1 /* $OpenBSD: servconf.c,v 1.195 2009/04/14 21:10:54 jj Exp $ */
3 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
6 * As far as I am concerned, the code I have written for this software
7 * can be used freely for any purpose. Any derived versions of this
8 * software must be clearly marked as such, and if the derived work is
9 * incompatible with the protocol description in the RFC file, it must be
10 * called by a name other than "ssh" or "Secure Shell".
15 #include <sys/types.h>
16 #include <sys/socket.h>
28 #include "openbsd-compat/sys-queue.h"
35 #include "pathnames.h"
43 #include "groupaccess.h"
45 static void add_listen_addr(ServerOptions
*, char *, int);
46 static void add_one_listen_addr(ServerOptions
*, char *, int);
48 /* Use of privilege separation or not */
49 extern int use_privsep
;
52 /* Initializes the server options to their default values. */
55 initialize_server_options(ServerOptions
*options
)
57 memset(options
, 0, sizeof(*options
));
59 /* Portable-specific options */
60 options
->use_pam
= -1;
62 /* Standard Options */
63 options
->num_ports
= 0;
64 options
->ports_from_cmdline
= 0;
65 options
->listen_addrs
= NULL
;
66 options
->address_family
= -1;
67 options
->num_host_key_files
= 0;
68 options
->pid_file
= NULL
;
69 options
->server_key_bits
= -1;
70 options
->login_grace_time
= -1;
71 options
->key_regeneration_time
= -1;
72 options
->permit_root_login
= PERMIT_NOT_SET
;
73 options
->ignore_rhosts
= -1;
74 options
->ignore_user_known_hosts
= -1;
75 options
->print_motd
= -1;
76 options
->print_lastlog
= -1;
77 options
->x11_forwarding
= -1;
78 options
->x11_display_offset
= -1;
79 options
->x11_use_localhost
= -1;
80 options
->xauth_location
= NULL
;
81 options
->strict_modes
= -1;
82 options
->tcp_keep_alive
= -1;
83 options
->log_facility
= SYSLOG_FACILITY_NOT_SET
;
84 options
->log_level
= SYSLOG_LEVEL_NOT_SET
;
85 options
->rhosts_rsa_authentication
= -1;
86 options
->hostbased_authentication
= -1;
87 options
->hostbased_uses_name_from_packet_only
= -1;
88 options
->rsa_authentication
= -1;
89 options
->pubkey_authentication
= -1;
90 options
->kerberos_authentication
= -1;
91 options
->kerberos_or_local_passwd
= -1;
92 options
->kerberos_ticket_cleanup
= -1;
93 options
->kerberos_get_afs_token
= -1;
94 options
->gss_authentication
=-1;
95 options
->gss_cleanup_creds
= -1;
96 options
->password_authentication
= -1;
97 options
->kbd_interactive_authentication
= -1;
98 options
->challenge_response_authentication
= -1;
99 options
->permit_blacklisted_keys
= -1;
100 options
->permit_empty_passwd
= -1;
101 options
->permit_user_env
= -1;
102 options
->use_login
= -1;
103 options
->compression
= -1;
104 options
->allow_tcp_forwarding
= -1;
105 options
->allow_agent_forwarding
= -1;
106 options
->num_allow_users
= 0;
107 options
->num_deny_users
= 0;
108 options
->num_allow_groups
= 0;
109 options
->num_deny_groups
= 0;
110 options
->ciphers
= NULL
;
111 options
->macs
= NULL
;
112 options
->protocol
= SSH_PROTO_UNKNOWN
;
113 options
->gateway_ports
= -1;
114 options
->num_subsystems
= 0;
115 options
->max_startups_begin
= -1;
116 options
->max_startups_rate
= -1;
117 options
->max_startups
= -1;
118 options
->max_authtries
= -1;
119 options
->max_sessions
= -1;
120 options
->banner
= NULL
;
121 options
->use_dns
= -1;
122 options
->client_alive_interval
= -1;
123 options
->client_alive_count_max
= -1;
124 options
->authorized_keys_file
= NULL
;
125 options
->authorized_keys_file2
= NULL
;
126 options
->num_accept_env
= 0;
127 options
->permit_tun
= -1;
128 options
->num_permitted_opens
= -1;
129 options
->adm_forced_command
= NULL
;
130 options
->chroot_directory
= NULL
;
131 options
->zero_knowledge_password_authentication
= -1;
135 fill_default_server_options(ServerOptions
*options
)
137 /* Portable-specific options */
138 if (options
->use_pam
== -1)
139 options
->use_pam
= 0;
141 /* Standard Options */
142 if (options
->protocol
== SSH_PROTO_UNKNOWN
)
143 options
->protocol
= SSH_PROTO_2
;
144 if (options
->num_host_key_files
== 0) {
145 /* fill default hostkeys for protocols */
146 if (options
->protocol
& SSH_PROTO_1
)
147 options
->host_key_files
[options
->num_host_key_files
++] =
149 if (options
->protocol
& SSH_PROTO_2
) {
150 options
->host_key_files
[options
->num_host_key_files
++] =
151 _PATH_HOST_RSA_KEY_FILE
;
152 options
->host_key_files
[options
->num_host_key_files
++] =
153 _PATH_HOST_DSA_KEY_FILE
;
156 if (options
->num_ports
== 0)
157 options
->ports
[options
->num_ports
++] = SSH_DEFAULT_PORT
;
158 if (options
->listen_addrs
== NULL
)
159 add_listen_addr(options
, NULL
, 0);
160 if (options
->pid_file
== NULL
)
161 options
->pid_file
= _PATH_SSH_DAEMON_PID_FILE
;
162 if (options
->server_key_bits
== -1)
163 options
->server_key_bits
= 1024;
164 if (options
->login_grace_time
== -1)
165 options
->login_grace_time
= 120;
166 if (options
->key_regeneration_time
== -1)
167 options
->key_regeneration_time
= 3600;
168 if (options
->permit_root_login
== PERMIT_NOT_SET
)
169 options
->permit_root_login
= PERMIT_NO
;
170 if (options
->ignore_rhosts
== -1)
171 options
->ignore_rhosts
= 1;
172 if (options
->ignore_user_known_hosts
== -1)
173 options
->ignore_user_known_hosts
= 0;
174 if (options
->print_motd
== -1)
175 options
->print_motd
= 1;
176 if (options
->print_lastlog
== -1)
177 options
->print_lastlog
= 1;
178 if (options
->x11_forwarding
== -1)
179 options
->x11_forwarding
= 1;
180 if (options
->x11_display_offset
== -1)
181 options
->x11_display_offset
= 10;
182 if (options
->x11_use_localhost
== -1)
183 options
->x11_use_localhost
= 1;
184 if (options
->xauth_location
== NULL
)
185 options
->xauth_location
= _PATH_XAUTH
;
186 if (options
->strict_modes
== -1)
187 options
