diff options
Diffstat (limited to 'debian')
131 files changed, 15898 insertions, 0 deletions
diff --git a/debian/.git-dpm b/debian/.git-dpm new file mode 100644 index 000000000..6c8df34b8 --- /dev/null +++ b/debian/.git-dpm | |||
@@ -0,0 +1,8 @@ | |||
1 | # see git-dpm(1) from git-dpm package | ||
2 | 904bc482ad87648a2c799c441dc6a8449f24e15a | ||
3 | 904bc482ad87648a2c799c441dc6a8449f24e15a | ||
4 | 971a7653746a6972b907dfe0ce139c06e4a6f482 | ||
5 | 971a7653746a6972b907dfe0ce139c06e4a6f482 | ||
6 | openssh_7.4p1.orig.tar.gz | ||
7 | 2330bbf82ed08cf3ac70e0acf00186ef3eeb97e0 | ||
8 | 1511780 | ||
diff --git a/debian/.gitignore b/debian/.gitignore new file mode 100644 index 000000000..3c767d5e5 --- /dev/null +++ b/debian/.gitignore | |||
@@ -0,0 +1,18 @@ | |||
1 | /*.debhelper* | ||
2 | /*substvars | ||
3 | /build-deb | ||
4 | /build-deb-ssh1 | ||
5 | /build-udeb | ||
6 | /files | ||
7 | /keygen-test/key1 | ||
8 | /keygen-test/key1.pub | ||
9 | /keygen-test/key2 | ||
10 | /keygen-test/key2.pub | ||
11 | /openssh-client | ||
12 | /openssh-client-udeb | ||
13 | /openssh-server | ||
14 | /openssh-server-udeb | ||
15 | /ssh | ||
16 | /ssh-askpass-gnome | ||
17 | /ssh-krb5 | ||
18 | /tmp | ||
diff --git a/debian/NEWS b/debian/NEWS new file mode 100644 index 000000000..77c594c5a --- /dev/null +++ b/debian/NEWS | |||
@@ -0,0 +1,156 @@ | |||
1 | openssh (1:7.4p1-7) unstable; urgency=medium | ||
2 | |||
3 | This version restores the default for AuthorizedKeysFile to search both | ||
4 | ~/.ssh/authorized_keys and ~/.ssh/authorized_keys2, as was the case in | ||
5 | Debian configurations before 1:7.4p1-1. Upstream intends to phase out | ||
6 | searching ~/.ssh/authorized_keys2 by default, so you should ensure that | ||
7 | you are only using ~/.ssh/authorized_keys, at least for critical | ||
8 | administrative access; do not assume that the current default will remain | ||
9 | in place forever. | ||
10 | |||
11 | -- Colin Watson <cjwatson@debian.org> Sun, 05 Mar 2017 02:12:42 +0000 | ||
12 | |||
13 | openssh (1:7.4p1-1) unstable; urgency=medium | ||
14 | |||
15 | OpenSSH 7.4 includes a number of changes that may affect existing | ||
16 | configurations: | ||
17 | |||
18 | * ssh(1): Remove 3des-cbc from the client's default proposal. 64-bit | ||
19 | block ciphers are not safe in 2016 and we don't want to wait until | ||
20 | attacks like SWEET32 are extended to SSH. As 3des-cbc was the only | ||
21 | mandatory cipher in the SSH RFCs, this may cause problems connecting to | ||
22 | older devices using the default configuration, but it's highly likely | ||
23 | that such devices already need explicit configuration for key exchange | ||
24 | and hostkey algorithms already anyway. | ||
25 | * sshd(8): Remove support for pre-authentication compression. Doing | ||
26 | compression early in the protocol probably seemed reasonable in the | ||
27 | 1990s, but today it's clearly a bad idea in terms of both cryptography | ||
28 | (cf. multiple compression oracle attacks in TLS) and attack surface. | ||
29 | Pre-auth compression support has been disabled by default for >10 | ||
30 | years. Support remains in the client. | ||
31 | * ssh-agent will refuse to load PKCS#11 modules outside a whitelist of | ||
32 | trusted paths by default. The path whitelist may be specified at | ||
33 | run-time. | ||
34 | * sshd(8): When a forced-command appears in both a certificate and an | ||
35 | authorized keys/principals command= restriction, sshd will now refuse | ||
36 | to accept the certificate unless they are identical. The previous | ||
37 | (documented) behaviour of having the certificate forced-command | ||
38 | override the other could be a bit confusing and error-prone. | ||
39 | * sshd(8): Remove the UseLogin configuration directive and support for | ||
40 | having /bin/login manage login sessions. | ||
41 | |||
42 | The unprivileged sshd process that deals with pre-authentication network | ||
43 | traffic is now subject to additional sandboxing restrictions by default: | ||
44 | that is, the default sshd_config now sets UsePrivilegeSeparation to | ||
45 | "sandbox" rather than "yes". This has been the case upstream for a while, | ||
46 | but until now the Debian configuration diverged unnecessarily. | ||
47 | |||
48 | -- Colin Watson <cjwatson@debian.org> Tue, 27 Dec 2016 18:01:46 +0000 | ||
49 | |||
50 | openssh (1:7.2p1-1) unstable; urgency=medium | ||
51 | |||
52 | OpenSSH 7.2 disables a number of legacy cryptographic algorithms by | ||
53 | default in ssh: | ||
54 | |||
55 | * Several ciphers blowfish-cbc, cast128-cbc, all arcfour variants and the | ||
56 | rijndael-cbc aliases for AES. | ||
57 | * MD5-based and truncated HMAC algorithms. | ||
58 | |||
59 | These algorithms are already disabled by default in sshd. | ||
60 | |||
61 | -- Colin Watson <cjwatson@debian.org> Tue, 08 Mar 2016 11:47:20 +0000 | ||
62 | |||
63 | openssh (1:7.1p1-2) unstable; urgency=medium | ||
64 | |||
65 | OpenSSH 7.0 disables several pieces of weak, legacy, and/or unsafe | ||
66 | cryptography. | ||
67 | |||
68 | * Support for the legacy SSH version 1 protocol is disabled by default at | ||
69 | compile time. Note that this also means that the Cipher keyword in | ||
70 | ssh_config(5) is effectively no longer usable; use Ciphers instead for | ||
71 | protocol 2. The openssh-client-ssh1 package includes "ssh1", "scp1", | ||
72 | and "ssh-keygen1" binaries which you can use if you have no alternative | ||
73 | way to connect to an outdated SSH1-only server; please contact the | ||
74 | server administrator or system vendor in such cases and ask them to | ||
75 | upgrade. | ||
76 | * Support for the 1024-bit diffie-hellman-group1-sha1 key exchange is | ||
77 | disabled by default at run-time. It may be re-enabled using the | ||
78 | instructions at http://www.openssh.com/legacy.html | ||
79 | * Support for ssh-dss, ssh-dss-cert-* host and user keys is disabled by | ||
80 | default at run-time. These may be re-enabled using the instructions at | ||
81 | http://www.openssh.com/legacy.html | ||
82 | * Support for the legacy v00 cert format has been removed. | ||
83 | |||
84 | Future releases will retire more legacy cryptography, including: | ||
85 | |||
86 | * Refusing all RSA keys smaller than 1024 bits (the current minimum is | ||
87 | 768 bits). | ||
88 | * Several ciphers will be disabled by default: blowfish-cbc, cast128-cbc, | ||
89 | all arcfour variants, and the rijndael-cbc aliases for AES. | ||
90 | * MD5-based HMAC algorithms will be disabled by default. | ||
91 | |||
92 | -- Colin Watson <cjwatson@debian.org> Tue, 08 Dec 2015 15:33:08 +0000 | ||
93 | |||
94 | openssh (1:6.9p1-1) unstable; urgency=medium | ||
95 | |||
96 | UseDNS now defaults to 'no'. Configurations that match against the client | ||
97 | host name (via sshd_config or authorized_keys) may need to re-enable it or | ||
98 | convert to matching against addresses. | ||
99 | |||
100 | -- Colin Watson <cjwatson@debian.org> Thu, 20 Aug 2015 10:38:58 +0100 | ||
101 | |||
102 | openssh (1:6.7p1-5) unstable; urgency=medium | ||
103 | |||
104 | openssh-server 1:6.7p1-4 changed the default setting of AcceptEnv to list | ||
105 | a number of specific LC_FOO variables rather than the wildcard LC_*. I | ||
106 | have since been persuaded that this was a bad idea and have reverted it, | ||
107 | but it is difficult to automatically undo the change to | ||
108 | /etc/ssh/sshd_config without compounding the problem (that of modifying | ||
109 | configuration that some users did not want to be modified) further. Most | ||
110 | users who upgraded via version 1:6.7p1-4 should restore the previous value | ||
111 | of "AcceptEnv LANG LC_*" in /etc/ssh/sshd_config. | ||
112 | |||
113 | -- Colin Watson <cjwatson@debian.org> Sun, 22 Mar 2015 23:09:32 +0000 | ||
114 | |||
115 | openssh (1:5.4p1-2) unstable; urgency=low | ||
116 | |||
117 | Smartcard support is now available using PKCS#11 tokens. If you were | ||
118 | previously using an unofficial build of Debian's OpenSSH package with | ||
119 | OpenSC-based smartcard support added, then note that commands like | ||
120 | 'ssh-add -s 0' will no longer work; you need to use 'ssh-add -s | ||
121 | /usr/lib/opensc-pkcs11.so' instead. | ||
122 | |||
123 | -- Colin Watson <cjwatson@debian.org> Sat, 10 Apr 2010 01:08:59 +0100 | ||
124 | |||
125 | openssh (1:3.8.1p1-9) experimental; urgency=low | ||
126 | |||
127 | The ssh package has been split into openssh-client and openssh-server. If | ||
128 | you had previously requested that the sshd server should not be run, then | ||
129 | that request will still be honoured. However, the recommended approach is | ||
130 | now to remove the openssh-server package if you do not want to run sshd. | ||
131 | You can remove the old /etc/ssh/sshd_not_to_be_run marker file after doing | ||
132 | that. | ||
133 | |||
134 | -- Colin Watson <cjwatson@debian.org> Mon, 2 Aug 2004 20:48:54 +0100 | ||
135 | |||
136 | openssh (1:3.5p1-1) unstable; urgency=low | ||
137 | |||
138 | This version of OpenSSH disables the environment option for public keys by | ||
139 | default, in order to avoid certain attacks (for example, LD_PRELOAD). If | ||
140 | you are using this option in an authorized_keys file, beware that the keys | ||
141 | in question will no longer work until the option is removed. | ||
142 | |||
143 | To re-enable this option, set "PermitUserEnvironment yes" in | ||
144 | /etc/ssh/sshd_config after the upgrade is complete, taking note of the | ||
145 | warning in the sshd_config(5) manual page. | ||
146 | |||
147 | -- Colin Watson <cjwatson@debian.org> Sat, 26 Oct 2002 19:41:51 +0100 | ||
148 | |||
149 | openssh (1:3.0.1p1-1) unstable; urgency=high | ||
150 | |||
151 | As of version 3, OpenSSH no longer uses separate files for ssh1 and ssh2 | ||
152 | keys. This means the authorized_keys2 and known_hosts2 files are no longer | ||
153 | needed. They will still be read in order to maintain backward | ||
154 | compatibility. | ||
155 | |||
156 | -- Matthew Vernon <matthew@debian.org> Thu, 28 Nov 2001 17:43:01 +0000 | ||
diff --git a/debian/README.Debian b/debian/README.Debian new file mode 100644 index 000000000..73b7cfc89 --- /dev/null +++ b/debian/README.Debian | |||
@@ -0,0 +1,257 @@ | |||
1 | OpenSSH for Debian | ||
2 | ------------------ | ||
3 | |||
4 | UPGRADE ISSUES | ||
5 | ============== | ||
6 | |||
7 | Privilege Separation | ||
8 | -------------------- | ||
9 | |||
10 | As of 3.3, openssh has employed privilege separation to reduce the | ||
11 | quantity of code that runs as root, thereby reducing the impact of | ||
12 | some security holes in sshd. This now also works properly with PAM. | ||
13 | |||
14 | Privilege separation is turned on by default, so, if you decide you | ||
15 | want it turned off, you need to add "UsePrivilegeSeparation no" to | ||
16 | /etc/ssh/sshd_config. | ||
17 | |||
18 | PermitRootLogin | ||
19 | --------------- | ||
20 | |||
21 | As of 1:6.6p1-1, new installations will be set to "PermitRootLogin | ||
22 | without-password" (or the synonymous "PermitRootLogin prohibit-password" as | ||
23 | of 1:7.1p1-1). This disables password authentication for root, foiling | ||
24 | password dictionary attacks on the root user. Some sites may wish to use | ||
25 | the stronger "PermitRootLogin forced-commands-only" or "PermitRootLogin no", | ||
26 | but note that "PermitRootLogin no" will break setups that SSH to root with a | ||
27 | forced command to take full-system backups. You can use PermitRootLogin in | ||
28 | a Match block if you want finer-grained control here. | ||
29 | |||
30 | For many years Debian's OpenSSH packaging used "PermitRootLogin yes", in | ||
31 | line with upstream. To avoid breaking local setups, this is still true for | ||
32 | installations upgraded from before 1:6.6p1-1. If you wish to change this, | ||
33 | you should edit /etc/ssh/sshd_config, change it manually, and run "service | ||
34 | ssh restart" as root. | ||
35 | |||
36 | Disabling PermitRootLogin means that an attacker possessing credentials for | ||
37 | the root account (any credentials in the case of "yes", or private key | ||
38 | material in the case of "prohibit-password") must compromise a normal user | ||
39 | account rather than being able to SSH directly to root. Be careful to avoid | ||
40 | a false illusion of security if you change this setting; any account you | ||
41 | escalate to root from should be considered equivalent to root for the | ||
42 | purposes of security against external attack. You might for example disable | ||
43 | it if you know you will only ever log in as root from the physical console. | ||
44 | |||
45 | Since the root account does not generally have non-password credentials | ||
46 | unless you explicitly install an SSH public key in its | ||
47 | ~/.ssh/authorized_keys, which you presumably only do if you want to SSH to | ||
48 | it, "prohibit-password" should be a reasonable default for most sites. | ||
49 | |||
50 | As of OpenSSH 7.0, this is the upstream default. | ||
51 | |||
52 | For further discussion, see: | ||
53 | |||
54 | https://bugs.debian.org/298138 | ||
55 | https://bugzilla.mindrot.org/show_bug.cgi?id=2164 | ||
56 | |||
57 | X11 Forwarding | ||
58 | -------------- | ||
59 | |||
60 | ssh's default for ForwardX11 has been changed to ``no'' because it has | ||
61 | been pointed out that logging into remote systems administered by | ||
62 | untrusted people is likely to open you up to X11 attacks, so you | ||
63 | should have to actively decide that you trust the remote machine's | ||
64 | root, before enabling X11. I strongly recommend that you do this on a | ||
65 | machine-by-machine basis, rather than just enabling it in the default | ||
66 | host settings. | ||
67 | |||
68 | In order for X11 forwarding to work, you need to install xauth on the | ||
69 | server. In Debian this is in the xbase-clients package. | ||
70 | |||
71 | As of OpenSSH 3.1, the remote $DISPLAY uses localhost by default to reduce | ||
72 | the security risks of X11 forwarding. Look up X11UseLocalhost in | ||
73 | sshd_config(8) if this is a problem. | ||
74 | |||
