author | Jan Parcel <jan.parcel@oracle.com> |
Mon, 01 Feb 2016 06:53:50 -0800 | |
changeset 5376 | 4615bc2f4a50 |
parent 5027 | c71f34180df2 |
permissions | -rw-r--r-- |
2182
9f1202f3ddbd
19465507 Deprecate SunSSH-only server options (e.g. iMaxAuthTriesLog) in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
1 |
# |
9f1202f3ddbd
19465507 Deprecate SunSSH-only server options (e.g. iMaxAuthTriesLog) in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
2 |
# Originally we planned to only deprecate client config (ssh_config) options |
9f1202f3ddbd
19465507 Deprecate SunSSH-only server options (e.g. iMaxAuthTriesLog) in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
3 |
# and leave it up to system administrators to remove all SunSSH specific |
9f1202f3ddbd
19465507 Deprecate SunSSH-only server options (e.g. iMaxAuthTriesLog) in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
4 |
# server config (sshd_config) options. In internal testing we have discovered, |
9f1202f3ddbd
19465507 Deprecate SunSSH-only server options (e.g. iMaxAuthTriesLog) in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
5 |
# that this would bring too much trouble to the said administrators. |
9f1202f3ddbd
19465507 Deprecate SunSSH-only server options (e.g. iMaxAuthTriesLog) in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
6 |
# The probability of these options appearing in existing sshd_config files |
9f1202f3ddbd
19465507 Deprecate SunSSH-only server options (e.g. iMaxAuthTriesLog) in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
7 |
# is higher than initially though, because some of the options have been in |
9f1202f3ddbd
19465507 Deprecate SunSSH-only server options (e.g. iMaxAuthTriesLog) in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
8 |
# default sshd_config file for very long time. Also the consequence of |
9f1202f3ddbd
19465507 Deprecate SunSSH-only server options (e.g. iMaxAuthTriesLog) in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
9 |
# unknown server option is harsh - ssh service goes to maintenance mode |
9f1202f3ddbd
19465507 Deprecate SunSSH-only server options (e.g. iMaxAuthTriesLog) in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
10 |
# possible rendering the instance not accessible. For this reason we will |
9f1202f3ddbd
19465507 Deprecate SunSSH-only server options (e.g. iMaxAuthTriesLog) in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
11 |
# deprecate SunSSH specific sshd_config options too. |
9f1202f3ddbd
19465507 Deprecate SunSSH-only server options (e.g. iMaxAuthTriesLog) in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
12 |
# |
9f1202f3ddbd
19465507 Deprecate SunSSH-only server options (e.g. iMaxAuthTriesLog) in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
13 |
# This is a Solaris specific change to ease the transition and will not be |
9f1202f3ddbd
19465507 Deprecate SunSSH-only server options (e.g. iMaxAuthTriesLog) in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
14 |
# offered upstream. |
9f1202f3ddbd
19465507 Deprecate SunSSH-only server options (e.g. iMaxAuthTriesLog) in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
15 |
# |
5027
c71f34180df2
PSARC/2015/427 Old SunSSH Gss* Option Names in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4709
diff
changeset
|
16 |
diff -pur old/servconf.c new/servconf.c |
c71f34180df2
PSARC/2015/427 Old SunSSH Gss* Option Names in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4709
diff
changeset
|
17 |
--- old/servconf.c |
c71f34180df2
PSARC/2015/427 Old SunSSH Gss* Option Names in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4709
diff
changeset
|
18 |
+++ new/servconf.c |
c71f34180df2
PSARC/2015/427 Old SunSSH Gss* Option Names in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4709
diff
changeset
|
19 |
@@ -518,6 +518,7 @@ static struct { |
c71f34180df2
PSARC/2015/427 Old SunSSH Gss* Option Names in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4709
diff
changeset
|
20 |
{ "afstokenpassing", sUnsupported, SSHCFG_GLOBAL }, |
c71f34180df2
PSARC/2015/427 Old SunSSH Gss* Option Names in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4709
diff
changeset
|
21 |
#ifdef GSSAPI |
c71f34180df2
