldap-wrapper
aedd00
+  * There is a possibility to change ldap.conf location
aedd00
+  * There are some debug options
aedd00
+  * Example
aedd00
+	/usr/libexec/openssh -s -f /etc/ldap.conf -w -d >> /tmp/ldapdebuglog.txt
aedd00
+7) Configure SELinux boolean which allows ldap-helper to bind ldap server
aedd00
+  Run this command
aedd00
+  # setsebool -P authlogin_nsswitch_use_ldap on
aedd00
+
aedd00
+HOW TO MIGRATE FROM LPK
aedd00
+
aedd00
+1) goto HOW TO START 4) .... the ldap schema is the same
aedd00
+
aedd00
+2) convert the group requests to the appropriate LDAP requests
aedd00
+
aedd00
+HOW TO SOLVE PROBLEMS
aedd00
+
aedd00
+1) use debug in sshd
aedd00
+  * /usr/sbin/sshd -d -d -d -d
aedd00
+2) use debug in ssh-ldap-helper
aedd00
+  * ssh-ldap-helper -d -d -d -d -s <username>
aedd00
+3) use tcpdump ... other ldap client etc.
aedd00
+
aedd00
+HOW TO CONFIGURE SSH FOR OTHER LDAP CONFIGURATION / SERVER /SCHEMA
aedd00
+
aedd00
+You can adjust search format string in /etc/ldap.conf using
aedd00
+ 1) SSH_Filter option to limit results for only specified users
aedd00
+    (this appends search condition after original query)
aedd00
+ 2) Search_Format option to define your own search string using expansion
aedd00
+    characters %u for username, %c for objectclass and %f for above mentioned filter.
aedd00
+
aedd00
+Example:
aedd00
+Search_Format (&(objectclass=posixAccount)(objectclass=ldapPublicKey)(uid=%u)%f)
aedd00
+
aedd00
+ADVANTAGES
aedd00
+
aedd00
+1) Blocking an user account can be done directly from LDAP (if sshd is using PubkeyAuthentication + AuthorizedKeysCommand with ldap only).
aedd00
+
aedd00
+DISADVANTAGES
aedd00
+
aedd00
+1)  LDAP must be well configured, getting the public key of some user is not a problem, but if anonymous LDAP 
aedd00
+  allows write to users dn, somebody could replace some user's public key by his own and impersonate some 
aedd00
+  of your users in all your server farm -- be VERY CAREFUL.
aedd00
+2) With incomplete PKI the MITM attack when sshd is requesting the public key, could lead to a compromise of your servers allowing login 
aedd00
+  as the impersonated user.
aedd00
+3) If LDAP server is down there may be no fallback on passwd auth.
aedd00
+  
aedd00
+MISC.
aedd00
+  
aedd00
+1) todo
aedd00
+  * Possibility to reuse the ssh-ldap-helper.
aedd00
+  * Tune the LDAP part to accept  all possible LDAP configurations.
aedd00
+
aedd00
+2) differences from original lpk
aedd00
+  * No LDAP code in sshd.
aedd00
+  * Support for various LDAP platforms and configurations.
aedd00
+  * LDAP is configured in separate ldap.conf file.
aedd00
+
aedd00
+3) docs/link 
aedd00
+  * http://pacsec.jp/core05/psj05-barisani-en.pdf
aedd00
+  * http://fritz.potsdam.edu/projects/openssh-lpk/
aedd00
+  * http://fritz.potsdam.edu/projects/sshgate/
aedd00
+  * http://dev.inversepath.com/trac/openssh-lpk
aedd00
+  * http://lam.sf.net/ ( http://lam.sourceforge.net/documentation/supportedSchemas.htm )
aedd00
+
aedd00
+4) contributors/ideas/greets
aedd00
+  - Eric AUGE <eau@phear.org>
aedd00
+  - Andrea Barisani <andrea@inversepath.com>
aedd00
+  - Falk Siemonsmeier.
aedd00
+  - Jacob Rief.
aedd00
+  - Michael Durchgraf.
aedd00
+  - frederic peters.
aedd00
+  - Finlay dobbie.
aedd00
+  - Stefan Fisher.
aedd00
+  - Robin H. Johnson.
aedd00
+  - Adrian Bridgett.
aedd00
+
aedd00
+5) Author
aedd00
+    Jan F. Chadima <jchadima@redhat.com>
aedd00
+
aedd00
diff -up openssh-6.8p1/Makefile.in.ldap openssh-6.8p1/Makefile.in
aedd00
--- openssh-6.8p1/Makefile.in.ldap	2015-03-17 06:49:20.000000000 +0100
aedd00
+++ openssh-6.8p1/Makefile.in	2015-03-18 11:13:10.147561177 +0100
aedd00
@@ -25,6 +25,8 @@ SSH_PROGRAM=@bindir@/ssh
aedd00
 ASKPASS_PROGRAM=$(libexecdir)/ssh-askpass
aedd00
 SFTP_SERVER=$(libexecdir)/sftp-server
aedd00
 SSH_KEYSIGN=$(libexecdir)/ssh-keysign
aedd00
+SSH_LDAP_HELPER=$(libexecdir)/ssh-ldap-helper
aedd00
+SSH_LDAP_WRAPPER=$(libexecdir)/ssh-ldap-wrapper
aedd00
 SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper
aedd00
 PRIVSEP_PATH=@PRIVSEP_PATH@
aedd00
 SSH_PRIVSEP_USER=@SSH_PRIVSEP_USER@
aedd00
@@ -50,6 +50,7 @@
aedd00
 CFLAGS=@CFLAGS@
aedd00
 CPPFLAGS=-I. -I$(srcdir) @CPPFLAGS@ $(PATHS) @DEFS@
aedd00
 LIBS=@LIBS@
aedd00
+LDAPLIBS=@LDAPLIBS@
aedd00
 K5LIBS=@K5LIBS@
aedd00
 GSSLIBS=@GSSLIBS@
aedd00
 SSHLIBS=@SSHLIBS@
aedd00
@@ -61,8 +63,9 @@ XAUTH_PATH=@XAUTH_PATH@
aedd00
 EXEEXT=@EXEEXT@
aedd00
 MANFMT=@MANFMT@
aedd00
 MKDIR_P=@MKDIR_P@
aedd00
+INSTALL_SSH_LDAP_HELPER=@INSTALL_SSH_LDAP_HELPER@
aedd00
 
aedd00
-TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT)
aedd00
+TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-ldap-helper$(EXEEXT)
aedd00
 
aedd00
 XMSS_OBJS=\
aedd00
 	ssh-xmss.o \
aedd00
@@ -112,8 +115,8 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passw
aedd00
 	sandbox-seccomp-filter.o sandbox-capsicum.o sandbox-pledge.o \
aedd00
 	sandbox-solaris.o uidswap.o
aedd00
 
aedd00
-MANPAGES	= moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-keysign.8.out ssh-pkcs11-helper.8.out sshd_config.5.out ssh_config.5.out
aedd00
-MANPAGES_IN	= moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-keysign.8 ssh-pkcs11-helper.8 sshd_config.5 ssh_config.5
aedd00
+MANPAGES	= moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-keysign.8.out ssh-pkcs11-helper.8.out sshd_config.5.out ssh_config.5.out ssh-ldap-helper.8.out ssh-ldap.conf.5.out
aedd00
+MANPAGES_IN	= moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-keysign.8 ssh-pkcs11-helper.8 sshd_config.5 ssh_config.5 ssh-ldap-helper.8 ssh-ldap.conf.5
aedd00
 MANTYPE		= @MANTYPE@
aedd00
 
aedd00
 CONFIGFILES=sshd_config.out ssh_config.out moduli.out
aedd00
@@ -184,6 +187,9 @@ ssh-keysign$(EXEEXT): $(LIBCOMPAT) libss
aedd00
 ssh-pkcs11-helper$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-pkcs11-helper.o ssh-pkcs11.o
aedd00
 	$(LD) -o $@ ssh-pkcs11-helper.o ssh-pkcs11.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
aedd00
 
aedd00
+ssh-ldap-helper$(EXEEXT): $(LIBCOMPAT) libssh.a ldapconf.o ldapbody.o ldapmisc.o ldap-helper.o
aedd00
+	$(LD) -o $@ ldapconf.o ldapbody.o ldapmisc.o ldap-helper.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS) $(LDAPLIBS)
aedd00
+
aedd00
 ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keyscan.o
aedd00
 	$(LD) -o $@ ssh-keyscan.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
aedd00
 
aedd00
@@ -311,6 +317,10 @@ install-files:
aedd00
 	$(INSTALL) -m 0755 $(STRIP_OPT) sshd$(EXEEXT) $(DESTDIR)$(sbindir)/sshd$(EXEEXT)
aedd00
 	$(INSTALL) -m 4711 $(STRIP_OPT) ssh-keysign$(EXEEXT) $(DESTDIR)$(SSH_KEYSIGN)$(EXEEXT)
aedd00
 	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-pkcs11-helper$(EXEEXT) $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT)
aedd00
+	if test ! -z "$(INSTALL_SSH_LDAP_HELPER)" ; then \
aedd00
+		$(INSTALL) -m 0700 $(STRIP_OPT) ssh-ldap-helper $(DESTDIR)$(SSH_LDAP_HELPER) ; \
aedd00
+		$(INSTALL) -m 0700 ssh-ldap-wrapper $(DESTDIR)$(SSH_LDAP_WRAPPER) ; \
aedd00
+	fi
aedd00
 	$(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT)
aedd00
 	$(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
aedd00
 	$(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
aedd00
@@ -327,6 +337,10 @@ install-files:
aedd00
 	$(INSTALL) -m 644 sftp-server.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8
aedd00
 	$(INSTALL) -m 644 ssh-keysign.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8
aedd00
 	$(INSTALL) -m 644 ssh-pkcs11-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8
aedd00
+	if test ! -z "$(INSTALL_SSH_LDAP_HELPER)" ; then \
aedd00
+		$(INSTALL) -m 644 ssh-ldap-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-ldap-helper.8 ; \
aedd00
+		$(INSTALL) -m 644 ssh-ldap.conf.5.out $(DESTDIR)$(mandir)/$(mansubdir)5/ssh-ldap.conf.5 ; \
aedd00
+	fi
aedd00
 
aedd00
 install-sysconf:
aedd00
 	$(MKDIR_P) $(DESTDIR)$(sysconfdir)
aedd00
@@ -356,6 +370,13 @@ install-sysconf:
aedd00
 	else \
aedd00
 		echo "$(DESTDIR)$(sysconfdir)/moduli already exists, install will not overwrite"; \
aedd00
 	fi
aedd00
+	if test ! -z "$(INSTALL_SSH_LDAP_HELPER)" ; then \
aedd00
+		if [ ! -f $(DESTDIR)$(sysconfdir)/ldap.conf ]; then \
aedd00
+			$(INSTALL) -m 644 ldap.conf $(DESTDIR)$(sysconfdir)/ldap.conf; \
aedd00
+		else \
aedd00
+			echo "$(DESTDIR)$(sysconfdir)/ldap.conf already exists, install will not overwrite"; \
aedd00
+		fi ; \
aedd00
+	fi
aedd00
 
aedd00
 host-key: ssh-keygen$(EXEEXT)
aedd00
 	@if [ -z "$(DESTDIR)" ] ; then \
aedd00
@@ -419,6 +440,8 @@ uninstall:
aedd00
 	-rm -r $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
aedd00
 	-rm -f $(DESTDIR)$(SSH_KEYSIGN)$(EXEEXT)
aedd00
 	-rm -f $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT)
aedd00
+	-rm -f $(DESTDIR)$(SSH_LDAP_HELPER)$(EXEEXT)
aedd00
+	-rm -f $(DESTDIR)$(SSH_LDAP_WRAPPER)$(EXEEXT)
aedd00
 	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
aedd00
 	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/scp.1
aedd00
 	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-add.1
aedd00
@@ -430,6 +453,7 @@ uninstall:
aedd00
 	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8
aedd00
 	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8
aedd00
 	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8
aedd00
+	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-ldap-helper.8
aedd00
 
aedd00
 regress-prep:
aedd00
 	$(MKDIR_P) `pwd`/regress/unittests/test_helper
aedd00
diff -up openssh-6.8p1/configure.ac.ldap openssh-6.8p1/configure.ac
aedd00
--- openssh-6.8p1/configure.ac.ldap	2015-03-17 06:49:20.000000000 +0100
aedd00
+++ openssh-6.8p1/configure.ac	2015-03-18 11:11:29.030801464 +0100
aedd00
@@ -1605,6 +1605,110 @@ if test "x$use_pie" != "xno"; then
aedd00
 	fi
aedd00
 fi
aedd00
 
aedd00
+# Check whether user wants LDAP support
aedd00
+LDAP_MSG="no"
aedd00
+INSTALL_SSH_LDAP_HELPER=""
aedd00
+AC_ARG_WITH(ldap,
aedd00
+	[  --with-ldap[[=PATH]]      Enable LDAP pubkey support (optionally in PATH)],
aedd00
+	[
aedd00
+		if test "x$withval" != "xno" ; then
aedd00
+
aedd00
+			INSTALL_SSH_LDAP_HELPER="yes"
aedd00
+			CPPFLAGS="$CPPFLAGS -DLDAP_DEPRECATED"
aedd00
+
aedd00
+			if test "x$withval" != "xyes" ; then
aedd00
+				CPPFLAGS="$CPPFLAGS -I${withval}/include"
aedd00
+				LDFLAGS="$LDFLAGS -L${withval}/lib"
aedd00
+			fi
aedd00
+
aedd00
+			AC_DEFINE([WITH_LDAP_PUBKEY], 1, [Enable LDAP pubkey support])
aedd00
+			LDAP_MSG="yes"
aedd00
+
aedd00
+			AC_CHECK_HEADERS(lber.h)
aedd00
+			AC_CHECK_HEADERS(ldap.h, , AC_MSG_ERROR(could not locate <ldap.h>))
aedd00
+			AC_CHECK_HEADERS(ldap_ssl.h)
aedd00
+
aedd00
+			AC_ARG_WITH(ldap-lib,
aedd00
+				[  --with-ldap-lib=type    select ldap library [auto|netscape5|netscape4|netscape3|umich|openldap]])
aedd00
+
aedd00
+			if test -z "$with_ldap_lib"; then
aedd00
+				with_ldap_lib=auto
aedd00
+			fi
aedd00
+
aedd00
+			if test -z "$found_ldap_lib" -a \( $with_ldap_lib = auto -o $with_ldap_lib = umich -o $with_ldap_lib = openldap \); then
aedd00
+				AC_CHECK_LIB(lber, main, LDAPLIBS="-llber $LDAPLIBS" found_ldap_lib=yes)
aedd00
+				AC_CHECK_LIB(ldap, main, LDAPLIBS="-lldap $LDAPLIBS" found_ldap_lib=yes)
aedd00
+			fi
aedd00
+
aedd00
+			if test -z "$found_ldap_lib" -a \( $with_ldap_lib = auto -o $with_ldap_lib = netscape5 \); then
aedd00
+				AC_CHECK_LIB(ldap50, main, LDAPLIBS="-lldap50 -lssldap50 -lssl3 -lnss3 -lnspr4 -lprldap50 -lplc4 -lplds4 $LDAPLIBS" found_ldap_lib=yes)
aedd00
+			fi
aedd00
+
aedd00
+			if test -z "$found_ldap_lib" -a \( $with_ldap_lib = auto -o $with_ldap_lib = netscape4 \); then
aedd00
+				AC_CHECK_LIB(ldapssl41, main, LDAPLIBS="-lldapssl41 -lplc3 -lplds3 -lnspr3 $LDAPLIBS" found_ldap_lib=yes)
aedd00
+				if test -z "$found_ldap_lib"; then
aedd00
+					AC_CHECK_LIB(ldapssl40, main, LDAPLIBS="-lldapssl40 $LDAPLIBS" found_ldap_lib=yes)
aedd00
+				fi
aedd00
+				if test -z "$found_ldap_lib"; then
aedd00
+					AC_CHECK_LIB(ldap41, main, LDAPLIBS="-lldap41 $LDAPLIBS" found_ldap_lib=yes)
aedd00
+				fi
aedd00
+				if test -z "$found_ldap_lib"; then
aedd00
+					AC_CHECK_LIB(ldap40, main, LDAPLIBS="-lldap40 $LDAPLIBS" found_ldap_lib=yes)
aedd00
+				fi
aedd00
+			fi
aedd00
+
aedd00
+			if test -z "$found_ldap_lib" -a \( $with_ldap_lib = auto -o $with_ldap_lib = netscape3 \); then
aedd00
+				AC_CHECK_LIB(ldapssl30, main, LDAPLIBS="-lldapssl30 $LDAPLIBS" found_ldap_lib=yes)
aedd00
+			fi
aedd00
+
aedd00
+			if test -z "$found_ldap_lib"; then
aedd00
+				AC_MSG_ERROR(could not locate a valid LDAP library)
aedd00
+			fi
aedd00
+
aedd00
+			saved_LIBS="$LIBS"
aedd00
+			LIBS="$LIBS $LDAPLIBS"
aedd00
+			AC_MSG_CHECKING([for working LDAP support])
aedd00
+			AC_TRY_COMPILE(
aedd00
+				[#include <sys/types.h>
aedd00
+				 #include <ldap.h>],
aedd00
+				[(void)ldap_init(0, 0);],
aedd00
+				[AC_MSG_RESULT(yes)],
aedd00
+				[
aedd00
+				    AC_MSG_RESULT(no) 
aedd00
+					AC_MSG_ERROR([** Incomplete or missing ldap libraries **])
aedd00
+				])
aedd00
+			AC_CHECK_FUNCS( \
aedd00
+				ldap_init \
aedd00
+				ldap_get_lderrno \
aedd00
+				ldap_set_lderrno \
aedd00
+				ldap_parse_result \
aedd00
+				ldap_memfree \
aedd00
+				ldap_controls_free \
aedd00
+				ldap_set_option \
aedd00
+				ldap_get_option \
aedd00
+				ldapssl_init \
aedd00
+				ldap_start_tls_s \
aedd00
+				ldap_pvt_tls_set_option \
aedd00
+				ldap_initialize \
aedd00
+			)
aedd00
+			AC_CHECK_FUNCS(ldap_set_rebind_proc,
aedd00
+				AC_MSG_CHECKING([number arguments of ldap_set_rebind_proc])
aedd00
+				AC_TRY_COMPILE(
aedd00
+					[#include <lber.h>
aedd00
+					#include <ldap.h>],
aedd00
+					[ldap_set_rebind_proc(0, 0, 0);],
aedd00
+					[ac_cv_ldap_set_rebind_proc=3],
aedd00
+					[ac_cv_ldap_set_rebind_proc=2])
aedd00
+				AC_MSG_RESULT($ac_cv_ldap_set_rebind_proc)
aedd00
+				AC_DEFINE_UNQUOTED(LDAP_SET_REBIND_PROC_ARGS, $ac_cv_ldap_set_rebind_proc, [number arguments of ldap_set_rebind_proc])
aedd00
+			)
aedd00
+			LIBS="$saved_LIBS"
aedd00
+		fi
aedd00
+	]
aedd00
+)
aedd00
+AC_SUBST(INSTALL_SSH_LDAP_HELPER)
aedd00
+AC_SUBST(LDAPLIBS)
aedd00
+
aedd00
 dnl    Checks for library functions. Please keep in alphabetical order
aedd00
 AC_CHECK_FUNCS([ \
aedd00
 	Blowfish_initstate \
aedd00
@@ -5227,6 +5352,9 @@
aedd00
 echo "Preprocessor flags: ${CPPFLAGS}"
aedd00
 echo "      Linker flags: ${LDFLAGS}"
aedd00
 echo "         Libraries: ${LIBS}"
aedd00
+if test ! -z "${LDAPLIBS}"; then
aedd00
+echo "         +for ldap: ${LDAPLIBS}"
aedd00
+fi
aedd00
 if test ! -z "${SSHDLIBS}"; then
aedd00
 echo "         +for sshd: ${SSHDLIBS}"
aedd00
 fi
aedd00
diff -up openssh-6.8p1/ldap-helper.c.ldap openssh-6.8p1/ldap-helper.c
aedd00
--- openssh-6.8p1/ldap-helper.c.ldap	2015-03-18 11:11:29.030801464 +0100
aedd00
+++ openssh-6.8p1/ldap-helper.c	2015-03-18 11:11:29.030801464 +0100
aedd00
@@ -0,0 +1,151 @@
aedd00
+/* $OpenBSD: ssh-pka-ldap.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
aedd00
+/*
aedd00
+ * Copyright (c) 2009 Jan F. Chadima.  All rights reserved.
