diff options
| author |   djm <djm@openbsd.org> | 2012-12-02 20:34:09 +0000 |
|---|---|---|
| committer | djm <djm@openbsd.org> | 2012-12-02 20:34:09 +0000 |
| commit | e806a6a046b6a7d4bc5330461d34043b90bba1a5 (patch) | |
| tree | a95128bda5b4205009ed3e3c256b2d3cc569c969 /usr.bin/ssh/auth.c | |
| parent | Make IdentitiesOnly apply to keys obtained from a PKCS11Provider. (diff) | |
| download | wireguard-openbsd-e806a6a046b6a7d4bc5330461d34043b90bba1a5.tar.xz wireguard-openbsd-e806a6a046b6a7d4bc5330461d34043b90bba1a5.zip | |
Fixes logging of partial authentication when privsep is enabled
Previously, we recorded "Failed xxx" since we reset authenticated before
calling auth_log() in auth2.c. This adds an explcit "Partial" state.
Add a "submethod" to auth_log() to report which submethod is used
for keyboard-interactive.
Fix multiple authentication when one of the methods is
keyboard-interactive.
ok markus@
Diffstat (limited to 'usr.bin/ssh/auth.c')
| -rw-r--r-- | usr.bin/ssh/auth.c | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/usr.bin/ssh/auth.c b/usr.bin/ssh/auth.c index 9568b3fb6c2..e537ef70f45 100644 --- a/usr.bin/ssh/auth.c +++ b/usr.bin/ssh/auth.c @@ -1,4 +1,4 @@ -/* $OpenBSD: auth.c,v 1.97 2012/10/30 21:29:54 djm Exp $ */ +/* $OpenBSD: auth.c,v 1.98 2012/12/02 20:34:09 djm Exp $ */ /* * Copyright (c) 2000 Markus Friedl. All rights reserved. * @@ -179,7 +179,8 @@ allowed_user(struct passwd * pw) } void -auth_log(Authctxt *authctxt, int authenticated, char *method, char *info) +auth_log(Authctxt *authctxt, int authenticated, int partial, + const char *method, const char *submethod, const char *info) { void (*authlog) (const char *fmt,...) = verbose; char *authmsg; @@ -196,12 +197,15 @@ auth_log(Authctxt *authctxt, int authenticated, char *method, char *info) if (authctxt->postponed) authmsg = "Postponed"; + else if (partial) + authmsg = "Partial"; else authmsg = authenticated ? "Accepted" : "Failed"; - authlog("%s %s for %s%.100s from %.200s port %d%s", + authlog("%s %s%s%s for %s%.100s from %.200s port %d%s", authmsg, method, + submethod != NULL ? "/" : "", submethod == NULL ? "" : submethod, authctxt->valid ? "" : "invalid user ", authctxt->user, get_remote_ipaddr(), @@ -213,7 +217,7 @@ auth_log(Authctxt *authctxt, int authenticated, char *method, char *info) * Check whether root logins are disallowed. */ int -auth_root_allowed(char *method) +auth_root_allowed(const char *method) { switch (options.permit_root_login) { case PERMIT_YES: |