[contrib/caldera/openssh.spec] make ssh-agent setgid nobody

- (bal) Fix bug id 383 and only call loginrestrict for AIX if not root.

ChangeLog

@@ -1,3 +1,12 @@
+20021015
+ - (bal) Fix bug id 383 and only call loginrestrict for AIX if not root.
+ - (bal) More advanced strsep test by Darren Tucker <[email protected]>
+ - (tim) [contrib/caldera/openssh.spec] make ssh-agent setgid nobody
+
+20021004
+ - (bal) Disable post-authentication Privsep for OSF/1.  It conflicts with
+   SIA.
+
 20021003
  - (djm) OpenBSD CVS Sync
    - [email protected] 2002/10/01 20:34:12
@@ -7,6 +16,7 @@
      [version.h]
      OpenSSH 3.5
  - (djm) Bump RPM spec version numbers
+ - (djm) Bug #406 s/msg_send/ssh_msh_send/ for Mac OS X 1.2
 
 20020930
  - (djm) Tidy contrib/, add Makefile for GNOME passphrase dialogs, 
@@ -756,4 +766,4 @@
      save auth method before monitor_reset_key_state(); bugzilla bug #284;
      ok provos@
 
-$Id: ChangeLog,v 1.2491 2002/10/03 01:56:58 djm Exp $
+$Id: ChangeLog,v 1.2491.2.5 2002/10/16 00:40:23 tim Exp $

auth.c

@@ -202,7 +202,13 @@ allowed_user(struct passwd * pw)
 	}
 
 #ifdef WITH_AIXAUTHENTICATE
-	if (loginrestrictions(pw->pw_name, S_RLOGIN, NULL, &loginmsg) != 0) {
+	/*
+	 * Don't check loginrestrictions() for root account (use
+	 * PermitRootLogin to control logins via ssh), or if running as
+	 * non-root user (since loginrestrictions will always fail).
+	 */
+	if ( (pw->pw_uid != 0) && (geteuid() == 0) &&
+	    loginrestrictions(pw->pw_name, S_RLOGIN, NULL, &loginmsg) != 0) {
 		if (loginmsg && *loginmsg) {
 			/* Remove embedded newlines (if any) */
 			char *p;

configure.ac

@@ -1,4 +1,4 @@
-# $Id: configure.ac,v 1.89 2002/09/26 00:38:47 tim Exp $
+# $Id: configure.ac,v 1.89.2.2 2002/10/16 00:25:40 mouring Exp $
 
 AC_INIT
 AC_CONFIG_SRCDIR([ssh.c])
@@ -330,6 +330,7 @@ mips-sony-bsd|mips-sony-newsos4)
 			AC_MSG_RESULT(no)
 		fi
 	fi
+	AC_DEFINE(DISABLE_FD_PASSING)
 	;;
 
 *-*-nto-qnx)
@@ -604,9 +605,12 @@ AC_CHECK_FUNCS(arc4random b64_ntop bcopy bindresvport_sa \
 	realpath recvmsg rresvport_af sendmsg setdtablesize setegid \
 	setenv seteuid setgroups setlogin setproctitle setresgid setreuid \
 	setrlimit setsid setpcred setvbuf sigaction sigvec snprintf \
-	socketpair strerror strlcat strlcpy strmode strsep sysconf tcgetpgrp \
+	socketpair strerror strlcat strlcpy strmode sysconf tcgetpgrp \
 	truncate utimes vhangup vsnprintf waitpid __b64_ntop _getpty)
 
+dnl Make sure strsep prototype is defined before defining HAVE_STRSEP
+AC_CHECK_DECL(strsep, [AC_CHECK_FUNCS(strsep)])
+
 dnl IRIX and Solaris 2.5.1 have dirname() in libgen
 AC_CHECK_FUNCS(dirname, [AC_CHECK_HEADERS(libgen.h)] ,[
 	AC_CHECK_LIB(gen, dirname,[

contrib/caldera/openssh.spec

@@ -316,7 +316,14 @@ fi
 %defattr(-,root,root)
 %dir %{_sysconfdir}
 %config %{_sysconfdir}/ssh_config
-%{_bindir}/*
+%{_bindir}/scp
+%{_bindir}/sftp
+%{_bindir}/ssh
+%{_bindir}/slogin
+%{_bindir}/ssh-add
+%attr(2755,root,nobody) %{_bindir}/ssh-agent
+%{_bindir}/ssh-keygen
+%{_bindir}/ssh-keyscan
 %dir %{_libexecdir}
 %{_sbindir}/ssh-host-keygen
 %dir %{_defaultdocdir}/%{name}-%{version}
@@ -331,7 +338,7 @@ fi
  
