Forward-port from HEAD:

  * If PasswordAuthentication is disabled, then offer to disable
    ChallengeResponseAuthentication too. The current PAM code will attempt
    password-style authentication if ChallengeResponseAuthentication is
    enabled (closes: #250369).
  * This will ask a question of anyone who installed fresh with 1:3.8p1-2 or
    later and then upgraded. Sorry about that ... for this reason, the
    default answer is to leave ChallengeResponseAuthentication enabled.

20 files changed, 575 insertions, 35 deletions

diff --git a/debian/changelog b/debian/changelog
index c1aa043f0..e0c41d52d 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,6 +1,13 @@
 openssh (1:3.8.1p1-11) UNRELEASED; urgency=low
 
   * Move sshd_config(5) to openssh-server, where it belongs.
+  * If PasswordAuthentication is disabled, then offer to disable
+    ChallengeResponseAuthentication too. The current PAM code will attempt
+    password-style authentication if ChallengeResponseAuthentication is
+    enabled (closes: #250369).
+  * This will ask a question of anyone who installed fresh with 1:3.8p1-2 or
+    later and then upgraded. Sorry about that ... for this reason, the
+    default answer is to leave ChallengeResponseAuthentication enabled.
 
  -- Colin Watson <cjwatson@debian.org>  Tue, 31 Aug 2004 04:30:34 +0100
 
diff --git a/debian/openssh-server.config b/debian/openssh-server.config
index b40e8afd7..0cd0a4b8d 100644
--- a/debian/openssh-server.config
+++ b/debian/openssh-server.config
@@ -7,6 +7,18 @@ version=$2
 . /usr/share/debconf/confmodule
 db_version 2.0
 
+
+get_config_option() {
+        option="$1"
+
+        [ -f /etc/ssh/sshd_config ] || return
+
+        # TODO: actually only one '=' allowed after option
+        perl -ne 'print if s/^[[:space:]]*'"$option"'[[:space:]=]+//i' \
+           /etc/ssh/sshd_config 2>/dev/null
+}
+
+
 if [ -e /etc/init.d/ssh ] && ! grep -q pidfile /etc/init.d/ssh
 then
   db_fset ssh/use_old_init_script seen false
@@ -35,6 +47,19 @@ then
         then db_input medium ssh/protocol2_only ||true
         fi
     fi
+
+    # An empty version means we're upgrading from before the package split,
+    # so check.
+    if dpkg --compare-versions "$version" lt 1:3.8.1p1-11
+    then
+        passwordauth="$(get_config_option PasswordAuthentication)"
+        crauth="$(get_config_option ChallengeResponseAuthentication)"
+        if [ "$passwordauth" = no ] && \
+           ([ -z "$crauth" ] || [ "$crauth" = yes ])
+        then
+            db_input critical ssh/disable_cr_auth || true
+        fi
+    fi
 fi 
 
 if [ -x /usr/sbin/in.telnetd ] && grep -q "^telnet\b" /etc/inetd.conf
diff --git a/debian/openssh-server.postinst b/debian/openssh-server.postinst
index 28af3f490..dab8c94fd 100644
--- a/debian/openssh-server.postinst
+++ b/debian/openssh-server.postinst
@@ -29,12 +29,33 @@ check_idea_key() {
 get_config_option() {
         option="$1"
 
+        [ -f /etc/ssh/sshd_config ] || return
+
         # TODO: actually only one '=' allowed after option
         perl -ne 'print if s/^[[:space:]]*'"$option"'[[:space:]=]+//i' \
            /etc/ssh/sshd_config
 }
 
 
+set_config_option() {
+        option="$1"
+        value="$2"
+
+        perl -e '
+                $option = $ARGV[0]; $value = $ARGV[1]; $done = 0;
+                while (<STDIN>) {
+                        if (s/^\s*\Q$option\E\s+.*/$option $value/) {
+                                $done = 1;
+                        }
+                        print;
+                }
+                print "\n$option $value\n" unless $done;' \
+                "$option" "$value" \
+                < /etc/ssh/sshd_config > /etc/ssh/sshd_config.dpkg-new
+        mv /etc/ssh/sshd_config.dpkg-new /etc/ssh/sshd_config
+}
+
+
 host_keys_required() {
         hostkeys="$(get_config_option HostKey)"
         if [ "$hostkeys" ]; then
@@ -85,31 +106,54 @@ create_keys() {
 }
 
