diff options
Diffstat (limited to 'debian/changelog')
-rw-r--r-- | debian/changelog | 2196 |
1 files changed, 2196 insertions, 0 deletions
diff --git a/debian/changelog b/debian/changelog new file mode 100644 index 000000000..a6eb2d15b --- /dev/null +++ b/debian/changelog | |||
@@ -0,0 +1,2196 @@ | |||
1 | openssh (1:4.6p1-1) UNRELEASED; urgency=low | ||
2 | |||
3 | * New upstream release (closes: #395507, #397961, #420035). Important | ||
4 | changes not previously backported to 4.3p2: | ||
5 | - 4.4/4.4p1 (http://www.openssh.org/txt/release-4.4): | ||
6 | + On portable OpenSSH, fix a GSSAPI authentication abort that could be | ||
7 | used to determine the validity of usernames on some platforms. | ||
8 | + Implemented conditional configuration in sshd_config(5) using the | ||
9 | "Match" directive. This allows some configuration options to be | ||
10 | selectively overridden if specific criteria (based on user, group, | ||
11 | hostname and/or address) are met. So far a useful subset of | ||
12 | post-authentication options are supported and more are expected to | ||
13 | be added in future releases. | ||
14 | + Add support for Diffie-Hellman group exchange key agreement with a | ||
15 | final hash of SHA256. | ||
16 | + Added a "ForceCommand" directive to sshd_config(5). Similar to the | ||
17 | command="..." option accepted in ~/.ssh/authorized_keys, this forces | ||
18 | the execution of the specified command regardless of what the user | ||
19 | requested. This is very useful in conjunction with the new "Match" | ||
20 | option. | ||
21 | + Add a "PermitOpen" directive to sshd_config(5). This mirrors the | ||
22 | permitopen="..." authorized_keys option, allowing fine-grained | ||
23 | control over the port-forwardings that a user is allowed to | ||
24 | establish. | ||
25 | + Add optional logging of transactions to sftp-server(8). | ||
26 | + ssh(1) will now record port numbers for hosts stored in | ||
27 | ~/.ssh/known_hosts when a non-standard port has been requested | ||
28 | (closes: #50612). | ||
29 | + Add an "ExitOnForwardFailure" option to cause ssh(1) to exit (with a | ||
30 | non-zero exit code) when requested port forwardings could not be | ||
31 | established. | ||
32 | + Extend sshd_config(5) "SubSystem" declarations to allow the | ||
33 | specification of command-line arguments. | ||
34 | + Replacement of all integer overflow susceptible invocations of | ||
35 | malloc(3) and realloc(3) with overflow-checking equivalents. | ||
36 | + Many manpage fixes and improvements. | ||
37 | + Add optional support for OpenSSL hardware accelerators (engines), | ||
38 | enabled using the --with-ssl-engine configure option. | ||
39 | + Tokens in configuration files may be double-quoted in order to | ||
40 | contain spaces (closes: #319639). | ||
41 | + Move a debug() call out of a SIGCHLD handler, fixing a hang when the | ||
42 | session exits very quickly (closes: #307890). | ||
43 | + Fix some incorrect buffer allocation calculations (closes: #410599). | ||
44 | + ssh-add doesn't ask for a passphrase if key file permissions are too | ||
45 | liberal (closes: #103677). | ||
46 | + Likewise, ssh doesn't ask either (closes: #99675). | ||
47 | - 4.6/4.6p1 (http://www.openssh.org/txt/release-4.6): | ||
48 | + sshd now allows the enabling and disabling of authentication methods | ||
49 | on a per user, group, host and network basis via the Match directive | ||
50 | in sshd_config. | ||
51 | + Fixed an inconsistent check for a terminal when displaying scp | ||
52 | progress meter (closes: #257524). | ||
53 | + Fix "hang on exit" when background processes are running at the time | ||
54 | of exit on a ttyful/login session (closes: #88337). | ||
55 | * Update to current GSSAPI patch from | ||
56 | http://www.sxw.org.uk/computing/patches/openssh-4.6p1-gsskex-20070312.patch; | ||
57 | install ChangeLog.gssapi. | ||
58 | |||
59 | -- Colin Watson <cjwatson@ubuntu.com> Tue, 12 Jun 2007 14:31:01 +0100 | ||
60 | |||
61 | openssh (1:4.3p2-11) unstable; urgency=low | ||
62 | |||
63 | * It's been four and a half years now since I took over as "temporary" | ||
64 | maintainer, so the Maintainer field is getting a bit inaccurate. Set | ||
65 | Maintainer to debian-ssh@lists.debian.org and leave Matthew and myself | ||
66 | as Uploaders. | ||
67 | * Use dpkg-query to fetch conffile md5sums rather than parsing | ||
68 | /var/lib/dpkg/status directly. | ||
69 | * openssh-client Suggests: libpam-ssh (closes: #427840). | ||
70 | * Use 'start-stop-daemon --oknodo' so that openssh-server's init script | ||
71 | exits successfully if sshd is already running (closes: #426858). | ||
72 | |||
73 | * Apply results of debconf templates and package descriptions review by | ||
74 | debian-l10n-english (closes: #420107, #420742). | ||
75 | * debconf template translations: | ||
76 | - Update Dutch (thanks, Machteld de Kok; closes: #419260). | ||
77 | - Update Norwegian Bokmål (thanks, Bjørn Steensrud; closes: #420630). | ||
78 | - Update Galician (thanks, Jacobo Tarrio; closes: #420635). | ||
79 | - Update Spanish (thanks, Javier Fernández-Sanguino Peña; | ||
80 | closes: #420651). | ||
81 | - Update Swedish (thanks, Daniel Nylander; closes: #420663). | ||
82 | - Add Bulgarian (thanks, Damyan Ivanov; closes: #420703). | ||
83 | - Add Tamil (thanks, Tirumurti Vasudevan; closes: #420739). | ||
84 | - Update German (thanks, Helge Kreutzmann; closes: #420743). | ||
85 | - Update Japanese (thanks, Kenshi Muto; closes: #420946). | ||
86 | - Add Basque (thanks, Piarres Beobide; closes: #421238). | ||
87 | - Update Italian (thanks, Luca Monducci; closes: #421348). | ||
88 | - Update Czech (thanks, Miroslav Kure; closes: #421484). | ||
89 | - Update Romanian (thanks, Igor Stirbu; closes: #421760). | ||
90 | - Update Russian (thanks, Yuriy Talakan' and Sergey Alyoshin; | ||
91 | closes: #420862). | ||
92 | - Update Dutch (thanks, Bart Cornelis; closes: #422767). | ||
93 | - Update Portuguese (thanks, Ricardo Silva; closes: #423112). | ||
94 | - Update French (thanks, Christian Perrier). | ||
95 | - Add Korean (thanks, Sunjae Park; closes: #424008). | ||
96 | - Update Vietnamese (thanks, Clytie Siddall; closes: #426991). | ||
97 | |||
98 | -- Colin Watson <cjwatson@debian.org> Sun, 10 Jun 2007 08:59:42 +0100 | ||
99 | |||
100 | openssh (1:4.3p2-10) unstable; urgency=low | ||
101 | |||
102 | * Multiply openssh-client-udeb's Installer-Menu-Item by 100. | ||
103 | * Increase MAX_SESSIONS to 64. | ||
104 | |||
105 | -- Colin Watson <cjwatson@debian.org> Tue, 10 Apr 2007 19:17:20 +0100 | ||
106 | |||
107 | openssh (1:4.3p2-9) unstable; urgency=high | ||
108 | |||
109 | [ Russ Allbery ] | ||
110 | * Fix GSSAPIKeyExchange configuration file handling logic in ssh-krb5 | ||
111 | (closes: #404863). | ||
112 | * Fix uncommenting of GSSAPI options by ssh-krb5 (closes: #407766). | ||
113 | |||
114 | [ Colin Watson ] | ||
115 | * debconf template translations: | ||
116 | - Add Norwegian Bokmål (thanks, Bjørn Steensrud; closes: #412330). | ||
117 | |||
118 | -- Colin Watson <cjwatson@debian.org> Mon, 5 Mar 2007 16:13:50 +0000 | ||
119 | |||
120 | openssh (1:4.3p2-8) unstable; urgency=medium | ||
121 | |||
122 | [ Vincent Untz ] | ||
123 | * Give the ssh-askpass-gnome window a default icon; remove unnecessary | ||
124 | icon extension from .desktop file (closes: | ||
125 | https://launchpad.net/bugs/27152). | ||
126 | |||
127 | [ Colin Watson ] | ||
128 | * Drop versioning on ssh/ssh-krb5 Replaces, as otherwise it isn't | ||
129 | sufficient to replace conffiles (closes: #402804). | ||
130 | * Make GSSAPICleanupCreds a compatibility alias for | ||
131 | GSSAPICleanupCredentials. Mark GSSUseSessionCCache and | ||
132 | GSSAPIUseSessionCredCache as known-but-unsupported options, and migrate | ||
133 | away from them on upgrade. | ||
134 | * It turns out that the people who told me that removing a conffile in the | ||
135 | preinst was sufficient to have dpkg replace it without prompting when | ||
136 | moving a conffile between packages were very much mistaken. As far as I | ||
137 | can tell, the only way to do this reliably is to write out the desired | ||
138 | new text of the conffile in the preinst. This is gross, and requires | ||
139 | shipping the text of all conffiles in the preinst too, but there's | ||
140 | nothing for it. Fortunately this nonsense is only required for smooth | ||
141 | upgrades from sarge. | ||
142 | * debconf template translations: | ||
143 | - Add Romanian (thanks, Stan Ioan-Eugen; closes: #403528). | ||
144 | |||
145 | -- Colin Watson <cjwatson@debian.org> Sat, 23 Dec 2006 18:38:33 +0000 | ||
146 | |||
147 | openssh (1:4.3p2-7) unstable; urgency=medium | ||
148 | |||
149 | [ Colin Watson ] | ||
150 | * Ignore errors from usermod when changing sshd's shell, since it will | ||
151 | fail if the sshd user is not local (closes: #398436). | ||
152 | * Remove version control tags from /etc/ssh/moduli and /etc/ssh/ssh_config | ||
153 | to avoid unnecessary conffile resolution steps for administrators | ||
154 | (thanks, Jari Aalto; closes: #335259). | ||
155 | * Fix quoting error in configure.ac and regenerate configure (thanks, Ben | ||
156 | Pfaff; closes: #391248). | ||
157 | * When installing openssh-client or openssh-server from scratch, remove | ||
158 | any unchanged conffiles from the pre-split ssh package to work around a | ||
159 | bug in sarge's dpkg (thanks, Justin Pryzby and others; closes: #335276). | ||
160 | |||
161 | [ Russ Allbery ] | ||
162 | * Create transitional ssh-krb5 package which enables GSSAPI configuration | ||
163 | in sshd_config (closes: #390986). | ||
164 | * Default client to attempting GSSAPI authentication. | ||
165 | * Remove obsolete GSSAPINoMICAuthentication from sshd_config if it's | ||
166 | found. | ||
167 | * Add ssh -K option, the converse of -k, to enable GSSAPI credential | ||
168 | delegation (closes: #401483). | ||
169 | |||
170 | -- Colin Watson <cjwatson@debian.org> Wed, 6 Dec 2006 23:00:49 +0000 | ||
171 | |||
172 | openssh (1:4.3p2-6) unstable; urgency=low | ||
173 | |||
174 | * Acknowledge NMU (thanks, Manoj; closes: #394795). | ||
175 | * Backport from 4.5p1: | ||
176 | - Fix a bug in the sshd privilege separation monitor that weakened its | ||
177 | verification of successful authentication. This bug is not known to be | ||
178 | exploitable in the absence of additional vulnerabilities. | ||
179 | * openssh-server Suggests: molly-guard (closes: #395473). | ||
180 | * debconf template translations: | ||
181 | - Update German (thanks, Helge Kreutzmann; closes: #395947). | ||
182 | |||
183 | -- Colin Watson <cjwatson@debian.org> Wed, 15 Nov 2006 00:07:32 +0000 | ||
184 | |||
185 | openssh (1:4.3p2-5.1) unstable; urgency=low | ||
186 | |||
187 | * NMU to update SELinux patch, bringing it in line with current selinux | ||
188 | releases. The patch for this NMU is simply the Bug#394795 patch, | ||
189 | and no other changes. (closes: #394795) | ||
190 | |||
191 | -- Manoj Srivastava <srivasta@debian.org> Mon, 23 Oct 2006 14:11:24 -0500 | ||
192 | |||
193 | openssh (1:4.3p2-5) unstable; urgency=low | ||
194 | |||
195 | * Remove ssh/insecure_telnetd check altogether (closes: #391081). | ||
196 | * debconf template translations: | ||
197 | - Update Danish (thanks, Claus Hindsgaul; closes: #390612). | ||
198 | |||
199 | -- Colin Watson <cjwatson@debian.org> Thu, 5 Oct 2006 09:04:19 +0100 | ||
200 | |||
201 | openssh (1:4.3p2-4) unstable; urgency=high | ||
202 | |||
203 | * Backport from 4.4p1 (since I don't have an updated version of the GSSAPI | ||
204 | patch yet): | ||
205 | - CVE-2006-4924: Fix a pre-authentication denial of service found by | ||
206 | Tavis Ormandy, that would cause sshd(8) to spin until the login grace | ||
207 | time expired (closes: #389995). | ||
208 | - CVE-2006-5051: Fix an unsafe signal hander reported by Mark Dowd. The | ||
209 | signal handler was vulnerable to a race condition that could be | ||
210 | exploited to perform a pre-authentication denial of service. On | ||
211 | portable OpenSSH, this vulnerability could theoretically lead to | ||
212 | pre-authentication remote code execution if GSSAPI authentication is | ||
213 | enabled, but the likelihood of successful exploitation appears remote. | ||
214 | |||
215 | * Read /etc/default/locale as well as /etc/environment (thanks, Raphaël | ||
216 | Hertzog; closes: #369395). | ||
217 | * Remove no-longer-used ssh/insecure_rshd debconf template. | ||
218 | * Make ssh/insecure_telnetd Type: error (closes: #388946). | ||
219 | |||
220 | * debconf template translations: | ||
221 | - Update Portuguese (thanks, Rui Branco; closes: #381942). | ||
222 | - Update Spanish (thanks, Javier Fernández-Sanguino Peña; | ||
223 | closes: #382966). | ||
224 | |||
225 | -- Colin Watson <cjwatson@debian.org> Fri, 29 Sep 2006 16:28:24 +0100 | ||
226 | |||
227 | openssh (1:4.3p2-3) unstable; urgency=low | ||
228 | |||
229 | * Document KeepAlive->TCPKeepAlive renaming in sshd_config(5) (closes: | ||
230 | https://launchpad.net/bugs/50702). | ||
231 | * Change sshd user's shell to /usr/sbin/nologin (closes: #366541). | ||
232 | Introduces dependency on passwd for usermod. | ||
233 | * debconf template translations: | ||
234 | - Update French (thanks, Denis Barbier; closes: #368503). | ||
235 | - Update Dutch (thanks, Bart Cornelis; closes: #375100). | ||
236 | - Update Japanese (thanks, Kenshi Muto; closes: #379950). | ||
237 | |||
238 | -- Colin Watson <cjwatson@debian.org> Thu, 27 Jul 2006 00:12:36 +0100 | ||
239 | |||
240 | openssh (1:4.3p2-2) unstable; urgency=low | ||
241 | |||
242 | * Include commented-out pam_access example in /etc/pam.d/ssh. | ||
243 | * On '/etc/init.d/ssh restart', create /var/run/sshd before checking the | ||
244 | server configuration, as otherwise 'sshd -t' will complain about the | ||
245 | lack of /var/run/sshd (closes: https://launchpad.net/bugs/45234). | ||
246 | * debconf template translations: | ||
247 | - Update Russian (thanks, Yuriy Talakan'; closes: #367143). | ||
248 | - Update Czech (thanks, Miroslav Kure; closes: #367161). | ||
249 | - Update Italian (thanks, Luca Monducci; closes: #367186). | ||
250 | - Update Galician (thanks, Jacobo Tarrio; closes: #367318). | ||
251 | - Update Swedish (thanks, Daniel Nylander; closes: #367971). | ||
252 | |||
253 | -- Colin Watson <cjwatson@debian.org> Fri, 19 May 2006 09:14:27 +0100 | ||
254 | |||
255 | openssh (1:4.3p2-1) unstable; urgency=low | ||
256 | |||
257 | * New upstream release (closes: #361032). | ||
258 | - CVE-2006-0225: scp (as does rcp, on which it is based) invoked a | ||
