From Darren.Moffat@sun.com Wed Aug 19 05:26:22 2009 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7JCQMfC024637 for ; Wed, 19 Aug 2009 05:26:22 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n7JCQKol040548; Wed, 19 Aug 2009 06:26:21 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KOM00I0FIJWKT00@nwk-avmta-1.sfbay.Sun.COM>; Wed, 19 Aug 2009 05:26:20 -0700 (PDT) Received: from gmp-eb-inf-1.sun.com ([192.18.6.21]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KOM000ZEIJVA570@nwk-avmta-1.sfbay.Sun.COM>; Wed, 19 Aug 2009 05:26:20 -0700 (PDT) Received: from fe-emea-10.sun.com (gmp-eb-lb-1-fe1.eu.sun.com [192.18.6.7] (may be forged)) by gmp-eb-inf-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n7JCQI6K008715; Wed, 19 Aug 2009 12:26:19 +0000 (GMT) Received: from conversion-daemon.fe-emea-10.sun.com by fe-emea-10.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) id <0KOM00D00GKOWB00@fe-emea-10.sun.com>; Wed, 19 Aug 2009 13:26:16 +0100 (BST) Received: from [192.168.1.105] (cpc2-rdng20-2-0-cust917.15-3.cable.virginmedia.com [86.28.167.150]) by fe-emea-10.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) with ESMTPSA id <0KOM00M9YIJGR950@fe-emea-10.sun.com>; Wed, 19 Aug 2009 13:26:05 +0100 (BST) Date: Wed, 19 Aug 2009 13:26:04 +0100 From: Darren J Moffat Subject: sshd PreUserAuthHook [PSARC/2009/449 FastTrack timeout 08/25/2009] Sender: Darren.Moffat@sun.com To: PSARC-ext@sun.com Cc: Erik.Trauschke@sun.com, Alan.Burlison@sun.com, ssh-iteam@sun.com Message-id: <4A8BEF5C.2070200@Sun.COM> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 User-Agent: Thunderbird 2.0.0.21 (X11/20090623) Status: RO Content-Length: 7573 Template Version: @(#)onepager.txt 1.35 07/11/07 SMI Copyright 2007 Sun Microsystems 1. Introduction 1.1. Project/Component Working Name: Extension of SSHD to allow public keys to be provided by executables 1.2. Name of Document Author/Supplier: Erik Trauschke 1.3. Date of This Document: 11/06/2009 1.3.1. Date this project was conceived: 04/2009 1.4. Name of Major Document Customer(s)/Consumer(s): 1.4.1. The PAC or CPT you expect to review your project: Solaris PAC 1.4.2. The ARC(s) you expect to review your project: PSARC 1.4.3. The Director/VP who is "Sponsoring" this project: Vincent.Murphy@sun.com 1.4.4. The name of your business unit: OpenSolaris 1.5. Email Aliases: 1.5.1. Responsible Manager: Bonnie.Corwin@sun.com 1.5.2. Responsible Engineer: Erik.Trauschke@sun.com 1.5.3. Marketing Manager: N/A 1.5.4. Interest List: Alan.Burlison@sun.com 2. Project Summary 2.1. Project Description: This extension to Secure Shell Daemon (SSHD) allows it to run an configuration-defined executable before user authentication. This can be used to retrieve user-related data, which is required for authentication (like e.g. SSH keys), from arbitrary systems such as databases and remote authentication facilities. 2.2. Risks and Assumptions: The proposed change to SSHD adds a new configuration option to sshd that will be specific to the Sun version of SSHD. However, the modified SSHD will still be fully compatible with the configuration files used by the current version of SSHD. The change will therefore not require any changes to existing customized configuration files. The use of an executable run before authentication could potentially introduce security issues if the executable is not written correctly. However only the superuser can activate this functionality, and there are already multiple ways an administrator could compromise security by misconfiguration of SSHD, so the incremental risk introduced by this modification is small. 3. Business Summary 3.1. Problem Area: The OpenSolaris.org infrastructure needs to be able to authenticate SSH sessions against an external XML-RPC service. After discussion with the Sun SSH maintainers, it was agreed that this was a generally useful feature, and it should therefore be added to the Solaris SSHD. 3.2. Market/Requester: OpenSolaris 4. Technical Description: 4.1. Details: The changes involve the addition of a new configuration directive to the SSHD configuration file (/etc/ssh/sshd_config) named PreUserauthHook. It only parameter is the path to an executable which is run before each authentication method. The executable is invoked with two arguments. The first argument specifies the name of the authentication method currently processed, the second specifies the username of the user trying to log in. Furthermore SSHD passes an environment variable named SSH_CONNECTION to the executable, which is equivalent to the SSH_CONNECTION variable set for the SSH shell after successful login. The exit code of the executable defines if the current authentication method will be continued or aborted. If the executable exits with an exit code of zero the authentication method will be processed as normal. If the exit status is 1 the current authentication is aborted and authentication continues with the next method, if any. The executable is furthermore required to have defined permissions, namely owned by the user running SSHD (normally root) and with only read and execute permissions for that user (0500). 