1*0Sstevel@tonic-gate /* 2*0Sstevel@tonic-gate * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 3*0Sstevel@tonic-gate * All rights reserved 4*0Sstevel@tonic-gate * 5*0Sstevel@tonic-gate * As far as I am concerned, the code I have written for this software 6*0Sstevel@tonic-gate * can be used freely for any purpose. Any derived versions of this 7*0Sstevel@tonic-gate * software must be clearly marked as such, and if the derived work is 8*0Sstevel@tonic-gate * incompatible with the protocol description in the RFC file, it must be 9*0Sstevel@tonic-gate * called by a name other than "ssh" or "Secure Shell". 10*0Sstevel@tonic-gate */ 11*0Sstevel@tonic-gate /* 12*0Sstevel@tonic-gate * Copyright 2004 Sun Microsystems, Inc. All rights reserved. 13*0Sstevel@tonic-gate * Use is subject to license terms. 14*0Sstevel@tonic-gate */ 15*0Sstevel@tonic-gate 16*0Sstevel@tonic-gate #include "includes.h" 17*0Sstevel@tonic-gate RCSID("$OpenBSD: servconf.c,v 1.115 2002/09/04 18:52:42 stevesk Exp $"); 18*0Sstevel@tonic-gate 19*0Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 20*0Sstevel@tonic-gate 21*0Sstevel@tonic-gate #ifdef HAVE_DEFOPEN 22*0Sstevel@tonic-gate #include <deflt.h> 23*0Sstevel@tonic-gate #endif /* HAVE_DEFOPEN */ 24*0Sstevel@tonic-gate 25*0Sstevel@tonic-gate #if defined(KRB4) 26*0Sstevel@tonic-gate #include <krb.h> 27*0Sstevel@tonic-gate #endif 28*0Sstevel@tonic-gate #if defined(KRB5) 29*0Sstevel@tonic-gate #ifdef HEIMDAL 30*0Sstevel@tonic-gate #include <krb.h> 31*0Sstevel@tonic-gate #else 32*0Sstevel@tonic-gate /* Bodge - but then, so is using the kerberos IV KEYFILE to get a Kerberos V 33*0Sstevel@tonic-gate * keytab */ 34*0Sstevel@tonic-gate #define KEYFILE "/etc/krb5.keytab" 35*0Sstevel@tonic-gate #endif 36*0Sstevel@tonic-gate #endif 37*0Sstevel@tonic-gate #ifdef AFS 38*0Sstevel@tonic-gate #include <kafs.h> 39*0Sstevel@tonic-gate #endif 40*0Sstevel@tonic-gate 41*0Sstevel@tonic-gate #include "ssh.h" 42*0Sstevel@tonic-gate #include "log.h" 43*0Sstevel@tonic-gate #include "servconf.h" 44*0Sstevel@tonic-gate #include "xmalloc.h" 45*0Sstevel@tonic-gate #include "compat.h" 46*0Sstevel@tonic-gate #include "pathnames.h" 47*0Sstevel@tonic-gate #include "tildexpand.h" 48*0Sstevel@tonic-gate #include "misc.h" 49*0Sstevel@tonic-gate #include "cipher.h" 50*0Sstevel@tonic-gate #include "kex.h" 51*0Sstevel@tonic-gate #include "mac.h" 52*0Sstevel@tonic-gate #include "auth.h" 53*0Sstevel@tonic-gate 54*0Sstevel@tonic-gate static void add_listen_addr(ServerOptions *, char *, u_short); 55*0Sstevel@tonic-gate static void add_one_listen_addr(ServerOptions *, char *, u_short); 56*0Sstevel@tonic-gate 57*0Sstevel@tonic-gate /* AF_UNSPEC or AF_INET or AF_INET6 */ 58*0Sstevel@tonic-gate extern int IPv4or6; 59*0Sstevel@tonic-gate /* Use of privilege separation or not */ 60*0Sstevel@tonic-gate extern int use_privsep; 61*0Sstevel@tonic-gate 62*0Sstevel@tonic-gate /* Initializes the server options to their default values. */ 63*0Sstevel@tonic-gate 64*0Sstevel@tonic-gate void 65*0Sstevel@tonic-gate initialize_server_options(ServerOptions *options) 66*0Sstevel@tonic-gate { 67*0Sstevel@tonic-gate (void) memset(options, 0, sizeof(*options)); 68*0Sstevel@tonic-gate 69*0Sstevel@tonic-gate /* Portable-specific options */ 70*0Sstevel@tonic-gate options->pam_authentication_via_kbd_int = -1; 71*0Sstevel@tonic-gate 72*0Sstevel@tonic-gate /* Standard Options */ 73*0Sstevel@tonic-gate options->num_ports = 0; 74*0Sstevel@tonic-gate options->ports_from_cmdline = 0; 75*0Sstevel@tonic-gate options->listen_addrs = NULL; 76*0Sstevel@tonic-gate options->num_host_key_files = 0; 77*0Sstevel@tonic-gate options->pid_file = NULL; 78*0Sstevel@tonic-gate options->server_key_bits = -1; 79*0Sstevel@tonic-gate options->login_grace_time = -1; 80*0Sstevel@tonic-gate options->key_regeneration_time = -1; 81*0Sstevel@tonic-gate options->permit_root_login = PERMIT_NOT_SET; 82*0Sstevel@tonic-gate options->ignore_rhosts = -1; 83*0Sstevel@tonic-gate options->ignore_user_known_hosts = -1; 84*0Sstevel@tonic-gate options->print_motd = -1; 85*0Sstevel@tonic-gate options->print_lastlog = -1; 86*0Sstevel@tonic-gate options->x11_forwarding = -1; 87*0Sstevel@tonic-gate options->x11_display_offset = -1; 88*0Sstevel@tonic-gate options->x11_use_localhost = -1; 89*0Sstevel@tonic-gate options->xauth_location = NULL; 90*0Sstevel@tonic-gate options->strict_modes = -1; 91*0Sstevel@tonic-gate options->keepalives = -1; 92*0Sstevel@tonic-gate options->log_facility = SYSLOG_FACILITY_NOT_SET; 93*0Sstevel@tonic-gate options->log_level = SYSLOG_LEVEL_NOT_SET; 94*0Sstevel@tonic-gate options->rhosts_authentication = -1; 95*0Sstevel@tonic-gate options->rhosts_rsa_authentication = -1; 96*0Sstevel@tonic-gate options->hostbased_authentication = -1; 97*0Sstevel@tonic-gate options->hostbased_uses_name_from_packet_only = -1; 98*0Sstevel@tonic-gate options->rsa_authentication = -1; 99*0Sstevel@tonic-gate options->pubkey_authentication = -1; 100*0Sstevel@tonic-gate #ifdef GSSAPI 101*0Sstevel@tonic-gate options->gss_authentication = -1; 102*0Sstevel@tonic-gate options->gss_keyex = -1; 103*0Sstevel@tonic-gate options->gss_store_creds = -1; 104*0Sstevel@tonic-gate options->gss_use_session_ccache = -1; 105*0Sstevel@tonic-gate options->gss_cleanup_creds = -1; 106*0Sstevel@tonic-gate #endif 107*0Sstevel@tonic-gate #if defined(KRB4) || defined(KRB5) 108*0Sstevel@tonic-gate options->kerberos_authentication = -1; 109*0Sstevel@tonic-gate options->kerberos_or_local_passwd = -1; 110*0Sstevel@tonic-gate options->kerberos_ticket_cleanup = -1; 111*0Sstevel@tonic-gate #endif 112*0Sstevel@tonic-gate #if defined(AFS) || defined(KRB5) 113*0Sstevel@tonic-gate options->kerberos_tgt_passing = -1; 114*0Sstevel@tonic-gate #endif 115*0Sstevel@tonic-gate #ifdef AFS 116*0Sstevel@tonic-gate options->afs_token_passing = -1; 117*0Sstevel@tonic-gate #endif 118*0Sstevel@tonic-gate options->password_authentication = -1; 119*0Sstevel@tonic-gate options->kbd_interactive_authentication = -1; 120*0Sstevel@tonic-gate options->challenge_response_authentication = -1; 121*0Sstevel@tonic-gate options->permit_empty_passwd = -1; 122*0Sstevel@tonic-gate options->permit_user_env = -1; 123*0Sstevel@tonic-gate options->use_login = -1; 124*0Sstevel@tonic-gate options->compression = -1; 125*0Sstevel@tonic-gate options->allow_tcp_forwarding = -1; 126*0Sstevel@tonic-gate options->num_allow_users = 0; 127*0Sstevel@tonic-gate options->num_deny_users = 0; 128*0Sstevel@tonic-gate options->num_allow_groups = 0; 129*0Sstevel@tonic-gate options->num_deny_groups = 0; 130*0Sstevel@tonic-gate options->ciphers = NULL; 131*0Sstevel@tonic-gate options->macs = NULL; 132*0Sstevel@tonic-gate options->protocol = SSH_PROTO_UNKNOWN; 133*0Sstevel@tonic-gate options->gateway_ports = -1; 134*0Sstevel@tonic-gate options->num_subsystems = 0; 135*0Sstevel@tonic-gate options->max_startups_begin = -1; 136*0Sstevel@tonic-gate options->max_startups_rate = -1; 137*0Sstevel@tonic-gate options->max_startups = -1; 138*0Sstevel@tonic-gate options->banner = NULL; 139*0Sstevel@tonic-gate options->verify_reverse_mapping = -1; 140*0Sstevel@tonic-gate options->client_alive_interval = -1; 141*0Sstevel@tonic-gate options->client_alive_count_max = -1; 142*0Sstevel@tonic-gate options->authorized_keys_file = NULL; 143*0Sstevel@tonic-gate options->authorized_keys_file2 = NULL; 144*0Sstevel@tonic-gate 145*0Sstevel@tonic-gate options->max_auth_tries = -1; 146*0Sstevel@tonic-gate options->max_auth_tries_log = -1; 147*0Sstevel@tonic-gate 148*0Sstevel@tonic-gate options->max_init_auth_tries = -1; 149*0Sstevel@tonic-gate options->max_init_auth_tries_log = -1; 150*0Sstevel@tonic-gate 151*0Sstevel@tonic-gate options->lookup_client_hostnames = -1; 152*0Sstevel@tonic-gate 153*0Sstevel@tonic-gate /* Needs to be accessable in many places */ 154*0Sstevel@tonic-gate use_privsep = -1; 155*0Sstevel@tonic-gate } 156*0Sstevel@tonic-gate 157*0Sstevel@tonic-gate #ifdef HAVE_DEFOPEN 158*0Sstevel@tonic-gate /* 159*0Sstevel@tonic-gate * Reads /etc/default/login and defaults several ServerOptions: 160*0Sstevel@tonic-gate * 161*0Sstevel@tonic-gate * PermitRootLogin 162*0Sstevel@tonic-gate * PermitEmptyPasswords 163*0Sstevel@tonic-gate * LoginGraceTime 164*0Sstevel@tonic-gate * 165*0Sstevel@tonic-gate * CONSOLE=* -> PermitRootLogin=without-password 166*0Sstevel@tonic-gate * #CONSOLE=* -> PermitRootLogin=yes 167*0Sstevel@tonic-gate * 168*0Sstevel@tonic-gate * PASSREQ=YES -> PermitEmptyPasswords=no 169*0Sstevel@tonic-gate * PASSREQ=NO -> PermitEmptyPasswords=yes 170*0Sstevel@tonic-gate * #PASSREQ=* -> PermitEmptyPasswords=no 171*0Sstevel@tonic-gate * 172*0Sstevel@tonic-gate * TIMEOUT=<secs> -> LoginGraceTime=<secs> 173*0Sstevel@tonic-gate * #TIMEOUT=<secs> -> LoginGraceTime=300 174*0Sstevel@tonic-gate */ 175*0Sstevel@tonic-gate static 176*0Sstevel@tonic-gate void 177*0Sstevel@tonic-gate deflt_fill_default_server_options(ServerOptions *options) 178*0Sstevel@tonic-gate { 179*0Sstevel@tonic-gate int flags; 180*0Sstevel@tonic-gate char *ptr; 181*0Sstevel@tonic-gate 182*0Sstevel@tonic-gate if (defopen(_PATH_DEFAULT_LOGIN)) 183*0Sstevel@tonic-gate return; 184*0Sstevel@tonic-gate 185*0Sstevel@tonic-gate /* Ignore case */ 186*0Sstevel@tonic-gate flags = defcntl(DC_GETFLAGS, 0); 187*0Sstevel@tonic-gate TURNOFF(flags, DC_CASE); 188*0Sstevel@tonic-gate (void) defcntl(DC_SETFLAGS, flags); 189*0Sstevel@tonic-gate 190*0Sstevel@tonic-gate if (options->permit_root_login == PERMIT_NOT_SET && 191*0Sstevel@tonic-gate (ptr = defread("CONSOLE=")) != NULL) 192*0Sstevel@tonic-gate options->permit_root_login = PERMIT_NO_PASSWD; 193*0Sstevel@tonic-gate 194*0Sstevel@tonic-gate if (options->permit_empty_passwd == -1 && 195*0Sstevel@tonic-gate (ptr = defread("PASSREQ=")) != NULL) { 196*0Sstevel@tonic-gate if (strcasecmp("YES", ptr) == 0) 197*0Sstevel@tonic-gate options->permit_empty_passwd = 0; 198*0Sstevel@tonic-gate else if (strcasecmp("NO", ptr) == 0) 199*0Sstevel@tonic-gate options->permit_empty_passwd = 1; 200*0Sstevel@tonic-gate } 201*0Sstevel@tonic-gate 202*0Sstevel@tonic-gate if (options->max_init_auth_tries == -1 && 203*0Sstevel@tonic-gate (ptr = defread("RETRIES=")) != NULL) { 204*0Sstevel@tonic-gate options->max_init_auth_tries = atoi(ptr); 205*0Sstevel@tonic-gate } 206*0Sstevel@tonic-gate 207*0Sstevel@tonic-gate if (options->max_init_auth_tries_log == -1 && 208*0Sstevel@tonic-gate (ptr = defread("SYSLOG_FAILED_LOGINS=")) != NULL) { 209*0Sstevel@tonic-gate options->max_init_auth_tries_log = atoi(ptr); 210*0Sstevel@tonic-gate } 211*0Sstevel@tonic-gate 212*0Sstevel@tonic-gate if (options->login_grace_time == -1) { 213*0Sstevel@tonic-gate if ((ptr = defread("TIMEOUT=")) != NULL) 214*0Sstevel@tonic-gate options->login_grace_time = (unsigned)atoi(ptr); 215*0Sstevel@tonic-gate else 216*0Sstevel@tonic-gate options->login_grace_time = 300; 217*0Sstevel@tonic-gate } 218*0Sstevel@tonic-gate 219*0Sstevel@tonic-gate (void) defopen((char *)NULL); 220*0Sstevel@tonic-gate } 221*0Sstevel@tonic-gate #endif /* HAVE_DEFOPEN */ 222*0Sstevel@tonic-gate 223*0Sstevel@tonic-gate void 224*0Sstevel@tonic-gate fill_default_server_options(ServerOptions *options) 225*0Sstevel@tonic-gate { 226*0Sstevel@tonic-gate 227*0Sstevel@tonic-gate #ifdef HAVE_DEFOPEN 228*0Sstevel@tonic-gate deflt_fill_default_server_options(options); 229*0Sstevel@tonic-gate #endif /* HAVE_DEFOPEN */ 230*0Sstevel@tonic-gate 231*0Sstevel@tonic-gate /* Portable-specific options */ 232*0Sstevel@tonic-gate if (options->pam_authentication_via_kbd_int == -1) 233*0Sstevel@tonic-gate options->pam_authentication_via_kbd_int = 0; 234*0Sstevel@tonic-gate 235*0Sstevel@tonic-gate /* Standard Options */ 236*0Sstevel@tonic-gate if (options->protocol == SSH_PROTO_UNKNOWN) 237*0Sstevel@tonic-gate options->protocol = SSH_PROTO_1|SSH_PROTO_2; 238*0Sstevel@tonic-gate if (options->num_host_key_files == 0) { 239*0Sstevel@tonic-gate /* fill default hostkeys for protocols */ 240*0Sstevel@tonic-gate if (options->protocol & SSH_PROTO_1) 241*0Sstevel@tonic-gate options->host_key_files[options->num_host_key_files++] = 242*0Sstevel@tonic-gate _PATH_HOST_KEY_FILE; 243*0Sstevel@tonic-gate #ifndef GSSAPI 244*0Sstevel@tonic-gate /* With GSS keyex we can run v2 w/ no host keys */ 245*0Sstevel@tonic-gate if (options->protocol & SSH_PROTO_2) { 246*0Sstevel@tonic-gate options->host_key_files[options->num_host_key_files++] = 247*0Sstevel@tonic-gate _PATH_HOST_RSA_KEY_FILE; 248*0Sstevel@tonic-gate options->host_key_files[options->num_host_key_files++] = 249*0Sstevel@tonic-gate _PATH_HOST_DSA_KEY_FILE; 250*0Sstevel@tonic-gate } 251*0Sstevel@tonic-gate #endif /* GSSAPI */ 252*0Sstevel@tonic-gate } 253*0Sstevel@tonic-gate if (options->num_ports == 0) 254*0Sstevel@tonic-gate options->ports[options->num_ports++] = SSH_DEFAULT_PORT; 255*0Sstevel@tonic-gate if (options->listen_addrs == NULL) 256*0Sstevel@tonic-gate add_listen_addr(options, NULL, 0); 257*0Sstevel@tonic-gate if (options->pid_file == NULL) 258*0Sstevel@tonic-gate options->pid_file = _PATH_SSH_DAEMON_PID_FILE; 259*0Sstevel@tonic-gate if (options->server_key_bits == -1) 260*0Sstevel@tonic-gate options->server_key_bits = 768; 261*0Sstevel@tonic-gate if (options->login_grace_time == -1) 262*0Sstevel@tonic-gate options->login_grace_time = 120; 263*0Sstevel@tonic-gate if (options->key_regeneration_time == -1) 264*0Sstevel@tonic-gate options->key_regeneration_time = 3600; 265*0Sstevel@tonic-gate if (options->permit_root_login == PERMIT_NOT_SET) 266*0Sstevel@tonic-gate options->permit_root_login = PERMIT_YES; 267*0Sstevel@tonic-gate if (options->ignore_rhosts == -1) 268*0Sstevel@tonic-gate options->ignore_rhosts = 1; 269*0Sstevel@tonic-gate if (options->ignore_user_known_hosts == -1) 270*0Sstevel@tonic-gate options->ignore_user_known_hosts = 0; 271*0Sstevel@tonic-gate if (options->print_motd == -1) 272*0Sstevel@tonic-gate options->print_motd = 1; 273*0Sstevel@tonic-gate if (options->print_lastlog == -1) 274*0Sstevel@tonic-gate options->print_lastlog = 1; 275*0Sstevel@tonic-gate if (options->x11_forwarding == -1) 276*0Sstevel@tonic-gate options->x11_forwarding = 1; 277*0Sstevel@tonic-gate if (options->x11_display_offset == -1) 278*0Sstevel@tonic-gate options->x11_display_offset = 10; 279*0Sstevel@tonic-gate if (options->x11_use_localhost == -1) 280*0Sstevel@tonic-gate options->x11_use_localhost = 1; 281*0Sstevel@tonic-gate if (options->xauth_location == NULL) 282*0Sstevel@tonic-gate options->xauth_location = _PATH_XAUTH; 283*0Sstevel@tonic-gate if (options->strict_modes == -1) 284*0Sstevel@tonic-gate options->strict_modes = 1; 285*0Sstevel@tonic-gate if (options->keepalives == -1) 286*0Sstevel@tonic-gate