aedd00
+ *
aedd00
+ * Redistribution and use in source and binary forms, with or without
aedd00
+ * modification, are permitted provided that the following conditions
aedd00
+ * are met:
aedd00
+ * 1. Redistributions of source code must retain the above copyright
aedd00
+ *    notice, this list of conditions and the following disclaimer.
aedd00
+ * 2. Redistributions in binary form must reproduce the above copyright
aedd00
+ *    notice, this list of conditions and the following disclaimer in the
aedd00
+ *    documentation and/or other materials provided with the distribution.
aedd00
+ *
aedd00
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
aedd00
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
aedd00
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
aedd00
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
aedd00
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
aedd00
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
aedd00
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
aedd00
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
aedd00
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
aedd00
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
aedd00
+ */
aedd00
+
aedd00
+#include "ldapincludes.h"
aedd00
+#include "log.h"
aedd00
+#include "misc.h"
aedd00
+#include "xmalloc.h"
aedd00
+#include "ldapconf.h"
aedd00
+#include "ldapbody.h"
aedd00
+#include <string.h>
aedd00
+#include <unistd.h>
aedd00
+#include <stdlib.h>
aedd00
+
aedd00
+static int config_debug = 0;
aedd00
+int config_exclusive_config_file = 0;
aedd00
+static char *config_file_name = "/etc/ssh/ldap.conf";
aedd00
+static char *config_single_user = NULL;
aedd00
+static int config_verbose = SYSLOG_LEVEL_VERBOSE;
aedd00
+int config_warning_config_file = 0;
aedd00
+extern char *__progname;
aedd00
+
aedd00
+static void
aedd00
+usage(void)
aedd00
+{
aedd00
+	fprintf(stderr, "usage: %s [options]\n",
aedd00
+	    __progname);
aedd00
+	fprintf(stderr, "Options:\n");
aedd00
+	fprintf(stderr, "  -d          Output the log messages to stderr.\n");
aedd00
+	fprintf(stderr, "  -e          Check the config file for unknown commands.\n");
aedd00
+	fprintf(stderr, "  -f file     Use alternate config file (default is /etc/ssh/ldap.conf).\n");
aedd00
+	fprintf(stderr, "  -s user     Do not demonize, send the user's key to stdout.\n");
aedd00
+	fprintf(stderr, "  -v          Increase verbosity of the debug output (implies -d).\n");
aedd00
+	fprintf(stderr, "  -w          Warn on unknown commands in the config file.\n");
aedd00
+	exit(1);
aedd00
+}
aedd00
+
aedd00
+/*
aedd00
+ * Main program for the ssh pka ldap agent.
aedd00
+ */
aedd00
+
aedd00
+int
aedd00
+main(int ac, char **av)
aedd00
+{
aedd00
+	int opt;
aedd00
+	FILE *outfile = NULL;
aedd00
+
aedd00
+	__progname = ssh_get_progname(av[0]);
aedd00
+
aedd00
+	log_init(__progname, SYSLOG_LEVEL_DEBUG3, SYSLOG_FACILITY_AUTH, 0);
aedd00
+
aedd00
+	/*
aedd00
+	 * Initialize option structure to indicate that no values have been
aedd00
+	 * set.
aedd00
+	 */
aedd00
+	initialize_options();
aedd00
+
aedd00
+	/* Parse command-line arguments. */
aedd00
+	while ((opt = getopt(ac, av, "def:s:vw")) != -1) {
aedd00
+		switch (opt) {
aedd00
+		case 'd':
aedd00
+			config_debug = 1;
aedd00
+			break;
aedd00
+
aedd00
+		case 'e':
aedd00
+			config_exclusive_config_file = 1;
aedd00
+			config_warning_config_file = 1;
aedd00
+			break;
aedd00
+
aedd00
+		case 'f':
aedd00
+			config_file_name = optarg;
aedd00
+			break;
aedd00
+
aedd00
+		case 's':
aedd00
+			config_single_user = optarg;
aedd00
+			outfile = fdopen (dup (fileno (stdout)), "w");
aedd00
+			break;
aedd00
+
aedd00
+		case 'v':
aedd00
+			config_debug = 1;
aedd00
+			if (config_verbose < SYSLOG_LEVEL_DEBUG3)
aedd00
+			    config_verbose++;
aedd00
+			break;
aedd00
+
aedd00
+		case 'w':
aedd00
+			config_warning_config_file = 1;
aedd00
+			break;
aedd00
+
aedd00
+		case '?':
aedd00
+		default:
aedd00
+			usage();
aedd00
+			break;
aedd00
+		}
aedd00
+	}
aedd00
+
aedd00
+	/* Initialize loging */
aedd00
+	log_init(__progname, config_verbose, SYSLOG_FACILITY_AUTH, config_debug);
aedd00
+
aedd00
+	if (ac != optind)
aedd00
+	    fatal ("illegal extra parameter %s", av[1]);
aedd00
+
aedd00
+	/* Ensure that fds 0 and 2 are open or directed to /dev/null */
aedd00
+	if (config_debug == 0)
aedd00
+	    sanitise_stdfd();
aedd00
+
aedd00
+	/* Read config file */
aedd00
+	read_config_file(config_file_name);
aedd00
+	fill_default_options();
aedd00
+	if (config_verbose == SYSLOG_LEVEL_DEBUG3) {
aedd00
+		debug3 ("=== Configuration ===");
aedd00
+		dump_config();
aedd00
+		debug3 ("=== *** ===");
aedd00
+	}
aedd00
+
aedd00
+	ldap_checkconfig();
aedd00
+	ldap_do_connect();
aedd00
+
aedd00
+	if (config_single_user) {
aedd00
+		process_user (config_single_user, outfile);
aedd00
+	} else {
aedd00
+		usage();
aedd00
+		fatal ("Not yet implemented");
aedd00
+/* TODO
aedd00
+ * open unix socket a run the loop on it
aedd00
+ */
aedd00
+	}
aedd00
+
aedd00
+	ldap_do_close();
aedd00
+	return 0;
aedd00
+}
aedd00
diff -up openssh-6.8p1/ldap-helper.h.ldap openssh-6.8p1/ldap-helper.h
aedd00
--- openssh-6.8p1/ldap-helper.h.ldap	2015-03-18 11:11:29.031801462 +0100
aedd00
+++ openssh-6.8p1/ldap-helper.h	2015-03-18 11:11:29.031801462 +0100
aedd00
@@ -0,0 +1,32 @@
aedd00
+/* $OpenBSD: ldap-helper.h,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
aedd00
+/*
aedd00
+ * Copyright (c) 2009 Jan F. Chadima.  All rights reserved.
aedd00
+ *
aedd00
+ * Redistribution and use in source and binary forms, with or without
aedd00
+ * modification, are permitted provided that the following conditions
aedd00
+ * are met:
aedd00
+ * 1. Redistributions of source code must retain the above copyright
aedd00
+ *    notice, this list of conditions and the following disclaimer.
aedd00
+ * 2. Redistributions in binary form must reproduce the above copyright
aedd00
+ *    notice, this list of conditions and the following disclaimer in the
aedd00
+ *    documentation and/or other materials provided with the distribution.
aedd00
+ *
aedd00
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
aedd00
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
aedd00
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
aedd00
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
aedd00
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
aedd00
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
aedd00
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
aedd00
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
aedd00
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
aedd00
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
aedd00
+ */
aedd00
+
aedd00
+#ifndef LDAP_HELPER_H
aedd00
+#define LDAP_HELPER_H
aedd00
+
aedd00
+extern int config_exclusive_config_file;
aedd00
+extern int config_warning_config_file;
aedd00
+
aedd00
+#endif /* LDAP_HELPER_H */
aedd00
diff -up openssh-6.8p1/ldap.conf.ldap openssh-6.8p1/ldap.conf
aedd00
--- openssh-6.8p1/ldap.conf.ldap	2015-03-18 11:11:29.031801462 +0100
aedd00
+++ openssh-6.8p1/ldap.conf	2015-03-18 11:11:29.031801462 +0100
aedd00
@@ -0,0 +1,95 @@
aedd00
+# $Id: openssh-5.5p1-ldap.patch,v 1.3 2010/07/07 13:48:36 jfch2222 Exp $
aedd00
+#
aedd00
+# This is the example configuration file for the OpenSSH
aedd00
+# LDAP backend
aedd00
+# 
aedd00
+# see ssh-ldap.conf(5)
aedd00
+#
aedd00
+
aedd00
+# URI with your LDAP server name. This allows to use
aedd00
+# Unix Domain Sockets to connect to a local LDAP Server.
aedd00
+#uri ldap://127.0.0.1/
aedd00
+#uri ldaps://127.0.0.1/   
aedd00
+#uri ldapi://%2fvar%2frun%2fldapi_sock/
aedd00
+# Note: %2f encodes the '/' used as directory separator
aedd00
+
aedd00
+# Another way to specify your LDAP server is to provide an
aedd00
+# host name and the port of our LDAP server. Host name
aedd00
+# must be resolvable without using LDAP.
aedd00
+# Multiple hosts may be specified, each separated by a 
aedd00
+# space. How long nss_ldap takes to failover depends on
aedd00
+# whether your LDAP client library supports configurable
aedd00
+# network or connect timeouts (see bind_timelimit).
aedd00
+#host 127.0.0.1
aedd00
+
aedd00
+# The port.
aedd00
+# Optional: default is 389.
aedd00
+#port 389
aedd00
+
aedd00
+# The distinguished name to bind to the server with.
aedd00
+# Optional: default is to bind anonymously.
aedd00
+#binddn cn=openssh_keys,dc=example,dc=org
aedd00
+
aedd00
+# The credentials to bind with. 
aedd00
+# Optional: default is no credential.
aedd00
+#bindpw TopSecret
aedd00
+
aedd00
+# The distinguished name of the search base.
aedd00
+#base dc=example,dc=org
aedd00
+
aedd00
+# The LDAP version to use (defaults to 3
aedd00
+# if supported by client library)
aedd00
+#ldap_version 3
aedd00
+
aedd00
+# The search scope.
aedd00
+#scope sub
aedd00
+#scope one
aedd00
+#scope base
aedd00
+
aedd00
+# Search timelimit
aedd00
+#timelimit 30
aedd00
+
aedd00
+# Bind/connect timelimit
aedd00
+#bind_timelimit 30
aedd00
+
aedd00
+# Reconnect policy: hard (default) will retry connecting to
aedd00
+# the software with exponential backoff, soft will fail
aedd00
+# immediately.
aedd00
+#bind_policy hard
aedd00
+
aedd00
+# SSL setup, may be implied by URI also.
aedd00
+#ssl no
aedd00
+#ssl on
aedd00
+#ssl start_tls
aedd00
+
aedd00
+# OpenLDAP SSL options
aedd00
+# Require and verify server certificate (yes/no)
aedd00
+# Default is to use libldap's default behavior, which can be configured in
aedd00
+# /etc/openldap/ldap.conf using the TLS_REQCERT setting.  The default for
aedd00
+# OpenLDAP 2.0 and earlier is "no", for 2.1 and later is "yes".
aedd00
+#tls_checkpeer hard
aedd00
+
aedd00
+# CA certificates for server certificate verification
aedd00
+# At least one of these are required if tls_checkpeer is "yes"
aedd00
+#tls_cacertfile /etc/ssl/ca.cert
aedd00
+#tls_cacertdir /etc/pki/tls/certs
aedd00
+
aedd00
+# Seed the PRNG if /dev/urandom is not provided
aedd00
+#tls_randfile /var/run/egd-pool
aedd00
+
aedd00
+# SSL cipher suite
aedd00
+# See man ciphers for syntax
aedd00
+#tls_ciphers TLSv1
aedd00
+
aedd00
+# Client certificate and key
aedd00
+# Use these, if your server requires client authentication.
aedd00
+#tls_cert
aedd00
+#tls_key
aedd00
+
aedd00
+# OpenLDAP search_format
aedd00
+# format used to search for users in LDAP directory using substitution
aedd00
+# for %u for user name and %f for SSH_Filter option (optional, empty by default)
aedd00
+#search_format (&(objectclass=%c)(objectclass=ldapPublicKey)(uid=%u)%f)
aedd00
+
aedd00
+#AccountClass posixAccount
aedd00
+
aedd00
diff -up openssh-6.8p1/ldapbody.c.ldap openssh-6.8p1/ldapbody.c
aedd00
--- openssh-6.8p1/ldapbody.c.ldap	2015-03-18 11:11:29.031801462 +0100
aedd00
+++ openssh-6.8p1/ldapbody.c	2015-03-18 11:11:29.031801462 +0100
aedd00
@@ -0,0 +1,499 @@
aedd00
+/* $OpenBSD: ldapbody.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
aedd00
+/*
aedd00
+ * Copyright (c) 2009 Jan F. Chadima.  All rights reserved.
aedd00
+ *
aedd00
+ * Redistribution and use in source and binary forms, with or without
aedd00
+ * modification, are permitted provided that the following conditions
aedd00
+ * are met:
aedd00
+ * 1. Redistributions of source code must retain the above copyright
aedd00
+ *    notice, this list of conditions and the following disclaimer.
