blob: d1205a81f6ca3602406cd15b93b36ce0d77959cb [file] [log] [blame]
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001/*
Damien Miller95def091999-11-25 00:26:21 +11002 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
3 * All rights reserved
Damien Miller4af51302000-04-16 11:18:38 +10004 *
Damien Millere4340be2000-09-16 13:29:08 +11005 * As far as I am concerned, the code I have written for this software
6 * can be used freely for any purpose. Any derived versions of this
7 * software must be clearly marked as such, and if the derived work is
8 * incompatible with the protocol description in the RFC file, it must be
9 * called by a name other than "ssh" or "Secure Shell".
Damien Miller95def091999-11-25 00:26:21 +110010 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +100011
12#include "includes.h"
Ben Lindstrom1bf11f62001-06-09 01:48:01 +000013RCSID("$OpenBSD: servconf.c,v 1.83 2001/06/08 15:25:40 markus Exp $");
Ben Lindstrom226cfa02001-01-22 05:34:40 +000014
15#ifdef KRB4
16#include <krb.h>
17#endif
18#ifdef AFS
19#include <kafs.h>
20#endif
Damien Millerd4a8b7e1999-10-27 13:42:43 +100021
22#include "ssh.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000023#include "log.h"
Damien Millerd4a8b7e1999-10-27 13:42:43 +100024#include "servconf.h"
25#include "xmalloc.h"
Damien Miller78928792000-04-12 20:17:38 +100026#include "compat.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000027#include "pathnames.h"
28#include "tildexpand.h"
29#include "misc.h"
30#include "cipher.h"
Ben Lindstrom06b33aa2001-02-15 03:01:59 +000031#include "kex.h"
32#include "mac.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000033
Ben Lindstrom19066a12001-04-12 23:39:26 +000034void add_listen_addr(ServerOptions *options, char *addr, u_short port);
Ben Lindstromc510af42001-04-07 17:25:48 +000035void add_one_listen_addr(ServerOptions *options, char *addr, u_short port);
Damien Miller34132e52000-01-14 15:45:46 +110036
Ben Lindstrom226cfa02001-01-22 05:34:40 +000037/* AF_UNSPEC or AF_INET or AF_INET6 */
38extern int IPv4or6;
39
Damien Millerd4a8b7e1999-10-27 13:42:43 +100040/* Initializes the server options to their default values. */
41
Damien Miller4af51302000-04-16 11:18:38 +100042void
Damien Miller95def091999-11-25 00:26:21 +110043initialize_server_options(ServerOptions *options)
Damien Millerd4a8b7e1999-10-27 13:42:43 +100044{
Damien Miller95def091999-11-25 00:26:21 +110045 memset(options, 0, sizeof(*options));
Damien Miller34132e52000-01-14 15:45:46 +110046 options->num_ports = 0;
47 options->ports_from_cmdline = 0;
48 options->listen_addrs = NULL;
Damien Miller0bc1bd82000-11-13 22:57:25 +110049 options->num_host_key_files = 0;
Damien Miller6f83b8e2000-05-02 09:23:45 +100050 options->pid_file = NULL;
Damien Miller95def091999-11-25 00:26:21 +110051 options->server_key_bits = -1;
52 options->login_grace_time = -1;
53 options->key_regeneration_time = -1;
Ben Lindstromd8a90212001-02-15 03:08:27 +000054 options->permit_root_login = PERMIT_NOT_SET;
Damien Miller95def091999-11-25 00:26:21 +110055 options->ignore_rhosts = -1;
56 options->ignore_user_known_hosts = -1;
57 options->print_motd = -1;
Ben Lindstrom7bfff362001-03-26 05:45:53 +000058 options->print_lastlog = -1;
Damien Miller95def091999-11-25 00:26:21 +110059 options->check_mail = -1;
60 options->x11_forwarding = -1;
61 options->x11_display_offset = -1;
Damien Millerd3a18572000-06-07 19:55:44 +100062 options->xauth_location = NULL;
Damien Miller95def091999-11-25 00:26:21 +110063 options->strict_modes = -1;
64 options->keepalives = -1;
65 options->log_facility = (SyslogFacility) - 1;
66 options->log_level = (LogLevel) - 1;
67 options->rhosts_authentication = -1;
68 options->rhosts_rsa_authentication = -1;
Ben Lindstrom5eabda32001-04-12 23:34:34 +000069 options->hostbased_authentication = -1;
70 options->hostbased_uses_name_from_packet_only = -1;
Damien Miller95def091999-11-25 00:26:21 +110071 options->rsa_authentication = -1;
Damien Miller0bc1bd82000-11-13 22:57:25 +110072 options->pubkey_authentication = -1;
Damien Millerd4a8b7e1999-10-27 13:42:43 +100073#ifdef KRB4
Damien Miller95def091999-11-25 00:26:21 +110074 options->kerberos_authentication = -1;
75 options->kerberos_or_local_passwd = -1;
76 options->kerberos_ticket_cleanup = -1;
Damien Millerd4a8b7e1999-10-27 13:42:43 +100077#endif
78#ifdef AFS
Damien Miller95def091999-11-25 00:26:21 +110079 options->kerberos_tgt_passing = -1;
80 options->afs_token_passing = -1;
Damien Millerd4a8b7e1999-10-27 13:42:43 +100081#endif
Damien Miller95def091999-11-25 00:26:21 +110082 options->password_authentication = -1;
Damien Miller874d77b2000-10-14 16:23:11 +110083 options->kbd_interactive_authentication = -1;
Ben Lindstrom551ea372001-06-05 18:56:16 +000084 options->challenge_response_authentication = -1;
Damien Miller95def091999-11-25 00:26:21 +110085 options->permit_empty_passwd = -1;
86 options->use_login = -1;
Damien Miller50a41ed2000-10-16 12:14:42 +110087 options->allow_tcp_forwarding = -1;
Damien Miller95def091999-11-25 00:26:21 +110088 options->num_allow_users = 0;
89 options->num_deny_users = 0;
90 options->num_allow_groups = 0;
91 options->num_deny_groups = 0;
Damien Miller78928792000-04-12 20:17:38 +100092 options->ciphers = NULL;
Ben Lindstrom06b33aa2001-02-15 03:01:59 +000093 options->macs = NULL;
Damien Miller78928792000-04-12 20:17:38 +100094 options->protocol = SSH_PROTO_UNKNOWN;
Damien Millere247cc42000-05-07 12:03:14 +100095 options->gateway_ports = -1;
Damien Millerf6d9e222000-06-18 14:50:44 +100096 options->num_subsystems = 0;
Damien Miller942da032000-08-18 13:59:06 +100097 options->max_startups_begin = -1;
98 options->max_startups_rate = -1;
Damien Miller37023962000-07-11 17:31:38 +100099 options->max_startups = -1;
Ben Lindstrom48bd7c12001-01-09 00:35:42 +0000100 options->banner = NULL;