->strict_modes
= 1;
188 if (options
->tcp_keep_alive
== -1)
189 options
->tcp_keep_alive
= 1;
190 if (options
->log_facility
== SYSLOG_FACILITY_NOT_SET
)
191 options
->log_facility
= SYSLOG_FACILITY_AUTH
;
192 if (options
->log_level
== SYSLOG_LEVEL_NOT_SET
)
193 options
->log_level
= SYSLOG_LEVEL_INFO
;
194 if (options
->rhosts_rsa_authentication
== -1)
195 options
->rhosts_rsa_authentication
= 0;
196 if (options
->hostbased_authentication
== -1)
197 options
->hostbased_authentication
= 0;
198 if (options
->hostbased_uses_name_from_packet_only
== -1)
199 options
->hostbased_uses_name_from_packet_only
= 0;
200 if (options
->rsa_authentication
== -1)
201 options
->rsa_authentication
= 1;
202 if (options
->pubkey_authentication
== -1)
203 options
->pubkey_authentication
= 1;
204 if (options
->kerberos_authentication
== -1)
205 options
->kerberos_authentication
= 0;
206 if (options
->kerberos_or_local_passwd
== -1)
207 options
->kerberos_or_local_passwd
= 1;
208 if (options
->kerberos_ticket_cleanup
== -1)
209 options
->kerberos_ticket_cleanup
= 1;
210 if (options
->kerberos_get_afs_token
== -1)
211 options
->kerberos_get_afs_token
= 0;
212 if (options
->gss_authentication
== -1)
213 options
->gss_authentication
= 0;
214 if (options
->gss_cleanup_creds
== -1)
215 options
->gss_cleanup_creds
= 1;
216 if (options
->password_authentication
== -1)
217 options
->password_authentication
= 1;
218 if (options
->kbd_interactive_authentication
== -1)
219 options
->kbd_interactive_authentication
= 0;
220 if (options
->challenge_response_authentication
== -1)
221 options
->challenge_response_authentication
= 1;
222 if (options
->permit_blacklisted_keys
== -1)
223 options
->permit_blacklisted_keys
= 0;
224 if (options
->permit_empty_passwd
== -1)
225 options
->permit_empty_passwd
= 0;
226 if (options
->permit_user_env
== -1)
227 options
->permit_user_env
= 0;
228 if (options
->use_login
== -1)
229 options
->use_login
= 0;
230 if (options
->compression
== -1)
231 options
->compression
= COMP_DELAYED
;
232 if (options
->allow_tcp_forwarding
== -1)
233 options
->allow_tcp_forwarding
= 1;
234 if (options
->allow_agent_forwarding
== -1)
235 options
->allow_agent_forwarding
= 1;
236 if (options
->gateway_ports
== -1)
237 options
->gateway_ports
= 0;
238 if (options
->max_startups
== -1)
239 options
->max_startups
= 10;
240 if (options
->max_startups_rate
== -1)
241 options
->max_startups_rate
= 100; /* 100% */
242 if (options
->max_startups_begin
== -1)
243 options
->max_startups_begin
= options
->max_startups
;
244 if (options
->max_authtries
== -1)
245 options
->max_authtries
= DEFAULT_AUTH_FAIL_MAX
;
246 if (options
->max_sessions
== -1)
247 options
->max_sessions
= DEFAULT_SESSIONS_MAX
;
248 if (options
->use_dns
== -1)
249 options
->use_dns
= 1;
250 if (options
->client_alive_interval
== -1)
251 options
->client_alive_interval
= 0;
252 if (options
->client_alive_count_max
== -1)
253 options
->client_alive_count_max
= 3;
254 if (options
->authorized_keys_file2
== NULL
) {
255 /* authorized_keys_file2 falls back to authorized_keys_file */
256 if (options
->authorized_keys_file
!= NULL
)
257 options
->authorized_keys_file2
= options
->authorized_keys_file
;
259 options
->authorized_keys_file2
= _PATH_SSH_USER_PERMITTED_KEYS2
;
261 if (options
->authorized_keys_file
== NULL
)
262 options
->authorized_keys_file
= _PATH_SSH_USER_PERMITTED_KEYS
;
263 if (options
->permit_tun
== -1)
264 options
->permit_tun
= SSH_TUNMODE_NO
;
265 if (options
->zero_knowledge_password_authentication
== -1)
266 options
->zero_knowledge_password_authentication
= 0;
268 /* Turn privilege separation on by default */
269 if (use_privsep
== -1)
273 if (use_privsep
&& options
->compression
== 1) {
274 error("This platform does not support both privilege "
275 "separation and compression");
276 error("Compression disabled");
277 options
->compression
= 0;
283 /* Keyword tokens. */
285 sBadOption
, /* == unknown option */
286 /* Portable-specific options */
288 /* Standard Options */
289 sPort
, sHostKeyFile
, sServerKeyBits
, sLoginGraceTime
, sKeyRegenerationTime
,
290 sPermitRootLogin
, sLogFacility
, sLogLevel
,
291 sRhostsRSAAuthentication
, sRSAAuthentication
,
292 sKerberosAuthentication
, sKerberosOrLocalPasswd
, sKerberosTicketCleanup
,
293 sKerberosGetAFSToken
,
294 sKerberosTgtPassing
, sChallengeResponseAuthentication
,
295 sPasswordAuthentication
, sKbdInteractiveAuthentication
,
296 sListenAddress
, sAddressFamily
,
297 sPrintMotd
, sPrintLastLog
, sIgnoreRhosts
,
298 sX11Forwarding
, sX11DisplayOffset
, sX11UseLocalhost
,
299 sStrictModes
, sPermitBlacklistedKeys
, sEmptyPasswd
, sTCPKeepAlive
,
300 sPermitUserEnvironment
, sUseLogin
, sAllowTcpForwarding
, sCompression
,
301 sAllowUsers
, sDenyUsers
, sAllowGroups
, sDenyGroups
,
302 sIgnoreUserKnownHosts
, sCiphers
, sMacs
, sProtocol
, sPidFile
,
303 sGatewayPorts
, sPubkeyAuthentication
, sXAuthLocation
, sSubsystem
,
304 sMaxStartups
, sMaxAuthTries
, sMaxSessions
,
305 sBanner
, sUseDNS
, sHostbasedAuthentication
,
306 sHostbasedUsesNameFromPacketOnly
, sClientAliveInterval
,
307 sClientAliveCountMax
, sAuthorizedKeysFile
, sAuthorizedKeysFile2
,
308 sGssAuthentication
, sGssCleanupCreds
, sAcceptEnv
, sPermitTunnel
,
309 sMatch
, sPermitOpen
, sForceCommand
, sChrootDirectory
,
310 sUsePrivilegeSeparation
, sAllowAgentForwarding
,
311 sZeroKnowledgePasswordAuthentication
,
313 sDeprecated
, sUnsupported
316 #define SSHCFG_GLOBAL 0x01 /* allowed in main section of sshd_config */
317 #define SSHCFG_MATCH 0x02 /* allowed inside a Match section */
318 #define SSHCFG_ALL (SSHCFG_GLOBAL|SSHCFG_MATCH)
320 /* Textual representation of the tokens. */
323 ServerOpCodes opcode
;
326 /* Portable-specific options */