options->keepalives = 1; 287*0Sstevel@tonic-gate if (options->log_facility == SYSLOG_FACILITY_NOT_SET) 288*0Sstevel@tonic-gate options->log_facility = SYSLOG_FACILITY_AUTH; 289*0Sstevel@tonic-gate if (options->log_level == SYSLOG_LEVEL_NOT_SET) 290*0Sstevel@tonic-gate options->log_level = SYSLOG_LEVEL_INFO; 291*0Sstevel@tonic-gate if (options->rhosts_authentication == -1) 292*0Sstevel@tonic-gate options->rhosts_authentication = 0; 293*0Sstevel@tonic-gate if (options->rhosts_rsa_authentication == -1) 294*0Sstevel@tonic-gate options->rhosts_rsa_authentication = 0; 295*0Sstevel@tonic-gate if (options->hostbased_authentication == -1) 296*0Sstevel@tonic-gate options->hostbased_authentication = 0; 297*0Sstevel@tonic-gate if (options->hostbased_uses_name_from_packet_only == -1) 298*0Sstevel@tonic-gate options->hostbased_uses_name_from_packet_only = 0; 299*0Sstevel@tonic-gate if (options->rsa_authentication == -1) 300*0Sstevel@tonic-gate options->rsa_authentication = 1; 301*0Sstevel@tonic-gate if (options->pubkey_authentication == -1) 302*0Sstevel@tonic-gate options->pubkey_authentication = 1; 303*0Sstevel@tonic-gate #ifdef GSSAPI 304*0Sstevel@tonic-gate if (options->gss_authentication == -1) 305*0Sstevel@tonic-gate options->gss_authentication = 1; 306*0Sstevel@tonic-gate if (options->gss_keyex == -1) 307*0Sstevel@tonic-gate options->gss_keyex = 1; 308*0Sstevel@tonic-gate if (options->gss_store_creds == -1) 309*0Sstevel@tonic-gate options->gss_store_creds = 1; 310*0Sstevel@tonic-gate if (options->gss_use_session_ccache == -1) 311*0Sstevel@tonic-gate options->gss_use_session_ccache = 1; 312*0Sstevel@tonic-gate if (options->gss_cleanup_creds == -1) 313*0Sstevel@tonic-gate options->gss_cleanup_creds = 1; 314*0Sstevel@tonic-gate #endif 315*0Sstevel@tonic-gate #if defined(KRB4) || defined(KRB5) 316*0Sstevel@tonic-gate if (options->kerberos_authentication == -1) 317*0Sstevel@tonic-gate options->kerberos_authentication = 0; 318*0Sstevel@tonic-gate if (options->kerberos_or_local_passwd == -1) 319*0Sstevel@tonic-gate options->kerberos_or_local_passwd = 1; 320*0Sstevel@tonic-gate if (options->kerberos_ticket_cleanup == -1) 321*0Sstevel@tonic-gate options->kerberos_ticket_cleanup = 1; 322*0Sstevel@tonic-gate #endif 323*0Sstevel@tonic-gate #if defined(AFS) || defined(KRB5) 324*0Sstevel@tonic-gate if (options->kerberos_tgt_passing == -1) 325*0Sstevel@tonic-gate options->kerberos_tgt_passing = 0; 326*0Sstevel@tonic-gate #endif 327*0Sstevel@tonic-gate #ifdef AFS 328*0Sstevel@tonic-gate if (options->afs_token_passing == -1) 329*0Sstevel@tonic-gate options->afs_token_passing = 0; 330*0Sstevel@tonic-gate #endif 331*0Sstevel@tonic-gate if (options->password_authentication == -1) 332*0Sstevel@tonic-gate options->password_authentication = 1; 333*0Sstevel@tonic-gate if (options->kbd_interactive_authentication == -1) 334*0Sstevel@tonic-gate options->kbd_interactive_authentication = 0; 335*0Sstevel@tonic-gate if (options->challenge_response_authentication == -1) 336*0Sstevel@tonic-gate options->challenge_response_authentication = 1; 337*0Sstevel@tonic-gate if (options->permit_empty_passwd == -1) 338*0Sstevel@tonic-gate options->permit_empty_passwd = 0; 339*0Sstevel@tonic-gate if (options->permit_user_env == -1) 340*0Sstevel@tonic-gate options->permit_user_env = 0; 341*0Sstevel@tonic-gate if (options->use_login == -1) 342*0Sstevel@tonic-gate options->use_login = 0; 343*0Sstevel@tonic-gate if (options->compression == -1) 344*0Sstevel@tonic-gate options->compression = 1; 345*0Sstevel@tonic-gate if (options->allow_tcp_forwarding == -1) 346*0Sstevel@tonic-gate options->allow_tcp_forwarding = 1; 347*0Sstevel@tonic-gate if (options->gateway_ports == -1) 348*0Sstevel@tonic-gate options->gateway_ports = 0; 349*0Sstevel@tonic-gate if (options->max_startups == -1) 350*0Sstevel@tonic-gate options->max_startups = 10; 351*0Sstevel@tonic-gate if (options->max_startups_rate == -1) 352*0Sstevel@tonic-gate options->max_startups_rate = 100; /* 100% */ 353*0Sstevel@tonic-gate if (options->max_startups_begin == -1) 354*0Sstevel@tonic-gate options->max_startups_begin = options->max_startups; 355*0Sstevel@tonic-gate if (options->verify_reverse_mapping == -1) 356*0Sstevel@tonic-gate options->verify_reverse_mapping = 0; 357*0Sstevel@tonic-gate if (options->client_alive_interval == -1) 358*0Sstevel@tonic-gate options->client_alive_interval = 0; 359*0Sstevel@tonic-gate if (options->client_alive_count_max == -1) 360*0Sstevel@tonic-gate options->client_alive_count_max = 3; 361*0Sstevel@tonic-gate if (options->authorized_keys_file2 == NULL) { 362*0Sstevel@tonic-gate /* authorized_keys_file2 falls back to authorized_keys_file */ 363*0Sstevel@tonic-gate if (options->authorized_keys_file != NULL) 364*0Sstevel@tonic-gate options->authorized_keys_file2 = options->authorized_keys_file; 365*0Sstevel@tonic-gate else 366*0Sstevel@tonic-gate options->authorized_keys_file2 = _PATH_SSH_USER_PERMITTED_KEYS2; 367*0Sstevel@tonic-gate } 368*0Sstevel@tonic-gate if (options->authorized_keys_file == NULL) 369*0Sstevel@tonic-gate options->authorized_keys_file = _PATH_SSH_USER_PERMITTED_KEYS; 370*0Sstevel@tonic-gate 371*0Sstevel@tonic-gate if (options->max_auth_tries == -1) 372*0Sstevel@tonic-gate options->max_auth_tries = AUTH_FAIL_MAX; 373*0Sstevel@tonic-gate if (options->max_auth_tries_log == -1) 374*0Sstevel@tonic-gate options->max_auth_tries_log = options->max_auth_tries / 2; 375*0Sstevel@tonic-gate 376*0Sstevel@tonic-gate if (options->max_init_auth_tries == -1) 377*0Sstevel@tonic-gate options->max_init_auth_tries = AUTH_FAIL_MAX; 378*0Sstevel@tonic-gate if (options->max_init_auth_tries_log == -1) 379*0Sstevel@tonic-gate options->max_init_auth_tries_log = options->max_init_auth_tries / 2; 380*0Sstevel@tonic-gate 381*0Sstevel@tonic-gate if (options->lookup_client_hostnames == -1) 382*0Sstevel@tonic-gate options->lookup_client_hostnames = 1; 383*0Sstevel@tonic-gate 384*0Sstevel@tonic-gate /* XXX SUNWssh resync */ 385*0Sstevel@tonic-gate /* Turn privilege separation OFF by default */ 386*0Sstevel@tonic-gate if (use_privsep == -1) 387*0Sstevel@tonic-gate use_privsep = 0; 388*0Sstevel@tonic-gate 389*0Sstevel@tonic-gate #ifndef HAVE_MMAP 390*0Sstevel@tonic-gate if (use_privsep && options->compression == 1) { 391*0Sstevel@tonic-gate error("This platform does not support both privilege " 392*0Sstevel@tonic-gate "separation and compression"); 393*0Sstevel@tonic-gate error("Compression disabled"); 394*0Sstevel@tonic-gate options->compression = 0; 395*0Sstevel@tonic-gate } 396*0Sstevel@tonic-gate #endif 397*0Sstevel@tonic-gate 398*0Sstevel@tonic-gate } 399*0Sstevel@tonic-gate 400*0Sstevel@tonic-gate /* Keyword tokens. */ 401*0Sstevel@tonic-gate typedef enum { 402*0Sstevel@tonic-gate sBadOption, /* == unknown option */ 403*0Sstevel@tonic-gate /* Portable-specific options */ 404*0Sstevel@tonic-gate sPAMAuthenticationViaKbdInt, 405*0Sstevel@tonic-gate /* Standard Options */ 406*0Sstevel@tonic-gate sPort, sHostKeyFile, sServerKeyBits, sLoginGraceTime, sKeyRegenerationTime, 407*0Sstevel@tonic-gate sPermitRootLogin, sLogFacility, sLogLevel, 408*0Sstevel@tonic-gate sRhostsAuthentication, sRhostsRSAAuthentication, sRSAAuthentication, 409*0Sstevel@tonic-gate #ifdef GSSAPI 410*0Sstevel@tonic-gate sGssAuthentication, sGssKeyEx, sGssStoreDelegCreds, 411*0Sstevel@tonic-gate