Damien Miller33804262001-02-04 23:20:18 +1100101 options->reverse_mapping_check = -1;
Ben Lindstrom5744dc42001-04-13 23:28:01 +0000102 options->client_alive_interval = -1;
103 options->client_alive_count_max = -1;
Ben Lindstrombfb3a0e2001-06-05 20:25:05 +0000104 options->authorized_keys_file = NULL;
105 options->authorized_keys_file2 = NULL;
Damien Millerf8154422001-04-25 22:44:14 +1000106 options->pam_authentication_via_kbd_int = -1;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000107}
108
Damien Miller4af51302000-04-16 11:18:38 +1000109void
Damien Miller95def091999-11-25 00:26:21 +1100110fill_default_server_options(ServerOptions *options)
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000111{
Damien Miller0bc1bd82000-11-13 22:57:25 +1100112 if (options->protocol == SSH_PROTO_UNKNOWN)
113 options->protocol = SSH_PROTO_1|SSH_PROTO_2;
114 if (options->num_host_key_files == 0) {
115 /* fill default hostkeys for protocols */
116 if (options->protocol & SSH_PROTO_1)
Ben Lindstrom226cfa02001-01-22 05:34:40 +0000117 options->host_key_files[options->num_host_key_files++] = _PATH_HOST_KEY_FILE;
Damien Miller0bc1bd82000-11-13 22:57:25 +1100118 if (options->protocol & SSH_PROTO_2)
Ben Lindstrom226cfa02001-01-22 05:34:40 +0000119 options->host_key_files[options->num_host_key_files++] = _PATH_HOST_DSA_KEY_FILE;
Damien Miller0bc1bd82000-11-13 22:57:25 +1100120 }
Damien Miller34132e52000-01-14 15:45:46 +1100121 if (options->num_ports == 0)
122 options->ports[options->num_ports++] = SSH_DEFAULT_PORT;
123 if (options->listen_addrs == NULL)
Ben Lindstrom19066a12001-04-12 23:39:26 +0000124 add_listen_addr(options, NULL, 0);
Damien Miller6f83b8e2000-05-02 09:23:45 +1000125 if (options->pid_file == NULL)
Ben Lindstrom226cfa02001-01-22 05:34:40 +0000126 options->pid_file = _PATH_SSH_DAEMON_PID_FILE;
Damien Miller95def091999-11-25 00:26:21 +1100127 if (options->server_key_bits == -1)
128 options->server_key_bits = 768;
129 if (options->login_grace_time == -1)
130 options->login_grace_time = 600;
131 if (options->key_regeneration_time == -1)
132 options->key_regeneration_time = 3600;
Ben Lindstromd8a90212001-02-15 03:08:27 +0000133 if (options->permit_root_login == PERMIT_NOT_SET)
134 options->permit_root_login = PERMIT_YES;
Damien Miller95def091999-11-25 00:26:21 +1100135 if (options->ignore_rhosts == -1)
Damien Miller98c7ad62000-03-09 21:27:49 +1100136 options->ignore_rhosts = 1;
Damien Miller95def091999-11-25 00:26:21 +1100137 if (options->ignore_user_known_hosts == -1)
138 options->ignore_user_known_hosts = 0;
139 if (options->check_mail == -1)
140 options->check_mail = 0;
141 if (options->print_motd == -1)
142 options->print_motd = 1;
Ben Lindstrom7bfff362001-03-26 05:45:53 +0000143 if (options->print_lastlog == -1)
144 options->print_lastlog = 1;
Damien Miller95def091999-11-25 00:26:21 +1100145 if (options->x11_forwarding == -1)
Damien Miller98c7ad62000-03-09 21:27:49 +1100146 options->x11_forwarding = 0;
Damien Miller95def091999-11-25 00:26:21 +1100147 if (options->x11_display_offset == -1)
Damien Miller98c7ad62000-03-09 21:27:49 +1100148 options->x11_display_offset = 10;
Ben Lindstrom1bf11f62001-06-09 01:48:01 +0000149#ifdef _PATH_XAUTH
Damien Millerd3a18572000-06-07 19:55:44 +1000150 if (options->xauth_location == NULL)
Ben Lindstrom1bf11f62001-06-09 01:48:01 +0000151 options->xauth_location = _PATH_XAUTH;
152#endif
Damien Miller95def091999-11-25 00:26:21 +1100153 if (options->strict_modes == -1)
154 options->strict_modes = 1;
155 if (options->keepalives == -1)
156 options->keepalives = 1;
157 if (options->log_facility == (SyslogFacility) (-1))
158 options->log_facility = SYSLOG_FACILITY_AUTH;
159 if (options->log_level == (LogLevel) (-1))
Ben Lindstromdb65e8f2001-01-19 04:26:52 +0000160 options->log_level = SYSLOG_LEVEL_INFO;
Damien Miller95def091999-11-25 00:26:21 +1100161 if (options->rhosts_authentication == -1)
162 options->rhosts_authentication = 0;
163 if (options->rhosts_rsa_authentication == -1)
Damien Miller98c7ad62000-03-09 21:27:49 +1100164 options->rhosts_rsa_authentication = 0;
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000165 if (options->hostbased_authentication == -1)
166 options->hostbased_authentication = 0;
167 if (options->hostbased_uses_name_from_packet_only == -1)
168 options->hostbased_uses_name_from_packet_only = 0;
Damien Miller95def091999-11-25 00:26:21 +1100169 if (options->rsa_authentication == -1)
170 options->rsa_authentication = 1;
Damien Miller0bc1bd82000-11-13 22:57:25 +1100171 if (options->pubkey_authentication == -1)
172 options->pubkey_authentication = 1;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000173#ifdef KRB4
Damien Miller95def091999-11-25 00:26:21 +1100174 if (options->kerberos_authentication == -1)
175 options->kerberos_authentication = (access(KEYFILE, R_OK) == 0);
176 if (options->kerberos_or_local_passwd == -1)
177 options->kerberos_or_local_passwd = 1;
178 if (options->kerberos_ticket_cleanup == -1)
179 options->kerberos_ticket_cleanup = 1;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000180#endif /* KRB4 */
181#ifdef AFS
Damien Miller95def091999-11-25 00:26:21 +1100182 if (options->kerberos_tgt_passing == -1)
183 options->kerberos_tgt_passing = 0;
184 if (options->afs_token_passing == -1)
185 options->afs_token_passing = k_hasafs();
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000186#endif /* AFS */
Damien Miller95def091999-11-25 00:26:21 +1100187 if (options->password_authentication == -1)
188 options->password_authentication = 1;
Damien Miller874d77b2000-10-14 16:23:11 +1100189 if (options->kbd_interactive_authentication == -1)
190 options->kbd_interactive_authentication = 0;
Ben Lindstrom551ea372001-06-05 18:56:16 +0000191 if (options->challenge_response_authentication == -1)
192 options->challenge_response_authentication = 1;