259 | subshell to perform local to local, and remote to remote copy | ||
260 | operations. This subshell exposed filenames to shell expansion twice; | ||
261 | allowing a local attacker to create filenames containing shell | ||
262 | metacharacters that, if matched by a wildcard, could lead to execution | ||
263 | of attacker-specified commands with the privilege of the user running | ||
264 | scp (closes: #349645). | ||
265 | - Add support for tunneling arbitrary network packets over a connection | ||
266 | between an OpenSSH client and server via tun(4) virtual network | ||
267 | interfaces. This allows the use of OpenSSH (4.3+) to create a true VPN | ||
268 | between the client and server providing real network connectivity at | ||
269 | layer 2 or 3. This feature is experimental. | ||
270 | - Reduce default key length for new DSA keys generated by ssh-keygen | ||
271 | back to 1024 bits. DSA is not specified for longer lengths and does | ||
272 | not fully benefit from simply making keys longer. As per FIPS 186-2 | ||
273 | Change Notice 1, ssh-keygen will refuse to generate a new DSA key | ||
274 | smaller or larger than 1024 bits. | ||
275 | - Fixed X forwarding failing to start when the X11 client is executed in | ||
276 | background at the time of session exit. | ||
277 | - Change ssh-keygen to generate a protocol 2 RSA key when invoked | ||
278 | without arguments (closes: #114894). | ||
279 | - Fix timing variance for valid vs. invalid accounts when attempting | ||
280 | Kerberos authentication. | ||
281 | - Ensure that ssh always returns code 255 on internal error | ||
282 | (closes: #259865). | ||
283 | - Cleanup wtmp files on SIGTERM when not using privsep. | ||
284 | - Set SO_REUSEADDR on X11 listeners to avoid problems caused by | ||
285 | lingering sockets from previous session (X11 applications can | ||
286 | sometimes not connect to 127.0.0.1:60xx) (closes: | ||
287 | https://launchpad.net/bugs/25528). | ||
288 | - Ensure that fds 0, 1 and 2 are always attached in all programs, by | ||
289 | duping /dev/null to them if necessary. | ||
290 | - Xauth list invocation had bogus "." argument. | ||
291 | - Remove internal assumptions on key exchange hash algorithm and output | ||
292 | length, preparing OpenSSH for KEX methods with alternate hashes. | ||
293 | - Ignore junk sent by a server before it sends the "SSH-" banner. | ||
294 | - Many manual page improvements. | ||
295 | - Lots of cleanups, including fixes to memory leaks on error paths and | ||
296 | possible crashes. | ||
297 | * Update to current GSSAPI patch from | ||
298 | http://www.sxw.org.uk/computing/patches/openssh-4.3p2-gsskex-20060223.patch | ||
299 | (closes: #352042). | ||
300 | * debian/rules: Resynchronise CFLAGS with that generated by configure. | ||
301 | * Restore pam_nologin to /etc/pam.d/ssh; sshd no longer checks this itself | ||
302 | when PAM is enabled, but relies on PAM to do it. | ||
303 | * Rename KeepAlive to TCPKeepAlive in default sshd_config | ||
304 | (closes: #349896). | ||
305 | * Rephrase ssh/new_config and ssh/encrypted_host_key_but_no_keygen debconf | ||
306 | templates to make boolean short descriptions end with a question mark | ||
307 | and to avoid use of the first person. | ||
308 | * Ship README.tun. | ||
309 | * Policy version 3.7.2: no changes required. | ||
310 | * debconf template translations: | ||
311 | - Update Italian (thanks, Luca Monducci; closes: #360348). | ||
312 | - Add Galician (thanks, Jacobo Tarrio; closes: #361220). | ||
313 | |||
314 | -- Colin Watson <cjwatson@debian.org> Fri, 12 May 2006 12:48:24 +0100 | ||
315 | |||
316 | openssh (1:4.2p1-8) unstable; urgency=low | ||
317 | |||
318 | [ Frans Pop ] | ||
319 | * Use udeb support introduced in debhelper 4.2.0 (available in sarge) | ||
320 | rather than constructing udebs by steam. | ||
321 | * Require debhelper 5.0.22, which generates correct shared library | ||
322 | dependencies for udebs (closes: #360068). This build-dependency can be | ||
323 | ignored if building on sarge. | ||
324 | |||
325 | [ Colin Watson ] | ||
326 | * Switch to debhelper compatibility level 4, since we now require | ||
327 | debhelper 4 even on sarge anyway for udeb support. | ||
328 | |||
329 | -- Colin Watson <cjwatson@debian.org> Fri, 31 Mar 2006 09:44:55 +0100 | ||
330 | |||
331 | openssh (1:4.2p1-7) unstable; urgency=low | ||
332 | |||
333 | * I accidentally applied the default $PATH change in 1:4.2p1-6 to the udeb | ||
334 | rather than the deb. Fixed. | ||
335 | |||
336 | -- Colin Watson <cjwatson@debian.org> Wed, 1 Mar 2006 16:19:00 +0000 | ||
337 | |||
338 | openssh (1:4.2p1-6) unstable; urgency=low | ||
339 | |||
340 | * Sync default values of $PATH from shadow 1:4.0.12-6, adding /usr/bin/X11 | ||
341 | to the normal and superuser paths and /usr/games to the normal path. | ||
342 | * When the client receives a signal, don't fatal() with "Killed by signal | ||
343 | %d." (which produces unhelpful noise on stderr and causes confusion for | ||
344 | users of some applications that wrap ssh); instead, generate a debug | ||
345 | message and exit with the traditional status (closes: #313371). | ||
346 | * debconf template translations: | ||
347 | - Add Swedish (thanks, Daniel Nylander; closes: #333133). | ||
348 | - Update Spanish (thanks, Javier Fernández-Sanguino Peña; | ||
349 | closes: #341371). | ||
350 | - Correct erroneously-changed Last-Translator headers in Greek and | ||
351 | Spanish translations. | ||
352 | |||
353 | -- Colin Watson <cjwatson@debian.org> Mon, 20 Feb 2006 16:50:55 +0000 | ||
354 | |||
355 | openssh (1:4.2p1-5) unstable; urgency=low | ||
356 | |||
357 | * Add a CVE name to the 1:4.0p1-1 changelog entry. | ||
358 | * Build-depend on libselinux1-dev on armeb. | ||
359 | * Only send GSSAPI proposal if GSSAPIAuthentication is enabled. | ||
360 | * Build-depend on libssl-dev (>= 0.9.8-1) to cope with surprise OpenSSL | ||
361 | transition, since otherwise who knows what the buildds will do. If | ||
362 | you're building openssh yourself, you can safely ignore this and use an | ||
363 | older libssl-dev. | ||
364 | |||
365 | -- Colin Watson <cjwatson@debian.org> Fri, 7 Oct 2005 12:23:42 +0100 | ||
366 | |||
367 | openssh (1:4.2p1-4) unstable; urgency=low | ||
368 | |||
369 | * Initialise token to GSS_C_EMPTY_BUFFER in ssh_gssapi_check_mechanism | ||
370 | (closes: #328606). | ||
371 | |||
372 | -- Colin Watson <cjwatson@debian.org> Fri, 16 Sep 2005 12:50:16 +0100 | ||
373 | |||
374 | openssh (1:4.2p1-3) unstable; urgency=low | ||
375 | |||
376 | * Add prototype for ssh_gssapi_server_mechanisms (closes: #328372). | ||
377 | * Interoperate with ssh-krb5 << 3.8.1p1-1 servers, which used a slightly | ||
378 | different version of the gssapi authentication method (thanks, Aaron M. | ||
379 | Ucko; closes: #328388). | ||
380 | * Explicitly tell po2debconf to use the 'popular' output encoding, so that | ||
381 | the woody-compatibility hack works even with po-debconf 0.9.0. | ||
382 | |||
383 | -- Colin Watson <cjwatson@debian.org> Thu, 15 Sep 2005 09:28:21 +0100 | ||
384 | |||
385 | openssh (1:4.2p1-2) unstable; urgency=low | ||
386 | |||
387 | * Annotate 1:4.2p1-1 changelog with CVE references. | ||
388 | * Add remaining pieces of Kerberos support (closes: #152657, #275472): | ||
389 | - Add GSSAPI key exchange support from | ||
390 | http://www.sxw.org.uk/computing/patches/openssh.html (thanks, Stephen | ||
391 | Frost). | ||
392 | - Build-depend on libkrb5-dev and configure --with-kerberos5=/usr. | ||
393 | - openssh-client and openssh-server replace ssh-krb5. | ||
394 | - Update commented-out Kerberos/GSSAPI options in default sshd_config. | ||
395 | - Fix HAVE_GSSAPI_KRB5_H/HAVE_GSSAPI_GSSAPI_KRB5_H typos in | ||
396 | gss-serv-krb5.c. | ||
397 | |||
398 | -- Colin Watson <cjwatson@debian.org> Wed, 14 Sep 2005 18:28:49 +0100 | ||
399 | |||
400 | openssh (1:4.2p1-1) unstable; urgency=low | ||
401 | |||
402 | * New upstream release. | ||
403 | - SECURITY (CAN-2005-2797): Fix a bug introduced in OpenSSH 4.0 that | ||
404 | caused GatewayPorts to be incorrectly activated for dynamic ("-D") | ||
405 | port forwardings when no listen address was explicitly specified | ||
406 | (closes: #326065). | ||
407 | - SECURITY (CAN-2005-2798): Fix improper delegation of GSSAPI | ||
408 | credentials. This code is only built in openssh-krb5, not openssh, but | ||
409 | I mention the CVE reference here anyway for completeness. | ||
410 | - Add a new compression method ("Compression delayed") that delays zlib | ||
411 | compression until after authentication, eliminating the risk of zlib | ||
412 | vulnerabilities being exploited by unauthenticated users. Note that | ||
413 | users of OpenSSH versions earlier than 3.5 will need to disable | ||
414 | compression on the client or set "Compression yes" (losing this | ||
415 | security benefit) on the server. | ||
416 | - Increase the default size of new RSA/DSA keys generated by ssh-keygen | ||
417 | from 1024 to 2048 bits (closes: #181162). | ||
418 | - Many bugfixes and improvements to connection multiplexing. | ||
419 | - Don't pretend to accept $HOME (closes: #208648). | ||
420 | * debian/rules: Resynchronise CFLAGS with that generated by configure. | ||
421 | * openssh-client and openssh-server conflict with pre-split ssh to avoid | ||
422 | problems when ssh is left un-upgraded (closes: #324695). | ||
423 | * Set X11Forwarding to yes in the default sshd_config (new installs only). | ||
424 | At least when X11UseLocalhost is turned on, which is the default, the | ||
425 | security risks of using X11 forwarding are risks to the client, not to | ||
426 | the server (closes: #320104). | ||
427 | |||
428 | -- Colin Watson <cjwatson@debian.org> Wed, 14 Sep 2005 15:16:14 +0100 | ||
429 | |||
430 | openssh (1:4.1p1-7) unstable; urgency=low | ||
431 | |||
432 | * Do the IDEA host key check on a temporary file to avoid altering | ||
433 | /etc/ssh/ssh_host_key itself (closes: #312312). | ||
434 | * Work around the ssh-askpass alternative somehow ending up in manual mode | ||
435 | pointing to the obsolete /usr/lib/ssh/gnome-ssh-askpass. | ||
436 | * Add GNU/kFreeBSD support (thanks, Aurelien Jarno; closes: #318113). | ||
437 | * Fix XSIish uses of 'test' in openssh-server.preinst. | ||
438 | * Policy version 3.6.2: no changes required. | ||
439 | |||
440 | -- Colin Watson <cjwatson@debian.org> Fri, 2 Sep 2005 16:18:11 +0100 | ||
441 | |||
442 | openssh (1:4.1p1-6) unstable; urgency=low | ||
443 | |||
444 | * Fix one-character typo that meant the binaries in openssh-client and | ||
445 | openssh-server got recompiled with the wrong options during | ||
446 | 'debian/rules install' (closes: #317088, #317238, #317241). | ||
447 | |||
448 | -- Colin Watson <cjwatson@debian.org> Thu, 7 Jul 2005 10:56:16 +0100 | ||
449 | |||
450 | openssh (1:4.1p1-5) unstable; urgency=low | ||
451 | |||
452 | * Build-depend on libselinux1-dev on ppc64 too (closes: #314625). | ||
453 | * Drop priority of ssh to extra to match the override file. | ||
454 | * Make /usr/share/doc/openssh-server and /usr/share/doc/ssh symlinks to | ||
455 | /usr/share/doc/openssh-client (closes: #314745). | ||
456 | * Ship README.dns (closes: #284874). | ||
457 | * Disable btmp logging, since Debian's /var/log/btmp has inappropriate | ||
458 | permissions (closes: #314956). | ||
459 | * Allow ~/.ssh/config to be group-writable, provided that the group in | ||
460 | question contains only the file's owner (closes: #314347). | ||
461 | * debconf template translations: | ||
462 | - Update Brazilian Portuguese (thanks, André Luís Lopes; | ||
463 | closes: #315477). | ||
464 | - Add Vietnamese (thanks, Clytie Siddall; closes: #316636). | ||
465 | |||
466 | -- Colin Watson <cjwatson@debian.org> Sun, 3 Jul 2005 17:08:08 +0100 | ||
467 | |||
468 | openssh (1:4.1p1-4) unstable; urgency=low | ||
469 | |||
470 | * openssh-client and openssh-server conflict with ssh-krb5, as ssh-krb5 | ||
471 | only conflicts with ssh (closes: #312475). | ||
472 | * SELinux support (thanks, Manoj Srivastava; closes: #308555): | ||
473 | - Added SELinux capability, and turned it on be default. Added | ||
474 | restorecon calls in preinst and postinst (should not matter if the | ||
475 | machine is not SELinux aware). By and large, the changes made should | ||
476 | have no effect unless the rules file calls --with-selinux; and even | ||
477 | then there should be no performance hit for machines not actively | ||
478 | running SELinux. | ||
479 | - Modified the preinst and postinst to call restorecon to set the | ||
480 | security context for the generated public key files. | ||
481 | - Added a comment to /etc/pam.d/ssh to indicate that an SELinux system | ||
482 | may want to also include pam_selinux.so. | ||
483 | * Re-enable ssh-askpass-gnome on the Hurd, now that its build-dependencies | ||
484 | are available. | ||
485 | * Restore /usr/lib/sftp-server temporarily, as a symlink to | ||
486 | /usr/lib/openssh/sftp-server (closes: #312891). | ||
487 | * Switch to debhelper compatibility level 3, since 2 is deprecated. | ||
488 | * debconf template translations: | ||
489 | - Update German (thanks, Jens Seidel; closes: #313949). | ||
490 | |||
491 | -- Colin Watson <cjwatson@debian.org> Fri, 17 Jun 2005 14:20:20 +0100 | ||
492 | |||
493 | openssh (1:4.1p1-3) unstable; urgency=low | ||
494 | |||
495 | * Upload to unstable. | ||
496 | |||
497 | -- Colin Watson <cjwatson@debian.org> Mon, 6 Jun 2005 22:28:33 +0100 | ||
498 | |||
499 | openssh (1:4.1p1-2) experimental; urgency=low | ||
500 | |||
501 | * Drop debconf support for allowing SSH protocol 1, which is discouraged | ||
502 | and has not been the default since openssh 1:3.0.1p1-1. Users who need | ||
503 | this should edit sshd_config instead (closes: #147212). | ||
504 | * Since ssh-keysign isn't used by default (you need to set | ||
505 | EnableSSHKeysign to "yes" in /etc/ssh/ssh_config), having a debconf | ||
506 | question to ask whether it should be setuid is overkill, and the | ||
507 | question text had got out of date anyway. Remove this question, ship | ||
508 | ssh-keysign setuid in openssh-client.deb, and set a statoverride if the | ||
509 | debconf question was previously set to false. | ||
510 | * Add lintian overrides for the above (setuid-binary, | ||
511 | no-debconf-templates). | ||
512 | * Fix picky lintian errors about slogin symlinks. | ||
513 | * Fix DEB_HOST_ARCH_OS/DEB_HOST_GNU_SYSTEM compatibility handling. | ||
514 | * Apply Linux 2.2 workaround (see #239999) only on Linux. | ||
