31 files changed, 175 insertions, 130 deletions

diff --git a/auth-options.c b/auth-options.c
index b528c197a..ef57ebf43 100644
--- a/auth-options.c
+++ b/auth-options.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth-options.c,v 1.78 2018/03/14 05:35:40 djm Exp $ */
+/* $OpenBSD: auth-options.c,v 1.79 2018/04/06 04:15:45 djm Exp $ */
 /*
  * Copyright (c) 2018 Damien Miller <djm@mindrot.org>
  *
@@ -394,7 +394,7 @@ sshauthopt_parse(const char *opts, const char **errstrp)
                                 goto fail;
                         }
                         for (cp = opt; cp < tmp; cp++) {
-                                if (!isalnum((u_char)*cp)) {
+                                if (!isalnum((u_char)*cp) && *cp != '_') {
                                         free(opt);
                                         errstr = "invalid environment string";
                                         goto fail;
diff --git a/debian/.git-dpm b/debian/.git-dpm
index c57923b4d..0f4069a2f 100644
--- a/debian/.git-dpm
+++ b/debian/.git-dpm
@@ -1,6 +1,6 @@
 # see git-dpm(1) from git-dpm package
-ea67bc97339c9a507343e4a1f5fb867f678fbe1d
-ea67bc97339c9a507343e4a1f5fb867f678fbe1d
+60256f28189c3d0650a78e737eb0ca4753478a4b
+60256f28189c3d0650a78e737eb0ca4753478a4b
 ed6ae9c1a014a08ff5db3d768f01f2e427eeb476
 ed6ae9c1a014a08ff5db3d768f01f2e427eeb476
 openssh_7.7p1.orig.tar.gz
diff --git a/debian/changelog b/debian/changelog
index 51269fe0d..3bd1146a6 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -9,6 +9,10 @@ openssh (1:7.7p1-3) UNRELEASED; urgency=medium
   [ Juri Grabowski ]
   * Add rescue.target with ssh support.
 
+  [ Christian Ehrhardt ]
+  * Fix unintentional restriction of authorized keys environment options
+    to be alphanumeric (LP: #1771011)
+
  -- Colin Watson <cjwatson@debian.org>  Sat, 16 Jun 2018 12:42:36 +0100
 
 openssh (1:7.7p1-2) unstable; urgency=medium
diff --git a/debian/patches/authorized-keys-man-symlink.patch b/debian/patches/authorized-keys-man-symlink.patch
index 239c36f78..b5a1ea191 100644
--- a/debian/patches/authorized-keys-man-symlink.patch
+++ b/debian/patches/authorized-keys-man-symlink.patch
@@ -13,7 +13,7 @@ Patch-Name: authorized-keys-man-symlink.patch
  1 file changed, 1 insertion(+)
 
 diff --git a/Makefile.in b/Makefile.in
-index 6f3f042b..1afb4f79 100644
+index 6f3f042b1..1afb4f798 100644
 --- a/Makefile.in
 +++ b/Makefile.in
 @@ -352,6 +352,7 @@ install-files:
diff --git a/debian/patches/debian-banner.patch b/debian/patches/debian-banner.patch
index b1338d2c7..9062918f6 100644
--- a/debian/patches/debian-banner.patch
+++ b/debian/patches/debian-banner.patch
@@ -19,7 +19,7 @@ Patch-Name: debian-banner.patch
  4 files changed, 18 insertions(+), 1 deletion(-)
 
 diff --git a/servconf.c b/servconf.c
-index 3fff3d53..0a8f6fd6 100644
+index 3fff3d531..0a8f6fd62 100644
 --- a/servconf.c
 +++ b/servconf.c
 @@ -177,6 +177,7 @@ initialize_server_options(ServerOptions *options)
@@ -67,7 +67,7 @@ index 3fff3d53..0a8f6fd6 100644
         case sIgnore:
         case sUnsupported:
 diff --git a/servconf.h b/servconf.h
-index 5dfc9bc0..b0fa7045 100644
+index 5dfc9bc02..b0fa70455 100644
 --- a/servconf.h
 +++ b/servconf.h
 @@ -211,6 +211,8 @@ typedef struct {
@@ -80,7 +80,7 @@ index 5dfc9bc0..b0fa7045 100644
  
  /* Information about the incoming connection as used by Match */
 diff --git a/sshd.c b/sshd.c
-index 9a7f5495..1d645a17 100644
+index 9a7f5495c..1d645a170 100644
 --- a/sshd.c
 +++ b/sshd.c
 @@ -384,7 +384,8 @@ sshd_exchange_identification(struct ssh *ssh, int sock_in, int sock_out)
@@ -94,7 +94,7 @@ index 9a7f5495..1d645a17 100644
             options.version_addendum);
  
 diff --git a/sshd_config.5 b/sshd_config.5
-index 1a1c6dd0..45044a70 100644
+index 1a1c6dd09..45044a70f 100644
 --- a/sshd_config.5
 +++ b/sshd_config.5
 @@ -531,6 +531,11 @@ or
diff --git a/debian/patches/debian-config.patch b/debian/patches/debian-config.patch
index ebf5d23bc..be6d7df30 100644
--- a/debian/patches/debian-config.patch
+++ b/debian/patches/debian-config.patch
@@ -39,7 +39,7 @@ Patch-Name: debian-config.patch
  6 files changed, 77 insertions(+), 9 deletions(-)
 
 diff --git a/readconf.c b/readconf.c
-index 50349e23..efcf2d62 100644
+index 50349e238..efcf2d628 100644
 --- a/readconf.c
 +++ b/readconf.c
 @@ -1916,7 +1916,7 @@ fill_default_options(Options * options)
@@ -52,7 +52,7 @@ index 50349e23..efcf2d62 100644
                 options->forward_x11_timeout = 1200;
         /*
 diff --git a/ssh.1 b/ssh.1
-index f8fc26d2..8a03db95 100644
+index f8fc26d2a..8a03db952 100644
 --- a/ssh.1
 +++ b/ssh.1
 @@ -768,6 +768,16 @@ directive in
@@ -91,7 +91,7 @@ index f8fc26d2..8a03db95 100644
  Send log information using the
  .Xr syslog 3
 diff --git a/ssh_config b/ssh_config
-index bcb9f153..1b676fb2 100644
+index bcb9f153d..1b676fb2c 100644
 --- a/ssh_config
 +++ b/ssh_config
 @@ -17,9 +17,10 @@
@@ -114,7 +114,7 @@ index bcb9f153..1b676fb2 100644
 +    HashKnownHosts yes
 +    GSSAPIAuthentication yes
 diff --git a/ssh_config.5 b/ssh_config.5
-index ca052884..ed6e5d02 100644
+index ca0528842..ed6e5d026 100644
 --- a/ssh_config.5
 +++ b/ssh_config.5
 @@ -71,6 +71,22 @@ Since the first obtained value for each parameter is used, more
@@ -155,7 +155,7 @@ index ca052884..ed6e5d02 100644
  from stealing or tampering with data belonging to trusted X11
  clients.
 diff --git a/sshd_config b/sshd_config
-index 86263d71..de9cc9fe 100644
+index 86263d713..de9cc9fe2 100644
 --- a/sshd_config
 +++ b/sshd_config
 @@ -57,8 +57,9 @@ AuthorizedKeysFile    .ssh/authorized_keys
@@ -204,7 +204,7 @@ index 86263d71..de9cc9fe 100644
  # Example of overriding settings on a per-user basis
  #Match User anoncvs
 diff --git a/sshd_config.5 b/sshd_config.5
-index 44b91846..4c7ee425 100644
+index 44b918463..4c7ee4254 100644
 --- a/sshd_config.5
 +++ b/sshd_config.5
 @@ -56,6 +56,28 @@ Arguments may optionally be enclosed in double quotes
diff --git a/debian/patches/dnssec-sshfp.patch b/debian/patches/dnssec-sshfp.patch
index 0ba825f4e..6c2ebf173 100644
--- a/debian/patches/dnssec-sshfp.patch
+++ b/debian/patches/dnssec-sshfp.patch
@@ -18,7 +18,7 @@ Patch-Name: dnssec-sshfp.patch
  3 files changed, 21 insertions(+), 6 deletions(-)
 
