26 files changed, 42 insertions, 42 deletions

diff --git a/debian/.git-dpm b/debian/.git-dpm
index f530b3269..7a3e2e900 100644
--- a/debian/.git-dpm
+++ b/debian/.git-dpm
@@ -1,6 +1,6 @@
 # see git-dpm(1) from git-dpm package
-af54c22db774b37a15df5e599d08a83d4bbe5079
-af54c22db774b37a15df5e599d08a83d4bbe5079
+41265d4fa6f5946719155a08a19717a4ca229454
+41265d4fa6f5946719155a08a19717a4ca229454
 971a7653746a6972b907dfe0ce139c06e4a6f482
 971a7653746a6972b907dfe0ce139c06e4a6f482
 openssh_7.4p1.orig.tar.gz
diff --git a/debian/changelog b/debian/changelog
index 80e03947f..a9f8f815e 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -132,6 +132,9 @@ openssh (1:7.4p1-1) UNRELEASED; urgency=medium
       PermitRootLogin setting is properly preserved.
     - UsePrivilegeSeparation now defaults to the stronger "sandbox" rather
       than "yes", per upstream.
+  * Remove redundant "GSSAPIDelegateCredentials no" from ssh_config (already
+    the upstream default), and document that setting ServerAliveInterval to
+    300 by default if BatchMode is set is Debian-specific (closes: #765630).
 
  -- Colin Watson <cjwatson@debian.org>  Mon, 05 Dec 2016 19:31:33 +0000
 
diff --git a/debian/patches/auth-log-verbosity.patch b/debian/patches/auth-log-verbosity.patch
index 55c5e84ff..d025cf7eb 100644
--- a/debian/patches/auth-log-verbosity.patch
+++ b/debian/patches/auth-log-verbosity.patch
@@ -1,4 +1,4 @@
-From 69e0307a3bc73d5d360c19aeb61133c126cf63bf Mon Sep 17 00:00:00 2001
+From f7088f0a3d04473cfdcf11fe6b084b81beb7041c Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:02 +0000
 Subject: Quieten logs when multiple from= restrictions are used
diff --git a/debian/patches/authorized-keys-man-symlink.patch b/debian/patches/authorized-keys-man-symlink.patch
index 145e667ba..dcfd8b403 100644
--- a/debian/patches/authorized-keys-man-symlink.patch
+++ b/debian/patches/authorized-keys-man-symlink.patch
@@ -1,4 +1,4 @@
-From 59a369094592ce96510bb421d6e494b6f36eb7b7 Mon Sep 17 00:00:00 2001
+From 0290fd6980eaefa222cc39b6a4871be0a8c72a7d Mon Sep 17 00:00:00 2001
 From: Tomas Pospisek <tpo_deb@sourcepole.ch>
 Date: Sun, 9 Feb 2014 16:10:07 +0000
 Subject: Install authorized_keys(5) as a symlink to sshd(8)
diff --git a/debian/patches/debian-banner.patch b/debian/patches/debian-banner.patch
index ad842c23f..20ceefe9c 100644
--- a/debian/patches/debian-banner.patch
+++ b/debian/patches/debian-banner.patch
@@ -1,4 +1,4 @@
-From 02a077d3c8f8491d277b2291d5ae538379c7ed44 Mon Sep 17 00:00:00 2001
+From 541f4f5664934bccc96a9b7a2a7e957ce2cff6af Mon Sep 17 00:00:00 2001
 From: Kees Cook <kees@debian.org>
 Date: Sun, 9 Feb 2014 16:10:06 +0000
 Subject: Add DebianBanner server configuration option
diff --git a/debian/patches/debian-config.patch b/debian/patches/debian-config.patch
index 65175d589..9b46e1392 100644
--- a/debian/patches/debian-config.patch
+++ b/debian/patches/debian-config.patch
@@ -1,4 +1,4 @@
-From af54c22db774b37a15df5e599d08a83d4bbe5079 Mon Sep 17 00:00:00 2001
+From 41265d4fa6f5946719155a08a19717a4ca229454 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:18 +0000
 Subject: Various Debian-specific configuration changes
@@ -11,8 +11,7 @@ ssh: Set 'SendEnv LANG LC_*' by default (http://bugs.debian.org/264024).
 ssh: Enable HashKnownHosts by default to try to limit the spread of ssh
 worms.
 
