1 /* $OpenBSD: servconf.c,v 1.186 2008/07/04 03:44:59 djm Exp $ */
3 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
6 * As far as I am concerned, the code I have written for this software
7 * can be used freely for any purpose. Any derived versions of this
8 * software must be clearly marked as such, and if the derived work is
9 * incompatible with the protocol description in the RFC file, it must be
10 * called by a name other than "ssh" or "Secure Shell".
15 #include <sys/types.h>
16 #include <sys/socket.h>
28 #include "openbsd-compat/sys-queue.h"
35 #include "pathnames.h"
43 #include "groupaccess.h"
45 static void add_listen_addr(ServerOptions *, char *, u_short);
46 static void add_one_listen_addr(ServerOptions *, char *, u_short);
48 /* Use of privilege separation or not */
49 extern int use_privsep;
52 /* Initializes the server options to their default values. */
55 initialize_server_options(ServerOptions *options)
57 memset(options, 0, sizeof(*options));
59 /* Portable-specific options */
60 options->use_pam = -1;
62 /* Standard Options */
63 options->num_ports = 0;
64 options->ports_from_cmdline = 0;
65 options->listen_addrs = NULL;
66 options->address_family = -1;
67 options->num_host_key_files = 0;
68 options->pid_file = NULL;
69 options->server_key_bits = -1;
70 options->login_grace_time = -1;
71 options->key_regeneration_time = -1;
72 options->permit_root_login = PERMIT_NOT_SET;
73 options->ignore_rhosts = -1;
74 options->ignore_user_known_hosts = -1;
75 options->print_motd = -1;
76 options->print_lastlog = -1;
77 options->x11_forwarding = -1;
78 options->x11_display_offset = -1;
79 options->x11_use_localhost = -1;
80 options->xauth_location = NULL;
81 options->strict_modes = -1;
82 options->tcp_keep_alive = -1;
83 options->log_facility = SYSLOG_FACILITY_NOT_SET;
84 options->log_level = SYSLOG_LEVEL_NOT_SET;
85 options->rhosts_rsa_authentication = -1;
86 options->hostbased_authentication = -1;
87 options->hostbased_uses_name_from_packet_only = -1;
88 options->rsa_authentication = -1;
89 options->pubkey_authentication = -1;
90 options->kerberos_authentication = -1;
91 options->kerberos_or_local_passwd = -1;
92 options->kerberos_ticket_cleanup = -1;
93 options->kerberos_get_afs_token = -1;
94 options->gss_authentication=-1;
95 options->gss_cleanup_creds = -1;
96 options->password_authentication = -1;
97 options->kbd_interactive_authentication = -1;
98 options->challenge_response_authentication = -1;
99 options->permit_blacklisted_keys = -1;
100 options->permit_empty_passwd = -1;
101 options->permit_user_env = -1;
102 options->use_login = -1;
103 options->compression = -1;
104 options->allow_tcp_forwarding = -1;
105 options->allow_agent_forwarding = -1;
106 options->num_allow_users = 0;
107 options->num_deny_users = 0;
108 options->num_allow_groups = 0;
109 options->num_deny_groups = 0;
110 options->ciphers = NULL;
111 options->macs = NULL;
112 options->protocol = SSH_PROTO_UNKNOWN;
113 options->gateway_ports = -1;
114 options->num_subsystems = 0;
115 options->max_startups_begin = -1;
116 options->max_startups_rate = -1;
117 options->max_startups = -1;
118 options->max_authtries = -1;
119 options->max_sessions = -1;
120 options->banner = NULL;
121 options->use_dns = -1;
122 options->client_alive_interval = -1;
123 options->client_alive_count_max = -1;
124 options->authorized_keys_file = NULL;
125 options->authorized_keys_file2 = NULL;
126 options->num_accept_env = 0;
127 options->permit_tun = -1;
128 options->num_permitted_opens = -1;
129 options->adm_forced_command = NULL;
130 options->chroot_directory = NULL;
134 fill_default_server_options(ServerOptions *options)
136 /* Portable-specific options */
137 if (options->use_pam == -1)
138 options->use_pam = 0;
140 /* Standard Options */
141 if (options->protocol == SSH_PROTO_UNKNOWN)
142 options->protocol = SSH_PROTO_2;
143 if (options->num_host_key_files == 0) {
144 /* fill default hostkeys for protocols */
145 if (options->protocol & SSH_PROTO_1)
146 options->host_key_files[options->num_host_key_files++] =
148 if (options->protocol & SSH_PROTO_2) {
149 options->host_key_files[options->num_host_key_files++] =
150 _PATH_HOST_RSA_KEY_FILE;
151 options->host_key_files[options->num_host_key_files++] =
152 _PATH_HOST_DSA_KEY_FILE;
155 if (options->num_ports == 0)
156 options->ports[options->num_ports++] = SSH_DEFAULT_PORT;
157 if (options->listen_addrs == NULL)
158 add_listen_addr(options, NULL, 0);
159 if (options->pid_file == NULL)
160 options->pid_file = _PATH_SSH_DAEMON_PID_FILE;
161 if (options->server_key_bits == -1)
162 options->server_key_bits = 1024;
163 if (options->login_grace_time == -1)
164 options->login_grace_time = 120;
165 if (options->key_regeneration_time == -1)
166 options->key_regeneration_time = 3600;
167 if (options->permit_root_login == PERMIT_NOT_SET)
168 options->permit_root_login = PERMIT_NO;
169 if (options->ignore_rhosts == -1)
170 options->ignore_rhosts = 1;
171 if (options->ignore_user_known_hosts == -1)
172 options->ignore_user_known_hosts = 0;
173 if (options->print_motd == -1)
174 options->print_motd = 1;
175 if (options->print_lastlog == -1)
176 options->print_lastlog = 1;
177 if (options->x11_forwarding == -1)
178 options->x11_forwarding = 1;
179 if (options->x11_display_offset == -1)
180 options->x11_display_offset = 10;
181 if (options->x11_use_localhost == -1)
182 options->x11_use_localhost = 1;
183 if (options->xauth_location == NULL)
184 options->xauth_location = _PATH_XAUTH;
