mirror of git://anongit.mindrot.org/openssh.git
upstream: Add sshd_config CASignatureAlgorithms option to allow
control over which signature algorithms a CA may use when signing certificates. In particular, this allows a sshd to ban certificates signed with RSA/SHA1. ok markus@ OpenBSD-Commit-ID: b05c86ef8b52b913ed48d54a9b9c1a7714d96bac
This commit is contained in:
djm@openbsd.org
Damien Miller
parent
f80e68ea7d
commit
86e5737c39
|
|
@ -1,4 +1,4 @@
|
|||
/* $OpenBSD: auth2-hostbased.c,v 1.37 2018/08/28 12:17:45 mestre Exp $ */
|
||||
/* $OpenBSD: auth2-hostbased.c,v 1.38 2018/09/20 03:28:06 djm Exp $ */
|
||||
/*
|
||||
* Copyright (c) 2000 Markus Friedl. All rights reserved.
|
||||
*
|
||||
|
|
@ -112,6 +112,13 @@ userauth_hostbased(struct ssh *ssh)
|
|||
__func__, sshkey_type(key));
|
||||
goto done;
|
||||
}
|
||||
if ((r = sshkey_check_cert_sigtype(key,
|
||||
options.ca_sign_algorithms)) != 0) {
|
||||
logit("%s: certificate signature algorithm %s: %s", __func__,
|
||||
(key->cert == NULL || key->cert->signature_type == NULL) ?
|
||||
"(null)" : key->cert->signature_type, ssh_err(r));
|
||||
goto done;
|
||||
}
|
||||
|
||||
if (!authctxt->valid || authctxt->user == NULL) {
|
||||
debug2("%s: disabled because of invalid user", __func__);
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
/* $OpenBSD: auth2-pubkey.c,v 1.85 2018/08/28 12:25:53 mestre Exp $ */
|
||||
/* $OpenBSD: auth2-pubkey.c,v 1.86 2018/09/20 03:28:06 djm Exp $ */
|
||||
/*
|
||||
* Copyright (c) 2000 Markus Friedl. All rights reserved.
|
||||
*
|
||||
|
|
@ -137,7 +137,13 @@ userauth_pubkey(struct ssh *ssh)
|
|||
__func__, sshkey_ssh_name(key));
|
||||
goto done;
|
||||
}
|
||||
|
||||
if ((r = sshkey_check_cert_sigtype(key,
|
||||
options.ca_sign_algorithms)) != 0) {
|
||||
logit("%s: certificate signature algorithm %s: %s", __func__,
|
||||
(key->cert == NULL || key->cert->signature_type == NULL) ?
|
||||
"(null)" : key->cert->signature_type, ssh_err(r));
|
||||
goto done;
|
||||
}
|
||||
key_s = format_key(key);
|
||||
if (sshkey_is_cert(key))
|
||||
ca_s = format_key(key->cert->signature_key);
|
||||
|
|
|
|||
16
servconf.c
16
servconf.c
|
|
@ -1,5 +1,5 @@
|
|||
|
||||
/* $OpenBSD: servconf.c,v 1.340 2018/08/12 20:19:13 djm Exp $ */
|
||||
/* $OpenBSD: servconf.c,v 1.341 2018/09/20 03:28:06 djm Exp $ */
|
||||
/*
|
||||
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
|
||||
* All rights reserved
|
||||
|
|
@ -145,6 +145,7 @@ initialize_server_options(ServerOptions *options)
|
|||
options->ciphers = NULL;
|
||||
options->macs = NULL;
|
||||
options->kex_algorithms = NULL;
|
||||
options->ca_sign_algorithms = NULL;
|
||||
options->fwd_opts.gateway_ports = -1;
|
||||
options->fwd_opts.streamlocal_bind_mask = (mode_t)-1;
|
||||
options->fwd_opts.streamlocal_bind_unlink = -1;
|
||||
|
|
@ -191,13 +192,14 @@ option_clear_or_none(const char *o)
|
|||
static void
|
||||
assemble_algorithms(ServerOptions *o)
|
||||
{
|
||||
char *all_cipher, *all_mac, *all_kex, *all_key;
|
||||
char *all_cipher, *all_mac, *all_kex, *all_key, *all_sig;
|
||||
int r;
|
||||
|
||||
all_cipher = cipher_alg_list(',', 0);
|
||||
all_mac = mac_alg_list(',');
|
||||
all_kex = kex_alg_list(',');
|
||||
all_key = sshkey_alg_list(0, 0, 1, ',');
|
||||
all_sig = sshkey_alg_list(0, 1, 1, ',');
|
||||
#define ASSEMBLE(what, defaults, all) \
|
||||
do { \
|
||||
if ((r = kex_assemble_names(&o->what, defaults, all)) != 0) \
|
||||
|
|
@ -209,11 +211,13 @@ assemble_algorithms(ServerOptions *o)
|
|||
ASSEMBLE(hostkeyalgorithms, KEX_DEFAULT_PK_ALG, all_key);
|
||||
ASSEMBLE(hostbased_key_types, KEX_DEFAULT_PK_ALG, all_key);
|
||||
ASSEMBLE(pubkey_key_types, KEX_DEFAULT_PK_ALG, all_key);
|
||||
ASSEMBLE(ca_sign_algorithms, SSH_ALLOWED_CA_SIGALGS, all_sig);
|
||||
#undef ASSEMBLE
|
||||
free(all_cipher);
|
||||
free(all_mac);
|
||||
free(all_kex);
|
||||
free(all_key);
|
||||
free(all_sig);
|
||||
}
|
||||
|
||||
static void
|
