mirror of
git://anongit.mindrot.org/openssh.git
synced 2024-12-16 15:14:35 +00:00
4515047e47
[sshd.c servconf.h servconf.c sshd_config.5 auth.c]
Add support for conditional directives to sshd_config via a "Match"
keyword, which works similarly to the "Host" directive in ssh_config.
Lines after a Match line override the default set in the main section
if the condition on the Match line is true, eg
AllowTcpForwarding yes
Match User anoncvs
AllowTcpForwarding no
will allow port forwarding by all users except "anoncvs".
Currently only a very small subset of directives are supported.
ok djm@
155 lines
6.1 KiB
C
155 lines
6.1 KiB
C
/* $OpenBSD: servconf.h,v 1.75 2006/07/12 11:34:58 dtucker Exp $ */
|
|
|
|
/*
|
|
* Author: Tatu Ylonen <ylo@cs.hut.fi>
|
|
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
|
|
* All rights reserved
|
|
* Definitions for server configuration data and for the functions reading it.
|
|
*
|
|
* As far as I am concerned, the code I have written for this software
|
|
* can be used freely for any purpose. Any derived versions of this
|
|
* software must be clearly marked as such, and if the derived work is
|
|
* incompatible with the protocol description in the RFC file, it must be
|
|
* called by a name other than "ssh" or "Secure Shell".
|
|
*/
|
|
|
|
#ifndef SERVCONF_H
|
|
#define SERVCONF_H
|
|
|
|
#include "buffer.h"
|
|
|
|
#define MAX_PORTS 256 /* Max # ports. */
|
|
|
|
#define MAX_ALLOW_USERS 256 /* Max # users on allow list. */
|
|
#define MAX_DENY_USERS 256 /* Max # users on deny list. */
|
|
#define MAX_ALLOW_GROUPS 256 /* Max # groups on allow list. */
|
|
#define MAX_DENY_GROUPS 256 /* Max # groups on deny list. */
|
|
#define MAX_SUBSYSTEMS 256 /* Max # subsystems. */
|
|
#define MAX_HOSTKEYS 256 /* Max # hostkeys. */
|
|
#define MAX_ACCEPT_ENV 256 /* Max # of env vars. */
|
|
|
|
/* permit_root_login */
|
|
#define PERMIT_NOT_SET -1
|
|
#define PERMIT_NO 0
|
|
#define PERMIT_FORCED_ONLY 1
|
|
#define PERMIT_NO_PASSWD 2
|
|
#define PERMIT_YES 3
|
|
|
|
#define DEFAULT_AUTH_FAIL_MAX 6 /* Default for MaxAuthTries */
|
|
|
|
typedef struct {
|
|
u_int num_ports;
|
|
u_int ports_from_cmdline;
|
|
u_short ports[MAX_PORTS]; /* Port number to listen on. */
|
|
char *listen_addr; /* Address on which the server listens. */
|
|
struct addrinfo *listen_addrs; /* Addresses on which the server listens. */
|
|
int address_family; /* Address family used by the server. */
|
|
char *host_key_files[MAX_HOSTKEYS]; /* Files containing host keys. */
|
|
int num_host_key_files; /* Number of files for host keys. */
|
|
char *pid_file; /* Where to put our pid */
|
|
int server_key_bits;/* Size of the server key. */
|
|
int login_grace_time; /* Disconnect if no auth in this time
|
|
* (sec). */
|
|
int key_regeneration_time; /* Server key lifetime (seconds). */
|
|
int permit_root_login; /* PERMIT_*, see above */
|
|
int ignore_rhosts; /* Ignore .rhosts and .shosts. */
|
|
int ignore_user_known_hosts; /* Ignore ~/.ssh/known_hosts
|
|
* for RhostsRsaAuth */
|
|
int print_motd; /* If true, print /etc/motd. */
|
|
int print_lastlog; /* If true, print lastlog */
|
|
int x11_forwarding; /* If true, permit inet (spoofing) X11 fwd. */
|
|
int x11_display_offset; /* What DISPLAY number to start
|
|
* searching at */
|
|
int x11_use_localhost; /* If true, use localhost for fake X11 server. */
|
|
char *xauth_location; /* Location of xauth program */
|
|
int strict_modes; /* If true, require string home dir modes. */
|
|
int tcp_keep_alive; /* If true, set SO_KEEPALIVE. */
