OpenSolaris

Printable Version Enter a New Search
Bug ID 6655613
Synopsis resync server's conditional Match block from OpenSSH
State 8-Fix Available (Fix has been made (either putback, or just prior))
Category:Subcategory ssh:server
Keywords
Responsible Engineer Huie-ying Lee
Reported Against snv_82
Duplicate Of
Introduced In
Commit to Fix snv_129
Fixed In snv_129
Release Fixed
Related Bugs 6357777 , 6357779 , 6655614 , 6871707 , 6881438 , 6885011
Submit Date 26-January-2008
Last Update Date 12-November-2009
Description
as per synopsis. Match section from OpenSSH's sshd_config(8) follows:

     Match   Introduces a conditional block.  If all of the criteria on the
             Match line are satisfied, the keywords on the following lines
             override those set in the global section of the config file, un-
             til either another Match line or the end of the file.  The argu-
             ments to Match are one or more criteria-pattern pairs.  The
             available criteria are User, Group, Host, and Address.  Only a
             subset of keywords may be used on the lines following a Match
             keyword.  Available keywords are AllowTcpForwarding, Banner,
             ForceCommand, GatewayPorts, GSSApiAuthentication,
             KbdInteractiveAuthentication, KerberosAuthentication,
             PasswordAuthentication, PermitOpen, RhostsRSAAuthentication,
             RSAAuthentication, X11DisplayOffset, X11Forwarding, and
             X11UseLocalHost.
I need this for my own system configuration, but I need to make AllowUsers
conditional on destination address.

I have a bastion host.  When a connection arrives over my internal network,
I want to allow all internal users to access it.  When a connection arrives
over the global Internet, I want to allow only a few users to get access.

I currently do this by running two copies of sshd.  One is bound to "::",
and has AllowUsers set to the restricted subset.  The other is bound to
my internal RFC 1918 address, and doesn't have AllowUsers set.  It's a bit
of a kludge, but it works.  Having Match would be *much* more elegant.
Work Around
N/A
Comments
N/A