F-6700: Add PermitRootLogin prohibit-password and forced-commands-only modes

Emma Stensland · Emma Stensland · commit 9e1bbd97fbfc · 2026-07-21T09:49:08.000-06:00
Update test keys for authentication testing
diff --git a/apps/wolfsshd/auth.c b/apps/wolfsshd/auth.c
@@ -360,20 +360,20 @@ static int ExtractSalt(char* hash, char** salt, int saltSz)
 
 #if defined(WOLFSSH_HAVE_LIBCRYPT) || defined(WOLFSSH_HAVE_LIBLOGIN)
 #ifdef WOLFSSHD_UNIT_TEST
-int CheckPasswordHashUnix(const char* input, char* stored)
+int CheckPasswordHashUnix(const char* input, const char* stored)
 #else
-static int CheckPasswordHashUnix(const char* input, char* stored)
+static int CheckPasswordHashUnix(const char* input, const char* stored)
 #endif
 {
     int ret = WSSHD_AUTH_SUCCESS;
-    char* hashedInput;
+    char* hashedInput = NULL;
     word32 hashedInputSz = 0, storedSz = 0;
 
     if (input == NULL || stored == NULL) {
         ret = WS_BAD_ARGUMENT;
     }
 
-    /* empty password case */
+    /* empty password case: fast return based on real stored hash. */
     if (ret == WSSHD_AUTH_SUCCESS && stored[0] == 0 && WSTRLEN(input) == 0) {
         wolfSSH_Log(WS_LOG_INFO,
                     "[SSHD] User logged in with empty password");
@@ -1626,6 +1626,32 @@ static int RequestAuthentication(WS_UserAuthData* authData,
 
     usr = (const char*)authData->username;
     ret = DoCheckUser(usr, authCtx);
+
+    /* Avoid timing leak for invalid users with a fake crypt() call using a
+     * real $6$ (SHA-512) salt so it costs the same as a real lookup. */
+    if (ret == WOLFSSH_USERAUTH_INVALID_USER &&
+        authData->type == WOLFSSH_USERAUTH_PASSWORD) {
+#if defined(WOLFSSH_HAVE_LIBCRYPT) || defined(WOLFSSH_HAVE_LIBLOGIN)
+        word32 fakePwSz = authData->sf.password.passwordSz;
+        char* fakePwStr = (char*)WMALLOC(fakePwSz + 1, NULL, DYNTYPE_STRING);
+
+        if (fakePwStr != NULL) {
+            if (fakePwSz > 0) {
+                XMEMCPY(fakePwStr, authData->sf.password.password, fakePwSz);
+            }
+            fakePwStr[fakePwSz] = 0;
+        }
+
+        CheckPasswordHashUnix(fakePwStr != NULL ? fakePwStr : "",
+                "$6$wolfSSHDfakeSalt$");
+
+        if (fakePwStr != NULL) {
+            WS_FORCEZERO(fakePwStr, fakePwSz + 1);
+            WFREE(fakePwStr, NULL, DYNTYPE_STRING);
+        }
+#endif
+    }
+
     /* temporarily elevate permissions */
     if (ret == WOLFSSH_USERAUTH_SUCCESS &&
             wolfSSHD_AuthRaisePermissions(authCtx) != WS_SUCCESS) {
@@ -1660,12 +1686,23 @@ static int RequestAuthentication(WS_UserAuthData* authData,
 
     if (ret == WOLFSSH_USERAUTH_SUCCESS &&
         authData->type == WOLFSSH_USERAUTH_PASSWORD) {
+        int configAllowed = 0;
 
