1 /* 2 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 3 * All rights reserved 4 * 5 * As far as I am concerned, the code I have written for this software 6 * can be used freely for any purpose. Any derived versions of this 7 * software must be clearly marked as such, and if the derived work is 8 * incompatible with the protocol description in the RFC file, it must be 9 * called by a name other than "ssh" or "Secure Shell". 10 */ 11 /* 12 * Copyright (c) 2001, 2010, Oracle and/or its affiliates. All rights reserved. 13 * Copyright 2013 Joyent, Inc. All rights reserved. 14 */ 15 16 #include "includes.h" 17 RCSID("$OpenBSD: servconf.c,v 1.115 2002/09/04 18:52:42 stevesk Exp $"); 18 19 #ifdef HAVE_DEFOPEN 20 #include <deflt.h> 21 #endif /* HAVE_DEFOPEN */ 22 23 #if defined(KRB4) 24 #include <krb.h> 25 #endif 26 #if defined(KRB5) 27 #ifdef HEIMDAL 28 #include <krb.h> 29 #else 30 /* Bodge - but then, so is using the kerberos IV KEYFILE to get a Kerberos V 31 * keytab */ 32 #define KEYFILE "/etc/krb5.keytab" 33 #endif 34 #endif 35 #ifdef AFS 36 #include <kafs.h> 37 #endif 38 39 #include "ssh.h" 40 #include "log.h" 41 #include "buffer.h" 42 #include "servconf.h" 43 #include "xmalloc.h" 44 #include "compat.h" 45 #include "pathnames.h" 46 #include "tildexpand.h" 47 #include "misc.h" 48 #include "cipher.h" 49 #include "kex.h" 50 #include "mac.h" 51 #include "auth.h" 52 #include "match.h" 53 #include "groupaccess.h" 54 55 static void add_listen_addr(ServerOptions *, char *, u_short); 56 static void add_one_listen_addr(ServerOptions *, char *, u_short); 57 58 extern Buffer cfg; 59 60 /* AF_UNSPEC or AF_INET or AF_INET6 */ 61 extern int IPv4or6; 62 63 /* 64 * Initializes the server options to their initial (unset) values. Some of those 65 * that stay unset after the command line options and configuration files are 66 * read are set to their default values in fill_default_server_options(). 67 */ 68 void 69 initialize_server_options(ServerOptions *options) 70 { 71 (void) memset(options, 0, sizeof(*options)); 72 73 /* Standard Options */ 74 options->num_ports = 0; 75 options->ports_from_cmdline = 0; 76 options->listen_addrs = NULL; 77 options->num_host_key_files = 0; 78 options->pid_file = NULL; 79 options->server_key_bits = -1; 80 options->login_grace_time = -1; 81 options->key_regeneration_time = -1; 82 options->permit_root_login = PERMIT_NOT_SET; 83 options->ignore_rhosts = -1; 84 options->ignore_user_known_hosts = -1; 85 options->print_motd = -1; 86 options->print_lastlog = -1; 87 options->x11_forwarding = -1; 88 options->x11_display_offset = -1; 89 options->x11_use_localhost = -1; 90 options->xauth_location = NULL; 91 options->strict_modes = -1; 92 options->keepalives = -1; 93 options->log_facility = SYSLOG_FACILITY_NOT_SET; 94 options->log_level = SYSLOG_LEVEL_NOT_SET; 95 options->rhosts_authentication = -1; 96 options->rhosts_rsa_authentication = -1; 97 options->hostbased_authentication = -1; 98 options->hostbased_uses_name_from_packet_only = -1; 99 options->rsa_authentication = -1; 100 options->pubkey_authentication = -1; 101 #ifdef GSSAPI 102 options->gss_authentication = -1; 103 options->gss_keyex = -1; 104 options->gss_store_creds = -1; 105 options->gss_use_session_ccache = -1; 106 options->gss_cleanup_creds = -1; 107 #endif 108 #if defined(KRB4) || defined(KRB5) 109 options->kerberos_authentication = -1; 110 options->kerberos_or_local_passwd = -1; 111 options->kerberos_ticket_cleanup = -1; 112 #endif 113 #if defined(AFS) || defined(KRB5) 114 options->kerberos_tgt_passing = -1; 115 #endif 116 #ifdef AFS 117 options->afs_token_passing = -1; 118 #endif 119 options->password_authentication = -1; 120 options->kbd_interactive_authentication = -1; 121 options->challenge_response_authentication = -1; 122 options->pam_authentication_via_kbd_int = -1; 123 options->permit_empty_passwd = -1; 124 options->permit_user_env = -1; 125 options->compression = -1; 126 options->allow_tcp_forwarding = -1; 127 options->num_allow_users = 0; 128 options->num_deny_users = 0; 129 options->num_allow_groups = 0; 130 options->num_deny_groups = 0; 131 options->ciphers = NULL; 132 options->macs = NULL; 133 options->protocol = SSH_PROTO_UNKNOWN; 134 options->gateway_ports = -1; 135 options->num_subsystems = 0; 136 options->max_startups_begin = -1; 137 options->max_startups_rate = -1; 138 options->max_startups = -1; 139 options->banner = NULL; 140 options->verify_reverse_mapping = -1; 141 options->client_alive_interval = -1; 142 options->client_alive_count_max = -1; 143 options->authorized_keys_file = NULL; 144 options->authorized_keys_file2 = NULL; 145 146 options->max_auth_tries = -1; 147 options->max_auth_tries_log = -1; 148 149 options->max_init_auth_tries = -1; 150 options->max_init_auth_tries_log = -1; 151 152 options->lookup_client_hostnames = -1; 153 options->use_openssl_engine = -1; 154 options->chroot_directory = NULL; 155 options->pre_userauth_hook = NULL; 156 options->pam_service_name = NULL; 157 options->pam_service_prefix = NULL; 158 } 159 160 #ifdef HAVE_DEFOPEN 161 /* 162 * Reads /etc/default/login and defaults several ServerOptions: 163 * 164 * PermitRootLogin 165 * PermitEmptyPasswords 166 * LoginGraceTime 167 * 168 * CONSOLE=* -> PermitRootLogin=without-password 169 * #CONSOLE=* -> PermitRootLogin=yes 170 * 171 * PASSREQ=YES -> PermitEmptyPasswords=no 172 * PASSREQ=NO -> PermitEmptyPasswords=yes 173 * #PASSREQ=* -> PermitEmptyPasswords=no 174 * 175 * TIMEOUT=<secs> -> LoginGraceTime=<secs> 176 * #TIMEOUT=<secs> -> LoginGraceTime=300 177 */ 178 static 179 void 180 deflt_fill_default_server_options(ServerOptions *options) 181 { 182 int flags; 183 char *ptr; 184 185 if (defopen(_PATH_DEFAULT_LOGIN)) 186 return; 187 188 /* Ignore case */ 189 flags = defcntl(DC_GETFLAGS, 0); 190 TURNOFF(flags, DC_CASE); 191 (void) defcntl(DC_SETFLAGS, flags); 192 193 if (options->permit_root_login == PERMIT_NOT_SET && 194 (ptr = defread("CONSOLE=")) != NULL) 195 options->permit_root_login = PERMIT_NO_PASSWD; 196 197 if (options->permit_empty_passwd == -1 && 198 (ptr = defread("PASSREQ=")) != NULL) { 199 