diff -up openssh-6.8p1/HOWTO.ldap-keys.ldap openssh-6.8p1/HOWTO.ldap-keys

--- openssh-6.8p1/HOWTO.ldap-keys.ldap	2015-03-18 11:11:29.029801467 +0100

+++ openssh-6.8p1/HOWTO.ldap-keys	2015-03-18 11:11:29.029801467 +0100

@@ -0,0 +1,122 @@

+

+HOW TO START

+

+1) configure LDAP server

+  * Use LDAP server documentation

+2) add appropriate LDAP schema

+  * For OpenLDAP or SunONE Use attached schema, otherwise you have to create it. 

+  * LDAP user entry

+        User entry:

+	- attached to the 'ldapPublicKey' objectclass

+	- attached to the 'posixAccount' objectclass

+	- with a filled 'sshPublicKey' attribute 

+3) insert users into LDAP

+  * Use LDAP Tree management tool as useful

+  * Entry in the LDAP server must respect 'posixAccount' and 'ldapPublicKey' which are defined in core.schema and the additionnal lpk.schema.

+  * Example:

+	dn: uid=captain,ou=commanders,dc=enterprise,dc=universe

+	objectclass: top

+	objectclass: person

+	objectclass: organizationalPerson

+	objectclass: posixAccount

+	objectclass: ldapPublicKey

+	description: Jonathan Archer

+	userPassword: Porthos

+	cn: onathan Archer

+	sn: onathan Archer

+	uid: captain

+	uidNumber: 1001

+	gidNumber: 1001

+	homeDirectory: /home/captain

+	sshPublicKey: ssh-rss AAAAB3.... =captain@universe

+	sshPublicKey: command="kill -9 1" ssh-rss AAAAM5...

+4) on the ssh side set in sshd_config

+  * Set up the backend

+	AuthorizedKeysCommand /usr/libexec/openssh/ssh-ldap-wrapper

+	AuthorizedKeysCommandUser <appropriate user to run LDAP>

+  * Do not forget to set

+	PubkeyAuthentication yes

+  * Swith off unnecessary auth methods

+5) confugure ldap.conf

+  * Default ldap.conf is placed in /etc/ssh

+  * The configuration style is the same as other ldap based aplications

+6) if necessary edit ssh-ldap-wrapper

+  * There is a possibility to change ldap.conf location

+  * There are some debug options

+  * Example

+	/usr/libexec/openssh -s -f /etc/ldap.conf -w -d >> /tmp/ldapdebuglog.txt

+7) Configure SELinux boolean which allows ldap-helper to bind ldap server

+  Run this command

+  # setsebool -P authlogin_nsswitch_use_ldap on

+

+HOW TO MIGRATE FROM LPK

+

+1) goto HOW TO START 4) .... the ldap schema is the same

+

+2) convert the group requests to the appropriate LDAP requests

+

+HOW TO SOLVE PROBLEMS

+

+1) use debug in sshd

+  * /usr/sbin/sshd -d -d -d -d

+2) use debug in ssh-ldap-helper

+  * ssh-ldap-helper -d -d -d -d -s <username>

+3) use tcpdump ... other ldap client etc.

+

+HOW TO CONFIGURE SSH FOR OTHER LDAP CONFIGURATION / SERVER /SCHEMA

+

+You can adjust search format string in /etc/ldap.conf using

+ 1) SSH_Filter option to limit results for only specified users

+    (this appends search condition after original query)

+ 2) Search_Format option to define your own search string using expansion

+    characters %u for username, %c for objectclass and %f for above mentioned filter.

+

+Example:

+Search_Format (&(objectclass=posixAccount)(objectclass=ldapPublicKey)(uid=%u)%f)

+

+ADVANTAGES

+

+1) Blocking an user account can be done directly from LDAP (if sshd is using PubkeyAuthentication + AuthorizedKeysCommand with ldap only).

+

+DISADVANTAGES

+

+1)  LDAP must be well configured, getting the public key of some user is not a problem, but if anonymous LDAP 

+  allows write to users dn, somebody could replace some user's public key by his own and impersonate some 

+  of your users in all your server farm -- be VERY CAREFUL.

+2) With incomplete PKI the MITM attack when sshd is requesting the public key, could lead to a compromise of your servers allowing login 

+  as the impersonated user.

+3) If LDAP server is down there may be no fallback on passwd auth.

+  

+MISC.

+  

+1) todo

+  * Possibility to reuse the ssh-ldap-helper.

+  * Tune the LDAP part to accept  all possible LDAP configurations.

+

+2) differences from original lpk

+  * No LDAP code in sshd.

+  * Support for various LDAP platforms and configurations.

+  * LDAP is configured in separate ldap.conf file.