         if (wolfSSHD_ConfigGetPwAuth(usrConf) != 1) {
             wolfSSH_Log(WS_LOG_ERROR, "[SSHD] Password authentication not "
                         "allowed by configuration!");
             ret = WOLFSSH_USERAUTH_REJECTED;
         }
+        else if (XSTRCMP(usr, "root") == 0 &&
+                 (wolfSSHD_ConfigGetPermitRoot(usrConf) ==
+                      WOLFSSHD_PERMIT_ROOT_PROHIBIT_PW ||
+                  wolfSSHD_ConfigGetPermitRoot(usrConf) ==
+                      WOLFSSHD_PERMIT_ROOT_FORCED_CMD)) {
+            /* prohibit-password and forced-commands-only both block this. */
+            wolfSSH_Log(WS_LOG_ERROR, "[SSHD] Password authentication for "
+                        "root not allowed by configuration!");
+            ret = WOLFSSH_USERAUTH_REJECTED;
+        }
         /* Check if password is valid for this user. */
         /* first handle empty password cases */
         else if (authData->sf.password.passwordSz == 0 &&
@@ -1675,8 +1712,14 @@ static int RequestAuthentication(WS_UserAuthData* authData,
             ret = WOLFSSH_USERAUTH_FAILURE;
         }
         else {
+            configAllowed = 1;
+        }
+
+        /* Only run password check when config allows it (avoids leaks). */
+        if (configAllowed) {
             rc = authCtx->checkPasswordCb(usr, authData->sf.password.password,
-                                     authData->sf.password.passwordSz, authCtx);
+                                          authData->sf.password.passwordSz, authCtx);
+
             if (rc == WSSHD_AUTH_SUCCESS) {
                 wolfSSH_Log(WS_LOG_INFO, "[SSHD] Password ok.");
             }
@@ -1707,6 +1750,18 @@ static int RequestAuthentication(WS_UserAuthData* authData,
         ret = WOLFSSH_USERAUTH_REJECTED;
     }
 
+    if (ret == WOLFSSH_USERAUTH_SUCCESS &&
+        authData->type == WOLFSSH_USERAUTH_PUBLICKEY &&
+        XSTRCMP(usr, "root") == 0 &&
+        wolfSSHD_ConfigGetPermitRoot(usrConf) ==
+            WOLFSSHD_PERMIT_ROOT_FORCED_CMD &&
+        wolfSSHD_ConfigGetForcedCmd(usrConf) == NULL) {
+        /* forced-commands-only requires a forced command for root pubkey login. */
+        wolfSSH_Log(WS_LOG_ERROR, "[SSHD] Public key login for root requires "
+                    "a forced command by configuration!");
+        ret = WOLFSSH_USERAUTH_REJECTED;
+    }
+
     #ifdef WOLFSSL_FPKI
     if (ret == WOLFSSH_USERAUTH_SUCCESS &&
         authData->type == WOLFSSH_USERAUTH_PUBLICKEY) {
@@ -1935,15 +1990,15 @@ int DefaultUserAuthTypes(WOLFSSH* ssh, void* ctx)
     int   ret = 0;
 
     if (ssh == NULL || ctx == NULL)
-        return WS_BAD_ARGUMENT;
+        return 0;
     authCtx = (WOLFSSHD_AUTH*)ctx;
 
     /* get configuration for user */
     usr     = wolfSSH_GetUsername(ssh);
     usrConf = wolfSSHD_AuthGetUserConf(authCtx, usr, NULL, NULL,
             NULL, NULL, NULL);
     if (usrConf == NULL) {
-        ret = WS_BAD_ARGUMENT;
+        ret = 0;
     }
     else {
         ret = wolfSSHD_GetUserAuthTypes(usrConf);
diff --git a/apps/wolfsshd/auth.h b/apps/wolfsshd/auth.h
@@ -105,7 +105,7 @@ int wolfSSHD_GetUserGroupNames(void* heap, const char* usr, WGID_T primaryGid,
 void wolfSSHD_FreeUserGroupNames(void* heap, char** names, word32 count);
 #endif
 #if defined(WOLFSSH_HAVE_LIBCRYPT) || defined(WOLFSSH_HAVE_LIBLOGIN)
-int CheckPasswordHashUnix(const char* input, char* stored);
+int CheckPasswordHashUnix(const char* input, const char* stored);
 #endif
 int CheckAuthKeysLine(char* line, word32 lineSz, const byte* key,
                       word32 keySz);
diff --git a/apps/wolfsshd/configuration.c b/apps/wolfsshd/configuration.c
@@ -100,7 +100,7 @@ struct WOLFSSHD_CONFIG {
     byte usePrivilegeSeparation:2;
     byte passwordAuth:1;
     byte pubKeyAuth:1;
-    byte permitRootLogin:1;
+    byte permitRootLogin:2;
     byte permitEmptyPasswords:1;
     byte authKeysFileSet:1; /* if not set then no explicit authorized keys */
     byte strictModes:1; /* enforce file permission/ownership checks */
@@ -555,10 +555,20 @@ static int HandlePermitRoot(WOLFSSHD_CONFIG* conf, const char* value)
 