aedd00
+ * 2. Redistributions in binary form must reproduce the above copyright
aedd00
+ *    notice, this list of conditions and the following disclaimer in the
aedd00
+ *    documentation and/or other materials provided with the distribution.
aedd00
+ *
aedd00
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
aedd00
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
aedd00
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
aedd00
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
aedd00
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
aedd00
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
aedd00
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
aedd00
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
aedd00
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
aedd00
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
aedd00
+ */
aedd00
+
aedd00
+#include "ldapincludes.h"
aedd00
+#include "log.h"
aedd00
+#include "xmalloc.h"
aedd00
+#include "ldapconf.h"
aedd00
+#include "ldapmisc.h"
aedd00
+#include "ldapbody.h"
aedd00
+#include <stdio.h>
aedd00
+#include <unistd.h>
aedd00
+#include <stdlib.h>
aedd00
+#include "misc.h"
aedd00
+
aedd00
+#define LDAPSEARCH_FORMAT "(&(objectclass=%c)(objectclass=ldapPublicKey)(uid=%u)%f)"
aedd00
+#define PUBKEYATTR "sshPublicKey"
aedd00
+#define LDAP_LOGFILE	"%s/ldap.%d"
aedd00
+
aedd00
+static FILE *logfile = NULL;
aedd00
+static LDAP *ld;
aedd00
+
aedd00
+static char *attrs[] = {
aedd00
+    PUBKEYATTR,
aedd00
+    NULL
aedd00
+};
aedd00
+
aedd00
+void
aedd00
+ldap_checkconfig (void)
aedd00
+{
aedd00
+#ifdef HAVE_LDAP_INITIALIZE
aedd00
+		if (options.host == NULL && options.uri == NULL)
aedd00
+#else
aedd00
+		if (options.host == NULL)
aedd00
+#endif
aedd00
+		    fatal ("missing  \"host\" in config file");
aedd00
+}
aedd00
+
aedd00
+#if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)
aedd00
+static int
aedd00
+#if LDAP_API_VERSION > 3000
aedd00
+_rebind_proc (LDAP * ld, LDAP_CONST char *url, ber_tag_t request, ber_int_t msgid, void *params)
aedd00
+#else
aedd00
+_rebind_proc (LDAP * ld, LDAP_CONST char *url, int request, ber_int_t msgid)
aedd00
+#endif
aedd00
+{
aedd00
+	struct timeval timeout;
aedd00
+	int rc;
aedd00
+#if defined(HAVE_LDAP_PARSE_RESULT) && defined(HAVE_LDAP_CONTROLS_FREE)
aedd00
+	LDAPMessage *result;
aedd00
+#endif /* HAVE_LDAP_PARSE_RESULT && HAVE_LDAP_CONTROLS_FREE */
aedd00
+
aedd00
+	debug2 ("Doing LDAP rebind to %s", options.binddn);
aedd00
+	if (options.ssl == SSL_START_TLS) {
aedd00
+		if ((rc = ldap_start_tls_s (ld, NULL, NULL)) != LDAP_SUCCESS) {
aedd00
+			error ("ldap_starttls_s: %s", ldap_err2string (rc));
aedd00
+			return LDAP_OPERATIONS_ERROR;
aedd00
+		}
aedd00
+	}
aedd00
+
aedd00
+#if !defined(HAVE_LDAP_PARSE_RESULT) || !defined(HAVE_LDAP_CONTROLS_FREE)
aedd00
+	return ldap_simple_bind_s (ld, options.binddn, options.bindpw);
aedd00
+#else
aedd00
+	if (ldap_simple_bind(ld, options.binddn, options.bindpw) < 0)
aedd00
+	    fatal ("ldap_simple_bind %s", ldap_err2string (ldap_get_lderrno (ld, 0, 0)));
aedd00
+
aedd00
+	timeout.tv_sec = options.bind_timelimit;
aedd00
+	timeout.tv_usec = 0;
aedd00
+	result = NULL;
aedd00
+	if ((rc = ldap_result (ld, msgid, 0, &timeout, &result)) < 1) {
aedd00
+		error ("ldap_result %s", ldap_err2string (ldap_get_lderrno (ld, 0, 0)));
aedd00
+		ldap_msgfree (result);
aedd00
+		return LDAP_OPERATIONS_ERROR;
aedd00
+	}
aedd00
+	debug3 ("LDAP rebind to %s succesfull", options.binddn);
aedd00
+	return rc;
aedd00
+#endif
aedd00
+}
aedd00
+#else
aedd00
+
aedd00
+static int
aedd00
+_rebind_proc (LDAP * ld, char **whop, char **credp, int *methodp, int freeit)
aedd00
+{
aedd00
+	if (freeit)
aedd00
+	    return LDAP_SUCCESS;
aedd00
+
aedd00
+	*whop = strdup (options.binddn);
aedd00
+	*credp = strdup (options.bindpw);
aedd00
+	*methodp = LDAP_AUTH_SIMPLE;
aedd00
+	debug2 ("Doing LDAP rebind for %s", *whop);
aedd00
+	return LDAP_SUCCESS;
aedd00
+}
aedd00
+#endif
aedd00
+
aedd00
+void
aedd00
+ldap_do_connect(void)
aedd00
+{
aedd00
+	int rc, msgid, ld_errno = 0;
aedd00
+	struct timeval timeout;
aedd00
+#if defined(HAVE_LDAP_PARSE_RESULT) && defined(HAVE_LDAP_CONTROLS_FREE)
aedd00
+	int parserc;
aedd00
+	LDAPMessage *result;
aedd00
+	LDAPControl **controls;
aedd00
+	int reconnect = 0;
aedd00
+#endif /* HAVE_LDAP_PARSE_RESULT && HAVE_LDAP_CONTROLS_FREE */
aedd00
+
aedd00
+	debug ("LDAP do connect");
aedd00
+
aedd00
+retry:
aedd00
+	if (reconnect) {
aedd00
+		debug3 ("Reconnecting with ld_errno %d", ld_errno);
aedd00
+		if (options.bind_policy == 0 ||
aedd00
+		    (ld_errno != LDAP_SERVER_DOWN && ld_errno != LDAP_TIMEOUT) ||
aedd00
+			reconnect > 5)
aedd00
+			    fatal ("Cannot connect to LDAP server");
aedd00
+	
aedd00
+		if (reconnect > 1)
aedd00
+			sleep (reconnect - 1);
aedd00
+
aedd00
+		if (ld != NULL) {
aedd00
+			ldap_unbind (ld);
aedd00
+			ld = NULL;
aedd00
+		}
aedd00
+		logit("reconnecting to LDAP server...");
aedd00
+	}
aedd00
+
aedd00
+	if (ld == NULL) {
aedd00
+		int rc;
aedd00
+		struct timeval tv;
aedd00
+
aedd00
+#ifdef HAVE_LDAP_SET_OPTION
aedd00
+		if (options.debug > 0) {
aedd00
+#ifdef LBER_OPT_LOG_PRINT_FILE
aedd00
+			if (options.logdir) {
aedd00
+				char *logfilename;
aedd00
+				int logfilenamelen;
aedd00
+
aedd00
+				logfilenamelen = strlen(LDAP_LOGFILE)
aedd00
+				    + strlen("000000") + strlen (options.logdir);
aedd00
+				logfilename = xmalloc (logfilenamelen);
aedd00
+				snprintf (logfilename, logfilenamelen, LDAP_LOGFILE, options.logdir, (int) getpid ());
aedd00
+				logfilename[logfilenamelen - 1] = 0;
aedd00
+				if ((logfile = fopen (logfilename, "a")) == NULL)
aedd00
+				    fatal ("cannot append to %s: %s", logfilename, strerror (errno));
aedd00
+				debug3 ("LDAP debug into %s", logfilename);
aedd00
+				free (logfilename);
aedd00
+				ber_set_option (NULL, LBER_OPT_LOG_PRINT_FILE, logfile);
aedd00
+			}
aedd00
+#endif
aedd00
+			if (options.debug) {
aedd00
+#ifdef LBER_OPT_DEBUG_LEVEL
aedd00
+				ber_set_option (NULL, LBER_OPT_DEBUG_LEVEL, &options.debug);
aedd00
+#endif /* LBER_OPT_DEBUG_LEVEL */
aedd00
+#ifdef LDAP_OPT_DEBUG_LEVEL
aedd00
+				(void) ldap_set_option (NULL, LDAP_OPT_DEBUG_LEVEL, &options.debug);
aedd00
+#endif /* LDAP_OPT_DEBUG_LEVEL */
aedd00
+				debug3 ("Set LDAP debug to %d", options.debug);
aedd00
+			}
aedd00
+		}
aedd00
+#endif /* HAVE_LDAP_SET_OPTION */
aedd00
+
aedd00
+		ld = NULL;
aedd00
+#ifdef HAVE_LDAPSSL_INIT
aedd00
+		if (options.host != NULL) {
aedd00
+			if (options.ssl_on == SSL_LDAPS) {
aedd00
+				if ((rc = ldapssl_client_init (options.sslpath, NULL)) != LDAP_SUCCESS)
aedd00
+				    fatal ("ldapssl_client_init %s", ldap_err2string (rc));
aedd00
+				debug3 ("LDAPssl client init");
aedd00
+			}
aedd00
+
aedd00
+			if (options.ssl_on != SSL_OFF) {
aedd00
+				if ((ld = ldapssl_init (options.host, options.port, 1)) == NULL)
aedd00
+				    fatal ("ldapssl_init failed");
aedd00
+				debug3 ("LDAPssl init");
aedd00
+			}
aedd00
+		}
aedd00
+#endif /* HAVE_LDAPSSL_INIT */
aedd00
+
aedd00
+		/* continue with opening */
aedd00
+		if (ld == NULL) {
aedd00
+#if defined (HAVE_LDAP_START_TLS_S) || (defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_X_TLS))
aedd00
+			/* Some global TLS-specific options need to be set before we create our
aedd00
+			 * session context, so we set them here. */
aedd00
+
aedd00
+#ifdef LDAP_OPT_X_TLS_RANDOM_FILE
aedd00
+			/* rand file */
aedd00
+			if (options.tls_randfile != NULL) {
aedd00
+				if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_RANDOM_FILE,
aedd00
+				    options.tls_randfile)) != LDAP_SUCCESS)
aedd00
+					fatal ("ldap_set_option(LDAP_OPT_X_TLS_RANDOM_FILE): %s",
aedd00
+					    ldap_err2string (rc));
aedd00
+				debug3 ("Set TLS random file %s", options.tls_randfile);
aedd00
+			}
aedd00
+#endif /* LDAP_OPT_X_TLS_RANDOM_FILE */
aedd00
+
aedd00
+			/* ca cert file */
aedd00
+			if (options.tls_cacertfile != NULL) {
aedd00
+				if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_CACERTFILE,
aedd00
+				    options.tls_cacertfile)) != LDAP_SUCCESS)
aedd00
+					error ("ldap_set_option(LDAP_OPT_X_TLS_CACERTFILE): %s",
aedd00
+					    ldap_err2string (rc));
aedd00
+				debug3 ("Set TLS CA cert file %s ", options.tls_cacertfile);
aedd00
+			}
aedd00
+
aedd00
+			/* ca cert directory */
aedd00
+			if (options.tls_cacertdir != NULL) {
aedd00
+				if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_CACERTDIR,
aedd00
+				    options.tls_cacertdir)) != LDAP_SUCCESS)
aedd00
+					fatal ("ldap_set_option(LDAP_OPT_X_TLS_CACERTDIR): %s",
aedd00
+					    ldap_err2string (rc));
aedd00
+				debug3 ("Set TLS CA cert dir %s ", options.tls_cacertdir);
aedd00
+			}
aedd00
+
aedd00
+			/* require cert? */
aedd00
+			if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_REQUIRE_CERT,
aedd00
+			    &options.tls_checkpeer)) != LDAP_SUCCESS)
aedd00
+				fatal ("ldap_set_option(LDAP_OPT_X_TLS_REQUIRE_CERT): %s",
aedd00
+				    ldap_err2string (rc));
aedd00
+			debug3 ("Set TLS check peer to %d ", options.tls_checkpeer);
aedd00
+
aedd00
+			/* set cipher suite, certificate and private key: */
aedd00
+			if (options.tls_ciphers != NULL) {
aedd00
+				if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_CIPHER_SUITE,
aedd00
+				    options.tls_ciphers)) != LDAP_SUCCESS)
aedd00
+					fatal ("ldap_set_option(LDAP_OPT_X_TLS_CIPHER_SUITE): %s",
aedd00
+					    ldap_err2string (rc));
aedd00
+				debug3 ("Set TLS ciphers to %s ", options.tls_ciphers);
aedd00
+			}
aedd00
+
aedd00
+			/* cert file */
aedd00
+			if (options.tls_cert != NULL) {
aedd00
+				if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_CERTFILE,
aedd00
+				    options.tls_cert)) != LDAP_SUCCESS)
aedd00
+					fatal ("ldap_set_option(LDAP_OPT_X_TLS_CERTFILE): %s",
aedd00
+					    ldap_err2string (rc));
aedd00
+				debug3 ("Set TLS cert file %s ", options.tls_cert);
aedd00
+			}
aedd00
+
aedd00
+			/* key file */
aedd00
+			if (options.tls_key != NULL) {
aedd00
+				if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_KEYFILE,
aedd00
+				    options.tls_key)) != LDAP_SUCCESS)
aedd00
+					fatal ("ldap_set_option(LDAP_OPT_X_TLS_KEYFILE): %s",
aedd00
+					    ldap_err2string (rc));
aedd00
+				debug3 ("Set TLS key file %s ", options.tls_key);
aedd00
+			}
aedd00
+#endif
aedd00
+#ifdef HAVE_LDAP_INITIALIZE
aedd00
+			if (options.uri != NULL) {
aedd00
+				if ((rc = ldap_initialize (&ld, options.uri)) != LDAP_SUCCESS)
aedd00
+					fatal ("ldap_initialize %s", ldap_err2string (rc));
aedd00
+				debug3 ("LDAP initialize %s", options.uri);
aedd00
+			}
aedd00
+	}
aedd00
+#endif /* HAVE_LDAP_INTITIALIZE */
aedd00
+
aedd00
+		/* continue with opening */
aedd00
+		if ((ld == NULL) && (options.host != NULL)) {
aedd00
+#ifdef HAVE_LDAP_INIT
aedd00
+			if ((ld = ldap_init (options.host, options.port)) == NULL)
aedd00
+			    fatal ("ldap_init failed");
aedd00
+			debug3 ("LDAP init %s:%d", options.host, options.port);
aedd00
+#else
aedd00
+			if ((ld = ldap_open (options.host, options.port)) == NULL)
aedd00
+			    fatal ("ldap_open failed");
aedd00
+			debug3 ("LDAP open %s:%d", options.host, options.port);
aedd00
+#endif /* HAVE_LDAP_INIT */
aedd00
+		}
aedd00
+
aedd00
+		if (ld == NULL)
aedd00
+			fatal ("no way to open ldap");
aedd00
+
aedd00
+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_X_TLS)
aedd00
+		if (options.ssl == SSL_LDAPS) {
aedd00
+			if ((rc = ldap_set_option (ld, LDAP_OPT_X_TLS, &options.tls_checkpeer)) != LDAP_SUCCESS)
aedd00
+				fatal ("ldap_set_option(LDAP_OPT_X_TLS) %s", ldap_err2string (rc));
aedd00
+			debug3 ("LDAP set LDAP_OPT_X_TLS_%d", options.tls_checkpeer);
aedd00
+		}
aedd00
+#endif /* LDAP_OPT_X_TLS */
aedd00
+
aedd00
+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_PROTOCOL_VERSION)
aedd00
+		(void) ldap_set_option (ld, LDAP_OPT_PROTOCOL_VERSION,
aedd00
+		    &options.ldap_version);
aedd00
+#else
aedd00
+		ld->ld_version = options.ldap_version;
aedd00
+#endif
aedd00
+		debug3 ("LDAP set version to %d", options.ldap_version);
aedd00
+
aedd00
+#if LDAP_SET_REBIND_PROC_ARGS == 3
aedd00
+		ldap_set_rebind_proc (ld, _rebind_proc, NULL);
aedd00
+#elif LDAP_SET_REBIND_PROC_ARGS == 2
aedd00
+		ldap_set_rebind_proc (ld, _rebind_proc);
aedd00
+#else
aedd00
+#warning unknown LDAP_SET_REBIND_PROC_ARGS
aedd00
+#endif
aedd00
+		debug3 ("LDAP set rebind proc");
aedd00
+
aedd00
+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_DEREF)
aedd00
+		(void) ldap_set_option (ld, LDAP_OPT_DEREF, &options.deref);
aedd00
+#else
aedd00
+		ld->ld_deref = options.deref;
aedd00
+#endif
aedd00
+		debug3 ("LDAP set deref to %d", options.deref);
aedd00
+
aedd00
+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_TIMELIMIT)
aedd00
+		(void) ldap_set_option (ld, LDAP_OPT_TIMELIMIT,
aedd00
+		    &options.timelimit);
aedd00
+#else
aedd00
+		ld->ld_timelimit = options.timelimit;
aedd00
+#endif
aedd00
+		debug3 ("LDAP set timelimit to %d", options.timelimit);
aedd00
+
aedd00
+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_X_OPT_CONNECT_TIMEOUT)
aedd00
+		/*
aedd00
+		 * This is a new option in the Netscape SDK which sets 
aedd00
+		 * the TCP connect timeout. For want of a better value,
aedd00
+		 * we use the bind_timelimit to control this.
