diff options
author | Colin Watson <cjwatson@debian.org> | 2016-12-24 19:26:39 +0000 |
---|---|---|
committer | Colin Watson <cjwatson@debian.org> | 2016-12-26 00:30:30 +0000 |
commit | de911c73504da8dd7d9bbaddcf0c0845dd6eb9a0 (patch) | |
tree | c1be675cab068c60f7461a67b396961227c9ae6d /debian/NEWS | |
parent | 9477f029ee259b25daff503e02e6b011aea82ce3 (diff) | |
parent | af54c22db774b37a15df5e599d08a83d4bbe5079 (diff) |
Start handling /etc/ssh/sshd_config using ucf.
* Start handling /etc/ssh/sshd_config using ucf. The immediate motivation
for this is to deal with deprecations of options related to protocol 1,
but something like this has been needed for a long time (closes:
#419574, #848089):
- sshd_config is now a slightly-patched version of upstream's, and only
contains non-default settings (closes: #147201).
- I've included as many historical md5sums of default versions of
sshd_config as I could reconstruct from version control, but I'm sure
I've missed some.
- Explicitly synchronise the debconf database with the current
configuration file state in openssh-server.config, to ensure that the
PermitRootLogin setting is properly preserved.
- UsePrivilegeSeparation now defaults to the stronger "sandbox" rather
than "yes", per upstream.
Diffstat (limited to 'debian/NEWS')
-rw-r--r-- | debian/NEWS | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/debian/NEWS b/debian/NEWS index 3a331e1fd..590aa664b 100644 --- a/debian/NEWS +++ b/debian/NEWS | |||
@@ -27,6 +27,12 @@ openssh (1:7.4p1-1) UNRELEASED; urgency=medium | |||
27 | * sshd(8): Remove the UseLogin configuration directive and support for | 27 | * sshd(8): Remove the UseLogin configuration directive and support for |
28 | having /bin/login manage login sessions. | 28 | having /bin/login manage login sessions. |
29 | 29 | ||
30 | The unprivileged sshd process that deals with pre-authentication network | ||
31 | traffic is now subject to additional sandboxing restrictions by default: | ||
32 | that is, the default sshd_config now sets UsePrivilegeSeparation to | ||
33 | "sandbox" rather than "yes". This has been the case upstream for a while, | ||
34 | but until now the Debian configuration diverged unnecessarily. | ||
35 | |||
30 | -- Colin Watson <cjwatson@debian.org> Tue, 20 Dec 2016 22:21:15 +0000 | 36 | -- Colin Watson <cjwatson@debian.org> Tue, 20 Dec 2016 22:21:15 +0000 |
31 | 37 | ||
32 | openssh (1:7.2p1-1) unstable; urgency=medium | 38 | openssh (1:7.2p1-1) unstable; urgency=medium |