sGssUseSessionCredCache, sGssCleanupCreds, 412*0Sstevel@tonic-gate #endif /* GSSAPI */ 413*0Sstevel@tonic-gate #if defined(KRB4) || defined(KRB5) 414*0Sstevel@tonic-gate sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup, 415*0Sstevel@tonic-gate #endif 416*0Sstevel@tonic-gate #if defined(AFS) || defined(KRB5) 417*0Sstevel@tonic-gate sKerberosTgtPassing, 418*0Sstevel@tonic-gate #endif 419*0Sstevel@tonic-gate #ifdef AFS 420*0Sstevel@tonic-gate sAFSTokenPassing, 421*0Sstevel@tonic-gate #endif 422*0Sstevel@tonic-gate sChallengeResponseAuthentication, 423*0Sstevel@tonic-gate sPasswordAuthentication, sKbdInteractiveAuthentication, sListenAddress, 424*0Sstevel@tonic-gate sPrintMotd, sPrintLastLog, sIgnoreRhosts, 425*0Sstevel@tonic-gate sX11Forwarding, sX11DisplayOffset, sX11UseLocalhost, 426*0Sstevel@tonic-gate sStrictModes, sEmptyPasswd, sKeepAlives, 427*0Sstevel@tonic-gate sPermitUserEnvironment, sUseLogin, sAllowTcpForwarding, sCompression, 428*0Sstevel@tonic-gate sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups, 429*0Sstevel@tonic-gate sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile, 430*0Sstevel@tonic-gate sGatewayPorts, sPubkeyAuthentication, sXAuthLocation, sSubsystem, sMaxStartups, 431*0Sstevel@tonic-gate sBanner, sVerifyReverseMapping, sHostbasedAuthentication, 432*0Sstevel@tonic-gate sHostbasedUsesNameFromPacketOnly, sClientAliveInterval, 433*0Sstevel@tonic-gate sClientAliveCountMax, sAuthorizedKeysFile, sAuthorizedKeysFile2, 434*0Sstevel@tonic-gate sMaxAuthTries, sMaxAuthTriesLog, sUsePrivilegeSeparation, 435*0Sstevel@tonic-gate sLookupClientHostnames, 436*0Sstevel@tonic-gate sDeprecated 437*0Sstevel@tonic-gate } ServerOpCodes; 438*0Sstevel@tonic-gate 439*0Sstevel@tonic-gate /* Textual representation of the tokens. */ 440*0Sstevel@tonic-gate static struct { 441*0Sstevel@tonic-gate const char *name; 442*0Sstevel@tonic-gate ServerOpCodes opcode; 443*0Sstevel@tonic-gate } keywords[] = { 444*0Sstevel@tonic-gate /* Portable-specific options */ 445*0Sstevel@tonic-gate { "PAMAuthenticationViaKbdInt", sPAMAuthenticationViaKbdInt }, 446*0Sstevel@tonic-gate /* Standard Options */ 447*0Sstevel@tonic-gate { "port", sPort }, 448*0Sstevel@tonic-gate { "hostkey", sHostKeyFile }, 449*0Sstevel@tonic-gate { "hostdsakey", sHostKeyFile }, /* alias */ 450*0Sstevel@tonic-gate { "pidfile", sPidFile }, 451*0Sstevel@tonic-gate { "serverkeybits", sServerKeyBits }, 452*0Sstevel@tonic-gate { "logingracetime", sLoginGraceTime }, 453*0Sstevel@tonic-gate { "keyregenerationinterval", sKeyRegenerationTime }, 454*0Sstevel@tonic-gate { "permitrootlogin", sPermitRootLogin }, 455*0Sstevel@tonic-gate { "syslogfacility", sLogFacility }, 456*0Sstevel@tonic-gate { "loglevel", sLogLevel }, 457*0Sstevel@tonic-gate { "rhostsauthentication", sRhostsAuthentication }, 458*0Sstevel@tonic-gate { "rhostsrsaauthentication", sRhostsRSAAuthentication }, 459*0Sstevel@tonic-gate { "hostbasedauthentication", sHostbasedAuthentication }, 460*0Sstevel@tonic-gate { "hostbasedusesnamefrompacketonly", sHostbasedUsesNameFromPacketOnly }, 461*0Sstevel@tonic-gate { "rsaauthentication", sRSAAuthentication }, 462*0Sstevel@tonic-gate { "pubkeyauthentication", sPubkeyAuthentication }, 463*0Sstevel@tonic-gate { "dsaauthentication", sPubkeyAuthentication }, /* alias */ 464*0Sstevel@tonic-gate #ifdef GSSAPI 465*0Sstevel@tonic-gate { "gssapiauthentication", sGssAuthentication }, 466*0Sstevel@tonic-gate { "gssapikeyexchange", sGssKeyEx }, 467*0Sstevel@tonic-gate { "gssapistoredelegatedcredentials", sGssStoreDelegCreds }, 468*0Sstevel@tonic-gate { "gssauthentication", sGssAuthentication }, /* alias */ 469*0Sstevel@tonic-gate { "gsskeyex", sGssKeyEx }, /* alias */ 470*0Sstevel@tonic-gate { "gssstoredelegcreds", sGssStoreDelegCreds }, /* alias */ 471*0Sstevel@tonic-gate #ifndef SUNW_GSSAPI 472*0Sstevel@tonic-gate { "gssusesessionccache", sGssUseSessionCredCache }, 473*0Sstevel@tonic-gate { "gssusesessioncredcache", sGssUseSessionCredCache }, 474*0Sstevel@tonic-gate { "gsscleanupcreds", sGssCleanupCreds }, 475*0Sstevel@tonic-gate #endif /* SUNW_GSSAPI */ 476*0Sstevel@tonic-gate #endif 477*0Sstevel@tonic-gate #if defined(KRB4) || defined(KRB5) 478*0Sstevel@tonic-gate { "kerberosauthentication", sKerberosAuthentication }, 479*0Sstevel@tonic-gate { "kerberosorlocalpasswd", sKerberosOrLocalPasswd }, 480*0Sstevel@tonic-gate { "kerberosticketcleanup", sKerberosTicketCleanup }, 481*0Sstevel@tonic-gate #endif 482*0Sstevel@tonic-gate #if defined(AFS) || defined(KRB5) 483*0Sstevel@tonic-gate { "kerberostgtpassing", sKerberosTgtPassing }, 484*0Sstevel@tonic-gate #endif 485*0Sstevel@tonic-gate #ifdef AFS 486*0Sstevel@tonic-gate { "afstokenpassing", sAFSTokenPassing }, 487*0Sstevel@tonic-gate #endif 488*0Sstevel@tonic-gate { "passwordauthentication", sPasswordAuthentication }, 489*0Sstevel@tonic-gate { "kbdinteractiveauthentication", sKbdInteractiveAuthentication }, 490*0Sstevel@tonic-gate { "challengeresponseauthentication", sChallengeResponseAuthentication }, 491*0Sstevel@tonic-gate { "skeyauthentication", sChallengeResponseAuthentication }, /* alias */ 492*0Sstevel@tonic-gate { "checkmail", sDeprecated }, 493*0Sstevel@tonic-gate { "listenaddress", sListenAddress }, 494*0Sstevel@tonic-gate { "printmotd", sPrintMotd }, 495*0Sstevel@tonic-gate { "printlastlog", sPrintLastLog }, 496*0Sstevel@tonic-gate { "ignorerhosts", sIgnoreRhosts }, 497*0Sstevel@tonic-gate { "ignoreuserknownhosts", sIgnoreUserKnownHosts }, 498*0Sstevel@tonic-gate { "x11forwarding", sX11Forwarding }, 499*0Sstevel@tonic-gate { "x11displayoffset", sX11DisplayOffset }, 500*0Sstevel@tonic-gate { "x11uselocalhost", sX11UseLocalhost }, 501*0Sstevel@tonic-gate { "xauthlocation", sXAuthLocation }, 502*0Sstevel@tonic-gate { "strictmodes", sStrictModes }, 503*0Sstevel@tonic-gate { "permitemptypasswords", sEmptyPasswd }, 504*0Sstevel@tonic-gate { "permituserenvironment", sPermitUserEnvironment }, 505*0Sstevel@tonic-gate { "uselogin", sUseLogin }, 506*0Sstevel@tonic-gate { "compression", sCompression }, 507*0Sstevel@tonic-gate { "keepalive", sKeepAlives }, 508*0Sstevel@tonic-gate { "allowtcpforwarding", sAllowTcpForwarding }, 509*0Sstevel@tonic-gate { "allowusers", sAllowUsers }, 510*0Sstevel@tonic-gate { "denyusers", sDenyUsers }, 511*0Sstevel@tonic-gate { "allowgroups", sAllowGroups }, 512*0Sstevel@tonic-gate { "denygroups", sDenyGroups }, 513*0Sstevel@tonic-gate { "ciphers", sCiphers }, 514*0Sstevel@tonic-gate { "macs", sMacs }, 515*0Sstevel@tonic-gate { "protocol", sProtocol }, 516*0Sstevel@tonic-gate { "gatewayports", sGatewayPorts }, 517*0Sstevel@tonic-gate { "subsystem", sSubsystem }, 518*0Sstevel@tonic-gate { "maxstartups", sMaxStartups }, 519*0Sstevel@tonic-gate { "banner", sBanner }, 520*0Sstevel@tonic-gate { "verifyreversemapping", sVerifyReverseMapping }, 521*0Sstevel@tonic-gate { "reversemappingcheck", sVerifyReverseMapping }, 522*0Sstevel@tonic-gate { "clientaliveinterval", sClientAliveInterval }, 523*0Sstevel@tonic-gate { "clientalivecountmax", sClientAliveCountMax }, 524*0Sstevel@tonic-gate { "authorizedkeysfile", sAuthorizedKeysFile }, 525*0Sstevel@tonic-gate { "authorizedkeysfile2", sAuthorizedKeysFile2 }, 526*0Sstevel@tonic-gate { "maxauthtries", sMaxAuthTries }, 527*0Sstevel@tonic-gate { "maxauthtrieslog", sMaxAuthTriesLog }, 528*0Sstevel@tonic-gate { "useprivilegeseparation", sUsePrivilegeSeparation}, 529*0Sstevel@tonic-gate { "lookupclienthostnames", sLookupClientHostnames}, 530*0Sstevel@tonic-gate { NULL, sBadOption } 531*0Sstevel@tonic-gate }; 532*0Sstevel@tonic-gate 533*0Sstevel@tonic-gate /* 534*0Sstevel@tonic-gate * Returns the number of the token pointed to by cp or sBadOption. 