aedd00
+		 */
aedd00
+		timeout = options.bind_timelimit * 1000;
aedd00
+		(void) ldap_set_option (ld, LDAP_X_OPT_CONNECT_TIMEOUT, &timeout);
aedd00
+		debug3 ("LDAP set opt connect timeout to %d", timeout);
aedd00
+#endif
aedd00
+
aedd00
+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_NETWORK_TIMEOUT)
aedd00
+		tv.tv_sec = options.bind_timelimit;
aedd00
+		tv.tv_usec = 0;
aedd00
+		(void) ldap_set_option (ld, LDAP_OPT_NETWORK_TIMEOUT, &tv;;
aedd00
+		debug3 ("LDAP set opt network timeout to %ld.0", tv.tv_sec);
aedd00
+#endif
aedd00
+
aedd00
+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_REFERRALS)
aedd00
+		(void) ldap_set_option (ld, LDAP_OPT_REFERRALS,
aedd00
+		    options.referrals ? LDAP_OPT_ON : LDAP_OPT_OFF);
aedd00
+		debug3 ("LDAP set referrals to %d", options.referrals);
aedd00
+#endif
aedd00
+
aedd00
+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_RESTART)
aedd00
+		(void) ldap_set_option (ld, LDAP_OPT_RESTART,
aedd00
+		    options.restart ? LDAP_OPT_ON : LDAP_OPT_OFF);
aedd00
+		debug3 ("LDAP set restart to %d", options.restart);
aedd00
+#endif
aedd00
+
aedd00
+#ifdef HAVE_LDAP_START_TLS_S
aedd00
+		if (options.ssl == SSL_START_TLS) {
aedd00
+			int version;
aedd00
+
aedd00
+			if (ldap_get_option (ld, LDAP_OPT_PROTOCOL_VERSION, &version)
aedd00
+			    == LDAP_SUCCESS) {
aedd00
+				if (version < LDAP_VERSION3) {
aedd00
+					version = LDAP_VERSION3;
aedd00
+					(void) ldap_set_option (ld, LDAP_OPT_PROTOCOL_VERSION,
aedd00
+					    &version);
aedd00
+					debug3 ("LDAP set version to %d", version);
aedd00
+				}
aedd00
+			}
aedd00
+
aedd00
+			if ((rc = ldap_start_tls_s (ld, NULL, NULL)) != LDAP_SUCCESS)
aedd00
+			    fatal ("ldap_starttls_s: %s", ldap_err2string (rc));
aedd00
+			debug3 ("LDAP start TLS");
aedd00
+		}
aedd00
+#endif /* HAVE_LDAP_START_TLS_S */
aedd00
+	}
aedd00
+
aedd00
+	if ((msgid = ldap_simple_bind (ld, options.binddn,
aedd00
+	    options.bindpw)) == -1) {
aedd00
+		ld_errno = ldap_get_lderrno (ld, 0, 0);
aedd00
+
aedd00
+		error ("ldap_simple_bind %s", ldap_err2string (ld_errno));
aedd00
+		reconnect++;
aedd00
+		goto retry;
aedd00
+	}
aedd00
+	debug3 ("LDAP simple bind (%s)", options.binddn);
aedd00
+
aedd00
+	timeout.tv_sec = options.bind_timelimit;
aedd00
+	timeout.tv_usec = 0;
aedd00
+	if ((rc = ldap_result (ld, msgid, 0, &timeout, &result)) < 1) {
aedd00
+		ld_errno = ldap_get_lderrno (ld, 0, 0);
aedd00
+
aedd00
+		error ("ldap_result %s", ldap_err2string (ld_errno));
aedd00
+		reconnect++;
aedd00
+		goto retry;
aedd00
+	}
aedd00
+	debug3 ("LDAP result in time");
aedd00
+
aedd00
+#if defined(HAVE_LDAP_PARSE_RESULT) && defined(HAVE_LDAP_CONTROLS_FREE)
aedd00
+	controls = NULL;
aedd00
+	if ((parserc = ldap_parse_result (ld, result, &rc, 0, 0, 0, &controls, 1)) != LDAP_SUCCESS)
aedd00
+	    fatal ("ldap_parse_result %s", ldap_err2string (parserc));
aedd00
+	debug3 ("LDAP parse result OK");
aedd00
+
aedd00
+	if (controls != NULL) {
aedd00
+		ldap_controls_free (controls);
aedd00
+	}
aedd00
+#else
aedd00
+	rc = ldap_result2error (session->ld, result, 1);
aedd00
+#endif
aedd00
+	if (rc != LDAP_SUCCESS)
aedd00
+	    fatal ("error trying to bind as user \"%s\" (%s)",
aedd00
+		options.binddn, ldap_err2string (rc));
aedd00
+
aedd00
+	debug2 ("LDAP do connect OK");
aedd00
+}
aedd00
+
aedd00
+void
aedd00
+process_user (const char *user, FILE *output)
aedd00
+{
aedd00
+	LDAPMessage *res, *e;
aedd00
+	char *buffer, *format;
aedd00
+	int rc, i;
aedd00
+	struct timeval timeout;
aedd00
+
aedd00
+	debug ("LDAP process user");
aedd00
+
aedd00
+	/* quick check for attempts to be evil */
aedd00
+	if ((strchr(user, '(') != NULL) || (strchr(user, ')') != NULL) ||
aedd00
+	    (strchr(user, '*') != NULL) || (strchr(user, '\\') != NULL)) {
aedd00
+		logit ("illegal user name %s not processed", user);
aedd00
+		return;
aedd00
+	}
aedd00
+
aedd00
+	/* build  filter for LDAP request */
aedd00
+	format = LDAPSEARCH_FORMAT;
aedd00
+	if (options.search_format != NULL)
aedd00
+		format = options.search_format;
aedd00
+	buffer = percent_expand(format, "c", options.account_class, "u", user, "f", options.ssh_filter, (char *)NULL);
aedd00
+
aedd00
+	debug3 ("LDAP search scope = %d %s", options.scope, buffer);
aedd00
+
aedd00
+	timeout.tv_sec = options.timelimit;
aedd00
+	timeout.tv_usec = 0;
aedd00
+	if ((rc = ldap_search_st(ld, options.base, options.scope, buffer, attrs, 0, &timeout, &res)) != LDAP_SUCCESS) {
aedd00
+		error ("ldap_search_st(): %s", ldap_err2string (rc));
aedd00
+		free (buffer);
aedd00
+		return;
aedd00
+	}
aedd00
+
aedd00
+	/* free */
aedd00
+	free (buffer);
aedd00
+
aedd00
+	for (e = ldap_first_entry(ld, res); e != NULL; e = ldap_next_entry(ld, e)) {
aedd00
+		int num;
aedd00
+		struct berval **keys;
aedd00
+
aedd00
+		keys = ldap_get_values_len(ld, e, PUBKEYATTR);
aedd00
+		num = ldap_count_values_len(keys);
aedd00
+		for (i = 0 ; i < num ; i++) {
aedd00
+			char *cp; //, *options = NULL;
aedd00
+
aedd00
+			for (cp = keys[i]->bv_val; *cp == ' ' || *cp == '\t'; cp++);
aedd00
+			if (!*cp || *cp == '\n' || *cp == '#')
aedd00
+			    continue;
aedd00
+
aedd00
+			/* We have found the desired key. */
aedd00
+			fprintf (output, "%s\n", keys[i]->bv_val);
aedd00
+		}
aedd00
+
aedd00
+		ldap_value_free_len(keys);
aedd00
+	}
aedd00
+
aedd00
+	ldap_msgfree(res);
aedd00
+	debug2 ("LDAP process user finished");
aedd00
+}
aedd00
+
aedd00
+void
aedd00
+ldap_do_close(void)
aedd00
+{
aedd00
+	int rc;
aedd00
+
aedd00
+	debug ("LDAP do close");
aedd00
+	if ((rc = ldap_unbind_ext(ld, NULL, NULL)) != LDAP_SUCCESS)
aedd00
+	    fatal ("ldap_unbind_ext: %s",
aedd00
+                                    ldap_err2string (rc));
aedd00
+
aedd00
+	ld = NULL;
aedd00
+	debug2 ("LDAP do close OK");
aedd00
+	return;
aedd00
+}
aedd00
+
aedd00
diff -up openssh-6.8p1/ldapbody.h.ldap openssh-6.8p1/ldapbody.h
aedd00
--- openssh-6.8p1/ldapbody.h.ldap	2015-03-18 11:11:29.031801462 +0100
aedd00
+++ openssh-6.8p1/ldapbody.h	2015-03-18 11:11:29.031801462 +0100
aedd00
@@ -0,0 +1,37 @@
aedd00
+/* $OpenBSD: ldapbody.h,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
aedd00
+/*
aedd00
+ * Copyright (c) 2009 Jan F. Chadima.  All rights reserved.
aedd00
+ *
aedd00
+ * Redistribution and use in source and binary forms, with or without
aedd00
+ * modification, are permitted provided that the following conditions
aedd00
+ * are met:
aedd00
+ * 1. Redistributions of source code must retain the above copyright
aedd00
+ *    notice, this list of conditions and the following disclaimer.
aedd00
+ * 2. Redistributions in binary form must reproduce the above copyright
aedd00
+ *    notice, this list of conditions and the following disclaimer in the
aedd00
+ *    documentation and/or other materials provided with the distribution.
aedd00
+ *
aedd00
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
aedd00
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
aedd00
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
aedd00
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
aedd00
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
aedd00
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
aedd00
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
aedd00
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
aedd00
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
aedd00
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
aedd00
+ */
aedd00
+
aedd00
+#ifndef LDAPBODY_H
aedd00
+#define LDAPBODY_H
aedd00
+
aedd00
+#include <stdio.h>
aedd00
+
aedd00
+void ldap_checkconfig(void);
aedd00
+void ldap_do_connect(void);
aedd00
+void process_user(const char *, FILE *);
aedd00
+void ldap_do_close(void);
aedd00
+
aedd00
+#endif /* LDAPBODY_H */
aedd00
+
aedd00
diff -up openssh-6.8p1/ldapconf.c.ldap openssh-6.8p1/ldapconf.c
aedd00
--- openssh-6.8p1/ldapconf.c.ldap	2015-03-18 11:11:29.032801460 +0100
aedd00
+++ openssh-6.8p1/ldapconf.c	2015-03-18 11:11:29.032801460 +0100
aedd00
@@ -0,0 +1,729 @@
aedd00
+/* $OpenBSD: ldapconf.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
aedd00
+/*
aedd00
+ * Copyright (c) 2009 Jan F. Chadima.  All rights reserved.
aedd00
+ *
aedd00
+ * Redistribution and use in source and binary forms, with or without
aedd00
+ * modification, are permitted provided that the following conditions
aedd00
+ * are met:
aedd00
+ * 1. Redistributions of source code must retain the above copyright
aedd00
+ *    notice, this list of conditions and the following disclaimer.
aedd00
+ * 2. Redistributions in binary form must reproduce the above copyright
aedd00
+ *    notice, this list of conditions and the following disclaimer in the
aedd00
+ *    documentation and/or other materials provided with the distribution.
aedd00
+ *
aedd00
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
aedd00
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
aedd00
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
aedd00
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
aedd00
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
aedd00
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
aedd00
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
aedd00
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
aedd00
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
aedd00
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
aedd00
+ */
aedd00
+
aedd00
+#include "ldapincludes.h"
aedd00
+#include "ldap-helper.h"
aedd00
+#include "log.h"
aedd00
+#include "misc.h"
aedd00
+#include "xmalloc.h"
aedd00
+#include "ldapconf.h"
aedd00
+#include <unistd.h>
aedd00
+#include <string.h>
aedd00
+#include <stdlib.h>
aedd00
+
aedd00
+/* Keyword tokens. */
aedd00
+
aedd00
+typedef enum {
aedd00
+	lBadOption,
aedd00
+	lHost, lURI, lBase, lBindDN, lBindPW, lRootBindDN,
aedd00
+	lScope, lDeref, lPort, lTimeLimit, lBind_TimeLimit,
aedd00
+	lLdap_Version, lBind_Policy, lSSLPath, lSSL, lReferrals,
aedd00
+	lRestart, lTLS_CheckPeer, lTLS_CaCertFile,
aedd00
+	lTLS_CaCertDir, lTLS_Ciphers, lTLS_Cert, lTLS_Key,
aedd00
+	lTLS_RandFile, lLogDir, lDebug, lSSH_Filter, lSearch_Format,
aedd00
+	lAccountClass, lDeprecated, lUnsupported
aedd00
+} OpCodes;
aedd00
+
aedd00
+/* Textual representations of the tokens. */
aedd00
+
aedd00
+static struct {
aedd00
+	const char *name;
aedd00
+	OpCodes opcode;
aedd00
+} keywords[] = {
aedd00
+	{ "URI", lURI },
aedd00
+	{ "Base", lBase },
aedd00
+	{ "BindDN", lBindDN },
aedd00
+	{ "BindPW", lBindPW },
aedd00
+	{ "RootBindDN", lRootBindDN },
aedd00
+	{ "Host", lHost },
aedd00
+	{ "Port", lPort },
aedd00
+	{ "Scope", lScope },
aedd00
+	{ "Deref", lDeref },
aedd00
+	{ "TimeLimit", lTimeLimit },
aedd00
+	{ "TimeOut", lTimeLimit },
aedd00
+	{ "Bind_Timelimit", lBind_TimeLimit },
aedd00
+	{ "Network_TimeOut", lBind_TimeLimit },
aedd00
+/*
aedd00
+ * Todo
aedd00
+ * SIZELIMIT
aedd00
+ */
aedd00
+	{ "Ldap_Version", lLdap_Version },
aedd00
+	{ "Version", lLdap_Version },
aedd00
+	{ "Bind_Policy", lBind_Policy },
aedd00
+	{ "SSLPath", lSSLPath },
aedd00
+	{ "SSL", lSSL },
aedd00
+	{ "Referrals", lReferrals },
aedd00
+	{ "Restart", lRestart },
aedd00
+	{ "TLS_CheckPeer", lTLS_CheckPeer },
aedd00
+	{ "TLS_ReqCert", lTLS_CheckPeer },
aedd00
+	{ "TLS_CaCertFile", lTLS_CaCertFile },
aedd00
+	{ "TLS_CaCert", lTLS_CaCertFile },
aedd00
+	{ "TLS_CaCertDir", lTLS_CaCertDir },
aedd00
+	{ "TLS_Ciphers", lTLS_Ciphers },
aedd00
+	{ "TLS_Cipher_Suite", lTLS_Ciphers },
aedd00
+	{ "TLS_Cert", lTLS_Cert },
aedd00
+	{ "TLS_Certificate", lTLS_Cert },
aedd00
+	{ "TLS_Key", lTLS_Key },
aedd00
+	{ "TLS_RandFile", lTLS_RandFile },
aedd00
+/*
aedd00
+ * Todo
aedd00
+ * TLS_CRLCHECK
aedd00
+ * TLS_CRLFILE
aedd00
+ */
aedd00
+	{ "LogDir", lLogDir },
aedd00
+	{ "Debug", lDebug },
aedd00
+	{ "SSH_Filter", lSSH_Filter },
aedd00
+	{ "search_format", lSearch_Format },
aedd00
+	{ "AccountClass", lAccountClass },
aedd00
+	{ NULL, lBadOption }
aedd00
+};
aedd00
+
aedd00
+/* Configuration ptions. */
aedd00
+
aedd00
+Options options;
aedd00
+
aedd00
+/*
aedd00
+ * Returns the number of the token pointed to by cp or oBadOption.
