* New upstream release (http://www.openssh.org/txt/release-5.9).

  - Introduce sandboxing of the pre-auth privsep child using an optional
    sshd_config(5) "UsePrivilegeSeparation=sandbox" mode that enables
    mandatory restrictions on the syscalls the privsep child can perform.
  - Add new SHA256-based HMAC transport integrity modes from
    http://www.ietf.org/id/draft-dbider-sha2-mac-for-ssh-02.txt.
  - The pre-authentication sshd(8) privilege separation slave process now
    logs via a socket shared with the master process, avoiding the need to
    maintain /dev/log inside the chroot (closes: #75043, #429243,
    #599240).
  - ssh(1) now warns when a server refuses X11 forwarding (closes:
    #504757).
  - sshd_config(5)'s AuthorizedKeysFile now accepts multiple paths,
    separated by whitespace (closes: #76312).  The authorized_keys2
    fallback is deprecated but documented (closes: #560156).
  - ssh(1) and sshd(8): set IPv6 traffic class from IPQoS, as well as IPv4
    ToS/DSCP (closes: #498297).
  - ssh-add(1) now accepts keys piped from standard input.  E.g. "ssh-add
    - < /path/to/key" (closes: #229124).
  - Clean up lost-passphrase text in ssh-keygen(1) (closes: #444691).
  - Say "required" rather than "recommended" in unprotected-private-key
    warning (LP: #663455).

1 files changed, 8 insertions, 8 deletions

diff --git a/debian/patches/debian-banner.patch b/debian/patches/debian-banner.patch
index 32251397d..57ca35e87 100644
--- a/debian/patches/debian-banner.patch
+++ b/debian/patches/debian-banner.patch
@@ -10,7 +10,7 @@ Index: b/servconf.c
 ===================================================================
 --- a/servconf.c
 +++ b/servconf.c
-@@ -143,6 +143,7 @@
+@@ -142,6 +142,7 @@
         options->authorized_principals_file = NULL;
         options->ip_qos_interactive = -1;
         options->ip_qos_bulk = -1;
@@ -18,7 +18,7 @@ Index: b/servconf.c
  }
  
  void
-@@ -293,6 +294,8 @@
+@@ -289,6 +290,8 @@
                 options->ip_qos_interactive = IPTOS_LOWDELAY;
         if (options->ip_qos_bulk == -1)
                 options->ip_qos_bulk = IPTOS_THROUGHPUT;
@@ -27,7 +27,7 @@ Index: b/servconf.c
  
         /* Turn privilege separation on by default */
         if (use_privsep == -1)
-@@ -342,6 +345,7 @@
+@@ -338,6 +341,7 @@
         sZeroKnowledgePasswordAuthentication, sHostCertificate,
         sRevokedKeys, sTrustedUserCAKeys, sAuthorizedPrincipalsFile,
         sKexAlgorithms, sIPQoS,
@@ -35,7 +35,7 @@ Index: b/servconf.c
         sDeprecated, sUnsupported
  } ServerOpCodes;
  
-@@ -477,6 +481,7 @@
+@@ -473,6 +477,7 @@
         { "authorizedprincipalsfile", sAuthorizedPrincipalsFile, SSHCFG_ALL },
         { "kexalgorithms", sKexAlgorithms, SSHCFG_GLOBAL },
         { "ipqos", sIPQoS, SSHCFG_ALL },
@@ -43,7 +43,7 @@ Index: b/servconf.c
         { NULL, sBadOption, 0 }
  };
  
-@@ -1439,6 +1444,10 @@
+@@ -1436,6 +1441,10 @@
                 }
                 break;
  
@@ -58,7 +58,7 @@ Index: b/servconf.h
 ===================================================================
 --- a/servconf.h
 +++ b/servconf.h
-@@ -160,6 +160,8 @@
+@@ -166,6 +166,8 @@
  
         int     num_permitted_opens;
  
@@ -71,7 +71,7 @@ Index: b/sshd.c
 ===================================================================
 --- a/sshd.c
 +++ b/sshd.c
-@@ -422,7 +422,8 @@
+@@ -423,7 +423,8 @@
                 minor = PROTOCOL_MINOR_1;
         }
         snprintf(buf, sizeof buf, "SSH-%d.%d-%.100s%s", major, minor,
@@ -85,7 +85,7 @@ Index: b/sshd_config.5
 ===================================================================
 --- a/sshd_config.5
 +++ b/sshd_config.5
-@@ -339,6 +339,11 @@
+@@ -340,6 +340,11 @@
  .Dq no .
  The default is
  .Dq delayed .