-ssh: Enable GSSAPIAuthentication and disable GSSAPIDelegateCredentials by
-default.
+ssh: Enable GSSAPIAuthentication by default.
 
 sshd: Enable PAM, disable ChallengeResponseAuthentication, and disable
 PrintMotd.
@@ -27,17 +26,17 @@ Document all of this.
 
 Author: Russ Allbery <rra@debian.org>
 Forwarded: not-needed
-Last-Update: 2016-12-24
+Last-Update: 2016-12-26
 
 Patch-Name: debian-config.patch
 ---
  readconf.c    |  2 +-
  ssh.1         | 21 +++++++++++++++++++++
- ssh_config    |  7 ++++++-
+ ssh_config    |  6 +++++-
  ssh_config.5  | 19 ++++++++++++++++++-
  sshd_config   | 16 ++++++++++------
  sshd_config.5 | 22 ++++++++++++++++++++++
- 6 files changed, 78 insertions(+), 9 deletions(-)
+ 6 files changed, 77 insertions(+), 9 deletions(-)
 
 diff --git a/readconf.c b/readconf.c
 index c02cdf63..d1091cbd 100644
@@ -92,7 +91,7 @@ index 22e56a7b..6aa57c46 100644
  Send log information using the
  .Xr syslog 3
 diff --git a/ssh_config b/ssh_config
-index 4e879cd2..5190b06b 100644
+index 4e879cd2..093c8366 100644
 --- a/ssh_config
 +++ b/ssh_config
 @@ -17,9 +17,10 @@
@@ -107,16 +106,15 @@ index 4e879cd2..5190b06b 100644
  #   RhostsRSAAuthentication no
  #   RSAAuthentication yes
  #   PasswordAuthentication yes
-@@ -50,3 +51,7 @@
+@@ -50,3 +51,6 @@
  #   VisualHostKey no
  #   ProxyCommand ssh -q -W %h:%p gateway.example.com
  #   RekeyLimit 1G 1h
 +    SendEnv LANG LC_*
 +    HashKnownHosts yes
 +    GSSAPIAuthentication yes
-+    GSSAPIDelegateCredentials no
 diff --git a/ssh_config.5 b/ssh_config.5
-index 40617be4..8dce757e 100644
+index 8698c28e..26f983a3 100644
 --- a/ssh_config.5
 +++ b/ssh_config.5
 @@ -74,6 +74,22 @@ Since the first obtained value for each parameter is used, more
diff --git a/debian/patches/dnssec-sshfp.patch b/debian/patches/dnssec-sshfp.patch
index f85eaadd9..18a16fb6d 100644
--- a/debian/patches/dnssec-sshfp.patch
+++ b/debian/patches/dnssec-sshfp.patch
@@ -1,4 +1,4 @@
-From cb15899de8dc5d2e8b3869d743307d252af69643 Mon Sep 17 00:00:00 2001
+From de4a8d3eaf773015b6d725c9c682430325a14b0e Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:01 +0000
 Subject: Force use of DNSSEC even if "options edns0" isn't in resolv.conf
diff --git a/debian/patches/doc-hash-tab-completion.patch b/debian/patches/doc-hash-tab-completion.patch
index 9d03ff54e..76f9ae4f9 100644
--- a/debian/patches/doc-hash-tab-completion.patch
+++ b/debian/patches/doc-hash-tab-completion.patch
@@ -1,4 +1,4 @@
-From 9d1bb4df39e51955442e82d8764827abdd2651c9 Mon Sep 17 00:00:00 2001
+From 934c9a5c1689c7ce4b78dee3f65c30f53e41ec81 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:11 +0000
 Subject: Document that HashKnownHosts may break tab-completion
@@ -13,7 +13,7 @@ Patch-Name: doc-hash-tab-completion.patch
  1 file changed, 3 insertions(+)
 