75 | OpenSSH 3.8 invented ForwardX11Trusted, which when set to no causes the | ||
76 | ssh client to create an untrusted X cookie so that attacks on the | ||
77 | forwarded X11 connection can't become attacks on X clients on the remote | ||
78 | machine. However, this has some problems in implementation - notably a | ||
79 | very short timeout of the untrusted cookie - breaks large numbers of | ||
80 | existing setups, and generally seems immature. The Debian package | ||
81 | therefore sets the default for this option to "yes" (in ssh itself, | ||
82 | rather than in ssh_config). | ||
83 | |||
84 | Fallback to RSH | ||
85 | --------------- | ||
86 | |||
87 | The default for this setting has been changed from Yes to No, for | ||
88 | security reasons, and to stop the delay attempting to rsh to machines | ||
89 | that don't offer the service. Simply switch it back on in either | ||
90 | /etc/ssh/ssh_config or ~/.ssh/config for those machines that you need | ||
91 | it for. | ||
92 | |||
93 | Setgid ssh-agent and environment variables | ||
94 | ------------------------------------------ | ||
95 | |||
96 | As of version 1:3.5p1-1, ssh-agent is installed setgid to prevent ptrace() | ||
97 | attacks retrieving private key material. This has the side-effect of causing | ||
98 | glibc to remove certain environment variables which might have security | ||
99 | implications for set-id programs, including LD_PRELOAD, LD_LIBRARY_PATH, and | ||
100 | TMPDIR. | ||
101 | |||
102 | If you need to set any of these environment variables, you will need to do | ||
103 | so in the program exec()ed by ssh-agent. This may involve creating a small | ||
104 | wrapper script. | ||
105 | |||
106 | Symlink Hostname invocation | ||
107 | --------------------------- | ||
108 | |||
109 | This version of ssh no longer includes support for invoking ssh with the | ||
110 | hostname as the name of the file run. People wanting this support should | ||
111 | use the ssh-argv0 script. | ||
112 | |||
113 | =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= | ||
114 | |||
115 | OTHER ISSUES | ||
116 | ============ | ||
117 | |||
118 | Authorization Forwarding | ||
119 | ------------------------ | ||
120 | |||
121 | Similarly, root on a remote server could make use of your ssh-agent | ||
122 | (while you're logged into their machine) to obtain access to machines | ||
123 | which trust your keys. This feature is therefore disabled by default. | ||
124 | You should only re-enable it for those hosts (in your ~/.ssh/config or | ||
125 | /etc/ssh/ssh_config) where you are confident that the remote machine | ||
126 | is not a threat. | ||
127 | |||
128 | Problems logging in with RSA authentication | ||
129 | ------------------------------------------- | ||
130 | |||
131 | If you have trouble logging in with RSA authentication then the | ||
132 | problem is probably caused by the fact that you have your home | ||
133 | directory writable by group, as well as user (this is the default on | ||
134 | Debian systems). | ||
135 | |||
136 | Depending upon other settings on your system (i.e. other users being | ||
137 | in your group) this could open a security hole, so you will need to | ||
138 | make your home directory writable only by yourself. Run this command, | ||
139 | as yourself: | ||
140 | |||
141 | chmod g-w ~/ | ||
142 | |||
143 | to remove group write permissions. If you use ssh-copy-id to install your | ||
144 | keys, it does this for you. | ||
145 | |||
146 | -L option of ssh nonfree | ||
147 | ------------------------ | ||
148 | |||
149 | non-free ssh supported the usage of the option -L to use a non privileged | ||
150 | port for scp. This option will not be supported by scp from openssh. | ||
151 | |||
152 | Please use instead scp -o "UsePrivilegedPort=no" as documented in the | ||
153 | manpage to scp itself. | ||
154 | |||
155 | Problem logging in because of TCP-Wrappers | ||
156 | ------------------------------------------ | ||
157 | |||
158 | ssh is compiled with support for tcp-wrappers. So if you can no longer | ||
159 | log into your system, please check that /etc/hosts.allow and /etc/hosts.deny | ||
160 | are configured so that ssh is not blocked. | ||
161 | |||
162 | Kerberos support | ||
163 | ---------------- | ||
164 | |||
165 | ssh is now compiled with Kerberos support. Unfortunately, privilege | ||
166 | separation is incompatible with parts of Kerberos support for protocol 2; | ||
167 | you may need to run kinit after logging in. | ||
168 | |||
169 | Interoperability between scp and the ssh.com SSH server | ||
170 | ------------------------------------------------------- | ||
171 | |||
172 | In version 2 and greater of the commercial SSH server produced by SSH | ||
173 | Communications Security, scp was changed to use SFTP (SSH2's file transfer | ||
174 | protocol) instead of the traditional rcp-over-ssh, thereby breaking | ||
175 | compatibility. The OpenSSH developers regard this as a bug in the ssh.com | ||
176 | server, and do not currently intend to change OpenSSH's scp to match. | ||
177 | |||
178 | Workarounds for this problem are to install scp1 on the server (scp2 will | ||
179 | fall back to it), to use sftp, or to use some other transfer mechanism such | ||
180 | as rsync-over-ssh or tar-over-ssh. | ||
181 | |||
182 | Running sshd from inittab | ||
183 | ------------------------- | ||
184 | |||
185 | Some people find it useful to run the sshd server from inittab, to make sure | ||
186 | that it always stays running. To do this, stop sshd ('/etc/init.d/ssh | ||
187 | stop'), add the following line to /etc/inittab, and run 'telinit q': | ||
188 | |||
189 | ss:2345:respawn:/usr/sbin/sshd -D | ||
190 | |||
191 | If you do this, note that you will need to stop sshd being started in the | ||
192 | normal way ('update-rc.d ssh disable') and that you will need to restart | ||
193 | this sshd manually on upgrades. | ||
194 | |||
195 | Per-connection sshd instances with systemd | ||
196 | ------------------------------------------ | ||
197 | |||
198 | If you want to reconfigure systemd to listen on port 22 itself and launch an | ||
199 | instance of sshd for each connection (inetd-style socket activation), then | ||
200 | you can run: | ||
201 | |||
202 | systemctl stop ssh.service | ||
203 | systemctl start ssh.socket | ||
204 | |||
205 | To make this permanent: | ||
206 | |||
207 | systemctl disable ssh.service | ||
208 | systemctl enable ssh.socket | ||
209 | |||
210 | This may be appropriate in environments where minimal footprint is critical | ||
211 | (e.g. cloud guests). Be aware that this bypasses MaxStartups, and systemd's | ||
212 | MaxConnections cannot quite replace this as it cannot distinguish between | ||
213 | authenticated and unauthenticated connections; see | ||
214 | https://bugzilla.redhat.com/show_bug.cgi?id=963268 for more discussion. | ||
215 | |||
216 | The provided ssh.socket unit file sets ListenStream=22. If you need to have | ||
217 | it listen on a different address or port, then you will need to do this by | ||
218 | copying /lib/systemd/system/ssh.socket to /etc/systemd/system/ssh.socket and | ||
219 | modifying the ListenStream option. See systemd.socket(5) for details. | ||
220 | |||
221 | Terminating SSH sessions cleanly on shutdown/reboot with systemd | ||
222 | ---------------------------------------------------------------- | ||
223 | |||
224 | If you have libpam-systemd >= 230 installed (following openssh-server's | ||
225 | Recommends) and "UsePAM yes" in sshd_config (the default configuration | ||
226 | shipped by this package), then SSH sessions will be terminated cleanly when | ||
227 | the server is shut down or rebooted. | ||
228 | |||
229 | If either of these conditions does not hold, then you may find that SSH | ||
230 | sessions hang silently when the server is shut down or rebooted. If you do | ||
231 | not want to use PAM or configure it properly for whatever reason, then you | ||
232 | can instead copy | ||
233 | /usr/share/doc/openssh-server/examples/ssh-session-cleanup.service to | ||
234 | /etc/systemd/system/ and run "systemctl enable ssh-session-cleanup.service". | ||
235 | |||
236 | Non-systemd users may find /usr/lib/openssh/ssh-session-cleanup helpful if | ||
237 | they have a similar problem, although at present there is no system | ||
238 | integration for this for anything other than systemd. | ||
239 | |||
240 | SSH protocol 1 server support removed | ||
241 | ------------------------------------- | ||
242 | |||
243 | sshd(8) no longer supports the old SSH protocol 1, so all the configuration | ||
244 | options related to it are now deprecated and should be removed from | ||
245 | /etc/ssh/sshd_config. These are: | ||
246 | |||
247 | KeyRegenerationInterval | ||
248 | RSAAuthentication | ||
249 | RhostsRSAAuthentication | ||
250 | ServerKeyBits | ||
251 | |||
252 | The Protocol option is also no longer needed, although it is silently | ||
253 | ignored rather than deprecated. | ||
254 | |||
255 | -- | ||
256 | Matthew Vernon <matthew@debian.org> | ||
257 | Colin Watson <cjwatson@debian.org> | ||
diff --git a/debian/adjust-openssl-dependencies b/debian/adjust-openssl-dependencies new file mode 100755 index 000000000..9daa9b415 --- /dev/null +++ b/debian/adjust-openssl-dependencies | |||
@@ -0,0 +1,32 @@ | |||
1 | #! /bin/sh | ||
2 | # Attempt to tighten libssl dependencies to match the check in entropy.c. | ||
3 | # Must be run after dpkg-shlibdeps. | ||
4 | |||
5 | client=debian/openssh-client.substvars | ||
6 | server=debian/openssh-server.substvars | ||
7 | |||
8 | libssl_version="$(dpkg-query -W libssl-dev 2>/dev/null | cut -f2)" | ||
9 | if [ -z "$libssl_version" ]; then | ||
10 | echo "Can't find libssl-dev version; leaving dependencies alone." | ||
11 | exit 0 | ||
12 | fi | ||
13 | libssl_version="$(echo "$libssl_version" | sed 's/[a-z-].*//')" | ||
14 | |||
15 | libssl_package="$(sed -n 's/.*[= ]\(libssl[0-9][a-z0-9+.-]*\).*/\1/p' "$client")" | ||
16 | if [ "$libssl_package" ]; then | ||
17 | new_dep="$libssl_package (>= $libssl_version)" | ||
18 | sed -i "/^shlibs:Depends=/s/\$/, $new_dep/" "$client" | ||
19 | sed -i "/^shlibs:Depends=/s/\$/, $new_dep/" "$server" | ||
20 | fi | ||
21 | |||
22 | client_udeb=debian/openssh-client-udeb.substvars | ||
23 | server_udeb=debian/openssh-server-udeb.substvars | ||
24 | |||
25 | libcrypto_package="$(sed -n 's/.*[= ]\(libcrypto[0-9][a-z0-9+.-]*\).*/\1/p' "$client_udeb")" | ||
26 | if [ "$libcrypto_package" ]; then | ||
27 | new_dep="$libcrypto_package (>= $libssl_version)" | ||
28 | sed -i "/^shlibs:Depends=/s/\$/, $new_dep/" "$client_udeb" | ||
29 | sed -i "/^shlibs:Depends=/s/\$/, $new_dep/" "$server_udeb" | ||
30 | fi | ||
31 | |||
32 | exit 0 | ||
diff --git a/debian/agent-launch b/debian/agent-launch new file mode 100755 index 000000000..40479b868 --- /dev/null +++ b/debian/agent-launch | |||
@@ -0,0 +1,29 @@ | |||
1 | #!/bin/sh | ||
2 | # helper script for launching ssh-agent, used by systemd unit and upstart job | ||
3 | set -e | ||
4 | |||
5 | if [ ! -d "$XDG_RUNTIME_DIR" ]; then | ||
6 | echo 'This needs $XDG_RUNTIME_DIR to be set' >&2 | ||
7 | exit 1 | ||
8 | fi | ||
9 | |||
10 | if [ "$1" = start ]; then | ||
11 | if [ -z "$SSH_AUTH_SOCK" ] && grep -s -q '^use-ssh-agent$' /etc/X11/Xsession.options; then | ||
12 | S="$XDG_RUNTIME_DIR/openssh_agent" | ||
13 | dbus-update-activation-environment --verbose --systemd SSH_AUTH_SOCK=$S SSH_AGENT_LAUNCHER=openssh | ||
14 | if type initctl >/dev/null 2>&1; then | ||
15 | initctl set-env --global SSH_AUTH_SOCK=$S | ||
16 | fi | ||
17 | exec ssh-agent -D -a $S | ||
18 | fi | ||
19 | elif [ "$1" = stop ]; then | ||
20 | if [ "$SSH_AGENT_LAUNCHER" = openssh ]; then | ||
21 | dbus-update-activation-environment --systemd SSH_AUTH_SOCK= | ||
22 | if type initctl >/dev/null 2>&1; then | ||
23 | initctl unset-env --global SSH_AUTH_SOCK | ||
24 | fi | ||
25 | fi | ||
26 | else | ||
27 | echo "Unknown command $1" >&2 | ||
28 | exit 1 | ||
29 | fi | ||
diff --git a/debian/changelog b/debian/changelog new file mode 100644 index 000000000..4c1ffa30d --- /dev/null +++ b/debian/changelog | |||
@@ -0,0 +1,4687 @@ | |||
1 | openssh (1:7.4p1-10) UNRELEASED; urgency=medium | ||
2 | |||
3 | * Move privilege separation directory and PID file from /var/run/ to /run/ | ||
4 | (closes: #760422, #856825). | ||
5 | * Unbreak Unix domain socket forwarding for root (closes: #858252). | ||
6 | |||
7 | -- Colin Watson <cjwatson@debian.org> Wed, 29 Mar 2017 23:44:13 +0100 | ||
8 | |||
9 | openssh (1:7.4p1-9) unstable; urgency=medium | ||
10 | |||
11 | * Fix null pointer dereference in ssh-keygen; this fixes an autopkgtest | ||
12 | regression introduced in 1:7.4p1-8. | ||
13 | |||
14 | -- Colin Watson <cjwatson@debian.org> Thu, 16 Mar 2017 13:43:15 +0000 | ||
15 | |||
16 | openssh (1:7.4p1-8) unstable; urgency=medium | ||
17 | |||
18 | * Fix ssh-keygen -H accidentally corrupting known_hosts that contained | ||
19 | already-hashed entries (closes: #851734, LP: #1668093). | ||
20 | * Fix ssh-keyscan to correctly hash hosts with a port number (closes: | ||
21 | #857736, LP: #1670745). | ||
22 | |||
23 | -- Colin Watson <cjwatson@debian.org> Tue, 14 Mar 2017 13:49:14 +0000 | ||
24 | |||
25 | openssh (1:7.4p1-7) unstable; urgency=medium | ||
26 | |||
27 | * Don't set "PermitRootLogin yes" on fresh installations (regression | ||
28 | introduced in 1:7.4p1-1; closes: #852781). | ||
29 | * Restore reading authorized_keys2 by default. Upstream seems to intend | ||
30 | to gradually phase this out, so don't assume that this will remain the | ||
31 | default forever. However, we were late in adopting the upstream | ||
32 | sshd_config changes, so it makes sense to extend the grace period | ||
33 | (closes: #852320). | ||
34 | |||
35 | -- Colin Watson <cjwatson@debian.org> Sun, 05 Mar 2017 02:12:42 +0000 | ||
36 | |||
37 | openssh (1:7.4p1-6) unstable; urgency=medium | ||
38 | |||
39 | * Remove temporary file on exit from postinst (closes: #850275). | ||
40 | * Remove LOGIN_PROGRAM and LOGIN_NO_ENDOPT definitions, since UseLogin is | ||
41 | gone. | ||
42 | * Document sshd_config changes that may be needed following the removal of | ||
