Document the Debian-specific change to the default value of ForwardX11Trusted in ssh(1) (closes: #781469).

1 files changed, 41 insertions, 2 deletions

diff --git a/debian/patches/debian-config.patch b/debian/patches/debian-config.patch
index 4f5db8a91..c990a01c3 100644
--- a/debian/patches/debian-config.patch
+++ b/debian/patches/debian-config.patch
@@ -1,4 +1,4 @@
-From 810eecd6b2e03770f21e46b5cb8ce8c7fcd46da8 Mon Sep 17 00:00:00 2001
+From 88ebb6a4a95f2f9ded930587c33f08cff0fc1db4 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:18 +0000
 Subject: Various Debian-specific configuration changes
@@ -27,11 +27,12 @@ Last-Update: 2015-08-19
 Patch-Name: debian-config.patch
 ---
  readconf.c    |  2 +-
+ ssh.1         | 21 +++++++++++++++++++++
  ssh_config    |  7 ++++++-
  ssh_config.5  | 19 ++++++++++++++++++-
  sshd_config   |  3 ++-
  sshd_config.5 | 25 +++++++++++++++++++++++++
- 5 files changed, 52 insertions(+), 4 deletions(-)
+ 6 files changed, 73 insertions(+), 4 deletions(-)
 
 diff --git a/readconf.c b/readconf.c
 index 5f6c37f..f0769b5 100644
@@ -46,6 +47,44 @@ index 5f6c37f..f0769b5 100644
         if (options->forward_x11_timeout == -1)
                 options->forward_x11_timeout = 1200;
         if (options->exit_on_forward_failure == -1)
+diff --git a/ssh.1 b/ssh.1
+index 2178863..e2cce49 100644
+--- a/ssh.1
++++ b/ssh.1
+@@ -670,12 +670,33 @@ option and the
+ directive in
+ .Xr ssh_config 5
+ for more information.
++.Pp
++(Debian-specific: X11 forwarding is not subjected to X11 SECURITY extension
++restrictions by default, because too many programs currently crash in this
++mode.
++Set the
++.Cm ForwardX11Trusted
++option to
++.Dq no
++to restore the upstream behaviour.
++This may change in future depending on client-side improvements.)
+ .It Fl x
+ Disables X11 forwarding.
+ .It Fl Y
+ Enables trusted X11 forwarding.
+ Trusted X11 forwardings are not subjected to the X11 SECURITY extension
+ controls.
++.Pp
++(Debian-specific: This option does nothing in the default configuration: it
++is equivalent to
++.Dq Cm ForwardX11Trusted No yes ,
++which is the default as described above.
++Set the
++.Cm ForwardX11Trusted
++option to
++.Dq no
++to restore the upstream behaviour.
++This may change in future depending on client-side improvements.)
+ .It Fl y
+ Send log information using the
+ .Xr syslog 3
 diff --git a/ssh_config b/ssh_config
 index 228e5ab..c9386aa 100644
 --- a/ssh_config