27 files changed, 93 insertions, 57 deletions

diff --git a/debian/changelog b/debian/changelog
index df48a4003..aafb4e26f 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -12,6 +12,8 @@ openssh (1:4.1p1-1) UNRELEASED; urgency=low
     to PasswordAuthentication by default, since it now supports PAM and
     apparently works better with a non-threaded sshd (closes: #247521).
   * openssh-server Suggests: rssh (closes: #233012).
+  * Change libexecdir to /usr/lib/openssh, and fix up various alternatives
+    and configuration files to match (closes: #87900, #151321).
 
  -- Colin Watson <cjwatson@debian.org>  Thu, 26 May 2005 13:51:50 +0100
 
diff --git a/debian/openssh-client.postinst b/debian/openssh-client.postinst
index 2168dc1f1..4744a34a1 100644
--- a/debian/openssh-client.postinst
+++ b/debian/openssh-client.postinst
@@ -59,13 +59,28 @@ set_ssh_permissions() {
             fi
         fi
 
+        # libexecdir changed, so migrate old statoverrides.
+        if [ -x /usr/sbin/dpkg-statoverride ] &&
+            override="$(dpkg-statoverride --list /usr/lib/ssh-keysign)"; then
+                override_user="${override%% *}"
+                override="${override#* }"
+                override_group="${override%% *}"
+                override="${override#* }"
+                override_mode="${override%% *}"
+                if dpkg-statoverride --update --add \
+                    "$override_user" "$override_group" "$override_mode" \
+                    /usr/lib/openssh/ssh-keysign; then
+                        dpkg-statoverride --remove /usr/lib/ssh-keysign || true
+                fi
+        fi
+
         if [ ! -x /usr/sbin/dpkg-statoverride ] || \
-             ! dpkg-statoverride --list /usr/lib/ssh-keysign >/dev/null ; then
+             ! dpkg-statoverride --list /usr/lib/openssh/ssh-keysign >/dev/null; then
                 db_get ssh/SUID_client
                 if [ "$RET" = "false" ] ; then
-                        chmod 0755 /usr/lib/ssh-keysign
+                        chmod 0755 /usr/lib/openssh/ssh-keysign
                 elif [ "$RET" = "true" ] ; then
-                        chmod 4755 /usr/lib/ssh-keysign
+                        chmod 4755 /usr/lib/openssh/ssh-keysign
                 fi
         fi
 }
diff --git a/debian/openssh-client.templates.master b/debian/openssh-client.templates.master
index 2a9594c66..1cb84bf04 100644
--- a/debian/openssh-client.templates.master
+++ b/debian/openssh-client.templates.master
@@ -1,7 +1,7 @@
 Template: ssh/SUID_client
 Type: boolean
 Default: true
-_Description: Do you want /usr/lib/ssh-keysign to be installed SUID root?
+_Description: Do you want ssh-keysign to be installed SUID root?
  You have the option of installing the ssh-keysign helper with the SUID bit
  set.
  .
diff --git a/debian/openssh-server.dirs b/debian/openssh-server.dirs
index 85ee171be..b28faf929 100644
--- a/debian/openssh-server.dirs
+++ b/debian/openssh-server.dirs
@@ -1,6 +1,6 @@
 etc/init.d
 etc/default
-usr/lib
+usr/lib/openssh
 usr/sbin
 usr/share/man/man5
 usr/share/man/man8
diff --git a/debian/openssh-server.postinst b/debian/openssh-server.postinst
index 46813605f..fe6f50775 100644
--- a/debian/openssh-server.postinst
+++ b/debian/openssh-server.postinst
@@ -32,7 +32,7 @@ get_config_option() {
         [ -f /etc/ssh/sshd_config ] || return
 
         # TODO: actually only one '=' allowed after option
-        perl -ne 'print if s/^[[:space:]]*'"$option"'[[:space:]=]+//i' \
+        perl -lne 's/\s+/ /g; print if s/^\s*'"$option"'[[:space:]=]+//i' \
            /etc/ssh/sshd_config
 }
 
