diff options
| author | Darren Tucker <dtucker@cvs.openbsd.org> | 2018-07-16 11:05:42 +0000 |
|---|---|---|
| committer | Darren Tucker <dtucker@cvs.openbsd.org> | 2018-07-16 11:05:42 +0000 |
| commit | 2de79e94856c7fe9754ba5b0bd21b339e40240c6 (patch) | |
| tree | 1466588aba33f80df46bdd08a4560d6a60d23f70 /usr.bin/ssh/sshconnect2.c | |
| parent | 87fbcb0d924941a4564487474584c7ae1d8b8ad9 (diff) | |
Remove support for loading HostBasedAuthentication keys directly in
ssh(1) and always use ssh-keysign. This removes one of the few remaining
reasons why ssh(1) might be setuid. ok markus@
Diffstat (limited to 'usr.bin/ssh/sshconnect2.c')
| -rw-r--r-- | usr.bin/ssh/sshconnect2.c | 10 |
1 files changed, 3 insertions, 7 deletions
diff --git a/usr.bin/ssh/sshconnect2.c b/usr.bin/ssh/sshconnect2.c index c7906afb9e9..bfc0f336f4d 100644 --- a/usr.bin/ssh/sshconnect2.c +++ b/usr.bin/ssh/sshconnect2.c @@ -1,4 +1,4 @@ -/* $OpenBSD: sshconnect2.c,v 1.280 2018/07/11 18:55:11 markus Exp $ */ +/* $OpenBSD: sshconnect2.c,v 1.281 2018/07/16 11:05:41 dtucker Exp $ */ /* * Copyright (c) 2000 Markus Friedl. All rights reserved. * Copyright (c) 2008 Damien Miller. All rights reserved. @@ -1982,12 +1982,8 @@ userauth_hostbased(Authctxt *authctxt) #ifdef DEBUG_PK sshbuf_dump(b, stderr); #endif - if (authctxt->sensitive->external_keysign) - r = ssh_keysign(private, &sig, &siglen, - sshbuf_ptr(b), sshbuf_len(b)); - else if ((r = sshkey_sign(private, &sig, &siglen, - sshbuf_ptr(b), sshbuf_len(b), NULL, datafellows)) != 0) - debug("%s: sshkey_sign: %s", __func__, ssh_err(r)); + r = ssh_keysign(private, &sig, &siglen, + sshbuf_ptr(b), sshbuf_len(b)); if (r != 0) { error("sign using hostkey %s %s failed", sshkey_ssh_name(private), fp); |