185 if (options->strict_modes == -1)
186 options->strict_modes = 1;
187 if (options->tcp_keep_alive == -1)
188 options->tcp_keep_alive = 1;
189 if (options->log_facility == SYSLOG_FACILITY_NOT_SET)
190 options->log_facility = SYSLOG_FACILITY_AUTH;
191 if (options->log_level == SYSLOG_LEVEL_NOT_SET)
192 options->log_level = SYSLOG_LEVEL_INFO;
193 if (options->rhosts_rsa_authentication == -1)
194 options->rhosts_rsa_authentication = 0;
195 if (options->hostbased_authentication == -1)
196 options->hostbased_authentication = 0;
197 if (options->hostbased_uses_name_from_packet_only == -1)
198 options->hostbased_uses_name_from_packet_only = 0;
199 if (options->rsa_authentication == -1)
200 options->rsa_authentication = 1;
201 if (options->pubkey_authentication == -1)
202 options->pubkey_authentication = 1;
203 if (options->kerberos_authentication == -1)
204 options->kerberos_authentication = 0;
205 if (options->kerberos_or_local_passwd == -1)
206 options->kerberos_or_local_passwd = 1;
207 if (options->kerberos_ticket_cleanup == -1)
208 options->kerberos_ticket_cleanup = 1;
209 if (options->kerberos_get_afs_token == -1)
210 options->kerberos_get_afs_token = 0;
211 if (options->gss_authentication == -1)
212 options->gss_authentication = 0;
213 if (options->gss_cleanup_creds == -1)
214 options->gss_cleanup_creds = 1;
215 if (options->password_authentication == -1)
216 options->password_authentication = 1;
217 if (options->kbd_interactive_authentication == -1)
218 options->kbd_interactive_authentication = 0;
219 if (options->challenge_response_authentication == -1)
220 options->challenge_response_authentication = 1;
221 if (options->permit_blacklisted_keys == -1)
222 options->permit_blacklisted_keys = 0;
223 if (options->permit_empty_passwd == -1)
224 options->permit_empty_passwd = 0;
225 if (options->permit_user_env == -1)
226 options->permit_user_env = 0;
227 if (options->use_login == -1)
228 options->use_login = 0;
229 if (options->compression == -1)
230 options->compression = COMP_DELAYED;
231 if (options->allow_tcp_forwarding == -1)
232 options->allow_tcp_forwarding = 1;
233 if (options->allow_agent_forwarding == -1)
234 options->allow_agent_forwarding = 1;
235 if (options->gateway_ports == -1)
236 options->gateway_ports = 0;
237 if (options->max_startups == -1)
238 options->max_startups = 10;
239 if (options->max_startups_rate == -1)
240 options->max_startups_rate = 100; /* 100% */
241 if (options->max_startups_begin == -1)
242 options->max_startups_begin = options->max_startups;
243 if (options->max_authtries == -1)
244 options->max_authtries = DEFAULT_AUTH_FAIL_MAX;
245 if (options->max_sessions == -1)
246 options->max_sessions = DEFAULT_SESSIONS_MAX;
247 if (options->use_dns == -1)
248 options->use_dns = 1;
249 if (options->client_alive_interval == -1)
250 options->client_alive_interval = 0;
251 if (options->client_alive_count_max == -1)
252 options->client_alive_count_max = 3;
253 if (options->authorized_keys_file2 == NULL) {
254 /* authorized_keys_file2 falls back to authorized_keys_file */
255 if (options->authorized_keys_file != NULL)
256 options->authorized_keys_file2 = options->authorized_keys_file;
258 options->authorized_keys_file2 = _PATH_SSH_USER_PERMITTED_KEYS2;
260 if (options->authorized_keys_file == NULL)
261 options->authorized_keys_file = _PATH_SSH_USER_PERMITTED_KEYS;
262 if (options->permit_tun == -1)
263 options->permit_tun = SSH_TUNMODE_NO;
265 /* Turn privilege separation on by default */
266 if (use_privsep == -1)
270 if (use_privsep && options->compression == 1) {
271 error("This platform does not support both privilege "
272 "separation and compression");
273 error("Compression disabled");
274 options->compression = 0;
280 /* Keyword tokens. */
282 sBadOption, /* == unknown option */
283 /* Portable-specific options */
285 /* Standard Options */
286 sPort, sHostKeyFile, sServerKeyBits, sLoginGraceTime, sKeyRegenerationTime,
287 sPermitRootLogin, sLogFacility, sLogLevel,
288 sRhostsRSAAuthentication, sRSAAuthentication,
289 sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup,
290 sKerberosGetAFSToken,
291 sKerberosTgtPassing, sChallengeResponseAuthentication,
292 sPasswordAuthentication, sKbdInteractiveAuthentication,
293 sListenAddress, sAddressFamily,
294 sPrintMotd, sPrintLastLog, sIgnoreRhosts,
295 sX11Forwarding, sX11DisplayOffset, sX11UseLocalhost,
296 sStrictModes, sPermitBlacklistedKeys, sEmptyPasswd, sTCPKeepAlive,
297 sPermitUserEnvironment, sUseLogin, sAllowTcpForwarding, sCompression,
298 sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups,
299 sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile,
300 sGatewayPorts, sPubkeyAuthentication, sXAuthLocation, sSubsystem,
301 sMaxStartups, sMaxAuthTries, sMaxSessions,
302 sBanner, sUseDNS, sHostbasedAuthentication,
303 sHostbasedUsesNameFromPacketOnly, sClientAliveInterval,
304 sClientAliveCountMax, sAuthorizedKeysFile, sAuthorizedKeysFile2,
305 sGssAuthentication, sGssCleanupCreds, sAcceptEnv, sPermitTunnel,
306 sMatch, sPermitOpen, sForceCommand, sChrootDirectory,
307 sUsePrivilegeSeparation, sAllowAgentForwarding,
309 sDeprecated, sUnsupported
312 #define SSHCFG_GLOBAL 0x01 /* allowed in main section of sshd_config */
313 #define SSHCFG_MATCH 0x02 /* allowed inside a Match section */
314 #define SSHCFG_ALL (SSHCFG_GLOBAL|SSHCFG_MATCH)
316 /* Textual representation of the tokens. */
319 ServerOpCodes opcode;
322 /* Portable-specific options */
