summaryrefslogtreecommitdiffstats
path: root/auth2.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* - stevesk@cvs.openbsd.org 2007/04/14 22:01:58Darren Tucker2007-05-201-3/+1
| | | | | [auth2.c] remove unused macro; from Dmitry V. Levin <ldv@altlinux.org>
* - dtucker@cvs.openbsd.org 2007/03/01 10:28:02Darren Tucker2007-03-011-5/+1
| | | | | | | | [auth2.c sshd_config.5 servconf.c] Remove ChallengeResponseAuthentication support inside a Match block as its interaction with KbdInteractive makes it difficult to support. Also, relocate the CR/kbdint option special-case code into servconf. "please commit" djm@, ok markus@ for the relocation.
* - deraadt@cvs.openbsd.org 2006/08/03 03:34:42Damien Miller2006-08-051-3/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [OVERVIEW atomicio.c atomicio.h auth-bsdauth.c auth-chall.c auth-krb5.c] [auth-options.c auth-options.h auth-passwd.c auth-rh-rsa.c auth-rhosts.c] [auth-rsa.c auth-skey.c auth.c auth.h auth1.c auth2-chall.c auth2-gss.c] [auth2-hostbased.c auth2-kbdint.c auth2-none.c auth2-passwd.c ] [auth2-pubkey.c auth2.c authfd.c authfd.h authfile.c bufaux.c bufbn.c] [buffer.c buffer.h canohost.c channels.c channels.h cipher-3des1.c] [cipher-bf1.c cipher-ctr.c cipher.c cleanup.c clientloop.c compat.c] [compress.c deattack.c dh.c dispatch.c dns.c dns.h fatal.c groupaccess.c] [groupaccess.h gss-genr.c gss-serv-krb5.c gss-serv.c hostfile.c kex.c] [kex.h kexdh.c kexdhc.c kexdhs.c kexgex.c kexgexc.c kexgexs.c key.c] [key.h log.c log.h mac.c match.c md-sha256.c misc.c misc.h moduli.c] [monitor.c monitor_fdpass.c monitor_mm.c monitor_mm.h monitor_wrap.c] [monitor_wrap.h msg.c nchan.c packet.c progressmeter.c readconf.c] [readconf.h readpass.c rsa.c scard.c scard.h scp.c servconf.c servconf.h] [serverloop.c session.c session.h sftp-client.c sftp-common.c] [sftp-common.h sftp-glob.c sftp-server.c sftp.c ssh-add.c ssh-agent.c] [ssh-dss.c ssh-gss.h ssh-keygen.c ssh-keyscan.c ssh-keysign.c ssh-rsa.c] [ssh.c ssh.h sshconnect.c sshconnect.h sshconnect1.c sshconnect2.c] [sshd.c sshlogin.c sshlogin.h sshpty.c sshpty.h sshtty.c ttymodes.c] [uidswap.c uidswap.h uuencode.c uuencode.h xmalloc.c xmalloc.h] [loginrec.c loginrec.h openbsd-compat/port-aix.c openbsd-compat/port-tun.h] almost entirely get rid of the culture of ".h files that include .h files" ok djm, sort of ok stevesk makes the pain stop in one easy step NB. portable commit contains everything *except* removing includes.h, as that will take a fair bit more work as we move headers that are required for portability workarounds to defines.h. (also, this step wasn't "easy")
* - stevesk@cvs.openbsd.org 2006/07/22 20:48:23Damien Miller2006-07-241-1/+2
| | | | | | | | | | | | | | | | | [atomicio.c auth-options.c auth-passwd.c auth-rhosts.c auth-rsa.c] [auth.c auth1.c auth2-chall.c auth2-hostbased.c auth2-passwd.c auth2.c] [authfd.c authfile.c bufaux.c bufbn.c buffer.c canohost.c channels.c] [cipher-3des1.c cipher-bf1.c cipher-ctr.c cipher.c clientloop.c] [compat.c deattack.c dh.c dns.c gss-genr.c gss-serv.c hostfile.c] [includes.h kex.c kexdhc.c kexdhs.c kexgexc.c kexgexs.c key.c log.c] [mac.c match.c md-sha256.c misc.c moduli.c monitor.c monitor_fdpass.c] [monitor_mm.c monitor_wrap.c msg.c nchan.c packet.c rsa.c] [progressmeter.c readconf.c readpass.c scp.c servconf.c serverloop.c] [session.c sftp-client.c sftp-common.c sftp-glob.c sftp-server.c sftp.c] [ssh-add.c ssh-agent.c ssh-dss.c ssh-keygen.c ssh-keyscan.c] [ssh-keysign.c ssh-rsa.c ssh.c sshconnect.c sshconnect1.c sshconnect2.c] [sshd.c sshlogin.c sshpty.c ttymodes.c uidswap.c xmalloc.c] move #include <string.h> out of includes.h