 
+check_password_auth() {
+        passwordauth="$(get_config_option PasswordAuthentication)"
+        crauth="$(get_config_option ChallengeResponseAuthentication)"
+        if [ "$passwordauth" = no ] && \
+           ([ -z "$crauth" ] || [ "$crauth" = yes ]); then
+                db_get ssh/disable_cr_auth
+                if [ "$RET" = true ]; then
+                        set_config_option ChallengeResponseAuthentication no
+                fi
+        fi
+}
+
+
 create_sshdconfig() {
         if [ -e /etc/ssh/sshd_config ] ; then
             if dpkg --compare-versions "$oldversion" lt-nl 1:1.3 ; then
                 db_get ssh/new_config
                 if [ "$RET" = "false" ] ; then return 0; fi
-            elif (dpkg --compare-versions "$oldversion" lt-nl 1:3.8p1-1 && \
-                  ! grep -iq ^UsePAM /etc/ssh/sshd_config) || \
-                 grep -Eiq '^(PAMAuthenticationViaKbdInt|RhostsAuthentication)' \
-                   /etc/ssh/sshd_config ; then
-                # Upgrade from pre-3.7: UsePAM needed to maintain standard
-                # Debian configuration.
-                # Note that --compare-versions is sadly not reliable enough
-                # here due to the package split of ssh into openssh-client
-                # and openssh-server. The extra grep for some deprecated
-                # options should with any luck be a good enough heuristic.
-                echo -n 'Upgrading sshd_config (old version in .dpkg-old) ...'
-                cp -a /etc/ssh/sshd_config /etc/ssh/sshd_config.dpkg-old
-                perl -pe 's/^(PAMAuthenticationViaKbdInt|RhostsAuthentication)\b/#$1/i' \
-                    /etc/ssh/sshd_config > /etc/ssh/sshd_config.dpkg-new
-                echo >> /etc/ssh/sshd_config.dpkg-new
-                echo 'UsePAM yes' >> /etc/ssh/sshd_config.dpkg-new
-                mv /etc/ssh/sshd_config.dpkg-new /etc/ssh/sshd_config
-                echo
+            else
+                # Upgrade sshd configuration from a sane version.
+
+                if (dpkg --compare-versions "$oldversion" lt-nl 1:3.8p1-1 && \
+                    ! grep -iq ^UsePAM /etc/ssh/sshd_config) || \
+                   grep -Eiq '^(PAMAuthenticationViaKbdInt|RhostsAuthentication)' \
+                     /etc/ssh/sshd_config ; then
+                    # Upgrade from pre-3.7: UsePAM needed to maintain standard
+                    # Debian configuration.
+                    # Note that --compare-versions is sadly not reliable enough
+                    # here due to the package split of ssh into openssh-client
+                    # and openssh-server. The extra grep for some deprecated
+                    # options should with any luck be a good enough heuristic.
+                    echo -n 'Upgrading sshd_config (old version in .dpkg-old) ...'
+                    cp -a /etc/ssh/sshd_config /etc/ssh/sshd_config.dpkg-old
+                    perl -pe 's/^(PAMAuthenticationViaKbdInt|RhostsAuthentication)\b/#$1/i' \
+                        /etc/ssh/sshd_config > /etc/ssh/sshd_config.dpkg-new
+                    echo >> /etc/ssh/sshd_config.dpkg-new
+                    echo 'UsePAM yes' >> /etc/ssh/sshd_config.dpkg-new
+                    mv /etc/ssh/sshd_config.dpkg-new /etc/ssh/sshd_config
+                    echo
+                fi
+
+                # An empty version means we're upgrading from before the
+                # package split, so check.
+                if dpkg --compare-versions "$oldversion" lt 1:3.8.1p1-11; then
+                    check_password_auth
+                fi
+
                 return 0
-            else return 0
             fi
         fi
 