43 | protocol 1 support from sshd (closes: #851573). | ||
44 | * Remove ssh_host_dsa_key from HostKey default (closes: #850614). | ||
45 | * Fix rekeying failure with GSSAPI key exchange (thanks, Harald Barth; | ||
46 | closes: #819361, LP: #1608965). | ||
47 | |||
48 | -- Colin Watson <cjwatson@debian.org> Mon, 16 Jan 2017 15:11:10 +0000 | ||
49 | |||
50 | openssh (1:7.4p1-5) unstable; urgency=medium | ||
51 | |||
52 | * Create mux socket for regression tests in a temporary directory. | ||
53 | * Work around clock_gettime kernel bug on Linux x32 (closes: #849923). | ||
54 | |||
55 | -- Colin Watson <cjwatson@debian.org> Tue, 03 Jan 2017 14:43:28 +0000 | ||
56 | |||
57 | openssh (1:7.4p1-4) unstable; urgency=medium | ||
58 | |||
59 | * Run regression tests inside annotate-output to try to diagnose timeout | ||
60 | issues. | ||
61 | * Make integrity tests more robust against timeouts in the case where the | ||
62 | first test in a series for a given MAC happens to modify the low bytes | ||
63 | of a packet length. | ||
64 | * Fix race conditions in forwarding tests. | ||
65 | |||
66 | -- Colin Watson <cjwatson@debian.org> Mon, 02 Jan 2017 19:37:23 +0000 | ||
67 | |||
68 | openssh (1:7.4p1-3) unstable; urgency=medium | ||
69 | |||
70 | * Revert attempted hack around regress/forwarding.sh test failure, since | ||
71 | it doesn't seem to help. | ||
72 | * Run regression tests using 'sh -x' to try to get more information about | ||
73 | failures. | ||
74 | * Dump some useful log files if regression tests fail. | ||
75 | * Tweak regression test setup to cope with the case where some of the | ||
76 | source directory is unreadable by the openssh-tests user. | ||
77 | |||
78 | -- Colin Watson <cjwatson@debian.org> Sat, 31 Dec 2016 02:48:17 +0000 | ||
79 | |||
80 | openssh (1:7.4p1-2) unstable; urgency=medium | ||
81 | |||
82 | * Attempt to hack around regress/forwarding.sh test failure in some | ||
83 | environments. | ||
84 | * Avoid calling into Kerberos libraries from ssh_gssapi_server_mechanisms | ||
85 | in the privsep monitor. | ||
86 | |||
87 | -- Colin Watson <cjwatson@debian.org> Thu, 29 Dec 2016 12:02:12 +0000 | ||
88 | |||
89 | openssh (1:7.4p1-1) unstable; urgency=medium | ||
90 | |||
91 | * New upstream release (http://www.openssh.com/txt/release-7.4): | ||
92 | - ssh(1): Remove 3des-cbc from the client's default proposal. 64-bit | ||
93 | block ciphers are not safe in 2016 and we don't want to wait until | ||
94 | attacks like SWEET32 are extended to SSH. As 3des-cbc was the only | ||
95 | mandatory cipher in the SSH RFCs, this may cause problems connecting | ||
96 | to older devices using the default configuration, but it's highly | ||
97 | likely that such devices already need explicit configuration for key | ||
98 | exchange and hostkey algorithms already anyway. | ||
99 | - sshd(8): When a forced-command appears in both a certificate and an | ||
100 | authorized keys/principals command= restriction, sshd will now refuse | ||
101 | to accept the certificate unless they are identical. The previous | ||
102 | (documented) behaviour of having the certificate forced-command | ||
103 | override the other could be a bit confusing and error-prone. | ||
104 | - sshd(8): Remove the UseLogin configuration directive and support for | ||
105 | having /bin/login manage login sessions. | ||
106 | - CVE-2016-10009: ssh-agent(1): Will now refuse to load PKCS#11 modules | ||
107 | from paths outside a trusted whitelist (run-time configurable). | ||
108 | Requests to load modules could be passed via agent forwarding and an | ||
109 | attacker could attempt to load a hostile PKCS#11 module across the | ||
110 | forwarded agent channel: PKCS#11 modules are shared libraries, so this | ||
111 | would result in code execution on the system running the ssh-agent if | ||
112 | the attacker has control of the forwarded agent-socket (on the host | ||
113 | running the sshd server) and the ability to write to the filesystem of | ||
114 | the host running ssh-agent (usually the host running the ssh client) | ||
115 | (closes: #848714). | ||
116 | - CVE-2016-10010: sshd(8): When privilege separation is disabled, | ||
117 | forwarded Unix-domain sockets would be created by sshd(8) with the | ||
118 | privileges of 'root' instead of the authenticated user. This release | ||
119 | refuses Unix-domain socket forwarding when privilege separation is | ||
120 | disabled (Privilege separation has been enabled by default for 14 | ||
121 | years) (closes: #848715). | ||
122 | - CVE-2016-10011: sshd(8): Avoid theoretical leak of host private key | ||
123 | material to privilege-separated child processes via realloc() when | ||
124 | reading keys. No such leak was observed in practice for normal-sized | ||
125 | keys, nor does a leak to the child processes directly expose key | ||
126 | material to unprivileged users (closes: #848716). | ||
127 | - CVE-2016-10012: sshd(8): The shared memory manager used by | ||
128 | pre-authentication compression support had a bounds checks that could | ||
129 | be elided by some optimising compilers. Additionally, this memory | ||
130 | manager was incorrectly accessible when pre-authentication compression | ||
131 | was disabled. This could potentially allow attacks against the | ||
132 | privileged monitor process from the sandboxed privilege-separation | ||
133 | process (a compromise of the latter would be required first). This | ||
134 | release removes support for pre-authentication compression from | ||
135 | sshd(8) (closes: #848717). | ||
136 | - SECURITY: sshd(8): Validate address ranges for AllowUser and DenyUsers | ||
137 | directives at configuration load time and refuse to accept invalid | ||
138 | ones. It was previously possible to specify invalid CIDR address | ||
139 | ranges (e.g. user@127.1.2.3/55) and these would always match, possibly | ||
140 | resulting in granting access where it was not intended. | ||
141 | - ssh(1): Add a proxy multiplexing mode to ssh(1) inspired by the | ||
142 | version in PuTTY by Simon Tatham. This allows a multiplexing client | ||
143 | to communicate with the master process using a subset of the SSH | ||
144 | packet and channels protocol over a Unix-domain socket, with the main | ||
145 | process acting as a proxy that translates channel IDs, etc. This | ||
146 | allows multiplexing mode to run on systems that lack file-descriptor | ||
147 | passing (used by current multiplexing code) and potentially, in | ||
148 | conjunction with Unix-domain socket forwarding, with the client and | ||
149 | multiplexing master process on different machines. Multiplexing proxy | ||
150 | mode may be invoked using "ssh -O proxy ...". | ||
151 | - sshd(8): Add a sshd_config DisableForwarding option that disables X11, | ||
152 | agent, TCP, tunnel and Unix domain socket forwarding, as well as | ||
153 | anything else we might implement in the future. Like the 'restrict' | ||
154 | authorized_keys flag, this is intended to be a simple and future-proof | ||
155 | way of restricting an account. | ||
156 | - sshd(8), ssh(1): Support the "curve25519-sha256" key exchange method. | ||
157 | This is identical to the currently-supported method named | ||
158 | "curve25519-sha256@libssh.org". | ||
159 | - sshd(8): Improve handling of SIGHUP by checking to see if sshd is | ||
160 | already daemonised at startup and skipping the call to daemon(3) if it | ||
161 | is. This ensures that a SIGHUP restart of sshd(8) will retain the | ||
162 | same process-ID as the initial execution. sshd(8) will also now | ||
163 | unlink the PidFile prior to SIGHUP restart and re-create it after a | ||
164 | successful restart, rather than leaving a stale file in the case of a | ||
165 | configuration error. | ||
166 | - sshd(8): Allow ClientAliveInterval and ClientAliveCountMax directives | ||
167 | to appear in sshd_config Match blocks. | ||
168 | - sshd(8): Add %-escapes to AuthorizedPrincipalsCommand to match those | ||
169 | supported by AuthorizedKeysCommand (key, key type, fingerprint, etc.) | ||
170 | and a few more to provide access to the contents of the certificate | ||
171 | being offered. | ||
172 | - ssh(1): Allow IdentityFile to successfully load and use certificates | ||
173 | that have no corresponding bare public key. | ||
174 | - ssh(1): Fix public key authentication when multiple authentication is | ||
175 | in use and publickey is not just the first method attempted. | ||
176 | - ssh(1): Improve reporting when attempting to load keys from PKCS#11 | ||
177 | tokens with fewer useless log messages and more detail in debug | ||
178 | messages. | ||
179 | - ssh(1): When tearing down ControlMaster connections, don't pollute | ||
180 | stderr when LogLevel=quiet. | ||
181 | - sftp(1): On ^Z wait for underlying ssh(1) to suspend before suspending | ||
182 | sftp(1) to ensure that ssh(1) restores the terminal mode correctly if | ||
183 | suspended during a password prompt. | ||
184 | - ssh(1): Avoid busy-wait when ssh(1) is suspended during a password | ||
185 | prompt (LP: #1646813). | ||
186 | - ssh(1), sshd(8): Correctly report errors during sending of ext-info | ||
187 | messages. | ||
188 | - sshd(8): Fix NULL-deref crash if sshd(8) received an out-of-sequence | ||
189 | NEWKEYS message. | ||
190 | - sshd(8): Correct list of supported signature algorithms sent in the | ||
191 | server-sig-algs extension. | ||
192 | - sshd(8): Fix sending ext_info message if privsep is disabled. | ||
193 | - sshd(8): More strictly enforce the expected ordering of privilege | ||
194 | separation monitor calls used for authentication and allow them only | ||
195 | when their respective authentication methods are enabled in the | ||
196 | configuration. | ||
197 | - sshd_config(5): Use 2001:db8::/32, the official IPv6 subnet for | ||
198 | configuration examples. | ||
199 | - On environments configured with Turkish locales, fall back to the | ||
200 | C/POSIX locale to avoid errors in configuration parsing caused by that | ||
201 | locale's unique handling of the letters 'i' and 'I' (LP: #1638338). | ||
202 | - contrib: Add a gnome-ssh-askpass3 with GTK+3 support. | ||
203 | - sshd(8): Improve PRNG reseeding across privilege separation and force | ||
204 | libcrypto to obtain a high-quality seed before chroot or sandboxing. | ||
205 | * Apply "wrap-and-sort -at -f debian/control -f debian/tests/control". | ||
206 | * Remove entries related to protocol 1 from the default sshd_config | ||
207 | generated on new installations. | ||
208 | * Remove some advice related to protocol 1 from README.Debian. | ||
209 | * Start handling /etc/ssh/sshd_config using ucf. The immediate motivation | ||
210 | for this is to deal with deprecations of options related to protocol 1, | ||
211 | but something like this has been needed for a long time (closes: | ||
212 | #419574, #848089): | ||
213 | - sshd_config is now a slightly-patched version of upstream's, and only | ||
214 | contains non-default settings (closes: #147201). | ||
215 | - I've included as many historical md5sums of default versions of | ||
216 | sshd_config as I could reconstruct from version control, but I'm sure | ||
217 | I've missed some. | ||
218 | - Explicitly synchronise the debconf database with the current | ||
219 | configuration file state in openssh-server.config, to ensure that the | ||
220 | PermitRootLogin setting is properly preserved. | ||
221 | - UsePrivilegeSeparation now defaults to the stronger "sandbox" rather | ||
222 | than "yes", per upstream. | ||
223 | * Remove redundant "GSSAPIDelegateCredentials no" from ssh_config (already | ||
224 | the upstream default), and document that setting ServerAliveInterval to | ||
225 | 300 by default if BatchMode is set is Debian-specific (closes: #765630). | ||
226 | * Build gnome-ssh-askpass with GTK+ 3 (LP: #801187). | ||
227 | * When running regression tests under autopkgtest, use a non-root user | ||
228 | with passwordless sudo. | ||
229 | |||
230 | -- Colin Watson <cjwatson@debian.org> Tue, 27 Dec 2016 18:01:46 +0000 | ||
231 | |||
232 | openssh (1:7.3p1-5) unstable; urgency=medium | ||
233 | |||
234 | * debian/tests/control: Add dependency on openssl, required by the PuTTY | ||
235 | interoperability tests. | ||
236 | |||
237 | -- Colin Watson <cjwatson@debian.org> Sat, 03 Dec 2016 03:43:21 +0000 | ||
238 | |||
239 | openssh (1:7.3p1-4) unstable; urgency=medium | ||
240 | |||
241 | * Adjust Build-Depends further to avoid considering libssl-dev >= 1.1.0~ | ||
242 | as sufficient. | ||
243 | * Move build directories under debian/. | ||
244 | * Remove the non-upstream .gitignore file and add the relevant entries to | ||
245 | debian/.gitignore, in order to make the source tree more | ||
246 | dgit-compatible. | ||
247 | * Build all upstream regression test binaries using the new | ||
248 | "regress-binaries" target. | ||
249 | * Fix and enable PuTTY interoperability tests under autopkgtest. | ||
250 | |||
251 | -- Colin Watson <cjwatson@debian.org> Fri, 02 Dec 2016 20:49:30 +0000 | ||
252 | |||
253 | openssh (1:7.3p1-3) unstable; urgency=medium | ||
254 | |||
255 | * Avoid building with OpenSSL 1.1 for now (see #828475). | ||
256 | * Add a missing License line to debian/copyright. | ||
257 | * Policy version 3.9.8: no changes required. | ||
258 | |||
259 | -- Colin Watson <cjwatson@debian.org> Sat, 05 Nov 2016 15:37:15 +0000 | ||
260 | |||
261 | openssh (1:7.3p1-2) unstable; urgency=high | ||
262 | |||
263 | * Rewrite debian/copyright using copyright-format 1.0. | ||
264 | * CVE-2016-8858: Unregister the KEXINIT handler after message has been | ||
265 | received (closes: #841884). | ||
266 | |||
267 | -- Colin Watson <cjwatson@debian.org> Mon, 24 Oct 2016 11:18:00 +0100 | ||
268 | |||
269 | openssh (1:7.3p1-1) unstable; urgency=medium | ||
270 | |||
271 | * New upstream release (http://www.openssh.com/txt/release-7.3): | ||
272 | - SECURITY: sshd(8): Mitigate a potential denial-of-service attack | ||
273 | against the system's crypt(3) function via sshd(8). An attacker could | ||
274 | send very long passwords that would cause excessive CPU use in | ||
275 | crypt(3). sshd(8) now refuses to accept password authentication | ||