324 { "usepam", sUsePAM, SSHCFG_GLOBAL },
326 { "usepam", sUnsupported, SSHCFG_GLOBAL },
328 { "pamauthenticationviakbdint", sDeprecated, SSHCFG_GLOBAL },
329 /* Standard Options */
330 { "port", sPort, SSHCFG_GLOBAL },
331 { "hostkey", sHostKeyFile, SSHCFG_GLOBAL },
332 { "hostdsakey", sHostKeyFile, SSHCFG_GLOBAL }, /* alias */
333 { "pidfile", sPidFile, SSHCFG_GLOBAL },
334 { "serverkeybits", sServerKeyBits, SSHCFG_GLOBAL },
335 { "logingracetime", sLoginGraceTime, SSHCFG_GLOBAL },
336 { "keyregenerationinterval", sKeyRegenerationTime, SSHCFG_GLOBAL },
337 { "permitrootlogin", sPermitRootLogin, SSHCFG_ALL },
338 { "syslogfacility", sLogFacility, SSHCFG_GLOBAL },
339 { "loglevel", sLogLevel, SSHCFG_GLOBAL },
340 { "rhostsauthentication", sDeprecated, SSHCFG_GLOBAL },
341 { "rhostsrsaauthentication", sRhostsRSAAuthentication, SSHCFG_ALL },
342 { "hostbasedauthentication", sHostbasedAuthentication, SSHCFG_ALL },
343 { "hostbasedusesnamefrompacketonly", sHostbasedUsesNameFromPacketOnly, SSHCFG_GLOBAL },
344 { "rsaauthentication", sRSAAuthentication, SSHCFG_ALL },
345 { "pubkeyauthentication", sPubkeyAuthentication, SSHCFG_ALL },
346 { "dsaauthentication", sPubkeyAuthentication, SSHCFG_GLOBAL }, /* alias */
348 { "kerberosauthentication", sKerberosAuthentication, SSHCFG_ALL },
349 { "kerberosorlocalpasswd", sKerberosOrLocalPasswd, SSHCFG_GLOBAL },
350 { "kerberosticketcleanup", sKerberosTicketCleanup, SSHCFG_GLOBAL },
352 { "kerberosgetafstoken", sKerberosGetAFSToken, SSHCFG_GLOBAL },
354 { "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL },
357 { "kerberosauthentication", sUnsupported, SSHCFG_ALL },
358 { "kerberosorlocalpasswd", sUnsupported, SSHCFG_GLOBAL },
359 { "kerberosticketcleanup", sUnsupported, SSHCFG_GLOBAL },
360 { "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL },
362 { "kerberostgtpassing", sUnsupported, SSHCFG_GLOBAL },
363 { "afstokenpassing", sUnsupported, SSHCFG_GLOBAL },
365 { "gssapiauthentication", sGssAuthentication, SSHCFG_ALL },
366 { "gssapicleanupcredentials", sGssCleanupCreds, SSHCFG_GLOBAL },
368 { "gssapiauthentication", sUnsupported, SSHCFG_ALL },
369 { "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL },
371 { "passwordauthentication", sPasswordAuthentication, SSHCFG_ALL },
372 { "kbdinteractiveauthentication", sKbdInteractiveAuthentication, SSHCFG_ALL },
373 { "challengeresponseauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL },
374 { "skeyauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL }, /* alias */
375 { "checkmail", sDeprecated, SSHCFG_GLOBAL },
376 { "listenaddress", sListenAddress, SSHCFG_GLOBAL },
377 { "addressfamily", sAddressFamily, SSHCFG_GLOBAL },
378 { "printmotd", sPrintMotd, SSHCFG_GLOBAL },
379 { "printlastlog", sPrintLastLog, SSHCFG_GLOBAL },
380 { "ignorerhosts", sIgnoreRhosts, SSHCFG_GLOBAL },
381 { "ignoreuserknownhosts", sIgnoreUserKnownHosts, SSHCFG_GLOBAL },
382 { "x11forwarding", sX11Forwarding, SSHCFG_ALL },
383 { "x11displayoffset", sX11DisplayOffset, SSHCFG_ALL },
384 { "x11uselocalhost", sX11UseLocalhost, SSHCFG_ALL },
385 { "xauthlocation", sXAuthLocation, SSHCFG_GLOBAL },
386 { "strictmodes", sStrictModes, SSHCFG_GLOBAL },
387 { "permitblacklistedkeys", sPermitBlacklistedKeys, SSHCFG_GLOBAL },
388 { "permitemptypasswords", sEmptyPasswd, SSHCFG_GLOBAL },
389 { "permituserenvironment", sPermitUserEnvironment, SSHCFG_GLOBAL },
390 { "uselogin", sUseLogin, SSHCFG_GLOBAL },
391 { "compression", sCompression, SSHCFG_GLOBAL },
392 { "tcpkeepalive", sTCPKeepAlive, SSHCFG_GLOBAL },
393 { "keepalive", sTCPKeepAlive, SSHCFG_GLOBAL }, /* obsolete alias */
394 { "allowtcpforwarding", sAllowTcpForwarding, SSHCFG_ALL },
395 { "allowagentforwarding", sAllowAgentForwarding, SSHCFG_ALL },
396 { "allowusers", sAllowUsers, SSHCFG_GLOBAL },
397 { "denyusers", sDenyUsers, SSHCFG_GLOBAL },
398 { "allowgroups", sAllowGroups, SSHCFG_GLOBAL },
399 { "denygroups", sDenyGroups, SSHCFG_GLOBAL },
400 { "ciphers", sCiphers, SSHCFG_GLOBAL },
401 { "macs", sMacs, SSHCFG_GLOBAL },
402 { "protocol", sProtocol, SSHCFG_GLOBAL },
403 { "gatewayports", sGatewayPorts, SSHCFG_ALL },
404 { "subsystem", sSubsystem, SSHCFG_GLOBAL },
405 { "maxstartups", sMaxStartups, SSHCFG_GLOBAL },
406 { "maxauthtries", sMaxAuthTries, SSHCFG_ALL },
407 { "maxsessions", sMaxSessions, SSHCFG_ALL },
408 { "banner", sBanner, SSHCFG_ALL },
409 { "usedns", sUseDNS, SSHCFG_GLOBAL },
410 { "verifyreversemapping", sDeprecated, SSHCFG_GLOBAL },
411 { "reversemappingcheck", sDeprecated, SSHCFG_GLOBAL },
412 { "clientaliveinterval", sClientAliveInterval, SSHCFG_GLOBAL },
413 { "clientalivecountmax", sClientAliveCountMax, SSHCFG_GLOBAL },
414 { "authorizedkeysfile", sAuthorizedKeysFile, SSHCFG_GLOBAL },
415 { "authorizedkeysfile2", sAuthorizedKeysFile2, SSHCFG_GLOBAL },
416 { "useprivilegeseparation", sUsePrivilegeSeparation, SSHCFG_GLOBAL },
417 { "versionaddendum", sVersionAddendum , SSHCFG_GLOBAL },
418 { "acceptenv", sAcceptEnv, SSHCFG_GLOBAL },
419 { "permittunnel", sPermitTunnel, SSHCFG_GLOBAL },
420 { "match", sMatch, SSHCFG_ALL },
421 { "permitopen", sPermitOpen, SSHCFG_ALL },
422 { "forcecommand", sForceCommand, SSHCFG_ALL },
423 { "chrootdirectory", sChrootDirectory, SSHCFG_ALL },
424 { NULL, sBadOption, 0 }
431 { SSH_TUNMODE_NO, "no" },
432 { SSH_TUNMODE_POINTOPOINT, "point-to-point" },
433 { SSH_TUNMODE_ETHERNET, "ethernet" },
434 { SSH_TUNMODE_YES, "yes" },
439 * Returns the number of the token pointed to by cp or sBadOption.
