author | Tomas Kuthan <tomas.kuthan@oracle.com> |
Fri, 21 Mar 2014 09:36:50 -0700 | |
changeset 1783 | d716b9b5961b |
child 1786 | d2b02f72138c |
permissions | -rw-r--r-- |
1783
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
1 |
# |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
2 |
# This patch modifies code for storing delegated GSS-API credentials to work |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
3 |
# with Solaris Kerberos. |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
4 |
# |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
5 |
# Default credential cache is used instead of per-session credentials cache |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
6 |
# because on Solaris gssd cannot use credentials from non-default cred store. |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
7 |
# A downside of this solution is, that the default credential cache file |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
8 |
# cannot be deleted upon logout and hence GSSAPICleanupCredentials is |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
9 |
# unsupported for now. |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
10 |
# |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
11 |
# To store the credentials a standardized GSS-API function gss_store_cred() is |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
12 |
# used instead of gss_krb5_copy_ccache(), because (unlike MIT Kerberos |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
13 |
# libgssapi_krb5) Solaris Kerberos libgss does not have Kerberos mechanism |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
14 |
# directly built in the library and this function is not directly accessible. |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
15 |
# |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
16 |
# The patch is implemented as Solaris-specific using USE_GSS_STORE_CRED |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
17 |
# and GSSAPI_STORECREDS_NEEDS_RUID macros. |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
18 |
# |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
19 |
diff -ur old/config.h.in new/config.h.in |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
20 |
--- old/config.h.in 2012-04-19 22:03:32.000000000 -0700 |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
21 |
+++ new/config.h.in 2014-03-12 06:47:38.667166593 -0700 |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
22 |
@@ -1465,6 +1465,12 @@ |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
23 |
/* Use btmp to log bad logins */ |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
24 |
#undef USE_BTMP |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
25 |
|
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
26 |
+/* Store delegated credentials in default cred. store using gss_store_cred */ |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
27 |
+#undef USE_GSS_STORE_CRED |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
28 |
+ |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
29 |
+/* Set real uid prior to storing delegated credentials */ |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
30 |
+#undef GSSAPI_STORECREDS_NEEDS_RUID |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
31 |
+ |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
32 |
/* Use libedit for sftp */ |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
33 |
#undef USE_LIBEDIT |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
34 |
|
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
35 |
diff -ur old/configure new/configure |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
36 |
--- old/configure 2014-03-12 04:01:33.320409426 -0700 |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
37 |
+++ new/configure 2014-03-12 06:47:48.510155481 -0700 |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
38 |
@@ -7201,6 +7201,9 @@ |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
39 |
|
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
40 |
fi |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
41 |
|
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
42 |
+ $as_echo "#define USE_GSS_STORE_CRED 1" >>confdefs.h |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
43 |
+ $as_echo "#define GSSAPI_STORECREDS_NEEDS_RUID 1" >>confdefs.h |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
44 |
+ |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
45 |
;; |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
46 |
*-*-sunos4*) |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
47 |
CPPFLAGS="$CPPFLAGS -DSUNOS4" |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
48 |
diff -ur old/configure.ac new/configure.ac |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
49 |
--- old/configure.ac 2014-03-12 04:01:33.310743659 -0700 |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
50 |
+++ new/configure.ac 2014-03-12 06:47:59.218730468 -0700 |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
51 |
@@ -802,6 +802,8 @@ |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
52 |
SP_MSG="yes" ], ) |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
53 |
], |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
54 |
) |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
55 |
+ AC_DEFINE([USE_GSS_STORE_CRED]) |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
56 |
+ AC_DEFINE([GSSAPI_STORECREDS_NEEDS_RUID]) |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
57 |
;; |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
58 |
*-*-sunos4*) |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
59 |
CPPFLAGS="$CPPFLAGS -DSUNOS4" |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
60 |
diff -ur old/gss-serv-krb5.c new/gss-serv-krb5.c |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
61 |
--- old/gss-serv-krb5.c 2006-08-31 22:38:36.000000000 -0700 |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
62 |
+++ new/gss-serv-krb5.c 2014-03-17 06:25:36.218227736 -0700 |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
63 |
