summaryrefslogtreecommitdiff
path: root/usr.bin/ssh/misc.h
AgeCommit message (Collapse)Author
2024-09-25fix regression introduced when I switched the "Match" criteria tokeniserDamien Miller
to a more shell-like one. Apparently the old tokeniser (accidentally?) allowed "Match criteria=argument" as well as the "Match criteria argument" syntax that we tested for. People were using this syntax so this adds back support for "Match criteria=argument" bz3739 ok dtucker
2024-06-06Add a facility to sshd(8) to penalise particular problematic clientDamien Miller
behaviours, controlled by two new sshd_config(5) options: PerSourcePenalties and PerSourcePenaltyExemptList. When PerSourcePenalties are enabled, sshd(8) will monitor the exit status of its child pre-auth session processes. Through the exit status, it can observe situations where the session did not authenticate as expected. These conditions include when the client repeatedly attempted authentication unsucessfully (possibly indicating an attack against one or more accounts, e.g. password guessing), or when client behaviour caused sshd to crash (possibly indicating attempts to exploit sshd). When such a condition is observed, sshd will record a penalty of some duration (e.g. 30 seconds) against the client's address. If this time is above a minimum threshold specified by the PerSourcePenalties, then connections from the client address will be refused (along with any others in the same PerSourceNetBlockSize CIDR range). Repeated offenses by the same client address will accrue greater penalties, up to a configurable maximum. A PerSourcePenaltyExemptList option allows certain address ranges to be exempt from all penalties. We hope these options will make it significantly more difficult for attackers to find accounts with weak/guessable passwords or exploit bugs in sshd(8) itself. PerSourcePenalties is off by default, but we expect to enable it automatically in the near future. much feedback markus@ and others, ok markus@
2024-05-17Start the process of splitting sshd into separate binaries. This stepDamien Miller
splits sshd into a listener and a session binary. More splits are planned. After this changes, the listener binary will validate the configuration, load the hostkeys, listen on port 22 and manage MaxStartups only. All session handling will be performed by a new sshd-session binary that the listener fork+execs. This reduces the listener process to the minimum necessary and sets us up for future work on the sshd-session binary. feedback/ok markus@ deraadt@ NB. if you're updating via source, please restart sshd after installing, otherwise you run the risk of locking yourself out.
2024-03-04Separate parsing of string array options from applying them to theDamien Miller
active configuration. This fixes the config parser from erroneously rejecting cases like: AuthenticationMethods password Match User ivy AuthenticationMethods any bz3657 ok markus@
2023-10-11add ChannelTimeout support to the client, mirroring the same optionDamien Miller
in the server. ok markus@
2023-08-28Add keystroke timing obfuscation to the client.Damien Miller
This attempts to hide inter-keystroke timings by sending interactive traffic at fixed intervals (default: every 20ms) when there is only a small amount of data being sent. It also sends fake "chaff" keystrokes for a random interval after the last real keystroke. These are controlled by a new ssh_config ObscureKeystrokeTiming keyword/ feedback/ok markus@
2023-08-18fix regression in OpenSSH 9.4 (mux.c r1.99) that caused multiplexedDamien Miller
sessions to ignore SIGINT under some circumstances. Reported by / feedback naddy@, ok dtucker@
2023-07-19Ensure FIDO/PKCS11 libraries contain expected symbolsDamien Miller
This checks via nlist(3) that candidate provider libraries contain one of the symbols that we will require prior to dlopen(), which can cause a number of side effects, including execution of constructors. Feedback deraadt; ok markus
2023-03-03Use time_t for x11_refuse_time timeout. We need SSH_TIME_T_MAX forDarren Tucker
this, so move from misc.c to misc.h so it's available. Fixes a Coverity warning for 64bit time_t safety, ok djm@
