[openssh-commits] CVS: fuyu.mindrot.org: openssh

[Darren Tucker]

CVSROOT:        /var/cvs
Module name:    openssh
Changes by:     dtucker at fuyu.mindrot.org 08/07/02 22:56:10

Modified files:
    .               : ChangeLog auth2-none.c auth2.c

Log message:
   - djm at cvs.openbsd.org 2008/07/02 12:36:39
     [auth2-none.c auth2.c]
     Make protocol 2 MaxAuthTries behaviour a little more sensible:
     Check whether client has exceeded MaxAuthTries before running
     an authentication method and skip it if they have, previously it
     would always allow one try (for "none" auth).
     Preincrement failure count before post-auth test - previously this
     checked and postincremented, also to allow one "none" try.
     Together, these two changes always count the "none" auth method
     which could be skipped by a malicious client (e.g. an SSH worm)
     to get an extra attempt at a real auth method. They also make
     MaxAuthTries=0 a useful way to block users entirely (esp. in a
     sshd_config Match block).
     Also, move sending of any preauth banner from "none" auth method
     to the first call to input_userauth_request(), so worms that skip
     the "none" method get to see it too.

Diff commands:
cvs -nQq rdiff -u -r1.5047 -r1.5048 openssh/ChangeLog
cvs -nQq rdiff -u -r1.18 -r1.19 openssh/auth2-none.c
cvs -nQq rdiff -u -r1.145 -r1.146 openssh/auth2.c

CVSWeb:
http://cvsweb.mindrot.org/index.cgi/openssh/ChangeLog?r1=1.5047;r2=1.5048
http://cvsweb.mindrot.org/index.cgi/openssh/auth2-none.c?r1=1.18;r2=1.19
http://cvsweb.mindrot.org/index.cgi/openssh/auth2.c?r1=1.145;r2=1.146

Please note that there may be a delay before commits are available
on the public CVSWeb site.