wolfsshd: match sshd's host key file checks - #1178
Open
ejohnstown wants to merge 1 commit into
Open
Conversation
wolfsshd ran the host key, host certificate and TrustedUserCAKeys through wolfSSHD_OpenSecureFile(), rejecting symlinks, foreign owners and group writable ancestors that sshd accepts, with no sshd_config knob to relax it. - Open the host certificate and TrustedUserCAKeys plainly, unchecked. - Add wolfSSHD_OpenHostKeyFile() applying sshd's host key rule. - Also refuse non-regular files, and open O_NONBLOCK, so a FIFO left in place of the key cannot stall startup. - Leave wolfSSHD_OpenSecureFile() gating authorized_keys and shadow. - Assert the new host key behaviour in the suite, and drop the root-owned trust anchor copies from start_sshd.sh. Issue: F-5901
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates wolfsshd to align its host key file handling more closely with OpenSSH sshd, relaxing previous “secure gate” restrictions for host trust-anchor paths while adding a dedicated host-key open routine that enforces sshd-style permissions checks and protects startup from FIFO stalls.
Changes:
- Introduce
wolfSSHD_OpenHostKeyFile()and route host private key loading through it, matchingsshd’s “only police perms when daemon owns the key” rule and rejecting non-regular files. - Stop secure-gating host certificates and
TrustedUserCAKeys(open plainly without ownership/symlink/ancestor checks), leavingwolfSSHD_OpenSecureFile()forauthorized_keysand shadow handling. - Update the test harness/scripts to assert the new host key behavior and remove root-owned trust-anchor copy logic.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| apps/wolfsshd/wolfsshd.c | Switch host key loading to the new HOSTKEY load class; open host cert/CA keys without secure gating. |
| apps/wolfsshd/auth.h | Document revised secure-open scope and declare wolfSSHD_OpenHostKeyFile(). |
| apps/wolfsshd/auth.c | Implement wolfSSHD_OpenHostKeyFile(); change TrustedUserCAKeys scan to run without StrictModes gating. |
| apps/wolfsshd/test/start_sshd.sh | Remove temp trust-anchor copy/rewrite logic; use the provided config directly. |
| apps/wolfsshd/test/sshd_ossh_cert_test.sh | Update commentary to reflect new host key permission behavior. |
| apps/wolfsshd/test/run_all_sshd_tests.sh | Replace the prior StrictModes trust-anchor negative test with host-key-mode checks and expanded host key permission assertions. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+1857
to
1862
| /* The signing CA must be listed in TrustedUserCAKeys, a file sshd | ||
| * applies no permission policy to. */ | ||
| if (ret == WSSHD_AUTH_SUCCESS) { | ||
| ret = SearchKeysFile(usrCaKeysFile, pubKeyCtx->caKey, | ||
| pubKeyCtx->caKeySz, geteuid(), 1 /* strictModes */); | ||
| pubKeyCtx->caKeySz, geteuid(), 0 /* strictModes */); | ||
| } |
Comment on lines
+388
to
+389
| /* NULL is a rejected key (logged) or a read failure, not a | ||
| * memory error. */ |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
wolfsshd ran the host key, host certificate and TrustedUserCAKeys through wolfSSHD_OpenSecureFile(), rejecting symlinks, foreign owners and group writable ancestors that sshd accepts, with no sshd_config knob to relax it.
Issue: F-5901