kentpeacock / rpms / openssh

Forked from rpms/openssh 2 years ago
Clone
Dmitry Belyavskiy f32839
diff -up openssh-8.7p1/pathnames.h.kill-scp openssh-8.7p1/pathnames.h
Dmitry Belyavskiy f32839
--- openssh-8.7p1/pathnames.h.kill-scp	2021-09-16 11:37:57.240171687 +0200
Dmitry Belyavskiy f32839
+++ openssh-8.7p1/pathnames.h	2021-09-16 11:42:29.183427917 +0200
Dmitry Belyavskiy f32839
@@ -42,6 +42,7 @@
Dmitry Belyavskiy f32839
 #define _PATH_HOST_XMSS_KEY_FILE	SSHDIR "/ssh_host_xmss_key"
Dmitry Belyavskiy f32839
 #define _PATH_HOST_RSA_KEY_FILE		SSHDIR "/ssh_host_rsa_key"
Dmitry Belyavskiy f32839
 #define _PATH_DH_MODULI			SSHDIR "/moduli"
Dmitry Belyavskiy f32839
+#define _PATH_SCP_KILL_SWITCH		SSHDIR "/disable_scp"
Dmitry Belyavskiy f32839
 
Dmitry Belyavskiy f32839
 #ifndef _PATH_SSH_PROGRAM
Dmitry Belyavskiy f32839
 #define _PATH_SSH_PROGRAM		"/usr/bin/ssh"
Dmitry Belyavskiy f32839
diff -up openssh-8.7p1/scp.1.kill-scp openssh-8.7p1/scp.1
Dmitry Belyavskiy f32839
--- openssh-8.7p1/scp.1.kill-scp	2021-09-16 12:09:02.646714578 +0200
Dmitry Belyavskiy f32839
+++ openssh-8.7p1/scp.1	2021-09-16 12:26:49.978628226 +0200
Dmitry Belyavskiy f32839
@@ -278,6 +278,13 @@ to print debugging messages about their
Dmitry Belyavskiy f32839
 This is helpful in
Dmitry Belyavskiy f32839
 debugging connection, authentication, and configuration problems.
Dmitry Belyavskiy f32839
 .El
Dmitry Belyavskiy f32839
+.Pp
Dmitry Belyavskiy f32839
+Usage of SCP protocol can be blocked by creating a world-readable
Dmitry Belyavskiy f32839
+.Ar /etc/ssh/disable_scp
Dmitry Belyavskiy f32839
+file. If this file exists, when SCP protocol is in use (either remotely or 
Dmitry Belyavskiy f32839
+via the
Dmitry Belyavskiy f32839
+.Fl O
Dmitry Belyavskiy f32839
+option), the program will exit.
Dmitry Belyavskiy f32839
 .Sh EXIT STATUS
Dmitry Belyavskiy f32839
 .Ex -std scp
Dmitry Belyavskiy f32839
 .Sh SEE ALSO
Dmitry Belyavskiy f32839
diff -up openssh-8.7p1/scp.c.kill-scp openssh-8.7p1/scp.c
Dmitry Belyavskiy f32839
--- openssh-8.7p1/scp.c.kill-scp	2021-09-16 11:42:56.013650519 +0200
Dmitry Belyavskiy f32839
+++ openssh-8.7p1/scp.c	2021-09-16 11:53:03.249713836 +0200
Dmitry Belyavskiy f32839
@@ -596,6 +596,14 @@ main(int argc, char **argv)
Dmitry Belyavskiy f32839
 	if (iamremote)
Dmitry Belyavskiy f32839
 		mode = MODE_SCP;
Dmitry Belyavskiy f32839
 
Dmitry Belyavskiy f32839
+	if (mode == MODE_SCP) {
Dmitry Belyavskiy f32839
+		FILE *f = fopen(_PATH_SCP_KILL_SWITCH, "r");
Dmitry Belyavskiy f32839
+		if (f != NULL) {
Dmitry Belyavskiy f32839
+			fclose(f);
Dmitry Belyavskiy f32839
+			fatal("SCP protocol is forbidden via %s", _PATH_SCP_KILL_SWITCH);
Dmitry Belyavskiy f32839
+		}
Dmitry Belyavskiy f32839
+	}
Dmitry Belyavskiy f32839
+
Dmitry Belyavskiy f32839
 	if ((pwd = getpwuid(userid = getuid())) == NULL)
Dmitry Belyavskiy f32839
 		fatal("unknown user %u", (u_int) userid);
Dmitry Belyavskiy f32839