5 files changed, 17 insertions, 2 deletions

diff --git a/debian/README.Debian b/debian/README.Debian
index cb1444a47..4f076f898 100644
--- a/debian/README.Debian
+++ b/debian/README.Debian
@@ -115,6 +115,15 @@ As of OpenSSH 3.1, the remote $DISPLAY uses localhost by default to reduce
 the security risks of X11 forwarding. Look up X11UseLocalhost in
 sshd_config(8) if this is a problem.
 
+OpenSSH 3.8 invented ForwardX11Trusted, which when set to no causes the
+ssh client to create an untrusted X cookie so that attacks on the
+forwarded X11 connection can't become attacks on X clients on the remote
+machine. However, this has some problems in implementation - notably a
+very short timeout of the untrusted cookie - breaks large numbers of
+existing setups, and generally seems immature. The Debian package
+therefore sets the default for this option to "no" (in ssh itself,
+rather than in ssh_config).
+
 Fallback to RSH
 ---------------
 
diff --git a/debian/changelog b/debian/changelog
index ef6d73a81..3d3ed1275 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,6 +1,10 @@
 openssh (1:3.8p1-2) UNRELEASED; urgency=low
 
   * Disable PasswordAuthentication for new installations (closes: #236810).
+  * Turn off the new ForwardX11Trusted by default, returning to the
+    semantics of 3.7 and earlier, since it seems immature and causes far too
+    many problems with existing setups. See README.Debian for details
+    (closes: #237021).
 
  -- Colin Watson <cjwatson@debian.org>  Mon,  8 Mar 2004 14:38:54 +0000
 
diff --git a/readconf.c b/readconf.c
index 3af3038bb..dfd83c1b9 100644
--- a/readconf.c
+++ b/readconf.c
@@ -899,7 +899,7 @@ fill_default_options(Options * options)
         if (options->forward_x11 == -1)
                 options->forward_x11 = 0;
         if (options->forward_x11_trusted == -1)
-                options->forward_x11_trusted = 0;
+                options->forward_x11_trusted = 1;
         if (options->xauth_location == NULL)
                 options->xauth_location = _PATH_XAUTH;
         if (options->gateway_ports == -1)
diff --git a/ssh_config b/ssh_config
index 2692e8913..f72394b4e 100644
--- a/ssh_config
+++ b/ssh_config
@@ -18,6 +18,7 @@
 # Host *
 #   ForwardAgent no
 #   ForwardX11 no
+#   ForwardX11Trusted yes
 #   RhostsRSAAuthentication no
 #   RSAAuthentication yes
 #   PasswordAuthentication yes
diff --git a/ssh_config.5 b/ssh_config.5
index 72ad6d512..e4a59a2ad 100644
--- a/ssh_config.5
+++ b/ssh_config.5
@@ -330,7 +330,8 @@ from stealing or tampering with data belonging to trusted X11
 clients.
 .Pp
 The default is
-.Dq no .
+.Dq yes
+(Debian-specific).
 .Pp
 See the X11 SECURITY extension specification for full details on
 the restrictions imposed on untrusted clients.