blob: 9274c7e6c9636eab1daadcafc888525411d53aeb [file] [log] [blame]
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001/*
Damien Miller95def091999-11-25 00:26:21 +11002 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
3 * All rights reserved
Damien Miller4af51302000-04-16 11:18:38 +10004 *
Damien Millere4340be2000-09-16 13:29:08 +11005 * As far as I am concerned, the code I have written for this software
6 * can be used freely for any purpose. Any derived versions of this
7 * software must be clearly marked as such, and if the derived work is
8 * incompatible with the protocol description in the RFC file, it must be
9 * called by a name other than "ssh" or "Secure Shell".
Damien Miller95def091999-11-25 00:26:21 +110010 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +100011
12#include "includes.h"
Ben Lindstrom65366a82001-12-06 16:32:47 +000013RCSID("$OpenBSD: servconf.c,v 1.92 2001/11/17 19:14:34 stevesk Exp $");
Ben Lindstrom226cfa02001-01-22 05:34:40 +000014
Damien Millerc4b7fea2001-07-14 12:20:32 +100015#if defined(KRB4) || defined(KRB5)
Ben Lindstrom226cfa02001-01-22 05:34:40 +000016#include <krb.h>
17#endif
Ben Lindstromeb7a84c2001-07-04 04:48:36 +000018#ifdef AFS
19#include <kafs.h>
20#endif
Damien Millerd4a8b7e1999-10-27 13:42:43 +100021
22#include "ssh.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000023#include "log.h"
Damien Millerd4a8b7e1999-10-27 13:42:43 +100024#include "servconf.h"
25#include "xmalloc.h"
Damien Miller78928792000-04-12 20:17:38 +100026#include "compat.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000027#include "pathnames.h"
28#include "tildexpand.h"
29#include "misc.h"
30#include "cipher.h"
Ben Lindstrom06b33aa2001-02-15 03:01:59 +000031#include "kex.h"
32#include "mac.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000033
Ben Lindstrombba81212001-06-25 05:01:22 +000034static void add_listen_addr(ServerOptions *, char *, u_short);
35static void add_one_listen_addr(ServerOptions *, char *, u_short);
Damien Miller34132e52000-01-14 15:45:46 +110036
Ben Lindstrom226cfa02001-01-22 05:34:40 +000037/* AF_UNSPEC or AF_INET or AF_INET6 */
38extern int IPv4or6;
39
Damien Millerd4a8b7e1999-10-27 13:42:43 +100040/* Initializes the server options to their default values. */
41
Damien Miller4af51302000-04-16 11:18:38 +100042void
Damien Miller95def091999-11-25 00:26:21 +110043initialize_server_options(ServerOptions *options)
Damien Millerd4a8b7e1999-10-27 13:42:43 +100044{
Damien Miller95def091999-11-25 00:26:21 +110045 memset(options, 0, sizeof(*options));
Damien Miller726273e2001-11-12 11:40:11 +110046
47 /* Portable-specific options */
48 options->pam_authentication_via_kbd_int = -1;
49
50 /* Standard Options */
Damien Miller34132e52000-01-14 15:45:46 +110051 options->num_ports = 0;
52 options->ports_from_cmdline = 0;
53 options->listen_addrs = NULL;
Damien Miller0bc1bd82000-11-13 22:57:25 +110054 options->num_host_key_files = 0;
Damien Miller6f83b8e2000-05-02 09:23:45 +100055 options->pid_file = NULL;
Damien Miller95def091999-11-25 00:26:21 +110056 options->server_key_bits = -1;
57 options->login_grace_time = -1;
58 options->key_regeneration_time = -1;
Ben Lindstromd8a90212001-02-15 03:08:27 +000059 options->permit_root_login = PERMIT_NOT_SET;
Damien Miller95def091999-11-25 00:26:21 +110060 options->ignore_rhosts = -1;
61 options->ignore_user_known_hosts = -1;
62 options->print_motd = -1;
Ben Lindstrom7bfff362001-03-26 05:45:53 +000063 options->print_lastlog = -1;
Damien Miller95def091999-11-25 00:26:21 +110064 options->x11_forwarding = -1;
65 options->x11_display_offset = -1;
Damien Millerd3a18572000-06-07 19:55:44 +100066 options->xauth_location = NULL;
Damien Miller95def091999-11-25 00:26:21 +110067 options->strict_modes = -1;
68 options->keepalives = -1;
69 options->log_facility = (SyslogFacility) - 1;
70 options->log_level = (LogLevel) - 1;
71 options->rhosts_authentication = -1;
72 options->rhosts_rsa_authentication = -1;
Ben Lindstrom5eabda32001-04-12 23:34:34 +000073 options->hostbased_authentication = -1;
74 options->hostbased_uses_name_from_packet_only = -1;
Damien Miller95def091999-11-25 00:26:21 +110075 options->rsa_authentication = -1;
Damien Miller0bc1bd82000-11-13 22:57:25 +110076 options->pubkey_authentication = -1;
Ben Lindstromec95ed92001-07-04 04:21:14 +000077#if defined(KRB4) || defined(KRB5)
Damien Miller95def091999-11-25 00:26:21 +110078 options->kerberos_authentication = -1;
79 options->kerberos_or_local_passwd = -1;
80 options->kerberos_ticket_cleanup = -1;
Damien Millerd4a8b7e1999-10-27 13:42:43 +100081#endif
Ben Lindstromec95ed92001-07-04 04:21:14 +000082#if defined(AFS) || defined(KRB5)
Damien Miller95def091999-11-25 00:26:21 +110083 options->kerberos_tgt_passing = -1;
Ben Lindstromec95ed92001-07-04 04:21:14 +000084#endif
85#ifdef AFS
Damien Miller95def091999-11-25 00:26:21 +110086 options->afs_token_passing = -1;
Damien Millerd4a8b7e1999-10-27 13:42:43 +100087#endif
Damien Miller95def091999-11-25 00:26:21 +110088 options->password_authentication = -1;
Damien Miller874d77b2000-10-14 16:23:11 +110089 options->kbd_interactive_authentication = -1;
Ben Lindstrom551ea372001-06-05 18:56:16 +000090 options->challenge_response_authentication = -1;
Damien Miller95def091999-11-25 00:26:21 +110091 options->permit_empty_passwd = -1;
92 options->use_login = -1;
Damien Miller50a41ed2000-10-16 12:14:42 +110093 options->allow_tcp_forwarding = -1;
Damien Miller95def091999-11-25 00:26:21 +110094 options->num_allow_users = 0;
95 options->num_deny_users = 0;
96 options->num_allow_groups = 0;
97 options->num_deny_groups = 0;
Damien Miller78928792000-04-12 20:17:38 +100098 options->ciphers = NULL;
Ben Lindstrom06b33aa2001-02-15 03:01:59 +000099 options->macs = NULL;
Damien Miller78928792000-04-12 20:17:38 +1000100 options->protocol = SSH_PROTO_UNKNOWN;
Damien Millere247cc42000-05-07 12:03:14 +1000101 options->gateway_ports = -1;
Damien Millerf6d9e222000-06-18 14:50:44 +1000102 options->num_subsystems = 0;
Damien Miller942da032000-08-18 13:59:06 +1000103 options->max_startups_begin = -1;
