Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also .

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also .
base repository: openssh/openssh-portable
base: master
Choose a base ref
...
head repository: Feandil/openssh-portable
compare: master
Choose a head ref
Checking mergeability… Don’t worry, you can still create the pull request.
  • 17 commits
  • 16 files changed
  • 2 contributors

Commits on Jul 1, 2016

  1. Store details about successful auth methods

    @Feandil
    Feandil committed Jul 1, 2016
    6247715

  2. Export auth_details to child env as SSH_USER_AUTH

    @Feandil
    Feandil committed Jul 1, 2016
    a59b4fd

  3. Expose auth_details to pam via "SSH_USER_AUTH" 

    Whenever the pam device is called, update the "SSH_USER_AUTH" PAM
environment variable (Doing it outside this module exposes us to a NULL
sshpam_handle).

When a session will be later created, this variable, still part of the
PAM environment variable will be copied to the child environment before
being overriden by the latest value stored in auth_details. As a result,
using the same variable name as the final one is key to prevent the
final environment to be poluted with an outdated value.
    @Feandil
    Feandil committed Jul 1, 2016
    62fd706

  4. Extract pubkey_format from pubkey_auth_info

    @Feandil
    Feandil committed Jul 1, 2016
    5e40cf5

  5. auth2-pubkey: fill last_details on success

    @Feandil
    Feandil committed Jul 1, 2016
    c7919e8

  6. auth2-hostbased: fill last_details on success

    @Feandil
    Feandil committed Jul 1, 2016
    c0c71f6

  7. privsep: Expose success auth methods 

    Unfortunately, in the monitor thread, not the same amount of data is
available when an key-base authentication succeed. It could be possible
to extract the key information of all key that pass through
mm_answer_keyverify, but linking it to the authentication success would
be dangerous.

Simply exposing the successul methods would already be a progress
    @Feandil
    Feandil committed Jul 1, 2016
    f11882e

  8. Mention SSH_USER_AUTH in the man page

    @Feandil
    Feandil committed Jul 1, 2016
    2dbc57b

  9. Fix memory leak in pubkey_auth_info 

    Bug introduced by c087cdf
    @Feandil
    Feandil committed Jul 1, 2016
    b1f2fcf

  10. Move pubkey_format@auth.h to sshkey_format_oneline@sshkey.h

    @Feandil
    Feandil committed Jul 1, 2016
    c680cf6

  11. Privsep: expose detailed information for sshkey auth

    @Feandil
    Feandil committed Jul 1, 2016
    23bbff3

  12. New function: ssh_gssapi_get_displayname

    @Feandil
    Feandil committed Jul 1, 2016
    4183a77

  13. Expose displayname for gssapi logins

    @Feandil
    Feandil committed Jul 1, 2016
    0a4901c

  14. Always clean last_details, even for authentication failures 

    last_details is supposed to be only filled on authentication success, but may
be incorrectly filled in the future. This patch make sure that this field is
cleaned even on authentication failures to make sure than even incorrect
authentication modules cannot polute the SSH_USER_AUTH string for another
module
    @Feandil
    Feandil committed Jul 1, 2016
    6c40d1b

  15. Add ExposeAuthenticationMethods configuration option

    @Feandil
    Feandil committed Jul 1, 2016
    3f269a6

  16. Allow ExposeAuthenticationMethods to be used in 'Match' blocks

    @Feandil
    Feandil committed Jul 1, 2016
    69dac0f

  17. ExposeAuthenticationMethods: change default to 'never'

    @Feandil
    Feandil committed Jul 1, 2016
    886735d