PSARC/2015/427 Old SunSSH Gss* Option Names in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4709
diff
changeset
|
22 |
{ "gssapiauthentication", sGssAuthentication, SSHCFG_ALL }, |
c71f34180df2
PSARC/2015/427 Old SunSSH Gss* Option Names in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4709
diff
changeset
|
23 |
+ { "gssauthentication", sGssAuthentication, SSHCFG_ALL }, /* alias */ |
c71f34180df2
PSARC/2015/427 Old SunSSH Gss* Option Names in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4709
diff
changeset
|
24 |
#ifdef USE_GSS_STORE_CRED |
c71f34180df2
PSARC/2015/427 Old SunSSH Gss* Option Names in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4709
diff
changeset
|
25 |
{ "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL }, |
c71f34180df2
PSARC/2015/427 Old SunSSH Gss* Option Names in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4709
diff
changeset
|
26 |
#else /* USE_GSS_STORE_CRED */ |
c71f34180df2
PSARC/2015/427 Old SunSSH Gss* Option Names in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4709
diff
changeset
|
27 |
@@ -526,6 +527,7 @@ static struct { |
c71f34180df2
PSARC/2015/427 Old SunSSH Gss* Option Names in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4709
diff
changeset
|
28 |
{ "gssapistrictacceptorcheck", sGssStrictAcceptor, SSHCFG_GLOBAL }, |
c71f34180df2
PSARC/2015/427 Old SunSSH Gss* Option Names in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4709
diff
changeset
|
29 |
#else |
c71f34180df2
PSARC/2015/427 Old SunSSH Gss* Option Names in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4709
diff
changeset
|
30 |
{ "gssapiauthentication", sUnsupported, SSHCFG_ALL }, |
c71f34180df2
PSARC/2015/427 Old SunSSH Gss* Option Names in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4709
diff
changeset
|
31 |
+ { "gssauthentication", sUnsupported, SSHCFG_ALL }, /* alias */ |
c71f34180df2
PSARC/2015/427 Old SunSSH Gss* Option Names in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4709
diff
changeset
|
32 |
{ "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL }, |
c71f34180df2
PSARC/2015/427 Old SunSSH Gss* Option Names in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4709
diff
changeset
|
33 |
{ "gssapistrictacceptorcheck", sUnsupported, SSHCFG_GLOBAL }, |
c71f34180df2
PSARC/2015/427 Old SunSSH Gss* Option Names in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4709
diff
changeset
|
34 |
#endif |
c71f34180df2
PSARC/2015/427 Old SunSSH Gss* Option Names in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4709
diff
changeset
|
35 |
@@ -592,6 +594,30 @@ static struct { |
4709
fd98db93ff7c
21509846 problem in UTILITY/OPENSSH
Huie-Ying Lee <huieying.lee@oracle.com>
parents:
4503
diff
changeset
|
36 |
{ "pamserviceprefix", sPAMServicePrefix, SSHCFG_GLOBAL }, |
fd98db93ff7c
21509846 problem in UTILITY/OPENSSH
Huie-Ying Lee <huieying.lee@oracle.com>
parents:
4503
diff
changeset
|
37 |
{ "pamservicename", sPAMServiceName, SSHCFG_GLOBAL }, |
2182
9f1202f3ddbd
19465507 Deprecate SunSSH-only server options (e.g. iMaxAuthTriesLog) in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
38 |
#endif |
9f1202f3ddbd
19465507 Deprecate SunSSH-only server options (e.g. iMaxAuthTriesLog) in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
39 |
+#ifdef DEPRECATE_SUNSSH_OPT |
9f1202f3ddbd
19465507 Deprecate SunSSH-only server options (e.g. iMaxAuthTriesLog) in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
40 |
+ /* |
9f1202f3ddbd
19465507 Deprecate SunSSH-only server options (e.g. iMaxAuthTriesLog) in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
41 |
+ * On Solaris, to make the transition from SunSSH to OpenSSH as smooth |
9f1202f3ddbd
19465507 Deprecate SunSSH-only server options (e.g. iMaxAuthTriesLog) in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
42 |
+ * as possible, we will deprecate SunSSH-only options in OpenSSH. |
9f1202f3ddbd
19465507 Deprecate SunSSH-only server options (e.g. iMaxAuthTriesLog) in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
43 |
+ * Therefore on a system having one of the following options in |
9f1202f3ddbd
19465507 Deprecate SunSSH-only server options (e.g. iMaxAuthTriesLog) in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
