Start handling /etc/ssh/sshd_config using ucf.

* Start handling /etc/ssh/sshd_config using ucf.  The immediate motivation
  for this is to deal with deprecations of options related to protocol 1,
  but something like this has been needed for a long time (closes:
  #419574, #848089):
  - sshd_config is now a slightly-patched version of upstream's, and only
    contains non-default settings (closes: #147201).
  - I've included as many historical md5sums of default versions of
    sshd_config as I could reconstruct from version control, but I'm sure
    I've missed some.
  - Explicitly synchronise the debconf database with the current
    configuration file state in openssh-server.config, to ensure that the
    PermitRootLogin setting is properly preserved.
  - UsePrivilegeSeparation now defaults to the stronger "sandbox" rather
    than "yes", per upstream.

1 files changed, 6 insertions, 0 deletions

diff --git a/debian/NEWS b/debian/NEWS
index 3a331e1fd..590aa664b 100644
--- a/debian/NEWS
+++ b/debian/NEWS
@@ -27,6 +27,12 @@ openssh (1:7.4p1-1) UNRELEASED; urgency=medium
    * sshd(8): Remove the UseLogin configuration directive and support for
      having /bin/login manage login sessions.
 
+  The unprivileged sshd process that deals with pre-authentication network
+  traffic is now subject to additional sandboxing restrictions by default:
+  that is, the default sshd_config now sets UsePrivilegeSeparation to
+  "sandbox" rather than "yes".  This has been the case upstream for a while,
+  but until now the Debian configuration diverged unnecessarily.
+
  -- Colin Watson <cjwatson@debian.org>  Tue, 20 Dec 2016 22:21:15 +0000
 
 openssh (1:7.2p1-1) unstable; urgency=medium