Mercurial > dropbear
changeset 1818:587c76726b5f
Add "restrict" authorized_keys option
| author | Matt Johnston <matt@ucc.asn.au> |
|---|---|
| date | Sat, 01 May 2021 20:47:15 +0800 |
| parents | 209711833f15 |
| children | 5120e22882de |
| files | dropbear.8 svr-authpubkeyoptions.c |
| diffstat | 2 files changed, 16 insertions(+), 0 deletions(-) [+] |
line wrap: on
line diff
--- a/dropbear.8 Wed Mar 31 23:31:26 2021 +0800 +++ b/dropbear.8 Sat May 01 20:47:15 2021 +0800 @@ -135,6 +135,10 @@ same functionality with other means even if no-pty is set. .TP +.B restrict +Applies all the no- restrictions listed above. + +.TP .B command=\fR"\fIforced_command\fR" Disregard the command provided by the user and always run \fIforced_command\fR. The -c command line option overrides this.
--- a/svr-authpubkeyoptions.c Wed Mar 31 23:31:26 2021 +0800 +++ b/svr-authpubkeyoptions.c Sat May 01 20:47:15 2021 +0800 @@ -166,6 +166,18 @@ ses.authstate.pubkey_options->no_pty_flag = 1; goto next_option; } + if (match_option(options_buf, "restrict") == DROPBEAR_SUCCESS) { + dropbear_log(LOG_WARNING, "Restrict option set"); + ses.authstate.pubkey_options->no_port_forwarding_flag = 1; +#if DROPBEAR_SVR_AGENTFWD + ses.authstate.pubkey_options->no_agent_forwarding_flag = 1; +#endif +#if DROPBEAR_X11FWD + ses.authstate.pubkey_options->no_x11_forwarding_flag = 1; +#endif + ses.authstate.pubkey_options->no_pty_flag = 1; + goto next_option; + } if (match_option(options_buf, "command=\"") == DROPBEAR_SUCCESS) { int escaped = 0; const unsigned char* command_start = buf_getptr(options_buf, 0);