535*0Sstevel@tonic-gate */ 536*0Sstevel@tonic-gate 537*0Sstevel@tonic-gate static ServerOpCodes 538*0Sstevel@tonic-gate parse_token(const char *cp, const char *filename, 539*0Sstevel@tonic-gate int linenum) 540*0Sstevel@tonic-gate { 541*0Sstevel@tonic-gate u_int i; 542*0Sstevel@tonic-gate 543*0Sstevel@tonic-gate for (i = 0; keywords[i].name; i++) 544*0Sstevel@tonic-gate if (strcasecmp(cp, keywords[i].name) == 0) 545*0Sstevel@tonic-gate return keywords[i].opcode; 546*0Sstevel@tonic-gate 547*0Sstevel@tonic-gate error("%s: line %d: Bad configuration option: %s", 548*0Sstevel@tonic-gate filename, linenum, cp); 549*0Sstevel@tonic-gate return sBadOption; 550*0Sstevel@tonic-gate } 551*0Sstevel@tonic-gate 552*0Sstevel@tonic-gate static void 553*0Sstevel@tonic-gate add_listen_addr(ServerOptions *options, char *addr, u_short port) 554*0Sstevel@tonic-gate { 555*0Sstevel@tonic-gate int i; 556*0Sstevel@tonic-gate 557*0Sstevel@tonic-gate if (options->num_ports == 0) 558*0Sstevel@tonic-gate options->ports[options->num_ports++] = SSH_DEFAULT_PORT; 559*0Sstevel@tonic-gate if (port == 0) 560*0Sstevel@tonic-gate for (i = 0; i < options->num_ports; i++) 561*0Sstevel@tonic-gate add_one_listen_addr(options, addr, options->ports[i]); 562*0Sstevel@tonic-gate else 563*0Sstevel@tonic-gate add_one_listen_addr(options, addr, port); 564*0Sstevel@tonic-gate } 565*0Sstevel@tonic-gate 566*0Sstevel@tonic-gate static void 567*0Sstevel@tonic-gate add_one_listen_addr(ServerOptions *options, char *addr, u_short port) 568*0Sstevel@tonic-gate { 569*0Sstevel@tonic-gate struct addrinfo hints, *ai, *aitop; 570*0Sstevel@tonic-gate char strport[NI_MAXSERV]; 571*0Sstevel@tonic-gate int gaierr; 572*0Sstevel@tonic-gate 573*0Sstevel@tonic-gate (void) memset(&hints, 0, sizeof(hints)); 574*0Sstevel@tonic-gate hints.ai_family = IPv4or6; 575*0Sstevel@tonic-gate hints.ai_socktype = SOCK_STREAM; 576*0Sstevel@tonic-gate hints.ai_flags = (addr == NULL) ? AI_PASSIVE : 0; 577*0Sstevel@tonic-gate (void) snprintf(strport, sizeof strport, "%u", port); 578*0Sstevel@tonic-gate if ((gaierr = getaddrinfo(addr, strport, &hints, &aitop)) != 0) 579*0Sstevel@tonic-gate fatal("bad addr or host: %s (%s)", 580*0Sstevel@tonic-gate addr ? addr : "<NULL>", 581*0Sstevel@tonic-gate gai_strerror(gaierr)); 582*0Sstevel@tonic-gate for (ai = aitop; ai->ai_next; ai = ai->ai_next) 583*0Sstevel@tonic-gate ; 584*0Sstevel@tonic-gate ai->ai_next = options->listen_addrs; 585*0Sstevel@tonic-gate options->listen_addrs = aitop; 586*0Sstevel@tonic-gate } 587*0Sstevel@tonic-gate 588*0Sstevel@tonic-gate int 589*0Sstevel@tonic-gate process_server_config_line(ServerOptions *options, char *line, 590*0Sstevel@tonic-gate const char *filename, int linenum) 591*0Sstevel@tonic-gate { 592*0Sstevel@tonic-gate char *cp, **charptr, *arg, *p; 593*0Sstevel@tonic-gate int *intptr, value, i, n; 594*0Sstevel@tonic-gate ServerOpCodes opcode; 595*0Sstevel@tonic-gate 596*0Sstevel@tonic-gate cp = line; 597*0Sstevel@tonic-gate arg = strdelim(&cp); 598*0Sstevel@tonic-gate /* Ignore leading whitespace */ 599*0Sstevel@tonic-gate if (*arg == '\0') 600*0Sstevel@tonic-gate arg = strdelim(&cp); 601*0Sstevel@tonic-gate if (!arg || !*arg || *arg == '#') 602*0Sstevel@tonic-gate return 0; 603*0Sstevel@tonic-gate intptr = NULL; 604*0Sstevel@tonic-gate charptr = NULL; 605*0Sstevel@tonic-gate opcode = parse_token(arg, filename, linenum); 606*0Sstevel@tonic-gate switch (opcode) { 607*0Sstevel@tonic-gate /* Portable-specific options */ 608*0Sstevel@tonic-gate case sPAMAuthenticationViaKbdInt: 609*0Sstevel@tonic-gate intptr = &options->pam_authentication_via_kbd_int; 610*0Sstevel@tonic-gate goto parse_flag; 611*0Sstevel@tonic-gate 612*0Sstevel@tonic-gate /* Standard Options */ 613*0Sstevel@tonic-gate case sBadOption: 614*0Sstevel@tonic-gate return -1; 615*0Sstevel@tonic-gate case sPort: 616*0Sstevel@tonic-gate /* ignore ports from configfile if cmdline specifies ports */ 617*0Sstevel@tonic-gate if (options->ports_from_cmdline) 618*0Sstevel@tonic-gate return 0; 619*0Sstevel@tonic-gate if (options->listen_addrs != NULL) 620*0Sstevel@tonic-gate fatal("%s line %d: ports must be specified before " 621*0Sstevel@tonic-gate "ListenAddress.", filename, linenum); 622*0Sstevel@tonic-gate if (options->num_ports >= MAX_PORTS) 623*0Sstevel@tonic-gate fatal("%s line %d: too many ports.", 624*0Sstevel@tonic-gate filename, linenum); 625*0Sstevel@tonic-gate arg = strdelim(&cp); 626*0Sstevel@tonic-gate if (!arg || *arg == '\0') 627*0Sstevel@tonic-gate fatal("%s line %d: missing port number.", 628*0Sstevel@tonic-gate filename, linenum); 629*0Sstevel@tonic-gate options->ports[options->num_ports++] = a2port(arg); 630*0Sstevel@tonic-gate if (options->ports[options->num_ports-1] == 0) 631*0Sstevel@tonic-gate fatal("%s line %d: Badly formatted port number.", 632*0Sstevel@tonic-gate filename, linenum); 633*0Sstevel@tonic-gate break; 634*0Sstevel@tonic-gate 635*0Sstevel@tonic-gate case sServerKeyBits: 636*0Sstevel@tonic-gate intptr = &options->server_key_bits; 637*0Sstevel@tonic-gate parse_int: 638*0Sstevel@tonic-gate arg = strdelim(&cp); 639*0Sstevel@tonic-gate if (!arg || *arg == '\0') 640*0Sstevel@tonic-gate fatal("%s line %d: missing integer value.", 641*0Sstevel@tonic-gate filename, linenum); 642*0Sstevel@tonic-gate value = atoi(arg); 643*0Sstevel@tonic-gate if (*intptr == -1) 644*0Sstevel@tonic-gate *intptr = value; 645*0Sstevel@tonic-gate break; 646*0Sstevel@tonic-gate 647*0Sstevel@tonic-gate case sLoginGraceTime: 648*0Sstevel@tonic-gate intptr = &options->login_grace_time; 649*0Sstevel@tonic-gate parse_time: 650*0Sstevel@tonic-gate arg = strdelim(&cp); 651*0Sstevel@tonic-gate if (!arg || *arg == '\0') 652*0Sstevel@tonic-gate fatal("%s line %d: missing time value.", 653*0Sstevel@tonic-gate filename, linenum); 654*0Sstevel@tonic-gate if ((value = convtime(arg)) == -1) 655*0Sstevel@tonic-gate fatal("%s line %d: invalid time value.", 656*0Sstevel@tonic-gate filename, linenum); 657*0Sstevel@tonic-gate if (*intptr == -1) 658*0Sstevel@tonic-gate *intptr = value; 659*0Sstevel@tonic-gate break; 660*0Sstevel@tonic-gate 661*0Sstevel@tonic-gate case sKeyRegenerationTime: 662*0Sstevel@tonic-gate intptr = &options->key_regeneration_time; 663*0Sstevel@tonic-gate goto parse_time; 664*0Sstevel@tonic-gate 665*0Sstevel@tonic-gate case sListenAddress: 666*0Sstevel@tonic-gate arg = strdelim(&cp); 667*0Sstevel@tonic-gate if (!arg || *arg == '\0' || strncmp(arg, "[]", 2) == 0) 668*0Sstevel@tonic-gate fatal("%s line %d: missing inet addr.", 669*0Sstevel@tonic-gate filename, linenum); 670*0Sstevel@tonic-gate if (*arg == '[') { 671*0Sstevel@tonic-gate if ((p = strchr(arg, ']')) == NULL) 672*0Sstevel@tonic-gate fatal("%s line %d: bad ipv6 inet addr usage.", 673*0Sstevel@tonic-gate filename, linenum); 674*0Sstevel@tonic-gate arg++; 675*0Sstevel@tonic-gate (void) memmove(p, p+1, strlen(p+1)+1); 676*0Sstevel@tonic-gate } else if (((p = strchr(arg, ':')) == NULL) || 677*0Sstevel@tonic-gate (strchr(p+1, ':') != NULL)) { 