https://gitlab.synchro.net/main/sbbs/-/commit/ca239664d95bca090dc4b064
Modified Files:
src/sbbs3/answer.cpp
Log Message:
Reject DELETED/INACTIVE accounts on the SSH, SFTP and RLogin logon paths
An account flagged DELETED or INACTIVE could still log on via SSH, SFTP
or RLogin. Those paths resolve the account name themselves and, on a successful authentication, jump straight to logon(), bypassing login(),
which was the only place the flags were checked. That is why Telnet
correctly refused the same account while SSH let it straight in.
find_login_id() does not filter the flags on the caller's behalf:
matchuser() skips only DELETED accounts, because a deleted account's
alias is blanked in the user index, and the LOGIN_USERNUM shortcut
checks nothing at all.
Test user_is_active() once the account has been resolved. A terminal
session is sent text[UnknownUser] before the disconnect, the same
response Telnet gives, since login() treats a deactivated account as an
unknown one. An SFTP session has no terminal and is refused in the
channel handler instead, before the session is marked on-line and the
logon is counted.
Both sites record the rejection with badlogin(), so repeated attempts accumulate toward the hack and IP filter thresholds, as they already do
in the FTP and mail servers. The password is deliberately not passed
along: it was the correct one, and it would otherwise be written to the
hack log and to the ip.can entry.
GitLab #1239
Co-Authored-By: Claude Opus 5 (1M context) <
[email protected]>
--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)