Add PermitRootLogin prohibit-password and forced-commands-only#1111
Add PermitRootLogin prohibit-password and forced-commands-only#1111stenslae wants to merge 1 commit into
Conversation
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #1111
Scan targets checked: wolfssh-bugs, wolfssh-src
Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)
This review was generated automatically by Fenrir. Findings are non-blocking.
9e1bbd9 to
71e1e28
Compare
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #1111
Scan targets checked: wolfssh-bugs, wolfssh-src
No new issues found in the changed files. ✅
…y modes Update test keys for authentication testing
71e1e28 to
9937fff
Compare
|
Rebased onto latest master, which added a72b944 (roots PermitRootLogin on uid 0). Extracted into a shared IsRootUser() and pointed my prohibit-password / forced-commands-only checks at it too. Also dropped my fake-crypt timing mitigation for invalid users, will make a dedicated PR for the timing oracle mitigations. |
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #1111
Scan targets checked: wolfssh-bugs, wolfssh-src
No new issues found in the changed files. ✅
3 participants
Expanded PermitRootLogin configuration to fully support OpenSSH settings prohibit-password (including legacy without-password) and forced-commands-only. Added a constant time mitigation for invalid usernames and added logic that gates password verification after policy enforcement. Also added an explicit null-termination check on user-provided passwords and changed DefaultUserAuthTypes to 0 instead of WS_BAD_ARGUMENT.
Added additional test coverage for this new feature.