mirror of
https://github.com/freebsd/freebsd-src
synced 2024-07-21 18:27:22 +00:00
535af610a4
Excerpts from the release notes: * ssh-agent(1): PKCS#11 modules must now be specified by their full paths. Previously dlopen(3) could search for them in system library directories. * ssh(1): allow forwarding Unix Domain sockets via ssh -W. * ssh(1): add support for configuration tags to ssh(1). This adds a ssh_config(5) "Tag" directive and corresponding "Match tag" predicate that may be used to select blocks of configuration similar to the pf.conf(5) keywords of the same name. * ssh(1): add a "match localnetwork" predicate. This allows matching on the addresses of available network interfaces and may be used to vary the effective client configuration based on network location. * ssh-agent(1): improve isolation between loaded PKCS#11 modules by running separate ssh-pkcs11-helpers for each loaded provider. * ssh-agent(1), ssh(1): improve defences against invalid PKCS#11 modules being loaded by checking that the requested module contains the required symbol before loading it. * ssh(1): don't incorrectly disable hostname canonicalization when CanonicalizeHostname=yes and ProxyJump was expicitly set to "none". bz3567 Full release notes at https://www.openssh.com/txt/release-9.4 Relnotes: Yes Sponsored by: The FreeBSD Foundation
48 lines
1.2 KiB
Bash
48 lines
1.2 KiB
Bash
# $OpenBSD: sftp-chroot.sh,v 1.9 2023/05/12 06:37:42 djm Exp $
|
|
# Placed in the Public Domain.
|
|
|
|
tid="sftp in chroot"
|
|
|
|
CHROOT=/var/run
|
|
FILENAME=testdata_${USER}.$$
|
|
PRIVDATA=${CHROOT}/${FILENAME}
|
|
trap "${SUDO} rm -f ${PRIVDATA}" 0
|
|
|
|
if [ -z "$SUDO" -a ! -w /var/run ]; then
|
|
skip "need SUDO to create file in /var/run, test won't work without"
|
|
fi
|
|
|
|
if ! $OBJ/check-perm -m chroot "$CHROOT" ; then
|
|
skip "$CHROOT is unsuitable as ChrootDirectory"
|
|
fi
|
|
|
|
$SUDO sh -c "echo mekmitastdigoat > $PRIVDATA" || \
|
|
fatal "create $PRIVDATA failed"
|
|
|
|
echo "ForceCommand internal-sftp -d /" >> $OBJ/sshd_config
|
|
|
|
start_sshd -oChrootDirectory=$CHROOT
|
|
|
|
verbose "test $tid: get"
|
|
${SFTP} -S "$SSH" -F $OBJ/ssh_config host:/${FILENAME} $COPY \
|
|
>>$TEST_REGRESS_LOGFILE 2>&1 || \
|
|
fatal "Fetch ${FILENAME} failed"
|
|
cmp $PRIVDATA $COPY || fail "$PRIVDATA $COPY differ"
|
|
|
|
stop_sshd
|
|
|
|
verbose "test $tid: match"
|
|
cat << EOF >> $OBJ/sshd_config
|
|
Match All
|
|
ChrootDirectory $CHROOT
|
|
EOF
|
|
start_sshd
|
|
$SUDO sh -c "echo orpheanbeholder > $PRIVDATA" || \
|
|
fatal "create $PRIVDATA failed"
|
|
${SFTP} -S "$SSH" -F $OBJ/ssh_config host:/${FILENAME} $COPY \
|
|
>>$TEST_REGRESS_LOGFILE 2>&1 || \
|
|
fatal "Fetch ${FILENAME} failed"
|
|
cmp $PRIVDATA $COPY || fail "$PRIVDATA $COPY differ"
|
|
|
|
stop_sshd
|