summaryrefslogtreecommitdiff
path: root/sshconnect.c
diff options
context:
space:
mode:
authorBen Lindstrom <mouring@eviladmin.org>2000-12-28 16:40:05 +0000
committerBen Lindstrom <mouring@eviladmin.org>2000-12-28 16:40:05 +0000
commit4dccfa5fb73853e6c9281beac2c42a31391acdc7 (patch)
tree2a64c6b1e096010f2b5fd45a08f9878cac5d400e /sshconnect.c
parent42717bf8fff94146edf43ea266113f1a54456c62 (diff)
- (bal) OpenBSD CVS Update
- markus@cvs.openbsd.org 2000/12/28 14:25:51 [auth.h auth2.c] count authentication failures only - markus@cvs.openbsd.org 2000/12/28 14:25:03 [sshconnect.c] fingerprint for MITM attacks, too. - markus@cvs.openbsd.org 2000/12/28 12:03:57 [sshd.8 sshd.c] document -D - markus@cvs.openbsd.org 2000/12/27 14:19:21 [serverloop.c] less chatty - markus@cvs.openbsd.org 2000/12/27 12:34 [auth1.c sshconnect2.c sshd.c] typo - markus@cvs.openbsd.org 2000/12/27 12:30:19 [readconf.c readconf.h ssh.1 sshconnect.c] new option: HostKeyAlias: allow the user to record the host key under a different name. This is useful for ssh tunneling over forwarded connections or if you run multiple sshd's on different ports on the same machine. - markus@cvs.openbsd.org 2000/12/27 11:51:53 [ssh.1 ssh.c] multiple -t force pty allocation, document ORIGINAL_COMMAND - markus@cvs.openbsd.org 2000/12/27 11:41:31 [sshd.8] update for ssh-2
Diffstat (limited to 'sshconnect.c')
-rw-r--r--sshconnect.c30
1 files changed, 23 insertions, 7 deletions
diff --git a/sshconnect.c b/sshconnect.c
index 647aec79..22e69142 100644
--- a/sshconnect.c
+++ b/sshconnect.c
@@ -13,7 +13,7 @@
*/
#include "includes.h"
-RCSID("$OpenBSD: sshconnect.c,v 1.85 2000/12/21 15:10:17 markus Exp $");
+RCSID("$OpenBSD: sshconnect.c,v 1.87 2000/12/28 14:25:03 markus Exp $");
#include <openssl/bn.h>
#include <openssl/dsa.h>
@@ -499,8 +499,13 @@ check_host_key(char *host, struct sockaddr *hostaddr, Key *host_key,
break;
}
if (local) {
- debug("Forcing accepting of host key for loopback/localhost.");
- return;
+ if (options.host_key_alias == NULL) {
+ debug("Forcing accepting of host key for "
+ "loopback/localhost.");
+ return;
+ }
+ if (options.check_host_ip)
+ options.check_host_ip = 0;
}
/*
@@ -514,7 +519,7 @@ check_host_key(char *host, struct sockaddr *hostaddr, Key *host_key,
if (options.proxy_command == NULL) {
if (getnameinfo(hostaddr, salen, ntop, sizeof(ntop),
- NULL, 0, NI_NUMERICHOST) != 0)
+ NULL, 0, NI_NUMERICHOST) != 0)
fatal("check_host_key: getnameinfo failed");
ip = xstrdup(ntop);
} else {
@@ -522,6 +527,16 @@ check_host_key(char *host, struct sockaddr *hostaddr, Key *host_key,
}
/*
+ * Allow the user to record the key under a different name. This is
+ * useful for ssh tunneling over forwarded connections or if you run
+ * multiple sshd's on different ports on the same machine.
+ */
+ if (options.host_key_alias != NULL) {
+ host = options.host_key_alias;
+ debug("using hostkeyalias: %s", host);
+ }
+
+ /*
* Store the host key from the known host file in here so that we can
* compare it with the key for the IP address.
*/
@@ -592,12 +607,11 @@ check_host_key(char *host, struct sockaddr *hostaddr, Key *host_key,
} else if (options.strict_host_key_checking == 2) {
/* The default */
char prompt[1024];
- char *fp = key_fingerprint(host_key);
snprintf(prompt, sizeof(prompt),
"The authenticity of host '%.200s (%s)' can't be established.\n"
"%s key fingerprint is %s.\n"
"Are you sure you want to continue connecting (yes/no)? ",
- host, ip, type, fp);
+ host, ip, type, key_fingerprint(host_key));
if (!read_yes_or_no(prompt, -1))
fatal("Aborted by user!\n");
}
@@ -642,9 +656,11 @@ check_host_key(char *host, struct sockaddr *hostaddr, Key *host_key,
error("IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!");
error("Someone could be eavesdropping on you right now (man-in-the-middle attack)!");
error("It is also possible that the %s host key has just been changed.", type);
+ error("The fingerprint for the %s key sent by the remote host is\n%s.",
+ type, key_fingerprint(host_key));
error("Please contact your system administrator.");
error("Add correct host key in %.100s to get rid of this message.",
- user_hostfile);
+ user_hostfile);
error("Offending key in %s:%d", host_file, host_line);
/*