2023-01-06add ptimeout API for keeping track of poll/ppoll timeouts;Damien Miller
ok dtucker markus
2022-06-03Make SetEnv directives first-match-wins in both sshd_config andDamien Miller
sshd_config; previously if the same name was reused then the last would win (which is the opposite to how the config is supposed to work). While there, make the ssh_config parsing more like sshd_config. bz3438, ok dtucker
2021-11-13replace select() with ppoll(), including converting timeval's to timespec'sTheo de Raadt
to make things easier. back and forth and ok; djm
2021-08-09SFTP protocol extension to allow the server to expand ~-prefixedDamien Miller
paths, in particular ~user ones. Allows scp in sftp mode to accept these paths, like scp in rcp mode does. prompted by and much discussion deraadt@ ok markus@
2021-06-08Allow argv_split() to optionally terminate tokenisation when itDamien Miller
encounters an unquoted comment. Add some additional utility function for working with argument vectors, since we'll be switching to using them to parse ssh/sshd_config shortly. ok markus@ as part of a larger diff; tested in snaps
2021-06-04allow ssh_config SetEnv to override $TERM, which is otherwise handledDamien Miller
specially by the protocol. Useful in ~/.ssh/config to set TERM to something generic (e.g. "xterm" instead of "xterm-256color") for destinations that lack terminfo entries. feedback and ok dtucker@
2021-04-03highly polished whitespace, mostly fixing spaces-for-tab and badDamien Miller
indentation on continuation lines. Prompted by GHPR#185
2021-03-03needs FILE*; from Mike FrysingerDamien Miller
2021-02-15factor out opt_array_append; ok djm@Markus Friedl
2021-01-11Change convtime() from returning long to returning int. On platformsDarren Tucker
where sizeof(int) != sizeof(long), convtime could accept values >MAX_INT which subsequently truncate when stored in an int during config parsing. bz#3250, ok djm@
2020-12-22move subprocess() from auth.c to misc.cDamien Miller
make privilege dropping optional but allow it via callbacks (to avoid need to link uidswap.c everywhere) add some other flags (keep environment, disable strict path safety check) that make this more useful for client-side use. feedback & ok markus@
2020-11-27Set the specified TOS/DSCP for interactive use prior to TCP connect.Damien Miller
The connection phase of the SSH session is time-sensitive (due to server side login grace periods) and is frequently interactive (e.g. entering passwords). The ultimate interactive/bulk TOS/DSCP will be set after authentication completes. ok dtucker@
2020-11-08when requesting a security key touch on stderr, inform the user onceDamien Miller
the touch has been recorded; requested by claudio@ ok markus@
2020-10-03There are lots of place where we want to redirect stdin, stdoutDamien Miller
and/or stderr to /dev/null. Factor all these out to a single stdfd_devnull() function that allows selection of which of these to redirect. ok markus@
2020-05-29Make dollar_expand variadic and pass a real va_list to vdollar_percent_expand.Darren Tucker
Fixes build error on arm64 spotted by otto@.
2020-05-29Allow some keywords to expand shell-style ${ENV} environmentDarren Tucker
variables on the client side. The supported keywords are CertificateFile, ControlPath, IdentityAgent and IdentityFile, plus LocalForward and RemoteForward when used for Unix domain socket paths. This would for example allow forwarding of Unix domain socket paths that change at runtime. bz#3140, ok djm@
2020-05-26add fmt_timeframe() (from bgpd) to format a time interval in a human-Damien Miller
friendly format. Switch copyright for this file from BSD to MIT to make it easier to add Henning's copyright for this function. ok markus@
2020-01-24add xextendf() to extend a string with a format (reallocating asDamien Miller
necessary). ok aja@ as part of a larger diff
2020-01-23Replace all calls to signal(2) with a wrapper around sigaction(2).Darren Tucker
This wrapper blocks all other signals during the handler preventing races between handlers, and sets SA_RESTART which should reduce the potential for short read/write operations.
