summaryrefslogtreecommitdiff
path: root/usr.bin/ssh/sshd.c
AgeCommit message (Collapse)Author
2024-10-14Split per-connection sshd-session binaryDamien Miller
This splits the user authentication code from the sshd-session binary into a separate sshd-auth binary. This will be executed by sshd-session to complete the user authentication phase of the protocol only. Splitting this code into a separate binary ensures that the crucial pre-authentication attack surface has an entirely disjoint address space from the code used for the rest of the connection. It also yields a small runtime memory saving as the authentication code will be unloaded after thhe authentication phase completes. Joint work with markus@ feedback deraadt@ Tested in snaps since last week
2024-09-15Add a "refuseconnection" penalty class to sshd_configDamien Miller
PerSourcePenalties This allows penalising connection sources that have had connections dropped by the RefuseConnection option. ok markus@
2024-09-12Relax absolute path requirement back to what it was prior to OpenSSH 9.8,Damien Miller
which incorrectly required that sshd was started with an absolute path in inetd mode. bz3717, patch from Colin Wilson
2024-08-17fix swapping of source and destination addresses in some sshd log messagesDamien Miller
2024-06-27delete obsolete commentDamien Miller
2024-06-26move child process waitpid() loop out of SIGCHLD handler;Damien Miller
ok deraadt
2024-06-06disable stderr redirection before closing fdsDamien Miller
2024-06-06Add a facility to sshd(8) to penalise particular problematic clientDamien Miller
behaviours, controlled by two new sshd_config(5) options: PerSourcePenalties and PerSourcePenaltyExemptList. When PerSourcePenalties are enabled, sshd(8) will monitor the exit status of its child pre-auth session processes. Through the exit status, it can observe situations where the session did not authenticate as expected. These conditions include when the client repeatedly attempted authentication unsucessfully (possibly indicating an attack against one or more accounts, e.g. password guessing), or when client behaviour caused sshd to crash (possibly indicating attempts to exploit sshd). When such a condition is observed, sshd will record a penalty of some duration (e.g. 30 seconds) against the client's address. If this time is above a minimum threshold specified by the PerSourcePenalties, then connections from the client address will be refused (along with any others in the same PerSourceNetBlockSize CIDR range). Repeated offenses by the same client address will accrue greater penalties, up to a configurable maximum. A PerSourcePenaltyExemptList option allows certain address ranges to be exempt from all penalties. We hope these options will make it significantly more difficult for attackers to find accounts with weak/guessable passwords or exploit bugs in sshd(8) itself. PerSourcePenalties is off by default, but we expect to enable it automatically in the near future. much feedback markus@ and others, ok markus@
2024-06-01be really strict with fds reserved for communication with the separateDamien Miller
sshd-session process - reserve them early and fatal if we can't dup2(2) them later. The pre-split fallback to re-reading the configuration files is not possible, so sshd-session absolutely requires the fd the configuration is passed over to be in order. ok deraadt@
2024-05-31warn when -r (deprecated option to disable re-exec) is passedDamien Miller
2024-05-17Start the process of splitting sshd into separate binaries. This stepDamien Miller
splits sshd into a listener and a session binary. More splits are planned. After this changes, the listener binary will validate the configuration, load the hostkeys, listen on port 22 and manage MaxStartups only. All session handling will be performed by a new sshd-session binary that the listener fork+execs. This reduces the listener process to the minimum necessary and sets us up for future work on the sshd-session binary. feedback/ok markus@ deraadt@ NB. if you're updating via source, please restart sshd after installing, otherwise you run the risk of locking yourself out.
2024-01-08remove ext-info-* in the kex.c code, not in callers; with/ok markus@Damien Miller
2023-12-18add "ext-info-in-auth@openssh.com" extensionDamien Miller
This adds another transport protocol extension to allow a sshd to send SSH2_MSG_EXT_INFO during user authentication, after the server has learned the username that is being logged in to. This lets sshd to update the acceptable signature algoritms for public key authentication, and allows these to be varied via sshd_config(5) "Match" directives, which are evaluated after the server learns the username being authenticated. Full details in the PROTOCOL file
2023-03-08Delete obsolete /* ARGSUSED */ lint comments.Philip Guenther
ok miod@ millert@
2023-03-06Refactor creation of KEX proposal.Darren Tucker
This adds kex_proposal_populate_entries (and corresponding free) which populates the KEX proposal array with dynamically allocated strings. This replaces the previous mix of static and dynamic that has been the source of previous leaks and bugs. Remove unused compat functions. With & ok djm@.
