root/patches/openssh-2.9p2+SecurID.README

/*
 * Author: Theo Schlossnagle <jesus@omniti.com>
 * Copyright (c) 2000,2001 Theo Schlossnagle <jesus@omniti.com>
 *                    All rights reserved
 * Created: September 21, 2000
 * License: OpenSSH License.  See the license for OpenSSH for more details.
 *
 * June 28, 2001:
 * Updated to 2.9p2 -- jesus@omniti.com
 * no new features
 *
 * April 24, 2001:
 * Updated to 2.9p1 -- jesus@omniti.com
 * added autoconf clauses to fault if sdiclient.a and headers aren't there.
 *
 * April 21, 2001:
 * Updated to 2.5.2p2 -- jesus@omniti.com
 * Incorporated some bug fixes from Anders Olsen to fix next-token code.
 *
 * March 19, 2001:
 * Updated to 2.5.2p1 -- jesus@omniti.com
 *
 * December 20, 2000:
 * Updated to 2.3.0p1 -- jesus@omniti.com
 *
 * Jan 9th, 2001:
 * Added SecurIDUsersFile, SecurIDIgnoreShell, AllowNonSecurID directives
 * to the sshd_config file.  These parameters are documented in the man page.
 * This provides a more logical seperationg between fail-through due to system
 * failure and fall-through by configuration. (fall-through vs. fail-through)
 *   -- jesus@omniti.com
 */

Seems like a few people are interested.  So here is the patch.

This has only been tested on UNICIES that support PAM.  There is untested
(only 5 lines) code in auth-passwd.c that should provide the same
functionality for normal (non-PAM) password verifications.

The patch is logical quite small, the physical patch bulky because it contains
all the line number changes in "configure" after running autoconf on the
modified configure.in file (in which I changed maybe 10 lines -- Yuk.)

The sshd man page has been patched too :-)  Read it for the two new options
relating to SecurID.

How it works:

0) apply patch ;-)
1) copy sdi headers (in SecurID example directory) into either a standard
include place (like /usr/local/include) or into the openssh source tree
or add the --with-cflags=-I/path/to/ace/examples (where the include files are)
2) copy the sdiclient.a file (same dir) into the openssh source tree.

Make sure that /var/ace contains your sdconf.rec, etc.  If you installed
SecurID client or server on a machine it should be this way already.  If you
used a non-standard install location do a "ln -s /path/to/ace/data /var/ace"

3) add --with-securid --with-pam to the configure flags.  This module rides on
the PAM authentication mechanism.

It will trigger if a user has a shell in /etc/passwd that ends with "sdshell"
and it snags your shell the same way sdshell does.  Users with other shells
will log in as if SecurID didn't exist.

Done:
  o Normal passcode verification
  o Enter next token for verification
    (use ssh -v to see the *useful* debgging messages)

ssh -v will let you know if:
 o your code was accepted.
 o your code was rejected.
 o you are required to wait for the next token and enter that.

TODO:
  o Handle PIN creation and changing (as their are by default three log in
attempts, it should be straight forward to integrate in these additions --
both of these operations require exactly three user inputs.)
  o Add sshd_config parameter to specify the VAR_ACE location (forced to
/var/ace OR VAR_ACE environment variable now.)
  o Make autoconf find the headers in logical places and add a long-option to
give it a hint.  I am an "autoconf idiot"... The small changes I made were
challenging enough :) 


DISCLAIMER:
  I works for me (yes, in production).  If you get locked out of a production
system becuase you replaced your sshd with this one, feeling really dumb is
YOUR responsibility NOT mine.  It is not my fault :-D

Hope this is useful! scp (and all other tools that can use ssh like rsync and
cvs) will work now!!!! Hooray!