src/usr.bin/ssh/auth-rh-rsa.c - diff

Return to auth-rh-rsa.c CVS log

Up to [local] / src / usr.bin / ssh

Diff for /src/usr.bin/ssh/Attic/auth-rh-rsa.c between version 1.23 and 1.23.2.4

version 1.23, 2001/04/06 21:00:04

version 1.23.2.4, 2002/06/02 22:56:09

Line 16

RCSID("$OpenBSD$");

#include "packet.h"

#include "xmalloc.h"

#include "uidswap.h"

#include "log.h"

#include "servconf.h"

Line 24

Line 23

#include "hostfile.h"

#include "pathnames.h"

#include "auth.h"

#include "tildexpand.h"

#include "canohost.h"

#include "monitor_wrap.h"

* Tries to authenticate the user using the .rhosts file and the host using

* its host key. Returns true if authentication succeeds.

/* import */

extern ServerOptions options;

int

auth_rhosts_rsa(struct passwd *pw, const char *client_user, RSA *client_host_key)

auth_rhosts_rsa_key_allowed(struct passwd *pw, char *cuser, char *chost,

Key *client_host_key)

{

extern ServerOptions options;

const char *canonical_hostname;

HostStatus host_status;

Key *client_key, *found;

debug("Trying rhosts with RSA host authentication for client user %.100s", client_user);

if (pw == NULL || client_host_key == NULL)

return 0;

/* Check if we would accept it using rhosts authentication. */

if (!auth_rhosts(pw, client_user))

if (!auth_rhosts(pw, cuser))

return 0;

canonical_hostname = get_canonical_hostname(

host_status = check_key_in_hostfiles(pw, client_host_key,

options.reverse_mapping_check);

chost, _PATH_SSH_SYSTEM_HOSTFILE,

options.ignore_user_known_hosts ? NULL : _PATH_SSH_USER_HOSTFILE);

debug("Rhosts RSA authentication: canonical host %.900s", canonical_hostname);

return (host_status == HOST_OK);

}

/* wrap the RSA key into a 'generic' key */

client_key = key_new(KEY_RSA1);

* Tries to authenticate the user using the .rhosts file and the host using

BN_copy(client_key->rsa->e, client_host_key->e);

* its host key. Returns true if authentication succeeds.

BN_copy(client_key->rsa->n, client_host_key->n);

found = key_new(KEY_RSA1);

int

auth_rhosts_rsa(struct passwd *pw, char *cuser, Key *client_host_key)

{

char *chost;

/* Check if we know the host and its host key. */

debug("Trying rhosts with RSA host authentication for client user %.100s",

host_status = check_host_in_hostfile(_PATH_SSH_SYSTEM_HOSTFILE, canonical_hostname,

cuser);

client_key, found, NULL);

/* Check user host file unless ignored. */

if (pw == NULL || client_host_key == NULL ||

if (host_status != HOST_OK && !options.ignore_user_known_hosts) {

client_host_key->rsa == NULL)

struct stat st;

return 0;

char *user_hostfile = tilde_expand_filename(_PATH_SSH_USER_HOSTFILE, pw->pw_uid);

* Check file permissions of _PATH_SSH_USER_HOSTFILE, auth_rsa()

* did already check pw->pw_dir, but there is a race XXX

if (options.strict_modes &&

(stat(user_hostfile, &st) == 0) &&

((st.st_uid != 0 && st.st_uid != pw->pw_uid) ||

(st.st_mode & 022) != 0)) {

log("Rhosts RSA authentication refused for %.100s: bad owner or modes for %.200s",

pw->pw_name, user_hostfile);

} else {

/* XXX race between stat and the following open() */

temporarily_use_uid(pw);

host_status = check_host_in_hostfile(user_hostfile, canonical_hostname,

client_key, found, NULL);

restore_uid();

}

xfree(user_hostfile);

}

key_free(client_key);

key_free(found);

if (host_status != HOST_OK) {

chost = (char *)get_canonical_hostname(options.verify_reverse_mapping);

debug("Rhosts RSA authentication: canonical host %.900s", chost);

if (!PRIVSEP(auth_rhosts_rsa_key_allowed(pw, cuser, chost, client_host_key))) {

debug("Rhosts with RSA host authentication denied: unknown or invalid host key");

packet_send_debug("Your host key cannot be verified: unknown or invalid host key.");

return 0;

Line 100

Line 76

/* Perform the challenge-response dialog with the client for the host key. */

if (!auth_rsa_challenge_dialog(client_host_key)) {

log("Client on %.800s failed to respond correctly to host authentication.",

canonical_hostname);

chost);

return 0;

}

Line 109

Line 85

verbose("Rhosts with RSA host authentication accepted for %.100s, %.100s on %.700s.",

pw->pw_name, client_user, canonical_hostname);

pw->pw_name, cuser, chost);

packet_send_debug("Rhosts with RSA host authentication accepted.");

return 1;

}