djm@openbsd.org | 0fddf29 | 2019-11-25 00:52:46 +0000 | [diff] [blame] | 1 | /* $OpenBSD: servconf.h,v 1.141 2019/11/25 00:52:46 djm Exp $ */ |
Ben Lindstrom | 05764b9 | 2002-03-05 01:53:02 +0000 | [diff] [blame] | 2 | |
Damien Miller | d4a8b7e | 1999-10-27 13:42:43 +1000 | [diff] [blame] | 3 | /* |
Damien Miller | 95def09 | 1999-11-25 00:26:21 +1100 | [diff] [blame] | 4 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
Damien Miller | 95def09 | 1999-11-25 00:26:21 +1100 | [diff] [blame] | 5 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
| 6 | * All rights reserved |
Damien Miller | 95def09 | 1999-11-25 00:26:21 +1100 | [diff] [blame] | 7 | * Definitions for server configuration data and for the functions reading it. |
Damien Miller | 4af5130 | 2000-04-16 11:18:38 +1000 | [diff] [blame] | 8 | * |
Damien Miller | e4340be | 2000-09-16 13:29:08 +1100 | [diff] [blame] | 9 | * As far as I am concerned, the code I have written for this software |
| 10 | * can be used freely for any purpose. Any derived versions of this |
| 11 | * software must be clearly marked as such, and if the derived work is |
| 12 | * incompatible with the protocol description in the RFC file, it must be |
| 13 | * called by a name other than "ssh" or "Secure Shell". |
Damien Miller | 95def09 | 1999-11-25 00:26:21 +1100 | [diff] [blame] | 14 | */ |
Damien Miller | d4a8b7e | 1999-10-27 13:42:43 +1000 | [diff] [blame] | 15 | |
Damien Miller | d4a8b7e | 1999-10-27 13:42:43 +1000 | [diff] [blame] | 16 | #ifndef SERVCONF_H |
| 17 | #define SERVCONF_H |
| 18 | |
Damien Miller | 34132e5 | 2000-01-14 15:45:46 +1100 | [diff] [blame] | 19 | #define MAX_PORTS 256 /* Max # ports. */ |
| 20 | |
Damien Miller | f6d9e22 | 2000-06-18 14:50:44 +1000 | [diff] [blame] | 21 | #define MAX_SUBSYSTEMS 256 /* Max # subsystems. */ |
Damien Miller | d4a8b7e | 1999-10-27 13:42:43 +1000 | [diff] [blame] | 22 | |
Ben Lindstrom | d8a9021 | 2001-02-15 03:08:27 +0000 | [diff] [blame] | 23 | /* permit_root_login */ |
| 24 | #define PERMIT_NOT_SET -1 |
| 25 | #define PERMIT_NO 0 |
| 26 | #define PERMIT_FORCED_ONLY 1 |
| 27 | #define PERMIT_NO_PASSWD 2 |
| 28 | #define PERMIT_YES 3 |
| 29 | |
Damien Miller | 69ff1df | 2011-06-23 08:30:03 +1000 | [diff] [blame] | 30 | /* use_privsep */ |
| 31 | #define PRIVSEP_OFF 0 |
| 32 | #define PRIVSEP_ON 1 |
Damien Miller | 5a5c2b9 | 2012-07-31 12:21:34 +1000 | [diff] [blame] | 33 | #define PRIVSEP_NOSANDBOX 2 |
Damien Miller | 69ff1df | 2011-06-23 08:30:03 +1000 | [diff] [blame] | 34 | |
djm@openbsd.org | dbee411 | 2017-09-12 06:32:07 +0000 | [diff] [blame] | 35 | /* PermitOpen */ |
| 36 | #define PERMITOPEN_ANY 0 |
| 37 | #define PERMITOPEN_NONE -2 |
| 38 | |
Darren Tucker | 89413db | 2004-05-24 10:36:23 +1000 | [diff] [blame] | 39 | #define DEFAULT_AUTH_FAIL_MAX 6 /* Default for MaxAuthTries */ |
Damien Miller | 7207f64 | 2008-05-19 15:34:50 +1000 | [diff] [blame] | 40 | #define DEFAULT_SESSIONS_MAX 10 /* Default for MaxSessions */ |
