summaryrefslogtreecommitdiff
path: root/sshd.8
diff options
context:
space:
mode:
authorColin Watson <cjwatson@debian.org>2014-10-07 13:22:41 +0100
committerColin Watson <cjwatson@debian.org>2016-01-04 15:07:00 +0000
commitc538473bc1958b99bb26283752f287df5934045a (patch)
tree2a874070b15d57372b83509e95767d48b8dad4a1 /sshd.8
parent48424483cbf2232ba849038e02675b2db1ea3a88 (diff)
Restore TCP wrappers support
Support for TCP wrappers was dropped in OpenSSH 6.7. See this message and thread: https://lists.mindrot.org/pipermail/openssh-unix-dev/2014-April/032497.html It is true that this reduces preauth attack surface in sshd. On the other hand, this support seems to be quite widely used, and abruptly dropping it (from the perspective of users who don't read openssh-unix-dev) could easily cause more serious problems in practice. It's not entirely clear what the right long-term answer for Debian is, but it at least probably doesn't involve dropping this feature shortly before a freeze. Forwarded: not-needed Last-Update: 2014-10-07 Patch-Name: restore-tcp-wrappers.patch
Diffstat (limited to 'sshd.8')
-rw-r--r--sshd.87
1 files changed, 7 insertions, 0 deletions
diff --git a/sshd.8 b/sshd.8
index 213b5fc43..2105979a9 100644
--- a/sshd.8
+++ b/sshd.8
@@ -850,6 +850,12 @@ the user's home directory becomes accessible.
850This file should be writable only by the user, and need not be 850This file should be writable only by the user, and need not be
851readable by anyone else. 851readable by anyone else.
852.Pp 852.Pp
853.It Pa /etc/hosts.allow
854.It Pa /etc/hosts.deny
855Access controls that should be enforced by tcp-wrappers are defined here.
856Further details are described in
857.Xr hosts_access 5 .
858.Pp
853.It Pa /etc/hosts.equiv 859.It Pa /etc/hosts.equiv
854This file is for host-based authentication (see 860This file is for host-based authentication (see
855.Xr ssh 1 ) . 861.Xr ssh 1 ) .
@@ -953,6 +959,7 @@ The content of this file is not sensitive; it can be world-readable.
953.Xr ssh-keygen 1 , 959.Xr ssh-keygen 1 ,
954.Xr ssh-keyscan 1 , 960.Xr ssh-keyscan 1 ,
955.Xr chroot 2 , 961.Xr chroot 2 ,
962.Xr hosts_access 5 ,
956.Xr login.conf 5 , 963.Xr login.conf 5 ,
957.Xr moduli 5 , 964.Xr moduli 5 ,
958.Xr sshd_config 5 , 965.Xr sshd_config 5 ,