@@ -109,6 +109,7 @@ |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
64 |
} |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
65 |
|
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
66 |
|
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
67 |
+#ifndef USE_GSS_STORE_CRED |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
68 |
/* This writes out any forwarded credentials from the structure populated |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
69 |
* during userauth. Called after we have setuid to the user */ |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
70 |
|
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
71 |
@@ -183,6 +184,7 @@ |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
72 |
|
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
73 |
return; |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
74 |
} |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
75 |
+#endif /* #ifndef USE_GSS_STORE_CRED */ |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
76 |
|
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
77 |
ssh_gssapi_mech gssapi_kerberos_mech = { |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
78 |
"toWM5Slw5Ew8Mqkay+al2g==", |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
79 |
@@ -191,7 +193,11 @@ |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
80 |
NULL, |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
81 |
&ssh_gssapi_krb5_userok, |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
82 |
NULL, |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
83 |
+#ifdef USE_GSS_STORE_CRED |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
84 |
+ NULL |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
85 |
+#else |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
86 |
&ssh_gssapi_krb5_storecreds |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
87 |
+#endif |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
88 |
}; |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
89 |
|
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
90 |
#endif /* KRB5 */ |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
91 |
diff -ur old/gss-serv.c new/gss-serv.c |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
92 |
--- old/gss-serv.c 2011-08-05 13:16:46.000000000 -0700 |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
93 |
+++ new/gss-serv.c 2014-03-12 05:55:42.368676287 -0700 |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
94 |
@@ -292,22 +292,66 @@ |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
95 |
void |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
96 |
ssh_gssapi_cleanup_creds(void) |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
97 |
{ |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
98 |
+#ifdef USE_GSS_STORE_CRED |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
99 |
+ debug("removing gssapi cred file not implemented"); |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
100 |
+#else |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
101 |
if (gssapi_client.store.filename != NULL) { |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
102 |
/* Unlink probably isn't sufficient */ |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
103 |
debug("removing gssapi cred file\"%s\"", |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
104 |
gssapi_client.store.filename); |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
105 |
unlink(gssapi_client.store.filename); |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
106 |
} |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
107 |
+#endif /* USE_GSS_STORE_CRED */ |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
108 |
} |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
109 |
|
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
110 |
/* As user */ |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
111 |
void |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
112 |
ssh_gssapi_storecreds(void) |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
113 |
{ |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
114 |
+#ifdef USE_GSS_STORE_CRED |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
115 |
+ OM_uint32 maj_status, min_status; |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
116 |
+ |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
117 |
+ if (gssapi_client.creds == NULL) { |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
118 |
+ debug("No credentials stored"); |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
119 |
+ return; |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
120 |
+ } |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
121 |
+ |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
122 |
+ maj_status = gss_store_cred(&min_status, gssapi_client.creds, |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
123 |
+ GSS_C_INITIATE, &gssapi_client.mech->oid, 1, 1, NULL, NULL); |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
124 |
+ |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
125 |
+ if (GSS_ERROR(maj_status)) { |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
126 |
+ Buffer b; |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
127 |
+ gss_buffer_desc msg; |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
128 |
+ OM_uint32 lmin; |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
129 |
+ OM_uint32 more = 0; |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
130 |
+ buffer_init(&b); |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
131 |
+ /* GSS-API error */ |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
132 |
+ do { |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
133 |
+ gss_display_status(&lmin, maj_status, GSS_C_GSS_CODE, |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
134 |
+ GSS_C_NULL_OID, &more, &msg); |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
135 |
+ buffer_append(&b, msg.value, msg.length); |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
136 |
+ buffer_put_char(&b, '\n'); |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
137 |
