diff options
178 files changed, 22664 insertions, 121 deletions
diff --git a/.bzrignore b/.bzrignore new file mode 100644 index 000000000..0f130a704 --- /dev/null +++ b/.bzrignore | |||
@@ -0,0 +1,51 @@ | |||
1 | ./.pc | ||
2 | ./*.out | ||
3 | ./Makefile | ||
4 | ./autom4te.cache | ||
5 | ./build-deb | ||
6 | ./build-deb-stamp | ||
7 | ./build-udeb | ||
8 | ./build-udeb-stamp | ||
9 | ./buildit.sh | ||
10 | ./buildpkg.sh | ||
11 | ./config.cache | ||
12 | ./config.h | ||
13 | ./config.log | ||
14 | ./config.status | ||
15 | ./openssh.xml | ||
16 | ./opensshd.init | ||
17 | ./scp | ||
18 | ./sftp | ||
19 | ./sftp-server | ||
20 | ./ssh | ||
21 | ./ssh-add | ||
22 | ./ssh-agent | ||
23 | ./ssh-keygen | ||
24 | ./ssh-keyscan | ||
25 | ./ssh-keysign | ||
26 | ./ssh-rand-helper | ||
27 | ./ssh_prng_cmds | ||
28 | ./sshd | ||
29 | ./stamp-h.in | ||
30 | ./survey | ||
31 | ./survey.sh | ||
32 | contrib/gnome-ssh-askpass1 | ||
33 | contrib/gnome-ssh-askpass2 | ||
34 | openbsd-compat/Makefile | ||
35 | scard/Makefile | ||
36 | debian/*.debhelper* | ||
37 | debian/*substvars | ||
38 | debian/copyright | ||
39 | debian/files | ||
40 | debian/openssh-client | ||
41 | debian/openssh-client-udeb | ||
42 | debian/openssh-server | ||
43 | debian/openssh-server-udeb | ||
44 | debian/ssh | ||
45 | debian/ssh-askpass-gnome | ||
46 | debian/ssh-krb5 | ||
47 | debian/tests/key1 | ||
48 | debian/tests/key1.pub | ||
49 | debian/tests/key2 | ||
50 | debian/tests/key2.pub | ||
51 | debian/tmp | ||
diff --git a/Makefile.in b/Makefile.in index e479a44e5..7406aef6f 100644 --- a/Makefile.in +++ b/Makefile.in | |||
@@ -26,6 +26,7 @@ ASKPASS_PROGRAM=$(libexecdir)/ssh-askpass | |||
26 | SFTP_SERVER=$(libexecdir)/sftp-server | 26 | SFTP_SERVER=$(libexecdir)/sftp-server |
27 | SSH_KEYSIGN=$(libexecdir)/ssh-keysign | 27 | SSH_KEYSIGN=$(libexecdir)/ssh-keysign |
28 | SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper | 28 | SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper |
29 | SSH_DATADIR=$(datadir)/ssh | ||
29 | PRIVSEP_PATH=@PRIVSEP_PATH@ | 30 | PRIVSEP_PATH=@PRIVSEP_PATH@ |
30 | SSH_PRIVSEP_USER=@SSH_PRIVSEP_USER@ | 31 | SSH_PRIVSEP_USER=@SSH_PRIVSEP_USER@ |
31 | STRIP_OPT=@STRIP_OPT@ | 32 | STRIP_OPT=@STRIP_OPT@ |
@@ -38,6 +39,7 @@ PATHS= -DSSHDIR=\"$(sysconfdir)\" \ | |||
38 | -D_PATH_SSH_PKCS11_HELPER=\"$(SSH_PKCS11_HELPER)\" \ | 39 | -D_PATH_SSH_PKCS11_HELPER=\"$(SSH_PKCS11_HELPER)\" \ |
39 | -D_PATH_SSH_PIDDIR=\"$(piddir)\" \ | 40 | -D_PATH_SSH_PIDDIR=\"$(piddir)\" \ |
40 | -D_PATH_PRIVSEP_CHROOT_DIR=\"$(PRIVSEP_PATH)\" \ | 41 | -D_PATH_PRIVSEP_CHROOT_DIR=\"$(PRIVSEP_PATH)\" \ |
42 | -D_PATH_SSH_DATADIR=\"$(SSH_DATADIR)\" \ | ||
41 | 43 | ||
42 | CC=@CC@ | 44 | CC=@CC@ |
43 | LD=@LD@ | 45 | LD=@LD@ |
@@ -59,7 +61,7 @@ LDFLAGS=-L. -Lopenbsd-compat/ @LDFLAGS@ | |||
59 | EXEEXT=@EXEEXT@ | 61 | EXEEXT=@EXEEXT@ |
60 | MANFMT=@MANFMT@ | 62 | MANFMT=@MANFMT@ |
61 | 63 | ||
62 | TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) | 64 | TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-vulnkey$(EXEEXT) |
63 | 65 | ||
64 | LIBSSH_OBJS=acss.o authfd.o authfile.o bufaux.o bufbn.o buffer.o \ | 66 | LIBSSH_OBJS=acss.o authfd.o authfile.o bufaux.o bufbn.o buffer.o \ |
65 | canohost.o channels.o cipher.o cipher-acss.o cipher-aes.o \ | 67 | canohost.o channels.o cipher.o cipher-acss.o cipher-aes.o \ |
@@ -93,8 +95,8 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passwd.o auth-rsa.o auth-rh-rsa.o \ | |||
93 | roaming_common.o roaming_serv.o \ | 95 | roaming_common.o roaming_serv.o \ |
94 | sandbox-null.o sandbox-rlimit.o sandbox-systrace.o sandbox-darwin.o | 96 | sandbox-null.o sandbox-rlimit.o sandbox-systrace.o sandbox-darwin.o |
95 | 97 | ||
96 | MANPAGES = moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-keysign.8.out ssh-pkcs11-helper.8.out sshd_config.5.out ssh_config.5.out | 98 | MANPAGES = moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-keysign.8.out ssh-pkcs11-helper.8.out ssh-vulnkey.1.out sshd_config.5.out ssh_config.5.out |
97 | MANPAGES_IN = moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-keysign.8 ssh-pkcs11-helper.8 sshd_config.5 ssh_config.5 | 99 | MANPAGES_IN = moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-keysign.8 ssh-pkcs11-helper.8 ssh-vulnkey.1 sshd_config.5 ssh_config.5 |
98 | MANTYPE = @MANTYPE@ | 100 | MANTYPE = @MANTYPE@ |
99 | 101 | ||
100 | CONFIGFILES=sshd_config.out ssh_config.out moduli.out | 102 | CONFIGFILES=sshd_config.out ssh_config.out moduli.out |
@@ -171,6 +173,9 @@ sftp-server$(EXEEXT): $(LIBCOMPAT) libssh.a sftp.o sftp-common.o sftp-server.o s | |||
171 | sftp$(EXEEXT): $(LIBCOMPAT) libssh.a sftp.o sftp-client.o sftp-common.o sftp-glob.o progressmeter.o | 173 | sftp$(EXEEXT): $(LIBCOMPAT) libssh.a sftp.o sftp-client.o sftp-common.o sftp-glob.o progressmeter.o |
172 | $(LD) -o $@ progressmeter.o sftp.o sftp-client.o sftp-common.o sftp-glob.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) $(LIBEDIT) | 174 | $(LD) -o $@ progressmeter.o sftp.o sftp-client.o sftp-common.o sftp-glob.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) $(LIBEDIT) |
173 | 175 | ||
176 | ssh-vulnkey$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-vulnkey.o | ||
177 | $(LD) -o $@ ssh-vulnkey.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) | ||
178 | |||
174 | # test driver for the loginrec code - not built by default | 179 | # test driver for the loginrec code - not built by default |
175 | logintest: logintest.o $(LIBCOMPAT) libssh.a loginrec.o | 180 | logintest: logintest.o $(LIBCOMPAT) libssh.a loginrec.o |
176 | $(LD) -o $@ logintest.o $(LDFLAGS) loginrec.o -lopenbsd-compat -lssh $(LIBS) | 181 | $(LD) -o $@ logintest.o $(LDFLAGS) loginrec.o -lopenbsd-compat -lssh $(LIBS) |
@@ -259,6 +264,7 @@ install-files: | |||
259 | $(INSTALL) -m 0755 $(STRIP_OPT) ssh-pkcs11-helper$(EXEEXT) $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT) | 264 | $(INSTALL) -m 0755 $(STRIP_OPT) ssh-pkcs11-helper$(EXEEXT) $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT) |
260 | $(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT) | 265 | $(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT) |
261 | $(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT) | 266 | $(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT) |
267 | $(INSTALL) -m 0755 $(STRIP_OPT) ssh-vulnkey$(EXEEXT) $(DESTDIR)$(bindir)/ssh-vulnkey$(EXEEXT) | ||
262 | $(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1 | 268 | $(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1 |
263 | $(INSTALL) -m 644 scp.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/scp.1 | 269 | $(INSTALL) -m 644 scp.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/scp.1 |
264 | $(INSTALL) -m 644 ssh-add.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-add.1 | 270 | $(INSTALL) -m 644 ssh-add.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-add.1 |
@@ -269,14 +275,16 @@ install-files: | |||
269 | $(INSTALL) -m 644 sshd_config.5.out $(DESTDIR)$(mandir)/$(mansubdir)5/sshd_config.5 | 275 | $(INSTALL) -m 644 sshd_config.5.out $(DESTDIR)$(mandir)/$(mansubdir)5/sshd_config.5 |
270 | $(INSTALL) -m 644 ssh_config.5.out $(DESTDIR)$(mandir)/$(mansubdir)5/ssh_config.5 | 276 | $(INSTALL) -m 644 ssh_config.5.out $(DESTDIR)$(mandir)/$(mansubdir)5/ssh_config.5 |
271 | $(INSTALL) -m 644 sshd.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sshd.8 | 277 | $(INSTALL) -m 644 sshd.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sshd.8 |
278 | ln -s ../$(mansubdir)8/sshd.8 $(DESTDIR)$(mandir)/$(mansubdir)5/authorized_keys.5 | ||
272 | $(INSTALL) -m 644 sftp.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/sftp.1 | 279 | $(INSTALL) -m 644 sftp.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/sftp.1 |
273 | $(INSTALL) -m 644 sftp-server.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8 | 280 | $(INSTALL) -m 644 sftp-server.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8 |
274 | $(INSTALL) -m 644 ssh-keysign.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8 | 281 | $(INSTALL) -m 644 ssh-keysign.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8 |
275 | $(INSTALL) -m 644 ssh-pkcs11-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8 | 282 | $(INSTALL) -m 644 ssh-pkcs11-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8 |
283 | $(INSTALL) -m 644 ssh-vulnkey.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-vulnkey.1 | ||
276 | -rm -f $(DESTDIR)$(bindir)/slogin | 284 | -rm -f $(DESTDIR)$(bindir)/slogin |
277 | ln -s ./ssh$(EXEEXT) $(DESTDIR)$(bindir)/slogin | 285 | ln -s ssh$(EXEEXT) $(DESTDIR)$(bindir)/slogin |
278 | -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/slogin.1 | 286 | -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/slogin.1 |
279 | ln -s ./ssh.1 $(DESTDIR)$(mandir)/$(mansubdir)1/slogin.1 | 287 | ln -s ssh.1 $(DESTDIR)$(mandir)/$(mansubdir)1/slogin.1 |
280 | 288 | ||
281 | install-sysconf: | 289 | install-sysconf: |
282 | if [ ! -d $(DESTDIR)$(sysconfdir) ]; then \ | 290 | if [ ! -d $(DESTDIR)$(sysconfdir) ]; then \ |
@@ -354,6 +362,7 @@ uninstall: | |||
354 | -rm -f $(DESTDIR)$(bindir)/ssh-agent$(EXEEXT) | 362 | -rm -f $(DESTDIR)$(bindir)/ssh-agent$(EXEEXT) |
355 | -rm -f $(DESTDIR)$(bindir)/ssh-keygen$(EXEEXT) | 363 | -rm -f $(DESTDIR)$(bindir)/ssh-keygen$(EXEEXT) |
356 | -rm -f $(DESTDIR)$(bindir)/ssh-keyscan$(EXEEXT) | 364 | -rm -f $(DESTDIR)$(bindir)/ssh-keyscan$(EXEEXT) |
365 | -rm -f $(DESTDIR)$(bindir)/ssh-vulnkey$(EXEEXT) | ||
357 | -rm -f $(DESTDIR)$(bindir)/sftp$(EXEEXT) | 366 | -rm -f $(DESTDIR)$(bindir)/sftp$(EXEEXT) |
358 | -rm -f $(DESTDIR)$(sbindir)/sshd$(EXEEXT) | 367 | -rm -f $(DESTDIR)$(sbindir)/sshd$(EXEEXT) |
359 | -rm -r $(DESTDIR)$(SFTP_SERVER)$(EXEEXT) | 368 | -rm -r $(DESTDIR)$(SFTP_SERVER)$(EXEEXT) |
@@ -366,6 +375,7 @@ uninstall: | |||
366 | -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-keygen.1 | 375 | -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-keygen.1 |
367 | -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/sftp.1 | 376 | -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/sftp.1 |
368 | -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-keyscan.1 | 377 | -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-keyscan.1 |
378 | -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-vulnkey.1 | ||
369 | -rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/sshd.8 | 379 | -rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/sshd.8 |
370 | -rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8 | 380 | -rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8 |
371 | -rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8 | 381 | -rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8 |
diff --git a/auth-options.c b/auth-options.c index eae45cf2b..8d1ef0a18 100644 --- a/auth-options.c +++ b/auth-options.c | |||
@@ -58,9 +58,20 @@ int forced_tun_device = -1; | |||
58 | /* "principals=" option. */ | 58 | /* "principals=" option. */ |
59 | char *authorized_principals = NULL; | 59 | char *authorized_principals = NULL; |
60 | 60 | ||
61 | /* Throttle log messages. */ | ||
62 | int logged_from_hostip = 0; | ||
63 | int logged_cert_hostip = 0; | ||
64 | |||
61 | extern ServerOptions options; | 65 | extern ServerOptions options; |
62 | 66 | ||
63 | void | 67 | void |
68 | auth_start_parse_options(void) | ||
69 | { | ||
70 | logged_from_hostip = 0; | ||
71 | logged_cert_hostip = 0; | ||
72 | } | ||
73 | |||
74 | void | ||
64 | auth_clear_options(void) | 75 | auth_clear_options(void) |
65 | { | 76 | { |
66 | no_agent_forwarding_flag = 0; | 77 | no_agent_forwarding_flag = 0; |
@@ -288,10 +299,13 @@ auth_parse_options(struct passwd *pw, char *opts, char *file, u_long linenum) | |||
288 | /* FALLTHROUGH */ | 299 | /* FALLTHROUGH */ |
289 | case 0: | 300 | case 0: |
290 | xfree(patterns); | 301 | xfree(patterns); |
291 | logit("Authentication tried for %.100s with " | 302 | if (!logged_from_hostip) { |
292 | "correct key but not from a permitted " | 303 | logit("Authentication tried for %.100s with " |
293 | "host (host=%.200s, ip=%.200s).", | 304 | "correct key but not from a permitted " |
294 | pw->pw_name, remote_host, remote_ip); | 305 | "host (host=%.200s, ip=%.200s).", |
306 | pw->pw_name, remote_host, remote_ip); | ||
307 | logged_from_hostip = 1; | ||
308 | } | ||
295 | auth_debug_add("Your host '%.200s' is not " | 309 | auth_debug_add("Your host '%.200s' is not " |
296 | "permitted to use this key for login.", | 310 | "permitted to use this key for login.", |
297 | remote_host); | 311 | remote_host); |
@@ -526,11 +540,14 @@ parse_option_list(u_char *optblob, size_t optblob_len, struct passwd *pw, | |||
526 | break; | 540 | break; |
527 | case 0: | 541 | case 0: |
528 | /* no match */ | 542 | /* no match */ |
529 | logit("Authentication tried for %.100s " | 543 | if (!logged_cert_hostip) { |
530 | "with valid certificate but not " | 544 | logit("Authentication tried for %.100s " |
531 | "from a permitted host " | 545 | "with valid certificate but not " |
532 | "(ip=%.200s).", pw->pw_name, | 546 | "from a permitted host " |
533 | remote_ip); | 547 | "(ip=%.200s).", pw->pw_name, |
548 | remote_ip); | ||
549 | logged_cert_hostip = 1; | ||
550 | } | ||
534 | auth_debug_add("Your address '%.200s' " | 551 | auth_debug_add("Your address '%.200s' " |
535 | "is not permitted to use this " | 552 | "is not permitted to use this " |
536 | "certificate for login.", | 553 | "certificate for login.", |
diff --git a/auth-options.h b/auth-options.h index 7455c9454..a3f0a02da 100644 --- a/auth-options.h +++ b/auth-options.h | |||
@@ -33,6 +33,7 @@ extern int forced_tun_device; | |||
33 | extern int key_is_cert_authority; | 33 | extern int key_is_cert_authority; |
34 | extern char *authorized_principals; | 34 | extern char *authorized_principals; |
35 | 35 | ||
36 | void auth_start_parse_options(void); | ||
36 | int auth_parse_options(struct passwd *, char *, char *, u_long); | 37 | int auth_parse_options(struct passwd *, char *, char *, u_long); |
37 | void auth_clear_options(void); | 38 | void auth_clear_options(void); |
38 | int auth_cert_options(Key *, struct passwd *); | 39 | int auth_cert_options(Key *, struct passwd *); |
diff --git a/auth-rh-rsa.c b/auth-rh-rsa.c index b21a0f4a2..891ec3297 100644 --- a/auth-rh-rsa.c +++ b/auth-rh-rsa.c | |||
@@ -44,7 +44,7 @@ auth_rhosts_rsa_key_allowed(struct passwd *pw, char *cuser, char *chost, | |||
44 | { | 44 | { |
45 | HostStatus host_status; | 45 | HostStatus host_status; |
46 | 46 | ||
47 | if (auth_key_is_revoked(client_host_key)) | 47 | if (auth_key_is_revoked(client_host_key, 0)) |
48 | return 0; | 48 | return 0; |
49 | 49 | ||
50 | /* Check if we would accept it using rhosts authentication. */ | 50 | /* Check if we would accept it using rhosts authentication. */ |
diff --git a/auth-rhosts.c b/auth-rhosts.c index 06ae7f0b9..f20278797 100644 --- a/auth-rhosts.c +++ b/auth-rhosts.c | |||
@@ -256,8 +256,7 @@ auth_rhosts2_raw(struct passwd *pw, const char *client_user, const char *hostnam | |||
256 | return 0; | 256 | return 0; |
257 | } | 257 | } |
258 | if (options.strict_modes && | 258 | if (options.strict_modes && |
259 | ((st.st_uid != 0 && st.st_uid != pw->pw_uid) || | 259 | !secure_permissions(&st, pw->pw_uid)) { |
260 | (st.st_mode & 022) != 0)) { | ||
261 | logit("Rhosts authentication refused for %.100s: " | 260 | logit("Rhosts authentication refused for %.100s: " |
262 | "bad ownership or modes for home directory.", pw->pw_name); | 261 | "bad ownership or modes for home directory.", pw->pw_name); |
263 | auth_debug_add("Rhosts authentication refused for %.100s: " | 262 | auth_debug_add("Rhosts authentication refused for %.100s: " |
@@ -283,8 +282,7 @@ auth_rhosts2_raw(struct passwd *pw, const char *client_user, const char *hostnam | |||
283 | * allowing access to their account by anyone. | 282 | * allowing access to their account by anyone. |
284 | */ | 283 | */ |
285 | if (options.strict_modes && | 284 | if (options.strict_modes && |
286 | ((st.st_uid != 0 && st.st_uid != pw->pw_uid) || | 285 | !secure_permissions(&st, pw->pw_uid)) { |
287 | (st.st_mode & 022) != 0)) { | ||
288 | logit("Rhosts authentication refused for %.100s: bad modes for %.200s", | 286 | logit("Rhosts authentication refused for %.100s: bad modes for %.200s", |
289 | pw->pw_name, buf); | 287 | pw->pw_name, buf); |
290 | auth_debug_add("Bad file modes for %.200s", buf); | 288 | auth_debug_add("Bad file modes for %.200s", buf); |
diff --git a/auth-rsa.c b/auth-rsa.c index 4ab46cd51..99c4e882d 100644 --- a/auth-rsa.c +++ b/auth-rsa.c | |||
@@ -175,6 +175,8 @@ rsa_key_allowed_in_file(struct passwd *pw, char *file, | |||
175 | if ((f = auth_openkeyfile(file, pw, options.strict_modes)) == NULL) | 175 | if ((f = auth_openkeyfile(file, pw, options.strict_modes)) == NULL) |
176 | return 0; | 176 | return 0; |
177 | 177 | ||
178 | auth_start_parse_options(); | ||
179 | |||
178 | /* | 180 | /* |
179 | * Go though the accepted keys, looking for the current key. If | 181 | * Go though the accepted keys, looking for the current key. If |
180 | * found, perform a challenge-response dialog to verify that the | 182 | * found, perform a challenge-response dialog to verify that the |
@@ -233,7 +235,7 @@ rsa_key_allowed_in_file(struct passwd *pw, char *file, | |||
233 | file, linenum, BN_num_bits(key->rsa->n), bits); | 235 | file, linenum, BN_num_bits(key->rsa->n), bits); |
234 | 236 | ||
235 | /* Never accept a revoked key */ | 237 | /* Never accept a revoked key */ |
236 | if (auth_key_is_revoked(key)) | 238 | if (auth_key_is_revoked(key, 0)) |
237 | break; | 239 | break; |
238 | 240 | ||
239 | /* We have found the desired key. */ | 241 | /* We have found the desired key. */ |
@@ -59,6 +59,7 @@ | |||
59 | #include "servconf.h" | 59 | #include "servconf.h" |
60 | #include "key.h" | 60 | #include "key.h" |
61 | #include "hostfile.h" | 61 | #include "hostfile.h" |
62 | #include "authfile.h" | ||
62 | #include "auth.h" | 63 | #include "auth.h" |
63 | #include "auth-options.h" | 64 | #include "auth-options.h" |
64 | #include "canohost.h" | 65 | #include "canohost.h" |
@@ -379,8 +380,7 @@ check_key_in_hostfiles(struct passwd *pw, Key *key, const char *host, | |||
379 | user_hostfile = tilde_expand_filename(userfile, pw->pw_uid); | 380 | user_hostfile = tilde_expand_filename(userfile, pw->pw_uid); |
380 | if (options.strict_modes && | 381 | if (options.strict_modes && |
381 | (stat(user_hostfile, &st) == 0) && | 382 | (stat(user_hostfile, &st) == 0) && |
382 | ((st.st_uid != 0 && st.st_uid != pw->pw_uid) || | 383 | !secure_permissions(&st, pw->pw_uid)) { |
383 | (st.st_mode & 022) != 0)) { | ||
384 | logit("Authentication refused for %.100s: " | 384 | logit("Authentication refused for %.100s: " |
385 | "bad owner or modes for %.200s", | 385 | "bad owner or modes for %.200s", |
386 | pw->pw_name, user_hostfile); | 386 | pw->pw_name, user_hostfile); |
@@ -441,8 +441,7 @@ secure_filename(FILE *f, const char *file, struct passwd *pw, | |||
441 | 441 | ||
442 | /* check the open file to avoid races */ | 442 | /* check the open file to avoid races */ |
443 | if (fstat(fileno(f), &st) < 0 || | 443 | if (fstat(fileno(f), &st) < 0 || |
444 | (st.st_uid != 0 && st.st_uid != uid) || | 444 | !secure_permissions(&st, uid)) { |
445 | (st.st_mode & 022) != 0) { | ||
446 | snprintf(err, errlen, "bad ownership or modes for file %s", | 445 | snprintf(err, errlen, "bad ownership or modes for file %s", |
447 | buf); | 446 | buf); |
448 | return -1; | 447 | return -1; |
@@ -457,8 +456,7 @@ secure_filename(FILE *f, const char *file, struct passwd *pw, | |||
457 | strlcpy(buf, cp, sizeof(buf)); | 456 | strlcpy(buf, cp, sizeof(buf)); |
458 | 457 | ||
459 | if (stat(buf, &st) < 0 || | 458 | if (stat(buf, &st) < 0 || |
460 | (st.st_uid != 0 && st.st_uid != uid) || | 459 | !secure_permissions(&st, uid)) { |
461 | (st.st_mode & 022) != 0) { | ||
462 | snprintf(err, errlen, | 460 | snprintf(err, errlen, |
463 | "bad ownership or modes for directory %s", buf); | 461 | "bad ownership or modes for directory %s", buf); |
464 | return -1; | 462 | return -1; |
@@ -606,10 +604,34 @@ getpwnamallow(const char *user) | |||
606 | 604 | ||
607 | /* Returns 1 if key is revoked by revoked_keys_file, 0 otherwise */ | 605 | /* Returns 1 if key is revoked by revoked_keys_file, 0 otherwise */ |
608 | int | 606 | int |
609 | auth_key_is_revoked(Key *key) | 607 | auth_key_is_revoked(Key *key, int hostkey) |
610 | { | 608 | { |
611 | char *key_fp; | 609 | char *key_fp; |
612 | 610 | ||
611 | if (blacklisted_key(key, &key_fp) == 1) { | ||
612 | if (options.permit_blacklisted_keys) { | ||
613 | if (hostkey) | ||
614 | error("Host key %s blacklisted (see " | ||
615 | "ssh-vulnkey(1)); continuing anyway", | ||
616 | key_fp); | ||
617 | else | ||
618 | logit("Public key %s from %s blacklisted (see " | ||
619 | "ssh-vulnkey(1)); continuing anyway", | ||
620 | key_fp, get_remote_ipaddr()); | ||
621 | xfree(key_fp); | ||
622 | } else { | ||
623 | if (hostkey) | ||
624 | error("Host key %s blacklisted (see " | ||
625 | "ssh-vulnkey(1))", key_fp); | ||
626 | else | ||
627 | logit("Public key %s from %s blacklisted (see " | ||
628 | "ssh-vulnkey(1))", | ||
629 | key_fp, get_remote_ipaddr()); | ||
630 | xfree(key_fp); | ||
631 | return 1; | ||
632 | } | ||
633 | } | ||
634 | |||
613 | if (options.revoked_keys_file == NULL) | 635 | if (options.revoked_keys_file == NULL) |
614 | return 0; | 636 | return 0; |
615 | 637 | ||
@@ -59,6 +59,7 @@ struct Authctxt { | |||
59 | char *service; | 59 | char *service; |
60 | struct passwd *pw; /* set if 'valid' */ | 60 | struct passwd *pw; /* set if 'valid' */ |
61 | char *style; | 61 | char *style; |
62 | char *role; | ||
62 | void *kbdintctxt; | 63 | void *kbdintctxt; |
63 | void *jpake_ctx; | 64 | void *jpake_ctx; |
64 | #ifdef BSD_AUTH | 65 | #ifdef BSD_AUTH |
@@ -173,7 +174,7 @@ char *authorized_principals_file(struct passwd *); | |||
173 | 174 | ||
174 | FILE *auth_openkeyfile(const char *, struct passwd *, int); | 175 | FILE *auth_openkeyfile(const char *, struct passwd *, int); |
175 | FILE *auth_openprincipals(const char *, struct passwd *, int); | 176 | FILE *auth_openprincipals(const char *, struct passwd *, int); |
176 | int auth_key_is_revoked(Key *); | 177 | int auth_key_is_revoked(Key *, int); |
177 | 178 | ||
178 | HostStatus | 179 | HostStatus |
179 | check_key_in_hostfiles(struct passwd *, Key *, const char *, | 180 | check_key_in_hostfiles(struct passwd *, Key *, const char *, |
@@ -383,7 +383,7 @@ void | |||
383 | do_authentication(Authctxt *authctxt) | 383 | do_authentication(Authctxt *authctxt) |
384 | { | 384 | { |
385 | u_int ulen; | 385 | u_int ulen; |
386 | char *user, *style = NULL; | 386 | char *user, *style = NULL, *role = NULL; |
387 | 387 | ||
388 | /* Get the name of the user that we wish to log in as. */ | 388 | /* Get the name of the user that we wish to log in as. */ |
389 | packet_read_expect(SSH_CMSG_USER); | 389 | packet_read_expect(SSH_CMSG_USER); |
@@ -392,11 +392,17 @@ do_authentication(Authctxt *authctxt) | |||
392 | user = packet_get_cstring(&ulen); | 392 | user = packet_get_cstring(&ulen); |
393 | packet_check_eom(); | 393 | packet_check_eom(); |
394 | 394 | ||
395 | if ((role = strchr(user, '/')) != NULL) | ||
396 | *role++ = '\0'; | ||
397 | |||
395 | if ((style = strchr(user, ':')) != NULL) | 398 | if ((style = strchr(user, ':')) != NULL) |
396 | *style++ = '\0'; | 399 | *style++ = '\0'; |
400 | else if (role && (style = strchr(role, ':')) != NULL) | ||
401 | *style++ = '\0'; | ||
397 | 402 | ||
398 | authctxt->user = user; | 403 | authctxt->user = user; |
399 | authctxt->style = style; | 404 | authctxt->style = style; |
405 | authctxt->role = role; | ||
400 | 406 | ||
401 | /* Verify that the user is a valid user. */ | 407 | /* Verify that the user is a valid user. */ |
402 | if ((authctxt->pw = PRIVSEP(getpwnamallow(user))) != NULL) | 408 | if ((authctxt->pw = PRIVSEP(getpwnamallow(user))) != NULL) |
diff --git a/auth2-hostbased.c b/auth2-hostbased.c index cdf442f97..700631558 100644 --- a/auth2-hostbased.c +++ b/auth2-hostbased.c | |||
@@ -146,7 +146,7 @@ hostbased_key_allowed(struct passwd *pw, const char *cuser, char *chost, | |||
146 | int len; | 146 | int len; |
147 | char *fp; | 147 | char *fp; |
148 | 148 | ||
149 | if (auth_key_is_revoked(key)) | 149 | if (auth_key_is_revoked(key, 0)) |
150 | return 0; | 150 | return 0; |
151 | 151 | ||
152 | resolvedname = get_canonical_hostname(options.use_dns); | 152 | resolvedname = get_canonical_hostname(options.use_dns); |
diff --git a/auth2-pubkey.c b/auth2-pubkey.c index 137887ecd..a1d31e930 100644 --- a/auth2-pubkey.c +++ b/auth2-pubkey.c | |||
@@ -211,6 +211,7 @@ match_principals_file(char *file, struct passwd *pw, struct KeyCert *cert) | |||
211 | restore_uid(); | 211 | restore_uid(); |
212 | return 0; | 212 | return 0; |
213 | } | 213 | } |
214 | auth_start_parse_options(); | ||
214 | while (read_keyfile_line(f, file, line, sizeof(line), &linenum) != -1) { | 215 | while (read_keyfile_line(f, file, line, sizeof(line), &linenum) != -1) { |
215 | /* Skip leading whitespace. */ | 216 | /* Skip leading whitespace. */ |
216 | for (cp = line; *cp == ' ' || *cp == '\t'; cp++) | 217 | for (cp = line; *cp == ' ' || *cp == '\t'; cp++) |
@@ -280,6 +281,8 @@ user_key_allowed2(struct passwd *pw, Key *key, char *file) | |||
280 | found_key = 0; | 281 | found_key = 0; |
281 | found = key_new(key_is_cert(key) ? KEY_UNSPEC : key->type); | 282 | found = key_new(key_is_cert(key) ? KEY_UNSPEC : key->type); |
282 | 283 | ||
284 | auth_start_parse_options(); | ||
285 | |||
283 | while (read_keyfile_line(f, file, line, sizeof(line), &linenum) != -1) { | 286 | while (read_keyfile_line(f, file, line, sizeof(line), &linenum) != -1) { |
284 | char *cp, *key_options = NULL; | 287 | char *cp, *key_options = NULL; |
285 | 288 | ||
@@ -416,6 +419,7 @@ user_cert_trusted_ca(struct passwd *pw, Key *key) | |||
416 | if (key_cert_check_authority(key, 0, 1, | 419 | if (key_cert_check_authority(key, 0, 1, |
417 | principals_file == NULL ? pw->pw_name : NULL, &reason) != 0) | 420 | principals_file == NULL ? pw->pw_name : NULL, &reason) != 0) |
418 | goto fail_reason; | 421 | goto fail_reason; |
422 | auth_start_parse_options(); | ||
419 | if (auth_cert_options(key, pw) != 0) | 423 | if (auth_cert_options(key, pw) != 0) |
420 | goto out; | 424 | goto out; |
421 | 425 | ||
@@ -439,9 +443,10 @@ user_key_allowed(struct passwd *pw, Key *key) | |||
439 | u_int success, i; | 443 | u_int success, i; |
440 | char *file; | 444 | char *file; |
441 | 445 | ||
442 | if (auth_key_is_revoked(key)) | 446 | if (auth_key_is_revoked(key, 0)) |
443 | return 0; | 447 | return 0; |
444 | if (key_is_cert(key) && auth_key_is_revoked(key->cert->signature_key)) | 448 | if (key_is_cert(key) && |
449 | auth_key_is_revoked(key->cert->signature_key, 0)) | ||
445 | return 0; | 450 | return 0; |
446 | 451 | ||
447 | success = user_cert_trusted_ca(pw, key); | 452 | success = user_cert_trusted_ca(pw, key); |
@@ -217,7 +217,7 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt) | |||
217 | { | 217 | { |
218 | Authctxt *authctxt = ctxt; | 218 | Authctxt *authctxt = ctxt; |
219 | Authmethod *m = NULL; | 219 | Authmethod *m = NULL; |
220 | char *user, *service, *method, *style = NULL; | 220 | char *user, *service, *method, *style = NULL, *role = NULL; |
221 | int authenticated = 0; | 221 | int authenticated = 0; |
222 | 222 | ||
223 | if (authctxt == NULL) | 223 | if (authctxt == NULL) |
@@ -229,8 +229,13 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt) | |||
229 | debug("userauth-request for user %s service %s method %s", user, service, method); | 229 | debug("userauth-request for user %s service %s method %s", user, service, method); |
230 | debug("attempt %d failures %d", authctxt->attempt, authctxt->failures); | 230 | debug("attempt %d failures %d", authctxt->attempt, authctxt->failures); |
231 | 231 | ||
232 | if ((role = strchr(user, '/')) != NULL) | ||
233 | *role++ = 0; | ||
234 | |||
232 | if ((style = strchr(user, ':')) != NULL) | 235 | if ((style = strchr(user, ':')) != NULL) |
233 | *style++ = 0; | 236 | *style++ = 0; |
237 | else if (role && (style = strchr(role, ':')) != NULL) | ||
238 | *style++ = '\0'; | ||
234 | 239 | ||
235 | if (authctxt->attempt++ == 0) { | 240 | if (authctxt->attempt++ == 0) { |
236 | /* setup auth context */ | 241 | /* setup auth context */ |
@@ -254,8 +259,9 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt) | |||
254 | use_privsep ? " [net]" : ""); | 259 | use_privsep ? " [net]" : ""); |
255 | authctxt->service = xstrdup(service); | 260 | authctxt->service = xstrdup(service); |
256 | authctxt->style = style ? xstrdup(style) : NULL; | 261 | authctxt->style = style ? xstrdup(style) : NULL; |
262 | authctxt->role = role ? xstrdup(role) : NULL; | ||
257 | if (use_privsep) | 263 | if (use_privsep) |
258 | mm_inform_authserv(service, style); | 264 | mm_inform_authserv(service, style, role); |
259 | userauth_banner(); | 265 | userauth_banner(); |
260 | } else if (strcmp(user, authctxt->user) != 0 || | 266 | } else if (strcmp(user, authctxt->user) != 0 || |
261 | strcmp(service, authctxt->service) != 0) { | 267 | strcmp(service, authctxt->service) != 0) { |
diff --git a/authfile.c b/authfile.c index 1d7e53cd1..e5fe0b801 100644 --- a/authfile.c +++ b/authfile.c | |||
@@ -68,6 +68,7 @@ | |||
68 | #include "rsa.h" | 68 | #include "rsa.h" |
69 | #include "misc.h" | 69 | #include "misc.h" |
70 | #include "atomicio.h" | 70 | #include "atomicio.h" |
71 | #include "pathnames.h" | ||
71 | 72 | ||
72 | #define MAX_KEY_FILE_SIZE (1024 * 1024) | 73 | #define MAX_KEY_FILE_SIZE (1024 * 1024) |
73 | 74 | ||
@@ -944,3 +945,140 @@ key_in_file(Key *key, const char *filename, int strict_type) | |||
944 | return ret; | 945 | return ret; |
945 | } | 946 | } |
946 | 947 | ||
948 | /* Scan a blacklist of known-vulnerable keys in blacklist_file. */ | ||
949 | static int | ||
950 | blacklisted_key_in_file(Key *key, const char *blacklist_file, char **fp) | ||
951 | { | ||
952 | int fd = -1; | ||
953 | char *dgst_hex = NULL; | ||
954 | char *dgst_packed = NULL, *p; | ||
955 | int i; | ||
956 | size_t line_len; | ||
957 | struct stat st; | ||
958 | char buf[256]; | ||
959 | off_t start, lower, upper; | ||
960 | int ret = 0; | ||
961 | |||
962 | debug("Checking blacklist file %s", blacklist_file); | ||
963 | fd = open(blacklist_file, O_RDONLY); | ||
964 | if (fd < 0) { | ||
965 | ret = -1; | ||
966 | goto out; | ||
967 | } | ||
968 | |||
969 | dgst_hex = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX); | ||
970 | /* Remove all colons */ | ||
971 | dgst_packed = xcalloc(1, strlen(dgst_hex) + 1); | ||
972 | for (i = 0, p = dgst_packed; dgst_hex[i]; i++) | ||
973 | if (dgst_hex[i] != ':') | ||
974 | *p++ = dgst_hex[i]; | ||
975 | /* Only compare least-significant 80 bits (to keep the blacklist | ||
976 | * size down) | ||
977 | */ | ||
978 | line_len = strlen(dgst_packed + 12); | ||
979 | if (line_len > 32) | ||
980 | goto out; | ||
981 | |||
982 | /* Skip leading comments */ | ||
983 | start = 0; | ||
984 | for (;;) { | ||
985 | ssize_t r; | ||
986 | char *newline; | ||
987 | |||
988 | r = atomicio(read, fd, buf, sizeof(buf)); | ||
989 | if (r <= 0) | ||
990 | goto out; | ||
991 | if (buf[0] != '#') | ||
992 | break; | ||
993 | |||
994 | newline = memchr(buf, '\n', sizeof(buf)); | ||
995 | if (!newline) | ||
996 | goto out; | ||
997 | start += newline + 1 - buf; | ||
998 | if (lseek(fd, start, SEEK_SET) < 0) | ||
999 | goto out; | ||
1000 | } | ||
1001 | |||
1002 | /* Initialise binary search record numbers */ | ||
1003 | if (fstat(fd, &st) < 0) | ||
1004 | goto out; | ||
1005 | lower = 0; | ||
1006 | upper = (st.st_size - start) / (line_len + 1); | ||
1007 | |||
1008 | while (lower != upper) { | ||
1009 | off_t cur; | ||
1010 | int cmp; | ||
1011 | |||
1012 | cur = lower + (upper - lower) / 2; | ||
1013 | |||
1014 | /* Read this line and compare to digest; this is | ||
1015 | * overflow-safe since cur < max(off_t) / (line_len + 1) */ | ||
1016 | if (lseek(fd, start + cur * (line_len + 1), SEEK_SET) < 0) | ||
1017 | break; | ||
1018 | if (atomicio(read, fd, buf, line_len) != line_len) | ||
1019 | break; | ||
1020 | cmp = memcmp(buf, dgst_packed + 12, line_len); | ||
1021 | if (cmp < 0) { | ||
1022 | if (cur == lower) | ||
1023 | break; | ||
1024 | lower = cur; | ||
1025 | } else if (cmp > 0) { | ||
1026 | if (cur == upper) | ||
1027 | break; | ||
1028 | upper = cur; | ||
1029 | } else { | ||
1030 | debug("Found %s in blacklist", dgst_hex); | ||
1031 | ret = 1; | ||
1032 | break; | ||
1033 | } | ||
1034 | } | ||
1035 | |||
1036 | out: | ||
1037 | if (dgst_packed) | ||
1038 | xfree(dgst_packed); | ||
1039 | if (ret != 1 && dgst_hex) { | ||
1040 | xfree(dgst_hex); | ||
1041 | dgst_hex = NULL; | ||
1042 | } | ||
1043 | if (fp) | ||
1044 | *fp = dgst_hex; | ||
1045 | if (fd >= 0) | ||
1046 | close(fd); | ||
1047 | return ret; | ||
1048 | } | ||
1049 | |||
1050 | /* | ||
1051 | * Scan blacklists of known-vulnerable keys. If a vulnerable key is found, | ||
1052 | * its fingerprint is returned in *fp, unless fp is NULL. | ||
1053 | */ | ||
1054 | int | ||
1055 | blacklisted_key(Key *key, char **fp) | ||
1056 | { | ||
1057 | Key *public; | ||
1058 | char *blacklist_file; | ||
1059 | int ret, ret2; | ||
1060 | |||
1061 | public = key_demote(key); | ||
1062 | if (public->type == KEY_RSA1) | ||
1063 | public->type = KEY_RSA; | ||
1064 | |||
1065 | xasprintf(&blacklist_file, "%s.%s-%u", | ||
1066 | _PATH_BLACKLIST, key_type(public), key_size(public)); | ||
1067 | ret = blacklisted_key_in_file(public, blacklist_file, fp); | ||
1068 | xfree(blacklist_file); | ||
1069 | if (ret > 0) { | ||
1070 | key_free(public); | ||
1071 | return ret; | ||
1072 | } | ||
1073 | |||
1074 | xasprintf(&blacklist_file, "%s.%s-%u", | ||
1075 | _PATH_BLACKLIST_CONFIG, key_type(public), key_size(public)); | ||
1076 | ret2 = blacklisted_key_in_file(public, blacklist_file, fp); | ||
1077 | xfree(blacklist_file); | ||
1078 | if (ret2 > ret) | ||
1079 | ret = ret2; | ||
1080 | |||
1081 | key_free(public); | ||
1082 | return ret; | ||
1083 | } | ||
1084 | |||
diff --git a/authfile.h b/authfile.h index 78349beb5..3f2bdcb06 100644 --- a/authfile.h +++ b/authfile.h | |||
@@ -28,4 +28,6 @@ Key *key_load_private_pem(int, int, const char *, char **); | |||
28 | int key_perm_ok(int, const char *); | 28 | int key_perm_ok(int, const char *); |
29 | int key_in_file(Key *, const char *, int); | 29 | int key_in_file(Key *, const char *, int); |
30 | 30 | ||
31 | int blacklisted_key(Key *key, char **fp); | ||
32 | |||
31 | #endif | 33 | #endif |
diff --git a/clientloop.c b/clientloop.c index 17628efb5..18a85c56c 100644 --- a/clientloop.c +++ b/clientloop.c | |||
@@ -545,16 +545,21 @@ client_global_request_reply(int type, u_int32_t seq, void *ctxt) | |||
545 | static void | 545 | static void |
546 | server_alive_check(void) | 546 | server_alive_check(void) |
547 | { | 547 | { |
548 | if (packet_inc_alive_timeouts() > options.server_alive_count_max) { | 548 | if (compat20) { |
549 | logit("Timeout, server %s not responding.", host); | 549 | if (packet_inc_alive_timeouts() > options.server_alive_count_max) { |
550 | cleanup_exit(255); | 550 | logit("Timeout, server %s not responding.", host); |
551 | cleanup_exit(255); | ||
552 | } | ||
553 | packet_start(SSH2_MSG_GLOBAL_REQUEST); | ||
554 | packet_put_cstring("keepalive@openssh.com"); | ||
555 | packet_put_char(1); /* boolean: want reply */ | ||
556 | packet_send(); | ||
557 | /* Insert an empty placeholder to maintain ordering */ | ||
558 | client_register_global_confirm(NULL, NULL); | ||
559 | } else { | ||
560 | packet_send_ignore(0); | ||
561 | packet_send(); | ||
551 | } | 562 | } |
552 | packet_start(SSH2_MSG_GLOBAL_REQUEST); | ||
553 | packet_put_cstring("keepalive@openssh.com"); | ||
554 | packet_put_char(1); /* boolean: want reply */ | ||
555 | packet_send(); | ||
556 | /* Insert an empty placeholder to maintain ordering */ | ||
557 | client_register_global_confirm(NULL, NULL); | ||
558 | } | 563 | } |
559 | 564 | ||
560 | /* | 565 | /* |
@@ -614,7 +619,7 @@ client_wait_until_can_do_something(fd_set **readsetp, fd_set **writesetp, | |||
614 | */ | 619 | */ |
615 | 620 | ||
616 | timeout_secs = INT_MAX; /* we use INT_MAX to mean no timeout */ | 621 | timeout_secs = INT_MAX; /* we use INT_MAX to mean no timeout */ |
617 | if (options.server_alive_interval > 0 && compat20) | 622 | if (options.server_alive_interval > 0) |
618 | timeout_secs = options.server_alive_interval; | 623 | timeout_secs = options.server_alive_interval; |
619 | set_control_persist_exit_time(); | 624 | set_control_persist_exit_time(); |
620 | if (control_persist_exit_time > 0) { | 625 | if (control_persist_exit_time > 0) { |
@@ -1614,8 +1619,10 @@ client_loop(int have_pty, int escape_char_arg, int ssh2_chan_id) | |||
1614 | exit_status = 0; | 1619 | exit_status = 0; |
1615 | } | 1620 | } |
1616 | 1621 | ||
1617 | if (received_signal) | 1622 | if (received_signal) { |
1618 | fatal("Killed by signal %d.", (int) received_signal); | 1623 | debug("Killed by signal %d.", (int) received_signal); |
1624 | cleanup_exit((int) received_signal + 128); | ||
1625 | } | ||
1619 | 1626 | ||
1620 | /* | 1627 | /* |
1621 | * In interactive mode (with pseudo tty) display a message indicating | 1628 | * In interactive mode (with pseudo tty) display a message indicating |
diff --git a/contrib/gnome-ssh-askpass2.c b/contrib/gnome-ssh-askpass2.c index 9d97c30c0..04b3a110e 100644 --- a/contrib/gnome-ssh-askpass2.c +++ b/contrib/gnome-ssh-askpass2.c | |||
@@ -209,6 +209,8 @@ main(int argc, char **argv) | |||
209 | 209 | ||
210 | gtk_init(&argc, &argv); | 210 | gtk_init(&argc, &argv); |
211 | 211 | ||
212 | gtk_window_set_default_icon_from_file ("/usr/share/pixmaps/ssh-askpass-gnome.png", NULL); | ||
213 | |||
212 | if (argc > 1) { | 214 | if (argc > 1) { |
213 | message = g_strjoinv(" ", argv + 1); | 215 | message = g_strjoinv(" ", argv + 1); |
214 | } else { | 216 | } else { |
diff --git a/debian/NEWS b/debian/NEWS new file mode 100644 index 000000000..7a67e1528 --- /dev/null +++ b/debian/NEWS | |||
@@ -0,0 +1,42 @@ | |||
1 | openssh (1:5.4p1-2) unstable; urgency=low | ||
2 | |||
3 | Smartcard support is now available using PKCS#11 tokens. If you were | ||
4 | previously using an unofficial build of Debian's OpenSSH package with | ||
5 | OpenSC-based smartcard support added, then note that commands like | ||
6 | 'ssh-add -s 0' will no longer work; you need to use 'ssh-add -s | ||
7 | /usr/lib/opensc-pkcs11.so' instead. | ||
8 | |||
9 | -- Colin Watson <cjwatson@debian.org> Sat, 10 Apr 2010 01:08:59 +0100 | ||
10 | |||
11 | openssh (1:3.8.1p1-9) experimental; urgency=low | ||
12 | |||
13 | The ssh package has been split into openssh-client and openssh-server. If | ||
14 | you had previously requested that the sshd server should not be run, then | ||
15 | that request will still be honoured. However, the recommended approach is | ||
16 | now to remove the openssh-server package if you do not want to run sshd. | ||
17 | You can remove the old /etc/ssh/sshd_not_to_be_run marker file after doing | ||
18 | that. | ||
19 | |||
20 | -- Colin Watson <cjwatson@debian.org> Mon, 2 Aug 2004 20:48:54 +0100 | ||
21 | |||
22 | openssh (1:3.5p1-1) unstable; urgency=low | ||
23 | |||
24 | This version of OpenSSH disables the environment option for public keys by | ||
25 | default, in order to avoid certain attacks (for example, LD_PRELOAD). If | ||
26 | you are using this option in an authorized_keys file, beware that the keys | ||
27 | in question will no longer work until the option is removed. | ||
28 | |||
29 | To re-enable this option, set "PermitUserEnvironment yes" in | ||
30 | /etc/ssh/sshd_config after the upgrade is complete, taking note of the | ||
31 | warning in the sshd_config(5) manual page. | ||
32 | |||
33 | -- Colin Watson <cjwatson@debian.org> Sat, 26 Oct 2002 19:41:51 +0100 | ||
34 | |||
35 | openssh (1:3.0.1p1-1) unstable; urgency=high | ||
36 | |||
37 | As of version 3, OpenSSH no longer uses separate files for ssh1 and ssh2 | ||
38 | keys. This means the authorized_keys2 and known_hosts2 files are no longer | ||
39 | needed. They will still be read in order to maintain backward | ||
40 | compatibility. | ||
41 | |||
42 | -- Matthew Vernon <matthew@debian.org> Thu, 28 Nov 2001 17:43:01 +0000 | ||
diff --git a/debian/README.Debian b/debian/README.Debian new file mode 100644 index 000000000..f37cce4b0 --- /dev/null +++ b/debian/README.Debian | |||
@@ -0,0 +1,234 @@ | |||
1 | OpenSSH for Debian | ||
2 | ------------------ | ||
3 | |||
4 | UPGRADE ISSUES | ||
5 | ============== | ||
6 | |||
7 | Privilege Separation | ||
8 | -------------------- | ||
9 | |||
10 | As of 3.3, openssh has employed privilege separation to reduce the | ||
11 | quantity of code that runs as root, thereby reducing the impact of | ||
12 | some security holes in sshd. This now also works properly with PAM. | ||
13 | |||
14 | Privilege separation is turned on by default, so, if you decide you | ||
15 | want it turned off, you need to add "UsePrivilegeSeparation no" to | ||
16 | /etc/ssh/sshd_config. | ||
17 | |||
18 | PermitRootLogin set to yes | ||
19 | -------------------------- | ||
20 | |||
21 | This is now the default setting (in line with upstream), and people | ||
22 | who asked for an automatically-generated configuration file when | ||
23 | upgrading from potato (or on a new install) will have this setting in | ||
24 | their /etc/ssh/sshd_config file. | ||
25 | |||
26 | Should you wish to change this setting, edit /etc/ssh/sshd_config, and | ||
27 | change: | ||
28 | PermitRootLogin yes | ||
29 | to: | ||
30 | PermitRootLogin no | ||
31 | |||
32 | Having PermitRootLogin set to yes means that an attacker that knows | ||
33 | the root password can ssh in directly (without having to go via a user | ||
34 | account). If you set it to no, then they must compromise a normal user | ||
35 | account. In the vast majority of cases, this does not give added | ||
36 | security; remember that any account you su to root from is equivalent | ||
37 | to root - compromising this account gives an attacker access to root | ||
38 | easily. If you only ever log in as root from the physical console, | ||
39 | then you probably want to set this value to no. | ||
40 | |||
41 | As an aside, PermitRootLogin can also be set to "without-password" or | ||
42 | "forced-commands-only" - see sshd(8) for more details. | ||
43 | |||
44 | DO NOT FILE BUG REPORTS SAYING YOU THINK THIS DEFAULT IS INCORRECT! | ||
45 | |||
46 | The argument above is somewhat condensed; I have had this discussion | ||
47 | at great length with many people. If you think the default is | ||
48 | incorrect, and feel strongly enough to want to argue about it, then | ||
49 | send email to debian-ssh@lists.debian.org. I will close bug reports | ||
50 | claiming the default is incorrect. | ||
51 | |||
52 | SSH now uses protocol 2 by default | ||
53 | ---------------------------------- | ||
54 | |||
55 | This means all your keyfiles you used for protocol version 1 need to | ||
56 | be re-generated. The server keys are done automatically, but for RSA | ||
57 | authentication, please read the ssh-keygen manpage. | ||
58 | |||
59 | If you have an automatically generated configuration file, and decide | ||
60 | at a later stage that you do want to support protocol version 1 (not | ||
61 | recommended, but note that the ssh client shipped with Debian potato | ||
62 | only supported protocol version 1), then you need to do the following: | ||
63 | |||
64 | Change /etc/ssh/sshd_config such that: | ||
65 | Protocol 2 | ||
66 | becomes: | ||
67 | Protocol 2,1 | ||
68 | Also add the line: | ||
69 | HostKey /etc/ssh/ssh_host_key | ||
70 | |||
71 | If you do not already have an RSA1 host key in /etc/ssh/ssh_host_key, | ||
72 | you will need to generate one. To do so, run this command as root: | ||
73 | |||
74 | ssh-keygen -f /etc/ssh/ssh_host_key -N '' -t rsa1 | ||
75 | |||
76 | As of openssh-server 1:4.1p1-2, the option to support protocol version 1 | ||
77 | is no longer available via debconf. You must edit the configuration file | ||
78 | instead. | ||
79 | |||
80 | X11 Forwarding | ||
81 | -------------- | ||
82 | |||
83 | ssh's default for ForwardX11 has been changed to ``no'' because it has | ||
84 | been pointed out that logging into remote systems administered by | ||
85 | untrusted people is likely to open you up to X11 attacks, so you | ||
86 | should have to actively decide that you trust the remote machine's | ||
87 | root, before enabling X11. I strongly recommend that you do this on a | ||
88 | machine-by-machine basis, rather than just enabling it in the default | ||
89 | host settings. | ||
90 | |||
91 | In order for X11 forwarding to work, you need to install xauth on the | ||
92 | server. In Debian this is in the xbase-clients package. | ||
93 | |||
94 | As of OpenSSH 3.1, the remote $DISPLAY uses localhost by default to reduce | ||
95 | the security risks of X11 forwarding. Look up X11UseLocalhost in | ||
96 | sshd_config(8) if this is a problem. | ||
97 | |||
98 | OpenSSH 3.8 invented ForwardX11Trusted, which when set to no causes the | ||
99 | ssh client to create an untrusted X cookie so that attacks on the | ||
100 | forwarded X11 connection can't become attacks on X clients on the remote | ||
101 | machine. However, this has some problems in implementation - notably a | ||
102 | very short timeout of the untrusted cookie - breaks large numbers of | ||
103 | existing setups, and generally seems immature. The Debian package | ||
104 | therefore sets the default for this option to "yes" (in ssh itself, | ||
105 | rather than in ssh_config). | ||
106 | |||
107 | Fallback to RSH | ||
108 | --------------- | ||
109 | |||
110 | The default for this setting has been changed from Yes to No, for | ||
111 | security reasons, and to stop the delay attempting to rsh to machines | ||
112 | that don't offer the service. Simply switch it back on in either | ||
113 | /etc/ssh/ssh_config or ~/.ssh/config for those machines that you need | ||
114 | it for. | ||
115 | |||
116 | Setgid ssh-agent and environment variables | ||
117 | ------------------------------------------ | ||
118 | |||
119 | As of version 1:3.5p1-1, ssh-agent is installed setgid to prevent ptrace() | ||
120 | attacks retrieving private key material. This has the side-effect of causing | ||
121 | glibc to remove certain environment variables which might have security | ||
122 | implications for set-id programs, including LD_PRELOAD, LD_LIBRARY_PATH, and | ||
123 | TMPDIR. | ||
124 | |||
125 | If you need to set any of these environment variables, you will need to do | ||
126 | so in the program exec()ed by ssh-agent. This may involve creating a small | ||
127 | wrapper script. | ||
128 | |||
129 | Symlink Hostname invocation | ||
130 | --------------------------- | ||
131 | |||
132 | This version of ssh no longer includes support for invoking ssh with the | ||
133 | hostname as the name of the file run. People wanting this support should | ||
134 | use the ssh-argv0 script. | ||
135 | |||
136 | =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= | ||
137 | |||
138 | OTHER ISSUES | ||
139 | ============ | ||
140 | |||
141 | /usr/bin/ssh not SUID | ||
142 | --------------------- | ||
143 | |||
144 | Due to Debian bug #164325, RhostsRSAAuthentication can only be used if ssh | ||
145 | is SUID. Until this is fixed, if that is a problem, use: | ||
146 | |||
147 | dpkg-statoverride | ||
148 | |||
149 | or if that's also missing, use this: | ||
150 | |||
151 | chown root.root /usr/bin/ssh | ||
152 | chmod 04755 /usr/bin/ssh | ||
153 | |||
154 | Authorization Forwarding | ||
155 | ------------------------ | ||
156 | |||
157 | Similarly, root on a remote server could make use of your ssh-agent | ||
158 | (while you're logged into their machine) to obtain access to machines | ||
159 | which trust your keys. This feature is therefore disabled by default. | ||
160 | You should only re-enable it for those hosts (in your ~/.ssh/config or | ||
161 | /etc/ssh/ssh_config) where you are confident that the remote machine | ||
162 | is not a threat. | ||
163 | |||
164 | Problems logging in with RSA authentication | ||
165 | ------------------------------------------- | ||
166 | |||
167 | If you have trouble logging in with RSA authentication then the | ||
168 | problem is probably caused by the fact that you have your home | ||
169 | directory writable by group, as well as user (this is the default on | ||
170 | Debian systems). | ||
171 | |||
172 | Depending upon other settings on your system (i.e. other users being | ||
173 | in your group) this could open a security hole, so you will need to | ||
174 | make your home directory writable only by yourself. Run this command, | ||
175 | as yourself: | ||
176 | |||
177 | chmod g-w ~/ | ||
178 | |||
179 | to remove group write permissions. If you use ssh-copy-id to install your | ||
180 | keys, it does this for you. | ||
181 | |||
182 | -L option of ssh nonfree | ||
183 | ------------------------ | ||
184 | |||
185 | non-free ssh supported the usage of the option -L to use a non privileged | ||
186 | port for scp. This option will not be supported by scp from openssh. | ||
187 | |||
188 | Please use instead scp -o "UsePrivilegedPort=no" as documented in the | ||
189 | manpage to scp itself. | ||
190 | |||
191 | Problem logging in because of TCP-Wrappers | ||
192 | ------------------------------------------ | ||
193 | |||
194 | ssh is compiled with support for tcp-wrappers. So if you can no longer | ||
195 | log into your system, please check that /etc/hosts.allow and /etc/hosts.deny | ||
196 | are configured so that ssh is not blocked. | ||
197 | |||
198 | Kerberos support | ||
199 | ---------------- | ||
200 | |||
201 | ssh is now compiled with Kerberos support. Unfortunately, privilege | ||
202 | separation is incompatible with Kerberos support for SSH protocol 1 and | ||
203 | parts of the support for protocol 2; you may need to run kinit after logging | ||
204 | in. | ||
205 | |||
206 | Interoperability between scp and the ssh.com SSH server | ||
207 | ------------------------------------------------------- | ||
208 | |||
209 | In version 2 and greater of the commercial SSH server produced by SSH | ||
210 | Communications Security, scp was changed to use SFTP (SSH2's file transfer | ||
211 | protocol) instead of the traditional rcp-over-ssh, thereby breaking | ||
212 | compatibility. The OpenSSH developers regard this as a bug in the ssh.com | ||
213 | server, and do not currently intend to change OpenSSH's scp to match. | ||
214 | |||
215 | Workarounds for this problem are to install scp1 on the server (scp2 will | ||
216 | fall back to it), to use sftp, or to use some other transfer mechanism such | ||
217 | as rsync-over-ssh or tar-over-ssh. | ||
218 | |||
219 | Running sshd from inittab | ||
220 | ------------------------- | ||
221 | |||
222 | Some people find it useful to run the sshd server from inittab, to make sure | ||
223 | that it always stays running. To do this, stop sshd ('/etc/init.d/ssh | ||
224 | stop'), add the following line to /etc/inittab, and run 'telinit q': | ||
225 | |||
226 | ss:2345:respawn:/usr/sbin/sshd -D | ||
227 | |||
228 | If you do this, note that you will need to stop sshd being started in the | ||
229 | normal way ('rm -f /etc/rc[2345].d/S16ssh') and that you will need to | ||
230 | restart this sshd manually on upgrades. | ||
231 | |||
232 | -- | ||
233 | Matthew Vernon <matthew@debian.org> | ||
234 | Colin Watson <cjwatson@debian.org> | ||
diff --git a/debian/README.compromised-keys b/debian/README.compromised-keys new file mode 100644 index 000000000..7a9cb7657 --- /dev/null +++ b/debian/README.compromised-keys | |||
@@ -0,0 +1,167 @@ | |||
1 | The following instructions relate to CVE-2008-0166. They were prepared by | ||
2 | Matt Zimmerman, assisted by Colin Watson. | ||
3 | |||
4 | == What Happened == | ||
5 | |||
6 | A weakness has been discovered in the random number generator used by OpenSSL | ||
7 | on Debian and Ubuntu systems. As a result of this weakness, certain encryption | ||
8 | keys are much more common than they should be, such that an attacker could | ||
9 | guess the key through a brute-force attack given minimal knowledge of the | ||
10 | system. This particularly affects the use of encryption keys in OpenSSH, | ||
11 | OpenVPN and SSL certificates. | ||
12 | |||
13 | This vulnerability only affects operating systems which (like Ubuntu) are based | ||
14 | on Debian. However, other systems can be indirectly affected if weak keys are | ||
15 | imported into them. | ||
16 | |||
17 | We consider this an extremely serious vulnerability, and urge all users to act | ||
18 | immediately to secure their systems. | ||
19 | |||
20 | == Who is affected == | ||
21 | |||
22 | Systems which are running any of the following releases: | ||
23 | |||
24 | * Debian 4.0 (etch) | ||
25 | * Ubuntu 7.04 (Feisty) | ||
26 | * Ubuntu 7.10 (Gutsy) | ||
27 | * Ubuntu 8.04 LTS (Hardy) | ||
28 | * Ubuntu "Intrepid Ibex" (development): libssl <= 0.9.8g-8 | ||
29 | |||
30 | and have openssh-server installed or have been used to create an OpenSSH key or | ||
31 | X.509 (SSL) certificate. | ||
32 | |||
33 | All OpenSSH and X.509 keys generated on such systems must be considered | ||
34 | untrustworthy, regardless of the system on which they are used, even after the | ||
35 | update has been applied. | ||
36 | |||
37 | This includes the automatically generated host keys used by OpenSSH, which are | ||
38 | the basis for its server spoofing and man-in-the-middle protection. | ||
39 | |||
40 | The specific package versions affected are: | ||
41 | |||
42 | * Debian 4.0: libssl <= 0.9.8c-4etch3 | ||
43 | * Ubuntu 7.04: libssl <= 0.9.8c-4ubuntu0.2 | ||
44 | * Ubuntu 7.10: libssl <= 0.9.8e-5ubuntu3.1 | ||
45 | * Ubuntu 8.04: libssl <= 0.9.8g-4ubuntu3 | ||
46 | |||
47 | == What to do if you are affected == | ||
48 | |||
49 | OpenSSH: | ||
50 | |||
51 | 1. Install the security updates | ||
52 | |||
53 | Once the update is applied, weak user keys will be automatically rejected | ||
54 | where possible (though they cannot be detected in all cases). If you are | ||
55 | using such keys for user authentication, they will immediately stop working | ||
56 | and will need to be replaced (see step 3). | ||
57 | |||
58 | OpenSSH host keys can be automatically regenerated when the OpenSSH security | ||
59 | update is applied. The update will prompt for confirmation before taking | ||
60 | this step. | ||
61 | |||
62 | 2. Update OpenSSH known_hosts files | ||
63 | |||
64 | The regeneration of host keys will cause a warning to be displayed when | ||
65 | connecting to the system using SSH until the host key is updated in the | ||
66 | known_hosts file. The warning will look like this: | ||
67 | |||
68 | @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ | ||
69 | @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ | ||
70 | @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ | ||
71 | IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! | ||
72 | Someone could be eavesdropping on you right now (man-in-the-middle attack)! | ||
73 | It is also possible that the RSA host key has just been changed. | ||
74 | |||
75 | In this case, the host key has simply been changed, and you should update | ||
76 | the relevant known_hosts file as indicated in the error message. | ||
77 | |||
78 | 3. Check all OpenSSH user keys | ||
79 | |||
80 | The safest course of action is to regenerate all OpenSSH user keys, | ||
81 | except where it can be established to a high degree of certainty that the | ||
82 | key was generated on an unaffected system. | ||
83 | |||
84 | Check whether your key is affected by running the ssh-vulnkey tool, included | ||
85 | in the security update. By default, ssh-vulnkey will check the standard | ||
86 | location for user keys (~/.ssh/id_rsa, ~/.ssh/id_dsa and ~/.ssh/identity), | ||
87 | your authorized_keys file (~/.ssh/authorized_keys and | ||
88 | ~/.ssh/authorized_keys2), and the system's host keys | ||
89 | (/etc/ssh/ssh_host_dsa_key and /etc/ssh/ssh_host_rsa_key). | ||
90 | |||
91 | To check all your own keys, assuming they are in the standard | ||
92 | locations (~/.ssh/id_rsa, ~/.ssh/id_dsa, or ~/.ssh/identity): | ||
93 | |||
94 | ssh-vulnkey | ||
95 | |||
96 | To check all keys on your system: | ||
97 | |||
98 | sudo ssh-vulnkey -a | ||
99 | |||
100 | To check a key in a non-standard location: | ||
101 | |||
102 | ssh-vulnkey /path/to/key | ||
103 | |||
104 | If ssh-vulnkey says "Unknown (no blacklist information)", then it has no | ||
105 | information about whether that key is affected. If in doubt, destroy the | ||
106 | key and generate a new one. | ||
107 | |||
108 | 4. Regenerate any affected user keys | ||
109 | |||
110 | OpenSSH keys used for user authentication must be manually regenerated, | ||
111 | including those which may have since been transferred to a different system | ||
112 | after being generated. | ||
113 | |||
114 | New keys can be generated using ssh-keygen, e.g.: | ||
115 | |||
116 | $ ssh-keygen | ||
117 | Generating public/private rsa key pair. | ||
118 | Enter file in which to save the key (/home/user/.ssh/id_rsa): | ||
119 | Enter passphrase (empty for no passphrase): | ||
120 | Enter same passphrase again: | ||
121 | Your identification has been saved in /home/user/.ssh/id_rsa. | ||
122 | Your public key has been saved in /home/user/.ssh/id_rsa.pub. | ||
123 | The key fingerprint is: | ||
124 | 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00 user@host | ||
125 | |||
126 | 5. Update authorized_keys files (if necessary) | ||
127 | |||
128 | Once the user keys have been regenerated, the relevant public keys must | ||
129 | be propagated to any authorized_keys files on remote systems. Be sure to | ||
130 | delete the affected key. | ||
131 | |||
132 | OpenSSL: | ||
133 | |||
134 | 1. Install the security update | ||
135 | |||
136 | 2. Create new certificates to replace any server or client certificates in use | ||
137 | on the system | ||
138 | |||
139 | 3. If certificates have been generated for use on other systems, they must be | ||
140 | found and replaced as well. | ||
141 | |||
142 | == Removing openssh-blacklist == | ||
143 | |||
144 | For the moment, the openssh-server package depends on openssh-blacklist, in | ||
145 | order that the blacklist is deployed to the maximum possible number of | ||
146 | systems to reduce the potential spread of worms exploiting this | ||
147 | vulnerability. We acknowledge that this may be inconvenient for some small | ||
148 | systems, but nevertheless feel that this was the best course of action. | ||
149 | |||
150 | If you absolutely need to remove the blacklist from your system, then you | ||
151 | can run the following commands to substitute a fake package for | ||
152 | openssh-blacklist: | ||
153 | |||
154 | sudo apt-get install equivs | ||
155 | equivs-control openssh-blacklist.ctl | ||
156 | sed -i 's/^Package:.*/Package: openssh-blacklist/' openssh-blacklist.ctl | ||
157 | sed -i 's/^# Version:.*/Version: 9:1.0/' openssh-blacklist.ctl | ||
158 | equivs-build openssh-blacklist.ctl | ||
159 | sudo dpkg -i openssh-blacklist_1.0_all.deb | ||
160 | |||
161 | Be warned: this circumvents a security measure for the sake of disk space. | ||
162 | You should only do this if you have no other option, and if you are certain | ||
163 | that no compromised keys will ever be generated on or copied onto this | ||
164 | system. | ||
165 | |||
166 | Once a sufficient amount of time and number of releases have passed, the | ||
167 | openssh-blacklist package will be phased out. | ||
diff --git a/debian/README.source b/debian/README.source new file mode 100644 index 000000000..cf28fbd48 --- /dev/null +++ b/debian/README.source | |||
@@ -0,0 +1,223 @@ | |||
1 | Debian OpenSSH source package handling | ||
2 | ====================================== | ||
3 | |||
4 | The Debian package of OpenSSH is maintained in Bazaar | ||
5 | (http://bazaar-vcs.org/, or the 'bzr' package in Debian). You will need at | ||
6 | least version 1.16.1; the version in Debian testing as of the time of | ||
7 | writing (2009-12-21) is fine, or you can use the version in lenny-backports. | ||
8 | URLs are as follows: | ||
9 | |||
10 | Anonymous branch: http://anonscm.debian.org/bzr/pkg-ssh/openssh/trunk | ||
11 | Web browsing: http://anonscm.debian.org/loggerhead/pkg-ssh/openssh/trunk | ||
12 | Authenticated, for developers with commit access only: | ||
13 | bzr+ssh://bzr.debian.org/bzr/pkg-ssh/openssh/trunk | ||
14 | |||
15 | Although it's possible that I may use something like bzr-loom in the future | ||
16 | to better manage things like the Kerberos/GSSAPI patch, right now there's no | ||
17 | funny business and all that developers need to do is: | ||
18 | |||
19 | # To check out: | ||
20 | bzr co bzr+ssh://bzr.debian.org/bzr/pkg-ssh/openssh/trunk openssh | ||
21 | |||
22 | # To update: | ||
23 | bzr up | ||
24 | |||
25 | # To edit: | ||
26 | # hack hack hack, and 'bzr add' any new files | ||
27 | debcommit # or bzr commit | ||
28 | # note that this pushes automatically; you can use 'bzr unbind' to | ||
29 | # temporarily prevent this, or 'bzr branch' to create a local branch which | ||
30 | # you can merge later | ||
31 | |||
32 | # To release: | ||
33 | dch -r && debcommit -r | ||
34 | |||
35 | If you have lots of branches, you'll probably want to use a shared | ||
36 | repository to save space. Run 'bzr init-repo .' in an ancestor directory of | ||
37 | all your OpenSSH working directories. For example, I have a shared | ||
38 | repository in ~/src/debian/openssh/, upstream checkouts in | ||
39 | ~/src/debian/openssh/upstream/, and my own working trees in | ||
40 | ~/src/debian/openssh/trunk/. | ||
41 | |||
42 | Patch handling | ||
43 | -------------- | ||
44 | |||
45 | This package uses quilt to manage all modifications to the upstream source. | ||
46 | Changes are stored in the source package as diffs in debian/patches and | ||
47 | applied automatically by dpkg-source when the source package is extracted. | ||
48 | |||
49 | To configure quilt to use debian/patches instead of patches, you want either | ||
50 | to export QUILT_PATCHES=debian/patches in your environment or use this | ||
51 | snippet in your ~/.quiltrc: | ||
52 | |||
53 | for where in ./ ../ ../../ ../../../ ../../../../ ../../../../../; do | ||
54 | if [ -e ${where}debian/rules -a -d ${where}debian/patches ]; then | ||
55 | export QUILT_PATCHES=debian/patches | ||
56 | break | ||
57 | fi | ||
58 | done | ||
59 | |||
60 | After unpacking the source package, all patches will be applied, and you can | ||
61 | use quilt normally. | ||
62 | |||
63 | If you check out the source code from bzr, then all patches will be applied, | ||
64 | but you will need to inform quilt of this manually. Do this by running: | ||
65 | |||
66 | debian/rules quilt-setup | ||
67 | |||
68 | To add a new set of changes, first run quilt push -a, and then run: | ||
69 | |||
70 | quilt new <patch> | ||
71 | |||
72 | where <patch> is a descriptive name for the patch, used as the filename in | ||
73 | debian/patches. Then, for every file that will be modified by this patch, | ||
74 | run: | ||
75 | |||
76 | quilt add <file> | ||
77 | |||
78 | before editing those files. You must tell quilt with quilt add what files | ||
79 | will be part of the patch before making changes or quilt will not work | ||
80 | properly. After editing the files, run: | ||
81 | |||
82 | quilt refresh | ||
83 | |||
84 | to save the results as a patch. | ||
85 | |||
86 | Alternately, if you already have an external patch and you just want to add | ||
87 | it to the build system, run quilt push -a and then: | ||
88 | |||
89 | quilt import -P <patch> /path/to/patch | ||
90 | quilt push -a | ||
91 | |||
92 | (add -p 0 to quilt import if needed). <patch> as above is the filename to | ||
93 | use in debian/patches. The last quilt push -a will apply the patch to make | ||
94 | sure it works properly. | ||
95 | |||
96 | To remove an existing patch from the list of patches that will be applied, | ||
97 | run: | ||
98 | |||
99 | quilt delete <patch> | ||
100 | |||
101 | You may need to run quilt pop -a to unapply patches first before running | ||
102 | this command. | ||
103 | |||
104 | You should only commit changes to bzr with all patches applied, i.e. after | ||
105 | 'quilt push -a'. | ||
106 | |||
107 | Merging new upstream releases | ||
108 | ----------------------------- | ||
109 | |||
110 | (Most developers will not need to read this section.) | ||
111 | |||
112 | Thanks to the import from Portable OpenSSH CVS provided by Launchpad | ||
113 | (https://code.launchpad.net/~vcs-imports/openssh/main, accessible by the | ||
114 | shortcut 'lp:openssh' from the bzr client), the Debian branch is a true DVCS | ||
115 | branch from upstream. This is a worthwhile property, but preserving it does | ||
116 | take a little bit of work. | ||
117 | |||
118 | Launchpad only imports CVS HEAD, but upstream sometimes produces releases | ||
119 | from a branch. We use the same software used by Launchpad to import the | ||
120 | branch as well, but a few small hacks are necessary to do good branch | ||
121 | imports. In Bazaar, it's important that the same file in different branches | ||
122 | should have the same file-id, otherwise merge attempts will try to delete | ||
123 | and re-add the file which usually doesn't work out very well. Occasionally a | ||
124 | file is added to CVS HEAD and then also added to a branch, and cscvs isn't | ||
125 | quite smart enough to spot this and copy over the file-id. We need to help | ||
126 | it out. | ||
127 | |||
128 | To fetch the necessary code: | ||
129 | |||
130 | bzr branch lp:~cjwatson/launchpad-cscvs/openssh-branch-imports | ||
131 | # or 'bzr pull' in the appropriate directory to update this, if you | ||
132 | # already have a copy | ||
133 | |||
134 | To import a branch, V_5_3 in this example: | ||
135 | |||
136 | export PATH="/path/to/cscvs/openssh-branch-imports:$PATH" | ||
137 | export PYTHONPATH=/path/to/cscvs/openssh-branch-imports/modules:/path/to/cscvs/openssh-branch-imports | ||
138 | # in a CVS checkout of :ext:anoncvs@anoncvs.mindrot.org:/cvs module | ||
139 | # openssh: | ||
140 | cscvs cache -b | ||
141 | # or 'cscvs cache -u' if you've done this before and want to update | ||
142 | cvs up -rV_5_3 | ||
143 | |||
144 | # Now we need to get a few bits of information from cscvs' cache. | ||
145 | sqlite CVS/Catalog.sqlite | ||
146 | sqlite> select csnum,log from changeset where branch = 'V_5_3' order by startdate; | ||
147 | # There will be a solid block of "Creation of branch V_5_3" changesets at | ||
148 | # the start; look for the first revision *after* this. Substitute this in | ||
149 | # the following wherever you see "CSX". | ||
150 | sqlite> select revision,filename from revision where branch = 'V_5_3' and csnum >= CSX and revision not like '%.%.%' order by filename; | ||
151 | # Anything listed here will need to be added to the openssh_ids dictionary | ||
152 | # in modules/CVS/StorageLayer.py in cscvs. Please send Colin Watson a | ||
153 | # patch if you do this. | ||
154 | |||
155 | # Next, look up the branchpoint revision in the main bzr import (bzr | ||
156 | # branch lp:openssh). It's usually easiest to just look it up by commit | ||
157 | # message and double-check the timestamp. Substitute this revision number | ||
158 | # for "BPR" in the following. /path/to/openssh/main is wherever you've | ||
159 | # checked out lp:openssh. | ||
160 | bzr branch -rBPR /path/to/openssh/main /path/to/openssh/5.3 | ||
161 | # If you're using Bazaar signed commits with a GPG agent, make sure that | ||
162 | # your agent has seen your passphrase recently. Now you can start the | ||
163 | # actual import! | ||
164 | cscvs -D4 totla -SC V_5_3.CSX: /path/to/openssh/5.3 | ||
165 | # If this fails at the end with a "directories differ" message, you may | ||
166 | # have forgotten to switch your CVS checkout to the appropriate branch | ||
167 | # with 'cvs up -r...' above. Otherwise you'll have to debug this for | ||
168 | # yourself. It's also worth double-checking that any files added to the | ||
169 | # branch have file-ids matching those on the trunk, using 'bzr ls -R | ||
170 | # --show-ids'. | ||
171 | |||
172 | Now we have a Bazaar branch corresponding to what's in CVS. Previous such | ||
173 | branches are available from Launchpad, for reference purposes: | ||
174 | |||
175 | https://code.launchpad.net/openssh | ||
176 | |||
177 | However, upstream releases involve a 'make distprep' step as well to | ||
178 | construct the tarball, and we need to import the results of this as well to | ||
179 | get a clean package. | ||
180 | |||
181 | Start by unpacking the upstream tarball (remember to check its GPG signature | ||
182 | first!). Copy the .bzr directory from the upstream branch you prepared | ||
183 | earlier. Now we have another branch, but with a working tree corresponding | ||
184 | to the upstream tarball. Modifications and deletions are handled | ||
185 | automatically, but we need to handle additions explicitly to make sure | ||
186 | file-ids are correct (see above). Run: | ||
187 | |||
188 | bzr add --file-ids-from=/path/to/openssh/debian/trunk | ||
189 | bzr st --show-ids | ||
190 | # compare this with 'bzr ls --show-ids' in the Debian trunk to make sure | ||
191 | # the result will be mergeable | ||
192 | bzr ci -m 'Import 5.3p1 tarball' | ||
193 | |||
194 | Add a parent revision for the previous tarball branch, to make it easier for | ||
195 | bzr to compute accurate merges. | ||
196 | |||
197 | bzr log -n0 /path/to/openssh/debian/trunk | less | ||
198 | # find revision number for previous tarball import, hence 'PREVIOUS' | ||
199 | bzr merge -rPREVIOUS /path/to/openssh/debian/trunk | ||
200 | # merge history only, no file changes | ||
201 | bzr revert . | ||
202 | bzr ci -m 'add 5.2p1 tarball parent revision' | ||
203 | bzr tag upstream-5.3p1 | ||
204 | |||
205 | Next, merge this into the gssapi branch | ||
206 | (bzr+ssh://bzr.debian.org/bzr/pkg-ssh/openssh/gssapi/). For this branch, we | ||
207 | want to ignore the normal results of merging and take only the patch from | ||
208 | http://www.sxw.org.uk/computing/patches/openssh.html; of course such a patch | ||
209 | needs to exist first! To do this, run this in the gssapi branch: | ||
210 | |||
211 | bzr merge /path/to/openssh/tarball/branch | ||
212 | bzr revert -rrevno:-1:/path/to/openssh/tarball/branch . | ||
213 | patch -p1 </path/to/openssh/gssapi/patch | ||
214 | bzr add --file-ids-from=/path/to/openssh/debian/trunk | ||
215 | # you may need to deal with applying configure.ac changes to configure | ||
216 | # here | ||
217 | bzr ci -m 'import openssh-5.3p1-gsskex-all-20100124.patch' | ||
218 | |||
219 | You should now be able to 'bzr merge' from the gssapi branch into the Debian | ||
220 | trunk, resolve conflicts, and commit. If you see lots of "Contents conflict" | ||
221 | messages, you may have got the file-ids wrong. Once you've committed the | ||
222 | merge, you can throw away the tarball branch, as all its history will have | ||
223 | been incorporated. | ||
diff --git a/debian/changelog b/debian/changelog new file mode 100644 index 000000000..108d915bb --- /dev/null +++ b/debian/changelog | |||
@@ -0,0 +1,3280 @@ | |||
1 | openssh (1:5.9p1-1) UNRELEASED; urgency=low | ||
2 | |||
3 | * New upstream release (http://www.openssh.org/txt/release-5.9). | ||
4 | - Introduce sandboxing of the pre-auth privsep child using an optional | ||
5 | sshd_config(5) "UsePrivilegeSeparation=sandbox" mode that enables | ||
6 | mandatory restrictions on the syscalls the privsep child can perform. | ||
7 | - Add new SHA256-based HMAC transport integrity modes from | ||
8 | http://www.ietf.org/id/draft-dbider-sha2-mac-for-ssh-02.txt. | ||
9 | - The pre-authentication sshd(8) privilege separation slave process now | ||
10 | logs via a socket shared with the master process, avoiding the need to | ||
11 | maintain /dev/log inside the chroot (closes: #75043, #429243, | ||
12 | #599240). | ||
13 | - ssh(1) now warns when a server refuses X11 forwarding (closes: | ||
14 | #504757). | ||
15 | - sshd_config(5)'s AuthorizedKeysFile now accepts multiple paths, | ||
16 | separated by whitespace (closes: #76312). The authorized_keys2 | ||
17 | fallback is deprecated but documented (closes: #560156). | ||
18 | - ssh(1) and sshd(8): set IPv6 traffic class from IPQoS, as well as IPv4 | ||
19 | ToS/DSCP (closes: #498297). | ||
20 | - ssh-add(1) now accepts keys piped from standard input. E.g. "ssh-add | ||
21 | - < /path/to/key" (closes: #229124). | ||
22 | - Clean up lost-passphrase text in ssh-keygen(1) (closes: #444691). | ||
23 | - Say "required" rather than "recommended" in unprotected-private-key | ||
24 | warning (LP: #663455). | ||
25 | |||
26 | -- Colin Watson <cjwatson@debian.org> Tue, 06 Sep 2011 10:16:33 +0100 | ||
27 | |||
28 | openssh (1:5.8p1-7) unstable; urgency=low | ||
29 | |||
30 | * Only recommend ssh-import-id when built on Ubuntu (closes: #635887). | ||
31 | * Use 'dpkg-vendor --derives-from Ubuntu' to detect Ubuntu systems rather | ||
32 | than 'lsb_release -is' so that Ubuntu derivatives behave the same way as | ||
33 | Ubuntu itself. | ||
34 | |||
35 | -- Colin Watson <cjwatson@debian.org> Fri, 29 Jul 2011 14:27:52 +0100 | ||
36 | |||
37 | openssh (1:5.8p1-6) unstable; urgency=low | ||
38 | |||
39 | * openssh-client and openssh-server Suggests: monkeysphere. | ||
40 | * Quieten logs when multiple from= restrictions are used in different | ||
41 | authorized_keys lines for the same key; it's still not ideal, but at | ||
42 | least you'll only get one log entry per key (closes: #630606). | ||
43 | * Merge from Ubuntu (Dustin Kirkland): | ||
44 | - openssh-server Recommends: ssh-import-id (no-op in Debian since that | ||
45 | package doesn't exist there, but this reduces the Ubuntu delta). | ||
46 | |||
47 | -- Colin Watson <cjwatson@debian.org> Thu, 28 Jul 2011 17:10:18 +0100 | ||
48 | |||
49 | openssh (1:5.8p1-5) unstable; urgency=low | ||
50 | |||
51 | * Drop openssh-server's dependency on openssh-blacklist to a | ||
52 | recommendation (closes: #622604). | ||
53 | * Update Vcs-* fields and README.source for Alioth changes. | ||
54 | * Backport from upstream: | ||
55 | - Make hostbased auth with ECDSA keys work correctly (closes: #633368). | ||
56 | |||
57 | -- Colin Watson <cjwatson@debian.org> Sun, 24 Jul 2011 11:06:47 +0100 | ||
58 | |||
59 | openssh (1:5.8p1-4) unstable; urgency=low | ||
60 | |||
61 | * Drop hardcoded dependencies on libssl0.9.8 and libcrypto0.9.8-udeb, | ||
62 | since the required minimum versions are rather old now anyway and | ||
63 | openssl has bumped its SONAME (thanks, Julien Cristau; closes: #620828). | ||
64 | * Remove unreachable code from openssh-server.postinst. | ||
65 | |||
66 | -- Colin Watson <cjwatson@debian.org> Mon, 04 Apr 2011 15:56:18 +0100 | ||
67 | |||
68 | openssh (1:5.8p1-3) unstable; urgency=low | ||
69 | |||
70 | * Correct ssh-keygen instruction in the changelog for 1:5.7p1-1 (thanks, | ||
71 | Joel Stanley). | ||
72 | * Allow ssh-add to read from FIFOs (thanks, Daniel Kahn Gillmor; closes: | ||
73 | #614897). | ||
74 | |||
75 | -- Colin Watson <cjwatson@debian.org> Fri, 18 Mar 2011 16:42:42 +0000 | ||
76 | |||
77 | openssh (1:5.8p1-2) unstable; urgency=low | ||
78 | |||
79 | * Upload to unstable. | ||
80 | |||
81 | -- Colin Watson <cjwatson@debian.org> Tue, 08 Feb 2011 10:59:17 +0000 | ||
82 | |||
83 | openssh (1:5.8p1-1) experimental; urgency=low | ||
84 | |||
85 | * New upstream release (http://www.openssh.org/txt/release-5.8): | ||
86 | - Fix stack information leak in legacy certificate signing | ||
87 | (http://www.openssh.com/txt/legacy-cert.adv). | ||
88 | |||
89 | -- Colin Watson <cjwatson@debian.org> Sat, 05 Feb 2011 11:13:11 +0000 | ||
90 | |||
91 | openssh (1:5.7p1-2) experimental; urgency=low | ||
92 | |||
93 | * Fix crash in ssh_selinux_setfscreatecon when SELinux is disabled | ||
94 | (LP: #708571). | ||
95 | |||
96 | -- Colin Watson <cjwatson@debian.org> Thu, 27 Jan 2011 12:14:17 +0000 | ||
97 | |||
98 | openssh (1:5.7p1-1) experimental; urgency=low | ||
99 | |||
100 | * New upstream release (http://www.openssh.org/txt/release-5.7): | ||
101 | - Implement Elliptic Curve Cryptography modes for key exchange (ECDH) | ||
102 | and host/user keys (ECDSA) as specified by RFC5656. ECDH and ECDSA | ||
103 | offer better performance than plain DH and DSA at the same equivalent | ||
104 | symmetric key length, as well as much shorter keys. | ||
105 | - sftp(1)/sftp-server(8): add a protocol extension to support a hard | ||
106 | link operation. It is available through the "ln" command in the | ||
107 | client. The old "ln" behaviour of creating a symlink is available | ||
108 | using its "-s" option or through the preexisting "symlink" command. | ||
109 | - scp(1): Add a new -3 option to scp: Copies between two remote hosts | ||
110 | are transferred through the local host (closes: #508613). | ||
111 | - ssh(1): "atomically" create the listening mux socket by binding it on | ||
112 | a temporary name and then linking it into position after listen() has | ||
113 | succeeded. This allows the mux clients to determine that the server | ||
114 | socket is either ready or stale without races (closes: #454784). | ||
115 | Stale server sockets are now automatically removed (closes: #523250). | ||
116 | - ssh(1): install a SIGCHLD handler to reap expired child process | ||
117 | (closes: #594687). | ||
118 | - ssh(1)/ssh-agent(1): honour $TMPDIR for client xauth and ssh-agent | ||
119 | temporary directories (closes: #357469, although only if you arrange | ||
120 | for ssh-agent to actually see $TMPDIR since the setgid bit will cause | ||
121 | it to be stripped off). | ||
122 | * Update to current GSSAPI patch from | ||
123 | http://www.sxw.org.uk/computing/patches/openssh-5.7p1-gsskex-all-20110125.patch: | ||
124 | - Add GSSAPIServerIdentity option. | ||
125 | * Generate ECDSA host keys on fresh installations. Upgraders who wish to | ||
126 | add such host keys should manually add 'HostKey | ||
127 | /etc/ssh/ssh_host_ecdsa_key' to /etc/ssh/sshd_config and run 'ssh-keygen | ||
128 | -q -f /etc/ssh/ssh_host_ecdsa_key -N "" -t ecdsa'. | ||
129 | * Build-depend on libssl-dev (>= 0.9.8g) to ensure sufficient ECC support. | ||
130 | * Backport SELinux build fix from CVS. | ||
131 | * Rearrange selinux-role.patch so that it links properly given this | ||
132 | SELinux build fix. | ||
133 | |||
134 | -- Colin Watson <cjwatson@debian.org> Wed, 26 Jan 2011 23:48:02 +0000 | ||
135 | |||
136 | openssh (1:5.6p1-3) experimental; urgency=low | ||
137 | |||
138 | * Drop override for desktop-file-but-no-dh_desktop-call, which Lintian no | ||
139 | longer issues. | ||
140 | * Merge 1:5.5p1-6. | ||
141 | |||
142 | -- Colin Watson <cjwatson@debian.org> Thu, 30 Dec 2010 11:48:00 +0000 | ||
143 | |||
144 | openssh (1:5.6p1-2) experimental; urgency=low | ||
145 | |||
146 | * Backport upstream patch to install a SIGCHLD handler to reap expired ssh | ||
147 | child processes, preventing lots of zombies when using ControlPersist | ||
148 | (closes: #594687). | ||
149 | |||
150 | -- Colin Watson <cjwatson@debian.org> Tue, 26 Oct 2010 14:46:40 +0100 | ||
151 | |||
152 | openssh (1:5.6p1-1) experimental; urgency=low | ||
153 | |||
154 | * New upstream release (http://www.openssh.com/txt/release-5.6): | ||
155 | - Added a ControlPersist option to ssh_config(5) that automatically | ||
156 | starts a background ssh(1) multiplex master when connecting. This | ||
157 | connection can stay alive indefinitely, or can be set to automatically | ||
158 | close after a user-specified duration of inactivity (closes: #335697, | ||
159 | #350898, #454787, #500573, #550262). | ||
160 | - Support AuthorizedKeysFile, AuthorizedPrincipalsFile, | ||
161 | HostbasedUsesNameFromPacketOnly, and PermitTunnel in sshd_config(5) | ||
162 | Match blocks (closes: #549858). | ||
163 | - sftp(1): fix ls in working directories that contain globbing | ||
164 | characters in their pathnames (LP: #530714). | ||
165 | |||
166 | -- Colin Watson <cjwatson@debian.org> Tue, 24 Aug 2010 00:37:54 +0100 | ||
167 | |||
168 | openssh (1:5.5p1-6) unstable; urgency=low | ||
169 | |||
170 | * Touch /var/run/sshd/.placeholder in the preinst so that /var/run/sshd, | ||
171 | which is intentionally no longer shipped in the openssh-server package | ||
172 | due to /var/run often being a temporary directory, is not removed on | ||
173 | upgrade (closes: #575582). | ||
174 | |||
175 | -- Colin Watson <cjwatson@debian.org> Sun, 26 Dec 2010 18:09:29 +0000 | ||
176 | |||
177 | openssh (1:5.5p1-5) unstable; urgency=low | ||
178 | |||
179 | * Use an architecture wildcard for libselinux1-dev (closes: #591740). | ||
180 | * debconf template translations: | ||
181 | - Update Danish (thanks, Joe Hansen; closes: #592800). | ||
182 | |||
183 | -- Colin Watson <cjwatson@debian.org> Mon, 23 Aug 2010 22:59:03 +0100 | ||
184 | |||
185 | openssh (1:5.5p1-4) unstable; urgency=low | ||
186 | |||
187 | [ Sebastian Andrzej Siewior ] | ||
188 | * Add powerpcspe to architecture list for libselinux1-dev build-dependency | ||
189 | (closes: #579843). | ||
190 | |||
191 | [ Colin Watson ] | ||
192 | * Allow ~/.ssh/authorized_keys and other secure files to be | ||
193 | group-writable, provided that the group in question contains only the | ||
194 | file's owner; this extends a patch previously applied to ~/.ssh/config | ||
195 | (closes: #581919). | ||
196 | * Check primary group memberships as well as supplementary group | ||
197 | memberships, and only allow group-writability by groups with exactly one | ||
198 | member, as zero-member groups are typically used by setgid binaries | ||
199 | rather than being user-private groups (closes: #581697). | ||
200 | |||
201 | -- Colin Watson <cjwatson@debian.org> Sat, 22 May 2010 23:37:20 +0100 | ||
202 | |||
203 | openssh (1:5.5p1-3) unstable; urgency=low | ||
204 | |||
205 | * Discard error messages while checking whether rsh, rlogin, and rcp | ||
206 | alternatives exist (closes: #579285). | ||
207 | * Drop IDEA key check; I don't think it works properly any more due to | ||
208 | textual changes in error output, it's only relevant for direct upgrades | ||
209 | from truly ancient versions, and it breaks upgrades if | ||
210 | /etc/ssh/ssh_host_key can't be loaded (closes: #579570). | ||
211 | |||
212 | -- Colin Watson <cjwatson@debian.org> Wed, 28 Apr 2010 22:12:47 +0100 | ||
213 | |||
214 | openssh (1:5.5p1-2) unstable; urgency=low | ||
215 | |||
216 | * Use dh_installinit -n, since our maintainer scripts already handle this | ||
217 | more carefully (thanks, Julien Cristau). | ||
218 | |||
219 | -- Colin Watson <cjwatson@debian.org> Sat, 17 Apr 2010 12:55:56 +0100 | ||
220 | |||
221 | openssh (1:5.5p1-1) unstable; urgency=low | ||
222 | |||
223 | * New upstream release: | ||
224 | - Unbreak sshd_config's AuthorizedKeysFile option for $HOME-relative | ||
225 | paths. | ||
226 | - Include a language tag when sending a protocol 2 disconnection | ||
227 | message. | ||
228 | - Make logging of certificates used for user authentication more clear | ||
229 | and consistent between CAs specified using TrustedUserCAKeys and | ||
230 | authorized_keys. | ||
231 | |||
232 | -- Colin Watson <cjwatson@debian.org> Fri, 16 Apr 2010 10:27:30 +0100 | ||
233 | |||
234 | openssh (1:5.4p1-2) unstable; urgency=low | ||
235 | |||
236 | * Borrow patch from Fedora to add DNSSEC support: if glibc 2.11 is | ||
237 | installed, the host key is published in an SSHFP RR secured with DNSSEC, | ||
238 | and VerifyHostKeyDNS=yes, then ssh will no longer prompt for host key | ||
239 | verification (closes: #572049). | ||
240 | * Convert to dh(1), and use dh_installdocs --link-doc. | ||
241 | * Drop lpia support, since Ubuntu no longer supports this architecture. | ||
242 | * Use dh_install more effectively. | ||
243 | * Add a NEWS.Debian entry about changes in smartcard support relative to | ||
244 | previous unofficial builds (closes: #231472). | ||
245 | |||
246 | -- Colin Watson <cjwatson@debian.org> Sat, 10 Apr 2010 01:08:59 +0100 | ||
247 | |||
248 | openssh (1:5.4p1-1) unstable; urgency=low | ||
249 | |||
250 | * New upstream release (LP: #535029). | ||
251 | - After a transition period of about 10 years, this release disables SSH | ||
252 | protocol 1 by default. Clients and servers that need to use the | ||
253 | legacy protocol must explicitly enable it in ssh_config / sshd_config | ||
254 | or on the command-line. | ||
255 | - Remove the libsectok/OpenSC-based smartcard code and add support for | ||
256 | PKCS#11 tokens. This support is enabled by default in the Debian | ||
257 | packaging, since it now doesn't involve additional library | ||
258 | dependencies (closes: #231472, LP: #16918). | ||
259 | - Add support for certificate authentication of users and hosts using a | ||
260 | new, minimal OpenSSH certificate format (closes: #482806). | ||
261 | - Added a 'netcat mode' to ssh(1): "ssh -W host:port ...". | ||
262 | - Add the ability to revoke keys in sshd(8) and ssh(1). (For the Debian | ||
263 | package, this overlaps with the key blacklisting facility added in | ||
264 | openssh 1:4.7p1-9, but with different file formats and slightly | ||
265 | different scopes; for the moment, I've roughly merged the two.) | ||
266 | - Various multiplexing improvements, including support for requesting | ||
267 | port-forwardings via the multiplex protocol (closes: #360151). | ||
268 | - Allow setting an explicit umask on the sftp-server(8) commandline to | ||
269 | override whatever default the user has (closes: #496843). | ||
270 | - Many sftp client improvements, including tab-completion, more options, | ||
271 | and recursive transfer support for get/put (LP: #33378). The old | ||
272 | mget/mput commands never worked properly and have been removed | ||
273 | (closes: #270399, #428082). | ||
274 | - Do not prompt for a passphrase if we fail to open a keyfile, and log | ||
275 | the reason why the open failed to debug (closes: #431538). | ||
276 | - Prevent sftp from crashing when given a "-" without a command. Also, | ||
277 | allow whitespace to follow a "-" (closes: #531561). | ||
278 | |||
279 | * Fix 'debian/rules quilt-setup' to avoid writing .orig files if some | ||
280 | patches apply with offsets. | ||
281 | * Include debian/ssh-askpass-gnome.png in the Debian tarball now that | ||
282 | we're using a source format that permits this, rather than messing | ||
283 | around with uudecode. | ||
284 | * Drop compatibility with the old gssapi mechanism used in ssh-krb5 << | ||
285 | 3.8.1p1-1. Simon Wilkinson refused this patch since the old gssapi | ||
286 | mechanism was removed due to a serious security hole, and since these | ||
287 | versions of ssh-krb5 are no longer security-supported by Debian I don't | ||
288 | think there's any point keeping client compatibility for them. | ||
289 | * Fix substitution of ETC_PAM_D_SSH, following the rename in 1:4.7p1-4. | ||
290 | * Hardcode the location of xauth to /usr/bin/xauth rather than | ||
291 | /usr/bin/X11/xauth (thanks, Aron Griffis; closes: #575725, LP: #8440). | ||
292 | xauth no longer depends on x11-common, so we're no longer guaranteed to | ||
293 | have the /usr/bin/X11 symlink available. I was taking advantage of the | ||
294 | /usr/bin/X11 symlink to smooth X's move to /usr/bin, but this is far | ||
295 | enough in the past now that it's probably safe to just use /usr/bin. | ||
296 | * Remove SSHD_OOM_ADJUST configuration. sshd now unconditionally makes | ||
297 | itself non-OOM-killable, and doesn't require configuration to avoid log | ||
298 | spam in virtualisation containers (closes: #555625). | ||
299 | * Drop Debian-specific removal of OpenSSL version check. Upstream ignores | ||
300 | the two patchlevel nybbles now, which is sufficient to address the | ||
301 | original reason this change was introduced, and it appears that any | ||
302 | change in the major/minor/fix nybbles would involve a new libssl package | ||
303 | name. (We'd still lose if the status nybble were ever changed, but that | ||
304 | would mean somebody had packaged a development/beta version rather than | ||
305 | a proper release, which doesn't appear to be normal practice.) | ||
306 | * Drop most of our "LogLevel SILENT" (-qq) patch. This was originally | ||
307 | introduced to match the behaviour of non-free SSH, in which -q does not | ||
308 | suppress fatal errors, but matching the behaviour of OpenSSH upstream is | ||
309 | much more important nowadays. We no longer document that -q does not | ||
310 | suppress fatal errors (closes: #280609). Migrate "LogLevel SILENT" to | ||
311 | "LogLevel QUIET" in sshd_config on upgrade. | ||
312 | * Policy version 3.8.4: | ||
313 | - Add a Homepage field. | ||
314 | |||
315 | -- Colin Watson <cjwatson@debian.org> Tue, 06 Apr 2010 22:38:31 +0100 | ||
316 | |||
317 | openssh (1:5.3p1-3) unstable; urgency=low | ||
318 | |||
319 | * Convert to source format 3.0 (quilt). | ||
320 | * Update README.source to match, and add a 'quilt-setup' target to | ||
321 | debian/rules for the benefit of those checking out the package from | ||
322 | revision control. | ||
323 | * All patches are now maintained separately and tagged according to DEP-3. | ||
324 | * Add GSSAPIStoreCredentialsOnRekey to 'sshd -T' configuration dump. | ||
325 | * Remove documentation of building for Debian 3.0 in README.Debian. | ||
326 | Support for this was removed in 1:4.7p1-2. | ||
327 | * Remove obsolete header from README.Debian dating from when people | ||
328 | expected non-free SSH. | ||
329 | * Update copyright years for GSSAPI patch. | ||
330 | |||
331 | -- Colin Watson <cjwatson@debian.org> Sun, 28 Feb 2010 01:35:53 +0000 | ||
332 | |||
333 | openssh (1:5.3p1-2) unstable; urgency=low | ||
334 | |||
335 | * Link with -Wl,--as-needed (closes: #560155). | ||
336 | * Install upstream sshd_config as an example (closes: #415008). | ||
337 | * Use dh_lintian. | ||
338 | * Honour DEB_BUILD_OPTIONS=nocheck. | ||
339 | |||
340 | -- Colin Watson <cjwatson@debian.org> Mon, 22 Feb 2010 12:43:24 +0000 | ||
341 | |||
342 | openssh (1:5.3p1-1) unstable; urgency=low | ||
343 | |||
344 | * New upstream release. | ||
345 | * Update to GSSAPI patch from | ||
346 | http://www.sxw.org.uk/computing/patches/openssh-5.3p1-gsskex-all-20100124.patch. | ||
347 | * Backport from upstream: | ||
348 | - Do not fall back to adding keys without constraints (ssh-add -c / -t | ||
349 | ...) when the agent refuses the constrained add request. This was a | ||
350 | useful migration measure back in 2002 when constraints were new, but | ||
351 | just adds risk now (LP: #209447). | ||
352 | * Drop change from 1:3.8p1-3 to avoid setresuid() and setresgid() system | ||
353 | calls. This only applied to Linux 2.2, which it's no longer feasible to | ||
354 | run anyway (see 1:5.2p1-2 changelog). | ||
355 | |||
356 | -- Colin Watson <cjwatson@debian.org> Tue, 26 Jan 2010 11:55:29 +0000 | ||
357 | |||
358 | openssh (1:5.2p1-2) unstable; urgency=low | ||
359 | |||
360 | [ Colin Watson ] | ||
361 | * Backport from upstream: | ||
362 | - After sshd receives a SIGHUP, ignore subsequent HUPs while sshd | ||
363 | re-execs itself. Prevents two HUPs in quick succession from resulting | ||
364 | in sshd dying (LP: #497781). | ||
365 | - Output a debug if we can't open an existing keyfile (LP: #505301). | ||
366 | * Use host compiler for ssh-askpass-gnome when cross-compiling. | ||
367 | * Don't run tests when cross-compiling. | ||
368 | * Drop change from 1:3.6.1p2-5 to disable cmsg_type check for file | ||
369 | descriptor passing when running on Linux 2.0. The previous stable | ||
370 | release of Debian dropped support for Linux 2.4, let alone 2.0, so this | ||
371 | very likely has no remaining users depending on it. | ||
372 | |||
373 | [ Kees Cook ] | ||
374 | * Implement DebianBanner server configuration flag that can be set to "no" | ||
375 | to allow sshd to run without the Debian-specific extra version in the | ||
376 | initial protocol handshake (closes: #562048). | ||
377 | |||
378 | -- Colin Watson <cjwatson@debian.org> Sat, 16 Jan 2010 01:28:58 +0000 | ||
379 | |||
380 | openssh (1:5.2p1-1) unstable; urgency=low | ||
381 | |||
382 | * New upstream release (closes: #536182). Yes, I know 5.3p1 has been out | ||
383 | for a while, but there's no GSSAPI patch available for it yet. | ||
384 | - Change the default cipher order to prefer the AES CTR modes and the | ||
385 | revised "arcfour256" mode to CBC mode ciphers that are susceptible to | ||
386 | CPNI-957037 "Plaintext Recovery Attack Against SSH". | ||
387 | - Add countermeasures to mitigate CPNI-957037-style attacks against the | ||
388 | SSH protocol's use of CBC-mode ciphers. Upon detection of an invalid | ||
389 | packet length or Message Authentication Code, ssh/sshd will continue | ||
390 | reading up to the maximum supported packet length rather than | ||
391 | immediately terminating the connection. This eliminates most of the | ||
392 | known differences in behaviour that leaked information about the | ||
393 | plaintext of injected data which formed the basis of this attack | ||
394 | (closes: #506115, LP: #379329). | ||
395 | - ForceCommand directive now accepts commandline arguments for the | ||
396 | internal-sftp server (closes: #524423, LP: #362511). | ||
397 | - Add AllowAgentForwarding to available Match keywords list (closes: | ||
398 | #540623). | ||
399 | - Make ssh(1) send the correct channel number for | ||
400 | SSH2_MSG_CHANNEL_SUCCESS and SSH2_MSG_CHANNEL_FAILURE messages to | ||
401 | avoid triggering 'Non-public channel' error messages on sshd(8) in | ||
402 | openssh-5.1. | ||
403 | - Avoid printing 'Non-public channel' warnings in sshd(8), since the | ||
404 | ssh(1) has sent incorrect channel numbers since ~2004 (this reverts a | ||
405 | behaviour introduced in openssh-5.1; closes: #496017). | ||
406 | - Disable nonfunctional ssh(1) ~C escape handler in multiplex slave | ||
407 | connections (closes: #507541). | ||
408 | - Fix "whitepsace" typo in ssh_config(5) (closes: #514313, LP: #303835). | ||
409 | * Update to GSSAPI patch from | ||
410 | http://www.sxw.org.uk/computing/patches/openssh-5.2p1-gsskex-all-20090726.patch, | ||
411 | including cascading credentials support (LP: #416958). | ||
412 | * Use x11.pc when compiling/linking gnome-ssh-askpass2 (closes: #555951). | ||
413 | * Moved to bzr.debian.org; add Vcs-Bzr and Vcs-Browser control fields. | ||
414 | * Add debian/README.source with instructions on bzr handling. | ||
415 | * Make ChrootDirectory work with SELinux (thanks, Russell Coker; closes: | ||
416 | #556644). | ||
417 | * Initialise sc to NULL in ssh_selinux_getctxbyname (thanks, Václav OvsÃk; | ||
418 | closes: #498684). | ||
419 | * Don't duplicate backslashes when displaying server banner (thanks, | ||
420 | Michał Górny; closes: #505378, LP: #425346). | ||
421 | * Use hardening-includes for hardening logic (thanks, Kees Cook; closes: | ||
422 | #561887). | ||
423 | * Update OpenSSH FAQ to revision 1.110. | ||
424 | * Remove ssh/new_config, only needed for direct upgrades from potato which | ||
425 | are no longer particularly feasible anyway (closes: #420682). | ||
426 | * Cope with insserv reordering of init script links. | ||
427 | * Remove init script stop link in rc1, as killprocs handles it already. | ||
428 | * Adjust short descriptions to avoid relying on previous experience with | ||
429 | rsh, based on suggestions from Reuben Thomas (closes: #512198). | ||
430 | * Remove manual page references to login.conf, which aren't applicable on | ||
431 | non-BSD systems (closes: #154434). | ||
432 | * Remove/adjust manual page references to BSD-specific /etc/rc (closes: | ||
433 | #513417). | ||
434 | * Refer to sshd_config(5) rather than sshd(8) in postinst-written | ||
435 | /etc/ssh/sshd_config, and add UsePAM commentary from upstream-shipped | ||
436 | configuration file (closes: #415008, although unfortunately this will | ||
437 | only be conveniently visible on new installations). | ||
438 | * Include URL to OpenBSD's ssl(8) in ssh(1), since I don't see a better | ||
439 | source for the same information among Debian's manual pages (closes: | ||
440 | #530692, LP: #456660). | ||
441 | |||
442 | -- Colin Watson <cjwatson@debian.org> Mon, 04 Jan 2010 13:23:35 +0000 | ||
443 | |||
444 | openssh (1:5.1p1-8) unstable; urgency=low | ||
445 | |||
446 | * Build with just -fPIC on mips/mipsel, not -fPIE as well (thanks, LIU Qi; | ||
447 | closes: #538313). | ||
448 | * Build-depend on libselinux1-dev on sh4 too (thanks, Nobuhiro Iwamatsu; | ||
449 | closes: #547103). | ||
450 | * Fix grammar in if-up script (closes: #549128). | ||
451 | * Pass $SSHD_OPTS when checking configuration too (thanks, "sobtwmxt"; | ||
452 | closes: #548662). | ||
453 | |||
454 | -- Colin Watson <cjwatson@debian.org> Mon, 05 Oct 2009 13:30:49 +0100 | ||
455 | |||
456 | openssh (1:5.1p1-7) unstable; urgency=low | ||
457 | |||
458 | * Update config.guess and config.sub from autotools-dev 20090611.1 | ||
459 | (closes: #538301). | ||
460 | * Set umask to 022 in the init script as well as postinsts (closes: | ||
461 | #539030). | ||
462 | * Add ${misc:Depends} to keep Lintian happy. | ||
463 | * Use 'which' rather than 'type' in maintainer scripts. | ||
464 | * Upgrade to debhelper v7. | ||
465 | |||
466 | -- Colin Watson <cjwatson@debian.org> Fri, 31 Jul 2009 16:28:10 +0100 | ||
467 | |||
468 | openssh (1:5.1p1-6) unstable; urgency=low | ||
469 | |||
470 | * Open /proc/self/oom_adj with O_RDONLY or O_WRONLY as necessary, rather | ||
471 | than O_RDWR. | ||
472 | * Disable OOM adjustment for vserver/OpenVZ (thanks, Karl Chen; closes: | ||
473 | #511771). | ||
474 | * Add ufw integration (thanks, Didier Roche; see | ||
475 | https://wiki.ubuntu.com/UbuntuFirewall#Integrating%20UFW%20with%20Packages; | ||
476 | LP: #261884). | ||
477 | * Add a comment above PermitRootLogin in sshd_config pointing to | ||
478 | README.Debian. | ||
479 | * Check if delgroup is present in openssh-client.postrm (closes: #530501). | ||
480 | * Build with -fPIC on mips/mipsel (thanks, Luk Claes; closes: #531942). | ||
481 | * Remove /var/run/sshd from openssh-server package; it will be created at | ||
482 | run-time before starting the server. | ||
483 | * Use invoke-rc.d in openssh-server's if-up script. | ||
484 | |||
485 | -- Colin Watson <cjwatson@debian.org> Fri, 05 Jun 2009 11:56:03 +0100 | ||
486 | |||
487 | openssh (1:5.1p1-5) unstable; urgency=low | ||
488 | |||
489 | * Backport from upstream CVS (Markus Friedl): | ||
490 | - packet_disconnect() on padding error, too. Should reduce the success | ||
491 | probability for the CPNI-957037 Plaintext Recovery Attack to 2^-18. | ||
492 | * Check that /var/run/sshd.pid exists and that the process ID listed there | ||
493 | corresponds to sshd before running '/etc/init.d/ssh reload' from if-up | ||
494 | script; SIGHUP is racy if called at boot before sshd has a chance to | ||
495 | install its signal handler, but fortunately the pid file is written | ||
496 | after that which lets us avoid the race (closes: #502444). | ||
497 | * While the above is a valuable sanity-check, it turns out that it doesn't | ||
498 | really fix the bug (thanks to Kevin Price for testing), so for the | ||
499 | meantime we'll just use '/etc/init.d/ssh restart', even though it is | ||
500 | unfortunately heavyweight. | ||
501 | |||
502 | -- Colin Watson <cjwatson@debian.org> Wed, 14 Jan 2009 00:34:08 +0000 | ||
503 | |||
504 | openssh (1:5.1p1-4) unstable; urgency=low | ||
505 | |||
506 | * ssh-copy-id: Strip trailing colons from hostname (closes: #226172, | ||
507 | LP: #249706; thanks to Karl Goetz for nudging this along; forwarded | ||
508 | upstream as https://bugzilla.mindrot.org/show_bug.cgi?id=1530). | ||
509 | * Backport from upstream CVS (Markus Friedl): | ||
510 | - Only send eow and no-more-sessions requests to openssh 5 and newer; | ||
511 | fixes interop problems with broken ssh v2 implementations (closes: | ||
512 | #495917). | ||
513 | * Fix double-free when failing to parse a forwarding specification given | ||
514 | using ~C (closes: #505330; forwarded upstream as | ||
515 | https://bugzilla.mindrot.org/show_bug.cgi?id=1539). | ||
516 | |||
517 | -- Colin Watson <cjwatson@debian.org> Sun, 23 Nov 2008 14:46:10 +0000 | ||
518 | |||
519 | openssh (1:5.1p1-3) unstable; urgency=low | ||
520 | |||
521 | * Remove unnecessary ssh-vulnkey output in non-verbose mode when no | ||
522 | compromised or unknown keys were found (closes: #496495). | ||
523 | * Configure with --disable-strip; dh_strip will deal with stripping | ||
524 | binaries and will honour DEB_BUILD_OPTIONS (thanks, Bernhard R. Link; | ||
525 | closes: #498681). | ||
526 | * Fix handling of zero-length server banners (thanks, Tomas Mraz; closes: | ||
527 | #497026). | ||
528 | |||
529 | -- Colin Watson <cjwatson@debian.org> Tue, 30 Sep 2008 23:09:58 +0100 | ||
530 | |||
531 | openssh (1:5.1p1-2) unstable; urgency=low | ||
532 | |||
533 | * Look for $SHELL on the path when executing ProxyCommands or | ||
534 | LocalCommands (closes: #492728). | ||
535 | |||
536 | -- Colin Watson <cjwatson@debian.org> Tue, 29 Jul 2008 15:31:25 +0100 | ||
537 | |||
538 | openssh (1:5.1p1-1) unstable; urgency=low | ||
539 | |||
540 | * New upstream release (closes: #474301). Important changes not previously | ||
541 | backported to 4.7p1: | ||
542 | - 4.9/4.9p1 (http://www.openssh.com/txt/release-4.9): | ||
543 | + Added chroot(2) support for sshd(8), controlled by a new option | ||
544 | "ChrootDirectory" (closes: #139047, LP: #24777). | ||
545 | + Linked sftp-server(8) into sshd(8). The internal sftp server is used | ||
546 | when the command "internal-sftp" is specified in a Subsystem or | ||
547 | ForceCommand declaration. When used with ChrootDirectory, the | ||
548 | internal sftp server requires no special configuration of files | ||
549 | inside the chroot environment. | ||
550 | + Added a protocol extension method "posix-rename@openssh.com" for | ||
551 | sftp-server(8) to perform POSIX atomic rename() operations; sftp(1) | ||
552 | prefers this if available (closes: #308561). | ||
553 | + Removed the fixed limit of 100 file handles in sftp-server(8). | ||
554 | + ssh(8) will now skip generation of SSH protocol 1 ephemeral server | ||
555 | keys when in inetd mode and protocol 2 connections are negotiated. | ||
556 | This speeds up protocol 2 connections to inetd-mode servers that | ||
557 | also allow Protocol 1. | ||
558 | + Accept the PermitRootLogin directive in a sshd_config(5) Match | ||
559 | block. Allows for, e.g. permitting root only from the local network. | ||
560 | + Reworked sftp(1) argument splitting and escaping to be more | ||
561 | internally consistent (i.e. between sftp commands) and more | ||
562 | consistent with sh(1). Please note that this will change the | ||
563 | interpretation of some quoted strings, especially those with | ||
564 | embedded backslash escape sequences. | ||
565 | + Support "Banner=none" in sshd_config(5) to disable sending of a | ||
566 | pre-login banner (e.g. in a Match block). | ||
567 | + ssh(1) ProxyCommands are now executed with $SHELL rather than | ||
568 | /bin/sh. | ||
569 | + ssh(1)'s ConnectTimeout option is now applied to both the TCP | ||
570 | connection and the SSH banner exchange (previously it just covered | ||
571 | the TCP connection). This allows callers of ssh(1) to better detect | ||
572 | and deal with stuck servers that accept a TCP connection but don't | ||
573 | progress the protocol, and also makes ConnectTimeout useful for | ||
574 | connections via a ProxyCommand. | ||
575 | + scp(1) incorrectly reported "stalled" on slow copies (closes: | ||
576 | #140828). | ||
577 | + scp(1) date underflow for timestamps before epoch. | ||
578 | + ssh(1) used the obsolete SIG DNS RRtype for host keys in DNS, | ||
579 | instead of the current standard RRSIG. | ||
580 | + Correctly drain ACKs when a sftp(1) upload write fails midway, | ||
581 | avoids a fatal() exit from what should be a recoverable condition. | ||
582 | + Fixed ssh-keygen(1) selective host key hashing (i.e. "ssh-keygen -HF | ||
583 | hostname") to not include any IP address in the data to be hashed. | ||
584 | + Make ssh(1) skip listening on the IPv6 wildcard address when a | ||
585 | binding address of 0.0.0.0 is used against an old SSH server that | ||
586 | does not support the RFC4254 syntax for wildcard bind addresses. | ||
587 | + Enable IPV6_V6ONLY socket option on sshd(8) listen socket, as is | ||
588 | already done for X11/TCP forwarding sockets (closes: #439661). | ||
589 | + Fix FD leak that could hang a ssh(1) connection multiplexing master. | ||
590 | + Make ssh(1) -q option documentation consistent with reality. | ||
591 | + Fixed sshd(8) PAM support not calling pam_session_close(), or | ||
592 | failing to call it with root privileges (closes: #372680). | ||
593 | + Fix activation of OpenSSL engine support when requested in configure | ||
594 | (LP: #119295). | ||
595 | + Cache SELinux status earlier so we know if it's enabled after a | ||
596 | chroot (LP: #237557). | ||
597 | - 5.1/5.1p1 (http://www.openssh.com/txt/release-5.1): | ||
598 | + Introduce experimental SSH Fingerprint ASCII Visualisation to ssh(1) | ||
599 | and ssh-keygen(1). Visual fingerprint display is controlled by a new | ||
600 | ssh_config(5) option "VisualHostKey". The intent is to render SSH | ||
601 | host keys in a visual form that is amenable to easy recall and | ||
602 | rejection of changed host keys. | ||
603 | + sshd_config(5) now supports CIDR address/masklen matching in "Match | ||
604 | address" blocks, with a fallback to classic wildcard matching. | ||
605 | + sshd(8) now supports CIDR matching in ~/.ssh/authorized_keys | ||
606 | from="..." restrictions, also with a fallback to classic wildcard | ||
607 | matching. | ||
608 | + Added an extended test mode (-T) to sshd(8) to request that it write | ||
609 | its effective configuration to stdout and exit. Extended test mode | ||
610 | also supports the specification of connection parameters (username, | ||
611 | source address and hostname) to test the application of | ||
612 | sshd_config(5) Match rules. | ||
613 | + ssh(1) now prints the number of bytes transferred and the overall | ||
614 | connection throughput for SSH protocol 2 sessions when in verbose | ||
615 | mode (previously these statistics were displayed for protocol 1 | ||
616 | connections only). | ||
617 | + sftp-server(8) now supports extension methods statvfs@openssh.com | ||
618 | and fstatvfs@openssh.com that implement statvfs(2)-like operations. | ||
619 | + sftp(1) now has a "df" command to the sftp client that uses the | ||
620 | statvfs@openssh.com to produce a df(1)-like display of filesystem | ||
621 | space and inode utilisation (requires statvfs@openssh.com support on | ||
622 | the server). | ||
623 | + Added a MaxSessions option to sshd_config(5) to allow control of the | ||
624 | number of multiplexed sessions supported over a single TCP | ||
625 | connection. This allows increasing the number of allowed sessions | ||
626 | above the previous default of 10, disabling connection multiplexing | ||
627 | (MaxSessions=1) or disallowing login/shell/subsystem sessions | ||
628 | entirely (MaxSessions=0). | ||
629 | + Added a no-more-sessions@openssh.com global request extension that | ||
630 | is sent from ssh(1) to sshd(8) when the client knows that it will | ||
631 | never request another session (i.e. when session multiplexing is | ||
632 | disabled). This allows a server to disallow further session requests | ||
633 | and terminate the session in cases where the client has been | ||
634 | hijacked. | ||
635 | + ssh-keygen(1) now supports the use of the -l option in combination | ||
636 | with -F to search for a host in ~/.ssh/known_hosts and display its | ||
637 | fingerprint. | ||
638 | + ssh-keyscan(1) now defaults to "rsa" (protocol 2) keys, instead of | ||
639 | "rsa1" (LP: #129794). | ||
640 | + Added an AllowAgentForwarding option to sshd_config(8) to control | ||
641 | whether authentication agent forwarding is permitted. Note that this | ||
642 | is a loose control, as a client may install their own unofficial | ||
643 | forwarder. | ||
644 | + ssh(1) and sshd(8): avoid unnecessary malloc/copy/free when | ||
645 | receiving network data, resulting in a ~10% speedup. | ||
646 | + ssh(1) and sshd(8) will now try additional addresses when connecting | ||
647 | to a port forward destination whose DNS name resolves to more than | ||
648 | one address. The previous behaviour was to try the only first | ||
649 | address and give up if that failed. | ||
650 | + ssh(1) and sshd(8) now support signalling that channels are | ||
651 | half-closed for writing, through a channel protocol extension | ||
652 | notification "eow@openssh.com". This allows propagation of closed | ||
653 | file descriptors, so that commands such as "ssh -2 localhost od | ||
654 | /bin/ls | true" do not send unnecessary data over the wire. | ||
655 | + sshd(8): increased the default size of ssh protocol 1 ephemeral keys | ||
656 | from 768 to 1024 bits. | ||
657 | + When ssh(1) has been requested to fork after authentication ("ssh | ||
658 | -f") with ExitOnForwardFailure enabled, delay the fork until after | ||
659 | replies for any -R forwards have been seen. Allows for robust | ||
660 | detection of -R forward failure when using -f. | ||
661 | + "Match group" blocks in sshd_config(5) now support negation of | ||
662 | groups. E.g. "Match group staff,!guests". | ||
663 | + sftp(1) and sftp-server(8) now allow chmod-like operations to set | ||
664 | set[ug]id/sticky bits. | ||
665 | + The MaxAuthTries option is now permitted in sshd_config(5) match | ||
666 | blocks. | ||
667 | + Multiplexed ssh(1) sessions now support a subset of the ~ escapes | ||
668 | that are available to a primary connection. | ||
669 | + ssh(1) connection multiplexing will now fall back to creating a new | ||
670 | connection in most error cases (closes: #352830). | ||
671 | + Make ssh(1) deal more gracefully with channel requests that fail. | ||
672 | Previously it would optimistically assume that requests would always | ||
673 | succeed, which could cause hangs if they did not (e.g. when the | ||
674 | server runs out of file descriptors). | ||
675 | + ssh(1) now reports multiplexing errors via the multiplex slave's | ||
676 | stderr where possible (subject to LogLevel in the mux master). | ||
677 | + Fixed an UMAC alignment problem that manifested on Itanium | ||
678 | platforms. | ||
679 | * Remove our local version of moduli(5) now that there's one upstream. | ||
680 | * Say "GTK+" rather than "GTK" in ssh-askpass-gnome's description. | ||
681 | * Add lintian overrides for empty /usr/share/doc/openssh-client | ||
682 | directories in openssh-server and ssh (necessary due to being symlink | ||
683 | targets). | ||
684 | * Merge from Ubuntu: | ||
685 | - Add 'status' action to openssh-server init script, requiring lsb-base | ||
686 | (>= 3.2-13) (thanks, Dustin Kirkland). | ||
687 | * debconf template translations: | ||
688 | - Update Korean (thanks, Sunjae Park; closes: #484821). | ||
689 | |||
690 | -- Colin Watson <cjwatson@debian.org> Fri, 25 Jul 2008 10:45:08 +0100 | ||
691 | |||
692 | openssh (1:4.7p1-13) unstable; urgency=low | ||
693 | |||
694 | * Add some helpful advice to the end of ssh-vulnkey's output if there are | ||
695 | unknown or compromised keys (thanks, Dan Jacobson; closes: #483756). | ||
696 | * Check compromised key blacklist in ssh or ssh-add, as well as in the | ||
697 | server (LP: #232391). To override the blacklist check in ssh | ||
698 | temporarily, use 'ssh -o UseBlacklistedKeys=yes'; there is no override | ||
699 | for the blacklist check in ssh-add. | ||
700 | * Add cross-references to ssh-vulnkey(1) to ssh(1), ssh-add(1), | ||
701 | ssh-keygen(1), and sshd(8) (closes: #484451). | ||
702 | * Change openssh-client-udeb's Installer-Menu-Item from 99900 to 99999 | ||
703 | (thanks, Frans Pop). | ||
704 | * Drop openssh-client-udeb isinstallable hack, as main-menu (>= 1.26) now | ||
705 | takes care of that (thanks, Frans Pop; closes: #484404). | ||
706 | * Update DEB_BUILD_OPTIONS parsing code from policy 3.8.0. | ||
707 | * Add documentation on removing openssh-blacklist locally (see #484269). | ||
708 | * Clarify documentation of SSHD_OOM_ADJUST, and make setting it to the | ||
709 | empty string actually skip adjustment as intended (closes: #487325). | ||
710 | * Remove empty /usr/share/applications directory in ssh-askpass-gnome. | ||
711 | * debconf template translations: | ||
712 | - Update Romanian (thanks, Cătălin Feștilă; closes: #485415). | ||
713 | |||
714 | -- Colin Watson <cjwatson@debian.org> Mon, 21 Jul 2008 12:18:28 +0100 | ||
715 | |||
716 | openssh (1:4.7p1-12) unstable; urgency=low | ||
717 | |||
718 | * Fill in CVE identifier for ssh-vulnkey bug fixed in 1:4.7p1-10. | ||
719 | * Refactor rejection of blacklisted user keys into a single | ||
720 | reject_blacklisted_key function in auth.c (thanks, Dmitry V. Levin). | ||
721 | * Fix memory leak of blacklisted host keys (thanks, Dmitry V. Levin). | ||
722 | * debconf template translations: | ||
723 | - Update Dutch (thanks, Bart Cornelis; closes: #483004). | ||
724 | - Update Brazilian Portuguese (thanks, Eder L. Marques; closes: | ||
725 | #483142). | ||
726 | - Update Slovak (thanks, Ivan Masár; closes: #483517). | ||
727 | |||
728 | -- Colin Watson <cjwatson@debian.org> Thu, 29 May 2008 21:41:29 +0100 | ||
729 | |||
730 | openssh (1:4.7p1-11) unstable; urgency=low | ||
731 | |||
732 | * Make init script depend on $syslog, and fix some other dependency | ||
733 | glitches (thanks, Petter Reinholdtsen; closes: #481018). | ||
734 | * Remove 0 and 6 from Default-Stop in init script (thanks, Kel Modderman; | ||
735 | closes: #481151). | ||
736 | * Restore OOM killer adjustment for child processes (thanks, Vaclav Ovsik; | ||
737 | closes: #480020). | ||
738 | * Allow building with heimdal-dev (LP: #125805). | ||
739 | |||
740 | * Check RSA1 keys without the need for a separate blacklist. Thanks to | ||
741 | Simon Tatham for the idea. | ||
742 | * Generate two keys with the PID forced to the same value and test that | ||
743 | they differ, to defend against recurrences of the recent Debian OpenSSL | ||
744 | vulnerability. | ||
745 | * Recommend openssh-blacklist from openssh-client (closes: #481187). | ||
746 | * Recommend openssh-blacklist-extra from openssh-client and | ||
747 | openssh-server. | ||
748 | * Make ssh-vulnkey report the file name and line number for each key | ||
749 | (thanks, Heiko Schlittermann and Christopher Perry; closes: #481398). | ||
750 | * Check for blacklists in /usr/share/ssh/ as well as /etc/ssh/ (see | ||
751 | #481283). | ||
752 | * Log IP addresses of hosts attempting to use blacklisted keys (closes: | ||
753 | #481721). | ||
754 | * Incorporate various ssh-vulnkey suggestions from Hugh Daniel: | ||
755 | - Add -v (verbose) option, and don't print output for keys that have a | ||
756 | blacklist file but that are not listed unless in verbose mode. | ||
757 | - Move exit status documentation to a separate section. | ||
758 | - Document key status descriptions. | ||
759 | - Add key type to output. | ||
760 | - Fix error output if ssh-vulnkey fails to read key files, with the | ||
761 | exception of host keys unless -a was given. | ||
762 | - In verbose mode, output the name of each file examined. | ||
763 | * Handle leading IP addresses in ssh-vulnkey input (LP: #230497). | ||
764 | * Fix various ssh-vulnkey problems pointed out by Solar Designer: | ||
765 | - Fix some buffer handling inconsistencies. | ||
766 | - Use xasprintf to build user key file names, avoiding truncation | ||
767 | problems. | ||
768 | - Drop to the user's UID when reading user keys with -a. | ||
769 | - Use EUID rather than UID when run with no file names and without -a. | ||
770 | - Reword "Unknown (no blacklist information)" to "Unknown (blacklist | ||
771 | file not installed)". | ||
772 | |||
773 | * Fix typo in ssh/vulnerable_host_keys message (thanks, Esko Arajärvi). | ||
774 | * debconf template translations: | ||
775 | - Update Finnish (thanks, Esko Arajärvi; closes: #481530). | ||
776 | - Update French (thanks, Christian Perrier; closes: #481576). | ||
777 | - Update Norwegian Bokmål (thanks, Bjørn Steensrud; closes: #481591). | ||
778 | - Update Galician (thanks, Jacobo Tarrio; closes: #481596). | ||
779 | - Update Japanese (thanks, Kenshi Muto; closes: #481621). | ||
780 | - Update Czech (thanks, Miroslav Kure; closes: #481624). | ||
781 | - Update German (thanks, Helge Kreutzmann; closes: #481676). | ||
782 | - Update Portuguese (thanks, Ricardo Silva; closes: #481781). | ||
783 | - Update Basque (thanks, Piarres Beobide; closes: #481836). | ||
784 | - Update Bulgarian (thanks, Damyan Ivanov; closes: #481870). | ||
785 | - Update Vietnamese (thanks, Clytie Siddall; closes: #481876). | ||
786 | - Update Spanish (thanks, Javier Fernandez-Sanguino Peña; closes: | ||
787 | #482341). | ||
788 | - Update Turkish (thanks, Mert Dirik; closes: #482548). | ||
789 | - Update Russian (thanks, Yuri Kozlov; closes: #482887). | ||
790 | - Update Swedish (thanks, Martin Bagge; closes: #482464). | ||
791 | - Update Italian (thanks, Luca Monducci; closes: #482808). | ||
792 | |||
793 | -- Colin Watson <cjwatson@debian.org> Mon, 26 May 2008 12:21:39 +0100 | ||
794 | |||
795 | openssh (1:4.7p1-10) unstable; urgency=low | ||
796 | |||
797 | * Add a FILES section to ssh-vulnkey(1) (thanks, Hugh Daniel). | ||
798 | * CVE-2008-2285: ssh-vulnkey handles options in authorized_keys | ||
799 | (LP: #230029), and treats # as introducing a comment even if it is | ||
800 | preceded by whitespace. | ||
801 | |||
802 | -- Colin Watson <cjwatson@debian.org> Wed, 14 May 2008 12:35:05 +0100 | ||
803 | |||
804 | openssh (1:4.7p1-9) unstable; urgency=critical | ||
805 | |||
806 | * Fill in CVE identifier for security vulnerability fixed in 1:4.7p1-8. | ||
807 | * Mitigate OpenSSL security vulnerability (CVE-2008-0166): | ||
808 | - Add key blacklisting support. Keys listed in | ||
809 | /etc/ssh/blacklist.TYPE-LENGTH will be rejected for authentication by | ||
810 | sshd, unless "PermitBlacklistedKeys yes" is set in | ||
811 | /etc/ssh/sshd_config. | ||
812 | - Add a new program, ssh-vulnkey, which can be used to check keys | ||
813 | against these blacklists. | ||
814 | - Depend on openssh-blacklist. | ||
815 | - Force dependencies on libssl0.9.8 / libcrypto0.9.8-udeb to at least | ||
816 | 0.9.8g-9. | ||
817 | - Automatically regenerate known-compromised host keys, with a | ||
818 | critical-priority debconf note. (I regret that there was no time to | ||
819 | gather translations.) | ||
820 | |||
821 | -- Colin Watson <cjwatson@debian.org> Tue, 13 May 2008 12:33:38 +0100 | ||
822 | |||
823 | openssh (1:4.7p1-8) unstable; urgency=high | ||
824 | |||
825 | * Fill in CVE identifier for security vulnerability fixed in 1:4.7p1-5. | ||
826 | * Rename KeepAlive to TCPKeepAlive in sshd_config, cleaning up from old | ||
827 | configurations (LP: #211400). | ||
828 | * Tweak scp's reporting of filenames in verbose mode to be a bit less | ||
829 | confusing with spaces (thanks, Nicolas Valcárcel; LP: #89945). | ||
830 | * Backport from 4.9p1: | ||
831 | - CVE-2008-1657: Ignore ~/.ssh/rc if a sshd_config ForceCommand is | ||
832 | specified. | ||
833 | - Add no-user-rc authorized_keys option to disable execution of | ||
834 | ~/.ssh/rc. | ||
835 | * Backport from Simon Wilkinson's GSSAPI key exchange patch for 5.0p1: | ||
836 | - Add code to actually implement GSSAPIStrictAcceptorCheck, which had | ||
837 | somehow been omitted from a previous version of this patch (closes: | ||
838 | #474246). | ||
839 | |||
840 | -- Colin Watson <cjwatson@debian.org> Sun, 06 Apr 2008 12:34:19 +0100 | ||
841 | |||
842 | openssh (1:4.7p1-7) unstable; urgency=low | ||
843 | |||
844 | * Ignore errors writing to oom_adj (closes: #473573). | ||
845 | |||
846 | -- Colin Watson <cjwatson@debian.org> Mon, 31 Mar 2008 16:24:44 +0100 | ||
847 | |||
848 | openssh (1:4.7p1-6) unstable; urgency=low | ||
849 | |||
850 | * Disable the Linux kernel's OOM-killer for the sshd parent; tweak | ||
851 | SSHD_OOM_ADJUST in /etc/default/ssh to change this (closes: #341767). | ||
852 | |||
853 | -- Colin Watson <cjwatson@debian.org> Sun, 30 Mar 2008 21:14:12 +0100 | ||
854 | |||
855 | openssh (1:4.7p1-5) unstable; urgency=low | ||
856 | |||
857 | * Recommends: xauth rather than Suggests: xbase-clients. | ||
858 | * Document in ssh(1) that '-S none' disables connection sharing | ||
859 | (closes: #471437). | ||
860 | * Patch from Red Hat / Fedora: | ||
861 | - CVE-2008-1483: Don't use X11 forwarding port which can't be bound on | ||
862 | all address families, preventing hijacking of X11 forwarding by | ||
863 | unprivileged users when both IPv4 and IPv6 are configured (closes: | ||
864 | #463011). | ||
865 | * Use printf rather than echo -en (a bashism) in openssh-server.config and | ||
866 | openssh-server.preinst. | ||
867 | * debconf template translations: | ||
868 | - Update Finnish (thanks, Esko Arajärvi; closes: #468563). | ||
869 | |||
870 | -- Colin Watson <cjwatson@debian.org> Sat, 22 Mar 2008 12:37:00 +0000 | ||
871 | |||
872 | openssh (1:4.7p1-4) unstable; urgency=low | ||
873 | |||
874 | [ Caleb Case ] | ||
875 | * Fix configure detection of getseuserbyname and | ||
876 | get_default_context_with_level (closes: #465614, LP: #188136). | ||
877 | |||
878 | [ Colin Watson ] | ||
879 | * Include the autogenerated debian/copyright in the source package. | ||
880 | * Move /etc/pam.d/ssh to /etc/pam.d/sshd, allowing us to stop defining | ||
881 | SSHD_PAM_SERVICE (closes: #255870). | ||
882 | |||
883 | -- Colin Watson <cjwatson@debian.org> Wed, 13 Feb 2008 18:18:52 +0000 | ||
884 | |||
885 | openssh (1:4.7p1-3) unstable; urgency=low | ||
886 | |||
887 | * Improve grammar of ssh-askpass-gnome description. | ||
888 | * Backport from upstream: | ||
889 | - Use the correct packet maximum sizes for remote port and agent | ||
890 | forwarding. Prevents the server from killing the connection if too | ||
891 | much data is queued and an excessively large packet gets sent | ||
892 | (https://bugzilla.mindrot.org/show_bug.cgi?id=1360). | ||
893 | * Allow passing temporary daemon parameters on the init script's command | ||
894 | line, e.g. '/etc/init.d/ssh start "-o PermitRootLogin=yes"' (thanks, | ||
895 | Marc Haber; closes: #458547). | ||
896 | |||
897 | -- Colin Watson <cjwatson@debian.org> Fri, 01 Feb 2008 21:59:59 +0000 | ||
898 | |||
899 | openssh (1:4.7p1-2) unstable; urgency=low | ||
900 | |||
901 | * Adjust many relative links in faq.html to point to | ||
902 | http://www.openssh.org/ (thanks, Dan Jacobson; mentioned in #459807). | ||
903 | * Pass --with-mantype=doc to configure rather than build-depending on | ||
904 | groff (closes: #460121). | ||
905 | * Add armel to architecture list for libselinux1-dev build-dependency | ||
906 | (closes: #460136). | ||
907 | * Drop source-compatibility with Debian 3.0: | ||
908 | - Remove support for building with GNOME 1. This allows simplification | ||
909 | of our GNOME build-dependencies (see #460136). | ||
910 | - Remove hacks to support the old PAM configuration scheme. | ||
911 | - Remove compatibility for building without po-debconf. | ||
912 | * Build-depend on libgtk2.0-dev rather than libgnomeui-dev. As far as I | ||
913 | can see, the GTK2 version of ssh-askpass-gnome has never required | ||
914 | libgnomeui-dev. | ||
915 | |||
916 | -- Colin Watson <cjwatson@debian.org> Fri, 11 Jan 2008 00:14:10 +0000 | ||
917 | |||
918 | openssh (1:4.7p1-1) unstable; urgency=low | ||
919 | |||
920 | * New upstream release (closes: #453367). | ||
921 | - CVE-2007-4752: Prevent ssh(1) from using a trusted X11 cookie if | ||
922 | creation of an untrusted cookie fails; found and fixed by Jan Pechanec | ||
923 | (closes: #444738). | ||
924 | - sshd(8) in new installations defaults to SSH Protocol 2 only. Existing | ||
925 | installations are unchanged. | ||
926 | - The SSH channel window size has been increased, and both ssh(1) | ||
927 | sshd(8) now send window updates more aggressively. These improves | ||
928 | performance on high-BDP (Bandwidth Delay Product) networks. | ||
929 | - ssh(1) and sshd(8) now preserve MAC contexts between packets, which | ||
930 | saves 2 hash calls per packet and results in 12-16% speedup for | ||
931 | arcfour256/hmac-md5. | ||
932 | - A new MAC algorithm has been added, UMAC-64 (RFC4418) as | ||
933 | "umac-64@openssh.com". UMAC-64 has been measured to be approximately | ||
934 | 20% faster than HMAC-MD5. | ||
935 | - Failure to establish a ssh(1) TunnelForward is now treated as a fatal | ||
936 | error when the ExitOnForwardFailure option is set. | ||
937 | - ssh(1) returns a sensible exit status if the control master goes away | ||
938 | without passing the full exit status. | ||
939 | - When using a ProxyCommand in ssh(1), set the outgoing hostname with | ||
940 | gethostname(2), allowing hostbased authentication to work. | ||
941 | - Make scp(1) skip FIFOs rather than hanging (closes: #246774). | ||
942 | - Encode non-printing characters in scp(1) filenames. These could cause | ||
943 | copies to be aborted with a "protocol error". | ||
944 | - Handle SIGINT in sshd(8) privilege separation child process to ensure | ||
945 | that wtmp and lastlog records are correctly updated. | ||
946 | - Report GSSAPI mechanism in errors, for libraries that support multiple | ||
947 | mechanisms. | ||
948 | - Improve documentation for ssh-add(1)'s -d option. | ||
949 | - Rearrange and tidy GSSAPI code, removing server-only code being linked | ||
950 | into the client. | ||
951 | - Delay execution of ssh(1)'s LocalCommand until after all forwardings | ||
952 | have been established. | ||
953 | - In scp(1), do not truncate non-regular files. | ||
954 | - Improve exit message from ControlMaster clients. | ||
955 | - Prevent sftp-server(8) from reading until it runs out of buffer space, | ||
956 | whereupon it would exit with a fatal error (closes: #365541). | ||
957 | - pam_end() was not being called if authentication failed | ||
958 | (closes: #405041). | ||
959 | - Manual page datestamps updated (closes: #433181). | ||
960 | * Install the OpenSSH FAQ in /usr/share/doc/openssh-client. | ||
961 | - Includes documentation on copying files with colons using scp | ||
962 | (closes: #303453). | ||
963 | * Create /var/run/sshd on start even if /etc/ssh/sshd_not_to_be_run exists | ||
964 | (closes: #453285). | ||
965 | * Fix "overriden" typo in ssh(1) (thanks, A. Costa; closes: #390699). | ||
966 | * Refactor debian/rules configure and make invocations to make development | ||
967 | easier. | ||
968 | * Remove the hideously old /etc/ssh/primes on upgrade (closes: #123013). | ||
969 | * Update moduli(5) to revision 1.11 from OpenBSD CVS. | ||
970 | * Document the non-default options we set as standard in ssh_config(5) and | ||
971 | sshd_config(5) (closes: #327886, #345628). | ||
972 | * Recode LICENCE to UTF-8 when concatenating it to debian/copyright. | ||
973 | * Override desktop-file-but-no-dh_desktop-call lintian warning; the | ||
974 | .desktop file is intentionally not installed (see 1:3.8.1p1-10). | ||
975 | * Update copyright dates for Kerberos patch in debian/copyright.head. | ||
976 | * Policy version 3.7.3: no changes required. | ||
977 | |||
978 | -- Colin Watson <cjwatson@debian.org> Mon, 24 Dec 2007 16:43:02 +0000 | ||
979 | |||
980 | openssh (1:4.6p1-7) unstable; urgency=low | ||
981 | |||
982 | * Don't build PIE executables on m68k (closes: #451192). | ||
983 | * Use autotools-dev's recommended configure --build and --host options. | ||
984 | * Adjust README.Debian to suggest mailing debian-ssh@lists.debian.org | ||
985 | rather than Matthew. | ||
986 | * Check whether deluser exists in postrm (closes: #454085). | ||
987 | |||
988 | -- Colin Watson <cjwatson@debian.org> Mon, 03 Dec 2007 11:11:02 +0000 | ||
989 | |||
990 | openssh (1:4.6p1-6) unstable; urgency=low | ||
991 | |||
992 | * Remove blank line between head comment and first template in | ||
993 | debian/openssh-server.templates.master; apparently it confuses some | ||
994 | versions of debconf. | ||
995 | * Install authorized_keys(5) as a symlink to sshd(8) (thanks, Tomas | ||
996 | Pospisek; closes: #441817). | ||
997 | * Discard error output from dpkg-query in preinsts, in case the ssh | ||
998 | metapackage is not installed. | ||
999 | * Fix sshd/inittab advice in README.Debian to account for rc.d movement | ||
1000 | (closes: #450632). | ||
1001 | * Suppress error from debian/rules if lsb-release is not installed. | ||
1002 | * Don't ignore errors from 'make -C contrib clean'. | ||
1003 | * Adjust categories in ssh-askpass-gnome.desktop to comply with the | ||
1004 | Desktop Menu Specification. | ||
1005 | * debconf template translations: | ||
1006 | - Add Slovak (thanks, Ivan Masár; closes: #441690). | ||
1007 | - Update Brazilian Portuguese (thanks, Eder L. Marques; | ||
1008 | closes: #447145). | ||
1009 | |||
1010 | -- Colin Watson <cjwatson@debian.org> Mon, 12 Nov 2007 11:47:28 +0000 | ||
1011 | |||
1012 | openssh (1:4.6p1-5) unstable; urgency=low | ||
1013 | |||
1014 | * Identify ssh as a metapackage rather than a transitional package. It's | ||
1015 | still useful as a quick way to install both the client and the server. | ||
1016 | * ssh-copy-id now checks the exit status of ssh-add -L (thanks, Adeodato | ||
1017 | Simó; closes: #221675). | ||
1018 | * ssh-copy-id no longer prints the output of expr (thanks, Peter | ||
1019 | Eisentraut; closes: #291534). | ||
1020 | * ssh-copy-id defaults to ~/.ssh/id_rsa.pub rather than | ||
1021 | ~/.ssh/identity.pub, in line with ssh-keygen (thanks, Greg Norris; | ||
1022 | closes: #234627). | ||
1023 | * Build-depend on libselinux1-dev on lpia. | ||
1024 | * openssh-client Suggests: keychain. | ||
1025 | * debconf template translations: | ||
1026 | - Update Catalan (thanks, Jordà Polo; closes: #431970). | ||
1027 | |||
1028 | -- Colin Watson <cjwatson@debian.org> Mon, 30 Jul 2007 09:34:38 +0100 | ||
1029 | |||
1030 | openssh (1:4.6p1-4) unstable; urgency=low | ||
1031 | |||
1032 | * Don't build PIE executables on hppa, as they crash. | ||
1033 | |||
1034 | -- Colin Watson <cjwatson@debian.org> Thu, 05 Jul 2007 11:06:54 +0100 | ||
1035 | |||
1036 | openssh (1:4.6p1-3) unstable; urgency=low | ||
1037 | |||
1038 | * Only build PIE executables on Linux and NetBSD (closes: #430455). | ||
1039 | * Fix broken switch fallthrough when SELinux is running in permissive mode | ||
1040 | (closes: #430838). | ||
1041 | * Document that HashKnownHosts may break tab-completion (closes: #430154). | ||
1042 | |||
1043 | -- Colin Watson <cjwatson@debian.org> Fri, 29 Jun 2007 07:15:38 +0100 | ||
1044 | |||
1045 | openssh (1:4.6p1-2) unstable; urgency=low | ||
1046 | |||
1047 | * Fix ordering of SYSLOG_LEVEL_QUIET and SYSLOG_LEVEL_FATAL. | ||
1048 | * Clarify that 'ssh -q -q' still prints errors caused by bad arguments | ||
1049 | (i.e. before the logging system is initialised). | ||
1050 | * Suppress "Connection to <host> closed" and "Connection to master closed" | ||
1051 | messages at loglevel SILENT (thanks, Jaap Eldering; closes: #409788). | ||
1052 | * Suppress "Pseudo-terminal will not be allocated because stdin is not a | ||
1053 | terminal" message at loglevels QUIET and SILENT (closes: #366814). | ||
1054 | * Document the SILENT loglevel in sftp-server(8), ssh_config(5), and | ||
1055 | sshd_config(5). | ||
1056 | * Add try-restart action to init script. | ||
1057 | * Add /etc/network/if-up.d/openssh-server to restart sshd when new | ||
1058 | interfaces appear (LP: #103436). | ||
1059 | * Backport from upstream: | ||
1060 | - Move C/R -> kbdint special case to after the defaults have been | ||
1061 | loaded, which makes ChallengeResponse default to yes again. This was | ||
1062 | broken by the Match changes and not fixed properly subsequently | ||
1063 | (closes: #428968). | ||
1064 | - Silence spurious error messages from hang-on-exit fix | ||
1065 | (http://bugzilla.mindrot.org/show_bug.cgi?id=1306, closes: #429531). | ||
1066 | |||
1067 | -- Colin Watson <cjwatson@debian.org> Wed, 20 Jun 2007 11:52:44 +0100 | ||
1068 | |||
1069 | openssh (1:4.6p1-1) unstable; urgency=low | ||
1070 | |||
1071 | * New upstream release (closes: #395507, #397961, #420035). Important | ||
1072 | changes not previously backported to 4.3p2: | ||
1073 | - 4.4/4.4p1 (http://www.openssh.org/txt/release-4.4): | ||
1074 | + On portable OpenSSH, fix a GSSAPI authentication abort that could be | ||
1075 | used to determine the validity of usernames on some platforms. | ||
1076 | + Implemented conditional configuration in sshd_config(5) using the | ||
1077 | "Match" directive. This allows some configuration options to be | ||
1078 | selectively overridden if specific criteria (based on user, group, | ||
1079 | hostname and/or address) are met. So far a useful subset of | ||
1080 | post-authentication options are supported and more are expected to | ||
1081 | be added in future releases. | ||
1082 | + Add support for Diffie-Hellman group exchange key agreement with a | ||
1083 | final hash of SHA256. | ||
1084 | + Added a "ForceCommand" directive to sshd_config(5). Similar to the | ||
1085 | command="..." option accepted in ~/.ssh/authorized_keys, this forces | ||
1086 | the execution of the specified command regardless of what the user | ||
1087 | requested. This is very useful in conjunction with the new "Match" | ||
1088 | option. | ||
1089 | + Add a "PermitOpen" directive to sshd_config(5). This mirrors the | ||
1090 | permitopen="..." authorized_keys option, allowing fine-grained | ||
1091 | control over the port-forwardings that a user is allowed to | ||
1092 | establish. | ||
1093 | + Add optional logging of transactions to sftp-server(8). | ||
1094 | + ssh(1) will now record port numbers for hosts stored in | ||
1095 | ~/.ssh/known_hosts when a non-standard port has been requested | ||
1096 | (closes: #50612). | ||
1097 | + Add an "ExitOnForwardFailure" option to cause ssh(1) to exit (with a | ||
1098 | non-zero exit code) when requested port forwardings could not be | ||
1099 | established. | ||
1100 | + Extend sshd_config(5) "SubSystem" declarations to allow the | ||
1101 | specification of command-line arguments. | ||
1102 | + Replacement of all integer overflow susceptible invocations of | ||
1103 | malloc(3) and realloc(3) with overflow-checking equivalents. | ||
1104 | + Many manpage fixes and improvements. | ||
1105 | + Add optional support for OpenSSL hardware accelerators (engines), | ||
1106 | enabled using the --with-ssl-engine configure option. | ||
1107 | + Tokens in configuration files may be double-quoted in order to | ||
1108 | contain spaces (closes: #319639). | ||
1109 | + Move a debug() call out of a SIGCHLD handler, fixing a hang when the | ||
1110 | session exits very quickly (closes: #307890). | ||
1111 | + Fix some incorrect buffer allocation calculations (closes: #410599). | ||
1112 | + ssh-add doesn't ask for a passphrase if key file permissions are too | ||
1113 | liberal (closes: #103677). | ||
1114 | + Likewise, ssh doesn't ask either (closes: #99675). | ||
1115 | - 4.6/4.6p1 (http://www.openssh.org/txt/release-4.6): | ||
1116 | + sshd now allows the enabling and disabling of authentication methods | ||
1117 | on a per user, group, host and network basis via the Match directive | ||
1118 | in sshd_config. | ||
1119 | + Fixed an inconsistent check for a terminal when displaying scp | ||
1120 | progress meter (closes: #257524). | ||
1121 | + Fix "hang on exit" when background processes are running at the time | ||
1122 | of exit on a ttyful/login session (closes: #88337). | ||
1123 | * Update to current GSSAPI patch from | ||
1124 | http://www.sxw.org.uk/computing/patches/openssh-4.6p1-gsskex-20070312.patch; | ||
1125 | install ChangeLog.gssapi. | ||
1126 | * Build the .deb --with-ssl-engine (closes: #408027, LP: #119295). | ||
1127 | * Use LSB functions in init scripts, and add an LSB-style header (partly | ||
1128 | from Ubuntu and partly thanks to Christian Perrier; closes: #389038). | ||
1129 | * Move init script start links to S16, move rc1 stop link to K84, and | ||
1130 | remove rc0 and rc6 stop links altogether (the last part from Ubuntu; | ||
1131 | closes: #122188). | ||
1132 | * Emit a slightly more informative message from the init script if | ||
1133 | /dev/null has somehow become not a character device (closes: #369964). | ||
1134 | * Belatedly build-depend on zlib1g-dev (>= 1:1.2.3-1) (closes: #333447). | ||
1135 | * Merge from Ubuntu: | ||
1136 | - Build position-independent executables (only for debs, not for udebs) | ||
1137 | to take advantage of address space layout randomisation. | ||
1138 | - If building on Ubuntu, add /sbin, /usr/sbin, and /usr/local/sbin to | ||
1139 | the default path. | ||
1140 | * Use ${binary:Version} rather than ${Source-Version} in openssh-server -> | ||
1141 | openssh-client dependency. | ||
1142 | |||
1143 | -- Colin Watson <cjwatson@debian.org> Wed, 13 Jun 2007 00:28:26 +0100 | ||
1144 | |||
1145 | openssh (1:4.3p2-11) unstable; urgency=low | ||
1146 | |||
1147 | * It's been four and a half years now since I took over as "temporary" | ||
1148 | maintainer, so the Maintainer field is getting a bit inaccurate. Set | ||
1149 | Maintainer to debian-ssh@lists.debian.org and leave Matthew and myself | ||
1150 | as Uploaders. | ||
1151 | * Use dpkg-query to fetch conffile md5sums rather than parsing | ||
1152 | /var/lib/dpkg/status directly. | ||
1153 | * openssh-client Suggests: libpam-ssh (closes: #427840). | ||
1154 | * Use 'start-stop-daemon --oknodo' so that openssh-server's init script | ||
1155 | exits successfully if sshd is already running (closes: #426858). | ||
1156 | |||
1157 | * Apply results of debconf templates and package descriptions review by | ||
1158 | debian-l10n-english (closes: #420107, #420742). | ||
1159 | * debconf template translations: | ||
1160 | - Update Dutch (thanks, Machteld de Kok; closes: #419260). | ||
1161 | - Update Norwegian Bokmål (thanks, Bjørn Steensrud; closes: #420630). | ||
1162 | - Update Galician (thanks, Jacobo Tarrio; closes: #420635). | ||
1163 | - Update Spanish (thanks, Javier Fernández-Sanguino Peña; | ||
1164 | closes: #420651). | ||
1165 | - Update Swedish (thanks, Daniel Nylander; closes: #420663). | ||
1166 | - Add Bulgarian (thanks, Damyan Ivanov; closes: #420703). | ||
1167 | - Add Tamil (thanks, Tirumurti Vasudevan; closes: #420739). | ||
1168 | - Update German (thanks, Helge Kreutzmann; closes: #420743). | ||
1169 | - Update Japanese (thanks, Kenshi Muto; closes: #420946). | ||
1170 | - Add Basque (thanks, Piarres Beobide; closes: #421238). | ||
1171 | - Update Italian (thanks, Luca Monducci; closes: #421348). | ||
1172 | - Update Czech (thanks, Miroslav Kure; closes: #421484). | ||
1173 | - Update Romanian (thanks, Igor Stirbu; closes: #421760). | ||
1174 | - Update Russian (thanks, Yuriy Talakan' and Sergey Alyoshin; | ||
1175 | closes: #420862). | ||
1176 | - Update Dutch (thanks, Bart Cornelis; closes: #422767). | ||
1177 | - Update Portuguese (thanks, Ricardo Silva; closes: #423112). | ||
1178 | - Update French (thanks, Christian Perrier). | ||
1179 | - Add Korean (thanks, Sunjae Park; closes: #424008). | ||
1180 | - Update Vietnamese (thanks, Clytie Siddall; closes: #426991). | ||
1181 | |||
1182 | -- Colin Watson <cjwatson@debian.org> Sun, 10 Jun 2007 08:59:42 +0100 | ||
1183 | |||
1184 | openssh (1:4.3p2-10) unstable; urgency=low | ||
1185 | |||
1186 | * Multiply openssh-client-udeb's Installer-Menu-Item by 100. | ||
1187 | * Increase MAX_SESSIONS to 64. | ||
1188 | |||
1189 | -- Colin Watson <cjwatson@debian.org> Tue, 10 Apr 2007 19:17:20 +0100 | ||
1190 | |||
1191 | openssh (1:4.3p2-9) unstable; urgency=high | ||
1192 | |||
1193 | [ Russ Allbery ] | ||
1194 | * Fix GSSAPIKeyExchange configuration file handling logic in ssh-krb5 | ||
1195 | (closes: #404863). | ||
1196 | * Fix uncommenting of GSSAPI options by ssh-krb5 (closes: #407766). | ||
1197 | |||
1198 | [ Colin Watson ] | ||
1199 | * debconf template translations: | ||
1200 | - Add Norwegian Bokmål (thanks, Bjørn Steensrud; closes: #412330). | ||
1201 | |||
1202 | -- Colin Watson <cjwatson@debian.org> Mon, 5 Mar 2007 16:13:50 +0000 | ||
1203 | |||
1204 | openssh (1:4.3p2-8) unstable; urgency=medium | ||
1205 | |||
1206 | [ Vincent Untz ] | ||
1207 | * Give the ssh-askpass-gnome window a default icon; remove unnecessary | ||
1208 | icon extension from .desktop file (closes: | ||
1209 | https://launchpad.net/bugs/27152). | ||
1210 | |||
1211 | [ Colin Watson ] | ||
1212 | * Drop versioning on ssh/ssh-krb5 Replaces, as otherwise it isn't | ||
1213 | sufficient to replace conffiles (closes: #402804). | ||
1214 | * Make GSSAPICleanupCreds a compatibility alias for | ||
1215 | GSSAPICleanupCredentials. Mark GSSUseSessionCCache and | ||
1216 | GSSAPIUseSessionCredCache as known-but-unsupported options, and migrate | ||
1217 | away from them on upgrade. | ||
1218 | * It turns out that the people who told me that removing a conffile in the | ||
1219 | preinst was sufficient to have dpkg replace it without prompting when | ||
1220 | moving a conffile between packages were very much mistaken. As far as I | ||
1221 | can tell, the only way to do this reliably is to write out the desired | ||
1222 | new text of the conffile in the preinst. This is gross, and requires | ||
1223 | shipping the text of all conffiles in the preinst too, but there's | ||
1224 | nothing for it. Fortunately this nonsense is only required for smooth | ||
1225 | upgrades from sarge. | ||
1226 | * debconf template translations: | ||
1227 | - Add Romanian (thanks, Stan Ioan-Eugen; closes: #403528). | ||
1228 | |||
1229 | -- Colin Watson <cjwatson@debian.org> Sat, 23 Dec 2006 18:38:33 +0000 | ||
1230 | |||
1231 | openssh (1:4.3p2-7) unstable; urgency=medium | ||
1232 | |||
1233 | [ Colin Watson ] | ||
1234 | * Ignore errors from usermod when changing sshd's shell, since it will | ||
1235 | fail if the sshd user is not local (closes: #398436). | ||
1236 | * Remove version control tags from /etc/ssh/moduli and /etc/ssh/ssh_config | ||
1237 | to avoid unnecessary conffile resolution steps for administrators | ||
1238 | (thanks, Jari Aalto; closes: #335259). | ||
1239 | * Fix quoting error in configure.ac and regenerate configure (thanks, Ben | ||
1240 | Pfaff; closes: #391248). | ||
1241 | * When installing openssh-client or openssh-server from scratch, remove | ||
1242 | any unchanged conffiles from the pre-split ssh package to work around a | ||
1243 | bug in sarge's dpkg (thanks, Justin Pryzby and others; closes: #335276). | ||
1244 | |||
1245 | [ Russ Allbery ] | ||
1246 | * Create transitional ssh-krb5 package which enables GSSAPI configuration | ||
1247 | in sshd_config (closes: #390986). | ||
1248 | * Default client to attempting GSSAPI authentication. | ||
1249 | * Remove obsolete GSSAPINoMICAuthentication from sshd_config if it's | ||
1250 | found. | ||
1251 | * Add ssh -K option, the converse of -k, to enable GSSAPI credential | ||
1252 | delegation (closes: #401483). | ||
1253 | |||
1254 | -- Colin Watson <cjwatson@debian.org> Wed, 6 Dec 2006 23:00:49 +0000 | ||
1255 | |||
1256 | openssh (1:4.3p2-6) unstable; urgency=low | ||
1257 | |||
1258 | * Acknowledge NMU (thanks, Manoj; closes: #394795). | ||
1259 | * Backport from 4.5p1: | ||
1260 | - Fix a bug in the sshd privilege separation monitor that weakened its | ||
1261 | verification of successful authentication. This bug is not known to be | ||
1262 | exploitable in the absence of additional vulnerabilities. | ||
1263 | * openssh-server Suggests: molly-guard (closes: #395473). | ||
1264 | * debconf template translations: | ||
1265 | - Update German (thanks, Helge Kreutzmann; closes: #395947). | ||
1266 | |||
1267 | -- Colin Watson <cjwatson@debian.org> Wed, 15 Nov 2006 00:07:32 +0000 | ||
1268 | |||
1269 | openssh (1:4.3p2-5.1) unstable; urgency=low | ||
1270 | |||
1271 | * NMU to update SELinux patch, bringing it in line with current selinux | ||
1272 | releases. The patch for this NMU is simply the Bug#394795 patch, | ||
1273 | and no other changes. (closes: #394795) | ||
1274 | |||
1275 | -- Manoj Srivastava <srivasta@debian.org> Mon, 23 Oct 2006 14:11:24 -0500 | ||
1276 | |||
1277 | openssh (1:4.3p2-5) unstable; urgency=low | ||
1278 | |||
1279 | * Remove ssh/insecure_telnetd check altogether (closes: #391081). | ||
1280 | * debconf template translations: | ||
1281 | - Update Danish (thanks, Claus Hindsgaul; closes: #390612). | ||
1282 | |||
1283 | -- Colin Watson <cjwatson@debian.org> Thu, 5 Oct 2006 09:04:19 +0100 | ||
1284 | |||
1285 | openssh (1:4.3p2-4) unstable; urgency=high | ||
