1 /* $OpenBSD: sshd.c,v 1.470 2016/05/24 04:43:45 dtucker Exp $ */
3 * Author: Tatu Ylonen <ylo@cs.hut.fi>
4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
6 * This program is the ssh daemon. It listens for connections from clients,
7 * and performs authentication, executes use commands or shell, and forwards
8 * information to/from the application to the user client over an encrypted
9 * connection. This can also handle forwarding of X11, TCP/IP, and
10 * authentication agent connections.
12 * As far as I am concerned, the code I have written for this software
13 * can be used freely for any purpose. Any derived versions of this
14 * software must be clearly marked as such, and if the derived work is
15 * incompatible with the protocol description in the RFC file, it must be
16 * called by a name other than "ssh" or "Secure Shell".
18 * SSH2 implementation:
19 * Privilege Separation:
21 * Copyright (c) 2000, 2001, 2002 Markus Friedl. All rights reserved.
22 * Copyright (c) 2002 Niels Provos. All rights reserved.
24 * Redistribution and use in source and binary forms, with or without
25 * modification, are permitted provided that the following conditions
27 * 1. Redistributions of source code must retain the above copyright
28 * notice, this list of conditions and the following disclaimer.
29 * 2. Redistributions in binary form must reproduce the above copyright
30 * notice, this list of conditions and the following disclaimer in the
31 * documentation and/or other materials provided with the distribution.
33 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
34 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
35 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
36 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
37 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
38 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
39 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
40 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
41 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
42 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
47 #include <sys/types.h>
48 #include <sys/ioctl.h>
49 #include <sys/socket.h>
50 #ifdef HAVE_SYS_STAT_H
51 # include <sys/stat.h>
53 #ifdef HAVE_SYS_TIME_H
54 # include <sys/time.h>
56 #include "openbsd-compat/sys-tree.h"
57 #include "openbsd-compat/sys-queue.h"
77 #include <openssl/dh.h>
78 #include <openssl/bn.h>
79 #include <openssl/rand.h>
80 #include "openbsd-compat/openssl-compat.h"
83 #ifdef HAVE_SECUREWARE
84 #include <sys/security.h>
106 #include "myproposal.h"
107 #include "authfile.h"
108 #include "pathnames.h"
109 #include "atomicio.h"
110 #include "canohost.h"
111 #include "hostfile.h"
115 #include "dispatch.h"
116 #include "channels.h"
118 #include "monitor_mm.h"
123 #include "monitor_wrap.h"
124 #include "ssh-sandbox.h"
133 #define REEXEC_DEVCRYPTO_RESERVED_FD (STDERR_FILENO + 1)
134 #define REEXEC_STARTUP_PIPE_FD (STDERR_FILENO + 2)
135 #define REEXEC_CONFIG_PASS_FD (STDERR_FILENO + 3)
136 #define REEXEC_MIN_FREE_FD (STDERR_FILENO + 4)
138 extern char *__progname
;
140 /* Server configuration options. */
141 ServerOptions options
;
143 /* Name of the server configuration file. */
144 char *config_file_name
= _PATH_SERVER_CONFIG_FILE
;
147 * Debug mode flag. This can be set on the command line. If debug
148 * mode is enabled, extra debugging output will be sent to the system
149 * log, the daemon will not go to background, and will exit after processing
150 * the first connection.
154 /* Flag indicating that the daemon should only test the configuration and keys. */
157 /* Flag indicating that the daemon is being started from inetd. */
160 /* Flag indicating that sshd should not detach and become a daemon. */
161 int no_daemon_flag
= 0;
163 /* debug goes to stderr unless inetd_flag is set */
166 /* Saved arguments to main(). */
171 int rexeced_flag
= 0;
177 * The sockets that the server is listening; this is used in the SIGHUP
180 #define MAX_LISTEN_SOCKS 16
181 int listen_socks
[MAX_LISTEN_SOCKS
];
182 int num_listen_socks
= 0;
185 * the client's version string, passed by sshd2 in compat mode. if != NULL,
186 * sshd will skip the version-number exchange
188 char *client_version_string
= NULL
;
189 char *server_version_string
= NULL
;
191 /* Daemon's agent connection */
196 * Any really sensitive data in the application is contained in this
197 * structure. The idea is that this structure could be locked into memory so
198 * that the pages do not get written into swap. However, there are some
199 * problems. The private key contains BIGNUMs, and we do not (in principle)
200 * have access to the internals of them, and locking just the structure is
201 * not very useful. Currently, memory locking is not implemented.
204 Key
*server_key
; /* ephemeral server key */
205 Key
*ssh1_host_key
; /* ssh1 host key */
206 Key
**host_keys
; /* all private host keys */
207 Key
**host_pubkeys
; /* all public host keys */
208 Key
**host_certificates
; /* all public host certificates */
211 u_char ssh1_cookie
[SSH_SESSION_KEY_LENGTH
];
215 * Flag indicating whether the RSA server key needs to be regenerated.
216 * Is set in the SIGALRM handler and cleared when the key is regenerated.
218 static volatile sig_atomic_t key_do_regen
= 0;
220 /* This is set to true when a signal is received. */
221 static volatile sig_atomic_t received_sighup
= 0;
222 static volatile sig_atomic_t received_sigterm
= 0;
224 /* session identifier, used by RSA-auth */
225 u_char session_id
[16];
228 u_char
*session_id2
= NULL
;
229 u_int session_id2_len
= 0;
231 /* record remote hostname or ip */
232 u_int utmp_len
= HOST_NAME_MAX
+1;
234 /* options.max_startup sized array of fd ints */
235 int *startup_pipes
= NULL
;
236 int startup_pipe
; /* in child */
238 /* variables used for privilege separation */
239 int use_privsep
= -1;
240 struct monitor
*pmonitor
= NULL
;
241 int privsep_is_preauth
= 1;
243 /* global authentication context */
244 Authctxt
*the_authctxt
= NULL
;
246 /* sshd_config buffer */
249 /* message to be displayed after login */
252 /* Unprivileged user */
253 struct passwd
*privsep_pw
= NULL
;
255 /* Prototypes for various functions defined later in this file. */
256 void destroy_sensitive_data(void);
257 void demote_sensitive_data(void);
260 static void do_ssh1_kex(void);
262 static void do_ssh2_kex(void);
265 * Close all listening sockets
268 close_listen_socks(void)
272 for (i
= 0; i
< num_listen_socks
; i
++)
273 close(listen_socks
[i
]);
274 num_listen_socks
= -1;
278 close_startup_pipes(void)
283 for (i
= 0; i
< options
.max_startups
; i
++)
284 if (startup_pipes
[i
] != -1)
285 close(startup_pipes
[i
]);
289 * Signal handler for SIGHUP. Sshd execs itself when it receives SIGHUP;
290 * the effect is to reread the configuration file (and to regenerate
296 sighup_handler(int sig
)
298 int save_errno
= errno
;
301 signal(SIGHUP
, sighup_handler
);
306 * Called from the main program after receiving SIGHUP.
307 * Restarts the server.
312 logit("Received SIGHUP; restarting.");
313 platform_pre_restart();
314 close_listen_socks();
315 close_startup_pipes();
316 alarm(0); /* alarm timer persists across exec */
317 signal(SIGHUP
, SIG_IGN
); /* will be restored after exec */
318 execv(saved_argv
[0], saved_argv
);
319 logit("RESTART FAILED: av[0]='%.100s', error: %.100s.", saved_argv
[0],
325 * Generic signal handler for terminating signals in the master daemon.
329 sigterm_handler(int sig
)
331 received_sigterm
= sig
;
335 * SIGCHLD handler. This is called whenever a child dies. This will then
336 * reap any zombies left by exited children.
340 main_sigchld_handler(int sig
)
342 int save_errno
= errno
;
346 while ((pid
= waitpid(-1, &status
, WNOHANG
)) > 0 ||
347 (pid
< 0 && errno
== EINTR
))
350 signal(SIGCHLD
, main_sigchld_handler
);
355 * Signal handler for the alarm after the login grace period has expired.
359 grace_alarm_handler(int sig
)
361 if (use_privsep
&& pmonitor
!= NULL
&& pmonitor
->m_pid
> 0)
362 kill(pmonitor
->m_pid
, SIGALRM
);
365 * Try to kill any processes that we have spawned, E.g. authorized
366 * keys command helpers.
368 if (getpgid(0) == getpid()) {
369 signal(SIGTERM
, SIG_IGN
);
373 /* Log error and exit. */
374 sigdie("Timeout before authentication for %s port %d",
375 ssh_remote_ipaddr(active_state
), ssh_remote_port(active_state
));
379 * Signal handler for the key regeneration alarm. Note that this
380 * alarm only occurs in the daemon waiting for connections, and it does not
381 * do anything with the private key or random state before forking.
382 * Thus there should be no concurrency control/asynchronous execution
386 generate_ephemeral_server_key(void)
388 verbose("Generating %s%d bit RSA key.",
389 sensitive_data
.server_key
? "new " : "", options
.server_key_bits
);
390 if (sensitive_data
.server_key
!= NULL
)
391 key_free(sensitive_data
.server_key
);
392 sensitive_data
.server_key
= key_generate(KEY_RSA1
,
393 options
.server_key_bits
);
394 verbose("RSA key generation complete.");
396 arc4random_buf(sensitive_data
.ssh1_cookie
, SSH_SESSION_KEY_LENGTH
);
401 key_regeneration_alarm(int sig
)
403 int save_errno
= errno
;
405 signal(SIGALRM
, SIG_DFL
);
411 sshd_exchange_identification(struct ssh
*ssh
, int sock_in
, int sock_out
)
415 int remote_major
, remote_minor
;
417 char *s
, *newline
= "\n";
418 char buf
[256]; /* Must not be larger than remote_version. */
419 char remote_version
[256]; /* Must be at least as big as buf. */
421 if ((options
.protocol
& SSH_PROTO_1
) &&
422 (options
.protocol
& SSH_PROTO_2
)) {
423 major
= PROTOCOL_MAJOR_1
;
425 } else if (options
.protocol
& SSH_PROTO_2
) {
426 major
= PROTOCOL_MAJOR_2
;
427 minor
= PROTOCOL_MINOR_2
;
430 major
= PROTOCOL_MAJOR_1
;
431 minor
= PROTOCOL_MINOR_1
;
434 xasprintf(&server_version_string
, "SSH-%d.%d-%.100s%s%s%s",
435 major
, minor
, SSH_VERSION
,
436 *options
.version_addendum
== '\0' ? "" : " ",
437 options
.version_addendum
, newline
);
439 /* Send our protocol version identification. */
440 if (atomicio(vwrite
, sock_out
, server_version_string
,
441 strlen(server_version_string
))
442 != strlen(server_version_string
)) {
443 logit("Could not write ident string to %s port %d",
444 ssh_remote_ipaddr(ssh
), ssh_remote_port(ssh
));
448 /* Read other sides version identification. */
449 memset(buf
, 0, sizeof(buf
));
450 for (i
= 0; i
< sizeof(buf
) - 1; i
++) {
451 if (atomicio(read
, sock_in
, &buf
[i
], 1) != 1) {
452 logit("Did not receive identification string "
454 ssh_remote_ipaddr(ssh
), ssh_remote_port(ssh
));
457 if (buf
[i
] == '\r') {
459 /* Kludge for F-Secure Macintosh < 1.0.2 */
461 strncmp(buf
, "SSH-1.5-W1.0", 12) == 0)
465 if (buf
[i
] == '\n') {
470 buf
[sizeof(buf
) - 1] = 0;
471 client_version_string
= xstrdup(buf
);
474 * Check that the versions match. In future this might accept
475 * several versions and set appropriate flags to handle them.
