* New upstream release (closes: #395507, #397961, #420035). Important

  changes not previously backported to 4.3p2:
  - 4.4/4.4p1 (http://www.openssh.org/txt/release-4.4):
    + On portable OpenSSH, fix a GSSAPI authentication abort that could be
      used to determine the validity of usernames on some platforms.
    + Implemented conditional configuration in sshd_config(5) using the
      "Match" directive. This allows some configuration options to be
      selectively overridden if specific criteria (based on user, group,
      hostname and/or address) are met. So far a useful subset of
      post-authentication options are supported and more are expected to
      be added in future releases.
    + Add support for Diffie-Hellman group exchange key agreement with a
      final hash of SHA256.
    + Added a "ForceCommand" directive to sshd_config(5). Similar to the
      command="..." option accepted in ~/.ssh/authorized_keys, this forces
      the execution of the specified command regardless of what the user
      requested. This is very useful in conjunction with the new "Match"
      option.
    + Add a "PermitOpen" directive to sshd_config(5). This mirrors the
      permitopen="..." authorized_keys option, allowing fine-grained
      control over the port-forwardings that a user is allowed to
      establish.
    + Add optional logging of transactions to sftp-server(8).
    + ssh(1) will now record port numbers for hosts stored in
      ~/.ssh/known_hosts when a non-standard port has been requested
      (closes: #50612).
    + Add an "ExitOnForwardFailure" option to cause ssh(1) to exit (with a
      non-zero exit code) when requested port forwardings could not be
      established.
    + Extend sshd_config(5) "SubSystem" declarations to allow the
      specification of command-line arguments.
    + Replacement of all integer overflow susceptible invocations of
      malloc(3) and realloc(3) with overflow-checking equivalents.
    + Many manpage fixes and improvements.
    + Add optional support for OpenSSL hardware accelerators (engines),
      enabled using the --with-ssl-engine configure option.
    + Tokens in configuration files may be double-quoted in order to
      contain spaces (closes: #319639).
    + Move a debug() call out of a SIGCHLD handler, fixing a hang when the
      session exits very quickly (closes: #307890).
    + Fix some incorrect buffer allocation calculations (closes: #410599).
    + ssh-add doesn't ask for a passphrase if key file permissions are too
      liberal (closes: #103677).
    + Likewise, ssh doesn't ask either (closes: #99675).
  - 4.6/4.6p1 (http://www.openssh.org/txt/release-4.6):
    + sshd now allows the enabling and disabling of authentication methods
      on a per user, group, host and network basis via the Match directive
      in sshd_config.
    + Fixed an inconsistent check for a terminal when displaying scp
      progress meter (closes: #257524).
    + Fix "hang on exit" when background processes are running at the time
      of exit on a ttyful/login session (closes: #88337).
* Update to current GSSAPI patch from
  http://www.sxw.org.uk/computing/patches/openssh-4.6p1-gsskex-20070312.patch;
  install ChangeLog.gssapi.

7 files changed, 78 insertions, 50 deletions

diff --git a/contrib/aix/buildbff.sh b/contrib/aix/buildbff.sh
index 09b9c118c..97a7cbbba 100755
--- a/contrib/aix/buildbff.sh
+++ b/contrib/aix/buildbff.sh
@@ -1,7 +1,7 @@
 #!/bin/sh
 #
 # buildbff.sh: Create AIX SMIT-installable OpenSSH packages
-# $Id: buildbff.sh,v 1.8 2005/03/29 13:24:12 dtucker Exp $
+# $Id: buildbff.sh,v 1.10 2006/09/10 03:24:19 dtucker Exp $
 #
 # Author: Darren Tucker (dtucker at zip dot com dot au)
 # This file is placed in the public domain and comes with absolutely
@@ -23,6 +23,8 @@ umask 022
 
 startdir=`pwd`
 
+perl -v >/dev/null || (echo perl required; exit 1)
+
 # Path to inventory.sh: same place as buildbff.sh
 if  echo $0 | egrep '^/'
 then
@@ -200,33 +202,29 @@ do
 done
 echo
 
-# Create PrivSep user if PrivSep not disabled in config
-echo Creating PrivSep prereqs if required.
-if egrep '^[ \t]*UsePrivilegeSeparation[ \t]+no' $sysconfdir/sshd_config >/dev/null
+# Create PrivilegeSeparation user and group if not present
+echo Checking for PrivilegeSeparation user and group.
+if cut -f1 -d: /etc/group | egrep '^'$SSH_PRIVSEP_USER'\$' >/dev/null
 then
-        echo "UsePrivilegeSeparation disabled in config, not creating PrivSep user,"
-        echo "group or chroot directory."
+        echo "PrivSep group $SSH_PRIVSEP_USER already exists."
 else
-        echo "UsePrivilegeSeparation enabled in config (or defaulting to on)."
-
-        # create group if required
-        if cut -f1 -d: /etc/group | egrep '^'$SSH_PRIVSEP_USER'\$' >/dev/null
-        then
-                echo "PrivSep group $SSH_PRIVSEP_USER already exists."
-        else
-                echo "Creating PrivSep group $SSH_PRIVSEP_USER."
-                mkgroup -A $SSH_PRIVSEP_USER
-        fi
+        echo "Creating PrivSep group $SSH_PRIVSEP_USER."
+        mkgroup -A $SSH_PRIVSEP_USER
+fi
 