1286 | |||
1287 | * Backport from 4.4p1 (since I don't have an updated version of the GSSAPI | ||
1288 | patch yet): | ||
1289 | - CVE-2006-4924: Fix a pre-authentication denial of service found by | ||
1290 | Tavis Ormandy, that would cause sshd(8) to spin until the login grace | ||
1291 | time expired (closes: #389995). | ||
1292 | - CVE-2006-5051: Fix an unsafe signal hander reported by Mark Dowd. The | ||
1293 | signal handler was vulnerable to a race condition that could be | ||
1294 | exploited to perform a pre-authentication denial of service. On | ||
1295 | portable OpenSSH, this vulnerability could theoretically lead to | ||
1296 | pre-authentication remote code execution if GSSAPI authentication is | ||
1297 | enabled, but the likelihood of successful exploitation appears remote. | ||
1298 | |||
1299 | * Read /etc/default/locale as well as /etc/environment (thanks, Raphaël | ||
1300 | Hertzog; closes: #369395). | ||
1301 | * Remove no-longer-used ssh/insecure_rshd debconf template. | ||
1302 | * Make ssh/insecure_telnetd Type: error (closes: #388946). | ||
1303 | |||
1304 | * debconf template translations: | ||
1305 | - Update Portuguese (thanks, Rui Branco; closes: #381942). | ||
1306 | - Update Spanish (thanks, Javier Fernández-Sanguino Peña; | ||
1307 | closes: #382966). | ||
1308 | |||
1309 | -- Colin Watson <cjwatson@debian.org> Fri, 29 Sep 2006 16:28:24 +0100 | ||
1310 | |||
1311 | openssh (1:4.3p2-3) unstable; urgency=low | ||
1312 | |||
1313 | * Document KeepAlive->TCPKeepAlive renaming in sshd_config(5) (closes: | ||
1314 | https://launchpad.net/bugs/50702). | ||
1315 | * Change sshd user's shell to /usr/sbin/nologin (closes: #366541). | ||
1316 | Introduces dependency on passwd for usermod. | ||
1317 | * debconf template translations: | ||
1318 | - Update French (thanks, Denis Barbier; closes: #368503). | ||
1319 | - Update Dutch (thanks, Bart Cornelis; closes: #375100). | ||
1320 | - Update Japanese (thanks, Kenshi Muto; closes: #379950). | ||
1321 | |||
1322 | -- Colin Watson <cjwatson@debian.org> Thu, 27 Jul 2006 00:12:36 +0100 | ||
1323 | |||
1324 | openssh (1:4.3p2-2) unstable; urgency=low | ||
1325 | |||
1326 | * Include commented-out pam_access example in /etc/pam.d/ssh. | ||
1327 | * On '/etc/init.d/ssh restart', create /var/run/sshd before checking the | ||
1328 | server configuration, as otherwise 'sshd -t' will complain about the | ||
1329 | lack of /var/run/sshd (closes: https://launchpad.net/bugs/45234). | ||
1330 | * debconf template translations: | ||
1331 | - Update Russian (thanks, Yuriy Talakan'; closes: #367143). | ||
1332 | - Update Czech (thanks, Miroslav Kure; closes: #367161). | ||
1333 | - Update Italian (thanks, Luca Monducci; closes: #367186). | ||
1334 | - Update Galician (thanks, Jacobo Tarrio; closes: #367318). | ||
1335 | - Update Swedish (thanks, Daniel Nylander; closes: #367971). | ||
1336 | |||
1337 | -- Colin Watson <cjwatson@debian.org> Fri, 19 May 2006 09:14:27 +0100 | ||
1338 | |||
1339 | openssh (1:4.3p2-1) unstable; urgency=low | ||
1340 | |||
1341 | * New upstream release (closes: #361032). | ||
1342 | - CVE-2006-0225: scp (as does rcp, on which it is based) invoked a | ||
1343 | subshell to perform local to local, and remote to remote copy | ||
1344 | operations. This subshell exposed filenames to shell expansion twice; | ||
1345 | allowing a local attacker to create filenames containing shell | ||
1346 | metacharacters that, if matched by a wildcard, could lead to execution | ||
1347 | of attacker-specified commands with the privilege of the user running | ||
1348 | scp (closes: #349645). | ||
1349 | - Add support for tunneling arbitrary network packets over a connection | ||
1350 | between an OpenSSH client and server via tun(4) virtual network | ||
1351 | interfaces. This allows the use of OpenSSH (4.3+) to create a true VPN | ||
1352 | between the client and server providing real network connectivity at | ||
1353 | layer 2 or 3. This feature is experimental. | ||
1354 | - Reduce default key length for new DSA keys generated by ssh-keygen | ||
1355 | back to 1024 bits. DSA is not specified for longer lengths and does | ||
1356 | not fully benefit from simply making keys longer. As per FIPS 186-2 | ||
1357 | Change Notice 1, ssh-keygen will refuse to generate a new DSA key | ||
1358 | smaller or larger than 1024 bits. | ||
1359 | - Fixed X forwarding failing to start when the X11 client is executed in | ||
1360 | background at the time of session exit. | ||
1361 | - Change ssh-keygen to generate a protocol 2 RSA key when invoked | ||
1362 | without arguments (closes: #114894). | ||
1363 | - Fix timing variance for valid vs. invalid accounts when attempting | ||
1364 | Kerberos authentication. | ||
1365 | - Ensure that ssh always returns code 255 on internal error | ||
1366 | (closes: #259865). | ||
1367 | - Cleanup wtmp files on SIGTERM when not using privsep. | ||
1368 | - Set SO_REUSEADDR on X11 listeners to avoid problems caused by | ||
1369 | lingering sockets from previous session (X11 applications can | ||
1370 | sometimes not connect to 127.0.0.1:60xx) (closes: | ||
1371 | https://launchpad.net/bugs/25528). | ||
1372 | - Ensure that fds 0, 1 and 2 are always attached in all programs, by | ||
1373 | duping /dev/null to them if necessary. | ||
1374 | - Xauth list invocation had bogus "." argument. | ||
1375 | - Remove internal assumptions on key exchange hash algorithm and output | ||
1376 | length, preparing OpenSSH for KEX methods with alternate hashes. | ||
1377 | - Ignore junk sent by a server before it sends the "SSH-" banner. | ||
1378 | - Many manual page improvements. | ||
1379 | - Lots of cleanups, including fixes to memory leaks on error paths and | ||
1380 | possible crashes. | ||
1381 | * Update to current GSSAPI patch from | ||
1382 | http://www.sxw.org.uk/computing/patches/openssh-4.3p2-gsskex-20060223.patch | ||
1383 | (closes: #352042). | ||
1384 | * debian/rules: Resynchronise CFLAGS with that generated by configure. | ||
1385 | * Restore pam_nologin to /etc/pam.d/ssh; sshd no longer checks this itself | ||
1386 | when PAM is enabled, but relies on PAM to do it. | ||
1387 | * Rename KeepAlive to TCPKeepAlive in default sshd_config | ||
1388 | (closes: #349896). | ||
1389 | * Rephrase ssh/new_config and ssh/encrypted_host_key_but_no_keygen debconf | ||
1390 | templates to make boolean short descriptions end with a question mark | ||
1391 | and to avoid use of the first person. | ||
1392 | * Ship README.tun. | ||
1393 | * Policy version 3.7.2: no changes required. | ||
1394 | * debconf template translations: | ||
1395 | - Update Italian (thanks, Luca Monducci; closes: #360348). | ||
1396 | - Add Galician (thanks, Jacobo Tarrio; closes: #361220). | ||
1397 | |||
1398 | -- Colin Watson <cjwatson@debian.org> Fri, 12 May 2006 12:48:24 +0100 | ||
1399 | |||
1400 | openssh (1:4.2p1-8) unstable; urgency=low | ||
1401 | |||
1402 | [ Frans Pop ] | ||
1403 | * Use udeb support introduced in debhelper 4.2.0 (available in sarge) | ||
1404 | rather than constructing udebs by steam. | ||
1405 | * Require debhelper 5.0.22, which generates correct shared library | ||
1406 | dependencies for udebs (closes: #360068). This build-dependency can be | ||
1407 | ignored if building on sarge. | ||
1408 | |||
1409 | [ Colin Watson ] | ||
1410 | * Switch to debhelper compatibility level 4, since we now require | ||
1411 | debhelper 4 even on sarge anyway for udeb support. | ||
1412 | |||
1413 | -- Colin Watson <cjwatson@debian.org> Fri, 31 Mar 2006 09:44:55 +0100 | ||
1414 | |||
1415 | openssh (1:4.2p1-7) unstable; urgency=low | ||
1416 | |||
1417 | * I accidentally applied the default $PATH change in 1:4.2p1-6 to the udeb | ||
1418 | rather than the deb. Fixed. | ||
1419 | |||
1420 | -- Colin Watson <cjwatson@debian.org> Wed, 1 Mar 2006 16:19:00 +0000 | ||
1421 | |||
1422 | openssh (1:4.2p1-6) unstable; urgency=low | ||
1423 | |||
1424 | * Sync default values of $PATH from shadow 1:4.0.12-6, adding /usr/bin/X11 | ||
1425 | to the normal and superuser paths and /usr/games to the normal path. | ||
1426 | * When the client receives a signal, don't fatal() with "Killed by signal | ||
1427 | %d." (which produces unhelpful noise on stderr and causes confusion for | ||
1428 | users of some applications that wrap ssh); instead, generate a debug | ||
1429 | message and exit with the traditional status (closes: #313371). | ||
1430 | * debconf template translations: | ||
1431 | - Add Swedish (thanks, Daniel Nylander; closes: #333133). | ||
1432 | - Update Spanish (thanks, Javier Fernández-Sanguino Peña; | ||
1433 | closes: #341371). | ||
1434 | - Correct erroneously-changed Last-Translator headers in Greek and | ||
1435 | Spanish translations. | ||
1436 | |||
1437 | -- Colin Watson <cjwatson@debian.org> Mon, 20 Feb 2006 16:50:55 +0000 | ||
1438 | |||
1439 | openssh (1:4.2p1-5) unstable; urgency=low | ||
1440 | |||
1441 | * Add a CVE name to the 1:4.0p1-1 changelog entry. | ||
1442 | * Build-depend on libselinux1-dev on armeb. | ||
1443 | * Only send GSSAPI proposal if GSSAPIAuthentication is enabled. | ||
1444 | * Build-depend on libssl-dev (>= 0.9.8-1) to cope with surprise OpenSSL | ||
1445 | transition, since otherwise who knows what the buildds will do. If | ||
1446 | you're building openssh yourself, you can safely ignore this and use an | ||
1447 | older libssl-dev. | ||
1448 | |||
1449 | -- Colin Watson <cjwatson@debian.org> Fri, 7 Oct 2005 12:23:42 +0100 | ||
1450 | |||
1451 | openssh (1:4.2p1-4) unstable; urgency=low | ||
1452 | |||
1453 | * Initialise token to GSS_C_EMPTY_BUFFER in ssh_gssapi_check_mechanism | ||
1454 | (closes: #328606). | ||
1455 | |||
1456 | -- Colin Watson <cjwatson@debian.org> Fri, 16 Sep 2005 12:50:16 +0100 | ||
1457 | |||
1458 | openssh (1:4.2p1-3) unstable; urgency=low | ||
1459 | |||
1460 | * Add prototype for ssh_gssapi_server_mechanisms (closes: #328372). | ||
1461 | * Interoperate with ssh-krb5 << 3.8.1p1-1 servers, which used a slightly | ||
1462 | different version of the gssapi authentication method (thanks, Aaron M. | ||
1463 | Ucko; closes: #328388). | ||
1464 | * Explicitly tell po2debconf to use the 'popular' output encoding, so that | ||
1465 | the woody-compatibility hack works even with po-debconf 0.9.0. | ||
1466 | |||
1467 | -- Colin Watson <cjwatson@debian.org> Thu, 15 Sep 2005 09:28:21 +0100 | ||
1468 | |||
1469 | openssh (1:4.2p1-2) unstable; urgency=low | ||
1470 | |||
1471 | * Annotate 1:4.2p1-1 changelog with CVE references. | ||
1472 | * Add remaining pieces of Kerberos support (closes: #152657, #275472): | ||
1473 | - Add GSSAPI key exchange support from | ||
1474 | http://www.sxw.org.uk/computing/patches/openssh.html (thanks, Stephen | ||
1475 | Frost). | ||
1476 | - Build-depend on libkrb5-dev and configure --with-kerberos5=/usr. | ||
1477 | - openssh-client and openssh-server replace ssh-krb5. | ||
1478 | - Update commented-out Kerberos/GSSAPI options in default sshd_config. | ||
1479 | - Fix HAVE_GSSAPI_KRB5_H/HAVE_GSSAPI_GSSAPI_KRB5_H typos in | ||
1480 | gss-serv-krb5.c. | ||
1481 | |||
1482 | -- Colin Watson <cjwatson@debian.org> Wed, 14 Sep 2005 18:28:49 +0100 | ||
1483 | |||
1484 | openssh (1:4.2p1-1) unstable; urgency=low | ||
1485 | |||
1486 | * New upstream release. | ||
1487 | - SECURITY (CAN-2005-2797): Fix a bug introduced in OpenSSH 4.0 that | ||
1488 | caused GatewayPorts to be incorrectly activated for dynamic ("-D") | ||
1489 | port forwardings when no listen address was explicitly specified | ||
1490 | (closes: #326065). | ||
1491 | - SECURITY (CAN-2005-2798): Fix improper delegation of GSSAPI | ||
1492 | credentials. This code is only built in openssh-krb5, not openssh, but | ||
1493 | I mention the CVE reference here anyway for completeness. | ||
1494 | - Add a new compression method ("Compression delayed") that delays zlib | ||
1495 | compression until after authentication, eliminating the risk of zlib | ||
1496 | vulnerabilities being exploited by unauthenticated users. Note that | ||
1497 | users of OpenSSH versions earlier than 3.5 will need to disable | ||
1498 | compression on the client or set "Compression yes" (losing this | ||
1499 | security benefit) on the server. | ||
1500 | - Increase the default size of new RSA/DSA keys generated by ssh-keygen | ||
1501 | from 1024 to 2048 bits (closes: #181162). | ||
1502 | - Many bugfixes and improvements to connection multiplexing. | ||
1503 | - Don't pretend to accept $HOME (closes: #208648). | ||
1504 | * debian/rules: Resynchronise CFLAGS with that generated by configure. | ||
1505 | * openssh-client and openssh-server conflict with pre-split ssh to avoid | ||
1506 | problems when ssh is left un-upgraded (closes: #324695). | ||
1507 | * Set X11Forwarding to yes in the default sshd_config (new installs only). | ||
1508 | At least when X11UseLocalhost is turned on, which is the default, the | ||
1509 | security risks of using X11 forwarding are risks to the client, not to | ||
1510 | the server (closes: #320104). | ||
1511 | |||
1512 | -- Colin Watson <cjwatson@debian.org> Wed, 14 Sep 2005 15:16:14 +0100 | ||
1513 | |||
1514 | openssh (1:4.1p1-7) unstable; urgency=low | ||
1515 | |||
1516 | * Do the IDEA host key check on a temporary file to avoid altering | ||
1517 | /etc/ssh/ssh_host_key itself (closes: #312312). | ||
1518 | * Work around the ssh-askpass alternative somehow ending up in manual mode | ||
1519 | pointing to the obsolete /usr/lib/ssh/gnome-ssh-askpass. | ||
1520 | * Add GNU/kFreeBSD support (thanks, Aurelien Jarno; closes: #318113). | ||
1521 | * Fix XSIish uses of 'test' in openssh-server.preinst. | ||
1522 | * Policy version 3.6.2: no changes required. | ||
1523 | |||
1524 | -- Colin Watson <cjwatson@debian.org> Fri, 2 Sep 2005 16:18:11 +0100 | ||
1525 | |||
1526 | openssh (1:4.1p1-6) unstable; urgency=low | ||
1527 | |||
1528 | * Fix one-character typo that meant the binaries in openssh-client and | ||
1529 | openssh-server got recompiled with the wrong options during | ||
1530 | 'debian/rules install' (closes: #317088, #317238, #317241). | ||
1531 | |||
1532 | -- Colin Watson <cjwatson@debian.org> Thu, 7 Jul 2005 10:56:16 +0100 | ||
1533 | |||
1534 | openssh (1:4.1p1-5) unstable; urgency=low | ||
1535 | |||
1536 | * Build-depend on libselinux1-dev on ppc64 too (closes: #314625). | ||
1537 | * Drop priority of ssh to extra to match the override file. | ||
1538 | * Make /usr/share/doc/openssh-server and /usr/share/doc/ssh symlinks to | ||
1539 | /usr/share/doc/openssh-client (closes: #314745). | ||
1540 | * Ship README.dns (closes: #284874). | ||
1541 | * Disable btmp logging, since Debian's /var/log/btmp has inappropriate | ||
1542 | permissions (closes: #314956). | ||
1543 | * Allow ~/.ssh/config to be group-writable, provided that the group in | ||
1544 | question contains only the file's owner (closes: #314347). | ||
1545 | * debconf template translations: | ||
1546 | - Update Brazilian Portuguese (thanks, André LuÃs Lopes; | ||
1547 | closes: #315477). | ||
1548 | - Add Vietnamese (thanks, Clytie Siddall; closes: #316636). | ||
1549 | |||
1550 | -- Colin Watson <cjwatson@debian.org> Sun, 3 Jul 2005 17:08:08 +0100 | ||
1551 | |||
1552 | openssh (1:4.1p1-4) unstable; urgency=low | ||
1553 | |||
1554 | * openssh-client and openssh-server conflict with ssh-krb5, as ssh-krb5 | ||
1555 | only conflicts with ssh (closes: #312475). | ||
1556 | * SELinux support (thanks, Manoj Srivastava; closes: #308555): | ||
1557 | - Added SELinux capability, and turned it on be default. Added | ||
1558 | restorecon calls in preinst and postinst (should not matter if the | ||
1559 | machine is not SELinux aware). By and large, the changes made should | ||
1560 | have no effect unless the rules file calls --with-selinux; and even | ||
1561 | then there should be no performance hit for machines not actively | ||
1562 | running SELinux. | ||
1563 | - Modified the preinst and postinst to call restorecon to set the | ||
1564 | security context for the generated public key files. | ||
1565 | - Added a comment to /etc/pam.d/ssh to indicate that an SELinux system | ||
1566 | may want to also include pam_selinux.so. | ||
1567 | * Re-enable ssh-askpass-gnome on the Hurd, now that its build-dependencies | ||
1568 | are available. | ||
1569 | * Restore /usr/lib/sftp-server temporarily, as a symlink to | ||
1570 | /usr/lib/openssh/sftp-server (closes: #312891). | ||
1571 | * Switch to debhelper compatibility level 3, since 2 is deprecated. | ||
1572 | * debconf template translations: | ||
1573 | - Update German (thanks, Jens Seidel; closes: #313949). | ||
1574 | |||
1575 | -- Colin Watson <cjwatson@debian.org> Fri, 17 Jun 2005 14:20:20 +0100 | ||
1576 | |||
1577 | openssh (1:4.1p1-3) unstable; urgency=low | ||
1578 | |||
1579 | * Upload to unstable. | ||
1580 | |||
1581 | -- Colin Watson <cjwatson@debian.org> Mon, 6 Jun 2005 22:28:33 +0100 | ||
1582 | |||
1583 | openssh (1:4.1p1-2) experimental; urgency=low | ||
1584 | |||
1585 | * Drop debconf support for allowing SSH protocol 1, which is discouraged | ||
1586 | and has not been the default since openssh 1:3.0.1p1-1. Users who need | ||
1587 | this should edit sshd_config instead (closes: #147212). | ||
1588 | * Since ssh-keysign isn't used by default (you need to set | ||
1589 | EnableSSHKeysign to "yes" in /etc/ssh/ssh_config), having a debconf | ||
1590 | question to ask whether it should be setuid is overkill, and the | ||
1591 | question text had got out of date anyway. Remove this question, ship | ||
1592 | ssh-keysign setuid in openssh-client.deb, and set a statoverride if the | ||
1593 | debconf question was previously set to false. | ||
1594 | * Add lintian overrides for the above (setuid-binary, | ||
1595 | no-debconf-templates). | ||
1596 | * Fix picky lintian errors about slogin symlinks. | ||
1597 | * Fix DEB_HOST_ARCH_OS/DEB_HOST_GNU_SYSTEM compatibility handling. | ||
1598 | * Apply Linux 2.2 workaround (see #239999) only on Linux. | ||
1599 | |||
1600 | -- Colin Watson <cjwatson@debian.org> Thu, 2 Jun 2005 00:55:58 +0100 | ||
1601 | |||
1602 | openssh (1:4.1p1-1) experimental; urgency=low | ||
1603 | |||
1604 | * New upstream release. | ||
1605 | - Normalise socket addresses returned by get_remote_hostname(), fixing | ||
1606 | 4-in-6 mapping issues with AllowUsers et al (closes: #192234). | ||
1607 | * Take upstream's hint and disable the unsupported USE_POSIX_THREADS | ||
1608 | (closes: #295757, #308868, and possibly others; may open other bugs). | ||
1609 | Use PAM password authentication to avoid #278394. In future I may | ||
1610 | provide two sets of binaries built with and without this option, since | ||
1611 | it seems I can't win. | ||
1612 | * Disable ChallengeResponseAuthentication in new installations, returning | ||
1613 | to PasswordAuthentication by default, since it now supports PAM and | ||
1614 | apparently works better with a non-threaded sshd (closes: #247521). | ||
1615 | * openssh-server Suggests: rssh (closes: #233012). | ||
1616 | * Change libexecdir to /usr/lib/openssh, and fix up various alternatives | ||
1617 | and configuration files to match (closes: #87900, #151321). | ||
1618 | * Fix up very old sshd_config files that refer to /usr/libexec/sftp-server | ||
1619 | (closes: #141979). | ||
1620 | |||
1621 | -- Colin Watson <cjwatson@debian.org> Tue, 31 May 2005 01:33:33 +0100 | ||
1622 | |||
1623 | openssh (1:4.0p1-1) experimental; urgency=low | ||
1624 | |||
1625 | * New upstream release. | ||
1626 | - Port-forwarding specifications now take optional bind addresses, and | ||
1627 | the server allows client-specified bind addresses for remote port | ||
1628 | forwardings when configured with "GatewayPorts clientspecified" | ||
1629 | (closes: #87253, #192206). | ||
1630 | - ssh and ssh-keyscan now support hashing of known_hosts files for | ||
1631 | improved privacy (CAN-2005-2666). ssh-keygen has new options for | ||
1632 | managing known_hosts files, which understand hashing. | ||
1633 | - sftp supports command history and editing support using libedit | ||
1634 | (closes: #287013). | ||
1635 | - Have scp and sftp wait for the spawned ssh to exit before they exit | ||
1636 | themselves, allowing ssh to restore terminal modes (closes: #257130). | ||
1637 | - Improved the handling of bad data in authorized_keys files, | ||
1638 | eliminating fatal errors on corrupt or very large keys; e.g. linefeeds | ||
1639 | in keys only produce errors in auth.log now (closes: #220726). | ||
1640 | - Add "command mode" to ssh connection multiplexing (closes: #303452). | ||
1641 | - Mention $HOME/.hushlogin in sshd(8) FILES section (closes: #163933). | ||
1642 | * Make gnome-ssh-askpass stay above other windows (thanks, Liyang HU; | ||
1643 | closes: #296487). | ||
1644 | * Remove obsolete and unnecessary ssh/forward_warning debconf note. | ||
1645 | * Hurd build fixes (although sshd still doesn't work): | ||
1646 | - Restore X forwarding fix from #102991, lost somewhere along the way. | ||
1647 | - Link with -lcrypt. | ||
1648 | - Link with -lpthread rather than -pthread. | ||
1649 | - Don't build ssh-askpass-gnome on the Hurd, until GNOME is available to | ||
1650 | satisfy build-dependencies. | ||
1651 | * Drop workaround for #242462 on amd64; it's been fixed properly upstream. | ||
1652 | * Enable HashKnownHosts by default. This only affects new entries; use | ||
1653 | 'ssh-keygen -H' to convert an entire known_hosts file to hashed format. | ||
1654 | * Note in ssh_config(5) that the SetupTimeOut option is Debian-specific | ||
1655 | (closes: #307069). | ||
1656 | * debconf template translations: | ||
1657 | - Update Czech (thanks, Miroslav Kure; closes: #298744). | ||
1658 | - Update Finnish (thanks, Matti Pöllä; closes: #303787). | ||
1659 | - Synchronise Spanish with sarge branch (thanks, Javier | ||
1660 | Fernández-Sanguino Peña; closes: #298536). | ||
1661 | - Add Ukrainian (thanks, Eugeniy Meshcheryakov; closes: #301852). | ||
1662 | |||
1663 | -- Colin Watson <cjwatson@debian.org> Thu, 26 May 2005 11:23:18 +0100 | ||
1664 | |||
1665 | openssh (1:3.9p1-3) experimental; urgency=low | ||
1666 | |||
1667 | * Explain how to run sshd from inittab in README.Debian (closes: #147360). | ||
1668 | * Add debian/watch file. | ||
1669 | |||
1670 | -- Colin Watson <cjwatson@debian.org> Fri, 18 Feb 2005 00:20:16 +0000 | ||
1671 | |||
1672 | openssh (1:3.9p1-2) experimental; urgency=low | ||
1673 | |||
1674 | * Remove pam_nologin from /etc/pam.d/ssh, as sshd's built-in support | ||
1675 | appears to be sufficient and more useful (closes: #162996). | ||
1676 | * Depend on debconf | debconf-2.0. | ||
1677 | * Drop LoginGraceTime back to the upstream default of two minutes on new | ||
1678 | installs (closes: #289573). | ||
1679 | * debconf template translations from Ubuntu bug #1232: | ||
1680 | - Update Greek (thanks, Logiotatidis George). | ||
1681 | - Update Spanish (thanks, Santiago Erquicia). | ||
1682 | |||
1683 | -- Colin Watson <cjwatson@debian.org> Sat, 15 Jan 2005 12:37:54 +0000 | ||
1684 | |||
1685 | openssh (1:3.9p1-1) experimental; urgency=low | ||
1686 | |||
1687 | * New upstream release. | ||
1688 | - PAM password authentication implemented again (closes: #238699, | ||
1689 | #242119). | ||
1690 | - Implemented the ability to pass selected environment variables between | ||
1691 | the client and the server. | ||
1692 | - Fix ssh-keyscan breakage when remote server doesn't speak SSH protocol | ||
1693 | (closes: #228828). | ||
1694 | - Fix res_query detection (closes: #242462). | ||
1695 | - 'ssh -c' documentation improved (closes: #265627). | ||
1696 | * Pass LANG and LC_* environment variables from the client by default, and | ||
1697 | accept them to the server by default in new installs, although not on | ||
1698 | upgrade (closes: #264024). | ||
1699 | * Build ssh in binary-indep, not binary-arch (thanks, LaMont Jones). | ||
1700 | * Expand on openssh-client package description (closes: #273831). | ||
1701 | |||
1702 | -- Colin Watson <cjwatson@debian.org> Tue, 4 Jan 2005 14:18:31 +0000 | ||
1703 | |||
1704 | openssh (1:3.8.1p1-14) experimental; urgency=low | ||
1705 | |||
1706 | * We use DH_COMPAT=2, so build-depend on debhelper (>= 2). | ||
1707 | * Fix timing information leak allowing discovery of invalid usernames in | ||
1708 | PAM keyboard-interactive authentication (backported from a patch by | ||
1709 | Darren Tucker; closes: #281595). | ||
1710 | * Make sure that there's a delay in PAM keyboard-interactive | ||
1711 | authentication when PermitRootLogin is not set to yes and the correct | ||
1712 | root password is entered (closes: #248747). | ||
1713 | |||
1714 | -- Colin Watson <cjwatson@debian.org> Sun, 28 Nov 2004 18:09:37 +0000 | ||
1715 | |||
1716 | openssh (1:3.8.1p1-13) experimental; urgency=low | ||
1717 | |||
1718 | * Enable threading for PAM, on Sam Hartman's advice (closes: #278394). | ||
1719 | * debconf template translations: | ||
1720 | - Update Dutch (thanks, cobaco; closes: #278715). | ||
1721 | * Correct README.Debian's ForwardX11Trusted description (closes: #280190). | ||
1722 | |||
1723 | -- Colin Watson <cjwatson@debian.org> Fri, 12 Nov 2004 12:03:13 +0000 | ||
1724 | |||
1725 | openssh (1:3.8.1p1-12) experimental; urgency=low | ||
1726 | |||
1727 | * Preserve /etc/ssh/sshd_config ownership/permissions (closes: #276754). | ||
1728 | * Shorten the version string from the form "OpenSSH_3.8.1p1 Debian | ||
1729 | 1:3.8.1p1-8.sarge.1" to "OpenSSH_3.8.1p1 Debian-8.sarge.1", as some SSH | ||
1730 | implementations apparently have problems with the long version string. | ||
1731 | This is of course a bug in those implementations, but since the extent | ||
1732 | of the problem is unknown it's best to play safe (closes: #275731). | ||
1733 | * debconf template translations: | ||
1734 | - Add Finnish (thanks, Matti Pöllä; closes: #265339). | ||
1735 | - Update Danish (thanks, Morten Brix Pedersen; closes: #275895). | ||
1736 | - Update French (thanks, Denis Barbier; closes: #276703). | ||
1737 | - Update Japanese (thanks, Kenshi Muto; closes: #277438). | ||
1738 | |||
1739 | -- Colin Watson <cjwatson@debian.org> Sun, 24 Oct 2004 19:21:17 +0100 | ||
1740 | |||
1741 | openssh (1:3.8.1p1-11) experimental; urgency=high | ||
1742 | |||
1743 | * Move sshd_config(5) to openssh-server, where it belongs. | ||
1744 | * If PasswordAuthentication is disabled, then offer to disable | ||
1745 | ChallengeResponseAuthentication too. The current PAM code will attempt | ||
1746 | password-style authentication if ChallengeResponseAuthentication is | ||
1747 | enabled (closes: #250369). | ||
1748 | * This will ask a question of anyone who installed fresh with 1:3.8p1-2 or | ||
1749 | later and then upgraded. Sorry about that ... for this reason, the | ||
1750 | default answer is to leave ChallengeResponseAuthentication enabled. | ||
1751 | |||
1752 | -- Colin Watson <cjwatson@debian.org> Wed, 6 Oct 2004 14:28:20 +0100 | ||
1753 | |||
1754 | openssh (1:3.8.1p1-10) experimental; urgency=low | ||
1755 | |||
1756 | * Don't install the ssh-askpass-gnome .desktop file by default; I've had | ||
1757 | too many GNOME people tell me it's the wrong thing to be doing. I've | ||
1758 | left it in /usr/share/doc/ssh-askpass-gnome/examples/ for now. | ||
1759 | |||
1760 | -- Colin Watson <cjwatson@debian.org> Wed, 25 Aug 2004 18:18:14 +0100 | ||
1761 | |||
1762 | openssh (1:3.8.1p1-9) experimental; urgency=low | ||
1763 | |||
1764 | * Split the ssh binary package into openssh-client and openssh-server | ||
1765 | (closes: #39741). openssh-server depends on openssh-client for some | ||
1766 | common functionality; it didn't seem worth creating yet another package | ||
1767 | for this. openssh-client is priority standard, openssh-server optional. | ||
1768 | * New transitional ssh package, priority optional, depending on | ||
1769 | openssh-client and openssh-server. May be removed once nothing depends | ||
1770 | on it. | ||
1771 | * When upgrading from ssh to openssh-{client,server}, it's very difficult | ||
1772 | for the maintainer scripts to find out what version we're upgrading from | ||
1773 | without dodgy dpkg hackery. I've therefore taken the opportunity to move | ||
1774 | a couple of debconf notes into NEWS files, namely ssh/ssh2_keys_merged | ||
1775 | and ssh/user_environment_tell. | ||
1776 | * Add a heuristic to try to make sure the sshd_config upgrade to >= 3.7 | ||
1777 | happens even though we don't know what version we're upgrading from. | ||
1778 | * Remove /etc/ssh/sshd_not_to_be_run on purge of openssh-server. For now | ||
1779 | (until sarge+2) it's still honoured to avoid breaking existing | ||
1780 | configurations, but the right approach is now to remove the | ||
1781 | openssh-server package if you don't want to run the server. Add a NEWS | ||
1782 | item to that effect. | ||
1783 | |||
1784 | -- Colin Watson <cjwatson@debian.org> Mon, 2 Aug 2004 20:48:54 +0100 | ||
1785 | |||
1786 | openssh (1:3.8.1p1-8.sarge.4) unstable; urgency=high | ||
1787 | |||
1788 | * Fix timing information leak allowing discovery of invalid usernames in | ||
1789 | PAM keyboard-interactive authentication (backported from a patch by | ||
1790 | Darren Tucker; closes: #281595). | ||
1791 | * Make sure that there's a delay in PAM keyboard-interactive | ||
1792 | authentication when PermitRootLogin is not set to yes and the correct | ||
1793 | root password is entered (closes: #248747). | ||
1794 | |||
1795 | -- Colin Watson <cjwatson@debian.org> Sun, 28 Nov 2004 12:37:16 +0000 | ||
1796 | |||
1797 | openssh (1:3.8.1p1-8.sarge.3) unstable; urgency=low | ||
1798 | |||
1799 | * Enable threading for PAM, on Sam Hartman's advice (closes: #278394). | ||
1800 | * debconf template translations: | ||
1801 | - Update Dutch (thanks, cobaco; closes: #278715). | ||
1802 | * Correct README.Debian's ForwardX11Trusted description (closes: #280190). | ||
1803 | |||
1804 | -- Colin Watson <cjwatson@debian.org> Fri, 12 Nov 2004 10:31:12 +0000 | ||
1805 | |||
1806 | openssh (1:3.8.1p1-8.sarge.2) unstable; urgency=low | ||
1807 | |||
1808 | * Preserve /etc/ssh/sshd_config ownership/permissions (closes: #276754). | ||
1809 | * Shorten the version string from the form "OpenSSH_3.8.1p1 Debian | ||
1810 | 1:3.8.1p1-8.sarge.1" to "OpenSSH_3.8.1p1 Debian-8.sarge.1", as some SSH | ||
1811 | implementations apparently have problems with the long version string. | ||
1812 | This is of course a bug in those implementations, but since the extent | ||
1813 | of the problem is unknown it's best to play safe (closes: #275731). | ||
1814 | * debconf template translations: | ||
1815 | - Add Finnish (thanks, Matti Pöllä; closes: #265339). | ||
1816 | - Update Danish (thanks, Morten Brix Pedersen; closes: #275895). | ||
1817 | - Update French (thanks, Denis Barbier; closes: #276703). | ||
1818 | - Update Japanese (thanks, Kenshi Muto; closes: #277438). | ||
1819 | |||
1820 | -- Colin Watson <cjwatson@debian.org> Sun, 24 Oct 2004 17:57:14 +0100 | ||
1821 | |||
1822 | openssh (1:3.8.1p1-8.sarge.1) unstable; urgency=high | ||
1823 | |||
1824 | * If PasswordAuthentication is disabled, then offer to disable | ||
1825 | ChallengeResponseAuthentication too. The current PAM code will attempt | ||
1826 | password-style authentication if ChallengeResponseAuthentication is | ||
1827 | enabled (closes: #250369). | ||
1828 | * This will ask a question of anyone who installed fresh with 1:3.8p1-2 or | ||
1829 | later and then upgraded. Sorry about that ... for this reason, the | ||
1830 | default answer is to leave ChallengeResponseAuthentication enabled. | ||
1831 | |||
1832 | -- Colin Watson <cjwatson@debian.org> Wed, 6 Oct 2004 14:21:55 +0100 | ||
1833 | |||
1834 | openssh (1:3.8.1p1-8) unstable; urgency=high | ||
1835 | |||
1836 | * Matthew Vernon: | ||
1837 | - Add a GPL exception to the licensing terms of the Debian patch | ||
1838 | (closes: #211644). | ||
1839 | |||
1840 | -- Colin Watson <cjwatson@debian.org> Thu, 29 Jul 2004 13:28:47 +0100 | ||
1841 | |||
1842 | openssh (1:3.8.1p1-7) unstable; urgency=low | ||
1843 | |||
1844 | * Re-enable shadow password support in openssh-server-udeb, at Bastian | ||
1845 | Blank's request (closes: #260800). | ||
1846 | |||
1847 | -- Colin Watson <cjwatson@debian.org> Thu, 22 Jul 2004 10:56:06 +0100 | ||
1848 | |||
1849 | openssh (1:3.8.1p1-6) unstable; urgency=low | ||
1850 | |||
1851 | * Implement hack in | ||
1852 | http://lists.debian.org/debian-boot/2004/07/msg01207.html to get | ||
1853 | openssh-client-udeb to show up as a retrievable debian-installer | ||
1854 | component. | ||
1855 | * Generate host keys in postinst only if the relevant HostKey directives | ||
1856 | are found in sshd_config (closes: #87946). | ||
1857 | |||
1858 | -- Colin Watson <cjwatson@debian.org> Wed, 21 Jul 2004 15:14:46 +0100 | ||
1859 | |||
1860 | openssh (1:3.8.1p1-5) unstable; urgency=medium | ||
1861 | |||
1862 | * Update German debconf template translation (thanks, Helge Kreutzmann; | ||
1863 | closes: #252226). | ||
1864 | * Remove Suggests: dnsutils, as it was only needed for | ||
1865 | make-ssh-known-hosts (#93265), which has been replaced by ssh-keyscan. | ||
1866 | * Disable shadow password support in openssh-server-udeb. | ||
1867 | * Fix non-portable shell constructs in maintainer scripts, Makefile, and | ||
1868 | ssh-copy-id (thanks, David Weinehall; closes: #258517). | ||
1869 | * Apply patch from Darren Tucker to make the PAM authentication SIGCHLD | ||
1870 | handler kill the PAM thread if its waitpid() call returns 0, as well as | ||
1871 | the previous check for -1 (closes: #252676). | ||
1872 | * Add scp and sftp to openssh-client-udeb. It might not be very 'u' any | ||
1873 | more; oh well. | ||
1874 | |||
1875 | -- Colin Watson <cjwatson@debian.org> Sat, 10 Jul 2004 13:57:27 +0100 | ||
1876 | |||
1877 | openssh (1:3.8.1p1-4) unstable; urgency=medium | ||
1878 | |||
1879 | * Kill off PAM thread if privsep slave dies (closes: #248125). | ||
1880 | |||
1881 | -- Colin Watson <cjwatson@debian.org> Fri, 28 May 2004 17:58:45 -0300 | ||
1882 | |||
1883 | openssh (1:3.8.1p1-3) unstable; urgency=low | ||
1884 | |||
1885 | * Add ssh-keygen to openssh-server-udeb. | ||
1886 | |||
1887 | -- Colin Watson <cjwatson@debian.org> Thu, 20 May 2004 16:31:52 +0100 | ||
1888 | |||
1889 | openssh (1:3.8.1p1-2) unstable; urgency=low | ||
1890 | |||
1891 | * Add Catalan debconf template translation (thanks, Aleix Badia i Bosch; | ||
1892 | closes: #248748). | ||
1893 | * openssh-client-udeb and openssh-server-udeb depend on libnss-files-udeb | ||
1894 | (not yet uploaded). | ||
1895 | * Restore ssh-askpass-gnome binary, lost by mistake. | ||
1896 | * Don't link against libnsl in udeb builds. | ||
1897 | |||
1898 | -- Colin Watson <cjwatson@debian.org> Thu, 20 May 2004 11:15:58 +0100 | ||
1899 | |||
1900 | openssh (1:3.8.1p1-1) unstable; urgency=low | ||
1901 | |||
1902 | * New upstream release. | ||
1903 | - Use a longer buffer for tty names in utmp (closes: #247538). | ||
1904 | * Make sure there's a newline at the end of sshd_config before adding | ||
1905 | 'UsePAM yes' (closes: #244829). | ||
1906 | * Generate a new .orig.tar.gz without RFC.nroff, and remove | ||
1907 | /usr/share/doc/ssh/RFC.gz (closes: #211640). It isn't DFSG-free and only | ||
1908 | documents the obsolete SSH1 protocol, not to mention that it was never a | ||
1909 | real RFC but only an Internet-Draft. It's available from | ||
1910 | http://www.free.lp.se/bamse/draft-ylonen-ssh-protocol-00.txt if you want | ||
1911 | it for some reason. | ||
1912 | * Add openssh-client-udeb and openssh-server-udeb binary packages for use | ||
1913 | in debian-installer. They still need libnss_files to be supplied in udeb | ||
1914 | form by glibc. | ||
1915 | * Work around lack of res_query weak alias in libresolv on amd64 (see | ||
1916 | #242462, awaiting real fix upstream). | ||
1917 | * Fix grammar in sshd(8) (closes: #238753). | ||
1918 | * Add .desktop file and icon for ssh-askpass-gnome (closes: #232333). | ||
1919 | * Update Polish debconf template translation (thanks, Emil Nowak; | ||
1920 | closes: #242808). | ||
1921 | * Add Turkish debconf template translation (thanks, Recai OktaÅŸ; | ||
1922 | closes: #246068). | ||
1923 | |||
1924 | -- Colin Watson <cjwatson@debian.org> Tue, 11 May 2004 23:38:10 +0100 | ||
1925 | |||
1926 | openssh (1:3.8p1-3) unstable; urgency=low | ||
1927 | |||
1928 | * Remove deprecated ReverseMappingCheck option from newly generated | ||
1929 | sshd_config files (closes: #239987). | ||
1930 | * Build everything apart from contrib in a subdirectory, to allow for | ||
1931 | multiple builds. | ||
1932 | * Some older kernels are missing setresuid() and setresgid(), so don't try | ||
1933 | to use them. setreuid() and setregid() will do well enough for our | ||
1934 | purposes (closes: #239999). | ||
1935 | |||
1936 | -- Colin Watson <cjwatson@debian.org> Mon, 5 Apr 2004 21:23:43 +0100 | ||
1937 | |||
1938 | openssh (1:3.8p1-2) unstable; urgency=medium | ||
1939 | |||
1940 | * Disable PasswordAuthentication for new installations (closes: #236810). | ||
1941 | * Turn off the new ForwardX11Trusted by default, returning to the | ||
1942 | semantics of 3.7 and earlier, since it seems immature and causes far too | ||
1943 | many problems with existing setups. See README.Debian for details | ||
1944 | (closes: #237021). | ||
1945 | |||
1946 | -- Colin Watson <cjwatson@debian.org> Wed, 10 Mar 2004 10:33:07 +0000 | ||
1947 | |||
1948 | openssh (1:3.8p1-1) unstable; urgency=low | ||
1949 | |||
1950 | * New upstream release (closes: #232281): | ||
1951 | - New PAM implementation based on that in FreeBSD. This runs PAM session | ||
1952 | modules before dropping privileges (closes: #132681, #150968). | ||
1953 | - Since PAM session modules are run as root, we can turn pam_limits back | ||
1954 | on by default, and it no longer spits out "Operation not permitted" to | ||
1955 | syslog (closes: #171673). | ||
1956 | - Password expiry works again (closes: #153235). | ||
1957 | - 'ssh -q' suppresses login banner (closes: #134589). | ||
1958 | - sshd doesn't lie to PAM about invalid usernames (closes: #157078). | ||
1959 | - ssh-add prints key comment on each prompt (closes: #181869). | ||
1960 | - Punctuation formatting fixed in man pages (closes: #191131). | ||
1961 | - EnableSSHKeysign documented in ssh_config(5) (closes: #224457). | ||
1962 | * Add 'UsePAM yes' to /etc/ssh/sshd_config on upgrade from versions older | ||
1963 | than this, to maintain the standard Debian sshd configuration. | ||
1964 | * Comment out PAMAuthenticationViaKbdInt and RhostsAuthentication in | ||
1965 | sshd_config on upgrade. Neither option is supported any more. | ||
1966 | * Privilege separation and PAM are now properly supported together, so | ||
1967 | remove both debconf questions related to them and simply set it | ||
1968 | unconditionally in newly generated sshd_config files (closes: #228838). | ||
1969 | * ServerAliveInterval implemented upstream, so ProtocolKeepAlives is now a | ||
1970 | compatibility alias. The semantics differ slightly, though; see | ||
1971 | ssh_config(5) for details. | ||
1972 | * Implement SSH1 support for ServerAliveInterval using SSH_MSG_IGNORE. As | ||
1973 | documented in ssh_config(5), it's not as good as the SSH2 version. | ||
1974 | * Remove -fno-builtin-log, -DHAVE_MMAP_ANON_SHARED, and | ||
1975 | -D__FILE_OFFSET_BITS=64 compiler options, which are no longer necessary. | ||
1976 | * Update config.guess and config.sub from autotools-dev 20040105.1. | ||
1977 | * Darren Tucker: | ||
1978 | - Reset signal status when starting pam auth thread, prevent hanging | ||
1979 | during PAM keyboard-interactive authentications. | ||
1980 | - Fix a non-security-critical segfault in PAM authentication. | ||
1981 | * Add debconf template translations: | ||
1982 | - Greek (thanks, Konstantinos Margaritis; closes: #232843). | ||
1983 | - Italian (thanks, Renato Gini; closes: #234777). | ||
1984 | |||
1985 | -- Colin Watson <cjwatson@debian.org> Sat, 6 Mar 2004 18:43:44 +0000 | ||
1986 | |||
1987 | openssh (1:3.6.1p2-12) unstable; urgency=low | ||
1988 | |||
1989 | * Update Spanish debconf template translation (thanks, Javier | ||
1990 | Fernández-Sanguino Peña; closes: #228242). | ||
1991 | * Add debconf template translations: | ||
1992 | - Czech (thanks, Miroslav Kure; closes: #230110). | ||
1993 | - Simplified Chinese (thanks, Hiei Xu; closes: #230726). | ||
1994 | |||
1995 | -- Colin Watson <cjwatson@debian.org> Wed, 11 Feb 2004 09:37:57 +0000 | ||
1996 | |||
1997 | openssh (1:3.6.1p2-11) unstable; urgency=low | ||
1998 | |||
1999 | * Comment out pam_limits in default configuration, for now at least | ||
2000 | (closes: #198254). | ||
2001 | * Use invoke-rc.d (if it exists) to run the init script. | ||
2002 | * Backport format string bug fix in sshconnect.c (closes: #225238). | ||
2003 | * ssh-copy-id exits if ssh fails (closes: #215252). | ||
2004 | |||
2005 | -- Colin Watson <cjwatson@debian.org> Sun, 4 Jan 2004 18:59:21 +0000 | ||
2006 | |||
2007 | openssh (1:3.6.1p2-10) unstable; urgency=low | ||
2008 | |||
2009 | * Use --retry in init script when restarting rather than sleeping, to make | ||
2010 | sure the old process is dead (thanks, Herbert Xu; closes: #212117). | ||
2011 | Depend on dpkg (>= 1.9.0) for start-stop-daemon's --retry option. | ||
2012 | * Update debconf template translations: | ||
2013 | - Brazilian Portuguese (thanks, Andre Luis Lopes; closes: #219844). | ||
2014 | - Danish (thanks, Morten Brix Pedersen; closes: #217964). | ||
2015 | - Japanese (thanks, Kenshi Muto; closes: #212497). | ||
2016 | - Russian (thanks, Ilgiz Kalmetev). | ||
2017 | - Spanish (thanks, Carlos Valdivia Yagüe; closes: #211832). | ||
2018 | * Add Dutch debconf template translation (thanks, cobaco; | ||
2019 | closes: #215372). | ||
2020 | * Update config.guess and config.sub from autotools-dev 20031007.1 | ||
2021 | (closes: #217696). | ||
2022 | * Implement New World Order for PAM configuration, including | ||
2023 | /etc/pam.d/common-* from /etc/pam.d/ssh (closes: #212959). | ||
2024 | - To backport this release to woody, you need to set DEB_BUILD_SSH_WOODY | ||
2025 | in your environment. See README.Debian. | ||
2026 | * Add more commentary to /etc/pam.d/ssh. | ||
2027 | |||
2028 | -- Colin Watson <cjwatson@debian.org> Sun, 16 Nov 2003 01:14:16 +0000 | ||
2029 | |||
2030 | openssh (1:3.6.1p2-9) unstable; urgency=high | ||
2031 | |||
2032 | * Merge even more buffer allocation fixes from upstream (CAN-2003-0682; | ||
2033 | closes: #211434). | ||
2034 | |||
2035 | -- Colin Watson <cjwatson@debian.org> Fri, 19 Sep 2003 10:25:25 +0100 | ||
2036 | |||
2037 | openssh (1:3.6.1p2-8) unstable; urgency=high | ||
2038 | |||
2039 | * Merge more buffer allocation fixes from new upstream version 3.7.1p1 | ||
2040 | (closes: #211324). | ||
2041 | |||
2042 | -- Colin Watson <cjwatson@debian.org> Wed, 17 Sep 2003 03:07:19 +0100 | ||
2043 | |||
2044 | openssh (1:3.6.1p2-7) unstable; urgency=high | ||
2045 | |||
2046 | * Update debconf template translations: | ||
2047 | - French (thanks, Christian Perrier; closes: #208801). | ||
2048 | - Japanese (thanks, Kenshi Muto; closes: #210380). | ||
2049 | * Some small improvements to the English templates courtesy of Christian | ||
2050 | Perrier. I've manually unfuzzied a few translations where it was | ||
2051 | obvious, on Christian's advice, but the others will have to be updated. | ||
2052 | * Document how to generate an RSA1 host key (closes: #141703). | ||
2053 | * Incorporate NMU fix for early buffer expansion vulnerability, | ||
2054 | CAN-2003-0693 (closes: #211205). Thanks to Michael Stone. | ||
2055 | |||
2056 | -- Colin Watson <cjwatson@debian.org> Tue, 16 Sep 2003 14:32:28 +0100 | ||
2057 | |||
2058 | openssh (1:3.6.1p2-6.0) unstable; urgency=high | ||
2059 | |||
2060 | * SECURITY: fix for CAN-2003-0693, buffer allocation error | ||
2061 | |||
2062 | -- Michael Stone <mstone@debian.org> Tue, 16 Sep 2003 08:27:07 -0400 | ||
2063 | |||
2064 | openssh (1:3.6.1p2-6) unstable; urgency=medium | ||
2065 | |||
2066 | * Use a more CVS-friendly means of setting SSH_VERSION. | ||
2067 | * Update Brazilian Portuguese debconf template translation (thanks, Andre | ||
2068 | Luis Lopes; closes: #208036). | ||
2069 | * Don't run 'sshd -t' in init script if the server isn't to be run | ||
2070 | (closes: #197576). | ||
2071 | * Fix login delay, spurious auth.log entry, and PermitRootLogin | ||
2072 | information leakage due to PAM issues with upstream's recent security | ||
2073 | update (thanks, Darren Tucker; closes: #99168, #192207, #193546). | ||
2074 | * Policy version 3.6.1: recode this changelog to UTF-8. | ||
2075 | |||
2076 | -- Colin Watson <cjwatson@debian.org> Wed, 3 Sep 2003 19:14:02 +0100 | ||
2077 | |||
2078 | openssh (1:3.6.1p2-5) unstable; urgency=low | ||
2079 | |||
2080 | * Disable cmsg_type check for file descriptor passing when running on | ||
2081 | Linux 2.0 (closes: #150976). Remove comments about non-functional | ||
2082 | privilege separation on 2.0 from ssh/privsep_ask and ssh/privsep_tell | ||
2083 | debconf questions and from README.Debian, since it should all now work. | ||
2084 | * Fix "defails" typo in generated sshd_config (closes: #206484). | ||
2085 | * Backport upstream patch to strip trailing whitespace (including | ||
2086 | newlines) from configuration directives (closes: #192079). | ||
2087 | |||
2088 | -- Colin Watson <cjwatson@debian.org> Wed, 27 Aug 2003 02:19:57 +0100 | ||
2089 | |||
2090 | openssh (1:3.6.1p2-4) unstable; urgency=low | ||
2091 | |||
2092 | * getent can get just one key; no need to use grep (thanks, James Troup). | ||
2093 | * Move /usr/local/bin to the front of the default path, following | ||
2094 | /etc/login.defs (closes: #201150). | ||
2095 | * Remove specifics of problematic countries from package description | ||
2096 | (closes: #197040). | ||
2097 | * Update Spanish debconf template translation (thanks, Carlos Valdivia | ||
2098 | Yagüe; closes: #198456). | ||
2099 | * Backport upstream patch to pass monitor signals through to child | ||
2100 | (closes: #164797). | ||
2101 | |||
2102 | -- Colin Watson <cjwatson@debian.org> Sun, 27 Jul 2003 17:31:15 +0100 | ||
2103 | |||
2104 | openssh (1:3.6.1p2-3) unstable; urgency=low | ||
2105 | |||
2106 | * Update French debconf template translation (thanks, Christian Perrier; | ||
2107 | closes: #194323). | ||
2108 | * Version the adduser dependency for --no-create-home (closes: #195756). | ||
2109 | * Add a version of moduli(5), namely revision 1.7 of | ||
2110 | http://www.openbsd.org/cgi-bin/cvsweb/src/share/man/man5/moduli.5 with | ||
2111 | '/etc/moduli' changed to '/etc/ssh/moduli' throughout (closes: #196061). | ||
2112 | |||
2113 | -- Colin Watson <cjwatson@debian.org> Mon, 9 Jun 2003 02:51:35 +0100 | ||
2114 | |||
2115 | openssh (1:3.6.1p2-2) unstable; urgency=low | ||
2116 | |||
2117 | * Force /etc/default/ssh to be non-executable, since dpkg apparently | ||
2118 | doesn't deal with permissions changes on conffiles (closes: #192966). | ||
2119 | * Use debconf 0.5's seen flag rather than the deprecated isdefault. | ||
2120 | * Add GPL location to copyright file. | ||
2121 | * Remove debian/postinst.old. | ||
2122 | * Switch to po-debconf, with some careful manual use of po2debconf to | ||
2123 | ensure that the source package continues to build smoothly on woody | ||
2124 | (closes: #183986). | ||
2125 | * Update debconf template translations: | ||
2126 | - Brazilian Portugese (thanks, Andre Luis Lopes; see #183986). | ||
2127 | - Japanese (thanks, Tomohiro KUBOTA; closes: #192429). | ||
2128 | * Compile with -fno-builtin-log for now, otherwise gcc-3.3 complains | ||
2129 | "log.h:59: warning: conflicting types for built-in function `log'". The | ||
2130 | OpenSSH log() function has been renamed in upstream CVS. | ||
2131 | |||
2132 | -- Colin Watson <cjwatson@debian.org> Mon, 19 May 2003 01:52:38 +0100 | ||
2133 | |||
2134 | openssh (1:3.6.1p2-1) unstable; urgency=medium | ||
2135 | |||
2136 | * New upstream release, including fix for PAM user-discovery security hole | ||
2137 | (closes: #191681). | ||
2138 | * Fix ChallengeResponseAuthentication default in generated sshd_config | ||
2139 | (closes: #106037). | ||
2140 | * Put newlines after full stops in man page documentation for | ||
2141 | ProtocolKeepAlives and SetupTimeOut. | ||
2142 | * Policy version 3.5.9: support DEB_BUILD_OPTIONS=noopt, build | ||
2143 | gnome-ssh-askpass with -g and -Wall flags. | ||
2144 | * Really ask ssh/new_config debconf question before trying to fetch its | ||
2145 | value (closes: #188721). | ||
2146 | * On purge, remove only the files we know about in /etc/ssh rather than | ||
2147 | the whole thing, and remove the directory if that leaves it empty | ||
2148 | (closes: #176679). | ||
2149 | * ssh has depended on debconf for some time now with no complaints, so: | ||
2150 | - Simplify the postinst by relying on debconf being present. (The absent | ||
2151 | case was buggy anyway.) | ||
2152 | - Get rid of "if you have not installed debconf" text in README.Debian, | ||
2153 | and generally update the "/usr/bin/ssh not SUID" entry. | ||
2154 | * More README.Debian work: | ||
2155 | - Reorganize into "UPGRADE ISSUES" and "OTHER ISSUES", in an effort to | ||
2156 | make it easier for people to find the former. The upgrade issues | ||
2157 | should probably be sorted by version somehow. | ||
2158 | - Document X11UseLocalhost under "X11 Forwarding" (closes: #150913). | ||
2159 | * Fix setting of IP flags for interactive sessions (upstream bug #541). | ||
2160 | |||
2161 | -- Colin Watson <cjwatson@debian.org> Mon, 5 May 2003 17:47:40 +0100 | ||
2162 | |||
2163 | openssh (1:3.6.1p1-1) unstable; urgency=low | ||
2164 | |||
2165 | * New upstream release (thanks, Laurence J. Lane). | ||
2166 | * debian/control: ssh-askpass-gnome is now Section: gnome, following the | ||
2167 | override file. | ||
2168 | |||
2169 | -- Colin Watson <cjwatson@debian.org> Wed, 2 Apr 2003 00:51:02 +0100 | ||
2170 | |||
2171 | openssh (1:3.6p1-1) unstable; urgency=low | ||
2172 | |||
2173 | * New upstream release. | ||
2174 | - Workaround applied upstream for a bug in the interaction of glibc's | ||
2175 | getaddrinfo() with the Linux 2.2 kernel (closes: #155814). | ||
2176 | - As such, it should now be safe to remove --with-ipv4-default, so | ||
2177 | starting sshd with -6 is no longer necessary (closes: #79861 and lots | ||
2178 | of other merged bugs). | ||
2179 | - ssh-copy-id prints usage when run without arguments (closes: #71376). | ||
2180 | - scp exits 1 if ssh fails (closes: #138400). | ||
2181 | - sshd writes to utmp's ut_addr_v6 field in IPv6 mode (closes: #167867). | ||
2182 | - 'ssh-add -c' causes ssh-agent to ask the user each time a key is used | ||
2183 | (closes: #109795). | ||
2184 | * Install /etc/default/ssh non-executable (closes: #185537). | ||
2185 | |||
2186 | -- Colin Watson <cjwatson@debian.org> Mon, 31 Mar 2003 23:00:59 +0100 | ||
2187 | |||
2188 | openssh (1:3.5p1-5) unstable; urgency=low | ||
2189 | |||
2190 | * Add /etc/default/ssh (closes: #161049). | ||
2191 | * Run the init script under 'set -e' (closes: #175010). | ||
2192 | * Change the default superuser path to include /sbin, /usr/sbin, and | ||
2193 | /usr/local/sbin (closes: #128235, #151267). Using login.defs would be | ||
2194 | nice, but that belongs to another package. Without a defined API to | ||
2195 | retrieve its settings, parsing it is off-limits. | ||
2196 | * Build ssh-askpass-gnome with GNOME 2. The source package should still | ||
2197 | support building on stable with GNOME 1, using the alternate | ||
2198 | libgnome-dev build-dependency (thanks, Colin Walters; closes: #167582). | ||
2199 | |||
2200 | -- Colin Watson <cjwatson@debian.org> Sun, 9 Mar 2003 20:12:10 +0000 | ||
2201 | |||
2202 | openssh (1:3.5p1-4) unstable; urgency=low | ||
2203 | |||
2204 | * Point rlogin and rcp alternatives at slogin and scp respectively rather | ||
2205 | than ssh (closes: #121103, #151666). Fix alternative removal to match; | ||
2206 | previously it was completely wrong anyway. | ||
2207 | * Find out whether /etc/ssh/sshd_not_to_be_run exists and set the debconf | ||
2208 | question's default using that information, rather than using debconf as | ||
2209 | a registry. Other solutions may be better in the long run, but this is | ||
2210 | at least correct (thanks, Matthew Woodcraft; closes: #84725). | ||
2211 | * Stop using pam_lastlog, as it doesn't currently work well as a session | ||
2212 | module when privilege separation is enabled; it can usually read | ||
2213 | /var/log/lastlog but can't write to it. Instead, just use sshd's | ||
2214 | built-in support, already enabled by default (closes: #151297, #169938). | ||
2215 | * Use 'ssh-keygen -q' rather than redirecting output to /dev/null. | ||
2216 | * Add a "this may take some time" warning when creating host keys on | ||
2217 | installation (part of #110094). | ||
2218 | * When restarting via the init script, check for sshd_not_to_be_run after | ||
2219 | stopping sshd (idea from Tomas Pospisek; closes: #149850). | ||
2220 | * Append /usr/sbin:/sbin to the init script's $PATH, just in case of | ||
2221 | strangeness (closes: #115138). | ||
2222 | * Fix a dpkg-statoverride call to redirect stdout to /dev/null, not | ||
2223 | stderr. | ||
2224 | * Correct copyright file typo: "orignal" -> "original" (closes: #176490). | ||
2225 | * Rebuild with libssl0.9.7 (closes: #176983). | ||
2226 | * We're up to policy version 3.5.6. DEB_BUILD_OPTIONS stuff still needs to | ||
2227 | be looked at. | ||
2228 | |||
2229 | -- Colin Watson <cjwatson@debian.org> Sat, 18 Jan 2003 01:37:23 +0000 | ||
2230 | |||
2231 | openssh (1:3.5p1-3) unstable; urgency=low | ||
2232 | |||
2233 | * Happy new year! | ||
2234 | * Use getent rather than id to find out whether the sshd user exists | ||
2235 | (closes: #150974). | ||
2236 | * Remove some duplication from the postinst's ssh-keysign setuid code. | ||
2237 | * Replace db_text with db_input throughout debian/config. (db_text has | ||
2238 | been a compatibility wrapper since debconf 0.1.5.) | ||
2239 | * Warn about PermitUserEnvironment on upgrade (closes: #167895). | ||
2240 | * Use 'make install-nokeys', and disable unused debhelper commands, | ||
2241 | thereby forward-porting the last pieces of Zack Weinberg's patch | ||
2242 | (closes: #68341). | ||
2243 | * Move the man page for gnome-ssh-askpass from the ssh package to | ||
2244 | ssh-askpass-gnome (closes: #174449). | ||
2245 | * Build with -DLOGIN_NO_ENDOPT, since Debian's /bin/login doesn't accept | ||
2246 | '--' to terminate the list of options (closes: #171554). | ||
2247 | * Add Jonathan Amery's ssh-argv0 script (closes: #111341). | ||
2248 | * Update Danish debconf template (thanks, Morten Brix Pedersen; | ||
2249 | closes: #174757). | ||
2250 | * Document setgid ssh-agent's effect on certain environment variables in | ||
2251 | README.Debian (closes: #167974). | ||
2252 | * Document interoperability problems between scp and ssh.com's server in | ||
2253 | README.Debian, and suggest some workarounds (closes: #174662). | ||
2254 | |||
2255 | -- Colin Watson <cjwatson@debian.org> Wed, 1 Jan 2003 14:18:30 +0000 | ||
2256 | |||
2257 | openssh (1:3.5p1-2) unstable; urgency=low | ||
2258 | |||
2259 | * Mention in the ssh package description that it provides both ssh and | ||
2260 | sshd (closes: #99680). | ||
2261 | * Create a system group for ssh-agent, not a user group (closes: #167669). | ||
2262 | |||
2263 | -- Colin Watson <cjwatson@debian.org> Mon, 4 Nov 2002 13:43:53 +0000 | ||
2264 | |||
2265 | openssh (1:3.5p1-1) unstable; urgency=low | ||
2266 | |||
2267 | * New upstream release. | ||
2268 | - Fixes typo in ssh-add usage (closes: #152239). | ||
2269 | - Fixes 'PermitRootLogin forced-commands-only' (closes: #166184). | ||
2270 | - ~/.ssh/environment and environment= options in ~/.ssh/authorized_keys | ||
2271 | are deprecated for security reasons and will eventually go away. For | ||
2272 | now they can be re-enabled by setting 'PermitUserEnvironment yes' in | ||
2273 | sshd_config. | ||
2274 | - ssh-agent is installed setgid to prevent ptrace() attacks. The group | ||
2275 | actually doesn't matter, as it drops privileges immediately, but to | ||
2276 | avoid confusion the postinst creates a new 'ssh' group for it. | ||
2277 | * Obsolete patches: | ||
2278 | - Solar Designer's privsep+compression patch for Linux 2.2 (see | ||
2279 | 1:3.3p1-0.0woody1). | ||
2280 | - Hostbased auth ssh-keysign backport (see 1:3.4p1-4). | ||
2281 | |||
2282 | * Remove duplicated phrase in ssh_config(5) (closes: #152404). | ||
2283 | * Source the debconf confmodule at the top of the postrm rather than at | ||
2284 | the bottom, to avoid making future non-idempotency problems worse (see | ||
2285 | #151035). | ||
2286 | * Debconf templates: | ||
2287 | - Add Polish (thanks, Grzegorz Kusnierz). | ||
2288 | - Update French (thanks, Denis Barbier; closes: #132509). | ||
2289 | - Update Spanish (thanks, Carlos Valdivia Yagüe; closes: #164716). | ||
2290 | * Write a man page for gnome-ssh-askpass, and link it to ssh-askpass.1 if | ||
2291 | this is the selected ssh-askpass alternative (closes: #67775). | ||
2292 | |||
2293 | -- Colin Watson <cjwatson@debian.org> Sat, 26 Oct 2002 19:41:51 +0100 | ||
2294 | |||
2295 | openssh (1:3.4p1-4) unstable; urgency=low | ||
2296 | |||
2297 | * Allow ssh-krb5 in ssh-askpass-gnome's dependencies (closes: #129532). | ||
2298 | * Restore Russia to list of countries where encryption is problematic (see | ||
2299 | #148951 and http://www.average.org/freecrypto/). | ||
2300 | * Drop ssh-askpass-gnome's priority to optional, per the override file. | ||
2301 | * Drop the PAM special case for hurd-i386 (closes: #99157). | ||
2302 | * s/dile/idle/ in ssh_config(5) (closes: #118331). | ||
2303 | * Note in README.Debian that you need xauth from xbase-clients on the | ||
2304 | server for X11 forwarding (closes: #140269). | ||
2305 | * Use correct path to upstream README in copyright file (closes: #146037). | ||
2306 | * Document the units for ProtocolKeepAlives (closes: #159479). | ||
2307 | * Backport upstream patch to fix hostbased auth (closes: #117114). | ||
2308 | * Add -g to CFLAGS. | ||
2309 | |||
2310 | -- Colin Watson <cjwatson@debian.org> Sun, 13 Oct 2002 18:58:53 +0100 | ||
2311 | |||
2312 | openssh (1:3.4p1-3) unstable; urgency=low | ||
2313 | |||
2314 | * Add myself to Uploaders: and begin acting as temporary maintainer, at | ||
2315 | Matthew's request. (Normal service will resume in some months' time.) | ||
2316 | * Add sharutils to Build-Depends (closes: #138465). | ||
2317 | * Stop creating the /usr/doc/ssh symlink. | ||
2318 | |||
2319 | * Fix some debconf template typos (closes: #160358). | ||
2320 | * Split debconf templates into one file per language. | ||
2321 | * Add debconf template translations: | ||
2322 | - Brazilian Portuguese (thanks, Andre Luis Lopes; closes: #106173). | ||
2323 | - Danish (thanks, Claus Hindsgaul; closes: #126607). | ||
2324 | - Japanese (thanks, Tomohiro KUBOTA; closes: #137427). | ||
2325 | - Russian (thanks, Ilgiz Kalmetev; closes: #136610). | ||
2326 | - Spanish (thanks, Carlos Valdivia Yagüe; closes: #129041). | ||
2327 | * Update debconf template translations: | ||
2328 | - French (thanks, Igor Genibel; closes: #151361). | ||
2329 | - German (thanks, Axel Noetzold; closes: #147069). | ||
2330 | * Some of these translations are fuzzy. Please send updates. | ||
2331 | |||
2332 | -- Colin Watson <cjwatson@debian.org> Sun, 13 Oct 2002 14:09:57 +0100 | ||
2333 | |||
2334 | openssh (1:3.4p1-2) unstable; urgency=high | ||
2335 | |||
2336 | * Get a security-fixed version into unstable | ||
2337 | * Also tidy README.Debian up a little | ||
2338 | |||
2339 | -- Matthew Vernon <matthew@debian.org> Fri, 28 Jun 2002 17:20:59 +0100 | ||
2340 | |||
2341 | openssh (1:3.4p1-1) testing; urgency=high | ||
2342 | |||
2343 | * Extend my tendrils back into this package (Closes: #150915, #151098) | ||
2344 | * thanks to the security team for their work | ||
2345 | * no thanks to ISS/Theo de Raadt for their handling of these bugs | ||
2346 | * save old sshd_configs to sshd_config.dpkg-old when auto-generating a | ||
2347 | new one | ||
2348 | * tell/ask the user about PriviledgeSeparation | ||
2349 | * /etc/init.d/ssh run will now create the chroot empty dir if necessary | ||
2350 | * Remove our previous statoverride on /usr/bin/ssh (only for people | ||
2351 | upgrading from a version where we'd put one in ourselves!) | ||
2352 | * Stop slandering Russia, since someone asked so nicely (Closes: #148951) | ||
2353 | * Reduce the sleep time in /etc/init.d/ssh during a restart | ||
2354 | |||
2355 | -- Matthew Vernon <matthew@debian.org> Fri, 28 Jun 2002 15:52:10 +0100 | ||
2356 | |||
2357 | openssh (1:3.4p1-0.0woody1) testing-security; urgency=high | ||
2358 | |||
2359 | * NMU by the security team. | ||
2360 | * New upstream version | ||
2361 | |||
2362 | -- Michael Stone <mstone@debian.org> Wed, 26 Jun 2002 15:40:38 -0400 | ||
2363 | |||
2364 | openssh (1:3.3p1-0.0woody4) testing-security; urgency=high | ||
2365 | |||
2366 | * NMU by the security team. | ||
2367 | * fix error when /etc/ssh/sshd_config exists on new install | ||
2368 | * check that user doesn't exist before running adduser | ||
2369 | * use openssl internal random unconditionally | ||
2370 | |||
2371 | -- Michael Stone <mstone@debian.org> Tue, 25 Jun 2002 19:44:39 -0400 | ||
2372 | |||
2373 | openssh (1:3.3p1-0.0woody3) testing-security; urgency=high | ||
2374 | |||
2375 | * NMU by the security team. | ||
2376 | * use correct home directory when sshd user is created | ||
2377 | |||
2378 | -- Michael Stone <mstone@debian.org> Tue, 25 Jun 2002 08:59:50 -0400 | ||
2379 | |||
2380 | openssh (1:3.3p1-0.0woody2) testing-security; urgency=high | ||
2381 | |||
2382 | * NMU by the security team. | ||
2383 | * Fix rsa1 key creation (Closes: #150949) | ||
2384 | * don't fail if sshd user removal fails | ||
2385 | * depends: on adduser (Closes: #150907) | ||
2386 | |||
2387 | -- Michael Stone <mstone@debian.org> Tue, 25 Jun 2002 08:59:50 -0400 | ||
2388 | |||
2389 | openssh (1:3.3p1-0.0woody1) testing-security; urgency=high | ||
2390 | |||
2391 | * NMU by the security team. | ||
2392 | * New upstream version. | ||
2393 | - Enable privilege separation by default. | ||
2394 | * Include patch from Solar Designer for privilege separation and | ||
2395 | compression on 2.2.x kernels. | ||
2396 | * Remove --disable-suid-ssh from configure. | ||
2397 | * Support setuid ssh-keysign binary instead of setuid ssh client. | ||
2398 | * Check sshd configuration before restarting. | ||
2399 | |||
2400 | -- Daniel Jacobowitz <dan@debian.org> Mon, 24 Jun 2002 13:43:44 -0400 | ||
2401 | |||
2402 | openssh (1:3.0.2p1-9) unstable; urgency=high | ||
2403 | |||
2404 | * Thanks to those who NMUd | ||
2405 | * The only change in this version is to debian/control - I've removed | ||
2406 | the bit that says you can't export it from the US - it would look | ||
2407 | pretty daft to say this about a package in main! Also, it's now OK | ||
2408 | to use crypto in France, so I've edited that comment slightly | ||
2409 | * Correct a path in README.Debian too (Closes: #138634) | ||
2410 | |||
2411 | -- Matthew Vernon <matthew@debian.org> Sun, 4 Apr 2002 09:52:59 +0100 | ||
2412 | |||
2413 | openssh (1:3.0.2p1-8.3) unstable; urgency=medium | ||
2414 | |||
2415 | * NMU | ||
2416 | * Really set urgency to medium this time (oops) | ||
2417 | * Fix priority to standard per override while I'm at it | ||
2418 | |||
2419 | -- Aaron M. Ucko <ucko@debian.org> Sun, 24 Mar 2002 09:00:08 -0500 | ||
2420 | |||
2421 | openssh (1:3.0.2p1-8.2) unstable; urgency=low | ||
2422 | |||
2423 | * NMU with maintainer's permission | ||
2424 | * Prepare for upcoming ssh-nonfree transitional packages per | ||
2425 | <http://lists.debian.org/debian-ssh/2002/debian-ssh-200203/msg00008.html> | ||
2426 | * Urgency medium because it would really be good to get this into woody | ||
2427 | before it releases | ||
2428 | * Fix sections to match override file | ||
2429 | * Reissued due to clash with non-US -> main move | ||
2430 | |||
2431 | -- Aaron M. Ucko <ucko@debian.org> Sat, 23 Mar 2002 21:21:52 -0500 | ||
2432 | |||
2433 | openssh (1:3.0.2p1-8.1) unstable; urgency=low | ||
2434 | |||
2435 | * NMU | ||
2436 | * Move from non-US to mani | ||
2437 | |||
2438 | -- LaMont Jones <lamont@debian.org> Thu, 21 Mar 2002 09:33:50 -0700 | ||
2439 | |||
2440 | openssh (1:3.0.2p1-8) unstable; urgency=critical | ||
2441 | |||
2442 | * Security fix - patch from upstream (Closes: #137209, #137210) | ||
2443 | * Undo the changes in the unreleased -7, since they appear to break | ||
2444 | things here. Accordingly, the code change is minimal, and I'm | ||
2445 | happy to get it into testing ASAP | ||
2446 | |||
2447 | -- Matthew Vernon <matthew@debian.org> Thu, 7 Mar 2002 14:25:23 +0000 | ||
2448 | |||
2449 | openssh (1:3.0.2p1-7) unstable; urgency=high | ||
2450 | |||
2451 | * Build to support IPv6 and IPv4 by default again | ||
2452 | |||
2453 | -- Matthew Vernon <matthew@debian.org> Sat, 2 Mar 2002 00:25:05 +0000 | ||
2454 | |||
2455 | openssh (1:3.0.2p1-6) unstable; urgency=high | ||
2456 | |||
2457 | * Correct error in the clean target (Closes: #130868) | ||
2458 | |||
2459 | -- Matthew Vernon <matthew@debian.org> Sat, 26 Jan 2002 00:32:00 +0000 | ||
2460 | |||
2461 | openssh (1:3.0.2p1-5) unstable; urgency=medium | ||
2462 | |||
2463 | * Include the Debian version in our identification, to make it easier to | ||
2464 | audit networks for patched versions in future | ||
2465 | |||
2466 | -- Matthew Vernon <matthew@debian.org> Mon, 21 Jan 2002 17:16:10 +0000 | ||
2467 | |||
2468 | openssh (1:3.0.2p1-4) unstable; urgency=medium | ||
2469 | |||
2470 | * If we're asked to not run sshd, stop any running sshd's first | ||
2471 | (Closes: #129327) | ||
2472 | |||
2473 | -- Matthew Vernon <matthew@debian.org> Wed, 16 Jan 2002 21:24:16 +0000 | ||
2474 | |||
2475 | openssh (1:3.0.2p1-3) unstable; urgency=high | ||
2476 | |||
2477 | * Fix /etc/pam.d/ssh to not set $MAIL (Closes: #128913) | ||
2478 | * Remove extra debconf suggestion (Closes: #128094) | ||
2479 | * Mmm. speedy bug-fixing :-) | ||
2480 | |||
2481 | -- Matthew Vernon <matthew@debian.org> Sat, 12 Jan 2002 17:23:58 +0000 | ||
2482 | |||
2483 | openssh (1:3.0.2p1-2) unstable; urgency=high | ||
2484 | |||
2485 | * Fix postinst to not automatically overwrite sshd_config (!) | ||
2486 | (Closes: #127842, #127867) | ||
2487 | * Add section in README.Debian about the PermitRootLogin setting | ||
2488 | |||
2489 | -- Matthew Vernon <matthew@debian.org> Sat, 5 Jan 2003 05:26:30 +0000 | ||
2490 | |||
2491 | openssh (1:3.0.2p1-1) unstable; urgency=high | ||
2492 | |||
2493 | * Incorporate fix from Colin's NMU | ||
2494 | * New upstream version (fixes the bug Wichert fixed) (Closes: #124035) | ||
2495 | * Capitalise IETF (Closes: #125379) | ||
2496 | * Refer to the correct sftp-server location (Closes: #126854, #126224) | ||
2497 | * Do what we're asked re SetUID ssh (Closes: #124065, #124154, #123247) | ||
2498 | * Ask people upgrading from potato if they want a new conffile | ||
2499 | (Closes: #125642) | ||
2500 | * Fix a typo in postinst (Closes: #122192, #122410, #123440) | ||
2501 | * Frob the default config a little (Closes: #122284, #125827, #125696, | ||
2502 | #123854) | ||
2503 | * Make /etc/init.d/ssh be more clear about ssh not running (Closes: | ||
2504 | #123552) | ||
2505 | * Fix typo in templates file (Closes: #123411) | ||
2506 | |||
2507 | -- Matthew Vernon <matthew@debian.org> Fri, 4 Jan 2002 16:01:52 +0000 | ||
2508 | |||
2509 | openssh (1:3.0.1p1-1.2) unstable; urgency=high | ||
2510 | |||
2511 | * Non-maintainer upload | ||
2512 | * Prevent local users from passing environment variables to the login | ||
2513 | process when UseLogin is enabled | ||
2514 | |||
2515 | -- Wichert Akkerman <wakkerma@debian.org> Mon, 3 Dec 2001 19:34:45 +0100 | ||
2516 | |||
2517 | openssh (1:3.0.1p1-1.1) unstable; urgency=low | ||
2518 | |||
2519 | * Non-maintainer upload, at Matthew's request. | ||
2520 | * Remove sa_restorer assignment to fix compilation on alpha, hppa, and | ||
2521 | ia64 (closes: #122086). | ||
2522 | |||
2523 | -- Colin Watson <cjwatson@debian.org> Sun, 2 Dec 2001 18:54:16 +0000 | ||
2524 | |||
2525 | openssh (1:3.0.1p1-1) unstable; urgency=high | ||
2526 | |||
2527 | * New upstream version (Closes: #113646, #113513, #114707, #118564) | ||
2528 | * Building with a libc that works (!) (Closes: #115228) | ||
2529 | * Patches forward-ported are -1/-2 options for scp, the improvement to | ||
2530 | 'waiting for forwarded connections to terminate...' | ||
2531 | * Fix /etc/init.d/ssh to stop sshd properly (Closes: #115228) | ||
2532 | * /etc/ssh/sshd_config is no longer a conffile but generated in the postinst | ||
2533 | * Remove suidregister leftover from postrm | ||
2534 | * Mention key we are making in the postinst | ||
2535 | * Default to not enable SSH protocol 1 support, since protocol 2 is | ||
2536 | much safer anyway. | ||
2537 | * New version of the vpn-fixes patch, from Ian Jackson | ||
2538 | * New handling of -q, and added new -qq option; thanks to Jon Amery | ||
2539 | * Experimental smartcard support not enabled, since I have no way of | ||
2540 | testing it. | ||
2541 | |||
2542 | -- Matthew Vernon <matthew@debian.org> Thu, 28 Nov 2001 17:43:01 +0000 | ||
2543 | |||
2544 | openssh (1:2.9p2-6) unstable; urgency=low | ||
2545 | |||
2546 | * check for correct file in /etc/init.d/ssh (Closes: #110876) | ||
2547 | * correct location of version 2 keys in ssh.1 (Closes: #110439) | ||
2548 | * call update-alternatives --quiet (Closes: #103314) | ||
2549 | * hack ssh-copy-id to chmod go-w (Closes: #95551) | ||
2550 | * TEMPORARY fix to provide largefile support using a -D in the cflags | ||
2551 | line. long-term, upstream will patch the autoconf stuff | ||
2552 | (Closes: #106809, #111849) | ||
2553 | * remove /etc/rc references in ssh-keygen.1 (Closes: #68350) | ||
2554 | * scp.1 patch from Adam McKenna to document -r properly (Closes: #76054) | ||
2555 | * Check for files containing a newline character (Closes: #111692) | ||
2556 | |||
2557 | -- Matthew Vernon <matthew@debian.org> Thu, 13 Sep 2001 16:47:36 +0100 | ||
2558 | |||
2559 | openssh (1:2.9p2-5) unstable; urgency=high | ||
2560 | |||
2561 | * Thanks to all the bug-fixers who helped! | ||
2562 | * remove sa_restorer assignment (Closes: #102837) | ||
2563 | * patch from Peter Benie to DTRT wrt X forwarding if the server refuses | ||
2564 | us access (Closes: #48297) | ||
2565 | * patch from upstream CVS to fix port forwarding (Closes: #107132) | ||
2566 | * patch from Jonathan Amery to document ssh-keygen behaviour | ||
2567 | (Closes:#106643, #107512) | ||
2568 | * patch to postinst from Jonathan Amery (Closes: #106411) | ||
2569 | * patch to manpage from Jonathan Amery (Closes: #107364) | ||
2570 | * patch from Matthew Vernon to make -q emit fatal errors as that is the | ||
2571 | documented behaviour (Closes: #64347) | ||
2572 | * patch from Ian Jackson to cause us to destroy a file when we scp it | ||
2573 | onto itself, rather than dumping bits of our memory into it, which was | ||
2574 | a security hole (see #51955) | ||
2575 | * patch from Jonathan Amery to document lack of Kerberos support | ||
2576 | (Closes: #103726) | ||
2577 | * patch from Matthew Vernon to make the 'waiting for connections to | ||
2578 | terminate' message more helpful (Closes: #50308) | ||
2579 | |||
2580 | -- Matthew Vernon <matthew@debian.org> Thu, 23 Aug 2001 02:14:09 +0100 | ||
2581 | |||
2582 | openssh (1:2.9p2-4) unstable; urgency=high | ||
2583 | |||
2584 | * Today's build of ssh is strawberry flavoured | ||
2585 | * Patch from mhp to reduce length of time sshd is stopped for (Closes: #106176) | ||
2586 | * Tidy up debconf template (Closes: #106152) | ||
2587 | * If called non-setuid, then setgid()'s failure should not be fatal (see | ||
2588 | #105854) | ||
2589 | |||
2590 | -- Matthew Vernon <matthew@debian.org> Sun, 22 Jul 2001 14:19:43 +0100 | ||
2591 | |||
2592 | openssh (1:2.9p2-3) unstable; urgency=low | ||
2593 | |||
2594 | * Patch from yours truly to add -1 and -2 options to scp (Closes: #106061) | ||
2595 | * Improve the IdentityFile section in the man page (Closes: #106038) | ||
2596 | |||
2597 | -- Matthew Vernon <matthew@debian.org> Sat, 21 Jul 2001 14:47:27 +0100 | ||
2598 | |||
2599 | openssh (1:2.9p2-2) unstable; urgency=low | ||
2600 | |||
2601 | * Document the protocol version 2 and IPV6 changes (Closes: #105845, #105868) | ||
2602 | * Make PrintLastLog 'no' by default (Closes: #105893) | ||
2603 | |||
2604 | -- Matthew Vernon <matthew@debian.org> Thu, 19 Jul 2001 18:36:41 +0100 | ||
2605 | |||
2606 | openssh (1:2.9p2-1) unstable; urgency=low | ||
2607 | |||
2608 | * new (several..) upstream version (Closes: #96726, #81856, #96335) | ||
2609 | * Hopefully, this will close some other bugs too | ||
2610 | |||
2611 | -- Matthew Vernon <matthew@debian.org> Tue, 17 Jul 2001 19:41:58 +0100 | ||
2612 | |||
2613 | openssh (1:2.5.2p2-3) unstable; urgency=low | ||
2614 | |||
2615 | * Taking Over this package | ||
2616 | * Patches from Robert Bihlmeyer for the Hurd (Closes: #102991) | ||
2617 | * Put PermitRootLogin back to yes (Closes: #67334, #67371, #78274) | ||
2618 | * Don't fiddle with conf-files any more (Closes: #69501) | ||
2619 | |||
2620 | -- Matthew Vernon <matthew@debian.org> Tue, 03 Jul 2001 02:58:13 +0100 | ||
2621 | |||
2622 | openssh (1:2.5.2p2-2.2) unstable; urgency=low | ||
2623 | |||
2624 | * NMU | ||
2625 | * Include Hurd compatibility patches from Robert Bihlmeyer (Closes: #76033) | ||
2626 | * Patch from Richard Kettlewell for protocolkeepalives (Closes: #99273) | ||
2627 | * Patch from Matthew Vernon for BannerTimeOut, batchmode, and | ||
2628 | documentation for protocolkeepalives. Makes ssh more generally useful | ||
2629 | for scripting uses (Closes: #82877, #99275) | ||
2630 | * Set a umask, so ourpidfile isn't world-writable (closes: #100012, | ||
2631 | #98286, #97391) | ||
2632 | |||
2633 | -- Matthew Vernon <matthew@debian.org> Thu, 28 Jun 2001 23:15:42 +0100 | ||
2634 | |||
2635 | openssh (1:2.5.2p2-2.1) unstable; urgency=low | ||
2636 | |||
2637 | * NMU | ||
2638 | * Remove duplicate Build-Depends for libssl096-dev and change it to | ||
2639 | depend on libssl-dev instaed. Also adding in virtual | real package | ||
2640 | style build-deps. (Closes: #93793, #75228) | ||
2641 | * Removing add-log entry (Closes: #79266) | ||
2642 | * This was a pam bug from a while back (Closes: #86908, #88457, #86843) | ||
2643 | * pam build-dep already exists (Closes: #93683) | ||
2644 | * libgnome-dev build-dep already exists (Closes: #93694) | ||
2645 | * No longer in non-free (Closes: #85401) | ||
2646 | * Adding in fr debconf translations (Closes: #83783) | ||
2647 | * Already suggests xbase-clients (Closes: #79741) | ||
2648 | * No need to suggest libpam-pwdb anymore (Closes: #81658) | ||
2649 | * Providing rsh-client (Closes: #79437) | ||
2650 | * hurd patch was already applied (Closes: #76033) | ||
2651 | * default set to no (Closes: #73682) | ||
2652 | * Adding in a suggests for dnsutils (Closes: #93265) | ||
2653 | * postinst bugs fixed (Closes: #88057, #88066, #88196, #88405, #88612) | ||
2654 | (Closes: #88774, #88196, #89556, #90123, #90228, #90833, #87814, #85465) | ||
2655 | * Adding in debconf dependency | ||
2656 | |||
2657 | -- Ivan E. Moore II <rkrusty@debian.org> Mon, 16 Apr 2001 14:11:04 +0100 | ||
2658 | |||
2659 | openssh (1:2.5.2p2-2) unstable; urgency=high | ||
2660 | |||
2661 | * disable the OpenSSL version check in entropy.c | ||
2662 | (closes: #93581, #93588, #93590, #93614, #93619, #93635, #93648) | ||
2663 | |||
2664 | -- Philip Hands <phil@uk.alcove.com> Wed, 11 Apr 2001 20:30:04 +0100 | ||
2665 | |||
2666 | openssh (1:2.5.2p2-1) unstable; urgency=low | ||
2667 | |||
2668 | * New upstream release | ||
2669 | * removed make-ssh-known-hosts, since ssh-keyscan does that job (closes: #86069, #87748) | ||
2670 | * fix double space indent in german templates (closes: #89493) | ||
2671 | * make postinst check for ssh_host_rsa_key | ||
2672 | * get rid of the last of the misguided debian/rules NMU debris :-/ | ||
2673 | |||
2674 | -- Philip Hands <phil@hands.com> Sat, 24 Mar 2001 20:59:33 +0000 | ||
2675 | |||
2676 | openssh (1:2.5.1p2-2) unstable; urgency=low | ||
2677 | |||
2678 | * rebuild with new debhelper (closes: #89558, #89536, #90225) | ||
2679 | * fix broken dpkg-statoverride test in postinst | ||
2680 | (closes: #89612, #90474, #90460, #89605) | ||
2681 | * NMU bug fixed but not closed in last upload (closes: #88206) | ||
2682 | |||
2683 | -- Philip Hands <phil@hands.com> Fri, 23 Mar 2001 16:11:33 +0000 | ||
2684 | |||
2685 | openssh (1:2.5.1p2-1) unstable; urgency=high | ||
2686 | |||
2687 | * New upstream release | ||
2688 | * fix typo in postinst (closes: #88110) | ||
2689 | * revert to setting PAM service name in debian/rules, backing out last | ||
2690 | NMU, which also (closes: #88101) | ||
2691 | * restore the pam lastlog/motd lines, lost during the NMUs, and sshd_config | ||
2692 | * restore printlastlog option patch | ||
2693 | * revert to using debhelper, which had been partially disabled in NMUs | ||
2694 | |||
2695 | -- Philip Hands <phil@hands.com> Tue, 13 Mar 2001 01:41:34 +0000 | ||
2696 | |||
2697 | openssh (1:2.5.1p1-1.8) unstable; urgency=high | ||
2698 | |||
2699 | * And now the old pam-bug s/sshd/ssh in ssh.c is also fixed | ||
2700 | |||
2701 | -- Christian Kurz <shorty@debian.org> Thu, 1 Mar 2001 19:48:01 +0100 | ||
2702 | |||
2703 | openssh (1:2.5.1p1-1.7) unstable; urgency=high | ||
2704 | |||
2705 | * And now we mark the correct binary as setuid, when a user requested | ||
2706 | to install it setuid. | ||
2707 | |||
2708 | -- Christian Kurz <shorty@debian.org> Thu, 1 Mar 2001 07:19:56 +0100 | ||
2709 | |||
2710 | openssh (1:2.5.1p1-1.6) unstable; urgency=high | ||
2711 | |||
2712 | * Fixes postinst to handle overrides that are already there. Damn, I | ||
2713 | should have noticed the bug earlier. | ||
2714 | |||
2715 | -- Christian Kurz <shorty@debian.org> Wed, 28 Feb 2001 22:35:00 +0100 | ||
2716 | |||
2717 | openssh (1:2.5.1p1-1.5) unstable; urgency=high | ||
2718 | |||
2719 | * Rebuild ssh with pam-support. | ||
2720 | |||
2721 | -- Christian Kurz <shorty@debian.org> Mon, 26 Feb 2001 21:55:51 +0100 | ||
2722 | |||
2723 | openssh (1:2.5.1p1-1.4) unstable; urgency=low | ||
2724 | |||
2725 | * Added Build-Depends on libssl096-dev. | ||
2726 | * Fixed sshd_config file to disallow root logins again. | ||
2727 | |||
2728 | -- Christian Kurz <shorty@debian.org> Sun, 25 Feb 2001 20:03:55 +0100 | ||
2729 | |||
2730 | openssh (1:2.5.1p1-1.3) unstable; urgency=low | ||
2731 | |||
2732 | * Fixed missing manpages for sftp.1 and ssh-keyscan.1 | ||
2733 | * Made package policy 3.5.2 compliant. | ||
2734 | |||
2735 | -- Christian Kurz <shorty@debian.org> Sun, 25 Feb 2001 15:46:26 +0100 | ||
2736 | |||
2737 | openssh (1:2.5.1p1-1.2) unstable; urgency=low | ||
2738 | |||
2739 | * Added Conflict with sftp, since we now provide our own sftp-client. | ||
2740 | * Added a fix for our broken dpkg-statoverride call in the | ||
2741 | 2.3.0p1-13. | ||
2742 | * Fixed some config pathes in the comments of sshd_config. | ||
2743 | * Removed ssh-key-exchange-vulnerability-patch since it's not needed | ||
2744 | anymore because upstream included the fix. | ||
2745 | |||
2746 | -- Christian Kurz <shorty@debian.org> Sun, 25 Feb 2001 13:46:58 +0100 | ||
2747 | |||
2748 | openssh (1:2.5.1p1-1.1) unstable; urgency=high | ||
2749 | |||
2750 | * Another NMU to get the new upstream version 2.5.1p1 into | ||
2751 | unstable. (Closes: #87123) | ||
2752 | * Corrected postinst to mark ssh as setuid. (Closes: #86391, #85766) | ||
2753 | * Key Exchange patch is already included by upstream. (Closes: #86015) | ||
2754 | * Upgrading should be possible now. (Closes: #85525, #85523) | ||
2755 | * Added --disable-suid-ssh as compile option, so ssh won't get installed | ||
2756 | suid per default. | ||
2757 | * Fixed postinst to run dpkg-statoverride only, when dpkg-statoverride | ||
2758 | is available and the mode of the binary should be 4755. And also added | ||
2759 | suggestion for a newer dpkg. | ||
2760 | (Closes: #85734, #85741, #86876) | ||
2761 | * sftp and ssh-keyscan will also be included from now on. (Closes: #79994) | ||
2762 | * scp now understands spaces in filenames (Closes: #53783, #58958, | ||
2763 | #66723) | ||
2764 | * ssh-keygen now supports showing DSA fingerprints. (Closes: #68623) | ||
2765 | * ssh doesn' t show motd anymore when switch -t is used. (Closes #69035) | ||
2766 | * ssh supports the usage of other dsa keys via the ssh command line | ||
2767 | options. (Closes: #81250) | ||
2768 | * Documentation in sshd_config fixed. (Closes: #81088) | ||
2769 | * primes file included by upstream and included now. (Closes: #82101) | ||
2770 | * scp now allows dots in the username. (Closes: #82477) | ||
2771 | * Spelling error in ssh-copy-id.1 corrected by upstream. (Closes: #78124) | ||
2772 | |||
2773 | -- Christian Kurz <shorty@debian.org> Sun, 25 Feb 2001 10:06:08 +0100 | ||
2774 | |||
2775 | openssh (1:2.3.0p1-1.13) unstable; urgency=low | ||
2776 | |||
2777 | * Config should now also be fixed with this hopefully last NMU. | ||
2778 | |||
2779 | -- Christian Kurz <shorty@debian.org> Sat, 10 Feb 2001 22:56:36 +0100 | ||
2780 | |||
2781 | openssh (1:2.3.0p1-1.12) unstable; urgency=high | ||
2782 | |||
2783 | * Added suggest for xbase-clients to control-file. (Closes #85227) | ||
2784 | * Applied patch from Markus Friedl to fix a vulnerability in | ||
2785 | the rsa keyexchange. | ||
2786 | * Fixed position of horizontal line. (Closes: #83613) | ||
2787 | * Fixed hopefully the grep problem in the config-file. (Closes: #78802) | ||
2788 | * Converted package from suidregister to dpkg-statoverride. | ||
2789 | |||
2790 | -- Christian Kurz <shorty@debian.org> Fri, 9 Feb 2001 19:43:55 +0100 | ||
2791 | |||
2792 | openssh (1:2.3.0p1-1.11) unstable; urgency=medium | ||
2793 | |||
2794 | * Fixed some typos in the german translation of the debconf | ||
2795 | template. | ||
2796 | |||
2797 | -- Christian Kurz <shorty@debian.org> Wed, 24 Jan 2001 18:22:38 +0100 | ||
2798 | |||
2799 | openssh (1:2.3.0p1-1.10) unstable; urgency=medium | ||
2800 | |||
2801 | * Fixed double printing of motd. (Closes: #82618) | ||
2802 | |||
2803 | -- Christian Kurz <shorty@debian.org> Tue, 23 Jan 2001 21:03:43 +0100 | ||
2804 | |||
2805 | openssh (1:2.3.0p1-1.9) unstable; urgency=high | ||
2806 | |||
2807 | * And the next NMU which includes the patch from Andrew Bartlett | ||
2808 | and Markus Friedl to fix the root privileges handling of openssh. | ||
2809 | (Closes: #82657) | ||
2810 | |||
2811 | -- Christian Kurz <shorty@debian.org> Wed, 17 Jan 2001 22:20:54 +0100 | ||
2812 | |||
2813 | openssh (1:2.3.0p1-1.8) unstable; urgency=high | ||
2814 | |||
2815 | * Applied fix from Ryan Murray to allow building on other architectures | ||
2816 | since the hurd patch was wrong. (Closes: #82471) | ||
2817 | |||
2818 | -- Christian Kurz <shorty@debian.org> Tue, 16 Jan 2001 22:45:51 +0100 | ||
2819 | |||
2820 | openssh (1:2.3.0p1-1.7) unstable; urgency=medium | ||
2821 | |||
2822 | * Fixed another typo on sshd_config | ||
2823 | |||
2824 | -- Christian Kurz <shorty@debian.org> Sun, 14 Jan 2001 19:01:31 +0100 | ||
2825 | |||
2826 | openssh (1:2.3.0p1-1.6) unstable; urgency=high | ||
2827 | |||
2828 | * Added Build-Dependency on groff (Closes: #81886) | ||
2829 | * Added Build-Depencency on debhelper (Closes: #82072) | ||
2830 | * Fixed entry for known_hosts in sshd_config (Closes: #82096) | ||
2831 | |||
2832 | -- Christian Kurz <shorty@debian.org> Thu, 11 Jan 2001 23:08:16 +0100 | ||
2833 | |||
2834 | openssh (1:2.3.0p1-1.5) unstable; urgency=high | ||
2835 | |||
2836 | * Fixed now also the problem with sshd used as default ipv4 and | ||
2837 | didn't use IPv6. This should be now fixed. | ||
2838 | |||
2839 | -- Christian Kurz <shorty@debian.org> Thu, 11 Jan 2001 21:25:55 +0100 | ||
2840 | |||
2841 | openssh (1:2.3.0p1-1.4) unstable; urgency=high | ||
2842 | |||
2843 | * Fixed buggy entry in postinst. | ||
2844 | |||
2845 | -- Christian Kurz <shorty@debian.org> Wed, 10 Jan 2001 23:12:16 +0100 | ||
2846 | |||
2847 | openssh (1:2.3.0p1-1.3) unstable; urgency=high | ||
2848 | |||
2849 | * After finishing the rewrite of the rules-file I had to notice that | ||
2850 | the manpage installation was broken. This should now work again. | ||
2851 | |||
2852 | -- Christian Kurz <shorty@debian.org> Wed, 10 Jan 2001 22:11:59 +0100 | ||
2853 | |||
2854 | openssh (1:2.3.0p1-1.2) unstable; urgency=high | ||
2855 | |||
2856 | * Fixed the screwed up build-dependency. | ||
2857 | * Removed --with-ipv4-default to support ipv6. | ||
2858 | * Changed makefile to use /etc/pam.d/ssh instead of /etc/pam.d/sshd. | ||
2859 | * Fixed location to sftp-server in config. | ||
2860 | * Since debian still relies on /etc/pam.d/ssh instead of moving to | ||
2861 | /etc/pam.d/sshd, I had to hack ssh.h to get ssh to use this name. | ||
2862 | * Fixed path to host key in sshd_config. | ||
2863 | |||
2864 | -- Christian Kurz <shorty@debian.org> Wed, 10 Jan 2001 08:23:47 +0100 | ||
2865 | |||
2866 | openssh (1:2.3.0p1-1.1) unstable; urgency=medium | ||
2867 | |||
2868 | * NMU with permission of Phil Hands. | ||
2869 | * New upstream release | ||
2870 | * Update Build-Depends to point to new libssl096. | ||
2871 | * This upstream release doesn't leak any information depending | ||
2872 | on the setting of PermitRootLogin (Closes: #59933) | ||
2873 | * New upstream release contains fix against forcing a client to | ||
2874 | do X/agent forwarding (Closes: #76788) | ||
2875 | * Changed template to contain correct path to the documentation | ||
2876 | (Closes: #67245) | ||
2877 | * Added --with-4in6 switch as compile option into debian/rules. | ||
2878 | * Added --with-ipv4-default as compile option into debian/rules. | ||
2879 | (Closes: #75037) | ||
2880 | * Changed default path to also contain /usr/local/bin and | ||
2881 | /usr/X11R6/bin (Closes: #62472,#54567,#62810) | ||
2882 | * Changed path to sftp-server in sshd_config to match the | ||
2883 | our package (Closes: #68347) | ||
2884 | * Replaced OpenBSDh with OpenBSD in the init-script. | ||
2885 | * Changed location to original source in copyright.head | ||
2886 | * Changed behaviour of init-script when invoked with the option | ||
2887 | restart (Closes: #68706,#72560) | ||
2888 | * Added a note about -L option of scp to README.Debian | ||
2889 | * ssh won't print now the motd if invoked with -t option | ||
2890 | (Closes: #59933) | ||
2891 | * RFC.nroff.gz get's now converted into RFC.gz. (Closes: #63867) | ||
2892 | * Added a note about tcp-wrapper support to README.Debian | ||
2893 | (Closes: #72807,#22190) | ||
2894 | * Removed two unneeded options from building process. | ||
2895 | * Added sshd.pam into debian dir and install it. | ||
2896 | * Commented out unnecessary call to dh_installinfo. | ||
2897 | * Added a line to sshd.pam so that limits will be paid attention | ||
2898 | to (Closes: #66904) | ||
2899 | * Restart Option has a Timeout of 10 seconds (Closes: 51264) | ||
2900 | * scp won't override files anymore (Closes: 51955) | ||
2901 | * Removed pam_lastlog module, so that the lastlog is now printed | ||
2902 | only once (Closes: #71742, #68335, #69592, #71495, #77781) | ||
2903 | * If password is expired, openssh now forces the user to change it. | ||
2904 | (Closes: #51747) | ||
2905 | * scp should now have no more problems with shell-init-files that | ||
2906 | produces ouput (Closes: #56280,#59873) | ||
2907 | * ssh now prints the motd correctly (Closes: #66926) | ||
2908 | * ssh upgrade should disable ssh daemon only if users has choosen | ||
2909 | to do so (Closes: #67478) | ||
2910 | * ssh can now be installed suid (Closes: #70879) | ||
2911 | * Modified debian/rules to support hurd. | ||
2912 | |||
2913 | -- Christian Kurz <shorty@debian.org> Wed, 27 Dec 2000 20:06:57 +0100 | ||
2914 | |||
2915 | openssh (1:2.2.0p1-1.1) unstable; urgency=medium | ||
2916 | |||
2917 | * Non-Maintainer Upload | ||
2918 | * Check for new returns in the new libc | ||
2919 | (closes: #72803, #74393, #72797, #71307, #71702) | ||
2920 | * Link against libssl095a (closes: #66304) | ||
2921 | * Correct check for PermitRootLogin (closes: #69448) | ||
2922 | |||
2923 | -- Ryan Murray <rmurray@debian.org> Wed, 18 Oct 2000 00:48:18 -0700 | ||
2924 | |||
2925 | openssh (1:2.2.0p1-1) unstable; urgency=low | ||
2926 | |||
2927 | * New upstream release | ||
2928 | |||
2929 | -- Philip Hands <phil@hands.com> Mon, 11 Sep 2000 14:49:43 +0100 | ||
2930 | |||
2931 | openssh (1:2.1.1p4-3) unstable; urgency=low | ||
2932 | |||
2933 | * add rsh alternatives | ||
2934 | * add -S option to scp (using Tommi Virtanen's patch) (closes: #63097) | ||
2935 | * do the IPV4_DEFAULT thing properly this time | ||
2936 | |||
2937 | -- Philip Hands <phil@hands.com> Fri, 11 Aug 2000 18:14:37 +0100 | ||
2938 | |||
2939 | openssh (1:2.1.1p4-2) unstable; urgency=low | ||
2940 | |||
2941 | * reinstate manpage .out patch from 1:1.2.3 | ||
2942 | * fix typo in postinst | ||
2943 | * only compile ssh with IPV4_DEFAULT | ||
2944 | * apply James Troup's patch to add a -o option to scp and updated manpage | ||
2945 | |||
2946 | -- Philip Hands <phil@hands.com> Sun, 30 Jul 2000 00:12:49 +0100 | ||
2947 | |||
2948 | openssh (1:2.1.1p4-1) unstable; urgency=low | ||
2949 | |||
2950 | * New upstream release | ||
2951 | |||
2952 | -- Philip Hands <phil@hands.com> Sat, 29 Jul 2000 14:46:16 +0100 | ||
2953 | |||
2954 | openssh (1:1.2.3-10) unstable; urgency=low | ||
2955 | |||
2956 | * add version to libpam-modules dependency, because old versions of | ||
2957 | pam_motd make it impossible to log in. | ||
2958 | |||
2959 | -- Philip Hands <phil@hands.com> Sat, 29 Jul 2000 13:28:22 +0100 | ||
2960 | |||
2961 | openssh (1:1.2.3-9) frozen unstable; urgency=low | ||
2962 | |||
2963 | * force location of /usr/bin/X11/xauth | ||
2964 | (closes: #64424, #66437, #66859) *RC* | ||
2965 | * typos in config (closes: #66779, #66780) | ||
2966 | * sshd_not_to_be_run could be assumed to be true, in error, if the config | ||
2967 | script died in an unusual way --- I've reversed this (closes: #66335) | ||
2968 | * Apply Zack Weinberg <zack@wolery.cumb.org>'s patch to ssh-askpass-ptk | ||
2969 | (closes: #65981) | ||
2970 | * change default for PermitRootLogin to "no" (closes: #66406) | ||
2971 | |||
2972 | -- Philip Hands <phil@hands.com> Tue, 11 Jul 2000 20:51:18 +0100 | ||
2973 | |||
2974 | openssh (1:1.2.3-8) frozen unstable; urgency=low | ||
2975 | |||
2976 | * get rid of Provides: rsh-server (this will mean that rstartd | ||
2977 | will need to change it's depends to deal with #63948, which I'm | ||
2978 | reopening) (closes: #66257) | ||
2979 | Given that this is also a trivial change, and is a reversal of a | ||
2980 | change that was mistakenly made after the freeze, I think this should | ||
2981 | also go into frozen. | ||
2982 | |||
2983 | -- Philip Hands <phil@hands.com> Wed, 28 Jun 2000 03:26:30 +0100 | ||
2984 | |||
2985 | openssh (1:1.2.3-7) frozen unstable; urgency=low | ||
2986 | |||
2987 | * check if debconf is installed before calling db_stop in postinst. | ||
2988 | This is required to allow ssh to be installed when debconf is not | ||
2989 | wanted, which probably makes it an RC upload (hopefully the last of | ||
2990 | too many). | ||
2991 | |||
2992 | -- Philip Hands <phil@hands.com> Wed, 28 Jun 2000 03:19:47 +0100 | ||
2993 | |||
2994 | openssh (1:1.2.3-6) frozen unstable; urgency=low | ||
2995 | |||
2996 | * fixed depressing little bug involving a line wrap looking like | ||
2997 | a blank line in the templates file *RC* | ||
2998 | (closes: #66090, #66078, #66083, #66182) | ||
2999 | |||
3000 | -- Philip Hands <phil@hands.com> Mon, 26 Jun 2000 00:45:05 +0100 | ||
3001 | |||
3002 | openssh (1:1.2.3-5) frozen unstable; urgency=low | ||
3003 | |||
3004 | * add code to prevent UseLogin exploit, although I think our PAM | ||
3005 | conditional code breaks UseLogin in a way that protects us from this | ||
3006 | exploit anyway. ;-) (closes: #65495) *RC* | ||
3007 | * Apply Zack Weinberg <zack@wolery.cumb.org>'s patch to fix keyboard | ||
3008 | grab vulnerability in ssh-askpass-gnome (closes: #64795) *RC* | ||
3009 | * stop redirection of sshd's file descriptors (introduced in 1:1.2.3-3) | ||
3010 | and use db_stop in the postinst to solve that problem instead | ||
3011 | (closes: #65104) | ||
3012 | * add Provides: rsh-server to ssh (closes: #63948) | ||
3013 | * provide config option not to run sshd | ||
3014 | |||
3015 | -- Philip Hands <phil@hands.com> Mon, 12 Jun 2000 23:05:11 +0100 | ||
3016 | |||
3017 | openssh (1:1.2.3-4) frozen unstable; urgency=low | ||
3018 | |||
3019 | * fixes #63436 which is *RC* | ||
3020 | * add 10 second pause in init.d restart (closes: #63844) | ||
3021 | * get rid of noenv in PAM mail line (closes: #63856) | ||
3022 | * fix host key path in make-ssh-known-hosts (closes: #63713) | ||
3023 | * change wording of SUID template (closes: #62788, #63436) | ||
3024 | |||
3025 | -- Philip Hands <phil@hands.com> Sat, 27 May 2000 11:18:06 +0100 | ||
3026 | |||
3027 | openssh (1:1.2.3-3) frozen unstable; urgency=low | ||
3028 | |||
3029 | * redirect sshd's file descriptors to /dev/null in init to | ||
3030 | prevent debconf from locking up during installation | ||
3031 | ** grave bug just submited by me ** | ||
3032 | |||
3033 | -- Philip Hands <phil@hands.com> Thu, 20 Apr 2000 17:10:59 +0100 | ||
3034 | |||
3035 | openssh (1:1.2.3-2) frozen unstable; urgency=low | ||
3036 | |||
3037 | * allow user to select SUID status of /usr/bin/ssh (closes: 62462) ** RC ** | ||
3038 | * suggest debconf | ||
3039 | * conflict with debconf{,-tiny} (<<0.2.17) so I can clean up the preinst | ||
3040 | |||
3041 | -- Philip Hands <phil@hands.com> Wed, 19 Apr 2000 17:49:15 +0100 | ||
3042 | |||
3043 | openssh (1:1.2.3-1) frozen unstable; urgency=low | ||
3044 | |||
3045 | * New upstream release | ||
3046 | * patch sshd to create extra xauth key required for localhost | ||
3047 | (closes: #49944) *** RC *** | ||
3048 | * FallbacktoRsh now defaults to ``no'' to match impression | ||
3049 | given in sshd_config | ||
3050 | * stop setting suid bit on ssh (closes: #58711, #58558) | ||
3051 | This breaks Rhosts authentication (which nobody uses) and allows | ||
3052 | the LD_PRELOAD trick to get socks working, so seems like a net benefit. | ||
3053 | |||
3054 | -- Philip Hands <phil@hands.com> Thu, 13 Apr 2000 20:01:54 +0100 | ||
3055 | |||
3056 | openssh (1:1.2.2-1.4) frozen unstable; urgency=low | ||
3057 | |||
3058 | * Recompile for frozen, contains fix for RC bug. | ||
3059 | |||
3060 | -- Tommi Virtanen <tv@debian.org> Tue, 29 Feb 2000 22:14:58 +0200 | ||
3061 | |||
3062 | openssh (1:1.2.2-1.3) unstable; urgency=low | ||
3063 | |||
3064 | * Integrated man page addition for PrintLastLog. | ||
3065 | This bug was filed on "openssh", and I ended up | ||
3066 | creating my own patch for this (closes: #59054) | ||
3067 | * Improved error message when ssh_exchange_identification | ||
3068 | gets EOF (closes: #58904) | ||
3069 | * Fixed typo (your -> you're) in debian/preinst. | ||
3070 | * Added else-clauses to config to make this upgradepath possible: | ||
3071 | oldssh -> openssh preinst fails due to upgrade_to_openssh=false | ||
3072 | -> ssh-nonfree -> openssh. Without these, debconf remembered | ||
3073 | the old answer, config didn't force asking it, and preinst always | ||
3074 | aborted (closes: #56596, #57782) | ||
3075 | * Moved setting upgrade_to_openssh isdefault flag to the place | ||
3076 | where preinst would abort. This means no double question to most | ||
3077 | users, people who currently suffer from "can't upgrade" may need | ||
3078 | to run apt-get install ssh twice. Did not do the same for | ||
3079 | use_old_init_script, as the situation is a bit different, and | ||
3080 | less common (closes: #54010, #56224) | ||
3081 | * Check for existance of ssh-keygen before attempting to use it in | ||
3082 | preinst, added warning for non-existant ssh-keygen in config. This | ||
3083 | happens when the old ssh is removed (say, due to ssh-nonfree getting | ||
3084 | installed). | ||
3085 | |||
3086 | -- Tommi Virtanen <tv@debian.org> Sun, 27 Feb 2000 21:36:43 +0200 | ||
3087 | |||
3088 | openssh (1:1.2.2-1.2) frozen unstable; urgency=low | ||
3089 | |||
3090 | * Non-maintainer upload. | ||
3091 | * Added configuration option PrintLastLog, default off due to PAM | ||
3092 | (closes: #54007, #55042) | ||
3093 | * ssh-askpass-{gnome,ptk} now provide ssh-askpass, making ssh's | ||
3094 | Suggests: line more accurate. Also closing related bugs fixed | ||
3095 | earlier, when default ssh-askpass moved to /usr/bin. | ||
3096 | (closes: #52403, #54741, #50607, #52298, #50967, #51661) | ||
3097 | * Patched to call vhangup, with autoconf detection and all | ||
3098 | (closes: #55379) | ||
3099 | * Added --with-ipv4-default workaround to a glibc bug causing | ||
3100 | slow DNS lookups, as per UPGRADING. Use -6 to really use | ||
3101 | IPv6 addresses. (closes: #57891, #58744, #58713, #57970) | ||
3102 | * Added noenv to PAM pam_mail line. Thanks to Ben Collins. | ||
3103 | (closes: #58429) | ||
3104 | * Added the UPGRADING file to the package. | ||
3105 | * Added frozen to the changelog line and recompiled before | ||
3106 | package was installed into the archive. | ||
3107 | |||
3108 | -- Tommi Virtanen <tv@debian.org> Fri, 25 Feb 2000 22:08:57 +0200 | ||
3109 | |||
3110 | openssh (1:1.2.2-1.1) frozen unstable; urgency=low | ||
3111 | |||
3112 | * Non-maintainer upload. | ||
3113 | * Integrated scp pipe buffer patch from Ben Collins | ||
3114 | <benc@debian.org>, should now work even if reading | ||
3115 | a pipe gives less than fstat st_blksize bytes. | ||
3116 | Should now work on Alpha and Sparc Linux (closes: #53697, #52071) | ||
3117 | * Made ssh depend on libssl09 (>= 0.9.4-3) (closes: #51393) | ||
3118 | * Integrated patch from Ben Collins <benc@debian.org> | ||
3119 | to do full shadow account locking and expiration | ||
3120 | checking (closes: #58165, #51747) | ||
3121 | |||
3122 | -- Tommi Virtanen <tv@debian.org> Tue, 22 Feb 2000 20:46:12 +0200 | ||
3123 | |||
3124 | openssh (1:1.2.2-1) frozen unstable; urgency=medium | ||
3125 | |||
3126 | * New upstream release (closes: #56870, #56346) | ||
3127 | * built against new libesd (closes: #56805) | ||
3128 | * add Colin Watson <cjw44@cam.ac.uk> =NULL patch | ||
3129 | (closes: #49902, #54894) | ||
3130 | * use socketpairs as suggested by Andrew Tridgell to eliminate rsync | ||
3131 | (and other) lockups | ||
3132 | * patch SSHD_PAM_SERVICE back into auth-pam.c, again :-/ | ||
3133 | (closes: #49902, #55872, #56959) | ||
3134 | * uncoment the * line in ssh_config (closes: #56444) | ||
3135 | |||
3136 | * #54894 & #49902 are release critical, so this should go in frozen | ||
3137 | |||
3138 | -- Philip Hands <phil@hands.com> Wed, 9 Feb 2000 04:52:04 +0000 | ||
3139 | |||
3140 | openssh (1:1.2.1pre24-1) unstable; urgency=low | ||
3141 | |||
3142 | * New upstream release | ||
3143 | |||
3144 | -- Philip Hands <phil@hands.com> Fri, 31 Dec 1999 02:47:24 +0000 | ||
3145 | |||
3146 | openssh (1:1.2.1pre23-1) unstable; urgency=low | ||
3147 | |||
3148 | * New upstream release | ||
3149 | * excape ? in /etc/init.d/ssh (closes: #53269) | ||
3150 | |||
3151 | -- Philip Hands <phil@hands.com> Wed, 29 Dec 1999 16:50:46 +0000 | ||
3152 | |||
3153 | openssh (1:1.2pre17-1) unstable; urgency=low | ||
3154 | |||
3155 | * New upstream release | ||
3156 | |||
3157 | -- Philip Hands <phil@hands.com> Thu, 9 Dec 1999 16:50:40 +0000 | ||
3158 | |||
3159 | openssh (1:1.2pre16-1) unstable; urgency=low | ||
3160 | |||
3161 | * New upstream release | ||
3162 | * upstream release (1.2pre14) (closes: #50299) | ||
3163 | * make ssh depend on libwrap0 (>= 7.6-1.1) (closes: #50973, #50776) | ||
3164 | * dispose of grep -q broken pipe message in config script (closes: #50855) | ||
3165 | * add make-ssh-known-hosts (closes: #50660) | ||
3166 | * add -i option to ssh-copy-id (closes: #50657) | ||
3167 | * add check for *LK* in password, indicating a locked account | ||
3168 | |||
3169 | -- Philip Hands <phil@hands.com> Wed, 8 Dec 1999 22:59:38 +0000 | ||
3170 | |||
3171 | openssh (1:1.2pre13-1) unstable; urgency=low | ||
3172 | |||
3173 | * New upstream release | ||
3174 | * make sshd.c use SSHD_PAM_SERVICE and define it as "ssh" in debian/rules | ||
3175 | * remove duplicate line in /etc/pam.d/ssh (closes: #50310) | ||
3176 | * mention ssh -A option in ssh.1 & ssh_config | ||
3177 | * enable forwarding to localhost in default ssh_config (closes: #50373) | ||
3178 | * tweak preinst to deal with debconf being `unpacked' | ||
3179 | * use --with-tcp-wrappers (closes: #49545) | ||
3180 | |||
3181 | -- Philip Hands <phil@hands.com> Sat, 20 Nov 1999 14:20:04 +0000 | ||
3182 | |||
3183 | openssh (1:1.2pre11-2) unstable; urgency=low | ||
3184 | |||
3185 | * oops, just realised that I forgot to strip out the unpleasant | ||
3186 | fiddling mentioned below (which turned not to be a fix anyway) | ||
3187 | |||
3188 | -- Philip Hands <phil@hands.com> Mon, 15 Nov 1999 01:35:23 +0000 | ||
3189 | |||
3190 | openssh (1:1.2pre11-1) unstable; urgency=low | ||
3191 | |||
3192 | * New upstream release (closes: #49722) | ||
3193 | * add 2>/dev/null to dispose of spurious message casused by grep -q | ||
3194 | (closes: #49876, #49604) | ||
3195 | * fix typo in debian/control (closes: #49841) | ||
3196 | * Do some unpleasant fiddling with upgraded keys in the preinst, which | ||
3197 | should make the keylength problem go away. (closes: #49676) | ||
3198 | * make pam_start in sshd use ``ssh'' as the service name (closes: #49956) | ||
3199 | * If /etc/ssh/NOSERVER exist, stop sshd from starting (closes: #47107) | ||
3200 | * apply Ben Collins <bcollins@debian.org>'s shadow patch | ||
3201 | * disable lastlogin and motd printing if using pam (closes: #49957) | ||
3202 | * add ssh-copy-id script and manpage | ||
3203 | |||
3204 | -- Philip Hands <phil@hands.com> Fri, 12 Nov 1999 01:03:38 +0000 | ||
3205 | |||
3206 | openssh (1:1.2pre9-1) unstable; urgency=low | ||
3207 | |||
3208 | * New upstream release | ||
3209 | * apply Chip Salzenberg <chip@valinux.com>'s SO_REUSEADDR patch | ||
3210 | to channels.c, to make forwarded ports instantly reusable | ||
3211 | * replace Pre-Depend: debconf with some check code in preinst | ||
3212 | * make the ssh-add ssh-askpass failure message more helpful | ||
3213 | * fix the ssh-agent getopts bug (closes: #49426) | ||
3214 | * fixed typo on Suggests: line (closes: #49704, #49571) | ||
3215 | * tidy up ssh package description (closes: #49642) | ||
3216 | * make ssh suid (closes: #49635) | ||
3217 | * in preinst upgrade code, ensure ssh_host_keys is mode 600 (closes: #49606) | ||
3218 | * disable agent forwarding by default, for the similar reasons as | ||
3219 | X forwarding (closes: #49586) | ||
3220 | |||
3221 | -- Philip Hands <phil@hands.com> Tue, 9 Nov 1999 09:57:47 +0000 | ||
3222 | |||
3223 | openssh (1:1.2pre7-4) unstable; urgency=low | ||
3224 | |||
3225 | * predepend on debconf (>= 0.2.17) should now allow preinst questions | ||
3226 | |||
3227 | -- Philip Hands <phil@hands.com> Sat, 6 Nov 1999 10:31:06 +0000 | ||
3228 | |||
3229 | openssh (1:1.2pre7-3) unstable; urgency=low | ||
3230 | |||
3231 | * add ssh-askpass package using Tommi Virtanen's perl-tk script | ||
3232 | * add ssh-preconfig package cludge | ||
3233 | * add usage hints to ssh-agent.1 | ||
3234 | |||
3235 | -- Philip Hands <phil@hands.com> Fri, 5 Nov 1999 00:38:33 +0000 | ||
3236 | |||
3237 | openssh (1:1.2pre7-2) unstable; urgency=low | ||
3238 | |||
3239 | * use pam patch from Ben Collins <bcollins@debian.org> | ||
3240 | * add slogin symlink to Makefile.in | ||
3241 | * change /usr/bin/login to LOGIN_PROGRAM define of /bin/login | ||
3242 | * sort out debconf usage | ||
3243 | * patch from Tommi Virtanen <tv@debian.org>'s makes ssh-add use ssh-askpass | ||
3244 | |||
3245 | -- Philip Hands <phil@hands.com> Thu, 4 Nov 1999 11:08:54 +0000 | ||
3246 | |||
3247 | openssh (1:1.2pre7-1) unstable; urgency=low | ||
3248 | |||
3249 | * New upstream release | ||
3250 | |||
3251 | -- Philip Hands <phil@hands.com> Tue, 2 Nov 1999 21:02:37 +0000 | ||
3252 | |||
3253 | openssh (1:1.2.0.pre6db1-2) unstable; urgency=low | ||
3254 | |||
3255 | * change the binary package name to ssh (the non-free branch of ssh has | ||
3256 | been renamed to ssh-nonfree) | ||
3257 | * make pam file comply with Debian standards | ||
3258 | * use an epoch to make sure openssh supercedes ssh-nonfree | ||
3259 | |||
3260 | -- Philip Hands <phil@hands.com> Sat, 30 Oct 1999 16:26:05 +0100 | ||
3261 | |||
3262 | openssh (1.2pre6db1-1) unstable; urgency=low | ||
3263 | |||
3264 | * New upstream source | ||
3265 | * sshd accepts logins now! | ||
3266 | |||
3267 | -- Dan Brosemer <odin@linuxfreak.com> Fri, 29 Oct 1999 11:13:38 -0500 | ||
3268 | |||
3269 | openssh (1.2.0.19991028-1) unstable; urgency=low | ||
3270 | |||
3271 | * New upstream source | ||
3272 | * Added test for -lnsl to configure script | ||
3273 | |||
3274 | -- Dan Brosemer <odin@linuxfreak.com> Thu, 28 Oct 1999 18:52:09 -0500 | ||
3275 | |||
3276 | openssh (1.2.0.19991027-3) unstable; urgency=low | ||
3277 | |||
3278 | * Initial release | ||
3279 | |||
3280 | -- Dan Brosemer <odin@linuxfreak.com> Wed, 27 Oct 1999 19:39:46 -0500 | ||
diff --git a/debian/clean b/debian/clean new file mode 100644 index 000000000..5da17f8eb --- /dev/null +++ b/debian/clean | |||
@@ -0,0 +1 @@ | |||
config.log | |||
diff --git a/debian/compat b/debian/compat new file mode 100644 index 000000000..7f8f011eb --- /dev/null +++ b/debian/compat | |||
@@ -0,0 +1 @@ | |||
7 | |||
diff --git a/debian/control b/debian/control new file mode 100644 index 000000000..8ea645dea --- /dev/null +++ b/debian/control | |||
@@ -0,0 +1,133 @@ | |||
1 | Source: openssh | ||
2 | Section: net | ||
3 | Priority: standard | ||
4 | Maintainer: Debian OpenSSH Maintainers <debian-ssh@lists.debian.org> | ||
5 | Build-Depends: libwrap0-dev | libwrap-dev, zlib1g-dev (>= 1:1.2.3-1), libssl-dev (>= 0.9.8g), libpam0g-dev | libpam-dev, libgtk2.0-dev, libedit-dev, debhelper (>= 7.4.2~), libselinux1-dev [linux-any], libkrb5-dev | heimdal-dev, hardening-includes | ||
6 | Standards-Version: 3.8.4 | ||
7 | Uploaders: Colin Watson <cjwatson@debian.org>, Matthew Vernon <matthew@debian.org> | ||
8 | Homepage: http://www.openssh.org/ | ||
9 | Vcs-Bzr: http://anonscm.debian.org/bzr/pkg-ssh/openssh/trunk | ||
10 | Vcs-Browser: http://anonscm.debian.org/loggerhead/pkg-ssh/openssh/trunk | ||
11 | |||
12 | Package: openssh-client | ||
13 | Architecture: any | ||
14 | Depends: ${shlibs:Depends}, ${misc:Depends}, debconf (>= 1.2.0) | debconf-2.0, adduser (>= 3.10), dpkg (>= 1.7.0), passwd | ||
15 | Recommends: xauth, openssh-blacklist, openssh-blacklist-extra | ||
16 | Conflicts: ssh (<< 1:3.8.1p1-9), sftp, rsh-client (<<0.16.1-1), ssh-krb5 (<< 1:4.3p2-7) | ||
17 | Replaces: ssh, ssh-krb5 | ||
18 | Suggests: ssh-askpass, libpam-ssh, keychain, monkeysphere | ||
19 | Provides: rsh-client, ssh-client | ||
20 | Description: secure shell (SSH) client, for secure access to remote machines | ||
21 | This is the portable version of OpenSSH, a free implementation of | ||
22 | the Secure Shell protocol as specified by the IETF secsh working | ||
23 | group. | ||
24 | . | ||
25 | Ssh (Secure Shell) is a program for logging into a remote machine | ||
26 | and for executing commands on a remote machine. | ||
27 | It provides secure encrypted communications between two untrusted | ||
28 | hosts over an insecure network. X11 connections and arbitrary TCP/IP | ||
29 | ports can also be forwarded over the secure channel. | ||
30 | It can be used to provide applications with a secure communication | ||
31 | channel. | ||
32 | . | ||
33 | This package provides the ssh, scp and sftp clients, the ssh-agent | ||
34 | and ssh-add programs to make public key authentication more convenient, | ||
35 | and the ssh-keygen, ssh-keyscan, ssh-copy-id and ssh-argv0 utilities. | ||
36 | . | ||
37 | In some countries it may be illegal to use any encryption at all | ||
38 | without a special permit. | ||
39 | . | ||
40 | ssh replaces the insecure rsh, rcp and rlogin programs, which are | ||
41 | obsolete for most purposes. | ||
42 | |||
43 | Package: openssh-server | ||
44 | Priority: optional | ||
45 | Architecture: any | ||
46 | Depends: ${shlibs:Depends}, ${misc:Depends}, debconf (>= 1.2.0) | debconf-2.0, libpam-runtime (>= 0.76-14), libpam-modules (>= 0.72-9), adduser (>= 3.9), dpkg (>= 1.9.0), openssh-client (= ${binary:Version}), lsb-base (>= 3.2-13), procps | ||
47 | Recommends: xauth, openssh-blacklist, openssh-blacklist-extra, ${openssh-server:Recommends} | ||
48 | Conflicts: ssh (<< 1:3.8.1p1-9), ssh-nonfree (<<2), ssh-socks, ssh2, sftp, rsh-client (<<0.16.1-1), ssh-krb5 (<< 1:4.3p2-7) | ||
49 | Replaces: ssh, openssh-client (<< 1:3.8.1p1-11), ssh-krb5 | ||
50 | Suggests: ssh-askpass, rssh, molly-guard, ufw, monkeysphere | ||
51 | Provides: ssh-server | ||
52 | Description: secure shell (SSH) server, for secure access from remote machines | ||
53 | This is the portable version of OpenSSH, a free implementation of | ||
54 | the Secure Shell protocol as specified by the IETF secsh working | ||
55 | group. | ||
56 | . | ||
57 | Ssh (Secure Shell) is a program for logging into a remote machine | ||
58 | and for executing commands on a remote machine. | ||
59 | It provides secure encrypted communications between two untrusted | ||
60 | hosts over an insecure network. X11 connections and arbitrary TCP/IP | ||
61 | ports can also be forwarded over the secure channel. | ||
62 | It can be used to provide applications with a secure communication | ||
63 | channel. | ||
64 | . | ||
65 | This package provides the sshd server. | ||
66 | . | ||
67 | In some countries it may be illegal to use any encryption at all | ||
68 | without a special permit. | ||
69 | . | ||
70 | sshd replaces the insecure rshd program, which is obsolete for most | ||
71 | purposes. | ||
72 | |||
73 | Package: ssh | ||
74 | Priority: extra | ||
75 | Architecture: all | ||
76 | Depends: ${misc:Depends}, openssh-client, openssh-server | ||
77 | Description: secure shell client and server (metapackage) | ||
78 | This metapackage is a convenient way to install both the OpenSSH client | ||
79 | and the OpenSSH server. It provides nothing in and of itself, so you | ||
80 | may remove it if nothing depends on it. | ||
81 | |||
82 | Package: ssh-krb5 | ||
83 | Priority: extra | ||
84 | Architecture: all | ||
85 | Depends: ${misc:Depends}, openssh-client, openssh-server | ||
86 | Description: secure shell client and server (transitional package) | ||
87 | This is a transitional package depending on the regular Debian OpenSSH | ||
88 | client and server, which now support GSSAPI natively. It will add the | ||
89 | necessary GSSAPI options to the server configuration file. You can | ||
90 | remove it once the upgrade is complete and nothing depends on it. | ||
91 | |||
92 | Package: ssh-askpass-gnome | ||
93 | Section: gnome | ||
94 | Priority: optional | ||
95 | Architecture: any | ||
96 | Depends: ${shlibs:Depends}, ${misc:Depends}, openssh-client | ssh (>= 1:1.2pre7-4) | ssh-krb5 | ||
97 | Replaces: ssh (<< 1:3.5p1-3) | ||
98 | Provides: ssh-askpass | ||
99 | Description: interactive X program to prompt users for a passphrase for ssh-add | ||
100 | This has been split out of the main openssh-client package so that | ||
101 | openssh-client does not need to depend on GTK+. | ||
102 | . | ||
103 | You probably want the ssh-askpass package instead, but this is | ||
104 | provided to add to your choice and/or confusion. | ||
105 | |||
106 | Package: openssh-client-udeb | ||
107 | XC-Package-Type: udeb | ||
108 | Section: debian-installer | ||
109 | Priority: optional | ||
110 | Architecture: any | ||
111 | Depends: ${shlibs:Depends}, libnss-files-udeb | ||
112 | XB-Installer-Menu-Item: 99999 | ||
113 | Description: secure shell client for the Debian installer | ||
114 | This is the portable version of OpenSSH, a free implementation of | ||
115 | the Secure Shell protocol as specified by the IETF secsh working | ||
116 | group. | ||
117 | . | ||
118 | This package provides the ssh client for use in debian-installer. | ||
119 | |||
120 | Package: openssh-server-udeb | ||
121 | XC-Package-Type: udeb | ||
122 | Section: debian-installer | ||
123 | Priority: optional | ||
124 | Architecture: any | ||
125 | Depends: ${shlibs:Depends}, libnss-files-udeb | ||
126 | Description: secure shell server for the Debian installer | ||
127 | This is the portable version of OpenSSH, a free implementation of | ||
128 | the Secure Shell protocol as specified by the IETF secsh working | ||
129 | group. | ||
130 | . | ||
131 | This package provides the sshd server for use in debian-installer. | ||
132 | Since it is expected to be used in specialized situations (e.g. S/390 | ||
133 | installs with no console), it does not provide any configuration. | ||
diff --git a/debian/copyright.head b/debian/copyright.head new file mode 100644 index 000000000..311a06a7e --- /dev/null +++ b/debian/copyright.head | |||
@@ -0,0 +1,52 @@ | |||
1 | This package was debianized by Philip Hands <phil@hands.com> on 31 Oct 1999 | ||
2 | (with help from Dan Brosemer <odin@linuxfreak.com>) | ||
3 | |||
4 | It was downloaded from here: | ||
5 | ftp://ftp.fu-berlin.de/unix/security/openssh/openssh-2.3.0p1.tar.gz | ||
6 | |||
7 | worldwide mirrors are listed here: | ||
8 | http://www.openssh.com/ftp.html | ||
9 | |||
10 | The Debian specific parts of the package are mostly taken from the | ||
11 | original ssh package, which has since been renamed as ssh-nonfree. | ||
12 | |||
13 | The Debian patch is distributed under the terms of the GPL, which you | ||
14 | can find in /usr/share/common-licenses/GPL. | ||
15 | |||
16 | In addition, as a special exception, Matthew Vernon gives permission | ||
17 | to link the code of the Debian patch with any version of the OpenSSH | ||
18 | code which is distributed under a license identical to that listed in | ||
19 | the included Copyright file, and distribute linked combinations | ||
20 | including the two. You must obey the GNU General Public License in | ||
21 | all respects for all of the code used other than OpenSSH. If you | ||
22 | modify this file, you may extend this exception to your version of the | ||
23 | file, but you are not obligated to do so. If you do not wish to do | ||
24 | so, delete this exception statement from your version. | ||
25 | |||
26 | The upstream source for this package is a combination of the ssh | ||
27 | branch that is being maintained by the OpenBSD team (starting from | ||
28 | the last version of SSH that was distributed under a free license), | ||
29 | and porting work by Damien Miller <damien@ibs.com.au> to get it | ||
30 | working on Linux. Other people also contributed to this, and are | ||
31 | credited in /usr/share/doc/ssh/README. | ||
32 | |||
33 | This package contains Kerberos version 5 patches from | ||
34 | http://www.sxw.org.uk/computing/patches/openssh.html; this is Copyright | ||
35 | (c) 2001-2009 Simon Wilkinson and provided under the standard 2-term BSD | ||
36 | licence used elsewhere in OpenSSH. | ||
37 | |||
38 | Copyright: | ||
39 | |||
40 | Code in helper.[ch] is Copyright Internet Business Solutions and is | ||
41 | released under a X11-style license (see source file for details). | ||
42 | |||
43 | (A)RC4 code in rc4.[ch] is Copyright Damien Miller. It too is under a | ||
44 | X11-style license (see source file for details). | ||
45 | |||
46 | make-ssh-known-hosts is Copyright Tero Kivinen <Tero.Kivinen@hut.fi>, | ||
47 | and is distributed under the GPL (see source file for details). | ||
48 | |||
49 | The copyright for the original SSH version follows. It has been | ||
50 | modified with [comments] to reflect the changes that the OpenBSD folks | ||
51 | have made: | ||
52 | |||
diff --git a/debian/faq.html b/debian/faq.html new file mode 100644 index 000000000..812234d2f --- /dev/null +++ b/debian/faq.html | |||
@@ -0,0 +1,1182 @@ | |||
1 | <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> | ||
2 | <html> | ||
3 | <head> | ||
4 | <title>OpenSSH FAQ</title> | ||
5 | <link rev= "made" href= "mailto:www@openbsd.org"> | ||
6 | <meta name= "resource-type" content= "document"> | ||
7 | <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> | ||
8 | <meta name= "description" content= "the OpenSSH FAQ page"> | ||
9 | <meta name= "keywords" content= "OpenSSH,SSH,Secure Shell,faq"> | ||
10 | <meta name= "distribution" content= "global"> | ||
11 | <meta name= "copyright" content= "This document copyright 1999-2005 OpenBSD."> | ||
12 | </head> | ||
13 | |||
14 | <body bgcolor= "#ffffff" text= "#000000" link= "#23238E"> | ||
15 | <a href="http://www.openssh.org/index.html"><img alt="[OpenSSH]" height="30" width="141" src="images/smalltitle.gif" border="0"></a> | ||
16 | <p> | ||
17 | |||
18 | <h1>OpenSSH FAQ (Frequently asked questions)</h1> | ||
19 | |||
20 | <strong>Date: 2005/09/20</strong> | ||
21 | |||
22 | <hr> | ||
23 | |||
24 | <blockquote> | ||
25 | <h3><a href= "#1.0">1.0 - What Is OpenSSH and Where Can I Get It?</a></h3> | ||
26 | <ul> | ||
27 | <li><a href= "#1.1">1.1 - What is OpenSSH and where can I download it?</a> | ||
28 | <li><a href= "#1.2">1.2 - Why should it be used?</a> | ||
29 | <li><a href= "#1.3">1.3 - What Operating Systems are supported?</a> | ||
30 | <li><a href= "#1.4">1.4 - What about copyright, usage and patents?</a> | ||
31 | <li><a href= "#1.5">1.5 - Where should I ask for help?</a> | ||
32 | <li><a href= "#1.6">1.6 - I have found a bug. Where do I report it?</a> | ||
33 | </ul> | ||
34 | |||
35 | <h3><a href= "#2.0">2.0 - General Questions</a></h3> | ||
36 | <ul> | ||
37 | <li><a href= "#2.1">2.1 - Why does ssh/scp make connections from low-numbered ports. My firewall blocks these.</a> | ||
38 | <li><a href= "#2.2">2.2 - Why is the ssh client setuid root?</a> | ||
39 | <li><a href= "#2.3">2.3 - Why does SSH 2.3 have problems interoperating with OpenSSH 2.1.1?</a> | ||
40 | <li><a href= "#2.4">2.4 - Why does OpenSSH print: Dispatch protocol error: type 20</a> | ||
41 | <li><a href= "#2.5">2.5 - Old versions of commercial SSH encrypt host keys with IDEA.</a> | ||
42 | <li><a href= "#2.6">2.6 - What are these warning messages about key lengths?</a> | ||
43 | <li><a href= "#2.7">2.7 - X11 and/or agent forwarding does not work.</a> | ||
44 | <li><a href= "#2.8">2.8 - After upgrading OpenSSH I lost SSH2 support.</a> | ||
45 | <li><a href= "#2.9">2.9 - sftp/scp fails at connection, but ssh is OK.</a> | ||
46 | <li><a href= "#2.10">2.10 - Will you add [foo] to scp?</a> | ||
47 | <li><a href= "#2.11">2.11 - How do I use port forwarding?</a> | ||
48 | <li><a href= "#2.12">2.12 - My ssh connection freezes or drops out after N minutes of inactivity.</a> | ||
49 | <li><a href= "#2.13">2.13 - How do I use scp to copy a file with a colon in it?</a> | ||
50 | <li><a href= "#2.14">2.14 - Why does OpenSSH report its version to clients?</a> | ||
51 | </ul> | ||
52 | |||
53 | <h3><a href= "#3.0">3.0 - Portable OpenSSH Questions</a></h3> | ||
54 | <ul> | ||
55 | <li><a href= "#3.1">3.1 - Spurious PAM authentication messages in logfiles.</a> | ||
56 | <li><a href= "#3.2">3.2 - Empty passwords not allowed with PAM authentication.</a> | ||
57 | <li><a href= "#3.3">3.3 - ssh(1) takes a long time to connect or log in</a> | ||
58 | <li><a href= "#3.4">3.4 - "Can't locate module net-pf-10" messages in log under Linux.</a> | ||
59 | <li><a href= "#3.5">3.5 - Password authentication doesn't work (eg on Slackware 7.0 or Red Hat Linux 6.x)</a> | ||
60 | <li><a href= "#3.6">3.6 - Configure or sshd(8) complain about lack of RSA support</a> | ||
61 | <li><a href= "#3.7">3.7 - "scp: command not found" errors</a> | ||
62 | <li><a href= "#3.8">3.8 - Unable to read passphrase</a> | ||
63 | <li><a href= "#3.9">3.9 - 'configure' missing or make fails</a> | ||
64 | <li><a href= "#3.10">3.10 - Hangs when exiting ssh</a> | ||
65 | <li><a href= "#3.11">3.11 - Why does ssh hang on exit?</a> | ||
66 | <li><a href= "#3.12">3.12 - I upgraded to OpenSSH 3.1 and X11 forwarding stopped working.</a> | ||
67 | <li><a href= "#3.13">3.13 - I upgraded to OpenSSH 3.8 and some X11 programs stopped working.</a> | ||
68 | <li><a href= "#3.14">3.14 - I copied my public key to authorized_keys but public-key authentication still doesn't work.</a> | ||
69 | <li><a href= "#3.15">3.15 - OpenSSH versions and PAM behaviour.</a> | ||
70 | <li><a href= "#3.16">3.16 - Why doesn't "w" or "who" on AIX 5.x show users logged in via ssh?</a> | ||
71 | </ul> | ||
72 | |||
73 | </blockquote> | ||
74 | |||
75 | <hr> | ||
76 | |||
77 | <h2><u><a name= "1.0">1.0 - What Is OpenSSH and Where Can I Get It?</a></u></h2> | ||
78 | |||
79 | <h2><a name= "1.1">1.1 - What is OpenSSH and where can I download it?</a></h2> | ||
80 | |||
81 | <p> | ||
82 | OpenSSH is a <b>FREE</b> version of the SSH suite of network connectivity | ||
83 | tools that increasing numbers of people on the Internet are coming to | ||
84 | rely on. Many users of telnet, rlogin, ftp, and other such programs might | ||
85 | not realize that their password is transmitted across the Internet | ||
86 | unencrypted, but it is. OpenSSH encrypts all traffic (including passwords) | ||
87 | to effectively eliminate eavesdropping, connection hijacking, | ||
88 | and other network-level attacks. | ||
89 | |||
90 | <p> | ||
91 | The OpenSSH suite includes the | ||
92 | <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh&sektion=1">ssh(1)</a> | ||
93 | program which replaces rlogin and telnet, and | ||
94 | <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=scp&sektion=1">scp(1)</a> | ||
95 | which replaces | ||
96 | <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=rcp&sektion=1">rcp(1)</a> and | ||
97 | <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ftp&sektion=1">ftp(1)</a>. | ||
98 | OpenSSH has also added | ||
99 | <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sftp&sektion=1">sftp(1)</a> and | ||
100 | <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sftp-server&sektion=8">sftp-server(8)</a> | ||
101 | which implement an easier solution for file-transfer. This is based upon the | ||
102 | <a href="http://www.openssh.org/txt/draft-ietf-secsh-filexfer-02.txt">secsh-filexfer</a> IETF draft. | ||
103 | |||
104 | |||
105 | <p><strong>OpenSSH consists of a number of programs.</strong> | ||
106 | |||
107 | <ul> | ||
108 | <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sshd&sektion=8">sshd(8)</a> - Server program run on the server machine. This listens for connections from client machines, and whenever it receives a connection, it performs authentication and starts serving the client. | ||
109 | Its behaviour is controlled by the config file <i><a | ||
110 | href="http://www.openbsd.org/cgi-bin/man.cgi?query=sshd_config&sektion=5"> | ||
111 | sshd_config(5)</a></i>. | ||
112 | <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh&sektion=1">ssh(1)</a> - This is the client program used to log into another machine or to execute commands on the other machine. <i>slogin</i> is another name for this program. | ||
113 | Its behaviour is controlled by the global config file <i><a | ||
114 | href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh_config&sektion=5"> | ||
115 | ssh_config(5)</a></i> and individual users' <i>$HOME/.ssh/config</i> files. | ||
116 | <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=scp&sektion=1">scp(1)</a> - Securely copies files from one machine to another. | ||
117 | <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh-keygen&sektion=1">ssh-keygen(1)</a> - Used to create Pubkey Authentication (RSA or DSA) keys (host keys and user authentication keys). | ||
118 | <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh-agent&sektion=1">ssh-agent(1)</a> - Authentication agent. This can be used to hold RSA keys for authentication. | ||
119 | <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh-add&sektion=1">ssh-add(1)</a> - Used to register new keys with the agent. | ||
120 | <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sftp-server&sektion=8">sftp-server(8)</a> - SFTP server subsystem. | ||
121 | <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sftp&sektion=1">sftp(1)</a> - Secure file transfer program. | ||
122 | <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh-keyscan&sektion=1">ssh-keyscan(1)</a> - gather ssh public keys. | ||
123 | <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh-keysign&sektion=8">ssh-keysign(8)</a> - ssh helper program for hostbased authentication. | ||
124 | </ul> | ||
125 | |||
126 | <h3>Downloading</h3> | ||
127 | |||
128 | <p> | ||
129 | OpenSSH comes in two downloadable distributions: the native <a | ||
130 | href="http://www.openssh.org/openbsd.html">OpenBSD</a> distribution and the multi-platform | ||
131 | <a href="http://www.openssh.org/portable.html">Portable</a> distribution. If you want | ||
132 | OpenSSH for a recent OpenBSD or integration into a product, you | ||
133 | probably want the <a href="http://www.openssh.org/openbsd.html">OpenBSD</a> distribution. | ||
134 | If you want OpenSSH for another platform, or an older OpenBSD, you | ||
135 | probably want the <a href="http://www.openssh.org/portable.html">Portable</a> distribution. | ||
136 | |||
137 | <p> | ||
138 | When downloading, please use a <a href="http://www.openssh.org/portable.html#mirrors">mirror</a> | ||
139 | near you. | ||
140 | |||
141 | <h2><a name= "1.2">1.2 - Why should it be used?</a></h2> | ||
142 | |||
143 | <p> | ||
144 | OpenSSH is a suite of tools to help secure your network | ||
145 | connections. Here is a list of features: | ||
146 | |||
147 | |||
148 | <ul> | ||
149 | <li>Strong authentication. Closes several security holes (e.g., IP, routing, and DNS spoofing). | ||
150 | <li>Improved privacy. All communications are automatically and transparently encrypted. | ||
151 | <li>Secure X11 sessions. The program automatically sets DISPLAY on the server machine, and forwards any X11 connections over the secure channel. | ||
152 | <li>Arbitrary TCP/IP ports can be redirected through the encrypted channel in both directions (e.g., for e-cash transactions). | ||
153 | <li>No retraining needed for normal users. | ||
154 | <li>Never trusts the network. Minimal trust on the remote side of the connection. Minimal trust on domain name servers. Pure RSA authentication never trusts anything but the private key. | ||
155 | <li>Client RSA-authenticates the server machine in the beginning of every connection to prevent trojan horses (by routing or DNS spoofing) and man-in-the-middle attacks, and the server RSA-authenticates the client machine before accepting <i>.rhosts</i> or <i>/etc/hosts.equiv</i> authentication (to prevent DNS, routing, or IP-spoofing). | ||
156 | <li>Host authentication key distribution can be centrally by the administration, automatically when the first connection is made to a machine. | ||
157 | <li>Any user can create any number of user authentication RSA keys for his/her own use. | ||
158 | <li>The server program has its own server RSA key which is automatically regenerated every hour. | ||
159 | <li>An authentication agent, running in the user's laptop or local workstation, can be used to hold the user's RSA authentication keys. | ||
160 | <li>The software can be installed and used (with restricted functionality) even without root privileges. | ||
161 | <li>The client is customizable in system-wide and per-user configuration files. | ||
162 | <li>Optional compression of all data with gzip (including forwarded X11 and TCP/IP port data), which may result in significant speedups on slow connections. | ||
163 | <li>Complete replacement for rlogin, rsh, and rcp. | ||
164 | </ul> | ||
165 | |||
166 | <p> | ||
167 | Currently, almost all communications in computer networks are done | ||
168 | without encryption. As a consequence, anyone who has access to any | ||
169 | machine connected to the network can listen in on any communication. | ||
170 | This is being done by hackers, curious administrators, employers, | ||
171 | criminals, industrial spies, and governments. Some networks leak off | ||
172 | enough electromagnetic radiation that data may be captured even from a | ||
173 | distance. | ||
174 | |||
175 | |||
176 | <p> | ||
177 | When you log in, your password goes in the network in plain | ||
178 | text. Thus, any listener can then use your account to do any evil he | ||
179 | likes. Many incidents have been encountered worldwide where crackers | ||
180 | have started programs on workstations without the owner's knowledge | ||
181 | just to listen to the network and collect passwords. Programs for | ||
182 | doing this are available on the Internet, or can be built by a | ||
183 | competent programmer in a few hours. | ||
184 | |||
185 | |||
186 | <p> | ||
187 | Businesses have trade secrets, patent applications in preparation, | ||
188 | pricing information, subcontractor information, client data, personnel | ||
189 | data, financial information, etc. Currently, anyone with access to | ||
190 | the network (any machine on the network) can listen to anything that | ||
191 | goes in the network, without any regard to normal access restrictions. | ||
192 | |||
193 | |||
194 | <p> | ||
195 | Many companies are not aware that information can so easily be | ||
196 | recovered from the network. They trust that their data is safe | ||
197 | since nobody is supposed to know that there is sensitive information | ||
198 | in the network, or because so much other data is transferred in the | ||
199 | network. This is not a safe policy. | ||
200 | |||
201 | |||
202 | <h2><a name= "1.3">1.3 - What operating systems are supported?</a></h2> | ||
203 | |||
204 | <p> | ||
205 | Even though OpenSSH is developed on | ||
206 | <a href="http://www.openbsd.org/">OpenBSD</a> a wide variety of | ||
207 | ports to other operating systems exist. The portable version of OpenSSH | ||
208 | is headed by <a href="mailto:djm@openbsd.org">Damien Miller</a>. | ||
209 | For a quick overview of the portable version of OpenSSH see | ||
210 | <a href="http://www.openssh.org/portable.html">OpenSSH Portable Release</a>. | ||
211 | Currently, the supported operating systems are: | ||
212 | |||
213 | |||
214 | <ul> | ||
215 | <li>OpenBSD | ||
216 | <li>NetBSD | ||
217 | <li>FreeBSD | ||
218 | <li>AIX | ||
219 | <li>HP-UX | ||
220 | <li>IRIX | ||
221 | <li>Linux | ||
222 | <li>NeXT | ||
223 | <li>SCO | ||
224 | <li>SNI/Reliant Unix | ||
225 | <li>Solaris | ||
226 | <li>Digital Unix/Tru64/OSF | ||
227 | <li>Mac OS X | ||
228 | <li>Cygwin | ||
229 | </ul> | ||
230 | |||
231 | <p> | ||
232 | A list of vendors that include OpenSSH in their distributions | ||
233 | is located in the <a href="http://www.openssh.org/users.html">OpenSSH Users page</a>. | ||
234 | |||
235 | <h2><a name= "1.4">1.4 - What about copyrights, usage and patents?</a></h2> | ||
236 | <p> | ||
237 | The OpenSSH developers have tried very hard to keep OpenSSH free of any | ||
238 | patent or copyright problems. To do this, some options had to be | ||
239 | stripped from OpenSSH. Namely support for patented algorithms. | ||
240 | |||
241 | <p> | ||
242 | OpenSSH does not support any patented transport algorithms. In SSH1 mode, | ||
243 | only 3DES and Blowfish are available options. In SSH2 mode, only 3DES, | ||
244 | Blowfish, CAST128, Arcfour and AES can be selected. | ||
245 | The patented IDEA algorithm is not supported. | ||
246 | |||
247 | <p> | ||
248 | OpenSSH provides support for both SSH1 and SSH2 protocols. | ||
249 | |||
250 | <p> | ||
251 | Since the RSA patent has expired, there are no restrictions on the use | ||
252 | of RSA algorithm using software, including OpenBSD. | ||
253 | |||
254 | <h2><a name= "1.5">1.5 - Where should I ask for help?</a></h2> | ||
255 | <p> | ||
256 | There are many places to turn to for help. In addition to the main | ||
257 | <a href="http://www.openssh.org/index.html">OpenSSH website</a>, | ||
258 | there are many mailing lists to try. Before trying any mailing lists, | ||
259 | please search through all mailing list archives to see if your question | ||
260 | has already been answered. The OpenSSH Mailing List has been archived and | ||
261 | put in searchable form and can be found at | ||
262 | <a href="http://marc.info/?l=openssh-unix-dev&r=1&w=2">marc.info</a>. | ||
263 | |||
264 | <p> | ||
265 | For more information on subscribing to OpenSSH related mailing lists, | ||
266 | please see <a href="http://www.openssh.org/list.html">OpenSSH Mailing lists</a>. | ||
267 | |||
268 | <h2><a name= "1.6">1.6 - I have found a bug. Where do I report it?</a></h2> | ||
269 | <p> | ||
270 | Information about submitting bug reports can be found at the OpenSSH | ||
271 | <a href="http://www.openssh.org/report.html">Reporting bugs</a> page. | ||
272 | <p> | ||
273 | If you wish to report a security bug, please contact the private developers | ||
274 | list <<a href="mailto:openssh@openssh.com">openssh@openssh.com</a>>. | ||
275 | |||
276 | <h2><u><a name= "2.0">2.0 - General Questions</a></u></h2> | ||
277 | |||
278 | <h2><a name= "2.1">2.1 - Why does ssh/scp make connections from low-numbered ports.</a></h2> | ||
279 | <p> | ||
280 | The OpenSSH client uses low numbered ports for rhosts and rhosts-rsa | ||
281 | authentication because the server needs to trust the username provided by | ||
282 | the client. To get around this, you can add the below example to your | ||
283 | <i>ssh_config</i> or <i>~/.ssh/config</i> file. | ||
284 | |||
285 | |||
286 | <blockquote> | ||
287 | <table border=0 width="800"> | ||
288 | <tr> | ||
289 | <td nowrap bgcolor="#EEEEEE"> | ||
290 | <b>UsePrivilegedPort no</b> | ||
291 | </td> | ||
292 | </tr> | ||
293 | </table> | ||
294 | </blockquote> | ||
295 | |||
296 | <p> | ||
297 | Or you can specify this option on the command line, using the <b>-o</b> | ||
298 | option to | ||
299 | <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh&sektion=1">ssh(1)</a> command. | ||
300 | |||
301 | <blockquote> | ||
302 | <table border=0 width="800"> | ||
303 | <tr> | ||
304 | <td nowrap bgcolor="#EEEEEE"> | ||
305 | $ <b>ssh -o "UsePrivilegedPort no" host.com</b> | ||
306 | </td> | ||
307 | </tr> | ||
308 | </table> | ||
309 | </blockquote> | ||
310 | |||
311 | <h2><a name= "2.2">2.2 - Why is the ssh client setuid root?</a></h2> | ||
312 | |||
313 | <p> | ||
314 | In conjunction with the previous question, (<a href="#2.1">2.1</a>) | ||
315 | OpenSSH needs root authority to be able to bind to low-numbered ports to | ||
316 | facilitate <i>rhosts authentication</i>. | ||
317 | A privileged port is also required for rhosts-rsa authentication to older | ||
318 | SSH releases. | ||
319 | |||
320 | <p> | ||
321 | Additionally, for both <i>rhosts-rsa authentication</i> (in protocol | ||
322 | version 1) and <i>hostbased authentication</i> (in protocol version 2) | ||
323 | the ssh client needs to access the <i>private host key</i> in order to | ||
324 | authenticate the client machine to the server. | ||
325 | OpenSSH versions prior to 3.3 required the <code>ssh</code> binary to be | ||
326 | setuid root to enable this, and you may safely remove it if you don't | ||
327 | want to use these authentication methods. | ||
328 | |||
329 | <p> | ||
330 | Starting in OpenSSH 3.3, <code>ssh</code> is not setuid by default. <a | ||
331 | href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh-keysign">ssh-keysign</a>, | ||
332 | is used for access to the private hosts keys, and ssh does not use privileged | ||
333 | source ports by default. If you wish to use a privileged source port, you must | ||
334 | manually set the setuid bit on <code>ssh</code>. | ||
335 | |||
336 | <h2><a name= "2.3">2.3 - Why does SSH 2.3 have problems interoperating with OpenSSH 2.1.1?</a></h2> | ||
337 | |||
338 | <p> | ||
339 | SSH 2.3 and earlier versions contain a flaw in their HMAC implementation. | ||
340 | Their code was not supplying the full data block output from the digest, | ||
341 | and instead always provided 128 bits. For longer digests, this caused | ||
342 | SSH 2.3 to not interoperate with OpenSSH. | ||
343 | |||
344 | <p> | ||
345 | OpenSSH 2.2.0 detects that SSH 2.3 has this flaw. Recent versions of SSH | ||
346 | will have this bug fixed. Or you can add the following to | ||
347 | SSH 2.3 <i>sshd2_config</i>. | ||
348 | |||
349 | |||
350 | <blockquote> | ||
351 | <table border=0 width="800"> | ||
352 | <tr> | ||
353 | <td nowrap bgcolor="#EEEEEE"> | ||
354 | <b>Mac hmac-md5</b> | ||
355 | </td> | ||
356 | </tr> | ||
357 | </table> | ||
358 | </blockquote> | ||
359 | |||
360 | <h2><a name= "2.4">2.4 - Why does OpenSSH print: Dispatch protocol error: type 20</a></h2> | ||
361 | |||
362 | <p> | ||
363 | Problems in interoperation have been seen because older versions of | ||
364 | OpenSSH did not support session rekeying. However the commercial SSH 2.3 | ||
365 | tries to negotiate this feature, and you might experience connection | ||
366 | freezes or see the error message "<b>Dispatch protocol error: | ||
367 | type 20 </b>". | ||
368 | To solve this problem, either upgrade to a recent OpenSSH release or | ||
369 | disable rekeying by adding the following to your commercial SSH 2.3's | ||
370 | <i>ssh2_config</i> or <i>sshd2_config</i>. | ||
371 | |||
372 | |||
373 | <blockquote> | ||
374 | <table border=0 width="800"> | ||
375 | <tr> | ||
376 | <td nowrap bgcolor="#EEEEEE"> | ||
377 | <b>RekeyIntervalSeconds 0</b> | ||
378 | </td> | ||
379 | </tr> | ||
380 | </table> | ||
381 | </blockquote> | ||
382 | |||
383 | <h2><a name= "2.5">2.5 - Old versions of commercial SSH encrypt host keys with IDEA.</a></h2> | ||
384 | |||
385 | <p> | ||
386 | The old versions of SSH used a patented algorithm to encrypt their | ||
387 | <i>/etc/ssh/ssh_host_key</i>. This problem will manifest as | ||
388 | <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sshd&sektion=8">sshd(8)</a> | ||
389 | not being able to read its host key. To solve this, use the command below | ||
390 | to convert your ssh_host_key to use 3DES. | ||
391 | <b>NOTE:</b> Use the | ||
392 | <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh-keygen&sektion=1">ssh-keygen(1)</a> | ||
393 | program from the Commercial SSH product, *NOT* OpenSSH for the example | ||
394 | below. | ||
395 | |||
396 | |||
397 | <blockquote> | ||
398 | <table border=0 width="800"> | ||
399 | <tr> | ||
400 | <td nowrap bgcolor="#EEEEEE"> | ||
401 | # <b>ssh-keygen -u -f /etc/ssh/ssh_host_key</b> | ||
402 | </td> | ||
403 | </tr> | ||
404 | </table> | ||
405 | </blockquote> | ||
406 | |||
407 | <h2><a name= "2.6">2.6 - What are these warning messages about key lengths</a></h2> | ||
408 | |||
409 | <p> | ||
410 | Commercial SSH's | ||
411 | <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh-keygen&sektion=1">ssh-keygen(1)</a> | ||
412 | program contained a bug which caused it to occasionally generate Pubkey | ||
413 | Authentication (RSA or DSA) keys which had their Most Significant Bit | ||
414 | (MSB) unset. Such keys were advertised as being full-length, but are | ||
415 | actually, half the time, smaller than advertised. | ||
416 | |||
417 | <p> | ||
418 | OpenSSH will print warning messages when it encounters such keys. To rid | ||
419 | yourself of these message, edit your <i>known_hosts</i> files and replace the | ||
420 | incorrect key length (usually "1024") with the correct key length | ||
421 | (usually "1023"). | ||
422 | |||
423 | <h2><a name= "2.7">2.7 - X11 and/or agent forwarding does not work.</a></h2> | ||
424 | |||
425 | <p> | ||
426 | Check your <i>ssh_config</i> and <i>sshd_config</i>. The default | ||
427 | configuration files disable authentication agent and X11 forwarding. To | ||
428 | enable it, put the line below in <i>sshd_config</i>: | ||
429 | |||
430 | <blockquote> | ||
431 | <table border=0 width="800"> | ||
432 | <tr> | ||
433 | <td nowrap bgcolor="#EEEEEE"> | ||
434 | <b>X11Forwarding yes</b> | ||
435 | </td> | ||
436 | </tr> | ||
437 | </table> | ||
438 | </blockquote> | ||
439 | |||
440 | <p> | ||
441 | and put the following lines in <i>ssh_config</i>: | ||
442 | |||
443 | <blockquote> | ||
444 | <table border=0 width="800"> | ||
445 | <tr> | ||
446 | <td nowrap bgcolor="#EEEEEE"> | ||
447 | <b>ForwardAgent yes</b><br> | ||
448 | <b>ForwardX11 yes</b> | ||
449 | </td> | ||
450 | </tr> | ||
451 | </table> | ||
452 | </blockquote> | ||
453 | |||
454 | <p> | ||
455 | X11 forwarding requires a working <a | ||
456 | href="http://www.openbsd.org/cgi-bin/man.cgi?query=xauth&sektion=1" | ||
457 | >xauth(1)</a> binary. On OpenBSD this is in the <i>xbase</i> file | ||
458 | set but will probably be different on other platforms. For OpenSSH | ||
459 | Portable, xauth must be either found at configure time or specified | ||
460 | via <b>XAuthLocation</b> in sshd_config(5) and ssh_config(5). | ||
461 | |||
462 | <p> | ||
463 | Note on agent interoperability: There are two different and | ||
464 | incompatible agent forwarding mechanisms within the SSH2 protocol. | ||
465 | OpenSSH has always used an extension of the original SSH1 agent | ||
466 | requests, however some commercial products use a different, non-free | ||
467 | agent forwarding protocol. This means that agent forwarding cannot | ||
468 | be used between OpenSSH and those products. | ||
469 | |||
470 | <p> | ||
471 | <b>NOTE:</b> For users of Linux Mandrake 7.2, Mandrake modifies the | ||
472 | <i>XAUTHORITY</i> environment variable in <i>/etc/skel/.bashrc</i>, | ||
473 | and thus any bash user's home directory. This variable is set by OpenSSH | ||
474 | and for either of the above options to work, you need to comment out | ||
475 | the line: | ||
476 | |||
477 | |||
478 | <blockquote> | ||
479 | <table border=0 width="800"> | ||
480 | <tr> | ||
481 | <td nowrap bgcolor="#EEEEEE"> | ||
482 | <b># export XAUTHORITY=$HOME/.Xauthority</b> | ||
483 | </td> | ||
484 | </tr> | ||
485 | </table> | ||
486 | </blockquote> | ||
487 | |||
488 | <h2><a name= "2.8">2.8 - After upgrading OpenSSH I lost SSH2 support.</a></h2> | ||
489 | |||
490 | <p> | ||
491 | Between versions changes can be made to <i>sshd_config</i> or | ||
492 | <i>ssh_config</i>. You should always check on these changes when upgrading | ||
493 | versions of OpenSSH. After OpenSSH Version 2.3.0 you need to add the | ||
494 | following to your <i>sshd_config</i>: | ||
495 | |||
496 | |||
497 | <blockquote> | ||
498 | <table border=0 width="800"> | ||
499 | <tr> | ||
500 | <td nowrap bgcolor="#EEEEEE"> | ||
501 | <b>HostKey /etc/ssh_host_dsa_key</b><br> | ||
502 | <b>HostKey /etc/ssh_host_rsa_key</b> | ||
503 | </td> | ||
504 | </tr> | ||
505 | </table> | ||
506 | </blockquote> | ||
507 | |||
508 | <h2><a name= "2.9">2.9 - sftp/scp fails at connection, but ssh is OK.</a></h2> | ||
509 | |||
510 | <p> | ||
511 | sftp and/or scp may fail at connection time if you have shell | ||
512 | initialization (.profile, .bashrc, .cshrc, etc) which produces output | ||
513 | for non-interactive sessions. This output confuses the sftp/scp client. | ||
514 | You can verify if your shell is doing this by executing: | ||
515 | |||
516 | <blockquote> | ||
517 | <table border=0 width="800"> | ||
518 | <tr> | ||
519 | <td nowrap bgcolor="#EEEEEE"> | ||
520 | <b>ssh yourhost /usr/bin/true</b> | ||
521 | </td> | ||
522 | </tr> | ||
523 | </table> | ||
524 | </blockquote> | ||
525 | |||
526 | <p> | ||
527 | If the above command produces any output, then you need to modify your | ||
528 | shell initialization. | ||
529 | |||
530 | <h2><a name= "2.10">2.10 - Will you add [foo] to scp?</a></h2> | ||
531 | |||
532 | <p> | ||
533 | Short Answer: no. | ||
534 | |||
535 | <p> | ||
536 | Long Answer: scp is not standardized. The closest thing it has to a | ||
537 | specification is "what rcp does". Since the same command is used on both ends | ||
538 | of the connection, adding features or options risks breaking interoperability with other | ||
539 | implementations. | ||
540 | |||
541 | <p> | ||
542 | New features are more likely in sftp, since the protocol is standardized | ||
543 | (well, a <a href="http://www.ietf.org/html.charters/OLD/secsh-charter.html"> | ||
544 | draft standard</a>), extensible, and the client and server are decoupled. | ||
545 | |||
546 | <h2><a name= "2.11">2.11 - How do I use port forwarding?</a></h2> | ||
547 | |||
548 | <p> | ||
549 | If the remote server is running sshd(8), it may be possible to | ||
550 | ``tunnel'' certain services via ssh. This may be desirable, for | ||
551 | example, to encrypt POP or SMTP connections, even though the software | ||
552 | does not directly support encrypted communications. Tunnelling uses | ||
