summaryrefslogtreecommitdiff
path: root/usr.bin/ssh/sshd.c
AgeCommit message (Collapse)Author
2019-06-21Add protection for private keys at rest in RAM against speculationDamien Miller
and memory sidechannel attacks like Spectre, Meltdown, Rowhammer and Rambleed. This change encrypts private keys when they are not in use with a symmetic key that is derived from a relatively large "prekey" consisting of random data (currently 16KB). Attackers must recover the entire prekey with high accuracy before they can attempt to decrypt the shielded private key, but the current generation of attacks have bit error rates that, when applied cumulatively to the entire prekey, make this unlikely. Implementation-wise, keys are encrypted "shielded" when loaded and then automatically and transparently unshielded when used for signatures or when being saved/serialised. Hopefully we can remove this in a few years time when computer architecture has become less unsafe. been in snaps for a bit already; thanks deraadt@ ok dtucker@ deraadt@
2019-06-06Replace calls to ssh_malloc_init() by a static init of malloc_options.Otto Moerbeek
Prepares for changes in the way malloc is initialized. ok guenther@ dtucker@
2019-04-18When running sshd -T, assume any attibute not provided by -C does not match,Darren Tucker
which allows it to work when sshd_config contains a Match directive with or without -C. bz#2858, ok djm@
2019-03-01Fix two race conditions in sshd relating to SIGHUP:Damien Miller
1. Recently-forked child processes will briefly remain listening to listen_socks. If the main server sshd process completes its restart via execv() before these sockets are closed by the child processes then it can fail to listen at the desired addresses/ports and/or fail to restart. 2. When a SIGHUP is received, there may be forked child processes that are awaiting their reexecution state. If the main server sshd process restarts before passing this state, these child processes will yield errors and use a fallback path of reading the current sshd_config from the filesystem rather than use the one that sshd was started with. To fix both of these cases, we reuse the startup_pipes that are shared between the main server sshd and forked children. Previously this was used solely to implement tracking of pre-auth child processes for MaxStartups, but this extends the messaging over these pipes to include a child->parent message that the parent process is safe to restart. This message is sent from the child after it has completed its preliminaries: closing listen_socks and receiving its reexec state. bz#2953, reported by Michal Koutný; ok markus@ dtucker@
2019-01-21merge kexkem[cs] into kexgenDamien Miller
from markus@ ok djm@
2019-01-21use KEM API for vanilla ECDHDamien Miller
from markus@ ok djm@
2019-01-21use KEM API for vanilla DH KEXDamien Miller
from markus@ ok djm@
2019-01-21use KEM API for vanilla c25519 KEXDamien Miller
2019-01-21Add support for a PQC KEX/KEM: sntrup4591761x25519-sha512@tinyssh.orgDamien Miller
using the Streamlined NTRU Prime 4591^761 implementation from SUPERCOP coupled with X25519 as a stop-loss. Not enabled by default. introduce KEM API; a simplified framework for DH-ish KEX methods. from markus@ feedback & ok djm@
2019-01-19remove last references to active_stateDamien Miller
with & ok markus@
2019-01-19convert monitor.c to new packet APIDamien Miller
with & ok markus@
2019-01-19convert sshd.c to new packet APIDamien Miller
with & ok markus@
2019-01-19convert auth2.c to new packet APIDamien Miller
2019-01-19convert servconf.c to new packet APIDamien Miller
with & ok markus@
2019-01-19begin landing remaining refactoring of packet parsing API, startedDamien Miller
almost exactly six years ago. This change stops including the old packet_* API by default and makes each file that requires the old API include it explicitly. We will commit file-by-file refactoring to remove the old API in consistent steps. with & ok markus@
2019-01-17many of the global variables in this file can be made static;Damien Miller
patch from Markus Schmidt
2018-12-27move client/server SSH-* banners to buffers under ssh->kex and factorDamien Miller
out the banner exchange. This eliminates some common code from the client and server. Also be more strict about handling \r characters - these should only be accepted immediately before \n (pointed out by Jann Horn). Inspired by a patch from Markus Schmidt. (lots of) feedback and ok markus@
2018-11-19silence (to log level debug2) failure messages when loading the defaultDamien Miller
hostkeys. Hostkeys explicitly specified in the configuration or on the command-line are still reported as errors, and failure to load at least one host key remains a fatal error. Based on patch from Dag-Erling Smørgrav via https://github.com/openssh/openssh-portable/pull/103 ok markus@
2018-11-16use path_absolute() for pathname checks; from Manoj AmpalamDamien Miller
2018-10-23refer to OpenSSL not SSLeay;Damien Miller
we're old, but we don't have to act it
2018-09-21when compiled with GSSAPI support, cache supported method OIDs byDamien Miller
calling ssh_gssapi_prepare_supported_oids() regardless of whether GSSAPI authentication is enabled in the main config. This avoids sandbox violations for configurations that enable GSSAPI auth later, e.g. Match user djm GSSAPIAuthentication yes bz#2107; ok dtucker@
2018-09-13hold our collective noses and use the openssl-1.1.x API in OpenSSH;Damien Miller
feedback and ok tb@ jsing@ markus@
2018-08-13revert compat.[ch] section of the following change. It causesDamien Miller
double-free under some circumstances. -- date: 2018/07/31 03:07:24; author: djm; state: Exp; lines: +33 -18; commitid: f7g4UI8eeOXReTPh; fix some memory leaks spotted by Coverity via Jakub Jelen in bz#2366 feedback and ok dtucker@
2018-07-31fix some memory leaks spotted by Coverity via Jakub Jelen in bz#2366Damien Miller
feedback and ok dtucker@
2018-07-11remove legacy key emulation layer; ok djm@Markus Friedl
2018-07-09sshd: switch config to sshbuf API; ok djm@Markus Friedl
2018-07-09sshd: switch loginmsg to sshbuf API; ok djm@Markus Friedl
2018-07-03Improve strictness and control over RSA-SHA2 signature types:Damien Miller
In ssh, when an agent fails to return a RSA-SHA2 signature when requested and falls back to RSA-SHA1 instead, retry the signature to ensure that the public key algorithm sent in the SSH_MSG_USERAUTH matches the one in the signature itself. In sshd, strictly enforce that the public key algorithm sent in the SSH_MSG_USERAUTH message matches what appears in the signature. Make the sshd_config PubkeyAcceptedKeyTypes and HostbasedAcceptedKeyTypes options control accepted signature algorithms (previously they selected supported key types). This allows these options to ban RSA-SHA1 in favour of RSA-SHA2. Add new signature algorithms "rsa-sha2-256-cert-v01@openssh.com" and "rsa-sha2-512-cert-v01@openssh.com" to force use of RSA-SHA2 signatures with certificate keys. feedback and ok markus@
2018-04-13Defend against user enumeration timing attacks.Darren Tucker
This establishes a minimum time for each failed authentication attempt (5ms) and adds a per-user constant derived from a host secret (0-4ms). Based on work by joona.kannisto at tut.fi, ok markus@ djm@.
