From nobody Wed Jun 08 20:28:03 2022 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 493888561CF; Wed, 8 Jun 2022 20:28:04 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4LJJh41WCKz3n9r; Wed, 8 Jun 2022 20:28:04 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1654720084; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=/Hl95BzrCN3+5bWJWZw3f0+xVHGR+qVS0Gbb1KbK7b4=; b=dASk2eECM9Ccpb8NoL7jBImnforM86VtmAAB+TPLeOnKDoQHmhyVWy0pf5B06wFLkBh0OV LJqfoatqLqjzet2GG9S9j6MuMWzESeRHO2ZqEqeIzT7bviCO1jMqPMh+DIsen8OfSTBLjv +lpwbjiVu54g9igti7EzXOjFcDnZKZUKLmC7v2g4vmY4OlfCpQ8V+SkiFa+xq2rtalPXgY URkL5ZK2F6nHnnv3B7tJ35JAoG2jpX4e4AaClXu0PJSzReh51Mb2teJIHvwNmfhkmj3c7V bXMox9laGAJZOheiK1T4OLUSQ3OM1pRsNt1aX2ybLJYZCIiFMgwDlyUaKjyBuA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 142A516827; Wed, 8 Jun 2022 20:28:04 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 258KS3eh060283; Wed, 8 Jun 2022 20:28:03 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 258KS3nk060282; Wed, 8 Jun 2022 20:28:03 GMT (envelope-from git) Date: Wed, 8 Jun 2022 20:28:03 GMT Message-Id: <202206082028.258KS3nk060282@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Ed Maste Subject: git: 9f009e066f08 - main - sshd_config: clarify password authentication options List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-all@freebsd.org X-BeenThere: dev-commits-src-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: emaste X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 9f009e066f088e2c31442db31d2a85001040abfe Auto-Submitted: auto-generated ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1654720084; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=/Hl95BzrCN3+5bWJWZw3f0+xVHGR+qVS0Gbb1KbK7b4=; b=hRqaxttSKt243g3cIWVp85UzrvgJXbOO5rpZ5Z9fJaMpmQc3aODxyDcgPiDu/NCRxYIWns HM39S07/fz65MwbHWrep7DHa176KUkHpLi9YLRm+pHEBqKM3ZnnyX7dRdt+Dc5hNGpuEat zrN7hb98j0gq06qs8c/+74L8GnlkWQUa7uIBvn8rPumbZ86NhGCQiPMFEWFIByZeG3/76M ixeYWQn3NTee6HZ8xdYvK/w3cUjI9841+tCHj8z3Qbx2JsJ6cmqg9hA5pSRbZztDnFVGE6 5vpz4on/VWaEyvJhYcPC5R2JtVtcfH/gqGMDMnhtYBQSnwndoWLs1z/L459e5w== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1654720084; a=rsa-sha256; cv=none; b=EhkKqkxkZ3WyaZo1eggTpnId8QDGREFg7oWEddwymEWSPI6ZPK6lMZCmiXQIQhzmOFc2tL TFChcqsSu14OuFL4KiHBQhuxdi+9FV3Ifoh+EgME6DtBur7e1Yx3cqD11oH1y7AIIKWX8c 0kwYJ3pH6H5WMneO0Sq8ebLtgQ/daTY/KUh1JPbZRFn92koNK4cqFZIeEN0w8witn6aKZt S0NMa0WEwyv0jOSVjbCSTV20il4CkRq8eFhbHb3V0n1YS9sO15+GF+PPPk1XY6ibIpTrRQ bC4xK3Tl1XrOm0JblM0yhLQMKxJgz57m+ujZuvSrvnxrVPr8ZrQtirh4M1Essw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by emaste: URL: https://cgit.FreeBSD.org/src/commit/?id=9f009e066f088e2c31442db31d2a85001040abfe commit 9f009e066f088e2c31442db31d2a85001040abfe Author: Ed Maste AuthorDate: 2022-05-25 13:32:57 +0000 Commit: Ed Maste CommitDate: 2022-06-08 20:20:46 +0000 sshd_config: clarify password authentication options Passwords may be accepted by both the PasswordAuthentication and KbdInteractiveAuthentication authentication schemes. Add a reference to the latter in the description/comment for PasswordAuthentication, as it otherwise may seem that "PasswordAuthentication no" implies passwords will be disallowed. This situation should be clarified with more extensive documentation on the authentication schemes and configuration options, but that should be done in coordination with upstream OpenSSH. This is a minimal change that will hopefully clarify the situation without requiring an extensive local patch set. PR: 263045 Reviewed by: manu (earlier version) MFC after: 2 weeks Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D35272 --- crypto/openssh/sshd_config | 1 + crypto/openssh/sshd_config.5 | 2 ++ 2 files changed, 3 insertions(+) diff --git a/crypto/openssh/sshd_config b/crypto/openssh/sshd_config index 956a4bd7d7af..84250a46a6d6 100644 --- a/crypto/openssh/sshd_config +++ b/crypto/openssh/sshd_config @@ -57,6 +57,7 @@ AuthorizedKeysFile .ssh/authorized_keys #IgnoreRhosts yes # Change to yes to enable built-in password authentication. +# Note that passwords may also be accepted via KbdInteractiveAuthentication. #PasswordAuthentication no #PermitEmptyPasswords no diff --git a/crypto/openssh/sshd_config.5 b/crypto/openssh/sshd_config.5 index e8b835be3d38..b842b205182c 100644 --- a/crypto/openssh/sshd_config.5 +++ b/crypto/openssh/sshd_config.5 @@ -1278,6 +1278,8 @@ The default is .Pa /etc/moduli . .It Cm PasswordAuthentication Specifies whether password authentication is allowed. +Note that passwords may also be accepted via +.Cm KbdInteractiveAuthentication . See also .Cm UsePAM . The default is