553 | port forwarding to create a connection between the client and server. | ||
554 | The client software must be able to specify a non-standard port to | ||
555 | connect to for this to work. | ||
556 | |||
557 | <p> | ||
558 | The idea is that the user connects to the remote host using ssh, | ||
559 | and specifies which port on the client's machine should be used to | ||
560 | forward connections to the remote server. After that it is possible | ||
561 | to start the service which is to be encrypted (e.g. fetchmail, irc) | ||
562 | on the client machine, specifying the same local port passed to | ||
563 | ssh, and the connection will be tunnelled through ssh. By default, | ||
564 | the system running the forward will only accept connections from | ||
565 | itself. | ||
566 | |||
567 | <p> | ||
568 | The options most relevant to tunnelling are the -L and -R options, | ||
569 | which allow the user to forward connections, the -D option, which | ||
570 | permits dynamic port forwarding, the -g option, which permits other | ||
571 | hosts to use port forwards, and the -f option, which instructs ssh | ||
572 | to put itself in the background after authentication. See the <a | ||
573 | href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh&sektion=1" | ||
574 | >ssh(1)</a> man page for further details. | ||
575 | |||
576 | <p> | ||
577 | This is an example of tunnelling an IRC session from client machine | ||
578 | ``127.0.0.1'' (localhost) to remote server ``server.example.com'': | ||
579 | |||
580 | <blockquote> | ||
581 | <table border=0 width="800"> | ||
582 | <tr> | ||
583 | <td nowrap bgcolor="#EEEEEE"> | ||
584 | <b>ssh -f -L 1234:server.example.com:6667 server.example.com sleep 10<br> | ||
585 | irc -c '#users' -p 1234 pinky 127.0.0.1</b> | ||
586 | </td> | ||
587 | </tr> | ||
588 | </table> | ||
589 | </blockquote> | ||
590 | |||
591 | <p> | ||
592 | This tunnels a connection to IRC server server.example.com, joining | ||
593 | channel ``#users'', using the nickname ``pinky''. The local port used | ||
594 | in this example is 1234. It does not matter which port is used, as | ||
595 | long as it's greater than 1023 (remember, only root can open sockets on | ||
596 | privileged ports) and doesn't conflict with any ports already in use. | ||
597 | The connection is forwarded to port 6667 on the remote server, since | ||
598 | that's the standard port for IRC services. | ||
599 | |||
600 | <p> | ||
601 | The remote command ``sleep 10'' was specified to allow an amount | ||
602 | of time (10 seconds, in the example) to start the service which is to | ||
603 | be tunnelled. If no connections are made within the time specified, | ||
604 | ssh will exit. If more time is required, the sleep(1) value can be | ||
605 | increased appropriately or, alternatively, the example above could | ||
606 | be added as a function to the user's shell. See ksh(1) and csh(1) | ||
607 | for more details about user-defined functions. | ||
608 | |||
609 | <p> | ||
610 | ssh also has an -N option, convenient for use with port forwarding: | ||
611 | if -N is specified, it is not necessary to specify a remote command | ||
612 | (``sleep 10'' in the example above). However, use of this option | ||
613 | causes ssh to wait around for ever (as opposed to exiting after a | ||
614 | remote command has completed), and the user must take care to manually | ||
615 | kill(1) the process afterwards. | ||
616 | |||
617 | <h2><a name= "2.12">2.12 - My ssh connection freezes or drops out after N minutes of inactivity.</a></h2> | ||
618 | |||
619 | <p> | ||
620 | This is usually the result of a packet filter or NAT device | ||
621 | timing out your TCP connection due to inactivity. You can enable | ||
622 | <b>ClientAliveInterval</b> in the server's <i><a | ||
623 | href="http://www.openbsd.org/cgi-bin/man.cgi?query=sshd_config&sektion=5"> | ||
624 | sshd_config</a></i>, or enable <b>ServerAliveInterval</b> in the | ||
625 | client's <i><a | ||
626 | href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh_config&sektion=5"> | ||
627 | ssh_config</a></i> (the latter is available in OpenSSH 3.8 and newer). | ||
628 | |||
629 | <p> | ||
630 | Enabling either option and setting the interval for less than the time | ||
631 | it takes to time out your session will ensure that the connection is | ||
632 | kept "fresh" in the device's connection table. | ||
633 | |||
634 | <h2><a name= "2.13">2.13 - How do I use scp to copy a file with a colon in it?</a></h2> | ||
635 | |||
636 | <b><a | ||
637 | href="http://www.openbsd.org/cgi-bin/man.cgi?query=scp&sektion=1"> | ||
638 | scp</a></b> will interpret the component before the colon to be a remote | ||
639 | server name and attempt to connect to it. To prevent this, refer to | ||
640 | the file by a relative or absolute path, eg: | ||
641 | |||
642 | <blockquote> | ||
643 | <table border=0 width="800"> | ||
644 | <tr> | ||
645 | <td nowrap bgcolor="#EEEEEE"> | ||
646 | $ scp ./source:file sshserver: | ||
647 | </td> | ||
648 | </tr> | ||
649 | </table> | ||
650 | </blockquote> | ||
651 | |||
652 | <h2><a name= "2.14">2.14 - Why does OpenSSH report its version to clients?</a></h2> | ||
653 | |||
654 | <p> | ||
655 | OpenSSH, like most SSH implementations, reports its name and version to clients | ||
656 | when they connect, e.g. | ||
657 | </p> | ||
658 | |||
659 | <blockquote> | ||
660 | SSH-2.0-OpenSSH_3.9 | ||
661 | </blockquote> | ||
662 | |||
663 | <p> | ||
664 | This information is used by clients and servers to enable protocol | ||
665 | compatibility tweaks to work around changed, buggy or missing features in | ||
666 | the implementation they are talking to. This protocol feature checking is | ||
667 | still required at present because versions with incompatibilities are still | ||
668 | in wide use. | ||
669 | </p> | ||
670 | |||
671 | <h2><u><a name= "3.0">3.0 - Portable OpenSSH Questions</a></u></h2> | ||
672 | |||
673 | <h2><a name= "3.1">3.1 - Spurious PAM authentication messages in logfiles.</a></h2> | ||
674 | |||
675 | <p> | ||
676 | The portable version of OpenSSH will generate spurious authentication | ||
677 | failures at every login, similar to: | ||
678 | |||
679 | |||
680 | <blockquote> | ||
681 | <table border=0 width="800"> | ||
682 | <tr> | ||
683 | <td nowrap bgcolor="#EEEEEE"> | ||
684 | "<b>authentication failure; (uid=0) -> root for sshd service</b>" | ||
685 | </td> | ||
686 | </tr> | ||
687 | </table> | ||
688 | </blockquote> | ||
689 | |||
690 | <p> | ||
691 | These are generated because OpenSSH first tries to determine whether a | ||
692 | user needs authentication to login (e.g. empty password). Unfortunately | ||
693 | PAM likes to log all authentication events, this one included. | ||
694 | |||
695 | <p> | ||
696 | If it annoys you too much, set "<b>PermitEmptyPasswords no</b>" | ||
697 | in <i>sshd_config</i>. This will quiet the error message at the expense | ||
698 | of disabling logins to accounts with no password set. | ||
699 | This is the default if you use the supplied <i>sshd_config</i> file. | ||
700 | |||
701 | <h2><a name= "3.2">3.2 - Empty passwords not allowed with PAM authentication.</a></h2> | ||
702 | |||
703 | <p> | ||
704 | To enable empty passwords with a version of OpenSSH built with PAM you | ||
705 | must add the flag nullok to the end of the password checking module | ||
706 | in the <i>/etc/pam.d/sshd</i> file. For example: | ||
707 | |||
708 | <blockquote> | ||
709 | <table border=0 width="800"> | ||
710 | <tr> | ||
711 | <td nowrap bgcolor="#EEEEEE"> | ||
712 | auth required/lib/security/pam_unix.so shadow nodelay nullok | ||
713 | </td> | ||
714 | </tr> | ||
715 | </table> | ||
716 | </blockquote> | ||
717 | |||
718 | <p> | ||
719 | This must be done in addition to setting "<b>PermitEmptyPasswords | ||
720 | yes</b>" in the <i>sshd_config</i> file. | ||
721 | |||
722 | <p> | ||
723 | There is one caveat when using empty passwords with PAM authentication: | ||
724 | PAM will allow any password when authenticating an account with an empty | ||
725 | password. This breaks the check that | ||
726 | <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sshd&sektion=8">sshd(8)</a> | ||
727 | uses to determine whether an account has no password set and grant | ||
728 | users access to the account regardless of the policy specified by | ||
729 | <b>PermitEmptyPasswords</b>. For this reason, it is recommended that you | ||
730 | do not add the <b>nullok</b> directive to your PAM configuration file | ||
731 | unless you specifically wish to allow empty passwords. | ||
732 | |||
733 | |||
734 | <h2><a name= "3.3">3.3 - ssh(1) takes a long time to connect or log | ||
735 | in</a></h2> | ||
736 | |||
737 | <p> | ||
738 | Large delays (more that 10 seconds) are typically caused a problem with | ||
739 | name resolution: | ||
740 | <ul> | ||
741 | <li>Some versions of glibc (notably glibc 2.1 shipped with Red Hat 6.1) | ||
742 | can take a long time to resolve "IPv6 or IPv4" addresses from domain | ||
743 | names. This can be worked around with by specifying <b>AddressFamily | ||
744 | inet</b> option in <i>ssh_config</i>.</li> | ||
745 | |||
746 | <li>There may be a DNS lookup problem, either at the client or server. | ||
747 | You can use the <code>nslookup</code> command to check this on both client | ||
748 | and server by looking up the other end's name and IP address. In | ||
749 | addition, on the server look up the name returned by the client's | ||
750 | IP-name lookup. You can disable most of the server-side lookups by | ||
751 | setting <b>UseDNS no</b> in <i>sshd_config</i>.</li> | ||
752 | </ul> | ||
753 | |||
754 | <p> | ||
755 | Delays less than 10 seconds can have other causes. | ||
756 | |||
757 | <ul> | ||
758 | |||
759 | <li>OpenSSH releases prior to 3.8 had an <i>moduli</i> file with | ||
760 | moduli that were just smaller than what sshd would look for, and | ||
761 | as a result, sshd would end up using moduli significantly larger | ||
762 | than requested, which resulted in a speed penalty. Replacing the | ||
763 | <i>moduli</i> file will resolve this (note that in most cases this | ||
764 | file will not be replaced during an upgrade and must be replaced | ||
765 | manually).</li> | ||
766 | |||
767 | <li>OpenSSH releases prior to 3.8 had a flaw in <code>ssh</code> that | ||
768 | would cause it to request moduli larger than intended (which when | ||
769 | combined with the above resulted in significant slowdowns). | ||
770 | Upgrading the client to 3.8 or higher will resolve this issue.</li> | ||
771 | |||
772 | <li>If either the client or server lack a kernel-based random number | ||
773 | device (eg Solaris < 9, AIX < 5.2, HP-UX < 11.11) and no | ||
774 | substitute is available (eg <a href= | ||
775 | "ftp://ftp.ayamura.org/pub/prngd/">prngd</a>) it's possible that | ||
776 | one of the programs called by <code>ssh-rand-helper</code> to | ||
777 | generate entropy is hanging. This can be investigated by running | ||
778 | it in debug mode: | ||
779 | |||
780 | <blockquote> | ||
781 | <table border=0 width="800"> | ||
782 | <tr> | ||
783 | <td nowrap bgcolor="#EEEEEE"> | ||
784 | /usr/local/libexec/ssh-rand-helper -vvv | ||
785 | </td> | ||
786 | </tr> | ||
787 | </table> | ||
788 | </blockquote> | ||
789 | |||
790 | Any significant delays should be investigated and rectified, or the | ||
791 | corresponding commands should be removed from <i>ssh_prng_cmds</i>. | ||
792 | </li> | ||
793 | |||
794 | </ul> | ||
795 | |||
796 | <h3>How slow is "slow"?</h3> | ||
797 | Under normal conditions, the speed of SSH logins is dependant on | ||
798 | CPU speed of client and server. For comparison the following are | ||
799 | typical connect times for <code>time ssh localhost true</code> | ||
800 | with a 1024-bit RSA key on otherwise unloaded hosts. OpenSSH and | ||
801 | OpenSSL were compiled with gcc 3.3.x. | ||
802 | |||
803 | <p> | ||
804 | <table> | ||
805 | <tr><th>CPU</th><th>Time (SSHv1)<a href="#3.3fn1">[1]</a></th> | ||
806 | <th>Time (SSHv2)</th></tr> | ||
807 | <tr><td>170MHz SPARC/sun4m</td><td>0.74 sec</td><td>1.25 sec</td></tr> | ||
808 | <tr><td>236MHz HPPA/8200<a href="#3.3fn2">[2]</a></td><td>0.44 sec</td> | ||
809 | <td>0.79 sec</td></tr> | ||
810 | <tr><td>375MHz PowerPC/604e</td><td>0.38 sec</td><td>0.51 sec</td></tr> | ||
811 | <tr><td>933MHz VIA Ezra</td><td>0.34 sec</td><td>0.44 sec</td></tr> | ||
812 | <tr><td>2.1GHz Athlon XP 2600+</td><td>0.14 sec</td><td>0.22 sec</td></tr> | ||
813 | </table> | ||
814 | |||
815 | <br> | ||
816 | |||
817 | <a name="3.3fn1">[1]</a> The SSHv1 protocol is faster but is | ||
818 | cryptographically weaker than SSHv2.<br> | ||
819 | |||
820 | <a name="3.3fn2">[2]</a> At the time of writing, gcc generates | ||
821 | relatively slow code on HPPA for RSA and Diffie-Hellman operations | ||
822 | (see <a href= "http://gcc.gnu.org/bugzilla/show_bug.cgi?id=7625">gcc | ||
823 | bug #7625</a> and <a | ||
824 | href="http://marc.info/?l=openssh-unix-dev&m=102646106016694"> | ||
825 | discussion on openssh-unix-dev</a>). | ||
826 | |||
827 | <h2><a name= "3.4">3.4 - "Can't locate module net-pf-10" messages in log under Linux.</a></h2> | ||
828 | |||
829 | <p> | ||
830 | The Linux kernel is looking (via modprobe) for protocol family 10 (IPv6). | ||
831 | Either load the appropriate kernel module, enter the correct alias in | ||
832 | <i>/etc/modules.conf</i> or disable IPv6 in <i>/etc/modules.conf</i>. | ||
833 | |||
834 | |||
835 | <p> | ||
836 | For some silly reason <i>/etc/modules.conf</i> may also be named | ||
837 | <i>/etc/conf.modules</i>. | ||
838 | |||
839 | |||
840 | <h2><a name= "3.5">3.5 - Password authentication doesn't work (eg on Slackware 7.0 or Red Hat 6.x)</a></h2> | ||
841 | |||
842 | <p> | ||
843 | If the password is correct password the login is still denied, the | ||
844 | usual cause is that the system is configured to use MD5-type passwords | ||
845 | but the | ||
846 | <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=crypt&sektion=3" | ||
847 | >crypt(3)</a> function used by sshd doesn't understand them. | ||
848 | |||
849 | <p> | ||
850 | Affected accounts will have password strings in <i>/etc/passwd</i> | ||
851 | or <i>/etc/shadow</i> that start with <b>$1$</b>. | ||
852 | If password authentication fails for new accounts or accounts with | ||
853 | recently changed passwords, but works for old accounts, this is the | ||
854 | likely culprit. | ||
855 | |||
856 | <p> | ||
857 | The underlying cause is that some versions of OpenSSL have a crypt(3) | ||
858 | function that does not understand MD5 passwords, and the link order of | ||
859 | sshd means that OpenSSL's crypt(3) is used instead of the system's. | ||
860 | OpensSSH's configure attempts to correct for this but is not always | ||
861 | successful. | ||
862 | |||
863 | <p> | ||
864 | There are several possible solutions: | ||
865 | |||
866 | <ul> | ||
867 | <li> | ||
868 | <p> | ||
869 | Enable sshd's built-in support for MD5 passwords at build time. | ||
870 | |||
871 | <blockquote> | ||
872 | <table border=0 width="800"> | ||
873 | <tr> | ||
874 | <td nowrap bgcolor="#EEEEEE"> | ||
875 | ./configure --with-md5-passwords [options] | ||
876 | </td> | ||
877 | </tr> | ||
878 | </table> | ||
879 | </blockquote> | ||
880 | |||
881 | This is safe even if you have both types of encryption as sshd will | ||
882 | select the correct algorithm for each account automatically. | ||
883 | |||
884 | <li> | ||
885 | <p> | ||
886 | If your system has a separate libcrypt library (eg Slackware 7) then you | ||
887 | can manually add -lcrypt to the LIBS list so it's used instead of | ||
888 | OpenSSL's: | ||
889 | |||
890 | <blockquote> | ||
891 | <table border=0 width="800"> | ||
892 | <tr> | ||
893 | <td nowrap bgcolor="#EEEEEE"> | ||
894 | LIBS=-lcrypt ./configure [options] | ||
895 | </td> | ||
896 | </tr> | ||
897 | </table> | ||
898 | </blockquote> | ||
899 | |||
900 | <li> | ||
901 | <p> | ||
902 | If your platforms supports PAM, you may configure sshd to use it | ||
903 | (see <a href= "#3.15" >section 3.15</a>). This will mean that sshd will | ||
904 | not verify passwords itself but will defer to the configured PAM modules. | ||
905 | </ul> | ||
906 | |||
907 | <h2><a name= "3.6">3.6 - Configure or sshd(8) complain about lack of RSA or DSA support</a></h2> | ||
908 | |||
909 | <p> | ||
910 | Ensure that your OpenSSL libraries have been built to include RSA or DSA | ||
911 | support either internally or through RSAref. | ||
912 | |||
913 | |||
914 | <h2><a name= "3.7">3.7 - "scp: command not found" errors</a></h2> | ||
915 | |||
916 | <p> | ||
917 | <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=scp&sektion=1">scp(1)</a> | ||
918 | must be in the default PATH on both the client and the server. You may | ||
919 | need to use the <b>--with-default-path</b> option to specify a custom | ||
920 | path to search on the server. This option replaces the default path, | ||
921 | so you need to specify all the current directories on your path as well | ||
922 | as where you have installed scp. For example: | ||
923 | |||
924 | <blockquote> | ||
925 | <table border=0 width="800"> | ||
926 | <tr> | ||
927 | <td nowrap bgcolor="#EEEEEE"> | ||
928 | $ <b>./configure --with-default-path=/bin:/usr/bin:/usr/local/bin:/path/to/scp</b> | ||
929 | </td> | ||
930 | </tr> | ||
931 | </table> | ||
932 | </blockquote> | ||
933 | |||
934 | <p> | ||
935 | Note that configuration by the server's admin will take precedence over the | ||
936 | setting of <b>--with-default-path</b>. This includes resetting PATH in | ||
937 | <i>/etc/profile</i>, PATH in <i>/etc/environment</i> on AIX, or (for 3.7p1 and | ||
938 | above) setting PATH or SUPATH in <i>/etc/default/login</i> on Solaris or | ||
939 | Reliant Unix. | ||
940 | |||
941 | <h2><a name= "3.8">3.8 - Unable to read passphrase</a></h2> | ||
942 | |||
943 | <p> | ||
944 | Some operating systems set <i>/dev/tty</i> with incorrect modes, causing | ||
945 | the reading of passwords to fail with the following error: | ||
946 | |||
947 | <blockquote> | ||
948 | <table border=0 width="800"> | ||
949 | <tr> | ||
950 | <td nowrap bgcolor="#EEEEEE"> | ||
951 | You have no controlling tty. Cannot read passphrase. | ||
952 | </td> | ||
953 | </tr> | ||
954 | </table> | ||
955 | </blockquote> | ||
956 | |||
957 | <p> | ||
958 | The solution to this is to reset the permissions on <i>/dev/tty</i> | ||
959 | to mode 0666 and report the error as a bug to your OS vendor. | ||
960 | |||
961 | |||
962 | <h2><a name= "3.9">3.9 - 'configure' missing or make fails</a></h2> | ||
963 | |||
964 | <p> | ||
965 | If there is no 'configure' file in the tar.gz file that you downloaded | ||
966 | or make fails with "missing separator" errors, you have probably | ||
967 | downloaded the OpenBSD distribution of OpenSSH and are attempting to | ||
968 | compile it on another platform. Please refer to the information on the | ||
969 | <a href="http://www.openssh.org/portable.html">portable version</a>. | ||
970 | |||
971 | |||
972 | <h2><a name= "3.10">3.10 - Hangs when exiting ssh</a></h2> | ||
973 | |||
974 | <p> | ||
975 | OpenSSH may hang when exiting. This can occur when there is an active | ||
976 | background process. This is known to occur on Linux and HP-UX. | ||
977 | The problem can be verified by doing the following: | ||
978 | |||
979 | <blockquote> | ||
980 | <table border=0 width="800"> | ||
981 | <tr> | ||
982 | <td nowrap bgcolor="#EEEEEE"> | ||
983 | $ <b>sleep 20 & exit</b> | ||
984 | </td> | ||
985 | </tr> | ||
986 | </table> | ||
987 | </blockquote> | ||
988 | |||
989 | Try to use this instead: | ||
990 | <blockquote> | ||
991 | <table border=0 width="800"> | ||
992 | <tr> | ||
993 | <td nowrap bgcolor="#EEEEEE"> | ||
994 | $ <b>sleep 20 < /dev/null > /dev/null 2>&1 &</b> | ||
995 | </td> | ||
996 | </tr> | ||
997 | </table> | ||
998 | </blockquote> | ||
999 | |||
1000 | <p> | ||
1001 | A work around for bash users is to place <b>"shopt -s huponexit"</b> | ||
1002 | in either /etc/bashrc or ~/.bashrc. Otherwise, consult your shell's | ||
1003 | man page for an option to enable it to send a HUP signal to active | ||
1004 | jobs when exiting. See <a | ||
1005 | href="http://bugzilla.mindrot.org/show_bug.cgi?id=52">bug #52</a> | ||
1006 | for other workarounds. | ||
1007 | |||
1008 | <h2><a name= "3.11">3.11 - Why does ssh hang on exit?</a></h2> | ||
1009 | |||
1010 | <p> | ||
1011 | When executing | ||
1012 | <blockquote> | ||
1013 | <table border=0 width="800"> | ||
1014 | <tr> | ||
1015 | <td nowrap bgcolor="#EEEEEE"> | ||
1016 | $ <b>ssh host command</b> | ||
1017 | </td> | ||
1018 | </tr> | ||
1019 | </table> | ||
1020 | </blockquote> | ||
1021 | ssh <b>needs</b> to hang, because it needs to wait: | ||
1022 | <ul> | ||
1023 | <li> | ||
1024 | until it can be sure that <code>command</code> does not need | ||
1025 | more input. | ||
1026 | <li> | ||
1027 | until it can be sure that <code>command</code> does not produce | ||
1028 | more output. | ||
1029 | <li> | ||
1030 | until <code>command</code> exits because sshd needs to tell | ||
1031 | the exit status from <code>command</code> to ssh. | ||
1032 | </ul> | ||
1033 | <p> | ||
1034 | |||
1035 | <h2><a name= "3.12">3.12 - I upgraded to OpenSSH 3.1 and X11 | ||
1036 | forwarding stopped working.</a></h2> | ||
1037 | |||
1038 | Starting with OpenSSH 3.1, the sshd x11 forwarding server listens on | ||
1039 | localhost by default; see the sshd <b>X11UseLocalhost</b> option to | ||
1040 | revert to prior behaviour if your older X11 clients do not function | ||
1041 | with this configuration.<p> | ||
1042 | |||
1043 | In general, X11 clients using X11 R6 should work with the default | ||
1044 | setting. Some vendors, including HP, ship X11 clients with R6 | ||
1045 | and R5 libs, so some clients will work, and others will not work. | ||
1046 | This is true for HP-UX 11.X.<p> | ||
1047 | |||
1048 | <h2><a name= "3.13">3.13 - I upgraded to OpenSSH 3.8 and some | ||
1049 | X11 programs stopped working.</a></h2> | ||
1050 | |||
1051 | <p> | ||
1052 | As documented in the <a href="http://www.openssh.org/txt/release-3.8">3.8 release notes</a>, | ||
1053 | <code>ssh</code> will now use untrusted X11 cookies by | ||
1054 | default. The previous behaviour can be restored by setting | ||
1055 | <b>ForwardX11Trusted yes</b> in <i>ssh_config</i>. | ||
1056 | |||
1057 | <p> | ||
1058 | Possible symptoms include:<br> | ||
1059 | <code>BadWindow (invalid Window parameter)<br> | ||
1060 | BadAccess (attempt to access private resource denied)<br> | ||
1061 | X Error of failed request: BadAtom (invalid Atom parameter)<br> | ||
1062 | Major opcode of failed request: 20 (X_GetProperty)<br></code> | ||
1063 | |||
1064 | <h2><a name= "3.14">3.14 - I copied my public key to authorized_keys | ||
1065 | but public-key authentication still doesn't work.</a></h2> | ||
1066 | |||
1067 | <p> | ||
1068 | Typically this is caused by the file permissions on $HOME, $HOME/.ssh or | ||
1069 | $HOME/.ssh/authorized_keys being more permissive than sshd allows by default. | ||
1070 | |||
1071 | <p> | ||
1072 | In this case, it can be solved by executing the following on the server. | ||
1073 | <blockquote> | ||
1074 | <table border=0 width="800"> | ||
1075 | <tr> | ||
1076 | <td nowrap bgcolor="#EEEEEE"> | ||
1077 | $ <b>chmod go-w $HOME $HOME/.ssh</b><br> | ||
1078 | $ <b>chmod 600 $HOME/.ssh/authorized_keys</b> | ||
1079 | $ <b>chown `whoami` $HOME/.ssh/authorized_keys</b><br> | ||
1080 | </td> | ||
1081 | </tr> | ||
1082 | </table> | ||
1083 | </blockquote> | ||
1084 | |||
1085 | <p> | ||
1086 | If this is not possible for some reason, an alternative is to set | ||
1087 | <b>StrictModes no</b> in <i>sshd_config</i>, however this is not | ||
1088 | recommended. | ||
1089 | |||
1090 | <h2><a name= "3.15">3.15 - OpenSSH versions and PAM behaviour.</a></h2> | ||
1091 | |||
1092 | Portable OpenSSH has a configure-time option to enable sshd's use of the | ||
1093 | <a href="http://www.opengroup.org/onlinepubs/008329799/">PAM</a> | ||
1094 | (Pluggable Authentication Modules) interface. | ||
1095 | |||
1096 | <blockquote> | ||
1097 | <table border=0 width="800"> | ||
1098 | <tr> | ||
1099 | <td nowrap bgcolor="#EEEEEE"> | ||
1100 | ./configure --with-pam [options] | ||
1101 | </td> | ||
1102 | </tr> | ||
1103 | </table> | ||
1104 | </blockquote> | ||
1105 | |||
1106 | To use PAM at all, this option must be provided at build time. | ||
1107 | The run-time behaviour when PAM is built in varies with the version of | ||
1108 | Portable OpenSSH, and on later versions it must also be enabled by setting | ||
1109 | <b>UsePAM</b> to <b>yes</b> in <i>sshd_config</i>. | ||
1110 | |||
1111 | <p> | ||
1112 | The behaviour of the relevant authentications options when PAM support is built | ||
1113 | in is summarised by the following table. | ||
1114 | |||
1115 | <p> | ||
1116 | <table border="1"> | ||
1117 | <tr> <th>Version</th> <th>UsePAM</th> <th>PasswordAuthentication</th> <th>ChallengeResponseAuthentication</th> </tr> | ||
1118 | <tr> | ||
1119 | <td><=3.6.1p2</td> | ||
1120 | <td>Not applicable</td> | ||
1121 | <td>Uses PAM</td> | ||
1122 | <td>Uses PAM if <b>PAMAuthenticationViaKbdInt</b> is enabled</td> | ||
1123 | </tr> | ||
1124 | <tr> | ||
1125 | <td>3.7p1 - 3.7.1p1</td> | ||
1126 | <td>Defaults to <b>yes</b></td> | ||
1127 | <td>Does not use PAM</td> | ||
1128 | <td>Uses PAM if <b>UsePAM</b> is enabled</td> | ||
1129 | </tr> | ||
1130 | <tr> | ||
1131 | <td>3.7.1p2 - 3.8.1p1</td> | ||
1132 | <td>Defaults to <b>no</b></td> | ||
1133 | <td>Does not use PAM <a href="#3.15fn1">[1]</a></td> | ||
1134 | <td>Uses PAM if <b>UsePAM</b> is enabled</td> | ||
1135 | </tr> | ||
1136 | <tr> | ||
1137 | <td>3.9p1</td> | ||
1138 | <td>Defaults to <b>no</b></td> | ||
1139 | <td>Uses PAM if <b>UsePAM</b> is enabled</td> | ||
1140 | <td>Uses PAM if <b>UsePAM</b> is enabled</td> | ||
1141 | </tr> | ||
1142 | </table> | ||
1143 | <p> | ||
1144 | |||
1145 | <a name= "3.15fn1">[1]</a> Some vendors, notably Redhat/Fedora, have | ||
1146 | backported the PasswordAuthentication from 3.9p1 to their 3.8x based | ||
1147 | packages. If you're using a vendor-supplied package then consult their | ||
1148 | documentation. | ||
1149 | |||
1150 | <p> | ||
1151 | OpenSSH Portable's PAM interface still has problems with a few modules, | ||
1152 | however we hope that this number will reduce in the future. As at the | ||
1153 | 3.9p1 release, the known problems are: | ||
1154 | |||
1155 | <ul> | ||
1156 | <li>Modules relying on module-private data (eg pam_dhkeys, pam_krb5, AFS) | ||
1157 | may fail to correctly establish credentials (bug <a | ||
1158 | href="http://bugzilla.mindrot.org/show_bug.cgi?id=688">#688</a>) when | ||
1159 | authenticating via <b>ChallengeResponseAuthentication</b>. | ||
1160 | <b>PasswordAuthentication</b> with 3.9p1 and above should work. | ||
1161 | </ul> | ||
1162 | |||
1163 | You can also check <a | ||
1164 | href="http://bugzilla.mindrot.org/buglist.cgi?product=Portable+OpenSSH&bug_status=RESOLVED&bug_status=NEW&bug_status=ACCEPTED&component=PAM+support" | ||
1165 | >bugzilla for current PAM issues</a>. | ||
1166 | |||
1167 | <h2><a name= "3.16">3.16 - Why doesn't "w" or "who" on AIX 5.x show users | ||
1168 | logged in via ssh?</a></h2> | ||
1169 | |||
1170 | Between AIX 4.3.3 and AIX 5.x, the format of the wtmp struct changed. This | ||
1171 | means that sshd binaries built on AIX 4.x will not correctly write wtmp | ||
1172 | entries when run on AIX 5.x. This can be fixed by simply recompiling | ||
1173 | sshd on an AIX 5.x system and using that. | ||
1174 | |||
1175 | <hr> | ||
1176 | <a href="http://www.openssh.org/index.html"><img height=24 width=24 src="back.gif" border=0 alt=OpenSSH></a> | ||
1177 | <a href="mailto:www@openbsd.org">www@openbsd.org</a> | ||
1178 | <br> | ||
1179 | <small>$OpenBSD: faq.html,v 1.110 2009/11/23 23:38:17 dtucker Exp $</small> | ||
1180 | |||
1181 | </body> | ||
1182 | </html> | ||
diff --git a/debian/gnome-ssh-askpass.1 b/debian/gnome-ssh-askpass.1 new file mode 100644 index 000000000..b74c410a8 --- /dev/null +++ b/debian/gnome-ssh-askpass.1 | |||
@@ -0,0 +1,51 @@ | |||
1 | .TH GNOME-SSH-ASKPASS 1 | ||
2 | .SH NAME | ||
3 | gnome\-ssh\-askpass \- prompts a user for a passphrase using GNOME | ||
4 | .SH SYNOPSIS | ||
5 | .B gnome\-ssh\-askpass | ||
6 | .SH DESCRIPTION | ||
7 | .B gnome\-ssh\-askpass | ||
8 | is a GNOME-based passphrase dialog for use with OpenSSH. | ||
9 | It is intended to be called by the | ||
10 | .BR ssh\-add (1) | ||
11 | program and not invoked directly. | ||
12 | It allows | ||
13 | .BR ssh\-add (1) | ||
14 | to obtain a passphrase from a user, even if not connected to a terminal | ||
15 | (assuming that an X display is available). | ||
16 | This happens automatically in the case where | ||
17 | .B ssh\-add | ||
18 | is invoked from one's | ||
19 | .B ~/.xsession | ||
20 | or as one of the GNOME startup programs, for example. | ||
21 | .PP | ||
22 | In order to be called automatically by | ||
23 | .BR ssh\-add , | ||
24 | .B gnome\-ssh\-askpass | ||
25 | should be installed as | ||
26 | .IR /usr/bin/ssh\-askpass . | ||
27 | .SH "ENVIRONMENT VARIABLES" | ||
28 | The following environment variables are recognized: | ||
29 | .TP | ||
30 | .I GNOME_SSH_ASKPASS_GRAB_SERVER | ||
31 | Causes | ||
32 | .B gnome\-ssh\-askpass | ||
33 | to grab the X server before asking for a passphrase. | ||
34 | .TP | ||
35 | .I GNOME_SSH_ASKPASS_GRAB_POINTER | ||
36 | Causes | ||
37 | .B gnome\-ssh\-askpass | ||
38 | to grab the mouse pointer using | ||
39 | .IR gdk_pointer_grab () | ||
40 | before asking for a passphrase. | ||
41 | .PP | ||
42 | Regardless of whether either of these environment variables is set, | ||
43 | .B gnome\-ssh\-askpass | ||
44 | will grab the keyboard using | ||
45 | .IR gdk_keyboard_grab (). | ||
46 | .SH AUTHOR | ||
47 | This manual page was written by Colin Watson <cjwatson@debian.org> | ||
48 | for the Debian system (but may be used by others). | ||
49 | It was based on that for | ||
50 | .B x11\-ssh\-askpass | ||
51 | by Philip Hands. | ||
diff --git a/debian/openssh-client-udeb.dirs b/debian/openssh-client-udeb.dirs new file mode 100644 index 000000000..e77248175 --- /dev/null +++ b/debian/openssh-client-udeb.dirs | |||
@@ -0,0 +1 @@ | |||
usr/bin | |||
diff --git a/debian/openssh-client-udeb.install b/debian/openssh-client-udeb.install new file mode 100644 index 000000000..b3891f02d --- /dev/null +++ b/debian/openssh-client-udeb.install | |||
@@ -0,0 +1,3 @@ | |||
1 | scp usr/bin | ||
2 | sftp usr/bin | ||
3 | ssh usr/bin | ||
diff --git a/debian/openssh-client.config b/debian/openssh-client.config new file mode 100644 index 000000000..736e464ed --- /dev/null +++ b/debian/openssh-client.config | |||
@@ -0,0 +1,26 @@ | |||
1 | #!/bin/sh | ||
2 | |||
3 | action=$1 | ||
4 | version=$2 | ||
5 | |||
6 | # Source debconf library. | ||
7 | . /usr/share/debconf/confmodule | ||
8 | db_version 2.0 | ||
9 | |||
10 | if [ -d /etc/ssh-nonfree ] && [ ! -d /etc/ssh ]; then | ||
11 | version=1.2.27 | ||
12 | cp -a /etc/ssh-nonfree /etc/ssh | ||
13 | fi | ||
14 | |||
15 | # Was ssh-keysign's setuid bit turned off using the obsolete debconf | ||
16 | # question? If so, turn this into a statoverride. (Ugh.) | ||
17 | if dpkg --compare-versions "$2" lt 1:4.1p1-2 && \ | ||
18 | db_get ssh/SUID_client && [ "$RET" = false ] && | ||
19 | [ -x /usr/sbin/dpkg-statoverride ] && \ | ||
20 | ! dpkg-statoverride --list /usr/lib/ssh-keysign && \ | ||
21 | ! dpkg-statoverride --list /usr/lib/openssh/ssh-keysign; then | ||
22 | dpkg-statoverride --update --add root root 0755 \ | ||
23 | /usr/lib/openssh/ssh-keysign | ||
24 | fi | ||
25 | |||
26 | exit 0 | ||
diff --git a/debian/openssh-client.dirs b/debian/openssh-client.dirs new file mode 100644 index 000000000..1da8fba83 --- /dev/null +++ b/debian/openssh-client.dirs | |||
@@ -0,0 +1 @@ | |||
usr/share/lintian/overrides | |||
diff --git a/debian/openssh-client.docs b/debian/openssh-client.docs new file mode 100644 index 000000000..00fd691c4 --- /dev/null +++ b/debian/openssh-client.docs | |||
@@ -0,0 +1,7 @@ | |||
1 | ChangeLog.gssapi | ||
2 | OVERVIEW | ||
3 | README | ||
4 | README.dns | ||
5 | README.tun | ||
6 | debian/faq.html | ||
7 | debian/README.compromised-keys | ||
diff --git a/debian/openssh-client.install b/debian/openssh-client.install new file mode 100644 index 000000000..fd9e8feab --- /dev/null +++ b/debian/openssh-client.install | |||
@@ -0,0 +1,29 @@ | |||
1 | etc/ssh/moduli | ||
2 | etc/ssh/ssh_config | ||
3 | usr/bin/scp | ||
4 | usr/bin/sftp | ||
5 | usr/bin/slogin | ||
6 | usr/bin/ssh | ||
7 | usr/bin/ssh-add | ||
8 | usr/bin/ssh-agent | ||
9 | usr/bin/ssh-keygen | ||
10 | usr/bin/ssh-keyscan | ||
11 | usr/bin/ssh-vulnkey | ||
12 | usr/lib/openssh/ssh-keysign | ||
13 | usr/lib/openssh/ssh-pkcs11-helper | ||
14 | usr/share/man/man1/scp.1 | ||
15 | usr/share/man/man1/sftp.1 | ||
16 | usr/share/man/man1/slogin.1 | ||
17 | usr/share/man/man1/ssh-add.1 | ||
18 | usr/share/man/man1/ssh-agent.1 | ||
19 | usr/share/man/man1/ssh-keygen.1 | ||
20 | usr/share/man/man1/ssh-keyscan.1 | ||
21 | usr/share/man/man1/ssh-vulnkey.1 | ||
22 | usr/share/man/man1/ssh.1 | ||
23 | usr/share/man/man5/moduli.5 | ||
24 | usr/share/man/man5/ssh_config.5 | ||
25 | usr/share/man/man8/ssh-keysign.8 | ||
26 | usr/share/man/man8/ssh-pkcs11-helper.8 | ||
27 | |||
28 | contrib/ssh-copy-id usr/bin | ||
29 | debian/ssh-argv0 usr/bin | ||
diff --git a/debian/openssh-client.lintian-overrides b/debian/openssh-client.lintian-overrides new file mode 100644 index 000000000..8c4bd1751 --- /dev/null +++ b/debian/openssh-client.lintian-overrides | |||
@@ -0,0 +1,2 @@ | |||
1 | openssh-client: setuid-binary usr/lib/openssh/ssh-keysign 4755 root/root | ||
2 | openssh-client: no-debconf-templates | ||
diff --git a/debian/openssh-client.manpages b/debian/openssh-client.manpages new file mode 100644 index 000000000..690bd8a22 --- /dev/null +++ b/debian/openssh-client.manpages | |||
@@ -0,0 +1,2 @@ | |||
1 | contrib/ssh-copy-id.1 | ||
2 | debian/ssh-argv0.1 | ||
diff --git a/debian/openssh-client.postinst b/debian/openssh-client.postinst new file mode 100644 index 000000000..cff282d70 --- /dev/null +++ b/debian/openssh-client.postinst | |||
@@ -0,0 +1,115 @@ | |||
1 | #!/bin/sh -e | ||
2 | |||
3 | action="$1" | ||
4 | oldversion="$2" | ||
5 | |||
6 | . /usr/share/debconf/confmodule | ||
7 | db_version 2.0 | ||
8 | |||
9 | umask 022 | ||
10 | |||
11 | if [ "$action" != configure ] | ||
12 | then | ||
13 | exit 0 | ||
14 | fi | ||
15 | |||
16 | |||
17 | fix_rsh_diversion() { | ||
18 | # get rid of mistaken rsh diversion (circa 1.2.27-1) | ||
19 | |||
20 | if [ -L /usr/bin/rsh ] && | ||
21 | dpkg-divert --list '/usr/bin/rsh.real/rsh' | grep -q ' ssh$' ; then | ||
22 | for cmd in rlogin rsh rcp ; do | ||
23 | [ -L /usr/bin/$cmd ] && rm /usr/bin/$cmd | ||
24 | dpkg-divert --package ssh --remove --rename \ | ||
25 | --divert /usr/bin/rsh.real/$cmd /usr/bin/$cmd | ||
26 | |||
27 | [ -L /usr/man/man1/$cmd.1.gz ] && rm /usr/man/man1/$$cmd.1.gz | ||
28 | dpkg-divert --package ssh --remove --rename \ | ||
29 | --divert /usr/man/man1/$cmd.real.1.gz /usr/man/man1/$cmd.1.gz | ||
30 | done | ||
31 | |||
32 | rmdir /usr/bin/rsh.real | ||
33 | fi | ||
34 | } | ||
35 | |||
36 | create_alternatives() { | ||
37 | # Create alternatives for the various r* tools. | ||
38 | # Make sure we don't change existing alternatives that a user might have | ||
39 | # changed, but clean up after some old alternatives that mistakenly pointed | ||
40 | # rlogin and rcp to ssh. | ||
41 | update-alternatives --quiet --remove rlogin /usr/bin/ssh | ||
42 | update-alternatives --quiet --remove rcp /usr/bin/ssh | ||
43 | for cmd in rsh rlogin rcp; do | ||
44 | scmd="s${cmd#r}" | ||
45 | if ! update-alternatives --display "$cmd" 2>/dev/null | \ | ||
46 | grep -q "$scmd"; then | ||
47 | update-alternatives --quiet --install "/usr/bin/$cmd" "$cmd" "/usr/bin/$scmd" 20 \ | ||
48 | --slave "/usr/share/man/man1/$cmd.1.gz" "$cmd.1.gz" "/usr/share/man/man1/$scmd.1.gz" | ||
49 | fi | ||
50 | done | ||
51 | } | ||
52 | |||
53 | set_ssh_permissions() { | ||
54 | if dpkg --compare-versions "$oldversion" lt-nl 1:3.4p1-1 ; then | ||
55 | if [ -x /usr/sbin/dpkg-statoverride ] ; then | ||
56 | if dpkg-statoverride --list /usr/bin/ssh >/dev/null; then | ||
57 | dpkg-statoverride --remove /usr/bin/ssh >/dev/null | ||
58 | fi | ||
59 | fi | ||
60 | fi | ||
61 | |||
62 | # libexecdir changed, so migrate old statoverrides. | ||
63 | if [ -x /usr/sbin/dpkg-statoverride ] && | ||
64 | override="$(dpkg-statoverride --list /usr/lib/ssh-keysign)"; then | ||
65 | override_user="${override%% *}" | ||
66 | override="${override#* }" | ||
67 | override_group="${override%% *}" | ||
68 | override="${override#* }" | ||
69 | override_mode="${override%% *}" | ||
70 | if dpkg-statoverride --update --add \ | ||
71 | "$override_user" "$override_group" "$override_mode" \ | ||
72 | /usr/lib/openssh/ssh-keysign; then | ||
73 | dpkg-statoverride --remove /usr/lib/ssh-keysign || true | ||
74 | fi | ||
75 | fi | ||
76 | } | ||
77 | |||
78 | fix_ssh_group() { | ||
79 | # Try to remove non-system group mistakenly created by 1:3.5p1-1. | ||
80 | # set_ssh_agent_permissions() below will re-create it properly. | ||
81 | if getent group ssh >/dev/null; then | ||
82 | delgroup --quiet ssh || true | ||
83 | fi | ||
84 | } | ||
85 | |||
86 | set_ssh_agent_permissions() { | ||
87 | if ! getent group ssh >/dev/null; then | ||
88 | addgroup --system --quiet ssh | ||
89 | fi | ||
90 | if ! [ -x /usr/sbin/dpkg-statoverride ] || \ | ||
91 | ! dpkg-statoverride --list /usr/bin/ssh-agent >/dev/null ; then | ||
92 | chgrp ssh /usr/bin/ssh-agent | ||
93 | chmod 2755 /usr/bin/ssh-agent | ||
94 | fi | ||
95 | } | ||
96 | |||
97 | commit_transfer_conffile () { | ||
98 | CONFFILE="$1" | ||
99 | if [ -e "$CONFFILE.moved-by-preinst" ]; then | ||
100 | rm -f "$CONFFILE.moved-by-preinst" | ||
101 | fi | ||
102 | } | ||
103 | |||
104 | |||
105 | fix_rsh_diversion | ||
106 | create_alternatives | ||
107 | set_ssh_permissions | ||
108 | if [ "$2" = "1:3.5p1-1" ]; then | ||
109 | fix_ssh_group | ||
110 | fi | ||
111 | set_ssh_agent_permissions | ||
112 | commit_transfer_conffile /etc/ssh/moduli | ||
113 | commit_transfer_conffile /etc/ssh/ssh_config | ||
114 | |||
115 | exit 0 | ||
diff --git a/debian/openssh-client.postrm b/debian/openssh-client.postrm new file mode 100644 index 000000000..eb6fde06b --- /dev/null +++ b/debian/openssh-client.postrm | |||
@@ -0,0 +1,34 @@ | |||
1 | #!/bin/sh -e | ||
2 | |||
3 | #DEBHELPER# | ||
4 | |||
5 | abort_transfer_conffile () { | ||
6 | CONFFILE="$1" | ||
7 | if [ -e "$CONFFILE.moved-by-preinst" ]; then | ||
8 | echo >&2 "Aborting ownership transfer of conffile $CONFFILE ..." | ||
9 | mv -f "$CONFFILE.moved-by-preinst" "$CONFFILE" | ||
10 | return 0 | ||
11 | fi | ||
12 | } | ||
13 | |||
14 | case $1 in | ||
15 | abort-install|abort-upgrade) | ||
16 | abort_transfer_conffile /etc/ssh/moduli | ||
17 | abort_transfer_conffile /etc/ssh/ssh_config | ||
18 | ;; | ||
19 | purge) | ||
20 | # Remove all non-conffiles that ssh might create, so that we | ||
21 | # can smoothly remove /etc/ssh if and only if the user | ||
22 | # hasn't dropped some other files in there. Conffiles have | ||
23 | # already been removed at this point. | ||
24 | rm -f /etc/ssh/moduli /etc/ssh/primes | ||
25 | rm -f /etc/ssh/ssh_known_hosts /etc/ssh/ssh_known_hosts2 | ||
26 | rmdir --ignore-fail-on-non-empty /etc/ssh | ||
27 | |||
28 | if which delgroup; then | ||
29 | delgroup --quiet ssh > /dev/null || true | ||
30 | fi | ||
31 | ;; | ||
32 | esac | ||
33 | |||
34 | exit 0 | ||
diff --git a/debian/openssh-client.preinst b/debian/openssh-client.preinst new file mode 100644 index 000000000..0b29c051d --- /dev/null +++ b/debian/openssh-client.preinst | |||
@@ -0,0 +1,49 @@ | |||
1 | #! /bin/sh -e | ||
2 | |||
3 | ETC_SSH_MODULI=@ETC_SSH_MODULI@ | ||
4 | |||
5 | ETC_SSH_SSH_CONFIG=@ETC_SSH_SSH_CONFIG@ | ||
6 | |||
7 | action="$1" | ||
8 | version="$2" | ||
9 | |||
10 | prepare_transfer_conffile () { | ||
11 | CONFFILE="$1" | ||
12 | TEXT="$2" | ||
13 | MODE="$3" | ||
14 | [ "$CONFFILES" ] || return 0 | ||
15 | [ -e "$CONFFILE" ] || return 0 | ||
16 | |||
17 | md5sum="$(md5sum "$CONFFILE" |sed -e 's/ .*//')" | ||
18 | old_md5sum="$(echo "$CONFFILES" | awk '$1 == "'"$CONFFILE"'" { print $2 }')" | ||
19 | if [ "$md5sum" = "$old_md5sum" ]; then | ||
20 | echo >&2 "Transferring ownership of conffile $CONFFILE ..." | ||
21 | # We have to write out the desired new text of the conffile, | ||
22 | # which is tricky in the preinst, hence the nasty way we | ||
23 | # have to hardcode the text here. Fortunately, this is only | ||
24 | # necessary with sarge's dpkg and older. | ||
25 | if echo "$TEXT" | head -n1 | grep -q '^@.*@$'; then | ||
26 | echo >&2 'Unsubstituted conffile text! Please report this bug.' | ||
27 | exit 1 | ||
28 | fi | ||
29 | printf '%s' "$TEXT" >"$CONFFILE.dpkg-new" | ||
30 | chmod "$MODE" "$CONFFILE.dpkg-new" | ||
31 | mv -f "$CONFFILE" "$CONFFILE.moved-by-preinst" | ||
32 | mv -f "$CONFFILE.dpkg-new" "$CONFFILE" | ||
33 | return 0 | ||
34 | fi | ||
35 | } | ||
36 | |||
37 | case $action in | ||
38 | install|upgrade) | ||
39 | if dpkg --compare-versions "$version" lt 0; then | ||
40 | CONFFILES="$(dpkg-query -W -f '${Conffiles}\n' ssh 2>/dev/null | sed 's/^ *//')" | ||
41 | prepare_transfer_conffile /etc/ssh/moduli "$ETC_SSH_MODULI" 0644 | ||
42 | prepare_transfer_conffile /etc/ssh/ssh_config "$ETC_SSH_SSH_CONFIG" 0644 | ||
43 | fi | ||
44 | ;; | ||
45 | esac | ||
46 | |||
47 | #DEBHELPER# | ||
48 | |||
49 | exit 0 | ||
diff --git a/debian/openssh-client.prerm b/debian/openssh-client.prerm new file mode 100644 index 000000000..2d631cb9c --- /dev/null +++ b/debian/openssh-client.prerm | |||
@@ -0,0 +1,39 @@ | |||
1 | #! /bin/sh | ||
2 | # prerm script for ssh | ||
3 | # | ||
4 | # see: dh_installdeb(1) | ||
5 | |||
6 | set -e | ||
7 | |||
8 | # summary of how this script can be called: | ||
9 | # * <prerm> `remove' | ||
10 | # * <old-prerm> `upgrade' <new-version> | ||
11 | # * <new-prerm> `failed-upgrade' <old-version> | ||
12 | # * <conflictor's-prerm> `remove' `in-favour' <package> <new-version> | ||
13 | # * <deconfigured's-prerm> `deconfigure' `in-favour' | ||
14 | # <package-being-installed> <version> `removing' | ||
15 | # <conflicting-package> <version> | ||
16 | # for details, see /usr/share/doc/packaging-manual/ | ||
17 | |||
18 | case "$1" in | ||
19 | remove|deconfigure) | ||
20 | update-alternatives --quiet --remove rsh /usr/bin/ssh | ||
21 | update-alternatives --quiet --remove rlogin /usr/bin/slogin | ||
22 | update-alternatives --quiet --remove rcp /usr/bin/scp | ||
23 | ;; | ||
24 | upgrade) | ||
25 | ;; | ||
26 | failed-upgrade) | ||
27 | ;; | ||
28 | *) | ||
29 | echo "prerm called with unknown argument \`$1'" >&2 | ||
30 | exit 0 | ||
31 | ;; | ||
32 | esac | ||
33 | |||
34 | # dh_installdeb will replace this with shell code automatically | ||
35 | # generated by other debhelper scripts. | ||
36 | |||
37 | #DEBHELPER# | ||
38 | |||
39 | exit 0 | ||
diff --git a/debian/openssh-server-udeb.dirs b/debian/openssh-server-udeb.dirs new file mode 100644 index 000000000..f2b0bd9da --- /dev/null +++ b/debian/openssh-server-udeb.dirs | |||
@@ -0,0 +1,3 @@ | |||
1 | usr/bin | ||
2 | usr/sbin | ||
3 | var/run/sshd | ||
diff --git a/debian/openssh-server-udeb.install b/debian/openssh-server-udeb.install new file mode 100644 index 000000000..05ccbf7af --- /dev/null +++ b/debian/openssh-server-udeb.install | |||
@@ -0,0 +1,2 @@ | |||
1 | sshd usr/sbin | ||
2 | ssh-keygen usr/bin | ||
diff --git a/debian/openssh-server.config b/debian/openssh-server.config new file mode 100644 index 000000000..2a01aa806 --- /dev/null +++ b/debian/openssh-server.config | |||
@@ -0,0 +1,71 @@ | |||
1 | #!/bin/sh | ||
2 | |||
3 | action=$1 | ||
4 | version=$2 | ||
5 | |||
6 | # Source debconf library. | ||
7 | . /usr/share/debconf/confmodule | ||
8 | db_version 2.0 | ||
9 | |||
10 | |||
11 | get_config_option() { | ||
12 | option="$1" | ||
13 | |||
14 | [ -f /etc/ssh/sshd_config ] || return | ||
15 | |||
16 | # TODO: actually only one '=' allowed after option | ||
17 | perl -ne 'print if s/^[[:space:]]*'"$option"'[[:space:]=]+//i' \ | ||
18 | /etc/ssh/sshd_config 2>/dev/null | ||
19 | } | ||
20 | |||
21 | |||
22 | if [ -e /etc/init.d/ssh ] && ! grep -q pidfile /etc/init.d/ssh | ||
23 | then | ||
24 | db_fset ssh/use_old_init_script seen false | ||
25 | db_input medium ssh/use_old_init_script || true | ||
26 | db_go | ||
27 | |||
28 | db_get ssh/use_old_init_script | ||
29 | [ "$RET" = "false" ] && exit 0 | ||
30 | else | ||
31 | db_set ssh/use_old_init_script true | ||
32 | db_fset ssh/use_old_init_script seen true | ||
33 | fi | ||
34 | |||
35 | if [ -e /etc/ssh/sshd_config ] | ||
36 | then | ||
37 | # An empty version means we're upgrading from before the package split, | ||
38 | # so check. | ||
39 | if dpkg --compare-versions "$version" lt 1:3.8.1p1-11 | ||
40 | then | ||
41 | passwordauth="$(get_config_option PasswordAuthentication)" | ||
42 | crauth="$(get_config_option ChallengeResponseAuthentication)" | ||
43 | if [ "$passwordauth" = no ] && \ | ||
44 | ([ -z "$crauth" ] || [ "$crauth" = yes ]) | ||
45 | then | ||
46 | db_input critical ssh/disable_cr_auth || true | ||
47 | fi | ||
48 | fi | ||
49 | fi | ||
50 | |||
51 | key=/etc/ssh/ssh_host_key | ||
52 | export key | ||
53 | if [ -n "$version" ] && [ -f $key ] && [ ! -x /usr/bin/ssh-keygen ] && | ||
54 | dpkg --compare-versions "$version" lt 1.2.28 | ||
55 | then | ||
56 | # make sure that keys get updated to get rid of IDEA; preinst | ||
57 | # actually does the work, but if the old ssh-keygen is not found, | ||
58 | # it can't do that -- thus, we tell the user that he must create | ||
59 | # a new host key. | ||
60 | printf '\0\0' | 3<&0 sh -c \ | ||
61 | 'dd if=$key bs=1 skip=32 count=2 2>/dev/null | cmp -s - /dev/fd/3' || { | ||
62 | # this means that bytes 32&33 of the key were not both zero, in which | ||
63 | # case the key is encrypted, which we need to fix | ||
64 | db_input high ssh/encrypted_host_key_but_no_keygen || true | ||
65 | } | ||
66 | fi | ||
67 | |||
68 | |||
69 | db_go | ||
70 | |||
71 | exit 0 | ||
diff --git a/debian/openssh-server.dirs b/debian/openssh-server.dirs new file mode 100644 index 000000000..b008fbf2c --- /dev/null +++ b/debian/openssh-server.dirs | |||
@@ -0,0 +1,9 @@ | |||
1 | etc/init.d | ||
2 | etc/default | ||
3 | etc/network/if-up.d | ||
4 | etc/ufw/applications.d | ||
5 | usr/lib/openssh | ||
6 | usr/sbin | ||
7 | usr/share/lintian/overrides | ||
8 | usr/share/man/man5 | ||
9 | usr/share/man/man8 | ||
diff --git a/debian/openssh-server.examples b/debian/openssh-server.examples new file mode 100644 index 000000000..0d0e55a7a --- /dev/null +++ b/debian/openssh-server.examples | |||
@@ -0,0 +1 @@ | |||
sshd_config | |||
diff --git a/debian/openssh-server.if-up b/debian/openssh-server.if-up new file mode 100644 index 000000000..ce5d4dd17 --- /dev/null +++ b/debian/openssh-server.if-up | |||
@@ -0,0 +1,40 @@ | |||
1 | #! /bin/sh | ||
2 | # Reload the OpenSSH server when an interface comes up, to allow it to start | ||
3 | # listening on new addresses. | ||
4 | |||
5 | set -e | ||
6 | |||
7 | # Don't bother to restart sshd when lo is configured. | ||
8 | if [ "$IFACE" = lo ]; then | ||
9 | exit 0 | ||
10 | fi | ||
11 | |||
12 | # Only run from ifup. | ||
13 | if [ "$MODE" != start ]; then | ||
14 | exit 0 | ||
15 | fi | ||
16 | |||
17 | # OpenSSH only cares about inet and inet6. Get ye gone, strange people | ||
18 | # still using ipx. | ||
19 | if [ "$ADDRFAM" != inet ] && [ "$ADDRFAM" != inet6 ]; then | ||
20 | exit 0 | ||
21 | fi | ||
22 | |||
23 | # Is /usr mounted? | ||
24 | if [ ! -e /usr/sbin/sshd ]; then | ||
25 | exit 0 | ||
26 | fi | ||
27 | |||
28 | if [ ! -f /var/run/sshd.pid ] || \ | ||
29 | [ "$(ps -p "$(cat /var/run/sshd.pid)" -o comm=)" != sshd ]; then | ||
30 | exit 0 | ||
31 | fi | ||
32 | |||
33 | # We'd like to use 'reload' here, but it has some problems; see #502444. | ||
34 | if [ -x /usr/sbin/invoke-rc.d ]; then | ||
35 | invoke-rc.d ssh restart >/dev/null 2>&1 || true | ||
36 | else | ||
37 | /etc/init.d/ssh restart >/dev/null 2>&1 || true | ||
38 | fi | ||
39 | |||
40 | exit 0 | ||
diff --git a/debian/openssh-server.install b/debian/openssh-server.install new file mode 100644 index 000000000..8e04c4170 --- /dev/null +++ b/debian/openssh-server.install | |||
@@ -0,0 +1,6 @@ | |||
1 | usr/lib/openssh/sftp-server | ||
2 | usr/sbin/sshd | ||
3 | usr/share/man/man5/authorized_keys.5 | ||
4 | usr/share/man/man5/sshd_config.5 | ||
5 | usr/share/man/man8/sftp-server.8 | ||
6 | usr/share/man/man8/sshd.8 | ||
diff --git a/debian/openssh-server.links b/debian/openssh-server.links new file mode 100644 index 000000000..2d98b1dcb --- /dev/null +++ b/debian/openssh-server.links | |||
@@ -0,0 +1 @@ | |||
usr/lib/openssh/sftp-server usr/lib/sftp-server | |||
diff --git a/debian/openssh-server.lintian-overrides b/debian/openssh-server.lintian-overrides new file mode 100644 index 000000000..17d912cb0 --- /dev/null +++ b/debian/openssh-server.lintian-overrides | |||
@@ -0,0 +1 @@ | |||
openssh-server: package-contains-empty-directory usr/share/doc/openssh-client/ | |||
diff --git a/debian/openssh-server.postinst b/debian/openssh-server.postinst new file mode 100644 index 000000000..cf3fa68ea --- /dev/null +++ b/debian/openssh-server.postinst | |||
@@ -0,0 +1,482 @@ | |||
1 | #!/bin/sh -e | ||
2 | |||
3 | action="$1" | ||
4 | oldversion="$2" | ||
5 | |||
6 | . /usr/share/debconf/confmodule | ||
7 | db_version 2.0 | ||
8 | |||
9 | umask 022 | ||
10 | |||
11 | if [ "$action" != configure ] | ||
12 | then | ||
13 | exit 0 | ||
14 | fi | ||
15 | |||
16 | |||
17 | fix_doc_symlink() { | ||
18 | if [ ! -L /usr/share/doc/openssh-server ] && \ | ||
19 | dpkg --compare-versions "$oldversion" lt-nl 1:4.1p1-5; then | ||
20 | rm -rf /usr/share/doc/openssh-server | ||
21 | ln -s openssh-client /usr/share/doc/openssh-server | ||
22 | fi | ||
23 | } | ||
24 | |||
25 | |||
26 | get_config_option() { | ||
27 | option="$1" | ||
28 | |||
29 | [ -f /etc/ssh/sshd_config ] || return | ||
30 | |||
31 | # TODO: actually only one '=' allowed after option | ||
32 | perl -lne 's/\s+/ /g; print if s/^\s*'"$option"'[[:space:]=]+//i' \ | ||
33 | /etc/ssh/sshd_config | ||
34 | } | ||
35 | |||
36 | |||
37 | set_config_option() { | ||
38 | option="$1" | ||
39 | value="$2" | ||
40 | |||
41 | perl -le ' | ||
42 | $option = $ARGV[0]; $value = $ARGV[1]; $done = 0; | ||
43 | while (<STDIN>) { | ||
44 | chomp; | ||
45 | (my $match = $_) =~ s/\s+/ /g; | ||
46 | if ($match =~ s/^\s*\Q$option\E\s+.*/$option $value/) { | ||
47 | $_ = $match; | ||
48 | $done = 1; | ||
49 | } | ||
50 | print; | ||
51 | } | ||
52 | print "$option $value" unless $done;' \ | ||
53 | "$option" "$value" \ | ||
54 | < /etc/ssh/sshd_config > /etc/ssh/sshd_config.dpkg-new | ||
55 | chown --reference /etc/ssh/sshd_config /etc/ssh/sshd_config.dpkg-new | ||
56 | chmod --reference /etc/ssh/sshd_config /etc/ssh/sshd_config.dpkg-new | ||
57 | mv /etc/ssh/sshd_config.dpkg-new /etc/ssh/sshd_config | ||
58 | } | ||
59 | |||
60 | |||
61 | disable_config_option() { | ||
62 | option="$1" | ||
63 | |||
64 | value="$(get_config_option "$option")" | ||
65 | [ "$value" ] || return 0 | ||
66 | |||
67 | perl -le ' | ||
68 | $option = $ARGV[0]; | ||
69 | while (<STDIN>) { | ||
70 | chomp; | ||
71 | (my $match = $_) =~ s/\s+/ /g; | ||
72 | # TODO: actually only one "=" allowed after option | ||
73 | if ($match =~ s/^(\s*\Q$option\E[[:space:]=]+.*)/#$1/i) { | ||
74 | $_ = $match; | ||
75 | } | ||
76 | print; | ||
77 | }' \ | ||
78 | "$option" \ | ||
79 | < /etc/ssh/sshd_config > /etc/ssh/sshd_config.dpkg-new | ||
80 | chown --reference /etc/ssh/sshd_config /etc/ssh/sshd_config.dpkg-new | ||
81 | chmod --reference /etc/ssh/sshd_config /etc/ssh/sshd_config.dpkg-new | ||
82 | mv /etc/ssh/sshd_config.dpkg-new /etc/ssh/sshd_config | ||
83 | } | ||
84 | |||
85 | |||
86 | rename_config_option() { | ||
87 | oldoption="$1" | ||
88 | newoption="$2" | ||
89 | |||
90 | value="$(get_config_option "$oldoption")" | ||
91 | [ "$value" ] || return 0 | ||
92 | |||
93 | perl -le ' | ||
94 | $oldoption = $ARGV[0]; $newoption = $ARGV[1]; | ||
95 | while (<STDIN>) { | ||
96 | chomp; | ||
97 | (my $match = $_) =~ s/\s+/ /g; | ||
98 | # TODO: actually only one "=" allowed after option | ||
99 | if ($match =~ s/^(\s*)\Q$oldoption\E([[:space:]=]+)/$1$newoption$2/i) { | ||
100 | $_ = $match; | ||
101 | } | ||
102 | print; | ||
103 | }' \ | ||
104 | "$oldoption" "$newoption" \ | ||
105 | < /etc/ssh/sshd_config > /etc/ssh/sshd_config.dpkg-new | ||
106 | chown --reference /etc/ssh/sshd_config /etc/ssh/sshd_config.dpkg-new | ||
107 | chmod --reference /etc/ssh/sshd_config /etc/ssh/sshd_config.dpkg-new | ||
108 | mv /etc/ssh/sshd_config.dpkg-new /etc/ssh/sshd_config | ||
109 | } | ||
110 | |||
111 | |||
112 | remove_obsolete_gssapi() { | ||
113 | disable_config_option GSSAPINoMICAuthentication | ||
114 | disable_config_option GSSUseSessionCCache | ||
115 | disable_config_option GSSAPIUseSessionCredCache | ||
116 | } | ||
117 | |||
118 | |||
119 | host_keys_required() { | ||
120 | hostkeys="$(get_config_option HostKey)" | ||
121 | if [ "$hostkeys" ]; then | ||
122 | echo "$hostkeys" | ||
123 | else | ||
124 | # No HostKey directives at all, so the server picks some | ||
125 | # defaults depending on the setting of Protocol. | ||
126 | protocol="$(get_config_option Protocol)" | ||
127 | [ "$protocol" ] || protocol=1,2 | ||
128 | if echo "$protocol" | grep 1 >/dev/null; then | ||
129 | echo /etc/ssh/ssh_host_key | ||
130 | fi | ||
131 | if echo "$protocol" | grep 2 >/dev/null; then | ||
132 | echo /etc/ssh/ssh_host_rsa_key | ||
133 | echo /etc/ssh/ssh_host_dsa_key | ||
134 | echo /etc/ssh/ssh_host_ecdsa_key | ||
135 | fi | ||
136 | fi | ||
137 | } | ||
138 | |||
139 | |||
140 | create_key() { | ||
141 | msg="$1" | ||
142 | shift | ||
143 | hostkeys="$1" | ||
144 | shift | ||
145 | file="$1" | ||
146 | shift | ||
147 | |||
148 | if echo "$hostkeys" | grep -x "$file" >/dev/null && \ | ||
149 | [ ! -f "$file" ] ; then | ||
150 | echo -n $msg | ||
151 | ssh-keygen -q -f "$file" -N '' "$@" | ||
152 | echo | ||
153 | if which restorecon >/dev/null 2>&1; then | ||
154 | restorecon "$file.pub" | ||
155 | fi | ||
156 | fi | ||
157 | } | ||
158 | |||
159 | |||
160 | create_keys() { | ||
161 | hostkeys="$(host_keys_required)" | ||
162 | |||
163 | create_key "Creating SSH1 key; this may take some time ..." \ | ||
164 | "$hostkeys" /etc/ssh/ssh_host_key -t rsa1 | ||
165 | |||
166 | create_key "Creating SSH2 RSA key; this may take some time ..." \ | ||
167 | "$hostkeys" /etc/ssh/ssh_host_rsa_key -t rsa | ||
168 | create_key "Creating SSH2 DSA key; this may take some time ..." \ | ||
169 | "$hostkeys" /etc/ssh/ssh_host_dsa_key -t dsa | ||
170 | create_key "Creating SSH2 ECDSA key; this may take some time ..." \ | ||
171 | "$hostkeys" /etc/ssh/ssh_host_ecdsa_key -t ecdsa | ||
172 | } | ||
173 | |||
174 | |||
175 | vulnerable_host_keys() { | ||
176 | # If the admin has explicitly put the vulnerable keys back, we | ||
177 | # assume they can look after themselves. | ||
178 | db_fget ssh/vulnerable_host_keys seen | ||
179 | if [ "$RET" = true ]; then | ||
180 | return 0 | ||
181 | fi | ||
182 | |||
183 | hostkeys="$(host_keys_required)" | ||
184 | vulnerable= | ||
185 | for hostkey in $hostkeys; do | ||
186 | [ -f "$hostkey" ] || continue | ||
187 | if ssh-vulnkey -q "$hostkey"; then | ||
188 | vulnerable="${vulnerable:+$vulnerable }$hostkey" | ||
189 | fi | ||
190 | done | ||
191 | if [ "$vulnerable" ]; then | ||
192 | db_subst ssh/vulnerable_host_keys HOST_KEYS "$vulnerable" | ||
193 | db_input critical ssh/vulnerable_host_keys || true | ||
194 | db_go | ||
195 | for hostkey in $vulnerable; do | ||
196 | mv "$hostkey" "$hostkey.broken" || true | ||
197 | mv "$hostkey.pub" "$hostkey.pub.broken" || true | ||
198 | done | ||
199 | create_keys | ||
200 | fi | ||
201 | } | ||
202 | |||
203 | |||
204 | check_password_auth() { | ||
205 | passwordauth="$(get_config_option PasswordAuthentication)" | ||
206 | crauth="$(get_config_option ChallengeResponseAuthentication)" | ||
207 | if [ "$passwordauth" = no ] && \ | ||
208 | ([ -z "$crauth" ] || [ "$crauth" = yes ]); then | ||
209 | db_get ssh/disable_cr_auth | ||
210 | if [ "$RET" = true ]; then | ||
211 | set_config_option ChallengeResponseAuthentication no | ||
212 | fi | ||
213 | fi | ||
214 | } | ||
215 | |||
216 | |||
217 | move_subsystem_sftp() { | ||
218 | subsystem_sftp="$(get_config_option 'Subsystem sftp')" | ||
219 | if [ "$subsystem_sftp" = /usr/lib/sftp-server ] || \ | ||
220 | [ "$subsystem_sftp" = /usr/libexec/sftp-server ]; then | ||
221 | set_config_option 'Subsystem sftp' /usr/lib/openssh/sftp-server | ||
222 | fi | ||
223 | } | ||
224 | |||
225 | |||
226 | fix_loglevel_silent() { | ||
227 | if [ "$(get_config_option LogLevel)" = SILENT ]; then | ||
228 | set_config_option LogLevel QUIET | ||
229 | fi | ||
230 | } | ||
231 | |||
232 | |||
233 | create_sshdconfig() { | ||
234 | if [ -e /etc/ssh/sshd_config ] ; then | ||
235 | # Upgrade an existing sshd configuration. | ||
236 | |||
237 | if (dpkg --compare-versions "$oldversion" lt-nl 1:3.8p1-1 && \ | ||
238 | ! grep -iq ^UsePAM /etc/ssh/sshd_config) || \ | ||
239 | grep -Eiq '^(PAMAuthenticationViaKbdInt|RhostsAuthentication)' \ | ||
240 | /etc/ssh/sshd_config ; then | ||
241 | # Upgrade from pre-3.7: UsePAM needed to maintain standard | ||
242 | # Debian configuration. | ||
243 | # Note that --compare-versions is sadly not reliable enough | ||
244 | # here due to the package split of ssh into openssh-client | ||
245 | # and openssh-server. The extra grep for some deprecated | ||
246 | # options should with any luck be a good enough heuristic. | ||
247 | echo -n 'Upgrading sshd_config (old version in .dpkg-old) ...' | ||
248 | cp -a /etc/ssh/sshd_config /etc/ssh/sshd_config.dpkg-old | ||
249 | perl -pe 's/^(PAMAuthenticationViaKbdInt|RhostsAuthentication)\b/#$1/i' \ | ||
250 | /etc/ssh/sshd_config > /etc/ssh/sshd_config.dpkg-new | ||
251 | echo >> /etc/ssh/sshd_config.dpkg-new | ||
252 | echo 'UsePAM yes' >> /etc/ssh/sshd_config.dpkg-new | ||
253 | chown --reference /etc/ssh/sshd_config \ | ||
254 | /etc/ssh/sshd_config.dpkg-new | ||
255 | chmod --reference /etc/ssh/sshd_config \ | ||
256 | /etc/ssh/sshd_config.dpkg-new | ||
257 | mv /etc/ssh/sshd_config.dpkg-new /etc/ssh/sshd_config | ||
258 | echo | ||
259 | fi | ||
260 | |||
261 | # An empty version means we're upgrading from before the | ||
262 | # package split, so check. | ||
263 | if dpkg --compare-versions "$oldversion" lt 1:3.8.1p1-11; then | ||
264 | check_password_auth | ||
265 | fi | ||
266 | |||
267 | # libexecdir changed, so fix up 'Subsystem sftp'. | ||
268 | if dpkg --compare-versions "$oldversion" lt 1:4.1p1-1; then | ||
269 | move_subsystem_sftp | ||
270 | fi | ||
271 | |||
272 | # Remove obsolete GSSAPI options. | ||
273 | if dpkg --compare-versions "$oldversion" lt 1:4.3p2-8; then | ||
274 | remove_obsolete_gssapi | ||
275 | fi | ||
276 | |||
277 | # This option was renamed in 3.8p1, but we never took care | ||
278 | # of adjusting the configuration file until now. | ||
279 | if dpkg --compare-versions "$oldversion" lt 1:4.7p1-8; then | ||
280 | rename_config_option KeepAlive TCPKeepAlive | ||
281 | fi | ||
282 | |||
283 | # 'LogLevel SILENT' is now equivalent to QUIET. | ||
284 | if dpkg --compare-versions "$oldversion" lt 1:5.4p1-1; then | ||
285 | fix_loglevel_silent | ||
286 | fi | ||
287 | |||
288 | return 0 | ||
289 | fi | ||
290 | |||
291 | cat <<EOF > /etc/ssh/sshd_config | ||
292 | # Package generated configuration file | ||
293 | # See the sshd_config(5) manpage for details | ||
294 | |||
295 | # What ports, IPs and protocols we listen for | ||
296 | Port 22 | ||
297 | # Use these options to restrict which interfaces/protocols sshd will bind to | ||
298 | #ListenAddress :: | ||
299 | #ListenAddress 0.0.0.0 | ||
300 | Protocol 2 | ||
301 | # HostKeys for protocol version 2 | ||
302 | HostKey /etc/ssh/ssh_host_rsa_key | ||
303 | HostKey /etc/ssh/ssh_host_dsa_key | ||
304 | HostKey /etc/ssh/ssh_host_ecdsa_key | ||
305 | #Privilege Separation is turned on for security | ||
306 | UsePrivilegeSeparation yes | ||
307 | |||
308 | # Lifetime and size of ephemeral version 1 server key | ||
309 | KeyRegenerationInterval 3600 | ||
310 | ServerKeyBits 768 | ||
311 | |||
312 | # Logging | ||
313 | SyslogFacility AUTH | ||
314 | LogLevel INFO | ||
315 | |||
316 | # Authentication: | ||
317 | LoginGraceTime 120 | ||
318 | PermitRootLogin yes | ||
319 | StrictModes yes | ||
320 | |||
321 | RSAAuthentication yes | ||
322 | PubkeyAuthentication yes | ||
323 | #AuthorizedKeysFile %h/.ssh/authorized_keys | ||
324 | |||
325 | # Don't read the user's ~/.rhosts and ~/.shosts files | ||
326 | IgnoreRhosts yes | ||
327 | # For this to work you will also need host keys in /etc/ssh_known_hosts | ||
328 | RhostsRSAAuthentication no | ||
329 | # similar for protocol version 2 | ||
330 | HostbasedAuthentication no | ||
331 | # Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication | ||
332 | #IgnoreUserKnownHosts yes | ||
333 | |||
334 | # To enable empty passwords, change to yes (NOT RECOMMENDED) | ||
335 | PermitEmptyPasswords no | ||
336 | |||
337 | # Change to yes to enable challenge-response passwords (beware issues with | ||
338 | # some PAM modules and threads) | ||
339 | ChallengeResponseAuthentication no | ||
340 | |||
341 | # Change to no to disable tunnelled clear text passwords | ||
342 | #PasswordAuthentication yes | ||
343 | |||
344 | # Kerberos options | ||
345 | #KerberosAuthentication no | ||
346 | #KerberosGetAFSToken no | ||
347 | #KerberosOrLocalPasswd yes | ||
348 | #KerberosTicketCleanup yes | ||
349 | |||
350 | # GSSAPI options | ||
351 | #GSSAPIAuthentication no | ||
352 | #GSSAPICleanupCredentials yes | ||
353 | |||
354 | X11Forwarding yes | ||
355 | X11DisplayOffset 10 | ||
356 | PrintMotd no | ||
357 | PrintLastLog yes | ||
358 | TCPKeepAlive yes | ||
359 | #UseLogin no | ||
360 | |||
361 | #MaxStartups 10:30:60 | ||
362 | #Banner /etc/issue.net | ||
363 | |||
364 | # Allow client to pass locale environment variables | ||
365 | AcceptEnv LANG LC_* | ||
366 | |||
367 | Subsystem sftp /usr/lib/openssh/sftp-server | ||
368 | |||
369 | # Set this to 'yes' to enable PAM authentication, account processing, | ||
370 | # and session processing. If this is enabled, PAM authentication will | ||
371 | # be allowed through the ChallengeResponseAuthentication and | ||
372 | # PasswordAuthentication. Depending on your PAM configuration, | ||
373 | # PAM authentication via ChallengeResponseAuthentication may bypass | ||
374 | # the setting of "PermitRootLogin without-password". | ||
375 | # If you just want the PAM account and session checks to run without | ||
376 | # PAM authentication, then enable this but set PasswordAuthentication | ||
377 | # and ChallengeResponseAuthentication to 'no'. | ||
378 | UsePAM yes | ||
379 | EOF | ||
380 | } | ||
381 | |||
382 | fix_statoverride() { | ||
383 | # Remove an erronous override for sshd (we should have overridden ssh) | ||
384 | if [ -x /usr/sbin/dpkg-statoverride ]; then | ||
385 | if dpkg-statoverride --list /usr/sbin/sshd >/dev/null ; then | ||
386 | dpkg-statoverride --remove /usr/sbin/sshd | ||
387 | fi | ||
388 | fi | ||
389 | } | ||
390 | |||
391 | fix_sshd_shell() { | ||
392 | if getent passwd sshd | grep -q ':/bin/false$'; then | ||
393 | usermod -s /usr/sbin/nologin sshd || true | ||
394 | fi | ||
395 | } | ||
396 | |||
397 | setup_sshd_user() { | ||
398 | if ! getent passwd sshd >/dev/null; then | ||
399 | adduser --quiet --system --no-create-home --home /var/run/sshd --shell /usr/sbin/nologin sshd | ||
400 | fi | ||
401 | } | ||
402 | |||
403 | fix_conffile_permissions() { | ||
404 | # Clean up after executable /etc/default/ssh in 1:3.5p1-5. dpkg | ||
405 | # doesn't do this for us; see bug #192981. | ||
406 | chmod 644 /etc/default/ssh | ||
407 | } | ||
408 | |||
409 | remove_old_init_links() { | ||
410 | # Yes, this only works with the SysV init script layout. I know. | ||
411 | # The important thing is that it doesn't actually *break* with | ||
412 | # file-rc ... | ||
413 | if [ -e /etc/rc2.d/S20ssh ]; then | ||
414 | update-rc.d -f ssh remove >/dev/null 2>&1 | ||
415 | fi | ||
416 | rm -f /etc/rc0.d/K??ssh /etc/rc1.d/K??ssh /etc/rc6.d/K??ssh | ||
417 | } | ||
418 | |||
419 | setup_init() { | ||
420 | if [ -x /etc/init.d/ssh ]; then | ||
421 | update-rc.d ssh start 16 2 3 4 5 . >/dev/null | ||
422 | if [ -x /usr/sbin/invoke-rc.d ]; then | ||
423 | invoke-rc.d ssh restart | ||
424 | else | ||
425 | /etc/init.d/ssh restart | ||
426 | fi | ||
427 | fi | ||
428 | } | ||
429 | |||
430 | commit_transfer_conffile () { | ||
431 | CONFFILE="$1" | ||
432 | if [ -e "$CONFFILE.moved-by-preinst" ]; then | ||
433 | rm -f "$CONFFILE.moved-by-preinst" | ||
434 | fi | ||
435 | } | ||
436 | |||
437 | commit_mv_conffile () { | ||
438 | OLDCONFFILE="$1" | ||
439 | NEWCONFFILE="$2" | ||
440 | |||
441 | if [ -e "$OLDCONFFILE.moving" ]; then | ||
442 | echo "Preserving user changes to $NEWCONFFILE ..." | ||
443 | mv -f "$NEWCONFFILE" "$NEWCONFFILE.dpkg-new" | ||
444 | mv -f "$OLDCONFFILE.moving" "$NEWCONFFILE" | ||
445 | elif [ -e "$OLDCONFFILE.dpkg-old" ]; then | ||
446 | rm -f "$OLDCONFFILE.dpkg-old" | ||
447 | fi | ||
448 | } | ||
449 | |||
450 | |||
451 | fix_doc_symlink | ||
452 | create_sshdconfig | ||
453 | create_keys | ||
454 | vulnerable_host_keys | ||
455 | fix_statoverride | ||
456 | if dpkg --compare-versions "$2" lt 1:4.3p2-3; then | ||
457 | fix_sshd_shell | ||
458 | fi | ||
459 | setup_sshd_user | ||
460 | if dpkg --compare-versions "$2" lt 1:3.6.1p2-2; then | ||
461 | fix_conffile_permissions | ||
462 | fi | ||
463 | if dpkg --compare-versions "$2" lt 1:5.2p1-1; then | ||
464 | remove_old_init_links | ||
465 | fi | ||
466 | setup_init | ||
467 | commit_transfer_conffile /etc/default/ssh | ||
468 | commit_transfer_conffile /etc/init.d/ssh | ||
469 | commit_transfer_conffile /etc/pam.d/ssh | ||
470 | commit_mv_conffile /etc/pam.d/ssh /etc/pam.d/sshd | ||
471 | # Renamed to /etc/ssh/moduli in 2.9.9 (!) | ||
472 | if dpkg --compare-versions "$2" lt 1:4.7p1-1; then | ||
473 | rm -f /etc/ssh/primes | ||
474 | fi | ||
475 | if dpkg --compare-versions "$2" lt 1:5.5p1-6; then | ||
476 | rm -f /var/run/sshd/.placeholder | ||
477 | fi | ||
478 | |||
479 | |||
480 | db_stop | ||
481 | |||
482 | exit 0 | ||
diff --git a/debian/openssh-server.postrm b/debian/openssh-server.postrm new file mode 100644 index 000000000..655c1ae17 --- /dev/null +++ b/debian/openssh-server.postrm | |||
@@ -0,0 +1,66 @@ | |||
1 | #!/bin/sh -e | ||
2 | |||
3 | #DEBHELPER# | ||
4 | |||
5 | abort_mv_conffile () { | ||
6 | CONFFILE="$1" | ||
7 | |||
8 | if [ ! -e "$CONFFILE" ]; then | ||
9 | if [ -e "$CONFFILE.dpkg-old" ]; then | ||
10 | mv -f "$CONFFILE.dpkg-old" "$CONFFILE" | ||
11 | elif [ -e "$CONFFILE.moving" ]; then | ||
12 | mv -f "$CONFFILE.moving" "$CONFFILE" | ||
13 | fi | ||
14 | fi | ||
15 | } | ||
16 | |||
17 | finish_mv_conffile () { | ||
18 | CONFFILE="$1" | ||
19 | |||
20 | if [ -e "$CONFFILE.dpkg-old" ]; then | ||
21 | rm -f "$CONFFILE.dpkg-old" | ||
22 | fi | ||
23 | } | ||
24 | |||
25 | abort_transfer_conffile () { | ||
26 | CONFFILE="$1" | ||
27 | if [ -e "$CONFFILE.moved-by-preinst" ]; then | ||
28 | echo >&2 "Aborting ownership transfer of conffile $CONFFILE ..." | ||
29 | mv -f "$CONFFILE.moved-by-preinst" "$CONFFILE" | ||
30 | return 0 | ||
31 | fi | ||
32 | } | ||
33 | |||
34 | case $1 in | ||
35 | abort-install|abort-upgrade) | ||
36 | if dpkg --compare-versions "$2" lt 1:4.7p1-4; then | ||
37 | abort_mv_conffile /etc/pam.d/ssh | ||
38 | fi | ||
39 | abort_transfer_conffile /etc/default/ssh | ||
40 | abort_transfer_conffile /etc/init.d/ssh | ||
41 | abort_transfer_conffile /etc/pam.d/ssh | ||
42 | ;; | ||
43 | purge) | ||
44 | # Remove all non-conffiles that ssh might create, so that we | ||
45 | # can smoothly remove /etc/ssh if and only if the user | ||
46 | # hasn't dropped some other files in there. Conffiles have | ||
47 | # already been removed at this point. | ||
48 | rm -f /etc/ssh/ssh_host_key /etc/ssh/ssh_host_key.pub | ||
49 | rm -f /etc/ssh/ssh_host_rsa_key /etc/ssh/ssh_host_rsa_key.pub | ||
50 | rm -f /etc/ssh/ssh_host_dsa_key /etc/ssh/ssh_host_dsa_key.pub | ||
51 | rm -f /etc/ssh/ssh_host_ecdsa_key /etc/ssh/ssh_host_ecdsa_key.pub | ||
52 | rm -f /etc/ssh/sshd_config | ||
53 | rm -f /etc/ssh/sshd_not_to_be_run | ||
54 | rmdir --ignore-fail-on-non-empty /etc/ssh | ||
55 | |||
56 | update-rc.d ssh remove >/dev/null | ||
57 | |||
58 | if which deluser >/dev/null 2>&1; then | ||
59 | deluser --quiet sshd > /dev/null || true | ||
60 | fi | ||
61 | |||
62 | finish_mv_conffile /etc/pam.d/ssh | ||
63 | ;; | ||
64 | esac | ||
65 | |||
66 | exit 0 | ||
diff --git a/debian/openssh-server.preinst b/debian/openssh-server.preinst new file mode 100644 index 000000000..510070645 --- /dev/null +++ b/debian/openssh-server.preinst | |||
@@ -0,0 +1,145 @@ | |||
1 | #!/bin/sh -e | ||
2 | |||
3 | ETC_DEFAULT_SSH=@ETC_DEFAULT_SSH@ | ||
4 | |||
5 | ETC_INIT_D_SSH=@ETC_INIT_D_SSH@ | ||
6 | |||
7 | ETC_PAM_D_SSH=@ETC_PAM_D_SSH@ | ||
8 | |||
9 | action=$1 | ||
10 | version=$2 | ||
11 | |||
12 | prepare_transfer_conffile () { | ||
13 | CONFFILE="$1" | ||
14 | TEXT="$2" | ||
15 | MODE="$3" | ||
16 | [ "$CONFFILES" ] || return 0 | ||
17 | [ -e "$CONFFILE" ] || return 0 | ||
18 | |||
19 | md5sum="$(md5sum "$CONFFILE" |sed -e 's/ .*//')" | ||
20 | old_md5sum="$(echo "$CONFFILES" | awk '$1 == "'"$CONFFILE"'" { print $2 }')" | ||
21 | if [ "$md5sum" = "$old_md5sum" ]; then | ||
22 | echo >&2 "Transferring ownership of conffile $CONFFILE ..." | ||
23 | # We have to write out the desired new text of the conffile, | ||
24 | # which is tricky in the preinst, hence the nasty way we | ||
25 | # have to hardcode the text here. Fortunately, this is only | ||
26 | # necessary with sarge's dpkg and older. | ||
27 | if echo "$TEXT" | head -n1 | grep -q '^@.*@$'; then | ||
28 | echo >&2 'Unsubstituted conffile text! Please report this bug.' | ||
29 | exit 1 | ||
30 | fi | ||
31 | printf '%s' "$TEXT" >"$CONFFILE.dpkg-new" | ||
32 | chmod "$MODE" "$CONFFILE.dpkg-new" | ||
33 | mv -f "$CONFFILE" "$CONFFILE.moved-by-preinst" | ||
34 | mv -f "$CONFFILE.dpkg-new" "$CONFFILE" | ||
35 | return 0 | ||
36 | fi | ||
37 | } | ||
38 | |||
39 | prepare_mv_conffile () { | ||
40 | CONFFILE="$1" | ||
41 | [ -e "$CONFFILE" ] || return 0 | ||
42 | |||
43 | md5sum="$(md5sum "$CONFFILE" | sed -e 's/ .*//')" | ||
44 | old_md5sum="$(dpkg-query -W -f '${Conffiles}\n' openssh-server 2>/dev/null | sed 's/^ *//' | awk '$1 == "'"$CONFFILE"'" { print $2 }')" | ||
45 | if [ "$md5sum" = "$old_md5sum" ]; then | ||
46 | mv -f "$CONFFILE" "$CONFFILE.dpkg-old" | ||
47 | else | ||
48 | mv -f "$CONFFILE" "$CONFFILE.moving" | ||
49 | fi | ||
50 | } | ||
51 | |||
52 | if [ -d /etc/ssh-nonfree ] && [ ! -d /etc/ssh ]; then | ||
53 | version=1.2.27 | ||
54 | fi | ||
55 | |||
56 | if [ "$action" = upgrade ] || [ "$action" = install ] | ||
57 | then | ||
58 | # check if debconf is missing | ||
59 | if ! test -f /usr/share/debconf/confmodule | ||
60 | then | ||
61 | cat <<EOF | ||
62 | |||
63 | WARNING: ssh's pre-configuration script relies on debconf to tell you | ||
64 | about some problems that might prevent you from logging in if you are | ||
65 | upgrading from the old, Non-free version of ssh. | ||
66 | |||
67 | If this is a new installation, you don't need to worry about this. | ||
68 | Just go ahead and install ssh (make sure to read .../ssh/README.Debian). | ||
69 | |||
70 | If you are upgrading, but you have alternative ways of logging into | ||
71 | the machine (i.e. you're sitting in front of it, or you have telnetd | ||
72 | running), then you also don't need to worry too much, because you can | ||
73 | fix it up afterwards if there's a problem. | ||
74 | |||
75 | If you're upgrading from an older (non-free) version of ssh, and ssh | ||
76 | is the only way you have to access this machine, then you should | ||
77 | probably abort the installation of ssh, install debconf, and then | ||
78 | retry the installation of ssh. | ||
79 | |||
80 | EOF | ||
81 | echo -n "Do you want to install SSH anyway [yN]: " | ||
82 | read input | ||
83 | expr "$input" : '[Yy]' >/dev/null || exit 1 | ||
84 | |||
85 | # work around for missing debconf | ||
86 | db_get() { : ; } | ||
87 | RET=true | ||
88 | if [ -d /etc/ssh-nonfree ] && [ ! -d /etc/ssh ]; then | ||
89 | cp -a /etc/ssh-nonfree /etc/ssh | ||
90 | fi | ||
91 | else | ||
92 | # Source debconf library. | ||
93 | . /usr/share/debconf/confmodule | ||
94 | db_version 2.0 | ||
95 | fi | ||
96 | |||
97 | db_get ssh/use_old_init_script | ||
98 | if [ "$RET" = "false" ]; then | ||
99 | echo "ssh config: Aborting because ssh/use_old_init_script = false" >&2 | ||
100 | exit 1 | ||
101 | fi | ||
102 | |||
103 | # deal with upgrading from pre-OpenSSH versions | ||
104 | key=/etc/ssh/ssh_host_key | ||
105 | export key | ||
106 | if [ -n "$version" ] && [ -x /usr/bin/ssh-keygen ] && [ -f $key ] && | ||
107 | dpkg --compare-versions "$version" lt 1.2.28 | ||
108 | then | ||
109 | # make sure that keys get updated to get rid of IDEA | ||
110 | # | ||
111 | # N.B. this only works because we've still got the old | ||
112 | # nonfree ssh-keygen at this point | ||
113 | # | ||
114 | # First, check if we need to bother | ||
115 | printf '\0\0' | 3<&0 sh -c \ | ||
116 | 'dd if=$key bs=1 skip=32 count=2 2>/dev/null | cmp -s - /dev/fd/3' || { | ||
117 | # this means that bytes 32&33 of the key were not both zero, in which | ||
118 | # case the key is encrypted, which we need to fix | ||
119 | chmod 600 $key | ||
120 | ssh-keygen -u -f $key >/dev/null | ||
121 | if which restorecon >/dev/null 2>&1; then | ||
122 | restorecon "$key.pub" | ||
123 | fi | ||
124 | } | ||
125 | fi | ||
126 | |||
127 | if dpkg --compare-versions "$version" lt 0; then | ||
128 | CONFFILES="$(dpkg-query -W -f '${Conffiles}\n' ssh 2>/dev/null | sed 's/^ *//')" | ||
129 | prepare_transfer_conffile /etc/default/ssh "$ETC_DEFAULT_SSH" 0644 | ||
130 | prepare_transfer_conffile /etc/init.d/ssh "$ETC_INIT_D_SSH" 0755 | ||
131 | prepare_transfer_conffile /etc/pam.d/ssh "$ETC_PAM_D_SSH" 0644 | ||
132 | fi | ||
133 | |||
134 | if dpkg --compare-versions "$version" lt 1:4.7p1-4; then | ||
135 | prepare_mv_conffile /etc/pam.d/ssh | ||
136 | fi | ||
137 | |||
138 | if dpkg --compare-versions "$version" lt 1:5.5p1-6 && \ | ||
139 | [ -d /var/run/sshd ]; then | ||
140 | # make sure /var/run/sshd is not removed on upgrades | ||
141 | touch /var/run/sshd/.placeholder | ||
142 | fi | ||
143 | fi | ||
144 | |||
145 | #DEBHELPER# | ||
diff --git a/debian/openssh-server.prerm b/debian/openssh-server.prerm new file mode 100644 index 000000000..9c3313aac --- /dev/null +++ b/debian/openssh-server.prerm | |||
@@ -0,0 +1,48 @@ | |||
1 | #! /bin/sh | ||
2 | # prerm script for ssh | ||
3 | # | ||
4 | # see: dh_installdeb(1) | ||
5 | |||
6 | set -e | ||
7 | |||
8 | # summary of how this script can be called: | ||
9 | # * <prerm> `remove' | ||
10 | # * <old-prerm> `upgrade' <new-version> | ||
11 | # * <new-prerm> `failed-upgrade' <old-version> | ||
12 | # * <conflictor's-prerm> `remove' `in-favour' <package> <new-version> | ||
13 | # * <deconfigured's-prerm> `deconfigure' `in-favour' | ||
14 | # <package-being-installed> <version> `removing' | ||
15 | # <conflicting-package> <version> | ||
16 | # for details, see /usr/share/doc/packaging-manual/ | ||
17 | |||
18 | case "$1" in | ||
19 | remove|deconfigure) | ||
20 | if [ -x /etc/init.d/ssh ]; then | ||
21 | if [ -x /usr/sbin/invoke-rc.d ]; then | ||
22 | invoke-rc.d ssh stop | ||
23 | else | ||
24 | /etc/init.d/ssh stop | ||
25 | fi | ||
26 | fi | ||
27 | ;; | ||
28 | upgrade) | ||
29 | # remove symlink on downgrade to when it was a directory | ||
30 | if [ -L /usr/share/doc/openssh-server ] && \ | ||
31 | dpkg --compare-versions "$2" lt-nl 1:4.1p1-5; then | ||
32 | rm -f /usr/share/doc/openssh-server | ||
33 | fi | ||
34 | ;; | ||
35 | failed-upgrade) | ||
36 | ;; | ||
37 | *) | ||
38 | echo "prerm called with unknown argument \`$1'" >&2 | ||
39 | exit 0 | ||
40 | ;; | ||
41 | esac | ||
42 | |||
43 | # dh_installdeb will replace this with shell code automatically | ||
44 | # generated by other debhelper scripts. | ||
45 | |||
46 | #DEBHELPER# | ||
47 | |||
48 | exit 0 | ||
diff --git a/debian/openssh-server.ssh.default b/debian/openssh-server.ssh.default new file mode 100644 index 000000000..304042224 --- /dev/null +++ b/debian/openssh-server.ssh.default | |||
@@ -0,0 +1,5 @@ | |||
1 | # Default settings for openssh-server. This file is sourced by /bin/sh from | ||
2 | # /etc/init.d/ssh. | ||
3 | |||
4 | # Options to pass to sshd | ||
5 | SSHD_OPTS= | ||
diff --git a/debian/openssh-server.ssh.init b/debian/openssh-server.ssh.init new file mode 100644 index 000000000..62bcc21d4 --- /dev/null +++ b/debian/openssh-server.ssh.init | |||
@@ -0,0 +1,164 @@ | |||
1 | #! /bin/sh | ||
2 | |||
3 | ### BEGIN INIT INFO | ||
4 | # Provides: sshd | ||
5 | # Required-Start: $remote_fs $syslog | ||
6 | # Required-Stop: $remote_fs $syslog | ||
7 | # Default-Start: 2 3 4 5 | ||
8 | # Default-Stop: | ||
9 | # Short-Description: OpenBSD Secure Shell server | ||
10 | ### END INIT INFO | ||
11 | |||
12 | set -e | ||
13 | |||
14 | # /etc/init.d/ssh: start and stop the OpenBSD "secure shell(tm)" daemon | ||
15 | |||
16 | test -x /usr/sbin/sshd || exit 0 | ||
17 | ( /usr/sbin/sshd -\? 2>&1 | grep -q OpenSSH ) 2>/dev/null || exit 0 | ||
18 | |||
19 | umask 022 | ||
20 | |||
21 | if test -f /etc/default/ssh; then | ||
22 | . /etc/default/ssh | ||
23 | fi | ||
24 | |||
25 | . /lib/lsb/init-functions | ||
26 | |||
27 | if [ -n "$2" ]; then | ||
28 | SSHD_OPTS="$SSHD_OPTS $2" | ||
29 | fi | ||
30 | |||
31 | # Are we running from init? | ||
32 | run_by_init() { | ||
33 | ([ "$previous" ] && [ "$runlevel" ]) || [ "$runlevel" = S ] | ||
34 | } | ||
35 | |||
36 | check_for_no_start() { | ||
37 | # forget it if we're trying to start, and /etc/ssh/sshd_not_to_be_run exists | ||
38 | if [ -e /etc/ssh/sshd_not_to_be_run ]; then | ||
39 | if [ "$1" = log_end_msg ]; then | ||
40 | log_end_msg 0 | ||
41 | fi | ||
42 | if ! run_by_init; then | ||
43 | log_action_msg "OpenBSD Secure Shell server not in use (/etc/ssh/sshd_not_to_be_run)" | ||
44 | fi | ||
45 | exit 0 | ||
46 | fi | ||
47 | } | ||
48 | |||
49 | check_dev_null() { | ||
50 | if [ ! -c /dev/null ]; then | ||
51 | if [ "$1" = log_end_msg ]; then | ||
52 | log_end_msg 1 || true | ||
53 | fi | ||
54 | if ! run_by_init; then | ||
55 | log_action_msg "/dev/null is not a character device!" | ||
56 | fi | ||
57 | exit 1 | ||
58 | fi | ||
59 | } | ||
60 | |||
61 | check_privsep_dir() { | ||
62 | # Create the PrivSep empty dir if necessary | ||
63 | if [ ! -d /var/run/sshd ]; then | ||
64 | mkdir /var/run/sshd | ||
65 | chmod 0755 /var/run/sshd | ||
66 | fi | ||
67 | } | ||
68 | |||
69 | check_config() { | ||
70 | if [ ! -e /etc/ssh/sshd_not_to_be_run ]; then | ||
71 | /usr/sbin/sshd $SSHD_OPTS -t || exit 1 | ||
72 | fi | ||
73 | } | ||
74 | |||
75 | export PATH="${PATH:+$PATH:}/usr/sbin:/sbin" | ||
76 | |||
77 | case "$1" in | ||
78 | start) | ||
79 | check_privsep_dir | ||
80 | check_for_no_start | ||
81 | check_dev_null | ||
82 | log_daemon_msg "Starting OpenBSD Secure Shell server" "sshd" | ||
83 | if start-stop-daemon --start --quiet --oknodo --pidfile /var/run/sshd.pid --exec /usr/sbin/sshd -- $SSHD_OPTS; then | ||
84 | log_end_msg 0 | ||
85 | else | ||
86 | log_end_msg 1 | ||
87 | fi | ||
88 | ;; | ||
89 | stop) | ||
90 | log_daemon_msg "Stopping OpenBSD Secure Shell server" "sshd" | ||
91 | if start-stop-daemon --stop --quiet --oknodo --pidfile /var/run/sshd.pid; then | ||
92 | log_end_msg 0 | ||
93 | else | ||
94 | log_end_msg 1 | ||
95 | fi | ||
96 | ;; | ||
97 | |||
98 | reload|force-reload) | ||
99 | check_for_no_start | ||
100 | check_config | ||
101 | log_daemon_msg "Reloading OpenBSD Secure Shell server's configuration" "sshd" | ||
102 | if start-stop-daemon --stop --signal 1 --quiet --oknodo --pidfile /var/run/sshd.pid --exec /usr/sbin/sshd; then | ||
103 | log_end_msg 0 | ||
104 | else | ||
105 | log_end_msg 1 | ||
106 | fi | ||
107 | ;; | ||
108 | |||
109 | restart) | ||
110 | check_privsep_dir | ||
111 | check_config | ||
112 | log_daemon_msg "Restarting OpenBSD Secure Shell server" "sshd" | ||
113 | start-stop-daemon --stop --quiet --oknodo --retry 30 --pidfile /var/run/sshd.pid | ||
114 | check_for_no_start log_end_msg | ||
115 | check_dev_null log_end_msg | ||
116 | if start-stop-daemon --start --quiet --oknodo --pidfile /var/run/sshd.pid --exec /usr/sbin/sshd -- $SSHD_OPTS; then | ||
117 | log_end_msg 0 | ||
118 | else | ||
119 | log_end_msg 1 | ||
120 | fi | ||
121 | ;; | ||
122 | |||
123 | try-restart) | ||
124 | check_privsep_dir | ||
125 | check_config | ||
126 | log_daemon_msg "Restarting OpenBSD Secure Shell server" "sshd" | ||
127 | set +e | ||
128 | start-stop-daemon --stop --quiet --retry 30 --pidfile /var/run/sshd.pid | ||
129 | RET="$?" | ||
130 | set -e | ||
131 | case $RET in | ||
132 | 0) | ||
133 | # old daemon stopped | ||
134 | check_for_no_start log_end_msg | ||
135 | check_dev_null log_end_msg | ||
136 | if start-stop-daemon --start --quiet --oknodo --pidfile /var/run/sshd.pid --exec /usr/sbin/sshd -- $SSHD_OPTS; then | ||
137 | log_end_msg 0 | ||
138 | else | ||
139 | log_end_msg 1 | ||
140 | fi | ||
141 | ;; | ||
142 | 1) | ||
143 | # daemon not running | ||
144 | log_progress_msg "(not running)" | ||
145 | log_end_msg 0 | ||
146 | ;; | ||
147 | *) | ||
148 | # failed to stop | ||
149 | log_progress_msg "(failed to stop)" | ||
150 | log_end_msg 1 | ||
151 | ;; | ||
152 | esac | ||
153 | ;; | ||
154 | |||
155 | status) | ||
156 | status_of_proc -p /var/run/sshd.pid /usr/sbin/sshd sshd && exit 0 || exit $? | ||
157 | ;; | ||
158 | |||
159 | *) | ||
160 | log_action_msg "Usage: /etc/init.d/ssh {start|stop|reload|force-reload|restart|try-restart|status}" | ||
161 | exit 1 | ||
162 | esac | ||
163 | |||
164 | exit 0 | ||
diff --git a/debian/openssh-server.sshd.pam b/debian/openssh-server.sshd.pam new file mode 100644 index 000000000..9b7695184 --- /dev/null +++ b/debian/openssh-server.sshd.pam | |||
@@ -0,0 +1,39 @@ | |||
1 | # PAM configuration for the Secure Shell service | ||
2 | |||
3 | # Read environment variables from /etc/environment and | ||
4 | # /etc/security/pam_env.conf. | ||
5 | auth required pam_env.so # [1] | ||
6 | # In Debian 4.0 (etch), locale-related environment variables were moved to | ||
7 | # /etc/default/locale, so read that as well. | ||
8 | auth required pam_env.so envfile=/etc/default/locale | ||
9 | |||
10 | # Standard Un*x authentication. | ||
11 | @include common-auth | ||
12 | |||
13 | # Disallow non-root logins when /etc/nologin exists. | ||
14 | account required pam_nologin.so | ||
15 | |||
16 | # Uncomment and edit /etc/security/access.conf if you need to set complex | ||
17 | # access limits that are hard to express in sshd_config. | ||
18 | # account required pam_access.so | ||
19 | |||
20 | # Standard Un*x authorization. | ||
21 | @include common-account | ||
22 | |||
23 | # Standard Un*x session setup and teardown. | ||
24 | @include common-session | ||
25 | |||
26 | # Print the message of the day upon successful login. | ||
27 | session optional pam_motd.so # [1] | ||
28 | |||
29 | # Print the status of the user's mailbox upon successful login. | ||
30 | session optional pam_mail.so standard noenv # [1] | ||
31 | |||
32 | # Set up user limits from /etc/security/limits.conf. | ||
33 | session required pam_limits.so | ||
34 | |||
35 | # Set up SELinux capabilities (need modified pam) | ||
36 | # session required pam_selinux.so multiple | ||
37 | |||
38 | # Standard Un*x password updating. | ||
39 | @include common-password | ||
diff --git a/debian/openssh-server.templates b/debian/openssh-server.templates new file mode 100644 index 000000000..6c7d3999d --- /dev/null +++ b/debian/openssh-server.templates | |||
@@ -0,0 +1,68 @@ | |||
1 | # These templates have been reviewed by the debian-l10n-english | ||
2 | # team | ||
3 | # | ||
4 | # If modifications/additions/rewording are needed, please ask | ||
5 | # for an advice to debian-l10n-english@lists.debian.org | ||
6 | # | ||
7 | # Even minor modifications require translation updates and such | ||
8 | # changes should be coordinated with translators and reviewers. | ||
9 | # | ||
10 | Template: ssh/use_old_init_script | ||
11 | Type: boolean | ||
12 | Default: false | ||
13 | _Description: Do you want to risk killing active SSH sessions? | ||
14 | The currently installed version of /etc/init.d/ssh is likely to kill | ||
15 | all running sshd instances. If you are doing this upgrade via an SSH | ||
16 | session, you're likely to be disconnected and leave the upgrade | ||
17 | procedure unfinished. | ||
18 | . | ||
19 | This can be fixed by manually adding "--pidfile /var/run/sshd.pid" to | ||
20 | the start-stop-daemon line in the stop section of the file. | ||
21 | |||
22 | Template: ssh/encrypted_host_key_but_no_keygen | ||
23 | Type: note | ||
24 | _Description: New host key mandatory | ||
25 | The current host key, in /etc/ssh/ssh_host_key, is encrypted with the | ||
26 | IDEA algorithm. OpenSSH can not handle this host key file, and the | ||
27 | ssh-keygen utility from the old (non-free) SSH installation does not | ||
28 | appear to be available. | ||
29 | . | ||
30 | You need to manually generate a new host key. | ||
31 | |||
32 | Template: ssh/disable_cr_auth | ||
33 | Type: boolean | ||
34 | Default: false | ||
35 | _Description: Disable challenge-response authentication? | ||
36 | Password authentication appears to be disabled in the current OpenSSH | ||
37 | server configuration. In order to prevent users from logging in using | ||
38 | passwords (perhaps using only public key authentication instead) with | ||
39 | recent versions of OpenSSH, you must disable challenge-response | ||
40 | authentication, or else ensure that your PAM configuration does not allow | ||
41 | Unix password file authentication. | ||
42 | . | ||
43 | If you disable challenge-response authentication, then users will not be | ||
44 | able to log in using passwords. If you leave it enabled (the default | ||
45 | answer), then the 'PasswordAuthentication no' option will have no useful | ||
46 | effect unless you also adjust your PAM configuration in /etc/pam.d/ssh. | ||
47 | |||
48 | Template: ssh/vulnerable_host_keys | ||
49 | Type: note | ||
50 | #flag:translate!:5 | ||
51 | _Description: Vulnerable host keys will be regenerated | ||
52 | Some of the OpenSSH server host keys on this system were generated with a | ||
53 | version of OpenSSL that had a broken random number generator. As a result, | ||
54 | these host keys are from a well-known set, are subject to brute-force | ||
55 | attacks, and must be regenerated. | ||
56 | . | ||
57 | Users of this system should be informed of this change, as they will be | ||
58 | prompted about the host key change the next time they log in. Use | ||
59 | 'ssh-keygen -l -f HOST_KEY_FILE' after the upgrade to print the | ||
60 | fingerprints of the new host keys. | ||
61 | . | ||
62 | The affected host keys are: | ||
63 | . | ||
64 | ${HOST_KEYS} | ||
65 | . | ||
66 | User keys may also be affected by this problem. The 'ssh-vulnkey' command | ||
67 | may be used as a partial test for this. See | ||
68 | /usr/share/doc/openssh-server/README.compromised-keys.gz for more details. | ||
diff --git a/debian/openssh-server.ufw.profile b/debian/openssh-server.ufw.profile new file mode 100644 index 000000000..9bbe906bc --- /dev/null +++ b/debian/openssh-server.ufw.profile | |||
@@ -0,0 +1,4 @@ | |||
1 | [OpenSSH] | ||
2 | title=Secure shell server, an rshd replacement | ||
3 | description=OpenSSH is a free implementation of the Secure Shell protocol. | ||
4 | ports=22/tcp | ||
diff --git a/debian/patches/auth-log-verbosity.patch b/debian/patches/auth-log-verbosity.patch new file mode 100644 index 000000000..da940d9fa --- /dev/null +++ b/debian/patches/auth-log-verbosity.patch | |||
@@ -0,0 +1,123 @@ | |||
1 | Description: Quieten logs when multiple from= restrictions are used | ||
2 | Author: Colin Watson <cjwatson@debian.org> | ||
3 | Bug-Debian: http://bugs.debian.org/630606 | ||
4 | Forwarded: no | ||
5 | Last-Update: 2011-07-28 | ||
6 | |||
7 | Index: b/auth-options.c | ||
8 | =================================================================== | ||
9 | --- a/auth-options.c | ||
10 | +++ b/auth-options.c | ||
11 | @@ -58,9 +58,20 @@ | ||
12 | /* "principals=" option. */ | ||
13 | char *authorized_principals = NULL; | ||
14 | |||
15 | +/* Throttle log messages. */ | ||
16 | +int logged_from_hostip = 0; | ||
17 | +int logged_cert_hostip = 0; | ||
18 | + | ||
19 | extern ServerOptions options; | ||
20 | |||
21 | void | ||
22 | +auth_start_parse_options(void) | ||
23 | +{ | ||
24 | + logged_from_hostip = 0; | ||
25 | + logged_cert_hostip = 0; | ||
26 | +} | ||
27 | + | ||
28 | +void | ||
29 | auth_clear_options(void) | ||
30 | { | ||
31 | no_agent_forwarding_flag = 0; | ||
32 | @@ -288,10 +299,13 @@ | ||
33 | /* FALLTHROUGH */ | ||
34 | case 0: | ||
35 | xfree(patterns); | ||
36 | - logit("Authentication tried for %.100s with " | ||
37 | - "correct key but not from a permitted " | ||
38 | - "host (host=%.200s, ip=%.200s).", | ||
39 | - pw->pw_name, remote_host, remote_ip); | ||
40 | + if (!logged_from_hostip) { | ||
41 | + logit("Authentication tried for %.100s with " | ||
42 | + "correct key but not from a permitted " | ||
43 | + "host (host=%.200s, ip=%.200s).", | ||
44 | + pw->pw_name, remote_host, remote_ip); | ||
45 | + logged_from_hostip = 1; | ||
46 | + } | ||
47 | auth_debug_add("Your host '%.200s' is not " | ||
48 | "permitted to use this key for login.", | ||
49 | remote_host); | ||
50 | @@ -526,11 +540,14 @@ | ||
51 | break; | ||
52 | case 0: | ||
53 | /* no match */ | ||
54 | - logit("Authentication tried for %.100s " | ||
55 | - "with valid certificate but not " | ||
56 | - "from a permitted host " | ||
57 | - "(ip=%.200s).", pw->pw_name, | ||
58 | - remote_ip); | ||
59 | + if (!logged_cert_hostip) { | ||
60 | + logit("Authentication tried for %.100s " | ||
61 | + "with valid certificate but not " | ||
62 | + "from a permitted host " | ||
63 | + "(ip=%.200s).", pw->pw_name, | ||
64 | + remote_ip); | ||
65 | + logged_cert_hostip = 1; | ||
66 | + } | ||
67 | auth_debug_add("Your address '%.200s' " | ||
68 | "is not permitted to use this " | ||
69 | "certificate for login.", | ||
70 | Index: b/auth-options.h | ||
71 | =================================================================== | ||
72 | --- a/auth-options.h | ||
73 | +++ b/auth-options.h | ||
74 | @@ -33,6 +33,7 @@ | ||
75 | extern int key_is_cert_authority; | ||
76 | extern char *authorized_principals; | ||
77 | |||
78 | +void auth_start_parse_options(void); | ||
79 | int auth_parse_options(struct passwd *, char *, char *, u_long); | ||
80 | void auth_clear_options(void); | ||
81 | int auth_cert_options(Key *, struct passwd *); | ||
82 | Index: b/auth-rsa.c | ||
83 | =================================================================== | ||
84 | --- a/auth-rsa.c | ||
85 | +++ b/auth-rsa.c | ||
86 | @@ -175,6 +175,8 @@ | ||
87 | if ((f = auth_openkeyfile(file, pw, options.strict_modes)) == NULL) | ||
88 | return 0; | ||
89 | |||
90 | + auth_start_parse_options(); | ||
91 | + | ||
92 | /* | ||
93 | * Go though the accepted keys, looking for the current key. If | ||
94 | * found, perform a challenge-response dialog to verify that the | ||
95 | Index: b/auth2-pubkey.c | ||
96 | =================================================================== | ||
97 | --- a/auth2-pubkey.c | ||
98 | +++ b/auth2-pubkey.c | ||
99 | @@ -211,6 +211,7 @@ | ||
100 | restore_uid(); | ||
101 | return 0; | ||
102 | } | ||
103 | + auth_start_parse_options(); | ||
104 | while (read_keyfile_line(f, file, line, sizeof(line), &linenum) != -1) { | ||
105 | /* Skip leading whitespace. */ | ||
106 | for (cp = line; *cp == ' ' || *cp == '\t'; cp++) | ||
107 | @@ -280,6 +281,8 @@ | ||
108 | found_key = 0; | ||
109 | found = key_new(key_is_cert(key) ? KEY_UNSPEC : key->type); | ||
110 | |||
111 | + auth_start_parse_options(); | ||
112 | + | ||
113 | while (read_keyfile_line(f, file, line, sizeof(line), &linenum) != -1) { | ||
114 | char *cp, *key_options = NULL; | ||
115 | |||
116 | @@ -416,6 +419,7 @@ | ||
117 | if (key_cert_check_authority(key, 0, 1, | ||
118 | principals_file == NULL ? pw->pw_name : NULL, &reason) != 0) | ||
119 | goto fail_reason; | ||
120 | + auth_start_parse_options(); | ||
121 | if (auth_cert_options(key, pw) != 0) | ||
122 | goto out; | ||
123 | |||
diff --git a/debian/patches/authorized-keys-man-symlink.patch b/debian/patches/authorized-keys-man-symlink.patch new file mode 100644 index 000000000..a9ca85407 --- /dev/null +++ b/debian/patches/authorized-keys-man-symlink.patch | |||
@@ -0,0 +1,18 @@ | |||
1 | Description: Install authorized_keys(5) as a symlink to sshd(8) | ||
2 | Author: Tomas Pospisek <tpo_deb@sourcepole.ch> | ||
3 | Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1720 | ||
4 | Bug-Debian: http://bugs.debian.org/441817 | ||
5 | Last-Update: 2010-03-01 | ||
6 | |||
7 | Index: b/Makefile.in | ||
8 | =================================================================== | ||
9 | --- a/Makefile.in | ||
10 | +++ b/Makefile.in | ||
11 | @@ -275,6 +275,7 @@ | ||
12 | $(INSTALL) -m 644 sshd_config.5.out $(DESTDIR)$(mandir)/$(mansubdir)5/sshd_config.5 | ||
13 | $(INSTALL) -m 644 ssh_config.5.out $(DESTDIR)$(mandir)/$(mansubdir)5/ssh_config.5 | ||
14 | $(INSTALL) -m 644 sshd.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sshd.8 | ||
15 | + ln -s ../$(mansubdir)8/sshd.8 $(DESTDIR)$(mandir)/$(mansubdir)5/authorized_keys.5 | ||
16 | $(INSTALL) -m 644 sftp.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/sftp.1 | ||
17 | $(INSTALL) -m 644 sftp-server.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8 | ||
18 | $(INSTALL) -m 644 ssh-keysign.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8 | ||
diff --git a/debian/patches/debian-banner.patch b/debian/patches/debian-banner.patch new file mode 100644 index 000000000..57ca35e87 --- /dev/null +++ b/debian/patches/debian-banner.patch | |||
@@ -0,0 +1,99 @@ | |||
1 | Description: Add DebianBanner server configuration option | ||
2 | Setting this to "no" causes sshd to omit the Debian revision from its | ||
3 | initial protocol handshake, for those scared by package-versioning.patch. | ||
4 | Author: Kees Cook <kees@debian.org> | ||
5 | Bug-Debian: http://bugs.debian.org/562048 | ||
6 | Forwarded: not-needed | ||
7 | Last-Update: 2010-02-28 | ||
8 | |||
9 | Index: b/servconf.c | ||
10 | =================================================================== | ||
11 | --- a/servconf.c | ||
12 | +++ b/servconf.c | ||
13 | @@ -142,6 +142,7 @@ | ||
14 | options->authorized_principals_file = NULL; | ||
15 | options->ip_qos_interactive = -1; | ||
16 | options->ip_qos_bulk = -1; | ||
17 | + options->debian_banner = -1; | ||
18 | } | ||
19 | |||
20 | void | ||
21 | @@ -289,6 +290,8 @@ | ||
22 | options->ip_qos_interactive = IPTOS_LOWDELAY; | ||
23 | if (options->ip_qos_bulk == -1) | ||
24 | options->ip_qos_bulk = IPTOS_THROUGHPUT; | ||
25 | + if (options->debian_banner == -1) | ||
26 | + options->debian_banner = 1; | ||
27 | |||
28 | /* Turn privilege separation on by default */ | ||
29 | if (use_privsep == -1) | ||
30 | @@ -338,6 +341,7 @@ | ||
31 | sZeroKnowledgePasswordAuthentication, sHostCertificate, | ||
32 | sRevokedKeys, sTrustedUserCAKeys, sAuthorizedPrincipalsFile, | ||
33 | sKexAlgorithms, sIPQoS, | ||
34 | + sDebianBanner, | ||
35 | sDeprecated, sUnsupported | ||
36 | } ServerOpCodes; | ||
37 | |||
38 | @@ -473,6 +477,7 @@ | ||
39 | { "authorizedprincipalsfile", sAuthorizedPrincipalsFile, SSHCFG_ALL }, | ||
40 | { "kexalgorithms", sKexAlgorithms, SSHCFG_GLOBAL }, | ||
41 | { "ipqos", sIPQoS, SSHCFG_ALL }, | ||
42 | + { "debianbanner", sDebianBanner, SSHCFG_GLOBAL }, | ||
43 | { NULL, sBadOption, 0 } | ||
44 | }; | ||
45 | |||
46 | @@ -1436,6 +1441,10 @@ | ||
47 | } | ||
48 | break; | ||
49 | |||
50 | + case sDebianBanner: | ||
51 | + intptr = &options->debian_banner; | ||
52 | + goto parse_int; | ||
53 | + | ||
54 | case sDeprecated: | ||
55 | logit("%s line %d: Deprecated option %s", | ||
56 | filename, linenum, arg); | ||
57 | Index: b/servconf.h | ||
58 | =================================================================== | ||
59 | --- a/servconf.h | ||
60 | +++ b/servconf.h | ||
61 | @@ -166,6 +166,8 @@ | ||
62 | |||
63 | int num_permitted_opens; | ||
64 | |||
65 | + int debian_banner; | ||
66 | + | ||
67 | char *chroot_directory; | ||
68 | char *revoked_keys_file; | ||
69 | char *trusted_user_ca_keys; | ||
70 | Index: b/sshd.c | ||
71 | =================================================================== | ||
72 | --- a/sshd.c | ||
73 | +++ b/sshd.c | ||
74 | @@ -423,7 +423,8 @@ | ||
75 | minor = PROTOCOL_MINOR_1; | ||
76 | } | ||
77 | snprintf(buf, sizeof buf, "SSH-%d.%d-%.100s%s", major, minor, | ||
78 | - SSH_RELEASE, newline); | ||
79 | + options.debian_banner ? SSH_RELEASE : SSH_RELEASE_MINIMUM, | ||
80 | + newline); | ||
81 | server_version_string = xstrdup(buf); | ||
82 | |||
83 | /* Send our protocol version identification. */ | ||
84 | Index: b/sshd_config.5 | ||
85 | =================================================================== | ||
86 | --- a/sshd_config.5 | ||
87 | +++ b/sshd_config.5 | ||
88 | @@ -340,6 +340,11 @@ | ||
89 | .Dq no . | ||
90 | The default is | ||
91 | .Dq delayed . | ||
92 | +.It Cm DebianBanner | ||
93 | +Specifies whether the distribution-specified extra version suffix is | ||
94 | +included during initial protocol handshake. | ||
95 | +The default is | ||
96 | +.Dq yes . | ||
97 | .It Cm DenyGroups | ||
98 | This keyword can be followed by a list of group name patterns, separated | ||
99 | by spaces. | ||
diff --git a/debian/patches/debian-config.patch b/debian/patches/debian-config.patch new file mode 100644 index 000000000..74aa53ecc --- /dev/null +++ b/debian/patches/debian-config.patch | |||
@@ -0,0 +1,146 @@ | |||
1 | Description: Various Debian-specific configuration changes | ||
2 | ssh: Enable ForwardX11Trusted, returning to earlier semantics which cause | ||
3 | fewer problems with existing setups (http://bugs.debian.org/237021). | ||
4 | . | ||
5 | ssh: Set 'SendEnv LANG LC_*' by default (http://bugs.debian.org/264024). | ||
6 | . | ||
7 | ssh: Enable HashKnownHosts by default to try to limit the spread of ssh | ||
8 | worms. | ||
9 | . | ||
10 | ssh: Enable GSSAPIAuthentication and disable GSSAPIDelegateCredentials by | ||
11 | default. | ||
12 | . | ||
13 | sshd: Refer to /usr/share/doc/openssh-server/README.Debian.gz alongside | ||
14 | PermitRootLogin default. | ||
15 | . | ||
16 | Document all of this, along with several sshd defaults set in | ||
17 | debian/openssh-server.postinst. | ||
18 | Author: Colin Watson <cjwatson@debian.org> | ||
19 | Author: Russ Allbery <rra@debian.org> | ||
20 | Forwarded: not-needed | ||
21 | Last-Update: 2010-02-28 | ||
22 | |||
23 | Index: b/readconf.c | ||
24 | =================================================================== | ||
25 | --- a/readconf.c | ||
26 | +++ b/readconf.c | ||
27 | @@ -1268,7 +1268,7 @@ | ||
28 | if (options->forward_x11 == -1) | ||
29 | options->forward_x11 = 0; | ||
30 | if (options->forward_x11_trusted == -1) | ||
31 | - options->forward_x11_trusted = 0; | ||
32 | + options->forward_x11_trusted = 1; | ||
33 | if (options->forward_x11_timeout == -1) | ||
34 | options->forward_x11_timeout = 1200; | ||
35 | if (options->exit_on_forward_failure == -1) | ||
36 | Index: b/ssh_config | ||
37 | =================================================================== | ||
38 | --- a/ssh_config | ||
39 | +++ b/ssh_config | ||
40 | @@ -17,9 +17,10 @@ | ||
41 | # list of available options, their meanings and defaults, please see the | ||
42 | # ssh_config(5) man page. | ||
43 | |||
44 | -# Host * | ||
45 | +Host * | ||
46 | # ForwardAgent no | ||
47 | # ForwardX11 no | ||
48 | +# ForwardX11Trusted yes | ||
49 | # RhostsRSAAuthentication no | ||
50 | # RSAAuthentication yes | ||
51 | # PasswordAuthentication yes | ||
52 | @@ -47,3 +48,7 @@ | ||
53 | # PermitLocalCommand no | ||
54 | # VisualHostKey no | ||
55 | # ProxyCommand ssh -q -W %h:%p gateway.example.com | ||
56 | + SendEnv LANG LC_* | ||
57 | + HashKnownHosts yes | ||
58 | + GSSAPIAuthentication yes | ||
59 | + GSSAPIDelegateCredentials no | ||
60 | Index: b/ssh_config.5 | ||
61 | =================================================================== | ||
62 | --- a/ssh_config.5 | ||
63 | +++ b/ssh_config.5 | ||
64 | @@ -71,6 +71,22 @@ | ||
65 | host-specific declarations should be given near the beginning of the | ||
66 | file, and general defaults at the end. | ||
67 | .Pp | ||
68 | +Note that the Debian | ||
69 | +.Ic openssh-client | ||
70 | +package sets several options as standard in | ||
71 | +.Pa /etc/ssh/ssh_config | ||
72 | +which are not the default in | ||
73 | +.Xr ssh 1 : | ||
74 | +.Pp | ||
75 | +.Bl -bullet -offset indent -compact | ||
76 | +.It | ||
77 | +.Cm SendEnv No LANG LC_* | ||
78 | +.It | ||
79 | +.Cm HashKnownHosts No yes | ||
80 | +.It | ||
81 | +.Cm GSSAPIAuthentication No yes | ||
82 | +.El | ||
83 | +.Pp | ||
84 | The configuration file has the following format: | ||
85 | .Pp | ||
86 | Empty lines and lines starting with | ||
87 | @@ -499,7 +515,8 @@ | ||
88 | Remote clients will be refused access after this time. | ||
89 | .Pp | ||
90 | The default is | ||
91 | -.Dq no . | ||
92 | +.Dq yes | ||
93 | +(Debian-specific). | ||
94 | .Pp | ||
95 | See the X11 SECURITY extension specification for full details on | ||
96 | the restrictions imposed on untrusted clients. | ||
97 | Index: b/sshd_config | ||
98 | =================================================================== | ||
99 | --- a/sshd_config | ||
100 | +++ b/sshd_config | ||
101 | @@ -37,6 +37,7 @@ | ||
102 | # Authentication: | ||
103 | |||
104 | #LoginGraceTime 2m | ||
105 | +# See /usr/share/doc/openssh-server/README.Debian.gz. | ||
106 | #PermitRootLogin yes | ||
107 | #StrictModes yes | ||
108 | #MaxAuthTries 6 | ||
109 | Index: b/sshd_config.5 | ||
110 | =================================================================== | ||
111 | --- a/sshd_config.5 | ||
112 | +++ b/sshd_config.5 | ||
113 | @@ -57,6 +57,33 @@ | ||
114 | .Pq \&" | ||
115 | in order to represent arguments containing spaces. | ||
116 | .Pp | ||
117 | +Note that the Debian | ||
118 | +.Ic openssh-server | ||
119 | +package sets several options as standard in | ||
120 | +.Pa /etc/ssh/sshd_config | ||
121 | +which are not the default in | ||
122 | +.Xr sshd 8 . | ||
123 | +The exact list depends on whether the package was installed fresh or | ||
124 | +upgraded from various possible previous versions, but includes at least the | ||
125 | +following: | ||
126 | +.Pp | ||
127 | +.Bl -bullet -offset indent -compact | ||
128 | +.It | ||
129 | +.Cm Protocol No 2 | ||
130 | +.It | ||
131 | +.Cm ChallengeResponseAuthentication No no | ||
132 | +.It | ||
133 | +.Cm X11Forwarding No yes | ||
134 | +.It | ||
135 | +.Cm PrintMotd No no | ||
136 | +.It | ||
137 | +.Cm AcceptEnv No LANG LC_* | ||
138 | +.It | ||
139 | +.Cm Subsystem No sftp /usr/lib/openssh/sftp-server | ||
140 | +.It | ||
141 | +.Cm UsePAM No yes | ||
142 | +.El | ||
143 | +.Pp | ||
144 | The possible | ||
145 | keywords and their meanings are as follows (note that | ||
146 | keywords are case-insensitive and arguments are case-sensitive): | ||
diff --git a/debian/patches/dnssec-sshfp.patch b/debian/patches/dnssec-sshfp.patch new file mode 100644 index 000000000..8e8285a1f --- /dev/null +++ b/debian/patches/dnssec-sshfp.patch | |||
@@ -0,0 +1,82 @@ | |||
1 | Description: Force use of DNSSEC even if "options edns0" isn't in resolv.conf | ||
2 | This allows SSHFP DNS records to be verified if glibc 2.11 is installed. | ||
3 | Origin: vendor, https://cvs.fedoraproject.org/viewvc/F-12/openssh/openssh-5.2p1-edns.patch?revision=1.1&view=markup | ||
4 | Bug: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=572049 | ||
5 | Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=572049 | ||
6 | Last-Update: 2010-04-06 | ||
7 | |||
8 | Index: b/dns.c | ||
9 | =================================================================== | ||
10 | --- a/dns.c | ||
11 | +++ b/dns.c | ||
12 | @@ -177,6 +177,7 @@ | ||
13 | { | ||
14 | u_int counter; | ||
15 | int result; | ||
16 | + unsigned int rrset_flags = 0; | ||
17 | struct rrsetinfo *fingerprints = NULL; | ||
18 | |||
19 | u_int8_t hostkey_algorithm; | ||
20 | @@ -200,8 +201,19 @@ | ||
21 | return -1; | ||
22 | } | ||
23 | |||
24 | + /* | ||
25 | + * Original getrrsetbyname function, found on OpenBSD for example, | ||
26 | + * doesn't accept any flag and prerequisite for obtaining AD bit in | ||
27 | + * DNS response is set by "options edns0" in resolv.conf. | ||
28 | + * | ||
29 | + * Our version is more clever and use RRSET_FORCE_EDNS0 flag. | ||
30 | + */ | ||
31 | +#ifndef HAVE_GETRRSETBYNAME | ||
32 | + rrset_flags |= RRSET_FORCE_EDNS0; | ||
33 | +#endif | ||
34 | result = getrrsetbyname(hostname, DNS_RDATACLASS_IN, | ||
35 | - DNS_RDATATYPE_SSHFP, 0, &fingerprints); | ||
36 | + DNS_RDATATYPE_SSHFP, rrset_flags, &fingerprints); | ||
37 | + | ||
38 | if (result) { | ||
39 | verbose("DNS lookup error: %s", dns_result_totext(result)); | ||
40 | return -1; | ||
41 | Index: b/openbsd-compat/getrrsetbyname.c | ||
42 | =================================================================== | ||
43 | --- a/openbsd-compat/getrrsetbyname.c | ||
44 | +++ b/openbsd-compat/getrrsetbyname.c | ||
45 | @@ -209,8 +209,8 @@ | ||
46 | goto fail; | ||
47 | } | ||
48 | |||
49 | - /* don't allow flags yet, unimplemented */ | ||
50 | - if (flags) { | ||
51 | + /* Allow RRSET_FORCE_EDNS0 flag only. */ | ||
52 | + if ((flags & !RRSET_FORCE_EDNS0) != 0) { | ||
53 | result = ERRSET_INVAL; | ||
54 | goto fail; | ||
55 | } | ||
56 | @@ -226,9 +226,9 @@ | ||
57 | #endif /* DEBUG */ | ||
58 | |||
59 | #ifdef RES_USE_DNSSEC | ||
60 | - /* turn on DNSSEC if EDNS0 is configured */ | ||
61 | - if (_resp->options & RES_USE_EDNS0) | ||
62 | - _resp->options |= RES_USE_DNSSEC; | ||
63 | + /* turn on DNSSEC if required */ | ||
64 | + if (flags & RRSET_FORCE_EDNS0) | ||
65 | + _resp->options |= (RES_USE_EDNS0|RES_USE_DNSSEC); | ||
66 | #endif /* RES_USE_DNSEC */ | ||
67 | |||
68 | /* make query */ | ||
69 | Index: b/openbsd-compat/getrrsetbyname.h | ||
70 | =================================================================== | ||
71 | --- a/openbsd-compat/getrrsetbyname.h | ||
72 | +++ b/openbsd-compat/getrrsetbyname.h | ||
73 | @@ -72,6 +72,9 @@ | ||
74 | #ifndef RRSET_VALIDATED | ||
75 | # define RRSET_VALIDATED 1 | ||
76 | #endif | ||
77 | +#ifndef RRSET_FORCE_EDNS0 | ||
78 | +# define RRSET_FORCE_EDNS0 0x0001 | ||
79 | +#endif | ||
80 | |||
81 | /* | ||
82 | * Return codes for getrrsetbyname() | ||
diff --git a/debian/patches/doc-hash-tab-completion.patch b/debian/patches/doc-hash-tab-completion.patch new file mode 100644 index 000000000..cec6f6639 --- /dev/null +++ b/debian/patches/doc-hash-tab-completion.patch | |||
@@ -0,0 +1,20 @@ | |||
1 | Description: Document that HashKnownHosts may break tab-completion | ||
2 | Author: Colin Watson <cjwatson@debian.org> | ||
3 | Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1727 | ||
4 | Bug-Debian: http://bugs.debian.org/430154 | ||
5 | Last-Update: 2010-03-01 | ||
6 | |||
7 | Index: b/ssh_config.5 | ||
8 | =================================================================== | ||
9 | --- a/ssh_config.5 | ||
10 | +++ b/ssh_config.5 | ||
11 | @@ -585,6 +585,9 @@ | ||
12 | will not be converted automatically, | ||
13 | but may be manually hashed using | ||
14 | .Xr ssh-keygen 1 . | ||
15 | +Use of this option may break facilities such as tab-completion that rely | ||
16 | +on being able to read unhashed host names from | ||
17 | +.Pa ~/.ssh/known_hosts . | ||
18 | .It Cm HostbasedAuthentication | ||
19 | Specifies whether to try rhosts based authentication with public key | ||
20 | authentication. | ||
diff --git a/debian/patches/gnome-ssh-askpass2-icon.patch b/debian/patches/gnome-ssh-askpass2-icon.patch new file mode 100644 index 000000000..96bbf3a09 --- /dev/null +++ b/debian/patches/gnome-ssh-askpass2-icon.patch | |||
@@ -0,0 +1,18 @@ | |||
1 | Description: Give the ssh-askpass-gnome window a default icon | ||
2 | Author: Vincent Untz <vuntz@ubuntu.com> | ||
3 | Bug-Ubuntu: https://bugs.launchpad.net/bugs/27152 | ||
4 | Last-Update: 2010-02-28 | ||
5 | |||
6 | Index: b/contrib/gnome-ssh-askpass2.c | ||
7 | =================================================================== | ||
8 | --- a/contrib/gnome-ssh-askpass2.c | ||
9 | +++ b/contrib/gnome-ssh-askpass2.c | ||
10 | @@ -209,6 +209,8 @@ | ||
11 | |||
12 | gtk_init(&argc, &argv); | ||
13 | |||
14 | + gtk_window_set_default_icon_from_file ("/usr/share/pixmaps/ssh-askpass-gnome.png", NULL); | ||
15 | + | ||
16 | if (argc > 1) { | ||
17 | message = g_strjoinv(" ", argv + 1); | ||
18 | } else { | ||
diff --git a/debian/patches/gssapi.patch b/debian/patches/gssapi.patch new file mode 100644 index 000000000..dc293683e --- /dev/null +++ b/debian/patches/gssapi.patch | |||
@@ -0,0 +1,3091 @@ | |||
1 | Description: GSSAPI key exchange support | ||
2 | This patch has been rejected upstream: "None of the OpenSSH developers are | ||
3 | in favour of adding this, and this situation has not changed for several | ||
4 | years. This is not a slight on Simon's patch, which is of fine quality, | ||
5 | but just that a) we don't trust GSSAPI implementations that much and b) we | ||
6 | don't like adding new KEX since they are pre-auth attack surface. This one | ||
7 | is particularly scary, since it requires hooks out to typically root-owned | ||
8 | system resources." | ||
9 | . | ||
10 | However, quite a lot of people rely on this in Debian, and it's better to | ||
11 | have it merged into the main openssh package rather than having separate | ||
12 | -krb5 packages (as we used to have). It seems to have a generally good | ||
13 | security history. | ||
14 | Author: Simon Wilkinson <simon@sxw.org.uk> | ||
15 | Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1242 | ||
16 | Last-Updated: 2010-02-27 | ||
17 | |||
18 | Index: b/ChangeLog.gssapi | ||
19 | =================================================================== | ||
20 | --- /dev/null | ||
21 | +++ b/ChangeLog.gssapi | ||
22 | @@ -0,0 +1,113 @@ | ||
23 | +20110101 | ||
24 | + - Finally update for OpenSSH 5.6p1 | ||
25 | + - Add GSSAPIServerIdentity option from Jim Basney | ||
26 | + | ||
27 | +20100308 | ||
28 | + - [ Makefile.in, key.c, key.h ] | ||
29 | + Updates for OpenSSH 5.4p1 | ||
30 | + - [ servconf.c ] | ||
31 | + Include GSSAPI options in the sshd -T configuration dump, and flag | ||
32 | + some older configuration options as being unsupported. Thanks to Colin | ||
33 | + Watson. | ||
34 | + - | ||
35 | + | ||
36 | +20100124 | ||
37 | + - [ sshconnect2.c ] | ||
38 | + Adapt to deal with additional element in Authmethod structure. Thanks to | ||
39 | + Colin Watson | ||
40 | + | ||
41 | +20090615 | ||
42 | + - [ gss-genr.c gss-serv.c kexgssc.c kexgsss.c monitor.c sshconnect2.c | ||
43 | + sshd.c ] | ||
44 | + Fix issues identified by Greg Hudson following a code review | ||
45 | + Check return value of gss_indicate_mechs | ||
46 | + Protect GSSAPI calls in monitor, so they can only be used if enabled | ||
47 | + Check return values of bignum functions in key exchange | ||
48 | + Use BN_clear_free to clear other side's DH value | ||
49 | + Make ssh_gssapi_id_kex more robust | ||
50 | + Only configure kex table pointers if GSSAPI is enabled | ||
51 | + Don't leak mechanism list, or gss mechanism list | ||
52 | + Cast data.length before printing | ||
53 | + If serverkey isn't provided, use an empty string, rather than NULL | ||
54 | + | ||
55 | +20090201 | ||
56 | + - [ gss-genr.c gss-serv.c kex.h kexgssc.c readconf.c readconf.h ssh-gss.h | ||
57 | + ssh_config.5 sshconnet2.c ] | ||
58 | + Add support for the GSSAPIClientIdentity option, which allows the user | ||
59 | + to specify which GSSAPI identity to use to contact a given server | ||
60 | + | ||
61 | +20080404 | ||
62 | + - [ gss-serv.c ] | ||
63 | + Add code to actually implement GSSAPIStrictAcceptCheck, which had somehow | ||
64 | + been omitted from a previous version of this patch. Reported by Borislav | ||
65 | + Stoichkov | ||
66 | + | ||
67 | +20070317 | ||
68 | + - [ gss-serv-krb5.c ] | ||
69 | + Remove C99ism, where new_ccname was being declared in the middle of a | ||
70 | + function | ||
71 | + | ||
72 | +20061220 | ||
73 | + - [ servconf.c ] | ||
74 | + Make default for GSSAPIStrictAcceptorCheck be Yes, to match previous, and | ||
75 | + documented, behaviour. Reported by Dan Watson. | ||
76 | + | ||
77 | +20060910 | ||
78 | + - [ gss-genr.c kexgssc.c kexgsss.c kex.h monitor.c sshconnect2.c sshd.c | ||
79 | + ssh-gss.h ] | ||
80 | + add support for gss-group14-sha1 key exchange mechanisms | ||
81 | + - [ gss-serv.c servconf.c servconf.h sshd_config sshd_config.5 ] | ||
82 | + Add GSSAPIStrictAcceptorCheck option to allow the disabling of | ||
83 | + acceptor principal checking on multi-homed machines. | ||
84 | + <Bugzilla #928> | ||
85 | + - [ sshd_config ssh_config ] | ||
86 | + Add settings for GSSAPIKeyExchange and GSSAPITrustDNS to the sample | ||
87 | + configuration files | ||
88 | + - [ kexgss.c kegsss.c sshconnect2.c sshd.c ] | ||
89 | + Code cleanup. Replace strlen/xmalloc/snprintf sequences with xasprintf() | ||
90 | + Limit length of error messages displayed by client | ||
91 | + | ||
92 | +20060909 | ||
93 | + - [ gss-genr.c gss-serv.c ] | ||
94 | + move ssh_gssapi_acquire_cred() and ssh_gssapi_server_ctx to be server | ||
95 | + only, where they belong | ||
96 | + <Bugzilla #1225> | ||
97 | + | ||
98 | +20060829 | ||
99 | + - [ gss-serv-krb5.c ] | ||
100 | + Fix CCAPI credentials cache name when creating KRB5CCNAME environment | ||
101 | + variable | ||
102 | + | ||
103 | +20060828 | ||
104 | + - [ gss-genr.c ] | ||
105 | + Avoid Heimdal context freeing problem | ||
106 | + <Fixed upstream 20060829> | ||
107 | + | ||
108 | +20060818 | ||
109 | + - [ gss-genr.c ssh-gss.h sshconnect2.c ] | ||
110 | + Make sure that SPENGO is disabled | ||
111 | + <Bugzilla #1218 - Fixed upstream 20060818> | ||
112 | + | ||
113 | +20060421 | ||
114 | + - [ gssgenr.c, sshconnect2.c ] | ||
115 | + a few type changes (signed versus unsigned, int versus size_t) to | ||
116 | + fix compiler errors/warnings | ||
117 | + (from jbasney AT ncsa.uiuc.edu) | ||
118 | + - [ kexgssc.c, sshconnect2.c ] | ||
119 | + fix uninitialized variable warnings | ||
120 | + (from jbasney AT ncsa.uiuc.edu) | ||
121 | + - [ gssgenr.c ] | ||
122 | + pass oid to gss_display_status (helpful when using GSSAPI mechglue) | ||
123 | + (from jbasney AT ncsa.uiuc.edu) | ||
124 | + <Bugzilla #1220 > | ||
125 | + - [ gss-serv-krb5.c ] | ||
126 | + #ifdef HAVE_GSSAPI_KRB5 should be #ifdef HAVE_GSSAPI_KRB5_H | ||
127 | + (from jbasney AT ncsa.uiuc.edu) | ||
128 | + <Fixed upstream 20060304> | ||
129 | + - [ readconf.c, readconf.h, ssh_config.5, sshconnect2.c | ||
130 | + add client-side GssapiKeyExchange option | ||
131 | + (from jbasney AT ncsa.uiuc.edu) | ||
132 | + - [ sshconnect2.c ] | ||
133 | + add support for GssapiTrustDns option for gssapi-with-mic | ||
134 | + (from jbasney AT ncsa.uiuc.edu) | ||
135 | + <gssapi-with-mic support is Bugzilla #1008> | ||
136 | Index: b/Makefile.in | ||
137 | =================================================================== | ||
138 | --- a/Makefile.in | ||
139 | +++ b/Makefile.in | ||
140 | @@ -70,6 +70,7 @@ | ||
141 | atomicio.o key.o dispatch.o kex.o mac.o uidswap.o uuencode.o misc.o \ | ||
142 | monitor_fdpass.o rijndael.o ssh-dss.o ssh-ecdsa.o ssh-rsa.o dh.o \ | ||
143 | kexdh.o kexgex.o kexdhc.o kexgexc.o bufec.o kexecdh.o kexecdhc.o \ | ||
144 | + kexgssc.o \ | ||
145 | msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o jpake.o \ | ||
146 | schnorr.o ssh-pkcs11.o | ||
147 | |||
148 | @@ -86,7 +87,7 @@ | ||
149 | auth2-none.o auth2-passwd.o auth2-pubkey.o auth2-jpake.o \ | ||
150 | monitor_mm.o monitor.o monitor_wrap.o kexdhs.o kexgexs.o kexecdhs.o \ | ||
151 | auth-krb5.o \ | ||
152 | - auth2-gss.o gss-serv.o gss-serv-krb5.o \ | ||
153 | + auth2-gss.o gss-serv.o gss-serv-krb5.o kexgsss.o\ | ||
154 | loginrec.o auth-pam.o auth-shadow.o auth-sia.o md5crypt.o \ | ||
155 | sftp-server.o sftp-common.o \ | ||
156 | roaming_common.o roaming_serv.o \ | ||
157 | Index: b/auth-krb5.c | ||
158 | =================================================================== | ||
159 | --- a/auth-krb5.c | ||
160 | +++ b/auth-krb5.c | ||
161 | @@ -170,8 +170,13 @@ | ||
162 | |||
163 | len = strlen(authctxt->krb5_ticket_file) + 6; | ||
164 | authctxt->krb5_ccname = xmalloc(len); | ||
165 | +#ifdef USE_CCAPI | ||
166 | + snprintf(authctxt->krb5_ccname, len, "API:%s", | ||
167 | + authctxt->krb5_ticket_file); | ||
168 | +#else | ||
169 | snprintf(authctxt->krb5_ccname, len, "FILE:%s", | ||
170 | authctxt->krb5_ticket_file); | ||
171 | +#endif | ||
172 | |||
173 | #ifdef USE_PAM | ||
174 | if (options.use_pam) | ||
175 | @@ -226,15 +231,22 @@ | ||
176 | #ifndef HEIMDAL | ||
177 | krb5_error_code | ||
178 | ssh_krb5_cc_gen(krb5_context ctx, krb5_ccache *ccache) { | ||
179 | - int tmpfd, ret; | ||
180 | + int ret; | ||
181 | char ccname[40]; | ||
182 | mode_t old_umask; | ||
183 | +#ifdef USE_CCAPI | ||
184 | + char cctemplate[] = "API:krb5cc_%d"; | ||
185 | +#else | ||
186 | + char cctemplate[] = "FILE:/tmp/krb5cc_%d_XXXXXXXXXX"; | ||
187 | + int tmpfd; | ||
188 | +#endif | ||
189 | |||
190 | ret = snprintf(ccname, sizeof(ccname), | ||
191 | - "FILE:/tmp/krb5cc_%d_XXXXXXXXXX", geteuid()); | ||
192 | + cctemplate, geteuid()); | ||
193 | if (ret < 0 || (size_t)ret >= sizeof(ccname)) | ||
194 | return ENOMEM; | ||
195 | |||
196 | +#ifndef USE_CCAPI | ||
197 | old_umask = umask(0177); | ||
198 | tmpfd = mkstemp(ccname + strlen("FILE:")); | ||
199 | umask(old_umask); | ||
200 | @@ -249,6 +261,7 @@ | ||
201 | return errno; | ||
202 | } | ||
203 | close(tmpfd); | ||
204 | +#endif | ||
205 | |||
206 | return (krb5_cc_resolve(ctx, ccname, ccache)); | ||
207 | } | ||
208 | Index: b/auth2-gss.c | ||
209 | =================================================================== | ||
210 | --- a/auth2-gss.c | ||
211 | +++ b/auth2-gss.c | ||
212 | @@ -1,7 +1,7 @@ | ||
213 | /* $OpenBSD: auth2-gss.c,v 1.17 2011/03/10 02:52:57 djm Exp $ */ | ||
214 | |||
215 | /* | ||
216 | - * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved. | ||
217 | + * Copyright (c) 2001-2007 Simon Wilkinson. All rights reserved. | ||
218 | * | ||
219 | * Redistribution and use in source and binary forms, with or without | ||
220 | * modification, are permitted provided that the following conditions | ||
221 | @@ -52,6 +52,40 @@ | ||
222 | static void input_gssapi_exchange_complete(int type, u_int32_t plen, void *ctxt); | ||
223 | static void input_gssapi_errtok(int, u_int32_t, void *); | ||
224 | |||
225 | +/* | ||
226 | + * The 'gssapi_keyex' userauth mechanism. | ||
227 | + */ | ||
228 | +static int | ||
229 | +userauth_gsskeyex(Authctxt *authctxt) | ||
230 | +{ | ||
231 | + int authenticated = 0; | ||
232 | + Buffer b; | ||
233 | + gss_buffer_desc mic, gssbuf; | ||
234 | + u_int len; | ||
235 | + | ||
236 | + mic.value = packet_get_string(&len); | ||
237 | + mic.length = len; | ||
238 | + | ||
239 | + packet_check_eom(); | ||
240 | + | ||
241 | + ssh_gssapi_buildmic(&b, authctxt->user, authctxt->service, | ||
242 | + "gssapi-keyex"); | ||
243 | + | ||
244 | + gssbuf.value = buffer_ptr(&b); | ||
245 | + gssbuf.length = buffer_len(&b); | ||
246 | + | ||
247 | + /* gss_kex_context is NULL with privsep, so we can't check it here */ | ||
248 | + if (!GSS_ERROR(PRIVSEP(ssh_gssapi_checkmic(gss_kex_context, | ||
249 | + &gssbuf, &mic)))) | ||
250 | + authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user, | ||
251 | + authctxt->pw)); | ||
252 | + | ||
253 | + buffer_free(&b); | ||
254 | + xfree(mic.value); | ||
255 | + | ||
256 | + return (authenticated); | ||
257 | +} | ||
258 | + | ||
259 | /* | ||
260 | * We only support those mechanisms that we know about (ie ones that we know | ||
261 | * how to check local user kuserok and the like) | ||
262 | @@ -244,7 +278,8 @@ | ||
263 | |||
264 | packet_check_eom(); | ||
265 | |||
266 | - authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user)); | ||
267 | + authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user, | ||
268 | + authctxt->pw)); | ||
269 | |||
270 | authctxt->postponed = 0; | ||
271 | dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL); | ||
272 | @@ -279,7 +314,8 @@ | ||
273 | gssbuf.length = buffer_len(&b); | ||
274 | |||
275 | if (!GSS_ERROR(PRIVSEP(ssh_gssapi_checkmic(gssctxt, &gssbuf, &mic)))) | ||
276 | - authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user)); | ||
277 | + authenticated = | ||
278 | + PRIVSEP(ssh_gssapi_userok(authctxt->user, authctxt->pw)); | ||
279 | else | ||
280 | logit("GSSAPI MIC check failed"); | ||
281 | |||
282 | @@ -294,6 +330,12 @@ | ||
283 | userauth_finish(authctxt, authenticated, "gssapi-with-mic"); | ||
284 | } | ||
285 | |||
286 | +Authmethod method_gsskeyex = { | ||
287 | + "gssapi-keyex", | ||
288 | + userauth_gsskeyex, | ||
289 | + &options.gss_authentication | ||
290 | +}; | ||
291 | + | ||
292 | Authmethod method_gssapi = { | ||
293 | "gssapi-with-mic", | ||
294 | userauth_gssapi, | ||
295 | Index: b/auth2.c | ||
296 | =================================================================== | ||
297 | --- a/auth2.c | ||
298 | +++ b/auth2.c | ||
299 | @@ -69,6 +69,7 @@ | ||
300 | extern Authmethod method_kbdint; | ||
301 | extern Authmethod method_hostbased; | ||
302 | #ifdef GSSAPI | ||
303 | +extern Authmethod method_gsskeyex; | ||
304 | extern Authmethod method_gssapi; | ||
305 | #endif | ||
306 | #ifdef JPAKE | ||
307 | @@ -79,6 +80,7 @@ | ||
308 | &method_none, | ||
309 | &method_pubkey, | ||
310 | #ifdef GSSAPI | ||
311 | + &method_gsskeyex, | ||
312 | &method_gssapi, | ||
313 | #endif | ||
314 | #ifdef JPAKE | ||
315 | Index: b/clientloop.c | ||
316 | =================================================================== | ||
317 | --- a/clientloop.c | ||
318 | +++ b/clientloop.c | ||
319 | @@ -111,6 +111,10 @@ | ||
320 | #include "msg.h" | ||
321 | #include "roaming.h" | ||
322 | |||
323 | +#ifdef GSSAPI | ||
324 | +#include "ssh-gss.h" | ||
325 | +#endif | ||
326 | + | ||
327 | /* import options */ | ||
328 | extern Options options; | ||
329 | |||
330 | @@ -1508,6 +1512,15 @@ | ||
331 | /* Do channel operations unless rekeying in progress. */ | ||
332 | if (!rekeying) { | ||
333 | channel_after_select(readset, writeset); | ||
334 | + | ||
335 | +#ifdef GSSAPI | ||
336 | + if (options.gss_renewal_rekey && | ||
337 | + ssh_gssapi_credentials_updated(GSS_C_NO_CONTEXT)) { | ||
338 | + debug("credentials updated - forcing rekey"); | ||
339 | + need_rekeying = 1; | ||
340 | + } | ||
341 | +#endif | ||
342 | + | ||
343 | if (need_rekeying || packet_need_rekeying()) { | ||
344 | debug("need rekeying"); | ||
345 | xxx_kex->done = 0; | ||
346 | Index: b/config.h.in | ||
347 | =================================================================== | ||
348 | --- a/config.h.in | ||
349 | +++ b/config.h.in | ||
350 | @@ -1441,6 +1441,9 @@ | ||
351 | /* Use btmp to log bad logins */ | ||
352 | #undef USE_BTMP | ||
353 | |||
354 | +/* platform uses an in-memory credentials cache */ | ||
355 | +#undef USE_CCAPI | ||
356 | + | ||
357 | /* Use libedit for sftp */ | ||
358 | #undef USE_LIBEDIT | ||
359 | |||
360 | @@ -1456,6 +1459,9 @@ | ||
361 | /* Use PIPES instead of a socketpair() */ | ||
362 | #undef USE_PIPES | ||
363 | |||
364 | +/* platform has the Security Authorization Session API */ | ||
365 | +#undef USE_SECURITY_SESSION_API | ||
366 | + | ||
367 | /* Define if you have Solaris process contracts */ | ||
368 | #undef USE_SOLARIS_PROCESS_CONTRACTS | ||
369 | |||
370 | Index: b/configure | ||
371 | =================================================================== | ||
372 | --- a/configure | ||
373 | +++ b/configure | ||
374 | @@ -6521,6 +6521,63 @@ | ||
375 | |||
376 | $as_echo "#define SSH_TUN_PREPEND_AF 1" >>confdefs.h | ||
377 | |||
378 | + { $as_echo "$as_me:${as_lineno-$LINENO}: checking if we have the Security Authorization Session API" >&5 | ||
379 | +$as_echo_n "checking if we have the Security Authorization Session API... " >&6; } | ||
380 | + cat confdefs.h - <<_ACEOF >conftest.$ac_ext | ||
381 | +/* end confdefs.h. */ | ||
382 | +#include <Security/AuthSession.h> | ||
383 | +int | ||
384 | +main () | ||
385 | +{ | ||
386 | +SessionCreate(0, 0); | ||
387 | + ; | ||
388 | + return 0; | ||
389 | +} | ||
390 | +_ACEOF | ||
391 | +if ac_fn_c_try_compile "$LINENO"; then : | ||
392 | + ac_cv_use_security_session_api="yes" | ||
393 | + | ||
394 | +$as_echo "#define USE_SECURITY_SESSION_API 1" >>confdefs.h | ||
395 | + | ||
396 | + LIBS="$LIBS -framework Security" | ||
397 | + { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 | ||
398 | +$as_echo "yes" >&6; } | ||
399 | +else | ||
400 | + ac_cv_use_security_session_api="no" | ||
401 | + { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 | ||
402 | +$as_echo "no" >&6; } | ||
403 | +fi | ||
404 | +rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext | ||
405 | + { $as_echo "$as_me:${as_lineno-$LINENO}: checking if we have an in-memory credentials cache" >&5 | ||
406 | +$as_echo_n "checking if we have an in-memory credentials cache... " >&6; } | ||
407 | + cat confdefs.h - <<_ACEOF >conftest.$ac_ext | ||
408 | +/* end confdefs.h. */ | ||
409 | +#include <Kerberos/Kerberos.h> | ||
410 | +int | ||
411 | +main () | ||
412 | +{ | ||
413 | +cc_context_t c; | ||
414 | + (void) cc_initialize (&c, 0, NULL, NULL); | ||
415 | + ; | ||
416 | + return 0; | ||
417 | +} | ||
418 | +_ACEOF | ||
419 | +if ac_fn_c_try_compile "$LINENO"; then : | ||
420 | + | ||
421 | +$as_echo "#define USE_CCAPI 1" >>confdefs.h | ||
422 | + | ||
423 | + LIBS="$LIBS -framework Security" | ||
424 | + { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 | ||
425 | +$as_echo "yes" >&6; } | ||
426 | + if test "x$ac_cv_use_security_session_api" = "xno"; then | ||
427 | + as_fn_error $? "*** Need a security framework to use the credentials cache API ***" "$LINENO" 5 | ||
428 | + fi | ||
429 | +else | ||
430 | + { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 | ||
431 | +$as_echo "no" >&6; } | ||
432 | + | ||
433 | +fi | ||
434 | +rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext | ||
435 | |||
436 | ac_fn_c_check_decl "$LINENO" "AU_IPv4" "ac_cv_have_decl_AU_IPv4" "$ac_includes_default" | ||
437 | if test "x$ac_cv_have_decl_AU_IPv4" = xyes; then : | ||
438 | Index: b/configure.ac | ||
439 | =================================================================== | ||
440 | --- a/configure.ac | ||
441 | +++ b/configure.ac | ||
442 | @@ -515,6 +515,30 @@ | ||
443 | [Use tunnel device compatibility to OpenBSD]) | ||
444 | AC_DEFINE([SSH_TUN_PREPEND_AF], [1], | ||
445 | [Prepend the address family to IP tunnel traffic]) | ||
446 | + AC_MSG_CHECKING([if we have the Security Authorization Session API]) | ||
447 | + AC_TRY_COMPILE([#include <Security/AuthSession.h>], | ||
448 | + [SessionCreate(0, 0);], | ||
449 | + [ac_cv_use_security_session_api="yes" | ||
450 | + AC_DEFINE([USE_SECURITY_SESSION_API], [1], | ||
451 | + [platform has the Security Authorization Session API]) | ||
452 | + LIBS="$LIBS -framework Security" | ||
453 | + AC_MSG_RESULT([yes])], | ||
454 | + [ac_cv_use_security_session_api="no" | ||
455 | + AC_MSG_RESULT([no])]) | ||
456 | + AC_MSG_CHECKING([if we have an in-memory credentials cache]) | ||
457 | + AC_TRY_COMPILE( | ||
458 | + [#include <Kerberos/Kerberos.h>], | ||
459 | + [cc_context_t c; | ||
460 | + (void) cc_initialize (&c, 0, NULL, NULL);], | ||
461 | + [AC_DEFINE([USE_CCAPI], [1], | ||
462 | + [platform uses an in-memory credentials cache]) | ||
463 | + LIBS="$LIBS -framework Security" | ||
464 | + AC_MSG_RESULT([yes]) | ||
465 | + if test "x$ac_cv_use_security_session_api" = "xno"; then | ||
466 | + AC_MSG_ERROR([*** Need a security framework to use the credentials cache API ***]) | ||
467 | + fi], | ||
468 | + [AC_MSG_RESULT([no])] | ||
469 | + ) | ||
470 | m4_pattern_allow([AU_IPv]) | ||
471 | AC_CHECK_DECL([AU_IPv4], [], | ||
472 | AC_DEFINE([AU_IPv4], [0], [System only supports IPv4 audit records]) | ||
473 | Index: b/gss-genr.c | ||
474 | =================================================================== | ||
475 | --- a/gss-genr.c | ||
476 | +++ b/gss-genr.c | ||
477 | @@ -1,7 +1,7 @@ | ||
478 | /* $OpenBSD: gss-genr.c,v 1.20 2009/06/22 05:39:28 dtucker Exp $ */ | ||
479 | |||
480 | /* | ||
481 | - * Copyright (c) 2001-2007 Simon Wilkinson. All rights reserved. | ||
482 | + * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved. | ||
483 | * | ||
484 | * Redistribution and use in source and binary forms, with or without | ||
485 | * modification, are permitted provided that the following conditions | ||
486 | @@ -39,12 +39,167 @@ | ||
487 | #include "buffer.h" | ||
488 | #include "log.h" | ||
489 | #include "ssh2.h" | ||
490 | +#include "cipher.h" | ||
491 | +#include "key.h" | ||
492 | +#include "kex.h" | ||
493 | +#include <openssl/evp.h> | ||
494 | |||
495 | #include "ssh-gss.h" | ||
496 | |||
497 | extern u_char *session_id2; | ||
498 | extern u_int session_id2_len; | ||
499 | |||
500 | +typedef struct { | ||
501 | + char *encoded; | ||
502 | + gss_OID oid; | ||
503 | +} ssh_gss_kex_mapping; | ||
504 | + | ||
505 | +/* | ||
506 | + * XXX - It would be nice to find a more elegant way of handling the | ||
507 | + * XXX passing of the key exchange context to the userauth routines | ||
508 | + */ | ||
509 | + | ||
510 | +Gssctxt *gss_kex_context = NULL; | ||
511 | + | ||
512 | +static ssh_gss_kex_mapping *gss_enc2oid = NULL; | ||
513 | + | ||
514 | +int | ||
515 | +ssh_gssapi_oid_table_ok() { | ||
516 | + return (gss_enc2oid != NULL); | ||
517 | +} | ||
518 | + | ||
519 | +/* | ||
520 | + * Return a list of the gss-group1-sha1 mechanisms supported by this program | ||
521 | + * | ||
522 | + * We test mechanisms to ensure that we can use them, to avoid starting | ||
523 | + * a key exchange with a bad mechanism | ||
524 | + */ | ||
525 | + | ||
526 | +char * | ||
527 | +ssh_gssapi_client_mechanisms(const char *host, const char *client) { | ||
528 | + gss_OID_set gss_supported; | ||
529 | + OM_uint32 min_status; | ||
530 | + | ||
531 | + if (GSS_ERROR(gss_indicate_mechs(&min_status, &gss_supported))) | ||
532 | + return NULL; | ||
533 | + | ||
534 | + return(ssh_gssapi_kex_mechs(gss_supported, ssh_gssapi_check_mechanism, | ||
535 | + host, client)); | ||
536 | +} | ||
537 | + | ||
538 | +char * | ||
539 | +ssh_gssapi_kex_mechs(gss_OID_set gss_supported, ssh_gssapi_check_fn *check, | ||
540 | + const char *host, const char *client) { | ||
541 | + Buffer buf; | ||
542 | + size_t i; | ||
543 | + int oidpos, enclen; | ||
544 | + char *mechs, *encoded; | ||
545 | + u_char digest[EVP_MAX_MD_SIZE]; | ||
546 | + char deroid[2]; | ||
547 | + const EVP_MD *evp_md = EVP_md5(); | ||
548 | + EVP_MD_CTX md; | ||
549 | + | ||
550 | + if (gss_enc2oid != NULL) { | ||
551 | + for (i = 0; gss_enc2oid[i].encoded != NULL; i++) | ||
552 | + xfree(gss_enc2oid[i].encoded); | ||
553 | + xfree(gss_enc2oid); | ||
554 | + } | ||
555 | + | ||
556 | + gss_enc2oid = xmalloc(sizeof(ssh_gss_kex_mapping) * | ||
557 | + (gss_supported->count + 1)); | ||
558 | + | ||
559 | + buffer_init(&buf); | ||
560 | + | ||
561 | + oidpos = 0; | ||
562 | + for (i = 0; i < gss_supported->count; i++) { | ||
563 | + if (gss_supported->elements[i].length < 128 && | ||
564 | + (*check)(NULL, &(gss_supported->elements[i]), host, client)) { | ||
565 | + | ||
566 | + deroid[0] = SSH_GSS_OIDTYPE; | ||
567 | + deroid[1] = gss_supported->elements[i].length; | ||
568 | + | ||
569 | + EVP_DigestInit(&md, evp_md); | ||
570 | + EVP_DigestUpdate(&md, deroid, 2); | ||
571 | + EVP_DigestUpdate(&md, | ||
572 | + gss_supported->elements[i].elements, | ||
573 | + gss_supported->elements[i].length); | ||
574 | + EVP_DigestFinal(&md, digest, NULL); | ||
575 | + | ||
576 | + encoded = xmalloc(EVP_MD_size(evp_md) * 2); | ||
577 | + enclen = __b64_ntop(digest, EVP_MD_size(evp_md), | ||
578 | + encoded, EVP_MD_size(evp_md) * 2); | ||
579 | + | ||
580 | + if (oidpos != 0) | ||
581 | + buffer_put_char(&buf, ','); | ||
582 | + | ||
583 | + buffer_append(&buf, KEX_GSS_GEX_SHA1_ID, | ||
584 | + sizeof(KEX_GSS_GEX_SHA1_ID) - 1); | ||
585 | + buffer_append(&buf, encoded, enclen); | ||
586 | + buffer_put_char(&buf, ','); | ||
587 | + buffer_append(&buf, KEX_GSS_GRP1_SHA1_ID, | ||
588 | + sizeof(KEX_GSS_GRP1_SHA1_ID) - 1); | ||
589 | + buffer_append(&buf, encoded, enclen); | ||
590 | + buffer_put_char(&buf, ','); | ||
591 | + buffer_append(&buf, KEX_GSS_GRP14_SHA1_ID, | ||
592 | + sizeof(KEX_GSS_GRP14_SHA1_ID) - 1); | ||
593 | + buffer_append(&buf, encoded, enclen); | ||
594 | + | ||
595 | + gss_enc2oid[oidpos].oid = &(gss_supported->elements[i]); | ||
596 | + gss_enc2oid[oidpos].encoded = encoded; | ||
597 | + oidpos++; | ||
598 | + } | ||
599 | + } | ||
600 | + gss_enc2oid[oidpos].oid = NULL; | ||
601 | + gss_enc2oid[oidpos].encoded = NULL; | ||
602 | + | ||
603 | + buffer_put_char(&buf, '\0'); | ||
604 | + | ||
605 | + mechs = xmalloc(buffer_len(&buf)); | ||
606 | + buffer_get(&buf, mechs, buffer_len(&buf)); | ||
607 | + buffer_free(&buf); | ||
608 | + | ||
609 | + if (strlen(mechs) == 0) { | ||
610 | + xfree(mechs); | ||
611 | + mechs = NULL; | ||
612 | + } | ||
613 | + | ||
614 | + return (mechs); | ||
615 | +} | ||
616 | + | ||
617 | +gss_OID | ||
618 | +ssh_gssapi_id_kex(Gssctxt *ctx, char *name, int kex_type) { | ||
619 | + int i = 0; | ||
620 | + | ||
621 | + switch (kex_type) { | ||
622 | + case KEX_GSS_GRP1_SHA1: | ||
623 | + if (strlen(name) < sizeof(KEX_GSS_GRP1_SHA1_ID)) | ||
624 | + return GSS_C_NO_OID; | ||
625 | + name += sizeof(KEX_GSS_GRP1_SHA1_ID) - 1; | ||
626 | + break; | ||
627 | + case KEX_GSS_GRP14_SHA1: | ||
628 | + if (strlen(name) < sizeof(KEX_GSS_GRP14_SHA1_ID)) | ||
629 | + return GSS_C_NO_OID; | ||
630 | + name += sizeof(KEX_GSS_GRP14_SHA1_ID) - 1; | ||
631 | + break; | ||
632 | + case KEX_GSS_GEX_SHA1: | ||
633 | + if (strlen(name) < sizeof(KEX_GSS_GEX_SHA1_ID)) | ||
634 | + return GSS_C_NO_OID; | ||
635 | + name += sizeof(KEX_GSS_GEX_SHA1_ID) - 1; | ||
636 | + break; | ||
637 | + default: | ||
638 | + return GSS_C_NO_OID; | ||
639 | + } | ||
640 | + | ||
641 | + while (gss_enc2oid[i].encoded != NULL && | ||
642 | + strcmp(name, gss_enc2oid[i].encoded) != 0) | ||
643 | + i++; | ||
644 | + | ||
645 | + if (gss_enc2oid[i].oid != NULL && ctx != NULL) | ||
646 | + ssh_gssapi_set_oid(ctx, gss_enc2oid[i].oid); | ||
647 | + | ||
648 | + return gss_enc2oid[i].oid; | ||
649 | +} | ||
650 | + | ||
651 | /* Check that the OID in a data stream matches that in the context */ | ||
652 | int | ||
653 | ssh_gssapi_check_oid(Gssctxt *ctx, void *data, size_t len) | ||
654 | @@ -197,7 +352,7 @@ | ||
655 | } | ||
656 | |||
657 | ctx->major = gss_init_sec_context(&ctx->minor, | ||
658 | - GSS_C_NO_CREDENTIAL, &ctx->context, ctx->name, ctx->oid, | ||
659 | + ctx->client_creds, &ctx->context, ctx->name, ctx->oid, | ||
660 | GSS_C_MUTUAL_FLAG | GSS_C_INTEG_FLAG | deleg_flag, | ||
661 | 0, NULL, recv_tok, NULL, send_tok, flags, NULL); | ||
662 | |||
663 | @@ -227,8 +382,42 @@ | ||
664 | } | ||
665 | |||
666 | OM_uint32 | ||
667 | +ssh_gssapi_client_identity(Gssctxt *ctx, const char *name) | ||
668 | +{ | ||
669 | + gss_buffer_desc gssbuf; | ||
670 | + gss_name_t gssname; | ||
671 | + OM_uint32 status; | ||
672 | + gss_OID_set oidset; | ||
673 | + | ||
674 | + gssbuf.value = (void *) name; | ||
675 | + gssbuf.length = strlen(gssbuf.value); | ||
676 | + | ||
677 | + gss_create_empty_oid_set(&status, &oidset); | ||
678 | + gss_add_oid_set_member(&status, ctx->oid, &oidset); | ||
679 | + | ||
680 | + ctx->major = gss_import_name(&ctx->minor, &gssbuf, | ||
681 | + GSS_C_NT_USER_NAME, &gssname); | ||
682 | + | ||
683 | + if (!ctx->major) | ||
684 | + ctx->major = gss_acquire_cred(&ctx->minor, | ||
685 | + gssname, 0, oidset, GSS_C_INITIATE, | ||
686 | + &ctx->client_creds, NULL, NULL); | ||
687 | + | ||
688 | + gss_release_name(&status, &gssname); | ||
689 | + gss_release_oid_set(&status, &oidset); | ||
690 | + | ||
691 | + if (ctx->major) | ||
692 | + ssh_gssapi_error(ctx); | ||
693 | + | ||
694 | + return(ctx->major); | ||
695 | +} | ||
696 | + | ||
697 | +OM_uint32 | ||
698 | ssh_gssapi_sign(Gssctxt *ctx, gss_buffer_t buffer, gss_buffer_t hash) | ||
699 | { | ||
700 | + if (ctx == NULL) | ||
701 | + return -1; | ||
702 | + | ||
703 | if ((ctx->major = gss_get_mic(&ctx->minor, ctx->context, | ||
704 | GSS_C_QOP_DEFAULT, buffer, hash))) | ||
705 | ssh_gssapi_error(ctx); | ||
706 | @@ -236,6 +425,19 @@ | ||
707 | return (ctx->major); | ||
708 | } | ||
709 | |||
710 | +/* Priviledged when used by server */ | ||
711 | +OM_uint32 | ||
712 | +ssh_gssapi_checkmic(Gssctxt *ctx, gss_buffer_t gssbuf, gss_buffer_t gssmic) | ||
713 | +{ | ||
714 | + if (ctx == NULL) | ||
715 | + return -1; | ||
716 | + | ||
717 | + ctx->major = gss_verify_mic(&ctx->minor, ctx->context, | ||
718 | + gssbuf, gssmic, NULL); | ||
719 | + | ||
720 | + return (ctx->major); | ||
721 | +} | ||
722 | + | ||
723 | void | ||
724 | ssh_gssapi_buildmic(Buffer *b, const char *user, const char *service, | ||
725 | const char *context) | ||
726 | @@ -249,11 +451,16 @@ | ||
727 | } | ||
728 | |||
729 | int | ||
730 | -ssh_gssapi_check_mechanism(Gssctxt **ctx, gss_OID oid, const char *host) | ||
731 | +ssh_gssapi_check_mechanism(Gssctxt **ctx, gss_OID oid, const char *host, | ||
732 | + const char *client) | ||
733 | { | ||
734 | gss_buffer_desc token = GSS_C_EMPTY_BUFFER; | ||
735 | OM_uint32 major, minor; | ||
736 | gss_OID_desc spnego_oid = {6, (void *)"\x2B\x06\x01\x05\x05\x02"}; | ||
737 | + Gssctxt *intctx = NULL; | ||
738 | + | ||
739 | + if (ctx == NULL) | ||
740 | + ctx = &intctx; | ||
741 | |||
742 | /* RFC 4462 says we MUST NOT do SPNEGO */ | ||
743 | if (oid->length == spnego_oid.length && | ||
744 | @@ -263,6 +470,10 @@ | ||
745 | ssh_gssapi_build_ctx(ctx); | ||
746 | ssh_gssapi_set_oid(*ctx, oid); | ||
747 | major = ssh_gssapi_import_name(*ctx, host); | ||
748 | + | ||
749 | + if (!GSS_ERROR(major) && client) | ||
750 | + major = ssh_gssapi_client_identity(*ctx, client); | ||
751 | + | ||
752 | if (!GSS_ERROR(major)) { | ||
753 | major = ssh_gssapi_init_ctx(*ctx, 0, GSS_C_NO_BUFFER, &token, | ||
754 | NULL); | ||
755 | @@ -272,10 +483,67 @@ | ||
756 | GSS_C_NO_BUFFER); | ||
757 | } | ||
758 | |||
759 | - if (GSS_ERROR(major)) | ||
760 | + if (GSS_ERROR(major) || intctx != NULL) | ||
761 | ssh_gssapi_delete_ctx(ctx); | ||
762 | |||
763 | return (!GSS_ERROR(major)); | ||
764 | } | ||
765 | |||
766 | +int | ||
767 | +ssh_gssapi_credentials_updated(Gssctxt *ctxt) { | ||
768 | + static gss_name_t saved_name = GSS_C_NO_NAME; | ||
769 | + static OM_uint32 saved_lifetime = 0; | ||
770 | + static gss_OID saved_mech = GSS_C_NO_OID; | ||
771 | + static gss_name_t name; | ||
772 | + static OM_uint32 last_call = 0; | ||
773 | + OM_uint32 lifetime, now, major, minor; | ||
774 | + int equal; | ||
775 | + gss_cred_usage_t usage = GSS_C_INITIATE; | ||
776 | + | ||
777 | + now = time(NULL); | ||
778 | + | ||
779 | + if (ctxt) { | ||
780 | + debug("Rekey has happened - updating saved versions"); | ||
781 | + | ||
782 | + if (saved_name != GSS_C_NO_NAME) | ||
783 | + gss_release_name(&minor, &saved_name); | ||
784 | + | ||
785 | + major = gss_inquire_cred(&minor, GSS_C_NO_CREDENTIAL, | ||
786 | + &saved_name, &saved_lifetime, NULL, NULL); | ||
787 | + | ||
788 | + if (!GSS_ERROR(major)) { | ||
789 | + saved_mech = ctxt->oid; | ||
790 | + saved_lifetime+= now; | ||
791 | + } else { | ||
792 | + /* Handle the error */ | ||
793 | + } | ||
794 | + return 0; | ||
795 | + } | ||
796 | + | ||
797 | + if (now - last_call < 10) | ||
798 | + return 0; | ||
799 | + | ||
800 | + last_call = now; | ||
801 | + | ||
802 | + if (saved_mech == GSS_C_NO_OID) | ||
803 | + return 0; | ||
804 | + | ||
805 | + major = gss_inquire_cred(&minor, GSS_C_NO_CREDENTIAL, | ||
806 | + &name, &lifetime, NULL, NULL); | ||
807 | + if (major == GSS_S_CREDENTIALS_EXPIRED) | ||
808 | + return 0; | ||
809 | + else if (GSS_ERROR(major)) | ||
810 | + return 0; | ||
811 | + | ||
812 | + major = gss_compare_name(&minor, saved_name, name, &equal); | ||
813 | + gss_release_name(&minor, &name); | ||
814 | + if (GSS_ERROR(major)) | ||
815 | + return 0; | ||
816 | + | ||
817 | + if (equal && (saved_lifetime < lifetime + now - 10)) | ||
818 | + return 1; | ||
819 | + | ||
820 | + return 0; | ||
821 | +} | ||
822 | + | ||
823 | #endif /* GSSAPI */ | ||
824 | Index: b/gss-serv-krb5.c | ||
825 | =================================================================== | ||
826 | --- a/gss-serv-krb5.c | ||
827 | +++ b/gss-serv-krb5.c | ||
828 | @@ -1,7 +1,7 @@ | ||
829 | /* $OpenBSD: gss-serv-krb5.c,v 1.7 2006/08/03 03:34:42 deraadt Exp $ */ | ||
830 | |||
831 | /* | ||
832 | - * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved. | ||
833 | + * Copyright (c) 2001-2007 Simon Wilkinson. All rights reserved. | ||
834 | * | ||
835 | * Redistribution and use in source and binary forms, with or without | ||
836 | * modification, are permitted provided that the following conditions | ||
837 | @@ -120,6 +120,7 @@ | ||
838 | krb5_principal princ; | ||
839 | OM_uint32 maj_status, min_status; | ||
840 | int len; | ||
841 | + const char *new_ccname; | ||
842 | |||
843 | if (client->creds == NULL) { | ||
844 | debug("No credentials stored"); | ||
845 | @@ -168,11 +169,16 @@ | ||
846 | return; | ||
847 | } | ||
848 | |||
849 | - client->store.filename = xstrdup(krb5_cc_get_name(krb_context, ccache)); | ||
850 | + new_ccname = krb5_cc_get_name(krb_context, ccache); | ||
851 | + | ||
852 | client->store.envvar = "KRB5CCNAME"; | ||
853 | - len = strlen(client->store.filename) + 6; | ||
854 | - client->store.envval = xmalloc(len); | ||
855 | - snprintf(client->store.envval, len, "FILE:%s", client->store.filename); | ||
856 | +#ifdef USE_CCAPI | ||
857 | + xasprintf(&client->store.envval, "API:%s", new_ccname); | ||
858 | + client->store.filename = NULL; | ||
859 | +#else | ||
860 | + xasprintf(&client->store.envval, "FILE:%s", new_ccname); | ||
861 | + client->store.filename = xstrdup(new_ccname); | ||
862 | +#endif | ||
863 | |||
864 | #ifdef USE_PAM | ||
865 | if (options.use_pam) | ||
866 | @@ -184,6 +190,71 @@ | ||
867 | return; | ||
868 | } | ||
869 | |||
870 | +int | ||
871 | +ssh_gssapi_krb5_updatecreds(ssh_gssapi_ccache *store, | ||
872 | + ssh_gssapi_client *client) | ||
873 | +{ | ||
874 | + krb5_ccache ccache = NULL; | ||
875 | + krb5_principal principal = NULL; | ||
876 | + char *name = NULL; | ||
877 | + krb5_error_code problem; | ||
878 | + OM_uint32 maj_status, min_status; | ||
879 | + | ||
880 | + if ((problem = krb5_cc_resolve(krb_context, store->envval, &ccache))) { | ||
881 | + logit("krb5_cc_resolve(): %.100s", | ||
882 | + krb5_get_err_text(krb_context, problem)); | ||
883 | + return 0; | ||
884 | + } | ||
885 | + | ||
886 | + /* Find out who the principal in this cache is */ | ||
887 | + if ((problem = krb5_cc_get_principal(krb_context, ccache, | ||
888 | + &principal))) { | ||
889 | + logit("krb5_cc_get_principal(): %.100s", | ||
890 | + krb5_get_err_text(krb_context, problem)); | ||
891 | + krb5_cc_close(krb_context, ccache); | ||
892 | + return 0; | ||
893 | + } | ||
894 | + | ||
895 | + if ((problem = krb5_unparse_name(krb_context, principal, &name))) { | ||
896 | + logit("krb5_unparse_name(): %.100s", | ||
897 | + krb5_get_err_text(krb_context, problem)); | ||
898 | + krb5_free_principal(krb_context, principal); | ||
899 | + krb5_cc_close(krb_context, ccache); | ||
900 | + return 0; | ||
901 | + } | ||
902 | + | ||
903 | + | ||
904 | + if (strcmp(name,client->exportedname.value)!=0) { | ||
905 | + debug("Name in local credentials cache differs. Not storing"); | ||
906 | + krb5_free_principal(krb_context, principal); | ||
907 | + krb5_cc_close(krb_context, ccache); | ||
908 | + krb5_free_unparsed_name(krb_context, name); | ||
909 | + return 0; | ||
910 | + } | ||
911 | + krb5_free_unparsed_name(krb_context, name); | ||
912 | + | ||
913 | + /* Name matches, so lets get on with it! */ | ||
914 | + | ||
915 | + if ((problem = krb5_cc_initialize(krb_context, ccache, principal))) { | ||
916 | + logit("krb5_cc_initialize(): %.100s", | ||
917 | + krb5_get_err_text(krb_context, problem)); | ||
918 | + krb5_free_principal(krb_context, principal); | ||
919 | + krb5_cc_close(krb_context, ccache); | ||
920 | + return 0; | ||
921 | + } | ||
922 | + | ||
