* New upstream release (closes: #395507, #397961, #420035). Important

  changes not previously backported to 4.3p2:
  - 4.4/4.4p1 (http://www.openssh.org/txt/release-4.4):
    + On portable OpenSSH, fix a GSSAPI authentication abort that could be
      used to determine the validity of usernames on some platforms.
    + Implemented conditional configuration in sshd_config(5) using the
      "Match" directive. This allows some configuration options to be
      selectively overridden if specific criteria (based on user, group,
      hostname and/or address) are met. So far a useful subset of
      post-authentication options are supported and more are expected to
      be added in future releases.
    + Add support for Diffie-Hellman group exchange key agreement with a
      final hash of SHA256.
    + Added a "ForceCommand" directive to sshd_config(5). Similar to the
      command="..." option accepted in ~/.ssh/authorized_keys, this forces
      the execution of the specified command regardless of what the user
      requested. This is very useful in conjunction with the new "Match"
      option.
    + Add a "PermitOpen" directive to sshd_config(5). This mirrors the
      permitopen="..." authorized_keys option, allowing fine-grained
      control over the port-forwardings that a user is allowed to
      establish.
    + Add optional logging of transactions to sftp-server(8).
    + ssh(1) will now record port numbers for hosts stored in
      ~/.ssh/known_hosts when a non-standard port has been requested
      (closes: #50612).
    + Add an "ExitOnForwardFailure" option to cause ssh(1) to exit (with a
      non-zero exit code) when requested port forwardings could not be
      established.
    + Extend sshd_config(5) "SubSystem" declarations to allow the
      specification of command-line arguments.
    + Replacement of all integer overflow susceptible invocations of
      malloc(3) and realloc(3) with overflow-checking equivalents.
    + Many manpage fixes and improvements.
    + Add optional support for OpenSSL hardware accelerators (engines),
      enabled using the --with-ssl-engine configure option.
    + Tokens in configuration files may be double-quoted in order to
      contain spaces (closes: #319639).
    + Move a debug() call out of a SIGCHLD handler, fixing a hang when the
      session exits very quickly (closes: #307890).
    + Fix some incorrect buffer allocation calculations (closes: #410599).
    + ssh-add doesn't ask for a passphrase if key file permissions are too
      liberal (closes: #103677).
    + Likewise, ssh doesn't ask either (closes: #99675).
  - 4.6/4.6p1 (http://www.openssh.org/txt/release-4.6):
    + sshd now allows the enabling and disabling of authentication methods
      on a per user, group, host and network basis via the Match directive
      in sshd_config.
    + Fixed an inconsistent check for a terminal when displaying scp
      progress meter (closes: #257524).
    + Fix "hang on exit" when background processes are running at the time
      of exit on a ttyful/login session (closes: #88337).
* Update to current GSSAPI patch from
  http://www.sxw.org.uk/computing/patches/openssh-4.6p1-gsskex-20070312.patch;
  install ChangeLog.gssapi.

1 files changed, 71 insertions, 32 deletions

diff --git a/ssh.0 b/ssh.0
index 83c4b94eb..c31e17eaf 100644
--- a/ssh.0
+++ b/ssh.0
@@ -9,7 +9,7 @@ SYNOPSIS
          [-i identity_file] [-L [bind_address:]port:host:hostport]
          [-l login_name] [-m mac_spec] [-O ctl_cmd] [-o option] [-p port]
          [-R [bind_address:]port:host:hostport] [-S ctl_path]
-         [-w tunnel:tunnel] [user@]hostname [command]
+         [-w local_tun[:remote_tun]] [user@]hostname [command]
 
 DESCRIPTION
      ssh (SSH client) is a program for logging into a remote machine and for
@@ -225,6 +225,7 @@ DESCRIPTION
                    ControlPath
                    DynamicForward
                    EscapeChar
+                   ExitOnForwardFailure
                    ForwardAgent
                    ForwardX11
                    ForwardX11Trusted
@@ -315,7 +316,7 @@ DESCRIPTION
 
      -t      Force pseudo-tty allocation.  This can be used to execute arbi-
              trary screen-based programs on a remote machine, which can be
-             very useful, e.g., when implementing menu services.  Multiple -t
+             very useful, e.g. when implementing menu services.  Multiple -t
              options force tty allocation, even if ssh has no local tty.
 