if (strcasecmp("YES", ptr) == 0) 200 options->permit_empty_passwd = 0; 201 else if (strcasecmp("NO", ptr) == 0) 202 options->permit_empty_passwd = 1; 203 } 204 205 if (options->max_init_auth_tries == -1 && 206 (ptr = defread("RETRIES=")) != NULL) { 207 options->max_init_auth_tries = atoi(ptr); 208 } 209 210 if (options->max_init_auth_tries_log == -1 && 211 (ptr = defread("SYSLOG_FAILED_LOGINS=")) != NULL) { 212 options->max_init_auth_tries_log = atoi(ptr); 213 } 214 215 if (options->login_grace_time == -1) { 216 if ((ptr = defread("TIMEOUT=")) != NULL) 217 options->login_grace_time = (unsigned)atoi(ptr); 218 else 219 options->login_grace_time = 300; 220 } 221 222 (void) defopen((char *)NULL); 223 } 224 #endif /* HAVE_DEFOPEN */ 225 226 void 227 fill_default_server_options(ServerOptions *options) 228 { 229 230 #ifdef HAVE_DEFOPEN 231 deflt_fill_default_server_options(options); 232 #endif /* HAVE_DEFOPEN */ 233 234 /* Standard Options */ 235 if (options->protocol == SSH_PROTO_UNKNOWN) 236 options->protocol = SSH_PROTO_1|SSH_PROTO_2; 237 if (options->num_host_key_files == 0) { 238 /* fill default hostkeys for protocols */ 239 if (options->protocol & SSH_PROTO_1) 240 options->host_key_files[options->num_host_key_files++] = 241 _PATH_HOST_KEY_FILE; 242 #ifndef GSSAPI 243 /* With GSS keyex we can run v2 w/ no host keys */ 244 if (options->protocol & SSH_PROTO_2) { 245 options->host_key_files[options->num_host_key_files++] = 246 _PATH_HOST_RSA_KEY_FILE; 247 options->host_key_files[options->num_host_key_files++] = 248 _PATH_HOST_DSA_KEY_FILE; 249 } 250 #endif /* GSSAPI */ 251 } 252 if (options->num_ports == 0) 253 options->ports[options->num_ports++] = SSH_DEFAULT_PORT; 254 if (options->listen_addrs == NULL) 255 add_listen_addr(options, NULL, 0); 256 if (options->pid_file == NULL) 257 options->pid_file = _PATH_SSH_DAEMON_PID_FILE; 258 if (options->server_key_bits == -1) 259 options->server_key_bits = 768; 260 if (options->login_grace_time == -1) 261 options->login_grace_time = 120; 262 if (options->key_regeneration_time == -1) 263 options->key_regeneration_time = 3600; 264 if (options->permit_root_login == PERMIT_NOT_SET) 265 options->permit_root_login = PERMIT_YES; 266 if (options->ignore_rhosts == -1) 267 options->ignore_rhosts = 1; 268 if (options->ignore_user_known_hosts == -1) 269 options->ignore_user_known_hosts = 0; 270 if (options->print_motd == -1) 271 options->print_motd = 1; 272 if (options->print_lastlog == -1) 273 options->print_lastlog = 1; 274 if (options->x11_forwarding == -1) 275 options->x11_forwarding = 1; 276 if (options->x11_display_offset == -1) 277 options->x11_display_offset = 10; 278 if (options->x11_use_localhost == -1) 279 options->x11_use_localhost = 1; 280 if (options->xauth_location == NULL) 281 options->xauth_location = _PATH_XAUTH; 282 if (options->strict_modes == -1) 283 options->strict_modes = 1; 284 if (options->keepalives == -1) 285 options->keepalives = 1; 286 if (options->log_facility == SYSLOG_FACILITY_NOT_SET) 287 options->log_facility = SYSLOG_FACILITY_AUTH; 288 if (options->log_level == SYSLOG_LEVEL_NOT_SET) 289 options->log_level = SYSLOG_LEVEL_INFO; 290 if (options->rhosts_authentication == -1) 291 options->rhosts_authentication = 0; 292 if (options->rhosts_rsa_authentication == -1) 293 options->rhosts_rsa_authentication = 0; 294 if (options->hostbased_authentication == -1) 295 options->hostbased_authentication = 0; 296 if (options->hostbased_uses_name_from_packet_only == -1) 297 options->hostbased_uses_name_from_packet_only = 0; 298 if (options->rsa_authentication == -1) 299 options->rsa_authentication = 1; 300 if (options->pubkey_authentication == -1) 301 options->pubkey_authentication = 1; 302 #ifdef GSSAPI 303 if (options->gss_authentication == -1) 304 options->gss_authentication = 1; 305 if (options->gss_keyex == -1) 306 options->gss_keyex = 1; 307 if (options->gss_store_creds == -1) 308 options->gss_store_creds = 1; 309 if (options->gss_use_session_ccache == -1) 310 options->gss_use_session_ccache = 1; 311 if (options->gss_cleanup_creds == -1) 312 options->gss_cleanup_creds = 1; 313 #endif 314 #if defined(KRB4) || defined(KRB5) 315 if (options->kerberos_authentication == -1) 316 options->kerberos_authentication = 0; 317 if (options->kerberos_or_local_passwd == -1) 318 options->kerberos_or_local_passwd = 1; 319 if (options->kerberos_ticket_cleanup == -1) 320 options->kerberos_ticket_cleanup = 1; 321 #endif 322 #if defined(AFS) || defined(KRB5) 323 if (options->kerberos_tgt_passing == -1) 324 options->kerberos_tgt_passing = 0; 325 #endif 326 #ifdef AFS 327 if (options->afs_token_passing == -1) 328 options->afs_token_passing = 0; 329 #endif 330 if (options->password_authentication == -1) 331 options->password_authentication = 1; 332 /* 333 * options->pam_authentication_via_kbd_int has intentionally no default 334 * value since we do not need it. 335 */ 336 if (options->kbd_interactive_authentication == -1) 337 options->kbd_interactive_authentication = 1; 338 if (options->challenge_response_authentication == -1) 339 options->challenge_response_authentication = 1; 340 if (options->permit_empty_passwd == -1) 341 options->permit_empty_passwd = 0; 342 if (options->permit_user_env == -1) 343 options->permit_user_env = 0; 344 if (options->compression == -1) 345 options->compression = 1; 346 if (options->allow_tcp_forwarding == -1) 347 options->allow_tcp_forwarding = 1; 348 if (options->gateway_ports == -1) 349 options->gateway_ports = 0; 350 if (options->max_startups == -1) 351 options->max_startups = 10; 352 if (options->max_startups_rate == -1) 353 options->max_startups_rate = 100; /* 100% */ 354 if (options->max_startups_begin == -1) 355 options->max_startups_begin = options->max_startups; 356 if (options->verify_reverse_mapping == -1) 357 options->verify_reverse_mapping = 0; 358 if (options->client_alive_interval == -1) 359 options->client_alive_interval = 0; 360 if (options->client_alive_count_max == -1) 361 options->client_alive_count_max = 3; 362 if (options->authorized_keys_file2 == NULL) { 363 /* authorized_keys_file2 falls back to