923 | + krb5_free_principal(krb_context, principal); | ||
924 | + | ||
925 | + if ((maj_status = gss_krb5_copy_ccache(&min_status, client->creds, | ||
926 | + ccache))) { | ||
927 | + logit("gss_krb5_copy_ccache() failed. Sorry!"); | ||
928 | + krb5_cc_close(krb_context, ccache); | ||
929 | + return 0; | ||
930 | + } | ||
931 | + | ||
932 | + return 1; | ||
933 | +} | ||
934 | + | ||
935 | ssh_gssapi_mech gssapi_kerberos_mech = { | ||
936 | "toWM5Slw5Ew8Mqkay+al2g==", | ||
937 | "Kerberos", | ||
938 | @@ -191,7 +262,8 @@ | ||
939 | NULL, | ||
940 | &ssh_gssapi_krb5_userok, | ||
941 | NULL, | ||
942 | - &ssh_gssapi_krb5_storecreds | ||
943 | + &ssh_gssapi_krb5_storecreds, | ||
944 | + &ssh_gssapi_krb5_updatecreds | ||
945 | }; | ||
946 | |||
947 | #endif /* KRB5 */ | ||
948 | Index: b/gss-serv.c | ||
949 | =================================================================== | ||
950 | --- a/gss-serv.c | ||
951 | +++ b/gss-serv.c | ||
952 | @@ -1,7 +1,7 @@ | ||
953 | /* $OpenBSD: gss-serv.c,v 1.23 2011/08/01 19:18:15 markus Exp $ */ | ||
954 | |||
955 | /* | ||
956 | - * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved. | ||
957 | + * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved. | ||
958 | * | ||
959 | * Redistribution and use in source and binary forms, with or without | ||
960 | * modification, are permitted provided that the following conditions | ||
961 | @@ -45,15 +45,20 @@ | ||
962 | #include "channels.h" | ||
963 | #include "session.h" | ||
964 | #include "misc.h" | ||
965 | +#include "servconf.h" | ||
966 | +#include "uidswap.h" | ||
967 | |||
968 | #include "ssh-gss.h" | ||
969 | +#include "monitor_wrap.h" | ||
970 | + | ||
971 | +extern ServerOptions options; | ||
972 | |||
973 | static ssh_gssapi_client gssapi_client = | ||
974 | { GSS_C_EMPTY_BUFFER, GSS_C_EMPTY_BUFFER, | ||
975 | - GSS_C_NO_CREDENTIAL, NULL, {NULL, NULL, NULL}}; | ||
976 | + GSS_C_NO_CREDENTIAL, GSS_C_NO_NAME, NULL, {NULL, NULL, NULL}, 0, 0}; | ||
977 | |||
978 | ssh_gssapi_mech gssapi_null_mech = | ||
979 | - { NULL, NULL, {0, NULL}, NULL, NULL, NULL, NULL}; | ||
980 | + { NULL, NULL, {0, NULL}, NULL, NULL, NULL, NULL, NULL}; | ||
981 | |||
982 | #ifdef KRB5 | ||
983 | extern ssh_gssapi_mech gssapi_kerberos_mech; | ||
984 | @@ -81,25 +86,32 @@ | ||
985 | char lname[MAXHOSTNAMELEN]; | ||
986 | gss_OID_set oidset; | ||
987 | |||
988 | - gss_create_empty_oid_set(&status, &oidset); | ||
989 | - gss_add_oid_set_member(&status, ctx->oid, &oidset); | ||
990 | + if (options.gss_strict_acceptor) { | ||
991 | + gss_create_empty_oid_set(&status, &oidset); | ||
992 | + gss_add_oid_set_member(&status, ctx->oid, &oidset); | ||
993 | + | ||
994 | + if (gethostname(lname, MAXHOSTNAMELEN)) { | ||
995 | + gss_release_oid_set(&status, &oidset); | ||
996 | + return (-1); | ||
997 | + } | ||
998 | |||
999 | - if (gethostname(lname, MAXHOSTNAMELEN)) { | ||
1000 | - gss_release_oid_set(&status, &oidset); | ||
1001 | - return (-1); | ||
1002 | - } | ||
1003 | + if (GSS_ERROR(ssh_gssapi_import_name(ctx, lname))) { | ||
1004 | + gss_release_oid_set(&status, &oidset); | ||
1005 | + return (ctx->major); | ||
1006 | + } | ||
1007 | + | ||
1008 | + if ((ctx->major = gss_acquire_cred(&ctx->minor, | ||
1009 | + ctx->name, 0, oidset, GSS_C_ACCEPT, &ctx->creds, | ||
1010 | + NULL, NULL))) | ||
1011 | + ssh_gssapi_error(ctx); | ||
1012 | |||
1013 | - if (GSS_ERROR(ssh_gssapi_import_name(ctx, lname))) { | ||
1014 | gss_release_oid_set(&status, &oidset); | ||
1015 | return (ctx->major); | ||
1016 | + } else { | ||
1017 | + ctx->name = GSS_C_NO_NAME; | ||
1018 | + ctx->creds = GSS_C_NO_CREDENTIAL; | ||
1019 | } | ||
1020 | - | ||
1021 | - if ((ctx->major = gss_acquire_cred(&ctx->minor, | ||
1022 | - ctx->name, 0, oidset, GSS_C_ACCEPT, &ctx->creds, NULL, NULL))) | ||
1023 | - ssh_gssapi_error(ctx); | ||
1024 | - | ||
1025 | - gss_release_oid_set(&status, &oidset); | ||
1026 | - return (ctx->major); | ||
1027 | + return GSS_S_COMPLETE; | ||
1028 | } | ||
1029 | |||
1030 | /* Privileged */ | ||
1031 | @@ -114,6 +126,29 @@ | ||
1032 | } | ||
1033 | |||
1034 | /* Unprivileged */ | ||
1035 | +char * | ||
1036 | +ssh_gssapi_server_mechanisms() { | ||
1037 | + gss_OID_set supported; | ||
1038 | + | ||
1039 | + ssh_gssapi_supported_oids(&supported); | ||
1040 | + return (ssh_gssapi_kex_mechs(supported, &ssh_gssapi_server_check_mech, | ||
1041 | + NULL, NULL)); | ||
1042 | +} | ||
1043 | + | ||
1044 | +/* Unprivileged */ | ||
1045 | +int | ||
1046 | +ssh_gssapi_server_check_mech(Gssctxt **dum, gss_OID oid, const char *data, | ||
1047 | + const char *dummy) { | ||
1048 | + Gssctxt *ctx = NULL; | ||
1049 | + int res; | ||
1050 | + | ||
1051 | + res = !GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctx, oid))); | ||
1052 | + ssh_gssapi_delete_ctx(&ctx); | ||
1053 | + | ||
1054 | + return (res); | ||
1055 | +} | ||
1056 | + | ||
1057 | +/* Unprivileged */ | ||
1058 | void | ||
1059 | ssh_gssapi_supported_oids(gss_OID_set *oidset) | ||
1060 | { | ||
1061 | @@ -123,7 +158,9 @@ | ||
1062 | gss_OID_set supported; | ||
1063 | |||
1064 | gss_create_empty_oid_set(&min_status, oidset); | ||
1065 | - gss_indicate_mechs(&min_status, &supported); | ||
1066 | + | ||
1067 | + if (GSS_ERROR(gss_indicate_mechs(&min_status, &supported))) | ||
1068 | + return; | ||
1069 | |||
1070 | while (supported_mechs[i]->name != NULL) { | ||
1071 | if (GSS_ERROR(gss_test_oid_set_member(&min_status, | ||
1072 | @@ -249,8 +286,48 @@ | ||
1073 | ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client) | ||
1074 | { | ||
1075 | int i = 0; | ||
1076 | + int equal = 0; | ||
1077 | + gss_name_t new_name = GSS_C_NO_NAME; | ||
1078 | + gss_buffer_desc ename = GSS_C_EMPTY_BUFFER; | ||
1079 | + | ||
1080 | + if (options.gss_store_rekey && client->used && ctx->client_creds) { | ||
1081 | + if (client->mech->oid.length != ctx->oid->length || | ||
1082 | + (memcmp(client->mech->oid.elements, | ||
1083 | + ctx->oid->elements, ctx->oid->length) !=0)) { | ||
1084 | + debug("Rekeyed credentials have different mechanism"); | ||
1085 | + return GSS_S_COMPLETE; | ||
1086 | + } | ||
1087 | + | ||
1088 | + if ((ctx->major = gss_inquire_cred_by_mech(&ctx->minor, | ||
1089 | + ctx->client_creds, ctx->oid, &new_name, | ||
1090 | + NULL, NULL, NULL))) { | ||
1091 | + ssh_gssapi_error(ctx); | ||
1092 | + return (ctx->major); | ||
1093 | + } | ||
1094 | + | ||
1095 | + ctx->major = gss_compare_name(&ctx->minor, client->name, | ||
1096 | + new_name, &equal); | ||
1097 | |||
1098 | - gss_buffer_desc ename; | ||
1099 | + if (GSS_ERROR(ctx->major)) { | ||
1100 | + ssh_gssapi_error(ctx); | ||
1101 | + return (ctx->major); | ||
1102 | + } | ||
1103 | + | ||
1104 | + if (!equal) { | ||
1105 | + debug("Rekeyed credentials have different name"); | ||
1106 | + return GSS_S_COMPLETE; | ||
1107 | + } | ||
1108 | + | ||
1109 | + debug("Marking rekeyed credentials for export"); | ||
1110 | + | ||
1111 | + gss_release_name(&ctx->minor, &client->name); | ||
1112 | + gss_release_cred(&ctx->minor, &client->creds); | ||
1113 | + client->name = new_name; | ||
1114 | + client->creds = ctx->client_creds; | ||
1115 | + ctx->client_creds = GSS_C_NO_CREDENTIAL; | ||
1116 | + client->updated = 1; | ||
1117 | + return GSS_S_COMPLETE; | ||
1118 | + } | ||
1119 | |||
1120 | client->mech = NULL; | ||
1121 | |||
1122 | @@ -265,6 +342,13 @@ | ||
1123 | if (client->mech == NULL) | ||
1124 | return GSS_S_FAILURE; | ||
1125 | |||
1126 | + if (ctx->client_creds && | ||
1127 | + (ctx->major = gss_inquire_cred_by_mech(&ctx->minor, | ||
1128 | + ctx->client_creds, ctx->oid, &client->name, NULL, NULL, NULL))) { | ||
1129 | + ssh_gssapi_error(ctx); | ||
1130 | + return (ctx->major); | ||
1131 | + } | ||
1132 | + | ||
1133 | if ((ctx->major = gss_display_name(&ctx->minor, ctx->client, | ||
1134 | &client->displayname, NULL))) { | ||
1135 | ssh_gssapi_error(ctx); | ||
1136 | @@ -282,6 +366,8 @@ | ||
1137 | return (ctx->major); | ||
1138 | } | ||
1139 | |||
1140 | + gss_release_buffer(&ctx->minor, &ename); | ||
1141 | + | ||
1142 | /* We can't copy this structure, so we just move the pointer to it */ | ||
1143 | client->creds = ctx->client_creds; | ||
1144 | ctx->client_creds = GSS_C_NO_CREDENTIAL; | ||
1145 | @@ -329,7 +415,7 @@ | ||
1146 | |||
1147 | /* Privileged */ | ||
1148 | int | ||
1149 | -ssh_gssapi_userok(char *user) | ||
1150 | +ssh_gssapi_userok(char *user, struct passwd *pw) | ||
1151 | { | ||
1152 | OM_uint32 lmin; | ||
1153 | |||
1154 | @@ -339,9 +425,11 @@ | ||
1155 | return 0; | ||
1156 | } | ||
1157 | if (gssapi_client.mech && gssapi_client.mech->userok) | ||
1158 | - if ((*gssapi_client.mech->userok)(&gssapi_client, user)) | ||
1159 | + if ((*gssapi_client.mech->userok)(&gssapi_client, user)) { | ||
1160 | + gssapi_client.used = 1; | ||
1161 | + gssapi_client.store.owner = pw; | ||
1162 | return 1; | ||
1163 | - else { | ||
1164 | + } else { | ||
1165 | /* Destroy delegated credentials if userok fails */ | ||
1166 | gss_release_buffer(&lmin, &gssapi_client.displayname); | ||
1167 | gss_release_buffer(&lmin, &gssapi_client.exportedname); | ||
1168 | @@ -354,14 +442,90 @@ | ||
1169 | return (0); | ||
1170 | } | ||
1171 | |||
1172 | -/* Privileged */ | ||
1173 | -OM_uint32 | ||
1174 | -ssh_gssapi_checkmic(Gssctxt *ctx, gss_buffer_t gssbuf, gss_buffer_t gssmic) | ||
1175 | +/* These bits are only used for rekeying. The unpriviledged child is running | ||
1176 | + * as the user, the monitor is root. | ||
1177 | + * | ||
1178 | + * In the child, we want to : | ||
1179 | + * *) Ask the monitor to store our credentials into the store we specify | ||
1180 | + * *) If it succeeds, maybe do a PAM update | ||
1181 | + */ | ||
1182 | + | ||
1183 | +/* Stuff for PAM */ | ||
1184 | + | ||
1185 | +#ifdef USE_PAM | ||
1186 | +static int ssh_gssapi_simple_conv(int n, const struct pam_message **msg, | ||
1187 | + struct pam_response **resp, void *data) | ||
1188 | { | ||
1189 | - ctx->major = gss_verify_mic(&ctx->minor, ctx->context, | ||
1190 | - gssbuf, gssmic, NULL); | ||
1191 | + return (PAM_CONV_ERR); | ||
1192 | +} | ||
1193 | +#endif | ||
1194 | |||
1195 | - return (ctx->major); | ||
1196 | +void | ||
1197 | +ssh_gssapi_rekey_creds() { | ||
1198 | + int ok; | ||
1199 | + int ret; | ||
1200 | +#ifdef USE_PAM | ||
1201 | + pam_handle_t *pamh = NULL; | ||
1202 | + struct pam_conv pamconv = {ssh_gssapi_simple_conv, NULL}; | ||
1203 | + char *envstr; | ||
1204 | +#endif | ||
1205 | + | ||
1206 | + if (gssapi_client.store.filename == NULL && | ||
1207 | + gssapi_client.store.envval == NULL && | ||
1208 | + gssapi_client.store.envvar == NULL) | ||
1209 | + return; | ||
1210 | + | ||
1211 | + ok = PRIVSEP(ssh_gssapi_update_creds(&gssapi_client.store)); | ||
1212 | + | ||
1213 | + if (!ok) | ||
1214 | + return; | ||
1215 | + | ||
1216 | + debug("Rekeyed credentials stored successfully"); | ||
1217 | + | ||
1218 | + /* Actually managing to play with the ssh pam stack from here will | ||
1219 | + * be next to impossible. In any case, we may want different options | ||
1220 | + * for rekeying. So, use our own :) | ||
1221 | + */ | ||
1222 | +#ifdef USE_PAM | ||
1223 | + if (!use_privsep) { | ||
1224 | + debug("Not even going to try and do PAM with privsep disabled"); | ||
1225 | + return; | ||
1226 | + } | ||
1227 | + | ||
1228 | + ret = pam_start("sshd-rekey", gssapi_client.store.owner->pw_name, | ||
1229 | + &pamconv, &pamh); | ||
1230 | + if (ret) | ||
1231 | + return; | ||
1232 | + | ||
1233 | + xasprintf(&envstr, "%s=%s", gssapi_client.store.envvar, | ||
1234 | + gssapi_client.store.envval); | ||
1235 | + | ||
1236 | + ret = pam_putenv(pamh, envstr); | ||
1237 | + if (!ret) | ||
1238 | + pam_setcred(pamh, PAM_REINITIALIZE_CRED); | ||
1239 | + pam_end(pamh, PAM_SUCCESS); | ||
1240 | +#endif | ||
1241 | +} | ||
1242 | + | ||
1243 | +int | ||
1244 | +ssh_gssapi_update_creds(ssh_gssapi_ccache *store) { | ||
1245 | + int ok = 0; | ||
1246 | + | ||
1247 | + /* Check we've got credentials to store */ | ||
1248 | + if (!gssapi_client.updated) | ||
1249 | + return 0; | ||
1250 | + | ||
1251 | + gssapi_client.updated = 0; | ||
1252 | + | ||
1253 | + temporarily_use_uid(gssapi_client.store.owner); | ||
1254 | + if (gssapi_client.mech && gssapi_client.mech->updatecreds) | ||
1255 | + ok = (*gssapi_client.mech->updatecreds)(store, &gssapi_client); | ||
1256 | + else | ||
1257 | + debug("No update function for this mechanism"); | ||
1258 | + | ||
1259 | + restore_uid(); | ||
1260 | + | ||
1261 | + return ok; | ||
1262 | } | ||
1263 | |||
1264 | #endif | ||
1265 | Index: b/kex.c | ||
1266 | =================================================================== | ||
1267 | --- a/kex.c | ||
1268 | +++ b/kex.c | ||
1269 | @@ -50,6 +50,10 @@ | ||
1270 | #include "monitor.h" | ||
1271 | #include "roaming.h" | ||
1272 | |||
1273 | +#ifdef GSSAPI | ||
1274 | +#include "ssh-gss.h" | ||
1275 | +#endif | ||
1276 | + | ||
1277 | #if OPENSSL_VERSION_NUMBER >= 0x00907000L | ||
1278 | # if defined(HAVE_EVP_SHA256) | ||
1279 | # define evp_ssh_sha256 EVP_sha256 | ||
1280 | @@ -358,6 +362,20 @@ | ||
1281 | k->kex_type = KEX_ECDH_SHA2; | ||
1282 | k->evp_md = kex_ecdh_name_to_evpmd(k->name); | ||
1283 | #endif | ||
1284 | +#ifdef GSSAPI | ||
1285 | + } else if (strncmp(k->name, KEX_GSS_GEX_SHA1_ID, | ||
1286 | + sizeof(KEX_GSS_GEX_SHA1_ID) - 1) == 0) { | ||
1287 | + k->kex_type = KEX_GSS_GEX_SHA1; | ||
1288 | + k->evp_md = EVP_sha1(); | ||
1289 | + } else if (strncmp(k->name, KEX_GSS_GRP1_SHA1_ID, | ||
1290 | + sizeof(KEX_GSS_GRP1_SHA1_ID) - 1) == 0) { | ||
1291 | + k->kex_type = KEX_GSS_GRP1_SHA1; | ||
1292 | + k->evp_md = EVP_sha1(); | ||
1293 | + } else if (strncmp(k->name, KEX_GSS_GRP14_SHA1_ID, | ||
1294 | + sizeof(KEX_GSS_GRP14_SHA1_ID) - 1) == 0) { | ||
1295 | + k->kex_type = KEX_GSS_GRP14_SHA1; | ||
1296 | + k->evp_md = EVP_sha1(); | ||
1297 | +#endif | ||
1298 | } else | ||
1299 | fatal("bad kex alg %s", k->name); | ||
1300 | } | ||
1301 | Index: b/kex.h | ||
1302 | =================================================================== | ||
1303 | --- a/kex.h | ||
1304 | +++ b/kex.h | ||
1305 | @@ -73,6 +73,9 @@ | ||
1306 | KEX_DH_GEX_SHA1, | ||
1307 | KEX_DH_GEX_SHA256, | ||
1308 | KEX_ECDH_SHA2, | ||
1309 | + KEX_GSS_GRP1_SHA1, | ||
1310 | + KEX_GSS_GRP14_SHA1, | ||
1311 | + KEX_GSS_GEX_SHA1, | ||
1312 | KEX_MAX | ||
1313 | }; | ||
1314 | |||
1315 | @@ -129,6 +132,12 @@ | ||
1316 | sig_atomic_t done; | ||
1317 | int flags; | ||
1318 | const EVP_MD *evp_md; | ||
1319 | +#ifdef GSSAPI | ||
1320 | + int gss_deleg_creds; | ||
1321 | + int gss_trust_dns; | ||
1322 | + char *gss_host; | ||
1323 | + char *gss_client; | ||
1324 | +#endif | ||
1325 | char *client_version_string; | ||
1326 | char *server_version_string; | ||
1327 | int (*verify_host_key)(Key *); | ||
1328 | @@ -156,6 +165,11 @@ | ||
1329 | void kexecdh_client(Kex *); | ||
1330 | void kexecdh_server(Kex *); | ||
1331 | |||
1332 | +#ifdef GSSAPI | ||
1333 | +void kexgss_client(Kex *); | ||
1334 | +void kexgss_server(Kex *); | ||
1335 | +#endif | ||
1336 | + | ||
1337 | void | ||
1338 | kex_dh_hash(char *, char *, char *, int, char *, int, u_char *, int, | ||
1339 | BIGNUM *, BIGNUM *, BIGNUM *, u_char **, u_int *); | ||
1340 | Index: b/kexgssc.c | ||
1341 | =================================================================== | ||
1342 | --- /dev/null | ||
1343 | +++ b/kexgssc.c | ||
1344 | @@ -0,0 +1,334 @@ | ||
1345 | +/* | ||
1346 | + * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved. | ||
1347 | + * | ||
1348 | + * Redistribution and use in source and binary forms, with or without | ||
1349 | + * modification, are permitted provided that the following conditions | ||
1350 | + * are met: | ||
1351 | + * 1. Redistributions of source code must retain the above copyright | ||
1352 | + * notice, this list of conditions and the following disclaimer. | ||
1353 | + * 2. Redistributions in binary form must reproduce the above copyright | ||
1354 | + * notice, this list of conditions and the following disclaimer in the | ||
1355 | + * documentation and/or other materials provided with the distribution. | ||
1356 | + * | ||
1357 | + * THIS SOFTWARE IS PROVIDED BY THE AUTHOR `AS IS'' AND ANY EXPRESS OR | ||
1358 | + * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES | ||
1359 | + * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. | ||
1360 | + * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, | ||
1361 | + * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT | ||
1362 | + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, | ||
1363 | + * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY | ||
1364 | + * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT | ||
1365 | + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF | ||
1366 | + * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | ||
1367 | + */ | ||
1368 | + | ||
1369 | +#include "includes.h" | ||
1370 | + | ||
1371 | +#ifdef GSSAPI | ||
1372 | + | ||
1373 | +#include "includes.h" | ||
1374 | + | ||
1375 | +#include <openssl/crypto.h> | ||
1376 | +#include <openssl/bn.h> | ||
1377 | + | ||
1378 | +#include <string.h> | ||
1379 | + | ||
1380 | +#include "xmalloc.h" | ||
1381 | +#include "buffer.h" | ||
1382 | +#include "ssh2.h" | ||
1383 | +#include "key.h" | ||
1384 | +#include "cipher.h" | ||
1385 | +#include "kex.h" | ||
1386 | +#include "log.h" | ||
1387 | +#include "packet.h" | ||
1388 | +#include "dh.h" | ||
1389 | + | ||
1390 | +#include "ssh-gss.h" | ||
1391 | + | ||
1392 | +void | ||
1393 | +kexgss_client(Kex *kex) { | ||
1394 | + gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER; | ||
1395 | + gss_buffer_desc recv_tok, gssbuf, msg_tok, *token_ptr; | ||
1396 | + Gssctxt *ctxt; | ||
1397 | + OM_uint32 maj_status, min_status, ret_flags; | ||
1398 | + u_int klen, kout, slen = 0, hashlen, strlen; | ||
1399 | + DH *dh; | ||
1400 | + BIGNUM *dh_server_pub = NULL; | ||
1401 | + BIGNUM *shared_secret = NULL; | ||
1402 | + BIGNUM *p = NULL; | ||
1403 | + BIGNUM *g = NULL; | ||
1404 | + u_char *kbuf, *hash; | ||
1405 | + u_char *serverhostkey = NULL; | ||
1406 | + u_char *empty = ""; | ||
1407 | + char *msg; | ||
1408 | + char *lang; | ||
1409 | + int type = 0; | ||
1410 | + int first = 1; | ||
1411 | + int nbits = 0, min = DH_GRP_MIN, max = DH_GRP_MAX; | ||
1412 | + | ||
1413 | + /* Initialise our GSSAPI world */ | ||
1414 | + ssh_gssapi_build_ctx(&ctxt); | ||
1415 | + if (ssh_gssapi_id_kex(ctxt, kex->name, kex->kex_type) | ||
1416 | + == GSS_C_NO_OID) | ||
1417 | + fatal("Couldn't identify host exchange"); | ||
1418 | + | ||
1419 | + if (ssh_gssapi_import_name(ctxt, kex->gss_host)) | ||
1420 | + fatal("Couldn't import hostname"); | ||
1421 | + | ||
1422 | + if (kex->gss_client && | ||
1423 | + ssh_gssapi_client_identity(ctxt, kex->gss_client)) | ||
1424 | + fatal("Couldn't acquire client credentials"); | ||
1425 | + | ||
1426 | + switch (kex->kex_type) { | ||
1427 | + case KEX_GSS_GRP1_SHA1: | ||
1428 | + dh = dh_new_group1(); | ||
1429 | + break; | ||
1430 | + case KEX_GSS_GRP14_SHA1: | ||
1431 | + dh = dh_new_group14(); | ||
1432 | + break; | ||
1433 | + case KEX_GSS_GEX_SHA1: | ||
1434 | + debug("Doing group exchange\n"); | ||
1435 | + nbits = dh_estimate(kex->we_need * 8); | ||
1436 | + packet_start(SSH2_MSG_KEXGSS_GROUPREQ); | ||
1437 | + packet_put_int(min); | ||
1438 | + packet_put_int(nbits); | ||
1439 | + packet_put_int(max); | ||
1440 | + | ||
1441 | + packet_send(); | ||
1442 | + | ||
1443 | + packet_read_expect(SSH2_MSG_KEXGSS_GROUP); | ||
1444 | + | ||
1445 | + if ((p = BN_new()) == NULL) | ||
1446 | + fatal("BN_new() failed"); | ||
1447 | + packet_get_bignum2(p); | ||
1448 | + if ((g = BN_new()) == NULL) | ||
1449 | + fatal("BN_new() failed"); | ||
1450 | + packet_get_bignum2(g); | ||
1451 | + packet_check_eom(); | ||
1452 | + | ||
1453 | + if (BN_num_bits(p) < min || BN_num_bits(p) > max) | ||
1454 | + fatal("GSSGRP_GEX group out of range: %d !< %d !< %d", | ||
1455 | + min, BN_num_bits(p), max); | ||
1456 | + | ||
1457 | + dh = dh_new_group(g, p); | ||
1458 | + break; | ||
1459 | + default: | ||
1460 | + fatal("%s: Unexpected KEX type %d", __func__, kex->kex_type); | ||
1461 | + } | ||
1462 | + | ||
1463 | + /* Step 1 - e is dh->pub_key */ | ||
1464 | + dh_gen_key(dh, kex->we_need * 8); | ||
1465 | + | ||
1466 | + /* This is f, we initialise it now to make life easier */ | ||
1467 | + dh_server_pub = BN_new(); | ||
1468 | + if (dh_server_pub == NULL) | ||
1469 | + fatal("dh_server_pub == NULL"); | ||
1470 | + | ||
1471 | + token_ptr = GSS_C_NO_BUFFER; | ||
1472 | + | ||
1473 | + do { | ||
1474 | + debug("Calling gss_init_sec_context"); | ||
1475 | + | ||
1476 | + maj_status = ssh_gssapi_init_ctx(ctxt, | ||
1477 | + kex->gss_deleg_creds, token_ptr, &send_tok, | ||
1478 | + &ret_flags); | ||
1479 | + | ||
1480 | + if (GSS_ERROR(maj_status)) { | ||
1481 | + if (send_tok.length != 0) { | ||
1482 | + packet_start(SSH2_MSG_KEXGSS_CONTINUE); | ||
1483 | + packet_put_string(send_tok.value, | ||
1484 | + send_tok.length); | ||
1485 | + } | ||
1486 | + fatal("gss_init_context failed"); | ||
1487 | + } | ||
1488 | + | ||
1489 | + /* If we've got an old receive buffer get rid of it */ | ||
1490 | + if (token_ptr != GSS_C_NO_BUFFER) | ||
1491 | + xfree(recv_tok.value); | ||
1492 | + | ||
1493 | + if (maj_status == GSS_S_COMPLETE) { | ||
1494 | + /* If mutual state flag is not true, kex fails */ | ||
1495 | + if (!(ret_flags & GSS_C_MUTUAL_FLAG)) | ||
1496 | + fatal("Mutual authentication failed"); | ||
1497 | + | ||
1498 | + /* If integ avail flag is not true kex fails */ | ||
1499 | + if (!(ret_flags & GSS_C_INTEG_FLAG)) | ||
1500 | + fatal("Integrity check failed"); | ||
1501 | + } | ||
1502 | + | ||
1503 | + /* | ||
1504 | + * If we have data to send, then the last message that we | ||
1505 | + * received cannot have been a 'complete'. | ||
1506 | + */ | ||
1507 | + if (send_tok.length != 0) { | ||
1508 | + if (first) { | ||
1509 | + packet_start(SSH2_MSG_KEXGSS_INIT); | ||
1510 | + packet_put_string(send_tok.value, | ||
1511 | + send_tok.length); | ||
1512 | + packet_put_bignum2(dh->pub_key); | ||
1513 | + first = 0; | ||
1514 | + } else { | ||
1515 | + packet_start(SSH2_MSG_KEXGSS_CONTINUE); | ||
1516 | + packet_put_string(send_tok.value, | ||
1517 | + send_tok.length); | ||
1518 | + } | ||
1519 | + packet_send(); | ||
1520 | + gss_release_buffer(&min_status, &send_tok); | ||
1521 | + | ||
1522 | + /* If we've sent them data, they should reply */ | ||
1523 | + do { | ||
1524 | + type = packet_read(); | ||
1525 | + if (type == SSH2_MSG_KEXGSS_HOSTKEY) { | ||
1526 | + debug("Received KEXGSS_HOSTKEY"); | ||
1527 | + if (serverhostkey) | ||
1528 | + fatal("Server host key received more than once"); | ||
1529 | + serverhostkey = | ||
1530 | + packet_get_string(&slen); | ||
1531 | + } | ||
1532 | + } while (type == SSH2_MSG_KEXGSS_HOSTKEY); | ||
1533 | + | ||
1534 | + switch (type) { | ||
1535 | + case SSH2_MSG_KEXGSS_CONTINUE: | ||
1536 | + debug("Received GSSAPI_CONTINUE"); | ||
1537 | + if (maj_status == GSS_S_COMPLETE) | ||
1538 | + fatal("GSSAPI Continue received from server when complete"); | ||
1539 | + recv_tok.value = packet_get_string(&strlen); | ||
1540 | + recv_tok.length = strlen; | ||
1541 | + break; | ||
1542 | + case SSH2_MSG_KEXGSS_COMPLETE: | ||
1543 | + debug("Received GSSAPI_COMPLETE"); | ||
1544 | + packet_get_bignum2(dh_server_pub); | ||
1545 | + msg_tok.value = packet_get_string(&strlen); | ||
1546 | + msg_tok.length = strlen; | ||
1547 | + | ||
1548 | + /* Is there a token included? */ | ||
1549 | + if (packet_get_char()) { | ||
1550 | + recv_tok.value= | ||
1551 | + packet_get_string(&strlen); | ||
1552 | + recv_tok.length = strlen; | ||
1553 | + /* If we're already complete - protocol error */ | ||
1554 | + if (maj_status == GSS_S_COMPLETE) | ||
1555 | + packet_disconnect("Protocol error: received token when complete"); | ||
1556 | + } else { | ||
1557 | + /* No token included */ | ||
1558 | + if (maj_status != GSS_S_COMPLETE) | ||
1559 | + packet_disconnect("Protocol error: did not receive final token"); | ||
1560 | + } | ||
1561 | + break; | ||
1562 | + case SSH2_MSG_KEXGSS_ERROR: | ||
1563 | + debug("Received Error"); | ||
1564 | + maj_status = packet_get_int(); | ||
1565 | + min_status = packet_get_int(); | ||
1566 | + msg = packet_get_string(NULL); | ||
1567 | + lang = packet_get_string(NULL); | ||
1568 | + fatal("GSSAPI Error: \n%.400s",msg); | ||
1569 | + default: | ||
1570 | + packet_disconnect("Protocol error: didn't expect packet type %d", | ||
1571 | + type); | ||
1572 | + } | ||
1573 | + token_ptr = &recv_tok; | ||
1574 | + } else { | ||
1575 | + /* No data, and not complete */ | ||
1576 | + if (maj_status != GSS_S_COMPLETE) | ||
1577 | + fatal("Not complete, and no token output"); | ||
1578 | + } | ||
1579 | + } while (maj_status & GSS_S_CONTINUE_NEEDED); | ||
1580 | + | ||
1581 | + /* | ||
1582 | + * We _must_ have received a COMPLETE message in reply from the | ||
1583 | + * server, which will have set dh_server_pub and msg_tok | ||
1584 | + */ | ||
1585 | + | ||
1586 | + if (type != SSH2_MSG_KEXGSS_COMPLETE) | ||
1587 | + fatal("Didn't receive a SSH2_MSG_KEXGSS_COMPLETE when I expected it"); | ||
1588 | + | ||
1589 | + /* Check f in range [1, p-1] */ | ||
1590 | + if (!dh_pub_is_valid(dh, dh_server_pub)) | ||
1591 | + packet_disconnect("bad server public DH value"); | ||
1592 | + | ||
1593 | + /* compute K=f^x mod p */ | ||
1594 | + klen = DH_size(dh); | ||
1595 | + kbuf = xmalloc(klen); | ||
1596 | + kout = DH_compute_key(kbuf, dh_server_pub, dh); | ||
1597 | + if (kout < 0) | ||
1598 | + fatal("DH_compute_key: failed"); | ||
1599 | + | ||
1600 | + shared_secret = BN_new(); | ||
1601 | + if (shared_secret == NULL) | ||
1602 | + fatal("kexgss_client: BN_new failed"); | ||
1603 | + | ||
1604 | + if (BN_bin2bn(kbuf, kout, shared_secret) == NULL) | ||
1605 | + fatal("kexdh_client: BN_bin2bn failed"); | ||
1606 | + | ||
1607 | + memset(kbuf, 0, klen); | ||
1608 | + xfree(kbuf); | ||
1609 | + | ||
1610 | + switch (kex->kex_type) { | ||
1611 | + case KEX_GSS_GRP1_SHA1: | ||
1612 | + case KEX_GSS_GRP14_SHA1: | ||
1613 | + kex_dh_hash( kex->client_version_string, | ||
1614 | + kex->server_version_string, | ||
1615 | + buffer_ptr(&kex->my), buffer_len(&kex->my), | ||
1616 | + buffer_ptr(&kex->peer), buffer_len(&kex->peer), | ||
1617 | + (serverhostkey ? serverhostkey : empty), slen, | ||
1618 | + dh->pub_key, /* e */ | ||
1619 | + dh_server_pub, /* f */ | ||
1620 | + shared_secret, /* K */ | ||
1621 | + &hash, &hashlen | ||
1622 | + ); | ||
1623 | + break; | ||
1624 | + case KEX_GSS_GEX_SHA1: | ||
1625 | + kexgex_hash( | ||
1626 | + kex->evp_md, | ||
1627 | + kex->client_version_string, | ||
1628 | + kex->server_version_string, | ||
1629 | + buffer_ptr(&kex->my), buffer_len(&kex->my), | ||
1630 | + buffer_ptr(&kex->peer), buffer_len(&kex->peer), | ||
1631 | + (serverhostkey ? serverhostkey : empty), slen, | ||
1632 | + min, nbits, max, | ||
1633 | + dh->p, dh->g, | ||
1634 | + dh->pub_key, | ||
1635 | + dh_server_pub, | ||
1636 | + shared_secret, | ||
1637 | + &hash, &hashlen | ||
1638 | + ); | ||
1639 | + break; | ||
1640 | + default: | ||
1641 | + fatal("%s: Unexpected KEX type %d", __func__, kex->kex_type); | ||
1642 | + } | ||
1643 | + | ||
1644 | + gssbuf.value = hash; | ||
1645 | + gssbuf.length = hashlen; | ||
1646 | + | ||
1647 | + /* Verify that the hash matches the MIC we just got. */ | ||
1648 | + if (GSS_ERROR(ssh_gssapi_checkmic(ctxt, &gssbuf, &msg_tok))) | ||
1649 | + packet_disconnect("Hash's MIC didn't verify"); | ||
1650 | + | ||
1651 | + xfree(msg_tok.value); | ||
1652 | + | ||
1653 | + DH_free(dh); | ||
1654 | + if (serverhostkey) | ||
1655 | + xfree(serverhostkey); | ||
1656 | + BN_clear_free(dh_server_pub); | ||
1657 | + | ||
1658 | + /* save session id */ | ||
1659 | + if (kex->session_id == NULL) { | ||
1660 | + kex->session_id_len = hashlen; | ||
1661 | + kex->session_id = xmalloc(kex->session_id_len); | ||
1662 | + memcpy(kex->session_id, hash, kex->session_id_len); | ||
1663 | + } | ||
1664 | + | ||
1665 | + if (kex->gss_deleg_creds) | ||
1666 | + ssh_gssapi_credentials_updated(ctxt); | ||
1667 | + | ||
1668 | + if (gss_kex_context == NULL) | ||
1669 | + gss_kex_context = ctxt; | ||
1670 | + else | ||
1671 | + ssh_gssapi_delete_ctx(&ctxt); | ||
1672 | + | ||
1673 | + kex_derive_keys(kex, hash, hashlen, shared_secret); | ||
1674 | + BN_clear_free(shared_secret); | ||
1675 | + kex_finish(kex); | ||
1676 | +} | ||
1677 | + | ||
1678 | +#endif /* GSSAPI */ | ||
1679 | Index: b/kexgsss.c | ||
1680 | =================================================================== | ||
1681 | --- /dev/null | ||
1682 | +++ b/kexgsss.c | ||
1683 | @@ -0,0 +1,288 @@ | ||
1684 | +/* | ||
1685 | + * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved. | ||
1686 | + * | ||
1687 | + * Redistribution and use in source and binary forms, with or without | ||
1688 | + * modification, are permitted provided that the following conditions | ||
1689 | + * are met: | ||
1690 | + * 1. Redistributions of source code must retain the above copyright | ||
1691 | + * notice, this list of conditions and the following disclaimer. | ||
1692 | + * 2. Redistributions in binary form must reproduce the above copyright | ||
1693 | + * notice, this list of conditions and the following disclaimer in the | ||
1694 | + * documentation and/or other materials provided with the distribution. | ||
1695 | + * | ||
1696 | + * THIS SOFTWARE IS PROVIDED BY THE AUTHOR `AS IS'' AND ANY EXPRESS OR | ||
1697 | + * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES | ||
1698 | + * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. | ||
1699 | + * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, | ||
1700 | + * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT | ||
1701 | + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, | ||
1702 | + * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY | ||
1703 | + * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT | ||
1704 | + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF | ||
1705 | + * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | ||
1706 | + */ | ||
1707 | + | ||
1708 | +#include "includes.h" | ||
1709 | + | ||
1710 | +#ifdef GSSAPI | ||
1711 | + | ||
1712 | +#include <string.h> | ||
1713 | + | ||
1714 | +#include <openssl/crypto.h> | ||
1715 | +#include <openssl/bn.h> | ||
1716 | + | ||
1717 | +#include "xmalloc.h" | ||
1718 | +#include "buffer.h" | ||
1719 | +#include "ssh2.h" | ||
1720 | +#include "key.h" | ||
1721 | +#include "cipher.h" | ||
1722 | +#include "kex.h" | ||
1723 | +#include "log.h" | ||
1724 | +#include "packet.h" | ||
1725 | +#include "dh.h" | ||
1726 | +#include "ssh-gss.h" | ||
1727 | +#include "monitor_wrap.h" | ||
1728 | +#include "servconf.h" | ||
1729 | + | ||
1730 | +extern ServerOptions options; | ||
1731 | + | ||
1732 | +void | ||
1733 | +kexgss_server(Kex *kex) | ||
1734 | +{ | ||
1735 | + OM_uint32 maj_status, min_status; | ||
1736 | + | ||
1737 | + /* | ||
1738 | + * Some GSSAPI implementations use the input value of ret_flags (an | ||
1739 | + * output variable) as a means of triggering mechanism specific | ||
1740 | + * features. Initializing it to zero avoids inadvertently | ||
1741 | + * activating this non-standard behaviour. | ||
1742 | + */ | ||
1743 | + | ||
1744 | + OM_uint32 ret_flags = 0; | ||
1745 | + gss_buffer_desc gssbuf, recv_tok, msg_tok; | ||
1746 | + gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER; | ||
1747 | + Gssctxt *ctxt = NULL; | ||
1748 | + u_int slen, klen, kout, hashlen; | ||
1749 | + u_char *kbuf, *hash; | ||
1750 | + DH *dh; | ||
1751 | + int min = -1, max = -1, nbits = -1; | ||
1752 | + BIGNUM *shared_secret = NULL; | ||
1753 | + BIGNUM *dh_client_pub = NULL; | ||
1754 | + int type = 0; | ||
1755 | + gss_OID oid; | ||
1756 | + char *mechs; | ||
1757 | + | ||
1758 | + /* Initialise GSSAPI */ | ||
1759 | + | ||
1760 | + /* If we're rekeying, privsep means that some of the private structures | ||
1761 | + * in the GSSAPI code are no longer available. This kludges them back | ||
1762 | + * into life | ||
1763 | + */ | ||
1764 | + if (!ssh_gssapi_oid_table_ok()) | ||
1765 | + if ((mechs = ssh_gssapi_server_mechanisms())) | ||
1766 | + xfree(mechs); | ||
1767 | + | ||
1768 | + debug2("%s: Identifying %s", __func__, kex->name); | ||
1769 | + oid = ssh_gssapi_id_kex(NULL, kex->name, kex->kex_type); | ||
1770 | + if (oid == GSS_C_NO_OID) | ||
1771 | + fatal("Unknown gssapi mechanism"); | ||
1772 | + | ||
1773 | + debug2("%s: Acquiring credentials", __func__); | ||
1774 | + | ||
1775 | + if (GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctxt, oid)))) | ||
1776 | + fatal("Unable to acquire credentials for the server"); | ||
1777 | + | ||
1778 | + switch (kex->kex_type) { | ||
1779 | + case KEX_GSS_GRP1_SHA1: | ||
1780 | + dh = dh_new_group1(); | ||
1781 | + break; | ||
1782 | + case KEX_GSS_GRP14_SHA1: | ||
1783 | + dh = dh_new_group14(); | ||
1784 | + break; | ||
1785 | + case KEX_GSS_GEX_SHA1: | ||
1786 | + debug("Doing group exchange"); | ||
1787 | + packet_read_expect(SSH2_MSG_KEXGSS_GROUPREQ); | ||
1788 | + min = packet_get_int(); | ||
1789 | + nbits = packet_get_int(); | ||
1790 | + max = packet_get_int(); | ||
1791 | + min = MAX(DH_GRP_MIN, min); | ||
1792 | + max = MIN(DH_GRP_MAX, max); | ||
1793 | + packet_check_eom(); | ||
1794 | + if (max < min || nbits < min || max < nbits) | ||
1795 | + fatal("GSS_GEX, bad parameters: %d !< %d !< %d", | ||
1796 | + min, nbits, max); | ||
1797 | + dh = PRIVSEP(choose_dh(min, nbits, max)); | ||
1798 | + if (dh == NULL) | ||
1799 | + packet_disconnect("Protocol error: no matching group found"); | ||
1800 | + | ||
1801 | + packet_start(SSH2_MSG_KEXGSS_GROUP); | ||
1802 | + packet_put_bignum2(dh->p); | ||
1803 | + packet_put_bignum2(dh->g); | ||
1804 | + packet_send(); | ||
1805 | + | ||
1806 | + packet_write_wait(); | ||
1807 | + break; | ||
1808 | + default: | ||
1809 | + fatal("%s: Unexpected KEX type %d", __func__, kex->kex_type); | ||
1810 | + } | ||
1811 | + | ||
1812 | + dh_gen_key(dh, kex->we_need * 8); | ||
1813 | + | ||
1814 | + do { | ||
1815 | + debug("Wait SSH2_MSG_GSSAPI_INIT"); | ||
1816 | + type = packet_read(); | ||
1817 | + switch(type) { | ||
1818 | + case SSH2_MSG_KEXGSS_INIT: | ||
1819 | + if (dh_client_pub != NULL) | ||
1820 | + fatal("Received KEXGSS_INIT after initialising"); | ||
1821 | + recv_tok.value = packet_get_string(&slen); | ||
1822 | + recv_tok.length = slen; | ||
1823 | + | ||
1824 | + if ((dh_client_pub = BN_new()) == NULL) | ||
1825 | + fatal("dh_client_pub == NULL"); | ||
1826 | + | ||
1827 | + packet_get_bignum2(dh_client_pub); | ||
1828 | + | ||
1829 | + /* Send SSH_MSG_KEXGSS_HOSTKEY here, if we want */ | ||
1830 | + break; | ||
1831 | + case SSH2_MSG_KEXGSS_CONTINUE: | ||
1832 | + recv_tok.value = packet_get_string(&slen); | ||
1833 | + recv_tok.length = slen; | ||
1834 | + break; | ||
1835 | + default: | ||
1836 | + packet_disconnect( | ||
1837 | + "Protocol error: didn't expect packet type %d", | ||
1838 | + type); | ||
1839 | + } | ||
1840 | + | ||
1841 | + maj_status = PRIVSEP(ssh_gssapi_accept_ctx(ctxt, &recv_tok, | ||
1842 | + &send_tok, &ret_flags)); | ||
1843 | + | ||
1844 | + xfree(recv_tok.value); | ||
1845 | + | ||
1846 | + if (maj_status != GSS_S_COMPLETE && send_tok.length == 0) | ||
1847 | + fatal("Zero length token output when incomplete"); | ||
1848 | + | ||
1849 | + if (dh_client_pub == NULL) | ||
1850 | + fatal("No client public key"); | ||
1851 | + | ||
1852 | + if (maj_status & GSS_S_CONTINUE_NEEDED) { | ||
1853 | + debug("Sending GSSAPI_CONTINUE"); | ||
1854 | + packet_start(SSH2_MSG_KEXGSS_CONTINUE); | ||
1855 | + packet_put_string(send_tok.value, send_tok.length); | ||
1856 | + packet_send(); | ||
1857 | + gss_release_buffer(&min_status, &send_tok); | ||
1858 | + } | ||
1859 | + } while (maj_status & GSS_S_CONTINUE_NEEDED); | ||
1860 | + | ||
1861 | + if (GSS_ERROR(maj_status)) { | ||
1862 | + if (send_tok.length > 0) { | ||
1863 | + packet_start(SSH2_MSG_KEXGSS_CONTINUE); | ||
1864 | + packet_put_string(send_tok.value, send_tok.length); | ||
1865 | + packet_send(); | ||
1866 | + } | ||
1867 | + fatal("accept_ctx died"); | ||
1868 | + } | ||
1869 | + | ||
1870 | + if (!(ret_flags & GSS_C_MUTUAL_FLAG)) | ||
1871 | + fatal("Mutual Authentication flag wasn't set"); | ||
1872 | + | ||
1873 | + if (!(ret_flags & GSS_C_INTEG_FLAG)) | ||
1874 | + fatal("Integrity flag wasn't set"); | ||
1875 | + | ||
1876 | + if (!dh_pub_is_valid(dh, dh_client_pub)) | ||
1877 | + packet_disconnect("bad client public DH value"); | ||
1878 | + | ||
1879 | + klen = DH_size(dh); | ||
1880 | + kbuf = xmalloc(klen); | ||
1881 | + kout = DH_compute_key(kbuf, dh_client_pub, dh); | ||
1882 | + if (kout < 0) | ||
1883 | + fatal("DH_compute_key: failed"); | ||
1884 | + | ||
1885 | + shared_secret = BN_new(); | ||
1886 | + if (shared_secret == NULL) | ||
1887 | + fatal("kexgss_server: BN_new failed"); | ||
1888 | + | ||
1889 | + if (BN_bin2bn(kbuf, kout, shared_secret) == NULL) | ||
1890 | + fatal("kexgss_server: BN_bin2bn failed"); | ||
1891 | + | ||
1892 | + memset(kbuf, 0, klen); | ||
1893 | + xfree(kbuf); | ||
1894 | + | ||
1895 | + switch (kex->kex_type) { | ||
1896 | + case KEX_GSS_GRP1_SHA1: | ||
1897 | + case KEX_GSS_GRP14_SHA1: | ||
1898 | + kex_dh_hash( | ||
1899 | + kex->client_version_string, kex->server_version_string, | ||
1900 | + buffer_ptr(&kex->peer), buffer_len(&kex->peer), | ||
1901 | + buffer_ptr(&kex->my), buffer_len(&kex->my), | ||
1902 | + NULL, 0, /* Change this if we start sending host keys */ | ||
1903 | + dh_client_pub, dh->pub_key, shared_secret, | ||
1904 | + &hash, &hashlen | ||
1905 | + ); | ||
1906 | + break; | ||
1907 | + case KEX_GSS_GEX_SHA1: | ||
1908 | + kexgex_hash( | ||
1909 | + kex->evp_md, | ||
1910 | + kex->client_version_string, kex->server_version_string, | ||
1911 | + buffer_ptr(&kex->peer), buffer_len(&kex->peer), | ||
1912 | + buffer_ptr(&kex->my), buffer_len(&kex->my), | ||
1913 | + NULL, 0, | ||
1914 | + min, nbits, max, | ||
1915 | + dh->p, dh->g, | ||
1916 | + dh_client_pub, | ||
1917 | + dh->pub_key, | ||
1918 | + shared_secret, | ||
1919 | + &hash, &hashlen | ||
1920 | + ); | ||
1921 | + break; | ||
1922 | + default: | ||
1923 | + fatal("%s: Unexpected KEX type %d", __func__, kex->kex_type); | ||
1924 | + } | ||
1925 | + | ||
1926 | + BN_clear_free(dh_client_pub); | ||
1927 | + | ||
1928 | + if (kex->session_id == NULL) { | ||
1929 | + kex->session_id_len = hashlen; | ||
1930 | + kex->session_id = xmalloc(kex->session_id_len); | ||
1931 | + memcpy(kex->session_id, hash, kex->session_id_len); | ||
1932 | + } | ||
1933 | + | ||
1934 | + gssbuf.value = hash; | ||
1935 | + gssbuf.length = hashlen; | ||
1936 | + | ||
1937 | + if (GSS_ERROR(PRIVSEP(ssh_gssapi_sign(ctxt,&gssbuf,&msg_tok)))) | ||
1938 | + fatal("Couldn't get MIC"); | ||
1939 | + | ||
1940 | + packet_start(SSH2_MSG_KEXGSS_COMPLETE); | ||
1941 | + packet_put_bignum2(dh->pub_key); | ||
1942 | + packet_put_string(msg_tok.value,msg_tok.length); | ||
1943 | + | ||
1944 | + if (send_tok.length != 0) { | ||
1945 | + packet_put_char(1); /* true */ | ||
1946 | + packet_put_string(send_tok.value, send_tok.length); | ||
1947 | + } else { | ||
1948 | + packet_put_char(0); /* false */ | ||
1949 | + } | ||
1950 | + packet_send(); | ||
1951 | + | ||
1952 | + gss_release_buffer(&min_status, &send_tok); | ||
1953 | + gss_release_buffer(&min_status, &msg_tok); | ||
1954 | + | ||
1955 | + if (gss_kex_context == NULL) | ||
1956 | + gss_kex_context = ctxt; | ||
1957 | + else | ||
1958 | + ssh_gssapi_delete_ctx(&ctxt); | ||
1959 | + | ||
1960 | + DH_free(dh); | ||
1961 | + | ||
1962 | + kex_derive_keys(kex, hash, hashlen, shared_secret); | ||
1963 | + BN_clear_free(shared_secret); | ||
1964 | + kex_finish(kex); | ||
1965 | + | ||
1966 | + /* If this was a rekey, then save out any delegated credentials we | ||
1967 | + * just exchanged. */ | ||
1968 | + if (options.gss_store_rekey) | ||
1969 | + ssh_gssapi_rekey_creds(); | ||
1970 | +} | ||
1971 | +#endif /* GSSAPI */ | ||
1972 | Index: b/key.c | ||
1973 | =================================================================== | ||
1974 | --- a/key.c | ||
1975 | +++ b/key.c | ||
1976 | @@ -971,6 +971,8 @@ | ||
1977 | } | ||
1978 | break; | ||
1979 | #endif /* OPENSSL_HAS_ECC */ | ||
1980 | + case KEY_NULL: | ||
1981 | + return "null"; | ||
1982 | } | ||
1983 | return "ssh-unknown"; | ||
1984 | } | ||
1985 | @@ -1276,6 +1278,8 @@ | ||
1986 | strcmp(name, "ecdsa-sha2-nistp521-cert-v01@openssh.com") == 0) { | ||
1987 | return KEY_ECDSA_CERT; | ||
1988 | #endif | ||
1989 | + } else if (strcmp(name, "null") == 0) { | ||
1990 | + return KEY_NULL; | ||
1991 | } | ||
1992 | |||
1993 | debug2("key_type_from_name: unknown key type '%s'", name); | ||
1994 | Index: b/key.h | ||
1995 | =================================================================== | ||
1996 | --- a/key.h | ||
1997 | +++ b/key.h | ||
1998 | @@ -44,6 +44,7 @@ | ||
1999 | KEY_ECDSA_CERT, | ||
2000 | KEY_RSA_CERT_V00, | ||
2001 | KEY_DSA_CERT_V00, | ||
2002 | + KEY_NULL, | ||
2003 | KEY_UNSPEC | ||
2004 | }; | ||
2005 | enum fp_type { | ||
2006 | Index: b/monitor.c | ||
2007 | =================================================================== | ||
2008 | --- a/monitor.c | ||
2009 | +++ b/monitor.c | ||
2010 | @@ -180,6 +180,8 @@ | ||
2011 | int mm_answer_gss_accept_ctx(int, Buffer *); | ||
2012 | int mm_answer_gss_userok(int, Buffer *); | ||
2013 | int mm_answer_gss_checkmic(int, Buffer *); | ||
2014 | +int mm_answer_gss_sign(int, Buffer *); | ||
2015 | +int mm_answer_gss_updatecreds(int, Buffer *); | ||
2016 | #endif | ||
2017 | |||
2018 | #ifdef SSH_AUDIT_EVENTS | ||
2019 | @@ -251,6 +253,7 @@ | ||
2020 | {MONITOR_REQ_GSSSTEP, MON_ISAUTH, mm_answer_gss_accept_ctx}, | ||
2021 | {MONITOR_REQ_GSSUSEROK, MON_AUTH, mm_answer_gss_userok}, | ||
2022 | {MONITOR_REQ_GSSCHECKMIC, MON_ISAUTH, mm_answer_gss_checkmic}, | ||
2023 | + {MONITOR_REQ_GSSSIGN, MON_ONCE, mm_answer_gss_sign}, | ||
2024 | #endif | ||
2025 | #ifdef JPAKE | ||
2026 | {MONITOR_REQ_JPAKE_GET_PWDATA, MON_ONCE, mm_answer_jpake_get_pwdata}, | ||
2027 | @@ -263,6 +266,12 @@ | ||
2028 | }; | ||
2029 | |||
2030 | struct mon_table mon_dispatch_postauth20[] = { | ||
2031 | +#ifdef GSSAPI | ||
2032 | + {MONITOR_REQ_GSSSETUP, 0, mm_answer_gss_setup_ctx}, | ||
2033 | + {MONITOR_REQ_GSSSTEP, 0, mm_answer_gss_accept_ctx}, | ||
2034 | + {MONITOR_REQ_GSSSIGN, 0, mm_answer_gss_sign}, | ||
2035 | + {MONITOR_REQ_GSSUPCREDS, 0, mm_answer_gss_updatecreds}, | ||
2036 | +#endif | ||
2037 | {MONITOR_REQ_MODULI, 0, mm_answer_moduli}, | ||
2038 | {MONITOR_REQ_SIGN, 0, mm_answer_sign}, | ||
2039 | {MONITOR_REQ_PTY, 0, mm_answer_pty}, | ||
2040 | @@ -371,6 +380,10 @@ | ||
2041 | /* Permit requests for moduli and signatures */ | ||
2042 | monitor_permit(mon_dispatch, MONITOR_REQ_MODULI, 1); | ||
2043 | monitor_permit(mon_dispatch, MONITOR_REQ_SIGN, 1); | ||
2044 | +#ifdef GSSAPI | ||
2045 | + /* and for the GSSAPI key exchange */ | ||
2046 | + monitor_permit(mon_dispatch, MONITOR_REQ_GSSSETUP, 1); | ||
2047 | +#endif | ||
2048 | } else { | ||
2049 | mon_dispatch = mon_dispatch_proto15; | ||
2050 | |||
2051 | @@ -468,6 +481,10 @@ | ||
2052 | monitor_permit(mon_dispatch, MONITOR_REQ_MODULI, 1); | ||
2053 | monitor_permit(mon_dispatch, MONITOR_REQ_SIGN, 1); | ||
2054 | monitor_permit(mon_dispatch, MONITOR_REQ_TERM, 1); | ||
2055 | +#ifdef GSSAPI | ||
2056 | + /* and for the GSSAPI key exchange */ | ||
2057 | + monitor_permit(mon_dispatch, MONITOR_REQ_GSSSETUP, 1); | ||
2058 | +#endif | ||
2059 | } else { | ||
2060 | mon_dispatch = mon_dispatch_postauth15; | ||
2061 | monitor_permit(mon_dispatch, MONITOR_REQ_TERM, 1); | ||
2062 | @@ -1802,6 +1819,13 @@ | ||
2063 | kex->kex[KEX_DH_GEX_SHA1] = kexgex_server; | ||
2064 | kex->kex[KEX_DH_GEX_SHA256] = kexgex_server; | ||
2065 | kex->kex[KEX_ECDH_SHA2] = kexecdh_server; | ||
2066 | +#ifdef GSSAPI | ||
2067 | + if (options.gss_keyex) { | ||
2068 | + kex->kex[KEX_GSS_GRP1_SHA1] = kexgss_server; | ||
2069 | + kex->kex[KEX_GSS_GRP14_SHA1] = kexgss_server; | ||
2070 | + kex->kex[KEX_GSS_GEX_SHA1] = kexgss_server; | ||
2071 | + } | ||
2072 | +#endif | ||
2073 | kex->server = 1; | ||
2074 | kex->hostkey_type = buffer_get_int(m); | ||
2075 | kex->kex_type = buffer_get_int(m); | ||
2076 | @@ -2008,6 +2032,9 @@ | ||
2077 | OM_uint32 major; | ||
2078 | u_int len; | ||
2079 | |||
2080 | + if (!options.gss_authentication && !options.gss_keyex) | ||
2081 | + fatal("In GSSAPI monitor when GSSAPI is disabled"); | ||
2082 | + | ||
2083 | goid.elements = buffer_get_string(m, &len); | ||
2084 | goid.length = len; | ||
2085 | |||
2086 | @@ -2035,6 +2062,9 @@ | ||
2087 | OM_uint32 flags = 0; /* GSI needs this */ | ||
2088 | u_int len; | ||
2089 | |||
2090 | + if (!options.gss_authentication && !options.gss_keyex) | ||
2091 | + fatal("In GSSAPI monitor when GSSAPI is disabled"); | ||
2092 | + | ||
2093 | in.value = buffer_get_string(m, &len); | ||
2094 | in.length = len; | ||
2095 | major = ssh_gssapi_accept_ctx(gsscontext, &in, &out, &flags); | ||
2096 | @@ -2052,6 +2082,7 @@ | ||
2097 | monitor_permit(mon_dispatch, MONITOR_REQ_GSSSTEP, 0); | ||
2098 | monitor_permit(mon_dispatch, MONITOR_REQ_GSSUSEROK, 1); | ||
2099 | monitor_permit(mon_dispatch, MONITOR_REQ_GSSCHECKMIC, 1); | ||
2100 | + monitor_permit(mon_dispatch, MONITOR_REQ_GSSSIGN, 1); | ||
2101 | } | ||
2102 | return (0); | ||
2103 | } | ||
2104 | @@ -2063,6 +2094,9 @@ | ||
2105 | OM_uint32 ret; | ||
2106 | u_int len; | ||
2107 | |||
2108 | + if (!options.gss_authentication && !options.gss_keyex) | ||
2109 | + fatal("In GSSAPI monitor when GSSAPI is disabled"); | ||
2110 | + | ||
2111 | gssbuf.value = buffer_get_string(m, &len); | ||
2112 | gssbuf.length = len; | ||
2113 | mic.value = buffer_get_string(m, &len); | ||
2114 | @@ -2089,7 +2123,11 @@ | ||
2115 | { | ||
2116 | int authenticated; | ||
2117 | |||
2118 | - authenticated = authctxt->valid && ssh_gssapi_userok(authctxt->user); | ||
2119 | + if (!options.gss_authentication && !options.gss_keyex) | ||
2120 | + fatal("In GSSAPI monitor when GSSAPI is disabled"); | ||
2121 | + | ||
2122 | + authenticated = authctxt->valid && | ||
2123 | + ssh_gssapi_userok(authctxt->user, authctxt->pw); | ||
2124 | |||
2125 | buffer_clear(m); | ||
2126 | buffer_put_int(m, authenticated); | ||
2127 | @@ -2102,6 +2140,74 @@ | ||
2128 | /* Monitor loop will terminate if authenticated */ | ||
2129 | return (authenticated); | ||
2130 | } | ||
2131 | + | ||
2132 | +int | ||
2133 | +mm_answer_gss_sign(int socket, Buffer *m) | ||
2134 | +{ | ||
2135 | + gss_buffer_desc data; | ||
2136 | + gss_buffer_desc hash = GSS_C_EMPTY_BUFFER; | ||
2137 | + OM_uint32 major, minor; | ||
2138 | + u_int len; | ||
2139 | + | ||
2140 | + if (!options.gss_authentication && !options.gss_keyex) | ||
2141 | + fatal("In GSSAPI monitor when GSSAPI is disabled"); | ||
2142 | + | ||
2143 | + data.value = buffer_get_string(m, &len); | ||
2144 | + data.length = len; | ||
2145 | + if (data.length != 20) | ||
2146 | + fatal("%s: data length incorrect: %d", __func__, | ||
2147 | + (int) data.length); | ||
2148 | + | ||
2149 | + /* Save the session ID on the first time around */ | ||
2150 | + if (session_id2_len == 0) { | ||
2151 | + session_id2_len = data.length; | ||
2152 | + session_id2 = xmalloc(session_id2_len); | ||
2153 | + memcpy(session_id2, data.value, session_id2_len); | ||
2154 | + } | ||
2155 | + major = ssh_gssapi_sign(gsscontext, &data, &hash); | ||
2156 | + | ||
2157 | + xfree(data.value); | ||
2158 | + | ||
2159 | + buffer_clear(m); | ||
2160 | + buffer_put_int(m, major); | ||
2161 | + buffer_put_string(m, hash.value, hash.length); | ||
2162 | + | ||
2163 | + mm_request_send(socket, MONITOR_ANS_GSSSIGN, m); | ||
2164 | + | ||
2165 | + gss_release_buffer(&minor, &hash); | ||
2166 | + | ||
2167 | + /* Turn on getpwnam permissions */ | ||
2168 | + monitor_permit(mon_dispatch, MONITOR_REQ_PWNAM, 1); | ||
2169 | + | ||
2170 | + /* And credential updating, for when rekeying */ | ||
2171 | + monitor_permit(mon_dispatch, MONITOR_REQ_GSSUPCREDS, 1); | ||
2172 | + | ||
2173 | + return (0); | ||
2174 | +} | ||
2175 | + | ||
2176 | +int | ||
2177 | +mm_answer_gss_updatecreds(int socket, Buffer *m) { | ||
2178 | + ssh_gssapi_ccache store; | ||
2179 | + int ok; | ||
2180 | + | ||
2181 | + store.filename = buffer_get_string(m, NULL); | ||
2182 | + store.envvar = buffer_get_string(m, NULL); | ||
2183 | + store.envval = buffer_get_string(m, NULL); | ||
2184 | + | ||
2185 | + ok = ssh_gssapi_update_creds(&store); | ||
2186 | + | ||
2187 | + xfree(store.filename); | ||
2188 | + xfree(store.envvar); | ||
2189 | + xfree(store.envval); | ||
2190 | + | ||
2191 | + buffer_clear(m); | ||
2192 | + buffer_put_int(m, ok); | ||
2193 | + | ||
2194 | + mm_request_send(socket, MONITOR_ANS_GSSUPCREDS, m); | ||
2195 | + | ||
2196 | + return(0); | ||
2197 | +} | ||
2198 | + | ||
2199 | #endif /* GSSAPI */ | ||
2200 | |||
2201 | #ifdef JPAKE | ||
2202 | Index: b/monitor.h | ||
2203 | =================================================================== | ||
2204 | --- a/monitor.h | ||
2205 | +++ b/monitor.h | ||
2206 | @@ -53,6 +53,8 @@ | ||
2207 | MONITOR_REQ_GSSSTEP, MONITOR_ANS_GSSSTEP, | ||
2208 | MONITOR_REQ_GSSUSEROK, MONITOR_ANS_GSSUSEROK, | ||
2209 | MONITOR_REQ_GSSCHECKMIC, MONITOR_ANS_GSSCHECKMIC, | ||
2210 | + MONITOR_REQ_GSSSIGN, MONITOR_ANS_GSSSIGN, | ||
2211 | + MONITOR_REQ_GSSUPCREDS, MONITOR_ANS_GSSUPCREDS, | ||
2212 | MONITOR_REQ_PAM_START, | ||
2213 | MONITOR_REQ_PAM_ACCOUNT, MONITOR_ANS_PAM_ACCOUNT, | ||
2214 | MONITOR_REQ_PAM_INIT_CTX, MONITOR_ANS_PAM_INIT_CTX, | ||
2215 | Index: b/monitor_wrap.c | ||
2216 | =================================================================== | ||
2217 | --- a/monitor_wrap.c | ||
2218 | +++ b/monitor_wrap.c | ||
2219 | @@ -1270,7 +1270,7 @@ | ||
2220 | } | ||
2221 | |||
2222 | int | ||
2223 | -mm_ssh_gssapi_userok(char *user) | ||
2224 | +mm_ssh_gssapi_userok(char *user, struct passwd *pw) | ||
2225 | { | ||
2226 | Buffer m; | ||
2227 | int authenticated = 0; | ||
2228 | @@ -1287,6 +1287,51 @@ | ||
2229 | debug3("%s: user %sauthenticated",__func__, authenticated ? "" : "not "); | ||
2230 | return (authenticated); | ||
2231 | } | ||
2232 | + | ||
2233 | +OM_uint32 | ||
2234 | +mm_ssh_gssapi_sign(Gssctxt *ctx, gss_buffer_desc *data, gss_buffer_desc *hash) | ||
2235 | +{ | ||
2236 | + Buffer m; | ||
2237 | + OM_uint32 major; | ||
2238 | + u_int len; | ||
2239 | + | ||
2240 | + buffer_init(&m); | ||
2241 | + buffer_put_string(&m, data->value, data->length); | ||
2242 | + | ||
2243 | + mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSSIGN, &m); | ||
2244 | + mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_GSSSIGN, &m); | ||
2245 | + | ||
2246 | + major = buffer_get_int(&m); | ||
2247 | + hash->value = buffer_get_string(&m, &len); | ||
2248 | + hash->length = len; | ||
2249 | + | ||
2250 | + buffer_free(&m); | ||
2251 | + | ||
2252 | + return(major); | ||
2253 | +} | ||
2254 | + | ||
2255 | +int | ||
2256 | +mm_ssh_gssapi_update_creds(ssh_gssapi_ccache *store) | ||
2257 | +{ | ||
2258 | + Buffer m; | ||
2259 | + int ok; | ||
2260 | + | ||
2261 | + buffer_init(&m); | ||
2262 | + | ||
2263 | + buffer_put_cstring(&m, store->filename ? store->filename : ""); | ||
2264 | + buffer_put_cstring(&m, store->envvar ? store->envvar : ""); | ||
2265 | + buffer_put_cstring(&m, store->envval ? store->envval : ""); | ||
2266 | + | ||
2267 | + mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSUPCREDS, &m); | ||
2268 | + mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_GSSUPCREDS, &m); | ||
2269 | + | ||
2270 | + ok = buffer_get_int(&m); | ||
2271 | + | ||
2272 | + buffer_free(&m); | ||
2273 | + | ||
2274 | + return (ok); | ||
2275 | +} | ||
2276 | + | ||
2277 | #endif /* GSSAPI */ | ||
2278 | |||
2279 | #ifdef JPAKE | ||
2280 | Index: b/monitor_wrap.h | ||
2281 | =================================================================== | ||
2282 | --- a/monitor_wrap.h | ||
2283 | +++ b/monitor_wrap.h | ||
2284 | @@ -58,8 +58,10 @@ | ||
2285 | OM_uint32 mm_ssh_gssapi_server_ctx(Gssctxt **, gss_OID); | ||
2286 | OM_uint32 mm_ssh_gssapi_accept_ctx(Gssctxt *, | ||
2287 | gss_buffer_desc *, gss_buffer_desc *, OM_uint32 *); | ||
2288 | -int mm_ssh_gssapi_userok(char *user); | ||
2289 | +int mm_ssh_gssapi_userok(char *user, struct passwd *); | ||
2290 | OM_uint32 mm_ssh_gssapi_checkmic(Gssctxt *, gss_buffer_t, gss_buffer_t); | ||
2291 | +OM_uint32 mm_ssh_gssapi_sign(Gssctxt *, gss_buffer_t, gss_buffer_t); | ||
2292 | +int mm_ssh_gssapi_update_creds(ssh_gssapi_ccache *); | ||
2293 | #endif | ||
2294 | |||
2295 | #ifdef USE_PAM | ||
2296 | Index: b/readconf.c | ||
2297 | =================================================================== | ||
2298 | --- a/readconf.c | ||
2299 | +++ b/readconf.c | ||
2300 | @@ -129,6 +129,8 @@ | ||
2301 | oClearAllForwardings, oNoHostAuthenticationForLocalhost, | ||
2302 | oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout, | ||
2303 | oAddressFamily, oGssAuthentication, oGssDelegateCreds, | ||
2304 | + oGssTrustDns, oGssKeyEx, oGssClientIdentity, oGssRenewalRekey, | ||
2305 | + oGssServerIdentity, | ||
2306 | oServerAliveInterval, oServerAliveCountMax, oIdentitiesOnly, | ||
2307 | oSendEnv, oControlPath, oControlMaster, oControlPersist, | ||
2308 | oHashKnownHosts, | ||
2309 | @@ -169,10 +171,19 @@ | ||
2310 | { "afstokenpassing", oUnsupported }, | ||
2311 | #if defined(GSSAPI) | ||
2312 | { "gssapiauthentication", oGssAuthentication }, | ||
2313 | + { "gssapikeyexchange", oGssKeyEx }, | ||
2314 | { "gssapidelegatecredentials", oGssDelegateCreds }, | ||
2315 | + { "gssapitrustdns", oGssTrustDns }, | ||
2316 | + { "gssapiclientidentity", oGssClientIdentity }, | ||
2317 | + { "gssapiserveridentity", oGssServerIdentity }, | ||
2318 | + { "gssapirenewalforcesrekey", oGssRenewalRekey }, | ||
2319 | #else | ||
2320 | { "gssapiauthentication", oUnsupported }, | ||
2321 | + { "gssapikeyexchange", oUnsupported }, | ||
2322 | { "gssapidelegatecredentials", oUnsupported }, | ||
2323 | + { "gssapitrustdns", oUnsupported }, | ||
2324 | + { "gssapiclientidentity", oUnsupported }, | ||
2325 | + { "gssapirenewalforcesrekey", oUnsupported }, | ||
2326 | #endif | ||
2327 | { "fallbacktorsh", oDeprecated }, | ||
2328 | { "usersh", oDeprecated }, | ||
2329 | @@ -482,10 +493,30 @@ | ||
2330 | intptr = &options->gss_authentication; | ||
2331 | goto parse_flag; | ||
2332 | |||
2333 | + case oGssKeyEx: | ||
2334 | + intptr = &options->gss_keyex; | ||
2335 | + goto parse_flag; | ||
2336 | + | ||
2337 | case oGssDelegateCreds: | ||
2338 | intptr = &options->gss_deleg_creds; | ||
2339 | goto parse_flag; | ||
2340 | |||
2341 | + case oGssTrustDns: | ||
2342 | + intptr = &options->gss_trust_dns; | ||
2343 | + goto parse_flag; | ||
2344 | + | ||
2345 | + case oGssClientIdentity: | ||
2346 | + charptr = &options->gss_client_identity; | ||
2347 | + goto parse_string; | ||
2348 | + | ||
2349 | + case oGssServerIdentity: | ||
2350 | + charptr = &options->gss_server_identity; | ||
2351 | + goto parse_string; | ||
2352 | + | ||
2353 | + case oGssRenewalRekey: | ||
2354 | + intptr = &options->gss_renewal_rekey; | ||
2355 | + goto parse_flag; | ||
2356 | + | ||
2357 | case oBatchMode: | ||
2358 | intptr = &options->batch_mode; | ||
2359 | goto parse_flag; | ||
2360 | @@ -1138,7 +1169,12 @@ | ||
2361 | options->pubkey_authentication = -1; | ||
2362 | options->challenge_response_authentication = -1; | ||
2363 | options->gss_authentication = -1; | ||
2364 | + options->gss_keyex = -1; | ||
2365 | options->gss_deleg_creds = -1; | ||
2366 | + options->gss_trust_dns = -1; | ||
2367 | + options->gss_renewal_rekey = -1; | ||
2368 | + options->gss_client_identity = NULL; | ||
2369 | + options->gss_server_identity = NULL; | ||
2370 | options->password_authentication = -1; | ||
2371 | options->kbd_interactive_authentication = -1; | ||
2372 | options->kbd_interactive_devices = NULL; | ||
2373 | @@ -1238,8 +1274,14 @@ | ||
2374 | options->challenge_response_authentication = 1; | ||
2375 | if (options->gss_authentication == -1) | ||
2376 | options->gss_authentication = 0; | ||
2377 | + if (options->gss_keyex == -1) | ||
2378 | + options->gss_keyex = 0; | ||
2379 | if (options->gss_deleg_creds == -1) | ||
2380 | options->gss_deleg_creds = 0; | ||
2381 | + if (options->gss_trust_dns == -1) | ||
2382 | + options->gss_trust_dns = 0; | ||
2383 | + if (options->gss_renewal_rekey == -1) | ||
2384 | + options->gss_renewal_rekey = 0; | ||
2385 | if (options->password_authentication == -1) | ||
2386 | options->password_authentication = 1; | ||
2387 | if (options->kbd_interactive_authentication == -1) | ||
2388 | Index: b/readconf.h | ||
2389 | =================================================================== | ||
2390 | --- a/readconf.h | ||
2391 | +++ b/readconf.h | ||
2392 | @@ -47,7 +47,12 @@ | ||
2393 | int challenge_response_authentication; | ||
2394 | /* Try S/Key or TIS, authentication. */ | ||
2395 | int gss_authentication; /* Try GSS authentication */ | ||
2396 | + int gss_keyex; /* Try GSS key exchange */ | ||
2397 | int gss_deleg_creds; /* Delegate GSS credentials */ | ||
2398 | + int gss_trust_dns; /* Trust DNS for GSS canonicalization */ | ||
2399 | + int gss_renewal_rekey; /* Credential renewal forces rekey */ | ||
2400 | + char *gss_client_identity; /* Principal to initiate GSSAPI with */ | ||
2401 | + char *gss_server_identity; /* GSSAPI target principal */ | ||
2402 | int password_authentication; /* Try password | ||
2403 | * authentication. */ | ||
2404 | int kbd_interactive_authentication; /* Try keyboard-interactive auth. */ | ||
2405 | Index: b/servconf.c | ||
2406 | =================================================================== | ||
2407 | --- a/servconf.c | ||
2408 | +++ b/servconf.c | ||
2409 | @@ -97,7 +97,10 @@ | ||
2410 | options->kerberos_ticket_cleanup = -1; | ||
2411 | options->kerberos_get_afs_token = -1; | ||
2412 | options->gss_authentication=-1; | ||
2413 | + options->gss_keyex = -1; | ||
2414 | options->gss_cleanup_creds = -1; | ||
2415 | + options->gss_strict_acceptor = -1; | ||
2416 | + options->gss_store_rekey = -1; | ||
2417 | options->password_authentication = -1; | ||
2418 | options->kbd_interactive_authentication = -1; | ||
2419 | options->challenge_response_authentication = -1; | ||
2420 | @@ -225,8 +228,14 @@ | ||
2421 | options->kerberos_get_afs_token = 0; | ||
2422 | if (options->gss_authentication == -1) | ||
2423 | options->gss_authentication = 0; | ||
2424 | + if (options->gss_keyex == -1) | ||
2425 | + options->gss_keyex = 0; | ||
2426 | if (options->gss_cleanup_creds == -1) | ||
2427 | options->gss_cleanup_creds = 1; | ||
2428 | + if (options->gss_strict_acceptor == -1) | ||
2429 | + options->gss_strict_acceptor = 1; | ||
2430 | + if (options->gss_store_rekey == -1) | ||
2431 | + options->gss_store_rekey = 0; | ||
2432 | if (options->password_authentication == -1) | ||
2433 | options->password_authentication = 1; | ||
2434 | if (options->kbd_interactive_authentication == -1) | ||
2435 | @@ -318,7 +327,9 @@ | ||
2436 | sBanner, sUseDNS, sHostbasedAuthentication, | ||
2437 | sHostbasedUsesNameFromPacketOnly, sClientAliveInterval, | ||
2438 | sClientAliveCountMax, sAuthorizedKeysFile, | ||
2439 | - sGssAuthentication, sGssCleanupCreds, sAcceptEnv, sPermitTunnel, | ||
2440 | + sGssAuthentication, sGssCleanupCreds, sGssStrictAcceptor, | ||
2441 | + sGssKeyEx, sGssStoreRekey, | ||
2442 | + sAcceptEnv, sPermitTunnel, | ||
2443 | sMatch, sPermitOpen, sForceCommand, sChrootDirectory, | ||
2444 | sUsePrivilegeSeparation, sAllowAgentForwarding, | ||
2445 | sZeroKnowledgePasswordAuthentication, sHostCertificate, | ||
2446 | @@ -382,10 +393,20 @@ | ||
2447 | #ifdef GSSAPI | ||
2448 | { "gssapiauthentication", sGssAuthentication, SSHCFG_ALL }, | ||
2449 | { "gssapicleanupcredentials", sGssCleanupCreds, SSHCFG_GLOBAL }, | ||
2450 | + { "gssapicleanupcreds", sGssCleanupCreds, SSHCFG_GLOBAL }, | ||
2451 | + { "gssapistrictacceptorcheck", sGssStrictAcceptor, SSHCFG_GLOBAL }, | ||
2452 | + { "gssapikeyexchange", sGssKeyEx, SSHCFG_GLOBAL }, | ||
2453 | + { "gssapistorecredentialsonrekey", sGssStoreRekey, SSHCFG_GLOBAL }, | ||
2454 | #else | ||
2455 | { "gssapiauthentication", sUnsupported, SSHCFG_ALL }, | ||
2456 | { "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL }, | ||
2457 | + { "gssapicleanupcreds", sUnsupported, SSHCFG_GLOBAL }, | ||
2458 | + { "gssapistrictacceptorcheck", sUnsupported, SSHCFG_GLOBAL }, | ||
2459 | + { "gssapikeyexchange", sUnsupported, SSHCFG_GLOBAL }, | ||
2460 | + { "gssapistorecredentialsonrekey", sUnsupported, SSHCFG_GLOBAL }, | ||
2461 | #endif | ||
2462 | + { "gssusesessionccache", sUnsupported, SSHCFG_GLOBAL }, | ||
2463 | + { "gssapiusesessioncredcache", sUnsupported, SSHCFG_GLOBAL }, | ||
2464 | { "passwordauthentication", sPasswordAuthentication, SSHCFG_ALL }, | ||
2465 | { "kbdinteractiveauthentication", sKbdInteractiveAuthentication, SSHCFG_ALL }, | ||
2466 | { "challengeresponseauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL }, | ||
2467 | @@ -962,10 +983,22 @@ | ||
2468 | intptr = &options->gss_authentication; | ||
2469 | goto parse_flag; | ||
2470 | |||
2471 | + case sGssKeyEx: | ||
2472 | + intptr = &options->gss_keyex; | ||
2473 | + goto parse_flag; | ||
2474 | + | ||
2475 | case sGssCleanupCreds: | ||
2476 | intptr = &options->gss_cleanup_creds; | ||
2477 | goto parse_flag; | ||
2478 | |||
2479 | + case sGssStrictAcceptor: | ||
2480 | + intptr = &options->gss_strict_acceptor; | ||
2481 | + goto parse_flag; | ||
2482 | + | ||
2483 | + case sGssStoreRekey: | ||
2484 | + intptr = &options->gss_store_rekey; | ||
2485 | + goto parse_flag; | ||
2486 | + | ||
2487 | case sPasswordAuthentication: | ||
2488 | intptr = &options->password_authentication; | ||
2489 | goto parse_flag; | ||
2490 | @@ -1720,7 +1753,10 @@ | ||
2491 | #endif | ||
2492 | #ifdef GSSAPI | ||
2493 | dump_cfg_fmtint(sGssAuthentication, o->gss_authentication); | ||
2494 | + dump_cfg_fmtint(sGssKeyEx, o->gss_keyex); | ||
2495 | dump_cfg_fmtint(sGssCleanupCreds, o->gss_cleanup_creds); | ||
2496 | + dump_cfg_fmtint(sGssStrictAcceptor, o->gss_strict_acceptor); | ||
2497 | + dump_cfg_fmtint(sGssStoreRekey, o->gss_store_rekey); | ||
2498 | #endif | ||
2499 | #ifdef JPAKE | ||
2500 | dump_cfg_fmtint(sZeroKnowledgePasswordAuthentication, | ||
2501 | Index: b/servconf.h | ||
2502 | =================================================================== | ||
2503 | --- a/servconf.h | ||
2504 | +++ b/servconf.h | ||
2505 | @@ -103,7 +103,10 @@ | ||
2506 | int kerberos_get_afs_token; /* If true, try to get AFS token if | ||
2507 | * authenticated with Kerberos. */ | ||
2508 | int gss_authentication; /* If true, permit GSSAPI authentication */ | ||
2509 | + int gss_keyex; /* If true, permit GSSAPI key exchange */ | ||
2510 | int gss_cleanup_creds; /* If true, destroy cred cache on logout */ | ||
2511 | + int gss_strict_acceptor; /* If true, restrict the GSSAPI acceptor name */ | ||
2512 | + int gss_store_rekey; | ||
2513 | int password_authentication; /* If true, permit password | ||
2514 | * authentication. */ | ||
2515 | int kbd_interactive_authentication; /* If true, permit */ | ||
2516 | Index: b/ssh-gss.h | ||
2517 | =================================================================== | ||
2518 | --- a/ssh-gss.h | ||
2519 | +++ b/ssh-gss.h | ||
2520 | @@ -1,6 +1,6 @@ | ||
2521 | /* $OpenBSD: ssh-gss.h,v 1.10 2007/06/12 08:20:00 djm Exp $ */ | ||
2522 | /* | ||
2523 | - * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved. | ||
2524 | + * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved. | ||
2525 | * | ||
2526 | * Redistribution and use in source and binary forms, with or without | ||
2527 | * modification, are permitted provided that the following conditions | ||
2528 | @@ -60,10 +60,22 @@ | ||
2529 | |||
2530 | #define SSH_GSS_OIDTYPE 0x06 | ||
2531 | |||
2532 | +#define SSH2_MSG_KEXGSS_INIT 30 | ||
2533 | +#define SSH2_MSG_KEXGSS_CONTINUE 31 | ||
2534 | +#define SSH2_MSG_KEXGSS_COMPLETE 32 | ||
2535 | +#define SSH2_MSG_KEXGSS_HOSTKEY 33 | ||
2536 | +#define SSH2_MSG_KEXGSS_ERROR 34 | ||
2537 | +#define SSH2_MSG_KEXGSS_GROUPREQ 40 | ||
2538 | +#define SSH2_MSG_KEXGSS_GROUP 41 | ||
2539 | +#define KEX_GSS_GRP1_SHA1_ID "gss-group1-sha1-" | ||
2540 | +#define KEX_GSS_GRP14_SHA1_ID "gss-group14-sha1-" | ||
2541 | +#define KEX_GSS_GEX_SHA1_ID "gss-gex-sha1-" | ||
2542 | + | ||
2543 | typedef struct { | ||
2544 | char *filename; | ||
2545 | char *envvar; | ||
2546 | char *envval; | ||
2547 | + struct passwd *owner; | ||
2548 | void *data; | ||
2549 | } ssh_gssapi_ccache; | ||
2550 | |||
2551 | @@ -71,8 +83,11 @@ | ||
2552 | gss_buffer_desc displayname; | ||
2553 | gss_buffer_desc exportedname; | ||
2554 | gss_cred_id_t creds; | ||
2555 | + gss_name_t name; | ||
2556 | struct ssh_gssapi_mech_struct *mech; | ||
2557 | ssh_gssapi_ccache store; | ||
2558 | + int used; | ||
2559 | + int updated; | ||
2560 | } ssh_gssapi_client; | ||
2561 | |||
2562 | typedef struct ssh_gssapi_mech_struct { | ||
2563 | @@ -83,6 +98,7 @@ | ||
2564 | int (*userok) (ssh_gssapi_client *, char *); | ||
2565 | int (*localname) (ssh_gssapi_client *, char **); | ||
2566 | void (*storecreds) (ssh_gssapi_client *); | ||
2567 | + int (*updatecreds) (ssh_gssapi_ccache *, ssh_gssapi_client *); | ||
2568 | } ssh_gssapi_mech; | ||
2569 | |||
2570 | typedef struct { | ||
2571 | @@ -93,10 +109,11 @@ | ||
2572 | gss_OID oid; /* client */ | ||
2573 | gss_cred_id_t creds; /* server */ | ||
2574 | gss_name_t client; /* server */ | ||
2575 | - gss_cred_id_t client_creds; /* server */ | ||
2576 | + gss_cred_id_t client_creds; /* both */ | ||
2577 | } Gssctxt; | ||
2578 | |||
2579 | extern ssh_gssapi_mech *supported_mechs[]; | ||
2580 | +extern Gssctxt *gss_kex_context; | ||
2581 | |||
2582 | int ssh_gssapi_check_oid(Gssctxt *, void *, size_t); | ||
2583 | void ssh_gssapi_set_oid_data(Gssctxt *, void *, size_t); | ||
2584 | @@ -116,16 +133,30 @@ | ||
2585 | void ssh_gssapi_delete_ctx(Gssctxt **); | ||
2586 | OM_uint32 ssh_gssapi_sign(Gssctxt *, gss_buffer_t, gss_buffer_t); | ||
2587 | void ssh_gssapi_buildmic(Buffer *, const char *, const char *, const char *); | ||
2588 | -int ssh_gssapi_check_mechanism(Gssctxt **, gss_OID, const char *); | ||
2589 | +int ssh_gssapi_check_mechanism(Gssctxt **, gss_OID, const char *, const char *); | ||
2590 | +OM_uint32 ssh_gssapi_client_identity(Gssctxt *, const char *); | ||
2591 | +int ssh_gssapi_credentials_updated(Gssctxt *); | ||
2592 | |||
2593 | /* In the server */ | ||
2594 | +typedef int ssh_gssapi_check_fn(Gssctxt **, gss_OID, const char *, | ||
2595 | + const char *); | ||
2596 | +char *ssh_gssapi_client_mechanisms(const char *, const char *); | ||
2597 | +char *ssh_gssapi_kex_mechs(gss_OID_set, ssh_gssapi_check_fn *, const char *, | ||
2598 | + const char *); | ||
2599 | +gss_OID ssh_gssapi_id_kex(Gssctxt *, char *, int); | ||
2600 | +int ssh_gssapi_server_check_mech(Gssctxt **,gss_OID, const char *, | ||
2601 | + const char *); | ||
2602 | OM_uint32 ssh_gssapi_server_ctx(Gssctxt **, gss_OID); | ||
2603 | -int ssh_gssapi_userok(char *name); | ||
2604 | +int ssh_gssapi_userok(char *name, struct passwd *); | ||
2605 | OM_uint32 ssh_gssapi_checkmic(Gssctxt *, gss_buffer_t, gss_buffer_t); | ||
2606 | void ssh_gssapi_do_child(char ***, u_int *); | ||
2607 | void ssh_gssapi_cleanup_creds(void); | ||
2608 | void ssh_gssapi_storecreds(void); | ||
2609 | |||
2610 | +char *ssh_gssapi_server_mechanisms(void); | ||
2611 | +int ssh_gssapi_oid_table_ok(); | ||
2612 | + | ||
2613 | +int ssh_gssapi_update_creds(ssh_gssapi_ccache *store); | ||
2614 | #endif /* GSSAPI */ | ||
2615 | |||
2616 | #endif /* _SSH_GSS_H */ | ||
2617 | Index: b/ssh_config | ||
2618 | =================================================================== | ||
2619 | --- a/ssh_config | ||
2620 | +++ b/ssh_config | ||
2621 | @@ -26,6 +26,8 @@ | ||
2622 | # HostbasedAuthentication no | ||
2623 | # GSSAPIAuthentication no | ||
2624 | # GSSAPIDelegateCredentials no | ||
2625 | +# GSSAPIKeyExchange no | ||
2626 | +# GSSAPITrustDNS no | ||
2627 | # BatchMode no | ||
2628 | # CheckHostIP yes | ||
2629 | # AddressFamily any | ||
2630 | Index: b/ssh_config.5 | ||
2631 | =================================================================== | ||
2632 | --- a/ssh_config.5 | ||
2633 | +++ b/ssh_config.5 | ||
2634 | @@ -527,11 +527,43 @@ | ||
2635 | The default is | ||
2636 | .Dq no . | ||
2637 | Note that this option applies to protocol version 2 only. | ||
2638 | +.It Cm GSSAPIKeyExchange | ||
2639 | +Specifies whether key exchange based on GSSAPI may be used. When using | ||
2640 | +GSSAPI key exchange the server need not have a host key. | ||
2641 | +The default is | ||
2642 | +.Dq no . | ||
2643 | +Note that this option applies to protocol version 2 only. | ||
2644 | +.It Cm GSSAPIClientIdentity | ||
2645 | +If set, specifies the GSSAPI client identity that ssh should use when | ||
2646 | +connecting to the server. The default is unset, which means that the default | ||
2647 | +identity will be used. | ||
2648 | +.It Cm GSSAPIServerIdentity | ||
2649 | +If set, specifies the GSSAPI server identity that ssh should expect when | ||
2650 | +connecting to the server. The default is unset, which means that the | ||
2651 | +expected GSSAPI server identity will be determined from the target | ||
2652 | +hostname. | ||
2653 | .It Cm GSSAPIDelegateCredentials | ||
2654 | Forward (delegate) credentials to the server. | ||
2655 | The default is | ||
2656 | .Dq no . | ||
2657 | -Note that this option applies to protocol version 2 only. | ||
2658 | +Note that this option applies to protocol version 2 connections using GSSAPI. | ||
2659 | +.It Cm GSSAPIRenewalForcesRekey | ||
2660 | +If set to | ||
2661 | +.Dq yes | ||
2662 | +then renewal of the client's GSSAPI credentials will force the rekeying of the | ||
2663 | +ssh connection. With a compatible server, this can delegate the renewed | ||
2664 | +credentials to a session on the server. | ||
2665 | +The default is | ||
2666 | +.Dq no . | ||
2667 | +.It Cm GSSAPITrustDns | ||
2668 | +Set to | ||
2669 | +.Dq yes to indicate that the DNS is trusted to securely canonicalize | ||
2670 | +the name of the host being connected to. If | ||
2671 | +.Dq no, the hostname entered on the | ||
2672 | +command line will be passed untouched to the GSSAPI library. | ||
2673 | +The default is | ||
2674 | +.Dq no . | ||
2675 | +This option only applies to protocol version 2 connections using GSSAPI. | ||
2676 | .It Cm HashKnownHosts | ||
2677 | Indicates that | ||
2678 | .Xr ssh 1 | ||
2679 | Index: b/sshconnect2.c | ||
2680 | =================================================================== | ||
2681 | --- a/sshconnect2.c | ||
2682 | +++ b/sshconnect2.c | ||
2683 | @@ -160,9 +160,34 @@ | ||
2684 | { | ||
2685 | Kex *kex; | ||
2686 | |||
2687 | +#ifdef GSSAPI | ||
2688 | + char *orig = NULL, *gss = NULL; | ||
2689 | + char *gss_host = NULL; | ||
2690 | +#endif | ||
2691 | + | ||
2692 | xxx_host = host; | ||
2693 | xxx_hostaddr = hostaddr; | ||
2694 | |||
2695 | +#ifdef GSSAPI | ||
2696 | + if (options.gss_keyex) { | ||
2697 | + /* Add the GSSAPI mechanisms currently supported on this | ||
2698 | + * client to the key exchange algorithm proposal */ | ||
2699 | + orig = myproposal[PROPOSAL_KEX_ALGS]; | ||
2700 | + | ||
2701 | + if (options.gss_trust_dns) | ||
2702 | + gss_host = (char *)get_canonical_hostname(1); | ||
2703 | + else | ||
2704 | + gss_host = host; | ||
2705 | + | ||
2706 | + gss = ssh_gssapi_client_mechanisms(gss_host, options.gss_client_identity); | ||
2707 | + if (gss) { | ||
2708 | + debug("Offering GSSAPI proposal: %s", gss); | ||
2709 | + xasprintf(&myproposal[PROPOSAL_KEX_ALGS], | ||
2710 | + "%s,%s", gss, orig); | ||
2711 | + } | ||
2712 | + } | ||
2713 | +#endif | ||
2714 | + | ||
2715 | if (options.ciphers == (char *)-1) { | ||
2716 | logit("No valid ciphers for protocol version 2 given, using defaults."); | ||
2717 | options.ciphers = NULL; | ||
2718 | @@ -197,6 +222,17 @@ | ||
2719 | if (options.kex_algorithms != NULL) | ||
2720 | myproposal[PROPOSAL_KEX_ALGS] = options.kex_algorithms; | ||
2721 | |||
2722 | +#ifdef GSSAPI | ||
2723 | + /* If we've got GSSAPI algorithms, then we also support the | ||
2724 | + * 'null' hostkey, as a last resort */ | ||
2725 | + if (options.gss_keyex && gss) { | ||
2726 | + orig = myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS]; | ||
2727 | + xasprintf(&myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS], | ||
2728 | + "%s,null", orig); | ||
2729 | + xfree(gss); | ||
2730 | + } | ||
2731 | +#endif | ||
2732 | + | ||
2733 | if (options.rekey_limit) | ||
2734 | packet_set_rekey_limit((u_int32_t)options.rekey_limit); | ||
2735 | |||
2736 | @@ -207,10 +243,30 @@ | ||
2737 | kex->kex[KEX_DH_GEX_SHA1] = kexgex_client; | ||
2738 | kex->kex[KEX_DH_GEX_SHA256] = kexgex_client; | ||
2739 | kex->kex[KEX_ECDH_SHA2] = kexecdh_client; | ||
2740 | +#ifdef GSSAPI | ||
2741 | + if (options.gss_keyex) { | ||
2742 | + kex->kex[KEX_GSS_GRP1_SHA1] = kexgss_client; | ||
2743 | + kex->kex[KEX_GSS_GRP14_SHA1] = kexgss_client; | ||
2744 | + kex->kex[KEX_GSS_GEX_SHA1] = kexgss_client; | ||
2745 | + } | ||
2746 | +#endif | ||
2747 | kex->client_version_string=client_version_string; | ||
2748 | kex->server_version_string=server_version_string; | ||
2749 | kex->verify_host_key=&verify_host_key_callback; | ||
2750 | |||
2751 | +#ifdef GSSAPI | ||
2752 | + if (options.gss_keyex) { | ||
2753 | + kex->gss_deleg_creds = options.gss_deleg_creds; | ||
2754 | + kex->gss_trust_dns = options.gss_trust_dns; | ||
2755 | + kex->gss_client = options.gss_client_identity; | ||
2756 | + if (options.gss_server_identity) { | ||
2757 | + kex->gss_host = options.gss_server_identity; | ||
2758 | + } else { | ||
2759 | + kex->gss_host = gss_host; | ||
2760 | + } | ||
2761 | + } | ||
2762 | +#endif | ||
2763 | + | ||
2764 | xxx_kex = kex; | ||
2765 | |||
2766 | dispatch_run(DISPATCH_BLOCK, &kex->done, kex); | ||
2767 | @@ -305,6 +361,7 @@ | ||
2768 | void input_gssapi_hash(int type, u_int32_t, void *); | ||
2769 | void input_gssapi_error(int, u_int32_t, void *); | ||
2770 | void input_gssapi_errtok(int, u_int32_t, void *); | ||
2771 | +int userauth_gsskeyex(Authctxt *authctxt); | ||
2772 | #endif | ||
2773 | |||
2774 | void userauth(Authctxt *, char *); | ||
2775 | @@ -320,6 +377,11 @@ | ||
2776 | |||
2777 | Authmethod authmethods[] = { | ||
2778 | #ifdef GSSAPI | ||
2779 | + {"gssapi-keyex", | ||
2780 | + userauth_gsskeyex, | ||
2781 | + NULL, | ||
2782 | + &options.gss_authentication, | ||
2783 | + NULL}, | ||
2784 | {"gssapi-with-mic", | ||
2785 | userauth_gssapi, | ||
2786 | NULL, | ||
2787 | @@ -626,19 +688,31 @@ | ||
2788 | static u_int mech = 0; | ||
2789 | OM_uint32 min; | ||
2790 | int ok = 0; | ||
2791 | + const char *gss_host; | ||
2792 | + | ||
2793 | + if (options.gss_server_identity) | ||
2794 | + gss_host = options.gss_server_identity; | ||
2795 | + else if (options.gss_trust_dns) | ||
2796 | + gss_host = get_canonical_hostname(1); | ||
2797 | + else | ||
2798 | + gss_host = authctxt->host; | ||
2799 | |||
2800 | /* Try one GSSAPI method at a time, rather than sending them all at | ||
2801 | * once. */ | ||
2802 | |||
2803 | if (gss_supported == NULL) | ||
2804 | - gss_indicate_mechs(&min, &gss_supported); | ||
2805 | + if (GSS_ERROR(gss_indicate_mechs(&min, &gss_supported))) { | ||
2806 | + gss_supported = NULL; | ||
2807 | + return 0; | ||
2808 | + } | ||
2809 | |||
2810 | /* Check to see if the mechanism is usable before we offer it */ | ||
2811 | while (mech < gss_supported->count && !ok) { | ||
2812 | /* My DER encoding requires length<128 */ | ||
2813 | if (gss_supported->elements[mech].length < 128 && | ||
2814 | ssh_gssapi_check_mechanism(&gssctxt, | ||
2815 | - &gss_supported->elements[mech], authctxt->host)) { | ||
2816 | + &gss_supported->elements[mech], gss_host, | ||
2817 | + options.gss_client_identity)) { | ||
2818 | ok = 1; /* Mechanism works */ | ||
2819 | } else { | ||
2820 | mech++; | ||
2821 | @@ -735,8 +809,8 @@ | ||
2822 | { | ||
2823 | Authctxt *authctxt = ctxt; | ||
2824 | Gssctxt *gssctxt; | ||
2825 | - int oidlen; | ||
2826 | - char *oidv; | ||
2827 | + u_int oidlen; | ||
2828 | + u_char *oidv; | ||
2829 | |||
2830 | if (authctxt == NULL) | ||
2831 | fatal("input_gssapi_response: no authentication context"); | ||
2832 | @@ -846,6 +920,48 @@ | ||
2833 | xfree(msg); | ||
2834 | xfree(lang); | ||
2835 | } | ||
2836 | + | ||
2837 | +int | ||
2838 | +userauth_gsskeyex(Authctxt *authctxt) | ||
2839 | +{ | ||
2840 | + Buffer b; | ||
2841 | + gss_buffer_desc gssbuf; | ||
2842 | + gss_buffer_desc mic = GSS_C_EMPTY_BUFFER; | ||
2843 | + OM_uint32 ms; | ||
2844 | + | ||
2845 | + static int attempt = 0; | ||
2846 | + if (attempt++ >= 1) | ||
2847 | + return (0); | ||
2848 | + | ||
2849 | + if (gss_kex_context == NULL) { | ||
2850 | + debug("No valid Key exchange context"); | ||
2851 | + return (0); | ||
2852 | + } | ||
2853 | + | ||
2854 | + ssh_gssapi_buildmic(&b, authctxt->server_user, authctxt->service, | ||
2855 | + "gssapi-keyex"); | ||
2856 | + | ||
2857 | + gssbuf.value = buffer_ptr(&b); | ||
2858 | + gssbuf.length = buffer_len(&b); | ||
2859 | + | ||
2860 | + if (GSS_ERROR(ssh_gssapi_sign(gss_kex_context, &gssbuf, &mic))) { | ||
2861 | + buffer_free(&b); | ||
2862 | + return (0); | ||
2863 | + } | ||
2864 | + | ||
2865 | + packet_start(SSH2_MSG_USERAUTH_REQUEST); | ||
2866 | + packet_put_cstring(authctxt->server_user); | ||
2867 | + packet_put_cstring(authctxt->service); | ||
2868 | + packet_put_cstring(authctxt->method->name); | ||
2869 | + packet_put_string(mic.value, mic.length); | ||
2870 | + packet_send(); | ||
2871 | + | ||
2872 | + buffer_free(&b); | ||
2873 | + gss_release_buffer(&ms, &mic); | ||
2874 | + | ||
2875 | + return (1); | ||
2876 | +} | ||
2877 | + | ||
2878 | #endif /* GSSAPI */ | ||
2879 | |||
2880 | int | ||
2881 | Index: b/sshd.c | ||
2882 | =================================================================== | ||
2883 | --- a/sshd.c | ||
2884 | +++ b/sshd.c | ||
2885 | @@ -121,6 +121,10 @@ | ||
2886 | #include "ssh-sandbox.h" | ||
2887 | #include "version.h" | ||
2888 | |||
2889 | +#ifdef USE_SECURITY_SESSION_API | ||
2890 | +#include <Security/AuthSession.h> | ||
2891 | +#endif | ||
2892 | + | ||
2893 | #ifdef LIBWRAP | ||
2894 | #include <tcpd.h> | ||
2895 | #include <syslog.h> | ||
2896 | @@ -1612,10 +1616,13 @@ | ||
2897 | logit("Disabling protocol version 1. Could not load host key"); | ||
2898 | options.protocol &= ~SSH_PROTO_1; | ||
2899 | } | ||
2900 | +#ifndef GSSAPI | ||
2901 | + /* The GSSAPI key exchange can run without a host key */ | ||
2902 | if ((options.protocol & SSH_PROTO_2) && !sensitive_data.have_ssh2_key) { | ||
2903 | logit("Disabling protocol version 2. Could not load host key"); | ||
2904 | options.protocol &= ~SSH_PROTO_2; | ||
2905 | } | ||
2906 | +#endif | ||
2907 | if (!(options.protocol & (SSH_PROTO_1|SSH_PROTO_2))) { | ||
2908 | logit("sshd: no hostkeys available -- exiting."); | ||
2909 | exit(1); | ||
2910 | @@ -1944,6 +1951,60 @@ | ||
2911 | /* Log the connection. */ | ||
2912 | verbose("Connection from %.500s port %d", remote_ip, remote_port); | ||
2913 | |||
2914 | +#ifdef USE_SECURITY_SESSION_API | ||
2915 | + /* | ||
2916 | + * Create a new security session for use by the new user login if | ||
2917 | + * the current session is the root session or we are not launched | ||
2918 | + * by inetd (eg: debugging mode or server mode). We do not | ||
2919 | + * necessarily need to create a session if we are launched from | ||
2920 | + * inetd because Panther xinetd will create a session for us. | ||
2921 | + * | ||
2922 | + * The only case where this logic will fail is if there is an | ||
2923 | + * inetd running in a non-root session which is not creating | ||
2924 | + * new sessions for us. Then all the users will end up in the | ||
2925 | + * same session (bad). | ||
2926 | + * | ||
2927 | + * When the client exits, the session will be destroyed for us | ||
2928 | + * automatically. | ||
2929 | + * | ||
2930 | + * We must create the session before any credentials are stored | ||
2931 | + * (including AFS pags, which happens a few lines below). | ||
2932 | + */ | ||
2933 | + { | ||
2934 | + OSStatus err = 0; | ||
2935 | + SecuritySessionId sid = 0; | ||
2936 | + SessionAttributeBits sattrs = 0; | ||
2937 | + | ||
2938 | + err = SessionGetInfo(callerSecuritySession, &sid, &sattrs); | ||
2939 | + if (err) | ||
2940 | + error("SessionGetInfo() failed with error %.8X", | ||
2941 | + (unsigned) err); | ||
2942 | + else | ||
2943 | + debug("Current Session ID is %.8X / Session Attributes are %.8X", | ||
2944 | + (unsigned) sid, (unsigned) sattrs); | ||
2945 | + | ||
2946 | + if (inetd_flag && !(sattrs & sessionIsRoot)) | ||
2947 | + debug("Running in inetd mode in a non-root session... " | ||
2948 | + "assuming inetd created the session for us."); | ||
2949 | + else { | ||
2950 | + debug("Creating new security session..."); | ||
2951 | + err = SessionCreate(0, sessionHasTTY | sessionIsRemote); | ||
2952 | + if (err) | ||
2953 | + error("SessionCreate() failed with error %.8X", | ||
2954 | + (unsigned) err); | ||
2955 | + | ||
2956 | + err = SessionGetInfo(callerSecuritySession, &sid, | ||
2957 | + &sattrs); | ||
2958 | + if (err) | ||
2959 | + error("SessionGetInfo() failed with error %.8X", | ||
2960 | + (unsigned) err); | ||
2961 | + else | ||
2962 | + debug("New Session ID is %.8X / Session Attributes are %.8X", | ||
2963 | + (unsigned) sid, (unsigned) sattrs); | ||
2964 | + } | ||
2965 | + } | ||
2966 | +#endif | ||
2967 | + | ||
2968 | /* | ||
2969 | * We don't want to listen forever unless the other side | ||
2970 | * successfully authenticates itself. So we set up an alarm which is | ||
2971 | @@ -2325,6 +2386,48 @@ | ||
2972 | |||
2973 | myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = list_hostkey_types(); | ||
2974 | |||
2975 | +#ifdef GSSAPI | ||
2976 | + { | ||
2977 | + char *orig; | ||
2978 | + char *gss = NULL; | ||
2979 | + char *newstr = NULL; | ||
2980 | + orig = myproposal[PROPOSAL_KEX_ALGS]; | ||
2981 | + | ||
2982 | + /* | ||
2983 | + * If we don't have a host key, then there's no point advertising | ||
2984 | + * the other key exchange algorithms | ||
2985 | + */ | ||
2986 | + | ||
2987 | + if (strlen(myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS]) == 0) | ||
2988 | + orig = NULL; | ||
2989 | + | ||
2990 | + if (options.gss_keyex) | ||
2991 | + gss = ssh_gssapi_server_mechanisms(); | ||
2992 | + else | ||
2993 | + gss = NULL; | ||
2994 | + | ||
2995 | + if (gss && orig) | ||
2996 | + xasprintf(&newstr, "%s,%s", gss, orig); | ||
2997 | + else if (gss) | ||
2998 | + newstr = gss; | ||
2999 | + else if (orig) | ||
3000 | + newstr = orig; | ||
3001 | + | ||
3002 | + /* | ||
3003 | + * If we've got GSSAPI mechanisms, then we've got the 'null' host | ||
3004 | + * key alg, but we can't tell people about it unless its the only | ||
3005 | + * host key algorithm we support | ||
3006 | + */ | ||
3007 | + if (gss && (strlen(myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS])) == 0) | ||
3008 | + myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = "null"; | ||
3009 | + | ||
3010 | + if (newstr) | ||
3011 | + myproposal[PROPOSAL_KEX_ALGS] = newstr; | ||
3012 | + else | ||
3013 | + fatal("No supported key exchange algorithms"); | ||
3014 | + } | ||
3015 | +#endif | ||
3016 | + | ||
3017 | /* start key exchange */ | ||
3018 | kex = kex_setup(myproposal); | ||
3019 | kex->kex[KEX_DH_GRP1_SHA1] = kexdh_server; | ||
3020 | @@ -2332,6 +2435,13 @@ | ||
3021 | kex->kex[KEX_DH_GEX_SHA1] = kexgex_server; | ||
3022 | kex->kex[KEX_DH_GEX_SHA256] = kexgex_server; | ||
3023 | kex->kex[KEX_ECDH_SHA2] = kexecdh_server; | ||
3024 | +#ifdef GSSAPI | ||
3025 | + if (options.gss_keyex) { | ||
3026 | + kex->kex[KEX_GSS_GRP1_SHA1] = kexgss_server; | ||
3027 | + kex->kex[KEX_GSS_GRP14_SHA1] = kexgss_server; | ||
3028 | + kex->kex[KEX_GSS_GEX_SHA1] = kexgss_server; | ||
3029 | + } | ||
3030 | +#endif | ||
3031 | kex->server = 1; | ||
3032 | kex->client_version_string=client_version_string; | ||
3033 | kex->server_version_string=server_version_string; | ||
3034 | Index: b/sshd_config | ||
3035 | =================================================================== | ||
3036 | --- a/sshd_config | ||
3037 | +++ b/sshd_config | ||
3038 | @@ -75,6 +75,8 @@ | ||
3039 | # GSSAPI options | ||
3040 | #GSSAPIAuthentication no | ||
3041 | #GSSAPICleanupCredentials yes | ||
3042 | +#GSSAPIStrictAcceptorCheck yes | ||
3043 | +#GSSAPIKeyExchange no | ||
3044 | |||
3045 | # Set this to 'yes' to enable PAM authentication, account processing, | ||
3046 | # and session processing. If this is enabled, PAM authentication will | ||
3047 | Index: b/sshd_config.5 | ||
3048 | =================================================================== | ||
3049 | --- a/sshd_config.5 | ||
3050 | +++ b/sshd_config.5 | ||
3051 | @@ -424,12 +424,40 @@ | ||
3052 | The default is | ||
3053 | .Dq no . | ||
3054 | Note that this option applies to protocol version 2 only. | ||
3055 | +.It Cm GSSAPIKeyExchange | ||
3056 | +Specifies whether key exchange based on GSSAPI is allowed. GSSAPI key exchange | ||
3057 | +doesn't rely on ssh keys to verify host identity. | ||
3058 | +The default is | ||
3059 | +.Dq no . | ||
3060 | +Note that this option applies to protocol version 2 only. | ||
3061 | .It Cm GSSAPICleanupCredentials | ||
3062 | Specifies whether to automatically destroy the user's credentials cache | ||
3063 | on logout. | ||
3064 | The default is | ||
3065 | .Dq yes . | ||
3066 | Note that this option applies to protocol version 2 only. | ||
3067 | +.It Cm GSSAPIStrictAcceptorCheck | ||
3068 | +Determines whether to be strict about the identity of the GSSAPI acceptor | ||
3069 | +a client authenticates against. If | ||
3070 | +.Dq yes | ||
3071 | +then the client must authenticate against the | ||
3072 | +.Pa host | ||
3073 | +service on the current hostname. If | ||
3074 | +.Dq no | ||
3075 | +then the client may authenticate against any service key stored in the | ||
3076 | +machine's default store. This facility is provided to assist with operation | ||
3077 | +on multi homed machines. | ||
3078 | +The default is | ||
3079 | +.Dq yes . | ||
3080 | +Note that this option applies only to protocol version 2 GSSAPI connections, | ||
3081 | +and setting it to | ||
3082 | +.Dq no | ||
3083 | +may only work with recent Kerberos GSSAPI libraries. | ||
3084 | +.It Cm GSSAPIStoreCredentialsOnRekey | ||
3085 | +Controls whether the user's GSSAPI credentials should be updated following a | ||
3086 | +successful connection rekeying. This option can be used to accepted renewed | ||
3087 | +or updated credentials from a compatible client. The default is | ||
3088 | +.Dq no . | ||
3089 | .It Cm HostbasedAuthentication | ||
3090 | Specifies whether rhosts or /etc/hosts.equiv authentication together | ||
3091 | with successful public key client host authentication is allowed | ||
diff --git a/debian/patches/helpful-wait-terminate.patch b/debian/patches/helpful-wait-terminate.patch new file mode 100644 index 000000000..857f86456 --- /dev/null +++ b/debian/patches/helpful-wait-terminate.patch | |||
@@ -0,0 +1,18 @@ | |||
1 | Description: Mention ~& when waiting for forwarded connections to terminate | ||
2 | Author: Matthew Vernon <matthew@debian.org> | ||
3 | Bug-Debian: http://bugs.debian.org/50308 | ||
4 | Last-Update: 2010-02-27 | ||
5 | |||
6 | Index: b/serverloop.c | ||
7 | =================================================================== | ||
8 | --- a/serverloop.c | ||
9 | +++ b/serverloop.c | ||
10 | @@ -680,7 +680,7 @@ | ||
11 | if (!channel_still_open()) | ||
12 | break; | ||
13 | if (!waiting_termination) { | ||
14 | - const char *s = "Waiting for forwarded connections to terminate...\r\n"; | ||
15 | + const char *s = "Waiting for forwarded connections to terminate... (press ~& to background)\r\n"; | ||
16 | char *cp; | ||
17 | waiting_termination = 1; | ||
18 | buffer_append(&stderr_buffer, s, strlen(s)); | ||
diff --git a/debian/patches/keepalive-extensions.patch b/debian/patches/keepalive-extensions.patch new file mode 100644 index 000000000..d8362de70 --- /dev/null +++ b/debian/patches/keepalive-extensions.patch | |||
@@ -0,0 +1,124 @@ | |||
1 | Description: Various keepalive extensions | ||
2 | Add compatibility aliases for ProtocolKeepAlives and SetupTimeOut, | ||
3 | supported in previous versions of Debian's OpenSSH package but since | ||
4 | superseded by ServerAliveInterval. (We're probably stuck with this bit for | ||
5 | compatibility.) | ||
6 | . | ||
7 | In batch mode, default ServerAliveInterval to five minutes. | ||
8 | . | ||
9 | Adjust documentation to match and to give some more advice on use of | ||
10 | keepalives. | ||
11 | Author: Richard Kettlewell <rjk@greenend.org.uk> | ||
12 | Author: Ian Jackson <ian@chiark.greenend.org.uk> | ||
13 | Author: Matthew Vernon <matthew@debian.org> | ||
14 | Author: Colin Watson <cjwatson@debian.org> | ||
15 | Last-Update: 2010-02-27 | ||
16 | |||
17 | Index: b/readconf.c | ||
18 | =================================================================== | ||
19 | --- a/readconf.c | ||
20 | +++ b/readconf.c | ||
21 | @@ -138,6 +138,7 @@ | ||
22 | oTunnel, oTunnelDevice, oLocalCommand, oPermitLocalCommand, | ||
23 | oVisualHostKey, oUseRoaming, oZeroKnowledgePasswordAuthentication, | ||
24 | oKexAlgorithms, oIPQoS, oRequestTTY, | ||
25 | + oProtocolKeepAlives, oSetupTimeOut, | ||
26 | oDeprecated, oUnsupported | ||
27 | } OpCodes; | ||
28 | |||
29 | @@ -259,6 +260,8 @@ | ||
30 | { "kexalgorithms", oKexAlgorithms }, | ||
31 | { "ipqos", oIPQoS }, | ||
32 | { "requesttty", oRequestTTY }, | ||
33 | + { "protocolkeepalives", oProtocolKeepAlives }, | ||
34 | + { "setuptimeout", oSetupTimeOut }, | ||
35 | |||
36 | { NULL, oBadOption } | ||
37 | }; | ||
38 | @@ -914,6 +917,8 @@ | ||
39 | goto parse_flag; | ||
40 | |||
41 | case oServerAliveInterval: | ||
42 | + case oProtocolKeepAlives: /* Debian-specific compatibility alias */ | ||
43 | + case oSetupTimeOut: /* Debian-specific compatibility alias */ | ||
44 | intptr = &options->server_alive_interval; | ||
45 | goto parse_time; | ||
46 | |||
47 | @@ -1385,8 +1390,13 @@ | ||
48 | options->rekey_limit = 0; | ||
49 | if (options->verify_host_key_dns == -1) | ||
50 | options->verify_host_key_dns = 0; | ||
51 | - if (options->server_alive_interval == -1) | ||
52 | - options->server_alive_interval = 0; | ||
53 | + if (options->server_alive_interval == -1) { | ||
54 | + /* in batch mode, default is 5mins */ | ||
55 | + if (options->batch_mode == 1) | ||
56 | + options->server_alive_interval = 300; | ||
57 | + else | ||
58 | + options->server_alive_interval = 0; | ||
59 | + } | ||
60 | if (options->server_alive_count_max == -1) | ||
61 | options->server_alive_count_max = 3; | ||
62 | if (options->control_master == -1) | ||
63 | Index: b/ssh_config.5 | ||
64 | =================================================================== | ||
65 | --- a/ssh_config.5 | ||
66 | +++ b/ssh_config.5 | ||
67 | @@ -136,8 +136,12 @@ | ||
68 | If set to | ||
69 | .Dq yes , | ||
70 | passphrase/password querying will be disabled. | ||
71 | +In addition, the | ||
72 | +.Cm ServerAliveInterval | ||
73 | +option will be set to 300 seconds by default. | ||
74 | This option is useful in scripts and other batch jobs where no user | ||
75 | -is present to supply the password. | ||
76 | +is present to supply the password, | ||
77 | +and where it is desirable to detect a broken network swiftly. | ||
78 | The argument must be | ||
79 | .Dq yes | ||
80 | or | ||
81 | @@ -1100,8 +1104,15 @@ | ||
82 | will send a message through the encrypted | ||
83 | channel to request a response from the server. | ||
84 | The default | ||
85 | -is 0, indicating that these messages will not be sent to the server. | ||
86 | +is 0, indicating that these messages will not be sent to the server, | ||
87 | +or 300 if the | ||
88 | +.Cm BatchMode | ||
89 | +option is set. | ||
90 | This option applies to protocol version 2 only. | ||
91 | +.Cm ProtocolKeepAlives | ||
92 | +and | ||
93 | +.Cm SetupTimeOut | ||
94 | +are Debian-specific compatibility aliases for this option. | ||
95 | .It Cm StrictHostKeyChecking | ||
96 | If this flag is set to | ||
97 | .Dq yes , | ||
98 | @@ -1140,6 +1151,12 @@ | ||
99 | other side. | ||
100 | If they are sent, death of the connection or crash of one | ||
101 | of the machines will be properly noticed. | ||
102 | +This option only uses TCP keepalives (as opposed to using ssh level | ||
103 | +keepalives), so takes a long time to notice when the connection dies. | ||
104 | +As such, you probably want | ||
105 | +the | ||
106 | +.Cm ServerAliveInterval | ||
107 | +option as well. | ||
108 | However, this means that | ||
109 | connections will die if the route is down temporarily, and some people | ||
110 | find it annoying. | ||
111 | Index: b/sshd_config.5 | ||
112 | =================================================================== | ||
113 | --- a/sshd_config.5 | ||
114 | +++ b/sshd_config.5 | ||
115 | @@ -1037,6 +1037,9 @@ | ||
116 | .Pp | ||
117 | To disable TCP keepalive messages, the value should be set to | ||
118 | .Dq no . | ||
119 | +.Pp | ||
120 | +This option was formerly called | ||
121 | +.Cm KeepAlive . | ||
122 | .It Cm TrustedUserCAKeys | ||
123 | Specifies a file containing public keys of certificate authorities that are | ||
124 | trusted to sign user certificates for authentication. | ||
diff --git a/debian/patches/lintian-symlink-pickiness.patch b/debian/patches/lintian-symlink-pickiness.patch new file mode 100644 index 000000000..7ee91cce8 --- /dev/null +++ b/debian/patches/lintian-symlink-pickiness.patch | |||
@@ -0,0 +1,23 @@ | |||
1 | Description: Fix picky lintian errors about slogin symlinks | ||
2 | Apparently this breaks some SVR4 packaging systems, so upstream can't win | ||
3 | either way and opted to keep the status quo. We need this patch anyway. | ||
4 | Author: Colin Watson <cjwatson@debian.org> | ||
5 | Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1728 | ||
6 | Last-Update: 2010-04-10 | ||
7 | |||
8 | Index: b/Makefile.in | ||
9 | =================================================================== | ||
10 | --- a/Makefile.in | ||
11 | +++ b/Makefile.in | ||
12 | @@ -282,9 +282,9 @@ | ||
13 | $(INSTALL) -m 644 ssh-pkcs11-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8 | ||
14 | $(INSTALL) -m 644 ssh-vulnkey.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-vulnkey.1 | ||
15 | -rm -f $(DESTDIR)$(bindir)/slogin | ||
16 | - ln -s ./ssh$(EXEEXT) $(DESTDIR)$(bindir)/slogin | ||
17 | + ln -s ssh$(EXEEXT) $(DESTDIR)$(bindir)/slogin | ||
18 | -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/slogin.1 | ||
19 | - ln -s ./ssh.1 $(DESTDIR)$(mandir)/$(mansubdir)1/slogin.1 | ||
20 | + ln -s ssh.1 $(DESTDIR)$(mandir)/$(mansubdir)1/slogin.1 | ||
21 | |||
22 | install-sysconf: | ||
23 | if [ ! -d $(DESTDIR)$(sysconfdir) ]; then \ | ||
diff --git a/debian/patches/openbsd-docs.patch b/debian/patches/openbsd-docs.patch new file mode 100644 index 000000000..bda5f0c24 --- /dev/null +++ b/debian/patches/openbsd-docs.patch | |||
@@ -0,0 +1,135 @@ | |||
1 | Description: Adjust various OpenBSD-specific references in manual pages | ||
2 | No single bug reference for this patch, but history includes: | ||
3 | http://bugs.debian.org/154434 (login.conf(5)) | ||
4 | http://bugs.debian.org/513417 (/etc/rc) | ||
5 | http://bugs.debian.org/530692 (ssl(8)) | ||
6 | https://bugs.launchpad.net/bugs/456660 (ssl(8)) | ||
7 | Author: Colin Watson <cjwatson@debian.org> | ||
8 | Forwarded: not-needed | ||
9 | Last-Update: 2010-02-28 | ||
10 | |||
11 | Index: b/moduli.5 | ||
12 | =================================================================== | ||
13 | --- a/moduli.5 | ||
14 | +++ b/moduli.5 | ||
15 | @@ -21,7 +21,7 @@ | ||
16 | .Nd Diffie-Hellman moduli | ||
17 | .Sh DESCRIPTION | ||
18 | The | ||
19 | -.Pa /etc/moduli | ||
20 | +.Pa /etc/ssh/moduli | ||
21 | file contains prime numbers and generators for use by | ||
22 | .Xr sshd 8 | ||
23 | in the Diffie-Hellman Group Exchange key exchange method. | ||
24 | @@ -110,7 +110,7 @@ | ||
25 | Diffie-Hellman output to sufficiently key the selected symmetric cipher. | ||
26 | .Xr sshd 8 | ||
27 | then randomly selects a modulus from | ||
28 | -.Fa /etc/moduli | ||
29 | +.Fa /etc/ssh/moduli | ||
30 | that best meets the size requirement. | ||
31 | .Sh SEE ALSO | ||
32 | .Xr ssh-keygen 1 , | ||
33 | Index: b/ssh-keygen.1 | ||
34 | =================================================================== | ||
35 | --- a/ssh-keygen.1 | ||
36 | +++ b/ssh-keygen.1 | ||
37 | @@ -149,9 +149,7 @@ | ||
38 | .Pa ~/.ssh/id_dsa | ||
39 | or | ||
40 | .Pa ~/.ssh/id_rsa . | ||
41 | -Additionally, the system administrator may use this to generate host keys, | ||
42 | -as seen in | ||
43 | -.Pa /etc/rc . | ||
44 | +Additionally, the system administrator may use this to generate host keys. | ||
45 | .Pp | ||
46 | Normally this program generates the key and asks for a file in which | ||
47 | to store the private key. | ||
48 | @@ -197,9 +195,7 @@ | ||
49 | For each of the key types (rsa1, rsa, dsa and ecdsa) for which host keys | ||
50 | do not exist, generate the host keys with the default key file path, | ||
51 | an empty passphrase, default bits for the key type, and default comment. | ||
52 | -This is used by | ||
53 | -.Pa /etc/rc | ||
54 | -to generate new host keys. | ||
55 | +This is used by system administration scripts to generate new host keys. | ||
56 | .It Fl a Ar trials | ||
57 | Specifies the number of primality tests to perform when screening DH-GEX | ||
58 | candidates using the | ||
59 | @@ -535,7 +531,7 @@ | ||
60 | Valid generator values are 2, 3, and 5. | ||
61 | .Pp | ||
62 | Screened DH groups may be installed in | ||
63 | -.Pa /etc/moduli . | ||
64 | +.Pa /etc/ssh/moduli . | ||
65 | It is important that this file contains moduli of a range of bit lengths and | ||
66 | that both ends of a connection share common moduli. | ||
67 | .Sh CERTIFICATES | ||
68 | @@ -661,7 +657,7 @@ | ||
69 | where the user wishes to log in using public key authentication. | ||
70 | There is no need to keep the contents of this file secret. | ||
71 | .Pp | ||
72 | -.It Pa /etc/moduli | ||
73 | +.It Pa /etc/ssh/moduli | ||
74 | Contains Diffie-Hellman groups used for DH-GEX. | ||
75 | The file format is described in | ||
76 | .Xr moduli 5 . | ||
77 | Index: b/ssh.1 | ||
78 | =================================================================== | ||
79 | --- a/ssh.1 | ||
80 | +++ b/ssh.1 | ||
81 | @@ -731,6 +731,10 @@ | ||
82 | .Sx HISTORY | ||
83 | section of | ||
84 | .Xr ssl 8 | ||
85 | +(on non-OpenBSD systems, see | ||
86 | +.nh | ||
87 | +http://www.openbsd.org/cgi\-bin/man.cgi?query=ssl&sektion=8#HISTORY) | ||
88 | +.hy | ||
89 | contains a brief discussion of the DSA and RSA algorithms. | ||
90 | .Pp | ||
91 | The file | ||
92 | Index: b/sshd.8 | ||
93 | =================================================================== | ||
94 | --- a/sshd.8 | ||
95 | +++ b/sshd.8 | ||
96 | @@ -69,7 +69,7 @@ | ||
97 | .Nm | ||
98 | listens for connections from clients. | ||
99 | It is normally started at boot from | ||
100 | -.Pa /etc/rc . | ||
101 | +.Pa /etc/init.d/ssh . | ||
102 | It forks a new | ||
103 | daemon for each incoming connection. | ||
104 | The forked daemons handle | ||
105 | @@ -853,7 +853,7 @@ | ||
106 | .Xr ssh 1 ) . | ||
107 | It should only be writable by root. | ||
108 | .Pp | ||
109 | -.It Pa /etc/moduli | ||
110 | +.It Pa /etc/ssh/moduli | ||
111 | Contains Diffie-Hellman groups used for the "Diffie-Hellman Group Exchange". | ||
112 | The file format is described in | ||
113 | .Xr moduli 5 . | ||
114 | @@ -951,7 +951,6 @@ | ||
115 | .Xr ssh-vulnkey 1 , | ||
116 | .Xr chroot 2 , | ||
117 | .Xr hosts_access 5 , | ||
118 | -.Xr login.conf 5 , | ||
119 | .Xr moduli 5 , | ||
120 | .Xr sshd_config 5 , | ||
121 | .Xr inetd 8 , | ||
122 | Index: b/sshd_config.5 | ||
123 | =================================================================== | ||
124 | --- a/sshd_config.5 | ||
125 | +++ b/sshd_config.5 | ||
126 | @@ -222,8 +222,7 @@ | ||
127 | By default, no banner is displayed. | ||
128 | .It Cm ChallengeResponseAuthentication | ||
129 | Specifies whether challenge-response authentication is allowed (e.g. via | ||
130 | -PAM or though authentication styles supported in | ||
131 | -.Xr login.conf 5 ) | ||
132 | +PAM). | ||
133 | The default is | ||
134 | .Dq yes . | ||
135 | .It Cm ChrootDirectory | ||
diff --git a/debian/patches/package-versioning.patch b/debian/patches/package-versioning.patch new file mode 100644 index 000000000..6dd0cf78d --- /dev/null +++ b/debian/patches/package-versioning.patch | |||
@@ -0,0 +1,50 @@ | |||
1 | Description: Include the Debian version in our identification | ||
2 | This makes it easier to audit networks for versions patched against | ||
3 | security vulnerabilities. It has little detrimental effect, as attackers | ||
4 | will generally just try attacks rather than bothering to scan for | ||
5 | vulnerable-looking version strings. (However, see debian-banner.patch.) | ||
6 | Author: Matthew Vernon <matthew@debian.org> | ||
7 | Forwarded: not-needed | ||
8 | Last-Update: 2010-02-28 | ||
9 | |||
10 | Index: b/sshconnect.c | ||
11 | =================================================================== | ||
12 | --- a/sshconnect.c | ||
13 | +++ b/sshconnect.c | ||
14 | @@ -556,7 +556,7 @@ | ||
15 | snprintf(buf, sizeof buf, "SSH-%d.%d-%.100s%s", | ||
16 | compat20 ? PROTOCOL_MAJOR_2 : PROTOCOL_MAJOR_1, | ||
17 | compat20 ? PROTOCOL_MINOR_2 : minor1, | ||
18 | - SSH_VERSION, compat20 ? "\r\n" : "\n"); | ||
19 | + SSH_RELEASE, compat20 ? "\r\n" : "\n"); | ||
20 | if (roaming_atomicio(vwrite, connection_out, buf, strlen(buf)) | ||
21 | != strlen(buf)) | ||
22 | fatal("write: %.100s", strerror(errno)); | ||
23 | Index: b/sshd.c | ||
24 | =================================================================== | ||
25 | --- a/sshd.c | ||
26 | +++ b/sshd.c | ||
27 | @@ -423,7 +423,7 @@ | ||
28 | minor = PROTOCOL_MINOR_1; | ||
29 | } | ||
30 | snprintf(buf, sizeof buf, "SSH-%d.%d-%.100s%s", major, minor, | ||
31 | - SSH_VERSION, newline); | ||
32 | + SSH_RELEASE, newline); | ||
33 | server_version_string = xstrdup(buf); | ||
34 | |||
35 | /* Send our protocol version identification. */ | ||
36 | Index: b/version.h | ||
37 | =================================================================== | ||
38 | --- a/version.h | ||
39 | +++ b/version.h | ||
40 | @@ -3,4 +3,9 @@ | ||
41 | #define SSH_VERSION "OpenSSH_5.9" | ||
42 | |||
43 | #define SSH_PORTABLE "p2" | ||
44 | -#define SSH_RELEASE SSH_VERSION SSH_PORTABLE | ||
45 | +#define SSH_RELEASE_MINIMUM SSH_VERSION SSH_PORTABLE | ||
46 | +#ifdef SSH_EXTRAVERSION | ||
47 | +#define SSH_RELEASE SSH_RELEASE_MINIMUM " " SSH_EXTRAVERSION | ||
48 | +#else | ||
49 | +#define SSH_RELEASE SSH_RELEASE_MINIMUM | ||
50 | +#endif | ||
diff --git a/debian/patches/quieter-signals.patch b/debian/patches/quieter-signals.patch new file mode 100644 index 000000000..ff41f094d --- /dev/null +++ b/debian/patches/quieter-signals.patch | |||
@@ -0,0 +1,31 @@ | |||
1 | Description: Reduce severity of "Killed by signal %d" | ||
2 | This produces irritating messages when using ProxyCommand or other programs | ||
3 | that use ssh under the covers (e.g. Subversion). These messages are more | ||
4 | normally printed by the calling program, such as the shell. | ||
5 | . | ||
6 | According to the upstream bug, the right way to avoid this is to use the -q | ||
7 | option, so we may drop this patch after further investigation into whether | ||
8 | any software in Debian is still relying on it. | ||
9 | Author: Peter Samuelson <peter@p12n.org> | ||
10 | Author: Colin Watson <cjwatson@debian.org> | ||
11 | Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1118 | ||
12 | Bug-Debian: http://bugs.debian.org/313371 | ||
13 | Last-Update: 2010-02-27 | ||
14 | |||
15 | Index: b/clientloop.c | ||
16 | =================================================================== | ||
17 | --- a/clientloop.c | ||
18 | +++ b/clientloop.c | ||
19 | @@ -1619,8 +1619,10 @@ | ||
20 | exit_status = 0; | ||
21 | } | ||
22 | |||
23 | - if (received_signal) | ||
24 | - fatal("Killed by signal %d.", (int) received_signal); | ||
25 | + if (received_signal) { | ||
26 | + debug("Killed by signal %d.", (int) received_signal); | ||
27 | + cleanup_exit((int) received_signal + 128); | ||
28 | + } | ||
29 | |||
30 | /* | ||
31 | * In interactive mode (with pseudo tty) display a message indicating | ||
diff --git a/debian/patches/scp-quoting.patch b/debian/patches/scp-quoting.patch new file mode 100644 index 000000000..239c1b599 --- /dev/null +++ b/debian/patches/scp-quoting.patch | |||
@@ -0,0 +1,32 @@ | |||
1 | Description: Adjust scp quoting in verbose mode | ||
2 | Tweak scp's reporting of filenames in verbose mode to be a bit less | ||
3 | confusing with spaces. | ||
4 | . | ||
5 | This should be revised to mimic real shell quoting. | ||
6 | Author: Nicolas Valcárcel <nvalcarcel@ubuntu.com> | ||
7 | Bug-Ubuntu: https://bugs.launchpad.net/bugs/89945 | ||
8 | Last-Update: 2010-02-27 | ||
9 | |||
10 | Index: b/scp.c | ||
11 | =================================================================== | ||
12 | --- a/scp.c | ||
13 | +++ b/scp.c | ||
14 | @@ -189,8 +189,16 @@ | ||
15 | |||
16 | if (verbose_mode) { | ||
17 | fprintf(stderr, "Executing:"); | ||
18 | - for (i = 0; i < a->num; i++) | ||
19 | - fprintf(stderr, " %s", a->list[i]); | ||
20 | + for (i = 0; i < a->num; i++) { | ||
21 | + if (i == 0) | ||
22 | + fprintf(stderr, " %s", a->list[i]); | ||
23 | + else | ||
24 | + /* | ||
25 | + * TODO: misbehaves if a->list[i] contains a | ||
26 | + * single quote | ||
27 | + */ | ||
28 | + fprintf(stderr, " '%s'", a->list[i]); | ||
29 | + } | ||
30 | fprintf(stderr, "\n"); | ||
31 | } | ||
32 | if ((pid = fork()) == -1) | ||
diff --git a/debian/patches/selinux-role.patch b/debian/patches/selinux-role.patch new file mode 100644 index 000000000..b14402199 --- /dev/null +++ b/debian/patches/selinux-role.patch | |||
@@ -0,0 +1,482 @@ | |||
1 | Description: Handle SELinux authorisation roles | ||
2 | Rejected upstream due to discomfort with magic usernames; a better approach | ||
3 | will need an SSH protocol change. In the meantime, this came from Debian's | ||
4 | SELinux maintainer, so we'll keep it until we have something better. | ||
5 | Author: Manoj Srivastava <srivasta@debian.org> | ||
6 | Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1641 | ||
7 | Bug-Debian: http://bugs.debian.org/394795 | ||
8 | Last-Update: 2010-02-27 | ||
9 | |||
10 | Index: b/auth.h | ||
11 | =================================================================== | ||
12 | --- a/auth.h | ||
13 | +++ b/auth.h | ||
14 | @@ -59,6 +59,7 @@ | ||
15 | char *service; | ||
16 | struct passwd *pw; /* set if 'valid' */ | ||
17 | char *style; | ||
18 | + char *role; | ||
19 | void *kbdintctxt; | ||
20 | void *jpake_ctx; | ||
21 | #ifdef BSD_AUTH | ||
22 | Index: b/auth1.c | ||
23 | =================================================================== | ||
24 | --- a/auth1.c | ||
25 | +++ b/auth1.c | ||
26 | @@ -383,7 +383,7 @@ | ||
27 | do_authentication(Authctxt *authctxt) | ||
28 | { | ||
29 | u_int ulen; | ||
30 | - char *user, *style = NULL; | ||
31 | + char *user, *style = NULL, *role = NULL; | ||
32 | |||
33 | /* Get the name of the user that we wish to log in as. */ | ||
34 | packet_read_expect(SSH_CMSG_USER); | ||
35 | @@ -392,11 +392,17 @@ | ||
36 | user = packet_get_cstring(&ulen); | ||
37 | packet_check_eom(); | ||
38 | |||
39 | + if ((role = strchr(user, '/')) != NULL) | ||
40 | + *role++ = '\0'; | ||
41 | + | ||
42 | if ((style = strchr(user, ':')) != NULL) | ||
43 | *style++ = '\0'; | ||
44 | + else if (role && (style = strchr(role, ':')) != NULL) | ||
45 | + *style++ = '\0'; | ||
46 | |||
47 | authctxt->user = user; | ||
48 | authctxt->style = style; | ||
49 | + authctxt->role = role; | ||
50 | |||
51 | /* Verify that the user is a valid user. */ | ||
52 | if ((authctxt->pw = PRIVSEP(getpwnamallow(user))) != NULL) | ||
53 | Index: b/auth2.c | ||
54 | =================================================================== | ||
55 | --- a/auth2.c | ||
56 | +++ b/auth2.c | ||
57 | @@ -217,7 +217,7 @@ | ||
58 | { | ||
59 | Authctxt *authctxt = ctxt; | ||
60 | Authmethod *m = NULL; | ||
61 | - char *user, *service, *method, *style = NULL; | ||
62 | + char *user, *service, *method, *style = NULL, *role = NULL; | ||
63 | int authenticated = 0; | ||
64 | |||
65 | if (authctxt == NULL) | ||
66 | @@ -229,8 +229,13 @@ | ||
67 | debug("userauth-request for user %s service %s method %s", user, service, method); | ||
68 | debug("attempt %d failures %d", authctxt->attempt, authctxt->failures); | ||
69 | |||
70 | + if ((role = strchr(user, '/')) != NULL) | ||
71 | + *role++ = 0; | ||
72 | + | ||
73 | if ((style = strchr(user, ':')) != NULL) | ||
74 | *style++ = 0; | ||
75 | + else if (role && (style = strchr(role, ':')) != NULL) | ||
76 | + *style++ = '\0'; | ||
77 | |||
78 | if (authctxt->attempt++ == 0) { | ||
79 | /* setup auth context */ | ||
80 | @@ -254,8 +259,9 @@ | ||
81 | use_privsep ? " [net]" : ""); | ||
82 | authctxt->service = xstrdup(service); | ||
83 | authctxt->style = style ? xstrdup(style) : NULL; | ||
84 | + authctxt->role = role ? xstrdup(role) : NULL; | ||
85 | if (use_privsep) | ||
86 | - mm_inform_authserv(service, style); | ||
87 | + mm_inform_authserv(service, style, role); | ||
88 | userauth_banner(); | ||
89 | } else if (strcmp(user, authctxt->user) != 0 || | ||
90 | strcmp(service, authctxt->service) != 0) { | ||
91 | Index: b/monitor.c | ||
92 | =================================================================== | ||
93 | --- a/monitor.c | ||
94 | +++ b/monitor.c | ||
95 | @@ -145,6 +145,7 @@ | ||
96 | int mm_answer_pwnamallow(int, Buffer *); | ||
97 | int mm_answer_auth2_read_banner(int, Buffer *); | ||
98 | int mm_answer_authserv(int, Buffer *); | ||
99 | +int mm_answer_authrole(int, Buffer *); | ||
100 | int mm_answer_authpassword(int, Buffer *); | ||
101 | int mm_answer_bsdauthquery(int, Buffer *); | ||
102 | int mm_answer_bsdauthrespond(int, Buffer *); | ||
103 | @@ -225,6 +226,7 @@ | ||
104 | {MONITOR_REQ_SIGN, MON_ONCE, mm_answer_sign}, | ||
105 | {MONITOR_REQ_PWNAM, MON_ONCE, mm_answer_pwnamallow}, | ||
106 | {MONITOR_REQ_AUTHSERV, MON_ONCE, mm_answer_authserv}, | ||
107 | + {MONITOR_REQ_AUTHROLE, MON_ONCE, mm_answer_authrole}, | ||
108 | {MONITOR_REQ_AUTH2_READ_BANNER, MON_ONCE, mm_answer_auth2_read_banner}, | ||
109 | {MONITOR_REQ_AUTHPASSWORD, MON_AUTH, mm_answer_authpassword}, | ||
110 | #ifdef USE_PAM | ||
111 | @@ -810,6 +812,7 @@ | ||
112 | else { | ||
113 | /* Allow service/style information on the auth context */ | ||
114 | monitor_permit(mon_dispatch, MONITOR_REQ_AUTHSERV, 1); | ||
115 | + monitor_permit(mon_dispatch, MONITOR_REQ_AUTHROLE, 1); | ||
116 | monitor_permit(mon_dispatch, MONITOR_REQ_AUTH2_READ_BANNER, 1); | ||
117 | } | ||
118 | #ifdef USE_PAM | ||
119 | @@ -842,14 +845,37 @@ | ||
120 | |||
121 | authctxt->service = buffer_get_string(m, NULL); | ||
122 | authctxt->style = buffer_get_string(m, NULL); | ||
123 | - debug3("%s: service=%s, style=%s", | ||
124 | - __func__, authctxt->service, authctxt->style); | ||
125 | + authctxt->role = buffer_get_string(m, NULL); | ||
126 | + debug3("%s: service=%s, style=%s, role=%s", | ||
127 | + __func__, authctxt->service, authctxt->style, authctxt->role); | ||
128 | |||
129 | if (strlen(authctxt->style) == 0) { | ||
130 | xfree(authctxt->style); | ||
131 | authctxt->style = NULL; | ||
132 | } | ||
133 | |||
134 | + if (strlen(authctxt->role) == 0) { | ||
135 | + xfree(authctxt->role); | ||
136 | + authctxt->role = NULL; | ||
137 | + } | ||
138 | + | ||
139 | + return (0); | ||
140 | +} | ||
141 | + | ||
142 | +int | ||
143 | +mm_answer_authrole(int sock, Buffer *m) | ||
144 | +{ | ||
145 | + monitor_permit_authentications(1); | ||
146 | + | ||
147 | + authctxt->role = buffer_get_string(m, NULL); | ||
148 | + debug3("%s: role=%s", | ||
149 | + __func__, authctxt->role); | ||
150 | + | ||
151 | + if (strlen(authctxt->role) == 0) { | ||
152 | + xfree(authctxt->role); | ||
153 | + authctxt->role = NULL; | ||
154 | + } | ||
155 | + | ||
156 | return (0); | ||
157 | } | ||
158 | |||
159 | @@ -1437,7 +1463,7 @@ | ||
160 | res = pty_allocate(&s->ptyfd, &s->ttyfd, s->tty, sizeof(s->tty)); | ||
161 | if (res == 0) | ||
162 | goto error; | ||
163 | - pty_setowner(authctxt->pw, s->tty); | ||
164 | + pty_setowner(authctxt->pw, s->tty, authctxt->role); | ||
165 | |||
166 | buffer_put_int(m, 1); | ||
167 | buffer_put_cstring(m, s->tty); | ||
168 | Index: b/monitor.h | ||
169 | =================================================================== | ||
170 | --- a/monitor.h | ||
171 | +++ b/monitor.h | ||
172 | @@ -30,7 +30,7 @@ | ||
173 | |||
174 | enum monitor_reqtype { | ||
175 | MONITOR_REQ_MODULI, MONITOR_ANS_MODULI, | ||
176 | - MONITOR_REQ_FREE, MONITOR_REQ_AUTHSERV, | ||
177 | + MONITOR_REQ_FREE, MONITOR_REQ_AUTHSERV, MONITOR_REQ_AUTHROLE, | ||
178 | MONITOR_REQ_SIGN, MONITOR_ANS_SIGN, | ||
179 | MONITOR_REQ_PWNAM, MONITOR_ANS_PWNAM, | ||
180 | MONITOR_REQ_AUTH2_READ_BANNER, MONITOR_ANS_AUTH2_READ_BANNER, | ||
181 | Index: b/monitor_wrap.c | ||
182 | =================================================================== | ||
183 | --- a/monitor_wrap.c | ||
184 | +++ b/monitor_wrap.c | ||
185 | @@ -318,10 +318,10 @@ | ||
186 | return (banner); | ||
187 | } | ||
188 | |||
189 | -/* Inform the privileged process about service and style */ | ||
190 | +/* Inform the privileged process about service, style, and role */ | ||
191 | |||
192 | void | ||
193 | -mm_inform_authserv(char *service, char *style) | ||
194 | +mm_inform_authserv(char *service, char *style, char *role) | ||
195 | { | ||
196 | Buffer m; | ||
197 | |||
198 | @@ -330,11 +330,29 @@ | ||
199 | buffer_init(&m); | ||
200 | buffer_put_cstring(&m, service); | ||
201 | buffer_put_cstring(&m, style ? style : ""); | ||
202 | + buffer_put_cstring(&m, role ? role : ""); | ||
203 | |||
204 | mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUTHSERV, &m); | ||
205 | |||
206 | buffer_free(&m); | ||
207 | } | ||
208 | + | ||
209 | +/* Inform the privileged process about role */ | ||
210 | + | ||
211 | +void | ||
212 | +mm_inform_authrole(char *role) | ||
213 | +{ | ||
214 | + Buffer m; | ||
215 | + | ||
216 | + debug3("%s entering", __func__); | ||
217 | + | ||
218 | + buffer_init(&m); | ||
219 | + buffer_put_cstring(&m, role ? role : ""); | ||
220 | + | ||
221 | + mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUTHROLE, &m); | ||
222 | + | ||
223 | + buffer_free(&m); | ||
224 | +} | ||
225 | |||
226 | /* Do the password authentication */ | ||
227 | int | ||
228 | Index: b/monitor_wrap.h | ||
229 | =================================================================== | ||
230 | --- a/monitor_wrap.h | ||
231 | +++ b/monitor_wrap.h | ||
232 | @@ -41,7 +41,8 @@ | ||
233 | int mm_is_monitor(void); | ||
234 | DH *mm_choose_dh(int, int, int); | ||
235 | int mm_key_sign(Key *, u_char **, u_int *, u_char *, u_int); | ||
236 | -void mm_inform_authserv(char *, char *); | ||
237 | +void mm_inform_authserv(char *, char *, char *); | ||
238 | +void mm_inform_authrole(char *); | ||
239 | struct passwd *mm_getpwnamallow(const char *); | ||
240 | char *mm_auth2_read_banner(void); | ||
241 | int mm_auth_password(struct Authctxt *, char *); | ||
242 | Index: b/openbsd-compat/port-linux.c | ||
243 | =================================================================== | ||
244 | --- a/openbsd-compat/port-linux.c | ||
245 | +++ b/openbsd-compat/port-linux.c | ||
246 | @@ -29,6 +29,12 @@ | ||
247 | #include <string.h> | ||
248 | #include <stdio.h> | ||
249 | |||
250 | +#ifdef WITH_SELINUX | ||
251 | +#include "key.h" | ||
252 | +#include "hostfile.h" | ||
253 | +#include "auth.h" | ||
254 | +#endif | ||
255 | + | ||
256 | #include "log.h" | ||
257 | #include "xmalloc.h" | ||
258 | #include "port-linux.h" | ||
259 | @@ -58,9 +64,9 @@ | ||
260 | |||
261 | /* Return the default security context for the given username */ | ||
262 | static security_context_t | ||
263 | -ssh_selinux_getctxbyname(char *pwname) | ||
264 | +ssh_selinux_getctxbyname(char *pwname, const char *role) | ||
265 | { | ||
266 | - security_context_t sc; | ||
267 | + security_context_t sc = NULL; | ||
268 | char *sename = NULL, *lvl = NULL; | ||
269 | int r; | ||
270 | |||
271 | @@ -73,9 +79,16 @@ | ||
272 | #endif | ||
273 | |||
274 | #ifdef HAVE_GET_DEFAULT_CONTEXT_WITH_LEVEL | ||
275 | - r = get_default_context_with_level(sename, lvl, NULL, &sc); | ||
276 | + if (role != NULL && role[0]) | ||
277 | + r = get_default_context_with_rolelevel(sename, role, lvl, NULL, | ||
278 | + &sc); | ||
279 | + else | ||
280 | + r = get_default_context_with_level(sename, lvl, NULL, &sc); | ||
281 | #else | ||
282 | - r = get_default_context(sename, NULL, &sc); | ||
283 | + if (role != NULL && role[0]) | ||
284 | + r = get_default_context_with_role(sename, role, NULL, &sc); | ||
285 | + else | ||
286 | + r = get_default_context(sename, NULL, &sc); | ||
287 | #endif | ||
288 | |||
289 | if (r != 0) { | ||
290 | @@ -106,7 +119,7 @@ | ||
291 | |||
292 | /* Set the execution context to the default for the specified user */ | ||
293 | void | ||
294 | -ssh_selinux_setup_exec_context(char *pwname) | ||
295 | +ssh_selinux_setup_exec_context(char *pwname, const char *role) | ||
296 | { | ||
297 | security_context_t user_ctx = NULL; | ||
298 | |||
299 | @@ -115,7 +128,7 @@ | ||
300 | |||
301 | debug3("%s: setting execution context", __func__); | ||
302 | |||
303 | - user_ctx = ssh_selinux_getctxbyname(pwname); | ||
304 | + user_ctx = ssh_selinux_getctxbyname(pwname, role); | ||
305 | if (setexeccon(user_ctx) != 0) { | ||
306 | switch (security_getenforce()) { | ||
307 | case -1: | ||
308 | @@ -137,7 +150,7 @@ | ||
309 | |||
310 | /* Set the TTY context for the specified user */ | ||
311 | void | ||
312 | -ssh_selinux_setup_pty(char *pwname, const char *tty) | ||
313 | +ssh_selinux_setup_pty(char *pwname, const char *tty, const char *role) | ||
314 | { | ||
315 | security_context_t new_tty_ctx = NULL; | ||
316 | security_context_t user_ctx = NULL; | ||
317 | @@ -148,7 +161,7 @@ | ||
318 | |||
319 | debug3("%s: setting TTY context on %s", __func__, tty); | ||
320 | |||
321 | - user_ctx = ssh_selinux_getctxbyname(pwname); | ||
322 | + user_ctx = ssh_selinux_getctxbyname(pwname, role); | ||
323 | |||
324 | /* XXX: should these calls fatal() upon failure in enforcing mode? */ | ||
325 | |||
326 | Index: b/openbsd-compat/port-linux.h | ||
327 | =================================================================== | ||
328 | --- a/openbsd-compat/port-linux.h | ||
329 | +++ b/openbsd-compat/port-linux.h | ||
330 | @@ -21,8 +21,8 @@ | ||
331 | |||
332 | #ifdef WITH_SELINUX | ||
333 | int ssh_selinux_enabled(void); | ||
334 | -void ssh_selinux_setup_pty(char *, const char *); | ||
335 | -void ssh_selinux_setup_exec_context(char *); | ||
336 | +void ssh_selinux_setup_pty(char *, const char *, const char *); | ||
337 | +void ssh_selinux_setup_exec_context(char *, const char *); | ||
338 | void ssh_selinux_change_context(const char *); | ||
339 | void ssh_selinux_setfscreatecon(const char *); | ||
340 | #endif | ||
341 | Index: b/platform.c | ||
342 | =================================================================== | ||
343 | --- a/platform.c | ||
344 | +++ b/platform.c | ||
345 | @@ -134,7 +134,7 @@ | ||
346 | * called if sshd is running as root. | ||
347 | */ | ||
348 | void | ||
349 | -platform_setusercontext_post_groups(struct passwd *pw) | ||
350 | +platform_setusercontext_post_groups(struct passwd *pw, const char *role) | ||
351 | { | ||
352 | #if !defined(HAVE_LOGIN_CAP) && defined(USE_PAM) | ||
353 | /* | ||
354 | @@ -181,7 +181,7 @@ | ||
355 | } | ||
356 | #endif /* HAVE_SETPCRED */ | ||
357 | #ifdef WITH_SELINUX | ||
358 | - ssh_selinux_setup_exec_context(pw->pw_name); | ||
359 | + ssh_selinux_setup_exec_context(pw->pw_name, role); | ||
360 | #endif | ||
361 | } | ||
362 | |||
363 | Index: b/platform.h | ||
364 | =================================================================== | ||
365 | --- a/platform.h | ||
366 | +++ b/platform.h | ||
367 | @@ -26,7 +26,7 @@ | ||
368 | void platform_post_fork_child(void); | ||
369 | int platform_privileged_uidswap(void); | ||
370 | void platform_setusercontext(struct passwd *); | ||
371 | -void platform_setusercontext_post_groups(struct passwd *); | ||
372 | +void platform_setusercontext_post_groups(struct passwd *, const char *); | ||
373 | char *platform_get_krb5_client(const char *); | ||
374 | char *platform_krb5_get_principal_name(const char *); | ||
375 | |||
376 | Index: b/session.c | ||
377 | =================================================================== | ||
378 | --- a/session.c | ||
379 | +++ b/session.c | ||
380 | @@ -1471,7 +1471,7 @@ | ||
381 | |||
382 | /* Set login name, uid, gid, and groups. */ | ||
383 | void | ||
384 | -do_setusercontext(struct passwd *pw) | ||
385 | +do_setusercontext(struct passwd *pw, const char *role) | ||
386 | { | ||
387 | char *chroot_path, *tmp; | ||
388 | |||
389 | @@ -1499,7 +1499,7 @@ | ||
390 | endgrent(); | ||
391 | #endif | ||
392 | |||
393 | - platform_setusercontext_post_groups(pw); | ||
394 | + platform_setusercontext_post_groups(pw, role); | ||
395 | |||
396 | if (options.chroot_directory != NULL && | ||
397 | strcasecmp(options.chroot_directory, "none") != 0) { | ||
398 | @@ -1625,7 +1625,7 @@ | ||
399 | |||
400 | /* Force a password change */ | ||
401 | if (s->authctxt->force_pwchange) { | ||
402 | - do_setusercontext(pw); | ||
403 | + do_setusercontext(pw, s->authctxt->role); | ||
404 | child_close_fds(); | ||
405 | do_pwchange(s); | ||
406 | exit(1); | ||
407 | @@ -1652,7 +1652,7 @@ | ||
408 | /* When PAM is enabled we rely on it to do the nologin check */ | ||
409 | if (!options.use_pam) | ||
410 | do_nologin(pw); | ||
411 | - do_setusercontext(pw); | ||
412 | + do_setusercontext(pw, s->authctxt->role); | ||
413 | /* | ||
414 | * PAM session modules in do_setusercontext may have | ||
415 | * generated messages, so if this in an interactive | ||
416 | @@ -2064,7 +2064,7 @@ | ||
417 | tty_parse_modes(s->ttyfd, &n_bytes); | ||
418 | |||
419 | if (!use_privsep) | ||
420 | - pty_setowner(s->pw, s->tty); | ||
421 | + pty_setowner(s->pw, s->tty, s->authctxt->role); | ||
422 | |||
423 | /* Set window size from the packet. */ | ||
424 | pty_change_window_size(s->ptyfd, s->row, s->col, s->xpixel, s->ypixel); | ||
425 | Index: b/session.h | ||
426 | =================================================================== | ||
427 | --- a/session.h | ||
428 | +++ b/session.h | ||
429 | @@ -76,7 +76,7 @@ | ||
430 | Session *session_new(void); | ||
431 | Session *session_by_tty(char *); | ||
432 | void session_close(Session *); | ||
433 | -void do_setusercontext(struct passwd *); | ||
434 | +void do_setusercontext(struct passwd *, const char *); | ||
435 | void child_set_env(char ***envp, u_int *envsizep, const char *name, | ||
436 | const char *value); | ||
437 | |||
438 | Index: b/sshd.c | ||
439 | =================================================================== | ||
440 | --- a/sshd.c | ||
441 | +++ b/sshd.c | ||
442 | @@ -730,7 +730,7 @@ | ||
443 | RAND_seed(rnd, sizeof(rnd)); | ||
444 | |||
445 | /* Drop privileges */ | ||
446 | - do_setusercontext(authctxt->pw); | ||
447 | + do_setusercontext(authctxt->pw, authctxt->role); | ||
448 | |||
449 | skip: | ||
450 | /* It is safe now to apply the key state */ | ||
451 | Index: b/sshpty.c | ||
452 | =================================================================== | ||
453 | --- a/sshpty.c | ||
454 | +++ b/sshpty.c | ||
455 | @@ -200,7 +200,7 @@ | ||
456 | } | ||
457 | |||
458 | void | ||
459 | -pty_setowner(struct passwd *pw, const char *tty) | ||
460 | +pty_setowner(struct passwd *pw, const char *tty, const char *role) | ||
461 | { | ||
462 | struct group *grp; | ||
463 | gid_t gid; | ||
464 | @@ -227,7 +227,7 @@ | ||
465 | strerror(errno)); | ||
466 | |||
467 | #ifdef WITH_SELINUX | ||
468 | - ssh_selinux_setup_pty(pw->pw_name, tty); | ||
469 | + ssh_selinux_setup_pty(pw->pw_name, tty, role); | ||
470 | #endif | ||
471 | |||
472 | if (st.st_uid != pw->pw_uid || st.st_gid != gid) { | ||
473 | Index: b/sshpty.h | ||
474 | =================================================================== | ||
475 | --- a/sshpty.h | ||
476 | +++ b/sshpty.h | ||
477 | @@ -24,4 +24,4 @@ | ||
478 | void pty_release(const char *); | ||
479 | void pty_make_controlling_tty(int *, const char *); | ||
480 | void pty_change_window_size(int, u_int, u_int, u_int, u_int); | ||
481 | -void pty_setowner(struct passwd *, const char *); | ||
482 | +void pty_setowner(struct passwd *, const char *, const char *); | ||
diff --git a/debian/patches/series b/debian/patches/series new file mode 100644 index 000000000..2be7cf10a --- /dev/null +++ b/debian/patches/series | |||
@@ -0,0 +1,43 @@ | |||
1 | # GSSAPI | ||
2 | gssapi.patch | ||
3 | |||
4 | # SELinux | ||
5 | selinux-role.patch | ||
6 | |||
7 | # Key blacklisting | ||
8 | ssh-vulnkey.patch | ||
9 | |||
10 | # Keepalive handling | ||
11 | ssh1-keepalive.patch | ||
12 | keepalive-extensions.patch | ||
13 | |||
14 | # Message adjustments | ||
15 | syslog-level-silent.patch | ||
16 | quieter-signals.patch | ||
17 | helpful-wait-terminate.patch | ||
18 | |||
19 | # Miscellaneous bug fixes | ||
20 | user-group-modes.patch | ||
21 | scp-quoting.patch | ||
22 | shell-path.patch | ||
23 | dnssec-sshfp.patch | ||
24 | |||
25 | # Versioning | ||
26 | package-versioning.patch | ||
27 | debian-banner.patch | ||
28 | |||
29 | # File system layout | ||
30 | authorized-keys-man-symlink.patch | ||
31 | lintian-symlink-pickiness.patch | ||
32 | |||
33 | # Documentation | ||
34 | openbsd-docs.patch | ||
35 | ssh-argv0.patch | ||
36 | doc-hash-tab-completion.patch | ||
37 | |||
38 | # Miscellaneous bug fixes | ||
39 | auth-log-verbosity.patch | ||
40 | |||
41 | # Debian-specific configuration | ||
42 | gnome-ssh-askpass2-icon.patch | ||
43 | debian-config.patch | ||
diff --git a/debian/patches/shell-path.patch b/debian/patches/shell-path.patch new file mode 100644 index 000000000..8c549128b --- /dev/null +++ b/debian/patches/shell-path.patch | |||
@@ -0,0 +1,30 @@ | |||
1 | Description: Look for $SHELL on the path for ProxyCommand/LocalCommand | ||
2 | There's some debate on the upstream bug about whether POSIX requires this. | ||
3 | I (Colin Watson) agree with Vincent and think it does. | ||
4 | Author: Colin Watson <cjwatson@debian.org> | ||
5 | Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1494 | ||
6 | Bug-Debian: http://bugs.debian.org/492728 | ||
7 | Last-Update: 2010-02-27 | ||
8 | |||
9 | Index: b/sshconnect.c | ||
10 | =================================================================== | ||
11 | --- a/sshconnect.c | ||
12 | +++ b/sshconnect.c | ||
13 | @@ -144,7 +144,7 @@ | ||
14 | /* Execute the proxy command. Note that we gave up any | ||
15 | extra privileges above. */ | ||
16 | signal(SIGPIPE, SIG_DFL); | ||
17 | - execv(argv[0], argv); | ||
18 | + execvp(argv[0], argv); | ||
19 | perror(argv[0]); | ||
20 | exit(1); | ||
21 | } | ||
22 | @@ -1273,7 +1273,7 @@ | ||
23 | if (pid == 0) { | ||
24 | signal(SIGPIPE, SIG_DFL); | ||
25 | debug3("Executing %s -c \"%s\"", shell, args); | ||
26 | - execl(shell, shell, "-c", args, (char *)NULL); | ||
27 | + execlp(shell, shell, "-c", args, (char *)NULL); | ||
28 | error("Couldn't execute %s -c \"%s\": %s", | ||
29 | shell, args, strerror(errno)); | ||
30 | _exit(1); | ||
diff --git a/debian/patches/ssh-argv0.patch b/debian/patches/ssh-argv0.patch new file mode 100644 index 000000000..a7750ed23 --- /dev/null +++ b/debian/patches/ssh-argv0.patch | |||
@@ -0,0 +1,21 @@ | |||
1 | Description: ssh(1): Refer to ssh-argv0(1) | ||
2 | Old versions of OpenSSH (up to 2.5 or thereabouts) allowed creating | ||
3 | symlinks to ssh with the name of the host you want to connect to. Debian | ||
4 | ships an ssh-argv0 script restoring this feature; this patch refers to its | ||
5 | manual page from ssh(1). | ||
6 | Bug-Debian: http://bugs.debian.org/111341 | ||
7 | Forwarded: not-needed | ||
8 | Last-Update: 2010-02-28 | ||
9 | |||
10 | Index: b/ssh.1 | ||
11 | =================================================================== | ||
12 | --- a/ssh.1 | ||
13 | +++ b/ssh.1 | ||
14 | @@ -1411,6 +1411,7 @@ | ||
15 | .Xr sftp 1 , | ||
16 | .Xr ssh-add 1 , | ||
17 | .Xr ssh-agent 1 , | ||
18 | +.Xr ssh-argv0 1 , | ||
19 | .Xr ssh-keygen 1 , | ||
20 | .Xr ssh-keyscan 1 , | ||
21 | .Xr ssh-vulnkey 1 , | ||
diff --git a/debian/patches/ssh-vulnkey.patch b/debian/patches/ssh-vulnkey.patch new file mode 100644 index 000000000..4245319c3 --- /dev/null +++ b/debian/patches/ssh-vulnkey.patch | |||
@@ -0,0 +1,1382 @@ | |||
1 | Description: Reject vulnerable keys to mitigate Debian OpenSSL flaw | ||
2 | In 2008, Debian (and derived distributions such as Ubuntu) shipped an | ||
3 | OpenSSL package with a flawed random number generator, causing OpenSSH to | ||
4 | generate only a very limited set of keys which were subject to private half | ||
5 | precomputation. To mitigate this, this patch checks key authentications | ||
6 | against a blacklist of known-vulnerable keys, and adds a new ssh-vulnkey | ||
7 | program which can be used to explicitly check keys against that blacklist. | ||
8 | See CVE-2008-0166. | ||
9 | Author: Colin Watson <cjwatson@ubuntu.com> | ||
10 | Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1469 | ||
11 | Last-Update: 2010-02-27 | ||
12 | |||
13 | Index: b/Makefile.in | ||
14 | =================================================================== | ||
15 | --- a/Makefile.in | ||
16 | +++ b/Makefile.in | ||
17 | @@ -26,6 +26,7 @@ | ||
18 | SFTP_SERVER=$(libexecdir)/sftp-server | ||
19 | SSH_KEYSIGN=$(libexecdir)/ssh-keysign | ||
20 | SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper | ||
21 | +SSH_DATADIR=$(datadir)/ssh | ||
22 | PRIVSEP_PATH=@PRIVSEP_PATH@ | ||
23 | SSH_PRIVSEP_USER=@SSH_PRIVSEP_USER@ | ||
24 | STRIP_OPT=@STRIP_OPT@ | ||
25 | @@ -38,6 +39,7 @@ | ||
26 | -D_PATH_SSH_PKCS11_HELPER=\"$(SSH_PKCS11_HELPER)\" \ | ||
27 | -D_PATH_SSH_PIDDIR=\"$(piddir)\" \ | ||
28 | -D_PATH_PRIVSEP_CHROOT_DIR=\"$(PRIVSEP_PATH)\" \ | ||
29 | + -D_PATH_SSH_DATADIR=\"$(SSH_DATADIR)\" \ | ||
30 | |||
31 | CC=@CC@ | ||
32 | LD=@LD@ | ||
33 | @@ -59,7 +61,7 @@ | ||
34 | EXEEXT=@EXEEXT@ | ||
35 | MANFMT=@MANFMT@ | ||
36 | |||
37 | -TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) | ||
38 | +TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-vulnkey$(EXEEXT) | ||
39 | |||
40 | LIBSSH_OBJS=acss.o authfd.o authfile.o bufaux.o bufbn.o buffer.o \ | ||
41 | canohost.o channels.o cipher.o cipher-acss.o cipher-aes.o \ | ||
42 | @@ -93,8 +95,8 @@ | ||
43 | roaming_common.o roaming_serv.o \ | ||
44 | sandbox-null.o sandbox-rlimit.o sandbox-systrace.o sandbox-darwin.o | ||
45 | |||
46 | -MANPAGES = moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-keysign.8.out ssh-pkcs11-helper.8.out sshd_config.5.out ssh_config.5.out | ||
47 | -MANPAGES_IN = moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-keysign.8 ssh-pkcs11-helper.8 sshd_config.5 ssh_config.5 | ||
48 | +MANPAGES = moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-keysign.8.out ssh-pkcs11-helper.8.out ssh-vulnkey.1.out sshd_config.5.out ssh_config.5.out | ||
49 | +MANPAGES_IN = moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-keysign.8 ssh-pkcs11-helper.8 ssh-vulnkey.1 sshd_config.5 ssh_config.5 | ||
50 | MANTYPE = @MANTYPE@ | ||
51 | |||
52 | CONFIGFILES=sshd_config.out ssh_config.out moduli.out | ||
53 | @@ -171,6 +173,9 @@ | ||
54 | sftp$(EXEEXT): $(LIBCOMPAT) libssh.a sftp.o sftp-client.o sftp-common.o sftp-glob.o progressmeter.o | ||
55 | $(LD) -o $@ progressmeter.o sftp.o sftp-client.o sftp-common.o sftp-glob.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) $(LIBEDIT) | ||
56 | |||
57 | +ssh-vulnkey$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-vulnkey.o | ||
58 | + $(LD) -o $@ ssh-vulnkey.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) | ||
59 | + | ||
60 | # test driver for the loginrec code - not built by default | ||
61 | logintest: logintest.o $(LIBCOMPAT) libssh.a loginrec.o | ||
62 | $(LD) -o $@ logintest.o $(LDFLAGS) loginrec.o -lopenbsd-compat -lssh $(LIBS) | ||
63 | @@ -259,6 +264,7 @@ | ||
64 | $(INSTALL) -m 0755 $(STRIP_OPT) ssh-pkcs11-helper$(EXEEXT) $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT) | ||
65 | $(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT) | ||
66 | $(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT) | ||
67 | + $(INSTALL) -m 0755 $(STRIP_OPT) ssh-vulnkey$(EXEEXT) $(DESTDIR)$(bindir)/ssh-vulnkey$(EXEEXT) | ||
68 | $(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1 | ||
69 | $(INSTALL) -m 644 scp.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/scp.1 | ||
70 | $(INSTALL) -m 644 ssh-add.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-add.1 | ||
71 | @@ -273,6 +279,7 @@ | ||
72 | $(INSTALL) -m 644 sftp-server.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8 | ||
73 | $(INSTALL) -m 644 ssh-keysign.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8 | ||
74 | $(INSTALL) -m 644 ssh-pkcs11-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8 | ||
75 | + $(INSTALL) -m 644 ssh-vulnkey.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-vulnkey.1 | ||
76 | -rm -f $(DESTDIR)$(bindir)/slogin | ||
77 | ln -s ./ssh$(EXEEXT) $(DESTDIR)$(bindir)/slogin | ||
78 | -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/slogin.1 | ||
79 | @@ -354,6 +361,7 @@ | ||
80 | -rm -f $(DESTDIR)$(bindir)/ssh-agent$(EXEEXT) | ||
81 | -rm -f $(DESTDIR)$(bindir)/ssh-keygen$(EXEEXT) | ||
82 | -rm -f $(DESTDIR)$(bindir)/ssh-keyscan$(EXEEXT) | ||
83 | + -rm -f $(DESTDIR)$(bindir)/ssh-vulnkey$(EXEEXT) | ||
84 | -rm -f $(DESTDIR)$(bindir)/sftp$(EXEEXT) | ||
85 | -rm -f $(DESTDIR)$(sbindir)/sshd$(EXEEXT) | ||
86 | -rm -r $(DESTDIR)$(SFTP_SERVER)$(EXEEXT) | ||
87 | @@ -366,6 +374,7 @@ | ||
88 | -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-keygen.1 | ||
89 | -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/sftp.1 | ||
90 | -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-keyscan.1 | ||
91 | + -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-vulnkey.1 | ||
92 | -rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/sshd.8 | ||
93 | -rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8 | ||
94 | -rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8 | ||
95 | Index: b/auth-rh-rsa.c | ||
96 | =================================================================== | ||
97 | --- a/auth-rh-rsa.c | ||
98 | +++ b/auth-rh-rsa.c | ||
99 | @@ -44,7 +44,7 @@ | ||
100 | { | ||
101 | HostStatus host_status; | ||
102 | |||
103 | - if (auth_key_is_revoked(client_host_key)) | ||
104 | + if (auth_key_is_revoked(client_host_key, 0)) | ||
105 | return 0; | ||
106 | |||
107 | /* Check if we would accept it using rhosts authentication. */ | ||
108 | Index: b/auth-rsa.c | ||
109 | =================================================================== | ||
110 | --- a/auth-rsa.c | ||
111 | +++ b/auth-rsa.c | ||
112 | @@ -233,7 +233,7 @@ | ||
113 | file, linenum, BN_num_bits(key->rsa->n), bits); | ||
114 | |||
115 | /* Never accept a revoked key */ | ||
116 | - if (auth_key_is_revoked(key)) | ||
117 | + if (auth_key_is_revoked(key, 0)) | ||
118 | break; | ||
119 | |||
120 | /* We have found the desired key. */ | ||
121 | Index: b/auth.c | ||
122 | =================================================================== | ||
123 | --- a/auth.c | ||
124 | +++ b/auth.c | ||
125 | @@ -59,6 +59,7 @@ | ||
126 | #include "servconf.h" | ||
127 | #include "key.h" | ||
128 | #include "hostfile.h" | ||
129 | +#include "authfile.h" | ||
130 | #include "auth.h" | ||
131 | #include "auth-options.h" | ||
132 | #include "canohost.h" | ||
133 | @@ -606,10 +607,34 @@ | ||
134 | |||
135 | /* Returns 1 if key is revoked by revoked_keys_file, 0 otherwise */ | ||
136 | int | ||
137 | -auth_key_is_revoked(Key *key) | ||
138 | +auth_key_is_revoked(Key *key, int hostkey) | ||
139 | { | ||
140 | char *key_fp; | ||
141 | |||
142 | + if (blacklisted_key(key, &key_fp) == 1) { | ||
143 | + if (options.permit_blacklisted_keys) { | ||
144 | + if (hostkey) | ||
145 | + error("Host key %s blacklisted (see " | ||
146 | + "ssh-vulnkey(1)); continuing anyway", | ||
147 | + key_fp); | ||
148 | + else | ||
149 | + logit("Public key %s from %s blacklisted (see " | ||
150 | + "ssh-vulnkey(1)); continuing anyway", | ||
151 | + key_fp, get_remote_ipaddr()); | ||
152 | + xfree(key_fp); | ||
153 | + } else { | ||
154 | + if (hostkey) | ||
155 | + error("Host key %s blacklisted (see " | ||
156 | + "ssh-vulnkey(1))", key_fp); | ||
157 | + else | ||
158 | + logit("Public key %s from %s blacklisted (see " | ||
159 | + "ssh-vulnkey(1))", | ||
160 | + key_fp, get_remote_ipaddr()); | ||
161 | + xfree(key_fp); | ||
162 | + return 1; | ||
163 | + } | ||
164 | + } | ||
165 | + | ||
166 | if (options.revoked_keys_file == NULL) | ||
167 | return 0; | ||
168 | |||
169 | Index: b/auth.h | ||
170 | =================================================================== | ||
171 | --- a/auth.h | ||
172 | +++ b/auth.h | ||
173 | @@ -174,7 +174,7 @@ | ||
174 | |||
175 | FILE *auth_openkeyfile(const char *, struct passwd *, int); | ||
176 | FILE *auth_openprincipals(const char *, struct passwd *, int); | ||
177 | -int auth_key_is_revoked(Key *); | ||
178 | +int auth_key_is_revoked(Key *, int); | ||
179 | |||
180 | HostStatus | ||
181 | check_key_in_hostfiles(struct passwd *, Key *, const char *, | ||
182 | Index: b/auth2-hostbased.c | ||
183 | =================================================================== | ||
184 | --- a/auth2-hostbased.c | ||
185 | +++ b/auth2-hostbased.c | ||
186 | @@ -146,7 +146,7 @@ | ||
187 | int len; | ||
188 | char *fp; | ||
189 | |||
190 | - if (auth_key_is_revoked(key)) | ||
191 | + if (auth_key_is_revoked(key, 0)) | ||
192 | return 0; | ||
193 | |||
194 | resolvedname = get_canonical_hostname(options.use_dns); | ||
195 | Index: b/auth2-pubkey.c | ||
196 | =================================================================== | ||
197 | --- a/auth2-pubkey.c | ||
198 | +++ b/auth2-pubkey.c | ||
199 | @@ -439,9 +439,10 @@ | ||
200 | u_int success, i; | ||
201 | char *file; | ||
202 | |||
203 | - if (auth_key_is_revoked(key)) | ||
204 | + if (auth_key_is_revoked(key, 0)) | ||
205 | return 0; | ||
206 | - if (key_is_cert(key) && auth_key_is_revoked(key->cert->signature_key)) | ||
207 | + if (key_is_cert(key) && | ||
208 | + auth_key_is_revoked(key->cert->signature_key, 0)) | ||
209 | return 0; | ||
210 | |||
211 | success = user_cert_trusted_ca(pw, key); | ||
212 | Index: b/authfile.c | ||
213 | =================================================================== | ||
214 | --- a/authfile.c | ||
215 | +++ b/authfile.c | ||
216 | @@ -68,6 +68,7 @@ | ||
217 | #include "rsa.h" | ||
218 | #include "misc.h" | ||
219 | #include "atomicio.h" | ||
220 | +#include "pathnames.h" | ||
221 | |||
222 | #define MAX_KEY_FILE_SIZE (1024 * 1024) | ||
223 | |||
224 | @@ -944,3 +945,140 @@ | ||
225 | return ret; | ||
226 | } | ||
227 | |||
228 | +/* Scan a blacklist of known-vulnerable keys in blacklist_file. */ | ||
229 | +static int | ||
230 | +blacklisted_key_in_file(Key *key, const char *blacklist_file, char **fp) | ||
231 | +{ | ||
232 | + int fd = -1; | ||
233 | + char *dgst_hex = NULL; | ||
234 | + char *dgst_packed = NULL, *p; | ||
235 | + int i; | ||
236 | + size_t line_len; | ||
237 | + struct stat st; | ||
238 | + char buf[256]; | ||
239 | + off_t start, lower, upper; | ||
240 | + int ret = 0; | ||
241 | + | ||
242 | + debug("Checking blacklist file %s", blacklist_file); | ||
243 | + fd = open(blacklist_file, O_RDONLY); | ||
244 | + if (fd < 0) { | ||
245 | + ret = -1; | ||
246 | + goto out; | ||
247 | + } | ||
248 | + | ||
249 | + dgst_hex = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX); | ||
250 | + /* Remove all colons */ | ||
251 | + dgst_packed = xcalloc(1, strlen(dgst_hex) + 1); | ||
252 | + for (i = 0, p = dgst_packed; dgst_hex[i]; i++) | ||
253 | + if (dgst_hex[i] != ':') | ||
254 | + *p++ = dgst_hex[i]; | ||
255 | + /* Only compare least-significant 80 bits (to keep the blacklist | ||
256 | + * size down) | ||
257 | + */ | ||
258 | + line_len = strlen(dgst_packed + 12); | ||
259 | + if (line_len > 32) | ||
260 | + goto out; | ||
261 | + | ||
262 | + /* Skip leading comments */ | ||
263 | + start = 0; | ||
264 | + for (;;) { | ||
265 | + ssize_t r; | ||
266 | + char *newline; | ||
267 | + | ||
268 | + r = atomicio(read, fd, buf, sizeof(buf)); | ||
269 | + if (r <= 0) | ||
270 | + goto out; | ||
271 | + if (buf[0] != '#') | ||
272 | + break; | ||
273 | + | ||
274 | + newline = memchr(buf, '\n', sizeof(buf)); | ||
275 | + if (!newline) | ||
276 | + goto out; | ||
277 | + start += newline + 1 - buf; | ||
278 | + if (lseek(fd, start, SEEK_SET) < 0) | ||
279 | + goto out; | ||
280 | + } | ||
281 | + | ||
282 | + /* Initialise binary search record numbers */ | ||
283 | + if (fstat(fd, &st) < 0) | ||
284 | + goto out; | ||
285 | + lower = 0; | ||
286 | + upper = (st.st_size - start) / (line_len + 1); | ||
287 | + | ||
288 | + while (lower != upper) { | ||
289 | + off_t cur; | ||
290 | + int cmp; | ||
291 | + | ||
292 | + cur = lower + (upper - lower) / 2; | ||
293 | + | ||
294 | + /* Read this line and compare to digest; this is | ||
295 | + * overflow-safe since cur < max(off_t) / (line_len + 1) */ | ||
296 | + if (lseek(fd, start + cur * (line_len + 1), SEEK_SET) < 0) | ||
297 | + break; | ||
298 | + if (atomicio(read, fd, buf, line_len) != line_len) | ||
299 | + break; | ||
300 | + cmp = memcmp(buf, dgst_packed + 12, line_len); | ||
301 | + if (cmp < 0) { | ||
302 | + if (cur == lower) | ||
303 | + break; | ||
304 | + lower = cur; | ||
305 | + } else if (cmp > 0) { | ||
306 | + if (cur == upper) | ||
307 | + break; | ||
308 | + upper = cur; | ||
309 | + } else { | ||
310 | + debug("Found %s in blacklist", dgst_hex); | ||
311 | + ret = 1; | ||
312 | + break; | ||
313 | + } | ||
314 | + } | ||
315 | + | ||
316 | +out: | ||
317 | + if (dgst_packed) | ||
318 | + xfree(dgst_packed); | ||
319 | + if (ret != 1 && dgst_hex) { | ||
320 | + xfree(dgst_hex); | ||
321 | + dgst_hex = NULL; | ||
322 | + } | ||
323 | + if (fp) | ||
324 | + *fp = dgst_hex; | ||
325 | + if (fd >= 0) | ||
326 | + close(fd); | ||
327 | + return ret; | ||
328 | +} | ||
329 | + | ||
330 | +/* | ||
331 | + * Scan blacklists of known-vulnerable keys. If a vulnerable key is found, | ||
332 | + * its fingerprint is returned in *fp, unless fp is NULL. | ||
333 | + */ | ||
334 | +int | ||
335 | +blacklisted_key(Key *key, char **fp) | ||
336 | +{ | ||
337 | + Key *public; | ||
338 | + char *blacklist_file; | ||
339 | + int ret, ret2; | ||
340 | + | ||
341 | + public = key_demote(key); | ||
342 | + if (public->type == KEY_RSA1) | ||
343 | + public->type = KEY_RSA; | ||
344 | + | ||
345 | + xasprintf(&blacklist_file, "%s.%s-%u", | ||
346 | + _PATH_BLACKLIST, key_type(public), key_size(public)); | ||
347 | + ret = blacklisted_key_in_file(public, blacklist_file, fp); | ||
348 | + xfree(blacklist_file); | ||
349 | + if (ret > 0) { | ||
350 | + key_free(public); | ||
351 | + return ret; | ||
352 | + } | ||
353 | + | ||
354 | + xasprintf(&blacklist_file, "%s.%s-%u", | ||
355 | + _PATH_BLACKLIST_CONFIG, key_type(public), key_size(public)); | ||
356 | + ret2 = blacklisted_key_in_file(public, blacklist_file, fp); | ||
357 | + xfree(blacklist_file); | ||
358 | + if (ret2 > ret) | ||
359 | + ret = ret2; | ||
360 | + | ||
361 | + key_free(public); | ||
362 | + return ret; | ||
363 | +} | ||
364 | + | ||
365 | Index: b/authfile.h | ||
366 | =================================================================== | ||
367 | --- a/authfile.h | ||
368 | +++ b/authfile.h | ||
369 | @@ -28,4 +28,6 @@ | ||
370 | int key_perm_ok(int, const char *); | ||
371 | int key_in_file(Key *, const char *, int); | ||
372 | |||
373 | +int blacklisted_key(Key *key, char **fp); | ||
374 | + | ||
375 | #endif | ||
376 | Index: b/pathnames.h | ||
377 | =================================================================== | ||
378 | --- a/pathnames.h | ||
379 | +++ b/pathnames.h | ||
380 | @@ -18,6 +18,10 @@ | ||
381 | #define SSHDIR ETCDIR "/ssh" | ||
382 | #endif | ||
383 | |||
384 | +#ifndef _PATH_SSH_DATADIR | ||
385 | +#define _PATH_SSH_DATADIR "/usr/share/ssh" | ||
386 | +#endif | ||
387 | + | ||
388 | #ifndef _PATH_SSH_PIDDIR | ||
389 | #define _PATH_SSH_PIDDIR "/var/run" | ||
390 | #endif | ||
391 | @@ -44,6 +48,9 @@ | ||
392 | /* Backwards compatibility */ | ||
393 | #define _PATH_DH_PRIMES SSHDIR "/primes" | ||
394 | |||
395 | +#define _PATH_BLACKLIST _PATH_SSH_DATADIR "/blacklist" | ||
396 | +#define _PATH_BLACKLIST_CONFIG SSHDIR "/blacklist" | ||
397 | + | ||
398 | #ifndef _PATH_SSH_PROGRAM | ||
399 | #define _PATH_SSH_PROGRAM "/usr/bin/ssh" | ||
400 | #endif | ||
401 | Index: b/readconf.c | ||
402 | =================================================================== | ||
403 | --- a/readconf.c | ||
404 | +++ b/readconf.c | ||
405 | @@ -125,6 +125,7 @@ | ||