+

+3) docs/link 

+  * http://pacsec.jp/core05/psj05-barisani-en.pdf

+  * http://fritz.potsdam.edu/projects/openssh-lpk/

+  * http://fritz.potsdam.edu/projects/sshgate/

+  * http://dev.inversepath.com/trac/openssh-lpk

+  * http://lam.sf.net/ ( http://lam.sourceforge.net/documentation/supportedSchemas.htm )

+

+4) contributors/ideas/greets

+  - Eric AUGE <eau@phear.org>

+  - Andrea Barisani <andrea@inversepath.com>

+  - Falk Siemonsmeier.

+  - Jacob Rief.

+  - Michael Durchgraf.

+  - frederic peters.

+  - Finlay dobbie.

+  - Stefan Fisher.

+  - Robin H. Johnson.

+  - Adrian Bridgett.

+

+5) Author

+    Jan F. Chadima <jchadima@redhat.com>

+

diff -up openssh-6.8p1/Makefile.in.ldap openssh-6.8p1/Makefile.in

--- openssh-6.8p1/Makefile.in.ldap	2015-03-17 06:49:20.000000000 +0100

+++ openssh-6.8p1/Makefile.in	2015-03-18 11:13:10.147561177 +0100

@@ -25,6 +25,8 @@ SSH_PROGRAM=@bindir@/ssh

 ASKPASS_PROGRAM=$(libexecdir)/ssh-askpass

 SFTP_SERVER=$(libexecdir)/sftp-server

 SSH_KEYSIGN=$(libexecdir)/ssh-keysign

+SSH_LDAP_HELPER=$(libexecdir)/ssh-ldap-helper

+SSH_LDAP_WRAPPER=$(libexecdir)/ssh-ldap-wrapper

 SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper

 PRIVSEP_PATH=@PRIVSEP_PATH@

 SSH_PRIVSEP_USER=@SSH_PRIVSEP_USER@

@@ -61,8 +63,9 @@ XAUTH_PATH=@XAUTH_PATH@

 LDFLAGS=-L. -Lopenbsd-compat/ @LDFLAGS@

 EXEEXT=@EXEEXT@

 MANFMT=@MANFMT@

+INSTALL_SSH_LDAP_HELPER=@INSTALL_SSH_LDAP_HELPER@

-TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT)

+TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-ldap-helper$(EXEEXT)

 LIBOPENSSH_OBJS=\

 	ssh_api.o \

@@ -112,8 +115,8 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passw

 	sandbox-null.o sandbox-rlimit.o sandbox-systrace.o sandbox-darwin.o \

 	sandbox-seccomp-filter.o sandbox-capsicum.o

-MANPAGES	= moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-keysign.8.out ssh-pkcs11-helper.8.out sshd_config.5.out ssh_config.5.out

-MANPAGES_IN	= moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-keysign.8 ssh-pkcs11-helper.8 sshd_config.5 ssh_config.5

+MANPAGES	= moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-keysign.8.out ssh-pkcs11-helper.8.out sshd_config.5.out ssh_config.5.out ssh-ldap-helper.8.out ssh-ldap.conf.5.out

+MANPAGES_IN	= moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-keysign.8 ssh-pkcs11-helper.8 sshd_config.5 ssh_config.5 ssh-ldap-helper.8 ssh-ldap.conf.5

 MANTYPE		= @MANTYPE@

 CONFIGFILES=sshd_config.out ssh_config.out moduli.out

@@ -184,6 +187,9 @@ ssh-keysign$(EXEEXT): $(LIBCOMPAT) libss

 ssh-pkcs11-helper$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-pkcs11-helper.o ssh-pkcs11.o

 	$(LD) -o $@ ssh-pkcs11-helper.o ssh-pkcs11.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)

+ssh-ldap-helper$(EXEEXT): $(LIBCOMPAT) libssh.a ldapconf.o ldapbody.o ldapmisc.o ldap-helper.o sshbuf-getput-basic.o ssherr.o

+	$(LD) -o $@ ldapconf.o ldapbody.o ldapmisc.o ldap-helper.o sshbuf-getput-basic.o ssherr.o $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(LIBS)

+

 ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keyscan.o roaming_dummy.o

 	$(LD) -o $@ ssh-keyscan.o roaming_dummy.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)

@@ -311,6 +317,10 @@ install-files:

 	$(INSTALL) -m 0755 $(STRIP_OPT) sshd$(EXEEXT) $(DESTDIR)$(sbindir)/sshd$(EXEEXT)

 	$(INSTALL) -m 4711 $(STRIP_OPT) ssh-keysign$(EXEEXT) $(DESTDIR)$(SSH_KEYSIGN)$(EXEEXT)

 	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-pkcs11-helper$(EXEEXT) $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT)

+	if test ! -z "$(INSTALL_SSH_LDAP_HELPER)" ; then \

+		$(INSTALL) -m 0700 $(STRIP_OPT) ssh-ldap-helper $(DESTDIR)$(SSH_LDAP_HELPER) ; \