authorized_keys_file */ 364 if (options->authorized_keys_file != NULL) 365 options->authorized_keys_file2 = options->authorized_keys_file; 366 else 367 options->authorized_keys_file2 = _PATH_SSH_USER_PERMITTED_KEYS2; 368 } 369 if (options->authorized_keys_file == NULL) 370 options->authorized_keys_file = _PATH_SSH_USER_PERMITTED_KEYS; 371 372 if (options->max_auth_tries == -1) 373 options->max_auth_tries = AUTH_FAIL_MAX; 374 if (options->max_auth_tries_log == -1) 375 options->max_auth_tries_log = options->max_auth_tries / 2; 376 377 if (options->max_init_auth_tries == -1) 378 options->max_init_auth_tries = AUTH_FAIL_MAX; 379 if (options->max_init_auth_tries_log == -1) 380 options->max_init_auth_tries_log = options->max_init_auth_tries / 2; 381 382 if (options->lookup_client_hostnames == -1) 383 options->lookup_client_hostnames = 1; 384 if (options->use_openssl_engine == -1) 385 options->use_openssl_engine = 1; 386 if (options->pam_service_prefix == NULL) 387 options->pam_service_prefix = _SSH_PAM_SERVICE_PREFIX; 388 if (options->pam_service_name == NULL) 389 options->pam_service_name = NULL; 390 } 391 392 /* Keyword tokens. */ 393 typedef enum { 394 sBadOption, /* == unknown option */ 395 /* Portable-specific options */ 396 sPAMAuthenticationViaKbdInt, 397 /* Standard Options */ 398 sPort, sHostKeyFile, sServerKeyBits, sLoginGraceTime, sKeyRegenerationTime, 399 sPermitRootLogin, sLogFacility, sLogLevel, 400 sRhostsAuthentication, sRhostsRSAAuthentication, sRSAAuthentication, 401 #ifdef GSSAPI 402 sGssAuthentication, sGssKeyEx, sGssStoreDelegCreds, 403 sGssUseSessionCredCache, sGssCleanupCreds, 404 #endif /* GSSAPI */ 405 #if defined(KRB4) || defined(KRB5) 406 sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup, 407 #endif 408 #if defined(AFS) || defined(KRB5) 409 sKerberosTgtPassing, 410 #endif 411 #ifdef AFS 412 sAFSTokenPassing, 413 #endif 414 sChallengeResponseAuthentication, 415 sPasswordAuthentication, sKbdInteractiveAuthentication, sListenAddress, 416 sPrintMotd, sPrintLastLog, sIgnoreRhosts, 417 sX11Forwarding, sX11DisplayOffset, sX11UseLocalhost, 418 sStrictModes, sEmptyPasswd, sKeepAlives, 419 sPermitUserEnvironment, sUseLogin, sAllowTcpForwarding, sCompression, 420 sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups, 421 sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile, 422 sGatewayPorts, sPubkeyAuthentication, sXAuthLocation, sSubsystem, sMaxStartups, 423 sBanner, sVerifyReverseMapping, sHostbasedAuthentication, 424 sHostbasedUsesNameFromPacketOnly, sClientAliveInterval, 425 sClientAliveCountMax, sAuthorizedKeysFile, sAuthorizedKeysFile2, 426 sMaxAuthTries, sMaxAuthTriesLog, sUsePrivilegeSeparation, 427 sLookupClientHostnames, sUseOpenSSLEngine, sChrootDirectory, 428 sPreUserauthHook, sMatch, sPAMServicePrefix, sPAMServiceName, 429 sDeprecated 430 } ServerOpCodes; 431 432 #define SSHCFG_GLOBAL 0x01 /* allowed in main section of sshd_config */ 433 #define SSHCFG_MATCH 0x02 /* allowed inside a Match section */ 434 #define SSHCFG_ALL (SSHCFG_GLOBAL|SSHCFG_MATCH) 435 436 /* Textual representation of the tokens. */ 437 static struct { 438 const char *name; 439 ServerOpCodes opcode; 440 u_int flags; 441 } keywords[] = { 442 /* Portable-specific options */ 443 { "PAMAuthenticationViaKbdInt", sPAMAuthenticationViaKbdInt, SSHCFG_GLOBAL }, 444 /* Standard Options */ 445 { "port", sPort, SSHCFG_GLOBAL }, 446 { "hostkey", sHostKeyFile, SSHCFG_GLOBAL }, 447 { "hostdsakey", sHostKeyFile, SSHCFG_GLOBAL }, /* alias */ 448 { "pidfile", sPidFile, SSHCFG_GLOBAL }, 449 { "serverkeybits", sServerKeyBits, SSHCFG_GLOBAL }, 450 { "logingracetime", sLoginGraceTime, SSHCFG_GLOBAL }, 451 { "keyregenerationinterval", sKeyRegenerationTime, SSHCFG_GLOBAL }, 452 { "permitrootlogin", sPermitRootLogin, SSHCFG_ALL }, 453 { "syslogfacility", sLogFacility, SSHCFG_GLOBAL }, 454 { "loglevel", sLogLevel, SSHCFG_GLOBAL }, 455 { "rhostsauthentication", sRhostsAuthentication, SSHCFG_GLOBAL }, 456 { "rhostsrsaauthentication", sRhostsRSAAuthentication, SSHCFG_ALL }, 457 { "hostbasedauthentication", sHostbasedAuthentication, SSHCFG_ALL }, 458 { "hostbasedusesnamefrompacketonly", sHostbasedUsesNameFromPacketOnly }, 459 { "rsaauthentication", sRSAAuthentication, SSHCFG_ALL }, 460 { "pubkeyauthentication", sPubkeyAuthentication, SSHCFG_ALL }, 461 { "dsaauthentication", sPubkeyAuthentication, SSHCFG_GLOBAL }, /* alias */ 462 #ifdef GSSAPI 463 { "gssapiauthentication", sGssAuthentication, SSHCFG_ALL }, 464 { "gssapikeyexchange", sGssKeyEx, SSHCFG_GLOBAL }, 465 { "gssapistoredelegatedcredentials", sGssStoreDelegCreds, SSHCFG_GLOBAL }, 466 { "gssauthentication", sGssAuthentication, SSHCFG_GLOBAL }, /* alias */ 467 { "gsskeyex", sGssKeyEx, SSHCFG_GLOBAL }, /* alias */ 468 { "gssstoredelegcreds", sGssStoreDelegCreds, SSHCFG_GLOBAL }, /* alias */ 469 #ifndef SUNW_GSSAPI 470 { "gssusesessionccache", sGssUseSessionCredCache, SSHCFG_GLOBAL }, 471 { "gssusesessioncredcache", sGssUseSessionCredCache, SSHCFG_GLOBAL }, 472 { "gsscleanupcreds", sGssCleanupCreds, SSHCFG_GLOBAL }, 473 #endif /* SUNW_GSSAPI */ 474 #endif 475 #if defined(KRB4) || defined(KRB5) 476 { "kerberosauthentication", sKerberosAuthentication, SSHCFG_ALL }, 477 { "kerberosorlocalpasswd", sKerberosOrLocalPasswd, SSHCFG_GLOBAL }, 478 { "kerberosticketcleanup", sKerberosTicketCleanup, SSHCFG_GLOBAL }, 479 #endif 480 #if defined(AFS) || defined(KRB5) 481 { "kerberostgtpassing", sKerberosTgtPassing, SSHCFG_GLOBAL }, 482 #endif 483 #ifdef AFS 484 { "afstokenpassing", sAFSTokenPassing, SSHCFG_GLOBAL }, 485 #endif 486 { "passwordauthentication", sPasswordAuthentication, SSHCFG_ALL }, 487 { "kbdinteractiveauthentication", sKbdInteractiveAuthentication, SSHCFG_ALL }, 488 { "challengeresponseauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL }, 489 { "skeyauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL }, /* alias */ 490 { "checkmail", sDeprecated, SSHCFG_GLOBAL }, 491 { "listenaddress", sListenAddress, SSHCFG_GLOBAL }, 492 { "printmotd", sPrintMotd, SSHCFG_GLOBAL }, 493 { "printlastlog", sPrintLastLog, SSHCFG_GLOBAL }, 494 { "ignorerhosts", sIgnoreRhosts, SSHCFG_GLOBAL }, 495 { "ignoreuserknownhosts", sIgnoreUserKnownHosts, SSHCFG_GLOBAL }, 496 { "x11forwarding", sX11Forwarding, SSHCFG_ALL }, 497 { "x11displayoffset", sX11DisplayOffset, SSHCFG_ALL }, 498 { "x11uselocalhost", sX11UseLocalhost, SSHCFG_ALL }, 499 { "xauthlocation", sXAuthLocation, SSHCFG_GLOBAL }, 500 { "strictmodes", sStrictModes, SSHCFG_GLOBAL }, 501 { "permitemptypasswords", sEmptyPasswd, SSHCFG_ALL }, 502 { "permituserenvironment", sPermitUserEnvironment, SSHCFG_GLOBAL }, 503 { "uselogin", sUseLogin, SSHCFG_GLOBAL }, 504 { "compression", sCompression, SSHCFG_GLOBAL }, 505 { "tcpkeepalive", sKeepAlives, SSHCFG_GLOBAL }, 506 { "keepalive", sKeepAlives, SSHCFG_GLOBAL }, /* obsolete */ 507 { "allowtcpforwarding", sAllowTcpForwarding, SSHCFG_ALL }, 508 { "allowusers", sAllowUsers, SSHCFG_GLOBAL }, 509 { "denyusers", sDenyUsers, SSHCFG_GLOBAL }, 510 { "allowgroups", sAllowGroups, SSHCFG_GLOBAL }, 511 { "denygroups", sDenyGroups, SSHCFG_GLOBAL }, 512 { "ciphers", sCiphers, SSHCFG_GLOBAL }, 513 { "macs", sMacs, SSHCFG_GLOBAL}, 514 { "protocol", sProtocol,SSHCFG_GLOBAL }, 515 { "gatewayports", sGatewayPorts, SSHCFG_ALL }, 516 { "subsystem", sSubsystem, SSHCFG_GLOBAL}, 517 { "maxstartups", sMaxStartups, SSHCFG_GLOBAL }, 518 { "banner", sBanner, SSHCFG_ALL }, 519 { "verifyreversemapping", sVerifyReverseMapping, SSHCFG_GLOBAL }, 520 { "reversemappingcheck", sVerifyReverseMapping,SSHCFG_GLOBAL }, 521 { "clientaliveinterval", sClientAliveInterval, SSHCFG_GLOBAL }, 522 { "clientalivecountmax", sClientAliveCountMax, SSHCFG_GLOBAL }, 523 { "authorizedkeysfile", sAuthorizedKeysFile, SSHCFG_GLOBAL }, 524 { "authorizedkeysfile2", sAuthorizedKeysFile2, SSHCFG_GLOBAL }, 525 { "maxauthtries", sMaxAuthTries, SSHCFG_ALL }, 526 { "maxauthtrieslog", sMaxAuthTriesLog, SSHCFG_GLOBAL }, 527 { "useprivilegeseparation", sUsePrivilegeSeparation, SSHCFG_GLOBAL }, 528 { "lookupclienthostnames", sLookupClientHostnames, SSHCFG_GLOBAL }, 529 { "useopensslengine", sUseOpenSSLEngine, SSHCFG_GLOBAL }, 530 { "chrootdirectory", sChrootDirectory, SSHCFG_ALL }, 531 { "preuserauthhook", sPreUserauthHook, SSHCFG_ALL}, 532 { "match", sMatch, SSHCFG_ALL }, 533 { "pamserviceprefix", sPAMServicePrefix, SSHCFG_GLOBAL }, 534 { "pamservicename", sPAMServiceName, SSHCFG_GLOBAL }, 535 536 { NULL, sBadOption, 0 } 537 }; 538 539 /* 540 * Returns the number of the token pointed to by cp or sBadOption. 541 */ 542 543 static ServerOpCodes 544 parse_token(const char *cp, const char *filename, 545 int linenum, u_int *flags) 546 { 547 u_int i; 548 549 for (i = 0; keywords[i].name; i++) 550 if (strcasecmp(cp, keywords[i].name) == 0) { 551 *flags = keywords[i].flags; 552 return keywords[i].opcode; 553 } 554 555 error("%s: line %d: Bad configuration option: %s", 556 filename, linenum, cp); 557 return sBadOption; 558 } 559 560 static void 561 add_listen_addr(ServerOptions *options, char *addr, u_short port) 562 { 563 int i; 564 565 if (options->num_ports == 0) 566 options->ports[options->num_ports++] = SSH_DEFAULT_PORT; 567 if (port == 0) 568 for (i = 0; i < options->num_ports; i++) 569 add_one_listen_addr(options, addr, options->ports[i]); 570 else 571 add_one_listen_addr(options, addr, port); 572 } 573 574 static void 575 add_one_listen_addr(ServerOptions *options, char *addr, u_short port) 576 { 577 struct addrinfo hints, *ai, *aitop; 578 char strport[NI_MAXSERV]; 579 int gaierr; 580 581 (void) memset(&hints, 0, sizeof(hints)); 582 hints.ai_family = IPv4or6; 583 hints.ai_socktype = SOCK_STREAM; 584 hints.ai_flags = (addr == NULL) ? AI_PASSIVE : 0; 585 (void) snprintf(strport, sizeof strport, "%u", port); 586 if ((gaierr = getaddrinfo(addr, strport, &hints, &aitop)) != 0) 587 fatal("bad addr or host: %s (%s)", 588 addr ? addr : "<NULL>", 589 gai_strerror(gaierr)); 590 for (ai = aitop; ai->ai_next; ai = ai->ai_next) 591 ; 592 ai->ai_next = options->listen_addrs; 593 options->listen_addrs = aitop; 594 } 595 596 /* 597 * The strategy for the Match blocks is that the config file is parsed twice. 598 * 599 * The first time is at startup. activep is initialized to 1 and the 600 * directives in the global context are processed and acted on. Hitting a 601 * Match directive unsets activep and the directives inside the block are 602 * checked for syntax only. 603 * 604 * The second time is after a connection has been established but before 605 * authentication. activep is initialized to 2 and global config directives 606 * are ignored since they have already been processed. If the criteria in a 607 * Match block is met, activep is set and the subsequent directives 608 * processed and actioned until EOF or another Match block unsets it. Any 609 * options set are copied into the main server config. 610 * 611 * Potential additions/improvements: 612 * - Add Match support for pre-kex directives, eg Protocol, Ciphers. 613 * 614 * - Add a Tag directive (idea from David Leonard) ala pf, eg: 615 * Match Address 192.168.0.* 616 * Tag trusted 617 * Match Group wheel 618 * Tag trusted 619 * Match Tag trusted 620 * AllowTcpForwarding yes 621 * GatewayPorts clientspecified 622 * [...] 623 * 624 * - Add a PermittedChannelRequests directive 625 * Match Group shell 626 * PermittedChannelRequests session,forwarded-tcpip 627 */ 628 629 static int 630 match_cfg_line_group(const char *grps, int line, const char *user) 631 { 632 int result = 0; 633 struct passwd *pw; 634 635 if (user == NULL) 636 goto out; 637 638 if ((pw = getpwnam(user)) == NULL) { 639 debug("Can't match group at line %d because user %.100s does " 640 "not exist", line, user); 641 } else if (ga_init(pw->pw_name, pw->pw_gid) == 0) { 642 debug("Can't Match group because user %.100s not in any group " 643 "at line %d", user, line); 644 } else if (ga_match_pattern_list(grps) != 1) { 645 debug("user %.100s does not match group list %.100s at line %d", 646 user, grps, line); 647 } else { 648 debug("user %.100s matched group list %.100s at line %d", user, 649 grps, line); 650 result = 1; 651 } 652 out: 653 ga_free(); 654 return result; 655 } 656 657 static int 