104 options->max_startups_rate = -1;
Damien Miller37023962000-07-11 17:31:38 +1000105 options->max_startups = -1;
Ben Lindstrom48bd7c12001-01-09 00:35:42 +0000106 options->banner = NULL;
Damien Miller33804262001-02-04 23:20:18 +1100107 options->reverse_mapping_check = -1;
Ben Lindstrom5744dc42001-04-13 23:28:01 +0000108 options->client_alive_interval = -1;
109 options->client_alive_count_max = -1;
Ben Lindstrombfb3a0e2001-06-05 20:25:05 +0000110 options->authorized_keys_file = NULL;
111 options->authorized_keys_file2 = NULL;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000112}
113
Damien Miller4af51302000-04-16 11:18:38 +1000114void
Damien Miller95def091999-11-25 00:26:21 +1100115fill_default_server_options(ServerOptions *options)
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000116{
Damien Miller726273e2001-11-12 11:40:11 +1100117 /* Portable-specific options */
118 if (options->pam_authentication_via_kbd_int == -1)
119 options->pam_authentication_via_kbd_int = 0;
120
121 /* Standard Options */
Damien Miller0bc1bd82000-11-13 22:57:25 +1100122 if (options->protocol == SSH_PROTO_UNKNOWN)
123 options->protocol = SSH_PROTO_1|SSH_PROTO_2;
124 if (options->num_host_key_files == 0) {
125 /* fill default hostkeys for protocols */
126 if (options->protocol & SSH_PROTO_1)
Ben Lindstrom226cfa02001-01-22 05:34:40 +0000127 options->host_key_files[options->num_host_key_files++] = _PATH_HOST_KEY_FILE;
Damien Miller0bc1bd82000-11-13 22:57:25 +1100128 if (options->protocol & SSH_PROTO_2)
Ben Lindstrom226cfa02001-01-22 05:34:40 +0000129 options->host_key_files[options->num_host_key_files++] = _PATH_HOST_DSA_KEY_FILE;
Damien Miller0bc1bd82000-11-13 22:57:25 +1100130 }
Damien Miller34132e52000-01-14 15:45:46 +1100131 if (options->num_ports == 0)
132 options->ports[options->num_ports++] = SSH_DEFAULT_PORT;
133 if (options->listen_addrs == NULL)
Ben Lindstrom19066a12001-04-12 23:39:26 +0000134 add_listen_addr(options, NULL, 0);
Damien Miller6f83b8e2000-05-02 09:23:45 +1000135 if (options->pid_file == NULL)
Ben Lindstrom226cfa02001-01-22 05:34:40 +0000136 options->pid_file = _PATH_SSH_DAEMON_PID_FILE;
Damien Miller95def091999-11-25 00:26:21 +1100137 if (options->server_key_bits == -1)
138 options->server_key_bits = 768;
139 if (options->login_grace_time == -1)
140 options->login_grace_time = 600;
141 if (options->key_regeneration_time == -1)
142 options->key_regeneration_time = 3600;
Ben Lindstromd8a90212001-02-15 03:08:27 +0000143 if (options->permit_root_login == PERMIT_NOT_SET)
144 options->permit_root_login = PERMIT_YES;
Damien Miller95def091999-11-25 00:26:21 +1100145 if (options->ignore_rhosts == -1)
Damien Miller98c7ad62000-03-09 21:27:49 +1100146 options->ignore_rhosts = 1;
Damien Miller95def091999-11-25 00:26:21 +1100147 if (options->ignore_user_known_hosts == -1)
148 options->ignore_user_known_hosts = 0;
Damien Miller95def091999-11-25 00:26:21 +1100149 if (options->print_motd == -1)
150 options->print_motd = 1;
Ben Lindstrom7bfff362001-03-26 05:45:53 +0000151 if (options->print_lastlog == -1)
152 options->print_lastlog = 1;
Damien Miller95def091999-11-25 00:26:21 +1100153 if (options->x11_forwarding == -1)
Damien Miller98c7ad62000-03-09 21:27:49 +1100154 options->x11_forwarding = 0;
Damien Miller95def091999-11-25 00:26:21 +1100155 if (options->x11_display_offset == -1)
Damien Miller98c7ad62000-03-09 21:27:49 +1100156 options->x11_display_offset = 10;
Ben Lindstrom1bf11f62001-06-09 01:48:01 +0000157#ifdef _PATH_XAUTH
Damien Millerd3a18572000-06-07 19:55:44 +1000158 if (options->xauth_location == NULL)
Ben Lindstrom1bf11f62001-06-09 01:48:01 +0000159 options->xauth_location = _PATH_XAUTH;
160#endif
Damien Miller95def091999-11-25 00:26:21 +1100161 if (options->strict_modes == -1)
162 options->strict_modes = 1;
163 if (options->keepalives == -1)
164 options->keepalives = 1;
165 if (options->log_facility == (SyslogFacility) (-1))
166 options->log_facility = SYSLOG_FACILITY_AUTH;
167 if (options->log_level == (LogLevel) (-1))
Ben Lindstromdb65e8f2001-01-19 04:26:52 +0000168 options->log_level = SYSLOG_LEVEL_INFO;
Damien Miller95def091999-11-25 00:26:21 +1100169 if (options->rhosts_authentication == -1)
170 options->rhosts_authentication = 0;
171 if (options->rhosts_rsa_authentication == -1)
Damien Miller98c7ad62000-03-09 21:27:49 +1100172 options->rhosts_rsa_authentication = 0;
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000173 if (options->hostbased_authentication == -1)
174 options->hostbased_authentication = 0;
175 if (options->hostbased_uses_name_from_packet_only == -1)
176 options->hostbased_uses_name_from_packet_only = 0;
Damien Miller95def091999-11-25 00:26:21 +1100177 if (options->rsa_authentication == -1)
178 options->rsa_authentication = 1;
Damien Miller0bc1bd82000-11-13 22:57:25 +1100179 if (options->pubkey_authentication == -1)
180 options->pubkey_authentication = 1;
Ben Lindstromec95ed92001-07-04 04:21:14 +0000181#if defined(KRB4) || defined(KRB5)
Damien Miller95def091999-11-25 00:26:21 +1100182 if (options->kerberos_authentication == -1)
183 options->kerberos_authentication = (access(KEYFILE, R_OK) == 0);
184 if (options->kerberos_or_local_passwd == -1)
185 options->kerberos_or_local_passwd = 1;
186 if (options->kerberos_ticket_cleanup == -1)
187 options->kerberos_ticket_cleanup = 1;
Ben Lindstromec95ed92001-07-04 04:21:14 +0000188#endif
189#if defined(AFS) || defined(KRB5)
Damien Miller95def091999-11-25 00:26:21 +1100190 if (options->kerberos_tgt_passing == -1)
191 options->kerberos_tgt_passing = 0;
Ben Lindstromec95ed92001-07-04 04:21:14 +0000192#endif
193#ifdef AFS
Damien Miller95def091999-11-25 00:26:21 +1100194 if (options->afs_token_passing == -1)
195 options->afs_token_passing = k_hasafs();
Ben Lindstromec95ed92001-07-04 04:21:14 +0000196#endif
Damien Miller95def091999-11-25 00:26:21 +1100197 if (options->password_authentication == -1)
198 options->password_authentication = 1;
Damien Miller874d77b2000-10-14 16:23:11 +1100199 if (options->kbd_interactive_authentication == -1)
200 options->kbd_interactive_authentication = 0;
