diff options
| author | djm@openbsd.org <djm@openbsd.org> | 2019-11-25 00:52:46 +0000 |
|---|---|---|
| committer | Damien Miller <djm@mindrot.org> | 2019-11-25 12:23:40 +1100 |
| commit | 0fddf2967ac51d518e300408a0d7e6adf4cd2634 (patch) | |
| tree | d7fe4a4f7cd92c565a765e21b7cb19b9c7544d29 /auth2-pubkey.c | |
| parent | b7e74ea072919b31391bc0f5ff653f80b9f5e84f (diff) | |
| download | openssh-git-0fddf2967ac51d518e300408a0d7e6adf4cd2634.tar.gz | |
upstream: Add a sshd_config PubkeyAuthOptions directive
This directive has a single valid option "no-touch-required" that
causes sshd to skip checking whether user presence was tested before
a security key signature was made (usually by the user touching the
key).
ok markus@
OpenBSD-Commit-ID: 46e434a49802d4ed82bc0aa38cb985c198c407de
Diffstat (limited to 'auth2-pubkey.c')
| -rw-r--r-- | auth2-pubkey.c | 22 |
1 files changed, 19 insertions, 3 deletions
diff --git a/auth2-pubkey.c b/auth2-pubkey.c index 2b698670..0ef982a4 100644 --- a/auth2-pubkey.c +++ b/auth2-pubkey.c @@ -1,4 +1,4 @@ -/* $OpenBSD: auth2-pubkey.c,v 1.95 2019/11/25 00:51:37 djm Exp $ */ +/* $OpenBSD: auth2-pubkey.c,v 1.96 2019/11/25 00:52:46 djm Exp $ */ /* * Copyright (c) 2000 Markus Friedl. All rights reserved. * @@ -68,6 +68,7 @@ #include "ssherr.h" #include "channels.h" /* XXX for session.h */ #include "session.h" /* XXX for child_set_env(); refactor? */ +#include "sk-api.h" /* import */ extern ServerOptions options; @@ -96,7 +97,7 @@ userauth_pubkey(struct ssh *ssh) u_char *pkblob = NULL, *sig = NULL, have_sig; size_t blen, slen; int r, pktype; - int authenticated = 0; + int req_presence = 0, authenticated = 0; struct sshauthopt *authopts = NULL; struct sshkey_sig_details *sig_details = NULL; @@ -217,10 +218,25 @@ userauth_pubkey(struct ssh *ssh) ssh->compat, &sig_details)) == 0) { authenticated = 1; } - if (sig_details != NULL) { + if (authenticated == 1 && sig_details != NULL) { + auth2_record_info(authctxt, "signature count = %u", + sig_details->sk_counter); debug("%s: sk_counter = %u, sk_flags = 0x%02x", __func__, sig_details->sk_counter, sig_details->sk_flags); + req_presence = (options.pubkey_auth_options & + PUBKEYAUTH_TOUCH_REQUIRED); + if (req_presence && (sig_details->sk_flags & + SSH_SK_USER_PRESENCE_REQD) == 0) { + error("public key %s signature for %s%s from " + "%.128s port %d rejected: user presence " + "(key touch) requirement not met ", key_s, + authctxt->valid ? "" : "invalid user ", + authctxt->user, ssh_remote_ipaddr(ssh), + ssh_remote_port(ssh)); + authenticated = 0; + goto done; + } } auth2_record_key(authctxt, authenticated, key); } else { |