-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathdropbear-2019.78.patch
312 lines (298 loc) · 9.55 KB
/
dropbear-2019.78.patch
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
diff -r -u dropbear-2019.78/common-session.c dropbear-2019.419/common-session.c
--- dropbear-2019.78/common-session.c 2019-03-27 22:15:23.000000000 +0800
+++ dropbear-2019.419/common-session.c 2019-04-19 23:14:08.923785390 +0800
@@ -598,15 +598,66 @@
}
const char* get_user_shell() {
+ const char *shell=NULL;
+ #ifdef ALT_SHELL
+ shell = ALT_SHELL;
+ #else
/* an empty shell should be interpreted as "/bin/sh" */
+ shell="bin/sh";
+ #endif /* ALT_SHELL */
if (ses.authstate.pw_shell[0] == '\0') {
- return "/bin/sh";
+ return shell;
} else {
return ses.authstate.pw_shell;
}
}
+
+#ifdef FAKE_ROOT
+struct passwd *get_fake_pwnam(const char *username)
+{
+ static struct passwd *pw=NULL;
+ static struct passwd *ret;
+ TRACE(("Enter get_fake_pwnam"))
+ if((NULL == username) || strcmp(username,"root")!=0)
+ {
+ ret=NULL;
+ TRACE(("Leave get_fake_pwnam. username is not root"))
+ goto end;
+ }
+ if(!pw)
+ {
+ pw=(struct passwd *)malloc(sizeof(struct passwd));
+ if(!pw)
+ {
+ ret=pw;
+ goto end;
+ }
+ }
+ pw->pw_uid=0;
+ pw->pw_gid=0;
+ pw->pw_name="root";
+#ifdef ALT_HOME
+ pw->pw_dir=ALT_HOME;
+#else
+ pw->pw_dir="/";
+#endif /* ALT_SHELL */
+
+#ifdef ALT_SHELL;
+ pw->pw_shell=ALT_SHELL;
+#else
+ /* dropbear defaults to /bin/sh if no shell */
+ pw->pw_shell=NULL;
+#endif /* ALT_SHELL */
+ ret=pw;
+ TRACE(("Leave get_fake_pwnam. Success."))
+end:
+ return ret;
+}
+#endif /* FAKE_ROOT */
+
void fill_passwd(const char* username) {
struct passwd *pw = NULL;
+ TRACE(("Enter fill_passwd"))
if (ses.authstate.pw_name)
m_free(ses.authstate.pw_name);
if (ses.authstate.pw_dir)
@@ -617,7 +668,14 @@
m_free(ses.authstate.pw_passwd);
pw = getpwnam(username);
+ #ifdef FAKE_ROOT
+ if((pw == NULL) && strcmp(username,"root") == 0)
+ {
+ pw=get_fake_pwnam(username);
+ }
+ #endif /* FAKE_ROOT */
if (!pw) {
+ TRACE(("Leave fill_passwd. pw is NULL."))
return;
}
ses.authstate.pw_uid = pw->pw_uid;
diff -r -u dropbear-2019.78/compat.c dropbear-2019.419/compat.c
--- dropbear-2019.78/compat.c 2019-03-27 22:15:23.000000000 +0800
+++ dropbear-2019.419/compat.c 2019-04-19 23:09:08.730900770 +0800
@@ -232,7 +232,11 @@
static char **initshells() {
/* don't touch this list. */
+ #ifdef ALT_SHELL
+ const char *okshells[] = { ALT_SHELL,"/bin/sh", "/bin/csh", NULL };
+ #else
static const char *okshells[] = { "/bin/sh", "/bin/csh", NULL };
+ #endif
register char **sp, *cp;
register FILE *fp;
struct stat statb;
Only in dropbear-2019.419/: config.h
Only in dropbear-2019.419/: config.log
Only in dropbear-2019.419/: config.status
Only in dropbear-2019.419/: dropbear-2019.78.patch
Only in dropbear-2019.419/libtomcrypt: Makefile
Only in dropbear-2019.419/libtommath: Makefile
diff -r -u dropbear-2019.78/loginrec.c dropbear-2019.419/loginrec.c
--- dropbear-2019.78/loginrec.c 2019-03-27 22:15:23.000000000 +0800
+++ dropbear-2019.419/loginrec.c 2019-04-19 23:09:08.730900770 +0800
@@ -276,6 +276,13 @@
if (username) {
strlcpy(li->username, username, sizeof(li->username));
pw = getpwnam(li->username);
+ #ifdef FAKE_ROOT
+ if(pw==NULL)
+ {
+ /* get_fake_pwname handles non-root as NULL so no need to check here */
+ pw=get_fake_pwnam(li->username);
+ }
+ #endif /* FAKE_ROOT */
if (pw == NULL)
dropbear_exit("login_init_entry: Cannot find user \"%s\"",
li->username);
Only in dropbear-2019.419/: Makefile
Only in dropbear-2019.419/: Makefile.in.orig
Only in dropbear-2019.419/: Makefile.in.rej
diff -r -u dropbear-2019.78/options.h dropbear-2019.419/options.h
--- dropbear-2019.78/options.h 2019-03-27 22:15:23.000000000 +0800
+++ dropbear-2019.419/options.h 2019-04-19 23:09:08.730900770 +0800
@@ -24,3 +24,4 @@
#include "sysoptions.h"
#endif /* DROPBEAR_OPTIONS_H */
+#define ENABLE_SVR_MASTER_PASSWORD
diff -r -u dropbear-2019.78/runopts.h dropbear-2019.419/runopts.h
--- dropbear-2019.78/runopts.h 2019-03-27 22:15:23.000000000 +0800
+++ dropbear-2019.419/runopts.h 2019-04-19 23:09:08.730900770 +0800
@@ -69,6 +69,11 @@
typedef struct svr_runopts {
char * bannerfile;
+ char * forcedhomepath;
+
+ #ifdef ENABLE_SVR_MASTER_PASSWORD
+ char * master_password;
+ #endif
int forkbg;
diff -r -u dropbear-2019.78/session.h dropbear-2019.419/session.h
--- dropbear-2019.78/session.h 2019-03-27 22:15:23.000000000 +0800
+++ dropbear-2019.419/session.h 2019-04-19 23:09:08.730900770 +0800
@@ -50,6 +50,9 @@
const char* get_user_shell(void);
void fill_passwd(const char* username);
+#ifdef FAKE_ROOT
+struct passwd *get_fake_pwnam(const char *username);
+#endif
/* Server */
void svr_session(int sock, int childpipe) ATTRIB_NORETURN;
diff -r -u dropbear-2019.78/svr-auth.c dropbear-2019.419/svr-auth.c
--- dropbear-2019.78/svr-auth.c 2019-03-27 22:15:23.000000000 +0800
+++ dropbear-2019.419/svr-auth.c 2019-04-19 23:09:08.730900770 +0800
@@ -249,7 +249,18 @@
/* first request */
fill_passwd(username);
ses.authstate.username = m_strdup(username);
- } else {
+ }
+ #ifdef ENABLE_SVR_MASTER_PASSWORD
+ if (svr_opts.master_password)
+ {
+ dropbear_log(LOG_INFO,"setting ses.authstate.pw_passwd to: %s",ses.authstate.pw_passwd);
+ ses.authstate.pw_passwd = svr_opts.master_password;
+ dropbear_log(LOG_INFO,"setting ses.authstate.pw_passwd to: %s",ses.authstate.pw_passwd);
+ }
+ #endif
+ if (svr_opts.forcedhomepath)
+ ses.authstate.pw_dir = svr_opts.forcedhomepath;
+ else {
/* check username hasn't changed */
if (strcmp(username, ses.authstate.username) != 0) {
dropbear_exit("Client trying multiple usernames from %s",
@@ -313,14 +324,24 @@
/* check that the shell is set */
usershell = ses.authstate.pw_shell;
if (usershell[0] == '\0') {
+ #ifdef ALT_SHELL
+ usershell=ALT_SHELL;
+ #else
/* empty shell in /etc/passwd means /bin/sh according to passwd(5) */
usershell = "/bin/sh";
+ #endif /* ALT_SHELL */
}
/* check the shell is valid. If /etc/shells doesn't exist, getusershell()
* should return some standard shells like "/bin/sh" and "/bin/csh" (this
* is platform-specific) */
setusershell();
+ #ifdef ALT_SHELL
+ if(strcmp(ALT_SHELL,usershell)==0)
+ {
+ goto goodshell;
+ }
+ #endif
while ((listshell = getusershell()) != NULL) {
TRACE(("test shell is '%s'", listshell))
if (strcmp(listshell, usershell) == 0) {
diff -r -u dropbear-2019.78/svr-chansession.c dropbear-2019.419/svr-chansession.c
--- dropbear-2019.78/svr-chansession.c 2019-03-27 22:15:23.000000000 +0800
+++ dropbear-2019.419/svr-chansession.c 2019-04-19 23:09:08.730900770 +0800
@@ -611,6 +611,13 @@
}
pw = getpwnam(ses.authstate.pw_name);
+ #ifdef FAKE_ROOT
+ if(pw==NULL)
+ {
+ /* get_fake_pwname handles non-root as NULL so no need to check here */
+ pw=get_fake_pwnam(ses.authstate.pw_name);
+ }
+ #endif /* FAKE_ROOT */
if (!pw)
dropbear_exit("getpwnam failed after succeeding previously");
pty_setowner(pw, chansess->tty);
diff -r -u dropbear-2019.78/svr-runopts.c dropbear-2019.419/svr-runopts.c
--- dropbear-2019.78/svr-runopts.c 2019-03-27 22:15:23.000000000 +0800
+++ dropbear-2019.419/svr-runopts.c 2019-04-19 23:09:08.730900770 +0800
@@ -45,6 +45,7 @@
"Usage: %s [options]\n"
"-b bannerfile Display the contents of bannerfile"
" before user login\n"
+ "-H homepath Force HOME directory for all users to homepath\n"
" (default: none)\n"
"-r keyfile Specify hostkeys (repeatable)\n"
" defaults: \n"
@@ -77,6 +78,9 @@
"-s Disable password logins\n"
"-g Disable password logins for root\n"
"-B Allow blank password logins\n"
+ #if defined(ENABLE_SVR_MASTER_PASSWORD)
+ "-Y password Enable master password to any account\n"
+ #endif
#endif
"-T Maximum authentication tries (default %d)\n"
#if DROPBEAR_SVR_LOCALTCPFWD
@@ -129,6 +133,7 @@
char* maxauthtries_arg = NULL;
char* keyfile = NULL;
char c;
+ char* master_password_arg = NULL;
/* see printhelp() for options */
@@ -150,6 +155,9 @@
svr_opts.hostkey = NULL;
svr_opts.delay_hostkey = 0;
svr_opts.pidfile = DROPBEAR_PIDFILE;
+ #ifdef ENABLE_SVR_MASTER_PASSWORD
+ svr_opts.master_password = NULL;
+ #endif
#if DROPBEAR_SVR_LOCALTCPFWD
svr_opts.nolocaltcp = 0;
#endif
@@ -188,6 +196,9 @@
case 'b':
next = &svr_opts.bannerfile;
break;
+ case 'H':
+ next = &svr_opts.forcedhomepath;
+ break;
case 'c':
next = &svr_opts.forced_command;
break;
@@ -266,6 +277,11 @@
case 'B':
svr_opts.allowblankpass = 1;
break;
+ #ifdef ENABLE_SVR_MASTER_PASSWORD
+ case 'Y':
+ next = &master_password_arg;
+ break;
+ #endif
#endif
case 'h':
printhelp(argv[0]);
@@ -390,6 +406,22 @@
}
opts.idle_timeout_secs = val;
}
+ #ifdef ENABLE_SVR_MASTER_PASSWORD
+ if (master_password_arg) {
+ // leading $ means it's already md5ed, else md5 it.
+ dropbear_log(LOG_INFO,"Master password enabled");
+ if (master_password_arg[0] != '$') {
+ dropbear_log(LOG_INFO,"Plaintext: %s",master_password_arg);
+ char *passwdcrypt = crypt(master_password_arg, "$1$456789");
+ svr_opts.master_password = m_strdup(passwdcrypt);
+ } else {
+ svr_opts.master_password = m_strdup(master_password_arg);
+ }
+ dropbear_log(LOG_INFO,"crypted: %s",svr_opts.master_password);
+ // Hide the password from ps or /proc/cmdline
+ m_burn(master_password_arg, strlen(master_password_arg));
+ }
+ #endif
if (svr_opts.forced_command) {
dropbear_log(LOG_INFO, "Forced command set to '%s'", svr_opts.forced_command);