restrict certificate type for builtin SSH server #26789
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- While doing some sanity checks over OpenSSH's code for how they handle certificates authentication. I stumbled on an condition that checks the certificate type is really an user certificate on the server-side authentication. This checks seems to be a formality and just for the sake of good domain seperation, because an user and host certificate don't differ in their generation, verification or flags that can be included. - Add this check to the builtin SSH server to stay close to the unwritten SSH specification. - This is an breaking change for setups where the builtin SSH server is being used and for some reason host certificates were being used for authentication. (cherry picked from commit de35b141b79a3d6efe2127ed2c73fd481515e481) Refs: https://codeberg.org/forgejo/forgejo/pulls/1172
GiteaBot
added
the
lgtm/need 2
pull-request-size
bot
added
the
size/XS
lafriks
approved these changes
Aug 29, 2023
GiteaBot
added
lgtm/need 1
puni9869
reviewed
Aug 29, 2023
Comment on lines
+195
to
+196
| log.Warn("Certificate Rejected: Not a user certificate") | ||
| log.Warn("Failed authentication attempt from %s", ctx.RemoteAddr()) |
There was a problem hiding this comment.
Think it's fine. Go is not really made for multi-line strings.
puni9869
approved these changes
Aug 29, 2023
GiteaBot
added
lgtm/done
KN4CK3R
added
the
pr/breaking
silverwind
added
the
reviewed/wait-merge
|
Breaking label added, good to go imho. |
silverwind
approved these changes
Sep 1, 2023
|
In the unlikely event this is breaking someone's workflow, I guess a option could be introduced to skip this check, but as I see it this is not configurable in OpenSSH either, so we likely shouldn't bother either. |
silverwind
added
the
topic/security
GiteaBot
removed
the
reviewed/wait-merge
zjjhot
added a commit
to zjjhot/gitea
that referenced
this pull request
Sep 1, 2023
* giteaoffical/main: (22 commits) Use case-insensitive regex for all webpack assets (go-gitea#26867) restrict certificate type for builtin SSH server (go-gitea#26789) feat(API): add secret deletion functionality for repository (go-gitea#26808) Avoid double-unescaping of form value (go-gitea#26853) Move web/api context related testing function into a separate package (go-gitea#26859) Remove some unused CSS styles (go-gitea#26852) [skip ci] Updated translations via Crowdin Minor dashboard tweaks, fix flex-list margins (go-gitea#26829) Update team invitation email link (go-gitea#26550) Redirect from `{repo}/issues/new` to `{repo}/issues/new/choose` when blank issues are disabled (go-gitea#26813) Remove "TODO" tasks from CSS file (go-gitea#26835) User details page (go-gitea#26713) Render code blocks in repo description (go-gitea#26830) Remove joinPaths function (go-gitea#26833) Remove polluted `.ui.right` (go-gitea#26825) Sync tags when adopting repos (go-gitea#26816) rm comment about hugo (go-gitea#26832) Fix filename for .spectral.yaml (go-gitea#26828) [skip ci] Updated translations via Crowdin Check blocklist for emails when adding them to account (go-gitea#26812) ...
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
(cherry picked from commit de35b141b79a3d6efe2127ed2c73fd481515e481)
Refs: https://codeberg.org/forgejo/forgejo/pulls/1172
The built-in SSH server will now only accept SSH user certificates, not server certificates. This behaviour matches OpenSSH.