276 | requests of length greater than 1024 characters. | ||
277 | - SECURITY: ssh(1), sshd(8): Fix observable timing weakness in the CBC | ||
278 | padding oracle countermeasures. Note that CBC ciphers are disabled by | ||
279 | default and only included for legacy compatibility. | ||
280 | - SECURITY: ssh(1), sshd(8): Improve operation ordering of MAC | ||
281 | verification for Encrypt-then-MAC (EtM) mode transport MAC algorithms | ||
282 | to verify the MAC before decrypting any ciphertext. This removes the | ||
283 | possibility of timing differences leaking facts about the plaintext, | ||
284 | though no such leakage has been observed. | ||
285 | - ssh(1): Add a ProxyJump option and corresponding -J command-line flag | ||
286 | to allow simplified indirection through a one or more SSH bastions or | ||
287 | "jump hosts". | ||
288 | - ssh(1): Add an IdentityAgent option to allow specifying specific agent | ||
289 | sockets instead of accepting one from the environment. | ||
290 | - ssh(1): Allow ExitOnForwardFailure and ClearAllForwardings to be | ||
291 | optionally overridden when using ssh -W. | ||
292 | - ssh(1), sshd(8): Implement support for the IUTF8 terminal mode as per | ||
293 | draft-sgtatham-secsh-iutf8-00 (closes: #337041, LP: #394570). | ||
294 | - ssh(1), sshd(8): Add support for additional fixed Diffie-Hellman 2K, | ||
295 | 4K and 8K groups from draft-ietf-curdle-ssh-kex-sha2-03. | ||
296 | - ssh-keygen(1), ssh(1), sshd(8): Support SHA256 and SHA512 RSA | ||
297 | signatures in certificates. | ||
298 | - ssh(1): Add an Include directive for ssh_config(5) files (closes: | ||
299 | #536031). | ||
300 | - ssh(1): Permit UTF-8 characters in pre-authentication banners sent | ||
301 | from the server. | ||
302 | - ssh(1), sshd(8): Reduce the syslog level of some relatively common | ||
303 | protocol events from LOG_CRIT. | ||
304 | - sshd(8): Refuse AuthenticationMethods="" in configurations and accept | ||
305 | AuthenticationMethods=any for the default behaviour of not requiring | ||
306 | multiple authentication. | ||
307 | - sshd(8): Remove obsolete and misleading "POSSIBLE BREAK-IN ATTEMPT!" | ||
308 | message when forward and reverse DNS don't match. | ||
309 | - ssh(1): Deduplicate LocalForward and RemoteForward entries to fix | ||
310 | failures when both ExitOnForwardFailure and hostname canonicalisation | ||
311 | are enabled. | ||
312 | - sshd(8): Remove fallback from moduli to obsolete "primes" file that | ||
313 | was deprecated in 2001 (LP: #1528251). | ||
314 | - sshd_config(5): Correct description of UseDNS: it affects ssh hostname | ||
315 | processing for authorized_keys, not known_hosts. | ||
316 | - sshd(8): Send ClientAliveInterval pings when a time-based RekeyLimit | ||
317 | is set; previously keepalive packets were not being sent. | ||
318 | - sshd(8): Whitelist more architectures to enable the seccomp-bpf | ||
319 | sandbox. | ||
320 | - scp(1): Respect the local user's LC_CTYPE locale (closes: #396295). | ||
321 | - Take character display widths into account for the progressmeter | ||
322 | (closes: #407088). | ||
323 | |||
324 | -- Colin Watson <cjwatson@debian.org> Sun, 07 Aug 2016 22:45:26 +0100 | ||
325 | |||
326 | openssh (1:7.2p2-8) unstable; urgency=medium | ||
327 | |||
328 | [ Colin Watson ] | ||
329 | * Stop enabling ssh-session-cleanup.service by default; instead, ship it | ||
330 | as an example and add a section to README.Debian. libpam-systemd >= 230 | ||
331 | and "UsePAM yes" should take care of the original problem for most | ||
332 | systemd users (thanks, Michael Biebl; closes: #832155). | ||
333 | |||
334 | [ Martin Pitt ] | ||
335 | * Add debian/agent-launch: Helper script for conditionally starting the SSH | ||
336 | agent in the user session. Use it in ssh-agent.user-session.upstart. | ||
337 | * Add systemd user unit for graphical sessions that use systemd. Override | ||
338 | the corresponding upstart job in that case (closes: #832445). | ||
339 | * debian/openssh-server.if-up: Don't block on a finished reload of | ||
340 | openssh.service, to avoid deadlocking with restarting networking. | ||
341 | (closes: #832557, LP: #1584393) | ||
342 | |||
343 | -- Colin Watson <cjwatson@debian.org> Fri, 29 Jul 2016 02:51:32 +0100 | ||
344 | |||
345 | openssh (1:7.2p2-7) unstable; urgency=medium | ||
346 | |||
347 | * Don't stop the ssh-session-cleanup service on upgrade (closes: #832155). | ||
348 | This may cause SSH sessions to be killed on upgrade to *this* version if | ||
349 | you had previously installed 1:7.2p2-6. Sorry! If your session is | ||
350 | killed, you can recover using "dpkg --unpack" on this openssh-server | ||
351 | .deb, followed by "dpkg --configure -a". | ||
352 | * Recommend libpam-systemd from openssh-server. It's a much better | ||
353 | solution than the above for systemd users, but I'm wary of depending on | ||
354 | it in case I cause an assortment of exciting dependency problems on | ||
355 | upgrade for non-systemd users. | ||
356 | |||
357 | -- Colin Watson <cjwatson@debian.org> Sat, 23 Jul 2016 11:46:33 +0100 | ||
358 | |||
359 | openssh (1:7.2p2-6) unstable; urgency=medium | ||
360 | |||
361 | * debian/watch: Switch to HTTP (thanks, Nicholas Luedtke; closes: | ||
362 | #822997). | ||
363 | * Copy summary of supported SFTP protocol versions from upstream's | ||
364 | PROTOCOL file into the openssh-sftp-server package description (closes: | ||
365 | #766887). | ||
366 | * Set SSH_PROGRAM=/usr/bin/ssh1 when building openssh-client-ssh1 so that | ||
367 | scp1 works (reported by Olivier MATZ). | ||
368 | * Retroactively add a NEWS.Debian entry for the UseDNS change in 6.9 (see | ||
369 | LP #1588457). | ||
370 | * CVE-2016-6210: Mitigate user enumeration via covert timing channel | ||
371 | (closes: #831902). | ||
372 | * Backport upstream patch to close ControlPersist background process | ||
373 | stderr when not in debug mode or when logging to a file or syslog | ||
374 | (closes: #714526). | ||
375 | * Add a session cleanup script and a systemd unit file to trigger it, | ||
376 | which serves to terminate SSH sessions cleanly if systemd doesn't do | ||
377 | that itself, often because libpam-systemd is not installed (thanks, | ||
378 | Vivek Das Mohapatra, Tom Hutter, and others; closes: #751636). | ||
379 | * Stop generating DSA host keys by default (thanks, Santiago Vila; closes: | ||
380 | #823827). | ||
381 | |||
382 | -- Colin Watson <cjwatson@debian.org> Fri, 22 Jul 2016 17:06:19 +0100 | ||
383 | |||
384 | openssh (1:7.2p2-5) unstable; urgency=medium | ||
385 | |||
386 | * Backport upstream patch to unbreak authentication using lone certificate | ||
387 | keys in ssh-agent: when attempting pubkey auth with a certificate, if no | ||
388 | separate private key is found among the keys then try with the | ||
389 | certificate key itself (thanks, Paul Querna; LP: #1575961). | ||
390 | |||
391 | -- Colin Watson <cjwatson@debian.org> Thu, 28 Apr 2016 01:52:01 +0100 | ||
392 | |||
393 | openssh (1:7.2p2-4) unstable; urgency=medium | ||
394 | |||
395 | * Drop dependency on libnss-files-udeb (closes: #819686). | ||
396 | * Policy version 3.9.7: no changes required. | ||
397 | |||
398 | -- Colin Watson <cjwatson@debian.org> Fri, 15 Apr 2016 16:40:07 +0100 | ||
399 | |||
400 | openssh (1:7.2p2-3) unstable; urgency=high | ||
401 | |||
402 | * Change all openssh.org references to openssh.com (closes: #819213). | ||
403 | * CVE-2015-8325: Ignore PAM environment vars when UseLogin=yes. | ||
404 | |||
405 | -- Colin Watson <cjwatson@debian.org> Wed, 13 Apr 2016 16:42:28 +0100 | ||
406 | |||
407 | openssh (1:7.2p2-2) unstable; urgency=medium | ||
408 | |||
409 | * Fix kexgss_server to cope with DH_GRP_MIN/DH_GRP_MAX being stricter on | ||
410 | the server end than the client (thanks, Damien Miller; closes: #817870, | ||
411 | LP: #1558576). | ||
412 | |||
413 | -- Colin Watson <cjwatson@debian.org> Mon, 21 Mar 2016 12:08:55 +0000 | ||
414 | |||
415 | openssh (1:7.2p2-1) unstable; urgency=high | ||
416 | |||
417 | * New upstream release (http://www.openssh.com/txt/release-7.2p2): | ||
418 | - CVE-2016-3115: sshd(8): Sanitise X11 authentication credentials to | ||
419 | avoid xauth command injection when X11Forwarding is enabled | ||
420 | (http://www.openssh.com/txt/x11fwd.adv). | ||
421 | |||
422 | -- Colin Watson <cjwatson@debian.org> Thu, 10 Mar 2016 13:04:29 +0000 | ||
423 | |||
424 | openssh (1:7.2p1-1) unstable; urgency=medium | ||
425 | |||
426 | * New upstream release (http://www.openssh.com/txt/release-7.2): | ||
427 | - This release disables a number of legacy cryptographic algorithms by | ||
428 | default in ssh: | ||
429 | + Several ciphers blowfish-cbc, cast128-cbc, all arcfour variants and | ||
430 | the rijndael-cbc aliases for AES. | ||
431 | + MD5-based and truncated HMAC algorithms. | ||
432 | These algorithms are already disabled by default in sshd. | ||
433 | - ssh(1), sshd(8): Remove unfinished and unused roaming code (was | ||
434 | already forcibly disabled in OpenSSH 7.1p2). | ||
435 | - ssh(1): Eliminate fallback from untrusted X11 forwarding to trusted | ||
436 | forwarding when the X server disables the SECURITY extension. | ||
437 | - ssh(1), sshd(8): Increase the minimum modulus size supported for | ||
438 | diffie-hellman-group-exchange to 2048 bits. | ||
439 | - sshd(8): Pre-auth sandboxing is now enabled by default (previous | ||
440 | releases enabled it for new installations via sshd_config). | ||
441 | - all: Add support for RSA signatures using SHA-256/512 hash algorithms | ||
442 | based on draft-rsa-dsa-sha2-256-03.txt and draft-ssh-ext-info-04.txt. | ||
443 | - ssh(1): Add an AddKeysToAgent client option which can be set to 'yes', | ||
444 | 'no', 'ask', or 'confirm', and defaults to 'no'. When enabled, a | ||
445 | private key that is used during authentication will be added to | ||
446 | ssh-agent if it is running (with confirmation enabled if set to | ||
447 | 'confirm'). | ||
448 | - sshd(8): Add a new authorized_keys option "restrict" that includes all | ||
449 | current and future key restrictions (no-*-forwarding, etc.). Also add | ||
450 | permissive versions of the existing restrictions, e.g. "no-pty" -> | ||
451 | "pty". This simplifies the task of setting up restricted keys and | ||
452 | ensures they are maximally-restricted, regardless of any permissions | ||
453 | we might implement in the future. | ||
454 | - ssh(1): Add ssh_config CertificateFile option to explicitly list | ||
455 | certificates. | ||
456 | - ssh-keygen(1): Allow ssh-keygen to change the key comment for all | ||
457 | supported formats (closes: #811125). | ||
458 | - ssh-keygen(1): Allow fingerprinting from standard input, e.g. | ||
459 | "ssh-keygen -lf -" (closes: #509058). | ||
460 | - ssh-keygen(1): Allow fingerprinting multiple public keys in a file, | ||
461 | e.g. "ssh-keygen -lf ~/.ssh/authorized_keys". | ||
462 | - sshd(8): Support "none" as an argument for sshd_config Foreground and | ||
463 | ChrootDirectory. Useful inside Match blocks to override a global | ||
464 | default. | ||
465 | - ssh-keygen(1): Support multiple certificates (one per line) and | ||
466 | reading from standard input (using "-f -") for "ssh-keygen -L" | ||
467 | - ssh-keyscan(1): Add "ssh-keyscan -c ..." flag to allow fetching | ||
468 | certificates instead of plain keys. | ||
469 | - ssh(1): Better handle anchored FQDNs (e.g. 'cvs.openbsd.org.') in | ||
470 | hostname canonicalisation - treat them as already canonical and remove | ||
471 | the trailing '.' before matching ssh_config. | ||
472 | - sftp(1): Existing destination directories should not terminate | ||
473 | recursive uploads (regression in OpenSSH 6.8; LP: #1553378). | ||
474 | * Use HTTPS for Vcs-* URLs, and link to cgit rather than gitweb. | ||
475 | * Restore slogin symlinks for compatibility, although they were removed | ||
476 | upstream. | ||
477 | |||
478 | -- Colin Watson <cjwatson@debian.org> Tue, 08 Mar 2016 11:47:20 +0000 | ||
479 | |||
480 | openssh (1:7.1p2-2) unstable; urgency=medium | ||
481 | |||
482 | * Remove protocol 1 host key generation from openssh-server.postinst | ||
483 | (closes: #811265). | ||
484 | |||
485 | -- Colin Watson <cjwatson@debian.org> Sun, 17 Jan 2016 14:10:19 +0000 | ||
486 | |||
487 | openssh (1:7.1p2-1) unstable; urgency=high | ||
488 | |||
489 | * New upstream release (http://www.openssh.com/txt/release-7.1p2): | ||
490 | - CVE-2016-0777, CVE-2016-0778: Disable experimental client-side support | ||
491 | for roaming, which could be tricked by a malicious server into leaking | ||
492 | client memory to the server, including private client user keys; this | ||
493 | information leak is restricted to connections to malicious or | ||
494 | compromised servers (closes: #810984). | ||
495 | - SECURITY: Fix an out of-bound read access in the packet handling code. | ||
496 | Reported by Ben Hawkes. | ||
497 | - Further use of explicit_bzero has been added in various buffer | ||
498 | handling code paths to guard against compilers aggressively doing | ||
499 | dead-store removal. | ||
500 | |||
501 | -- Colin Watson <cjwatson@debian.org> Thu, 14 Jan 2016 15:28:03 +0000 | ||
502 | |||
503 | openssh (1:7.1p1-6) unstable; urgency=medium | ||
504 | |||
505 | [ Colin Watson ] | ||
506 | * Remove explicit "XS-Testsuite: autopkgtest" from debian/control; | ||
507 | dpkg-source now figures that out automatically based on the existence of | ||
508 | debian/tests/control. | ||
509 | * Allow authenticating as root using gssapi-keyex even with | ||
510 | "PermitRootLogin prohibit-password" (closes: #809695). | ||
511 | * Shuffle PROPOSAL_KEX_ALGS mangling for GSSAPI key exchange a little | ||
512 | later in ssh_kex2 so that it's actually effective (closes: #809696). | ||
513 | |||
514 | [ Michael Biebl ] | ||
515 | * Don't call sd_notify when sshd is re-execed (closes: #809035). | ||
516 | |||
517 | -- Colin Watson <cjwatson@debian.org> Mon, 04 Jan 2016 15:09:10 +0000 | ||
518 | |||
519 | openssh (1:7.1p1-5) unstable; urgency=medium | ||
520 | |||
521 | [ Michael Biebl ] | ||
522 | * Add systemd readiness notification support (closes: #778913). | ||