 diff --git a/dns.c b/dns.c
-index ff1a2c41..82ec9719 100644
+index ff1a2c41c..82ec97199 100644
 --- a/dns.c
 +++ b/dns.c
 @@ -211,6 +211,7 @@ verify_host_key_dns(const char *hostname, struct sockaddr *address,
@@ -51,7 +51,7 @@ index ff1a2c41..82ec9719 100644
                 verbose("DNS lookup error: %s", dns_result_totext(result));
                 return -1;
 diff --git a/openbsd-compat/getrrsetbyname.c b/openbsd-compat/getrrsetbyname.c
-index dc6fe053..e061a290 100644
+index dc6fe0533..e061a290a 100644
 --- a/openbsd-compat/getrrsetbyname.c
 +++ b/openbsd-compat/getrrsetbyname.c
 @@ -209,8 +209,8 @@ getrrsetbyname(const char *hostname, unsigned int rdclass,
@@ -79,7 +79,7 @@ index dc6fe053..e061a290 100644
  
         /* make query */
 diff --git a/openbsd-compat/getrrsetbyname.h b/openbsd-compat/getrrsetbyname.h
-index 1283f550..dbbc85a2 100644
+index 1283f5506..dbbc85a2a 100644
 --- a/openbsd-compat/getrrsetbyname.h
 +++ b/openbsd-compat/getrrsetbyname.h
 @@ -72,6 +72,9 @@
diff --git a/debian/patches/doc-hash-tab-completion.patch b/debian/patches/doc-hash-tab-completion.patch
index 86f3a1fc4..599b8c0f6 100644
--- a/debian/patches/doc-hash-tab-completion.patch
+++ b/debian/patches/doc-hash-tab-completion.patch
@@ -13,7 +13,7 @@ Patch-Name: doc-hash-tab-completion.patch
  1 file changed, 3 insertions(+)
 
 diff --git a/ssh_config.5 b/ssh_config.5
-index 84dcd52c..ca052884 100644
+index 84dcd52cc..ca0528842 100644
 --- a/ssh_config.5
 +++ b/ssh_config.5
 @@ -784,6 +784,9 @@ Note that existing names and addresses in known hosts files
diff --git a/debian/patches/gnome-ssh-askpass2-icon.patch b/debian/patches/gnome-ssh-askpass2-icon.patch
index 2959854e4..3a4a5c896 100644
--- a/debian/patches/gnome-ssh-askpass2-icon.patch
+++ b/debian/patches/gnome-ssh-askpass2-icon.patch
@@ -12,7 +12,7 @@ Patch-Name: gnome-ssh-askpass2-icon.patch
  1 file changed, 2 insertions(+)
 
 diff --git a/contrib/gnome-ssh-askpass2.c b/contrib/gnome-ssh-askpass2.c
-index 535a6927..e37a1338 100644
+index 535a69274..e37a13382 100644
 --- a/contrib/gnome-ssh-askpass2.c
 +++ b/contrib/gnome-ssh-askpass2.c
 @@ -211,6 +211,8 @@ main(int argc, char **argv)
diff --git a/debian/patches/gssapi.patch b/debian/patches/gssapi.patch
index a67ebced0..d47b0a796 100644
--- a/debian/patches/gssapi.patch
+++ b/debian/patches/gssapi.patch
@@ -21,37 +21,37 @@ Last-Updated: 2017-10-04
 
 Patch-Name: gssapi.patch
 ---
- ChangeLog.gssapi | 113 +++++++++++++++++++
+ ChangeLog.gssapi | 113 ++++++++++++++++
  Makefile.in      |   3 +-
  auth-krb5.c      |  17 ++-
- auth.c           |  96 +---------------
- auth2-gss.c      |  49 +++++++-
+ auth.c           |  96 +-------------
+ auth2-gss.c      |  49 ++++++-
  auth2.c          |   2 +
- canohost.c       |  93 +++++++++++++++
+ canohost.c       |  93 +++++++++++++
  canohost.h       |   3 +
  clientloop.c     |  15 ++-
  config.h.in      |   6 +
  configure.ac     |  24 ++++
- gss-genr.c       | 275 +++++++++++++++++++++++++++++++++++++++++++-
- gss-serv-krb5.c  |  85 ++++++++++++--
- gss-serv.c       | 184 +++++++++++++++++++++++++++---
- kex.c            |  19 ++++
- kex.h            |  14 +++
- kexgssc.c        | 338 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
- kexgsss.c        | 295 ++++++++++++++++++++++++++++++++++++++++++++++++
- monitor.c        | 115 +++++++++++++++++--
+ gss-genr.c       | 275 +++++++++++++++++++++++++++++++++++++-
+ gss-serv-krb5.c  |  85 +++++++++++-
+ gss-serv.c       | 184 ++++++++++++++++++++++++--
+ kex.c            |  19 +++
+ kex.h            |  14 ++
+ kexgssc.c        | 338 +++++++++++++++++++++++++++++++++++++++++++++++
+ kexgsss.c        | 295 +++++++++++++++++++++++++++++++++++++++++
+ monitor.c        | 115 ++++++++++++++--
  monitor.h        |   3 +
- monitor_wrap.c   |  47 +++++++-
+ monitor_wrap.c   |  47 ++++++-
  monitor_wrap.h   |   4 +-
- readconf.c       |  43 +++++++
+ readconf.c       |  43 ++++++
  readconf.h       |   5 +
- servconf.c       |  26 +++++
+ servconf.c       |  26 ++++
  servconf.h       |   2 +
- ssh-gss.h        |  41 ++++++-
+ ssh-gss.h        |  41 +++++-
  ssh_config       |   2 +
- ssh_config.5     |  32 ++++++
- sshconnect2.c    | 131 ++++++++++++++++++++-
- sshd.c           | 112 +++++++++++++++++-
+ ssh_config.5     |  32 +++++
+ sshconnect2.c    | 131 +++++++++++++++++-
+ sshd.c           | 112 +++++++++++++++-
  sshd_config      |   2 +
  sshd_config.5    |  10 ++
  sshkey.c         |   3 +-
@@ -63,7 +63,7 @@ Patch-Name: gssapi.patch
 