aedd00
+ */
aedd00
+
aedd00
+static OpCodes
aedd00
+parse_token(const char *cp, const char *filename, int linenum)
aedd00
+{
aedd00
+	u_int i;
aedd00
+
aedd00
+	for (i = 0; keywords[i].name; i++)
aedd00
+		if (strcasecmp(cp, keywords[i].name) == 0)
aedd00
+			return keywords[i].opcode;
aedd00
+
aedd00
+	if (config_warning_config_file) 
aedd00
+	    logit("%s: line %d: Bad configuration option: %s",
aedd00
+		filename, linenum, cp);
aedd00
+	return lBadOption;
aedd00
+}
aedd00
+
aedd00
+/* Characters considered whitespace in strsep calls. */
aedd00
+#define WHITESPACE " \t\r\n"
aedd00
+
aedd00
+/* return next token in configuration line */
aedd00
+static char *
aedd00
+ldap_strdelim(char **s)
aedd00
+{
aedd00
+      char *old;
aedd00
+      int wspace = 0;
aedd00
+
aedd00
+      if (*s == NULL)
aedd00
+              return NULL;
aedd00
+
aedd00
+      old = *s;
aedd00
+
aedd00
+      *s = strpbrk(*s, WHITESPACE);
aedd00
+      if (*s == NULL)
aedd00
+              return (old);
aedd00
+
aedd00
+      *s[0] = '\0';
aedd00
+
aedd00
+      /* Skip any extra whitespace after first token */
aedd00
+      *s += strspn(*s + 1, WHITESPACE) + 1;
aedd00
+      if (*s[0] == '=' && !wspace)
aedd00
+              *s += strspn(*s + 1, WHITESPACE) + 1;
aedd00
+
aedd00
+      return (old);
aedd00
+}
aedd00
+
aedd00
+/*
aedd00
+ * Processes a single option line as used in the configuration files. This
aedd00
+ * only sets those values that have not already been set.
aedd00
+ */
aedd00
+#define WHITESPACE " \t\r\n"
aedd00
+
aedd00
+static int
aedd00
+process_config_line(char *line, const char *filename, int linenum)
aedd00
+{
aedd00
+	char *s, **charptr, **xstringptr, *endofnumber, *keyword, *arg;
aedd00
+	char *rootbinddn = NULL;
aedd00
+	int opcode, *intptr, value;
aedd00
+	size_t len;
aedd00
+
aedd00
+	/* Strip trailing whitespace */
aedd00
+	for (len = strlen(line) - 1; len > 0; len--) {
aedd00
+		if (strchr(WHITESPACE, line[len]) == NULL)
aedd00
+			break;
aedd00
+		line[len] = '\0';
aedd00
+	}
aedd00
+
aedd00
+	s = line;
aedd00
+	/* Get the keyword. (Each line is supposed to begin with a keyword). */
aedd00
+	if ((keyword = ldap_strdelim(&s)) == NULL)
aedd00
+		return 0;
aedd00
+	/* Ignore leading whitespace. */
aedd00
+	if (*keyword == '\0')
aedd00
+		keyword = ldap_strdelim(&s);
aedd00
+	if (keyword == NULL || !*keyword || *keyword == '\n' || *keyword == '#')
aedd00
+		return 0;
aedd00
+
aedd00
+	opcode = parse_token(keyword, filename, linenum);
aedd00
+
aedd00
+	switch (opcode) {
aedd00
+	case lBadOption:
aedd00
+		/* don't panic, but count bad options */
aedd00
+		return -1;
aedd00
+		/* NOTREACHED */
aedd00
+
aedd00
+	case lHost:
aedd00
+		xstringptr = &options.host;
aedd00
+parse_xstring:
aedd00
+		if (!s || *s == '\0')
aedd00
+		    fatal("%s line %d: missing dn",filename,linenum);
aedd00
+		if (*xstringptr == NULL)
aedd00
+		    *xstringptr = xstrdup(s);
aedd00
+		return 0;
aedd00
+
aedd00
+	case lURI:
aedd00
+		xstringptr = &options.uri;
aedd00
+		goto parse_xstring;
aedd00
+
aedd00
+	case lBase:
aedd00
+		xstringptr = &options.base;
aedd00
+		goto parse_xstring;
aedd00
+
aedd00
+	case lBindDN:
aedd00
+		xstringptr = &options.binddn;
aedd00
+		goto parse_xstring;
aedd00
+
aedd00
+	case lBindPW:
aedd00
+		charptr = &options.bindpw;
aedd00
+parse_string:
aedd00
+		arg = ldap_strdelim(&s);
aedd00
+		if (!arg || *arg == '\0')
aedd00
+			fatal("%.200s line %d: Missing argument.", filename, linenum);
aedd00
+		if (*charptr == NULL)
aedd00
+			*charptr = xstrdup(arg);
aedd00
+		break;
aedd00
+
aedd00
+	case lRootBindDN:
aedd00
+		xstringptr = &rootbinddn;
aedd00
+		goto parse_xstring;
aedd00
+
aedd00
+	case lScope:
aedd00
+		intptr = &options.scope;
aedd00
+		arg = ldap_strdelim(&s);
aedd00
+		if (!arg || *arg == '\0')
aedd00
+			fatal("%.200s line %d: Missing sub/one/base argument.", filename, linenum);
aedd00
+		value = 0;	/* To avoid compiler warning... */
aedd00
+		if (strcasecmp (arg, "sub") == 0 || strcasecmp (arg, "subtree") == 0)
aedd00
+			value = LDAP_SCOPE_SUBTREE;
aedd00
+		else if (strcasecmp (arg, "one") == 0)
aedd00
+			value = LDAP_SCOPE_ONELEVEL;
aedd00
+		else if (strcasecmp (arg, "base") == 0)
aedd00
+			value = LDAP_SCOPE_BASE;
aedd00
+		else
aedd00
+			fatal("%.200s line %d: Bad sub/one/base argument.", filename, linenum);
aedd00
+		if (*intptr == -1)
aedd00
+			*intptr = value;
aedd00
+		break;
aedd00
+
aedd00
+	case lDeref:
aedd00
+		intptr = &options.scope;
aedd00
+		arg = ldap_strdelim(&s);
aedd00
+		if (!arg || *arg == '\0')
aedd00
+			fatal("%.200s line %d: Missing never/searching/finding/always argument.", filename, linenum);
aedd00
+		value = 0;	/* To avoid compiler warning... */
aedd00
+		if (!strcasecmp (arg, "never"))
aedd00
+			value = LDAP_DEREF_NEVER;
aedd00
+		else if (!strcasecmp (arg, "searching"))
aedd00
+			value = LDAP_DEREF_SEARCHING;
aedd00
+		else if (!strcasecmp (arg, "finding"))
aedd00
+			value = LDAP_DEREF_FINDING;
aedd00
+		else if (!strcasecmp (arg, "always"))
aedd00
+			value = LDAP_DEREF_ALWAYS;
aedd00
+		else
aedd00
+			fatal("%.200s line %d: Bad never/searching/finding/always argument.", filename, linenum);
aedd00
+		if (*intptr == -1)
aedd00
+			*intptr = value;
aedd00
+		break;
aedd00
+
aedd00
+	case lPort:
aedd00
+		intptr = &options.port;
aedd00
+parse_int:
aedd00
+		arg = ldap_strdelim(&s);
aedd00
+		if (!arg || *arg == '\0')
aedd00
+			fatal("%.200s line %d: Missing argument.", filename, linenum);
aedd00
+		if (arg[0] < '0' || arg[0] > '9')
aedd00
+			fatal("%.200s line %d: Bad number.", filename, linenum);
aedd00
+
aedd00
+		/* Octal, decimal, or hex format? */
aedd00
+		value = strtol(arg, &endofnumber, 0);
aedd00
+		if (arg == endofnumber)
aedd00
+			fatal("%.200s line %d: Bad number.", filename, linenum);
aedd00
+		if (*intptr == -1)
aedd00
+			*intptr = value;
aedd00
+		break;
aedd00
+
aedd00
+	case lTimeLimit:
aedd00
+		intptr = &options.timelimit;
aedd00
+parse_time:
aedd00
+		arg = ldap_strdelim(&s);
aedd00
+		if (!arg || *arg == '\0')
aedd00
+			fatal("%s line %d: missing time value.",
aedd00
+			    filename, linenum);
aedd00
+		if ((value = convtime(arg)) == -1)
aedd00
+			fatal("%s line %d: invalid time value.",
aedd00
+			    filename, linenum);
aedd00
+		if (*intptr == -1)
aedd00
+			*intptr = value;
aedd00
+		break;
aedd00
+
aedd00
+	case lBind_TimeLimit:
aedd00
+		intptr = &options.bind_timelimit;
aedd00
+		goto parse_time;
aedd00
+
aedd00
+	case lLdap_Version:
aedd00
+		intptr = &options.ldap_version;
aedd00
+		goto parse_int;
aedd00
+
aedd00
+	case lBind_Policy:
aedd00
+		intptr = &options.bind_policy;
aedd00
+		arg = ldap_strdelim(&s);
aedd00
+		if (!arg || *arg == '\0')
aedd00
+			fatal("%.200s line %d: Missing soft/hard argument.", filename, linenum);
aedd00
+		value = 0;	/* To avoid compiler warning... */
aedd00
+		if (strcasecmp(arg, "hard") == 0 || strcasecmp(arg, "hard_open") == 0 || strcasecmp(arg, "hard_init") == 0)
aedd00
+			value = 1;
aedd00
+		else if (strcasecmp(arg, "soft") == 0)
aedd00
+			value = 0;
aedd00
+		else
aedd00
+			fatal("%.200s line %d: Bad soft/hard argument.", filename, linenum);
aedd00
+		if (*intptr == -1)
aedd00
+			*intptr = value;
aedd00
+		break;
aedd00
+
aedd00
+	case lSSLPath:
aedd00
+		charptr = &options.sslpath;
aedd00
+		goto parse_string;
aedd00
+
aedd00
+	case lSSL:
aedd00
+		intptr = &options.ssl;
aedd00
+		arg = ldap_strdelim(&s);
aedd00
+		if (!arg || *arg == '\0')
aedd00
+			fatal("%.200s line %d: Missing yes/no/start_tls argument.", filename, linenum);
aedd00
+		value = 0;	/* To avoid compiler warning... */
aedd00
+		if (strcasecmp(arg, "yes") == 0 || strcasecmp(arg, "true") == 0 || strcasecmp(arg, "on") == 0)
aedd00
+			value = SSL_LDAPS;
aedd00
+		else if (strcasecmp(arg, "no") == 0 || strcasecmp(arg, "false") == 0 || strcasecmp(arg, "off") == 0)
aedd00
+			value = SSL_OFF;
aedd00
+		else if (!strcasecmp (arg, "start_tls"))
aedd00
+			value = SSL_START_TLS;
aedd00
+		else
aedd00
+			fatal("%.200s line %d: Bad yes/no/start_tls argument.", filename, linenum);
aedd00
+		if (*intptr == -1)
aedd00
+			*intptr = value;
aedd00
+		break;
aedd00
+
aedd00
+	case lReferrals:
aedd00
+		intptr = &options.referrals;
aedd00
+parse_flag:
aedd00
+		arg = ldap_strdelim(&s);
aedd00
+		if (!arg || *arg == '\0')
aedd00
+			fatal("%.200s line %d: Missing yes/no argument.", filename, linenum);
aedd00
+		value = 0;	/* To avoid compiler warning... */
aedd00
+		if (strcasecmp(arg, "yes") == 0 || strcasecmp(arg, "true") == 0 || strcasecmp(arg, "on") == 0)
aedd00
+			value = 1;
aedd00
+		else if (strcasecmp(arg, "no") == 0 || strcasecmp(arg, "false") == 0 || strcasecmp(arg, "off") == 0)
aedd00
+			value = 0;
aedd00
+		else
aedd00
+			fatal("%.200s line %d: Bad yes/no argument.", filename, linenum);
aedd00
+		if (*intptr == -1)
aedd00
+			*intptr = value;
aedd00
+		break;
aedd00
+
aedd00
+	case lRestart:
aedd00
+		intptr = &options.restart;
aedd00
+		goto parse_flag;
aedd00
+
aedd00
+	case lTLS_CheckPeer:
aedd00
+		intptr = &options.tls_checkpeer;
aedd00
+		arg = ldap_strdelim(&s);
aedd00
+		if (!arg || *arg == '\0')
aedd00
+			fatal("%.200s line %d: Missing never/hard/demand/alow/try argument.", filename, linenum);
aedd00
+		value = 0;	/* To avoid compiler warning... */
aedd00
+		if (strcasecmp(arg, "never") == 0 || strcasecmp(arg, "no") == 0 || strcasecmp(arg, "false") == 0 || strcasecmp(arg, "off") == 0)
aedd00
+			value = LDAP_OPT_X_TLS_NEVER;
aedd00
+		else if (strcasecmp(arg, "hard") == 0 || strcasecmp(arg, "yes") == 0 || strcasecmp(arg, "true") == 0 || strcasecmp(arg, "on") == 0)
aedd00
+			value = LDAP_OPT_X_TLS_HARD;
aedd00
+		else if (strcasecmp(arg, "demand") == 0)
aedd00
+			value = LDAP_OPT_X_TLS_DEMAND;
aedd00
+		else if (strcasecmp(arg, "allow") == 0)
aedd00
+			value = LDAP_OPT_X_TLS_ALLOW;
aedd00
+		else if (strcasecmp(arg, "try") == 0)
aedd00
+			value = LDAP_OPT_X_TLS_TRY;
aedd00
+		else
aedd00
+			fatal("%.200s line %d: Bad never/hard/demand/alow/try argument.", filename, linenum);
aedd00
+		if (*intptr == -1)
aedd00
+			*intptr = value;
aedd00
+		break;
aedd00
+
aedd00
+	case lTLS_CaCertFile:
aedd00
+		charptr = &options.tls_cacertfile;
aedd00
+		goto parse_string;
aedd00
+
aedd00
+	case lTLS_CaCertDir:
aedd00
+		charptr = &options.tls_cacertdir;
aedd00
+		goto parse_string;
aedd00
+
aedd00
+	case lTLS_Ciphers:
aedd00
+		xstringptr = &options.tls_ciphers;
aedd00
+		goto parse_xstring;
aedd00
+
aedd00
+	case lTLS_Cert:
aedd00
+		charptr = &options.tls_cert;
aedd00
+		goto parse_string;
aedd00
+
aedd00
+	case lTLS_Key:
aedd00
+		charptr = &options.tls_key;
aedd00
+		goto parse_string;
aedd00
+
aedd00
+	case lTLS_RandFile:
aedd00
+		charptr = &options.tls_randfile;
aedd00
+		goto parse_string;
aedd00
+
aedd00
+	case lLogDir:
aedd00
+		charptr = &options.logdir;
aedd00
+		goto parse_string;
aedd00
+
aedd00
+	case lDebug:
aedd00
+		intptr = &options.debug;
aedd00
+		goto parse_int;
aedd00
+
aedd00
+	case lSSH_Filter:
aedd00
+		xstringptr = &options.ssh_filter;
aedd00
+		goto parse_xstring;
aedd00
+
aedd00
+	case lSearch_Format:
aedd00
+		charptr = &options.search_format;
aedd00
+		goto parse_string;
aedd00
+
aedd00
+	case lAccountClass:
aedd00
+		charptr = &options.account_class;
aedd00
+		goto parse_string;
aedd00
+
aedd00
+	case lDeprecated:
aedd00
+		debug("%s line %d: Deprecated option \"%s\"",
aedd00
+		    filename, linenum, keyword);
aedd00
+		return 0;
aedd00
+
aedd00
+	case lUnsupported:
aedd00
+		error("%s line %d: Unsupported option \"%s\"",
aedd00
+		    filename, linenum, keyword);
aedd00
+		return 0;
aedd00
+
aedd00
+	default:
aedd00
+		fatal("process_config_line: Unimplemented opcode %d", opcode);
aedd00
+	}
aedd00
+
aedd00
+	/* Check that there is no garbage at end of line. */
aedd00
+	if ((arg = ldap_strdelim(&s)) != NULL && *arg != '\0') {
aedd00
+		fatal("%.200s line %d: garbage at end of line; \"%.200s\".",
aedd00
+		    filename, linenum, arg);
aedd00
+	}
aedd00
+	return 0;
aedd00
+}
aedd00
+
aedd00
+/*
aedd00
+ * Reads the config file and modifies the options accordingly.  Options
aedd00
+ * should already be initialized before this call.  This never returns if
aedd00
+ * there is an error.  If the file does not exist, this returns 0.
aedd00
+ */
aedd00
+
aedd00
+void
aedd00
+read_config_file(const char *filename)
aedd00
+{
aedd00
+	FILE *f;
aedd00
+	char line[1024];
aedd00
+	int linenum;
aedd00
+	int bad_options = 0;
aedd00
+	struct stat sb;
aedd00
+
aedd00
+	if ((f = fopen(filename, "r")) == NULL)
aedd00
+		fatal("fopen %s: %s", filename, strerror(errno));
aedd00
+
aedd00
+	if (fstat(fileno(f), &sb) == -1)
aedd00
+		fatal("fstat %s: %s", filename, strerror(errno));
aedd00
+	if (((sb.st_uid != 0 && sb.st_uid != getuid()) ||
aedd00
+	    (sb.st_mode & 022) != 0))
aedd00
+		fatal("Bad owner or permissions on %s", filename);
aedd00
+
aedd00
+	debug("Reading configuration data %.200s", filename);
aedd00
+
aedd00
+	/*
aedd00
+	 * Mark that we are now processing the options.  This flag is turned
aedd00
+	 * on/off by Host specifications.