523 | |||
524 | -- Colin Watson <cjwatson@debian.org> Mon, 21 Dec 2015 22:10:07 +0000 | ||
525 | |||
526 | openssh (1:7.1p1-4) unstable; urgency=medium | ||
527 | |||
528 | * Backport upstream patch to unbreak connections with peers that set | ||
529 | first_kex_follows (LP: #1526357). | ||
530 | |||
531 | -- Colin Watson <cjwatson@debian.org> Tue, 15 Dec 2015 15:40:18 +0000 | ||
532 | |||
533 | openssh (1:7.1p1-3) unstable; urgency=medium | ||
534 | |||
535 | * Drop priority of openssh-client-ssh1 to extra (closes: #807518). | ||
536 | * Redirect regression test input from /dev/zero, since otherwise conch | ||
537 | will immediately send EOF. | ||
538 | |||
539 | -- Colin Watson <cjwatson@debian.org> Thu, 10 Dec 2015 15:12:10 +0000 | ||
540 | |||
541 | openssh (1:7.1p1-2) unstable; urgency=medium | ||
542 | |||
543 | * Really enable conch interoperability tests under autopkgtest. | ||
544 | * Drop SSH1 keepalive patch. Now that SSH1 is disabled at compile-time, | ||
545 | it's been rejected upstream and there isn't much point carrying it any | ||
546 | more. | ||
547 | * Add NEWS.Debian documenting cryptographic changes in OpenSSH 7.0 | ||
548 | (closes: #806962). | ||
549 | * Add an openssh-client-ssh1 binary package for people who need to connect | ||
550 | to outdated SSH1-only servers (closes: #807107). | ||
551 | * Update "Subsystem sftp" path in example sshd_config (closes: #691004, | ||
552 | LP: #1437005). | ||
553 | |||
554 | -- Colin Watson <cjwatson@debian.org> Tue, 08 Dec 2015 15:33:08 +0000 | ||
555 | |||
556 | openssh (1:7.1p1-1) unstable; urgency=medium | ||
557 | |||
558 | * New upstream release (http://www.openssh.com/txt/release-7.0, closes: | ||
559 | #785190): | ||
560 | - Support for the legacy SSH version 1 protocol is disabled by default | ||
561 | at compile time. | ||
562 | - Support for the 1024-bit diffie-hellman-group1-sha1 key exchange is | ||
563 | disabled by default at run-time. It may be re-enabled using the | ||
564 | instructions at http://www.openssh.com/legacy.html | ||
565 | - Support for ssh-dss, ssh-dss-cert-* host and user keys is disabled by | ||
566 | default at run-time. These may be re-enabled using the instructions | ||
567 | at http://www.openssh.com/legacy.html | ||
568 | - Support for the legacy v00 cert format has been removed. | ||
569 | - The default for the sshd_config(5) PermitRootLogin option has changed | ||
570 | from "yes" to "prohibit-password". | ||
571 | - PermitRootLogin=without-password/prohibit-password now bans all | ||
572 | interactive authentication methods, allowing only public-key, | ||
573 | hostbased and GSSAPI authentication (previously it permitted | ||
574 | keyboard-interactive and password-less authentication if those were | ||
575 | enabled). | ||
576 | - ssh_config(5): Add PubkeyAcceptedKeyTypes option to control which | ||
577 | public key types are available for user authentication. | ||
578 | - sshd_config(5): Add HostKeyAlgorithms option to control which public | ||
579 | key types are offered for host authentications. | ||
580 | - ssh(1), sshd(8): Extend Ciphers, MACs, KexAlgorithms, | ||
581 | HostKeyAlgorithms, PubkeyAcceptedKeyTypes and HostbasedKeyTypes | ||
582 | options to allow appending to the default set of algorithms instead of | ||
583 | replacing it. Options may now be prefixed with a '+' to append to the | ||
584 | default, e.g. "HostKeyAlgorithms=+ssh-dss". | ||
585 | - sshd_config(5): PermitRootLogin now accepts an argument of | ||
586 | 'prohibit-password' as a less-ambiguous synonym of 'without- | ||
587 | password'. | ||
588 | - ssh(1), sshd(8): Add compatability workarounds for Cisco and more | ||
589 | PuTTY versions. | ||
590 | - Fix some omissions and errors in the PROTOCOL and PROTOCOL.mux | ||
591 | documentation relating to Unix domain socket forwarding. | ||
592 | - ssh(1): Improve the ssh(1) manual page to include a better description | ||
593 | of Unix domain socket forwarding (closes: #779068). | ||
594 | - ssh(1), ssh-agent(1): Skip uninitialised PKCS#11 slots, fixing | ||
595 | failures to load keys when they are present. | ||
596 | - ssh(1), ssh-agent(1): Do not ignore PKCS#11 hosted keys that wth empty | ||
597 | CKA_ID. | ||
598 | - sshd(8): Clarify documentation for UseDNS option. | ||
599 | - Check realpath(3) behaviour matches what sftp-server requires and use | ||
600 | a replacement if necessary. | ||
601 | * New upstream release (http://www.openssh.com/txt/release-7.1): | ||
602 | - sshd(8): OpenSSH 7.0 contained a logic error in PermitRootLogin= | ||
603 | prohibit-password/without-password that could, depending on | ||
604 | compile-time configuration, permit password authentication to root | ||
605 | while preventing other forms of authentication. This problem was | ||
606 | reported by Mantas Mikulenas. | ||
607 | - ssh(1), sshd(8): Add compatibility workarounds for FuTTY. | ||
608 | - ssh(1), sshd(8): Refine compatibility workarounds for WinSCP. | ||
609 | - Fix a number of memory faults (double-free, free of uninitialised | ||
610 | memory, etc) in ssh(1) and ssh-keygen(1). Reported by Mateusz | ||
611 | Kocielski. | ||
612 | * Change "PermitRootLogin without-password" to the new preferred spelling | ||
613 | of "PermitRootLogin prohibit-password" in sshd_config, and update | ||
614 | documentation to reflect the new upstream default. | ||
615 | * Enable conch interoperability tests under autopkgtest. | ||
616 | |||
617 | -- Colin Watson <cjwatson@debian.org> Wed, 02 Dec 2015 20:18:35 +0000 | ||
618 | |||
619 | openssh (1:6.9p1-3) unstable; urgency=medium | ||
620 | |||
621 | * ssh_config(5): Fix markup errors in description of GSSAPITrustDns | ||
622 | (closes: #799271). | ||
623 | * Fix dh_install and dh_fixperms overrides to work properly with an | ||
624 | architecture-independent-only build (closes: #806090). | ||
625 | * Do much less work in architecture-independent-only builds. | ||
626 | * Drop ConsoleKit session registration patch; it was only ever enabled for | ||
627 | Ubuntu, which no longer needs it (LP: #1334916, #1502045). | ||
628 | |||
629 | -- Colin Watson <cjwatson@debian.org> Tue, 24 Nov 2015 22:48:53 +0000 | ||
630 | |||
631 | openssh (1:6.9p1-2) unstable; urgency=medium | ||
632 | |||
633 | [ Colin Watson ] | ||
634 | * mention-ssh-keygen-on-keychange.patch: Move example ssh-keygen | ||
635 | invocation onto a separate line to make it easier to copy and paste | ||
636 | (LP: #1491532). | ||
637 | |||
638 | [ Tyler Hicks ] | ||
639 | * Build with audit support on Linux (closes: #797727, LP: #1478087). | ||
640 | |||
641 | -- Colin Watson <cjwatson@debian.org> Thu, 10 Sep 2015 12:26:11 +0100 | ||
642 | |||
643 | openssh (1:6.9p1-1) unstable; urgency=medium | ||
644 | |||
645 | * New upstream release (http://www.openssh.com/txt/release-6.8): | ||
646 | - sshd(8): UseDNS now defaults to 'no'. Configurations that match | ||
647 | against the client host name (via sshd_config or authorized_keys) may | ||
648 | need to re-enable it or convert to matching against addresses. | ||
649 | - Add FingerprintHash option to ssh(1) and sshd(8), and equivalent | ||
650 | command-line flags to the other tools to control algorithm used for | ||
651 | key fingerprints. The default changes from MD5 to SHA256 and format | ||
652 | from hex to base64. | ||
653 | Fingerprints now have the hash algorithm prepended. An example of the | ||
654 | new format: SHA256:mVPwvezndPv/ARoIadVY98vAC0g+P/5633yTC4d/wXE | ||
655 | Please note that visual host keys will also be different. | ||
656 | - ssh(1), sshd(8): Experimental host key rotation support. Add a | ||
657 | protocol extension for a server to inform a client of all its | ||
658 | available host keys after authentication has completed. The client | ||
659 | may record the keys in known_hosts, allowing it to upgrade to better | ||
660 | host key algorithms and a server to gracefully rotate its keys. | ||
661 | The client side of this is controlled by a UpdateHostkeys config | ||
662 | option (default off). | ||
663 | - ssh(1): Add a ssh_config HostbasedKeyType option to control which host | ||
664 | public key types are tried during host-based authentication. | ||
665 | - ssh(1), sshd(8): Fix connection-killing host key mismatch errors when | ||
666 | sshd offers multiple ECDSA keys of different lengths. | ||
667 | - ssh(1): When host name canonicalisation is enabled, try to parse host | ||
668 | names as addresses before looking them up for canonicalisation. Fixes | ||
669 | bz#2074 and avoids needless DNS lookups in some cases. | ||
670 | - ssh(1), ssh-keysign(8): Make ed25519 keys work for host based | ||
671 | authentication. | ||
672 | - sshd(8): SSH protocol v.1 workaround for the Meyer, et al, | ||
673 | Bleichenbacher Side Channel Attack. Fake up a bignum key before RSA | ||
674 | decryption. | ||
675 | - sshd(8): Remember which public keys have been used for authentication | ||
676 | and refuse to accept previously-used keys. This allows | ||
677 | AuthenticationMethods=publickey,publickey to require that users | ||
678 | authenticate using two _different_ public keys. | ||
679 | - sshd(8): add sshd_config HostbasedAcceptedKeyTypes and | ||
680 | PubkeyAcceptedKeyTypes options to allow sshd to control what public | ||
681 | key types will be accepted (closes: #481133). Currently defaults to | ||
682 | all. | ||
683 | - sshd(8): Don't count partial authentication success as a failure | ||
684 | against MaxAuthTries. | ||
685 | - ssh(1): Add RevokedHostKeys option for the client to allow text-file | ||
686 | or KRL-based revocation of host keys. | ||
687 | - ssh-keygen(1), sshd(8): Permit KRLs that revoke certificates by serial | ||
688 | number or key ID without scoping to a particular CA. | ||
689 | - ssh(1): Add a "Match canonical" criteria that allows ssh_config Match | ||
690 | blocks to trigger only in the second config pass. | ||
691 | - ssh(1): Add a -G option to ssh that causes it to parse its | ||
692 | configuration and dump the result to stdout, similar to "sshd -T". | ||
693 | - ssh(1): Allow Match criteria to be negated. E.g. "Match !host". | ||
694 | - ssh-keyscan(1): ssh-keyscan has been made much more robust against | ||
695 | servers that hang or violate the SSH protocol (closes: #241119). | ||
696 | - ssh(1), ssh-keygen(1): Fix regression bz#2306: Key path names were | ||
697 | being lost as comment fields (closes: #787776). | ||
698 | - ssh(1): Allow ssh_config Port options set in the second config parse | ||
699 | phase to be applied (they were being ignored; closes: #774369). | ||
700 | - ssh(1): Tweak config re-parsing with host canonicalisation - make the | ||
701 | second pass through the config files always run when host name | ||
702 | canonicalisation is enabled (and not whenever the host name changes) | ||
703 | - ssh(1): Fix passing of wildcard forward bind addresses when connection | ||
704 | multiplexing is in use. | ||
705 | - ssh-keygen(1): Fix broken private key conversion from non-OpenSSH | ||
706 | formats. | ||
707 | - ssh-keygen(1): Fix KRL generation bug when multiple CAs are in use. | ||
708 | * New upstream release (http://www.openssh.com/txt/release-6.9): | ||
709 | - CVE-2015-5352: ssh(1): When forwarding X11 connections with | ||
710 | ForwardX11Trusted=no, connections made after ForwardX11Timeout expired | ||
711 | could be permitted and no longer subject to XSECURITY restrictions | ||
712 | because of an ineffective timeout check in ssh(1) coupled with "fail | ||
713 | open" behaviour in the X11 server when clients attempted connections | ||
714 | with expired credentials (closes: #790798). This problem was reported | ||
715 | by Jann Horn. | ||
716 | - SECURITY: ssh-agent(1): Fix weakness of agent locking (ssh-add -x) to | ||
717 | password guessing by implementing an increasing failure delay, storing | ||
718 | a salted hash of the password rather than the password itself and | ||
719 | using a timing-safe comparison function for verifying unlock attempts. | ||
720 | This problem was reported by Ryan Castellucci. | ||
721 | - sshd(8): Support admin-specified arguments to AuthorizedKeysCommand | ||
722 | (closes: #740494). | ||
723 | - sshd(8): Add AuthorizedPrincipalsCommand that allows retrieving | ||
724 | authorized principals information from a subprocess rather than a | ||
725 | file. | ||
726 | - ssh(1), ssh-add(1): Support PKCS#11 devices with external PIN entry | ||
727 | devices. | ||
728 | - ssh-keygen(1): Support "ssh-keygen -lF hostname" to search known_hosts | ||
729 | and print key hashes rather than full keys. | ||
730 | - ssh-agent(1): Add -D flag to leave ssh-agent in foreground without | ||
731 | enabling debug mode. | ||
732 | - ssh(1), sshd(8): Deprecate legacy SSH2_MSG_KEX_DH_GEX_REQUEST_OLD | ||
733 | message and do not try to use it against some 3rd-party SSH | ||
734 | implementations that use it (older PuTTY, WinSCP). | ||
735 | - ssh(1), sshd(8): Cap DH-GEX group size at 4Kbits for Cisco | ||
736 | implementations as some would fail when attempting to use group sizes | ||
737 | >4K (closes: #740307, LP: #1287222). | ||
738 | - ssh(1): Fix out-of-bound read in EscapeChar configuration option | ||
739 | parsing. | ||
740 | - sshd(8): Fix application of PermitTunnel, LoginGraceTime, | ||
741 | AuthenticationMethods and StreamLocalBindMask options in Match blocks. | ||
742 | - ssh(1), sshd(8): Improve disconnection message on TCP reset. | ||
743 | - ssh(1): Remove failed remote forwards established by multiplexing from | ||
744 | the list of active forwards. | ||
745 | - sshd(8): Make parsing of authorized_keys "environment=" options | ||
746 | independent of PermitUserEnv being enabled. | ||
747 | - sshd(8): Fix post-auth crash with permitopen=none (closes: #778807). | ||
748 | - ssh(1), ssh-add(1), ssh-keygen(1): Allow new-format private keys to be | ||
749 | encrypted with AEAD ciphers. | ||
750 | - ssh(1): Allow ListenAddress, Port and AddressFamily configuration | ||
751 | options to appear in any order. | ||
752 | - sshd(8): Check for and reject missing arguments for VersionAddendum | ||
753 | and ForceCommand. | ||
754 | - ssh(1), sshd(8): Don't treat unknown certificate extensions as fatal. | ||
