diff options
Diffstat (limited to 'scripts/git-integration/0001-Patch-sshd-for-the-AUR.patch')
| -rw-r--r-- | scripts/git-integration/0001-Patch-sshd-for-the-AUR.patch | 1146 |
1 files changed, 1044 insertions, 102 deletions
diff --git a/scripts/git-integration/0001-Patch-sshd-for-the-AUR.patch b/scripts/git-integration/0001-Patch-sshd-for-the-AUR.patch index 6b72712..688b115 100644 --- a/scripts/git-integration/0001-Patch-sshd-for-the-AUR.patch +++ b/scripts/git-integration/0001-Patch-sshd-for-the-AUR.patch @@ -1,11 +1,10 @@ -From e23745b61a46f034bca3cab9936c24c249afdc7f Mon Sep 17 00:00:00 2001 -From: Lukas Fleischer <archlinux@cryptocrack.de> -Date: Sun, 21 Dec 2014 22:17:48 +0100 +From 6423ae83d38535687d52097b7854b3c81151fe34 Mon Sep 17 00:00:00 2001 +From: Lukas Fleischer <lfleischer@archlinux.org> +Date: Sat, 11 Apr 2015 12:57:46 +0200 Subject: [PATCH] Patch sshd for the AUR -* Add SSH_KEY_FINGERPRINT and SSH_KEY variables to the environment of - the AuthorizedKeysCommand which allows for efficiently looking up SSH - keys in the AUR database. +* Apply the latest version of Damien Miller's patch to extend the + parameters to the AuthorizedKeysCommand. * Remove the secure path check for the AuthorizedKeysCommand. We are running the sshd under a non-privileged user who has as little @@ -14,139 +13,1082 @@ Subject: [PATCH] Patch sshd for the AUR * Prevent from running the sshd as root. -Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de> +Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org> --- - auth2-pubkey.c | 48 +++++++++++++++++++++++++++++++++++++++++++----- - ssh.h | 12 ++++++++++++ - sshd.c | 5 +++++ - sshd_config.5 | 5 +++++ - 4 files changed, 65 insertions(+), 5 deletions(-) + auth2-pubkey.c | 530 +++++++++++++++++++++++++++++++++++++++++++-------------- + servconf.c | 35 ++++ + servconf.h | 8 +- + ssh.c | 5 + + sshd.c | 5 + + sshd_config.5 | 54 +++++- + sshkey.c | 172 +++++++++++-------- + sshkey.h | 1 + + 8 files changed, 606 insertions(+), 204 deletions(-) diff --git a/auth2-pubkey.c b/auth2-pubkey.c -index 0a3c1de..baf4922 100644 +index d943efa..2ce0a4b 100644 --- a/auth2-pubkey.c +++ b/auth2-pubkey.c -@@ -510,6 +510,8 @@ user_key_command_allowed2(struct passwd *user_pw, Key *key) - int status, devnull, p[2], i; - pid_t pid; - char *username, errmsg[512]; -+ struct sshbuf *b = NULL, *bb = NULL; -+ char *keytext, *uu = NULL; - - if (options.authorized_keys_command == NULL || - options.authorized_keys_command[0] != '/') -@@ -538,11 +540,6 @@ user_key_command_allowed2(struct passwd *user_pw, Key *key) - options.authorized_keys_command, strerror(errno)); - goto out; - } -- if (auth_secure_path(options.authorized_keys_command, &st, NULL, 0, -- errmsg, sizeof(errmsg)) != 0) { -- error("Unsafe AuthorizedKeysCommand: %s", errmsg); -- goto out; -- } +@@ -65,6 +65,9 @@ + #include "monitor_wrap.h" + #include "authfile.h" + #include "match.h" ++#include "ssherr.h" ++#include "channels.h" /* XXX for session.h */ ++#include "session.h" /* XXX for child_set_env(); refactor? */ - if (pipe(p) != 0) { - error("%s: pipe: %s", __func__, strerror(errno)); -@@ -568,6 +565,47 @@ user_key_command_allowed2(struct passwd *user_pw, Key *key) - for (i = 0; i < NSIG; i++) - signal(i, SIG_DFL); + /* import */ + extern ServerOptions options; +@@ -248,6 +251,227 @@ pubkey_auth_info(Authctxt *authctxt, const Key *key, const char *fmt, ...) + free(extra); + } -+ keytext = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX); -+ if (setenv(SSH_KEY_FINGERPRINT_ENV_NAME, keytext, 1) == -1) { -+ error("%s: setenv: %s", __func__, strerror(errno)); -+ _exit(1); -+ } ++/* ++ * Splits 's' into an argument vector. Handles quoted string and basic ++ * escape characters (\\, \", \'). Caller must free the argument vector ++ * and its members. ++ */ ++static int ++split_argv(const char *s, int *argcp, char ***argvp) ++{ ++ int r = SSH_ERR_INTERNAL_ERROR; ++ int argc = 0, quote, i, j; ++ char *arg, **argv = xcalloc(1, sizeof(*argv)); + -+ if (!(b = sshbuf_new()) || !