@@ -41,15 +41,18 @@ set_config_option() {
         option="$1"
         value="$2"
 
-        perl -e '
+        perl -le '
                 $option = $ARGV[0]; $value = $ARGV[1]; $done = 0;
                 while (<STDIN>) {
-                        if (s/^\s*\Q$option\E\s+.*/$option $value/) {
+                        chomp;
+                        (my $match = $_) =~ s/\s+/ /g;
+                        if ($match =~ s/^\s*\Q$option\E\s+.*/$option $value/) {
+                                $_ = $match;
                                 $done = 1;
                         }
                         print;
                 }
-                print "\n$option $value\n" unless $done;' \
+                print "$option $value" unless $done;' \
                 "$option" "$value" \
                 < /etc/ssh/sshd_config > /etc/ssh/sshd_config.dpkg-new
         chown --reference /etc/ssh/sshd_config /etc/ssh/sshd_config.dpkg-new
@@ -121,6 +124,14 @@ check_password_auth() {
 }
 
 
+move_subsystem_sftp() {
+        subsystem_sftp="$(get_config_option 'Subsystem sftp')"
+        if [ "$subsystem_sftp" = /usr/lib/sftp-server ]; then
+                set_config_option 'Subsystem sftp' /usr/lib/openssh/sftp-server
+        fi
+}
+
+
 create_sshdconfig() {
         if [ -e /etc/ssh/sshd_config ] ; then
             if dpkg --compare-versions "$oldversion" lt-nl 1:1.3 ; then
@@ -159,6 +170,11 @@ create_sshdconfig() {
                     check_password_auth
                 fi
 
+                # libexecdir changed, so fix up 'Subsystem sftp'.
+                if dpkg --compare-versions "$oldversion" lt 1:4.1p1-1; then
+                    move_subsystem_sftp
+                fi
+
                 return 0
             fi
         fi
@@ -260,7 +276,7 @@ KeepAlive yes
 # Allow client to pass locale environment variables
 AcceptEnv LANG LC_*
 
-Subsystem       sftp    /usr/lib/sftp-server
+Subsystem sftp /usr/lib/openssh/sftp-server
 
 UsePAM yes
 EOF
diff --git a/debian/po/ca.po b/debian/po/ca.po
index 31b446645..04fd74b6e 100644
--- a/debian/po/ca.po
+++ b/debian/po/ca.po
@@ -17,8 +17,8 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../openssh-client.templates.master:4
-msgid "Do you want /usr/lib/ssh-keysign to be installed SUID root?"
-msgstr "Voleu que el fitxer /usr/lib/ssh-keysign s'instal揃li SUID root?"
+msgid "Do you want ssh-keysign to be installed SUID root?"
+msgstr "Voleu que el fitxer ssh-keysign s'instal揃li SUID root?"
 
 #. Type: boolean
 #. Description
diff --git a/debian/po/cs.po b/debian/po/cs.po
index 50280ae75..245fcb4ba 100644
--- a/debian/po/cs.po
+++ b/debian/po/cs.po
@@ -26,8 +26,8 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../openssh-client.templates.master:4
-msgid "Do you want /usr/lib/ssh-keysign to be installed SUID root?"
-msgstr "Chcete /usr/lib/ssh-keysign nainstalovat jako SUID root?"
+msgid "Do you want ssh-keysign to be installed SUID root?"
+msgstr "Chcete ssh-keysign nainstalovat jako SUID root?"
 
 #. Type: boolean
 #. Description
diff --git a/debian/po/da.po b/debian/po/da.po
index 88fba1944..d469d3cae 100644
--- a/debian/po/da.po
+++ b/debian/po/da.po
@@ -26,8 +26,8 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../openssh-client.templates.master:4
-msgid "Do you want /usr/lib/ssh-keysign to be installed SUID root?"
-msgstr "Vil du have, at /usr/bin/ssh-keysign bliver installeret 'SUID root'?"
+msgid "Do you want ssh-keysign to be installed SUID root?"
+msgstr "Vil du have, at ssh-keysign bliver installeret 'SUID root'?"
 
