Changeset 1739 for trunk

Timestamp:

Nov 20, 2010, 9:15:16 PM (14 years ago)

Author:

mitchb

Message:

Eliminate spurious opsnssh error messages related to public keys

If the following conditions apply:
  o Someone attempt to authenticate to an account with an ssh key
  o The account has an authorized_keys file
  o Entries in authorized_keys have restrictions (i.e. "from=" clauses)
  o The attempted key matches the type (RSA/DSA) of the restricted key(s)
  o The attempted key is not actually one of the authorized keys

You will get a spurious error message that claims:
  "Authentication tried for _____ with correct key but not from a
   permitted host (host=______, ip=________)."
even though there is no correct key involved.

This is OpenSSH bug 1765 (https://bugzilla.mindrot.org/show_bug.cgi?id=1765)
and the patch is backported from the one committed in that ticket
(https://bugzilla.mindrot.org/attachment.cgi?id=1848).

Location:

trunk/server

Files:

• common/patches/openssh-no-spurious-correct-key-incorrect-host-messages.patch (added)
• fedora/specs/openssh.spec.patch (modified) (2 diffs)

trunk/server/fedora/specs/openssh.spec.patch

@@ -10 +10 @@
  #URL1: http://pamsshagentauth.sourceforge.net
  #Source0: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz
-@@ -88,6 +88,7 @@
+@@ -88,6 +88,8 @@
  Source3: sshd.init
  Source4: http://prdownloads.sourceforge.net/pamsshagentauth/pam_ssh_agent_auth/pam_ssh_agent_auth-%{pam_ssh_agent_ver}.tar.bz2
  Source5: pam_ssh_agent-rmheaders
 +Patch1001: openssh-4.7p1-gssapi-name-in-env.patch
++Patch1002: openssh-no-spurious-correct-key-incorrect-host-messages.patch
  Patch0: openssh-5.4p1-redhat.patch
  Patch2: openssh-5.3p1-skip-initial.patch
  Patch4: openssh-5.2p1-vendor.patch
-@@ -175,6 +177,7 @@
+@@ -175,6 +178,7 @@
  Requires(post): chkconfig >= 0.9, /sbin/service
  Requires(pre): /usr/sbin/useradd
@@ -26 +27 @@
  %package askpass
  Summary: A passphrase dialog for OpenSSH and X
-@@ -267,6 +270,8 @@
+@@ -267,6 +271,9 @@
  %patch75 -p1 -b .dso
  %patch76 -p1 -b .bz595935
  
 +%patch1001 -p1 -b .gssapi-env
++%patch1002 -p1 -b .no-spurious-correct-key-incorrect-host-messages
 +
  autoreconf