21 #define MAX_ALLOW_USERS 256 22 #define MAX_DENY_USERS 256 23 #define MAX_ALLOW_GROUPS 256 24 #define MAX_DENY_GROUPS 256 25 #define MAX_SUBSYSTEMS 256 26 #define MAX_HOSTKEYS 256 27 #define MAX_HOSTCERTS 256 28 #define MAX_ACCEPT_ENV 256 29 #define MAX_MATCH_GROUPS 256 30 #define MAX_AUTHKEYS_FILES 256 31 #define MAX_AUTH_METHODS 256 34 #define PERMIT_NOT_SET -1 36 #define PERMIT_FORCED_ONLY 1 37 #define PERMIT_NO_PASSWD 2 43 #define PRIVSEP_NOSANDBOX 2 46 #define FORWARD_DENY 0 47 #define FORWARD_REMOTE (1) 48 #define FORWARD_LOCAL (1<<1) 49 #define FORWARD_ALLOW (FORWARD_REMOTE|FORWARD_LOCAL) 51 #define DEFAULT_AUTH_FAIL_MAX 6 52 #define DEFAULT_SESSIONS_MAX 10 55 #define INTERNAL_SFTP_NAME "internal-sftp" 59 u_int ports_from_cmdline;
61 u_int num_queued_listens;
62 char **queued_listen_addrs;
63 int *queued_listen_ports;
64 struct addrinfo *listen_addrs;
66 char *host_key_files[MAX_HOSTKEYS];
67 int num_host_key_files;
68 char *host_cert_files[MAX_HOSTCERTS];
69 int num_host_cert_files;
75 int key_regeneration_time;
76 int permit_root_login;
78 int ignore_user_known_hosts;
83 int x11_display_offset;
85 int x11_use_localhost;
91 int ip_qos_interactive;
97 struct ForwardOptions fwd_opts;
98 SyslogFacility log_facility;
100 int rhosts_rsa_authentication;
102 int hostbased_authentication;
103 int hostbased_uses_name_from_packet_only;
104 char *hostbased_key_types;
105 char *hostkeyalgorithms;
106 int rsa_authentication;
107 int pubkey_authentication;
108 char *pubkey_key_types;
109 int kerberos_authentication;
111 int kerberos_or_local_passwd;
116 int kerberos_ticket_cleanup;
119 int session_hooks_allow;
120 char* session_hooks_startup_cmd;
121 char* session_hooks_shutdown_cmd;
123 int kerberos_get_afs_token;
125 int gsi_allow_limited_proxy;
126 int gss_authentication;
129 int gss_cleanup_creds;
130 char* gss_creds_path;
131 int gss_strict_acceptor;
133 int password_authentication;
135 int kbd_interactive_authentication;
136 int challenge_response_authentication;
137 int permit_empty_passwd;
142 int allow_tcp_forwarding;
143 int allow_streamlocal_forwarding;
144 int allow_agent_forwarding;
145 u_int num_allow_users;
146 char *allow_users[MAX_ALLOW_USERS];
147 u_int num_deny_users;
148 char *deny_users[MAX_DENY_USERS];
149 u_int num_allow_groups;
150 char *allow_groups[MAX_ALLOW_GROUPS];
151 u_int num_deny_groups;
152 char *deny_groups[MAX_DENY_GROUPS];
154 u_int num_subsystems;
155 char *subsystem_name[MAX_SUBSYSTEMS];
156 char *subsystem_command[MAX_SUBSYSTEMS];
157 char *subsystem_args[MAX_SUBSYSTEMS];
159 u_int num_accept_env;
160 char *accept_env[MAX_ACCEPT_ENV];
162 int max_startups_begin;
163 int max_startups_rate;
169 int client_alive_interval;
173 int client_alive_count_max;
179 u_int num_authkeys_files;
180 char *authorized_keys_files[MAX_AUTHKEYS_FILES];
182 char *adm_forced_command;
185 int tcp_rcv_buf_poll;
186 int permit_pam_user_change;
193 int disable_multithreaded;
197 int num_permitted_opens;
199 char *chroot_directory;
201 int disable_usage_stats;
202 char *usage_stats_targets;
204 char *revoked_keys_file;
205 char *trusted_user_ca_keys;
206 char *authorized_keys_command;
207 char *authorized_keys_command_user;
208 char *authorized_principals_file;
209 char *authorized_principals_command;
210 char *authorized_principals_command_user;
215 char *version_addendum;
217 u_int num_auth_methods;
218 char *auth_methods[MAX_AUTH_METHODS];
220 int fingerprint_hash;
224 struct connection_info {
228 const char *laddress;
242 #define COPY_MATCH_STRING_OPTS() do { \ 243 M_CP_STROPT(banner); \ 244 M_CP_STROPT(trusted_user_ca_keys); \ 245 M_CP_STROPT(revoked_keys_file); \ 246 M_CP_STROPT(authorized_keys_command); \ 247 M_CP_STROPT(authorized_keys_command_user); \ 248 M_CP_STROPT(authorized_principals_file); \ 249 M_CP_STROPT(authorized_principals_command); \ 250 M_CP_STROPT(authorized_principals_command_user); \ 251 M_CP_STROPT(hostbased_key_types); \ 252 M_CP_STROPT(pubkey_key_types); \ 253 M_CP_STRARRAYOPT(authorized_keys_files, num_authkeys_files); \ 254 M_CP_STRARRAYOPT(allow_users, num_allow_users); \ 255 M_CP_STRARRAYOPT(deny_users, num_deny_users); \ 256 M_CP_STRARRAYOPT(allow_groups, num_allow_groups); \ 257 M_CP_STRARRAYOPT(deny_groups, num_deny_groups); \ 258 M_CP_STRARRAYOPT(accept_env, num_accept_env); \ 259 M_CP_STRARRAYOPT(auth_methods, num_auth_methods); \ 262 struct connection_info *get_connection_info(
int,
int);
263 void initialize_server_options(ServerOptions *);
264 void fill_default_server_options(ServerOptions *);
265 int process_server_config_line(ServerOptions *,
char *,
const char *,
int,
266 int *,
struct connection_info *);
267 void load_server_config(
const char *, Buffer *);
268 void parse_server_config(ServerOptions *,
const char *, Buffer *,
269 struct connection_info *);
270 void parse_server_match_config(ServerOptions *,
struct connection_info *);
271 int parse_server_match_testspec(
struct connection_info *,
char *);
272 int server_match_spec_complete(
struct connection_info *);
273 void copy_set_server_options(ServerOptions *, ServerOptions *,
int);
274 void dump_config(ServerOptions *);
275 char *derelativise_path(
const char *);