Displaying 20 results from an estimated 23 matches for "no_x11_forwarding_flag".
2003 Dec 07
0
[PATCH] Do PAM chauthtok via keyboard-interactive.
...us = -1;
static char **sshpam_env = NULL;
struct pam_ctxt {
@@ -144,6 +146,21 @@ pam_getenvlist(pam_handle_t *pamh)
}
#endif
+void
+pam_password_change_required(int reqd)
+{
+ sshpam_new_authtok_reqd = reqd;
+ if (reqd) {
+ no_port_forwarding_flag |= 2;
+ no_agent_forwarding_flag |= 2;
+ no_x11_forwarding_flag |= 2;
+ } else {
+ no_port_forwarding_flag &= ~2;
+ no_agent_forwarding_flag &= ~2;
+ no_x11_forwarding_flag &= ~2;
+
+ }
+}
/* Import regular and PAM environment from subprocess */
static void
import_environments(Buffer *b)
@@ -152,6 +169,13 @@ import_environments(Buffer *b)
u_...
2001 Jun 05
1
OpenSSH tmp cleanup
Hi,
I noticed that Markus has fixed the temporary file cleanup problems in
OpenSSH cvs. What files need patching for this ? I only noticed
changes in: session.c, channels.h and channels.c.
-Jarno
--
Jarno Huuskonen <Jarno.Huuskonen at uku.fi>
2003 Oct 30
1
Patch to make sshd work on multihomed systems
...AXHOSTNAMELEN))
return (-1);
diff -u -r src.old/session.c src/session.c
--- src.old/session.c Thu Oct 30 15:02:46 2003
+++ src/session.c Thu Oct 30 15:02:44 2003
@@ -2060,6 +2060,7 @@
struct stat st;
char display[512], auth_display[512];
char hostname[MAXHOSTNAMELEN];
+ char *pname;
if (no_x11_forwarding_flag) {
packet_send_debug("X11 forwarding disabled in user configuration file.");
@@ -2091,8 +2092,13 @@
}
/* Set up a suitable value for the DISPLAY variable. */
- if (gethostname(hostname, sizeof(hostname)) < 0)
+ pname = get_local_name(packet_get_connection_in());
+ if (pname) {...
2003 Jan 29
0
[PATCH] features for restricted shell environments
...rwarding)
- channel_add_permitted_opens(host, port);
xfree(patterns);
goto next_option;
}
--- auth-pam.c 28 Jan 2003 18:06:51 -0000 1.1.1.2
+++ auth-pam.c 29 Jan 2003 20:39:19 -0000 1.2
@@ -358,7 +360,7 @@
no_port_forwarding_flag &= ~2;
no_agent_forwarding_flag &= ~2;
no_x11_forwarding_flag &= ~2;
- if (!no_port_forwarding_flag && options.allow_tcp_forwarding)
+ if (!auth_restricted(RESTRICT_TCP, auth_get_user()))
channel_permit_all_opens();
#endif
}
--- auth.c 28 Jan 2003 18:06:51 -0000 1.1.1.2
+++ auth.c 29 Jan 2003 21:26:11 -0000 1.4
@@ -291,6 +293,31 @@
retu...
2003 Oct 12
4
[PATCH]: Call pam_chauthtok from keyboard-interactive.
...UTHTOK_REQD)
- return (0);
+ if (sshpam_err != PAM_SUCCESS && sshpam_err != PAM_NEW_AUTHTOK_REQD) {
+ sshpam_account_status = 0;
+ return (sshpam_account_status);
+ }
if (sshpam_err == PAM_NEW_AUTHTOK_REQD) {
sshpam_new_authtok_reqd = 1;
@@ -547,7 +564,8 @@ do_pam_account(void)
no_x11_forwarding_flag |= 2;
}
- return (1);
+ sshpam_account_status = 1;
+ return (sshpam_account_status);
}
void
2002 Dec 21
6
[PATCH] PAM chauthtok + Privsep
...rivsep ?
- NEW_AUTHTOK_MSG_PRIVSEP : NEW_AUTHTOK_MSG);
+ message_cat(&__pam_msg, NEW_AUTHTOK_MSG);
/* flag that password change is necessary */
password_change_required = 1;
/* disallow other functionality for now */
@@ -267,7 +266,6 @@
no_agent_forwarding_flag |= 2;
no_x11_forwarding_flag |= 2;
break;
-#endif
default:
log("PAM rejected by account configuration[%d]: "
"%.200s", pam_retval, PAM_STRERROR(__pamh,
@@ -301,6 +299,18 @@
session_opened = 1;
}
+/* Set the TTY after session is open */
+void do_pam_set_tty(const char *ttyname) {
+ i...