515 | |||
516 | -- Colin Watson <cjwatson@debian.org> Thu, 2 Jun 2005 00:55:58 +0100 | ||
517 | |||
518 | openssh (1:4.1p1-1) experimental; urgency=low | ||
519 | |||
520 | * New upstream release. | ||
521 | - Normalise socket addresses returned by get_remote_hostname(), fixing | ||
522 | 4-in-6 mapping issues with AllowUsers et al (closes: #192234). | ||
523 | * Take upstream's hint and disable the unsupported USE_POSIX_THREADS | ||
524 | (closes: #295757, #308868, and possibly others; may open other bugs). | ||
525 | Use PAM password authentication to avoid #278394. In future I may | ||
526 | provide two sets of binaries built with and without this option, since | ||
527 | it seems I can't win. | ||
528 | * Disable ChallengeResponseAuthentication in new installations, returning | ||
529 | to PasswordAuthentication by default, since it now supports PAM and | ||
530 | apparently works better with a non-threaded sshd (closes: #247521). | ||
531 | * openssh-server Suggests: rssh (closes: #233012). | ||
532 | * Change libexecdir to /usr/lib/openssh, and fix up various alternatives | ||
533 | and configuration files to match (closes: #87900, #151321). | ||
534 | * Fix up very old sshd_config files that refer to /usr/libexec/sftp-server | ||
535 | (closes: #141979). | ||
536 | |||
537 | -- Colin Watson <cjwatson@debian.org> Tue, 31 May 2005 01:33:33 +0100 | ||
538 | |||
539 | openssh (1:4.0p1-1) experimental; urgency=low | ||
540 | |||
541 | * New upstream release. | ||
542 | - Port-forwarding specifications now take optional bind addresses, and | ||
543 | the server allows client-specified bind addresses for remote port | ||
544 | forwardings when configured with "GatewayPorts clientspecified" | ||
545 | (closes: #87253, #192206). | ||
546 | - ssh and ssh-keyscan now support hashing of known_hosts files for | ||
547 | improved privacy (CAN-2005-2666). ssh-keygen has new options for | ||
548 | managing known_hosts files, which understand hashing. | ||
549 | - sftp supports command history and editing support using libedit | ||
550 | (closes: #287013). | ||
551 | - Have scp and sftp wait for the spawned ssh to exit before they exit | ||
552 | themselves, allowing ssh to restore terminal modes (closes: #257130). | ||
553 | - Improved the handling of bad data in authorized_keys files, | ||
554 | eliminating fatal errors on corrupt or very large keys; e.g. linefeeds | ||
555 | in keys only produce errors in auth.log now (closes: #220726). | ||
556 | - Add "command mode" to ssh connection multiplexing (closes: #303452). | ||
557 | - Mention $HOME/.hushlogin in sshd(8) FILES section (closes: #163933). | ||
558 | * Make gnome-ssh-askpass stay above other windows (thanks, Liyang HU; | ||
559 | closes: #296487). | ||
560 | * Remove obsolete and unnecessary ssh/forward_warning debconf note. | ||
561 | * Hurd build fixes (although sshd still doesn't work): | ||
562 | - Restore X forwarding fix from #102991, lost somewhere along the way. | ||
563 | - Link with -lcrypt. | ||
564 | - Link with -lpthread rather than -pthread. | ||
565 | - Don't build ssh-askpass-gnome on the Hurd, until GNOME is available to | ||
566 | satisfy build-dependencies. | ||
567 | * Drop workaround for #242462 on amd64; it's been fixed properly upstream. | ||
568 | * Enable HashKnownHosts by default. This only affects new entries; use | ||
569 | 'ssh-keygen -H' to convert an entire known_hosts file to hashed format. | ||
570 | * Note in ssh_config(5) that the SetupTimeOut option is Debian-specific | ||
571 | (closes: #307069). | ||
572 | * debconf template translations: | ||
573 | - Update Czech (thanks, Miroslav Kure; closes: #298744). | ||
574 | - Update Finnish (thanks, Matti Pöllä; closes: #303787). | ||
575 | - Synchronise Spanish with sarge branch (thanks, Javier | ||
576 | Fernández-Sanguino Peña; closes: #298536). | ||
577 | - Add Ukrainian (thanks, Eugeniy Meshcheryakov; closes: #301852). | ||
578 | |||
579 | -- Colin Watson <cjwatson@debian.org> Thu, 26 May 2005 11:23:18 +0100 | ||
580 | |||
581 | openssh (1:3.9p1-3) experimental; urgency=low | ||
582 | |||
583 | * Explain how to run sshd from inittab in README.Debian (closes: #147360). | ||
584 | * Add debian/watch file. | ||
585 | |||
586 | -- Colin Watson <cjwatson@debian.org> Fri, 18 Feb 2005 00:20:16 +0000 | ||
587 | |||
588 | openssh (1:3.9p1-2) experimental; urgency=low | ||
589 | |||
590 | * Remove pam_nologin from /etc/pam.d/ssh, as sshd's built-in support | ||
591 | appears to be sufficient and more useful (closes: #162996). | ||
592 | * Depend on debconf | debconf-2.0. | ||
593 | * Drop LoginGraceTime back to the upstream default of two minutes on new | ||
594 | installs (closes: #289573). | ||
595 | * debconf template translations from Ubuntu bug #1232: | ||
596 | - Update Greek (thanks, Logiotatidis George). | ||
597 | - Update Spanish (thanks, Santiago Erquicia). | ||
598 | |||
599 | -- Colin Watson <cjwatson@debian.org> Sat, 15 Jan 2005 12:37:54 +0000 | ||
600 | |||
601 | openssh (1:3.9p1-1) experimental; urgency=low | ||
602 | |||
603 | * New upstream release. | ||
604 | - PAM password authentication implemented again (closes: #238699, | ||
605 | #242119). | ||
606 | - Implemented the ability to pass selected environment variables between | ||
607 | the client and the server. | ||
608 | - Fix ssh-keyscan breakage when remote server doesn't speak SSH protocol | ||
609 | (closes: #228828). | ||
610 | - Fix res_query detection (closes: #242462). | ||
611 | - 'ssh -c' documentation improved (closes: #265627). | ||
612 | * Pass LANG and LC_* environment variables from the client by default, and | ||
613 | accept them to the server by default in new installs, although not on | ||
614 | upgrade (closes: #264024). | ||
615 | * Build ssh in binary-indep, not binary-arch (thanks, LaMont Jones). | ||
616 | * Expand on openssh-client package description (closes: #273831). | ||
617 | |||
618 | -- Colin Watson <cjwatson@debian.org> Tue, 4 Jan 2005 14:18:31 +0000 | ||
619 | |||
620 | openssh (1:3.8.1p1-14) experimental; urgency=low | ||
621 | |||
622 | * We use DH_COMPAT=2, so build-depend on debhelper (>= 2). | ||
623 | * Fix timing information leak allowing discovery of invalid usernames in | ||
624 | PAM keyboard-interactive authentication (backported from a patch by | ||
625 | Darren Tucker; closes: #281595). | ||
626 | * Make sure that there's a delay in PAM keyboard-interactive | ||
627 | authentication when PermitRootLogin is not set to yes and the correct | ||
628 | root password is entered (closes: #248747). | ||
629 | |||
630 | -- Colin Watson <cjwatson@debian.org> Sun, 28 Nov 2004 18:09:37 +0000 | ||
631 | |||
632 | openssh (1:3.8.1p1-13) experimental; urgency=low | ||
633 | |||
634 | * Enable threading for PAM, on Sam Hartman's advice (closes: #278394). | ||
635 | * debconf template translations: | ||
636 | - Update Dutch (thanks, cobaco; closes: #278715). | ||
637 | * Correct README.Debian's ForwardX11Trusted description (closes: #280190). | ||
638 | |||
639 | -- Colin Watson <cjwatson@debian.org> Fri, 12 Nov 2004 12:03:13 +0000 | ||
640 | |||
641 | openssh (1:3.8.1p1-12) experimental; urgency=low | ||
642 | |||
643 | * Preserve /etc/ssh/sshd_config ownership/permissions (closes: #276754). | ||
644 | * Shorten the version string from the form "OpenSSH_3.8.1p1 Debian | ||
645 | 1:3.8.1p1-8.sarge.1" to "OpenSSH_3.8.1p1 Debian-8.sarge.1", as some SSH | ||
646 | implementations apparently have problems with the long version string. | ||
647 | This is of course a bug in those implementations, but since the extent | ||
648 | of the problem is unknown it's best to play safe (closes: #275731). | ||
649 | * debconf template translations: | ||
650 | - Add Finnish (thanks, Matti Pöllä; closes: #265339). | ||
651 | - Update Danish (thanks, Morten Brix Pedersen; closes: #275895). | ||
652 | - Update French (thanks, Denis Barbier; closes: #276703). | ||
653 | - Update Japanese (thanks, Kenshi Muto; closes: #277438). | ||
654 | |||
655 | -- Colin Watson <cjwatson@debian.org> Sun, 24 Oct 2004 19:21:17 +0100 | ||
656 | |||
657 | openssh (1:3.8.1p1-11) experimental; urgency=high | ||
658 | |||
659 | * Move sshd_config(5) to openssh-server, where it belongs. | ||
660 | * If PasswordAuthentication is disabled, then offer to disable | ||
661 | ChallengeResponseAuthentication too. The current PAM code will attempt | ||
662 | password-style authentication if ChallengeResponseAuthentication is | ||
663 | enabled (closes: #250369). | ||
664 | * This will ask a question of anyone who installed fresh with 1:3.8p1-2 or | ||
665 | later and then upgraded. Sorry about that ... for this reason, the | ||
666 | default answer is to leave ChallengeResponseAuthentication enabled. | ||
667 | |||
668 | -- Colin Watson <cjwatson@debian.org> Wed, 6 Oct 2004 14:28:20 +0100 | ||
669 | |||
670 | openssh (1:3.8.1p1-10) experimental; urgency=low | ||
671 | |||
672 | * Don't install the ssh-askpass-gnome .desktop file by default; I've had | ||
673 | too many GNOME people tell me it's the wrong thing to be doing. I've | ||
674 | left it in /usr/share/doc/ssh-askpass-gnome/examples/ for now. | ||
675 | |||
676 | -- Colin Watson <cjwatson@debian.org> Wed, 25 Aug 2004 18:18:14 +0100 | ||
677 | |||
678 | openssh (1:3.8.1p1-9) experimental; urgency=low | ||
679 | |||
680 | * Split the ssh binary package into openssh-client and openssh-server | ||
681 | (closes: #39741). openssh-server depends on openssh-client for some | ||
682 | common functionality; it didn't seem worth creating yet another package | ||
683 | for this. openssh-client is priority standard, openssh-server optional. | ||
684 | * New transitional ssh package, priority optional, depending on | ||
685 | openssh-client and openssh-server. May be removed once nothing depends | ||
686 | on it. | ||
687 | * When upgrading from ssh to openssh-{client,server}, it's very difficult | ||
688 | for the maintainer scripts to find out what version we're upgrading from | ||
689 | without dodgy dpkg hackery. I've therefore taken the opportunity to move | ||
690 | a couple of debconf notes into NEWS files, namely ssh/ssh2_keys_merged | ||
691 | and ssh/user_environment_tell. | ||
692 | * Add a heuristic to try to make sure the sshd_config upgrade to >= 3.7 | ||
693 | happens even though we don't know what version we're upgrading from. | ||
694 | * Remove /etc/ssh/sshd_not_to_be_run on purge of openssh-server. For now | ||
695 | (until sarge+2) it's still honoured to avoid breaking existing | ||
696 | configurations, but the right approach is now to remove the | ||
697 | openssh-server package if you don't want to run the server. Add a NEWS | ||
698 | item to that effect. | ||
699 | |||
700 | -- Colin Watson <cjwatson@debian.org> Mon, 2 Aug 2004 20:48:54 +0100 | ||
701 | |||
702 | openssh (1:3.8.1p1-8.sarge.4) unstable; urgency=high | ||
703 | |||
704 | * Fix timing information leak allowing discovery of invalid usernames in | ||
705 | PAM keyboard-interactive authentication (backported from a patch by | ||
706 | Darren Tucker; closes: #281595). | ||
707 | * Make sure that there's a delay in PAM keyboard-interactive | ||
708 | authentication when PermitRootLogin is not set to yes and the correct | ||
709 | root password is entered (closes: #248747). | ||
710 | |||
711 | -- Colin Watson <cjwatson@debian.org> Sun, 28 Nov 2004 12:37:16 +0000 | ||
712 | |||
713 | openssh (1:3.8.1p1-8.sarge.3) unstable; urgency=low | ||
714 | |||
715 | * Enable threading for PAM, on Sam Hartman's advice (closes: #278394). | ||
716 | * debconf template translations: | ||
717 | - Update Dutch (thanks, cobaco; closes: #278715). | ||
718 | * Correct README.Debian's ForwardX11Trusted description (closes: #280190). | ||
719 | |||
720 | -- Colin Watson <cjwatson@debian.org> Fri, 12 Nov 2004 10:31:12 +0000 | ||
721 | |||
722 | openssh (1:3.8.1p1-8.sarge.2) unstable; urgency=low | ||
723 | |||
724 | * Preserve /etc/ssh/sshd_config ownership/permissions (closes: #276754). | ||
725 | * Shorten the version string from the form "OpenSSH_3.8.1p1 Debian | ||
726 | 1:3.8.1p1-8.sarge.1" to "OpenSSH_3.8.1p1 Debian-8.sarge.1", as some SSH | ||
727 | implementations apparently have problems with the long version string. | ||
728 | This is of course a bug in those implementations, but since the extent | ||
729 | of the problem is unknown it's best to play safe (closes: #275731). | ||
730 | * debconf template translations: | ||
731 | - Add Finnish (thanks, Matti Pöllä; closes: #265339). | ||
732 | - Update Danish (thanks, Morten Brix Pedersen; closes: #275895). | ||
733 | - Update French (thanks, Denis Barbier; closes: #276703). | ||
734 | - Update Japanese (thanks, Kenshi Muto; closes: #277438). | ||
735 | |||
736 | -- Colin Watson <cjwatson@debian.org> Sun, 24 Oct 2004 17:57:14 +0100 | ||
737 | |||
738 | openssh (1:3.8.1p1-8.sarge.1) unstable; urgency=high | ||
739 | |||
740 | * If PasswordAuthentication is disabled, then offer to disable | ||
741 | ChallengeResponseAuthentication too. The current PAM code will attempt | ||
742 | password-style authentication if ChallengeResponseAuthentication is | ||
743 | enabled (closes: #250369). | ||
744 | * This will ask a question of anyone who installed fresh with 1:3.8p1-2 or | ||
745 | later and then upgraded. Sorry about that ... for this reason, the | ||
746 | default answer is to leave ChallengeResponseAuthentication enabled. | ||
747 | |||
748 | -- Colin Watson <cjwatson@debian.org> Wed, 6 Oct 2004 14:21:55 +0100 | ||
749 | |||
750 | openssh (1:3.8.1p1-8) unstable; urgency=high | ||
751 | |||
752 | * Matthew Vernon: | ||
753 | - Add a GPL exception to the licensing terms of the Debian patch | ||
754 | (closes: #211644). | ||
755 | |||
756 | -- Colin Watson <cjwatson@debian.org> Thu, 29 Jul 2004 13:28:47 +0100 | ||
757 | |||
758 | openssh (1:3.8.1p1-7) unstable; urgency=low | ||
759 | |||
760 | * Re-enable shadow password support in openssh-server-udeb, at Bastian | ||
761 | Blank's request (closes: #260800). | ||
762 | |||
763 | -- Colin Watson <cjwatson@debian.org> Thu, 22 Jul 2004 10:56:06 +0100 | ||
764 | |||
765 | openssh (1:3.8.1p1-6) unstable; urgency=low | ||
766 | |||
767 | * Implement hack in | ||
768 | http://lists.debian.org/debian-boot/2004/07/msg01207.html to get | ||
769 | openssh-client-udeb to show up as a retrievable debian-installer | ||
770 | component. | ||
771 | * Generate host keys in postinst only if the relevant HostKey directives | ||
772 | are found in sshd_config (closes: #87946). | ||
773 | |||
774 | -- Colin Watson <cjwatson@debian.org> Wed, 21 Jul 2004 15:14:46 +0100 | ||