477 if (sscanf(client_version_string
, "SSH-%d.%d-%[^\n]\n",
478 &remote_major
, &remote_minor
, remote_version
) != 3) {
479 s
= "Protocol mismatch.\n";
480 (void) atomicio(vwrite
, sock_out
, s
, strlen(s
));
481 logit("Bad protocol version identification '%.100s' "
482 "from %s port %d", client_version_string
,
483 ssh_remote_ipaddr(ssh
), ssh_remote_port(ssh
));
488 debug("Client protocol version %d.%d; client software version %.100s",
489 remote_major
, remote_minor
, remote_version
);
491 ssh
->compat
= compat_datafellows(remote_version
);
493 if ((ssh
->compat
& SSH_BUG_PROBE
) != 0) {
494 logit("probed from %s port %d with %s. Don't panic.",
495 ssh_remote_ipaddr(ssh
), ssh_remote_port(ssh
),
496 client_version_string
);
499 if ((ssh
->compat
& SSH_BUG_SCANNER
) != 0) {
500 logit("scanned from %s port %d with %s. Don't panic.",
501 ssh_remote_ipaddr(ssh
), ssh_remote_port(ssh
),
502 client_version_string
);
505 if ((ssh
->compat
& SSH_BUG_RSASIGMD5
) != 0) {
506 logit("Client version \"%.100s\" uses unsafe RSA signature "
507 "scheme; disabling use of RSA keys", remote_version
);
509 if ((ssh
->compat
& SSH_BUG_DERIVEKEY
) != 0) {
510 fatal("Client version \"%.100s\" uses unsafe key agreement; "
511 "refusing connection", remote_version
);
515 switch (remote_major
) {
517 if (remote_minor
== 99) {
518 if (options
.protocol
& SSH_PROTO_2
)
524 if (!(options
.protocol
& SSH_PROTO_1
)) {
528 if (remote_minor
< 3) {
529 packet_disconnect("Your ssh version is too old and "
530 "is no longer supported. Please install a newer version.");
531 } else if (remote_minor
== 3) {
532 /* note that this disables agent-forwarding */
537 if (options
.protocol
& SSH_PROTO_2
) {
546 chop(server_version_string
);
547 debug("Local version string %.200s", server_version_string
);
550 s
= "Protocol major versions differ.\n";
551 (void) atomicio(vwrite
, sock_out
, s
, strlen(s
));
554 logit("Protocol major versions differ for %s port %d: "
556 ssh_remote_ipaddr(ssh
), ssh_remote_port(ssh
),
557 server_version_string
, client_version_string
);
562 /* Destroy the host and server keys. They will no longer be needed. */
564 destroy_sensitive_data(void)
568 if (sensitive_data
.server_key
) {
569 key_free(sensitive_data
.server_key
);
570 sensitive_data
.server_key
= NULL
;
572 for (i
= 0; i
< options
.num_host_key_files
; i
++) {
573 if (sensitive_data
.host_keys
[i
]) {
574 key_free(sensitive_data
.host_keys
[i
]);
575 sensitive_data
.host_keys
[i
] = NULL
;
577 if (sensitive_data
.host_certificates
[i
]) {
578 key_free(sensitive_data
.host_certificates
[i
]);
579 sensitive_data
.host_certificates
[i
] = NULL
;
582 sensitive_data
.ssh1_host_key
= NULL
;
583 explicit_bzero(sensitive_data
.ssh1_cookie
, SSH_SESSION_KEY_LENGTH
);
586 /* Demote private to public keys for network child */
588 demote_sensitive_data(void)
593 if (sensitive_data
.server_key
) {
594 tmp
= key_demote(sensitive_data
.server_key
);
595 key_free(sensitive_data
.server_key
);
596 sensitive_data
.server_key
= tmp
;
599 for (i
= 0; i
< options
.num_host_key_files
; i
++) {
600 if (sensitive_data
.host_keys
[i
]) {
601 tmp
= key_demote(sensitive_data
.host_keys
[i
]);
602 key_free(sensitive_data
.host_keys
[i
]);
603 sensitive_data
.host_keys
[i
] = tmp
;
604 if (tmp
->type
== KEY_RSA1
)
605 sensitive_data
.ssh1_host_key
= tmp
;
607 /* Certs do not need demotion */
610 /* We do not clear ssh1_host key and cookie. XXX - Okay Niels? */
614 privsep_preauth_child(void)
619 /* Enable challenge-response authentication for privilege separation */
620 privsep_challenge_enable();
623 /* Cache supported mechanism OIDs for later use */
624 if (options
.gss_authentication
)
625 ssh_gssapi_prepare_supported_oids();
629 arc4random_buf(rnd
, sizeof(rnd
));
631 RAND_seed(rnd
, sizeof(rnd
));
632 if ((RAND_bytes((u_char
*)rnd
, 1)) != 1)
633 fatal("%s: RAND_bytes failed", __func__
);
635 explicit_bzero(rnd
, sizeof(rnd
));
637 /* Demote the private keys to public keys. */
638 demote_sensitive_data();
640 /* Demote the child */
641 if (getuid() == 0 || geteuid() == 0) {
642 /* Change our root directory */
643 if (chroot(_PATH_PRIVSEP_CHROOT_DIR
) == -1)
644 fatal("chroot(\"%s\"): %s", _PATH_PRIVSEP_CHROOT_DIR
,
646 if (chdir("/") == -1)
647 fatal("chdir(\"/\"): %s", strerror(errno
));
649 /* Drop our privileges */
650 debug3("privsep user:group %u:%u", (u_int
)privsep_pw
->pw_uid
,
651 (u_int
)privsep_pw
->pw_gid
);
652 gidset
[0] = privsep_pw
->pw_gid
;
653 if (setgroups(1, gidset
) < 0)
654 fatal("setgroups: %.100s", strerror(errno
));
655 permanently_set_uid(privsep_pw
);
660 privsep_preauth(Authctxt
*authctxt
)
664 struct ssh_sandbox
*box
= NULL
;
666 /* Set up unprivileged child process to deal with network data */
667 pmonitor
= monitor_init();
668 /* Store a pointer to the kex for later rekeying */
669 pmonitor
->m_pkex
= &active_state
->kex
;
671 if (use_privsep
== PRIVSEP_ON
)
672 box
= ssh_sandbox_init(pmonitor
);
675 fatal("fork of unprivileged child failed");
676 } else if (pid
!= 0) {
677 debug2("Network child is on pid %ld", (long)pid
);
679 pmonitor
->m_pid
= pid
;
681 r
= ssh_get_authentication_socket(&auth_sock
);
683 error("Could not get agent socket: %s",
689 ssh_sandbox_parent_preauth(box
, pid
);
690 monitor_child_preauth(authctxt
, pmonitor
);
693 monitor_sync(pmonitor
);
695 /* Wait for the child's exit status */
696 while (waitpid(pid
, &status
, 0) < 0) {
699 pmonitor
->m_pid
= -1;
700 fatal("%s: waitpid: %s", __func__
, strerror(errno
));
702 privsep_is_preauth
= 0;
703 pmonitor
->m_pid
= -1;
704 if (WIFEXITED(status
)) {
705 if (WEXITSTATUS(status
) != 0)
706 fatal("%s: preauth child exited with status %d",
707 __func__
, WEXITSTATUS(status
));
708 } else if (WIFSIGNALED(status
))
709 fatal("%s: preauth child terminated by signal %d",
710 __func__
, WTERMSIG(status
));
712 ssh_sandbox_parent_finish(box
);
716 close(pmonitor
->m_sendfd
);
717 close(pmonitor
->m_log_recvfd
);
719 /* Arrange for logging to be sent to the monitor */
720 set_log_handler(mm_log_handler
, pmonitor
);
722 privsep_preauth_child();
723 setproctitle("%s", "[net]");
725 ssh_sandbox_child(box
);
732 privsep_postauth(Authctxt
*authctxt
)
736 #ifdef DISABLE_FD_PASSING
739 if (authctxt
->pw
->pw_uid
== 0 || options
.use_login
) {
741 /* File descriptor passing is broken or root login */
746 /* New socket pair */
747 monitor_reinit(pmonitor
);
749 pmonitor
->m_pid
= fork();
750 if (pmonitor
->m_pid
== -1)
751 fatal("fork of unprivileged child failed");
752 else if (pmonitor
->m_pid
!= 0) {
753 verbose("User child is on pid %ld", (long)pmonitor
->m_pid
);
754 buffer_clear(&loginmsg
);
755 monitor_child_postauth(pmonitor
);
763 close(pmonitor
->m_sendfd
);
764 pmonitor
->m_sendfd
= -1;
766 /* Demote the private keys to public keys. */
767 demote_sensitive_data();
770 arc4random_buf(rnd
, sizeof(rnd
));
772 RAND_seed(rnd
, sizeof(rnd
));
773 if ((RAND_bytes((u_char
*)rnd
, 1)) != 1)
774 fatal("%s: RAND_bytes failed", __func__
);
776 explicit_bzero(rnd
, sizeof(rnd
));
778 /* Drop privileges */
779 do_setusercontext(authctxt
->pw
);
782 /* It is safe now to apply the key state */
783 monitor_apply_keystate(pmonitor
);
786 * Tell the packet layer that authentication was successful, since
787 * this information is not part of the key state.