 diff --git a/ChangeLog.gssapi b/ChangeLog.gssapi
 new file mode 100644
-index 00000000..f117a336
+index 000000000..f117a336a
 --- /dev/null
 +++ b/ChangeLog.gssapi
 @@ -0,0 +1,113 @@
@@ -181,7 +181,7 @@ index 00000000..f117a336
 +    (from jbasney AT ncsa.uiuc.edu)
 +    <gssapi-with-mic support is Bugzilla #1008>
 diff --git a/Makefile.in b/Makefile.in
-index 04e1c8e5..6f3f042b 100644
+index 04e1c8e53..6f3f042b1 100644
 --- a/Makefile.in
 +++ b/Makefile.in
 @@ -100,6 +100,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
@@ -202,7 +202,7 @@ index 04e1c8e5..6f3f042b 100644
         sftp-server.o sftp-common.o \
         sandbox-null.o sandbox-rlimit.o sandbox-systrace.o sandbox-darwin.o \
 diff --git a/auth-krb5.c b/auth-krb5.c
-index a5a81ed2..38e7fee2 100644
+index a5a81ed2e..38e7fee21 100644
 --- a/auth-krb5.c
 +++ b/auth-krb5.c
 @@ -182,8 +182,13 @@ auth_krb5_password(Authctxt *authctxt, const char *password)
@@ -253,7 +253,7 @@ index a5a81ed2..38e7fee2 100644
         return (krb5_cc_resolve(ctx, ccname, ccache));
  }
 diff --git a/auth.c b/auth.c
-index 63366768..76d586e3 100644
+index 63366768a..76d586e31 100644
 --- a/auth.c
 +++ b/auth.c
 @@ -396,7 +396,8 @@ auth_root_allowed(struct ssh *ssh, const char *method)
@@ -367,7 +367,7 @@ index 63366768..76d586e3 100644
   * Return the canonical name of the host in the other side of the current
   * connection.  The host name is cached, so it is efficient to call this
 diff --git a/auth2-gss.c b/auth2-gss.c
-index 589283b7..fd411d3a 100644
+index 589283b72..fd411d3a7 100644
 --- a/auth2-gss.c
 +++ b/auth2-gss.c
 @@ -1,7 +1,7 @@
@@ -455,7 +455,7 @@ index 589283b7..fd411d3a 100644
         "gssapi-with-mic",
         userauth_gssapi,
 diff --git a/auth2.c b/auth2.c
-index e0034229..c34f58c4 100644
+index e0034229a..c34f58c45 100644
 --- a/auth2.c
 +++ b/auth2.c
 @@ -72,6 +72,7 @@ extern Authmethod method_passwd;
@@ -475,7 +475,7 @@ index e0034229..c34f58c4 100644
  #endif
         &method_passwd,
 diff --git a/canohost.c b/canohost.c
-index f71a0856..404731d2 100644
+index f71a08568..404731d24 100644
 --- a/canohost.c
 +++ b/canohost.c
 @@ -35,6 +35,99 @@
@@ -579,7 +579,7 @@ index f71a0856..404731d2 100644
  ipv64_normalise_mapped(struct sockaddr_storage *addr, socklen_t *len)
  {
 diff --git a/canohost.h b/canohost.h
-index 26d62855..0cadc9f1 100644
+index 26d62855a..0cadc9f18 100644
 --- a/canohost.h
 +++ b/canohost.h
 @@ -15,6 +15,9 @@
@@ -593,7 +593,7 @@ index 26d62855..0cadc9f1 100644
  int             get_peer_port(int);
  char           *get_local_ipaddr(int);
 diff --git a/clientloop.c b/clientloop.c
-index 7bcf22e3..ef803e98 100644
+index 7bcf22e38..ef803e985 100644
 --- a/clientloop.c
 +++ b/clientloop.c
 @@ -112,6 +112,10 @@
@@ -628,7 +628,7 @@ index 7bcf22e3..ef803e98 100644
                 client_process_net_input(readset);
  
 diff --git a/config.h.in b/config.h.in
-index 57208740..4c9545c7 100644
+index 572087407..4c9545c78 100644
 --- a/config.h.in
 +++ b/config.h.in
 @@ -1746,6 +1746,9 @@
@@ -652,7 +652,7 @@ index 57208740..4c9545c7 100644
  #undef USE_SOLARIS_PRIVS
  
 diff --git a/configure.ac b/configure.ac
-index 663062be..1cd5eab6 100644
+index 663062bef..1cd5eab6c 100644
 --- a/configure.ac
 +++ b/configure.ac
 @@ -664,6 +664,30 @@ main() { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
@@ -687,7 +687,7 @@ index 663062be..1cd5eab6 100644
         AC_CHECK_DECL([AU_IPv4], [],
             AC_DEFINE([AU_IPv4], [0], [System only supports IPv4 audit records])
 diff --git a/gss-genr.c b/gss-genr.c
-index 62559ed9..0b3ae073 100644
+index 62559ed9e..0b3ae073c 100644
 --- a/gss-genr.c
 +++ b/gss-genr.c
 @@ -1,7 +1,7 @@
@@ -1038,7 +1038,7 @@ index 62559ed9..0b3ae073 100644
 +
  #endif /* GSSAPI */
 diff --git a/gss-serv-krb5.c b/gss-serv-krb5.c
-index 795992d9..fd8b3718 100644
+index 795992d9f..fd8b37183 100644
 --- a/gss-serv-krb5.c
 +++ b/gss-serv-krb5.c
 @@ -1,7 +1,7 @@
@@ -1164,7 +1164,7 @@ index 795992d9..fd8b3718 100644
  
  #endif /* KRB5 */
 diff --git a/gss-serv.c b/gss-serv.c
-index 6cae720e..967c6cfb 100644
+index 6cae720e5..967c6cfbc 100644
 --- a/gss-serv.c
 +++ b/gss-serv.c
 @@ -1,7 +1,7 @@
@@ -1435,7 +1435,7 @@ index 6cae720e..967c6cfb 100644
  
  /* Privileged */
 diff --git a/kex.c b/kex.c
-index 15ea28b0..6cc2935f 100644
+index 15ea28b07..6cc2935fe 100644
 --- a/kex.c
 +++ b/kex.c
 @@ -54,6 +54,10 @@
@@ -1486,7 +1486,7 @@ index 15ea28b0..6cc2935f 100644
         free(kex->server_version_string);
         free(kex->failed_choice);
 diff --git a/kex.h b/kex.h
-index 01bb3986..a708e486 100644
+index 01bb3986a..a708e4868 100644
 --- a/kex.h
 +++ b/kex.h
 @@ -99,6 +99,9 @@ enum kex_exchange {
@@ -1526,7 +1526,7 @@ index 01bb3986..a708e486 100644
      const BIGNUM *, const BIGNUM *, const BIGNUM *, u_char *, size_t *);
 diff --git a/kexgssc.c b/kexgssc.c
 new file mode 100644
-index 00000000..10447f2b
+index 000000000..10447f2b0
 --- /dev/null
 +++ b/kexgssc.c
 @@ -0,0 +1,338 @@
@@ -1870,7 +1870,7 @@ index 00000000..10447f2b
 +#endif /* GSSAPI */
 diff --git a/kexgsss.c b/kexgsss.c
 new file mode 100644
-index 00000000..38ca082b
+index 000000000..38ca082ba
 --- /dev/null
 +++ b/kexgsss.c
 @@ -0,0 +1,295 @@
@@ -2170,7 +2170,7 @@ index 00000000..38ca082b
 +}
 +#endif /* GSSAPI */
 diff --git a/monitor.c b/monitor.c
-index c68e1b0d..868fb0d2 100644
+index c68e1b0d9..868fb0d2d 100644
 --- a/monitor.c
 +++ b/monitor.c
 @@ -158,6 +158,8 @@ int mm_answer_gss_setup_ctx(int, Buffer *);
@@ -2371,7 +2371,7 @@ index c68e1b0d..868fb0d2 100644
  #endif /* GSSAPI */
  
 diff --git a/monitor.h b/monitor.h
-index d68f6745..ec41404c 100644
+index d68f67458..ec41404c7 100644
 --- a/monitor.h
 +++ b/monitor.h
 @@ -65,6 +65,9 @@ enum monitor_reqtype {
@@ -2385,7 +2385,7 @@ index d68f6745..ec41404c 100644
  
  struct monitor {
 diff --git a/monitor_wrap.c b/monitor_wrap.c
-index 9666bda4..e749efc1 100644
+index 9666bda4b..e749efc18 100644
 --- a/monitor_wrap.c
 +++ b/monitor_wrap.c
 @@ -943,7 +943,7 @@ mm_ssh_gssapi_checkmic(Gssctxt *ctx, gss_buffer_t gssbuf, gss_buffer_t gssmic)
@@ -2449,7 +2449,7 @@ index 9666bda4..e749efc1 100644
  #endif /* GSSAPI */
  
 diff --git a/monitor_wrap.h b/monitor_wrap.h
-index 76233270..0970d1f8 100644
+index 762332704..0970d1f87 100644
 --- a/monitor_wrap.h
 +++ b/monitor_wrap.h
 @@ -60,8 +60,10 @@ int mm_sshkey_verify(const struct sshkey *, const u_char *, size_t,
@@ -2465,7 +2465,7 @@ index 76233270..0970d1f8 100644
  
