Ticket History #841: telnetd should have a way to require encrypted sessions

From djm@web.us.uu.net Fri Apr 14 12:37:05 2000
Received: from MIT.EDU (SOUTH-STATION-ANNEX.MIT.EDU [18.72.1.2])
by rt-11.mit.edu (8.9.3/8.9.3) with SMTP id MAA03242
for <bugs@RT-11.MIT.EDU>; Fri, 14 Apr 2000 12:37:04 -0400 (EDT)
Received: from jenkins.web.us.uu.net by MIT.EDU with SMTP
id AA06276; Fri, 14 Apr 00 12:37:00 EDT
Received: from dagger.web.us.uu.net by jenkins.web.us.uu.net with ESMTP
(peer crosschecked as: dagger.web.us.uu.net [208.211.134.28])
id MAA11601; Fri, 14 Apr 2000 12:37:03 -0400 (EDT)
Received: by dagger.web.us.uu.net
id MAA28618; Fri, 14 Apr 2000 12:36:40 -0400
Message-Id: <MAA28618.200004141636@dagger.web.us.uu.net>
Date: Fri, 14 Apr 2000 12:36:40 -0400
From: djm@web.us.uu.net (David J. MacKenzie)
Reply-To: djm@web.us.uu.net
To: krb5-bugs@MIT.EDU
Cc: djm@web.us.uu.net
Subject: telnetd patch to require encryption
X-Send-Pr-Version: 3.99

UUNET Technologies

System: Linux dagger.web.us.uu.net 2.2.14-15mdk #2 Sat Mar 11 19:32:26 EST 2000 i686 unknown
Architecture: i686

On our administrative hosts (KDC's, for example), we only
want to allow encrypted (in both directions) logins.

telnet -a kerberos


This patch is from cross@eng.us.uu.net (Chris Ross).

--- /homes/elves/djm/src/krb5-1.1.1/src/appl/telnet/telnetd/state.c Fri Dec 17 15:44:25 1999
+++ src/appl/telnet/telnetd/state.c Tue Mar 28 03:09:54 2000
@@ -124,6 +124,21 @@
state = TS_IAC;
break;
}
+#ifdef ENCRYPTION
+ /*
+ * Check to make sure we have a connection
+ * encrypted in both directions if we've been
+ * told to require as much...
+ */
+ {
+ extern int encrypt_required;
+ if (encrypt_required &&
+ (!encrypt_output || !decrypt_input)) {
+ fatal(net, "Encryption required");
+ exit(1);
+ }
+ }
+#endif /* ENCRYPTION */
/*
* We now map \r\n ==> \r for pragmatic reasons.
* Many client implementations send \r\n when
--- /homes/elves/djm/src/krb5-1.1.1/src/appl/telnet/telnetd/telnetd.c Fri Dec 17 15:44:26 1999
+++ src/appl/telnet/telnetd/telnetd.c Tue Mar 28 03:15:14 2000
@@ -144,6 +144,12 @@
int always_ip = 0;
int stripdomain = 1;

+#ifdef ENCRYPTION
+/* Require encryption? If this is on, any unencrypted connection */
+/* will be refused... */
+int encrypt_required = 0;
+#endif
+
extern void usage P((void));

/*
@@ -310,6 +316,9 @@
extern int encrypt_debug_mode;
encrypt_debug_mode = 1;
break;
+ } else if (strcmp(optarg, "require") == 0) {
+ encrypt_required = 1;
+ break;
}
usage();
/* NOTREACHED */
@@ -1493,6 +1502,13 @@
#endif /* defined(CRAY2) && defined(UNICOS5) */
}
}
+
+#ifdef ENCRYPTION
+ if (encrypt_required && (!encrypt_output || !decrypt_input)) {
+ fatal(net, "Encryption required");
+ exit(1);
+ }
+#endif /* ENCRYPTION */

while (pcc > 0) {
if ((&netobuf[BUFSIZ] - nfrontp) < 2)