diff options
Diffstat (limited to 'debian/patches/debian-config.patch')
-rw-r--r-- | debian/patches/debian-config.patch | 159 |
1 files changed, 159 insertions, 0 deletions
diff --git a/debian/patches/debian-config.patch b/debian/patches/debian-config.patch new file mode 100644 index 000000000..4f5db8a91 --- /dev/null +++ b/debian/patches/debian-config.patch | |||
@@ -0,0 +1,159 @@ | |||
1 | From 810eecd6b2e03770f21e46b5cb8ce8c7fcd46da8 Mon Sep 17 00:00:00 2001 | ||
2 | From: Colin Watson <cjwatson@debian.org> | ||
3 | Date: Sun, 9 Feb 2014 16:10:18 +0000 | ||
4 | Subject: Various Debian-specific configuration changes | ||
5 | |||
6 | ssh: Enable ForwardX11Trusted, returning to earlier semantics which cause | ||
7 | fewer problems with existing setups (http://bugs.debian.org/237021). | ||
8 | |||
9 | ssh: Set 'SendEnv LANG LC_*' by default (http://bugs.debian.org/264024). | ||
10 | |||
11 | ssh: Enable HashKnownHosts by default to try to limit the spread of ssh | ||
12 | worms. | ||
13 | |||
14 | ssh: Enable GSSAPIAuthentication and disable GSSAPIDelegateCredentials by | ||
15 | default. | ||
16 | |||
17 | sshd: Refer to /usr/share/doc/openssh-server/README.Debian.gz alongside | ||
18 | PermitRootLogin default. | ||
19 | |||
20 | Document all of this, along with several sshd defaults set in | ||
21 | debian/openssh-server.postinst. | ||
22 | |||
23 | Author: Russ Allbery <rra@debian.org> | ||
24 | Forwarded: not-needed | ||
25 | Last-Update: 2015-08-19 | ||
26 | |||
27 | Patch-Name: debian-config.patch | ||
28 | --- | ||
29 | readconf.c | 2 +- | ||
30 | ssh_config | 7 ++++++- | ||
31 | ssh_config.5 | 19 ++++++++++++++++++- | ||
32 | sshd_config | 3 ++- | ||
33 | sshd_config.5 | 25 +++++++++++++++++++++++++ | ||
34 | 5 files changed, 52 insertions(+), 4 deletions(-) | ||
35 | |||
36 | diff --git a/readconf.c b/readconf.c | ||
37 | index 5f6c37f..f0769b5 100644 | ||
38 | --- a/readconf.c | ||
39 | +++ b/readconf.c | ||
40 | @@ -1748,7 +1748,7 @@ fill_default_options(Options * options) | ||
41 | if (options->forward_x11 == -1) | ||
42 | options->forward_x11 = 0; | ||
43 | if (options->forward_x11_trusted == -1) | ||
44 | - options->forward_x11_trusted = 0; | ||
45 | + options->forward_x11_trusted = 1; | ||
46 | if (options->forward_x11_timeout == -1) | ||
47 | options->forward_x11_timeout = 1200; | ||
48 | if (options->exit_on_forward_failure == -1) | ||
49 | diff --git a/ssh_config b/ssh_config | ||
50 | index 228e5ab..c9386aa 100644 | ||
51 | --- a/ssh_config | ||
52 | +++ b/ssh_config | ||
53 | @@ -17,9 +17,10 @@ | ||
54 | # list of available options, their meanings and defaults, please see the | ||
55 | # ssh_config(5) man page. | ||
56 | |||
57 | -# Host * | ||
58 | +Host * | ||
59 | # ForwardAgent no | ||
60 | # ForwardX11 no | ||
61 | +# ForwardX11Trusted yes | ||
62 | # RhostsRSAAuthentication no | ||
63 | # RSAAuthentication yes | ||
64 | # PasswordAuthentication yes | ||
65 | @@ -48,3 +49,7 @@ | ||
66 | # VisualHostKey no | ||
67 | # ProxyCommand ssh -q -W %h:%p gateway.example.com | ||
68 | # RekeyLimit 1G 1h | ||
69 | + SendEnv LANG LC_* | ||
70 | + HashKnownHosts yes | ||
71 | + GSSAPIAuthentication yes | ||
72 | + GSSAPIDelegateCredentials no | ||