  #ifdef USE_PAM
 diff --git a/readconf.c b/readconf.c
-index 88051db5..c8e79299 100644
+index 88051db57..c8e792991 100644
 --- a/readconf.c
 +++ b/readconf.c
 @@ -160,6 +160,8 @@ typedef enum {
@@ -2558,7 +2558,7 @@ index 88051db5..c8e79299 100644
                 options->password_authentication = 1;
         if (options->kbd_interactive_authentication == -1)
 diff --git a/readconf.h b/readconf.h
-index f4d9e2b2..f469daaf 100644
+index f4d9e2b26..f469daaff 100644
 --- a/readconf.h
 +++ b/readconf.h
 @@ -42,7 +42,12 @@ typedef struct {
@@ -2575,7 +2575,7 @@ index f4d9e2b2..f469daaf 100644
                                                  * authentication. */
         int     kbd_interactive_authentication; /* Try keyboard-interactive auth. */
 diff --git a/servconf.c b/servconf.c
-index 0f0d0906..cbbea05b 100644
+index 0f0d09068..cbbea05bf 100644
 --- a/servconf.c
 +++ b/servconf.c
 @@ -123,8 +123,10 @@ initialize_server_options(ServerOptions *options)
@@ -2667,7 +2667,7 @@ index 0f0d0906..cbbea05b 100644
         dump_cfg_fmtint(sPasswordAuthentication, o->password_authentication);
         dump_cfg_fmtint(sKbdInteractiveAuthentication,
 diff --git a/servconf.h b/servconf.h
-index 37a0fb1a..5dfc9bc0 100644
+index 37a0fb1a3..5dfc9bc02 100644
 --- a/servconf.h
 +++ b/servconf.h
 @@ -130,8 +130,10 @@ typedef struct {
@@ -2682,7 +2682,7 @@ index 37a0fb1a..5dfc9bc0 100644
                                                  * authentication. */
         int     kbd_interactive_authentication; /* If true, permit */
 diff --git a/ssh-gss.h b/ssh-gss.h
-index 6593e422..919660a0 100644
+index 6593e422d..919660a03 100644
 --- a/ssh-gss.h
 +++ b/ssh-gss.h
 @@ -1,6 +1,6 @@
@@ -2786,7 +2786,7 @@ index 6593e422..919660a0 100644
  
  #endif /* _SSH_GSS_H */
 diff --git a/ssh_config b/ssh_config
-index c12f5ef5..bcb9f153 100644
+index c12f5ef52..bcb9f153d 100644
 --- a/ssh_config
 +++ b/ssh_config
 @@ -24,6 +24,8 @@
@@ -2799,7 +2799,7 @@ index c12f5ef5..bcb9f153 100644
  #   CheckHostIP yes
  #   AddressFamily any
 diff --git a/ssh_config.5 b/ssh_config.5
-index 71705cab..66826aa7 100644
+index 71705cabd..66826aa70 100644
 --- a/ssh_config.5
 +++ b/ssh_config.5
 @@ -727,10 +727,42 @@ The default is
@@ -2846,7 +2846,7 @@ index 71705cab..66826aa7 100644
  Indicates that
  .Xr ssh 1
 diff --git a/sshconnect2.c b/sshconnect2.c
-index 1f4a74cf..83562c68 100644
+index 1f4a74cf4..83562c688 100644
 --- a/sshconnect2.c
 +++ b/sshconnect2.c
 @@ -162,6 +162,11 @@ ssh_kex2(char *host, struct sockaddr *hostaddr, u_short port)
@@ -3063,7 +3063,7 @@ index 1f4a74cf..83562c68 100644
  
  int
 diff --git a/sshd.c b/sshd.c
-index fd95b681..e88185ef 100644
+index fd95b681b..e88185efa 100644
 --- a/sshd.c
 +++ b/sshd.c
 @@ -123,6 +123,10 @@
@@ -3225,7 +3225,7 @@ index fd95b681..e88185ef 100644
         kex->client_version_string=client_version_string;
         kex->server_version_string=server_version_string;
 diff --git a/sshd_config b/sshd_config
-index 3109d5d7..86263d71 100644
+index 3109d5d73..86263d713 100644
 --- a/sshd_config
 +++ b/sshd_config
 @@ -69,6 +69,8 @@ AuthorizedKeysFile    .ssh/authorized_keys
@@ -3238,7 +3238,7 @@ index 3109d5d7..86263d71 100644
  # Set this to 'yes' to enable PAM authentication, account processing,
  # and session processing. If this is enabled, PAM authentication will
 diff --git a/sshd_config.5 b/sshd_config.5
-index e3c7c393..c4a3f3cb 100644
+index e3c7c3936..c4a3f3cb2 100644
 --- a/sshd_config.5
 +++ b/sshd_config.5
 @@ -636,6 +636,11 @@ The default is
@@ -3266,7 +3266,7 @@ index e3c7c393..c4a3f3cb 100644
  Specifies the key types that will be accepted for hostbased authentication
  as a comma-separated pattern list.
 diff --git a/sshkey.c b/sshkey.c
-index 7712fba2..08887286 100644
+index 7712fba23..088872860 100644
 --- a/sshkey.c
 +++ b/sshkey.c
 @@ -122,6 +122,7 @@ static const struct keytype keytypes[] = {
@@ -3287,7 +3287,7 @@ index 7712fba2..08887286 100644
                 if (!include_sigonly && kt->sigonly)
                         continue;
 diff --git a/sshkey.h b/sshkey.h
-index 155cd45a..4e89049f 100644
+index 155cd45ae..4e89049f1 100644
 --- a/sshkey.h
 +++ b/sshkey.h
 @@ -63,6 +63,7 @@ enum sshkey_types {
diff --git a/debian/patches/keepalive-extensions.patch b/debian/patches/keepalive-extensions.patch
index 68fa28e5c..b75b82068 100644
--- a/debian/patches/keepalive-extensions.patch
+++ b/debian/patches/keepalive-extensions.patch
@@ -26,7 +26,7 @@ Patch-Name: keepalive-extensions.patch
  3 files changed, 34 insertions(+), 4 deletions(-)
 
 diff --git a/readconf.c b/readconf.c
-index 1f1be778..7f2b5c17 100644
+index 1f1be7789..7f2b5c172 100644
 --- a/readconf.c
 +++ b/readconf.c
 @@ -174,6 +174,7 @@ typedef enum {
@@ -72,7 +72,7 @@ index 1f1be778..7f2b5c17 100644
                 options->server_alive_count_max = 3;
         if (options->control_master == -1)
 diff --git a/ssh_config.5 b/ssh_config.5
-index 66826aa7..32c3632c 100644
+index 66826aa70..32c3632c7 100644
 --- a/ssh_config.5
 +++ b/ssh_config.5
 @@ -247,8 +247,12 @@ Valid arguments are
@@ -119,7 +119,7 @@ index 66826aa7..32c3632c 100644
  connections will die if the route is down temporarily, and some people
  find it annoying.
 diff --git a/sshd_config.5 b/sshd_config.5
-index c4a3f3cb..1a1c6dd0 100644
+index c4a3f3cb2..1a1c6dd09 100644
 --- a/sshd_config.5
 +++ b/sshd_config.5
 @@ -1495,6 +1495,9 @@ This avoids infinitely hanging sessions.
diff --git a/debian/patches/mention-ssh-keygen-on-keychange.patch b/debian/patches/mention-ssh-keygen-on-keychange.patch
index 542b42ae9..95c235b32 100644
--- a/debian/patches/mention-ssh-keygen-on-keychange.patch
+++ b/debian/patches/mention-ssh-keygen-on-keychange.patch
@@ -14,7 +14,7 @@ Patch-Name: mention-ssh-keygen-on-keychange.patch
  1 file changed, 8 insertions(+), 1 deletion(-)
 