2019-11-12dd API for performing one-shot notifications via tty or SSH_ASKPASSDamien Miller
2019-09-03move authorized_keys option parsing helpsers to misc.c and makeDamien Miller
them public; ok markus@
2019-09-03move skip_space() to misc.c and make it public; ok markus@Damien Miller
2019-01-23Remove support for obsolete host/port syntax.Darren Tucker
host/port was added in 2001 as an alternative to host:port syntax for the benefit of IPv6 users. These days there are establised standards for this like [::1]:22 and the slash syntax is easily mistaken for CIDR notation, which OpenSSH now supports for some things. Remove the slash notation from ListenAddress and PermitOpen. bz#2335, patch from jjelen at redhat.com, ok markus@
2018-12-27move client/server SSH-* banners to buffers under ssh->kex and factorDamien Miller
out the banner exchange. This eliminates some common code from the client and server. Also be more strict about handling \r characters - these should only be accepted immediately before \n (pointed out by Jann Horn). Inspired by a patch from Markus Schmidt. (lots of) feedback and ok markus@
2018-12-07Fix calculation of initial bandwidth limits.Darren Tucker
Account for written bytes before the initial timer check so that the first buffer written is accounted. Set the threshold after which the timer is checked such that the limit starts being computed as soon as possible, ie after the second buffer is written. This prevents an initial burst of traffic and provides a more accurate bandwidth limit. bz#2927, ok djm.
2018-11-16use path_absolute() for pathname checks; from Manoj AmpalamDamien Miller
2018-10-03Allow ssh_config IdentityAgent directive to accept environment variableDamien Miller
names as well as explicit paths. ok dtucker@
2018-07-27Remove uid checks from low port binds. Now that ssh cannot beDarren Tucker
setuid and sshd always has privsep on, we can remove the uid checks for low port binds and just let the system do the check. We leave a sanity check for the !privsep case so long as the code is stil there. with & ok djm@
2018-06-09add a SetEnv directive to ssh_config that allows setting environmentDamien Miller
variables for the remote session (subject to the server accepting them) refactor SendEnv to remove the arbitrary limit of variable names. ok markus@
2018-06-06switch config file parsing to getline(3) as this avoids static limitsMarkus Friedl
noted by gerhard@; ok dtucker@, djm@
2018-03-12add valid-before="[time]" authorized_keys option. A simple way ofDamien Miller
giving a key an expiry date. ok markus@
2018-01-08move subprocess() so scp/sftp do not need uidswap.o; ok djm@Markus Friedl
2017-12-05Replace atoi and strtol conversions for integer arguments to configDarren Tucker
keywords with a checking wrapper around strtonum. This will prevent and flag invalid and negative arguments to these keywords. ok djm@
2017-11-25Add monotime_ts and monotime_tv that return monotonic timespec andDarren Tucker
timeval respectively. Replace calls to gettimeofday() in packet timing with monotime_tv so that the callers will work over a clock step. Should prevent integer overflow during clock steps reported by wangle6 at huawei.com. "I like" markus@
2017-10-25add sshd_config RDomain keyword to place sshd and the subsequentDamien Miller
user session (including the shell and any TCP/IP forwardings) into the specified rdomain(4) ok markus@
2017-10-25Add optional rdomain qualifier to sshd_config's ListenAddress optionDamien Miller
to allow listening on a different rdomain(4), e.g. ListenAddress 0.0.0.0 rdomain 4
2017-10-23Expose devices allocated for tun/tap forwarding.Damien Miller
At the client, the device may be obtained from a new %T expansion for LocalCommand. At the server, the allocated devices will be listed in a SSH_TUNNEL variable exposed to the environment of any user sessions started after the tunnel forwarding was established. ok markus
2017-10-21Add URI support to ssh, sftp and scp. For example ssh://user@hostTodd C. Miller
or sftp://user@host/path. The connection parameters described in draft-ietf-secsh-scp-sftp-ssh-uri-04 are not implemented since the ssh fingerprint format in the draft uses md5 with no way to specify the hash function type. OK djm@
2017-08-18add a "quiet" flag to exited_cleanly() that supresses errors aboutDamien Miller
exit status (failure due to signal is still reported)
2017-08-18Move several subprocess-related functions from various locations toDamien Miller
misc.c. Extend subprocess() to offer a little more control over stdio disposition. feedback & ok dtucker@
2016-11-30On startup, check to see if sshd is already daemonized and if so,Darren Tucker
skip the call to daemon() and do not rewrite the PidFile. This means that when sshd re-execs itself on SIGHUP the process ID will no longer change. Should address bz#2641. ok djm@ markus@.
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-29 11:33:58 +0000