Ben Lindstrom | d8a9021 | 2001-02-15 03:08:27 +0000 | [diff] [blame] | 41 | |
Damien Miller | 76e95da | 2008-03-07 18:31:24 +1100 | [diff] [blame] | 42 | /* Magic name for internal sftp-server */ |
| 43 | #define INTERNAL_SFTP_NAME "internal-sftp" |
| 44 | |
djm@openbsd.org | 0fddf29 | 2019-11-25 00:52:46 +0000 | [diff] [blame] | 45 | /* PubkeyAuthOptions flags */ |
| 46 | #define PUBKEYAUTH_TOUCH_REQUIRED 1 |
| 47 | |
djm@openbsd.org | dbee411 | 2017-09-12 06:32:07 +0000 | [diff] [blame] | 48 | struct ssh; |
| 49 | struct fwd_perm_list; |
| 50 | |
djm@openbsd.org | acf559e | 2017-10-25 00:15:35 +0000 | [diff] [blame] | 51 | /* |
| 52 | * Used to store addresses from ListenAddr directives. These may be |
| 53 | * incomplete, as they may specify addresses that need to be merged |
| 54 | * with any ports requested by ListenPort. |
| 55 | */ |
| 56 | struct queued_listenaddr { |
| 57 | char *addr; |
| 58 | int port; /* <=0 if unspecified */ |
| 59 | char *rdomain; |
| 60 | }; |
| 61 | |
| 62 | /* Resolved listen addresses, grouped by optional routing domain */ |
| 63 | struct listenaddr { |
| 64 | char *rdomain; |
| 65 | struct addrinfo *addrs; |
| 66 | }; |
| 67 | |
Damien Miller | 95def09 | 1999-11-25 00:26:21 +1100 | [diff] [blame] | 68 | typedef struct { |
Damien Miller | 3dc71ad | 2009-01-28 16:31:22 +1100 | [diff] [blame] | 69 | u_int num_ports; |
| 70 | u_int ports_from_cmdline; |
| 71 | int ports[MAX_PORTS]; /* Port number to listen on. */ |
djm@openbsd.org | acf559e | 2017-10-25 00:15:35 +0000 | [diff] [blame] | 72 | struct queued_listenaddr *queued_listen_addrs; |
dtucker@openbsd.org | 531a57a | 2015-04-29 03:48:56 +0000 | [diff] [blame] | 73 | u_int num_queued_listens; |
djm@openbsd.org | acf559e | 2017-10-25 00:15:35 +0000 | [diff] [blame] | 74 | struct listenaddr *listen_addrs; |
| 75 | u_int num_listen_addrs; |
Damien Miller | 6f72280 | 2017-10-20 12:52:50 +1100 | [diff] [blame] | 76 | int address_family; /* Address family used by the server. */ |
| 77 | |
djm@openbsd.org | 35eb33f | 2017-10-25 00:17:08 +0000 | [diff] [blame] | 78 | char *routing_domain; /* Bind session to routing domain */ |
| 79 | |
Damien Miller | 6f72280 | 2017-10-20 12:52:50 +1100 | [diff] [blame] | 80 | char **host_key_files; /* Files containing host keys. */ |
djm@openbsd.org | 928f123 | 2018-11-19 04:12:32 +0000 | [diff] [blame] | 81 | int *host_key_file_userprovided; /* Key was specified by user. */ |
Damien Miller | 6f72280 | 2017-10-20 12:52:50 +1100 | [diff] [blame] | 82 | u_int num_host_key_files; /* Number of files for host keys. */ |
| 83 | char **host_cert_files; /* Files containing host certs. */ |
| 84 | u_int num_host_cert_files; /* Number of files for host certs. */ |
| 85 | |
| 86 | char *host_key_agent; /* ssh-agent socket for host keys. */ |
| 87 | char *pid_file; /* Where to put our pid */ |
Damien Miller | 95def09 | 1999-11-25 00:26:21 +1100 | [diff] [blame] | 88 | int login_grace_time; /* Disconnect if no auth in this time |
| 89 | * (sec). */ |