 diff --git a/sshconnect.c b/sshconnect.c
-index 8ab01c0e..58f9eac8 100644
+index 8ab01c0ef..58f9eac8a 100644
 --- a/sshconnect.c
 +++ b/sshconnect.c
 @@ -1141,9 +1141,13 @@ check_host_key(char *hostname, struct sockaddr *hostaddr, u_short port,
diff --git a/debian/patches/no-openssl-version-status.patch b/debian/patches/no-openssl-version-status.patch
index f6646ca20..c7b57a428 100644
--- a/debian/patches/no-openssl-version-status.patch
+++ b/debian/patches/no-openssl-version-status.patch
@@ -23,7 +23,7 @@ Patch-Name: no-openssl-version-status.patch
  2 files changed, 4 insertions(+), 3 deletions(-)
 
 diff --git a/openbsd-compat/openssl-compat.c b/openbsd-compat/openssl-compat.c
-index 259fccbe..aaa953f2 100644
+index 259fccbec..aaa953f2d 100644
 --- a/openbsd-compat/openssl-compat.c
 +++ b/openbsd-compat/openssl-compat.c
 @@ -34,7 +34,7 @@
@@ -49,7 +49,7 @@ index 259fccbe..aaa953f2 100644
         lfix = (libver & 0x000ff000) >> 12;
         if ( (headerver & mask) == (libver & mask) && lfix >= hfix)
 diff --git a/openbsd-compat/regress/opensslvertest.c b/openbsd-compat/regress/opensslvertest.c
-index 5d019b59..58474873 100644
+index 5d019b598..58474873d 100644
 --- a/openbsd-compat/regress/opensslvertest.c
 +++ b/openbsd-compat/regress/opensslvertest.c
 @@ -35,6 +35,7 @@ struct version_test {
diff --git a/debian/patches/openbsd-docs.patch b/debian/patches/openbsd-docs.patch
index a9e8aac29..89bd0a3bd 100644
--- a/debian/patches/openbsd-docs.patch
+++ b/debian/patches/openbsd-docs.patch
@@ -22,7 +22,7 @@ Patch-Name: openbsd-docs.patch
  5 files changed, 13 insertions(+), 15 deletions(-)
 
 diff --git a/moduli.5 b/moduli.5
-index ef0de085..149846c8 100644
+index ef0de0850..149846c8c 100644
 --- a/moduli.5
 +++ b/moduli.5
 @@ -21,7 +21,7 @@
@@ -44,7 +44,7 @@ index ef0de085..149846c8 100644
  .Sh SEE ALSO
  .Xr ssh-keygen 1 ,
 diff --git a/ssh-keygen.1 b/ssh-keygen.1
-index 3525d7d1..39767e62 100644
+index 3525d7d17..39767e621 100644
 --- a/ssh-keygen.1
 +++ b/ssh-keygen.1
 @@ -176,9 +176,7 @@ key in
@@ -88,7 +88,7 @@ index 3525d7d1..39767e62 100644
  The file format is described in
  .Xr moduli 5 .
 diff --git a/ssh.1 b/ssh.1
-index 0ef7c170..54e21d88 100644
+index 0ef7c1709..54e21d88a 100644
 --- a/ssh.1
 +++ b/ssh.1
 @@ -846,6 +846,10 @@ implements public key authentication protocol automatically,
@@ -103,7 +103,7 @@ index 0ef7c170..54e21d88 100644
  .Pp
  The file
 diff --git a/sshd.8 b/sshd.8
-index c8299d5e..378aeb9f 100644
+index c8299d5e5..378aeb9f5 100644
 --- a/sshd.8
 +++ b/sshd.8
 @@ -65,7 +65,7 @@ over an insecure network.
@@ -133,7 +133,7 @@ index c8299d5e..378aeb9f 100644
  .Xr sshd_config 5 ,
  .Xr inetd 8 ,
 diff --git a/sshd_config.5 b/sshd_config.5
-index 45044a70..44b91846 100644
+index 45044a70f..44b918463 100644
 --- a/sshd_config.5
 +++ b/sshd_config.5
 @@ -383,8 +383,7 @@ then no banner is displayed.
diff --git a/debian/patches/package-versioning.patch b/debian/patches/package-versioning.patch
index db144f505..c95f06568 100644
--- a/debian/patches/package-versioning.patch
+++ b/debian/patches/package-versioning.patch
@@ -19,7 +19,7 @@ Patch-Name: package-versioning.patch
  3 files changed, 8 insertions(+), 3 deletions(-)
 
 diff --git a/sshconnect.c b/sshconnect.c
-index 58f9eac8..15d8b807 100644
+index 58f9eac8a..15d8b807e 100644
 --- a/sshconnect.c
 +++ b/sshconnect.c
 @@ -638,7 +638,7 @@ send_client_banner(int connection_out, int minor1)
@@ -32,7 +32,7 @@ index 58f9eac8..15d8b807 100644
             strlen(client_version_string)) != strlen(client_version_string))
                 fatal("write: %.100s", strerror(errno));
 diff --git a/sshd.c b/sshd.c
-index 6d911c19..9a7f5495 100644
+index 6d911c19a..9a7f5495c 100644
 --- a/sshd.c
 +++ b/sshd.c
 @@ -384,7 +384,7 @@ sshd_exchange_identification(struct ssh *ssh, int sock_in, int sock_out)
@@ -45,7 +45,7 @@ index 6d911c19..9a7f5495 100644
             options.version_addendum);
  
 diff --git a/version.h b/version.h
-index ea52b26f..a3fa6e0b 100644
+index ea52b26f5..a3fa6e0b9 100644
 --- a/version.h
 +++ b/version.h
 @@ -3,4 +3,9 @@
diff --git a/debian/patches/restore-authorized_keys2.patch b/debian/patches/restore-authorized_keys2.patch
index 2e680f5ce..366c41655 100644
--- a/debian/patches/restore-authorized_keys2.patch
+++ b/debian/patches/restore-authorized_keys2.patch
@@ -18,7 +18,7 @@ Patch-Name: restore-authorized_keys2.patch
  1 file changed, 2 insertions(+), 3 deletions(-)
 
 diff --git a/sshd_config b/sshd_config
-index de9cc9fe..31e14a4f 100644
+index de9cc9fe2..31e14a4f0 100644
 --- a/sshd_config
 +++ b/sshd_config
 @@ -36,9 +36,8 @@
diff --git a/debian/patches/restore-tcp-wrappers.patch b/debian/patches/restore-tcp-wrappers.patch
index 4132937da..fccd130b8 100644
--- a/debian/patches/restore-tcp-wrappers.patch
+++ b/debian/patches/restore-tcp-wrappers.patch
@@ -22,13 +22,13 @@ Last-Update: 2014-10-07
 