     if (ret == WS_SUCCESS) {
         if (WSTRCMP(value, "no") == 0) {
-            conf->permitRootLogin = 0;
+            conf->permitRootLogin = WOLFSSHD_PERMIT_ROOT_NO;
         }
         else if (WSTRCMP(value, "yes") == 0) {
-            conf->permitRootLogin = 1;
+            conf->permitRootLogin = WOLFSSHD_PERMIT_ROOT_YES;
+        }
+        else if (WSTRCMP(value, "prohibit-password") == 0 ||
+                 WSTRCMP(value, "without-password") == 0) {
+            conf->permitRootLogin = WOLFSSHD_PERMIT_ROOT_PROHIBIT_PW;
+        }
+        else if (WSTRCMP(value, "forced-commands-only") == 0) {
+            wolfSSH_Log(WS_LOG_WARN, "[SSHD] PermitRootLogin "
+                        "forced-commands-only: authorized_keys command= "
+                        "restrictions not enforced");
+            conf->permitRootLogin = WOLFSSHD_PERMIT_ROOT_FORCED_CMD;
         }
         else {
             ret = WS_BAD_ARGUMENT;
diff --git a/apps/wolfsshd/configuration.h b/apps/wolfsshd/configuration.h
@@ -43,6 +43,14 @@ typedef struct WOLFSSHD_CONFIG WOLFSSHD_CONFIG;
     #define MAX_PATH_SZ 80
 #endif
 
+/* 0 so that root login is default off after struct memset'd on init */
+#define WOLFSSHD_PERMIT_ROOT_NO           0
+#define WOLFSSHD_PERMIT_ROOT_YES          1
+#define WOLFSSHD_PERMIT_ROOT_PROHIBIT_PW  2
+/* Prohibits passwords; pubkey logins require a configured ForceCommand
+ * (ignores authorized_keys command="..." restrictions). */
+#define WOLFSSHD_PERMIT_ROOT_FORCED_CMD   3
+
 WOLFSSHD_CONFIG* wolfSSHD_ConfigNew(void* heap);
 void wolfSSHD_ConfigFree(WOLFSSHD_CONFIG* conf);
 int wolfSSHD_ConfigLoad(WOLFSSHD_CONFIG* conf, const char* filename);
diff --git a/apps/wolfsshd/test/run_all_sshd_tests.sh b/apps/wolfsshd/test/run_all_sshd_tests.sh
@@ -395,12 +395,14 @@ else
         run_test "sshd_forcedcmd_test.sh"
         run_test "sshd_window_full_test.sh"
         run_test "sshd_empty_password_test.sh"
+        run_test "sshd_permitroot_prohibit_password.sh"
+        run_test "sshd_permitroot_forced_cmd.sh"
         run_strictmodes_negative_test
         run_test "sshd_login_grace_test.sh"
         run_test "sshd_privdrop_fail_test.sh"
     else
         printf "Skipping tests that need to setup local SSHD\n"
-        SKIPPED=$((SKIPPED+6))
+        SKIPPED=$((SKIPPED+8))
     fi
 
