diff options
Diffstat (limited to 'openssh-6.6p1-kuserok.patch')
| -rw-r--r-- | openssh-6.6p1-kuserok.patch | 289 |
1 files changed, 0 insertions, 289 deletions
diff --git a/openssh-6.6p1-kuserok.patch b/openssh-6.6p1-kuserok.patch deleted file mode 100644 index 6e2c76a..0000000 --- a/openssh-6.6p1-kuserok.patch +++ /dev/null @@ -1,289 +0,0 @@ -diff -up openssh-7.4p1/auth-krb5.c.kuserok openssh-7.4p1/auth-krb5.c ---- openssh-7.4p1/auth-krb5.c.kuserok 2016-12-23 14:36:07.640465939 +0100 -+++ openssh-7.4p1/auth-krb5.c 2016-12-23 14:36:07.644465936 +0100 -@@ -56,6 +56,21 @@ - - extern ServerOptions options; - -+int -+ssh_krb5_kuserok(krb5_context krb5_ctx, krb5_principal krb5_user, const char *client, -+ int k5login_exists) -+{ -+ if (options.use_kuserok || !k5login_exists) -+ return krb5_kuserok(krb5_ctx, krb5_user, client); -+ else { -+ char kuser[65]; -+ -+ if (krb5_aname_to_localname(krb5_ctx, krb5_user, sizeof(kuser), kuser)) -+ return 0; -+ return strcmp(kuser, client) == 0; -+ } -+} -+ - static int - krb5_init(void *context) - { -@@ -160,8 +175,9 @@ auth_krb5_password(Authctxt *authctxt, c - if (problem) - goto out; - -- if (!krb5_kuserok(authctxt->krb5_ctx, authctxt->krb5_user, -- authctxt->pw->pw_name)) { -+ /* Use !options.use_kuserok here to make ssh_krb5_kuserok() not -+ * depend on the existance of .k5login */ -+ if (!ssh_krb5_kuserok(authctxt->krb5_ctx, authctxt->krb5_user, authctxt->pw->pw_name, !options.use_kuserok)) { - problem = -1; - goto out; - } -diff -up openssh-7.4p1/gss-serv-krb5.c.kuserok openssh-7.4p1/gss-serv-krb5.c ---- openssh-7.4p1/gss-serv-krb5.c.kuserok 2016-12-23 14:36:07.640465939 +0100 -+++ openssh-7.4p1/gss-serv-krb5.c 2016-12-23 14:36:07.644465936 +0100 -@@ -67,6 +67,7 @@ static int ssh_gssapi_krb5_cmdok(krb5_pr - int); - - static krb5_context krb_context = NULL; -+extern int ssh_krb5_kuserok(krb5_context, krb5_principal, const char *, int); - - /* Initialise the krb5 library, for the stuff that GSSAPI won't do */ - -@@ -92,6 +93,103 @@ ssh_gssapi_krb5_init(void) - * Returns true if the user is OK to log in, otherwise returns 0 - */ - -+/* The purpose of the function is to find out if a Kerberos principal is -+ * allowed to log in as the given local user. This is a general problem with -+ * Kerberized services because by design the Kerberos principals are -+ * completely independent from the local user names. This is one of the -+ * reasons why Kerberos is working well on different operating systems like -+ * Windows and UNIX/Linux. Nevertheless a relationship between a Kerberos -+ * principal and a local user name must be established because otherwise every -+ * access would be granted for every principal with a valid ticket. -+ * -+ * Since it is a general issue libkrb5 provides some functions for -+ * applications to find out about the relationship between the Kerberos -+ * principal and a local user name. They are krb5_kuserok() and -+ * krb5_aname_to_localname(). -+ * -+ * krb5_kuserok() can be used to "Determine if a principal is authorized to -+ * log in as a local user" (from the MIT Kerberos documentation of this -+ * function). Which is exactly what we are looking for and should be the -+ * preferred choice. It accepts the Kerberos principal and a local user name -+ * and let libkrb5 or its plugins determine if they relate to each other or -+ * not. -+ * -+ * krb5_aname_to_localname() can use used to "Convert a principal name to a -+ * local name" (from the MIT Kerberos documentation of this function). It -+ * accepts a Kerberos principle and returns