1 /* $OpenBSD: servconf.c,v 1.186 2008/07/04 03:44:59 djm Exp $ */
3 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
6 * As far as I am concerned, the code I have written for this software
7 * can be used freely for any purpose. Any derived versions of this
8 * software must be clearly marked as such, and if the derived work is
9 * incompatible with the protocol description in the RFC file, it must be
10 * called by a name other than "ssh" or "Secure Shell".
15 #include <sys/types.h>
16 #include <sys/socket.h>
28 #include "openbsd-compat/sys-queue.h"
35 #include "pathnames.h"
43 #include "groupaccess.h"
45 static void add_listen_addr(ServerOptions
*, char *, u_short
);
46 static void add_one_listen_addr(ServerOptions
*, char *, u_short
);
48 /* Use of privilege separation or not */
49 extern int use_privsep
;
52 /* Initializes the server options to their default values. */
55 initialize_server_options(ServerOptions
*options
)
57 memset(options
, 0, sizeof(*options
));
59 /* Portable-specific options */
60 options
->use_pam
= -1;
62 /* Standard Options */
63 options
->num_ports
= 0;
64 options
->ports_from_cmdline
= 0;
65 options
->listen_addrs
= NULL
;
66 options
->address_family
= -1;
67 options
->num_host_key_files
= 0;
68 options
->pid_file
= NULL
;
69 options
->server_key_bits
= -1;
70 options
->login_grace_time
= -1;
71 options
->key_regeneration_time
= -1;
72 options
->permit_root_login
= PERMIT_NOT_SET
;
73 options
->ignore_rhosts
= -1;
74 options
->ignore_user_known_hosts
= -1;
75 options
->print_motd
= -1;
76 options
->print_lastlog
= -1;
77 options
->x11_forwarding
= -1;
78 options
->x11_display_offset
= -1;
79 options
->x11_use_localhost
= -1;
80 options
->xauth_location
= NULL
;
81 options
->strict_modes
= -1;
82 options
->tcp_keep_alive
= -1;
83 options
->log_facility
= SYSLOG_FACILITY_NOT_SET
;
84 options
->log_level
= SYSLOG_LEVEL_NOT_SET
;
85 options
->rhosts_rsa_authentication
= -1;
86 options
->hostbased_authentication
= -1;
87 options
->hostbased_uses_name_from_packet_only
= -1;
88 options
->rsa_authentication
= -1;
89 options
->pubkey_authentication
= -1;
90 options
->kerberos_authentication
= -1;
91 options
->kerberos_or_local_passwd
= -1;
92 options
->kerberos_ticket_cleanup
= -1;
93 options
->kerberos_get_afs_token
= -1;
94 options
->gss_authentication
=-1;
95 options
->gss_cleanup_creds
= -1;
96 options
->password_authentication
= -1;
97 options
->kbd_interactive_authentication
= -1;
98 options
->challenge_response_authentication
= -1;
99 options
->permit_blacklisted_keys
= -1;
100 options
->permit_empty_passwd
= -1;
101 options
->permit_user_env
= -1;
102 options
->use_login
= -1;
103 options
->compression
= -1;
104 options
->allow_tcp_forwarding
= -1;
105 options
->allow_agent_forwarding
= -1;
106 options
->num_allow_users
= 0;
107 options
->num_deny_users
= 0;
108 options
->num_allow_groups
= 0;
109 options
->num_deny_groups
= 0;
110 options
->ciphers
= NULL
;
111 options
->macs
= NULL
;
112 options
->protocol
= SSH_PROTO_UNKNOWN
;
113 options
->gateway_ports
= -1;
114 options
->num_subsystems
= 0;
115 options
->max_startups_begin
= -1;
116 options
->max_startups_rate
= -1;
117 options
->max_startups
= -1;
118 options
->max_authtries
= -1;
119 options
->max_sessions
= -1;
120 options
->banner
= NULL
;
121 options
->use_dns
= -1;
122 options
->client_alive_interval
= -1;
123 options
->client_alive_count_max
= -1;
124 options
->authorized_keys_file
= NULL
;
125 options
->authorized_keys_file2
= NULL
;
126 options
->num_accept_env
= 0;
127 options
->permit_tun
= -1;
128 options
->num_permitted_opens
= -1;
129 options
->adm_forced_command
= NULL
;
130 options
->chroot_directory
= NULL
;
134 fill_default_server_options(ServerOptions
*options
)
136 /* Portable-specific options */
137 if (options
->use_pam
== -1)
138 options
->use_pam
= 0;
140 /* Standard Options */
141 if (options
->protocol
== SSH_PROTO_UNKNOWN
)
142 options
->protocol
= SSH_PROTO_2
;
143 if (options
->num_host_key_files
== 0) {
144 /* fill default hostkeys for protocols */
145 if (options
->protocol
& SSH_PROTO_1
)
146 options
->host_key_files
[options
->num_host_key_files
++] =
148 if (options
->protocol
& SSH_PROTO_2
) {
149 options
->host_key_files
[options
->num_host_key_files
++] =
150 _PATH_HOST_RSA_KEY_FILE
;
151 options
->host_key_files
[options
->num_host_key_files
++] =
152 _PATH_HOST_DSA_KEY_FILE
;
155 if (options
->num_ports
== 0)
156 options
->ports
[options
->num_ports
++] = SSH_DEFAULT_PORT
;
157 if (options
->listen_addrs
== NULL
)
158 add_listen_addr(options
, NULL
, 0);
159 if (options
->pid_file
== NULL
)
160 options
->pid_file
= _PATH_SSH_DAEMON_PID_FILE
;
161 if (options
->server_key_bits
== -1)
162 options
->server_key_bits
= 1024;
163 if (options
->login_grace_time
== -1)
164 options
->login_grace_time
= 120;
165 if (options
->key_regeneration_time
== -1)
166 options
->key_regeneration_time
= 3600;
167 if (options
->permit_root_login
== PERMIT_NOT_SET
)
168 options
->permit_root_login
= PERMIT_NO
;
169 if (options
->ignore_rhosts
== -1)
170 options
->ignore_rhosts
= 1;
171 if (options
->ignore_user_known_hosts
== -1)
172 options
->ignore_user_known_hosts
= 0;
173 if (options
->print_motd
== -1)
174 options
->print_motd
= 1;
175 if (options
->print_lastlog
== -1)
176 options
->print_lastlog
= 1;
177 if (options
->x11_forwarding
== -1)
178 options
->x11_forwarding
= 1;
179 if (options
->x11_display_offset
== -1)
180 options
->x11_display_offset
= 10;
181 if (options
->x11_use_localhost
== -1)
182 options
->x11_use_localhost
= 1;
183 if (options
->xauth_location
== NULL
)
184 options