 diff --git a/ssh_config.5 b/ssh_config.5
-index f62ea6b8..40617be4 100644
+index 0483a1ee..8698c28e 100644
 --- a/ssh_config.5
 +++ b/ssh_config.5
 @@ -805,6 +805,9 @@ Note that existing names and addresses in known hosts files
diff --git a/debian/patches/doc-upstart.patch b/debian/patches/doc-upstart.patch
index 67906f19a..54f99e662 100644
--- a/debian/patches/doc-upstart.patch
+++ b/debian/patches/doc-upstart.patch
@@ -1,4 +1,4 @@
-From d52a0f1744dde27a36c3ee8314fbbab8c1a2216f Mon Sep 17 00:00:00 2001
+From c8d763aeef5f450e55172ff2374e0b9abb3f08a9 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@ubuntu.com>
 Date: Sun, 9 Feb 2014 16:10:12 +0000
 Subject: Refer to ssh's Upstart job as well as its init script
diff --git a/debian/patches/gnome-ssh-askpass2-icon.patch b/debian/patches/gnome-ssh-askpass2-icon.patch
index 8d4199907..ec7647c6d 100644
--- a/debian/patches/gnome-ssh-askpass2-icon.patch
+++ b/debian/patches/gnome-ssh-askpass2-icon.patch
@@ -1,4 +1,4 @@
-From 39cb522642f428a818ef2cd56c39de4783da0b6e Mon Sep 17 00:00:00 2001
+From 7e6bb45ce4ead0e3256d1741e0020bc5d4e6a09b Mon Sep 17 00:00:00 2001
 From: Vincent Untz <vuntz@ubuntu.com>
 Date: Sun, 9 Feb 2014 16:10:16 +0000
 Subject: Give the ssh-askpass-gnome window a default icon
diff --git a/debian/patches/keepalive-extensions.patch b/debian/patches/keepalive-extensions.patch
index 11378586d..4db3caa5a 100644
--- a/debian/patches/keepalive-extensions.patch
+++ b/debian/patches/keepalive-extensions.patch
@@ -1,4 +1,4 @@
-From 8f60ff6d23d4a1f8c347cf4b95267e00116f74fa Mon Sep 17 00:00:00 2001
+From 0bdc6351d8a32c33e65542617c71da8ddcdeb331 Mon Sep 17 00:00:00 2001
 From: Richard Kettlewell <rjk@greenend.org.uk>
 Date: Sun, 9 Feb 2014 16:09:52 +0000
 Subject: Various keepalive extensions
@@ -16,7 +16,7 @@ keepalives.
 Author: Ian Jackson <ian@chiark.greenend.org.uk>
 Author: Matthew Vernon <matthew@debian.org>
 Author: Colin Watson <cjwatson@debian.org>
-Last-Update: 2015-11-29
+Last-Update: 2016-12-26
 
