search for: ga_match_pattern_list

...ority: P2 Component: ssh AssignedTo: unassigned-bugs at mindrot.org ReportedBy: osshbugs at qwe.cc Statements such as: Match User !root ForceCommand /bin/rshell or: Match Group !root ForceCommand /bin/rshell Will not work, due to (in my read) servconf.c # } else if (ga_match_pattern_list(grps) != 1) { and # if (match_pattern_list(user, arg, len, 0) != 1) Both functions on an affirmatively negated match will return -1 (rather than 1, but still non zero), thus never being considered a "match" by either user or group negation processing. In fact, for users, I'm not ce...

On Wed, 20 Feb 2019 at 23:54, Corinna Vinschen <vinschen at redhat.com> wrote: > The previous revert enabled case-insensitive user names again. This > patch implements the case-insensitive user and group name matching. > To allow Unicode chars, implement the matcher using wchar_t chars in > Cygwin-specific code. Keep the generic code changes as small as possible. > Cygwin:

http://bugzilla.mindrot.org/show_bug.cgi?id=1315 Summary: Match Group does not support negation Product: Portable OpenSSH Version: 4.6p1 Platform: All OS/Version: All Status: NEW Severity: enhancement Priority: P2 Component: sshd AssignedTo: bitbucket at mindrot.org ReportedBy: wknox at

Windows usernames are case-insensitive and almost any Unicode character is allowed in a username. The user should be able to login with her username given in any case and not be refused. However, this opens up a security problem in terms of the sshd_config Match rules. The match rules for user and group names have to operate case-insensitive as well, otherwise the user can override her settings

...e cygwin function is always called for case-insensitive operation. How's this? It's just tweaking your patch a bit, simplifying the Cygwin code. diff --git a/groupaccess.c b/groupaccess.c index 43367990d8c3..1a498d16beac 100644 --- a/groupaccess.c +++ b/groupaccess.c @@ -103,11 +103,8 @@ ga_match_pattern_list(const char *group_pattern) int i, found = 0; for (i = 0; i < ngroups; i++) { -#ifndef HAVE_CYGWIN - switch (match_pattern_list(groups_byname[i], group_pattern, 0)) { -#else - switch (match_pattern_list(groups_byname[i], group_pattern, 1)) { -#endif + switch (match_usergroup_pattern_list...