summaryrefslogtreecommitdiffstats
path: root/usr.bin/ssh/readconf.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Hostname->HostName cleanup; from lauri tirkkonenjmc2019-06-121-6/+6
| | | | ok dtucker
* Typo and spelling fixes in comments and error messages. Patch fromdtucker2019-06-071-2/+2
| | | | knweiss at gmail.com via -portable.
* let PKCS11Provider=none do what users expectdjm2019-03-011-2/+3
| | | | | | print PKCS11Provider instead of obsolete SmartcardDevice in config dump. bz#2974 ok dtucker@
* openssh-7.9 accidentally reused the server's algorithm lists in thedjm2019-02-231-4/+4
| | | | | | | | | | | | client for KEX, ciphers and MACs. The ciphers and MACs were identical between the client and server, but the error accidentially disabled the diffie-hellman-group-exchange-sha1 KEX method. This fixes the client code to use the correct method list, but because nobody complained, it also disables the diffie-hellman-group-exchange-sha1 KEX method. Reported by nuxi AT vault24.org via bz#2697; ok dtucker
* add a ssh_config "Match final" predicatedjm2018-11-231-16/+28
| | | | | Matches in same pass as "Match canonical" but doesn't require hostname canonicalisation be enabled. bz#2906 ok markus
* use path_absolute() for pathname checks; from Manoj Ampalamdjm2018-11-161-2/+2
|
* Support using service names for port numbers.naddy2018-10-051-6/+15
| | | | | | | | | * Try to resolve a port specification with getservbyname(3) if a numeric conversion fails. * Make the "Port" option in ssh_config handle its argument as a port rather than a plain integer. ok dtucker@ deraadt@
* Allow ssh_config IdentityAgent directive to accept environment variabledjm2018-10-031-2/+13
| | | | names as well as explicit paths. ok dtucker@
* add CASignatureAlgorithms option for the client, allowing it to specifydjm2018-09-201-3/+13
| | | | | which signature algorithms may be used by CAs when signing certificates. Useful if you want to ban RSA/SHA1; ok markus@
* better diagnosics on alg list assembly errors; ok deraadt@ markus@djm2018-08-121-12/+15
|
* Now that ssh can't be setuid, remove the original_real_uid anddtucker2018-07-271-3/+1
| | | | | original_effective_uid globals and replace with calls to plain getuid(). ok djm@
* Remove uid checks from low port binds. Now that ssh cannot bedtucker2018-07-271-4/+1
| | | | | | | setuid and sshd always has privsep on, we can remove the uid checks for low port binds and just let the system do the check. We leave a sanity check for the !privsep case so long as the code is stil there. with & ok djm@
* Deprecate UsePrivilegedPort now that support for running ssh(1)dtucker2018-07-191-10/+2
| | | | | | | | | | | setuid has been removed, remove supporting code and clean up references to it in the man pages We have not shipped ssh(1) the setuid bit since 2002. If ayone really needs to make connections from a low port number this can be implemented via a small setuid ProxyCommand. ok markus@ jmc@ djm@
* Remove support for running ssh(1) setuid and fatal if attempted.dtucker2018-07-181-4/+1
| | | | | Do not link uidwap.c into ssh any more. Neuters UsePrivilegedPort, which will be marked as deprecated shortly. ok markus@ djm@
* repair PubkeyAcceptedKeyTypes (and friends) after RSA signature work -djm2018-07-041-10/+28
| | | | | | | | | | | | | returns ability to add/remove/specify algorithms by wildcard. Algorithm lists are now fully expanded when the server/client configs are finalised, so errors are reported early and the config dumps (e.g. "ssh -G ...") now list the actual algorithms selected. Clarify that, while wildcards are accepted in algorithm lists, they aren't full pattern-lists that support negation. (lots of) feedback, ok markus@
* unbreak SendEnv; patch from tb@djm2018-06-101-2/+2
|
* add a SetEnv directive to ssh_config that allows setting environmentdjm2018-06-091-3/+31
| | | | | | | | variables for the remote session (subject to the server accepting them) refactor SendEnv to remove the arbitrary limit of variable names. ok markus@
* switch config file parsing to getline(3) as this avoids static limitsmarkus2018-06-061-5/+5
| | | | noted by gerhard@; ok dtucker@, djm@
* make UID available as a %-expansion everywhere that the username isdjm2018-06-011-1/+5