      -V      Display the version number and exit.
@@ -325,11 +326,16 @@ DESCRIPTION
              tion, and configuration problems.  Multiple -v options increase
              the verbosity.  The maximum is 3.
 
-     -w tunnel:tunnel
-             Requests a tun(4) device on the client (first tunnel arg) and
-             server (second tunnel arg).  The devices may be specified by nu-
-             merical ID or the keyword ``any'', which uses the next available
-             tunnel device.  See also the Tunnel directive in ssh_config(5).
+     -w local_tun[:remote_tun]
+             Requests tunnel device forwarding with the specified tun(4) de-
+             vices between the client (local_tun) and the server (remote_tun).
+
+             The devices may be specified by numerical ID or the keyword
+             ``any'', which uses the next available tunnel device.  If
+             remote_tun is not specified, it defaults to ``any''.  See also
+             the Tunnel and TunnelDevice directives in ssh_config(5).  If the
+             Tunnel directive is unset, it is set to the default tunnel mode,
+             which is ``point-to-point''.
 
      -X      Enables X11 forwarding.  This can also be specified on a per-host
              basis in a configuration file.
@@ -368,11 +374,11 @@ AUTHENTICATION
      integrity (hmac-md5, hmac-sha1, hmac-ripemd160).  Protocol 1 lacks a
      strong mechanism for ensuring the integrity of the connection.
 
-     The methods available for authentication are: host-based authentication,
-     public key authentication, challenge-response authentication, and pass-
-     word authentication.  Authentication methods are tried in the order spec-
-     ified above, though protocol 2 has a configuration option to change the
-     default order: PreferredAuthentications.
+     The methods available for authentication are: GSSAPI-based authentica-
+     tion, host-based authentication, public key authentication, challenge-re-
+     sponse authentication, and password authentication.  Authentication meth-
+     ods are tried in the order specified above, though protocol 2 has a con-
+     figuration option to change the default order: PreferredAuthentications.
 
      Host-based authentication works as follows: If the machine the user logs
      in from is listed in /etc/hosts.equiv or /etc/shosts.equiv on the remote
@@ -487,8 +493,8 @@ ESCAPE CHARACTERS
      ~C      Open command line.  Currently this allows the addition of port
              forwardings using the -L and -R options (see above).  It also al-
              lows the cancellation of existing remote port-forwardings using
-             -KR hostport.  !command allows the user to execute a local com-
-             mand if the PermitLocalCommand option is enabled in
+             -KR[bind_address:]port.  !command allows the user to execute a
+             local command if the PermitLocalCommand option is enabled in
              ssh_config(5).  Basic help is available, using the -h option.
 
      ~R      Request rekeying of the connection (only useful for SSH protocol
@@ -573,8 +579,7 @@ VERIFYING HOST KEYS
      ``host.example.com''.  The SSHFP resource records should first be added
      to the zonefile for host.example.com:
 
-           $ ssh-keygen -f /etc/ssh/ssh_host_rsa_key.pub -r host.example.com.
-           $ ssh-keygen -f /etc/ssh/ssh_host_dsa_key.pub -r host.example.com.
+           $ ssh-keygen -r host.example.com.
 
      The output lines will have to be added to the zonefile.  To check that
      the zone is answering fingerprint queries:
@@ -598,24 +603,34 @@ SSH-BASED VIRTUAL PRIVATE NETWORKS
      fic).
 
      The following example would connect client network 10.0.50.0/24 with re-
-     mote network 10.0.99.0/24, provided that the SSH server running on the
-     gateway to the remote network, at 192.168.1.15, allows it:
+     mote network 10.0.99.0/24 using a point-to-point connection from 10.1.1.1
+     to 10.1.1.2, provided that the SSH server running on the gateway to the
+     remote network, at 192.168.1.15, allows it.
+
+     On the client:
 