Ben Lindstrom | d8a9021 | 2001-02-15 03:08:27 +0000 | [diff] [blame] | 90 | int permit_root_login; /* PERMIT_*, see above */ |
Damien Miller | 95def09 | 1999-11-25 00:26:21 +1100 | [diff] [blame] | 91 | int ignore_rhosts; /* Ignore .rhosts and .shosts. */ |
| 92 | int ignore_user_known_hosts; /* Ignore ~/.ssh/known_hosts |
| 93 | * for RhostsRsaAuth */ |
| 94 | int print_motd; /* If true, print /etc/motd. */ |
Ben Lindstrom | 7bfff36 | 2001-03-26 05:45:53 +0000 | [diff] [blame] | 95 | int print_lastlog; /* If true, print lastlog */ |
Damien Miller | 95def09 | 1999-11-25 00:26:21 +1100 | [diff] [blame] | 96 | int x11_forwarding; /* If true, permit inet (spoofing) X11 fwd. */ |
| 97 | int x11_display_offset; /* What DISPLAY number to start |
| 98 | * searching at */ |
Damien Miller | 95c249f | 2002-02-05 12:11:34 +1100 | [diff] [blame] | 99 | int x11_use_localhost; /* If true, use localhost for fake X11 server. */ |
Damien Miller | d3a1857 | 2000-06-07 19:55:44 +1000 | [diff] [blame] | 100 | char *xauth_location; /* Location of xauth program */ |
Damien Miller | 5ff30c6 | 2013-10-30 22:21:50 +1100 | [diff] [blame] | 101 | int permit_tty; /* If false, deny pty allocation */ |
Damien Miller | 72e6b5c | 2014-07-04 09:00:04 +1000 | [diff] [blame] | 102 | int permit_user_rc; /* If false, deny ~/.ssh/rc execution */ |
Damien Miller | 95def09 | 1999-11-25 00:26:21 +1100 | [diff] [blame] | 103 | int strict_modes; /* If true, require string home dir modes. */ |
Damien Miller | 12c150e | 2003-12-17 16:31:10 +1100 | [diff] [blame] | 104 | int tcp_keep_alive; /* If true, set SO_KEEPALIVE. */ |
Damien Miller | 0dac6fb | 2010-11-20 15:19:38 +1100 | [diff] [blame] | 105 | int ip_qos_interactive; /* IP ToS/DSCP/class for interactive */ |
| 106 | int ip_qos_bulk; /* IP ToS/DSCP/class for bulk traffic */ |
Ben Lindstrom | 06b33aa | 2001-02-15 03:01:59 +0000 | [diff] [blame] | 107 | char *ciphers; /* Supported SSH2 ciphers. */ |
| 108 | char *macs; /* Supported SSH2 macs. */ |
Damien Miller | d5f62bf | 2010-09-24 22:11:14 +1000 | [diff] [blame] | 109 | char *kex_algorithms; /* SSH2 kex methods in order of preference. */ |
Damien Miller | 7acefbb | 2014-07-18 14:11:24 +1000 | [diff] [blame] | 110 | struct ForwardOptions fwd_opts; /* forwarding options */ |
Damien Miller | 95def09 | 1999-11-25 00:26:21 +1100 | [diff] [blame] | 111 | SyslogFacility log_facility; /* Facility for system logging. */ |
| 112 | LogLevel log_level; /* Level for system logging. */ |
Ben Lindstrom | 5eabda3 | 2001-04-12 23:34:34 +0000 | [diff] [blame] | 113 | int hostbased_authentication; /* If true, permit ssh2 hostbased auth */ |
| 114 | int hostbased_uses_name_from_packet_only; /* experimental */ |
djm@openbsd.org | 1f729f0 | 2015-01-13 07:39:19 +0000 | [diff] [blame] | 115 | char *hostbased_key_types; /* Key types allowed for hostbased */ |
markus@openbsd.org | 3a1638d | 2015-07-10 06:21:53 +0000 | [diff] [blame] | 116 | char *hostkeyalgorithms; /* SSH2 server key types */ |