2023-03-03Check return values of dup2. Spotted by Coverity, ok djm@Darren Tucker
2023-02-10add a `sshd -G` option that parses and prints the effectiveDamien Miller
configuration without attempting to load private keys and perform other checks. This allows usage of the option before keys have been generated. bz3460 feedback/ok dtucker@
2023-01-18Add a -V (version) option to sshd like the ssh client has.Todd C. Miller
OK markus@ deraadt@
2023-01-06Implement channel inactivity timeoutsDamien Miller
This adds a sshd_config ChannelTimeouts directive that allows channels that have not seen traffic in a configurable interval to be automatically closed. Different timeouts may be applied to session, X11, agent and TCP forwarding channels. Note: this only affects channels over an opened SSH connection and not the connection itself. Most clients close the connection when their channels go away, with a notable exception being ssh(1) in multiplexing mode. ok markus dtucker
2022-12-16Clear signal mask early in main(); sshd may have been started withDamien Miller
one or more signals masked (sigprocmask(2) is not cleared on fork/exec) and this could interfere with various things, e.g. the login grace timer. Execution environments that fail to clear the signal mask before running sshd are clearly broken, but apparently they do exist. Reported by Sreedhar Balasubramanian; ok dtucker@
2022-12-04userspace: remove vestigial '?' cases from top-level getopt(3) loopsScott Soule Cheloha
getopt(3) returns '?' when it encounters a flag not present in the in the optstring or if a flag is missing its option argument. We can handle this case with the "default" failure case with no loss of legibility. Hence, remove all the redundant "case '?':" lines. Prompted by dlg@. With help from dlg@ and millert@. Link: https://marc.info/?l=openbsd-tech&m=167011979726449&w=2 ok naddy@ millert@ dlg@
2022-10-28refactor sshkey_private_serialize_opt()Damien Miller
feedback/ok markus@
2022-09-17Add RequiredRSASize for sshd(8); RSA keys that fall beneath this limitDamien Miller
will be ignored for user and host-based authentication. Feedback deraadt@ ok markus@
2022-07-01Remove extra line leftover from merge conflict. ok djm@Darren Tucker
2022-07-01Don't leak the strings allocated by order_hostkeyalgs() andDarren Tucker
list_hostkey_types() that are passed to compat_pkalg_proposal(). Part of github PR#324 from ZoltanFridrich, ok djm@ This is a roll-forward of the previous rollback now that the required changes in compat.c have been done.
2022-06-24Roll back previous KEX changes as they aren't safe untilDarren Tucker
compat_pkalg_proposal and friends always allocate their returned strings. Reported by Qualys.
2022-06-24Don't leak the strings allocated by order_hostkeyalgs() andDarren Tucker
list_hostkey_types() that are passed to compat_pkalg_proposal(). Part of github PR#324 from ZoltanFridrich, ok djm@
2022-06-17Log an error if pipe() fails while accepting a connection. bz#3447, fromDarren Tucker
vincent-openssh at vinc17 net, ok djm@
2022-03-18don't try to resolve ListenAddress directives in the sshd re-execDamien Miller
path - we're never going to use the result and if the operation fails then it can prevent connections from being accepted. Reported by Aaron Poffenberger; with / ok dtucker@
2022-03-01pack pollfd array before server_accept_loop() ppoll() call,Damien Miller
and terminate sshd if ppoll() returns errno==EINVAL avoids spin in ppoll when MaxStartups > RLIMIT_NOFILE, reported by Daniel Micay feedback/ok deraadt
2022-02-01Remove explicit kill of privsep preauth child's PID in SIGALRM handler.Darren Tucker
It's no longer needed since the child will get terminated by the SIGTERM to the process group that cleans up any auth helpers, it simplifies the signal handler and removes the risk of a race when updating the PID. Based on analysis by HerrSpace in github PR#289, ok djm@
2021-11-18fd leak in sshd listen loop error path; from Gleb SmirnoffDamien Miller
2021-11-18check for POLLHUP as well as POLLIN in sshd listen loop;Damien Miller
ok deraadt millert
2021-11-17set num_listen_socks to 0 on close-all instead of -1, whichDamien Miller
interferes with the new poll()-based listen loop; spotted and debugged by anton@+deraadt@
2021-11-14use ppoll() instead of pselect()Theo de Raadt
with djm
2021-07-19Put dh_set_moduli_file call inside ifdef WITH_OPENSSL. Fixes build withDarren Tucker
OPENSSL=no.