diff --git a/debian/openssh-server.templates.master b/debian/openssh-server.templates.master
index e6d355639..af4d4e9f8 100644
--- a/debian/openssh-server.templates.master
+++ b/debian/openssh-server.templates.master
@@ -77,3 +77,19 @@ _Description: Warning: you must create a new host key
  from the old (non-free) SSH installation.
  .
  You will need to generate a new host key.
+
+Template: ssh/disable_cr_auth
+Type: boolean
+Default: false
+_Description: Disable challenge-response authentication?
+ Password authentication appears to be disabled in your current OpenSSH
+ server configuration. In order to prevent users from logging in using
+ passwords (perhaps using only public key authentication instead) with
+ recent versions of OpenSSH, you must disable challenge-response
+ authentication, or else ensure that your PAM configuration does not allow
+ Unix password file authentication.
+ .
+ If you disable challenge-response authentication, then users will not be
+ able to log in using passwords. If you leave it enabled (the default
+ answer), then the 'PasswordAuthentication no' option will have no useful
+ effect unless you also adjust your PAM configuration in /etc/pam.d/ssh.
diff --git a/debian/po/ca.po b/debian/po/ca.po
index 19d590977..633867185 100644
--- a/debian/po/ca.po
+++ b/debian/po/ca.po
@@ -6,7 +6,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openssh_1:3.8p1-3_templates\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2004-07-31 03:10+0100\n"
+"POT-Creation-Date: 2004-10-06 14:06+0100\n"
 "PO-Revision-Date: 2004-03-05 19:46GMT\n"
 "Last-Translator: Aleix Badia i Bosch <abadia@ica.es>\n"
 "Language-Team: Catalan <debian-l10n-catalan@lists.debian.org>\n"
@@ -265,6 +265,34 @@ msgstr ""
 msgid "You will need to generate a new host key."
 msgstr "Haureu de generar una nova clau de l'ordinador central."
 
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates.master:84
+msgid "Disable challenge-response authentication?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates.master:84
+msgid ""
+"Password authentication appears to be disabled in your current OpenSSH "
+"server configuration. In order to prevent users from logging in using "
+"passwords (perhaps using only public key authentication instead) with recent "
+"versions of OpenSSH, you must disable challenge-response authentication, or "
+"else ensure that your PAM configuration does not allow Unix password file "
+"authentication."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates.master:84
+msgid ""
+"If you disable challenge-response authentication, then users will not be "
+"able to log in using passwords. If you leave it enabled (the default "
+"answer), then the 'PasswordAuthentication no' option will have no useful "
+"effect unless you also adjust your PAM configuration in /etc/pam.d/ssh."
+msgstr ""
+
 #~ msgid "ssh2 keys merged in configuration files"
 #~ msgstr "S'han combinat les claus de l'ssh2 als fitxers de configuració"
 
diff --git a/debian/po/cs.po b/debian/po/cs.po
index 617f7d98d..19cc1762a 100644
--- a/debian/po/cs.po
+++ b/debian/po/cs.po
@@ -15,7 +15,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openssh\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2004-07-31 03:10+0100\n"
+"POT-Creation-Date: 2004-10-06 14:06+0100\n"
 "PO-Revision-Date: 2004-01-28 15:10+0100\n"
 "Last-Translator: Miroslav Kure <kurem@debian.cz>\n"
 "Language-Team: Czech <provoz@debian.cz>\n"
@@ -263,6 +263,34 @@ msgstr ""
 msgid "You will need to generate a new host key."
 msgstr "Mus�te vygenerovat nov� serverov� kl��"
 
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates.master:84
+msgid "Disable challenge-response authentication?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates.master:84
+msgid ""
+"Password authentication appears to be disabled in your current OpenSSH "
+"server configuration. In order to prevent users from logging in using "
+"passwords (perhaps using only public key authentication instead) with recent "
+"versions of OpenSSH, you must disable challenge-response authentication, or "
+"else ensure that your PAM configuration does not allow Unix password file "
+"authentication."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates.master:84
+msgid ""
+"If you disable challenge-response authentication, then users will not be "
+"able to log in using passwords. If you leave it enabled (the default "
+"answer), then the 'PasswordAuthentication no' option will have no useful "
+"effect unless you also adjust your PAM configuration in /etc/pam.d/ssh."
+msgstr ""
+
 #~ msgid "ssh2 keys merged in configuration files"
 #~ msgstr "Kl��e ssh2 v konfigura�n�ch souborech byly spojeny"
 
diff --git a/debian/po/da.po b/debian/po/da.po
index 6eb87ece2..a34023481 100644
--- a/debian/po/da.po
+++ b/debian/po/da.po
@@ -15,7 +15,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openssh 3.6.1p2\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2004-07-31 03:10+0100\n"
+"POT-Creation-Date: 2004-10-06 14:06+0100\n"
 "PO-Revision-Date: 2003-10-28 14:30+0200\n"
 "Last-Translator: Morten Brix Pedersen <morten@wtf.dk>\n"
 "Language-Team: debian-l10n-danish <debian-l10n-danish@lists.debian.org>\n"
@@ -268,6 +268,34 @@ msgstr ""
 msgid "You will need to generate a new host key."
 msgstr "Du skal oprette en ny værtsnøgle."
 