443 parse_token(const char *cp, const char *filename,
444 int linenum, u_int *flags)
448 for (i = 0; keywords[i].name; i++)
449 if (strcasecmp(cp, keywords[i].name) == 0) {
450 *flags = keywords[i].flags;
451 return keywords[i].opcode;
454 error("%s: line %d: Bad configuration option: %s",
455 filename, linenum, cp);
460 add_listen_addr(ServerOptions *options, char *addr, u_short port)
464 if (options->num_ports == 0)
465 options->ports[options->num_ports++] = SSH_DEFAULT_PORT;
466 if (options->address_family == -1)
467 options->address_family = AF_UNSPEC;
469 for (i = 0; i < options->num_ports; i++)
470 add_one_listen_addr(options, addr, options->ports[i]);
472 add_one_listen_addr(options, addr, port);
476 add_one_listen_addr(ServerOptions *options, char *addr, u_short port)
478 struct addrinfo hints, *ai, *aitop;
479 char strport[NI_MAXSERV];
482 memset(&hints, 0, sizeof(hints));
483 hints.ai_family = options->address_family;
484 hints.ai_socktype = SOCK_STREAM;
485 hints.ai_flags = (addr == NULL) ? AI_PASSIVE : 0;
486 snprintf(strport, sizeof strport, "%u", port);
487 if ((gaierr = getaddrinfo(addr, strport, &hints, &aitop)) != 0)
488 fatal("bad addr or host: %s (%s)",
489 addr ? addr : "<NULL>",
490 ssh_gai_strerror(gaierr));
491 for (ai = aitop; ai->ai_next; ai = ai->ai_next)
493 ai->ai_next = options->listen_addrs;
494 options->listen_addrs = aitop;
498 * The strategy for the Match blocks is that the config file is parsed twice.
500 * The first time is at startup. activep is initialized to 1 and the
501 * directives in the global context are processed and acted on. Hitting a
502 * Match directive unsets activep and the directives inside the block are
503 * checked for syntax only.
505 * The second time is after a connection has been established but before
506 * authentication. activep is initialized to 2 and global config directives
507 * are ignored since they have already been processed. If the criteria in a
508 * Match block is met, activep is set and the subsequent directives
509 * processed and actioned until EOF or another Match block unsets it. Any
510 * options set are copied into the main server config.
512 * Potential additions/improvements:
513 * - Add Match support for pre-kex directives, eg Protocol, Ciphers.
515 * - Add a Tag directive (idea from David Leonard) ala pf, eg:
516 * Match Address 192.168.0.*
521 * AllowTcpForwarding yes
522 * GatewayPorts clientspecified
525 * - Add a PermittedChannelRequests directive
527 * PermittedChannelRequests session,forwarded-tcpip
531 match_cfg_line_group(const char *grps, int line, const char *user)
539 if ((pw = getpwnam(user)) == NULL) {
540 debug("Can't match group at line %d because user %.100s does "
541 "not exist", line, user);
542 } else if (ga_init(pw->pw_name, pw->pw_gid) == 0) {
543 debug("Can't Match group because user %.100s not in any group "
544 "at line %d", user, line);
545 } else if (ga_match_pattern_list(grps) != 1) {
546 debug("user %.100s does not match group list %.100s at line %d",
549 debug("user %.100s matched group list %.100s at line %d", user,
559 match_cfg_line(char **condition, int line, const char *user, const char *host,
563 char *arg, *attrib, *cp = *condition;
567 debug3("checking syntax for 'Match %s'", cp);
569 debug3("checking match for '%s' user %s host %s addr %s", cp,
570 user ? user : "(null)", host ? host : "(null)",
571 address ? address : "(null)");
573 while ((attrib = strdelim(&cp)) && *attrib != '\0') {
574 if ((arg = strdelim(&cp)) == NULL || *arg == '\0') {
575 error("Missing Match criteria for %s", attrib);
579 if (strcasecmp(attrib, "user") == 0) {
584 if (match_pattern_list(user, arg, len, 0) != 1)
587 debug("user %.100s matched 'User %.100s' at "
588 "line %d", user, arg, line);
589 } else if (strcasecmp(attrib, "group") == 0) {
590 switch (match_cfg_line_group(arg, line, user)) {
596 } else if (strcasecmp(attrib, "host") == 0) {
601 if (match_hostname(host, arg, len) != 1)
604 debug("connection from %.100s matched 'Host "
605 "%.100s' at line %d", host, arg, line);
606 } else if (strcasecmp(attrib, "address") == 0) {
607 switch (addr_match_list(address, arg)) {
609 debug("connection from %.100s matched 'Address "
610 "%.100s' at line %d", address, arg, line);
620 error("Unsupported Match attribute %s", attrib);
625 debug3("match %sfound", result ? "" : "not ");
630 #define WHITESPACE " \t\r\n"
633 process_server_config_line(ServerOptions *options, char *line,
634 const char *filename, int linenum, int *activep, const char *user,
635 const char *host, const char *address)
637 char *cp, **charptr, *arg, *p;
638 int cmdline = 0, *intptr, value, n;
639 SyslogFacility *log_facility_ptr;
640 LogLevel *log_level_ptr;
641 ServerOpCodes opcode;
647 if ((arg = strdelim(&cp)) == NULL)
649 /* Ignore leading whitespace */
652 if (!arg || !*arg || *arg == '#')
656 opcode = parse_token(arg, filename, linenum, &flags);
658 if (activep == NULL) { /* We are processing a command line directive */
662 if (*activep && opcode != sMatch)
663 debug3("%s:%d setting %s %s", filename, linenum, arg, cp);
664 if (*activep == 0 && !(flags & SSHCFG_MATCH)) {
666 fatal("%s line %d: Directive '%s' is not allowed "
667 "within a Match block", filename, linenum, arg);
668 } else { /* this is a directive we have already processed */
676 /* Portable-specific options */
678 intptr = &options->use_pam;
681 /* Standard Options */
685 /* ignore ports from configfile if cmdline specifies ports */