44 |
+ * /etc/ssh/sshd_config, change to OpenSSH will not result in service |
9f1202f3ddbd
19465507 Deprecate SunSSH-only server options (e.g. iMaxAuthTriesLog) in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
45 |
+ * network/ssh going to maintenance. Instead, a warning will be printed |
9f1202f3ddbd
19465507 Deprecate SunSSH-only server options (e.g. iMaxAuthTriesLog) in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
46 |
+ * to /var/svc/log/network-ssh:default.log. Note that |
9f1202f3ddbd
19465507 Deprecate SunSSH-only server options (e.g. iMaxAuthTriesLog) in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
47 |
+ * this is an interim enhancement to OpenSSH to make the transition |
9f1202f3ddbd
19465507 Deprecate SunSSH-only server options (e.g. iMaxAuthTriesLog) in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
48 |
+ * smoother. If a deprecated SunSSH-only option is migrated to OpenSSH |
9f1202f3ddbd
19465507 Deprecate SunSSH-only server options (e.g. iMaxAuthTriesLog) in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
49 |
+ * later, then it will be changed from deprecated to supported. |
9f1202f3ddbd
19465507 Deprecate SunSSH-only server options (e.g. iMaxAuthTriesLog) in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
50 |
+ */ |
9f1202f3ddbd
19465507 Deprecate SunSSH-only server options (e.g. iMaxAuthTriesLog) in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
51 |
+ { "maxauthtrieslog", sDeprecated, SSHCFG_GLOBAL }, |
9f1202f3ddbd
19465507 Deprecate SunSSH-only server options (e.g. iMaxAuthTriesLog) in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
52 |
+ { "lookupclienthostnames", sDeprecated, SSHCFG_GLOBAL }, |
9f1202f3ddbd
19465507 Deprecate SunSSH-only server options (e.g. iMaxAuthTriesLog) in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
53 |
+ { "useopensslengine", sDeprecated, SSHCFG_GLOBAL }, |
9f1202f3ddbd
19465507 Deprecate SunSSH-only server options (e.g. iMaxAuthTriesLog) in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
54 |
+ { "preuserauthhook", sDeprecated, SSHCFG_ALL}, |
9f1202f3ddbd
19465507 Deprecate SunSSH-only server options (e.g. iMaxAuthTriesLog) in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
55 |
+ { "kmfpolicydatabase", sDeprecated, SSHCFG_GLOBAL }, |
9f1202f3ddbd
19465507 Deprecate SunSSH-only server options (e.g. iMaxAuthTriesLog) in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
56 |
+ { "kmfpolicyname", sDeprecated, SSHCFG_GLOBAL }, |
9f1202f3ddbd
19465507 Deprecate SunSSH-only server options (e.g. iMaxAuthTriesLog) in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
57 |
+ { "trustedanchorkeystore", sDeprecated, SSHCFG_GLOBAL }, |
9f1202f3ddbd
19465507 Deprecate SunSSH-only server options (e.g. iMaxAuthTriesLog) in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
58 |
+ { "useunsupportedsshv1", sDeprecated, SSHCFG_GLOBAL }, |
9f1202f3ddbd
19465507 Deprecate SunSSH-only server options (e.g. iMaxAuthTriesLog) in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
59 |
+ { "usefips140", sDeprecated, SSHCFG_ALL}, |
4709
fd98db93ff7c
21509846 problem in UTILITY/OPENSSH
Huie-Ying Lee <huieying.lee@oracle.com>
parents:
4503
diff
changeset
|
60 |
+ { "gssapistoredelegatedcredentials", sDeprecated, SSHCFG_ALL }, |
5027
c71f34180df2
PSARC/2015/427 Old SunSSH Gss* Option Names in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
4709
diff
changeset
|
61 |
+ { "gssstoredelegcreds", sDeprecated, SSHCFG_ALL }, |
2182
9f1202f3ddbd
19465507 Deprecate SunSSH-only server options (e.g. iMaxAuthTriesLog) in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
62 |
+#endif |
4503
bf30d46ab06e
PSARC/2015/179 OpenSSH 6.8
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
2182
diff
changeset
|
63 |
{ "revokedkeys", sRevokedKeys, SSHCFG_ALL }, |
bf30d46ab06e
PSARC/2015/179 OpenSSH 6.8
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
2182
diff
changeset
|
64 |
{ "trustedusercakeys", sTrustedUserCAKeys, SSHCFG_ALL }, |
bf30d46ab06e
PSARC/2015/179 OpenSSH 6.8
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
2182
diff
changeset
|
65 |
{ "authorizedprincipalsfile", sAuthorizedPrincipalsFile, SSHCFG_ALL }, |