406 | oGlobalKnownHostsFile2, oUserKnownHostsFile2, oPubkeyAuthentication, | ||
407 | oKbdInteractiveAuthentication, oKbdInteractiveDevices, oHostKeyAlias, | ||
408 | oDynamicForward, oPreferredAuthentications, oHostbasedAuthentication, | ||
409 | + oUseBlacklistedKeys, | ||
410 | oHostKeyAlgorithms, oBindAddress, oPKCS11Provider, | ||
411 | oClearAllForwardings, oNoHostAuthenticationForLocalhost, | ||
412 | oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout, | ||
413 | @@ -158,6 +159,7 @@ | ||
414 | { "passwordauthentication", oPasswordAuthentication }, | ||
415 | { "kbdinteractiveauthentication", oKbdInteractiveAuthentication }, | ||
416 | { "kbdinteractivedevices", oKbdInteractiveDevices }, | ||
417 | + { "useblacklistedkeys", oUseBlacklistedKeys }, | ||
418 | { "rsaauthentication", oRSAAuthentication }, | ||
419 | { "pubkeyauthentication", oPubkeyAuthentication }, | ||
420 | { "dsaauthentication", oPubkeyAuthentication }, /* alias */ | ||
421 | @@ -489,6 +491,10 @@ | ||
422 | intptr = &options->challenge_response_authentication; | ||
423 | goto parse_flag; | ||
424 | |||
425 | + case oUseBlacklistedKeys: | ||
426 | + intptr = &options->use_blacklisted_keys; | ||
427 | + goto parse_flag; | ||
428 | + | ||
429 | case oGssAuthentication: | ||
430 | intptr = &options->gss_authentication; | ||
431 | goto parse_flag; | ||
432 | @@ -1180,6 +1186,7 @@ | ||
433 | options->kbd_interactive_devices = NULL; | ||
434 | options->rhosts_rsa_authentication = -1; | ||
435 | options->hostbased_authentication = -1; | ||
436 | + options->use_blacklisted_keys = -1; | ||
437 | options->batch_mode = -1; | ||
438 | options->check_host_ip = -1; | ||
439 | options->strict_host_key_checking = -1; | ||
440 | @@ -1290,6 +1297,8 @@ | ||
441 | options->rhosts_rsa_authentication = 0; | ||
442 | if (options->hostbased_authentication == -1) | ||
443 | options->hostbased_authentication = 0; | ||
444 | + if (options->use_blacklisted_keys == -1) | ||
445 | + options->use_blacklisted_keys = 0; | ||
446 | if (options->batch_mode == -1) | ||
447 | options->batch_mode = 0; | ||
448 | if (options->check_host_ip == -1) | ||
449 | Index: b/readconf.h | ||
450 | =================================================================== | ||
451 | --- a/readconf.h | ||
452 | +++ b/readconf.h | ||
453 | @@ -58,6 +58,7 @@ | ||
454 | int kbd_interactive_authentication; /* Try keyboard-interactive auth. */ | ||
455 | char *kbd_interactive_devices; /* Keyboard-interactive auth devices. */ | ||
456 | int zero_knowledge_password_authentication; /* Try jpake */ | ||
457 | + int use_blacklisted_keys; /* If true, send */ | ||
458 | int batch_mode; /* Batch mode: do not ask for passwords. */ | ||
459 | int check_host_ip; /* Also keep track of keys for IP address */ | ||
460 | int strict_host_key_checking; /* Strict host key checking. */ | ||
461 | Index: b/servconf.c | ||
462 | =================================================================== | ||
463 | --- a/servconf.c | ||
464 | +++ b/servconf.c | ||
465 | @@ -104,6 +104,7 @@ | ||
466 | options->password_authentication = -1; | ||
467 | options->kbd_interactive_authentication = -1; | ||
468 | options->challenge_response_authentication = -1; | ||
469 | + options->permit_blacklisted_keys = -1; | ||
470 | options->permit_empty_passwd = -1; | ||
471 | options->permit_user_env = -1; | ||
472 | options->use_login = -1; | ||
473 | @@ -242,6 +243,8 @@ | ||
474 | options->kbd_interactive_authentication = 0; | ||
475 | if (options->challenge_response_authentication == -1) | ||
476 | options->challenge_response_authentication = 1; | ||
477 | + if (options->permit_blacklisted_keys == -1) | ||
478 | + options->permit_blacklisted_keys = 0; | ||
479 | if (options->permit_empty_passwd == -1) | ||
480 | options->permit_empty_passwd = 0; | ||
481 | if (options->permit_user_env == -1) | ||
482 | @@ -318,7 +321,7 @@ | ||
483 | sListenAddress, sAddressFamily, | ||
484 | sPrintMotd, sPrintLastLog, sIgnoreRhosts, | ||
485 | sX11Forwarding, sX11DisplayOffset, sX11UseLocalhost, | ||
486 | - sStrictModes, sEmptyPasswd, sTCPKeepAlive, | ||
487 | + sStrictModes, sPermitBlacklistedKeys, sEmptyPasswd, sTCPKeepAlive, | ||
488 | sPermitUserEnvironment, sUseLogin, sAllowTcpForwarding, sCompression, | ||
489 | sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups, | ||
490 | sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile, | ||
491 | @@ -428,6 +431,7 @@ | ||
492 | { "x11uselocalhost", sX11UseLocalhost, SSHCFG_ALL }, | ||
493 | { "xauthlocation", sXAuthLocation, SSHCFG_GLOBAL }, | ||
494 | { "strictmodes", sStrictModes, SSHCFG_GLOBAL }, | ||
495 | + { "permitblacklistedkeys", sPermitBlacklistedKeys, SSHCFG_GLOBAL }, | ||
496 | { "permitemptypasswords", sEmptyPasswd, SSHCFG_ALL }, | ||
497 | { "permituserenvironment", sPermitUserEnvironment, SSHCFG_GLOBAL }, | ||
498 | { "uselogin", sUseLogin, SSHCFG_GLOBAL }, | ||
499 | @@ -1047,6 +1051,10 @@ | ||
500 | intptr = &options->tcp_keep_alive; | ||
501 | goto parse_flag; | ||
502 | |||
503 | + case sPermitBlacklistedKeys: | ||
504 | + intptr = &options->permit_blacklisted_keys; | ||
505 | + goto parse_flag; | ||
506 | + | ||
507 | case sEmptyPasswd: | ||
508 | intptr = &options->permit_empty_passwd; | ||
509 | goto parse_flag; | ||
510 | @@ -1773,6 +1781,7 @@ | ||
511 | dump_cfg_fmtint(sX11UseLocalhost, o->x11_use_localhost); | ||
512 | dump_cfg_fmtint(sStrictModes, o->strict_modes); | ||
513 | dump_cfg_fmtint(sTCPKeepAlive, o->tcp_keep_alive); | ||
514 | + dump_cfg_fmtint(sPermitBlacklistedKeys, o->permit_blacklisted_keys); | ||
515 | dump_cfg_fmtint(sEmptyPasswd, o->permit_empty_passwd); | ||
516 | dump_cfg_fmtint(sPermitUserEnvironment, o->permit_user_env); | ||
517 | dump_cfg_fmtint(sUseLogin, o->use_login); | ||
518 | Index: b/servconf.h | ||
519 | =================================================================== | ||
520 | --- a/servconf.h | ||
521 | +++ b/servconf.h | ||
522 | @@ -113,6 +113,7 @@ | ||
523 | int challenge_response_authentication; | ||
524 | int zero_knowledge_password_authentication; | ||
525 | /* If true, permit jpake auth */ | ||
526 | + int permit_blacklisted_keys; /* If true, permit */ | ||
527 | int permit_empty_passwd; /* If false, do not permit empty | ||
528 | * passwords. */ | ||
529 | int permit_user_env; /* If true, read ~/.ssh/environment */ | ||
530 | Index: b/ssh-add.1 | ||
531 | =================================================================== | ||
532 | --- a/ssh-add.1 | ||
533 | +++ b/ssh-add.1 | ||
534 | @@ -81,6 +81,10 @@ | ||
535 | .Nm | ||
536 | to work. | ||
537 | .Pp | ||
538 | +Any keys recorded in the blacklist of known-compromised keys (see | ||
539 | +.Xr ssh-vulnkey 1 ) | ||
540 | +will be refused. | ||
541 | +.Pp | ||
542 | The options are as follows: | ||
543 | .Bl -tag -width Ds | ||
544 | .It Fl c | ||
545 | @@ -183,6 +187,7 @@ | ||
546 | .Xr ssh 1 , | ||
547 | .Xr ssh-agent 1 , | ||
548 | .Xr ssh-keygen 1 , | ||
549 | +.Xr ssh-vulnkey 1 , | ||
550 | .Xr sshd 8 | ||
551 | .Sh AUTHORS | ||
552 | OpenSSH is a derivative of the original and free | ||
553 | Index: b/ssh-add.c | ||
554 | =================================================================== | ||
555 | --- a/ssh-add.c | ||
556 | +++ b/ssh-add.c | ||
557 | @@ -142,7 +142,7 @@ | ||
558 | add_file(AuthenticationConnection *ac, const char *filename) | ||
559 | { | ||
560 | Key *private, *cert; | ||
561 | - char *comment = NULL; | ||
562 | + char *comment = NULL, *fp; | ||
563 | char msg[1024], *certpath; | ||
564 | int fd, perms_ok, ret = -1; | ||
565 | Buffer keyblob; | ||
566 | @@ -218,6 +218,14 @@ | ||
567 | } else { | ||
568 | fprintf(stderr, "Could not add identity: %s\n", filename); | ||
569 | } | ||
570 | + if (blacklisted_key(private, &fp) == 1) { | ||
571 | + fprintf(stderr, "Public key %s blacklisted (see " | ||
572 | + "ssh-vulnkey(1)); refusing to add it\n", fp); | ||
573 | + xfree(fp); | ||
574 | + key_free(private); | ||
575 | + xfree(comment); | ||
576 | + return -1; | ||
577 | + } | ||
578 | |||
579 | |||
580 | /* Now try to add the certificate flavour too */ | ||
581 | Index: b/ssh-keygen.1 | ||
582 | =================================================================== | ||
583 | --- a/ssh-keygen.1 | ||
584 | +++ b/ssh-keygen.1 | ||
585 | @@ -670,6 +670,7 @@ | ||
586 | .Xr ssh 1 , | ||
587 | .Xr ssh-add 1 , | ||
588 | .Xr ssh-agent 1 , | ||
589 | +.Xr ssh-vulnkey 1 , | ||
590 | .Xr moduli 5 , | ||
591 | .Xr sshd 8 | ||
592 | .Rs | ||
593 | Index: b/ssh-vulnkey.1 | ||
594 | =================================================================== | ||
595 | --- /dev/null | ||
596 | +++ b/ssh-vulnkey.1 | ||
597 | @@ -0,0 +1,242 @@ | ||
598 | +.\" Copyright (c) 2008 Canonical Ltd. All rights reserved. | ||
599 | +.\" | ||
600 | +.\" Redistribution and use in source and binary forms, with or without | ||
601 | +.\" modification, are permitted provided that the following conditions | ||
602 | +.\" are met: | ||
603 | +.\" 1. Redistributions of source code must retain the above copyright | ||
604 | +.\" notice, this list of conditions and the following disclaimer. | ||
605 | +.\" 2. Redistributions in binary form must reproduce the above copyright | ||
606 | +.\" notice, this list of conditions and the following disclaimer in the | ||
607 | +.\" documentation and/or other materials provided with the distribution. | ||
608 | +.\" | ||
609 | +.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR | ||
610 | +.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES | ||
611 | +.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. | ||
612 | +.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, | ||
613 | +.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT | ||
614 | +.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, | ||
615 | +.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY | ||
616 | +.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT | ||
617 | +.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF | ||
618 | +.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | ||
619 | +.\" | ||
620 | +.Dd $Mdocdate: May 12 2008 $ | ||
621 | +.Dt SSH-VULNKEY 1 | ||
622 | +.Os | ||
623 | +.Sh NAME | ||
624 | +.Nm ssh-vulnkey | ||
625 | +.Nd check blacklist of compromised keys | ||
626 | +.Sh SYNOPSIS | ||
627 | +.Nm | ||
628 | +.Op Fl q | Fl v | ||
629 | +.Ar file ... | ||
630 | +.Nm | ||
631 | +.Fl a | ||
632 | +.Sh DESCRIPTION | ||
633 | +.Nm | ||
634 | +checks a key against a blacklist of compromised keys. | ||
635 | +.Pp | ||
636 | +A substantial number of keys are known to have been generated using a broken | ||
637 | +version of OpenSSL distributed by Debian which failed to seed its random | ||
638 | +number generator correctly. | ||
639 | +Keys generated using these OpenSSL versions should be assumed to be | ||
640 | +compromised. | ||
641 | +This tool may be useful in checking for such keys. | ||
642 | +.Pp | ||
643 | +Keys that are compromised cannot be repaired; replacements must be generated | ||
644 | +using | ||
645 | +.Xr ssh-keygen 1 . | ||
646 | +Make sure to update | ||
647 | +.Pa authorized_keys | ||
648 | +files on all systems where compromised keys were permitted to authenticate. | ||
649 | +.Pp | ||
650 | +The argument list will be interpreted as a list of paths to public key files | ||
651 | +or | ||
652 | +.Pa authorized_keys | ||
653 | +files. | ||
654 | +If no suitable file is found at a given path, | ||
655 | +.Nm | ||
656 | +will append | ||
657 | +.Pa .pub | ||
658 | +and retry, in case it was given a private key file. | ||
659 | +If no files are given as arguments, | ||
660 | +.Nm | ||
661 | +will check | ||
662 | +.Pa ~/.ssh/id_rsa , | ||
663 | +.Pa ~/.ssh/id_dsa , | ||
664 | +.Pa ~/.ssh/identity , | ||
665 | +.Pa ~/.ssh/authorized_keys | ||
666 | +and | ||
667 | +.Pa ~/.ssh/authorized_keys2 , | ||
668 | +as well as the system's host keys if readable. | ||
669 | +.Pp | ||
670 | +If | ||
671 | +.Dq - | ||
672 | +is given as an argument, | ||
673 | +.Nm | ||
674 | +will read from standard input. | ||
675 | +This can be used to process output from | ||
676 | +.Xr ssh-keyscan 1 , | ||
677 | +for example: | ||
678 | +.Pp | ||
679 | +.Dl $ ssh-keyscan -t rsa remote.example.org | ssh-vulnkey - | ||
680 | +.Pp | ||
681 | +Unless the | ||
682 | +.Cm PermitBlacklistedKeys | ||
683 | +option is used, | ||
684 | +.Xr sshd 8 | ||
685 | +will reject attempts to authenticate with keys in the compromised list. | ||
686 | +.Pp | ||
687 | +The output from | ||
688 | +.Nm | ||
689 | +looks like this: | ||
690 | +.Pp | ||
691 | +.Bd -literal -offset indent | ||
692 | +/etc/ssh/ssh_host_key:1: COMPROMISED: RSA1 2048 xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx root@host | ||
693 | +/home/user/.ssh/id_dsa:1: Not blacklisted: DSA 1024 xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx /home/user/.ssh/id_dsa.pub | ||
694 | +/home/user/.ssh/authorized_keys:3: Unknown (blacklist file not installed): RSA 1024 xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx user@host | ||
695 | +.Ed | ||
696 | +.Pp | ||
697 | +Each line is of the following format (any lines beginning with | ||
698 | +.Dq # | ||
699 | +should be ignored by scripts): | ||
700 | +.Pp | ||
701 | +.Dl Ar filename : Ns Ar line : Ar status : Ar type Ar size Ar fingerprint Ar comment | ||
702 | +.Pp | ||
703 | +It is important to distinguish between the possible values of | ||
704 | +.Ar status : | ||
705 | +.Pp | ||
706 | +.Bl -tag -width Ds | ||
707 | +.It COMPROMISED | ||
708 | +These keys are listed in a blacklist file, normally because their | ||
709 | +corresponding private keys are well-known. | ||
710 | +Replacements must be generated using | ||
711 | +.Xr ssh-keygen 1 . | ||
712 | +.It Not blacklisted | ||
713 | +A blacklist file exists for this key type and size, but this key is not | ||
714 | +listed in it. | ||
715 | +Unless there is some particular reason to believe otherwise, this key | ||
716 | +may be used safely. | ||
717 | +(Note that DSA keys used with the broken version of OpenSSL distributed | ||
718 | +by Debian may be compromised in the event that anyone captured a network | ||
719 | +trace, even if they were generated with a secure version of OpenSSL.) | ||
720 | +.It Unknown (blacklist file not installed) | ||
721 | +No blacklist file exists for this key type and size. | ||
722 | +You should find a suitable published blacklist and install it before | ||
723 | +deciding whether this key is safe to use. | ||
724 | +.El | ||
725 | +.Pp | ||
726 | +The options are as follows: | ||
727 | +.Bl -tag -width Ds | ||
728 | +.It Fl a | ||
729 | +Check keys of all users on the system. | ||
730 | +You will typically need to run | ||
731 | +.Nm | ||
732 | +as root to use this option. | ||
733 | +For each user, | ||
734 | +.Nm | ||
735 | +will check | ||
736 | +.Pa ~/.ssh/id_rsa , | ||
737 | +.Pa ~/.ssh/id_dsa , | ||
738 | +.Pa ~/.ssh/identity , | ||
739 | +.Pa ~/.ssh/authorized_keys | ||
740 | +and | ||
741 | +.Pa ~/.ssh/authorized_keys2 . | ||
742 | +It will also check the system's host keys. | ||
743 | +.It Fl q | ||
744 | +Quiet mode. | ||
745 | +Normally, | ||
746 | +.Nm | ||
747 | +outputs the fingerprint of each key scanned, with a description of its | ||
748 | +status. | ||
749 | +This option suppresses that output. | ||
750 | +.It Fl v | ||
751 | +Verbose mode. | ||
752 | +Normally, | ||
753 | +.Nm | ||
754 | +does not output anything for keys that are not listed in their corresponding | ||
755 | +blacklist file (although it still produces output for keys for which there | ||
756 | +is no blacklist file, since their status is unknown). | ||
757 | +This option causes | ||
758 | +.Nm | ||
759 | +to produce output for all keys. | ||
760 | +.El | ||
761 | +.Sh EXIT STATUS | ||
762 | +.Nm | ||
763 | +will exit zero if any of the given keys were in the compromised list, | ||
764 | +otherwise non-zero. | ||
765 | +.Sh BLACKLIST FILE FORMAT | ||
766 | +The blacklist file may start with comments, on lines starting with | ||
767 | +.Dq # . | ||
768 | +After these initial comments, it must follow a strict format: | ||
769 | +.Pp | ||
770 | +.Bl -bullet -offset indent -compact | ||
771 | +.It | ||
772 | +All the lines must be exactly the same length (20 characters followed by a | ||
773 | +newline) and must be in sorted order. | ||
774 | +.It | ||
775 | +Each line must consist of the lower-case hexadecimal MD5 key fingerprint, | ||
776 | +without colons, and with the first 12 characters removed (that is, the least | ||
777 | +significant 80 bits of the fingerprint). | ||
778 | +.El | ||
779 | +.Pp | ||
780 | +The key fingerprint may be generated using | ||
781 | +.Xr ssh-keygen 1 : | ||
782 | +.Pp | ||
783 | +.Dl $ ssh-keygen -l -f /path/to/key | ||
784 | +.Pp | ||
785 | +This strict format is necessary to allow the blacklist file to be checked | ||
786 | +quickly, using a binary-search algorithm. | ||
787 | +.Sh FILES | ||
788 | +.Bl -tag -width Ds | ||
789 | +.It Pa ~/.ssh/id_rsa | ||
790 | +If present, contains the protocol version 2 RSA authentication identity of | ||
791 | +the user. | ||
792 | +.It Pa ~/.ssh/id_dsa | ||
793 | +If present, contains the protocol version 2 DSA authentication identity of | ||
794 | +the user. | ||
795 | +.It Pa ~/.ssh/identity | ||
796 | +If present, contains the protocol version 1 RSA authentication identity of | ||
797 | +the user. | ||
798 | +.It Pa ~/.ssh/authorized_keys | ||
799 | +If present, lists the public keys (RSA/DSA) that can be used for logging in | ||
800 | +as this user. | ||
801 | +.It Pa ~/.ssh/authorized_keys2 | ||
802 | +Obsolete name for | ||
803 | +.Pa ~/.ssh/authorized_keys . | ||
804 | +This file may still be present on some old systems, but should not be | ||
805 | +created if it is missing. | ||
806 | +.It Pa /etc/ssh/ssh_host_rsa_key | ||
807 | +If present, contains the protocol version 2 RSA identity of the system. | ||
808 | +.It Pa /etc/ssh/ssh_host_dsa_key | ||
809 | +If present, contains the protocol version 2 DSA identity of the system. | ||
810 | +.It Pa /etc/ssh/ssh_host_key | ||
811 | +If present, contains the protocol version 1 RSA identity of the system. | ||
812 | +.It Pa /usr/share/ssh/blacklist. Ns Ar TYPE Ns Pa - Ns Ar LENGTH | ||
813 | +If present, lists the blacklisted keys of type | ||
814 | +.Ar TYPE | ||
815 | +.Pf ( Dq RSA | ||
816 | +or | ||
817 | +.Dq DSA ) | ||
818 | +and bit length | ||
819 | +.Ar LENGTH . | ||
820 | +The format of this file is described above. | ||
821 | +RSA1 keys are converted to RSA before being checked in the blacklist. | ||
822 | +Note that the fingerprints of RSA1 keys are computed differently, so you | ||
823 | +will not be able to find them in the blacklist by hand. | ||
824 | +.It Pa /etc/ssh/blacklist. Ns Ar TYPE Ns Pa - Ns Ar LENGTH | ||
825 | +Same as | ||
826 | +.Pa /usr/share/ssh/blacklist. Ns Ar TYPE Ns Pa - Ns Ar LENGTH , | ||
827 | +but may be edited by the system administrator to add new blacklist entries. | ||
828 | +.El | ||
829 | +.Sh SEE ALSO | ||
830 | +.Xr ssh-keygen 1 , | ||
831 | +.Xr sshd 8 | ||
832 | +.Sh AUTHORS | ||
833 | +.An -nosplit | ||
834 | +.An Colin Watson Aq cjwatson@ubuntu.com | ||
835 | +.Pp | ||
836 | +Florian Weimer suggested the option to check keys of all users, and the idea | ||
837 | +of processing | ||
838 | +.Xr ssh-keyscan 1 | ||
839 | +output. | ||
840 | Index: b/ssh-vulnkey.c | ||
841 | =================================================================== | ||
842 | --- /dev/null | ||
843 | +++ b/ssh-vulnkey.c | ||
844 | @@ -0,0 +1,387 @@ | ||
845 | +/* | ||
846 | + * Copyright (c) 2008 Canonical Ltd. All rights reserved. | ||
847 | + * | ||
848 | + * Redistribution and use in source and binary forms, with or without | ||
849 | + * modification, are permitted provided that the following conditions | ||
850 | + * are met: | ||
851 | + * 1. Redistributions of source code must retain the above copyright | ||
852 | + * notice, this list of conditions and the following disclaimer. | ||
853 | + * 2. Redistributions in binary form must reproduce the above copyright | ||
854 | + * notice, this list of conditions and the following disclaimer in the | ||
855 | + * documentation and/or other materials provided with the distribution. | ||
856 | + * | ||
857 | + * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR | ||
858 | + * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES | ||
859 | + * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. | ||
860 | + * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, | ||
861 | + * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT | ||
862 | + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, | ||
863 | + * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY | ||
864 | + * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT | ||
865 | + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF | ||
866 | + * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | ||
867 | + */ | ||
868 | + | ||
869 | +#include "includes.h" | ||
870 | + | ||
871 | +#include <sys/types.h> | ||
872 | +#include <sys/stat.h> | ||
873 | + | ||
874 | +#include <errno.h> | ||
875 | +#include <string.h> | ||
876 | +#include <stdio.h> | ||
877 | +#include <fcntl.h> | ||
878 | +#include <unistd.h> | ||
879 | + | ||
880 | +#include <openssl/evp.h> | ||
881 | + | ||
882 | +#include "xmalloc.h" | ||
883 | +#include "ssh.h" | ||
884 | +#include "log.h" | ||
885 | +#include "key.h" | ||
886 | +#include "authfile.h" | ||
887 | +#include "pathnames.h" | ||
888 | +#include "uidswap.h" | ||
889 | +#include "misc.h" | ||
890 | + | ||
891 | +extern char *__progname; | ||
892 | + | ||
893 | +/* Default files to check */ | ||
894 | +static char *default_host_files[] = { | ||
895 | + _PATH_HOST_RSA_KEY_FILE, | ||
896 | + _PATH_HOST_DSA_KEY_FILE, | ||
897 | + _PATH_HOST_KEY_FILE, | ||
898 | + NULL | ||
899 | +}; | ||
900 | +static char *default_files[] = { | ||
901 | + _PATH_SSH_CLIENT_ID_RSA, | ||
902 | + _PATH_SSH_CLIENT_ID_DSA, | ||
903 | + _PATH_SSH_CLIENT_IDENTITY, | ||
904 | + _PATH_SSH_USER_PERMITTED_KEYS, | ||
905 | + _PATH_SSH_USER_PERMITTED_KEYS2, | ||
906 | + NULL | ||
907 | +}; | ||
908 | + | ||
909 | +static int verbosity = 0; | ||
910 | + | ||
911 | +static int some_keys = 0; | ||
912 | +static int some_unknown = 0; | ||
913 | +static int some_compromised = 0; | ||
914 | + | ||
915 | +static void | ||
916 | +usage(void) | ||
917 | +{ | ||
918 | + fprintf(stderr, "usage: %s [-aqv] [file ...]\n", __progname); | ||
919 | + fprintf(stderr, "Options:\n"); | ||
920 | + fprintf(stderr, " -a Check keys of all users.\n"); | ||
921 | + fprintf(stderr, " -q Quiet mode.\n"); | ||
922 | + fprintf(stderr, " -v Verbose mode.\n"); | ||
923 | + exit(1); | ||
924 | +} | ||
925 | + | ||
926 | +static void | ||
927 | +describe_key(const char *filename, u_long linenum, const char *msg, | ||
928 | + Key *key, const char *comment, int min_verbosity) | ||
929 | +{ | ||
930 | + char *fp; | ||
931 | + | ||
932 | + fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX); | ||
933 | + if (verbosity >= min_verbosity) { | ||
934 | + if (strchr(filename, ':')) | ||
935 | + printf("\"%s\"", filename); | ||
936 | + else | ||
937 | + printf("%s", filename); | ||
938 | + printf(":%lu: %s: %s %u %s %s\n", linenum, msg, | ||
939 | + key_type(key), key_size(key), fp, comment); | ||
940 | + } | ||
941 | + xfree(fp); | ||
942 | +} | ||
943 | + | ||
944 | +static int | ||
945 | +do_key(const char *filename, u_long linenum, | ||
946 | + Key *key, const char *comment) | ||
947 | +{ | ||
948 | + Key *public; | ||
949 | + int blacklist_status; | ||
950 | + int ret = 1; | ||
951 | + | ||
952 | + some_keys = 1; | ||
953 | + | ||
954 | + public = key_demote(key); | ||
955 | + if (public->type == KEY_RSA1) | ||
956 | + public->type = KEY_RSA; | ||
957 | + | ||
958 | + blacklist_status = blacklisted_key(public, NULL); | ||
959 | + if (blacklist_status == -1) { | ||
960 | + describe_key(filename, linenum, | ||
961 | + "Unknown (blacklist file not installed)", key, comment, 0); | ||
962 | + some_unknown = 1; | ||
963 | + } else if (blacklist_status == 1) { | ||
964 | + describe_key(filename, linenum, | ||
965 | + "COMPROMISED", key, comment, 0); | ||
966 | + some_compromised = 1; | ||
967 | + ret = 0; | ||
968 | + } else | ||
969 | + describe_key(filename, linenum, | ||
970 | + "Not blacklisted", key, comment, 1); | ||
971 | + | ||
972 | + key_free(public); | ||
973 | + | ||
974 | + return ret; | ||
975 | +} | ||
976 | + | ||
977 | +static int | ||
978 | +do_filename(const char *filename, int quiet_open) | ||
979 | +{ | ||
980 | + FILE *f; | ||
981 | + char line[SSH_MAX_PUBKEY_BYTES]; | ||
982 | + char *cp; | ||
983 | + u_long linenum = 0; | ||
984 | + Key *key; | ||
985 | + char *comment = NULL; | ||
986 | + int found = 0, ret = 1; | ||
987 | + | ||
988 | + /* Copy much of key_load_public's logic here so that we can read | ||
989 | + * several keys from a single file (e.g. authorized_keys). | ||
990 | + */ | ||
991 | + | ||
992 | + if (strcmp(filename, "-") != 0) { | ||
993 | + int save_errno; | ||
994 | + f = fopen(filename, "r"); | ||
995 | + save_errno = errno; | ||
996 | + if (!f) { | ||
997 | + char pubfile[MAXPATHLEN]; | ||
998 | + if (strlcpy(pubfile, filename, sizeof pubfile) < | ||
999 | + sizeof(pubfile) && | ||
1000 | + strlcat(pubfile, ".pub", sizeof pubfile) < | ||
1001 | + sizeof(pubfile)) | ||
1002 | + f = fopen(pubfile, "r"); | ||
1003 | + } | ||
1004 | + errno = save_errno; /* earlier errno is more useful */ | ||
1005 | + if (!f) { | ||
1006 | + if (!quiet_open) | ||
1007 | + perror(filename); | ||
1008 | + return -1; | ||
1009 | + } | ||
1010 | + if (verbosity > 0) | ||
1011 | + printf("# %s\n", filename); | ||
1012 | + } else | ||
1013 | + f = stdin; | ||
1014 | + while (read_keyfile_line(f, filename, line, sizeof(line), | ||
1015 | + &linenum) != -1) { | ||
1016 | + int i; | ||
1017 | + char *space; | ||
1018 | + int type; | ||
1019 | + char *end; | ||
1020 | + | ||
1021 | + /* Chop trailing newline. */ | ||
1022 | + i = strlen(line) - 1; | ||
1023 | + if (line[i] == '\n') | ||
1024 | + line[i] = '\0'; | ||
1025 | + | ||
1026 | + /* Skip leading whitespace, empty and comment lines. */ | ||
1027 | + for (cp = line; *cp == ' ' || *cp == '\t'; cp++) | ||
1028 | + ; | ||
1029 | + if (!*cp || *cp == '\n' || *cp == '#') | ||
1030 | + continue; | ||
1031 | + | ||
1032 | + /* Cope with ssh-keyscan output and options in | ||
1033 | + * authorized_keys files. | ||
1034 | + */ | ||
1035 | + space = strchr(cp, ' '); | ||
1036 | + if (!space) | ||
1037 | + continue; | ||
1038 | + *space = '\0'; | ||
1039 | + type = key_type_from_name(cp); | ||
1040 | + *space = ' '; | ||
1041 | + /* Leading number (RSA1) or valid type (RSA/DSA) indicates | ||
1042 | + * that we have no host name or options to skip. | ||
1043 | + */ | ||
1044 | + if ((strtol(cp, &end, 10) == 0 || *end != ' ') && | ||
1045 | + type == KEY_UNSPEC) { | ||
1046 | + int quoted = 0; | ||
1047 | + | ||
1048 | + for (; *cp && (quoted || (*cp != ' ' && *cp != '\t')); cp++) { | ||
1049 | + if (*cp == '\\' && cp[1] == '"') | ||
1050 | + cp++; /* Skip both */ | ||
1051 | + else if (*cp == '"') | ||
1052 | + quoted = !quoted; | ||
1053 | + } | ||
1054 | + /* Skip remaining whitespace. */ | ||
1055 | + for (; *cp == ' ' || *cp == '\t'; cp++) | ||
1056 | + ; | ||
1057 | + if (!*cp) | ||
1058 | + continue; | ||
1059 | + } | ||
1060 | + | ||
1061 | + /* Read and process the key itself. */ | ||
1062 | + key = key_new(KEY_RSA1); | ||
1063 | + if (key_read(key, &cp) == 1) { | ||
1064 | + while (*cp == ' ' || *cp == '\t') | ||
1065 | + cp++; | ||
1066 | + if (!do_key(filename, linenum, | ||
1067 | + key, *cp ? cp : filename)) | ||
1068 | + ret = 0; | ||
1069 | + found = 1; | ||
1070 | + } else { | ||
1071 | + key_free(key); | ||
1072 | + key = key_new(KEY_UNSPEC); | ||
1073 | + if (key_read(key, &cp) == 1) { | ||
1074 | + while (*cp == ' ' || *cp == '\t') | ||
1075 | + cp++; | ||
1076 | + if (!do_key(filename, linenum, | ||
1077 | + key, *cp ? cp : filename)) | ||
1078 | + ret = 0; | ||
1079 | + found = 1; | ||
1080 | + } | ||
1081 | + } | ||
1082 | + key_free(key); | ||
1083 | + } | ||
1084 | + if (f != stdin) | ||
1085 | + fclose(f); | ||
1086 | + | ||
1087 | + if (!found && filename) { | ||
1088 | + key = key_load_public(filename, &comment); | ||
1089 | + if (key) { | ||
1090 | + if (!do_key(filename, 1, key, comment)) | ||
1091 | + ret = 0; | ||
1092 | + found = 1; | ||
1093 | + } | ||
1094 | + if (comment) | ||
1095 | + xfree(comment); | ||
1096 | + } | ||
1097 | + | ||
1098 | + return ret; | ||
1099 | +} | ||
1100 | + | ||
1101 | +static int | ||
1102 | +do_host(int quiet_open) | ||
1103 | +{ | ||
1104 | + int i; | ||
1105 | + struct stat st; | ||
1106 | + int ret = 1; | ||
1107 | + | ||
1108 | + for (i = 0; default_host_files[i]; i++) { | ||
1109 | + if (stat(default_host_files[i], &st) < 0 && errno == ENOENT) | ||
1110 | + continue; | ||
1111 | + if (!do_filename(default_host_files[i], quiet_open)) | ||
1112 | + ret = 0; | ||
1113 | + } | ||
1114 | + | ||
1115 | + return ret; | ||
1116 | +} | ||
1117 | + | ||
1118 | +static int | ||
1119 | +do_user(const char *dir) | ||
1120 | +{ | ||
1121 | + int i; | ||
1122 | + char *file; | ||
1123 | + struct stat st; | ||
1124 | + int ret = 1; | ||
1125 | + | ||
1126 | + for (i = 0; default_files[i]; i++) { | ||
1127 | + xasprintf(&file, "%s/%s", dir, default_files[i]); | ||
1128 | + if (stat(file, &st) < 0 && errno == ENOENT) { | ||
1129 | + xfree(file); | ||
1130 | + continue; | ||
1131 | + } | ||
1132 | + if (!do_filename(file, 0)) | ||
1133 | + ret = 0; | ||
1134 | + xfree(file); | ||
1135 | + } | ||
1136 | + | ||
1137 | + return ret; | ||
1138 | +} | ||
1139 | + | ||
1140 | +int | ||
1141 | +main(int argc, char **argv) | ||
1142 | +{ | ||
1143 | + int opt, all_users = 0; | ||
1144 | + int ret = 1; | ||
1145 | + extern int optind; | ||
1146 | + | ||
1147 | + /* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */ | ||
1148 | + sanitise_stdfd(); | ||
1149 | + | ||
1150 | + __progname = ssh_get_progname(argv[0]); | ||
1151 | + | ||
1152 | + SSLeay_add_all_algorithms(); | ||
1153 | + log_init(argv[0], SYSLOG_LEVEL_INFO, SYSLOG_FACILITY_USER, 1); | ||
1154 | + | ||
1155 | + /* We don't need the RNG ourselves, but symbol references here allow | ||
1156 | + * ld to link us properly. | ||
1157 | + */ | ||
1158 | + seed_rng(); | ||
1159 | + | ||
1160 | + while ((opt = getopt(argc, argv, "ahqv")) != -1) { | ||
1161 | + switch (opt) { | ||
1162 | + case 'a': | ||
1163 | + all_users = 1; | ||
1164 | + break; | ||
1165 | + case 'q': | ||
1166 | + verbosity--; | ||
1167 | + break; | ||
1168 | + case 'v': | ||
1169 | + verbosity++; | ||
1170 | + break; | ||
1171 | + case 'h': | ||
1172 | + default: | ||
1173 | + usage(); | ||
1174 | + } | ||
1175 | + } | ||
1176 | + | ||
1177 | + if (all_users) { | ||
1178 | + struct passwd *pw; | ||
1179 | + | ||
1180 | + if (!do_host(0)) | ||
1181 | + ret = 0; | ||
1182 | + | ||
1183 | + while ((pw = getpwent()) != NULL) { | ||
1184 | + if (pw->pw_dir) { | ||
1185 | + temporarily_use_uid(pw); | ||
1186 | + if (!do_user(pw->pw_dir)) | ||
1187 | + ret = 0; | ||
1188 | + restore_uid(); | ||
1189 | + } | ||
1190 | + } | ||
1191 | + } else if (optind == argc) { | ||
1192 | + struct passwd *pw; | ||
1193 | + | ||
1194 | + if (!do_host(1)) | ||
1195 | + ret = 0; | ||
1196 | + | ||
1197 | + if ((pw = getpwuid(geteuid())) == NULL) | ||
1198 | + fprintf(stderr, "No user found with uid %u\n", | ||
1199 | + (u_int)geteuid()); | ||
1200 | + else { | ||
1201 | + if (!do_user(pw->pw_dir)) | ||
1202 | + ret = 0; | ||
1203 | + } | ||
1204 | + } else { | ||
1205 | + while (optind < argc) | ||
1206 | + if (!do_filename(argv[optind++], 0)) | ||
1207 | + ret = 0; | ||
1208 | + } | ||
1209 | + | ||
1210 | + if (verbosity >= 0) { | ||
1211 | + if (some_unknown) { | ||
1212 | + printf("#\n"); | ||
1213 | + printf("# The status of some keys on your system is unknown.\n"); | ||
1214 | + printf("# You may need to install additional blacklist files.\n"); | ||
1215 | + } | ||
1216 | + if (some_compromised) { | ||
1217 | + printf("#\n"); | ||
1218 | + printf("# Some keys on your system have been compromised!\n"); | ||
1219 | + printf("# You must replace them using ssh-keygen(1).\n"); | ||
1220 | + } | ||
1221 | + if (some_unknown || some_compromised) { | ||
1222 | + printf("#\n"); | ||
1223 | + printf("# See the ssh-vulnkey(1) manual page for further advice.\n"); | ||
1224 | + } else if (some_keys && verbosity > 0) { | ||
1225 | + printf("#\n"); | ||
1226 | + printf("# No blacklisted keys!\n"); | ||
1227 | + } | ||
1228 | + } | ||
1229 | + | ||
1230 | + return ret; | ||
1231 | +} | ||
1232 | Index: b/ssh.1 | ||
1233 | =================================================================== | ||
1234 | --- a/ssh.1 | ||
1235 | +++ b/ssh.1 | ||
1236 | @@ -1407,6 +1407,7 @@ | ||
1237 | .Xr ssh-agent 1 , | ||
1238 | .Xr ssh-keygen 1 , | ||
1239 | .Xr ssh-keyscan 1 , | ||
1240 | +.Xr ssh-vulnkey 1 , | ||
1241 | .Xr tun 4 , | ||
1242 | .Xr hosts.equiv 5 , | ||
1243 | .Xr ssh_config 5 , | ||
1244 | Index: b/ssh.c | ||
1245 | =================================================================== | ||
1246 | --- a/ssh.c | ||
1247 | +++ b/ssh.c | ||
1248 | @@ -1476,7 +1476,7 @@ | ||
1249 | static void | ||
1250 | load_public_identity_files(void) | ||
1251 | { | ||
1252 | - char *filename, *cp, thishost[NI_MAXHOST]; | ||
1253 | + char *filename, *cp, thishost[NI_MAXHOST], *fp; | ||
1254 | char *pwdir = NULL, *pwname = NULL; | ||
1255 | int i = 0; | ||
1256 | Key *public; | ||
1257 | @@ -1533,6 +1533,22 @@ | ||
1258 | public = key_load_public(filename, NULL); | ||
1259 | debug("identity file %s type %d", filename, | ||
1260 | public ? public->type : -1); | ||
1261 | + if (public && blacklisted_key(public, &fp) == 1) { | ||
1262 | + if (options.use_blacklisted_keys) | ||
1263 | + logit("Public key %s blacklisted (see " | ||
1264 | + "ssh-vulnkey(1)); continuing anyway", fp); | ||
1265 | + else | ||
1266 | + logit("Public key %s blacklisted (see " | ||
1267 | + "ssh-vulnkey(1)); refusing to send it", | ||
1268 | + fp); | ||
1269 | + xfree(fp); | ||
1270 | + if (!options.use_blacklisted_keys) { | ||
1271 | + key_free(public); | ||
1272 | + xfree(filename); | ||
1273 | + filename = NULL; | ||
1274 | + public = NULL; | ||
1275 | + } | ||
1276 | + } | ||
1277 | xfree(options.identity_files[i]); | ||
1278 | identity_files[n_ids] = filename; | ||
1279 | identity_keys[n_ids] = public; | ||
1280 | Index: b/ssh_config.5 | ||
1281 | =================================================================== | ||
1282 | --- a/ssh_config.5 | ||
1283 | +++ b/ssh_config.5 | ||
1284 | @@ -1188,6 +1188,23 @@ | ||
1285 | .Dq any . | ||
1286 | The default is | ||
1287 | .Dq any:any . | ||
1288 | +.It Cm UseBlacklistedKeys | ||
1289 | +Specifies whether | ||
1290 | +.Xr ssh 1 | ||
1291 | +should use keys recorded in its blacklist of known-compromised keys (see | ||
1292 | +.Xr ssh-vulnkey 1 ) | ||
1293 | +for authentication. | ||
1294 | +If | ||
1295 | +.Dq yes , | ||
1296 | +then attempts to use compromised keys for authentication will be logged but | ||
1297 | +accepted. | ||
1298 | +It is strongly recommended that this be used only to install new authorized | ||
1299 | +keys on the remote system, and even then only with the utmost care. | ||
1300 | +If | ||
1301 | +.Dq no , | ||
1302 | +then attempts to use compromised keys for authentication will be prevented. | ||
1303 | +The default is | ||
1304 | +.Dq no . | ||
1305 | .It Cm UsePrivilegedPort | ||
1306 | Specifies whether to use a privileged port for outgoing connections. | ||
1307 | The argument must be | ||
1308 | Index: b/sshconnect2.c | ||
1309 | =================================================================== | ||
1310 | --- a/sshconnect2.c | ||
1311 | +++ b/sshconnect2.c | ||
1312 | @@ -1489,6 +1489,8 @@ | ||
1313 | |||
1314 | /* list of keys stored in the filesystem */ | ||
1315 | for (i = 0; i < options.num_identity_files; i++) { | ||
1316 | + if (options.identity_files[i] == NULL) | ||
1317 | + continue; | ||
1318 | key = options.identity_keys[i]; | ||
1319 | if (key && key->type == KEY_RSA1) | ||
1320 | continue; | ||
1321 | @@ -1582,7 +1584,7 @@ | ||
1322 | debug("Offering %s public key: %s", key_type(id->key), | ||
1323 | id->filename); | ||
1324 | sent = send_pubkey_test(authctxt, id); | ||
1325 | - } else if (id->key == NULL) { | ||
1326 | + } else if (id->key == NULL && id->filename) { | ||
1327 | debug("Trying private key: %s", id->filename); | ||
1328 | id->key = load_identity_file(id->filename); | ||
1329 | if (id->key != NULL) { | ||
1330 | Index: b/sshd.8 | ||
1331 | =================================================================== | ||
1332 | --- a/sshd.8 | ||
1333 | +++ b/sshd.8 | ||
1334 | @@ -948,6 +948,7 @@ | ||
1335 | .Xr ssh-agent 1 , | ||
1336 | .Xr ssh-keygen 1 , | ||
1337 | .Xr ssh-keyscan 1 , | ||
1338 | +.Xr ssh-vulnkey 1 , | ||
1339 | .Xr chroot 2 , | ||
1340 | .Xr hosts_access 5 , | ||
1341 | .Xr login.conf 5 , | ||
1342 | Index: b/sshd.c | ||
1343 | =================================================================== | ||
1344 | --- a/sshd.c | ||
1345 | +++ b/sshd.c | ||
1346 | @@ -1598,6 +1598,11 @@ | ||
1347 | sensitive_data.host_keys[i] = NULL; | ||
1348 | continue; | ||
1349 | } | ||
1350 | + if (auth_key_is_revoked(key, 1)) { | ||
1351 | + key_free(key); | ||
1352 | + sensitive_data.host_keys[i] = NULL; | ||
1353 | + continue; | ||
1354 | + } | ||
1355 | switch (key->type) { | ||
1356 | case KEY_RSA1: | ||
1357 | sensitive_data.ssh1_host_key = key; | ||
1358 | Index: b/sshd_config.5 | ||
1359 | =================================================================== | ||
1360 | --- a/sshd_config.5 | ||
1361 | +++ b/sshd_config.5 | ||
1362 | @@ -795,6 +795,20 @@ | ||
1363 | Specifies whether password authentication is allowed. | ||
1364 | The default is | ||
1365 | .Dq yes . | ||
1366 | +.It Cm PermitBlacklistedKeys | ||
1367 | +Specifies whether | ||
1368 | +.Xr sshd 8 | ||
1369 | +should allow keys recorded in its blacklist of known-compromised keys (see | ||
1370 | +.Xr ssh-vulnkey 1 ) . | ||
1371 | +If | ||
1372 | +.Dq yes , | ||
1373 | +then attempts to authenticate with compromised keys will be logged but | ||
1374 | +accepted. | ||
1375 | +If | ||
1376 | +.Dq no , | ||
1377 | +then attempts to authenticate with compromised keys will be rejected. | ||
1378 | +The default is | ||
1379 | +.Dq no . | ||
1380 | .It Cm PermitEmptyPasswords | ||
1381 | When password authentication is allowed, it specifies whether the | ||
1382 | server allows login to accounts with empty password strings. | ||
diff --git a/debian/patches/ssh1-keepalive.patch b/debian/patches/ssh1-keepalive.patch new file mode 100644 index 000000000..d5a7fe07a --- /dev/null +++ b/debian/patches/ssh1-keepalive.patch | |||
@@ -0,0 +1,65 @@ | |||
1 | Description: Partial server keep-alive implementation for SSH1 | ||
2 | Author: Colin Watson <cjwatson@debian.org> | ||
3 | Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1712 | ||
4 | Last-Update: 2010-02-27 | ||
5 | |||
6 | Index: b/clientloop.c | ||
7 | =================================================================== | ||
8 | --- a/clientloop.c | ||
9 | +++ b/clientloop.c | ||
10 | @@ -545,16 +545,21 @@ | ||
11 | static void | ||
12 | server_alive_check(void) | ||
13 | { | ||
14 | - if (packet_inc_alive_timeouts() > options.server_alive_count_max) { | ||
15 | - logit("Timeout, server %s not responding.", host); | ||
16 | - cleanup_exit(255); | ||
17 | + if (compat20) { | ||
18 | + if (packet_inc_alive_timeouts() > options.server_alive_count_max) { | ||
19 | + logit("Timeout, server %s not responding.", host); | ||
20 | + cleanup_exit(255); | ||
21 | + } | ||
22 | + packet_start(SSH2_MSG_GLOBAL_REQUEST); | ||
23 | + packet_put_cstring("keepalive@openssh.com"); | ||
24 | + packet_put_char(1); /* boolean: want reply */ | ||
25 | + packet_send(); | ||
26 | + /* Insert an empty placeholder to maintain ordering */ | ||
27 | + client_register_global_confirm(NULL, NULL); | ||
28 | + } else { | ||
29 | + packet_send_ignore(0); | ||
30 | + packet_send(); | ||
31 | } | ||
32 | - packet_start(SSH2_MSG_GLOBAL_REQUEST); | ||
33 | - packet_put_cstring("keepalive@openssh.com"); | ||
34 | - packet_put_char(1); /* boolean: want reply */ | ||
35 | - packet_send(); | ||
36 | - /* Insert an empty placeholder to maintain ordering */ | ||
37 | - client_register_global_confirm(NULL, NULL); | ||
38 | } | ||
39 | |||
40 | /* | ||
41 | @@ -614,7 +619,7 @@ | ||
42 | */ | ||
43 | |||
44 | timeout_secs = INT_MAX; /* we use INT_MAX to mean no timeout */ | ||
45 | - if (options.server_alive_interval > 0 && compat20) | ||
46 | + if (options.server_alive_interval > 0) | ||
47 | timeout_secs = options.server_alive_interval; | ||
48 | set_control_persist_exit_time(); | ||
49 | if (control_persist_exit_time > 0) { | ||
50 | Index: b/ssh_config.5 | ||
51 | =================================================================== | ||
52 | --- a/ssh_config.5 | ||
53 | +++ b/ssh_config.5 | ||
54 | @@ -1089,7 +1089,10 @@ | ||
55 | .Cm ServerAliveCountMax | ||
56 | is left at the default, if the server becomes unresponsive, | ||
57 | ssh will disconnect after approximately 45 seconds. | ||
58 | -This option applies to protocol version 2 only. | ||
59 | +This option applies to protocol version 2 only; in protocol version | ||
60 | +1 there is no mechanism to request a response from the server to the | ||
61 | +server alive messages, so disconnection is the responsibility of the TCP | ||
62 | +stack. | ||
63 | .It Cm ServerAliveInterval | ||
64 | Sets a timeout interval in seconds after which if no data has been received | ||
65 | from the server, | ||
diff --git a/debian/patches/syslog-level-silent.patch b/debian/patches/syslog-level-silent.patch new file mode 100644 index 000000000..90ddca4ad --- /dev/null +++ b/debian/patches/syslog-level-silent.patch | |||
@@ -0,0 +1,37 @@ | |||
1 | Description: "LogLevel SILENT" compatibility | ||
2 | "LogLevel SILENT" (-qq) was introduced in Debian openssh 1:3.0.1p1-1 to | ||
3 | match the behaviour of non-free SSH, in which -q does not suppress fatal | ||
4 | errors. However, this was unintentionally broken in 1:4.6p1-2 and nobody | ||
5 | complained, so we've dropped most of it. The parts that remain are basic | ||
6 | configuration file compatibility, and an adjustment to "Pseudo-terminal | ||
7 | will not be allocated ..." which should be split out into a separate patch. | ||
8 | Author: Jonathan David Amery <jdamery@ysolde.ucam.org> | ||
9 | Author: Matthew Vernon <matthew@debian.org> | ||
10 | Author: Colin Watson <cjwatson@debian.org> | ||
11 | Last-Update: 2010-03-31 | ||
12 | |||
13 | Index: b/log.c | ||
14 | =================================================================== | ||
15 | --- a/log.c | ||
16 | +++ b/log.c | ||
17 | @@ -92,6 +92,7 @@ | ||
18 | LogLevel val; | ||
19 | } log_levels[] = | ||
20 | { | ||
21 | + { "SILENT", SYSLOG_LEVEL_QUIET }, /* compatibility */ | ||
22 | { "QUIET", SYSLOG_LEVEL_QUIET }, | ||
23 | { "FATAL", SYSLOG_LEVEL_FATAL }, | ||
24 | { "ERROR", SYSLOG_LEVEL_ERROR }, | ||
25 | Index: b/ssh.c | ||
26 | =================================================================== | ||
27 | --- a/ssh.c | ||
28 | +++ b/ssh.c | ||
29 | @@ -678,7 +678,7 @@ | ||
30 | /* Do not allocate a tty if stdin is not a tty. */ | ||
31 | if ((!isatty(fileno(stdin)) || stdin_null_flag) && | ||
32 | options.request_tty != REQUEST_TTY_FORCE) { | ||
33 | - if (tty_flag) | ||
34 | + if (tty_flag && options.log_level != SYSLOG_LEVEL_QUIET) | ||
35 | logit("Pseudo-terminal will not be allocated because " | ||
36 | "stdin is not a terminal."); | ||
37 | tty_flag = 0; | ||
diff --git a/debian/patches/user-group-modes.patch b/debian/patches/user-group-modes.patch new file mode 100644 index 000000000..01ba05526 --- /dev/null +++ b/debian/patches/user-group-modes.patch | |||
@@ -0,0 +1,202 @@ | |||
1 | Description: Allow harmless group-writability | ||
2 | Allow secure files (~/.ssh/config, ~/.ssh/authorized_keys, etc.) to be | ||
3 | group-writable, provided that the group in question contains only the | ||
4 | file's owner. Rejected upstream for IMO incorrect reasons (e.g. a | ||
5 | misunderstanding about the contents of gr->gr_mem). Given that | ||
6 | per-user groups and umask 002 are the default setup in Debian (for good | ||
7 | reasons - this makes operating in setgid directories with other groups | ||
8 | much easier), we need to permit this by default. | ||
9 | Author: Colin Watson <cjwatson@debian.org> | ||
10 | Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1060 | ||
11 | Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=314347 | ||
12 | Last-Update: 2010-02-27 | ||
13 | |||
14 | Index: b/readconf.c | ||
15 | =================================================================== | ||
16 | --- a/readconf.c | ||
17 | +++ b/readconf.c | ||
18 | @@ -30,6 +30,8 @@ | ||
19 | #include <stdio.h> | ||
20 | #include <string.h> | ||
21 | #include <unistd.h> | ||
22 | +#include <pwd.h> | ||
23 | +#include <grp.h> | ||
24 | |||
25 | #include "xmalloc.h" | ||
26 | #include "ssh.h" | ||
27 | @@ -1131,8 +1133,7 @@ | ||
28 | |||
29 | if (fstat(fileno(f), &sb) == -1) | ||
30 | fatal("fstat %s: %s", filename, strerror(errno)); | ||
31 | - if (((sb.st_uid != 0 && sb.st_uid != getuid()) || | ||
32 | - (sb.st_mode & 022) != 0)) | ||
33 | + if (!secure_permissions(&sb, getuid())) | ||
34 | fatal("Bad owner or permissions on %s", filename); | ||
35 | } | ||
36 | |||
37 | Index: b/ssh.1 | ||
38 | =================================================================== | ||
39 | --- a/ssh.1 | ||
40 | +++ b/ssh.1 | ||
41 | @@ -1298,6 +1298,8 @@ | ||
42 | .Xr ssh_config 5 . | ||
43 | Because of the potential for abuse, this file must have strict permissions: | ||
44 | read/write for the user, and not accessible by others. | ||
45 | +It may be group-writable provided that the group in question contains only | ||
46 | +the user. | ||
47 | .Pp | ||
48 | .It Pa ~/.ssh/environment | ||
49 | Contains additional definitions for environment variables; see | ||
50 | Index: b/ssh_config.5 | ||
51 | =================================================================== | ||
52 | --- a/ssh_config.5 | ||
53 | +++ b/ssh_config.5 | ||
54 | @@ -1343,6 +1343,8 @@ | ||
55 | This file is used by the SSH client. | ||
56 | Because of the potential for abuse, this file must have strict permissions: | ||
57 | read/write for the user, and not accessible by others. | ||
58 | +It may be group-writable provided that the group in question contains only | ||
59 | +the user. | ||
60 | .It Pa /etc/ssh/ssh_config | ||
61 | Systemwide configuration file. | ||
62 | This file provides defaults for those | ||
63 | Index: b/auth.c | ||
64 | =================================================================== | ||
65 | --- a/auth.c | ||
66 | +++ b/auth.c | ||
67 | @@ -380,8 +380,7 @@ | ||
68 | user_hostfile = tilde_expand_filename(userfile, pw->pw_uid); | ||
69 | if (options.strict_modes && | ||
70 | (stat(user_hostfile, &st) == 0) && | ||
71 | - ((st.st_uid != 0 && st.st_uid != pw->pw_uid) || | ||
72 | - (st.st_mode & 022) != 0)) { | ||
73 | + !secure_permissions(&st, pw->pw_uid)) { | ||
74 | logit("Authentication refused for %.100s: " | ||
75 | "bad owner or modes for %.200s", | ||
76 | pw->pw_name, user_hostfile); | ||
77 | @@ -442,8 +441,7 @@ | ||
78 | |||
79 | /* check the open file to avoid races */ | ||
80 | if (fstat(fileno(f), &st) < 0 || | ||
81 | - (st.st_uid != 0 && st.st_uid != uid) || | ||
82 | - (st.st_mode & 022) != 0) { | ||
83 | + !secure_permissions(&st, uid)) { | ||
84 | snprintf(err, errlen, "bad ownership or modes for file %s", | ||
85 | buf); | ||
86 | return -1; | ||
87 | @@ -458,8 +456,7 @@ | ||
88 | strlcpy(buf, cp, sizeof(buf)); | ||
89 | |||
90 | if (stat(buf, &st) < 0 || | ||
91 | - (st.st_uid != 0 && st.st_uid != uid) || | ||
92 | - (st.st_mode & 022) != 0) { | ||
93 | + !secure_permissions(&st, uid)) { | ||
94 | snprintf(err, errlen, | ||
95 | "bad ownership or modes for directory %s", buf); | ||
96 | return -1; | ||
97 | Index: b/misc.c | ||
98 | =================================================================== | ||
99 | --- a/misc.c | ||
100 | +++ b/misc.c | ||
101 | @@ -48,8 +48,9 @@ | ||
102 | #include <netdb.h> | ||
103 | #ifdef HAVE_PATHS_H | ||
104 | # include <paths.h> | ||
105 | -#include <pwd.h> | ||
106 | #endif | ||
107 | +#include <pwd.h> | ||
108 | +#include <grp.h> | ||
109 | #ifdef SSH_TUN_OPENBSD | ||
110 | #include <net/if.h> | ||
111 | #endif | ||
112 | @@ -642,6 +643,55 @@ | ||
113 | } | ||
114 | |||
115 | int | ||
116 | +secure_permissions(struct stat *st, uid_t uid) | ||
117 | +{ | ||
118 | + if (st->st_uid != 0 && st->st_uid != uid) | ||
119 | + return 0; | ||
120 | + if ((st->st_mode & 002) != 0) | ||
121 | + return 0; | ||
122 | + if ((st->st_mode & 020) != 0) { | ||
123 | + /* If the file is group-writable, the group in question must | ||
124 | + * have exactly one member, namely the file's owner. | ||
125 | + * (Zero-member groups are typically used by setgid | ||
126 | + * binaries, and are unlikely to be suitable.) | ||
127 | + */ | ||
128 | + struct passwd *pw; | ||
129 | + struct group *gr; | ||
130 | + int members = 0; | ||
131 | + | ||
132 | + gr = getgrgid(st->st_gid); | ||
133 | + if (!gr) | ||
134 | + return 0; | ||
135 | + | ||
136 | + /* Check primary group memberships. */ | ||
137 | + while ((pw = getpwent()) != NULL) { | ||
138 | + if (pw->pw_gid == gr->gr_gid) { | ||
139 | + ++members; | ||
140 | + if (pw->pw_uid != uid) | ||
141 | + return 0; | ||
142 | + } | ||
143 | + } | ||
144 | + endpwent(); | ||
145 | + | ||
146 | + pw = getpwuid(st->st_uid); | ||
147 | + if (!pw) | ||
148 | + return 0; | ||
149 | + | ||
150 | + /* Check supplementary group memberships. */ | ||
151 | + if (gr->gr_mem[0]) { | ||
152 | + ++members; | ||
153 | + if (strcmp(pw->pw_name, gr->gr_mem[0]) || | ||
154 | + gr->gr_mem[1]) | ||
155 | + return 0; | ||
156 | + } | ||
157 | + | ||
158 | + if (!members) | ||
159 | + return 0; | ||
160 | + } | ||
161 | + return 1; | ||
162 | +} | ||
163 | + | ||
164 | +int | ||
165 | tun_open(int tun, int mode) | ||
166 | { | ||
167 | #if defined(CUSTOM_SYS_TUN_OPEN) | ||
168 | Index: b/misc.h | ||
169 | =================================================================== | ||
170 | --- a/misc.h | ||
171 | +++ b/misc.h | ||
172 | @@ -103,4 +103,6 @@ | ||
173 | int ask_permission(const char *, ...) __attribute__((format(printf, 1, 2))); | ||
174 | int read_keyfile_line(FILE *, const char *, char *, size_t, u_long *); | ||
175 | |||
176 | +int secure_permissions(struct stat *st, uid_t uid); | ||
177 | + | ||
178 | #endif /* _MISC_H */ | ||
179 | Index: b/auth-rhosts.c | ||
180 | =================================================================== | ||
181 | --- a/auth-rhosts.c | ||
182 | +++ b/auth-rhosts.c | ||
183 | @@ -256,8 +256,7 @@ | ||
184 | return 0; | ||
185 | } | ||
186 | if (options.strict_modes && | ||
187 | - ((st.st_uid != 0 && st.st_uid != pw->pw_uid) || | ||
188 | - (st.st_mode & 022) != 0)) { | ||
189 | + !secure_permissions(&st, pw->pw_uid)) { | ||
190 | logit("Rhosts authentication refused for %.100s: " | ||
191 | "bad ownership or modes for home directory.", pw->pw_name); | ||
192 | auth_debug_add("Rhosts authentication refused for %.100s: " | ||
193 | @@ -283,8 +282,7 @@ | ||
194 | * allowing access to their account by anyone. | ||
195 | */ | ||
196 | if (options.strict_modes && | ||
197 | - ((st.st_uid != 0 && st.st_uid != pw->pw_uid) || | ||
198 | - (st.st_mode & 022) != 0)) { | ||
199 | + !secure_permissions(&st, pw->pw_uid)) { | ||
200 | logit("Rhosts authentication refused for %.100s: bad modes for %.200s", | ||
201 | pw->pw_name, buf); | ||
202 | auth_debug_add("Bad file modes for %.200s", buf); | ||
diff --git a/debian/po/POTFILES.in b/debian/po/POTFILES.in new file mode 100644 index 000000000..c619f3451 --- /dev/null +++ b/debian/po/POTFILES.in | |||
@@ -0,0 +1 @@ | |||
[type: gettext/rfc822deb] openssh-server.templates | |||
diff --git a/debian/po/bg.po b/debian/po/bg.po new file mode 100644 index 000000000..6b2bc0e8b --- /dev/null +++ b/debian/po/bg.po | |||
@@ -0,0 +1,193 @@ | |||
1 | # translation of bg.po to Bulgarian | ||
2 | # Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER | ||
3 | # This file is distributed under the same license as the PACKAGE package. | ||
4 | # | ||
5 | # Damyan Ivanov <dmn@debian.org>, 2007, 2008. | ||
6 | msgid "" | ||
7 | msgstr "" | ||
8 | "Project-Id-Version: openssh\n" | ||
9 | "Report-Msgid-Bugs-To: openssh@packages.debian.org\n" | ||
10 | "POT-Creation-Date: 2010-01-02 08:55+0000\n" | ||
11 | "PO-Revision-Date: 2008-05-19 09:27+0300\n" | ||
12 | "Last-Translator: Damyan Ivanov <dmn@debian.org>\n" | ||
13 | "Language-Team: Bulgarian <dict@fsa-bg.org>\n" | ||
14 | "MIME-Version: 1.0\n" | ||
15 | "Content-Type: text/plain; charset=UTF-8\n" | ||
16 | "Content-Transfer-Encoding: 8bit\n" | ||
17 | "X-Generator: KBabel 1.11.4\n" | ||
18 | |||
19 | #. Type: boolean | ||
20 | #. Description | ||
21 | #: ../openssh-server.templates:1001 | ||
22 | msgid "Do you want to risk killing active SSH sessions?" | ||
23 | msgstr "Да Ñе прекъÑнат ли текущите връзки по SSH?" | ||
24 | |||
25 | #. Type: boolean | ||
26 | #. Description | ||
27 | #: ../openssh-server.templates:1001 | ||
28 | msgid "" | ||
29 | "The currently installed version of /etc/init.d/ssh is likely to kill all " | ||
30 | "running sshd instances. If you are doing this upgrade via an SSH session, " | ||
31 | "you're likely to be disconnected and leave the upgrade procedure unfinished." | ||
32 | msgstr "" | ||
33 | "Много е вероÑтно верÑиÑта на /etc/init.d/ssh, коÑто е инÑталирана в момента " | ||
34 | "да прекъÑне активните връзки. Ðко извършвате обновÑването отдалечено има " | ||
35 | "опаÑноÑÑ‚ връзката да Ñе разпадне и процеÑÑŠÑ‚ да не завърши нормално." | ||
36 | |||
37 | #. Type: boolean | ||
38 | #. Description | ||
39 | #: ../openssh-server.templates:1001 | ||
40 | msgid "" | ||
41 | "This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the " | ||
42 | "start-stop-daemon line in the stop section of the file." | ||
43 | msgstr "" | ||
44 | "Това може да бъде поправено ръчно Ñ Ð´Ð¾Ð±Ð°Ð²Ñнето на „--pidfile /var/run/sshd." | ||
45 | "pid“ към командата start-stop-daemon в раздела „stop“ на файла." | ||
46 | |||
47 | #. Type: note | ||
48 | #. Description | ||
49 | #: ../openssh-server.templates:2001 | ||
50 | msgid "New host key mandatory" | ||
51 | msgstr "Ðеобходим е нов ключ за хоÑта" | ||
52 | |||
53 | #. Type: note | ||
54 | #. Description | ||
55 | #: ../openssh-server.templates:2001 | ||
56 | msgid "" | ||
57 | "The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA " | ||
58 | "algorithm. OpenSSH can not handle this host key file, and the ssh-keygen " | ||
59 | "utility from the old (non-free) SSH installation does not appear to be " | ||
60 | "available." | ||
61 | msgstr "" | ||
62 | "Ð’ момента ключа на хоÑта в /etc/ssh/ssh_host_key е шифриран Ñ Ð°Ð»Ð³Ð¾Ñ€Ð¸Ñ‚ÑŠÐ¼Ð° " | ||
63 | "IDEA. OpenSSH не може да работи Ñ Ñ‚Ð¾Ð·Ð¸ файл, а програмата ssh-keygen от " | ||
64 | "Ñтарата инÑÑ‚Ð°Ð»Ð°Ñ†Ð¸Ñ Ð½Ðµ е налична." | ||
65 | |||
66 | #. Type: note | ||
67 | #. Description | ||
68 | #: ../openssh-server.templates:2001 | ||
69 | msgid "You need to manually generate a new host key." | ||
70 | msgstr "Ðеобходимо е да Ñе генерира ръчно нов ключ за хоÑта." | ||
71 | |||
72 | #. Type: boolean | ||
73 | #. Description | ||
74 | #: ../openssh-server.templates:3001 | ||
75 | msgid "Disable challenge-response authentication?" | ||
76 | msgstr "Забрана на удоÑтоверÑването challenge-response?" | ||
77 | |||
78 | #. Type: boolean | ||
79 | #. Description | ||
80 | #: ../openssh-server.templates:3001 | ||
81 | msgid "" | ||
82 | "Password authentication appears to be disabled in the current OpenSSH server " | ||
83 | "configuration. In order to prevent users from logging in using passwords " | ||
84 | "(perhaps using only public key authentication instead) with recent versions " | ||
85 | "of OpenSSH, you must disable challenge-response authentication, or else " | ||
86 | "ensure that your PAM configuration does not allow Unix password file " | ||
87 | "authentication." | ||
88 | msgstr "" | ||
89 | "Изглежда че удоÑтоверÑването Ñ Ð¿Ð°Ñ€Ð¾Ð»Ð° е забранено в наÑтройката на OpenSSH " | ||
90 | "Ñървъра. За пълна забрана на използването на пароли за удоÑтоверÑване " | ||
91 | "(вероÑтно оÑтавÑйки Ñамо удоÑтоверÑването Ñ Ð¿ÑƒÐ±Ð»Ð¸Ñ‡ÐµÐ½ ключ) е необходимо да " | ||
92 | "бъде забранено удоÑтоверÑването „challenge-response“. Ð’ противен Ñлучай е " | ||
93 | "нужно да Ñе наÑтрои PAM да не позволÑва удоÑтоверÑване чрез файловете Ñ " | ||
94 | "пароли Ñтил Unix." | ||
95 | |||
96 | #. Type: boolean | ||
97 | #. Description | ||
98 | #: ../openssh-server.templates:3001 | ||
99 | msgid "" | ||
100 | "If you disable challenge-response authentication, then users will not be " | ||
101 | "able to log in using passwords. If you leave it enabled (the default " | ||
102 | "answer), then the 'PasswordAuthentication no' option will have no useful " | ||
103 | "effect unless you also adjust your PAM configuration in /etc/pam.d/ssh." | ||
104 | msgstr "" | ||
105 | "Ðко удоÑтоверÑването chalenge-response е забрането, потребителите нÑма да " | ||
106 | "могат да използват пароли за удоÑтоверÑване. Ðко е разрешено (по " | ||
107 | "подразбиране), наÑтройката 'PasswordAuthentication no' нÑма да има ефект, " | ||
108 | "оÑвен ако не промените наÑтройките за PAM в /etc/pam.d/ssh." | ||
109 | |||
110 | #. Type: note | ||
111 | #. Description | ||
112 | #: ../openssh-server.templates:4001 | ||
113 | msgid "Vulnerable host keys will be regenerated" | ||
114 | msgstr "УÑзвимите ключове на хоÑта ще бъдат Ñъздадени наново" | ||
115 | |||
116 | #. Type: note | ||
117 | #. Description | ||
118 | #: ../openssh-server.templates:4001 | ||
119 | msgid "" | ||
120 | "Some of the OpenSSH server host keys on this system were generated with a " | ||
121 | "version of OpenSSL that had a broken random number generator. As a result, " | ||
122 | "these host keys are from a well-known set, are subject to brute-force " | ||
123 | "attacks, and must be regenerated." | ||
124 | msgstr "" | ||
125 | "ÐÑкои от ключовете за уÑлугата OpenSSH на хоÑта Ñа Ñъздадени Ñ Ð²ÐµÑ€ÑÐ¸Ñ Ð½Ð° " | ||
126 | "OpenSSL, коÑто използва повреден генератор на Ñлучайни чиÑла. Тези ключове " | ||
127 | "Ñа широко извеÑтни, уÑзвими Ñа към атаки и Ñ‚Ñ€Ñбва да бъдат Ñменени." | ||
128 | |||
129 | #. Type: note | ||
130 | #. Description | ||
131 | #: ../openssh-server.templates:4001 | ||
132 | msgid "" | ||
133 | "Users of this system should be informed of this change, as they will be " | ||
134 | "prompted about the host key change the next time they log in. Use 'ssh-" | ||
135 | "keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of " | ||
136 | "the new host keys." | ||
137 | msgstr "" | ||
138 | "Потребителите на ÑиÑтемата Ñ‚Ñ€Ñбва да бъдат извеÑтени за промÑната, понеже " | ||
139 | "при ÑледващиÑÑ‚ им опит за връзка чрез SSH ще получат предупреждение за " | ||
140 | "промÑна в ключовете на хоÑта. За да получите отпечатъците на новите ключове " | ||
141 | "използвайте „ssh-keygen -l -f файл-Ñ-ключ“." | ||
142 | |||
143 | #. Type: note | ||
144 | #. Description | ||
145 | #: ../openssh-server.templates:4001 | ||
146 | msgid "The affected host keys are:" | ||
147 | msgstr "ЗаÑегнатите ключове на хоÑта Ñа:" | ||
148 | |||
149 | #. Type: note | ||
150 | #. Description | ||
151 | #: ../openssh-server.templates:4001 | ||
152 | msgid "" | ||
153 | "User keys may also be affected by this problem. The 'ssh-vulnkey' command " | ||
154 | "may be used as a partial test for this. See /usr/share/doc/openssh-server/" | ||
155 | "README.compromised-keys.gz for more details." | ||
156 | msgstr "" | ||
157 | "Възможно е потребителÑките ключове Ñъщо да Ñа заÑегнати от проблема. Можете " | ||
158 | "да използвате програмата „ssh-vulnkey“ за да ги проверите. За повече " | ||
159 | "Ð¸Ð½Ñ„Ð¾Ñ€Ð¼Ð°Ñ†Ð¸Ñ Ð¿Ð¾Ð³Ð»ÐµÐ´Ð½ÐµÑ‚Ðµ /usr/share/doc/openssh-server/README.compromised-keys." | ||
160 | "gz." | ||
161 | |||
162 | #~ msgid "Generate a new configuration file for OpenSSH?" | ||
163 | #~ msgstr "Създаване на нов файл Ñ Ð½Ð°Ñтройки за OpenSSH?" | ||
164 | |||
165 | #~ msgid "" | ||
166 | #~ "This version of OpenSSH has a considerably changed configuration file " | ||
167 | #~ "from the version shipped in Debian 'Potato', which you appear to be " | ||
168 | #~ "upgrading from. This package can now generate a new configuration file (/" | ||
169 | #~ "etc/ssh/sshd.config), which will work with the new server version, but " | ||
170 | #~ "will not contain any customizations you made with the old version." | ||
171 | #~ msgstr "" | ||
172 | #~ "Файлът Ñ Ð½Ð°Ñтройки в тази верÑÐ¸Ñ Ð½Ð° OpenSSH е Ñилно променен в Ñравнение " | ||
173 | #~ "Ñ Ð²ÐµÑ€ÑиÑта в Debian 'Potato', коÑто изглежда Ñе обновÑва. Може да бъде " | ||
174 | #~ "Ñъздаден нов файл Ñ Ð½Ð°Ñтройки (/etc/ssh/sshd.config), който ще работи Ñ " | ||
175 | #~ "новата верÑиÑ, но нÑма да Ñъдържа евентуални промени от ÑÑ‚Ð°Ñ€Ð¸Ñ Ñ„Ð°Ð¹Ð»." | ||
176 | |||
177 | #~ msgid "" | ||
178 | #~ "Please note that this new configuration file will set the value of " | ||
179 | #~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password " | ||
180 | #~ "can ssh directly in as root). Please read the README.Debian file for more " | ||
181 | #~ "details about this design choice." | ||
182 | #~ msgstr "" | ||
183 | #~ "ÐовиÑÑ‚ файл ще Ñъдържа 'PermitRootLogin yes' (разрешавайки отдалечен " | ||
184 | #~ "доÑтъп през ssh за админиÑÑ‚Ñ€Ð°Ñ‚Ð¸Ð²Ð½Ð¸Ñ Ð¿Ð¾Ñ‚Ñ€ÐµÐ±Ð¸Ñ‚ÐµÐ» root). ПодробноÑти за " | ||
185 | #~ "причините за тази наÑтройка има във файла README.Debian." | ||
186 | |||
187 | #~ msgid "" | ||
188 | #~ "It is strongly recommended that you choose to generate a new " | ||
189 | #~ "configuration file now." | ||
190 | #~ msgstr "Препоръчва Ñе да изберете Ñъздаването на нов файл Ñ Ð½Ð°Ñтройки." | ||
191 | |||
192 | #~ msgid "${HOST_KEYS}" | ||
193 | #~ msgstr "${HOST_KEYS}" | ||
diff --git a/debian/po/ca.po b/debian/po/ca.po new file mode 100644 index 000000000..04bcdea8f --- /dev/null +++ b/debian/po/ca.po | |||
@@ -0,0 +1,352 @@ | |||
1 | # | ||
2 | # Catalan translation for openssh package. | ||
3 | # Copyright (C) 2007 Matthew Vernon. | ||
4 | # This file is distributed under the same license as the openssh package. | ||
5 | # | ||
6 | # Aleix Badia i Bosch <abadia@ica.es>, 2004 | ||
7 | # Jordà Polo <jorda@ettin.org>, 2007. | ||
8 | # | ||
9 | msgid "" | ||
10 | msgstr "" | ||
11 | "Project-Id-Version: 1:4.6p1-2\n" | ||
12 | "Report-Msgid-Bugs-To: openssh@packages.debian.org\n" | ||
13 | "POT-Creation-Date: 2010-01-02 08:55+0000\n" | ||
14 | "PO-Revision-Date: 2007-06-30 01:13+0200\n" | ||
15 | "Last-Translator: Jordà Polo <jorda@ettin.org>\n" | ||
16 | "Language-Team: Català <debian-l10n-catalan@lists.debian.org>\n" | ||
17 | "MIME-Version: 1.0\n" | ||
18 | "Content-Type: text/plain; charset=UTF-8\n" | ||
19 | "Content-Transfer-Encoding: 8bit\n" | ||
20 | |||
21 | #. Type: boolean | ||
22 | #. Description | ||
23 | #: ../openssh-server.templates:1001 | ||
24 | msgid "Do you want to risk killing active SSH sessions?" | ||
25 | msgstr "Voleu arriscar-vos a aturar les sessions SSH actives?" | ||
26 | |||
27 | #. Type: boolean | ||
28 | #. Description | ||
29 | #: ../openssh-server.templates:1001 | ||
30 | msgid "" | ||
31 | "The currently installed version of /etc/init.d/ssh is likely to kill all " | ||
32 | "running sshd instances. If you are doing this upgrade via an SSH session, " | ||
33 | "you're likely to be disconnected and leave the upgrade procedure unfinished." | ||
34 | msgstr "" | ||
35 | "És possible que la versió de «/etc/init.d/ssh» que teniu instal·lada " | ||
36 | "actualment aturi les instà ncies de l'sshd que s'estan executant. Si esteu " | ||
37 | "actualitzant des d'una sessió SSH, és possible que es talli la connexió i " | ||
38 | "quedi el procés d'actualització a mitges." | ||
39 | |||
40 | #. Type: boolean | ||
41 | #. Description | ||
42 | #: ../openssh-server.templates:1001 | ||
43 | msgid "" | ||
44 | "This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the " | ||
45 | "start-stop-daemon line in the stop section of the file." | ||
46 | msgstr "" | ||
47 | "Ho podeu arreglar afegint «--pidfile /var/run/sshd.pid» a la lÃnia «start-stop-" | ||
48 | "daemon» de la secció «stop» del mateix fitxer." | ||
49 | |||
50 | #. Type: note | ||
51 | #. Description | ||
52 | #: ../openssh-server.templates:2001 | ||
53 | msgid "New host key mandatory" | ||
54 | msgstr "Nova clau obligatòria" | ||
55 | |||
56 | #. Type: note | ||
57 | #. Description | ||
58 | #: ../openssh-server.templates:2001 | ||
59 | msgid "" | ||
60 | "The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA " | ||
61 | "algorithm. OpenSSH can not handle this host key file, and the ssh-keygen " | ||
62 | "utility from the old (non-free) SSH installation does not appear to be " | ||
63 | "available." | ||
64 | msgstr "" | ||
65 | "L'actual clau de la mà quina, a /etc/ssh/ssh_host_key, està xifrada amb " | ||
66 | "l'algorisme IDEA. OpenSSH no pot gestionar aquest fitxer de clau, i no es " | ||
67 | "pot trobar l'eina ssh-keygen de la instal·lació d'SSH anterior (non-free)." | ||
68 | |||
69 | #. Type: note | ||
70 | #. Description | ||
71 | #: ../openssh-server.templates:2001 | ||
72 | msgid "You need to manually generate a new host key." | ||
73 | msgstr "Haureu de generar manualment una nova clau per a la mà quina." | ||
74 | |||
75 | #. Type: boolean | ||
76 | #. Description | ||
77 | #: ../openssh-server.templates:3001 | ||
78 | msgid "Disable challenge-response authentication?" | ||
79 | msgstr "Voleu desactivar l'autenticació «challenge-response»?" | ||
80 | |||
81 | #. Type: boolean | ||
82 | #. Description | ||
83 | #: ../openssh-server.templates:3001 | ||
84 | msgid "" | ||
85 | "Password authentication appears to be disabled in the current OpenSSH server " | ||
86 | "configuration. In order to prevent users from logging in using passwords " | ||
87 | "(perhaps using only public key authentication instead) with recent versions " | ||
88 | "of OpenSSH, you must disable challenge-response authentication, or else " | ||
89 | "ensure that your PAM configuration does not allow Unix password file " | ||
90 | "authentication." | ||
91 | msgstr "" | ||
92 | "Sembla que l'autenticació per contrasenya està desactivada en l'actual " | ||
93 | "configuració del servidor OpenSSH. Per tal d'evitar que els usuaris entrin " | ||
94 | "al sistema utilitzant contrasenyes (i utilitzin només autenticació basada en " | ||
95 | "clau pública), en les darreres versions d'OpenSSH heu de desactivar " | ||
96 | "l'autenticació «challenge-response», o altrament assegurar-vos que la " | ||
97 | "configuració de PAM no permet autenticar mitjançant el fitxer de " | ||
98 | "contrasenyes de Unix." | ||
99 | |||
100 | #. Type: boolean | ||
101 | #. Description | ||
102 | #: ../openssh-server.templates:3001 | ||
103 | msgid "" | ||
104 | "If you disable challenge-response authentication, then users will not be " | ||
105 | "able to log in using passwords. If you leave it enabled (the default " | ||
106 | "answer), then the 'PasswordAuthentication no' option will have no useful " | ||
107 | "effect unless you also adjust your PAM configuration in /etc/pam.d/ssh." | ||
108 | msgstr "" | ||
109 | "Si desactiveu l'autenticació «challenge-response», aleshores els usuaris no " | ||
110 | "podran entrar utilitzant contrasenyes. Si la deixeu activada (que és l'opció " | ||
111 | "predeterminada), aleshores «PasswordAuthentication no» no tindrà cap valor a " | ||
112 | "menys que ajusteu la configuració de PAM a /etc/pam.d/ssh." | ||
113 | |||
114 | #. Type: note | ||
115 | #. Description | ||
116 | #: ../openssh-server.templates:4001 | ||
117 | msgid "Vulnerable host keys will be regenerated" | ||
118 | msgstr "" | ||
119 | |||
120 | #. Type: note | ||
121 | #. Description | ||
122 | #: ../openssh-server.templates:4001 | ||
123 | msgid "" | ||
124 | "Some of the OpenSSH server host keys on this system were generated with a " | ||
125 | "version of OpenSSL that had a broken random number generator. As a result, " | ||
126 | "these host keys are from a well-known set, are subject to brute-force " | ||
127 | "attacks, and must be regenerated." | ||
128 | msgstr "" | ||
129 | |||
130 | #. Type: note | ||
131 | #. Description | ||
132 | #: ../openssh-server.templates:4001 | ||
133 | msgid "" | ||
134 | "Users of this system should be informed of this change, as they will be " | ||
135 | "prompted about the host key change the next time they log in. Use 'ssh-" | ||
136 | "keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of " | ||
137 | "the new host keys." | ||
138 | msgstr "" | ||
139 | |||
140 | #. Type: note | ||
141 | #. Description | ||
142 | #: ../openssh-server.templates:4001 | ||
143 | msgid "The affected host keys are:" | ||
144 | msgstr "" | ||
145 | |||
146 | #. Type: note | ||
147 | #. Description | ||
148 | #: ../openssh-server.templates:4001 | ||
149 | msgid "" | ||
150 | "User keys may also be affected by this problem. The 'ssh-vulnkey' command " | ||
151 | "may be used as a partial test for this. See /usr/share/doc/openssh-server/" | ||
152 | "README.compromised-keys.gz for more details." | ||
153 | msgstr "" | ||
154 | |||
155 | #~ msgid "Generate a new configuration file for OpenSSH?" | ||
156 | #~ msgstr "Voleu generar un nou fitxer de configuració per a l'OpenSSH?" | ||
157 | |||
158 | #~ msgid "" | ||
159 | #~ "This version of OpenSSH has a considerably changed configuration file " | ||
160 | #~ "from the version shipped in Debian 'Potato', which you appear to be " | ||
161 | #~ "upgrading from. This package can now generate a new configuration file (/" | ||
162 | #~ "etc/ssh/sshd.config), which will work with the new server version, but " | ||
163 | #~ "will not contain any customizations you made with the old version." | ||
164 | #~ msgstr "" | ||
165 | #~ "Els fitxers de configuració de l'OpenSSH s'han modificat considerablement " | ||
166 | #~ "respecte als de Debian «Potato», versió des de la qual sembla que esteu " | ||
167 | #~ "actualitzant. Aquest paquet pot generar ara un nou fitxer de configuració " | ||
168 | #~ "(/etc/sshd/sshd.config), que funcionarà amb la nova versió del servidor " | ||
169 | #~ "però no contindrà els parà metres de configuració personalitzats de la " | ||
170 | #~ "versió anterior." | ||
171 | |||
172 | #~ msgid "" | ||
173 | #~ "Please note that this new configuration file will set the value of " | ||
174 | #~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password " | ||
175 | #~ "can ssh directly in as root). Please read the README.Debian file for more " | ||
176 | #~ "details about this design choice." | ||
177 | #~ msgstr "" | ||
178 | #~ "Tingueu en compte que el nou fitxer de configuració establirà el valor de " | ||
179 | #~ "«PermitRootLogin» a «yes» (és a dir, qualsevol que conegui la contrasenya " | ||
180 | #~ "de root podrà connectar-se directament mitjançant ssh). Si us plau, " | ||
181 | #~ "llegiu el fitxer README.Debian per a més detalls sobre aquesta opció." | ||
182 | |||
183 | #~ msgid "" | ||
184 | #~ "It is strongly recommended that you choose to generate a new " | ||
185 | #~ "configuration file now." | ||
186 | #~ msgstr "" | ||
187 | #~ "És molt recomanable que trieu generar el nou fitxer de configuració ara." | ||
188 | |||
189 | #~ msgid "Warning: you must create a new host key" | ||
190 | #~ msgstr "AvÃs: heu de crear una nova clau del servidor central" | ||
191 | |||
192 | #~ msgid "Warning: telnetd is installed --- probably not a good idea" | ||
193 | #~ msgstr "" | ||
194 | #~ "AvÃs: el telnetd està instal·lat --- probablement no sigui una bona idea" | ||
195 | |||
196 | #~ msgid "" | ||
197 | #~ "I'd advise you to either remove the telnetd package (if you don't " | ||
198 | #~ "actually need to offer telnet access) or install telnetd-ssl so that " | ||
199 | #~ "there is at least some chance that telnet sessions will not be sending " | ||
200 | #~ "unencrypted login/password and session information over the network." | ||
201 | #~ msgstr "" | ||
202 | #~ "Es aconsellable suprimir el paquet telnetd (si no heu d'oferir accés a " | ||
203 | #~ "telnet) o torneu a instal·lar el paquet telnetd-ssl si més no per " | ||
204 | #~ "assegurar que les sessions de telnet no enviaran les informació del nom " | ||
205 | #~ "d'usuari i contrasenya sense xifrar a través de la xarxa." | ||
206 | |||
207 | #~ msgid "Warning: rsh-server is installed --- probably not a good idea" | ||
208 | #~ msgstr "" | ||
209 | #~ "AvÃs: el servidor rsh-server està instal·lat --- probablement no sigui " | ||
210 | #~ "una bona idea" | ||
211 | |||
212 | #~ msgid "" | ||
213 | #~ "having rsh-server installed undermines the security that you were " | ||
214 | #~ "probably wanting to obtain by installing ssh. I'd advise you to remove " | ||
215 | #~ "that package." | ||
216 | #~ msgstr "" | ||
217 | #~ "si teniu instal·lat l'rsh-server perdreu la seguretat que esperà veu " | ||
218 | #~ "obtenir instal·lant l'ssh. És aconsellable suprimir el paquet." | ||
219 | |||
220 | #~ msgid "Do you want ssh-keysign to be installed SUID root?" | ||
221 | #~ msgstr "Voleu que el fitxer ssh-keysign s'instal·li SUID root?" | ||
222 | |||
223 | #~ msgid "" | ||
224 | #~ "You have the option of installing the ssh-keysign helper with the SUID " | ||
225 | #~ "bit set." | ||
226 | #~ msgstr "Podeu instal·lar l'ajudant del ssh-keysign amb el bit SUID definit." | ||
227 | |||
228 | #~ msgid "" | ||
229 | #~ "If you make ssh-keysign SUID, you will be able to use SSH's Protocol 2 " | ||
230 | #~ "host-based authentication." | ||
231 | #~ msgstr "" | ||
232 | #~ "Si definiu l'ssh-keysign SUID podreu utilitzat l'autenticació basada en " | ||
233 | #~ "l'ordinador central del Protocol 2 de l'SSH." | ||
234 | |||
235 | #~ msgid "" | ||
236 | #~ "If in doubt, I suggest you install it with SUID. If it causes problems " | ||
237 | #~ "you can change your mind later by running: dpkg-reconfigure ssh" | ||
238 | #~ msgstr "" | ||
239 | #~ "Si dubteu instal·leu-lo amb el SUID. Si us causa algun problema ho podeu " | ||
240 | #~ "modificar posteriorment executant l'ordre: dpkg-reconfigure ssh" | ||
241 | |||
242 | #~ msgid "Allow SSH protocol 2 only" | ||
243 | #~ msgstr "Permet únicament la versió 2 del protocol d'SSH" | ||
244 | |||
245 | #~ msgid "" | ||
246 | #~ "This version of OpenSSH supports version 2 of the ssh protocol, which is " | ||
247 | #~ "much more secure. Disabling ssh 1 is encouraged, however this will slow " | ||
248 | #~ "things down on low end machines and might prevent older clients from " | ||
249 | #~ "connecting (the ssh client shipped with \"potato\" is affected)." | ||
250 | #~ msgstr "" | ||
251 | #~ "Aquesta versió de l'OpenSSH suporta la versió 2 del protocol d'ssh, " | ||
252 | #~ "aquesta versió és molt més segura. És recomanable inhabilitar la versió 1 " | ||
253 | #~ "del protocol, tot i que això alentirà el funcionament dels ordinadors més " | ||
254 | #~ "antics i no permetrà les connexions als clients antics (afectarà al " | ||
255 | #~ "client proporcionat per la \"potato\")." | ||
256 | |||
257 | #~ msgid "" | ||
258 | #~ "Also please note that keys used for protocol 1 are different so you will " | ||
259 | #~ "not be able to use them if you only allow protocol 2 connections." | ||
260 | #~ msgstr "" | ||
261 | #~ "Recordeu que les claus que utilitza la versió 1 del protocol són " | ||
262 | #~ "diferents i no les podreu utilitzar si habiliteu únicament les connexions " | ||
263 | #~ "de la versió 2 del protocol." | ||
264 | |||
265 | #~ msgid "" | ||
266 | #~ "If you later change your mind about this setting, README.Debian has " | ||
267 | #~ "instructions on what to do to your sshd_config file." | ||
268 | #~ msgstr "" | ||
269 | #~ "Si posteriorment canvieu d'opinió respecte a la configuració, podeu " | ||
270 | #~ "trobar les instruccions per modificar el fitxer sshd_config a README." | ||
271 | #~ "Debian." | ||
272 | |||
273 | #~ msgid "NOTE: Forwarding of X11 and Authorization disabled by default." | ||
274 | #~ msgstr "" | ||
275 | #~ "Nota: les opcions de reenviament de les X11 i autorització estan " | ||
276 | #~ "inhabilitades per defecte." | ||
277 | |||
278 | #~ msgid "" | ||
279 | #~ "For security reasons, the Debian version of ssh has ForwardX11 and " | ||
280 | #~ "ForwardAgent set to ``off'' by default." | ||
281 | #~ msgstr "" | ||
282 | #~ "Per raons de seguretat i de forma predeterminada la versió d'ssh de " | ||
283 | #~ "Debian té les opcions ForwardX11 i ForwardAgent definides a \"off\"." | ||
284 | |||
285 | #~ msgid "" | ||
286 | #~ "You can enable it for servers you trust, either in one of the " | ||
287 | #~ "configuration files, or with the -X command line option." | ||
288 | #~ msgstr "" | ||
289 | #~ "Ho podeu habilitar pels servidors de confiança, ja sigui en un dels " | ||
290 | #~ "fitxers de configuració o a través de l'opció de la lÃnia d'ordre -X." | ||
291 | |||
292 | #~ msgid "More details can be found in /usr/share/doc/ssh/README.Debian" | ||
293 | #~ msgstr "" | ||
294 | #~ "Podeu trobar més informació al fitxer /usr/share/doc/ssh/README.Debian" | ||
295 | |||
296 | #~ msgid "ssh2 keys merged in configuration files" | ||
297 | #~ msgstr "S'han combinat les claus de l'ssh2 als fitxers de configuració" | ||
298 | |||
299 | #~ msgid "" | ||
300 | #~ "As of version 3 OpenSSH no longer uses separate files for ssh1 and ssh2 " | ||
301 | #~ "keys. This means the authorized_keys2 and known_hosts2 files are no " | ||
302 | #~ "longer needed. They will still be read in order to maintain backwards " | ||
303 | #~ "compatibility" | ||
304 | #~ msgstr "" | ||
305 | #~ "Des de la versió 3 de l'OpenSSH ja no s'utilitzaran fitxers separats per " | ||
306 | #~ "les claus de l'ssh1 i ssg2. Ja no caldran els fitxer authorized_keys2 i " | ||
307 | #~ "known_hosts2. Es continuaran llegint per mantenir la compatibilitat amb " | ||
308 | #~ "les versions anteriors." | ||
309 | |||
310 | #~ msgid "Do you want to run the sshd server?" | ||
311 | #~ msgstr "Voleu executar el servidor d'sshd?" | ||
312 | |||
313 | #~ msgid "This package contains both the ssh client, and the sshd server." | ||
314 | #~ msgstr "El paquet conté el client i el servidor d'ssh." | ||
315 | |||
316 | #~ msgid "" | ||
317 | #~ "Normally the sshd Secure Shell Server will be run to allow remote logins " | ||
318 | #~ "via ssh." | ||
319 | #~ msgstr "" | ||
320 | #~ "L'sshd (servidor de l'intèrpret d'ordres segur) s'executarà , normalment, " | ||
321 | #~ "per permetre l'entrada remota a través de l'ssh." | ||
322 | |||
323 | #~ msgid "" | ||
324 | #~ "If you are only interested in using the ssh client for outbound " | ||
325 | #~ "connections on this machine, and don't want to log into it at all using " | ||
326 | #~ "ssh, then you can disable sshd here." | ||
327 | #~ msgstr "" | ||
328 | #~ "Podeu inhabilitar l'sshd si voleu utilitzar el client d'ssh únicament per " | ||
329 | #~ "connexions a l'exterior i no per acceptar connexions remotes." | ||
330 | |||
331 | #~ msgid "Environment options on keys have been deprecated" | ||
332 | #~ msgstr "S'ha prohibit les opcions d'entorn a les claus." | ||
333 | |||
334 | #~ msgid "" | ||
335 | #~ "This version of OpenSSH disables the environment option for public keys " | ||
336 | #~ "by default, in order to avoid certain attacks (for example, LD_PRELOAD). " | ||
337 | #~ "If you are using this option in an authorized_keys file, beware that the " | ||
338 | #~ "keys in question will no longer work until the option is removed." | ||
339 | #~ msgstr "" | ||
340 | #~ "L'OpenSSH inhabilita, per defecte i per evitar diversos atacs (per " | ||
341 | #~ "exemple LD_PRELOAD), les opcions d'entorn per les claus públiques. Si " | ||
342 | #~ "utilitzeu aquesta opció al fitxer authorized_keys recordeu que les claus " | ||
343 | #~ "de la qüestió no funcionaran fins que no se suprimeixi l'opció." | ||
344 | |||
345 | #~ msgid "" | ||
346 | #~ "To re-enable this option, set \"PermitUserEnvironment yes\" in /etc/ssh/" | ||
347 | #~ "sshd_config after the upgrade is complete, taking note of the warning in " | ||
348 | #~ "the sshd_config(5) manual page." | ||
349 | #~ msgstr "" | ||
350 | #~ "Per tornar a habilitar l'opció definiu \"PermitUserEnvironment yes\" al " | ||
351 | #~ "fitxer /etc/ssh/sshd_config al finalitzar l'actualització (recordeu la " | ||
352 | #~ "nota d'avÃs de la pà gina del manual sshd_config(5)). " | ||
diff --git a/debian/po/cs.po b/debian/po/cs.po new file mode 100644 index 000000000..5e023da5f --- /dev/null +++ b/debian/po/cs.po | |||
@@ -0,0 +1,357 @@ | |||
1 | # | ||
2 | # Translators, if you are not familiar with the PO format, gettext | ||
3 | # documentation is worth reading, especially sections dedicated to | ||
4 | # this format, e.g. by running: | ||
5 | # info -n '(gettext)PO Files' | ||
6 | # info -n '(gettext)Header Entry' | ||
7 | # | ||
8 | # Some information specific to po-debconf are available at | ||
9 | # /usr/share/doc/po-debconf/README-trans | ||
10 | # or http://www.debian.org/intl/l10n/po-debconf/README-trans | ||
11 | # | ||
12 | # Developers do not need to manually edit POT or PO files. | ||
13 | # | ||
14 | msgid "" | ||
15 | msgstr "" | ||
16 | "Project-Id-Version: openssh\n" | ||
17 | "Report-Msgid-Bugs-To: openssh@packages.debian.org\n" | ||
18 | "POT-Creation-Date: 2010-01-02 08:55+0000\n" | ||
19 | "PO-Revision-Date: 2008-05-17 14:49+0200\n" | ||
20 | "Last-Translator: Miroslav Kure <kurem@debian.cz>\n" | ||
21 | "Language-Team: Czech <debian-l10n-czech@lists.debian.org>\n" | ||
22 | "MIME-Version: 1.0\n" | ||
23 | "Content-Type: text/plain; charset=UTF-8\n" | ||
24 | "Content-Transfer-Encoding: 8bit\n" | ||
25 | |||
26 | #. Type: boolean | ||
27 | #. Description | ||
28 | #: ../openssh-server.templates:1001 | ||
29 | msgid "Do you want to risk killing active SSH sessions?" | ||
30 | msgstr "Chcete riskovat ukonÄenà aktivnÃch SSH spojenÃ?" | ||
31 | |||
32 | #. Type: boolean | ||
33 | #. Description | ||
34 | #: ../openssh-server.templates:1001 | ||
35 | msgid "" | ||
36 | "The currently installed version of /etc/init.d/ssh is likely to kill all " | ||
37 | "running sshd instances. If you are doing this upgrade via an SSH session, " | ||
38 | "you're likely to be disconnected and leave the upgrade procedure unfinished." | ||
39 | msgstr "" | ||
40 | "StávajÃcà verze /etc/init.d/ssh pravdÄ›podobnÄ› pozabÃjà vÅ¡echny běžÃcà " | ||
41 | "instance sshd. Pokud tuto aktualizaci provádÃte pÅ™es SSH, budete nejspÃÅ¡e " | ||
42 | "odpojeni a aktualizace skonÄà na půli cesty." | ||
43 | |||
44 | #. Type: boolean | ||
45 | #. Description | ||
46 | #: ../openssh-server.templates:1001 | ||
47 | msgid "" | ||
48 | "This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the " | ||
49 | "start-stop-daemon line in the stop section of the file." | ||
50 | msgstr "" | ||
51 | "Můžete to spravit ruÄnÃm pÅ™idánÃm „--pidfile /var/run/sshd.pid“ na řádek " | ||
52 | "start-stop-daemon v sekci stop." | ||
53 | |||
54 | #. Type: note | ||
55 | #. Description | ||
56 | #: ../openssh-server.templates:2001 | ||
57 | msgid "New host key mandatory" | ||
58 | msgstr "Nutný nový serverový klÃÄ" | ||
59 | |||
60 | #. Type: note | ||
61 | #. Description | ||
62 | #: ../openssh-server.templates:2001 | ||
63 | msgid "" | ||
64 | "The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA " | ||
65 | "algorithm. OpenSSH can not handle this host key file, and the ssh-keygen " | ||
66 | "utility from the old (non-free) SSH installation does not appear to be " | ||
67 | "available." | ||
68 | msgstr "" | ||
69 | "Aktuálnà serverový klÃÄ v /etc/ssh/ssh_host_key je Å¡ifrovaný algoritmem " | ||
70 | "IDEA. OpenSSH neumà tento soubor zpracovat a zdá se, že utilita ssh-keygen " | ||
71 | "ze staré (nesvobodné) instalace SSH nenà k dispozici." | ||
72 | |||
73 | #. Type: note | ||
74 | #. Description | ||
75 | #: ../openssh-server.templates:2001 | ||
76 | msgid "You need to manually generate a new host key." | ||
77 | msgstr "MusÃte ruÄnÄ› vygenerovat nový serverový klÃÄ" | ||
78 | |||
79 | #. Type: boolean | ||
80 | #. Description | ||
81 | #: ../openssh-server.templates:3001 | ||
82 | msgid "Disable challenge-response authentication?" | ||
83 | msgstr "Zakázat autentizaci challenge-response?" | ||
84 | |||
85 | #. Type: boolean | ||
86 | #. Description | ||
87 | #: ../openssh-server.templates:3001 | ||
88 | msgid "" | ||
89 | "Password authentication appears to be disabled in the current OpenSSH server " | ||
90 | "configuration. In order to prevent users from logging in using passwords " | ||
91 | "(perhaps using only public key authentication instead) with recent versions " | ||
92 | "of OpenSSH, you must disable challenge-response authentication, or else " | ||
93 | "ensure that your PAM configuration does not allow Unix password file " | ||
94 | "authentication." | ||
95 | msgstr "" | ||
96 | "Zdá se, že autentizace pomocà hesel je ve vaÅ¡Ã stávajÃcà konfiguraci OpenSSH " | ||
97 | "serveru zakázána. Abyste zabránili uživatelům v přihlášenà pouze pomocà " | ||
98 | "hesla, musÃte v poslednÃch verzÃch OpenSSH zakázat autentizaci challenge-" | ||
99 | "response, nebo jinak zajistit, aby PAM nepovolilo autentizaci vůÄi unixovému " | ||
100 | "souboru hesel." | ||
101 | |||
102 | #. Type: boolean | ||
103 | #. Description | ||
104 | #: ../openssh-server.templates:3001 | ||
105 | msgid "" | ||
106 | "If you disable challenge-response authentication, then users will not be " | ||
107 | "able to log in using passwords. If you leave it enabled (the default " | ||
108 | "answer), then the 'PasswordAuthentication no' option will have no useful " | ||
109 | "effect unless you also adjust your PAM configuration in /etc/pam.d/ssh." | ||
110 | msgstr "" | ||
111 | "Zakážete-li autentizaci challenge-response, uživatelé se nebudou moci " | ||
112 | "pÅ™ihlásit pomocà hesel. Necháte-li ji povolenu (pÅ™ednastavená odpovÄ›Ä), pak " | ||
113 | "nebude mÃt volba „PasswordAuthentication no“ žádný efekt, pokud ovÅ¡em " | ||
114 | "neupravÃte nastavenà PAM v /etc/pam.d/ssh." | ||
115 | |||
116 | #. Type: note | ||
117 | #. Description | ||
118 | #: ../openssh-server.templates:4001 | ||
119 | msgid "Vulnerable host keys will be regenerated" | ||
120 | msgstr "Zranitelné serverové klÃÄe budou pÅ™egenerovány" | ||
121 | |||
122 | #. Type: note | ||
123 | #. Description | ||
124 | #: ../openssh-server.templates:4001 | ||
125 | msgid "" | ||
126 | "Some of the OpenSSH server host keys on this system were generated with a " | ||
127 | "version of OpenSSL that had a broken random number generator. As a result, " | ||
128 | "these host keys are from a well-known set, are subject to brute-force " | ||
129 | "attacks, and must be regenerated." | ||
130 | msgstr "" | ||
131 | "NÄ›které serverové klÃÄe OpenSSH na tomto systému byly vytvoÅ™eny verzà " | ||
132 | "OpenSSL, která mÄ›la naruÅ¡ený generátor náhodných ÄÃsel. Ve výsledku jsou " | ||
133 | "tyto dobÅ™e známé klÃÄe pÅ™edmÄ›tem útoků hrubou silou a musà být pÅ™egenerovány." | ||
134 | |||
135 | #. Type: note | ||
136 | #. Description | ||
137 | #: ../openssh-server.templates:4001 | ||
138 | msgid "" | ||
139 | "Users of this system should be informed of this change, as they will be " | ||
140 | "prompted about the host key change the next time they log in. Use 'ssh-" | ||
141 | "keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of " | ||
142 | "the new host keys." | ||
143 | msgstr "" | ||
144 | "Uživatelé tohoto systému by měli být informováni o změně, protože budou při " | ||
145 | "pÅ™ÃÅ¡tÃm pÅ™ihlášenà varováni o zmÄ›nÄ› serverového klÃÄe. Po aktualizaci můžete " | ||
146 | "zjistit nové otisky serverových klÃÄů pÅ™Ãkazem „ssh-keygen -l -f " | ||
147 | "SOUBOR_SE_SERVEROVÃM_KLÃÄŒEM“." | ||
148 | |||
149 | #. Type: note | ||
150 | #. Description | ||
151 | #: ../openssh-server.templates:4001 | ||
152 | msgid "The affected host keys are:" | ||
153 | msgstr "Postižené serverové klÃÄe:" | ||
154 | |||
155 | #. Type: note | ||
156 | #. Description | ||
157 | #: ../openssh-server.templates:4001 | ||
158 | msgid "" | ||
159 | "User keys may also be affected by this problem. The 'ssh-vulnkey' command " | ||
160 | "may be used as a partial test for this. See /usr/share/doc/openssh-server/" | ||
161 | "README.compromised-keys.gz for more details." | ||
162 | msgstr "" | ||
163 | "TÃmto problémem mohou být postiženy také uživatelské klÃÄe. Pro ÄásteÄnou " | ||
164 | "kontrolu můžete použÃt pÅ™Ãkaz „ssh-vulnkey“. VÃce informacà naleznete v " | ||
165 | "souboru /usr/share/doc/openssh-server/README.compromised-keys.gz." | ||
166 | |||
167 | #~ msgid "Generate a new configuration file for OpenSSH?" | ||
168 | #~ msgstr "VytvoÅ™it nový konfiguraÄnà soubor OpenSSH?" | ||
169 | |||
170 | #~ msgid "" | ||
171 | #~ "This version of OpenSSH has a considerably changed configuration file " | ||
172 | #~ "from the version shipped in Debian 'Potato', which you appear to be " | ||
173 | #~ "upgrading from. This package can now generate a new configuration file (/" | ||
174 | #~ "etc/ssh/sshd.config), which will work with the new server version, but " | ||
175 | #~ "will not contain any customizations you made with the old version." | ||
176 | #~ msgstr "" | ||
177 | #~ "Tato verze OpenSSH má oproti verzi dodávané s Debianem 2.2, kterou nynà " | ||
178 | #~ "pravdÄ›podobnÄ› aktualizujete, znaÄnÄ› odliÅ¡ný konfiguraÄnà soubor. BalÃk " | ||
179 | #~ "nynà může vytvoÅ™it nový konfiguraÄnà soubor (/etc/ssh/sshd.config), který " | ||
180 | #~ "bude fungovat s novou verzà serveru, ale nebude obsahovat žádné úpravy, " | ||
181 | #~ "které jste provedli ve staré verzi." | ||
182 | |||
183 | #~ msgid "" | ||
184 | #~ "Please note that this new configuration file will set the value of " | ||
185 | #~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password " | ||
186 | #~ "can ssh directly in as root). Please read the README.Debian file for more " | ||
187 | #~ "details about this design choice." | ||
188 | #~ msgstr "" | ||
189 | #~ "V novém konfiguraÄnÃm souboru bude parametr PermitRootLogin nastaven na " | ||
190 | #~ "hodnotu „yes“. To znamená, že se kdokoliv se znalostà rootova hesla může " | ||
191 | #~ "pÅ™ihlásit rovnou jako root. VÃce o tomto rozhodnutà se dozvÃte v souboru " | ||
192 | #~ "README.Debian." | ||
193 | |||
194 | #~ msgid "" | ||
195 | #~ "It is strongly recommended that you choose to generate a new " | ||
196 | #~ "configuration file now." | ||
197 | #~ msgstr "" | ||
198 | #~ "Je vÅ™ele doporuÄeno nechat si nynà vytvoÅ™it nový konfiguraÄnà soubor." | ||
199 | |||
200 | #~ msgid "Warning: you must create a new host key" | ||
201 | #~ msgstr "VarovánÃ: musÃte vytvoÅ™it nový serverový klÃÄ" | ||
202 | |||
203 | #~ msgid "Warning: telnetd is installed --- probably not a good idea" | ||
204 | #~ msgstr "VarovánÃ: je nainstalován telnetd --- to nenà dobrý nápad" | ||
205 | |||
206 | #~ msgid "" | ||
207 | #~ "I'd advise you to either remove the telnetd package (if you don't " | ||
208 | #~ "actually need to offer telnet access) or install telnetd-ssl so that " | ||
209 | #~ "there is at least some chance that telnet sessions will not be sending " | ||
210 | #~ "unencrypted login/password and session information over the network." | ||
211 | #~ msgstr "" | ||
212 | #~ "DoporuÄujeme buÄ odstranit balÃk telnetd (pokud telnet pÅ™Ãstup " | ||
213 | #~ "nepotřebujete), nebo nainstalovat telnetd-ssl, kde je alespoň nějaká " | ||
214 | #~ "Å¡ance, že spojenà nebudou po sÃti zasÃlat nezaÅ¡ifrovaná jména/hesla/" | ||
215 | #~ "informace." | ||
216 | |||
217 | #~ msgid "Warning: rsh-server is installed --- probably not a good idea" | ||
218 | #~ msgstr "VarovánÃ: je nainstalován rsh-server --- to nenà dobrý nápad" | ||
219 | |||
220 | #~ msgid "" | ||
221 | #~ "having rsh-server installed undermines the security that you were " | ||
222 | #~ "probably wanting to obtain by installing ssh. I'd advise you to remove " | ||
223 | #~ "that package." | ||
224 | #~ msgstr "" | ||
225 | #~ "nainstalovánÃm rsh-server si bouráte bezpeÄnost, kterou jste " | ||
226 | #~ "pravdÄ›podobnÄ› chtÄ›li dosáhnout instalacà ssh. DoporuÄujeme tento balÃk " | ||
227 | #~ "odstranit." | ||
228 | |||
229 | #~ msgid "Do you want ssh-keysign to be installed SUID root?" | ||
230 | #~ msgstr "Chcete ssh-keysign nainstalovat jako SUID root?" | ||
231 | |||
232 | #~ msgid "" | ||
233 | #~ "You have the option of installing the ssh-keysign helper with the SUID " | ||
234 | #~ "bit set." | ||
235 | #~ msgstr "" | ||
236 | #~ "Můžete si vybrat, zda chcete nainstalovat ssh-keysign s nastaveným SUID " | ||
237 | #~ "bitem." | ||
238 | |||
239 | #~ msgid "" | ||
240 | #~ "If you make ssh-keysign SUID, you will be able to use SSH's Protocol 2 " | ||
241 | #~ "host-based authentication." | ||
242 | #~ msgstr "" | ||
243 | #~ "Pokud nastavÃte ssh-keysign SUID, můžete použÃvat „host-based“ " | ||
244 | #~ "autentizaci protokolu verze 2." | ||
245 | |||
246 | #~ msgid "" | ||
247 | #~ "If in doubt, I suggest you install it with SUID. If it causes problems " | ||
248 | #~ "you can change your mind later by running: dpkg-reconfigure ssh" | ||
249 | #~ msgstr "" | ||
250 | #~ "Pokud jste na pochybách, doporuÄujeme SUID bit povolit. Pokud zaznamenáte " | ||
251 | #~ "problémy, můžete nastavenà zmÄ›nit spuÅ¡tÄ›nÃm: dpkg-reconfigure ssh" | ||
252 | |||
253 | #~ msgid "Allow SSH protocol 2 only" | ||
254 | #~ msgstr "Povolit pouze SSH protokol verze 2" | ||
255 | |||
256 | #~ msgid "" | ||
257 | #~ "This version of OpenSSH supports version 2 of the ssh protocol, which is " | ||
258 | #~ "much more secure. Disabling ssh 1 is encouraged, however this will slow " | ||
259 | #~ "things down on low end machines and might prevent older clients from " | ||
260 | #~ "connecting (the ssh client shipped with \"potato\" is affected)." | ||
261 | #~ msgstr "" | ||
262 | #~ "Tato verze OpenSSH podporuje ssh protokol ve verzi 2, který je mnohem " | ||
263 | #~ "bezpeÄnÄ›jÅ¡Ã. Je dobré ssh verze 1 zakázat, nicménÄ› na slabÅ¡Ãch poÄÃtaÄÃch " | ||
264 | #~ "se projevà zpomalenà a také tÃm znemožnÃte pÅ™ihlášenà starÅ¡Ãch klientů " | ||
265 | #~ "(napÅ™Ãklad tÄ›ch z Debianu 2.2)." | ||
266 | |||
267 | #~ msgid "" | ||
268 | #~ "Also please note that keys used for protocol 1 are different so you will " | ||
269 | #~ "not be able to use them if you only allow protocol 2 connections." | ||
270 | #~ msgstr "" | ||
271 | #~ "Také si vÅ¡imnÄ›te, že klÃÄe protokolu verze 1 jsou odliÅ¡né a pokud " | ||
272 | #~ "povolÃte pouze protokol verze 2, nebudete je moci použÃt. " | ||
273 | |||
274 | #~ msgid "" | ||
275 | #~ "If you later change your mind about this setting, README.Debian has " | ||
276 | #~ "instructions on what to do to your sshd_config file." | ||
277 | #~ msgstr "" | ||
278 | #~ "Pokud se později rozhodnete jinak, v README.Debian se nacházà přesný " | ||
279 | #~ "návod, jak upravit soubor sshd_config." | ||
280 | |||
281 | #~ msgid "ssh2 keys merged in configuration files" | ||
282 | #~ msgstr "KlÃÄe ssh2 v konfiguraÄnÃch souborech byly spojeny" | ||
283 | |||
284 | #~ msgid "" | ||
285 | #~ "As of version 3 OpenSSH no longer uses separate files for ssh1 and ssh2 " | ||
286 | #~ "keys. This means the authorized_keys2 and known_hosts2 files are no " | ||
287 | #~ "longer needed. They will still be read in order to maintain backwards " | ||
288 | #~ "compatibility" | ||
289 | #~ msgstr "" | ||
290 | #~ "OpenSSH verze 3 již nepoužÃvá oddÄ›lené soubory pro klÃÄe verze ssh1 a " | ||
291 | #~ "ssh2. To znamená, že soubory authorized_keys2 a known_hosts2 již nejsou " | ||
292 | #~ "potřeba, ovšem z důvodů zachovánà zpětné kompatibility jsou stále " | ||
293 | #~ "naÄÃtány." | ||
294 | |||
295 | #~ msgid "NOTE: Forwarding of X11 and Authorization disabled by default." | ||
296 | #~ msgstr "POZNÃMKA: Autorizace a pÅ™esmÄ›rovánà X11 je standardnÄ› vypnuto." | ||
297 | |||
298 | #~ msgid "" | ||
299 | #~ "For security reasons, the Debian version of ssh has ForwardX11 and " | ||
300 | #~ "ForwardAgent set to ``off'' by default." | ||
301 | #~ msgstr "" | ||
302 | #~ "Z bezpeÄnostnÃch důvodů má verze ssh v Debianu standardnÄ› nastavené " | ||
303 | #~ "ForwardX11 a ForwardAgent na hodnotu „off“." | ||
304 | |||
305 | #~ msgid "" | ||
306 | #~ "You can enable it for servers you trust, either in one of the " | ||
307 | #~ "configuration files, or with the -X command line option." | ||
308 | #~ msgstr "" | ||
309 | #~ "Pro servery, kterým důvěřujete, můžete tyto parametry povolit v jednom z " | ||
310 | #~ "konfiguraÄnÃch souborů, nebo z pÅ™Ãkazové řádky parametrem -X." | ||
311 | |||
312 | #~ msgid "More details can be found in /usr/share/doc/ssh/README.Debian" | ||
313 | #~ msgstr "VÃce naleznete v /usr/share/doc/ssh/README.Debian" | ||
314 | |||
315 | #~ msgid "Do you want to run the sshd server?" | ||
316 | #~ msgstr "Chcete spustit sshd server?" | ||
317 | |||
318 | #~ msgid "This package contains both the ssh client, and the sshd server." | ||
319 | #~ msgstr "Tento balÃk obsahuje jak klienta ssh, tak server sshd." | ||
320 | |||
321 | #~ msgid "" | ||
322 | #~ "Normally the sshd Secure Shell Server will be run to allow remote logins " | ||
323 | #~ "via ssh." | ||
324 | #~ msgstr "" | ||
325 | #~ "Obvykle se sshd (Secure Shell Server) spouÅ¡tÃ, aby se vzdálenà uživatelé " | ||
326 | #~ "mohli přihlašovat přes ssh." | ||
327 | |||
328 | #~ msgid "" | ||
329 | #~ "If you are only interested in using the ssh client for outbound " | ||
330 | #~ "connections on this machine, and don't want to log into it at all using " | ||
331 | #~ "ssh, then you can disable sshd here." | ||
332 | #~ msgstr "" | ||
333 | #~ "Pokud na tomto poÄÃtaÄi chcete využÃvat pouze ssh klienta pro odchozà " | ||
334 | #~ "spojenÃ, můžete zde sshd zakázat." | ||
335 | |||
336 | #~ msgid "Environment options on keys have been deprecated" | ||
337 | #~ msgstr "Volby prostÅ™edà spojené s klÃÄi jsou zakázány" | ||
338 | |||
339 | #~ msgid "" | ||
340 | #~ "This version of OpenSSH disables the environment option for public keys " | ||
341 | #~ "by default, in order to avoid certain attacks (for example, LD_PRELOAD). " | ||
342 | #~ "If you are using this option in an authorized_keys file, beware that the " | ||
343 | #~ "keys in question will no longer work until the option is removed." | ||
344 | #~ msgstr "" | ||
345 | #~ "Pro zamezenà urÄitých typů útoků (napÅ™. LD_PRELOAD), tato verze OpenSSH " | ||
346 | #~ "standardnÄ› zabraňuje použÃvat volbu prostÅ™edà u veÅ™ejných klÃÄů. Pokud " | ||
347 | #~ "tuto volbu použÃváte v souboru authorized_keys, tak postižené klÃÄe " | ||
348 | #~ "nebudou fungovat, dokud jim tuto volbu nesmažete." | ||
349 | |||
350 | #~ msgid "" | ||
351 | #~ "To re-enable this option, set \"PermitUserEnvironment yes\" in /etc/ssh/" | ||
352 | #~ "sshd_config after the upgrade is complete, taking note of the warning in " | ||
353 | #~ "the sshd_config(5) manual page." | ||
354 | #~ msgstr "" | ||
355 | #~ "Pro znovupovolenà této volby si po aktualizaci pÅ™eÄtÄ›te varovánà v " | ||
356 | #~ "manuálové stránce sshd_config(5) a v souboru /etc/ssh/sshd_config zadejte " | ||
357 | #~ "„PermitUserEnvironment yes“." | ||
diff --git a/debian/po/da.po b/debian/po/da.po new file mode 100644 index 000000000..766b82ef4 --- /dev/null +++ b/debian/po/da.po | |||
@@ -0,0 +1,161 @@ | |||
1 | # Danish translation openssh. | ||
2 | # Copyright (C) 2010 openssh & nedenstående oversættere. | ||
3 | # This file is distributed under the same license as the openssh package. | ||
4 | # Claus Hindsgaul <claus.hindsgaul@gmail.com>, 2006. | ||
5 | # Joe Hansen (joedalton2@yahoo.dk), 2010. | ||
6 | # | ||
7 | msgid "" | ||
8 | msgstr "" | ||
9 | "Project-Id-Version: openssh\n" | ||
10 | "Report-Msgid-Bugs-To: openssh@packages.debian.org\n" | ||
11 | "POT-Creation-Date: 2010-01-02 08:55+0000\n" | ||
12 | "PO-Revision-Date: 2010-08-12 17:30+01:00\n" | ||
13 | "Last-Translator: Joe Hansen <joedalton2@yahoo.dk>\n" | ||
14 | "Language-Team: Danish <debian-l10n-danish@lists.debian.org> \n" | ||
15 | "MIME-Version: 1.0\n" | ||
16 | "Content-Type: text/plain; charset=UTF-8\n" | ||
17 | "Content-Transfer-Encoding: 8bit\n" | ||
18 | |||
19 | #. Type: boolean | ||
20 | #. Description | ||
21 | #: ../openssh-server.templates:1001 | ||
22 | msgid "Do you want to risk killing active SSH sessions?" | ||
23 | msgstr "Vil du risikere at afbryde aktive SSH-forbindelser?" | ||
24 | |||
25 | #. Type: boolean | ||
26 | #. Description | ||
27 | #: ../openssh-server.templates:1001 | ||
28 | msgid "" | ||
29 | "The currently installed version of /etc/init.d/ssh is likely to kill all " | ||
30 | "running sshd instances. If you are doing this upgrade via an SSH session, " | ||
31 | "you're likely to be disconnected and leave the upgrade procedure unfinished." | ||
32 | msgstr "" | ||
33 | "Den udgave af /etc/init.d/ssh, du har installeret, vil sandsynligvis afbryde " | ||
34 | "alle sshd-instanser. Hvis du foretager denne opgradering via en SSH-session, " | ||
35 | "vil du højst sandsynlig blive afbrudt og efterlade opgraderingsproceduren " | ||
36 | "uafsluttet." | ||
37 | |||
38 | #. Type: boolean | ||
39 | #. Description | ||
40 | #: ../openssh-server.templates:1001 | ||
41 | msgid "" | ||
42 | "This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the " | ||
43 | "start-stop-daemon line in the stop section of the file." | ||
44 | msgstr "" | ||
45 | "Du kan afhjælpe dette ved at tilføje »--pidfile /var/run/sshd.pid« til " | ||
46 | "linjen start-stop-daemon i stop-afsnittet af filen." | ||
47 | |||
48 | #. Type: note | ||
49 | #. Description | ||
50 | #: ../openssh-server.templates:2001 | ||
51 | msgid "New host key mandatory" | ||
52 | msgstr "Ny værtsnøgle er krævet" | ||
53 | |||
54 | #. Type: note | ||
55 | #. Description | ||
56 | #: ../openssh-server.templates:2001 | ||
57 | msgid "" | ||
58 | "The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA " | ||
59 | "algorithm. OpenSSH can not handle this host key file, and the ssh-keygen " | ||
60 | "utility from the old (non-free) SSH installation does not appear to be " | ||
61 | "available." | ||
62 | msgstr "" | ||
63 | "Den aktuelle værtsnøgle, i /etc/ssh/ssh_host_key, er krypteret med en IDEA-" | ||
64 | "algoritme. OpenSSH kan ikke håndtere en sådan værtsnøglefil, og værktøjet " | ||
65 | "ssh-keygen fra den gamle (ikke-frie, 'non-free') SSH-installation lader ikke " | ||
66 | "til at være tilgængeligt." | ||
67 | |||
68 | #. Type: note | ||
69 | #. Description | ||
70 | #: ../openssh-server.templates:2001 | ||
71 | msgid "You need to manually generate a new host key." | ||
72 | msgstr "Du skal manuelt oprette en ny værtsnøgle." | ||
73 | |||
74 | #. Type: boolean | ||
75 | #. Description | ||
76 | #: ../openssh-server.templates:3001 | ||
77 | msgid "Disable challenge-response authentication?" | ||
78 | msgstr "Slå udfordrings-svar godkendelse fra?" | ||
79 | |||
80 | #. Type: boolean | ||
81 | #. Description | ||
82 | #: ../openssh-server.templates:3001 | ||
83 | msgid "" | ||
84 | "Password authentication appears to be disabled in the current OpenSSH server " | ||
85 | "configuration. In order to prevent users from logging in using passwords " | ||
86 | "(perhaps using only public key authentication instead) with recent versions " | ||
87 | "of OpenSSH, you must disable challenge-response authentication, or else " | ||
88 | "ensure that your PAM configuration does not allow Unix password file " | ||
89 | "authentication." | ||
90 | msgstr "" | ||
91 | "Adgangskodegodkendelse ser ud til at være deaktiveret i din nuværende " | ||
92 | "OpenSSH-serveropsætning. For at forhindre brugere i at logge ind med " | ||
93 | "adgangskoder (måske kun med brug af offentlig nøglegodkendelse) med nyere " | ||
94 | "versioner af OpenSSH, skal du deaktivere udfordrings-svar godkendelse, eller " | ||
95 | "sikre at din PAM-opsætning ikke tillader godkendelse via Unixadgangskodefil." | ||
96 | |||
97 | #. Type: boolean | ||
98 | #. Description | ||
99 | #: ../openssh-server.templates:3001 | ||
100 | msgid "" | ||
101 | "If you disable challenge-response authentication, then users will not be " | ||
102 | "able to log in using passwords. If you leave it enabled (the default " | ||
103 | "answer), then the 'PasswordAuthentication no' option will have no useful " | ||
104 | "effect unless you also adjust your PAM configuration in /etc/pam.d/ssh." | ||
105 | msgstr "" | ||
106 | "Hvis du deaktiverer udfordrings-svar godkendelse, vil brugere ikke være i " | ||
107 | "stand til at logge ind med adgangskoder. Hvis du lader det være slået til " | ||
108 | "(standardsvaret), så vil indstillingen 'PasswordAuthentication no' ikke have " | ||
109 | "nogen effekt, medmindre du også redigerer din PAM-opsætning i /etc/pam.d/ssh." | ||
110 | |||
111 | #. Type: note | ||
112 | #. Description | ||
113 | #: ../openssh-server.templates:4001 | ||
114 | msgid "Vulnerable host keys will be regenerated" | ||
115 | msgstr "Sårbare værtsnøgler vil blive oprettet" | ||
116 | |||
117 | #. Type: note | ||
118 | #. Description | ||
119 | #: ../openssh-server.templates:4001 | ||
120 | msgid "" | ||
121 | "Some of the OpenSSH server host keys on this system were generated with a " | ||
122 | "version of OpenSSL that had a broken random number generator. As a result, " | ||
123 | "these host keys are from a well-known set, are subject to brute-force " | ||
124 | "attacks, and must be regenerated." | ||
125 | msgstr "" | ||
126 | "Nogle af OpenSSh-serverens værtsnøgler på dette system blev oprettet med en " | ||
127 | "version af OpenSSL, som havde en ødelagt tilfældighedstalgenerator. Derfor " | ||
128 | "er disse værtsnøgler fra et velkendt sæt, der er sårbare over for brutale " | ||
129 | "(brute-force) angreb og skal derfor genskabes." | ||
130 | |||
131 | #. Type: note | ||
132 | #. Description | ||
133 | #: ../openssh-server.templates:4001 | ||
134 | msgid "" | ||
135 | "Users of this system should be informed of this change, as they will be " | ||
136 | "prompted about the host key change the next time they log in. Use 'ssh-" | ||
137 | "keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of " | ||
138 | "the new host keys." | ||
139 | msgstr "" | ||
140 | "Brugere af dette system bør informeres om denne ændring, da de vil blive " | ||
141 | "spurgt om værtsnøgleændringen den næste gang de logger ind. Brug 'ssh-keygen " | ||
142 | "-l -f HOST_KEY_FILE' efter opgraderingen for at udskrive fingeraftryk på de " | ||
143 | "nye værtsnøgler." | ||
144 | |||
145 | #. Type: note | ||
146 | #. Description | ||
147 | #: ../openssh-server.templates:4001 | ||
148 | msgid "The affected host keys are:" | ||
149 | msgstr "De påvirkede værtsnøgler er:" | ||
150 | |||
151 | #. Type: note | ||
152 | #. Description | ||
153 | #: ../openssh-server.templates:4001 | ||
154 | msgid "" | ||
155 | "User keys may also be affected by this problem. The 'ssh-vulnkey' command " | ||
156 | "may be used as a partial test for this. See /usr/share/doc/openssh-server/" | ||
157 | "README.compromised-keys.gz for more details." | ||
158 | msgstr "" | ||
159 | "Brugernøgler kan måske også være påvirket af dette problem. Kommandoen 'ssh-" | ||
160 | "vulnkey' kan bruges som en delvis test vedrørende dette. Se /usr/share/doc/" | ||
161 | "openssh-server/README.compromised-keys.gz for yderligere detaljer." | ||
diff --git a/debian/po/de.po b/debian/po/de.po new file mode 100644 index 000000000..55b363a67 --- /dev/null +++ b/debian/po/de.po | |||
@@ -0,0 +1,369 @@ | |||
1 | # Translation of openssh debconf templates to German | ||
2 | # Copyright (C) Helge Kreutzmann <debian@helgefjell.de>, 2006-2008. | ||
3 | # This file is distributed under the same license as the openssh package. | ||
4 | # | ||
5 | msgid "" | ||
6 | msgstr "" | ||
7 | "Project-Id-Version: openssh 1:4.7p1-9\n" | ||
8 | "Report-Msgid-Bugs-To: openssh@packages.debian.org\n" | ||
9 | "POT-Creation-Date: 2010-01-02 08:55+0000\n" | ||
10 | "PO-Revision-Date: 2008-05-17 23:09+0200\n" | ||
11 | "Last-Translator: Helge Kreutzmann <debian@helgefjell.de>\n" | ||
12 | "Language-Team: de <debian-l10n-german@lists.debian.org>\n" | ||
13 | "MIME-Version: 1.0\n" | ||
14 | "Content-Type: text/plain; charset=ISO-8859-15\n" | ||
15 | "Content-Transfer-Encoding: 8bit\n" | ||
16 | |||
17 | #. Type: boolean | ||
18 | #. Description | ||
19 | #: ../openssh-server.templates:1001 | ||
20 | msgid "Do you want to risk killing active SSH sessions?" | ||
21 | msgstr "Wollen Sie das Beenden aktiver SSH-Sitzungen riskieren?" | ||
22 | |||
23 | #. Type: boolean | ||
24 | #. Description | ||
25 | #: ../openssh-server.templates:1001 | ||
26 | msgid "" | ||
27 | "The currently installed version of /etc/init.d/ssh is likely to kill all " | ||
28 | "running sshd instances. If you are doing this upgrade via an SSH session, " | ||
29 | "you're likely to be disconnected and leave the upgrade procedure unfinished." | ||
30 | msgstr "" | ||
31 | "Die derzeit installierte Version von /etc/init.d/ssh wird vermutlich Ihre " | ||
32 | "aktiven ssh-Instanzen beenden. Falls Sie dieses Upgrade über eine SSH-" | ||
33 | "Sitzung durchführen, dann wird die Verbindung wahrscheinlich getrennt und " | ||
34 | "der Upgrade-Vorgang nicht beendet." | ||
35 | |||
36 | #. Type: boolean | ||
37 | #. Description | ||
38 | #: ../openssh-server.templates:1001 | ||
39 | msgid "" | ||
40 | "This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the " | ||
41 | "start-stop-daemon line in the stop section of the file." | ||
42 | msgstr "" | ||
43 | "Dieses Problem kann behoben werden, indem »--pidfile /var/run/sshd.pid« an " | ||
44 | "die start-stop-daemon-Zeile in dem Abschnitt »stop« der Datei /etc/init.d/ssh " | ||
45 | "manuell hinzugefügt wird." | ||
46 | |||
47 | #. Type: note | ||
48 | #. Description | ||
49 | #: ../openssh-server.templates:2001 | ||
50 | msgid "New host key mandatory" | ||
51 | msgstr "Neuer Host-Schlüssel verpflichtend" | ||
52 | |||
53 | #. Type: note | ||
54 | #. Description | ||
55 | #: ../openssh-server.templates:2001 | ||
56 | msgid "" | ||
57 | "The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA " | ||
58 | "algorithm. OpenSSH can not handle this host key file, and the ssh-keygen " | ||
59 | "utility from the old (non-free) SSH installation does not appear to be " | ||
60 | "available." | ||
61 | msgstr "" | ||
62 | "Der aktuelle Host-Schlüssel in /etc/ssh/ssh_host_key ist mit dem IDEA-" | ||
63 | "Algorithmus verschlüsselt. OpenSSH kann diese Host-Schlüssel-Datei nicht " | ||
64 | "verarbeiten und das ssh-keygen-Hilfswerkzeug von der alten (nicht-freien) " | ||
65 | "SSH-Installation scheint nicht verfügbar zu sein." | ||
66 | |||
67 | #. Type: note | ||
68 | #. Description | ||
69 | #: ../openssh-server.templates:2001 | ||
70 | msgid "You need to manually generate a new host key." | ||
71 | msgstr "Sie müssen manuell einen neuen Host-Schlüssel erzeugen." | ||
72 | |||
73 | #. Type: boolean | ||
74 | #. Description | ||
75 | #: ../openssh-server.templates:3001 | ||
76 | msgid "Disable challenge-response authentication?" | ||
77 | msgstr "Challenge-response-Authentifizierung deaktivieren?" | ||
78 | |||
79 | #. Type: boolean | ||
80 | #. Description | ||
81 | #: ../openssh-server.templates:3001 | ||
82 | msgid "" | ||
83 | "Password authentication appears to be disabled in the current OpenSSH server " | ||
84 | "configuration. In order to prevent users from logging in using passwords " | ||
85 | "(perhaps using only public key authentication instead) with recent versions " | ||
86 | "of OpenSSH, you must disable challenge-response authentication, or else " | ||
87 | "ensure that your PAM configuration does not allow Unix password file " | ||
88 | "authentication." | ||
89 | msgstr "" | ||
90 | "Passwort-Authentifizierung scheint in der aktuellen OpenSSH-Server-" | ||
91 | "Konfiguration deaktiviert zu sein. Um in neueren Versionen von OpenSSH zu " | ||
92 | "verhindern, dass Benutzer sich unter Verwendung von Passwörtern anmelden " | ||
93 | "(möglicherweise stattdessen nur unter Verwendung von Public-Key-" | ||
94 | "Authentifizierung), müssen Sie Challenge-response-Authentifizierung " | ||
95 | "deaktivieren oder ansonsten sicherstellen, dass Ihre PAM-Konfiguration keine " | ||
96 | "Authentifizierung über Unix-Password-Dateien erlaubt." | ||
97 | |||
98 | #. Type: boolean | ||
99 | #. Description | ||
100 | #: ../openssh-server.templates:3001 | ||
101 | msgid "" | ||
102 | "If you disable challenge-response authentication, then users will not be " | ||
103 | "able to log in using passwords. If you leave it enabled (the default " | ||
104 | "answer), then the 'PasswordAuthentication no' option will have no useful " | ||
105 | "effect unless you also adjust your PAM configuration in /etc/pam.d/ssh." | ||
106 | msgstr "" | ||
107 | "Falls Sie Challenge-response-Authentifizierung deaktivieren, werden Benutzer " | ||
108 | "nicht in der Lage sein, sich mit Passwörtern anzumelden. Falls Sie es " | ||
109 | "aktiviert lassen (die Standard-Antwort) wird die »PasswordAuthentication no«-" | ||
110 | "Einstellung keinen nützlichen Effekt haben, es sei denn, sie passen auch " | ||
111 | "Ihre PAM-Konfiguration in /etc/pam.d/ssh an." | ||
112 | |||
113 | #. Type: note | ||
114 | #. Description | ||
115 | #: ../openssh-server.templates:4001 | ||
116 | msgid "Vulnerable host keys will be regenerated" | ||
117 | msgstr "Verwundbare Host-Schlüssel werden neu erzeugt" | ||
118 | |||
119 | #. Type: note | ||
120 | #. Description | ||
121 | #: ../openssh-server.templates:4001 | ||
122 | msgid "" | ||
123 | "Some of the OpenSSH server host keys on this system were generated with a " | ||
124 | "version of OpenSSL that had a broken random number generator. As a result, " | ||
125 | "these host keys are from a well-known set, are subject to brute-force " | ||
126 | "attacks, and must be regenerated." | ||
127 | msgstr "" | ||
128 | "Einige der OpenSSH-Server-Host-Schlüssel auf diesem System wurden mit einer " | ||
129 | "Version von OpenSSL erzeugt, die einen defekten Zufallszahlengenerator " | ||
130 | "hatte. Als Ergebnis stammen diese Host-Schlüssel aus einer wohlbekannten " | ||
131 | "Menge, unterliegen Rechen- (»brute-force«)-angriffen und müssen neu erstellt " | ||
132 | "werden." | ||
133 | |||
134 | #. Type: note | ||
135 | #. Description | ||
136 | #: ../openssh-server.templates:4001 | ||
137 | msgid "" | ||
138 | "Users of this system should be informed of this change, as they will be " | ||
139 | "prompted about the host key change the next time they log in. Use 'ssh-" | ||
140 | "keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of " | ||
141 | "the new host keys." | ||
142 | msgstr "" | ||
143 | "Die Benutzer dieses Systems sollten über diese Änderung informiert werden, " | ||
144 | "da sie über die Änderung des Host-Schlüssels bei der nächsten Anmeldung " | ||
145 | "befragt werden. Führen Sie nach dem Upgrade »ssh-keygen -l -f " | ||
146 | "HOST_SCHLÜSSEL_DATEI« aus, um die Fingerabdrücke es neuen Host-Schlüssels " | ||
147 | "anzuzeigen." | ||
148 | |||
149 | #. Type: note | ||
150 | #. Description | ||
151 | #: ../openssh-server.templates:4001 | ||
152 | msgid "The affected host keys are:" | ||
153 | msgstr "Die betroffenen Host-Schlüssel sind:" | ||
154 | |||
155 | #. Type: note | ||
156 | #. Description | ||
157 | #: ../openssh-server.templates:4001 | ||
158 | msgid "" | ||
159 | "User keys may also be affected by this problem. The 'ssh-vulnkey' command " | ||
160 | "may be used as a partial test for this. See /usr/share/doc/openssh-server/" | ||
161 | "README.compromised-keys.gz for more details." | ||
162 | msgstr "" | ||
163 | "Die Schüssel der Benutzer könnten auch von diesem Problem betroffen sein. " | ||
164 | "Der Befehl »ssh-vulnkey« kann dazu verwandt werden, dieses Problem teilweise " | ||
165 | "zu ermitteln. Lesen Sie /usr/share/doc/openssh-server/README.compromised-" | ||
166 | "keys.gz für weitere Details." | ||
167 | |||
168 | #~ msgid "Generate a new configuration file for OpenSSH?" | ||
169 | #~ msgstr "Eine neue Konfigurationsdatei für OpenSSH erzeugen?" | ||
170 | |||
171 | #~ msgid "" | ||
172 | #~ "This version of OpenSSH has a considerably changed configuration file " | ||
173 | #~ "from the version shipped in Debian 'Potato', which you appear to be " | ||
174 | #~ "upgrading from. This package can now generate a new configuration file (/" | ||
175 | #~ "etc/ssh/sshd.config), which will work with the new server version, but " | ||
176 | #~ "will not contain any customizations you made with the old version." | ||
177 | #~ msgstr "" | ||
178 | #~ "Diese Version von OpenSSH hat eine deutlich geänderte Konfigurationsdatei " | ||
179 | #~ "gegenüber der in »Potato« ausgelieferten Version, von der Sie anscheinend " | ||
180 | #~ "ein Upgrade durchführen. Dieses Paket kann jetzt eine neue " | ||
181 | #~ "Konfigurationsdatei (/etc/ssh/sshd.config) erzeugen, die mit der neuen " | ||
182 | #~ "Server-Version zusammenarbeitet, aber keine Anpassungen aus der alten " | ||
183 | #~ "Version enthält." | ||
184 | |||
185 | #~ msgid "" | ||
186 | #~ "Please note that this new configuration file will set the value of " | ||
187 | #~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password " | ||
188 | #~ "can ssh directly in as root). Please read the README.Debian file for more " | ||
189 | #~ "details about this design choice." | ||
190 | #~ msgstr "" | ||
191 | #~ "Bitte beachten Sie, dass die neue Konfigurationsdatei »PermitRootLogin« " | ||
192 | #~ "auf »yes« setzt (was bedeutet, dass jeder, der das Root-Passwort kennt, " | ||
193 | #~ "sich direkt via ssh als root anmelden kann). Bitte lesen Sie die Datei " | ||
194 | #~ "README.Debian für weitergehende Informationen über diese Design-" | ||
195 | #~ "Entscheidung." | ||
196 | |||
197 | #~ msgid "" | ||
198 | #~ "It is strongly recommended that you choose to generate a new " | ||
199 | #~ "configuration file now." | ||
200 | #~ msgstr "" | ||
201 | #~ "Es wird nachdrücklich empfohlen, dass Sie jetzt eine neue " | ||
202 | #~ "Konfigurationsdatei erzeugen." | ||
203 | |||
204 | #~ msgid "Warning: you must create a new host key" | ||
205 | #~ msgstr "Warnung: Sie müssen einen neuen Host-Schlüssel erzeugen" | ||
206 | |||
207 | #~ msgid "Warning: telnetd is installed --- probably not a good idea" | ||
208 | #~ msgstr "Warnung: telnetd ist installiert --- wahrscheinlich keine gute Idee" | ||
209 | |||
210 | #~ msgid "" | ||
211 | #~ "I'd advise you to either remove the telnetd package (if you don't " | ||
212 | #~ "actually need to offer telnet access) or install telnetd-ssl so that " | ||
213 | #~ "there is at least some chance that telnet sessions will not be sending " | ||
214 | #~ "unencrypted login/password and session information over the network." | ||
215 | #~ msgstr "" | ||
216 | #~ "Wir empfehlen das telnetd Paket zu entfernen (falls Sie keinen telnet " | ||
217 | #~ "Zugang anbieten) oder telnetd-ssl zu installieren, so daß Sie verhindern " | ||
218 | #~ "können, daß Login und Passwort unverschlüsselt durch das Netz gesendet " | ||
219 | #~ "werden." | ||
220 | |||
221 | #~ msgid "Warning: rsh-server is installed --- probably not a good idea" | ||
222 | #~ msgstr "" | ||
223 | #~ "Warnung: rsh-server ist installiert --- wahrscheinlich keine gute Idee" | ||
224 | |||
225 | #~ msgid "" | ||
226 | #~ "having rsh-server installed undermines the security that you were " | ||
227 | #~ "probably wanting to obtain by installing ssh. I'd advise you to remove " | ||
228 | #~ "that package." | ||
229 | #~ msgstr "" | ||
230 | #~ "ist es eine schlechte Idee, den rsh-server installiert zu haben, da er " | ||
231 | #~ "die Sicherheit untergräbt. Wir empfehlen, das Paket zu entfernen." | ||
232 | |||
233 | #~ msgid "Do you want ssh-keysign to be installed SUID root?" | ||
234 | #~ msgstr "Möchten Sie ssh-keysign SUID-Root installieren?" | ||
235 | |||
236 | #~ msgid "" | ||
237 | #~ "You have the option of installing the ssh-keysign helper with the SUID " | ||
238 | #~ "bit set." | ||
239 | #~ msgstr "" | ||
240 | #~ "Sie haben die Möglichkeit, den ssh-keysign-Helfer mit gesetzten SUID-Bit " | ||
241 | #~ "zu installieren." | ||
242 | |||
243 | #~ msgid "" | ||
244 | #~ "If you make ssh-keysign SUID, you will be able to use SSH's Protocol 2 " | ||
245 | #~ "host-based authentication." | ||
246 | #~ msgstr "" | ||
247 | #~ "Falls Sie ssh-keysign SUID installieren, können Sie die Host-basierende " | ||
248 | #~ "Authentisierung von SSH-Protokoll Version 2 verwenden." | ||
249 | |||
250 | #~ msgid "" | ||
251 | #~ "If in doubt, I suggest you install it with SUID. If it causes problems " | ||
252 | #~ "you can change your mind later by running: dpkg-reconfigure ssh" | ||
253 | #~ msgstr "" | ||
254 | #~ "Falls Sie unsicher sind, empfehle ich, mit SUID zu installieren. Falls es " | ||
255 | #~ "Probleme gibt, können Sie später Ihre Meinung ändern, indem Sie dpkg-" | ||
256 | #~ "reconfigure ssh aufrufen." | ||
257 | |||
258 | #~ msgid "Allow SSH protocol 2 only" | ||
259 | #~ msgstr "Nur SSH-Protokoll Version 2 erlauben" | ||
260 | |||
261 | #~ msgid "" | ||
262 | #~ "This version of OpenSSH supports version 2 of the ssh protocol, which is " | ||
263 | #~ "much more secure. Disabling ssh 1 is encouraged, however this will slow " | ||
264 | #~ "things down on low end machines and might prevent older clients from " | ||
265 | #~ "connecting (the ssh client shipped with \"potato\" is affected)." | ||
266 | #~ msgstr "" | ||
267 | #~ "Diese Version von OpenSSH unterstützt Version 2 des SSH-Protokolls, die " | ||
268 | #~ "sicherer ist. Es wird empfohlen, Version 1 zu deaktivieren, allerdings " | ||
269 | #~ "kann dies Vorgänge auf langsamen Maschinen verzögern und alte Clients an " | ||
270 | #~ "der Verbindungsaufnahme hindern (der ssh-Client von »potato« ist davon " | ||
271 | #~ "betroffen)." | ||
272 | |||
273 | #~ msgid "" | ||
274 | #~ "Also please note that keys used for protocol 1 are different so you will " | ||
275 | #~ "not be able to use them if you only allow protocol 2 connections." | ||
276 | #~ msgstr "" | ||
277 | #~ "Bitte beachten Sie auch, daß sich die für Protokoll 1 verwendeten " | ||
278 | #~ "Schlüssel unterscheiden und Sie diese daher nicht verwenden können, wenn " | ||
279 | #~ "Sie nur Protokoll Version 2-Verbindungen erlauben." | ||
280 | |||
281 | #~ msgid "" | ||
282 | #~ "If you later change your mind about this setting, README.Debian has " | ||
283 | #~ "instructions on what to do to your sshd_config file." | ||
284 | #~ msgstr "" | ||
285 | #~ "Falls Sie später Ihre Meinung über diese Einstellung ändern, finden Sie " | ||
286 | #~ "in README.Debian eine Anleitung was Sie mit der sshd_config-Datei machen " | ||
287 | #~ "müssen." | ||
288 | |||
289 | #~ msgid "NOTE: Forwarding of X11 and Authorization disabled by default." | ||
290 | #~ msgstr "HINWEIS: Weiterleiten von X11 und Berechtigungen ist abgeschaltet." | ||
291 | |||
292 | #~ msgid "" | ||
293 | #~ "For security reasons, the Debian version of ssh has ForwardX11 and " | ||
294 | #~ "ForwardAgent set to ``off'' by default." | ||
295 | #~ msgstr "" | ||
296 | #~ "Aus Sicherheitsgründen ist bei der Debian-Version von ssh ForwardX11 und " | ||
297 | #~ "ForwardAgent auf »off« gesetzt." | ||
298 | |||
299 | #~ msgid "" | ||
300 | #~ "You can enable it for servers you trust, either in one of the " | ||
301 | #~ "configuration files, or with the -X command line option." | ||
302 | #~ msgstr "" | ||
303 | #~ "Sie können dies für Server, denen Sie trauen, entweder per Eintrag in die " | ||
304 | #~ "Konfigurations-Dateien oder per Kommando-Zeilen Option -X ändern." | ||
305 | |||
306 | #~ msgid "More details can be found in /usr/share/doc/ssh/README.Debian" | ||
307 | #~ msgstr "" | ||
308 | #~ "Weitere Details können Sie in /usr/share/doc/ssh/README.Debian finden." | ||
309 | |||
310 | #~ msgid "ssh2 keys merged in configuration files" | ||
311 | #~ msgstr "ssh2-Schlüssel in die Konfigurationsdateien eingefügt" | ||
312 | |||
313 | #~ msgid "" | ||
314 | #~ "As of version 3 OpenSSH no longer uses separate files for ssh1 and ssh2 " | ||
315 | #~ "keys. This means the authorized_keys2 and known_hosts2 files are no " | ||
316 | #~ "longer needed. They will still be read in order to maintain backwards " | ||
317 | #~ "compatibility" | ||
318 | #~ msgstr "" | ||
319 | #~ "Mit Version 3 verwendet OpenSSH nicht mehr separate Dateien für ssh1 und " | ||
320 | #~ "ssh2 Schlüssel. Dies bedeutet, daß authorized_keys2 und known_hosts2 " | ||
321 | #~ "nicht mehr benötigt werden. Sie werden noch eingelesen, um " | ||
322 | #~ "Abwärtskompatibilität zu gewähren." | ||
323 | |||
324 | #~ msgid "Do you want to run the sshd server?" | ||
325 | #~ msgstr "Möchten Sie den sshd Server starten?" | ||
326 | |||
327 | #~ msgid "This package contains both the ssh client, and the sshd server." | ||
328 | #~ msgstr "Das Paket enthält sowohl den Client als auch den sshd Server." | ||
329 | |||
330 | #~ msgid "" | ||
331 | #~ "Normally the sshd Secure Shell Server will be run to allow remote logins " | ||
332 | #~ "via ssh." | ||
333 | #~ msgstr "" | ||
334 | #~ "Normalerweise wird der sshd Secure Shell Server für Remote Logins per " | ||
335 | #~ "sshgestartet." | ||
336 | |||
337 | #~ msgid "" | ||
338 | #~ "If you are only interested in using the ssh client for outbound " | ||
339 | #~ "connections on this machine, and don't want to log into it at all using " | ||
340 | #~ "ssh, then you can disable sshd here." | ||
341 | #~ msgstr "" | ||
342 | #~ "Wenn Sie nur den ssh client nutzen wollen, um sich mit anderen Rechnern " | ||
343 | #~ "zu verbinden, und sich nicht per ssh in diesen Computer einloggen wollen, " | ||
344 | #~ "dann können Sie hier den sshd abschalten." | ||
345 | |||
346 | #~ msgid "Environment options on keys have been deprecated" | ||
347 | #~ msgstr "Umgebungs-Optionen für Schlüssel wurden missbilligt" | ||
348 | |||
349 | #~ msgid "" | ||
350 | #~ "This version of OpenSSH disables the environment option for public keys " | ||
351 | #~ "by default, in order to avoid certain attacks (for example, LD_PRELOAD). " | ||
352 | #~ "If you are using this option in an authorized_keys file, beware that the " | ||
353 | #~ "keys in question will no longer work until the option is removed." | ||
354 | #~ msgstr "" | ||
355 | #~ "Diese Version von OpenSSH deaktiviert standardmäßig die Umgebungsoption " | ||
356 | #~ "füröffentliche Schlüssel um bestimmte Angriffe (zum Beispiel über " | ||
357 | #~ "LD_PRELOAD) zu vermeiden. Falls Sie diese Option in einer authorized_keys-" | ||
358 | #~ "Datei verwenden, beachten Sie, daß die in Frage kommenden Schlüssel nicht " | ||
359 | #~ "funktionieren werden bis diese Option entfernt wurde." | ||
360 | |||
361 | #~ msgid "" | ||
362 | #~ "To re-enable this option, set \"PermitUserEnvironment yes\" in /etc/ssh/" | ||
363 | #~ "sshd_config after the upgrade is complete, taking note of the warning in " | ||
364 | #~ "the sshd_config(5) manual page." | ||
365 | #~ msgstr "" | ||
366 | #~ "Um diese Option wieder zu reaktivieren, setzen Sie, unter " | ||
367 | #~ "Berücksichtigung der Warnung in der sshd_config(5)-Handbuchseite, " | ||
368 | #~ "»PermitUserEnvironment yes« in /etc/ssh/sshd_config nachdem das Upgrade " | ||
369 | #~ "erfolgt ist." | ||
diff --git a/debian/po/el.po b/debian/po/el.po new file mode 100644 index 000000000..4ca56384e --- /dev/null +++ b/debian/po/el.po | |||
@@ -0,0 +1,451 @@ | |||
1 | # translation of el.po to Greek | ||
2 | # translation of templates.po to Greek | ||
3 | # | ||
4 | # Translators, if you are not familiar with the PO format, gettext | ||
5 | # documentation is worth reading, especially sections dedicated to | ||
6 | # this format, e.g. by running: | ||
7 | # info -n '(gettext)PO Files' | ||
8 | # info -n '(gettext)Header Entry' | ||
9 | # Some information specific to po-debconf are available at | ||
10 | # /usr/share/doc/po-debconf/README-trans | ||
11 | # or http://www.debian.org/intl/l10n/po-debconf/README-trans# | ||
12 | # Developers do not need to manually edit POT or PO files. | ||
13 | # Konstantinos Margaritis <markos@debian.org>, 2004. | ||
14 | # | ||
15 | msgid "" | ||
16 | msgstr "" | ||
17 | "Project-Id-Version: el\n" | ||
18 | "Report-Msgid-Bugs-To: openssh@packages.debian.org\n" | ||
19 | "POT-Creation-Date: 2010-01-02 08:55+0000\n" | ||
20 | "PO-Revision-Date: 2004-10-14 21:34+0300\n" | ||
21 | "Last-Translator: Konstantinos Margaritis <markos@debian.org>\n" | ||
22 | "Language-Team: Greek <debian-l10n-greek@lists.debian.org>\n" | ||
23 | "MIME-Version: 1.0\n" | ||
24 | "Content-Type: text/plain; charset=UTF-8\n" | ||
25 | "Content-Transfer-Encoding: 8bit\n" | ||
26 | "X-Generator: KBabel 1.0.2\n" | ||
27 | |||
28 | #. Type: boolean | ||
29 | #. Description | ||
30 | #: ../openssh-server.templates:1001 | ||
31 | #, fuzzy | ||
32 | #| msgid "Do you want to continue (and risk killing active ssh sessions)?" | ||
33 | msgid "Do you want to risk killing active SSH sessions?" | ||
34 | msgstr "" | ||
35 | "ΘÎλετε να συνεχίσετε (με κίνδυνο τεÏÎ¼Î±Ï„Î¹ÏƒÎ¼Î¿Ï Ï„Ï‰Î½ ενεÏγών συνεδÏιών ssh);" | ||
36 | |||
37 | #. Type: boolean | ||
38 | #. Description | ||
39 | #: ../openssh-server.templates:1001 | ||
40 | #, fuzzy | ||
41 | #| msgid "" | ||
42 | #| "The version of /etc/init.d/ssh that you have installed, is likely to kill " | ||
43 | #| "all running sshd instances. If you are doing this upgrade via an ssh " | ||
44 | #| "session, that would be a Bad Thing(tm)." | ||
45 | msgid "" | ||
46 | "The currently installed version of /etc/init.d/ssh is likely to kill all " | ||
47 | "running sshd instances. If you are doing this upgrade via an SSH session, " | ||
48 | "you're likely to be disconnected and leave the upgrade procedure unfinished." | ||
49 | msgstr "" | ||
50 | "Η Ï„ÏÎχουσα Îκδοση του /etc/init.d/ssh που είναι εγκατεστημÎνη, πιθανότατα θα " | ||
51 | "τεÏματίσει όλες τις συνεδÏίες του sshd. Αν κάνετε αυτήν την αναβάθμιση μÎσω " | ||
52 | "μιας συνεδÏίας ssh, αυτό είναι μάλλον κακή ιδÎα..." | ||
53 | |||
54 | #. Type: boolean | ||
55 | #. Description | ||
56 | #: ../openssh-server.templates:1001 | ||
57 | #, fuzzy | ||
58 | #| msgid "" | ||
59 | #| "You can fix this by adding \"--pidfile /var/run/sshd.pid\" to the start-" | ||
60 | #| "stop-daemon line in the stop section of the file." | ||
61 | msgid "" | ||
62 | "This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the " | ||
63 | "start-stop-daemon line in the stop section of the file." | ||
64 | msgstr "" | ||
65 | "ΜποÏείτε να το διοÏθώσετε αυτό Ï€ÏοσθÎτοντας \"--pidfile /var/run/sshd.pid\" " | ||
66 | "στη γÏαμμή start-stop-daemon στο τμήμα \"stop\" του αÏχείου." | ||
67 | |||
68 | #. Type: note | ||
69 | #. Description | ||
70 | #: ../openssh-server.templates:2001 | ||
71 | msgid "New host key mandatory" | ||
72 | msgstr "" | ||
73 | |||
74 | #. Type: note | ||
75 | #. Description | ||
76 | #: ../openssh-server.templates:2001 | ||
77 | #, fuzzy | ||
78 | msgid "" | ||
79 | "The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA " | ||
80 | "algorithm. OpenSSH can not handle this host key file, and the ssh-keygen " | ||
81 | "utility from the old (non-free) SSH installation does not appear to be " | ||
82 | "available." | ||
83 | msgstr "" | ||
84 | "ΥπάÏχει Îνα παλαιότεÏο κλειδί /etc/ssh/ssh_host_key, που είναι " | ||
85 | "κÏυπτογÏαφημÎνο με τον αλγόÏιθμο IDEA. Το OpenSSH δε μποÏεί να χειÏιστεί " | ||
86 | "αυτό το κλειδί και δεν Îχει βÏεθεί το εÏγαλείο ssh-keygen από την παλιά (μη " | ||
87 | "ελεÏθεÏη) εγκατάσταση του SSH." | ||
88 | |||
89 | #. Type: note | ||
90 | #. Description | ||
91 | #: ../openssh-server.templates:2001 | ||
92 | #, fuzzy | ||
93 | #| msgid "You will need to generate a new host key." | ||
94 | msgid "You need to manually generate a new host key." | ||
95 | msgstr "Î ÏÎπει να δημιουÏγήσετε Îνα νÎο κλειδί για τον υπολογιστή (host key)." | ||
96 | |||
97 | #. Type: boolean | ||
98 | #. Description | ||
99 | #: ../openssh-server.templates:3001 | ||
100 | msgid "Disable challenge-response authentication?" | ||
101 | msgstr "Îα απενεÏγοποιηθεί η πιστοποίηση challenge-response;" | ||
102 | |||
103 | #. Type: boolean | ||
104 | #. Description | ||
105 | #: ../openssh-server.templates:3001 | ||
106 | #, fuzzy | ||
107 | #| msgid "" | ||
108 | #| "Password authentication appears to be disabled in your current OpenSSH " | ||
109 | #| "server configuration. In order to prevent users from logging in using " | ||
110 | #| "passwords (perhaps using only public key authentication instead) with " | ||
111 | #| "recent versions of OpenSSH, you must disable challenge-response " | ||
112 | #| "authentication, or else ensure that your PAM configuration does not allow " | ||
113 | #| "Unix password file authentication." | ||
114 | msgid "" | ||
115 | "Password authentication appears to be disabled in the current OpenSSH server " | ||
116 | "configuration. In order to prevent users from logging in using passwords " | ||
117 | "(perhaps using only public key authentication instead) with recent versions " | ||
118 | "of OpenSSH, you must disable challenge-response authentication, or else " | ||
119 | "ensure that your PAM configuration does not allow Unix password file " | ||
120 | "authentication." | ||
121 | msgstr "" | ||
122 | "Η πιστοποίηση με κωδικό είναι απενεÏγοποιημÎνη στο τωÏινό OpenSSH " | ||
123 | "εξυπηÏετητή. Για να αποτÏÎψετε την είσοδο τον χÏηστών με χÏήση ÎºÏ‰Î´Î¹ÎºÎ¿Ï (για " | ||
124 | "παÏάδειγμα να γίνεται χÏήση μόνο του δημοσίου κλειδιοÏ) με την Ï€Ïόσφατες " | ||
125 | "εκδόσεις του OpenSSH, θα Ï€ÏÎπει να απενεÏγοποιήσετε την πιστοποίηση " | ||
126 | "challenge-response ή να επιβεβαιώσετε ότι η διαμόÏφωση του PAM δεν επιτÏÎπει " | ||
127 | "την πιστοποίηση με αÏχείο κωδικών." | ||
128 | |||
129 | #. Type: boolean | ||
130 | #. Description | ||
131 | #: ../openssh-server.templates:3001 | ||
132 | msgid "" | ||
133 | "If you disable challenge-response authentication, then users will not be " | ||
134 | "able to log in using passwords. If you leave it enabled (the default " | ||
135 | "answer), then the 'PasswordAuthentication no' option will have no useful " | ||
136 | "effect unless you also adjust your PAM configuration in /etc/pam.d/ssh." | ||
137 | msgstr "" | ||
138 | "Εάν απενεÏγοποιήσετε την πιστοποίηση challenge-response, οι χÏήστες δεν θα " | ||
139 | "μποÏοÏν να εισÎλθουν χÏησιμοποιώντας τον κωδικό τους. Εάν το αφήσετε " | ||
140 | "ενεÏγοποιημÎνο (Ï€Ïοεπιλογή), τότε η επιλογή 'PasswordAuthetication no' δεν " | ||
141 | "θα επιδÏά εκτός και εάν Ïυθμίσετε και το PAM στο αÏχείο /etc/pam.d/ssh." | ||
142 | |||
143 | #. Type: note | ||
144 | #. Description | ||
145 | #: ../openssh-server.templates:4001 | ||
146 | msgid "Vulnerable host keys will be regenerated" | ||
147 | msgstr "" | ||
148 | |||
149 | #. Type: note | ||
150 | #. Description | ||
151 | #: ../openssh-server.templates:4001 | ||
152 | msgid "" | ||
153 | "Some of the OpenSSH server host keys on this system were generated with a " | ||
154 | "version of OpenSSL that had a broken random number generator. As a result, " | ||
155 | "these host keys are from a well-known set, are subject to brute-force " | ||
156 | "attacks, and must be regenerated." | ||
157 | msgstr "" | ||
158 | |||
159 | #. Type: note | ||
160 | #. Description | ||
161 | #: ../openssh-server.templates:4001 | ||
162 | msgid "" | ||
163 | "Users of this system should be informed of this change, as they will be " | ||
164 | "prompted about the host key change the next time they log in. Use 'ssh-" | ||
165 | "keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of " | ||
166 | "the new host keys." | ||
167 | msgstr "" | ||
168 | |||
169 | #. Type: note | ||
170 | #. Description | ||
171 | #: ../openssh-server.templates:4001 | ||
172 | msgid "The affected host keys are:" | ||
173 | msgstr "" | ||
174 | |||
175 | #. Type: note | ||
176 | #. Description | ||
177 | #: ../openssh-server.templates:4001 | ||
178 | msgid "" | ||
179 | "User keys may also be affected by this problem. The 'ssh-vulnkey' command " | ||
180 | "may be used as a partial test for this. See /usr/share/doc/openssh-server/" | ||
181 | "README.compromised-keys.gz for more details." | ||
182 | msgstr "" | ||
183 | |||
184 | #, fuzzy | ||
185 | #~ msgid "Generate a new configuration file for OpenSSH?" | ||
186 | #~ msgstr "ΔημιουÏγία νÎου αÏχείου Ïυθμίσεων" | ||
187 | |||
188 | #, fuzzy | ||
189 | #~ msgid "" | ||
190 | #~ "This version of OpenSSH has a considerably changed configuration file " | ||
191 | #~ "from the version shipped in Debian 'Potato', which you appear to be " | ||
192 | #~ "upgrading from. This package can now generate a new configuration file (/" | ||
193 | #~ "etc/ssh/sshd.config), which will work with the new server version, but " | ||
194 | #~ "will not contain any customizations you made with the old version." | ||
195 | #~ msgstr "" | ||
196 | #~ "Αυτή η Îκδοση του OpenSSH Îχει σημαντικά διαφοÏοποιημÎνο αÏχείο Ïυθμίσεων " | ||
197 | #~ "από την Îκδοση που πεÏιλαμβάνεται στη διανομή 'Potato' του Debian, από " | ||
198 | #~ "την οποία φαίνεται ότι Ï€Ïαγματοποιείτε την αναβάθμιση. Στο σημείο αυτό, " | ||
199 | #~ "σας δίνεται η δυνατότητα να δημιουÏγήσετε Îνα νÎο αÏχείο Ïυθμίσεων (/etc/" | ||
200 | #~ "ssh/sshd_config), το οποίο χÏησιμοποιείται από τη νÎα Îκδοση του δαίμονα, " | ||
201 | #~ "αλλά δεν θα πεÏιÎχει οποιαδήποτε παÏαμετÏοποίηση Îχετε ήδη κάνει στην " | ||
202 | #~ "παλιά Îκδοση." | ||
203 | |||
204 | #, fuzzy | ||
205 | #~| msgid "" | ||
206 | #~| "Please note that this new configuration file will set the value of " | ||
207 | #~| "'PermitRootLogin' to yes (meaning that anyone knowing the root password " | ||
208 | #~| "can ssh directly in as root). It is the opinion of the maintainer that " | ||
209 | #~| "this is the correct default (see README.Debian for more details), but " | ||
210 | #~| "you can always edit sshd_config and set it to no if you wish." | ||
211 | #~ msgid "" | ||
212 | #~ "Please note that this new configuration file will set the value of " | ||
213 | #~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password " | ||
214 | #~ "can ssh directly in as root). Please read the README.Debian file for more " | ||
215 | #~ "details about this design choice." | ||
216 | #~ msgstr "" | ||
217 | #~ "Σημειώστε ότι το νÎο αÏχείο Ïυθμίσεων θα καθοÏίσει την τιμή της επιλογής " | ||
218 | #~ "'PermitRootLogin' σε yes (εννοώντας ότι οποιοσδήποτε γνωÏίζει τον κωδικό " | ||
219 | #~ "Ï€Ïόσβασης του root μποÏεί να συνδεθεί ως χÏήστης root). Κατά τον " | ||
220 | #~ "συντηÏητή αυτή είναι και η σωστή Ï€ÏοκαθοÏισμÎνη ÏÏθμιση (δείτε το README." | ||
221 | #~ "Debian για πεÏισσότεÏες λεπτομÎÏειες), αλλά μποÏείτε οποιαδήποτε στιγμή " | ||
222 | #~ "να αλλάξετε την τιμή σε no στο αÏχείο sshd_config." | ||
223 | |||
224 | #, fuzzy | ||
225 | #~ msgid "" | ||
226 | #~ "It is strongly recommended that you choose to generate a new " | ||
227 | #~ "configuration file now." | ||
228 | #~ msgstr "Συνιστάται να επιλÎξετε την δημιουÏγία του νÎου αÏχείου Ïυθμίσεων." | ||
229 | |||
230 | #~ msgid "Warning: you must create a new host key" | ||
231 | #~ msgstr "" | ||
232 | #~ "Î Ïοσοχή: Ï€ÏÎπει να δημιουÏγήσετε Îνα νÎο κλειδί για τον υπολογιστή (host " | ||
233 | #~ "key)" | ||
234 | |||
235 | #~ msgid "Warning: telnetd is installed --- probably not a good idea" | ||
236 | #~ msgstr "" | ||
237 | #~ "Î Ïοσοχή: είναι ήδη εγκατεστημÎνος ο telnetd --- όχι και τοσο καλή ιδÎα" | ||
238 | |||
239 | #~ msgid "" | ||
240 | #~ "I'd advise you to either remove the telnetd package (if you don't " | ||
241 | #~ "actually need to offer telnet access) or install telnetd-ssl so that " | ||
242 | #~ "there is at least some chance that telnet sessions will not be sending " | ||
243 | #~ "unencrypted login/password and session information over the network." | ||
244 | #~ msgstr "" | ||
245 | #~ "Συνιστάται είτε να αφαιÏÎσετε το πακÎτο telnetd (αν δεν είναι Ï€Ïαγματικά " | ||
246 | #~ "απαÏαίτητη η Ï€Ïόσβαση μÎσω telnet) ή να εγκαταστήσετε το πακÎτο telnetd-" | ||
247 | #~ "ssl, ώστε να υπάÏχει τουλάχιστον μια πιθανότητα οι συνδÎσεις telnet να " | ||
248 | #~ "μην αποστÎλλουν μη κÏυπτογÏαφημÎνες πληÏοφοÏίες κωδικών Ï€Ïόσβασης και " | ||
249 | #~ "συνεδÏιών μÎσω δικτÏου." | ||
250 | |||
251 | #~ msgid "Warning: rsh-server is installed --- probably not a good idea" | ||
252 | #~ msgstr "" | ||
253 | #~ "Î Ïοσοχή: είναι ήδη εγκατεστημÎνος ο rsh-server --- όχι και τοσο καλή ιδÎα" | ||
254 | |||
255 | #~ msgid "" | ||
256 | #~ "having rsh-server installed undermines the security that you were " | ||
257 | #~ "probably wanting to obtain by installing ssh. I'd advise you to remove " | ||
258 | #~ "that package." | ||
259 | #~ msgstr "" | ||
260 | #~ "Η παÏουσία του rsh-server υπονομεÏει την ασφάλεια του συστήματος, την " | ||
261 | #~ "οποία θÎλετε να εξασφαλίσετε με την εγκατάσταση του ssh. Συνιστάται η " | ||
262 | #~ "αφαίÏεση Î±Ï…Ï„Î¿Ï Ï„Î¿Ï… πακÎτου." | ||
263 | |||
264 | #~ msgid "Do you want ssh-keysign to be installed SUID root?" | ||
265 | #~ msgstr "ΘÎλετε να εγκαταστήσετε το ssh-keysign ως SUID;" | ||
266 | |||
267 | #~ msgid "" | ||
268 | #~ "You have the option of installing the ssh-keysign helper with the SUID " | ||
269 | #~ "bit set." | ||
270 | #~ msgstr "" | ||
271 | #~ "Έχετε την επιλογή της εγκατάστασης του εÏγαλείου ssh-keysign με το bit " | ||
272 | #~ "SUID ενεÏγοποιημÎνο." | ||
273 | |||
274 | #~ msgid "" | ||
275 | #~ "If you make ssh-keysign SUID, you will be able to use SSH's Protocol 2 " | ||
276 | #~ "host-based authentication." | ||
277 | #~ msgstr "" | ||
278 | #~ "Αν εγκαταστήσετε το ssh-keysign SUID, θα μποÏείτε να χÏησιμοποιήσετε την " | ||
279 | #~ "πιστοποίηση υπολογιστή (host-based authentication) του Ï€Ïωτοκόλου SSH 2." | ||
280 | |||
281 | #~ msgid "" | ||
282 | #~ "If in doubt, I suggest you install it with SUID. If it causes problems " | ||
283 | #~ "you can change your mind later by running: dpkg-reconfigure ssh" | ||
284 | #~ msgstr "" | ||
285 | #~ "Αν Îχετε αμφιβολίες, συνιστάται να το εγκαταστήσετε SUID. Αν " | ||
286 | #~ "διαπιστώσετε Ï€Ïοβλήματα μποÏείτε να αλλάξετε τη ÏÏθμιση αυτή εκτελώντας: " | ||
287 | #~ "dpkg-reconfigure ssh" | ||
288 | |||
289 | #~ msgid "Allow SSH protocol 2 only" | ||
290 | #~ msgstr "Îα επιτÏÎπεται μόνο η χÏήση του Ï€Ïωτοκόλλου SSH 2" | ||
291 | |||
292 | #~ msgid "" | ||
293 | #~ "This version of OpenSSH supports version 2 of the ssh protocol, which is " | ||
294 | #~ "much more secure. Disabling ssh 1 is encouraged, however this will slow " | ||
295 | #~ "things down on low end machines and might prevent older clients from " | ||
296 | #~ "connecting (the ssh client shipped with \"potato\" is affected)." | ||
297 | #~ msgstr "" | ||
298 | #~ "Αυτή η Îκδοση του OpenSSH υποστηÏίζει την Îκδοση 2 του Ï€Ïωτοκόλλου ssh, " | ||
299 | #~ "που είναι Ï€Î¿Î»Ï Ï€Î¹Î¿ ασφαλής. Συνιστάται η απενεÏγοποίηση της Îκδοσης 1, " | ||
300 | #~ "ωστόσο αυτό θα γίνει εις βάÏος της ταχÏτητας σε χαμηλότεÏων επιδόσεων " | ||
301 | #~ "συστήματα και θα απαγοÏÎψει τη σÏνδεση σε παλαιότεÏα Ï€ÏογÏάμματα-πελάτες " | ||
302 | #~ "(Ï€.χ. ο πελάτης ssh που διανÎμεται με την Îκδοση \"potato\")." | ||
303 | |||
304 | #~ msgid "" | ||
305 | #~ "Also please note that keys used for protocol 1 are different so you will " | ||
306 | #~ "not be able to use them if you only allow protocol 2 connections." | ||
307 | #~ msgstr "" | ||
308 | #~ "Επίσης, σημειώστε ότι τα κλειδιά που χÏησιμοποιοÏνταν στο Ï€Ïωτόκολλο 1 " | ||
309 | #~ "είναι διαφοÏετικά και δε θα είναι δυνατή η χÏήση τους αν επιτÏÎψετε μόνο " | ||
310 | #~ "τις συνδÎσεις με το Ï€Ïωτόκολλο 2." | ||
311 | |||
312 | #~ msgid "" | ||
313 | #~ "If you later change your mind about this setting, README.Debian has " | ||
314 | #~ "instructions on what to do to your sshd_config file." | ||
315 | #~ msgstr "" | ||
316 | #~ "Αν αποφασίσετε διαφοÏετικά αÏγότεÏα για αυτή τη ÏÏθμιση, το αÏχείο README." | ||
317 | #~ "Debian Îχει οδηγίες για την κατάλληλη Ï„Ïοποποίηση του αÏχείου sshd_config." | ||
318 | |||
319 | #~ msgid "NOTE: Forwarding of X11 and Authorization disabled by default." | ||
320 | #~ msgstr "" | ||
321 | #~ "ΣΗΜΕΙΩΣΗ: Η Ï€Ïοώθηση των πακÎτων X11 και πιστοποίησης είναι " | ||
322 | #~ "απενεÏγοποιημÎνηεξ οÏισμοÏ." | ||
323 | |||
324 | #~ msgid "" | ||
325 | #~ "For security reasons, the Debian version of ssh has ForwardX11 and " | ||
326 | #~ "ForwardAgent set to ``off'' by default." | ||
327 | #~ msgstr "" | ||
328 | #~ "Για λόγους ασφαλείας, η Îκδοση του ssh στο Debian Îχει τις επιλογÎÏ‚ " | ||
329 | #~ "ForwardX11 και ForwardAgent οÏισμÎνες σε ``off'' εξ οÏισμοÏ." | ||
330 | |||
331 | #~ msgid "" | ||
332 | #~ "You can enable it for servers you trust, either in one of the " | ||
333 | #~ "configuration files, or with the -X command line option." | ||
334 | #~ msgstr "" | ||
335 | #~ "ΜποÏείτε να τα ενεÏγοποιήσετε για διακομιστÎÏ‚ που εμπιστεÏεστε, είτε σε " | ||
336 | #~ "Îνα από τα αÏχεία Ïυθμίσεων, είτε μÎσω της επιλογής -X στη γÏαμμή εντολών." | ||
337 | |||
338 | #~ msgid "More details can be found in /usr/share/doc/ssh/README.Debian" | ||
339 | #~ msgstr "" | ||
340 | #~ "ΠεÏισσότεÏες λεπτομÎÏειες μποÏείτε να βÏείτε στο αÏχείο /usr/share/doc/" | ||
341 | #~ "ssh/README.Debian" | ||
342 | |||
343 | #~ msgid "ssh2 keys merged in configuration files" | ||
344 | #~ msgstr "Τα κλειδιά ssh2 συγχωνεÏτηκαν στα αÏχεία Ïυθμίσεων" | ||
345 | |||
346 | #~ msgid "" | ||
347 | #~ "As of version 3 OpenSSH no longer uses separate files for ssh1 and ssh2 " | ||
348 | #~ "keys. This means the authorized_keys2 and known_hosts2 files are no " | ||
349 | #~ "longer needed. They will still be read in order to maintain backwards " | ||
350 | #~ "compatibility" | ||
351 | #~ msgstr "" | ||
352 | #~ "Από την Îκδοση 3 και Îπειτα, το OpenSSH δεν χÏησιμοποιεί πλÎον ξεχωÏιστά " | ||
353 | #~ "αÏχεία για τα κλειδιά των ssh1 και ssh2. Αυτό σημαίνει ότι τα αÏχεία " | ||
354 | #~ "authorized_keys2 και known_hosts2 δεν είναι πλÎον απαÏαίτητα. Θα " | ||
355 | #~ "χÏησιμοποιοÏνται μόνο για λόγους συμβατότητας." | ||
356 | |||
357 | #~ msgid "Do you want to run the sshd server?" | ||
358 | #~ msgstr "ΘÎλετε να εκτελÎσετε τον δαίμονα sshd;" | ||
359 | |||
360 | #~ msgid "This package contains both the ssh client, and the sshd server." | ||
361 | #~ msgstr "Το πακÎτο αυτό πεÏιÎχει το πελάτη ssh και το δαίμονα sshd." | ||
362 | |||
363 | #~ msgid "" | ||
364 | #~ "Normally the sshd Secure Shell Server will be run to allow remote logins " | ||
365 | #~ "via ssh." | ||
366 | #~ msgstr "" | ||
367 | #~ "Κανονικά ο δαίμονας sshd (Δαίμονας ΑσφαλοÏÏ‚ ΚελÏφους) θα εκτελείται για " | ||
368 | #~ "απομακÏυσμÎνες συνδÎσεις μÎσω ssh." | ||
369 | |||
370 | #~ msgid "" | ||
371 | #~ "If you are only interested in using the ssh client for outbound " | ||
372 | #~ "connections on this machine, and don't want to log into it at all using " | ||
373 | #~ "ssh, then you can disable sshd here." | ||
374 | #~ msgstr "" | ||
375 | #~ "Αν ενδιαφÎÏεστε μόνο για τη χÏήση του πελάτη ssh για εξεÏχόμενες " | ||
376 | #~ "συνδÎσεις από αυτόν τον υπολογιστή και δεν επιθυμείτε να συνδÎεστε σε " | ||
377 | #~ "αυτόν μÎσω ssh, τότε μποÏείτε να απενεÏγοποιήσετε τον sshd στο σημείο " | ||
378 | #~ "αυτό." | ||
379 | |||
380 | #~ msgid "Environment options on keys have been deprecated" | ||
381 | #~ msgstr "" | ||
382 | #~ "Οι επιλογÎÏ‚ πεÏιβάλλοντος κελÏφους για τα κλειδιά είναι πλÎον παÏωχημÎνες." | ||
383 | |||
384 | #~ msgid "" | ||
385 | #~ "This version of OpenSSH disables the environment option for public keys " | ||
386 | #~ "by default, in order to avoid certain attacks (for example, LD_PRELOAD). " | ||
387 | #~ "If you are using this option in an authorized_keys file, beware that the " | ||
388 | #~ "keys in question will no longer work until the option is removed." | ||
389 | #~ msgstr "" | ||
390 | #~ "Αυτή η Îκδοση του OpenSSH απενεÏγοποιεί τις επιλογÎÏ‚ πεÏιβάλλοντος " | ||
391 | #~ "κελÏφους για δημόσια κλειδιά εξ οÏισμοÏ, ώστε να αποφευχθοÏν οÏισμÎνου " | ||
392 | #~ "Ï„Ïπου επιθÎσεις (για παÏάδειγμα, LD_PRELOAD). Αν χÏησιμοποιείτε αυτήν την " | ||
393 | #~ "επιλογή σε Îνα αÏχείο authorized_keys, Îχετε υπόψιν σας ότι τα " | ||
394 | #~ "συγκεκÏιμÎνα κλειδιά δεν θα χÏησιμοποιοÏνται Îως ότου αφαιÏεθεί η επιλογή " | ||
395 | #~ "αυτή." | ||
396 | |||
397 | #~ msgid "" | ||
398 | #~ "To re-enable this option, set \"PermitUserEnvironment yes\" in /etc/ssh/" | ||
399 | #~ "sshd_config after the upgrade is complete, taking note of the warning in " | ||
400 | #~ "the sshd_config(5) manual page." | ||
401 | #~ msgstr "" | ||
402 | #~ "Για να επανενεÏγοποιήσετε αυτήν την επιλογή, οÏίστε " | ||
403 | #~ "\"PermitUserEnvironment yes\" στο αÏχείο /etc/ssh/sshd_config μετά το " | ||
404 | #~ "Ï„Îλος της αναβάθμισης, Îχοντας υπόψιν την Ï€Ïοειδοποίηση στη σελίδα " | ||
405 | #~ "οδηγιών του sshd_config(5)." | ||
406 | |||
407 | #~ msgid "Privilege separation" | ||
408 | #~ msgstr "ΔιαχωÏισμός Î Ïονομίων" | ||
409 | |||
410 | #~ msgid "" | ||
411 | #~ "Privilege separation is turned on by default, so if you decide you want " | ||
412 | #~ "it turned off, you need to add \"UsePrivilegeSeparation no\" to /etc/ssh/" | ||
413 | #~ "sshd_config." | ||
414 | #~ msgstr "" | ||
415 | #~ "Ο διαχωÏισμός Ï€Ïονομίων είναι ενεÏγοποιημÎνος εξ οÏισμοÏ, οπότε αν " | ||
416 | #~ "αποφασίσετε ότι θÎλετε να τον απενεÏγοποιήσετε, Ï€ÏÎπει να Ï€ÏοσθÎσετε την " | ||
417 | #~ "ÏÏθμιση \"UsePrivilegeSeparation no\" στο αÏχείο sshd_config." | ||
418 | |||
419 | #~ msgid "Enable Privilege separation" | ||
420 | #~ msgstr "ΕνεÏγοποίηση ΔιαχωÏÎ¹ÏƒÎ¼Î¿Ï Î Ïονομίων" | ||
421 | |||
422 | #~ msgid "" | ||
423 | #~ "This version of OpenSSH contains the new privilege separation option. " | ||
424 | #~ "This significantly reduces the quantity of code that runs as root, and " | ||
425 | #~ "therefore reduces the impact of security holes in sshd." | ||
426 | #~ msgstr "" | ||
427 | #~ "Αυτή η Îκδοση του OpenSSH πεÏιλαμβάνει τη νÎα επιλογή διαχωÏÎ¹ÏƒÎ¼Î¿Ï " | ||
428 | #~ "Ï€Ïονομίων. Αυτό μειώνει δÏαστικά το ποσοστό των Ï€ÏογÏαμμάτων που " | ||
429 | #~ "εκτελοÏνται ως root, και κατά συνÎπεια και τις Ï„ÏÏπες ασφαλείας του sshd." | ||
430 | |||
431 | #~ msgid "" | ||
432 | #~ "Unfortunately, privilege separation interacts badly with PAM. Any PAM " | ||
433 | #~ "session modules that need to run as root (pam_mkhomedir, for example) " | ||
434 | #~ "will fail, and PAM keyboard-interactive authentication won't work." | ||
435 | #~ msgstr "" | ||
436 | #~ "Δυστυχώς, ο διαχωÏισμός Ï€Ïονομίων δεν συνεÏγάζεται σωστά με το PAM. " | ||
437 | #~ "Οποιεσδήποτε μονάδες συνεδÏίας (session modules) του PAM που Ï€ÏÎπει να " | ||
438 | #~ "εκτελεστοÏν ως root (pam_mkhomedir, για παÏάδειγμα) θα αποτÏχουν, και η " | ||
439 | #~ "πιστοποίηση μÎσω πληκτÏολογίου στο PAM δεν θα λειτουÏγεί." | ||
440 | |||
441 | #~ msgid "" | ||
442 | #~ "Since you've opted to have me generate an sshd_config file for you, you " | ||
443 | #~ "can choose whether or not to have privilege separation turned on or not. " | ||
444 | #~ "Unless you know you need to use PAM features that won't work with this " | ||
445 | #~ "option, you should enable it." | ||
446 | #~ msgstr "" | ||
447 | #~ "Εφόσον Îχετε επιλÎξει να δημιουÏγήθεί αυτόματα το αÏχείο sshd_config, " | ||
448 | #~ "μποÏείτε να επιλÎξετε επίσης αν θÎλετε να ενεÏγοποιήσετε το διαχωÏισμό " | ||
449 | #~ "Ï€Ïονομίων ή όχι. Εκτός αν γνωÏίζετε ότι χÏειάζεστε να χÏησιμοποιήσετε " | ||
450 | #~ "χαÏακτηÏιστικά του PAM που δε συνεÏγάζονται με αυτή την επιλογή, " | ||
451 | #~ "συνιστάται να την ενεÏγοποιήσετε." | ||
diff --git a/debian/po/es.po b/debian/po/es.po new file mode 100644 index 000000000..94667d7af --- /dev/null +++ b/debian/po/es.po | |||
@@ -0,0 +1,448 @@ | |||
1 | # | ||
2 | # openssh debconf translation to spanish | ||
3 | # Copyright (C) 2003-2007 Software in the Public Interest | ||
4 | # This file is distributed under the same license as the XXXX package. | ||
5 | # | ||
6 | # Changes: | ||
7 | # - Initial translation | ||
8 | # Carlos Valdivia Yagüe <valyag@dat,etsit.upm.es>, 2003 | ||
9 | # - Revision | ||
10 | # Javier Fernandez-Sanguino Peña <jfs@computer.org>, 2004 | ||
11 | # - Translation updates | ||
12 | # Javier Fernandez-Sanguino Peña <jfs@computer.org>, 2006-2008 | ||
13 | # | ||
14 | # Traductores, si no conoce el formato PO, merece la pena leer la | ||
15 | # documentación de gettext, especialmente las secciones dedicadas a este | ||
16 | # formato, por ejemplo ejecutando: | ||
17 | # info -n '(gettext)PO Files' | ||
18 | # info -n '(gettext)Header Entry' | ||
19 | # | ||
20 | # Equipo de traducción al español, por favor lean antes de traducir | ||
21 | # los siguientes documentos: | ||
22 | # | ||
23 | # - El proyecto de traducción de Debian al español | ||
24 | # http://www.debian.org/intl/spanish/coordinacion | ||
25 | # especialmente las notas de traducción en | ||
26 | # http://www.debian.org/intl/spanish/notas | ||
27 | # | ||
28 | # - La guía de traducción de po's de debconf: | ||
29 | # /usr/share/doc/po-debconf/README-trans | ||
30 | # o http://www.debian.org/intl/l10n/po-debconf/README-trans | ||
31 | # | ||
32 | msgid "" | ||
33 | msgstr "" | ||
34 | "Project-Id-Version: openssh 3.6.1p2-11\n" | ||
35 | "Report-Msgid-Bugs-To: openssh@packages.debian.org\n" | ||
36 | "POT-Creation-Date: 2010-01-02 08:55+0000\n" | ||
37 | "PO-Revision-Date: 2008-05-22 00:56+0200\n" | ||
38 | "Last-Translator: Javier Fernandez-Sanguino Peña <jfs@debian.org>\n" | ||
39 | "Language-Team: Debian L10n Spanish <debian-l10n-spanish@lists.debian.org>\n" | ||
40 | "MIME-Version: 1.0\n" | ||
41 | "Content-Type: text/plain; charset=ISO-8859-15\n" | ||
42 | "Content-Transfer-Encoding: 8bit\n" | ||
43 | "X-POFile-SpellExtra: usr pid PasswordAuthentication PermitRootLogin server\n" | ||
44 | "X-POFile-SpellExtra: PAM start OpenSSH OpenSSL init sshhostkey daemon var\n" | ||
45 | "X-POFile-SpellExtra: config pam pidfile vulnkey run Potato keys share stop\n" | ||
46 | "X-POFile-SpellExtra: gz README ssh sshd doc keygen ARCHIVOCLAVESISTEMA SSH\n" | ||
47 | "X-POFile-SpellExtra: openssh root compromised\n" | ||
48 | |||
49 | #. Type: boolean | ||
50 | #. Description | ||
51 | #: ../openssh-server.templates:1001 | ||
52 | msgid "Do you want to risk killing active SSH sessions?" | ||
53 | msgstr "¿Desea correr el riesgo de matar las sesiones SSH activas?" | ||
54 | |||
55 | #. Type: boolean | ||
56 | #. Description | ||
57 | #: ../openssh-server.templates:1001 | ||
58 | msgid "" | ||
59 | "The currently installed version of /etc/init.d/ssh is likely to kill all " | ||
60 | "running sshd instances. If you are doing this upgrade via an SSH session, " | ||
61 | "you're likely to be disconnected and leave the upgrade procedure unfinished." | ||
62 | msgstr "" | ||
63 | "La versión de /etc/init.d/ssh que tiene instalada es muy probable que mate " | ||
64 | "todas las estancias que están ejecutándose de sshd. Es muy probable que se " | ||
65 | "le desconecte y el procedimiento de actualización quede a medidas si " | ||
66 | "continúa y está realizando esta actualizando." | ||
67 | |||
68 | #. Type: boolean | ||
69 | #. Description | ||
70 | #: ../openssh-server.templates:1001 | ||
71 | msgid "" | ||
72 | "This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the " | ||
73 | "start-stop-daemon line in the stop section of the file." | ||
74 | msgstr "" | ||
75 | "Puede arreglarlo añadiendo manualmente «--pidfile /var/run/sshd.pid» a la " | ||
76 | "línea «start-stop-daemon», en la sección «stop» del fichero." | ||
77 | |||
78 | #. Type: note | ||
79 | #. Description | ||
80 | #: ../openssh-server.templates:2001 | ||
81 | msgid "New host key mandatory" | ||
82 | msgstr "Nueva clave de sistema obligatoria" | ||
83 | |||
84 | #. Type: note | ||
85 | #. Description | ||
86 | #: ../openssh-server.templates:2001 | ||
87 | msgid "" | ||
88 | "The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA " | ||
89 | "algorithm. OpenSSH can not handle this host key file, and the ssh-keygen " | ||
90 | "utility from the old (non-free) SSH installation does not appear to be " | ||
91 | "available." | ||
92 | msgstr "" | ||
93 | "La clave actual de su sistema, en /etc/ssh/ssh_host_key, está cifrada con el " | ||
94 | "algoritmo IDEA. OpenSSH no puede manejar este fichero de clave y tampoco " | ||
95 | "parece estar disponible la utilidad «ssh-keygen» de la instalación antigua de " | ||
96 | "SSH (no libre)." | ||
97 | |||
98 | #. Type: note | ||
99 | #. Description | ||
100 | #: ../openssh-server.templates:2001 | ||
101 | msgid "You need to manually generate a new host key." | ||
102 | msgstr "Debe generar manualmente una nueva clave de sistema." | ||
103 | |||
104 | #. Type: boolean | ||
105 | #. Description | ||
106 | #: ../openssh-server.templates:3001 | ||
107 | msgid "Disable challenge-response authentication?" | ||
108 | msgstr "¿Desea deshabilitar la autenticación basada en desafío-respuesta?" | ||
109 | |||
110 | #. Type: boolean | ||
111 | #. Description | ||
112 | #: ../openssh-server.templates:3001 | ||
113 | msgid "" | ||
114 | "Password authentication appears to be disabled in the current OpenSSH server " | ||
115 | "configuration. In order to prevent users from logging in using passwords " | ||
116 | "(perhaps using only public key authentication instead) with recent versions " | ||
117 | "of OpenSSH, you must disable challenge-response authentication, or else " | ||
118 | "ensure that your PAM configuration does not allow Unix password file " | ||
119 | "authentication." | ||
120 | msgstr "" | ||
121 | "Parece que la configuración actual de su servidor de OpenSSH tiene " | ||
122 | "deshabilitada la autenticación mediante contraseñas. En las versiones " | ||
123 | "recientes de OpenSSH para impedir que los usuarios se puedan conectar con " | ||
124 | "contraseñas (y obligar la utilización de sistemas de autenticación con clave " | ||
125 | "pública) debe deshabilitar la autenticación basada en desafío-respuesta o " | ||
126 | "asegurarse de que su configuración PAM no permite autenticación basada en el " | ||
127 | "fichero de contraseñas Unix." | ||
128 | |||
129 | #. Type: boolean | ||
130 | #. Description | ||
131 | #: ../openssh-server.templates:3001 | ||
132 | msgid "" | ||
133 | "If you disable challenge-response authentication, then users will not be " | ||
134 | "able to log in using passwords. If you leave it enabled (the default " | ||
135 | "answer), then the 'PasswordAuthentication no' option will have no useful " | ||
136 | "effect unless you also adjust your PAM configuration in /etc/pam.d/ssh." | ||
137 | msgstr "" | ||
138 | "Si deshabilita la autenticación mediante desafío-respuesta los usuarios no " | ||
139 | "podrán acceder con contraseñas. Si la deja habilitada (respuesta por " | ||
140 | "omisión) entonces la opción «PasswordAuthentication no» no tendrá ninguna " | ||
141 | "utilidad a menos que ajuste su configuración de PAM en «/etc/pam.d/ssh»." | ||
142 | |||
143 | #. Type: note | ||
144 | #. Description | ||
145 | #: ../openssh-server.templates:4001 | ||
146 | msgid "Vulnerable host keys will be regenerated" | ||
147 | msgstr "Se regenerarán las claves vulnerables del sistema" | ||
148 | |||
149 | #. Type: note | ||
150 | #. Description | ||
151 | #: ../openssh-server.templates:4001 | ||
152 | msgid "" | ||
153 | "Some of the OpenSSH server host keys on this system were generated with a " | ||
154 | "version of OpenSSL that had a broken random number generator. As a result, " | ||
155 | "these host keys are from a well-known set, are subject to brute-force " | ||
156 | "attacks, and must be regenerated." | ||
157 | msgstr "" | ||
158 | "Algunas de las claves de sistema del servidor OpenSSH en este equipo se " | ||
159 | "generaron con una versión de OpenSSL que tenía un generador de números " | ||
160 | "aleatorios defectuoso. Consecuentemente, estas claves de sistema son de un " | ||
161 | "conjunto de claves conocidas y están sujetas a ataques de fuerza bruta por " | ||
162 | "lo que conviene regenerarlas." | ||
163 | |||
164 | #. Type: note | ||
165 | #. Description | ||
166 | #: ../openssh-server.templates:4001 | ||
167 | msgid "" | ||
168 | "Users of this system should be informed of this change, as they will be " | ||
169 | "prompted about the host key change the next time they log in. Use 'ssh-" | ||
170 | "keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of " | ||
171 | "the new host keys." | ||
172 | msgstr "" | ||
173 | "Se informará a los usuarios de este sistema ya que se les informará del " | ||
174 | "cambio de clave la siguiente vez que se conecten. Utilice «ssh-keygen -l -f " | ||
175 | "ARCHIVO_CLAVE_SISTEMA» después de la actualización para obtener la huella " | ||
176 | "digital de las nuevas claves del sistema." | ||
177 | |||
178 | #. Type: note | ||
179 | #. Description | ||
180 | #: ../openssh-server.templates:4001 | ||
181 | msgid "The affected host keys are:" | ||
182 | msgstr "Las claves del sistema afectadas son:" | ||
183 | |||
184 | #. Type: note | ||
185 | #. Description | ||
186 | #: ../openssh-server.templates:4001 | ||
187 | msgid "" | ||
188 | "User keys may also be affected by this problem. The 'ssh-vulnkey' command " | ||
189 | "may be used as a partial test for this. See /usr/share/doc/openssh-server/" | ||
190 | "README.compromised-keys.gz for more details." | ||
191 | msgstr "" | ||
192 | "Las claves de los usuarios también pueden estar afectadas por este problema. " | ||
193 | "Se puede utilizar el programa «ssh-vulnkey» como un test parcial para " | ||
194 | "detectar el problema. Consulte la información en «/usr/share/doc/openssh-" | ||
195 | "server/README.compromised-keys.gz» para conocer los detalles." | ||
196 | |||
197 | #~ msgid "Generate a new configuration file for OpenSSH?" | ||
198 | #~ msgstr "¿Desea generar un nuevo fichero de configuración para OpenSSH?" | ||
199 | |||
200 | #~ msgid "" | ||
201 | #~ "This version of OpenSSH has a considerably changed configuration file " | ||
202 | #~ "from the version shipped in Debian 'Potato', which you appear to be " | ||
203 | #~ "upgrading from. This package can now generate a new configuration file (/" | ||
204 | #~ "etc/ssh/sshd.config), which will work with the new server version, but " | ||
205 | #~ "will not contain any customizations you made with the old version." | ||
206 | #~ msgstr "" | ||
207 | #~ "Esta versión de OpenSSH ha cambiado considerablemente el fichero de " | ||
208 | #~ "configuración del incluido en Debian 'Potato', que es la versión desde la " | ||
209 | #~ "que parece estar actualizando. Puede crear automáticamente un nuevo " | ||
210 | #~ "fichero de configuración (/etc/ssh/sshd.config), que funcionará con la " | ||
211 | #~ "nueva versión del servidor, pero no incluirá las modificaciones que " | ||
212 | #~ "hiciera en la versión antigua." | ||
213 | |||
214 | #~ msgid "" | ||
215 | #~ "Please note that this new configuration file will set the value of " | ||
216 | #~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password " | ||
217 | #~ "can ssh directly in as root). Please read the README.Debian file for more " | ||
218 | #~ "details about this design choice." | ||
219 | #~ msgstr "" | ||
220 | #~ "Además, recuerde que este nuevo fichero de configuración dirá sí en la " | ||
221 | #~ "opción «PermitRootLogin», por lo que cualquiera que conozca la contraseña " | ||
222 | #~ "de root podrá entrar mediante ssh directamente como root. Puede leer " | ||
223 | #~ "README.Debian si quiere conocer más información sobre esta elección de " | ||
224 | #~ "diseño." | ||
225 | |||
226 | #~ msgid "" | ||
227 | #~ "It is strongly recommended that you choose to generate a new " | ||
228 | #~ "configuration file now." | ||
229 | #~ msgstr "" | ||
230 | #~ "Es muy recomendable que elija generar un nuevo fichero de configuración " | ||
231 | #~ "ahora." | ||
232 | |||
233 | #~ msgid "Warning: you must create a new host key" | ||
234 | #~ msgstr "Aviso: debe crear una nueva clave para su servidor" | ||
235 | |||
236 | #~ msgid "Warning: telnetd is installed --- probably not a good idea" | ||
237 | #~ msgstr "Aviso: tiene telnetd instalado (posiblemente no es una buena idea)" | ||
238 | |||
239 | #~ msgid "" | ||
240 | #~ "I'd advise you to either remove the telnetd package (if you don't " | ||
241 | #~ "actually need to offer telnet access) or install telnetd-ssl so that " | ||
242 | #~ "there is at least some chance that telnet sessions will not be sending " | ||
243 | #~ "unencrypted login/password and session information over the network." | ||
244 | #~ msgstr "" | ||
245 | #~ "Es muy aconsejable que borre el paquete telnetd si no necesita realmente " | ||
246 | #~ "ofrecer acceso mediante telnet o instalar telnetd-ssl para que las " | ||
247 | #~ "contraseñas, nombres de usuario y demás información de las sesiones " | ||
248 | #~ "telnet no viajen sin cifrar por la red." | ||
249 | |||
250 | #~ msgid "Warning: rsh-server is installed --- probably not a good idea" | ||
251 | #~ msgstr "" | ||
252 | #~ "Aviso: tiene rsh-server instalado (seguramente, esto no es una buena idea)" | ||
253 | |||
254 | #~ msgid "" | ||
255 | #~ "having rsh-server installed undermines the security that you were " | ||
256 | #~ "probably wanting to obtain by installing ssh. I'd advise you to remove " | ||
257 | #~ "that package." | ||
258 | #~ msgstr "" | ||
259 | #~ "Tener rsh-server instalado representa un menoscabo de la seguridad que " | ||
260 | #~ "probablemente desea obtener instalando ssh. Es muy aconsejable que borre " | ||
261 | #~ "ese paquete." | ||
262 | |||
263 | #~ msgid "Do you want ssh-keysign to be installed SUID root?" | ||
264 | #~ msgstr "¿Quiere instalar ssh-keysign SUID root?" | ||
265 | |||
266 | #~ msgid "" | ||
267 | #~ "You have the option of installing the ssh-keysign helper with the SUID " | ||
268 | #~ "bit set." | ||
269 | #~ msgstr "" | ||
270 | #~ "Puede instalar ssh-keysign con el bit SUID (se ejecutará con privilegios " | ||
271 | #~ "de root)." | ||
272 | |||
273 | #~ msgid "" | ||
274 | #~ "If you make ssh-keysign SUID, you will be able to use SSH's Protocol 2 " | ||
275 | #~ "host-based authentication." | ||
276 | #~ msgstr "" | ||
277 | #~ "Si hace ssh-keysign SUID, podrá usar la autenticación basada en servidor " | ||
278 | #~ "de la versión 2 del protocolo SSH." | ||
279 | |||
280 | #~ msgid "" | ||
281 | #~ "If in doubt, I suggest you install it with SUID. If it causes problems " | ||
282 | #~ "you can change your mind later by running: dpkg-reconfigure ssh" | ||
283 | #~ msgstr "" | ||
284 | #~ "Si duda, se recomienda que lo instale SUID. Si le causa problemas puede " | ||
285 | #~ "cambiar de opinión posteriormente ejecutando «dpkg-reconfigure ssh»." | ||
286 | |||
287 | #~ msgid "Allow SSH protocol 2 only" | ||
288 | #~ msgstr "Permitir sólo la versión 2 del protocolo SSH" | ||
289 | |||
290 | #~ msgid "" | ||
291 | #~ "This version of OpenSSH supports version 2 of the ssh protocol, which is " | ||
292 | #~ "much more secure. Disabling ssh 1 is encouraged, however this will slow " | ||
293 | #~ "things down on low end machines and might prevent older clients from " | ||
294 | #~ "connecting (the ssh client shipped with \"potato\" is affected)." | ||
295 | #~ msgstr "" | ||
296 | #~ "Esta versión de OpenSSH soporta la versión 2 del protocolo ssh, que es " | ||
297 | #~ "mucho más segura que la anterior. Se recomienda desactivar la versión 1, " | ||
298 | #~ "aunque funcionará más lento en máquinas modestas y puede impedir que se " | ||
299 | #~ "conecten clientes antiguos, como, por ejemplo, el incluido en «potato»." | ||
300 | |||
301 | #~ msgid "" | ||
302 | #~ "Also please note that keys used for protocol 1 are different so you will " | ||
303 | #~ "not be able to use them if you only allow protocol 2 connections." | ||
304 | #~ msgstr "" | ||
305 | #~ "También tenga en cuenta que las claves utilizadas para el protocolo 1 son " | ||
306 | #~ "diferentes, por lo que no podrá usarlas si únicamente permite conexiones " | ||
307 | #~ "mediante la versión 2 del protocolo." | ||
308 | |||
309 | #~ msgid "" | ||
310 | #~ "If you later change your mind about this setting, README.Debian has " | ||
311 | #~ "instructions on what to do to your sshd_config file." | ||
312 | #~ msgstr "" | ||
313 | #~ "Si más tarde cambia de opinión, el fichero README.Debian contiene " | ||
314 | #~ "instrucciones sobre cómo modificar en el fichero sshd_config." | ||
315 | |||
316 | #~ msgid "NOTE: Forwarding of X11 and Authorization disabled by default." | ||
317 | #~ msgstr "NOTA: Reenvío de X11 y Autorización desactivadas por defecto." | ||
318 | |||
319 | #~ msgid "" | ||
320 | #~ "For security reasons, the Debian version of ssh has ForwardX11 and " | ||
321 | #~ "ForwardAgent set to ``off'' by default." | ||
322 | #~ msgstr "" | ||
323 | #~ "Por razones de seguridad, la versión de ssh de Debian tiene por defecto " | ||
324 | #~ "ForwardX11 y ForwardAgent desactivadas." | ||
325 | |||
326 | #~ msgid "" | ||
327 | #~ "You can enable it for servers you trust, either in one of the " | ||
328 | #~ "configuration files, or with the -X command line option." | ||
329 | #~ msgstr "" | ||
330 | #~ "Puede activar estas opciones para los servidores en los que confíe, en " | ||
331 | #~ "los ficheros de configuración o con la opción -X en línea de comandos." | ||
332 | |||
333 | #~ msgid "More details can be found in /usr/share/doc/ssh/README.Debian" | ||
334 | #~ msgstr "Puede encontrar más detalles en /usr/share/doc/ssh/README.Debian." | ||
335 | |||
336 | #~ msgid "ssh2 keys merged in configuration files" | ||
337 | #~ msgstr "Las claves ssh2 ya se incluyen en los ficheros de configuración" | ||
338 | |||
339 | #~ msgid "" | ||
340 | #~ "As of version 3 OpenSSH no longer uses separate files for ssh1 and ssh2 " | ||
341 | #~ "keys. This means the authorized_keys2 and known_hosts2 files are no " | ||
342 | #~ "longer needed. They will still be read in order to maintain backwards " | ||
343 | #~ "compatibility" | ||
344 | #~ msgstr "" | ||
345 | #~ "A partir de la versión 3, OpenSSH ya no utiliza ficheros diferentes para " | ||
346 | #~ "las claves ssh1 y ssh2. Esto quiere decir que ya no son necesarios los " | ||
347 | #~ "ficheros authorized_keys2 y known_hosts2, aunque aún se seguirán leyendo " | ||
348 | #~ "para mantener compatibilidad hacia atrás." | ||
349 | |||
350 | #~ msgid "Do you want to run the sshd server?" | ||
351 | #~ msgstr "¿Quiere ejecutar el servidor sshd?" | ||
352 | |||
353 | #~ msgid "This package contains both the ssh client, and the sshd server." | ||
354 | #~ msgstr "Este paquete contiene el cliente ssh y el servidor sshd." | ||
355 | |||
356 | #~ msgid "" | ||
357 | #~ "Normally the sshd Secure Shell Server will be run to allow remote logins " | ||
358 | #~ "via ssh." | ||
359 | #~ msgstr "" | ||
360 | #~ "Generalmente, el servidor de ssh (Secure Shell Server) se ejecuta para " | ||
361 | #~ "permitir el acceso remoto mediante ssh." | ||
362 | |||
363 | #~ msgid "" | ||
364 | #~ "If you are only interested in using the ssh client for outbound " | ||
365 | #~ "connections on this machine, and don't want to log into it at all using " | ||
366 | #~ "ssh, then you can disable sshd here." | ||
367 | #~ msgstr "" | ||
368 | #~ "Si sólo está interesado en usar el cliente ssh en conexiones salientes " | ||
369 | #~ "del sistema y no quiere acceder a él mediante ssh, entonces puede " | ||
370 | #~ "desactivar sshd." | ||
371 | |||
372 | #~ msgid "Environment options on keys have been deprecated" | ||
373 | #~ msgstr "Las opciones de entorno para las claves, en desuso" | ||
374 | |||
375 | #~ msgid "" | ||
376 | #~ "This version of OpenSSH disables the environment option for public keys " | ||
377 | #~ "by default, in order to avoid certain attacks (for example, LD_PRELOAD). " | ||
378 | #~ "If you are using this option in an authorized_keys file, beware that the " | ||
379 | #~ "keys in question will no longer work until the option is removed." | ||
380 | #~ msgstr "" | ||
381 | #~ "Esta versión de OpenSSH tiene desactivada por defecto la opción de " | ||
382 | #~ "entorno para las claves públicas, para evitar ciertos ataques (por " | ||
383 | #~ "ejemplo, basados en LD_PRELOAD). Si utiliza esta opción en un fichero " | ||
384 | #~ "authorized_keys, las claves implicadas no funcionarán hasta que borre la " | ||
385 | #~ "opción." | ||
386 | |||
387 | #~ msgid "" | ||
388 | #~ "To re-enable this option, set \"PermitUserEnvironment yes\" in /etc/ssh/" | ||
389 | #~ "sshd_config after the upgrade is complete, taking note of the warning in " | ||
390 | #~ "the sshd_config(5) manual page." | ||
391 | #~ msgstr "" | ||
392 | #~ "Para volver a activar esta opción, escriba «PermitUserEnvironment yes» en /" | ||
393 | #~ "etc/ssh/sshd_config al terminar la actualización, teniendo en cuenta el " | ||
394 | #~ "aviso de la página de manual de sshd_config(5)." | ||
395 | |||
396 | #~ msgid "Privilege separation" | ||
397 | #~ msgstr "Separación de privilegios" | ||
398 | |||
399 | #~ msgid "" | ||
400 | #~ "Privilege separation is turned on by default, so if you decide you want " | ||
401 | #~ "it turned off, you need to add \"UsePrivilegeSeparation no\" to /etc/ssh/" | ||
402 | #~ "sshd_config." | ||
403 | #~ msgstr "" | ||
404 | #~ "La separación de privilegios está activa por defecto, por lo que si " | ||
405 | #~ "decide desactivarla, tiene que añadir «UsePrivilegeSeparation no» al " | ||
406 | #~ "fichero /etc/ssh/sshd_config." | ||
407 | |||
408 | #~ msgid "Enable Privilege separation" | ||
409 | #~ msgstr "Activar separación de privilegios" | ||
410 | |||
411 | #~ msgid "" | ||
412 | #~ "This version of OpenSSH contains the new privilege separation option. " | ||
413 | #~ "This significantly reduces the quantity of code that runs as root, and " | ||
414 | #~ "therefore reduces the impact of security holes in sshd." | ||
415 | #~ msgstr "" | ||
416 | #~ "Esta versión de OpenSSH incluye una nueva opción de separación de " | ||
417 | #~ "privilegios que reduce significativamente la cantidad de código que se " | ||
418 | #~ "ejecuta como root, por lo que reduce el impacto de posibles agujeros de " | ||
419 | #~ "seguridad en sshd." | ||
420 | |||
421 | #~ msgid "" | ||
422 | #~ "Unfortunately, privilege separation interacts badly with PAM. Any PAM " | ||
423 | #~ "session modules that need to run as root (pam_mkhomedir, for example) " | ||
424 | #~ "will fail, and PAM keyboard-interactive authentication won't work." | ||
425 | #~ msgstr "" | ||
426 | #~ "Desafortunadamente, la separación de privilegios no funciona " | ||
427 | #~ "correctamente con PAM. Cualquier módulo PAM que necesite ejecutarse como " | ||
428 | #~ "root (como, por ejemplo, pam_mkhomedir) y la autenticación interactiva " | ||
429 | #~ "PAM con teclado no funcionarán." | ||
430 | |||
431 | #~ msgid "" | ||
432 | #~ "Since you've opted to have me generate an sshd_config file for you, you " | ||
433 | #~ "can choose whether or not to have privilege separation turned on or not. " | ||
434 | #~ "Unless you know you need to use PAM features that won't work with this " | ||
435 | #~ "option, you should enable it." | ||
436 | #~ msgstr "" | ||
437 | #~ "Puesto que ha elegido crear automáticamente el fichero sshd_config, puede " | ||
438 | #~ "decidir ahora si quiere activar la opción de separación de privilegios. A " | ||
439 | #~ "menos que necesite usar ciertas características de PAM que no funcionan " | ||
440 | #~ "con esta opción, debería responder sí a esta pregunta." | ||
441 | |||
442 | #~ msgid "" | ||
443 | #~ "NB! If you are running a 2.0 series Linux kernel, then privilege " | ||
444 | #~ "separation will not work at all, and your sshd will fail to start unless " | ||
445 | #~ "you explicitly turn privilege separation off." | ||
446 | #~ msgstr "" | ||
447 | #~ "Nota: Si utiliza un núcleo Linux 2.0, la separación de privilegios " | ||
448 | #~ "fallará estrepitosamente y sshd no funcionará a no ser que la desactive." | ||
diff --git a/debian/po/eu.po b/debian/po/eu.po new file mode 100644 index 000000000..efa16fa81 --- /dev/null +++ b/debian/po/eu.po | |||
@@ -0,0 +1,197 @@ | |||
1 | # translation of openssh-templates.po to basque | ||
2 | # Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER | ||
3 | # This file is distributed under the same license as the PACKAGE package. | ||
4 | # | ||
5 | # Piarres Beobide <pi@beobide.net>, 2007, 2008. | ||
6 | msgid "" | ||
7 | msgstr "" | ||
8 | "Project-Id-Version: openssh-templates\n" | ||
9 | "Report-Msgid-Bugs-To: openssh@packages.debian.org\n" | ||
10 | "POT-Creation-Date: 2010-01-02 08:55+0000\n" | ||
11 | "PO-Revision-Date: 2007-04-27 12:10+0200\n" | ||
12 | "Last-Translator: Piarres Beobide <pi@beobide.net>\n" | ||
13 | "Language-Team: librezale <librezale@librezale.org>\n" | ||
14 | "MIME-Version: 1.0\n" | ||
15 | "Content-Type: text/plain; charset=UTF-8\n" | ||
16 | "Content-Transfer-Encoding: 8bit\n" | ||
17 | "X-Generator: Pootle 0.11\n" | ||
18 | "Plural-Forms: nplurals=2; plural=(n != 1);\n" | ||
19 | |||
20 | #. Type: boolean | ||
21 | #. Description | ||
22 | #: ../openssh-server.templates:1001 | ||
23 | msgid "Do you want to risk killing active SSH sessions?" | ||
24 | msgstr "Irekirik dauden SSH saioak ixteko arriskua hartu nahi duzu?" | ||
25 | |||
26 | #. Type: boolean | ||
27 | #. Description | ||
28 | #: ../openssh-server.templates:1001 | ||
29 | msgid "" | ||
30 | "The currently installed version of /etc/init.d/ssh is likely to kill all " | ||
31 | "running sshd instances. If you are doing this upgrade via an SSH session, " | ||
32 | "you're likely to be disconnected and leave the upgrade procedure unfinished." | ||
33 | msgstr "" | ||
34 | "Instalaturik dagoen /etc/init.d/ssh bertsioak martxan dauden sshd " | ||
35 | "instantziak hilko ditu. Bertsio berritze hau SSH bidez egiten ari bazara, " | ||
36 | "ziurrenik deskonektatu egingo zara eta bertsio berritze prozedura ez da " | ||
37 | "behar bezala amaituko." | ||
38 | |||
39 | #. Type: boolean | ||
40 | #. Description | ||
41 | #: ../openssh-server.templates:1001 | ||
42 | msgid "" | ||
43 | "This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the " | ||
44 | "start-stop-daemon line in the stop section of the file." | ||
45 | msgstr "" | ||
46 | "Hau eskuz konpondu daiteke \"--pidfile /var/run/sshd.pid\" gehituaz start-" | ||
47 | "stop-daemon lerroan fitxategiaren \"stop\" atalean." | ||
48 | |||
49 | #. Type: note | ||
50 | #. Description | ||
51 | #: ../openssh-server.templates:2001 | ||
52 | msgid "New host key mandatory" | ||
53 | msgstr "Ostalari gako berria beharrezkoa" | ||
54 | |||
55 | #. Type: note | ||
56 | #. Description | ||
57 | #: ../openssh-server.templates:2001 | ||
58 | msgid "" | ||
59 | "The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA " | ||
60 | "algorithm. OpenSSH can not handle this host key file, and the ssh-keygen " | ||
61 | "utility from the old (non-free) SSH installation does not appear to be " | ||
62 | "available." | ||
63 | msgstr "" | ||
64 | "/etc/ssh/ssh_host_key-ko ostalari gakoa IDEA algoritmoaren bidez " | ||
65 | "enkriptaturik dago. OpenSSH ez da ostalari gako mota hau kudeatzeko gai eta " | ||
66 | "SSH instalazio zaharreko (ez-librea) ssh-keygen lanabesa dirudienez ez dago " | ||
67 | "erabilgarri." | ||
68 | |||
69 | #. Type: note | ||
70 | #. Description | ||
71 | #: ../openssh-server.templates:2001 | ||
72 | msgid "You need to manually generate a new host key." | ||
73 | msgstr "Ostalari gako berri bat eskuz sortu behar duzu." | ||
74 | |||
75 | #. Type: boolean | ||
76 | #. Description | ||
77 | #: ../openssh-server.templates:3001 | ||
78 | msgid "Disable challenge-response authentication?" | ||
79 | msgstr "erronka-erantzun autentifikazioa desgaitu?" | ||
80 | |||
81 | #. Type: boolean | ||
82 | #. Description | ||
83 | #: ../openssh-server.templates:3001 | ||
84 | msgid "" | ||
85 | "Password authentication appears to be disabled in the current OpenSSH server " | ||
86 | "configuration. In order to prevent users from logging in using passwords " | ||
87 | "(perhaps using only public key authentication instead) with recent versions " | ||
88 | "of OpenSSH, you must disable challenge-response authentication, or else " | ||
89 | "ensure that your PAM configuration does not allow Unix password file " | ||
90 | "authentication." | ||
91 | msgstr "" | ||
92 | "Pasahitz egiaztapena dirudienez desgaiturik dago instalaturik dagoen OpenSSH " | ||
93 | "konfigurazioan. Pasahitzak erabiliaz OpenSSH bertsio berrietan saio hastea " | ||
94 | "ezintzeko (agian gako publiko autentifikazioa bakarrik erabiliaz), erronka-" | ||
95 | "erantzun (challenge-response) autentifikazioa desgaitu edo zure PAM " | ||
96 | "konfigurazioak UNIX pasahitz fitxategi autentifikazioa onartzen ez duela " | ||
97 | "ziurtatu beharko duzu." | ||
98 | |||
99 | #. Type: boolean | ||
100 | #. Description | ||
101 | #: ../openssh-server.templates:3001 | ||
102 | msgid "" | ||
103 | "If you disable challenge-response authentication, then users will not be " | ||
104 | "able to log in using passwords. If you leave it enabled (the default " | ||
105 | "answer), then the 'PasswordAuthentication no' option will have no useful " | ||
106 | "effect unless you also adjust your PAM configuration in /etc/pam.d/ssh." | ||
107 | msgstr "" | ||
108 | "Erronka-erantzun autentifikazioa des\tgaituaz gero erabiltzaileak ez dira " | ||
109 | "pasahitza erabiliaz saio hasteko gai izango. Berau gaiturik utziaz gero " | ||
110 | "(lehenetsiriko erantzuna), 'PasswordAuthentication no' aukerak ez du " | ||
111 | "ondoriorik izango /etc/pam.d/ssh-eko PAM konfigurazioa doitzen ez baduzu." | ||
112 | |||
113 | #. Type: note | ||
114 | #. Description | ||
115 | #: ../openssh-server.templates:4001 | ||
116 | msgid "Vulnerable host keys will be regenerated" | ||
117 | msgstr "Ostalari gako ahulak birsortu egingo dira" | ||
118 | |||
119 | #. Type: note | ||
120 | #. Description | ||
121 | #: ../openssh-server.templates:4001 | ||
122 | msgid "" | ||
123 | "Some of the OpenSSH server host keys on this system were generated with a " | ||
124 | "version of OpenSSL that had a broken random number generator. As a result, " | ||
125 | "these host keys are from a well-known set, are subject to brute-force " | ||
126 | "attacks, and must be regenerated." | ||
127 | msgstr "" | ||
128 | "Sistema honetako zenbait OpenSSH ostalari gako hondaturiko ausazko zenbasi " | ||
129 | "sortzaile bat zuen OpenSSL bertsio batez sortuak izan ziren. Hau dela eta, " | ||
130 | "ostalari gako horiek ezagutza handiko pertsona batek indarrezko erasoei " | ||
131 | "ahulak dira eta birsortuak izango dira." | ||
132 | |||
133 | #. Type: note | ||
134 | #. Description | ||
135 | #: ../openssh-server.templates:4001 | ||
136 | msgid "" | ||
137 | "Users of this system should be informed of this change, as they will be " | ||
138 | "prompted about the host key change the next time they log in. Use 'ssh-" | ||
139 | "keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of " | ||
140 | "the new host keys." | ||
141 | msgstr "" | ||
142 | "Sistema honetako erabiltzaileak aldaketa honetaz ohartu beharko ziren, saio " | ||
143 | "hasten duten hurrengoan ostalari gako aldaketaz galdetuko zaie eta. 'ssh-" | ||
144 | "keygen -l -f OSTALARI_GAKO_FITX' erabili bertsio-berritzearen ondoren " | ||
145 | "ostalari gako berrien hatzmarkak inprimatzeko." | ||
146 | |||
147 | #. Type: note | ||
148 | #. Description | ||
149 | #: ../openssh-server.templates:4001 | ||
150 | msgid "The affected host keys are:" | ||
151 | msgstr "Ostalari gako hauei eragingo die:" | ||
152 | |||
153 | #. Type: note | ||
154 | #. Description | ||
155 | #: ../openssh-server.templates:4001 | ||
156 | msgid "" | ||
157 | "User keys may also be affected by this problem. The 'ssh-vulnkey' command " | ||
158 | "may be used as a partial test for this. See /usr/share/doc/openssh-server/" | ||
159 | "README.compromised-keys.gz for more details." | ||
160 | msgstr "" | ||
161 | "Erabiltzaile gakoak ere arazo honengatik eragindak egon daitezke. 'ssh-" | ||
162 | "vulnkey' komandoak honetarako proba bezala erdi-ziur erabili daiteke. Ikusi /" | ||
163 | "usr/share/doc/openssh-server/README.compromised-keys.gz xehetasun " | ||
164 | "gehiagorako." | ||
165 | |||
166 | #~ msgid "Generate a new configuration file for OpenSSH?" | ||
167 | #~ msgstr "OpenSSH-rentzat konfigurazio fitxategi berri bat sortu?" | ||
168 | |||
169 | #~ msgid "" | ||
170 | #~ "This version of OpenSSH has a considerably changed configuration file " | ||
171 | #~ "from the version shipped in Debian 'Potato', which you appear to be " | ||
172 | #~ "upgrading from. This package can now generate a new configuration file (/" | ||
173 | #~ "etc/ssh/sshd.config), which will work with the new server version, but " | ||
174 | #~ "will not contain any customizations you made with the old version." | ||
175 | #~ msgstr "" | ||
176 | #~ "OpenSSH bertsio honek konfigurazio fitxategia nahiko aldatu du Debian " | ||
177 | #~ "'Potato' bertsioak banatu zuenetik, dirudienez zu bertsio horretatik " | ||
178 | #~ "eguneratzen ari zara. Pakete honek konfigurazio fitxategi berri bat sortu " | ||
179 | #~ "dezake (/etc/ssh/sshd.config) bertsio honetarako funtziona dezan baina ez " | ||
180 | #~ "ditu zuk bertsio zaharrari egin ahal izan diezazkiokezun " | ||
181 | #~ "pertsonalizazioak edukiko." | ||
182 | |||
183 | #~ msgid "" | ||
184 | #~ "Please note that this new configuration file will set the value of " | ||
185 | #~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password " | ||
186 | #~ "can ssh directly in as root). Please read the README.Debian file for more " | ||
187 | #~ "details about this design choice." | ||
188 | #~ msgstr "" | ||
189 | #~ "Kontutan izan konfigurazio fitxategi berri honek 'PermitRootLogin' " | ||
190 | #~ "parametroan balioa 'yes' bezala ezarriko duela (honek root erabiltzaileak " | ||
191 | #~ "ssh bidez sartzeko aukera emango du). Mesedez irakurri README.Debian " | ||
192 | #~ "fitxategia ezarpen honen xehetasun gehiagorako." | ||
193 | |||
194 | #~ msgid "" | ||
195 | #~ "It is strongly recommended that you choose to generate a new " | ||
196 | #~ "configuration file now." | ||
197 | #~ msgstr "Gomendagarria da konfigurazio fitxategi berri bat orain sortzea." | ||
diff --git a/debian/po/fi.po b/debian/po/fi.po new file mode 100644 index 000000000..b5e192db3 --- /dev/null +++ b/debian/po/fi.po | |||
@@ -0,0 +1,202 @@ | |||
1 | # translation of fi.po to Finnish | ||
2 | # openssh translation | ||
3 | # | ||
4 | # Translators, if you are not familiar with the PO format, gettext | ||
5 | # documentation is worth reading, especially sections dedicated to | ||
6 | # this format, e.g. by running: | ||
7 | # info -n '(gettext)PO Files' | ||
8 | # info -n '(gettext)Header Entry' | ||
9 | # | ||
10 | # Some information specific to po-debconf are available at | ||
11 | # /usr/share/doc/po-debconf/README-trans | ||
12 | # or http://www.debian.org/intl/l10n/po-debconf/README-trans | ||
13 | # | ||
14 | # Developers do not need to manually edit POT or PO files. | ||
15 | # | ||
16 | # Matti Pöllä <mpo@iki.fi>, 2004-2005. | ||
17 | msgid "" | ||
18 | msgstr "" | ||
19 | "Project-Id-Version: openssh\n" | ||
20 | "Report-Msgid-Bugs-To: openssh@packages.debian.org\n" | ||
21 | "POT-Creation-Date: 2010-01-02 08:55+0000\n" | ||
22 | "PO-Revision-Date: 2008-05-17 16:38+0200\n" | ||
23 | "Last-Translator: Esko Arajärvi <edu@iki.fi>\n" | ||
24 | "Language-Team: Finnish <debian-l10n-finnish@lists.debian.org>\n" | ||
25 | "MIME-Version: 1.0\n" | ||
26 | "Content-Type: text/plain; charset=UTF-8\n" | ||
27 | "Content-Transfer-Encoding: 8bit\n" | ||
28 | |||
29 | #. Type: boolean | ||
30 | #. Description | ||
31 | #: ../openssh-server.templates:1001 | ||
32 | msgid "Do you want to risk killing active SSH sessions?" | ||
33 | msgstr "Haluatko ottaa riskin, että aktiiviset SSH-istunnot tapetaan?" | ||
34 | |||
35 | #. Type: boolean | ||
36 | #. Description | ||
37 | #: ../openssh-server.templates:1001 | ||
38 | msgid "" | ||
39 | "The currently installed version of /etc/init.d/ssh is likely to kill all " | ||
40 | "running sshd instances. If you are doing this upgrade via an SSH session, " | ||
41 | "you're likely to be disconnected and leave the upgrade procedure unfinished." | ||
42 | msgstr "" | ||
43 | "Tiedoston /etc/init.d/ssh asennettuna oleva versio tappaa todennäköisesti " | ||
44 | "kaikki käynnissä olevat sshd-prosessit. Jos teet tätä päivitystä ssh-" | ||
45 | "yhteyden yli, yhteytesi luultavasti katkeaa ja päivitysprosessi keskeytyy." | ||
46 | |||
47 | #. Type: boolean | ||
48 | #. Description | ||
49 | #: ../openssh-server.templates:1001 | ||
50 | msgid "" | ||
51 | "This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the " | ||
52 | "start-stop-daemon line in the stop section of the file." | ||
53 | msgstr "" | ||
54 | "Tämä voidaan korjata lisäämällä merkkijono â€--pidfile /var/run/sshd.pid†" | ||
55 | "kyseisen tiedoston stop-osion start-stop-daemon-riville." | ||
56 | |||
57 | #. Type: note | ||
58 | #. Description | ||
59 | #: ../openssh-server.templates:2001 | ||
60 | msgid "New host key mandatory" | ||
61 | msgstr "Uusi järjestelmäavain pakollinen" | ||
62 | |||
63 | #. Type: note | ||
64 | #. Description | ||
65 | #: ../openssh-server.templates:2001 | ||
66 | msgid "" | ||
67 | "The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA " | ||
68 | "algorithm. OpenSSH can not handle this host key file, and the ssh-keygen " | ||
69 | "utility from the old (non-free) SSH installation does not appear to be " | ||
70 | "available." | ||
71 | msgstr "" | ||
72 | "Olemassa oleva järjestelmäavain /etc/ssh/ssh_host_key on salattu IDEA-" | ||
73 | "algoritmilla. OpenSSH ei voi käsitellä tätä järjestelmäavaintiedostoa, eikä " | ||
74 | "vanhan (ei-vapaan) SSH-asennuksen ssh-keygen-ohjelmaa löydy." | ||
75 | |||
76 | #. Type: note | ||
77 | #. Description | ||
78 | #: ../openssh-server.templates:2001 | ||
79 | msgid "You need to manually generate a new host key." | ||
80 | msgstr "Uuden järjestelmäavaimen (host key) luominen on tarpeen." | ||
81 | |||
82 | #. Type: boolean | ||
83 | #. Description | ||
84 | #: ../openssh-server.templates:3001 | ||
85 | msgid "Disable challenge-response authentication?" | ||
86 | msgstr "Poistetaanko haaste-vaste-autentikointi käytöstä?" | ||
87 | |||
88 | #. Type: boolean | ||
89 | #. Description | ||
90 | #: ../openssh-server.templates:3001 | ||
91 | msgid "" | ||
92 | "Password authentication appears to be disabled in the current OpenSSH server " | ||
93 | "configuration. In order to prevent users from logging in using passwords " | ||
94 | "(perhaps using only public key authentication instead) with recent versions " | ||
95 | "of OpenSSH, you must disable challenge-response authentication, or else " | ||
96 | "ensure that your PAM configuration does not allow Unix password file " | ||
97 | "authentication." | ||
98 | msgstr "" | ||
99 | "OpenSSH-palvelimen nykyisissä asetuksissa salasana-autentikointi näyttää " | ||
100 | "olevan poissa käytöstä. Estääksesi kirjautumiset salasanaa käyttäen (esim. " | ||
101 | "salliaksesi kirjautumisen vain julkista avainta käyttäen), OpenSSH:n uusissa " | ||
102 | "versioissa haaste-vaste-autentikointi tulee poistaa käytöstä tai muutoin " | ||
103 | "varmistaa, että PAM-asetukset eivät salli Unixin salasanatiedostoon " | ||
104 | "perustuvaa autentikointia." | ||
105 | |||
106 | #. Type: boolean | ||
107 | #. Description | ||
108 | #: ../openssh-server.templates:3001 | ||
109 | msgid "" | ||
110 | "If you disable challenge-response authentication, then users will not be " | ||
111 | "able to log in using passwords. If you leave it enabled (the default " | ||
112 | "answer), then the 'PasswordAuthentication no' option will have no useful " | ||
113 | "effect unless you also adjust your PAM configuration in /etc/pam.d/ssh." | ||
114 | msgstr "" | ||
115 | "Jos poistat haaste-vaste-autentikoinnin käytöstä, käyttäjät eivät voi " | ||
116 | "kirjautua käyttäen salasanaa. Jos jätät sen päälle (oletus), asetuksella " | ||
117 | "â€PasswordAuthentication no†ei ole vaikutusta, ellet muuta myös PAM-" | ||
118 | "asetuksia tiedostossa /etc/pam.d/ssh." | ||
119 | |||
120 | #. Type: note | ||
121 | #. Description | ||
122 | #: ../openssh-server.templates:4001 | ||
123 | msgid "Vulnerable host keys will be regenerated" | ||
124 | msgstr "Haavoittuvaiset järjestelmäavaimet luodaan uudelleen" | ||
125 | |||
126 | #. Type: note | ||
127 | #. Description | ||
128 | #: ../openssh-server.templates:4001 | ||
129 | msgid "" | ||
130 | "Some of the OpenSSH server host keys on this system were generated with a " | ||
131 | "version of OpenSSL that had a broken random number generator. As a result, " | ||
132 | "these host keys are from a well-known set, are subject to brute-force " | ||
133 | "attacks, and must be regenerated." | ||
134 | msgstr "" | ||
135 | "Jotkin tämän järjestelmän OpenSSH-palvelimen järjestelmäavaimista on luotu " | ||
136 | "OpenSSL:n versiolla, jossa oli rikkinäinen satunnaislukugeneraattori. Tämän " | ||
137 | "tuloksena nämä avaimet voidaan murtaa järjestelmällisellä läpikäynnillä ja " | ||
138 | "ne tulee vaihtaa." | ||
139 | |||
140 | #. Type: note | ||
141 | #. Description | ||
142 | #: ../openssh-server.templates:4001 | ||
143 | msgid "" | ||
144 | "Users of this system should be informed of this change, as they will be " | ||
145 | "prompted about the host key change the next time they log in. Use 'ssh-" | ||
146 | "keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of " | ||
147 | "the new host keys." | ||
148 | msgstr "" | ||
149 | "Järjestelmän käyttäjille tulisi tiedottaa tästä muutoksesta, koska heitä " | ||
150 | "pyydetään hyväksymään muuttunut järjestelmäavain, kun he seuraavan kerran " | ||
151 | "kirjautuvat järjestelmään. Komennolla â€ssh-keygen -l -f HOST_KEY_FILE†" | ||
152 | "voidaan tulostaa uusien järjestelmäavainten sormenjäljet päivityksen jälkeen." | ||
153 | |||
154 | #. Type: note | ||
155 | #. Description | ||
156 | #: ../openssh-server.templates:4001 | ||
157 | msgid "The affected host keys are:" | ||
158 | msgstr "Järjestelmäavaimet, joihin tämä vaikuttaa:" | ||
159 | |||
160 | #. Type: note | ||
161 | #. Description | ||
162 | #: ../openssh-server.templates:4001 | ||
163 | msgid "" | ||
164 | "User keys may also be affected by this problem. The 'ssh-vulnkey' command " | ||
165 | "may be used as a partial test for this. See /usr/share/doc/openssh-server/" | ||
166 | "README.compromised-keys.gz for more details." | ||
167 | msgstr "" | ||
168 | "Tämä ongelma saattaa vaikuttaa myös käyttäjien avaimiin. Komennolla â€ssh-" | ||
169 | "vulnkey†voidaan osittain testata tätä. Tiedostossa /usr/share/doc/openssh-" | ||
170 | "server/README.compromised-keys.gz on lisätietoja." | ||
171 | |||
172 | #~ msgid "Generate a new configuration file for OpenSSH?" | ||
173 | #~ msgstr "Luodaanko OpenSSH:lle uusi asetustiedosto?" | ||
174 | |||
175 | #~ msgid "" | ||
176 | #~ "This version of OpenSSH has a considerably changed configuration file " | ||
177 | #~ "from the version shipped in Debian 'Potato', which you appear to be " | ||
178 | #~ "upgrading from. This package can now generate a new configuration file (/" | ||
179 | #~ "etc/ssh/sshd.config), which will work with the new server version, but " | ||
180 | #~ "will not contain any customizations you made with the old version." | ||
181 | #~ msgstr "" | ||
182 | #~ "Tämän OpenSSH:n version käyttämän asetustiedoston muoto poikkeaa " | ||
183 | #~ "huomattavasti Debianin â€Potatoâ€-julkaisun mukana toimitetusta versiosta, " | ||
184 | #~ "jota olet päivittämässä. Uusi asetustiedosto (/etc/ssh/sshd.config) " | ||
185 | #~ "voidaan luoda nyt. Uudet asetukset toimivat uuden palvelinversion kanssa, " | ||
186 | #~ "mutta vanhaan versioon itse tehdyt muokkaukset menetetään." | ||
187 | |||
188 | #~ msgid "" | ||
189 | #~ "Please note that this new configuration file will set the value of " | ||
190 | #~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password " | ||
191 | #~ "can ssh directly in as root). Please read the README.Debian file for more " | ||
192 | #~ "details about this design choice." | ||
193 | #~ msgstr "" | ||
194 | #~ "Uudessa asetustiedostossa muuttujan â€PermitRootLogin†arvo on " | ||
195 | #~ "â€yes†(tarkoittaen, että kuka tahansa pääkäyttäjän salasanan tietävä voi " | ||
196 | #~ "kirjautua suoraan ssh:n avulla pääkäyttäjänä). Lisätietoja tästä " | ||
197 | #~ "valinnasta löytyy (englanniksi) tiedostosta README.Debian." | ||
198 | |||
199 | #~ msgid "" | ||
200 | #~ "It is strongly recommended that you choose to generate a new " | ||
201 | #~ "configuration file now." | ||
202 | #~ msgstr "Uuden asetustiedoston luominen nyt on erittäin suositeltavaa." | ||
diff --git a/debian/po/fr.po b/debian/po/fr.po new file mode 100644 index 000000000..a8856906d --- /dev/null +++ b/debian/po/fr.po | |||
@@ -0,0 +1,211 @@ | |||
1 | # translation of fr.po to French | ||
2 | # | ||
3 | # Translators, if you are not familiar with the PO format, gettext | ||
4 | # documentation is worth reading, especially sections dedicated to | ||
5 | # this format, e.g. by running: | ||
6 | # info -n '(gettext)PO Files' | ||
7 | # info -n '(gettext)Header Entry' | ||
8 | # | ||
9 | # Some information specific to po-debconf are available at | ||
10 | # /usr/share/doc/po-debconf/README-trans | ||
11 | # or http://www.debian.org/intl/l10n/po-debconf/README-trans | ||
12 | # | ||
13 | # Developers do not need to manually edit POT or PO files. | ||
14 | # | ||
15 | # Christian Perrier <bubulle@debian.org>, 2007, 2008. | ||
16 | msgid "" | ||
17 | msgstr "" | ||
18 | "Project-Id-Version: \n" | ||
19 | "Report-Msgid-Bugs-To: openssh@packages.debian.org\n" | ||
20 | "POT-Creation-Date: 2010-01-02 08:55+0000\n" | ||
21 | "PO-Revision-Date: 2008-05-15 10:23+0200\n" | ||
22 | "Last-Translator: Christian Perrier <bubulle@debian.org>\n" | ||
23 | "Language-Team: French <debian-l10n-french@lists.debian.org>\n" | ||
24 | "MIME-Version: 1.0\n" | ||
25 | "Content-Type: text/plain; charset=UTF-8\n" | ||
26 | "Content-Transfer-Encoding: 8bit\n" | ||
27 | "X-Generator: KBabel 1.11.4\n" | ||
28 | |||
29 | #. Type: boolean | ||
30 | #. Description | ||
31 | #: ../openssh-server.templates:1001 | ||
32 | msgid "Do you want to risk killing active SSH sessions?" | ||
33 | msgstr "Voulez-vous risquer de rompre les sessions SSH actives ?" | ||
34 | |||
35 | #. Type: boolean | ||
36 | #. Description | ||
37 | #: ../openssh-server.templates:1001 | ||
38 | msgid "" | ||
39 | "The currently installed version of /etc/init.d/ssh is likely to kill all " | ||
40 | "running sshd instances. If you are doing this upgrade via an SSH session, " | ||
41 | "you're likely to be disconnected and leave the upgrade procedure unfinished." | ||
42 | msgstr "" | ||
43 | "La version de /etc/init.d/ssh actuellement installée va vraisemblablement " | ||
44 | "interrompre toutes les instances de sshd en cours. Si vous êtes en train de " | ||
45 | "faire cette mise à niveau à l'aide de SSH, la connexion sera probablement " | ||
46 | "coupée et la mise à jour sera interrompue." | ||
47 | |||
48 | #. Type: boolean | ||
49 | #. Description | ||
50 | #: ../openssh-server.templates:1001 | ||
51 | msgid "" | ||
52 | "This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the " | ||
53 | "start-stop-daemon line in the stop section of the file." | ||
54 | msgstr "" | ||
55 | "Cela peut être corrigé en ajoutant « --pidfile /var/run/sshd.pid » à la ligne " | ||
56 | "« start-stop-daemon » dans /etc/init.d/ssh, dans la section « stop » du " | ||
57 | "fichier." | ||
58 | |||
59 | #. Type: note | ||
60 | #. Description | ||
61 | #: ../openssh-server.templates:2001 | ||
62 | msgid "New host key mandatory" | ||
63 | msgstr "Nouvelle clé d'hôte obligatoire" | ||
64 | |||
65 | #. Type: note | ||
66 | #. Description | ||
67 | #: ../openssh-server.templates:2001 | ||
68 | msgid "" | ||
69 | "The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA " | ||
70 | "algorithm. OpenSSH can not handle this host key file, and the ssh-keygen " | ||
71 | "utility from the old (non-free) SSH installation does not appear to be " | ||
72 | "available." | ||
73 | msgstr "" | ||
74 | "La clé d'hôte actuelle, /etc/ssh/ssh_host_key, est chiffrée avec IDEA. " | ||
75 | "OpenSSH ne peut utiliser ce fichier de clé, et l'utilitaire ssh-keygen de " | ||
76 | "l'installation précédente (non libre) de SSH n'a pas été trouvé." | ||
77 | |||
78 | #. Type: note | ||
79 | #. Description | ||
80 | #: ../openssh-server.templates:2001 | ||
81 | msgid "You need to manually generate a new host key." | ||
82 | msgstr "Vous devez générer une nouvelle clé d'hôte vous-même." | ||
83 | |||
84 | #. Type: boolean | ||
85 | #. Description | ||
86 | #: ../openssh-server.templates:3001 | ||
87 | msgid "Disable challenge-response authentication?" | ||
88 | msgstr "Faut-il désactiver l'authentification par défi-réponse ?" | ||
89 | |||
90 | #. Type: boolean | ||
91 | #. Description | ||
92 | #: ../openssh-server.templates:3001 | ||
93 | msgid "" | ||
94 | "Password authentication appears to be disabled in the current OpenSSH server " | ||
95 | "configuration. In order to prevent users from logging in using passwords " | ||
96 | "(perhaps using only public key authentication instead) with recent versions " | ||
97 | "of OpenSSH, you must disable challenge-response authentication, or else " | ||
98 | "ensure that your PAM configuration does not allow Unix password file " | ||
99 | "authentication." | ||
100 | msgstr "" | ||
101 | "L'authentification par mots de passe semble être désactivée dans la " | ||
102 | "configuration actuelle du serveur OpenSSH. Afin d'empêcher les utilisateurs " | ||
103 | "de se connecter avec un mot de passe (pour, par exemple n'autoriser que " | ||
104 | "l'authentification par clé publique) avec les versions récentes d'OpenSSH, " | ||
105 | "vous devez aussi désactiver l'authentification par défi-réponse, ou alors " | ||
106 | "vous assurer que votre configuration de PAM n'autorise pas " | ||
107 | "l'authentification avec le fichier de mots de passe Unix." | ||
108 | |||
109 | #. Type: boolean | ||
110 | #. Description | ||
111 | #: ../openssh-server.templates:3001 | ||
112 | msgid "" | ||
113 | "If you disable challenge-response authentication, then users will not be " | ||
114 | "able to log in using passwords. If you leave it enabled (the default " | ||
115 | "answer), then the 'PasswordAuthentication no' option will have no useful " | ||
116 | "effect unless you also adjust your PAM configuration in /etc/pam.d/ssh." | ||
117 | msgstr "" | ||
118 | "Si vous désactivez l'authentification par défi-réponse, alors les " | ||
119 | "utilisateurs ne pourront pas se connecter en entrant un mot de passe. Si " | ||
120 | "vous la laissez active (ce qui est la valeur par défaut), alors l'option " | ||
121 | "« PasswordAuthentication no » n'aura d'effet que si vous ajustez aussi la " | ||
122 | "configuration de PAM dans /etc/pam.d/ssh." | ||
123 | |||
124 | #. Type: note | ||
125 | #. Description | ||
126 | #: ../openssh-server.templates:4001 | ||
127 | msgid "Vulnerable host keys will be regenerated" | ||
128 | msgstr "Recréation des clés d'hôte vulnérables" | ||
129 | |||
130 | #. Type: note | ||
131 | #. Description | ||
132 | #: ../openssh-server.templates:4001 | ||
133 | msgid "" | ||
134 | "Some of the OpenSSH server host keys on this system were generated with a " | ||
135 | "version of OpenSSL that had a broken random number generator. As a result, " | ||
136 | "these host keys are from a well-known set, are subject to brute-force " | ||
137 | "attacks, and must be regenerated." | ||
138 | msgstr "" | ||
139 | "Certaines clés d'hôte OpenSSH de ce serveur ont été créées avec une version " | ||
140 | "d'OpenSSL affligée d'un défaut dans le générateur de nombres aléatoires. En " | ||
141 | "conséquence, ces clés ont un contenu prévisible et peuvent être vulnérables " | ||
142 | "à des attaques par force brute. Elles doivent être recréées." | ||
143 | |||
144 | #. Type: note | ||
145 | #. Description | ||
146 | #: ../openssh-server.templates:4001 | ||
147 | msgid "" | ||
148 | "Users of this system should be informed of this change, as they will be " | ||
149 | "prompted about the host key change the next time they log in. Use 'ssh-" | ||
150 | "keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of " | ||
151 | "the new host keys." | ||
152 | msgstr "" | ||
153 | "Les utilisateurs de ce système devraient être informés de cette modification " | ||
154 | "car le système leur signalera le changement de clé d'hôte à leur prochaine " | ||
155 | "connexion. Vous pouvez utiliser la commande « ssh-keygen -l -f " | ||
156 | "HOST_KEY_FILE » après la mise à jour pour afficher l'empreinte des nouvelles " | ||
157 | "clés d'hôte." | ||
158 | |||
159 | #. Type: note | ||
160 | #. Description | ||
161 | #: ../openssh-server.templates:4001 | ||
162 | msgid "The affected host keys are:" | ||
163 | msgstr "Les clés concernées sont les suivantes :" | ||
164 | |||
165 | #. Type: note | ||
166 | #. Description | ||
167 | #: ../openssh-server.templates:4001 | ||
168 | msgid "" | ||
169 | "User keys may also be affected by this problem. The 'ssh-vulnkey' command " | ||
170 | "may be used as a partial test for this. See /usr/share/doc/openssh-server/" | ||
171 | "README.compromised-keys.gz for more details." | ||
172 | msgstr "" | ||
173 | "Les clés OpenSSH des utilisateurs sont aussi potentiellement affectées par " | ||
174 | "ce problème. La commande « ssh-vulnkey » offre un test partiel pour cette " | ||
175 | "vulnérabilité. Veuillez consulter le fichier /usr/share/doc/openssh-server/" | ||
176 | "README.compromised-keys.gz pour plus d'informations." | ||
177 | |||
178 | #~ msgid "Generate a new configuration file for OpenSSH?" | ||
179 | #~ msgstr "Faut-il créer un nouveau fichier de configuration pour OpenSSH ?" | ||
180 | |||
181 | #~ msgid "" | ||
182 | #~ "This version of OpenSSH has a considerably changed configuration file " | ||
183 | #~ "from the version shipped in Debian 'Potato', which you appear to be " | ||
184 | #~ "upgrading from. This package can now generate a new configuration file (/" | ||
185 | #~ "etc/ssh/sshd.config), which will work with the new server version, but " | ||
186 | #~ "will not contain any customizations you made with the old version." | ||
187 | #~ msgstr "" | ||
188 | #~ "Cette version d'OpenSSH utilise un fichier de configuration qui a " | ||
189 | #~ "fortement changé depuis la version contenue dans la distribution Debian " | ||
190 | #~ "« Potato », depuis laquelle vous semblez faire une mise à jour. Un nouveau " | ||
191 | #~ "fichier de configuration (/etc/ssh/sshd.config) qui fonctionnera avec la " | ||
192 | #~ "nouvelle version du serveur peut être créé, mais ne contiendra aucun des " | ||
193 | #~ "réglages que vous aviez faits avec la version précédente." | ||
194 | |||
195 | #~ msgid "" | ||
196 | #~ "Please note that this new configuration file will set the value of " | ||
197 | #~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password " | ||
198 | #~ "can ssh directly in as root). Please read the README.Debian file for more " | ||
199 | #~ "details about this design choice." | ||
200 | #~ msgstr "" | ||
201 | #~ "Veuillez noter que ce nouveau fichier de configuration positionnera la " | ||
202 | #~ "valeur de « PermitRootLogin » à « yes » (ce qui signifie que quiconque " | ||
203 | #~ "connaissant le mot de passe du superutilisateur peut se connecter en tant " | ||
204 | #~ "que tel sur la machine). Veuillez consulter le fichier README.Debian pour " | ||
205 | #~ "plus d'informations à propos de ce choix." | ||
206 | |||
207 | #~ msgid "" | ||
208 | #~ "It is strongly recommended that you choose to generate a new " | ||
209 | #~ "configuration file now." | ||
210 | #~ msgstr "" | ||
211 | #~ "Il est fortement recommandé de créer un nouveau fichier de configuration." | ||
diff --git a/debian/po/gl.po b/debian/po/gl.po new file mode 100644 index 000000000..acbb341b2 --- /dev/null +++ b/debian/po/gl.po | |||
@@ -0,0 +1,236 @@ | |||
1 | # Galician translation of openssh's debconf templates. | ||
2 | # This file is distributed under the same license as the openssh package. | ||
3 | # | ||
4 | # 2006, 2007, 2008 Jacobo Tarrio <jtarrio@debian.org> | ||
5 | # | ||
6 | msgid "" | ||
7 | msgstr "" | ||
8 | "Project-Id-Version: openssh\n" | ||
9 | "Report-Msgid-Bugs-To: openssh@packages.debian.org\n" | ||
10 | "POT-Creation-Date: 2010-01-02 08:55+0000\n" | ||
11 | "PO-Revision-Date: 2008-05-17 10:29+0100\n" | ||
12 | "Last-Translator: Jacobo Tarrio <jtarrio@debian.org>\n" | ||
13 | "Language-Team: Galician <proxecto@trasno.net>\n" | ||
14 | "MIME-Version: 1.0\n" | ||
15 | "Content-Type: text/plain; charset=UTF-8\n" | ||
16 | "Content-Transfer-Encoding: 8bit\n" | ||
17 | |||
18 | #. Type: boolean | ||
19 | #. Description | ||
20 | #: ../openssh-server.templates:1001 | ||
21 | msgid "Do you want to risk killing active SSH sessions?" | ||
22 | msgstr "¿Quere arriscarse a matar as sesións de SSH activas?" | ||
23 | |||
24 | #. Type: boolean | ||
25 | #. Description | ||
26 | #: ../openssh-server.templates:1001 | ||
27 | msgid "" | ||
28 | "The currently installed version of /etc/init.d/ssh is likely to kill all " | ||
29 | "running sshd instances. If you are doing this upgrade via an SSH session, " | ||
30 | "you're likely to be disconnected and leave the upgrade procedure unfinished." | ||
31 | msgstr "" | ||
32 | "É posible que a versión de /etc/init.d/ssh que instalou vaia matar tódalas " | ||
33 | "instancias de sshd en execución. Se está a facer esta actualización mediante " | ||
34 | "unha sesión SSH, é probable que se desconecte e este procedemento de " | ||
35 | "actualización quede sen rematar." | ||
36 | |||
37 | #. Type: boolean | ||
38 | #. Description | ||
39 | #: ../openssh-server.templates:1001 | ||
40 | msgid "" | ||
41 | "This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the " | ||
42 | "start-stop-daemon line in the stop section of the file." | ||
43 | msgstr "" | ||
44 | "Isto pode arranxarse engadindo \"--pidfile /var/run/sshd.pid\" á liña start-" | ||
45 | "stop-daemon da sección stop do ficheiro." | ||
46 | |||
47 | #. Type: note | ||
48 | #. Description | ||
49 | #: ../openssh-server.templates:2001 | ||
50 | msgid "New host key mandatory" | ||
51 | msgstr "É obrigatorio ter unha nova clave de servidor" | ||
52 | |||
53 | #. Type: note | ||
54 | #. Description | ||
55 | #: ../openssh-server.templates:2001 | ||
56 | msgid "" | ||
57 | "The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA " | ||
58 | "algorithm. OpenSSH can not handle this host key file, and the ssh-keygen " | ||
59 | "utility from the old (non-free) SSH installation does not appear to be " | ||
60 | "available." | ||
61 | msgstr "" | ||
62 | "A clave de servidor actual, armacenada en /etc/ssh/ssh_host_key, está " | ||
63 | "cifrada mediante o algoritmo IDEA. OpenSSH non pode xestionar este ficheiro " | ||
64 | "de clave de servidor, e non semella que estea dispoñible a utilidade ssh-" | ||
65 | "keygen da anterior instalación de SSH (non libre)." | ||
66 | |||
67 | #. Type: note | ||
68 | #. Description | ||
69 | #: ../openssh-server.templates:2001 | ||
70 | msgid "You need to manually generate a new host key." | ||
71 | msgstr "Ten que xerar unha nova clave de servidor." | ||
72 | |||
73 | #. Type: boolean | ||
74 | #. Description | ||
75 | #: ../openssh-server.templates:3001 | ||
76 | msgid "Disable challenge-response authentication?" | ||
77 | msgstr "¿Desactivar a autenticación por desafÃo-resposta?" | ||
78 | |||
79 | #. Type: boolean | ||
80 | #. Description | ||
81 | #: ../openssh-server.templates:3001 | ||
82 | msgid "" | ||
83 | "Password authentication appears to be disabled in the current OpenSSH server " | ||
84 | "configuration. In order to prevent users from logging in using passwords " | ||
85 | "(perhaps using only public key authentication instead) with recent versions " | ||
86 | "of OpenSSH, you must disable challenge-response authentication, or else " | ||
87 | "ensure that your PAM configuration does not allow Unix password file " | ||
88 | "authentication." | ||
89 | msgstr "" | ||
90 | "Semella que a autenticación por contrasinal está desactivada na " | ||
91 | "configuración actual do servidor de OpenSSH. Para impedir que os usuarios se " | ||
92 | "conecten empregando contrasinais (empregando no seu canto, por exemplo, " | ||
93 | "autenticación mediante clave pública), nas versións recentes de OpenSSH ten " | ||
94 | "que desactivar a autenticación por desafÃo-resposta ou asegurarse de que a " | ||
95 | "súa configuración de PAM non permita a autenticación por ficheiro de " | ||
96 | "contrasinais de Unix." | ||
97 | |||
98 | #. Type: boolean | ||
99 | #. Description | ||
100 | #: ../openssh-server.templates:3001 | ||
101 | msgid "" | ||
102 | "If you disable challenge-response authentication, then users will not be " | ||
103 | "able to log in using passwords. If you leave it enabled (the default " | ||
104 | "answer), then the 'PasswordAuthentication no' option will have no useful " | ||
105 | "effect unless you also adjust your PAM configuration in /etc/pam.d/ssh." | ||
106 | msgstr "" | ||
107 | "Se desactiva a autenticación por desafÃo-resposta, os usuarios non han poder " | ||
108 | "conectarse empregando contrasinais. Se a deixa activada (a resposta por " | ||
109 | "defecto) a opción \"PasswordAuthentication no\" non ha ter ningún efecto " | ||
110 | "útil a menos que tamén axuste a súa configuración de PAM en /etc/pam.d/ssh." | ||
111 | |||
112 | #. Type: note | ||
113 | #. Description | ||
114 | #: ../openssh-server.templates:4001 | ||
115 | msgid "Vulnerable host keys will be regenerated" | ||
116 | msgstr "Hanse rexenerar as claves de servidor vulnerables" | ||
117 | |||
118 | #. Type: note | ||
119 | #. Description | ||
120 | #: ../openssh-server.templates:4001 | ||
121 | msgid "" | ||
122 | "Some of the OpenSSH server host keys on this system were generated with a " | ||
123 | "version of OpenSSL that had a broken random number generator. As a result, " | ||
124 | "these host keys are from a well-known set, are subject to brute-force " | ||
125 | "attacks, and must be regenerated." | ||
126 | msgstr "" | ||
127 | "Algunhas das claves de servidor de OpenSSH deste sistema xeráronse cunha " | ||
128 | "versión de OpenSSL que tiña un xerador de números aleatorios que non " | ||
129 | "funcionaba correctamente. Coma resultado, esas claves de servidor pertencen " | ||
130 | "a un conxunto coñecido, son vulnerables a ataques por forza bruta, e teñen " | ||
131 | "que se rexenerar." | ||
132 | |||
133 | #. Type: note | ||
134 | #. Description | ||
135 | #: ../openssh-server.templates:4001 | ||
136 | msgid "" | ||
137 | "Users of this system should be informed of this change, as they will be " | ||
138 | "prompted about the host key change the next time they log in. Use 'ssh-" | ||
139 | "keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of " | ||
140 | "the new host keys." | ||
141 | msgstr "" | ||
142 | "É preciso informar deste cambio aos usuarios deste sistema, xa que se lles " | ||
143 | "ha avisar do cambio de clave de servidor a próxima vez que se conecten. " | ||
144 | "Empregue a orde \"ssh-keygen -l -f FICHEIRO_DE_CLAVE\" trala actualización " | ||
145 | "para amosar as pegadas dactilares das novas claves de servidor." | ||
146 | |||
147 | #. Type: note | ||
148 | #. Description | ||
149 | #: ../openssh-server.templates:4001 | ||
150 | msgid "The affected host keys are:" | ||
151 | msgstr "As claves de servidor afectadas son:" | ||
152 | |||
153 | #. Type: note | ||
154 | #. Description | ||
155 | #: ../openssh-server.templates:4001 | ||
156 | msgid "" | ||
157 | "User keys may also be affected by this problem. The 'ssh-vulnkey' command " | ||
158 | "may be used as a partial test for this. See /usr/share/doc/openssh-server/" | ||
159 | "README.compromised-keys.gz for more details." | ||
160 | msgstr "" | ||
161 | "As claves dos usuarios tamén poden estar afectadas por este problema. Pódese " | ||
162 | "empregar a orde \"ssh-vulnkey\" para facer unha comprobación parcial disto. " | ||
163 | "Consulte /usr/share/doc/openssh-server/README.compromised-keys.gz para máis " | ||
164 | "detalles." | ||
165 | |||
166 | #~ msgid "Generate a new configuration file for OpenSSH?" | ||
167 | #~ msgstr "¿Xerar un novo ficheiro de configuración para OpenSSH?" | ||
168 | |||
169 | #~ msgid "" | ||
170 | #~ "This version of OpenSSH has a considerably changed configuration file " | ||
171 | #~ "from the version shipped in Debian 'Potato', which you appear to be " | ||
172 | #~ "upgrading from. This package can now generate a new configuration file (/" | ||
173 | #~ "etc/ssh/sshd.config), which will work with the new server version, but " | ||
174 | #~ "will not contain any customizations you made with the old version." | ||
175 | #~ msgstr "" | ||
176 | #~ "Esta versión de OpenSSH ten un ficheiro de configuración que cambiou " | ||
177 | #~ "moito con respecto á versión que se subministrou con Debian \"Potato\", " | ||
178 | #~ "desde a que semella que se está a actualizar. Este paquete pode xerar " | ||
179 | #~ "agora un novo ficheiro de configuración (/etc/ssh/sshd.config) que ha " | ||
180 | #~ "funcionar coa nova versión do servidor, pero que non ha conter ningunha " | ||
181 | #~ "personalización que teña feito na versión antiga." | ||
182 | |||
183 | # | msgid "" | ||
184 | # | "Please note that this new configuration file will set the value of " | ||
185 | # | "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password " | ||
186 | # | "can ssh directly in as root). Please read the README.Debian file for more " | ||
187 | # | "details about this design choice." | ||
188 | #~ msgid "" | ||
189 | #~ "Please note that this new configuration file will set the value of " | ||
190 | #~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password " | ||
191 | #~ "can ssh directly in as root). Please read the README.Debian file for more " | ||
192 | #~ "details about this design choice." | ||
193 | #~ msgstr "" | ||
194 | #~ "Teña en conta que este novo ficheiro de configuración ha establecer o " | ||
195 | #~ "valor de de \"PermitRootLogin\" a \"yes\" (o que significa que calquera " | ||
196 | #~ "que coñeza o contrasinal do administrador ha poder conectarse " | ||
197 | #~ "directamente coma \"root\" mediante ssh). Consulte o ficheiro README." | ||
198 | #~ "Debian para ter máis detalles sobre esta decisión de deseño." | ||
199 | |||
200 | #~ msgid "" | ||
201 | #~ "It is strongly recommended that you choose to generate a new " | ||
202 | #~ "configuration file now." | ||
203 | #~ msgstr "" | ||
204 | #~ "Recoméndase encarecidamente que xere agora un novo ficheiro de " | ||
205 | #~ "configuración." | ||
206 | |||
207 | #~ msgid "Warning: you must create a new host key" | ||
208 | #~ msgstr "Aviso: ten que crear unha nove chave de servidor" | ||
209 | |||
210 | #~ msgid "Warning: telnetd is installed --- probably not a good idea" | ||
211 | #~ msgstr "" | ||
212 | #~ "Aviso: telnetd está instalado --- seguramente non sexa unha boa idea" | ||
213 | |||
214 | #~ msgid "" | ||
215 | #~ "I'd advise you to either remove the telnetd package (if you don't " | ||
216 | #~ "actually need to offer telnet access) or install telnetd-ssl so that " | ||
217 | #~ "there is at least some chance that telnet sessions will not be sending " | ||
218 | #~ "unencrypted login/password and session information over the network." | ||
219 | #~ msgstr "" | ||
220 | #~ "Recoméndase que elimine o paquete telnetd (se non precisa de fornecer " | ||
221 | #~ "acceso por telnet) ou instale telnetd-ssl para que exista alomenos " | ||
222 | #~ "algunha posibilidade de que as sesións telnet non envÃen información de " | ||
223 | #~ "usuario/contrasinal e das sesións sen cifrar pola rede." | ||
224 | |||
225 | #~ msgid "Warning: rsh-server is installed --- probably not a good idea" | ||
226 | #~ msgstr "" | ||
227 | #~ "Aviso: rsh-server está instalado --- seguramente non sexa unha boa idea" | ||
228 | |||
229 | #~ msgid "" | ||
230 | #~ "having rsh-server installed undermines the security that you were " | ||
231 | #~ "probably wanting to obtain by installing ssh. I'd advise you to remove " | ||
232 | #~ "that package." | ||
233 | #~ msgstr "" | ||
234 | #~ "ao ter rsh-server instalado pérdese a seguridade que probablemente " | ||
235 | #~ "pretendÃa obter ao instalar ssh. Recoméndase que se desinstale ese " | ||
236 | #~ "paquete." | ||
diff --git a/debian/po/it.po b/debian/po/it.po new file mode 100644 index 000000000..047dd3f34 --- /dev/null +++ b/debian/po/it.po | |||
@@ -0,0 +1,202 @@ | |||
1 | # Italian (it) translation of debconf templates for openssh | ||
2 | # Copyright (C) 2006 Software in the Public Interest | ||
3 | # This file is distributed under the same license as the openssh package. | ||
4 | # Renato Gini <rgini@openlabs.it>, 2003 - 2005 | ||
5 | # Luca Monducci <luca.mo@tiscali.it>, 2006, 2007. | ||
6 | # | ||
7 | msgid "" | ||
8 | msgstr "" | ||
9 | "Project-Id-Version: openssh 4.7p1 italian debconf templates\n" | ||
10 | "Report-Msgid-Bugs-To: openssh@packages.debian.org\n" | ||
11 | "POT-Creation-Date: 2010-01-02 08:55+0000\n" | ||
12 | "PO-Revision-Date: 2008-05-18 12:08+0200\n" | ||
13 | "Last-Translator: Luca Monducci <luca.mo@tiscali.it>\n" | ||
14 | "Language-Team: Italian <debian-l10n-italian@lists.debian.org>\n" | ||
15 | "MIME-Version: 1.0\n" | ||
16 | "Content-Type: text/plain; charset=UTF-8\n" | ||
17 | "Content-Transfer-Encoding: 8bit\n" | ||
18 | |||
19 | #. Type: boolean | ||
20 | #. Description | ||
21 | #: ../openssh-server.templates:1001 | ||
22 | msgid "Do you want to risk killing active SSH sessions?" | ||
23 | msgstr "Si vuole rischiare di terminare le sessioni SSH attive?" | ||
24 | |||
25 | #. Type: boolean | ||
26 | #. Description | ||
27 | #: ../openssh-server.templates:1001 | ||
28 | msgid "" | ||
29 | "The currently installed version of /etc/init.d/ssh is likely to kill all " | ||
30 | "running sshd instances. If you are doing this upgrade via an SSH session, " | ||
31 | "you're likely to be disconnected and leave the upgrade procedure unfinished." | ||
32 | msgstr "" | ||
33 | "È probabile che la versione di /etc/init.d/ssh attualmente installata " | ||
34 | "termini tutte le istanze di sshd attive. Se si sta effettuando questo " | ||
35 | "aggiornamento tramite una sessione SSH, è possibile che la sessione venga " | ||
36 | "chiusa e che la procedura di aggiornamento rimanga incompleta." | ||
37 | |||
38 | #. Type: boolean | ||
39 | #. Description | ||
40 | #: ../openssh-server.templates:1001 | ||
41 | msgid "" | ||
42 | "This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the " | ||
43 | "start-stop-daemon line in the stop section of the file." | ||
44 | msgstr "" | ||
45 | "È possibile evitare ciò aggiungendo manualmente «--pidfile /var/run/sshd.pid» " | ||
46 | "alla riga start-stop-daemon nella sezione stop del file." | ||
47 | |||
48 | #. Type: note | ||
49 | #. Description | ||
50 | #: ../openssh-server.templates:2001 | ||
51 | msgid "New host key mandatory" | ||
52 | msgstr "Necessaria una nuova chiave host" | ||
53 | |||
54 | #. Type: note | ||
55 | #. Description | ||
56 | #: ../openssh-server.templates:2001 | ||
57 | msgid "" | ||
58 | "The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA " | ||
59 | "algorithm. OpenSSH can not handle this host key file, and the ssh-keygen " | ||
60 | "utility from the old (non-free) SSH installation does not appear to be " | ||
61 | "available." | ||
62 | msgstr "" | ||
63 | "L'attuale chiave host, contenuta in /etc/ssh/ssh_host_key, è cifrata con " | ||
64 | "l'algoritmo IDEA. OpenSSH non è in grado di gestire questa chiave host e non " | ||
65 | "è disponibile il programma (non-free) ssh-keygen dalla precedente " | ||
66 | "installazione di SSH." | ||
67 | |||
68 | #. Type: note | ||
69 | #. Description | ||
70 | #: ../openssh-server.templates:2001 | ||
71 | msgid "You need to manually generate a new host key." | ||
72 | msgstr "È necessario generare manualmente una nuova chiave host." | ||
73 | |||
74 | #. Type: boolean | ||
75 | #. Description | ||
76 | #: ../openssh-server.templates:3001 | ||
77 | msgid "Disable challenge-response authentication?" | ||
78 | msgstr "Disabilitare l'autenticazione interattiva?" | ||
79 | |||
80 | #. Type: boolean | ||
81 | #. Description | ||
82 | #: ../openssh-server.templates:3001 | ||
83 | msgid "" | ||
84 | "Password authentication appears to be disabled in the current OpenSSH server " | ||
85 | "configuration. In order to prevent users from logging in using passwords " | ||
86 | "(perhaps using only public key authentication instead) with recent versions " | ||
87 | "of OpenSSH, you must disable challenge-response authentication, or else " | ||
88 | "ensure that your PAM configuration does not allow Unix password file " | ||
89 | "authentication." | ||
90 | msgstr "" | ||
91 | "Nell'attuale configurazione del server OpenSSH è disabilitata " | ||
92 | "l'autenticazione tramite password. Con le versioni più recenti di OpenSSH " | ||
93 | "per impedire l'accesso degli utenti al sistema con la password (per esempio " | ||
94 | "l'accesso deve essere possibile solo tramite chiavi pubbliche) si deve " | ||
95 | "disabilitare l'autenticazione interattiva oppure si deve verificare che PAM " | ||
96 | "sia configurato in modo da non consentire l'autenticazione tramite il file " | ||
97 | "delle password Unix." | ||
98 | |||
99 | #. Type: boolean | ||
100 | #. Description | ||
101 | #: ../openssh-server.templates:3001 | ||
102 | msgid "" | ||
103 | "If you disable challenge-response authentication, then users will not be " | ||
104 | "able to log in using passwords. If you leave it enabled (the default " | ||
105 | "answer), then the 'PasswordAuthentication no' option will have no useful " | ||
106 | "effect unless you also adjust your PAM configuration in /etc/pam.d/ssh." | ||
107 | msgstr "" | ||
108 | "Se l'autenticazione interattiva è disabilitata gli utenti non possono " | ||
109 | "effettuare l'accesso al sistema con la password. Invece se, come previsto " | ||
110 | "dalla configurazione predefinita, è abilitata allora l'opzione " | ||
111 | "«PasswordAuthentication no» non ha effetto fino a quando non si interviene " | ||
112 | "anche sulla configurazione di PAM in /etc/pam.d/ssh." | ||
113 | |||
114 | #. Type: note | ||
115 | #. Description | ||
116 | #: ../openssh-server.templates:4001 | ||
117 | msgid "Vulnerable host keys will be regenerated" | ||
118 | msgstr "Le chiavi host vulnerabili devono essere rigenerate" | ||
119 | |||
120 | #. Type: note | ||
121 | #. Description | ||
122 | #: ../openssh-server.templates:4001 | ||
123 | msgid "" | ||
124 | "Some of the OpenSSH server host keys on this system were generated with a " | ||
125 | "version of OpenSSL that had a broken random number generator. As a result, " | ||
126 | "these host keys are from a well-known set, are subject to brute-force " | ||
127 | "attacks, and must be regenerated." | ||
128 | msgstr "" | ||
129 | "Alcune delle chiavi host OpenSSH per server presenti su questo sistema sono " | ||
130 | "state create con una versione di OpenSSL afflitta da un problema al " | ||
131 | "generatore di numeri casuali. Di conseguenza queste chiavi host appartengono " | ||
132 | "a un insieme noto, quindi sono vulnerabili ad attacchi di tipo forza bruta e " | ||
133 | "devono essere rigenerate." | ||
134 | |||
135 | #. Type: note | ||
136 | #. Description | ||
137 | #: ../openssh-server.templates:4001 | ||
138 | msgid "" | ||
139 | "Users of this system should be informed of this change, as they will be " | ||
140 | "prompted about the host key change the next time they log in. Use 'ssh-" | ||
141 | "keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of " | ||
142 | "the new host keys." | ||
143 | msgstr "" | ||
144 | "Gli utenti del sistema dovrebbero essere informati di questo cambiamento " | ||
145 | "poiché al prossimo accesso al sistema verrà loro mostrato un avvertimento " | ||
146 | "relativo al cambiamento della chiave host. Dopo l'aggiornamento usare \"ssh-" | ||
147 | "keygen -l -f FILE_CHIAVE_HOST\" per stampare i fingerprint delle nuove " | ||
148 | "chiavi host." | ||
149 | |||
150 | #. Type: note | ||
151 | #. Description | ||
152 | #: ../openssh-server.templates:4001 | ||
153 | msgid "The affected host keys are:" | ||
154 | msgstr "Le chiavi host vulnerabili sono:" | ||
155 | |||
156 | #. Type: note | ||
157 | #. Description | ||
158 | #: ../openssh-server.templates:4001 | ||
159 | msgid "" | ||
160 | "User keys may also be affected by this problem. The 'ssh-vulnkey' command " | ||
161 | "may be used as a partial test for this. See /usr/share/doc/openssh-server/" | ||
162 | "README.compromised-keys.gz for more details." | ||
163 | msgstr "" | ||
164 | "Anche le chiavi utente potrebbero essere afflitte dallo stesso problema. È " | ||
165 | "possibile usare il comando \"ssh-vulnkey\" per fare un test parziale sulla " | ||
166 | "loro vulnerabilità . Si veda /usr/share/doc/openssh-server/README.compromised-" | ||
167 | "keys.gz per ulteriori informazioni." | ||
168 | |||
169 | #~ msgid "Generate a new configuration file for OpenSSH?" | ||
170 | #~ msgstr "Generare un nuovo file di configurazione per OpenSSH?" | ||
171 | |||
172 | #~ msgid "" | ||
173 | #~ "This version of OpenSSH has a considerably changed configuration file " | ||
174 | #~ "from the version shipped in Debian 'Potato', which you appear to be " | ||
175 | #~ "upgrading from. This package can now generate a new configuration file (/" | ||
176 | #~ "etc/ssh/sshd.config), which will work with the new server version, but " | ||
177 | #~ "will not contain any customizations you made with the old version." | ||
178 | #~ msgstr "" | ||
179 | #~ "Questa versione di OpenSSH contiene un file di configurazione decisamente " | ||
180 | #~ "diverso da quello distribuito in Debian \"Potato\", che sembra essere " | ||
181 | #~ "quello che si sta aggiornando. Questo pacchetto è in grado di generare " | ||
182 | #~ "automaticamente un nuovo file di configurazione (/etc/ssh/sshd.config) " | ||
183 | #~ "adatto alla nuova versione del server, ma che non contiene nessuna delle " | ||
184 | #~ "personalizzazioni apportate nella precedente versione." | ||
185 | |||
186 | #~ msgid "" | ||
187 | #~ "Please note that this new configuration file will set the value of " | ||
188 | #~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password " | ||
189 | #~ "can ssh directly in as root). Please read the README.Debian file for more " | ||
190 | #~ "details about this design choice." | ||
191 | #~ msgstr "" | ||
192 | #~ "Notare che nel nuovo file di configurazione il valore di «PermitRootLogin» " | ||
193 | #~ "è impostato a «yes» (quindi chiunque conosca la password di root può " | ||
194 | #~ "collegarsi tramite ssh direttamente come root). Per ulteriori dettagli su " | ||
195 | #~ "questa scelta si veda il file README.Debian." | ||
196 | |||
197 | #~ msgid "" | ||
198 | #~ "It is strongly recommended that you choose to generate a new " | ||
199 | #~ "configuration file now." | ||
200 | #~ msgstr "" | ||
201 | #~ "È vivamente raccomandata la scelta di far generare automaticamente un " | ||
202 | #~ "nuovo file di configurazione." | ||
diff --git a/debian/po/ja.po b/debian/po/ja.po new file mode 100644 index 000000000..b011ddc0a --- /dev/null +++ b/debian/po/ja.po | |||
@@ -0,0 +1,197 @@ | |||
1 | # | ||
2 | # Translators, if you are not familiar with the PO format, gettext | ||
3 | # documentation is worth reading, especially sections dedicated to | ||
4 | # this format, e.g. by running: | ||
5 | # info -n '(gettext)PO Files' | ||
6 | # info -n '(gettext)Header Entry' | ||
7 | # | ||
8 | # Some information specific to po-debconf are available at | ||
9 | # /usr/share/doc/po-debconf/README-trans | ||
10 | # or http://www.debian.org/intl/l10n/po-debconf/README-trans | ||
11 | # | ||
12 | # Developers do not need to manually edit POT or PO files. | ||
13 | # | ||
14 | msgid "" | ||
15 | msgstr "" | ||
16 | "Project-Id-Version: openssh\n" | ||
17 | "Report-Msgid-Bugs-To: openssh@packages.debian.org\n" | ||
18 | "POT-Creation-Date: 2010-01-02 08:55+0000\n" | ||
19 | "PO-Revision-Date: 2008-05-17 21:28+0900\n" | ||
20 | "Last-Translator: Kenshi Muto <kmuto@debian.org>\n" | ||
21 | "Language-Team: Japanese <debian-japanese@lists.debian.org>\n" | ||
22 | "MIME-Version: 1.0\n" | ||
23 | "Content-Type: text/plain; charset=UTF-8\n" | ||
24 | "Content-Transfer-Encoding: 8bit\n" | ||
25 | |||
26 | #. Type: boolean | ||
27 | #. Description | ||
28 | #: ../openssh-server.templates:1001 | ||
29 | msgid "Do you want to risk killing active SSH sessions?" | ||
30 | msgstr "接続ä¸ã® SSH セッションãŒåˆ‡ã‚Œã‚‹ã‹ã‚‚ã—ã‚Œã¾ã›ã‚“ãŒã‚ˆã„ã§ã™ã‹?" | ||
31 | |||
32 | #. Type: boolean | ||
33 | #. Description | ||
34 | #: ../openssh-server.templates:1001 | ||
35 | msgid "" | ||
36 | "The currently installed version of /etc/init.d/ssh is likely to kill all " | ||
37 | "running sshd instances. If you are doing this upgrade via an SSH session, " | ||
38 | "you're likely to be disconnected and leave the upgrade procedure unfinished." | ||
39 | msgstr "" | ||
40 | "ç¾åœ¨ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã•ã‚ŒãŸãƒãƒ¼ã‚¸ãƒ§ãƒ³ã® /etc/init.d/ssh ã¯ã€ãŠãらã実行ä¸ã® sshd " | ||
41 | "インスタンスをã™ã¹ã¦æ®ºã—ã¾ã™ã€‚ã“ã®ã‚¢ãƒƒãƒ—グレードを SSH セッション経由ã§è¡Œã£ã¦" | ||
42 | "ã„ã‚‹å ´åˆã€ã‚ãªãŸã¯åˆ‡æ–ã•ã‚Œã€ã‚¢ãƒƒãƒ—グレード処ç†ã¯ä¸å®Œå…¨ãªã¾ã¾ã«ãªã‚‹ã§ã—ょã†ã€‚" | ||
43 | |||
44 | #. Type: boolean | ||
45 | #. Description | ||
46 | #: ../openssh-server.templates:1001 | ||
47 | msgid "" | ||
48 | "This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the " | ||
49 | "start-stop-daemon line in the stop section of the file." | ||
50 | msgstr "" | ||
51 | "ã“ã®çŠ¶æ³ã‚’ä¿®æ£ã™ã‚‹ã«ã¯ã€ãƒ•ã‚¡ã‚¤ãƒ«ã® stop セクション㮠start-stop-daemon ã®è¡Œã«" | ||
52 | "「--pidfile /var/run/sshd.pidã€ã¨æ‰‹å‹•ã§è¿½åŠ ã—ã¾ã™ã€‚" | ||
53 | |||
54 | #. Type: note | ||
55 | #. Description | ||
56 | #: ../openssh-server.templates:2001 | ||
57 | msgid "New host key mandatory" | ||
58 | msgstr "æ–°ã—ã„ホストã‚ーãŒå¿…è¦ã§ã™" | ||
59 | |||
60 | #. Type: note | ||
61 | #. Description | ||
62 | #: ../openssh-server.templates:2001 | ||
63 | msgid "" | ||
64 | "The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA " | ||
65 | "algorithm. OpenSSH can not handle this host key file, and the ssh-keygen " | ||
66 | "utility from the old (non-free) SSH installation does not appear to be " | ||
67 | "available." | ||
68 | msgstr "" | ||
69 | "/etc/ssh/ssh_host_key ã«ã‚ã‚‹ç¾åœ¨ã®ãƒ›ã‚¹ãƒˆã‚ー㯠IDEA ã§æš—å·åŒ–ã•ã‚Œã¦ã„ã‚ã™ã€‚" | ||
70 | "OpenSSH ã¯ã“ã®ãƒ›ã‚¹ãƒˆã‚ーファイルを扱ãˆãšã€å¤ã„ (フリーã§ã¯ãªã„) SSH ã® ssh-" | ||
71 | "keygen ユーティリティã¯ã‚‚ã†åˆ©ç”¨ã§ãã¾ã›ã‚“。" | ||
72 | |||
73 | #. Type: note | ||
74 | #. Description | ||
75 | #: ../openssh-server.templates:2001 | ||
76 | msgid "You need to manually generate a new host key." | ||
77 | msgstr "æ–°ã—ã„ホストã‚ーを手動ã§ç”Ÿæˆã™ã‚‹å¿…è¦ãŒã‚ã‚Šã¾ã™ã€‚" | ||
78 | |||
79 | #. Type: boolean | ||
80 | #. Description | ||
81 | #: ../openssh-server.templates:3001 | ||
82 | msgid "Disable challenge-response authentication?" | ||
83 | msgstr "ãƒãƒ£ãƒ¬ãƒ³ã‚¸-レスãƒãƒ³ã‚¹èªè¨¼ã‚’無効ã«ã—ã¾ã™ã‹?" | ||
84 | |||
85 | #. Type: boolean | ||
86 | #. Description | ||
87 | #: ../openssh-server.templates:3001 | ||
88 | msgid "" | ||
89 | "Password authentication appears to be disabled in the current OpenSSH server " | ||
90 | "configuration. In order to prevent users from logging in using passwords " | ||
91 | "(perhaps using only public key authentication instead) with recent versions " | ||
92 | "of OpenSSH, you must disable challenge-response authentication, or else " | ||
93 | "ensure that your PAM configuration does not allow Unix password file " | ||
94 | "authentication." | ||
95 | msgstr "" | ||
96 | "ç¾åœ¨ã® OpenSSH サーãƒã®è¨å®šã§ã¯ãƒ‘スワードèªè¨¼ãŒç„¡åŠ¹ã«ãªã£ã¦ã„るよã†ã§ã™ã€‚" | ||
97 | "OpenSSH ã®æœ€è¿‘ã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã§ãƒ‘スワードを使ã£ã¦ãƒ¦ãƒ¼ã‚¶ãŒãƒã‚°ã‚¤ãƒ³ã™ã‚‹ã®ã‚’防ã " | ||
98 | "(多分公開éµèªè¨¼ã ã‘を代ã‚ã‚Šã«ä½¿ã†) ãŸã‚ã«ã¯ã€ãƒãƒ£ãƒ¬ãƒ³ã‚¸-レスãƒãƒ³ã‚¹èªè¨¼ã‚’無効" | ||
99 | "ã«ã™ã‚‹ã‹ã€PAM è¨å®šã§ Unix パスワードファイルèªè¨¼ã‚’絶対ã«è¨±å¯ã—ãªã„よã†ã«ã™ã‚‹" | ||
100 | "å¿…è¦ãŒã‚ã‚Šã¾ã™ã€‚" | ||
101 | |||
102 | #. Type: boolean | ||
103 | #. Description | ||
104 | #: ../openssh-server.templates:3001 | ||
105 | msgid "" | ||
106 | "If you disable challenge-response authentication, then users will not be " | ||
107 | "able to log in using passwords. If you leave it enabled (the default " | ||
108 | "answer), then the 'PasswordAuthentication no' option will have no useful " | ||
109 | "effect unless you also adjust your PAM configuration in /etc/pam.d/ssh." | ||
110 | msgstr "" | ||
111 | "ãƒãƒ£ãƒ¬ãƒ³ã‚¸-レスãƒãƒ³ã‚¹èªè¨¼ã‚’無効ã«ã™ã‚‹å ´åˆã€ãƒ¦ãƒ¼ã‚¶ã¯ãƒ‘スワードを使ã£ã¦ãƒã‚°ã‚¤ãƒ³" | ||
112 | "ã§ããªããªã‚Šã¾ã™ã€‚有効 (デフォルト) ã®ã¾ã¾ã«ã—ã¦ãŠãã¨ã€/etc/pam.d/ssh ã«ã‚" | ||
113 | "ã‚‹ PAM è¨å®šã‚’調節ã—ãªã„é™ã‚Šã€'PasswordAuthentication no' オプションã¯åŠ¹æžœã‚’æŒ" | ||
114 | "ãŸãªããªã‚Šã¾ã™ã€‚" | ||
115 | |||
116 | #. Type: note | ||
117 | #. Description | ||
118 | #: ../openssh-server.templates:4001 | ||
119 | msgid "Vulnerable host keys will be regenerated" | ||
120 | msgstr "脆弱ãªãƒ›ã‚¹ãƒˆã‚ーã¯å†ç”Ÿæˆã•ã‚Œã¾ã™" | ||
121 | |||
122 | #. Type: note | ||
123 | #. Description | ||
124 | #: ../openssh-server.templates:4001 | ||
125 | msgid "" | ||
126 | "Some of the OpenSSH server host keys on this system were generated with a " | ||
127 | "version of OpenSSL that had a broken random number generator. As a result, " | ||
128 | "these host keys are from a well-known set, are subject to brute-force " | ||
129 | "attacks, and must be regenerated." | ||
130 | msgstr "" | ||
131 | "ã“ã®ã‚·ã‚¹ãƒ†ãƒ ã® OpenSSH サーãƒã®ãƒ›ã‚¹ãƒˆã‚ーã®ã„ãã¤ã‹ãŒã€å£Šã‚ŒãŸä¹±æ•°ç”Ÿæˆå™¨ã‚’æŒ" | ||
132 | "㤠OpenSSL ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã§ç”Ÿæˆã•ã‚Œã¦ã„ã¾ã—ãŸã€‚çµæžœã¨ã—ã¦ã€ã“れらã®ãƒ›ã‚¹ãƒˆã‚ーã¯æ—¢" | ||
133 | "知ã®çµ„ã¿åˆã‚ã›ã‹ã‚‰æˆã‚Šã€ãƒ–ルートフォース攻撃をå—ã‘ã‚„ã™ã„ã‚‚ã®ã«ãªã£ã¦ã„ã‚‹ãŸ" | ||
134 | "ã‚ã€å†ç”Ÿæˆã™ã‚‹å¿…è¦ãŒã‚ã‚Šã¾ã™ã€‚" | ||
135 | |||
136 | #. Type: note | ||
137 | #. Description | ||
138 | #: ../openssh-server.templates:4001 | ||
139 | msgid "" | ||
140 | "Users of this system should be informed of this change, as they will be " | ||
141 | "prompted about the host key change the next time they log in. Use 'ssh-" | ||
142 | "keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of " | ||
143 | "the new host keys." | ||
144 | msgstr "" | ||
145 | "次回ã®ãƒã‚°ã‚¤ãƒ³æ™‚ã«ãƒ›ã‚¹ãƒˆã‚ーã®å¤‰æ›´ãŒç¤ºã•ã‚Œã‚‹ã“ã¨ã§ã€ã“ã®ã‚·ã‚¹ãƒ†ãƒ ã®ãƒ¦ãƒ¼ã‚¶ã¯ã€" | ||
146 | "ã“ã®å¤‰æ›´ã®é€šçŸ¥ã‚’å—ã‘å–ã‚‹ã“ã¨ã«ãªã‚Šã¾ã™ã€‚更新後ã«æ–°ã—ã„ホストã‚ーã®æŒ‡ç´‹ã‚’表示" | ||
147 | "ã™ã‚‹ã«ã¯ã€'ssh-keygen -l -f HOST_KEY_FILE' を使ã„ã¾ã™ã€‚" | ||
148 | |||
149 | #. Type: note | ||
150 | #. Description | ||
151 | #: ../openssh-server.templates:4001 | ||
152 | msgid "The affected host keys are:" | ||
153 | msgstr "影響をå—ã‘るホストã‚ーã¯æ¬¡ã®ã¨ãŠã‚Šã§ã™:" | ||
154 | |||
155 | #. Type: note | ||
156 | #. Description | ||
157 | #: ../openssh-server.templates:4001 | ||
158 | msgid "" | ||
159 | "User keys may also be affected by this problem. The 'ssh-vulnkey' command " | ||
160 | "may be used as a partial test for this. See /usr/share/doc/openssh-server/" | ||
161 | "README.compromised-keys.gz for more details." | ||
162 | msgstr "" | ||
163 | "ユーザã‚ーもã“ã®å•é¡Œã®å½±éŸ¿ã‚’å—ã‘ã¦ã„ã‚‹æã‚ŒãŒã‚ã‚Šã¾ã™ã€‚ã“ã®éƒ¨åˆ†çš„ãªãƒ†ã‚¹ãƒˆã¨ã—" | ||
164 | "ã¦ã€'ssh-vulnkey' コマンドを利用ã§ãã¾ã™ã€‚詳細ã«ã¤ã„ã¦ã¯ /usr/share/doc/" | ||
165 | "openssh-server/README.compromised-keys.gz ã‚’å‚ç…§ã—ã¦ãã ã•ã„。" | ||
166 | |||
167 | #~ msgid "Generate a new configuration file for OpenSSH?" | ||
168 | #~ msgstr "OpenSSH ã®æ–°ã—ã„è¨å®šãƒ•ã‚¡ã‚¤ãƒ«ã‚’作りã¾ã™ã‹?" | ||
169 | |||
170 | #~ msgid "" | ||
171 | #~ "This version of OpenSSH has a considerably changed configuration file " | ||
172 | #~ "from the version shipped in Debian 'Potato', which you appear to be " | ||
173 | #~ "upgrading from. This package can now generate a new configuration file (/" | ||
174 | #~ "etc/ssh/sshd.config), which will work with the new server version, but " | ||
175 | #~ "will not contain any customizations you made with the old version." | ||
176 | #~ msgstr "" | ||
177 | #~ "OpenSSH ã®ã“ã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã¯ã€Debian 'Potato' ã§æä¾›ã—ã¦ã„ãŸãƒãƒ¼ã‚¸ãƒ§ãƒ³ (ã„" | ||
178 | #~ "ã¾ã€ãã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã‹ã‚‰ã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã‚¢ãƒƒãƒ—を試ã¿ã¦ã„ã‚‹ã¨ã“ã‚) ã‹ã‚‰ã€è¨å®šãƒ•ã‚¡" | ||
179 | #~ "イルãŒå¤§å¹…ã«å¤‰åŒ–ã—ã¦ã„ã¾ã™ã€‚ã“ã®ãƒ‘ッケージã¯ã€æ–°ã—ã„ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã®ã‚µãƒ¼ãƒã§ä½¿" | ||
180 | #~ "ã†ã“ã¨ãŒã§ãã‚‹æ–°ã—ã„è¨å®šãƒ•ã‚¡ã‚¤ãƒ« (/etc/ssh/sshd.config) を今生æˆã™ã‚‹ã“ã¨ãŒ" | ||
181 | #~ "ã§ãã¾ã™ãŒã€å¤ã„ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã®è¨å®šãƒ•ã‚¡ã‚¤ãƒ«ã«åŠ ãˆã¦ã„ãŸã‚«ã‚¹ã‚¿ãƒžã‚¤ã‚ºã¯ã„ãšã‚Œã‚‚" | ||
182 | #~ "å«ã¾ã‚Œã¾ã›ã‚“。" | ||
183 | |||
184 | #~ msgid "" | ||
185 | #~ "Please note that this new configuration file will set the value of " | ||
186 | #~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password " | ||
187 | #~ "can ssh directly in as root). Please read the README.Debian file for more " | ||
188 | #~ "details about this design choice." | ||
189 | #~ msgstr "" | ||
190 | #~ "ã“ã®æ–°ã—ã„è¨å®šãƒ•ã‚¡ã‚¤ãƒ«ã¯ã€ã€ŒPermitRootLoginã€ã‚’「yesã€ã«è¨å®šã—ã¾ã™ (ã¤ã¾" | ||
191 | #~ "ã‚Šã€root ã®ãƒ‘スワードを知ã£ã¦ã„る人ãªã‚‰èª°ã§ã‚‚直接ãƒã‚°ã‚¤ãƒ³ã§ãã¾ã™)。ã“ã®ã‚ˆ" | ||
192 | #~ "ã†ãªè¨è¨ˆã‚’é¸ã‚“ã§ã„ã‚‹ç†ç”±ã®è©³ç´°ã«ã¤ã„ã¦ã¯ã€README.Debian ã‚’èªã‚“ã§ãã ã•ã„。" | ||
193 | |||
194 | #~ msgid "" | ||
195 | #~ "It is strongly recommended that you choose to generate a new " | ||
196 | #~ "configuration file now." | ||
197 | #~ msgstr "æ–°ã—ã„è¨å®šãƒ•ã‚¡ã‚¤ãƒ«ã‚’今生æˆã™ã‚‹ã“ã¨ã‚’å¼·ããŠå‹§ã‚ã—ã¾ã™ã€‚" | ||
diff --git a/debian/po/ko.po b/debian/po/ko.po new file mode 100644 index 000000000..7cbf4c13c --- /dev/null +++ b/debian/po/ko.po | |||
@@ -0,0 +1,189 @@ | |||
1 | # Korean translations for openssh package | ||
2 | # openssh íŒ¨í‚¤ì§€ì— ëŒ€í•œ í•œêµì–´ 번ì—문. | ||
3 | # Copyright (C) 2007 THE openssh'S COPYRIGHT HOLDER | ||
4 | # This file is distributed under the same license as the openssh package. | ||
5 | # Sunjae Park <darehanl@gmail.com>, 2007. | ||
6 | # | ||
7 | msgid "" | ||
8 | msgstr "" | ||
9 | "Project-Id-Version: openssh\n" | ||
10 | "Report-Msgid-Bugs-To: openssh@packages.debian.org\n" | ||
11 | "POT-Creation-Date: 2010-01-02 08:55+0000\n" | ||
12 | "PO-Revision-Date: 2008-06-06 16:06-0400\n" | ||
13 | "Last-Translator: Sunjae Park <darehanl@gmail.com>\n" | ||
14 | "Language-Team: Korean <debian-l10n-korean@lists.debian.org>\n" | ||
15 | "MIME-Version: 1.0\n" | ||
16 | "Content-Type: text/plain; charset=UTF-8\n" | ||
17 | "Content-Transfer-Encoding: 8bit\n" | ||
18 | "Plural-Forms: nplurals=1; plural=0;\n" | ||
19 | |||
20 | #. Type: boolean | ||
21 | #. Description | ||
22 | #: ../openssh-server.templates:1001 | ||
23 | msgid "Do you want to risk killing active SSH sessions?" | ||
24 | msgstr "현재 ì‚¬ìš©ì¤‘ì¸ SSH ì„¸ì…˜ì„ ì£½ì—¬ë„ ê´œì°®ìŠµë‹ˆê¹Œ?" | ||
25 | |||
26 | #. Type: boolean | ||
27 | #. Description | ||
28 | #: ../openssh-server.templates:1001 | ||
29 | msgid "" | ||
30 | "The currently installed version of /etc/init.d/ssh is likely to kill all " | ||
31 | "running sshd instances. If you are doing this upgrade via an SSH session, " | ||
32 | "you're likely to be disconnected and leave the upgrade procedure unfinished." | ||
33 | msgstr "" | ||
34 | "현재 ì„¤ì¹˜ëœ /etc/init.d/ssh ë²„ì „ì€ ì‚¬ìš©ì¤‘ì¸ sshd ì¸ìŠ¤í„´ìŠ¤ë¥¼ ëª¨ë‘ ì£½ì¼ ê²ƒìž…ë‹ˆ" | ||
35 | "다. 만약 SSH ì„¸ì…˜ì„ í†µí•´ ì´ ì—…ê·¸ë ˆì´ë“œë¥¼ í•˜ê³ ìžˆë‹¤ë©´ ë„ì¤‘ì— ì—°ê²°ì´ í•´ì œë˜ì–´ " | ||
36 | "ì—…ê·¸ë ˆì´ë“œ ìž‘ì—…ì´ ë„ì¤‘ì— ì¤‘ë‹¨ë 수 있습니다." | ||
37 | |||
38 | #. Type: boolean | ||
39 | #. Description | ||
40 | #: ../openssh-server.templates:1001 | ||
41 | msgid "" | ||
42 | "This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the " | ||
43 | "start-stop-daemon line in the stop section of the file." | ||
44 | msgstr "" | ||
45 | "파ì¼ì˜ stop 구ì—ì— ìžˆëŠ” start-stop-daemonì— \"--pidfile /var/run/sshd.pid" | ||
46 | "\"ì„ ì¶”ê°€í•˜ì‹œë©´ ì´ ë¬¸ì œë¥¼ í•´ê²°í• ìˆ˜ 있습니다." | ||
47 | |||
48 | #. Type: note | ||
49 | #. Description | ||
50 | #: ../openssh-server.templates:2001 | ||
51 | msgid "New host key mandatory" | ||
52 | msgstr "호스트키 새로 만들어야 함" | ||
53 | |||
54 | #. Type: note | ||
55 | #. Description | ||
56 | #: ../openssh-server.templates:2001 | ||
57 | msgid "" | ||
58 | "The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA " | ||
59 | "algorithm. OpenSSH can not handle this host key file, and the ssh-keygen " | ||
60 | "utility from the old (non-free) SSH installation does not appear to be " | ||
61 | "available." | ||
62 | msgstr "" | ||
63 | "/etc/ssh/ssh_host_keyì— ìžˆëŠ” 현재 호스트키늘 IDEA ì•Œê³ ë¦¬ì¦˜ìœ¼ë¡œ 암호화ë˜ì–´ìžˆìŠµ" | ||
64 | "니다. OpenSSH는 ì´ í˜¸ìŠ¤íŠ¸í‚¤ 파ì¼ì„ 다루지 못하며, ì´ì „ì— ì„¤ì¹˜ë˜ì—ˆë˜ (비ìžìœ ) " | ||
65 | "SSH í”„ë¡œê·¸ëž¨ì˜ ssh-keygen ì‘ìš©í”„ë¡œê·¸ëž¨ì´ ì—†ëŠ” 것 같습니다." | ||
66 | |||
67 | #. Type: note | ||
68 | #. Description | ||
69 | #: ../openssh-server.templates:2001 | ||
70 | msgid "You need to manually generate a new host key." | ||
71 | msgstr "호스트키를 ì§ì ‘ 새로 ìƒì„±í•˜ì…”야 합니다." | ||
72 | |||
73 | #. Type: boolean | ||
74 | #. Description | ||
75 | #: ../openssh-server.templates:3001 | ||
76 | msgid "Disable challenge-response authentication?" | ||
77 | msgstr "ì œê¸°-ì‘답 ì¸ì¦ë°©ì‹ì„ í•´ì œí•˜ë„ë¡ í• ê¹Œìš”?" | ||
78 | |||
79 | #. Type: boolean | ||
80 | #. Description | ||
81 | #: ../openssh-server.templates:3001 | ||
82 | msgid "" | ||
83 | "Password authentication appears to be disabled in the current OpenSSH server " | ||
84 | "configuration. In order to prevent users from logging in using passwords " | ||
85 | "(perhaps using only public key authentication instead) with recent versions " | ||
86 | "of OpenSSH, you must disable challenge-response authentication, or else " | ||
87 | "ensure that your PAM configuration does not allow Unix password file " | ||
88 | "authentication." | ||
89 | msgstr "" | ||
90 | "í˜„ìž¬ì˜ OpenSSH 서버 ì„¤ì •ì— ë¹„ë°€ë²ˆí˜¸ ì¸ì¦ë°©ì‹ì´ í•´ì œë˜ì–´ 있습니다. 최근 ë²„ì „" | ||
91 | "ì˜ OpenSSHì—ì„œ 사용ìžë“¤ì´ (공개키 ë°©ì‹ë§Œ 허용하기 위해서 ë“±ì˜ ì´ìœ ë¡œ) 비밀번" | ||
92 | "호로 로그ì¸í•˜ì§€ 못하ë„ë¡ í•˜ì‹œë ¤ë©´ ì œê¸°-ì‘답 ì¸ì¦ë°©ì‹ì„ í•´ì œí•˜ì‹œë“ ì§€ ìœ ë‹‰ìŠ¤ " | ||
93 | "password íŒŒì¼ ì¸ì¦ë°©ì‹ì„ 사용하지 못하ë„ë¡ PAM ì„¤ì •ì„ í•˜ì…”ì•¼ 합니다." | ||
94 | |||
95 | #. Type: boolean | ||
96 | #. Description | ||
97 | #: ../openssh-server.templates:3001 | ||
98 | msgid "" | ||
99 | "If you disable challenge-response authentication, then users will not be " | ||
100 | "able to log in using passwords. If you leave it enabled (the default " | ||
101 | "answer), then the 'PasswordAuthentication no' option will have no useful " | ||
102 | "effect unless you also adjust your PAM configuration in /etc/pam.d/ssh." | ||
103 | msgstr "" | ||
104 | "ì œê¸°-ì‘답 ì¸ì¦ë°©ì‹ì„ í•´ì œí•˜ë©´ 사용ìžë“¤ì€ 비밀번호를 ì´ìš©í•˜ì—¬ 로그ì¸í•˜ì§€ 못하" | ||
105 | "게 ë©ë‹ˆë‹¤. (기본 ì„¤ì •ëŒ€ë¡œ) í•´ì œí•˜ì§€ 않으시면 /etc/pam.d/sshì— ìžˆëŠ” PAM ì„¤ì •" | ||
106 | "ì„ ë³€ê²½í•˜ì§€ 않으실 경우 'PasswordAuthentication no' ì˜µì…˜ì€ ì•„ë¬´ëŸ° ì˜í–¥ì„ 주" | ||
107 | "지 못합니다." | ||
108 | |||
109 | #. Type: note | ||
110 | #. Description | ||
111 | #: ../openssh-server.templates:4001 | ||
112 | msgid "Vulnerable host keys will be regenerated" | ||
113 | msgstr "취약한 호스트키를 다시 ìƒì„±í•©ë‹ˆë‹¤" | ||
114 | |||
115 | #. Type: note | ||
116 | #. Description | ||
117 | #: ../openssh-server.templates:4001 | ||
118 | msgid "" | ||
119 | "Some of the OpenSSH server host keys on this system were generated with a " | ||
120 | "version of OpenSSL that had a broken random number generator. As a result, " | ||
121 | "these host keys are from a well-known set, are subject to brute-force " | ||
122 | "attacks, and must be regenerated." | ||
123 | msgstr "" | ||
124 | "ì´ ì‹œìŠ¤í…œì— ìžˆëŠ” OpenSSH ì„œë²„ì˜ í˜¸ìŠ¤íŠ¸í‚¤ëŠ” ìž˜ëª»ëœ ë‚œìˆ˜ìƒì„±ê¸°ë¥¼ 사용한 ë²„ì „ì˜ " | ||
125 | "OpenSSL를 통해 만들어졌습니다. ì´ëŸ¬í•œ í˜¸ìŠ¤íŠ¸í‚¤ë“¤ì€ ìž˜ ì•Œë ¤ì§„ 범위 ë‚´ì— ìžˆê²Œ " | ||
126 | "ë˜ë¯€ë¡œ brute-force ê³µê²©ì— ì•½í• ìˆ˜ 있으며, ë”°ë¼ì„œ 다시 만들어야 합니다." | ||
127 | |||
128 | #. Type: note | ||
129 | #. Description | ||
130 | #: ../openssh-server.templates:4001 | ||
131 | msgid "" | ||
132 | "Users of this system should be informed of this change, as they will be " | ||
133 | "prompted about the host key change the next time they log in. Use 'ssh-" | ||
134 | "keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of " | ||
135 | "the new host keys." | ||
136 | msgstr "" | ||
137 | "ì´ ì‹œìŠ¤í…œì„ ì‚¬ìš©í•œ ì‚¬ëžŒë“¤ì€ ë‹¤ìŒì— 로그ì¸í• ë•Œ 호스트키가 변경ë˜ì—ˆë‹¤ëŠ” 사실" | ||
138 | "ì„ ê°ì§€í•˜ê²Œ ë˜ê¸° ë•Œë¬¸ì— ì‚¬ìš©ìžë“¤ì—게 ì´ ì‚¬í•ì„ ì•Œë ¤ì£¼ì…”ì•¼ 합니다. ì—…ê·¸ë ˆì´ë“œ " | ||
139 | "후 'ssh-keygen -l -f 호스트키 파ì¼ëª…'ì„ ì‚¬ìš©í•˜ì—¬ 새로운 í˜¸ìŠ¤íŠ¸í‚¤ì˜ í•‘ê±°í”„ë¦°íŠ¸" | ||
140 | "를 ì¶œë ¥ë°›ì„ ìˆ˜ 있습니다." | ||
141 | |||
142 | #. Type: note | ||
143 | #. Description | ||
144 | #: ../openssh-server.templates:4001 | ||
145 | msgid "The affected host keys are:" | ||
146 | msgstr "ê´€ë ¨ëœ í˜¸ìŠ¤íŠ¸í‚¤ì˜ ëª©ë¡ì€:" | ||
147 | |||
148 | #. Type: note | ||
149 | #. Description | ||
150 | #: ../openssh-server.templates:4001 | ||
151 | msgid "" | ||
152 | "User keys may also be affected by this problem. The 'ssh-vulnkey' command " | ||
153 | "may be used as a partial test for this. See /usr/share/doc/openssh-server/" | ||
154 | "README.compromised-keys.gz for more details." | ||
155 | msgstr "" | ||
156 | "ì‚¬ìš©ìž í‚¤ ì—ì‹œ ì´ ë¬¸ì œì— ì˜í–¥ì„ ë°›ì„ ìˆ˜ 있습니다. 'ssh-vulnkey' ëª…ë ¹ì„ ì‚¬ìš©í•˜" | ||
157 | "ì—¬ 부분ì 으로나마 ê·¸ë ‡í•œì§€ë¥¼ ê²€ì‚¬í• ìˆ˜ 있습니다. ìžì„¸í•œ ì •ë³´ëŠ” /usr/share/" | ||
158 | "doc/openssh-server/README.compromised-keys.gz를 참조하ì‹ì‹œì˜¤." | ||
159 | |||
160 | #~ msgid "Generate a new configuration file for OpenSSH?" | ||
161 | #~ msgstr "OpenSSH ì„¤ì • 파ì¼ì„ 새로 만들까요?" | ||
162 | |||
163 | #~ msgid "" | ||
164 | #~ "This version of OpenSSH has a considerably changed configuration file " | ||
165 | #~ "from the version shipped in Debian 'Potato', which you appear to be " | ||
166 | #~ "upgrading from. This package can now generate a new configuration file (/" | ||
167 | #~ "etc/ssh/sshd.config), which will work with the new server version, but " | ||
168 | #~ "will not contain any customizations you made with the old version." | ||
169 | #~ msgstr "" | ||
170 | #~ "ì´ë²ˆ OpenSSH ë²„ì „ì€ ì§€ê¸ˆ ì‚¬ìš©í•˜ê³ ê³„ì‹œëŠ” 듯한 ë°ë¹„안 'Potato'ì˜ OpenSSH 버" | ||
171 | #~ "ì „ê³¼ëŠ” í¬ê²Œ 다른 ì„¤ì • 파ì¼ì„ 사용합니다. ì´ ê¾¸ëŸ¬ë¯¸ëŠ” 새로 설치ë˜ëŠ” 서버 버" | ||
172 | #~ "ì „ì— ë§žëŠ” ì„¤ì • 파ì¼(/etc/ssh/sshd.config)ì„ ìƒˆë¡œ 만들 수 있습니다만, ì´ì „ " | ||
173 | #~ "ë²„ì „ì—ì„œ 변경한 ë‚´ì—ì€ ì ìš©ë˜ì§€ 않습니다." | ||
174 | |||
175 | #~ msgid "" | ||
176 | #~ "Please note that this new configuration file will set the value of " | ||
177 | #~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password " | ||
178 | #~ "can ssh directly in as root). Please read the README.Debian file for more " | ||
179 | #~ "details about this design choice." | ||
180 | #~ msgstr "" | ||
181 | #~ "ì°¸ê³ ë¡œ 새로 설치ë˜ëŠ” ì„¤ì •íŒŒì¼ì€ 'PermitRootLogin'ì˜ ê°’ì„ 'yes'ë¡œ ì„¤ì •í•©ë‹ˆ" | ||
182 | #~ "다(ë”°ë¼ì„œ root 비밀번호를 ì•Œê³ ìžˆëŠ” ì‚¬ëžŒì€ ëˆ„êµ¬ë‚˜ rootë¡œ ì§ì ‘ ssh 로그ì¸" | ||
183 | #~ "í• ìˆ˜ 있습니다). ì´ë ‡ê²Œ ê²°ì •í•œ ì´ìœ ì— ëŒ€í•´ì„œ ìžì„¸ížˆ ì•Œê³ ìž í•˜ì‹ ë‹¤ë©´ " | ||
184 | #~ "README.Debian 파ì¼ì„ 참조하시기 ë°”ëžë‹ˆë‹¤." | ||
185 | |||
186 | #~ msgid "" | ||
187 | #~ "It is strongly recommended that you choose to generate a new " | ||
188 | #~ "configuration file now." | ||
189 | #~ msgstr "ì„¤ì • 파ì¼ì„ 지금 새로 만드시길 ê°•ë ¥ížˆ 권장합니다." | ||
diff --git a/debian/po/nb.po b/debian/po/nb.po new file mode 100644 index 000000000..415d5faf2 --- /dev/null +++ b/debian/po/nb.po | |||
@@ -0,0 +1,196 @@ | |||
1 | # translation of nb.po to Norwegian Bokmål | ||
2 | # Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER | ||
3 | # This file is distributed under the same license as the PACKAGE package. | ||
4 | # | ||
5 | # Bjørn Steensrud <bjornst@powertech.no>, 2007. | ||
6 | # Bjørn Steensrud <bjornst@skogkatt.homelinux.org>, 2008. | ||
7 | msgid "" | ||
8 | msgstr "" | ||
9 | "Project-Id-Version: nb\n" | ||
10 | "Report-Msgid-Bugs-To: openssh@packages.debian.org\n" | ||
11 | "POT-Creation-Date: 2010-01-02 08:55+0000\n" | ||
12 | "PO-Revision-Date: 2008-05-17 11:04+0200\n" | ||
13 | "Last-Translator: Bjørn Steensrud <bjornst@skogkatt.homelinux.org>\n" | ||
14 | "Language-Team: Norwegian Bokmål <i18n-nb@lister.ping.uio.no>\n" | ||
15 | "MIME-Version: 1.0\n" | ||
16 | "Content-Type: text/plain; charset=UTF-8\n" | ||
17 | "Content-Transfer-Encoding: 8bit\n" | ||
18 | "X-Generator: KBabel 1.11.4\n" | ||
19 | |||
20 | #. Type: boolean | ||
21 | #. Description | ||
22 | #: ../openssh-server.templates:1001 | ||
23 | msgid "Do you want to risk killing active SSH sessions?" | ||
24 | msgstr "Vil du risikere å avbryte aktive SSH-økter?" | ||
25 | |||
26 | #. Type: boolean | ||
27 | #. Description | ||
28 | #: ../openssh-server.templates:1001 | ||
29 | msgid "" | ||
30 | "The currently installed version of /etc/init.d/ssh is likely to kill all " | ||
31 | "running sshd instances. If you are doing this upgrade via an SSH session, " | ||
32 | "you're likely to be disconnected and leave the upgrade procedure unfinished." | ||
33 | msgstr "" | ||
34 | "Den versjonen av /etc/init.d/ssh som nå er installert vil antakelig stoppe " | ||
35 | "alle sshd-instanser som kjører. Hvis denne oppgraderingen gjøres over en SSH-" | ||
36 | "økt, så risikerer du å bli frakoblet og oppgraderingen blir ikke fullført." | ||
37 | |||
38 | #. Type: boolean | ||
39 | #. Description | ||
40 | #: ../openssh-server.templates:1001 | ||
41 | msgid "" | ||
42 | "This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the " | ||
43 | "start-stop-daemon line in the stop section of the file." | ||
44 | msgstr "" | ||
45 | "Dette kan rettes på ved å legge til manuelt «--pidfile /var/run/sshd.pid» til " | ||
46 | "start-stop-daemon linja i stopp-delen av fila." | ||
47 | |||
48 | #. Type: note | ||
49 | #. Description | ||
50 | #: ../openssh-server.templates:2001 | ||
51 | msgid "New host key mandatory" | ||
52 | msgstr "Ny vertsnøkkel obligatorisk" | ||
53 | |||
54 | #. Type: note | ||
55 | #. Description | ||
56 | #: ../openssh-server.templates:2001 | ||
57 | msgid "" | ||
58 | "The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA " | ||
59 | "algorithm. OpenSSH can not handle this host key file, and the ssh-keygen " | ||
60 | "utility from the old (non-free) SSH installation does not appear to be " | ||
61 | "available." | ||
62 | msgstr "" | ||
63 | "Den gjeldende vertsnøkkelen, i /etc/ssh/ssh_host_key, er kryptert med IDEA-" | ||
64 | "algoritmen. OpenSSH kan ikke håndtere denne vertsnøkkelfila, og det ser ikke " | ||
65 | "ut til at verktøyet ssh-keygen fra den gamle (ikke-frie) SSH-installasjonen " | ||
66 | "er tilgjengelig." | ||
67 | |||
68 | #. Type: note | ||
69 | #. Description | ||
70 | #: ../openssh-server.templates:2001 | ||
71 | msgid "You need to manually generate a new host key." | ||
72 | msgstr "En ny vertsnøkkel må lages manuelt." | ||
73 | |||
74 | #. Type: boolean | ||
75 | #. Description | ||
76 | #: ../openssh-server.templates:3001 | ||
77 | msgid "Disable challenge-response authentication?" | ||
78 | msgstr "Skal autentisering med utfordring/svar slås av?" | ||
79 | |||
80 | #. Type: boolean | ||
81 | #. Description | ||
82 | #: ../openssh-server.templates:3001 | ||
83 | msgid "" | ||
84 | "Password authentication appears to be disabled in the current OpenSSH server " | ||
85 | "configuration. In order to prevent users from logging in using passwords " | ||
86 | "(perhaps using only public key authentication instead) with recent versions " | ||
87 | "of OpenSSH, you must disable challenge-response authentication, or else " | ||
88 | "ensure that your PAM configuration does not allow Unix password file " | ||
89 | "authentication." | ||
90 | msgstr "" | ||
91 | "Det ser ut til at passord-autentisering er slått av i det gjeldende " | ||
92 | "tjeneroppsettet for OpenSSH. For å hindre brukere i å logge inn med passord " | ||
93 | "med nyere versjoner av OpenSSH (kanskje med autentisering med kryptonøkler i " | ||
94 | "stedet), så må autentisering med utfordring-svar slås av, eller det må " | ||
95 | "sjekkes at PAM-oppsettet er satt til ikke å tillate autentisering mot Unix " | ||
96 | "passord-fila." | ||
97 | |||
98 | #. Type: boolean | ||
99 | #. Description | ||
100 | #: ../openssh-server.templates:3001 | ||
101 | msgid "" | ||
102 | "If you disable challenge-response authentication, then users will not be " | ||
103 | "able to log in using passwords. If you leave it enabled (the default " | ||
104 | "answer), then the 'PasswordAuthentication no' option will have no useful " | ||
105 | "effect unless you also adjust your PAM configuration in /etc/pam.d/ssh." | ||
106 | msgstr "" | ||
107 | "Hvis autentisering med utfordring-svar er slått av, så kan brukere ikke " | ||
108 | "logge inn med passord. Hvis det står på (som er standard), så har det ingen " | ||
109 | "virkning å sette «PasswordAuthentication no» med mindre PAM-oppsettet i /etc/" | ||
110 | "pam.d/ssh også justeres." | ||
111 | |||
112 | #. Type: note | ||
113 | #. Description | ||
114 | #: ../openssh-server.templates:4001 | ||
115 | msgid "Vulnerable host keys will be regenerated" | ||
116 | msgstr "Sårbare vertsnøkler vil bli laget på nytt" | ||
117 | |||
118 | #. Type: note | ||
119 | #. Description | ||
120 | #: ../openssh-server.templates:4001 | ||
121 | msgid "" | ||
122 | "Some of the OpenSSH server host keys on this system were generated with a " | ||
123 | "version of OpenSSL that had a broken random number generator. As a result, " | ||
124 | "these host keys are from a well-known set, are subject to brute-force " | ||
125 | "attacks, and must be regenerated." | ||
126 | msgstr "" | ||
127 | "Noen av OpenSSHs vertsnøkler på dette systemet ble opprettet med versjon av " | ||
128 | "OpenSSH som hadde en feil på slumptallsgeneratoren. Derfor tilhører disse " | ||
129 | "nøklene et velkjent sett nøkler, kan knekkes med «rå kraft»-metoden og må " | ||
130 | "lages på nytt." | ||
131 | |||
132 | #. Type: note | ||
133 | #. Description | ||
134 | #: ../openssh-server.templates:4001 | ||
135 | msgid "" | ||
136 | "Users of this system should be informed of this change, as they will be " | ||
137 | "prompted about the host key change the next time they log in. Use 'ssh-" | ||
138 | "keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of " | ||
139 | "the new host keys." | ||
140 | msgstr "" | ||
141 | "De som bruker dette systemet bør få opplysning om denne endringen, siden de " | ||
142 | "vkil få spørsmål om vertsnøkkelendringen neste gang de logger inn. Etter " | ||
143 | "oppgraderingen kan fingeravtrykkene for de nye vertsnøklene skrives ut med " | ||
144 | "kommandoen «keygen -l -f VERTSNØKKELFIL»." | ||
145 | |||
146 | #. Type: note | ||
147 | #. Description | ||
148 | #: ../openssh-server.templates:4001 | ||
149 | msgid "The affected host keys are:" | ||
150 | msgstr "De vertsnøklene dette gjelder er:" | ||
151 | |||
152 | #. Type: note | ||
153 | #. Description | ||
154 | #: ../openssh-server.templates:4001 | ||
155 | msgid "" | ||
156 | "User keys may also be affected by this problem. The 'ssh-vulnkey' command " | ||
157 | "may be used as a partial test for this. See /usr/share/doc/openssh-server/" | ||
158 | "README.compromised-keys.gz for more details." | ||
159 | msgstr "" | ||
160 | "Det kan være at brukernøkler også har dette problemet. En delvis test på " | ||
161 | "dette kan gjøres med kommandoen «ssh-vulnkey». Mer detaljer finnes i /usr/" | ||
162 | "share/doc/openssh-server/README.compromised-keys.gz." | ||
163 | |||
164 | #~ msgid "Generate a new configuration file for OpenSSH?" | ||
165 | #~ msgstr "Skal ny oppsettsfil for OpenSSH lages?" | ||
166 | |||
167 | #~ msgid "" | ||
168 | #~ "This version of OpenSSH has a considerably changed configuration file " | ||
169 | #~ "from the version shipped in Debian 'Potato', which you appear to be " | ||
170 | #~ "upgrading from. This package can now generate a new configuration file (/" | ||
171 | #~ "etc/ssh/sshd.config), which will work with the new server version, but " | ||
172 | #~ "will not contain any customizations you made with the old version." | ||
173 | #~ msgstr "" | ||
174 | #~ "Det ser ut til at du oppgraderer fra Debian «Potato», og denne versjonen " | ||
175 | #~ "av OpenSSH har ganske store endringer i oppsettsfila. Denne pakka kan nå " | ||
176 | #~ "lage en ny oppsettsfil (/etc/ssh/sshd.config) som fungerer med den nye " | ||
177 | #~ "tjenerversjonen, men ikke inneholder noen tilpasninger som kan være gjort " | ||
178 | #~ "lokalt i den gamle versjonen." | ||
179 | |||
180 | #~ msgid "" | ||
181 | #~ "Please note that this new configuration file will set the value of " | ||
182 | #~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password " | ||
183 | #~ "can ssh directly in as root). Please read the README.Debian file for more " | ||
184 | #~ "details about this design choice." | ||
185 | #~ msgstr "" | ||
186 | #~ "Merk at denne nye oppsettsfila setter verdien av «PermitRootLogin» til " | ||
187 | #~ "«yes» (slik at alle som kjenner root-passordet kan logge inn direkte med " | ||
188 | #~ "ssh som root). Les README.Debian-fila for å finne ut mer om dette " | ||
189 | #~ "oppsettsvalget." | ||
190 | |||
191 | #~ msgid "" | ||
192 | #~ "It is strongly recommended that you choose to generate a new " | ||
193 | #~ "configuration file now." | ||
194 | #~ msgstr "" | ||
195 | #~ "Det anbefales sterkt at denne pakka får lov til å lage en ny oppsettsfil " | ||
196 | #~ "nå." | ||
diff --git a/debian/po/nl.po b/debian/po/nl.po new file mode 100644 index 000000000..b88ca8276 --- /dev/null +++ b/debian/po/nl.po | |||
@@ -0,0 +1,208 @@ | |||
1 | # | ||
2 | # Translators, if you are not familiar with the PO format, gettext | ||
3 | # documentation is worth reading, especially sections dedicated to | ||
4 | # this format, e.g. by running: | ||
5 | # info -n '(gettext)PO Files' | ||
6 | # info -n '(gettext)Header Entry' | ||
7 | # | ||
8 | # Some information specific to po-debconf are available at | ||
9 | # /usr/share/doc/po-debconf/README-trans | ||
10 | # or http://www.debian.org/intl/l10n/po-debconf/README-trans | ||
11 | # | ||
12 | # Developers do not need to manually edit POT or PO files. | ||
13 | # | ||
14 | msgid "" | ||
15 | msgstr "" | ||
16 | "Project-Id-Version: openssh 3.6.1p2-9\n" | ||
17 | "Report-Msgid-Bugs-To: openssh@packages.debian.org\n" | ||
18 | "POT-Creation-Date: 2010-01-02 08:55+0000\n" | ||
19 | "PO-Revision-Date: 2008-05-26 15:19+0200\n" | ||
20 | "Last-Translator: Bart Cornelis <cobaco@skolelinux.no>\n" | ||
21 | "Language-Team: debian-l10n-dutch <debian-l10n-dutch@lists.debian.org>\n" | ||
22 | "MIME-Version: 1.0\n" | ||
23 | "Content-Type: text/plain; charset=utf-8\n" | ||
24 | "Content-Transfer-Encoding: 8bit\n" | ||
25 | "X-Poedit-Language: Dutch\n" | ||
26 | |||
27 | #. Type: boolean | ||
28 | #. Description | ||
29 | #: ../openssh-server.templates:1001 | ||
30 | msgid "Do you want to risk killing active SSH sessions?" | ||
31 | msgstr "Wilt u het afsluiten van actieve SSH-sessies riskeren?" | ||
32 | |||
33 | #. Type: boolean | ||
34 | #. Description | ||
35 | #: ../openssh-server.templates:1001 | ||
36 | msgid "" | ||
37 | "The currently installed version of /etc/init.d/ssh is likely to kill all " | ||
38 | "running sshd instances. If you are doing this upgrade via an SSH session, " | ||
39 | "you're likely to be disconnected and leave the upgrade procedure unfinished." | ||
40 | msgstr "" | ||
41 | "De /etc/init.d/ssh versie die u geïnstalleerd hebt sluit waarschijnlijk alle " | ||
42 | "lopende sshd-instanties af. Als u deze opwaardering via een SSH-sessie " | ||
43 | "uitvoert verliest u waarschijnlijk de verbinding waardoor de " | ||
44 | "opwaarderingsprocedure onafgemaakt blijft." | ||
45 | |||
46 | #. Type: boolean | ||
47 | #. Description | ||
48 | #: ../openssh-server.templates:1001 | ||
49 | msgid "" | ||
50 | "This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the " | ||
51 | "start-stop-daemon line in the stop section of the file." | ||
52 | msgstr "" | ||
53 | "U kunt dit handmatig repareren door \"--pidfile /var/run/sshd.pid\" toe te " | ||
54 | "voegen aan de start-stop-daemon regel in de stop-sectie van het bestand." | ||
55 | |||
56 | #. Type: note | ||
57 | #. Description | ||
58 | #: ../openssh-server.templates:2001 | ||
59 | msgid "New host key mandatory" | ||
60 | msgstr "Een nieuwe computersleutel is verplicht" | ||
61 | |||
62 | #. Type: note | ||
63 | #. Description | ||
64 | #: ../openssh-server.templates:2001 | ||
65 | msgid "" | ||
66 | "The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA " | ||
67 | "algorithm. OpenSSH can not handle this host key file, and the ssh-keygen " | ||
68 | "utility from the old (non-free) SSH installation does not appear to be " | ||
69 | "available." | ||
70 | msgstr "" | ||
71 | "De huidige computersleutel in /etc/ssh/ssh_host_key is versleuteld met het " | ||
72 | "IDEA-algoritme. OpenSSH kan dit computer-sleutelbestand niet aan, en het ssh-" | ||
73 | "keygen programma van de oude (niet-vrije) SSH-installatie is niet " | ||
74 | "beschikbaar." | ||
75 | |||
76 | #. Type: note | ||
77 | #. Description | ||
78 | #: ../openssh-server.templates:2001 | ||
79 | msgid "You need to manually generate a new host key." | ||
80 | msgstr "U dient bijgevolg handmatig een nieuwe computersleutel te genereren." | ||
81 | |||
82 | #. Type: boolean | ||
83 | #. Description | ||
84 | #: ../openssh-server.templates:3001 | ||
85 | msgid "Disable challenge-response authentication?" | ||
86 | msgstr "Challenge-response-authenticatie deactiveren?" | ||
87 | |||
88 | #. Type: boolean | ||
89 | #. Description | ||
90 | #: ../openssh-server.templates:3001 | ||
91 | msgid "" | ||
92 | "Password authentication appears to be disabled in the current OpenSSH server " | ||
93 | "configuration. In order to prevent users from logging in using passwords " | ||
94 | "(perhaps using only public key authentication instead) with recent versions " | ||
95 | "of OpenSSH, you must disable challenge-response authentication, or else " | ||
96 | "ensure that your PAM configuration does not allow Unix password file " | ||
97 | "authentication." | ||
98 | msgstr "" | ||
99 | "Zo te zien is wachtwoord-authenticatie momenteel gedeactiveerd in uw OpenSSH-" | ||
100 | "serverconfiguratie. Om te voorkomen dat gebruikers van recente OpenSSH-" | ||
101 | "versies inloggen met behulp van wachtwoorden (en in plaats daarvan enkel " | ||
102 | "publieke-sleutel authenticatie te gebruiken), dient challenge-response-" | ||
103 | "authenticatie gedeactiveerd te worden, of dient u ervoor te zorgen dat uw " | ||
104 | "PAM-configuratie geen Unix 'password'-bestand-authenticatie toe laat." | ||
105 | |||
106 | #. Type: boolean | ||
107 | #. Description | ||
108 | #: ../openssh-server.templates:3001 | ||
109 | msgid "" | ||
110 | "If you disable challenge-response authentication, then users will not be " | ||
111 | "able to log in using passwords. If you leave it enabled (the default " | ||
112 | "answer), then the 'PasswordAuthentication no' option will have no useful " | ||
113 | "effect unless you also adjust your PAM configuration in /etc/pam.d/ssh." | ||
114 | msgstr "" | ||
115 | "Wanneer u challenge-response-authenticatie deactiveert kunnen gebruikers " | ||
116 | "niet meer inloggen met behulp van wachtwoorden. Als u het geactiveerd laat " | ||
117 | "(de standaarwaarde) zal de 'PasswordAuthentication no' optie geen (nuttig) " | ||
118 | "effect hebben tenzij u ook de PAM-configuratie aanpast in /etc/pam.d/ssh." | ||
119 | |||
120 | #. Type: note | ||
121 | #. Description | ||
122 | #: ../openssh-server.templates:4001 | ||
123 | msgid "Vulnerable host keys will be regenerated" | ||
124 | msgstr "Kwetsbare computersleutels worden opnieuw aangemaakt" | ||
125 | |||
126 | #. Type: note | ||
127 | #. Description | ||
128 | #: ../openssh-server.templates:4001 | ||
129 | msgid "" | ||
130 | "Some of the OpenSSH server host keys on this system were generated with a " | ||
131 | "version of OpenSSL that had a broken random number generator. As a result, " | ||
132 | "these host keys are from a well-known set, are subject to brute-force " | ||
133 | "attacks, and must be regenerated." | ||
134 | msgstr "" | ||
135 | "Er zijn op dit systeem OpenSSH-computersleutels aangetroffen die aangemaakt " | ||
136 | "zijn door een versie van OpenSSL met een onjuiste random-nummer-generator. " | ||
137 | "Hierdoor zijn deze computersleutels kwetsbaar voor 'brute-force'-aanvallen " | ||
138 | "en moeten ze opnieuw aangemaakt worden." | ||
139 | |||
140 | #. Type: note | ||
141 | #. Description | ||
142 | #: ../openssh-server.templates:4001 | ||
143 | msgid "" | ||
144 | "Users of this system should be informed of this change, as they will be " | ||
145 | "prompted about the host key change the next time they log in. Use 'ssh-" | ||
146 | "keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of " | ||
147 | "the new host keys." | ||
148 | msgstr "" | ||
149 | "Gebruikers van dit systeem krijgen een melding omtrent de " | ||
150 | "computersleutelverandering op hun scherm de volgende keer dat ze inloggen " | ||
151 | "via ssh. U dient hun hierover dus te berichten. De vingerafdrukken van de " | ||
152 | "nieuwe computersleutels kunt na de opwaardering opvragen via het commando " | ||
153 | "'ssh-keygen -l -f HOST_KEY_FILE'." | ||
154 | |||
155 | #. Type: note | ||
156 | #. Description | ||
157 | #: ../openssh-server.templates:4001 | ||
158 | msgid "The affected host keys are:" | ||
159 | msgstr "De getroffen computersleutels zijn:" | ||
160 | |||
161 | #. Type: note | ||
162 | #. Description | ||
163 | #: ../openssh-server.templates:4001 | ||
164 | msgid "" | ||
165 | "User keys may also be affected by this problem. The 'ssh-vulnkey' command " | ||
166 | "may be used as a partial test for this. See /usr/share/doc/openssh-server/" | ||
167 | "README.compromised-keys.gz for more details." | ||
168 | msgstr "" | ||
169 | "Sleutels van gebruikers kunnen ook getroffen zijn door dit probleem. Het " | ||
170 | "'ssh-vulnkey' commando kan gebruikt worden als een gedeeltelijke test, meer " | ||
171 | "details vindt u in /usr/share/doc/openssh-server/README.compromised-keys." | ||
172 | "gz . " | ||
173 | |||
174 | #~ msgid "Generate a new configuration file for OpenSSH?" | ||
175 | #~ msgstr "" | ||
176 | #~ "Wilt u dat er een nieuw configuratiebestand aangemaakt wordt voor OpenSSH?" | ||
177 | |||
178 | #~ msgid "" | ||
179 | #~ "This version of OpenSSH has a considerably changed configuration file " | ||
180 | #~ "from the version shipped in Debian 'Potato', which you appear to be " | ||
181 | #~ "upgrading from. This package can now generate a new configuration file (/" | ||
182 | #~ "etc/ssh/sshd.config), which will work with the new server version, but " | ||
183 | #~ "will not contain any customizations you made with the old version." | ||
184 | #~ msgstr "" | ||
185 | #~ "Deze versie van OpenSSH gebruikt een configuratiebestand dat sterk " | ||
186 | #~ "veranderd is ten opzichte van dat in Debian 'Potato' (waarvan u lijkt op " | ||
187 | #~ "te waarderen). Het pakket kan nu een nieuw configuratiebestand (/etc/ssh/" | ||
188 | #~ "sshd.config) genereren dat met de nieuwe versie werkt. Dit gegenereerde " | ||
189 | #~ "bestand zal echter de door u gemaakte aanpassingen in het oude " | ||
190 | #~ "configuratiebestand niet overnemen." | ||
191 | |||
192 | #~ msgid "" | ||
193 | #~ "Please note that this new configuration file will set the value of " | ||
194 | #~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password " | ||
195 | #~ "can ssh directly in as root). Please read the README.Debian file for more " | ||
196 | #~ "details about this design choice." | ||
197 | #~ msgstr "" | ||
198 | #~ "Merk op dat dit nieuwe configuratiebestand de waarde van " | ||
199 | #~ "'PermitRootLogin' op 'yes' zet (wat betekent dat iedereen die het root-" | ||
200 | #~ "wachtwoord kent via ssh rechtstreeks als root kan aanmelden). Meer " | ||
201 | #~ "informatie over deze ontwerpkeuze vindt u in het bestand README.Debian." | ||
202 | |||
203 | #~ msgid "" | ||
204 | #~ "It is strongly recommended that you choose to generate a new " | ||
205 | #~ "configuration file now." | ||
206 | #~ msgstr "" | ||
207 | #~ "Het wordt ten sterkste aangeraden om nu het nieuwe configuratiebestand te " | ||
208 | #~ "laten genereren." | ||
diff --git a/debian/po/pl.po b/debian/po/pl.po new file mode 100644 index 000000000..e70ee26ac --- /dev/null +++ b/debian/po/pl.po | |||
@@ -0,0 +1,432 @@ | |||
1 | # | ||
2 | # Translators, if you are not familiar with the PO format, gettext | ||
3 | # documentation is worth reading, especially sections dedicated to | ||
4 | # this format, e.g. by running: | ||
5 | # info -n '(gettext)PO Files' | ||
6 | # info -n '(gettext)Header Entry' | ||
7 | # | ||
8 | # Some information specific to po-debconf are available at | ||
9 | # /usr/share/doc/po-debconf/README-trans | ||
10 | # or http://www.debian.org/intl/l10n/po-debconf/README-trans | ||
11 | # | ||
12 | # Developers do not need to manually edit POT or PO files. | ||
13 | # | ||
14 | msgid "" | ||
15 | msgstr "" | ||
16 | "Project-Id-Version: PACKAGE VERSION\n" | ||
17 | "Report-Msgid-Bugs-To: openssh@packages.debian.org\n" | ||
18 | "POT-Creation-Date: 2010-01-02 08:55+0000\n" | ||
19 | "PO-Revision-Date: 2004-04-08 18:28+0200\n" | ||
20 | "Last-Translator: Emil Nowak <emil5@go2.pl>\n" | ||
21 | "Language-Team: Polish <translation-team-pl@lists.sourceforge.net>\n" | ||
22 | "MIME-Version: 1.0\n" | ||
23 | "Content-Type: text/plain; charset=ISO-8859-2\n" | ||
24 | "Content-Transfer-Encoding: 8bit\n" | ||
25 | |||
26 | #. Type: boolean | ||
27 | #. Description | ||
28 | #: ../openssh-server.templates:1001 | ||
29 | #, fuzzy | ||
30 | #| msgid "Do you want to continue (and risk killing active ssh sessions)?" | ||
31 | msgid "Do you want to risk killing active SSH sessions?" | ||
32 | msgstr "Czy chcesz kontynuowaæ (i ryzykowaæ przerwaniem aktywnych sesji ssh) ?" | ||
33 | |||
34 | #. Type: boolean | ||
35 | #. Description | ||
36 | #: ../openssh-server.templates:1001 | ||
37 | #, fuzzy | ||
38 | #| msgid "" | ||
39 | #| "The version of /etc/init.d/ssh that you have installed, is likely to kill " | ||
40 | #| "all running sshd instances. If you are doing this upgrade via an ssh " | ||
41 | #| "session, that would be a Bad Thing(tm)." | ||
42 | msgid "" | ||
43 | "The currently installed version of /etc/init.d/ssh is likely to kill all " | ||
44 | "running sshd instances. If you are doing this upgrade via an SSH session, " | ||
45 | "you're likely to be disconnected and leave the upgrade procedure unfinished." | ||
46 | msgstr "" | ||
47 | "Zainstalowana w³a¶nie wersja /etc/init.d/ssh mo¿e zabiæ wszystkie dzia³aj±ce " | ||
48 | "obecnie kopie sshd. Je¶li wykonujesz t± aktualizacjê przez ssh, to by³aby " | ||
49 | "Z³a Rzecz(tm)." | ||
50 | |||
51 | #. Type: boolean | ||
52 | #. Description | ||
53 | #: ../openssh-server.templates:1001 | ||
54 | #, fuzzy | ||
55 | #| msgid "" | ||
56 | #| "You can fix this by adding \"--pidfile /var/run/sshd.pid\" to the start-" | ||
57 | #| "stop-daemon line in the stop section of the file." | ||
58 | msgid "" | ||
59 | "This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the " | ||
60 | "start-stop-daemon line in the stop section of the file." | ||
61 | msgstr "" | ||
62 | "Mo¿esz to naprawiæ dodaj±c \"--pidfile /var/run/sshd.pid\" do linijki start-" | ||
63 | "stop-daemon w sekcji stop tego pliku." | ||
64 | |||
65 | #. Type: note | ||
66 | #. Description | ||
67 | #: ../openssh-server.templates:2001 | ||
68 | msgid "New host key mandatory" | ||
69 | msgstr "" | ||
70 | |||
71 | #. Type: note | ||
72 | #. Description | ||
73 | #: ../openssh-server.templates:2001 | ||
74 | #, fuzzy | ||
75 | msgid "" | ||
76 | "The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA " | ||
77 | "algorithm. OpenSSH can not handle this host key file, and the ssh-keygen " | ||
78 | "utility from the old (non-free) SSH installation does not appear to be " | ||
79 | "available." | ||
80 | msgstr "" | ||
81 | "Istnieje stary /etc/ssh/ssh_host_key, który jest zaszyfrowany przez IDEA. " | ||
82 | "OpenSSH nie umie korzystaæ z tak zaszyfrowanego klucza, a nie mo¿e znale¼æ " | ||
83 | "polecenia ssh-keygen ze starego SSH (non-free)." | ||
84 | |||
85 | #. Type: note | ||
86 | #. Description | ||
87 | #: ../openssh-server.templates:2001 | ||
88 | #, fuzzy | ||
89 | #| msgid "You will need to generate a new host key." | ||
90 | msgid "You need to manually generate a new host key." | ||
91 | msgstr "Bêdziesz musia³ wygenerowaæ nowy klucz hosta." | ||
92 | |||
93 | #. Type: boolean | ||
94 | #. Description | ||
95 | #: ../openssh-server.templates:3001 | ||
96 | msgid "Disable challenge-response authentication?" | ||
97 | msgstr "" | ||
98 | |||
99 | #. Type: boolean | ||
100 | #. Description | ||
101 | #: ../openssh-server.templates:3001 | ||
102 | msgid "" | ||
103 | "Password authentication appears to be disabled in the current OpenSSH server " | ||
104 | "configuration. In order to prevent users from logging in using passwords " | ||
105 | "(perhaps using only public key authentication instead) with recent versions " | ||
106 | "of OpenSSH, you must disable challenge-response authentication, or else " | ||
107 | "ensure that your PAM configuration does not allow Unix password file " | ||
108 | "authentication." | ||
109 | msgstr "" | ||
110 | |||
111 | #. Type: boolean | ||
112 | #. Description | ||
113 | #: ../openssh-server.templates:3001 | ||
114 | msgid "" | ||
115 | "If you disable challenge-response authentication, then users will not be " | ||
116 | "able to log in using passwords. If you leave it enabled (the default " | ||
117 | "answer), then the 'PasswordAuthentication no' option will have no useful " | ||
118 | "effect unless you also adjust your PAM configuration in /etc/pam.d/ssh." | ||
119 | msgstr "" | ||
120 | |||
121 | #. Type: note | ||
122 | #. Description | ||
123 | #: ../openssh-server.templates:4001 | ||
124 | msgid "Vulnerable host keys will be regenerated" | ||
125 | msgstr "" | ||
126 | |||
127 | #. Type: note | ||
128 | #. Description | ||
129 | #: ../openssh-server.templates:4001 | ||
130 | msgid "" | ||
131 | "Some of the OpenSSH server host keys on this system were generated with a " | ||
132 | "version of OpenSSL that had a broken random number generator. As a result, " | ||
133 | "these host keys are from a well-known set, are subject to brute-force " | ||
134 | "attacks, and must be regenerated." | ||
135 | msgstr "" | ||
136 | |||
137 | #. Type: note | ||
138 | #. Description | ||
139 | #: ../openssh-server.templates:4001 | ||
140 | msgid "" | ||
141 | "Users of this system should be informed of this change, as they will be " | ||
142 | "prompted about the host key change the next time they log in. Use 'ssh-" | ||
143 | "keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of " | ||
144 | "the new host keys." | ||
145 | msgstr "" | ||
146 | |||
147 | #. Type: note | ||
148 | #. Description | ||
149 | #: ../openssh-server.templates:4001 | ||
150 | msgid "The affected host keys are:" | ||
151 | msgstr "" | ||
152 | |||
153 | #. Type: note | ||
154 | #. Description | ||
155 | #: ../openssh-server.templates:4001 | ||
156 | msgid "" | ||
157 | "User keys may also be affected by this problem. The 'ssh-vulnkey' command " | ||
158 | "may be used as a partial test for this. See /usr/share/doc/openssh-server/" | ||
159 | "README.compromised-keys.gz for more details." | ||
160 | msgstr "" | ||
161 | |||
162 | #, fuzzy | ||
163 | #~ msgid "Generate a new configuration file for OpenSSH?" | ||
164 | #~ msgstr "Wygeneruj nowy plik konfiguracyjny" | ||
165 | |||
166 | #, fuzzy | ||
167 | #~ msgid "" | ||
168 | #~ "This version of OpenSSH has a considerably changed configuration file " | ||
169 | #~ "from the version shipped in Debian 'Potato', which you appear to be " | ||
170 | #~ "upgrading from. This package can now generate a new configuration file (/" | ||
171 | #~ "etc/ssh/sshd.config), which will work with the new server version, but " | ||
172 | #~ "will not contain any customizations you made with the old version." | ||
173 | #~ msgstr "" | ||
174 | #~ "W tej wersji OpenSSH zmieni³ siê plik konfiguracyjny w stosunku do wersji " | ||
175 | #~ "dostarczanej z Debianem 'Potato', któr± zdajesz siê aktualizowaæ. Mogê " | ||
176 | #~ "teraz wygenerowaæ nowy plik konfiguracyjny (/etc/ssh/sshd.config), który " | ||
177 | #~ "bêdzie dzia³a³ z now± wersj± serwera, ale nie bêdzie zawiera³ ¿adnych " | ||
178 | #~ "dokonanych przez ciebie w starej wersji zmian." | ||
179 | |||
180 | #, fuzzy | ||
181 | #~| msgid "" | ||
182 | #~| "Please note that this new configuration file will set the value of " | ||
183 | #~| "'PermitRootLogin' to yes (meaning that anyone knowing the root password " | ||
184 | #~| "can ssh directly in as root). It is the opinion of the maintainer that " | ||
185 | #~| "this is the correct default (see README.Debian for more details), but " | ||
186 | #~| "you can always edit sshd_config and set it to no if you wish." | ||
187 | #~ msgid "" | ||
188 | #~ "Please note that this new configuration file will set the value of " | ||
189 | #~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password " | ||
190 | #~ "can ssh directly in as root). Please read the README.Debian file for more " | ||
191 | #~ "details about this design choice." | ||
192 | #~ msgstr "" | ||
193 | #~ "Zauwa¿ proszê, ¿e nowy plik konfiguracyjny bêdzie ustawia³ warto¶æ opcji " | ||
194 | #~ "'PermitRootLogin' na 'tak' (co oznacza, ¿e ka¿dy kto zna has³o root'a " | ||
195 | #~ "mo¿e zdalnie zalogowaæ siê przez ssh jako root). W opinii opiekuna " | ||
196 | #~ "pakietu to jest poprawna warto¶æ domy¶lna (szczegó³y w README.Debian), " | ||
197 | #~ "ale mo¿esz sobie wyedytowaæ sshd_config i ustawiæ tê opcjê na 'nie' je¶li " | ||
198 | #~ "siê z t± opini± nie zgadzasz." | ||
199 | |||
200 | #, fuzzy | ||
201 | #~ msgid "" | ||
202 | #~ "It is strongly recommended that you choose to generate a new " | ||
203 | #~ "configuration file now." | ||
204 | #~ msgstr "" | ||
205 | #~ "Jest bardzo wskazane aby¶ pozwoli³ mi wygenerowaæ nowy plik " | ||
206 | #~ "konfiguracyjny." | ||
207 | |||
208 | #~ msgid "Warning: you must create a new host key" | ||
209 | #~ msgstr "Uwaga: musisz utworzyæ nowy klucz hosta" | ||
210 | |||
211 | #~ msgid "Warning: telnetd is installed --- probably not a good idea" | ||
212 | #~ msgstr "" | ||
213 | #~ "Uwaga: telnetd jest zainstalowany --- prawdopodobnie nienajlepszy pomys³" | ||
214 | |||
215 | #~ msgid "" | ||
216 | #~ "I'd advise you to either remove the telnetd package (if you don't " | ||
217 | #~ "actually need to offer telnet access) or install telnetd-ssl so that " | ||
218 | #~ "there is at least some chance that telnet sessions will not be sending " | ||
219 | #~ "unencrypted login/password and session information over the network." | ||
220 | #~ msgstr "" | ||
221 | #~ "Radzi³bym albo usun±æ pakiet telnetd (je¶li nie potrzebujesz koniecznie " | ||
222 | #~ "udostêpniaæ telnet'a) albo zainstalowaæ telnetd-ssl aby by³a choæ " | ||
223 | #~ "szansza, ¿e sesje telnet nie bêd± przesy³aæ niezaszyfrowanego loginu/" | ||
224 | #~ "has³a oraz danych sesji przez sieæ." | ||
225 | |||
226 | #~ msgid "Warning: rsh-server is installed --- probably not a good idea" | ||
227 | #~ msgstr "" | ||
228 | #~ "Uwaga: serwer rsh jest zainstalowany --- prawdopodobnie nienajlepszy " | ||
229 | #~ "pomys³" | ||
230 | |||
231 | #~ msgid "" | ||
232 | #~ "having rsh-server installed undermines the security that you were " | ||
233 | #~ "probably wanting to obtain by installing ssh. I'd advise you to remove " | ||
234 | #~ "that package." | ||
235 | #~ msgstr "" | ||
236 | #~ "Posiadanie zainstalowanego serwera rsh podminowuje zabezpieczenia, które " | ||
237 | #~ "prawdopodobnie starasz siê uzyskaæ instaluj±c ssh. Radzi³bym usun±æ ten " | ||
238 | #~ "pakiet." | ||
239 | |||
240 | #~ msgid "Do you want ssh-keysign to be installed SUID root?" | ||
241 | #~ msgstr "Czy chcesz aby ssh-keysign by³ zainstalowany jako SUID root?" | ||
242 | |||
243 | #~ msgid "" | ||
244 | #~ "You have the option of installing the ssh-keysign helper with the SUID " | ||
245 | #~ "bit set." | ||
246 | #~ msgstr "" | ||
247 | #~ "Masz mo¿liwo¶æ zainstalowania pomocniczego programu ssh-keysign z " | ||
248 | #~ "w³±czonym bitem SETUID." | ||
249 | |||
250 | #~ msgid "" | ||
251 | #~ "If you make ssh-keysign SUID, you will be able to use SSH's Protocol 2 " | ||
252 | #~ "host-based authentication." | ||
253 | #~ msgstr "" | ||
254 | #~ "Je¶li uczynisz ssh-keysign SUIDowym, bêdziesz móg³ u¿ywaæ opartej na " | ||
255 | #~ "hostach autoryzacji drugiej wersji protoko³u SSH." | ||
256 | |||
257 | #~ msgid "" | ||
258 | #~ "If in doubt, I suggest you install it with SUID. If it causes problems " | ||
259 | #~ "you can change your mind later by running: dpkg-reconfigure ssh" | ||
260 | #~ msgstr "" | ||
261 | #~ "Je¶li masz w±tpliwo¶ci, radzê zainstalowaæ go z SUIDem. Je¶li to sprawia " | ||
262 | #~ "problemy, mo¿esz zmieniæ swoje zdanie uruchamiaj±c pó¼niej polecenie: " | ||
263 | #~ "dpkg-reconfigure ssh" | ||
264 | |||
265 | #~ msgid "Allow SSH protocol 2 only" | ||
266 | #~ msgstr "Zezwalaj wy³±cznie na wersjê 2 protoko³u SSH" | ||
267 | |||
268 | #~ msgid "" | ||
269 | #~ "This version of OpenSSH supports version 2 of the ssh protocol, which is " | ||
270 | #~ "much more secure. Disabling ssh 1 is encouraged, however this will slow " | ||
271 | #~ "things down on low end machines and might prevent older clients from " | ||
272 | #~ "connecting (the ssh client shipped with \"potato\" is affected)." | ||
273 | #~ msgstr "" | ||
274 | #~ "Ta wersja OpenSSH wspiera drug± wersjê protoko³u ssh, która jest znacznie " | ||
275 | #~ "bardziej bezpieczna. Wy³±czenie ssh 1 jest zalecane, choæ spowalnia to " | ||
276 | #~ "dzia³anie na starych maszynach i mo¿e uniemo¿liwiæ po³±czenie starszym " | ||
277 | #~ "wersjom klientów (dotyczy to np. klienta ssh do³±czanego do \"potato\")." | ||
278 | |||
279 | #~ msgid "" | ||
280 | #~ "Also please note that keys used for protocol 1 are different so you will " | ||
281 | #~ "not be able to use them if you only allow protocol 2 connections." | ||
282 | #~ msgstr "" | ||
283 | #~ "Ponadto, zauwa¿ proszê, ¿e klucze u¿ywane przez protokó³ 1 s± inne, wiêc " | ||
284 | #~ "nie bêdziesz móg³ ich u¿ywaæ je¶li zezwolisz na korzystanie wy³±cznie z " | ||
285 | #~ "wersji 2 protoko³u." | ||
286 | |||
287 | #~ msgid "" | ||
288 | #~ "If you later change your mind about this setting, README.Debian has " | ||
289 | #~ "instructions on what to do to your sshd_config file." | ||
290 | #~ msgstr "" | ||
291 | #~ "Je¶li pó¼niej zmienisz zdanie co do tego ustawienia, to instrukcje co " | ||
292 | #~ "zmieniæ w sshd_config znajduj± siê w README.Debian." | ||
293 | |||
294 | #~ msgid "NOTE: Forwarding of X11 and Authorization disabled by default." | ||
295 | #~ msgstr "" | ||
296 | #~ "UWAGA: Przekazywanie (forwarding) X11 i Autoryzacji jest domy¶lnie " | ||
297 | #~ "wy³±czone." | ||
298 | |||
299 | #~ msgid "" | ||
300 | #~ "For security reasons, the Debian version of ssh has ForwardX11 and " | ||
301 | #~ "ForwardAgent set to ``off'' by default." | ||
302 | #~ msgstr "" | ||
303 | #~ "Ze wzglêdów bezpieczeñstwa Debianowa wersja ssh ma ForwardX11 i " | ||
304 | #~ "ForwardAgent ustawione domy¶lnie na 'off'." | ||
305 | |||
306 | #~ msgid "" | ||
307 | #~ "You can enable it for servers you trust, either in one of the " | ||
308 | #~ "configuration files, or with the -X command line option." | ||
309 | #~ msgstr "" | ||
310 | #~ "Dla zaufanych serwerów mo¿esz w³±czyæ te opcje w pliku konfiguracyjnym " | ||
311 | #~ "lub przy pomocy opcji -X z linii komend." | ||
312 | |||
313 | #~ msgid "More details can be found in /usr/share/doc/ssh/README.Debian" | ||
314 | #~ msgstr "Wiêcej szczegó³ów znajdziesz w /usr/share/doc/ssh/README.Debian." | ||
315 | |||
316 | #~ msgid "ssh2 keys merged in configuration files" | ||
317 | #~ msgstr "klucze ssh2 w³±czone do plików konfiguracyjnych" | ||
318 | |||
319 | #~ msgid "" | ||
320 | #~ "As of version 3 OpenSSH no longer uses separate files for ssh1 and ssh2 " | ||
321 | #~ "keys. This means the authorized_keys2 and known_hosts2 files are no " | ||
322 | #~ "longer needed. They will still be read in order to maintain backwards " | ||
323 | #~ "compatibility" | ||
324 | #~ msgstr "" | ||
325 | #~ "Pocz±wszy od wersji 3 OpenSSH nie u¿ywa ju¿ osobnych plików dla kluczy " | ||
326 | #~ "ssh1 i ssh2. Oznacza to, ¿e pliki authorized_keys2 i known_hosts2 nie s± " | ||
327 | #~ "ju¿ potrzebne. Bêd± one jednak odczytywane aby zachowaæ wsteczn± " | ||
328 | #~ "kompatybilno¶æ." | ||
329 | |||
330 | #~ msgid "Do you want to run the sshd server?" | ||
331 | #~ msgstr "Czy chcesz uruchamiaæ serwer sshd ?" | ||
332 | |||
333 | #~ msgid "This package contains both the ssh client, and the sshd server." | ||
334 | #~ msgstr "Ten pakiet zawiera zarówno klienta ssh, jak i serwer sshd." | ||
335 | |||
336 | #~ msgid "" | ||
337 | #~ "Normally the sshd Secure Shell Server will be run to allow remote logins " | ||
338 | #~ "via ssh." | ||
339 | #~ msgstr "" | ||
340 | #~ "Normalnie serwer sshd (Secure Shell Server) bêdzie uruchomiony aby " | ||
341 | #~ "umo¿liwiæ zdalny dostêp przez ssh." | ||
342 | |||
343 | #~ msgid "" | ||
344 | #~ "If you are only interested in using the ssh client for outbound " | ||
345 | #~ "connections on this machine, and don't want to log into it at all using " | ||