789 packet_set_authenticated();
793 list_hostkey_types(void)
802 for (i
= 0; i
< options
.num_host_key_files
; i
++) {
803 key
= sensitive_data
.host_keys
[i
];
805 key
= sensitive_data
.host_pubkeys
[i
];
806 if (key
== NULL
|| key
->type
== KEY_RSA1
)
808 /* Check that the key is accepted in HostkeyAlgorithms */
809 if (match_pattern_list(sshkey_ssh_name(key
),
810 options
.hostkeyalgorithms
, 0) != 1) {
811 debug3("%s: %s key not permitted by HostkeyAlgorithms",
812 __func__
, sshkey_ssh_name(key
));
820 if (buffer_len(&b
) > 0)
821 buffer_append(&b
, ",", 1);
822 p
= key_ssh_name(key
);
823 buffer_append(&b
, p
, strlen(p
));
825 /* for RSA we also support SHA2 signatures */
826 if (key
->type
== KEY_RSA
) {
827 p
= ",rsa-sha2-512,rsa-sha2-256";
828 buffer_append(&b
, p
, strlen(p
));
832 /* If the private key has a cert peer, then list that too */
833 key
= sensitive_data
.host_certificates
[i
];
840 case KEY_ED25519_CERT
:
841 if (buffer_len(&b
) > 0)
842 buffer_append(&b
, ",", 1);
843 p
= key_ssh_name(key
);
844 buffer_append(&b
, p
, strlen(p
));
848 if ((ret
= sshbuf_dup_string(&b
)) == NULL
)
849 fatal("%s: sshbuf_dup_string failed", __func__
);
851 debug("list_hostkey_types: %s", ret
);
856 get_hostkey_by_type(int type
, int nid
, int need_private
, struct ssh
*ssh
)
861 for (i
= 0; i
< options
.num_host_key_files
; i
++) {
866 case KEY_ED25519_CERT
:
867 key
= sensitive_data
.host_certificates
[i
];
870 key
= sensitive_data
.host_keys
[i
];
871 if (key
== NULL
&& !need_private
)
872 key
= sensitive_data
.host_pubkeys
[i
];
875 if (key
!= NULL
&& key
->type
== type
&&
876 (key
->type
!= KEY_ECDSA
|| key
->ecdsa_nid
== nid
))
877 return need_private
?
878 sensitive_data
.host_keys
[i
] : key
;
884 get_hostkey_public_by_type(int type
, int nid
, struct ssh
*ssh
)
886 return get_hostkey_by_type(type
, nid
, 0, ssh
);
890 get_hostkey_private_by_type(int type
, int nid
, struct ssh
*ssh
)
892 return get_hostkey_by_type(type
, nid
, 1, ssh
);
896 get_hostkey_by_index(int ind
)
898 if (ind
< 0 || ind
>= options
.num_host_key_files
)
900 return (sensitive_data
.host_keys
[ind
]);
904 get_hostkey_public_by_index(int ind
, struct ssh
*ssh
)
906 if (ind
< 0 || ind
>= options
.num_host_key_files
)
908 return (sensitive_data
.host_pubkeys
[ind
]);
912 get_hostkey_index(Key
*key
, int compare
, struct ssh
*ssh
)
916 for (i
= 0; i
< options
.num_host_key_files
; i
++) {
917 if (key_is_cert(key
)) {
918 if (key
== sensitive_data
.host_certificates
[i
] ||
919 (compare
&& sensitive_data
.host_certificates
[i
] &&
921 sensitive_data
.host_certificates
[i
])))
924 if (key
== sensitive_data
.host_keys
[i
] ||
925 (compare
&& sensitive_data
.host_keys
[i
] &&
926 sshkey_equal(key
, sensitive_data
.host_keys
[i
])))
928 if (key
== sensitive_data
.host_pubkeys
[i
] ||
929 (compare
&& sensitive_data
.host_pubkeys
[i
] &&
930 sshkey_equal(key
, sensitive_data
.host_pubkeys
[i
])))
937 /* Inform the client of all hostkeys */
939 notify_hostkeys(struct ssh
*ssh
)
946 /* Some clients cannot cope with the hostkeys message, skip those. */
947 if (datafellows
& SSH_BUG_HOSTKEYS
)
950 if ((buf
= sshbuf_new()) == NULL
)
951 fatal("%s: sshbuf_new", __func__
);
952 for (i
= nkeys
= 0; i
< options
.num_host_key_files
; i
++) {
953 key
= get_hostkey_public_by_index(i
, ssh
);
954 if (key
== NULL
|| key
->type
== KEY_UNSPEC
||
955 key
->type
== KEY_RSA1
|| sshkey_is_cert(key
))
957 fp
= sshkey_fingerprint(key
, options
.fingerprint_hash
,
959 debug3("%s: key %d: %s %s", __func__
, i
,
960 sshkey_ssh_name(key
), fp
);
963 packet_start(SSH2_MSG_GLOBAL_REQUEST
);
964 packet_put_cstring("hostkeys-00@openssh.com");
965 packet_put_char(0); /* want-reply */
968 if ((r
= sshkey_putb(key
, buf
)) != 0)
969 fatal("%s: couldn't put hostkey %d: %s",
970 __func__
, i
, ssh_err(r
));
971 packet_put_string(sshbuf_ptr(buf
), sshbuf_len(buf
));
974 debug3("%s: sent %d hostkeys", __func__
, nkeys
);
976 fatal("%s: no hostkeys", __func__
);
982 * returns 1 if connection should be dropped, 0 otherwise.
983 * dropping starts at connection #max_startups_begin with a probability
984 * of (max_startups_rate/100). the probability increases linearly until
985 * all connections are dropped for startups > max_startups
988 drop_connection(int startups
)
992 if (startups
< options
.max_startups_begin
)
994 if (startups
>= options
.max_startups
)
996 if (options
.max_startups_rate
== 100)
999 p
= 100 - options
.max_startups_rate
;
1000 p
*= startups
- options
.max_startups_begin
;
1001 p
/= options
.max_startups
- options
.max_startups_begin
;
1002 p
+= options
.max_startups_rate
;
1003 r
= arc4random_uniform(100);
1005 debug("drop_connection: p %d, r %d", p
, r
);
1006 return (r
< p
) ? 1 : 0;
1012 fprintf(stderr
, "%s, %s\n",
1015 SSLeay_version(SSLEAY_VERSION
)
1021 "usage: sshd [-46DdeiqTt] [-b bits] [-C connection_spec] [-c host_cert_file]\n"
1022 " [-E log_file] [-f config_file] [-g login_grace_time]\n"
1023 " [-h host_key_file] [-k key_gen_time] [-o option] [-p port]\n"
1030 send_rexec_state(int fd
, struct sshbuf
*conf
)
1035 debug3("%s: entering fd = %d config len %zu", __func__
, fd
,
1039 * Protocol from reexec master to child:
1040 * string configuration
1041 * u_int ephemeral_key_follows
1042 * bignum e (only if ephemeral_key_follows == 1)
1048 * string rngseed (only if OpenSSL is not self-seeded)
1050 if ((m
= sshbuf_new()) == NULL
)
1051 fatal("%s: sshbuf_new failed", __func__
);
1052 if ((r
= sshbuf_put_stringb(m
, conf
)) != 0)
1053 fatal("%s: buffer error: %s", __func__
, ssh_err(r
));
1056 if (sensitive_data
.server_key
!= NULL
&&
1057 sensitive_data
.server_key
->type
== KEY_RSA1
) {
1058 if ((r
= sshbuf_put_u32(m
, 1)) != 0 ||
1059 (r
= sshbuf_put_bignum1(m
,
1060 sensitive_data
.server_key
->rsa
->e
)) != 0 ||
1061 (r
= sshbuf_put_bignum1(m
,
1062 sensitive_data
.server_key
->rsa
->n
)) != 0 ||
1063 (r
= sshbuf_put_bignum1(m
,
1064 sensitive_data
.server_key
->rsa
->d
)) != 0 ||
1065 (r
= sshbuf_put_bignum1(m
,
1066 sensitive_data
.server_key
->rsa
->iqmp
)) != 0 ||
1067 (r
= sshbuf_put_bignum1(m
,
1068 sensitive_data
.server_key
->rsa
->p
)) != 0 ||
1069 (r
= sshbuf_put_bignum1(m
,
1070 sensitive_data
.server_key
->rsa
->q
)) != 0)
1071 fatal("%s: buffer error: %s", __func__
, ssh_err(r
));
1074 if ((r
= sshbuf_put_u32(m
, 1)) != 0)
1075 fatal("%s: buffer error: %s", __func__
, ssh_err(r
));
1077 #if defined(WITH_OPENSSL) && !defined(OPENSSL_PRNG_ONLY)
1078 rexec_send_rng_seed(m
);
1081 if (ssh_msg_send(fd
, 0, m
) == -1)
1082 fatal("%s: ssh_msg_send failed", __func__
);
1086 debug3("%s: done", __func__
);
1090 recv_rexec_state(int fd
, Buffer
*conf
)
1096 debug3("%s: entering fd = %d", __func__
, fd
);
1100 if (ssh_msg_recv(fd
, &m
) == -1)
1101 fatal("%s: ssh_msg_recv failed", __func__
);
1102 if (buffer_get_char(&m
) != 0)
1103 fatal("%s: rexec version mismatch", __func__
);
1105 cp
= buffer_get_string(&m
, &len
);
1107 buffer_append(conf
, cp
, len
);
1110 if (buffer_get_int(&m
)) {
1112 if (sensitive_data
.server_key
!= NULL
)
1113 key_free(sensitive_data
.server_key
);
1114 sensitive_data
.server_key
= key_new_private(KEY_RSA1
);
1115 buffer_get_bignum(&m
, sensitive_data
.server_key
->rsa
->e
);
1116 buffer_get_bignum(&m
, sensitive_data
.server_key
->rsa
->n
);
1117 buffer_get_bignum(&m
, sensitive_data
.server_key
->rsa
->d
);
1118 buffer_get_bignum(&m
, sensitive_data
.server_key
->rsa
->iqmp
);
1119 buffer_get_bignum(&m
, sensitive_data
.server_key
->rsa
->p
);
1120 buffer_get_bignum(&m
, sensitive_data
.server_key
->rsa
->q
);
1121 if (rsa_generate_additional_parameters(
1122 sensitive_data
.server_key
->rsa
) != 0)
1123 fatal("%s: rsa_generate_additional_parameters "
1128 #if defined(WITH_OPENSSL) && !defined(OPENSSL_PRNG_ONLY)
1129 rexec_recv_rng_seed(&m
);
1134 debug3("%s: done", __func__
);
1137 /* Accept a connection from inetd */
1139 server_accept_inetd(int *sock_in
, int *sock_out
)
1145 close(REEXEC_CONFIG_PASS_FD
);
1146 *sock_in
= *sock_out
= dup(STDIN_FILENO
);
1148 startup_pipe
= dup(REEXEC_STARTUP_PIPE_FD
);
1149 close(REEXEC_STARTUP_PIPE_FD
);
1152 *sock_in
= dup(STDIN_FILENO
);
1153 *sock_out
= dup(STDOUT_FILENO
);
1156 * We intentionally do not close the descriptors 0, 1, and 2
1157 * as our code for setting the descriptors won't work if
1158 * ttyfd happens to be one of those.