(bb = sshbuf_new())) { -+ error("%s: sshbuf_new: %s", __func__, strerror(errno)); -+ _exit(1); ++ *argvp = NULL; ++ *argcp = 0; ++ ++ for (i = 0; s[i] != '\0'; i++) { ++ /* Skip leading whitespace */ ++ if (s[i] == ' ' || s[i] == '\t') ++ continue; ++ ++ /* Start of a token */ ++ quote = 0; ++ if (s[i] == '\\' && ++ (s[i + 1] == '\'' || s[i + 1] == '\"' || s[i + 1] == '\\')) ++ i++; ++ else if (s[i] == '\'' || s[i] == '"') ++ quote = s[i++]; ++ ++ argv = xrealloc(argv, (argc + 2), sizeof(*argv)); ++ arg = argv[argc++] = xcalloc(1, strlen(s + i) + 1); ++ argv[argc] = NULL; ++ ++ /* Copy the token in, removing escapes */ ++ for (j = 0; s[i] != '\0'; i++) { ++ if (s[i] == '\\') { ++ if (s[i + 1] == '\'' || ++ s[i + 1] == '\"' || ++ s[i + 1] == '\\') { ++ i++; /* Skip '\' */ ++ arg[j++] = s[i]; ++ } else { ++ /* Unrecognised escape */ ++ arg[j++] = s[i]; ++ } ++ } else if (quote == 0 && (s[i] == ' ' || s[i] == '\t')) ++ break; /* done */ ++ else if (quote != 0 && s[i] == quote) ++ break; /* done */ ++ else ++ arg[j++] = s[i]; ++ } ++ if (s[i] == '\0') { ++ if (quote != 0) { ++ /* Ran out of string looking for close quote */ ++ r = SSH_ERR_INVALID_FORMAT; ++ goto out; ++ } ++ break; + } -+ if (sshkey_to_blob_buf(key, bb) != 0) { -+ error("%s: sshkey_to_blob_buf: %s", __func__, ++ } ++ /* Success */ ++ *argcp = argc; ++ *argvp = argv; ++ argc = 0; ++ argv = NULL; ++ r = 0; ++ out: ++ if (argc != 0 && argv != NULL) { ++ for (i = 0; i < argc; i++) ++ free(argv[i]); ++ free(argv); ++ } ++ return r; ++} ++ ++/* ++ * Runs command in a subprocess. Returns pid on success and a FILE* to the ++ * subprocess' stdout or 0 on failure. ++ * NB. "command" is only used for logging. ++ */ ++static pid_t ++subprocess(const char *tag, struct passwd *pw, const char *command, ++ int ac, char **av, FILE **child) ++{ ++ FILE *f; ++ struct stat st; ++ int devnull, p[2], i; ++ pid_t pid; ++ char *cp, errmsg[512]; ++ u_int envsize; ++ char **child_env; ++ ++ *child = NULL; ++ ++ debug3("%s: %s command \"%s\" running as %s", __func__, ++ tag, command, pw->pw_name); ++ ++ /* Verify the path exists and is safe-ish to execute */ ++ if (*av[0] != '/') { ++ error("%s path is not absolute", tag); ++ return 0; ++ } ++ temporarily_use_uid(pw); ++ if (stat(av[0], &st) < 0) { ++ error("Could not stat %s \"%s\": %s", tag, ++ av[0], strerror(errno)); ++ restore_uid(); ++ return 0; ++ } ++ ++ /* ++ * Run the command; stderr is left in place, stdout is the ++ * authorized_keys output. ++ */ ++ if (pipe(p) != 0) { ++ error("%s: pipe: %s", tag, strerror(errno)); ++ restore_uid(); ++ return 0; ++ } ++ ++ /* ++ * Don't want to call this in the child, where it can fatal() and ++ * run cleanup_exit() code. ++ */ ++ restore_uid(); ++ ++ switch ((pid = fork())) { ++ case -1: /* error */ ++ error("%s: fork: %s", tag, strerror(errno)); ++ close(p[0]); ++ close(p[1]); ++ return 0; ++ case 0: /* child */ ++ /* Prepare a minimal environment for the child. */ ++ envsize = 5; ++ child_env = xcalloc(sizeof(*child_env), envsize); ++ child_set_env(&child_env, &envsize, "PATH", _PATH_STDPATH); ++ child_set_env(&child_env, &envsize, "USER", pw->pw_name); ++ child_set_env(&child_env, &envsize, "LOGNAME", pw->pw_name); ++ child_set_env(&child_env, &envsize, "HOME", pw->pw_dir); ++ if ((cp = getenv("LANG")) != NULL) ++ child_set_env(&child_env, &envsize, "LANG", cp); ++ ++ for (i = 0; i < NSIG; i++) ++ signal(i, SIG_DFL); ++ ++ if ((devnull = open(_PATH_DEVNULL, O_RDWR)) == -1) { ++ error("%s: open %s: %s", tag, _PATH_DEVNULL, + strerror(errno)); + _exit(1); + } -+ if (!(uu = sshbuf_dtob64(bb))) { -+ error("%s: sshbuf_dtob64: %s", __func__, -+ strerror(errno)); ++ /* Keep stderr around a while longer to catch errors */ ++ if (dup2(devnull, STDIN_FILENO) == -1 || ++ dup2(p[1], STDOUT_FILENO) == -1) { ++ error("%s: dup2: %s", tag, strerror(errno)); + _exit(1); + } -+ if (sshbuf_putf(b, "%s ", sshkey_ssh_name(key))) { -+ error("%s: sshbuf_putf: %s", __func__, ++ closefrom(STDERR_FILENO + 1); ++ ++ /* Don't use permanently_set_uid() here to avoid fatal() */ ++ if (setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) != 0) { ++ error("%s: setresgid %u: %s", tag, (u_int)pw->pw_gid, + strerror(errno)); + _exit(1); + } -+ if (sshbuf_put(b, uu, strlen(uu) + 1)) { -+ error("%s: sshbuf_put: %s", __func__, ++ if (setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid) != 0) { ++ error("%s: setresuid %u: %s", tag, (u_int)pw->pw_uid, + strerror(errno)); + _exit(1); + } -+ if (setenv(SSH_KEY_ENV_NAME, sshbuf_ptr(b), 1) == -1) { -+ error("%s: setenv: %s", __func__, strerror(errno)); ++ /* stdin is pointed to /dev/null at this point */ ++ if (dup2(STDIN_FILENO, STDERR_FILENO) == -1) { ++ error("%s: dup2: %s", tag, strerror(errno)); + _exit(1); + } -+ if (uu) -+ free(uu); -+ if (b) -+ sshbuf_free(b); -+ if (bb) -+ sshbuf_free(bb); -+ - if ((devnull = open(_PATH_DEVNULL, O_RDWR)) == -1) { - error("%s: open %s: %s", __func__, _PATH_DEVNULL, - strerror(errno)); -diff --git a/ssh.h b/ssh.h -index c94633b..411ea86 100644 ---- a/ssh.h -+++ b/ssh.h -@@ -97,3 +97,15 @@ - - /* Listen backlog for sshd, ssh-agent and forwarding sockets */ - #define SSH_LISTEN_BACKLOG 128 + -+/* -+ * Name of the environment variable containing the incoming