Hi
a fellow debian developer pointed it out to me, that ssh itself does not
check the username that is provided for login into a remote host, but
that scp checks it. I could verify that the current openssh code from
cvs still has a check for the username in scp.c but not in ssh.c. So I
created the attached small patch to remove the username check from scp.
I hope ?t's correct and that you apply it to the source. If it's wrong,
please point me to my mistake, so that I can learn from it. If you don't
want to apply it, then please tell me why. Thank you.
Ciao
Christian
--
When it is incorrect, it is, at least *authoritatively* incorrect.
-- Hitchiker's Guide To The Galaxy
-------------- next part --------------
--- scp.c.orig Thu Feb 8 21:20:50 2001
+++ scp.c Thu Feb 8 21:21:21 2001
@@ -207,7 +207,6 @@
char *colon(char *);
void lostconn(int);
void nospace(void);
-int okname(char *);
void run_err(const char *,...);
void verifydir(char *);
@@ -371,8 +370,6 @@
tuser = argv[argc - 1];
if (*tuser == '\0')
tuser = NULL;
- else if (!okname(tuser))
- exit(1);
} else {
thost = argv[argc - 1];
tuser = NULL;
@@ -395,8 +392,6 @@
suser = argv[i];
if (*suser == '\0')
suser = pwd->pw_name;
- else if (!okname(suser))
- continue;
sprintf(bp,
"%s%s -x -o'FallBackToRsh no' -n -l %s %s %s %s
'%s%s%s:%s'",
ssh_program, verbose_mode ? " -v" : "",
@@ -468,8 +463,6 @@
suser = argv[i];
if (*suser == '\0')
suser = pwd->pw_name;
- else if (!okname(suser))
- continue;
}
host = cleanhostname(host);
len = strlen(src) + CMDNEEDS + 20;
@@ -1017,28 +1010,6 @@
}
run_err("%s: %s", cp, strerror(errno));
exit(1);
-}
-
-int
-okname(cp0)
- char *cp0;
-{
- int c;
- char *cp;
-
- cp = cp0;
- do {
- c = *cp;
- if (c & 0200)
- goto bad;
- if (!isalpha(c) && !isdigit(c) &&
- c != '_' && c != '-' && c != '.'
&& c != '+')
- goto bad;
- } while (*++cp);
- return (1);
-
-bad: fprintf(stderr, "%s: invalid user name\n", cp0);
- return (0);
}
BUF *
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 241 bytes
Desc: not available
Url :
http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20010208/c4f07a36/attachment.bin