* New upstream release (LP: #535029).

  - After a transition period of about 10 years, this release disables SSH
    protocol 1 by default.  Clients and servers that need to use the
    legacy protocol must explicitly enable it in ssh_config / sshd_config
    or on the command-line.
  - Remove the libsectok/OpenSC-based smartcard code and add support for
    PKCS#11 tokens.  This support is enabled by default in the Debian
    packaging, since it now doesn't involve additional library
    dependencies (closes: #231472, LP: #16918).
  - Add support for certificate authentication of users and hosts using a
    new, minimal OpenSSH certificate format (closes: #482806).
  - Added a 'netcat mode' to ssh(1): "ssh -W host:port ...".
  - Add the ability to revoke keys in sshd(8) and ssh(1).  (For the Debian
    package, this overlaps with the key blacklisting facility added in
    openssh 1:4.7p1-9, but with different file formats and slightly
    different scopes; for the moment, I've roughly merged the two.)
  - Various multiplexing improvements, including support for requesting
    port-forwardings via the multiplex protocol (closes: #360151).
  - Allow setting an explicit umask on the sftp-server(8) commandline to
    override whatever default the user has (closes: #496843).
  - Many sftp client improvements, including tab-completion, more options,
    and recursive transfer support for get/put (LP: #33378).  The old
    mget/mput commands never worked properly and have been removed
    (closes: #270399, #428082).
  - Do not prompt for a passphrase if we fail to open a keyfile, and log
    the reason why the open failed to debug (closes: #431538).
  - Prevent sftp from crashing when given a "-" without a command.  Also,
    allow whitespace to follow a "-" (closes: #531561).

1 files changed, 20 insertions, 14 deletions

diff --git a/ssh_config.0 b/ssh_config.0
index 756fc6dbb..48969a22a 100644
--- a/ssh_config.0
+++ b/ssh_config.0
@@ -316,7 +316,9 @@ DESCRIPTION
              identity is read.  The default is ~/.ssh/identity for protocol
              version 1, and ~/.ssh/id_rsa and ~/.ssh/id_dsa for protocol ver-
              sion 2.  Additionally, any identities represented by the authen-
-             tication agent will be used for authentication.
+             tication agent will be used for authentication.  ssh(1) will try
+             to load certificate information from the filename obtained by ap-
+             pending -cert.pub to the path of a specified IdentityFile.
 
              The file name may use the tilde syntax to refer to a user's home
              directory or one of the following escape characters: `%d' (local
@@ -347,8 +349,14 @@ DESCRIPTION
              `%d' (local user's home directory), `%h' (remote host name), `%l'
              (local host name), `%n' (host name as provided on the command
              line), `%p' (remote port), `%r' (remote user name) or `%u' (local
-             user name).  This directive is ignored unless PermitLocalCommand
-             has been enabled.
+             user name).
+
+             The command is run synchronously and does not have access to the
+             session of the ssh(1) that spawned it.  It should not be used for
+             interactive commands.
+
+             This directive is ignored unless PermitLocalCommand has been en-
+             abled.
 
      LocalForward
              Specifies that a TCP port on the local machine be forwarded over
@@ -405,6 +413,11 @@ DESCRIPTION
              ing the !command escape sequence in ssh(1).  The argument must be
              ``yes'' or ``no''.  The default is ``no''.
 
+     PKCS11Provider
+             Specifies which PKCS#11 provider to use.  The argument to this
+             keyword is the PKCS#11 shared libary ssh(1) should use to commu-
+             nicate with a PKCS#11 token providing the user's private RSA key.
+
      Port    Specifies the port number to connect on the remote host.  The de-
              fault is 22.
 
@@ -418,9 +431,9 @@ DESCRIPTION
      Protocol
              Specifies the protocol versions ssh(1) should support in order of
              preference.  The possible values are `1' and `2'.  Multiple ver-
-             sions must be comma-separated.  The default is ``2,1''.  This
-             means that ssh tries version 2 and falls back to version 1 if
-             version 2 is not available.
+             sions must be comma-separated.  When this option is set to
+             ``2,1'' ssh will try version 2 and fall back to version 1 if ver-
+             sion 2 is not available.  The default is `2'.
 
      ProxyCommand
              Specifies the command to use to connect to the server.  The com-
@@ -527,13 +540,6 @@ DESCRIPTION
              default is 0, indicating that these messages will not be sent to
              the server.  This option applies to protocol version 2 only.
 
-     SmartcardDevice
-             Specifies which smartcard device to use.  The argument to this
-             keyword is the device ssh(1) should use to communicate with a
-             smartcard used for storing the user's private RSA key.  By de-
-             fault, no device is specified and smartcard support is not acti-
-             vated.
-
      StrictHostKeyChecking
              If this flag is set to ``yes'', ssh(1) will never automatically
              add host keys to the ~/.ssh/known_hosts file, and refuses to con-
@@ -667,4 +673,4 @@ AUTHORS
      ated OpenSSH.  Markus Friedl contributed the support for SSH protocol
      versions 1.5 and 2.0.
 
-OpenBSD 4.6                    February 22, 2009                            11
+OpenBSD 4.6                      March 5, 2010                              11