* - stevesk@cvs.openbsd.org 2006/07/06 16:03:53Damien Miller2006-07-101-1/+5
| | | | | | | | | | | [auth-options.c auth-options.h auth-passwd.c auth-rh-rsa.c] [auth-rhosts.c auth-rsa.c auth.c auth.h auth2-hostbased.c] [auth2-pubkey.c auth2.c includes.h misc.c misc.h monitor.c] [monitor_wrap.c monitor_wrap.h scp.c serverloop.c session.c] [session.h sftp-common.c ssh-add.c ssh-keygen.c ssh-keysign.c] [ssh.c sshconnect.c sshconnect.h sshd.c sshpty.c sshpty.h uidswap.c] [uidswap.h] move #include <pwd.h> out of includes.h; ok markus@
* - djm@cvs.openbsd.org 2006/03/25 13:17:03Damien Miller2006-03-261-0/+1
| | | | | | | | | | | | | | | | | | | | | [atomicio.c auth-bsdauth.c auth-chall.c auth-options.c auth-passwd.c] [auth-rh-rsa.c auth-rhosts.c auth-rsa.c auth-skey.c auth.c auth1.c] [auth2-chall.c auth2-hostbased.c auth2-kbdint.c auth2-none.c] [auth2-passwd.c auth2-pubkey.c auth2.c authfd.c authfile.c bufaux.c] [buffer.c canohost.c channels.c cipher-3des1.c cipher-bf1.c] [cipher-ctr.c cipher.c cleanup.c clientloop.c compat.c compress.c] [deattack.c dh.c dispatch.c fatal.c groupaccess.c hostfile.c kex.c] [kexdh.c kexdhc.c kexdhs.c kexgex.c kexgexc.c kexgexs.c key.c log.c] [mac.c match.c md-sha256.c misc.c monitor.c monitor_fdpass.c] [monitor_mm.c monitor_wrap.c msg.c nchan.c packet.c progressmeter.c] [readconf.c readpass.c rsa.c scard.c scp.c servconf.c serverloop.c] [session.c sftp-client.c sftp-common.c sftp-glob.c sftp-server.c] [sftp.c ssh-add.c ssh-agent.c ssh-dss.c ssh-keygen.c ssh-keyscan.c] [ssh-keysign.c ssh-rsa.c ssh.c sshconnect.c sshconnect1.c] [sshconnect2.c sshd.c sshlogin.c sshpty.c sshtty.c ttymodes.c] [uidswap.c uuencode.c xmalloc.c] Put $OpenBSD$ tags back (as comments) to replace the RCSID()s that Theo nuked - our scripts to sync -portable need them in the files
* - deraadt@cvs.openbsd.org 2006/03/20 18:17:20Damien Miller2006-03-261-0/+2
| | | | | | [auth1.c auth2.c sshd.c] sprinkle some ARGSUSED for table driven functions (which sometimes must ignore their args)
* - deraadt@cvs.openbsd.org 2006/03/19 18:51:18Damien Miller2006-03-251-1/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | [atomicio.c auth-bsdauth.c auth-chall.c auth-krb5.c auth-options.c] [auth-pam.c auth-passwd.c auth-rh-rsa.c auth-rhosts.c auth-rsa.c] [auth-shadow.c auth-skey.c auth.c auth1.c auth2-chall.c] [auth2-hostbased.c auth2-kbdint.c auth2-none.c auth2-passwd.c] [auth2-pubkey.c auth2.c authfd.c authfile.c bufaux.c buffer.c] [canohost.c channels.c cipher-3des1.c cipher-acss.c cipher-aes.c] [cipher-bf1.c cipher-ctr.c cipher.c cleanup.c clientloop.c compat.c] [compress.c deattack.c dh.c dispatch.c dns.c entropy.c fatal.c] [groupaccess.c hostfile.c includes.h kex.c