775 | |||
776 | openssh (1:3.8.1p1-5) unstable; urgency=medium | ||
777 | |||
778 | * Update German debconf template translation (thanks, Helge Kreutzmann; | ||
779 | closes: #252226). | ||
780 | * Remove Suggests: dnsutils, as it was only needed for | ||
781 | make-ssh-known-hosts (#93265), which has been replaced by ssh-keyscan. | ||
782 | * Disable shadow password support in openssh-server-udeb. | ||
783 | * Fix non-portable shell constructs in maintainer scripts, Makefile, and | ||
784 | ssh-copy-id (thanks, David Weinehall; closes: #258517). | ||
785 | * Apply patch from Darren Tucker to make the PAM authentication SIGCHLD | ||
786 | handler kill the PAM thread if its waitpid() call returns 0, as well as | ||
787 | the previous check for -1 (closes: #252676). | ||
788 | * Add scp and sftp to openssh-client-udeb. It might not be very 'u' any | ||
789 | more; oh well. | ||
790 | |||
791 | -- Colin Watson <cjwatson@debian.org> Sat, 10 Jul 2004 13:57:27 +0100 | ||
792 | |||
793 | openssh (1:3.8.1p1-4) unstable; urgency=medium | ||
794 | |||
795 | * Kill off PAM thread if privsep slave dies (closes: #248125). | ||
796 | |||
797 | -- Colin Watson <cjwatson@debian.org> Fri, 28 May 2004 17:58:45 -0300 | ||
798 | |||
799 | openssh (1:3.8.1p1-3) unstable; urgency=low | ||
800 | |||
801 | * Add ssh-keygen to openssh-server-udeb. | ||
802 | |||
803 | -- Colin Watson <cjwatson@debian.org> Thu, 20 May 2004 16:31:52 +0100 | ||
804 | |||
805 | openssh (1:3.8.1p1-2) unstable; urgency=low | ||
806 | |||
807 | * Add Catalan debconf template translation (thanks, Aleix Badia i Bosch; | ||
808 | closes: #248748). | ||
809 | * openssh-client-udeb and openssh-server-udeb depend on libnss-files-udeb | ||
810 | (not yet uploaded). | ||
811 | * Restore ssh-askpass-gnome binary, lost by mistake. | ||
812 | * Don't link against libnsl in udeb builds. | ||
813 | |||
814 | -- Colin Watson <cjwatson@debian.org> Thu, 20 May 2004 11:15:58 +0100 | ||
815 | |||
816 | openssh (1:3.8.1p1-1) unstable; urgency=low | ||
817 | |||
818 | * New upstream release. | ||
819 | - Use a longer buffer for tty names in utmp (closes: #247538). | ||
820 | * Make sure there's a newline at the end of sshd_config before adding | ||
821 | 'UsePAM yes' (closes: #244829). | ||
822 | * Generate a new .orig.tar.gz without RFC.nroff, and remove | ||
823 | /usr/share/doc/ssh/RFC.gz (closes: #211640). It isn't DFSG-free and only | ||
824 | documents the obsolete SSH1 protocol, not to mention that it was never a | ||
825 | real RFC but only an Internet-Draft. It's available from | ||
826 | http://www.free.lp.se/bamse/draft-ylonen-ssh-protocol-00.txt if you want | ||
827 | it for some reason. | ||
828 | * Add openssh-client-udeb and openssh-server-udeb binary packages for use | ||
829 | in debian-installer. They still need libnss_files to be supplied in udeb | ||
830 | form by glibc. | ||
831 | * Work around lack of res_query weak alias in libresolv on amd64 (see | ||
832 | #242462, awaiting real fix upstream). | ||
833 | * Fix grammar in sshd(8) (closes: #238753). | ||
834 | * Add .desktop file and icon for ssh-askpass-gnome (closes: #232333). | ||
835 | * Update Polish debconf template translation (thanks, Emil Nowak; | ||
836 | closes: #242808). | ||
837 | * Add Turkish debconf template translation (thanks, Recai Oktaş; | ||
838 | closes: #246068). | ||
839 | |||
840 | -- Colin Watson <cjwatson@debian.org> Tue, 11 May 2004 23:38:10 +0100 | ||
841 | |||
842 | openssh (1:3.8p1-3) unstable; urgency=low | ||
843 | |||
844 | * Remove deprecated ReverseMappingCheck option from newly generated | ||
845 | sshd_config files (closes: #239987). | ||
846 | * Build everything apart from contrib in a subdirectory, to allow for | ||
847 | multiple builds. | ||
848 | * Some older kernels are missing setresuid() and setresgid(), so don't try | ||
849 | to use them. setreuid() and setregid() will do well enough for our | ||
850 | purposes (closes: #239999). | ||
851 | |||
852 | -- Colin Watson <cjwatson@debian.org> Mon, 5 Apr 2004 21:23:43 +0100 | ||
853 | |||
854 | openssh (1:3.8p1-2) unstable; urgency=medium | ||
855 | |||
856 | * Disable PasswordAuthentication for new installations (closes: #236810). | ||
857 | * Turn off the new ForwardX11Trusted by default, returning to the | ||
858 | semantics of 3.7 and earlier, since it seems immature and causes far too | ||
859 | many problems with existing setups. See README.Debian for details | ||
860 | (closes: #237021). | ||
861 | |||
862 | -- Colin Watson <cjwatson@debian.org> Wed, 10 Mar 2004 10:33:07 +0000 | ||
863 | |||
864 | openssh (1:3.8p1-1) unstable; urgency=low | ||
865 | |||
866 | * New upstream release (closes: #232281): | ||
867 | - New PAM implementation based on that in FreeBSD. This runs PAM session | ||
868 | modules before dropping privileges (closes: #132681, #150968). | ||
869 | - Since PAM session modules are run as root, we can turn pam_limits back | ||
870 | on by default, and it no longer spits out "Operation not permitted" to | ||
871 | syslog (closes: #171673). | ||
872 | - Password expiry works again (closes: #153235). | ||
873 | - 'ssh -q' suppresses login banner (closes: #134589). | ||
874 | - sshd doesn't lie to PAM about invalid usernames (closes: #157078). | ||
875 | - ssh-add prints key comment on each prompt (closes: #181869). | ||
876 | - Punctuation formatting fixed in man pages (closes: #191131). | ||
877 | - EnableSSHKeysign documented in ssh_config(5) (closes: #224457). | ||
878 | * Add 'UsePAM yes' to /etc/ssh/sshd_config on upgrade from versions older | ||
879 | than this, to maintain the standard Debian sshd configuration. | ||
880 | * Comment out PAMAuthenticationViaKbdInt and RhostsAuthentication in | ||
881 | sshd_config on upgrade. Neither option is supported any more. | ||
882 | * Privilege separation and PAM are now properly supported together, so | ||
883 | remove both debconf questions related to them and simply set it | ||
884 | unconditionally in newly generated sshd_config files (closes: #228838). | ||
885 | * ServerAliveInterval implemented upstream, so ProtocolKeepAlives is now a | ||
886 | compatibility alias. The semantics differ slightly, though; see | ||
887 | ssh_config(5) for details. | ||
888 | * Implement SSH1 support for ServerAliveInterval using SSH_MSG_IGNORE. As | ||
889 | documented in ssh_config(5), it's not as good as the SSH2 version. | ||
890 | * Remove -fno-builtin-log, -DHAVE_MMAP_ANON_SHARED, and | ||
891 | -D__FILE_OFFSET_BITS=64 compiler options, which are no longer necessary. | ||
892 | * Update config.guess and config.sub from autotools-dev 20040105.1. | ||
893 | * Darren Tucker: | ||
894 | - Reset signal status when starting pam auth thread, prevent hanging | ||
895 | during PAM keyboard-interactive authentications. | ||
896 | - Fix a non-security-critical segfault in PAM authentication. | ||
897 | * Add debconf template translations: | ||
898 | - Greek (thanks, Konstantinos Margaritis; closes: #232843). | ||
899 | - Italian (thanks, Renato Gini; closes: #234777). | ||
900 | |||
901 | -- Colin Watson <cjwatson@debian.org> Sat, 6 Mar 2004 18:43:44 +0000 | ||
902 | |||
903 | openssh (1:3.6.1p2-12) unstable; urgency=low | ||
904 | |||
905 | * Update Spanish debconf template translation (thanks, Javier | ||
906 | Fernández-Sanguino Peña; closes: #228242). | ||
907 | * Add debconf template translations: | ||
908 | - Czech (thanks, Miroslav Kure; closes: #230110). | ||
909 | - Simplified Chinese (thanks, Hiei Xu; closes: #230726). | ||
910 | |||
911 | -- Colin Watson <cjwatson@debian.org> Wed, 11 Feb 2004 09:37:57 +0000 | ||
912 | |||
913 | openssh (1:3.6.1p2-11) unstable; urgency=low | ||
914 | |||
915 | * Comment out pam_limits in default configuration, for now at least | ||
916 | (closes: #198254). | ||
917 | * Use invoke-rc.d (if it exists) to run the init script. | ||
918 | * Backport format string bug fix in sshconnect.c (closes: #225238). | ||
919 | * ssh-copy-id exits if ssh fails (closes: #215252). | ||
920 | |||
921 | -- Colin Watson <cjwatson@debian.org> Sun, 4 Jan 2004 18:59:21 +0000 | ||
922 | |||
923 | openssh (1:3.6.1p2-10) unstable; urgency=low | ||
924 | |||
925 | * Use --retry in init script when restarting rather than sleeping, to make | ||
926 | sure the old process is dead (thanks, Herbert Xu; closes: #212117). | ||
927 | Depend on dpkg (>= 1.9.0) for start-stop-daemon's --retry option. | ||
928 | * Update debconf template translations: | ||
929 | - Brazilian Portuguese (thanks, Andre Luis Lopes; closes: #219844). | ||
930 | - Danish (thanks, Morten Brix Pedersen; closes: #217964). | ||
931 | - Japanese (thanks, Kenshi Muto; closes: #212497). | ||
932 | - Russian (thanks, Ilgiz Kalmetev). | ||
933 | - Spanish (thanks, Carlos Valdivia Yagüe; closes: #211832). | ||
934 | * Add Dutch debconf template translation (thanks, cobaco; | ||
935 | closes: #215372). | ||
936 | * Update config.guess and config.sub from autotools-dev 20031007.1 | ||
937 | (closes: #217696). | ||
938 | * Implement New World Order for PAM configuration, including | ||
939 | /etc/pam.d/common-* from /etc/pam.d/ssh (closes: #212959). | ||
940 | - To backport this release to woody, you need to set DEB_BUILD_SSH_WOODY | ||
941 | in your environment. See README.Debian. | ||
942 | * Add more commentary to /etc/pam.d/ssh. | ||
943 | |||
944 | -- Colin Watson <cjwatson@debian.org> Sun, 16 Nov 2003 01:14:16 +0000 | ||
945 | |||
946 | openssh (1:3.6.1p2-9) unstable; urgency=high | ||
947 | |||
948 | * Merge even more buffer allocation fixes from upstream (CAN-2003-0682; | ||
949 | closes: #211434). | ||
950 | |||
951 | -- Colin Watson <cjwatson@debian.org> Fri, 19 Sep 2003 10:25:25 +0100 | ||
952 | |||
953 | openssh (1:3.6.1p2-8) unstable; urgency=high | ||
954 | |||
955 | * Merge more buffer allocation fixes from new upstream version 3.7.1p1 | ||
956 | (closes: #211324). | ||
957 | |||
958 | -- Colin Watson <cjwatson@debian.org> Wed, 17 Sep 2003 03:07:19 +0100 | ||
959 | |||
960 | openssh (1:3.6.1p2-7) unstable; urgency=high | ||
961 | |||
962 | * Update debconf template translations: | ||
963 | - French (thanks, Christian Perrier; closes: #208801). | ||
964 | - Japanese (thanks, Kenshi Muto; closes: #210380). | ||
965 | * Some small improvements to the English templates courtesy of Christian | ||
966 | Perrier. I've manually unfuzzied a few translations where it was | ||
967 | obvious, on Christian's advice, but the others will have to be updated. | ||
968 | * Document how to generate an RSA1 host key (closes: #141703). | ||
969 | * Incorporate NMU fix for early buffer expansion vulnerability, | ||
970 | CAN-2003-0693 (closes: #211205). Thanks to Michael Stone. | ||
971 | |||
972 | -- Colin Watson <cjwatson@debian.org> Tue, 16 Sep 2003 14:32:28 +0100 | ||
973 | |||
974 | openssh (1:3.6.1p2-6.0) unstable; urgency=high | ||
975 | |||
976 | * SECURITY: fix for CAN-2003-0693, buffer allocation error | ||
977 | |||
978 | -- Michael Stone <mstone@debian.org> Tue, 16 Sep 2003 08:27:07 -0400 | ||
979 | |||
980 | openssh (1:3.6.1p2-6) unstable; urgency=medium | ||
981 | |||
982 | * Use a more CVS-friendly means of setting SSH_VERSION. | ||
983 | * Update Brazilian Portuguese debconf template translation (thanks, Andre | ||
984 | Luis Lopes; closes: #208036). | ||
985 | * Don't run 'sshd -t' in init script if the server isn't to be run | ||
986 | (closes: #197576). | ||
987 | * Fix login delay, spurious auth.log entry, and PermitRootLogin | ||
988 | information leakage due to PAM issues with upstream's recent security | ||
989 | update (thanks, Darren Tucker; closes: #99168, #192207, #193546). | ||
990 | * Policy version 3.6.1: recode this changelog to UTF-8. | ||
991 | |||
992 | -- Colin Watson <cjwatson@debian.org> Wed, 3 Sep 2003 19:14:02 +0100 | ||
993 | |||
994 | openssh (1:3.6.1p2-5) unstable; urgency=low | ||
995 | |||
996 | * Disable cmsg_type check for file descriptor passing when running on | ||
997 | Linux 2.0 (closes: #150976). Remove comments about non-functional | ||
998 | privilege separation on 2.0 from ssh/privsep_ask and ssh/privsep_tell | ||
999 | debconf questions and from README.Debian, since it should all now work. | ||
1000 | * Fix "defails" typo in generated sshd_config (closes: #206484). | ||
1001 | * Backport upstream patch to strip trailing whitespace (including | ||
1002 | newlines) from configuration directives (closes: #192079). | ||
1003 | |||
1004 | -- Colin Watson <cjwatson@debian.org> Wed, 27 Aug 2003 02:19:57 +0100 | ||
1005 | |||
1006 | openssh (1:3.6.1p2-4) unstable; urgency=low | ||
1007 | |||
1008 | * getent can get just one key; no need to use grep (thanks, James Troup). | ||
1009 | * Move /usr/local/bin to the front of the default path, following | ||
1010 | /etc/login.defs (closes: #201150). | ||
1011 | * Remove specifics of problematic countries from package description | ||
1012 | (closes: #197040). | ||
1013 | * Update Spanish debconf template translation (thanks, Carlos Valdivia | ||
1014 | Yagüe; closes: #198456). | ||
1015 | * Backport upstream patch to pass monitor signals through to child | ||
1016 | (closes: #164797). | ||
1017 | |||
1018 | -- Colin Watson <cjwatson@debian.org> Sun, 27 Jul 2003 17:31:15 +0100 | ||
1019 | |||
1020 | openssh (1:3.6.1p2-3) unstable; urgency=low | ||
1021 | |||
1022 | * Update French debconf template translation (thanks, Christian Perrier; | ||
1023 | closes: #194323). | ||
1024 | * Version the adduser dependency for --no-create-home (closes: #195756). | ||
1025 | * Add a version of moduli(5), namely revision 1.7 of | ||
1026 | http://www.openbsd.org/cgi-bin/cvsweb/src/share/man/man5/moduli.5 with | ||
1027 | '/etc/moduli' changed to '/etc/ssh/moduli' throughout (closes: #196061). | ||
1028 | |||
1029 | -- Colin Watson <cjwatson@debian.org> Mon, 9 Jun 2003 02:51:35 +0100 | ||
1030 | |||
1031 | openssh (1:3.6.1p2-2) unstable; urgency=low | ||
1032 | |||
1033 | * Force /etc/default/ssh to be non-executable, since dpkg apparently | ||
1034 | doesn't deal with permissions changes on conffiles (closes: #192966). | ||
1035 | * Use debconf 0.5's seen flag rather than the deprecated isdefault. | ||
1036 | * Add GPL location to copyright file. | ||
1037 | * Remove debian/postinst.old. | ||
1038 | * Switch to po-debconf, with some careful manual use of po2debconf to | ||
1039 | ensure that the source package continues to build smoothly on woody | ||
1040 | (closes: #183986). | ||
1041 | * Update debconf template translations: | ||
1042 | - Brazilian Portugese (thanks, Andre Luis Lopes; see #183986). | ||
