[patch] user at host in AllowUsers

[Andrew Tridgell]

This is a port of a patch I contributed to ssh 1.2.23 in May 1998. I
have missed the functionality after moving to OpenSSH so I have
updated the patch and hope OpenSSH might accept it.

The patch allows sshd_config to have lines like:

AllowUsers root at localhost
AllowUsers tridge@*
AllowUsers guest at 192.168.2.*
DenyUsers badguy@*

etc.

I found this useful for restricting users to only login from hostnames
that they pre-arranged with me.

Patch is against current cvs.

Cheers, Tridge


Index: auth.c
===================================================================
RCS file: /cvs/openssh_cvs/auth.c,v
retrieving revision 1.28
diff -u -r1.28 auth.c
--- auth.c	2001/03/19 22:15:57	1.28
+++ auth.c	2001/06/04 15:20:52
@@ -45,6 +45,56 @@
 extern ServerOptions options;
 
 /*
+  match a hostname or an IP to a pattern. If the pattern only contains digits and '.'
+  then match as a IP, otherwise match as a hostname
+ */
+static int match_host(const char *host, const char *ip, const char *pattern)
+{
+	const char *p;
+	for (p=pattern; *p; p++) {
+		if (!strchr("0123456789*?.", *p)) {
+			/* treat as a hostname */
+			return match_pattern(host, pattern);
+		}
+	}
+	return match_pattern(ip, pattern);
+}
+
+
+/* this combines the effect of match_pattern on a username, hostname
+   and IP address. If the pattern contains a @ then the part preceding
+   the @ is checked against the username. The part after the @ is
+   checked against the hostname and IP address. If no @ is found then
+   a normal match_pattern is done against the username 
+
+   This is more useful than just a match_pattern as it allows you to
+   specify exactly what users are alowed to login from what hosts
+   (tridge, May 1998)
+*/
+static int match_user(const char *user, const char *host, const char *ip,
+		      const char *pattern)
+{
+	int ret;
+	char *p2;
+	char *p;
+
+	p = strchr(pattern,'@');
+  
+	if (!p)	return match_pattern(user, pattern);
+
+	p2 = xstrdup(pattern);
+	p = strchr(p2, '@');
+  
+	*p = 0;
+
+	ret = match_pattern(user,p2) && match_host(host, ip, p + 1);
+  
+	xfree(p2);
+	return ret;
+}
+
+
+/*
  * Check if the user is allowed to log in via ssh. If user is listed
  * in DenyUsers or one of user's groups is listed in DenyGroups, false
  * will be returned. If AllowUsers isn't empty and user isn't listed
@@ -103,14 +153,18 @@
 
 	/* Return false if user is listed in DenyUsers */
 	if (options.num_deny_users > 0) {
+		const char *hostname = get_canonical_hostname(options.reverse_mapping_check);
+		const char *ipaddr = get_remote_ipaddr();
 		for (i = 0; i < options.num_deny_users; i++)
-			if (match_pattern(pw->pw_name, options.deny_users[i]))
+			if (match_user(pw->pw_name, hostname, ipaddr, options.deny_users[i]))
 				return 0;
 	}
 	/* Return false if AllowUsers isn't empty and user isn't listed there */
 	if (options.num_allow_users > 0) {
+		const char *hostname = get_canonical_hostname(options.reverse_mapping_check);
+		const char *ipaddr = get_remote_ipaddr();
 		for (i = 0; i < options.num_allow_users; i++)
-			if (match_pattern(pw->pw_name, options.allow_users[i]))
+			if (match_user(pw->pw_name, hostname, ipaddr, options.allow_users[i]))
 				break;
 		/* i < options.num_allow_users iff we break for loop */
 		if (i >= options.num_allow_users)
Index: sshd.8
===================================================================
RCS file: /cvs/openssh_cvs/sshd.8,v
retrieving revision 1.78
diff -u -r1.78 sshd.8
--- sshd.8	2001/05/04 22:38:43	1.78
+++ sshd.8	2001/06/04 15:20:54
@@ -330,6 +330,9 @@
 wildcards in the patterns.
 Only user names are valid; a numerical user ID isn't recognized.
 By default login is allowed regardless of the user name.
+If the pattern takes the form USER at HOST then USER and HOST
+are separately checked, allowing you to restrict logins to particular
+users from particular hosts.
 .Pp
 .It Cm Banner
 In some jurisdictions, sending a warning message before authentication