 #. Type: boolean
 #. Description
diff --git a/debian/po/de.po b/debian/po/de.po
index 394227e7e..f48b8587b 100644
--- a/debian/po/de.po
+++ b/debian/po/de.po
@@ -27,8 +27,8 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../openssh-client.templates.master:4
-msgid "Do you want /usr/lib/ssh-keysign to be installed SUID root?"
-msgstr "M�chten Sie /usr/lib/ssh-keysign SUID-Root installieren?"
+msgid "Do you want ssh-keysign to be installed SUID root?"
+msgstr "M�chten Sie ssh-keysign SUID-Root installieren?"
 
 #. Type: boolean
 #. Description
diff --git a/debian/po/el.po b/debian/po/el.po
index 23195f3e9..345f1e5db 100644
--- a/debian/po/el.po
+++ b/debian/po/el.po
@@ -28,8 +28,8 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../openssh-client.templates.master:4
-msgid "Do you want /usr/lib/ssh-keysign to be installed SUID root?"
-msgstr "��劉了竜��竜 僚留 竜粒虜留��留����流��竜��竜 ��凌 /usr/lib/ssh-keysign ���� SUID;"
+msgid "Do you want ssh-keysign to be installed SUID root?"
+msgstr "��劉了竜��竜 僚留 竜粒虜留��留����流��竜��竜 ��凌 ssh-keysign ���� SUID;"
 
 #. Type: boolean
 #. Description
diff --git a/debian/po/es.po b/debian/po/es.po
index 65d8fe4c3..11ae193bd 100644
--- a/debian/po/es.po
+++ b/debian/po/es.po
@@ -43,8 +43,8 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../openssh-client.templates.master:4
-msgid "Do you want /usr/lib/ssh-keysign to be installed SUID root?"
-msgstr "�Quiere instalar /usr/lib/ssh-keysign SUID root?"
+msgid "Do you want ssh-keysign to be installed SUID root?"
+msgstr "�Quiere instalar ssh-keysign SUID root?"
 
 #. Type: boolean
 #. Description
diff --git a/debian/po/fi.po b/debian/po/fi.po
index 8b187fabe..dbc7ef98c 100644
--- a/debian/po/fi.po
+++ b/debian/po/fi.po
@@ -29,8 +29,8 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../openssh-client.templates.master:4
-msgid "Do you want /usr/lib/ssh-keysign to be installed SUID root?"
-msgstr "Haluatko, ett辰 /usr/lib/ssh-keygen asennetaan SUID root -oikeuksin?"
+msgid "Do you want ssh-keysign to be installed SUID root?"
+msgstr "Haluatko, ett辰 ssh-keygen asennetaan SUID root -oikeuksin?"
 
 #. Type: boolean
 #. Description
diff --git a/debian/po/fr.po b/debian/po/fr.po
index db77e6c98..6b15f7d16 100644
--- a/debian/po/fr.po
+++ b/debian/po/fr.po
@@ -26,8 +26,8 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../openssh-client.templates.master:4
-msgid "Do you want /usr/lib/ssh-keysign to be installed SUID root?"
-msgstr "Faut-il installer /usr/lib/ssh-keysign avec le bit SETUID activ��?"
+msgid "Do you want ssh-keysign to be installed SUID root?"
+msgstr "Faut-il installer ssh-keysign avec le bit SETUID activ��?"
 