 %Files server
 %defattr(-,root,root)
-%dir %attr(0700,root,root) %{_var}/empty/sshd
+%dir %{_var}/empty/sshd
 %config %{SVIdir}/sshd
 %config /etc/pam.d/sshd
 %config %{_sysconfdir}/moduli
@@ -353,4 +360,4 @@ fi
 * Mon Jan 01 1998 ...
 Template Version: 1.31
 
-$Id: openssh.spec,v 1.38 2002/10/03 01:56:59 djm Exp $
+$Id: openssh.spec,v 1.38.2.1 2002/10/16 00:40:25 tim Exp $

msg.c

@@ -31,43 +31,43 @@ RCSID("$OpenBSD: msg.c,v 1.4 2002/07/01 16:15:25 deraadt Exp $");
 #include "msg.h"
 
 void
-msg_send(int fd, u_char type, Buffer *m)
+ssh_msg_send(int fd, u_char type, Buffer *m)
 {
 	u_char buf[5];
 	u_int mlen = buffer_len(m);
 
-	debug3("msg_send: type %u", (unsigned int)type & 0xff);
+	debug3("ssh_msg_send: type %u", (unsigned int)type & 0xff);
 
 	PUT_32BIT(buf, mlen + 1);
 	buf[4] = type;		/* 1st byte of payload is mesg-type */
 	if (atomicio(write, fd, buf, sizeof(buf)) != sizeof(buf))
-		fatal("msg_send: write");
+		fatal("ssh_msg_send: write");
 	if (atomicio(write, fd, buffer_ptr(m), mlen) != mlen)
-		fatal("msg_send: write");
+		fatal("ssh_msg_send: write");
 }
 
 int
-msg_recv(int fd, Buffer *m)
+ssh_msg_recv(int fd, Buffer *m)
 {
 	u_char buf[4];
 	ssize_t res;
 	u_int msg_len;
 
-	debug3("msg_recv entering");
+	debug3("ssh_msg_recv entering");
 
 	res = atomicio(read, fd, buf, sizeof(buf));
 	if (res != sizeof(buf)) {
 		if (res == 0)
 			return -1;
-		fatal("msg_recv: read: header %ld", (long)res);
+		fatal("ssh_msg_recv: read: header %ld", (long)res);
 	}
 	msg_len = GET_32BIT(buf);
 	if (msg_len > 256 * 1024)
-		fatal("msg_recv: read: bad msg_len %u", msg_len);
+		fatal("ssh_msg_recv: read: bad msg_len %u", msg_len);
 	buffer_clear(m);
 	buffer_append_space(m, msg_len);
 	res = atomicio(read, fd, buffer_ptr(m), msg_len);
 	if (res != msg_len)
-		fatal("msg_recv: read: %ld != msg_len", (long)res);
+		fatal("ssh_msg_recv: read: %ld != msg_len", (long)res);
 	return 0;
 }

msg.h

@@ -25,7 +25,7 @@
 #ifndef SSH_MSG_H
 #define SSH_MSG_H
 
-void	 msg_send(int, u_char, Buffer *);
-int	 msg_recv(int, Buffer *);
+void	 ssh_msg_send(int, u_char, Buffer *);
+int	 ssh_msg_recv(int, Buffer *);
 
 #endif

ssh-keysign.c

@@ -206,8 +206,8 @@ main(int argc, char **argv)
 		fatal("no hostkey found");
 
 	buffer_init(&b);
-	if (msg_recv(STDIN_FILENO, &b) < 0)
-		fatal("msg_recv failed");
+	if (ssh_msg_recv(STDIN_FILENO, &b) < 0)
+		fatal("ssh_msg_recv failed");
 	if (buffer_get_char(&b) != version)
 		fatal("bad version");
 	fd = buffer_get_int(&b);
@@ -239,7 +239,7 @@ main(int argc, char **argv)
 	/* send reply */
 	buffer_clear(&b);
 	buffer_put_string(&b, signature, slen);
-	msg_send(STDOUT_FILENO, version, &b);
+	ssh_msg_send(STDOUT_FILENO, version, &b);
 
 	return (0);
 }

sshconnect2.c

@@ -947,9 +947,9 @@ ssh_keysign(Key *key, u_char **sigp, u_int *lenp,
 	buffer_init(&b);
 	buffer_put_int(&b, packet_get_connection_in()); /* send # of socket */
 	buffer_put_string(&b, data, datalen);
-	msg_send(to[1], version, &b);
+	ssh_msg_send(to[1], version, &b);
 
-	if (msg_recv(from[0], &b) < 0) {
+	if (ssh_msg_recv(from[0], &b) < 0) {
 		error("ssh_keysign: no reply");
 		buffer_clear(&b);
 		return -1;