1160 if ((fd
= open(_PATH_DEVNULL
, O_RDWR
, 0)) != -1) {
1161 dup2(fd
, STDIN_FILENO
);
1162 dup2(fd
, STDOUT_FILENO
);
1164 dup2(fd
, STDERR_FILENO
);
1165 if (fd
> (log_stderr
? STDERR_FILENO
: STDOUT_FILENO
))
1168 debug("inetd sockets after dupping: %d, %d", *sock_in
, *sock_out
);
1172 * Listen for TCP connections
1177 int ret
, listen_sock
, on
= 1;
1178 struct addrinfo
*ai
;
1179 char ntop
[NI_MAXHOST
], strport
[NI_MAXSERV
];
1181 for (ai
= options
.listen_addrs
; ai
; ai
= ai
->ai_next
) {
1182 if (ai
->ai_family
!= AF_INET
&& ai
->ai_family
!= AF_INET6
)
1184 if (num_listen_socks
>= MAX_LISTEN_SOCKS
)
1185 fatal("Too many listen sockets. "
1186 "Enlarge MAX_LISTEN_SOCKS");
1187 if ((ret
= getnameinfo(ai
->ai_addr
, ai
->ai_addrlen
,
1188 ntop
, sizeof(ntop
), strport
, sizeof(strport
),
1189 NI_NUMERICHOST
|NI_NUMERICSERV
)) != 0) {
1190 error("getnameinfo failed: %.100s",
1191 ssh_gai_strerror(ret
));
1194 /* Create socket for listening. */
1195 listen_sock
= socket(ai
->ai_family
, ai
->ai_socktype
,
1197 if (listen_sock
< 0) {
1198 /* kernel may not support ipv6 */
1199 verbose("socket: %.100s", strerror(errno
));
1202 if (set_nonblock(listen_sock
) == -1) {
1207 * Set socket options.
1208 * Allow local port reuse in TIME_WAIT.
1210 if (setsockopt(listen_sock
, SOL_SOCKET
, SO_REUSEADDR
,
1211 &on
, sizeof(on
)) == -1)
1212 error("setsockopt SO_REUSEADDR: %s", strerror(errno
));
1214 /* Only communicate in IPv6 over AF_INET6 sockets. */
1215 if (ai
->ai_family
== AF_INET6
)
1216 sock_set_v6only(listen_sock
);
1218 debug("Bind to port %s on %s.", strport
, ntop
);
1220 /* Bind the socket to the desired port. */
1221 if (bind(listen_sock
, ai
->ai_addr
, ai
->ai_addrlen
) < 0) {
1222 error("Bind to port %s on %s failed: %.200s.",
1223 strport
, ntop
, strerror(errno
));
1227 listen_socks
[num_listen_socks
] = listen_sock
;
1230 /* Start listening on the port. */
1231 if (listen(listen_sock
, SSH_LISTEN_BACKLOG
) < 0)
1232 fatal("listen on [%s]:%s: %.100s",
1233 ntop
, strport
, strerror(errno
));
1234 logit("Server listening on %s port %s.", ntop
, strport
);
1236 freeaddrinfo(options
.listen_addrs
);
1238 if (!num_listen_socks
)
1239 fatal("Cannot bind any address.");
1243 * The main TCP accept loop. Note that, for the non-debug case, returns
1244 * from this function are in a forked subprocess.
1247 server_accept_loop(int *sock_in
, int *sock_out
, int *newsock
, int *config_s
)
1250 int i
, j
, ret
, maxfd
;
1251 int key_used
= 0, startups
= 0;
1252 int startup_p
[2] = { -1 , -1 };
1253 struct sockaddr_storage from
;
1258 /* setup fd set for accept */
1261 for (i
= 0; i
< num_listen_socks
; i
++)
1262 if (listen_socks
[i
] > maxfd
)
1263 maxfd
= listen_socks
[i
];
1264 /* pipes connected to unauthenticated childs */
1265 startup_pipes
= xcalloc(options
.max_startups
, sizeof(int));
1266 for (i
= 0; i
< options
.max_startups
; i
++)
1267 startup_pipes
[i
] = -1;
1270 * Stay listening for connections until the system crashes or
1271 * the daemon is killed with a signal.
1274 if (received_sighup
)
1277 fdset
= xcalloc(howmany(maxfd
+ 1, NFDBITS
),
1280 for (i
= 0; i
< num_listen_socks
; i
++)
1281 FD_SET(listen_socks
[i
], fdset
);
1282 for (i
= 0; i
< options
.max_startups
; i
++)
1283 if (startup_pipes
[i
] != -1)
1284 FD_SET(startup_pipes
[i
], fdset
);
1286 /* Wait in select until there is a connection. */
1287 ret
= select(maxfd
+1, fdset
, NULL
, NULL
, NULL
);
1288 if (ret
< 0 && errno
!= EINTR
)
1289 error("select: %.100s", strerror(errno
));
1290 if (received_sigterm
) {
1291 logit("Received signal %d; terminating.",
1292 (int) received_sigterm
);
1293 close_listen_socks();
1294 if (options
.pid_file
!= NULL
)
1295 unlink(options
.pid_file
);
1296 exit(received_sigterm
== SIGTERM
? 0 : 255);
1298 if (key_used
&& key_do_regen
) {
1299 generate_ephemeral_server_key();
1306 for (i
= 0; i
< options
.max_startups
; i
++)
1307 if (startup_pipes
[i
] != -1 &&
1308 FD_ISSET(startup_pipes
[i
], fdset
)) {
1310 * the read end of the pipe is ready
1311 * if the child has closed the pipe
1312 * after successful authentication
1313 * or if the child has died
1315 close(startup_pipes
[i
]);
1316 startup_pipes
[i
] = -1;
1319 for (i
= 0; i
< num_listen_socks
; i
++) {
1320 if (!FD_ISSET(listen_socks
[i
], fdset
))
1322 fromlen
= sizeof(from
);
1323 *newsock
= accept(listen_socks
[i
],
1324 (struct sockaddr
*)&from
, &fromlen
);
1326 if (errno
!= EINTR
&& errno
!= EWOULDBLOCK
&&
1327 errno
!= ECONNABORTED
&& errno
!= EAGAIN
)
1328 error("accept: %.100s",
1330 if (errno
== EMFILE
|| errno
== ENFILE
)
1334 if (unset_nonblock(*newsock
) == -1) {
1338 if (drop_connection(startups
) == 1) {
1339 debug("drop connection #%d", startups
);
1343 if (pipe(startup_p
) == -1) {
1348 if (rexec_flag
&& socketpair(AF_UNIX
,
1349 SOCK_STREAM
, 0, config_s
) == -1) {
1350 error("reexec socketpair: %s",
1353 close(startup_p
[0]);
1354 close(startup_p
[1]);
1358 for (j
= 0; j
< options
.max_startups
; j
++)
1359 if (startup_pipes
[j
] == -1) {
1360 startup_pipes
[j
] = startup_p
[0];
1361 if (maxfd
< startup_p
[0])
1362 maxfd
= startup_p
[0];
1368 * Got connection. Fork a child to handle it, unless
1369 * we are in debugging mode.
1373 * In debugging mode. Close the listening
1374 * socket, and start processing the
1375 * connection without forking.
1377 debug("Server will not fork when running in debugging mode.");
1378 close_listen_socks();
1379 *sock_in
= *newsock
;
1380 *sock_out
= *newsock
;
1381 close(startup_p
[0]);
1382 close(startup_p
[1]);
1386 send_rexec_state(config_s
[0],
1394 * Normal production daemon. Fork, and have
1395 * the child process the connection. The
1396 * parent continues listening.
1398 platform_pre_fork();
1399 if ((pid
= fork()) == 0) {
1401 * Child. Close the listening and
1402 * max_startup sockets. Start using
1403 * the accepted socket. Reinitialize
1404 * logging (since our pid has changed).
1405 * We break out of the loop to handle
1408 platform_post_fork_child();
1409 startup_pipe
= startup_p
[1];
1410 close_startup_pipes();
1411 close_listen_socks();
1412 *sock_in
= *newsock
;
1413 *sock_out
= *newsock
;
1414 log_init(__progname
,
1416 options
.log_facility
,
1423 /* Parent. Stay in the loop. */
1424 platform_post_fork_parent(pid
);
1426 error("fork: %.100s", strerror(errno
));
1428 debug("Forked child %ld.", (long)pid
);
1430 close(startup_p
[1]);
1433 send_rexec_state(config_s
[0], &cfg
);
1439 * Mark that the key has been used (it
1440 * was "given" to the child).
1442 if ((options
.protocol
& SSH_PROTO_1
) &&
1444 /* Schedule server key regeneration alarm. */
1445 signal(SIGALRM
, key_regeneration_alarm
);
1446 alarm(options
.key_regeneration_time
);
1453 * Ensure that our random state differs
1454 * from that of the child
1457 arc4random_buf(rnd
, sizeof(rnd
));
1459 RAND_seed(rnd
, sizeof(rnd
));
1460 if ((RAND_bytes((u_char
*)rnd
, 1)) != 1)
1461 fatal("%s: RAND_bytes failed", __func__
);
1463 explicit_bzero(rnd
, sizeof(rnd
));
1466 /* child process check (or debug mode) */
1467 if (num_listen_socks
< 0)
1473 * If IP options are supported, make sure there are none (log and
1474 * return an error if any are found). Basically we are worried about
1475 * source routing; it can be used to pretend you are somebody
1476 * (ip-address) you are not. That itself may be "almost acceptable"
1477 * under certain circumstances, but rhosts autentication is useless
1478 * if source routing is accepted. Notice also that if we just dropped
1479 * source routing here, the other side could use IP spoofing to do
1480 * rest of the interaction and could still bypass security. So we
1481 * exit here if we detect any IP options.