328 { "usepam", sUsePAM
, SSHCFG_GLOBAL
},
330 { "usepam", sUnsupported
, SSHCFG_GLOBAL
},
332 { "pamauthenticationviakbdint", sDeprecated
, SSHCFG_GLOBAL
},
333 /* Standard Options */
334 { "port", sPort
, SSHCFG_GLOBAL
},
335 { "hostkey", sHostKeyFile
, SSHCFG_GLOBAL
},
336 { "hostdsakey", sHostKeyFile
, SSHCFG_GLOBAL
}, /* alias */
337 { "pidfile", sPidFile
, SSHCFG_GLOBAL
},
338 { "serverkeybits", sServerKeyBits
, SSHCFG_GLOBAL
},
339 { "logingracetime", sLoginGraceTime
, SSHCFG_GLOBAL
},
340 { "keyregenerationinterval", sKeyRegenerationTime
, SSHCFG_GLOBAL
},
341 { "permitrootlogin", sPermitRootLogin
, SSHCFG_ALL
},
342 { "syslogfacility", sLogFacility
, SSHCFG_GLOBAL
},
343 { "loglevel", sLogLevel
, SSHCFG_GLOBAL
},
344 { "rhostsauthentication", sDeprecated
, SSHCFG_GLOBAL
},
345 { "rhostsrsaauthentication", sRhostsRSAAuthentication
, SSHCFG_ALL
},
346 { "hostbasedauthentication", sHostbasedAuthentication
, SSHCFG_ALL
},
347 { "hostbasedusesnamefrompacketonly", sHostbasedUsesNameFromPacketOnly
, SSHCFG_GLOBAL
},
348 { "rsaauthentication", sRSAAuthentication
, SSHCFG_ALL
},
349 { "pubkeyauthentication", sPubkeyAuthentication
, SSHCFG_ALL
},
350 { "dsaauthentication", sPubkeyAuthentication
, SSHCFG_GLOBAL
}, /* alias */
352 { "kerberosauthentication", sKerberosAuthentication
, SSHCFG_ALL
},
353 { "kerberosorlocalpasswd", sKerberosOrLocalPasswd
, SSHCFG_GLOBAL
},
354 { "kerberosticketcleanup", sKerberosTicketCleanup
, SSHCFG_GLOBAL
},
356 { "kerberosgetafstoken", sKerberosGetAFSToken
, SSHCFG_GLOBAL
},
358 { "kerberosgetafstoken", sUnsupported
, SSHCFG_GLOBAL
},
361 { "kerberosauthentication", sUnsupported
, SSHCFG_ALL
},
362 { "kerberosorlocalpasswd", sUnsupported
, SSHCFG_GLOBAL
},
363 { "kerberosticketcleanup", sUnsupported
, SSHCFG_GLOBAL
},
364 { "kerberosgetafstoken", sUnsupported
, SSHCFG_GLOBAL
},
366 { "kerberostgtpassing", sUnsupported
, SSHCFG_GLOBAL
},
367 { "afstokenpassing", sUnsupported
, SSHCFG_GLOBAL
},
369 { "gssapiauthentication", sGssAuthentication
, SSHCFG_ALL
},
370 { "gssapicleanupcredentials", sGssCleanupCreds
, SSHCFG_GLOBAL
},
372 { "gssapiauthentication", sUnsupported
, SSHCFG_ALL
},
373 { "gssapicleanupcredentials", sUnsupported
, SSHCFG_GLOBAL
},
375 { "passwordauthentication", sPasswordAuthentication
, SSHCFG_ALL
},
376 { "kbdinteractiveauthentication", sKbdInteractiveAuthentication
, SSHCFG_ALL
},
377 { "challengeresponseauthentication", sChallengeResponseAuthentication
, SSHCFG_GLOBAL
},
378 { "skeyauthentication", sChallengeResponseAuthentication
, SSHCFG_GLOBAL
}, /* alias */
380 { "zeroknowledgepasswordauthentication", sZeroKnowledgePasswordAuthentication
, SSHCFG_ALL
},
382 { "zeroknowledgepasswordauthentication", sUnsupported
, SSHCFG_ALL
},
384 { "checkmail", sDeprecated
, SSHCFG_GLOBAL
},
385 { "listenaddress", sListenAddress
, SSHCFG_GLOBAL
},
386 { "addressfamily", sAddressFamily
, SSHCFG_GLOBAL
},
387 { "printmotd", sPrintMotd
, SSHCFG_GLOBAL
},
388 { "printlastlog", sPrintLastLog
, SSHCFG_GLOBAL
},
389 { "ignorerhosts", sIgnoreRhosts
, SSHCFG_GLOBAL
},
390 { "ignoreuserknownhosts", sIgnoreUserKnownHosts
, SSHCFG_GLOBAL
},
391 { "x11forwarding", sX11Forwarding
, SSHCFG_ALL
},
392 { "x11displayoffset", sX11DisplayOffset
, SSHCFG_ALL
},
393 { "x11uselocalhost", sX11UseLocalhost
, SSHCFG_ALL
},
394 { "xauthlocation", sXAuthLocation
, SSHCFG_GLOBAL
},
395 { "strictmodes", sStrictModes
, SSHCFG_GLOBAL
},
396 { "permitblacklistedkeys", sPermitBlacklistedKeys
, SSHCFG_GLOBAL
},
397 { "permitemptypasswords", sEmptyPasswd
, SSHCFG_ALL
},
398 { "permituserenvironment", sPermitUserEnvironment
, SSHCFG_GLOBAL
},
399 { "uselogin", sUseLogin
, SSHCFG_GLOBAL
},
400 { "compression", sCompression
, SSHCFG_GLOBAL
},
401 { "tcpkeepalive", sTCPKeepAlive
, SSHCFG_GLOBAL
},
402 { "keepalive", sTCPKeepAlive
, SSHCFG_GLOBAL
}, /* obsolete alias */
403 { "allowtcpforwarding", sAllowTcpForwarding
, SSHCFG_ALL
},
404 { "allowagentforwarding", sAllowAgentForwarding
, SSHCFG_ALL
},
405 { "allowusers", sAllowUsers
, SSHCFG_GLOBAL
},
406 { "denyusers", sDenyUsers
, SSHCFG_GLOBAL
},
407 { "allowgroups", sAllowGroups
, SSHCFG_GLOBAL
},
408 { "denygroups", sDenyGroups
, SSHCFG_GLOBAL
},
409 { "ciphers", sCiphers
, SSHCFG_GLOBAL
},
410 { "macs", sMacs
, SSHCFG_GLOBAL
},
411 { "protocol", sProtocol
, SSHCFG_GLOBAL
},
412 { "gatewayports", sGatewayPorts
, SSHCFG_ALL
},
413 { "subsystem", sSubsystem
, SSHCFG_GLOBAL
},
414 { "maxstartups", sMaxStartups
, SSHCFG_GLOBAL
},
415 { "maxauthtries", sMaxAuthTries
, SSHCFG_ALL
},
416 { "maxsessions", sMaxSessions
, SSHCFG_ALL
},
417 { "banner", sBanner
, SSHCFG_ALL
},
418 { "usedns", sUseDNS
, SSHCFG_GLOBAL
},
419 { "verifyreversemapping", sDeprecated
, SSHCFG_GLOBAL
},
420 { "reversemappingcheck", sDeprecated
, SSHCFG_GLOBAL
},
421 { "clientaliveinterval", sClientAliveInterval
, SSHCFG_GLOBAL
},
422 { "clientalivecountmax", sClientAliveCountMax
, SSHCFG_GLOBAL
},
423 { "authorizedkeysfile", sAuthorizedKeysFile
, SSHCFG_GLOBAL
},
424 { "authorizedkeysfile2", sAuthorizedKeysFile2
, SSHCFG_GLOBAL
},
425 { "useprivilegeseparation", sUsePrivilegeSeparation
, SSHCFG_GLOBAL
},
426 { "versionaddendum", sVersionAddendum
, SSHCFG_GLOBAL
},
427 { "acceptenv", sAcceptEnv
, SSHCFG_GLOBAL
},
428 { "permittunnel", sPermitTunnel
, SSHCFG_GLOBAL
},
429 { "match", sMatch
, SSHCFG_ALL
},
430 { "permitopen", sPermitOpen
, SSHCFG_ALL
},
431 { "forcecommand", sForceCommand
, SSHCFG_ALL
},
432 { "chrootdirectory", sChrootDirectory
, SSHCFG_ALL
},
433 { NULL
, sBadOption
, 0 }
440 { SSH_TUNMODE_NO
, "no" },
441 { SSH_TUNMODE_POINTOPOINT
, "point-to-point" },
442 { SSH_TUNMODE_ETHERNET
, "ethernet" },
443 { SSH_TUNMODE_YES
, "yes" },
448 * Returns the number of the token pointed to by cp or sBadOption.