Damien Miller95def091999-11-25 00:26:21 +1100193 if (options->permit_empty_passwd == -1)
Damien Miller98c7ad62000-03-09 21:27:49 +1100194 options->permit_empty_passwd = 0;
Damien Miller95def091999-11-25 00:26:21 +1100195 if (options->use_login == -1)
196 options->use_login = 0;
Damien Miller50a41ed2000-10-16 12:14:42 +1100197 if (options->allow_tcp_forwarding == -1)
198 options->allow_tcp_forwarding = 1;
Damien Millere247cc42000-05-07 12:03:14 +1000199 if (options->gateway_ports == -1)
200 options->gateway_ports = 0;
Damien Miller37023962000-07-11 17:31:38 +1000201 if (options->max_startups == -1)
202 options->max_startups = 10;
Damien Miller942da032000-08-18 13:59:06 +1000203 if (options->max_startups_rate == -1)
204 options->max_startups_rate = 100; /* 100% */
205 if (options->max_startups_begin == -1)
206 options->max_startups_begin = options->max_startups;
Damien Miller33804262001-02-04 23:20:18 +1100207 if (options->reverse_mapping_check == -1)
208 options->reverse_mapping_check = 0;
Ben Lindstrom5744dc42001-04-13 23:28:01 +0000209 if (options->client_alive_interval == -1)
210 options->client_alive_interval = 0;
211 if (options->client_alive_count_max == -1)
212 options->client_alive_count_max = 3;
Ben Lindstrombfb3a0e2001-06-05 20:25:05 +0000213 if (options->authorized_keys_file == NULL)
214 options->authorized_keys_file = _PATH_SSH_USER_PERMITTED_KEYS;
215 if (options->authorized_keys_file2 == NULL)
216 options->authorized_keys_file2 = _PATH_SSH_USER_PERMITTED_KEYS2;
Damien Millerf8154422001-04-25 22:44:14 +1000217 if (options->pam_authentication_via_kbd_int == -1)
218 options->pam_authentication_via_kbd_int = 0;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000219}
220
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000221/* Keyword tokens. */
Damien Miller95def091999-11-25 00:26:21 +1100222typedef enum {
223 sBadOption, /* == unknown option */
224 sPort, sHostKeyFile, sServerKeyBits, sLoginGraceTime, sKeyRegenerationTime,
225 sPermitRootLogin, sLogFacility, sLogLevel,
226 sRhostsAuthentication, sRhostsRSAAuthentication, sRSAAuthentication,
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000227#ifdef KRB4
Damien Miller95def091999-11-25 00:26:21 +1100228 sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup,
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000229#endif
230#ifdef AFS
Damien Miller95def091999-11-25 00:26:21 +1100231 sKerberosTgtPassing, sAFSTokenPassing,
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000232#endif
Ben Lindstrom95fb2dd2001-01-23 03:12:10 +0000233 sChallengeResponseAuthentication,
Damien Miller874d77b2000-10-14 16:23:11 +1100234 sPasswordAuthentication, sKbdInteractiveAuthentication, sListenAddress,
Ben Lindstrom7bfff362001-03-26 05:45:53 +0000235 sPrintMotd, sPrintLastLog, sIgnoreRhosts,
236 sX11Forwarding, sX11DisplayOffset,
Ben Lindstromd9cae222001-03-05 07:42:03 +0000237 sStrictModes, sEmptyPasswd, sKeepAlives, sCheckMail,
Damien Miller50a41ed2000-10-16 12:14:42 +1100238 sUseLogin, sAllowTcpForwarding,
239 sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups,
Ben Lindstrom06b33aa2001-02-15 03:01:59 +0000240 sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile,
Damien Miller0bc1bd82000-11-13 22:57:25 +1100241 sGatewayPorts, sPubkeyAuthentication, sXAuthLocation, sSubsystem, sMaxStartups,
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000242 sBanner, sReverseMappingCheck, sHostbasedAuthentication,
Ben Lindstrom5744dc42001-04-13 23:28:01 +0000243 sHostbasedUsesNameFromPacketOnly, sClientAliveInterval,
Ben Lindstrombfb3a0e2001-06-05 20:25:05 +0000244 sClientAliveCountMax, sAuthorizedKeysFile, sAuthorizedKeysFile2,
245 sPAMAuthenticationViaKbdInt
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000246} ServerOpCodes;
247
248/* Textual representation of the tokens. */
Damien Miller95def091999-11-25 00:26:21 +1100249static struct {
250 const char *name;
251 ServerOpCodes opcode;
252} keywords[] = {
253 { "port", sPort },
254 { "hostkey", sHostKeyFile },
Damien Miller0bc1bd82000-11-13 22:57:25 +1100255 { "hostdsakey", sHostKeyFile }, /* alias */
Kevin Stevesef4eea92001-02-05 12:42:17 +0000256 { "pidfile", sPidFile },
Damien Miller95def091999-11-25 00:26:21 +1100257 { "serverkeybits", sServerKeyBits },
258 { "logingracetime", sLoginGraceTime },
259 { "keyregenerationinterval", sKeyRegenerationTime },
260 { "permitrootlogin", sPermitRootLogin },
261 { "syslogfacility", sLogFacility },
262 { "loglevel", sLogLevel },
263 { "rhostsauthentication", sRhostsAuthentication },
264 { "rhostsrsaauthentication", sRhostsRSAAuthentication },
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000265 { "hostbasedauthentication", sHostbasedAuthentication },
266 { "hostbasedusesnamefrompacketonly", sHostbasedUsesNameFromPacketOnly },
Damien Miller95def091999-11-25 00:26:21 +1100267 { "rsaauthentication", sRSAAuthentication },
Damien Miller0bc1bd82000-11-13 22:57:25 +1100268 { "pubkeyauthentication", sPubkeyAuthentication },
269 { "dsaauthentication", sPubkeyAuthentication }, /* alias */
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000270#ifdef KRB4
Damien Miller95def091999-11-25 00:26:21 +1100271 { "kerberosauthentication", sKerberosAuthentication },
272 { "kerberosorlocalpasswd", sKerberosOrLocalPasswd },
273 { "kerberosticketcleanup", sKerberosTicketCleanup },
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000274#endif
275#ifdef AFS
Damien Miller95def091999-11-25 00:26:21 +1100276 { "kerberostgtpassing", sKerberosTgtPassing },
277 { "afstokenpassing", sAFSTokenPassing },
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000278#endif
Damien Miller95def091999-11-25 00:26:21 +1100279 { "passwordauthentication", sPasswordAuthentication },
Damien Miller874d77b2000-10-14 16:23:11 +1100280 { "kbdinteractiveauthentication", sKbdInteractiveAuthentication },
