dilim/openssh-portable
1
0 Fork 0
mirror of https://github.com/openssh/openssh-portable.git synced 2026-11-06 05:16:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

upstream: avoid spurious disconnect if connecting as root with

Browse Source 
`PermitRootLogin forced-commands-only` enabled and a authorized_keys entry
_without_ a `command=` option before a key _with_ this option.

Anthropic ANT-2026-29SEM083

OpenBSD-Commit-ID: ea9c2afc636e120f68a0b70087afb1d5ecc1f9e0
This commit is contained in:
djm@openbsd.org authored and Damien Miller committed 2026-10-30 20:10:11 +11:00
1 parent 37bb397d9a
commit 9ca942330f
1 file changed
+9 -3
Download Patch File Download Diff File Expand all files Collapse all files
auth-options.c
+9 -3
View File
@@ -1,4 +1,4 @@
/* $OpenBSD: auth-options.c,v 1.103 2026/09/16 00:33:44 djm Exp $ */
/* $OpenBSD: auth-options.c,v 1.104 2026/10/30 00:58:02 djm Exp $ */
/*
* Copyright (c) 2018 Damien Miller <djm@mindrot.org>
*
@@ -821,11 +821,17 @@ sshauthopt_serialise(const struct sshauthopt *opts, struct sshbuf *m,
0 : (u_int)opts->force_tun_device)) != 0)
return r;
/* String options; these may be NULL */
/*
* String options; these may be NULL. In untrusted mode the
* contents of the forced command are hidden, but its presence
* must be preserved as PermitRootLogin=forced-commands-only
* depends on it.
*/
if ((r = serialise_nullable_string(m,
untrusted ? "yes" : opts->cert_principals)) != 0 ||
(r = serialise_nullable_string(m,
untrusted ? "true" : opts->force_command)) != 0 ||
(untrusted && opts->force_command != NULL) ?
"true" : opts->force_command)) != 0 ||
(r = serialise_nullable_string(m,
untrusted ? NULL : opts->required_from_host_cert)) != 0 ||
(r = serialise_nullable_string(m,