452 parse_token(const char *cp
, const char *filename
,
453 int linenum
, u_int
*flags
)
457 for (i
= 0; keywords
[i
].name
; i
++)
458 if (strcasecmp(cp
, keywords
[i
].name
) == 0) {
459 *flags
= keywords
[i
].flags
;
460 return keywords
[i
].opcode
;
463 error("%s: line %d: Bad configuration option: %s",
464 filename
, linenum
, cp
);
469 add_listen_addr(ServerOptions
*options
, char *addr
, int port
)
473 if (options
->num_ports
== 0)
474 options
->ports
[options
->num_ports
++] = SSH_DEFAULT_PORT
;
475 if (options
->address_family
== -1)
476 options
->address_family
= AF_UNSPEC
;
478 for (i
= 0; i
< options
->num_ports
; i
++)
479 add_one_listen_addr(options
, addr
, options
->ports
[i
]);
481 add_one_listen_addr(options
, addr
, port
);
485 add_one_listen_addr(ServerOptions
*options
, char *addr
, int port
)
487 struct addrinfo hints
, *ai
, *aitop
;
488 char strport
[NI_MAXSERV
];
491 memset(&hints
, 0, sizeof(hints
));
492 hints
.ai_family
= options
->address_family
;
493 hints
.ai_socktype
= SOCK_STREAM
;
494 hints
.ai_flags
= (addr
== NULL
) ? AI_PASSIVE
: 0;
495 snprintf(strport
, sizeof strport
, "%d", port
);
496 if ((gaierr
= getaddrinfo(addr
, strport
, &hints
, &aitop
)) != 0)
497 fatal("bad addr or host: %s (%s)",
498 addr
? addr
: "<NULL>",
499 ssh_gai_strerror(gaierr
));
500 for (ai
= aitop
; ai
->ai_next
; ai
= ai
->ai_next
)
502 ai
->ai_next
= options
->listen_addrs
;
503 options
->listen_addrs
= aitop
;
507 * The strategy for the Match blocks is that the config file is parsed twice.
509 * The first time is at startup. activep is initialized to 1 and the
510 * directives in the global context are processed and acted on. Hitting a
511 * Match directive unsets activep and the directives inside the block are
512 * checked for syntax only.
514 * The second time is after a connection has been established but before
515 * authentication. activep is initialized to 2 and global config directives
516 * are ignored since they have already been processed. If the criteria in a
517 * Match block is met, activep is set and the subsequent directives
518 * processed and actioned until EOF or another Match block unsets it. Any
519 * options set are copied into the main server config.
521 * Potential additions/improvements:
522 * - Add Match support for pre-kex directives, eg Protocol, Ciphers.
524 * - Add a Tag directive (idea from David Leonard) ala pf, eg:
525 * Match Address 192.168.0.*
530 * AllowTcpForwarding yes
531 * GatewayPorts clientspecified
534 * - Add a PermittedChannelRequests directive
536 * PermittedChannelRequests session,forwarded-tcpip
540 match_cfg_line_group(const char *grps
, int line
, const char *user
)
548 if ((pw
= getpwnam(user
)) == NULL
) {
549 debug("Can't match group at line %d because user %.100s does "
550 "not exist", line
, user
);
551 } else if (ga_init(pw
->pw_name
, pw
->pw_gid
) == 0) {
552 debug("Can't Match group because user %.100s not in any group "
553 "at line %d", user
, line
);
554 } else if (ga_match_pattern_list(grps
) != 1) {
555 debug("user %.100s does not match group list %.100s at line %d",
558 debug("user %.100s matched group list %.100s at line %d", user
,
568 match_cfg_line(char **condition
, int line
, const char *user
, const char *host
,
572 char *arg
, *attrib
, *cp
= *condition
;
576 debug3("checking syntax for 'Match %s'", cp
);
578 debug3("checking match for '%s' user %s host %s addr %s", cp
,
579 user
? user
: "(null)", host
? host
: "(null)",
580 address
? address
: "(null)");
582 while ((attrib
= strdelim(&cp
)) && *attrib
!= '\0') {
583 if ((arg
= strdelim(&cp
)) == NULL
|| *arg
== '\0') {
584 error("Missing Match criteria for %s", attrib
);
588 if (strcasecmp(attrib
, "user") == 0) {
593 if (match_pattern_list(user
, arg
, len
, 0) != 1)
596 debug("user %.100s matched 'User %.100s' at "
597 "line %d", user
, arg
, line
);
598 } else if (strcasecmp(attrib
, "group") == 0) {
599 switch (match_cfg_line_group(arg
, line
, user
)) {
605 } else if (strcasecmp(attrib
, "host") == 0) {
610 if (match_hostname(host
, arg
, len
) != 1)
613 debug("connection from %.100s matched 'Host "
614 "%.100s' at line %d", host
, arg
, line
);
615 } else if (strcasecmp(attrib
, "address") == 0) {
616 switch (addr_match_list(address
, arg
)) {
618 debug("connection from %.100s matched 'Address "
619 "%.100s' at line %d", address
, arg
, line
);
629 error("Unsupported Match attribute %s", attrib
);
634 debug3("match %sfound", result
? "" : "not ");
639 #define WHITESPACE " \t\r\n"
642 process_server_config_line(ServerOptions
*options
, char *line
,
643 const char *filename
, int linenum
, int *activep
, const char *user
,
644 const char *host
, const char *address
)
646 char *cp
, **charptr
, *arg
, *p
;
647 int cmdline
= 0, *intptr
, value
, n
;
648 SyslogFacility
*log_facility_ptr
;
649 LogLevel
*log_level_ptr
;
650 ServerOpCodes opcode
;
656 if ((arg
= strdelim(&cp
)) == NULL
)
658 /* Ignore leading whitespace */
661 if (!arg
|| !*arg
|| *arg
== '#')
665 opcode
= parse_token(arg
, filename
, linenum
, &flags
);
667 if (activep
== NULL
) { /* We are processing a command line directive */
671 if (*activep
&& opcode
!= sMatch
)
672 debug3("%s:%d setting %s %s", filename
, linenum
, arg
, cp
);
673 if (*activep
== 0 && !(flags
& SSHCFG_MATCH
)) {
675 fatal("%s line %d: Directive '%s' is not allowed "
676 "within a Match block", filename
, linenum
, arg
);
677 } else { /* this is a directive we have already processed */
685 /* Portable-specific options */
687 intptr
= &options
->use_pam
;
690 /* Standard Options */
694 /* ignore ports from configfile if cmdline specifies ports */
695 if (options
->ports_from_cmdline