755 | - ssh-keygen(1): Make stdout and stderr output consistent. | ||
756 | - ssh(1): Mention missing DISPLAY environment in debug log when X11 | ||
757 | forwarding requested. | ||
758 | - sshd(8): Correctly record login when UseLogin is set. | ||
759 | - sshd(8): Add some missing options to sshd -T output and fix output of | ||
760 | VersionAddendum and HostCertificate. | ||
761 | - Document and improve consistency of options that accept a "none" | ||
762 | argument: TrustedUserCAKeys, RevokedKeys, AuthorizedPrincipalsFile. | ||
763 | - ssh(1): Include remote username in debug output. | ||
764 | - sshd(8): Avoid compatibility problem with some versions of Tera Term, | ||
765 | which would crash when they received the hostkeys notification message | ||
766 | (hostkeys-00@openssh.com). | ||
767 | - sshd(8): Mention ssh-keygen -E as useful when comparing legacy MD5 | ||
768 | host key fingerprints. | ||
769 | - ssh(1): Clarify pseudo-terminal request behaviour and make manual | ||
770 | language consistent. | ||
771 | - ssh(1): Document that the TERM environment variable is not subject to | ||
772 | SendEnv and AcceptEnv; bz#2386 | ||
773 | - sshd(8): Format UsePAM setting when using sshd -T (closes: #767648). | ||
774 | - moduli(5): Update DH-GEX moduli (closes: #787037). | ||
775 | * There are some things I want to fix before upgrading to 7.0p1, though I | ||
776 | intend to do that soon. In the meantime, backport some patches, mainly | ||
777 | to fix security issues: | ||
778 | - SECURITY: sshd(8): OpenSSH 6.8 and 6.9 incorrectly set TTYs to be | ||
779 | world-writable. Local attackers may be able to write arbitrary | ||
780 | messages to logged-in users, including terminal escape sequences. | ||
781 | Reported by Nikolay Edigaryev. | ||
782 | - SECURITY: sshd(8): Fixed a privilege separation weakness related to | ||
783 | PAM support. Attackers who could successfully compromise the | ||
784 | pre-authentication process for remote code execution and who had valid | ||
785 | credentials on the host could impersonate other users. Reported by | ||
786 | Moritz Jodeit. | ||
787 | - SECURITY: sshd(8): Fixed a use-after-free bug related to PAM support | ||
788 | that was reachable by attackers who could compromise the | ||
789 | pre-authentication process for remote code execution (closes: | ||
790 | #795711). Also reported by Moritz Jodeit. | ||
791 | - CVE-2015-5600: sshd(8): Fix circumvention of MaxAuthTries using | ||
792 | keyboard-interactive authentication (closes: #793616). By specifying | ||
793 | a long, repeating keyboard-interactive "devices" string, an attacker | ||
794 | could request the same authentication method be tried thousands of | ||
795 | times in a single pass. The LoginGraceTime timeout in sshd(8) and any | ||
796 | authentication failure delays implemented by the authentication | ||
797 | mechanism itself were still applied. Found by Kingcope. | ||
798 | - Let principals-command.sh work for noexec /var/run. | ||
799 | * Thanks to Jakub Jelen of Red Hat for Fedora's rebased version of the | ||
800 | GSSAPI key exchange patch. | ||
801 | * Document the Debian-specific change to the default value of | ||
802 | ForwardX11Trusted in ssh(1) (closes: #781469). | ||
803 | |||
804 | -- Colin Watson <cjwatson@debian.org> Thu, 20 Aug 2015 10:38:58 +0100 | ||
805 | |||
806 | openssh (1:6.7p1-6) unstable; urgency=medium | ||
807 | |||
808 | [ Martin Pitt ] | ||
809 | * openssh-server.postinst: Quiesce "Unable to connect to Upstart" error | ||
810 | message from initctl if upstart is installed, but not the current init | ||
811 | system. (LP: #1440070) | ||
812 | * openssh-server.postinst: Fix version comparisons of upgrade adjustments | ||
813 | to not apply to fresh installs. | ||
814 | |||
815 | -- Colin Watson <cjwatson@debian.org> Sun, 19 Apr 2015 14:32:43 +0100 | ||
816 | |||
817 | openssh (1:6.7p1-5) unstable; urgency=medium | ||
818 | |||
819 | * Revert change from previous upload, which causes far more trouble than | ||
820 | it is worth (closes: #780797): | ||
821 | - Send/accept only specific known LC_* variables, rather than using a | ||
822 | wildcard. | ||
823 | * Add a NEWS.Debian entry documenting this reversion, as it is too | ||
824 | difficult to undo the sshd_config change automatically without | ||
825 | compounding the problem of (arguably) overwriting user configuration. | ||
826 | |||
827 | -- Colin Watson <cjwatson@debian.org> Sun, 22 Mar 2015 23:20:56 +0000 | ||
828 | |||
829 | openssh (1:6.7p1-4) unstable; urgency=medium | ||
830 | |||
831 | * Send/accept only specific known LC_* variables, rather than using a | ||
832 | wildcard (closes: #765633). | ||
833 | * Document interactions between ListenAddress/Port and ssh.socket in | ||
834 | README.Debian (closes: #764842). | ||
835 | * Debconf translations: | ||
836 | - Brazilian Portuguese (thanks, José de Figueiredo; closes: #771859). | ||
837 | |||
838 | -- Colin Watson <cjwatson@debian.org> Wed, 18 Mar 2015 15:34:13 +0000 | ||
839 | |||
840 | openssh (1:6.7p1-3) unstable; urgency=medium | ||
841 | |||
842 | * Debconf translations: | ||
843 | - Dutch (thanks, Frans Spiesschaert; closes: #765851). | ||
844 | * Assume that dpkg-statoverride exists and drop the test for an obsolete | ||
845 | compatibility path. | ||
846 | |||
847 | -- Colin Watson <cjwatson@debian.org> Mon, 03 Nov 2014 20:29:52 +0000 | ||
848 | |||
849 | openssh (1:6.7p1-2) unstable; urgency=medium | ||
850 | |||
851 | * debian/tests/control: Drop isolation-container, since the tests run on a | ||
852 | high port. They're still not guaranteed to run correctly in an schroot, | ||
853 | but may manage to work, so this lets the tests at least try to run on | ||
854 | ci.debian.net. | ||
855 | |||
856 | -- Colin Watson <cjwatson@debian.org> Fri, 10 Oct 2014 10:47:19 +0100 | ||
857 | |||
858 | openssh (1:6.7p1-1) unstable; urgency=medium | ||
859 | |||
860 | * New upstream release (http://www.openssh.com/txt/release-6.7): | ||
861 | - sshd(8): The default set of ciphers and MACs has been altered to | ||
862 | remove unsafe algorithms. In particular, CBC ciphers and arcfour* are | ||
863 | disabled by default. The full set of algorithms remains available if | ||
864 | configured explicitly via the Ciphers and MACs sshd_config options. | ||
865 | - ssh(1), sshd(8): Add support for Unix domain socket forwarding. A | ||
866 | remote TCP port may be forwarded to a local Unix domain socket and | ||
867 | vice versa or both ends may be a Unix domain socket (closes: #236718). | ||
868 | - ssh(1), ssh-keygen(1): Add support for SSHFP DNS records for ED25519 | ||
869 | key types. | ||
870 | - sftp(1): Allow resumption of interrupted uploads. | ||
871 | - ssh(1): When rekeying, skip file/DNS lookups of the hostkey if it is | ||
872 | the same as the one sent during initial key exchange. | ||
873 | - sshd(8): Allow explicit ::1 and 127.0.0.1 forwarding bind addresses | ||
874 | when GatewayPorts=no; allows client to choose address family. | ||
875 | - sshd(8): Add a sshd_config PermitUserRC option to control whether | ||
876 | ~/.ssh/rc is executed, mirroring the no-user-rc authorized_keys | ||
877 | option. | ||
878 | - ssh(1): Add a %C escape sequence for LocalCommand and ControlPath that | ||
879 | expands to a unique identifier based on a hash of the tuple of (local | ||
880 | host, remote user, hostname, port). Helps avoid exceeding miserly | ||
881 | pathname limits for Unix domain sockets in multiplexing control paths. | ||
882 | - sshd(8): Make the "Too many authentication failures" message include | ||
883 | the user, source address, port and protocol in a format similar to the | ||
884 | authentication success / failure messages. | ||
885 | - Use CLOCK_BOOTTIME in preference to CLOCK_MONOTONIC when it is | ||
886 | available. It considers time spent suspended, thereby ensuring | ||
887 | timeouts (e.g. for expiring agent keys) fire correctly (closes: | ||
888 | #734553). | ||
889 | - Use prctl() to prevent sftp-server from accessing | ||
890 | /proc/self/{mem,maps}. | ||
891 | * Restore TCP wrappers support, removed upstream in 6.7. It is true that | ||
892 | dropping this reduces preauth attack surface in sshd. On the other | ||
893 | hand, this support seems to be quite widely used, and abruptly dropping | ||
894 | it (from the perspective of users who don't read openssh-unix-dev) could | ||
895 | easily cause more serious problems in practice. It's not entirely clear | ||
896 | what the right long-term answer for Debian is, but it at least probably | ||
897 | doesn't involve dropping this feature shortly before a freeze. | ||
898 | * Replace patch to disable OpenSSL version check with an updated version | ||
899 | of Kurt Roeckx's patch from #732940 to just avoid checking the status | ||
900 | field. | ||
901 | * Build-depend on a new enough dpkg-dev for dpkg-buildflags, rather than | ||
902 | simply a new enough dpkg. | ||
903 | * Simplify debian/rules using /usr/share/dpkg/buildflags.mk. | ||
904 | * Use Package-Type rather than XC-Package-Type, now that it is an official | ||
905 | field. | ||
906 | * Run a subset of the upstream regression test suite at package build | ||
907 | time, and the rest of it under autopkgtest. | ||
908 | |||
909 | -- Colin Watson <cjwatson@debian.org> Thu, 09 Oct 2014 14:05:56 +0100 | ||
910 | |||
911 | openssh (1:6.6p1-8) unstable; urgency=medium | ||
912 | |||
913 | * Make the if-up hook use "reload" rather than "restart" if the system was | ||
914 | booted using systemd (closes: #756547). | ||
915 | * Show fingerprints of new keys after creating them in the postinst | ||
916 | (closes: #762128). | ||
917 | * Policy version 3.9.6: no changes required. | ||
918 | * Don't link /usr/share/doc/ssh to openssh-client, as this is not safe | ||
919 | between Architecture: all and Architecture: any binary packages (closes: | ||
920 | #763375). | ||
921 | |||
922 | -- Colin Watson <cjwatson@debian.org> Fri, 03 Oct 2014 12:23:57 +0100 | ||
923 | |||
924 | openssh (1:6.6p1-7) unstable; urgency=medium | ||
925 | |||
926 | * Make sure that DEB_HOST_ARCH is set, even when invoking debian/rules | ||
927 | directly. | ||
928 | * Use dh-exec to simplify override_dh_install target. | ||
929 | * Remove several unnecessary entries in debian/*.dirs. | ||
930 | * Pass noupdate to the second call to pam_motd, not the first (thanks, Ken | ||
931 | T Takusagawa; closes: #757059). | ||
932 | * Debconf translations: | ||
933 | - Turkish (thanks, Mert Dirik; closes: #756757). | ||
934 | |||
935 | -- Colin Watson <cjwatson@debian.org> Tue, 05 Aug 2014 09:10:04 +0100 | ||
936 | |||
937 | openssh (1:6.6p1-6) unstable; urgency=medium | ||
938 | |||
939 | * Upgrade to debhelper v9. | ||
940 | * Only use pam_keyinit on Linux architectures (closes: #747245). | ||
941 | * Make get_config_option more robust against trailing whitespace (thanks, | ||
942 | LaMont Jones). | ||
943 | * Debconf translations: | ||
944 | - Czech (thanks, Michal Šimůnek; closes: #751419). | ||
945 | |||
946 | -- Colin Watson <cjwatson@debian.org> Sat, 28 Jun 2014 14:50:04 +0100 | ||
947 | |||
948 | openssh (1:6.6p1-5) unstable; urgency=medium | ||
949 | |||
950 | * Force ssh-agent Upstart job to use sh syntax regardless of the user's | ||
951 | shell (thanks, Steffen Stempel; LP: #1312928). | ||
952 | |||
953 | -- Colin Watson <cjwatson@debian.org> Thu, 01 May 2014 16:27:53 +0100 | ||
954 | |||
955 | openssh (1:6.6p1-4) unstable; urgency=medium | ||
956 | |||
957 | * Debconf translations: | ||
958 | - Spanish (thanks, Matías Bellone; closes: #744867). | ||
959 | * Apply upstream-recommended patch to fix bignum encoding for | ||
960 | curve25519-sha256@libssh.org, fixing occasional key exchange failures. | ||
961 | |||
962 | -- Colin Watson <cjwatson@debian.org> Mon, 21 Apr 2014 21:29:53 +0100 | ||
963 | |||
964 | openssh (1:6.6p1-3) unstable; urgency=medium | ||
965 | |||
966 | * Debconf translations: | ||
967 | - French (thanks, Étienne Gilli; closes: #743242). | ||
968 | * Never signal the service supervisor with SIGSTOP more than once, to | ||
969 | prevent a hang on re-exec (thanks, Robie Basak; LP: #1306877). | ||
970 | |||
971 | -- Colin Watson <cjwatson@debian.org> Mon, 14 Apr 2014 12:11:50 +0100 | ||
972 | |||
973 | openssh (1:6.6p1-2) unstable; urgency=medium | ||
974 | |||
975 | * If no root password is set, then switch to "PermitRootLogin | ||
976 | without-password" without asking (LP: #1300127). | ||
977 | |||
978 | -- Colin Watson <cjwatson@debian.org> Mon, 31 Mar 2014 12:20:46 +0100 | ||
979 | |||
980 | openssh (1:6.6p1-1) unstable; urgency=medium | ||
981 | |||
982 | [ Colin Watson ] | ||
983 | * Apply various warning-suppression and regression-test fixes to | ||
984 | gssapi.patch from Damien Miller. | ||
985 | * New upstream release (http://www.openssh.com/txt/release-6.6, | ||
986 | LP: #1298280): | ||
987 | - CVE-2014-2532: sshd(8): when using environment passing with an | ||
988 | sshd_config(5) AcceptEnv pattern with a wildcard, OpenSSH prior to 6.6 | ||
989 | could be tricked into accepting any environment variable that contains | ||
990 | the characters before the wildcard character. | ||
991 | * Re-enable btmp logging, as its permissions were fixed a long time ago in | ||
992 | response to #370050 (closes: #341883). | ||
993 | * Change to "PermitRootLogin without-password" for new installations, and | ||
994 | ask a debconf question when upgrading systems with "PermitRootLogin yes" | ||
995 | from previous versions (closes: #298138). | ||
996 | * Debconf translations: | ||
997 | - Danish (thanks, Joe Hansen). | ||
998 | - Portuguese (thanks, Américo Monteiro). | ||
999 | - Russian (thanks, Yuri Kozlov; closes: #742308). | ||
1000 | - Swedish (thanks, Andreas Rönnquist). | ||
1001 | - Japanese (thanks, victory). | ||
1002 | - German (thanks, Stephan Beck; closes: #742541). | ||
1003 | - Italian (thanks, Beatrice Torracca). | ||
1004 | * Don't start ssh-agent from the Upstart user session job if something | ||
1005 | like Xsession has already done so (based on work by Bruno Vasselle; | ||
1006 | LP: #1244736). | ||
1007 | |||