->xauth_location
= _PATH_XAUTH
;
185 if (options
->strict_modes
== -1)
186 options
->strict_modes
= 1;
187 if (options
->tcp_keep_alive
== -1)
188 options
->tcp_keep_alive
= 1;
189 if (options
->log_facility
== SYSLOG_FACILITY_NOT_SET
)
190 options
->log_facility
= SYSLOG_FACILITY_AUTH
;
191 if (options
->log_level
== SYSLOG_LEVEL_NOT_SET
)
192 options
->log_level
= SYSLOG_LEVEL_INFO
;
193 if (options
->rhosts_rsa_authentication
== -1)
194 options
->rhosts_rsa_authentication
= 0;
195 if (options
->hostbased_authentication
== -1)
196 options
->hostbased_authentication
= 0;
197 if (options
->hostbased_uses_name_from_packet_only
== -1)
198 options
->hostbased_uses_name_from_packet_only
= 0;
199 if (options
->rsa_authentication
== -1)
200 options
->rsa_authentication
= 1;
201 if (options
->pubkey_authentication
== -1)
202 options
->pubkey_authentication
= 1;
203 if (options
->kerberos_authentication
== -1)
204 options
->kerberos_authentication
= 0;
205 if (options
->kerberos_or_local_passwd
== -1)
206 options
->kerberos_or_local_passwd
= 1;
207 if (options
->kerberos_ticket_cleanup
== -1)
208 options
->kerberos_ticket_cleanup
= 1;
209 if (options
->kerberos_get_afs_token
== -1)
210 options
->kerberos_get_afs_token
= 0;
211 if (options
->gss_authentication
== -1)
212 options
->gss_authentication
= 0;
213 if (options
->gss_cleanup_creds
== -1)
214 options
->gss_cleanup_creds
= 1;
215 if (options
->password_authentication
== -1)
216 options
->password_authentication
= 1;
217 if (options
->kbd_interactive_authentication
== -1)
218 options
->kbd_interactive_authentication
= 0;
219 if (options
->challenge_response_authentication
== -1)
220 options
->challenge_response_authentication
= 1;
221 if (options
->permit_blacklisted_keys
== -1)
222 options
->permit_blacklisted_keys
= 0;
223 if (options
->permit_empty_passwd
== -1)
224 options
->permit_empty_passwd
= 0;
225 if (options
->permit_user_env
== -1)
226 options
->permit_user_env
= 0;
227 if (options
->use_login
== -1)
228 options
->use_login
= 0;
229 if (options
->compression
== -1)
230 options
->compression
= COMP_DELAYED
;
231 if (options
->allow_tcp_forwarding
== -1)
232 options
->allow_tcp_forwarding
= 1;
233 if (options
->allow_agent_forwarding
== -1)
234 options
->allow_agent_forwarding
= 1;
235 if (options
->gateway_ports
== -1)
236 options
->gateway_ports
= 0;
237 if (options
->max_startups
== -1)
238 options
->max_startups
= 10;
239 if (options
->max_startups_rate
== -1)
240 options
->max_startups_rate
= 100; /* 100% */
241 if (options
->max_startups_begin
== -1)
242 options
->max_startups_begin
= options
->max_startups
;
243 if (options
->max_authtries
== -1)
244 options
->max_authtries
= DEFAULT_AUTH_FAIL_MAX
;
245 if (options
->max_sessions
== -1)
246 options
->max_sessions
= DEFAULT_SESSIONS_MAX
;
247 if (options
->use_dns
== -1)
248 options
->use_dns
= 1;
249 if (options
->client_alive_interval
== -1)
250 options
->client_alive_interval
= 0;
251 if (options
->client_alive_count_max
== -1)
252 options
->client_alive_count_max
= 3;
253 if (options
->authorized_keys_file2
== NULL
) {
254 /* authorized_keys_file2 falls back to authorized_keys_file */
255 if (options
->authorized_keys_file
!= NULL
)
256 options
->authorized_keys_file2
= options
->authorized_keys_file
;
258 options
->authorized_keys_file2
= _PATH_SSH_USER_PERMITTED_KEYS2
;
260 if (options
->authorized_keys_file
== NULL
)
261 options
->authorized_keys_file
= _PATH_SSH_USER_PERMITTED_KEYS
;
262 if (options
->permit_tun
== -1)
263 options
->permit_tun
= SSH_TUNMODE_NO
;
265 /* Turn privilege separation on by default */
266 if (use_privsep
== -1)
270 if (use_privsep
&& options
->compression
== 1) {
271 error("This platform does not support both privilege "
272 "separation and compression");
273 error("Compression disabled");
274 options
->compression
= 0;
280 /* Keyword tokens. */
282 sBadOption
, /* == unknown option */
283 /* Portable-specific options */
285 /* Standard Options */
286 sPort
, sHostKeyFile
, sServerKeyBits
, sLoginGraceTime
, sKeyRegenerationTime
,
287 sPermitRootLogin
, sLogFacility
, sLogLevel
,
288 sRhostsRSAAuthentication
, sRSAAuthentication
,
289 sKerberosAuthentication
, sKerberosOrLocalPasswd
, sKerberosTicketCleanup
,
290 sKerberosGetAFSToken
,
291 sKerberosTgtPassing
, sChallengeResponseAuthentication
,
292 sPasswordAuthentication
, sKbdInteractiveAuthentication
,
293 sListenAddress
, sAddressFamily
,
294 sPrintMotd
, sPrintLastLog
, sIgnoreRhosts
,
295 sX11Forwarding
, sX11DisplayOffset
, sX11UseLocalhost
,
296 sStrictModes
, sPermitBlacklistedKeys
, sEmptyPasswd
, sTCPKeepAlive
,
297 sPermitUserEnvironment
, sUseLogin
, sAllowTcpForwarding
, sCompression
,
298 sAllowUsers
, sDenyUsers
, sAllowGroups
, sDenyGroups
,
299 sIgnoreUserKnownHosts
, sCiphers
, sMacs
, sProtocol
, sPidFile
,
300 sGatewayPorts
, sPubkeyAuthentication
, sXAuthLocation
, sSubsystem
,
301 sMaxStartups
, sMaxAuthTries
, sMaxSessions
,
302 sBanner
, sUseDNS
, sHostbasedAuthentication
,
303 sHostbasedUsesNameFromPacketOnly
, sClientAliveInterval
,
304 sClientAliveCountMax
, sAuthorizedKeysFile
, sAuthorizedKeysFile2
,
305 sGssAuthentication
, sGssCleanupCreds
, sAcceptEnv
, sPermitTunnel
,
306 sMatch
, sPermitOpen
, sForceCommand
, sChrootDirectory
,
307 sUsePrivilegeSeparation
, sAllowAgentForwarding
,
309 sDeprecated
, sUnsupported
312 #define SSHCFG_GLOBAL 0x01 /* allowed in main section of sshd_config */
313 #define SSHCFG_MATCH 0x02 /* allowed inside a Match section */
314 #define SSHCFG_ALL (SSHCFG_GLOBAL|SSHCFG_MATCH)
316 /* Textual representation of the tokens. */
319 ServerOpCodes opcode