)
697 if (options
->listen_addrs
!= NULL
)
698 fatal("%s line %d: ports must be specified before "
699 "ListenAddress.", filename
, linenum
);
700 if (options
->num_ports
>= MAX_PORTS
)
701 fatal("%s line %d: too many ports.",
704 if (!arg
|| *arg
== '\0')
705 fatal("%s line %d: missing port number.",
707 options
->ports
[options
->num_ports
++] = a2port(arg
);
708 if (options
->ports
[options
->num_ports
-1] <= 0)
709 fatal("%s line %d: Badly formatted port number.",
714 intptr
= &options
->server_key_bits
;
717 if (!arg
|| *arg
== '\0')
718 fatal("%s line %d: missing integer value.",
721 if (*activep
&& *intptr
== -1)
725 case sLoginGraceTime
:
726 intptr
= &options
->login_grace_time
;
729 if (!arg
|| *arg
== '\0')
730 fatal("%s line %d: missing time value.",
732 if ((value
= convtime(arg
)) == -1)
733 fatal("%s line %d: invalid time value.",
739 case sKeyRegenerationTime
:
740 intptr
= &options
->key_regeneration_time
;
745 if (arg
== NULL
|| *arg
== '\0')
746 fatal("%s line %d: missing address",
748 /* check for bare IPv6 address: no "[]" and 2 or more ":" */
749 if (strchr(arg
, '[') == NULL
&& (p
= strchr(arg
, ':')) != NULL
750 && strchr(p
+1, ':') != NULL
) {
751 add_listen_addr(options
, arg
, 0);
756 fatal("%s line %d: bad address:port usage",
758 p
= cleanhostname(p
);
761 else if ((port
= a2port(arg
)) <= 0)
762 fatal("%s line %d: bad port number", filename
, linenum
);
764 add_listen_addr(options
, p
, port
);
770 if (!arg
|| *arg
== '\0')
771 fatal("%s line %d: missing address family.",
773 intptr
= &options
->address_family
;
774 if (options
->listen_addrs
!= NULL
)
775 fatal("%s line %d: address family must be specified before "
776 "ListenAddress.", filename
, linenum
);
777 if (strcasecmp(arg
, "inet") == 0)
779 else if (strcasecmp(arg
, "inet6") == 0)
781 else if (strcasecmp(arg
, "any") == 0)
784 fatal("%s line %d: unsupported address family \"%s\".",
785 filename
, linenum
, arg
);
791 intptr
= &options
->num_host_key_files
;
792 if (*intptr
>= MAX_HOSTKEYS
)
793 fatal("%s line %d: too many host keys specified (max %d).",
794 filename
, linenum
, MAX_HOSTKEYS
);
795 charptr
= &options
->host_key_files
[*intptr
];
798 if (!arg
|| *arg
== '\0')
799 fatal("%s line %d: missing file name.",
801 if (*activep
&& *charptr
== NULL
) {
802 *charptr
= tilde_expand_filename(arg
, getuid());
803 /* increase optional counter */
805 *intptr
= *intptr
+ 1;
810 charptr
= &options
->pid_file
;
813 case sPermitRootLogin
:
814 intptr
= &options
->permit_root_login
;
816 if (!arg
|| *arg
== '\0')
817 fatal("%s line %d: missing yes/"
818 "without-password/forced-commands-only/no "
819 "argument.", filename
, linenum
);
820 value
= 0; /* silence compiler */
821 if (strcmp(arg
, "without-password") == 0)
822 value
= PERMIT_NO_PASSWD
;
823 else if (strcmp(arg
, "forced-commands-only") == 0)
824 value
= PERMIT_FORCED_ONLY
;
825 else if (strcmp(arg
, "yes") == 0)
827 else if (strcmp(arg
, "no") == 0)
830 fatal("%s line %d: Bad yes/"
831 "without-password/forced-commands-only/no "
832 "argument: %s", filename
, linenum
, arg
);
833 if (*activep
&& *intptr
== -1)
838 intptr
= &options
->ignore_rhosts
;
841 if (!arg
|| *arg
== '\0')
842 fatal("%s line %d: missing yes/no argument.",
844 value
= 0; /* silence compiler */
845 if (strcmp(arg
, "yes") == 0)
847 else if (strcmp(arg
, "no") == 0)
850 fatal("%s line %d: Bad yes/no argument: %s",
851 filename
, linenum
, arg
);
852 if (*activep
&& *intptr
== -1)
856 case sIgnoreUserKnownHosts
:
857 intptr
= &options
->ignore_user_known_hosts
;
860 case sRhostsRSAAuthentication
:
861 intptr
= &options
->rhosts_rsa_authentication
;
864 case sHostbasedAuthentication
:
865 intptr
= &options
->hostbased_authentication
;
868 case sHostbasedUsesNameFromPacketOnly
:
869 intptr
= &options
->hostbased_uses_name_from_packet_only
;
872 case sRSAAuthentication
:
873 intptr
= &options
->rsa_authentication
;
876 case sPubkeyAuthentication
:
877 intptr
= &options
->pubkey_authentication
;
880 case sKerberosAuthentication
:
881 intptr
= &options
->kerberos_authentication
;
884 case sKerberosOrLocalPasswd
:
885 intptr
= &options
->kerberos_or_local_passwd
;
888 case sKerberosTicketCleanup
:
889 intptr
= &options
->kerberos_ticket_cleanup
;
892 case sKerberosGetAFSToken
:
893 intptr
= &options
->kerberos_get_afs_token
;
896 case sGssAuthentication
:
897 intptr
= &options
->gss_authentication
;
900 case sGssCleanupCreds
:
901 intptr
= &options
->gss_cleanup_creds
;
904 case sPasswordAuthentication
:
905 intptr
= &options
->password_authentication
;
908 case sZeroKnowledgePasswordAuthentication
:
909 intptr
= &options
->zero_knowledge_password_authentication
;
912 case sKbdInteractiveAuthentication
:
913 intptr
= &options
->kbd_interactive_authentication
;
916 case sChallengeResponseAuthentication
:
917 intptr
= &options
->challenge_response_authentication
;
921 intptr
= &options
->print_motd
;
925 intptr
= &options
->print_lastlog
;
929 intptr
= &options
->x11_forwarding
;
932 case sX11DisplayOffset
:
933 intptr
= &options
->x11_display_offset
;
936 case sX11UseLocalhost
:
937 intptr
= &options
->x11_use_localhost
;
941 charptr
= &options
->xauth_location
;
945 intptr
= &options
->strict_modes
;
949 intptr
= &options
->tcp_keep_alive
;
952 case sPermitBlacklistedKeys
:
953 intptr
= &options
->permit_blacklisted_keys
;
957 intptr
= &options
->permit_empty_passwd
;
960 case sPermitUserEnvironment
:
961 intptr
= &options
->permit_user_env
;
965 intptr
= &options
->use_login
;
969 intptr
= &options
->compression
;
971 if (!arg
|| *arg
== '\0')
972 fatal("%s line %d: missing yes/no/delayed "
973 "argument.", filename
, linenum
);