+ gss_release_buffer(&lmin, &msg); |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
138 |
+ } while (more != 0); |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
139 |
+ /* Mechanism specific error */ |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
140 |
+ do { |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
141 |
+ gss_display_status(&lmin, min_status, GSS_C_MECH_CODE, |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
142 |
+ &gssapi_client.mech->oid, &more, &msg); |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
143 |
+ buffer_append(&b, msg.value, msg.length); |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
144 |
+ buffer_put_char(&b, '\n'); |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
145 |
+ gss_release_buffer(&lmin, &msg); |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
146 |
+ } while (more != 0); |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
147 |
+ buffer_put_char(&b, '\0'); |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
148 |
+ error("GSS-API error while storing delegated credentials: %s", |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
149 |
+ buffer_ptr(&b)); |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
150 |
+ buffer_free(&b); |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
151 |
+ } |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
152 |
+#else /* #ifdef USE_GSS_STORE_CRED */ |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
153 |
if (gssapi_client.mech && gssapi_client.mech->storecreds) { |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
154 |
(*gssapi_client.mech->storecreds)(&gssapi_client); |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
155 |
} else |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
156 |
debug("ssh_gssapi_storecreds: Not a GSSAPI mechanism"); |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
157 |
+#endif /* #ifdef USE_GSS_STORE_CRED */ |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
158 |
} |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
159 |
|
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
160 |
/* This allows GSSAPI methods to do things to the childs environment based |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
161 |
diff -ur old/servconf.c new/servconf.c |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
162 |
--- old/servconf.c 2014-03-12 04:01:33.343205265 -0700 |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
163 |
+++ new/servconf.c 2014-03-12 04:01:33.400368192 -0700 |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
164 |
@@ -386,7 +386,11 @@ |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
165 |
{ "afstokenpassing", sUnsupported, SSHCFG_GLOBAL }, |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
166 |
#ifdef GSSAPI |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
167 |
{ "gssapiauthentication", sGssAuthentication, SSHCFG_ALL }, |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
168 |
+#ifdef USE_GSS_STORE_CRED |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
169 |
+ { "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL }, |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
170 |
+#else /* USE_GSS_STORE_CRED*/ |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
171 |
{ "gssapicleanupcredentials", sGssCleanupCreds, SSHCFG_GLOBAL }, |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
172 |
+#endif /* USE_GSS_STORE_CRED*/ |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
173 |
#else |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
174 |
{ "gssapiauthentication", sUnsupported, SSHCFG_ALL }, |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
175 |
{ "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL }, |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
176 |
diff -ur old/sshd.c new/sshd.c |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
177 |
--- old/sshd.c 2014-03-12 04:01:33.321603394 -0700 |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
178 |
+++ new/sshd.c 2014-03-12 06:48:16.296909610 -0700 |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
179 |
@@ -2041,9 +2041,23 @@ |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
180 |
|
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
181 |
#ifdef GSSAPI |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
182 |
if (options.gss_authentication) { |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
183 |
+#ifdef GSSAPI_STORECREDS_NEEDS_RUID |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
184 |
+ if (setreuid(authctxt->pw->pw_uid, -1) != 0) { |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
185 |
+ debug("setreuid %u: %.100s", |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
186 |
+ (u_int) authctxt->pw->pw_uid, strerror(errno)); |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
187 |
+ goto bail_storecred; |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
188 |
+ } |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
189 |
+#endif |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
190 |
temporarily_use_uid(authctxt->pw); |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
191 |
ssh_gssapi_storecreds(); |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
192 |
restore_uid(); |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
193 |
+#ifdef GSSAPI_STORECREDS_NEEDS_RUID |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
194 |
+ if (setuid(geteuid()) != 0) { |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
195 |
+ fatal("setuid %u: %.100s", (u_int) geteuid(), |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
196 |
+ strerror(errno)); |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
197 |
+ } |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
198 |
+ bail_storecred: |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
199 |
+#endif |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
200 |
} |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
201 |
#endif |
d716b9b5961b
18267729 Delegating credentials in OpenSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
202 |
#ifdef USE_PAM |