Ben Lindstrom95fb2dd2001-01-23 03:12:10 +0000281 { "challengeresponseauthentication", sChallengeResponseAuthentication },
282 { "skeyauthentication", sChallengeResponseAuthentication }, /* alias */
Damien Miller95def091999-11-25 00:26:21 +1100283 { "checkmail", sCheckMail },
284 { "listenaddress", sListenAddress },
285 { "printmotd", sPrintMotd },
Ben Lindstrom7bfff362001-03-26 05:45:53 +0000286 { "printlastlog", sPrintLastLog },
Damien Miller95def091999-11-25 00:26:21 +1100287 { "ignorerhosts", sIgnoreRhosts },
288 { "ignoreuserknownhosts", sIgnoreUserKnownHosts },
289 { "x11forwarding", sX11Forwarding },
290 { "x11displayoffset", sX11DisplayOffset },
Damien Millerd3a18572000-06-07 19:55:44 +1000291 { "xauthlocation", sXAuthLocation },
Damien Miller95def091999-11-25 00:26:21 +1100292 { "strictmodes", sStrictModes },
293 { "permitemptypasswords", sEmptyPasswd },
294 { "uselogin", sUseLogin },
Damien Miller95def091999-11-25 00:26:21 +1100295 { "keepalive", sKeepAlives },
Damien Miller50a41ed2000-10-16 12:14:42 +1100296 { "allowtcpforwarding", sAllowTcpForwarding },
Damien Miller95def091999-11-25 00:26:21 +1100297 { "allowusers", sAllowUsers },
298 { "denyusers", sDenyUsers },
299 { "allowgroups", sAllowGroups },
300 { "denygroups", sDenyGroups },
Damien Miller78928792000-04-12 20:17:38 +1000301 { "ciphers", sCiphers },
Ben Lindstrom06b33aa2001-02-15 03:01:59 +0000302 { "macs", sMacs },
Damien Miller78928792000-04-12 20:17:38 +1000303 { "protocol", sProtocol },
Damien Millere247cc42000-05-07 12:03:14 +1000304 { "gatewayports", sGatewayPorts },
Damien Millerf6d9e222000-06-18 14:50:44 +1000305 { "subsystem", sSubsystem },
Damien Miller37023962000-07-11 17:31:38 +1000306 { "maxstartups", sMaxStartups },
Ben Lindstrom48bd7c12001-01-09 00:35:42 +0000307 { "banner", sBanner },
Damien Miller33804262001-02-04 23:20:18 +1100308 { "reversemappingcheck", sReverseMappingCheck },
Ben Lindstrom5744dc42001-04-13 23:28:01 +0000309 { "clientaliveinterval", sClientAliveInterval },
310 { "clientalivecountmax", sClientAliveCountMax },
Ben Lindstrombfb3a0e2001-06-05 20:25:05 +0000311 { "authorizedkeysfile", sAuthorizedKeysFile },
312 { "authorizedkeysfile2", sAuthorizedKeysFile2 },
Damien Millerf8154422001-04-25 22:44:14 +1000313 { "PAMAuthenticationViaKbdInt", sPAMAuthenticationViaKbdInt },
Damien Miller95def091999-11-25 00:26:21 +1100314 { NULL, 0 }
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000315};
316
Damien Miller5428f641999-11-25 11:54:57 +1100317/*
Ben Lindstrom3704c262001-04-02 18:20:03 +0000318 * Returns the number of the token pointed to by cp or sBadOption.
Damien Miller5428f641999-11-25 11:54:57 +1100319 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000320
Damien Miller4af51302000-04-16 11:18:38 +1000321static ServerOpCodes
Damien Miller95def091999-11-25 00:26:21 +1100322parse_token(const char *cp, const char *filename,
323 int linenum)
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000324{
Ben Lindstrom46c16222000-12-22 01:43:59 +0000325 u_int i;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000326
Damien Miller95def091999-11-25 00:26:21 +1100327 for (i = 0; keywords[i].name; i++)
Damien Miller5428f641999-11-25 11:54:57 +1100328 if (strcasecmp(cp, keywords[i].name) == 0)
Damien Miller95def091999-11-25 00:26:21 +1100329 return keywords[i].opcode;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000330
Ben Lindstromb5cdc662001-04-16 02:13:26 +0000331 error("%s: line %d: Bad configuration option: %s",
332 filename, linenum, cp);
Damien Miller95def091999-11-25 00:26:21 +1100333 return sBadOption;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000334}
335
Damien Miller4af51302000-04-16 11:18:38 +1000336void
Ben Lindstrom19066a12001-04-12 23:39:26 +0000337add_listen_addr(ServerOptions *options, char *addr, u_short port)
Damien Miller34132e52000-01-14 15:45:46 +1100338{
Damien Miller34132e52000-01-14 15:45:46 +1100339 int i;
340
341 if (options->num_ports == 0)
342 options->ports[options->num_ports++] = SSH_DEFAULT_PORT;
Ben Lindstrom19066a12001-04-12 23:39:26 +0000343 if (port == 0)
Ben Lindstromc510af42001-04-07 17:25:48 +0000344 for (i = 0; i < options->num_ports; i++)
345 add_one_listen_addr(options, addr, options->ports[i]);
346 else
Ben Lindstrom19066a12001-04-12 23:39:26 +0000347 add_one_listen_addr(options, addr, port);
Ben Lindstromc510af42001-04-07 17:25:48 +0000348}
349
350void
351add_one_listen_addr(ServerOptions *options, char *addr, u_short port)
352{
353 struct addrinfo hints, *ai, *aitop;
354 char strport[NI_MAXSERV];
355 int gaierr;
356
357 memset(&hints, 0, sizeof(hints));
358 hints.ai_family = IPv4or6;
359 hints.ai_socktype = SOCK_STREAM;
360 hints.ai_flags = (addr == NULL) ? AI_PASSIVE : 0;
361 snprintf(strport, sizeof strport, "%d", port);
362 if ((gaierr = getaddrinfo(addr, strport, &hints, &aitop)) != 0)
363 fatal("bad addr or host: %s (%s)",
364 addr ? addr : "<NULL>",
365 gai_strerror(gaierr));
366 for (ai = aitop; ai->ai_next; ai = ai->ai_next)
367 ;
368 ai->ai_next = options->listen_addrs;
369 options->listen_addrs = aitop;
Damien Miller34132e52000-01-14 15:45:46 +1100370}
371
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000372/* Reads the server configuration file. */
373
Damien Miller4af51302000-04-16 11:18:38 +1000374void
Damien Miller95def091999-11-25 00:26:21 +1100375read_server_config(ServerOptions *options, const char *filename)
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000376{
Damien Miller95def091999-11-25 00:26:21 +1100377 FILE *f;
378 char line[1024];
Ben Lindstromc510af42001-04-07 17:25:48 +0000379 char *cp, **charptr, *arg, *p;
Damien Miller95def091999-11-25 00:26:21 +1100380 int linenum, *intptr, value;
381 int bad_options = 0;
382 ServerOpCodes opcode;
