Browse Source

n/ssh-vulnkey: Added.

slackware-14.2
Damien Goutte-Gattat 13 years ago
parent
commit
6d7b8760b9
  1. 3
      n/ssh-vulnkey/sha1sums
  2. 12
      n/ssh-vulnkey/slack-desc
  3. 180
      n/ssh-vulnkey/ssh-vulnkey.1
  4. 136
      n/ssh-vulnkey/ssh-vulnkey.SlackBuild
  5. 438
      n/ssh-vulnkey/ssh-vulnkey.c

3
n/ssh-vulnkey/sha1sums

@ -0,0 +1,3 @@
0c6919b5a097dd627637514122e4ac9d134bddea debian_ssh_dsa_1024_x86.tar.bz2
a858cb3baa70f6e276454bab41a6b7055a235ee8 debian_ssh_rsa_2048_x86.tar.bz2
dd92da04f1e0a5306a3ff86a2e3a123775254630 openssh-5.1p1.tar.bz2

12
n/ssh-vulnkey/slack-desc

@ -0,0 +1,12 @@
|-----handy-ruler------------------------------------------------------|
ssh-vulnkey: ssh-vulnkey (detect Debian-generated weak SSH keys)
ssh-vulnkey:
ssh-vulnkey: This package installs a list of compromised SSH keys that should
ssh-vulnkey: not be used, and a small tool to test a given key against that
ssh-vulnkey: list.
ssh-vulnkey:
ssh-vulnkey:
ssh-vulnkey:
ssh-vulnkey:
ssh-vulnkey:
ssh-vulnkey:

180
n/ssh-vulnkey/ssh-vulnkey.1

@ -0,0 +1,180 @@
.\" Copyright (c) 2008 Canonical Ltd. All rights reserved.
.\"
.\" Redistribution and use in source and binary forms, with or without
.\" modification, are permitted provided that the following conditions
.\" are met:
.\" 1. Redistributions of source code must retain the above copyright
.\" notice, this list of conditions and the following disclaimer.
.\" 2. Redistributions in binary form must reproduce the above copyright
.\" notice, this list of conditions and the following disclaimer in the
.\" documentation and/or other materials provided with the distribution.
.\"
.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
.Dd $Mdocdate: May 12 2008 $
.Dt SSH-VULNKEY 1
.Os
.Sh NAME
.Nm ssh-vulnkey
.Nd check blacklist of compromised keys
.Sh SYNOPSIS
.Nm
.Op Fl q
.Ar file ...
.Nm
.Fl a
.Sh DESCRIPTION
.Nm
checks a key against a blacklist of compromised keys.
.Pp
A substantial number of keys are known to have been generated using a broken
version of OpenSSL distributed by Debian which failed to seed its random
number generator correctly.
Keys generated using these OpenSSL versions should be assumed to be
compromised.
This tool may be useful in checking for such keys.
.Pp
Keys that are compromised cannot be repaired; replacements must be generated
using
.Xr ssh-keygen 1 .
Make sure to update
.Pa authorized_keys
files on all systems where compromised keys were permitted to authenticate.
.Pp
The argument list will be interpreted as a list of paths to public key files
or
.Pa authorized_keys
files.
If no suitable file is found at a given path,
.Nm
will append
.Pa .pub
and retry, in case it was given a private key file.
If no files are given as arguments,
.Nm
will check
.Pa ~/.ssh/id_rsa ,
.Pa ~/.ssh/id_dsa ,
.Pa ~/.ssh/identity ,
.Pa ~/.ssh/authorized_keys
and
.Pa ~/.ssh/authorized_keys2 ,
