From nobody Wed Oct 19 14:34:24 2022 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4MstXc6pskz4g6HG; Wed, 19 Oct 2022 14:34:24 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4MstXc6SFVz3Q88; Wed, 19 Oct 2022 14:34:24 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1666190064; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=AnFlxQ3wZiPnprmRvqB2bBh2WzjoXE91Skh7lKFcpZQ=; b=DwbTxpn67KPM9NFNUh7DRsgkG/T+8BgEHHwevqndfrNI1k7eDOD5qtszEf7joCdsyH+gm5 WY9UjKm4ZU9cb31L4Pw5wXxKiqXVevS9W1cKF7uON67JRDk9xspqcVVs3AZ8RoH0Gj8JDM 2anDzcp1BAsW3LjEY4i4JZCtZUimcqagWbYG/AxYK82lHqOojlhEwJOCI8jWCPt7APmvlL od9TzzxrJPw2Akx1AqfbO5KNdzeviBW9iaKnQrfUzh8zGkgIeDairCscyE+niIv+GpTKPm 6Xbj2zC0GtQb2fxpRJa/VeyaTn82XjoL90RqfPIRqTNmzZqACqveSrAElEOVxA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4MstXc5T5GzYhK; Wed, 19 Oct 2022 14:34:24 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 29JEYOwZ060219; Wed, 19 Oct 2022 14:34:24 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 29JEYOmv060218; Wed, 19 Oct 2022 14:34:24 GMT (envelope-from git) Date: Wed, 19 Oct 2022 14:34:24 GMT Message-Id: <202210191434.29JEYOmv060218@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Ed Maste Subject: git: 38a52bd3b5ca - main - ssh: update to OpenSSH 9.1p1 List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-all@freebsd.org X-BeenThere: dev-commits-src-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: emaste X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 38a52bd3b5cac3da6f7f6eef3dd050e6aa08ebb3 Auto-Submitted: auto-generated ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1666190064; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=AnFlxQ3wZiPnprmRvqB2bBh2WzjoXE91Skh7lKFcpZQ=; b=k4wFiou/M1DKAcx++zxIeNkHmRum8oG+iYt59U21T1jKMQqGUrXvSAysju+DARNiZ253AI 1S9xSAELrZd38QG81gwVSBiL9HUqPbTF3FWkmNiKhPf6G3vSKPxIQ9gDIUqvVWGowPcixb rJql0ibjnK9VXL6M7zhlx/quY3hD+RF7UvbNQuSln0m2EX9PZua7iVxFTf3R4yM02iKRB6 /xZg3et678wuqe/xIxh9/RL7XtNzrkVEeUyBeOXsjINEU84OUnLY4nXZA6gka1FPV0CvnL g6dQV7GKgIoKy/bjJb5kfpSPl3oqz6soDFVRSIPxkmEZtfkozbHes4xgL9ddqA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1666190064; a=rsa-sha256; cv=none; b=ngcbOQInfLupZBV6Y6F6444MaEU5aIGml9Z/IhEUaESY5tlSuqdXgvsms1VUwoP922cAK5 Mj+MibuSIHi77XrIE0w8gYhebilweiJOPYz+Nf2IHEYS6MlWmkiN6F0wrQr3AddBerpwCJ Yv/kD7Lzthq7JvGwt6yIxVnoiyqjQeW2GnYvcOrGstBG8m1Vm5a963v6CHJfrE6o0NLmMB +mFeDzqRMZ5g+2NrCaIyVWkX0oNB/59VTE2baiE3MTJQlvZPo/AthlOjxLKvIK35b8qZRx NfST1E9B+ti1k1pu/gS0PPyQKwpwWYOoGVcxoAatOfm2LEtrn7u4K8yTlkTUVg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by emaste: URL: https://cgit.FreeBSD.org/src/commit/?id=38a52bd3b5cac3da6f7f6eef3dd050e6aa08ebb3 commit 38a52bd3b5cac3da6f7f6eef3dd050e6aa08ebb3 Merge: af3297898720 56fae0659591 Author: Ed Maste AuthorDate: 2022-10-19 14:27:11 +0000 Commit: Ed Maste CommitDate: 2022-10-19 14:27:11 +0000 ssh: update to OpenSSH 9.1p1 Release notes are available at https://www.openssh.com/txt/release-9.1 9.1 contains fixes for three minor memory safety problems; these have lready been merged to the copy of OpenSSH 9.0 that is in the FreeBSD base system. Some highlights copied from the release notes: Potentially-incompatible changes -------------------------------- * ssh(1), sshd(8): SetEnv directives in ssh_config and sshd_config are now first-match-wins to match other directives. Previously if an environment variable was multiply specified the last set value would have been used. bz3438 * ssh-keygen(8): ssh-keygen -A (generate all default host key types) will no longer generate DSA keys, as these are insecure and have not been used by default for some years. New features ------------ * ssh(1), sshd(8): add a RequiredRSASize directive to set a minimum RSA key length. Keys below this length will be ignored for user authentication and for host authentication in sshd(8). * sftp-server(8): add a "users-groups-by-id@openssh.com" extension request that allows the client to obtain user/group names that correspond to a set of uids/gids. * sftp(1): use "users-groups-by-id@openssh.com" sftp-server extension (when available) to fill in user/group names for directory listings. * sftp-server(8): support the "home-directory" extension request defined in draft-ietf-secsh-filexfer-extensions-00. This overlaps a bit with the existing "expand-path@openssh.com", but some other clients support it. * ssh-keygen(1), sshd(8): allow certificate validity intervals, sshsig verification times and authorized_keys expiry-time options to accept dates in the UTC time zone in addition to the default of interpreting them in the system time zone. YYYYMMDD and YYMMDDHHMM[SS] dates/times will be interpreted as UTC if suffixed with a 'Z' character. Also allow certificate