658 match_cfg_line(char **condition, int line, const char *user, const char *host, 659 const char *address) 660 { 661 int result = 1; 662 char *arg, *attrib, *cp = *condition; 663 size_t len; 664 665 if (user == NULL) 666 debug3("checking syntax for 'Match %s'", cp); 667 else 668 debug3("checking match for '%s' user %s host %s addr %s", cp, 669 user ? user : "(null)", host ? host : "(null)", 670 address ? address : "(null)"); 671 672 while ((attrib = strdelim(&cp)) != NULL && *attrib != '\0') { 673 if ((arg = strdelim(&cp)) == NULL || *arg == '\0') { 674 error("Missing Match criteria for %s", attrib); 675 return -1; 676 } 677 len = strlen(arg); 678 if (strcasecmp(attrib, "user") == 0) { 679 if (!user) { 680 result = 0; 681 continue; 682 } 683 if (match_pattern_list(user, arg, len, 0) != 1) 684 result = 0; 685 else 686 debug("user %.100s matched 'User %.100s' at " 687 "line %d", user, arg, line); 688 } else if (strcasecmp(attrib, "group") == 0) { 689 switch (match_cfg_line_group(arg, line, user)) { 690 case -1: 691 return -1; 692 case 0: 693 result = 0; 694 } 695 } else if (strcasecmp(attrib, "host") == 0) { 696 if (!host) { 697 result = 0; 698 continue; 699 } 700 if (match_hostname(host, arg, len) != 1) 701 result = 0; 702 else 703 debug("connection from %.100s matched 'Host " 704 "%.100s' at line %d", host, arg, line); 705 } else if (strcasecmp(attrib, "address") == 0) { 706 switch (addr_match_list(address, arg)) { 707 case 1: 708 debug("connection from %.100s matched 'Address " 709 "%.100s' at line %d", address, arg, line); 710 break; 711 case 0: 712 case -1: 713 result = 0; 714 break; 715 case -2: 716 return -1; 717 } 718 } else { 719 error("Unsupported Match attribute %s", attrib); 720 return -1; 721 } 722 } 723 if (user != NULL) 724 debug3("match %sfound", result ? "" : "not "); 725 *condition = cp; 726 return result; 727 } 728 729 #define WHITESPACE " \t\r\n" 730 731 int 732 process_server_config_line(ServerOptions *options, char *line, 733 const char *filename, int linenum, int *activep, const char *user, 734 const char *host, const char *address) 735 { 736 char *cp, **charptr, *arg, *p; 737 int cmdline = 0, *intptr, value, n; 738 ServerOpCodes opcode; 739 u_int i, flags = 0; 740 size_t len; 741 742 cp = line; 743 arg = strdelim(&cp); 744 /* Ignore leading whitespace */ 745 if (*arg == '\0') 746 arg = strdelim(&cp); 747 if (!arg || !*arg || *arg == '#') 748 return 0; 749 intptr = NULL; 750 charptr = NULL; 751 opcode = parse_token(arg, filename, linenum, &flags); 752 753 if (activep == NULL) { /* We are processing a command line directive */ 754 cmdline = 1; 755 activep = &cmdline; 756 } 757 if (*activep && opcode != sMatch) 758 debug3("%s:%d setting %s %s", filename, linenum, arg, cp); 759 if (*activep == 0 && !(flags & SSHCFG_MATCH)) { 760 if (user == NULL) { 761 fatal("%s line %d: Directive '%s' is not allowed " 762 "within a Match block", filename, linenum, arg); 763 } else { /* this is a directive we have already processed */ 764 while (arg) 765 arg = strdelim(&cp); 766 return 0; 767 } 768 } 769 770 switch (opcode) { 771 /* Portable-specific options */ 772 case sPAMAuthenticationViaKbdInt: 773 log("%s line %d: PAMAuthenticationViaKbdInt has been " 774 "deprecated. You should use KbdInteractiveAuthentication " 775 "instead (which defaults to \"yes\").", filename, linenum); 776 intptr = &options->pam_authentication_via_kbd_int; 777 goto parse_flag; 778 779 /* Standard Options */ 780 case sBadOption: 781 return -1; 782 case sPort: 783 /* ignore ports from configfile if cmdline specifies ports */ 784 if (options->ports_from_cmdline) 785 return 0; 786 if (options->listen_addrs != NULL) 787 fatal("%s line %d: ports must be specified before " 788 "ListenAddress.", filename, linenum); 789 if (options->num_ports >= MAX_PORTS) 790 fatal("%s line %d: too many ports.", 791 filename, linenum); 792 arg = strdelim(&cp); 793 if (!arg || *arg == '\0') 794 fatal("%s line %d: missing port number.", 795 filename, linenum); 796 options->ports[options->num_ports++] = a2port(arg); 797 if (options->ports[options->num_ports-1] == 0) 798 fatal("%s line %d: Badly formatted port number.", 799 filename, linenum); 800 break; 801 802 case sServerKeyBits: 803 intptr = &options->server_key_bits; 804 parse_int: 805 arg = strdelim(&cp); 806 if (!arg || *arg == '\0') 807 fatal("%s line %d: missing integer value.", 808 filename, linenum); 809 value = atoi(arg); 810 if (*activep && *intptr == -1) 811 *intptr = value; 812 break; 813 814 case sLoginGraceTime: 815 intptr = &options->login_grace_time; 816 parse_time: 817 arg = strdelim(&cp); 818 if (!arg || *arg == '\0') 819 fatal("%s line %d: missing time value.", 820 filename, linenum); 821 if ((value = convtime(arg)) == -1) 822 fatal("%s line %d: invalid time value.", 823 filename, linenum); 824 if (*intptr == -1) 825 *intptr = value; 826 break; 827 828 case sKeyRegenerationTime: 829 intptr = &options->key_regeneration_time; 830 goto parse_time; 831 832 case sListenAddress: 833 arg = strdelim(&cp); 834 if (!arg || *arg == '\0' || strncmp(arg, "[]", 2) == 0) 835 fatal("%s line %d: missing inet addr.", 836 filename, linenum); 837 if (*arg == '[') { 838 if ((p = strchr(arg, ']')) == NULL) 839 fatal("%s line %d: bad ipv6 inet addr usage.", 840 filename, linenum); 841 arg++; 842 (void) memmove(p, p+1, strlen(p+1)+1); 843 } else if (((p = strchr(arg, ':')) == NULL) || 844 (strchr(p+1, ':') != NULL)) { 845 add_listen_addr(options, arg, 0); 846 break; 847 } 848 if (*p == ':') { 849 u_short port; 850 851 p++; 852 if (*p == '\0') 853 fatal("%s line %d: bad inet addr:port usage.", 854 filename, linenum); 855 else { 856 *(p-1) = '\0'; 857 if ((port = a2port(p)) == 0) 858 fatal("%s line %d: bad port number.", 859 filename, linenum); 860 add_listen_addr(options, arg, port); 861 } 862 } else if (*p == '\0') 863 add_listen_addr(options, arg, 0); 864 else 865 fatal("%s line %d: bad inet addr usage.", 866 filename, linenum); 867 break; 868 869 case sHostKeyFile: 870 intptr = &options->num_host_key_files; 871 if (*intptr >= MAX_HOSTKEYS) 872 fatal("%s line %d: too many