+		$(INSTALL) -m 0700 ssh-ldap-wrapper $(DESTDIR)$(SSH_LDAP_WRAPPER) ; \

+	fi

 	$(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT)

 	$(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)

 	$(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1

@@ -327,6 +337,10 @@ install-files:

 	$(INSTALL) -m 644 sftp-server.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8

 	$(INSTALL) -m 644 ssh-keysign.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8

 	$(INSTALL) -m 644 ssh-pkcs11-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8

+	if test ! -z "$(INSTALL_SSH_LDAP_HELPER)" ; then \

+		$(INSTALL) -m 644 ssh-ldap-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-ldap-helper.8 ; \

+		$(INSTALL) -m 644 ssh-ldap.conf.5.out $(DESTDIR)$(mandir)/$(mansubdir)5/ssh-ldap.conf.5 ; \

+	fi

 	-rm -f $(DESTDIR)$(bindir)/slogin

 	ln -s ./ssh$(EXEEXT) $(DESTDIR)$(bindir)/slogin

 	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/slogin.1

@@ -356,6 +370,13 @@ install-sysconf:

 	else \

 		echo "$(DESTDIR)$(sysconfdir)/moduli already exists, install will not overwrite"; \

 	fi

+	if test ! -z "$(INSTALL_SSH_LDAP_HELPER)" ; then \

+		if [ ! -f $(DESTDIR)$(sysconfdir)/ldap.conf ]; then \

+			$(INSTALL) -m 644 ldap.conf $(DESTDIR)$(sysconfdir)/ldap.conf; \

+		else \

+			echo "$(DESTDIR)$(sysconfdir)/ldap.conf already exists, install will not overwrite"; \

+		fi ; \

+	fi

 host-key: ssh-keygen$(EXEEXT)

 	@if [ -z "$(DESTDIR)" ] ; then \

@@ -419,6 +440,8 @@ uninstall:

 	-rm -r $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)

 	-rm -f $(DESTDIR)$(SSH_KEYSIGN)$(EXEEXT)

 	-rm -f $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT)

+	-rm -f $(DESTDIR)$(SSH_LDAP_HELPER)$(EXEEXT)

+	-rm -f $(DESTDIR)$(SSH_LDAP_WRAPPER)$(EXEEXT)

 	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1

 	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/scp.1

 	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-add.1

@@ -430,6 +453,7 @@ uninstall:

 	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8

 	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8

 	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8

+	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-ldap-helper.8

 	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/slogin.1

 regress-prep:

diff -up openssh-6.8p1/configure.ac.ldap openssh-6.8p1/configure.ac

--- openssh-6.8p1/configure.ac.ldap	2015-03-17 06:49:20.000000000 +0100

+++ openssh-6.8p1/configure.ac	2015-03-18 11:11:29.030801464 +0100

@@ -1605,6 +1605,106 @@ if test "x$use_pie" != "xno"; then

 	fi

 fi

+# Check whether user wants LDAP support

+LDAP_MSG="no"

+INSTALL_SSH_LDAP_HELPER=""

+AC_ARG_WITH(ldap,

+	[  --with-ldap[[=PATH]]      Enable LDAP pubkey support (optionally in PATH)],

+	[

+		if test "x$withval" != "xno" ; then

+

+			INSTALL_SSH_LDAP_HELPER="yes"

+			CPPFLAGS="$CPPFLAGS -DLDAP_DEPRECATED"

+

+			if test "x$withval" != "xyes" ; then

+				CPPFLAGS="$CPPFLAGS -I${withval}/include"

+				LDFLAGS="$LDFLAGS -L${withval}/lib"

+			fi

+

+			AC_DEFINE([WITH_LDAP_PUBKEY], 1, [Enable LDAP pubkey support])

+			LDAP_MSG="yes"

+

+			AC_CHECK_HEADERS(lber.h)

+			AC_CHECK_HEADERS(ldap.h, , AC_MSG_ERROR(could not locate <ldap.h>))

+			AC_CHECK_HEADERS(ldap_ssl.h)

+

+			AC_ARG_WITH(ldap-lib,

+				[  --with-ldap-lib=type    select ldap library [auto|netscape5|netscape4|netscape3|umich|openldap]])

+

+			if test -z "$with_ldap_lib"; then

+				with_ldap_lib=auto

+			fi

+

+			if test -z "$found_ldap_lib" -a \( $with_ldap_lib = auto -o $with_ldap_lib = umich -o $with_ldap_lib = openldap \); then

+				AC_CHECK_LIB(lber, main, LIBS="-llber $LIBS" found_ldap_lib=yes)

+				AC_CHECK_LIB(ldap, main, LIBS="-lldap $LIBS" found_ldap_lib=yes)