Damien Millerf6d9e222000-06-18 14:50:44 +1000383 int i;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000384
Damien Miller95def091999-11-25 00:26:21 +1100385 f = fopen(filename, "r");
386 if (!f) {
387 perror(filename);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000388 exit(1);
Damien Miller95def091999-11-25 00:26:21 +1100389 }
390 linenum = 0;
391 while (fgets(line, sizeof(line), f)) {
392 linenum++;
Damien Millerbe484b52000-07-15 14:14:16 +1000393 cp = line;
394 arg = strdelim(&cp);
395 /* Ignore leading whitespace */
396 if (*arg == '\0')
397 arg = strdelim(&cp);
Ben Lindstrom226cfa02001-01-22 05:34:40 +0000398 if (!arg || !*arg || *arg == '#')
Damien Miller95def091999-11-25 00:26:21 +1100399 continue;
Damien Miller0bc1bd82000-11-13 22:57:25 +1100400 intptr = NULL;
401 charptr = NULL;
Damien Miller37023962000-07-11 17:31:38 +1000402 opcode = parse_token(arg, filename, linenum);
Damien Miller95def091999-11-25 00:26:21 +1100403 switch (opcode) {
404 case sBadOption:
405 bad_options++;
406 continue;
407 case sPort:
Damien Miller34132e52000-01-14 15:45:46 +1100408 /* ignore ports from configfile if cmdline specifies ports */
409 if (options->ports_from_cmdline)
410 continue;
411 if (options->listen_addrs != NULL)
412 fatal("%s line %d: ports must be specified before "
Ben Lindstroma6218b82001-05-03 22:39:11 +0000413 "ListenAdress.", filename, linenum);
Damien Miller34132e52000-01-14 15:45:46 +1100414 if (options->num_ports >= MAX_PORTS)
Ben Lindstrom6df8ef42001-03-05 07:47:23 +0000415 fatal("%s line %d: too many ports.",
Damien Miller4af51302000-04-16 11:18:38 +1000416 filename, linenum);
Damien Millerbe484b52000-07-15 14:14:16 +1000417 arg = strdelim(&cp);
Damien Miller37023962000-07-11 17:31:38 +1000418 if (!arg || *arg == '\0')
Ben Lindstrom6df8ef42001-03-05 07:47:23 +0000419 fatal("%s line %d: missing port number.",
Damien Miller34132e52000-01-14 15:45:46 +1100420 filename, linenum);
Ben Lindstrom19066a12001-04-12 23:39:26 +0000421 options->ports[options->num_ports++] = a2port(arg);
422 if (options->ports[options->num_ports-1] == 0)
423 fatal("%s line %d: Badly formatted port number.",
424 filename, linenum);
Damien Miller34132e52000-01-14 15:45:46 +1100425 break;
426
427 case sServerKeyBits:
428 intptr = &options->server_key_bits;
Damien Miller95def091999-11-25 00:26:21 +1100429parse_int:
Damien Millerbe484b52000-07-15 14:14:16 +1000430 arg = strdelim(&cp);
Ben Lindstromb5cdc662001-04-16 02:13:26 +0000431 if (!arg || *arg == '\0')
432 fatal("%s line %d: missing integer value.",
433 filename, linenum);
Damien Miller37023962000-07-11 17:31:38 +1000434 value = atoi(arg);
Damien Miller95def091999-11-25 00:26:21 +1100435 if (*intptr == -1)
436 *intptr = value;
437 break;
Damien Miller32265091999-11-12 11:33:04 +1100438
Damien Miller95def091999-11-25 00:26:21 +1100439 case sLoginGraceTime:
440 intptr = &options->login_grace_time;
Ben Lindstrom1bda4c82001-06-05 19:59:08 +0000441parse_time:
442 arg = strdelim(&cp);
443 if (!arg || *arg == '\0')
444 fatal("%s line %d: missing time value.",
445 filename, linenum);
446 if ((value = convtime(arg)) == -1)
447 fatal("%s line %d: invalid time value.",
448 filename, linenum);
449 if (*intptr == -1)
450 *intptr = value;
451 break;
Damien Miller95def091999-11-25 00:26:21 +1100452
453 case sKeyRegenerationTime:
454 intptr = &options->key_regeneration_time;
Ben Lindstrom1bda4c82001-06-05 19:59:08 +0000455 goto parse_time;
Damien Miller95def091999-11-25 00:26:21 +1100456
457 case sListenAddress:
Damien Millerbe484b52000-07-15 14:14:16 +1000458 arg = strdelim(&cp);
Ben Lindstromc510af42001-04-07 17:25:48 +0000459 if (!arg || *arg == '\0' || strncmp(arg, "[]", 2) == 0)
Ben Lindstrom6df8ef42001-03-05 07:47:23 +0000460 fatal("%s line %d: missing inet addr.",
Damien Miller34132e52000-01-14 15:45:46 +1100461 filename, linenum);
Ben Lindstromc510af42001-04-07 17:25:48 +0000462 if (*arg == '[') {
463 if ((p = strchr(arg, ']')) == NULL)
464 fatal("%s line %d: bad ipv6 inet addr usage.",
465 filename, linenum);
466 arg++;
467 memmove(p, p+1, strlen(p+1)+1);
468 } else if (((p = strchr(arg, ':')) == NULL) ||
469 (strchr(p+1, ':') != NULL)) {
Ben Lindstrom19066a12001-04-12 23:39:26 +0000470 add_listen_addr(options, arg, 0);
Ben Lindstromc510af42001-04-07 17:25:48 +0000471 break;
472 }
473 if (*p == ':') {
Ben Lindstrom19066a12001-04-12 23:39:26 +0000474 u_short port;
475
Ben Lindstromc510af42001-04-07 17:25:48 +0000476 p++;
477 if (*p == '\0')
478 fatal("%s line %d: bad inet addr:port usage.",
479 filename, linenum);
480 else {
481 *(p-1) = '\0';
Ben Lindstrom19066a12001-04-12 23:39:26 +0000482 if ((port = a2port(p)) == 0)
483 fatal("%s line %d: bad port number.",
484 filename, linenum);
485 add_listen_addr(options, arg, port);
Ben Lindstromc510af42001-04-07 17:25:48 +0000486 }
487 } else if (*p == '\0')
Ben Lindstrom19066a12001-04-12 23:39:26 +0000488 add_listen_addr(options, arg, 0);
Ben Lindstromc510af42001-04-07 17:25:48 +0000489 else
490 fatal("%s line %d: bad inet addr usage.",
491 filename, linenum);
Damien Miller95def091999-11-25 00:26:21 +1100492 break;
493
494 case sHostKeyFile:
Damien Miller0bc1bd82000-11-13 22:57:25 +1100495 intptr = &options->num_host_key_files;
Ben Lindstromb5cdc662001-04-16 02:13:26 +0000496 if (*intptr >= MAX_HOSTKEYS)
497 fatal("%s line %d: too many host keys specified (max %d).",
Damien Miller0bc1bd82000-11-13 22:57:25 +1100498 filename, linenum, MAX_HOSTKEYS);
Damien Miller0bc1bd82000-11-13 22:57:25 +1100499 charptr = &options->host_key_files[*intptr];
Damien Millerd3a18572000-06-07 19:55:44 +1000500parse_filename:
Damien Millerbe484b52000-07-15 14:14:16 +1000501 arg = strdelim(&cp);
Ben Lindstromb5cdc662001-04-16 02:13:26 +0000502 if (!arg || *arg == '\0')
503 fatal("%s line %d: missing file name.",
Damien Miller6f83b8e2000-05-02 09:23:45 +1000504 filename, linenum);
