1 files changed, 48 insertions, 19 deletions

diff --git a/debian/patches/debian-config.patch b/debian/patches/debian-config.patch
index e5c690915..35c71b0e9 100644
--- a/debian/patches/debian-config.patch
+++ b/debian/patches/debian-config.patch
@@ -1,4 +1,4 @@
-From cc80ecc65d57a9e68ce84d67bcfece281ffa0e9f Mon Sep 17 00:00:00 2001
+From 8086961f9f4ad834e9c3b09b6e2c80273be1c506 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:18 +0000
 Subject: Various Debian-specific configuration changes
@@ -13,6 +13,8 @@ worms.
 
 ssh: Enable GSSAPIAuthentication by default.
 
+ssh: Include /etc/ssh/ssh_config.d/*.conf.
+
 sshd: Enable PAM, disable ChallengeResponseAuthentication, and disable
 PrintMotd.
 
@@ -22,21 +24,23 @@ sshd: Set 'AcceptEnv LANG LC_*' by default.
 
 sshd: Change sftp subsystem path to /usr/lib/openssh/sftp-server.
 
+sshd: Include /etc/ssh/sshd_config.d/*.conf.
+
 Document all of this.
 
 Author: Russ Allbery <rra@debian.org>
 Forwarded: not-needed
-Last-Update: 2020-02-19
+Last-Update: 2020-02-21
 
 Patch-Name: debian-config.patch
 ---
  readconf.c    |  2 +-
  ssh.1         | 24 ++++++++++++++++++++++++
- ssh_config    |  6 +++++-
- ssh_config.5  | 19 ++++++++++++++++++-
- sshd_config   | 16 ++++++++++------
- sshd_config.5 | 22 ++++++++++++++++++++++
- 6 files changed, 80 insertions(+), 9 deletions(-)
+ ssh_config    |  8 +++++++-
+ ssh_config.5  | 26 +++++++++++++++++++++++++-
+ sshd_config   | 18 ++++++++++++------
+ sshd_config.5 | 29 +++++++++++++++++++++++++++++
+ 6 files changed, 98 insertions(+), 9 deletions(-)
 
 diff --git a/readconf.c b/readconf.c
 index 7f251dd4a..e82024678 100644
@@ -94,14 +98,16 @@ index b33a8049f..a8967c2f8 100644
  Send log information using the
  .Xr syslog 3
 diff --git a/ssh_config b/ssh_config
-index 1ff999b68..6dd6ecf87 100644
+index 1ff999b68..8a55237b9 100644
 --- a/ssh_config
 +++ b/ssh_config
-@@ -17,9 +17,10 @@
+@@ -17,9 +17,12 @@
  # list of available options, their meanings and defaults, please see the
  # ssh_config(5) man page.
  