kexdh.c kexdhc.c] [kexdhs.c kexgex.c kexgexc.c kexgexs.c key.c log.c loginrec.c] [loginrec.h logintest.c mac.c match.c md-sha256.c md5crypt.c misc.c] [monitor.c monitor_fdpass.c monitor_mm.c monitor_wrap.c msg.c] [nchan.c packet.c progressmeter.c readconf.c readpass.c rsa.c] [scard.c scp.c servconf.c serverloop.c session.c sftp-client.c] [sftp-common.c sftp-glob.c sftp-server.c sftp.c ssh-add.c] [ssh-agent.c ssh-dss.c ssh-keygen.c ssh-keyscan.c ssh-keysign.c] [ssh-rand-helper.c ssh-rsa.c ssh.c sshconnect.c sshconnect1.c] [sshconnect2.c sshd.c sshlogin.c sshpty.c sshtty.c ttymodes.c] [uidswap.c uuencode.c xmalloc.c openbsd-compat/bsd-arc4random.c] [openbsd-compat/bsd-closefrom.c openbsd-compat/bsd-cygwin_util.c] [openbsd-compat/bsd-getpeereid.c openbsd-compat/bsd-misc.c] [openbsd-compat/bsd-nextstep.c openbsd-compat/bsd-snprintf.c] [openbsd-compat/bsd-waitpid.c openbsd-compat/fake-rfc2553.c] RCSID() can die
* - (dtucker) [auth2.c] Move start_pam() calls out of if-else block to removeDarren Tucker2005-09-241-8/+4
| | | | duplicate call. ok djm@
* -(djm) [audit.c auth1.c auth2.c entropy.c loginrec.c serverloop.c]Damien Miller2005-07-171-1/+1
| | | | [ssh-rand-helper.c] fix portable 2nd level indents at 4 spaces too
* - (dtucker) [audit.c audit.h auth.c auth1.c auth2.c loginrec.c monitor.cDarren Tucker2005-02-081-6/+6
| | | | | | monitor_wrap.c monitor_wrap.h session.c sshd.c]: Prepend all of the audit defines and enums with SSH_ to prevent namespace collisions on some platforms (eg AIX).
* - (dtucker) [Makefile.in auth.c auth.h auth1.c auth2.c loginrec.c monitor.cDarren Tucker2005-02-021-2/+13
| | | | | | monitor.h monitor_wrap.c monitor_wrap.h session.c sshd.c] Bug #125: (first stage) Add audit instrumentation to sshd, currently disabled by default. with suggestions from and djm@
* - (dtucker) [auth1.c auth2.c] If the user successfully authenticates but isDarren Tucker2004-12-031-2/+3
| | | | | | subsequently denied by the PAM auth stack, send the PAM message to the user via packet_disconnect (Protocol 1) or userauth_banner (Protocol 2). ok djm@
* - (dtucker) [auth-pam.c auth.h auth2-none.c auth2.c monitor.c monitor_wrap.c]Darren Tucker2004-09-111-2/+13
| | | | | | Bug #892: Send messages from failing PAM account modules to the client via SSH2_MSG_USERAUTH_BANNER messages. Note that this will not happen with SSH2 kbdint authentication, which need to be dealt with separately. ok djm@
* - markus@cvs.openbsd.org 2004/07/28 09:40:29Darren Tucker2004-08-121-2/+2
| | | | | | [auth.c auth1.c auth2.c cipher.c cipher.h key.c session.c ssh.c sshconnect1.c] more s/illegal/invalid/
* - djm@cvs.openbsd.org 2004/07/21 10:33:31Damien Miller2004-07-211-2/+2
| | | | | [auth1.c auth2.c] bz#899: Don't display invalid usernames in setproctitle
* - dtucker@cvs.openbsd.org 2004/05/23 23:59:53Darren Tucker2004-05-241-2/+2
| | | | | [auth.c auth.h auth1.c auth2.c servconf.c servconf.h sshd_config sshd_config.5] Add MaxAuthTries sshd config option; ok markus@
* - (dtucker) [auth-pam.c auth-pam.h auth1.c auth2.c monitor.c monitor_wrap.cDarren Tucker2004-03-081-3/+3