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates.master:84
+msgid "Disable challenge-response authentication?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates.master:84
+msgid ""
+"Password authentication appears to be disabled in your current OpenSSH "
+"server configuration. In order to prevent users from logging in using "
+"passwords (perhaps using only public key authentication instead) with recent "
+"versions of OpenSSH, you must disable challenge-response authentication, or "
+"else ensure that your PAM configuration does not allow Unix password file "
+"authentication."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates.master:84
+msgid ""
+"If you disable challenge-response authentication, then users will not be "
+"able to log in using passwords. If you leave it enabled (the default "
+"answer), then the 'PasswordAuthentication no' option will have no useful "
+"effect unless you also adjust your PAM configuration in /etc/pam.d/ssh."
+msgstr ""
+
 #~ msgid "ssh2 keys merged in configuration files"
 #~ msgstr "ssh2-nøgler flettet i opsætningsfilerne"
 
diff --git a/debian/po/de.po b/debian/po/de.po
index 17526f287..0af4ea07f 100644
--- a/debian/po/de.po
+++ b/debian/po/de.po
@@ -16,7 +16,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2004-07-31 03:10+0100\n"
+"POT-Creation-Date: 2004-10-06 14:06+0100\n"
 "PO-Revision-Date: 2004-05-30 09:49-0200\n"
 "Last-Translator: Helge Kreutzmann <kreutzm@itp.uni-hannover.de>\n"
 "Language-Team: de <debian-l10n-german@lists.debian.org>\n"
@@ -274,6 +274,34 @@ msgstr ""
 msgid "You will need to generate a new host key."
 msgstr "Sie m�ssen einen neuen Host-Schl�ssel erzeugen."
 
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates.master:84
+msgid "Disable challenge-response authentication?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates.master:84
+msgid ""
+"Password authentication appears to be disabled in your current OpenSSH "
+"server configuration. In order to prevent users from logging in using "
+"passwords (perhaps using only public key authentication instead) with recent "
+"versions of OpenSSH, you must disable challenge-response authentication, or "
+"else ensure that your PAM configuration does not allow Unix password file "
+"authentication."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates.master:84
+msgid ""
+"If you disable challenge-response authentication, then users will not be "
+"able to log in using passwords. If you leave it enabled (the default "
+"answer), then the 'PasswordAuthentication no' option will have no useful "
+"effect unless you also adjust your PAM configuration in /etc/pam.d/ssh."
+msgstr ""
+
 #~ msgid "ssh2 keys merged in configuration files"
 #~ msgstr "ssh2-Schl�ssel in die Konfigurationsdateien eingef�gt"
 
diff --git a/debian/po/el.po b/debian/po/el.po
index 4a67e7116..5cb31d755 100644
--- a/debian/po/el.po
+++ b/debian/po/el.po
@@ -16,7 +16,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: el\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2004-07-31 03:10+0100\n"
+"POT-Creation-Date: 2004-10-06 14:06+0100\n"
 "PO-Revision-Date: 2004-02-15 14:14EEST\n"
 "Last-Translator: Konstantinos Margaritis <markos@debian.org>\n"
 "Language-Team: Greek <debian-l10n-greek@lists.debian.org>\n"
@@ -283,6 +283,34 @@ msgstr ""
 msgid "You will need to generate a new host key."
 msgstr "Πρέπει να δημιουργήσετε ένα νέο κλειδί για τον υπολογιστή (host key)."
 
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates.master:84
+msgid "Disable challenge-response authentication?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates.master:84
+msgid ""
+"Password authentication appears to be disabled in your current OpenSSH "
+"server configuration. In order to prevent users from logging in using "
+"passwords (perhaps using only public key authentication instead) with recent "
+"versions of OpenSSH, you must disable challenge-response authentication, or "
+"else ensure that your PAM configuration does not allow Unix password file "
+"authentication."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates.master:84
+msgid ""
+"If you disable challenge-response authentication, then users will not be "
+"able to log in using passwords. If you leave it enabled (the default "
+"answer), then the 'PasswordAuthentication no' option will have no useful "
+"effect unless you also adjust your PAM configuration in /etc/pam.d/ssh."
+msgstr ""
+
 #~ msgid "ssh2 keys merged in configuration files"
 #~ msgstr "Τα κλειδιά ssh2 συγχωνεύτηκαν στα αρχεία ρυθμίσεων"
 
diff --git a/debian/po/es.po b/debian/po/es.po
index 84b290e0a..d34d1a9df 100644
--- a/debian/po/es.po
+++ b/debian/po/es.po
@@ -32,7 +32,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openssh 3.6.1p2-11\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2004-07-31 03:10+0100\n"
+"POT-Creation-Date: 2004-10-06 14:06+0100\n"
 "PO-Revision-Date: 2004-01-17 17:47+0200\n"
 "Last-Translator: Javier Fernandez-Sanguino Pe�a <jfs@computer.org>\n"
 "Language-Team: Debian L10n Spanish <debian-l10n-spanish@lists.debian.org>\n"
@@ -289,6 +289,34 @@ msgstr ""
 msgid "You will need to generate a new host key."
 msgstr "Necesitar� generar una nueva clave para su servidor."
 