a local name and it is up to the -+ * application to do any additional checks. There are two issues using -+ * krb5_aname_to_localname(). First, since POSIX user names are case -+ * sensitive, the calling application in general has no other choice than -+ * doing a case-sensitive string comparison between the name returned by -+ * krb5_aname_to_localname() and the name used at the login prompt. When the -+ * users are provided by a case in-sensitive server, e.g. Active Directory, -+ * this might lead to login failures because the user typing the name at the -+ * login prompt might not be aware of the right case. Another issue might be -+ * caused if there are multiple alias names available for a single user. E.g. -+ * the canonical name of a user is user@group.department.example.com but there -+ * exists a shorter login name, e.g. user@example.com, to safe typing at the -+ * login prompt. Here krb5_aname_to_localname() can only return the canonical -+ * name, but if the short alias is used at the login prompt authentication -+ * will fail as well. All this can be avoided by using krb5_kuserok() and -+ * configuring krb5.conf or using a suitable plugin to meet the needs of the -+ * given environment. -+ * -+ * The openEuler version of openssh contain two patches which modify the -+ * access control behavior: -+ * - openssh-6.6p1-kuserok.patch -+ * - openssh-6.6p1-force_krb.patch -+ * -+ * openssh-6.6p1-kuserok.patch adds a new option KerberosUseKuserok for -+ * sshd_config which controls if krb5_kuserok() is used to check if the -+ * principle is authorized or if krb5_aname_to_localname() should be used. -+ * The reason to add this patch was that krb5_kuserok() by default checks if -+ * a .k5login file exits in the users home-directory. With this the user can -+ * give access to his account for any given principal which might be -+ * in violation with company policies and it would be useful if this can be -+ * rejected. Nevertheless the patch ignores the fact that krb5_kuserok() does -+ * no only check .k5login but other sources as well and checking .k5login can -+ * be disabled for all applications in krb5.conf as well. With this new -+ * option KerberosUseKuserok set to 'no' (and this is the default for -+ * openEuler) openssh can only use krb5_aname_to_localname() with the -+ * restrictions mentioned above. -+ * -+ * openssh-6.6p1-force_krb.patch adds a ksu like behaviour to ssh, i.e. when -+ * using GSSAPI authentication only commands configured in the .k5user can be -+ * executed. Here the wrong assumption that krb5_kuserok() only checks -+ * .k5login is made as well. In contrast ksu checks .k5login directly and -+ * does not use krb5_kuserok() which might be more useful for the given -+ * purpose. Additionally this patch is not synced with -+ * openssh-6.6p1-kuserok.patch. -+ * -+ * The current patch tries to restore the usage of krb5_kuserok() so that e.g. -+ * localauth plugins can be used. It does so by adding a forth parameter to -+ * ssh_krb5_kuserok() which indicates whether .k5login exists or not. If it -+ * does not exists krb5_kuserok() is called even if KerberosUseKuserok is set -+ * to 'no' because the intent of the option is to not check .k5login and if it -+ * does not exists krb5_kuserok() returns a result without checking .k5login. -+ * If .k5login does exists and KerberosUseKuserok is 'no' we fall back to -+ * krb5_aname_to_localname(). This is in my point of view an acceptable -+ * limitation and does not break the current behaviour. -+ * -+ * Additionally with this