as well as the system's host keys if readable.
.Pp
If
.Dq -
is given as an argument,
.Nm
will read from standard input.
This can be used to process output from
.Xr ssh-keyscan 1 ,
for example:
.Pp
.Dl $ ssh-keyscan -t rsa remote.example.org | ssh-vulnkey -
.Pp
.Nm
will exit zero if any of the given keys were in the compromised list,
otherwise non-zero.
.Pp
The options are as follows:
.Bl -tag -width Ds
.It Fl a
Check keys of all users on the system.
You will typically need to run
.Nm
as root to use this option.
For each user,
.Nm
will check
.Pa ~/.ssh/id_rsa ,
.Pa ~/.ssh/id_dsa ,
.Pa ~/.ssh/identity ,
.Pa ~/.ssh/authorized_keys
and
.Pa ~/.ssh/authorized_keys2 .
It will also check the system's host keys.
.It Fl q
Quiet mode.
Normally,
.Nm
outputs the fingerprint of each key scanned, with a description of its
status.
This option suppresses that output.
.El
.Sh BLACKLIST FILE FORMAT
The blacklist file may start with comments, on lines starting with
.Dq # .
After these initial comments, it must follow a strict format:
.Pp
.Bl -bullet -offset indent -compact
.It
All the lines must be exactly the same length (32 characters followed by a
newline) and must be in sorted order.
.It
Each line must consist of the lower-case hexadecimal MD5 key fingerprint,
without colons.
.El
.Pp
The key fingerprint may be generated using
.Xr ssh-keygen 1 :
.Pp
.Dl $ ssh-keygen -l -f /path/to/key
.Pp
This strict format is necessary to allow the blacklist file to be checked
quickly, using a binary-search algorithm.
.Sh FILES
.Bl -tag -width Ds
.It Pa ~/.ssh/id_rsa
If present, contains the protocol version 2 RSA authentication identity of
the user.
.It Pa ~/.ssh/id_dsa
If present, contains the protocol version 2 DSA authentication identity of
the user.
.It Pa ~/.ssh/identity
If present, contains the protocol version 1 RSA authentication identity of
the user.
.It Pa ~/.ssh/authorized_keys
If present, lists the public keys (RSA/DSA) that can be used for logging in
as this user.
.It Pa ~/.ssh/authorized_keys2
Obsolete name for
.Pa ~/.ssh/authorized_keys .
This file may still be present on some old systems, but should not be
created if it is missing.
.It Pa /etc/ssh/ssh_host_rsa_key
If present, contains the protocol version 2 RSA identity of the system.
.It Pa /etc/ssh/ssh_host_dsa_key
If present, contains the protocol version 2 DSA identity of the system.
.It Pa /etc/ssh/ssh_host_key
If present, contains the protocol version 1 RSA identity of the system.
.It Pa /etc/ssh/blacklist. Ns Ar TYPE Ns Pa - Ns Ar LENGTH
If present, lists the blacklisted keys of type
.Ar TYPE
.Pf ( Dq RSA1 ,
.Dq RSA ,
or
.Dq DSA )
and bit length
.Ar LENGTH .
The format of this file is described above.
.El
.Sh SEE ALSO
.Xr ssh-keygen 1 ,
.Xr sshd 8
.Sh AUTHORS
.An -nosplit
.An Colin Watson Aq cjwatson@ubuntu.com
.Pp
Florian Weimer suggested the option to check keys of all users, and the idea
of processing
.Xr ssh-keyscan 1
output.