974 value
= 0; /* silence compiler */
975 if (strcmp(arg
, "delayed") == 0)
976 value
= COMP_DELAYED
;
977 else if (strcmp(arg
, "yes") == 0)
979 else if (strcmp(arg
, "no") == 0)
982 fatal("%s line %d: Bad yes/no/delayed "
983 "argument: %s", filename
, linenum
, arg
);
989 intptr
= &options
->gateway_ports
;
991 if (!arg
|| *arg
== '\0')
992 fatal("%s line %d: missing yes/no/clientspecified "
993 "argument.", filename
, linenum
);
994 value
= 0; /* silence compiler */
995 if (strcmp(arg
, "clientspecified") == 0)
997 else if (strcmp(arg
, "yes") == 0)
999 else if (strcmp(arg
, "no") == 0)
1002 fatal("%s line %d: Bad yes/no/clientspecified "
1003 "argument: %s", filename
, linenum
, arg
);
1004 if (*activep
&& *intptr
== -1)
1009 intptr
= &options
->use_dns
;
1013 log_facility_ptr
= &options
->log_facility
;
1014 arg
= strdelim(&cp
);
1015 value
= log_facility_number(arg
);
1016 if (value
== SYSLOG_FACILITY_NOT_SET
)
1017 fatal("%.200s line %d: unsupported log facility '%s'",
1018 filename
, linenum
, arg
? arg
: "<NONE>");
1019 if (*log_facility_ptr
== -1)
1020 *log_facility_ptr
= (SyslogFacility
) value
;
1024 log_level_ptr
= &options
->log_level
;
1025 arg
= strdelim(&cp
);
1026 value
= log_level_number(arg
);
1027 if (value
== SYSLOG_LEVEL_NOT_SET
)
1028 fatal("%.200s line %d: unsupported log level '%s'",
1029 filename
, linenum
, arg
? arg
: "<NONE>");
1030 if (*log_level_ptr
== -1)
1031 *log_level_ptr
= (LogLevel
) value
;
1034 case sAllowTcpForwarding
:
1035 intptr
= &options
->allow_tcp_forwarding
;
1038 case sAllowAgentForwarding
:
1039 intptr
= &options
->allow_agent_forwarding
;
1042 case sUsePrivilegeSeparation
:
1043 intptr
= &use_privsep
;
1047 while ((arg
= strdelim(&cp
)) && *arg
!= '\0') {
1048 if (options
->num_allow_users
>= MAX_ALLOW_USERS
)
1049 fatal("%s line %d: too many allow users.",
1051 options
->allow_users
[options
->num_allow_users
++] =
1057 while ((arg
= strdelim(&cp
)) && *arg
!= '\0') {
1058 if (options
->num_deny_users
>= MAX_DENY_USERS
)
1059 fatal("%s line %d: too many deny users.",
1061 options
->deny_users
[options
->num_deny_users
++] =
1067 while ((arg
= strdelim(&cp
)) && *arg
!= '\0') {
1068 if (options
->num_allow_groups
>= MAX_ALLOW_GROUPS
)
1069 fatal("%s line %d: too many allow groups.",
1071 options
->allow_groups
[options
->num_allow_groups
++] =
1077 while ((arg
= strdelim(&cp
)) && *arg
!= '\0') {
1078 if (options
->num_deny_groups
>= MAX_DENY_GROUPS
)
1079 fatal("%s line %d: too many deny groups.",
1081 options
->deny_groups
[options
->num_deny_groups
++] = xstrdup(arg
);
1086 arg
= strdelim(&cp
);
1087 if (!arg
|| *arg
== '\0')
1088 fatal("%s line %d: Missing argument.", filename
, linenum
);
1089 if (!ciphers_valid(arg
))
1090 fatal("%s line %d: Bad SSH2 cipher spec '%s'.",
1091 filename
, linenum
, arg
? arg
: "<NONE>");
1092 if (options
->ciphers
== NULL
)
1093 options
->ciphers
= xstrdup(arg
);
1097 arg
= strdelim(&cp
);
1098 if (!arg
|| *arg
== '\0')
1099 fatal("%s line %d: Missing argument.", filename
, linenum
);
1100 if (!mac_valid(arg
))
1101 fatal("%s line %d: Bad SSH2 mac spec '%s'.",
1102 filename
, linenum
, arg
? arg
: "<NONE>");
1103 if (options
->macs
== NULL
)
1104 options
->macs
= xstrdup(arg
);
1108 intptr
= &options
->protocol
;
1109 arg
= strdelim(&cp
);
1110 if (!arg
|| *arg
== '\0')
1111 fatal("%s line %d: Missing argument.", filename
, linenum
);
1112 value
= proto_spec(arg
);
1113 if (value
== SSH_PROTO_UNKNOWN
)
1114 fatal("%s line %d: Bad protocol spec '%s'.",
1115 filename
, linenum
, arg
? arg
: "<NONE>");
1116 if (*intptr
== SSH_PROTO_UNKNOWN
)
1121 if (options
->num_subsystems
>= MAX_SUBSYSTEMS
) {
1122 fatal("%s line %d: too many subsystems defined.",
1125 arg
= strdelim(&cp
);
1126 if (!arg
|| *arg
== '\0')
1127 fatal("%s line %d: Missing subsystem name.",
1130 arg
= strdelim(&cp
);
1133 for (i
= 0; i
< options
->num_subsystems
; i
++)
1134 if (strcmp(arg
, options
->subsystem_name
[i
]) == 0)
1135 fatal("%s line %d: Subsystem '%s' already defined.",
1136 filename
, linenum
, arg
);
1137 options
->subsystem_name
[options
->num_subsystems
] = xstrdup(arg
);
1138 arg
= strdelim(&cp
);
1139 if (!arg
|| *arg
== '\0')
1140 fatal("%s line %d: Missing subsystem command.",
1142 options
->subsystem_command
[options
->num_subsystems
] = xstrdup(arg
);
1144 /* Collect arguments (separate to executable) */
1146 len
= strlen(p
) + 1;
1147 while ((arg
= strdelim(&cp
)) != NULL
&& *arg
!= '\0') {
1148 len
+= 1 + strlen(arg
);
1149 p
= xrealloc(p
, 1, len
);
1150 strlcat(p
, " ", len
);
1151 strlcat(p
, arg
, len
);
1153 options
->subsystem_args
[options
->num_subsystems
] = p
;
1154 options
->num_subsystems
++;
1158 arg
= strdelim(&cp
);
1159 if (!arg
|| *arg
== '\0')
1160 fatal("%s line %d: Missing MaxStartups spec.",
1162 if ((n
= sscanf(arg
, "%d:%d:%d",
1163 &options
->max_startups_begin
,
1164 &options
->max_startups_rate
,
1165 &options
->max_startups
)) == 3) {
1166 if (options
->max_startups_begin
>
1167 options
->max_startups
||
1168 options
->max_startups_rate
> 100 ||
1169 options
->max_startups_rate
< 1)
1170 fatal("%s line %d: Illegal MaxStartups spec.",
1173 fatal("%s line %d: Illegal MaxStartups spec.",
1176 options
->max_startups
= options
->max_startups_begin
;
1180 intptr
= &options
->max_authtries
;
1184 intptr
= &options
->max_sessions
;
1188 charptr
= &options
->banner
;
1189 goto parse_filename
;
1192 * These options can contain %X options expanded at
1193 * connect time, so that you can specify paths like:
1195 * AuthorizedKeysFile /etc/ssh_keys/%u
1197 case sAuthorizedKeysFile
:
1198 case sAuthorizedKeysFile2
:
1199 charptr
= (opcode
== sAuthorizedKeysFile
) ?