4.2. Bug/RFE Number(s): 6850175 Extension of SSHD to run an executable prior to user authentication 4.5. Interfaces: The modified SSHD will accept a new option in its configuration file (/etc/ssh/sshd_config) named PreUserauthHook. The parameters for this option are the path to the executable. Example: PreUserauthHook /opt/oso/bin/synckeys Calls the executable "synckeys". Stability level: Committed Release binding: patch 4.6. Doc Impact: Suggested manpage addition: PreUserauthHook Specifies an executable which will be run prior to any of the processed authentication methods. The executable can be used to synchronize user information with a remote user-management facility using an arbitrary communication protocol. The executable is run before any user validation is conducted by SSHD so the user is not required to be existent before she tries to log in. The executable is invoked with two arguments in the following order: the name of the current authentication method and the username. Furthermore the environment variable SSH_CONNECTION (see sshd(1M)) is passed to the executable. If the executable returns a zero exit status, the current authentication method is processed as normal. If the exit status is 1 the current authentication method is ignored and can not be used to validate the user. The executable must be owned by root and have permissions of 0500, otherwise it will be treated as if it has exited with status 1. There is no default value for this property. 4.7. Admin/Config Impact: A new option will be available in the configuration file for SSHD which specifies the executable to be run to retrieve public keys. See 4.5 4.10. Packaging & Delivery: All affected components are in the SUNWssh package (OpenSolaris) or in the SUNWsshdu package (Nevada), respectively. 4.11. Security Impact: If SSHD is configured to use the PreUserauthHook the system administrator needs to be aware of the security implications of having an executable retrieving keys. SSHD will require the executable to be owned by the user running the SSHD process, and will verify that the executable is only user readable and user executable (0500). 4.12. Dependencies: none 6. Resources and Schedule: 6.1. Projected Availability: 08/2009 6.2. Cost of Effort: 1 man/month 6.3. Cost of Capital Resources: 0 6.4. Product Approval Committee requested information: 6.4.1. Consolidation or Component Name: ON 6.4.3. Type of CPT Review and Approval expected: FastTrack 6.4.7. Target RTI Date/Release: 08/2009 6.4.8. Target Code Design Review Date: 14/08/2009 6.5. ARC review type: FastTrack 6.6. ARC Exposure: open -- Darren J Moffat From Darren.Moffat@sun.com Tue Sep 1 03:08:26 2009 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n81A8QUK013107 for ; Tue, 1 Sep 2009 03:08:26 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n81A8PuY027008 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Tue, 1 Sep 2009 03:08:25 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KPA0060BEU1FA00@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 01 Sep 2009 04:08:25 -0600 (MDT) Received: from gmp-eb-inf-1.sun.com ([192.18.6.21]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KPA00JRDEU0BSE0@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 01 Sep 2009 04:08:24 -0600 (MDT) Received: from fe-emea-10.sun.com (gmp-eb-lb-1-fe1.eu.sun.com [192.18.6.7] (may be forged)) by gmp-eb-inf-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n81A8NeJ009451 for ; Tue, 01 Sep 2009 10:08:23 +0000 (GMT) Received: from conversion-daemon.fe-emea-10.sun.com by fe-emea-10.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) id <0KPA00K00EMED000@fe-emea-10.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 01 Sep 2009 11:08:17 +0100 (BST) Received: from [192.168.1.105] (cpc2-rdng20-2-0-cust917.15-3.cable.virginmedia.com [86.28.167.150]) by fe-emea-10.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) with ESMTPSA id <0KPA00G29ET9GFF0@fe-emea-10.