Import openssh_7.7p1.orig.tar.gz

1 files changed, 50 insertions, 26 deletions

diff --git a/sshd_config.0 b/sshd_config.0
index 678ee14b4..95c17fc8d 100644
--- a/sshd_config.0
+++ b/sshd_config.0
@@ -6,9 +6,10 @@ NAME
 DESCRIPTION
      sshd(8) reads configuration data from /etc/ssh/sshd_config (or the file
      specified with -f on the command line).  The file contains keyword-
-     argument pairs, one per line.  Lines starting with M-bM-^@M-^X#M-bM-^@M-^Y and empty lines
-     are interpreted as comments.  Arguments may optionally be enclosed in
-     double quotes (") in order to represent arguments containing spaces.
+     argument pairs, one per line.  For each keyword, the first obtained value
+     will be used.  Lines starting with M-bM-^@M-^X#M-bM-^@M-^Y and empty lines are interpreted as
+     comments.  Arguments may optionally be enclosed in double quotes (") in
+     order to represent arguments containing spaces.
 
      The possible keywords and their meanings are as follows (note that
      keywords are case-insensitive and arguments are case-sensitive):
@@ -422,9 +423,8 @@ DESCRIPTION
 
      HostKey
              Specifies a file containing a private host key used by SSH.  The
-             defaults are /etc/ssh/ssh_host_dsa_key,
-             /etc/ssh/ssh_host_ecdsa_key, /etc/ssh/ssh_host_ed25519_key and
-             /etc/ssh/ssh_host_rsa_key.
+             defaults are /etc/ssh/ssh_host_ecdsa_key,
+             /etc/ssh/ssh_host_ed25519_key and /etc/ssh/ssh_host_rsa_key.
 
              Note that sshd(8) will refuse to use a file if it is group/world-
              accessible and that the HostKeyAlgorithms option restricts which
@@ -465,8 +465,9 @@ DESCRIPTION
 
      IgnoreUserKnownHosts
              Specifies whether sshd(8) should ignore the user's
-             ~/.ssh/known_hosts during HostbasedAuthentication.  The default
-             is no.
+             ~/.ssh/known_hosts during HostbasedAuthentication and use only
+             the system-wide known hosts file /etc/ssh/known_hosts.  The
+             default is no.
 
      IPQoS   Specifies the IPv4 type-of-service or DSCP class for the
              connection.  Accepted values are af11, af12, af13, af21, af22,
@@ -521,6 +522,9 @@ DESCRIPTION
                    curve25519-sha256@libssh.org
                    diffie-hellman-group1-sha1
                    diffie-hellman-group14-sha1
+                   diffie-hellman-group14-sha256
+                   diffie-hellman-group16-sha512
+                   diffie-hellman-group18-sha512
                    diffie-hellman-group-exchange-sha1
                    diffie-hellman-group-exchange-sha256
                    ecdh-sha2-nistp256
@@ -532,7 +536,8 @@ DESCRIPTION
                    curve25519-sha256,curve25519-sha256@libssh.org,
                    ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,
                    diffie-hellman-group-exchange-sha256,
-                   diffie-hellman-group14-sha1
+                   diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,
+                   diffie-hellman-group14-sha256,diffie-hellman-group14-sha1
 
              The list of available key exchange algorithms may also be
              obtained using "ssh -Q kex".
@@ -541,13 +546,18 @@ DESCRIPTION
              Specifies the local addresses sshd(8) should listen on.  The
              following forms may be used:
 
-                   ListenAddress host|IPv4_addr|IPv6_addr
-                   ListenAddress host|IPv4_addr:port
-                   ListenAddress [host|IPv6_addr]:port
+                   ListenAddress hostname|address [rdomain domain]
+                   ListenAddress hostname:port [rdomain domain]
+                   ListenAddress IPv4_address:port [rdomain domain]
+                   ListenAddress [hostname|address]:port [rdomain domain]
 
-             If port is not specified, sshd will listen on the address and all
-             Port options specified.  The default is to listen on all local
-             addresses.  Multiple ListenAddress options are permitted.
+             The optional rdomain qualifier requests sshd(8) listen in an
+             explicit routing domain.  If port is not specified, sshd will
+             listen on the address and all Port options specified.  The
+             default is to listen on all local addresses on the current
+             default routing domain.  Multiple ListenAddress options are
+             permitted.  For more information on routing domains, see
+             rdomain(4).
 
