1 files changed, 16 insertions, 33 deletions

diff --git a/debian/patches/debian-config.patch b/debian/patches/debian-config.patch
index dd33c00a6..aae4e7d34 100644
--- a/debian/patches/debian-config.patch
+++ b/debian/patches/debian-config.patch
@@ -1,4 +1,4 @@
-From 0cce5c4c1de33c4172ce8ebc0f93e717995779f8 Mon Sep 17 00:00:00 2001
+From 6d0faf6dc76ac8cc73d6f8e478db7c97f7013a2d Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:18 +0000
 Subject: Various Debian-specific configuration changes
@@ -14,15 +14,12 @@ worms.
 ssh: Enable GSSAPIAuthentication and disable GSSAPIDelegateCredentials by
 default.
 
-sshd: Refer to /usr/share/doc/openssh-server/README.Debian.gz alongside
-PermitRootLogin default.
-
 Document all of this, along with several sshd defaults set in
 debian/openssh-server.postinst.
 
 Author: Russ Allbery <rra@debian.org>
 Forwarded: not-needed
-Last-Update: 2015-08-19
+Last-Update: 2015-11-29
 
 Patch-Name: debian-config.patch
 ---
@@ -30,15 +27,14 @@ Patch-Name: debian-config.patch
  ssh.1         | 21 +++++++++++++++++++++
  ssh_config    |  7 ++++++-
  ssh_config.5  | 19 ++++++++++++++++++-
- sshd_config   |  3 ++-
  sshd_config.5 | 25 +++++++++++++++++++++++++
- 6 files changed, 73 insertions(+), 4 deletions(-)
+ 5 files changed, 71 insertions(+), 3 deletions(-)
 
 diff --git a/readconf.c b/readconf.c
-index 5f6c37f..f0769b5 100644
+index c0ba5a7..e4e1cba 100644
 --- a/readconf.c
 +++ b/readconf.c
-@@ -1748,7 +1748,7 @@ fill_default_options(Options * options)
+@@ -1749,7 +1749,7 @@ fill_default_options(Options * options)
         if (options->forward_x11 == -1)
                 options->forward_x11 = 0;
         if (options->forward_x11_trusted == -1)
@@ -48,14 +44,13 @@ index 5f6c37f..f0769b5 100644
                 options->forward_x11_timeout = 1200;
         if (options->exit_on_forward_failure == -1)
 diff --git a/ssh.1 b/ssh.1
-index 2178863..e2cce49 100644
+index 05b7f10..649d6c3 100644
 --- a/ssh.1
 +++ b/ssh.1
-@@ -670,12 +670,33 @@ option and the
- directive in
+@@ -755,6 +755,16 @@ directive in
  .Xr ssh_config 5
  for more information.
-+.Pp
+ .Pp
 +(Debian-specific: X11 forwarding is not subjected to X11 SECURITY extension
 +restrictions by default, because too many programs currently crash in this
 +mode.
@@ -65,13 +60,14 @@ index 2178863..e2cce49 100644
 +.Dq no
 +to restore the upstream behaviour.
 +This may change in future depending on client-side improvements.)
++.Pp
  .It Fl x
  Disables X11 forwarding.
- .It Fl Y
- Enables trusted X11 forwarding.
+ .Pp
+@@ -763,6 +773,17 @@ Enables trusted X11 forwarding.
  Trusted X11 forwardings are not subjected to the X11 SECURITY extension
  controls.
-+.Pp
+ .Pp
 +(Debian-specific: This option does nothing in the default configuration: it
 +is equivalent to
 +.Dq Cm ForwardX11Trusted No yes ,
@@ -82,6 +78,7 @@ index 2178863..e2cce49 100644
 +.Dq no
 +to restore the upstream behaviour.
 +This may change in future depending on client-side improvements.)
++.Pp
  .It Fl y
  Send log information using the
  .Xr syslog 3
@@ -110,7 +107,7 @@ index 228e5ab..c9386aa 100644
 +    GSSAPIAuthentication yes
 +    GSSAPIDelegateCredentials no
 diff --git a/ssh_config.5 b/ssh_config.5
-index f25cedd..9a103f2 100644
+index 5bc04b0..aaa435a 100644
 --- a/ssh_config.5
 +++ b/ssh_config.5
 @@ -74,6 +74,22 @@ Since the first obtained value for each parameter is used, more
@@ -136,7 +133,7 @@ index f25cedd..9a103f2 100644
  The configuration file has the following format:
  .Pp
  Empty lines and lines starting with
-@@ -716,7 +732,8 @@ token used for the session will be set to expire after 20 minutes.
+@@ -721,7 +737,8 @@ token used for the session will be set to expire after 20 minutes.
  Remote clients will be refused access after this time.
  .Pp
  The default is
@@ -146,22 +143,8 @@ index f25cedd..9a103f2 100644
  .Pp
  See the X11 SECURITY extension specification for full details on
  the restrictions imposed on untrusted clients.
-diff --git a/sshd_config b/sshd_config
-index 1dfd0f1..23a338f 100644
---- a/sshd_config
-+++ b/sshd_config
-@@ -41,7 +41,8 @@
- # Authentication:
- 
- #LoginGraceTime 2m
--#PermitRootLogin no
-+# See /usr/share/doc/openssh-server/README.Debian.gz.
-+#PermitRootLogin without-password
- #StrictModes yes
- #MaxAuthTries 6
- #MaxSessions 10
 diff --git a/sshd_config.5 b/sshd_config.5
-index 355b445..eb6bff8 100644
+index 7e40a27..92c23bc 100644
 --- a/sshd_config.5
 +++ b/sshd_config.5
 @@ -57,6 +57,31 @@ Arguments may optionally be enclosed in double quotes