RepoMirrors/openssh
1
0
Fork 0
mirror of git://anongit.mindrot.org/openssh.git synced 2024-12-27 20:42:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

- djm@cvs.openbsd.org 2010/06/25 23:10:30

Browse Source 
[ssh.c]
     log the hostname and address that we connected to at LogLevel=verbose
     after authentication is successful to mitigate "phishing" attacks by
     servers with trusted keys that accept authentication silently and
     automatically before presenting fake password/passphrase prompts;
     "nice!" markus@
This commit is contained in:
Damien Miller 2010-06-26 10:02:03 +10:00
parent bda3ecafca
commit 383ffe6c5f
2 changed files with 15 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
ChangeLog
View File

@ -67,6 +67,13 @@
[auth1.c auth2-none.c] [auth1.c auth2-none.c]
skip the initial check for access with an empty password when skip the initial check for access with an empty password when
PermitEmptyPasswords=no; bz#1638; ok markus@ PermitEmptyPasswords=no; bz#1638; ok markus@
- djm@cvs.openbsd.org 2010/06/25 23:10:30
[ssh.c]
log the hostname and address that we connected to at LogLevel=verbose
after authentication is successful to mitigate "phishing" attacks by
servers with trusted keys that accept authentication silently and
automatically before presenting fake password/passphrase prompts;
"nice!" markus@
20100622 20100622
- (djm) [loginrec.c] crank LINFO_NAMESIZE (username length) to 512 - (djm) [loginrec.c] crank LINFO_NAMESIZE (username length) to 512

9
ssh.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: ssh.c,v 1.338 2010/05/16 12:55:51 markus Exp $ */ /* $OpenBSD: ssh.c,v 1.339 2010/06/25 23:10:30 djm Exp $ */
/* /*
* Author: Tatu Ylonen <ylo@cs.hut.fi> * Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@ -829,6 +829,13 @@ main(int ac, char **av)
ssh_login(&sensitive_data, host, (struct sockaddr *)&hostaddr, ssh_login(&sensitive_data, host, (struct sockaddr *)&hostaddr,
pw, timeout_ms); pw, timeout_ms);
if (packet_connection_is_on_socket()) {
verbose("Authenticated to %s ([%s]:%d).", host,
get_remote_ipaddr(), get_remote_port());
} else {
verbose("Authenticated to %s (via proxy).", host);
}
/* We no longer need the private host keys. Clear them now. */ /* We no longer need the private host keys. Clear them now. */
if (sensitive_data.nkeys != 0) { if (sensitive_data.nkeys != 0) {
for (i = 0; i < sensitive_data.nkeys; i++) { for (i = 0; i < sensitive_data.nkeys; i++) {