686 if (options->ports_from_cmdline)
688 if (options->listen_addrs != NULL)
689 fatal("%s line %d: ports must be specified before "
690 "ListenAddress.", filename, linenum);
691 if (options->num_ports >= MAX_PORTS)
692 fatal("%s line %d: too many ports.",
695 if (!arg || *arg == '\0')
696 fatal("%s line %d: missing port number.",
698 options->ports[options->num_ports++] = a2port(arg);
699 if (options->ports[options->num_ports-1] == 0)
700 fatal("%s line %d: Badly formatted port number.",
705 intptr = &options->server_key_bits;
708 if (!arg || *arg == '\0')
709 fatal("%s line %d: missing integer value.",
712 if (*activep && *intptr == -1)
716 case sLoginGraceTime:
717 intptr = &options->login_grace_time;
720 if (!arg || *arg == '\0')
721 fatal("%s line %d: missing time value.",
723 if ((value = convtime(arg)) == -1)
724 fatal("%s line %d: invalid time value.",
730 case sKeyRegenerationTime:
731 intptr = &options->key_regeneration_time;
736 if (arg == NULL || *arg == '\0')
737 fatal("%s line %d: missing address",
739 /* check for bare IPv6 address: no "[]" and 2 or more ":" */
740 if (strchr(arg, '[') == NULL && (p = strchr(arg, ':')) != NULL
741 && strchr(p+1, ':') != NULL) {
742 add_listen_addr(options, arg, 0);
747 fatal("%s line %d: bad address:port usage",
749 p = cleanhostname(p);
752 else if ((port = a2port(arg)) == 0)
753 fatal("%s line %d: bad port number", filename, linenum);
755 add_listen_addr(options, p, port);
761 if (!arg || *arg == '\0')
762 fatal("%s line %d: missing address family.",
764 intptr = &options->address_family;
765 if (options->listen_addrs != NULL)
766 fatal("%s line %d: address family must be specified before "
767 "ListenAddress.", filename, linenum);
768 if (strcasecmp(arg, "inet") == 0)
770 else if (strcasecmp(arg, "inet6") == 0)
772 else if (strcasecmp(arg, "any") == 0)
775 fatal("%s line %d: unsupported address family \"%s\".",
776 filename, linenum, arg);
782 intptr = &options->num_host_key_files;
783 if (*intptr >= MAX_HOSTKEYS)
784 fatal("%s line %d: too many host keys specified (max %d).",
785 filename, linenum, MAX_HOSTKEYS);
786 charptr = &options->host_key_files[*intptr];
789 if (!arg || *arg == '\0')
790 fatal("%s line %d: missing file name.",
792 if (*activep && *charptr == NULL) {
793 *charptr = tilde_expand_filename(arg, getuid());
794 /* increase optional counter */
796 *intptr = *intptr + 1;
801 charptr = &options->pid_file;
804 case sPermitRootLogin:
805 intptr = &options->permit_root_login;
807 if (!arg || *arg == '\0')
808 fatal("%s line %d: missing yes/"
809 "without-password/forced-commands-only/no "
810 "argument.", filename, linenum);
811 value = 0; /* silence compiler */
812 if (strcmp(arg, "without-password") == 0)
813 value = PERMIT_NO_PASSWD;
814 else if (strcmp(arg, "forced-commands-only") == 0)
815 value = PERMIT_FORCED_ONLY;
816 else if (strcmp(arg, "yes") == 0)
818 else if (strcmp(arg, "no") == 0)
821 fatal("%s line %d: Bad yes/"
822 "without-password/forced-commands-only/no "
823 "argument: %s", filename, linenum, arg);
824 if (*activep && *intptr == -1)
829 intptr = &options->ignore_rhosts;
832 if (!arg || *arg == '\0')
833 fatal("%s line %d: missing yes/no argument.",
835 value = 0; /* silence compiler */
836 if (strcmp(arg, "yes") == 0)
838 else if (strcmp(arg, "no") == 0)
841 fatal("%s line %d: Bad yes/no argument: %s",
842 filename, linenum, arg);
843 if (*activep && *intptr == -1)
847 case sIgnoreUserKnownHosts:
848 intptr = &options->ignore_user_known_hosts;
851 case sRhostsRSAAuthentication:
852 intptr = &options->rhosts_rsa_authentication;
855 case sHostbasedAuthentication:
856 intptr = &options->hostbased_authentication;
859 case sHostbasedUsesNameFromPacketOnly:
860 intptr = &options->hostbased_uses_name_from_packet_only;
863 case sRSAAuthentication:
864 intptr = &options->rsa_authentication;
867 case sPubkeyAuthentication:
868 intptr = &options->pubkey_authentication;
871 case sKerberosAuthentication:
872 intptr = &options->kerberos_authentication;
875 case sKerberosOrLocalPasswd:
876 intptr = &options->kerberos_or_local_passwd;
879 case sKerberosTicketCleanup:
880 intptr = &options->kerberos_ticket_cleanup;
883 case sKerberosGetAFSToken:
884 intptr = &options->kerberos_get_afs_token;
887 case sGssAuthentication:
888 intptr = &options->gss_authentication;
891 case sGssCleanupCreds:
892 intptr = &options->gss_cleanup_creds;
895 case sPasswordAuthentication:
896 intptr = &options->password_authentication;
899 case sKbdInteractiveAuthentication:
900 intptr = &options->kbd_interactive_authentication;
903 case sChallengeResponseAuthentication:
904 intptr = &options->challenge_response_authentication;
908 intptr = &options->print_motd;
912 intptr = &options->print_lastlog;
916 intptr = &options->x11_forwarding;
919 case sX11DisplayOffset:
920 intptr = &options->x11_display_offset;
923 case sX11UseLocalhost:
924 intptr = &options->x11_use_localhost;
928 charptr = &options->xauth_location;
932 intptr = &options->strict_modes;
936 intptr = &options->tcp_keep_alive;
939 case sPermitBlacklistedKeys:
940 intptr = &options->permit_blacklisted_keys;
944 intptr = &options->permit_empty_passwd;
947 case sPermitUserEnvironment:
948 intptr = &options->permit_user_env;
952 intptr = &options->use_login;
956 intptr = &options->compression;
958 if (!arg || *arg == '\0')
959 fatal("%s line %d: missing yes/no/delayed "
960 "argument.", filename, linenum);
961 value = 0; /* silence compiler */