aedd00
+	 */
aedd00
+	linenum = 0;
aedd00
+	while (fgets(line, sizeof(line), f)) {
aedd00
+		/* Update line number counter. */
aedd00
+		linenum++;
aedd00
+		if (process_config_line(line, filename, linenum) != 0)
aedd00
+			bad_options++;
aedd00
+	}
aedd00
+	fclose(f);
aedd00
+	if ((bad_options > 0) && config_exclusive_config_file) 
aedd00
+		fatal("%s: terminating, %d bad configuration options",
aedd00
+		    filename, bad_options);
aedd00
+}
aedd00
+
aedd00
+/*
aedd00
+ * Initializes options to special values that indicate that they have not yet
aedd00
+ * been set.  Read_config_file will only set options with this value. Options
aedd00
+ * are processed in the following order: command line, user config file,
aedd00
+ * system config file.  Last, fill_default_options is called.
aedd00
+ */
aedd00
+
aedd00
+void
aedd00
+initialize_options(void)
aedd00
+{
aedd00
+	memset(&options, 'X', sizeof(options));
aedd00
+	options.host = NULL;
aedd00
+	options.uri = NULL;
aedd00
+	options.base = NULL;
aedd00
+	options.binddn = NULL;
aedd00
+	options.bindpw = NULL;
aedd00
+	options.scope = -1;
aedd00
+	options.deref = -1;
aedd00
+	options.port = -1;
aedd00
+	options.timelimit = -1;
aedd00
+	options.bind_timelimit = -1;
aedd00
+	options.ldap_version = -1;
aedd00
+	options.bind_policy = -1;
aedd00
+	options.sslpath = NULL;
aedd00
+	options.ssl = -1;
aedd00
+	options.referrals = -1;
aedd00
+	options.restart = -1;
aedd00
+	options.tls_checkpeer = -1;
aedd00
+	options.tls_cacertfile = NULL;
aedd00
+	options.tls_cacertdir = NULL;
aedd00
+	options.tls_ciphers = NULL;
aedd00
+	options.tls_cert = NULL;
aedd00
+	options.tls_key = NULL;
aedd00
+	options.tls_randfile = NULL;
aedd00
+	options.logdir = NULL;
aedd00
+	options.debug = -1;
aedd00
+	options.ssh_filter = NULL;
aedd00
+	options.search_format = NULL;
aedd00
+	options.account_class = NULL;
aedd00
+}
aedd00
+
aedd00
+/*
aedd00
+ * Called after processing other sources of option data, this fills those
aedd00
+ * options for which no value has been specified with their default values.
aedd00
+ */
aedd00
+
aedd00
+void
aedd00
+fill_default_options(void)
aedd00
+{
aedd00
+	if (options.uri != NULL) {
aedd00
+		LDAPURLDesc *ludp;
aedd00
+
aedd00
+		if (ldap_url_parse(options.uri, &ludp) == LDAP_SUCCESS) {
aedd00
+			if (options.ssl == -1) {
aedd00
+				if (strcmp (ludp->lud_scheme, "ldap") == 0)
aedd00
+				    options.ssl = 2;
aedd00
+				if (strcmp (ludp->lud_scheme, "ldapi") == 0)
aedd00
+				    options.ssl = 0;
aedd00
+				else if (strcmp (ludp->lud_scheme, "ldaps") == 0)
aedd00
+				    options.ssl = 1;
aedd00
+			}
aedd00
+			if (options.host == NULL)
aedd00
+			    options.host = xstrdup (ludp->lud_host);
aedd00
+			if (options.port == -1)
aedd00
+			    options.port = ludp->lud_port;
aedd00
+
aedd00
+			ldap_free_urldesc (ludp);
aedd00
+		}
aedd00
+	} 
aedd00
+	if (options.ssl == -1)
aedd00
+	    options.ssl = SSL_START_TLS;
aedd00
+	if (options.port == -1)
aedd00
+	    options.port = (options.ssl == 0) ? 389 : 636;
aedd00
+	if (options.uri == NULL) {
aedd00
+		int len;
aedd00
+#define MAXURILEN 4096
aedd00
+
aedd00
+		options.uri = xmalloc (MAXURILEN);
aedd00
+		len = snprintf (options.uri, MAXURILEN, "ldap%s://%s:%d",
aedd00
+		    (options.ssl == 0) ? "" : "s", options.host, options.port);
aedd00
+		options.uri[MAXURILEN - 1] = 0;
aedd00
+		options.uri = xreallocarray(options.uri, len + 1, 1);
aedd00
+	}
aedd00
+	if (options.binddn == NULL)
aedd00
+	    options.binddn = "";
aedd00
+	if (options.bindpw == NULL)
aedd00
+	    options.bindpw = "";
aedd00
+	if (options.scope == -1)
aedd00
+	    options.scope = LDAP_SCOPE_SUBTREE;
aedd00
+	if (options.deref == -1)
aedd00
+	    options.deref = LDAP_DEREF_NEVER;
aedd00
+	if (options.timelimit == -1)
aedd00
+	    options.timelimit = 10;
aedd00
+	if (options.bind_timelimit == -1)
aedd00
+	    options.bind_timelimit = 10;
aedd00
+	if (options.ldap_version == -1)
aedd00
+	    options.ldap_version = 3;
aedd00
+	if (options.bind_policy == -1)
aedd00
+	    options.bind_policy = 1;
aedd00
+	if (options.referrals == -1)
aedd00
+	    options.referrals = 1;
aedd00
+	if (options.restart == -1)
aedd00
+	    options.restart = 1;
aedd00
+	if (options.tls_checkpeer == -1)
aedd00
+	    options.tls_checkpeer = LDAP_OPT_X_TLS_HARD;
aedd00
+	if (options.debug == -1)
aedd00
+	    options.debug = 0;
aedd00
+	if (options.ssh_filter == NULL)
aedd00
+	    options.ssh_filter = "";
aedd00
+	if (options.account_class == NULL)
aedd00
+	    options.account_class = "posixAccount";
aedd00
+}
aedd00
+
aedd00
+static const char *
aedd00
+lookup_opcode_name(OpCodes code)
aedd00
+{
aedd00
+	u_int i;
aedd00
+
aedd00
+	for (i = 0; keywords[i].name != NULL; i++)
aedd00
+	    if (keywords[i].opcode == code)
aedd00
+		return(keywords[i].name);
aedd00
+	return "UNKNOWN";
aedd00
+}
aedd00
+
aedd00
+static void
aedd00
+dump_cfg_string(OpCodes code, const char *val)
aedd00
+{
aedd00
+	if (val == NULL)
aedd00
+	    debug3("%s <UNDEFINED>", lookup_opcode_name(code));
aedd00
+	else
aedd00
+	    debug3("%s %s", lookup_opcode_name(code), val);
aedd00
+}
aedd00
+
aedd00
+static void
aedd00
+dump_cfg_int(OpCodes code, int val)
aedd00
+{
aedd00
+	if (val == -1)
aedd00
+	    debug3("%s <UNDEFINED>", lookup_opcode_name(code));
aedd00
+	else
aedd00
+	    debug3("%s %d", lookup_opcode_name(code), val);
aedd00
+}
aedd00
+
aedd00
+struct names {
aedd00
+	int value;
aedd00
+	char *name;
aedd00
+};
aedd00
+
aedd00
+static void
aedd00
+dump_cfg_namedint(OpCodes code, int val, struct names *names)
aedd00
+{
aedd00
+	u_int i;
aedd00
+
aedd00
+	if (val == -1)
aedd00
+	    debug3("%s <UNDEFINED>", lookup_opcode_name(code));
aedd00
+	else {
aedd00
+		for (i = 0; names[i].value != -1; i++)
aedd00
+	 	    if (names[i].value == val) {
aedd00
+	    		debug3("%s %s", lookup_opcode_name(code), names[i].name);
aedd00
+			    return;
aedd00
+		}
aedd00
+		debug3("%s unknown: %d", lookup_opcode_name(code), val);
aedd00
+	}
aedd00
+}
aedd00
+
aedd00
+static struct names _yesnotls[] = {
aedd00
+	{ 0, "No" },
aedd00
+	{ 1, "Yes" },
aedd00
+	{ 2, "Start_TLS" },
aedd00
+	{ -1, NULL }};
aedd00
+
aedd00
+static struct names _scope[] = {
aedd00
+	{ LDAP_SCOPE_BASE, "Base" },
aedd00
+	{ LDAP_SCOPE_ONELEVEL, "One" },
aedd00
+	{ LDAP_SCOPE_SUBTREE, "Sub"},
aedd00
+	{ -1, NULL }};
aedd00
+
aedd00
+static struct names _deref[] = {
aedd00
+	{ LDAP_DEREF_NEVER, "Never" },
aedd00
+	{ LDAP_DEREF_SEARCHING, "Searching" },
aedd00
+	{ LDAP_DEREF_FINDING, "Finding" },
aedd00
+	{ LDAP_DEREF_ALWAYS, "Always" },
aedd00
+	{ -1, NULL }};
aedd00
+
aedd00
+static struct names _yesno[] = {
aedd00
+	{ 0, "No" },
aedd00
+	{ 1, "Yes" },
aedd00
+	{ -1, NULL }};
aedd00
+
aedd00
+static struct names _bindpolicy[] = {
aedd00
+	{ 0, "Soft" },
aedd00
+	{ 1, "Hard" },
aedd00
+	{ -1, NULL }};
aedd00
+
aedd00
+static struct names _checkpeer[] = {
aedd00
+	{ LDAP_OPT_X_TLS_NEVER, "Never" },
aedd00
+	{ LDAP_OPT_X_TLS_HARD, "Hard" },
aedd00
+	{ LDAP_OPT_X_TLS_DEMAND, "Demand" },
aedd00
+	{ LDAP_OPT_X_TLS_ALLOW, "Allow" },
aedd00
+	{ LDAP_OPT_X_TLS_TRY, "TRY" },
aedd00
+	{ -1, NULL }};
aedd00
+
aedd00
+void
aedd00
+dump_config(void)
aedd00
+{
aedd00
+	dump_cfg_string(lURI, options.uri);
aedd00
+	dump_cfg_string(lHost, options.host);
aedd00
+	dump_cfg_int(lPort, options.port);
aedd00
+	dump_cfg_namedint(lSSL, options.ssl, _yesnotls);
aedd00
+	dump_cfg_int(lLdap_Version, options.ldap_version);
aedd00
+	dump_cfg_int(lTimeLimit, options.timelimit);
aedd00
+	dump_cfg_int(lBind_TimeLimit, options.bind_timelimit);
aedd00
+	dump_cfg_string(lBase, options.base);
aedd00
+	dump_cfg_string(lBindDN, options.binddn);
aedd00
+	dump_cfg_string(lBindPW, options.bindpw);
aedd00
+	dump_cfg_namedint(lScope, options.scope, _scope);
aedd00
+	dump_cfg_namedint(lDeref, options.deref, _deref);
aedd00
+	dump_cfg_namedint(lReferrals, options.referrals, _yesno);
aedd00
+	dump_cfg_namedint(lRestart, options.restart, _yesno);
aedd00
+	dump_cfg_namedint(lBind_Policy, options.bind_policy, _bindpolicy);
aedd00
+	dump_cfg_string(lSSLPath, options.sslpath);
aedd00
+	dump_cfg_namedint(lTLS_CheckPeer, options.tls_checkpeer, _checkpeer);
aedd00
+	dump_cfg_string(lTLS_CaCertFile, options.tls_cacertfile);
aedd00
+	dump_cfg_string(lTLS_CaCertDir, options.tls_cacertdir);
aedd00
+	dump_cfg_string(lTLS_Ciphers, options.tls_ciphers);
aedd00
+	dump_cfg_string(lTLS_Cert, options.tls_cert);
aedd00
+	dump_cfg_string(lTLS_Key, options.tls_key);
aedd00
+	dump_cfg_string(lTLS_RandFile, options.tls_randfile);
aedd00
+	dump_cfg_string(lLogDir, options.logdir);
aedd00
+	dump_cfg_int(lDebug, options.debug);
aedd00
+	dump_cfg_string(lSSH_Filter, options.ssh_filter);
aedd00
+	dump_cfg_string(lSearch_Format, options.search_format);
aedd00
+	dump_cfg_string(lAccountClass, options.account_class);
aedd00
+}
aedd00
+
aedd00
diff -up openssh-6.8p1/ldapconf.h.ldap openssh-6.8p1/ldapconf.h
aedd00
--- openssh-6.8p1/ldapconf.h.ldap	2015-03-18 11:11:29.032801460 +0100
aedd00
+++ openssh-6.8p1/ldapconf.h	2015-03-18 11:11:29.032801460 +0100
aedd00
@@ -0,0 +1,73 @@
aedd00
+/* $OpenBSD: ldapconf.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
aedd00
+/*
aedd00
+ * Copyright (c) 2009 Jan F. Chadima.  All rights reserved.
aedd00
+ *
aedd00
+ * Redistribution and use in source and binary forms, with or without
aedd00
+ * modification, are permitted provided that the following conditions
aedd00
+ * are met:
aedd00
+ * 1. Redistributions of source code must retain the above copyright
aedd00
+ *    notice, this list of conditions and the following disclaimer.
aedd00
+ * 2. Redistributions in binary form must reproduce the above copyright
aedd00
+ *    notice, this list of conditions and the following disclaimer in the
aedd00
+ *    documentation and/or other materials provided with the distribution.
aedd00
+ *
aedd00
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
aedd00
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
aedd00
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
aedd00
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
aedd00
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
aedd00
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
aedd00
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
aedd00
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
aedd00
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
aedd00
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
aedd00
+ */
aedd00
+
aedd00
+#ifndef LDAPCONF_H
aedd00
+#define LDAPCONF_H
aedd00
+
aedd00
+#define SSL_OFF          0
aedd00
+#define SSL_LDAPS        1
aedd00
+#define SSL_START_TLS    2
aedd00
+
aedd00
+/* Data structure for representing option data. */
aedd00
+
aedd00
+typedef struct {
aedd00
+	char *host;
aedd00
+	char *uri;
aedd00
+	char *base;
aedd00
+	char *binddn;
aedd00
+	char *bindpw;
aedd00
+	int scope;
aedd00
+	int deref;
aedd00
+	int port;
aedd00
+	int timelimit;
aedd00
+	int bind_timelimit;
aedd00
+	int ldap_version;
aedd00
+	int bind_policy;
aedd00
+	char *sslpath;
aedd00
+	int ssl;
aedd00
+	int referrals;
aedd00
+	int restart;
aedd00
+	int tls_checkpeer;
aedd00
+	char *tls_cacertfile;
aedd00
+	char *tls_cacertdir;
aedd00
+	char *tls_ciphers;
aedd00
+	char *tls_cert;
aedd00
+	char *tls_key;
aedd00
+	char *tls_randfile;
aedd00
+	char *logdir;
aedd00
+	int debug;
aedd00
+	char *ssh_filter;
aedd00
+	char *search_format;
aedd00
+	char *account_class;
aedd00
+}       Options;
aedd00
+
aedd00
+extern Options options;
aedd00
+
aedd00
+void read_config_file(const char *);
aedd00
+void initialize_options(void);
aedd00
+void fill_default_options(void);
aedd00
+void dump_config(void);
aedd00
+
aedd00
+#endif /* LDAPCONF_H */
aedd00
diff -up openssh-6.8p1/ldapincludes.h.ldap openssh-6.8p1/ldapincludes.h
aedd00
--- openssh-6.8p1/ldapincludes.h.ldap	2015-03-18 11:11:29.032801460 +0100
aedd00
+++ openssh-6.8p1/ldapincludes.h	2015-03-18 11:11:29.032801460 +0100
aedd00
@@ -0,0 +1,41 @@
aedd00
+/* $OpenBSD: ldapconf.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
aedd00
+/*
aedd00
+ * Copyright (c) 2009 Jan F. Chadima.  All rights reserved.
aedd00
+ *
aedd00
+ * Redistribution and use in source and binary forms, with or without
aedd00
+ * modification, are permitted provided that the following conditions
aedd00
+ * are met:
aedd00
+ * 1. Redistributions of source code must retain the above copyright
aedd00
+ *    notice, this list of conditions and the following disclaimer.
aedd00
+ * 2. Redistributions in binary form must reproduce the above copyright
aedd00
+ *    notice, this list of conditions and the following disclaimer in the
aedd00
+ *    documentation and/or other materials provided with the distribution.