djm@openbsd.org | 86e5737 | 2018-09-20 03:28:06 +0000 | [diff] [blame] | 117 | char *ca_sign_algorithms; /* Allowed CA signature algorithms */ |
Damien Miller | 0bc1bd8 | 2000-11-13 22:57:25 +1100 | [diff] [blame] | 118 | int pubkey_authentication; /* If true, permit ssh2 pubkey authentication. */ |
djm@openbsd.org | 1f729f0 | 2015-01-13 07:39:19 +0000 | [diff] [blame] | 119 | char *pubkey_key_types; /* Key types allowed for public key */ |
djm@openbsd.org | 0fddf29 | 2019-11-25 00:52:46 +0000 | [diff] [blame] | 120 | int pubkey_auth_options; /* -1 or mask of PUBKEYAUTH_* flags */ |
Damien Miller | 95def09 | 1999-11-25 00:26:21 +1100 | [diff] [blame] | 121 | int kerberos_authentication; /* If true, permit Kerberos |
| 122 | * authentication. */ |
| 123 | int kerberos_or_local_passwd; /* If true, permit kerberos |
| 124 | * and any other password |
| 125 | * authentication mechanism, |
| 126 | * such as SecurID or |
| 127 | * /etc/passwd */ |
| 128 | int kerberos_ticket_cleanup; /* If true, destroy ticket |
| 129 | * file on logout. */ |
Darren Tucker | 22ef508 | 2003-12-31 11:37:34 +1100 | [diff] [blame] | 130 | int kerberos_get_afs_token; /* If true, try to get AFS token if |
| 131 | * authenticated with Kerberos. */ |
Darren Tucker | 0efd155 | 2003-08-26 11:49:55 +1000 | [diff] [blame] | 132 | int gss_authentication; /* If true, permit GSSAPI authentication */ |
| 133 | int gss_cleanup_creds; /* If true, destroy cred cache on logout */ |
djm@openbsd.org | d7c31da | 2015-05-22 03:50:02 +0000 | [diff] [blame] | 134 | int gss_strict_acceptor; /* If true, restrict the GSSAPI acceptor name */ |
Damien Miller | 95def09 | 1999-11-25 00:26:21 +1100 | [diff] [blame] | 135 | int password_authentication; /* If true, permit password |
| 136 | * authentication. */ |
Damien Miller | 874d77b | 2000-10-14 16:23:11 +1100 | [diff] [blame] | 137 | int kbd_interactive_authentication; /* If true, permit */ |
Ben Lindstrom | 551ea37 | 2001-06-05 18:56:16 +0000 | [diff] [blame] | 138 | int challenge_response_authentication; |
Damien Miller | 95def09 | 1999-11-25 00:26:21 +1100 | [diff] [blame] | 139 | int permit_empty_passwd; /* If false, do not permit empty |
| 140 | * passwords. */ |
Ben Lindstrom | 5d860f0 | 2002-08-01 01:28:38 +0000 | [diff] [blame] | 141 | int permit_user_env; /* If true, read ~/.ssh/environment */ |
djm@openbsd.org | 95344c2 | 2018-07-03 10:59:35 +0000 | [diff] [blame] | 142 | char *permit_user_env_whitelist; /* pattern-list whitelist */ |
Ben Lindstrom | 23e0f66 | 2002-06-21 01:09:47 +0000 | [diff] [blame] | 143 | int compression; /* If true, compression is allowed */ |
Damien Miller | aa5b3f8 | 2012-12-03 09:50:54 +1100 | [diff] [blame] | 144 | int allow_tcp_forwarding; /* One of FORWARD_* */ |
Damien Miller | 7acefbb | 2014-07-18 14:11:24 +1000 | [diff] [blame] | 145 | int allow_streamlocal_forwarding; /* One of FORWARD_* */ |
Damien Miller | 4f755cd | 2008-05-19 14:57:41 +1000 | [diff] [blame] | 146 | int allow_agent_forwarding; |
