diff options
| -rw-r--r-- | cli-auth.c | 10 | ||||
| -rw-r--r-- | options.h | 12 |
2 files changed, 13 insertions, 9 deletions
@@ -257,10 +257,13 @@ void cli_auth_try() { #endif #ifdef ENABLE_CLI_INTERACT_AUTH +#if defined(DROPBEAR_NONE_CIPHER) && !defined(ALLOW_NONE_PASSWORD_AUTH) if (ses.keys->trans.algo_crypt->cipherdesc == NULL) { fprintf(stderr, "Sorry, I won't let you use interactive auth unencrypted.\n"); } - else if (!finished && ses.authstate.authtypes & AUTH_TYPE_INTERACT) { + else +#endif + if (!finished && ses.authstate.authtypes & AUTH_TYPE_INTERACT) { if (cli_ses.auth_interact_failed) { finished = 0; } else { @@ -272,10 +275,13 @@ void cli_auth_try() { #endif #ifdef ENABLE_CLI_PASSWORD_AUTH +#if defined(DROPBEAR_NONE_CIPHER) && !defined(ALLOW_NONE_PASSWORD_AUTH) if (ses.keys->trans.algo_crypt->cipherdesc == NULL) { fprintf(stderr, "Sorry, I won't let you use password auth unencrypted.\n"); } - else if (!finished && ses.authstate.authtypes & AUTH_TYPE_PASSWORD) { + else +#endif + if (!finished && ses.authstate.authtypes & AUTH_TYPE_PASSWORD) { cli_auth_password(); finished = 1; cli_ses.lastauthtype = AUTH_TYPE_PASSWORD; @@ -103,15 +103,13 @@ much traffic. */ /* You can compile with no encryption if you want. In some circumstances * this could be safe security-wise, though make sure you know what * you're doing. Anyone can see everything that goes over the wire, so - * the only safe auth method is public key. You'll have to disable all other - * ciphers above in the client if you want to use this, or implement cipher - * prioritisation in cli-runopts. - * - * The best way to do things is probably make normal compile of dropbear with - * all ciphers including "none" as the server, then recompile a special - * "dbclient-insecure" client. */ + * the only safe auth method is public key. */ #define DROPBEAR_NONE_CIPHER +/* Define this to allow password authentication even when no encryption + * is being used. This can be unsafe */ +#define ALLOW_NONE_PASSWORD_AUTH + /* Message Integrity - at least one required. * Protocol RFC requires sha1 and recommends sha1-96. * sha1-96 is of use for slow links as it has a smaller overhead. |