     # these tests run with X509 sshd-config loaded
diff --git a/apps/wolfsshd/test/sshd_permitroot_forced_cmd.sh b/apps/wolfsshd/test/sshd_permitroot_forced_cmd.sh
@@ -0,0 +1,129 @@
+#!/bin/bash
+
+# Test for PermitRootLogin forced-commands-only enforcement.
+
+if [ -z "$1" ] || [ -z "$2" ]; then
+    echo "expecting host and port as arguments"
+    echo "$0 127.0.0.1 22222"
+    exit 1
+fi
+
+TEST_HOST="$1"
+TEST_PORT="$2"
+USER="root"
+PWD=`pwd`
+
+source ./start_sshd.sh
+
+# Build an authorized_keys file for "root" so we can test root public-key
+# auth both with and without a ForceCommand configured.
+cat ../../../keys/hansel-*.pub > authorized_keys_test_forced_cmd
+sed -i.bak "s/hansel/root/" ./authorized_keys_test_forced_cmd
+
+TEST_CLIENT="../../../examples/client/client"
+
+cleanup() {
+    stop_wolfsshd
+    rm -f authorized_keys_test_forced_cmd authorized_keys_test_forced_cmd.bak \
+        sshd_config_test_forced_cmd sshd_config_test_forced_cmd_with_cmd
+}
+trap cleanup EXIT
+
+### Scenario 1: forced-commands-only with no ForceCommand configured -- both
+### root password auth and root pubkey auth must be rejected.
+cat <<EOF > sshd_config_test_forced_cmd
+Port $TEST_PORT
+Protocol 2
+LoginGraceTime 600
+PermitRootLogin forced-commands-only
+PasswordAuthentication yes
+AuthorizedKeysFile $PWD/authorized_keys_test_forced_cmd
+StrictModes no
+UsePrivilegeSeparation no
+UseDNS no
+HostKey $PWD/../../../keys/server-key.pem
+EOF
+
+sudo rm -f ./log.txt
+
+start_wolfsshd "sshd_config_test_forced_cmd"
+if [ -z "$PID" ]; then
+    echo "Failed to start wolfsshd"
+    exit 1
+fi
+
+timeout 10 $TEST_CLIENT -u "$USER" -P "somepassword" -c 'true' \
+    -h "$TEST_HOST" -p "$TEST_PORT" > /dev/null 2>&1
+PASS_RESULT=$?
+
+if [ "$PASS_RESULT" = 0 ]; then
+    echo "FAIL: root password login unexpectedly succeeded under forced-commands-only"
+    exit 1
+fi
+
+timeout 10 $TEST_CLIENT -u "$USER" -c 'true' \
+    -i ../../../keys/hansel-key-ecc.der -j ../../../keys/hansel-key-ecc.pub \
+    -h "$TEST_HOST" -p "$TEST_PORT" > /dev/null 2>&1
+NOCMD_PUBKEY_RESULT=$?
+
+if [ "$NOCMD_PUBKEY_RESULT" = 0 ]; then
+    echo "FAIL: root pubkey login without a ForceCommand unexpectedly succeeded"
+    exit 1
+fi
+
+# Let wolfsshd flush the log before we stop it.
+sleep 1
+
+if ! sudo grep -q "Password authentication for root not allowed by configuration!" ./log.txt; then
+    echo "FAIL: forced-commands-only did not reject root password login as expected"
+    echo "----- log.txt -----"
+    sudo cat ./log.txt
+    exit 1
+fi
+
+if ! sudo grep -q "Public key login for root requires a forced command by configuration!" ./log.txt; then
+    echo "FAIL: forced-commands-only did not reject root pubkey login without a ForceCommand"
+    echo "----- log.txt -----"
+    sudo cat ./log.txt
+    exit 1
+fi
+
+stop_wolfsshd
+
+### Scenario 2: forced-commands-only WITH a ForceCommand configured -- root
+### pubkey login must now be permitted.
+cat <<EOF > sshd_config_test_forced_cmd_with_cmd
+Port $TEST_PORT
+Protocol 2
+LoginGraceTime 600
+PermitRootLogin forced-commands-only
+ForceCommand true
+PasswordAuthentication yes
+AuthorizedKeysFile $PWD/authorized_keys_test_forced_cmd
+StrictModes no
+UsePrivilegeSeparation no
+UseDNS no
+HostKey $PWD/../../../keys/server-key.pem
+EOF
+
+sudo rm -f ./log.txt
+
+start_wolfsshd "sshd_config_test_forced_cmd_with_cmd"
+if [ -z "$PID" ]; then
+    echo "Failed to start wolfsshd"
+    exit 1
+fi
+
+timeout 10 $TEST_CLIENT -u "$USER" -c 'true' \
+    -i ../../../keys/hansel-key-ecc.der -j ../../../keys/hansel-key-ecc.pub \
+    -h "$TEST_HOST" -p "$TEST_PORT" > /dev/null 2>&1
+WITHCMD_PUBKEY_RESULT=$?
+
+if [ "$WITHCMD_PUBKEY_RESULT" != 0 ]; then
+    echo "FAIL: root pubkey login with a ForceCommand configured was rejected"
+    echo "----- log.txt -----"
+    sudo cat ./log.txt
+    exit 1
+fi
+
+exit 0
diff --git a/apps/wolfsshd/test/sshd_permitroot_prohibit_password.sh b/apps/wolfsshd/test/sshd_permitroot_prohibit_password.sh
diff --git a/apps/wolfsshd/test/test_configuration.c b/apps/wolfsshd/test/test_configuration.c