djm@openbsd.org | 7844f35 | 2016-11-30 03:00:05 +0000 | [diff] [blame] | 147 | int disable_forwarding; |
Ben Lindstrom | 46c1622 | 2000-12-22 01:43:59 +0000 | [diff] [blame] | 148 | u_int num_allow_users; |
Damien Miller | 6f72280 | 2017-10-20 12:52:50 +1100 | [diff] [blame] | 149 | char **allow_users; |
Ben Lindstrom | 46c1622 | 2000-12-22 01:43:59 +0000 | [diff] [blame] | 150 | u_int num_deny_users; |
Damien Miller | 6f72280 | 2017-10-20 12:52:50 +1100 | [diff] [blame] | 151 | char **deny_users; |
Ben Lindstrom | 46c1622 | 2000-12-22 01:43:59 +0000 | [diff] [blame] | 152 | u_int num_allow_groups; |
Damien Miller | 6f72280 | 2017-10-20 12:52:50 +1100 | [diff] [blame] | 153 | char **allow_groups; |
Ben Lindstrom | 46c1622 | 2000-12-22 01:43:59 +0000 | [diff] [blame] | 154 | u_int num_deny_groups; |
Damien Miller | 6f72280 | 2017-10-20 12:52:50 +1100 | [diff] [blame] | 155 | char **deny_groups; |
Damien Miller | f6d9e22 | 2000-06-18 14:50:44 +1000 | [diff] [blame] | 156 | |
Ben Lindstrom | 46c1622 | 2000-12-22 01:43:59 +0000 | [diff] [blame] | 157 | u_int num_subsystems; |
Damien Miller | f6d9e22 | 2000-06-18 14:50:44 +1000 | [diff] [blame] | 158 | char *subsystem_name[MAX_SUBSYSTEMS]; |
| 159 | char *subsystem_command[MAX_SUBSYSTEMS]; |
Damien Miller | 917f9b6 | 2006-07-10 20:36:47 +1000 | [diff] [blame] | 160 | char *subsystem_args[MAX_SUBSYSTEMS]; |
Damien Miller | 3702396 | 2000-07-11 17:31:38 +1000 | [diff] [blame] | 161 | |
Darren Tucker | 46bc075 | 2004-05-02 22:11:30 +1000 | [diff] [blame] | 162 | u_int num_accept_env; |
Damien Miller | 6f72280 | 2017-10-20 12:52:50 +1100 | [diff] [blame] | 163 | char **accept_env; |
djm@openbsd.org | 2801375 | 2018-06-09 03:03:10 +0000 | [diff] [blame] | 164 | u_int num_setenv; |
| 165 | char **setenv; |
Darren Tucker | 46bc075 | 2004-05-02 22:11:30 +1000 | [diff] [blame] | 166 | |
Damien Miller | 942da03 | 2000-08-18 13:59:06 +1000 | [diff] [blame] | 167 | int max_startups_begin; |
| 168 | int max_startups_rate; |
Damien Miller | 3702396 | 2000-07-11 17:31:38 +1000 | [diff] [blame] | 169 | int max_startups; |
Darren Tucker | 89413db | 2004-05-24 10:36:23 +1000 | [diff] [blame] | 170 | int max_authtries; |
Damien Miller | 7207f64 | 2008-05-19 15:34:50 +1000 | [diff] [blame] | 171 | int max_sessions; |
Ben Lindstrom | 48bd7c1 | 2001-01-09 00:35:42 +0000 | [diff] [blame] | 172 | char *banner; /* SSH-2 banner message */ |
Damien Miller | 3a961dc | 2003-06-03 10:25:48 +1000 | [diff] [blame] | 173 | int use_dns; |
Ben Lindstrom | 5744dc4 | 2001-04-13 23:28:01 +0000 | [diff] [blame] | 174 | int client_alive_interval; /* |
Damien Miller | 9f0f5c6 | 2001-12-21 14:45:46 +1100 | [diff] [blame] | 175 | * poke the client this often to |
| 176 | * see if it's still there |
Ben Lindstrom | 5744dc4 | 2001-04-13 23:28:01 +0000 | [diff] [blame] | 177 | */ |
| 178 | int client_alive_count_max; /* |
Ben Lindstrom | 7bb37b2 | 2001-09-12 16:40:05 +0000 | [diff] [blame] | 179 | * If the client is unresponsive |
| 180 | * for this many intervals above, |