+			fi

+

+			if test -z "$found_ldap_lib" -a \( $with_ldap_lib = auto -o $with_ldap_lib = netscape5 \); then

+				AC_CHECK_LIB(ldap50, main, LIBS="-lldap50 -lssldap50 -lssl3 -lnss3 -lnspr4 -lprldap50 -lplc4 -lplds4 $LIBS" found_ldap_lib=yes)

+			fi

+

+			if test -z "$found_ldap_lib" -a \( $with_ldap_lib = auto -o $with_ldap_lib = netscape4 \); then

+				AC_CHECK_LIB(ldapssl41, main, LIBS="-lldapssl41 -lplc3 -lplds3 -lnspr3 $LIBS" found_ldap_lib=yes)

+				if test -z "$found_ldap_lib"; then

+					AC_CHECK_LIB(ldapssl40, main, LIBS="-lldapssl40 $LIBS" found_ldap_lib=yes)

+				fi

+				if test -z "$found_ldap_lib"; then

+					AC_CHECK_LIB(ldap41, main, LIBS="-lldap41 $LIBS" found_ldap_lib=yes)

+				fi

+				if test -z "$found_ldap_lib"; then

+					AC_CHECK_LIB(ldap40, main, LIBS="-lldap40 $LIBS" found_ldap_lib=yes)

+				fi

+			fi

+

+			if test -z "$found_ldap_lib" -a \( $with_ldap_lib = auto -o $with_ldap_lib = netscape3 \); then

+				AC_CHECK_LIB(ldapssl30, main, LIBS="-lldapssl30 $LIBS" found_ldap_lib=yes)

+			fi

+

+			if test -z "$found_ldap_lib"; then

+				AC_MSG_ERROR(could not locate a valid LDAP library)

+			fi

+

+			AC_MSG_CHECKING([for working LDAP support])

+			AC_TRY_COMPILE(

+				[#include <sys/types.h>

+				 #include <ldap.h>],

+				[(void)ldap_init(0, 0);],

+				[AC_MSG_RESULT(yes)],

+				[

+				    AC_MSG_RESULT(no) 

+					AC_MSG_ERROR([** Incomplete or missing ldap libraries **])

+				])

+			AC_CHECK_FUNCS( \

+				ldap_init \

+				ldap_get_lderrno \

+				ldap_set_lderrno \

+				ldap_parse_result \

+				ldap_memfree \

+				ldap_controls_free \

+				ldap_set_option \

+				ldap_get_option \

+				ldapssl_init \

+				ldap_start_tls_s \

+				ldap_pvt_tls_set_option \

+				ldap_initialize \

+			)

+			AC_CHECK_FUNCS(ldap_set_rebind_proc,

+				AC_MSG_CHECKING([number arguments of ldap_set_rebind_proc])

+				AC_TRY_COMPILE(

+					[#include <lber.h>

+					#include <ldap.h>],

+					[ldap_set_rebind_proc(0, 0, 0);],

+					[ac_cv_ldap_set_rebind_proc=3],

+					[ac_cv_ldap_set_rebind_proc=2])

+				AC_MSG_RESULT($ac_cv_ldap_set_rebind_proc)

+				AC_DEFINE(LDAP_SET_REBIND_PROC_ARGS, $ac_cv_ldap_set_rebind_proc, [number arguments of ldap_set_rebind_proc])

+			)

+		fi

+	]

+)

+AC_SUBST(INSTALL_SSH_LDAP_HELPER)

+

 dnl    Checks for library functions. Please keep in alphabetical order

 AC_CHECK_FUNCS([ \

 	Blowfish_initstate \

diff -up openssh-6.8p1/ldap-helper.c.ldap openssh-6.8p1/ldap-helper.c

--- openssh-6.8p1/ldap-helper.c.ldap	2015-03-18 11:11:29.030801464 +0100

+++ openssh-6.8p1/ldap-helper.c	2015-03-18 11:11:29.030801464 +0100

@@ -0,0 +1,155 @@

+/* $OpenBSD: ssh-pka-ldap.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */

+/*

+ * Copyright (c) 2009 Jan F. Chadima.  All rights reserved.

+ *

+ * Redistribution and use in source and binary forms, with or without

+ * modification, are permitted provided that the following conditions

+ * are met:

+ * 1. Redistributions of source code must retain the above copyright

+ *    notice, this list of conditions and the following disclaimer.

+ * 2. Redistributions in binary form must reproduce the above copyright

+ *    notice, this list of conditions and the following disclaimer in the

+ *    documentation and/or other materials provided with the distribution.

+ *

+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR

+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES

+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.