 Patch-Name: restore-tcp-wrappers.patch
 ---
- configure.ac | 57 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ configure.ac | 57 ++++++++++++++++++++++++++++++++++++++++++++++++++++
  sshd.8       |  7 +++++++
- sshd.c       | 25 +++++++++++++++++++++++++
+ sshd.c       | 25 +++++++++++++++++++++++
  3 files changed, 89 insertions(+)
 
 diff --git a/configure.ac b/configure.ac
-index 1cd5eab6..3e23e60d 100644
+index 1cd5eab6c..3e23e60d6 100644
 --- a/configure.ac
 +++ b/configure.ac
 @@ -1566,6 +1566,62 @@ AC_ARG_WITH([skey],
@@ -103,7 +103,7 @@ index 1cd5eab6..3e23e60d 100644
  echo "                   libedit support: $LIBEDIT_MSG"
  echo "                   libldns support: $LDNS_MSG"
 diff --git a/sshd.8 b/sshd.8
-index 968ba66b..c8299d5e 100644
+index 968ba66bb..c8299d5e5 100644
 --- a/sshd.8
 +++ b/sshd.8
 @@ -845,6 +845,12 @@ the user's home directory becomes accessible.
@@ -128,7 +128,7 @@ index 968ba66b..c8299d5e 100644
  .Xr moduli 5 ,
  .Xr sshd_config 5 ,
 diff --git a/sshd.c b/sshd.c
-index e88185ef..4ed0364f 100644
+index e88185efa..4ed0364f2 100644
 --- a/sshd.c
 +++ b/sshd.c
 @@ -127,6 +127,13 @@
diff --git a/debian/patches/scp-quoting.patch b/debian/patches/scp-quoting.patch
index d969d5e8e..18c7155e4 100644
--- a/debian/patches/scp-quoting.patch
+++ b/debian/patches/scp-quoting.patch
@@ -17,7 +17,7 @@ Patch-Name: scp-quoting.patch
  1 file changed, 10 insertions(+), 2 deletions(-)
 
 diff --git a/scp.c b/scp.c
-index 31e6709f..2bbf6938 100644
+index 31e6709fb..2bbf6938e 100644
 --- a/scp.c
 +++ b/scp.c
 @@ -198,8 +198,16 @@ do_local_cmd(arglist *a)
diff --git a/debian/patches/seccomp-getuid-geteuid.patch b/debian/patches/seccomp-getuid-geteuid.patch
index 293322e9c..be4921ae4 100644
--- a/debian/patches/seccomp-getuid-geteuid.patch
+++ b/debian/patches/seccomp-getuid-geteuid.patch
@@ -20,7 +20,7 @@ Patch-Name: seccomp-getuid-geteuid.patch
  1 file changed, 12 insertions(+)
 
 diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
-index 6e7de311..e86aa2c9 100644
+index 6e7de3114..e86aa2c91 100644
 --- a/sandbox-seccomp-filter.c
 +++ b/sandbox-seccomp-filter.c
 @@ -175,6 +175,18 @@ static const struct sock_filter preauth_insns[] = {
diff --git a/debian/patches/seccomp-s390-flock-ipc.patch b/debian/patches/seccomp-s390-flock-ipc.patch
index 030d8f417..b62d0195c 100644
--- a/debian/patches/seccomp-s390-flock-ipc.patch
+++ b/debian/patches/seccomp-s390-flock-ipc.patch
@@ -22,7 +22,7 @@ Patch-Name: seccomp-s390-flock-ipc.patch
  1 file changed, 6 insertions(+)
 
 diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
-index ca75cc71..6e7de311 100644
+index ca75cc719..6e7de3114 100644
 --- a/sandbox-seccomp-filter.c
 +++ b/sandbox-seccomp-filter.c
 @@ -166,6 +166,9 @@ static const struct sock_filter preauth_insns[] = {
diff --git a/debian/patches/seccomp-s390-ioctl-ep11-crypto.patch b/debian/patches/seccomp-s390-ioctl-ep11-crypto.patch
index 77606886d..dd0f6510c 100644
--- a/debian/patches/seccomp-s390-ioctl-ep11-crypto.patch
+++ b/debian/patches/seccomp-s390-ioctl-ep11-crypto.patch
@@ -19,7 +19,7 @@ Patch-Name: seccomp-s390-ioctl-ep11-crypto.patch
  1 file changed, 2 insertions(+)
 
 diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
-index e86aa2c9..98062f15 100644
+index e86aa2c91..98062f152 100644
 --- a/sandbox-seccomp-filter.c
 +++ b/sandbox-seccomp-filter.c
 @@ -250,6 +250,8 @@ static const struct sock_filter preauth_insns[] = {
diff --git a/debian/patches/selinux-role.patch b/debian/patches/selinux-role.patch
index 5662207cd..5c0bad093 100644
--- a/debian/patches/selinux-role.patch
+++ b/debian/patches/selinux-role.patch
@@ -31,7 +31,7 @@ Patch-Name: selinux-role.patch
  15 files changed, 97 insertions(+), 30 deletions(-)
 
 diff --git a/auth.h b/auth.h
-index 23ce67ca..15ba7073 100644
+index 23ce67caf..15ba7073e 100644
 --- a/auth.h
 +++ b/auth.h
 @@ -65,6 +65,7 @@ struct Authctxt {
@@ -43,7 +43,7 @@ index 23ce67ca..15ba7073 100644
         /* Method lists for multiple authentication */
         char            **auth_methods; /* modified from server config */
 diff --git a/auth2.c b/auth2.c
-index c34f58c4..be5e9f15 100644
+index c34f58c45..be5e9f15f 100644
 --- a/auth2.c
 +++ b/auth2.c
 @@ -218,7 +218,7 @@ input_userauth_request(int type, u_int32_t seq, struct ssh *ssh)
@@ -81,7 +81,7 @@ index c34f58c4..be5e9f15 100644
                 if (auth2_setup_methods_lists(authctxt) != 0)
                         packet_disconnect("no authentication methods enabled");
 diff --git a/monitor.c b/monitor.c
-index 868fb0d2..ed37458f 100644
+index 868fb0d2d..ed37458fb 100644
 --- a/monitor.c
 +++ b/monitor.c
 @@ -128,6 +128,7 @@ int mm_answer_sign(int, Buffer *);
@@ -158,7 +158,7 @@ index 868fb0d2..ed37458f 100644
         buffer_put_int(m, 1);
         buffer_put_cstring(m, s->tty);
 diff --git a/monitor.h b/monitor.h
-index ec41404c..4c7955d7 100644
+index ec41404c7..4c7955d7a 100644
 --- a/monitor.h
 +++ b/monitor.h
 @@ -68,6 +68,8 @@ enum monitor_reqtype {
@@ -171,7 +171,7 @@ index ec41404c..4c7955d7 100644
  
  struct monitor {
 diff --git a/monitor_wrap.c b/monitor_wrap.c
-index e749efc1..7b2d06c6 100644
+index e749efc18..7b2d06c65 100644
 --- a/monitor_wrap.c
 +++ b/monitor_wrap.c
 @@ -331,10 +331,10 @@ mm_auth2_read_banner(void)
@@ -219,7 +219,7 @@ index e749efc1..7b2d06c6 100644
  int
  mm_auth_password(struct ssh *ssh, char *password)
 diff --git a/monitor_wrap.h b/monitor_wrap.h
-index 0970d1f8..492de5c8 100644
+index 0970d1f87..492de5c85 100644
 --- a/monitor_wrap.h
 +++ b/monitor_wrap.h
 @@ -43,7 +43,8 @@ int mm_is_monitor(void);
@@ -233,7 +233,7 @@ index 0970d1f8..492de5c8 100644
  char *mm_auth2_read_banner(void);
  int mm_auth_password(struct ssh *, char *);
 diff --git a/openbsd-compat/port-linux.c b/openbsd-compat/port-linux.c
-index 8c5325cc..8a3e5c68 100644
+index 8c5325cc3..8a3e5c68d 100644
 --- a/openbsd-compat/port-linux.c
 +++ b/openbsd-compat/port-linux.c
 @@ -27,6 +27,12 @@
@@ -314,7 +314,7 @@ index 8c5325cc..8a3e5c68 100644
         /* XXX: should these calls fatal() upon failure in enforcing mode? */
  