 #. Type: boolean
 #. Description
diff --git a/debian/po/it.po b/debian/po/it.po
index e064af9fe..257555427 100644
--- a/debian/po/it.po
+++ b/debian/po/it.po
@@ -26,8 +26,8 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../openssh-client.templates.master:4
-msgid "Do you want /usr/lib/ssh-keysign to be installed SUID root?"
-msgstr "Si desidera installare /usr/lib/ssh-keysign come SUID-root?"
+msgid "Do you want ssh-keysign to be installed SUID root?"
+msgstr "Si desidera installare ssh-keysign come SUID-root?"
 
 #. Type: boolean
 #. Description
diff --git a/debian/po/ja.po b/debian/po/ja.po
index 914ba4500..2422dc9f9 100644
--- a/debian/po/ja.po
+++ b/debian/po/ja.po
@@ -26,8 +26,8 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../openssh-client.templates.master:4
-msgid "Do you want /usr/lib/ssh-keysign to be installed SUID root?"
-msgstr "/usr/bin/ssh-keysign を SUID root でインストールしますか?"
+msgid "Do you want ssh-keysign to be installed SUID root?"
+msgstr "ssh-keysign を SUID root でインストールしますか?"
 
 #. Type: boolean
 #. Description
diff --git a/debian/po/nl.po b/debian/po/nl.po
index 95a2698fa..7e6897d15 100644
--- a/debian/po/nl.po
+++ b/debian/po/nl.po
@@ -26,8 +26,8 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../openssh-client.templates.master:4
-msgid "Do you want /usr/lib/ssh-keysign to be installed SUID root?"
-msgstr "Wilt u /usr/lib/ssh-keysign met SUID root installeren?"
+msgid "Do you want ssh-keysign to be installed SUID root?"
+msgstr "Wilt u ssh-keysign met SUID root installeren?"
 
 #. Type: boolean
 #. Description
diff --git a/debian/po/pl.po b/debian/po/pl.po
index 3b422c92c..cb9a1df8c 100644
--- a/debian/po/pl.po
+++ b/debian/po/pl.po
@@ -26,8 +26,8 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../openssh-client.templates.master:4
-msgid "Do you want /usr/lib/ssh-keysign to be installed SUID root?"
-msgstr "Czy chcesz aby /usr/lib/ssh-keysign by� zainstalowany jako SUID root?"
+msgid "Do you want ssh-keysign to be installed SUID root?"
+msgstr "Czy chcesz aby ssh-keysign by� zainstalowany jako SUID root?"
 
 #. Type: boolean
 #. Description
diff --git a/debian/po/pt_BR.po b/debian/po/pt_BR.po
index 6c8071955..c5df9efd1 100644
--- a/debian/po/pt_BR.po
+++ b/debian/po/pt_BR.po
@@ -26,8 +26,8 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../openssh-client.templates.master:4
-msgid "Do you want /usr/lib/ssh-keysign to be installed SUID root?"
-msgstr "Deseja que que /usr/lib/ssh-keysign seja instalado SUID root ?"
+msgid "Do you want ssh-keysign to be installed SUID root?"
+msgstr "Deseja que que ssh-keysign seja instalado SUID root ?"
 
 #. Type: boolean
 #. Description
diff --git a/debian/po/ru.po b/debian/po/ru.po
index d2e4cde60..923067022 100644
--- a/debian/po/ru.po
+++ b/debian/po/ru.po
@@ -27,8 +27,8 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../openssh-client.templates.master:4
-msgid "Do you want /usr/lib/ssh-keysign to be installed SUID root?"
-msgstr "莽塢堙 孑堊力徂墮 /usr/lib/ssh-keysign 冒� SUID root?"
+msgid "Do you want ssh-keysign to be installed SUID root?"
+msgstr "莽塢堙 孑堊力徂墮 ssh-keysign 冒� SUID root?"
 