1043 | - Japanese (thanks, Tomohiro KUBOTA; closes: #192429). | ||
1044 | * Compile with -fno-builtin-log for now, otherwise gcc-3.3 complains | ||
1045 | "log.h:59: warning: conflicting types for built-in function `log'". The | ||
1046 | OpenSSH log() function has been renamed in upstream CVS. | ||
1047 | |||
1048 | -- Colin Watson <cjwatson@debian.org> Mon, 19 May 2003 01:52:38 +0100 | ||
1049 | |||
1050 | openssh (1:3.6.1p2-1) unstable; urgency=medium | ||
1051 | |||
1052 | * New upstream release, including fix for PAM user-discovery security hole | ||
1053 | (closes: #191681). | ||
1054 | * Fix ChallengeResponseAuthentication default in generated sshd_config | ||
1055 | (closes: #106037). | ||
1056 | * Put newlines after full stops in man page documentation for | ||
1057 | ProtocolKeepAlives and SetupTimeOut. | ||
1058 | * Policy version 3.5.9: support DEB_BUILD_OPTIONS=noopt, build | ||
1059 | gnome-ssh-askpass with -g and -Wall flags. | ||
1060 | * Really ask ssh/new_config debconf question before trying to fetch its | ||
1061 | value (closes: #188721). | ||
1062 | * On purge, remove only the files we know about in /etc/ssh rather than | ||
1063 | the whole thing, and remove the directory if that leaves it empty | ||
1064 | (closes: #176679). | ||
1065 | * ssh has depended on debconf for some time now with no complaints, so: | ||
1066 | - Simplify the postinst by relying on debconf being present. (The absent | ||
1067 | case was buggy anyway.) | ||
1068 | - Get rid of "if you have not installed debconf" text in README.Debian, | ||
1069 | and generally update the "/usr/bin/ssh not SUID" entry. | ||
1070 | * More README.Debian work: | ||
1071 | - Reorganize into "UPGRADE ISSUES" and "OTHER ISSUES", in an effort to | ||
1072 | make it easier for people to find the former. The upgrade issues | ||
1073 | should probably be sorted by version somehow. | ||
1074 | - Document X11UseLocalhost under "X11 Forwarding" (closes: #150913). | ||
1075 | * Fix setting of IP flags for interactive sessions (upstream bug #541). | ||
1076 | |||
1077 | -- Colin Watson <cjwatson@debian.org> Mon, 5 May 2003 17:47:40 +0100 | ||
1078 | |||
1079 | openssh (1:3.6.1p1-1) unstable; urgency=low | ||
1080 | |||
1081 | * New upstream release (thanks, Laurence J. Lane). | ||
1082 | * debian/control: ssh-askpass-gnome is now Section: gnome, following the | ||
1083 | override file. | ||
1084 | |||
1085 | -- Colin Watson <cjwatson@debian.org> Wed, 2 Apr 2003 00:51:02 +0100 | ||
1086 | |||
1087 | openssh (1:3.6p1-1) unstable; urgency=low | ||
1088 | |||
1089 | * New upstream release. | ||
1090 | - Workaround applied upstream for a bug in the interaction of glibc's | ||
1091 | getaddrinfo() with the Linux 2.2 kernel (closes: #155814). | ||
1092 | - As such, it should now be safe to remove --with-ipv4-default, so | ||
1093 | starting sshd with -6 is no longer necessary (closes: #79861 and lots | ||
1094 | of other merged bugs). | ||
1095 | - ssh-copy-id prints usage when run without arguments (closes: #71376). | ||
1096 | - scp exits 1 if ssh fails (closes: #138400). | ||
1097 | - sshd writes to utmp's ut_addr_v6 field in IPv6 mode (closes: #167867). | ||
1098 | - 'ssh-add -c' causes ssh-agent to ask the user each time a key is used | ||
1099 | (closes: #109795). | ||
1100 | * Install /etc/default/ssh non-executable (closes: #185537). | ||
1101 | |||
1102 | -- Colin Watson <cjwatson@debian.org> Mon, 31 Mar 2003 23:00:59 +0100 | ||
1103 | |||
1104 | openssh (1:3.5p1-5) unstable; urgency=low | ||
1105 | |||
1106 | * Add /etc/default/ssh (closes: #161049). | ||
1107 | * Run the init script under 'set -e' (closes: #175010). | ||
1108 | * Change the default superuser path to include /sbin, /usr/sbin, and | ||
1109 | /usr/local/sbin (closes: #128235, #151267). Using login.defs would be | ||
1110 | nice, but that belongs to another package. Without a defined API to | ||
1111 | retrieve its settings, parsing it is off-limits. | ||
1112 | * Build ssh-askpass-gnome with GNOME 2. The source package should still | ||
1113 | support building on stable with GNOME 1, using the alternate | ||
1114 | libgnome-dev build-dependency (thanks, Colin Walters; closes: #167582). | ||
1115 | |||
1116 | -- Colin Watson <cjwatson@debian.org> Sun, 9 Mar 2003 20:12:10 +0000 | ||
1117 | |||
1118 | openssh (1:3.5p1-4) unstable; urgency=low | ||
1119 | |||
1120 | * Point rlogin and rcp alternatives at slogin and scp respectively rather | ||
1121 | than ssh (closes: #121103, #151666). Fix alternative removal to match; | ||
1122 | previously it was completely wrong anyway. | ||
1123 | * Find out whether /etc/ssh/sshd_not_to_be_run exists and set the debconf | ||
1124 | question's default using that information, rather than using debconf as | ||
1125 | a registry. Other solutions may be better in the long run, but this is | ||
1126 | at least correct (thanks, Matthew Woodcraft; closes: #84725). | ||
1127 | * Stop using pam_lastlog, as it doesn't currently work well as a session | ||
1128 | module when privilege separation is enabled; it can usually read | ||
1129 | /var/log/lastlog but can't write to it. Instead, just use sshd's | ||
1130 | built-in support, already enabled by default (closes: #151297, #169938). | ||
1131 | * Use 'ssh-keygen -q' rather than redirecting output to /dev/null. | ||
1132 | * Add a "this may take some time" warning when creating host keys on | ||
1133 | installation (part of #110094). | ||
1134 | * When restarting via the init script, check for sshd_not_to_be_run after | ||
1135 | stopping sshd (idea from Tomas Pospisek; closes: #149850). | ||
1136 | * Append /usr/sbin:/sbin to the init script's $PATH, just in case of | ||
1137 | strangeness (closes: #115138). | ||
1138 | * Fix a dpkg-statoverride call to redirect stdout to /dev/null, not | ||
1139 | stderr. | ||
1140 | * Correct copyright file typo: "orignal" -> "original" (closes: #176490). | ||
1141 | * Rebuild with libssl0.9.7 (closes: #176983). | ||
1142 | * We're up to policy version 3.5.6. DEB_BUILD_OPTIONS stuff still needs to | ||
1143 | be looked at. | ||
1144 | |||
1145 | -- Colin Watson <cjwatson@debian.org> Sat, 18 Jan 2003 01:37:23 +0000 | ||
1146 | |||
1147 | openssh (1:3.5p1-3) unstable; urgency=low | ||
1148 | |||
1149 | * Happy new year! | ||
1150 | * Use getent rather than id to find out whether the sshd user exists | ||
1151 | (closes: #150974). | ||
1152 | * Remove some duplication from the postinst's ssh-keysign setuid code. | ||
1153 | * Replace db_text with db_input throughout debian/config. (db_text has | ||
1154 | been a compatibility wrapper since debconf 0.1.5.) | ||
1155 | * Warn about PermitUserEnvironment on upgrade (closes: #167895). | ||
1156 | * Use 'make install-nokeys', and disable unused debhelper commands, | ||
1157 | thereby forward-porting the last pieces of Zack Weinberg's patch | ||
1158 | (closes: #68341). | ||
1159 | * Move the man page for gnome-ssh-askpass from the ssh package to | ||
1160 | ssh-askpass-gnome (closes: #174449). | ||
1161 | * Build with -DLOGIN_NO_ENDOPT, since Debian's /bin/login doesn't accept | ||
1162 | '--' to terminate the list of options (closes: #171554). | ||
1163 | * Add Jonathan Amery's ssh-argv0 script (closes: #111341). | ||
1164 | * Update Danish debconf template (thanks, Morten Brix Pedersen; | ||
1165 | closes: #174757). | ||
1166 | * Document setgid ssh-agent's effect on certain environment variables in | ||
1167 | README.Debian (closes: #167974). | ||
1168 | * Document interoperability problems between scp and ssh.com's server in | ||
1169 | README.Debian, and suggest some workarounds (closes: #174662). | ||
1170 | |||
1171 | -- Colin Watson <cjwatson@debian.org> Wed, 1 Jan 2003 14:18:30 +0000 | ||
1172 | |||
1173 | openssh (1:3.5p1-2) unstable; urgency=low | ||
1174 | |||
1175 | * Mention in the ssh package description that it provides both ssh and | ||
1176 | sshd (closes: #99680). | ||
1177 | * Create a system group for ssh-agent, not a user group (closes: #167669). | ||
1178 | |||
1179 | -- Colin Watson <cjwatson@debian.org> Mon, 4 Nov 2002 13:43:53 +0000 | ||
1180 | |||
1181 | openssh (1:3.5p1-1) unstable; urgency=low | ||
1182 | |||
1183 | * New upstream release. | ||
1184 | - Fixes typo in ssh-add usage (closes: #152239). | ||
1185 | - Fixes 'PermitRootLogin forced-commands-only' (closes: #166184). | ||
1186 | - ~/.ssh/environment and environment= options in ~/.ssh/authorized_keys | ||
1187 | are deprecated for security reasons and will eventually go away. For | ||
1188 | now they can be re-enabled by setting 'PermitUserEnvironment yes' in | ||
1189 | sshd_config. | ||
1190 | - ssh-agent is installed setgid to prevent ptrace() attacks. The group | ||
1191 | actually doesn't matter, as it drops privileges immediately, but to | ||
1192 | avoid confusion the postinst creates a new 'ssh' group for it. | ||
1193 | * Obsolete patches: | ||
1194 | - Solar Designer's privsep+compression patch for Linux 2.2 (see | ||
1195 | 1:3.3p1-0.0woody1). | ||
1196 | - Hostbased auth ssh-keysign backport (see 1:3.4p1-4). | ||
1197 | |||
1198 | * Remove duplicated phrase in ssh_config(5) (closes: #152404). | ||
1199 | * Source the debconf confmodule at the top of the postrm rather than at | ||
1200 | the bottom, to avoid making future non-idempotency problems worse (see | ||
1201 | #151035). | ||
1202 | * Debconf templates: | ||
1203 | - Add Polish (thanks, Grzegorz Kusnierz). | ||
1204 | - Update French (thanks, Denis Barbier; closes: #132509). | ||
1205 | - Update Spanish (thanks, Carlos Valdivia Yagüe; closes: #164716). | ||
1206 | * Write a man page for gnome-ssh-askpass, and link it to ssh-askpass.1 if | ||
1207 | this is the selected ssh-askpass alternative (closes: #67775). | ||
1208 | |||
1209 | -- Colin Watson <cjwatson@debian.org> Sat, 26 Oct 2002 19:41:51 +0100 | ||
1210 | |||
1211 | openssh (1:3.4p1-4) unstable; urgency=low | ||
1212 | |||
1213 | * Allow ssh-krb5 in ssh-askpass-gnome's dependencies (closes: #129532). | ||
1214 | * Restore Russia to list of countries where encryption is problematic (see | ||
1215 | #148951 and http://www.average.org/freecrypto/). | ||
1216 | * Drop ssh-askpass-gnome's priority to optional, per the override file. | ||
1217 | * Drop the PAM special case for hurd-i386 (closes: #99157). | ||
1218 | * s/dile/idle/ in ssh_config(5) (closes: #118331). | ||
1219 | * Note in README.Debian that you need xauth from xbase-clients on the | ||
1220 | server for X11 forwarding (closes: #140269). | ||
1221 | * Use correct path to upstream README in copyright file (closes: #146037). | ||
1222 | * Document the units for ProtocolKeepAlives (closes: #159479). | ||
1223 | * Backport upstream patch to fix hostbased auth (closes: #117114). | ||
1224 | * Add -g to CFLAGS. | ||
1225 | |||
1226 | -- Colin Watson <cjwatson@debian.org> Sun, 13 Oct 2002 18:58:53 +0100 | ||
1227 | |||
1228 | openssh (1:3.4p1-3) unstable; urgency=low | ||
1229 | |||
1230 | * Add myself to Uploaders: and begin acting as temporary maintainer, at | ||
1231 | Matthew's request. (Normal service will resume in some months' time.) | ||
1232 | * Add sharutils to Build-Depends (closes: #138465). | ||
1233 | * Stop creating the /usr/doc/ssh symlink. | ||
1234 | |||
1235 | * Fix some debconf template typos (closes: #160358). | ||
1236 | * Split debconf templates into one file per language. | ||
1237 | * Add debconf template translations: | ||
1238 | - Brazilian Portuguese (thanks, Andre Luis Lopes; closes: #106173). | ||
1239 | - Danish (thanks, Claus Hindsgaul; closes: #126607). | ||
1240 | - Japanese (thanks, Tomohiro KUBOTA; closes: #137427). | ||
1241 | - Russian (thanks, Ilgiz Kalmetev; closes: #136610). | ||
1242 | - Spanish (thanks, Carlos Valdivia Yagüe; closes: #129041). | ||
1243 | * Update debconf template translations: | ||
1244 | - French (thanks, Igor Genibel; closes: #151361). | ||
1245 | - German (thanks, Axel Noetzold; closes: #147069). | ||
1246 | * Some of these translations are fuzzy. Please send updates. | ||
1247 | |||
1248 | -- Colin Watson <cjwatson@debian.org> Sun, 13 Oct 2002 14:09:57 +0100 | ||
1249 | |||
1250 | openssh (1:3.4p1-2) unstable; urgency=high | ||
1251 | |||
1252 | * Get a security-fixed version into unstable | ||
1253 | * Also tidy README.Debian up a little | ||
1254 | |||
1255 | -- Matthew Vernon <matthew@debian.org> Fri, 28 Jun 2002 17:20:59 +0100 | ||
1256 | |||
1257 | openssh (1:3.4p1-1) testing; urgency=high | ||
1258 | |||
1259 | * Extend my tendrils back into this package (Closes: #150915, #151098) | ||
1260 | * thanks to the security team for their work | ||
1261 | * no thanks to ISS/Theo de Raadt for their handling of these bugs | ||
1262 | * save old sshd_configs to sshd_config.dpkg-old when auto-generating a | ||
1263 | new one | ||
1264 | * tell/ask the user about PriviledgeSeparation | ||
1265 | * /etc/init.d/ssh run will now create the chroot empty dir if necessary | ||
1266 | * Remove our previous statoverride on /usr/bin/ssh (only for people | ||
1267 | upgrading from a version where we'd put one in ourselves!) | ||
1268 | * Stop slandering Russia, since someone asked so nicely (Closes: #148951) | ||
1269 | * Reduce the sleep time in /etc/init.d/ssh during a restart | ||
1270 | |||
1271 | -- Matthew Vernon <matthew@debian.org> Fri, 28 Jun 2002 15:52:10 +0100 | ||
1272 | |||
1273 | openssh (1:3.4p1-0.0woody1) testing-security; urgency=high | ||
1274 | |||
1275 | * NMU by the security team. | ||
1276 | * New upstream version | ||
1277 | |||
1278 | -- Michael Stone <mstone@debian.org> Wed, 26 Jun 2002 15:40:38 -0400 | ||
1279 | |||
1280 | openssh (1:3.3p1-0.0woody4) testing-security; urgency=high | ||
1281 | |||
1282 | * NMU by the security team. | ||
1283 | * fix error when /etc/ssh/sshd_config exists on new install | ||
1284 | * check that user doesn't exist before running adduser | ||
1285 | * use openssl internal random unconditionally | ||
1286 | |||
1287 | -- Michael Stone <mstone@debian.org> Tue, 25 Jun 2002 19:44:39 -0400 | ||
1288 | |||
1289 | openssh (1:3.3p1-0.0woody3) testing-security; urgency=high | ||
1290 | |||
1291 | * NMU by the security team. | ||
1292 | * use correct home directory when sshd user is created | ||
1293 | |||
1294 | -- Michael Stone <mstone@debian.org> Tue, 25 Jun 2002 08:59:50 -0400 | ||
1295 | |||
1296 | openssh (1:3.3p1-0.0woody2) testing-security; urgency=high | ||
1297 | |||
1298 | * NMU by the security team. | ||
1299 | * Fix rsa1 key creation (Closes: #150949) | ||
1300 | * don't fail if sshd user removal fails | ||
1301 | * depends: on adduser (Closes: #150907) | ||
1302 | |||
