===================================================================
RCS file: /cvsrepo/anoncvs/cvs/src/usr.bin/ssh/monitor.c,v
retrieving revision 1.163
retrieving revision 1.164
diff -u -r1.163 -r1.164
--- src/usr.bin/ssh/monitor.c	2016/08/19 03:18:06	1.163
+++ src/usr.bin/ssh/monitor.c	2016/08/30 07:50:21	1.164
@@ -1,4 +1,4 @@
-/* $OpenBSD: monitor.c,v 1.163 2016/08/19 03:18:06 djm Exp $ */
+/* $OpenBSD: monitor.c,v 1.164 2016/08/30 07:50:21 djm Exp $ */
 /*
  * Copyright 2002 Niels Provos <provos@citi.umich.edu>
  * Copyright 2002 Markus Friedl <markus@openbsd.org>
@@ -759,6 +759,8 @@
 	int authenticated;
 	u_int plen;
 
+	if (!options.password_authentication)
+		fatal("%s: password authentication not enabled", __func__);
 	passwd = buffer_get_string(m, &plen);
 	/* Only authenticate if the context is valid */
 	authenticated = options.password_authentication &&
@@ -791,6 +793,8 @@
 	char **prompts;
 	u_int success;
 
+	if (!options.kbd_interactive_authentication)
+		fatal("%s: kbd-int authentication not enabled", __func__);
 	success = bsdauth_query(authctxt, &name, &infotxt, &numprompts,
 	    &prompts, &echo_on) < 0 ? 0 : 1;
 
@@ -818,6 +822,8 @@
 	char *response;
 	int authok;
 
+	if (!options.kbd_interactive_authentication)
+		fatal("%s: kbd-int authentication not enabled", __func__);
 	if (authctxt->as == NULL)
 		fatal("%s: no bsd auth session", __func__);
 
@@ -1380,6 +1386,9 @@
 	OM_uint32 major;
 	u_int len;
 
+	if (!options.gss_authentication)
+		fatal("%s: GSSAPI authentication not enabled", __func__);
+
 	goid.elements = buffer_get_string(m, &len);
 	goid.length = len;
 
@@ -1407,6 +1416,9 @@
 	OM_uint32 flags = 0; /* GSI needs this */
 	u_int len;
 
+	if (!options.gss_authentication)
+		fatal("%s: GSSAPI authentication not enabled", __func__);
+
 	in.value = buffer_get_string(m, &len);
 	in.length = len;
 	major = ssh_gssapi_accept_ctx(gsscontext, &in, &out, &flags);
@@ -1435,6 +1447,9 @@
 	OM_uint32 ret;
 	u_int len;
 
+	if (!options.gss_authentication)
+		fatal("%s: GSSAPI authentication not enabled", __func__);
+
 	gssbuf.value = buffer_get_string(m, &len);
 	gssbuf.length = len;
 	mic.value = buffer_get_string(m, &len);
@@ -1460,6 +1475,9 @@
 mm_answer_gss_userok(int sock, Buffer *m)
 {
 	int authenticated;
+
+	if (!options.gss_authentication)
+		fatal("%s: GSSAPI authentication not enabled", __func__);
 
 	authenticated = authctxt->valid && ssh_gssapi_userok(authctxt->user);