2003 Jul 09
0
[PATCH] Add expired password handling for AIX.
...at password change is necessary and disable all forwarding
+ */
+void
+flag_password_change_required(void)
+{
+ debug3("disabling forwarding");
+ password_change_required = 1;
+
+ /* disallow other functionality for now */
+ no_port_forwarding_flag |= 2;
+ no_agent_forwarding_flag |= 2;
+ no_x11_forwarding_flag |= 2;
+}
+
+/*
+ * Flags that password change was successful.
+ * XXX: the password change is performed in the process that becomes the
+ * shell, but the flags must be reset in its parent and currently there is no
+ * way to notify the parent that the change was successful.
+ */
+void
+flag_passwo...
2003 Jul 30
1
[PATCH] Password expiry merge (AIX parts)
...at password change is necessary and disable all forwarding
+ */
+void
+flag_password_change_required(void)
+{
+ debug3("disabling forwarding");
+ password_change_required = 1;
+
+ /* disallow other functionality for now */
+ no_port_forwarding_flag |= 2;
+ no_agent_forwarding_flag |= 2;
+ no_x11_forwarding_flag |= 2;
+}
+
+/*
+ * Flags that password change was successful.
+ * XXX: the password change is performed in the process that becomes the
+ * shell, but the flags must be reset in its parent and currently there is no
+ * way to notify the parent that the change was successful.
+ */
+void
+flag_passwo...
2002 Nov 20
0
[PATCH #9] Password expiration via /bin/passwd.
...s 8 (without PAM)
HP-UX 11.0 (trusted configuration, with PAM)
I'm confused about this from auth-pam.c:
/* XXX: This would need to be done in the parent process,
* but there's currently no way to pass such request. */
no_port_forwarding_flag &= ~2;
no_agent_forwarding_flag &= ~2;
no_x11_forwarding_flag &= ~2;
if (!no_port_forwarding_flag && options.allow_tcp_forwarding)
channel_permit_all_opens();
Isn't this all in the post-auth privsep slave? Or am I overlooking
something?
--
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4 37C9 C982 80C7 8FF...
2002 Aug 07
0
[Bug 381] New: unable to access expired accounts using PAM with openssh-3.4P1
..._REQD:
message_cat(&__pam_msg, use_privsep ?
NEW_AUTHTOK_MSG_PRIVSEP : NEW_AUTHTOK_MSG);
/* flag that password change is necessary */
password_change_required = 1;
/* disallow other functionality for now */
no_port_forwarding_flag |= 2;
no_agent_forwarding_flag |= 2;
no_x11_forwarding_flag |= 2;
break;
#endif
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
2002 Dec 08
1
Password expiry related clarification in OpenSSH3.5p1
..._REQD:
message_cat(&__pam_msg, use_privsep ?
NEW_AUTHTOK_MSG_PRIVSEP : NEW_AUTHTOK_MSG);
/* flag that password change is necessary */
password_change_required = 1;
/* disallow other functionality for now */
no_port_forwarding_flag |= 2;
no_agent_forwarding_flag |= 2;
no_x11_forwarding_flag |= 2;
break;
#endif
Please reply.
Thanks
Logsnaath.
----- End forwarded message -----
2003 Feb 20
0
"if 0" in auth-pam.c
.../* flag that password change is necessary */
password_change_required = 1;
/* disallow other functionality for now */
no_port_forwarding_flag |= 2;
no_agent_forwarding_flag |= 2;
no_x11_forwarding_flag |= 2;
break;
#endif
default:
log("PAM rejected by account configuration[%d]: "
"%.200s", pam_retval, PAM_STRERROR(__pamh,
pam_retval));...
2002 Dec 10
5
[PATCH] Password expiry with Privsep and PAM
...rivsep ?
- NEW_AUTHTOK_MSG_PRIVSEP : NEW_AUTHTOK_MSG);
+ message_cat(&__pam_msg, NEW_AUTHTOK_MSG);
/* flag that password change is necessary */
password_change_required = 1;
/* disallow other functionality for now */
@@ -267,7 +266,6 @@
no_agent_forwarding_flag |= 2;
no_x11_forwarding_flag |= 2;
break;
-#endif
default:
log("PAM rejected by account configuration[%d]: "
"%.200s", pam_retval, PAM_STRERROR(__pamh,
@@ -301,6 +299,18 @@
session_opened = 1;
}
+/* Set the TTY after session is open */
+void do_pam_set_tty(const char *ttyname) {
+ i...
2003 Nov 13
0
[PATCH] Perform do_pam_chauthtok via SSH2 keyboard-interactive.