1303 | -- Michael Stone <mstone@debian.org> Tue, 25 Jun 2002 08:59:50 -0400 | ||
1304 | |||
1305 | openssh (1:3.3p1-0.0woody1) testing-security; urgency=high | ||
1306 | |||
1307 | * NMU by the security team. | ||
1308 | * New upstream version. | ||
1309 | - Enable privilege separation by default. | ||
1310 | * Include patch from Solar Designer for privilege separation and | ||
1311 | compression on 2.2.x kernels. | ||
1312 | * Remove --disable-suid-ssh from configure. | ||
1313 | * Support setuid ssh-keysign binary instead of setuid ssh client. | ||
1314 | * Check sshd configuration before restarting. | ||
1315 | |||
1316 | -- Daniel Jacobowitz <dan@debian.org> Mon, 24 Jun 2002 13:43:44 -0400 | ||
1317 | |||
1318 | openssh (1:3.0.2p1-9) unstable; urgency=high | ||
1319 | |||
1320 | * Thanks to those who NMUd | ||
1321 | * The only change in this version is to debian/control - I've removed | ||
1322 | the bit that says you can't export it from the US - it would look | ||
1323 | pretty daft to say this about a package in main! Also, it's now OK | ||
1324 | to use crypto in France, so I've edited that comment slightly | ||
1325 | * Correct a path in README.Debian too (Closes: #138634) | ||
1326 | |||
1327 | -- Matthew Vernon <matthew@debian.org> Sun, 4 Apr 2002 09:52:59 +0100 | ||
1328 | |||
1329 | openssh (1:3.0.2p1-8.3) unstable; urgency=medium | ||
1330 | |||
1331 | * NMU | ||
1332 | * Really set urgency to medium this time (oops) | ||
1333 | * Fix priority to standard per override while I'm at it | ||
1334 | |||
1335 | -- Aaron M. Ucko <ucko@debian.org> Sun, 24 Mar 2002 09:00:08 -0500 | ||
1336 | |||
1337 | openssh (1:3.0.2p1-8.2) unstable; urgency=low | ||
1338 | |||
1339 | * NMU with maintainer's permission | ||
1340 | * Prepare for upcoming ssh-nonfree transitional packages per | ||
1341 | <http://lists.debian.org/debian-ssh/2002/debian-ssh-200203/msg00008.html> | ||
1342 | * Urgency medium because it would really be good to get this into woody | ||
1343 | before it releases | ||
1344 | * Fix sections to match override file | ||
1345 | * Reissued due to clash with non-US -> main move | ||
1346 | |||
1347 | -- Aaron M. Ucko <ucko@debian.org> Sat, 23 Mar 2002 21:21:52 -0500 | ||
1348 | |||
1349 | openssh (1:3.0.2p1-8.1) unstable; urgency=low | ||
1350 | |||
1351 | * NMU | ||
1352 | * Move from non-US to mani | ||
1353 | |||
1354 | -- LaMont Jones <lamont@debian.org> Thu, 21 Mar 2002 09:33:50 -0700 | ||
1355 | |||
1356 | openssh (1:3.0.2p1-8) unstable; urgency=critical | ||
1357 | |||
1358 | * Security fix - patch from upstream (Closes: #137209, #137210) | ||
1359 | * Undo the changes in the unreleased -7, since they appear to break | ||
1360 | things here. Accordingly, the code change is minimal, and I'm | ||
1361 | happy to get it into testing ASAP | ||
1362 | |||
1363 | -- Matthew Vernon <matthew@debian.org> Thu, 7 Mar 2002 14:25:23 +0000 | ||
1364 | |||
1365 | openssh (1:3.0.2p1-7) unstable; urgency=high | ||
1366 | |||
1367 | * Build to support IPv6 and IPv4 by default again | ||
1368 | |||
1369 | -- Matthew Vernon <matthew@debian.org> Sat, 2 Mar 2002 00:25:05 +0000 | ||
1370 | |||
1371 | openssh (1:3.0.2p1-6) unstable; urgency=high | ||
1372 | |||
1373 | * Correct error in the clean target (Closes: #130868) | ||
1374 | |||
1375 | -- Matthew Vernon <matthew@debian.org> Sat, 26 Jan 2002 00:32:00 +0000 | ||
1376 | |||
1377 | openssh (1:3.0.2p1-5) unstable; urgency=medium | ||
1378 | |||
1379 | * Include the Debian version in our identification, to make it easier to | ||
1380 | audit networks for patched versions in future | ||
1381 | |||
1382 | -- Matthew Vernon <matthew@debian.org> Mon, 21 Jan 2002 17:16:10 +0000 | ||
1383 | |||
1384 | openssh (1:3.0.2p1-4) unstable; urgency=medium | ||
1385 | |||
1386 | * If we're asked to not run sshd, stop any running sshd's first | ||
1387 | (Closes: #129327) | ||
1388 | |||
1389 | -- Matthew Vernon <matthew@debian.org> Wed, 16 Jan 2002 21:24:16 +0000 | ||
1390 | |||
1391 | openssh (1:3.0.2p1-3) unstable; urgency=high | ||
1392 | |||
1393 | * Fix /etc/pam.d/ssh to not set $MAIL (Closes: #128913) | ||
1394 | * Remove extra debconf suggestion (Closes: #128094) | ||
1395 | * Mmm. speedy bug-fixing :-) | ||
1396 | |||
1397 | -- Matthew Vernon <matthew@debian.org> Sat, 12 Jan 2002 17:23:58 +0000 | ||
1398 | |||
1399 | openssh (1:3.0.2p1-2) unstable; urgency=high | ||
1400 | |||
1401 | * Fix postinst to not automatically overwrite sshd_config (!) | ||
1402 | (Closes: #127842, #127867) | ||
1403 | * Add section in README.Debian about the PermitRootLogin setting | ||
1404 | |||
1405 | -- Matthew Vernon <matthew@debian.org> Sat, 5 Jan 2003 05:26:30 +0000 | ||
1406 | |||
1407 | openssh (1:3.0.2p1-1) unstable; urgency=high | ||
1408 | |||
1409 | * Incorporate fix from Colin's NMU | ||
1410 | * New upstream version (fixes the bug Wichert fixed) (Closes: #124035) | ||
1411 | * Capitalise IETF (Closes: #125379) | ||
1412 | * Refer to the correct sftp-server location (Closes: #126854, #126224) | ||
1413 | * Do what we're asked re SetUID ssh (Closes: #124065, #124154, #123247) | ||
1414 | * Ask people upgrading from potato if they want a new conffile | ||
1415 | (Closes: #125642) | ||
1416 | * Fix a typo in postinst (Closes: #122192, #122410, #123440) | ||
1417 | * Frob the default config a little (Closes: #122284, #125827, #125696, | ||
1418 | #123854) | ||
1419 | * Make /etc/init.d/ssh be more clear about ssh not running (Closes: | ||
1420 | #123552) | ||
1421 | * Fix typo in templates file (Closes: #123411) | ||
1422 | |||
1423 | -- Matthew Vernon <matthew@debian.org> Fri, 4 Jan 2002 16:01:52 +0000 | ||
1424 | |||
1425 | openssh (1:3.0.1p1-1.2) unstable; urgency=high | ||
1426 | |||
1427 | * Non-maintainer upload | ||
1428 | * Prevent local users from passing environment variables to the login | ||
1429 | process when UseLogin is enabled | ||
1430 | |||
1431 | -- Wichert Akkerman <wakkerma@debian.org> Mon, 3 Dec 2001 19:34:45 +0100 | ||
1432 | |||
1433 | openssh (1:3.0.1p1-1.1) unstable; urgency=low | ||
1434 | |||
1435 | * Non-maintainer upload, at Matthew's request. | ||
1436 | * Remove sa_restorer assignment to fix compilation on alpha, hppa, and | ||
1437 | ia64 (closes: #122086). | ||
1438 | |||
1439 | -- Colin Watson <cjwatson@debian.org> Sun, 2 Dec 2001 18:54:16 +0000 | ||
1440 | |||
1441 | openssh (1:3.0.1p1-1) unstable; urgency=high | ||
1442 | |||
1443 | * New upstream version (Closes: #113646, #113513, #114707, #118564) | ||
1444 | * Building with a libc that works (!) (Closes: #115228) | ||
1445 | * Patches forward-ported are -1/-2 options for scp, the improvement to | ||
1446 | 'waiting for forwarded connections to terminate...' | ||
1447 | * Fix /etc/init.d/ssh to stop sshd properly (Closes: #115228) | ||
1448 | * /etc/ssh/sshd_config is no longer a conffile but generated in the postinst | ||
1449 | * Remove suidregister leftover from postrm | ||
1450 | * Mention key we are making in the postinst | ||
1451 | * Default to not enable SSH protocol 1 support, since protocol 2 is | ||
1452 | much safer anyway. | ||
1453 | * New version of the vpn-fixes patch, from Ian Jackson | ||
1454 | * New handling of -q, and added new -qq option; thanks to Jon Amery | ||
1455 | * Experimental smartcard support not enabled, since I have no way of | ||
1456 | testing it. | ||
1457 | |||
1458 | -- Matthew Vernon <matthew@debian.org> Thu, 28 Nov 2001 17:43:01 +0000 | ||
1459 | |||
1460 | openssh (1:2.9p2-6) unstable; urgency=low | ||
1461 | |||
1462 | * check for correct file in /etc/init.d/ssh (Closes: #110876) | ||
1463 | * correct location of version 2 keys in ssh.1 (Closes: #110439) | ||
1464 | * call update-alternatives --quiet (Closes: #103314) | ||
1465 | * hack ssh-copy-id to chmod go-w (Closes: #95551) | ||
1466 | * TEMPORARY fix to provide largefile support using a -D in the cflags | ||
1467 | line. long-term, upstream will patch the autoconf stuff | ||
1468 | (Closes: #106809, #111849) | ||
1469 | * remove /etc/rc references in ssh-keygen.1 (Closes: #68350) | ||
1470 | * scp.1 patch from Adam McKenna to document -r properly (Closes: #76054) | ||
1471 | * Check for files containing a newline character (Closes: #111692) | ||
1472 | |||
1473 | -- Matthew Vernon <matthew@debian.org> Thu, 13 Sep 2001 16:47:36 +0100 | ||
1474 | |||
1475 | openssh (1:2.9p2-5) unstable; urgency=high | ||
1476 | |||
1477 | * Thanks to all the bug-fixers who helped! | ||
1478 | * remove sa_restorer assignment (Closes: #102837) | ||
1479 | * patch from Peter Benie to DTRT wrt X forwarding if the server refuses | ||
1480 | us access (Closes: #48297) | ||
1481 | * patch from upstream CVS to fix port forwarding (Closes: #107132) | ||
1482 | * patch from Jonathan Amery to document ssh-keygen behaviour | ||
1483 | (Closes:#106643, #107512) | ||
1484 | * patch to postinst from Jonathan Amery (Closes: #106411) | ||
1485 | * patch to manpage from Jonathan Amery (Closes: #107364) | ||
1486 | * patch from Matthew Vernon to make -q emit fatal errors as that is the | ||
1487 | documented behaviour (Closes: #64347) | ||
1488 | * patch from Ian Jackson to cause us to destroy a file when we scp it | ||
1489 | onto itself, rather than dumping bits of our memory into it, which was | ||
1490 | a security hole (see #51955) | ||
1491 | * patch from Jonathan Amery to document lack of Kerberos support | ||
1492 | (Closes: #103726) | ||
1493 | * patch from Matthew Vernon to make the 'waiting for connections to | ||
1494 | terminate' message more helpful (Closes: #50308) | ||
1495 | |||
1496 | -- Matthew Vernon <matthew@debian.org> Thu, 23 Aug 2001 02:14:09 +0100 | ||
1497 | |||
1498 | openssh (1:2.9p2-4) unstable; urgency=high | ||
1499 | |||
1500 | * Today's build of ssh is strawberry flavoured | ||
1501 | * Patch from mhp to reduce length of time sshd is stopped for (Closes: #106176) | ||
1502 | * Tidy up debconf template (Closes: #106152) | ||
1503 | * If called non-setuid, then setgid()'s failure should not be fatal (see | ||
1504 | #105854) | ||
1505 | |||
1506 | -- Matthew Vernon <matthew@debian.org> Sun, 22 Jul 2001 14:19:43 +0100 | ||
1507 | |||
1508 | openssh (1:2.9p2-3) unstable; urgency=low | ||
1509 | |||
1510 | * Patch from yours truly to add -1 and -2 options to scp (Closes: #106061) | ||
1511 | * Improve the IdentityFile section in the man page (Closes: #106038) | ||
1512 | |||
1513 | -- Matthew Vernon <matthew@debian.org> Sat, 21 Jul 2001 14:47:27 +0100 | ||
1514 | |||
1515 | openssh (1:2.9p2-2) unstable; urgency=low | ||
1516 | |||
1517 | * Document the protocol version 2 and IPV6 changes (Closes: #105845, #105868) | ||
1518 | * Make PrintLastLog 'no' by default (Closes: #105893) | ||
1519 | |||
1520 | -- Matthew Vernon <matthew@debian.org> Thu, 19 Jul 2001 18:36:41 +0100 | ||
1521 | |||
1522 | openssh (1:2.9p2-1) unstable; urgency=low | ||
1523 | |||
1524 | * new (several..) upstream version (Closes: #96726, #81856, #96335) | ||
1525 | * Hopefully, this will close some other bugs too | ||
1526 | |||
1527 | -- Matthew Vernon <matthew@debian.org> Tue, 17 Jul 2001 19:41:58 +0100 | ||
1528 | |||
1529 | openssh (1:2.5.2p2-3) unstable; urgency=low | ||
1530 | |||
1531 | * Taking Over this package | ||
1532 | * Patches from Robert Bihlmeyer for the Hurd (Closes: #102991) | ||
1533 | * Put PermitRootLogin back to yes (Closes: #67334, #67371, #78274) | ||
1534 | * Don't fiddle with conf-files any more (Closes: #69501) | ||
1535 | |||
1536 | -- Matthew Vernon <matthew@debian.org> Tue, 03 Jul 2001 02:58:13 +0100 | ||
1537 | |||
1538 | openssh (1:2.5.2p2-2.2) unstable; urgency=low | ||
1539 | |||
1540 | * NMU | ||
1541 | * Include Hurd compatibility patches from Robert Bihlmeyer (Closes: #76033) | ||
1542 | * Patch from Richard Kettlewell for protocolkeepalives (Closes: #99273) | ||
1543 | * Patch from Matthew Vernon for BannerTimeOut, batchmode, and | ||
1544 | documentation for protocolkeepalives. Makes ssh more generally useful | ||
1545 | for scripting uses (Closes: #82877, #99275) | ||
1546 | * Set a umask, so ourpidfile isn't world-writable (closes: #100012, | ||
1547 | #98286, #97391) | ||
1548 | |||
1549 | -- Matthew Vernon <matthew@debian.org> Thu, 28 Jun 2001 23:15:42 +0100 | ||
1550 | |||
1551 | openssh (1:2.5.2p2-2.1) unstable; urgency=low | ||
1552 | |||
1553 | * NMU | ||
1554 | * Remove duplicate Build-Depends for libssl096-dev and change it to | ||
1555 | depend on libssl-dev instaed. Also adding in virtual | real package | ||
1556 | style build-deps. (Closes: #93793, #75228) | ||
1557 | * Removing add-log entry (Closes: #79266) | ||
1558 | * This was a pam bug from a while back (Closes: #86908, #88457, #86843) | ||
1559 | * pam build-dep already exists (Closes: #93683) | ||
1560 | * libgnome-dev build-dep already exists (Closes: #93694) | ||
1561 | * No longer in non-free (Closes: #85401) | ||
1562 | * Adding in fr debconf translations (Closes: #83783) | ||
1563 | * Already suggests xbase-clients (Closes: #79741) | ||
1564 | * No need to suggest libpam-pwdb anymore (Closes: #81658) | ||
1565 | * Providing rsh-client (Closes: #79437) | ||
1566 | * hurd patch was already applied (Closes: #76033) | ||
1567 | * default set to no (Closes: #73682) | ||
1568 | * Adding in a suggests for dnsutils (Closes: #93265) | ||
1569 | * postinst bugs fixed (Closes: #88057, #88066, #88196, #88405, #88612) | ||
1570 | (Closes: #88774, #88196, #89556, #90123, #90228, #90833, #87814, #85465) | ||
1571 | * Adding in debconf dependency | ||
1572 | |||
1573 | -- Ivan E. Moore II <rkrusty@debian.org> Mon, 16 Apr 2001 14:11:04 +0100 | ||
1574 | |||
1575 | openssh (1:2.5.2p2-2) unstable; urgency=high | ||
1576 | |||
1577 | * disable the OpenSSL version check in entropy.c | ||
1578 | (closes: #93581, #93588, #93590, #93614, #93619, #93635, #93648) | ||
1579 | |||
1580 | -- Philip Hands <phil@uk.alcove.com> Wed, 11 Apr 2001 20:30:04 +0100 | ||
1581 | |||
1582 | openssh (1:2.5.2p2-1) unstable; urgency=low | ||
1583 | |||
1584 | * New upstream release | ||
1585 | * removed make-ssh-known-hosts, since ssh-keyscan does that job (closes: #86069, #87748) | ||
1586 | * fix double space indent in german templates (closes: #89493) | ||
1587 | * make postinst check for ssh_host_rsa_key | ||
1588 | * get rid of the last of the misguided debian/rules NMU debris :-/ | ||
1589 | |||
1590 | -- Philip Hands <phil@hands.com> Sat, 24 Mar 2001 20:59:33 +0000 | ||
1591 | |||
1592 | openssh (1:2.5.1p2-2) unstable; urgency=low | ||
1593 | |||
1594 | * rebuild with new debhelper (closes: #89558, #89536, #90225) | ||
1595 | * fix broken dpkg-statoverride test in postinst | ||