1484 check_ip_options(struct ssh
*ssh
)
1487 int sock_in
= ssh_packet_get_connection_in(ssh
);
1488 struct sockaddr_storage from
;
1489 socklen_t option_size
, i
, fromlen
= sizeof(from
);
1491 char text
[sizeof(opts
) * 3 + 1];
1493 memset(&from
, 0, sizeof(from
));
1494 if (getpeername(sock_in
, (struct sockaddr
*)&from
,
1497 if (from
.ss_family
!= AF_INET
)
1499 /* XXX IPv6 options? */
1501 if (getsockopt(sock_in
, IPPROTO_IP
, IP_OPTIONS
, opts
,
1502 &option_size
) >= 0 && option_size
!= 0) {
1504 for (i
= 0; i
< option_size
; i
++)
1505 snprintf(text
+ i
*3, sizeof(text
) - i
*3,
1507 fatal("Connection from %.100s port %d with IP opts: %.800s",
1508 ssh_remote_ipaddr(ssh
), ssh_remote_port(ssh
), text
);
1511 #endif /* IP_OPTIONS */
1515 * Main program for the daemon.
1518 main(int ac
, char **av
)
1520 struct ssh
*ssh
= NULL
;
1521 extern char *optarg
;
1523 int r
, opt
, i
, j
, on
= 1;
1524 int sock_in
= -1, sock_out
= -1, newsock
= -1;
1525 const char *remote_ip
;
1527 char *fp
, *line
, *laddr
, *logfile
= NULL
;
1528 int config_s
[2] = { -1 , -1 };
1530 u_int64_t ibytes
, obytes
;
1536 struct connection_info
*connection_info
= get_connection_info(0, 0);
1538 ssh_malloc_init(); /* must be called before any mallocs */
1540 #ifdef HAVE_SECUREWARE
1541 (void)set_auth_parameters(ac
, av
);
1543 __progname
= ssh_get_progname(av
[0]);
1545 /* Save argv. Duplicate so setproctitle emulation doesn't clobber it */
1548 saved_argv
= xcalloc(ac
+ 1, sizeof(*saved_argv
));
1549 for (i
= 0; i
< ac
; i
++)
1550 saved_argv
[i
] = xstrdup(av
[i
]);
1551 saved_argv
[i
] = NULL
;
1553 #ifndef HAVE_SETPROCTITLE
1554 /* Prepare for later setproctitle emulation */
1555 compat_init_setproctitle(ac
, av
);
1559 if (geteuid() == 0 && setgroups(0, NULL
) == -1)
1560 debug("setgroups(): %.200s", strerror(errno
));
1562 /* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
1565 /* Initialize configuration options to their default values. */
1566 initialize_server_options(&options
);
1568 /* Parse command-line arguments. */
1569 while ((opt
= getopt(ac
, av
,
1570 "C:E:b:c:f:g:h:k:o:p:u:46DQRTdeiqrt")) != -1) {
1573 options
.address_family
= AF_INET
;
1576 options
.address_family
= AF_INET6
;
1579 config_file_name
= optarg
;
1582 if (options
.num_host_cert_files
>= MAX_HOSTCERTS
) {
1583 fprintf(stderr
, "too many host certificates.\n");
1586 options
.host_cert_files
[options
.num_host_cert_files
++] =
1587 derelativise_path(optarg
);
1590 if (debug_flag
== 0) {
1592 options
.log_level
= SYSLOG_LEVEL_DEBUG1
;
1593 } else if (options
.log_level
< SYSLOG_LEVEL_DEBUG3
)
1594 options
.log_level
++;
1619 options
.log_level
= SYSLOG_LEVEL_QUIET
;
1622 options
.server_key_bits
= (int)strtonum(optarg
, 256,
1626 options
.ports_from_cmdline
= 1;
1627 if (options
.num_ports
>= MAX_PORTS
) {
1628 fprintf(stderr
, "too many ports.\n");
1631 options
.ports
[options
.num_ports
++] = a2port(optarg
);
1632 if (options
.ports
[options
.num_ports
-1] <= 0) {
1633 fprintf(stderr
, "Bad port number.\n");
1638 if ((options
.login_grace_time
= convtime(optarg
)) == -1) {
1639 fprintf(stderr
, "Invalid login grace time.\n");
1644 if ((options
.key_regeneration_time
= convtime(optarg
)) == -1) {
1645 fprintf(stderr
, "Invalid key regeneration interval.\n");
1650 if (options
.num_host_key_files
>= MAX_HOSTKEYS
) {
1651 fprintf(stderr
, "too many host keys.\n");
1654 options
.host_key_files
[options
.num_host_key_files
++] =
1655 derelativise_path(optarg
);
1664 if (parse_server_match_testspec(connection_info
,
1669 utmp_len
= (u_int
)strtonum(optarg
, 0, HOST_NAME_MAX
+1+1, NULL
);
1670 if (utmp_len
> HOST_NAME_MAX
+1) {
1671 fprintf(stderr
, "Invalid utmp length.\n");
1676 line
= xstrdup(optarg
);
1677 if (process_server_config_line(&options
, line
,
1678 "command-line", 0, NULL
, NULL
) != 0)
1688 if (rexeced_flag
|| inetd_flag
)
1690 if (!test_flag
&& (rexec_flag
&& (av
[0] == NULL
|| *av
[0] != '/')))
1691 fatal("sshd re-exec requires execution with an absolute path");
1693 closefrom(REEXEC_MIN_FREE_FD
);
1695 closefrom(REEXEC_DEVCRYPTO_RESERVED_FD
);
1698 OpenSSL_add_all_algorithms();
1701 /* If requested, redirect the logs to the specified logfile. */
1702 if (logfile
!= NULL
)
1703 log_redirect_stderr_to(logfile
);
1705 * Force logging to stderr until we have loaded the private host
1706 * key (unless started from inetd)
1708 log_init(__progname
,
1709 options
.log_level
== SYSLOG_LEVEL_NOT_SET
?
1710 SYSLOG_LEVEL_INFO
: options
.log_level
,
1711 options
.log_facility
== SYSLOG_FACILITY_NOT_SET
?
1712 SYSLOG_FACILITY_AUTH
: options
.log_facility
,
1713 log_stderr
|| !inetd_flag
);
1716 * Unset KRB5CCNAME, otherwise the user's session may inherit it from
1717 * root's environment
1719 if (getenv("KRB5CCNAME") != NULL
)
1720 (void) unsetenv("KRB5CCNAME");
1723 /* Cray can define user privs drop all privs now!
1724 * Not needed on PRIV_SU systems!
1729 sensitive_data
.server_key
= NULL
;
1730 sensitive_data
.ssh1_host_key
= NULL
;
1731 sensitive_data
.have_ssh1_key
= 0;
1732 sensitive_data
.have_ssh2_key
= 0;
1735 * If we're doing an extended config test, make sure we have all of
1736 * the parameters we need. If we're not doing an extended test,
1737 * do not silently ignore connection test params.
1739 if (test_flag
>= 2 && server_match_spec_complete(connection_info
) == 0)
1740 fatal("user, host and addr are all required when testing "
1742 if (test_flag
< 2 && server_match_spec_complete(connection_info
) >= 0)
1743 fatal("Config test connection parameter (-C) provided without "
1746 /* Fetch our configuration */
1749 recv_rexec_state(REEXEC_CONFIG_PASS_FD
, &cfg
);
1750 else if (strcasecmp(config_file_name
, "none") != 0)
1751 load_server_config(config_file_name
, &cfg
);
1753 parse_server_config(&options
, rexeced_flag
? "rexec" : config_file_name
,
1758 /* Fill in default values for those options not explicitly set. */
1759 fill_default_server_options(&options
);
1761 /* challenge-response is implemented via keyboard interactive */
1762 if (options
.challenge_response_authentication
)
1763 options
.kbd_interactive_authentication
= 1;
1765 /* Check that options are sensible */
1766 if (options
.authorized_keys_command_user
== NULL
&&
1767 (options
.authorized_keys_command
!= NULL
&&
1768 strcasecmp(options
.authorized_keys_command
, "none") != 0))
1769 fatal("AuthorizedKeysCommand set without "
1770 "AuthorizedKeysCommandUser");
1771 if (options
.authorized_principals_command_user
== NULL
&&
1772 (options
.authorized_principals_command
!= NULL
&&
1773 strcasecmp(options
.authorized_principals_command
, "none") != 0))
1774 fatal("AuthorizedPrincipalsCommand set without "
1775 "AuthorizedPrincipalsCommandUser");
1778 * Check whether there is any path through configured auth methods.
1779 * Unfortunately it is not possible to verify this generally before
1780 * daemonisation in the presence of Match block, but this catches
1781 * and warns for trivial misconfigurations that could break login.
1783 if (options
.num_auth_methods
!= 0) {
1784 if ((options
.protocol
& SSH_PROTO_1
))
1785 fatal("AuthenticationMethods is not supported with "
1787 for (n
= 0; n
< options
.num_auth_methods
; n
++) {
1788 if (auth2_methods_valid(options
.auth_methods
[n
],
1792 if (n
>= options
.num_auth_methods
)
1793 fatal("AuthenticationMethods cannot be satisfied by "
1794 "enabled authentication methods");
1797 /* set default channel AF */
1798 channel_set_af(options
.address_family
);
1800 /* Check that there are no remaining arguments. */
1802 fprintf(stderr
, "Extra argument %s.\n", av
[optind
]);
1806 debug("sshd version %s, %s", SSH_VERSION
,
1808 SSLeay_version(SSLEAY_VERSION
)
1814 /* Store privilege separation user for later use if required. */
1815 if ((privsep_pw
= getpwnam(SSH_PRIVSEP_USER
)) == NULL
) {
1816 if (use_privsep
|| options
.kerberos_authentication
)
1817 fatal("Privilege separation user %s does not exist",
1820 explicit_bzero(privsep_pw
->pw_passwd
,
1821 strlen(privsep_pw
->pw_passwd
));
1822 privsep_pw
= pwcopy(privsep_pw
);
1823 free(privsep_pw
->pw_passwd
);
1824 privsep_pw
->pw_passwd
= xstrdup("*");
1828 /* load host keys */
1829 sensitive_data
.host_keys
= xcalloc(options
.num_host_key_files
,
1831 sensitive_data
.host_pubkeys
= xcalloc(options
.num_host_key_files
,
1834 if (options
.host_key_agent
) {
1835 if (strcmp(options
.host_key_agent
, SSH_AUTHSOCKET_ENV_NAME
))
1836 setenv(SSH_AUTHSOCKET_ENV_NAME
,
1837 options
.host_key_agent
, 1);
1838 if ((r
= ssh_get_authentication_socket(NULL
)) == 0)
1841 error("Could not connect to agent \"%s\": %s",
1842 options
.host_key_agent
, ssh_err(r
));
1845 for (i
= 0; i
< options
.num_host_key_files
; i
++) {
1846 if (options
.host_key_files
[i
] == NULL
)
1848 key
= key_load_private(options
.host_key_files
[i
], "", NULL
);
1849 pubkey
= key_load_public(options
.host_key_files
[i
], NULL
);
1850 if (pubkey
== NULL
&& key
!= NULL
)
1851 pubkey
= key_demote(key
);
1852 sensitive_data
.host_keys
[i
] = key
;
1853 sensitive_data
.host_pubkeys
[i
] = pubkey
;
1855 if (key
== NULL
&& pubkey
!= NULL
&& pubkey
->type
!= KEY_RSA1
&&
1857 debug("will rely on agent for hostkey %s",
1858 options
.host_key_files
[i
]);
1859 keytype
= pubkey
->type
;
1860 } else if (key
!= NULL
) {
1861 keytype
= key
->type
;
1863 error("Could not load host key: %s",
1864 options
.host_key_files
[i
]);
1865 sensitive_data
.host_keys
[i
] = NULL
;
1866 sensitive_data
.host_pubkeys
[i
] = NULL
;
1872 sensitive_data
.ssh1_host_key
= key
;
1873 sensitive_data
.have_ssh1_key
= 1;
1879 if (have_agent
|| key
!= NULL
)
1880 sensitive_data
.have_ssh2_key
= 1;
1883 if ((fp
= sshkey_fingerprint(pubkey
, options
.fingerprint_hash
,
1884 SSH_FP_DEFAULT
)) == NULL
)
1885 fatal("sshkey_fingerprint failed");
1886 debug("%s host key #%d: %s %s",
1887 key
? "private" : "agent", i
, keytype
== KEY_RSA1
?