962 if (strcmp(arg, "delayed") == 0)
963 value = COMP_DELAYED;
964 else if (strcmp(arg, "yes") == 0)
966 else if (strcmp(arg, "no") == 0)
969 fatal("%s line %d: Bad yes/no/delayed "
970 "argument: %s", filename, linenum, arg);
976 intptr = &options->gateway_ports;
978 if (!arg || *arg == '\0')
979 fatal("%s line %d: missing yes/no/clientspecified "
980 "argument.", filename, linenum);
981 value = 0; /* silence compiler */
982 if (strcmp(arg, "clientspecified") == 0)
984 else if (strcmp(arg, "yes") == 0)
986 else if (strcmp(arg, "no") == 0)
989 fatal("%s line %d: Bad yes/no/clientspecified "
990 "argument: %s", filename, linenum, arg);
991 if (*activep && *intptr == -1)
996 intptr = &options->use_dns;
1000 log_facility_ptr = &options->log_facility;
1001 arg = strdelim(&cp);
1002 value = log_facility_number(arg);
1003 if (value == SYSLOG_FACILITY_NOT_SET)
1004 fatal("%.200s line %d: unsupported log facility '%s'",
1005 filename, linenum, arg ? arg : "<NONE>");
1006 if (*log_facility_ptr == -1)
1007 *log_facility_ptr = (SyslogFacility) value;
1011 log_level_ptr = &options->log_level;
1012 arg = strdelim(&cp);
1013 value = log_level_number(arg);
1014 if (value == SYSLOG_LEVEL_NOT_SET)
1015 fatal("%.200s line %d: unsupported log level '%s'",
1016 filename, linenum, arg ? arg : "<NONE>");
1017 if (*log_level_ptr == -1)
1018 *log_level_ptr = (LogLevel) value;
1021 case sAllowTcpForwarding:
1022 intptr = &options->allow_tcp_forwarding;
1025 case sAllowAgentForwarding:
1026 intptr = &options->allow_agent_forwarding;
1029 case sUsePrivilegeSeparation:
1030 intptr = &use_privsep;
1034 while ((arg = strdelim(&cp)) && *arg != '\0') {
1035 if (options->num_allow_users >= MAX_ALLOW_USERS)
1036 fatal("%s line %d: too many allow users.",
1038 options->allow_users[options->num_allow_users++] =
1044 while ((arg = strdelim(&cp)) && *arg != '\0') {
1045 if (options->num_deny_users >= MAX_DENY_USERS)
1046 fatal("%s line %d: too many deny users.",
1048 options->deny_users[options->num_deny_users++] =
1054 while ((arg = strdelim(&cp)) && *arg != '\0') {
1055 if (options->num_allow_groups >= MAX_ALLOW_GROUPS)
1056 fatal("%s line %d: too many allow groups.",
1058 options->allow_groups[options->num_allow_groups++] =
1064 while ((arg = strdelim(&cp)) && *arg != '\0') {
1065 if (options->num_deny_groups >= MAX_DENY_GROUPS)
1066 fatal("%s line %d: too many deny groups.",
1068 options->deny_groups[options->num_deny_groups++] = xstrdup(arg);
1073 arg = strdelim(&cp);
1074 if (!arg || *arg == '\0')
1075 fatal("%s line %d: Missing argument.", filename, linenum);
1076 if (!ciphers_valid(arg))
1077 fatal("%s line %d: Bad SSH2 cipher spec '%s'.",
1078 filename, linenum, arg ? arg : "<NONE>");
1079 if (options->ciphers == NULL)
1080 options->ciphers = xstrdup(arg);
1084 arg = strdelim(&cp);
1085 if (!arg || *arg == '\0')
1086 fatal("%s line %d: Missing argument.", filename, linenum);
1087 if (!mac_valid(arg))
1088 fatal("%s line %d: Bad SSH2 mac spec '%s'.",
1089 filename, linenum, arg ? arg : "<NONE>");
1090 if (options->macs == NULL)
1091 options->macs = xstrdup(arg);
1095 intptr = &options->protocol;
1096 arg = strdelim(&cp);
1097 if (!arg || *arg == '\0')
1098 fatal("%s line %d: Missing argument.", filename, linenum);
1099 value = proto_spec(arg);
1100 if (value == SSH_PROTO_UNKNOWN)
1101 fatal("%s line %d: Bad protocol spec '%s'.",
1102 filename, linenum, arg ? arg : "<NONE>");
1103 if (*intptr == SSH_PROTO_UNKNOWN)
1108 if (options->num_subsystems >= MAX_SUBSYSTEMS) {
1109 fatal("%s line %d: too many subsystems defined.",
1112 arg = strdelim(&cp);
1113 if (!arg || *arg == '\0')
1114 fatal("%s line %d: Missing subsystem name.",
1117 arg = strdelim(&cp);
1120 for (i = 0; i < options->num_subsystems; i++)
1121 if (strcmp(arg, options->subsystem_name[i]) == 0)
1122 fatal("%s line %d: Subsystem '%s' already defined.",
1123 filename, linenum, arg);
1124 options->subsystem_name[options->num_subsystems] = xstrdup(arg);
1125 arg = strdelim(&cp);
1126 if (!arg || *arg == '\0')
1127 fatal("%s line %d: Missing subsystem command.",
1129 options->subsystem_command[options->num_subsystems] = xstrdup(arg);
1131 /* Collect arguments (separate to executable) */
1133 len = strlen(p) + 1;
1134 while ((arg = strdelim(&cp)) != NULL && *arg != '\0') {
1135 len += 1 + strlen(arg);
1136 p = xrealloc(p, 1, len);
1137 strlcat(p, " ", len);
1138 strlcat(p, arg, len);
1140 options->subsystem_args[options->num_subsystems] = p;
1141 options->num_subsystems++;
1145 arg = strdelim(&cp);
1146 if (!arg || *arg == '\0')
1147 fatal("%s line %d: Missing MaxStartups spec.",
1149 if ((n = sscanf(arg, "%d:%d:%d",
1150 &options->max_startups_begin,
1151 &options->max_startups_rate,
1152 &options->max_startups)) == 3) {
1153 if (options->max_startups_begin >
1154 options->max_startups ||
1155 options->max_startups_rate > 100 ||
1156 options->max_startups_rate < 1)
1157 fatal("%s line %d: Illegal MaxStartups spec.",
1160 fatal("%s line %d: Illegal MaxStartups spec.",
1163 options->max_startups = options->max_startups_begin;
1167 intptr = &options->max_authtries;
1171 intptr = &options->max_sessions;
1175 charptr = &options->banner;
1176 goto parse_filename;
1179 * These options can contain %X options expanded at
1180 * connect time, so that you can specify paths like:
1182 * AuthorizedKeysFile /etc/ssh_keys/%u
1184 case sAuthorizedKeysFile:
1185 case sAuthorizedKeysFile2:
1186 charptr = (opcode == sAuthorizedKeysFile) ?