validity intervals to be specified in raw seconds-since-epoch as hex value, e.g. -V 0x1234:0x4567890. This is intended for use by regress tests and other tools that call ssh-keygen as part of a CA workflow. bz3468 * sftp(1): allow arguments to the sftp -D option, e.g. sftp -D "/usr/libexec/sftp-server -el debug3" * ssh-keygen(1): allow the existing -U (use agent) flag to work with "-Y sign" operations, where it will be interpreted to require that the private keys is hosted in an agent; bz3429 MFC after: 2 weeks Relnotes: Yes Sponsored by: The FreeBSD Foundation crypto/openssh/.depend | 5 +- crypto/openssh/.git_allowed_signers | 5 + crypto/openssh/.git_allowed_signers.asc | 16 + crypto/openssh/.github/configs | 75 +- crypto/openssh/.github/configure.sh | 2 +- crypto/openssh/.github/run_test.sh | 14 + crypto/openssh/.github/setup_ci.sh | 63 +- crypto/openssh/.github/workflows/c-cpp.yml | 60 +- crypto/openssh/.github/workflows/selfhosted.yml | 12 +- crypto/openssh/.github/workflows/upstream.yml | 13 +- crypto/openssh/.skipped-commit-ids | 1 + crypto/openssh/ChangeLog | 15789 +++++++++---------- crypto/openssh/INSTALL | 7 +- crypto/openssh/LICENCE | 1 + crypto/openssh/Makefile.in | 67 +- crypto/openssh/PROTOCOL | 65 +- crypto/openssh/PROTOCOL.agent | 6 +- crypto/openssh/PROTOCOL.key | 12 +- crypto/openssh/README | 2 +- crypto/openssh/README.md | 8 +- crypto/openssh/addr.c | 4 +- crypto/openssh/auth.c | 155 +- crypto/openssh/auth.h | 26 +- crypto/openssh/auth2-hostbased.c | 7 +- crypto/openssh/auth2-passwd.c | 10 +- crypto/openssh/auth2-pubkey.c | 357 +- crypto/openssh/auth2-pubkeyfile.c | 501 + crypto/openssh/authfd.c | 3 +- crypto/openssh/authfile.c | 19 +- crypto/openssh/channels.c | 43 +- crypto/openssh/channels.h | 4 +- crypto/openssh/cipher-ctr.c | 146 - crypto/openssh/cipher.c | 13 - crypto/openssh/clientloop.c | 14 +- crypto/openssh/compat.c | 15 +- crypto/openssh/config.h | 46 +- crypto/openssh/configure.ac | 313 +- crypto/openssh/contrib/redhat/openssh.spec | 2 +- crypto/openssh/contrib/suse/openssh.spec | 2 +- crypto/openssh/int32_minmax.inc | 0 crypto/openssh/krl.c | 4 +- crypto/openssh/misc.c | 43 +- crypto/openssh/misc.h | 4 +- crypto/openssh/moduli | 801 +- crypto/openssh/moduli.5 | 9 +- crypto/openssh/moduli.c | 14 +- crypto/openssh/monitor.c | 2 +- crypto/openssh/monitor_wrap.c | 2 +- crypto/openssh/monitor_wrap.h | 4 +- crypto/openssh/mux.c | 11 +- crypto/openssh/openbsd-compat/Makefile.in | 10 +- crypto/openssh/openbsd-compat/arc4random.c | 284 +- crypto/openssh/openbsd-compat/arc4random.h | 79 + crypto/openssh/openbsd-compat/arc4random_uniform.c | 64 + crypto/openssh/openbsd-compat/bsd-asprintf.c | 1 + crypto/openssh/openbsd-compat/bsd-getentropy.c | 82 + crypto/openssh/openbsd-compat/bsd-misc.c | 12 + crypto/openssh/openbsd-compat/bsd-timegm.c | 82 + crypto/openssh/openbsd-compat/getcwd.c | 5 +- crypto/openssh/openbsd-compat/openbsd-compat.h | 23 +- crypto/openssh/openbsd-compat/openssl-compat.h | 25 - crypto/openssh/packet.c | 4 +- crypto/openssh/readconf.c | 60 +- crypto/openssh/readconf.h | 12 +- crypto/openssh/readpass.c | 5 +- crypto/openssh/regress/agent-ptrace.sh | 2 +- crypto/openssh/regress/envpass.sh | 67 +- crypto/openssh/regress/forward-control.sh | 51 +- crypto/openssh/regress/misc/fuzz-harness/Makefile | 5 +- .../regress/misc/fuzz-harness/authkeys_fuzz.cc | 81 + crypto/openssh/regress/misc/sk-dummy/sk-dummy.c | 2 +- crypto/openssh/regress/multiplex.sh | 16 +- crypto/openssh/regress/scp.sh | 27 +- crypto/openssh/regress/scp3.sh | 6 + crypto/openssh/regress/sftp-cmds.sh | 7 +- crypto/openssh/regress/test-exec.sh | 41 +- .../openssh/regress/unittests/misc/test_convtime.c | 64 +- crypto/openssh/sandbox-capsicum.c | 4 + crypto/openssh/sandbox-seccomp-filter.c | 15 +- crypto/openssh/scp.1 | 7 +- crypto/openssh/scp.c | 12 +- crypto/openssh/servconf.c | 19 +- crypto/openssh/servconf.h | 3 +- crypto/openssh/serverloop.c | 5 +- crypto/openssh/sftp-client.c | 215 +- crypto/openssh/sftp-client.h | 26 +- crypto/openssh/sftp-common.c | 18 +- crypto/openssh/sftp-common.h | 5 +- crypto/openssh/sftp-server-main.c | 2 - crypto/openssh/sftp-server.c | 94 +- crypto/openssh/sftp-usergroup.c | 239 + crypto/openssh/sftp-usergroup.h | 25 + crypto/openssh/sftp.1 | 11 +- crypto/openssh/sftp.c | 204 +- crypto/openssh/sk-api.h | 6 +- crypto/openssh/sk-usbhid.c | 115 +- crypto/openssh/sk_config.h | 1 + crypto/openssh/ssh-add.c | 6 +- crypto/openssh/ssh-agent.c | 24 +- crypto/openssh/ssh-ed25519.c | 8 +- crypto/openssh/ssh-keygen.1 | 224 +- crypto/openssh/ssh-keygen.c | 186 +- crypto/openssh/ssh-keyscan.1 | 10 +- crypto/openssh/ssh-pkcs11-helper.8 | 23 +- crypto/openssh/ssh-sk-helper.8 | 23 +- crypto/openssh/ssh-sk-helper.c | 3 +- crypto/openssh/ssh-sk.c | 7 +- crypto/openssh/ssh-xmss.c | 4 +- crypto/openssh/ssh.1 | 12 +- crypto/openssh/ssh.c | 30 +- crypto/openssh/ssh_config.5 | 25 +- crypto/openssh/ssh_namespace.h | 3 +- crypto/openssh/sshbuf-getput-basic.c | 2 +- crypto/openssh/sshbuf-getput-crypto.c | 2 +- crypto/openssh/sshbuf.c | 9 +- crypto/openssh/sshbuf.h | 2 +- crypto/openssh/sshconnect.c | 6 +- crypto/openssh/sshconnect2.c | 74 +- crypto/openssh/sshd.8 | 12 +- crypto/openssh/sshd.c | 34 +- crypto/openssh/sshd_config | 2 +- crypto/openssh/sshd_config.5 | 24 +- crypto/openssh/sshkey.c | 96 +- crypto/openssh/sshkey.h | 3 +- crypto/openssh/sshlogin.c | 1 + crypto/openssh/version.h | 6 +- crypto/openssh/xmss_hash.c | 5 +- secure/lib/libssh/Makefile | 2 +- secure/usr.bin/sftp/Makefile | 3 +- secure/usr.sbin/sshd/Makefile | 2 +- 130 files changed, 11441 insertions(+), 10372 deletions(-) diff --cc crypto/openssh/.git_allowed_signers index 000000000000,0313c1ecd17f..0313c1ecd17f mode 000000,100644..100644 --- a/crypto/openssh/.git_allowed_signers +++ b/crypto/openssh/.git_allowed_signers diff --cc crypto/openssh/.git_allowed_signers.asc index 000000000000,5fc6118ca9a6..5fc6118ca9a6 mode 000000,100644..100644 --- a/crypto/openssh/.git_allowed_signers.asc +++ b/crypto/openssh/.git_allowed_signers.asc diff --cc crypto/openssh/INSTALL index 114d15314243,000000000000..1c9abb1c3a86 mode 100644,000000..100644 --- a/crypto/openssh/INSTALL +++ b/crypto/openssh/INSTALL @@@ -1,296 -1,0 +1,297 @@@ +1. Prerequisites +---------------- + - A C compiler. Any C89 or better compiler should work. Where supported, - configure will attempt to enable the compiler's run-time integrity checking - options. Some notes about specific compilers: ++A C compiler. Any C89 or better compiler that supports variadic macros ++should work. Where supported, configure will attempt to enable the ++compiler's run-time integrity checking options. Some notes about ++specific compilers: + - clang: -ftrapv and -sanitize=integer require the compiler-rt runtime + (CC=clang LDFLAGS=--rtlib=compiler-rt ./configure) + +To support Privilege Separation (which is now required) you will need +to create the user, group and directory used by sshd for privilege +separation. See README.privsep for details. + + +The remaining items are optional. + +A working installation of zlib: +Zlib 1.1.4 or 1.2.1.2 or greater (earlier 1.2.x versions have problems): +http://www.gzip.org/zlib/ + +libcrypto from either of LibreSSL or OpenSSL. Building without libcrypto +is supported but severely restricts the available ciphers and algorithms. + - LibreSSL (https://www.libressl.org/) + - OpenSSL (https://www.openssl.org) with any of the following versions: + - 1.0.x >= 1.0.1 or 1.1.0 >= 1.1.0g or any 1.1.1 + +Note that due to a bug in EVP_CipherInit OpenSSL 1.1 versions prior to +1.1.0g can't be used. + +LibreSSL/OpenSSL should be compiled as a position-independent library +(i.e. -fPIC, eg by configuring OpenSSL as "./config [options] -fPIC" +or LibreSSL as "CFLAGS=-fPIC ./configure") otherwise OpenSSH will not +be able to link with it. If you must use a non-position-independent +libcrypto, then you may need to configure OpenSSH --without-pie. + +If you build either from source, running the OpenSSL self-test ("make +tests") or the LibreSSL equivalent ("make check") and ensuring that all +tests pass is strongly recommended. + +NB. If you operating system supports /dev/random, you should configure +libcrypto (LibreSSL/OpenSSL) to use it. OpenSSH relies on libcrypto's +direct support of /dev/random, or failing that, either prngd or egd. + +PRNGD: + +If your system lacks kernel-based random collection, the use of Lutz +Jaenicke's PRNGd is recommended. It requires that libcrypto be configured +to support it. + +http://prngd.sourceforge.net/ + +EGD: + +The Entropy Gathering Daemon (EGD) supports the same interface as prngd. +It also supported only if libcrypto is configured to support it. + +http://egd.sourceforge.net/ + +PAM: + +OpenSSH can utilise Pluggable Authentication Modules (PAM) if your +system supports it. PAM is standard most Linux distributions, Solaris, +HP-UX 11, AIX >= 5.2, FreeBSD, NetBSD and Mac OS X. + +Information about the various PAM implementations are available: + +Solaris PAM: http://www.sun.com/software/solaris/pam/ +Linux PAM: http://www.kernel.org/pub/linux/libs/pam/ +OpenPAM: http://www.openpam.org/ + +If you wish to build the GNOME passphrase requester, you will need the GNOME +libraries and headers. + +GNOME: +http://www.gnome.org/ + +Alternatively, Jim Knoble has written an excellent X11 +passphrase requester. This is maintained separately at: + +http://www.jmknoble.net/software/x11-ssh-askpass/ + +TCP Wrappers: + +If you wish to use the TCP wrappers functionality you will need at least +tcpd.h and libwrap.a, either in the standard include and library paths, +or in the directory specified by --with-tcp-wrappers. Version 7.6 is +known to work. + +http://ftp.porcupine.org/pub/security/index.html + +LibEdit: + +sftp supports command-line editing via NetBSD's libedit. If your platform +has it available natively you can use that, alternatively you might try +these multi-platform ports: + +http://www.thrysoee.dk/editline/ +http://sourceforge.net/projects/libedit/ + +LDNS: + +LDNS is a DNS BSD-licensed resolver library which supports DNSSEC. + +http://nlnetlabs.nl/projects/ldns/ + +Autoconf: + +If you modify configure.ac or configure doesn't exist (eg if you checked +the code out of git yourself) then you will need autoconf-2.69 and +automake-1.16.1 to rebuild the automatically generated files by running +"autoreconf". Earlier versions may also work but this is not guaranteed. + +http://www.gnu.org/software/autoconf/ +http://www.gnu.org/software/automake/ + +Basic Security Module (BSM): + +Native BSM support is known to exist in Solaris from at least 2.5.1, +FreeBSD 6.1 and OS X. Alternatively, you may use the OpenBSM +implementation (http://www.openbsm.org). + +makedepend: + +https://www.x.org/archive/individual/util/ + +If you are making significant changes to the code you may need to rebuild +the dependency (.depend) file using "make depend", which requires the +"makedepend" tool from the X11 distribution. + +libfido2: + +libfido2 allows the use of hardware security keys over USB. libfido2 +in turn depends on libcbor. libfido2 >= 1.5.0 is strongly recommended. +Limited functionality is possible with earlier libfido2 versions. + +https://github.com/Yubico/libfido2 +https://github.com/pjk/libcbor + + +2. Building / Installation +-------------------------- + +To install OpenSSH with default options: + +./configure +make +make install + +This will install the OpenSSH binaries in /usr/local/bin, configuration files +in /usr/local/etc, the server in /usr/local/sbin, etc. To specify a different +installation prefix, use the --prefix option to configure: + +./configure --prefix=/opt +make +make install + +Will install OpenSSH in /opt/{bin,etc,lib,sbin}. You can also override +specific paths, for example: + +./configure --prefix=/opt --sysconfdir=/etc/ssh +make +make install + +This will install the binaries in /opt/{bin,lib,sbin}, but will place the +configuration files in /etc/ssh. + +If you are using PAM, you may need to manually install a PAM control +file as "/etc/pam.d/sshd" (or wherever your system prefers to keep +them). Note that the service name used to start PAM is __progname, +which is the basename of the path of your sshd (e.g., the service name +for /usr/sbin/osshd will be osshd). If you have renamed your sshd +executable, your PAM configuration may need to be modified. + +A generic PAM configuration is included as "contrib/sshd.pam.generic", +you may need to edit it before using it on your system. If you are +using a recent version of Red Hat Linux, the config file in +contrib/redhat/sshd.pam should be more useful. Failure to install a +valid PAM file may result in an inability to use password +authentication. On HP-UX 11 and Solaris, the standard /etc/pam.conf +configuration will work with sshd (sshd will match the other service +name). + +There are a few other options to the configure script: + +--with-audit=[module] enable additional auditing via the specified module. +Currently, drivers for "debug" (additional info via syslog) and "bsm" +(Sun's Basic Security Module) are supported. + +--with-pam enables PAM support. If PAM support is compiled in, it must +also be enabled in sshd_config (refer to the UsePAM directive). + +--with-prngd-socket=/some/file allows you to enable EGD or PRNGD +support and to specify a PRNGd socket. Use this if your Unix lacks +/dev/random. + +--with-prngd-port=portnum allows you to enable EGD or PRNGD support +and to specify a EGD localhost TCP port. Use this if your Unix lacks +/dev/random. + +--with-lastlog=FILE will specify the location of the lastlog file. +./configure searches a few locations for lastlog, but may not find +it if lastlog is installed in a different place. + +--without-lastlog will disable lastlog support entirely. + +--with-osfsia, --without-osfsia will enable or disable OSF1's Security +Integration Architecture. The default for OSF1 machines is enable. + +--with-tcp-wrappers will enable TCP Wrappers (/etc/hosts.allow|deny) +support. + +--with-utmpx enables utmpx support. utmpx support is automatic for +some platforms. + +--without-shadow disables