diff options
| author | djm@openbsd.org <djm@openbsd.org> | 2015-01-13 07:39:19 +0000 |
|---|---|---|
| committer | Damien Miller <djm@mindrot.org> | 2015-01-13 19:27:18 +1100 |
| commit | 1f729f0614d1376c3332fa1edb6a5e5cec7e9e03 (patch) | |
| tree | f651f10aa00dcecdf8e9362c0abb6282bbc99c95 /auth2-hostbased.c | |
| parent | 816d1538c24209a93ba0560b27c4fda57c3fff65 (diff) | |
upstream commit
add sshd_config HostbasedAcceptedKeyTypes and
PubkeyAcceptedKeyTypes options to allow sshd to control what public key types
will be accepted. Currently defaults to all. Feedback & ok markus@
Diffstat (limited to 'auth2-hostbased.c')
| -rw-r--r-- | auth2-hostbased.c | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/auth2-hostbased.c b/auth2-hostbased.c index 2db3d252..9f8a01cb 100644 --- a/auth2-hostbased.c +++ b/auth2-hostbased.c @@ -1,4 +1,4 @@ -/* $OpenBSD: auth2-hostbased.c,v 1.21 2015/01/08 10:14:08 djm Exp $ */ +/* $OpenBSD: auth2-hostbased.c,v 1.22 2015/01/13 07:39:19 djm Exp $ */ /* * Copyright (c) 2000 Markus Friedl. All rights reserved. * @@ -48,6 +48,7 @@ #endif #include "monitor_wrap.h" #include "pathnames.h" +#include "match.h" /* import */ extern ServerOptions options; @@ -108,6 +109,14 @@ userauth_hostbased(Authctxt *authctxt) "signature format"); goto done; } + if (match_pattern_list(sshkey_ssh_name(key), + options.hostbased_key_types, + strlen(options.hostbased_key_types), 0) != 1) { + logit("%s: key type %s not in HostbasedAcceptedKeyTypes", + __func__, sshkey_type(key)); + goto done; + } + service = datafellows & SSH_BUG_HBSERVICE ? "ssh-userauth" : authctxt->service; buffer_init(&b); |