summaryrefslogtreecommitdiffstats
path: root/usr.bin/ssh/hostfile.h (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Refactor hostkeys_foreach() and dependent codedjm2015-02-161-11/+20
| | | | | | Deal with IP addresses (i.e. CheckHostIP) Don't clobber known_hosts when nothing changed ok markus@ as part of larger commit
* Host key rotation support.djm2015-01-261-1/+4
| | | | | | | | | | | | | Add a hostkeys@openssh.com protocol extension (global request) for a server to inform a client of all its available host key after authentication has completed. The client may record the keys in known_hosts, allowing it to upgrade to better host key algorithms and a server to gracefully rotate its keys. The client side of this is controlled by a UpdateHostkeys config option (default on). ok markus@
* introduce hostkeys_foreach() to allow iteration over adjm2015-01-181-1/+42
| | | | | | | | known_hosts file or controlled subset thereof. This will allow us to pull out some ugly and duplicated code, and will be used to implement hostkey rotation later. feedback and ok markus
* sync ssh-keysign, ssh-keygen and some dependencies to the newdjm2015-01-151-5/+6
| | | | buffer/key API; mostly mechanical, ok markus@
* fix pointer-signedness warnings from clang/llvm-3.3; "seems nice" deraadt@djm2013-07-121-2/+2
|
* automatically order the hostkeys requested by the client based ondjm2010-11-291-6/+24
| | | | | | which hostkeys are already recorded in known_hosts. This avoids hostkey warnings when connecting to servers with new ECDSA keys that are preferred by default; with markus@
* Add a TrustedUserCAKeys option to sshd_config to specify CA keys thatdjm2010-03-041-2/+3
| | | | | | | | | | | are trusted to authenticate users (in addition than doing it per-user in authorized_keys). Add a RevokedKeys option to sshd_config and a @revoked marker to known_hosts to allow keys to me revoked and banned for user or host authentication. feedback and ok markus@
* Add support for certificate key types for users and hosts.djm2010-02-261-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | OpenSSH certificate key types are not X.509 certificates, but a much simpler format that encodes a public key, identity information and some validity constraints and signs it with a CA key. CA keys are regular SSH keys. This certificate style avoids the attack surface of X.509 certificates and is very easy to deploy. Certified host keys allow automatic acceptance of new host keys when a CA certificate is marked as trusted in ~/.ssh/known_hosts. see VERIFYING HOST KEYS in ssh(1) for details. Certified user keys allow authentication of users when the signing CA key is marked as trusted in authorized_keys. See "AUTHORIZED_KEYS FILE FORMAT" in sshd(8) for details. Certificates are minted using ssh-keygen(1), documentation is in the "CERTIFICATES" section of that manpage. Documentation on the format of certificates is in the file PROTOCOL.certkeys feedback and ok markus@
* standardise spacing in $OpenBSD$ tags; requested by deraadt@djm2006-03-251-1/+1
|
* add support for hashing host names and addresses added to known_hosts files,djm2005-03-011-2/+7
| | | | to improve privacy of which hosts user have been visiting; ok markus@ deraadt@
* constify. ok markus@ & djm@jakob2003-11-101-3/+3
|
* KNFderaadt2002-11-211-6/+6
|
* no comma at end of enumerator listmarkus2002-09-081-2/+2
|
* print out all known keys for a host if we get a unknown host key,markus2002-07-241-2/+4
| | | | | | | | | | | see discussion at http://marc.theaimsgroup.com/?t=101069210100016&r=1&w=4 the ssharp mitm tool attacks users in a similar way, so i'd like to pointed out again: A MITM attack is always possible if the ssh client prints: The authenticity of host 'bla' can't be established. (protocol version 2 with pubkey authentication allows you to detect MITM attacks)
* remove auth_rsa_read_key, make hostfile_ready_key non static; ok markus@jakob2001-12-181-2/+2
|
* remove comments from .h, since they are cut&paste from the .c filesmarkus2001-06-261-16/+3
| | | | and out of sync
* prototype pedant. not very creative...itojun2001-06-261-5/+4
| | | | | - () -> (void) - no variable names
* sync with netbsd tree changes.itojun2001-02-081-1/+4
| | | | | | - more strict prototypes, include necessary headers - use paths.h/pathnames.h decls - size_t typecase to int -> u_long
* $OpenBSD$niklas2001-01-291-0/+2
|
* print keyfile:line for changed hostkeys, for deraadt@; ok deraadt@markus2000-12-211-1/+3
|
* some more Copyright fixesmarkus2000-09-071-20/+8
|
* cleanup copyright notices on all files. I have attempted to be accurate withderaadt2000-09-071-0/+23
| | | | | | | the details. everything is now under Tatu's licence (which I copied from his readme), and/or the core-sdi bsd-ish thing for deattack, or various openbsd developers under a 2-term bsd licence. We're not changing any rules, just being accurate.
* whitespace cleanupmarkus2000-04-141-1/+1
|
* initial support for DSA keys. ok deraadt@, niels@markus2000-03-231-0/+22
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.