678*0Sstevel@tonic-gate add_listen_addr(options, arg, 0); 679*0Sstevel@tonic-gate break; 680*0Sstevel@tonic-gate } 681*0Sstevel@tonic-gate if (*p == ':') { 682*0Sstevel@tonic-gate u_short port; 683*0Sstevel@tonic-gate 684*0Sstevel@tonic-gate p++; 685*0Sstevel@tonic-gate if (*p == '\0') 686*0Sstevel@tonic-gate fatal("%s line %d: bad inet addr:port usage.", 687*0Sstevel@tonic-gate filename, linenum); 688*0Sstevel@tonic-gate else { 689*0Sstevel@tonic-gate *(p-1) = '\0'; 690*0Sstevel@tonic-gate if ((port = a2port(p)) == 0) 691*0Sstevel@tonic-gate fatal("%s line %d: bad port number.", 692*0Sstevel@tonic-gate filename, linenum); 693*0Sstevel@tonic-gate add_listen_addr(options, arg, port); 694*0Sstevel@tonic-gate } 695*0Sstevel@tonic-gate } else if (*p == '\0') 696*0Sstevel@tonic-gate add_listen_addr(options, arg, 0); 697*0Sstevel@tonic-gate else 698*0Sstevel@tonic-gate fatal("%s line %d: bad inet addr usage.", 699*0Sstevel@tonic-gate filename, linenum); 700*0Sstevel@tonic-gate break; 701*0Sstevel@tonic-gate 702*0Sstevel@tonic-gate case sHostKeyFile: 703*0Sstevel@tonic-gate intptr = &options->num_host_key_files; 704*0Sstevel@tonic-gate if (*intptr >= MAX_HOSTKEYS) 705*0Sstevel@tonic-gate fatal("%s line %d: too many host keys specified (max %d).", 706*0Sstevel@tonic-gate filename, linenum, MAX_HOSTKEYS); 707*0Sstevel@tonic-gate charptr = &options->host_key_files[*intptr]; 708*0Sstevel@tonic-gate parse_filename: 709*0Sstevel@tonic-gate arg = strdelim(&cp); 710*0Sstevel@tonic-gate if (!arg || *arg == '\0') 711*0Sstevel@tonic-gate fatal("%s line %d: missing file name.", 712*0Sstevel@tonic-gate filename, linenum); 713*0Sstevel@tonic-gate if (*charptr == NULL) { 714*0Sstevel@tonic-gate *charptr = tilde_expand_filename(arg, getuid()); 715*0Sstevel@tonic-gate /* increase optional counter */ 716*0Sstevel@tonic-gate if (intptr != NULL) 717*0Sstevel@tonic-gate *intptr = *intptr + 1; 718*0Sstevel@tonic-gate } 719*0Sstevel@tonic-gate break; 720*0Sstevel@tonic-gate 721*0Sstevel@tonic-gate case sPidFile: 722*0Sstevel@tonic-gate charptr = &options->pid_file; 723*0Sstevel@tonic-gate goto parse_filename; 724*0Sstevel@tonic-gate 725*0Sstevel@tonic-gate case sPermitRootLogin: 726*0Sstevel@tonic-gate intptr = &options->permit_root_login; 727*0Sstevel@tonic-gate arg = strdelim(&cp); 728*0Sstevel@tonic-gate if (!arg || *arg == '\0') 729*0Sstevel@tonic-gate fatal("%s line %d: missing yes/" 730*0Sstevel@tonic-gate "without-password/forced-commands-only/no " 731*0Sstevel@tonic-gate "argument.", filename, linenum); 732*0Sstevel@tonic-gate value = 0; /* silence compiler */ 733*0Sstevel@tonic-gate if (strcmp(arg, "without-password") == 0) 734*0Sstevel@tonic-gate value = PERMIT_NO_PASSWD; 735*0Sstevel@tonic-gate else if (strcmp(arg, "forced-commands-only") == 0) 736*0Sstevel@tonic-gate value = PERMIT_FORCED_ONLY; 737*0Sstevel@tonic-gate else if (strcmp(arg, "yes") == 0) 738*0Sstevel@tonic-gate value = PERMIT_YES; 739*0Sstevel@tonic-gate else if (strcmp(arg, "no") == 0) 740*0Sstevel@tonic-gate value = PERMIT_NO; 741*0Sstevel@tonic-gate else 742*0Sstevel@tonic-gate fatal("%s line %d: Bad yes/" 743*0Sstevel@tonic-gate "without-password/forced-commands-only/no " 744*0Sstevel@tonic-gate "argument: %s", filename, linenum, arg); 745*0Sstevel@tonic-gate if (*intptr == -1) 746*0Sstevel@tonic-gate *intptr = value; 747*0Sstevel@tonic-gate break; 748*0Sstevel@tonic-gate 749*0Sstevel@tonic-gate case sIgnoreRhosts: 750*0Sstevel@tonic-gate intptr = &options->ignore_rhosts; 751*0Sstevel@tonic-gate parse_flag: 752*0Sstevel@tonic-gate arg = strdelim(&cp); 753*0Sstevel@tonic-gate if (!arg || *arg == '\0') 754*0Sstevel@tonic-gate fatal("%s line %d: missing yes/no argument.", 755*0Sstevel@tonic-gate filename, linenum); 756*0Sstevel@tonic-gate value = 0; /* silence compiler */ 757*0Sstevel@tonic-gate if (strcmp(arg, "yes") == 0) 758*0Sstevel@tonic-gate value = 1; 759*0Sstevel@tonic-gate else if (strcmp(arg, "no") == 0) 760*0Sstevel@tonic-gate value = 0; 761*0Sstevel@tonic-gate else 762*0Sstevel@tonic-gate fatal("%s line %d: Bad yes/no argument: %s", 763*0Sstevel@tonic-gate filename, linenum, arg); 764*0Sstevel@tonic-gate if (*intptr == -1) 765*0Sstevel@tonic-gate *intptr = value; 766*0Sstevel@tonic-gate break; 767*0Sstevel@tonic-gate 768*0Sstevel@tonic-gate case sIgnoreUserKnownHosts: 769*0Sstevel@tonic-gate intptr = &options->ignore_user_known_hosts; 770*0Sstevel@tonic-gate goto parse_flag; 771*0Sstevel@tonic-gate 772*0Sstevel@tonic-gate case sRhostsAuthentication: 773*0Sstevel@tonic-gate intptr = &options->rhosts_authentication; 774*0Sstevel@tonic-gate goto parse_flag; 775*0Sstevel@tonic-gate 776*0Sstevel@tonic-gate case sRhostsRSAAuthentication: 777*0Sstevel@tonic-gate intptr = &options->rhosts_rsa_authentication; 778*0Sstevel@tonic-gate goto parse_flag; 779*0Sstevel@tonic-gate 780*0Sstevel@tonic-gate case sHostbasedAuthentication: 781*0Sstevel@tonic-gate intptr = &options->hostbased_authentication; 782*0Sstevel@tonic-gate goto parse_flag; 783*0Sstevel@tonic-gate 784*0Sstevel@tonic-gate case sHostbasedUsesNameFromPacketOnly: 785*0Sstevel@tonic-gate intptr = &options->hostbased_uses_name_from_packet_only; 786*0Sstevel@tonic-gate goto parse_flag; 787*0Sstevel@tonic-gate 788*0Sstevel@tonic-gate case sRSAAuthentication: 789*0Sstevel@tonic-gate intptr = &options->rsa_authentication; 790*0Sstevel@tonic-gate goto parse_flag; 791*0Sstevel@tonic-gate 792*0Sstevel@tonic-gate case sPubkeyAuthentication: 793*0Sstevel@tonic-gate intptr = &options->pubkey_authentication; 794*0Sstevel@tonic-gate goto parse_flag; 795*0Sstevel@tonic-gate #ifdef GSSAPI 796*0Sstevel@tonic-gate case sGssAuthentication: 797*0Sstevel@tonic-gate intptr = &options->gss_authentication; 798*0Sstevel@tonic-gate goto parse_flag; 799*0Sstevel@tonic-gate case sGssKeyEx: 800*0Sstevel@tonic-gate intptr = &options->gss_keyex; 801*0Sstevel@tonic-gate goto parse_flag; 802*0Sstevel@tonic-gate case sGssStoreDelegCreds: 803*0Sstevel@tonic-gate intptr = &options->gss_keyex; 804*0Sstevel@tonic-gate goto parse_flag; 805*0Sstevel@tonic-gate #ifndef SUNW_GSSAPI 806*0Sstevel@tonic-gate case sGssUseSessionCredCache: 807*0Sstevel@tonic-gate intptr = &options->gss_use_session_ccache; 808*0Sstevel@tonic-gate goto parse_flag; 809*0Sstevel@tonic-gate case sGssCleanupCreds: 810*0Sstevel@tonic-gate intptr = &options->gss_cleanup_creds; 811*0Sstevel@tonic-gate goto parse_flag; 812*0Sstevel@tonic-gate #endif /* SUNW_GSSAPI */ 813*0Sstevel@tonic-gate #endif /* GSSAPI */ 814*0Sstevel@tonic-gate #if defined(KRB4) || defined(KRB5) 815*0Sstevel@tonic-gate case sKerberosAuthentication: 816*0Sstevel@tonic-gate intptr = &options->kerberos_authentication; 817*0Sstevel@tonic-gate goto parse_flag; 818*0Sstevel@tonic-gate 819*0Sstevel@tonic-gate case sKerberosOrLocalPasswd: 820*0Sstevel@tonic-gate intptr = &options->kerberos_or_local_passwd; 821*0Sstevel@tonic-gate goto parse_flag; 822*0Sstevel@tonic-gate 823*0Sstevel@tonic-gate case sKerberosTicketCleanup: 824*0Sstevel@tonic-gate intptr = &options->kerberos_ticket_cleanup; 825*0Sstevel@tonic-gate goto parse_flag; 826*0Sstevel@tonic-gate #endif 827*0Sstevel@tonic-gate #if defined(AFS) || defined(KRB5) 828*0Sstevel@tonic-gate case sKerberosTgtPassing: 829*0Sstevel@tonic-gate intptr = &options->kerberos_tgt_passing; 830*0Sstevel@tonic-gate goto