patch ssh_krb5_kuserok() is called in -+ * ssh_gssapi_krb5_cmdok() instead of only krb5_aname_to_localname() is -+ * neither .k5login nor .k5users exists to allow plugin evaluation via -+ * krb5_kuserok() as well. -+ * -+ * I tried to keep the patch as minimal as possible, nevertheless I see some -+ * areas for improvement which, if they make sense, have to be evaluated -+ * carefully because they might change existing behaviour and cause breaks -+ * during upgrade: -+ * - I wonder if disabling .k5login usage make sense in sshd or if it should -+ * be better disabled globally in krb5.conf -+ * - if really needed openssh-6.6p1-kuserok.patch should be fixed to really -+ * only disable checking .k5login and maybe .k5users -+ * - the ksu behaviour should be configurable and maybe check the .k5login and -+ * .k5users files directly like ksu itself does -+ * - to make krb5_aname_to_localname() more useful an option for sshd to use -+ * the canonical name (the one returned by getpwnam()) instead of the name -+ * given at the login prompt might be useful */ -+ - static int - ssh_gssapi_krb5_userok(ssh_gssapi_client *client, char *name) - { -@@ -116,7 +214,8 @@ ssh_gssapi_krb5_userok(ssh_gssapi_client - /* NOTE: .k5login and .k5users must opened as root, not the user, - * because if they are on a krb5-protected filesystem, user credentials - * to access these files aren't available yet. */ -- if (krb5_kuserok(krb_context, princ, name) && k5login_exists) { -+ if (ssh_krb5_kuserok(krb_context, princ, name, k5login_exists) -+ && k5login_exists) { - retval = 1; - logit("Authorized to %s, krb5 principal %s (krb5_kuserok)", - name, (char *)client->displayname.value); -@@ -190,9 +289,8 @@ ssh_gssapi_krb5_cmdok(krb5_principal pri - snprintf(file, sizeof(file), "%s/.k5users", pw->pw_dir); - /* If both .k5login and .k5users DNE, self-login is ok. */ - if (!k5login_exists && (access(file, F_OK) == -1)) { -- return (krb5_aname_to_localname(krb_context, principal, -- sizeof(kuser), kuser) == 0) && -- (strcmp(kuser, luser) == 0); -+ return ssh_krb5_kuserok(krb_context, principal, luser, -+ k5login_exists); - } - if ((fp = fopen(file, "r")) == NULL) { - int saved_errno = errno; -diff -up openssh-7.4p1/servconf.c.kuserok openssh-7.4p1/servconf.c ---- openssh-7.4p1/servconf.c.kuserok 2016-12-23 14:36:07.630465944 +0100 -+++ openssh-7.4p1/servconf.c 2016-12-23 15:11:52.278133344 +0100 -@@ -116,6 +116,7 @@ initialize_server_options(ServerOptions - options->gss_strict_acceptor = -1; - options->gss_store_rekey = -1; - options->gss_kex_algorithms = NULL; -+ options->use_kuserok = -1; - options->password_authentication = -1; - options->kbd_interactive_authentication = -1; - options->permit_empty_passwd = -1; -@@ -278,6 +279,8 @@ fill_default_server_options(ServerOption - if (options->gss_kex_algorithms == NULL) - options->gss_kex_algorithms = strdup(GSS_KEX_DEFAULT_KEX); - #endif -+ if (options->use_kuserok == -1) -+ options->use_kuserok = 1; - if (options->password_authentication == -1) - options->password_authentication = 1; - if (options->kbd_interactive_authentication == -1) -@@ -399,7 +402,7 @@ typedef enum { - sPort, sHostKeyFile, sLoginGraceTime, - sPermitRootLogin, sLogFacility, sLogLevel, sLogVerbose, - sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup, -- sKerberosGetAFSToken, sKerberosUniqueCCache, sPasswordAuthentication, -+ sKerberosGetAFSToken, sKerberosUniqueCCache, sKerberosUseKuserok, sPasswordAuthentication, - sKbdInteractiveAuthentication, sListenAddress, sAddressFamily, - sPrintMotd, sPrintLastLog, sIgnoreRhosts, - sX11Forwarding, sX11DisplayOffset, sX11UseLocalhost, -@@ -478,12 +481,14 @@ static struct { - { "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL }, - #endif - { "kerberosuniqueccache", sKerberosUniqueCCache, SSHCFG_GLOBAL }, -+ { "kerberosusekuserok", sKerberosUseKuserok, SSHCFG_ALL }, - #else - { "kerberosauthentication", sUnsupported, SSHCFG_ALL }, - { "kerberosorlocalpasswd", sUnsupported, SSHCFG_GLOBAL }, - { "kerberosticketcleanup", sUnsupported, SSHCFG_GLOBAL }, - { "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL }, - { "kerberosuniqueccache", sUnsupported, SSHCFG_GLOBAL }, -+ { "kerberosusekuserok", sUnsupported, SSHCFG_ALL }, - #endif - { "kerberostgtpassing", sUnsupported, SSHCFG_GLOBAL }, - { "afstokenpassing", sUnsupported, SSHCFG_GLOBAL }, -@@ -1644,6 +1649,10 @@ process_server_config_line(ServerOptions - } - break; - -+ case sKerberosUseKuserok: -+ intptr = &options->use_kuserok; -+ goto parse_flag; -+ - case sMatch: - if (cmdline) - fatal("Match directive not supported as a command-line " -@@ -2016,6 +2025,7 @@ copy_set_server_options(ServerOptions *d - M_CP_INTOPT(client_alive_interval); - M_CP_INTOPT(ip_qos_interactive); - M_CP_INTOPT(ip_qos_bulk); -+ M_CP_INTOPT(use_kuserok); - M_CP_INTOPT(rekey_limit); - M_CP_INTOPT(rekey_interval); - M_CP_INTOPT(log_level); -@@ -2309,6 +2319,7 @@ dump_config(ServerOptions *o) - dump_cfg_fmtint(sKerberosGetAFSToken, o->kerberos_get_afs_token); - # endif - dump_cfg_fmtint(sKerberosUniqueCCache, o->kerberos_unique_ccache); -+ dump_cfg_fmtint(sKerberosUseKuserok, o->use_kuserok); - #endif - #ifdef GSSAPI - dump_cfg_fmtint(sGssAuthentication, o->gss_authentication); -diff -up openssh-7.4p1/servconf.h.kuserok openssh-7.4p1/servconf.h ---- openssh-7.4p1/servconf.h.kuserok 2016-12-23 14:36:07.630465944 +0100 -+++ openssh-7.4p1/servconf.h 2016-12-23 14:36:07.645465936 +0100 -@@ -118,6 +118,7 @@ typedef struct { - * authenticated with Kerberos. */ - int kerberos_unique_ccache; /* If true, the acquired ticket will - * be stored in per-session ccache */ -+ int use_kuserok; - int gss_authentication; /* If true, permit GSSAPI authentication */ - int gss_keyex; /* If true, permit GSSAPI key exchange */ - int gss_cleanup_creds; /* If true, destroy cred cache on logout */ -diff -up openssh-7.4p1/sshd_config.5.kuserok openssh-7.4p1/sshd_config.5 ---- openssh-7.4p1/sshd_config.5.kuserok 2016-12-23 14:36:07.637465940 +0100 -+++ openssh-7.4p1/sshd_config.5 2016-12-23 15:14:03.117162222 +0100 -@@ -850,6 +850,10 @@ Specifies whether to automatically destr - .Cm no - can lead to overwriting previous tickets by subseqent connections to the same - user account. -+.It Cm KerberosUseKuserok -+Specifies whether to look at .k5login file for user's aliases. -+The default is -+.Cm yes . - .It Cm KexAlgorithms - Specifies the available KEX (Key Exchange) algorithms. - Multiple algorithms must be comma-separated. -@@ -1078,6 +1082,7 @@ Available keywords are - .Cm IPQoS , - .Cm KbdInteractiveAuthentication , - .Cm KerberosAuthentication , -+.Cm KerberosUseKuserok , - .Cm LogLevel , - .Cm MaxAuthTries , - .Cm MaxSessions , -diff -up openssh-7.4p1/sshd_config.kuserok openssh-7.4p1/sshd_config ---- openssh-7.4p1/sshd_config.kuserok 2016-12-23 14:36:07.631465943 +0100 -+++ openssh-7.4p1/sshd_config 2016-12-23 14:36:07.646465935 +0100 -@@ -73,6 +73,7 @@ ChallengeResponseAuthentication no - #KerberosOrLocalPasswd yes - #KerberosTicketCleanup yes - #KerberosGetAFSToken no -+#KerberosUseKuserok yes - - # GSSAPI options - #GSSAPIAuthentication no |