| | | | | | | monitor_wrap.h] Bug #808: Ensure force_pwchange is correctly initialized even if keyboard-interactive is not used by the client. Prevents segfaults in some cases where the user's password is expired (note this is not considered a security exposure). ok djm@
* - djm@cvs.openbsd.org 2003/11/04 08:54:09Damien Miller2003-11-171-2/+1
| | | | | | | | [auth1.c auth2.c auth2-pubkey.c auth.h auth-krb5.c auth-passwd.c] [auth-rhosts.c auth-rh-rsa.c auth-rsa.c monitor.c serverloop.c] [session.c] standardise arguments to auth methods - they should all take authctxt. check authctxt->valid rather then pw != NULL; ok markus@
* - markus@cvs.openbsd.org 2003/09/23 20:17:11Darren Tucker2003-10-021-19/+3
| | | | | | | | | | | [Makefile.in auth1.c auth2.c auth.c auth.h auth-krb5.c canohost.c cleanup.c clientloop.c fatal.c gss-serv.c log.c log.h monitor.c monitor.h monitor_wrap.c monitor_wrap.h packet.c serverloop.c session.c session.h ssh-agent.c sshd.c] replace fatal_cleanup() and linked list of fatal callbacks with static cleanup_exit() function. re-refine cleanup_exit() where appropriate, allocate sshd's authctxt eary to allow simpler cleanup in sshd. tested by many, ok deraadt@
* - markus@cvs.openbsd.org 2003/08/26 09:58:43Damien Miller2003-09-021-1/+2
| | | | | | | [auth-passwd.c auth.c auth.h auth1.c auth2-none.c auth2-passwd.c] [auth2.c monitor.c] fix passwd auth for 'username leaks via timing'; with djm@, original patches from solar
* - markus@cvs.openbsd.org 2003/08/22 13:22:27Darren Tucker2003-08-261-7/+1
| | | | | [auth2.c] (auth2-krb5.c removed) nuke "kerberos-2@ssh.com"
* - markus@cvs.openbsd.org 2003/08/22 10:56:09Darren Tucker2003-08-261-1/+17
| | | | | | | | | [auth2.c auth2-gss.c auth.h compat.c compat.h gss-genr.c gss-serv-krb5.c gss-serv.c monitor.c monitor.h monitor_wrap.c monitor_wrap.h readconf.c readconf.h servconf.c servconf.h session.c session.h ssh-gss.h ssh_config.5 sshconnect2.c sshd_config sshd_config.5] support GSS API user authentication; patches from Simon Wilkinson, stripped down and tested by Jakob and myself.
* - (djm) Bug #564: Perform PAM account checks for all authentications whenDamien Miller2003-08-251-0/+5
| | | | UsePAM=yes; ok dtucker
* - markus@cvs.openbsd.org 2003/06/24 08:23:46Darren Tucker2003-06-281-2/+2
| | | | | | [auth2-hostbased.c auth2-pubkey.c auth2.c channels.c key.c key.h monitor.c packet.c packet.h serverloop.c sshconnect2.c sshd.c] int -> u_int; ok djm@, deraadt@, mouring@
* - (djm) Add new UsePAM configuration directive to allow runtime controlDamien Miller2003-05-141-12/+4
| | | | | over usage of PAM. This allows non-root use of sshd when built with --with-pam
* - markus@cvs.openbsd.org 2003/05/14 02:15:47Damien Miller2003-05-141-1/+7
| | | | | | [auth2.c monitor.c sshconnect2.c auth2-krb5.c] implement kerberos over ssh2 ("kerberos-2@ssh.com"); tested with jakob@ server interops with commercial client; ok jakob@ djm@
* - (djm) RCSID sync w/ OpenBSDDamien Miller2003-05-141-1/+1
|
* - (djm) Bug #117: Don't lie to PAM about usernameDamien Miller2003-05-141-1/+1
|
* - (dtucker) Move handling of bad password authentications into a platformDarren Tucker2003-05-021-4/+0
| | | | specific record_failed_login() function (affects AIX & Unicos).