shadow password support. + +--with-ipaddr-display forces the use of a numeric IP address in the +$DISPLAY environment variable. Some broken systems need this. + +--with-default-path=PATH allows you to specify a default $PATH for sessions +started by sshd. This replaces the standard path entirely. + +--with-pid-dir=PATH specifies the directory in which the sshd.pid file is +created. + +--with-xauth=PATH specifies the location of the xauth binary + +--with-ssl-dir=DIR allows you to specify where your Libre/OpenSSL +libraries are installed. + +--with-ssl-engine enables Libre/OpenSSL's (hardware) ENGINE support + +--without-openssl builds without using OpenSSL. Only a subset of ciphers +and algorithms are supported in this configuration. + +--without-zlib builds without zlib. This disables the Compression option. + +--with-4in6 Check for IPv4 in IPv6 mapped addresses and convert them to +real (AF_INET) IPv4 addresses. Works around some quirks on Linux. + +If you need to pass special options to the compiler or linker, you +can specify these as environment variables before running ./configure. +For example: + +CC="/usr/foo/cc" CFLAGS="-O" LDFLAGS="-s" LIBS="-lrubbish" ./configure + +3. Configuration +---------------- + +The runtime configuration files are installed by in ${prefix}/etc or +whatever you specified as your --sysconfdir (/usr/local/etc by default). + +The default configuration should be instantly usable, though you should +review it to ensure that it matches your security requirements. + +To generate a host key, run "make host-key". Alternately you can do so +manually using the following commands: + + ssh-keygen -t [type] -f /etc/ssh/ssh_host_key -N "" + +for each of the types you wish to generate (rsa, dsa or ecdsa) or + + ssh-keygen -A + +to generate keys for all supported types. + +Replacing /etc/ssh with the correct path to the configuration directory. +(${prefix}/etc or whatever you specified with --sysconfdir during +configuration). + +If you have configured OpenSSH with EGD/prngd support, ensure that EGD or +prngd is running and has collected some entropy first. + +For more information on configuration, please refer to the manual pages +for sshd, ssh and ssh-agent. + +4. (Optional) Send survey +------------------------- + +$ make survey +[check the contents of the file "survey" to ensure there's no information +that you consider sensitive] +$ make send-survey + +This will send configuration information for the currently configured +host to a survey address. This will help determine which configurations +are actually in use, and what valid combinations of configure options +exist. The raw data is available only to the OpenSSH developers, however +summary data may be published. + +5. Problems? +------------ + +If you experience problems compiling, installing or running OpenSSH, +please refer to the "reporting bugs" section of the webpage at +https://www.openssh.com/ diff --cc crypto/openssh/README.md index de4717737eac,000000000000..04e3a5198a91 mode 100644,000000..100644 --- a/crypto/openssh/README.md +++ b/crypto/openssh/README.md @@@ -1,84 -1,0 +1,86 @@@ +# Portable OpenSSH + +[![C/C++ CI](https://github.com/openssh/openssh-portable/actions/workflows/c-cpp.yml/badge.svg)](https://github.com/openssh/openssh-portable/actions/workflows/c-cpp.yml) +[![Fuzzing Status](https://oss-fuzz-build-logs.storage.googleapis.com/badges/openssh.svg)](https://bugs.chromium.org/p/oss-fuzz/issues/list?sort=-opened&can=1&q=proj:openssh) + +OpenSSH is a complete implementation of the SSH protocol (version 2) for secure remote login, command execution and file transfer. It includes a client ``ssh`` and server ``sshd``, file transfer utilities ``scp`` and ``sftp`` as well as tools for key generation (``ssh-keygen``), run-time key storage (``ssh-agent``) and a number of supporting programs. + +This is a port of OpenBSD's [OpenSSH](https://openssh.com) to most Unix-like operating systems, including Linux, OS X and Cygwin. Portable OpenSSH polyfills OpenBSD APIs that are not available elsewhere, adds sshd sandboxing for more operating systems and includes support for OS-native authentication and auditing (e.g. using PAM). + +## Documentation + +The official documentation for OpenSSH are the man pages for each tool: + +* [ssh(1)](https://man.openbsd.org/ssh.1) +* [sshd(8)](https://man.openbsd.org/sshd.8) +* [ssh-keygen(1)](https://man.openbsd.org/ssh-keygen.1) +* [ssh-agent(1)](https://man.openbsd.org/ssh-agent.1) +* [scp(1)](https://man.openbsd.org/scp.1) +* [sftp(1)](https://man.openbsd.org/sftp.1) +* [ssh-keyscan(8)](https://man.openbsd.org/ssh-keyscan.8) +* [sftp-server(8)](https://man.openbsd.org/sftp-server.8) + +## Stable