Damien Miller0bc1bd82000-11-13 22:57:25 +1100505 if (*charptr == NULL) {
Damien Miller37023962000-07-11 17:31:38 +1000506 *charptr = tilde_expand_filename(arg, getuid());
Damien Miller0bc1bd82000-11-13 22:57:25 +1100507 /* increase optional counter */
508 if (intptr != NULL)
509 *intptr = *intptr + 1;
510 }
Damien Miller6f83b8e2000-05-02 09:23:45 +1000511 break;
512
513 case sPidFile:
514 charptr = &options->pid_file;
Damien Millerd3a18572000-06-07 19:55:44 +1000515 goto parse_filename;
Damien Miller95def091999-11-25 00:26:21 +1100516
Damien Miller95def091999-11-25 00:26:21 +1100517 case sPermitRootLogin:
518 intptr = &options->permit_root_login;
Damien Millerbe484b52000-07-15 14:14:16 +1000519 arg = strdelim(&cp);
Ben Lindstromb5cdc662001-04-16 02:13:26 +0000520 if (!arg || *arg == '\0')
521 fatal("%s line %d: missing yes/"
Ben Lindstrom35f1f4e2001-03-06 01:02:41 +0000522 "without-password/forced-commands-only/no "
Ben Lindstromb5cdc662001-04-16 02:13:26 +0000523 "argument.", filename, linenum);
524 value = 0; /* silence compiler */
Damien Miller37023962000-07-11 17:31:38 +1000525 if (strcmp(arg, "without-password") == 0)
Ben Lindstromd8a90212001-02-15 03:08:27 +0000526 value = PERMIT_NO_PASSWD;
527 else if (strcmp(arg, "forced-commands-only") == 0)
528 value = PERMIT_FORCED_ONLY;
Damien Miller37023962000-07-11 17:31:38 +1000529 else if (strcmp(arg, "yes") == 0)
Ben Lindstromd8a90212001-02-15 03:08:27 +0000530 value = PERMIT_YES;
Damien Miller37023962000-07-11 17:31:38 +1000531 else if (strcmp(arg, "no") == 0)
Ben Lindstromd8a90212001-02-15 03:08:27 +0000532 value = PERMIT_NO;
Ben Lindstromb5cdc662001-04-16 02:13:26 +0000533 else
534 fatal("%s line %d: Bad yes/"
Ben Lindstromd8a90212001-02-15 03:08:27 +0000535 "without-password/forced-commands-only/no "
Ben Lindstromb5cdc662001-04-16 02:13:26 +0000536 "argument: %s", filename, linenum, arg);
Damien Miller95def091999-11-25 00:26:21 +1100537 if (*intptr == -1)
538 *intptr = value;
539 break;
540
541 case sIgnoreRhosts:
542 intptr = &options->ignore_rhosts;
543parse_flag:
Damien Millerbe484b52000-07-15 14:14:16 +1000544 arg = strdelim(&cp);
Ben Lindstromb5cdc662001-04-16 02:13:26 +0000545 if (!arg || *arg == '\0')
546 fatal("%s line %d: missing yes/no argument.",
547 filename, linenum);
548 value = 0; /* silence compiler */
Damien Miller37023962000-07-11 17:31:38 +1000549 if (strcmp(arg, "yes") == 0)
Damien Miller95def091999-11-25 00:26:21 +1100550 value = 1;
Damien Miller37023962000-07-11 17:31:38 +1000551 else if (strcmp(arg, "no") == 0)
Damien Miller95def091999-11-25 00:26:21 +1100552 value = 0;
Ben Lindstromb5cdc662001-04-16 02:13:26 +0000553 else
554 fatal("%s line %d: Bad yes/no argument: %s",
Damien Miller37023962000-07-11 17:31:38 +1000555 filename, linenum, arg);
Damien Miller95def091999-11-25 00:26:21 +1100556 if (*intptr == -1)
557 *intptr = value;
558 break;
559
560 case sIgnoreUserKnownHosts:
561 intptr = &options->ignore_user_known_hosts;
Damien Miller98c7ad62000-03-09 21:27:49 +1100562 goto parse_flag;
Damien Miller95def091999-11-25 00:26:21 +1100563
564 case sRhostsAuthentication:
565 intptr = &options->rhosts_authentication;
566 goto parse_flag;
567
568 case sRhostsRSAAuthentication:
569 intptr = &options->rhosts_rsa_authentication;
570 goto parse_flag;
571
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000572 case sHostbasedAuthentication:
573 intptr = &options->hostbased_authentication;
574 goto parse_flag;
575
576 case sHostbasedUsesNameFromPacketOnly:
577 intptr = &options->hostbased_uses_name_from_packet_only;
578 goto parse_flag;
579
Damien Miller95def091999-11-25 00:26:21 +1100580 case sRSAAuthentication:
581 intptr = &options->rsa_authentication;
582 goto parse_flag;
583
Damien Miller0bc1bd82000-11-13 22:57:25 +1100584 case sPubkeyAuthentication:
585 intptr = &options->pubkey_authentication;
Damien Millere247cc42000-05-07 12:03:14 +1000586 goto parse_flag;
587
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000588#ifdef KRB4
Damien Miller95def091999-11-25 00:26:21 +1100589 case sKerberosAuthentication:
590 intptr = &options->kerberos_authentication;
591 goto parse_flag;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000592
Damien Miller95def091999-11-25 00:26:21 +1100593 case sKerberosOrLocalPasswd:
594 intptr = &options->kerberos_or_local_passwd;
595 goto parse_flag;
596
597 case sKerberosTicketCleanup:
598 intptr = &options->kerberos_ticket_cleanup;
599 goto parse_flag;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000600#endif
Damien Miller95def091999-11-25 00:26:21 +1100601
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000602#ifdef AFS
Damien Miller95def091999-11-25 00:26:21 +1100603 case sKerberosTgtPassing:
604 intptr = &options->kerberos_tgt_passing;
605 goto parse_flag;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000606
Damien Miller95def091999-11-25 00:26:21 +1100607 case sAFSTokenPassing:
608 intptr = &options->afs_token_passing;
609 goto parse_flag;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000610#endif
611
Damien Miller95def091999-11-25 00:26:21 +1100612 case sPasswordAuthentication:
613 intptr = &options->password_authentication;
614 goto parse_flag;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000615
Damien Miller874d77b2000-10-14 16:23:11 +1100616 case sKbdInteractiveAuthentication:
617 intptr = &options->kbd_interactive_authentication;
618 goto parse_flag;
619
Damien Miller95def091999-11-25 00:26:21 +1100620 case sCheckMail:
621 intptr = &options->check_mail;
622 goto parse_flag;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000623
Ben Lindstrom95fb2dd2001-01-23 03:12:10 +0000624 case sChallengeResponseAuthentication:
Ben Lindstrom551ea372001-06-05 18:56:16 +0000625 intptr = &options->challenge_response_authentication;