Damien Miller | 9f0f5c6 | 2001-12-21 14:45:46 +1100 | [diff] [blame] | 181 | * disconnect the session |
Ben Lindstrom | 5744dc4 | 2001-04-13 23:28:01 +0000 | [diff] [blame] | 182 | */ |
Kevin Steves | e468de6 | 2001-07-04 18:37:20 +0000 | [diff] [blame] | 183 | |
Damien Miller | 6f72280 | 2017-10-20 12:52:50 +1100 | [diff] [blame] | 184 | u_int num_authkeys_files; /* Files containing public keys */ |
| 185 | char **authorized_keys_files; |
Damien Miller | d27b947 | 2005-12-13 19:29:02 +1100 | [diff] [blame] | 186 | |
Damien Miller | e275443 | 2006-07-24 14:06:47 +1000 | [diff] [blame] | 187 | char *adm_forced_command; |
| 188 | |
Damien Miller | 4e448a3 | 2003-05-14 15:11:48 +1000 | [diff] [blame] | 189 | int use_pam; /* Enable auth via PAM */ |
Damien Miller | d27b947 | 2005-12-13 19:29:02 +1100 | [diff] [blame] | 190 | |
| 191 | int permit_tun; |
Damien Miller | a765cf4 | 2006-07-24 14:08:13 +1000 | [diff] [blame] | 192 | |
djm@openbsd.org | 115063a | 2018-06-06 18:22:41 +0000 | [diff] [blame] | 193 | char **permitted_opens; /* May also be one of PERMITOPEN_* */ |
| 194 | u_int num_permitted_opens; |
djm@openbsd.org | 93c06ab | 2018-06-06 18:23:32 +0000 | [diff] [blame] | 195 | char **permitted_listens; /* May also be one of PERMITOPEN_* */ |
| 196 | u_int num_permitted_listens; |
Damien Miller | d8cb1f1 | 2008-02-10 22:40:12 +1100 | [diff] [blame] | 197 | |
| 198 | char *chroot_directory; |
Damien Miller | 1aed65e | 2010-03-04 21:53:35 +1100 | [diff] [blame] | 199 | char *revoked_keys_file; |
| 200 | char *trusted_user_ca_keys; |
Damien Miller | 09d3e12 | 2012-10-31 08:58:58 +1100 | [diff] [blame] | 201 | char *authorized_keys_command; |
| 202 | char *authorized_keys_command_user; |
djm@openbsd.org | bcc50d8 | 2015-05-21 06:43:30 +0000 | [diff] [blame] | 203 | char *authorized_principals_file; |
| 204 | char *authorized_principals_command; |
| 205 | char *authorized_principals_command_user; |
Damien Miller | 2352881 | 2012-04-22 11:24:43 +1000 | [diff] [blame] | 206 | |
Darren Tucker | 5f96f3b | 2013-05-16 20:29:28 +1000 | [diff] [blame] | 207 | int64_t rekey_limit; |
| 208 | int rekey_interval; |
| 209 | |
Damien Miller | 2352881 | 2012-04-22 11:24:43 +1000 | [diff] [blame] | 210 | char *version_addendum; /* Appended to SSH banner */ |
Damien Miller | a6e3f01 | 2012-11-04 23:21:40 +1100 | [diff] [blame] | 211 | |
| 212 | u_int num_auth_methods; |
Damien Miller | 6f72280 | 2017-10-20 12:52:50 +1100 | [diff] [blame] | 213 | char **auth_methods; |
djm@openbsd.org | 56d1c83 | 2014-12-21 22:27:55 +0000 | [diff] [blame] | 214 | |
| 215 | int fingerprint_hash; |
djm@openbsd.org | 8f57495 | 2017-06-24 06:34:38 +0000 | [diff] [blame] | 216 | int expose_userauth_info; |
dtucker@openbsd.org | e9d910b | 2018-04-13 03:57:26 +0000 | [diff] [blame] | 217 | u_int64_t timing_secret; |
Damien Miller | 95def09 | 1999-11-25 00:26:21 +1100 | [diff] [blame] | 218 | } ServerOptions; |
Damien Miller | d4a8b7e | 1999-10-27 13:42:43 +1000 | [diff] [blame] | 219 | |