Releases + +Stable release tarballs are available from a number of [download mirrors](https://www.openssh.com/portable.html#downloads). We recommend the use of a stable release for most users. Please read the [release notes](https://www.openssh.com/releasenotes.html) for details of recent changes and potential incompatibilities. + +## Building Portable OpenSSH + +### Dependencies + +Portable OpenSSH is built using autoconf and make. It requires a working C compiler, standard library and headers. + - ``libcrypto`` from either [LibreSSL](https://www.libressl.org/) or [OpenSSL](https://www.openssl.org) may also be used, but OpenSSH may be built without it supporting a subset of crypto algorithms. ++``libcrypto`` from either [LibreSSL](https://www.libressl.org/) or [OpenSSL](https://www.openssl.org) may also be used. OpenSSH may be built without either of these, but the resulting binaries will have only a subset of the cryptographic algorithms normally available. + +[zlib](https://www.zlib.net/) is optional; without it transport compression is not supported. + - FIDO security token support needs [libfido2](https://github.com/Yubico/libfido2) and its dependencies. Also, certain platforms and build-time options may require additional dependencies; see README.platform for details. ++FIDO security token support needs [libfido2](https://github.com/Yubico/libfido2) and its dependencies. ++ ++In addition, certain platforms and build-time options may require additional dependencies; see README.platform for details about your platform. + +### Building a release + +Releases include a pre-built copy of the ``configure`` script and may be built using: + +``` +tar zxvf openssh-X.YpZ.tar.gz +cd openssh +./configure # [options] +make && make tests +``` + +See the [Build-time Customisation](#build-time-customisation) section below for configure options. If you plan on installing OpenSSH to your system, then you will usually want to specify destination paths. + +### Building from git + +If building from git, you'll need [autoconf](https://www.gnu.org/software/autoconf/) installed to build the ``configure`` script. The following commands will check out and build portable OpenSSH from git: + +``` +git clone https://github.com/openssh/openssh-portable # or https://anongit.mindrot.org/openssh.git +cd openssh-portable +autoreconf +./configure +make && make tests +``` + +### Build-time Customisation + +There are many build-time customisation options available. All Autoconf destination path flags (e.g. ``--prefix``) are supported (and are usually required if you want to install OpenSSH). + - For a full list of available flags, run ``configure --help`` but a few of the more frequently-used ones are described below. Some of these flags will require additional libraries and/or headers be installed. ++For a full list of available flags, run ``./configure --help`` but a few of the more frequently-used ones are described below. Some of these flags will require additional libraries and/or headers be installed. + +Flag | Meaning +--- | --- +``--with-pam`` | Enable [PAM](https://en.wikipedia.org/wiki/Pluggable_authentication_module) support. [OpenPAM](https://www.openpam.org/), [Linux PAM](http://www.linux-pam.org/) and Solaris PAM are supported. +``--with-libedit`` | Enable [libedit](https://www.thrysoee.dk/editline/) support for sftp. +``--with-kerberos5`` | Enable Kerberos/GSSAPI support. Both [Heimdal](https://www.h5l.org/) and [MIT](https://web.mit.edu/kerberos/) Kerberos implementations are supported. +``--with-selinux`` | Enable [SELinux](https://en.wikipedia.org/wiki/Security-Enhanced_Linux) support. +``--with-security-key-builtin`` | Include built-in support for U2F/FIDO2 security keys. This requires [libfido2](https://github.com/Yubico/libfido2) be installed. + +## Development + +Portable OpenSSH development is discussed on the [openssh-unix-dev mailing list](https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev) ([archive mirror](https://marc.info/?l=openssh-unix-dev)). Bugs and feature requests are tracked on our [Bugzilla](https://bugzilla.mindrot.org/). + +## Reporting bugs + +_Non-security_ bugs may be reported to the developers via [Bugzilla](https://bugzilla.mindrot.org/) or via the mailing list above. Security bugs should be reported to [openssh@openssh.com](mailto:openssh.openssh.com). diff --cc crypto/openssh/auth.c index 0852a2d85728,000000000000..3e6b75c7bc62 mode 100644,000000..100644 --- a/crypto/openssh/auth.c +++ b/crypto/openssh/auth.c @@@ -1,1030 -1,0 +1,881 @@@ - /* $OpenBSD: auth.c,v 1.154 2022/02/23 11:17:10 djm Exp $ */ ++/* $OpenBSD: auth.c,v 1.158 2022/06/03 04:47:21 djm Exp $ */ +/* + * Copyright (c) 2000 Markus Friedl. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR + * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES + * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. + * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, + * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, + * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY + * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF + * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +#include "includes.h" + +#include +#include +#include +#include + +#include + +#include +#include +#include +#ifdef HAVE_PATHS_H +# include +#endif +#include +#ifdef HAVE_LOGIN_H +#include +#endif +#ifdef USE_SHADOW +#include +#endif +#include +#include +#include +#include +#include +#include +#include + +#include "xmalloc.h" +#include "match.h" +#include "groupaccess.h" +#include "log.h" +#include "sshbuf.h" +#include "misc.h" +#include "servconf.h" +#include "sshkey.h" +#include "hostfile.h" +#include "auth.h" +#include "auth-options.h" +#include "canohost.h" +#include "uidswap.h" +#include "packet.h" +#include "loginrec.h" +#ifdef GSSAPI +#include "ssh-gss.h" +#endif +#include "authfile.h" +#include "monitor_wrap.h" +#include "ssherr.h" +#include "compat.h" +#include "channels.h" +#include "blacklist_client.h" + +/* import */ +extern ServerOptions options; +extern struct include_list includes; +extern int use_privsep; +extern struct sshbuf *loginmsg; +extern struct passwd *privsep_pw; +extern struct sshauthopt *auth_opts; + +/* Debugging messages */ +static struct sshbuf *auth_debug; + +/* + * Check if the user is allowed to log in via ssh. If user is listed + * in DenyUsers or one of user's groups is listed in DenyGroups, false + * will be returned. If AllowUsers isn't empty and user isn't listed + * there, or if AllowGroups isn't empty and one of user's groups isn't + * listed there, false will be returned. + * If the user's shell is not executable, false will be returned. + * Otherwise true is returned. + */ +int +allowed_user(struct ssh *ssh, struct passwd * pw) +{ + struct stat st; + const char *hostname = NULL, *ipaddr = NULL; + u_int i; + int r; + + /* Shouldn't be called if pw is NULL, but better safe than sorry... */ + if (!pw || !pw->pw_name) + return 0; + + if (!options.use_pam && platform_locked_account(pw)) { + logit("User %.100s not allowed because account is locked", + pw->pw_name); + return 0; + } + + /* + * Deny if shell does not exist or is not executable unless we + * are chrooting. + */ + if (options.chroot_directory == NULL || + strcasecmp(options.chroot_directory, "none") == 0) { + char *shell = xstrdup((pw->pw_shell[0] == '\0') ? + _PATH_BSHELL : pw->pw_shell); /* empty = /bin/sh */ + + if (stat(shell, &st) == -1) { + logit("User %.100s not allowed because shell %.100s " + "does not exist", pw->pw_name, shell); + free(shell); + return 0; + } + if (S_ISREG(st.st_mode) == 0 || + (st.st_mode & (S_IXOTH|S_IXUSR|S_IXGRP)) == 0) { + logit("User %.100s not allowed because shell %.100s " + "is not executable", pw->pw_name, shell); + free(shell); + return 0; + } + free(shell); + } + + if (options.num_deny_users > 0 || options.num_allow_users > 0 || + options.num_deny_groups > 0 || options.num_allow_groups > 0) { + hostname = auth_get_canonical_hostname(ssh, options.use_dns); + ipaddr = ssh_remote_ipaddr(ssh); + } + + /* Return false if user is listed in DenyUsers */ + if (options.num_deny_users > 0) { + for (i = 0; i < options.num_deny_users; i++) { + r = match_user(pw->pw_name, hostname, ipaddr, + options.deny_users[i]); + if (r < 0) { + fatal("Invalid DenyUsers pattern \"%.100s\"", + options.deny_users[i]); + } else if (r != 0) { + logit("User %.100s from %.100s not allowed " + "because listed in DenyUsers", + pw->pw_name, hostname); + return 0; + } + } + } + /* Return false if AllowUsers isn't empty and user isn't listed there */ + if (options.num_allow_users > 0) { + for (i = 0; i < options.num_allow_users; i++) { + r = match_user(pw->pw_name, hostname, ipaddr, + options.allow_users[i]); + if (r < 0) { + fatal("Invalid AllowUsers pattern \"%.100s\"", + options.allow_users[i]); + } else if (r == 1) + break; + } + /* i < options.num_allow_users iff we break for loop */ + if (i >= options.num_allow_users) { + logit("User %.100s from %.100s not allowed because " + "not listed in AllowUsers", pw->pw_name, hostname); + return 0; + } + } + if (options.num_deny_groups > 0 || options.num_allow_groups > 0) { + /* Get the user's group access list (primary and supplementary) */ + if (ga_init(pw->pw_name, pw->pw_gid) == 0) { + logit("User %.100s from %.100s not allowed because " + "not in any group", pw->pw_name, hostname); + return 0; + } + + /* Return