PowerShell / PowerShell/Win32-OpenSSH

Allow all variations for allow/deny users,groups in sshd_config

Open
#869 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

0 - Backlog
Dominant language
No language data
Stars
8.3k
Forks
819
PR merge metrics
No merged PRs in 30d

Description

As of now sshd_config accepts allow/deny users, groups in this format
user?domain
group?domain

code snippet in servconf.c -
void
parse_server_config()
{

#ifdef WINDOWS
/* TODO - Refactor this into a platform specific post-read config processing routine.
* TODO - support all forms of username, groupname.
* a) domain\groupname
* b) domain\groupname@hostip
* c) full_domain_name\groupname
* d) full_domain_name\groupname@hostip
* e) user@domain
* f) domain\user
* g) fulldomain\user
* h) user@domain@hostip
/
/
convert the users, user groups to lower case */
for(int i = 0; i < options->num_allow_users; i++)
lowercase(options->allow_users[i]);

for (int i = 0; i < options->num_deny_users; i++)
	lowercase(options->deny_users[i]);

for (int i = 0; i < options->num_allow_groups; i++)
	lowercase(options->allow_groups[i]);

for (int i = 0; i < options->num_deny_groups; i++)
	lowercase(options->deny_groups[i]);

#endif // WINDOWS
}

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

The relevant entry point is parse_server_config() in servconf.c, within the Windows-specific configuration processing. Start by tracing how allow and deny users and groups are parsed and normalized, then compare that behavior with the listed username and group-name forms. Done means all documented domain, host, and separator variations are accepted consistently.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
authorization, operating-systems, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.