From 03ab4ca03017e86b7f083049f5a988b6d286d23e Mon Sep 17 00:00:00 2001 From: djm Date: Fri, 21 Sep 2018 12:23:17 +0000 Subject: [PATCH] when compiled with GSSAPI support, cache supported method OIDs by calling ssh_gssapi_prepare_supported_oids() regardless of whether GSSAPI authentication is enabled in the main config. This avoids sandbox violations for configurations that enable GSSAPI auth later, e.g. Match user djm GSSAPIAuthentication yes bz#2107; ok dtucker@ --- usr.bin/ssh/sshd.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/usr.bin/ssh/sshd.c b/usr.bin/ssh/sshd.c index f179027b3af..2795a2ea300 100644 --- a/usr.bin/ssh/sshd.c +++ b/usr.bin/ssh/sshd.c @@ -1,4 +1,4 @@ -/* $OpenBSD: sshd.c,v 1.515 2018/09/13 02:08:33 djm Exp $ */ +/* $OpenBSD: sshd.c,v 1.516 2018/09/21 12:23:17 djm Exp $ */ /* * Author: Tatu Ylonen * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland @@ -492,8 +492,7 @@ privsep_preauth_child(void) #ifdef GSSAPI /* Cache supported mechanism OIDs for later use */ - if (options.gss_authentication) - ssh_gssapi_prepare_supported_oids(); + ssh_gssapi_prepare_supported_oids(); #endif /* Demote the private keys to public keys. */ -- 2.20.1