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates.master:84
+msgid "Disable challenge-response authentication?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates.master:84
+msgid ""
+"Password authentication appears to be disabled in your current OpenSSH "
+"server configuration. In order to prevent users from logging in using "
+"passwords (perhaps using only public key authentication instead) with recent "
+"versions of OpenSSH, you must disable challenge-response authentication, or "
+"else ensure that your PAM configuration does not allow Unix password file "
+"authentication."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates.master:84
+msgid ""
+"If you disable challenge-response authentication, then users will not be "
+"able to log in using passwords. If you leave it enabled (the default "
+"answer), then the 'PasswordAuthentication no' option will have no useful "
+"effect unless you also adjust your PAM configuration in /etc/pam.d/ssh."
+msgstr ""
+
 #~ msgid "ssh2 keys merged in configuration files"
 #~ msgstr "Las claves ssh2 ya se incluyen en los ficheros de configuraci�n"
 
diff --git a/debian/po/fr.po b/debian/po/fr.po
index 6c6ecfaab..0ae9bbb24 100644
--- a/debian/po/fr.po
+++ b/debian/po/fr.po
@@ -15,7 +15,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openssh 3.6.1p2-5\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2004-07-31 03:10+0100\n"
+"POT-Creation-Date: 2004-10-06 14:06+0100\n"
 "PO-Revision-Date: 2003-05-22 10:34+0200\n"
 "Last-Translator: Denis Barbier <barbier@debian.org>\n"
 "Language-Team: French <Debian-l10n-french@lists.debian.org>\n"
@@ -285,6 +285,34 @@ msgstr ""
 msgid "You will need to generate a new host key."
 msgstr "Vous aurez besoin de g�n�rer une nouvelle cl� d'h�te."
 
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates.master:84
+msgid "Disable challenge-response authentication?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates.master:84
+msgid ""
+"Password authentication appears to be disabled in your current OpenSSH "
+"server configuration. In order to prevent users from logging in using "
+"passwords (perhaps using only public key authentication instead) with recent "
+"versions of OpenSSH, you must disable challenge-response authentication, or "
+"else ensure that your PAM configuration does not allow Unix password file "
+"authentication."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates.master:84
+msgid ""
+"If you disable challenge-response authentication, then users will not be "
+"able to log in using passwords. If you leave it enabled (the default "
+"answer), then the 'PasswordAuthentication no' option will have no useful "
+"effect unless you also adjust your PAM configuration in /etc/pam.d/ssh."
+msgstr ""
+
 #~ msgid "ssh2 keys merged in configuration files"
 #~ msgstr "Cl�s pour ssh2 fusionn�es dans les fichiers de configuration"
 
diff --git a/debian/po/it.po b/debian/po/it.po
index b827e9883..303cf5e52 100644
--- a/debian/po/it.po
+++ b/debian/po/it.po
@@ -15,7 +15,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openssh 3.6.1\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2004-07-31 03:10+0100\n"
+"POT-Creation-Date: 2004-10-06 14:06+0100\n"
 "PO-Revision-Date: 2003-12-21 12:23+0100\n"
 "Last-Translator: Renato Gini <rgini@openlabs.it>\n"
 "Language-Team: Italian <debian-l10n-italian@lists.debian.org>\n"
@@ -279,6 +279,34 @@ msgstr ""
 msgid "You will need to generate a new host key."
 msgstr "Sar� necessario generare una nuova chiave host."
 