346 | #~ "ssh, then you can disable sshd here." | ||
347 | #~ msgstr "" | ||
348 | #~ "Je¶li jeste¶ zainteresowany u¿ywaniem wy³±cznie klienta ssh dla po³±czeñ " | ||
349 | #~ "wychodz±cych z tej maszyny, i nie chcesz siê na ni± logowaæ przy pomocy " | ||
350 | #~ "ssh, to mo¿esz teraz wy³±czyæ serwer sshd." | ||
351 | |||
352 | #~ msgid "Environment options on keys have been deprecated" | ||
353 | #~ msgstr "Odradzamy stosowanie ustawieñ ¶rodowiskowych dla kluczy." | ||
354 | |||
355 | #~ msgid "" | ||
356 | #~ "This version of OpenSSH disables the environment option for public keys " | ||
357 | #~ "by default, in order to avoid certain attacks (for example, LD_PRELOAD). " | ||
358 | #~ "If you are using this option in an authorized_keys file, beware that the " | ||
359 | #~ "keys in question will no longer work until the option is removed." | ||
360 | #~ msgstr "" | ||
361 | #~ "Ta wersja OpenSSH ma wy³±czon± opcjê wykorzystywania ustawieñ " | ||
362 | #~ "¶rodowiskowych dla kluczy publicznych. Mo¿na dziêki temu unikn±æ pewnych " | ||
363 | #~ "ataków (jak np.: LD_PRELOAD). Je¿eli u¿ywasz tej opcji w pliku " | ||
364 | #~ "authorized_keys, to zawarte w nim klucze nie bêd± dzia³aæ dopóki ta opcja " | ||
365 | #~ "nie zostanie usuniêta." | ||
366 | |||
367 | #~ msgid "" | ||
368 | #~ "To re-enable this option, set \"PermitUserEnvironment yes\" in /etc/ssh/" | ||
369 | #~ "sshd_config after the upgrade is complete, taking note of the warning in " | ||
370 | #~ "the sshd_config(5) manual page." | ||
371 | #~ msgstr "" | ||
372 | #~ "Aby ponownie w³±czyæ tê opcjê, nale¿y dodaæ wpis \"PermitUserEnvironment " | ||
373 | #~ "yes\" do pliku /etc/ssh/sshd_config po ukoñczeniu aktualizacji. Przy " | ||
374 | #~ "zmianie konfiguracji nale¿y zapoznaæ siê z informacjami zawartymi na " | ||
375 | #~ "stronie podrêcznika systemowego sshd_config(5)." | ||
376 | |||
377 | #~ msgid "Privilege separation" | ||
378 | #~ msgstr "Separacja uprawnieñ" | ||
379 | |||
380 | #~ msgid "" | ||
381 | #~ "Privilege separation is turned on by default, so if you decide you want " | ||
382 | #~ "it turned off, you need to add \"UsePrivilegeSeparation no\" to /etc/ssh/" | ||
383 | #~ "sshd_config." | ||
384 | #~ msgstr "" | ||
385 | #~ "Separacja uprawnieñ jest domy¶lnie w³±czona, wiêc je¶li zdecydujesz siê " | ||
386 | #~ "j± wy³±czyæ, musisz dodaæ \"UsePrivilegeSeparation no\" do pliku /etc/ssh/" | ||
387 | #~ "sshd_config." | ||
388 | |||
389 | #~ msgid "Enable Privilege separation" | ||
390 | #~ msgstr "W³±czenie separacji uprawnieñ" | ||
391 | |||
392 | #~ msgid "" | ||
393 | #~ "This version of OpenSSH contains the new privilege separation option. " | ||
394 | #~ "This significantly reduces the quantity of code that runs as root, and " | ||
395 | #~ "therefore reduces the impact of security holes in sshd." | ||
396 | #~ msgstr "" | ||
397 | #~ "Ta wersja OpenSSH zawiera now± opcjê separacji uprawnieñ. Znacz±co " | ||
398 | #~ "zmniejsza ona ilo¶æ kodu, który jest uruchamiany jako root i co za tym " | ||
399 | #~ "idzie redukuje efekty luk bezpieczeñstwa w sshd." | ||
400 | |||
401 | #~ msgid "" | ||
402 | #~ "Unfortunately, privilege separation interacts badly with PAM. Any PAM " | ||
403 | #~ "session modules that need to run as root (pam_mkhomedir, for example) " | ||
404 | #~ "will fail, and PAM keyboard-interactive authentication won't work." | ||
405 | #~ msgstr "" | ||
406 | #~ "Niestety separacja uprawnieñ ¼le reaguje z PAMem. Jakikolwiek modu³ sesji " | ||
407 | #~ "PAM, który musi byæ uruchamiany jako root (pam_mkhomedir, na przyk³ad) " | ||
408 | #~ "zawiedzie. Nie bêdzie dzia³aæ równie¿ interaktywna autentykacja z " | ||
409 | #~ "klawiatury (keyboard-interactive authentication)." | ||
410 | |||
411 | #, fuzzy | ||
412 | #~ msgid "" | ||
413 | #~ "Since you've opted to have me generate an sshd_config file for you, you " | ||
414 | #~ "can choose whether or not to have privilege separation turned on or not. " | ||
415 | #~ "Unless you know you need to use PAM features that won't work with this " | ||
416 | #~ "option, you should enable it." | ||
417 | #~ msgstr "" | ||
418 | #~ "Zdecydowa³e¶ siê na to abym wygenerowa³ dla ciebie plik sshd_config, i " | ||
419 | #~ "mo¿esz wybraæ czy chcesz w³±czyæ Separacjê Uprawnieñ, czy te¿ nie. Je¶li " | ||
420 | #~ "nie u¿ywasz j±dra z serii 2.0 (w którym to przypadku *musisz* " | ||
421 | #~ "odpowiedzieæ tutaj 'nie' albo sshd w ogóle nie ruszy) i je¶li nie musisz " | ||
422 | #~ "korzystaæ z mo¿liwo¶ci PAMa, które nie bêd± dzia³a³y z t± opcj±, " | ||
423 | #~ "powiniene¶ odpowiedzieæ tutaj 'tak'." | ||
424 | |||
425 | #~ msgid "" | ||
426 | #~ "NB! If you are running a 2.0 series Linux kernel, then privilege " | ||
427 | #~ "separation will not work at all, and your sshd will fail to start unless " | ||
428 | #~ "you explicitly turn privilege separation off." | ||
429 | #~ msgstr "" | ||
430 | #~ "UWAGA! Je¿eli u¿ywasz j±dra Linux'a z serii 2.0, to separacja uprawnieñ w " | ||
431 | #~ "ogóle nie bêdzie dzia³aæ i sshd nie wystartuje dopóki w³asnorêcznie nie " | ||
432 | #~ "wy³±czysz separacji uprawnieñ w /etc/ssh/sshd_config." | ||
diff --git a/debian/po/pt.po b/debian/po/pt.po new file mode 100644 index 000000000..7fe576feb --- /dev/null +++ b/debian/po/pt.po | |||
@@ -0,0 +1,195 @@ | |||
1 | # Portuguese translation of openssh debconf messages. | ||
2 | # This file is distributed under the same license as the openssh package. | ||
3 | # Ricardo Silva <ardoric@gmail.com>, 2007. | ||
4 | # | ||
5 | msgid "" | ||
6 | msgstr "" | ||
7 | "Project-Id-Version: openssh 4.7p1-9\n" | ||
8 | "Report-Msgid-Bugs-To: openssh@packages.debian.org\n" | ||
9 | "POT-Creation-Date: 2010-01-02 08:55+0000\n" | ||
10 | "PO-Revision-Date: 2008-05-18 14:48+0100\n" | ||
11 | "Last-Translator: Ricardo Silva <ardoric@gmail.com>\n" | ||
12 | "Language-Team: Native Portuguese <traduz@debianpt.org>\n" | ||
13 | "MIME-Version: 1.0\n" | ||
14 | "Content-Type: text/plain; charset=UTF-8\n" | ||
15 | "Content-Transfer-Encoding: 8bit\n" | ||
16 | |||
17 | #. Type: boolean | ||
18 | #. Description | ||
19 | #: ../openssh-server.templates:1001 | ||
20 | msgid "Do you want to risk killing active SSH sessions?" | ||
21 | msgstr "Quer arriscar matar sessões activas de SSH?" | ||
22 | |||
23 | #. Type: boolean | ||
24 | #. Description | ||
25 | #: ../openssh-server.templates:1001 | ||
26 | msgid "" | ||
27 | "The currently installed version of /etc/init.d/ssh is likely to kill all " | ||
28 | "running sshd instances. If you are doing this upgrade via an SSH session, " | ||
29 | "you're likely to be disconnected and leave the upgrade procedure unfinished." | ||
30 | msgstr "" | ||
31 | "A versão do /etc/init.d/ssh que tem instalado provavelmente terminará todas " | ||
32 | "as instâncias de sshd. Se vai actualizar através de uma sessão ssh, é " | ||
33 | "possÃvel que a sua sessão seja terminada e que deixe o procedimento de " | ||
34 | "actualização por terminar." | ||
35 | |||
36 | #. Type: boolean | ||
37 | #. Description | ||
38 | #: ../openssh-server.templates:1001 | ||
39 | msgid "" | ||
40 | "This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the " | ||
41 | "start-stop-daemon line in the stop section of the file." | ||
42 | msgstr "" | ||
43 | "Isto pode ser arranjado adicionando \"--pidfile /var/run/sshd.pid\" Ã linha " | ||
44 | "start-stop-daemon na secção stop do ficheiro." | ||
45 | |||
46 | #. Type: note | ||
47 | #. Description | ||
48 | #: ../openssh-server.templates:2001 | ||
49 | msgid "New host key mandatory" | ||
50 | msgstr "Uma nova chave de anfitrião é obrigatória" | ||
51 | |||
52 | #. Type: note | ||
53 | #. Description | ||
54 | #: ../openssh-server.templates:2001 | ||
55 | msgid "" | ||
56 | "The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA " | ||
57 | "algorithm. OpenSSH can not handle this host key file, and the ssh-keygen " | ||
58 | "utility from the old (non-free) SSH installation does not appear to be " | ||
59 | "available." | ||
60 | msgstr "" | ||
61 | "A chave actual, em /etc/ssh/ssh_host_key, está cifrada com o algoritmo IDEA. " | ||
62 | "O OpenSSH não consegue usar este ficheiro, e o utilitário ssh-keygen da " | ||
63 | "antiga (e não livre) instalação do SSH não parece estar disponÃvel." | ||
64 | |||
65 | #. Type: note | ||
66 | #. Description | ||
67 | #: ../openssh-server.templates:2001 | ||
68 | msgid "You need to manually generate a new host key." | ||
69 | msgstr "Terá de gerar manualmente uma nova chave para o host." | ||
70 | |||
71 | #. Type: boolean | ||
72 | #. Description | ||
73 | #: ../openssh-server.templates:3001 | ||
74 | msgid "Disable challenge-response authentication?" | ||
75 | msgstr "Desactivar autenticação por desafio-resposta?" | ||
76 | |||
77 | #. Type: boolean | ||
78 | #. Description | ||
79 | #: ../openssh-server.templates:3001 | ||
80 | msgid "" | ||
81 | "Password authentication appears to be disabled in the current OpenSSH server " | ||
82 | "configuration. In order to prevent users from logging in using passwords " | ||
83 | "(perhaps using only public key authentication instead) with recent versions " | ||
84 | "of OpenSSH, you must disable challenge-response authentication, or else " | ||
85 | "ensure that your PAM configuration does not allow Unix password file " | ||
86 | "authentication." | ||
87 | msgstr "" | ||
88 | "Autenticação por palavra-chave aparenta estar desactivada na sua " | ||
89 | "configuração actual do servidor OpenSSH. De forma a impedir que os " | ||
90 | "utilizadores se liguem usando palavras-chave (talvez usando apenas " | ||
91 | "autenticação por chave pública) com versões recentes do OpenSSH, tem de " | ||
92 | "desactivar a autenticação por desafio-resposta, ou assegurar-se que a sua " | ||
93 | "configuração do PAM não permite autenticação pelo ficheiro password de Unix." | ||
94 | |||
95 | #. Type: boolean | ||
96 | #. Description | ||
97 | #: ../openssh-server.templates:3001 | ||
98 | msgid "" | ||
99 | "If you disable challenge-response authentication, then users will not be " | ||
100 | "able to log in using passwords. If you leave it enabled (the default " | ||
101 | "answer), then the 'PasswordAuthentication no' option will have no useful " | ||
102 | "effect unless you also adjust your PAM configuration in /etc/pam.d/ssh." | ||
103 | msgstr "" | ||
104 | "Se desactivar autenticação por pedido-resposta, os utilizadores não serão " | ||
105 | "capazes de se ligar usando palavras-chave. Se deixar activado (a resposta " | ||
106 | "por omissão), então a opção 'PasswordAuthentication no' não terá efeito a " | ||
107 | "não ser que também ajuste a configuração do PAM em /etc/pam.d/ssh." | ||
108 | |||
109 | #. Type: note | ||
110 | #. Description | ||
111 | #: ../openssh-server.templates:4001 | ||
112 | msgid "Vulnerable host keys will be regenerated" | ||
113 | msgstr "Chaves do anfitrião vulneráveis serão regeneradas" | ||
114 | |||
115 | #. Type: note | ||
116 | #. Description | ||
117 | #: ../openssh-server.templates:4001 | ||
118 | msgid "" | ||
119 | "Some of the OpenSSH server host keys on this system were generated with a " | ||
120 | "version of OpenSSL that had a broken random number generator. As a result, " | ||
121 | "these host keys are from a well-known set, are subject to brute-force " | ||
122 | "attacks, and must be regenerated." | ||
123 | msgstr "" | ||
124 | "Algumas das chaves do servidor OpenSSH neste sistema foram criadas com uma " | ||
125 | "versão do OpenSSL que tem um gerador de números aleatórios com problemas. " | ||
126 | "Como resultado estas chaves, que fazem parte de um conjunto bem conhecido, " | ||
127 | "estão sujeitas a ataques por força bruta, e têm de ser geradas de novo." | ||
128 | |||
129 | #. Type: note | ||
130 | #. Description | ||
131 | #: ../openssh-server.templates:4001 | ||
132 | msgid "" | ||
133 | "Users of this system should be informed of this change, as they will be " | ||
134 | "prompted about the host key change the next time they log in. Use 'ssh-" | ||
135 | "keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of " | ||
136 | "the new host keys." | ||
137 | msgstr "" | ||
138 | "Os utilizadores deste sistema devem ser informados desta mudança, uma vez " | ||
139 | "que vão ser avisados da mudança de chave da próxima vez que se ligarem. " | ||
140 | "Utilize o comando 'ssh-keygen -l -f FICHEIRO_DA_CHAVE' depois da " | ||
141 | "actualização para imprimir as impressões das novas chaves." | ||
142 | |||
143 | #. Type: note | ||
144 | #. Description | ||
145 | #: ../openssh-server.templates:4001 | ||
146 | msgid "The affected host keys are:" | ||
147 | msgstr "As chaves afectadas são:" | ||
148 | |||
149 | #. Type: note | ||
150 | #. Description | ||
151 | #: ../openssh-server.templates:4001 | ||
152 | msgid "" | ||
153 | "User keys may also be affected by this problem. The 'ssh-vulnkey' command " | ||
154 | "may be used as a partial test for this. See /usr/share/doc/openssh-server/" | ||
155 | "README.compromised-keys.gz for more details." | ||
156 | msgstr "" | ||
157 | "As chaves de utilizador também podem ser afectadas por este problema. O " | ||
158 | "comando 'ssh-vulnkey' pode ser usado como um teste parcial para este caso. " | ||
159 | "Veja o ficheiro /usr/share/doc/openssh-server/README.compromised-keys.gz " | ||
160 | "para mais detalhes." | ||
161 | |||
162 | #~ msgid "Generate a new configuration file for OpenSSH?" | ||
163 | #~ msgstr "Gerar um ficheiro de configuração novo para o OpenSSH?" | ||
164 | |||
165 | #~ msgid "" | ||
166 | #~ "This version of OpenSSH has a considerably changed configuration file " | ||
167 | #~ "from the version shipped in Debian 'Potato', which you appear to be " | ||
168 | #~ "upgrading from. This package can now generate a new configuration file (/" | ||
169 | #~ "etc/ssh/sshd.config), which will work with the new server version, but " | ||
170 | #~ "will not contain any customizations you made with the old version." | ||
171 | #~ msgstr "" | ||
172 | #~ "Esta versão do OpenSSH tem um ficheiro de configuração bastante diferente " | ||
173 | #~ "da versão que vinha com o Debian 'Potato', que parece ser de onde está a " | ||
174 | #~ "actualizar. Este pacote pode agora gerar um novo ficheiro de configuração " | ||
175 | #~ "(/etc/ssh/sshd.config), que irá funcionar com a nova versão do servidor, " | ||
176 | #~ "mas não conterá nenhuma alteração que tenha feito à versão antiga." | ||
177 | |||
178 | #~ msgid "" | ||
179 | #~ "Please note that this new configuration file will set the value of " | ||
180 | #~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password " | ||
181 | #~ "can ssh directly in as root). Please read the README.Debian file for more " | ||
182 | #~ "details about this design choice." | ||
183 | #~ msgstr "" | ||
184 | #~ "Por favor note que este novo ficheiro de configuração terá " | ||
185 | #~ "'PermitRootLogin' definido para 'yes' (o que significa que qualquer " | ||
186 | #~ "pessoa que saiba a palavra-chave de root pode ligar-se directamente como " | ||
187 | #~ "root a partir do ssh). Por favor leia o ficheiro README.Debian para mais " | ||
188 | #~ "detalhes sobre esta escolha." | ||
189 | |||
190 | #~ msgid "" | ||
191 | #~ "It is strongly recommended that you choose to generate a new " | ||
192 | #~ "configuration file now." | ||
193 | #~ msgstr "" | ||
194 | #~ "É fortemente recomendado que escolha gerar um novo ficheiro de " | ||
195 | #~ "configuração agora." | ||
diff --git a/debian/po/pt_BR.po b/debian/po/pt_BR.po new file mode 100644 index 000000000..fe2227190 --- /dev/null +++ b/debian/po/pt_BR.po | |||
@@ -0,0 +1,203 @@ | |||
1 | # openssh Brazilian Portuguese translation | ||
2 | # Copyright (C) 2007, André LuÃs Lopes | ||
3 | # This file is distributed under the same license as the openssh package. | ||
4 | # André LuÃs Lopes <andrelop@debian.org>, 2007. | ||
5 | # Eder L. Marques (frolic) <frolic@debian-ce.org>, 2008. | ||
6 | # | ||
7 | msgid "" | ||
8 | msgstr "" | ||
9 | "Project-Id-Version: openssh 1:4.7p1-9\n" | ||
10 | "Report-Msgid-Bugs-To: openssh@packages.debian.org\n" | ||
11 | "POT-Creation-Date: 2010-01-02 08:55+0000\n" | ||
12 | "PO-Revision-Date: 2008-05-27 10:10-0300\n" | ||
13 | "Last-Translator: Eder L. Marques (frolic) <frolic@debian-ce.org>\n" | ||
14 | "Language-Team: Brazilian Portuguese <debian-l10n-portuguese@lists.debian." | ||
15 | "org>\n" | ||
16 | "MIME-Version: 1.0\n" | ||
17 | "Content-Type: text/plain; charset=UTF-8\n" | ||
18 | "Content-Transfer-Encoding: 8bit\n" | ||
19 | "pt_BR utf-8\n" | ||
20 | |||
21 | #. Type: boolean | ||
22 | #. Description | ||
23 | #: ../openssh-server.templates:1001 | ||
24 | msgid "Do you want to risk killing active SSH sessions?" | ||
25 | msgstr "Você deseja arriscar matar (\"kill\") as sessões SSH ativas?" | ||
26 | |||
27 | #. Type: boolean | ||
28 | #. Description | ||
29 | #: ../openssh-server.templates:1001 | ||
30 | msgid "" | ||
31 | "The currently installed version of /etc/init.d/ssh is likely to kill all " | ||
32 | "running sshd instances. If you are doing this upgrade via an SSH session, " | ||
33 | "you're likely to be disconnected and leave the upgrade procedure unfinished." | ||
34 | msgstr "" | ||
35 | "A versão instalada atualmente de /etc/init.d/ssh está prestes a derrubar " | ||
36 | "todas as instâncias sshd em execução. Se você estiver fazendo esta " | ||
37 | "atualização através de uma sessão SSH, você provavelmente será desconectado " | ||
38 | "e deixará este processo de atualização incompleto." | ||
39 | |||
40 | #. Type: boolean | ||
41 | #. Description | ||
42 | #: ../openssh-server.templates:1001 | ||
43 | msgid "" | ||
44 | "This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the " | ||
45 | "start-stop-daemon line in the stop section of the file." | ||
46 | msgstr "" | ||
47 | "Você pode corrigir isto adicionando \"--pidfile /var/run/sshd.pid\" na linha " | ||
48 | "start-stop-daemon na seção stop deste arquivo." | ||
49 | |||
50 | #. Type: note | ||
51 | #. Description | ||
52 | #: ../openssh-server.templates:2001 | ||
53 | msgid "New host key mandatory" | ||
54 | msgstr "Nova chave de máquina obrigatória" | ||
55 | |||
56 | #. Type: note | ||
57 | #. Description | ||
58 | #: ../openssh-server.templates:2001 | ||
59 | msgid "" | ||
60 | "The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA " | ||
61 | "algorithm. OpenSSH can not handle this host key file, and the ssh-keygen " | ||
62 | "utility from the old (non-free) SSH installation does not appear to be " | ||
63 | "available." | ||
64 | msgstr "" | ||
65 | "A chave de máquina atual, em /etc/ssh/ssh_host_key, é criptografada " | ||
66 | "utilizando o algoritmo IDEA. O OpenSSH não pode gerenciar esse arquivo de " | ||
67 | "chave de máquina, e o utilitário ssh-keygen da antiga (e não livre) " | ||
68 | "instalação SSH não parece estar disponÃvel." | ||
69 | |||
70 | #. Type: note | ||
71 | #. Description | ||
72 | #: ../openssh-server.templates:2001 | ||
73 | msgid "You need to manually generate a new host key." | ||
74 | msgstr "Você precisa gerar manualmente uma chave de máquina." | ||
75 | |||
76 | #. Type: boolean | ||
77 | #. Description | ||
78 | #: ../openssh-server.templates:3001 | ||
79 | msgid "Disable challenge-response authentication?" | ||
80 | msgstr "Desabilitar autenticação desafio-resposta (\"challenge-response\")?" | ||
81 | |||
82 | #. Type: boolean | ||
83 | #. Description | ||
84 | #: ../openssh-server.templates:3001 | ||
85 | msgid "" | ||
86 | "Password authentication appears to be disabled in the current OpenSSH server " | ||
87 | "configuration. In order to prevent users from logging in using passwords " | ||
88 | "(perhaps using only public key authentication instead) with recent versions " | ||
89 | "of OpenSSH, you must disable challenge-response authentication, or else " | ||
90 | "ensure that your PAM configuration does not allow Unix password file " | ||
91 | "authentication." | ||
92 | msgstr "" | ||
93 | "A autenticação através de senha parece estar desabilitada em sua " | ||
94 | "configuração atual do servidor OpenSSH. Para que seja possÃvel evitar que " | ||
95 | "usuários se autentiquem utilizando senhas (talvez utilizando somente " | ||
96 | "autenticação através de chaves públicas) em versões recentes do OpenSSH você " | ||
97 | "deve desabilitar a autenticação desafio-resposta (\"challenge-response\") ou " | ||
98 | "então se certificar que sua configuração PAM não permita autenticação " | ||
99 | "através do arquivos de senhas Unix (\"password\")." | ||
100 | |||
101 | #. Type: boolean | ||
102 | #. Description | ||
103 | #: ../openssh-server.templates:3001 | ||
104 | msgid "" | ||
105 | "If you disable challenge-response authentication, then users will not be " | ||
106 | "able to log in using passwords. If you leave it enabled (the default " | ||
107 | "answer), then the 'PasswordAuthentication no' option will have no useful " | ||
108 | "effect unless you also adjust your PAM configuration in /etc/pam.d/ssh." | ||
109 | msgstr "" | ||
110 | "Caso você desabilite a autenticação desafio-resposta (\"challenge-response" | ||
111 | "\"), os usuários não poderão se autenticar utilizando suas senhas. Se você " | ||
112 | "deixá-la habilitada (a resposta padrão), então a opção " | ||
113 | "'PasswordAuthentication no' não terá efeito útil a menos que você também " | ||
114 | "ajuste sua configuração PAM em /etc/pam.d/ssh." | ||
115 | |||
116 | #. Type: note | ||
117 | #. Description | ||
118 | #: ../openssh-server.templates:4001 | ||
119 | msgid "Vulnerable host keys will be regenerated" | ||
120 | msgstr "Chaves de host vulneráveis serão regeradas" | ||
121 | |||
122 | #. Type: note | ||
123 | #. Description | ||
124 | #: ../openssh-server.templates:4001 | ||
125 | msgid "" | ||
126 | "Some of the OpenSSH server host keys on this system were generated with a " | ||
127 | "version of OpenSSL that had a broken random number generator. As a result, " | ||
128 | "these host keys are from a well-known set, are subject to brute-force " | ||
129 | "attacks, and must be regenerated." | ||
130 | msgstr "" | ||
131 | "Algumas das chaves de host do servidor OpenSSH neste sistema foram geradas " | ||
132 | "com uma versão do OpenSSL que tem um gerador de números aleatórios quebrado. " | ||
133 | "Como resultado, estas chaves de host são originárias de um conjunto bem " | ||
134 | "conhecido, ficando sujeitas a ataques de força bruta, e devem ser regeradas." | ||
135 | |||
136 | #. Type: note | ||
137 | #. Description | ||
138 | #: ../openssh-server.templates:4001 | ||
139 | msgid "" | ||
140 | "Users of this system should be informed of this change, as they will be " | ||
141 | "prompted about the host key change the next time they log in. Use 'ssh-" | ||
142 | "keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of " | ||
143 | "the new host keys." | ||
144 | msgstr "" | ||
145 | "Usuários deste sistema deverão ser informados desta mudança, pois eles serão " | ||
146 | "alertados sobre a mudança de chave de host na próxima vez que logarem. Use " | ||
147 | "'ssh-keygen -l -f ARQUIVO_COM_A_CHAVE_DE_HOST' após a atualização para " | ||
148 | "exibir as impressões digitais (\"fingerprints\") das novas chaves de host." | ||
149 | |||
150 | #. Type: note | ||
151 | #. Description | ||
152 | #: ../openssh-server.templates:4001 | ||
153 | msgid "The affected host keys are:" | ||
154 | msgstr "As chaves de host afetadas são:" | ||
155 | |||
156 | #. Type: note | ||
157 | #. Description | ||
158 | #: ../openssh-server.templates:4001 | ||
159 | msgid "" | ||
160 | "User keys may also be affected by this problem. The 'ssh-vulnkey' command " | ||
161 | "may be used as a partial test for this. See /usr/share/doc/openssh-server/" | ||
162 | "README.compromised-keys.gz for more details." | ||
163 | msgstr "" | ||
164 | "Chaves de usuários também podem ser afetadas por este problema. O comando " | ||
165 | "'ssh-vulnkey' pode ser usado como um teste parcial para isso. Veja /usr/" | ||
166 | "share/doc/openssh-server/README.compromised-keys.gz para mais detalhes." | ||
167 | |||
168 | #~ msgid "Generate a new configuration file for OpenSSH?" | ||
169 | #~ msgstr "Gerar um novo arquivo de configuração para o OpenSSH?" | ||
170 | |||
171 | #~ msgid "" | ||
172 | #~ "This version of OpenSSH has a considerably changed configuration file " | ||
173 | #~ "from the version shipped in Debian 'Potato', which you appear to be " | ||
174 | #~ "upgrading from. This package can now generate a new configuration file (/" | ||
175 | #~ "etc/ssh/sshd.config), which will work with the new server version, but " | ||
176 | #~ "will not contain any customizations you made with the old version." | ||
177 | #~ msgstr "" | ||
178 | #~ "Esta versão do OpenSSH possui um arquivo de configuração " | ||
179 | #~ "consideravelmente diferente da versão fornecida com o Debian 'Potato', a " | ||
180 | #~ "versão do Debian a partir da qual você parece estar atualizando. Este " | ||
181 | #~ "pacote pode agora gerar um novo arquivo de configuração (/etc/ssh/" | ||
182 | #~ "sshd_config), o qual irá funcionar com a nova versão do servidor sshd mas " | ||
183 | #~ "não irá conter nenhuma personalização que você possa ter feito na versão " | ||
184 | #~ "anterior." | ||
185 | |||
186 | #~ msgid "" | ||
187 | #~ "Please note that this new configuration file will set the value of " | ||
188 | #~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password " | ||
189 | #~ "can ssh directly in as root). Please read the README.Debian file for more " | ||
190 | #~ "details about this design choice." | ||
191 | #~ msgstr "" | ||
192 | #~ "Por favor, note que este novo arquivo de configuração irá definir o valor " | ||
193 | #~ "da opção 'PermitRootLogin' para 'yes' (o que significa que qualquer " | ||
194 | #~ "pessoa que conheça a senha do root poderá conectar via ssh diretamente " | ||
195 | #~ "como root). Por favor, leia os arquivos README.Debian para maiores " | ||
196 | #~ "detalhes sobre essa escolha de projeto." | ||
197 | |||
198 | #~ msgid "" | ||
199 | #~ "It is strongly recommended that you choose to generate a new " | ||
200 | #~ "configuration file now." | ||
201 | #~ msgstr "" | ||
202 | #~ "É fortemente recomendado que você escolha gerar um novo arquivo de " | ||
203 | #~ "configuração agora." | ||
diff --git a/debian/po/ro.po b/debian/po/ro.po new file mode 100644 index 000000000..87480db23 --- /dev/null +++ b/debian/po/ro.po | |||
@@ -0,0 +1,224 @@ | |||
1 | # Romanian translation of openssh. | ||
2 | # Copyright (C) 2006 THE openssh'S COPYRIGHT HOLDER | ||
3 | # This file is distributed under the same license as the openssh package. | ||
4 | # | ||
5 | # Stan Ioan-Eugen <stan.ieugen@gmail.com>, 2006. | ||
6 | # Igor Stirbu <igor.stirbu@gmail.com>, 2007. | ||
7 | # Cătălin Feștilă <catalinfest@gmail.com>,2008 | ||
8 | msgid "" | ||
9 | msgstr "" | ||
10 | "Project-Id-Version: openssh 1.4\n" | ||
11 | "Report-Msgid-Bugs-To: openssh@packages.debian.org\n" | ||
12 | "POT-Creation-Date: 2010-01-02 08:55+0000\n" | ||
13 | "PO-Revision-Date: 2008-05-28 17:54+0200\n" | ||
14 | "Last-Translator: Cătălin Feștilă <catalinfest@gmail.com>\n" | ||
15 | "Language-Team: Romanian <debian-l10n-romanian@lists.debian.org>\n" | ||
16 | "MIME-Version: 1.0\n" | ||
17 | "Content-Type: text/plain; charset=UTF-8\n" | ||
18 | "Content-Transfer-Encoding: 8bit\n" | ||
19 | "X-Generator: KBabel 1.11.4\n" | ||
20 | "Plural-Forms: nplurals=3; plural=n==1 ? 0 : (n==0 || (n%100 > 0 && n%100 < " | ||
21 | "20)) ? 1 : 2;\n" | ||
22 | |||
23 | #. Type: boolean | ||
24 | #. Description | ||
25 | #: ../openssh-server.templates:1001 | ||
26 | msgid "Do you want to risk killing active SSH sessions?" | ||
27 | msgstr "Doriți să riscați întreruperea sesiunilor ssh active?" | ||
28 | |||
29 | #. Type: boolean | ||
30 | #. Description | ||
31 | #: ../openssh-server.templates:1001 | ||
32 | msgid "" | ||
33 | "The currently installed version of /etc/init.d/ssh is likely to kill all " | ||
34 | "running sshd instances. If you are doing this upgrade via an SSH session, " | ||
35 | "you're likely to be disconnected and leave the upgrade procedure unfinished." | ||
36 | msgstr "" | ||
37 | "Este foarte probabil ca această versiune de /etc/init.d/ssh pe care o aveți " | ||
38 | "instalată să omoare toate instanțele sshd care rulează. Dacă faceți această " | ||
39 | "actualizare printr-o sesiune ssh, atunci este posibil să fiți deconectați și " | ||
40 | "actualizarea să rămână neterminată." | ||
41 | |||
42 | #. Type: boolean | ||
43 | #. Description | ||
44 | #: ../openssh-server.templates:1001 | ||
45 | msgid "" | ||
46 | "This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the " | ||
47 | "start-stop-daemon line in the stop section of the file." | ||
48 | msgstr "" | ||
49 | "Puteți repară manual acest lucru adăugând „--pidfile /var/run/sshd.pid†la " | ||
50 | "linia start-stop-daemon în secțiunea stop a fișierului." | ||
51 | |||
52 | #. Type: note | ||
53 | #. Description | ||
54 | #: ../openssh-server.templates:2001 | ||
55 | msgid "New host key mandatory" | ||
56 | msgstr "O cheie nouă este obligatorie" | ||
57 | |||
58 | #. Type: note | ||
59 | #. Description | ||
60 | #: ../openssh-server.templates:2001 | ||
61 | msgid "" | ||
62 | "The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA " | ||
63 | "algorithm. OpenSSH can not handle this host key file, and the ssh-keygen " | ||
64 | "utility from the old (non-free) SSH installation does not appear to be " | ||
65 | "available." | ||
66 | msgstr "" | ||
67 | "Cheia curentă în /etc/ssh/ssh_host_key este criptată cu algoritmul IDEA. " | ||
68 | "OpenSSH nu suportă acest tip de cheie, iar utilitarul ssh-keygen din " | ||
69 | "versiunea SSH (non-liberă) anterior instalată nu pare să fie disponibil." | ||
70 | |||
71 | #. Type: note | ||
72 | #. Description | ||
73 | #: ../openssh-server.templates:2001 | ||
74 | msgid "You need to manually generate a new host key." | ||
75 | msgstr "Va trebui să generați manual o nouă cheie pentru sistem." | ||
76 | |||
77 | #. Type: boolean | ||
78 | #. Description | ||
79 | #: ../openssh-server.templates:3001 | ||
80 | msgid "Disable challenge-response authentication?" | ||
81 | msgstr "Dezactivează modul de autentificare provocare-răspuns?" | ||
82 | |||
83 | #. Type: boolean | ||
84 | #. Description | ||
85 | #: ../openssh-server.templates:3001 | ||
86 | msgid "" | ||
87 | "Password authentication appears to be disabled in the current OpenSSH server " | ||
88 | "configuration. In order to prevent users from logging in using passwords " | ||
89 | "(perhaps using only public key authentication instead) with recent versions " | ||
90 | "of OpenSSH, you must disable challenge-response authentication, or else " | ||
91 | "ensure that your PAM configuration does not allow Unix password file " | ||
92 | "authentication." | ||
93 | msgstr "" | ||
94 | "Autentificarea pe bază de parole pare dezactivată în configurația curentă a " | ||
95 | "serverului OpenSSH. Pentru a împiedica utilizatorii să se autentifice " | ||
96 | "folosind parole (probabil folosind doar autentificarea cu chei publice) în " | ||
97 | "versiunile recente OpenSSH trebuie să dezactivați autentificarea tip " | ||
98 | "provocare-răspuns, sau asigurați-vă că configurația PAM nu permite " | ||
99 | "autentificarea cu fișierul de parole Unix." | ||
100 | |||
101 | #. Type: boolean | ||
102 | #. Description | ||
103 | #: ../openssh-server.templates:3001 | ||
104 | msgid "" | ||
105 | "If you disable challenge-response authentication, then users will not be " | ||
106 | "able to log in using passwords. If you leave it enabled (the default " | ||
107 | "answer), then the 'PasswordAuthentication no' option will have no useful " | ||
108 | "effect unless you also adjust your PAM configuration in /etc/pam.d/ssh." | ||
109 | msgstr "" | ||
110 | "Dacă dezactivați autentificarea pe bază de provocare-răspuns, utilizatorii " | ||
111 | "nu vor mai putea să se autentifice folosind parolele. Dacă nu o dezactivați " | ||
112 | "(răspunsul implicit), atunci opțiunea 'PasswordAuthentification no' va fi " | ||
113 | "utilizabilă doar dacă modificați și configurația PAM din /etc/pam.d/ssh." | ||
114 | |||
115 | #. Type: note | ||
116 | #. Description | ||
117 | #: ../openssh-server.templates:4001 | ||
118 | msgid "Vulnerable host keys will be regenerated" | ||
119 | msgstr "Cheile vulnerabile vor fi regenerate" | ||
120 | |||
121 | #. Type: note | ||
122 | #. Description | ||
123 | #: ../openssh-server.templates:4001 | ||
124 | msgid "" | ||
125 | "Some of the OpenSSH server host keys on this system were generated with a " | ||
126 | "version of OpenSSL that had a broken random number generator. As a result, " | ||
127 | "these host keys are from a well-known set, are subject to brute-force " | ||
128 | "attacks, and must be regenerated." | ||
129 | msgstr "" | ||
130 | "Unele dintre cheile serverului OpenSSH gazdă de pe acest sistem au fost " | ||
131 | "generate cu o versiune de OpenSSL, care a avut un generator de numere " | ||
132 | "aleatorii stricat. Ca rezultat, aceste chei gazda sunt un set binecunoscut, " | ||
133 | "sunt supuse la atacuri brute-force și trebuie să fie regenerate." | ||
134 | |||
135 | #. Type: note | ||
136 | #. Description | ||
137 | #: ../openssh-server.templates:4001 | ||
138 | msgid "" | ||
139 | "Users of this system should be informed of this change, as they will be " | ||
140 | "prompted about the host key change the next time they log in. Use 'ssh-" | ||
141 | "keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of " | ||
142 | "the new host keys." | ||
143 | msgstr "" | ||
144 | "Utilizatorii acestui sistem ar trebui să fie informați ce se schimbă, " | ||
145 | "deoarece se va solicita cheia gazdă ce se schimba data viitoare când se " | ||
146 | "autentifică. Folosiți 'ssh-keygen -l -f HOST_KEY_FILE' după ce faceți " | ||
147 | "actualizare pentru a imprima amprentele digitale ale noilor chei gazdă." | ||
148 | |||
149 | #. Type: note | ||
150 | #. Description | ||
151 | #: ../openssh-server.templates:4001 | ||
152 | msgid "The affected host keys are:" | ||
153 | msgstr "Cheile gazdă afectate sunt:" | ||
154 | |||
155 | #. Type: note | ||
156 | #. Description | ||
157 | #: ../openssh-server.templates:4001 | ||
158 | msgid "" | ||
159 | "User keys may also be affected by this problem. The 'ssh-vulnkey' command " | ||
160 | "may be used as a partial test for this. See /usr/share/doc/openssh-server/" | ||
161 | "README.compromised-keys.gz for more details." | ||
162 | msgstr "" | ||
163 | "Cheile utilizatorului de asemenea, pot fi afectate de această problemă. " | ||
164 | "Comanda 'ssh-vulnkey' poate fi folosită ca un test parțial pentru acestea. A " | ||
165 | "se vedea /usr/share/doc/openssh-server/README.compromised-keys.gz pentru mai " | ||
166 | "multe detalii." | ||
167 | |||
168 | #~ msgid "Generate a new configuration file for OpenSSH?" | ||
169 | #~ msgstr "Să se genereze un fișier nou de configurare pentru OpenSSH?" | ||
170 | |||
171 | #~ msgid "" | ||
172 | #~ "This version of OpenSSH has a considerably changed configuration file " | ||
173 | #~ "from the version shipped in Debian 'Potato', which you appear to be " | ||
174 | #~ "upgrading from. This package can now generate a new configuration file (/" | ||
175 | #~ "etc/ssh/sshd.config), which will work with the new server version, but " | ||
176 | #~ "will not contain any customizations you made with the old version." | ||
177 | #~ msgstr "" | ||
178 | #~ "Această versiune de OpenSSH are un fișier de configurare considerabil " | ||
179 | #~ "modificat față de versiunea care vine cu Debian 'Potato', pe care se pare " | ||
180 | #~ "că o actualizați. Acest pachet poate genera acum un nou fișier de " | ||
181 | #~ "configurare (/etc/ssh/sshd.config), care va funcționa cu noua versiune de " | ||
182 | #~ "server, dar nu va conține nici o personalizare făcută pentru versiunea " | ||
183 | #~ "anterioară." | ||
184 | |||
185 | #~ msgid "" | ||
186 | #~ "Please note that this new configuration file will set the value of " | ||
187 | #~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password " | ||
188 | #~ "can ssh directly in as root). Please read the README.Debian file for more " | ||
189 | #~ "details about this design choice." | ||
190 | #~ msgstr "" | ||
191 | #~ "A se reține că acest fișier nou de configurare va stabili valoarea " | ||
192 | #~ "opțiunii 'PermitRootLogin' la „yes†(ceea ce înseamnă că cine știe parola " | ||
193 | #~ "de root se poate autentifica prin ssh direct ca root). Părerea " | ||
194 | #~ "responsabilului de pachet este că aceasta trebuie să fie valoarea " | ||
195 | #~ "implicită (a se vedea fișierul README.Debian pentru detalii " | ||
196 | #~ "suplimentare), dar, dacă doriți, puteți edita oricând fișierul " | ||
197 | #~ "sshd_config pentru a stabili valoarea opÈ›iunii la „noâ€." | ||
198 | |||
199 | #~ msgid "" | ||
200 | #~ "It is strongly recommended that you choose to generate a new " | ||
201 | #~ "configuration file now." | ||
202 | #~ msgstr "" | ||
203 | #~ "Este indicat să alegeți acum generarea un nou fișier de configurare." | ||
204 | |||
205 | #~ msgid "Warning: you must create a new host key" | ||
206 | #~ msgstr "Avertizare: trebuie să creați o nouă cheie pentru sistem" | ||
207 | |||
208 | #~ msgid "Warning: telnetd is installed --- probably not a good idea" | ||
209 | #~ msgstr "" | ||
210 | #~ "Avertizare: telnetd este instalat --- probabil că nu este o idee bună" | ||
211 | |||
212 | #~ msgid "" | ||
213 | #~ "I'd advise you to either remove the telnetd package (if you don't " | ||
214 | #~ "actually need to offer telnet access) or install telnetd-ssl so that " | ||
215 | #~ "there is at least some chance that telnet sessions will not be sending " | ||
216 | #~ "unencrypted login/password and session information over the network." | ||
217 | #~ msgstr "" | ||
218 | #~ "Un sfat bun este fie să ștergeți pachetul telnetd (dacă întradevăr nu-l " | ||
219 | #~ "utilizați) fie să instalați telnetd-ssl astfel încât să existe " | ||
220 | #~ "posibilitatea ca sesiunile telnet să nu trimită informații necriptate de " | ||
221 | #~ "autentificare/parole prin rețea." | ||
222 | |||
223 | #~ msgid "${HOST_KEYS}" | ||
224 | #~ msgstr "${HOST_KEYS}" | ||
diff --git a/debian/po/ru.po b/debian/po/ru.po new file mode 100644 index 000000000..23b8c0348 --- /dev/null +++ b/debian/po/ru.po | |||
@@ -0,0 +1,209 @@ | |||
1 | # translation of ru.po to Russian | ||
2 | # translation of openssh to Russian | ||
3 | # | ||
4 | # Translators, if you are not familiar with the PO format, gettext | ||
5 | # documentation is worth reading, especially sections dedicated to | ||
6 | # this format, e.g. by running: | ||
7 | # info -n '(gettext)PO Files' | ||
8 | # info -n '(gettext)Header Entry' | ||
9 | # Some information specific to po-debconf are available at | ||
10 | # /usr/share/doc/po-debconf/README-trans | ||
11 | # or http://www.debian.org/intl/l10n/po-debconf/README-trans# | ||
12 | # Developers do not need to manually edit POT or PO files. | ||
13 | # | ||
14 | # Yuriy Talakan' <yt@drsk.ru>, 2007. | ||
15 | # Yuri Kozlov <kozlov.y@gmail.com>, 2008. | ||
16 | msgid "" | ||
17 | msgstr "" | ||
18 | "Project-Id-Version: openssh 1:4.7p1-9\n" | ||
19 | "Report-Msgid-Bugs-To: openssh@packages.debian.org\n" | ||
20 | "POT-Creation-Date: 2010-01-02 08:55+0000\n" | ||
21 | "PO-Revision-Date: 2008-05-18 08:55+0400\n" | ||
22 | "Last-Translator: Yuri Kozlov <kozlov.y@gmail.com>\n" | ||
23 | "Language-Team: Russian <debian-l10n-russian@lists.debian.org>\n" | ||
24 | "MIME-Version: 1.0\n" | ||
25 | "Content-Type: text/plain; charset=UTF-8\n" | ||
26 | "Content-Transfer-Encoding: 8bit\n" | ||
27 | "X-Generator: KBabel 1.11.4\n" | ||
28 | "Plural-Forms: nplurals=3; plural=(n%10==1 && n%100!=11 ? 0 : n%10>=2 && n%" | ||
29 | "10<=4 && (n%100<10 || n%100>=20) ? 1 : 2);\n" | ||
30 | |||
31 | #. Type: boolean | ||
32 | #. Description | ||
33 | #: ../openssh-server.templates:1001 | ||
34 | msgid "Do you want to risk killing active SSH sessions?" | ||
35 | msgstr "Ð’Ñ‹ хотите пойти на риÑк потерÑÑ‚ÑŒ активные SSH ÑоединениÑ?" | ||
36 | |||
37 | #. Type: boolean | ||
38 | #. Description | ||
39 | #: ../openssh-server.templates:1001 | ||
40 | msgid "" | ||
41 | "The currently installed version of /etc/init.d/ssh is likely to kill all " | ||
42 | "running sshd instances. If you are doing this upgrade via an SSH session, " | ||
43 | "you're likely to be disconnected and leave the upgrade procedure unfinished." | ||
44 | msgstr "" | ||
45 | "УÑÑ‚Ð°Ð½Ð¾Ð²Ð»ÐµÐ½Ð½Ð°Ñ Ð² наÑтоÑщее Ð²Ñ€ÐµÐ¼Ñ Ð²ÐµÑ€ÑÐ¸Ñ /etc/init.d/ssh, вероÑтно, уничтожит " | ||
46 | "вÑе запущенные ÑкземплÑры sshd. ЕÑли вы выполнÑете Ñто обновление через SSH " | ||
47 | "Ñоединение, то Ñкорее вÑего вы будете отключены и процедура Ð¾Ð±Ð½Ð¾Ð²Ð»ÐµÐ½Ð¸Ñ " | ||
48 | "оÑтанетÑÑ Ð½Ðµ завершенной." | ||
49 | |||
50 | #. Type: boolean | ||
51 | #. Description | ||
52 | #: ../openssh-server.templates:1001 | ||
53 | msgid "" | ||
54 | "This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the " | ||
55 | "start-stop-daemon line in the stop section of the file." | ||
56 | msgstr "" | ||
57 | "Ðто может быть иÑправлено вручную добавлением \"--pidfile /var/run/sshd.pid" | ||
58 | "\" в Ñтроку start-stop-daemon в разделе stop Ñтого файла." | ||
59 | |||
60 | #. Type: note | ||
61 | #. Description | ||
62 | #: ../openssh-server.templates:2001 | ||
63 | msgid "New host key mandatory" | ||
64 | msgstr "Ðеобходим новый ключ хоÑта" | ||
65 | |||
66 | #. Type: note | ||
67 | #. Description | ||
68 | #: ../openssh-server.templates:2001 | ||
69 | msgid "" | ||
70 | "The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA " | ||
71 | "algorithm. OpenSSH can not handle this host key file, and the ssh-keygen " | ||
72 | "utility from the old (non-free) SSH installation does not appear to be " | ||
73 | "available." | ||
74 | msgstr "" | ||
75 | "Текущий ключ хоÑта, /etc/ssh/ssh_host_key, зашифрован алгоритмом IDEA. " | ||
76 | "OpenSSH не может работать Ñ Ñ‚Ð°ÐºÐ¸Ð¼ файлом ключа хоÑта, а утилита ÑÐ¾Ð·Ð´Ð°Ð½Ð¸Ñ ssh-" | ||
77 | "ключа (ssh-keygen) из прежней (не Ñвободной) уÑтановки SSH, кажетÑÑ, " | ||
78 | "недоÑтупна." | ||
79 | |||
80 | #. Type: note | ||
81 | #. Description | ||
82 | #: ../openssh-server.templates:2001 | ||
83 | msgid "You need to manually generate a new host key." | ||
84 | msgstr "Вам нужно вручную Ñоздать новый ключ хоÑта." | ||
85 | |||
86 | #. Type: boolean | ||
87 | #. Description | ||
88 | #: ../openssh-server.templates:3001 | ||
89 | msgid "Disable challenge-response authentication?" | ||
90 | msgstr "Отключить аутентификацию запроÑ-ответ?" | ||
91 | |||
92 | #. Type: boolean | ||
93 | #. Description | ||
94 | #: ../openssh-server.templates:3001 | ||
95 | msgid "" | ||
96 | "Password authentication appears to be disabled in the current OpenSSH server " | ||
97 | "configuration. In order to prevent users from logging in using passwords " | ||
98 | "(perhaps using only public key authentication instead) with recent versions " | ||
99 | "of OpenSSH, you must disable challenge-response authentication, or else " | ||
100 | "ensure that your PAM configuration does not allow Unix password file " | ||
101 | "authentication." | ||
102 | msgstr "" | ||
103 | "КажетÑÑ, что Ð¿Ð°Ñ€Ð¾Ð»ÑŒÐ½Ð°Ñ Ð°ÑƒÑ‚ÐµÐ½Ñ‚Ð¸Ñ„Ð¸ÐºÐ°Ñ†Ð¸Ñ Ð¾Ñ‚ÐºÐ»ÑŽÑ‡ÐµÐ½Ð° в текущей наÑтройке Ñервера " | ||
104 | "OpenSSH. Чтобы запретить пользователÑм вход Ñ Ð¸Ñпользованием паролей " | ||
105 | "(возможно, иÑпользовав вмеÑто Ñтого только аутентификацию по публичному " | ||
106 | "ключу) в новых верÑиÑÑ… OpenSSH, вы должны отключить аутентификацию запроÑ-" | ||
107 | "ответ, либо убедитьÑÑ, что ваша наÑтройка PAM не разрешает аутентификацию по " | ||
108 | "файлу паролей Unix." | ||
109 | |||
110 | #. Type: boolean | ||
111 | #. Description | ||
112 | #: ../openssh-server.templates:3001 | ||
113 | msgid "" | ||
114 | "If you disable challenge-response authentication, then users will not be " | ||
115 | "able to log in using passwords. If you leave it enabled (the default " | ||
116 | "answer), then the 'PasswordAuthentication no' option will have no useful " | ||
117 | "effect unless you also adjust your PAM configuration in /etc/pam.d/ssh." | ||
118 | msgstr "" | ||
119 | "ЕÑли вы запретите аутентификацию запроÑ-ответ, пользователи не Ñмогут войти " | ||
120 | "Ñ Ð¸Ñпользованием паролей. ЕÑли вы оÑтавите её разрешенной (ответ по " | ||
121 | "умолчанию), то параметр 'PasswordAuthentication no' не будет иметь Ñилы до " | ||
122 | "тех пор, пока вы также не откорректируете наÑтройки PAM в /etc/pam.d/ssh." | ||
123 | |||
124 | #. Type: note | ||
125 | #. Description | ||
126 | #: ../openssh-server.templates:4001 | ||
127 | msgid "Vulnerable host keys will be regenerated" | ||
128 | msgstr "УÑзвимые ключи хоÑта будут Ñозданы заново" | ||
129 | |||
130 | #. Type: note | ||
131 | #. Description | ||
132 | #: ../openssh-server.templates:4001 | ||
133 | msgid "" | ||
134 | "Some of the OpenSSH server host keys on this system were generated with a " | ||
135 | "version of OpenSSL that had a broken random number generator. As a result, " | ||
136 | "these host keys are from a well-known set, are subject to brute-force " | ||
137 | "attacks, and must be regenerated." | ||
138 | msgstr "" | ||
139 | "Ðекоторые ключи хоÑта Ñервера OpenSSH в Ñтой ÑиÑтеме были Ñозданы Ñ Ð¿Ð¾Ð¼Ð¾Ñ‰ÑŒÑŽ " | ||
140 | "верÑии OpenSSL, в которой был иÑпорченный генератор Ñлучайных чиÑел. Ð’ " | ||
141 | "результате, такие ключи хоÑта входили во вÑем извеÑтный ÑпиÑок, что " | ||
142 | "позволÑло применÑÑ‚ÑŒ атаку поÑледовательного подбора ключей. Ключи должны " | ||
143 | "быть Ñозданы заново." | ||
144 | |||
145 | #. Type: note | ||
146 | #. Description | ||
147 | #: ../openssh-server.templates:4001 | ||
148 | msgid "" | ||
149 | "Users of this system should be informed of this change, as they will be " | ||
150 | "prompted about the host key change the next time they log in. Use 'ssh-" | ||
151 | "keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of " | ||
152 | "the new host keys." | ||
153 | msgstr "" | ||
154 | "Пользователи Ñтой ÑиÑтемы будут проинформированы об Ñтом изменении, так как " | ||
155 | "им будет выведено Ñообщение о Ñмене ключа хоÑта при Ñледующем подключении. " | ||
156 | "ИÑпользуйте команду 'ssh-keygen -l -f HOST_KEY_FILE' поÑле Ð¾Ð±Ð½Ð¾Ð²Ð»ÐµÐ½Ð¸Ñ Ð´Ð»Ñ " | ||
157 | "раÑпечатки отпечатков новых ключей хоÑта." | ||
158 | |||
159 | #. Type: note | ||
160 | #. Description | ||
161 | #: ../openssh-server.templates:4001 | ||
162 | msgid "The affected host keys are:" | ||
163 | msgstr "Ключи хоÑта, которые будут заменены:" | ||
164 | |||
165 | #. Type: note | ||
166 | #. Description | ||
167 | #: ../openssh-server.templates:4001 | ||
168 | msgid "" | ||
169 | "User keys may also be affected by this problem. The 'ssh-vulnkey' command " | ||
170 | "may be used as a partial test for this. See /usr/share/doc/openssh-server/" | ||
171 | "README.compromised-keys.gz for more details." | ||
172 | msgstr "" | ||
173 | "ПользовательÑкие ключи также имеют данную проблему. Ð”Ð»Ñ Ñ‡Ð°Ñтичной проверки " | ||
174 | "можно воÑпользоватьÑÑ ÐºÐ¾Ð¼Ð°Ð½Ð´Ð¾Ð¹ 'ssh-vulnkey'. Ð’ файле /usr/share/doc/openssh-" | ||
175 | "server/README.compromised-keys.gz дано более подробное опиÑание." | ||
176 | |||
177 | #~ msgid "Generate a new configuration file for OpenSSH?" | ||
178 | #~ msgstr "Создать новый файл наÑтроек Ð´Ð»Ñ OpenSSH?" | ||
179 | |||
180 | #~ msgid "" | ||
181 | #~ "This version of OpenSSH has a considerably changed configuration file " | ||
182 | #~ "from the version shipped in Debian 'Potato', which you appear to be " | ||
183 | #~ "upgrading from. This package can now generate a new configuration file (/" | ||
184 | #~ "etc/ssh/sshd.config), which will work with the new server version, but " | ||
185 | #~ "will not contain any customizations you made with the old version." | ||
186 | #~ msgstr "" | ||
187 | #~ "Файл наÑтроек Ñтой верÑии OpenSSH значительно отличаетÑÑ Ð¾Ñ‚ файла верÑии, " | ||
188 | #~ "ÐºÐ¾Ñ‚Ð¾Ñ€Ð°Ñ Ð¿Ð¾ÑтавлÑлаÑÑŒ Ñ Debian 'Potato', и которую вы, кажетÑÑ, " | ||
189 | #~ "обновлÑете. Ðтот пакет может ÑÐµÐ¹Ñ‡Ð°Ñ Ñоздать новый файл наÑтроек (/etc/ssh/" | ||
190 | #~ "sshd.config), который будет работать Ñ Ñервером новой верÑии, но не будет " | ||
191 | #~ "Ñодержать наÑтроек, которые вы Ñделали в Ñтарой верÑии." | ||
192 | |||
193 | #~ msgid "" | ||
194 | #~ "Please note that this new configuration file will set the value of " | ||
195 | #~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password " | ||
196 | #~ "can ssh directly in as root). Please read the README.Debian file for more " | ||
197 | #~ "details about this design choice." | ||
198 | #~ msgstr "" | ||
199 | #~ "Обратите внимание, что Ñтот новый файл наÑтроек уÑтановит значение " | ||
200 | #~ "параметра 'PermitRootLogin' в 'yes' (Ñто означает, что каждый знающий " | ||
201 | #~ "пароль ÑÑƒÐ¿ÐµÑ€Ð¿Ð¾Ð»ÑŒÐ·Ð¾Ð²Ð°Ñ‚ÐµÐ»Ñ Ð¼Ð¾Ð¶ÐµÑ‚ войти в ÑиÑтему по ssh как " | ||
202 | #~ "Ñуперпользователь). ПожалуйÑта, прочтите файл README.Debian Ð´Ð»Ñ " | ||
203 | #~ "разъÑÑÐ½ÐµÐ½Ð¸Ñ Ð´ÐµÑ‚Ð°Ð»ÐµÐ¹ Ñтого выбора." | ||
204 | |||
205 | #~ msgid "" | ||
206 | #~ "It is strongly recommended that you choose to generate a new " | ||
207 | #~ "configuration file now." | ||
208 | #~ msgstr "" | ||
209 | #~ "ÐаÑтоÑтельно рекомендуетÑÑ Ð²Ñ‹Ð±Ñ€Ð°Ñ‚ÑŒ ÑÐµÐ¹Ñ‡Ð°Ñ Ñоздание нового файла наÑтроек." | ||
diff --git a/debian/po/sk.po b/debian/po/sk.po new file mode 100644 index 000000000..a10e09b6c --- /dev/null +++ b/debian/po/sk.po | |||
@@ -0,0 +1,188 @@ | |||
1 | msgid "" | ||
2 | msgstr "" | ||
3 | "Project-Id-Version: openssh 1_4.6p1-5\n" | ||
4 | "Report-Msgid-Bugs-To: openssh@packages.debian.org\n" | ||
5 | "POT-Creation-Date: 2010-01-02 08:55+0000\n" | ||
6 | "PO-Revision-Date: 2008-05-29 08:51+0100\n" | ||
7 | "Last-Translator: Ivan Masár <helix84@centrum.sk>\n" | ||
8 | "Language-Team: Slovak <sk-i18n@lists.linux.sk>\n" | ||
9 | "MIME-Version: 1.0\n" | ||
10 | "Content-Type: text/plain; charset=utf-8\n" | ||
11 | "Content-Transfer-Encoding: 8bit\n" | ||
12 | |||
13 | #. Type: boolean | ||
14 | #. Description | ||
15 | #: ../openssh-server.templates:1001 | ||
16 | msgid "Do you want to risk killing active SSH sessions?" | ||
17 | msgstr "Chcete riskovaÅ¥ zruÅ¡enie aktÃvnych SSH reláciÃ?" | ||
18 | |||
19 | #. Type: boolean | ||
20 | #. Description | ||
21 | #: ../openssh-server.templates:1001 | ||
22 | msgid "" | ||
23 | "The currently installed version of /etc/init.d/ssh is likely to kill all " | ||
24 | "running sshd instances. If you are doing this upgrade via an SSH session, " | ||
25 | "you're likely to be disconnected and leave the upgrade procedure unfinished." | ||
26 | msgstr "" | ||
27 | "Momentálne nainÅ¡talovaná verzia /etc/init.d/ssh pravdepodobne ukonÄà vÅ¡etky " | ||
28 | "prebiehajúce inštancie sshd. Ak túto aktualizáciu vykonávate cez reláciu SSH " | ||
29 | "pravdepodobne budete odpojený a aktualizácia zostane nedokonÄená." | ||
30 | |||
31 | #. Type: boolean | ||
32 | #. Description | ||
33 | #: ../openssh-server.templates:1001 | ||
34 | msgid "" | ||
35 | "This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the " | ||
36 | "start-stop-daemon line in the stop section of the file." | ||
37 | msgstr "" | ||
38 | "Toto je možné manuálne napraviť tým, že pridáte „--pidfile /var/run/sshd." | ||
39 | "pid“ do stop sekcie súboru start-stop-daemon." | ||
40 | |||
41 | #. Type: note | ||
42 | #. Description | ||
43 | #: ../openssh-server.templates:2001 | ||
44 | msgid "New host key mandatory" | ||
45 | msgstr "Nový kÄ¾ÃºÄ hostiteľa je povinný" | ||
46 | |||
47 | #. Type: note | ||
48 | #. Description | ||
49 | #: ../openssh-server.templates:2001 | ||
50 | msgid "" | ||
51 | "The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA " | ||
52 | "algorithm. OpenSSH can not handle this host key file, and the ssh-keygen " | ||
53 | "utility from the old (non-free) SSH installation does not appear to be " | ||
54 | "available." | ||
55 | msgstr "" | ||
56 | "Aktuálny kÄ¾ÃºÄ hostiteľa v /etc/ssh/ssh_host_key je kryptovaný algoritmom " | ||
57 | "IDEA. OpenSSH nemôže pracovaÅ¥ s týmto súborom s kľúÄom hostiteľa a nástroj " | ||
58 | "ssh-keygen zo starej (neslobodnej) inštalácie SSH nie je dostupný." | ||
59 | |||
60 | #. Type: note | ||
61 | #. Description | ||
62 | #: ../openssh-server.templates:2001 | ||
63 | msgid "You need to manually generate a new host key." | ||
64 | msgstr "MusÃte ruÄne vygenerovaÅ¥ nový kÄ¾ÃºÄ hostiteľa." | ||
65 | |||
66 | #. Type: boolean | ||
67 | #. Description | ||
68 | #: ../openssh-server.templates:3001 | ||
69 | msgid "Disable challenge-response authentication?" | ||
70 | msgstr "Vypnúť autentifikáciu výzva-odpoveÄ?" | ||
71 | |||
72 | #. Type: boolean | ||
73 | #. Description | ||
74 | #: ../openssh-server.templates:3001 | ||
75 | msgid "" | ||
76 | "Password authentication appears to be disabled in the current OpenSSH server " | ||
77 | "configuration. In order to prevent users from logging in using passwords " | ||
78 | "(perhaps using only public key authentication instead) with recent versions " | ||
79 | "of OpenSSH, you must disable challenge-response authentication, or else " | ||
80 | "ensure that your PAM configuration does not allow Unix password file " | ||
81 | "authentication." | ||
82 | msgstr "" | ||
83 | "Zdá sa, že autentifikácia pomocou hesla je v aktuálnej konfigurácii OpenSSH " | ||
84 | "servera vypnutá. Aby ste zabránili použÃvateľom prihlasovaÅ¥ sa pomocou " | ||
85 | "hesiel (snÃ¡Ä iba použitÃm autentifikácie svojÃm verejným kľúÄom) pri novÅ¡Ãch " | ||
86 | "verziách OpenSSH musÃte vypnúť autentifikáciu výzva-odpoveÄ alebo sa inak " | ||
87 | "uistiť, že vaša konfigurácia PAM neumožňuje autentifikáciu pomocu unixového " | ||
88 | "súboru s heslami." | ||
89 | |||
90 | #. Type: boolean | ||
91 | #. Description | ||
92 | #: ../openssh-server.templates:3001 | ||
93 | msgid "" | ||
94 | "If you disable challenge-response authentication, then users will not be " | ||
95 | "able to log in using passwords. If you leave it enabled (the default " | ||
96 | "answer), then the 'PasswordAuthentication no' option will have no useful " | ||
97 | "effect unless you also adjust your PAM configuration in /etc/pam.d/ssh." | ||
98 | msgstr "" | ||
99 | "Ak vypnete autentifikáciu výzva-odpoveÄ, použÃvatelia sa nebudú môcÅ¥ " | ||
100 | "prihlasovaÅ¥ pomocou hesiel. Ak ju necháte zapnutú (Å¡tandardná odpoveÄ), " | ||
101 | "potom nebude maÅ¥ voľba „PasswordAuthentication no“ žiadny úÄinok v prÃpade, " | ||
102 | "že tiež vhodne nenastavÃte vaÅ¡u konfiguráciu PAM v /etc/pam.d/ssh." | ||
103 | |||
104 | #. Type: note | ||
105 | #. Description | ||
106 | #: ../openssh-server.templates:4001 | ||
107 | msgid "Vulnerable host keys will be regenerated" | ||
108 | msgstr "Namiesto zneužiteľných kľúÄov hostiteľa sa vytvoria nové" | ||
109 | |||
110 | #. Type: note | ||
111 | #. Description | ||
112 | #: ../openssh-server.templates:4001 | ||
113 | msgid "" | ||
114 | "Some of the OpenSSH server host keys on this system were generated with a " | ||
115 | "version of OpenSSL that had a broken random number generator. As a result, " | ||
116 | "these host keys are from a well-known set, are subject to brute-force " | ||
117 | "attacks, and must be regenerated." | ||
118 | msgstr "" | ||
119 | "Niektoré z OpenSSH klúÄov hostiteľa na tomto systéme boli vytvorené verziou " | ||
120 | "OpenSSL, ktorá mala chybný generátor náhodných ÄÃsel. Dôsledkom je, že tieto " | ||
121 | "klúÄe hostiteľa sú z vopred známej množiny, je možné ich prelomiÅ¥ hrubou " | ||
122 | "silou a je potrebné vytvoriť namiesto nich nové." | ||
123 | |||
124 | #. Type: note | ||
125 | #. Description | ||
126 | #: ../openssh-server.templates:4001 | ||
127 | msgid "" | ||
128 | "Users of this system should be informed of this change, as they will be " | ||
129 | "prompted about the host key change the next time they log in. Use 'ssh-" | ||
130 | "keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of " | ||
131 | "the new host keys." | ||
132 | msgstr "" | ||
133 | "PoužÃvateľov tohoto systému by ste mali informovaÅ¥ o tejto zmene, pretože " | ||
134 | "pri najbližšom prihlásenà sa im zobrazà výzva o zmenenom kľúÄi hostiteľa. Po " | ||
135 | "aktualizácii vypÃÅ¡ete odtlaÄky nových kľúÄov hostiteľa prÃkazom „ssh-keygen -" | ||
136 | "l -f HOST_KEY_FILE“." | ||
137 | |||
138 | #. Type: note | ||
139 | #. Description | ||
140 | #: ../openssh-server.templates:4001 | ||
141 | msgid "The affected host keys are:" | ||
142 | msgstr "Postihnuté kľúÄe sú:" | ||
143 | |||
144 | #. Type: note | ||
145 | #. Description | ||
146 | #: ../openssh-server.templates:4001 | ||
147 | msgid "" | ||
148 | "User keys may also be affected by this problem. The 'ssh-vulnkey' command " | ||
149 | "may be used as a partial test for this. See /usr/share/doc/openssh-server/" | ||
150 | "README.compromised-keys.gz for more details." | ||
151 | msgstr "" | ||
152 | "PoužÃvateľské kľúÄe tiež mohol ovplyvniÅ¥ tento problém. Na ÄiastoÄný test " | ||
153 | "zraniteľnosti je možné použiÅ¥ prÃkaz „ssh-vulnkey“. Podrobnosti nájdete v /" | ||
154 | "usr/share/doc/openssh-server/README.compromised-keys.gz" | ||
155 | |||
156 | #~ msgid "Generate a new configuration file for OpenSSH?" | ||
157 | #~ msgstr "VytvoriÅ¥ nový konfiguraÄný súbor pre OpenSSH?" | ||
158 | |||
159 | #~ msgid "" | ||
160 | #~ "This version of OpenSSH has a considerably changed configuration file " | ||
161 | #~ "from the version shipped in Debian 'Potato', which you appear to be " | ||
162 | #~ "upgrading from. This package can now generate a new configuration file (/" | ||
163 | #~ "etc/ssh/sshd.config), which will work with the new server version, but " | ||
164 | #~ "will not contain any customizations you made with the old version." | ||
165 | #~ msgstr "" | ||
166 | #~ "Táto verzia OpenSSH má podstatne zmenený konfiguraÄný súbor v porovnanà s " | ||
167 | #~ "versiou, ktorá sa dodávala s Debian „Potato“, z ktorej, zdá sa, " | ||
168 | #~ "aktualizujete. Tento balÃk teraz môže vytvoriÅ¥ nový konfiguraÄný súbor (/" | ||
169 | #~ "etc/ssh/sshd.config), ktorý bude fungovať s novou verziou servera, ale " | ||
170 | #~ "nebude obsahovať akékoľvek zmeny, ktoré ste urobili v starej verzii." | ||
171 | |||
172 | #~ msgid "" | ||
173 | #~ "Please note that this new configuration file will set the value of " | ||
174 | #~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password " | ||
175 | #~ "can ssh directly in as root). Please read the README.Debian file for more " | ||
176 | #~ "details about this design choice." | ||
177 | #~ msgstr "" | ||
178 | #~ "ProsÃm, majte na pamäti, že tento nový konfiguraÄný súbor nastavà hodnotu " | ||
179 | #~ "„'PermitRootLogin“ na „áno“ (Äo znamená, že každý, kto pozná heslo úÄtu " | ||
180 | #~ "root, sa bude môcÅ¥ pomocou ssh prihlásiÅ¥ priamo ako root). ProsÃm, " | ||
181 | #~ "preÄÃtajte si podrobnosti o tejto voľbe pri návrhu v súbore README.Debian." | ||
182 | |||
183 | #~ msgid "" | ||
184 | #~ "It is strongly recommended that you choose to generate a new " | ||
185 | #~ "configuration file now." | ||
186 | #~ msgstr "" | ||
187 | #~ "Silne sa odporúÄa, aby ste teraz zvolili vytvorenie nového konfiguraÄného " | ||
188 | #~ "súboru." | ||
diff --git a/debian/po/sv.po b/debian/po/sv.po new file mode 100644 index 000000000..cd28386d0 --- /dev/null +++ b/debian/po/sv.po | |||
@@ -0,0 +1,197 @@ | |||
1 | # translation of openssh.po to swedish | ||
2 | # Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER | ||
3 | # This file is distributed under the same license as the PACKAGE package. | ||
4 | # | ||
5 | # Martin Bagge <martin.bagge@bthstudent.se>, 2008. | ||
6 | msgid "" | ||
7 | msgstr "" | ||
8 | "Project-Id-Version: openssh\n" | ||
9 | "Report-Msgid-Bugs-To: openssh@packages.debian.org\n" | ||
10 | "POT-Creation-Date: 2010-01-02 08:55+0000\n" | ||
11 | "PO-Revision-Date: 2008-05-25 23:32+0200\n" | ||
12 | "Last-Translator: Martin Bagge <martin.bagge@bthstudent.se>\n" | ||
13 | "Language-Team: swedish <sv@li.org>\n" | ||
14 | "MIME-Version: 1.0\n" | ||
15 | "Content-Type: text/plain; charset=UTF-8\n" | ||
16 | "Content-Transfer-Encoding: 8bit\n" | ||
17 | "X-Generator: KBabel 1.11.4\n" | ||
18 | |||
19 | #. Type: boolean | ||
20 | #. Description | ||
21 | #: ../openssh-server.templates:1001 | ||
22 | msgid "Do you want to risk killing active SSH sessions?" | ||
23 | msgstr "Vill du riskera att döda aktiva SSH-sessioner?" | ||
24 | |||
25 | #. Type: boolean | ||
26 | #. Description | ||
27 | #: ../openssh-server.templates:1001 | ||
28 | msgid "" | ||
29 | "The currently installed version of /etc/init.d/ssh is likely to kill all " | ||
30 | "running sshd instances. If you are doing this upgrade via an SSH session, " | ||
31 | "you're likely to be disconnected and leave the upgrade procedure unfinished." | ||
32 | msgstr "" | ||
33 | "Den för närvarande installerade versionen av /etc/init.d/ssh kommer " | ||
34 | "antagligen döda alla körande instanser av sshd. Om du gör denna " | ||
35 | "uppgradering via en SSH-session kommer du sannolikt att kopplas ner och " | ||
36 | "uppgraderingsprocessen lämnas ofärdig." | ||
37 | |||
38 | #. Type: boolean | ||
39 | #. Description | ||
40 | #: ../openssh-server.templates:1001 | ||
41 | msgid "" | ||
42 | "This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the " | ||
43 | "start-stop-daemon line in the stop section of the file." | ||
44 | msgstr "" | ||
45 | "Det här kan rättas till genom att manuellt lägga till \"--pidfile /var/run/" | ||
46 | "sshd.pid\" till raden \"start-stop-daemon\" i sektionen \"stop\" i filen." | ||
47 | |||
48 | #. Type: note | ||
49 | #. Description | ||
50 | #: ../openssh-server.templates:2001 | ||
51 | msgid "New host key mandatory" | ||
52 | msgstr "Ny värdnyckel är obligatorisk" | ||
53 | |||
54 | #. Type: note | ||
55 | #. Description | ||
56 | #: ../openssh-server.templates:2001 | ||
57 | msgid "" | ||
58 | "The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA " | ||
59 | "algorithm. OpenSSH can not handle this host key file, and the ssh-keygen " | ||
60 | "utility from the old (non-free) SSH installation does not appear to be " | ||
61 | "available." | ||
62 | msgstr "" | ||
63 | "Den aktuella värdnyckeln i /etc/ssh/ssh_host_key är krypterad med IDEA-" | ||
64 | "algoritmen. OpenSSH kan inte hantera den här värdnyckelfilen och verktyget " | ||
65 | "ssh-keygen från den gamla (ickefria) SSH-installationen verkar inte finnas " | ||
66 | "tillgänglig." | ||
67 | |||
68 | #. Type: note | ||
69 | #. Description | ||
70 | #: ../openssh-server.templates:2001 | ||
71 | msgid "You need to manually generate a new host key." | ||
72 | msgstr "Du behöver manuellt generera en ny värdnyckel." | ||
73 | |||
74 | #. Type: boolean | ||
75 | #. Description | ||
76 | #: ../openssh-server.templates:3001 | ||
77 | msgid "Disable challenge-response authentication?" | ||
78 | msgstr "Inaktivera challenge-response-autentisering?" | ||
79 | |||
80 | #. Type: boolean | ||
81 | #. Description | ||
82 | #: ../openssh-server.templates:3001 | ||
83 | msgid "" | ||
84 | "Password authentication appears to be disabled in the current OpenSSH server " | ||
85 | "configuration. In order to prevent users from logging in using passwords " | ||
86 | "(perhaps using only public key authentication instead) with recent versions " | ||
87 | "of OpenSSH, you must disable challenge-response authentication, or else " | ||
88 | "ensure that your PAM configuration does not allow Unix password file " | ||
89 | "authentication." | ||
90 | msgstr "" | ||
91 | "Lösenordsautentisering verkar vara inaktiverat i din aktuella konfiguration " | ||
92 | "av OpenSSH-servern. För att förhindra att användare loggar in med lösenord " | ||
93 | "(istället kanske endast använder publik nyckelautentisering) med senare " | ||
94 | "versioner av OpenSSH, måste du inaktivera challenge-response-autentisering " | ||
95 | "eller försäkra dig om att din PAM-konfiguration inte tillåter autentisering " | ||
96 | "via Unix lösenordsfil." | ||
97 | |||
98 | #. Type: boolean | ||
99 | #. Description | ||
100 | #: ../openssh-server.templates:3001 | ||
101 | msgid "" | ||
102 | "If you disable challenge-response authentication, then users will not be " | ||
103 | "able to log in using passwords. If you leave it enabled (the default " | ||
104 | "answer), then the 'PasswordAuthentication no' option will have no useful " | ||
105 | "effect unless you also adjust your PAM configuration in /etc/pam.d/ssh." | ||
106 | msgstr "" | ||
107 | "Om du inaktiverar challenge-response-autentisering så kan användarna inte " | ||
108 | "logga in med lösenord. Om du lämnar det aktiverat (som är standard) så " | ||
109 | "kommer \"PasswordAuthentication no\" inte att ha någon effekt om du inte " | ||
110 | "justerar din PAM-konfiguration i /etc/pam.d/ssh." | ||
111 | |||
112 | #. Type: note | ||
113 | #. Description | ||
114 | #: ../openssh-server.templates:4001 | ||
115 | msgid "Vulnerable host keys will be regenerated" | ||
116 | msgstr "Sårbara värdnycklar kommer att omskapas" | ||
117 | |||
118 | #. Type: note | ||
119 | #. Description | ||
120 | #: ../openssh-server.templates:4001 | ||
121 | msgid "" | ||
122 | "Some of the OpenSSH server host keys on this system were generated with a " | ||
123 | "version of OpenSSL that had a broken random number generator. As a result, " | ||
124 | "these host keys are from a well-known set, are subject to brute-force " | ||
125 | "attacks, and must be regenerated." | ||
126 | msgstr "" | ||
127 | "Några av värdnycklarna för OpenSSH skapades med en version av OpenSSL som " | ||
128 | "innehöll ett fel i slumptalsgeneratorn. På grund av detta är värden sårbar " | ||
129 | "för en så kallad brute force-attack då nycklarna kommer från ett litet och " | ||
130 | "välkänt spektra." | ||
131 | |||
132 | #. Type: note | ||
133 | #. Description | ||
134 | #: ../openssh-server.templates:4001 | ||
135 | msgid "" | ||
136 | "Users of this system should be informed of this change, as they will be " | ||
137 | "prompted about the host key change the next time they log in. Use 'ssh-" | ||
138 | "keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of " | ||
139 | "the new host keys." | ||
140 | msgstr "" | ||
141 | "Användarna på det här systemet borde informeras om den här förändringen då " | ||
142 | "de kommer att bli varse bytet av värdnyckel nästa gång de loggar in. Använd " | ||
143 | "'ssh-keygen -l -f HOST_KEY_FILE' efter uppgraderingen har slutförst för att " | ||
144 | "skriva ut fingeravtrycken för de nya värdnycklarna" | ||
145 | |||
146 | #. Type: note | ||
147 | #. Description | ||
148 | #: ../openssh-server.templates:4001 | ||
149 | msgid "The affected host keys are:" | ||
150 | msgstr "De drabbade värdnycklarna är:" | ||
151 | |||
152 | #. Type: note | ||
153 | #. Description | ||
154 | #: ../openssh-server.templates:4001 | ||
155 | msgid "" | ||
156 | "User keys may also be affected by this problem. The 'ssh-vulnkey' command " | ||
157 | "may be used as a partial test for this. See /usr/share/doc/openssh-server/" | ||
158 | "README.compromised-keys.gz for more details." | ||
159 | msgstr "" | ||
160 | "Användarnycklar kan också vara drabbade av detta fel. Kommandot 'ssh-" | ||
161 | "vulnkey' kan användas som ett deltest. Läs /usr/share/doc/openssh-server/" | ||
162 | "README.compromised-keys.gz för mer ingående detaljer." | ||
163 | |||
164 | #~ msgid "Generate a new configuration file for OpenSSH?" | ||
165 | #~ msgstr "Generera en ny konfigurationsfil för OpenSSH?" | ||
166 | |||
167 | #~ msgid "" | ||
168 | #~ "This version of OpenSSH has a considerably changed configuration file " | ||
169 | #~ "from the version shipped in Debian 'Potato', which you appear to be " | ||
170 | #~ "upgrading from. This package can now generate a new configuration file (/" | ||
171 | #~ "etc/ssh/sshd.config), which will work with the new server version, but " | ||
172 | #~ "will not contain any customizations you made with the old version." | ||
173 | #~ msgstr "" | ||
174 | #~ "Denna version av OpenSSH har ändrat konfigurationsfilen ansenligt från " | ||
175 | #~ "den version som skickades med i Debians \"Potato\"-utgåva som du verkar " | ||
176 | #~ "uppgradera från. Detta paket kan nu generera en ny konfigurationsfil (/" | ||
177 | #~ "etc/ssh/sshd.config) som kommer att fungera med den nya serverversionen " | ||
178 | #~ "men kommer inte att innehålla några anpassningar som du gjorde med den " | ||
179 | #~ "gamla versionen." | ||
180 | |||
181 | #~ msgid "" | ||
182 | #~ "Please note that this new configuration file will set the value of " | ||
183 | #~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password " | ||
184 | #~ "can ssh directly in as root). Please read the README.Debian file for more " | ||
185 | #~ "details about this design choice." | ||
186 | #~ msgstr "" | ||
187 | #~ "Observera att den nya konfigurationsfilen kommer att ställa in värdet för " | ||
188 | #~ "\"PermitRootLogin\" till \"yes\" (vilket betyder att vem som helst som " | ||
189 | #~ "kan root-lösenordet kan logga in direkt som root). Läs filen README." | ||
190 | #~ "Debian för mer information om det här designvalet." | ||
191 | |||
192 | #~ msgid "" | ||
193 | #~ "It is strongly recommended that you choose to generate a new " | ||
194 | #~ "configuration file now." | ||
195 | #~ msgstr "" | ||
196 | #~ "Det rekommenderas starkt att du väljer att generera en ny " | ||
197 | #~ "konfigurationsfil nu." | ||
diff --git a/debian/po/ta.po b/debian/po/ta.po new file mode 100644 index 000000000..cab323a83 --- /dev/null +++ b/debian/po/ta.po | |||
@@ -0,0 +1,181 @@ | |||
1 | # translation of openssh.po to TAMIL | ||
2 | # Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER | ||
3 | # This file is distributed under the same license as the PACKAGE package. | ||
4 | # | ||
5 | # Dr.T.Vasudevan <agnihot3@gmail.com>, 2007. | ||
6 | msgid "" | ||
7 | msgstr "" | ||
8 | "Project-Id-Version: openssh\n" | ||
9 | "Report-Msgid-Bugs-To: openssh@packages.debian.org\n" | ||
10 | "POT-Creation-Date: 2010-01-02 08:55+0000\n" | ||
11 | "PO-Revision-Date: 2007-04-24 20:52+0530\n" | ||
12 | "Last-Translator: Dr.T.Vasudevan <agnihot3@gmail.com>\n" | ||
13 | "Language-Team: TAMIL <ubuntu-l10n-tam@lists.ubuntu.com>\n" | ||
14 | "MIME-Version: 1.0\n" | ||
15 | "Content-Type: text/plain; charset=UTF-8\n" | ||
16 | "Content-Transfer-Encoding: 8bit\n" | ||
17 | "X-Generator: KBabel 1.11.4\n" | ||
18 | |||
19 | #. Type: boolean | ||
20 | #. Description | ||
21 | #: ../openssh-server.templates:1001 | ||
22 | msgid "Do you want to risk killing active SSH sessions?" | ||
23 | msgstr "" | ||
24 | "செயலில௠இரà¯à®•à¯à®•à¯à®®à¯ எஸà¯à®Žà®¸à¯à®¹à¯†à®šà¯ அமரà¯à®µà¯à®•à®³à¯ˆ செயல௠நீகà¯à®•à®®à¯ செயà¯à®µà®¤à¯ˆ அனà¯à®®à®¤à®¿à®•à¯à®• விரà¯à®®à¯à®ªà¯à®•à®¿à®±à¯€à®•à®³à®¾?" | ||
25 | |||
26 | #. Type: boolean | ||
27 | #. Description | ||
28 | #: ../openssh-server.templates:1001 | ||
29 | msgid "" | ||
30 | "The currently installed version of /etc/init.d/ssh is likely to kill all " | ||
31 | "running sshd instances. If you are doing this upgrade via an SSH session, " | ||
32 | "you're likely to be disconnected and leave the upgrade procedure unfinished." | ||
33 | msgstr "" | ||
34 | "இபà¯à®ªà¯‹à®¤à¯ நிறà¯à®µà®¿à®¯à¯à®³à¯à®³ /etc/init.d/ssh பதிபà¯à®ªà¯ எலà¯à®²à®¾ செயலில௠இரà¯à®•à¯à®•à¯à®®à¯ எஸà¯à®Žà®¸à¯à®¹à¯†à®šà¯ " | ||
35 | "அமரà¯à®µà¯à®•à®³à¯ˆ செயல௠நீகà¯à®•à®®à¯ செயà¯à®¯à¯à®®à¯. நீஙà¯à®•à®³à¯ இநà¯à®¤ மேமà¯à®ªà®Ÿà¯à®¤à¯à®¤à®²à¯ˆ எஸà¯à®Žà®¸à¯à®¹à¯†à®šà¯ அமரà¯à®µà¯ வழியாக செயà¯à®¤à¯ " | ||
36 | "கொணà¯à®Ÿà®¿à®°à¯à®¨à¯à®¤à®¾à®²à¯ வலை இணபà¯à®ªà¯ தà¯à®£à¯à®Ÿà®¿à®•à¯à®•à®ªà¯à®ªà®Ÿà¯à®Ÿà¯ மேமà¯à®ªà®Ÿà¯à®¤à¯à®¤à®²à¯ நிறைவà¯à®±à®¾à®¤à¯." | ||
37 | |||
38 | #. Type: boolean | ||
39 | #. Description | ||
40 | #: ../openssh-server.templates:1001 | ||
41 | msgid "" | ||
42 | "This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the " | ||
43 | "start-stop-daemon line in the stop section of the file." | ||
44 | msgstr "" | ||
45 | "இத௠கைமà¯à®±à¯ˆà®¯à®¾à®• கோபà¯à®ªà®¿à®©à¯ நிறà¯à®¤à¯à®¤à¯ பகà¯à®¤à®¿à®¯à®¿à®²à¯ ஆரமà¯à®ªà®¿-நிறà¯à®¤à¯à®¤à¯-கிஙà¯à®•à®°à®©à¯ வரியில௠\"--" | ||
46 | "pidfile /var/run/sshd.pid\" என சேரà¯à®ªà¯à®ªà®¤à®¾à®²à¯ சரி செயà¯à®¯à®ªà¯à®ªà®Ÿà¯à®®à¯." | ||
47 | |||
48 | #. Type: note | ||
49 | #. Description | ||
50 | #: ../openssh-server.templates:2001 | ||
51 | msgid "New host key mandatory" | ||
52 | msgstr "பà¯à®¤à®¿à®¯ பà¯à®°à®µà®²à®©à¯ விசை கடà¯à®Ÿà®¾à®¯à®®à®¾à®•à¯à®®à¯" | ||
53 | |||
54 | #. Type: note | ||
55 | #. Description | ||
56 | #: ../openssh-server.templates:2001 | ||
57 | msgid "" | ||
58 | "The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA " | ||
59 | "algorithm. OpenSSH can not handle this host key file, and the ssh-keygen " | ||
60 | "utility from the old (non-free) SSH installation does not appear to be " | ||
61 | "available." | ||
62 | msgstr "" | ||
63 | "இபà¯à®ªà¯‹à®¤à¯ˆà®¯ /etc/ssh/ssh_host_key இல௠உளà¯à®³ பà¯à®°à®µà®²à®©à¯ விசை IDEA அலà¯à®•à®¾à®°à®¿à®¤à®¤à¯à®¤à®¿à®²à¯ கà¯à®±à®¿à®¯à¯€à®Ÿà¯ " | ||
64 | "செயà¯à®¯à®ªà¯à®ªà®Ÿà¯à®Ÿà®¤à¯. இநà¯à®¤ பà¯à®°à®µà®²à®©à¯ விசையை ஓபன௠எஸà¯à®Žà®¸à¯à®¹à¯†à®šà¯ கையாள இயலாதà¯. பழைய பதிபà¯à®ªà®¿à®²à®¿à®°à¯à®¨à¯à®¤à¯ " | ||
65 | "ssh-keygen பயனà¯à®ªà®¾à®Ÿà¯ இரà¯à®ªà¯à®ªà®¿à®²à¯ இலà¯à®²à¯ˆ." | ||
66 | |||
67 | #. Type: note | ||
68 | #. Description | ||
69 | #: ../openssh-server.templates:2001 | ||
70 | msgid "You need to manually generate a new host key." | ||
71 | msgstr "நீஙà¯à®•à®³à¯ கைமà¯à®±à¯ˆà®¯à®¾à®• பà¯à®¤à®¿à®¯ பà¯à®°à®µà®²à®©à¯ விசையை உரà¯à®µà®¾à®•à¯à®• வேணà¯à®Ÿà¯à®®à¯." | ||
72 | |||
73 | #. Type: boolean | ||
74 | #. Description | ||
75 | #: ../openssh-server.templates:3001 | ||
76 | msgid "Disable challenge-response authentication?" | ||
77 | msgstr "கேளà¯à®µà®¿ பதில௠உறà¯à®¤à®¿à®ªà¯à®ªà®Ÿà¯à®¤à¯à®¤à®²à¯ˆ செயலிழகà¯à®• செயà¯à®¯à®µà®¾?" | ||
78 | |||
79 | #. Type: boolean | ||
80 | #. Description | ||
81 | #: ../openssh-server.templates:3001 | ||
82 | msgid "" | ||
83 | "Password authentication appears to be disabled in the current OpenSSH server " | ||
84 | "configuration. In order to prevent users from logging in using passwords " | ||
85 | "(perhaps using only public key authentication instead) with recent versions " | ||
86 | "of OpenSSH, you must disable challenge-response authentication, or else " | ||
87 | "ensure that your PAM configuration does not allow Unix password file " | ||
88 | "authentication." | ||
89 | msgstr "" | ||
90 | "இபà¯à®ªà¯‹à®¤à¯ˆà®¯ ஓபன௠எஸà¯à®Žà®¸à¯à®¹à¯†à®šà¯ சேவையக வடிவமைபà¯à®ªà®¿à®²à¯ கடவà¯à®šà¯à®šà¯Šà®²à¯ உறà¯à®¤à®¿à®ªà¯à®ªà®Ÿà¯à®¤à¯à®¤à®²à¯ˆ செயலிழகà¯à®• " | ||
91 | "செயà¯à®¤à¯à®³à¯à®³à®¤à¯. (திறநà¯à®¤ விசையை பயனà¯à®ªà®Ÿà¯à®¤à¯à®¤à®¿) பயனரà¯à®•à®³à¯ உளà¯à®¨à¯à®´à¯ˆà®µà®¤à¯ˆ தடà¯à®•à¯à®• சமீபதà¯à®¤à®¿à®¯ ஓபன௠" | ||
92 | "எஸà¯à®Žà®¸à¯à®¹à¯†à®šà¯ பதிபà¯à®ªà¯à®•à®³à®¿à®²à¯ நீஙà¯à®•à®³à¯ கேளà¯à®µà®¿ பதில௠உறà¯à®¤à®¿à®ªà¯à®ªà®Ÿà¯à®¤à¯à®¤à®²à¯ˆ செயலிழகà¯à®• செயà¯à®¯ வேணà¯à®Ÿà¯à®®à¯. அலà¯à®²à®¤à¯ " | ||
93 | "உஙà¯à®•à®³à¯ பாம௠வடிவமைபà¯à®ªà¯ யூனிகà¯à®¸à¯ கடவà¯à®šà¯à®šà¯Šà®²à¯ கோபà¯à®ªà¯ உறà¯à®¤à®¿à®ªà¯à®ªà®Ÿà¯à®¤à¯à®¤à®²à¯ˆ à®à®±à¯à®•à®¾à®¤à®µà®¾à®±à¯ அமைகà¯à®• " | ||
94 | "வேணà¯à®Ÿà¯à®®à¯." | ||
95 | |||
96 | #. Type: boolean | ||
97 | #. Description | ||
98 | #: ../openssh-server.templates:3001 | ||
99 | msgid "" | ||
100 | "If you disable challenge-response authentication, then users will not be " | ||
101 | "able to log in using passwords. If you leave it enabled (the default " | ||
102 | "answer), then the 'PasswordAuthentication no' option will have no useful " | ||
103 | "effect unless you also adjust your PAM configuration in /etc/pam.d/ssh." | ||
104 | msgstr "" | ||
105 | "நீஙà¯à®•à®³à¯ கேளà¯à®µà®¿ பதில௠உறà¯à®¤à®¿à®ªà¯à®ªà®Ÿà¯à®¤à¯à®¤à®²à¯ˆ செயலிழகà¯à®• செயà¯à®¤à®¾à®²à¯ பயனரà¯à®•à®³à¯ கடவà¯à®šà¯à®šà¯Šà®±à¯à®•à®³à¯ˆ பயன௠படà¯à®¤à¯à®¤à®¿ " | ||
106 | "உள௠நà¯à®´à¯ˆà®¯ இயலாதà¯. அதை செயல௠படசà¯à®šà¯†à®¯à¯à®¤à®¾à®²à¯ (கடவà¯à®šà¯à®šà¯Šà®²à¯ உறà¯à®¤à®¿à®ªà¯à®ªà®Ÿà¯à®¤à¯à®¤à®²à¯ தேரà¯à®µà¯ இலà¯à®²à¯ˆ) " | ||
107 | "'PasswordAuthentication no' தேரà¯à®µà¯ /etc/pam.d/ssh இல௠பாம௠வடிவமைபà¯à®ªà¯ˆ சரி " | ||
108 | "செயà¯à®¤à®¾à®²à¯ ஒழிய பயன௠தராதà¯." | ||
109 | |||
110 | #. Type: note | ||
111 | #. Description | ||
112 | #: ../openssh-server.templates:4001 | ||
113 | msgid "Vulnerable host keys will be regenerated" | ||
114 | msgstr "" | ||
115 | |||
116 | #. Type: note | ||
117 | #. Description | ||
118 | #: ../openssh-server.templates:4001 | ||
119 | msgid "" | ||
120 | "Some of the OpenSSH server host keys on this system were generated with a " | ||
121 | "version of OpenSSL that had a broken random number generator. As a result, " | ||
122 | "these host keys are from a well-known set, are subject to brute-force " | ||
123 | "attacks, and must be regenerated." | ||
124 | msgstr "" | ||
125 | |||
126 | #. Type: note | ||
127 | #. Description | ||
128 | #: ../openssh-server.templates:4001 | ||
129 | msgid "" | ||
130 | "Users of this system should be informed of this change, as they will be " | ||
131 | "prompted about the host key change the next time they log in. Use 'ssh-" | ||
132 | "keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of " | ||
133 | "the new host keys." | ||
134 | msgstr "" | ||
135 | |||
136 | #. Type: note | ||
137 | #. Description | ||
138 | #: ../openssh-server.templates:4001 | ||
139 | msgid "The affected host keys are:" | ||
140 | msgstr "" | ||
141 | |||
142 | #. Type: note | ||
143 | #. Description | ||
144 | #: ../openssh-server.templates:4001 | ||
145 | msgid "" | ||
146 | "User keys may also be affected by this problem. The 'ssh-vulnkey' command " | ||
147 | "may be used as a partial test for this. See /usr/share/doc/openssh-server/" | ||
148 | "README.compromised-keys.gz for more details." | ||
149 | msgstr "" | ||
150 | |||
151 | #~ msgid "Generate a new configuration file for OpenSSH?" | ||
152 | #~ msgstr "ஓபன௠எஸà¯à®Žà®¸à¯à®¹à¯†à®šà¯ கà¯à®•à¯ பà¯à®¤à®¿à®¯ வடிவமைபà¯à®ªà¯ கோபà¯à®ªà¯ˆ உரà¯à®µà®¾à®•à¯à®•à®µà®¾?" | ||
153 | |||
154 | #~ msgid "" | ||
155 | #~ "This version of OpenSSH has a considerably changed configuration file " | ||
156 | #~ "from the version shipped in Debian 'Potato', which you appear to be " | ||
157 | #~ "upgrading from. This package can now generate a new configuration file (/" | ||
158 | #~ "etc/ssh/sshd.config), which will work with the new server version, but " | ||
159 | #~ "will not contain any customizations you made with the old version." | ||
160 | #~ msgstr "" | ||
161 | #~ "இநà¯à®¤ பதிபà¯à®ªà¯ ஓபன௠எஸà¯à®Žà®¸à¯à®¹à¯†à®šà¯ நீஙà¯à®•à®³à¯ மேமà¯à®ªà®Ÿà¯à®¤à¯à®¤à¯à®®à¯ டெபியன௠பொடாடோவில௠அமைநà¯à®¤ பதிபà¯à®ªà¯ˆ " | ||
162 | #~ "காடà¯à®Ÿà®¿à®²à¯à®®à¯ மிக மாறிய வடிவம௠உடையதà¯. இநà¯à®¤ பொதி இபà¯à®ªà¯‹à®¤à¯ பà¯à®¤à®¿à®¯ வடிவமைபà¯à®ªà¯ கோபà¯à®ªà¯ˆ " | ||
163 | #~ "உரà¯à®µà®¾à®•à¯à®•à¯à®®à¯. (/etc/ssh/sshd.config). இத௠பà¯à®¤à®¿à®¯ சேவையக பதிபà¯à®ªà®¿à®²à¯ வேலை செயà¯à®¯à¯à®®à¯. " | ||
164 | #~ "ஆனால௠நீஙà¯à®•à®³à¯ பழைய பதிபà¯à®ªà®¿à®²à¯ செயà¯à®¤ தனிபà¯à®ªà®Ÿà¯à®¤à¯à®¤à®²à¯ இயலாதà¯." | ||
165 | |||
166 | #~ msgid "" | ||
167 | #~ "Please note that this new configuration file will set the value of " | ||
168 | #~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password " | ||
169 | #~ "can ssh directly in as root). Please read the README.Debian file for more " | ||
170 | #~ "details about this design choice." | ||
171 | #~ msgstr "" | ||
172 | #~ "இநà¯à®¤ பà¯à®¤à®¿à®¯ வடிவமைபà¯à®ªà¯ கோபà¯à®ªà¯ 'PermitRootLogin மதிபà¯à®ªà¯ˆ ஆம௠என அமைகà¯à®•à¯à®®à¯ என " | ||
173 | #~ "அறியவà¯à®®à¯. அதாவத௠ரூட௠கடவà¯à®šà¯à®šà¯Šà®²à¯ அறிநà¯à®¤ யாரà¯à®®à¯ ரூடà¯à®Ÿà®¾à®• ஓபன௠எஸà¯à®Žà®¸à¯à®¹à¯†à®šà¯ வழியே " | ||
174 | #~ "உளà¯à®¨à¯à®´à¯ˆà®¯à®²à®¾à®®à¯. இநà¯à®¤ வடிவமைபà¯à®ªà¯ கà¯à®±à®¿à®¤à¯à®¤à¯ மேலà¯à®®à¯ README.Debian கோபà¯à®ªà®¿à®²à¯ காணவà¯à®®à¯." | ||
175 | |||
176 | #~ msgid "" | ||
177 | #~ "It is strongly recommended that you choose to generate a new " | ||
178 | #~ "configuration file now." | ||
179 | #~ msgstr "" | ||
180 | #~ "நீஙà¯à®•à®³à¯ இபà¯à®ªà¯‹à®¤à¯ பà¯à®¤à®¿à®¯ வடிவமைபà¯à®ªà¯ கோபà¯à®ªà¯ˆ உரà¯à®µà®¾à®•à¯à®• தேரà¯à®µà¯ செயà¯à®¯ பலமாக " | ||
181 | #~ "பரிநà¯à®¤à¯à®°à¯ˆà®•à¯à®•à®ªà¯à®ªà®Ÿà¯à®•à®¿à®±à®¤à¯." | ||
diff --git a/debian/po/templates.pot b/debian/po/templates.pot new file mode 100644 index 000000000..de8023b07 --- /dev/null +++ b/debian/po/templates.pot | |||
@@ -0,0 +1,131 @@ | |||
1 | # SOME DESCRIPTIVE TITLE. | ||
2 | # Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER | ||
3 | # This file is distributed under the same license as the PACKAGE package. | ||
4 | # FIRST AUTHOR <EMAIL@ADDRESS>, YEAR. | ||
5 | # | ||
6 | #, fuzzy | ||
7 | msgid "" | ||
8 | msgstr "" | ||
9 | "Project-Id-Version: PACKAGE VERSION\n" | ||
10 | "Report-Msgid-Bugs-To: openssh@packages.debian.org\n" | ||
11 | "POT-Creation-Date: 2010-01-02 08:55+0000\n" | ||
12 | "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" | ||
13 | "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n" | ||
14 | "Language-Team: LANGUAGE <LL@li.org>\n" | ||
15 | "MIME-Version: 1.0\n" | ||
16 | "Content-Type: text/plain; charset=CHARSET\n" | ||
17 | "Content-Transfer-Encoding: 8bit\n" | ||
18 | |||
19 | #. Type: boolean | ||
20 | #. Description | ||
21 | #: ../openssh-server.templates:1001 | ||
22 | msgid "Do you want to risk killing active SSH sessions?" | ||
23 | msgstr "" | ||
24 | |||
25 | #. Type: boolean | ||
26 | #. Description | ||
27 | #: ../openssh-server.templates:1001 | ||
28 | msgid "" | ||
29 | "The currently installed version of /etc/init.d/ssh is likely to kill all " | ||
30 | "running sshd instances. If you are doing this upgrade via an SSH session, " | ||
31 | "you're likely to be disconnected and leave the upgrade procedure unfinished." | ||
32 | msgstr "" | ||
33 | |||
34 | #. Type: boolean | ||
35 | #. Description | ||
36 | #: ../openssh-server.templates:1001 | ||
37 | msgid "" | ||
38 | "This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the " | ||
39 | "start-stop-daemon line in the stop section of the file." | ||
40 | msgstr "" | ||
41 | |||
42 | #. Type: note | ||
43 | #. Description | ||
44 | #: ../openssh-server.templates:2001 | ||
45 | msgid "New host key mandatory" | ||
46 | msgstr "" | ||
47 | |||
48 | #. Type: note | ||
49 | #. Description | ||
50 | #: ../openssh-server.templates:2001 | ||
51 | msgid "" | ||
52 | "The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA " | ||
53 | "algorithm. OpenSSH can not handle this host key file, and the ssh-keygen " | ||
54 | "utility from the old (non-free) SSH installation does not appear to be " | ||
55 | "available." | ||
56 | msgstr "" | ||
57 | |||
58 | #. Type: note | ||
59 | #. Description | ||
60 | #: ../openssh-server.templates:2001 | ||
61 | msgid "You need to manually generate a new host key." | ||
62 | msgstr "" | ||
63 | |||
64 | #. Type: boolean | ||
65 | #. Description | ||
66 | #: ../openssh-server.templates:3001 | ||
67 | msgid "Disable challenge-response authentication?" | ||
68 | msgstr "" | ||
69 | |||
70 | #. Type: boolean | ||
71 | #. Description | ||
72 | #: ../openssh-server.templates:3001 | ||
73 | msgid "" | ||
74 | "Password authentication appears to be disabled in the current OpenSSH server " | ||
75 | "configuration. In order to prevent users from logging in using passwords " | ||
76 | "(perhaps using only public key authentication instead) with recent versions " | ||
77 | "of OpenSSH, you must disable challenge-response authentication, or else " | ||
78 | "ensure that your PAM configuration does not allow Unix password file " | ||
79 | "authentication." | ||
80 | msgstr "" | ||
81 | |||
82 | #. Type: boolean | ||
83 | #. Description | ||
84 | #: ../openssh-server.templates:3001 | ||
85 | msgid "" | ||
86 | "If you disable challenge-response authentication, then users will not be " | ||
87 | "able to log in using passwords. If you leave it enabled (the default " | ||
88 | "answer), then the 'PasswordAuthentication no' option will have no useful " | ||
89 | "effect unless you also adjust your PAM configuration in /etc/pam.d/ssh." | ||
90 | msgstr "" | ||
91 | |||
92 | #. Type: note | ||
93 | #. Description | ||
94 | #: ../openssh-server.templates:4001 | ||
95 | msgid "Vulnerable host keys will be regenerated" | ||
96 | msgstr "" | ||
97 | |||
98 | #. Type: note | ||
99 | #. Description | ||
100 | #: ../openssh-server.templates:4001 | ||
101 | msgid "" | ||
102 | "Some of the OpenSSH server host keys on this system were generated with a " | ||
103 | "version of OpenSSL that had a broken random number generator. As a result, " | ||
104 | "these host keys are from a well-known set, are subject to brute-force " | ||
105 | "attacks, and must be regenerated." | ||
106 | msgstr "" | ||
107 | |||
108 | #. Type: note | ||
109 | #. Description | ||
110 | #: ../openssh-server.templates:4001 | ||
111 | msgid "" | ||
112 | "Users of this system should be informed of this change, as they will be " | ||
113 | "prompted about the host key change the next time they log in. Use 'ssh-" | ||
114 | "keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of " | ||
115 | "the new host keys." | ||
116 | msgstr "" | ||
117 | |||
118 | #. Type: note | ||
119 | #. Description | ||
120 | #: ../openssh-server.templates:4001 | ||
121 | msgid "The affected host keys are:" | ||
122 | msgstr "" | ||
123 | |||
124 | #. Type: note | ||
125 | #. Description | ||
126 | #: ../openssh-server.templates:4001 | ||
127 | msgid "" | ||
128 | "User keys may also be affected by this problem. The 'ssh-vulnkey' command " | ||
129 | "may be used as a partial test for this. See /usr/share/doc/openssh-server/" | ||
130 | "README.compromised-keys.gz for more details." | ||
131 | msgstr "" | ||
diff --git a/debian/po/tr.po b/debian/po/tr.po new file mode 100644 index 000000000..cff4ffae9 --- /dev/null +++ b/debian/po/tr.po | |||
@@ -0,0 +1,377 @@ | |||
1 | # Turkish translation of ssh. | ||
2 | # This file is distributed under the same license as the ssh package. | ||
3 | # Mert Dirik <mertdirik@gmail.com>, 2008. | ||
4 | # Recai OktaÅŸ <roktas@omu.edu.tr>, 2004. | ||
5 | # | ||
6 | msgid "" | ||
7 | msgstr "" | ||
8 | "Project-Id-Version: ssh\n" | ||
9 | "Report-Msgid-Bugs-To: openssh@packages.debian.org\n" | ||
10 | "POT-Creation-Date: 2010-01-02 08:55+0000\n" | ||
11 | "PO-Revision-Date: 2008-05-23 16:24+0200\n" | ||
12 | "Last-Translator: Mert Dirik <mertdirik@gmail.com>\n" | ||
13 | "Language-Team: Turkish <debian-l10n-turkish@lists.debian.org>\n" | ||
14 | "MIME-Version: 1.0\n" | ||
15 | "Content-Type: text/plain; charset=UTF-8\n" | ||
16 | "Content-Transfer-Encoding: 8bit\n" | ||
17 | "Plural-Forms: nplurals=1; plural=0;\n" | ||
18 | |||
19 | #. Type: boolean | ||
20 | #. Description | ||
21 | #: ../openssh-server.templates:1001 | ||
22 | msgid "Do you want to risk killing active SSH sessions?" | ||
23 | msgstr "Etkin SSH oturumlarının öldürülmesi riskini göze alıyor musunuz?" | ||
24 | |||
25 | #. Type: boolean | ||
26 | #. Description | ||
27 | #: ../openssh-server.templates:1001 | ||
28 | msgid "" | ||
29 | "The currently installed version of /etc/init.d/ssh is likely to kill all " | ||
30 | "running sshd instances. If you are doing this upgrade via an SSH session, " | ||
31 | "you're likely to be disconnected and leave the upgrade procedure unfinished." | ||
32 | msgstr "" | ||
33 | "Kurmuş olduğunuz /etc/init.d/ssh sürümü büyük olasılıkla, çalışıyor olan tüm " | ||
34 | "sshd süreçlerini öldürecek. Bu yükseltmeyi bir ssh oturumu üzerinden " | ||
35 | "yapıyorsanız büyük olasılıkla bağlantınız kopacak ve yükseltme işlemi yarım " | ||
36 | "kalacak." | ||
37 | |||
38 | #. Type: boolean | ||
39 | #. Description | ||
40 | #: ../openssh-server.templates:1001 | ||
41 | msgid "" | ||
42 | "This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the " | ||
43 | "start-stop-daemon line in the stop section of the file." | ||
44 | msgstr "" | ||
45 | "Bu sorunu dosyanın (/etc/init.d/ssh) stop bölümündeki start-stop-daemon " | ||
46 | "satırına \"--pidfile /var/run/sshd.pid\" ekleyerek düzeltebilirsiniz." | ||
47 | |||
48 | #. Type: note | ||
49 | #. Description | ||
50 | #: ../openssh-server.templates:2001 | ||
51 | msgid "New host key mandatory" | ||
52 | msgstr "Yeni makine anahtarı zorunlu" | ||
53 | |||
54 | #. Type: note | ||
55 | #. Description | ||
56 | #: ../openssh-server.templates:2001 | ||
57 | msgid "" | ||
58 | "The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA " | ||
59 | "algorithm. OpenSSH can not handle this host key file, and the ssh-keygen " | ||
60 | "utility from the old (non-free) SSH installation does not appear to be " | ||
61 | "available." | ||
62 | msgstr "" | ||
63 | "Şu anda kullandığınız makine anahtarı, /etc/ssh/ssh_host_key, IDEA " | ||
64 | "algoritmasıyla şifrelenmiş. OpenSSH bu anahtar dosyasını yönetemez; ayrıca " | ||
65 | "eski (özgür olmayan) SSH kurulumuna ait ssh-keygen aracı da ulaşılabilir " | ||
66 | "deÄŸil." | ||
67 | |||
68 | #. Type: note | ||
69 | #. Description | ||
70 | #: ../openssh-server.templates:2001 | ||
71 | msgid "You need to manually generate a new host key." | ||
72 | msgstr "Yeni bir makine anahtarı oluşturmanız gerekiyor." | ||
73 | |||
74 | #. Type: boolean | ||
75 | #. Description | ||
76 | #: ../openssh-server.templates:3001 | ||
77 | msgid "Disable challenge-response authentication?" | ||
78 | msgstr "Sorgula-yanıtla yöntemiyle kimlik doğrulama devre dışı bırakılsın mı?" | ||
79 | |||
80 | #. Type: boolean | ||
81 | #. Description | ||
82 | #: ../openssh-server.templates:3001 | ||
83 | msgid "" | ||
84 | "Password authentication appears to be disabled in the current OpenSSH server " | ||
85 | "configuration. In order to prevent users from logging in using passwords " | ||
86 | "(perhaps using only public key authentication instead) with recent versions " | ||
87 | "of OpenSSH, you must disable challenge-response authentication, or else " | ||
88 | "ensure that your PAM configuration does not allow Unix password file " | ||
89 | "authentication." | ||
90 | msgstr "" | ||
91 | "Şu anda kullanılan OpenSSH yapılandırmasında parola ile kimlik doğrulama " | ||
92 | "devre dışı gibi görünüyor. OpenSSH'ın yeni versiyonlarında kullanıcıların " | ||
93 | "parola kullanarak oturum açmalarını engellemek için (belki bunun yerine " | ||
94 | "açık anahtar yöntemiyle kimlik doğrulamayı kullanabilirsiniz) sorgula-" | ||
95 | "yanıtla yöntemiyle kimlik doğrulamayı devre dışı bırakmalı ya da PAM " | ||
96 | "yapılandırmanızın Unix parola dosyası yöntemiyle kimlik doğrulamaya izin " | ||
97 | "vermediğinden emin olmalısınız." | ||
98 | |||
99 | #. Type: boolean | ||
100 | #. Description | ||
101 | #: ../openssh-server.templates:3001 | ||
102 | msgid "" | ||
103 | "If you disable challenge-response authentication, then users will not be " | ||
104 | "able to log in using passwords. If you leave it enabled (the default " | ||
105 | "answer), then the 'PasswordAuthentication no' option will have no useful " | ||
106 | "effect unless you also adjust your PAM configuration in /etc/pam.d/ssh." | ||
107 | msgstr "" | ||
108 | "Sorgula-yanıtla kimlik doğrulamayı devre dışı bırakırsanız, kullanıcılar " | ||
109 | "parola kullanarak oturum açamayacaklar. Eğer sorgula-yanıtla kimlik " | ||
110 | "doğrulamayı etkin halde bırakırsanız (öntanımlı yanıt); /etc/pam.d/ssh'daki " | ||
111 | "PAM yapılandırmasını ayarlamadığınız sürece 'PasswordAuthentication no' " | ||
112 | "seçeneği bir işe yaramayacak." | ||
113 | |||
114 | #. Type: note | ||
115 | #. Description | ||
116 | #: ../openssh-server.templates:4001 | ||
117 | msgid "Vulnerable host keys will be regenerated" | ||
118 | msgstr "Saldırıya açık makine anahtarları yeniden yaratılacak" | ||
119 | |||
120 | #. Type: note | ||
121 | #. Description | ||
122 | #: ../openssh-server.templates:4001 | ||
123 | msgid "" | ||
124 | "Some of the OpenSSH server host keys on this system were generated with a " | ||
125 | "version of OpenSSL that had a broken random number generator. As a result, " | ||
126 | "these host keys are from a well-known set, are subject to brute-force " | ||
127 | "attacks, and must be regenerated." | ||
128 | msgstr "" | ||
129 | "Bu sistemdeki OpenSSH sunucusu makine anahtarlarından bazıları OpenSSL'in " | ||
130 | "rastgele sayı üreticisi bozuk olan bir versiyonuyla oluşturulmuş. Sonuç " | ||
131 | "olarak, bu makine anahtarları iyi bilinen bir gruptan ve kaba kuvvet " | ||
132 | "saldırılarına açık. Bu anahtarlar yeniden oluşturulmalı." | ||
133 | |||
134 | #. Type: note | ||
135 | #. Description | ||
136 | #: ../openssh-server.templates:4001 | ||
137 | msgid "" | ||
138 | "Users of this system should be informed of this change, as they will be " | ||
139 | "prompted about the host key change the next time they log in. Use 'ssh-" | ||
140 | "keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of " | ||
141 | "the new host keys." | ||
142 | msgstr "" | ||
143 | "Bu sistemin kullanıcılarını makine anahtarı değişikliğinden haberdar " | ||
144 | "etmelisiniz, çünkü kullanıcılar sisteme ilk oturum açışlarında uyarılacak " | ||
145 | "ve kullanıcılara oturum açmaya devam etmek isteyip istemedikleri sorulacak. " | ||
146 | "Yeni makine anahtarlarının parmak izlerini görmek için yükseltmeden sonra " | ||
147 | "'ssh-keygen -l -f MAKİNE_ANAHTARI_DOSYASI' komutunu kullanın." | ||
148 | |||
149 | #. Type: note | ||
150 | #. Description | ||
151 | #: ../openssh-server.templates:4001 | ||
152 | msgid "The affected host keys are:" | ||
153 | msgstr "Etkilenmiş makine anahtarları:" | ||
154 | |||
155 | #. Type: note | ||
156 | #. Description | ||
157 | #: ../openssh-server.templates:4001 | ||
158 | msgid "" | ||
159 | "User keys may also be affected by this problem. The 'ssh-vulnkey' command " | ||
160 | "may be used as a partial test for this. See /usr/share/doc/openssh-server/" | ||
161 | "README.compromised-keys.gz for more details." | ||
162 | msgstr "" | ||
163 | "Kullanıcı anahtarları da bu sorundan etkilenebilir. 'ssh-vulnkey' komutu bu " | ||
164 | "sorun için kısmi bir test olarak kullanılabilir. Ayrıntılar için /usr/share/" | ||
165 | "doc/openssh-server/README.compromised-keys.gz belgesine bakın." | ||
166 | |||
167 | #~ msgid "Generate a new configuration file for OpenSSH?" | ||
168 | #~ msgstr "OpenSSH için yeni yapılandırma dosyası oluşturulsun mu?" | ||
169 | |||
170 | #~ msgid "" | ||
171 | #~ "This version of OpenSSH has a considerably changed configuration file " | ||
172 | #~ "from the version shipped in Debian 'Potato', which you appear to be " | ||
173 | #~ "upgrading from. This package can now generate a new configuration file (/" | ||
174 | #~ "etc/ssh/sshd.config), which will work with the new server version, but " | ||
175 | #~ "will not contain any customizations you made with the old version." | ||
176 | #~ msgstr "" | ||
177 | #~ "Debian 'Potato' dağıtımından yükseltme yapmış gibi görünüyorsunuz. " | ||
178 | #~ "OpenSSH'ın bu sürümü Debian 'Potato' ile birlikte gelen sürümden çok " | ||
179 | #~ "farklı bir yapılandırma dosyası kullanmakta. Bu paket şimdi sizin için " | ||
180 | #~ "yeni bir yapılandırma dosyası (/etc/ssh/sshd.config) üretebilir. Bu dosya " | ||
181 | #~ "yeni sunucu sürümüyle çalışacak, fakat eski sürümde yaptığınız " | ||
182 | #~ "özelleştirmeleri içermeyecek." | ||
183 | |||
184 | #~| msgid "" | ||
185 | #~| "Please note that this new configuration file will set the value of " | ||
186 | #~| "'PermitRootLogin' to yes (meaning that anyone knowing the root password " | ||
187 | #~| "can ssh directly in as root). It is the opinion of the maintainer that " | ||
188 | #~| "this is the correct default (see README.Debian for more details), but " | ||
189 | #~| "you can always edit sshd_config and set it to no if you wish." | ||
190 | #~ msgid "" | ||
191 | #~ "Please note that this new configuration file will set the value of " | ||
192 | #~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password " | ||
193 | #~ "can ssh directly in as root). Please read the README.Debian file for more " | ||
194 | #~ "details about this design choice." | ||
195 | #~ msgstr "" | ||
196 | #~ "Yeni yapılandırma dosyasının 'PermitRootLogin' seçeneğini 'yes' olarak " | ||
197 | #~ "ayarlayacağını (yani root parolasını bilen herhangi birisinin ssh ile " | ||
198 | #~ "doğrudan sisteme girebileceğini) unutmayın. Öntanımlı ayarın böyle olması " | ||
199 | #~ "gerektiği paket geliştiricisinin kanaatidir (ayrıntılar için README." | ||
200 | #~ "Debian dosyasını okuyun)." | ||
201 | |||
202 | #~ msgid "" | ||
203 | #~ "It is strongly recommended that you choose to generate a new " | ||
204 | #~ "configuration file now." | ||
205 | #~ msgstr "" | ||
206 | #~ "Şimdi yeni bir yapılandırma dosyası üretmeyi seçmeniz kuvvetle tavsiye " | ||
207 | #~ "edilir." | ||
208 | |||
209 | #~ msgid "Warning: you must create a new host key" | ||
210 | #~ msgstr "Uyarı: yeni bir makine anahtarı oluşturmalısınız" | ||
211 | |||
212 | #~ msgid "Warning: telnetd is installed --- probably not a good idea" | ||
213 | #~ msgstr "Uyarı: telnetd kurulmuş --- bu muhtemelen iyi bir fikir değil" | ||
214 | |||
215 | #~ msgid "" | ||
216 | #~ "I'd advise you to either remove the telnetd package (if you don't " | ||
217 | #~ "actually need to offer telnet access) or install telnetd-ssl so that " | ||
218 | #~ "there is at least some chance that telnet sessions will not be sending " | ||
219 | #~ "unencrypted login/password and session information over the network." | ||
220 | #~ msgstr "" | ||
221 | #~ "Telnetd paketini (eğer gerçekten telnet erişimi sunmak gibi bir " | ||
222 | #~ "zorunluluğunuz yoksa) kaldırmanızı veya en azından, telnet oturumlarında " | ||
223 | #~ "şifrelenmemiş giriş/parola ve oturum bilgilerinin ağ üzerinden " | ||
224 | #~ "gönderilmemesi olanağını sunan telnetd-ssl paketini kurmanızı öneririm." | ||
225 | |||
226 | #~ msgid "Warning: rsh-server is installed --- probably not a good idea" | ||
227 | #~ msgstr "Uyarı: rsh-server kurulmuş --- bu muhtemelen iyi bir fikir değil" | ||
228 | |||
229 | #~ msgid "" | ||
230 | #~ "having rsh-server installed undermines the security that you were " | ||
231 | #~ "probably wanting to obtain by installing ssh. I'd advise you to remove " | ||
232 | #~ "that package." | ||
233 | #~ msgstr "" | ||
234 | #~ "rsh-server'ın kurulu durumda olması muhtemelen ssh'ı kurmakla elde " | ||
235 | #~ "edilmesini istediğiniz güvenliği gölgeliyor. Bu paketi kaldırmanızı " | ||
236 | #~ "öneririm." | ||
237 | |||
238 | #~ msgid "Do you want ssh-keysign to be installed SUID root?" | ||
239 | #~ msgstr "" | ||
240 | #~ "ssh-keysign'ın root haklarıyla kurulmasını (SUID root) ister misiniz?" | ||
241 | |||
242 | #~ msgid "" | ||
243 | #~ "You have the option of installing the ssh-keysign helper with the SUID " | ||
244 | #~ "bit set." | ||
245 | #~ msgstr "" | ||
246 | #~ "ssh-keysign yardımcı aracının SUID bit'i etkinleştirilerek kurulması " | ||
247 | #~ "seçeneğine sahipsiniz." | ||
248 | |||
249 | #~ msgid "" | ||
250 | #~ "If you make ssh-keysign SUID, you will be able to use SSH's Protocol 2 " | ||
251 | #~ "host-based authentication." | ||
252 | #~ msgstr "" | ||
253 | #~ "Eğer ssh-keysign'ı SUID yaparsanız, SSH'ın makine tabanlı Protokol 2 " | ||
254 | #~ "yetkilendirmesini kullanabileceksiniz." | ||
255 | |||
256 | #~ msgid "" | ||
257 | #~ "If in doubt, I suggest you install it with SUID. If it causes problems " | ||
258 | #~ "you can change your mind later by running: dpkg-reconfigure ssh" | ||
259 | #~ msgstr "" | ||
260 | #~ "Bu konuda şüpheliyseniz, size SUID'li kurulumu öneririm. Eğer bu " | ||
261 | #~ "sorunlara yol açarsa ileride fikrinizi değiştirmek için şu komutu " | ||
262 | #~ "çalıştırabilirsiniz: dpkg-reconfigure ssh" | ||
263 | |||
264 | #~ msgid "Allow SSH protocol 2 only" | ||
265 | #~ msgstr "Sadece SSH protokol 2'ye izin ver" | ||
266 | |||
267 | #~ msgid "" | ||
268 | #~ "This version of OpenSSH supports version 2 of the ssh protocol, which is " | ||
269 | #~ "much more secure. Disabling ssh 1 is encouraged, however this will slow " | ||
270 | #~ "things down on low end machines and might prevent older clients from " | ||
271 | #~ "connecting (the ssh client shipped with \"potato\" is affected)." | ||
272 | #~ msgstr "" | ||
273 | #~ "OpenSSH'ın bu sürümü ssh'ın çok daha güvenli olan sürüm 2 protokolünü " | ||
274 | #~ "destekler. Sürüm 1 protokolünün etkisizleştirilmesini teşvik ediyoruz, " | ||
275 | #~ "bununla beraber böyle yapılması halinde düşük düzeyli makinelerde " | ||
276 | #~ "işlemler yavaşlayacak ve eski sürüm ssh istemcilerinden (\"potato\" ile " | ||
277 | #~ "birlikte gelen ssh istemcisi gibi) bağlantı kurulamayacaktır." | ||
278 | |||
279 | #~ msgid "" | ||
280 | #~ "Also please note that keys used for protocol 1 are different so you will " | ||
281 | #~ "not be able to use them if you only allow protocol 2 connections." | ||
282 | #~ msgstr "" | ||
283 | #~ "Protokol 1 anahtarları çok farklı olduğundan, sadece protokol 2 " | ||
284 | #~ "bağlantılarına izin vermeniz halinde bu anahtarları kullanamayacağınızı " | ||
285 | #~ "da lütfen not edin." | ||
286 | |||
287 | #~ msgid "" | ||
288 | #~ "If you later change your mind about this setting, README.Debian has " | ||
289 | #~ "instructions on what to do to your sshd_config file." | ||
290 | #~ msgstr "" | ||
291 | #~ "Bu ayar hakkındaki fikriniz ileride değişirse, sshd_config dosyasında " | ||
292 | #~ "yapacağınız işlemlerle ilgili talimatları README.Debian dosyasında " | ||
293 | #~ "bulabilirsiniz." | ||
294 | |||
295 | #~ msgid "NOTE: Forwarding of X11 and Authorization disabled by default." | ||
296 | #~ msgstr "" | ||
297 | #~ "NOT: X11 yönlendirme ve yetkilendirmesi öntanımlı olarak " | ||
298 | #~ "etkisizleÅŸtirilmiÅŸtir." | ||
299 | |||
300 | #~ msgid "" | ||
301 | #~ "For security reasons, the Debian version of ssh has ForwardX11 and " | ||
302 | #~ "ForwardAgent set to ``off'' by default." | ||
303 | #~ msgstr "" | ||
304 | #~ "Güvenlik gerekçeleriyle ssh'ın Debian sürümünde ForwardX11 ve " | ||
305 | #~ "ForwardAgent seçenekleri öntanımlı ``off'' değerine ayarlıdır." | ||
306 | |||
307 | #~ msgid "" | ||
308 | #~ "You can enable it for servers you trust, either in one of the " | ||
309 | #~ "configuration files, or with the -X command line option." | ||
310 | #~ msgstr "" | ||
311 | #~ "Güvendiğiniz sunucular için bu seçeneği yapılandırma dosyalarından " | ||
312 | #~ "birinde veya -X komut satırı seçeneğiyle etkinleştirebilirsiniz." | ||
313 | |||
314 | #~ msgid "More details can be found in /usr/share/doc/ssh/README.Debian" | ||
315 | #~ msgstr "" | ||
316 | #~ "Daha ayrıntılı bilgi /usr/share/doc/ssh/README.Debian dosyasında " | ||
317 | #~ "bulunabilir." | ||
318 | |||
319 | #~ msgid "ssh2 keys merged in configuration files" | ||
320 | #~ msgstr "yapılandırma dosyalarındaki ssh2 anahtarları birleştirildi" | ||
321 | |||
322 | #~ msgid "" | ||
323 | #~ "As of version 3 OpenSSH no longer uses separate files for ssh1 and ssh2 " | ||
324 | #~ "keys. This means the authorized_keys2 and known_hosts2 files are no " | ||
325 | #~ "longer needed. They will still be read in order to maintain backwards " | ||
326 | #~ "compatibility" | ||
327 | #~ msgstr "" | ||
328 | #~ "Sürüm 3 itibarıyla OpenSSH artık, ssh1 ve ssh2 için ayrı yapılandırma " | ||
329 | #~ "dosyaları kullanmamaktadır. Bu, authorized_keys2 ve known_hosts2 " | ||
330 | #~ "dosyalarının artık gerekmediği anlamına gelir. Geriye doğru uyumluluğu " | ||
331 | #~ "korumak için bu dosyalar yine de okunacaktır." | ||
332 | |||
333 | #~ msgid "Do you want to run the sshd server?" | ||
334 | #~ msgstr "SSH sunucusu sshd'yi çalıştırmak istiyor musunuz?" | ||
335 | |||
336 | #~ msgid "This package contains both the ssh client, and the sshd server." | ||
337 | #~ msgstr "Bu paket hem ssh istemcisini hem de sshd sunucusunu içeriyor." | ||
338 | |||
339 | #~ msgid "" | ||
340 | #~ "Normally the sshd Secure Shell Server will be run to allow remote logins " | ||
341 | #~ "via ssh." | ||
342 | #~ msgstr "" | ||
343 | #~ "Güvenli Kabuk Sunucusu sshd, normalde ssh ile uzaktan girişlere izin " | ||
344 | #~ "vermek için çalıştırılacaktır." | ||
345 | |||
346 | #~ msgid "" | ||
347 | #~ "If you are only interested in using the ssh client for outbound " | ||
348 | #~ "connections on this machine, and don't want to log into it at all using " | ||
349 | #~ "ssh, then you can disable sshd here." | ||
350 | #~ msgstr "" | ||
351 | #~ "Eğer amacınız sadece bu makinedeki dış bağlantılar için ssh istemcisini " | ||
352 | #~ "kullanmak ise ve bu makineye ssh'la girmek gibi bir ÅŸeyi de " | ||
353 | #~ "istemiyorsanız, sshd sunucusunu bu adımda etkisizleştirebilirsiniz." | ||
354 | |||
355 | #~ msgid "Environment options on keys have been deprecated" | ||
356 | #~ msgstr "Anahtarlara ilişkin ortam seçenekleri geçerliliğini kaybetmiştir" | ||
357 | |||
358 | #~ msgid "" | ||
359 | #~ "This version of OpenSSH disables the environment option for public keys " | ||
360 | #~ "by default, in order to avoid certain attacks (for example, LD_PRELOAD). " | ||
361 | #~ "If you are using this option in an authorized_keys file, beware that the " | ||
362 | #~ "keys in question will no longer work until the option is removed." | ||
363 | #~ msgstr "" | ||
364 | #~ "OpenSSH'ın bu sürümü belirli atakları önlemek için (ör. LD_PRELOAD) ortak " | ||
365 | #~ "anahtarlara ait ortam seçeneklerini öntanımlı olarak etkisizleştirir. " | ||
366 | #~ "Eğer bu seçeneği bir authorized_keys dosyasında kullanıyorsanız, ilgili " | ||
367 | #~ "seçenek silininceye kadar bu anahtarın artık çalışmayacağını unutmayın." | ||
368 | |||
369 | #~ msgid "" | ||
370 | #~ "To re-enable this option, set \"PermitUserEnvironment yes\" in /etc/ssh/" | ||
371 | #~ "sshd_config after the upgrade is complete, taking note of the warning in " | ||
372 | #~ "the sshd_config(5) manual page." | ||
373 | #~ msgstr "" | ||
374 | #~ "Bu seçeneği tekrar etkinleştirmek için, sshd_config(5) kılavuz " | ||
375 | #~ "sayfasındaki uyarı notunu dikkate alarak, sshd yükseltmesi " | ||
376 | #~ "tamamlandığında /etc/ssh/ssh_config dosyasında \"PermitUserEnvironment yes" | ||
377 | #~ "\" satırını kullanın." | ||
diff --git a/debian/po/uk.po b/debian/po/uk.po new file mode 100644 index 000000000..7663a96c0 --- /dev/null +++ b/debian/po/uk.po | |||
@@ -0,0 +1,387 @@ | |||
1 | # translation of openssh to Ukrainian | ||
2 | # | ||
3 | # Translators, if you are not familiar with the PO format, gettext | ||
4 | # documentation is worth reading, especially sections dedicated to | ||
5 | # this format, e.g. by running: | ||
6 | # info -n '(gettext)PO Files' | ||
7 | # info -n '(gettext)Header Entry' | ||
8 | # Some information specific to po-debconf are available at | ||
9 | # /usr/share/doc/po-debconf/README-trans | ||
10 | # or http://www.debian.org/intl/l10n/po-debconf/README-trans# | ||
11 | # Developers do not need to manually edit POT or PO files. | ||
12 | # Eugeniy Meshcheryakov <eugen@univ.kiev.ua>, 2005. | ||
13 | # | ||
14 | msgid "" | ||
15 | msgstr "" | ||
16 | "Project-Id-Version: openssh-uk\n" | ||
17 | "Report-Msgid-Bugs-To: openssh@packages.debian.org\n" | ||
18 | "POT-Creation-Date: 2010-01-02 08:55+0000\n" | ||
19 | "PO-Revision-Date: 2005-03-28 22:28+0300\n" | ||
20 | "Last-Translator: Eugeniy Meshcheryakov <eugen@univ.kiev.ua>\n" | ||
21 | "Language-Team: Ukrainian\n" | ||
22 | "MIME-Version: 1.0\n" | ||
23 | "Content-Type: text/plain; charset=UTF-8\n" | ||
24 | "Content-Transfer-Encoding: 8bit\n" | ||
25 | "X-Generator: KBabel 1.9.1\n" | ||
26 | "Plural-Forms: nplurals=3; plural=(n%10==1 && n%100!=11 ? 0 : n%10>=2 && n%" | ||
27 | "10<=4 && (n%100<10 || n%100>=20) ? 1 : 2);\n" | ||
28 | |||
29 | #. Type: boolean | ||
30 | #. Description | ||
31 | #: ../openssh-server.templates:1001 | ||
32 | #, fuzzy | ||
33 | #| msgid "Do you want to continue (and risk killing active ssh sessions)?" | ||
34 | msgid "Do you want to risk killing active SSH sessions?" | ||
35 | msgstr "" | ||
36 | "Чи бажаєте ви продовжувати (та ризикувати втратити активні ÑеанÑи ssh)?" | ||
37 | |||
38 | #. Type: boolean | ||
39 | #. Description | ||
40 | #: ../openssh-server.templates:1001 | ||
41 | #, fuzzy | ||
42 | #| msgid "" | ||
43 | #| "The version of /etc/init.d/ssh that you have installed, is likely to kill " | ||
44 | #| "all running sshd instances. If you are doing this upgrade via an ssh " | ||
45 | #| "session, that would be a Bad Thing(tm)." | ||
46 | msgid "" | ||
47 | "The currently installed version of /etc/init.d/ssh is likely to kill all " | ||
48 | "running sshd instances. If you are doing this upgrade via an SSH session, " | ||
49 | "you're likely to be disconnected and leave the upgrade procedure unfinished." | ||
50 | msgstr "" | ||
51 | "ВерÑÑ–Ñ /etc/init.d/ssh, Ñку ви вÑтановили, імовірно зупинить вÑÑ– запущені " | ||
52 | "процеÑи sshd. Якщо ви оновлюєтеÑÑ Ñ‡ÐµÑ€ÐµÐ· ssh, це буде Погана річ (tm)." | ||
53 | |||
54 | #. Type: boolean | ||
55 | #. Description | ||
56 | #: ../openssh-server.templates:1001 | ||
57 | #, fuzzy | ||
58 | #| msgid "" | ||
59 | #| "You can fix this by adding \"--pidfile /var/run/sshd.pid\" to the start-" | ||
60 | #| "stop-daemon line in the stop section of the file." | ||
61 | msgid "" | ||
62 | "This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the " | ||
63 | "start-stop-daemon line in the stop section of the file." | ||
64 | msgstr "" | ||
65 | "Ви можете виправити це, додавши \"--pidfile /var/run/sshd.pid\" до Ñ€Ñдка з " | ||
66 | "викликом start-stop-daemon в чаÑтині зупинки цього файла." | ||
67 | |||
68 | #. Type: note | ||
69 | #. Description | ||
70 | #: ../openssh-server.templates:2001 | ||
71 | msgid "New host key mandatory" | ||
72 | msgstr "" | ||
73 | |||
74 | #. Type: note | ||
75 | #. Description | ||
76 | #: ../openssh-server.templates:2001 | ||
77 | #, fuzzy | ||
78 | msgid "" | ||
79 | "The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA " | ||
80 | "algorithm. OpenSSH can not handle this host key file, and the ssh-keygen " | ||
81 | "utility from the old (non-free) SSH installation does not appear to be " | ||
82 | "available." | ||
83 | msgstr "" | ||
84 | "Старий ключ в /etc/ssh/ssh_host_key зашифрований за допомогою IDEA. OpenSSH " | ||
85 | "не може оброблÑти такий файл ключа вузла, також неможливо знайти програму " | ||
86 | "ssh-keygen зі Ñтарої (невільної) верÑÑ–Ñ— SSH." | ||
87 | |||
88 | #. Type: note | ||
89 | #. Description | ||
90 | #: ../openssh-server.templates:2001 | ||
91 | #, fuzzy | ||
92 | #| msgid "You will need to generate a new host key." | ||
93 | msgid "You need to manually generate a new host key." | ||
94 | msgstr "Вам потрібно Ñтворити новий ключ вузла." | ||
95 | |||
96 | #. Type: boolean | ||
97 | #. Description | ||
98 | #: ../openssh-server.templates:3001 | ||
99 | msgid "Disable challenge-response authentication?" | ||
100 | msgstr "Заборонити автентифікацію запит-відповідь?" | ||
101 | |||
102 | #. Type: boolean | ||
103 | #. Description | ||
104 | #: ../openssh-server.templates:3001 | ||
105 | #, fuzzy | ||
106 | #| msgid "" | ||
107 | #| "Password authentication appears to be disabled in your current OpenSSH " | ||
108 | #| "server configuration. In order to prevent users from logging in using " | ||
109 | #| "passwords (perhaps using only public key authentication instead) with " | ||
110 | #| "recent versions of OpenSSH, you must disable challenge-response " | ||
111 | #| "authentication, or else ensure that your PAM configuration does not allow " | ||
112 | #| "Unix password file authentication." | ||
113 | msgid "" | ||
114 | "Password authentication appears to be disabled in the current OpenSSH server " | ||
115 | "configuration. In order to prevent users from logging in using passwords " | ||
116 | "(perhaps using only public key authentication instead) with recent versions " | ||
117 | "of OpenSSH, you must disable challenge-response authentication, or else " | ||
118 | "ensure that your PAM configuration does not allow Unix password file " | ||
119 | "authentication." | ||
120 | msgstr "" | ||
121 | "Схоже, що Ð°Ð²Ñ‚ÐµÐ½Ñ‚Ð¸Ñ„Ñ–ÐºÐ°Ñ†Ñ–Ñ Ð· викориÑтаннÑм паролів заборонена у поточній " | ||
122 | "конфігурації Ñервера OpenSSH. Щоб перешкодити кориÑтувачам реєÑтруватиÑÑ Ð· " | ||
123 | "викориÑтаннÑм паролів (можливо, Ð´Ð»Ñ Ð°Ð²Ñ‚ÐµÐ½Ñ‚Ð¸Ñ„Ñ–ÐºÐ°Ñ†Ñ–Ñ— тільки за допомогою " | ||
124 | "відкритих ключів) з оÑтанніми верÑÑ–Ñми OpenSSH, необхідно заборонити " | ||
125 | "автентифікацію виклик-відгук або впевнитиÑÑ, що Ð½Ð°Ð»Ð°ÑˆÑ‚ÑƒÐ²Ð°Ð½Ð½Ñ PAM не " | ||
126 | "дозволÑÑŽÑ‚ÑŒ автентифікацію за допомогою файла паролів Unix." | ||
127 | |||
128 | #. Type: boolean | ||
129 | #. Description | ||
130 | #: ../openssh-server.templates:3001 | ||
131 | msgid "" | ||
132 | "If you disable challenge-response authentication, then users will not be " | ||
133 | "able to log in using passwords. If you leave it enabled (the default " | ||
134 | "answer), then the 'PasswordAuthentication no' option will have no useful " | ||
135 | "effect unless you also adjust your PAM configuration in /etc/pam.d/ssh." | ||
136 | msgstr "" | ||
137 | "Якщо ви забороните автентифікацію виклик-відгук, то ваші кориÑтувачі не " | ||
138 | "зможуть реєÑтруватиÑÑ Ð²Ð¸ÐºÐ¾Ñ€Ð¸Ñтовуючи паролі. Якщо ви залишите Ñ—Ñ— дозволеною " | ||
139 | "(відповідь за замовчаннÑм), то Ð¾Ð¿Ñ†Ñ–Ñ 'PasswordAuthentication no' не буде " | ||
140 | "мати кориÑного ефекту доки ви не приÑтоÑуєте також Ð½Ð°Ð»Ð°ÑˆÑ‚ÑƒÐ²Ð°Ð½Ð½Ñ PAM в /etc/" | ||
141 | "pam.d/ssh." | ||
142 | |||
143 | #. Type: note | ||
144 | #. Description | ||
145 | #: ../openssh-server.templates:4001 | ||
146 | msgid "Vulnerable host keys will be regenerated" | ||
147 | msgstr "" | ||
148 | |||
149 | #. Type: note | ||
150 | #. Description | ||
151 | #: ../openssh-server.templates:4001 | ||
152 | msgid "" | ||
153 | "Some of the OpenSSH server host keys on this system were generated with a " | ||
154 | "version of OpenSSL that had a broken random number generator. As a result, " | ||
155 | "these host keys are from a well-known set, are subject to brute-force " | ||
156 | "attacks, and must be regenerated." | ||
157 | msgstr "" | ||
158 | |||
159 | #. Type: note | ||
160 | #. Description | ||
161 | #: ../openssh-server.templates:4001 | ||
162 | msgid "" | ||
163 | "Users of this system should be informed of this change, as they will be " | ||
164 | "prompted about the host key change the next time they log in. Use 'ssh-" | ||
165 | "keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of " | ||
166 | "the new host keys." | ||
167 | msgstr "" | ||
168 | |||
169 | #. Type: note | ||
170 | #. Description | ||
171 | #: ../openssh-server.templates:4001 | ||
172 | msgid "The affected host keys are:" | ||
173 | msgstr "" | ||
174 | |||
175 | #. Type: note | ||
176 | #. Description | ||
177 | #: ../openssh-server.templates:4001 | ||
178 | msgid "" | ||
179 | "User keys may also be affected by this problem. The 'ssh-vulnkey' command " | ||
180 | "may be used as a partial test for this. See /usr/share/doc/openssh-server/" | ||
181 | "README.compromised-keys.gz for more details." | ||
182 | msgstr "" | ||
183 | |||
184 | #, fuzzy | ||
185 | #~ msgid "Generate a new configuration file for OpenSSH?" | ||
186 | #~ msgstr "Створити новий файл налаштувань" | ||
187 | |||
188 | #, fuzzy | ||
189 | #~ msgid "" | ||
190 | #~ "This version of OpenSSH has a considerably changed configuration file " | ||
191 | #~ "from the version shipped in Debian 'Potato', which you appear to be " | ||
192 | #~ "upgrading from. This package can now generate a new configuration file (/" | ||
193 | #~ "etc/ssh/sshd.config), which will work with the new server version, but " | ||
194 | #~ "will not contain any customizations you made with the old version." | ||
195 | #~ msgstr "" | ||
196 | #~ "Ð’ цій верÑÑ–Ñ— OpenSSH значно змінений файл налаштувань, в порівнÑнні з " | ||
197 | #~ "верÑією, що входила в Debian 'Potato', Ñ– Ñку ви, Ñхоже, оновлюєте. Зараз " | ||
198 | #~ "можна Ñтворити новий файл налаштувань (/etc/ssh/sshd.config), що буде " | ||
199 | #~ "працювати з новою верÑією Ñервера, але не буде міÑтити будь-Ñкі зміни, " | ||
200 | #~ "Ñкі ви внеÑли у Ñтару верÑÑ–ÑŽ." | ||
201 | |||
202 | #, fuzzy | ||
203 | #~| msgid "" | ||
204 | #~| "Please note that this new configuration file will set the value of " | ||
205 | #~| "'PermitRootLogin' to yes (meaning that anyone knowing the root password " | ||
206 | #~| "can ssh directly in as root). It is the opinion of the maintainer that " | ||
207 | #~| "this is the correct default (see README.Debian for more details), but " | ||
208 | #~| "you can always edit sshd_config and set it to no if you wish." | ||
209 | #~ msgid "" | ||
210 | #~ "Please note that this new configuration file will set the value of " | ||
211 | #~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password " | ||
212 | #~ "can ssh directly in as root). Please read the README.Debian file for more " | ||
213 | #~ "details about this design choice." | ||
214 | #~ msgstr "" | ||
215 | #~ "Зауважте, що в новій верÑÑ–Ñ— файла налаштувань змінна 'PermitRootLogin' " | ||
216 | #~ "буде мати Ð·Ð½Ð°Ñ‡ÐµÐ½Ð½Ñ yes (що означає, що будь-Ñка людина, котра знає пароль " | ||
217 | #~ "кориÑтувача root, зможе увійти в ÑиÑтему через ssh). Ðа думку " | ||
218 | #~ "Ñупроводжуючого пакунку - це вірне Ð·Ð½Ð°Ñ‡ÐµÐ½Ð½Ñ Ð·Ð° замовчаннÑм (дивітьÑÑ " | ||
219 | #~ "також README.Debian), але ви завжди можете змінити Ð·Ð½Ð°Ñ‡ÐµÐ½Ð½Ñ Ñ†ÑŒÐ¾Ð³Ð¾ " | ||
220 | #~ "параметра у файлі sshd_config." | ||
221 | |||
222 | #, fuzzy | ||
223 | #~ msgid "" | ||
224 | #~ "It is strongly recommended that you choose to generate a new " | ||
225 | #~ "configuration file now." | ||
226 | #~ msgstr "РекомендуєтьÑÑ Ð´Ð¾Ð·Ð²Ð¾Ð»Ð¸Ñ‚Ð¸ Ñтворити новий файл налаштувань." | ||
227 | |||
228 | #~ msgid "Warning: you must create a new host key" | ||
229 | #~ msgstr "ПопередженнÑ: ви повинні Ñтворити новий ключ вузла" | ||
230 | |||
231 | #~ msgid "Warning: telnetd is installed --- probably not a good idea" | ||
232 | #~ msgstr "ПопередженнÑ: telnetd вÑтановлений - це погана ідеÑ" | ||
233 | |||
234 | #~ msgid "" | ||
235 | #~ "I'd advise you to either remove the telnetd package (if you don't " | ||
236 | #~ "actually need to offer telnet access) or install telnetd-ssl so that " | ||
237 | #~ "there is at least some chance that telnet sessions will not be sending " | ||
238 | #~ "unencrypted login/password and session information over the network." | ||
239 | #~ msgstr "" | ||
240 | #~ "РекомендуєтьÑÑ Ð°Ð±Ð¾ видалити пакунок telnetd (Ñкщо вам не потрібно " | ||
241 | #~ "надавати доÑтуп через telnet), або вÑтановити telnetd-ssl, щоб мати " | ||
242 | #~ "можливіÑÑ‚ÑŒ не передавати незашифровані логін/пароль та іншу інформацію " | ||
243 | #~ "через мережу." | ||
244 | |||
245 | #~ msgid "Warning: rsh-server is installed --- probably not a good idea" | ||
246 | #~ msgstr "ПопередженнÑ: rsh-server вÑтановлений - це погана ідеÑ" | ||
247 | |||
248 | #~ msgid "" | ||
249 | #~ "having rsh-server installed undermines the security that you were " | ||
250 | #~ "probably wanting to obtain by installing ssh. I'd advise you to remove " | ||
251 | #~ "that package." | ||
252 | #~ msgstr "" | ||
253 | #~ "Ð’Ñтановлений rsh-server знижує рівень безпеки, Ñкий ви, можливо, хотіли " | ||
254 | #~ "отримати вÑтановивши ssh. РекомендуєтьÑÑ Ð²Ð¸Ð´Ð°Ð»Ð¸Ñ‚Ð¸ цей пакунок." | ||
255 | |||
256 | #~ msgid "Do you want ssh-keysign to be installed SUID root?" | ||
257 | #~ msgstr "Чи бажаєте ви, щоб ssh-keysign мав вÑтановлений біт SUID?" | ||
258 | |||
259 | #~ msgid "" | ||
260 | #~ "You have the option of installing the ssh-keysign helper with the SUID " | ||
261 | #~ "bit set." | ||
262 | #~ msgstr "Ви маєте можливіÑÑ‚ÑŒ вÑтановити біт SUID Ð´Ð»Ñ Ð¿Ñ€Ð¾Ð³Ñ€Ð°Ð¼Ð¸ ssh-keysign." | ||
263 | |||
264 | #~ msgid "" | ||
265 | #~ "If you make ssh-keysign SUID, you will be able to use SSH's Protocol 2 " | ||
266 | #~ "host-based authentication." | ||
267 | #~ msgstr "" | ||
268 | #~ "Якщо ви вÑтановите біт SUID Ð´Ð»Ñ ssh-keysign, ви зможете викориÑтовувати " | ||
269 | #~ "вузлову автентифікацію протоколу SSH верÑÑ–Ñ— 2." | ||
270 | |||
271 | #~ msgid "" | ||
272 | #~ "If in doubt, I suggest you install it with SUID. If it causes problems " | ||
273 | #~ "you can change your mind later by running: dpkg-reconfigure ssh" | ||
274 | #~ msgstr "" | ||
275 | #~ "Якщо ÑумніваєтеÑÑŒ, то рекомендуєтьÑÑ Ð´Ð¾Ð·Ð²Ð¾Ð»Ð¸Ñ‚Ð¸ вÑтановити біт SUID. Якщо " | ||
276 | #~ "це викликатиме проблеми, ви зможете вÑе змінити запуÑтивши dpkg-" | ||
277 | #~ "reconfigure ssh" | ||
278 | |||
279 | #~ msgid "Allow SSH protocol 2 only" | ||
280 | #~ msgstr "Дозволити тільки SSH-протокол верÑÑ–Ñ— 2" | ||
281 | |||
282 | #~ msgid "" | ||
283 | #~ "This version of OpenSSH supports version 2 of the ssh protocol, which is " | ||
284 | #~ "much more secure. Disabling ssh 1 is encouraged, however this will slow " | ||
285 | #~ "things down on low end machines and might prevent older clients from " | ||
286 | #~ "connecting (the ssh client shipped with \"potato\" is affected)." | ||
287 | #~ msgstr "" | ||
288 | #~ "Ð¦Ñ Ð²ÐµÑ€ÑÑ–Ñ OpenSSH підтримує верÑÑ–ÑŽ 2 протоколу SSH, Ñка Ñ” більш " | ||
289 | #~ "безпечною. РекомендуєтьÑÑ Ð·Ð°Ð±Ð¾Ñ€Ð¾Ð½Ð¸Ñ‚Ð¸ верÑÑ–ÑŽ 1, однак це може уповільнити " | ||
290 | #~ "роботу на Ñлабких ÑиÑтемах та зробити неможливим з'Ñ”Ð´Ð½Ð°Ð½Ð½Ñ Ð· " | ||
291 | #~ "викориÑтаннÑм Ñтарих клієнтів (включно з клієнтом ssh з \"potato\")." | ||
292 | |||
293 | #~ msgid "" | ||
294 | #~ "Also please note that keys used for protocol 1 are different so you will " | ||
295 | #~ "not be able to use them if you only allow protocol 2 connections." | ||
296 | #~ msgstr "" | ||
297 | #~ "Також зверніть увагу, що ключі Ð´Ð»Ñ Ð²ÐµÑ€ÑÑ–Ñ— 1 відрізнÑÑŽÑ‚ÑŒÑÑ Ð²Ñ–Ð´ ключів Ð´Ð»Ñ " | ||
298 | #~ "верÑÑ–Ñ— 2, тому ви не зможете викориÑтовувати Ñ—Ñ…, Ñкщо дозволите з'Ñ”Ð´Ð½Ð°Ð½Ð½Ñ " | ||
299 | #~ "тільки по протоколу верÑÑ–Ñ— 2." | ||
300 | |||
301 | #~ msgid "" | ||
302 | #~ "If you later change your mind about this setting, README.Debian has " | ||
303 | #~ "instructions on what to do to your sshd_config file." | ||
304 | #~ msgstr "" | ||
305 | #~ "Якщо ви пізніше передумаєте щодо цього параметра, файл README.Debian " | ||
306 | #~ "міÑтить інÑтрукції щодо внеÑÐµÐ½Ð½Ñ Ð·Ð¼Ñ–Ð½ до файла sshd_config." | ||
307 | |||
308 | #~ msgid "ssh2 keys merged in configuration files" | ||
309 | #~ msgstr "ssh2-ключі злиті у файлах налаштувань" | ||
310 | |||
311 | #~ msgid "" | ||
312 | #~ "As of version 3 OpenSSH no longer uses separate files for ssh1 and ssh2 " | ||
313 | #~ "keys. This means the authorized_keys2 and known_hosts2 files are no " | ||
314 | #~ "longer needed. They will still be read in order to maintain backwards " | ||
315 | #~ "compatibility" | ||
316 | #~ msgstr "" | ||
317 | #~ "У верÑÑ–Ñ— 3 OpenSSH більше не викориÑтовує окремі файли Ð´Ð»Ñ ÐºÐ»ÑŽÑ‡Ñ–Ð² ssh1 та " | ||
318 | #~ "ssh2. Це означає, що файли authorized_keys2 та known_hosts2 більше " | ||
319 | #~ "непотрібні. Вони будуть читатиÑÑ Ð· метою Ð·Ð°Ð±ÐµÐ·Ð¿ÐµÑ‡ÐµÐ½Ð½Ñ Ð·Ð²Ð¾Ñ€Ð¾Ñ‚Ð½Ð¾Ñ— " | ||
320 | #~ "ÑуміÑноÑÑ‚Ñ–." | ||
321 | |||
322 | #~ msgid "NOTE: Forwarding of X11 and Authorization disabled by default." | ||
323 | #~ msgstr "" | ||
324 | #~ "ЗÐУВÐЖЕÐÐЯ: Форвардинг X11 та Authorization заборонені за замовчаннÑм." | ||
325 | |||
326 | #~ msgid "" | ||
327 | #~ "For security reasons, the Debian version of ssh has ForwardX11 and " | ||
328 | #~ "ForwardAgent set to ``off'' by default." | ||
329 | #~ msgstr "" | ||
330 | #~ "З міркувань безпеки в Debian-верÑÑ–Ñ— ssh параметри ForwardX11 та " | ||
331 | #~ "ForwardAgent за замовчаннÑм мають Ð·Ð½Ð°Ñ‡ÐµÐ½Ð½Ñ \"off\"." | ||
332 | |||
333 | #~ msgid "" | ||
334 | #~ "You can enable it for servers you trust, either in one of the " | ||
335 | #~ "configuration files, or with the -X command line option." | ||
336 | #~ msgstr "" | ||
337 | #~ "Ви можете дозволити Ñ—Ñ… Ð´Ð»Ñ Ñерверів, Ñким довірÑєте, або у одному з " | ||
338 | #~ "файлів налаштувань, або за допомогою параметра командного Ñ€Ñдка -X." | ||
339 | |||
340 | #~ msgid "More details can be found in /usr/share/doc/ssh/README.Debian" | ||
341 | #~ msgstr "Подробиці можна прочитати у файлі /usr/share/doc/ssh/README.Debian" | ||
342 | |||
343 | #~ msgid "Do you want to run the sshd server?" | ||
344 | #~ msgstr "Чи бажаєте ви запуÑтити Ñервер sshd?" | ||
345 | |||
346 | #~ msgid "This package contains both the ssh client, and the sshd server." | ||
347 | #~ msgstr "Цей пакунок міÑтить Ñк клієнт ssh, так Ñ– Ñервер sshd." | ||
348 | |||
349 | #~ msgid "" | ||
350 | #~ "Normally the sshd Secure Shell Server will be run to allow remote logins " | ||
351 | #~ "via ssh." | ||
352 | #~ msgstr "" | ||
353 | #~ "Звичайно sshd (Secure Shell Server) запуÑкаєтьÑÑ Ñ‰Ð¾Ð± зробити можливим " | ||
354 | #~ "віддалену реєÑтрацію в ÑиÑтемі за допомогою ssh." | ||
355 | |||
356 | #~ msgid "" | ||
357 | #~ "If you are only interested in using the ssh client for outbound " | ||
358 | #~ "connections on this machine, and don't want to log into it at all using " | ||
359 | #~ "ssh, then you can disable sshd here." | ||
360 | #~ msgstr "" | ||
361 | #~ "Якщо Ð²Ð°Ñ Ñ†Ñ–ÐºÐ°Ð²Ð¸Ñ‚ÑŒ викориÑÑ‚Ð°Ð½Ð½Ñ Ñ‚Ñ–Ð»ÑŒÐºÐ¸ клієнта ssh на цій машині Ñ– ви не " | ||
362 | #~ "бажаєте реєÑтруватиÑÑ Ð½Ð° ній викориÑтовуючи ssh, тоді ви можете " | ||
363 | #~ "заборонити sshd." | ||
364 | |||
365 | #~ msgid "Environment options on keys have been deprecated" | ||
366 | #~ msgstr "Опції Ð¾Ñ‚Ð¾Ñ‡ÐµÐ½Ð½Ñ Ð´Ð»Ñ ÐºÐ»ÑŽÑ‡Ñ–Ð² не повинні викориÑтовуватиÑÑ" | ||
367 | |||
368 | #~ msgid "" | ||
369 | #~ "This version of OpenSSH disables the environment option for public keys " | ||
370 | #~ "by default, in order to avoid certain attacks (for example, LD_PRELOAD). " | ||
371 | #~ "If you are using this option in an authorized_keys file, beware that the " | ||
372 | #~ "keys in question will no longer work until the option is removed." | ||
373 | #~ msgstr "" | ||
374 | #~ "Ð’ цій верÑÑ–Ñ— OpenSSH, з метою ÑƒÐ½Ð¸ÐºÐ½ÐµÐ½Ð½Ñ Ð´ÐµÑких атак (наприклад " | ||
375 | #~ "LD_PRELOAD), за замовчаннÑм заборонені опції Ð¾Ñ‚Ð¾Ñ‡ÐµÐ½Ð½Ñ Ð´Ð»Ñ Ð²Ñ–Ð´ÐºÑ€Ð¸Ñ‚Ð¸Ñ… " | ||
376 | #~ "ключів. Якщо ви викориÑтовуєте цю опцію у файлі authorized_keys, майте на " | ||
377 | #~ "увазі, що ключі з такими опціÑми не будуть працювати, доки Ð¾Ð¿Ñ†Ñ–Ñ Ð½Ðµ буде " | ||
378 | #~ "видалена." | ||
379 | |||
380 | #~ msgid "" | ||
381 | #~ "To re-enable this option, set \"PermitUserEnvironment yes\" in /etc/ssh/" | ||
382 | #~ "sshd_config after the upgrade is complete, taking note of the warning in " | ||
383 | #~ "the sshd_config(5) manual page." | ||
384 | #~ msgstr "" | ||
385 | #~ "Щоб дозволити цю опцію, вÑтановіть \"PermitUserEnvironment yes\" в /etc/" | ||
386 | #~ "ssh/sshd_config піÑÐ»Ñ Ð·Ð°Ð²ÐµÑ€ÑˆÐµÐ½Ð½Ñ Ð¾Ð½Ð¾Ð²Ð»ÐµÐ½Ð½Ñ; зверніть увагу на " | ||
387 | #~ "Ð¿Ð¾Ð¿ÐµÑ€ÐµÐ´Ð¶ÐµÐ½Ð½Ñ Ð½Ð° Ñторінці підручника sshd_config(5)." | ||
diff --git a/debian/po/vi.po b/debian/po/vi.po new file mode 100644 index 000000000..a94514c22 --- /dev/null +++ b/debian/po/vi.po | |||
@@ -0,0 +1,212 @@ | |||
1 | # Vietnamese translation for OpenSSH. | ||
2 | # Copyright © 2008 Free Software Foundation, Inc. | ||
3 | # Clytie Siddall <clytie@riverland.net.au>, 2007-2008. | ||
4 | # | ||
5 | msgid "" | ||
6 | msgstr "" | ||
7 | "Project-Id-Version: openssh 1:4.7p1-9\n" | ||
8 | "Report-Msgid-Bugs-To: openssh@packages.debian.org\n" | ||
9 | "POT-Creation-Date: 2010-01-02 08:55+0000\n" | ||
10 | "PO-Revision-Date: 2008-05-19 16:49+0930\n" | ||
11 | "Last-Translator: Clytie Siddall <clytie@riverland.net.au>\n" | ||
12 | "Language-Team: Vietnamese <vi-VN@googlegroups.com>\n" | ||
13 | "MIME-Version: 1.0\n" | ||
14 | "Content-Type: text/plain; charset=UTF-8\n" | ||
15 | "Content-Transfer-Encoding: 8bit\n" | ||
16 | "Plural-Forms: nplurals=1; plural=0;\n" | ||
17 | "X-Generator: LocFactoryEditor 1.7b3\n" | ||
18 | |||
19 | #. Type: boolean | ||
20 | #. Description | ||
21 | #: ../openssh-server.templates:1001 | ||
22 | msgid "Do you want to risk killing active SSH sessions?" | ||
23 | msgstr "Bạn có muốn rủi ro giết phiên bản SSH đang chạy không?" | ||
24 | |||
25 | # The version of /etc/init.d/ssh that you have installed, is likely to kill | ||
26 | # all running sshd instances. If you are doing this upgrade via an ssh | ||
27 | # session, that would be a Bad Thing(tm). | ||
28 | #. Type: boolean | ||
29 | #. Description | ||
30 | #: ../openssh-server.templates:1001 | ||
31 | msgid "" | ||
32 | "The currently installed version of /etc/init.d/ssh is likely to kill all " | ||
33 | "running sshd instances. If you are doing this upgrade via an SSH session, " | ||
34 | "you're likely to be disconnected and leave the upgrade procedure unfinished." | ||
35 | msgstr "" | ||
36 | "Phiên bản « /etc/init.d/ssh » được cà i đặt hiện thá»i rất có thể giết má»i tiến " | ||
37 | "trình sshd đang chạy. Nếu bạn có nâng cấp qua phiên chạy SSH, rất có thể bạn " | ||
38 | "bị ngắt kết nối, để lại tiến trình nâng cấp chưa hoà n tất." | ||
39 | |||
40 | # You can fix this by adding \"--pidfile /var/run/sshd.pid\" to the start- | ||
41 | # stop-daemon line in the stop section of the file. | ||
42 | #. Type: boolean | ||
43 | #. Description | ||
44 | #: ../openssh-server.templates:1001 | ||
45 | msgid "" | ||
46 | "This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the " | ||
47 | "start-stop-daemon line in the stop section of the file." | ||
48 | msgstr "" | ||
49 | "Bạn vẫn còn có thể sá»a chữa vấn Ä‘á» nà y bằng cách tá»± thêm chuá»—i « --pidfile /" | ||
50 | "var/run/sshd.pid » và o dòng « start-stop-daemon » (khởi/ngừng chạy trình ná»n) " | ||
51 | "trong phần « stop » (ngừng chạy) của táºp tin đó." | ||
52 | |||
53 | #. Type: note | ||
54 | #. Description | ||
55 | #: ../openssh-server.templates:2001 | ||
56 | msgid "New host key mandatory" | ||
57 | msgstr "Bắt buộc phải có khoá máy mới" | ||
58 | |||
59 | #. Type: note | ||
60 | #. Description | ||
61 | #: ../openssh-server.templates:2001 | ||
62 | msgid "" | ||
63 | "The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA " | ||
64 | "algorithm. OpenSSH can not handle this host key file, and the ssh-keygen " | ||
65 | "utility from the old (non-free) SSH installation does not appear to be " | ||
66 | "available." | ||
67 | msgstr "" | ||
68 | "Khoá máy hiện thá»i, trong « /etc/ssh/ssh_host_key », được mặt mã bằng thuáºt " | ||
69 | "toán IDEA. Phần má»m OpenSSH không thể xá» lý táºp tin khoá máy kiểu nà y; cÅ©ng " | ||
70 | "có vẻ là tiện Ãch « ssh-keygen » (tạo khoá SSH) thuá»™c vá» bản cà i đặt SSH cÅ© " | ||
71 | "(khác tự do) không sẵn sà ng." | ||
72 | |||
73 | #. Type: note | ||
74 | #. Description | ||
75 | #: ../openssh-server.templates:2001 | ||
76 | msgid "You need to manually generate a new host key." | ||
77 | msgstr "Váºy bạn cần phải tá»± tạo má»™t khoá máy má»›i." | ||
78 | |||
79 | #. Type: boolean | ||
80 | #. Description | ||
81 | #: ../openssh-server.templates:3001 | ||
82 | msgid "Disable challenge-response authentication?" | ||
83 | msgstr "Tắt chức năng xác thực kiểu yêu cầu/đáp ứng không?" | ||
84 | |||
85 | # Password authentication appears to be disabled in your current OpenSSH | ||
86 | # server configuration. In order to prevent users from logging in using | ||
87 | # passwords (perhaps using only public key authentication instead) with | ||
88 | # recent versions of OpenSSH, you must disable challenge-response | ||
89 | # authentication, or else ensure that your PAM configuration does not allow | ||
90 | # Unix password file authentication. | ||
91 | #. Type: boolean | ||
92 | #. Description | ||
93 | #: ../openssh-server.templates:3001 | ||
94 | msgid "" | ||
95 | "Password authentication appears to be disabled in the current OpenSSH server " | ||
96 | "configuration. In order to prevent users from logging in using passwords " | ||
97 | "(perhaps using only public key authentication instead) with recent versions " | ||
98 | "of OpenSSH, you must disable challenge-response authentication, or else " | ||
99 | "ensure that your PAM configuration does not allow Unix password file " | ||
100 | "authentication." | ||
101 | msgstr "" | ||
102 | "Có vẻ là chức năng xác thá»±c bằng máºt khẩu bị tắt trong cấu hình trình phục " | ||
103 | "vụ OpenSSH hiện thá»i. Äể ngăn cản ngÆ°á»i dùng đăng nháºp bằng máºt khẩu (có lẽ " | ||
104 | "chỉ xác thực bằng khoá công) với phiên bản OpenSSH gần đây, bạn cần phải " | ||
105 | "tắt khả năng xác thực kiểu yêu cầu/đáp ứng (challenge-response " | ||
106 | "authentication), không thì đảm bảo cấu hình PAM không cho phép xác thực bằng " | ||
107 | "táºp tin máºt khẩu UNIX." | ||
108 | |||
109 | #. Type: boolean | ||
110 | #. Description | ||
111 | #: ../openssh-server.templates:3001 | ||
112 | msgid "" | ||
113 | "If you disable challenge-response authentication, then users will not be " | ||
114 | "able to log in using passwords. If you leave it enabled (the default " | ||
115 | "answer), then the 'PasswordAuthentication no' option will have no useful " | ||
116 | "effect unless you also adjust your PAM configuration in /etc/pam.d/ssh." | ||
117 | msgstr "" | ||
118 | "Nếu bạn tắt khả năng xác thá»±c kiểu yêu cầu/đáp ứng, ngÆ°á»i dùng sẽ không thể " | ||
119 | "đăng nháºp bằng máºt khẩu. Äể lại hoạt Ä‘á»™ng (trả lá»i mặc định) thì tùy chá»n « " | ||
120 | "PasswordAuthentication no » (xác thá»±c bằng máºt khẩu : không) sẽ không có tác " | ||
121 | "Ä‘á»™ng tháºt, nếu bạn không Ä‘iá»u chỉnh cấu hình PAM trong « /etc/pam.d/ssh »" | ||
122 | |||
123 | #. Type: note | ||
124 | #. Description | ||
125 | #: ../openssh-server.templates:4001 | ||
126 | msgid "Vulnerable host keys will be regenerated" | ||
127 | msgstr "Má»i khoá máy dá»… bị tấn công Ä‘á»u sẽ được tạo lại" | ||
128 | |||
129 | #. Type: note | ||
130 | #. Description | ||
131 | #: ../openssh-server.templates:4001 | ||
132 | msgid "" | ||
133 | "Some of the OpenSSH server host keys on this system were generated with a " | ||
134 | "version of OpenSSL that had a broken random number generator. As a result, " | ||
135 | "these host keys are from a well-known set, are subject to brute-force " | ||
136 | "attacks, and must be regenerated." | ||
137 | msgstr "" | ||
138 | "Một số khoá máy kiểu trình phục vụ OpenSSH trên hệ thống nà y đã được tạo " | ||
139 | "bằng má»™t phiên bản OpenSSL có má»™t cÆ¡ chế tạo số ngẫu nhiên mà bị há»ng. Kết " | ||
140 | "quả là những khoá máy nà y thuá»™c vá» má»™t táºp hợp ai cÅ©ng biết, có thể bị tấn " | ||
141 | "công dùng sức mạnh vũ phu, và phải được tạo lại." | ||
142 | |||
143 | #. Type: note | ||
144 | #. Description | ||
145 | #: ../openssh-server.templates:4001 | ||
146 | msgid "" | ||
147 | "Users of this system should be informed of this change, as they will be " | ||
148 | "prompted about the host key change the next time they log in. Use 'ssh-" | ||
149 | "keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of " | ||
150 | "the new host keys." | ||
151 | msgstr "" | ||
152 | "Các ngÆ°á»i dùng của hệ thống nà y nên được thông báo vá» thay đổi nà y, vì há» sẽ " | ||
153 | "được nhắc cho thay đổi khoá máy nà y lần kế tiếp đăng nháºp. Hãy dùng câu lệnh " | ||
154 | "« ssh-keygen -l -f TẬP_TIN_KHOÃ_MÃY » sau khi nâng cấp, để in ra các vân tay " | ||
155 | "của những khoá máy mới." | ||
156 | |||
157 | #. Type: note | ||
158 | #. Description | ||
159 | #: ../openssh-server.templates:4001 | ||
160 | msgid "The affected host keys are:" | ||
161 | msgstr "Những máy khoá bị ảnh hưởng:" | ||
162 | |||
163 | #. Type: note | ||
164 | #. Description | ||
165 | #: ../openssh-server.templates:4001 | ||
166 | msgid "" | ||
167 | "User keys may also be affected by this problem. The 'ssh-vulnkey' command " | ||
168 | "may be used as a partial test for this. See /usr/share/doc/openssh-server/" | ||
169 | "README.compromised-keys.gz for more details." | ||
170 | msgstr "" | ||
171 | "Các khoá kiểu ngÆ°á»i dùng cÅ©ng có thể bị vấn Ä‘á» nà y ảnh hưởng. Câu lệnh « ssh-" | ||
172 | "vulnkey » có thể được sá» dụng là m thá» bá»™ pháºn để phát hiện các khoá vẫn còn " | ||
173 | "dá»… tấn công. Xem tà i liệu Äá»c Äi « /usr/share/doc/openssh-server/README." | ||
174 | "compromised-keys.gz » để tìm thêm chi tiết." | ||
175 | |||
176 | #~ msgid "Generate a new configuration file for OpenSSH?" | ||
177 | #~ msgstr "Tao ra táºp tin cấu hình má»›i cho OpenSSH không?" | ||
178 | |||
179 | #~ msgid "" | ||
180 | #~ "This version of OpenSSH has a considerably changed configuration file " | ||
181 | #~ "from the version shipped in Debian 'Potato', which you appear to be " | ||
182 | #~ "upgrading from. This package can now generate a new configuration file (/" | ||
183 | #~ "etc/ssh/sshd.config), which will work with the new server version, but " | ||
184 | #~ "will not contain any customizations you made with the old version." | ||
185 | #~ msgstr "" | ||
186 | #~ "Phiên bản OpenSSH nà y có má»™t táºp tin cấu hình đã thay đổi nhiá»u so vá»›i " | ||
187 | #~ "phiên bản có sẵn trong bản phát hà nh « Potato » của Debian, trong đó có vẻ " | ||
188 | #~ "là bạn Ä‘ang cáºp nháºt. Gói hiện thá»i có khả năng tạo ra má»™t táºp tin cấu " | ||
189 | #~ "hình mới (/etc/ssh/sshd.config), mà sẽ hoạt động được với phiên bản trình " | ||
190 | #~ "phục vụ má»›i, nhÆ°ng không còn chứa lại mục sá»a đổi nà o bạn đã tạo trong " | ||
191 | #~ "phiên bản cũ." | ||
192 | |||
193 | # Please note that this new configuration file will set the value of | ||
194 | # 'PermitRootLogin' to yes (meaning that anyone knowing the root password | ||
195 | # can ssh directly in as root). It is the opinion of the maintainer that | ||
196 | # this is the correct default (see README.Debian for more details), but you | ||
197 | # can always edit sshd_config and set it to no if you wish. | ||
198 | #~ msgid "" | ||
199 | #~ "Please note that this new configuration file will set the value of " | ||
200 | #~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password " | ||
201 | #~ "can ssh directly in as root). Please read the README.Debian file for more " | ||
202 | #~ "details about this design choice." | ||
203 | #~ msgstr "" | ||
204 | #~ "Ghi chú rằng táºp tin cấu hình má»›i nà y sẽ đặt giá trị của « PermitRootLogin " | ||
205 | #~ "» thà nh « yes » (có : nghÄ©a là ai đó biết máºt khẩu ngÆ°á»i chủ thì có khả " | ||
206 | #~ "năng truy cáºp trá»±c tiếp qua ssh vá»›i tÆ° cách là ngÆ°á»i chủ). Xem táºp tin " | ||
207 | #~ "Äá»c Äi « README.Debian » để tìm thêm chi tiết vá» sá»± chá»n thiết kế nà y." | ||
208 | |||
209 | #~ msgid "" | ||
210 | #~ "It is strongly recommended that you choose to generate a new " | ||
211 | #~ "configuration file now." | ||
212 | #~ msgstr "Rất khuyên bạn chá»n tạo ra táºp tin cấu hình má»›i ngay bây giá»." | ||
diff --git a/debian/po/zh_CN.po b/debian/po/zh_CN.po new file mode 100644 index 000000000..9eee59af9 --- /dev/null +++ b/debian/po/zh_CN.po | |||
@@ -0,0 +1,389 @@ | |||
1 | # | ||
2 | # Translators, if you are not familiar with the PO format, gettext | ||
3 | # documentation is worth reading, especially sections dedicated to | ||
4 | # this format, e.g. by running: | ||
5 | # info -n '(gettext)PO Files' | ||
6 | # info -n '(gettext)Header Entry' | ||
7 | # | ||
8 | # Some information specific to po-debconf are available at | ||
9 | # /usr/share/doc/po-debconf/README-trans | ||
10 | # or http://www.debian.org/intl/l10n/po-debconf/README-trans | ||
11 | # | ||
12 | # Developers do not need to manually edit POT or PO files. | ||
13 | # | ||
14 | msgid "" | ||
15 | msgstr "" | ||
16 | "Project-Id-Version: openssh 3.6.1p2-11\n" | ||
17 | "Report-Msgid-Bugs-To: openssh@packages.debian.org\n" | ||
18 | "POT-Creation-Date: 2010-01-02 08:55+0000\n" | ||
19 | "PO-Revision-Date: 2004-02-02 18:48+1300\n" | ||
20 | "Last-Translator: Hiei Xu <nicky@mail.edu.cn>\n" | ||
21 | "Language-Team: Chinese/Simplified <i18n-translation@lists.linux.net.cn>\n" | ||
22 | "MIME-Version: 1.0\n" | ||
23 | "Content-Type: text/plain; charset=UTF-8\n" | ||
24 | "Content-Transfer-Encoding: 8bit\n" | ||
25 | |||
26 | #. Type: boolean | ||
27 | #. Description | ||
28 | #: ../openssh-server.templates:1001 | ||
29 | #, fuzzy | ||
30 | #| msgid "Do you want to continue (and risk killing active ssh sessions)?" | ||
31 | msgid "Do you want to risk killing active SSH sessions?" | ||
32 | msgstr "您è¦ç»§ç»å—(会有æ€æ»æ´»åŠ¨çš„ ssh 会è¯çš„å±é™©)?" | ||
33 | |||
34 | #. Type: boolean | ||
35 | #. Description | ||
36 | #: ../openssh-server.templates:1001 | ||
37 | #, fuzzy | ||
38 | #| msgid "" | ||
39 | #| "The version of /etc/init.d/ssh that you have installed, is likely to kill " | ||
40 | #| "all running sshd instances. If you are doing this upgrade via an ssh " | ||
41 | #| "session, that would be a Bad Thing(tm)." | ||
42 | msgid "" | ||
43 | "The currently installed version of /etc/init.d/ssh is likely to kill all " | ||
44 | "running sshd instances. If you are doing this upgrade via an SSH session, " | ||
45 | "you're likely to be disconnected and leave the upgrade procedure unfinished." | ||
46 | msgstr "" | ||
47 | "您安装的 /etc/init.d/ssh 版本很å¯èƒ½ä¼šæ€æ»æ‰€æœ‰è¿è¡Œä¸çš„ sshd 例程。如果您是在通" | ||
48 | "过 ssh 会è¯è¿›è¡Œè¿™é¡¹å‡çº§ï¼Œé‚£å¯çœŸæ˜¯ä»¶ç³Ÿç³•çš„事情(tm)。" | ||
49 | |||
50 | #. Type: boolean | ||
51 | #. Description | ||
52 | #: ../openssh-server.templates:1001 | ||
53 | #, fuzzy | ||
54 | #| msgid "" | ||
55 | #| "You can fix this by adding \"--pidfile /var/run/sshd.pid\" to the start-" | ||
56 | #| "stop-daemon line in the stop section of the file." | ||
57 | msgid "" | ||
58 | "This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the " | ||
59 | "start-stop-daemon line in the stop section of the file." | ||
60 | msgstr "" | ||
61 | "您å¯ä»¥é€šè¿‡æ·»åŠ “--pidfile /var/run/sshd.pidâ€åˆ°è¿™ä¸ªæ–‡ä»¶çš„ stop 部分的 start-" | ||
62 | "stop-daemon è¡Œæ¥ä¿®æ£è¿™ä¸ªé—®é¢˜ã€‚" | ||
63 | |||
64 | #. Type: note | ||
65 | #. Description | ||
66 | #: ../openssh-server.templates:2001 | ||
67 | msgid "New host key mandatory" | ||
68 | msgstr "" | ||
69 | |||
70 | #. Type: note | ||
71 | #. Description | ||
72 | #: ../openssh-server.templates:2001 | ||
73 | #, fuzzy | ||
74 | msgid "" | ||
75 | "The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA " | ||
76 | "algorithm. OpenSSH can not handle this host key file, and the ssh-keygen " | ||
77 | "utility from the old (non-free) SSH installation does not appear to be " | ||
78 | "available." | ||
79 | msgstr "" | ||
80 | "/etc/ssh/ssh_host_key 是由 IDEA åŠ å¯†çš„æ—§å¯†é’¥æ–‡ä»¶ã€‚OpenSSH ä¸èƒ½å¤„ç†è¿™ç§å¯†é’¥æ–‡" | ||
81 | "ä»¶ï¼Œæˆ‘ä¹Ÿæ— æ³•æ‰¾åˆ°æ—§çš„(éžè‡ªç”±çš„) SSH 安装所带的 ssh-keygen 密钥生æˆå·¥å…·ã€‚" | ||
82 | |||
83 | #. Type: note | ||
84 | #. Description | ||
85 | #: ../openssh-server.templates:2001 | ||
86 | #, fuzzy | ||
87 | #| msgid "You will need to generate a new host key." | ||
88 | msgid "You need to manually generate a new host key." | ||
89 | msgstr "您需è¦åˆ›å»ºä¸€ä¸ªæ–°çš„主机密钥。" | ||
90 | |||
91 | #. Type: boolean | ||
92 | #. Description | ||
93 | #: ../openssh-server.templates:3001 | ||
94 | msgid "Disable challenge-response authentication?" | ||
95 | msgstr "" | ||
96 | |||
97 | #. Type: boolean | ||
98 | #. Description | ||
99 | #: ../openssh-server.templates:3001 | ||
100 | msgid "" | ||
101 | "Password authentication appears to be disabled in the current OpenSSH server " | ||
102 | "configuration. In order to prevent users from logging in using passwords " | ||
103 | "(perhaps using only public key authentication instead) with recent versions " | ||
104 | "of OpenSSH, you must disable challenge-response authentication, or else " | ||
105 | "ensure that your PAM configuration does not allow Unix password file " | ||
106 | "authentication." | ||
107 | msgstr "" | ||
108 | |||
109 | #. Type: boolean | ||
110 | #. Description | ||
111 | #: ../openssh-server.templates:3001 | ||
112 | msgid "" | ||
113 | "If you disable challenge-response authentication, then users will not be " | ||
114 | "able to log in using passwords. If you leave it enabled (the default " | ||
115 | "answer), then the 'PasswordAuthentication no' option will have no useful " | ||
116 | "effect unless you also adjust your PAM configuration in /etc/pam.d/ssh." | ||
117 | msgstr "" | ||
118 | |||
119 | #. Type: note | ||
120 | #. Description | ||
121 | #: ../openssh-server.templates:4001 | ||
122 | msgid "Vulnerable host keys will be regenerated" | ||
123 | msgstr "" | ||
124 | |||
125 | #. Type: note | ||
126 | #. Description | ||
127 | #: ../openssh-server.templates:4001 | ||
128 | msgid "" | ||
129 | "Some of the OpenSSH server host keys on this system were generated with a " | ||
130 | "version of OpenSSL that had a broken random number generator. As a result, " | ||
131 | "these host keys are from a well-known set, are subject to brute-force " | ||
132 | "attacks, and must be regenerated." | ||
133 | msgstr "" | ||
134 | |||
135 | #. Type: note | ||
136 | #. Description | ||
137 | #: ../openssh-server.templates:4001 | ||
138 | msgid "" | ||
139 | "Users of this system should be informed of this change, as they will be " | ||
140 | "prompted about the host key change the next time they log in. Use 'ssh-" | ||
141 | "keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of " | ||
142 | "the new host keys." | ||
143 | msgstr "" | ||
144 | |||
145 | #. Type: note | ||
146 | #. Description | ||
147 | #: ../openssh-server.templates:4001 | ||
