From nobody Thu Jun 16 13:38:22 2022 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id C295F83F41D; Thu, 16 Jun 2022 13:38:22 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4LP3Cf56TGz4s8G; Thu, 16 Jun 2022 13:38:22 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1655386702; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=eH7paOZMymE1741YTWHSMHPzU+hfelXs9kj9UCHjC6E=; b=darGTTiduwaiiWH6o5tzm51WT394yMFsi0/rhoRZJHAQ6Dkmw24v9RYCsH1EmsOGMKmuL5 RtfQepWkFo5BANrOhbvRL8xqV7B5+95A9qoD3i7LXj1OgcAMF09KySN0EPQOvKEQUSF+2B /aUl458yOkYsdf/I/VBmjUjfqBZMeC45CIwDATeeyQkBGAAc7aABY51l824yuBqp6FlnEK 06ubhnBKDoytD9y07mT3WwxTA5MRXMIOV7auzh+yXCQIqGfzBcVg23VIc3cn10gpoW5E3j rC2bi8JT8gDVLQ+nIMK9HAXIZ41gQ9w3Dv6geXjzCzGLf2v90Cax8s2QcX4jsA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 8AE5D42A9; Thu, 16 Jun 2022 13:38:22 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 25GDcMGl069851; Thu, 16 Jun 2022 13:38:22 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 25GDcME7069850; Thu, 16 Jun 2022 13:38:22 GMT (envelope-from git) Date: Thu, 16 Jun 2022 13:38:22 GMT Message-Id: <202206161338.25GDcME7069850@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Ed Maste Subject: git: a5e7c28b9b84 - stable/12 - sshd_config: clarify password authentication options List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-all@freebsd.org X-BeenThere: dev-commits-src-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: emaste X-Git-Repository: src X-Git-Refname: refs/heads/stable/12 X-Git-Reftype: branch X-Git-Commit: a5e7c28b9b84b81bbb8a8242ae44cc073b0103dc Auto-Submitted: auto-generated ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1655386702; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=eH7paOZMymE1741YTWHSMHPzU+hfelXs9kj9UCHjC6E=; b=QUJ3IDfsrImLr3NpICNffLlQ323QCaxkn8McmSKfHxTGKJRVYnZHL7eXzIATSLAUTckdEZ CQ4peOn3Roav2mMqDPC7UOz1rup95CzZ8AMmy02UxyoCd9IlkeDBtV2qwsdhOqSwFy+XA2 Vn270tVKNV5e59RQxOn355JFr2vZUxtAXGtqNsKtB8R4aaXRQ3pHmk3anH+6vQebVvGS4/ RzRIMXl8AkmebaiBZPHApJK933yAfjePMTTiIDNxLTgl/lMdmZSBAtan6HmM7D15hSyUhh bLI9r24y3hIZBKLa4pc3pyIYrm+JxAcFGsL1axSWdwOO+LZNh2WHw/h/pboU/w== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1655386702; a=rsa-sha256; cv=none; b=J9/2TUWiKgMAXHLnZiG+IYUv6cM2GImo6pG3KkmtxnW8+xuJUksUapx896t7JCD0RtuKDB l6+l1N6OOOg1gR0je5AwereeAWi71IWmFJlF7JisTLpZjS4bE+s1XEhFFGQe93NuDpIHCH AWb1ZX7JuVe0fiIyy4eoasE8DsgTuOj/IY15z1bdbu8SHmEChUr5ba6O18N8DBu2XKzbKk HJtUlR0hCUzE4ue9+tB9AFczXwVHh4j/R+luQaO62m3D5kd6IZe0Z/dtWI637ygbu2nuYK waoNwMWpY8bGTUCbRHEJfemd2joV1GYZnIbxq/faAZykpyc7niSGOwaAGQm+Aw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N The branch stable/12 has been updated by emaste: URL: https://cgit.FreeBSD.org/src/commit/?id=a5e7c28b9b84b81bbb8a8242ae44cc073b0103dc commit a5e7c28b9b84b81bbb8a8242ae44cc073b0103dc Author: Ed Maste AuthorDate: 2022-05-25 13:32:57 +0000 Commit: Ed Maste CommitDate: 2022-06-16 13:37:36 +0000 sshd_config: clarify password authentication options Passwords may be accepted by both the PasswordAuthentication and KbdInteractiveAuthentication authentication schemes. Add a reference to the latter in the description/comment for PasswordAuthentication, as it otherwise may seem that "PasswordAuthentication no" implies passwords will be disallowed. This situation should be clarified with more extensive documentation on the authentication schemes and configuration options, but that should be done in coordination with upstream OpenSSH. This is a minimal change that will hopefully clarify the situation without requiring an extensive local patch set. PR: 263045 Reviewed by: manu (earlier version) MFC after: 2 weeks Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D35272 (cherry picked from commit 9f009e066f088e2c31442db31d2a85001040abfe) --- crypto/openssh/sshd_config | 1 + crypto/openssh/sshd_config.5 | 2 ++ 2 files changed, 3 insertions(+) diff --git a/crypto/openssh/sshd_config b/crypto/openssh/sshd_config index 00b6c4366526..2ef36f63ae62 100644 --- a/crypto/openssh/sshd_config +++ b/crypto/openssh/sshd_config @@ -58,6 +58,7 @@ AuthorizedKeysFile .ssh/authorized_keys #IgnoreRhosts yes # Change to yes to enable built-in password authentication. +# Note that passwords may also be accepted via KbdInteractiveAuthentication. #PasswordAuthentication no #PermitEmptyPasswords no diff --git a/crypto/openssh/sshd_config.5 b/crypto/openssh/sshd_config.5 index 998d28f8c2e1..2daaa0817bd9 100644 --- a/crypto/openssh/sshd_config.5 +++ b/crypto/openssh/sshd_config.5 @@ -1278,6 +1278,8 @@ The default is .Pa /etc/moduli . .It Cm PasswordAuthentication Specifies whether password authentication is allowed. +Note that passwords may also be accepted via +.Cm KbdInteractiveAuthentication . See also .Cm UsePAM . The default is