user/958: check ~/.ssh/known_hosts for rhosts-rsa, too, ok niels/millert

3 files changed, 32 insertions, 10 deletions

diff --git a/usr.bin/ssh/auth-rh-rsa.c b/usr.bin/ssh/auth-rh-rsa.c
index 5f3edfab75b..66abac5527f 100644
--- a/usr.bin/ssh/auth-rh-rsa.c
+++ b/usr.bin/ssh/auth-rh-rsa.c
@@ -15,7 +15,7 @@ authentication.
 */
 
 #include "includes.h"
-RCSID("$Id: auth-rh-rsa.c,v 1.2 1999/10/03 21:50:03 provos Exp $");
+RCSID("$Id: auth-rh-rsa.c,v 1.3 1999/11/09 23:09:58 markus Exp $");
 
 #include "packet.h"
 #include "ssh.h"
@@ -53,8 +53,31 @@ int auth_rhosts_rsa(struct passwd *pw, const char *client_user,
   host_status = check_host_in_hostfile(SSH_SYSTEM_HOSTFILE, canonical_hostname,
 				       client_host_key_bits, client_host_key_e,
 				       client_host_key_n, ke, kn);
+  /* Check user host file. */
+  if (host_status != HOST_OK) {
+    struct stat st;
+    char *user_hostfile = tilde_expand_filename(SSH_USER_HOSTFILE, pw->pw_uid);
+    /* Check file permissions of SSH_USER_HOSTFILE,
+       auth_rsa() did already check pw->pw_dir, but there is a race XXX */
+    if (strict_modes &&
+	(stat(user_hostfile, &st) == 0) &&
+	((st.st_uid != 0 && st.st_uid != pw->pw_uid) ||
+	(st.st_mode & 022) != 0)) {
+       log("Rhosts RSA authentication refused for %.100s: bad owner or modes for %.200s",
+	   pw->pw_name, user_hostfile);
+    } else {
+      /* XXX race between stat and the following open() */
+      temporarily_use_uid(pw->pw_uid);
+      host_status = check_host_in_hostfile(user_hostfile, canonical_hostname,
+					   client_host_key_bits, client_host_key_e,
+					   client_host_key_n, ke, kn);
+      restore_uid();
+    }
+    xfree(user_hostfile);
+  }
   BN_free(ke);
   BN_free(kn);
+
   if (host_status != HOST_OK) {
     /* The host key was not found. */
     debug("Rhosts with RSA host authentication denied: unknown or invalid host key");
diff --git a/usr.bin/ssh/ssh.1 b/usr.bin/ssh/ssh.1
index 14b28d4604e..f176fdbcef0 100644
--- a/usr.bin/ssh/ssh.1
+++ b/usr.bin/ssh/ssh.1
@@ -9,7 +9,7 @@
 .\"
 .\" Created: Sat Apr 22 21:55:14 1995 ylo
 .\"
-.\" $Id: ssh.1,v 1.22 1999/10/17 16:58:39 provos Exp $
+.\" $Id: ssh.1,v 1.23 1999/11/09 23:09:58 markus Exp $
 .\"
 .Dd September 25, 1999
 .Dt SSH 1
@@ -93,6 +93,8 @@ or
 and if additionally the server can verify the client's
 host key (see 
 .Pa /etc/ssh_known_hosts
+and
+.Pa $HOME/.ssh/known_hosts
 in the
 .Sx FILES
 section), only then login is
diff --git a/usr.bin/ssh/sshd.8 b/usr.bin/ssh/sshd.8
index 751916bcbf0..5ef713cc993 100644
--- a/usr.bin/ssh/sshd.8
+++ b/usr.bin/ssh/sshd.8
@@ -9,7 +9,7 @@
 .\"
 .\" Created: Sat Apr 22 21:55:14 1995 ylo
 .\"
-.\" $Id: sshd.8,v 1.21 1999/10/25 21:35:25 markus Exp $
+.\" $Id: sshd.8,v 1.22 1999/11/09 23:09:58 markus Exp $
 .\"
 .Dd September 25, 1999
 .Dt SSHD 8
@@ -622,14 +622,11 @@ This file must be readable by root (which may on some machines imply
 it being world-readable if the user's home directory resides on an NFS
 volume).  It is recommended that it not be accessible by others.  The
 format of this file is described above.
-.It Pa /etc/ssh_known_hosts
-This file is consulted when using rhosts with RSA host
+.It Pa "/etc/ssh_known_hosts" and "$HOME/.ssh/known_hosts"
+These files are consulted when using rhosts with RSA host
 authentication to check the public key of the host.  The key must be
-listed in this file to be accepted.
-.It Pa $HOME/.ssh/known_hosts
-The client uses this file
-and
-.Pa /etc/ssh_known_hosts
+listed in one of these files to be accepted.
+The client uses the same files
 to verify that the remote host is the one we intended to
 connect. These files should be writable only by root/the owner.
 .Pa /etc/ssh_known_hosts