1200 &options
->authorized_keys_file
:
1201 &options
->authorized_keys_file2
;
1202 goto parse_filename
;
1204 case sClientAliveInterval
:
1205 intptr
= &options
->client_alive_interval
;
1208 case sClientAliveCountMax
:
1209 intptr
= &options
->client_alive_count_max
;
1213 while ((arg
= strdelim(&cp
)) && *arg
!= '\0') {
1214 if (strchr(arg
, '=') != NULL
)
1215 fatal("%s line %d: Invalid environment name.",
1217 if (options
->num_accept_env
>= MAX_ACCEPT_ENV
)
1218 fatal("%s line %d: too many allow env.",
1222 options
->accept_env
[options
->num_accept_env
++] =
1228 intptr
= &options
->permit_tun
;
1229 arg
= strdelim(&cp
);
1230 if (!arg
|| *arg
== '\0')
1231 fatal("%s line %d: Missing yes/point-to-point/"
1232 "ethernet/no argument.", filename
, linenum
);
1234 for (i
= 0; tunmode_desc
[i
].val
!= -1; i
++)
1235 if (strcmp(tunmode_desc
[i
].text
, arg
) == 0) {
1236 value
= tunmode_desc
[i
].val
;
1240 fatal("%s line %d: Bad yes/point-to-point/ethernet/"
1241 "no argument: %s", filename
, linenum
, arg
);
1248 fatal("Match directive not supported as a command-line "
1250 value
= match_cfg_line(&cp
, linenum
, user
, host
, address
);
1252 fatal("%s line %d: Bad Match condition", filename
,
1258 arg
= strdelim(&cp
);
1259 if (!arg
|| *arg
== '\0')
1260 fatal("%s line %d: missing PermitOpen specification",
1262 n
= options
->num_permitted_opens
; /* modified later */
1263 if (strcmp(arg
, "any") == 0) {
1264 if (*activep
&& n
== -1) {
1265 channel_clear_adm_permitted_opens();
1266 options
->num_permitted_opens
= 0;
1270 if (*activep
&& n
== -1)
1271 channel_clear_adm_permitted_opens();
1272 for (; arg
!= NULL
&& *arg
!= '\0'; arg
= strdelim(&cp
)) {
1275 fatal("%s line %d: missing host in PermitOpen",
1277 p
= cleanhostname(p
);
1278 if (arg
== NULL
|| (port
= a2port(arg
)) <= 0)
1279 fatal("%s line %d: bad port number in "
1280 "PermitOpen", filename
, linenum
);
1281 if (*activep
&& n
== -1)
1282 options
->num_permitted_opens
=
1283 channel_add_adm_permitted_opens(p
, port
);
1289 fatal("%.200s line %d: Missing argument.", filename
,
1291 len
= strspn(cp
, WHITESPACE
);
1292 if (*activep
&& options
->adm_forced_command
== NULL
)
1293 options
->adm_forced_command
= xstrdup(cp
+ len
);
1296 case sChrootDirectory
:
1297 charptr
= &options
->chroot_directory
;
1299 arg
= strdelim(&cp
);
1300 if (!arg
|| *arg
== '\0')
1301 fatal("%s line %d: missing file name.",
1303 if (*activep
&& *charptr
== NULL
)
1304 *charptr
= xstrdup(arg
);
1307 case sVersionAddendum
:
1308 ssh_version_set_addendum(strtok(cp
, "\n"));
1310 arg
= strdelim(&cp
);
1311 } while (arg
!= NULL
&& *arg
!= '\0');
1315 logit("%s line %d: Deprecated option %s",
1316 filename
, linenum
, arg
);
1318 arg
= strdelim(&cp
);
1322 logit("%s line %d: Unsupported option %s",
1323 filename
, linenum
, arg
);
1325 arg
= strdelim(&cp
);
1329 fatal("%s line %d: Missing handler for opcode %s (%d)",
1330 filename
, linenum
, arg
, opcode
);
1332 if ((arg
= strdelim(&cp
)) != NULL
&& *arg
!= '\0')
1333 fatal("%s line %d: garbage at end of line; \"%.200s\".",
1334 filename
, linenum
, arg
);
1338 /* Reads the server configuration file. */
1341 load_server_config(const char *filename
, Buffer
*conf
)
1343 char line
[1024], *cp
;
1346 debug2("%s: filename %s", __func__
, filename
);
1347 if ((f
= fopen(filename
, "r")) == NULL
) {
1352 while (fgets(line
, sizeof(line
), f
)) {
1354 * Trim out comments and strip whitespace
1355 * NB - preserve newlines, they are needed to reproduce
1356 * line numbers later for error messages
1358 if ((cp
= strchr(line
, '#')) != NULL
)
1359 memcpy(cp
, "\n", 2);
1360 cp
= line
+ strspn(line
, " \t\r");
1362 buffer_append(conf
, cp
, strlen(cp
));
1364 buffer_append(conf
, "\0", 1);
1366 debug2("%s: done config len = %d", __func__
, buffer_len(conf
));
1370 parse_server_match_config(ServerOptions
*options
, const char *user
,
1371 const char *host
, const char *address
)
1375 initialize_server_options(&mo
);
1376 parse_server_config(&mo
, "reprocess config", &cfg
, user
, host
, address
);
1377 copy_set_server_options(options
, &mo
, 0);
1381 #define M_CP_INTOPT(n) do {\
1385 #define M_CP_STROPT(n) do {\
1386 if (src->n != NULL) { \
1387 if (dst->n != NULL) \
1394 * Copy any supported values that are set.
1396 * If the preauth flag is set, we do not bother copying the string or
1397 * array values that are not used pre-authentication, because any that we
1398 * do use must be explictly sent in mm_getpwnamallow().
1401 copy_set_server_options(ServerOptions
*dst
, ServerOptions
*src
, int preauth
)
1403 M_CP_INTOPT(password_authentication
);
1404 M_CP_INTOPT(gss_authentication
);
1405 M_CP_INTOPT(rsa_authentication
);
1406 M_CP_INTOPT(pubkey_authentication
);
1407 M_CP_INTOPT(kerberos_authentication
);
1408 M_CP_INTOPT(hostbased_authentication
);
1409 M_CP_INTOPT(kbd_interactive_authentication
);
1410 M_CP_INTOPT(zero_knowledge_password_authentication
);
1411 M_CP_INTOPT(permit_root_login
);
1412 M_CP_INTOPT(permit_empty_passwd
);
1414 M_CP_INTOPT(allow_tcp_forwarding
);
1415 M_CP_INTOPT(allow_agent_forwarding
);
1416 M_CP_INTOPT(gateway_ports
);
1417 M_CP_INTOPT(x11_display_offset
);
1418 M_CP_INTOPT(x11_forwarding
);
1419 M_CP_INTOPT(x11_use_localhost
);
1420 M_CP_INTOPT(max_sessions
);
1421 M_CP_INTOPT(max_authtries
);
1423 M_CP_STROPT(banner
);
1426 M_CP_STROPT(adm_forced_command
);
1427 M_CP_STROPT(chroot_directory
);
1434 parse_server_config(ServerOptions
*options
, const char *filename
, Buffer
*conf
,
1435 const char *user
, const char *host
, const char *address
)
1437 int active
, linenum
, bad_options
= 0;
1438 char *cp
, *obuf
, *cbuf
;
1440 debug2("%s: config %s len %d", __func__
, filename
, buffer_len(conf
));
1442 obuf
= cbuf
= xstrdup(buffer_ptr(conf
));
1443 active
= user
? 0 : 1;
1445 while ((cp
= strsep(&cbuf
, "\n")) != NULL
) {
1446 if (process_server_config_line(options
, cp
, filename
,
1447 linenum
++, &active
, user
, host
, address
) != 0)
1451 if (bad_options
> 0)
1452 fatal("%s: terminating, %d bad configuration options",
1453 filename
, bad_options
);
1457 fmt_intarg(ServerOpCodes code
, int val
)
1459 if (code
== sAddressFamily
) {
1471 if (code
== sPermitRootLogin
) {
1473 case PERMIT_NO_PASSWD
:
1474 return "without-password";
1475 case PERMIT_FORCED_ONLY
:
1476 return "forced-commands-only";
1481 if (code
== sProtocol
) {
1487 case (SSH_PROTO_1
|SSH_PROTO_2
):
1493 if (code
== sGatewayPorts
&& val
== 2)
1494 return "clientspecified";
1495 if (code
== sCompression
&& val
== COMP_DELAYED
)
1509 lookup_opcode_name(ServerOpCodes code
)
1513 for (i
= 0; keywords
[i
].name
!= NULL
; i
++)
1514 if (keywords
[i
].opcode
== code
)
1515 return(keywords
[i
].name
);
1520 dump_cfg_int(ServerOpCodes code
, int val
)
1522 printf("%s %d\n", lookup_opcode_name(code
), val
);
1526 dump_cfg_fmtint(ServerOpCodes code
, int val
)
1528 printf("%s %s\n", lookup_opcode_name(code
), fmt_intarg(code
, val
));
1532 dump_cfg_string(ServerOpCodes code
, const char *val
)
1536 printf("%s %s\n", lookup_opcode_name(code
), val
);
1540 dump_cfg_strarray(ServerOpCodes code
, u_int count
, char **vals
)
1544 for (i
= 0; i
< count
; i
++)
1545 printf("%s %s\n", lookup_opcode_name(code
), vals
[i
]);
1549 dump_config(ServerOptions
*o
)
1553 struct addrinfo
*ai
;
1554 char addr
[NI_MAXHOST
], port
[NI_MAXSERV
], *s
= NULL
;
1556 /* these are usually at the top of the config */
1557 for (i
= 0; i
< o
->num_ports
; i
++)
1558 printf("port %d\n", o
->ports
[i
]);
1559 dump_cfg_fmtint(sProtocol
, o
->protocol
);
1560 dump_cfg_fmtint(sAddressFamily
, o
->address_family
);
1562 /* ListenAddress must be after Port */
1563 for (ai
= o
->listen_addrs
; ai
; ai
= ai
->ai_next
) {
1564 if ((ret
= getnameinfo(ai
->ai_addr
, ai
->ai_addrlen
, addr
,
1565 sizeof(addr
), port
, sizeof(port
),
1566 NI_NUMERICHOST
|NI_NUMERICSERV
)) != 0) {
1567 error("getnameinfo failed: %.100s",
1568 (ret
!= EAI_SYSTEM
) ? gai_strerror(ret
) :
1571 if (ai
->ai_family
== AF_INET6
)
1572 printf("listenaddress [%s]:%s\n", addr
, port
);
1574 printf("listenaddress %s:%s\n", addr
, port
);
1578 /* integer arguments */
1580 dump_cfg_int(sUsePAM
, o
->use_pam
);
1582 dump_cfg_int(sServerKeyBits
, o
->server_key_bits
);
1583 dump_cfg_int(sLoginGraceTime
, o
->login_grace_time
);
1584 dump_cfg_int(sKeyRegenerationTime
, o
->key_regeneration_time
);
1585 dump_cfg_int(sX11DisplayOffset
, o
->x11_display_offset
);
1586 dump_cfg_int(sMaxAuthTries
, o
->max_authtries
);
1587 dump_cfg_int(sMaxSessions
, o
->max_sessions
);
1588 dump_cfg_int(sClientAliveInterval
, o
->client_alive_interval
);
1589 dump_cfg_int(sClientAliveCountMax
, o
->client_alive_count_max
);
1591 /* formatted integer arguments */
1592 dump_cfg_fmtint(sPermitRootLogin
, o
->permit_root_login
);
1593 dump_cfg_fmtint(sIgnoreRhosts
, o
->ignore_rhosts
);
1594 dump_cfg_fmtint(sIgnoreUserKnownHosts
, o
->ignore_user_known_hosts
);
1595 dump_cfg_fmtint(sRhostsRSAAuthentication
, o
->rhosts_rsa_authentication
);
1596 dump_cfg_fmtint(sHostbasedAuthentication
, o
->hostbased_authentication
);
1597 dump_cfg_fmtint(sHostbasedUsesNameFromPacketOnly
,
1598 o
->hostbased_uses_name_from_packet_only
);
1599 dump_cfg_fmtint(sRSAAuthentication
, o
->rsa_authentication
);
1600 dump_cfg_fmtint(sPubkeyAuthentication
, o
->pubkey_authentication
);
1602 dump_cfg_fmtint(sKerberosAuthentication
, o
->kerberos_authentication
);
1603 dump_cfg_fmtint(sKerberosOrLocalPasswd
, o
->kerberos_or_local_passwd
);
1604 dump_cfg_fmtint(sKerberosTicketCleanup
, o
->kerberos_ticket_cleanup
);
1606 dump_cfg_fmtint(sKerberosGetAFSToken
, o
->kerberos_get_afs_token
);
1610 dump_cfg_fmtint(sGssAuthentication
, o
->gss_authentication
);
1611 dump_cfg_fmtint(sGssCleanupCreds
, o
->gss_cleanup_creds
);
1614 dump_cfg_fmtint(sZeroKnowledgePasswordAuthentication
,
1615 o
->zero_knowledge_password_authentication
);
1617 dump_cfg_fmtint(sPasswordAuthentication
, o
->password_authentication
);
1618 dump_cfg_fmtint(sKbdInteractiveAuthentication
,
1619 o
->kbd_interactive_authentication
);
1620 dump_cfg_fmtint(sChallengeResponseAuthentication
,
1621 o
->challenge_response_authentication
);
1622 dump_cfg_fmtint(sPrintMotd
, o
->print_motd
);
1623 dump_cfg_fmtint(sPrintLastLog
, o
->print_lastlog
);
1624 dump_cfg_fmtint(sX11Forwarding
, o
->x11_forwarding
);
1625 dump_cfg_fmtint(sX11UseLocalhost
, o
->x11_use_localhost
);
1626 dump_cfg_fmtint(sStrictModes
, o
->strict_modes
);
1627 dump_cfg_fmtint(sTCPKeepAlive
, o
->tcp_keep_alive
);
1628 dump_cfg_fmtint(sEmptyPasswd
, o
->permit_empty_passwd
);
1629 dump_cfg_fmtint(sPermitUserEnvironment
, o
->permit_user_env
);
1630 dump_cfg_fmtint(sUseLogin
, o
->use_login
);
1631 dump_cfg_fmtint(sCompression
, o
->compression
);
1632 dump_cfg_fmtint(sGatewayPorts
, o
->gateway_ports
);
1633 dump_cfg_fmtint(sUseDNS
, o
->use_dns
);
1634 dump_cfg_fmtint(sAllowTcpForwarding
, o
->allow_tcp_forwarding
);
1635 dump_cfg_fmtint(sUsePrivilegeSeparation
, use_privsep
);
1637 /* string arguments */
1638 dump_cfg_string(sPidFile
, o
->pid_file
);
1639 dump_cfg_string(sXAuthLocation
, o
->xauth_location
);
1640 dump_cfg_string(sCiphers
, o
->ciphers
);
1641 dump_cfg_string(sMacs
, o
->macs
);
1642 dump_cfg_string(sBanner
, o
->banner
);
1643 dump_cfg_string(sAuthorizedKeysFile
, o
->authorized_keys_file
);
1644 dump_cfg_string(sAuthorizedKeysFile2
, o
->authorized_keys_file2
);
1645 dump_cfg_string(sForceCommand
, o
->adm_forced_command
);
1647 /* string arguments requiring a lookup */
1648 dump_cfg_string(sLogLevel
, log_level_name(o
->log_level
));
1649 dump_cfg_string(sLogFacility
, log_facility_name(o
->log_facility
));
1651 /* string array arguments */
1652 dump_cfg_strarray(sHostKeyFile
, o
->num_host_key_files
,
1654 dump_cfg_strarray(sAllowUsers
, o
->num_allow_users
, o
->allow_users
);
1655 dump_cfg_strarray(sDenyUsers
, o
->num_deny_users
, o
->deny_users
);
1656 dump_cfg_strarray(sAllowGroups
, o
->num_allow_groups
, o
->allow_groups
);
1657 dump_cfg_strarray(sDenyGroups
, o
->num_deny_groups
, o
->deny_groups
);
1658 dump_cfg_strarray(sAcceptEnv
, o
->num_accept_env
, o
->accept_env
);
1660 /* other arguments */
1661 for (i
= 0; i
< o
->num_subsystems
; i
++)
1662 printf("subsystem %s %s\n", o
->subsystem_name
[i
],
1663 o
->subsystem_args
[i
]);
1665 printf("maxstartups %d:%d:%d\n", o
->max_startups_begin
,
1666 o
->max_startups_rate
, o
->max_startups
);
1668 for (i
= 0; tunmode_desc
[i
].val
!= -1; i
++)
1669 if (tunmode_desc
[i
].val
== o
->permit_tun
) {
1670 s
= tunmode_desc
[i
].text
;
1673 dump_cfg_string(sPermitTunnel
, s
);
1675 channel_print_adm_permitted_opens();