...UTHTOK_REQD)
- return (0);
+ if (sshpam_err != PAM_SUCCESS && sshpam_err != PAM_NEW_AUTHTOK_REQD) {
+ sshpam_account_status = 0;
+ return (sshpam_account_status);
+ }
if (sshpam_err == PAM_NEW_AUTHTOK_REQD) {
sshpam_new_authtok_reqd = 1;
@@ -547,7 +566,8 @@ do_pam_account(void)
no_x11_forwarding_flag |= 2;
}
- return (1);
+ sshpam_account_status = 1;
+ return (sshpam_account_status);
}
void
Index: configure.ac
===================================================================
RCS file: /usr/local/src/security/openssh/cvs/openssh_cvs/configure.ac,v
retrieving revision 1.173
diff -u -p -...
2004 Jan 19
3
Security suggestion concering SSH and port forwarding.
Hi,
sorry if it is the wrong approuch to suggest improvments to OpenSSH,
but here comes my suggestion:
I recently stumbled upon the scponly shell which in it's chroot:ed form is
an ideal solution when you want to share some files with people you trust
more or less.
The problem is, if you use the scponlyc as shell, port forwarding is still
allowed. This can of course be dissallowed in
2003 Jul 30
7
[Bug 564] new PAM code only calls pam_acct_mgmt for challenge-response clients
http://bugzilla.mindrot.org/show_bug.cgi?id=564
------- Additional Comments From djm at mindrot.org 2003-07-30 11:48 -------
Maybe UsePAM should be a tri-state: "kbd-int", "no" or "always". This is ugly -
suggestions wanted.
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
2001 Oct 04
1
patch - forceshell
...goto next_option;
}
cp = "command=\"";
diff -ur openssh-2.9p2/auth-options.h openssh-2.9p2_forceshell/auth-options.h
--- openssh-2.9p2/auth-options.h Sun Jan 21 21:34:40 2001
+++ openssh-2.9p2_forceshell/auth-options.h Wed Oct 3 09:57:33 2001
@@ -28,6 +28,7 @@
extern int no_x11_forwarding_flag;
extern int no_pty_flag;
extern char *forced_command;
+extern char *forced_shell;
extern struct envstring *custom_environment;
/*
diff -ur openssh-2.9p2/session.c openssh-2.9p2_forceshell/session.c
--- openssh-2.9p2/session.c Sat Jun 16 20:40:51 2001
+++ openssh-2.9p2_forceshell/session.c Wed...
2002 Feb 12
0
[Patch] Xauthority file in /tmp
...t_env(&env, &envsize, "XAUTHORITY", xauthfile);
if (auth_get_socket_name() != NULL)
child_set_env(&env, &envsize, SSH_AUTHSOCKET_ENV_NAME,
auth_get_socket_name());
@@ -2039,6 +2066,7 @@
session_setup_x11fwd(Session *s)
{
struct stat st;
+ int fd;
if (no_x11_forwarding_flag) {
packet_send_debug("X11 forwarding disabled in user configuration file.");
@@ -2067,6 +2095,28 @@
debug("x11_create_display_inet failed.");
return 0;
}
+
+ if (options.xauthority_in_tmp && (xauthfile == NULL)) {
+ /* If required, setup a temp .Xauthority fi...
2000 Jul 12
0
Announce: portable OpenSSH 2.1.1p3
...cleanup, less cut&paste
- markus at cvs.openbsd.org 2000/06/26 15:59:19
[servconf.c servconf.h session.c sshd.8 sshd.c]
MaxStartups: limit number of unauthenticated connections, work by
theo and me
- deraadt at cvs.openbsd.org 2000/07/05 14:18:07
[session.c]
use no_x11_forwarding_flag correctly; provos ok
- provos at cvs.openbsd.org 2000/07/05 15:35:57
[sshd.c]
typo
- aaron at cvs.openbsd.org 2000/07/05 22:06:58
[scp.1 ssh-agent.1 ssh-keygen.1 sshd.8]
Insert more missing .El directives. Our troff really should identify
these and spit out a warn...
2000 Jul 12
0
Announce: portable OpenSSH 2.1.1p3
...cleanup, less cut&paste
- markus at cvs.openbsd.org 2000/06/26 15:59:19
[servconf.c servconf.h session.c sshd.8 sshd.c]
MaxStartups: limit number of unauthenticated connections, work by
theo and me
- deraadt at cvs.openbsd.org 2000/07/05 14:18:07
[session.c]
use no_x11_forwarding_flag correctly; provos ok
- provos at cvs.openbsd.org 2000/07/05 15:35:57
[sshd.c]
typo
- aaron at cvs.openbsd.org 2000/07/05 22:06:58
[scp.1 ssh-agent.1 ssh-keygen.1 sshd.8]
Insert more missing .El directives. Our troff really should identify
these and spit out a warn...