1596 | (closes: #89612, #90474, #90460, #89605) | ||
1597 | * NMU bug fixed but not closed in last upload (closes: #88206) | ||
1598 | |||
1599 | -- Philip Hands <phil@hands.com> Fri, 23 Mar 2001 16:11:33 +0000 | ||
1600 | |||
1601 | openssh (1:2.5.1p2-1) unstable; urgency=high | ||
1602 | |||
1603 | * New upstream release | ||
1604 | * fix typo in postinst (closes: #88110) | ||
1605 | * revert to setting PAM service name in debian/rules, backing out last | ||
1606 | NMU, which also (closes: #88101) | ||
1607 | * restore the pam lastlog/motd lines, lost during the NMUs, and sshd_config | ||
1608 | * restore printlastlog option patch | ||
1609 | * revert to using debhelper, which had been partially disabled in NMUs | ||
1610 | |||
1611 | -- Philip Hands <phil@hands.com> Tue, 13 Mar 2001 01:41:34 +0000 | ||
1612 | |||
1613 | openssh (1:2.5.1p1-1.8) unstable; urgency=high | ||
1614 | |||
1615 | * And now the old pam-bug s/sshd/ssh in ssh.c is also fixed | ||
1616 | |||
1617 | -- Christian Kurz <shorty@debian.org> Thu, 1 Mar 2001 19:48:01 +0100 | ||
1618 | |||
1619 | openssh (1:2.5.1p1-1.7) unstable; urgency=high | ||
1620 | |||
1621 | * And now we mark the correct binary as setuid, when a user requested | ||
1622 | to install it setuid. | ||
1623 | |||
1624 | -- Christian Kurz <shorty@debian.org> Thu, 1 Mar 2001 07:19:56 +0100 | ||
1625 | |||
1626 | openssh (1:2.5.1p1-1.6) unstable; urgency=high | ||
1627 | |||
1628 | * Fixes postinst to handle overrides that are already there. Damn, I | ||
1629 | should have noticed the bug earlier. | ||
1630 | |||
1631 | -- Christian Kurz <shorty@debian.org> Wed, 28 Feb 2001 22:35:00 +0100 | ||
1632 | |||
1633 | openssh (1:2.5.1p1-1.5) unstable; urgency=high | ||
1634 | |||
1635 | * Rebuild ssh with pam-support. | ||
1636 | |||
1637 | -- Christian Kurz <shorty@debian.org> Mon, 26 Feb 2001 21:55:51 +0100 | ||
1638 | |||
1639 | openssh (1:2.5.1p1-1.4) unstable; urgency=low | ||
1640 | |||
1641 | * Added Build-Depends on libssl096-dev. | ||
1642 | * Fixed sshd_config file to disallow root logins again. | ||
1643 | |||
1644 | -- Christian Kurz <shorty@debian.org> Sun, 25 Feb 2001 20:03:55 +0100 | ||
1645 | |||
1646 | openssh (1:2.5.1p1-1.3) unstable; urgency=low | ||
1647 | |||
1648 | * Fixed missing manpages for sftp.1 and ssh-keyscan.1 | ||
1649 | * Made package policy 3.5.2 compliant. | ||
1650 | |||
1651 | -- Christian Kurz <shorty@debian.org> Sun, 25 Feb 2001 15:46:26 +0100 | ||
1652 | |||
1653 | openssh (1:2.5.1p1-1.2) unstable; urgency=low | ||
1654 | |||
1655 | * Added Conflict with sftp, since we now provide our own sftp-client. | ||
1656 | * Added a fix for our broken dpkg-statoverride call in the | ||
1657 | 2.3.0p1-13. | ||
1658 | * Fixed some config pathes in the comments of sshd_config. | ||
1659 | * Removed ssh-key-exchange-vulnerability-patch since it's not needed | ||
1660 | anymore because upstream included the fix. | ||
1661 | |||
1662 | -- Christian Kurz <shorty@debian.org> Sun, 25 Feb 2001 13:46:58 +0100 | ||
1663 | |||
1664 | openssh (1:2.5.1p1-1.1) unstable; urgency=high | ||
1665 | |||
1666 | * Another NMU to get the new upstream version 2.5.1p1 into | ||
1667 | unstable. (Closes: #87123) | ||
1668 | * Corrected postinst to mark ssh as setuid. (Closes: #86391, #85766) | ||
1669 | * Key Exchange patch is already included by upstream. (Closes: #86015) | ||
1670 | * Upgrading should be possible now. (Closes: #85525, #85523) | ||
1671 | * Added --disable-suid-ssh as compile option, so ssh won't get installed | ||
1672 | suid per default. | ||
1673 | * Fixed postinst to run dpkg-statoverride only, when dpkg-statoverride | ||
1674 | is available and the mode of the binary should be 4755. And also added | ||
1675 | suggestion for a newer dpkg. | ||
1676 | (Closes: #85734, #85741, #86876) | ||
1677 | * sftp and ssh-keyscan will also be included from now on. (Closes: #79994) | ||
1678 | * scp now understands spaces in filenames (Closes: #53783, #58958, | ||
1679 | #66723) | ||
1680 | * ssh-keygen now supports showing DSA fingerprints. (Closes: #68623) | ||
1681 | * ssh doesn' t show motd anymore when switch -t is used. (Closes #69035) | ||
1682 | * ssh supports the usage of other dsa keys via the ssh command line | ||
1683 | options. (Closes: #81250) | ||
1684 | * Documentation in sshd_config fixed. (Closes: #81088) | ||
1685 | * primes file included by upstream and included now. (Closes: #82101) | ||
1686 | * scp now allows dots in the username. (Closes: #82477) | ||
1687 | * Spelling error in ssh-copy-id.1 corrected by upstream. (Closes: #78124) | ||
1688 | |||
1689 | -- Christian Kurz <shorty@debian.org> Sun, 25 Feb 2001 10:06:08 +0100 | ||
1690 | |||
1691 | openssh (1:2.3.0p1-1.13) unstable; urgency=low | ||
1692 | |||
1693 | * Config should now also be fixed with this hopefully last NMU. | ||
1694 | |||
1695 | -- Christian Kurz <shorty@debian.org> Sat, 10 Feb 2001 22:56:36 +0100 | ||
1696 | |||
1697 | openssh (1:2.3.0p1-1.12) unstable; urgency=high | ||
1698 | |||
1699 | * Added suggest for xbase-clients to control-file. (Closes #85227) | ||
1700 | * Applied patch from Markus Friedl to fix a vulnerability in | ||
1701 | the rsa keyexchange. | ||
1702 | * Fixed position of horizontal line. (Closes: #83613) | ||
1703 | * Fixed hopefully the grep problem in the config-file. (Closes: #78802) | ||
1704 | * Converted package from suidregister to dpkg-statoverride. | ||
1705 | |||
1706 | -- Christian Kurz <shorty@debian.org> Fri, 9 Feb 2001 19:43:55 +0100 | ||
1707 | |||
1708 | openssh (1:2.3.0p1-1.11) unstable; urgency=medium | ||
1709 | |||
1710 | * Fixed some typos in the german translation of the debconf | ||
1711 | template. | ||
1712 | |||
1713 | -- Christian Kurz <shorty@debian.org> Wed, 24 Jan 2001 18:22:38 +0100 | ||
1714 | |||
1715 | openssh (1:2.3.0p1-1.10) unstable; urgency=medium | ||
1716 | |||
1717 | * Fixed double printing of motd. (Closes: #82618) | ||
1718 | |||
1719 | -- Christian Kurz <shorty@debian.org> Tue, 23 Jan 2001 21:03:43 +0100 | ||
1720 | |||
1721 | openssh (1:2.3.0p1-1.9) unstable; urgency=high | ||
1722 | |||
1723 | * And the next NMU which includes the patch from Andrew Bartlett | ||
1724 | and Markus Friedl to fix the root privileges handling of openssh. | ||
1725 | (Closes: #82657) | ||
1726 | |||
1727 | -- Christian Kurz <shorty@debian.org> Wed, 17 Jan 2001 22:20:54 +0100 | ||
1728 | |||
1729 | openssh (1:2.3.0p1-1.8) unstable; urgency=high | ||
1730 | |||
1731 | * Applied fix from Ryan Murray to allow building on other architectures | ||
1732 | since the hurd patch was wrong. (Closes: #82471) | ||
1733 | |||
1734 | -- Christian Kurz <shorty@debian.org> Tue, 16 Jan 2001 22:45:51 +0100 | ||
1735 | |||
1736 | openssh (1:2.3.0p1-1.7) unstable; urgency=medium | ||
1737 | |||
1738 | * Fixed another typo on sshd_config | ||
1739 | |||
1740 | -- Christian Kurz <shorty@debian.org> Sun, 14 Jan 2001 19:01:31 +0100 | ||
1741 | |||
1742 | openssh (1:2.3.0p1-1.6) unstable; urgency=high | ||
1743 | |||
1744 | * Added Build-Dependency on groff (Closes: #81886) | ||
1745 | * Added Build-Depencency on debhelper (Closes: #82072) | ||
1746 | * Fixed entry for known_hosts in sshd_config (Closes: #82096) | ||
1747 | |||
1748 | -- Christian Kurz <shorty@debian.org> Thu, 11 Jan 2001 23:08:16 +0100 | ||
1749 | |||
1750 | openssh (1:2.3.0p1-1.5) unstable; urgency=high | ||
1751 | |||
1752 | * Fixed now also the problem with sshd used as default ipv4 and | ||
1753 | didn't use IPv6. This should be now fixed. | ||
1754 | |||
1755 | -- Christian Kurz <shorty@debian.org> Thu, 11 Jan 2001 21:25:55 +0100 | ||
1756 | |||
1757 | openssh (1:2.3.0p1-1.4) unstable; urgency=high | ||
1758 | |||
1759 | * Fixed buggy entry in postinst. | ||
1760 | |||
1761 | -- Christian Kurz <shorty@debian.org> Wed, 10 Jan 2001 23:12:16 +0100 | ||
1762 | |||
1763 | openssh (1:2.3.0p1-1.3) unstable; urgency=high | ||
1764 | |||
1765 | * After finishing the rewrite of the rules-file I had to notice that | ||
1766 | the manpage installation was broken. This should now work again. | ||
1767 | |||
1768 | -- Christian Kurz <shorty@debian.org> Wed, 10 Jan 2001 22:11:59 +0100 | ||
1769 | |||
1770 | openssh (1:2.3.0p1-1.2) unstable; urgency=high | ||
1771 | |||
1772 | * Fixed the screwed up build-dependency. | ||
1773 | * Removed --with-ipv4-default to support ipv6. | ||
1774 | * Changed makefile to use /etc/pam.d/ssh instead of /etc/pam.d/sshd. | ||
1775 | * Fixed location to sftp-server in config. | ||
1776 | * Since debian still relies on /etc/pam.d/ssh instead of moving to | ||
1777 | /etc/pam.d/sshd, I had to hack ssh.h to get ssh to use this name. | ||
1778 | * Fixed path to host key in sshd_config. | ||
1779 | |||
1780 | -- Christian Kurz <shorty@debian.org> Wed, 10 Jan 2001 08:23:47 +0100 | ||
1781 | |||
1782 | openssh (1:2.3.0p1-1.1) unstable; urgency=medium | ||
1783 | |||
1784 | * NMU with permission of Phil Hands. | ||
1785 | * New upstream release | ||
1786 | * Update Build-Depends to point to new libssl096. | ||
1787 | * This upstream release doesn't leak any information depending | ||
1788 | on the setting of PermitRootLogin (Closes: #59933) | ||
1789 | * New upstream release contains fix against forcing a client to | ||
1790 | do X/agent forwarding (Closes: #76788) | ||
1791 | * Changed template to contain correct path to the documentation | ||
1792 | (Closes: #67245) | ||
1793 | * Added --with-4in6 switch as compile option into debian/rules. | ||
1794 | * Added --with-ipv4-default as compile option into debian/rules. | ||
1795 | (Closes: #75037) | ||
1796 | * Changed default path to also contain /usr/local/bin and | ||
1797 | /usr/X11R6/bin (Closes: #62472,#54567,#62810) | ||
1798 | * Changed path to sftp-server in sshd_config to match the | ||
1799 | our package (Closes: #68347) | ||
1800 | * Replaced OpenBSDh with OpenBSD in the init-script. | ||
1801 | * Changed location to original source in copyright.head | ||
1802 | * Changed behaviour of init-script when invoked with the option | ||
1803 | restart (Closes: #68706,#72560) | ||
1804 | * Added a note about -L option of scp to README.Debian | ||
1805 | * ssh won't print now the motd if invoked with -t option | ||
1806 | (Closes: #59933) | ||
1807 | * RFC.nroff.gz get's now converted into RFC.gz. (Closes: #63867) | ||
1808 | * Added a note about tcp-wrapper support to README.Debian | ||
1809 | (Closes: #72807,#22190) | ||
1810 | * Removed two unneeded options from building process. | ||
1811 | * Added sshd.pam into debian dir and install it. | ||
1812 | * Commented out unnecessary call to dh_installinfo. | ||
1813 | * Added a line to sshd.pam so that limits will be paid attention | ||
1814 | to (Closes: #66904) | ||
1815 | * Restart Option has a Timeout of 10 seconds (Closes: 51264) | ||
1816 | * scp won't override files anymore (Closes: 51955) | ||
1817 | * Removed pam_lastlog module, so that the lastlog is now printed | ||
1818 | only once (Closes: #71742, #68335, #69592, #71495, #77781) | ||
1819 | * If password is expired, openssh now forces the user to change it. | ||
1820 | (Closes: #51747) | ||
1821 | * scp should now have no more problems with shell-init-files that | ||
1822 | produces ouput (Closes: #56280,#59873) | ||
1823 | * ssh now prints the motd correctly (Closes: #66926) | ||
1824 | * ssh upgrade should disable ssh daemon only if users has choosen | ||
1825 | to do so (Closes: #67478) | ||
1826 | * ssh can now be installed suid (Closes: #70879) | ||
1827 | * Modified debian/rules to support hurd. | ||
1828 | |||
1829 | -- Christian Kurz <shorty@debian.org> Wed, 27 Dec 2000 20:06:57 +0100 | ||
1830 | |||
1831 | openssh (1:2.2.0p1-1.1) unstable; urgency=medium | ||
1832 | |||
1833 | * Non-Maintainer Upload | ||
1834 | * Check for new returns in the new libc | ||
1835 | (closes: #72803, #74393, #72797, #71307, #71702) | ||
1836 | * Link against libssl095a (closes: #66304) | ||
1837 | * Correct check for PermitRootLogin (closes: #69448) | ||
1838 | |||
1839 | -- Ryan Murray <rmurray@debian.org> Wed, 18 Oct 2000 00:48:18 -0700 | ||
1840 | |||
1841 | openssh (1:2.2.0p1-1) unstable; urgency=low | ||
1842 | |||
1843 | * New upstream release | ||
1844 | |||
1845 | -- Philip Hands <phil@hands.com> Mon, 11 Sep 2000 14:49:43 +0100 | ||
1846 | |||
1847 | openssh (1:2.1.1p4-3) unstable; urgency=low | ||
1848 | |||
1849 | * add rsh alternatives | ||
1850 | * add -S option to scp (using Tommi Virtanen's patch) (closes: #63097) | ||
1851 | * do the IPV4_DEFAULT thing properly this time | ||
1852 | |||
1853 | -- Philip Hands <phil@hands.com> Fri, 11 Aug 2000 18:14:37 +0100 | ||
1854 | |||
1855 | openssh (1:2.1.1p4-2) unstable; urgency=low | ||
1856 | |||
1857 | * reinstate manpage .out patch from 1:1.2.3 | ||
1858 | * fix typo in postinst | ||
1859 | * only compile ssh with IPV4_DEFAULT | ||
1860 | * apply James Troup's patch to add a -o option to scp and updated manpage | ||
1861 | |||
1862 | -- Philip Hands <phil@hands.com> Sun, 30 Jul 2000 00:12:49 +0100 | ||
1863 | |||
1864 | openssh (1:2.1.1p4-1) unstable; urgency=low | ||
1865 | |||
1866 | * New upstream release | ||
1867 | |||
1868 | -- Philip Hands <phil@hands.com> Sat, 29 Jul 2000 14:46:16 +0100 | ||
1869 | |||
1870 | openssh (1:1.2.3-10) unstable; urgency=low | ||
1871 | |||
1872 | * add version to libpam-modules dependency, because old versions of | ||
1873 | pam_motd make it impossible to log in. | ||
1874 | |||
1875 | -- Philip Hands <phil@hands.com> Sat, 29 Jul 2000 13:28:22 +0100 | ||
1876 | |||
1877 | openssh (1:1.2.3-9) frozen unstable; urgency=low | ||
1878 | |||
1879 | * force location of /usr/bin/X11/xauth | ||
1880 | (closes: #64424, #66437, #66859) *RC* | ||
1881 | * typos in config (closes: #66779, #66780) | ||
1882 | * sshd_not_to_be_run could be assumed to be true, in error, if the config | ||
1883 | script died in an unusual way --- I've reversed this (closes: #66335) | ||
1884 | * Apply Zack Weinberg <zack@wolery.cumb.org>'s patch to ssh-askpass-ptk | ||
1885 | (closes: #65981) | ||
1886 | * change default for PermitRootLogin to "no" (closes: #66406) | ||
1887 | |||
1888 | -- Philip Hands <phil@hands.com> Tue, 11 Jul 2000 20:51:18 +0100 | ||
1889 | |||
1890 | openssh (1:1.2.3-8) frozen unstable; urgency=low | ||
1891 | |||
1892 | * get rid of Provides: rsh-server (this will mean that rstartd | ||
1893 | will need to change it's depends to deal with #63948, which I'm | ||
1894 | reopening) (closes: #66257) | ||
1895 | Given that this is also a trivial change, and is a reversal of a | ||
1896 | change that was mistakenly made after the freeze, I think this should | ||
