openssh unix dev - Apr 2014 - heads up: tcpwrappers support going away

Hi,

This is an early warning: OpenSSH will drop tcpwrappers in the next
release. sshd_config has supported the Match keyword for a long time
and it is possible to express more useful conditions (e.g. matching
by user and address) than tcpwrappers allowed.

Removing it reduces the amount of code in the 'hot' pre-authentication
path in sshd and rids us of a dependency.

-d

On 04/22/2014 09:33 AM, Damien Miller wrote:
> Hi,
Hi,
> This is an early warning: OpenSSH will drop tcpwrappers in the next
> release. sshd_config has supported the Match keyword for a long time
> and it is possible to express more useful conditions (e.g. matching
> by user and address) than tcpwrappers allowed.
I'd agree that you can express more useful conditions using Match but it is
used in other application level than tcpwrappers.

Using tcpwrappers, you can drop a connection before even the server
identification
string is sent, while Match block is applied after the transport layer is
established.

You don't have to restart sshd every time you want to change conditions in
tcpwrappers, while
every change in sshd_config has to be confirmed by restart.

> Removing it reduces the amount of code in the 'hot'
pre-authentication
> path in sshd and rids us of a dependency.
> 
I can see only 17 lines of code in sshd.c around if (!hosts_access(&req)).

The tcpwrappers support is already optional so it is not a hard dependency.


Petr
-- 
Petr Lautrbach
Security Technologies
Red Hat

Better technology. Faster innovation. Powered by community collaboration.
See how it works at redhat.com.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: OpenPGP digital signature
URL:
<http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20140422/89655bcb/attachment.bin>

>>>>> "DM" == Damien Miller <djm at mindrot.org>
writes:
DM> This is an early warning: OpenSSH will drop tcpwrappers in the next
DM> release.

This will need a wider announcement.  Most auto-block solutions I've
looked at add entries to hosts.allow.  Everyone using such will need
to adapt their setup to cope.

Several use the notion of of a spawn line in hosts.allow.  With the
loss of tcpwrapper, openssh should add an option to run a command
for each incomming conenction (before it sends the banner, et alia)
which can check for abuse patterns and add (or expire) a packet filter.

The external should be expected to return zero to permit the connection
or non-zero to prevent it, plus perform any side-effects the admin wants.

-JimC
--
James Cloos <cloos at jhcloos.com>         OpenPGP: 0x997A9F17ED7DAEA6