host keys specified (max %d).", 873 filename, linenum, MAX_HOSTKEYS); 874 charptr = &options->host_key_files[*intptr]; 875 parse_filename: 876 arg = strdelim(&cp); 877 if (!arg || *arg == '\0') 878 fatal("%s line %d: missing file name.", 879 filename, linenum); 880 if (*activep && *charptr == NULL) { 881 *charptr = tilde_expand_filename(arg, getuid()); 882 /* increase optional counter */ 883 if (intptr != NULL) 884 *intptr = *intptr + 1; 885 } 886 break; 887 888 case sPidFile: 889 charptr = &options->pid_file; 890 goto parse_filename; 891 892 case sPermitRootLogin: 893 intptr = &options->permit_root_login; 894 arg = strdelim(&cp); 895 if (!arg || *arg == '\0') 896 fatal("%s line %d: missing yes/" 897 "without-password/forced-commands-only/no " 898 "argument.", filename, linenum); 899 value = 0; /* silence compiler */ 900 if (strcmp(arg, "without-password") == 0) 901 value = PERMIT_NO_PASSWD; 902 else if (strcmp(arg, "forced-commands-only") == 0) 903 value = PERMIT_FORCED_ONLY; 904 else if (strcmp(arg, "yes") == 0) 905 value = PERMIT_YES; 906 else if (strcmp(arg, "no") == 0) 907 value = PERMIT_NO; 908 else 909 fatal("%s line %d: Bad yes/" 910 "without-password/forced-commands-only/no " 911 "argument: %s", filename, linenum, arg); 912 if (*activep && *intptr == -1) 913 *intptr = value; 914 break; 915 916 case sIgnoreRhosts: 917 intptr = &options->ignore_rhosts; 918 parse_flag: 919 arg = strdelim(&cp); 920 if (!arg || *arg == '\0') 921 fatal("%s line %d: missing yes/no argument.", 922 filename, linenum); 923 value = 0; /* silence compiler */ 924 if (strcmp(arg, "yes") == 0) 925 value = 1; 926 else if (strcmp(arg, "no") == 0) 927 value = 0; 928 else 929 fatal("%s line %d: Bad yes/no argument: %s", 930 filename, linenum, arg); 931 if (*activep && *intptr == -1) 932 *intptr = value; 933 break; 934 935 case sIgnoreUserKnownHosts: 936 intptr = &options->ignore_user_known_hosts; 937 goto parse_flag; 938 939 case sRhostsAuthentication: 940 intptr = &options->rhosts_authentication; 941 goto parse_flag; 942 943 case sRhostsRSAAuthentication: 944 intptr = &options->rhosts_rsa_authentication; 945 goto parse_flag; 946 947 case sHostbasedAuthentication: 948 intptr = &options->hostbased_authentication; 949 goto parse_flag; 950 951 case sHostbasedUsesNameFromPacketOnly: 952 intptr = &options->hostbased_uses_name_from_packet_only; 953 goto parse_flag; 954 955 case sRSAAuthentication: 956 intptr = &options->rsa_authentication; 957 goto parse_flag; 958 959 case sPubkeyAuthentication: 960 intptr = &options->pubkey_authentication; 961 goto parse_flag; 962 #ifdef GSSAPI 963 case sGssAuthentication: 964 intptr = &options->gss_authentication; 965 goto parse_flag; 966 case sGssKeyEx: 967 intptr = &options->gss_keyex; 968 goto parse_flag; 969 case sGssStoreDelegCreds: 970 intptr = &options->gss_keyex; 971 goto parse_flag; 972 #ifndef SUNW_GSSAPI 973 case sGssUseSessionCredCache: 974 intptr = &options->gss_use_session_ccache; 975 goto parse_flag; 976 case sGssCleanupCreds: 977 intptr = &options->gss_cleanup_creds; 978 goto parse_flag; 979 #endif /* SUNW_GSSAPI */ 980 #endif /* GSSAPI */ 981 #if defined(KRB4) || defined(KRB5) 982 case sKerberosAuthentication: 983 intptr = &options->kerberos_authentication; 984 goto parse_flag; 985 986 case sKerberosOrLocalPasswd: 987 intptr = &options->kerberos_or_local_passwd; 988 goto parse_flag; 989 990 case sKerberosTicketCleanup: 991 intptr = &options->kerberos_ticket_cleanup; 992 goto parse_flag; 993 #endif 994 #if defined(AFS) || defined(KRB5) 995 case sKerberosTgtPassing: 996 intptr = &options->kerberos_tgt_passing; 997 goto parse_flag; 998 #endif 999 #ifdef AFS 1000 case sAFSTokenPassing: 1001 intptr = &options->afs_token_passing; 1002 goto parse_flag; 1003 #endif 1004 1005 case sPasswordAuthentication: 1006 intptr = &options->password_authentication; 1007 goto parse_flag; 1008 1009 case sKbdInteractiveAuthentication: 1010 intptr = &options->kbd_interactive_authentication; 1011 goto parse_flag; 1012 1013 case sChallengeResponseAuthentication: 1014 intptr = &options->challenge_response_authentication; 1015 goto parse_flag; 1016 1017 case sPrintMotd: 1018 intptr = &options->print_motd; 1019 goto parse_flag; 1020 1021 case sPrintLastLog: 1022 intptr = &options->print_lastlog; 1023 goto parse_flag; 1024 1025 case sX11Forwarding: 1026 intptr = &options->x11_forwarding; 1027 goto parse_flag; 1028 1029 case sX11DisplayOffset: 1030 intptr = &options->x11_display_offset; 1031 goto parse_int; 1032 1033 case sX11UseLocalhost: 1034 intptr = &options->x11_use_localhost; 1035 goto parse_flag; 1036 1037 case sXAuthLocation: 1038 charptr = &options->xauth_location; 1039 goto parse_filename; 1040 1041 case sStrictModes: 1042 intptr = &options->strict_modes; 1043 goto parse_flag; 1044 1045 case sKeepAlives: 1046 intptr = &options->keepalives; 1047 goto parse_flag; 1048 1049 case sEmptyPasswd: 1050 intptr = &options->permit_empty_passwd; 1051 goto parse_flag; 1052 1053 case sPermitUserEnvironment: 1054 intptr = &options->permit_user_env; 1055 goto parse_flag; 1056 1057 case sUseLogin: 1058 log("%s line %d: ignoring UseLogin option value." 1059 " This option is always off.", filename, linenum); 1060 while (arg) 1061 arg = strdelim(&cp); 1062 break; 1063 1064 case sCompression: 1065 intptr = &options->compression; 1066 goto parse_flag; 1067 1068 case sGatewayPorts: 1069 intptr = &options->gateway_ports; 1070 arg = strdelim(&cp); 1071 if (!arg || *arg == '\0') 1072 fatal("%s line %d: missing yes/no/clientspecified " 1073 "argument.", filename, linenum); 1074 value = 0; /* silence compiler */ 1075 if (strcmp(arg, "clientspecified") == 0) 1076 value = 2; 1077 else if (strcmp(arg, "yes") == 0) 1078 value = 1; 1079 else if (strcmp(arg, "no") == 0) 1080 value = 0; 1081 else 1082 fatal("%s line %d: Bad yes/no/clientspecified " 1083 "argument: %s", filename, linenum, arg); 1084 if (*activep && *intptr == -1) 1085 *intptr = value; 1086 break; 1087 1088 case sVerifyReverseMapping: 1089 intptr = &options->verify_reverse_mapping; 1090 goto parse_flag; 1091 1092 case sLogFacility: 1093 intptr = (int *) &options->log_facility; 1094 arg = strdelim(&cp); 1095 value = log_facility_number(arg); 1096 if (value == SYSLOG_FACILITY_NOT_SET) 1097 fatal("%.200s line %d: unsupported log facility '%s'", 1098 filename, linenum, arg ? arg : "<NONE>"); 1099 if (*intptr == -1) 1100 *intptr = (SyslogFacility) value; 1101 break; 1102 1103 case sLogLevel: 1104 intptr = (int *) &options->log_level; 1105 arg = strdelim(&cp); 1106 value = log_level_number(arg); 1107 if (value == SYSLOG_LEVEL_NOT_SET) 1108 fatal("%.200s line %d: unsupported log level '%s'", 1109 filename, linenum, arg ? arg : "<NONE>"); 1110 if (*intptr == -1) 1111 *intptr = (LogLevel) value; 1112 break; 1113 1114 case sAllowTcpForwarding: 1115 intptr = &options->allow_tcp_forwarding; 1116 goto parse_flag; 1117 1118 case sUsePrivilegeSeparation: 1119 log("%s line %d: ignoring UsePrivilegeSeparation option value." 