1008 | [ Matthew Vernon ] | ||
1009 | * CVE-2014-2653: Fix failure to check SSHFP records if server presents a | ||
1010 | certificate (bug reported by me, patch by upstream's Damien Miller; | ||
1011 | thanks also to Mark Wooding for his help in fixing this) (Closes: | ||
1012 | #742513) | ||
1013 | |||
1014 | -- Colin Watson <cjwatson@debian.org> Fri, 28 Mar 2014 18:04:41 +0000 | ||
1015 | |||
1016 | openssh (1:6.5p1-6) unstable; urgency=medium | ||
1017 | |||
1018 | * Fix Breaks/Replaces versions of openssh-sftp-server on openssh-server | ||
1019 | (thanks, Axel Beckert). | ||
1020 | |||
1021 | -- Colin Watson <cjwatson@debian.org> Thu, 06 Mar 2014 16:18:44 +0000 | ||
1022 | |||
1023 | openssh (1:6.5p1-5) unstable; urgency=medium | ||
1024 | |||
1025 | [ Colin Watson ] | ||
1026 | * Add Alias=sshd.service to systemd ssh.service file, to match "Provides: | ||
1027 | sshd" in the sysvinit script (thanks, Michael Biebl). | ||
1028 | * Add Before=ssh.service to systemd ssh.socket file, since otherwise | ||
1029 | nothing guarantees that ssh.service has stopped before ssh.socket starts | ||
1030 | (thanks, Uoti Urpala). | ||
1031 | |||
1032 | [ Axel Beckert ] | ||
1033 | * Split sftp-server into its own package to allow it to also be used by | ||
1034 | other SSH server implementations like dropbear (closes: #504290). | ||
1035 | |||
1036 | -- Colin Watson <cjwatson@debian.org> Wed, 05 Mar 2014 13:53:08 +0000 | ||
1037 | |||
1038 | openssh (1:6.5p1-4) unstable; urgency=medium | ||
1039 | |||
1040 | * Configure --without-hardening on hppa, to work around | ||
1041 | http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60155 (closes: #738798). | ||
1042 | * Amend "Running sshd from inittab" instructions in README.Debian to | ||
1043 | recommend 'update-rc.d ssh disable', rather than manual removal of rc*.d | ||
1044 | symlinks that won't work with dependency-based sysv-rc. | ||
1045 | * Remove code related to non-dependency-based sysv-rc ordering, since that | ||
1046 | is no longer supported. | ||
1047 | * Apply patch from https://bugzilla.mindrot.org/show_bug.cgi?id=2200 to | ||
1048 | fix getsockname errors when using "ssh -W" (closes: #738693). | ||
1049 | |||
1050 | -- Colin Watson <cjwatson@debian.org> Sat, 15 Feb 2014 02:19:36 +0000 | ||
1051 | |||
1052 | openssh (1:6.5p1-3) unstable; urgency=medium | ||
1053 | |||
1054 | * Clarify socket activation mode in README.Debian, as suggested by Uoti | ||
1055 | Urpala. | ||
1056 | * Stop claiming that "Protocol 2" is a Debian-specific default; this has | ||
1057 | been upstream's default since 5.4p1. | ||
1058 | * Avoid stdout noise from which(1) on purge of openssh-client. | ||
1059 | * Fix sysvinit->systemd transition code to cope with still-running | ||
1060 | sysvinit jobs being considered active by systemd (thanks, Uoti Urpala | ||
1061 | and Michael Biebl). | ||
1062 | * Bump guard version for sysvinit->systemd transition to 1:6.5p1-3; we may | ||
1063 | have got it wrong before, and it's fairly harmless to repeat it. | ||
1064 | * Remove tests for whether /dev/null is a character device from the | ||
1065 | Upstart job and the systemd service files; it's there to avoid a | ||
1066 | confusing failure mode in daemon(), but with modern init systems we use | ||
1067 | the -D option to suppress daemonisation anyway. | ||
1068 | * Refer to /usr/share/common-licenses/GPL-2 in debian/copyright (for the | ||
1069 | Debian patch) rather than plain GPL. | ||
1070 | * Drop some very old Conflicts and Replaces (ssh (<< 1:3.8.1p1-9), | ||
1071 | rsh-client (<< 0.16.1-1), ssh-krb5 (<< 1:4.3p2-7), ssh-nonfree (<< 2), | ||
1072 | and openssh-client (<< 1:3.8.1p1-11)). These all relate to pre-etch | ||
1073 | versions, for which we no longer have maintainer script code, and per | ||
1074 | policy they would have to become Breaks nowadays anyway. | ||
1075 | * Policy version 3.9.5. | ||
1076 | * Drop unnecessary -1 in zlib1g Build-Depends version. | ||
1077 | * Tweak dh_systemd_enable invocations to avoid lots of error noise. | ||
1078 | |||
1079 | -- Colin Watson <cjwatson@debian.org> Wed, 12 Feb 2014 13:10:08 +0000 | ||
1080 | |||
1081 | openssh (1:6.5p1-2) unstable; urgency=medium | ||
1082 | |||
1083 | * Only enable ssh.service for systemd, not both ssh.service and | ||
1084 | ssh.socket. Thanks to Michael Biebl for spotting this. | ||
1085 | * Backport upstream patch to unbreak case-sensitive matching of ssh_config | ||
1086 | (closes: #738619). | ||
1087 | |||
1088 | -- Colin Watson <cjwatson@debian.org> Tue, 11 Feb 2014 11:28:35 +0000 | ||
1089 | |||
1090 | openssh (1:6.5p1-1) unstable; urgency=medium | ||
1091 | |||
1092 | * New upstream release (http://www.openssh.com/txt/release-6.5, | ||
1093 | LP: #1275068): | ||
1094 | - ssh(1): Add support for client-side hostname canonicalisation using a | ||
1095 | set of DNS suffixes and rules in ssh_config(5). This allows | ||
1096 | unqualified names to be canonicalised to fully-qualified domain names | ||
1097 | to eliminate ambiguity when looking up keys in known_hosts or checking | ||
1098 | host certificate names (closes: #115286). | ||
1099 | * Switch to git; adjust Vcs-* fields. | ||
1100 | * Convert to git-dpm, and drop source package documentation associated | ||
1101 | with the old bzr/quilt patch handling workflow. | ||
1102 | * Drop ssh-vulnkey and the associated ssh/ssh-add/sshd integration code, | ||
1103 | leaving only basic configuration file compatibility, since it has been | ||
1104 | nearly six years since the original vulnerability and this code is not | ||
1105 | likely to be of much value any more (closes: #481853, #570651). See | ||
1106 | https://lists.debian.org/debian-devel/2013/09/msg00240.html for my full | ||
1107 | reasoning. | ||
1108 | * Add OpenPGP signature checking configuration to watch file (thanks, | ||
1109 | Daniel Kahn Gillmor; closes: #732441). | ||
1110 | * Add the pam_keyinit session module, to create a new session keyring on | ||
1111 | login (closes: #734816). | ||
1112 | * Incorporate default path changes from shadow 1:4.0.18.1-8, removing | ||
1113 | /usr/bin/X11 (closes: #644521). | ||
1114 | * Generate ED25519 host keys on fresh installations. Upgraders who wish | ||
1115 | to add such host keys should manually add 'HostKey | ||
1116 | /etc/ssh/ssh_host_ed25519_key' to /etc/ssh/sshd_config and run | ||
1117 | 'ssh-keygen -q -f /etc/ssh/ssh_host_ed25519_key -N "" -t ed25519'. | ||
1118 | * Drop long-obsolete "SSH now uses protocol 2 by default" section from | ||
1119 | README.Debian. | ||
1120 | * Add systemd support (thanks, Sven Joachim; closes: #676830). | ||
1121 | |||
1122 | -- Colin Watson <cjwatson@debian.org> Mon, 10 Feb 2014 14:58:26 +0000 | ||
1123 | |||
1124 | openssh (1:6.4p1-2) unstable; urgency=high | ||
1125 | |||
1126 | * Increase ServerKeyBits value in package-generated sshd_config to 1024 | ||
1127 | (closes: #727622, LP: #1244272). | ||
1128 | * Restore patch to disable OpenSSL version check (closes: #732940). | ||
1129 | |||
1130 | -- Colin Watson <cjwatson@debian.org> Mon, 23 Dec 2013 10:44:04 +0000 | ||
1131 | |||
1132 | openssh (1:6.4p1-1) unstable; urgency=high | ||
1133 | |||
1134 | * New upstream release. Important changes: | ||
1135 | - 6.3/6.3p1 (http://www.openssh.com/txt/release-6.3): | ||
1136 | + sftp(1): add support for resuming partial downloads using the | ||
1137 | "reget" command and on the sftp commandline or on the "get" | ||
1138 | commandline using the "-a" (append) option (closes: #158590). | ||
1139 | + ssh(1): add an "IgnoreUnknown" configuration option to selectively | ||
1140 | suppress errors arising from unknown configuration directives | ||
1141 | (closes: #436052). | ||
1142 | + sftp(1): update progressmeter when data is acknowledged, not when | ||
1143 | it's sent (partially addresses #708372). | ||
1144 | + ssh(1): do not fatally exit when attempting to cleanup multiplexing- | ||
1145 | created channels that are incompletely opened (closes: #651357). | ||
1146 | - 6.4/6.4p1 (http://www.openssh.com/txt/release-6.4): | ||
1147 | + CVE-2013-4548: sshd(8): fix a memory corruption problem triggered | ||
1148 | during rekeying when an AES-GCM cipher is selected (closes: | ||
1149 | #729029). Full details of the vulnerability are available at: | ||
1150 | http://www.openssh.com/txt/gcmrekey.adv | ||
1151 | * When running under Upstart, only consider the daemon started once it is | ||
1152 | ready to accept connections (by raising SIGSTOP at that point and using | ||
1153 | "expect stop"). | ||
1154 | |||
1155 | -- Colin Watson <cjwatson@debian.org> Sat, 09 Nov 2013 18:24:16 +0000 | ||
1156 | |||
1157 | openssh (1:6.2p2-6) unstable; urgency=low | ||
1158 | |||
1159 | * Update config.guess and config.sub automatically at build time. | ||
1160 | dh_autoreconf does not take care of that by default because openssh does | ||
1161 | not use automake. | ||
1162 | |||
1163 | -- Colin Watson <cjwatson@debian.org> Tue, 02 Jul 2013 22:54:49 +0100 | ||
1164 | |||
1165 | openssh (1:6.2p2-5) unstable; urgency=low | ||
1166 | |||
1167 | [ Colin Watson ] | ||
1168 | * Document consequences of ssh-agent being setgid in ssh-agent(1); see | ||
1169 | #711623. | ||
1170 | * Use 'set -e' rather than '#! /bin/sh -e' in maintainer scripts and | ||
1171 | ssh-argv0. | ||
1172 | |||
1173 | [ Yolanda Robla ] | ||
1174 | * debian/rules: Include real distribution in SSH_EXTRAVERSION instead of | ||
1175 | hardcoding Debian (LP: #1195342). | ||
1176 | |||
1177 | -- Colin Watson <cjwatson@debian.org> Thu, 27 Jun 2013 15:24:14 +0100 | ||
1178 | |||
1179 | openssh (1:6.2p2-4) unstable; urgency=low | ||
1180 | |||
1181 | * Fix non-portable shell in ssh-copy-id (closes: #711162). | ||
1182 | * Rebuild against debhelper 9.20130604 with fixed dependencies for | ||
1183 | invoke-rc.d and Upstart jobs (closes: #711159, #711364). | ||
1184 | * Set SELinux context on private host keys as well as public host keys | ||
1185 | (closes: #687436). | ||
1186 | |||
1187 | -- Colin Watson <cjwatson@debian.org> Thu, 06 Jun 2013 17:06:31 +0100 | ||
1188 | |||
1189 | openssh (1:6.2p2-3) unstable; urgency=low | ||
1190 | |||
1191 | * If the running init daemon is Upstart, then, on the first upgrade to | ||
1192 | this version, check whether sysvinit is still managing sshd; if so, | ||
1193 | manually stop it so that it can be restarted under upstart. We do this | ||
1194 | near the end of the postinst, so it shouldn't result in any appreciable | ||
1195 | extra window where sshd is not running during upgrade. | ||
1196 | |||
1197 | -- Colin Watson <cjwatson@debian.org> Wed, 22 May 2013 17:42:10 +0100 | ||
1198 | |||
1199 | openssh (1:6.2p2-2) unstable; urgency=low | ||
1200 | |||
1201 | * Change start condition of Upstart job to be just the standard "runlevel | ||
1202 | [2345]", rather than "filesystem or runlevel [2345]"; the latter makes | ||
1203 | it unreasonably difficult to ensure that urandom starts before ssh, and | ||
1204 | is not really necessary since one of static-network-up and failsafe-boot | ||
1205 | is guaranteed to happen and will trigger entry to the default runlevel, | ||
1206 | and we don't care about ssh starting before the network (LP: #1098299). | ||
1207 | * Drop conffile handling for direct upgrades from pre-split ssh package; | ||
1208 | this was originally added in 1:4.3p2-7 / 1:4.3p2-8, and contained a | ||
1209 | truly ghastly hack around a misbehaviour in sarge's dpkg. Since this is | ||
1210 | now four Debian releases ago, we can afford to drop this and simplify | ||
1211 | the packaging. | ||
1212 | * Remove ssh/use_old_init_script, which was a workaround for a very old | ||
1213 | bug in /etc/init.d/ssh. If anyone has ignored this for >10 years then | ||
1214 | they aren't going to be convinced now (closes: #214182). | ||
1215 | * Remove support for upgrading directly from ssh-nonfree. | ||
1216 | * Remove lots of maintainer script support for direct upgrades from | ||
1217 | pre-etch (three releases before current stable). | ||
1218 | * Add #DEBHELPER# tokens to openssh-client.postinst and | ||
1219 | openssh-server.postinst. | ||
1220 | * Replace old manual conffile handling code with dpkg-maintscript-helper, | ||
1221 | via dh_installdeb. | ||
1222 | * Switch to new unified layout for Upstart jobs as documented in | ||
1223 | https://wiki.ubuntu.com/UpstartCompatibleInitScripts: the init script | ||
1224 | checks for a running Upstart, and we now let dh_installinit handle most | ||
1225 | of the heavy lifting in maintainer scripts. Ubuntu users should be | ||
1226 | essentially unaffected except that sshd may no longer start | ||
1227 | automatically in chroots if the running Upstart predates 0.9.0; but the | ||
1228 | main goal is simply not to break when openssh-server is installed in a | ||
1229 | chroot. | ||
1230 | * Remove the check for vulnerable host keys; this was first added five | ||
1231 | years ago, and everyone should have upgraded through a version that | ||
1232 | applied these checks by now. The ssh-vulnkey tool and the blacklisting | ||
1233 | support in sshd are still here, at least for the moment. | ||
1234 | * This removes the last of our uses of debconf (closes: #221531). | ||
1235 | * Use the pam_loginuid session module (thanks, Laurent Bigonville; closes: | ||
1236 | #677440, LP: #1067779). | ||
1237 | * Bracket our session stack with calls to pam_selinux close/open (thanks, | ||
1238 | Laurent Bigonville; closes: #679458). | ||
1239 | * Fix dh_builddeb invocation so that we really use xz compression for | ||
1240 | binary packages, as intended since 1:6.1p1-2. | ||
1241 | |||
1242 | -- Colin Watson <cjwatson@debian.org> Wed, 22 May 2013 09:07:42 +0100 | ||
1243 | |||
1244 | openssh (1:6.2p2-1) unstable; urgency=low | ||
1245 | |||
1246 | * New upstream release (http://www.openssh.com/txt/release-6.2p2): | ||
1247 | - Only warn for missing identity files that were explicitly specified | ||
1248 | (closes: #708275). | ||
1249 | - Fix bug in contributed contrib/ssh-copy-id script that could result in | ||
1250 | "rm *" being called on mktemp failure (closes: #708419). | ||
1251 | |||
1252 | -- Colin Watson <cjwatson@debian.org> Thu, 16 May 2013 14:05:06 +0100 | ||