1897 | also go into frozen. | ||
1898 | |||
1899 | -- Philip Hands <phil@hands.com> Wed, 28 Jun 2000 03:26:30 +0100 | ||
1900 | |||
1901 | openssh (1:1.2.3-7) frozen unstable; urgency=low | ||
1902 | |||
1903 | * check if debconf is installed before calling db_stop in postinst. | ||
1904 | This is required to allow ssh to be installed when debconf is not | ||
1905 | wanted, which probably makes it an RC upload (hopefully the last of | ||
1906 | too many). | ||
1907 | |||
1908 | -- Philip Hands <phil@hands.com> Wed, 28 Jun 2000 03:19:47 +0100 | ||
1909 | |||
1910 | openssh (1:1.2.3-6) frozen unstable; urgency=low | ||
1911 | |||
1912 | * fixed depressing little bug involving a line wrap looking like | ||
1913 | a blank line in the templates file *RC* | ||
1914 | (closes: #66090, #66078, #66083, #66182) | ||
1915 | |||
1916 | -- Philip Hands <phil@hands.com> Mon, 26 Jun 2000 00:45:05 +0100 | ||
1917 | |||
1918 | openssh (1:1.2.3-5) frozen unstable; urgency=low | ||
1919 | |||
1920 | * add code to prevent UseLogin exploit, although I think our PAM | ||
1921 | conditional code breaks UseLogin in a way that protects us from this | ||
1922 | exploit anyway. ;-) (closes: #65495) *RC* | ||
1923 | * Apply Zack Weinberg <zack@wolery.cumb.org>'s patch to fix keyboard | ||
1924 | grab vulnerability in ssh-askpass-gnome (closes: #64795) *RC* | ||
1925 | * stop redirection of sshd's file descriptors (introduced in 1:1.2.3-3) | ||
1926 | and use db_stop in the postinst to solve that problem instead | ||
1927 | (closes: #65104) | ||
1928 | * add Provides: rsh-server to ssh (closes: #63948) | ||
1929 | * provide config option not to run sshd | ||
1930 | |||
1931 | -- Philip Hands <phil@hands.com> Mon, 12 Jun 2000 23:05:11 +0100 | ||
1932 | |||
1933 | openssh (1:1.2.3-4) frozen unstable; urgency=low | ||
1934 | |||
1935 | * fixes #63436 which is *RC* | ||
1936 | * add 10 second pause in init.d restart (closes: #63844) | ||
1937 | * get rid of noenv in PAM mail line (closes: #63856) | ||
1938 | * fix host key path in make-ssh-known-hosts (closes: #63713) | ||
1939 | * change wording of SUID template (closes: #62788, #63436) | ||
1940 | |||
1941 | -- Philip Hands <phil@hands.com> Sat, 27 May 2000 11:18:06 +0100 | ||
1942 | |||
1943 | openssh (1:1.2.3-3) frozen unstable; urgency=low | ||
1944 | |||
1945 | * redirect sshd's file descriptors to /dev/null in init to | ||
1946 | prevent debconf from locking up during installation | ||
1947 | ** grave bug just submited by me ** | ||
1948 | |||
1949 | -- Philip Hands <phil@hands.com> Thu, 20 Apr 2000 17:10:59 +0100 | ||
1950 | |||
1951 | openssh (1:1.2.3-2) frozen unstable; urgency=low | ||
1952 | |||
1953 | * allow user to select SUID status of /usr/bin/ssh (closes: 62462) ** RC ** | ||
1954 | * suggest debconf | ||
1955 | * conflict with debconf{,-tiny} (<<0.2.17) so I can clean up the preinst | ||
1956 | |||
1957 | -- Philip Hands <phil@hands.com> Wed, 19 Apr 2000 17:49:15 +0100 | ||
1958 | |||
1959 | openssh (1:1.2.3-1) frozen unstable; urgency=low | ||
1960 | |||
1961 | * New upstream release | ||
1962 | * patch sshd to create extra xauth key required for localhost | ||
1963 | (closes: #49944) *** RC *** | ||
1964 | * FallbacktoRsh now defaults to ``no'' to match impression | ||
1965 | given in sshd_config | ||
1966 | * stop setting suid bit on ssh (closes: #58711, #58558) | ||
1967 | This breaks Rhosts authentication (which nobody uses) and allows | ||
1968 | the LD_PRELOAD trick to get socks working, so seems like a net benefit. | ||
1969 | |||
1970 | -- Philip Hands <phil@hands.com> Thu, 13 Apr 2000 20:01:54 +0100 | ||
1971 | |||
1972 | openssh (1:1.2.2-1.4) frozen unstable; urgency=low | ||
1973 | |||
1974 | * Recompile for frozen, contains fix for RC bug. | ||
1975 | |||
1976 | -- Tommi Virtanen <tv@debian.org> Tue, 29 Feb 2000 22:14:58 +0200 | ||
1977 | |||
1978 | openssh (1:1.2.2-1.3) unstable; urgency=low | ||
1979 | |||
1980 | * Integrated man page addition for PrintLastLog. | ||
1981 | This bug was filed on "openssh", and I ended up | ||
1982 | creating my own patch for this (closes: #59054) | ||
1983 | * Improved error message when ssh_exchange_identification | ||
1984 | gets EOF (closes: #58904) | ||
1985 | * Fixed typo (your -> you're) in debian/preinst. | ||
1986 | * Added else-clauses to config to make this upgradepath possible: | ||
1987 | oldssh -> openssh preinst fails due to upgrade_to_openssh=false | ||
1988 | -> ssh-nonfree -> openssh. Without these, debconf remembered | ||
1989 | the old answer, config didn't force asking it, and preinst always | ||
1990 | aborted (closes: #56596, #57782) | ||
1991 | * Moved setting upgrade_to_openssh isdefault flag to the place | ||
1992 | where preinst would abort. This means no double question to most | ||
1993 | users, people who currently suffer from "can't upgrade" may need | ||
1994 | to run apt-get install ssh twice. Did not do the same for | ||
1995 | use_old_init_script, as the situation is a bit different, and | ||
1996 | less common (closes: #54010, #56224) | ||
1997 | * Check for existance of ssh-keygen before attempting to use it in | ||
1998 | preinst, added warning for non-existant ssh-keygen in config. This | ||
1999 | happens when the old ssh is removed (say, due to ssh-nonfree getting | ||
2000 | installed). | ||
2001 | |||
2002 | -- Tommi Virtanen <tv@debian.org> Sun, 27 Feb 2000 21:36:43 +0200 | ||
2003 | |||
2004 | openssh (1:1.2.2-1.2) frozen unstable; urgency=low | ||
2005 | |||
2006 | * Non-maintainer upload. | ||
2007 | * Added configuration option PrintLastLog, default off due to PAM | ||
2008 | (closes: #54007, #55042) | ||
2009 | * ssh-askpass-{gnome,ptk} now provide ssh-askpass, making ssh's | ||
2010 | Suggests: line more accurate. Also closing related bugs fixed | ||
2011 | earlier, when default ssh-askpass moved to /usr/bin. | ||
2012 | (closes: #52403, #54741, #50607, #52298, #50967, #51661) | ||
2013 | * Patched to call vhangup, with autoconf detection and all | ||
2014 | (closes: #55379) | ||
2015 | * Added --with-ipv4-default workaround to a glibc bug causing | ||
2016 | slow DNS lookups, as per UPGRADING. Use -6 to really use | ||
2017 | IPv6 addresses. (closes: #57891, #58744, #58713, #57970) | ||
2018 | * Added noenv to PAM pam_mail line. Thanks to Ben Collins. | ||
2019 | (closes: #58429) | ||
2020 | * Added the UPGRADING file to the package. | ||
2021 | * Added frozen to the changelog line and recompiled before | ||
2022 | package was installed into the archive. | ||
2023 | |||
2024 | -- Tommi Virtanen <tv@debian.org> Fri, 25 Feb 2000 22:08:57 +0200 | ||
2025 | |||
2026 | openssh (1:1.2.2-1.1) frozen unstable; urgency=low | ||
2027 | |||
2028 | * Non-maintainer upload. | ||
2029 | * Integrated scp pipe buffer patch from Ben Collins | ||
2030 | <benc@debian.org>, should now work even if reading | ||
2031 | a pipe gives less than fstat st_blksize bytes. | ||
2032 | Should now work on Alpha and Sparc Linux (closes: #53697, #52071) | ||
2033 | * Made ssh depend on libssl09 (>= 0.9.4-3) (closes: #51393) | ||
2034 | * Integrated patch from Ben Collins <benc@debian.org> | ||
2035 | to do full shadow account locking and expiration | ||
2036 | checking (closes: #58165, #51747) | ||
2037 | |||
2038 | -- Tommi Virtanen <tv@debian.org> Tue, 22 Feb 2000 20:46:12 +0200 | ||
2039 | |||
2040 | openssh (1:1.2.2-1) frozen unstable; urgency=medium | ||
2041 | |||
2042 | * New upstream release (closes: #56870, #56346) | ||
2043 | * built against new libesd (closes: #56805) | ||
2044 | * add Colin Watson <cjw44@cam.ac.uk> =NULL patch | ||
2045 | (closes: #49902, #54894) | ||
2046 | * use socketpairs as suggested by Andrew Tridgell to eliminate rsync | ||
2047 | (and other) lockups | ||
2048 | * patch SSHD_PAM_SERVICE back into auth-pam.c, again :-/ | ||
2049 | (closes: #49902, #55872, #56959) | ||
2050 | * uncoment the * line in ssh_config (closes: #56444) | ||
2051 | |||
2052 | * #54894 & #49902 are release critical, so this should go in frozen | ||
2053 | |||
2054 | -- Philip Hands <phil@hands.com> Wed, 9 Feb 2000 04:52:04 +0000 | ||
2055 | |||
2056 | openssh (1:1.2.1pre24-1) unstable; urgency=low | ||
2057 | |||
2058 | * New upstream release | ||
2059 | |||
2060 | -- Philip Hands <phil@hands.com> Fri, 31 Dec 1999 02:47:24 +0000 | ||
2061 | |||
2062 | openssh (1:1.2.1pre23-1) unstable; urgency=low | ||
2063 | |||
2064 | * New upstream release | ||
2065 | * excape ? in /etc/init.d/ssh (closes: #53269) | ||
2066 | |||
2067 | -- Philip Hands <phil@hands.com> Wed, 29 Dec 1999 16:50:46 +0000 | ||
2068 | |||
2069 | openssh (1:1.2pre17-1) unstable; urgency=low | ||
2070 | |||
2071 | * New upstream release | ||
2072 | |||
2073 | -- Philip Hands <phil@hands.com> Thu, 9 Dec 1999 16:50:40 +0000 | ||
2074 | |||
2075 | openssh (1:1.2pre16-1) unstable; urgency=low | ||
2076 | |||
2077 | * New upstream release | ||
2078 | * upstream release (1.2pre14) (closes: #50299) | ||
2079 | * make ssh depend on libwrap0 (>= 7.6-1.1) (closes: #50973, #50776) | ||
2080 | * dispose of grep -q broken pipe message in config script (closes: #50855) | ||
2081 | * add make-ssh-known-hosts (closes: #50660) | ||
2082 | * add -i option to ssh-copy-id (closes: #50657) | ||
2083 | * add check for *LK* in password, indicating a locked account | ||
2084 | |||
2085 | -- Philip Hands <phil@hands.com> Wed, 8 Dec 1999 22:59:38 +0000 | ||
2086 | |||
2087 | openssh (1:1.2pre13-1) unstable; urgency=low | ||
2088 | |||
2089 | * New upstream release | ||
2090 | * make sshd.c use SSHD_PAM_SERVICE and define it as "ssh" in debian/rules | ||
2091 | * remove duplicate line in /etc/pam.d/ssh (closes: #50310) | ||
2092 | * mention ssh -A option in ssh.1 & ssh_config | ||
2093 | * enable forwarding to localhost in default ssh_config (closes: #50373) | ||
2094 | * tweak preinst to deal with debconf being `unpacked' | ||
2095 | * use --with-tcp-wrappers (closes: #49545) | ||
2096 | |||
2097 | -- Philip Hands <phil@hands.com> Sat, 20 Nov 1999 14:20:04 +0000 | ||
2098 | |||
2099 | openssh (1:1.2pre11-2) unstable; urgency=low | ||
2100 | |||
2101 | * oops, just realised that I forgot to strip out the unpleasant | ||
2102 | fiddling mentioned below (which turned not to be a fix anyway) | ||
2103 | |||
2104 | -- Philip Hands <phil@hands.com> Mon, 15 Nov 1999 01:35:23 +0000 | ||
2105 | |||
2106 | openssh (1:1.2pre11-1) unstable; urgency=low | ||
2107 | |||
2108 | * New upstream release (closes: #49722) | ||
2109 | * add 2>/dev/null to dispose of spurious message casused by grep -q | ||
2110 | (closes: #49876, #49604) | ||
2111 | * fix typo in debian/control (closes: #49841) | ||
2112 | * Do some unpleasant fiddling with upgraded keys in the preinst, which | ||
2113 | should make the keylength problem go away. (closes: #49676) | ||
2114 | * make pam_start in sshd use ``ssh'' as the service name (closes: #49956) | ||
2115 | * If /etc/ssh/NOSERVER exist, stop sshd from starting (closes: #47107) | ||
2116 | * apply Ben Collins <bcollins@debian.org>'s shadow patch | ||
2117 | * disable lastlogin and motd printing if using pam (closes: #49957) | ||
2118 | * add ssh-copy-id script and manpage | ||
2119 | |||
2120 | -- Philip Hands <phil@hands.com> Fri, 12 Nov 1999 01:03:38 +0000 | ||
2121 | |||
2122 | openssh (1:1.2pre9-1) unstable; urgency=low | ||
2123 | |||
2124 | * New upstream release | ||
2125 | * apply Chip Salzenberg <chip@valinux.com>'s SO_REUSEADDR patch | ||
2126 | to channels.c, to make forwarded ports instantly reusable | ||
2127 | * replace Pre-Depend: debconf with some check code in preinst | ||
2128 | * make the ssh-add ssh-askpass failure message more helpful | ||
2129 | * fix the ssh-agent getopts bug (closes: #49426) | ||
2130 | * fixed typo on Suggests: line (closes: #49704, #49571) | ||
2131 | * tidy up ssh package description (closes: #49642) | ||
2132 | * make ssh suid (closes: #49635) | ||
2133 | * in preinst upgrade code, ensure ssh_host_keys is mode 600 (closes: #49606) | ||
2134 | * disable agent forwarding by default, for the similar reasons as | ||
2135 | X forwarding (closes: #49586) | ||
2136 | |||
2137 | -- Philip Hands <phil@hands.com> Tue, 9 Nov 1999 09:57:47 +0000 | ||
2138 | |||
2139 | openssh (1:1.2pre7-4) unstable; urgency=low | ||
2140 | |||
2141 | * predepend on debconf (>= 0.2.17) should now allow preinst questions | ||
2142 | |||
2143 | -- Philip Hands <phil@hands.com> Sat, 6 Nov 1999 10:31:06 +0000 | ||
2144 | |||
2145 | openssh (1:1.2pre7-3) unstable; urgency=low | ||
2146 | |||
2147 | * add ssh-askpass package using Tommi Virtanen's perl-tk script | ||
2148 | * add ssh-preconfig package cludge | ||
2149 | * add usage hints to ssh-agent.1 | ||
2150 | |||
2151 | -- Philip Hands <phil@hands.com> Fri, 5 Nov 1999 00:38:33 +0000 | ||
2152 | |||
2153 | openssh (1:1.2pre7-2) unstable; urgency=low | ||
2154 | |||
2155 | * use pam patch from Ben Collins <bcollins@debian.org> | ||
2156 | * add slogin symlink to Makefile.in | ||
2157 | * change /usr/bin/login to LOGIN_PROGRAM define of /bin/login | ||
2158 | * sort out debconf usage | ||
2159 | * patch from Tommi Virtanen <tv@debian.org>'s makes ssh-add use ssh-askpass | ||
2160 | |||
2161 | -- Philip Hands <phil@hands.com> Thu, 4 Nov 1999 11:08:54 +0000 | ||
2162 | |||
2163 | openssh (1:1.2pre7-1) unstable; urgency=low | ||
2164 | |||
2165 | * New upstream release | ||
2166 | |||
2167 | -- Philip Hands <phil@hands.com> Tue, 2 Nov 1999 21:02:37 +0000 | ||
2168 | |||
2169 | openssh (1:1.2.0.pre6db1-2) unstable; urgency=low | ||
2170 | |||
2171 | * change the binary package name to ssh (the non-free branch of ssh has | ||
2172 | been renamed to ssh-nonfree) | ||
2173 | * make pam file comply with Debian standards | ||
2174 | * use an epoch to make sure openssh supercedes ssh-nonfree | ||
2175 | |||
2176 | -- Philip Hands <phil@hands.com> Sat, 30 Oct 1999 16:26:05 +0100 | ||
2177 | |||
2178 | openssh (1.2pre6db1-1) unstable; urgency=low | ||
2179 | |||
2180 | * New upstream source | ||
2181 | * sshd accepts logins now! | ||
2182 | |||
2183 | -- Dan Brosemer <odin@linuxfreak.com> Fri, 29 Oct 1999 11:13:38 -0500 | ||
2184 | |||
2185 | openssh (1.2.0.19991028-1) unstable; urgency=low | ||
2186 | |||
2187 | * New upstream source | ||
2188 | * Added test for -lnsl to configure script | ||
2189 | |||
2190 | -- Dan Brosemer <odin@linuxfreak.com> Thu, 28 Oct 1999 18:52:09 -0500 | ||
2191 | |||
2192 | openssh (1.2.0.19991027-3) unstable; urgency=low | ||
2193 | |||
2194 | * Initial release | ||
2195 | |||
2196 | -- Dan Brosemer <odin@linuxfreak.com> Wed, 27 Oct 1999 19:39:46 -0500 | ||