Darren Tucker | fbcf827 | 2012-05-19 19:37:01 +1000 | [diff] [blame] | 220 | /* Information about the incoming connection as used by Match */ |
| 221 | struct connection_info { |
| 222 | const char *user; |
| 223 | const char *host; /* possibly resolved hostname */ |
| 224 | const char *address; /* remote address */ |
| 225 | const char *laddress; /* local address */ |
| 226 | int lport; /* local port */ |
djm@openbsd.org | 68af80e | 2017-10-25 00:19:47 +0000 | [diff] [blame] | 227 | const char *rdomain; /* routing domain if available */ |
dtucker@openbsd.org | e826bbc | 2019-04-18 18:56:16 +0000 | [diff] [blame] | 228 | int test; /* test mode, allow some attributes to be |
| 229 | * unspecified */ |
Darren Tucker | fbcf827 | 2012-05-19 19:37:01 +1000 | [diff] [blame] | 230 | }; |
| 231 | |
| 232 | |
Damien Miller | f2e407e | 2011-05-20 19:04:14 +1000 | [diff] [blame] | 233 | /* |
| 234 | * These are string config options that must be copied between the |
| 235 | * Match sub-config and the main config, and must be sent from the |
| 236 | * privsep slave to the privsep master. We use a macro to ensure all |
| 237 | * the options are copied and the copies are done in the correct order. |
Damien Miller | 534b2cc | 2013-12-05 14:07:27 +1100 | [diff] [blame] | 238 | * |
| 239 | * NB. an option must appear in servconf.c:copy_set_server_options() or |
| 240 | * COPY_MATCH_STRING_OPTS here but never both. |
Damien Miller | f2e407e | 2011-05-20 19:04:14 +1000 | [diff] [blame] | 241 | */ |
| 242 | #define COPY_MATCH_STRING_OPTS() do { \ |
| 243 | M_CP_STROPT(banner); \ |
| 244 | M_CP_STROPT(trusted_user_ca_keys); \ |
| 245 | M_CP_STROPT(revoked_keys_file); \ |
Damien Miller | 4413844 | 2013-01-09 15:56:45 +1100 | [diff] [blame] | 246 | M_CP_STROPT(authorized_keys_command); \ |
| 247 | M_CP_STROPT(authorized_keys_command_user); \ |
djm@openbsd.org | bcc50d8 | 2015-05-21 06:43:30 +0000 | [diff] [blame] | 248 | M_CP_STROPT(authorized_principals_file); \ |
| 249 | M_CP_STROPT(authorized_principals_command); \ |
| 250 | M_CP_STROPT(authorized_principals_command_user); \ |
djm@openbsd.org | 1f729f0 | 2015-01-13 07:39:19 +0000 | [diff] [blame] | 251 | M_CP_STROPT(hostbased_key_types); \ |
| 252 | M_CP_STROPT(pubkey_key_types); \ |
djm@openbsd.org | 86e5737 | 2018-09-20 03:28:06 +0000 | [diff] [blame] | 253 | M_CP_STROPT(ca_sign_algorithms); \ |
djm@openbsd.org | 35eb33f | 2017-10-25 00:17:08 +0000 | [diff] [blame] | 254 | M_CP_STROPT(routing_domain); \ |
djm@openbsd.org | 95344c2 | 2018-07-03 10:59:35 +0000 | [diff] [blame] | 255 | M_CP_STROPT(permit_user_env_whitelist); \ |
Damien Miller | d8478b6 | 2011-05-29 21:39:36 +1000 | [diff] [blame] | 256 | M_CP_STRARRAYOPT(authorized_keys_files, num_authkeys_files); \ |
Damien Miller | c24da77 | 2012-06-20 21:53:58 +1000 | [diff] [blame] | 257 | M_CP_STRARRAYOPT(allow_users, num_allow_users); \ |
| 258 | M_CP_STRARRAYOPT(deny_users, num_deny_users); \ |
| 259 | M_CP_STRARRAYOPT(allow_groups, num_allow_groups); \ |