1888 sshkey_type(pubkey
) : sshkey_ssh_name(pubkey
), fp
);
1891 if ((options
.protocol
& SSH_PROTO_1
) && !sensitive_data
.have_ssh1_key
) {
1892 logit("Disabling protocol version 1. Could not load host key");
1893 options
.protocol
&= ~SSH_PROTO_1
;
1895 if ((options
.protocol
& SSH_PROTO_2
) && !sensitive_data
.have_ssh2_key
) {
1896 logit("Disabling protocol version 2. Could not load host key");
1897 options
.protocol
&= ~SSH_PROTO_2
;
1899 if (!(options
.protocol
& (SSH_PROTO_1
|SSH_PROTO_2
))) {
1900 logit("sshd: no hostkeys available -- exiting.");
1905 * Load certificates. They are stored in an array at identical
1906 * indices to the public keys that they relate to.
1908 sensitive_data
.host_certificates
= xcalloc(options
.num_host_key_files
,
1910 for (i
= 0; i
< options
.num_host_key_files
; i
++)
1911 sensitive_data
.host_certificates
[i
] = NULL
;
1913 for (i
= 0; i
< options
.num_host_cert_files
; i
++) {
1914 if (options
.host_cert_files
[i
] == NULL
)
1916 key
= key_load_public(options
.host_cert_files
[i
], NULL
);
1918 error("Could not load host certificate: %s",
1919 options
.host_cert_files
[i
]);
1922 if (!key_is_cert(key
)) {
1923 error("Certificate file is not a certificate: %s",
1924 options
.host_cert_files
[i
]);
1928 /* Find matching private key */
1929 for (j
= 0; j
< options
.num_host_key_files
; j
++) {
1930 if (key_equal_public(key
,
1931 sensitive_data
.host_keys
[j
])) {
1932 sensitive_data
.host_certificates
[j
] = key
;
1936 if (j
>= options
.num_host_key_files
) {
1937 error("No matching private key for certificate: %s",
1938 options
.host_cert_files
[i
]);
1942 sensitive_data
.host_certificates
[j
] = key
;
1943 debug("host certificate: #%d type %d %s", j
, key
->type
,
1948 /* Check certain values for sanity. */
1949 if (options
.protocol
& SSH_PROTO_1
) {
1950 if (options
.server_key_bits
< SSH_RSA_MINIMUM_MODULUS_SIZE
||
1951 options
.server_key_bits
> OPENSSL_RSA_MAX_MODULUS_BITS
) {
1952 fprintf(stderr
, "Bad server key size.\n");
1956 * Check that server and host key lengths differ sufficiently. This
1957 * is necessary to make double encryption work with rsaref. Oh, I
1958 * hate software patents. I dont know if this can go? Niels
1960 if (options
.server_key_bits
>
1961 BN_num_bits(sensitive_data
.ssh1_host_key
->rsa
->n
) -
1962 SSH_KEY_BITS_RESERVED
&& options
.server_key_bits
<
1963 BN_num_bits(sensitive_data
.ssh1_host_key
->rsa
->n
) +
1964 SSH_KEY_BITS_RESERVED
) {
1965 options
.server_key_bits
=
1966 BN_num_bits(sensitive_data
.ssh1_host_key
->rsa
->n
) +
1967 SSH_KEY_BITS_RESERVED
;
1968 debug("Forcing server key to %d bits to make it differ from host key.",
1969 options
.server_key_bits
);
1977 if ((stat(_PATH_PRIVSEP_CHROOT_DIR
, &st
) == -1) ||
1978 (S_ISDIR(st
.st_mode
) == 0))
1979 fatal("Missing privilege separation directory: %s",
1980 _PATH_PRIVSEP_CHROOT_DIR
);
1983 if (check_ntsec(_PATH_PRIVSEP_CHROOT_DIR
) &&
1984 (st
.st_uid
!= getuid () ||
1985 (st
.st_mode
& (S_IWGRP
|S_IWOTH
)) != 0))
1987 if (st
.st_uid
!= 0 || (st
.st_mode
& (S_IWGRP
|S_IWOTH
)) != 0)
1989 fatal("%s must be owned by root and not group or "
1990 "world-writable.", _PATH_PRIVSEP_CHROOT_DIR
);
1993 if (test_flag
> 1) {
1994 if (server_match_spec_complete(connection_info
) == 1)
1995 parse_server_match_config(&options
, connection_info
);
1996 dump_config(&options
);
1999 /* Configuration looks good, so exit if in test mode. */
2004 * Clear out any supplemental groups we may have inherited. This
2005 * prevents inadvertent creation of files with bad modes (in the
2006 * portable version at least, it's certainly possible for PAM
2007 * to create a file, and we can't control the code in every
2008 * module which might be used).
2010 if (setgroups(0, NULL
) < 0)
2011 debug("setgroups() failed: %.200s", strerror(errno
));
2014 rexec_argv
= xcalloc(rexec_argc
+ 2, sizeof(char *));
2015 for (i
= 0; i
< rexec_argc
; i
++) {
2016 debug("rexec_argv[%d]='%s'", i
, saved_argv
[i
]);
2017 rexec_argv
[i
] = saved_argv
[i
];
2019 rexec_argv
[rexec_argc
] = "-R";
2020 rexec_argv
[rexec_argc
+ 1] = NULL
;
2023 /* Ensure that umask disallows at least group and world write */
2024 new_umask
= umask(0077) | 0022;
2025 (void) umask(new_umask
);
2027 /* Initialize the log (it is reinitialized below in case we forked). */
2028 if (debug_flag
&& (!inetd_flag
|| rexeced_flag
))
2030 log_init(__progname
, options
.log_level
, options
.log_facility
, log_stderr
);
2033 * If not in debugging mode, and not started from inetd, disconnect
2034 * from the controlling terminal, and fork. The original process
2037 if (!(debug_flag
|| inetd_flag
|| no_daemon_flag
)) {
2040 #endif /* TIOCNOTTY */
2041 if (daemon(0, 0) < 0)
2042 fatal("daemon() failed: %.200s", strerror(errno
));
2044 /* Disconnect from the controlling tty. */
2046 fd
= open(_PATH_TTY
, O_RDWR
| O_NOCTTY
);
2048 (void) ioctl(fd
, TIOCNOTTY
, NULL
);
2051 #endif /* TIOCNOTTY */
2053 /* Reinitialize the log (because of the fork above). */
2054 log_init(__progname
, options
.log_level
, options
.log_facility
, log_stderr
);
2056 /* Chdir to the root directory so that the current disk can be
2057 unmounted if desired. */
2058 if (chdir("/") == -1)
2059 error("chdir(\"/\"): %s", strerror(errno
));
2061 /* ignore SIGPIPE */
2062 signal(SIGPIPE
, SIG_IGN
);
2064 /* Get a connection, either from inetd or a listening TCP socket */
2066 server_accept_inetd(&sock_in
, &sock_out
);
2068 platform_pre_listen();
2071 if (options
.protocol
& SSH_PROTO_1
)
2072 generate_ephemeral_server_key();
2074 signal(SIGHUP
, sighup_handler
);
2075 signal(SIGCHLD
, main_sigchld_handler
);
2076 signal(SIGTERM
, sigterm_handler
);
2077 signal(SIGQUIT
, sigterm_handler
);
2080 * Write out the pid file after the sigterm handler
2081 * is setup and the listen sockets are bound
2083 if (options
.pid_file
!= NULL
&& !debug_flag
) {
2084 FILE *f
= fopen(options
.pid_file
, "w");
2087 error("Couldn't create pid file \"%s\": %s",
2088 options
.pid_file
, strerror(errno
));
2090 fprintf(f
, "%ld\n", (long) getpid());
2095 /* Accept a connection and return in a forked child */
2096 server_accept_loop(&sock_in
, &sock_out
,
2097 &newsock
, config_s
);
2100 /* This is the child processing a new connection. */
2101 setproctitle("%s", "[accepted]");
2104 * Create a new session and process group since the 4.4BSD
2105 * setlogin() affects the entire process group. We don't
2106 * want the child to be able to affect the parent.
2108 #if !defined(SSHD_ACQUIRES_CTTY)
2110 * If setsid is called, on some platforms sshd will later acquire a
2111 * controlling terminal which will result in "could not set
2112 * controlling tty" errors.