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates.master:84
+msgid "Disable challenge-response authentication?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates.master:84
+msgid ""
+"Password authentication appears to be disabled in your current OpenSSH "
+"server configuration. In order to prevent users from logging in using "
+"passwords (perhaps using only public key authentication instead) with recent "
+"versions of OpenSSH, you must disable challenge-response authentication, or "
+"else ensure that your PAM configuration does not allow Unix password file "
+"authentication."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates.master:84
+msgid ""
+"If you disable challenge-response authentication, then users will not be "
+"able to log in using passwords. If you leave it enabled (the default "
+"answer), then the 'PasswordAuthentication no' option will have no useful "
+"effect unless you also adjust your PAM configuration in /etc/pam.d/ssh."
+msgstr ""
+
 #~ msgid "ssh2 keys merged in configuration files"
 #~ msgstr "chiavi ssh2 aggiunte nei file di configurazione"
 
diff --git a/debian/po/ja.po b/debian/po/ja.po
index 0baefcc8e..5b03d6256 100644
--- a/debian/po/ja.po
+++ b/debian/po/ja.po
@@ -15,7 +15,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2004-07-31 03:10+0100\n"
+"POT-Creation-Date: 2004-10-06 14:06+0100\n"
 "PO-Revision-Date: 2003-09-24 09:32+0900\n"
 "Last-Translator: Kenshi Muto <kmuto@debian.org>\n"
 "Language-Team: Japanese <debian-japanese@lists.debian.org>\n"
@@ -267,6 +267,34 @@ msgstr ""
 msgid "You will need to generate a new host key."
 msgstr "�������ۥ��ȥ�������ɬ�פ�����ޤ���"
 
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates.master:84
+msgid "Disable challenge-response authentication?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates.master:84
+msgid ""
+"Password authentication appears to be disabled in your current OpenSSH "
+"server configuration. In order to prevent users from logging in using "
+"passwords (perhaps using only public key authentication instead) with recent "
+"versions of OpenSSH, you must disable challenge-response authentication, or "
+"else ensure that your PAM configuration does not allow Unix password file "
+"authentication."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates.master:84
+msgid ""
+"If you disable challenge-response authentication, then users will not be "
+"able to log in using passwords. If you leave it enabled (the default "
+"answer), then the 'PasswordAuthentication no' option will have no useful "
+"effect unless you also adjust your PAM configuration in /etc/pam.d/ssh."
+msgstr ""
+
 #~ msgid "ssh2 keys merged in configuration files"
 #~ msgstr "ssh2 ����������ե���������礵��ޤ�"
 
diff --git a/debian/po/nl.po b/debian/po/nl.po
index 40bca6356..059d623da 100644
--- a/debian/po/nl.po
+++ b/debian/po/nl.po
@@ -15,7 +15,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openssh 3.6.1p2-9\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2004-07-31 03:10+0100\n"
+"POT-Creation-Date: 2004-10-06 14:06+0100\n"
 "PO-Revision-Date: 2003-09-27 14:43+0100\n"
 "Last-Translator: Bart Cornelis <cobaco@linux.be>\n"
 "Language-Team: debian-l10n-dutch <debian-l10n-dutch@lists.debian.org>\n"
@@ -278,6 +278,34 @@ msgstr ""
 msgid "You will need to generate a new host key."
 msgstr "Het zal nodig zijn om een nieuwe computersleutel te genereren"
 
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates.master:84
+msgid "Disable challenge-response authentication?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates.master:84
+msgid ""
+"Password authentication appears to be disabled in your current OpenSSH "
+"server configuration. In order to prevent users from logging in using "
+"passwords (perhaps using only public key authentication instead) with recent "
+"versions of OpenSSH, you must disable challenge-response authentication, or "
+"else ensure that your PAM configuration does not allow Unix password file "
+"authentication."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates.master:84
+msgid ""
+"If you disable challenge-response authentication, then users will not be "
+"able to log in using passwords. If you leave it enabled (the default "
+"answer), then the 'PasswordAuthentication no' option will have no useful "
+"effect unless you also adjust your PAM configuration in /etc/pam.d/ssh."
+msgstr ""
+
 #~ msgid "ssh2 keys merged in configuration files"
 #~ msgstr "ssh2 sleutels zijn samengevoegd in de configuratiebestanden"
 
diff --git a/debian/po/pl.po b/debian/po/pl.po
index f91259960..530f1668f 100644
--- a/debian/po/pl.po
+++ b/debian/po/pl.po
@@ -15,7 +15,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2004-07-31 03:10+0100\n"
+"POT-Creation-Date: 2004-10-06 14:06+0100\n"
 "PO-Revision-Date: 2004-04-08 18:28+0200\n"
 "Last-Translator: Emil Nowak <emil5@go2.pl>\n"
 "Language-Team: Polish <translation-team-pl@lists.sourceforge.net>\n"
@@ -273,6 +273,34 @@ msgstr ""
 msgid "You will need to generate a new host key."
 msgstr "B�dziesz musia� wygenerowa� nowy klucz hosta."
 