parse_flag; 831*0Sstevel@tonic-gate #endif 832*0Sstevel@tonic-gate #ifdef AFS 833*0Sstevel@tonic-gate case sAFSTokenPassing: 834*0Sstevel@tonic-gate intptr = &options->afs_token_passing; 835*0Sstevel@tonic-gate goto parse_flag; 836*0Sstevel@tonic-gate #endif 837*0Sstevel@tonic-gate 838*0Sstevel@tonic-gate case sPasswordAuthentication: 839*0Sstevel@tonic-gate intptr = &options->password_authentication; 840*0Sstevel@tonic-gate goto parse_flag; 841*0Sstevel@tonic-gate 842*0Sstevel@tonic-gate case sKbdInteractiveAuthentication: 843*0Sstevel@tonic-gate intptr = &options->kbd_interactive_authentication; 844*0Sstevel@tonic-gate goto parse_flag; 845*0Sstevel@tonic-gate 846*0Sstevel@tonic-gate case sChallengeResponseAuthentication: 847*0Sstevel@tonic-gate intptr = &options->challenge_response_authentication; 848*0Sstevel@tonic-gate goto parse_flag; 849*0Sstevel@tonic-gate 850*0Sstevel@tonic-gate case sPrintMotd: 851*0Sstevel@tonic-gate intptr = &options->print_motd; 852*0Sstevel@tonic-gate goto parse_flag; 853*0Sstevel@tonic-gate 854*0Sstevel@tonic-gate case sPrintLastLog: 855*0Sstevel@tonic-gate intptr = &options->print_lastlog; 856*0Sstevel@tonic-gate goto parse_flag; 857*0Sstevel@tonic-gate 858*0Sstevel@tonic-gate case sX11Forwarding: 859*0Sstevel@tonic-gate intptr = &options->x11_forwarding; 860*0Sstevel@tonic-gate goto parse_flag; 861*0Sstevel@tonic-gate 862*0Sstevel@tonic-gate case sX11DisplayOffset: 863*0Sstevel@tonic-gate intptr = &options->x11_display_offset; 864*0Sstevel@tonic-gate goto parse_int; 865*0Sstevel@tonic-gate 866*0Sstevel@tonic-gate case sX11UseLocalhost: 867*0Sstevel@tonic-gate intptr = &options->x11_use_localhost; 868*0Sstevel@tonic-gate goto parse_flag; 869*0Sstevel@tonic-gate 870*0Sstevel@tonic-gate case sXAuthLocation: 871*0Sstevel@tonic-gate charptr = &options->xauth_location; 872*0Sstevel@tonic-gate goto parse_filename; 873*0Sstevel@tonic-gate 874*0Sstevel@tonic-gate case sStrictModes: 875*0Sstevel@tonic-gate intptr = &options->strict_modes; 876*0Sstevel@tonic-gate goto parse_flag; 877*0Sstevel@tonic-gate 878*0Sstevel@tonic-gate case sKeepAlives: 879*0Sstevel@tonic-gate intptr = &options->keepalives; 880*0Sstevel@tonic-gate goto parse_flag; 881*0Sstevel@tonic-gate 882*0Sstevel@tonic-gate case sEmptyPasswd: 883*0Sstevel@tonic-gate intptr = &options->permit_empty_passwd; 884*0Sstevel@tonic-gate goto parse_flag; 885*0Sstevel@tonic-gate 886*0Sstevel@tonic-gate case sPermitUserEnvironment: 887*0Sstevel@tonic-gate intptr = &options->permit_user_env; 888*0Sstevel@tonic-gate goto parse_flag; 889*0Sstevel@tonic-gate 890*0Sstevel@tonic-gate case sUseLogin: 891*0Sstevel@tonic-gate intptr = &options->use_login; 892*0Sstevel@tonic-gate goto parse_flag; 893*0Sstevel@tonic-gate 894*0Sstevel@tonic-gate case sCompression: 895*0Sstevel@tonic-gate intptr = &options->compression; 896*0Sstevel@tonic-gate goto parse_flag; 897*0Sstevel@tonic-gate 898*0Sstevel@tonic-gate case sGatewayPorts: 899*0Sstevel@tonic-gate intptr = &options->gateway_ports; 900*0Sstevel@tonic-gate goto parse_flag; 901*0Sstevel@tonic-gate 902*0Sstevel@tonic-gate case sVerifyReverseMapping: 903*0Sstevel@tonic-gate intptr = &options->verify_reverse_mapping; 904*0Sstevel@tonic-gate goto parse_flag; 905*0Sstevel@tonic-gate 906*0Sstevel@tonic-gate case sLogFacility: 907*0Sstevel@tonic-gate intptr = (int *) &options->log_facility; 908*0Sstevel@tonic-gate arg = strdelim(&cp); 909*0Sstevel@tonic-gate value = log_facility_number(arg); 910*0Sstevel@tonic-gate if (value == SYSLOG_FACILITY_NOT_SET) 911*0Sstevel@tonic-gate fatal("%.200s line %d: unsupported log facility '%s'", 912*0Sstevel@tonic-gate filename, linenum, arg ? arg : "<NONE>"); 913*0Sstevel@tonic-gate if (*intptr == -1) 914*0Sstevel@tonic-gate *intptr = (SyslogFacility) value; 915*0Sstevel@tonic-gate break; 916*0Sstevel@tonic-gate 917*0Sstevel@tonic-gate case sLogLevel: 918*0Sstevel@tonic-gate intptr = (int *) &options->log_level; 919*0Sstevel@tonic-gate arg = strdelim(&cp); 920*0Sstevel@tonic-gate value = log_level_number(arg); 921*0Sstevel@tonic-gate if (value == SYSLOG_LEVEL_NOT_SET) 922*0Sstevel@tonic-gate fatal("%.200s line %d: unsupported log level '%s'", 923*0Sstevel@tonic-gate filename, linenum, arg ? arg : "<NONE>"); 924*0Sstevel@tonic-gate if (*intptr == -1) 925*0Sstevel@tonic-gate *intptr = (LogLevel) value; 926*0Sstevel@tonic-gate break; 927*0Sstevel@tonic-gate 928*0Sstevel@tonic-gate case sAllowTcpForwarding: 929*0Sstevel@tonic-gate intptr = &options->allow_tcp_forwarding; 930*0Sstevel@tonic-gate goto parse_flag; 931*0Sstevel@tonic-gate 932*0Sstevel@tonic-gate case sUsePrivilegeSeparation: 933*0Sstevel@tonic-gate intptr = &use_privsep; 934*0Sstevel@tonic-gate goto parse_flag; 935*0Sstevel@tonic-gate 936*0Sstevel@tonic-gate case sAllowUsers: 937*0Sstevel@tonic-gate while (((arg = strdelim(&cp)) != NULL) && *arg != '\0') { 938*0Sstevel@tonic-gate if (options->num_allow_users >= MAX_ALLOW_USERS) 939*0Sstevel@tonic-gate fatal("%s line %d: too many allow users.", 940*0Sstevel@tonic-gate filename, linenum); 941*0Sstevel@tonic-gate options->allow_users[options->num_allow_users++] = 942*0Sstevel@tonic-gate xstrdup(arg); 943*0Sstevel@tonic-gate } 944*0Sstevel@tonic-gate break; 945*0Sstevel@tonic-gate 946*0Sstevel@tonic-gate case sDenyUsers: 947*0Sstevel@tonic-gate while (((arg = strdelim(&cp)) != NULL) && *arg != '\0') { 948*0Sstevel@tonic-gate if (options->num_deny_users >= MAX_DENY_USERS) 949*0Sstevel@tonic-gate fatal( "%s line %d: too many deny users.", 950*0Sstevel@tonic-gate filename, linenum); 951*0Sstevel@tonic-gate options->deny_users[options->num_deny_users++] = 952*0Sstevel@tonic-gate xstrdup(arg); 953*0Sstevel@tonic-gate } 954*0Sstevel@tonic-gate break; 955*0Sstevel@tonic-gate 956*0Sstevel@tonic-gate case sAllowGroups: 957*0Sstevel@tonic-gate while (((arg = strdelim(&cp)) != NULL) && *arg != '\0') { 958*0Sstevel@tonic-gate if (options->num_allow_groups >= MAX_ALLOW_GROUPS) 959*0Sstevel@tonic-gate fatal("%s line %d: too many allow groups.", 960*0Sstevel@tonic-gate filename, linenum); 961*0Sstevel@tonic-gate options->allow_groups[options->num_allow_groups++] = 962*0Sstevel@tonic-gate xstrdup(arg); 963*0Sstevel@tonic-gate } 964*0Sstevel@tonic-gate break; 965*0Sstevel@tonic-gate 966*0Sstevel@tonic-gate case sDenyGroups: 967*0Sstevel@tonic-gate while (((arg = strdelim(&cp)) != NULL) && *arg != '\0') { 968*0Sstevel@tonic-gate if (options->num_deny_groups >= MAX_DENY_GROUPS) 969*0Sstevel@tonic-gate fatal("%s line %d: too many deny groups.", 970*0Sstevel@tonic-gate filename, linenum); 971*0Sstevel@tonic-gate options->deny_groups[options->num_deny_groups++] = xstrdup(arg); 972*0Sstevel@tonic-gate } 973*0Sstevel@tonic-gate break; 974*0Sstevel@tonic-gate 975*0Sstevel@tonic-gate case sCiphers: 976*0Sstevel@tonic-gate arg = strdelim(&cp); 977*0Sstevel@tonic-gate if (!arg || *arg == '\0') 978*0Sstevel@tonic-gate fatal("%s line %d: Missing argument.", filename, linenum); 979*0Sstevel@tonic-gate if (!ciphers_valid(arg)) 980*0Sstevel@tonic-gate fatal("%s line %d: Bad SSH2 cipher spec '%s'.", 981*0Sstevel@tonic-gate filename, linenum, arg ? arg : "<NONE>"); 982*0Sstevel@tonic-gate if (options->ciphers == NULL) 983*0Sstevel@tonic-gate options->ciphers = xstrdup(arg); 984*0Sstevel@tonic-gate break; 985*0Sstevel@tonic-gate 986*0Sstevel@tonic-gate case