      LoginGraceTime
              The server disconnects after this time if the user has not
@@ -612,10 +622,13 @@ DESCRIPTION
 
              The arguments to Match are one or more criteria-pattern pairs or
              the single token All which matches all criteria.  The available
-             criteria are User, Group, Host, LocalAddress, LocalPort, and
-             Address.  The match patterns may consist of single entries or
-             comma-separated lists and may use the wildcard and negation
-             operators described in the PATTERNS section of ssh_config(5).
+             criteria are User, Group, Host, LocalAddress, LocalPort, RDomain,
+             and Address (with RDomain representing the rdomain(4) on which
+             the connection was received.)
+
+             The match patterns may consist of single entries or comma-
+             separated lists and may use the wildcard and negation operators
+             described in the PATTERNS section of ssh_config(5).
 
              The patterns in an Address criteria may additionally contain
              addresses to match in CIDR address/masklen format, such as
@@ -640,7 +653,7 @@ DESCRIPTION
              MaxAuthTries, MaxSessions, PasswordAuthentication,
              PermitEmptyPasswords, PermitOpen, PermitRootLogin, PermitTTY,
              PermitTunnel, PermitUserRC, PubkeyAcceptedKeyTypes,
-             PubkeyAuthentication, RekeyLimit, RevokedKeys,
+             PubkeyAuthentication, RekeyLimit, RevokedKeys, RDomain,
              StreamLocalBindMask, StreamLocalBindUnlink, TrustedUserCAKeys,
              X11DisplayOffset, X11Forwarding and X11UseLocalHost.
 
@@ -700,12 +713,12 @@ DESCRIPTION
 
      PermitRootLogin
              Specifies whether root can log in using ssh(1).  The argument
-             must be yes, prohibit-password, without-password,
-             forced-commands-only, or no.  The default is prohibit-password.
+             must be yes, prohibit-password, forced-commands-only, or no.  The
+             default is prohibit-password.
 
-             If this option is set to prohibit-password or without-password,
-             password and keyboard-interactive authentication are disabled for
-             root.
+             If this option is set to prohibit-password (or its deprecated
+             alias, without-password), password and keyboard-interactive
+             authentication are disabled for root.
 
              If this option is set to forced-commands-only, root login with
              public key authentication will be allowed, but only if the
@@ -807,6 +820,13 @@ DESCRIPTION
              ssh-keygen(1).  For more information on KRLs, see the KEY
              REVOCATION LISTS section in ssh-keygen(1).
 
+     RDomain
+             Specifies an explicit routing domain that is applied after
+             authentication has completed.  The user session, as well and any
+             forwarded or listening IP sockets, will be bound to this
+             rdomain(4).  If the routing domain is set to %D, then the domain
+             in which the incoming connection was received will be applied.
+
      StreamLocalBindMask
              Sets the octal file creation mode mask (umask) used when creating
              a Unix-domain socket file for local or remote port forwarding.
@@ -980,6 +1000,8 @@ TOKENS
      runtime:
 
            %%    A literal M-bM-^@M-^X%M-bM-^@M-^Y.
+           %D    The routing domain in which the incoming connection was
+                 received.
            %F    The fingerprint of the CA key.
            %f    The fingerprint of the key or certificate.
            %h    The home directory of the user.
@@ -1002,6 +1024,8 @@ TOKENS
 
      ChrootDirectory accepts the tokens %%, %h, and %u.
 
+     RoutingDomain accepts the token %D.
+
 FILES
      /etc/ssh/sshd_config
              Contains configuration data for sshd(8).  This file should be
@@ -1019,4 +1043,4 @@ AUTHORS
      versions 1.5 and 2.0.  Niels Provos and Markus Friedl contributed support
      for privilege separation.
 
-OpenBSD 6.2                   September 27, 2017                   OpenBSD 6.2
+OpenBSD 6.2                    February 16, 2018                   OpenBSD 6.2