+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,

+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,

+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY

+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF

+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

+ */

+

+#include "ldapincludes.h"

+#include "log.h"

+#include "misc.h"

+#include "xmalloc.h"

+#include "ldapconf.h"

+#include "ldapbody.h"

+#include <string.h>

+#include <unistd.h>

+

+static int config_debug = 0;

+int config_exclusive_config_file = 0;

+static char *config_file_name = "/etc/ssh/ldap.conf";

+static char *config_single_user = NULL;

+static int config_verbose = SYSLOG_LEVEL_VERBOSE;

+int config_warning_config_file = 0;

+extern char *__progname;

+

+static void

+usage(void)

+{

+	fprintf(stderr, "usage: %s [options]\n",

+	    __progname);

+	fprintf(stderr, "Options:\n");

+	fprintf(stderr, "  -d          Output the log messages to stderr.\n");

+	fprintf(stderr, "  -e          Check the config file for unknown commands.\n");

+	fprintf(stderr, "  -f file     Use alternate config file (default is /etc/ssh/ldap.conf).\n");

+	fprintf(stderr, "  -s user     Do not demonize, send the user's key to stdout.\n");

+	fprintf(stderr, "  -v          Increase verbosity of the debug output (implies -d).\n");

+	fprintf(stderr, "  -w          Warn on unknown commands in the config file.\n");

+	exit(1);

+}

+

+/*

+ * Main program for the ssh pka ldap agent.

+ */

+

+int

+main(int ac, char **av)

+{

+	int opt;

+	FILE *outfile = NULL;

+

+	__progname = ssh_get_progname(av[0]);

+

+	log_init(__progname, SYSLOG_LEVEL_DEBUG3, SYSLOG_FACILITY_AUTH, 0);

+

+	/*

+	 * Initialize option structure to indicate that no values have been

+	 * set.

+	 */

+	initialize_options();

+

+	/* Parse command-line arguments. */

+	while ((opt = getopt(ac, av, "def:s:vw")) != -1) {

+		switch (opt) {

+		case 'd':

+			config_debug = 1;

+			break;

+

+		case 'e':

+			config_exclusive_config_file = 1;

+			config_warning_config_file = 1;

+			break;

+

+		case 'f':

+			config_file_name = optarg;

+			break;

+

+		case 's':

+			config_single_user = optarg;

+			outfile = fdopen (dup (fileno (stdout)), "w");

+			break;

+

+		case 'v':

+			config_debug = 1;

+			if (config_verbose < SYSLOG_LEVEL_DEBUG3)

+			    config_verbose++;

+			break;

+

+		case 'w':

+			config_warning_config_file = 1;

+			break;

+

+		case '?':

+		default:

+			usage();

+			break;

+		}

+	}

+

+	/* Initialize loging */

+	log_init(__progname, config_verbose, SYSLOG_FACILITY_AUTH, config_debug);

+

+	if (ac != optind)

+	    fatal ("illegal extra parameter %s", av[1]);

+

+	/* Ensure that fds 0 and 2 are open or directed to /dev/null */

+	if (config_debug == 0)

+	    sanitise_stdfd();

+

+	/* Read config file */

+	read_config_file(config_file_name);

+	fill_default_options();

+	if (config_verbose == SYSLOG_LEVEL_DEBUG3) {

+		debug3 ("=== Configuration ===");

+		dump_config();

+		debug3 ("=== *** ===");

+	}

+

+	ldap_checkconfig();

+	ldap_do_connect();

+

+	if (config_single_user) {

+		process_user (config_single_user, outfile);

+	} else {

+		usage();

+		fatal ("Not yet implemented");

+/* TODO

+ * open unix socket a run the loop on it

+ */

+	}

+

+	ldap_do_close();

+	return 0;

+}

+

+/* Ugly hack */

+void   *buffer_get_string(Buffer *b, u_int *l) { return NULL; }

+void    buffer_put_string(Buffer *b, const void *f, u_int l) {}

+

diff -up openssh-6.8p1/ldap-helper.h.ldap openssh-6.8p1/ldap-helper.h

--- openssh-6.8p1/ldap-helper.h.ldap	2015-03-18 11:11:29.031801462 +0100

+++ openssh-6.8p1/ldap-helper.h	2015-03-18 11:11:29.031801462 +0100

@@ -0,0 +1,32 @@

+/* $OpenBSD: ldap-helper.h,v 1.1 2009/12/03 03:34:42 jfch Exp $ */

+/*

+ * Copyright (c) 2009 Jan F. Chadima.  All rights reserved.

+ *

+ * Redistribution and use in source and binary forms, with or without

+ * modification, are permitted provided that the following conditions

+ * are met:

+ * 1. Redistributions of source code must retain the above copyright

+ *    notice, this list of conditions and the following disclaimer.

+ * 2. Redistributions in binary form must reproduce the above copyright

+ *    notice, this list of conditions and the following disclaimer in the

+ *    documentation and/or other materials provided with the distribution.

+ *

+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR

+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES

+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.