-        # Create user if required
-        if lsuser "$SSH_PRIVSEP_USER" >/dev/null
-        then
-                echo "PrivSep user $SSH_PRIVSEP_USER already exists."
-        else
-                echo "Creating PrivSep user $SSH_PRIVSEP_USER."
-                mkuser gecos='SSHD PrivSep User' login=false rlogin=false account_locked=true pgrp=$SSH_PRIVSEP_USER $SSH_PRIVSEP_USER
-        fi
+# Create user if required
+if lsuser "$SSH_PRIVSEP_USER" >/dev/null
+then
+        echo "PrivSep user $SSH_PRIVSEP_USER already exists."
+else
+        echo "Creating PrivSep user $SSH_PRIVSEP_USER."
+        mkuser gecos='SSHD PrivSep User' login=false rlogin=false account_locked=true pgrp=$SSH_PRIVSEP_USER $SSH_PRIVSEP_USER
+fi
 
+if egrep '^[ \t]*UsePrivilegeSeparation[ \t]+no' $sysconfdir/sshd_config >/dev/null
+then
+        echo UsePrivilegeSeparation not enabled, privsep directory not required.
+else
         # create chroot directory if required
         if [ -d $PRIVSEP_PATH ]
         then
diff --git a/contrib/caldera/openssh.spec b/contrib/caldera/openssh.spec
index 09c08f194..3d756eb7f 100644
--- a/contrib/caldera/openssh.spec
+++ b/contrib/caldera/openssh.spec
@@ -17,7 +17,7 @@
 #old cvs stuff.  please update before use.  may be deprecated.
 %define use_stable      1
 %if %{use_stable}
-  %define version       4.3p2
+  %define version       4.6p1
   %define cvs           %{nil}
   %define release       1
 %else
@@ -357,4 +357,4 @@ fi
 * Mon Jan 01 1998 ...
 Template Version: 1.31
 
-$Id: openssh.spec,v 1.56.2.1 2006/02/11 00:00:45 djm Exp $
+$Id: openssh.spec,v 1.60 2007/03/06 10:23:27 djm Exp $
diff --git a/contrib/cygwin/ssh-host-config b/contrib/cygwin/ssh-host-config
index 0540890e6..e2ad69f19 100644
--- a/contrib/cygwin/ssh-host-config
+++ b/contrib/cygwin/ssh-host-config
@@ -153,22 +153,31 @@ fi
 
 # Create /var/log and /var/log/lastlog if not already existing
 
-if [ -f ${LOCALSTATEDIR}/log ]
+if [ -e ${LOCALSTATEDIR}/log -a ! -d ${LOCALSTATEDIR}/log ]
 then
-  echo "Creating ${LOCALSTATEDIR}/log failed!"
-else
-  if [ ! -d ${LOCALSTATEDIR}/log ]
-  then
-    mkdir -p ${LOCALSTATEDIR}/log
-  fi
-  if [ -d ${LOCALSTATEDIR}/log/lastlog ]
-  then
-    chmod 777 ${LOCALSTATEDIR}/log/lastlog
-  elif [ ! -f ${LOCALSTATEDIR}/log/lastlog ]
-  then
-    cat /dev/null > ${LOCALSTATEDIR}/log/lastlog
-    chmod 666 ${LOCALSTATEDIR}/log/lastlog
-  fi
+  echo
+  echo "${LOCALSTATEDIR}/log is existant but not a directory."
+  echo "Cannot create ssh host configuration."
+  echo
+  exit 1
+fi
+if [ ! -e ${LOCALSTATEDIR}/log ]
+then
+  mkdir -p ${LOCALSTATEDIR}/log
+fi
+
+if [ -e ${LOCALSTATEDIR}/log/lastlog -a ! -f ${LOCALSTATEDIR}/log/lastlog ]
+then
+  echo 
+  echo "${LOCALSTATEDIR}/log/lastlog exists, but is not a file."
+  echo "Cannot create ssh host configuration."
+  echo 
+  exit 1
+fi
+if [ ! -e ${LOCALSTATEDIR}/log/lastlog ]
+then
+  cat /dev/null > ${LOCALSTATEDIR}/log/lastlog
+  chmod 644 ${LOCALSTATEDIR}/log/lastlog
 fi
 