2114 if (!debug_flag
&& !inetd_flag
&& setsid() < 0)
2115 error("setsid: %.100s", strerror(errno
));
2121 debug("rexec start in %d out %d newsock %d pipe %d sock %d",
2122 sock_in
, sock_out
, newsock
, startup_pipe
, config_s
[0]);
2123 dup2(newsock
, STDIN_FILENO
);
2124 dup2(STDIN_FILENO
, STDOUT_FILENO
);
2125 if (startup_pipe
== -1)
2126 close(REEXEC_STARTUP_PIPE_FD
);
2127 else if (startup_pipe
!= REEXEC_STARTUP_PIPE_FD
) {
2128 dup2(startup_pipe
, REEXEC_STARTUP_PIPE_FD
);
2129 close(startup_pipe
);
2130 startup_pipe
= REEXEC_STARTUP_PIPE_FD
;
2133 dup2(config_s
[1], REEXEC_CONFIG_PASS_FD
);
2136 execv(rexec_argv
[0], rexec_argv
);
2138 /* Reexec has failed, fall back and continue */
2139 error("rexec of %s failed: %s", rexec_argv
[0], strerror(errno
));
2140 recv_rexec_state(REEXEC_CONFIG_PASS_FD
, NULL
);
2141 log_init(__progname
, options
.log_level
,
2142 options
.log_facility
, log_stderr
);
2145 close(REEXEC_CONFIG_PASS_FD
);
2146 newsock
= sock_out
= sock_in
= dup(STDIN_FILENO
);
2147 if ((fd
= open(_PATH_DEVNULL
, O_RDWR
, 0)) != -1) {
2148 dup2(fd
, STDIN_FILENO
);
2149 dup2(fd
, STDOUT_FILENO
);
2150 if (fd
> STDERR_FILENO
)
2153 debug("rexec cleanup in %d out %d newsock %d pipe %d sock %d",
2154 sock_in
, sock_out
, newsock
, startup_pipe
, config_s
[0]);
2157 /* Executed child processes don't need these. */
2158 fcntl(sock_out
, F_SETFD
, FD_CLOEXEC
);
2159 fcntl(sock_in
, F_SETFD
, FD_CLOEXEC
);
2162 * Disable the key regeneration alarm. We will not regenerate the
2163 * key since we are no longer in a position to give it to anyone. We
2164 * will not restart on SIGHUP since it no longer makes sense.
2167 signal(SIGALRM
, SIG_DFL
);
2168 signal(SIGHUP
, SIG_DFL
);
2169 signal(SIGTERM
, SIG_DFL
);
2170 signal(SIGQUIT
, SIG_DFL
);
2171 signal(SIGCHLD
, SIG_DFL
);
2172 signal(SIGINT
, SIG_DFL
);
2175 * Register our connection. This turns encryption off because we do
2178 packet_set_connection(sock_in
, sock_out
);
2179 packet_set_server();
2180 ssh
= active_state
; /* XXX */
2181 check_ip_options(ssh
);
2183 /* Set SO_KEEPALIVE if requested. */
2184 if (options
.tcp_keep_alive
&& packet_connection_is_on_socket() &&
2185 setsockopt(sock_in
, SOL_SOCKET
, SO_KEEPALIVE
, &on
, sizeof(on
)) < 0)
2186 error("setsockopt SO_KEEPALIVE: %.100s", strerror(errno
));
2188 if ((remote_port
= ssh_remote_port(ssh
)) < 0) {
2189 debug("ssh_remote_port failed");
2194 * The rest of the code depends on the fact that
2195 * ssh_remote_ipaddr() caches the remote ip, even if
2196 * the socket goes away.
2198 remote_ip
= ssh_remote_ipaddr(ssh
);
2200 #ifdef SSH_AUDIT_EVENTS
2201 audit_connection_from(remote_ip
, remote_port
);
2204 /* Log the connection. */
2205 laddr
= get_local_ipaddr(sock_in
);
2206 verbose("Connection from %s port %d on %s port %d",
2207 remote_ip
, remote_port
, laddr
, ssh_local_port(ssh
));
2211 * We don't want to listen forever unless the other side
2212 * successfully authenticates itself. So we set up an alarm which is
2213 * cleared after successful authentication. A limit of zero
2214 * indicates no limit. Note that we don't set the alarm in debugging
2215 * mode; it is just annoying to have the server exit just when you
2216 * are about to discover the bug.
2218 signal(SIGALRM
, grace_alarm_handler
);
2220 alarm(options
.login_grace_time
);
2222 sshd_exchange_identification(ssh
, sock_in
, sock_out
);
2224 /* In inetd mode, generate ephemeral key only for proto 1 connections */
2225 if (!compat20
&& inetd_flag
&& sensitive_data
.server_key
== NULL
)
2226 generate_ephemeral_server_key();
2228 packet_set_nonblocking();
2230 /* allocate authentication context */
2231 authctxt
= xcalloc(1, sizeof(*authctxt
));
2233 authctxt
->loginmsg
= &loginmsg
;
2235 /* XXX global for cleanup, access from other modules */
2236 the_authctxt
= authctxt
;
2238 /* prepare buffer to collect messages to display to user after login */
2239 buffer_init(&loginmsg
);
2243 if (privsep_preauth(authctxt
) == 1)
2245 } else if (compat20
&& have_agent
) {
2246 if ((r
= ssh_get_authentication_socket(&auth_sock
)) != 0) {
2247 error("Unable to get agent socket: %s", ssh_err(r
));
2252 /* perform the key exchange */
2253 /* authenticate user and start session */
2256 do_authentication2(authctxt
);
2260 do_authentication(authctxt
);
2262 fatal("ssh1 not supported");
2266 * If we use privilege separation, the unprivileged child transfers
2267 * the current keystate and exits
2270 mm_send_keystate(pmonitor
);
2276 * Cancel the alarm we set to limit the time taken for
2280 signal(SIGALRM
, SIG_DFL
);
2281 authctxt
->authenticated
= 1;
2282 if (startup_pipe
!= -1) {
2283 close(startup_pipe
);
2287 #ifdef SSH_AUDIT_EVENTS
2288 audit_event(SSH_AUTH_SUCCESS
);
2292 if (options
.gss_authentication
) {
2293 temporarily_use_uid(authctxt
->pw
);
2294 ssh_gssapi_storecreds();
2299 if (options
.use_pam
) {
2306 * In privilege separation, we fork another child and prepare
2307 * file descriptor passing.
2310 privsep_postauth(authctxt
);
2311 /* the monitor process [priv] will not return */
2313 destroy_sensitive_data();
2316 packet_set_timeout(options
.client_alive_interval
,
2317 options
.client_alive_count_max
);
2319 /* Try to send all our hostkeys to the client */
2321 notify_hostkeys(active_state
);
2323 /* Start session. */
2324 do_authenticated(authctxt
);
2326 /* The connection has been terminated. */
2327 packet_get_bytes(&ibytes
, &obytes
);
2328 verbose("Transferred: sent %llu, received %llu bytes",
2329 (unsigned long long)obytes
, (unsigned long long)ibytes
);
2331 verbose("Closing connection to %.500s port %d", remote_ip
, remote_port
);
2334 if (options
.use_pam
)
2336 #endif /* USE_PAM */
2338 #ifdef SSH_AUDIT_EVENTS
2339 PRIVSEP(audit_event(SSH_CONNECTION_CLOSE
));
2352 * Decrypt session_key_int using our private server key and private host key
2353 * (key with larger modulus first).
2356 ssh1_session_key(BIGNUM
*session_key_int
)
2358 struct ssh
*ssh
= active_state
; /* XXX */
2361 if (BN_cmp(sensitive_data
.server_key
->rsa
->n
,
2362 sensitive_data
.ssh1_host_key
->rsa
->n
) > 0) {
2363 /* Server key has bigger modulus. */
2364 if (BN_num_bits(sensitive_data
.server_key
->rsa
->n
) <
2365 BN_num_bits(sensitive_data
.ssh1_host_key
->rsa
->n
) +
2366 SSH_KEY_BITS_RESERVED
) {
2367 fatal("do_connection: %s port %d: "
2368 "server_key %d < host_key %d + SSH_KEY_BITS_RESERVED %d",
2369 ssh_remote_ipaddr(ssh
), ssh_remote_port(ssh
),
2370 BN_num_bits(sensitive_data
.server_key
->rsa
->n
),
2371 BN_num_bits(sensitive_data
.ssh1_host_key
->rsa
->n
),
2372 SSH_KEY_BITS_RESERVED
);
2374 if (rsa_private_decrypt(session_key_int
, session_key_int
,
2375 sensitive_data
.server_key
->rsa
) != 0)
2377 if (rsa_private_decrypt(session_key_int
, session_key_int
,
2378 sensitive_data
.ssh1_host_key
->rsa
) != 0)
2381 /* Host key has bigger modulus (or they are equal). */
2382 if (BN_num_bits(sensitive_data
.ssh1_host_key
->rsa
->n
) <
2383 BN_num_bits(sensitive_data
.server_key
->rsa
->n
) +
2384 SSH_KEY_BITS_RESERVED
) {
2385 fatal("do_connection: %s port %d: "
2386 "host_key %d < server_key %d + SSH_KEY_BITS_RESERVED %d",
2387 ssh_remote_ipaddr(ssh
), ssh_remote_port(ssh
),
2388 BN_num_bits(sensitive_data
.ssh1_host_key
->rsa
->n
),
2389 BN_num_bits(sensitive_data
.server_key
->rsa
->n
),
2390 SSH_KEY_BITS_RESERVED
);
2392 if (rsa_private_decrypt(session_key_int
, session_key_int
,
2393 sensitive_data
.ssh1_host_key
->rsa
) != 0)
2395 if (rsa_private_decrypt(session_key_int
, session_key_int
,
2396 sensitive_data
.server_key
->rsa
) != 0)
2408 struct ssh
*ssh
= active_state
; /* XXX */
2411 BIGNUM
*session_key_int
, *fake_key_int
, *real_key_int
;
2412 u_char session_key
[SSH_SESSION_KEY_LENGTH
];
2413 u_char fake_key_bytes
[4096 / 8];
2414 size_t fake_key_len
;
2416 u_int cipher_type
, auth_mask
, protocol_flags
;
2419 * Generate check bytes that the client must send back in the user
2420 * packet in order for it to be accepted; this is used to defy ip
2421 * spoofing attacks. Note that this only works against somebody
2422 * doing IP spoofing from a remote machine; any machine on the local
2423 * network can still see outgoing packets and catch the random
2424 * cookie. This only affects rhosts authentication, and this is one
2425 * of the reasons why it is inherently insecure.