+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,

+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,

+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY

+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF

+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

+ */

+

+#ifndef LDAP_HELPER_H

+#define LDAP_HELPER_H

+

+extern int config_exclusive_config_file;

+extern int config_warning_config_file;

+

+#endif /* LDAP_HELPER_H */

diff -up openssh-6.8p1/ldap.conf.ldap openssh-6.8p1/ldap.conf

--- openssh-6.8p1/ldap.conf.ldap	2015-03-18 11:11:29.031801462 +0100

+++ openssh-6.8p1/ldap.conf	2015-03-18 11:11:29.031801462 +0100

@@ -0,0 +1,95 @@

+# $Id: openssh-5.5p1-ldap.patch,v 1.3 2010/07/07 13:48:36 jfch2222 Exp $

+#

+# This is the example configuration file for the OpenSSH

+# LDAP backend

+# 

+# see ssh-ldap.conf(5)

+#

+

+# URI with your LDAP server name. This allows to use

+# Unix Domain Sockets to connect to a local LDAP Server.

+#uri ldap://127.0.0.1/

+#uri ldaps://127.0.0.1/   

+#uri ldapi://%2fvar%2frun%2fldapi_sock/

+# Note: %2f encodes the '/' used as directory separator

+

+# Another way to specify your LDAP server is to provide an

+# host name and the port of our LDAP server. Host name

+# must be resolvable without using LDAP.

+# Multiple hosts may be specified, each separated by a 

+# space. How long nss_ldap takes to failover depends on

+# whether your LDAP client library supports configurable

+# network or connect timeouts (see bind_timelimit).

+#host 127.0.0.1

+

+# The port.

+# Optional: default is 389.

+#port 389

+

+# The distinguished name to bind to the server with.

+# Optional: default is to bind anonymously.

+#binddn cn=openssh_keys,dc=example,dc=org

+

+# The credentials to bind with. 

+# Optional: default is no credential.

+#bindpw TopSecret

+

+# The distinguished name of the search base.

+#base dc=example,dc=org

+

+# The LDAP version to use (defaults to 3

+# if supported by client library)

+#ldap_version 3

+

+# The search scope.

+#scope sub

+#scope one

+#scope base

+

+# Search timelimit

+#timelimit 30

+

+# Bind/connect timelimit

+#bind_timelimit 30

+

+# Reconnect policy: hard (default) will retry connecting to

+# the software with exponential backoff, soft will fail

+# immediately.

+#bind_policy hard

+

+# SSL setup, may be implied by URI also.

+#ssl no

+#ssl on

+#ssl start_tls

+

+# OpenLDAP SSL options

+# Require and verify server certificate (yes/no)

+# Default is to use libldap's default behavior, which can be configured in

+# /etc/openldap/ldap.conf using the TLS_REQCERT setting.  The default for

+# OpenLDAP 2.0 and earlier is "no", for 2.1 and later is "yes".

+#tls_checkpeer hard

+

+# CA certificates for server certificate verification

+# At least one of these are required if tls_checkpeer is "yes"

+#tls_cacertfile /etc/ssl/ca.cert

+#tls_cacertdir /etc/pki/tls/certs

+

+# Seed the PRNG if /dev/urandom is not provided

+#tls_randfile /var/run/egd-pool

+

+# SSL cipher suite

+# See man ciphers for syntax

+#tls_ciphers TLSv1

+

+# Client certificate and key

+# Use these, if your server requires client authentication.

+#tls_cert

+#tls_key

+

+# OpenLDAP search_format

+# format used to search for users in LDAP directory using substitution

+# for %u for user name and %f for SSH_Filter option (optional, empty by default)

+#search_format (&(objectclass=%c)(objectclass=ldapPublicKey)(uid=%u)%f)

+

+#AccountClass posixAccount

+

diff -up openssh-6.8p1/ldapbody.c.ldap openssh-6.8p1/ldapbody.c

--- openssh-6.8p1/ldapbody.c.ldap	2015-03-18 11:11:29.031801462 +0100

+++ openssh-6.8p1/ldapbody.c	2015-03-18 11:11:29.031801462 +0100

@@ -0,0 +1,493 @@

+/* $OpenBSD: ldapbody.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */

+/*

+ * Copyright (c) 2009 Jan F. Chadima.  All rights reserved.

+ *

+ * Redistribution and use in source and binary forms, with or without

+ * modification, are permitted provided that the following conditions

+ * are met:

+ * 1. Redistributions of source code must retain the above copyright

+ *    notice, this list of conditions and the following disclaimer.

+ * 2. Redistributions in binary form must reproduce the above copyright

+ *    notice, this list of conditions and the following disclaimer in the

+ *    documentation and/or other materials provided with the distribution.

+ *

+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR

+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES

+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.