 #. Type: boolean
 #. Description
diff --git a/debian/po/templates.pot b/debian/po/templates.pot
index 458b36ad1..abcfb0e9a 100644
--- a/debian/po/templates.pot
+++ b/debian/po/templates.pot
@@ -27,7 +27,7 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../openssh-client.templates.master:4
-msgid "Do you want /usr/lib/ssh-keysign to be installed SUID root?"
+msgid "Do you want ssh-keysign to be installed SUID root?"
 msgstr ""
 
 #. Type: boolean
diff --git a/debian/po/tr.po b/debian/po/tr.po
index 4134b65be..9b60d9a3e 100644
--- a/debian/po/tr.po
+++ b/debian/po/tr.po
@@ -18,10 +18,8 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../openssh-client.templates.master:4
-msgid "Do you want /usr/lib/ssh-keysign to be installed SUID root?"
-msgstr ""
-"/usr/lib/ssh-keysign'脹n root haklar脹yla kurulmas脹n脹 (SUID root) ister "
-"misiniz?"
+msgid "Do you want ssh-keysign to be installed SUID root?"
+msgstr "ssh-keysign'脹n root haklar脹yla kurulmas脹n脹 (SUID root) ister misiniz?"
 
 #. Type: boolean
 #. Description
diff --git a/debian/po/uk.po b/debian/po/uk.po
index 4ee9de985..9a238e36e 100644
--- a/debian/po/uk.po
+++ b/debian/po/uk.po
@@ -29,8 +29,8 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../openssh-client.templates.master:4
-msgid "Do you want /usr/lib/ssh-keysign to be installed SUID root?"
-msgstr "丼亳 弍舒亢舒����亠 于亳, ��仂弍 /usr/lib/ssh-keysign 仄舒于 于����舒仆仂于仍亠仆亳亶 弍���� SUID?"
+msgid "Do you want ssh-keysign to be installed SUID root?"
+msgstr "丼亳 弍舒亢舒����亠 于亳, ��仂弍 ssh-keysign 仄舒于 于����舒仆仂于仍亠仆亳亶 弍���� SUID?"
 
 #. Type: boolean
 #. Description
diff --git a/debian/po/zh_CN.po b/debian/po/zh_CN.po
index f8673f647..afe415bb8 100644
--- a/debian/po/zh_CN.po
+++ b/debian/po/zh_CN.po
@@ -26,8 +26,8 @@ msgstr ""
 #. Type: boolean
 #. Description
 #: ../openssh-client.templates.master:4
-msgid "Do you want /usr/lib/ssh-keysign to be installed SUID root?"
-msgstr "���荀�絨� /usr/lib/ssh-keysign 絎�茖�筝� SUID root 腮�綺����鐚�"
+msgid "Do you want ssh-keysign to be installed SUID root?"
+msgstr "���荀�絨� ssh-keysign 絎�茖�筝� SUID root 腮�綺����鐚�"
 
 #. Type: boolean
 #. Description
diff --git a/debian/rules b/debian/rules
index cbad70815..90bd7ba9e 100755
--- a/debian/rules
+++ b/debian/rules
@@ -58,12 +58,12 @@ build-deb: build-deb-stamp
 build-deb-stamp:
         dh_testdir
         mkdir -p build-deb
-        cd build-deb && $(FORCE_LIBS) ../configure --prefix=/usr --sysconfdir=/etc/ssh --libexecdir=/usr/lib --mandir=/usr/share/man --with-tcp-wrappers --with-xauth=/usr/bin/X11/xauth --with-default-path=/usr/local/bin:/bin:/usr/bin:/usr/X11R6/bin --with-superuser-path=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin:/usr/X11R6/bin --with-pam --with-4in6 --with-privsep-path=/var/run/sshd --without-rand-helper --with-libedit
+        cd build-deb && $(FORCE_LIBS) ../configure --prefix=/usr --sysconfdir=/etc/ssh --libexecdir=/usr/lib/openssh --mandir=/usr/share/man --with-tcp-wrappers --with-xauth=/usr/bin/X11/xauth --with-default-path=/usr/local/bin:/bin:/usr/bin:/usr/X11R6/bin --with-superuser-path=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin:/usr/X11R6/bin --with-pam --with-4in6 --with-privsep-path=/var/run/sshd --without-rand-helper --with-libedit
 