aedd00
+ *
aedd00
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
aedd00
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
aedd00
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
aedd00
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
aedd00
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
aedd00
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
aedd00
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
aedd00
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
aedd00
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
aedd00
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
aedd00
+ */
aedd00
+
aedd00
+#ifndef LDAPINCLUDES_H
aedd00
+#define LDAPINCLUDES_H
aedd00
+
aedd00
+#include "includes.h"
aedd00
+
aedd00
+#ifdef HAVE_LBER_H
aedd00
+#include <lber.h>
aedd00
+#endif
aedd00
+#ifdef HAVE_LDAP_H
aedd00
+#include <ldap.h>
aedd00
+#endif
aedd00
+#ifdef HAVE_LDAP_SSL_H
aedd00
+#include <ldap_ssl.h>
aedd00
+#endif
aedd00
+
aedd00
+#endif /* LDAPINCLUDES_H */
aedd00
diff -up openssh-6.8p1/ldapmisc.c.ldap openssh-6.8p1/ldapmisc.c
aedd00
--- openssh-6.8p1/ldapmisc.c.ldap	2015-03-18 11:11:29.032801460 +0100
aedd00
+++ openssh-6.8p1/ldapmisc.c	2015-03-18 11:11:29.032801460 +0100
aedd00
@@ -0,0 +1,79 @@
aedd00
+
aedd00
+#include "ldapincludes.h"
aedd00
+#include "ldapmisc.h"
aedd00
+
aedd00
+#ifndef HAVE_LDAP_GET_LDERRNO
aedd00
+int
aedd00
+ldap_get_lderrno (LDAP * ld, char **m, char **s)
aedd00
+{
aedd00
+#ifdef HAVE_LDAP_GET_OPTION
aedd00
+	int rc;
aedd00
+#endif
aedd00
+	int lderrno;
aedd00
+
aedd00
+#if defined(HAVE_LDAP_GET_OPTION) && defined(LDAP_OPT_ERROR_NUMBER)
aedd00
+	if ((rc = ldap_get_option (ld, LDAP_OPT_ERROR_NUMBER, &lderrno)) != LDAP_SUCCESS)
aedd00
+	    return rc;
aedd00
+#else
aedd00
+	lderrno = ld->ld_errno;
aedd00
+#endif
aedd00
+
aedd00
+	if (s != NULL) {
aedd00
+#if defined(HAVE_LDAP_GET_OPTION) && defined(LDAP_OPT_ERROR_STRING)
aedd00
+		if ((rc = ldap_get_option (ld, LDAP_OPT_ERROR_STRING, s)) != LDAP_SUCCESS)
aedd00
+		    return rc;
aedd00
+#else
aedd00
+		*s = ld->ld_error;
aedd00
+#endif
aedd00
+	}
aedd00
+
aedd00
+	if (m != NULL) {
aedd00
+#if defined(HAVE_LDAP_GET_OPTION) && defined(LDAP_OPT_MATCHED_DN)
aedd00
+		if ((rc = ldap_get_option (ld, LDAP_OPT_MATCHED_DN, m)) != LDAP_SUCCESS)
aedd00
+		    return rc;
aedd00
+#else
aedd00
+		*m = ld->ld_matched;
aedd00
+#endif
aedd00
+	}
aedd00
+
aedd00
+	return lderrno;
aedd00
+}
aedd00
+#endif
aedd00
+
aedd00
+#ifndef HAVE_LDAP_SET_LDERRNO
aedd00
+int
aedd00
+ldap_set_lderrno (LDAP * ld, int lderrno, const char *m, const char *s)
aedd00
+{
aedd00
+#ifdef HAVE_LDAP_SET_OPTION
aedd00
+	int rc;
aedd00
+#endif
aedd00
+
aedd00
+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_ERROR_NUMBER)
aedd00
+	if ((rc = ldap_set_option (ld, LDAP_OPT_ERROR_NUMBER, &lderrno)) != LDAP_SUCCESS)
aedd00
+	    return rc;
aedd00
+#else
aedd00
+	ld->ld_errno = lderrno;
aedd00
+#endif
aedd00
+
aedd00
+	if (s != NULL) {
aedd00
+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_ERROR_STRING)
aedd00
+		if ((rc = ldap_set_option (ld, LDAP_OPT_ERROR_STRING, s)) != LDAP_SUCCESS)
aedd00
+		    return rc;
aedd00
+#else
aedd00
+		ld->ld_error = s;
aedd00
+#endif
aedd00
+	}
aedd00
+
aedd00
+	if (m != NULL) {
aedd00
+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_MATCHED_DN)
aedd00
+		if ((rc = ldap_set_option (ld, LDAP_OPT_MATCHED_DN, m)) != LDAP_SUCCESS)
aedd00
+		    return rc;
aedd00
+#else
aedd00
+		ld->ld_matched = m;
aedd00
+#endif
aedd00
+	}
aedd00
+
aedd00
+	return LDAP_SUCCESS;
aedd00
+}
aedd00
+#endif
aedd00
+
aedd00
diff -up openssh-6.8p1/ldapmisc.h.ldap openssh-6.8p1/ldapmisc.h
aedd00
--- openssh-6.8p1/ldapmisc.h.ldap	2015-03-18 11:11:29.032801460 +0100
aedd00
+++ openssh-6.8p1/ldapmisc.h	2015-03-18 11:11:29.032801460 +0100
aedd00
@@ -0,0 +1,35 @@
aedd00
+/* $OpenBSD: ldapbody.h,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
aedd00
+/*
aedd00
+ * Copyright (c) 2009 Jan F. Chadima.  All rights reserved.
aedd00
+ *
aedd00
+ * Redistribution and use in source and binary forms, with or without
aedd00
+ * modification, are permitted provided that the following conditions
aedd00
+ * are met:
aedd00
+ * 1. Redistributions of source code must retain the above copyright
aedd00
+ *    notice, this list of conditions and the following disclaimer.
aedd00
+ * 2. Redistributions in binary form must reproduce the above copyright
aedd00
+ *    notice, this list of conditions and the following disclaimer in the
aedd00
+ *    documentation and/or other materials provided with the distribution.
aedd00
+ *
aedd00
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
aedd00
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
aedd00
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
aedd00
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
aedd00
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
aedd00
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
aedd00
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
aedd00
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
aedd00
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
aedd00
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
aedd00
+ */
aedd00
+
aedd00
+#ifndef LDAPMISC_H
aedd00
+#define LDAPMISC_H
aedd00
+
aedd00
+#include "ldapincludes.h"
aedd00
+
aedd00
+int ldap_get_lderrno (LDAP *, char **, char **);
aedd00
+int ldap_set_lderrno (LDAP *, int, const char *, const char *);
aedd00
+
aedd00
+#endif /* LDAPMISC_H */
aedd00
+
aedd00
diff -up openssh-6.8p1/openssh-lpk-openldap.schema.ldap openssh-6.8p1/openssh-lpk-openldap.schema
aedd00
--- openssh-6.8p1/openssh-lpk-openldap.schema.ldap	2015-03-18 11:11:29.033801457 +0100
aedd00
+++ openssh-6.8p1/openssh-lpk-openldap.schema	2015-03-18 11:11:29.033801457 +0100
aedd00
@@ -0,0 +1,21 @@
aedd00
+#
aedd00
+# LDAP Public Key Patch schema for use with openssh-ldappubkey
aedd00
+#                              useful with PKA-LDAP also
aedd00
+#
aedd00
+# Author: Eric AUGE <eau@phear.org>
aedd00
+# 
aedd00
+# Based on the proposal of : Mark Ruijter
aedd00
+#
aedd00
+
aedd00
+
aedd00
+# octetString SYNTAX
aedd00
+attributetype ( 1.3.6.1.4.1.24552.500.1.1.1.13 NAME 'sshPublicKey' 
aedd00
+	DESC 'MANDATORY: OpenSSH Public key' 
aedd00
+	EQUALITY octetStringMatch
aedd00
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
aedd00
+
aedd00
+# printableString SYNTAX yes|no
aedd00
+objectclass ( 1.3.6.1.4.1.24552.500.1.1.2.0 NAME 'ldapPublicKey' SUP top AUXILIARY
aedd00
+	DESC 'MANDATORY: OpenSSH LPK objectclass'
aedd00
+	MUST ( sshPublicKey $ uid ) 
aedd00
+	)
aedd00
diff -up openssh-6.8p1/openssh-lpk-sun.schema.ldap openssh-6.8p1/openssh-lpk-sun.schema
aedd00
--- openssh-6.8p1/openssh-lpk-sun.schema.ldap	2015-03-18 11:11:29.033801457 +0100
aedd00
+++ openssh-6.8p1/openssh-lpk-sun.schema	2015-03-18 11:11:29.033801457 +0100
aedd00
@@ -0,0 +1,23 @@
aedd00
+#
aedd00
+# LDAP Public Key Patch schema for use with openssh-ldappubkey
aedd00
+#                              useful with PKA-LDAP also
aedd00
+#
aedd00
+# Author: Eric AUGE <eau@phear.org>
aedd00
+# 
aedd00
+# Schema for Sun Directory Server.
aedd00
+# Based on the original schema, modified by Stefan Fischer.
aedd00
+#
aedd00
+
aedd00
+dn: cn=schema
aedd00
+
aedd00
+# octetString SYNTAX
aedd00
+attributeTypes: ( 1.3.6.1.4.1.24552.500.1.1.1.13 NAME 'sshPublicKey' 
aedd00
+	DESC 'MANDATORY: OpenSSH Public key' 
aedd00
+	EQUALITY octetStringMatch
aedd00
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
aedd00
+
aedd00
+# printableString SYNTAX yes|no
aedd00
+objectClasses: ( 1.3.6.1.4.1.24552.500.1.1.2.0 NAME 'ldapPublicKey' SUP top AUXILIARY
aedd00
+	DESC 'MANDATORY: OpenSSH LPK objectclass'
aedd00
+	MUST ( sshPublicKey $ uid ) 
aedd00
+	)
aedd00
diff -up openssh-6.8p1/ssh-ldap-helper.8.ldap openssh-6.8p1/ssh-ldap-helper.8
aedd00
--- openssh-6.8p1/ssh-ldap-helper.8.ldap	2015-03-18 11:11:29.033801457 +0100
aedd00
+++ openssh-6.8p1/ssh-ldap-helper.8	2015-03-18 11:11:29.033801457 +0100
aedd00
@@ -0,0 +1,79 @@
aedd00
+.\" $OpenBSD: ssh-ldap-helper.8,v 1.1 2010/02/10 23:20:38 markus Exp $
aedd00
+.\"
aedd00
+.\" Copyright (c) 2010 Jan F. Chadima.  All rights reserved.
aedd00
+.\"
aedd00
+.\" Permission to use, copy, modify, and distribute this software for any
aedd00
+.\" purpose with or without fee is hereby granted, provided that the above
aedd00
+.\" copyright notice and this permission notice appear in all copies.
aedd00
+.\"
aedd00
+.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
aedd00
+.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
aedd00
+.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
aedd00
+.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
aedd00
+.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
aedd00
+.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
aedd00
+.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
aedd00
+.\"
aedd00
+.Dd $Mdocdate: April 29 2010 $
aedd00
+.Dt SSH-LDAP-HELPER 8
aedd00
+.Os
aedd00
+.Sh NAME
aedd00
+.Nm ssh-ldap-helper
aedd00
+.Nd sshd helper program for ldap support
aedd00
+.Sh SYNOPSIS
aedd00
+.Nm ssh-ldap-helper
aedd00
+.Op Fl devw
aedd00
+.Op Fl f Ar file
aedd00
+.Op Fl s Ar user
aedd00
+.Sh DESCRIPTION
aedd00
+.Nm
aedd00
+is used by
aedd00
+.Xr sshd 1
aedd00
+to access keys provided by an LDAP.
aedd00
+.Nm
aedd00
+is disabled by default and can only be enabled in the
aedd00
+sshd configuration file
aedd00
+.Pa /etc/ssh/sshd_config
aedd00
+by setting
aedd00
+.Cm AuthorizedKeysCommand
aedd00
+to
aedd00
+.Dq /usr/libexec/ssh-ldap-wrapper .
aedd00
+.Pp
aedd00
+.Nm
aedd00
+is not intended to be invoked by the user, but from
aedd00
+.Xr sshd 8 via
aedd00
+.Xr ssh-ldap-wrapper .
aedd00
+.Pp
aedd00
+The options are as follows:
aedd00
+.Bl -tag -width Ds
aedd00
+.It Fl d
aedd00
+Set the debug mode; 
aedd00
+.Nm
aedd00
+prints all logs to stderr instead of syslog.
aedd00
+.It Fl e
aedd00
+Implies \-w;
aedd00
+.Nm
aedd00
+halts if it encounters an unknown item in the ldap.conf file.
aedd00
+.It Fl f
aedd00
+.Nm
aedd00
+uses this file as the ldap configuration file instead of /etc/ssh/ldap.conf (default).
aedd00
+.It Fl s
aedd00
+.Nm
aedd00
+prints out the user's keys to stdout and exits.
aedd00
+.It Fl v
aedd00
+Implies \-d;
aedd00
+increases verbosity.
aedd00
+.It Fl w
aedd00
+.Nm
aedd00
+writes warnings about unknown items in the ldap.conf configuration file.
aedd00
+.El
aedd00
+.Sh SEE ALSO
aedd00
+.Xr sshd 8 ,
aedd00
+.Xr sshd_config 5 ,
aedd00
+.Xr ssh-ldap.conf 5 ,
aedd00
+.Sh HISTORY
aedd00
+.Nm
aedd00
+first appeared in
aedd00
+OpenSSH 5.5 + PKA-LDAP .
aedd00
+.Sh AUTHORS
aedd00
+.An Jan F. Chadima Aq jchadima@redhat.com
aedd00
diff -up openssh-6.8p1/ssh-ldap-wrapper.ldap openssh-6.8p1/ssh-ldap-wrapper
aedd00
--- openssh-6.8p1/ssh-ldap-wrapper.ldap	2015-03-18 11:11:29.033801457 +0100
aedd00
+++ openssh-6.8p1/ssh-ldap-wrapper	2015-03-18 11:11:29.033801457 +0100
aedd00
@@ -0,0 +1,4 @@
aedd00
+#!/bin/sh
aedd00
+
aedd00
+exec /usr/libexec/openssh/ssh-ldap-helper -s "$1"
aedd00
+
aedd00
diff -up openssh-6.8p1/ssh-ldap.conf.5.ldap openssh-6.8p1/ssh-ldap.conf.5
aedd00
--- openssh-6.8p1/ssh-ldap.conf.5.ldap	2015-03-18 11:11:29.033801457 +0100
aedd00
+++ openssh-6.8p1/ssh-ldap.conf.5	2015-03-18 11:11:29.033801457 +0100
aedd00
@@ -0,0 +1,385 @@
aedd00
+.\" $OpenBSD: ssh-ldap.conf.5,v 1.1 2010/02/10 23:20:38 markus Exp $
aedd00
+.\"
aedd00
+.\" Copyright (c) 2010 Jan F. Chadima.  All rights reserved.
aedd00
+.\"
aedd00
+.\" Permission to use, copy, modify, and distribute this software for any
aedd00
+.\" purpose with or without fee is hereby granted, provided that the above
aedd00
+.\" copyright notice and this permission notice appear in all copies.
aedd00
+.\"
aedd00
+.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
aedd00
+.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
aedd00
+.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
aedd00
+.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
aedd00
+.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
aedd00
+.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
aedd00
+.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
aedd00
+.\"
aedd00
+.Dd $Mdocdate: may 12 2010 $
aedd00
+.Dt SSH-LDAP.CONF 5
aedd00
+.Os
aedd00
+.Sh NAME
aedd00
+.Nm ssh-ldap.conf
aedd00
+.Nd configuration file for ssh-ldap-helper
aedd00
+.Sh SYNOPSIS
aedd00
+.Nm /etc/ssh/ldap.conf
aedd00
+.Sh DESCRIPTION
aedd00
+.Xr ssh-ldap-helper 8
aedd00
+reads configuration data from
aedd00
+.Pa /etc/ssh/ldap.conf
aedd00
+(or the file specified with
aedd00
+.Fl f
aedd00
+on the command line).
aedd00
+The file contains keyword-argument pairs, one per line.
aedd00
+Lines starting with
aedd00
+.Ql #
aedd00
+and empty lines are interpreted as comments.
aedd00
+.Pp
aedd00
+The value starts with the first non-blank character after 
aedd00
+the keyword's name, and terminates at the end of the line, 
aedd00
+or at the last sequence of blanks before the end of the line.
aedd00
+Quoting values that contain blanks 
aedd00
+may be incorrect, as the quotes would become part of the value.
aedd00
+The possible keywords and their meanings are as follows (note that
aedd00
+keywords are case-insensitive, and arguments, on a case by case basis, may be case-sensitive).
aedd00
+.Bl -tag -width Ds
aedd00
+.It Cm URI
aedd00
+The argument(s) are in the form
aedd00
+.Pa ldap[si]://[name[:port]]
aedd00
+and specify the URI(s) of an LDAP server(s) to which the
aedd00
+.Xr ssh-ldap-helper 8 
aedd00
+should connect. The URI scheme may be any of
aedd00
+.Dq ldap ,
aedd00
+.Dq ldaps 
aedd00
+or
aedd00
+.Dq ldapi ,
aedd00
+which refer to LDAP over TCP, LDAP over SSL (TLS) and LDAP
aedd00
+over IPC (UNIX domain sockets), respectively.