| | | | | | | available currently. In the client this is via %i, in the server %U (since %i was already used in the client in some places for this, but used for something different in the server); bz#2870, ok dtucker@
* support ProxyJump=none to disable ProxyJump functionality; bz#2869djm2018-05-221-9/+22
| | | | ok dtucker@
* Allow "SendEnv -PATTERN" to clear environment variables previouslydjm2018-04-061-6/+42
| | | | labeled for sendind. bz#1285 ok dtucker@
* add a couple of missed options to the config dump; patch fromdjm2018-04-061-1/+9
| | | | Jakub Jelen via bz2835
* Update default IPQoS in ssh(1), sshd(8) to DSCP AF21 for interactive and CS1 for bulkjob2018-04-041-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | AF21 was selected as this is the highest priority within the low-latency service class (and it is higher than what we have today). SSH is elastic and time-sensitive data, where a user is waiting for a response via the network in order to continue with a task at hand. As such, these flows should be considered foreground traffic, with delays or drops to such traffic directly impacting user-productivity. For bulk SSH traffic, the CS1 "Lower Effort" marker was chosen to enable networks implementing a scavanger/lower-than-best effort class to discriminate scp(1) below normal activities, such as web surfing. In general this type of bulk SSH traffic is a background activity. An advantage of using "AF21" for interactive SSH and "CS1" for bulk SSH is that they are recognisable values on all common platforms (IANA https://www.iana.org/assignments/dscp-registry/dscp-registry.xml), and for AF21 specifically a definition of the intended behavior exists https://tools.ietf.org/html/rfc4594#section-4.7 in addition to the definition of the Assured Forwarding PHB group https://tools.ietf.org/html/rfc2597, and for CS1 (Lower Effort) there is https://tools.ietf.org/html/rfc3662 The first three bits of "AF21" map to the equivalent IEEEE 802.1D PCP, IEEE 802.11e, MPLS EXP/CoS and IP Precedence value of 2 (also known as "Immediate", or "AC_BE"), and CS1's first 3 bits map to IEEEE 802.1D PCP, IEEE 802.11e, MPLS/CoS and IP Precedence value 1 ("Background" or "AC_BK"). OK deraadt@, "no objection" djm@
* Add experimental support for PQC XMSS keys (Extended Hash-Based Signatures)markus2018-02-231-1/+2
| | | | | | | The code is not compiled in by default (see WITH_XMSS in Makefile.inc) Joint work with stefan-lukas_gazdag at genua.eu See https://tools.ietf.org/html/draft-irtf-cfrg-xmss-hash-based-signatures-12 ok djm@
* Add BindInterface ssh_config directive and -B command-line argumentdjm2018-02-231-2/+9
| | | | | | | | | | | to ssh(1) that directs it to bind its outgoing connection to the address of the specified network interface. BindInterface prefers to use addresses that aren't loopback or link- local, but will fall back to those if no other addresses of the required family are available on that interface. Based on patch by Mike Manning in bz#2820, ok dtucker@
* Replace atoi and strtol conversions for integer arguments to configdtucker2017-12-051-11/+5
| | | | | keywords with a checking wrapper around strtonum. This will prevent and flag invalid and negative arguments to these keywords. ok djm@
* Add URI support to ssh, sftp and scp. For example ssh://user@hostmillert2017-10-211-32/+22
| | | | | | | or sftp://user@host/path. The connection parameters described in draft-ietf-secsh-scp-sftp-ssh-uri-04 are not implemented since the ssh fingerprint format in the draft uses md5 with no way to specify the hash function type. OK djm@
* Add 'reverse' dynamic forwarding which combines dynamic forwardingmarkus2017-09-211-18/+24
| | | | | | | | | | | | | | (-D) with remote forwarding (-R) where the remote-forwarded port expects SOCKS-requests. The SSH server code is unchanged and the parsing happens at the SSH clients side. Thus the full SOCKS-request is sent over the forwarded channel and the client parses c->output. Parsing happens in channel_before_prepare_select(), _before_ the select bitmask is computed in the pre[] handlers, but after network input processing in the post[] handlers. help and ok djm@
* Expand ssh_config's StrictModes option with two new settings:djm2017-09-031-4/+15
