summaryrefslogtreecommitdiffstats
path: root/src/responder/ssh
Commit message (Collapse)AuthorAgeFilesLines
* responders: reset ncache after domains are discovered during startupJakub Hrozek2015-04-091-1/+1
| | | | | | | | | After responders start, they add a lookup operation that discovers the subdomains so that qualifying users works. After this operation is finishes, we need to reset negcache to allow users to be added into the newly discovered domains. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SSH: Ignore the default_domain_suffixJakub Hrozek2015-04-011-1/+1
| | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2609 In a trust setup, hosts are normally only stored on the IPA server. The default_domain_suffix option is only recommended for the IPA-AD trust scenario as well. Therefore we should ignore this option in the SSH provider. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jan Cholasta <jcholast@redhat.com>
* Fix: always check return value of unlink()Pavel Reichl2014-11-281-2/+12
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2506 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Views: apply user SSH public key overrideSumit Bose2014-11-051-29/+94
| | | | | | | | | | | | | With this patch the SSH public key override attribute is read from the FreeIPA server and saved in the cache with the other override data. Since it is possible to have multiple public SSH keys this override value does not replace any other data but will be added to existing values. Fixes https://fedorahosted.org/sssd/ticket/2454 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* RESPONDERS: Set default value for umaskPavel Reichl2014-10-291-0/+2
| | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2468 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SSH: Run the ssh responder as the SSSD userJakub Hrozek2014-10-221-1/+2
| | | | | Reviewed-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* responders: Do not initialize pipe fd if already presentMichal Zidek2014-10-221-1/+1
| | | | | | | | Allow to skip initialization of pipe file descriptor if the responder context already has one. Reviewed-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* SSSD: Add the options to specify a UID and GID to run asJakub Hrozek2014-10-201-1/+4
| | | | | | | | | Adds new command line options --uid and --gid to all SSSD servers, making it possible to switch to another user ID if needed. So far all code still runs as root. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* IFP: Provide a SBUS method to reconnect to sysbusJakub Hrozek2014-07-081-0/+1
| | | | | | | | | Introduces a new method implemented only by the IFP responder. When this method is received, the responder attempts to reconnect to the system bus, if not connected already. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Pavel Reichl <preichl@redhat.com>
* sbus: Refactor how we export DBus interfacesStef Walter2014-03-141-14/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Most importantly, stop using per connection private data. This doesn't scale when you have more than one thing exporting or exported on a connection. Remove struct sbus_interface and expand sbus_conn_add_interface() function. Remove various struct sbus_interface args to connection initialization functions and make callers use sbus_conn_add_interface() directly. The old method was optimized for exporting one interface on a connection. We'll have connections that export zero, one or more interfaces. To export an interface on a DBus server, call sbus_conn_add_interface() from within the sbus_server_conn_init_fn. To export an interface on a DBus client, call sbus_conn_add_interface() after sbus_new_connection() returns. As before struct sbus_interface represents an object exported via DBus. However it is now talloc allocated. One can set instance data on the struct sbus_interface. This instance data is passed to the various handlers and used in their implementation. However, we now have type safe interface exporting in the various high level sss_process_init() sss_monitor_init() and so on. Introspection support was not in use, and is now gone until we implement it using the metadata (future patch). Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sbus: Use constants to make dbus callsStef Walter2014-02-241-2/+2