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 01 Sep 2009 11:07:57 +0100 (BST) Date: Tue, 01 Sep 2009 11:07:57 +0100 From: Darren J Moffat Subject: Re: sshd PreUserAuthHook [PSARC/2009/449 FastTrack timeout 08/25/2009] In-reply-to: <1251725076.859.44.camel@yogi> Sender: Darren.Moffat@sun.com To: Erik Trauschke Cc: PSARC-ext@sun.com Message-id: <4A9CF27D.7070009@Sun.COM> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <4A8BEF5C.2070200@Sun.COM> <1251725076.859.44.camel@yogi> User-Agent: Thunderbird 2.0.0.22 (X11/20090804) Status: RO Content-Length: 355 This case past its time out, there was not PSARC meeting that week (would have been 26th August). There has been no +1 or any comments from anyone and we are already one week past the original timer today. I'm setting the timer to the date of the next PSARC meeting (2nd Sept). Please can we have an ARC member review this case. -- Darren J Moffat From garrett@damore.org Wed Sep 2 09:18:18 2009 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n82GII0n026423 for ; Wed, 2 Sep 2009 09:18:18 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n82GIDYi016992 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 2 Sep 2009 09:18:17 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KPC00B03QMGVI00@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 02 Sep 2009 09:18:16 -0700 (PDT) Received: from sca-ea-mail-4.sun.com ([192.18.43.22]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KPC00B6ZQMG9L20@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 02 Sep 2009 09:18:16 -0700 (PDT) Received: from relay14i.sun.com (ip124.net129179-4.block1.us.syntegra.com [129.179.4.124]) by sca-ea-mail-4.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n82GFlGO015332 for ; Wed, 02 Sep 2009 16:18:15 +0000 (GMT) Received: from mmp11es.mmp.us.syntegra.com ([160.41.208.11] [160.41.208.11]) by relay14i.sun.com with ESMTP id BT-MMP-806607 for PSARC-ext@sun.com; Wed, 02 Sep 2009 16:18:15 +0000 (Z) Received: from relay15i.sun.com (relay15i.sun.com [129.179.4.125]) by mmp11es.mmp.us.syntegra.com with ESMTP id BT-MMP-12915129 for PSARC-ext@sun.com; Wed, 02 Sep 2009 16:18:15 +0000 (Z) Received: from outbound-mail-159.bluehost.com ([67.222.39.39] [67.222.39.39]) by relay1i.sun.com id BT-MMP-21928213 for PSARC-ext@sun.com; Wed, 02 Sep 2009 16:18:15 +0000 (Z) Received: (qmail 21556 invoked by uid 0); Wed, 02 Sep 2009 16:18:14 +0000 Received: from unknown (HELO box374.bluehost.com) (69.89.31.174) by outboundproxy5.bluehost.com with SMTP; Wed, 02 Sep 2009 16:18:14 +0000 Received: from sca-ea-fw-1.sun.com ([192.18.43.225] helo=[10.7.251.172]) by box374.bluehost.com with esmtpsa (TLSv1:AES256-SHA:256) (Exim 4.69) (envelope-from ) id 1MisXG-0006oZ-Pf for PSARC-ext@sun.com; Wed, 02 Sep 2009 10:18:14 -0600 Date: Wed, 02 Sep 2009 09:18:13 -0700 From: "Garrett D'Amore" Subject: PSARC 2009/449 sshd PreUserAuthHook To: PSARC-ext Message-id: <4A9E9AC5.8010106@damore.org> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=default; d=damore.org; h=Received:Message-ID:Date:From:User-Agent:MIME-Version:To:Subject:Content-Type:Content-Transfer-Encoding:X-Identified-User; b=kuWOvlO+xlMSMOvEcFbYxN0Ame5dzxKK9XjfmLfPau8oXsKpNzwdxRJRc97n/ZG9azL+Y+EITgZDIo9g05yMz1brbiblvKha82WTSICAvCR4fmEFdZ3a4S4poiTC2c67; X-PMX-Version: 5.4.1.325704 X-Brightmail-Tracker: AAAAAA== X-Identified-User: {2225:box374.bluehost.com:damoreor:damore.org} {sentby:smtp auth 192.18.43.225 authed with garrett+damore.org} User-Agent: Thunderbird 2.0.0.18 (X11/20081201) Status: RO Content-Length: 17 +1 on this case. From Darren.Moffat@Sun.COM Thu Sep 3 01:11:14 2009 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n838BExX017194 for ; Thu, 3 Sep 2009 01:11:14 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n838AtdQ017780 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Thu, 3 Sep 2009 01:11:13 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KPD0000VYQKDQ00@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 03 Sep 2009 01:11:08 -0700 (PDT) Received: from gmp-eb-inf-2.sun.com ([192.18.6.24]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KPD00IQ3YQIHS60@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 03 Sep 2009 01:11:06 -0700 (PDT) Received: from fe-emea-09.sun.com (gmp-eb-lb-1-fe1.eu.sun.com [192.18.6.7] (may be forged)) by gmp-eb-inf-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n838B5hW023986 for ; Thu, 03 Sep 2009 08:11:05 +0000 (GMT) Received: from conversion-daemon.fe-emea-09.sun.com by fe-emea-09.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) id <0KPD00K00YGTR100@fe-emea-09.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 03 Sep 2009 09:10:48 +0100 (BST) Received: from [192.168.1.105] (cpc2-rdng20-2-0-cust917.15-3.cable.virginmedia.com [86.28.167.150]) by fe-emea-09.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) with ESMTPSA id <0KPD00KI4YPZVU30@fe-emea-09.sun.com>; Thu, 03 Sep 2009 09:10:47 +0100 (BST) Date: Thu, 03 Sep 2009 09:10:47 +0100 From: Darren J Moffat Subject: PSARC/2009/449 sshd PreUserAuthHook Sender: Darren.Moffat@Sun.COM To: PSARC-ext@Sun.COM, Erik.Trauschke@Sun.COM, Alan.Burlison@sun.sun.com Message-id: <4A9F7A07.5010505@Sun.COM> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 User-Agent: Thunderbird 2.0.0.22 (X11/20090804) Status: RO Content-Length: 76 This case was approved in PSARC on Wednesday 2nd Sept. -- Darren J Moffat