Repository navigation
wolfsshd: honor none keywords, refuse Match Group - #1348
Open
ejohnstown wants to merge 3 commits into
Open
ejohnstown wants to merge 3 commits into
ejohnstown wants to merge 3 commits into
Conversation
"AuthorizedKeysFile none" now turns off the authorized keys file, as in OpenSSH, instead of naming ~/none, a file the user controls. The value stays "none" through Match composition, and SearchForPubKey refuses it before resolving any path. - match "none" case-insensitively, as OpenSSH does - OpenSSH certificates still check against TrustedUserCAKeys - X.509 certificates do not fall back to CA-only under "none" - a "none" node passes the wolfSSH_TrustedSystemCAKeys startup gates - add sshd_authkeys_none_test.sh: key in ~/none, X.509 CA-only and system CA gate cases, each set globally and in a Match block Issue: F-15558
"ChrootDirectory none" now means no chroot, as in OpenSSH, instead of a relative chdir() target. The keyword still counts as set, so a Match block using it exempts a user from a global ChrootDirectory. - match "none" case-insensitively, as OpenSSH does - add sshd_chroot_none_test.sh: global and Match cases against an empty global chroot Issue: F-16811
Windows wolfsshd does not look up a user's groups, so a Match Group block could never apply and its restrictions were skipped. The config load now rejects a Group selector there, as it does other unsupported Match selectors. - WOLFSSHD_NO_MATCH_GROUP gates the rejection, set for _WIN32 - add sshd_match_group_win_test.ps1 to the Windows check workflow Issue: F-15559
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
AuthorizedKeysFile none and ChrootDirectory none now mean what they do
in OpenSSH, and Windows wolfsshd refuses Match Group, which it could
never apply.
~/none; X.509 does not fall back to CA-only under it
user from a global one
Issue: F-15558, F-16811, F-15559