136
n/ssh-vulnkey/ssh-vulnkey.SlackBuild

@ -0,0 +1,136 @@
#!/bin/bash
# Build script for Slackware
# Copyright (C) 2008 Damien Goutte-Gattat
#
# Redistribution and use of this script, with or without modifications,
# is permitted provided that the following conditions are met:
#
# 1. Redistributions of this script must retain the above copyright
# notice, this list of conditions and the following disclaimer.
#
# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AS IS'' AND ANY EXPRESS OR
# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
# DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
# INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
# STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
# IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
#
# Contact: Damien Goutte-Gattat <damien.goutte-gattat@e.ujf-grenoble.fr>
# Built package infos
NAMETGZ=${NAMETGZ:-ssh-vulnkey}
VERSION=${VERSION:-20080518}
BUILD=${BUILD:-1GGD}
ARCH=${ARCH:-i486}
TARGET=${TARGET:-i486}
# Directories
TMP=${TMP:-/tmp}
OUT=${OUT:-$TMP/build}
PKG=${PKG:-$OUT/$NAMETGZ}
CWD=$(pwd)
set -e # Quit if a command returns non-zero
# Sanity check
if [ $UID -eq 0 ]; then
echo "You should NOT run this script as ROOT!"
exit 1
fi
if [ ! -d $TMP ]; then
echo "$TMP does not exist or is not a directory!"
exit 1
fi
# Compilation flags
case "$ARCH" in
i?86)
CPUOPT="-O2 -march=$ARCH -mtune=i686"
;;
*)
CPUOPT="-O2"
;;
esac
# Get the compromised keys
if [ ! -f debian_ssh_dsa_1024_x86.tar.bz2 ]; then
wget http://sugar.metasploit.com/debian_ssh_dsa_1024_x86.tar.bz2
fi
if [ ! -f debian_ssh_rsa_2048_x86.tar.bz2 ]; then
wget http://sugar.metasploit.com/debian_ssh_rsa_2048_x86.tar.bz2
fi
# Get the OpenSSH source package
if [ ! -f openssh-5.1p1.tar.bz2 ]; then
wget ftp://ftp.lip6.fr/pub/linux/distributions/slackware/slackware-12.2/source/n/openssh/openssh-5.1p1.tar.bz2
fi
# Check the files
sha1sum -c sha1sums
# Prepare tmp directory
cd $TMP
mkdir ssh-vulnkey
cd ssh-vulnkey
# Build blacklists
tar xf $CWD/debian_ssh_dsa_1024_x86.tar.bz2
tar xf $CWD/debian_ssh_rsa_2048_x86.tar.bz2
find dsa/1024 -name '*.pub' -printf "%f\n" | cut -d'-' -f1 | sort > \
blacklist.DSA-1024
find rsa/2048 -name '*.pub' -printf "%f\n" | cut -d'-' -f1 | sort > \
blacklist.RSA-2048
# Compile OpenSSH (that's needed in order to compile ssh-vulnkey)
tar xf $CWD/openssh-5.1p1.tar.bz2
cd openssh-5.1p1
CFLAGS=$CPUOPT \
CXXFLAGS=$CPUOPT \
./configure \
--prefix=/usr \
--mandir=/usr/man \
--sysconfdir=/etc \
--without-pam \
--with-md5-passwords \
--with-tcp-wrappers \
--with-default-path=/usr/local/sbin:/usr/sbin:/sbin:/usr/local/bin:/usr/bin:/bin \
--with-ipv4-default \
--with-privsep-path=/var/empty \
--with-privsep-user=sshd \
--build=$ARCH-slackware-linux
make -j 3
# Build ssh-vulnkey
cp $CWD/ssh-vulnkey.c ssh-vulnkey.c
gcc -c -I. ssh-vulnkey.c
gcc -o ssh-vulnkey ssh-vulnkey.o -L. -Lopenbsd-compat/ -lssh \
-lopenbsd-compat -lresolv -lcrypto -lutil -lz -lnsl -lcrypt
# Install
mkdir -p $PKG/etc/ssh $PKG/usr/bin $PKG/usr/man/man1 $PKG/install
install -m 0755 -s ssh-vulnkey $PKG/usr/bin
install -m 0644 $TMP/ssh-vulnkey/blacklist.DSA-1024 $PKG/etc/ssh
install -m 0644 $TMP/ssh-vulnkey/blacklist.RSA-2048 $PKG/etc/ssh
install -m 0644 $CWD/ssh-vulnkey.1 $PKG/usr/man/man1
gzip -9 $PKG/usr/man/man1/ssh-vulnkey.1
install -m 0644 $CWD/slack-desc $PKG/install
# Package the tree
cd $PKG
mkdir -p $OUT
PACKAGING="
chown root:root . -R
/sbin/makepkg -l y -c n $OUT/$NAMETGZ-$VERSION-$ARCH-$BUILD.tgz
rm -rf $PKG
rm -rf $TMP/ssh-vulnkey
"
if type -p fakeroot ; then
echo "$PACKAGING" | fakeroot
else
su -c "$PACKAGING"
fi