 # Create /var/empty file used as chroot jail for privilege separation
@@ -507,6 +516,7 @@ then
             fi
             editrights -a SeAssignPrimaryTokenPrivilege -u sshd_server &&
             editrights -a SeCreateTokenPrivilege -u sshd_server &&
+            editrights -a SeTcbPrivilege -u sshd_server &&
             editrights -a SeDenyInteractiveLogonRight -u sshd_server &&
             editrights -a SeDenyNetworkLogonRight -u sshd_server &&
             editrights -a SeDenyRemoteInteractiveLogonRight -u sshd_server &&
@@ -578,6 +588,7 @@ then
       fi
       chown "${_user}" ${SYSCONFDIR}/ssh*
       chown "${_user}".544 ${LOCALSTATEDIR}/empty
+      chown "${_user}".544 ${LOCALSTATEDIR}/log/lastlog
       if [ -f ${LOCALSTATEDIR}/log/sshd.log ]
       then
         chown "${_user}".544 ${LOCALSTATEDIR}/log/sshd.log
diff --git a/contrib/findssl.sh b/contrib/findssl.sh
index 716abced5..263fd2644 100644
--- a/contrib/findssl.sh
+++ b/contrib/findssl.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# $Id: findssl.sh,v 1.3 2004/12/13 07:08:33 dtucker Exp $
+# $Id: findssl.sh,v 1.4 2007/02/19 11:44:25 dtucker Exp $
 #
 # findssl.sh
 #       Search for all instances of OpenSSL headers and libraries
@@ -89,6 +89,25 @@ LD_LIBRARY_PATH=${LD_LIBRARY_PATH:=$DEFAULT_LIBPATH}
 LIBRARY_PATH=${LIBRARY_PATH:=$DEFAULT_LIBPATH}
 export LIBPATH LD_LIBRARY_PATH LIBRARY_PATH
 
+# not all platforms have a 'which' command
+if which ls >/dev/null 2>/dev/null; then
+    : which is defined
+else
+    which () {
+        saveIFS="$IFS"
+        IFS=:
+        for p in $PATH; do
+            if test -x "$p/$1" -a -f "$p/$1"; then
+                IFS="$saveIFS"
+                echo "$p/$1"
+                return 0
+            fi
+        done
+        IFS="$saveIFS"
+        return 1
+    }
+fi
+
 #
 # Search for OpenSSL headers and print versions
 #
diff --git a/contrib/redhat/openssh.spec b/contrib/redhat/openssh.spec
index cbdf7bbc7..08515d2b0 100644
--- a/contrib/redhat/openssh.spec
+++ b/contrib/redhat/openssh.spec
@@ -1,4 +1,4 @@
-%define ver 4.3p2
+%define ver 4.6p1
 %define rel 1
 
 # OpenSSH privilege separation requires a user & group ID
diff --git a/contrib/redhat/sshd.init b/contrib/redhat/sshd.init
index ffa66cd52..e5d837cbc 100755
--- a/contrib/redhat/sshd.init
+++ b/contrib/redhat/sshd.init
@@ -35,8 +35,8 @@ do_rsa1_keygen() {
                 if $KEYGEN -q -t rsa1 -f $RSA1_KEY -C '' -N '' >&/dev/null; then
                         chmod 600 $RSA1_KEY
                         chmod 644 $RSA1_KEY.pub
-                        if type restorecon >/dev/null 2>&1; then
-                                restorecon $RSA1_KEY.pub
+                        if [ -x /sbin/restorecon ]; then
+                            /sbin/restorecon $RSA1_KEY.pub
                         fi
                         success $"RSA1 key generation"
                         echo
@@ -54,8 +54,8 @@ do_rsa_keygen() {
                 if $KEYGEN -q -t rsa -f $RSA_KEY -C '' -N '' >&/dev/null; then
                         chmod 600 $RSA_KEY
                         chmod 644 $RSA_KEY.pub
-                        if type restorecon >/dev/null 2>&1; then
-                                restorecon $RSA_KEY.pub
+                        if [ -x /sbin/restorecon ]; then
+                            /sbin/restorecon $RSA_KEY.pub
                         fi
                         success $"RSA key generation"
                         echo
@@ -73,8 +73,8 @@ do_dsa_keygen() {
                 if $KEYGEN -q -t dsa -f $DSA_KEY -C '' -N '' >&/dev/null; then
                         chmod 600 $DSA_KEY
                         chmod 644 $DSA_KEY.pub
-                        if type restorecon >/dev/null 2>&1; then
-                                restorecon $DSA_KEY.pub
+                        if [ -x /sbin/restorecon ]; then
+                            /sbin/restorecon $DSA_KEY.pub
                         fi
                         success $"DSA key generation"
                         echo
diff --git a/contrib/suse/openssh.spec b/contrib/suse/openssh.spec
index b49e78c65..95b394f18 100644
--- a/contrib/suse/openssh.spec
+++ b/contrib/suse/openssh.spec
@@ -13,7 +13,7 @@
 
 Summary:        OpenSSH, a free Secure Shell (SSH) protocol implementation
 Name:           openssh
-Version:        4.3p2
+Version:        4.6p1
 URL:            http://www.openssh.com/
 Release:        1
 Source0:        openssh-%{version}.tar.gz