;
322 /* Portable-specific options */
324 { "usepam", sUsePAM
, SSHCFG_GLOBAL
},
326 { "usepam", sUnsupported
, SSHCFG_GLOBAL
},
328 { "pamauthenticationviakbdint", sDeprecated
, SSHCFG_GLOBAL
},
329 /* Standard Options */
330 { "port", sPort
, SSHCFG_GLOBAL
},
331 { "hostkey", sHostKeyFile
, SSHCFG_GLOBAL
},
332 { "hostdsakey", sHostKeyFile
, SSHCFG_GLOBAL
}, /* alias */
333 { "pidfile", sPidFile
, SSHCFG_GLOBAL
},
334 { "serverkeybits", sServerKeyBits
, SSHCFG_GLOBAL
},
335 { "logingracetime", sLoginGraceTime
, SSHCFG_GLOBAL
},
336 { "keyregenerationinterval", sKeyRegenerationTime
, SSHCFG_GLOBAL
},
337 { "permitrootlogin", sPermitRootLogin
, SSHCFG_ALL
},
338 { "syslogfacility", sLogFacility
, SSHCFG_GLOBAL
},
339 { "loglevel", sLogLevel
, SSHCFG_GLOBAL
},
340 { "rhostsauthentication", sDeprecated
, SSHCFG_GLOBAL
},
341 { "rhostsrsaauthentication", sRhostsRSAAuthentication
, SSHCFG_ALL
},
342 { "hostbasedauthentication", sHostbasedAuthentication
, SSHCFG_ALL
},
343 { "hostbasedusesnamefrompacketonly", sHostbasedUsesNameFromPacketOnly
, SSHCFG_GLOBAL
},
344 { "rsaauthentication", sRSAAuthentication
, SSHCFG_ALL
},
345 { "pubkeyauthentication", sPubkeyAuthentication
, SSHCFG_ALL
},
346 { "dsaauthentication", sPubkeyAuthentication
, SSHCFG_GLOBAL
}, /* alias */
348 { "kerberosauthentication", sKerberosAuthentication
, SSHCFG_ALL
},
349 { "kerberosorlocalpasswd", sKerberosOrLocalPasswd
, SSHCFG_GLOBAL
},
350 { "kerberosticketcleanup", sKerberosTicketCleanup
, SSHCFG_GLOBAL
},
352 { "kerberosgetafstoken", sKerberosGetAFSToken
, SSHCFG_GLOBAL
},
354 { "kerberosgetafstoken", sUnsupported
, SSHCFG_GLOBAL
},
357 { "kerberosauthentication", sUnsupported
, SSHCFG_ALL
},
358 { "kerberosorlocalpasswd", sUnsupported
, SSHCFG_GLOBAL
},
359 { "kerberosticketcleanup", sUnsupported
, SSHCFG_GLOBAL
},
360 { "kerberosgetafstoken", sUnsupported
, SSHCFG_GLOBAL
},
362 { "kerberostgtpassing", sUnsupported
, SSHCFG_GLOBAL
},
363 { "afstokenpassing", sUnsupported
, SSHCFG_GLOBAL
},
365 { "gssapiauthentication", sGssAuthentication
, SSHCFG_ALL
},
366 { "gssapicleanupcredentials", sGssCleanupCreds
, SSHCFG_GLOBAL
},
368 { "gssapiauthentication", sUnsupported
, SSHCFG_ALL
},
369 { "gssapicleanupcredentials", sUnsupported
, SSHCFG_GLOBAL
},
371 { "passwordauthentication", sPasswordAuthentication
, SSHCFG_ALL
},
372 { "kbdinteractiveauthentication", sKbdInteractiveAuthentication
, SSHCFG_ALL
},
373 { "challengeresponseauthentication", sChallengeResponseAuthentication
, SSHCFG_GLOBAL
},
374 { "skeyauthentication", sChallengeResponseAuthentication
, SSHCFG_GLOBAL
}, /* alias */
375 { "checkmail", sDeprecated
, SSHCFG_GLOBAL
},
376 { "listenaddress", sListenAddress
, SSHCFG_GLOBAL
},
377 { "addressfamily", sAddressFamily
, SSHCFG_GLOBAL
},
378 { "printmotd", sPrintMotd
, SSHCFG_GLOBAL
},
379 { "printlastlog", sPrintLastLog
, SSHCFG_GLOBAL
},
380 { "ignorerhosts", sIgnoreRhosts
, SSHCFG_GLOBAL
},
381 { "ignoreuserknownhosts", sIgnoreUserKnownHosts
, SSHCFG_GLOBAL
},
382 { "x11forwarding", sX11Forwarding
, SSHCFG_ALL
},
383 { "x11displayoffset", sX11DisplayOffset
, SSHCFG_ALL
},
384 { "x11uselocalhost", sX11UseLocalhost
, SSHCFG_ALL
},
385 { "xauthlocation", sXAuthLocation
, SSHCFG_GLOBAL
},
386 { "strictmodes", sStrictModes
, SSHCFG_GLOBAL
},
387 { "permitblacklistedkeys", sPermitBlacklistedKeys
, SSHCFG_GLOBAL
},
388 { "permitemptypasswords", sEmptyPasswd
, SSHCFG_GLOBAL
},
389 { "permituserenvironment", sPermitUserEnvironment
, SSHCFG_GLOBAL
},
390 { "uselogin", sUseLogin
, SSHCFG_GLOBAL
},
391 { "compression", sCompression
, SSHCFG_GLOBAL
},
392 { "tcpkeepalive", sTCPKeepAlive
, SSHCFG_GLOBAL
},
393 { "keepalive", sTCPKeepAlive
, SSHCFG_GLOBAL
}, /* obsolete alias */
394 { "allowtcpforwarding", sAllowTcpForwarding
, SSHCFG_ALL
},
395 { "allowagentforwarding", sAllowAgentForwarding
, SSHCFG_ALL
},
396 { "allowusers", sAllowUsers
, SSHCFG_GLOBAL
},
397 { "denyusers", sDenyUsers
, SSHCFG_GLOBAL
},
398 { "allowgroups", sAllowGroups
, SSHCFG_GLOBAL
},
399 { "denygroups", sDenyGroups
, SSHCFG_GLOBAL
},
400 { "ciphers", sCiphers
, SSHCFG_GLOBAL
},
401 { "macs", sMacs
, SSHCFG_GLOBAL
},
402 { "protocol", sProtocol
, SSHCFG_GLOBAL
},
403 { "gatewayports", sGatewayPorts
, SSHCFG_ALL
},
404 { "subsystem", sSubsystem
, SSHCFG_GLOBAL
},
405 { "maxstartups", sMaxStartups
, SSHCFG_GLOBAL
},
406 { "maxauthtries", sMaxAuthTries
, SSHCFG_ALL
},
407 { "maxsessions", sMaxSessions
, SSHCFG_ALL
},
408 { "banner", sBanner
, SSHCFG_ALL
},
409 { "usedns", sUseDNS
, SSHCFG_GLOBAL
},
410 { "verifyreversemapping", sDeprecated
, SSHCFG_GLOBAL
},
411 { "reversemappingcheck", sDeprecated
, SSHCFG_GLOBAL
},
412 { "clientaliveinterval", sClientAliveInterval
, SSHCFG_GLOBAL
},
413 { "clientalivecountmax", sClientAliveCountMax
, SSHCFG_GLOBAL
},
414 { "authorizedkeysfile", sAuthorizedKeysFile
, SSHCFG_GLOBAL
},
415 { "authorizedkeysfile2", sAuthorizedKeysFile2
, SSHCFG_GLOBAL
},
416 { "useprivilegeseparation", sUsePrivilegeSeparation
, SSHCFG_GLOBAL
},
417 { "versionaddendum", sVersionAddendum
, SSHCFG_GLOBAL
},
418 { "acceptenv", sAcceptEnv
, SSHCFG_GLOBAL
},
419 { "permittunnel", sPermitTunnel
, SSHCFG_GLOBAL
},
420 { "match", sMatch
, SSHCFG_ALL
},
421 { "permitopen", sPermitOpen
, SSHCFG_ALL
},
422 { "forcecommand", sForceCommand
, SSHCFG_ALL
},
423 { "chrootdirectory", sChrootDirectory
, SSHCFG_ALL
},
424 { NULL
, sBadOption
, 0 }
431 { SSH_TUNMODE_NO
, "no" },
432 { SSH_TUNMODE_POINTOPOINT
, "point-to-point" },
433 { SSH_TUNMODE_ETHERNET
, "ethernet" },
434 { SSH_TUNMODE_YES
, "yes" },
439 * Returns the number of the token pointed to by cp or sBadOption.