+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,

+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,

+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY

+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF

+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

+ */

+

+#include "ldapincludes.h"

+#include "log.h"

+#include "xmalloc.h"

+#include "ldapconf.h"

+#include "ldapmisc.h"

+#include "ldapbody.h"

+#include <stdio.h>

+#include <unistd.h>

+#include "misc.h"

+

+#define LDAPSEARCH_FORMAT "(&(objectclass=%c)(objectclass=ldapPublicKey)(uid=%u)%f)"

+#define PUBKEYATTR "sshPublicKey"

+#define LDAP_LOGFILE	"%s/ldap.%d"

+

+static FILE *logfile = NULL;

+static LDAP *ld;

+

+static char *attrs[] = {

+    PUBKEYATTR,

+    NULL

+};

+

+void

+ldap_checkconfig (void)

+{

+#ifdef HAVE_LDAP_INITIALIZE

+		if (options.host == NULL && options.uri == NULL)

+#else

+		if (options.host == NULL)

+#endif

+		    fatal ("missing  \"host\" in config file");

+}

+

+#if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)

+static int

+_rebind_proc (LDAP * ld, LDAP_CONST char *url, int request, ber_int_t msgid)

+{

+	struct timeval timeout;

+	int rc;

+#if defined(HAVE_LDAP_PARSE_RESULT) && defined(HAVE_LDAP_CONTROLS_FREE)

+	LDAPMessage *result;

+#endif /* HAVE_LDAP_PARSE_RESULT && HAVE_LDAP_CONTROLS_FREE */

+

+	debug2 ("Doing LDAP rebind to %s", options.binddn);

+	if (options.ssl == SSL_START_TLS) {

+		if ((rc = ldap_start_tls_s (ld, NULL, NULL)) != LDAP_SUCCESS) {

+			error ("ldap_starttls_s: %s", ldap_err2string (rc));

+			return LDAP_OPERATIONS_ERROR;

+		}

+	}

+

+#if !defined(HAVE_LDAP_PARSE_RESULT) || !defined(HAVE_LDAP_CONTROLS_FREE)

+	return ldap_simple_bind_s (ld, options.binddn, options.bindpw);

+#else

+	if (ldap_simple_bind(ld, options.binddn, options.bindpw) < 0)

+	    fatal ("ldap_simple_bind %s", ldap_err2string (ldap_get_lderrno (ld, 0, 0)));

+

+	timeout.tv_sec = options.bind_timelimit;

+	timeout.tv_usec = 0;

+	result = NULL;

+	if ((rc = ldap_result (ld, msgid, FALSE, &timeout, &result)) < 1) {

+		error ("ldap_result %s", ldap_err2string (ldap_get_lderrno (ld, 0, 0)));

+		ldap_msgfree (result);

+		return LDAP_OPERATIONS_ERROR;

+	}

+	debug3 ("LDAP rebind to %s succesfull", options.binddn);

+	return rc;

+#endif

+}

+#else

+

+static int

+_rebind_proc (LDAP * ld, char **whop, char **credp, int *methodp, int freeit)

+{

+	if (freeit)

+	    return LDAP_SUCCESS;

+

+	*whop = strdup (options.binddn);

+	*credp = strdup (options.bindpw);

+	*methodp = LDAP_AUTH_SIMPLE;

+	debug2 ("Doing LDAP rebind for %s", *whop);

+	return LDAP_SUCCESS;

+}

+#endif

+

+void

+ldap_do_connect(void)

+{

+	int rc, msgid, ld_errno = 0;

+	struct timeval timeout;

+#if defined(HAVE_LDAP_PARSE_RESULT) && defined(HAVE_LDAP_CONTROLS_FREE)

+	int parserc;

+	LDAPMessage *result;

+	LDAPControl **controls;

+	int reconnect = 0;

+#endif /* HAVE_LDAP_PARSE_RESULT && HAVE_LDAP_CONTROLS_FREE */

+

+	debug ("LDAP do connect");

+

+retry:

+	if (reconnect) {

+		debug3 ("Reconnecting with ld_errno %d", ld_errno);

+		if (options.bind_policy == 0 ||

+		    (ld_errno != LDAP_SERVER_DOWN && ld_errno != LDAP_TIMEOUT) ||

+			reconnect > 5)

+			    fatal ("Cannot connect to LDAP server");

+	

+		if (reconnect > 1)

+			sleep (reconnect - 1);

+

+		if (ld != NULL) {

+			ldap_unbind (ld);

+			ld = NULL;

+		}

+		logit("reconnecting to LDAP server...");

+	}

+

+	if (ld == NULL) {

+		int rc;

+		struct timeval tv;

+

+#ifdef HAVE_LDAP_SET_OPTION

+		if (options.debug > 0) {

+#ifdef LBER_OPT_LOG_PRINT_FILE

+			if (options.logdir) {

+				char *logfilename;

+				int logfilenamelen;