Damien Miller95def091999-11-25 00:26:21 +1100626 goto parse_flag;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000627
Damien Miller95def091999-11-25 00:26:21 +1100628 case sPrintMotd:
629 intptr = &options->print_motd;
630 goto parse_flag;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000631
Ben Lindstrom7bfff362001-03-26 05:45:53 +0000632 case sPrintLastLog:
633 intptr = &options->print_lastlog;
634 goto parse_flag;
635
Damien Miller95def091999-11-25 00:26:21 +1100636 case sX11Forwarding:
637 intptr = &options->x11_forwarding;
638 goto parse_flag;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000639
Damien Miller95def091999-11-25 00:26:21 +1100640 case sX11DisplayOffset:
641 intptr = &options->x11_display_offset;
642 goto parse_int;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000643
Damien Millerd3a18572000-06-07 19:55:44 +1000644 case sXAuthLocation:
645 charptr = &options->xauth_location;
646 goto parse_filename;
Kevin Stevesef4eea92001-02-05 12:42:17 +0000647
Damien Miller95def091999-11-25 00:26:21 +1100648 case sStrictModes:
649 intptr = &options->strict_modes;
650 goto parse_flag;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000651
Damien Miller95def091999-11-25 00:26:21 +1100652 case sKeepAlives:
653 intptr = &options->keepalives;
654 goto parse_flag;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000655
Damien Miller95def091999-11-25 00:26:21 +1100656 case sEmptyPasswd:
657 intptr = &options->permit_empty_passwd;
658 goto parse_flag;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000659
Damien Miller95def091999-11-25 00:26:21 +1100660 case sUseLogin:
661 intptr = &options->use_login;
662 goto parse_flag;
Damien Miller5ce662a1999-11-11 17:57:39 +1100663
Damien Millere247cc42000-05-07 12:03:14 +1000664 case sGatewayPorts:
665 intptr = &options->gateway_ports;
666 goto parse_flag;
667
Damien Miller33804262001-02-04 23:20:18 +1100668 case sReverseMappingCheck:
669 intptr = &options->reverse_mapping_check;
670 goto parse_flag;
671
Damien Miller95def091999-11-25 00:26:21 +1100672 case sLogFacility:
673 intptr = (int *) &options->log_facility;
Damien Millerbe484b52000-07-15 14:14:16 +1000674 arg = strdelim(&cp);
Damien Miller37023962000-07-11 17:31:38 +1000675 value = log_facility_number(arg);
Damien Miller95def091999-11-25 00:26:21 +1100676 if (value == (SyslogFacility) - 1)
Ben Lindstrom6df8ef42001-03-05 07:47:23 +0000677 fatal("%.200s line %d: unsupported log facility '%s'",
Damien Miller37023962000-07-11 17:31:38 +1000678 filename, linenum, arg ? arg : "<NONE>");
Damien Miller95def091999-11-25 00:26:21 +1100679 if (*intptr == -1)
680 *intptr = (SyslogFacility) value;
681 break;
682
683 case sLogLevel:
684 intptr = (int *) &options->log_level;
Damien Millerbe484b52000-07-15 14:14:16 +1000685 arg = strdelim(&cp);
Damien Miller37023962000-07-11 17:31:38 +1000686 value = log_level_number(arg);
Damien Miller95def091999-11-25 00:26:21 +1100687 if (value == (LogLevel) - 1)
Ben Lindstrom6df8ef42001-03-05 07:47:23 +0000688 fatal("%.200s line %d: unsupported log level '%s'",
Damien Miller37023962000-07-11 17:31:38 +1000689 filename, linenum, arg ? arg : "<NONE>");
Damien Miller95def091999-11-25 00:26:21 +1100690 if (*intptr == -1)
691 *intptr = (LogLevel) value;
692 break;
693
Damien Miller50a41ed2000-10-16 12:14:42 +1100694 case sAllowTcpForwarding:
695 intptr = &options->allow_tcp_forwarding;
696 goto parse_flag;
697
Damien Miller95def091999-11-25 00:26:21 +1100698 case sAllowUsers:
Damien Millerbe484b52000-07-15 14:14:16 +1000699 while ((arg = strdelim(&cp)) && *arg != '\0') {
Damien Miller78928792000-04-12 20:17:38 +1000700 if (options->num_allow_users >= MAX_ALLOW_USERS)
Ben Lindstrom6df8ef42001-03-05 07:47:23 +0000701 fatal("%s line %d: too many allow users.",
Damien Miller78928792000-04-12 20:17:38 +1000702 filename, linenum);
Damien Miller37023962000-07-11 17:31:38 +1000703 options->allow_users[options->num_allow_users++] = xstrdup(arg);
Damien Miller95def091999-11-25 00:26:21 +1100704 }
705 break;
706
707 case sDenyUsers:
Damien Millerbe484b52000-07-15 14:14:16 +1000708 while ((arg = strdelim(&cp)) && *arg != '\0') {
Damien Miller78928792000-04-12 20:17:38 +1000709 if (options->num_deny_users >= MAX_DENY_USERS)
Ben Lindstrom6df8ef42001-03-05 07:47:23 +0000710 fatal( "%s line %d: too many deny users.",
Damien Miller78928792000-04-12 20:17:38 +1000711 filename, linenum);
Damien Miller37023962000-07-11 17:31:38 +1000712 options->deny_users[options->num_deny_users++] = xstrdup(arg);
Damien Miller95def091999-11-25 00:26:21 +1100713 }
714 break;
715
716 case sAllowGroups:
Damien Millerbe484b52000-07-15 14:14:16 +1000717 while ((arg = strdelim(&cp)) && *arg != '\0') {
Damien Miller78928792000-04-12 20:17:38 +1000718 if (options->num_allow_groups >= MAX_ALLOW_GROUPS)
Ben Lindstrom6df8ef42001-03-05 07:47:23 +0000719 fatal("%s line %d: too many allow groups.",
Damien Miller78928792000-04-12 20:17:38 +1000720 filename, linenum);
Damien Miller37023962000-07-11 17:31:38 +1000721 options->allow_groups[options->num_allow_groups++] = xstrdup(arg);
Damien Miller95def091999-11-25 00:26:21 +1100722 }
723 break;
724
725 case sDenyGroups:
Damien Millerbe484b52000-07-15 14:14:16 +1000726 while ((arg = strdelim(&cp)) && *arg != '\0') {
Damien Miller78928792000-04-12 20:17:38 +1000727 if (options->num_deny_groups >= MAX_DENY_GROUPS)
Ben Lindstrom6df8ef42001-03-05 07:47:23 +0000728 fatal("%s line %d: too many deny groups.",
Damien Miller78928792000-04-12 20:17:38 +1000729 filename, linenum);
Damien Miller37023962000-07-11 17:31:38 +1000730 options->deny_groups[options->num_deny_groups++] = xstrdup(arg);
Damien Miller95def091999-11-25 00:26:21 +1100731 }
732 break;
733
Damien Miller78928792000-04-12 20:17:38 +1000734 case sCiphers:
Damien Millerbe484b52000-07-15 14:14:16 +1000735 arg = strdelim(&cp);