438
n/ssh-vulnkey/ssh-vulnkey.c

@ -0,0 +1,438 @@
/*
* Copyright (c) 2008 Canonical Ltd. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#include "includes.h"
#include <sys/types.h>
#include <sys/stat.h>
#include <string.h>
#include <stdio.h>
#include <fcntl.h>
#include <unistd.h>
#include <pwd.h>
#include <openssl/evp.h>
#include "xmalloc.h"
#include "ssh.h"
#include "log.h"
#include "key.h"
#include "authfile.h"
#include "pathnames.h"
#include "misc.h"
#define _PATH_BLACKLIST SSHDIR "/blacklist"
extern char *__progname;
char *
blacklist_filename(const Key *key)
{
char *name;
xasprintf(&name, "%s.%s-%u",
_PATH_BLACKLIST, key_type(key), key_size(key));
return name;
}
/* Scan a blacklist of known-vulnerable keys. */
int
blacklisted_key(const Key *key)
{
char *blacklist_file;
int fd = -1;
char *dgst_hex = NULL;
char *dgst_packed = NULL, *p;
int i;
size_t line_len;
struct stat st;
char buf[256];
off_t start, lower, upper;
int ret = 0;
blacklist_file = blacklist_filename(key);
debug("Checking blacklist file %s", blacklist_file);
fd = open(blacklist_file, O_RDONLY);
if (fd < 0)
goto out;
dgst_hex = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
/* Remove all colons */
dgst_packed = xcalloc(1, strlen(dgst_hex) + 1);
for (i = 0, p = dgst_packed; dgst_hex[i]; i++)
if (dgst_hex[i] != ':')
*p++ = dgst_hex[i];
/* Only compare least-significant 80 bits (to keep the blacklist
* size down)
*/
line_len = strlen(dgst_packed);
if (line_len > 32)
goto out;
/* Skip leading comments */
start = 0;
for (;;) {
ssize_t r;
char *newline;
r = atomicio(read, fd, buf, 256);
if (r <= 0)
goto out;
if (buf[0] != '#')
break;
newline = memchr(buf, '\n', 256);
if (!newline)
goto out;
start += newline + 1 - buf;
if (lseek(fd, start, SEEK_SET) < 0)
goto out;
}
/* Initialise binary search record numbers */
if (fstat(fd, &st) < 0)
goto out;
lower = 0;
upper = (st.st_size - start) / (line_len + 1);
while (lower != upper) {
off_t cur;
char buf[32];
int cmp;
cur = lower + (upper - lower) / 2;
/* Read this line and compare to digest; this is
* overflow-safe since cur < max(off_t) / (line_len + 1) */
if (lseek(fd, start + cur * (line_len + 1), SEEK_SET) < 0)
break;
if (atomicio(read, fd, buf, line_len) != line_len)
break;
cmp = memcmp(buf, dgst_packed, line_len);
if (cmp < 0) {
if (cur == lower)
break;
lower = cur;
} else if (cmp > 0) {
if (cur == upper)
break;
upper = cur;
} else {
debug("Found %s in blacklist", dgst_hex);
ret = 1;
break;
}
}
out:
if (dgst_packed)
xfree(dgst_packed);
if (dgst_hex)
xfree(dgst_hex);
if (fd >= 0)
close(fd);
xfree(blacklist_file);
return ret;
}
/* Default files to check */
static char *default_host_files[] = {
_PATH_HOST_RSA_KEY_FILE,
_PATH_HOST_DSA_KEY_FILE,
_PATH_HOST_KEY_FILE,
NULL
};
static char *default_files[] = {
_PATH_SSH_CLIENT_ID_RSA,
_PATH_SSH_CLIENT_ID_DSA,
_PATH_SSH_CLIENT_IDENTITY,
_PATH_SSH_USER_PERMITTED_KEYS,
_PATH_SSH_USER_PERMITTED_KEYS2,
NULL
};
static int quiet = 0;
static void
usage(void)
{
fprintf(stderr, "usage: %s [-aq] [file ...]\n", __progname);
fprintf(stderr, "Options:\n");
fprintf(stderr, " -a Check keys of all users.\n");
fprintf(stderr, " -q Quiet mode.\n");
exit(1);
}
void
describe_key(const char *msg, const Key *key, const char *comment)
{
char *fp;
fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
if (!quiet)
printf("%s: %u %s %s\n", msg, key_size(key), fp, comment);
xfree(fp);
}
int
do_key(const Key *key, const char *comment)
{
char *blacklist_file;
struct stat st;
int ret = 1;
blacklist_file = blacklist_filename(key);
if (stat(blacklist_file, &st) < 0)
describe_key("Unknown (no blacklist information)",
key, comment);
else if (blacklisted_key(key)) {
describe_key("COMPROMISED", key, comment);
ret = 0;
} else
describe_key("Not blacklisted", key, comment);