* - (bal) auth2.c same changed as above.Ben Lindstrom2003-04-271-2/+1
|
* *** empty log message ***Damien Miller2003-04-091-1/+1
|
* - markus@cvs.openbsd.org 2003/02/06 21:22:43Damien Miller2003-02-241-3/+2
| | | | | [auth1.c auth2.c] undo broken fix for #387, fixes #486
* Cray fixes (bug 367) based on patch from Wendy Palm @ cray.Tim Rice2002-09-261-0/+11
| | | | This does not include the deattack.c fixes.
* - markus@cvs.openbsd.org 2002/08/22 21:33:58Damien Miller2002-09-041-2/+3
| | | | | | [auth1.c auth2.c] auth_root_allowed() is handled by the monitor in the privsep case, so skip this for use_privsep, ok stevesk@, fixes bugzilla #387/325
* - (bal) Failed password attempts don't increment counter on AIX. Bug #145Ben Lindstrom2002-07-041-6/+0
|
* - deraadt@cvs.openbsd.org 2002/06/30 21:54:16Ben Lindstrom2002-07-041-4/+4
| | | | | [auth2.c session.c sshd.c] lint asks that we use names that do not overlap
* some xxx's for future privsep cleanupDamien Miller2002-06-211-0/+1
|
* - (bal) Refixed auth2.c. It was never fully commited while spliting outBen Lindstrom2002-06-071-321/+0
| | | | authentication to different files.
* - markus@cvs.openbsd.org 2002/05/31 11:35:15Ben Lindstrom2002-06-061-40/+32
| | | | | | | [auth.h auth2.c] move Authmethod definitons to per-method file. NOTE: The rest of this patch is with the import of the auth2-*.c files.
* - markus@cvs.openbsd.org 2002/05/25 18:51:07Ben Lindstrom2002-06-061-185/+1
| | | | | | | | | [auth.h auth2.c auth2-hostbased.c auth2-kbdint.c auth2-none.c auth2-passwd.c auth2-pubkey.c Makefile.in] split auth2.c into one file per method; ok provos@/deraadt@ NOTE: Merged back noticable cygwin and pam stuff. May need review to ensure I did not miss anything.
* - itojun@cvs.openbsd.org 2002/05/13 02:37:39Ben Lindstrom2002-05-151-1/+2
| | | | | [auth-skey.c auth2.c] less warnings. skey_{respond,query} are public (in auth.h)
* - (djm) Bug #231: UsePrivilegeSeparation turns off Banner.Damien Miller2002-05-131-12/+31
|
* - (djm) Disable PAM kbd-int auth if privsep is turned on (it doesn't work)Damien Miller2002-05-091-0/+2
|
* - (djm) Make privsep work with PAM (still experimental)Damien Miller2002-04-231-4/+4
|
* - (stevesk) [auth-pam.c auth-pam.h auth-passwd.c auth-sia.c auth-sia.hKevin Steves2002-04-041-12/+0
| | | | auth1.c auth2.c] PAM, OSF_SIA password auth cleanup; from djm.
* - (stevesk) [auth2.c] merge cleanup/syncKevin Steves2002-03-221-5/+3
|
* - markus@cvs.openbsd.org 2002/03/19 14:27:39Ben Lindstrom2002-03-221-8/+2
| | | | | [auth.c auth1.c auth2.c] make getpwnamallow() allways call pwcopy()
* - provos@cvs.openbsd.org 2002/03/18 17:50:31Ben Lindstrom2002-03-221-15/+28
| | | | | | | | | | | [auth-bsdauth.c auth-options.c auth-rh-rsa.c auth-rsa.c auth-skey.c auth.h auth1.c auth2-chall.c auth2.c kex.c kex.h kexdh.c kexgex.c servconf.c session.h servconf.h serverloop.c session.c sshd.c] integrate privilege separated openssh; its turned off by default for now. work done by me and markus@ applied, but outside of ensure that smaller code bits migrated with their owners.. no work was tried to 'fix' it to work. =) Later project!
* - provos@cvs.openbsd.org 2002/03/18 01:12:14Ben Lindstrom2002-03-221-3/+4
| | | | | | [auth.h auth1.c auth2.c sshd.c] have the authentication functions return the authentication context and then do_authenticated; okay millert@
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-19 03:34:58 +0100