| | | | | | | | | | | | | | | | | | | | | | | | StrictModes=accept-new will automatically accept hitherto-unseen keys but will refuse connections for changed or invalid hostkeys. StrictModes=off is the same as StrictModes=no Motivation: StrictModes=no combines two behaviours for host key processing: automatically learning new hostkeys and continuing to connect to hosts with invalid/changed hostkeys. The latter behaviour is quite dangerous since it removes most of the protections the SSH protocol is supposed to provide. Quite a few users want to automatically learn hostkeys however, so this makes that feature available with less danger. At some point in the future, StrictModes=no will change to be a synonym for accept-new, with its current behaviour remaining available via StrictModes=off. bz#2400, suggested by Michael Samuel; ok markus
* Add RemoteCommand option to specify a command in the ssh configbluhm2017-05-301-2/+11
| | | | | | | file instead of giving it on the client's command line. This command will be executed on the remote host. The feature allows to automate tasks using ssh config. OK markus@
* there's no reason to artificially limit the key path here, just checkdjm2017-05-201-3/+3
| | | | that it fits PATH_MAX; spotted by Matthew Patton
* remove SSHv1 configuration options and man pages bitsdjm2017-04-301-26/+1
| | | | ok markus@
* remove SSHv1 ciphers; ok markus@djm2017-04-301-23/+2
|
* remove options.protocol and client Protocol configuration knobdjm2017-04-301-46/+11
| | | | ok markus@
* unifdef WITH_SSH1djm2017-04-301-10/+1
| | | | ok markus@
* Add SyslogFacility option to ssh(1) matching the equivalent option indtucker2017-04-281-2/+18
| | | | sshd(8). bz#2705, patch from erahn at arista.com, ok djm@
* better match sshd config parser behaviour: fatal() if line is overlong,djm2017-03-101-2/+4
| | | | | increase line buffer to match sshd's; bz#2651 reported by Don Fong; ok dtucker@
* Plug mem leak on GLOB_NOMATCH case. From jjelen at redhat.com viadtucker2017-03-101-1/+2
| | | | bz#2687, ok djm@
* support =- for removing methods from algorithms lists, e.g.djm2017-02-031-5/+7
| | | | | Ciphers=-*cbc; suggested by Cristian Ionescu-Idbohrn in bz#2671 "I like it" markus@
* allow form-feed characters at EOL; bz#2431 ok dtucker@djm2017-02-031-3/+3
|
* small cleanup post SSHv1 removal:djm2017-01-301-29/+47
| | | | | | | | | | remove SSHv1-isms in commented examples reorder token table to group deprecated and compile-time conditional tokens better fix config dumping code for some compile-time conditional options that weren't being correctly skipped (SSHv1 and PKCS#11)
* some explicit NULL tests when dumping configured forwardings;djm2017-01-301-3/+3
| | | | from Karsten Weiss
* fix previousdjm2017-01-061-2/+2
|
* show a useful error message when included config files can't bedjm2017-01-061-1/+6
| | | | opened; bz#2653, ok dtucker@
* Fix logic in add_local_forward() that inverted a test when code wasjsg2016-10-251-2/+2
| | | | | | | refactored out into bind_permitted(). This broke ssh port forwarding for non-priv ports as a non root user. ok dtucker@ 'looks good' deraadt@
* Factor out "can bind to low ports" check into its own function. This will makedtucker2016-10-231-2/+2
| | | | | it easier for Portable to support platforms with permissions models other than uid==0 (eg bz#2625). ok djm@, "doesn't offend me too much" deraadt@.
* remove superfluous NOTREACHED commentdjm2016-08-251-2/+1
|
* reverse the order in which -J/JumpHost proxies are visited to bedjm2016-07-221-9/+16
| | | | | | more intuitive and document reported by and manpage bits naddy@
* Do not clobber the global jump_host variables when parsing an inactivenaddy2016-07-201-12/+15
| | | | configuration. ok djm@
* Add a ProxyJump ssh_config(5) option and corresponding -J ssh(1)djm2016-07-151-6/+89
| | | | | | | | | | | | | | command-line flag to allow simplified indirection through a SSH bastion or "jump host". These options construct a proxy command that connects to the specified jump host(s) (more than one may be specified) and uses port-forwarding to establish a connection to the next destination. This codifies the safest way of indirecting connections through SSH servers and makes it easy to use. ok markus@
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.