|
 |
9070b3 |
diff --git a/auth-krb5.c b/auth-krb5.c
|
|
|
9070b3 |
index 2b02a04..19b9364 100644
|
|
|
9070b3 |
--- a/auth-krb5.c
|
|
|
9070b3 |
+++ b/auth-krb5.c
|
|
|
9070b3 |
@@ -375,5 +375,21 @@ cleanup:
|
|
|
9070b3 |
return (krb5_cc_resolve(ctx, ccname, ccache));
|
|
|
9070b3 |
}
|
|
|
9070b3 |
}
|
|
|
9070b3 |
+
|
|
|
9070b3 |
+/*
|
|
|
9070b3 |
+ * Reads k5login_directory option from the krb5.conf
|
|
|
9070b3 |
+ */
|
|
|
9070b3 |
+krb5_error_code
|
|
|
9070b3 |
+ssh_krb5_get_k5login_directory(krb5_context ctx, char **k5login_directory) {
|
|
|
9070b3 |
+ profile_t p;
|
|
|
9070b3 |
+ int ret = 0;
|
|
|
9070b3 |
+
|
|
|
9070b3 |
+ ret = krb5_get_profile(ctx, &p);
|
|
|
9070b3 |
+ if (ret)
|
|
|
9070b3 |
+ return ret;
|
|
|
9070b3 |
+
|
|
|
9070b3 |
+ return profile_get_string(p, "libdefaults", "k5login_directory", NULL, NULL,
|
|
|
9070b3 |
+ k5login_directory);
|
|
|
9070b3 |
+}
|
|
|
9070b3 |
#endif /* !HEIMDAL */
|
|
|
9070b3 |
#endif /* KRB5 */
|
|
|
9070b3 |
diff --git a/auth.h b/auth.h
|
|
|
9070b3 |
index f9d191c..c432d2f 100644
|
|
|
9070b3 |
--- a/auth.h
|
|
|
9070b3 |
+++ b/auth.h
|
|
|
9070b3 |
@@ -222,6 +222,8 @@ int sys_auth_passwd(Authctxt *, const char *);
|
|
|
9070b3 |
|
|
|
9070b3 |
#if defined(KRB5) && !defined(HEIMDAL)
|
|
|
9070b3 |
krb5_error_code ssh_krb5_cc_new_unique(krb5_context, krb5_ccache *, int *);
|
|
|
9070b3 |
+krb5_error_code ssh_krb5_get_k5login_directory(krb5_context ctx,
|
|
|
9070b3 |
+ char **k5login_directory);
|
|
|
9070b3 |
#endif
|
|
|
9070b3 |
|
|
|
9070b3 |
#endif /* AUTH_H */
|
|
|
9070b3 |
diff --git a/gss-serv-krb5.c b/gss-serv-krb5.c
|
|
|
9070b3 |
index a7c0c5f..df8cc9a 100644
|
|
|
9070b3 |
--- a/gss-serv-krb5.c
|
|
|
9070b3 |
+++ b/gss-serv-krb5.c
|
|
|
9070b3 |
@@ -244,8 +244,27 @@ ssh_gssapi_k5login_exists()
|
|
|
9070b3 |
{
|
|
|
9070b3 |
char file[MAXPATHLEN];
|
|
|
9070b3 |
struct passwd *pw = the_authctxt->pw;
|
|
|
9070b3 |
+ char *k5login_directory = NULL;
|
|
|
9070b3 |
+ int ret = 0;
|
|
|
9070b3 |
+
|
|
|
9070b3 |
+ ret = ssh_krb5_get_k5login_directory(krb_context, &k5login_directory);
|
|
|
9070b3 |
+ debug3_f("k5login_directory = %s (rv=%d)", k5login_directory, ret);
|
|
|
9070b3 |
+ if (k5login_directory == NULL || ret != 0) {
|
|
|
9070b3 |
+ /* If not set, the library will look for k5login
|
|
|
9070b3 |
+ * files in the user's home directory, with the filename .k5login.
|
|
|
9070b3 |
+ */
|
|
|
9070b3 |
+ snprintf(file, sizeof(file), "%s/.k5login", pw->pw_dir);
|
|
|
9070b3 |
+ } else {
|
|
|
9070b3 |
+ /* If set, the library will look for a local user's k5login file
|
|
|
9070b3 |
+ * within the named directory, with a filename corresponding to the
|
|
|
9070b3 |
+ * local username.
|
|
|
9070b3 |
+ */
|
|
|
9070b3 |
+ snprintf(file, sizeof(file), "%s%s%s", k5login_directory,
|
|
|
9070b3 |
+ k5login_directory[strlen(k5login_directory)-1] != '/' ? "/" : "",
|
|
|
9070b3 |
+ pw->pw_name);
|
|
|
9070b3 |
+ }
|
|
|
9070b3 |
+ debug_f("Checking existence of file %s", file);
|
|
|
9070b3 |
|
|
|
9070b3 |
- snprintf(file, sizeof(file), "%s/.k5login", pw->pw_dir);
|
|
|
9070b3 |
return access(file, F_OK) == 0;
|
|
|
9070b3 |
}
|
|
|
9070b3 |
|
|
|
9070b3 |
diff --git a/sshd.8 b/sshd.8
|
|
|
9070b3 |
index 5c4f15b..135e290 100644
|
|
|
9070b3 |
--- a/sshd.8
|
|
|
9070b3 |
+++ b/sshd.8
|
|
|
9070b3 |
@@ -806,6 +806,10 @@ rlogin/rsh.
|
|
|
9070b3 |
These files enforce GSSAPI/Kerberos authentication access control.
|
|
|
9070b3 |
Further details are described in
|
|
|
9070b3 |
.Xr ksu 1 .
|
|
|
9070b3 |
+The location of the k5login file depends on the configuration option
|
|
|
9070b3 |
+.Cm k5login_directory
|
|
|
9070b3 |
+in the
|
|
|
9070b3 |
+.Xr krb5.conf 5 .
|
|
|
9070b3 |
.Pp
|
|
|
9070b3 |
.It Pa ~/.ssh/
|
|
|
9070b3 |
This directory is the default location for all user-specific configuration
|