1120 " This option is always on.", filename, linenum); 1121 while (arg) 1122 arg = strdelim(&cp); 1123 break; 1124 1125 case sAllowUsers: 1126 while (((arg = strdelim(&cp)) != NULL) && *arg != '\0') { 1127 if (options->num_allow_users >= MAX_ALLOW_USERS) 1128 fatal("%s line %d: too many allow users.", 1129 filename, linenum); 1130 options->allow_users[options->num_allow_users++] = 1131 xstrdup(arg); 1132 } 1133 break; 1134 1135 case sDenyUsers: 1136 while (((arg = strdelim(&cp)) != NULL) && *arg != '\0') { 1137 if (options->num_deny_users >= MAX_DENY_USERS) 1138 fatal( "%s line %d: too many deny users.", 1139 filename, linenum); 1140 options->deny_users[options->num_deny_users++] = 1141 xstrdup(arg); 1142 } 1143 break; 1144 1145 case sAllowGroups: 1146 while (((arg = strdelim(&cp)) != NULL) && *arg != '\0') { 1147 if (options->num_allow_groups >= MAX_ALLOW_GROUPS) 1148 fatal("%s line %d: too many allow groups.", 1149 filename, linenum); 1150 options->allow_groups[options->num_allow_groups++] = 1151 xstrdup(arg); 1152 } 1153 break; 1154 1155 case sDenyGroups: 1156 while (((arg = strdelim(&cp)) != NULL) && *arg != '\0') { 1157 if (options->num_deny_groups >= MAX_DENY_GROUPS) 1158 fatal("%s line %d: too many deny groups.", 1159 filename, linenum); 1160 options->deny_groups[options->num_deny_groups++] = xstrdup(arg); 1161 } 1162 break; 1163 1164 case sCiphers: 1165 arg = strdelim(&cp); 1166 if (!arg || *arg == '\0') 1167 fatal("%s line %d: Missing argument.", filename, linenum); 1168 if (!ciphers_valid(arg)) 1169 fatal("%s line %d: Bad SSH2 cipher spec '%s'.", 1170 filename, linenum, arg ? arg : "<NONE>"); 1171 if (options->ciphers == NULL) 1172 options->ciphers = xstrdup(arg); 1173 break; 1174 1175 case sMacs: 1176 arg = strdelim(&cp); 1177 if (!arg || *arg == '\0') 1178 fatal("%s line %d: Missing argument.", filename, linenum); 1179 if (!mac_valid(arg)) 1180 fatal("%s line %d: Bad SSH2 mac spec '%s'.", 1181 filename, linenum, arg ? arg : "<NONE>"); 1182 if (options->macs == NULL) 1183 options->macs = xstrdup(arg); 1184 break; 1185 1186 case sProtocol: 1187 intptr = &options->protocol; 1188 arg = strdelim(&cp); 1189 if (!arg || *arg == '\0') 1190 fatal("%s line %d: Missing argument.", filename, linenum); 1191 value = proto_spec(arg); 1192 if (value == SSH_PROTO_UNKNOWN) 1193 fatal("%s line %d: Bad protocol spec '%s'.", 1194 filename, linenum, arg ? arg : "<NONE>"); 1195 if (*intptr == SSH_PROTO_UNKNOWN) 1196 *intptr = value; 1197 break; 1198 1199 case sSubsystem: 1200 if (options->num_subsystems >= MAX_SUBSYSTEMS) { 1201 fatal("%s line %d: too many subsystems defined.", 1202 filename, linenum); 1203 } 1204 arg = strdelim(&cp); 1205 if (!arg || *arg == '\0') 1206 fatal("%s line %d: Missing subsystem name.", 1207 filename, linenum); 1208 if (!*activep) { 1209 arg = strdelim(&cp); 1210 break; 1211 } 1212 for (i = 0; i < options->num_subsystems; i++) 1213 if (strcmp(arg, options->subsystem_name[i]) == 0) 1214 fatal("%s line %d: Subsystem '%s' already defined.", 1215 filename, linenum, arg); 1216 options->subsystem_name[options->num_subsystems] = xstrdup(arg); 1217 arg = strdelim(&cp); 1218 if (!arg || *arg == '\0') 1219 fatal("%s line %d: Missing subsystem command.", 1220 filename, linenum); 1221 options->subsystem_command[options->num_subsystems] = xstrdup(arg); 1222 1223 /* 1224 * Collect arguments (separate to executable), including the 1225 * name of the executable, in a way that is easier to parse 1226 * later. 1227 */ 1228 p = xstrdup(arg); 1229 len = strlen(p) + 1; 1230 while ((arg = strdelim(&cp)) != NULL && *arg != '\0') { 1231 len += 1 + strlen(arg); 1232 p = xrealloc(p, len); 1233 strlcat(p, " ", len); 1234 strlcat(p, arg, len); 1235 } 1236 options->subsystem_args[options->num_subsystems] = p; 1237 options->num_subsystems++; 1238 break; 1239 1240 case sMaxStartups: 1241 arg = strdelim(&cp); 1242 if (!arg || *arg == '\0') 1243 fatal("%s line %d: Missing MaxStartups spec.", 1244 filename, linenum); 1245 if ((n = sscanf(arg, "%d:%d:%d", 1246 &options->max_startups_begin, 1247 &options->max_startups_rate, 1248 &options->max_startups)) == 3) { 1249 if (options->max_startups_begin > 1250 options->max_startups || 1251 options->max_startups_rate > 100 || 1252 options->max_startups_rate < 1) 1253 fatal("%s line %d: Illegal MaxStartups spec.", 1254 filename, linenum); 1255 } else if (n != 1) 1256 fatal("%s line %d: Illegal MaxStartups spec.", 1257 filename, linenum); 1258 else 1259 options->max_startups = options->max_startups_begin; 1260 break; 1261 1262 case sBanner: 1263 charptr = &options->banner; 1264 goto parse_filename; 1265 /* 1266 * These options can contain %X options expanded at 1267 * connect time, so that you can specify paths like: 1268 * 1269 * AuthorizedKeysFile /etc/ssh_keys/%u 1270 */ 1271 case sAuthorizedKeysFile: 1272 case sAuthorizedKeysFile2: 1273 charptr = (opcode == sAuthorizedKeysFile) ? 