From nobody Thu Jun 16 12:51:45 2022 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id DE9A58370AF; Thu, 16 Jun 2022 12:51:46 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4LP29t0znhz4lhP; Thu, 16 Jun 2022 12:51:45 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1655383906; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=bB4ndYaDceLeEBlpymTHz/M7kDIOtjQsSWkYPtPfQn4=; b=OkOMvE/IxdhLBR/n1zZxyzNJmJcDY1T06rbr8wftenlAE180xegoQZYHVPhYmWQZX3LGfW nyDKO8R84Beu6YhDS6v6Ko9QzHAh50o9YOkRtxSnRsU70DYgpRBxasJq5fyoL2A07gDVj4 EFMtXqJKyLnjNr38fVZOChSKScz3uZx0MYYG+GEERifG6fbOtTO89Cr0vnHFXTgQiqb8n7 r1tbT1muxuLd08rVi5z4LfWNo7xiBWNhXxj1iyh/C/WD5m7PaYeLiQlwmnbBjOpFiFEeEO oFwsrZpG5hBZqJNhLXF2yTv+nQC3UQ2PzWy9rTcM8gDiPH5b6VbcTvqxuOHK3Q== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id AD2AC3813; Thu, 16 Jun 2022 12:51:45 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 25GCpjwc014496; Thu, 16 Jun 2022 12:51:45 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 25GCpjPO014495; Thu, 16 Jun 2022 12:51:45 GMT (envelope-from git) Date: Thu, 16 Jun 2022 12:51:45 GMT Message-Id: <202206161251.25GCpjPO014495@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Ed Maste Subject: git: ce8133a5218b - stable/13 - sshd_config: clarify password authentication options List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-all@freebsd.org X-BeenThere: dev-commits-src-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: emaste X-Git-Repository: src X-Git-Refname: refs/heads/stable/13 X-Git-Reftype: branch X-Git-Commit: ce8133a5218b1f0e3ed17579029fcb12be93cf2d Auto-Submitted: auto-generated ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1655383906; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=bB4ndYaDceLeEBlpymTHz/M7kDIOtjQsSWkYPtPfQn4=; b=sK4WSeEoEDnZYj+9IktZ2b+7yt4IMZ5pDllDXC7PWsLTotlu0UcrGNrDk2oSJ7BL2oqrcj gmfR0AIook9oWrSwTzwBDDVdjRulQFrATqhQHOnQDxFPLmkeTXednu8MC2yt+Dg2AyPLSs 0FgHkxc5qY8zFlfvmM4ylwmTP/yypUXgLIHxZJV2CmyqUmYKapykYcR7vCP3qt48kS9PSS nxXbt3GceRpFxmzHTBypjCO1FqKK7tQNF/+oa+UAz/ktIR8cGF4EWKwCHzSjhc8bANv6GX 1R+7aof5aMj1h/eMDCbU9Y7uPYR1FMfBWbwVrbOCAIbxLbeWN0F1ZVocDN+5yg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1655383906; a=rsa-sha256; cv=none; b=PgnH4ILlPYXF/VSspc0yMvcMT29wTjAJppBq4fYhz0/hraqkqPjgUFPR2hGF/Fj/5h/zfw hpsQcHEpNt7mE75GkEWEEVWCKk4Nglox6Lav5h4X2BZ1PzEhJjc3uMt3AZ4ayDXpt/2Tf5 CPol0/KxQA5Grs8p4WMfy5URz7rL9reH7Ihoom+fDrkA7QMBx71YhG8s0GZVkG5/a31ioC beAEw3e+0loZT/wm3Alk/DKSkARcbLVpjYo8JKPGtz6vV+eVxnL1EHzEJ1o/DAmHVSNKgS QcZJ1xFAybIxiyNTVmJt0k+FmjJPsDLvqcgy+25XDc+5Sz6pK0Qr8K3yVRRRMQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N The branch stable/13 has been updated by emaste: URL: https://cgit.FreeBSD.org/src/commit/?id=ce8133a5218b1f0e3ed17579029fcb12be93cf2d commit ce8133a5218b1f0e3ed17579029fcb12be93cf2d Author: Ed Maste AuthorDate: 2022-05-25 13:32:57 +0000 Commit: Ed Maste CommitDate: 2022-06-16 12:50:23 +0000 sshd_config: clarify password authentication options Passwords may be accepted by both the PasswordAuthentication and KbdInteractiveAuthentication authentication schemes. Add a reference to the latter in the description/comment for PasswordAuthentication, as it otherwise may seem that "PasswordAuthentication no" implies passwords will be disallowed. This situation should be clarified with more extensive documentation on the authentication schemes and configuration options, but that should be done in coordination with upstream OpenSSH. This is a minimal change that will hopefully clarify the situation without requiring an extensive local patch set. PR: 263045 Reviewed by: manu (earlier version) MFC after: 2 weeks Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D35272 (cherry picked from commit 9f009e066f088e2c31442db31d2a85001040abfe) --- crypto/openssh/sshd_config | 1 + crypto/openssh/sshd_config.5 | 2 ++ 2 files changed, 3 insertions(+) diff --git a/crypto/openssh/sshd_config b/crypto/openssh/sshd_config index 00b6c4366526..2ef36f63ae62 100644 --- a/crypto/openssh/sshd_config +++ b/crypto/openssh/sshd_config @@ -58,6 +58,7 @@ AuthorizedKeysFile .ssh/authorized_keys #IgnoreRhosts yes # Change to yes to enable built-in password authentication. +# Note that passwords may also be accepted via KbdInteractiveAuthentication. #PasswordAuthentication no #PermitEmptyPasswords no diff --git a/crypto/openssh/sshd_config.5 b/crypto/openssh/sshd_config.5 index 527f3d4bb46e..8d748da9a552 100644 --- a/crypto/openssh/sshd_config.5 +++ b/crypto/openssh/sshd_config.5 @@ -1277,6 +1277,8 @@ The default is .Pa /etc/moduli . .It Cm PasswordAuthentication Specifies whether password authentication is allowed. +Note that passwords may also be accepted via +.Cm KbdInteractiveAuthentication . See also .Cm UsePAM . The default is