 diff --git a/openbsd-compat/port-linux.h b/openbsd-compat/port-linux.h
-index 3c22a854..c8812942 100644
+index 3c22a854d..c88129428 100644
 --- a/openbsd-compat/port-linux.h
 +++ b/openbsd-compat/port-linux.h
 @@ -19,8 +19,8 @@
@@ -329,7 +329,7 @@ index 3c22a854..c8812942 100644
  void ssh_selinux_setfscreatecon(const char *);
  #endif
 diff --git a/platform.c b/platform.c
-index 18c7751d..380ee3a4 100644
+index 18c7751de..380ee3a41 100644
 --- a/platform.c
 +++ b/platform.c
 @@ -143,7 +143,7 @@ platform_setusercontext(struct passwd *pw)
@@ -351,7 +351,7 @@ index 18c7751d..380ee3a4 100644
  }
  
 diff --git a/platform.h b/platform.h
-index ea4f9c58..60d72ffe 100644
+index ea4f9c584..60d72ffe7 100644
 --- a/platform.h
 +++ b/platform.h
 @@ -25,7 +25,7 @@ void platform_post_fork_parent(pid_t child_pid);
@@ -364,7 +364,7 @@ index ea4f9c58..60d72ffe 100644
  char *platform_krb5_get_principal_name(const char *);
  int platform_sys_dir_uid(uid_t);
 diff --git a/session.c b/session.c
-index 58826db1..ff301c98 100644
+index 58826db16..ff301c983 100644
 --- a/session.c
 +++ b/session.c
 @@ -1322,7 +1322,7 @@ safely_chroot(const char *path, uid_t uid)
@@ -413,7 +413,7 @@ index 58826db1..ff301c98 100644
         /* Set window size from the packet. */
         pty_change_window_size(s->ptyfd, s->row, s->col, s->xpixel, s->ypixel);
 diff --git a/session.h b/session.h
-index 54dd1f0c..8535ebce 100644
+index 54dd1f0ca..8535ebcef 100644
 --- a/session.h
 +++ b/session.h
 @@ -76,7 +76,7 @@ void   session_pty_cleanup2(Session *);
@@ -426,7 +426,7 @@ index 54dd1f0c..8535ebce 100644
  const char     *session_get_remote_name_or_ip(struct ssh *, u_int, int);
  
 diff --git a/sshd.c b/sshd.c
-index 4ed0364f..6d911c19 100644
+index 4ed0364f2..6d911c19a 100644
 --- a/sshd.c
 +++ b/sshd.c
 @@ -679,7 +679,7 @@ privsep_postauth(Authctxt *authctxt)
@@ -439,7 +439,7 @@ index 4ed0364f..6d911c19 100644
   skip:
         /* It is safe now to apply the key state */
 diff --git a/sshpty.c b/sshpty.c
-index 4da84d05..676ade50 100644
+index 4da84d05f..676ade50e 100644
 --- a/sshpty.c
 +++ b/sshpty.c
 @@ -162,7 +162,7 @@ pty_change_window_size(int ptyfd, u_int row, u_int col,
@@ -461,7 +461,7 @@ index 4da84d05..676ade50 100644
  
         if (st.st_uid != pw->pw_uid || st.st_gid != gid) {
 diff --git a/sshpty.h b/sshpty.h
-index 9ec7e9a1..de7e000a 100644
+index 9ec7e9a15..de7e000ae 100644
 --- a/sshpty.h
 +++ b/sshpty.h
 @@ -24,5 +24,5 @@ int    pty_allocate(int *, int *, char *, size_t);
diff --git a/debian/patches/series b/debian/patches/series
index e409902b5..9f89f7347 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -24,3 +24,4 @@ restore-authorized_keys2.patch
 seccomp-s390-flock-ipc.patch
 seccomp-getuid-geteuid.patch
 seccomp-s390-ioctl-ep11-crypto.patch
+upstream-relax-checking-of-authorized_keys-environme.patch
diff --git a/debian/patches/shell-path.patch b/debian/patches/shell-path.patch
index 638d348f2..92fc0026a 100644
--- a/debian/patches/shell-path.patch
+++ b/debian/patches/shell-path.patch
@@ -16,7 +16,7 @@ Patch-Name: shell-path.patch
  1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/sshconnect.c b/sshconnect.c
-index 3805d35d..8ab01c0e 100644
+index 3805d35d9..8ab01c0ef 100644
 --- a/sshconnect.c
 +++ b/sshconnect.c
 @@ -239,7 +239,7 @@ ssh_proxy_connect(struct ssh *ssh, const char *host, u_short port,
diff --git a/debian/patches/ssh-agent-setgid.patch b/debian/patches/ssh-agent-setgid.patch
index b7cd10dd1..add4d5115 100644
--- a/debian/patches/ssh-agent-setgid.patch
+++ b/debian/patches/ssh-agent-setgid.patch
@@ -13,7 +13,7 @@ Patch-Name: ssh-agent-setgid.patch
  1 file changed, 15 insertions(+)
 
 diff --git a/ssh-agent.1 b/ssh-agent.1
-index 83b2b41c..7230704a 100644
+index 83b2b41c8..7230704a3 100644
 --- a/ssh-agent.1
 +++ b/ssh-agent.1
 @@ -206,6 +206,21 @@ environment variable holds the agent's process ID.
diff --git a/debian/patches/ssh-argv0.patch b/debian/patches/ssh-argv0.patch
index 2539fa8ed..eb830e4cb 100644
--- a/debian/patches/ssh-argv0.patch
+++ b/debian/patches/ssh-argv0.patch
@@ -18,7 +18,7 @@ Patch-Name: ssh-argv0.patch
  1 file changed, 1 insertion(+)
 
 diff --git a/ssh.1 b/ssh.1
-index 54e21d88..f8fc26d2 100644
+index 54e21d88a..f8fc26d2a 100644
 --- a/ssh.1
 +++ b/ssh.1
 @@ -1571,6 +1571,7 @@ if an error occurred.
diff --git a/debian/patches/ssh-vulnkey-compat.patch b/debian/patches/ssh-vulnkey-compat.patch
index 34ff8a497..4d6f3e151 100644
--- a/debian/patches/ssh-vulnkey-compat.patch
+++ b/debian/patches/ssh-vulnkey-compat.patch
@@ -17,7 +17,7 @@ Patch-Name: ssh-vulnkey-compat.patch
  2 files changed, 2 insertions(+)
 
 diff --git a/readconf.c b/readconf.c
-index c8e79299..1f1be778 100644
+index c8e792991..1f1be7789 100644
 --- a/readconf.c
 +++ b/readconf.c
 @@ -189,6 +189,7 @@ static struct {
@@ -29,7 +29,7 @@ index c8e79299..1f1be778 100644
         { "useroaming", oDeprecated },
         { "usersh", oDeprecated },
 diff --git a/servconf.c b/servconf.c
-index cbbea05b..3fff3d53 100644
+index cbbea05bf..3fff3d531 100644
 --- a/servconf.c
 +++ b/servconf.c
 @@ -576,6 +576,7 @@ static struct {
diff --git a/debian/patches/syslog-level-silent.patch b/debian/patches/syslog-level-silent.patch
index 897433408..1b41b0801 100644
--- a/debian/patches/syslog-level-silent.patch
+++ b/debian/patches/syslog-level-silent.patch
@@ -21,7 +21,7 @@ Patch-Name: syslog-level-silent.patch
  2 files changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/log.c b/log.c
-index 99450dd1..1559091d 100644
+index 99450dd12..1559091da 100644
 --- a/log.c
 +++ b/log.c
 @@ -93,6 +93,7 @@ static struct {
@@ -33,7 +33,7 @@ index 99450dd1..1559091d 100644
         { "FATAL",      SYSLOG_LEVEL_FATAL },
         { "ERROR",      SYSLOG_LEVEL_ERROR },
 diff --git a/ssh.c b/ssh.c
-index d3619fe2..e36debf6 100644
+index d3619fe29..e36debf6a 100644
 --- a/ssh.c
 +++ b/ssh.c
 @@ -1252,7 +1252,7 @@ main(int ac, char **av)
diff --git a/debian/patches/systemd-readiness.patch b/debian/patches/systemd-readiness.patch
index a0e733f1b..982085c4c 100644
--- a/debian/patches/systemd-readiness.patch
+++ b/debian/patches/systemd-readiness.patch
@@ -14,7 +14,7 @@ Patch-Name: systemd-readiness.patch
  2 files changed, 33 insertions(+)
 