sMacs: 987*0Sstevel@tonic-gate arg = strdelim(&cp); 988*0Sstevel@tonic-gate if (!arg || *arg == '\0') 989*0Sstevel@tonic-gate fatal("%s line %d: Missing argument.", filename, linenum); 990*0Sstevel@tonic-gate if (!mac_valid(arg)) 991*0Sstevel@tonic-gate fatal("%s line %d: Bad SSH2 mac spec '%s'.", 992*0Sstevel@tonic-gate filename, linenum, arg ? arg : "<NONE>"); 993*0Sstevel@tonic-gate if (options->macs == NULL) 994*0Sstevel@tonic-gate options->macs = xstrdup(arg); 995*0Sstevel@tonic-gate break; 996*0Sstevel@tonic-gate 997*0Sstevel@tonic-gate case sProtocol: 998*0Sstevel@tonic-gate intptr = &options->protocol; 999*0Sstevel@tonic-gate arg = strdelim(&cp); 1000*0Sstevel@tonic-gate if (!arg || *arg == '\0') 1001*0Sstevel@tonic-gate fatal("%s line %d: Missing argument.", filename, linenum); 1002*0Sstevel@tonic-gate value = proto_spec(arg); 1003*0Sstevel@tonic-gate if (value == SSH_PROTO_UNKNOWN) 1004*0Sstevel@tonic-gate fatal("%s line %d: Bad protocol spec '%s'.", 1005*0Sstevel@tonic-gate filename, linenum, arg ? arg : "<NONE>"); 1006*0Sstevel@tonic-gate if (*intptr == SSH_PROTO_UNKNOWN) 1007*0Sstevel@tonic-gate *intptr = value; 1008*0Sstevel@tonic-gate break; 1009*0Sstevel@tonic-gate 1010*0Sstevel@tonic-gate case sSubsystem: 1011*0Sstevel@tonic-gate if (options->num_subsystems >= MAX_SUBSYSTEMS) { 1012*0Sstevel@tonic-gate fatal("%s line %d: too many subsystems defined.", 1013*0Sstevel@tonic-gate filename, linenum); 1014*0Sstevel@tonic-gate } 1015*0Sstevel@tonic-gate arg = strdelim(&cp); 1016*0Sstevel@tonic-gate if (!arg || *arg == '\0') 1017*0Sstevel@tonic-gate fatal("%s line %d: Missing subsystem name.", 1018*0Sstevel@tonic-gate filename, linenum); 1019*0Sstevel@tonic-gate for (i = 0; i < options->num_subsystems; i++) 1020*0Sstevel@tonic-gate if (strcmp(arg, options->subsystem_name[i]) == 0) 1021*0Sstevel@tonic-gate fatal("%s line %d: Subsystem '%s' already defined.", 1022*0Sstevel@tonic-gate filename, linenum, arg); 1023*0Sstevel@tonic-gate options->subsystem_name[options->num_subsystems] = xstrdup(arg); 1024*0Sstevel@tonic-gate arg = strdelim(&cp); 1025*0Sstevel@tonic-gate if (!arg || *arg == '\0') 1026*0Sstevel@tonic-gate fatal("%s line %d: Missing subsystem command.", 1027*0Sstevel@tonic-gate filename, linenum); 1028*0Sstevel@tonic-gate options->subsystem_command[options->num_subsystems] = xstrdup(arg); 1029*0Sstevel@tonic-gate options->num_subsystems++; 1030*0Sstevel@tonic-gate break; 1031*0Sstevel@tonic-gate 1032*0Sstevel@tonic-gate case sMaxStartups: 1033*0Sstevel@tonic-gate arg = strdelim(&cp); 1034*0Sstevel@tonic-gate if (!arg || *arg == '\0') 1035*0Sstevel@tonic-gate fatal("%s line %d: Missing MaxStartups spec.", 1036*0Sstevel@tonic-gate filename, linenum); 1037*0Sstevel@tonic-gate if ((n = sscanf(arg, "%d:%d:%d", 1038*0Sstevel@tonic-gate &options->max_startups_begin, 1039*0Sstevel@tonic-gate &options->max_startups_rate, 1040*0Sstevel@tonic-gate &options->max_startups)) == 3) { 1041*0Sstevel@tonic-gate if (options->max_startups_begin > 1042*0Sstevel@tonic-gate options->max_startups || 1043*0Sstevel@tonic-gate options->max_startups_rate > 100 || 1044*0Sstevel@tonic-gate options->max_startups_rate < 1) 1045*0Sstevel@tonic-gate fatal("%s line %d: Illegal MaxStartups spec.", 1046*0Sstevel@tonic-gate filename, linenum); 1047*0Sstevel@tonic-gate } else if (n != 1) 1048*0Sstevel@tonic-gate fatal("%s line %d: Illegal MaxStartups spec.", 1049*0Sstevel@tonic-gate filename, linenum); 1050*0Sstevel@tonic-gate else 1051*0Sstevel@tonic-gate options->max_startups = options->max_startups_begin; 1052*0Sstevel@tonic-gate break; 1053*0Sstevel@tonic-gate 1054*0Sstevel@tonic-gate case sBanner: 1055*0Sstevel@tonic-gate charptr = &options->banner; 1056*0Sstevel@tonic-gate goto parse_filename; 1057*0Sstevel@tonic-gate /* 1058*0Sstevel@tonic-gate * These options can contain %X options expanded at 1059*0Sstevel@tonic-gate * connect time, so that you can specify paths like: 1060*0Sstevel@tonic-gate * 1061*0Sstevel@tonic-gate * AuthorizedKeysFile /etc/ssh_keys/%u 1062*0Sstevel@tonic-gate */ 1063*0Sstevel@tonic-gate case sAuthorizedKeysFile: 1064*0Sstevel@tonic-gate case sAuthorizedKeysFile2: 1065*0Sstevel@tonic-gate charptr = (opcode == sAuthorizedKeysFile ) ? 1066*0Sstevel@tonic-gate &options->authorized_keys_file : 1067*0Sstevel@tonic-gate &options->authorized_keys_file2; 1068*0Sstevel@tonic-gate goto parse_filename; 1069*0Sstevel@tonic-gate 1070*0Sstevel@tonic-gate case sClientAliveInterval: 1071*0Sstevel@tonic-gate intptr = &options->client_alive_interval; 1072*0Sstevel@tonic-gate goto parse_time; 1073*0Sstevel@tonic-gate 1074*0Sstevel@tonic-gate case sClientAliveCountMax: 1075*0Sstevel@tonic-gate intptr = &options->client_alive_count_max; 1076*0Sstevel@tonic-gate goto parse_int; 1077*0Sstevel@tonic-gate 1078*0Sstevel@tonic-gate case sMaxAuthTries: 1079*0Sstevel@tonic-gate intptr = &options->max_auth_tries; 1080*0Sstevel@tonic-gate goto parse_int; 1081*0Sstevel@tonic-gate 1082*0Sstevel@tonic-gate case sMaxAuthTriesLog: 1083*0Sstevel@tonic-gate intptr = &options->max_auth_tries_log; 1084*0Sstevel@tonic-gate goto parse_int; 1085*0Sstevel@tonic-gate 1086*0Sstevel@tonic-gate case sLookupClientHostnames: 1087*0Sstevel@tonic-gate intptr = &options->lookup_client_hostnames; 1088*0Sstevel@tonic-gate goto parse_flag; 1089*0Sstevel@tonic-gate 1090*0Sstevel@tonic-gate case sDeprecated: 1091*0Sstevel@tonic-gate log("%s line %d: Deprecated option %s", 1092*0Sstevel@tonic-gate filename, linenum, arg); 1093*0Sstevel@tonic-gate while (arg) 1094*0Sstevel@tonic-gate arg = strdelim(&cp); 1095*0Sstevel@tonic-gate break; 1096*0Sstevel@tonic-gate 1097*0Sstevel@tonic-gate default: 1098*0Sstevel@tonic-gate fatal("%s line %d: Missing handler for opcode %s (%d)", 1099*0Sstevel@tonic-gate filename, linenum, arg, opcode); 1100*0Sstevel@tonic-gate } 1101*0Sstevel@tonic-gate if ((arg = strdelim(&cp)) != NULL && *arg != '\0') 1102*0Sstevel@tonic-gate fatal("%s line %d: garbage at end of line; \"%.200s\".", 1103*0Sstevel@tonic-gate filename, linenum, arg); 1104*0Sstevel@tonic-gate return 0; 1105*0Sstevel@tonic-gate } 1106*0Sstevel@tonic-gate 1107*0Sstevel@tonic-gate /* Reads the server configuration file. */ 1108*0Sstevel@tonic-gate 1109*0Sstevel@tonic-gate void 1110*0Sstevel@tonic-gate read_server_config(ServerOptions *options, const char *filename) 1111*0Sstevel@tonic-gate { 1112*0Sstevel@tonic-gate int linenum, bad_options = 0; 1113*0Sstevel@tonic-gate char line[1024]; 1114*0Sstevel@tonic-gate FILE *f; 1115*0Sstevel@tonic-gate 1116*0Sstevel@tonic-gate f = fopen(filename, "r"); 1117*0Sstevel@tonic-gate if (!f) { 1118*0Sstevel@tonic-gate perror(filename); 1119*0Sstevel@tonic-gate exit(1); 1120*0Sstevel@tonic-gate } 1121*0Sstevel@tonic-gate linenum = 0; 1122*0Sstevel@tonic-gate while (fgets(line, sizeof(line), f)) { 1123*0Sstevel@tonic-gate /* Update line number counter. */ 1124*0Sstevel@tonic-gate linenum++; 1125*0Sstevel@tonic-gate if (process_server_config_line(options, line, filename, linenum) != 0) 1126*0Sstevel@tonic-gate bad_options++; 1127*0Sstevel@tonic-gate } 1128*0Sstevel@tonic-gate (void) fclose(f); 1129*0Sstevel@tonic-gate if (bad_options > 0) 1130*0Sstevel@tonic-gate fatal("%s: terminating, %d bad configuration options", 1131*0Sstevel@tonic-gate filename, bad_options); 1132*0Sstevel@tonic-gate } 1133