 -# Host *
++Include /etc/ssh/ssh_config.d/*.conf
++
 +Host *
  #   ForwardAgent no
  #   ForwardX11 no
@@ -109,7 +115,7 @@ index 1ff999b68..6dd6ecf87 100644
  #   PasswordAuthentication yes
  #   HostbasedAuthentication no
  #   GSSAPIAuthentication no
-@@ -45,3 +46,6 @@
+@@ -45,3 +48,6 @@
  #   VisualHostKey no
  #   ProxyCommand ssh -q -W %h:%p gateway.example.com
  #   RekeyLimit 1G 1h
@@ -117,10 +123,10 @@ index 1ff999b68..6dd6ecf87 100644
 +    HashKnownHosts yes
 +    GSSAPIAuthentication yes
 diff --git a/ssh_config.5 b/ssh_config.5
-index c6eaa63e7..5c90d3e02 100644
+index c6eaa63e7..34dc2d51b 100644
 --- a/ssh_config.5
 +++ b/ssh_config.5
-@@ -71,6 +71,22 @@ Since the first obtained value for each parameter is used, more
+@@ -71,6 +71,29 @@ Since the first obtained value for each parameter is used, more
  host-specific declarations should be given near the beginning of the
  file, and general defaults at the end.
  .Pp
@@ -133,6 +139,8 @@ index c6eaa63e7..5c90d3e02 100644
 +.Pp
 +.Bl -bullet -offset indent -compact
 +.It
++.Cm Include /etc/ssh/ssh_config.d/*.conf
++.It
 +.Cm SendEnv No LANG LC_*
 +.It
 +.Cm HashKnownHosts No yes
@@ -140,10 +148,15 @@ index c6eaa63e7..5c90d3e02 100644
 +.Cm GSSAPIAuthentication No yes
 +.El
 +.Pp
++.Pa /etc/ssh/ssh_config.d/*.conf
++files are included at the start of the system-wide configuration file, so
++options set there will override those in
++.Pa /etc/ssh/ssh_config.
++.Pp
  The file contains keyword-argument pairs, one per line.
  Lines starting with
  .Ql #
-@@ -729,11 +745,12 @@ elapsed.
+@@ -729,11 +752,12 @@ elapsed.
  .It Cm ForwardX11Trusted
  If this option is set to
  .Cm yes ,
@@ -158,10 +171,19 @@ index c6eaa63e7..5c90d3e02 100644
  from stealing or tampering with data belonging to trusted X11
  clients.
 diff --git a/sshd_config b/sshd_config
-index 2c48105f8..ed8272f6d 100644
+index 2c48105f8..459c1b230 100644
 --- a/sshd_config
 +++ b/sshd_config
-@@ -57,8 +57,9 @@ AuthorizedKeysFile    .ssh/authorized_keys
+@@ -10,6 +10,8 @@
+ # possible, but leave them commented.  Uncommented options override the
+ # default value.
+ 
++Include /etc/ssh/sshd_config.d/*.conf
++
+ #Port 22
+ #AddressFamily any
+ #ListenAddress 0.0.0.0
+@@ -57,8 +59,9 @@ AuthorizedKeysFile    .ssh/authorized_keys
  #PasswordAuthentication yes
  #PermitEmptyPasswords no
  
@@ -173,7 +195,7 @@ index 2c48105f8..ed8272f6d 100644
  
  # Kerberos options
  #KerberosAuthentication no
-@@ -81,16 +82,16 @@ AuthorizedKeysFile  .ssh/authorized_keys
+@@ -81,16 +84,16 @@ AuthorizedKeysFile  .ssh/authorized_keys
  # If you just want the PAM account and session checks to run without
  # PAM authentication, then enable this but set PasswordAuthentication
  # and ChallengeResponseAuthentication to 'no'.
@@ -193,7 +215,7 @@ index 2c48105f8..ed8272f6d 100644
  #PrintLastLog yes
  #TCPKeepAlive yes
  #PermitUserEnvironment no
-@@ -107,8 +108,11 @@ AuthorizedKeysFile .ssh/authorized_keys
+@@ -107,8 +110,11 @@ AuthorizedKeysFile .ssh/authorized_keys
  # no default banner path
  #Banner none
  
@@ -207,10 +229,10 @@ index 2c48105f8..ed8272f6d 100644
  # Example of overriding settings on a per-user basis
  #Match User anoncvs
 diff --git a/sshd_config.5 b/sshd_config.5
-index 25f4b8117..b8bea2ad7 100644
+index 25f4b8117..e8271be74 100644
 --- a/sshd_config.5
 +++ b/sshd_config.5
-@@ -56,6 +56,28 @@ Arguments may optionally be enclosed in double quotes
+@@ -56,6 +56,35 @@ Arguments may optionally be enclosed in double quotes
  .Pq \&"
  in order to represent arguments containing spaces.
  .Pp
@@ -223,6 +245,8 @@ index 25f4b8117..b8bea2ad7 100644
 +.Pp
 +.Bl -bullet -offset indent -compact
 +.It
++.Cm Include /etc/ssh/sshd_config.d/*.conf
++.It
 +.Cm ChallengeResponseAuthentication No no
 +.It
 +.Cm X11Forwarding No yes
@@ -236,6 +260,11 @@ index 25f4b8117..b8bea2ad7 100644
 +.Cm UsePAM No yes
 +.El
 +.Pp
++.Pa /etc/ssh/sshd_config.d/*.conf
++files are included at the start of the configuration file, so options set
++there will override those in
++.Pa /etc/ssh/sshd_config.
++.Pp
  The possible
  keywords and their meanings are as follows (note that
  keywords are case-insensitive and arguments are case-sensitive):