diff options
| author |   djm <djm@openbsd.org> | 2011-03-10 02:52:57 +0000 |
|---|---|---|
| committer | djm <djm@openbsd.org> | 2011-03-10 02:52:57 +0000 |
| commit | 55a93f9cf3e0469d336035de104f5bbc190967f0 (patch) | |
| tree | cd2cf2134acbef6cfd6b81d25f262aa3e2b6faa8 | |
| parent | Log MAC address changes in the IPv6 neighbor discovery protocol (diff) | |
| download | wireguard-openbsd-55a93f9cf3e0469d336035de104f5bbc190967f0.tar.xz wireguard-openbsd-55a93f9cf3e0469d336035de104f5bbc190967f0.zip | |
allow GSSAPI authentication to detect when a server-side failure causes
authentication failure and don't count such failures against MaxAuthTries;
bz#1244 from simon AT sxw.org.uk; ok markus@ before lock
| -rw-r--r-- | usr.bin/ssh/auth2-gss.c | 4 | ||||
| -rw-r--r-- | usr.bin/ssh/auth2.c | 6 |
2 files changed, 7 insertions, 3 deletions
diff --git a/usr.bin/ssh/auth2-gss.c b/usr.bin/ssh/auth2-gss.c index 3a15cf58ce6..4f5fc28419f 100644 --- a/usr.bin/ssh/auth2-gss.c +++ b/usr.bin/ssh/auth2-gss.c @@ -1,4 +1,4 @@ -/* $OpenBSD: auth2-gss.c,v 1.16 2007/10/29 00:52:45 dtucker Exp $ */ +/* $OpenBSD: auth2-gss.c,v 1.17 2011/03/10 02:52:57 djm Exp $ */ /* * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved. @@ -98,6 +98,7 @@ userauth_gssapi(Authctxt *authctxt) if (!present) { xfree(doid); + authctxt->server_caused_failure = 1; return (0); } @@ -105,6 +106,7 @@ userauth_gssapi(Authctxt *authctxt) if (ctxt != NULL) ssh_gssapi_delete_ctx(&ctxt); xfree(doid); + authctxt->server_caused_failure = 1; return (0); } diff --git a/usr.bin/ssh/auth2.c b/usr.bin/ssh/auth2.c index b197315f60f..809d9b5da00 100644 --- a/usr.bin/ssh/auth2.c +++ b/usr.bin/ssh/auth2.c @@ -1,4 +1,4 @@ -/* $OpenBSD: auth2.c,v 1.122 2010/08/31 09:58:37 djm Exp $ */ +/* $OpenBSD: auth2.c,v 1.123 2011/03/10 02:52:57 djm Exp $ */ /* * Copyright (c) 2000 Markus Friedl. All rights reserved. * @@ -254,6 +254,7 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt) #endif authctxt->postponed = 0; + authctxt->server_caused_failure = 0; /* try to authenticate user */ m = authmethod_lookup(method); @@ -299,7 +300,8 @@ userauth_finish(Authctxt *authctxt, int authenticated, char *method) authctxt->success = 1; } else { /* Allow initial try of "none" auth without failure penalty */ - if (authctxt->attempt > 1 || strcmp(method, "none") != 0) + if (!authctxt->server_caused_failure && + (authctxt->attempt > 1 || strcmp(method, "none") != 0)) authctxt->failures++; if (authctxt->failures >= options.max_authtries) packet_disconnect(AUTH_FAIL_MSG, authctxt->user); |