148 | msgid "The affected host keys are:" | ||
149 | msgstr "" | ||
150 | |||
151 | #. Type: note | ||
152 | #. Description | ||
153 | #: ../openssh-server.templates:4001 | ||
154 | msgid "" | ||
155 | "User keys may also be affected by this problem. The 'ssh-vulnkey' command " | ||
156 | "may be used as a partial test for this. See /usr/share/doc/openssh-server/" | ||
157 | "README.compromised-keys.gz for more details." | ||
158 | msgstr "" | ||
159 | |||
160 | #, fuzzy | ||
161 | #~ msgid "Generate a new configuration file for OpenSSH?" | ||
162 | #~ msgstr "生æˆæ–°çš„é…置文件" | ||
163 | |||
164 | #, fuzzy | ||
165 | #~ msgid "" | ||
166 | #~ "This version of OpenSSH has a considerably changed configuration file " | ||
167 | #~ "from the version shipped in Debian 'Potato', which you appear to be " | ||
168 | #~ "upgrading from. This package can now generate a new configuration file (/" | ||
169 | #~ "etc/ssh/sshd.config), which will work with the new server version, but " | ||
170 | #~ "will not contain any customizations you made with the old version." | ||
171 | #~ msgstr "" | ||
172 | #~ "看æ¥æ‚¨æ£åœ¨ä»Ž Debian “Potatoâ€å‡çº§ï¼Œå½“å‰ç‰ˆæœ¬å’Œ Debian “Potatoâ€æ‰€å¸¦çš„ " | ||
173 | #~ "OpenSSH 版本的é…置文件对比有了相当多的改å˜ã€‚我现在å¯ä»¥ç”Ÿæˆé€‚用于新æœåŠ¡å™¨ç‰ˆ" | ||
174 | #~ "本的新é…置文件 (/etc/ssh/sshd_config),但是它ä¸ä¼šä¿ç•™æ‚¨ä¸ºæ—§ç‰ˆæœ¬å®šåˆ¶çš„任何" | ||
175 | #~ "é…置。" | ||
176 | |||
177 | #, fuzzy | ||
178 | #~| msgid "" | ||
179 | #~| "Please note that this new configuration file will set the value of " | ||
180 | #~| "'PermitRootLogin' to yes (meaning that anyone knowing the root password " | ||
181 | #~| "can ssh directly in as root). It is the opinion of the maintainer that " | ||
182 | #~| "this is the correct default (see README.Debian for more details), but " | ||
183 | #~| "you can always edit sshd_config and set it to no if you wish." | ||
184 | #~ msgid "" | ||
185 | #~ "Please note that this new configuration file will set the value of " | ||
186 | #~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password " | ||
187 | #~ "can ssh directly in as root). Please read the README.Debian file for more " | ||
188 | #~ "details about this design choice." | ||
189 | #~ msgstr "" | ||
190 | #~ "请注æ„æ–°çš„é…置文件将会把“PermitRootLoginâ€çš„值设置为 yes,(è¿™æ„味ç€ä»»ä½•ä¸€ä¸ª" | ||
191 | #~ "çŸ¥é“ root 密ç 的人都å¯ä»¥ç›´æŽ¥ä»¥ root 登录)。维护者认为这是一个æ£ç¡®çš„默认值 " | ||
192 | #~ "(详情请阅读 README.Debian),但如果您希望,也å¯ä»¥ç¼–辑 sshd_config 文件将其" | ||
193 | #~ "设置为 no。" | ||
194 | |||
195 | #, fuzzy | ||
196 | #~ msgid "" | ||
197 | #~ "It is strongly recommended that you choose to generate a new " | ||
198 | #~ "configuration file now." | ||
199 | #~ msgstr "强烈建议让我为您生æˆä¸€ä»½æ–°çš„é…置文件。" | ||
200 | |||
201 | #~ msgid "Warning: you must create a new host key" | ||
202 | #~ msgstr "è¦å‘Šï¼šæ‚¨å¿…须创建一个新的主机密钥" | ||
203 | |||
204 | #~ msgid "Warning: telnetd is installed --- probably not a good idea" | ||
205 | #~ msgstr "è¦å‘Šï¼šå·²ç»å®‰è£…了 telnetd æœåŠ¡å™¨ --- å¯èƒ½ä¸æ˜¯ä¸ªå¥½ä¸»æ„" | ||
206 | |||
207 | #~ msgid "" | ||
208 | #~ "I'd advise you to either remove the telnetd package (if you don't " | ||
209 | #~ "actually need to offer telnet access) or install telnetd-ssl so that " | ||
210 | #~ "there is at least some chance that telnet sessions will not be sending " | ||
211 | #~ "unencrypted login/password and session information over the network." | ||
212 | #~ msgstr "" | ||
213 | #~ "æˆ‘å»ºè®®æ‚¨åˆ é™¤ telnetd 包(如果您ä¸æ˜¯çœŸçš„需è¦æä¾› telnet 访问),或者安装 " | ||
214 | #~ "telnetd-sslï¼Œè¿™æ ·è‡³å°‘æœ‰æ—¶å€™ telnet 会è¯ä¸ä¼šå°†æœªåŠ 密的 登录å/密ç 和会è¯ä¿¡" | ||
215 | #~ "æ¯é€šè¿‡ç½‘络å‘é€ã€‚" | ||
216 | |||
217 | #~ msgid "Warning: rsh-server is installed --- probably not a good idea" | ||
218 | #~ msgstr "è¦å‘Šï¼šå·²ç»å®‰è£…了 rsh æœåŠ¡å™¨ --- å¯èƒ½ä¸æ˜¯ä¸ªå¥½ä¸»æ„" | ||
219 | |||
220 | #~ msgid "" | ||
221 | #~ "having rsh-server installed undermines the security that you were " | ||
222 | #~ "probably wanting to obtain by installing ssh. I'd advise you to remove " | ||
223 | #~ "that package." | ||
224 | #~ msgstr "" | ||
225 | #~ "安装 rsh æœåŠ¡å™¨å¾ˆå¯èƒ½ä¼šé™ä½Žæ‚¨æƒ³è¦é€šè¿‡å®‰è£… ssh å¾—åˆ°çš„å®‰å…¨æ€§ã€‚æˆ‘å»ºè®®æ‚¨åˆ é™¤è¿™" | ||
226 | #~ "个包。" | ||
227 | |||
228 | #~ msgid "Do you want ssh-keysign to be installed SUID root?" | ||
229 | #~ msgstr "您è¦å°† ssh-keysign 安装为 SUID root 程åºå—?" | ||
230 | |||
231 | #~ msgid "" | ||
232 | #~ "You have the option of installing the ssh-keysign helper with the SUID " | ||
233 | #~ "bit set." | ||
234 | #~ msgstr "您使用为 ssh-keysign 帮助者程åºè®¾ç½® SUID ä½çš„选项。" | ||
235 | |||
236 | #~ msgid "" | ||
237 | #~ "If you make ssh-keysign SUID, you will be able to use SSH's Protocol 2 " | ||
238 | #~ "host-based authentication." | ||
239 | #~ msgstr "" | ||
240 | #~ "如果您为 ssh-keysign 设置了 SUID,您将å¯ä»¥ä½¿ç”¨ SSH åè®® 2 的基于主机的认è¯" | ||
241 | #~ "æ–¹å¼ã€‚" | ||
242 | |||
243 | #~ msgid "" | ||
244 | #~ "If in doubt, I suggest you install it with SUID. If it causes problems " | ||
245 | #~ "you can change your mind later by running: dpkg-reconfigure ssh" | ||
246 | #~ msgstr "" | ||
247 | #~ "如果有疑问,我建议您将它安装为 SUID。如果它带æ¥éº»çƒ¦ï¼Œæ‚¨å¯ä»¥é€šè¿‡è¿è¡Œï¼šdpkg-" | ||
248 | #~ "reconfigure ssh æ¥æ”¹å˜ä¸»æ„" | ||
249 | |||
250 | #~ msgid "Allow SSH protocol 2 only" | ||
251 | #~ msgstr "åªå…许 SSH åè®® 2 (ssh2)。" | ||
252 | |||
253 | #~ msgid "" | ||
254 | #~ "This version of OpenSSH supports version 2 of the ssh protocol, which is " | ||
255 | #~ "much more secure. Disabling ssh 1 is encouraged, however this will slow " | ||
256 | #~ "things down on low end machines and might prevent older clients from " | ||
257 | #~ "connecting (the ssh client shipped with \"potato\" is affected)." | ||
258 | #~ msgstr "" | ||
259 | #~ "这个版本的 OpenSSH 支æŒæ›´åŠ 安全的第二版本 ssh å议。我们鼓励您ç¦ç”¨ ssh 1," | ||
260 | #~ "然而这会é™ä½Žä½Žç«¯æœºå™¨é€Ÿåº¦ï¼Œå¹¶ä¸”会阻æ¢è€ç‰ˆå®¢æˆ·ç«¯çš„连接(“potatoâ€æ‰€å¸¦çš„ ssh 客" | ||
261 | #~ "户端会å—到影å“)。" | ||
262 | |||
263 | #~ msgid "" | ||
264 | #~ "Also please note that keys used for protocol 1 are different so you will " | ||
265 | #~ "not be able to use them if you only allow protocol 2 connections." | ||
266 | #~ msgstr "" | ||
267 | #~ "也请注æ„åè®® 1 所用的密钥是ä¸åŒçš„ï¼Œå› æ¤å¦‚果您åªå…许åè®® 2 连接将会导致ä¸èƒ½" | ||
268 | #~ "使用它们。" | ||
269 | |||
270 | #~ msgid "" | ||
271 | #~ "If you later change your mind about this setting, README.Debian has " | ||
272 | #~ "instructions on what to do to your sshd_config file." | ||
273 | #~ msgstr "" | ||
274 | #~ "如果您ç¨åŽæƒ³æ”¹å˜è¿™ä¸ªè®¾ç½®ï¼ŒREADME.Debian 上有说明告诉您如何修改 " | ||
275 | #~ "sshd_Config 文件。" | ||
276 | |||
277 | #~ msgid "NOTE: Forwarding of X11 and Authorization disabled by default." | ||
278 | #~ msgstr "注æ„:X11 转å‘和认è¯é»˜è®¤è¢«ç¦æ¢ã€‚" | ||
279 | |||
280 | #~ msgid "" | ||
281 | #~ "For security reasons, the Debian version of ssh has ForwardX11 and " | ||
282 | #~ "ForwardAgent set to ``off'' by default." | ||
283 | #~ msgstr "" | ||
284 | #~ "å› ä¸ºå®‰å…¨æ€§åŽŸå› ï¼Œé»˜è®¤æƒ…å†µä¸‹ Debian 版本的 ssh å°† ForwardX11 å’Œ " | ||
285 | #~ "ForwardAgent 设置为 off。" | ||
286 | |||
287 | #~ msgid "" | ||
288 | #~ "You can enable it for servers you trust, either in one of the " | ||
289 | #~ "configuration files, or with the -X command line option." | ||
290 | #~ msgstr "" | ||
291 | #~ "您å¯ä»¥ä¸ºä¿¡èµ–çš„æœåŠ¡å™¨å¯ç”¨è¿™ä¸ªé€‰é¡¹ï¼Œå¯ä»¥é€šè¿‡å…¶ä¸ä¹‹ä¸€çš„é…置文件或者使用 -X 命" | ||
292 | #~ "令行选项æ¥å®žçŽ°ã€‚" | ||
293 | |||
294 | #~ msgid "More details can be found in /usr/share/doc/ssh/README.Debian" | ||
295 | #~ msgstr "更多细节å¯ä»¥åœ¨ /usr/share/doc/ssh/README.Debian 找到" | ||
296 | |||
297 | #~ msgid "ssh2 keys merged in configuration files" | ||
298 | #~ msgstr "ssh2 密钥被åˆå¹¶åˆ°é…置文件" | ||
299 | |||
300 | #~ msgid "" | ||
301 | #~ "As of version 3 OpenSSH no longer uses separate files for ssh1 and ssh2 " | ||
302 | #~ "keys. This means the authorized_keys2 and known_hosts2 files are no " | ||
303 | #~ "longer needed. They will still be read in order to maintain backwards " | ||
304 | #~ "compatibility" | ||
305 | #~ msgstr "" | ||
306 | #~ "在 OpenSSH 第 3 版ä¸å†ä¸º ssh1 å’Œ ssh2 的密钥使用ä¸åŒçš„文件。这æ„å‘³ç€ " | ||
307 | #~ "authorized_keys2 å’Œ known_hosts2 文件将ä¸å†éœ€è¦ã€‚但为了ä¿æŒå‘åŽå…¼å®¹æ€§ï¼Œå®ƒ" | ||
308 | #~ "们ä»ä¼šè¢«è¯»å–。" | ||
309 | |||
310 | #~ msgid "Do you want to run the sshd server?" | ||
311 | #~ msgstr "您è¦è¿è¡Œ sshd æœåŠ¡å™¨å—?" | ||
312 | |||
313 | #~ msgid "This package contains both the ssh client, and the sshd server." | ||
314 | #~ msgstr "è¿™ä¸ªè½¯ä»¶åŒ…å†…å« ssh 客户端和 sshd æœåŠ¡å™¨ã€‚" | ||
315 | |||
316 | #~ msgid "" | ||
317 | #~ "Normally the sshd Secure Shell Server will be run to allow remote logins " | ||
318 | #~ "via ssh." | ||
319 | #~ msgstr "通常 sshd 安全 Shell æœåŠ¡å™¨éƒ½ä¼šè¿è¡Œä»¥ä¾¿å…许通过 ssh 进行远程登录。" | ||
320 | |||
321 | #~ msgid "" | ||
322 | #~ "If you are only interested in using the ssh client for outbound " | ||
323 | #~ "connections on this machine, and don't want to log into it at all using " | ||
324 | #~ "ssh, then you can disable sshd here." | ||
325 | #~ msgstr "" | ||
326 | #~ "如果您åªè¦åœ¨è¿™å°æœºå™¨ä¸Šä½¿ç”¨ ssh 客户端对外连接,完全ä¸æƒ³é€šè¿‡ ssh 登录到本" | ||
327 | #~ "机,那么您å¯ä»¥åœ¨è¿™é‡Œç¦ç”¨ sshd æœåŠ¡å™¨ã€‚" | ||
328 | |||
329 | #~ msgid "Environment options on keys have been deprecated" | ||
330 | #~ msgstr "密钥的环境选项已被废弃" | ||
331 | |||
332 | #~ msgid "" | ||
333 | #~ "This version of OpenSSH disables the environment option for public keys " | ||
334 | #~ "by default, in order to avoid certain attacks (for example, LD_PRELOAD). " | ||
335 | #~ "If you are using this option in an authorized_keys file, beware that the " | ||
336 | #~ "keys in question will no longer work until the option is removed." | ||
337 | #~ msgstr "" | ||
338 | #~ "为了é¿å…一些攻击(如 LD_PRELOAD),这个版本的 OpenSSH 默认ç¦ç”¨äº†å…¬é’¥ä¸Šçš„环境" | ||
339 | #~ "选项。如果您在æŸä¸ªæŽˆæƒå¯†é’¥(authorized_keys)文件ä¸ç”¨äº†è¿™ä¸ªå‚数,请注æ„除éž" | ||
340 | #~ "åˆ é™¤äº†æ¤é€‰é¡¹ï¼Œå¦åˆ™è¿™ä¸ªå¯ç–‘的密钥将ä¸å†èµ·ä½œç”¨ã€‚" | ||
341 | |||
342 | #~ msgid "" | ||
343 | #~ "To re-enable this option, set \"PermitUserEnvironment yes\" in /etc/ssh/" | ||
344 | #~ "sshd_config after the upgrade is complete, taking note of the warning in " | ||
345 | #~ "the sshd_config(5) manual page." | ||
346 | #~ msgstr "" | ||
347 | #~ "è¦é‡æ–°å¯ç”¨è¿™ä¸ªé€‰é¡¹ï¼Œå‡çº§å®ŒæˆåŽè¯·åœ¨ /etc/ssh/sshd_config ä¸åŠ 入一" | ||
348 | #~ "行:“PermitUserEnvironment yesâ€ã€‚è¯·æ³¨æ„ sshd_config(5) 手册页ä¸æ到的è¦" | ||
349 | #~ "告。" | ||
350 | |||
351 | #~ msgid "Privilege separation" | ||
352 | #~ msgstr "æƒé™åˆ†ç¦»" | ||
353 | |||
354 | #~ msgid "" | ||
355 | #~ "Privilege separation is turned on by default, so if you decide you want " | ||
356 | #~ "it turned off, you need to add \"UsePrivilegeSeparation no\" to /etc/ssh/" | ||
357 | #~ "sshd_config." | ||
358 | #~ msgstr "" | ||
359 | #~ "æƒé™åˆ†ç¦»é€‰é¡¹æ˜¯é»˜è®¤æ‰“开的。如果想è¦å…³é—æ¤é€‰é¡¹ï¼Œæ‚¨éœ€è¦åœ¨ /etc/ssh/" | ||
360 | #~ "sshd_config 文件ä¸æ·»åŠ 一行“UsePrivilegeSeparation noâ€ã€‚" | ||
361 | |||
362 | #~ msgid "Enable Privilege separation" | ||
363 | #~ msgstr "å¯ç”¨æƒé™åˆ†ç¦»" | ||
364 | |||
365 | #~ msgid "" | ||
366 | #~ "This version of OpenSSH contains the new privilege separation option. " | ||
367 | #~ "This significantly reduces the quantity of code that runs as root, and " | ||
368 | #~ "therefore reduces the impact of security holes in sshd." | ||
369 | #~ msgstr "" | ||
370 | #~ "这个版本的 OpenSSH 包å«äº†ä¸€ä¸ªæ–°çš„æƒé™åˆ†ç¦»çš„选项,目的是为了å‡å°‘以 root è¿" | ||
371 | #~ "行的代ç 数目,进而å‡å°‘了 sshd 被安全æ¼æ´žå½±å“的机会。" | ||
372 | |||
373 | #~ msgid "" | ||
374 | #~ "Unfortunately, privilege separation interacts badly with PAM. Any PAM " | ||
375 | #~ "session modules that need to run as root (pam_mkhomedir, for example) " | ||
376 | #~ "will fail, and PAM keyboard-interactive authentication won't work." | ||
377 | #~ msgstr "" | ||
378 | #~ "ä¸å¹¸çš„是,æƒé™åˆ†ç¦»å’Œ PAM åŒæ—¶ä½¿ç”¨ä¼šå¾ˆç³Ÿç³•ã€‚任何需è¦ä»¥ root è¿è¡Œçš„ PAM 会è¯" | ||
379 | #~ "æ¨¡å— (如 pam_mkhomedir) 都会失败,而且 PAM 键盘交互å¼è®¤è¯éƒ½ä¸èµ·ä½œç”¨ã€‚" | ||
380 | |||
381 | #~ msgid "" | ||
382 | #~ "Since you've opted to have me generate an sshd_config file for you, you " | ||
383 | #~ "can choose whether or not to have privilege separation turned on or not. " | ||
384 | #~ "Unless you know you need to use PAM features that won't work with this " | ||
385 | #~ "option, you should enable it." | ||
386 | #~ msgstr "" | ||
387 | #~ "å› ä¸ºæ‚¨é€‰æ‹©äº†è®©æˆ‘ä¸ºæ‚¨ç”Ÿæˆ sshd_config 文件,您å¯ä»¥é€‰æ‹©æ˜¯å¦æ‰“å¼€æƒé™åˆ†ç¦»é€‰" | ||
388 | #~ "项。除éžæ‚¨çŸ¥é“需è¦ä½¿ç”¨ PAM 这个ä¸èƒ½å’Œæƒé™åˆ†ç¦»åŒæ—¶å·¥ä½œçš„功能,å¦åˆ™å°±åº”该å¯" | ||
389 | #~ "用它。" | ||
diff --git a/debian/rules b/debian/rules new file mode 100755 index 000000000..ce56fdea4 --- /dev/null +++ b/debian/rules | |||
@@ -0,0 +1,226 @@ | |||
1 | #!/usr/bin/make -f | ||
2 | |||
3 | # Uncomment this to turn on verbose mode. | ||
4 | # export DH_VERBOSE=1 | ||
5 | |||
6 | include /usr/share/hardening-includes/hardening.make | ||
7 | |||
8 | # This has to be exported to make some magic below work. | ||
9 | export DH_OPTIONS | ||
10 | |||
11 | ifeq (,$(filter noopt,$(DEB_BUILD_OPTIONS))) | ||
12 | OPTFLAGS := -O2 | ||
13 | else | ||
14 | OPTFLAGS := -O0 | ||
15 | endif | ||
16 | |||
17 | ifeq (,$(filter nocheck,$(DEB_BUILD_OPTIONS))) | ||
18 | RUN_TESTS := yes | ||
19 | else | ||
20 | RUN_TESTS := | ||
21 | endif | ||
22 | |||
23 | DEB_HOST_GNU_TYPE ?= $(shell dpkg-architecture -qDEB_HOST_GNU_TYPE) | ||
24 | DEB_BUILD_GNU_TYPE ?= $(shell dpkg-architecture -qDEB_BUILD_GNU_TYPE) | ||
25 | |||
26 | ifeq ($(DEB_BUILD_GNU_TYPE),$(DEB_HOST_GNU_TYPE)) | ||
27 | CC := gcc | ||
28 | else | ||
29 | CC := $(DEB_HOST_GNU_TYPE)-gcc | ||
30 | RUN_TESTS := | ||
31 | endif | ||
32 | |||
33 | DEB_HOST_ARCH_OS := $(shell dpkg-architecture -qDEB_HOST_ARCH_OS 2>/dev/null) | ||
34 | DEB_HOST_ARCH_CPU := $(shell dpkg-architecture -qDEB_HOST_ARCH_CPU 2>/dev/null) | ||
35 | |||
36 | # Take account of old dpkg-architecture output. | ||
37 | ifeq ($(DEB_HOST_ARCH_OS),) | ||
38 | DEB_HOST_ARCH_OS := $(subst -gnu,,$(shell dpkg-architecture -qDEB_HOST_GNU_SYSTEM)) | ||
39 | ifeq ($(DEB_HOST_ARCH_OS),gnu) | ||
40 | DEB_HOST_ARCH_OS := hurd | ||
41 | endif | ||
42 | endif | ||
43 | ifeq ($(DEB_HOST_ARCH_CPU),) | ||
44 | DEB_HOST_ARCH_CPU := $(shell dpkg-architecture -qDEB_HOST_GNU_CPU) | ||
45 | ifeq ($(DEB_HOST_ARCH_CPU),x86_64) | ||
46 | DEB_HOST_ARCH_CPU := amd64 | ||
47 | endif | ||
48 | endif | ||
49 | |||
50 | ifneq (,$(findstring :$(DEB_HOST_ARCH_OS):,:linux:knetbsd:)) | ||
51 | ifneq (,$(findstring :$(DEB_HOST_ARCH_CPU):,:mips:mipsel:)) | ||
52 | # Apparently this is not implied by -fPIE, at least on the mipsen. | ||
53 | PIC_CFLAGS := -fPIC | ||
54 | PIC_LDFLAGS := -fPIC | ||
55 | endif | ||
56 | endif | ||
57 | |||
58 | # Change the version string to include the Debian version | ||
59 | SSH_EXTRAVERSION := Debian-$(shell dpkg-parsechangelog | sed -n -e '/^Version:/s/Version: //p' | sed -e 's/[^-]*-//') | ||
60 | |||
61 | DISTRIBUTOR := $(shell dpkg-vendor --derives-from Ubuntu 2>/dev/null && echo Ubuntu) | ||
62 | ifeq ($(DISTRIBUTOR),Ubuntu) | ||
63 | DEFAULT_PATH := /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/bin/X11:/usr/games | ||
64 | else | ||
65 | DEFAULT_PATH := /usr/local/bin:/usr/bin:/bin:/usr/bin/X11:/usr/games | ||
66 | endif | ||
67 | SUPERUSER_PATH := /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/bin/X11 | ||
68 | |||
69 | ifeq ($(DISTRIBUTOR),Ubuntu) | ||
70 | server_recommends := ssh-import-id | ||
71 | else | ||
72 | server_recommends := | ||
73 | endif | ||
74 | |||
75 | # Common path configuration. | ||
76 | confflags += --sysconfdir=/etc/ssh | ||
77 | |||
78 | # Common build options. | ||
79 | confflags += --disable-strip | ||
80 | confflags += --with-mantype=doc | ||
81 | confflags += --with-4in6 | ||
82 | confflags += --with-privsep-path=/var/run/sshd | ||
83 | |||
84 | # The Hurd needs libcrypt for res_query et al. | ||
85 | ifeq ($(DEB_HOST_ARCH_OS),hurd) | ||
86 | confflags += --with-libs=-lcrypt | ||
87 | endif | ||
88 | |||
89 | # Everything above here is common to the deb and udeb builds. | ||
90 | confflags_udeb := $(confflags) | ||
91 | |||
92 | # Options specific to the deb build. | ||
93 | confflags += --with-tcp-wrappers | ||
94 | confflags += --with-pam | ||
95 | confflags += --with-libedit | ||
96 | confflags += --with-kerberos5=/usr | ||
97 | confflags += --with-ssl-engine | ||
98 | ifeq ($(DEB_HOST_ARCH_OS),linux) | ||
99 | confflags += --with-selinux | ||
100 | endif | ||
101 | |||
102 | # The deb build wants xauth; the udeb build doesn't. | ||
103 | confflags += --with-xauth=/usr/bin/xauth | ||
104 | confflags_udeb += --without-xauth | ||
105 | |||
106 | # Default paths. The udeb build has /usr/bin/X11 and /usr/games removed. | ||
107 | confflags += --with-default-path=$(DEFAULT_PATH) --with-superuser-path=$(SUPERUSER_PATH) | ||
108 | confflags_udeb += --with-default-path=/usr/local/bin:/usr/bin:/bin --with-superuser-path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin | ||
109 | |||
110 | # Compiler flags. | ||
111 | cflags := $(OPTFLAGS) $(PIC_CFLAGS) $(HARDENING_CFLAGS) | ||
112 | cflags += -DLOGIN_PROGRAM=\"/bin/login\" -DLOGIN_NO_ENDOPT | ||
113 | cflags += -DSSH_EXTRAVERSION=\"$(SSH_EXTRAVERSION)\" | ||
114 | cflags_udeb := -Os | ||
115 | cflags_udeb += -DSSH_EXTRAVERSION=\"$(SSH_EXTRAVERSION)\" | ||
116 | confflags += --with-cflags='$(cflags)' | ||
117 | confflags_udeb += --with-cflags='$(cflags_udeb)' | ||
118 | |||
119 | # Linker flags. | ||
120 | confflags += --with-ldflags='$(strip -Wl,--as-needed $(PIC_LDFLAGS) $(HARDENING_LDFLAGS))' | ||
121 | confflags_udeb += --with-ldflags='-Wl,--as-needed' | ||
122 | |||
123 | %: | ||
124 | dh $@ | ||
125 | |||
126 | override_dh_auto_configure: | ||
127 | dh_auto_configure -Bbuild-deb -- $(confflags) | ||
128 | dh_auto_configure -Bbuild-udeb -- $(confflags_udeb) | ||
129 | |||
130 | override_dh_auto_build: | ||
131 | # Debian's /var/log/btmp has inappropriate permissions. | ||
132 | perl -pi -e 's,.*#define USE_BTMP .*,/* #undef USE_BTMP */,' build-deb/config.h | ||
133 | perl -pi -e 's,.*#define USE_BTMP .*,/* #undef USE_BTMP */,' build-udeb/config.h | ||
134 | |||
135 | # Avoid libnsl linkage. Ugh. | ||
136 | perl -pi -e 's/ +-lnsl//' build-udeb/config.status | ||
137 | cd build-udeb && ./config.status | ||
138 | |||
139 | $(MAKE) -C build-deb -j 2 ASKPASS_PROGRAM='/usr/bin/ssh-askpass' | ||
140 | $(MAKE) -C build-udeb -j 2 ASKPASS_PROGRAM='/usr/bin/ssh-askpass' ssh scp sftp sshd ssh-keygen | ||
141 | |||
142 | $(MAKE) -C contrib gnome-ssh-askpass2 CC='$(CC) $(OPTFLAGS) -g -Wall -Wl,--as-needed' | ||
143 | |||
144 | override_dh_auto_test: | ||
145 | ifeq ($(RUN_TESTS),yes) | ||
146 | $(MAKE) -C debian/tests | ||
147 | endif | ||
148 | |||
149 | override_dh_auto_clean: | ||
150 | rm -rf build-deb build-udeb | ||
151 | ifeq ($(RUN_TESTS),yes) | ||
152 | $(MAKE) -C debian/tests clean | ||
153 | endif | ||
154 | $(MAKE) -C contrib clean | ||
155 | (cat debian/copyright.head; iconv -f ISO-8859-1 -t UTF-8 LICENCE) \ | ||
156 | > debian/copyright | ||
157 | |||
158 | override_dh_auto_install: | ||
159 | $(MAKE) -C build-deb DESTDIR=`pwd`/debian/tmp install-nokeys | ||
160 | |||
161 | override_dh_install: | ||
162 | rm -f debian/tmp/etc/ssh/sshd_config | ||
163 | |||
164 | dh_install -Nopenssh-client-udeb -Nopenssh-server-udeb --fail-missing | ||
165 | dh_install -popenssh-client-udeb -popenssh-server-udeb \ | ||
166 | --sourcedir=build-udeb | ||
167 | |||
168 | install -s -o root -g root -m 755 contrib/gnome-ssh-askpass2 debian/ssh-askpass-gnome/usr/lib/openssh/gnome-ssh-askpass | ||
169 | |||
170 | install -o root -g root debian/openssh-server.if-up debian/openssh-server/etc/network/if-up.d/openssh-server | ||
171 | install -o root -g root -m 644 debian/openssh-server.ufw.profile debian/openssh-server/etc/ufw/applications.d/openssh-server | ||
172 | |||
173 | # Remove version control tags to avoid unnecessary conffile | ||
174 | # resolution steps for administrators. | ||
175 | sed -i '/\$$OpenBSD:/d' \ | ||
176 | debian/openssh-client/etc/ssh/moduli \ | ||
177 | debian/openssh-client/etc/ssh/ssh_config | ||
178 | |||
179 | override_dh_installdocs: | ||
180 | dh_installdocs -Nopenssh-server -Nssh | ||
181 | dh_installdocs -popenssh-server -pssh --link-doc=openssh-client | ||
182 | # Avoid breaking dh_installexamples later. | ||
183 | mkdir -p debian/openssh-server/usr/share/doc/openssh-client | ||
184 | |||
185 | override_dh_installinit: | ||
186 | dh_installinit -n --name ssh | ||
187 | |||
188 | override_dh_installpam: | ||
189 | dh_installpam --name sshd | ||
190 | |||
191 | override_dh_fixperms: | ||
192 | dh_fixperms | ||
193 | chmod u+s debian/openssh-client/usr/lib/openssh/ssh-keysign | ||
194 | |||
195 | override_dh_installdeb: | ||
196 | dh_installdeb | ||
197 | perl -i debian/substitute-conffile.pl \ | ||
198 | ETC_SSH_MODULI debian/openssh-client/etc/ssh/moduli \ | ||
199 | ETC_SSH_SSH_CONFIG debian/openssh-client/etc/ssh/ssh_config \ | ||
200 | debian/openssh-client/DEBIAN/preinst | ||
201 | # Yes, ETC_PAM_D_SSH is meant to be spelled that way, to match the | ||
202 | # old configuration file name we need to transfer. | ||
203 | perl -i debian/substitute-conffile.pl \ | ||
204 | ETC_DEFAULT_SSH debian/openssh-server/etc/default/ssh \ | ||
205 | ETC_INIT_D_SSH debian/openssh-server/etc/init.d/ssh \ | ||
206 | ETC_PAM_D_SSH debian/openssh-server/etc/pam.d/sshd \ | ||
207 | debian/openssh-server/DEBIAN/preinst | ||
208 | |||
209 | override_dh_gencontrol: | ||
210 | dh_gencontrol -- -V'openssh-server:Recommends=$(server_recommends)' | ||
211 | |||
212 | debian/faq.html: | ||
213 | wget -O - http://www.openssh.org/faq.html | \ | ||
214 | sed 's,\(href="\)\(txt/\|[^":]*\.html\),\1http://www.openssh.org/\2,g' \ | ||
215 | > debian/faq.html | ||
216 | |||
217 | # You only need to run this immediately after checking out the package from | ||
218 | # revision control. | ||
219 | quilt-setup: | ||
220 | [ ! -d .pc ] | ||
221 | set -e; for patch in $$(quilt series | tac); do \ | ||
222 | patch -p1 -R --no-backup-if-mismatch <"debian/patches/$$patch"; \ | ||
223 | done | ||
224 | quilt push -a | ||
225 | |||
226 | .PHONY: quilt-setup | ||
diff --git a/debian/source/format b/debian/source/format new file mode 100644 index 000000000..163aaf8d8 --- /dev/null +++ b/debian/source/format | |||
@@ -0,0 +1 @@ | |||
3.0 (quilt) | |||
diff --git a/debian/source/include-binaries b/debian/source/include-binaries new file mode 100644 index 000000000..df5790e2e --- /dev/null +++ b/debian/source/include-binaries | |||
@@ -0,0 +1 @@ | |||
debian/ssh-askpass-gnome.png | |||
diff --git a/debian/ssh-argv0 b/debian/ssh-argv0 new file mode 100644 index 000000000..67599aec2 --- /dev/null +++ b/debian/ssh-argv0 | |||
@@ -0,0 +1,30 @@ | |||
1 | #! /bin/sh -e | ||
2 | |||
3 | # Copyright (c) 2001 Jonathan Amery. | ||
4 | # | ||
5 | # Redistribution and use in source and binary forms, with or without | ||
6 | # modification, are permitted provided that the following conditions | ||
7 | # are met: | ||
8 | # 1. Redistributions of source code must retain the above copyright | ||
9 | # notice, this list of conditions and the following disclaimer. | ||
10 | # 2. Redistributions in binary form must reproduce the above copyright | ||
11 | # notice, this list of conditions and the following disclaimer in the | ||
12 | # documentation and/or other materials provided with the distribution. | ||
13 | # | ||
14 | # THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR | ||
15 | # IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES | ||
16 | # OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. | ||
17 | # IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, | ||
18 | # INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT | ||
19 | # NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, | ||
20 | # DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY | ||
21 | # THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT | ||
22 | # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF | ||
23 | # THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | ||
24 | |||
25 | if [ "${0##*/}" = "ssh-argv0" ] | ||
26 | then | ||
27 | echo 'ssh-argv0: This script should not be run like this, see ssh-argv0(1) for details' 1>&2 | ||
28 | exit 1 | ||
29 | fi | ||
30 | exec ssh "${0##*/}" "$@" | ||
diff --git a/debian/ssh-argv0.1 b/debian/ssh-argv0.1 new file mode 100644 index 000000000..a36a63d40 --- /dev/null +++ b/debian/ssh-argv0.1 | |||
@@ -0,0 +1,64 @@ | |||
1 | .Dd September 7, 2001 | ||
2 | .Dt SSH-ARGV0 1 | ||
3 | .Os Debian Project | ||
4 | .Sh NAME | ||
5 | .Nm ssh-argv0 | ||
6 | .Nd replaces the old ssh command-name as hostname handling | ||
7 | .Sh SYNOPSIS | ||
8 | .Ar hostname | user@hostname | ||
9 | .Op Fl l Ar login_name | ||
10 | .Op Ar command | ||
11 | .Pp | ||
12 | .Ar hostname | user@hostname | ||
13 | .Op Fl afgknqstvxACNTX1246 | ||
14 | .Op Fl b Ar bind_address | ||
15 | .Op Fl c Ar cipher_spec | ||
16 | .Op Fl e Ar escape_char | ||
17 | .Op Fl i Ar identity_file | ||
18 | .Op Fl l Ar login_name | ||
19 | .Op Fl m Ar mac_spec | ||
20 | .Op Fl o Ar option | ||
21 | .Op Fl p Ar port | ||
22 | .Op Fl F Ar configfile | ||
23 | .Oo Fl L Xo | ||
24 | .Sm off | ||
25 | .Ar port : | ||
26 | .Ar host : | ||
27 | .Ar hostport | ||
28 | .Sm on | ||
29 | .Xc | ||
30 | .Oc | ||
31 | .Oo Fl R Xo | ||
32 | .Sm off | ||
33 | .Ar port : | ||
34 | .Ar host : | ||
35 | .Ar hostport | ||
36 | .Sm on | ||
37 | .Xc | ||
38 | .Oc | ||
39 | .Op Fl D Ar port | ||
40 | .Op Ar command | ||
41 | .Sh DESCRIPTION | ||
42 | .Nm | ||
43 | replaces the old ssh command-name as hostname handling. | ||
44 | If you link to this script with a hostname then executing the link is | ||
45 | equivalent to having executed ssh with that hostname as an argument. | ||
46 | All other arguments are passed to ssh and will be processed normally. | ||
47 | .Sh OPTIONS | ||
48 | See | ||
49 | .Xr ssh 1 . | ||
50 | .Sh FILES | ||
51 | See | ||
52 | .Xr ssh 1 . | ||
53 | .Sh AUTHORS | ||
54 | OpenSSH is a derivative of the original and free | ||
55 | ssh 1.2.12 release by Tatu Ylonen. | ||
56 | Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos, | ||
57 | Theo de Raadt and Dug Song | ||
58 | removed many bugs, re-added newer features and | ||
59 | created OpenSSH. | ||
60 | Markus Friedl contributed the support for SSH | ||
61 | protocol versions 1.5 and 2.0. | ||
62 | Jonathan Amery wrote this ssh-argv0 script and the associated documentation. | ||
63 | .Sh SEE ALSO | ||
64 | .Xr ssh 1 | ||
diff --git a/debian/ssh-askpass-gnome.copyright b/debian/ssh-askpass-gnome.copyright new file mode 100644 index 000000000..4a71dda00 --- /dev/null +++ b/debian/ssh-askpass-gnome.copyright | |||
@@ -0,0 +1,44 @@ | |||
1 | This package contains a Gnome based implementation of ssh-askpass | ||
2 | written by Damien Miller. | ||
3 | |||
4 | It is split out from the main package to isolate the dependency on the | ||
5 | Gnome and X11 libraries. | ||
6 | |||
7 | It was packaged for Debian by Philip Hands <phil@hands.com>. | ||
8 | |||
9 | Copyright: | ||
10 | |||
11 | /* | ||
12 | ** | ||
13 | ** GNOME ssh passphrase requestor | ||
14 | ** | ||
15 | ** Damien Miller <djm@ibs.com.au> | ||
16 | ** | ||
17 | ** Copyright 1999 Internet Business Solutions | ||
18 | ** | ||
19 | ** Permission is hereby granted, free of charge, to any person | ||
20 | ** obtaining a copy of this software and associated documentation | ||
21 | ** files (the "Software"), to deal in the Software without | ||
22 | ** restriction, including without limitation the rights to use, copy, | ||
23 | ** modify, merge, publish, distribute, sublicense, and/or sell copies | ||
24 | ** of the Software, and to permit persons to whom the Software is | ||
25 | ** furnished to do so, subject to the following conditions: | ||
26 | ** | ||
27 | ** The above copyright notice and this permission notice shall be | ||
28 | ** included in all copies or substantial portions of the Software. | ||
29 | ** | ||
30 | ** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY | ||
31 | ** KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE | ||
32 | ** WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE | ||
33 | ** AND NONINFRINGEMENT. IN NO EVENT SHALL DAMIEN MILLER OR INTERNET | ||
34 | ** BUSINESS SOLUTIONS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER | ||
35 | ** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, | ||
36 | ** ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE | ||
37 | ** OR OTHER DEALINGS IN THE SOFTWARE. | ||
38 | ** | ||
39 | ** Except as contained in this notice, the name of Internet Business | ||
40 | ** Solutions shall not be used in advertising or otherwise to promote | ||
41 | ** the sale, use or other dealings in this Software without prior | ||
42 | ** written authorization from Internet Business Solutions. | ||
43 | ** | ||
44 | */ | ||
diff --git a/debian/ssh-askpass-gnome.desktop b/debian/ssh-askpass-gnome.desktop new file mode 100644 index 000000000..eba7a67d1 --- /dev/null +++ b/debian/ssh-askpass-gnome.desktop | |||
@@ -0,0 +1,12 @@ | |||
1 | [Desktop Entry] | ||
2 | Version=1.0 | ||
3 | Encoding=UTF-8 | ||
4 | Name=SSH AskPass | ||
5 | GenericName=ssh-add | ||
6 | Comment=Enter passphrase to authenticate to the ssh agent | ||
7 | Exec=/usr/bin/ssh-add | ||
8 | TryExec=ssh-add | ||
9 | Terminal=false | ||
10 | Type=Application | ||
11 | Icon=ssh-askpass-gnome | ||
12 | Categories=Network;Security; | ||
diff --git a/debian/ssh-askpass-gnome.dirs b/debian/ssh-askpass-gnome.dirs new file mode 100644 index 000000000..0ffa45024 --- /dev/null +++ b/debian/ssh-askpass-gnome.dirs | |||
@@ -0,0 +1,3 @@ | |||
1 | usr/lib/openssh | ||
2 | usr/share/man/man1 | ||
3 | usr/share/pixmaps | ||
diff --git a/debian/ssh-askpass-gnome.examples b/debian/ssh-askpass-gnome.examples new file mode 100644 index 000000000..66fd8c0e4 --- /dev/null +++ b/debian/ssh-askpass-gnome.examples | |||
@@ -0,0 +1 @@ | |||
debian/ssh-askpass-gnome.desktop | |||
diff --git a/debian/ssh-askpass-gnome.install b/debian/ssh-askpass-gnome.install new file mode 100644 index 000000000..8b6b5f045 --- /dev/null +++ b/debian/ssh-askpass-gnome.install | |||
@@ -0,0 +1 @@ | |||
debian/ssh-askpass-gnome.png usr/share/pixmaps | |||
diff --git a/debian/ssh-askpass-gnome.manpages b/debian/ssh-askpass-gnome.manpages new file mode 100644 index 000000000..7749f13bb --- /dev/null +++ b/debian/ssh-askpass-gnome.manpages | |||
@@ -0,0 +1 @@ | |||
debian/gnome-ssh-askpass.1 | |||
diff --git a/debian/ssh-askpass-gnome.png b/debian/ssh-askpass-gnome.png new file mode 100644 index 000000000..06f75764e --- /dev/null +++ b/debian/ssh-askpass-gnome.png | |||
Binary files differ | |||
diff --git a/debian/ssh-askpass-gnome.postinst b/debian/ssh-askpass-gnome.postinst new file mode 100644 index 000000000..b6c56d4e7 --- /dev/null +++ b/debian/ssh-askpass-gnome.postinst | |||
@@ -0,0 +1,65 @@ | |||
1 | #! /bin/sh | ||
2 | # postinst script for ssh-askpass-gnome | ||
3 | # | ||
4 | # see: dh_installdeb(1) | ||
5 | |||
6 | set -e | ||
7 | |||
8 | # summary of how this script can be called: | ||
9 | # * <postinst> `configure' <most-recently-configured-version> | ||
10 | # * <old-postinst> `abort-upgrade' <new version> | ||
11 | # * <conflictor's-postinst> `abort-remove' `in-favour' <package> | ||
12 | # <new-version> | ||
13 | # * <deconfigured's-postinst> `abort-deconfigure' `in-favour' | ||
14 | # <failed-install-package> <version> `removing' | ||
15 | # <conflicting-package> <version> | ||
16 | # for details, see /usr/share/doc/packaging-manual/ | ||
17 | # | ||
18 | # quoting from the policy: | ||
19 | # Any necessary prompting should almost always be confined to the | ||
20 | # post-installation script, and should be protected with a conditional | ||
21 | # so that unnecessary prompting doesn't happen if a package's | ||
22 | # installation fails and the `postinst' is called with `abort-upgrade', | ||
23 | # `abort-remove' or `abort-deconfigure'. | ||
24 | |||
25 | case "$1" in | ||
26 | configure) | ||
27 | if dpkg --compare-versions "$2" lt-nl 1:4.1p1-1; then | ||
28 | # libexecdir changed, so remove the obsolete alternative. | ||
29 | update-alternatives --quiet --remove ssh-askpass \ | ||
30 | /usr/lib/ssh/gnome-ssh-askpass | ||
31 | fi | ||
32 | if dpkg --compare-versions "$2" lt-nl 1:4.1p1-7 && \ | ||
33 | [ -h /etc/alternatives/ssh-askpass ] && \ | ||
34 | [ "$(readlink /etc/alternatives/ssh-askpass)" = /usr/lib/ssh/gnome-ssh-askpass ]; then | ||
35 | # Work around the ssh-askpass alternative somehow ending up in | ||
36 | # manual mode. | ||
37 | update-alternatives --auto ssh-askpass | ||
38 | fi | ||
39 | update-alternatives --quiet \ | ||
40 | --install /usr/bin/ssh-askpass ssh-askpass \ | ||
41 | /usr/lib/openssh/gnome-ssh-askpass 30 \ | ||
42 | --slave /usr/share/man/man1/ssh-askpass.1.gz \ | ||
43 | ssh-askpass.1.gz /usr/share/man/man1/gnome-ssh-askpass.1.gz | ||
44 | |||
45 | |||
46 | ;; | ||
47 | |||
48 | abort-upgrade|abort-remove|abort-deconfigure) | ||
49 | |||
50 | ;; | ||
51 | |||
52 | *) | ||
53 | echo "postinst called with unknown argument \`$1'" >&2 | ||
54 | exit 0 | ||
55 | ;; | ||
56 | esac | ||
57 | |||
58 | # dh_installdeb will replace this with shell code automatically | ||
59 | # generated by other debhelper scripts. | ||
60 | |||
61 | #DEBHELPER# | ||
62 | |||
63 | exit 0 | ||
64 | |||
65 | |||
diff --git a/debian/ssh-askpass-gnome.prerm b/debian/ssh-askpass-gnome.prerm new file mode 100644 index 000000000..e85f2d4a7 --- /dev/null +++ b/debian/ssh-askpass-gnome.prerm | |||
@@ -0,0 +1,41 @@ | |||
1 | #! /bin/sh | ||
2 | # prerm script for ssh-askpass-gnome | ||
3 | # | ||
4 | # see: dh_installdeb(1) | ||
5 | |||
6 | set -e | ||
7 | |||
8 | # summary of how this script can be called: | ||
9 | # * <prerm> `remove' | ||
10 | # * <old-prerm> `upgrade' <new-version> | ||
11 | # * <new-prerm> `failed-upgrade' <old-version> | ||
12 | # * <conflictor's-prerm> `remove' `in-favour' <package> <new-version> | ||
13 | # * <deconfigured's-prerm> `deconfigure' `in-favour' | ||
14 | # <package-being-installed> <version> `removing' | ||
15 | # <conflicting-package> <version> | ||
16 | # for details, see /usr/share/doc/packaging-manual/ | ||
17 | |||
18 | case "$1" in | ||
19 | remove|deconfigure) | ||
20 | update-alternatives --quiet --remove ssh-askpass /usr/lib/openssh/gnome-ssh-askpass | ||
21 | # install-info --quiet --remove /usr/info/ssh-askpass.info.gz | ||
22 | ;; | ||
23 | upgrade) | ||
24 | # install-info --quiet --remove /usr/info/ssh-askpass.info.gz | ||
25 | ;; | ||
26 | failed-upgrade) | ||
27 | ;; | ||
28 | *) | ||
29 | echo "prerm called with unknown argument \`$1'" >&2 | ||
30 | exit 0 | ||
31 | ;; | ||
32 | esac | ||
33 | |||
34 | # dh_installdeb will replace this with shell code automatically | ||
35 | # generated by other debhelper scripts. | ||
36 | |||
37 | #DEBHELPER# | ||
38 | |||
39 | exit 0 | ||
40 | |||
41 | |||
diff --git a/debian/ssh-krb5.NEWS b/debian/ssh-krb5.NEWS new file mode 100644 index 000000000..5a6433ab2 --- /dev/null +++ b/debian/ssh-krb5.NEWS | |||
@@ -0,0 +1,18 @@ | |||
1 | ssh-krb5 (1:4.3p2-7) unstable; urgency=low | ||
2 | |||
3 | The normal openssh-server and openssh-client packages in Debian now | ||
4 | include full GSSAPI support, including key exchange. This package is | ||
5 | now only a transitional package that depends on openssh-server and | ||
6 | openssh-client and configures openssh-server for GSSAPI authentication | ||
7 | if it wasn't already. | ||
8 | |||
9 | You can now simply install openssh-server and openssh-client directly | ||
10 | and remove this package. Just make sure that /etc/ssh/sshd_config | ||
11 | contains: | ||
12 | |||
13 | GSSAPIAuthentication yes | ||
14 | GSSAPIKeyExchange yes | ||
15 | |||
16 | if you want to support GSSAPI authentication to your ssh server. | ||
17 | |||
18 | -- Russ Allbery <rra@debian.org> Tue, 03 Oct 2006 22:27:27 -0700 | ||
diff --git a/debian/ssh-krb5.postinst b/debian/ssh-krb5.postinst new file mode 100644 index 000000000..4d943d861 --- /dev/null +++ b/debian/ssh-krb5.postinst | |||
@@ -0,0 +1,73 @@ | |||
1 | #!/bin/sh | ||
2 | |||
3 | set -e | ||
4 | |||
5 | action="$1" | ||
6 | oldversion="$2" | ||
7 | |||
8 | if [ "$action" = configure ] ; then | ||
9 | if dpkg --compare-versions "$oldversion" lt-nl 1:4.3p2-7; then | ||
10 | # Replaced by /etc/init.d/ssh. | ||
11 | if [ -f /etc/init.d/ssh-krb5 ]; then | ||
12 | mv /etc/init.d/ssh-krb5 /etc/init.d/ssh-krb5.dpkg-old | ||
13 | update-rc.d ssh-krb5 remove || true | ||
14 | fi | ||
15 | fi | ||
16 | |||
17 | # Make sure that GSSAPI is enabled. If there is no uncommented GSSAPI | ||
18 | # configuration, uncomment any commented-out configuration if present | ||
19 | # (this will catch the case of a fresh install of openssh-server). | ||
20 | # Otherwise, add configuration turning on GSSAPIAuthentication and | ||
21 | # GSSAPIKeyExchange. | ||
22 | # | ||
23 | # If there is some configuration, we may be upgrading from ssh-krb5. It | ||
24 | # enabled GSSAPIKeyExchange without any configuration option. Therefore, | ||
25 | # if it isn't explicitly set, always enable it for compatible behavior | ||
26 | # with ssh-krb5. | ||
27 | if dpkg --compare-versions "$oldversion" ge 1:4.3p2-9; then | ||
28 | : | ||
29 | else | ||
30 | changed= | ||
31 | if grep -qi '^[ ]*GSSAPI' /etc/ssh/sshd_config ; then | ||
32 | if grep -qi '^[ ]*GSSAPIKeyExchange' /etc/ssh/sshd_config ; then | ||
33 | : | ||
34 | else | ||
35 | changed=true | ||
36 | cat >> /etc/ssh/sshd_config <<EOF | ||
37 | |||
38 | # GSSAPI key exchange (added by ssh-krb5 transitional package) | ||
39 | GSSAPIKeyExchange yes | ||
40 | EOF | ||
41 | fi | ||
42 | else | ||
43 | changed=true | ||
44 | if grep -qi '^#GSSAPI' /etc/ssh/sshd_config ; then | ||
45 | perl -pe 's/^\#(GSSAPI(Authentication|KeyExchange))\b.*/$1 yes/i' \ | ||
46 | < /etc/ssh/sshd_config > /etc/ssh/sshd_config.dpkg-new | ||
47 | chown --reference /etc/ssh/sshd_config \ | ||
48 | /etc/ssh/sshd_config.dpkg-new | ||
49 | chmod --reference /etc/ssh/sshd_config \ | ||
50 | /etc/ssh/sshd_config.dpkg-new | ||
51 | mv /etc/ssh/sshd_config.dpkg-new /etc/ssh/sshd_config | ||
52 | else | ||
53 | cat >> /etc/ssh/sshd_config <<EOF | ||
54 | |||
55 | # GSSAPI authentication (added by ssh-krb5 transitional package) | ||
56 | GSSAPIAuthentication yes | ||
57 | GSSAPIKeyExchange yes | ||
58 | EOF | ||
59 | fi | ||
60 | fi | ||
61 | if [ -n "$changed" ] && [ -x /etc/init.d/ssh ] ; then | ||
62 | if [ -x /usr/sbin/invoke-rc.d ] ; then | ||
63 | invoke-rc.d ssh restart | ||
64 | else | ||
65 | /etc/init.d/ssh restart | ||
66 | fi | ||
67 | fi | ||
68 | fi | ||
69 | fi | ||
70 | |||
71 | #DEBHELPER# | ||
72 | |||
73 | exit 0 | ||
diff --git a/debian/ssh.dirs b/debian/ssh.dirs new file mode 100644 index 000000000..1da8fba83 --- /dev/null +++ b/debian/ssh.dirs | |||
@@ -0,0 +1 @@ | |||
usr/share/lintian/overrides | |||
diff --git a/debian/ssh.lintian-overrides b/debian/ssh.lintian-overrides new file mode 100644 index 000000000..b9bf7ea08 --- /dev/null +++ b/debian/ssh.lintian-overrides | |||
@@ -0,0 +1 @@ | |||
ssh: package-contains-empty-directory usr/share/doc/openssh-client/ | |||
diff --git a/debian/ssh.postinst b/debian/ssh.postinst new file mode 100644 index 000000000..cb1278033 --- /dev/null +++ b/debian/ssh.postinst | |||
@@ -0,0 +1,18 @@ | |||
1 | #!/bin/sh -e | ||
2 | |||
3 | action="$1" | ||
4 | oldversion="$2" | ||
5 | |||
6 | if [ "$action" != configure ]; then | ||
7 | exit 0 | ||
8 | fi | ||
9 | |||
10 | if [ ! -L /usr/share/doc/ssh ] && \ | ||
11 | dpkg --compare-versions "$oldversion" lt-nl 1:4.1p1-5; then | ||
12 | rm -rf /usr/share/doc/ssh | ||
13 | ln -s openssh-client /usr/share/doc/ssh | ||
14 | fi | ||
15 | |||
16 | #DEBHELPER# | ||
17 | |||
18 | exit 0 | ||
diff --git a/debian/ssh.prerm b/debian/ssh.prerm new file mode 100644 index 000000000..400c92bed --- /dev/null +++ b/debian/ssh.prerm | |||
@@ -0,0 +1,14 @@ | |||
1 | #!/bin/sh -e | ||
2 | |||
3 | case $1 in | ||
4 | upgrade) | ||
5 | if [ -L /usr/share/doc/ssh ] && \ | ||
6 | dpkg --compare-versions "$2" lt-nl 1:4.1p1-5; then | ||
7 | rm -f /usr/share/doc/ssh | ||
8 | fi | ||
9 | ;; | ||
10 | esac | ||
11 | |||
12 | #DEBHELPER# | ||
13 | |||
14 | exit 0 | ||
diff --git a/debian/substitute-conffile.pl b/debian/substitute-conffile.pl new file mode 100644 index 000000000..7dd23363e --- /dev/null +++ b/debian/substitute-conffile.pl | |||
@@ -0,0 +1,26 @@ | |||
1 | #! /usr/bin/perl -p | ||
2 | |||
3 | # This is needed for a nasty preinst hack to work around a bug in sarge's | ||
4 | # version of dpkg. It substitutes the literal text of conffiles into preinst | ||
5 | # scripts so that they can be used when moving conffiles between packages. | ||
6 | |||
7 | BEGIN { | ||
8 | %texts = (); | ||
9 | while (@ARGV > 1) { | ||
10 | my $name = $ARGV[0]; | ||
11 | shift; | ||
12 | local *FILE; | ||
13 | open FILE, '<', $ARGV[0]; | ||
14 | local $/ = undef; | ||
15 | my $text = <FILE>; | ||
16 | close FILE; | ||
17 | # Quote for the shell. | ||
18 | $text =~ s/'/'\\''/g; | ||
19 | shift; | ||
20 | $texts{$name} = $text; | ||
21 | } | ||
22 | } | ||
23 | |||
24 | for my $name (keys %texts) { | ||
25 | s/\@$name\@/'$texts{$name}'/g; | ||
26 | } | ||
diff --git a/debian/tests/Makefile b/debian/tests/Makefile new file mode 100644 index 000000000..666ed8227 --- /dev/null +++ b/debian/tests/Makefile | |||
@@ -0,0 +1,12 @@ | |||
1 | test: getpid.so | ||
2 | chmod +x keygen-test | ||
3 | ./keygen-test | ||
4 | |||
5 | getpid.o: getpid.c | ||
6 | gcc -fPIC -c $< -o $@ | ||
7 | |||
8 | getpid.so: getpid.o | ||
9 | gcc -shared -o $@ $< | ||
10 | |||
11 | clean: | ||
12 | rm -f getpid.o getpid.so key1 key1.pub key2 key2.pub | ||
diff --git a/debian/tests/getpid.c b/debian/tests/getpid.c new file mode 100644 index 000000000..c9e35b87e --- /dev/null +++ b/debian/tests/getpid.c | |||
@@ -0,0 +1,39 @@ | |||
1 | /* | ||
2 | * Compile: | ||
3 | |||
4 | gcc -fPIC -c getpid.c -o getpid.o | ||
5 | gcc -shared -o getpid.so getpid.o | ||
6 | |||
7 | * Use: | ||
8 | |||
9 | FORCE_PID=1234 LD_PRELOAD=./getpid.so bash | ||
10 | |||
11 | # | ||
12 | # Copyright (C) 2001-2008 Kees Cook | ||
13 | # kees@outflux.net, http://outflux.net/ | ||
14 | # | ||
15 | # This program is free software; you can redistribute it and/or | ||
16 | # modify it under the terms of the GNU General Public License | ||
17 | # as published by the Free Software Foundation; either version 2 | ||
18 | # of the License, or (at your option) any later version. | ||
19 | # | ||
20 | # This program is distributed in the hope that it will be useful, | ||
21 | # but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
22 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||
23 | # GNU General Public License for more details. | ||
24 | # | ||
25 | # You should have received a copy of the GNU General Public License | ||
26 | # along with this program; if not, write to the Free Software | ||
27 | # Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. | ||
28 | # http://www.gnu.org/copyleft/gpl.html | ||
29 | |||
30 | */ | ||
31 | |||
32 | #include <sys/types.h> | ||
33 | #include <unistd.h> | ||
34 | #include <stdlib.h> | ||
35 | |||
36 | pid_t getpid(void) | ||
37 | { | ||
38 | return atoi(getenv("FORCE_PID")); | ||
39 | } | ||
diff --git a/debian/tests/keygen-test b/debian/tests/keygen-test new file mode 100755 index 000000000..02b7c761a --- /dev/null +++ b/debian/tests/keygen-test | |||
@@ -0,0 +1,12 @@ | |||
1 | #! /bin/sh | ||
2 | |||
3 | rm -f key1 key1.pub key2 key2.pub | ||
4 | LD_PRELOAD="$(pwd)/getpid.so" FORCE_PID=1234 \ | ||
5 | ../../build-deb/ssh-keygen -N '' -f key1 >/dev/null | ||
6 | LD_PRELOAD="$(pwd)/getpid.so" FORCE_PID=1234 \ | ||
7 | ../../build-deb/ssh-keygen -N '' -f key2 >/dev/null | ||
8 | if cmp -s key1 key2; then | ||
9 | echo "Generated two identical keys!" >&2 | ||
10 | exit 1 | ||
11 | fi | ||
12 | exit 0 | ||
diff --git a/debian/watch b/debian/watch new file mode 100644 index 000000000..6ffdc3708 --- /dev/null +++ b/debian/watch | |||
@@ -0,0 +1,3 @@ | |||
1 | version=2 | ||
2 | ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-(.*)\.tar\.gz \ | ||
3 | debian uupdate | ||
@@ -177,6 +177,7 @@ verify_host_key_dns(const char *hostname, struct sockaddr *address, | |||
177 | { | 177 | { |
178 | u_int counter; | 178 | u_int counter; |
179 | int result; | 179 | int result; |
180 | unsigned int rrset_flags = 0; | ||
180 | struct rrsetinfo *fingerprints = NULL; | 181 | struct rrsetinfo *fingerprints = NULL; |
181 | 182 | ||
182 | u_int8_t hostkey_algorithm; | 183 | u_int8_t hostkey_algorithm; |
@@ -200,8 +201,19 @@ verify_host_key_dns(const char *hostname, struct sockaddr *address, | |||
200 | return -1; | 201 | return -1; |
201 | } | 202 | } |
202 | 203 | ||
204 | /* | ||
205 | * Original getrrsetbyname function, found on OpenBSD for example, | ||
206 | * doesn't accept any flag and prerequisite for obtaining AD bit in | ||
207 | * DNS response is set by "options edns0" in resolv.conf. | ||
208 | * | ||
209 | * Our version is more clever and use RRSET_FORCE_EDNS0 flag. | ||
210 | */ | ||
211 | #ifndef HAVE_GETRRSETBYNAME | ||
212 | rrset_flags |= RRSET_FORCE_EDNS0; | ||
213 | #endif | ||
203 | result = getrrsetbyname(hostname, DNS_RDATACLASS_IN, | 214 | result = getrrsetbyname(hostname, DNS_RDATACLASS_IN, |
204 | DNS_RDATATYPE_SSHFP, 0, &fingerprints); | 215 | DNS_RDATATYPE_SSHFP, rrset_flags, &fingerprints); |
216 | |||
205 | if (result) { | 217 | if (result) { |
206 | verbose("DNS lookup error: %s", dns_result_totext(result)); | 218 | verbose("DNS lookup error: %s", dns_result_totext(result)); |
207 | return -1; | 219 | return -1; |
@@ -92,6 +92,7 @@ static struct { | |||
92 | LogLevel val; | 92 | LogLevel val; |
93 | } log_levels[] = | 93 | } log_levels[] = |
94 | { | 94 | { |
95 | { "SILENT", SYSLOG_LEVEL_QUIET }, /* compatibility */ | ||
95 | { "QUIET", SYSLOG_LEVEL_QUIET }, | 96 | { "QUIET", SYSLOG_LEVEL_QUIET }, |
96 | { "FATAL", SYSLOG_LEVEL_FATAL }, | 97 | { "FATAL", SYSLOG_LEVEL_FATAL }, |
97 | { "ERROR", SYSLOG_LEVEL_ERROR }, | 98 | { "ERROR", SYSLOG_LEVEL_ERROR }, |
@@ -48,8 +48,9 @@ | |||
48 | #include <netdb.h> | 48 | #include <netdb.h> |
49 | #ifdef HAVE_PATHS_H | 49 | #ifdef HAVE_PATHS_H |
50 | # include <paths.h> | 50 | # include <paths.h> |
51 | #include <pwd.h> | ||
52 | #endif | 51 | #endif |
52 | #include <pwd.h> | ||
53 | #include <grp.h> | ||
53 | #ifdef SSH_TUN_OPENBSD | 54 | #ifdef SSH_TUN_OPENBSD |
54 | #include <net/if.h> | 55 | #include <net/if.h> |
55 | #endif | 56 | #endif |
@@ -642,6 +643,55 @@ read_keyfile_line(FILE *f, const char *filename, char *buf, size_t bufsz, | |||
642 | } | 643 | } |
643 | 644 | ||
644 | int | 645 | int |
646 | secure_permissions(struct stat *st, uid_t uid) | ||
647 | { | ||
648 | if (st->st_uid != 0 && st->st_uid != uid) | ||
649 | return 0; | ||
650 | if ((st->st_mode & 002) != 0) | ||
651 | return 0; | ||
652 | if ((st->st_mode & 020) != 0) { | ||
653 | /* If the file is group-writable, the group in question must | ||
654 | * have exactly one member, namely the file's owner. | ||
655 | * (Zero-member groups are typically used by setgid | ||
656 | * binaries, and are unlikely to be suitable.) | ||
657 | */ | ||
658 | struct passwd *pw; | ||
659 | struct group *gr; | ||
660 | int members = 0; | ||
661 | |||
662 | gr = getgrgid(st->st_gid); | ||
663 | if (!gr) | ||
664 | return 0; | ||
665 | |||
666 | /* Check primary group memberships. */ | ||
667 | while ((pw = getpwent()) != NULL) { | ||
668 | if (pw->pw_gid == gr->gr_gid) { | ||
669 | ++members; | ||
670 | if (pw->pw_uid != uid) | ||
671 | return 0; | ||
672 | } | ||
673 | } | ||
674 | endpwent(); | ||
675 | |||
676 | pw = getpwuid(st->st_uid); | ||
677 | if (!pw) | ||
678 | return 0; | ||
679 | |||
680 | /* Check supplementary group memberships. */ | ||
681 | if (gr->gr_mem[0]) { | ||
682 | ++members; | ||
683 | if (strcmp(pw->pw_name, gr->gr_mem[0]) || | ||
684 | gr->gr_mem[1]) | ||
685 | return 0; | ||
686 | } | ||
687 | |||
688 | if (!members) | ||
689 | return 0; | ||
690 | } | ||
691 | return 1; | ||
692 | } | ||
693 | |||
694 | int | ||
645 | tun_open(int tun, int mode) | 695 | tun_open(int tun, int mode) |
646 | { | 696 | { |
647 | #if defined(CUSTOM_SYS_TUN_OPEN) | 697 | #if defined(CUSTOM_SYS_TUN_OPEN) |
@@ -103,4 +103,6 @@ char *read_passphrase(const char *, int); | |||
103 | int ask_permission(const char *, ...) __attribute__((format(printf, 1, 2))); | 103 | int ask_permission(const char *, ...) __attribute__((format(printf, 1, 2))); |
104 | int read_keyfile_line(FILE *, const char *, char *, size_t, u_long *); | 104 | int read_keyfile_line(FILE *, const char *, char *, size_t, u_long *); |
105 | 105 | ||
106 | int secure_permissions(struct stat *st, uid_t uid); | ||
107 | |||
106 | #endif /* _MISC_H */ | 108 | #endif /* _MISC_H */ |
@@ -21,7 +21,7 @@ | |||
21 | .Nd Diffie-Hellman moduli | 21 | .Nd Diffie-Hellman moduli |
22 | .Sh DESCRIPTION | 22 | .Sh DESCRIPTION |
23 | The | 23 | The |
24 | .Pa /etc/moduli | 24 | .Pa /etc/ssh/moduli |
25 | file contains prime numbers and generators for use by | 25 | file contains prime numbers and generators for use by |
26 | .Xr sshd 8 | 26 | .Xr sshd 8 |
27 | in the Diffie-Hellman Group Exchange key exchange method. | 27 | in the Diffie-Hellman Group Exchange key exchange method. |
@@ -110,7 +110,7 @@ first estimates the size of the modulus required to produce enough | |||
110 | Diffie-Hellman output to sufficiently key the selected symmetric cipher. | 110 | Diffie-Hellman output to sufficiently key the selected symmetric cipher. |
111 | .Xr sshd 8 | 111 | .Xr sshd 8 |
112 | then randomly selects a modulus from | 112 | then randomly selects a modulus from |
113 | .Fa /etc/moduli | 113 | .Fa /etc/ssh/moduli |
114 | that best meets the size requirement. | 114 | that best meets the size requirement. |
115 | .Sh SEE ALSO | 115 | .Sh SEE ALSO |
116 | .Xr ssh-keygen 1 , | 116 | .Xr ssh-keygen 1 , |
@@ -145,6 +145,7 @@ int mm_answer_sign(int, Buffer *); | |||
145 | int mm_answer_pwnamallow(int, Buffer *); | 145 | int mm_answer_pwnamallow(int, Buffer *); |
146 | int mm_answer_auth2_read_banner(int, Buffer *); | 146 | int mm_answer_auth2_read_banner(int, Buffer *); |
147 | int mm_answer_authserv(int, Buffer *); | 147 | int mm_answer_authserv(int, Buffer *); |
148 | int mm_answer_authrole(int, Buffer *); | ||
148 | int mm_answer_authpassword(int, Buffer *); | 149 | int mm_answer_authpassword(int, Buffer *); |
149 | int mm_answer_bsdauthquery(int, Buffer *); | 150 | int mm_answer_bsdauthquery(int, Buffer *); |
150 | int mm_answer_bsdauthrespond(int, Buffer *); | 151 | int mm_answer_bsdauthrespond(int, Buffer *); |
@@ -225,6 +226,7 @@ struct mon_table mon_dispatch_proto20[] = { | |||
225 | {MONITOR_REQ_SIGN, MON_ONCE, mm_answer_sign}, | 226 | {MONITOR_REQ_SIGN, MON_ONCE, mm_answer_sign}, |
226 | {MONITOR_REQ_PWNAM, MON_ONCE, mm_answer_pwnamallow}, | 227 | {MONITOR_REQ_PWNAM, MON_ONCE, mm_answer_pwnamallow}, |
227 | {MONITOR_REQ_AUTHSERV, MON_ONCE, mm_answer_authserv}, | 228 | {MONITOR_REQ_AUTHSERV, MON_ONCE, mm_answer_authserv}, |
229 | {MONITOR_REQ_AUTHROLE, MON_ONCE, mm_answer_authrole}, | ||
228 | {MONITOR_REQ_AUTH2_READ_BANNER, MON_ONCE, mm_answer_auth2_read_banner}, | 230 | {MONITOR_REQ_AUTH2_READ_BANNER, MON_ONCE, mm_answer_auth2_read_banner}, |
229 | {MONITOR_REQ_AUTHPASSWORD, MON_AUTH, mm_answer_authpassword}, | 231 | {MONITOR_REQ_AUTHPASSWORD, MON_AUTH, mm_answer_authpassword}, |
230 | #ifdef USE_PAM | 232 | #ifdef USE_PAM |
@@ -810,6 +812,7 @@ mm_answer_pwnamallow(int sock, Buffer *m) | |||
810 | else { | 812 | else { |
811 | /* Allow service/style information on the auth context */ | 813 | /* Allow service/style information on the auth context */ |
812 | monitor_permit(mon_dispatch, MONITOR_REQ_AUTHSERV, 1); | 814 | monitor_permit(mon_dispatch, MONITOR_REQ_AUTHSERV, 1); |
815 | monitor_permit(mon_dispatch, MONITOR_REQ_AUTHROLE, 1); | ||
813 | monitor_permit(mon_dispatch, MONITOR_REQ_AUTH2_READ_BANNER, 1); | 816 | monitor_permit(mon_dispatch, MONITOR_REQ_AUTH2_READ_BANNER, 1); |
814 | } | 817 | } |
815 | #ifdef USE_PAM | 818 | #ifdef USE_PAM |
@@ -842,14 +845,37 @@ mm_answer_authserv(int sock, Buffer *m) | |||
842 | 845 | ||
843 | authctxt->service = buffer_get_string(m, NULL); | 846 | authctxt->service = buffer_get_string(m, NULL); |
844 | authctxt->style = buffer_get_string(m, NULL); | 847 | authctxt->style = buffer_get_string(m, NULL); |
845 | debug3("%s: service=%s, style=%s", | 848 | authctxt->role = buffer_get_string(m, NULL); |
846 | __func__, authctxt->service, authctxt->style); | 849 | debug3("%s: service=%s, style=%s, role=%s", |
850 | __func__, authctxt->service, authctxt->style, authctxt->role); | ||
847 | 851 | ||
848 | if (strlen(authctxt->style) == 0) { | 852 | if (strlen(authctxt->style) == 0) { |
849 | xfree(authctxt->style); | 853 | xfree(authctxt->style); |
850 | authctxt->style = NULL; | 854 | authctxt->style = NULL; |
851 | } | 855 | } |
852 | 856 | ||
857 | if (strlen(authctxt->role) == 0) { | ||
858 | xfree(authctxt->role); | ||
859 | authctxt->role = NULL; | ||
860 | } | ||
861 | |||
862 | return (0); | ||
863 | } | ||
864 | |||
865 | int | ||
866 | mm_answer_authrole(int sock, Buffer *m) | ||
867 | { | ||
868 | monitor_permit_authentications(1); | ||
869 | |||
870 | authctxt->role = buffer_get_string(m, NULL); | ||
871 | debug3("%s: role=%s", | ||
872 | __func__, authctxt->role); | ||
873 | |||
874 | if (strlen(authctxt->role) == 0) { | ||
875 | xfree(authctxt->role); | ||
876 | authctxt->role = NULL; | ||
877 | } | ||
878 | |||
853 | return (0); | 879 | return (0); |
854 | } | 880 | } |
855 | 881 | ||
@@ -1437,7 +1463,7 @@ mm_answer_pty(int sock, Buffer *m) | |||
1437 | res = pty_allocate(&s->ptyfd, &s->ttyfd, s->tty, sizeof(s->tty)); | 1463 | res = pty_allocate(&s->ptyfd, &s->ttyfd, s->tty, sizeof(s->tty)); |
1438 | if (res == 0) | 1464 | if (res == 0) |
1439 | goto error; | 1465 | goto error; |
1440 | pty_setowner(authctxt->pw, s->tty); | 1466 | pty_setowner(authctxt->pw, s->tty, authctxt->role); |
1441 | 1467 | ||
1442 | buffer_put_int(m, 1); | 1468 | buffer_put_int(m, 1); |
1443 | buffer_put_cstring(m, s->tty); | 1469 | buffer_put_cstring(m, s->tty); |
@@ -30,7 +30,7 @@ | |||
30 | 30 | ||
31 | enum monitor_reqtype { | 31 | enum monitor_reqtype { |
32 | MONITOR_REQ_MODULI, MONITOR_ANS_MODULI, | 32 | MONITOR_REQ_MODULI, MONITOR_ANS_MODULI, |
33 | MONITOR_REQ_FREE, MONITOR_REQ_AUTHSERV, | 33 | MONITOR_REQ_FREE, MONITOR_REQ_AUTHSERV, MONITOR_REQ_AUTHROLE, |
34 | MONITOR_REQ_SIGN, MONITOR_ANS_SIGN, | 34 | MONITOR_REQ_SIGN, MONITOR_ANS_SIGN, |
35 | MONITOR_REQ_PWNAM, MONITOR_ANS_PWNAM, | 35 | MONITOR_REQ_PWNAM, MONITOR_ANS_PWNAM, |
36 | MONITOR_REQ_AUTH2_READ_BANNER, MONITOR_ANS_AUTH2_READ_BANNER, | 36 | MONITOR_REQ_AUTH2_READ_BANNER, MONITOR_ANS_AUTH2_READ_BANNER, |
diff --git a/monitor_wrap.c b/monitor_wrap.c index fc6bbcd2e..f46be660d 100644 --- a/monitor_wrap.c +++ b/monitor_wrap.c | |||
@@ -318,10 +318,10 @@ mm_auth2_read_banner(void) | |||
318 | return (banner); | 318 | return (banner); |
319 | } | 319 | } |
320 | 320 | ||
321 | /* Inform the privileged process about service and style */ | 321 | /* Inform the privileged process about service, style, and role */ |
322 | 322 | ||
323 | void | 323 | void |
324 | mm_inform_authserv(char *service, char *style) | 324 | mm_inform_authserv(char *service, char *style, char *role) |
325 | { | 325 | { |
326 | Buffer m; | 326 | Buffer m; |
327 | 327 | ||
@@ -330,12 +330,30 @@ mm_inform_authserv(char *service, char *style) | |||
330 | buffer_init(&m); | 330 | buffer_init(&m); |
331 | buffer_put_cstring(&m, service); | 331 | buffer_put_cstring(&m, service); |
332 | buffer_put_cstring(&m, style ? style : ""); | 332 | buffer_put_cstring(&m, style ? style : ""); |
333 | buffer_put_cstring(&m, role ? role : ""); | ||
333 | 334 | ||
334 | mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUTHSERV, &m); | 335 | mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUTHSERV, &m); |
335 | 336 | ||
336 | buffer_free(&m); | 337 | buffer_free(&m); |
337 | } | 338 | } |
338 | 339 | ||
340 | /* Inform the privileged process about role */ | ||
341 | |||
342 | void | ||
343 | mm_inform_authrole(char *role) | ||
344 | { | ||
345 | Buffer m; | ||
346 | |||
347 | debug3("%s entering", __func__); | ||
348 | |||
349 | buffer_init(&m); | ||
350 | buffer_put_cstring(&m, role ? role : ""); | ||
351 | |||
352 | mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUTHROLE, &m); | ||
353 | |||
354 | buffer_free(&m); | ||
355 | } | ||
356 | |||
339 | /* Do the password authentication */ | 357 | /* Do the password authentication */ |
340 | int | 358 | int |
341 | mm_auth_password(Authctxt *authctxt, char *password) | 359 | mm_auth_password(Authctxt *authctxt, char *password) |
diff --git a/monitor_wrap.h b/monitor_wrap.h index ec9b9b1c3..4d12e2956 100644 --- a/monitor_wrap.h +++ b/monitor_wrap.h | |||
@@ -41,7 +41,8 @@ void mm_log_handler(LogLevel, const char *, void *); | |||
41 | int mm_is_monitor(void); | 41 | int mm_is_monitor(void); |
42 | DH *mm_choose_dh(int, int, int); | 42 | DH *mm_choose_dh(int, int, int); |
43 | int mm_key_sign(Key *, u_char **, u_int *, u_char *, u_int); | 43 | int mm_key_sign(Key *, u_char **, u_int *, u_char *, u_int); |
44 | void mm_inform_authserv(char *, char *); | 44 | void mm_inform_authserv(char *, char *, char *); |
45 | void mm_inform_authrole(char *); | ||
45 | struct passwd *mm_getpwnamallow(const char *); | 46 | struct passwd *mm_getpwnamallow(const char *); |
46 | char *mm_auth2_read_banner(void); | 47 | char *mm_auth2_read_banner(void); |
47 | int mm_auth_password(struct Authctxt *, char *); | 48 | int mm_auth_password(struct Authctxt *, char *); |
diff --git a/openbsd-compat/getrrsetbyname.c b/openbsd-compat/getrrsetbyname.c index 98876673d..011821198 100644 --- a/openbsd-compat/getrrsetbyname.c +++ b/openbsd-compat/getrrsetbyname.c | |||
@@ -209,8 +209,8 @@ getrrsetbyname(const char *hostname, unsigned int rdclass, | |||
209 | goto fail; | 209 | goto fail; |
210 | } | 210 | } |
211 | 211 | ||
212 | /* don't allow flags yet, unimplemented */ | 212 | /* Allow RRSET_FORCE_EDNS0 flag only. */ |
213 | if (flags) { | 213 | if ((flags & !RRSET_FORCE_EDNS0) != 0) { |
214 | result = ERRSET_INVAL; | 214 | result = ERRSET_INVAL; |
215 | goto fail; | 215 | goto fail; |
216 | } | 216 | } |
@@ -226,9 +226,9 @@ getrrsetbyname(const char *hostname, unsigned int rdclass, | |||
226 | #endif /* DEBUG */ | 226 | #endif /* DEBUG */ |
227 | 227 | ||
228 | #ifdef RES_USE_DNSSEC | 228 | #ifdef RES_USE_DNSSEC |
229 | /* turn on DNSSEC if EDNS0 is configured */ | 229 | /* turn on DNSSEC if required */ |
230 | if (_resp->options & RES_USE_EDNS0) | 230 | if (flags & RRSET_FORCE_EDNS0) |
231 | _resp->options |= RES_USE_DNSSEC; | 231 | _resp->options |= (RES_USE_EDNS0|RES_USE_DNSSEC); |
232 | #endif /* RES_USE_DNSEC */ | 232 | #endif /* RES_USE_DNSEC */ |
233 | 233 | ||
234 | /* make query */ | 234 | /* make query */ |
diff --git a/openbsd-compat/getrrsetbyname.h b/openbsd-compat/getrrsetbyname.h index 1283f5506..dbbc85a2a 100644 --- a/openbsd-compat/getrrsetbyname.h +++ b/openbsd-compat/getrrsetbyname.h | |||
@@ -72,6 +72,9 @@ | |||
72 | #ifndef RRSET_VALIDATED | 72 | #ifndef RRSET_VALIDATED |
73 | # define RRSET_VALIDATED 1 | 73 | # define RRSET_VALIDATED 1 |
74 | #endif | 74 | #endif |
75 | #ifndef RRSET_FORCE_EDNS0 | ||
76 | # define RRSET_FORCE_EDNS0 0x0001 | ||
77 | #endif | ||
75 | 78 | ||
76 | /* | 79 | /* |
77 | * Return codes for getrrsetbyname() | 80 | * Return codes for getrrsetbyname() |
diff --git a/openbsd-compat/port-linux.c b/openbsd-compat/port-linux.c index ea8dff40f..ef91e4446 100644 --- a/openbsd-compat/port-linux.c +++ b/openbsd-compat/port-linux.c | |||
@@ -29,6 +29,12 @@ | |||
29 | #include <string.h> | 29 | #include <string.h> |
30 | #include <stdio.h> | 30 | #include <stdio.h> |
31 | 31 | ||
32 | #ifdef WITH_SELINUX | ||
33 | #include "key.h" | ||
34 | #include "hostfile.h" | ||
35 | #include "auth.h" | ||
36 | #endif | ||
37 | |||
32 | #include "log.h" | 38 | #include "log.h" |
33 | #include "xmalloc.h" | 39 | #include "xmalloc.h" |
34 | #include "port-linux.h" | 40 | #include "port-linux.h" |
@@ -58,9 +64,9 @@ ssh_selinux_enabled(void) | |||
58 | 64 | ||
59 | /* Return the default security context for the given username */ | 65 | /* Return the default security context for the given username */ |
60 | static security_context_t | 66 | static security_context_t |
61 | ssh_selinux_getctxbyname(char *pwname) | 67 | ssh_selinux_getctxbyname(char *pwname, const char *role) |
62 | { | 68 | { |
63 | security_context_t sc; | 69 | security_context_t sc = NULL; |
64 | char *sename = NULL, *lvl = NULL; | 70 | char *sename = NULL, *lvl = NULL; |
65 | int r; | 71 | int r; |
66 | 72 | ||
@@ -73,9 +79,16 @@ ssh_selinux_getctxbyname(char *pwname) | |||
73 | #endif | 79 | #endif |
74 | 80 | ||
75 | #ifdef HAVE_GET_DEFAULT_CONTEXT_WITH_LEVEL | 81 | #ifdef HAVE_GET_DEFAULT_CONTEXT_WITH_LEVEL |
76 | r = get_default_context_with_level(sename, lvl, NULL, &sc); | 82 | if (role != NULL && role[0]) |
83 | r = get_default_context_with_rolelevel(sename, role, lvl, NULL, | ||
84 | &sc); | ||
85 | else | ||
86 | r = get_default_context_with_level(sename, lvl, NULL, &sc); | ||
77 | #else | 87 | #else |
78 | r = get_default_context(sename, NULL, &sc); | 88 | if (role != NULL && role[0]) |
89 | r = get_default_context_with_role(sename, role, NULL, &sc); | ||
90 | else | ||
91 | r = get_default_context(sename, NULL, &sc); | ||
79 | #endif | 92 | #endif |
80 | 93 | ||
81 | if (r != 0) { | 94 | if (r != 0) { |
@@ -106,7 +119,7 @@ ssh_selinux_getctxbyname(char *pwname) | |||
106 | 119 | ||
107 | /* Set the execution context to the default for the specified user */ | 120 | /* Set the execution context to the default for the specified user */ |
108 | void | 121 | void |
109 | ssh_selinux_setup_exec_context(char *pwname) | 122 | ssh_selinux_setup_exec_context(char *pwname, const char *role) |
110 | { | 123 | { |
111 | security_context_t user_ctx = NULL; | 124 | security_context_t user_ctx = NULL; |
112 | 125 | ||
@@ -115,7 +128,7 @@ ssh_selinux_setup_exec_context(char *pwname) | |||
115 | 128 | ||
116 | debug3("%s: setting execution context", __func__); | 129 | debug3("%s: setting execution context", __func__); |
117 | 130 | ||
118 | user_ctx = ssh_selinux_getctxbyname(pwname); | 131 | user_ctx = ssh_selinux_getctxbyname(pwname, role); |
119 | if (setexeccon(user_ctx) != 0) { | 132 | if (setexeccon(user_ctx) != 0) { |
120 | switch (security_getenforce()) { | 133 | switch (security_getenforce()) { |
121 | case -1: | 134 | case -1: |
@@ -137,7 +150,7 @@ ssh_selinux_setup_exec_context(char *pwname) | |||
137 | 150 | ||
138 | /* Set the TTY context for the specified user */ | 151 | /* Set the TTY context for the specified user */ |
139 | void | 152 | void |
140 | ssh_selinux_setup_pty(char *pwname, const char *tty) | 153 | ssh_selinux_setup_pty(char *pwname, const char *tty, const char *role) |
141 | { | 154 | { |
142 | security_context_t new_tty_ctx = NULL; | 155 | security_context_t new_tty_ctx = NULL; |
143 | security_context_t user_ctx = NULL; | 156 | security_context_t user_ctx = NULL; |
@@ -148,7 +161,7 @@ ssh_selinux_setup_pty(char *pwname, const char *tty) | |||
148 | 161 | ||
149 | debug3("%s: setting TTY context on %s", __func__, tty); | 162 | debug3("%s: setting TTY context on %s", __func__, tty); |
150 | 163 | ||
151 | user_ctx = ssh_selinux_getctxbyname(pwname); | 164 | user_ctx = ssh_selinux_getctxbyname(pwname, role); |
152 | 165 | ||
153 | /* XXX: should these calls fatal() upon failure in enforcing mode? */ | 166 | /* XXX: should these calls fatal() upon failure in enforcing mode? */ |
154 | 167 | ||
diff --git a/openbsd-compat/port-linux.h b/openbsd-compat/port-linux.h index e3d1004aa..80ce13ad9 100644 --- a/openbsd-compat/port-linux.h +++ b/openbsd-compat/port-linux.h | |||
@@ -21,8 +21,8 @@ | |||
21 | 21 | ||
22 | #ifdef WITH_SELINUX | 22 | #ifdef WITH_SELINUX |
23 | int ssh_selinux_enabled(void); | 23 | int ssh_selinux_enabled(void); |
24 | void ssh_selinux_setup_pty(char *, const char *); | 24 | void ssh_selinux_setup_pty(char *, const char *, const char *); |
25 | void ssh_selinux_setup_exec_context(char *); | 25 | void ssh_selinux_setup_exec_context(char *, const char *); |
26 | void ssh_selinux_change_context(const char *); | 26 | void ssh_selinux_change_context(const char *); |
27 | void ssh_selinux_setfscreatecon(const char *); | 27 | void ssh_selinux_setfscreatecon(const char *); |
28 | #endif | 28 | #endif |
diff --git a/pathnames.h b/pathnames.h index c3d9abff5..0cdfcef7f 100644 --- a/pathnames.h +++ b/pathnames.h | |||
@@ -18,6 +18,10 @@ | |||
18 | #define SSHDIR ETCDIR "/ssh" | 18 | #define SSHDIR ETCDIR "/ssh" |
19 | #endif | 19 | #endif |
20 | 20 | ||
21 | #ifndef _PATH_SSH_DATADIR | ||
22 | #define _PATH_SSH_DATADIR "/usr/share/ssh" | ||
23 | #endif | ||
24 | |||
21 | #ifndef _PATH_SSH_PIDDIR | 25 | #ifndef _PATH_SSH_PIDDIR |
22 | #define _PATH_SSH_PIDDIR "/var/run" | 26 | #define _PATH_SSH_PIDDIR "/var/run" |
23 | #endif | 27 | #endif |
@@ -44,6 +48,9 @@ | |||
44 | /* Backwards compatibility */ | 48 | /* Backwards compatibility */ |
45 | #define _PATH_DH_PRIMES SSHDIR "/primes" | 49 | #define _PATH_DH_PRIMES SSHDIR "/primes" |
46 | 50 | ||
51 | #define _PATH_BLACKLIST _PATH_SSH_DATADIR "/blacklist" | ||
52 | #define _PATH_BLACKLIST_CONFIG SSHDIR "/blacklist" | ||
53 | |||
47 | #ifndef _PATH_SSH_PROGRAM | 54 | #ifndef _PATH_SSH_PROGRAM |
48 | #define _PATH_SSH_PROGRAM "/usr/bin/ssh" | 55 | #define _PATH_SSH_PROGRAM "/usr/bin/ssh" |
49 | #endif | 56 | #endif |
diff --git a/platform.c b/platform.c index a455472b3..e707aa4c7 100644 --- a/platform.c +++ b/platform.c | |||
@@ -134,7 +134,7 @@ platform_setusercontext(struct passwd *pw) | |||
134 | * called if sshd is running as root. | 134 | * called if sshd is running as root. |
135 | */ | 135 | */ |
136 | void | 136 | void |
137 | platform_setusercontext_post_groups(struct passwd *pw) | 137 | platform_setusercontext_post_groups(struct passwd *pw, const char *role) |
138 | { | 138 | { |
139 | #if !defined(HAVE_LOGIN_CAP) && defined(USE_PAM) | 139 | #if !defined(HAVE_LOGIN_CAP) && defined(USE_PAM) |
140 | /* | 140 | /* |
@@ -181,7 +181,7 @@ platform_setusercontext_post_groups(struct passwd *pw) | |||
181 | } | 181 | } |
182 | #endif /* HAVE_SETPCRED */ | 182 | #endif /* HAVE_SETPCRED */ |
183 | #ifdef WITH_SELINUX | 183 | #ifdef WITH_SELINUX |
184 | ssh_selinux_setup_exec_context(pw->pw_name); | 184 | ssh_selinux_setup_exec_context(pw->pw_name, role); |
185 | #endif | 185 | #endif |
186 | } | 186 | } |
187 | 187 | ||
diff --git a/platform.h b/platform.h index 944d2c340..7b2d481af 100644 --- a/platform.h +++ b/platform.h | |||
@@ -26,7 +26,7 @@ void platform_post_fork_parent(pid_t child_pid); | |||
26 | void platform_post_fork_child(void); | 26 | void platform_post_fork_child(void); |
27 | int platform_privileged_uidswap(void); | 27 | int platform_privileged_uidswap(void); |
28 | void platform_setusercontext(struct passwd *); | 28 | void platform_setusercontext(struct passwd *); |
29 | void platform_setusercontext_post_groups(struct passwd *); | 29 | void platform_setusercontext_post_groups(struct passwd *, const char *); |
30 | char *platform_get_krb5_client(const char *); | 30 | char *platform_get_krb5_client(const char *); |
31 | char *platform_krb5_get_principal_name(const char *); | 31 | char *platform_krb5_get_principal_name(const char *); |
32 | 32 | ||
diff --git a/readconf.c b/readconf.c index 60befde59..7a26e923b 100644 --- a/readconf.c +++ b/readconf.c | |||
@@ -30,6 +30,8 @@ | |||
30 | #include <stdio.h> | 30 | #include <stdio.h> |
31 | #include <string.h> | 31 | #include <string.h> |
32 | #include <unistd.h> | 32 | #include <unistd.h> |
33 | #include <pwd.h> | ||
34 | #include <grp.h> | ||
33 | 35 | ||
34 | #include "xmalloc.h" | 36 | #include "xmalloc.h" |
35 | #include "ssh.h" | 37 | #include "ssh.h" |
@@ -125,6 +127,7 @@ typedef enum { | |||
125 | oGlobalKnownHostsFile2, oUserKnownHostsFile2, oPubkeyAuthentication, | 127 | oGlobalKnownHostsFile2, oUserKnownHostsFile2, oPubkeyAuthentication, |
126 | oKbdInteractiveAuthentication, oKbdInteractiveDevices, oHostKeyAlias, | 128 | oKbdInteractiveAuthentication, oKbdInteractiveDevices, oHostKeyAlias, |
127 | oDynamicForward, oPreferredAuthentications, oHostbasedAuthentication, | 129 | oDynamicForward, oPreferredAuthentications, oHostbasedAuthentication, |
130 | oUseBlacklistedKeys, | ||
128 | oHostKeyAlgorithms, oBindAddress, oPKCS11Provider, | 131 | oHostKeyAlgorithms, oBindAddress, oPKCS11Provider, |
129 | oClearAllForwardings, oNoHostAuthenticationForLocalhost, | 132 | oClearAllForwardings, oNoHostAuthenticationForLocalhost, |
130 | oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout, | 133 | oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout, |
@@ -137,6 +140,7 @@ typedef enum { | |||
137 | oTunnel, oTunnelDevice, oLocalCommand, oPermitLocalCommand, | 140 | oTunnel, oTunnelDevice, oLocalCommand, oPermitLocalCommand, |
138 | oVisualHostKey, oUseRoaming, oZeroKnowledgePasswordAuthentication, | 141 | oVisualHostKey, oUseRoaming, oZeroKnowledgePasswordAuthentication, |
139 | oKexAlgorithms, oIPQoS, oRequestTTY, | 142 | oKexAlgorithms, oIPQoS, oRequestTTY, |
143 | oProtocolKeepAlives, oSetupTimeOut, | ||
140 | oDeprecated, oUnsupported | 144 | oDeprecated, oUnsupported |
141 | } OpCodes; | 145 | } OpCodes; |
142 | 146 | ||
@@ -158,6 +162,7 @@ static struct { | |||
158 | { "passwordauthentication", oPasswordAuthentication }, | 162 | { "passwordauthentication", oPasswordAuthentication }, |
159 | { "kbdinteractiveauthentication", oKbdInteractiveAuthentication }, | 163 | { "kbdinteractiveauthentication", oKbdInteractiveAuthentication }, |
160 | { "kbdinteractivedevices", oKbdInteractiveDevices }, | 164 | { "kbdinteractivedevices", oKbdInteractiveDevices }, |
165 | { "useblacklistedkeys", oUseBlacklistedKeys }, | ||
161 | { "rsaauthentication", oRSAAuthentication }, | 166 | { "rsaauthentication", oRSAAuthentication }, |
162 | { "pubkeyauthentication", oPubkeyAuthentication }, | 167 | { "pubkeyauthentication", oPubkeyAuthentication }, |
163 | { "dsaauthentication", oPubkeyAuthentication }, /* alias */ | 168 | { "dsaauthentication", oPubkeyAuthentication }, /* alias */ |
@@ -257,6 +262,8 @@ static struct { | |||
257 | { "kexalgorithms", oKexAlgorithms }, | 262 | { "kexalgorithms", oKexAlgorithms }, |
258 | { "ipqos", oIPQoS }, | 263 | { "ipqos", oIPQoS }, |
259 | { "requesttty", oRequestTTY }, | 264 | { "requesttty", oRequestTTY }, |
265 | { "protocolkeepalives", oProtocolKeepAlives }, | ||
266 | { "setuptimeout", oSetupTimeOut }, | ||
260 | 267 | ||
261 | { NULL, oBadOption } | 268 | { NULL, oBadOption } |
262 | }; | 269 | }; |
@@ -489,6 +496,10 @@ parse_flag: | |||
489 | intptr = &options->challenge_response_authentication; | 496 | intptr = &options->challenge_response_authentication; |
490 | goto parse_flag; | 497 | goto parse_flag; |
491 | 498 | ||
499 | case oUseBlacklistedKeys: | ||
500 | intptr = &options->use_blacklisted_keys; | ||
501 | goto parse_flag; | ||
502 | |||
492 | case oGssAuthentication: | 503 | case oGssAuthentication: |
493 | intptr = &options->gss_authentication; | 504 | intptr = &options->gss_authentication; |
494 | goto parse_flag; | 505 | goto parse_flag; |
@@ -908,6 +919,8 @@ parse_int: | |||
908 | goto parse_flag; | 919 | goto parse_flag; |
909 | 920 | ||
910 | case oServerAliveInterval: | 921 | case oServerAliveInterval: |
922 | case oProtocolKeepAlives: /* Debian-specific compatibility alias */ | ||
923 | case oSetupTimeOut: /* Debian-specific compatibility alias */ | ||
911 | intptr = &options->server_alive_interval; | 924 | intptr = &options->server_alive_interval; |
912 | goto parse_time; | 925 | goto parse_time; |
913 | 926 | ||
@@ -1120,8 +1133,7 @@ read_config_file(const char *filename, const char *host, Options *options, | |||
1120 | 1133 | ||
1121 | if (fstat(fileno(f), &sb) == -1) | 1134 | if (fstat(fileno(f), &sb) == -1) |
1122 | fatal("fstat %s: %s", filename, strerror(errno)); | 1135 | fatal("fstat %s: %s", filename, strerror(errno)); |
1123 | if (((sb.st_uid != 0 && sb.st_uid != getuid()) || | 1136 | if (!secure_permissions(&sb, getuid())) |
1124 | (sb.st_mode & 022) != 0)) | ||
1125 | fatal("Bad owner or permissions on %s", filename); | 1137 | fatal("Bad owner or permissions on %s", filename); |
1126 | } | 1138 | } |
1127 | 1139 | ||
@@ -1180,6 +1192,7 @@ initialize_options(Options * options) | |||
1180 | options->kbd_interactive_devices = NULL; | 1192 | options->kbd_interactive_devices = NULL; |
1181 | options->rhosts_rsa_authentication = -1; | 1193 | options->rhosts_rsa_authentication = -1; |
1182 | options->hostbased_authentication = -1; | 1194 | options->hostbased_authentication = -1; |
1195 | options->use_blacklisted_keys = -1; | ||
1183 | options->batch_mode = -1; | 1196 | options->batch_mode = -1; |
1184 | options->check_host_ip = -1; | 1197 | options->check_host_ip = -1; |
1185 | options->strict_host_key_checking = -1; | 1198 | options->strict_host_key_checking = -1; |
@@ -1255,7 +1268,7 @@ fill_default_options(Options * options) | |||
1255 | if (options->forward_x11 == -1) | 1268 | if (options->forward_x11 == -1) |
1256 | options->forward_x11 = 0; | 1269 | options->forward_x11 = 0; |
1257 | if (options->forward_x11_trusted == -1) | 1270 | if (options->forward_x11_trusted == -1) |
1258 | options->forward_x11_trusted = 0; | 1271 | options->forward_x11_trusted = 1; |
1259 | if (options->forward_x11_timeout == -1) | 1272 | if (options->forward_x11_timeout == -1) |
1260 | options->forward_x11_timeout = 1200; | 1273 | options->forward_x11_timeout = 1200; |
1261 | if (options->exit_on_forward_failure == -1) | 1274 | if (options->exit_on_forward_failure == -1) |
@@ -1290,6 +1303,8 @@ fill_default_options(Options * options) | |||
1290 | options->rhosts_rsa_authentication = 0; | 1303 | options->rhosts_rsa_authentication = 0; |
1291 | if (options->hostbased_authentication == -1) | 1304 | if (options->hostbased_authentication == -1) |
1292 | options->hostbased_authentication = 0; | 1305 | options->hostbased_authentication = 0; |
1306 | if (options->use_blacklisted_keys == -1) | ||
1307 | options->use_blacklisted_keys = 0; | ||
1293 | if (options->batch_mode == -1) | 1308 | if (options->batch_mode == -1) |
1294 | options->batch_mode = 0; | 1309 | options->batch_mode = 0; |
1295 | if (options->check_host_ip == -1) | 1310 | if (options->check_host_ip == -1) |
@@ -1376,8 +1391,13 @@ fill_default_options(Options * options) | |||
1376 | options->rekey_limit = 0; | 1391 | options->rekey_limit = 0; |
1377 | if (options->verify_host_key_dns == -1) | 1392 | if (options->verify_host_key_dns == -1) |
1378 | options->verify_host_key_dns = 0; | 1393 | options->verify_host_key_dns = 0; |
1379 | if (options->server_alive_interval == -1) | 1394 | if (options->server_alive_interval == -1) { |
1380 | options->server_alive_interval = 0; | 1395 | /* in batch mode, default is 5mins */ |
1396 | if (options->batch_mode == 1) | ||
1397 | options->server_alive_interval = 300; | ||
1398 | else | ||
1399 | options->server_alive_interval = 0; | ||
1400 | } | ||
1381 | if (options->server_alive_count_max == -1) | 1401 | if (options->server_alive_count_max == -1) |
1382 | options->server_alive_count_max = 3; | 1402 | options->server_alive_count_max = 3; |
1383 | if (options->control_master == -1) | 1403 | if (options->control_master == -1) |
diff --git a/readconf.h b/readconf.h index 617686f4c..2d9005ffa 100644 --- a/readconf.h +++ b/readconf.h | |||
@@ -58,6 +58,7 @@ typedef struct { | |||
58 | int kbd_interactive_authentication; /* Try keyboard-interactive auth. */ | 58 | int kbd_interactive_authentication; /* Try keyboard-interactive auth. */ |
59 | char *kbd_interactive_devices; /* Keyboard-interactive auth devices. */ | 59 | char *kbd_interactive_devices; /* Keyboard-interactive auth devices. */ |
60 | int zero_knowledge_password_authentication; /* Try jpake */ | 60 | int zero_knowledge_password_authentication; /* Try jpake */ |
61 | int use_blacklisted_keys; /* If true, send */ | ||
61 | int batch_mode; /* Batch mode: do not ask for passwords. */ | 62 | int batch_mode; /* Batch mode: do not ask for passwords. */ |
62 | int check_host_ip; /* Also keep track of keys for IP address */ | 63 | int check_host_ip; /* Also keep track of keys for IP address */ |
63 | int strict_host_key_checking; /* Strict host key checking. */ | 64 | int strict_host_key_checking; /* Strict host key checking. */ |
@@ -189,8 +189,16 @@ do_local_cmd(arglist *a) | |||
189 | 189 | ||
190 | if (verbose_mode) { | 190 | if (verbose_mode) { |
191 | fprintf(stderr, "Executing:"); | 191 | fprintf(stderr, "Executing:"); |
192 | for (i = 0; i < a->num; i++) | 192 | for (i = 0; i < a->num; i++) { |
193 | fprintf(stderr, " %s", a->list[i]); | 193 | if (i == 0) |
194 | fprintf(stderr, " %s", a->list[i]); | ||
195 | else | ||
196 | /* | ||
197 | * TODO: misbehaves if a->list[i] contains a | ||
198 | * single quote | ||
199 | */ | ||
200 | fprintf(stderr, " '%s'", a->list[i]); | ||
201 | } | ||
194 | fprintf(stderr, "\n"); | 202 | fprintf(stderr, "\n"); |
195 | } | 203 | } |
196 | if ((pid = fork()) == -1) | 204 | if ((pid = fork()) == -1) |
diff --git a/servconf.c b/servconf.c index 9bff59de3..1911ac540 100644 --- a/servconf.c +++ b/servconf.c | |||
@@ -104,6 +104,7 @@ initialize_server_options(ServerOptions *options) | |||
104 | options->password_authentication = -1; | 104 | options->password_authentication = -1; |
105 | options->kbd_interactive_authentication = -1; | 105 | options->kbd_interactive_authentication = -1; |
106 | options->challenge_response_authentication = -1; | 106 | options->challenge_response_authentication = -1; |
107 | options->permit_blacklisted_keys = -1; | ||
107 | options->permit_empty_passwd = -1; | 108 | options->permit_empty_passwd = -1; |
108 | options->permit_user_env = -1; | 109 | options->permit_user_env = -1; |
109 | options->use_login = -1; | 110 | options->use_login = -1; |
@@ -141,6 +142,7 @@ initialize_server_options(ServerOptions *options) | |||
141 | options->authorized_principals_file = NULL; | 142 | options->authorized_principals_file = NULL; |
142 | options->ip_qos_interactive = -1; | 143 | options->ip_qos_interactive = -1; |
143 | options->ip_qos_bulk = -1; | 144 | options->ip_qos_bulk = -1; |
145 | options->debian_banner = -1; | ||
144 | } | 146 | } |
145 | 147 | ||
146 | void | 148 | void |
@@ -242,6 +244,8 @@ fill_default_server_options(ServerOptions *options) | |||
242 | options->kbd_interactive_authentication = 0; | 244 | options->kbd_interactive_authentication = 0; |
243 | if (options->challenge_response_authentication == -1) | 245 | if (options->challenge_response_authentication == -1) |
244 | options->challenge_response_authentication = 1; | 246 | options->challenge_response_authentication = 1; |
247 | if (options->permit_blacklisted_keys == -1) | ||
248 | options->permit_blacklisted_keys = 0; | ||
245 | if (options->permit_empty_passwd == -1) | 249 | if (options->permit_empty_passwd == -1) |
246 | options->permit_empty_passwd = 0; | 250 | options->permit_empty_passwd = 0; |
247 | if (options->permit_user_env == -1) | 251 | if (options->permit_user_env == -1) |
@@ -286,6 +290,8 @@ fill_default_server_options(ServerOptions *options) | |||
286 | options->ip_qos_interactive = IPTOS_LOWDELAY; | 290 | options->ip_qos_interactive = IPTOS_LOWDELAY; |
287 | if (options->ip_qos_bulk == -1) | 291 | if (options->ip_qos_bulk == -1) |
288 | options->ip_qos_bulk = IPTOS_THROUGHPUT; | 292 | options->ip_qos_bulk = IPTOS_THROUGHPUT; |
293 | if (options->debian_banner == -1) | ||
294 | options->debian_banner = 1; | ||
289 | 295 | ||
290 | /* Turn privilege separation on by default */ | 296 | /* Turn privilege separation on by default */ |
291 | if (use_privsep == -1) | 297 | if (use_privsep == -1) |
@@ -318,7 +324,7 @@ typedef enum { | |||
318 | sListenAddress, sAddressFamily, | 324 | sListenAddress, sAddressFamily, |
319 | sPrintMotd, sPrintLastLog, sIgnoreRhosts, | 325 | sPrintMotd, sPrintLastLog, sIgnoreRhosts, |
320 | sX11Forwarding, sX11DisplayOffset, sX11UseLocalhost, | 326 | sX11Forwarding, sX11DisplayOffset, sX11UseLocalhost, |
321 | sStrictModes, sEmptyPasswd, sTCPKeepAlive, | 327 | sStrictModes, sPermitBlacklistedKeys, sEmptyPasswd, sTCPKeepAlive, |
322 | sPermitUserEnvironment, sUseLogin, sAllowTcpForwarding, sCompression, | 328 | sPermitUserEnvironment, sUseLogin, sAllowTcpForwarding, sCompression, |
323 | sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups, | 329 | sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups, |
324 | sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile, | 330 | sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile, |
@@ -335,6 +341,7 @@ typedef enum { | |||
335 | sZeroKnowledgePasswordAuthentication, sHostCertificate, | 341 | sZeroKnowledgePasswordAuthentication, sHostCertificate, |
336 | sRevokedKeys, sTrustedUserCAKeys, sAuthorizedPrincipalsFile, | 342 | sRevokedKeys, sTrustedUserCAKeys, sAuthorizedPrincipalsFile, |
337 | sKexAlgorithms, sIPQoS, | 343 | sKexAlgorithms, sIPQoS, |
344 | sDebianBanner, | ||
338 | sDeprecated, sUnsupported | 345 | sDeprecated, sUnsupported |
339 | } ServerOpCodes; | 346 | } ServerOpCodes; |
340 | 347 | ||
@@ -428,6 +435,7 @@ static struct { | |||
428 | { "x11uselocalhost", sX11UseLocalhost, SSHCFG_ALL }, | 435 | { "x11uselocalhost", sX11UseLocalhost, SSHCFG_ALL }, |
429 | { "xauthlocation", sXAuthLocation, SSHCFG_GLOBAL }, | 436 | { "xauthlocation", sXAuthLocation, SSHCFG_GLOBAL }, |
430 | { "strictmodes", sStrictModes, SSHCFG_GLOBAL }, | 437 | { "strictmodes", sStrictModes, SSHCFG_GLOBAL }, |
438 | { "permitblacklistedkeys", sPermitBlacklistedKeys, SSHCFG_GLOBAL }, | ||
431 | { "permitemptypasswords", sEmptyPasswd, SSHCFG_ALL }, | 439 | { "permitemptypasswords", sEmptyPasswd, SSHCFG_ALL }, |
432 | { "permituserenvironment", sPermitUserEnvironment, SSHCFG_GLOBAL }, | 440 | { "permituserenvironment", sPermitUserEnvironment, SSHCFG_GLOBAL }, |
433 | { "uselogin", sUseLogin, SSHCFG_GLOBAL }, | 441 | { "uselogin", sUseLogin, SSHCFG_GLOBAL }, |
@@ -469,6 +477,7 @@ static struct { | |||
469 | { "authorizedprincipalsfile", sAuthorizedPrincipalsFile, SSHCFG_ALL }, | 477 | { "authorizedprincipalsfile", sAuthorizedPrincipalsFile, SSHCFG_ALL }, |
470 | { "kexalgorithms", sKexAlgorithms, SSHCFG_GLOBAL }, | 478 | { "kexalgorithms", sKexAlgorithms, SSHCFG_GLOBAL }, |
471 | { "ipqos", sIPQoS, SSHCFG_ALL }, | 479 | { "ipqos", sIPQoS, SSHCFG_ALL }, |
480 | { "debianbanner", sDebianBanner, SSHCFG_GLOBAL }, | ||
472 | { NULL, sBadOption, 0 } | 481 | { NULL, sBadOption, 0 } |
473 | }; | 482 | }; |
474 | 483 | ||
@@ -1047,6 +1056,10 @@ process_server_config_line(ServerOptions *options, char *line, | |||
1047 | intptr = &options->tcp_keep_alive; | 1056 | intptr = &options->tcp_keep_alive; |
1048 | goto parse_flag; | 1057 | goto parse_flag; |
1049 | 1058 | ||
1059 | case sPermitBlacklistedKeys: | ||
1060 | intptr = &options->permit_blacklisted_keys; | ||
1061 | goto parse_flag; | ||
1062 | |||
1050 | case sEmptyPasswd: | 1063 | case sEmptyPasswd: |
1051 | intptr = &options->permit_empty_passwd; | 1064 | intptr = &options->permit_empty_passwd; |
1052 | goto parse_flag; | 1065 | goto parse_flag; |
@@ -1428,6 +1441,10 @@ process_server_config_line(ServerOptions *options, char *line, | |||
1428 | } | 1441 | } |
1429 | break; | 1442 | break; |
1430 | 1443 | ||
1444 | case sDebianBanner: | ||
1445 | intptr = &options->debian_banner; | ||
1446 | goto parse_int; | ||
1447 | |||
1431 | case sDeprecated: | 1448 | case sDeprecated: |
1432 | logit("%s line %d: Deprecated option %s", | 1449 | logit("%s line %d: Deprecated option %s", |
1433 | filename, linenum, arg); | 1450 | filename, linenum, arg); |
@@ -1773,6 +1790,7 @@ dump_config(ServerOptions *o) | |||
1773 | dump_cfg_fmtint(sX11UseLocalhost, o->x11_use_localhost); | 1790 | dump_cfg_fmtint(sX11UseLocalhost, o->x11_use_localhost); |
1774 | dump_cfg_fmtint(sStrictModes, o->strict_modes); | 1791 | dump_cfg_fmtint(sStrictModes, o->strict_modes); |
1775 | dump_cfg_fmtint(sTCPKeepAlive, o->tcp_keep_alive); | 1792 | dump_cfg_fmtint(sTCPKeepAlive, o->tcp_keep_alive); |
1793 | dump_cfg_fmtint(sPermitBlacklistedKeys, o->permit_blacklisted_keys); | ||
1776 | dump_cfg_fmtint(sEmptyPasswd, o->permit_empty_passwd); | 1794 | dump_cfg_fmtint(sEmptyPasswd, o->permit_empty_passwd); |
1777 | dump_cfg_fmtint(sPermitUserEnvironment, o->permit_user_env); | 1795 | dump_cfg_fmtint(sPermitUserEnvironment, o->permit_user_env); |
1778 | dump_cfg_fmtint(sUseLogin, o->use_login); | 1796 | dump_cfg_fmtint(sUseLogin, o->use_login); |
diff --git a/servconf.h b/servconf.h index a434c6fa3..0be15f09a 100644 --- a/servconf.h +++ b/servconf.h | |||
@@ -113,6 +113,7 @@ typedef struct { | |||
113 | int challenge_response_authentication; | 113 | int challenge_response_authentication; |
114 | int zero_knowledge_password_authentication; | 114 | int zero_knowledge_password_authentication; |
115 | /* If true, permit jpake auth */ | 115 | /* If true, permit jpake auth */ |
116 | int permit_blacklisted_keys; /* If true, permit */ | ||
116 | int permit_empty_passwd; /* If false, do not permit empty | 117 | int permit_empty_passwd; /* If false, do not permit empty |
117 | * passwords. */ | 118 | * passwords. */ |
118 | int permit_user_env; /* If true, read ~/.ssh/environment */ | 119 | int permit_user_env; /* If true, read ~/.ssh/environment */ |
@@ -165,6 +166,8 @@ typedef struct { | |||
165 | 166 | ||
166 | int num_permitted_opens; | 167 | int num_permitted_opens; |
167 | 168 | ||
169 | int debian_banner; | ||
170 | |||
168 | char *chroot_directory; | 171 | char *chroot_directory; |
169 | char *revoked_keys_file; | 172 | char *revoked_keys_file; |
170 | char *trusted_user_ca_keys; | 173 | char *trusted_user_ca_keys; |
diff --git a/serverloop.c b/serverloop.c index 19b84ff27..f7bbdad07 100644 --- a/serverloop.c +++ b/serverloop.c | |||
@@ -680,7 +680,7 @@ server_loop(pid_t pid, int fdin_arg, int fdout_arg, int fderr_arg) | |||
680 | if (!channel_still_open()) | 680 | if (!channel_still_open()) |
681 | break; | 681 | break; |
682 | if (!waiting_termination) { | 682 | if (!waiting_termination) { |
683 | const char *s = "Waiting for forwarded connections to terminate...\r\n"; | 683 | const char *s = "Waiting for forwarded connections to terminate... (press ~& to background)\r\n"; |
684 | char *cp; | 684 | char *cp; |
685 | waiting_termination = 1; | 685 | waiting_termination = 1; |
686 | buffer_append(&stderr_buffer, s, strlen(s)); | 686 | buffer_append(&stderr_buffer, s, strlen(s)); |
@@ -1471,7 +1471,7 @@ safely_chroot(const char *path, uid_t uid) | |||
1471 | 1471 | ||
1472 | /* Set login name, uid, gid, and groups. */ | 1472 | /* Set login name, uid, gid, and groups. */ |
1473 | void | 1473 | void |
1474 | do_setusercontext(struct passwd *pw) | 1474 | do_setusercontext(struct passwd *pw, const char *role) |
1475 | { | 1475 | { |
1476 | char *chroot_path, *tmp; | 1476 | char *chroot_path, *tmp; |
1477 | 1477 | ||
@@ -1499,7 +1499,7 @@ do_setusercontext(struct passwd *pw) | |||
1499 | endgrent(); | 1499 | endgrent(); |
1500 | #endif | 1500 | #endif |
1501 | 1501 | ||
1502 | platform_setusercontext_post_groups(pw); | 1502 | platform_setusercontext_post_groups(pw, role); |
1503 | 1503 | ||
1504 | if (options.chroot_directory != NULL && | 1504 | if (options.chroot_directory != NULL && |
1505 | strcasecmp(options.chroot_directory, "none") != 0) { | 1505 | strcasecmp(options.chroot_directory, "none") != 0) { |
@@ -1625,7 +1625,7 @@ do_child(Session *s, const char *command) | |||
1625 | 1625 | ||
1626 | /* Force a password change */ | 1626 | /* Force a password change */ |
1627 | if (s->authctxt->force_pwchange) { | 1627 | if (s->authctxt->force_pwchange) { |
1628 | do_setusercontext(pw); | 1628 | do_setusercontext(pw, s->authctxt->role); |
1629 | child_close_fds(); | 1629 | child_close_fds(); |
1630 | do_pwchange(s); | 1630 | do_pwchange(s); |
1631 | exit(1); | 1631 | exit(1); |
@@ -1652,7 +1652,7 @@ do_child(Session *s, const char *command) | |||
1652 | /* When PAM is enabled we rely on it to do the nologin check */ | 1652 | /* When PAM is enabled we rely on it to do the nologin check */ |
1653 | if (!options.use_pam) | 1653 | if (!options.use_pam) |
1654 | do_nologin(pw); | 1654 | do_nologin(pw); |
1655 | do_setusercontext(pw); | 1655 | do_setusercontext(pw, s->authctxt->role); |
1656 | /* | 1656 | /* |
1657 | * PAM session modules in do_setusercontext may have | 1657 | * PAM session modules in do_setusercontext may have |
1658 | * generated messages, so if this in an interactive | 1658 | * generated messages, so if this in an interactive |
@@ -2064,7 +2064,7 @@ session_pty_req(Session *s) | |||
2064 | tty_parse_modes(s->ttyfd, &n_bytes); | 2064 | tty_parse_modes(s->ttyfd, &n_bytes); |
2065 | 2065 | ||
2066 | if (!use_privsep) | 2066 | if (!use_privsep) |
2067 | pty_setowner(s->pw, s->tty); | 2067 | pty_setowner(s->pw, s->tty, s->authctxt->role); |
2068 | 2068 | ||
2069 | /* Set window size from the packet. */ | 2069 | /* Set window size from the packet. */ |
2070 | pty_change_window_size(s->ptyfd, s->row, s->col, s->xpixel, s->ypixel); | 2070 | pty_change_window_size(s->ptyfd, s->row, s->col, s->xpixel, s->ypixel); |
@@ -76,7 +76,7 @@ void session_pty_cleanup2(Session *); | |||
76 | Session *session_new(void); | 76 | Session *session_new(void); |
77 | Session *session_by_tty(char *); | 77 | Session *session_by_tty(char *); |
78 | void session_close(Session *); | 78 | void session_close(Session *); |
79 | void do_setusercontext(struct passwd *); | 79 | void do_setusercontext(struct passwd *, const char *); |
80 | void child_set_env(char ***envp, u_int *envsizep, const char *name, | 80 | void child_set_env(char ***envp, u_int *envsizep, const char *name, |
81 | const char *value); | 81 | const char *value); |
82 | 82 | ||
@@ -81,6 +81,10 @@ environment variable must contain the name of its socket for | |||
81 | .Nm | 81 | .Nm |
82 | to work. | 82 | to work. |
83 | .Pp | 83 | .Pp |
84 | Any keys recorded in the blacklist of known-compromised keys (see | ||
85 | .Xr ssh-vulnkey 1 ) | ||
86 | will be refused. | ||
87 | .Pp | ||
84 | The options are as follows: | 88 | The options are as follows: |
85 | .Bl -tag -width Ds | 89 | .Bl -tag -width Ds |
86 | .It Fl c | 90 | .It Fl c |
@@ -183,6 +187,7 @@ is unable to contact the authentication agent. | |||
183 | .Xr ssh 1 , | 187 | .Xr ssh 1 , |
184 | .Xr ssh-agent 1 , | 188 | .Xr ssh-agent 1 , |
185 | .Xr ssh-keygen 1 , | 189 | .Xr ssh-keygen 1 , |
190 | .Xr ssh-vulnkey 1 , | ||
186 | .Xr sshd 8 | 191 | .Xr sshd 8 |
187 | .Sh AUTHORS | 192 | .Sh AUTHORS |
188 | OpenSSH is a derivative of the original and free | 193 | OpenSSH is a derivative of the original and free |
@@ -142,7 +142,7 @@ static int | |||
142 | add_file(AuthenticationConnection *ac, const char *filename) | 142 | add_file(AuthenticationConnection *ac, const char *filename) |
143 | { | 143 | { |
144 | Key *private, *cert; | 144 | Key *private, *cert; |
145 | char *comment = NULL; | 145 | char *comment = NULL, *fp; |
146 | char msg[1024], *certpath; | 146 | char msg[1024], *certpath; |
147 | int fd, perms_ok, ret = -1; | 147 | int fd, perms_ok, ret = -1; |
148 | Buffer keyblob; | 148 | Buffer keyblob; |
@@ -218,6 +218,14 @@ add_file(AuthenticationConnection *ac, const char *filename) | |||
218 | } else { | 218 | } else { |
219 | fprintf(stderr, "Could not add identity: %s\n", filename); | 219 | fprintf(stderr, "Could not add identity: %s\n", filename); |
220 | } | 220 | } |
221 | if (blacklisted_key(private, &fp) == 1) { | ||
222 | fprintf(stderr, "Public key %s blacklisted (see " | ||
223 | "ssh-vulnkey(1)); refusing to add it\n", fp); | ||
224 | xfree(fp); | ||
225 | key_free(private); | ||
226 | xfree(comment); | ||
227 | return -1; | ||
228 | } | ||
221 | 229 | ||
222 | 230 | ||
223 | /* Now try to add the certificate flavour too */ | 231 | /* Now try to add the certificate flavour too */ |
diff --git a/ssh-keygen.1 b/ssh-keygen.1 index ede37921c..7c8b1f202 100644 --- a/ssh-keygen.1 +++ b/ssh-keygen.1 | |||
@@ -149,9 +149,7 @@ key in | |||
149 | .Pa ~/.ssh/id_dsa | 149 | .Pa ~/.ssh/id_dsa |
150 | or | 150 | or |
151 | .Pa ~/.ssh/id_rsa . | 151 | .Pa ~/.ssh/id_rsa . |
152 | Additionally, the system administrator may use this to generate host keys, | 152 | Additionally, the system administrator may use this to generate host keys. |
153 | as seen in | ||
154 | .Pa /etc/rc . | ||
155 | .Pp | 153 | .Pp |
156 | Normally this program generates the key and asks for a file in which | 154 | Normally this program generates the key and asks for a file in which |
157 | to store the private key. | 155 | to store the private key. |
@@ -197,9 +195,7 @@ The options are as follows: | |||
197 | For each of the key types (rsa1, rsa, dsa and ecdsa) for which host keys | 195 | For each of the key types (rsa1, rsa, dsa and ecdsa) for which host keys |
198 | do not exist, generate the host keys with the default key file path, | 196 | do not exist, generate the host keys with the default key file path, |
199 | an empty passphrase, default bits for the key type, and default comment. | 197 | an empty passphrase, default bits for the key type, and default comment. |
200 | This is used by | 198 | This is used by system administration scripts to generate new host keys. |
201 | .Pa /etc/rc | ||
202 | to generate new host keys. | ||
203 | .It Fl a Ar trials | 199 | .It Fl a Ar trials |
204 | Specifies the number of primality tests to perform when screening DH-GEX | 200 | Specifies the number of primality tests to perform when screening DH-GEX |
205 | candidates using the | 201 | candidates using the |
@@ -535,7 +531,7 @@ option. | |||
535 | Valid generator values are 2, 3, and 5. | 531 | Valid generator values are 2, 3, and 5. |
536 | .Pp | 532 | .Pp |
537 | Screened DH groups may be installed in | 533 | Screened DH groups may be installed in |
538 | .Pa /etc/moduli . | 534 | .Pa /etc/ssh/moduli . |
539 | It is important that this file contains moduli of a range of bit lengths and | 535 | It is important that this file contains moduli of a range of bit lengths and |
540 | that both ends of a connection share common moduli. | 536 | that both ends of a connection share common moduli. |
541 | .Sh CERTIFICATES | 537 | .Sh CERTIFICATES |
@@ -661,7 +657,7 @@ on all machines | |||
661 | where the user wishes to log in using public key authentication. | 657 | where the user wishes to log in using public key authentication. |
662 | There is no need to keep the contents of this file secret. | 658 | There is no need to keep the contents of this file secret. |
663 | .Pp | 659 | .Pp |
664 | .It Pa /etc/moduli | 660 | .It Pa /etc/ssh/moduli |
665 | Contains Diffie-Hellman groups used for DH-GEX. | 661 | Contains Diffie-Hellman groups used for DH-GEX. |
666 | The file format is described in | 662 | The file format is described in |
667 | .Xr moduli 5 . | 663 | .Xr moduli 5 . |
@@ -670,6 +666,7 @@ The file format is described in | |||
670 | .Xr ssh 1 , | 666 | .Xr ssh 1 , |
671 | .Xr ssh-add 1 , | 667 | .Xr ssh-add 1 , |
672 | .Xr ssh-agent 1 , | 668 | .Xr ssh-agent 1 , |
669 | .Xr ssh-vulnkey 1 , | ||
673 | .Xr moduli 5 , | 670 | .Xr moduli 5 , |
674 | .Xr sshd 8 | 671 | .Xr sshd 8 |
675 | .Rs | 672 | .Rs |
diff --git a/ssh-vulnkey.1 b/ssh-vulnkey.1 new file mode 100644 index 000000000..bcb9d31c6 --- /dev/null +++ b/ssh-vulnkey.1 | |||
@@ -0,0 +1,242 @@ | |||
1 | .\" Copyright (c) 2008 Canonical Ltd. All rights reserved. | ||
2 | .\" | ||
3 | .\" Redistribution and use in source and binary forms, with or without | ||
4 | .\" modification, are permitted provided that the following conditions | ||
5 | .\" are met: | ||
6 | .\" 1. Redistributions of source code must retain the above copyright | ||
7 | .\" notice, this list of conditions and the following disclaimer. | ||
8 | .\" 2. Redistributions in binary form must reproduce the above copyright | ||
9 | .\" notice, this list of conditions and the following disclaimer in the | ||
10 | .\" documentation and/or other materials provided with the distribution. | ||
11 | .\" | ||
12 | .\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR | ||
13 | .\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES | ||
14 | .\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. | ||
15 | .\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, | ||
16 | .\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT | ||
17 | .\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, | ||
18 | .\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY | ||
19 | .\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT | ||
20 | .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF | ||
21 | .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | ||
22 | .\" | ||
23 | .Dd $Mdocdate: May 12 2008 $ | ||
24 | .Dt SSH-VULNKEY 1 | ||
25 | .Os | ||
26 | .Sh NAME | ||
27 | .Nm ssh-vulnkey | ||
28 | .Nd check blacklist of compromised keys | ||
29 | .Sh SYNOPSIS | ||
30 | .Nm | ||
31 | .Op Fl q | Fl v | ||
32 | .Ar file ... | ||
33 | .Nm | ||
34 | .Fl a | ||
35 | .Sh DESCRIPTION | ||
36 | .Nm | ||
37 | checks a key against a blacklist of compromised keys. | ||
38 | .Pp | ||
39 | A substantial number of keys are known to have been generated using a broken | ||
40 | version of OpenSSL distributed by Debian which failed to seed its random | ||
41 | number generator correctly. | ||
42 | Keys generated using these OpenSSL versions should be assumed to be | ||
43 | compromised. | ||
44 | This tool may be useful in checking for such keys. | ||
45 | .Pp | ||
46 | Keys that are compromised cannot be repaired; replacements must be generated | ||
47 | using | ||
48 | .Xr ssh-keygen 1 . | ||
49 | Make sure to update | ||
50 | .Pa authorized_keys | ||
51 | files on all systems where compromised keys were permitted to authenticate. | ||
52 | .Pp | ||
53 | The argument list will be interpreted as a list of paths to public key files | ||
54 | or | ||
55 | .Pa authorized_keys | ||
56 | files. | ||
57 | If no suitable file is found at a given path, | ||
58 | .Nm | ||
59 | will append | ||
60 | .Pa .pub | ||
61 | and retry, in case it was given a private key file. | ||
62 | If no files are given as arguments, | ||
63 | .Nm | ||
64 | will check | ||
65 | .Pa ~/.ssh/id_rsa , | ||
66 | .Pa ~/.ssh/id_dsa , | ||
67 | .Pa ~/.ssh/identity , | ||
68 | .Pa ~/.ssh/authorized_keys | ||
69 | and | ||
70 | .Pa ~/.ssh/authorized_keys2 , | ||
71 | as well as the system's host keys if readable. | ||
72 | .Pp | ||
73 | If | ||
74 | .Dq - | ||
75 | is given as an argument, | ||
76 | .Nm | ||
77 | will read from standard input. | ||
78 | This can be used to process output from | ||
79 | .Xr ssh-keyscan 1 , | ||
80 | for example: | ||
81 | .Pp | ||
82 | .Dl $ ssh-keyscan -t rsa remote.example.org | ssh-vulnkey - | ||
83 | .Pp | ||
84 | Unless the | ||
85 | .Cm PermitBlacklistedKeys | ||
86 | option is used, | ||
87 | .Xr sshd 8 | ||
88 | will reject attempts to authenticate with keys in the compromised list. | ||
89 | .Pp | ||
90 | The output from | ||
91 | .Nm | ||
92 | looks like this: | ||
93 | .Pp | ||
94 | .Bd -literal -offset indent | ||
95 | /etc/ssh/ssh_host_key:1: COMPROMISED: RSA1 2048 xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx root@host | ||
96 | /home/user/.ssh/id_dsa:1: Not blacklisted: DSA 1024 xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx /home/user/.ssh/id_dsa.pub | ||
97 | /home/user/.ssh/authorized_keys:3: Unknown (blacklist file not installed): RSA 1024 xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx user@host | ||
98 | .Ed | ||
99 | .Pp | ||
100 | Each line is of the following format (any lines beginning with | ||
101 | .Dq # | ||
102 | should be ignored by scripts): | ||
103 | .Pp | ||
104 | .Dl Ar filename : Ns Ar line : Ar status : Ar type Ar size Ar fingerprint Ar comment | ||
105 | .Pp | ||
106 | It is important to distinguish between the possible values of | ||
107 | .Ar status : | ||
108 | .Pp | ||
109 | .Bl -tag -width Ds | ||
110 | .It COMPROMISED | ||
111 | These keys are listed in a blacklist file, normally because their | ||
112 | corresponding private keys are well-known. | ||
113 | Replacements must be generated using | ||
114 | .Xr ssh-keygen 1 . | ||
115 | .It Not blacklisted | ||
116 | A blacklist file exists for this key type and size, but this key is not | ||
117 | listed in it. | ||
118 | Unless there is some particular reason to believe otherwise, this key | ||
119 | may be used safely. | ||
120 | (Note that DSA keys used with the broken version of OpenSSL distributed | ||
121 | by Debian may be compromised in the event that anyone captured a network | ||
122 | trace, even if they were generated with a secure version of OpenSSL.) | ||
123 | .It Unknown (blacklist file not installed) | ||
124 | No blacklist file exists for this key type and size. | ||
125 | You should find a suitable published blacklist and install it before | ||
126 | deciding whether this key is safe to use. | ||
127 | .El | ||
128 | .Pp | ||
129 | The options are as follows: | ||
130 | .Bl -tag -width Ds | ||
131 | .It Fl a | ||
132 | Check keys of all users on the system. | ||
133 | You will typically need to run | ||
134 | .Nm | ||
135 | as root to use this option. | ||
136 | For each user, | ||
137 | .Nm | ||
138 | will check | ||
139 | .Pa ~/.ssh/id_rsa , | ||
140 | .Pa ~/.ssh/id_dsa , | ||
141 | .Pa ~/.ssh/identity , | ||
142 | .Pa ~/.ssh/authorized_keys | ||
143 | and | ||
144 | .Pa ~/.ssh/authorized_keys2 . | ||
145 | It will also check the system's host keys. | ||
146 | .It Fl q | ||
147 | Quiet mode. | ||
148 | Normally, | ||
149 | .Nm | ||
150 | outputs the fingerprint of each key scanned, with a description of its | ||
151 | status. | ||
152 | This option suppresses that output. | ||
153 | .It Fl v | ||
154 | Verbose mode. | ||
155 | Normally, | ||
156 | .Nm | ||
157 | does not output anything for keys that are not listed in their corresponding | ||
158 | blacklist file (although it still produces output for keys for which there | ||
159 | is no blacklist file, since their status is unknown). | ||
160 | This option causes | ||
161 | .Nm | ||
162 | to produce output for all keys. | ||
163 | .El | ||
164 | .Sh EXIT STATUS | ||
165 | .Nm | ||
166 | will exit zero if any of the given keys were in the compromised list, | ||
167 | otherwise non-zero. | ||
168 | .Sh BLACKLIST FILE FORMAT | ||
169 | The blacklist file may start with comments, on lines starting with | ||
170 | .Dq # . | ||
171 | After these initial comments, it must follow a strict format: | ||
172 | .Pp | ||
173 | .Bl -bullet -offset indent -compact | ||
174 | .It | ||
175 | All the lines must be exactly the same length (20 characters followed by a | ||
176 | newline) and must be in sorted order. | ||
177 | .It | ||
178 | Each line must consist of the lower-case hexadecimal MD5 key fingerprint, | ||
179 | without colons, and with the first 12 characters removed (that is, the least | ||
180 | significant 80 bits of the fingerprint). | ||
181 | .El | ||
182 | .Pp | ||
183 | The key fingerprint may be generated using | ||
184 | .Xr ssh-keygen 1 : | ||
185 | .Pp | ||
186 | .Dl $ ssh-keygen -l -f /path/to/key | ||
187 | .Pp | ||
188 | This strict format is necessary to allow the blacklist file to be checked | ||
189 | quickly, using a binary-search algorithm. | ||
190 | .Sh FILES | ||
191 | .Bl -tag -width Ds | ||
192 | .It Pa ~/.ssh/id_rsa | ||
193 | If present, contains the protocol version 2 RSA authentication identity of | ||
194 | the user. | ||
195 | .It Pa ~/.ssh/id_dsa | ||
196 | If present, contains the protocol version 2 DSA authentication identity of | ||
197 | the user. | ||
198 | .It Pa ~/.ssh/identity | ||
199 | If present, contains the protocol version 1 RSA authentication identity of | ||
200 | the user. | ||
201 | .It Pa ~/.ssh/authorized_keys | ||
202 | If present, lists the public keys (RSA/DSA) that can be used for logging in | ||
203 | as this user. | ||
204 | .It Pa ~/.ssh/authorized_keys2 | ||
205 | Obsolete name for | ||
206 | .Pa ~/.ssh/authorized_keys . | ||
207 | This file may still be present on some old systems, but should not be | ||
208 | created if it is missing. | ||
209 | .It Pa /etc/ssh/ssh_host_rsa_key | ||
210 | If present, contains the protocol version 2 RSA identity of the system. | ||
211 | .It Pa /etc/ssh/ssh_host_dsa_key | ||
212 | If present, contains the protocol version 2 DSA identity of the system. | ||
213 | .It Pa /etc/ssh/ssh_host_key | ||
214 | If present, contains the protocol version 1 RSA identity of the system. | ||
215 | .It Pa /usr/share/ssh/blacklist. Ns Ar TYPE Ns Pa - Ns Ar LENGTH | ||
216 | If present, lists the blacklisted keys of type | ||
217 | .Ar TYPE | ||
218 | .Pf ( Dq RSA | ||
219 | or | ||
220 | .Dq DSA ) | ||
221 | and bit length | ||
222 | .Ar LENGTH . | ||
223 | The format of this file is described above. | ||
224 | RSA1 keys are converted to RSA before being checked in the blacklist. | ||
225 | Note that the fingerprints of RSA1 keys are computed differently, so you | ||
226 | will not be able to find them in the blacklist by hand. | ||
227 | .It Pa /etc/ssh/blacklist. Ns Ar TYPE Ns Pa - Ns Ar LENGTH | ||
228 | Same as | ||
229 | .Pa /usr/share/ssh/blacklist. Ns Ar TYPE Ns Pa - Ns Ar LENGTH , | ||
230 | but may be edited by the system administrator to add new blacklist entries. | ||
231 | .El | ||
232 | .Sh SEE ALSO | ||
233 | .Xr ssh-keygen 1 , | ||
234 | .Xr sshd 8 | ||
235 | .Sh AUTHORS | ||
236 | .An -nosplit | ||
237 | .An Colin Watson Aq cjwatson@ubuntu.com | ||
238 | .Pp | ||
239 | Florian Weimer suggested the option to check keys of all users, and the idea | ||
240 | of processing | ||
241 | .Xr ssh-keyscan 1 | ||
242 | output. | ||
diff --git a/ssh-vulnkey.c b/ssh-vulnkey.c new file mode 100644 index 000000000..f8125e0bb --- /dev/null +++ b/ssh-vulnkey.c | |||
@@ -0,0 +1,387 @@ | |||
1 | /* | ||
2 | * Copyright (c) 2008 Canonical Ltd. All rights reserved. | ||
3 | * | ||
4 | * Redistribution and use in source and binary forms, with or without | ||
5 | * modification, are permitted provided that the following conditions | ||
6 | * are met: | ||
7 | * 1. Redistributions of source code must retain the above copyright | ||
8 | * notice, this list of conditions and the following disclaimer. | ||
9 | * 2. Redistributions in binary form must reproduce the above copyright | ||
10 | * notice, this list of conditions and the following disclaimer in the | ||
11 | * documentation and/or other materials provided with the distribution. | ||
12 | * | ||
13 | * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR | ||
14 | * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES | ||
15 | * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. | ||
16 | * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, | ||
17 | * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT | ||
18 | * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, | ||
19 | * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY | ||
20 | * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT | ||
21 | * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF | ||
22 | * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | ||
23 | */ | ||
24 | |||
25 | #include "includes.h" | ||
26 | |||
27 | #include <sys/types.h> | ||
28 | #include <sys/stat.h> | ||
29 | |||
30 | #include <errno.h> | ||
31 | #include <string.h> | ||
32 | #include <stdio.h> | ||
33 | #include <fcntl.h> | ||
34 | #include <unistd.h> | ||
35 | |||
36 | #include <openssl/evp.h> | ||
37 | |||
38 | #include "xmalloc.h" | ||
39 | #include "ssh.h" | ||
40 | #include "log.h" | ||
41 | #include "key.h" | ||
42 | #include "authfile.h" | ||
43 | #include "pathnames.h" | ||
44 | #include "uidswap.h" | ||
45 | #include "misc.h" | ||
46 | |||
47 | extern char *__progname; | ||
48 | |||
49 | /* Default files to check */ | ||
50 | static char *default_host_files[] = { | ||
51 | _PATH_HOST_RSA_KEY_FILE, | ||
52 | _PATH_HOST_DSA_KEY_FILE, | ||
53 | _PATH_HOST_KEY_FILE, | ||
54 | NULL | ||
55 | }; | ||
56 | static char *default_files[] = { | ||
57 | _PATH_SSH_CLIENT_ID_RSA, | ||
58 | _PATH_SSH_CLIENT_ID_DSA, | ||
59 | _PATH_SSH_CLIENT_IDENTITY, | ||
60 | _PATH_SSH_USER_PERMITTED_KEYS, | ||
61 | _PATH_SSH_USER_PERMITTED_KEYS2, | ||
62 | NULL | ||
63 | }; | ||
64 | |||
65 | static int verbosity = 0; | ||
66 | |||
67 | static int some_keys = 0; | ||
68 | static int some_unknown = 0; | ||
69 | static int some_compromised = 0; | ||
70 | |||
71 | static void | ||
72 | usage(void) | ||
73 | { | ||
74 | fprintf(stderr, "usage: %s [-aqv] [file ...]\n", __progname); | ||
75 | fprintf(stderr, "Options:\n"); | ||
76 | fprintf(stderr, " -a Check keys of all users.\n"); | ||
77 | fprintf(stderr, " -q Quiet mode.\n"); | ||
78 | fprintf(stderr, " -v Verbose mode.\n"); | ||
79 | exit(1); | ||
80 | } | ||
81 | |||
82 | static void | ||
83 | describe_key(const char *filename, u_long linenum, const char *msg, | ||
84 | Key *key, const char *comment, int min_verbosity) | ||
85 | { | ||
86 | char *fp; | ||
87 | |||
88 | fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX); | ||
89 | if (verbosity >= min_verbosity) { | ||
90 | if (strchr(filename, ':')) | ||
91 | printf("\"%s\"", filename); | ||
92 | else | ||
93 | printf("%s", filename); | ||
94 | printf(":%lu: %s: %s %u %s %s\n", linenum, msg, | ||
95 | key_type(key), key_size(key), fp, comment); | ||
96 | } | ||
97 | xfree(fp); | ||
98 | } | ||
99 | |||
100 | static int | ||
101 | do_key(const char *filename, u_long linenum, | ||
102 | Key *key, const char *comment) | ||
103 | { | ||
104 | Key *public; | ||
105 | int blacklist_status; | ||
106 | int ret = 1; | ||
107 | |||
108 | some_keys = 1; | ||
109 | |||
110 | public = key_demote(key); | ||
111 | if (public->type == KEY_RSA1) | ||
112 | public->type = KEY_RSA; | ||
113 | |||
114 | blacklist_status = blacklisted_key(public, NULL); | ||
115 | if (blacklist_status == -1) { | ||
116 | describe_key(filename, linenum, | ||
117 | "Unknown (blacklist file not installed)", key, comment, 0); | ||
118 | some_unknown = 1; | ||
119 | } else if (blacklist_status == 1) { | ||
120 | describe_key(filename, linenum, | ||
121 | "COMPROMISED", key, comment, 0); | ||
122 | some_compromised = 1; | ||
123 | ret = 0; | ||
124 | } else | ||
125 | describe_key(filename, linenum, | ||
126 | "Not blacklisted", key, comment, 1); | ||
127 | |||
128 | key_free(public); | ||
129 | |||
130 | return ret; | ||
131 | } | ||
132 | |||
133 | static int | ||
134 | do_filename(const char *filename, int quiet_open) | ||
135 | { | ||
136 | FILE *f; | ||
137 | char line[SSH_MAX_PUBKEY_BYTES]; | ||
138 | char *cp; | ||
139 | u_long linenum = 0; | ||
140 | Key *key; | ||
141 | char *comment = NULL; | ||
142 | int found = 0, ret = 1; | ||
143 | |||
144 | /* Copy much of key_load_public's logic here so that we can read | ||
145 | * several keys from a single file (e.g. authorized_keys). | ||
146 | */ | ||
147 | |||
148 | if (strcmp(filename, "-") != 0) { | ||
149 | int save_errno; | ||
150 | f = fopen(filename, "r"); | ||
151 | save_errno = errno; | ||
152 | if (!f) { | ||
153 | char pubfile[MAXPATHLEN]; | ||
154 | if (strlcpy(pubfile, filename, sizeof pubfile) < | ||
155 | sizeof(pubfile) && | ||
156 | strlcat(pubfile, ".pub", sizeof pubfile) < | ||
157 | sizeof(pubfile)) | ||
158 | f = fopen(pubfile, "r"); | ||
159 | } | ||
160 | errno = save_errno; /* earlier errno is more useful */ | ||
161 | if (!f) { | ||
162 | if (!quiet_open) | ||
163 | perror(filename); | ||
164 | return -1; | ||
165 | } | ||
166 | if (verbosity > 0) | ||
167 | printf("# %s\n", filename); | ||
168 | } else | ||
169 | f = stdin; | ||
170 | while (read_keyfile_line(f, filename, line, sizeof(line), | ||
171 | &linenum) != -1) { | ||
172 | int i; | ||
173 | char *space; | ||
174 | int type; | ||
175 | char *end; | ||
176 | |||
177 | /* Chop trailing newline. */ | ||
178 | i = strlen(line) - 1; | ||
179 | if (line[i] == '\n') | ||
180 | line[i] = '\0'; | ||
181 | |||
182 | /* Skip leading whitespace, empty and comment lines. */ | ||
183 | for (cp = line; *cp == ' ' || *cp == '\t'; cp++) | ||
184 | ; | ||
185 | if (!*cp || *cp == '\n' || *cp == '#') | ||
186 | continue; | ||
187 | |||
188 | /* Cope with ssh-keyscan output and options in | ||
189 | * authorized_keys files. | ||
190 | */ | ||
191 | space = strchr(cp, ' '); | ||
192 | if (!space) | ||
193 | continue; | ||
194 | *space = '\0'; | ||
195 | type = key_type_from_name(cp); | ||
196 | *space = ' '; | ||
197 | /* Leading number (RSA1) or valid type (RSA/DSA) indicates | ||
198 | * that we have no host name or options to skip. | ||
199 | */ | ||
200 | if ((strtol(cp, &end, 10) == 0 || *end != ' ') && | ||
201 | type == KEY_UNSPEC) { | ||
202 | int quoted = 0; | ||
203 | |||
204 | for (; *cp && (quoted || (*cp != ' ' && *cp != '\t')); cp++) { | ||
205 | if (*cp == '\\' && cp[1] == '"') | ||
206 | cp++; /* Skip both */ | ||
207 | else if (*cp == '"') | ||
208 | quoted = !quoted; | ||
209 | } | ||
210 | /* Skip remaining whitespace. */ | ||
211 | for (; *cp == ' ' || *cp == '\t'; cp++) | ||
212 | ; | ||
213 | if (!*cp) | ||
214 | continue; | ||
215 | } | ||
216 | |||
217 | /* Read and process the key itself. */ | ||
218 | key = key_new(KEY_RSA1); | ||
219 | if (key_read(key, &cp) == 1) { | ||
220 | while (*cp == ' ' || *cp == '\t') | ||
221 | cp++; | ||
222 | if (!do_key(filename, linenum, | ||
223 | key, *cp ? cp : filename)) | ||
224 | ret = 0; | ||
225 | found = 1; | ||
226 | } else { | ||
227 | key_free(key); | ||
228 | key = key_new(KEY_UNSPEC); | ||
229 | if (key_read(key, &cp) == 1) { | ||
230 | while (*cp == ' ' || *cp == '\t') | ||
231 | cp++; | ||
232 | if (!do_key(filename, linenum, | ||
233 | key, *cp ? cp : filename)) | ||
234 | ret = 0; | ||
235 | found = 1; | ||
236 | } | ||
237 | } | ||
238 | key_free(key); | ||
239 | } | ||
240 | if (f != stdin) | ||
241 | fclose(f); | ||
242 | |||
243 | if (!found && filename) { | ||
244 | key = key_load_public(filename, &comment); | ||
245 | if (key) { | ||
246 | if (!do_key(filename, 1, key, comment)) | ||
247 | ret = 0; | ||
248 | found = 1; | ||
249 | } | ||
250 | if (comment) | ||
251 | xfree(comment); | ||
252 | } | ||
253 | |||
254 | return ret; | ||
255 | } | ||
256 | |||
257 | static int | ||
258 | do_host(int quiet_open) | ||
259 | { | ||
260 | int i; | ||
261 | struct stat st; | ||
262 | int ret = 1; | ||
263 | |||
264 | for (i = 0; default_host_files[i]; i++) { | ||
265 | if (stat(default_host_files[i], &st) < 0 && errno == ENOENT) | ||
266 | continue; | ||
267 | if (!do_filename(default_host_files[i], quiet_open)) | ||
268 | ret = 0; | ||
269 | } | ||
270 | |||
271 | return ret; | ||
272 | } | ||
273 | |||
274 | static int | ||
275 | do_user(const char *dir) | ||
276 | { | ||
277 | int i; | ||
278 | char *file; | ||
279 | struct stat st; | ||
280 | int ret = 1; | ||
281 | |||
282 | for (i = 0; default_files[i]; i++) { | ||
283 | xasprintf(&file, "%s/%s", dir, default_files[i]); | ||
284 | if (stat(file, &st) < 0 && errno == ENOENT) { | ||
285 | xfree(file); | ||
286 | continue; | ||
287 | } | ||
288 | if (!do_filename(file, 0)) | ||
289 | ret = 0; | ||
290 | xfree(file); | ||
291 | } | ||
292 | |||
293 | return ret; | ||
294 | } | ||
295 | |||
296 | int | ||
297 | main(int argc, char **argv) | ||
298 | { | ||
299 | int opt, all_users = 0; | ||
300 | int ret = 1; | ||
301 | extern int optind; | ||
302 | |||
303 | /* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */ | ||
304 | sanitise_stdfd(); | ||
305 | |||
306 | __progname = ssh_get_progname(argv[0]); | ||
307 | |||
308 | SSLeay_add_all_algorithms(); | ||
309 | log_init(argv[0], SYSLOG_LEVEL_INFO, SYSLOG_FACILITY_USER, 1); | ||
310 | |||
311 | /* We don't need the RNG ourselves, but symbol references here allow | ||
312 | * ld to link us properly. | ||
313 | */ | ||
314 | seed_rng(); | ||
315 | |||
316 | while ((opt = getopt(argc, argv, "ahqv")) != -1) { | ||
317 | switch (opt) { | ||
318 | case 'a': | ||
319 | all_users = 1; | ||
320 | break; | ||
321 | case 'q': | ||
322 | verbosity--; | ||
323 | break; | ||
324 | case 'v': | ||
325 | verbosity++; | ||
326 | break; | ||
327 | case 'h': | ||
328 | default: | ||
329 | usage(); | ||
330 | } | ||
331 | } | ||
332 | |||
333 | if (all_users) { | ||
334 | struct passwd *pw; | ||
335 | |||
336 | if (!do_host(0)) | ||
337 | ret = 0; | ||
338 | |||
339 | while ((pw = getpwent()) != NULL) { | ||
340 | if (pw->pw_dir) { | ||
341 | temporarily_use_uid(pw); | ||
342 | if (!do_user(pw->pw_dir)) | ||
343 | ret = 0; | ||
344 | restore_uid(); | ||
345 | } | ||
346 | } | ||
347 | } else if (optind == argc) { | ||
348 | struct passwd *pw; | ||
349 | |||
350 | if (!do_host(1)) | ||
351 | ret = 0; | ||
352 | |||
353 | if ((pw = getpwuid(geteuid())) == NULL) | ||
354 | fprintf(stderr, "No user found with uid %u\n", | ||
355 | (u_int)geteuid()); | ||
356 | else { | ||
357 | if (!do_user(pw->pw_dir)) | ||
358 | ret = 0; | ||
359 | } | ||
360 | } else { | ||
361 | while (optind < argc) | ||
362 | if (!do_filename(argv[optind++], 0)) | ||
363 | ret = 0; | ||
364 | } | ||
365 | |||
366 | if (verbosity >= 0) { | ||
367 | if (some_unknown) { | ||
368 | printf("#\n"); | ||
369 | printf("# The status of some keys on your system is unknown.\n"); | ||
370 | printf("# You may need to install additional blacklist files.\n"); | ||
371 | } | ||
372 | if (some_compromised) { | ||
373 | printf("#\n"); | ||
374 | printf("# Some keys on your system have been compromised!\n"); | ||
375 | printf("# You must replace them using ssh-keygen(1).\n"); | ||
376 | } | ||
377 | if (some_unknown || some_compromised) { | ||
378 | printf("#\n"); | ||
379 | printf("# See the ssh-vulnkey(1) manual page for further advice.\n"); | ||
380 | } else if (some_keys && verbosity > 0) { | ||
381 | printf("#\n"); | ||
382 | printf("# No blacklisted keys!\n"); | ||
383 | } | ||
384 | } | ||
385 | |||
386 | return ret; | ||
387 | } | ||
@@ -731,6 +731,10 @@ The | |||
731 | .Sx HISTORY | 731 | .Sx HISTORY |
732 | section of | 732 | section of |
733 | .Xr ssl 8 | 733 | .Xr ssl 8 |
734 | (on non-OpenBSD systems, see | ||
735 | .nh | ||
736 | http://www.openbsd.org/cgi\-bin/man.cgi?query=ssl&sektion=8#HISTORY) | ||
737 | .hy | ||
734 | contains a brief discussion of the DSA and RSA algorithms. | 738 | contains a brief discussion of the DSA and RSA algorithms. |
735 | .Pp | 739 | .Pp |
736 | The file | 740 | The file |
@@ -1298,6 +1302,8 @@ The file format and configuration options are described in | |||
1298 | .Xr ssh_config 5 . | 1302 | .Xr ssh_config 5 . |
1299 | Because of the potential for abuse, this file must have strict permissions: | 1303 | Because of the potential for abuse, this file must have strict permissions: |
1300 | read/write for the user, and not accessible by others. | 1304 | read/write for the user, and not accessible by others. |
1305 | It may be group-writable provided that the group in question contains only | ||
1306 | the user. | ||
1301 | .Pp | 1307 | .Pp |
1302 | .It Pa ~/.ssh/environment | 1308 | .It Pa ~/.ssh/environment |
1303 | Contains additional definitions for environment variables; see | 1309 | Contains additional definitions for environment variables; see |
@@ -1405,8 +1411,10 @@ if an error occurred. | |||
1405 | .Xr sftp 1 , | 1411 | .Xr sftp 1 , |
1406 | .Xr ssh-add 1 , | 1412 | .Xr ssh-add 1 , |
1407 | .Xr ssh-agent 1 , | 1413 | .Xr ssh-agent 1 , |
1414 | .Xr ssh-argv0 1 , | ||
1408 | .Xr ssh-keygen 1 , | 1415 | .Xr ssh-keygen 1 , |
1409 | .Xr ssh-keyscan 1 , | 1416 | .Xr ssh-keyscan 1 , |
1417 | .Xr ssh-vulnkey 1 , | ||
1410 | .Xr tun 4 , | 1418 | .Xr tun 4 , |
1411 | .Xr hosts.equiv 5 , | 1419 | .Xr hosts.equiv 5 , |
1412 | .Xr ssh_config 5 , | 1420 | .Xr ssh_config 5 , |
@@ -678,7 +678,7 @@ main(int ac, char **av) | |||
678 | /* Do not allocate a tty if stdin is not a tty. */ | 678 | /* Do not allocate a tty if stdin is not a tty. */ |
679 | if ((!isatty(fileno(stdin)) || stdin_null_flag) && | 679 | if ((!isatty(fileno(stdin)) || stdin_null_flag) && |
680 | options.request_tty != REQUEST_TTY_FORCE) { | 680 | options.request_tty != REQUEST_TTY_FORCE) { |
681 | if (tty_flag) | 681 | if (tty_flag && options.log_level != SYSLOG_LEVEL_QUIET) |
682 | logit("Pseudo-terminal will not be allocated because " | 682 | logit("Pseudo-terminal will not be allocated because " |
683 | "stdin is not a terminal."); | 683 | "stdin is not a terminal."); |
684 | tty_flag = 0; | 684 | tty_flag = 0; |
@@ -1476,7 +1476,7 @@ ssh_session2(void) | |||
1476 | static void | 1476 | static void |
1477 | load_public_identity_files(void) | 1477 | load_public_identity_files(void) |
1478 | { | 1478 | { |
1479 | char *filename, *cp, thishost[NI_MAXHOST]; | 1479 | char *filename, *cp, thishost[NI_MAXHOST], *fp; |
1480 | char *pwdir = NULL, *pwname = NULL; | 1480 | char *pwdir = NULL, *pwname = NULL; |
1481 | int i = 0; | 1481 | int i = 0; |
1482 | Key *public; | 1482 | Key *public; |
@@ -1533,6 +1533,22 @@ load_public_identity_files(void) | |||
1533 | public = key_load_public(filename, NULL); | 1533 | public = key_load_public(filename, NULL); |
1534 | debug("identity file %s type %d", filename, | 1534 | debug("identity file %s type %d", filename, |
1535 | public ? public->type : -1); | 1535 | public ? public->type : -1); |
1536 | if (public && blacklisted_key(public, &fp) == 1) { | ||
1537 | if (options.use_blacklisted_keys) | ||
1538 | logit("Public key %s blacklisted (see " | ||
1539 | "ssh-vulnkey(1)); continuing anyway", fp); | ||
1540 | else | ||
1541 | logit("Public key %s blacklisted (see " | ||
1542 | "ssh-vulnkey(1)); refusing to send it", | ||
1543 | fp); | ||
1544 | xfree(fp); | ||
1545 | if (!options.use_blacklisted_keys) { | ||
1546 | key_free(public); | ||
1547 | xfree(filename); | ||
1548 | filename = NULL; | ||
1549 | public = NULL; | ||
1550 | } | ||
1551 | } | ||
1536 | xfree(options.identity_files[i]); | 1552 | xfree(options.identity_files[i]); |
1537 | identity_files[n_ids] = filename; | 1553 | identity_files[n_ids] = filename; |
1538 | identity_keys[n_ids] = public; | 1554 | identity_keys[n_ids] = public; |
diff --git a/ssh_config b/ssh_config index 2c06ba707..4281e7317 100644 --- a/ssh_config +++ b/ssh_config | |||
@@ -17,9 +17,10 @@ | |||
17 | # list of available options, their meanings and defaults, please see the | 17 | # list of available options, their meanings and defaults, please see the |
18 | # ssh_config(5) man page. | 18 | # ssh_config(5) man page. |
19 | 19 | ||
20 | # Host * | 20 | Host * |
21 | # ForwardAgent no | 21 | # ForwardAgent no |
22 | # ForwardX11 no | 22 | # ForwardX11 no |
23 | # ForwardX11Trusted yes | ||
23 | # RhostsRSAAuthentication no | 24 | # RhostsRSAAuthentication no |
24 | # RSAAuthentication yes | 25 | # RSAAuthentication yes |
25 | # PasswordAuthentication yes | 26 | # PasswordAuthentication yes |
@@ -47,3 +48,7 @@ | |||
47 | # PermitLocalCommand no | 48 | # PermitLocalCommand no |
48 | # VisualHostKey no | 49 | # VisualHostKey no |
49 | # ProxyCommand ssh -q -W %h:%p gateway.example.com | 50 | # ProxyCommand ssh -q -W %h:%p gateway.example.com |
51 | SendEnv LANG LC_* | ||
52 | HashKnownHosts yes | ||
53 | GSSAPIAuthentication yes | ||
54 | GSSAPIDelegateCredentials no | ||
diff --git a/ssh_config.5 b/ssh_config.5 index 9e1e9a6af..19bff6d54 100644 --- a/ssh_config.5 +++ b/ssh_config.5 | |||
@@ -71,6 +71,22 @@ Since the first obtained value for each parameter is used, more | |||
71 | host-specific declarations should be given near the beginning of the | 71 | host-specific declarations should be given near the beginning of the |
72 | file, and general defaults at the end. | 72 | file, and general defaults at the end. |
73 | .Pp | 73 | .Pp |
74 | Note that the Debian | ||
75 | .Ic openssh-client | ||
76 | package sets several options as standard in | ||
77 | .Pa /etc/ssh/ssh_config | ||
78 | which are not the default in | ||
79 | .Xr ssh 1 : | ||
80 | .Pp | ||
81 | .Bl -bullet -offset indent -compact | ||
82 | .It | ||
83 | .Cm SendEnv No LANG LC_* | ||
84 | .It | ||
85 | .Cm HashKnownHosts No yes | ||
86 | .It | ||
87 | .Cm GSSAPIAuthentication No yes | ||
88 | .El | ||
89 | .Pp | ||
74 | The configuration file has the following format: | 90 | The configuration file has the following format: |
75 | .Pp | 91 | .Pp |
76 | Empty lines and lines starting with | 92 | Empty lines and lines starting with |
@@ -136,8 +152,12 @@ Valid arguments are | |||
136 | If set to | 152 | If set to |
137 | .Dq yes , | 153 | .Dq yes , |
138 | passphrase/password querying will be disabled. | 154 | passphrase/password querying will be disabled. |
155 | In addition, the | ||
156 | .Cm ServerAliveInterval | ||
157 | option will be set to 300 seconds by default. | ||
139 | This option is useful in scripts and other batch jobs where no user | 158 | This option is useful in scripts and other batch jobs where no user |
140 | is present to supply the password. | 159 | is present to supply the password, |
160 | and where it is desirable to detect a broken network swiftly. | ||
141 | The argument must be | 161 | The argument must be |
142 | .Dq yes | 162 | .Dq yes |
143 | or | 163 | or |
@@ -495,7 +515,8 @@ token used for the session will be set to expire after 20 minutes. | |||
495 | Remote clients will be refused access after this time. | 515 | Remote clients will be refused access after this time. |
496 | .Pp | 516 | .Pp |
497 | The default is | 517 | The default is |
498 | .Dq no . | 518 | .Dq yes |
519 | (Debian-specific). | ||
499 | .Pp | 520 | .Pp |
500 | See the X11 SECURITY extension specification for full details on | 521 | See the X11 SECURITY extension specification for full details on |
501 | the restrictions imposed on untrusted clients. | 522 | the restrictions imposed on untrusted clients. |
@@ -581,6 +602,9 @@ Note that existing names and addresses in known hosts files | |||
581 | will not be converted automatically, | 602 | will not be converted automatically, |
582 | but may be manually hashed using | 603 | but may be manually hashed using |
583 | .Xr ssh-keygen 1 . | 604 | .Xr ssh-keygen 1 . |
605 | Use of this option may break facilities such as tab-completion that rely | ||
606 | on being able to read unhashed host names from | ||
607 | .Pa ~/.ssh/known_hosts . | ||
584 | .It Cm HostbasedAuthentication | 608 | .It Cm HostbasedAuthentication |
585 | Specifies whether to try rhosts based authentication with public key | 609 | Specifies whether to try rhosts based authentication with public key |
586 | authentication. | 610 | authentication. |
@@ -1089,7 +1113,10 @@ If, for example, | |||
1089 | .Cm ServerAliveCountMax | 1113 | .Cm ServerAliveCountMax |
1090 | is left at the default, if the server becomes unresponsive, | 1114 | is left at the default, if the server becomes unresponsive, |
1091 | ssh will disconnect after approximately 45 seconds. | 1115 | ssh will disconnect after approximately 45 seconds. |
1092 | This option applies to protocol version 2 only. | 1116 | This option applies to protocol version 2 only; in protocol version |
1117 | 1 there is no mechanism to request a response from the server to the | ||
1118 | server alive messages, so disconnection is the responsibility of the TCP | ||
1119 | stack. | ||
1093 | .It Cm ServerAliveInterval | 1120 | .It Cm ServerAliveInterval |
1094 | Sets a timeout interval in seconds after which if no data has been received | 1121 | Sets a timeout interval in seconds after which if no data has been received |
1095 | from the server, | 1122 | from the server, |
@@ -1097,8 +1124,15 @@ from the server, | |||
1097 | will send a message through the encrypted | 1124 | will send a message through the encrypted |
1098 | channel to request a response from the server. | 1125 | channel to request a response from the server. |
1099 | The default | 1126 | The default |
1100 | is 0, indicating that these messages will not be sent to the server. | 1127 | is 0, indicating that these messages will not be sent to the server, |
1128 | or 300 if the | ||
1129 | .Cm BatchMode | ||
1130 | option is set. | ||
1101 | This option applies to protocol version 2 only. | 1131 | This option applies to protocol version 2 only. |
1132 | .Cm ProtocolKeepAlives | ||
1133 | and | ||
1134 | .Cm SetupTimeOut | ||
1135 | are Debian-specific compatibility aliases for this option. | ||
1102 | .It Cm StrictHostKeyChecking | 1136 | .It Cm StrictHostKeyChecking |
1103 | If this flag is set to | 1137 | If this flag is set to |
1104 | .Dq yes , | 1138 | .Dq yes , |
@@ -1137,6 +1171,12 @@ Specifies whether the system should send TCP keepalive messages to the | |||
1137 | other side. | 1171 | other side. |
1138 | If they are sent, death of the connection or crash of one | 1172 | If they are sent, death of the connection or crash of one |
1139 | of the machines will be properly noticed. | 1173 | of the machines will be properly noticed. |
1174 | This option only uses TCP keepalives (as opposed to using ssh level | ||
1175 | keepalives), so takes a long time to notice when the connection dies. | ||
1176 | As such, you probably want | ||
1177 | the | ||
1178 | .Cm ServerAliveInterval | ||
1179 | option as well. | ||
1140 | However, this means that | 1180 | However, this means that |
1141 | connections will die if the route is down temporarily, and some people | 1181 | connections will die if the route is down temporarily, and some people |
1142 | find it annoying. | 1182 | find it annoying. |
@@ -1188,6 +1228,23 @@ is not specified, it defaults to | |||
1188 | .Dq any . | 1228 | .Dq any . |
1189 | The default is | 1229 | The default is |
1190 | .Dq any:any . | 1230 | .Dq any:any . |
1231 | .It Cm UseBlacklistedKeys | ||
1232 | Specifies whether | ||
1233 | .Xr ssh 1 | ||
1234 | should use keys recorded in its blacklist of known-compromised keys (see | ||
1235 | .Xr ssh-vulnkey 1 ) | ||
1236 | for authentication. | ||
1237 | If | ||
1238 | .Dq yes , | ||
1239 | then attempts to use compromised keys for authentication will be logged but | ||
1240 | accepted. | ||
1241 | It is strongly recommended that this be used only to install new authorized | ||
1242 | keys on the remote system, and even then only with the utmost care. | ||
1243 | If | ||
1244 | .Dq no , | ||
1245 | then attempts to use compromised keys for authentication will be prevented. | ||
1246 | The default is | ||
1247 | .Dq no . | ||
1191 | .It Cm UsePrivilegedPort | 1248 | .It Cm UsePrivilegedPort |
1192 | Specifies whether to use a privileged port for outgoing connections. | 1249 | Specifies whether to use a privileged port for outgoing connections. |
1193 | The argument must be | 1250 | The argument must be |
@@ -1306,6 +1363,8 @@ The format of this file is described above. | |||
1306 | This file is used by the SSH client. | 1363 | This file is used by the SSH client. |
1307 | Because of the potential for abuse, this file must have strict permissions: | 1364 | Because of the potential for abuse, this file must have strict permissions: |
1308 | read/write for the user, and not accessible by others. | 1365 | read/write for the user, and not accessible by others. |
1366 | It may be group-writable provided that the group in question contains only | ||
1367 | the user. | ||
1309 | .It Pa /etc/ssh/ssh_config | 1368 | .It Pa /etc/ssh/ssh_config |
1310 | Systemwide configuration file. | 1369 | Systemwide configuration file. |
1311 | This file provides defaults for those | 1370 | This file provides defaults for those |
diff --git a/sshconnect.c b/sshconnect.c index 0ee726637..aed4c0bc7 100644 --- a/sshconnect.c +++ b/sshconnect.c | |||
@@ -144,7 +144,7 @@ ssh_proxy_connect(const char *host, u_short port, const char *proxy_command) | |||
144 | /* Execute the proxy command. Note that we gave up any | 144 | /* Execute the proxy command. Note that we gave up any |
145 | extra privileges above. */ | 145 | extra privileges above. */ |
146 | signal(SIGPIPE, SIG_DFL); | 146 | signal(SIGPIPE, SIG_DFL); |
147 | execv(argv[0], argv); | 147 | execvp(argv[0], argv); |
148 | perror(argv[0]); | 148 | perror(argv[0]); |
149 | exit(1); | 149 | exit(1); |
150 | } | 150 | } |
@@ -556,7 +556,7 @@ ssh_exchange_identification(int timeout_ms) | |||
556 | snprintf(buf, sizeof buf, "SSH-%d.%d-%.100s%s", | 556 | snprintf(buf, sizeof buf, "SSH-%d.%d-%.100s%s", |
557 | compat20 ? PROTOCOL_MAJOR_2 : PROTOCOL_MAJOR_1, | 557 | compat20 ? PROTOCOL_MAJOR_2 : PROTOCOL_MAJOR_1, |
558 | compat20 ? PROTOCOL_MINOR_2 : minor1, | 558 | compat20 ? PROTOCOL_MINOR_2 : minor1, |
559 | SSH_VERSION, compat20 ? "\r\n" : "\n"); | 559 | SSH_RELEASE, compat20 ? "\r\n" : "\n"); |
560 | if (roaming_atomicio(vwrite, connection_out, buf, strlen(buf)) | 560 | if (roaming_atomicio(vwrite, connection_out, buf, strlen(buf)) |
561 | != strlen(buf)) | 561 | != strlen(buf)) |
562 | fatal("write: %.100s", strerror(errno)); | 562 | fatal("write: %.100s", strerror(errno)); |
@@ -1273,7 +1273,7 @@ ssh_local_cmd(const char *args) | |||
1273 | if (pid == 0) { | 1273 | if (pid == 0) { |
1274 | signal(SIGPIPE, SIG_DFL); | 1274 | signal(SIGPIPE, SIG_DFL); |
1275 | debug3("Executing %s -c \"%s\"", shell, args); | 1275 | debug3("Executing %s -c \"%s\"", shell, args); |
1276 | execl(shell, shell, "-c", args, (char *)NULL); | 1276 | execlp(shell, shell, "-c", args, (char *)NULL); |
1277 | error("Couldn't execute %s -c \"%s\": %s", | 1277 | error("Couldn't execute %s -c \"%s\": %s", |
1278 | shell, args, strerror(errno)); | 1278 | shell, args, strerror(errno)); |
1279 | _exit(1); | 1279 | _exit(1); |
diff --git a/sshconnect2.c b/sshconnect2.c index 3ddef328b..8346372cb 100644 --- a/sshconnect2.c +++ b/sshconnect2.c | |||
@@ -1489,6 +1489,8 @@ pubkey_prepare(Authctxt *authctxt) | |||
1489 | 1489 | ||
1490 | /* list of keys stored in the filesystem */ | 1490 | /* list of keys stored in the filesystem */ |
1491 | for (i = 0; i < options.num_identity_files; i++) { | 1491 | for (i = 0; i < options.num_identity_files; i++) { |
1492 | if (options.identity_files[i] == NULL) | ||
1493 | continue; | ||
1492 | key = options.identity_keys[i]; | 1494 | key = options.identity_keys[i]; |
1493 | if (key && key->type == KEY_RSA1) | 1495 | if (key && key->type == KEY_RSA1) |
1494 | continue; | 1496 | continue; |
@@ -1582,7 +1584,7 @@ userauth_pubkey(Authctxt *authctxt) | |||
1582 | debug("Offering %s public key: %s", key_type(id->key), | 1584 | debug("Offering %s public key: %s", key_type(id->key), |
1583 | id->filename); | 1585 | id->filename); |
1584 | sent = send_pubkey_test(authctxt, id); | 1586 | sent = send_pubkey_test(authctxt, id); |
1585 | } else if (id->key == NULL) { | 1587 | } else if (id->key == NULL && id->filename) { |
1586 | debug("Trying private key: %s", id->filename); | 1588 | debug("Trying private key: %s", id->filename); |
1587 | id->key = load_identity_file(id->filename); | 1589 | id->key = load_identity_file(id->filename); |
1588 | if (id->key != NULL) { | 1590 | if (id->key != NULL) { |
@@ -69,7 +69,7 @@ over an insecure network. | |||
69 | .Nm | 69 | .Nm |
70 | listens for connections from clients. | 70 | listens for connections from clients. |
71 | It is normally started at boot from | 71 | It is normally started at boot from |
72 | .Pa /etc/rc . | 72 | .Pa /etc/init.d/ssh . |
73 | It forks a new | 73 | It forks a new |
74 | daemon for each incoming connection. | 74 | daemon for each incoming connection. |
75 | The forked daemons handle | 75 | The forked daemons handle |
@@ -853,7 +853,7 @@ This file is for host-based authentication (see | |||
853 | .Xr ssh 1 ) . | 853 | .Xr ssh 1 ) . |
854 | It should only be writable by root. | 854 | It should only be writable by root. |
855 | .Pp | 855 | .Pp |
856 | .It Pa /etc/moduli | 856 | .It Pa /etc/ssh/moduli |
857 | Contains Diffie-Hellman groups used for the "Diffie-Hellman Group Exchange". | 857 | Contains Diffie-Hellman groups used for the "Diffie-Hellman Group Exchange". |
858 | The file format is described in | 858 | The file format is described in |
859 | .Xr moduli 5 . | 859 | .Xr moduli 5 . |
@@ -948,9 +948,9 @@ The content of this file is not sensitive; it can be world-readable. | |||
948 | .Xr ssh-agent 1 , | 948 | .Xr ssh-agent 1 , |
949 | .Xr ssh-keygen 1 , | 949 | .Xr ssh-keygen 1 , |
950 | .Xr ssh-keyscan 1 , | 950 | .Xr ssh-keyscan 1 , |
951 | .Xr ssh-vulnkey 1 , | ||
951 | .Xr chroot 2 , | 952 | .Xr chroot 2 , |
952 | .Xr hosts_access 5 , | 953 | .Xr hosts_access 5 , |
953 | .Xr login.conf 5 , | ||
954 | .Xr moduli 5 , | 954 | .Xr moduli 5 , |
955 | .Xr sshd_config 5 , | 955 | .Xr sshd_config 5 , |
956 | .Xr inetd 8 , | 956 | .Xr inetd 8 , |
@@ -423,7 +423,8 @@ sshd_exchange_identification(int sock_in, int sock_out) | |||
423 | minor = PROTOCOL_MINOR_1; | 423 | minor = PROTOCOL_MINOR_1; |
424 | } | 424 | } |
425 | snprintf(buf, sizeof buf, "SSH-%d.%d-%.100s%s", major, minor, | 425 | snprintf(buf, sizeof buf, "SSH-%d.%d-%.100s%s", major, minor, |
426 | SSH_VERSION, newline); | 426 | options.debian_banner ? SSH_RELEASE : SSH_RELEASE_MINIMUM, |
427 | newline); | ||
427 | server_version_string = xstrdup(buf); | 428 | server_version_string = xstrdup(buf); |
428 | 429 | ||
429 | /* Send our protocol version identification. */ | 430 | /* Send our protocol version identification. */ |
@@ -730,7 +731,7 @@ privsep_postauth(Authctxt *authctxt) | |||
730 | RAND_seed(rnd, sizeof(rnd)); | 731 | RAND_seed(rnd, sizeof(rnd)); |
731 | 732 | ||
732 | /* Drop privileges */ | 733 | /* Drop privileges */ |
733 | do_setusercontext(authctxt->pw); | 734 | do_setusercontext(authctxt->pw, authctxt->role); |
734 | 735 | ||
735 | skip: | 736 | skip: |
736 | /* It is safe now to apply the key state */ | 737 | /* It is safe now to apply the key state */ |
@@ -1598,6 +1599,11 @@ main(int ac, char **av) | |||
1598 | sensitive_data.host_keys[i] = NULL; | 1599 | sensitive_data.host_keys[i] = NULL; |
1599 | continue; | 1600 | continue; |
1600 | } | 1601 | } |
1602 | if (auth_key_is_revoked(key, 1)) { | ||
1603 | key_free(key); | ||
1604 | sensitive_data.host_keys[i] = NULL; | ||
1605 | continue; | ||
1606 | } | ||
1601 | switch (key->type) { | 1607 | switch (key->type) { |
1602 | case KEY_RSA1: | 1608 | case KEY_RSA1: |
1603 | sensitive_data.ssh1_host_key = key; | 1609 | sensitive_data.ssh1_host_key = key; |
diff --git a/sshd_config b/sshd_config index d02d7a749..e7a33399b 100644 --- a/sshd_config +++ b/sshd_config | |||
@@ -37,6 +37,7 @@ | |||
37 | # Authentication: | 37 | # Authentication: |
38 | 38 | ||
39 | #LoginGraceTime 2m | 39 | #LoginGraceTime 2m |
40 | # See /usr/share/doc/openssh-server/README.Debian.gz. | ||
40 | #PermitRootLogin yes | 41 | #PermitRootLogin yes |
41 | #StrictModes yes | 42 | #StrictModes yes |
42 | #MaxAuthTries 6 | 43 | #MaxAuthTries 6 |
diff --git a/sshd_config.5 b/sshd_config.5 index 76c95aa19..e73624154 100644 --- a/sshd_config.5 +++ b/sshd_config.5 | |||
@@ -57,6 +57,33 @@ Arguments may optionally be enclosed in double quotes | |||
57 | .Pq \&" | 57 | .Pq \&" |
58 | in order to represent arguments containing spaces. | 58 | in order to represent arguments containing spaces. |
59 | .Pp | 59 | .Pp |
60 | Note that the Debian | ||
61 | .Ic openssh-server | ||
62 | package sets several options as standard in | ||
63 | .Pa /etc/ssh/sshd_config | ||
64 | which are not the default in | ||
65 | .Xr sshd 8 . | ||
66 | The exact list depends on whether the package was installed fresh or | ||
67 | upgraded from various possible previous versions, but includes at least the | ||
68 | following: | ||
69 | .Pp | ||
70 | .Bl -bullet -offset indent -compact | ||
71 | .It | ||
72 | .Cm Protocol No 2 | ||
73 | .It | ||
74 | .Cm ChallengeResponseAuthentication No no | ||
75 | .It | ||
76 | .Cm X11Forwarding No yes | ||
77 | .It | ||
78 | .Cm PrintMotd No no | ||
79 | .It | ||
80 | .Cm AcceptEnv No LANG LC_* | ||
81 | .It | ||
82 | .Cm Subsystem No sftp /usr/lib/openssh/sftp-server | ||
83 | .It | ||
84 | .Cm UsePAM No yes | ||
85 | .El | ||
86 | .Pp | ||
60 | The possible | 87 | The possible |
61 | keywords and their meanings are as follows (note that | 88 | keywords and their meanings are as follows (note that |
62 | keywords are case-insensitive and arguments are case-sensitive): | 89 | keywords are case-insensitive and arguments are case-sensitive): |
@@ -222,8 +249,7 @@ This option is only available for protocol version 2. | |||
222 | By default, no banner is displayed. | 249 | By default, no banner is displayed. |
223 | .It Cm ChallengeResponseAuthentication | 250 | .It Cm ChallengeResponseAuthentication |
224 | Specifies whether challenge-response authentication is allowed (e.g. via | 251 | Specifies whether challenge-response authentication is allowed (e.g. via |
225 | PAM or though authentication styles supported in | 252 | PAM). |
226 | .Xr login.conf 5 ) | ||
227 | The default is | 253 | The default is |
228 | .Dq yes . | 254 | .Dq yes . |
229 | .It Cm ChrootDirectory | 255 | .It Cm ChrootDirectory |
@@ -340,6 +366,11 @@ or | |||
340 | .Dq no . | 366 | .Dq no . |
341 | The default is | 367 | The default is |
342 | .Dq delayed . | 368 | .Dq delayed . |
369 | .It Cm DebianBanner | ||
370 | Specifies whether the distribution-specified extra version suffix is | ||
371 | included during initial protocol handshake. | ||
372 | The default is | ||
373 | .Dq yes . | ||
343 | .It Cm DenyGroups | 374 | .It Cm DenyGroups |
344 | This keyword can be followed by a list of group name patterns, separated | 375 | This keyword can be followed by a list of group name patterns, separated |
345 | by spaces. | 376 | by spaces. |
@@ -795,6 +826,20 @@ are refused if the number of unauthenticated connections reaches | |||
795 | Specifies whether password authentication is allowed. | 826 | Specifies whether password authentication is allowed. |
796 | The default is | 827 | The default is |
797 | .Dq yes . | 828 | .Dq yes . |
829 | .It Cm PermitBlacklistedKeys | ||
830 | Specifies whether | ||
831 | .Xr sshd 8 | ||
832 | should allow keys recorded in its blacklist of known-compromised keys (see | ||
833 | .Xr ssh-vulnkey 1 ) . | ||
834 | If | ||
835 | .Dq yes , | ||
836 | then attempts to authenticate with compromised keys will be logged but | ||
837 | accepted. | ||
838 | If | ||
839 | .Dq no , | ||
840 | then attempts to authenticate with compromised keys will be rejected. | ||
841 | The default is | ||
842 | .Dq no . | ||
798 | .It Cm PermitEmptyPasswords | 843 | .It Cm PermitEmptyPasswords |
799 | When password authentication is allowed, it specifies whether the | 844 | When password authentication is allowed, it specifies whether the |
800 | server allows login to accounts with empty password strings. | 845 | server allows login to accounts with empty password strings. |
@@ -1023,6 +1068,9 @@ This avoids infinitely hanging sessions. | |||
1023 | .Pp | 1068 | .Pp |
1024 | To disable TCP keepalive messages, the value should be set to | 1069 | To disable TCP keepalive messages, the value should be set to |
1025 | .Dq no . | 1070 | .Dq no . |
1071 | .Pp | ||
1072 | This option was formerly called | ||
1073 | .Cm KeepAlive . | ||
1026 | .It Cm TrustedUserCAKeys | 1074 | .It Cm TrustedUserCAKeys |
1027 | Specifies a file containing public keys of certificate authorities that are | 1075 | Specifies a file containing public keys of certificate authorities that are |
1028 | trusted to sign user certificates for authentication. | 1076 | trusted to sign user certificates for authentication. |
@@ -200,7 +200,7 @@ pty_change_window_size(int ptyfd, u_int row, u_int col, | |||
200 | } | 200 | } |
201 | 201 | ||
202 | void | 202 | void |
203 | pty_setowner(struct passwd *pw, const char *tty) | 203 | pty_setowner(struct passwd *pw, const char *tty, const char *role) |
204 | { | 204 | { |
205 | struct group *grp; | 205 | struct group *grp; |
206 | gid_t gid; | 206 | gid_t gid; |
@@ -227,7 +227,7 @@ pty_setowner(struct passwd *pw, const char *tty) | |||
227 | strerror(errno)); | 227 | strerror(errno)); |
228 | 228 | ||
229 | #ifdef WITH_SELINUX | 229 | #ifdef WITH_SELINUX |
230 | ssh_selinux_setup_pty(pw->pw_name, tty); | 230 | ssh_selinux_setup_pty(pw->pw_name, tty, role); |
231 | #endif | 231 | #endif |
232 | 232 | ||
233 | if (st.st_uid != pw->pw_uid || st.st_gid != gid) { | 233 | if (st.st_uid != pw->pw_uid || st.st_gid != gid) { |
@@ -24,4 +24,4 @@ int pty_allocate(int *, int *, char *, size_t); | |||
24 | void pty_release(const char *); | 24 | void pty_release(const char *); |
25 | void pty_make_controlling_tty(int *, const char *); | 25 | void pty_make_controlling_tty(int *, const char *); |
26 | void pty_change_window_size(int, u_int, u_int, u_int, u_int); | 26 | void pty_change_window_size(int, u_int, u_int, u_int, u_int); |
27 | void pty_setowner(struct passwd *, const char *); | 27 | void pty_setowner(struct passwd *, const char *, const char *); |
@@ -3,4 +3,9 @@ | |||
3 | #define SSH_VERSION "OpenSSH_5.9" | 3 | #define SSH_VERSION "OpenSSH_5.9" |
4 | 4 | ||
5 | #define SSH_PORTABLE "p2" | 5 | #define SSH_PORTABLE "p2" |
6 | #define SSH_RELEASE SSH_VERSION SSH_PORTABLE | 6 | #define SSH_RELEASE_MINIMUM SSH_VERSION SSH_PORTABLE |
7 | #ifdef SSH_EXTRAVERSION | ||
8 | #define SSH_RELEASE SSH_RELEASE_MINIMUM " " SSH_EXTRAVERSION | ||
9 | #else | ||
10 | #define SSH_RELEASE SSH_RELEASE_MINIMUM | ||
11 | #endif | ||