Ben Lindstrom551ea372001-06-05 18:56:16 +0000201 if (options->challenge_response_authentication == -1)
202 options->challenge_response_authentication = 1;
Damien Miller95def091999-11-25 00:26:21 +1100203 if (options->permit_empty_passwd == -1)
Damien Miller98c7ad62000-03-09 21:27:49 +1100204 options->permit_empty_passwd = 0;
Damien Miller95def091999-11-25 00:26:21 +1100205 if (options->use_login == -1)
206 options->use_login = 0;
Damien Miller50a41ed2000-10-16 12:14:42 +1100207 if (options->allow_tcp_forwarding == -1)
208 options->allow_tcp_forwarding = 1;
Damien Millere247cc42000-05-07 12:03:14 +1000209 if (options->gateway_ports == -1)
210 options->gateway_ports = 0;
Damien Miller37023962000-07-11 17:31:38 +1000211 if (options->max_startups == -1)
212 options->max_startups = 10;
Damien Miller942da032000-08-18 13:59:06 +1000213 if (options->max_startups_rate == -1)
214 options->max_startups_rate = 100; /* 100% */
215 if (options->max_startups_begin == -1)
216 options->max_startups_begin = options->max_startups;
Damien Miller33804262001-02-04 23:20:18 +1100217 if (options->reverse_mapping_check == -1)
218 options->reverse_mapping_check = 0;
Ben Lindstrom5744dc42001-04-13 23:28:01 +0000219 if (options->client_alive_interval == -1)
220 options->client_alive_interval = 0;
221 if (options->client_alive_count_max == -1)
222 options->client_alive_count_max = 3;
Damien Miller75413ac2001-11-12 11:14:35 +1100223 if (options->authorized_keys_file2 == NULL) {
224 /* authorized_keys_file2 falls back to authorized_keys_file */
225 if (options->authorized_keys_file != NULL)
226 options->authorized_keys_file2 = options->authorized_keys_file;
227 else
228 options->authorized_keys_file2 = _PATH_SSH_USER_PERMITTED_KEYS2;
229 }
230 if (options->authorized_keys_file == NULL)
231 options->authorized_keys_file = _PATH_SSH_USER_PERMITTED_KEYS;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000232}
233
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000234/* Keyword tokens. */
Damien Miller95def091999-11-25 00:26:21 +1100235typedef enum {
236 sBadOption, /* == unknown option */
Damien Miller726273e2001-11-12 11:40:11 +1100237 /* Portable-specific options */
238 sPAMAuthenticationViaKbdInt,
239 /* Standard Options */
Damien Miller95def091999-11-25 00:26:21 +1100240 sPort, sHostKeyFile, sServerKeyBits, sLoginGraceTime, sKeyRegenerationTime,
241 sPermitRootLogin, sLogFacility, sLogLevel,
242 sRhostsAuthentication, sRhostsRSAAuthentication, sRSAAuthentication,
Ben Lindstromec95ed92001-07-04 04:21:14 +0000243#if defined(KRB4) || defined(KRB5)
Damien Miller95def091999-11-25 00:26:21 +1100244 sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup,
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000245#endif
Ben Lindstromec95ed92001-07-04 04:21:14 +0000246#if defined(AFS) || defined(KRB5)
247 sKerberosTgtPassing,
248#endif
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000249#ifdef AFS
Ben Lindstromec95ed92001-07-04 04:21:14 +0000250 sAFSTokenPassing,
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000251#endif
Ben Lindstrom95fb2dd2001-01-23 03:12:10 +0000252 sChallengeResponseAuthentication,
Damien Miller874d77b2000-10-14 16:23:11 +1100253 sPasswordAuthentication, sKbdInteractiveAuthentication, sListenAddress,
Ben Lindstrom7bfff362001-03-26 05:45:53 +0000254 sPrintMotd, sPrintLastLog, sIgnoreRhosts,
255 sX11Forwarding, sX11DisplayOffset,
Ben Lindstrom91e98682001-09-12 16:32:14 +0000256 sStrictModes, sEmptyPasswd, sKeepAlives,
Damien Miller50a41ed2000-10-16 12:14:42 +1100257 sUseLogin, sAllowTcpForwarding,
258 sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups,
Ben Lindstrom06b33aa2001-02-15 03:01:59 +0000259 sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile,
Damien Miller0bc1bd82000-11-13 22:57:25 +1100260 sGatewayPorts, sPubkeyAuthentication, sXAuthLocation, sSubsystem, sMaxStartups,
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000261 sBanner, sReverseMappingCheck, sHostbasedAuthentication,
Ben Lindstrom5744dc42001-04-13 23:28:01 +0000262 sHostbasedUsesNameFromPacketOnly, sClientAliveInterval,
Ben Lindstrombfb3a0e2001-06-05 20:25:05 +0000263 sClientAliveCountMax, sAuthorizedKeysFile, sAuthorizedKeysFile2,
Damien Miller726273e2001-11-12 11:40:11 +1100264 sDeprecated
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000265} ServerOpCodes;
266
267/* Textual representation of the tokens. */
Damien Miller95def091999-11-25 00:26:21 +1100268static struct {
269 const char *name;
270 ServerOpCodes opcode;
271} keywords[] = {
Damien Miller726273e2001-11-12 11:40:11 +1100272 /* Portable-specific options */
273 { "PAMAuthenticationViaKbdInt", sPAMAuthenticationViaKbdInt },
274 /* Standard Options */
Damien Miller95def091999-11-25 00:26:21 +1100275 { "port", sPort },
276 { "hostkey", sHostKeyFile },
Damien Miller0bc1bd82000-11-13 22:57:25 +1100277 { "hostdsakey", sHostKeyFile }, /* alias */
Kevin Stevesef4eea92001-02-05 12:42:17 +0000278 { "pidfile", sPidFile },
Damien Miller95def091999-11-25 00:26:21 +1100279 { "serverkeybits", sServerKeyBits },
280 { "logingracetime", sLoginGraceTime },
281 { "keyregenerationinterval", sKeyRegenerationTime },
282 { "permitrootlogin", sPermitRootLogin },
283 { "syslogfacility", sLogFacility },
284 { "loglevel", sLogLevel },
285 { "rhostsauthentication", sRhostsAuthentication },
286 { "rhostsrsaauthentication", sRhostsRSAAuthentication },
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000287 { "hostbasedauthentication", sHostbasedAuthentication },
288 { "hostbasedusesnamefrompacketonly", sHostbasedUsesNameFromPacketOnly },
Damien Miller95def091999-11-25 00:26:21 +1100289 { "rsaauthentication", sRSAAuthentication },
Damien Miller0bc1bd82000-11-13 22:57:25 +1100290 { "pubkeyauthentication", sPubkeyAuthentication },
291 { "dsaauthentication", sPubkeyAuthentication }, /* alias */
Ben Lindstromec95ed92001-07-04 04:21:14 +0000292#if defined(KRB4) || defined(KRB5)
Damien Miller95def091999-11-25 00:26:21 +1100293 { "kerberosauthentication", sKerberosAuthentication },
294 { "kerberosorlocalpasswd", sKerberosOrLocalPasswd },