Damien Miller37023962000-07-11 17:31:38 +1000736 if (!arg || *arg == '\0')
Damien Millerb1715dc2000-05-30 13:44:51 +1000737 fatal("%s line %d: Missing argument.", filename, linenum);
Damien Miller37023962000-07-11 17:31:38 +1000738 if (!ciphers_valid(arg))
Damien Miller30c3d422000-05-09 11:02:59 +1000739 fatal("%s line %d: Bad SSH2 cipher spec '%s'.",
Damien Miller37023962000-07-11 17:31:38 +1000740 filename, linenum, arg ? arg : "<NONE>");
Damien Miller78928792000-04-12 20:17:38 +1000741 if (options->ciphers == NULL)
Damien Miller37023962000-07-11 17:31:38 +1000742 options->ciphers = xstrdup(arg);
Damien Miller78928792000-04-12 20:17:38 +1000743 break;
744
Ben Lindstrom06b33aa2001-02-15 03:01:59 +0000745 case sMacs:
746 arg = strdelim(&cp);
747 if (!arg || *arg == '\0')
748 fatal("%s line %d: Missing argument.", filename, linenum);
749 if (!mac_valid(arg))
750 fatal("%s line %d: Bad SSH2 mac spec '%s'.",
751 filename, linenum, arg ? arg : "<NONE>");
752 if (options->macs == NULL)
753 options->macs = xstrdup(arg);
754 break;
755
Damien Miller78928792000-04-12 20:17:38 +1000756 case sProtocol:
757 intptr = &options->protocol;
Damien Millerbe484b52000-07-15 14:14:16 +1000758 arg = strdelim(&cp);
Damien Miller37023962000-07-11 17:31:38 +1000759 if (!arg || *arg == '\0')
Damien Millerb1715dc2000-05-30 13:44:51 +1000760 fatal("%s line %d: Missing argument.", filename, linenum);
Damien Miller37023962000-07-11 17:31:38 +1000761 value = proto_spec(arg);
Damien Miller78928792000-04-12 20:17:38 +1000762 if (value == SSH_PROTO_UNKNOWN)
763 fatal("%s line %d: Bad protocol spec '%s'.",
Damien Miller37023962000-07-11 17:31:38 +1000764 filename, linenum, arg ? arg : "<NONE>");
Damien Miller78928792000-04-12 20:17:38 +1000765 if (*intptr == SSH_PROTO_UNKNOWN)
766 *intptr = value;
767 break;
768
Damien Millerf6d9e222000-06-18 14:50:44 +1000769 case sSubsystem:
770 if(options->num_subsystems >= MAX_SUBSYSTEMS) {
771 fatal("%s line %d: too many subsystems defined.",
772 filename, linenum);
773 }
Damien Millerbe484b52000-07-15 14:14:16 +1000774 arg = strdelim(&cp);
Damien Miller37023962000-07-11 17:31:38 +1000775 if (!arg || *arg == '\0')
Damien Millerf6d9e222000-06-18 14:50:44 +1000776 fatal("%s line %d: Missing subsystem name.",
777 filename, linenum);
778 for (i = 0; i < options->num_subsystems; i++)
Damien Miller37023962000-07-11 17:31:38 +1000779 if(strcmp(arg, options->subsystem_name[i]) == 0)
Damien Millerf6d9e222000-06-18 14:50:44 +1000780 fatal("%s line %d: Subsystem '%s' already defined.",
Damien Miller37023962000-07-11 17:31:38 +1000781 filename, linenum, arg);
782 options->subsystem_name[options->num_subsystems] = xstrdup(arg);
Damien Millerbe484b52000-07-15 14:14:16 +1000783 arg = strdelim(&cp);
Damien Miller37023962000-07-11 17:31:38 +1000784 if (!arg || *arg == '\0')
Damien Millerf6d9e222000-06-18 14:50:44 +1000785 fatal("%s line %d: Missing subsystem command.",
786 filename, linenum);
Damien Miller37023962000-07-11 17:31:38 +1000787 options->subsystem_command[options->num_subsystems] = xstrdup(arg);
Damien Millerf6d9e222000-06-18 14:50:44 +1000788 options->num_subsystems++;
789 break;
790
Damien Miller37023962000-07-11 17:31:38 +1000791 case sMaxStartups:
Damien Miller942da032000-08-18 13:59:06 +1000792 arg = strdelim(&cp);
793 if (!arg || *arg == '\0')
794 fatal("%s line %d: Missing MaxStartups spec.",
795 filename, linenum);
796 if (sscanf(arg, "%d:%d:%d",
797 &options->max_startups_begin,
798 &options->max_startups_rate,
799 &options->max_startups) == 3) {
800 if (options->max_startups_begin >
801 options->max_startups ||
802 options->max_startups_rate > 100 ||
803 options->max_startups_rate < 1)
804 fatal("%s line %d: Illegal MaxStartups spec.",
805 filename, linenum);
806 break;
807 }
Damien Miller37023962000-07-11 17:31:38 +1000808 intptr = &options->max_startups;
809 goto parse_int;
810
Ben Lindstrom48bd7c12001-01-09 00:35:42 +0000811 case sBanner:
812 charptr = &options->banner;
813 goto parse_filename;
Ben Lindstrombfb3a0e2001-06-05 20:25:05 +0000814 /*
815 * These options can contain %X options expanded at
816 * connect time, so that you can specify paths like:
817 *
818 * AuthorizedKeysFile /etc/ssh_keys/%u
819 */
820 case sAuthorizedKeysFile:
821 case sAuthorizedKeysFile2:
822 charptr = (opcode == sAuthorizedKeysFile ) ?
823 &options->authorized_keys_file :
824 &options->authorized_keys_file2;
825 goto parse_filename;
Ben Lindstrom1bda4c82001-06-05 19:59:08 +0000826
Ben Lindstrom5744dc42001-04-13 23:28:01 +0000827 case sClientAliveInterval:
828 intptr = &options->client_alive_interval;
Ben Lindstrom1bda4c82001-06-05 19:59:08 +0000829 goto parse_time;
830
Ben Lindstrom5744dc42001-04-13 23:28:01 +0000831 case sClientAliveCountMax:
832 intptr = &options->client_alive_count_max;
833 goto parse_int;
Ben Lindstrom1bda4c82001-06-05 19:59:08 +0000834
Damien Millerf8154422001-04-25 22:44:14 +1000835 case sPAMAuthenticationViaKbdInt:
836 intptr = &options->pam_authentication_via_kbd_int;
837 goto parse_flag;
838
Damien Miller95def091999-11-25 00:26:21 +1100839 default:
Ben Lindstromb5cdc662001-04-16 02:13:26 +0000840 fatal("%s line %d: Missing handler for opcode %s (%d)",
841 filename, linenum, arg, opcode);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000842 }
Ben Lindstromb5cdc662001-04-16 02:13:26 +0000843 if ((arg = strdelim(&cp)) != NULL && *arg != '\0')
844 fatal("%s line %d: garbage at end of line; \"%.200s\".",
845 filename, linenum, arg);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000846 }
Damien Miller95def091999-11-25 00:26:21 +1100847 fclose(f);
Ben Lindstromb5cdc662001-04-16 02:13:26 +0000848 if (bad_options > 0)
849 fatal("%s: terminating, %d bad configuration options",
850 filename, bad_options);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000851}