 Patch-Name: keepalive-extensions.patch
 ---
@@ -72,7 +72,7 @@ index c1c3aae0..3efba242 100644
                 options->server_alive_count_max = 3;
         if (options->control_master == -1)
 diff --git a/ssh_config.5 b/ssh_config.5
-index a7703fc7..32fd100d 100644
+index a7703fc7..a0457314 100644
 --- a/ssh_config.5
 +++ b/ssh_config.5
 @@ -250,8 +250,12 @@ Valid arguments are
@@ -81,7 +81,7 @@ index a7703fc7..32fd100d 100644
  passphrase/password querying will be disabled.
 +In addition, the
 +.Cm ServerAliveInterval
-+option will be set to 300 seconds by default.
++option will be set to 300 seconds by default (Debian-specific).
  This option is useful in scripts and other batch jobs where no user
 -is present to supply the password.
 +is present to supply the password,
@@ -97,7 +97,7 @@ index a7703fc7..32fd100d 100644
 +is 0, indicating that these messages will not be sent to the server,
 +or 300 if the
 +.Cm BatchMode
-+option is set.
++option is set (Debian-specific).
 +.Cm ProtocolKeepAlives
 +and
 +.Cm SetupTimeOut
diff --git a/debian/patches/mention-ssh-keygen-on-keychange.patch b/debian/patches/mention-ssh-keygen-on-keychange.patch
index 943fc901d..0cfee84e5 100644
--- a/debian/patches/mention-ssh-keygen-on-keychange.patch
+++ b/debian/patches/mention-ssh-keygen-on-keychange.patch
@@ -1,4 +1,4 @@
-From e39bf0e814394fb5a14094b651f3bf9ddec0a782 Mon Sep 17 00:00:00 2001
+From 04923a79cca487e1295685638a6113dbe5ec54bd Mon Sep 17 00:00:00 2001
 From: Scott Moser <smoser@ubuntu.com>
 Date: Sun, 9 Feb 2014 16:10:03 +0000
 Subject: Mention ssh-keygen in ssh fingerprint changed warning
diff --git a/debian/patches/no-openssl-version-status.patch b/debian/patches/no-openssl-version-status.patch
index 682455fe9..af5caaa99 100644
--- a/debian/patches/no-openssl-version-status.patch
+++ b/debian/patches/no-openssl-version-status.patch
@@ -1,4 +1,4 @@
-From 27710ce6deb6e9a820235ac44dd82333ab330047 Mon Sep 17 00:00:00 2001
+From 85a592345eb1c86e918f08643b8b48aee69aec63 Mon Sep 17 00:00:00 2001
 From: Kurt Roeckx <kurt@roeckx.be>
 Date: Sun, 9 Feb 2014 16:10:14 +0000
 Subject: Don't check the status field of the OpenSSL version
diff --git a/debian/patches/openbsd-docs.patch b/debian/patches/openbsd-docs.patch
index 5a6428a16..50f5db1ae 100644
--- a/debian/patches/openbsd-docs.patch
+++ b/debian/patches/openbsd-docs.patch
@@ -1,4 +1,4 @@
-From 57a5ec3553730b373c96e8457815c42733304427 Mon Sep 17 00:00:00 2001
+From f16966d39a328b5f6461343d088f863c8cf2a2d4 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:09 +0000
 Subject: Adjust various OpenBSD-specific references in manual pages
diff --git a/debian/patches/package-versioning.patch b/debian/patches/package-versioning.patch
index 7b14bcc09..0b46869c9 100644
--- a/debian/patches/package-versioning.patch
+++ b/debian/patches/package-versioning.patch
@@ -1,4 +1,4 @@
-From cdce59c8c54d6d19ca0aa86cb4a62f6df94c7245 Mon Sep 17 00:00:00 2001
+From bfc81c7380b71bd5c0e841e8bd16bfc726a43603 Mon Sep 17 00:00:00 2001
 From: Matthew Vernon <matthew@debian.org>
 Date: Sun, 9 Feb 2014 16:10:05 +0000
 Subject: Include the Debian version in our identification
diff --git a/debian/patches/quieter-signals.patch b/debian/patches/quieter-signals.patch
index 49f1daf1c..ab94faecc 100644
--- a/debian/patches/quieter-signals.patch
+++ b/debian/patches/quieter-signals.patch
@@ -1,4 +1,4 @@
-From 7083ae25ccce8bbdad40e7c7500f69f2c0cbce34 Mon Sep 17 00:00:00 2001
+From 68d399525871ecd1a2837f04045581a2774ba4bb Mon Sep 17 00:00:00 2001
 From: Peter Samuelson <peter@p12n.org>
 Date: Sun, 9 Feb 2014 16:09:55 +0000
 Subject: Reduce severity of "Killed by signal %d"
diff --git a/debian/patches/scp-quoting.patch b/debian/patches/scp-quoting.patch
index 8e426db77..aad0e6b50 100644
--- a/debian/patches/scp-quoting.patch
+++ b/debian/patches/scp-quoting.patch
@@ -1,4 +1,4 @@
-From 43205c71be413d2225ce3ea5cf81d79afd420b81 Mon Sep 17 00:00:00 2001
+From 630c67159398218379b51112ce708fc4f208f903 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Nicolas=20Valc=C3=A1rcel?= <nvalcarcel@ubuntu.com>
 Date: Sun, 9 Feb 2014 16:09:59 +0000
 Subject: Adjust scp quoting in verbose mode
diff --git a/debian/patches/shell-path.patch b/debian/patches/shell-path.patch
index 82203e0d8..5c609f373 100644
--- a/debian/patches/shell-path.patch
+++ b/debian/patches/shell-path.patch
@@ -1,4 +1,4 @@
-From f6973171005fc513fa25540a1561ca1128e488e1 Mon Sep 17 00:00:00 2001