295 { "kerberosticketcleanup", sKerberosTicketCleanup },
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000296#endif
Ben Lindstromec95ed92001-07-04 04:21:14 +0000297#if defined(AFS) || defined(KRB5)
Damien Miller95def091999-11-25 00:26:21 +1100298 { "kerberostgtpassing", sKerberosTgtPassing },
Ben Lindstromec95ed92001-07-04 04:21:14 +0000299#endif
300#ifdef AFS
Damien Miller95def091999-11-25 00:26:21 +1100301 { "afstokenpassing", sAFSTokenPassing },
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000302#endif
Damien Miller95def091999-11-25 00:26:21 +1100303 { "passwordauthentication", sPasswordAuthentication },
Damien Miller874d77b2000-10-14 16:23:11 +1100304 { "kbdinteractiveauthentication", sKbdInteractiveAuthentication },
Ben Lindstrom95fb2dd2001-01-23 03:12:10 +0000305 { "challengeresponseauthentication", sChallengeResponseAuthentication },
306 { "skeyauthentication", sChallengeResponseAuthentication }, /* alias */
Ben Lindstrom91e98682001-09-12 16:32:14 +0000307 { "checkmail", sDeprecated },
Damien Miller95def091999-11-25 00:26:21 +1100308 { "listenaddress", sListenAddress },
309 { "printmotd", sPrintMotd },
Ben Lindstrom7bfff362001-03-26 05:45:53 +0000310 { "printlastlog", sPrintLastLog },
Damien Miller95def091999-11-25 00:26:21 +1100311 { "ignorerhosts", sIgnoreRhosts },
312 { "ignoreuserknownhosts", sIgnoreUserKnownHosts },
313 { "x11forwarding", sX11Forwarding },
314 { "x11displayoffset", sX11DisplayOffset },
Damien Millerd3a18572000-06-07 19:55:44 +1000315 { "xauthlocation", sXAuthLocation },
Damien Miller95def091999-11-25 00:26:21 +1100316 { "strictmodes", sStrictModes },
317 { "permitemptypasswords", sEmptyPasswd },
318 { "uselogin", sUseLogin },
Damien Miller95def091999-11-25 00:26:21 +1100319 { "keepalive", sKeepAlives },
Damien Miller50a41ed2000-10-16 12:14:42 +1100320 { "allowtcpforwarding", sAllowTcpForwarding },
Damien Miller95def091999-11-25 00:26:21 +1100321 { "allowusers", sAllowUsers },
322 { "denyusers", sDenyUsers },
323 { "allowgroups", sAllowGroups },
324 { "denygroups", sDenyGroups },
Damien Miller78928792000-04-12 20:17:38 +1000325 { "ciphers", sCiphers },
Ben Lindstrom06b33aa2001-02-15 03:01:59 +0000326 { "macs", sMacs },
Damien Miller78928792000-04-12 20:17:38 +1000327 { "protocol", sProtocol },
Damien Millere247cc42000-05-07 12:03:14 +1000328 { "gatewayports", sGatewayPorts },
Damien Millerf6d9e222000-06-18 14:50:44 +1000329 { "subsystem", sSubsystem },
Damien Miller37023962000-07-11 17:31:38 +1000330 { "maxstartups", sMaxStartups },
Ben Lindstrom48bd7c12001-01-09 00:35:42 +0000331 { "banner", sBanner },
Damien Miller33804262001-02-04 23:20:18 +1100332 { "reversemappingcheck", sReverseMappingCheck },
Ben Lindstrom5744dc42001-04-13 23:28:01 +0000333 { "clientaliveinterval", sClientAliveInterval },
334 { "clientalivecountmax", sClientAliveCountMax },
Ben Lindstrombfb3a0e2001-06-05 20:25:05 +0000335 { "authorizedkeysfile", sAuthorizedKeysFile },
336 { "authorizedkeysfile2", sAuthorizedKeysFile2 },
Ben Lindstrom65366a82001-12-06 16:32:47 +0000337 { NULL, sBadOption }
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000338};
339
Damien Miller5428f641999-11-25 11:54:57 +1100340/*
Ben Lindstrom3704c262001-04-02 18:20:03 +0000341 * Returns the number of the token pointed to by cp or sBadOption.
Damien Miller5428f641999-11-25 11:54:57 +1100342 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000343
Damien Miller4af51302000-04-16 11:18:38 +1000344static ServerOpCodes
Damien Miller95def091999-11-25 00:26:21 +1100345parse_token(const char *cp, const char *filename,
346 int linenum)
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000347{
Ben Lindstrom46c16222000-12-22 01:43:59 +0000348 u_int i;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000349
Damien Miller95def091999-11-25 00:26:21 +1100350 for (i = 0; keywords[i].name; i++)
Damien Miller5428f641999-11-25 11:54:57 +1100351 if (strcasecmp(cp, keywords[i].name) == 0)
Damien Miller95def091999-11-25 00:26:21 +1100352 return keywords[i].opcode;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000353
Ben Lindstromb5cdc662001-04-16 02:13:26 +0000354 error("%s: line %d: Bad configuration option: %s",
355 filename, linenum, cp);
Damien Miller95def091999-11-25 00:26:21 +1100356 return sBadOption;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000357}
358
Ben Lindstrombba81212001-06-25 05:01:22 +0000359static void
Ben Lindstrom19066a12001-04-12 23:39:26 +0000360add_listen_addr(ServerOptions *options, char *addr, u_short port)
Damien Miller34132e52000-01-14 15:45:46 +1100361{
Damien Miller34132e52000-01-14 15:45:46 +1100362 int i;
363
364 if (options->num_ports == 0)
365 options->ports[options->num_ports++] = SSH_DEFAULT_PORT;
Ben Lindstrom19066a12001-04-12 23:39:26 +0000366 if (port == 0)
Ben Lindstromc510af42001-04-07 17:25:48 +0000367 for (i = 0; i < options->num_ports; i++)
368 add_one_listen_addr(options, addr, options->ports[i]);
369 else
Ben Lindstrom19066a12001-04-12 23:39:26 +0000370 add_one_listen_addr(options, addr, port);
Ben Lindstromc510af42001-04-07 17:25:48 +0000371}
372
Ben Lindstrombba81212001-06-25 05:01:22 +0000373static void
Ben Lindstromc510af42001-04-07 17:25:48 +0000374add_one_listen_addr(ServerOptions *options, char *addr, u_short port)
375{
376 struct addrinfo hints, *ai, *aitop;
377 char strport[NI_MAXSERV];
378 int gaierr;
379
380 memset(&hints, 0, sizeof(hints));
381 hints.ai_family = IPv4or6;
382 hints.ai_socktype = SOCK_STREAM;
383 hints.ai_flags = (addr == NULL) ? AI_PASSIVE : 0;
384 snprintf(strport, sizeof strport, "%d", port);
385 if ((gaierr = getaddrinfo(addr, strport, &hints, &aitop)) != 0)
386 fatal("bad addr or host: %s (%s)",
387 addr ? addr : "<NULL>",
388 gai_strerror(gaierr));
389 for (ai = aitop; ai->ai_next; ai = ai->ai_next)
390 ;
391 ai->ai_next = options->listen_addrs;
392 options->listen_addrs = aitop;
Damien Miller34132e52000-01-14 15:45:46 +1100393}
394
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000395/* Reads the server configuration file. */
396
Damien Miller4af51302000-04-16 11:18:38 +1000397void
Damien Miller95def091999-11-25 00:26:21 +1100398read_server_config(ServerOptions *options, const char *filename)
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000399{
Damien Miller95def091999-11-25 00:26:21 +1100400 FILE *f;
401 char line[1024];
Ben Lindstromc510af42001-04-07 17:25:48 +0000402 char *cp, **charptr, *arg, *p;
Damien Miller95def091999-11-25 00:26:21 +1100403 int linenum, *intptr, value;
404 int bad_options = 0;
405 ServerOpCodes opcode;
Damien Miller40857852001-07-14 12:17:33 +1000406 int i, n;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000407
Damien Miller95def091999-11-25 00:26:21 +1100408 f = fopen(filename, "r");
409 if (!f) {
410 perror(filename);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000411 exit(1);
Damien Miller95def091999-11-25 00:26:21 +1100412 }
413 linenum = 0;
414 while (fgets(line, sizeof(line), f)) {
415 linenum++;
Damien Millerbe484b52000-07-15 14:14:16 +1000416 cp = line;
417 arg = strdelim(&cp);
418 /* Ignore leading whitespace */
419 if (*arg == '\0')
420 arg = strdelim(&cp);
Ben Lindstrom226cfa02001-01-22 05:34:40 +0000421 if (!arg || !*arg || *arg == '#')
Damien Miller95def091999-11-25 00:26:21 +1100422 continue;
Damien Miller0bc1bd82000-11-13 22:57:25 +1100423 intptr = NULL;
424 charptr = NULL;
Damien Miller37023962000-07-11 17:31:38 +1000425 opcode = parse_token(arg, filename, linenum);
Damien Miller95def091999-11-25 00:26:21 +1100426 switch (opcode) {
427 case sBadOption:
428 bad_options++;
429 continue;
Damien Miller726273e2001-11-12 11:40:11 +1100430
431 /* Portable-specific options */
432 case sPAMAuthenticationViaKbdInt:
433 intptr = &options->pam_authentication_via_kbd_int;
434 goto parse_flag;
435
436 /* Standard Options */
Damien Miller95def091999-11-25 00:26:21 +1100437 case sPort:
Damien Miller34132e52000-01-14 15:45:46 +1100438 /* ignore ports from configfile if cmdline specifies ports */
439 if (options->ports_from_cmdline)
440 continue;
441 if (options->listen_addrs != NULL)
442 fatal("%s line %d: ports must be specified before "
Ben Lindstroma6218b82001-05-03 22:39:11 +0000443 "ListenAdress.", filename, linenum);
Damien Miller34132e52000-01-14 15:45:46 +1100444 if (options->num_ports >= MAX_PORTS)
Ben Lindstrom6df8ef42001-03-05 07:47:23 +0000445 fatal("%s line %d: too many ports.",
Damien Miller4af51302000-04-16 11:18:38 +1000446 filename, linenum);
Damien Millerbe484b52000-07-15 14:14:16 +1000447 arg = strdelim(&cp);
Damien Miller37023962000-07-11 17:31:38 +1000448 if (!arg || *arg == '\0')
Ben Lindstrom6df8ef42001-03-05 07:47:23 +0000449 fatal("%s line %d: missing port number.",
Damien Miller34132e52000-01-14 15:45:46 +1100450 filename, linenum);
Ben Lindstrom19066a12001-04-12 23:39:26 +0000451 options->ports[options->num_ports++] = a2port(arg);
452 if (options->ports[options->num_ports-1] == 0)
453 fatal("%s line %d: Badly formatted port number.",
454 filename, linenum);
Damien Miller34132e52000-01-14 15:45:46 +1100455 break;
456
457 case sServerKeyBits:
458 intptr = &options->server_key_bits;
Damien Miller95def091999-11-25 00:26:21 +1100459parse_int:
Damien Millerbe484b52000-07-15 14:14:16 +1000460 arg = strdelim(&cp);
Ben Lindstromb5cdc662001-04-16 02:13:26 +0000461 if (!arg || *arg == '\0')
462 fatal("%s line %d: missing integer value.",
463 filename, linenum);
Damien Miller37023962000-07-11 17:31:38 +1000464 value = atoi(arg);
Damien Miller95def091999-11-25 00:26:21 +1100465 if (*intptr == -1)
466 *intptr = value;
467 break;
Damien Miller32265091999-11-12 11:33:04 +1100468
Damien Miller95def091999-11-25 00:26:21 +1100469 case sLoginGraceTime:
470 intptr = &options->login_grace_time;
Ben Lindstrom1bda4c82001-06-05 19:59:08 +0000471parse_time:
472 arg = strdelim(&cp);
473 if (!arg || *arg == '\0')
474 fatal("%s line %d: missing time value.",
475 filename, linenum);
476 if ((value = convtime(arg)) == -1)
477 fatal("%s line %d: invalid time value.",
478 filename, linenum);
479 if (*intptr == -1)
480 *intptr = value;
481 break;
Damien Miller95def091999-11-25 00:26:21 +1100482
483 case sKeyRegenerationTime:
484 intptr = &options->key_regeneration_time;
Ben Lindstrom1bda4c82001-06-05 19:59:08 +0000485 goto parse_time;
Damien Miller95def091999-11-25 00:26:21 +1100486
487 case sListenAddress:
Damien Millerbe484b52000-07-15 14:14:16 +1000488 arg = strdelim(&cp);
Ben Lindstromc510af42001-04-07 17:25:48 +0000489 if (!arg || *arg == '\0' || strncmp(arg, "[]", 2) == 0)
Ben Lindstrom6df8ef42001-03-05 07:47:23 +0000490 fatal("%s line %d: missing inet addr.",
Damien Miller34132e52000-01-14 15:45:46 +1100491 filename, linenum);
Ben Lindstromc510af42001-04-07 17:25:48 +0000492 if (*arg == '[') {
493 if ((p = strchr(arg, ']')) == NULL)
494 fatal("%s line %d: bad ipv6 inet addr usage.",
495 filename, linenum);
496 arg++;
497 memmove(p, p+1, strlen(p+1)+1);
498 } else if (((p = strchr(arg, ':')) == NULL) ||
499 (strchr(p+1, ':') != NULL)) {
Ben Lindstrom19066a12001-04-12 23:39:26 +0000500 add_listen_addr(options, arg, 0);
Ben Lindstromc510af42001-04-07 17:25:48 +0000501 break;
502 }
503 if (*p == ':') {
Ben Lindstrom19066a12001-04-12 23:39:26 +0000504 u_short port;
505
Ben Lindstromc510af42001-04-07 17:25:48 +0000506 p++;
507 if (*p == '\0')
508 fatal("%s line %d: bad inet addr:port usage.",
509 filename, linenum);
510 else {
511 *(p-1) = '\0';
Ben Lindstrom19066a12001-04-12 23:39:26 +0000512 if ((port = a2port(p)) == 0)
513 fatal("%s line %d: bad port number.",
514 filename, linenum);
515 add_listen_addr(options, arg, port);
Ben Lindstromc510af42001-04-07 17:25:48 +0000516 }
517 } else if (*p == '\0')
Ben Lindstrom19066a12001-04-12 23:39:26 +0000518 add_listen_addr(options, arg, 0);
Ben Lindstromc510af42001-04-07 17:25:48 +0000519 else
520 fatal("%s line %d: bad inet addr usage.",
521 filename, linenum);
Damien Miller95def091999-11-25 00:26:21 +1100522 break;
523
524 case sHostKeyFile:
Damien Miller0bc1bd82000-11-13 22:57:25 +1100525 intptr = &options->num_host_key_files;
Ben Lindstromb5cdc662001-04-16 02:13:26 +0000526 if (*intptr >= MAX_HOSTKEYS)