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates.master:84
+msgid "Disable challenge-response authentication?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates.master:84
+msgid ""
+"Password authentication appears to be disabled in your current OpenSSH "
+"server configuration. In order to prevent users from logging in using "
+"passwords (perhaps using only public key authentication instead) with recent "
+"versions of OpenSSH, you must disable challenge-response authentication, or "
+"else ensure that your PAM configuration does not allow Unix password file "
+"authentication."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates.master:84
+msgid ""
+"If you disable challenge-response authentication, then users will not be "
+"able to log in using passwords. If you leave it enabled (the default "
+"answer), then the 'PasswordAuthentication no' option will have no useful "
+"effect unless you also adjust your PAM configuration in /etc/pam.d/ssh."
+msgstr ""
+
 #~ msgid "ssh2 keys merged in configuration files"
 #~ msgstr "klucze ssh2 w��czone do plik�w konfiguracyjnych"
 
diff --git a/debian/po/pt_BR.po b/debian/po/pt_BR.po
index 4bf9baf82..4df5c2766 100644
--- a/debian/po/pt_BR.po
+++ b/debian/po/pt_BR.po
@@ -15,7 +15,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openssh_3.6.1p2-9\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2004-07-31 03:10+0100\n"
+"POT-Creation-Date: 2004-10-06 14:06+0100\n"
 "PO-Revision-Date: 2003-11-09 16:29-0300\n"
 "Last-Translator: Andr� Lu�s Lopes <andrelop@debian.org>\n"
 "Language-Team: Debian-BR Project <debian-l10n-portuguese@lists.debian.org>\n"
@@ -279,6 +279,34 @@ msgstr ""
 msgid "You will need to generate a new host key."
 msgstr "Voc� precisar� gerar uma nova host key."
 
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates.master:84
+msgid "Disable challenge-response authentication?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates.master:84
+msgid ""
+"Password authentication appears to be disabled in your current OpenSSH "
+"server configuration. In order to prevent users from logging in using "
+"passwords (perhaps using only public key authentication instead) with recent "
+"versions of OpenSSH, you must disable challenge-response authentication, or "
+"else ensure that your PAM configuration does not allow Unix password file "
+"authentication."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates.master:84
+msgid ""
+"If you disable challenge-response authentication, then users will not be "
+"able to log in using passwords. If you leave it enabled (the default "
+"answer), then the 'PasswordAuthentication no' option will have no useful "
+"effect unless you also adjust your PAM configuration in /etc/pam.d/ssh."
+msgstr ""
+
 #~ msgid "ssh2 keys merged in configuration files"
 #~ msgstr "Chaves ssh2 inclu�das nos arquivos de configura��o"
 
diff --git a/debian/po/ru.po b/debian/po/ru.po
index 6a46d1ec6..43af92834 100644
--- a/debian/po/ru.po
+++ b/debian/po/ru.po
@@ -16,7 +16,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2004-07-31 03:10+0100\n"
+"POT-Creation-Date: 2004-10-06 14:06+0100\n"
 "PO-Revision-Date: 2003-10-02 17:20+0500\n"
 "Last-Translator: Ilgiz Kalmetev <translator@ilgiz.pp.ru>\n"
 "Language-Team: russian <ru@li.org>\n"
@@ -269,6 +269,34 @@ msgstr ""
 msgid "You will need to generate a new host key."
 msgstr "��� ���� ����� ������������� ����� ���� �����."
 
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates.master:84
+msgid "Disable challenge-response authentication?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates.master:84
+msgid ""
+"Password authentication appears to be disabled in your current OpenSSH "
+"server configuration. In order to prevent users from logging in using "
+"passwords (perhaps using only public key authentication instead) with recent "
+"versions of OpenSSH, you must disable challenge-response authentication, or "
+"else ensure that your PAM configuration does not allow Unix password file "
+"authentication."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates.master:84
+msgid ""
+"If you disable challenge-response authentication, then users will not be "
+"able to log in using passwords. If you leave it enabled (the default "
+"answer), then the 'PasswordAuthentication no' option will have no useful "
+"effect unless you also adjust your PAM configuration in /etc/pam.d/ssh."
+msgstr ""
+
 #~ msgid "ssh2 keys merged in configuration files"
 #~ msgstr "����� ssh2 ��������� � ����� ��������"
 