||||
|
|
@ -487,7 +491,7 @@ typedef enum {
|
|||
sHostCertificate,
|
||||
sRevokedKeys, sTrustedUserCAKeys, sAuthorizedPrincipalsFile,
|
||||
sAuthorizedPrincipalsCommand, sAuthorizedPrincipalsCommandUser,
|
||||
sKexAlgorithms, sIPQoS, sVersionAddendum,
|
||||
sKexAlgorithms, sCASignatureAlgorithms, sIPQoS, sVersionAddendum,
|
||||
sAuthorizedKeysCommand, sAuthorizedKeysCommandUser,
|
||||
sAuthenticationMethods, sHostKeyAgent, sPermitUserRC,
|
||||
sStreamLocalBindMask, sStreamLocalBindUnlink,
|
||||
|
|
@ -1431,6 +1435,10 @@ process_server_config_line(ServerOptions *options, char *line,
|
|||
charptr = &options->hostkeyalgorithms;
|
||||
goto parse_keytypes;
|
||||
|
||||
case sCASignatureAlgorithms:
|
||||
charptr = &options->ca_sign_algorithms;
|
||||
goto parse_keytypes;
|
||||
|
||||
case sPubkeyAuthentication:
|
||||
intptr = &options->pubkey_authentication;
|
||||
goto parse_flag;
|
||||
|
|
@ -2601,6 +2609,8 @@ dump_config(ServerOptions *o)
|
|||
dump_cfg_string(sHostKeyAgent, o->host_key_agent);
|
||||
dump_cfg_string(sKexAlgorithms,
|
||||
o->kex_algorithms ? o->kex_algorithms : KEX_SERVER_KEX);
|
||||
dump_cfg_string(sCASignatureAlgorithms, o->ca_sign_algorithms ?
|
||||
o->ca_sign_algorithms : SSH_ALLOWED_CA_SIGALGS);
|
||||
dump_cfg_string(sHostbasedAcceptedKeyTypes, o->hostbased_key_types ?
|
||||
o->hostbased_key_types : KEX_DEFAULT_PK_ALG);
|
||||
dump_cfg_string(sHostKeyAlgorithms, o->hostkeyalgorithms ?
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
/* $OpenBSD: servconf.h,v 1.136 2018/07/09 21:26:02 markus Exp $ */
|
||||
/* $OpenBSD: servconf.h,v 1.137 2018/09/20 03:28:06 djm Exp $ */
|
||||
|
||||
/*
|
||||
* Author: Tatu Ylonen <ylo@cs.hut.fi>
|
||||
|
|
@ -110,6 +110,7 @@ typedef struct {
|
|||
int hostbased_uses_name_from_packet_only; /* experimental */
|
||||
char *hostbased_key_types; /* Key types allowed for hostbased */
|
||||
char *hostkeyalgorithms; /* SSH2 server key types */
|
||||
char *ca_sign_algorithms; /* Allowed CA signature algorithms */
|
||||
int pubkey_authentication; /* If true, permit ssh2 pubkey authentication. */
|
||||
char *pubkey_key_types; /* Key types allowed for public key */
|
||||
int kerberos_authentication; /* If true, permit Kerberos
|
||||
|
|
@ -242,6 +243,7 @@ struct connection_info {
|
|||
M_CP_STROPT(authorized_principals_command_user); \
|
||||
M_CP_STROPT(hostbased_key_types); \
|
||||
M_CP_STROPT(pubkey_key_types); \
|
||||
M_CP_STROPT(ca_sign_algorithms); \
|
||||
M_CP_STROPT(routing_domain); \
|
||||
M_CP_STROPT(permit_user_env_whitelist); \
|
||||
M_CP_STRARRAYOPT(authorized_keys_files, num_authkeys_files); \
|
||||
|
|
|
|||
|
|
@ -33,8 +33,8 @@
|
|||
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
||||
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
.\"
|
||||
.\" $OpenBSD: sshd_config.5,v 1.281 2018/07/20 05:01:10 djm Exp $
|
||||
.Dd $Mdocdate: July 20 2018 $
|
||||
.\" $OpenBSD: sshd_config.5,v 1.282 2018/09/20 03:28:06 djm Exp $
|
||||
.Dd $Mdocdate: September 20 2018 $
|
||||
.Dt SSHD_CONFIG 5
|
||||
.Os
|
||||
.Sh NAME
|
||||
|
|
@ -382,6 +382,17 @@ If the argument is
|
|||
.Cm none
|
||||
then no banner is displayed.
|
||||
By default, no banner is displayed.
|
||||
.It Cm CASignatureAlgorithms
|
||||
Specifies which algorithms are allowed for signing of certificates
|
||||
by certificate authorities (CAs).
|
||||
The default is:
|
||||
.Bd -literal -offset indent
|
||||
ecdsa-sha2-nistp256.ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
|
||||
ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
|
||||
.Ed
|
||||
.Pp
|
||||
Certificates signed using other algorithms will not be accepted for
|
||||
public key or host-based authentication.
|
||||
.It Cm ChallengeResponseAuthentication
|
||||
Specifies whether challenge-response authentication is allowed (e.g. via
|
||||
PAM or through authentication styles supported in
|
||||
|
|
|
|||
Loading…
Reference in New Issue