         # Some 2.2 kernels have trouble with setres[ug]id() (bug #239999).
         perl -pi -e 's/.*#undef (BROKEN_SETRES[UG]ID).*/#define $$1 1/' build-deb/config.h
 
-        $(MAKE) -C build-deb -j 2 ASKPASS_PROGRAM='/usr/bin/ssh-askpass' CFLAGS='$(OPTFLAGS) -g -Wall -DLOGIN_PROGRAM=\"/bin/login\" -DLOGIN_NO_ENDOPT -DSSHD_PAM_SERVICE=\"ssh\" -DSSH_EXTRAVERSION="\" $(SSH_EXTRAVERSION)\""' SSH_KEYSIGN='/usr/lib/ssh-keysign'
+        $(MAKE) -C build-deb -j 2 ASKPASS_PROGRAM='/usr/bin/ssh-askpass' CFLAGS='$(OPTFLAGS) -g -Wall -DLOGIN_PROGRAM=\"/bin/login\" -DLOGIN_NO_ENDOPT -DSSHD_PAM_SERVICE=\"ssh\" -DSSH_EXTRAVERSION="\" $(SSH_EXTRAVERSION)\""' SSH_KEYSIGN='/usr/lib/openssh/ssh-keysign'
         # Support building on Debian 3.0 (with GNOME 1.4) and later.
         if [ -f /usr/include/libgnomeui-2.0/gnome.h ]; then \
                 $(MAKE) -C contrib gnome-ssh-askpass2 CC='gcc $(OPTFLAGS) -g -Wall'; \
@@ -77,11 +77,11 @@ build-udeb: build-udeb-stamp
 build-udeb-stamp:
         dh_testdir
         mkdir -p build-udeb
-        cd build-udeb && $(FORCE_LIBS) ../configure --prefix=/usr --sysconfdir=/etc/ssh --without-xauth --with-default-path=/usr/local/bin:/bin:/usr/bin --with-superuser-path=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin --with-4in6 --with-privsep-path=/var/run/sshd --without-rand-helper
+        cd build-udeb && $(FORCE_LIBS) ../configure --prefix=/usr --sysconfdir=/etc/ssh --libexecdir=/usr/lib/openssh --without-xauth --with-default-path=/usr/local/bin:/bin:/usr/bin --with-superuser-path=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin --with-4in6 --with-privsep-path=/var/run/sshd --without-rand-helper
         # Avoid libnsl linkage. Ugh.
         perl -pi -e 's/ +-lnsl//' build-udeb/config.status
         cd build-udeb && ./config.status
-        $(MAKE) -C build-udeb -j 2 ASKPASS_PROGRAM='/usr/bin/ssh-askpass' CFLAGS='-Os -g -Wall -DSSH_EXTRAVERSION="\" $(SSH_EXTRAVERSION)\""' SSH_KEYSIGN='/usr/lib/ssh-keysign' ssh scp sftp sshd ssh-keygen
+        $(MAKE) -C build-udeb -j 2 ASKPASS_PROGRAM='/usr/bin/ssh-askpass' CFLAGS='-Os -g -Wall -DSSH_EXTRAVERSION="\" $(SSH_EXTRAVERSION)\""' SSH_KEYSIGN='/usr/lib/openssh/ssh-keysign' ssh scp sftp sshd ssh-keygen
         touch build-udeb-stamp
 
 clean:
@@ -125,7 +125,7 @@ install: build
 
         # Split off the server.
         mv debian/openssh-client/usr/sbin/sshd debian/openssh-server/usr/sbin/
-        mv debian/openssh-client/usr/lib/sftp-server debian/openssh-server/usr/lib/
+        mv debian/openssh-client/usr/lib/openssh/sftp-server debian/openssh-server/usr/lib/openssh/
         mv debian/openssh-client/usr/share/man/man5/sshd_config.5 debian/openssh-server/usr/share/man/man5/
         mv debian/openssh-client/usr/share/man/man8/sshd.8 debian/openssh-server/usr/share/man/man8/
         mv debian/openssh-client/usr/share/man/man8/sftp-server.8 debian/openssh-server/usr/share/man/man8/
@@ -137,9 +137,9 @@ install: build
 