2427 arc4random_buf(cookie
, sizeof(cookie
));
2430 * Send our public key. We include in the packet 64 bits of random
2431 * data that must be matched in the reply in order to prevent IP
2434 packet_start(SSH_SMSG_PUBLIC_KEY
);
2435 for (i
= 0; i
< 8; i
++)
2436 packet_put_char(cookie
[i
]);
2438 /* Store our public server RSA key. */
2439 packet_put_int(BN_num_bits(sensitive_data
.server_key
->rsa
->n
));
2440 packet_put_bignum(sensitive_data
.server_key
->rsa
->e
);
2441 packet_put_bignum(sensitive_data
.server_key
->rsa
->n
);
2443 /* Store our public host RSA key. */
2444 packet_put_int(BN_num_bits(sensitive_data
.ssh1_host_key
->rsa
->n
));
2445 packet_put_bignum(sensitive_data
.ssh1_host_key
->rsa
->e
);
2446 packet_put_bignum(sensitive_data
.ssh1_host_key
->rsa
->n
);
2448 /* Put protocol flags. */
2449 packet_put_int(SSH_PROTOFLAG_HOST_IN_FWD_OPEN
);
2451 /* Declare which ciphers we support. */
2452 packet_put_int(cipher_mask_ssh1(0));
2454 /* Declare supported authentication types. */
2456 if (options
.rhosts_rsa_authentication
)
2457 auth_mask
|= 1 << SSH_AUTH_RHOSTS_RSA
;
2458 if (options
.rsa_authentication
)
2459 auth_mask
|= 1 << SSH_AUTH_RSA
;
2460 if (options
.challenge_response_authentication
== 1)
2461 auth_mask
|= 1 << SSH_AUTH_TIS
;
2462 if (options
.password_authentication
)
2463 auth_mask
|= 1 << SSH_AUTH_PASSWORD
;
2464 packet_put_int(auth_mask
);
2466 /* Send the packet and wait for it to be sent. */
2468 packet_write_wait();
2470 debug("Sent %d bit server key and %d bit host key.",
2471 BN_num_bits(sensitive_data
.server_key
->rsa
->n
),
2472 BN_num_bits(sensitive_data
.ssh1_host_key
->rsa
->n
));
2474 /* Read clients reply (cipher type and session key). */
2475 packet_read_expect(SSH_CMSG_SESSION_KEY
);
2477 /* Get cipher type and check whether we accept this. */
2478 cipher_type
= packet_get_char();
2480 if (!(cipher_mask_ssh1(0) & (1 << cipher_type
)))
2481 packet_disconnect("Warning: client selects unsupported cipher.");
2483 /* Get check bytes from the packet. These must match those we
2484 sent earlier with the public key packet. */
2485 for (i
= 0; i
< 8; i
++)
2486 if (cookie
[i
] != packet_get_char())
2487 packet_disconnect("IP Spoofing check bytes do not match.");
2489 debug("Encryption type: %.200s", cipher_name(cipher_type
));
2491 /* Get the encrypted integer. */
2492 if ((real_key_int
= BN_new()) == NULL
)
2493 fatal("do_ssh1_kex: BN_new failed");
2494 packet_get_bignum(real_key_int
);
2496 protocol_flags
= packet_get_int();
2497 packet_set_protocol_flags(protocol_flags
);
2500 /* Setup a fake key in case RSA decryption fails */
2501 if ((fake_key_int
= BN_new()) == NULL
)
2502 fatal("do_ssh1_kex: BN_new failed");
2503 fake_key_len
= BN_num_bytes(real_key_int
);
2504 if (fake_key_len
> sizeof(fake_key_bytes
))
2505 fake_key_len
= sizeof(fake_key_bytes
);
2506 arc4random_buf(fake_key_bytes
, fake_key_len
);
2507 if (BN_bin2bn(fake_key_bytes
, fake_key_len
, fake_key_int
) == NULL
)
2508 fatal("do_ssh1_kex: BN_bin2bn failed");
2510 /* Decrypt real_key_int using host/server keys */
2511 rsafail
= PRIVSEP(ssh1_session_key(real_key_int
));
2512 /* If decryption failed, use the fake key. Else, the real key. */
2514 session_key_int
= fake_key_int
;
2516 session_key_int
= real_key_int
;
2519 * Extract session key from the decrypted integer. The key is in the
2520 * least significant 256 bits of the integer; the first byte of the
2521 * key is in the highest bits.
2523 (void) BN_mask_bits(session_key_int
, sizeof(session_key
) * 8);
2524 len
= BN_num_bytes(session_key_int
);
2525 if (len
< 0 || (u_int
)len
> sizeof(session_key
)) {
2526 error("%s: bad session key len from %s port %d: "
2527 "session_key_int %d > sizeof(session_key) %lu", __func__
,
2528 ssh_remote_ipaddr(ssh
), ssh_remote_port(ssh
),
2529 len
, (u_long
)sizeof(session_key
));
2532 explicit_bzero(session_key
, sizeof(session_key
));
2533 BN_bn2bin(session_key_int
,
2534 session_key
+ sizeof(session_key
) - len
);
2536 derive_ssh1_session_id(
2537 sensitive_data
.ssh1_host_key
->rsa
->n
,
2538 sensitive_data
.server_key
->rsa
->n
,
2539 cookie
, session_id
);
2541 * Xor the first 16 bytes of the session key with the
2544 for (i
= 0; i
< 16; i
++)
2545 session_key
[i
] ^= session_id
[i
];
2548 /* Destroy the private and public keys. No longer. */
2549 destroy_sensitive_data();
2552 mm_ssh1_session_id(session_id
);
2554 /* Destroy the decrypted integer. It is no longer needed. */
2555 BN_clear_free(real_key_int
);
2556 BN_clear_free(fake_key_int
);
2558 /* Set the session key. From this on all communications will be encrypted. */
2559 packet_set_encryption_key(session_key
, SSH_SESSION_KEY_LENGTH
, cipher_type
);
2561 /* Destroy our copy of the session key. It is no longer needed. */
2562 explicit_bzero(session_key
, sizeof(session_key
));
2564 debug("Received session key; encryption turned on.");
2566 /* Send an acknowledgment packet. Note that this packet is sent encrypted. */
2567 packet_start(SSH_SMSG_SUCCESS
);
2569 packet_write_wait();
2574 sshd_hostkey_sign(Key
*privkey
, Key
*pubkey
, u_char
**signature
, size_t *slen
,
2575 const u_char
*data
, size_t dlen
, const char *alg
, u_int flag
)
2578 u_int xxx_slen
, xxx_dlen
= dlen
;
2581 if (PRIVSEP(key_sign(privkey
, signature
, &xxx_slen
, data
, xxx_dlen
,
2583 fatal("%s: key_sign failed", __func__
);
2586 } else if (use_privsep
) {
2587 if (mm_key_sign(pubkey
, signature
, &xxx_slen
, data
, xxx_dlen
,
2589 fatal("%s: pubkey_sign failed", __func__
);
2593 if ((r
= ssh_agent_sign(auth_sock
, pubkey
, signature
, slen
,
2594 data
, dlen
, alg
, datafellows
)) != 0)
2595 fatal("%s: ssh_agent_sign failed: %s",
2596 __func__
, ssh_err(r
));
2601 /* SSH2 key exchange */
2605 char *myproposal
[PROPOSAL_MAX
] = { KEX_SERVER
};
2609 myproposal
[PROPOSAL_KEX_ALGS
] = compat_kex_proposal(
2610 options
.kex_algorithms
);
2611 myproposal
[PROPOSAL_ENC_ALGS_CTOS
] = compat_cipher_proposal(
2613 myproposal
[PROPOSAL_ENC_ALGS_STOC
] = compat_cipher_proposal(
2615 myproposal
[PROPOSAL_MAC_ALGS_CTOS
] =
2616 myproposal
[PROPOSAL_MAC_ALGS_STOC
] = options
.macs
;
2618 if (options
.compression
== COMP_NONE
) {
2619 myproposal
[PROPOSAL_COMP_ALGS_CTOS
] =
2620 myproposal
[PROPOSAL_COMP_ALGS_STOC
] = "none";
2621 } else if (options
.compression
== COMP_DELAYED
) {
2622 myproposal
[PROPOSAL_COMP_ALGS_CTOS
] =
2623 myproposal
[PROPOSAL_COMP_ALGS_STOC
] =
2624 "none,zlib@openssh.com";
2627 if (options
.rekey_limit
|| options
.rekey_interval
)
2628 packet_set_rekey_limits(options
.rekey_limit
,
2629 (time_t)options
.rekey_interval
);
2631 myproposal
[PROPOSAL_SERVER_HOST_KEY_ALGS
] = compat_pkalg_proposal(
2632 list_hostkey_types());
2634 /* start key exchange */
2635 if ((r
= kex_setup(active_state
, myproposal
)) != 0)
2636 fatal("kex_setup: %s", ssh_err(r
));
2637 kex
= active_state
->kex
;
2639 kex
->kex
[KEX_DH_GRP1_SHA1
] = kexdh_server
;
2640 kex
->kex
[KEX_DH_GRP14_SHA1
] = kexdh_server
;
2641 kex
->kex
[KEX_DH_GRP14_SHA256
] = kexdh_server
;
2642 kex
->kex
[KEX_DH_GRP16_SHA512
] = kexdh_server
;
2643 kex
->kex
[KEX_DH_GRP18_SHA512
] = kexdh_server
;
2644 kex
->kex
[KEX_DH_GEX_SHA1
] = kexgex_server
;
2645 kex
->kex
[KEX_DH_GEX_SHA256
] = kexgex_server
;
2646 # ifdef OPENSSL_HAS_ECC
2647 kex
->kex
[KEX_ECDH_SHA2
] = kexecdh_server
;
2650 kex
->kex
[KEX_C25519_SHA256
] = kexc25519_server
;
2652 kex
->client_version_string
=client_version_string
;
2653 kex
->server_version_string
=server_version_string
;
2654 kex
->load_host_public_key
=&get_hostkey_public_by_type
;
2655 kex
->load_host_private_key
=&get_hostkey_private_by_type
;
2656 kex
->host_key_index
=&get_hostkey_index
;
2657 kex
->sign
= sshd_hostkey_sign
;
2659 dispatch_run(DISPATCH_BLOCK
, &kex
->done
, active_state
);
2661 session_id2
= kex
->session_id
;
2662 session_id2_len
= kex
->session_id_len
;
2665 /* send 1st encrypted/maced/compressed message */
2666 packet_start(SSH2_MSG_IGNORE
);
2667 packet_put_cstring("markus");
2669 packet_write_wait();
2674 /* server specific fatal cleanup */
2679 do_cleanup(the_authctxt
);
2680 if (use_privsep
&& privsep_is_preauth
&&
2681 pmonitor
!= NULL
&& pmonitor
->m_pid
> 1) {
2682 debug("Killing privsep child %d", pmonitor
->m_pid
);
2683 if (kill(pmonitor
->m_pid
, SIGKILL
) != 0 &&
2685 error("%s: kill(%d): %s", __func__
,
2686 pmonitor
->m_pid
, strerror(errno
));
2689 #ifdef SSH_AUDIT_EVENTS
2690 /* done after do_cleanup so it can cancel the PAM auth 'thread' */
2691 if (!use_privsep
|| mm_is_monitor())
2692 audit_event(SSH_CONNECTION_ABANDON
);