1 |
/* $OpenBSD: servconf.h,v 1.72 2005/12/06 22:38:27 reyk Exp $ */ |
2 |
/* $FreeBSD: src/crypto/openssh/servconf.h,v 1.19 2006/03/22 20:41:37 des Exp $ */ |
3 |
|
4 |
/* |
5 |
* Author: Tatu Ylonen <ylo@cs.hut.fi> |
6 |
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
7 |
* All rights reserved |
8 |
* Definitions for server configuration data and for the functions reading it. |
9 |
* |
10 |
* As far as I am concerned, the code I have written for this software |
11 |
* can be used freely for any purpose. Any derived versions of this |
12 |
* software must be clearly marked as such, and if the derived work is |
13 |
* incompatible with the protocol description in the RFC file, it must be |
14 |
* called by a name other than "ssh" or "Secure Shell". |
15 |
*/ |
16 |
|
17 |
#ifndef SERVCONF_H |
18 |
#define SERVCONF_H |
19 |
|
20 |
#include "buffer.h" |
21 |
|
22 |
#define MAX_PORTS 256 /* Max # ports. */ |
23 |
|
24 |
#define MAX_ALLOW_USERS 256 /* Max # users on allow list. */ |
25 |
#define MAX_DENY_USERS 256 /* Max # users on deny list. */ |
26 |
#define MAX_ALLOW_GROUPS 256 /* Max # groups on allow list. */ |
27 |
#define MAX_DENY_GROUPS 256 /* Max # groups on deny list. */ |
28 |
#define MAX_SUBSYSTEMS 256 /* Max # subsystems. */ |
29 |
#define MAX_HOSTKEYS 256 /* Max # hostkeys. */ |
30 |
#define MAX_ACCEPT_ENV 256 /* Max # of env vars. */ |
31 |
|
32 |
/* permit_root_login */ |
33 |
#define PERMIT_NOT_SET -1 |
34 |
#define PERMIT_NO 0 |
35 |
#define PERMIT_FORCED_ONLY 1 |
36 |
#define PERMIT_NO_PASSWD 2 |
37 |
#define PERMIT_YES 3 |
38 |
|
39 |
#define DEFAULT_AUTH_FAIL_MAX 6 /* Default for MaxAuthTries */ |
40 |
|
41 |
typedef struct { |
42 |
u_int num_ports; |
43 |
u_int ports_from_cmdline; |
44 |
u_short ports[MAX_PORTS]; /* Port number to listen on. */ |
45 |
char *listen_addr; /* Address on which the server listens. */ |
46 |
struct addrinfo *listen_addrs; /* Addresses on which the server listens. */ |
47 |
int address_family; /* Address family used by the server. */ |
48 |
char *host_key_files[MAX_HOSTKEYS]; /* Files containing host keys. */ |
49 |
int num_host_key_files; /* Number of files for host keys. */ |
50 |
char *pid_file; /* Where to put our pid */ |
51 |
int server_key_bits;/* Size of the server key. */ |
52 |
int login_grace_time; /* Disconnect if no auth in this time |
53 |
* (sec). */ |
54 |
int key_regeneration_time; /* Server key lifetime (seconds). */ |
55 |
int permit_root_login; /* PERMIT_*, see above */ |
56 |
int ignore_rhosts; /* Ignore .rhosts and .shosts. */ |
57 |
int ignore_user_known_hosts; /* Ignore ~/.ssh/known_hosts |
58 |
* for RhostsRsaAuth */ |
59 |
int print_motd; /* If true, print /etc/motd. */ |
60 |
int print_lastlog; /* If true, print lastlog */ |
61 |
int x11_forwarding; /* If true, permit inet (spoofing) X11 fwd. */ |
62 |
int x11_display_offset; /* What DISPLAY number to start |
63 |
* searching at */ |
64 |
int x11_use_localhost; /* If true, use localhost for fake X11 server. */ |
65 |
char *xauth_location; /* Location of xauth program */ |
66 |
int strict_modes; /* If true, require string home dir modes. */ |
67 |
int tcp_keep_alive; /* If true, set SO_KEEPALIVE. */ |
68 |
char *ciphers; /* Supported SSH2 ciphers. */ |
69 |
char *macs; /* Supported SSH2 macs. */ |
70 |
int protocol; /* Supported protocol versions. */ |
71 |
int gateway_ports; /* If true, allow remote connects to forwarded ports. */ |
72 |
SyslogFacility log_facility; /* Facility for system logging. */ |
73 |
LogLevel log_level; /* Level for system logging. */ |
74 |
int rhosts_rsa_authentication; /* If true, permit rhosts RSA |
75 |
* authentication. */ |
76 |
int hostbased_authentication; /* If true, permit ssh2 hostbased auth */ |
77 |
int hostbased_uses_name_from_packet_only; /* experimental */ |
78 |
int rsa_authentication; /* If true, permit RSA authentication. */ |
79 |
int pubkey_authentication; /* If true, permit ssh2 pubkey authentication. */ |
80 |
int kerberos_authentication; /* If true, permit Kerberos |
81 |
* authentication. */ |
82 |
int kerberos_or_local_passwd; /* If true, permit kerberos |
83 |
* and any other password |
84 |
* authentication mechanism, |
85 |
* such as SecurID or |
86 |
* /etc/passwd */ |
87 |
int kerberos_ticket_cleanup; /* If true, destroy ticket |
88 |
* file on logout. */ |
89 |
int kerberos_get_afs_token; /* If true, try to get AFS token if |
90 |
* authenticated with Kerberos. */ |
91 |
int gss_authentication; /* If true, permit GSSAPI authentication */ |
92 |
int gss_cleanup_creds; /* If true, destroy cred cache on logout */ |
93 |
int password_authentication; /* If true, permit password |
94 |
* authentication. */ |
95 |
int kbd_interactive_authentication; /* If true, permit */ |
96 |
int challenge_response_authentication; |
97 |
int permit_empty_passwd; /* If false, do not permit empty |
98 |
* passwords. */ |
99 |
int permit_user_env; /* If true, read ~/.ssh/environment */ |
100 |
int use_login; /* If true, login(1) is used */ |
101 |
int compression; /* If true, compression is allowed */ |
102 |
int allow_tcp_forwarding; |
103 |
u_int num_allow_users; |
104 |
char *allow_users[MAX_ALLOW_USERS]; |
105 |
u_int num_deny_users; |
106 |
char *deny_users[MAX_DENY_USERS]; |
107 |
u_int num_allow_groups; |
108 |
char *allow_groups[MAX_ALLOW_GROUPS]; |
109 |
u_int num_deny_groups; |
110 |
char *deny_groups[MAX_DENY_GROUPS]; |
111 |
|
112 |
u_int num_subsystems; |
113 |
char *subsystem_name[MAX_SUBSYSTEMS]; |
114 |
char *subsystem_command[MAX_SUBSYSTEMS]; |
115 |
|
116 |
u_int num_accept_env; |
117 |
char *accept_env[MAX_ACCEPT_ENV]; |
118 |
|
119 |
int max_startups_begin; |
120 |
int max_startups_rate; |
121 |
int max_startups; |
122 |
int max_authtries; |
123 |
char *banner; /* SSH-2 banner message */ |
124 |
int use_dns; |
125 |
int client_alive_interval; /* |
126 |
* poke the client this often to |
127 |
* see if it's still there |
128 |
*/ |
129 |
int client_alive_count_max; /* |
130 |
* If the client is unresponsive |
131 |
* for this many intervals above, |
132 |
* disconnect the session |
133 |
*/ |
134 |
|
135 |
char *authorized_keys_file; /* File containing public keys */ |
136 |
char *authorized_keys_file2; |
137 |
|
138 |
int use_pam; /* Enable auth via PAM */ |
139 |
|
140 |
int permit_tun; |
141 |
} ServerOptions; |
142 |
|
143 |
void initialize_server_options(ServerOptions *); |
144 |
void fill_default_server_options(ServerOptions *); |
145 |
int process_server_config_line(ServerOptions *, char *, const char *, int); |
146 |
void load_server_config(const char *, Buffer *); |
147 |
void parse_server_config(ServerOptions *, const char *, Buffer *); |
148 |
|
149 |
#endif /* SERVCONF_H */ |