+From 62a564b1f2f9cb086a3618c6df4113a4d9dbe273 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:00 +0000
 Subject: Look for $SHELL on the path for ProxyCommand/LocalCommand
diff --git a/debian/patches/sigstop.patch b/debian/patches/sigstop.patch
index 5e07bf023..b82b21afe 100644
--- a/debian/patches/sigstop.patch
+++ b/debian/patches/sigstop.patch
@@ -1,4 +1,4 @@
-From 7140d94420542a8af7459d08436af2fc950cd810 Mon Sep 17 00:00:00 2001
+From e6e10c563bbe69426d5074b0b97e2a9b0b4b3b49 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:17 +0000
 Subject: Support synchronisation with service supervisor using SIGSTOP
diff --git a/debian/patches/ssh-agent-setgid.patch b/debian/patches/ssh-agent-setgid.patch
index 4e087e47d..73d48641f 100644
--- a/debian/patches/ssh-agent-setgid.patch
+++ b/debian/patches/ssh-agent-setgid.patch
@@ -1,4 +1,4 @@
-From 42a3ec898a2dc3a752d675f48585109ab8a592f2 Mon Sep 17 00:00:00 2001
+From 135f35985c55d9734dcd61cf159d3e7916b95b60 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:13 +0000
 Subject: Document consequences of ssh-agent being setgid in ssh-agent(1)
diff --git a/debian/patches/ssh-argv0.patch b/debian/patches/ssh-argv0.patch
index 70b13cd47..983a4fc67 100644
--- a/debian/patches/ssh-argv0.patch
+++ b/debian/patches/ssh-argv0.patch
@@ -1,4 +1,4 @@
-From 45d82ddb03e248dae4775ce1693654ea69d050ad Mon Sep 17 00:00:00 2001
+From 4476fe4e30c33c250ddd6bd01e644979f10acd25 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:10 +0000
 Subject: ssh(1): Refer to ssh-argv0(1)
diff --git a/debian/patches/syslog-level-silent.patch b/debian/patches/syslog-level-silent.patch
index 9fd4e96d3..d6a5707d4 100644
--- a/debian/patches/syslog-level-silent.patch
+++ b/debian/patches/syslog-level-silent.patch
@@ -1,4 +1,4 @@
-From 3ffb3874831f9f4a0a2d02c82c3505166593f1c1 Mon Sep 17 00:00:00 2001
+From bdc8262449eefe39f2dc4ddcbb44b84ddade4cd3 Mon Sep 17 00:00:00 2001
 From: Jonathan David Amery <jdamery@ysolde.ucam.org>
 Date: Sun, 9 Feb 2014 16:09:54 +0000
 Subject: "LogLevel SILENT" compatibility
diff --git a/debian/patches/systemd-readiness.patch b/debian/patches/systemd-readiness.patch
index a2ecd7e99..0a8ff5d9c 100644
--- a/debian/patches/systemd-readiness.patch
+++ b/debian/patches/systemd-readiness.patch
@@ -1,4 +1,4 @@
-From 6ea90cd25e0275c4153691a962bcc89007e77261 Mon Sep 17 00:00:00 2001
+From c95bb2c6a018688e44481bf1d199607db567fd9e Mon Sep 17 00:00:00 2001
 From: Michael Biebl <biebl@debian.org>
 Date: Mon, 21 Dec 2015 16:08:47 +0000
 Subject: Add systemd readiness notification support
diff --git a/debian/patches/user-group-modes.patch b/debian/patches/user-group-modes.patch
index e08b6c7b7..1a6194544 100644
--- a/debian/patches/user-group-modes.patch
+++ b/debian/patches/user-group-modes.patch
@@ -1,4 +1,4 @@
-From df060c830ad66289a93be24268f3f70e7021be29 Mon Sep 17 00:00:00 2001
+From 47c946434c6e99ff9da531cfcafb051e38e79ff8 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:09:58 +0000
 Subject: Allow harmless group-writability
@@ -245,7 +245,7 @@ index 4011c65a..feef81a5 100644
  .It Pa ~/.ssh/environment
  Contains additional definitions for environment variables; see
 diff --git a/ssh_config.5 b/ssh_config.5
-index 32fd100d..f62ea6b8 100644
+index a0457314..0483a1ee 100644
 --- a/ssh_config.5
 +++ b/ssh_config.5
 @@ -1803,6 +1803,8 @@ The format of this file is described above.
diff --git a/ssh_config b/ssh_config
index 5190b06b1..093c8366e 100644
--- a/ssh_config
+++ b/ssh_config
@@ -54,4 +54,3 @@ Host *
     SendEnv LANG LC_*
     HashKnownHosts yes
     GSSAPIAuthentication yes
-    GSSAPIDelegateCredentials no
diff --git a/ssh_config.5 b/ssh_config.5
index 8dce757ec..26f983a3e 100644
--- a/ssh_config.5
+++ b/ssh_config.5
@@ -268,7 +268,7 @@ If set to
 passphrase/password querying will be disabled.
 In addition, the
 .Cm ServerAliveInterval
-option will be set to 300 seconds by default.
+option will be set to 300 seconds by default (Debian-specific).
 This option is useful in scripts and other batch jobs where no user
 is present to supply the password,
 and where it is desirable to detect a broken network swiftly.
@@ -1512,7 +1512,7 @@ The default
 is 0, indicating that these messages will not be sent to the server,
 or 300 if the
 .Cm BatchMode
-option is set.
+option is set (Debian-specific).
 .Cm ProtocolKeepAlives
 and
 .Cm SetupTimeOut