summaryrefslogtreecommitdiff
path: root/debian/patches/debian-banner.patch
diff options
context:
space:
mode:
Diffstat (limited to 'debian/patches/debian-banner.patch')
-rw-r--r--debian/patches/debian-banner.patch99
1 files changed, 99 insertions, 0 deletions
diff --git a/debian/patches/debian-banner.patch b/debian/patches/debian-banner.patch
new file mode 100644
index 000000000..c0567f264
--- /dev/null
+++ b/debian/patches/debian-banner.patch
@@ -0,0 +1,99 @@
1Description: Add DebianBanner server configuration option
2 Setting this to "no" causes sshd to omit the Debian revision from its
3 initial protocol handshake, for those scared by package-versioning.patch.
4Author: Kees Cook <kees@debian.org>
5Bug-Debian: http://bugs.debian.org/562048
6Forwarded: not-needed
7Last-Update: 2010-02-28
8
9Index: b/servconf.c
10===================================================================
11--- a/servconf.c
12+++ b/servconf.c
13@@ -135,6 +135,7 @@
14 options->zero_knowledge_password_authentication = -1;
15 options->revoked_keys_file = NULL;
16 options->trusted_user_ca_keys = NULL;
17+ options->debian_banner = -1;
18 }
19
20 void
21@@ -277,6 +278,8 @@
22 options->permit_tun = SSH_TUNMODE_NO;
23 if (options->zero_knowledge_password_authentication == -1)
24 options->zero_knowledge_password_authentication = 0;
25+ if (options->debian_banner == -1)
26+ options->debian_banner = 1;
27
28 /* Turn privilege separation on by default */
29 if (use_privsep == -1)
30@@ -325,6 +328,7 @@
31 sUsePrivilegeSeparation, sAllowAgentForwarding,
32 sZeroKnowledgePasswordAuthentication, sHostCertificate,
33 sRevokedKeys, sTrustedUserCAKeys,
34+ sDebianBanner,
35 sDeprecated, sUnsupported
36 } ServerOpCodes;
37
38@@ -457,6 +461,7 @@
39 { "hostcertificate", sHostCertificate, SSHCFG_GLOBAL },
40 { "revokedkeys", sRevokedKeys, SSHCFG_ALL },
41 { "trustedusercakeys", sTrustedUserCAKeys, SSHCFG_ALL },
42+ { "debianbanner", sDebianBanner, SSHCFG_GLOBAL },
43 { NULL, sBadOption, 0 }
44 };
45
46@@ -1377,6 +1382,10 @@
47 charptr = &options->revoked_keys_file;
48 goto parse_filename;
49
50+ case sDebianBanner:
51+ intptr = &options->debian_banner;
52+ goto parse_int;
53+
54 case sDeprecated:
55 logit("%s line %d: Deprecated option %s",
56 filename, linenum, arg);
57Index: b/servconf.h
58===================================================================
59--- a/servconf.h
60+++ b/servconf.h
61@@ -157,6 +157,8 @@
62
63 int num_permitted_opens;
64
65+ int debian_banner;
66+
67 char *chroot_directory;
68 char *revoked_keys_file;
69 char *trusted_user_ca_keys;
70Index: b/sshd.c
71===================================================================
72--- a/sshd.c
73+++ b/sshd.c
74@@ -422,7 +422,8 @@
75 minor = PROTOCOL_MINOR_1;
76 }
77 snprintf(buf, sizeof buf, "SSH-%d.%d-%.100s%s", major, minor,
78- SSH_RELEASE, newline);
79+ options.debian_banner ? SSH_RELEASE : SSH_RELEASE_MINIMUM,
80+ newline);
81 server_version_string = xstrdup(buf);
82
83 /* Send our protocol version identification. */
84Index: b/sshd_config.5
85===================================================================
86--- a/sshd_config.5
87+++ b/sshd_config.5
88@@ -295,6 +295,11 @@
89 .Dq no .
90 The default is
91 .Dq delayed .
92+.It Cm DebianBanner
93+Specifies whether the distribution-specified extra version suffix is
94+included during initial protocol handshake.
95+The default is
96+.Dq yes .
97 .It Cm DenyGroups
98 This keyword can be followed by a list of group name patterns, separated
99 by spaces.