+

+				logfilenamelen = strlen (LDAP_LOGFILE) + strlen ("000000") + strlen (options.logdir);

+				logfilename = xmalloc (logfilenamelen);

+				snprintf (logfilename, logfilenamelen, LDAP_LOGFILE, options.logdir, (int) getpid ());

+				logfilename[logfilenamelen - 1] = 0;

+				if ((logfile = fopen (logfilename, "a")) == NULL)

+				    fatal ("cannot append to %s: %s", logfilename, strerror (errno));

+				debug3 ("LDAP debug into %s", logfilename);

+				free (logfilename);

+				ber_set_option (NULL, LBER_OPT_LOG_PRINT_FILE, logfile);

+			}

+#endif

+			if (options.debug) {

+#ifdef LBER_OPT_DEBUG_LEVEL

+				ber_set_option (NULL, LBER_OPT_DEBUG_LEVEL, &options.debug);

+#endif /* LBER_OPT_DEBUG_LEVEL */

+#ifdef LDAP_OPT_DEBUG_LEVEL

+				(void) ldap_set_option (NULL, LDAP_OPT_DEBUG_LEVEL, &options.debug);

+#endif /* LDAP_OPT_DEBUG_LEVEL */

+				debug3 ("Set LDAP debug to %d", options.debug);

+			}

+		}

+#endif /* HAVE_LDAP_SET_OPTION */

+

+		ld = NULL;

+#ifdef HAVE_LDAPSSL_INIT

+		if (options.host != NULL) {

+			if (options.ssl_on == SSL_LDAPS) {

+				if ((rc = ldapssl_client_init (options.sslpath, NULL)) != LDAP_SUCCESS)

+				    fatal ("ldapssl_client_init %s", ldap_err2string (rc));

+				debug3 ("LDAPssl client init");

+			}

+

+			if (options.ssl_on != SSL_OFF) {

+				if ((ld = ldapssl_init (options.host, options.port, TRUE)) == NULL)

+				    fatal ("ldapssl_init failed");

+				debug3 ("LDAPssl init");

+			}

+		}

+#endif /* HAVE_LDAPSSL_INIT */

+

+		/* continue with opening */

+		if (ld == NULL) {

+#if defined (HAVE_LDAP_START_TLS_S) || (defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_X_TLS))

+			/* Some global TLS-specific options need to be set before we create our

+			 * session context, so we set them here. */

+

+#ifdef LDAP_OPT_X_TLS_RANDOM_FILE

+			/* rand file */

+			if (options.tls_randfile != NULL) {

+				if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_RANDOM_FILE,

+				    options.tls_randfile)) != LDAP_SUCCESS)

+					fatal ("ldap_set_option(LDAP_OPT_X_TLS_RANDOM_FILE): %s",

+					    ldap_err2string (rc));

+				debug3 ("Set TLS random file %s", options.tls_randfile);

+			}

+#endif /* LDAP_OPT_X_TLS_RANDOM_FILE */

+

+			/* ca cert file */

+			if (options.tls_cacertfile != NULL) {

+				if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_CACERTFILE,

+				    options.tls_cacertfile)) != LDAP_SUCCESS)

+					error ("ldap_set_option(LDAP_OPT_X_TLS_CACERTFILE): %s",

+					    ldap_err2string (rc));

+				debug3 ("Set TLS CA cert file %s ", options.tls_cacertfile);

+			}

+

+			/* ca cert directory */

+			if (options.tls_cacertdir != NULL) {

+				if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_CACERTDIR,

+				    options.tls_cacertdir)) != LDAP_SUCCESS)

+					fatal ("ldap_set_option(LDAP_OPT_X_TLS_CACERTDIR): %s",

+					    ldap_err2string (rc));

+				debug3 ("Set TLS CA cert dir %s ", options.tls_cacertdir);

+			}

+

+			/* require cert? */

+			if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_REQUIRE_CERT,

+			    &options.tls_checkpeer)) != LDAP_SUCCESS)

+				fatal ("ldap_set_option(LDAP_OPT_X_TLS_REQUIRE_CERT): %s",

+				    ldap_err2string (rc));

+			debug3 ("Set TLS check peer to %d ", options.tls_checkpeer);

+

+			/* set cipher suite, certificate and private key: */

+			if (options.tls_ciphers != NULL) {

+				if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_CIPHER_SUITE,

+				    options.tls_ciphers)) != LDAP_SUCCESS)

+					fatal ("ldap_set_option(LDAP_OPT_X_TLS_CIPHER_SUITE): %s",

+					    ldap_err2string (rc));

+				debug3 ("Set TLS ciphers to %s ", options.tls_ciphers);

+			}

+

+			/* cert file */

+			if (options.tls_cert != NULL) {

+				if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_CERTFILE,

+				    options.tls_cert)) != LDAP_SUCCESS)