xfree(blacklist_file);
return ret;
}
int
do_filename(const char *filename, int quiet_open)
{
FILE *f;
char line[SSH_MAX_PUBKEY_BYTES];
char *cp;
u_long linenum = 0;
Key *key;
char *comment = NULL;
int found = 0, ret = 1;
/* Copy much of key_load_public's logic here so that we can read
* several keys from a single file (e.g. authorized_keys).
*/
if (strcmp(filename, "-") != 0) {
f = fopen(filename, "r");
if (!f) {
char pubfile[MAXPATHLEN];
if (strlcpy(pubfile, filename, sizeof pubfile) <
sizeof(pubfile) &&
strlcat(pubfile, ".pub", sizeof pubfile) <
sizeof(pubfile))
f = fopen(pubfile, "r");
}
if (!f) {
if (!quiet_open)
perror(filename);
return -1;
}
} else
f = stdin;
while (read_keyfile_line(f, filename, line, sizeof(line),
&linenum) != -1) {
int i;
char *space;
int type;
/* Chop trailing newline. */
i = strlen(line) - 1;
if (line[i] == '\n')
line[i] = '\0';
/* Skip leading whitespace, empty and comment lines. */
for (cp = line; *cp == ' ' || *cp == '\t'; cp++)
;
if (!*cp || *cp == '\n' || *cp == '#')
continue;
/* Cope with ssh-keyscan output and options in
* authorized_keys files.
*/
space = strchr(cp, ' ');
if (!space)
continue;
*space = '\0';
type = key_type_from_name(cp);
*space = ' ';
/* Leading number (RSA1) or valid type (RSA/DSA) indicates
* that we have no host name or options to skip.
*/
if (atoi(cp) == 0 && type == KEY_UNSPEC) {
int quoted = 0;
for (; *cp && (quoted || (*cp != ' ' && *cp != '\t')); cp++) {
if (*cp == '\\' && cp[1] == '"')
cp++; /* Skip both */
else if (*cp == '"')
quoted = !quoted;
}
/* Skip remaining whitespace. */
for (; *cp == ' ' || *cp == '\t'; cp++)
;
if (!*cp)
continue;
}
/* Read and process the key itself. */
key = key_new(KEY_RSA1);
if (key_read(key, &cp) == 1) {
while (*cp == ' ' || *cp == '\t')
cp++;
if (!do_key(key, *cp ? cp : filename))
ret = 0;
found = 1;
} else {
key_free(key);
key = key_new(KEY_UNSPEC);
if (key_read(key, &cp) == 1) {
while (*cp == ' ' || *cp == '\t')
cp++;
if (!do_key(key, *cp ? cp : filename))
ret = 0;
found = 1;
}
}
key_free(key);
}
if (f != stdin)
fclose(f);
if (!found && filename) {
key = key_load_public(filename, &comment);
if (key) {
if (!do_key(key, comment))
ret = 0;
found = 1;
}
if (comment)
xfree(comment);
}
return ret;
}
int
do_host(void)
{
int i;
struct stat st;
int ret = 1;
for (i = 0; default_host_files[i]; i++) {
if (stat(default_host_files[i], &st) < 0)
continue;
if (!do_filename(default_host_files[i], 1))
ret = 0;
}
return ret;
}
int
do_user(const char *dir)
{
int i;
char buf[MAXPATHLEN];
struct stat st;
int ret = 1;
for (i = 0; default_files[i]; i++) {
snprintf(buf, sizeof(buf), "%s/%s", dir, default_files[i]);
if (stat(buf, &st) < 0)
continue;
if (!do_filename(buf, 0))
ret = 0;
}
return ret;
}
int
main(int argc, char **argv)
{
int opt, all_users = 0;
int ret = 1;
extern int optind;
/* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
sanitise_stdfd();
__progname = ssh_get_progname(argv[0]);
SSLeay_add_all_algorithms();
log_init(argv[0], SYSLOG_LEVEL_INFO, SYSLOG_FACILITY_USER, 1);
/* We don't need the RNG ourselves, but symbol references here allow
* ld to link us properly.
*/
init_rng();
seed_rng();
while ((opt = getopt(argc, argv, "ahq")) != -1) {
switch (opt) {
case 'a':
all_users = 1;
break;
case 'q':
quiet = 1;
break;
case 'h':
default:
usage();
}
}
if (all_users) {
struct passwd *pw;
if (!do_host())
ret = 0;
while ((pw = getpwent()) != NULL) {
if (pw->pw_dir) {
if (!do_user(pw->pw_dir))
ret = 0;
}
}
} else if (optind == argc) {
struct passwd *pw;
if (!do_host())
ret = 0;
if ((pw = getpwuid(getuid())) == NULL)
fprintf(stderr, "No user found with uid %u\n",
(u_int)getuid());
else {
if (!do_user(pw->pw_dir))
ret = 0;
}
} else {
while (optind < argc)
if (!do_filename(argv[optind++], 0))
ret = 0;
}
return ret;
}
Loading…
Cancel
Save