Bug 35904 - OpenSSH ports (both) appear to ignore limits in /etc/login.conf unless UseLogin is set
Summary: OpenSSH ports (both) appear to ignore limits in /etc/login.conf unless UseLog...
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: Normal Affects Only Me
Assignee: Dirk Meyer
Depends on:
Reported: 2002-03-14 23:10 UTC by John-David Childs
Modified: 2002-03-17 20:25 UTC (History)
0 users

See Also:


Note You need to log in before you can comment on or make changes to this bug.
Description John-David Childs 2002-03-14 23:10:02 UTC
The openssh 3.1p1_1 (portable) and openssh-3.1_3 ports do not examine /etc/login.conf for restrictions such as ttys.{allow,deny}, unless UseLogin is set on in /etc/ssh/sshd_config.  This directive has been exploited in the past, and is now turned off by default.


These lines from the native SSH session.c (/usr/src/crypto/openssh/session.c) seem to be the key!

        if (!auth_ttyok(lc, s->tty)) {
                (void)printf("Permission denied.\n");
               "LOGIN %.200s REFUSED (TTY) FROM %.200s ON TTY %.200s",
                    pw->pw_name, get_remote_name_or_ip(utmp_len,
                        options.reverse_mapping_check), s->tty);
#endif /* HAVE_LOGIN_CAP */
How-To-Repeat: Set up a class with a tty restriction.  Created user in that class, and verified with "pw usershow <username> -P".  Installed "non-portable" (aka native) OpenSSH port. Killed existing sshd and started OpenSSH "/usr/local/sbin/sshd -f /etc/ssh/sshd_config".  Attempted SSH into box, and logged in successfully.  Rinse. Lather. Repeat with OpenSSH portable.  Finally, tried with "native" SSHD (no changes to /etc/ssh/sshd_config) and it worked.
Comment 1 Pete Fritchman freebsd_committer 2002-03-16 05:48:00 UTC
Responsible Changed
From-To: freebsd-ports->dinoex

Over to maintainer
Comment 2 Dirk Meyer freebsd_committer 2002-03-17 20:24:59 UTC
State Changed
From-To: open->closed

Changes have been committed, Thanks for pointing out.