aedd00
+Each server's name can be specified as a
aedd00
+domain-style name or an IP address literal.  Optionally, the
aedd00
+server's name can followed by a ':' and the port number the LDAP
aedd00
+server is listening on.  If no port number is provided, the default
aedd00
+port for the scheme is used (389 for ldap://, 636 for ldaps://).
aedd00
+For LDAP over IPC, name is the name of the socket, and no port
aedd00
+is required, nor allowed; note that directory separators must be 
aedd00
+URL-encoded, like any other characters that are special to URLs; 
aedd00
+A space separated list of URIs may be provided.
aedd00
+There is no default.
aedd00
+.It Cm Base
aedd00
+Specifies the default base Distinguished Name (DN) to use when performing ldap operations.
aedd00
+The base must be specified as a DN in LDAP format.
aedd00
+There is no default.
aedd00
+.It Cm BindDN
aedd00
+Specifies the default BIND DN to use when connecting to the ldap server.
aedd00
+The bind DN must be specified as a Distinguished Name in LDAP format.
aedd00
+There is no default.
aedd00
+.It Cm BindPW
aedd00
+Specifies the default password to use when connecting to the ldap server via
aedd00
+.Cm BindDN .
aedd00
+There is no default.
aedd00
+.It Cm RootBindDN
aedd00
+Intentionaly does nothing. Recognized for compatibility reasons.
aedd00
+.It Cm Host
aedd00
+The argument(s) specifies the name(s) of an LDAP server(s) to which the
aedd00
+.Xr ssh-ldap-helper 8
aedd00
+should connect.  Each server's name can be specified as a
aedd00
+domain-style name or an IP address and optionally followed by a ':' and
aedd00
+the port number the ldap server is listening on.  A space-separated
aedd00
+list of hosts may be provided.
aedd00
+There is no default.
aedd00
+.Cm Host
aedd00
+is deprecated in favor of
aedd00
+.Cm URI .
aedd00
+.It Cm Port
aedd00
+Specifies the default port used when connecting to LDAP servers(s).
aedd00
+The port may be specified as a number.
aedd00
+The default port is 389 for ldap:// or 636 for ldaps:// respectively.
aedd00
+.Cm Port
aedd00
+is deprecated in favor of
aedd00
+.Cm URI .
aedd00
+.It Cm Scope
aedd00
+Specifies the starting point of an LDAP search and the depth from the base DN to which the search should descend.
aedd00
+There are three options (values) that can be assigned to the
aedd00
+.Cm Scope parameter:
aedd00
+.Dq base ,
aedd00
+.Dq one
aedd00
+and
aedd00
+.Dq subtree .
aedd00
+Alias for the subtree is
aedd00
+.Dq sub .
aedd00
+The value
aedd00
+.Dq base
aedd00
+is used to indicate searching only the entry at the base DN, resulting in only that entry being returned (keeping in mind that it also has to meet the search filter criteria!).
aedd00
+The value
aedd00
+.Dq one
aedd00
+is used to indicate searching all entries one level under the base DN, but not including the base DN and not including any entries under that one level under the base DN.
aedd00
+The value
aedd00
+.Dq subtree
aedd00
+is used to indicate searching of all entries at all levels under and including the specified base DN.
aedd00
+The default is
aedd00
+.Dq subtree .
aedd00
+.It Cm Deref
aedd00
+Specifies how alias dereferencing is done when performing a search. There are four
aedd00
+possible values that can be assigned to the
aedd00
+.Cm Deref
aedd00
+parameter:
aedd00
+.Dq never ,
aedd00
+.Dq searching ,
aedd00
+.Dq finding ,
aedd00
+and
aedd00
+.Dq always .
aedd00
+The value
aedd00
+.Dq never
aedd00
+means that the aliases are never dereferenced.
aedd00
+The value
aedd00
+.Dq searching
aedd00
+means that the aliases are dereferenced in subordinates of the base object, but
aedd00
+not in locating the base object of the search.
aedd00
+The value
aedd00
+.Dq finding
aedd00
+means that the aliases are only dereferenced when locating the base object of the search.
aedd00
+The value
aedd00
+.Dq always
aedd00
+means that the aliases are dereferenced both in searching and in locating the base object
aedd00
+of the search.
aedd00
+The default is
aedd00
+.Dq never .
aedd00
+.It Cm TimeLimit
aedd00
+Specifies a time limit (in seconds) to use when performing searches.
aedd00
+The number should be a non-negative integer. A
aedd00
+.Cm TimeLimit
aedd00
+of zero (0) specifies that the search time is unlimited. Please note that the server
aedd00
+may still apply any server-side limit on the duration of a search operation.
aedd00
+The default value is 10.
aedd00
+.It Cm TimeOut
aedd00
+Is an aliast to
aedd00
+.Cm TimeLimit .
aedd00
+.It Cm Bind_TimeLimit
aedd00
+Specifies the timeout (in seconds) after which the poll(2)/select(2)
aedd00
+following a connect(2) returns in case of no activity.
aedd00
+The default value is 10.
aedd00
+.It Cm Network_TimeOut
aedd00
+Is an alias to
aedd00
+.Cm Bind_TimeLimit .
aedd00
+.It Cm Ldap_Version
aedd00
+Specifies what version of the LDAP protocol should be used.
aedd00
+The allowed values are 2 or 3. The default is 3.
aedd00
+.It Cm Version
aedd00
+Is an alias to
aedd00
+.Cm Ldap_Version .
aedd00
+.It Cm Bind_Policy
aedd00
+Specifies the policy to use for reconnecting to an unavailable LDAP server. There are 2 available values:
aedd00
+.Dq hard
aedd00
+and
aedd00
+.Dq soft.
aedd00
+.Dq hard has 2 aliases
aedd00
+.Dq hard_open
aedd00
+and
aedd00
+.Dq hard_init .
aedd00
+The value
aedd00
+.Dq hard
aedd00
+means that reconects that the
aedd00
+.Xr ssh-ldap-helper 8
aedd00
+tries to reconnect to the LDAP server 5 times before failure. There is exponential backoff before retrying.
aedd00
+The value
aedd00
+.Dq soft
aedd00
+means that
aedd00
+.Xr ssh-ldap-helper 8
aedd00
+fails immediately when it cannot connect to the LDAP seerver.
aedd00
+The deault is
aedd00
+.Dq hard .
aedd00
+.It Cm SSLPath
aedd00
+Specifies the path to the X.509 certificate database.
aedd00
+There is no default.
aedd00
+.It Cm SSL
aedd00
+Specifies whether to use SSL/TLS or not.
aedd00
+There are three allowed values:
aedd00
+.Dq yes ,
aedd00
+.Dq no
aedd00
+and
aedd00
+.Dq start_tls
aedd00
+Both
aedd00
+.Dq true
aedd00
+and
aedd00
+.Dq on
aedd00
+are the aliases for
aedd00
+.Dq yes .
aedd00
+.Dq false
aedd00
+and
aedd00
+.Dq off
aedd00
+are the aliases for
aedd00
+.Dq no .
aedd00
+If
aedd00
+.Dq start_tls
aedd00
+is specified then StartTLS is used rather than raw LDAP over SSL.
aedd00
+The default for ldap:// is
aedd00
+.Dq start_tls ,
aedd00
+for ldaps://
aedd00
+.Dq yes
aedd00
+and
aedd00
+.Dq no
aedd00
+for the ldapi:// .
aedd00
+In case of host based configuration the default is
aedd00
+.Dq start_tls .
aedd00
+.It Cm Referrals
aedd00
+Specifies if the client should automatically follow referrals returned
aedd00
+by LDAP servers.
aedd00
+The value can be or
aedd00
+.Dq yes
aedd00
+or
aedd00
+.Dq no .
aedd00
+.Dq true
aedd00
+and
aedd00
+.Dq on
aedd00
+are the aliases for
aedd00
+.Dq yes .
aedd00
+.Dq false
aedd00
+and
aedd00
+.Dq off
aedd00
+are the aliases for
aedd00
+.Dq no .
aedd00
+The default is yes.
aedd00
+.It Cm Restart
aedd00
+Specifies whether the LDAP client library should restart the select(2) system call when interrupted.
aedd00
+The value can be or
aedd00
+.Dq yes
aedd00
+or
aedd00
+.Dq no .
aedd00
+.Dq true
aedd00
+and
aedd00
+.Dq on
aedd00
+are the aliases for
aedd00
+.Dq yes .
aedd00
+.Dq false
aedd00
+and
aedd00
+.Dq off
aedd00
+are the aliases for
aedd00
+.Dq no .
aedd00
+The default is yes.
aedd00
+.It Cm TLS_CheckPeer
aedd00
+Specifies what checks to perform on server certificates in a TLS session,
aedd00
+if any. The value
aedd00
+can be specified as one of the following keywords:
aedd00
+.Dq never ,
aedd00
+.Dq hard ,
aedd00
+.Dq demand ,
aedd00
+.Dq allow
aedd00
+and
aedd00
+.Dq try .
aedd00
+.Dq true ,
aedd00
+.Dq on
aedd00
+and
aedd00
+.Dq yes
aedd00
+are aliases for
aedd00
+.Dq hard .
aedd00
+.Dq false ,
aedd00
+.Dq off
aedd00
+and
aedd00
+.Dq no
aedd00
+are the aliases for
aedd00
+.Dq never .
aedd00
+The value
aedd00
+.Dq never
aedd00
+means that the client will not request or check any server certificate.
aedd00
+The value
aedd00
+.Dq allow
aedd00
+means that the server certificate is requested. If no certificate is provided,
aedd00
+the session proceeds normally. If a bad certificate is provided, it will
aedd00
+be ignored and the session proceeds normally.
aedd00
+The value
aedd00
+.Dq try
aedd00
+means that the server certificate is requested. If no certificate is provided,
aedd00
+the session proceeds normally. If a bad certificate is provided,
aedd00
+the session is immediately terminated.
aedd00
+The value
aedd00
+.Dq demand
aedd00
+means that the server certificate is requested. If no
aedd00
+certificate is provided, or a bad certificate is provided, the session
aedd00
+is immediately terminated.
aedd00
+The value
aedd00
+.Dq hard
aedd00
+is the same as
aedd00
+.Dq demand .
aedd00
+It requires an SSL connection. In the case of the plain conection the
aedd00
+session is immediately terminated.
aedd00
+The default is
aedd00
+.Dq hard .
aedd00
+.It Cm TLS_ReqCert
aedd00
+Is an alias for 
aedd00
+.Cm TLS_CheckPeer .
aedd00
+.It Cm TLS_CACertFile
aedd00
+Specifies the file that contains certificates for all of the Certificate
aedd00
+Authorities the client will recognize.
aedd00
+There is no default.
aedd00
+.It Cm TLS_CACert
aedd00
+Is an alias for
aedd00
+.Cm TLS_CACertFile .
aedd00
+.It Cm TLS_CACertDIR
aedd00
+Specifies the path of a directory that contains Certificate Authority
aedd00
+certificates in separate individual files. The
aedd00
+.Cm TLS_CACert
aedd00
+is always used before
aedd00
+.Cm TLS_CACertDir .
aedd00
+The specified directory must be managed with the OpenSSL c_rehash utility.
aedd00
+There is no default.
aedd00
+.It Cm TLS_Ciphers
aedd00
+Specifies acceptable cipher suite and preference order.
aedd00
+The value should be a cipher specification for OpenSSL,
aedd00
+e.g.,
aedd00
+.Dq HIGH:MEDIUM:+SSLv2 .
aedd00
+The default is
aedd00
+.Dq ALL .
aedd00
+.It Cm TLS_Cipher_Suite
aedd00
+Is an alias for
aedd00
+.Cm TLS_Ciphers .
aedd00
+.It Cm TLS_Cert
aedd00
+Specifies the file that contains the client certificate.
aedd00
+There is no default.
aedd00
+.It Cm TLS_Certificate
aedd00
+Is an alias for
aedd00
+.Cm TLS_Cert .
aedd00
+.It Cm TLS_Key
aedd00
+Specifies the file that contains the private key that matches the certificate
aedd00
+stored in the
aedd00
+.Cm TLS_Cert
aedd00
+file. Currently, the private key must not be protected with a password, so
aedd00
+it is of critical importance that the key file is protected carefully.
aedd00
+There is no default.
aedd00
+.It Cm TLS_RandFile
aedd00
+Specifies the file to obtain random bits from when /dev/[u]random is
aedd00
+not available. Generally set to the name of the EGD/PRNGD socket.
aedd00
+The environment variable RANDFILE can also be used to specify the filename.
aedd00
+There is no default.
aedd00
+.It Cm LogDir
aedd00
+Specifies the directory used for logging by the LDAP client library.
aedd00
+There is no default.
aedd00
+.It Cm Debug
aedd00
+Specifies the debug level used for logging by the LDAP client library.
aedd00
+There is no default.
aedd00
+.It Cm SSH_Filter
aedd00
+Specifies the user filter applied on the LDAP search.
aedd00
+The default is no filter.
aedd00
+.It Cm AccountClass
aedd00
+Specifies the LDAP class used to find user accounts.
aedd00
+The default is posixAccount.
aedd00
+.It Cm search_format
aedd00
+Specifies the user format of search string in LDAP substituting %u for user name
aedd00
+and %f for additional ssh filter
aedd00
+.Cm SSH_Filter
aedd00
+(optional).
aedd00
+The default value is (&(objectclass=%c)(objectclass=ldapPublicKey)(uid=%u)%f)
aedd00
+.El
aedd00
+.Sh FILES
aedd00
+.Bl -tag -width Ds
aedd00
+.It Pa  /etc/ssh/ldap.conf
aedd00
+Ldap configuration file for
aedd00
+.Xr ssh-ldap-helper 8 .
aedd00
+.El
aedd00
+.Sh "SEE ALSO"
aedd00
+.Xr ldap.conf 5 ,
aedd00
+.Xr ssh-ldap-helper 8
aedd00
+.Sh HISTORY
aedd00
+.Nm
aedd00
+first appeared in
aedd00
+OpenSSH 5.5 + PKA-LDAP .
aedd00
+.Sh AUTHORS
aedd00
+.An Jan F. Chadima Aq jchadima@redhat.com
aedd00
diff --git a/openssh-lpk-openldap.ldif b/openssh-lpk-openldap.ldif
aedd00
new file mode 100644
aedd00
index 0000000..9adf4b8
aedd00
--- /dev/null
aedd00
+++ b/openssh-lpk-openldap.ldif
aedd00
@@ -0,0 +1,19 @@
aedd00
+#
aedd00
+# LDAP Public Key Patch schema for use with openssh-ldappubkey
aedd00
+#                              useful with PKA-LDAP also
aedd00
+#
aedd00
+# Author: Eric AUGE <eau@phear.org>
aedd00
+#
aedd00
+# LDIF for openLDAP Directory Server.
aedd00
+# Based on the original schema, modified by Jakub Jelen.
aedd00
+#
aedd00
+
aedd00
+dn: cn=openssh-lpk,cn=schema,cn=config
aedd00
+objectClass: olcSchemaConfig
aedd00
+cn: openssh-lpk
aedd00
+olcAttributeTypes: {0}( 1.3.6.1.4.1.24552.500.1.1.1.13
aedd00
+  NAME 'sshPublicKey' DESC 'MANDATORY: OpenSSH Public key'
aedd00
+  EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
aedd00
+olcObjectClasses: {0}( 1.3.6.1.4.1.24552.500.1.1.2.0
aedd00
+  NAME 'ldapPublicKey' DESC 'MANDATORY: OpenSSH LPK objectclass'
aedd00
+  SUP top AUXILIARY MUST ( sshPublicKey $ uid ) )
aedd00
diff --git a/openssh-lpk-sun.ldif b/openssh-lpk-sun.ldif
aedd00
new file mode 100644
aedd00
index 0000000..9adf4b8
aedd00
--- /dev/null
aedd00
+++ b/openssh-lpk-sun.ldif
aedd00
@@ -0,0 +1,17 @@
aedd00
+#
aedd00
+# LDAP Public Key Patch schema for use with openssh-ldappubkey
aedd00
+#                              useful with PKA-LDAP also
aedd00
+#
aedd00
+# Author: Eric AUGE <eau@phear.org>
aedd00
+#
aedd00
+# LDIF for Sun Directory Server.
aedd00
+# Based on the original schema, modified by Jakub Jelen.
aedd00
+#
aedd00
+
aedd00
+dn: cn=schema
aedd00
+attributeTypes: ( 1.3.6.1.4.1.24552.500.1.1.1.13
aedd00
+  NAME 'sshPublicKey' DESC 'MANDATORY: OpenSSH Public key'
aedd00
+  EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
aedd00
+objectClasses: ( 1.3.6.1.4.1.24552.500.1.1.2.0
aedd00
+  NAME 'ldapPublicKey' DESC 'MANDATORY: OpenSSH LPK objectclass'
aedd00
+  SUP top AUXILIARY MUST ( sshPublicKey $ uid ) )