            # ssh -f -w 0:1 192.168.1.15 true
-           # ifconfig tun0 10.0.50.1 10.0.99.1 netmask 255.255.255.252
+           # ifconfig tun0 10.1.1.1 10.1.1.2 netmask 255.255.255.252
+           # route add 10.0.99.0/24 10.1.1.2
+
+     On the server:
+
+           # ifconfig tun1 10.1.1.2 10.1.1.1 netmask 255.255.255.252
+           # route add 10.0.50.0/24 10.1.1.1
 
      Client access may be more finely tuned via the /root/.ssh/authorized_keys
      file (see below) and the PermitRootLogin server option.  The following
-     entry would permit connections on the first tun(4) device from user
-     ``jane'' and on the second device from user ``john'', if PermitRootLogin
-     is set to ``forced-commands-only'':
+     entry would permit connections on tun(4) device 1 from user ``jane'' and
+     on tun device 2 from user ``john'', if PermitRootLogin is set to
+     ``forced-commands-only'':
 
        tunnel="1",command="sh /etc/netstart tun1" ssh-rsa ... jane
-       tunnel="2",command="sh /etc/netstart tun1" ssh-rsa ... john
+       tunnel="2",command="sh /etc/netstart tun2" ssh-rsa ... john
 
-     Since a SSH-based setup entails a fair amount of overhead, it may be more
-     suited to temporary setups, such as for wireless VPNs.  More permanent
-     VPNs are better provided by tools such as ipsecctl(8) and isakmpd(8).
+     Since an SSH-based setup entails a fair amount of overhead, it may be
+     more suited to temporary setups, such as for wireless VPNs.  More perma-
+     nent VPNs are better provided by tools such as ipsecctl(8) and
+     isakmpd(8).
 
 ENVIRONMENT
      ssh will normally set the following environment variables:
@@ -671,8 +686,8 @@ ENVIRONMENT
 
      TZ                    This variable is set to indicate the present time
                            zone if it was set when the daemon was started
-                           (i.e., the daemon passes the value on to new con-
-                           nections).
+                           (i.e. the daemon passes the value on to new connec-
+                           tions).
 
      USER                  Set to the name of the user logging in.
 
@@ -779,9 +794,33 @@ SEE ALSO
      scp(1), sftp(1), ssh-add(1), ssh-agent(1), ssh-keygen(1), ssh-keyscan(1),
      tun(4), hosts.equiv(5), ssh_config(5), ssh-keysign(8), sshd(8)
 
-     T. Ylonen, T. Kivinen, M. Saarinen, T. Rinne, and S. Lehtinen, SSH
-     Protocol Architecture, draft-ietf-secsh-architecture-12.txt, January
-     2002, work in progress material.
+     The Secure Shell (SSH) Protocol Assigned Numbers, RFC 4250, 2006.
+
+     The Secure Shell (SSH) Protocol Architecture, RFC 4251, 2006.
+
+     The Secure Shell (SSH) Authentication Protocol, RFC 4252, 2006.
+
+     The Secure Shell (SSH) Transport Layer Protocol, RFC 4253, 2006.
+
+     The Secure Shell (SSH) Connection Protocol, RFC 4254, 2006.
+
+     Using DNS to Securely Publish Secure Shell (SSH) Key Fingerprints, RFC
+     4255, 2006.
+
+     Generic Message Exchange Authentication for the Secure Shell Protocol
+     (SSH), RFC 4256, 2006.
+
+     The Secure Shell (SSH) Session Channel Break Extension, RFC 4335, 2006.
+
+     The Secure Shell (SSH) Transport Layer Encryption Modes, RFC 4344, 2006.
+
+     Improved Arcfour Modes for the Secure Shell (SSH) Transport Layer
+     Protocol, RFC 4345, 2006.
+
+     Diffie-Hellman Group Exchange for the Secure Shell (SSH) Transport Layer
+     Protocol, RFC 4419, 2006.
+
+     The Secure Shell (SSH) Public Key File Format, RFC 4716, 2006.
 
 AUTHORS
      OpenSSH is a derivative of the original and free ssh 1.2.12 release by
@@ -790,4 +829,4 @@ AUTHORS
      created OpenSSH.  Markus Friedl contributed the support for SSH protocol
      versions 1.5 and 2.0.
 
-OpenBSD 3.9                   September 25, 1999                            12
+OpenBSD 4.1                   September 25, 1999                            13