Possible Allow* bug?

[James Dennis]

Hey,

After discussing the limit of MAX_ALLOW_USERS I've been trying to use 
AllowGroups instead. In the config file I have the AllowUsers lines 
before the AllowGroups lines (I have tried both ways) and it appears 
that the presence on the AllowGroups directives seems to blow away any 
Allow* directives I have set. I'm not sure how to check further for bugs 
so I figured I'd contact you guys.

When I simply comment out the AllowGroups line, the AllowUsers 
directives work fine, when I uncomment it, no access is granted to the 
system, period.

Bug?

In servconf.c I added debug lines in each directives case to print the 
amount of users found and when I start sshd, it prints the correct numbers.

[username at hostname /home/username/OpenSSH/openssh-3.5p1]$ ./sshd -d -d 
-d -p 8088
debug3: Found 5 AllowUsers
debug3: Found 11 AllowUsers
debug3: Found 12 AllowUsers
debug3: Found 14 AllowUsers
debug3: Found 16 AllowUsers
debug3: Found 17 AllowUsers
debug3: Found 29 AllowUsers
debug3: Found 1 AllowGroups
debug1: sshd version OpenSSH_3.5p1
debug1: private host key: #0 type 0 RSA1
debug3: Not a RSA1 key file /usr/local/openssh/etc/ssh_host_rsa_key.
debug1: read PEM private key done: type RSA
debug1: private host key: #1 type 1 RSA
debug3: Not a RSA1 key file /usr/local/openssh/etc/ssh_host_dsa_key.
debug1: read PEM private key done: type DSA
debug1: private host key: #2 type 2 DSA
debug1: Bind to port 8088 on 0.0.0.0.
Server listening on 0.0.0.0 port 8088.

The diff, in case you want to see what I actually did:
-3.5p1-chroot/servconf.c 

--- openssh-3.5p1/servconf.c    Thu Sep  5 00:35:15 2002
+++ openssh-3.5p1-chroot/servconf.c     Mon Feb 10 13:52:34 2003
@@ -775,6 +775,7 @@
                         options->allow_users[options->num_allow_users++] =
                             xstrdup(arg);
                 }
+               debug3("Found %d AllowUsers", options->num_allow_users);
                 break;

         case sDenyUsers:
@@ -795,6 +796,7 @@
 
options->allow_groups[options->num_allow_groups++] =
                             xstrdup(arg);
                 }
+               debug3("Found %d AllowGroups", options->num_allow_groups);
                 break;

         case sDenyGroups:


-- 
James Dennis
Harvard Law School

"Not everything that counts can be counted,
and not everything that can be counted counts."