1274 &options->authorized_keys_file : 1275 &options->authorized_keys_file2; 1276 goto parse_filename; 1277 1278 case sClientAliveInterval: 1279 intptr = &options->client_alive_interval; 1280 goto parse_time; 1281 1282 case sClientAliveCountMax: 1283 intptr = &options->client_alive_count_max; 1284 goto parse_int; 1285 1286 case sMaxAuthTries: 1287 intptr = &options->max_auth_tries; 1288 goto parse_int; 1289 1290 case sMaxAuthTriesLog: 1291 intptr = &options->max_auth_tries_log; 1292 goto parse_int; 1293 1294 case sLookupClientHostnames: 1295 intptr = &options->lookup_client_hostnames; 1296 goto parse_flag; 1297 1298 case sUseOpenSSLEngine: 1299 intptr = &options->use_openssl_engine; 1300 goto parse_flag; 1301 1302 case sChrootDirectory: 1303 charptr = &options->chroot_directory; 1304 1305 arg = strdelim(&cp); 1306 if (arg == NULL || *arg == '\0') 1307 fatal("%s line %d: missing directory name for " 1308 "ChrootDirectory.", filename, linenum); 1309 if (*activep && *charptr == NULL) 1310 *charptr = xstrdup(arg); 1311 break; 1312 1313 case sPreUserauthHook: 1314 charptr = &options->pre_userauth_hook; 1315 goto parse_filename; 1316 1317 case sMatch: 1318 if (cmdline) 1319 fatal("Match directive not supported as a command-line " 1320 "option"); 1321 value = match_cfg_line(&cp, linenum, user, host, address); 1322 if (value < 0) 1323 fatal("%s line %d: Bad Match condition", filename, 1324 linenum); 1325 *activep = value; 1326 break; 1327 1328 case sDeprecated: 1329 log("%s line %d: Deprecated option %s", 1330 filename, linenum, arg); 1331 while (arg) 1332 arg = strdelim(&cp); 1333 break; 1334 1335 case sPAMServicePrefix: 1336 arg = strdelim(&cp); 1337 if (!arg || *arg == '\0') 1338 fatal("%s line %d: Missing argument.", 1339 filename, linenum); 1340 if (options->pam_service_name != NULL) 1341 fatal("%s line %d: PAMServiceName and PAMServicePrefix " 1342 "are mutually exclusive.", filename, linenum); 1343 if (options->pam_service_prefix == NULL) 1344 options->pam_service_prefix = xstrdup(arg); 1345 break; 1346 1347 case sPAMServiceName: 1348 arg = strdelim(&cp); 1349 if (!arg || *arg == '\0') 1350 fatal("%s line %d: Missing argument.", 1351 filename, linenum); 1352 if (options->pam_service_prefix != NULL) 1353 fatal("%s line %d: PAMServiceName and PAMServicePrefix " 1354 "are mutually exclusive.", filename, linenum); 1355 if (options->pam_service_name == NULL) 1356 options->pam_service_name = xstrdup(arg); 1357 break; 1358 1359 default: 1360 fatal("%s line %d: Missing handler for opcode %s (%d)", 1361 filename, linenum, arg, opcode); 1362 } 1363 if ((arg = strdelim(&cp)) != NULL && *arg != '\0') 1364 fatal("%s line %d: garbage at end of line; \"%.200s\".", 1365 filename, linenum, arg); 1366 return 0; 1367 } 1368 1369 1370 /* Reads the server configuration file. */ 1371 1372 void 1373 load_server_config(const char *filename, Buffer *conf) 1374 { 1375 char line[1024], *cp; 1376 FILE *f; 1377 1378 debug2("%s: filename %s", __func__, filename); 1379 if ((f = fopen(filename, "r")) == NULL) { 1380 perror(filename); 1381 exit(1); 1382 } 1383 buffer_clear(conf); 1384 while (fgets(line, sizeof(line), f)) { 1385 /* 1386 * Trim out comments and strip whitespace 1387 * NB - preserve newlines, they are needed to reproduce 1388 * line numbers later for error messages 1389 */ 1390 if ((cp = strchr(line, '#')) != NULL) 1391 memcpy(cp, "\n", 2); 1392 cp = line + strspn(line, " \t\r"); 1393 1394 buffer_append(conf, cp, strlen(cp)); 1395 } 1396 buffer_append(conf, "\0", 1); 1397 fclose(f); 1398 debug2("%s: done config len = %d", __func__, buffer_len(conf)); 1399 } 1400 1401 void 1402 parse_server_match_config(ServerOptions *options, const char *user, 1403 const char *host, const char *address) 1404 { 1405 ServerOptions mo; 1406 1407 initialize_server_options(&mo); 1408 parse_server_config(&mo, "reprocess config", &cfg, user, host, address); 1409 copy_set_server_options(options, &mo, 0); 1410 } 1411 1412 1413 1414 /* Helper macros */ 1415 #define M_CP_INTOPT(n) do {\ 1416 if (src->n != -1) \ 1417 dst->n = src->n; \ 1418 } while (0) 1419 #define M_CP_STROPT(n) do {\ 1420 if (src->n != NULL) { \ 1421 if (dst->n != NULL) \ 1422 xfree(dst->n); \ 1423 dst->n = src->n; \ 1424 } \ 1425 } while(0) 1426 1427 /* 1428 * Copy any supported values that are set. 1429 * 1430 * If the preauth flag is set, we do not bother copying the the string or 1431 * array values that are not used pre-authentication, because any that we 1432 * do use must be explictly sent in mm_getpwnamallow(). 1433 */ 1434 void 1435 copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth) 1436 { 1437 M_CP_INTOPT(password_authentication); 1438 M_CP_INTOPT(gss_authentication); 1439 M_CP_INTOPT(rsa_authentication); 1440 M_CP_INTOPT(pubkey_authentication); 1441 M_CP_INTOPT(hostbased_authentication); 1442 M_CP_INTOPT(kbd_interactive_authentication); 1443 M_CP_INTOPT(permit_root_login); 1444 M_CP_INTOPT(permit_empty_passwd); 1445 M_CP_INTOPT(allow_tcp_forwarding); 1446 M_CP_INTOPT(gateway_ports); 1447 M_CP_INTOPT(x11_display_offset); 1448 M_CP_INTOPT(x11_forwarding); 1449 M_CP_INTOPT(x11_use_localhost); 1450 M_CP_INTOPT(max_auth_tries); 1451 M_CP_STROPT(banner); 1452 1453 if (preauth) 1454 return; 1455 M_CP_STROPT(chroot_directory); 1456 } 1457 1458 #undef M_CP_INTOPT 1459 #undef M_CP_STROPT 1460 1461 void 1462 parse_server_config(ServerOptions *options, const char *filename, Buffer *conf, 1463 const char *user, const char *host, const char *address) 1464 { 1465 int active, linenum, bad_options = 0; 1466 char *cp, *obuf, *cbuf; 1467 1468 debug2("%s: config %s len %d", __func__, filename, buffer_len(conf)); 1469 1470 obuf = cbuf = xstrdup(buffer_ptr(conf)); 1471 active = user ? 0 : 1; 1472 linenum = 1; 1473 while ((cp = strsep(&cbuf, "\n")) != NULL) { 1474 if (process_server_config_line(options, cp, filename, 1475 linenum++, &active, user, host, address) != 0) 1476 bad_options++; 1477 } 1478 xfree(obuf); 1479 if (bad_options > 0) 1480 fatal("%s: terminating, %d bad configuration options", 1481 filename, bad_options); 1482 } 1483 1484 1485 /* 1486 * Note that "none" is a special path having the same affect on sshd 1487 * configuration as not specifying ChrootDirectory at all. 1488 */ 1489 int 1490 chroot_requested(char *chroot_directory) 1491 { 1492 return (chroot_directory != NULL && 1493 strcasecmp(chroot_directory, "none") != 0); 1494 } 1495