diff --git a/debian/po/templates.pot b/debian/po/templates.pot
index a4224d581..6d43c330f 100644
--- a/debian/po/templates.pot
+++ b/debian/po/templates.pot
@@ -16,7 +16,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2004-07-31 03:10+0100\n"
+"POT-Creation-Date: 2004-10-06 14:06+0100\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -223,3 +223,31 @@ msgstr ""
 #: ../openssh-server.templates.master:74
 msgid "You will need to generate a new host key."
 msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates.master:84
+msgid "Disable challenge-response authentication?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates.master:84
+msgid ""
+"Password authentication appears to be disabled in your current OpenSSH "
+"server configuration. In order to prevent users from logging in using "
+"passwords (perhaps using only public key authentication instead) with recent "
+"versions of OpenSSH, you must disable challenge-response authentication, or "
+"else ensure that your PAM configuration does not allow Unix password file "
+"authentication."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates.master:84
+msgid ""
+"If you disable challenge-response authentication, then users will not be "
+"able to log in using passwords. If you leave it enabled (the default "
+"answer), then the 'PasswordAuthentication no' option will have no useful "
+"effect unless you also adjust your PAM configuration in /etc/pam.d/ssh."
+msgstr ""
diff --git a/debian/po/tr.po b/debian/po/tr.po
index 499041ad2..d3d471d3c 100644
--- a/debian/po/tr.po
+++ b/debian/po/tr.po
@@ -6,7 +6,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: ssh\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2004-07-31 03:10+0100\n"
+"POT-Creation-Date: 2004-10-06 14:06+0100\n"
 "PO-Revision-Date: 2004-04-27 06:50+0300\n"
 "Last-Translator: Recai Oktaş <roktas@omu.edu.tr>\n"
 "Language-Team: Turkish <debian-l10n-turkish@lists.debian.org>\n"
@@ -269,6 +269,34 @@ msgstr ""
 msgid "You will need to generate a new host key."
 msgstr "Yeni bir makine anahtarı oluşturmanız gerekiyor."
 
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates.master:84
+msgid "Disable challenge-response authentication?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates.master:84
+msgid ""
+"Password authentication appears to be disabled in your current OpenSSH "
+"server configuration. In order to prevent users from logging in using "
+"passwords (perhaps using only public key authentication instead) with recent "
+"versions of OpenSSH, you must disable challenge-response authentication, or "
+"else ensure that your PAM configuration does not allow Unix password file "
+"authentication."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates.master:84
+msgid ""
+"If you disable challenge-response authentication, then users will not be "
+"able to log in using passwords. If you leave it enabled (the default "
+"answer), then the 'PasswordAuthentication no' option will have no useful "
+"effect unless you also adjust your PAM configuration in /etc/pam.d/ssh."
+msgstr ""
+
 #~ msgid "ssh2 keys merged in configuration files"
 #~ msgstr "yapılandırma dosyalarındaki ssh2 anahtarları birleştirildi"
 
diff --git a/debian/po/zh_CN.po b/debian/po/zh_CN.po
index 263aada78..f32d77bcb 100644
--- a/debian/po/zh_CN.po
+++ b/debian/po/zh_CN.po
@@ -15,7 +15,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openssh 3.6.1p2-11\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2004-07-31 03:10+0100\n"
+"POT-Creation-Date: 2004-10-06 14:06+0100\n"
 "PO-Revision-Date: 2004-02-02 18:48+1300\n"
 "Last-Translator: Hiei Xu <nicky@mail.edu.cn>\n"
 "Language-Team: Chinese/Simplified <i18n-translation@lists.linux.net.cn>\n"
@@ -256,6 +256,34 @@ msgstr ""
 msgid "You will need to generate a new host key."
 msgstr "您需要创建一个新的主机密钥。"
 
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates.master:84
+msgid "Disable challenge-response authentication?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates.master:84
+msgid ""
+"Password authentication appears to be disabled in your current OpenSSH "
+"server configuration. In order to prevent users from logging in using "
+"passwords (perhaps using only public key authentication instead) with recent "
+"versions of OpenSSH, you must disable challenge-response authentication, or "
+"else ensure that your PAM configuration does not allow Unix password file "
+"authentication."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates.master:84
+msgid ""
+"If you disable challenge-response authentication, then users will not be "
+"able to log in using passwords. If you leave it enabled (the default "
+"answer), then the 'PasswordAuthentication no' option will have no useful "
+"effect unless you also adjust your PAM configuration in /etc/pam.d/ssh."
+msgstr ""
+
 #~ msgid "ssh2 keys merged in configuration files"
 #~ msgstr "ssh2 密钥被合并到配置文件"