Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
SUSE:SLE-12-SP4:Update
openssh-testuser.26950
openssh-7.2p2-tcpwrappers.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File openssh-7.2p2-tcpwrappers.patch of Package openssh-testuser.26950
From 734365c2441255fb409cc2542262de39dda68e17 Mon Sep 17 00:00:00 2001 From: Old openssh patches <pcerny@suse.com> Date: Wed, 26 Oct 2022 09:59:03 +0200 Subject: [PATCH] openssh-7.2p2-tcpwrappers # HG changeset patch # Parent 327e611bd491d65826fb6de435250c037ed7e307 Forward port TCP wrappers support (libwrap) from OpenSSH 6.6p1. Make it run-time switchable through the new UseTCPWrappers option for sshd. --- configure.ac | 57 +++++++++++++++++++++++++++++++++++++++++++++++++++ servconf.c | 11 ++++++++++ servconf.h | 1 + sshd.8 | 7 +++++++ sshd.c | 28 +++++++++++++++++++++++++ sshd_config | 1 + sshd_config.0 | 11 ++++++++++ sshd_config.5 | 16 +++++++++++++++ 8 files changed, 132 insertions(+) diff --git a/configure.ac b/configure.ac index 2c79bae6..c0d5c820 100644 --- a/configure.ac +++ b/configure.ac @@ -1506,6 +1506,62 @@ AC_ARG_WITH([skey], ] ) +# Check whether user wants TCP wrappers support +TCPW_MSG="no" +AC_ARG_WITH([tcp-wrappers], + [ --with-tcp-wrappers[[=PATH]] Enable tcpwrappers support (optionally in PATH)], + [ + if test "x$withval" != "xno" ; then + saved_LIBS="$LIBS" + saved_LDFLAGS="$LDFLAGS" + saved_CPPFLAGS="$CPPFLAGS" + if test -n "${withval}" && \ + test "x${withval}" != "xyes"; then + if test -d "${withval}/lib"; then + if test -n "${need_dash_r}"; then + LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}" + else + LDFLAGS="-L${withval}/lib ${LDFLAGS}" + fi + else + if test -n "${need_dash_r}"; then + LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}" + else + LDFLAGS="-L${withval} ${LDFLAGS}" + fi + fi + if test -d "${withval}/include"; then + CPPFLAGS="-I${withval}/include ${CPPFLAGS}" + else + CPPFLAGS="-I${withval} ${CPPFLAGS}" + fi + fi + LIBS="-lwrap $LIBS" + AC_MSG_CHECKING([for libwrap]) + AC_LINK_IFELSE([AC_LANG_PROGRAM([[ +#include <sys/types.h> +#include <sys/socket.h> +#include <netinet/in.h> +#include <tcpd.h> +int deny_severity = 0, allow_severity = 0; + ]], [[ + hosts_access(0); + ]])], [ + AC_MSG_RESULT([yes]) + AC_DEFINE([LIBWRAP], [1], + [Define if you want + TCP Wrappers support]) + SSHDLIBS="$SSHDLIBS -lwrap" + TCPW_MSG="yes" + ], [ + AC_MSG_ERROR([*** libwrap missing]) + + ]) + LIBS="$saved_LIBS" + fi + ] +) + # Check whether user wants to use ldns LDNS_MSG="no" AC_ARG_WITH(ldns, @@ -5164,6 +5220,7 @@ echo " KerberosV support: $KRB5_MSG" echo " SELinux support: $SELINUX_MSG" echo " Smartcard support: $SCARD_MSG" echo " S/KEY support: $SKEY_MSG" +echo " TCP Wrappers support: $TCPW_MSG" echo " MD5 password support: $MD5_MSG" echo " libedit support: $LIBEDIT_MSG" echo " Solaris process contract support: $SPC_MSG" diff --git a/servconf.c b/servconf.c index 8fe7a10d..e70ba44a 100644 --- a/servconf.c +++ b/servconf.c @@ -178,6 +178,7 @@ initialize_server_options(ServerOptions *options) options->ip_qos_bulk = -1; options->version_addendum = NULL; options->fingerprint_hash = -1; + options->use_tcpwrappers = -1; } /* Returns 1 if a string option is unset or set to "none" or 0 otherwise. */ @@ -397,6 +398,9 @@ fill_default_server_options(ServerOptions *options) options->fingerprint_hash = SSH_FP_HASH_DEFAULT; options->fingerprint_hash = fips_correct_dgst(options->fingerprint_hash); + if (options->use_tcpwrappers == -1) { + options->use_tcpwrappers = 0; + } assemble_algorithms(options); @@ -476,6 +480,7 @@ typedef enum { sAuthenticationMethods, sHostKeyAgent, sPermitUserRC, sStreamLocalBindMask, sStreamLocalBindUnlink, sAllowStreamLocalForwarding, sFingerprintHash, + sUseTCPWrappers, sDeprecated, sUnsupported } ServerOpCodes; @@ -627,6 +632,7 @@ static struct { { "streamlocalbindunlink", sStreamLocalBindUnlink, SSHCFG_ALL }, { "allowstreamlocalforwarding", sAllowStreamLocalForwarding, SSHCFG_ALL }, { "fingerprinthash", sFingerprintHash, SSHCFG_GLOBAL }, + { "usetcpwrappers", sUseTCPWrappers, SSHCFG_GLOBAL }, { NULL, sBadOption, 0 } }; @@ -1250,6 +1256,10 @@ process_server_config_line(ServerOptions *options, char *line, intptr = &options->hostbased_uses_name_from_packet_only; goto parse_flag; + case sUseTCPWrappers: + intptr = &options->use_tcpwrappers; + goto parse_flag; + case sHostbasedAcceptedKeyTypes: charptr = &options->hostbased_key_types; parse_keytypes: @@ -2405,6 +2415,7 @@ dump_config(ServerOptions *o) dump_cfg_fmtint(sAllowStreamLocalForwarding, o->allow_streamlocal_forwarding); dump_cfg_fmtint(sUsePrivilegeSeparation, use_privsep); dump_cfg_fmtint(sFingerprintHash, o->fingerprint_hash); + dump_cfg_fmtint(sUseTCPWrappers, o->use_tcpwrappers); /* string arguments */ dump_cfg_string(sPidFile, o->pid_file); diff --git a/servconf.h b/servconf.h index c19858c5..c0f5de23 100644 --- a/servconf.h +++ b/servconf.h @@ -201,6 +201,7 @@ typedef struct { char *auth_methods[MAX_AUTH_METHODS]; int fingerprint_hash; + int use_tcpwrappers; } ServerOptions; /* Information about the incoming connection as used by Match */ diff --git a/sshd.8 b/sshd.8 index dce962e9..79af2aae 100644 --- a/sshd.8 +++ b/sshd.8 @@ -880,6 +880,12 @@ the user's home directory becomes accessible. This file should be writable only by the user, and need not be readable by anyone else. .Pp +.It Pa /etc/hosts.allow +.It Pa /etc/hosts.deny +Access controls that should be enforced by tcp-wrappers are defined here. +Further details are described in +.Xr hosts_access 5 . +.Pp .It Pa /etc/hosts.equiv This file is for host-based authentication (see .Xr ssh 1 ) . @@ -1003,6 +1009,7 @@ be blocked until enough entropy is available. .Xr ssh-keygen 1 , .Xr ssh-keyscan 1 , .Xr chroot 2 , +.Xr hosts_access 5 , .Xr login.defs 5 , .Xr moduli 5 , .Xr sshd_config 5 , diff --git a/sshd.c b/sshd.c index cb96491a..ac2a98d3 100644 --- a/sshd.c +++ b/sshd.c @@ -137,6 +137,13 @@ #include <Security/AuthSession.h> #endif +#ifdef LIBWRAP +#include <tcpd.h> +#include <syslog.h> +int allow_severity; +int deny_severity; +#endif /* LIBWRAP */ + #ifndef O_NOCTTY #define O_NOCTTY 0 #endif @@ -2303,6 +2310,27 @@ main(int ac, char **av) audit_connection_from(remote_ip, remote_port); #endif +#ifdef LIBWRAP + if (options.use_tcpwrappers) { + allow_severity = options.log_facility|LOG_INFO; + deny_severity = options.log_facility|LOG_WARNING; + /* Check whether logins are denied from this host. */ + if (packet_connection_is_on_socket()) { + struct request_info req; + + request_init(&req, RQ_DAEMON, __progname, RQ_FILE, sock_in, 0); + fromhost(&req); + + if (!hosts_access(&req)) { + debug("Connection refused by tcp wrapper"); + refuse(&req); + /* NOTREACHED */ + fatal("libwrap refuse returns"); + } + } + } +#endif /* LIBWRAP */ + /* Log the connection. */ laddr = get_local_ipaddr(sock_in); verbose("Connection from %s port %d on %s port %d", diff --git a/sshd_config b/sshd_config index 97709a3a..6230748c 100644 --- a/sshd_config +++ b/sshd_config @@ -125,6 +125,7 @@ X11Forwarding yes #PermitTunnel no #ChrootDirectory none #VersionAddendum none +#UseTCPWrappers yes # no default banner path #Banner none diff --git a/sshd_config.0 b/sshd_config.0 index e7c97e8b..1b1c8741 100644 --- a/sshd_config.0 +++ b/sshd_config.0 @@ -1013,6 +1013,17 @@ DESCRIPTION authentication unprivileged process is subject to additional restrictions. The default is M-bM-^@M-^\sandboxM-bM-^@M-^]. + UseTCPWrappers + When set to "yes" , TCP wrappers (libwrap) are used to determine + whether a connection from a remote system should be allowed as + specified in hosts_accept(5). The default is "yes". + + Warning: This functionality has been backported for backward + compatibility and should be avoided, since libwrap pulls in a + whole load of security issues. Moving to sshd's internal host + matching is highly recommended - see the Match keyword for + details. + VersionAddendum Optionally specifies additional text to append to the SSH protocol banner sent by the server upon connection. The default diff --git a/sshd_config.5 b/sshd_config.5 index 5a75f55b..5d4c1339 100644 --- a/sshd_config.5 +++ b/sshd_config.5 @@ -1662,6 +1662,22 @@ then the pre-authentication unprivileged process is subject to additional restrictions. The default is .Dq sandbox . +.It Cm UseTCPWrappers +When set to +.Dq yes +, TCP wrappers (libwrap) are used to determine whether a connection from a +remote system should be allowed as specified in +.Xr hosts_accept 5 . +The default is +.Dq no . + +.Em Warning: This functionality has been backported for backward \ +compatibility and should be avoided, since libwrap pulls in a whole load of \ +security issues. +Moving to sshd's internal host matching is highly +recommended - see the +.Cm Match +keyword for details. .It Cm VersionAddendum Optionally specifies additional text to append to the SSH protocol banner sent by the server upon connection. -- 2.38.0
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor
