1 /* $OpenBSD: sshd.c,v 1.367 2009/05/28 16:50:16 andreas Exp $ */
3 * Author: Tatu Ylonen <ylo@cs.hut.fi>
4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
6 * This program is the ssh daemon. It listens for connections from clients,
7 * and performs authentication, executes use commands or shell, and forwards
8 * information to/from the application to the user client over an encrypted
9 * connection. This can also handle forwarding of X11, TCP/IP, and
10 * authentication agent connections.
12 * As far as I am concerned, the code I have written for this software
13 * can be used freely for any purpose. Any derived versions of this
14 * software must be clearly marked as such, and if the derived work is
15 * incompatible with the protocol description in the RFC file, it must be
16 * called by a name other than "ssh" or "Secure Shell".
18 * SSH2 implementation:
19 * Privilege Separation:
21 * Copyright (c) 2000, 2001, 2002 Markus Friedl. All rights reserved.
22 * Copyright (c) 2002 Niels Provos. All rights reserved.
24 * Redistribution and use in source and binary forms, with or without
25 * modification, are permitted provided that the following conditions
27 * 1. Redistributions of source code must retain the above copyright
28 * notice, this list of conditions and the following disclaimer.
29 * 2. Redistributions in binary form must reproduce the above copyright
30 * notice, this list of conditions and the following disclaimer in the
31 * documentation and/or other materials provided with the distribution.
33 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
34 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
35 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
36 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
37 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
38 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
39 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
40 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
41 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
42 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
47 #include <sys/types.h>
48 #include <sys/ioctl.h>
49 #include <sys/socket.h>
50 #ifdef HAVE_SYS_STAT_H
51 # include <sys/stat.h>
53 #ifdef HAVE_SYS_TIME_H
54 # include <sys/time.h>
56 #include "openbsd-compat/sys-tree.h"
57 #include "openbsd-compat/sys-queue.h"
75 #include <openssl/dh.h>
76 #include <openssl/bn.h>
77 #include <openssl/md5.h>
78 #include <openssl/rand.h>
79 #include "openbsd-compat/openssl-compat.h"
81 #ifdef HAVE_SECUREWARE
82 #include <sys/security.h>
103 #include "myproposal.h"
104 #include "authfile.h"
105 #include "pathnames.h"
106 #include "atomicio.h"
107 #include "canohost.h"
108 #include "hostfile.h"
112 #include "dispatch.h"
113 #include "channels.h"
115 #include "monitor_mm.h"
120 #include "monitor_wrap.h"
136 #define REEXEC_DEVCRYPTO_RESERVED_FD (STDERR_FILENO + 1)
137 #define REEXEC_STARTUP_PIPE_FD (STDERR_FILENO + 2)
138 #define REEXEC_CONFIG_PASS_FD (STDERR_FILENO + 3)
139 #define REEXEC_MIN_FREE_FD (STDERR_FILENO + 4)
144 extern char *__progname
;
146 /* Server configuration options. */
147 ServerOptions options
;
149 /* Name of the server configuration file. */
150 char *config_file_name
= _PATH_SERVER_CONFIG_FILE
;
153 * Debug mode flag. This can be set on the command line. If debug
154 * mode is enabled, extra debugging output will be sent to the system
155 * log, the daemon will not go to background, and will exit after processing
156 * the first connection.
160 /* Flag indicating that the daemon should only test the configuration and keys. */
163 /* Flag indicating that the daemon is being started from inetd. */
166 /* Flag indicating that sshd should not detach and become a daemon. */
167 int no_daemon_flag
= 0;
169 /* debug goes to stderr unless inetd_flag is set */
172 /* Saved arguments to main(). */
177 int rexeced_flag
= 0;
183 * The sockets that the server is listening; this is used in the SIGHUP
186 #define MAX_LISTEN_SOCKS 16
187 int listen_socks
[MAX_LISTEN_SOCKS
];
188 int num_listen_socks
= 0;
191 * the client's version string, passed by sshd2 in compat mode. if != NULL,
192 * sshd will skip the version-number exchange
194 char *client_version_string
= NULL
;
195 char *server_version_string
= NULL
;
197 /* for rekeying XXX fixme */
201 * Any really sensitive data in the application is contained in this
202 * structure. The idea is that this structure could be locked into memory so
203 * that the pages do not get written into swap. However, there are some
204 * problems. The private key contains BIGNUMs, and we do not (in principle)
205 * have access to the internals of them, and locking just the structure is
206 * not very useful. Currently, memory locking is not implemented.
209 Key
*server_key
; /* ephemeral server key */
210 Key
*ssh1_host_key
; /* ssh1 host key */
211 Key
**host_keys
; /* all private host keys */
214 u_char ssh1_cookie
[SSH_SESSION_KEY_LENGTH
];
218 * Flag indicating whether the RSA server key needs to be regenerated.
219 * Is set in the SIGALRM handler and cleared when the key is regenerated.
221 static volatile sig_atomic_t key_do_regen
= 0;
223 /* This is set to true when a signal is received. */
224 static volatile sig_atomic_t received_sighup
= 0;
225 static volatile sig_atomic_t received_sigterm
= 0;
227 /* session identifier, used by RSA-auth */
228 u_char session_id
[16];
231 u_char
*session_id2
= NULL
;
232 u_int session_id2_len
= 0;
234 /* record remote hostname or ip */
235 u_int utmp_len
= MAXHOSTNAMELEN
;
237 /* options.max_startup sized array of fd ints */
238 int *startup_pipes
= NULL
;
239 int startup_pipe
; /* in child */
241 /* variables used for privilege separation */
242 int use_privsep
= -1;
243 struct monitor
*pmonitor
= NULL
;
245 /* global authentication context */
246 Authctxt
*the_authctxt
= NULL
;
248 /* sshd_config buffer */
251 /* message to be displayed after login */
254 /* Unprivileged user */
255 struct passwd
*privsep_pw
= NULL
;
257 /* Prototypes for various functions defined later in this file. */
258 void destroy_sensitive_data(void);
259 void demote_sensitive_data(void);
261 static void do_ssh1_kex(void);
262 static void do_ssh2_kex(void);
265 * Close all listening sockets
268 close_listen_socks(void)
272 for (i
= 0; i
< num_listen_socks
; i
++)
273 close(listen_socks
[i
]);
274 num_listen_socks
= -1;
278 close_startup_pipes(void)
283 for (i
= 0; i
< options
.max_startups
; i
++)
284 if (startup_pipes
[i
] != -1)
285 close(startup_pipes
[i
]);
289 * Signal handler for SIGHUP. Sshd execs itself when it receives SIGHUP;
290 * the effect is to reread the configuration file (and to regenerate
296 sighup_handler(int sig
)
298 int save_errno
= errno
;
301 signal(SIGHUP
, sighup_handler
);
306 * Called from the main program after receiving SIGHUP.
307 * Restarts the server.
312 logit("Received SIGHUP; restarting.");
313 close_listen_socks();
314 close_startup_pipes();
315 alarm(0); /* alarm timer persists across exec */
316 execv(saved_argv
[0], saved_argv
);
317 logit("RESTART FAILED: av[0]='%.100s', error: %.100s.", saved_argv
[0],
323 * Generic signal handler for terminating signals in the master daemon.
327 sigterm_handler(int sig
)
329 received_sigterm
= sig
;
333 * SIGCHLD handler. This is called whenever a child dies. This will then
334 * reap any zombies left by exited children.
338 main_sigchld_handler(int sig
)
340 int save_errno
= errno
;
344 while ((pid
= waitpid(-1, &status
, WNOHANG
)) > 0 ||
345 (pid
< 0 && errno
== EINTR
))
348 signal(SIGCHLD
, main_sigchld_handler
);
353 * Signal handler for the alarm after the login grace period has expired.
357 grace_alarm_handler(int sig
)
359 if (use_privsep
&& pmonitor
!= NULL
&& pmonitor
->m_pid
> 0)
360 kill(pmonitor
->m_pid
, SIGALRM
);
362 /* Log error and exit. */
363 sigdie("Timeout before authentication for %s", get_remote_ipaddr());
367 * Signal handler for the key regeneration alarm. Note that this
368 * alarm only occurs in the daemon waiting for connections, and it does not
369 * do anything with the private key or random state before forking.
370 * Thus there should be no concurrency control/asynchronous execution
374 generate_ephemeral_server_key(void)
376 verbose("Generating %s%d bit RSA key.",
377 sensitive_data
.server_key
? "new " : "", options
.server_key_bits
);
378 if (sensitive_data
.server_key
!= NULL
)
379 key_free(sensitive_data
.server_key
);
380 sensitive_data
.server_key
= key_generate(KEY_RSA1
,
381 options
.server_key_bits
);
382 verbose("RSA key generation complete.");
384 arc4random_buf(sensitive_data
.ssh1_cookie
, SSH_SESSION_KEY_LENGTH
);
390 key_regeneration_alarm(int sig
)
392 int save_errno
= errno
;
394 signal(SIGALRM
, SIG_DFL
);
400 sshd_exchange_identification(int sock_in
, int sock_out
)
404 int remote_major
, remote_minor
;
406 char *s
, *newline
= "\n";
407 char buf
[256]; /* Must not be larger than remote_version. */
408 char remote_version
[256]; /* Must be at least as big as buf. */
410 if ((options
.protocol
& SSH_PROTO_1
) &&
411 (options
.protocol
& SSH_PROTO_2
)) {
412 major
= PROTOCOL_MAJOR_1
;
414 } else if (options
.protocol
& SSH_PROTO_2
) {
415 major
= PROTOCOL_MAJOR_2
;
416 minor
= PROTOCOL_MINOR_2
;
419 major
= PROTOCOL_MAJOR_1
;
420 minor
= PROTOCOL_MINOR_1
;
422 snprintf(buf
, sizeof buf
, "SSH-%d.%d-%.100s%s", major
, minor
,
423 SSH_RELEASE
, newline
);
424 server_version_string
= xstrdup(buf
);
426 /* Send our protocol version identification. */
427 if (roaming_atomicio(vwrite
, sock_out
, server_version_string
,
428 strlen(server_version_string
))
429 != strlen(server_version_string
)) {
430 logit("Could not write ident string to %s", get_remote_ipaddr());
434 /* Read other sides version identification. */
435 memset(buf
, 0, sizeof(buf
));
436 for (i
= 0; i
< sizeof(buf
) - 1; i
++) {
437 if (roaming_atomicio(read
, sock_in
, &buf
[i
], 1) != 1) {
438 logit("Did not receive identification string from %s",
439 get_remote_ipaddr());
442 if (buf
[i
] == '\r') {
444 /* Kludge for F-Secure Macintosh < 1.0.2 */
446 strncmp(buf
, "SSH-1.5-W1.0", 12) == 0)
450 if (buf
[i
] == '\n') {
455 buf
[sizeof(buf
) - 1] = 0;
456 client_version_string
= xstrdup(buf
);
459 * Check that the versions match. In future this might accept
460 * several versions and set appropriate flags to handle them.
462 if (sscanf(client_version_string
, "SSH-%d.%d-%[^\n]\n",
463 &remote_major
, &remote_minor
, remote_version
) != 3) {
464 s
= "Protocol mismatch.\n";
465 (void) atomicio(vwrite
, sock_out
, s
, strlen(s
));
468 logit("Bad protocol version identification '%.100s' from %s",
469 client_version_string
, get_remote_ipaddr());
472 debug("Client protocol version %d.%d; client software version %.100s",
473 remote_major
, remote_minor
, remote_version
);
474 logit("SSH: Server;Ltype: Version;Remote: %s-%d;Protocol: %d.%d;Client: %.100s",
475 get_remote_ipaddr(), get_remote_port(),
476 remote_major
, remote_minor
, remote_version
);
478 compat_datafellows(remote_version
);
480 if (datafellows
& SSH_BUG_PROBE
) {
481 logit("probed from %s with %s. Don't panic.",
482 get_remote_ipaddr(), client_version_string
);
486 if (datafellows
& SSH_BUG_SCANNER
) {
487 logit("scanned from %s with %s. Don't panic.",
488 get_remote_ipaddr(), client_version_string
);
493 switch (remote_major
) {
495 if (remote_minor
== 99) {
496 if (options
.protocol
& SSH_PROTO_2
)
502 if (!(options
.protocol
& SSH_PROTO_1
)) {
506 if (remote_minor
< 3) {
507 packet_disconnect("Your ssh version is too old and "
508 "is no longer supported. Please install a newer version.");
509 } else if (remote_minor
== 3) {
510 /* note that this disables agent-forwarding */
515 if (options
.protocol
& SSH_PROTO_2
) {
524 chop(server_version_string
);
525 debug("Local version string %.200s", server_version_string
);
528 s
= "Protocol major versions differ.\n";
529 (void) atomicio(vwrite
, sock_out
, s
, strlen(s
));
532 logit("Protocol major versions differ for %s: %.200s vs. %.200s",
534 server_version_string
, client_version_string
);
539 /* Destroy the host and server keys. They will no longer be needed. */
541 destroy_sensitive_data(void)
545 if (sensitive_data
.server_key
) {
546 key_free(sensitive_data
.server_key
);
547 sensitive_data
.server_key
= NULL
;
549 for (i
= 0; i
< options
.num_host_key_files
; i
++) {
550 if (sensitive_data
.host_keys
[i
]) {
551 key_free(sensitive_data
.host_keys
[i
]);
552 sensitive_data
.host_keys
[i
] = NULL
;
555 sensitive_data
.ssh1_host_key
= NULL
;
556 memset(sensitive_data
.ssh1_cookie
, 0, SSH_SESSION_KEY_LENGTH
);
559 /* Demote private to public keys for network child */
561 demote_sensitive_data(void)
566 if (sensitive_data
.server_key
) {
567 tmp
= key_demote(sensitive_data
.server_key
);
568 key_free(sensitive_data
.server_key
);
569 sensitive_data
.server_key
= tmp
;
572 for (i
= 0; i
< options
.num_host_key_files
; i
++) {
573 if (sensitive_data
.host_keys
[i
]) {
574 tmp
= key_demote(sensitive_data
.host_keys
[i
]);
575 key_free(sensitive_data
.host_keys
[i
]);
576 sensitive_data
.host_keys
[i
] = tmp
;
577 if (tmp
->type
== KEY_RSA1
)
578 sensitive_data
.ssh1_host_key
= tmp
;
582 /* We do not clear ssh1_host key and cookie. XXX - Okay Niels? */
586 privsep_preauth_child(void)
591 /* Enable challenge-response authentication for privilege separation */
592 privsep_challenge_enable();
595 arc4random_buf(rnd
, sizeof(rnd
));
596 RAND_seed(rnd
, sizeof(rnd
));
598 /* Demote the private keys to public keys. */
599 demote_sensitive_data();
601 /* Change our root directory */
602 if (chroot(_PATH_PRIVSEP_CHROOT_DIR
) == -1)
603 fatal("chroot(\"%s\"): %s", _PATH_PRIVSEP_CHROOT_DIR
,
605 if (chdir("/") == -1)
606 fatal("chdir(\"/\"): %s", strerror(errno
));
608 /* Drop our privileges */
609 debug3("privsep user:group %u:%u", (u_int
)privsep_pw
->pw_uid
,
610 (u_int
)privsep_pw
->pw_gid
);
612 /* XXX not ready, too heavy after chroot */
613 do_setusercontext(privsep_pw
);
615 gidset
[0] = privsep_pw
->pw_gid
;
616 if (setgroups(1, gidset
) < 0)
617 fatal("setgroups: %.100s", strerror(errno
));
618 permanently_set_uid(privsep_pw
);
623 privsep_preauth(Authctxt
*authctxt
)
628 /* Set up unprivileged child process to deal with network data */
629 pmonitor
= monitor_init();
630 /* Store a pointer to the kex for later rekeying */
631 pmonitor
->m_pkex
= &xxx_kex
;
635 fatal("fork of unprivileged child failed");
636 } else if (pid
!= 0) {
637 debug2("Network child is on pid %ld", (long)pid
);
639 close(pmonitor
->m_recvfd
);
640 pmonitor
->m_pid
= pid
;
641 monitor_child_preauth(authctxt
, pmonitor
);
642 close(pmonitor
->m_sendfd
);
645 monitor_sync(pmonitor
);
647 /* Wait for the child's exit status */
648 while (waitpid(pid
, &status
, 0) < 0)
655 close(pmonitor
->m_sendfd
);
657 /* Demote the child */
658 if (getuid() == 0 || geteuid() == 0)
659 privsep_preauth_child();
660 setproctitle("%s", "[net]");
666 privsep_postauth(Authctxt
*authctxt
)
670 #ifdef DISABLE_FD_PASSING
673 if (authctxt
->pw
->pw_uid
== 0 || options
.use_login
) {
675 /* File descriptor passing is broken or root login */
680 /* New socket pair */
681 monitor_reinit(pmonitor
);
683 pmonitor
->m_pid
= fork();
684 if (pmonitor
->m_pid
== -1)
685 fatal("fork of unprivileged child failed");
686 else if (pmonitor
->m_pid
!= 0) {
687 verbose("User child is on pid %ld", (long)pmonitor
->m_pid
);
688 close(pmonitor
->m_recvfd
);
689 buffer_clear(&loginmsg
);
690 monitor_child_postauth(pmonitor
);
696 close(pmonitor
->m_sendfd
);
698 /* Demote the private keys to public keys. */
699 demote_sensitive_data();
702 arc4random_buf(rnd
, sizeof(rnd
));
703 RAND_seed(rnd
, sizeof(rnd
));
705 /* Drop privileges */
706 do_setusercontext(authctxt
->pw
);
709 /* It is safe now to apply the key state */
710 monitor_apply_keystate(pmonitor
);
713 * Tell the packet layer that authentication was successful, since
714 * this information is not part of the key state.
716 packet_set_authenticated();
720 list_hostkey_types(void)
728 for (i
= 0; i
< options
.num_host_key_files
; i
++) {
729 Key
*key
= sensitive_data
.host_keys
[i
];
735 if (buffer_len(&b
) > 0)
736 buffer_append(&b
, ",", 1);
737 p
= key_ssh_name(key
);
738 buffer_append(&b
, p
, strlen(p
));
742 buffer_append(&b
, "\0", 1);
743 ret
= xstrdup(buffer_ptr(&b
));
745 debug("list_hostkey_types: %s", ret
);
750 get_hostkey_by_type(int type
)
754 for (i
= 0; i
< options
.num_host_key_files
; i
++) {
755 Key
*key
= sensitive_data
.host_keys
[i
];
756 if (key
!= NULL
&& key
->type
== type
)
763 get_hostkey_by_index(int ind
)
765 if (ind
< 0 || ind
>= options
.num_host_key_files
)
767 return (sensitive_data
.host_keys
[ind
]);
771 get_hostkey_index(Key
*key
)
775 for (i
= 0; i
< options
.num_host_key_files
; i
++) {
776 if (key
== sensitive_data
.host_keys
[i
])
783 * returns 1 if connection should be dropped, 0 otherwise.
784 * dropping starts at connection #max_startups_begin with a probability
785 * of (max_startups_rate/100). the probability increases linearly until
786 * all connections are dropped for startups > max_startups
789 drop_connection(int startups
)
793 if (startups
< options
.max_startups_begin
)
795 if (startups
>= options
.max_startups
)
797 if (options
.max_startups_rate
== 100)
800 p
= 100 - options
.max_startups_rate
;
801 p
*= startups
- options
.max_startups_begin
;
802 p
/= options
.max_startups
- options
.max_startups_begin
;
803 p
+= options
.max_startups_rate
;
804 r
= arc4random_uniform(100);
806 debug("drop_connection: p %d, r %d", p
, r
);
807 return (r
< p
) ? 1 : 0;
813 fprintf(stderr
, "%s, %s\n",
814 SSH_RELEASE
, SSLeay_version(SSLEAY_VERSION
));
816 "usage: sshd [-46DdeiqTt] [-b bits] [-C connection_spec] [-f config_file]\n"
817 " [-g login_grace_time] [-h host_key_file] [-k key_gen_time]\n"
818 " [-o option] [-p port] [-u len]\n"
824 send_rexec_state(int fd
, Buffer
*conf
)
828 debug3("%s: entering fd = %d config len %d", __func__
, fd
,
832 * Protocol from reexec master to child:
833 * string configuration
834 * u_int ephemeral_key_follows
835 * bignum e (only if ephemeral_key_follows == 1)
841 * string rngseed (only if OpenSSL is not self-seeded)
844 buffer_put_cstring(&m
, buffer_ptr(conf
));
846 if (sensitive_data
.server_key
!= NULL
&&
847 sensitive_data
.server_key
->type
== KEY_RSA1
) {
848 buffer_put_int(&m
, 1);
849 buffer_put_bignum(&m
, sensitive_data
.server_key
->rsa
->e
);
850 buffer_put_bignum(&m
, sensitive_data
.server_key
->rsa
->n
);
851 buffer_put_bignum(&m
, sensitive_data
.server_key
->rsa
->d
);
852 buffer_put_bignum(&m
, sensitive_data
.server_key
->rsa
->iqmp
);
853 buffer_put_bignum(&m
, sensitive_data
.server_key
->rsa
->p
);
854 buffer_put_bignum(&m
, sensitive_data
.server_key
->rsa
->q
);
856 buffer_put_int(&m
, 0);
858 #ifndef OPENSSL_PRNG_ONLY
859 rexec_send_rng_seed(&m
);
862 if (ssh_msg_send(fd
, 0, &m
) == -1)
863 fatal("%s: ssh_msg_send failed", __func__
);
867 debug3("%s: done", __func__
);
871 recv_rexec_state(int fd
, Buffer
*conf
)
877 debug3("%s: entering fd = %d", __func__
, fd
);
881 if (ssh_msg_recv(fd
, &m
) == -1)
882 fatal("%s: ssh_msg_recv failed", __func__
);
883 if (buffer_get_char(&m
) != 0)
884 fatal("%s: rexec version mismatch", __func__
);
886 cp
= buffer_get_string(&m
, &len
);
888 buffer_append(conf
, cp
, len
+ 1);
891 if (buffer_get_int(&m
)) {
892 if (sensitive_data
.server_key
!= NULL
)
893 key_free(sensitive_data
.server_key
);
894 sensitive_data
.server_key
= key_new_private(KEY_RSA1
);
895 buffer_get_bignum(&m
, sensitive_data
.server_key
->rsa
->e
);
896 buffer_get_bignum(&m
, sensitive_data
.server_key
->rsa
->n
);
897 buffer_get_bignum(&m
, sensitive_data
.server_key
->rsa
->d
);
898 buffer_get_bignum(&m
, sensitive_data
.server_key
->rsa
->iqmp
);
899 buffer_get_bignum(&m
, sensitive_data
.server_key
->rsa
->p
);
900 buffer_get_bignum(&m
, sensitive_data
.server_key
->rsa
->q
);
901 rsa_generate_additional_parameters(
902 sensitive_data
.server_key
->rsa
);
905 #ifndef OPENSSL_PRNG_ONLY
906 rexec_recv_rng_seed(&m
);
911 debug3("%s: done", __func__
);
914 /* Accept a connection from inetd */
916 server_accept_inetd(int *sock_in
, int *sock_out
)
922 close(REEXEC_CONFIG_PASS_FD
);
923 *sock_in
= *sock_out
= dup(STDIN_FILENO
);
925 startup_pipe
= dup(REEXEC_STARTUP_PIPE_FD
);
926 close(REEXEC_STARTUP_PIPE_FD
);
929 *sock_in
= dup(STDIN_FILENO
);
930 *sock_out
= dup(STDOUT_FILENO
);
933 * We intentionally do not close the descriptors 0, 1, and 2
934 * as our code for setting the descriptors won't work if
935 * ttyfd happens to be one of those.
937 if ((fd
= open(_PATH_DEVNULL
, O_RDWR
, 0)) != -1) {
938 dup2(fd
, STDIN_FILENO
);
939 dup2(fd
, STDOUT_FILENO
);
940 if (fd
> STDOUT_FILENO
)
943 debug("inetd sockets after dupping: %d, %d", *sock_in
, *sock_out
);
947 * Listen for TCP connections
952 int ret
, listen_sock
, on
= 1;
954 char ntop
[NI_MAXHOST
], strport
[NI_MAXSERV
];
956 int socksizelen
= sizeof(int);
958 for (ai
= options
.listen_addrs
; ai
; ai
= ai
->ai_next
) {
959 if (ai
->ai_family
!= AF_INET
&& ai
->ai_family
!= AF_INET6
)
961 if (num_listen_socks
>= MAX_LISTEN_SOCKS
)
962 fatal("Too many listen sockets. "
963 "Enlarge MAX_LISTEN_SOCKS");
964 if ((ret
= getnameinfo(ai
->ai_addr
, ai
->ai_addrlen
,
965 ntop
, sizeof(ntop
), strport
, sizeof(strport
),
966 NI_NUMERICHOST
|NI_NUMERICSERV
)) != 0) {
967 error("getnameinfo failed: %.100s",
968 ssh_gai_strerror(ret
));
971 /* Create socket for listening. */
972 listen_sock
= socket(ai
->ai_family
, ai
->ai_socktype
,
974 if (listen_sock
< 0) {
975 /* kernel may not support ipv6 */
976 verbose("socket: %.100s", strerror(errno
));
979 if (set_nonblock(listen_sock
) == -1) {
984 * Set socket options.
985 * Allow local port reuse in TIME_WAIT.
987 if (setsockopt(listen_sock
, SOL_SOCKET
, SO_REUSEADDR
,
988 &on
, sizeof(on
)) == -1)
989 error("setsockopt SO_REUSEADDR: %s", strerror(errno
));
992 /* Only communicate in IPv6 over AF_INET6 sockets. */
993 if (ai
->ai_family
== AF_INET6
) {
994 if (setsockopt(listen_sock
, IPPROTO_IPV6
, IPV6_V6ONLY
,
995 &on
, sizeof(on
)) == -1)
996 error("setsockopt IPV6_V6ONLY: %s",
1001 debug("Bind to port %s on %s.", strport
, ntop
);
1003 getsockopt(listen_sock
, SOL_SOCKET
, SO_RCVBUF
,
1004 &socksize
, &socksizelen
);
1005 debug("Server TCP RWIN socket size: %d", socksize
);
1006 debug("HPN Buffer Size: %d", options
.hpn_buffer_size
);
1008 /* Bind the socket to the desired port. */
1009 if (bind(listen_sock
, ai
->ai_addr
, ai
->ai_addrlen
) < 0) {
1010 error("Bind to port %s on %s failed: %.200s.",
1011 strport
, ntop
, strerror(errno
));
1015 listen_socks
[num_listen_socks
] = listen_sock
;
1018 /* Start listening on the port. */
1019 if (listen(listen_sock
, SSH_LISTEN_BACKLOG
) < 0)
1020 fatal("listen on [%s]:%s: %.100s",
1021 ntop
, strport
, strerror(errno
));
1022 logit("Server listening on %s port %s.", ntop
, strport
);
1024 freeaddrinfo(options
.listen_addrs
);
1026 if (!num_listen_socks
)
1027 fatal("Cannot bind any address.");
1031 * The main TCP accept loop. Note that, for the non-debug case, returns
1032 * from this function are in a forked subprocess.
1035 server_accept_loop(int *sock_in
, int *sock_out
, int *newsock
, int *config_s
)
1038 int i
, j
, ret
, maxfd
;
1039 int key_used
= 0, startups
= 0;
1040 int startup_p
[2] = { -1 , -1 };
1041 struct sockaddr_storage from
;
1045 /* setup fd set for accept */
1048 for (i
= 0; i
< num_listen_socks
; i
++)
1049 if (listen_socks
[i
] > maxfd
)
1050 maxfd
= listen_socks
[i
];
1051 /* pipes connected to unauthenticated childs */
1052 startup_pipes
= xcalloc(options
.max_startups
, sizeof(int));
1053 for (i
= 0; i
< options
.max_startups
; i
++)
1054 startup_pipes
[i
] = -1;
1057 * Stay listening for connections until the system crashes or
1058 * the daemon is killed with a signal.
1061 if (received_sighup
)
1065 fdset
= (fd_set
*)xcalloc(howmany(maxfd
+ 1, NFDBITS
),
1068 for (i
= 0; i
< num_listen_socks
; i
++)
1069 FD_SET(listen_socks
[i
], fdset
);
1070 for (i
= 0; i
< options
.max_startups
; i
++)
1071 if (startup_pipes
[i
] != -1)
1072 FD_SET(startup_pipes
[i
], fdset
);
1074 /* Wait in select until there is a connection. */
1075 ret
= select(maxfd
+1, fdset
, NULL
, NULL
, NULL
);
1076 if (ret
< 0 && errno
!= EINTR
)
1077 error("select: %.100s", strerror(errno
));
1078 if (received_sigterm
) {
1079 logit("Received signal %d; terminating.",
1080 (int) received_sigterm
);
1081 close_listen_socks();
1082 unlink(options
.pid_file
);
1085 if (key_used
&& key_do_regen
) {
1086 generate_ephemeral_server_key();
1093 for (i
= 0; i
< options
.max_startups
; i
++)
1094 if (startup_pipes
[i
] != -1 &&
1095 FD_ISSET(startup_pipes
[i
], fdset
)) {
1097 * the read end of the pipe is ready
1098 * if the child has closed the pipe
1099 * after successful authentication
1100 * or if the child has died
1102 close(startup_pipes
[i
]);
1103 startup_pipes
[i
] = -1;
1106 for (i
= 0; i
< num_listen_socks
; i
++) {
1107 if (!FD_ISSET(listen_socks
[i
], fdset
))
1109 fromlen
= sizeof(from
);
1110 *newsock
= accept(listen_socks
[i
],
1111 (struct sockaddr
*)&from
, &fromlen
);
1113 if (errno
!= EINTR
&& errno
!= EAGAIN
&&
1114 errno
!= EWOULDBLOCK
)
1115 error("accept: %.100s", strerror(errno
));
1118 if (unset_nonblock(*newsock
) == -1) {
1122 if (drop_connection(startups
) == 1) {
1123 debug("drop connection #%d", startups
);
1127 if (pipe(startup_p
) == -1) {
1132 if (rexec_flag
&& socketpair(AF_UNIX
,
1133 SOCK_STREAM
, 0, config_s
) == -1) {
1134 error("reexec socketpair: %s",
1137 close(startup_p
[0]);
1138 close(startup_p
[1]);
1142 for (j
= 0; j
< options
.max_startups
; j
++)
1143 if (startup_pipes
[j
] == -1) {
1144 startup_pipes
[j
] = startup_p
[0];
1145 if (maxfd
< startup_p
[0])
1146 maxfd
= startup_p
[0];
1152 * Got connection. Fork a child to handle it, unless
1153 * we are in debugging mode.
1157 * In debugging mode. Close the listening
1158 * socket, and start processing the
1159 * connection without forking.
1161 debug("Server will not fork when running in debugging mode.");
1162 close_listen_socks();
1163 *sock_in
= *newsock
;
1164 *sock_out
= *newsock
;
1165 close(startup_p
[0]);
1166 close(startup_p
[1]);
1170 send_rexec_state(config_s
[0],
1178 * Normal production daemon. Fork, and have
1179 * the child process the connection. The
1180 * parent continues listening.
1182 platform_pre_fork();
1183 if ((pid
= fork()) == 0) {
1185 * Child. Close the listening and
1186 * max_startup sockets. Start using
1187 * the accepted socket. Reinitialize
1188 * logging (since our pid has changed).
1189 * We break out of the loop to handle
1192 platform_post_fork_child();
1193 startup_pipe
= startup_p
[1];
1194 close_startup_pipes();
1195 close_listen_socks();
1196 *sock_in
= *newsock
;
1197 *sock_out
= *newsock
;
1198 log_init(__progname
,
1200 options
.log_facility
,
1207 /* Parent. Stay in the loop. */
1208 platform_post_fork_parent(pid
);
1210 error("fork: %.100s", strerror(errno
));
1212 debug("Forked child %ld.", (long)pid
);
1214 close(startup_p
[1]);
1217 send_rexec_state(config_s
[0], &cfg
);
1223 * Mark that the key has been used (it
1224 * was "given" to the child).
1226 if ((options
.protocol
& SSH_PROTO_1
) &&
1228 /* Schedule server key regeneration alarm. */
1229 signal(SIGALRM
, key_regeneration_alarm
);
1230 alarm(options
.key_regeneration_time
);
1237 * Ensure that our random state differs
1238 * from that of the child
1243 /* child process check (or debug mode) */
1244 if (num_listen_socks
< 0)
1251 * Main program for the daemon.
1254 main(int ac
, char **av
)
1256 extern char *optarg
;
1259 int sock_in
= -1, sock_out
= -1, newsock
= -1;
1260 const char *remote_ip
;
1261 char *test_user
= NULL
, *test_host
= NULL
, *test_addr
= NULL
;
1263 char *line
, *p
, *cp
;
1264 int config_s
[2] = { -1 , -1 };
1265 u_int64_t ibytes
, obytes
;
1270 #ifdef HAVE_SECUREWARE
1271 (void)set_auth_parameters(ac
, av
);
1273 __progname
= ssh_get_progname(av
[0]);
1276 /* Save argv. Duplicate so setproctitle emulation doesn't clobber it */
1279 saved_argv
= xcalloc(ac
+ 1, sizeof(*saved_argv
));
1280 for (i
= 0; i
< ac
; i
++)
1281 saved_argv
[i
] = xstrdup(av
[i
]);
1282 saved_argv
[i
] = NULL
;
1284 #ifndef HAVE_SETPROCTITLE
1285 /* Prepare for later setproctitle emulation */
1286 compat_init_setproctitle(ac
, av
);
1290 if (geteuid() == 0 && setgroups(0, NULL
) == -1)
1291 debug("setgroups(): %.200s", strerror(errno
));
1293 /* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
1296 /* Initialize configuration options to their default values. */
1297 initialize_server_options(&options
);
1299 /* Parse command-line arguments. */
1300 while ((opt
= getopt(ac
, av
, "f:p:b:k:h:g:u:o:C:dDeiqrtQRT46")) != -1) {
1303 options
.address_family
= AF_INET
;
1306 options
.address_family
= AF_INET6
;
1309 config_file_name
= optarg
;
1312 if (debug_flag
== 0) {
1314 options
.log_level
= SYSLOG_LEVEL_DEBUG1
;
1315 } else if (options
.log_level
< SYSLOG_LEVEL_DEBUG3
)
1316 options
.log_level
++;
1338 options
.log_level
= SYSLOG_LEVEL_QUIET
;
1341 options
.server_key_bits
= (int)strtonum(optarg
, 256,
1345 options
.ports_from_cmdline
= 1;
1346 if (options
.num_ports
>= MAX_PORTS
) {
1347 fprintf(stderr
, "too many ports.\n");
1350 options
.ports
[options
.num_ports
++] = a2port(optarg
);
1351 if (options
.ports
[options
.num_ports
-1] <= 0) {
1352 fprintf(stderr
, "Bad port number.\n");
1357 if ((options
.login_grace_time
= convtime(optarg
)) == -1) {
1358 fprintf(stderr
, "Invalid login grace time.\n");
1363 if ((options
.key_regeneration_time
= convtime(optarg
)) == -1) {
1364 fprintf(stderr
, "Invalid key regeneration interval.\n");
1369 if (options
.num_host_key_files
>= MAX_HOSTKEYS
) {
1370 fprintf(stderr
, "too many host keys.\n");
1373 options
.host_key_files
[options
.num_host_key_files
++] = optarg
;
1383 while ((p
= strsep(&cp
, ",")) && *p
!= '\0') {
1384 if (strncmp(p
, "addr=", 5) == 0)
1385 test_addr
= xstrdup(p
+ 5);
1386 else if (strncmp(p
, "host=", 5) == 0)
1387 test_host
= xstrdup(p
+ 5);
1388 else if (strncmp(p
, "user=", 5) == 0)
1389 test_user
= xstrdup(p
+ 5);
1391 fprintf(stderr
, "Invalid test "
1392 "mode specification %s\n", p
);
1398 utmp_len
= (u_int
)strtonum(optarg
, 0, MAXHOSTNAMELEN
+1, NULL
);
1399 if (utmp_len
> MAXHOSTNAMELEN
) {
1400 fprintf(stderr
, "Invalid utmp length.\n");
1405 line
= xstrdup(optarg
);
1406 if (process_server_config_line(&options
, line
,
1407 "command-line", 0, NULL
, NULL
, NULL
, NULL
) != 0)
1417 if (rexeced_flag
|| inetd_flag
)
1419 if (!test_flag
&& (rexec_flag
&& (av
[0] == NULL
|| *av
[0] != '/')))
1420 fatal("sshd re-exec requires execution with an absolute path");
1422 closefrom(REEXEC_MIN_FREE_FD
);
1424 closefrom(REEXEC_DEVCRYPTO_RESERVED_FD
);
1426 SSLeay_add_all_algorithms();
1429 * Force logging to stderr until we have loaded the private host
1430 * key (unless started from inetd)
1432 log_init(__progname
,
1433 options
.log_level
== SYSLOG_LEVEL_NOT_SET
?
1434 SYSLOG_LEVEL_INFO
: options
.log_level
,
1435 options
.log_facility
== SYSLOG_FACILITY_NOT_SET
?
1436 SYSLOG_FACILITY_AUTH
: options
.log_facility
,
1437 log_stderr
|| !inetd_flag
);
1440 * Unset KRB5CCNAME, otherwise the user's session may inherit it from
1441 * root's environment
1443 if (getenv("KRB5CCNAME") != NULL
)
1444 unsetenv("KRB5CCNAME");
1447 /* Cray can define user privs drop all privs now!
1448 * Not needed on PRIV_SU systems!
1453 sensitive_data
.server_key
= NULL
;
1454 sensitive_data
.ssh1_host_key
= NULL
;
1455 sensitive_data
.have_ssh1_key
= 0;
1456 sensitive_data
.have_ssh2_key
= 0;
1459 * If we're doing an extended config test, make sure we have all of
1460 * the parameters we need. If we're not doing an extended test,
1461 * do not silently ignore connection test params.
1463 if (test_flag
>= 2 &&
1464 (test_user
!= NULL
|| test_host
!= NULL
|| test_addr
!= NULL
)
1465 && (test_user
== NULL
|| test_host
== NULL
|| test_addr
== NULL
))
1466 fatal("user, host and addr are all required when testing "
1468 if (test_flag
< 2 && (test_user
!= NULL
|| test_host
!= NULL
||
1470 fatal("Config test connection parameter (-C) provided without "
1473 /* Fetch our configuration */
1476 recv_rexec_state(REEXEC_CONFIG_PASS_FD
, &cfg
);
1478 load_server_config(config_file_name
, &cfg
);
1480 parse_server_config(&options
, rexeced_flag
? "rexec" : config_file_name
,
1481 &cfg
, NULL
, NULL
, NULL
);
1485 /* Fill in default values for those options not explicitly set. */
1486 fill_default_server_options(&options
);
1488 /* challenge-response is implemented via keyboard interactive */
1489 if (options
.challenge_response_authentication
)
1490 options
.kbd_interactive_authentication
= 1;
1492 /* set default channel AF */
1493 channel_set_af(options
.address_family
);
1495 /* Check that there are no remaining arguments. */
1497 fprintf(stderr
, "Extra argument %s.\n", av
[optind
]);
1501 debug("sshd version %.100s", SSH_RELEASE
);
1503 /* Store privilege separation user for later use if required. */
1504 if ((privsep_pw
= getpwnam(SSH_PRIVSEP_USER
)) == NULL
) {
1505 if (use_privsep
|| options
.kerberos_authentication
)
1506 fatal("Privilege separation user %s does not exist",
1509 memset(privsep_pw
->pw_passwd
, 0, strlen(privsep_pw
->pw_passwd
));
1510 privsep_pw
= pwcopy(privsep_pw
);
1511 xfree(privsep_pw
->pw_passwd
);
1512 privsep_pw
->pw_passwd
= xstrdup("*");
1516 /* load private host keys */
1517 sensitive_data
.host_keys
= xcalloc(options
.num_host_key_files
,
1519 for (i
= 0; i
< options
.num_host_key_files
; i
++)
1520 sensitive_data
.host_keys
[i
] = NULL
;
1522 for (i
= 0; i
< options
.num_host_key_files
; i
++) {
1523 key
= key_load_private(options
.host_key_files
[i
], "", NULL
);
1524 if (key
&& blacklisted_key(key
)) {
1526 fp
= key_fingerprint(key
, SSH_FP_MD5
, SSH_FP_HEX
);
1527 if (options
.permit_blacklisted_keys
)
1528 error("Host key %s blacklisted (see "
1529 "ssh-vulnkey(1)); continuing anyway", fp
);
1531 error("Host key %s blacklisted (see "
1532 "ssh-vulnkey(1))", fp
);
1534 if (!options
.permit_blacklisted_keys
) {
1535 sensitive_data
.host_keys
[i
] = NULL
;
1539 sensitive_data
.host_keys
[i
] = key
;
1541 error("Could not load host key: %s",
1542 options
.host_key_files
[i
]);
1543 sensitive_data
.host_keys
[i
] = NULL
;
1546 switch (key
->type
) {
1548 sensitive_data
.ssh1_host_key
= key
;
1549 sensitive_data
.have_ssh1_key
= 1;
1553 sensitive_data
.have_ssh2_key
= 1;
1556 debug("private host key: #%d type %d %s", i
, key
->type
,
1559 if ((options
.protocol
& SSH_PROTO_1
) && !sensitive_data
.have_ssh1_key
) {
1560 logit("Disabling protocol version 1. Could not load host key");
1561 options
.protocol
&= ~SSH_PROTO_1
;
1563 if ((options
.protocol
& SSH_PROTO_2
) && !sensitive_data
.have_ssh2_key
) {
1564 logit("Disabling protocol version 2. Could not load host key");
1565 options
.protocol
&= ~SSH_PROTO_2
;
1567 if (!(options
.protocol
& (SSH_PROTO_1
|SSH_PROTO_2
))) {
1568 logit("sshd: no hostkeys available -- exiting.");
1572 /* Check certain values for sanity. */
1573 if (options
.protocol
& SSH_PROTO_1
) {
1574 if (options
.server_key_bits
< 512 ||
1575 options
.server_key_bits
> 32768) {
1576 fprintf(stderr
, "Bad server key size.\n");
1580 * Check that server and host key lengths differ sufficiently. This
1581 * is necessary to make double encryption work with rsaref. Oh, I
1582 * hate software patents. I dont know if this can go? Niels
1584 if (options
.server_key_bits
>
1585 BN_num_bits(sensitive_data
.ssh1_host_key
->rsa
->n
) -
1586 SSH_KEY_BITS_RESERVED
&& options
.server_key_bits
<
1587 BN_num_bits(sensitive_data
.ssh1_host_key
->rsa
->n
) +
1588 SSH_KEY_BITS_RESERVED
) {
1589 options
.server_key_bits
=
1590 BN_num_bits(sensitive_data
.ssh1_host_key
->rsa
->n
) +
1591 SSH_KEY_BITS_RESERVED
;
1592 debug("Forcing server key to %d bits to make it differ from host key.",
1593 options
.server_key_bits
);
1600 if ((stat(_PATH_PRIVSEP_CHROOT_DIR
, &st
) == -1) ||
1601 (S_ISDIR(st
.st_mode
) == 0))
1602 fatal("Missing privilege separation directory: %s",
1603 _PATH_PRIVSEP_CHROOT_DIR
);
1606 if (check_ntsec(_PATH_PRIVSEP_CHROOT_DIR
) &&
1607 (st
.st_uid
!= getuid () ||
1608 (st
.st_mode
& (S_IWGRP
|S_IWOTH
)) != 0))
1610 if (st
.st_uid
!= 0 || (st
.st_mode
& (S_IWGRP
|S_IWOTH
)) != 0)
1612 fatal("%s must be owned by root and not group or "
1613 "world-writable.", _PATH_PRIVSEP_CHROOT_DIR
);
1616 if (test_flag
> 1) {
1617 if (test_user
!= NULL
&& test_addr
!= NULL
&& test_host
!= NULL
)
1618 parse_server_match_config(&options
, test_user
,
1619 test_host
, test_addr
);
1620 dump_config(&options
);
1623 /* Configuration looks good, so exit if in test mode. */
1628 * Clear out any supplemental groups we may have inherited. This
1629 * prevents inadvertent creation of files with bad modes (in the
1630 * portable version at least, it's certainly possible for PAM
1631 * to create a file, and we can't control the code in every
1632 * module which might be used).
1634 if (setgroups(0, NULL
) < 0)
1635 debug("setgroups() failed: %.200s", strerror(errno
));
1638 rexec_argv
= xcalloc(rexec_argc
+ 2, sizeof(char *));
1639 for (i
= 0; i
< rexec_argc
; i
++) {
1640 debug("rexec_argv[%d]='%s'", i
, saved_argv
[i
]);
1641 rexec_argv
[i
] = saved_argv
[i
];
1643 rexec_argv
[rexec_argc
] = "-R";
1644 rexec_argv
[rexec_argc
+ 1] = NULL
;
1647 /* Ensure that umask disallows at least group and world write */
1648 new_umask
= umask(0077) | 0022;
1649 (void) umask(new_umask
);
1651 /* Initialize the log (it is reinitialized below in case we forked). */
1652 if (debug_flag
&& (!inetd_flag
|| rexeced_flag
))
1654 log_init(__progname
, options
.log_level
, options
.log_facility
, log_stderr
);
1657 * If not in debugging mode, and not started from inetd, disconnect
1658 * from the controlling terminal, and fork. The original process
1661 if (!(debug_flag
|| inetd_flag
|| no_daemon_flag
)) {
1664 #endif /* TIOCNOTTY */
1665 if (daemon(0, 0) < 0)
1666 fatal("daemon() failed: %.200s", strerror(errno
));
1668 /* Disconnect from the controlling tty. */
1670 fd
= open(_PATH_TTY
, O_RDWR
| O_NOCTTY
);
1672 (void) ioctl(fd
, TIOCNOTTY
, NULL
);
1675 #endif /* TIOCNOTTY */
1677 /* Reinitialize the log (because of the fork above). */
1678 log_init(__progname
, options
.log_level
, options
.log_facility
, log_stderr
);
1680 /* Initialize the random number generator. */
1683 /* Chdir to the root directory so that the current disk can be
1684 unmounted if desired. */
1687 /* ignore SIGPIPE */
1688 signal(SIGPIPE
, SIG_IGN
);
1690 /* Get a connection, either from inetd or a listening TCP socket */
1692 server_accept_inetd(&sock_in
, &sock_out
);
1696 if (options
.protocol
& SSH_PROTO_1
)
1697 generate_ephemeral_server_key();
1699 signal(SIGHUP
, sighup_handler
);
1700 signal(SIGCHLD
, main_sigchld_handler
);
1701 signal(SIGTERM
, sigterm_handler
);
1702 signal(SIGQUIT
, sigterm_handler
);
1705 * Write out the pid file after the sigterm handler
1706 * is setup and the listen sockets are bound
1709 FILE *f
= fopen(options
.pid_file
, "w");
1712 error("Couldn't create pid file \"%s\": %s",
1713 options
.pid_file
, strerror(errno
));
1715 fprintf(f
, "%ld\n", (long) getpid());
1720 /* Accept a connection and return in a forked child */
1721 server_accept_loop(&sock_in
, &sock_out
,
1722 &newsock
, config_s
);
1725 /* This is the child processing a new connection. */
1726 setproctitle("%s", "[accepted]");
1729 * Initialize the resolver. This may not happen automatically
1730 * before privsep chroot().
1732 if ((_res
.options
& RES_INIT
) == 0) {
1733 debug("res_init()");
1738 * Create a new session and process group since the 4.4BSD
1739 * setlogin() affects the entire process group. We don't
1740 * want the child to be able to affect the parent.
1742 #if !defined(SSHD_ACQUIRES_CTTY)
1744 * If setsid is called, on some platforms sshd will later acquire a
1745 * controlling terminal which will result in "could not set
1746 * controlling tty" errors.
1748 if (!debug_flag
&& !inetd_flag
&& setsid() < 0)
1749 error("setsid: %.100s", strerror(errno
));
1755 debug("rexec start in %d out %d newsock %d pipe %d sock %d",
1756 sock_in
, sock_out
, newsock
, startup_pipe
, config_s
[0]);
1757 dup2(newsock
, STDIN_FILENO
);
1758 dup2(STDIN_FILENO
, STDOUT_FILENO
);
1759 if (startup_pipe
== -1)
1760 close(REEXEC_STARTUP_PIPE_FD
);
1762 dup2(startup_pipe
, REEXEC_STARTUP_PIPE_FD
);
1764 dup2(config_s
[1], REEXEC_CONFIG_PASS_FD
);
1766 if (startup_pipe
!= -1)
1767 close(startup_pipe
);
1769 execv(rexec_argv
[0], rexec_argv
);
1771 /* Reexec has failed, fall back and continue */
1772 error("rexec of %s failed: %s", rexec_argv
[0], strerror(errno
));
1773 recv_rexec_state(REEXEC_CONFIG_PASS_FD
, NULL
);
1774 log_init(__progname
, options
.log_level
,
1775 options
.log_facility
, log_stderr
);
1778 startup_pipe
= REEXEC_STARTUP_PIPE_FD
;
1780 close(REEXEC_CONFIG_PASS_FD
);
1781 newsock
= sock_out
= sock_in
= dup(STDIN_FILENO
);
1782 if ((fd
= open(_PATH_DEVNULL
, O_RDWR
, 0)) != -1) {
1783 dup2(fd
, STDIN_FILENO
);
1784 dup2(fd
, STDOUT_FILENO
);
1785 if (fd
> STDERR_FILENO
)
1788 debug("rexec cleanup in %d out %d newsock %d pipe %d sock %d",
1789 sock_in
, sock_out
, newsock
, startup_pipe
, config_s
[0]);
1793 * Disable the key regeneration alarm. We will not regenerate the
1794 * key since we are no longer in a position to give it to anyone. We
1795 * will not restart on SIGHUP since it no longer makes sense.
1798 signal(SIGALRM
, SIG_DFL
);
1799 signal(SIGHUP
, SIG_DFL
);
1800 signal(SIGTERM
, SIG_DFL
);
1801 signal(SIGQUIT
, SIG_DFL
);
1802 signal(SIGCHLD
, SIG_DFL
);
1803 signal(SIGINT
, SIG_DFL
);
1806 * Register our connection. This turns encryption off because we do
1809 packet_set_connection(sock_in
, sock_out
);
1810 packet_set_server();
1812 /* Set SO_KEEPALIVE if requested. */
1813 if (options
.tcp_keep_alive
&& packet_connection_is_on_socket() &&
1814 setsockopt(sock_in
, SOL_SOCKET
, SO_KEEPALIVE
, &on
, sizeof(on
)) < 0)
1815 error("setsockopt SO_KEEPALIVE: %.100s", strerror(errno
));
1817 if ((remote_port
= get_remote_port()) < 0) {
1818 debug("get_remote_port failed");
1823 * We use get_canonical_hostname with usedns = 0 instead of
1824 * get_remote_ipaddr here so IP options will be checked.
1826 (void) get_canonical_hostname(0);
1828 * The rest of the code depends on the fact that
1829 * get_remote_ipaddr() caches the remote ip, even if
1830 * the socket goes away.
1832 remote_ip
= get_remote_ipaddr();
1834 #ifdef SSH_AUDIT_EVENTS
1835 audit_connection_from(remote_ip
, remote_port
);
1838 allow_severity
= options
.log_facility
|LOG_INFO
;
1839 deny_severity
= options
.log_facility
|LOG_WARNING
;
1840 /* Check whether logins are denied from this host. */
1841 if (packet_connection_is_on_socket()) {
1842 struct request_info req
;
1844 request_init(&req
, RQ_DAEMON
, __progname
, RQ_FILE
, sock_in
, 0);
1847 if (!hosts_access(&req
)) {
1848 debug("Connection refused by tcp wrapper");
1851 fatal("libwrap refuse returns");
1854 #endif /* LIBWRAP */
1856 /* Log the connection. */
1857 verbose("Connection from %.500s port %d", remote_ip
, remote_port
);
1859 /* set the HPN options for the child */
1860 channel_set_hpn(options
.hpn_disabled
, options
.hpn_buffer_size
);
1863 * We don't want to listen forever unless the other side
1864 * successfully authenticates itself. So we set up an alarm which is
1865 * cleared after successful authentication. A limit of zero
1866 * indicates no limit. Note that we don't set the alarm in debugging
1867 * mode; it is just annoying to have the server exit just when you
1868 * are about to discover the bug.
1870 signal(SIGALRM
, grace_alarm_handler
);
1872 alarm(options
.login_grace_time
);
1874 sshd_exchange_identification(sock_in
, sock_out
);
1876 /* In inetd mode, generate ephemeral key only for proto 1 connections */
1877 if (!compat20
&& inetd_flag
&& sensitive_data
.server_key
== NULL
)
1878 generate_ephemeral_server_key();
1880 packet_set_nonblocking();
1882 /* allocate authentication context */
1883 authctxt
= xcalloc(1, sizeof(*authctxt
));
1885 authctxt
->loginmsg
= &loginmsg
;
1887 /* XXX global for cleanup, access from other modules */
1888 the_authctxt
= authctxt
;
1890 /* prepare buffer to collect messages to display to user after login */
1891 buffer_init(&loginmsg
);
1894 if (privsep_preauth(authctxt
) == 1)
1897 /* perform the key exchange */
1898 /* authenticate user and start session */
1901 do_authentication2(authctxt
);
1904 do_authentication(authctxt
);
1907 * If we use privilege separation, the unprivileged child transfers
1908 * the current keystate and exits
1911 mm_send_keystate(pmonitor
);
1917 * Cancel the alarm we set to limit the time taken for
1921 signal(SIGALRM
, SIG_DFL
);
1922 authctxt
->authenticated
= 1;
1923 if (startup_pipe
!= -1) {
1924 close(startup_pipe
);
1928 #ifdef SSH_AUDIT_EVENTS
1929 audit_event(SSH_AUTH_SUCCESS
);
1933 if (options
.gss_authentication
) {
1934 temporarily_use_uid(authctxt
->pw
);
1935 ssh_gssapi_storecreds();
1940 if (options
.use_pam
) {
1947 * In privilege separation, we fork another child and prepare
1948 * file descriptor passing.
1951 privsep_postauth(authctxt
);
1952 /* the monitor process [priv] will not return */
1954 destroy_sensitive_data();
1957 packet_set_timeout(options
.client_alive_interval
,
1958 options
.client_alive_count_max
);
1960 /* Start session. */
1961 do_authenticated(authctxt
);
1963 /* The connection has been terminated. */
1964 packet_get_state(MODE_IN
, NULL
, NULL
, NULL
, &ibytes
);
1965 packet_get_state(MODE_OUT
, NULL
, NULL
, NULL
, &obytes
);
1966 verbose("Transferred: sent %ju, received %ju bytes",
1967 (uintmax_t)obytes
, (uintmax_t)ibytes
);
1969 verbose("Closing connection to %.500s port %d", remote_ip
, remote_port
);
1972 if (options
.use_pam
)
1974 #endif /* USE_PAM */
1976 #ifdef SSH_AUDIT_EVENTS
1977 PRIVSEP(audit_event(SSH_CONNECTION_CLOSE
));
1989 * Decrypt session_key_int using our private server key and private host key
1990 * (key with larger modulus first).
1993 ssh1_session_key(BIGNUM
*session_key_int
)
1997 if (BN_cmp(sensitive_data
.server_key
->rsa
->n
,
1998 sensitive_data
.ssh1_host_key
->rsa
->n
) > 0) {
1999 /* Server key has bigger modulus. */
2000 if (BN_num_bits(sensitive_data
.server_key
->rsa
->n
) <
2001 BN_num_bits(sensitive_data
.ssh1_host_key
->rsa
->n
) +
2002 SSH_KEY_BITS_RESERVED
) {
2003 fatal("do_connection: %s: "
2004 "server_key %d < host_key %d + SSH_KEY_BITS_RESERVED %d",
2005 get_remote_ipaddr(),
2006 BN_num_bits(sensitive_data
.server_key
->rsa
->n
),
2007 BN_num_bits(sensitive_data
.ssh1_host_key
->rsa
->n
),
2008 SSH_KEY_BITS_RESERVED
);
2010 if (rsa_private_decrypt(session_key_int
, session_key_int
,
2011 sensitive_data
.server_key
->rsa
) <= 0)
2013 if (rsa_private_decrypt(session_key_int
, session_key_int
,
2014 sensitive_data
.ssh1_host_key
->rsa
) <= 0)
2017 /* Host key has bigger modulus (or they are equal). */
2018 if (BN_num_bits(sensitive_data
.ssh1_host_key
->rsa
->n
) <
2019 BN_num_bits(sensitive_data
.server_key
->rsa
->n
) +
2020 SSH_KEY_BITS_RESERVED
) {
2021 fatal("do_connection: %s: "
2022 "host_key %d < server_key %d + SSH_KEY_BITS_RESERVED %d",
2023 get_remote_ipaddr(),
2024 BN_num_bits(sensitive_data
.ssh1_host_key
->rsa
->n
),
2025 BN_num_bits(sensitive_data
.server_key
->rsa
->n
),
2026 SSH_KEY_BITS_RESERVED
);
2028 if (rsa_private_decrypt(session_key_int
, session_key_int
,
2029 sensitive_data
.ssh1_host_key
->rsa
) < 0)
2031 if (rsa_private_decrypt(session_key_int
, session_key_int
,
2032 sensitive_data
.server_key
->rsa
) < 0)
2045 BIGNUM
*session_key_int
;
2046 u_char session_key
[SSH_SESSION_KEY_LENGTH
];
2048 u_int cipher_type
, auth_mask
, protocol_flags
;
2051 * Generate check bytes that the client must send back in the user
2052 * packet in order for it to be accepted; this is used to defy ip
2053 * spoofing attacks. Note that this only works against somebody
2054 * doing IP spoofing from a remote machine; any machine on the local
2055 * network can still see outgoing packets and catch the random
2056 * cookie. This only affects rhosts authentication, and this is one
2057 * of the reasons why it is inherently insecure.
2059 arc4random_buf(cookie
, sizeof(cookie
));
2062 * Send our public key. We include in the packet 64 bits of random
2063 * data that must be matched in the reply in order to prevent IP
2066 packet_start(SSH_SMSG_PUBLIC_KEY
);
2067 for (i
= 0; i
< 8; i
++)
2068 packet_put_char(cookie
[i
]);
2070 /* Store our public server RSA key. */
2071 packet_put_int(BN_num_bits(sensitive_data
.server_key
->rsa
->n
));
2072 packet_put_bignum(sensitive_data
.server_key
->rsa
->e
);
2073 packet_put_bignum(sensitive_data
.server_key
->rsa
->n
);
2075 /* Store our public host RSA key. */
2076 packet_put_int(BN_num_bits(sensitive_data
.ssh1_host_key
->rsa
->n
));
2077 packet_put_bignum(sensitive_data
.ssh1_host_key
->rsa
->e
);
2078 packet_put_bignum(sensitive_data
.ssh1_host_key
->rsa
->n
);
2080 /* Put protocol flags. */
2081 packet_put_int(SSH_PROTOFLAG_HOST_IN_FWD_OPEN
);
2083 /* Declare which ciphers we support. */
2084 packet_put_int(cipher_mask_ssh1(0));
2086 /* Declare supported authentication types. */
2088 if (options
.rhosts_rsa_authentication
)
2089 auth_mask
|= 1 << SSH_AUTH_RHOSTS_RSA
;
2090 if (options
.rsa_authentication
)
2091 auth_mask
|= 1 << SSH_AUTH_RSA
;
2092 if (options
.challenge_response_authentication
== 1)
2093 auth_mask
|= 1 << SSH_AUTH_TIS
;
2094 if (options
.password_authentication
)
2095 auth_mask
|= 1 << SSH_AUTH_PASSWORD
;
2096 packet_put_int(auth_mask
);
2098 /* Send the packet and wait for it to be sent. */
2100 packet_write_wait();
2102 debug("Sent %d bit server key and %d bit host key.",
2103 BN_num_bits(sensitive_data
.server_key
->rsa
->n
),
2104 BN_num_bits(sensitive_data
.ssh1_host_key
->rsa
->n
));
2106 /* Read clients reply (cipher type and session key). */
2107 packet_read_expect(SSH_CMSG_SESSION_KEY
);
2109 /* Get cipher type and check whether we accept this. */
2110 cipher_type
= packet_get_char();
2112 if (!(cipher_mask_ssh1(0) & (1 << cipher_type
)))
2113 packet_disconnect("Warning: client selects unsupported cipher.");
2115 /* Get check bytes from the packet. These must match those we
2116 sent earlier with the public key packet. */
2117 for (i
= 0; i
< 8; i
++)
2118 if (cookie
[i
] != packet_get_char())
2119 packet_disconnect("IP Spoofing check bytes do not match.");
2121 debug("Encryption type: %.200s", cipher_name(cipher_type
));
2123 /* Get the encrypted integer. */
2124 if ((session_key_int
= BN_new()) == NULL
)
2125 fatal("do_ssh1_kex: BN_new failed");
2126 packet_get_bignum(session_key_int
);
2128 protocol_flags
= packet_get_int();
2129 packet_set_protocol_flags(protocol_flags
);
2132 /* Decrypt session_key_int using host/server keys */
2133 rsafail
= PRIVSEP(ssh1_session_key(session_key_int
));
2136 * Extract session key from the decrypted integer. The key is in the
2137 * least significant 256 bits of the integer; the first byte of the
2138 * key is in the highest bits.
2141 (void) BN_mask_bits(session_key_int
, sizeof(session_key
) * 8);
2142 len
= BN_num_bytes(session_key_int
);
2143 if (len
< 0 || (u_int
)len
> sizeof(session_key
)) {
2144 error("do_ssh1_kex: bad session key len from %s: "
2145 "session_key_int %d > sizeof(session_key) %lu",
2146 get_remote_ipaddr(), len
, (u_long
)sizeof(session_key
));
2149 memset(session_key
, 0, sizeof(session_key
));
2150 BN_bn2bin(session_key_int
,
2151 session_key
+ sizeof(session_key
) - len
);
2153 derive_ssh1_session_id(
2154 sensitive_data
.ssh1_host_key
->rsa
->n
,
2155 sensitive_data
.server_key
->rsa
->n
,
2156 cookie
, session_id
);
2158 * Xor the first 16 bytes of the session key with the
2161 for (i
= 0; i
< 16; i
++)
2162 session_key
[i
] ^= session_id
[i
];
2166 int bytes
= BN_num_bytes(session_key_int
);
2167 u_char
*buf
= xmalloc(bytes
);
2170 logit("do_connection: generating a fake encryption key");
2171 BN_bn2bin(session_key_int
, buf
);
2173 MD5_Update(&md
, buf
, bytes
);
2174 MD5_Update(&md
, sensitive_data
.ssh1_cookie
, SSH_SESSION_KEY_LENGTH
);
2175 MD5_Final(session_key
, &md
);
2177 MD5_Update(&md
, session_key
, 16);
2178 MD5_Update(&md
, buf
, bytes
);
2179 MD5_Update(&md
, sensitive_data
.ssh1_cookie
, SSH_SESSION_KEY_LENGTH
);
2180 MD5_Final(session_key
+ 16, &md
);
2181 memset(buf
, 0, bytes
);
2183 for (i
= 0; i
< 16; i
++)
2184 session_id
[i
] = session_key
[i
] ^ session_key
[i
+ 16];
2186 /* Destroy the private and public keys. No longer. */
2187 destroy_sensitive_data();
2190 mm_ssh1_session_id(session_id
);
2192 /* Destroy the decrypted integer. It is no longer needed. */
2193 BN_clear_free(session_key_int
);
2195 /* Set the session key. From this on all communications will be encrypted. */
2196 packet_set_encryption_key(session_key
, SSH_SESSION_KEY_LENGTH
, cipher_type
);
2198 /* Destroy our copy of the session key. It is no longer needed. */
2199 memset(session_key
, 0, sizeof(session_key
));
2201 debug("Received session key; encryption turned on.");
2203 /* Send an acknowledgment packet. Note that this packet is sent encrypted. */
2204 packet_start(SSH_SMSG_SUCCESS
);
2206 packet_write_wait();
2210 * SSH2 key exchange: diffie-hellman-group1-sha1
2218 debug ("MYFLAG IS %d", myflag
);
2219 if (options
.ciphers
!= NULL
) {
2220 myproposal
[PROPOSAL_ENC_ALGS_CTOS
] =
2221 myproposal
[PROPOSAL_ENC_ALGS_STOC
] = options
.ciphers
;
2222 } else if (options
.none_enabled
== 1) {
2223 debug ("WARNING: None cipher enabled");
2224 myproposal
[PROPOSAL_ENC_ALGS_CTOS
] =
2225 myproposal
[PROPOSAL_ENC_ALGS_STOC
] = KEX_ENCRYPT_INCLUDE_NONE
;
2227 myproposal
[PROPOSAL_ENC_ALGS_CTOS
] =
2228 compat_cipher_proposal(myproposal
[PROPOSAL_ENC_ALGS_CTOS
]);
2229 myproposal
[PROPOSAL_ENC_ALGS_STOC
] =
2230 compat_cipher_proposal(myproposal
[PROPOSAL_ENC_ALGS_STOC
]);
2232 if (options
.macs
!= NULL
) {
2233 myproposal
[PROPOSAL_MAC_ALGS_CTOS
] =
2234 myproposal
[PROPOSAL_MAC_ALGS_STOC
] = options
.macs
;
2236 if (options
.compression
== COMP_NONE
) {
2237 myproposal
[PROPOSAL_COMP_ALGS_CTOS
] =
2238 myproposal
[PROPOSAL_COMP_ALGS_STOC
] = "none";
2239 } else if (options
.compression
== COMP_DELAYED
) {
2240 myproposal
[PROPOSAL_COMP_ALGS_CTOS
] =
2241 myproposal
[PROPOSAL_COMP_ALGS_STOC
] = "none,zlib@openssh.com";
2244 myproposal
[PROPOSAL_SERVER_HOST_KEY_ALGS
] = list_hostkey_types();
2246 /* start key exchange */
2247 kex
= kex_setup(myproposal
);
2248 kex
->kex
[KEX_DH_GRP1_SHA1
] = kexdh_server
;
2249 kex
->kex
[KEX_DH_GRP14_SHA1
] = kexdh_server
;
2250 kex
->kex
[KEX_DH_GEX_SHA1
] = kexgex_server
;
2251 kex
->kex
[KEX_DH_GEX_SHA256
] = kexgex_server
;
2253 kex
->client_version_string
=client_version_string
;
2254 kex
->server_version_string
=server_version_string
;
2255 kex
->load_host_key
=&get_hostkey_by_type
;
2256 kex
->host_key_index
=&get_hostkey_index
;
2260 dispatch_run(DISPATCH_BLOCK
, &kex
->done
, kex
);
2262 session_id2
= kex
->session_id
;
2263 session_id2_len
= kex
->session_id_len
;
2266 /* send 1st encrypted/maced/compressed message */
2267 packet_start(SSH2_MSG_IGNORE
);
2268 packet_put_cstring("markus");
2270 packet_write_wait();
2275 /* server specific fatal cleanup */
2280 do_cleanup(the_authctxt
);
2281 #ifdef SSH_AUDIT_EVENTS
2282 /* done after do_cleanup so it can cancel the PAM auth 'thread' */
2283 if (!use_privsep
|| mm_is_monitor())
2284 audit_event(SSH_CONNECTION_ABANDON
);