2018-04-10lots of typos in comments/docs. Patch from Karsten Weiss after checkingDamien Miller
with codespell tool (https://github.com/lucasdemarchi/codespell)
2018-03-03switch over to the new authorized_keys options API and remove theDamien Miller
legacy one. Includes a fairly big refactor of auth2-pubkey.c to retain less state between key file lines. feedback and ok markus@
2018-02-23Add experimental support for PQC XMSS keys (Extended Hash-Based Signatures)Markus Friedl
The code is not compiled in by default (see WITH_XMSS in Makefile.inc) Joint work with stefan-lukas_gazdag at genua.eu See https://tools.ietf.org/html/draft-irtf-cfrg-xmss-hash-based-signatures-12 ok djm@
2018-02-11Don't reset signal handlers inside handlers.Darren Tucker
The signal handlers from the original ssh1 code on which OpenSSH is based assume unreliable signals and reinstall their handlers. Since OpenBSD (and pretty much every current system) has reliable signals this is not needed. In the unlikely even that -portable is still being used on such systems we will deal with it in the compat layer. ok deraadt@
2018-01-23Fix a logic bug in sshd_exchange_identification which prevented clientsStefan Sperling
using major protocol version 2 from connecting to the server. ok millert@
2018-01-23Drop compatibility hacks for some ancient SSH implementations, includingDamien Miller
ssh.com <=2.* and OpenSSH <= 3.*. These versions were all released in or before 2001 and predate the final SSH RFCs. The hacks in question aren't necessary for RFC- compliant SSH implementations. ok markus@
2018-01-23unbreak support for clients that advertise a protocol versionDamien Miller
of "1.99" (indicating both v2 and v1 support). Busted by me during SSHv1 purge in r1.358; bz2810, ok dtucker
2018-01-23avoid modifying pw->pw_passwd; let endpwent() clean up for us, butDamien Miller
keep a scrubbed copy; bz2777, ok dtucker@
2017-11-14fix problem in configuration parsing when in config dump mode (sshd -T)Damien Miller
without providing a full connection specification (sshd -T -C ...) spotted by bluhm@
2017-11-03When doing a config test with sshd -T, only require the attributesDarren Tucker
that are actually used in Match criteria rather than (an incomplete list of) all criteria. ok djm@, man page help jmc@
2017-10-27improve printing of rdomain on accept() a littleDamien Miller
2017-10-25add a "rdomain" criteria for the sshd_config Match keyword to allowDamien Miller
conditional configuration that depends on which rdomain(4) a connection was recevied on. ok markus@
2017-10-25add sshd_config RDomain keyword to place sshd and the subsequentDamien Miller
user session (including the shell and any TCP/IP forwardings) into the specified rdomain(4) ok markus@
2017-10-25Add optional rdomain qualifier to sshd_config's ListenAddress optionDamien Miller
to allow listening on a different rdomain(4), e.g. ListenAddress 0.0.0.0 rdomain 4
2017-10-05replace statically-sized arrays in ServerOptions with dynamic onesDamien Miller
managed by xrecallocarray, removing some arbitrary (though large) limits and saving a bit of memory; "much nicer" markus@
2017-09-12refactor channels.cDamien Miller
Move static state to a "struct ssh_channels" that is allocated at runtime and tracked as a member of struct ssh. Explicitly pass "struct ssh" to all channels functions. Replace use of the legacy packet APIs in channels.c. Rework sshd_config PermitOpen handling: previously the configuration parser would call directly into the channels layer. After the refactor this is not possible, as the channels structures are allocated at connection time and aren't available when the configuration is parsed. The server config parser now tracks PermitOpen itself and explicitly configures the channels code later. ok markus@
2017-07-01remove post-SSHv1 removal dead code from rsa.c and merge theDamien Miller
remaining bit that it still used into ssh-rsa.c; ok markus
2017-05-31clear session keys from memory; ok djm@Markus Friedl
2017-05-31remove now obsolete ctx from ssh_dispatch_run; ok djm@Markus Friedl
2017-05-30switch from Key typedef with struct sshkey; ok djm@Markus Friedl
2017-04-30remove KEY_RSA1Damien Miller
ok markus@
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-13 20:44:46 +0000