key passed -+ * to AuthorizedKeysCommand. ++ execve(av[0], av, child_env); ++ error("%s exec \"%s\": %s", tag, command, strerror(errno)); ++ _exit(127); ++ default: /* parent */ ++ break; ++ } ++ ++ close(p[1]); ++ if ((f = fdopen(p[0], "r")) == NULL) { ++ error("%s: fdopen: %s", tag, strerror(errno)); ++ close(p[0]); ++ /* Don't leave zombie child */ ++ kill(pid, SIGTERM); ++ while (waitpid(pid, NULL, 0) == -1 && errno == EINTR) ++ ; ++ return 0; ++ } ++ /* Success */ ++ debug3("%s: %s pid %ld", __func__, tag, (long)pid); ++ *child = f; ++ return pid; ++} ++ ++/* Returns 0 if pid exited cleanly, non-zero otherwise */ ++static int ++exited_cleanly(pid_t pid, const char *tag, const char *cmd) ++{ ++ int status; ++ ++ while (waitpid(pid, &status, 0) == -1) { ++ if (errno != EINTR) { ++ error("%s: waitpid: %s", tag, strerror(errno)); ++ return -1; ++ } ++ } ++ if (WIFSIGNALED(status)) { ++ error("%s %s exited on signal %d", tag, cmd, WTERMSIG(status)); ++ return -1; ++ } else if (WEXITSTATUS(status) != 0) { ++ error("%s %s failed, status %d", tag, cmd, WEXITSTATUS(status)); ++ return -1; ++ } ++ return 0; ++} ++ + static int + match_principals_option(const char *principal_list, struct sshkey_cert *cert) + { +@@ -269,19 +493,13 @@ match_principals_option(const char *principal_list, struct sshkey_cert *cert) + } + + static int +-match_principals_file(char *file, struct passwd *pw, struct sshkey_cert *cert) ++process_principals(FILE *f, char *file, struct passwd *pw, ++ struct sshkey_cert *cert) + { +- FILE *f; + char line[SSH_MAX_PUBKEY_BYTES], *cp, *ep, *line_opts; + u_long linenum = 0; + u_int i; + +- temporarily_use_uid(pw); +- debug("trying authorized principals file %s", file); +- if ((f = auth_openprincipals(file, pw, options.strict_modes)) == NULL) { +- restore_uid(); +- return 0; +- } + while (read_keyfile_line(f, file, line, sizeof(line), &linenum) != -1) { + /* Skip leading whitespace. */ + for (cp = line; *cp == ' ' || *cp == '\t'; cp++) +@@ -309,24 +527,119 @@ match_principals_file(char *file, struct passwd *pw, struct sshkey_cert *cert) + } + for (i = 0; i < cert->nprincipals; i++) { + if (strcmp(cp, cert->principals[i]) == 0) { +- debug3("matched principal \"%.100s\" " +- "from file \"%s\" on line %lu", +- cert->principals[i], file, linenum); ++ debug3("%s:%lu: matched principal \"%.100s\"", ++ file == NULL ? "(command)" : file, ++ linenum, cert->principals[i]); + if (auth_parse_options(pw, line_opts, + file, linenum) != 1) + continue; +- fclose(f); +- restore_uid(); + return 1; + } + } + } ++ return 0; ++} ++ ++static int ++match_principals_file(char *file, struct passwd *pw, struct sshkey_cert *cert) ++{ ++ FILE *f; ++ int success; ++ ++ temporarily_use_uid(pw); ++ debug("trying authorized principals file %s", file); ++ if ((f = auth_openprincipals(file, pw, options.strict_modes)) == NULL) { ++ restore_uid(); ++ return 0; ++ } ++ success = process_principals(f, file, pw, cert); + fclose(f); + restore_uid(); +- return 0; ++ return success; + } + + /* ++ * Checks whether principal is allowed in output of command. ++ * returns 1 if the principal is allowed or 0 otherwise. + */ -+#define SSH_KEY_ENV_NAME "SSH_KEY" ++static int ++match_principals_command(struct passwd *user_pw, struct sshkey *key) ++{ ++ FILE *f = NULL; ++ int ok, found_principal = 0; ++ struct passwd *pw; ++ int i, ac = 0, uid_swapped = 0; ++ pid_t pid; ++ char *username = NULL, *command = NULL, **av = NULL; ++ void (*osigchld)(int); ++ ++ if (options.authorized_principals_command == NULL) ++ return 0; ++ if (options.authorized_principals_command_user == NULL) { ++ error("No user for AuthorizedPrincipalsCommand specified, " ++ "skipping"); ++ return 0; ++ } ++ ++ /* ++ * NB. all returns later this function should go via "out" to ++ * ensure the original SIGCHLD handler is restored properly. ++ */ ++ osigchld = signal(SIGCHLD, SIG_DFL); + ++ /* Prepare and verify the user for the command */ ++ username = percent_expand(options.authorized_principals_command_user, ++ "u", user_pw->pw_name, (char *)NULL); ++ pw = getpwnam(username); ++ if (pw == NULL) { ++ error("AuthorizedPrincipalsCommandUser \"%s\" not found: %s", ++ username, strerror(errno)); ++ goto out; ++ } ++ ++ command = percent_expand(options.authorized_principals_command, ++ "u", user_pw->pw_name, "h", user_pw->pw_dir, (char *)NULL); ++ ++ /* Turn the command into an argument vector */ ++ if (split_argv(command, &ac, &av) != 0) { ++ error("AuthorizedPrincipalsCommand \"%s\" contains " ++ "invalid quotes", command); ++ goto out; ++ } ++ if (ac == 0) { ++ error("AuthorizedPrincipalsCommand \"%s\" yielded no arguments", ++ command); ++ goto out; ++ } ++ ++ if ((pid = subprocess("AuthorizedPrincipalsCommand", pw, command, ++ ac, av, &f)) == 0) ++ goto out; ++ ++ uid_swapped = 1; ++ temporarily_use_uid(pw); ++ ++ ok = process_principals(f, NULL, pw, key->cert); ++ ++ if (exited_cleanly(pid, "AuthorizedPrincipalsCommand", command)) ++ goto out; ++ ++ /* Read completed successfully */ ++ found_principal = ok; ++ out: ++ if (f != NULL) ++ fclose(f); ++ signal(SIGCHLD, osigchld); ++ for (i = 0; i < ac; i++) ++ free(av[i]); ++ free(av); ++ if (uid_swapped) ++ restore_uid(); ++ free(command); ++ free(username); ++ return found_principal; ++} +/* -+ * Name of the environment variable containing the incoming key fingerprint -+ * passed to AuthorizedKeysCommand. -+ */ -+#define SSH_KEY_FINGERPRINT_ENV_NAME "SSH_KEY_FINGERPRINT" -diff --git a/sshd.c b/sshd.c -index 4e01855..60c676f 100644 ---- a/sshd.c -+++ b/sshd.c -@@ -1424,6 +1424,11 @@ main(int ac, char **av) - av = saved_argv; - #endif + * Checks whether key is allowed in authorized_keys-format file, + * returns 1 if the key is allowed or 0 otherwise. + */ +@@ -448,7 +761,7 @@ user_cert_trusted_ca(struct passwd *pw, Key *key) + { + char *ca_fp, *principals_file = NULL; + const char *reason; +- int ret = 0; ++ int ret = 0, found_principal = 0; + + if (!key_is_cert(key) || options.trusted_user_ca_keys == NULL) + return 0; +@@ -470,14 +783,20 @@ user_cert_trusted_ca(struct passwd *pw, Key *key) + * against the username. + */ + if ((principals_file = authorized_principals_file(pw)) != NULL) { +- if (!match_principals_file(principals_file, pw, key->cert)) { +- reason = "Certificate does not contain an " +- "authorized principal"; ++ if (match_principals_file(principals_file, pw, key->cert)) ++ found_principal = 1; ++ } ++ /* Try querying command if specified */ ++ if (!found_principal && match_principals_command(pw, key)) ++ found_principal = 1; ++ /* If principals file or command specify, then require a match here */ ++ if (!found_principal && (principals_file != NULL || ++ options.authorized_principals_command != NULL)) { ++ reason = "Certificate does not contain an authorized principal"; + fail_reason: +- error("%s", reason); +- auth_debug_add("%s", reason); +- goto out; +- } ++ error("%s", reason); ++ auth_debug_add("%s", reason); ++ goto out; + } + if (key_cert_check_authority(key, 0, 1, + principals_file == NULL ? pw->pw_name : NULL, &reason) != 0) +@@ -526,144 +845,105 @@ user_key_allowed2(struct passwd *pw, Key *key, char *file) + static int + user_key_command_allowed2(struct passwd *user_pw, Key *key) + { +- FILE *f; +- int ok, found_key = 0; ++ FILE *f = NULL; ++ int r, ok, found_key = 0; + struct passwd *pw; +- struct stat st; +- int status, devnull, p[2], i; ++ int i, uid_swapped = 0, ac = 0; + pid_t pid; +- char *username, errmsg[512]; ++ char *username = NULL, *key_fp = NULL, *keytext = NULL; ++ char *command = NULL, **av = NULL; ++ void (*osigchld)(int); + +- if (options.authorized_keys_command == NULL || +- options.authorized_keys_command[0] != '/') ++ if (options.authorized_keys_command == NULL) + return 0; +- + if (options.authorized_keys_command_user == NULL) { + error("No user for AuthorizedKeysCommand specified, skipping"); + return 0; + } + ++ /* ++ * NB. all returns later this function should go via "out" to ++ * ensure the original SIGCHLD handler is restored properly. ++ */ ++ osigchld = signal(SIGCHLD, SIG_DFL); ++ ++ /* Prepare and verify the user for the command */ + username = percent_expand(options.authorized_keys_command_user, + "u", user_pw->pw_name, (char *)NULL); + pw = getpwnam(username); + if (pw == NULL) { + error("AuthorizedKeysCommandUser \"%s\" not found: %s", + username, strerror(errno)); +- free(username); +- return 0; ++ goto out; + } +- free(username); +- +- temporarily_use_uid(pw); -+ if (geteuid() == 0) { +- if (stat(options.authorized_keys_command, &st) < 0) { +- error("Could not stat AuthorizedKeysCommand \"%s\": %s", +- options.authorized_keys_command, strerror(errno)); ++ /* Prepare AuthorizedKeysCommand */ ++ if ((key_fp = sshkey_fingerprint(key, options.fingerprint_hash, ++ SSH_FP_DEFAULT)) == NULL) { ++ error("%s: sshkey_fingerprint failed", __func__); + goto out; + } +- if (auth_secure_path(options.authorized_keys_command, &st, NULL, 0, +- errmsg, sizeof(errmsg)) != 0) { +- error("Unsafe AuthorizedKeysCommand: %s", errmsg); ++ if ((r = sshkey_to_base64(key, &keytext)) != 0) { ++ error("%s: sshkey_to_base64 failed: %s", __func__, ssh_err(r)); + goto out; + } +- +- if (pipe(p) != 0) { +- error("%s: pipe: %s", __func__, strerror(errno)); ++ command = percent_expand(options.authorized_keys_command, ++ "u", user_pw->pw_name, "h", user_pw->pw_dir, ++ "t", sshkey_ssh_name(key), "f", key_fp, "k", keytext, (char *)NULL); ++ ++ /* Turn the command into an argument vector */ ++ if (split_argv(command, &ac, &av) != 0) { ++ error("AuthorizedKeysCommand \"%s\" contains invalid quotes", ++ command); ++ goto out; ++ } ++ if (ac == 0) { ++ error("AuthorizedKeysCommand \"%s\" yielded no arguments", ++ command); + goto out; + } +- +- debug3("Running AuthorizedKeysCommand: \"%s %s\" as \"%s\"", +- options.authorized_keys_command, user_pw->pw_name, pw->pw_name); + + /* +- * Don't want to call this in the child, where it can fatal() and +- * run cleanup_exit() code. ++ * If AuthorizedKeysCommand was run without arguments ++ * then fall back to the old behaviour of passing the ++ * target username as a single argument. + */ +- restore_uid(); +- +- switch ((pid = fork())) { +- case -1: /* error */ +- error("%s: fork: %s", __func__, strerror(errno)); +- close(p[0]); +- close(p[1]); +- return 0; +- case 0: /* child */ +- for (i = 0; i < NSIG; i++) +- signal(i, SIG_DFL); +- +- if ((devnull = open(_PATH_DEVNULL, O_RDWR)) == -1) { +- error("%s: open %s: %s", __func__, _PATH_DEVNULL, +- strerror(errno)); +- _exit(1); +- } +- /* Keep stderr around a while longer to catch errors */ +- if (dup2(devnull, STDIN_FILENO) == -1 || +- dup2(p[1], STDOUT_FILENO) == -1) { +- error("%s: dup2: %s", __func__, strerror(errno)); +- _exit(1); +- } +- closefrom(STDERR_FILENO + 1); +- +- /* Don't use permanently_set_uid() here to avoid fatal() */ +- if (setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) != 0) { +- error("setresgid %u: %s", (u_int)pw->pw_gid, +- strerror(errno)); +- _exit(1); +- } +- if (setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid) != 0) { +- error("setresuid %u: %s", (u_int)pw->pw_uid, +- strerror(errno)); +- _exit(1); +- } +- /* stdin is pointed to /dev/null at this point */ +- if (dup2(STDIN_FILENO, STDERR_FILENO) == -1) { +- error("%s: dup2: %s", __func__, strerror(errno)); +- _exit(1); +- } +- +- execl(options.authorized_keys_command, +- options.authorized_keys_command, user_pw->pw_name, NULL); +- +- error("AuthorizedKeysCommand %s exec failed: %s", +- options.authorized_keys_command, strerror(errno)); +- _exit(127); +- default: /* parent */ +- break; ++ if (ac == 1) { ++ av = xrealloc(av, ac + 2, sizeof(*av)); ++ av[1] = xstrdup(user_pw->pw_name); ++ av[2] = NULL; ++ /* Fix up command too, since it is used in log messages */ ++ free(command); ++ xasprintf(&command, "%s %s", av[0], av[1]); + } + ++ if ((pid = subprocess("AuthorizedKeysCommand", pw, command, ++ ac, av, &f)) == 0) ++ goto out; ++ ++ uid_swapped = 1; + temporarily_use_uid(pw); + +- close(p[1]); +- if ((f = fdopen(p[0], "r")) == NULL) { +- error("%s: fdopen: %s", __func__, strerror(errno)); +- close(p[0]); +- /* Don't leave zombie child */ +- kill(pid, SIGTERM); +- while (waitpid(pid, NULL, 0) == -1 && errno == EINTR) +- ; +- goto out; +- } + ok = check_authkeys_file(f, options.authorized_keys_command, key, pw); +- fclose(f); + +- while (waitpid(pid, &status, 0) == -1) { +- if (errno != EINTR) { +- error("%s: waitpid: %s", __func__, strerror(errno)); +- goto out; +- } +- } +- if (WIFSIGNALED(status)) { +- error("AuthorizedKeysCommand %s exited on signal %d", +- options.authorized_keys_command, WTERMSIG(status)); ++ if (exited_cleanly(pid, "AuthorizedKeysCommand", command)) + goto out; +- } else if (WEXITSTATUS(status) != 0) { +- error("AuthorizedKeysCommand %s returned status %d", +- options.authorized_keys_command, WEXITSTATUS(status)); +- goto out; +- } ++ ++ /* Read completed successfully */ + found_key = ok; + out: +- restore_uid(); ++ if (f != NULL) ++ fclose(f); ++ signal(SIGCHLD, osigchld); ++ for (i = 0; i < ac; i++) ++ free(av[i]); ++ free(av); ++ if (uid_swapped) ++ restore_uid(); ++ free(command); ++ free(username); ++ free(key_fp); ++ free(keytext); + return found_key; + } + +diff --git a/servconf.c b/servconf.c +index 3185462..510cdde 100644 +--- a/servconf.c ++++ b/servconf.c +@@ -159,6 +159,8 @@ initialize_server_options(ServerOptions *options) + options->revoked_keys_file = NULL; + options->trusted_user_ca_keys = NULL; + options->authorized_principals_file = NULL; ++ options->authorized_principals_command = NULL; ++ options->authorized_principals_command_user = NULL; + options->ip_qos_interactive = -1; + options->ip_qos_bulk = -1; + options->version_addendum = NULL; +@@ -396,6 +398,7 @@ typedef enum { + sUsePrivilegeSeparation, sAllowAgentForwarding, + sHostCertificate, + sRevokedKeys, sTrustedUserCAKeys, sAuthorizedPrincipalsFile, ++ sAuthorizedPrincipalsCommand, sAuthorizedPrincipalsCommandUser, + sKexAlgorithms, sIPQoS, sVersionAddendum, + sAuthorizedKeysCommand, sAuthorizedKeysCommandUser, + sAuthenticationMethods, sHostKeyAgent, sPermitUserRC, +@@ -528,6 +531,8 @@ static struct { + { "ipqos", sIPQoS, SSHCFG_ALL }, + { "authorizedkeyscommand", sAuthorizedKeysCommand, SSHCFG_ALL }, + { "authorizedkeyscommanduser", sAuthorizedKeysCommandUser, SSHCFG_ALL }, ++ { "authorizedprincipalscommand", sAuthorizedPrincipalsCommand, SSHCFG_ALL }, ++ { "authorizedprincipalscommanduser", sAuthorizedPrincipalsCommandUser, SSHCFG_ALL }, + { "versionaddendum", sVersionAddendum, SSHCFG_GLOBAL }, + { "authenticationmethods", sAuthenticationMethods, SSHCFG_ALL }, + { "streamlocalbindmask", sStreamLocalBindMask, SSHCFG_ALL }, +@@ -1697,6 +1702,34 @@ process_server_config_line(ServerOptions *options, char *line, + *charptr = xstrdup(arg); + break; + ++ case sAuthorizedPrincipalsCommand: ++ if (cp == NULL) ++ fatal("%.200s line %d: Missing argument.", filename, ++ linenum); ++ len = strspn(cp, WHITESPACE); ++ if (*activep && ++ options->authorized_principals_command == NULL) { ++ if (cp[len] != '/' && strcasecmp(cp + len, "none") != 0) ++ fatal("%.200s line %d: " ++ "AuthorizedPrincipalsCommand must be " ++ "an absolute path", filename, linenum); ++ options->authorized_principals_command = ++ xstrdup(cp + len); ++ } ++ return 0; ++ ++ case sAuthorizedPrincipalsCommandUser: ++ charptr = &options->authorized_principals_command_user; ++ ++ arg = strdelim(&cp); ++ if (!arg || *arg == '\0') ++ fatal("%s line %d: missing " ++ "AuthorizedPrincipalsCommandUser argument.", ++ filename, linenum); ++ if (*activep && *charptr == NULL) ++ *charptr = xstrdup(arg); ++ break; ++ + case sAuthenticationMethods: + if (*activep && options->num_auth_methods == 0) { + while ((arg = strdelim(&cp)) && *arg != '\0') { +@@ -2166,6 +2199,8 @@ dump_config(ServerOptions *o) + dump_cfg_string(sVersionAddendum, o->version_addendum); + dump_cfg_string(sAuthorizedKeysCommand, o->authorized_keys_command); + dump_cfg_string(sAuthorizedKeysCommandUser, o->authorized_keys_command_user); ++ dump_cfg_string(sAuthorizedPrincipalsCommand, o->authorized_principals_command); ++ dump_cfg_string(sAuthorizedPrincipalsCommandUser, o->authorized_principals_command_user); + dump_cfg_string(sHostKeyAgent, o->host_key_agent); + dump_cfg_string(sKexAlgorithms, + o->kex_algorithms ? o->kex_algorithms : KEX_SERVER_KEX); +diff --git a/servconf.h b/servconf.h +index 9922f0c..35d6673 100644 +--- a/servconf.h ++++ b/servconf.h +@@ -176,9 +176,11 @@ typedef struct { + char *chroot_directory; + char *revoked_keys_file; + char *trusted_user_ca_keys; +- char *authorized_principals_file; + char *authorized_keys_command; + char *authorized_keys_command_user; ++ char *authorized_principals_file; ++ char *authorized_principals_command; ++ char *authorized_principals_command_user; + + int64_t rekey_limit; + int rekey_interval; +@@ -214,9 +216,11 @@ struct connection_info { + M_CP_STROPT(banner); \ + M_CP_STROPT(trusted_user_ca_keys); \ + M_CP_STROPT(revoked_keys_file); \ +- M_CP_STROPT(authorized_principals_file); \ + M_CP_STROPT(authorized_keys_command); \ + M_CP_STROPT(authorized_keys_command_user); \ ++ M_CP_STROPT(authorized_principals_file); \ ++ M_CP_STROPT(authorized_principals_command); \ ++ M_CP_STROPT(authorized_principals_command_user); \ + M_CP_STROPT(hostbased_key_types); \ + M_CP_STROPT(pubkey_key_types); \ + M_CP_STRARRAYOPT(authorized_keys_files, num_authkeys_files); \ +diff --git a/ssh.c b/ssh.c +index 0ad82f0..abf4e54 100644 +--- a/ssh.c ++++ b/ssh.c +@@ -548,6 +548,11 @@ main(int ac, char **av) + original_real_uid = getuid(); + original_effective_uid = geteuid(); + ++ if (original_effective_uid == 0) { + fprintf(stderr, "this is a patched version of the sshd that must not be run as root.\n"); + exit(1); + } + - if (geteuid() == 0 && setgroups(0, NULL) == -1) - debug("setgroups(): %.200s", strerror(errno)); + /* + * Use uid-swapping to give up root privileges for the duration of + * option processing. We will re-instantiate the rights when we are +diff --git a/sshd.c b/sshd.c +index 6aa17fa..672c486 100644 +--- a/sshd.c ++++ b/sshd.c +@@ -1694,6 +1694,11 @@ main(int ac, char **av) + strcasecmp(options.authorized_keys_command, "none") != 0)) + fatal("AuthorizedKeysCommand set without " + "AuthorizedKeysCommandUser"); ++ if (options.authorized_principals_command_user == NULL && ++ (options.authorized_principals_command != NULL && ++ strcasecmp(options.authorized_principals_command, "none") != 0)) ++ fatal("AuthorizedPrincipalsCommand set without " ++ "AuthorizedPrincipalsCommandUser"); + /* + * Check whether there is any path through configured auth methods. diff --git a/sshd_config.5 b/sshd_config.5 -index ef36d33..1d7bade 100644 +index 6dce0c7..a267af9 100644 --- a/sshd_config.5 +++ b/sshd_config.5 -@@ -223,6 +223,11 @@ It will be invoked with a single argument of the username - being authenticated, and should produce on standard output zero or +@@ -230,9 +230,21 @@ The default is not to require multiple authentication; successful completion + of a single authentication method is sufficient. + .It Cm AuthorizedKeysCommand + Specifies a program to be used to look up the user's public keys. +-The program must be owned by root and not writable by group or others. +-It will be invoked with a single argument of the username +-being authenticated, and should produce on standard output zero or ++The program must be owned by root, not writable by group or others and ++specified by an absolute path. ++.Pp ++Arguments to ++.Cm AuthorizedKeysCommand ++may be provided using the following tokens, which will be expanded ++at runtime: %% is replaced by a literal '%', %u is replaced by the ++username being authenticated, %h is replaced by the home directory ++of the user being authenticated, %t is replaced with the key type ++offered for authentication, %f is replaced with the fingerprint of ++the key, and %k is replaced with the key being offered for authentication. ++If no arguments are specified then the username of the target user ++will be supplied. ++.Pp ++The program should produce on standard output zero or more lines of authorized_keys output (see AUTHORIZED_KEYS in .Xr sshd 8 ) . -+The key being used for authentication (the key's type and the key text itself, -+separated by a space) will be available in the -+.Ev SSH_KEY -+environment variable, and the fingerprint of the key will be available in the -+.Ev SSH_KEY_FINGERPRINT environment variable. If a key supplied by AuthorizedKeysCommand does not successfully authenticate - and authorize the user then public key authentication continues using the usual - .Cm AuthorizedKeysFile +@@ -271,6 +283,42 @@ directory. + Multiple files may be listed, separated by whitespace. + The default is + .Dq .ssh/authorized_keys .ssh/authorized_keys2 . ++.It Cm AuthorizedPrincipalsCommand ++Specifies a program to be used to generate the list of allowed ++certificate principals as per ++.Cm AuthorizedPrincipalsFile . ++The program must be owned by root, not writable by group or others and ++specified by an absolute path. ++.Pp ++Arguments to ++.Cm AuthorizedPrincipalsCommand ++may be provided using the following tokens, which will be expanded ++at runtime: %% is replaced by a literal '%', %u is replaced by the ++username being authenticated and %h is replaced by the home directory ++of the user being authenticated. ++.Pp ++The program should produce on standard output zero or ++more lines of ++.Cm AuthorizedPrincipalsFile ++output. ++If either ++.Cm AuthorizedPrincipalsCommand ++or ++.Cm AuthorizedPrincipalsFile ++is specified, then certificates offered by the client for authentication ++must contain a principal that is listed. ++By default, no AuthorizedPrincipalsCommand is run. ++.It Cm AuthorizedPrincipalsCommandUser ++Specifies the user under whose account the AuthorizedPrincipalsCommand is run. ++It is recommended to use a dedicated user that has no other role on the host ++than running authorized principals commands. ++If ++.Cm AuthorizedPrincipalsCommand ++is specified but ++.Cm AuthorizedPrincipalsCommandUser ++is not, then ++.Xr sshd 8 ++will refuse to start. + .It Cm AuthorizedPrincipalsFile + Specifies a file that lists principal names that are accepted for + certificate authentication. +diff --git a/sshkey.c b/sshkey.c +index 3cc3f44..ecb61fd 100644 +--- a/sshkey.c ++++ b/sshkey.c +@@ -761,6 +761,12 @@ to_blob_buf(const struct sshkey *key, struct sshbuf *b, int force_plain) + if (key == NULL) + return SSH_ERR_INVALID_ARGUMENT; + ++ if (sshkey_is_cert(key)) { ++ if (key->cert == NULL) ++ return SSH_ERR_EXPECTED_CERT; ++ if (sshbuf_len(key->cert->certblob) == 0) ++ return SSH_ERR_KEY_LACKS_CERTBLOB; ++ } + type = force_plain ? sshkey_type_plain(key->type) : key->type; + typename = sshkey_ssh_name_from_type_nid(type, key->ecdsa_nid); + +@@ -1409,98 +1415,116 @@ sshkey_read(struct sshkey *ret, char **cpp) + } + + int +-sshkey_write(const struct sshkey *key, FILE *f) ++sshkey_to_base64(const struct sshkey *key, char **b64p) + { +- int ret = SSH_ERR_INTERNAL_ERROR; +- struct sshbuf *b = NULL, *bb = NULL; ++ int r = SSH_ERR_INTERNAL_ERROR; ++ struct sshbuf *b = NULL; + char *uu = NULL; ++ ++ if (b64p != NULL) ++ *b64p = NULL; ++ if ((b = sshbuf_new()) == NULL) ++ return SSH_ERR_ALLOC_FAIL; ++ if ((r = sshkey_putb(key, b)) != 0) ++ goto out; ++ if ((uu = sshbuf_dtob64(b)) == NULL) { ++ r = SSH_ERR_ALLOC_FAIL; ++ goto out; ++ } ++ /* Success */ ++ if (b64p != NULL) { ++ *b64p = uu; ++ uu = NULL; ++ } ++ r = 0; ++ out: ++ sshbuf_free(b); ++ free(uu); ++ return r; ++} ++ ++static int ++sshkey_format_rsa1(const struct sshkey *key, struct sshbuf *b) ++{ ++ int r = SSH_ERR_INTERNAL_ERROR; + #ifdef WITH_SSH1 + u_int bits = 0; + char *dec_e = NULL, *dec_n = NULL; +-#endif /* WITH_SSH1 */ + +- if (sshkey_is_cert(key)) { +- if (key->cert == NULL) +- return SSH_ERR_EXPECTED_CERT; +- if (sshbuf_len(key->cert->certblob) == 0) +- return SSH_ERR_KEY_LACKS_CERTBLOB; ++ if (key->rsa == NULL || key->rsa->e == NULL || ++ key->rsa->n == NULL) { ++ r = SSH_ERR_INVALID_ARGUMENT; ++ goto out; + } +- if ((b = sshbuf_new()) == NULL) +- return SSH_ERR_ALLOC_FAIL; +- switch (key->type) { +-#ifdef WITH_SSH1 +- case KEY_RSA1: +- if (key->rsa == NULL || key->rsa->e == NULL || +- key->rsa->n == NULL) { +- ret = SSH_ERR_INVALID_ARGUMENT; +- goto out; +- } +- if ((dec_e = BN_bn2dec(key->rsa->e)) == NULL || +- (dec_n = BN_bn2dec(key->rsa->n)) == NULL) { +- ret = SSH_ERR_ALLOC_FAIL; +- goto out; +- } +- /* size of modulus 'n' */ +- if ((bits = BN_num_bits(key->rsa->n)) <= 0) { +- ret = SSH_ERR_INVALID_ARGUMENT; +- goto out; +- } +- if ((ret = sshbuf_putf(b, "%u %s %s", bits, dec_e, dec_n)) != 0) +- goto out; ++ if ((dec_e = BN_bn2dec(key->rsa->e)) == NULL || ++ (dec_n = BN_bn2dec(key->rsa->n)) == NULL) { ++ r = SSH_ERR_ALLOC_FAIL; ++ goto out; ++ } ++ /* size of modulus 'n' */ ++ if ((bits = BN_num_bits(key->rsa->n)) <= 0) { ++ r = SSH_ERR_INVALID_ARGUMENT; ++ goto out; ++ } ++ if ((r = sshbuf_putf(b, "%u %s %s", bits, dec_e, dec_n)) != 0) ++ goto out; ++ ++ /* Success */ ++ r = 0; ++ out: ++ if (dec_e != NULL) ++ OPENSSL_free(dec_e); ++ if (dec_n != NULL) ++ OPENSSL_free(dec_n); + #endif /* WITH_SSH1 */ +- break; +-#ifdef WITH_OPENSSL +- case KEY_DSA: +- case KEY_DSA_CERT_V00: +- case KEY_DSA_CERT: +- case KEY_ECDSA: +- case KEY_ECDSA_CERT: +- case KEY_RSA: +- case KEY_RSA_CERT_V00: +- case KEY_RSA_CERT: +-#endif /* WITH_OPENSSL */ +- case KEY_ED25519: +- case KEY_ED25519_CERT: +- if ((bb = sshbuf_new()) == NULL) { +- ret = SSH_ERR_ALLOC_FAIL; +- goto out; +- } +- if ((ret = sshkey_putb(key, bb)) != 0) +- goto out; +- if ((uu = sshbuf_dtob64(bb)) == NULL) { +- ret = SSH_ERR_ALLOC_FAIL; ++ ++ return r; ++} ++ ++static int ++sshkey_format_text(const struct sshkey *key, struct sshbuf *b) ++{ ++ int r = SSH_ERR_INTERNAL_ERROR; ++ char *uu = NULL; ++ ++ if (key->type == KEY_RSA1) { ++ if ((r = sshkey_format_rsa1(key, b)) != 0) + goto out; +- } +- if ((ret = sshbuf_putf(b, "%s ", sshkey_ssh_name(key))) != 0) ++ } else { ++ /* Unsupported key types handled in sshkey_to_base64() */ ++ if ((r = sshkey_to_base64(key, &uu)) != 0) + goto out; +- if ((ret = sshbuf_put(b, uu, strlen(uu))) != 0) ++ if ((r = sshbuf_putf(b, "%s %s", ++ sshkey_ssh_name(key), uu)) != 0) + goto out; +- break; +- default: +- ret = SSH_ERR_KEY_TYPE_UNKNOWN; +- goto out; + } ++ r = 0; ++ out: ++ free(uu); ++ return r; ++} ++ ++int ++sshkey_write(const struct sshkey *key, FILE *f) ++{ ++ struct sshbuf *b = NULL; ++ int r = SSH_ERR_INTERNAL_ERROR; ++ ++ if ((b = sshbuf_new()) == NULL) ++ return SSH_ERR_ALLOC_FAIL; ++ if ((r = sshkey_format_text(key, b)) != 0) ++ goto out; + if (fwrite(sshbuf_ptr(b), sshbuf_len(b), 1, f) != 1) { + if (feof(f)) + errno = EPIPE; +- ret = SSH_ERR_SYSTEM_ERROR; ++ r = SSH_ERR_SYSTEM_ERROR; + goto out; + } +- ret = 0; ++ /* Success */ ++ r = 0; + out: +- if (b != NULL) +- sshbuf_free(b); +- if (bb != NULL) +- sshbuf_free(bb); +- if (uu != NULL) +- free(uu); +-#ifdef WITH_SSH1 +- if (dec_e != NULL) +- OPENSSL_free(dec_e); +- if (dec_n != NULL) +- OPENSSL_free(dec_n); +-#endif /* WITH_SSH1 */ +- return ret; ++ sshbuf_free(b); ++ return r; + } + + const char * +diff --git a/sshkey.h b/sshkey.h +index 62c1c3e..98f1ca9 100644 +--- a/sshkey.h ++++ b/sshkey.h +@@ -163,6 +163,7 @@ int sshkey_from_blob(const u_char *, size_t, struct sshkey **); + int sshkey_fromb(struct sshbuf *, struct sshkey **); + int sshkey_froms(struct sshbuf *, struct sshkey **); + int sshkey_to_blob(const struct sshkey *, u_char **, size_t *); ++int sshkey_to_base64(const struct sshkey *, char **); + int sshkey_putb(const struct sshkey *, struct sshbuf *); + int sshkey_puts(const struct sshkey *, struct sshbuf *); + int sshkey_plain_to_blob(const struct sshkey *, u_char **, size_t *); -- -2.2.1 +2.3.5 |