527 fatal("%s line %d: too many host keys specified (max %d).",
Damien Miller0bc1bd82000-11-13 22:57:25 +1100528 filename, linenum, MAX_HOSTKEYS);
Damien Miller0bc1bd82000-11-13 22:57:25 +1100529 charptr = &options->host_key_files[*intptr];
Damien Millerd3a18572000-06-07 19:55:44 +1000530parse_filename:
Damien Millerbe484b52000-07-15 14:14:16 +1000531 arg = strdelim(&cp);
Ben Lindstromb5cdc662001-04-16 02:13:26 +0000532 if (!arg || *arg == '\0')
533 fatal("%s line %d: missing file name.",
Damien Miller6f83b8e2000-05-02 09:23:45 +1000534 filename, linenum);
Damien Miller0bc1bd82000-11-13 22:57:25 +1100535 if (*charptr == NULL) {
Damien Miller37023962000-07-11 17:31:38 +1000536 *charptr = tilde_expand_filename(arg, getuid());
Damien Miller0bc1bd82000-11-13 22:57:25 +1100537 /* increase optional counter */
538 if (intptr != NULL)
539 *intptr = *intptr + 1;
540 }
Damien Miller6f83b8e2000-05-02 09:23:45 +1000541 break;
542
543 case sPidFile:
544 charptr = &options->pid_file;
Damien Millerd3a18572000-06-07 19:55:44 +1000545 goto parse_filename;
Damien Miller95def091999-11-25 00:26:21 +1100546
Damien Miller95def091999-11-25 00:26:21 +1100547 case sPermitRootLogin:
548 intptr = &options->permit_root_login;
Damien Millerbe484b52000-07-15 14:14:16 +1000549 arg = strdelim(&cp);
Ben Lindstromb5cdc662001-04-16 02:13:26 +0000550 if (!arg || *arg == '\0')
551 fatal("%s line %d: missing yes/"
Ben Lindstrom35f1f4e2001-03-06 01:02:41 +0000552 "without-password/forced-commands-only/no "
Ben Lindstromb5cdc662001-04-16 02:13:26 +0000553 "argument.", filename, linenum);
554 value = 0; /* silence compiler */
Damien Miller37023962000-07-11 17:31:38 +1000555 if (strcmp(arg, "without-password") == 0)
Ben Lindstromd8a90212001-02-15 03:08:27 +0000556 value = PERMIT_NO_PASSWD;
557 else if (strcmp(arg, "forced-commands-only") == 0)
558 value = PERMIT_FORCED_ONLY;
Damien Miller37023962000-07-11 17:31:38 +1000559 else if (strcmp(arg, "yes") == 0)
Ben Lindstromd8a90212001-02-15 03:08:27 +0000560 value = PERMIT_YES;
Damien Miller37023962000-07-11 17:31:38 +1000561 else if (strcmp(arg, "no") == 0)
Ben Lindstromd8a90212001-02-15 03:08:27 +0000562 value = PERMIT_NO;
Ben Lindstromb5cdc662001-04-16 02:13:26 +0000563 else
564 fatal("%s line %d: Bad yes/"
Ben Lindstromd8a90212001-02-15 03:08:27 +0000565 "without-password/forced-commands-only/no "
Ben Lindstromb5cdc662001-04-16 02:13:26 +0000566 "argument: %s", filename, linenum, arg);
Damien Miller95def091999-11-25 00:26:21 +1100567 if (*intptr == -1)
568 *intptr = value;
569 break;
570
571 case sIgnoreRhosts:
572 intptr = &options->ignore_rhosts;
573parse_flag:
Damien Millerbe484b52000-07-15 14:14:16 +1000574 arg = strdelim(&cp);
Ben Lindstromb5cdc662001-04-16 02:13:26 +0000575 if (!arg || *arg == '\0')
576 fatal("%s line %d: missing yes/no argument.",
577 filename, linenum);
578 value = 0; /* silence compiler */
Damien Miller37023962000-07-11 17:31:38 +1000579 if (strcmp(arg, "yes") == 0)
Damien Miller95def091999-11-25 00:26:21 +1100580 value = 1;
Damien Miller37023962000-07-11 17:31:38 +1000581 else if (strcmp(arg, "no") == 0)
Damien Miller95def091999-11-25 00:26:21 +1100582 value = 0;
Ben Lindstromb5cdc662001-04-16 02:13:26 +0000583 else
584 fatal("%s line %d: Bad yes/no argument: %s",
Damien Miller37023962000-07-11 17:31:38 +1000585 filename, linenum, arg);
Damien Miller95def091999-11-25 00:26:21 +1100586 if (*intptr == -1)
587 *intptr = value;
588 break;
589
590 case sIgnoreUserKnownHosts:
591 intptr = &options->ignore_user_known_hosts;
Damien Miller98c7ad62000-03-09 21:27:49 +1100592 goto parse_flag;
Damien Miller95def091999-11-25 00:26:21 +1100593
594 case sRhostsAuthentication:
595 intptr = &options->rhosts_authentication;
596 goto parse_flag;
597
598 case sRhostsRSAAuthentication:
599 intptr = &options->rhosts_rsa_authentication;
600 goto parse_flag;
601
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000602 case sHostbasedAuthentication:
603 intptr = &options->hostbased_authentication;
604 goto parse_flag;
605
606 case sHostbasedUsesNameFromPacketOnly:
607 intptr = &options->hostbased_uses_name_from_packet_only;
608 goto parse_flag;
609
Damien Miller95def091999-11-25 00:26:21 +1100610 case sRSAAuthentication:
611 intptr = &options->rsa_authentication;
612 goto parse_flag;
613
Damien Miller0bc1bd82000-11-13 22:57:25 +1100614 case sPubkeyAuthentication:
615 intptr = &options->pubkey_authentication;
Damien Millere247cc42000-05-07 12:03:14 +1000616 goto parse_flag;
Ben Lindstromec95ed92001-07-04 04:21:14 +0000617#if defined(KRB4) || defined(KRB5)
Damien Miller95def091999-11-25 00:26:21 +1100618 case sKerberosAuthentication:
619 intptr = &options->kerberos_authentication;
620 goto parse_flag;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000621
Damien Miller95def091999-11-25 00:26:21 +1100622 case sKerberosOrLocalPasswd:
623 intptr = &options->kerberos_or_local_passwd;
624 goto parse_flag;
625
626 case sKerberosTicketCleanup:
627 intptr = &options->kerberos_ticket_cleanup;
628 goto parse_flag;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000629#endif
Ben Lindstromec95ed92001-07-04 04:21:14 +0000630#if defined(AFS) || defined(KRB5)
Damien Miller95def091999-11-25 00:26:21 +1100631 case sKerberosTgtPassing:
632 intptr = &options->kerberos_tgt_passing;
633 goto parse_flag;
Ben Lindstromec95ed92001-07-04 04:21:14 +0000634#endif
635#ifdef AFS
Damien Miller95def091999-11-25 00:26:21 +1100636 case sAFSTokenPassing:
637 intptr = &options->afs_token_passing;
638 goto parse_flag;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000639#endif
640
Damien Miller95def091999-11-25 00:26:21 +1100641 case sPasswordAuthentication:
642 intptr = &options->password_authentication;
643 goto parse_flag;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000644
Damien Miller874d77b2000-10-14 16:23:11 +1100645 case sKbdInteractiveAuthentication:
646 intptr = &options->kbd_interactive_authentication;
647 goto parse_flag;
648
Ben Lindstrom95fb2dd2001-01-23 03:12:10 +0000649 case sChallengeResponseAuthentication:
Ben Lindstrom551ea372001-06-05 18:56:16 +0000650 intptr = &options->challenge_response_authentication;
Damien Miller95def091999-11-25 00:26:21 +1100651 goto parse_flag;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000652
Damien Miller95def091999-11-25 00:26:21 +1100653 case sPrintMotd:
654 intptr = &options->print_motd;
655 goto parse_flag;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000656
Ben Lindstrom7bfff362001-03-26 05:45:53 +0000657 case sPrintLastLog:
658 intptr = &options->print_lastlog;
659 goto parse_flag;
660
Damien Miller95def091999-11-25 00:26:21 +1100661 case sX11Forwarding:
662 intptr = &options->x11_forwarding;
663 goto parse_flag;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000664
Damien Miller95def091999-11-25 00:26:21 +1100665 case sX11DisplayOffset:
666 intptr = &options->x11_display_offset;
667 goto parse_int;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000668
Damien Millerd3a18572000-06-07 19:55:44 +1000669 case sXAuthLocation:
670 charptr = &options->xauth_location;
671 goto parse_filename;
Kevin Stevesef4eea92001-02-05 12:42:17 +0000672
Damien Miller95def091999-11-25 00:26:21 +1100673 case sStrictModes:
674 intptr = &options->strict_modes;
675 goto parse_flag;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000676
Damien Miller95def091999-11-25 00:26:21 +1100677 case sKeepAlives:
678 intptr = &options->keepalives;
679 goto parse_flag;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000680
Damien Miller95def091999-11-25 00:26:21 +1100681 case sEmptyPasswd:
682 intptr = &options->permit_empty_passwd;
683 goto parse_flag;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000684
Damien Miller95def091999-11-25 00:26:21 +1100685 case sUseLogin:
686 intptr = &options->use_login;
687 goto parse_flag;
Damien Miller5ce662a1999-11-11 17:57:39 +1100688
Damien Millere247cc42000-05-07 12:03:14 +1000689 case sGatewayPorts:
690 intptr = &options->gateway_ports;
691 goto parse_flag;
692
Damien Miller33804262001-02-04 23:20:18 +1100693 case sReverseMappingCheck:
694 intptr = &options->reverse_mapping_check;
695 goto parse_flag;
696
Damien Miller95def091999-11-25 00:26:21 +1100697 case sLogFacility:
698 intptr = (int *) &options->log_facility;
Damien Millerbe484b52000-07-15 14:14:16 +1000699 arg = strdelim(&cp);
Damien Miller37023962000-07-11 17:31:38 +1000700 value = log_facility_number(arg);
Damien Miller95def091999-11-25 00:26:21 +1100701 if (value == (SyslogFacility) - 1)
Ben Lindstrom6df8ef42001-03-05 07:47:23 +0000702 fatal("%.200s line %d: unsupported log facility '%s'",
Damien Miller37023962000-07-11 17:31:38 +1000703 filename, linenum, arg ? arg : "<NONE>");
Damien Miller95def091999-11-25 00:26:21 +1100704 if (*intptr == -1)
705 *intptr = (SyslogFacility) value;
706 break;
707
708 case sLogLevel:
709 intptr = (int *) &options->log_level;
Damien Millerbe484b52000-07-15 14:14:16 +1000710 arg = strdelim(&cp);
Damien Miller37023962000-07-11 17:31:38 +1000711 value = log_level_number(arg);
Damien Miller95def091999-11-25 00:26:21 +1100712 if (value == (LogLevel) - 1)
Ben Lindstrom6df8ef42001-03-05 07:47:23 +0000713 fatal("%.200s line %d: unsupported log level '%s'",
Damien Miller37023962000-07-11 17:31:38 +1000714 filename, linenum, arg ? arg : "<NONE>");
Damien Miller95def091999-11-25 00:26:21 +1100715 if (*intptr == -1)
716 *intptr = (LogLevel) value;
717 break;
718
Damien Miller50a41ed2000-10-16 12:14:42 +1100719 case sAllowTcpForwarding:
720 intptr = &options->allow_tcp_forwarding;
721 goto parse_flag;
722
Damien Miller95def091999-11-25 00:26:21 +1100723 case sAllowUsers:
Damien Millerbe484b52000-07-15 14:14:16 +1000724 while ((arg = strdelim(&cp)) && *arg != '\0') {
Damien Miller78928792000-04-12 20:17:38 +1000725 if (options->num_allow_users >= MAX_ALLOW_USERS)
Ben Lindstrom6df8ef42001-03-05 07:47:23 +0000726 fatal("%s line %d: too many allow users.",
Damien Miller78928792000-04-12 20:17:38 +1000727 filename, linenum);
Damien Miller37023962000-07-11 17:31:38 +1000728 options->allow_users[options->num_allow_users++] = xstrdup(arg);
Damien Miller95def091999-11-25 00:26:21 +1100729 }
730 break;
731
732 case sDenyUsers:
Damien Millerbe484b52000-07-15 14:14:16 +1000733 while ((arg = strdelim(&cp)) && *arg != '\0') {
Damien Miller78928792000-04-12 20:17:38 +1000734 if (options->num_deny_users >= MAX_DENY_USERS)
Ben Lindstrom6df8ef42001-03-05 07:47:23 +0000735 fatal( "%s line %d: too many deny users.",
Damien Miller78928792000-04-12 20:17:38 +1000736 filename, linenum);
Damien Miller37023962000-07-11 17:31:38 +1000737 options->deny_users[options->num_deny_users++] = xstrdup(arg);
Damien Miller95def091999-11-25 00:26:21 +1100738 }
739 break;
740
741 case sAllowGroups:
Damien Millerbe484b52000-07-15 14:14:16 +1000742 while ((arg = strdelim(&cp)) && *arg != '\0') {
Damien Miller78928792000-04-12 20:17:38 +1000743 if (options->num_allow_groups >= MAX_ALLOW_GROUPS)
Ben Lindstrom6df8ef42001-03-05 07:47:23 +0000744 fatal("%s line %d: too many allow groups.",
Damien Miller78928792000-04-12 20:17:38 +1000745 filename, linenum);
Damien Miller37023962000-07-11 17:31:38 +1000746 options->allow_groups[options->num_allow_groups++] = xstrdup(arg);
Damien Miller95def091999-11-25 00:26:21 +1100747 }
748 break;
749
750 case sDenyGroups:
Damien Millerbe484b52000-07-15 14:14:16 +1000751 while ((arg = strdelim(&cp)) && *arg != '\0') {
Damien Miller78928792000-04-12 20:17:38 +1000752 if (options->num_deny_groups >= MAX_DENY_GROUPS)
Ben Lindstrom6df8ef42001-03-05 07:47:23 +0000753 fatal("%s line %d: too many deny groups.",
Damien Miller78928792000-04-12 20:17:38 +1000754 filename, linenum);
Damien Miller37023962000-07-11 17:31:38 +1000755 options->deny_groups[options->num_deny_groups++] = xstrdup(arg);
Damien Miller95def091999-11-25 00:26:21 +1100756 }
757 break;
758
Damien Miller78928792000-04-12 20:17:38 +1000759 case sCiphers:
Damien Millerbe484b52000-07-15 14:14:16 +1000760 arg = strdelim(&cp);
Damien Miller37023962000-07-11 17:31:38 +1000761 if (!arg || *arg == '\0')
Damien Millerb1715dc2000-05-30 13:44:51 +1000762 fatal("%s line %d: Missing argument.", filename, linenum);