|
|
char *ciphers; /* Supported SSH2 ciphers. */
|
|
char *macs; /* Supported SSH2 macs. */
|
|
int protocol; /* Supported protocol versions. */
|
|
int gateway_ports; /* If true, allow remote connects to forwarded ports. */
|
|
SyslogFacility log_facility; /* Facility for system logging. */
|
|
LogLevel log_level; /* Level for system logging. */
|
|
int rhosts_rsa_authentication; /* If true, permit rhosts RSA
|
|
* authentication. */
|
|
int hostbased_authentication; /* If true, permit ssh2 hostbased auth */
|
|
int hostbased_uses_name_from_packet_only; /* experimental */
|
|
int rsa_authentication; /* If true, permit RSA authentication. */
|
|
int pubkey_authentication; /* If true, permit ssh2 pubkey authentication. */
|
|
int kerberos_authentication; /* If true, permit Kerberos
|
|
* authentication. */
|
|
int kerberos_or_local_passwd; /* If true, permit kerberos
|
|
* and any other password
|
|
* authentication mechanism,
|
|
* such as SecurID or
|
|
* /etc/passwd */
|
|
int kerberos_ticket_cleanup; /* If true, destroy ticket
|
|
* file on logout. */
|
|
int kerberos_get_afs_token; /* If true, try to get AFS token if
|
|
* authenticated with Kerberos. */
|
|
int gss_authentication; /* If true, permit GSSAPI authentication */
|
|
int gss_cleanup_creds; /* If true, destroy cred cache on logout */
|
|
int password_authentication; /* If true, permit password
|
|
* authentication. */
|
|
int kbd_interactive_authentication; /* If true, permit */
|
|
int challenge_response_authentication;
|
|
int permit_empty_passwd; /* If false, do not permit empty
|
|
* passwords. */
|
|
int permit_user_env; /* If true, read ~/.ssh/environment */
|
|
int use_login; /* If true, login(1) is used */
|
|
int compression; /* If true, compression is allowed */
|
|
int allow_tcp_forwarding;
|
|
u_int num_allow_users;
|
|
char *allow_users[MAX_ALLOW_USERS];
|
|
u_int num_deny_users;
|
|
char *deny_users[MAX_DENY_USERS];
|
|
u_int num_allow_groups;
|
|
char *allow_groups[MAX_ALLOW_GROUPS];
|
|
u_int num_deny_groups;
|
|
char *deny_groups[MAX_DENY_GROUPS];
|
|
|
|
u_int num_subsystems;
|
|
char *subsystem_name[MAX_SUBSYSTEMS];
|
|
char *subsystem_command[MAX_SUBSYSTEMS];
|
|
char *subsystem_args[MAX_SUBSYSTEMS];
|
|
|
|
u_int num_accept_env;
|
|
char *accept_env[MAX_ACCEPT_ENV];
|
|
|
|
int max_startups_begin;
|
|
int max_startups_rate;
|
|
int max_startups;
|
|
int max_authtries;
|
|
char *banner; /* SSH-2 banner message */
|
|
int use_dns;
|
|
int client_alive_interval; /*
|
|
* poke the client this often to
|
|
* see if it's still there
|
|
*/
|
|
int client_alive_count_max; /*
|
|
* If the client is unresponsive
|
|
* for this many intervals above,
|
|
* disconnect the session
|
|
*/
|
|
|
|
char *authorized_keys_file; /* File containing public keys */
|
|
char *authorized_keys_file2;
|
|
|
|
int use_pam; /* Enable auth via PAM */
|
|
|
|
int permit_tun;
|
|
} ServerOptions;
|
|
|
|
void initialize_server_options(ServerOptions *);
|
|
void fill_default_server_options(ServerOptions *);
|
|
int process_server_config_line(ServerOptions *, char *, const char *, int,
|
|
int *, const char *, const char *, const char *);
|
|
void load_server_config(const char *, Buffer *);
|
|
void parse_server_config(ServerOptions *, const char *, Buffer *,
|
|
const char *, const char *, const char *);
|
|
void parse_server_match_config(ServerOptions *, const char *, const char *,
|
|
const char *);
|
|
void copy_set_server_options(ServerOptions *, ServerOptions *);
|
|
|
|
#endif /* SERVCONF_H */
|