| 260 | M_CP_STRARRAYOPT(deny_groups, num_deny_groups); \ |
| 261 | M_CP_STRARRAYOPT(accept_env, num_accept_env); \ |
Damien Miller | a6e3f01 | 2012-11-04 23:21:40 +1100 | [diff] [blame] | 262 | M_CP_STRARRAYOPT(auth_methods, num_auth_methods); \ |
Damien Miller | 6f72280 | 2017-10-20 12:52:50 +1100 | [diff] [blame] | 263 | M_CP_STRARRAYOPT(permitted_opens, num_permitted_opens); \ |
djm@openbsd.org | 93c06ab | 2018-06-06 18:23:32 +0000 | [diff] [blame] | 264 | M_CP_STRARRAYOPT(permitted_listens, num_permitted_listens); \ |
Damien Miller | f2e407e | 2011-05-20 19:04:14 +1000 | [diff] [blame] | 265 | } while (0) |
| 266 | |
djm@openbsd.org | 172a592 | 2019-01-19 21:37:48 +0000 | [diff] [blame] | 267 | struct connection_info *get_connection_info(struct ssh *, int, int); |
Ben Lindstrom | 4cc240d | 2001-07-04 04:46:56 +0000 | [diff] [blame] | 268 | void initialize_server_options(ServerOptions *); |
Ben Lindstrom | 4cc240d | 2001-07-04 04:46:56 +0000 | [diff] [blame] | 269 | void fill_default_server_options(ServerOptions *); |
Darren Tucker | 4515047 | 2006-07-12 22:34:17 +1000 | [diff] [blame] | 270 | int process_server_config_line(ServerOptions *, char *, const char *, int, |
Darren Tucker | fbcf827 | 2012-05-19 19:37:01 +1000 | [diff] [blame] | 271 | int *, struct connection_info *); |
djm@openbsd.org | dbee411 | 2017-09-12 06:32:07 +0000 | [diff] [blame] | 272 | void process_permitopen(struct ssh *ssh, ServerOptions *options); |
markus@openbsd.org | 2808d18 | 2018-07-09 21:26:02 +0000 | [diff] [blame] | 273 | void load_server_config(const char *, struct sshbuf *); |
| 274 | void parse_server_config(ServerOptions *, const char *, struct sshbuf *, |
Darren Tucker | fbcf827 | 2012-05-19 19:37:01 +1000 | [diff] [blame] | 275 | struct connection_info *); |
| 276 | void parse_server_match_config(ServerOptions *, struct connection_info *); |
| 277 | int parse_server_match_testspec(struct connection_info *, char *); |
| 278 | int server_match_spec_complete(struct connection_info *); |
Darren Tucker | 1629c07 | 2007-02-19 22:25:37 +1100 | [diff] [blame] | 279 | void copy_set_server_options(ServerOptions *, ServerOptions *, int); |
Darren Tucker | e7140f2 | 2008-06-10 23:01:51 +1000 | [diff] [blame] | 280 | void dump_config(ServerOptions *); |
Darren Tucker | 88b6fb2 | 2010-01-13 22:44:29 +1100 | [diff] [blame] | 281 | char *derelativise_path(const char *); |
Damien Miller | 6f72280 | 2017-10-20 12:52:50 +1100 | [diff] [blame] | 282 | void servconf_add_hostkey(const char *, const int, |
djm@openbsd.org | 928f123 | 2018-11-19 04:12:32 +0000 | [diff] [blame] | 283 | ServerOptions *, const char *path, int); |
Damien Miller | 6f72280 | 2017-10-20 12:52:50 +1100 | [diff] [blame] | 284 | void servconf_add_hostcert(const char *, const int, |
| 285 | ServerOptions *, const char *path); |
Damien Miller | d4a8b7e | 1999-10-27 13:42:43 +1000 | [diff] [blame] | 286 | |
Damien Miller | 95def09 | 1999-11-25 00:26:21 +1100 | [diff] [blame] | 287 | #endif /* SERVCONF_H */ |