1187 &options->authorized_keys_file :
1188 &options->authorized_keys_file2;
1189 goto parse_filename;
1191 case sClientAliveInterval:
1192 intptr = &options->client_alive_interval;
1195 case sClientAliveCountMax:
1196 intptr = &options->client_alive_count_max;
1200 while ((arg = strdelim(&cp)) && *arg != '\0') {
1201 if (strchr(arg, '=') != NULL)
1202 fatal("%s line %d: Invalid environment name.",
1204 if (options->num_accept_env >= MAX_ACCEPT_ENV)
1205 fatal("%s line %d: too many allow env.",
1209 options->accept_env[options->num_accept_env++] =
1215 intptr = &options->permit_tun;
1216 arg = strdelim(&cp);
1217 if (!arg || *arg == '\0')
1218 fatal("%s line %d: Missing yes/point-to-point/"
1219 "ethernet/no argument.", filename, linenum);
1221 for (i = 0; tunmode_desc[i].val != -1; i++)
1222 if (strcmp(tunmode_desc[i].text, arg) == 0) {
1223 value = tunmode_desc[i].val;
1227 fatal("%s line %d: Bad yes/point-to-point/ethernet/"
1228 "no argument: %s", filename, linenum, arg);
1235 fatal("Match directive not supported as a command-line "
1237 value = match_cfg_line(&cp, linenum, user, host, address);
1239 fatal("%s line %d: Bad Match condition", filename,
1245 arg = strdelim(&cp);
1246 if (!arg || *arg == '\0')
1247 fatal("%s line %d: missing PermitOpen specification",
1249 n = options->num_permitted_opens; /* modified later */
1250 if (strcmp(arg, "any") == 0) {
1251 if (*activep && n == -1) {
1252 channel_clear_adm_permitted_opens();
1253 options->num_permitted_opens = 0;
1257 if (*activep && n == -1)
1258 channel_clear_adm_permitted_opens();
1259 for (; arg != NULL && *arg != '\0'; arg = strdelim(&cp)) {
1262 fatal("%s line %d: missing host in PermitOpen",
1264 p = cleanhostname(p);
1265 if (arg == NULL || (port = a2port(arg)) == 0)
1266 fatal("%s line %d: bad port number in "
1267 "PermitOpen", filename, linenum);
1268 if (*activep && n == -1)
1269 options->num_permitted_opens =
1270 channel_add_adm_permitted_opens(p, port);
1276 fatal("%.200s line %d: Missing argument.", filename,
1278 len = strspn(cp, WHITESPACE);
1279 if (*activep && options->adm_forced_command == NULL)
1280 options->adm_forced_command = xstrdup(cp + len);
1283 case sChrootDirectory:
1284 charptr = &options->chroot_directory;
1286 arg = strdelim(&cp);
1287 if (!arg || *arg == '\0')
1288 fatal("%s line %d: missing file name.",
1290 if (*activep && *charptr == NULL)
1291 *charptr = xstrdup(arg);
1294 case sVersionAddendum:
1295 ssh_version_set_addendum(strtok(cp, "\n"));
1297 arg = strdelim(&cp);
1298 } while (arg != NULL && *arg != '\0');
1302 logit("%s line %d: Deprecated option %s",
1303 filename, linenum, arg);
1305 arg = strdelim(&cp);
1309 logit("%s line %d: Unsupported option %s",
1310 filename, linenum, arg);
1312 arg = strdelim(&cp);
1316 fatal("%s line %d: Missing handler for opcode %s (%d)",
1317 filename, linenum, arg, opcode);
1319 if ((arg = strdelim(&cp)) != NULL && *arg != '\0')
1320 fatal("%s line %d: garbage at end of line; \"%.200s\".",
1321 filename, linenum, arg);
1325 /* Reads the server configuration file. */
1328 load_server_config(const char *filename, Buffer *conf)
1330 char line[1024], *cp;
1333 debug2("%s: filename %s", __func__, filename);
1334 if ((f = fopen(filename, "r")) == NULL) {
1339 while (fgets(line, sizeof(line), f)) {
1341 * Trim out comments and strip whitespace
1342 * NB - preserve newlines, they are needed to reproduce
1343 * line numbers later for error messages
1345 if ((cp = strchr(line, '#')) != NULL)
1346 memcpy(cp, "\n", 2);
1347 cp = line + strspn(line, " \t\r");
1349 buffer_append(conf, cp, strlen(cp));
1351 buffer_append(conf, "\0", 1);
1353 debug2("%s: done config len = %d", __func__, buffer_len(conf));
1357 parse_server_match_config(ServerOptions *options, const char *user,
1358 const char *host, const char *address)
1362 initialize_server_options(&mo);
1363 parse_server_config(&mo, "reprocess config", &cfg, user, host, address);
1364 copy_set_server_options(options, &mo, 0);
1368 #define M_CP_INTOPT(n) do {\
1372 #define M_CP_STROPT(n) do {\
1373 if (src->n != NULL) { \
1374 if (dst->n != NULL) \
1381 * Copy any supported values that are set.
1383 * If the preauth flag is set, we do not bother copying the the string or
1384 * array values that are not used pre-authentication, because any that we
1385 * do use must be explictly sent in mm_getpwnamallow().
1388 copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
1390 M_CP_INTOPT(password_authentication);
1391 M_CP_INTOPT(gss_authentication);
1392 M_CP_INTOPT(rsa_authentication);
1393 M_CP_INTOPT(pubkey_authentication);
1394 M_CP_INTOPT(kerberos_authentication);
1395 M_CP_INTOPT(hostbased_authentication);
1396 M_CP_INTOPT(kbd_interactive_authentication);
1397 M_CP_INTOPT(permit_root_login);
1399 M_CP_INTOPT(allow_tcp_forwarding);
1400 M_CP_INTOPT(allow_agent_forwarding);
1401 M_CP_INTOPT(gateway_ports);
1402 M_CP_INTOPT(x11_display_offset);
1403 M_CP_INTOPT(x11_forwarding);
1404 M_CP_INTOPT(x11_use_localhost);
1405 M_CP_INTOPT(max_sessions);
1406 M_CP_INTOPT(max_authtries);
1408 M_CP_STROPT(banner);
1411 M_CP_STROPT(adm_forced_command);
1412 M_CP_STROPT(chroot_directory);
1419 parse_server_config(ServerOptions *options, const char *filename, Buffer *conf,
1420 const char *user, const char *host, const char *address)
1422 int active, linenum, bad_options = 0;
1423 char *cp, *obuf, *cbuf;
1425 debug2("%s: config %s len %d", __func__, filename, buffer_len(conf));
1427 obuf = cbuf = xstrdup(buffer_ptr(conf));
1428 active = user ? 0 : 1;
1430 while ((cp = strsep(&cbuf, "\n")) != NULL) {
1431 if (process_server_config_line(options, cp, filename,
1432 linenum++, &active, user, host, address) != 0)
1436 if (bad_options > 0)
1437 fatal("%s: terminating, %d bad configuration options",
1438 filename, bad_options);
1442 fmt_intarg(ServerOpCodes code, int val)
1444 if (code == sAddressFamily) {
1456 if (code == sPermitRootLogin) {
1458 case PERMIT_NO_PASSWD:
1459 return "without-passord";
1460 case PERMIT_FORCED_ONLY:
1461 return "forced-commands-only";
1466 if (code == sProtocol) {
1472 case (SSH_PROTO_1|SSH_PROTO_2):
1478 if (code == sGatewayPorts && val == 2)
1479 return "clientspecified";
1480 if (code == sCompression && val == COMP_DELAYED)
1494 lookup_opcode_name(ServerOpCodes code)
1498 for (i = 0; keywords[i].name != NULL; i++)
1499 if (keywords[i].opcode == code)
1500 return(keywords[i].name);
1505 dump_cfg_int(ServerOpCodes code, int val)
1507 printf("%s %d\n", lookup_opcode_name(code), val);
1511 dump_cfg_fmtint(ServerOpCodes code, int val)
1513 printf("%s %s\n", lookup_opcode_name(code), fmt_intarg(code, val));
1517 dump_cfg_string(ServerOpCodes code, const char *val)
1521 printf("%s %s\n", lookup_opcode_name(code), val);
1525 dump_cfg_strarray(ServerOpCodes code, u_int count, char **vals)
1529 for (i = 0; i < count; i++)
1530 printf("%s %s\n", lookup_opcode_name(code), vals[i]);
1534 dump_config(ServerOptions *o)
1538 struct addrinfo *ai;
1539 char addr[NI_MAXHOST], port[NI_MAXSERV], *s = NULL;
1541 /* these are usually at the top of the config */
1542 for (i = 0; i < o->num_ports; i++)
1543 printf("port %d\n", o->ports[i]);
1544 dump_cfg_fmtint(sProtocol, o->protocol);
1545 dump_cfg_fmtint(sAddressFamily, o->address_family);
1547 /* ListenAddress must be after Port */
1548 for (ai = o->listen_addrs; ai; ai = ai->ai_next) {
1549 if ((ret = getnameinfo(ai->ai_addr, ai->ai_addrlen, addr,
1550 sizeof(addr), port, sizeof(port),
1551 NI_NUMERICHOST|NI_NUMERICSERV)) != 0) {
1552 error("getnameinfo failed: %.100s",
1553 (ret != EAI_SYSTEM) ? gai_strerror(ret) :
1556 if (ai->ai_family == AF_INET6)
1557 printf("listenaddress [%s]:%s\n", addr, port);
1559 printf("listenaddress %s:%s\n", addr, port);
1563 /* integer arguments */
1564 dump_cfg_int(sServerKeyBits, o->server_key_bits);
1565 dump_cfg_int(sLoginGraceTime, o->login_grace_time);
1566 dump_cfg_int(sKeyRegenerationTime, o->key_regeneration_time);
1567 dump_cfg_int(sX11DisplayOffset, o->x11_display_offset);
1568 dump_cfg_int(sMaxAuthTries, o->max_authtries);
1569 dump_cfg_int(sClientAliveInterval, o->client_alive_interval);
1570 dump_cfg_int(sClientAliveCountMax, o->client_alive_count_max);
1572 /* formatted integer arguments */
1573 dump_cfg_fmtint(sPermitRootLogin, o->permit_root_login);
1574 dump_cfg_fmtint(sIgnoreRhosts, o->ignore_rhosts);
1575 dump_cfg_fmtint(sIgnoreUserKnownHosts, o->ignore_user_known_hosts);
1576 dump_cfg_fmtint(sRhostsRSAAuthentication, o->rhosts_rsa_authentication);
1577 dump_cfg_fmtint(sHostbasedAuthentication, o->hostbased_authentication);
1578 dump_cfg_fmtint(sHostbasedUsesNameFromPacketOnly,
1579 o->hostbased_uses_name_from_packet_only);
1580 dump_cfg_fmtint(sRSAAuthentication, o->rsa_authentication);
1581 dump_cfg_fmtint(sPubkeyAuthentication, o->pubkey_authentication);
1582 dump_cfg_fmtint(sKerberosAuthentication, o->kerberos_authentication);
1583 dump_cfg_fmtint(sKerberosOrLocalPasswd, o->kerberos_or_local_passwd);
1584 dump_cfg_fmtint(sKerberosTicketCleanup, o->kerberos_ticket_cleanup);
1585 dump_cfg_fmtint(sKerberosGetAFSToken, o->kerberos_get_afs_token);
1586 dump_cfg_fmtint(sGssAuthentication, o->gss_authentication);
1587 dump_cfg_fmtint(sGssCleanupCreds, o->gss_cleanup_creds);
1588 dump_cfg_fmtint(sPasswordAuthentication, o->password_authentication);
1589 dump_cfg_fmtint(sKbdInteractiveAuthentication,
1590 o->kbd_interactive_authentication);
1591 dump_cfg_fmtint(sChallengeResponseAuthentication,
1592 o->challenge_response_authentication);
1593 dump_cfg_fmtint(sPrintMotd, o->print_motd);
1594 dump_cfg_fmtint(sPrintLastLog, o->print_lastlog);
1595 dump_cfg_fmtint(sX11Forwarding, o->x11_forwarding);
1596 dump_cfg_fmtint(sX11UseLocalhost, o->x11_use_localhost);
1597 dump_cfg_fmtint(sStrictModes, o->strict_modes);
1598 dump_cfg_fmtint(sTCPKeepAlive, o->tcp_keep_alive);
1599 dump_cfg_fmtint(sEmptyPasswd, o->permit_empty_passwd);
1600 dump_cfg_fmtint(sPermitUserEnvironment, o->permit_user_env);
1601 dump_cfg_fmtint(sUseLogin, o->use_login);
1602 dump_cfg_fmtint(sCompression, o->compression);
1603 dump_cfg_fmtint(sGatewayPorts, o->gateway_ports);
1604 dump_cfg_fmtint(sUseDNS, o->use_dns);
1605 dump_cfg_fmtint(sAllowTcpForwarding, o->allow_tcp_forwarding);
1606 dump_cfg_fmtint(sUsePrivilegeSeparation, use_privsep);
1608 /* string arguments */
1609 dump_cfg_string(sPidFile, o->pid_file);
1610 dump_cfg_string(sXAuthLocation, o->xauth_location);
1611 dump_cfg_string(sCiphers, o->ciphers);
1612 dump_cfg_string(sMacs, o->macs);
1613 dump_cfg_string(sBanner, o->banner);
1614 dump_cfg_string(sAuthorizedKeysFile, o->authorized_keys_file);
1615 dump_cfg_string(sAuthorizedKeysFile2, o->authorized_keys_file2);
1616 dump_cfg_string(sForceCommand, o->adm_forced_command);
1618 /* string arguments requiring a lookup */
1619 dump_cfg_string(sLogLevel, log_level_name(o->log_level));
1620 dump_cfg_string(sLogFacility, log_facility_name(o->log_facility));
1622 /* string array arguments */
1623 dump_cfg_strarray(sHostKeyFile, o->num_host_key_files,
1625 dump_cfg_strarray(sAllowUsers, o->num_allow_users, o->allow_users);
1626 dump_cfg_strarray(sDenyUsers, o->num_deny_users, o->deny_users);
1627 dump_cfg_strarray(sAllowGroups, o->num_allow_groups, o->allow_groups);
1628 dump_cfg_strarray(sDenyGroups, o->num_deny_groups, o->deny_groups);
1629 dump_cfg_strarray(sAcceptEnv, o->num_accept_env, o->accept_env);
1631 /* other arguments */
1632 for (i = 0; i < o->num_subsystems; i++)
1633 printf("subsystem %s %s\n", o->subsystem_name[i],
1634 o->subsystem_args[i]);
1636 printf("maxstartups %d:%d:%d\n", o->max_startups_begin,
1637 o->max_startups_rate, o->max_startups);
1639 for (i = 0; tunmode_desc[i].val != -1; i++)
1640 if (tunmode_desc[i].val == o->permit_tun) {
1641 s = tunmode_desc[i].text;
1644 dump_cfg_string(sPermitTunnel, s);
1646 printf("permitopen");
1647 channel_print_adm_permitted_opens();