| | | | | | | | | | | This allows us to remove duplicated information, and have the compiler check that when an method name is changed or removed the callers are updated. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* sbus: Rework sbus to use interface metadata and vtablesStef Walter2014-02-241-13/+21
| | | | | | | | | | | | | | | | | | | | Previous commits added support for interface metadata and handler vtables. This commit ports sbus_dbus_connection to use them. Port the internal uses of dbus to use the new scheme in a very minimal way. Further cleanup is possible here. This commit provides basic definitions of the internal dbus interfaces. The interfaces aren't fully defined, as the handlers will continue to unpack manually, and often overload DBus methods with different arguments (which is rather unorthodox, but not the end of the world). Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Make DEBUG macro invocations variadicNikolai Kondrashov2014-02-123-69/+69
| | | | | | | | | | | | | | | | | | | | | | | | Use a script to update DEBUG macro invocations to use it as a variadic macro, supplying format string and its arguments directly, instead of wrapping them in parens. This script was used to update the code: grep -rwl --include '*.[hc]' DEBUG . | while read f; do mv "$f"{,.orig} perl -e \ 'use strict; use File::Slurp; my $text=read_file(\*STDIN); $text=~s#(\bDEBUG\s*\([^(]+)\((.*?)\)\s*\)\s*;#$1$2);#gs; print $text;' < "$f.orig" > "$f" rm "$f.orig" done Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* SYSDB: Drop the sysdb_ctx parameter from the sysdb_ssh moduleMichal Zidek2013-11-151-4/+3
|
* SYSDB: Drop the sysdb_ctx parameter from the sysdb_search moduleMichal Zidek2013-11-151-4/+2
|
* Include header file in implementation module.Lukas Slebodnik2013-09-241-0/+1
| | | | | Declarations of public functions was in header files, but header files was not included in implementation file.
* SSH: Ensure that cmd_ctx->name will not be NULL.Lukas Slebodnik2013-08-051-4/+6
| | | | | | | | If cmd_ctx->name was not initialized by sss_parse_name then copy of name will be used. https://fedorahosted.org/sssd/ticket/1970 Coverity ID: 11647
* SSH: Update known_hosts file after unsuccessful requests as well.Jan Cholasta2013-06-271-20/+36
| | | | https://fedorahosted.org/sssd/ticket/1949
* Lookup domains at startupSumit Bose2013-06-041-0/+6
| | | | | | | | | | | | To make sure that e.g. the short/NetBIOS domain name is available this patch make sure that the responders send a get_domains request to their backends at startup the collect the domain information or read it from the cache if the backend is offline. For completeness I added this to all responders even if they do not need the information at the moment. Fixes https://fedorahosted.org/sssd/ticket/1951
* SSH: Do not skip domains with use_fully_qualified_names in host key requestsJan Cholasta2013-05-071-6/+0
|
* SSH: Use separate field for domain name in client requestsJan Cholasta2013-05-071-27/+64
| | | | | Instead of appending @domain to names when the --domain option of sss_ssh_* is used, put domain name in a separate field in client requests.
* SSH: Fix parsing of names from client requestsJan Cholasta2013-05-073-3/+30
| | | | | | Try to parse names in the form user@domain first, as that's what sss_ssh_* send in requests when the --domain option is used. Do not parse host names using domain-specific regular expression.
* Remove unused TALLOC_CTX from responder_get_domain()Sumit Bose2013-05-021-4/+2
| | | | | | Recent refactoring removed the need to copy the domain info data of sub-domains because the related objects will not be removed from memory anymore.
* change responder contexts hierarchyPavel Březina2013-03-201-9/+14
| | | | | | | | | https://fedorahosted.org/sssd/ticket/1575 The hierarchy is now: main_ctx -> responder_ctx -> specific_ctx where specific_ctx is one of sudo, pam, etc.