2021-07-02Remove references to ChallengeResponseAuthentication in favour ofDarren Tucker
KbdInteractiveAuthentication. The former is what was in SSHv1, the latter is what is in SSHv2 (RFC4256) and they were treated as somewhat but not entirely equivalent. We retain the old name as deprecated alias so config files continue to work and a reference in the man page for people looking for it. Prompted by bz#3303 which pointed out the discrepancy between the two when used with Match. Man page help & ok jmc@, with & ok djm@
2021-06-10Continue accept loop when pselect returns -1, eg if it was interruptedDarren Tucker
by a signal. This should prevent the hang discovered by sthen@ wherein sshd receives a SIGHUP while it has an unauthenticated child and goes on to a blocking read on a notify_pipe. feedback deraadt@, ok djm@
2021-06-06Match host certificates against host public keys, not private keys.Damien Miller
Allows use of certificates with private keys held in a ssh-agent. Reported by Miles Zhou in bz3524; ok dtucker@
2021-06-04Switch the listening select loop from select() to pselect() andDarren Tucker
mask signals while checking signal flags, umasking for pselect and restoring afterwards. Also restore signals before sighup_restart so they don't remain blocked after restart. This prevents a race where a SIGTERM or SIGHUP can arrive between checking the flag and calling select (eg if sshd is processing a new connection) resulting in sshd not shutting down until the next time it receives a new connection. bz#2158, with & ok djm@
2021-05-07don't sigdie() in signal handler in privsep child process;Damien Miller
this can end up causing sandbox violations per bz3286; ok dtucker@
2021-04-03highly polished whitespace, mostly fixing spaces-for-tab and badDamien Miller
indentation on continuation lines. Prompted by GHPR#185
2021-03-12Add ModuliFile keyword to sshd_config to specify the location of theDarren Tucker
"moduli" file containing the groups for DH-GEX. This will allow us to run tests against arbitrary moduli files without having to install them. ok djm@
2021-02-05Remove debug message from sigchld handler. While this works on OpenBSDDarren Tucker
it can cause problems on other platforms. From kircherlike at outlook.com via bz#3259, ok djm@
2021-01-27make ssh->kex->session_id a sshbuf instead of u_char*/size_t andDamien Miller
use that instead of global variables containing copies of it. feedback/ok markus@
2021-01-27remove global variable used to stash compat flags and use theDamien Miller
purpose-built ssh->compat variable instead; feedback/ok markus@
2021-01-09Add PerSourceMaxStartups and PerSourceNetBlockSize options which provideDarren Tucker
more fine grained MaxStartups limits. Man page help jmc@, feedback & ok djm@
2020-12-29Update/replace the experimental post-quantim hybrid key exchangeDamien Miller
method based on Streamlined NTRU Prime (coupled with X25519). The previous sntrup4591761x25519-sha512@tinyssh.org method is replaced with sntrup761x25519-sha512@openssh.com. Per the authors, sntrup4591761 was replaced almost two years ago by sntrup761. The sntrup761 implementaion, like sntrup4591761 before it, is public domain code extracted from the SUPERCOP cryptography benchmark suite (https://bench.cr.yp.to/supercop.html). Thanks for Daniel J Bernstein for guidance on algorithm selection. Patch from Tobias Heider; feedback & ok markus@ and myself (note this both the updated method and the one that it replaced are disabled by default)
2020-11-08Replace WITH_OPENSSL ifdefs in log calls with a macro. The log callsDarren Tucker
are themselves now macros, and preprocessor directives inside macro arguments are undefined behaviour which some compilers (eg old GCCs) choke on. It also makes the code tidier. ok deraadt@
2020-10-18use the new variant log macros instead of prepending __func__ andDamien Miller
appending ssh_err(r) manually; ok markus@
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-04 18:37:58 +0000