443 parse_token(const char *cp
, const char *filename
,
444 int linenum
, u_int
*flags
)
448 for (i
= 0; keywords
[i
].name
; i
++)
449 if (strcasecmp(cp
, keywords
[i
].name
) == 0) {
450 *flags
= keywords
[i
].flags
;
451 return keywords
[i
].opcode
;
454 error("%s: line %d: Bad configuration option: %s",
455 filename
, linenum
, cp
);
460 add_listen_addr(ServerOptions
*options
, char *addr
, u_short port
)
464 if (options
->num_ports
== 0)
465 options
->ports
[options
->num_ports
++] = SSH_DEFAULT_PORT
;
466 if (options
->address_family
== -1)
467 options
->address_family
= AF_UNSPEC
;
469 for (i
= 0; i
< options
->num_ports
; i
++)
470 add_one_listen_addr(options
, addr
, options
->ports
[i
]);
472 add_one_listen_addr(options
, addr
, port
);
476 add_one_listen_addr(ServerOptions
*options
, char *addr
, u_short port
)
478 struct addrinfo hints
, *ai
, *aitop
;
479 char strport
[NI_MAXSERV
];
482 memset(&hints
, 0, sizeof(hints
));
483 hints
.ai_family
= options
->address_family
;
484 hints
.ai_socktype
= SOCK_STREAM
;
485 hints
.ai_flags
= (addr
== NULL
) ? AI_PASSIVE
: 0;
486 snprintf(strport
, sizeof strport
, "%u", port
);
487 if ((gaierr
= getaddrinfo(addr
, strport
, &hints
, &aitop
)) != 0)
488 fatal("bad addr or host: %s (%s)",
489 addr
? addr
: "<NULL>",
490 ssh_gai_strerror(gaierr
));
491 for (ai
= aitop
; ai
->ai_next
; ai
= ai
->ai_next
)
493 ai
->ai_next
= options
->listen_addrs
;
494 options
->listen_addrs
= aitop
;
498 * The strategy for the Match blocks is that the config file is parsed twice.
500 * The first time is at startup. activep is initialized to 1 and the
501 * directives in the global context are processed and acted on. Hitting a
502 * Match directive unsets activep and the directives inside the block are
503 * checked for syntax only.
505 * The second time is after a connection has been established but before
506 * authentication. activep is initialized to 2 and global config directives
507 * are ignored since they have already been processed. If the criteria in a
508 * Match block is met, activep is set and the subsequent directives
509 * processed and actioned until EOF or another Match block unsets it. Any
510 * options set are copied into the main server config.
512 * Potential additions/improvements:
513 * - Add Match support for pre-kex directives, eg Protocol, Ciphers.
515 * - Add a Tag directive (idea from David Leonard) ala pf, eg:
516 * Match Address 192.168.0.*
521 * AllowTcpForwarding yes
522 * GatewayPorts clientspecified
525 * - Add a PermittedChannelRequests directive
527 * PermittedChannelRequests session,forwarded-tcpip
531 match_cfg_line_group(const char *grps
, int line
, const char *user
)
539 if ((pw
= getpwnam(user
)) == NULL
) {
540 debug("Can't match group at line %d because user %.100s does "
541 "not exist", line
, user
);
542 } else if (ga_init(pw
->pw_name
, pw
->pw_gid
) == 0) {
543 debug("Can't Match group because user %.100s not in any group "
544 "at line %d", user
, line
);
545 } else if (ga_match_pattern_list(grps
) != 1) {
546 debug("user %.100s does not match group list %.100s at line %d",
549 debug("user %.100s matched group list %.100s at line %d", user
,
559 match_cfg_line(char **condition
, int line
, const char *user
, const char *host
,
563 char *arg
, *attrib
, *cp
= *condition
;
567 debug3("checking syntax for 'Match %s'", cp
);
569 debug3("checking match for '%s' user %s host %s addr %s", cp
,
570 user
? user
: "(null)", host
? host
: "(null)",
571 address
? address
: "(null)");
573 while ((attrib
= strdelim(&cp
)) && *attrib
!= '\0') {
574 if ((arg
= strdelim(&cp
)) == NULL
|| *arg
== '\0') {
575 error("Missing Match criteria for %s", attrib
);
579 if (strcasecmp(attrib
, "user") == 0) {
584 if (match_pattern_list(user
, arg
, len
, 0) != 1)
587 debug("user %.100s matched 'User %.100s' at "
588 "line %d", user
, arg
, line
);
589 } else if (strcasecmp(attrib
, "group") == 0) {
590 switch (match_cfg_line_group(arg
, line
, user
)) {
596 } else if (strcasecmp(attrib
, "host") == 0) {
601 if (match_hostname(host
, arg
, len
) != 1)
604 debug("connection from %.100s matched 'Host "
605 "%.100s' at line %d", host
, arg
, line
);
606 } else if (strcasecmp(attrib
, "address") == 0) {
607 switch (addr_match_list(address
, arg
)) {
609 debug("connection from %.100s matched 'Address "
610 "%.100s' at line %d", address
, arg
, line
);
620 error("Unsupported Match attribute %s", attrib
);
625 debug3("match %sfound", result
? "" : "not ");
630 #define WHITESPACE " \t\r\n"
633 process_server_config_line(ServerOptions
*options
, char *line
,
634 const char *filename
, int linenum
, int *activep
, const char *user
,
635 const char *host
, const char *address
)
637 char *cp
, **charptr
, *arg
, *p
;
638 int cmdline
= 0, *intptr
, value
, n
;
639 SyslogFacility
*log_facility_ptr
;
640 LogLevel
*log_level_ptr
;
641 ServerOpCodes opcode
;
647 if ((arg
= strdelim(&cp
)) == NULL
)
649 /* Ignore leading whitespace */
652 if (!arg
|| !*arg
|| *arg
== '#')
656 opcode
= parse_token(arg
, filename
, linenum
, &flags
);
658 if (activep
== NULL
) { /* We are processing a command line directive */
662 if (*activep
&& opcode
!= sMatch
)
663 debug3("%s:%d setting %s %s", filename
, linenum
, arg
, cp
);
664 if (*activep
== 0 && !(flags
& SSHCFG_MATCH
)) {
666 fatal("%s line %d: Directive '%s' is not allowed "
667 "within a Match block", filename
, linenum
, arg
);
668 } else { /* this is a directive we have already processed */
676 /* Portable-specific options */
678 intptr
= &options
->use_pam
;
681 /* Standard Options */
685 /* ignore ports from configfile if cmdline specifies ports */
686 if (options
->ports_from_cmdline
)
688 if (options
->listen_addrs
!= NULL
)
689 fatal("%s line %d: ports must be specified before "
690 "ListenAddress.", filename
, linenum
);
691 if (options
->num_ports
>= MAX_PORTS
)
692 fatal("%s line %d: too many ports.",
695 if (!arg
|| *arg
== '\0')
696 fatal("%s line %d: missing port number.",
698 options
->ports
[options
->num_ports
++] = a2port(arg
);
699 if (options
->ports
[options
->num_ports
-1] == 0)
700 fatal("%s line %d: Badly formatted port number.",
705 intptr
= &options
->server_key_bits
;
708 if (!arg
|| *arg
== '\0')
709 fatal("%s line %d: missing integer value.",
712 if (*activep
&& *intptr
== -1)
716 case sLoginGraceTime
:
717 intptr
= &options
->login_grace_time
;
720 if (!arg
|| *arg
== '\0')
721 fatal("%s line %d: missing time value.",
723 if ((value
= convtime(arg
)) == -1)
724 fatal("%s line %d: invalid time value.",
730 case sKeyRegenerationTime
:
731 intptr
= &options
->key_regeneration_time
;
736 if (arg
== NULL
|| *arg
== '\0')
737 fatal("%s line %d: missing address",
739 /* check for bare IPv6 address: no "[]" and 2 or more ":" */
740 if (strchr(arg
, '[') == NULL
&& (p
= strchr(arg
, ':')) != NULL
741 && strchr(p
+1, ':') != NULL
) {
742 add_listen_addr(options
, arg
, 0);
747 fatal("%s line %d: bad address:port usage",
749 p
= cleanhostname(p
);
752 else if ((port
= a2port(arg
)) == 0)
753 fatal("%s line %d: bad port number", filename
, linenum
);
755 add_listen_addr(options
, p
, port
);
761 if (!arg
|| *arg
== '\0')
762 fatal("%s line %d: missing address family.",
764 intptr
= &options
->address_family
;
765 if (options
->listen_addrs
!= NULL
)
766 fatal("%s line %d: address family must be specified before "
767 "ListenAddress.", filename
, linenum
);
768 if (strcasecmp(arg
, "inet") == 0)
770 else if (strcasecmp(arg
, "inet6") == 0)
772 else if (strcasecmp(arg
, "any") == 0)
775 fatal("%s line %d: unsupported address family \"%s\".",
776 filename
, linenum
, arg
);
782 intptr
= &options
->num_host_key_files
;
783 if (*intptr
>= MAX_HOSTKEYS
)
784 fatal("%s line %d: too many host keys specified (max %d).",
785 filename
, linenum
, MAX_HOSTKEYS
);
786 charptr
= &options
->host_key_files
[*intptr
];
789 if (!arg
|| *arg
== '\0')
790 fatal("%s line %d: missing file name.",
792 if (*activep
&& *charptr
== NULL
) {
793 *charptr
= tilde_expand_filename(arg
, getuid());
794 /* increase optional counter */
796 *intptr
= *intptr
+ 1;
801 charptr
= &options
->pid_file
;
804 case sPermitRootLogin
:
805 intptr
= &options
->permit_root_login
;
807 if (!arg
|| *arg
== '\0')
808 fatal("%s line %d: missing yes/"
809 "without-password/forced-commands-only/no "
810 "argument.", filename
, linenum
);
811 value
= 0; /* silence compiler */
812 if (strcmp(arg
, "without-password") == 0)
813 value
= PERMIT_NO_PASSWD
;
814 else if (strcmp(arg
, "forced-commands-only") == 0)
815 value
= PERMIT_FORCED_ONLY
;
816 else if (strcmp(arg
, "yes") == 0)
818 else if (strcmp(arg
, "no") == 0)
821 fatal("%s line %d: Bad yes/"
822 "without-password/forced-commands-only/no "
823 "argument: %s", filename
, linenum
, arg
);
824 if (*activep
&& *intptr
== -1)
829 intptr
= &options
->ignore_rhosts
;
832 if (!arg
|| *arg
== '\0')
833 fatal("%s line %d: missing yes/no argument.",
835 value
= 0; /* silence compiler */
836 if (strcmp(arg
, "yes") == 0)
838 else if (strcmp(arg
, "no") == 0)
841 fatal("%s line %d: Bad yes/no argument: %s",
842 filename
, linenum
, arg
);
843 if (*activep
&& *intptr
== -1)
847 case sIgnoreUserKnownHosts
:
848 intptr
= &options
->ignore_user_known_hosts
;
851 case sRhostsRSAAuthentication
:
852 intptr
= &options
->rhosts_rsa_authentication
;
855 case sHostbasedAuthentication
:
856 intptr
= &options
->hostbased_authentication
;
859 case sHostbasedUsesNameFromPacketOnly
:
860 intptr
= &options
->hostbased_uses_name_from_packet_only
;
863 case sRSAAuthentication
:
864 intptr
= &options
->rsa_authentication
;
867 case sPubkeyAuthentication
:
868 intptr
= &options
->pubkey_authentication
;
871 case sKerberosAuthentication
:
872 intptr
= &options
->kerberos_authentication
;
875 case sKerberosOrLocalPasswd
:
876 intptr
= &options
->kerberos_or_local_passwd
;
879 case sKerberosTicketCleanup
:
880 intptr
= &options
->kerberos_ticket_cleanup
;
883 case sKerberosGetAFSToken
:
884 intptr
= &options
->kerberos_get_afs_token
;
887 case sGssAuthentication
:
888 intptr
= &options
->gss_authentication
;
891 case sGssCleanupCreds
:
892 intptr
= &options
->gss_cleanup_creds
;
895 case sPasswordAuthentication
:
896 intptr
= &options
->password_authentication
;
899 case sKbdInteractiveAuthentication
:
900 intptr
= &options
->kbd_interactive_authentication
;
903 case sChallengeResponseAuthentication
:
904 intptr
= &options
->challenge_response_authentication
;
908 intptr
= &options
->print_motd
;
912 intptr
= &options
->print_lastlog
;
916 intptr
= &options
->x11_forwarding
;
919 case sX11DisplayOffset
:
920 intptr
= &options
->x11_display_offset
;
923 case sX11UseLocalhost
:
924 intptr
= &options
->x11_use_localhost
;
928 charptr
= &options
->xauth_location
;
932 intptr
= &options
->strict_modes
;
936 intptr
= &options
->tcp_keep_alive
;
939 case sPermitBlacklistedKeys
:
940 intptr
= &options
->permit_blacklisted_keys
;
944 intptr
= &options
->permit_empty_passwd
;
947 case sPermitUserEnvironment
:
948 intptr
= &options
->permit_user_env
;
952 intptr
= &options
->use_login
;
956 intptr
= &options
->compression
;
958 if (!arg
|| *arg
== '\0')
959 fatal("%s line %d: missing yes/no/delayed "
960 "argument.", filename
, linenum
);
961 value
= 0; /* silence compiler */
962 if (strcmp(arg
, "delayed") == 0)
963 value
= COMP_DELAYED
;
964 else if (strcmp(arg
, "yes") == 0)
966 else if (strcmp(arg
, "no") == 0)
969 fatal("%s line %d: Bad yes/no/delayed "
970 "argument: %s", filename
, linenum
, arg
);
976 intptr
= &options
->gateway_ports
;
978 if (!arg
|| *arg
== '\0')
979 fatal("%s line %d: missing yes/no/clientspecified "
980 "argument.", filename
, linenum
);
981 value
= 0; /* silence compiler */
982 if (strcmp(arg
, "clientspecified") == 0)
984 else if (strcmp(arg
, "yes") == 0)
986 else if (strcmp(arg
, "no") == 0)
989 fatal("%s line %d: Bad yes/no/clientspecified "
990 "argument: %s", filename
, linenum
, arg
);
991 if (*activep
&& *intptr
== -1)
996 intptr
= &options
->use_dns
;
1000 log_facility_ptr
= &options
->log_facility
;
1001 arg
= strdelim(&cp
);
1002 value
= log_facility_number(arg
);
1003 if (value
== SYSLOG_FACILITY_NOT_SET
)
1004 fatal("%.200s line %d: unsupported log facility '%s'",
1005 filename
, linenum
, arg
? arg
: "<NONE>");
1006 if (*log_facility_ptr
== -1)
1007 *log_facility_ptr
= (SyslogFacility
) value
;
1011 log_level_ptr
= &options
->log_level
;
1012 arg
= strdelim(&cp
);
1013 value
= log_level_number(arg
);
1014 if (value
== SYSLOG_LEVEL_NOT_SET
)
1015 fatal("%.200s line %d: unsupported log level '%s'",
1016 filename
, linenum
, arg
? arg
: "<NONE>");
1017 if (*log_level_ptr
== -1)
1018 *log_level_ptr
= (LogLevel
) value
;
1021 case sAllowTcpForwarding
:
1022 intptr
= &options
->allow_tcp_forwarding
;
1025 case sAllowAgentForwarding
:
1026 intptr
= &options
->allow_agent_forwarding
;
1029 case sUsePrivilegeSeparation
:
1030 intptr
= &use_privsep
;
1034 while ((arg
= strdelim(&cp
)) && *arg
!= '\0') {
1035 if (options
->num_allow_users
>= MAX_ALLOW_USERS
)
1036 fatal("%s line %d: too many allow users.",
1038 options
->allow_users
[options
->num_allow_users
++] =
1044 while ((arg
= strdelim(&cp
)) && *arg
!= '\0') {
1045 if (options
->num_deny_users
>= MAX_DENY_USERS
)
1046 fatal("%s line %d: too many deny users.",
1048 options
->deny_users
[options
->num_deny_users
++] =
1054 while ((arg
= strdelim(&cp
)) && *arg
!= '\0') {
1055 if (options
->num_allow_groups
>= MAX_ALLOW_GROUPS
)
1056 fatal("%s line %d: too many allow groups.",
1058 options
->allow_groups
[options
->num_allow_groups
++] =
1064 while ((arg
= strdelim(&cp
)) && *arg
!= '\0') {
1065 if (options
->num_deny_groups
>= MAX_DENY_GROUPS
)
1066 fatal("%s line %d: too many deny groups.",
1068 options
->deny_groups
[options
->num_deny_groups
++] = xstrdup(arg
);
1073 arg
= strdelim(&cp
);
1074 if (!arg
|| *arg
== '\0')
1075 fatal("%s line %d: Missing argument.", filename
, linenum
);
1076 if (!ciphers_valid(arg
))
1077 fatal("%s line %d: Bad SSH2 cipher spec '%s'.",
1078 filename
, linenum
, arg
? arg
: "<NONE>");
1079 if (options
->ciphers
== NULL
)
1080 options
->ciphers
= xstrdup(arg
);
1084 arg
= strdelim(&cp
);
1085 if (!arg
|| *arg
== '\0')
1086 fatal("%s line %d: Missing argument.", filename
, linenum
);
1087 if (!mac_valid(arg
))
1088 fatal("%s line %d: Bad SSH2 mac spec '%s'.",
1089 filename
, linenum
, arg
? arg
: "<NONE>");
1090 if (options
->macs
== NULL
)
1091 options
->macs
= xstrdup(arg
);
1095 intptr
= &options
->protocol
;
1096 arg
= strdelim(&cp
);
1097 if (!arg
|| *arg
== '\0')
1098 fatal("%s line %d: Missing argument.", filename
, linenum
);
1099 value
= proto_spec(arg
);
1100 if (value
== SSH_PROTO_UNKNOWN
)
1101 fatal("%s line %d: Bad protocol spec '%s'.",
1102 filename
, linenum
, arg
? arg
: "<NONE>");
1103 if (*intptr
== SSH_PROTO_UNKNOWN
)
1108 if (options
->num_subsystems
>= MAX_SUBSYSTEMS
) {
1109 fatal("%s line %d: too many subsystems defined.",
1112 arg
= strdelim(&cp
);
1113 if (!arg
|| *arg
== '\0')
1114 fatal("%s line %d: Missing subsystem name.",
1117 arg
= strdelim(&cp
);
1120 for (i
= 0; i
< options
->num_subsystems
; i
++)
1121 if (strcmp(arg
, options
->subsystem_name
[i
]) == 0)
1122 fatal("%s line %d: Subsystem '%s' already defined.",
1123 filename
, linenum
, arg
);
1124 options
->subsystem_name
[options
->num_subsystems
] = xstrdup(arg
);
1125 arg
= strdelim(&cp
);
1126 if (!arg
|| *arg
== '\0')
1127 fatal("%s line %d: Missing subsystem command.",
1129 options
->subsystem_command
[options
->num_subsystems
] = xstrdup(arg
);
1131 /* Collect arguments (separate to executable) */
1133 len
= strlen(p
) + 1;
1134 while ((arg
= strdelim(&cp
)) != NULL
&& *arg
!= '\0') {
1135 len
+= 1 + strlen(arg
);
1136 p
= xrealloc(p
, 1, len
);
1137 strlcat(p
, " ", len
);
1138 strlcat(p
, arg
, len
);
1140 options
->subsystem_args
[options
->num_subsystems
] = p
;
1141 options
->num_subsystems
++;
1145 arg
= strdelim(&cp
);
1146 if (!arg
|| *arg
== '\0')
1147 fatal("%s line %d: Missing MaxStartups spec.",
1149 if ((n
= sscanf(arg
, "%d:%d:%d",
1150 &options
->max_startups_begin
,
1151 &options
->max_startups_rate
,
1152 &options
->max_startups
)) == 3) {
1153 if (options
->max_startups_begin
>
1154 options
->max_startups
||
1155 options
->max_startups_rate
> 100 ||
1156 options
->max_startups_rate
< 1)
1157 fatal("%s line %d: Illegal MaxStartups spec.",
1160 fatal("%s line %d: Illegal MaxStartups spec.",
1163 options
->max_startups
= options
->max_startups_begin
;
1167 intptr
= &options
->max_authtries
;
1171 intptr
= &options
->max_sessions
;
1175 charptr
= &options
->banner
;
1176 goto parse_filename
;
1179 * These options can contain %X options expanded at
1180 * connect time, so that you can specify paths like:
1182 * AuthorizedKeysFile /etc/ssh_keys/%u
1184 case sAuthorizedKeysFile
:
1185 case sAuthorizedKeysFile2
:
1186 charptr
= (opcode
== sAuthorizedKeysFile
) ?
1187 &options
->authorized_keys_file
:
1188 &options
->authorized_keys_file2
;
1189 goto parse_filename
;
1191 case sClientAliveInterval
:
1192 intptr
= &options
->client_alive_interval
;
1195 case sClientAliveCountMax
:
1196 intptr
= &options
->client_alive_count_max
;
1200 while ((arg
= strdelim(&cp
)) && *arg
!= '\0') {
1201 if (strchr(arg
, '=') != NULL
)
1202 fatal("%s line %d: Invalid environment name.",
1204 if (options
->num_accept_env
>= MAX_ACCEPT_ENV
)
1205 fatal("%s line %d: too many allow env.",
1209 options
->accept_env
[options
->num_accept_env
++] =
1215 intptr
= &options
->permit_tun
;
1216 arg
= strdelim(&cp
);
1217 if (!arg
|| *arg
== '\0')
1218 fatal("%s line %d: Missing yes/point-to-point/"
1219 "ethernet/no argument.", filename
, linenum
);
1221 for (i
= 0; tunmode_desc
[i
].val
!= -1; i
++)
1222 if (strcmp(tunmode_desc
[i
].text
, arg
) == 0) {
1223 value
= tunmode_desc
[i
].val
;
1227 fatal("%s line %d: Bad yes/point-to-point/ethernet/"
1228 "no argument: %s", filename
, linenum
, arg
);
1235 fatal("Match directive not supported as a command-line "
1237 value
= match_cfg_line(&cp
, linenum
, user
, host
, address
);
1239 fatal("%s line %d: Bad Match condition", filename
,
1245 arg
= strdelim(&cp
);
1246 if (!arg
|| *arg
== '\0')
1247 fatal("%s line %d: missing PermitOpen specification",
1249 n
= options
->num_permitted_opens
; /* modified later */
1250 if (strcmp(arg
, "any") == 0) {
1251 if (*activep
&& n
== -1) {
1252 channel_clear_adm_permitted_opens();
1253 options
->num_permitted_opens
= 0;
1257 if (*activep
&& n
== -1)
1258 channel_clear_adm_permitted_opens();
1259 for (; arg
!= NULL
&& *arg
!= '\0'; arg
= strdelim(&cp
)) {
1262 fatal("%s line %d: missing host in PermitOpen",
1264 p
= cleanhostname(p
);
1265 if (arg
== NULL
|| (port
= a2port(arg
)) == 0)
1266 fatal("%s line %d: bad port number in "
1267 "PermitOpen", filename
, linenum
);
1268 if (*activep
&& n
== -1)
1269 options
->num_permitted_opens
=
1270 channel_add_adm_permitted_opens(p
, port
);
1276 fatal("%.200s line %d: Missing argument.", filename
,
1278 len
= strspn(cp
, WHITESPACE
);
1279 if (*activep
&& options
->adm_forced_command
== NULL
)
1280 options
->adm_forced_command
= xstrdup(cp
+ len
);
1283 case sChrootDirectory
:
1284 charptr
= &options
->chroot_directory
;
1286 arg
= strdelim(&cp
);
1287 if (!arg
|| *arg
== '\0')
1288 fatal("%s line %d: missing file name.",
1290 if (*activep
&& *charptr
== NULL
)
1291 *charptr
= xstrdup(arg
);
1294 case sVersionAddendum
:
1295 ssh_version_set_addendum(strtok(cp
, "\n"));
1297 arg
= strdelim(&cp
);
1298 } while (arg
!= NULL
&& *arg
!= '\0');
1302 logit("%s line %d: Deprecated option %s",
1303 filename
, linenum
, arg
);
1305 arg
= strdelim(&cp
);
1309 logit("%s line %d: Unsupported option %s",
1310 filename
, linenum
, arg
);
1312 arg
= strdelim(&cp
);
1316 fatal("%s line %d: Missing handler for opcode %s (%d)",
1317 filename
, linenum
, arg
, opcode
);
1319 if ((arg
= strdelim(&cp
)) != NULL
&& *arg
!= '\0')
1320 fatal("%s line %d: garbage at end of line; \"%.200s\".",
1321 filename
, linenum
, arg
);
1325 /* Reads the server configuration file. */
1328 load_server_config(const char *filename
, Buffer
*conf
)
1330 char line
[1024], *cp
;
1333 debug2("%s: filename %s", __func__
, filename
);
1334 if ((f
= fopen(filename
, "r")) == NULL
) {
1339 while (fgets(line
, sizeof(line
), f
)) {
1341 * Trim out comments and strip whitespace
1342 * NB - preserve newlines, they are needed to reproduce
1343 * line numbers later for error messages
1345 if ((cp
= strchr(line
, '#')) != NULL
)
1346 memcpy(cp
, "\n", 2);
1347 cp
= line
+ strspn(line
, " \t\r");
1349 buffer_append(conf
, cp
, strlen(cp
));
1351 buffer_append(conf
, "\0", 1);
1353 debug2("%s: done config len = %d", __func__
, buffer_len(conf
));
1357 parse_server_match_config(ServerOptions
*options
, const char *user
,
1358 const char *host
, const char *address
)
1362 initialize_server_options(&mo
);
1363 parse_server_config(&mo
, "reprocess config", &cfg
, user
, host
, address
);
1364 copy_set_server_options(options
, &mo
, 0);
1368 #define M_CP_INTOPT(n) do {\
1372 #define M_CP_STROPT(n) do {\
1373 if (src->n != NULL) { \
1374 if (dst->n != NULL) \
1381 * Copy any supported values that are set.
1383 * If the preauth flag is set, we do not bother copying the the string or
1384 * array values that are not used pre-authentication, because any that we
1385 * do use must be explictly sent in mm_getpwnamallow().
1388 copy_set_server_options(ServerOptions
*dst
, ServerOptions
*src
, int preauth
)
1390 M_CP_INTOPT(password_authentication
);
1391 M_CP_INTOPT(gss_authentication
);
1392 M_CP_INTOPT(rsa_authentication
);
1393 M_CP_INTOPT(pubkey_authentication
);
1394 M_CP_INTOPT(kerberos_authentication
);
1395 M_CP_INTOPT(hostbased_authentication
);
1396 M_CP_INTOPT(kbd_interactive_authentication
);
1397 M_CP_INTOPT(permit_root_login
);
1399 M_CP_INTOPT(allow_tcp_forwarding
);
1400 M_CP_INTOPT(allow_agent_forwarding
);
1401 M_CP_INTOPT(gateway_ports
);
1402 M_CP_INTOPT(x11_display_offset
);
1403 M_CP_INTOPT(x11_forwarding
);
1404 M_CP_INTOPT(x11_use_localhost
);
1405 M_CP_INTOPT(max_sessions
);
1406 M_CP_INTOPT(max_authtries
);
1408 M_CP_STROPT(banner
);
1411 M_CP_STROPT(adm_forced_command
);
1412 M_CP_STROPT(chroot_directory
);
1419 parse_server_config(ServerOptions
*options
, const char *filename
, Buffer
*conf
,
1420 const char *user
, const char *host
, const char *address
)
1422 int active
, linenum
, bad_options
= 0;
1423 char *cp
, *obuf
, *cbuf
;
1425 debug2("%s: config %s len %d", __func__
, filename
, buffer_len(conf
));
1427 obuf
= cbuf
= xstrdup(buffer_ptr(conf
));
1428 active
= user
? 0 : 1;
1430 while ((cp
= strsep(&cbuf
, "\n")) != NULL
) {
1431 if (process_server_config_line(options
, cp
, filename
,
1432 linenum
++, &active
, user
, host
, address
) != 0)
1436 if (bad_options
> 0)
1437 fatal("%s: terminating, %d bad configuration options",
1438 filename
, bad_options
);
1442 fmt_intarg(ServerOpCodes code
, int val
)
1444 if (code
== sAddressFamily
) {
1456 if (code
== sPermitRootLogin
) {
1458 case PERMIT_NO_PASSWD
:
1459 return "without-passord";
1460 case PERMIT_FORCED_ONLY
:
1461 return "forced-commands-only";
1466 if (code
== sProtocol
) {
1472 case (SSH_PROTO_1
|SSH_PROTO_2
):
1478 if (code
== sGatewayPorts
&& val
== 2)
1479 return "clientspecified";
1480 if (code
== sCompression
&& val
== COMP_DELAYED
)
1494 lookup_opcode_name(ServerOpCodes code
)
1498 for (i
= 0; keywords
[i
].name
!= NULL
; i
++)
1499 if (keywords
[i
].opcode
== code
)
1500 return(keywords
[i
].name
);
1505 dump_cfg_int(ServerOpCodes code
, int val
)
1507 printf("%s %d\n", lookup_opcode_name(code
), val
);
1511 dump_cfg_fmtint(ServerOpCodes code
, int val
)
1513 printf("%s %s\n", lookup_opcode_name(code
), fmt_intarg(code
, val
));
1517 dump_cfg_string(ServerOpCodes code
, const char *val
)
1521 printf("%s %s\n", lookup_opcode_name(code
), val
);
1525 dump_cfg_strarray(ServerOpCodes code
, u_int count
, char **vals
)
1529 for (i
= 0; i
< count
; i
++)
1530 printf("%s %s\n", lookup_opcode_name(code
), vals
[i
]);
1534 dump_config(ServerOptions
*o
)
1538 struct addrinfo
*ai
;
1539 char addr
[NI_MAXHOST
], port
[NI_MAXSERV
], *s
= NULL
;
1541 /* these are usually at the top of the config */
1542 for (i
= 0; i
< o
->num_ports
; i
++)
1543 printf("port %d\n", o
->ports
[i
]);
1544 dump_cfg_fmtint(sProtocol
, o
->protocol
);
1545 dump_cfg_fmtint(sAddressFamily
, o
->address_family
);
1547 /* ListenAddress must be after Port */
1548 for (ai
= o
->listen_addrs
; ai
; ai
= ai
->ai_next
) {
1549 if ((ret
= getnameinfo(ai
->ai_addr
, ai
->ai_addrlen
, addr
,
1550 sizeof(addr
), port
, sizeof(port
),
1551 NI_NUMERICHOST
|NI_NUMERICSERV
)) != 0) {
1552 error("getnameinfo failed: %.100s",
1553 (ret
!= EAI_SYSTEM
) ? gai_strerror(ret
) :
1556 if (ai
->ai_family
== AF_INET6
)
1557 printf("listenaddress [%s]:%s\n", addr
, port
);
1559 printf("listenaddress %s:%s\n", addr
, port
);
1563 /* integer arguments */
1564 dump_cfg_int(sServerKeyBits
, o
->server_key_bits
);
1565 dump_cfg_int(sLoginGraceTime
, o
->login_grace_time
);
1566 dump_cfg_int(sKeyRegenerationTime
, o
->key_regeneration_time
);
1567 dump_cfg_int(sX11DisplayOffset
, o
->x11_display_offset
);
1568 dump_cfg_int(sMaxAuthTries
, o
->max_authtries
);
1569 dump_cfg_int(sClientAliveInterval
, o
->client_alive_interval
);
1570 dump_cfg_int(sClientAliveCountMax
, o
->client_alive_count_max
);
1572 /* formatted integer arguments */
1573 dump_cfg_fmtint(sPermitRootLogin
, o
->permit_root_login
);
1574 dump_cfg_fmtint(sIgnoreRhosts
, o
->ignore_rhosts
);
1575 dump_cfg_fmtint(sIgnoreUserKnownHosts
, o
->ignore_user_known_hosts
);
1576 dump_cfg_fmtint(sRhostsRSAAuthentication
, o
->rhosts_rsa_authentication
);
1577 dump_cfg_fmtint(sHostbasedAuthentication
, o
->hostbased_authentication
);
1578 dump_cfg_fmtint(sHostbasedUsesNameFromPacketOnly
,
1579 o
->hostbased_uses_name_from_packet_only
);
1580 dump_cfg_fmtint(sRSAAuthentication
, o
->rsa_authentication
);
1581 dump_cfg_fmtint(sPubkeyAuthentication
, o
->pubkey_authentication
);
1582 dump_cfg_fmtint(sKerberosAuthentication
, o
->kerberos_authentication
);
1583 dump_cfg_fmtint(sKerberosOrLocalPasswd
, o
->kerberos_or_local_passwd
);
1584 dump_cfg_fmtint(sKerberosTicketCleanup
, o
->kerberos_ticket_cleanup
);
1585 dump_cfg_fmtint(sKerberosGetAFSToken
, o
->kerberos_get_afs_token
);
1586 dump_cfg_fmtint(sGssAuthentication
, o
->gss_authentication
);
1587 dump_cfg_fmtint(sGssCleanupCreds
, o
->gss_cleanup_creds
);
1588 dump_cfg_fmtint(sPasswordAuthentication
, o
->password_authentication
);
1589 dump_cfg_fmtint(sKbdInteractiveAuthentication
,
1590 o
->kbd_interactive_authentication
);
1591 dump_cfg_fmtint(sChallengeResponseAuthentication
,
1592 o
->challenge_response_authentication
);
1593 dump_cfg_fmtint(sPrintMotd
, o
->print_motd
);
1594 dump_cfg_fmtint(sPrintLastLog
, o
->print_lastlog
);
1595 dump_cfg_fmtint(sX11Forwarding
, o
->x11_forwarding
);
1596 dump_cfg_fmtint(sX11UseLocalhost
, o
->x11_use_localhost
);
1597 dump_cfg_fmtint(sStrictModes
, o
->strict_modes
);
1598 dump_cfg_fmtint(sTCPKeepAlive
, o
->tcp_keep_alive
);
1599 dump_cfg_fmtint(sEmptyPasswd
, o
->permit_empty_passwd
);
1600 dump_cfg_fmtint(sPermitUserEnvironment
, o
->permit_user_env
);
1601 dump_cfg_fmtint(sUseLogin
, o
->use_login
);
1602 dump_cfg_fmtint(sCompression
, o
->compression
);
1603 dump_cfg_fmtint(sGatewayPorts
, o
->gateway_ports
);
1604 dump_cfg_fmtint(sUseDNS
, o
->use_dns
);
1605 dump_cfg_fmtint(sAllowTcpForwarding
, o
->allow_tcp_forwarding
);
1606 dump_cfg_fmtint(sUsePrivilegeSeparation
, use_privsep
);
1608 /* string arguments */
1609 dump_cfg_string(sPidFile
, o
->pid_file
);
1610 dump_cfg_string(sXAuthLocation
, o
->xauth_location
);
1611 dump_cfg_string(sCiphers
, o
->ciphers
);
1612 dump_cfg_string(sMacs
, o
->macs
);
1613 dump_cfg_string(sBanner
, o
->banner
);
1614 dump_cfg_string(sAuthorizedKeysFile
, o
->authorized_keys_file
);
1615 dump_cfg_string(sAuthorizedKeysFile2
, o
->authorized_keys_file2
);
1616 dump_cfg_string(sForceCommand
, o
->adm_forced_command
);
1618 /* string arguments requiring a lookup */
1619 dump_cfg_string(sLogLevel
, log_level_name(o
->log_level
));
1620 dump_cfg_string(sLogFacility
, log_facility_name(o
->log_facility
));
1622 /* string array arguments */
1623 dump_cfg_strarray(sHostKeyFile
, o
->num_host_key_files
,
1625 dump_cfg_strarray(sAllowUsers
, o
->num_allow_users
, o
->allow_users
);
1626 dump_cfg_strarray(sDenyUsers
, o
->num_deny_users
, o
->deny_users
);
1627 dump_cfg_strarray(sAllowGroups
, o
->num_allow_groups
, o
->allow_groups
);
1628 dump_cfg_strarray(sDenyGroups
, o
->num_deny_groups
, o
->deny_groups
);
1629 dump_cfg_strarray(sAcceptEnv
, o
->num_accept_env
, o
->accept_env
);
1631 /* other arguments */
1632 for (i
= 0; i
< o
->num_subsystems
; i
++)
1633 printf("subsystem %s %s\n", o
->subsystem_name
[i
],
1634 o
->subsystem_args
[i
]);
1636 printf("maxstartups %d:%d:%d\n", o
->max_startups_begin
,
1637 o
->max_startups_rate
, o
->max_startups
);
1639 for (i
= 0; tunmode_desc
[i
].val
!= -1; i
++)
1640 if (tunmode_desc
[i
].val
== o
->permit_tun
) {
1641 s
= tunmode_desc
[i
].text
;
1644 dump_cfg_string(sPermitTunnel
, s
);
1646 printf("permitopen");
1647 channel_print_adm_permitted_opens();