* do not leak memory on failure in *_process_init()Pavel Březina2013-03-201-4/+8
|
* Add function get_next_domain()Simo Sorce2013-02-101-5/+5
| | | | | | | Use this function instead of explicitly calling domain->next This function allows to get the next primary domain or to descend into the subdomains and replaces also get_next_dom_or_subdom()
* Check that strings do not go beyond the end of the packet body in autofs and ↵Jan Cholasta2013-01-231-4/+4
| | | | | | | | SSH requests. This fixes CVE-2013-0220. https://fedorahosted.org/sssd/ticket/1781
* Add domain arguments to sysdb ssh functionsSimo Sorce2013-01-151-3/+4
|
* Add domain argument to sysdb_get_user_attr()Simo Sorce2013-01-151-1/+1
|
* RESPONDERS: Create a common file with service names and versionsJakub Hrozek2012-12-182-3/+1
| | | | | | | The monitor sends calls different sbus methods to different responders. Instead of including headers of the particular responders directly in monitor, which breaks layering a little, create a common header file that will be included from src/responder/common/
* SSH: Reject requests for authorized keys of rootJan Cholasta2012-12-101-0/+5
| | | | https://fedorahosted.org/sssd/ticket/1687
* Include talloc log in our debug facilityMichal Zidek2012-10-291-1/+1
| | | | https://fedorahosted.org/sssd/ticket/1495
* Fix uninitialized pointer read in ssh_host_pubkeys_update_known_hostsJakub Hrozek2012-10-091-1/+2
|
* SSH: Expire hosts in known_hostsJan Cholasta2012-10-053-1/+21
|
* SSH: Refactor sysdb and related codeJan Cholasta2012-10-052-73/+52
|
* Add new option default_domain_suffixSumit Bose2012-10-011-1/+2
|
* SSH: Fix possible infinite loop when updating known_hostsJan Cholasta2012-09-201-3/+1
|
* SSH: Simplify public key formatting functionJan Cholasta2012-09-041-4/+2
|
* SSH: Return error code in SSH utility functionsJan Cholasta2012-09-041-6/+7
|
* Make re_expression and full_name_format per domain optionsStef Walter2012-06-121-2/+2
| | | | | | | | | | | * Allows different user/domain qualified names for different domains. For example Domain\User or user@domain. * The global re_expression and full_name_format options remain as defaults for the domains. * Subdomains get the re_expression and full_name_format of their parent domain. https://bugzilla.redhat.com/show_bug.cgi?id=811663
* SSH: Add dp_get_host_send to common responder codeJakub Hrozek2012-05-033-9/+184
| | | | | | | | Instead of using account_info request, creates a new ssh specific request. This improves code readability and will make the code more flexible in the future. https://fedorahosted.org/sssd/ticket/1176
* SSH: return NULL on error in ssh_host_pubkeys_format_known_host_plainJakub Hrozek2012-05-021-1/+2
| | | | | The 'result' pointer must be initialized tin order to always return a defined value.
* SSH: Add support for hashed known_hostsJan Cholasta2012-04-243-36/+171
| | | | https://fedorahosted.org/sssd/ticket/1203
* Modified responder_get_domain()Jan Zeleny2012-04-241-2/+2
| | | | Now it checks for subdomains as well as for the domain itself
* Convert read and write operations to sss_atomic_readJakub Hrozek2012-04-201-1/+1
| | | | https://fedorahosted.org/sssd/ticket/1209
* SSH: Allow clients to explicitly specify host aliasJan Cholasta2012-03-153-67/+38
| | | | | This change removes the need to canonicalize host names on the responder side - the relevant code was removed.
* SSH: Fix missing semicolonStephen Gallagher2012-03-091-1/+1
|
* Add umask before mkstemp() call in SSH responderJan Zeleny2012-03-091-0/+3
|
* Use the correct hash table for pending requestsSimo Sorce2012-03-081-1/+1
| | | | | | | | | | | | | The function that handled pending requests on reconnect was checking an orphaned global variable that was never used, redenring the whole function uselsess. This fixes a very nasty bug that was causing requests for which we never received an answer for (for example because the backend failed and was restarted) to be never removed and therefore causing a black hole effect for any other request of the same type. Fixes: https://fedorahosted.org/sssd/ticket/1229
* Remove sysdb_get_ctx_from_list()Sumit Bose2012-02-291-8/+6
|
generated by cgit (git 2.34.1) at 2024-06-23 16:31:02 +0000