false if one of user's groups is listed in DenyGroups */ + if (options.num_deny_groups > 0) + if (ga_match(options.deny_groups, + options.num_deny_groups)) { + ga_free(); + logit("User %.100s from %.100s not allowed " + "because a group is listed in DenyGroups", + pw->pw_name, hostname); + return 0; + } + /* + * Return false if AllowGroups isn't empty and one of user's groups + * isn't listed there + */ + if (options.num_allow_groups > 0) + if (!ga_match(options.allow_groups, + options.num_allow_groups)) { + ga_free(); + logit("User %.100s from %.100s not allowed " + "because none of user's groups are listed " + "in AllowGroups", pw->pw_name, hostname); + return 0; + } + ga_free(); + } + +#ifdef CUSTOM_SYS_AUTH_ALLOWED_USER + if (!sys_auth_allowed_user(pw, loginmsg)) + return 0; +#endif + + /* We found no reason not to let this user try to log on... */ + return 1; +} + +/* + * Formats any key left in authctxt->auth_method_key for inclusion in + * auth_log()'s message. Also includes authxtct->auth_method_info if present. + */ +static char * +format_method_key(Authctxt *authctxt) +{ + const struct sshkey *key = authctxt->auth_method_key; + const char *methinfo = authctxt->auth_method_info; + char *fp, *cafp, *ret = NULL; + + if (key == NULL) + return NULL; + + if (sshkey_is_cert(key)) { + fp = sshkey_fingerprint(key, + options.fingerprint_hash, SSH_FP_DEFAULT); + cafp = sshkey_fingerprint(key->cert->signature_key, + options.fingerprint_hash, SSH_FP_DEFAULT); + xasprintf(&ret, "%s %s ID %s (serial %llu) CA %s %s%s%s", + sshkey_type(key), fp == NULL ? "(null)" : fp, + key->cert->key_id, + (unsigned long long)key->cert->serial, + sshkey_type(key->cert->signature_key), + cafp == NULL ? "(null)" : cafp, + methinfo == NULL ? "" : ", ", + methinfo == NULL ? "" : methinfo); + free(fp); + free(cafp); + } else { + fp = sshkey_fingerprint(key, options.fingerprint_hash, + SSH_FP_DEFAULT); + xasprintf(&ret, "%s %s%s%s", sshkey_type(key), + fp == NULL ? "(null)" : fp, + methinfo == NULL ? "" : ", ", + methinfo == NULL ? "" : methinfo); + free(fp); + } + return ret; +} + +void +auth_log(struct ssh *ssh, int authenticated, int partial, + const char *method, const char *submethod) +{ + Authctxt *authctxt = (Authctxt *)ssh->authctxt; + int level = SYSLOG_LEVEL_VERBOSE; + const char *authmsg; + char *extra = NULL; + + if (use_privsep && !mm_is_monitor() && !authctxt->postponed) + return; + + /* Raise logging level */ + if (authenticated == 1 || + !authctxt->valid || + authctxt->failures >= options.max_authtries / 2 || + strcmp(method, "password") == 0) + level = SYSLOG_LEVEL_INFO; + + if (authctxt->postponed) + authmsg = "Postponed"; + else if (partial) + authmsg = "Partial"; + else { + authmsg = authenticated ? "Accepted" : "Failed"; + if (authenticated) + BLACKLIST_NOTIFY(ssh, BLACKLIST_AUTH_OK, "ssh"); + } + + if ((extra = format_method_key(authctxt)) == NULL) { + if (authctxt->auth_method_info != NULL) + extra = xstrdup(authctxt->auth_method_info); + } + + do_log2(level, "%s %s%s%s for %s%.100s from %.200s port %d ssh2%s%s", + authmsg, + method, + submethod != NULL ? "/" : "", submethod == NULL ? "" : submethod, + authctxt->valid ? "" : "invalid user ", + authctxt->user, + ssh_remote_ipaddr(ssh), + ssh_remote_port(ssh), + extra != NULL ? ": " : "", + extra != NULL ? extra : ""); + + free(extra); + +#if defined(CUSTOM_FAILED_LOGIN) || defined(SSH_AUDIT_EVENTS) + if (authenticated == 0 && !(authctxt->postponed || partial)) { + /* Log failed login attempt */ +# ifdef CUSTOM_FAILED_LOGIN + if (strcmp(method, "password") == 0 || + strncmp(method, "keyboard-interactive", 20) == 0 || + strcmp(method, "challenge-response") == 0) + record_failed_login(ssh, authctxt->user, + auth_get_canonical_hostname(ssh, options.use_dns), "ssh"); +# endif +# ifdef SSH_AUDIT_EVENTS + audit_event(ssh, audit_classify_auth(method)); +# endif + } +#endif +#if defined(CUSTOM_FAILED_LOGIN) && defined(WITH_AIXAUTHENTICATE) + if (authenticated) + sys_auth_record_login(authctxt->user, + auth_get_canonical_hostname(ssh, options.use_dns), "ssh", + loginmsg); +#endif +} + +void +auth_maxtries_exceeded(struct ssh *ssh) +{ + Authctxt *authctxt = (Authctxt *)ssh->authctxt; + + error("maximum authentication attempts exceeded for " + "%s%.100s from %.200s port %d ssh2", + authctxt->valid ? "" : "invalid user ", + authctxt->user, + ssh_remote_ipaddr(ssh), + ssh_remote_port(ssh)); + ssh_packet_disconnect(ssh, "Too many authentication failures"); + /* NOTREACHED */ +} + +/* + * Check whether root logins are disallowed. + */ +int +auth_root_allowed(struct ssh *ssh, const char *method) +{ + switch (options.permit_root_login) { + case PERMIT_YES: + return 1; *** 12832 LINES SKIPPED ***