 diff --git a/configure.ac b/configure.ac
-index 3e23e60d..eac143b4 100644
+index 3e23e60d6..eac143b4d 100644
 --- a/configure.ac
 +++ b/configure.ac
 @@ -4496,6 +4496,29 @@ AC_ARG_WITH([kerberos5],
@@ -56,7 +56,7 @@ index 3e23e60d..eac143b4 100644
  echo "           Translate v4 in v6 hack: $IPV4_IN6_HACK_MSG"
  echo "                  BSD Auth support: $BSD_AUTH_MSG"
 diff --git a/sshd.c b/sshd.c
-index 1d645a17..3a86e66e 100644
+index 1d645a170..3a86e66e7 100644
 --- a/sshd.c
 +++ b/sshd.c
 @@ -85,6 +85,10 @@
diff --git a/debian/patches/upstream-relax-checking-of-authorized_keys-environme.patch b/debian/patches/upstream-relax-checking-of-authorized_keys-environme.patch
new file mode 100644
index 000000000..251b9a3ca
--- /dev/null
+++ b/debian/patches/upstream-relax-checking-of-authorized_keys-environme.patch
@@ -0,0 +1,40 @@
+From 60256f28189c3d0650a78e737eb0ca4753478a4b Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Fri, 6 Apr 2018 04:15:45 +0000
+Subject: upstream: relax checking of authorized_keys environment="..."
+
+options to allow underscores in variable names (regression introduced in
+7.7). bz2851, ok deraadt@
+
+OpenBSD-Commit-ID: 69690ffe0c97ff393f2c76d25b4b3d2ed4e4ac9c
+
+Original-Author: Damien Miller <djm@mindrot.org>
+Origin: backport, http://anongit.mindrot.org/openssh.git/commit/?id=40f5f03544a07ebd2003b443d42e85cb51d94d59
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1771011
+Last-Update: 2018-06-28
+Signed-off-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>
+
+Patch-Name: upstream-relax-checking-of-authorized_keys-environme.patch
+---
+ auth-options.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/auth-options.c b/auth-options.c
+index b528c197a..ef57ebf43 100644
+--- a/auth-options.c
++++ b/auth-options.c
+@@ -1,4 +1,4 @@
+-/* $OpenBSD: auth-options.c,v 1.78 2018/03/14 05:35:40 djm Exp $ */
++/* $OpenBSD: auth-options.c,v 1.79 2018/04/06 04:15:45 djm Exp $ */
+ /*
+  * Copyright (c) 2018 Damien Miller <djm@mindrot.org>
+  *
+@@ -394,7 +394,7 @@ sshauthopt_parse(const char *opts, const char **errstrp)
+                                goto fail;
+                        }
+                        for (cp = opt; cp < tmp; cp++) {
+-                               if (!isalnum((u_char)*cp)) {
++                               if (!isalnum((u_char)*cp) && *cp != '_') {
+                                        free(opt);
+                                        errstr = "invalid environment string";
+                                        goto fail;
diff --git a/debian/patches/user-group-modes.patch b/debian/patches/user-group-modes.patch
index a7201b318..712620843 100644
--- a/debian/patches/user-group-modes.patch
+++ b/debian/patches/user-group-modes.patch
@@ -19,7 +19,7 @@ Patch-Name: user-group-modes.patch
 ---
  auth-rhosts.c |  6 ++----
  auth.c        |  3 +--
- misc.c        | 58 +++++++++++++++++++++++++++++++++++++++++++++++++++++-----
+ misc.c        | 58 ++++++++++++++++++++++++++++++++++++++++++++++-----
  misc.h        |  2 ++
  readconf.c    |  3 +--
  ssh.1         |  2 ++
@@ -27,7 +27,7 @@ Patch-Name: user-group-modes.patch
  7 files changed, 63 insertions(+), 13 deletions(-)
 
 diff --git a/auth-rhosts.c b/auth-rhosts.c
-index ecf956f0..4dccd5e6 100644
+index ecf956f06..4dccd5e6a 100644
 --- a/auth-rhosts.c
 +++ b/auth-rhosts.c
 @@ -261,8 +261,7 @@ auth_rhosts2(struct passwd *pw, const char *client_user, const char *hostname,
@@ -51,7 +51,7 @@ index ecf956f0..4dccd5e6 100644
                             pw->pw_name, buf);
                         auth_debug_add("Bad file modes for %.200s", buf);
 diff --git a/auth.c b/auth.c
-index 76d586e3..68b9fe79 100644
+index 76d586e31..68b9fe795 100644
 --- a/auth.c
 +++ b/auth.c
 @@ -468,8 +468,7 @@ check_key_in_hostfiles(struct passwd *pw, struct sshkey *key, const char *host,
@@ -65,7 +65,7 @@ index 76d586e3..68b9fe79 100644
                             "bad owner or modes for %.200s",
                             pw->pw_name, user_hostfile);
 diff --git a/misc.c b/misc.c
-index 874dcc8a..75c4113f 100644
+index 874dcc8a2..75c4113f0 100644
 --- a/misc.c
 +++ b/misc.c
 @@ -57,8 +57,9 @@
@@ -156,7 +156,7 @@ index 874dcc8a..75c4113f 100644
                             "bad ownership or modes for directory %s", buf);
                         return -1;
 diff --git a/misc.h b/misc.h
-index cdafea73..51943db9 100644
+index cdafea735..51943db90 100644
 --- a/misc.h
 +++ b/misc.h
 @@ -168,6 +168,8 @@ char        *read_passphrase(const char *, int);
@@ -169,7 +169,7 @@ index cdafea73..51943db9 100644
  #define MAXIMUM(a, b)  (((a) > (b)) ? (a) : (b))
  #define ROUNDUP(x, y)   ((((x)+((y)-1))/(y))*(y))
 diff --git a/readconf.c b/readconf.c
-index 7f2b5c17..50349e23 100644
+index 7f2b5c172..50349e238 100644
 --- a/readconf.c
 +++ b/readconf.c
 @@ -1741,8 +1741,7 @@ read_config_file_depth(const char *filename, struct passwd *pw,
@@ -183,7 +183,7 @@ index 7f2b5c17..50349e23 100644
         }
  
 diff --git a/ssh.1 b/ssh.1
-index b4078525..0ef7c170 100644
+index b4078525b..0ef7c1709 100644
 --- a/ssh.1
 +++ b/ssh.1
 @@ -1471,6 +1471,8 @@ The file format and configuration options are described in
@@ -196,7 +196,7 @@ index b4078525..0ef7c170 100644
  .It Pa ~/.ssh/environment
  Contains additional definitions for environment variables; see
 diff --git a/ssh_config.5 b/ssh_config.5
-index 32c3632c..84dcd52c 100644
+index 32c3632c7..84dcd52cc 100644
 --- a/ssh_config.5
 +++ b/ssh_config.5
 @@ -1818,6 +1818,8 @@ The format of this file is described above.