73 | diff --git a/ssh_config.5 b/ssh_config.5 | ||
74 | index acd581b..844d1a0 100644 | ||
75 | --- a/ssh_config.5 | ||
76 | +++ b/ssh_config.5 | ||
77 | @@ -74,6 +74,22 @@ Since the first obtained value for each parameter is used, more | ||
78 | host-specific declarations should be given near the beginning of the | ||
79 | file, and general defaults at the end. | ||
80 | .Pp | ||
81 | +Note that the Debian | ||
82 | +.Ic openssh-client | ||
83 | +package sets several options as standard in | ||
84 | +.Pa /etc/ssh/ssh_config | ||
85 | +which are not the default in | ||
86 | +.Xr ssh 1 : | ||
87 | +.Pp | ||
88 | +.Bl -bullet -offset indent -compact | ||
89 | +.It | ||
90 | +.Cm SendEnv No LANG LC_* | ||
91 | +.It | ||
92 | +.Cm HashKnownHosts No yes | ||
93 | +.It | ||
94 | +.Cm GSSAPIAuthentication No yes | ||
95 | +.El | ||
96 | +.Pp | ||
97 | The configuration file has the following format: | ||
98 | .Pp | ||
99 | Empty lines and lines starting with | ||
100 | @@ -716,7 +732,8 @@ token used for the session will be set to expire after 20 minutes. | ||
101 | Remote clients will be refused access after this time. | ||
102 | .Pp | ||
103 | The default is | ||
104 | -.Dq no . | ||
105 | +.Dq yes | ||
106 | +(Debian-specific). | ||
107 | .Pp | ||
108 | See the X11 SECURITY extension specification for full details on | ||
109 | the restrictions imposed on untrusted clients. | ||
110 | diff --git a/sshd_config b/sshd_config | ||
111 | index 1dfd0f1..23a338f 100644 | ||
112 | --- a/sshd_config | ||
113 | +++ b/sshd_config | ||
114 | @@ -41,7 +41,8 @@ | ||
115 | # Authentication: | ||
116 | |||
117 | #LoginGraceTime 2m | ||
118 | -#PermitRootLogin no | ||
119 | +# See /usr/share/doc/openssh-server/README.Debian.gz. | ||
120 | +#PermitRootLogin without-password | ||
121 | #StrictModes yes | ||
122 | #MaxAuthTries 6 | ||
123 | #MaxSessions 10 | ||
124 | diff --git a/sshd_config.5 b/sshd_config.5 | ||
125 | index 355b445..eb6bff8 100644 | ||
126 | --- a/sshd_config.5 | ||
127 | +++ b/sshd_config.5 | ||
128 | @@ -57,6 +57,31 @@ Arguments may optionally be enclosed in double quotes | ||
129 | .Pq \&" | ||
130 | in order to represent arguments containing spaces. | ||
131 | .Pp | ||
132 | +Note that the Debian | ||
133 | +.Ic openssh-server | ||
134 | +package sets several options as standard in | ||
135 | +.Pa /etc/ssh/sshd_config | ||
136 | +which are not the default in | ||
137 | +.Xr sshd 8 . | ||
138 | +The exact list depends on whether the package was installed fresh or | ||
139 | +upgraded from various possible previous versions, but includes at least the | ||
140 | +following: | ||
141 | +.Pp | ||
142 | +.Bl -bullet -offset indent -compact | ||
143 | +.It | ||
144 | +.Cm ChallengeResponseAuthentication No no | ||
145 | +.It | ||
146 | +.Cm X11Forwarding No yes | ||
147 | +.It | ||
148 | +.Cm PrintMotd No no | ||
149 | +.It | ||
150 | +.Cm AcceptEnv No LANG LC_* | ||
151 | +.It | ||
152 | +.Cm Subsystem No sftp /usr/lib/openssh/sftp-server | ||
153 | +.It | ||
154 | +.Cm UsePAM No yes | ||
155 | +.El | ||
156 | +.Pp | ||
157 | The possible | ||
158 | keywords and their meanings are as follows (note that | ||
159 | keywords are case-insensitive and arguments are case-sensitive): | ||