https://bugzilla.mindrot.org/show_bug.cgi?id=3148
--- Comment #2 from Anderson Medeiros Gomes <[email protected]> --- According to my source code analysis, two code blocks written in file "/src/usr.bin/ssh/auth-rhosts.c" ( https://cvsweb.openbsd.org/cgi-bin/cvsweb/~checkout~/src/usr.bin/ssh/auth-rhosts.c?rev=1.51 ) are explicitly preventing root user from authenticating itself via host-based method. This code block, which starts at line 226 and is declared inside function "auth_rhosts2", prevents parsing of "/etc/ssh/shosts.equiv" if "root" is the user being authenticated: -------------------------------- /* * If not logging in as superuser, try /etc/hosts.equiv and * shosts.equiv. */ if (pw->pw_uid == 0) debug3("%s: root user, ignoring system hosts files", __func__); else { if (check_rhosts_file(_PATH_RHOSTS_EQUIV, hostname, ipaddr, client_user, pw->pw_name)) { auth_debug_add("Accepted for %.100s [%.100s] by " "/etc/hosts.equiv.", hostname, ipaddr); return 1; } if (check_rhosts_file(_PATH_SSH_HOSTS_EQUIV, hostname, ipaddr, client_user, pw->pw_name)) { auth_debug_add("Accepted for %.100s [%.100s] by " "%.100s.", hostname, ipaddr, _PATH_SSH_HOSTS_EQUIV); return 1; } } -------------------------------- And this code block, starting at line 293, prevents parsing of "/root/.shosts" file if "IgnoreRhost yes" is set in "/etc/ssh/sshd_config". As a result, host-based authentication as root will fail even if a systems administrator creates in "/root/.shosts" a symbolic link targeting to "/etc/ssh/shosts.equiv" as a workaround. -------------------------------- /* * Check if we have been configured to ignore .rhosts * and .shosts files. */ if (options.ignore_rhosts) { auth_debug_add("Server has been configured to " "ignore %.100s.", rhosts_files[rhosts_file_index]); continue; } -------------------------------- -- You are receiving this mail because: You are watching the assignee of the bug. _______________________________________________ openssh-bugs mailing list [email protected] https://lists.mindrot.org/mailman/listinfo/openssh-bugs