 ifneq ($(DEB_HOST_ARCH_OS),gnu)
         if [ -f contrib/gnome-ssh-askpass2 ]; then \
-                install -s -o root -g root -m 755 contrib/gnome-ssh-askpass2 debian/ssh-askpass-gnome/usr/lib/ssh/gnome-ssh-askpass; \
+                install -s -o root -g root -m 755 contrib/gnome-ssh-askpass2 debian/ssh-askpass-gnome/usr/lib/openssh/gnome-ssh-askpass; \
         elif [ -f contrib/gnome-ssh-askpass1 ]; then \
-                install -s -o root -g root -m 755 contrib/gnome-ssh-askpass1 debian/ssh-askpass-gnome/usr/lib/ssh/gnome-ssh-askpass; \
+                install -s -o root -g root -m 755 contrib/gnome-ssh-askpass1 debian/ssh-askpass-gnome/usr/lib/openssh/gnome-ssh-askpass; \
         fi
         install -m 644 debian/gnome-ssh-askpass.1 debian/ssh-askpass-gnome/usr/share/man/man1/gnome-ssh-askpass.1
         uudecode -o debian/ssh-askpass-gnome/usr/share/pixmaps/ssh-askpass-gnome.png debian/ssh-askpass-gnome.png.uue
diff --git a/debian/ssh-askpass-gnome.dirs b/debian/ssh-askpass-gnome.dirs
index e5d8d3904..8fdeef7ea 100644
--- a/debian/ssh-askpass-gnome.dirs
+++ b/debian/ssh-askpass-gnome.dirs
@@ -1,4 +1,4 @@
-usr/lib/ssh
+usr/lib/openssh
 usr/share/man/man1
 usr/share/applications
 usr/share/pixmaps
diff --git a/debian/ssh-askpass-gnome.postinst b/debian/ssh-askpass-gnome.postinst
index 7441cca29..15290b711 100644
--- a/debian/ssh-askpass-gnome.postinst
+++ b/debian/ssh-askpass-gnome.postinst
@@ -24,9 +24,14 @@ set -e
 
 case "$1" in
     configure)
+        if dpkg --compare-versions "$2" lt-nl 1:4.1p1-1; then
+            # libexecdir changed, so remove the obsolete alternative.
+            update-alternatives --quiet --remove ssh-askpass \
+                /usr/lib/ssh/gnome-ssh-askpass
+        fi
         update-alternatives --quiet \
             --install /usr/bin/ssh-askpass ssh-askpass \
-                      /usr/lib/ssh/gnome-ssh-askpass 30 \
+                      /usr/lib/openssh/gnome-ssh-askpass 30 \
             --slave /usr/share/man/man1/ssh-askpass.1.gz \
                     ssh-askpass.1.gz /usr/share/man/man1/gnome-ssh-askpass.1.gz
 
diff --git a/debian/ssh-askpass-gnome.prerm b/debian/ssh-askpass-gnome.prerm
index 6f3f5756d..e85f2d4a7 100644
--- a/debian/ssh-askpass-gnome.prerm
+++ b/debian/ssh-askpass-gnome.prerm
@@ -17,7 +17,7 @@ set -e
 
 case "$1" in
     remove|deconfigure)
-        update-alternatives --quiet --remove ssh-askpass /usr/lib/ssh/gnome-ssh-askpass
+        update-alternatives --quiet --remove ssh-askpass /usr/lib/openssh/gnome-ssh-askpass
 #       install-info --quiet --remove /usr/info/ssh-askpass.info.gz
         ;;
     upgrade)