Damien Miller37023962000-07-11 17:31:38 +1000763 if (!ciphers_valid(arg))
Damien Miller30c3d422000-05-09 11:02:59 +1000764 fatal("%s line %d: Bad SSH2 cipher spec '%s'.",
Damien Miller37023962000-07-11 17:31:38 +1000765 filename, linenum, arg ? arg : "<NONE>");
Damien Miller78928792000-04-12 20:17:38 +1000766 if (options->ciphers == NULL)
Damien Miller37023962000-07-11 17:31:38 +1000767 options->ciphers = xstrdup(arg);
Damien Miller78928792000-04-12 20:17:38 +1000768 break;
769
Ben Lindstrom06b33aa2001-02-15 03:01:59 +0000770 case sMacs:
771 arg = strdelim(&cp);
772 if (!arg || *arg == '\0')
773 fatal("%s line %d: Missing argument.", filename, linenum);
774 if (!mac_valid(arg))
775 fatal("%s line %d: Bad SSH2 mac spec '%s'.",
776 filename, linenum, arg ? arg : "<NONE>");
777 if (options->macs == NULL)
778 options->macs = xstrdup(arg);
779 break;
780
Damien Miller78928792000-04-12 20:17:38 +1000781 case sProtocol:
782 intptr = &options->protocol;
Damien Millerbe484b52000-07-15 14:14:16 +1000783 arg = strdelim(&cp);
Damien Miller37023962000-07-11 17:31:38 +1000784 if (!arg || *arg == '\0')
Damien Millerb1715dc2000-05-30 13:44:51 +1000785 fatal("%s line %d: Missing argument.", filename, linenum);
Damien Miller37023962000-07-11 17:31:38 +1000786 value = proto_spec(arg);
Damien Miller78928792000-04-12 20:17:38 +1000787 if (value == SSH_PROTO_UNKNOWN)
788 fatal("%s line %d: Bad protocol spec '%s'.",
Damien Miller37023962000-07-11 17:31:38 +1000789 filename, linenum, arg ? arg : "<NONE>");
Damien Miller78928792000-04-12 20:17:38 +1000790 if (*intptr == SSH_PROTO_UNKNOWN)
791 *intptr = value;
792 break;
793
Damien Millerf6d9e222000-06-18 14:50:44 +1000794 case sSubsystem:
795 if(options->num_subsystems >= MAX_SUBSYSTEMS) {
796 fatal("%s line %d: too many subsystems defined.",
797 filename, linenum);
798 }
Damien Millerbe484b52000-07-15 14:14:16 +1000799 arg = strdelim(&cp);
Damien Miller37023962000-07-11 17:31:38 +1000800 if (!arg || *arg == '\0')
Damien Millerf6d9e222000-06-18 14:50:44 +1000801 fatal("%s line %d: Missing subsystem name.",
802 filename, linenum);
803 for (i = 0; i < options->num_subsystems; i++)
Damien Miller37023962000-07-11 17:31:38 +1000804 if(strcmp(arg, options->subsystem_name[i]) == 0)
Damien Millerf6d9e222000-06-18 14:50:44 +1000805 fatal("%s line %d: Subsystem '%s' already defined.",
Damien Miller37023962000-07-11 17:31:38 +1000806 filename, linenum, arg);
807 options->subsystem_name[options->num_subsystems] = xstrdup(arg);
Damien Millerbe484b52000-07-15 14:14:16 +1000808 arg = strdelim(&cp);
Damien Miller37023962000-07-11 17:31:38 +1000809 if (!arg || *arg == '\0')
Damien Millerf6d9e222000-06-18 14:50:44 +1000810 fatal("%s line %d: Missing subsystem command.",
811 filename, linenum);
Damien Miller37023962000-07-11 17:31:38 +1000812 options->subsystem_command[options->num_subsystems] = xstrdup(arg);
Damien Millerf6d9e222000-06-18 14:50:44 +1000813 options->num_subsystems++;
814 break;
815
Damien Miller37023962000-07-11 17:31:38 +1000816 case sMaxStartups:
Damien Miller942da032000-08-18 13:59:06 +1000817 arg = strdelim(&cp);
818 if (!arg || *arg == '\0')
819 fatal("%s line %d: Missing MaxStartups spec.",
820 filename, linenum);
Damien Miller40857852001-07-14 12:17:33 +1000821 if ((n = sscanf(arg, "%d:%d:%d",
Damien Miller942da032000-08-18 13:59:06 +1000822 &options->max_startups_begin,
823 &options->max_startups_rate,
Damien Miller40857852001-07-14 12:17:33 +1000824 &options->max_startups)) == 3) {
Damien Miller942da032000-08-18 13:59:06 +1000825 if (options->max_startups_begin >
826 options->max_startups ||
827 options->max_startups_rate > 100 ||
828 options->max_startups_rate < 1)
Damien Miller40857852001-07-14 12:17:33 +1000829 fatal("%s line %d: Illegal MaxStartups spec.",
830 filename, linenum);
831 } else if (n != 1)
Damien Miller942da032000-08-18 13:59:06 +1000832 fatal("%s line %d: Illegal MaxStartups spec.",
Damien Miller40857852001-07-14 12:17:33 +1000833 filename, linenum);
834 else
835 options->max_startups = options->max_startups_begin;
836 break;
Damien Miller37023962000-07-11 17:31:38 +1000837
Ben Lindstrom48bd7c12001-01-09 00:35:42 +0000838 case sBanner:
839 charptr = &options->banner;
840 goto parse_filename;
Ben Lindstrombfb3a0e2001-06-05 20:25:05 +0000841 /*
842 * These options can contain %X options expanded at
843 * connect time, so that you can specify paths like:
844 *
845 * AuthorizedKeysFile /etc/ssh_keys/%u
846 */
847 case sAuthorizedKeysFile:
848 case sAuthorizedKeysFile2:
849 charptr = (opcode == sAuthorizedKeysFile ) ?
850 &options->authorized_keys_file :
851 &options->authorized_keys_file2;
852 goto parse_filename;
Ben Lindstrom1bda4c82001-06-05 19:59:08 +0000853
Ben Lindstrom5744dc42001-04-13 23:28:01 +0000854 case sClientAliveInterval:
855 intptr = &options->client_alive_interval;
Ben Lindstrom1bda4c82001-06-05 19:59:08 +0000856 goto parse_time;
857
Ben Lindstrom5744dc42001-04-13 23:28:01 +0000858 case sClientAliveCountMax:
859 intptr = &options->client_alive_count_max;
860 goto parse_int;
Ben Lindstrom1bda4c82001-06-05 19:59:08 +0000861
Ben Lindstrom91e98682001-09-12 16:32:14 +0000862 case sDeprecated:
863 log("%s line %d: Deprecated option %s",
864 filename, linenum, arg);
865 while(arg)
866 arg = strdelim(&cp);
867 break;
868
Damien Miller95def091999-11-25 00:26:21 +1100869 default:
Ben Lindstromb5cdc662001-04-16 02:13:26 +0000870 fatal("%s line %d: Missing handler for opcode %s (%d)",
871 filename, linenum, arg, opcode);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000872 }
Ben Lindstromb5cdc662001-04-16 02:13:26 +0000873 if ((arg = strdelim(&cp)) != NULL && *arg != '\0')
874 fatal("%s line %d: garbage at end of line; \"%.200s\".",
875 filename, linenum, arg);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000876 }
Damien Miller95def091999-11-25 00:26:21 +1100877 fclose(f);
Ben Lindstromb5cdc662001-04-16 02:13:26 +0000878 if (bad_options > 0)
879 fatal("%s: terminating, %d bad configuration options",
880 filename, bad_options);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000881}