RepoMirrors/openssh
1
0
Fork 0
mirror of git://anongit.mindrot.org/openssh.git synced 2025-02-16 13:56:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

Class-imposed login restrictions

Browse Source 
If the following functions are available,
add an additional check if users are allowed to login imposed by login class.

* auth_hostok(3)
* auth_timeok(3)

These functions are implemented on FreeBSD.
This commit is contained in:
Yuichiro Naito 2021-09-01 10:19:32 +09:00 committed by Damien Miller
parent 7717b9e915
commit c276672fc0
No known key found for this signature in database
2 changed files with 20 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
auth.c
View File

@ -463,6 +463,9 @@ getpwnamallow(struct ssh *ssh, const char *user)
{
#ifdef HAVE_LOGIN_CAP
extern login_cap_t *lc;
#ifdef HAVE_AUTH_HOSTOK
const char *from_host, *from_ip;
#endif
#ifdef BSD_AUTH
auth_session_t *as;
#endif
@ -508,6 +511,21 @@ getpwnamallow(struct ssh *ssh, const char *user)
debug("unable to get login class: %s", user);
return (NULL);
}
#ifdef HAVE_AUTH_HOSTOK
from_host = auth_get_canonical_hostname(ssh, options.use_dns);
from_ip = ssh_remote_ipaddr(ssh);
if (!auth_hostok(lc, from_host, from_ip)) {
debug("Denied connection for %.200s from %.200s [%.200s].",
pw->pw_name, from_host, from_ip);
return (NULL);
}
#endif /* HAVE_AUTH_HOSTOK */
#ifdef HAVE_AUTH_TIMEOK
if (!auth_timeok(lc, time(NULL))) {
debug("LOGIN %.200s REFUSED (TIME)", pw->pw_name);
return (NULL);
}
#endif /* HAVE_AUTH_TIMEOK */
#ifdef BSD_AUTH
if ((as = auth_open()) == NULL || auth_setpwd(as, pw) != 0 ||
auth_approval(as, lc, pw->pw_name, "ssh") <= 0) {

2
configure.ac
View File

@ -1886,6 +1886,8 @@ AC_SUBST([PICFLAG])
dnl Checks for library functions. Please keep in alphabetical order
AC_CHECK_FUNCS([ \
auth_hostok \
auth_timeok \
Blowfish_initstate \
Blowfish_expandstate \
Blowfish_expand0state \