1253 | |||
1254 | openssh (1:6.2p1-3) unstable; urgency=low | ||
1255 | |||
1256 | * Renumber Debian-specific additions to enum monitor_reqtype so that they | ||
1257 | fit within a single byte (thanks, Jason Conti; LP: #1179202). | ||
1258 | |||
1259 | -- Colin Watson <cjwatson@debian.org> Mon, 13 May 2013 10:56:04 +0100 | ||
1260 | |||
1261 | openssh (1:6.2p1-2) unstable; urgency=low | ||
1262 | |||
1263 | * Fix build failure on Ubuntu: | ||
1264 | - Include openbsd-compat/sys-queue.h from consolekit.c. | ||
1265 | - Fix consolekit mismerges in monitor.c and monitor_wrap.c. | ||
1266 | |||
1267 | -- Colin Watson <cjwatson@debian.org> Thu, 09 May 2013 09:45:57 +0100 | ||
1268 | |||
1269 | openssh (1:6.2p1-1) unstable; urgency=low | ||
1270 | |||
1271 | * New upstream release (http://www.openssh.com/txt/release-6.2). | ||
1272 | - Add support for multiple required authentication in SSH protocol 2 via | ||
1273 | an AuthenticationMethods option (closes: #195716). | ||
1274 | - Fix Sophie Germain formula in moduli(5) (closes: #698612). | ||
1275 | - Update ssh-copy-id to Phil Hands' greatly revised version (closes: | ||
1276 | #99785, #322228, #620428; LP: #518883, #835901, #1074798). | ||
1277 | * Use dh-autoreconf. | ||
1278 | |||
1279 | -- Colin Watson <cjwatson@debian.org> Tue, 07 May 2013 11:48:16 +0100 | ||
1280 | |||
1281 | openssh (1:6.1p1-4) experimental; urgency=low | ||
1282 | |||
1283 | [ Gunnar Hjalmarsson ] | ||
1284 | * debian/openssh-server.sshd.pam: Explicitly state that ~/.pam_environment | ||
1285 | should be read, and move the pam_env calls from "auth" to "session" so | ||
1286 | that it's also read when $HOME is encrypted (LP: #952185). | ||
1287 | |||
1288 | [ Stéphane Graber ] | ||
1289 | * Add ssh-agent upstart user job. This implements something similar to | ||
1290 | the 90x11-common_ssh-agent Xsession script. That is, start ssh-agent | ||
1291 | and set the appropriate environment variables (closes: #703906). | ||
1292 | |||
1293 | -- Colin Watson <cjwatson@debian.org> Mon, 25 Mar 2013 16:58:04 +0000 | ||
1294 | |||
1295 | openssh (1:6.1p1-3) experimental; urgency=low | ||
1296 | |||
1297 | * Give ssh and ssh-krb5 versioned dependencies on openssh-client and | ||
1298 | openssh-server, to try to reduce confusion when people run 'apt-get | ||
1299 | install ssh' or similar and expect that to upgrade everything relevant. | ||
1300 | * CVE-2010-5107: Improve DoS resistance by changing default of MaxStartups | ||
1301 | to 10:30:100 (closes: #700102). | ||
1302 | |||
1303 | -- Colin Watson <cjwatson@debian.org> Fri, 08 Feb 2013 21:07:31 +0000 | ||
1304 | |||
1305 | openssh (1:6.1p1-2) experimental; urgency=low | ||
1306 | |||
1307 | * Use xz compression for binary packages. | ||
1308 | * Merge from Ubuntu: | ||
1309 | - Add support for registering ConsoleKit sessions on login. (This is | ||
1310 | currently enabled only when building for Ubuntu.) | ||
1311 | - Drop openssh-blacklist and openssh-blacklist-extra to Suggests. It's | ||
1312 | been long enough since the relevant vulnerability that we shouldn't | ||
1313 | need these installed by default nowadays. | ||
1314 | - Add an Upstart job (not currently used by default in Debian). | ||
1315 | - Add mention of ssh-keygen in ssh connect warning (Scott Moser). | ||
1316 | - Install apport hooks. | ||
1317 | * Only build with -j if DEB_BUILD_OPTIONS=parallel=* is used (closes: | ||
1318 | #694282). | ||
1319 | |||
1320 | -- Colin Watson <cjwatson@debian.org> Mon, 26 Nov 2012 16:39:07 +0000 | ||
1321 | |||
1322 | openssh (1:6.1p1-1) experimental; urgency=low | ||
1323 | |||
1324 | * New upstream release (http://www.openssh.com/txt/release-6.1). | ||
1325 | - Enable pre-auth sandboxing by default for new installs. | ||
1326 | - Allow "PermitOpen none" to refuse all port-forwarding requests | ||
1327 | (closes: #543683). | ||
1328 | |||
1329 | -- Colin Watson <cjwatson@debian.org> Fri, 07 Sep 2012 00:22:44 +0100 | ||
1330 | |||
1331 | openssh (1:6.0p1-3) unstable; urgency=low | ||
1332 | |||
1333 | * debconf template translations: | ||
1334 | - Add Indonesian (thanks, Andika Triwidada; closes: #681670). | ||
1335 | * Call restorecon on copied ~/.ssh/authorized_keys if possible, since some | ||
1336 | SELinux policies require this (closes: #658675). | ||
1337 | * Add ncurses-term to openssh-server's Recommends, since it's often needed | ||
1338 | to support unusual terminal emulators on clients (closes: #675362). | ||
1339 | |||
1340 | -- Colin Watson <cjwatson@debian.org> Fri, 24 Aug 2012 06:55:36 +0100 | ||
1341 | |||
1342 | openssh (1:6.0p1-2) unstable; urgency=low | ||
1343 | |||
1344 | * Tighten libssl1.0.0 and libcrypto1.0.0-udeb dependencies to the current | ||
1345 | "fix" version at build time (closes: #678661). | ||
1346 | |||
1347 | -- Colin Watson <cjwatson@debian.org> Sun, 24 Jun 2012 12:16:06 +0100 | ||
1348 | |||
1349 | openssh (1:6.0p1-1) unstable; urgency=low | ||
1350 | |||
1351 | [ Roger Leigh ] | ||
1352 | * Display dynamic part of MOTD from /run/motd.dynamic, if it exists | ||
1353 | (closes: #669699). | ||
1354 | |||
1355 | [ Colin Watson ] | ||
1356 | * Update OpenSSH FAQ to revision 1.113, fixing missing line break (closes: | ||
1357 | #669667). | ||
1358 | * New upstream release (closes: #671010, | ||
1359 | http://www.openssh.com/txt/release-6.0). | ||
1360 | - Fix IPQoS not being set on non-mapped v4-in-v6 addressed connections | ||
1361 | (closes: #643312, #650512, #671075). | ||
1362 | - Add a new privilege separation sandbox implementation for Linux's new | ||
1363 | seccomp sandbox, automatically enabled on platforms that support it. | ||
1364 | (Note: privilege separation sandboxing is still experimental.) | ||
1365 | * Fix a bashism in configure's seccomp_filter check. | ||
1366 | * Add a sandbox fallback mechanism, so that behaviour on Linux depends on | ||
1367 | whether the running system's kernel has seccomp_filter support, not the | ||
1368 | build system's kernel (forwarded upstream as | ||
1369 | https://bugzilla.mindrot.org/show_bug.cgi?id=2011). | ||
1370 | |||
1371 | -- Colin Watson <cjwatson@debian.org> Sat, 26 May 2012 13:48:14 +0100 | ||
1372 | |||
1373 | openssh (1:5.9p1-5) unstable; urgency=low | ||
1374 | |||
1375 | * Use dpkg-buildflags, including for hardening support; drop use of | ||
1376 | hardening-includes. | ||
1377 | * Fix cross-building: | ||
1378 | - Allow using a cross-architecture pkg-config. | ||
1379 | - Pass default LDFLAGS to contrib/Makefile. | ||
1380 | - Allow dh_strip to strip gnome-ssh-askpass, rather than calling | ||
1381 | 'install -s'. | ||
1382 | |||
1383 | -- Colin Watson <cjwatson@debian.org> Mon, 02 Apr 2012 11:20:33 +0100 | ||
1384 | |||
1385 | openssh (1:5.9p1-4) unstable; urgency=low | ||
1386 | |||
1387 | * Disable OpenSSL version check again, as its SONAME is sufficient | ||
1388 | nowadays (closes: #664383). | ||
1389 | |||
1390 | -- Colin Watson <cjwatson@debian.org> Mon, 19 Mar 2012 11:06:30 +0000 | ||
1391 | |||
1392 | openssh (1:5.9p1-3) unstable; urgency=low | ||
1393 | |||
1394 | * debconf template translations: | ||
1395 | - Update Polish (thanks, Michał Kułach; closes: #659829). | ||
1396 | * Ignore errors writing to console in init script (closes: #546743). | ||
1397 | * Move ssh-krb5 to Section: oldlibs. | ||
1398 | |||
1399 | -- Colin Watson <cjwatson@debian.org> Fri, 24 Feb 2012 08:56:18 +0000 | ||
1400 | |||
1401 | openssh (1:5.9p1-2) unstable; urgency=low | ||
1402 | |||
1403 | * Mark openssh-client and openssh-server as Multi-Arch: foreign. | ||
1404 | |||
1405 | -- Colin Watson <cjwatson@debian.org> Wed, 09 Nov 2011 02:06:48 +0000 | ||
1406 | |||
1407 | openssh (1:5.9p1-1) unstable; urgency=low | ||
1408 | |||
1409 | * New upstream release (http://www.openssh.com/txt/release-5.9). | ||
1410 | - Introduce sandboxing of the pre-auth privsep child using an optional | ||
1411 | sshd_config(5) "UsePrivilegeSeparation=sandbox" mode that enables | ||
1412 | mandatory restrictions on the syscalls the privsep child can perform. | ||
1413 | - Add new SHA256-based HMAC transport integrity modes from | ||
1414 | http://www.ietf.org/id/draft-dbider-sha2-mac-for-ssh-02.txt. | ||
1415 | - The pre-authentication sshd(8) privilege separation slave process now | ||
1416 | logs via a socket shared with the master process, avoiding the need to | ||
1417 | maintain /dev/log inside the chroot (closes: #75043, #429243, | ||
1418 | #599240). | ||
1419 | - ssh(1) now warns when a server refuses X11 forwarding (closes: | ||
1420 | #504757). | ||
1421 | - sshd_config(5)'s AuthorizedKeysFile now accepts multiple paths, | ||
1422 | separated by whitespace (closes: #76312). The authorized_keys2 | ||
1423 | fallback is deprecated but documented (closes: #560156). | ||
1424 | - ssh(1) and sshd(8): set IPv6 traffic class from IPQoS, as well as IPv4 | ||
1425 | ToS/DSCP (closes: #498297). | ||
1426 | - ssh-add(1) now accepts keys piped from standard input. E.g. "ssh-add | ||
1427 | - < /path/to/key" (closes: #229124). | ||
1428 | - Clean up lost-passphrase text in ssh-keygen(1) (closes: #444691). | ||
1429 | - Say "required" rather than "recommended" in unprotected-private-key | ||
1430 | warning (LP: #663455). | ||
1431 | * Update OpenSSH FAQ to revision 1.112. | ||
1432 | |||
1433 | -- Colin Watson <cjwatson@debian.org> Wed, 07 Sep 2011 23:46:00 +0100 | ||
1434 | |||
1435 | openssh (1:5.8p1-7) unstable; urgency=low | ||
1436 | |||
1437 | * Only recommend ssh-import-id when built on Ubuntu (closes: #635887). | ||
1438 | * Use 'dpkg-vendor --derives-from Ubuntu' to detect Ubuntu systems rather | ||
1439 | than 'lsb_release -is' so that Ubuntu derivatives behave the same way as | ||
1440 | Ubuntu itself. | ||
1441 | |||
1442 | -- Colin Watson <cjwatson@debian.org> Fri, 29 Jul 2011 14:27:52 +0100 | ||
1443 | |||
1444 | openssh (1:5.8p1-6) unstable; urgency=low | ||
1445 | |||
1446 | * openssh-client and openssh-server Suggests: monkeysphere. | ||
1447 | * Quieten logs when multiple from= restrictions are used in different | ||
1448 | authorized_keys lines for the same key; it's still not ideal, but at | ||
1449 | least you'll only get one log entry per key (closes: #630606). | ||
1450 | * Merge from Ubuntu (Dustin Kirkland): | ||
1451 | - openssh-server Recommends: ssh-import-id (no-op in Debian since that | ||
1452 | package doesn't exist there, but this reduces the Ubuntu delta). | ||
1453 | |||
1454 | -- Colin Watson <cjwatson@debian.org> Thu, 28 Jul 2011 17:10:18 +0100 | ||
1455 | |||
1456 | openssh (1:5.8p1-5) unstable; urgency=low | ||
1457 | |||
1458 | * Drop openssh-server's dependency on openssh-blacklist to a | ||
1459 | recommendation (closes: #622604). | ||
1460 | * Update Vcs-* fields and README.source for Alioth changes. | ||
1461 | * Backport from upstream: | ||
1462 | - Make hostbased auth with ECDSA keys work correctly (closes: #633368). | ||
1463 | |||
1464 | -- Colin Watson <cjwatson@debian.org> Sun, 24 Jul 2011 11:06:47 +0100 | ||
1465 | |||
1466 | openssh (1:5.8p1-4) unstable; urgency=low | ||
1467 | |||
1468 | * Drop hardcoded dependencies on libssl0.9.8 and libcrypto0.9.8-udeb, | ||
1469 | since the required minimum versions are rather old now anyway and | ||
1470 | openssl has bumped its SONAME (thanks, Julien Cristau; closes: #620828). | ||
1471 | * Remove unreachable code from openssh-server.postinst. | ||
1472 | |||
1473 | -- Colin Watson <cjwatson@debian.org> Mon, 04 Apr 2011 15:56:18 +0100 | ||
1474 | |||
1475 | openssh (1:5.8p1-3) unstable; urgency=low | ||
1476 | |||
1477 | * Correct ssh-keygen instruction in the changelog for 1:5.7p1-1 (thanks, | ||
1478 | Joel Stanley). | ||
1479 | * Allow ssh-add to read from FIFOs (thanks, Daniel Kahn Gillmor; closes: | ||
1480 | #614897). | ||
1481 | |||
1482 | -- Colin Watson <cjwatson@debian.org> Fri, 18 Mar 2011 16:42:42 +0000 | ||
1483 | |||
1484 | openssh (1:5.8p1-2) unstable; urgency=low | ||
1485 | |||
1486 | * Upload to unstable. | ||
1487 | |||
1488 | -- Colin Watson <cjwatson@debian.org> Tue, 08 Feb 2011 10:59:17 +0000 | ||
1489 | |||
1490 | openssh (1:5.8p1-1) experimental; urgency=low | ||
1491 | |||
1492 | * New upstream release (http://www.openssh.com/txt/release-5.8): | ||
1493 | - Fix stack information leak in legacy certificate signing | ||
1494 | (http://www.openssh.com/txt/legacy-cert.adv). | ||
1495 | |||
1496 | -- Colin Watson <cjwatson@debian.org> Sat, 05 Feb 2011 11:13:11 +0000 | ||
1497 | |||
1498 | openssh (1:5.7p1-2) experimental; urgency=low | ||
1499 | |||
1500 | * Fix crash in ssh_selinux_setfscreatecon when SELinux is disabled | ||
1501 | (LP: #708571). | ||
1502 | |||
1503 | -- Colin Watson <cjwatson@debian.org> Thu, 27 Jan 2011 12:14:17 +0000 | ||
1504 | |||
1505 | openssh (1:5.7p1-1) experimental; urgency=low | ||
1506 | |||
1507 | * New upstream release (http://www.openssh.com/txt/release-5.7): | ||
1508 | - Implement Elliptic Curve Cryptography modes for key exchange (ECDH) | ||
1509 | and host/user keys (ECDSA) as specified by RFC5656. ECDH and ECDSA | ||
1510 | offer better performance than plain DH and DSA at the same equivalent | ||
1511 | symmetric key length, as well as much shorter keys. | ||
1512 | - sftp(1)/sftp-server(8): add a protocol extension to support a hard | ||
1513 | link operation. It is available through the "ln" command in the | ||
1514 | client. The old "ln" behaviour of creating a symlink is available | ||
1515 | using its "-s" option or through the preexisting "symlink" command. | ||
1516 | - scp(1): Add a new -3 option to scp: Copies between two remote hosts | ||
1517 | are transferred through the local host (closes: #508613). | ||
1518 | - ssh(1): "atomically" create the listening mux socket by binding it on | ||
1519 | a temporary name and then linking it into position after listen() has | ||
1520 | succeeded. This allows the mux clients to determine that the server | ||
1521 | socket is either ready or stale without races (closes: #454784). | ||
1522 | Stale server sockets are now automatically removed (closes: #523250). | ||
1523 | - ssh(1): install a SIGCHLD handler to reap expired child process | ||
1524 | (closes: #594687). | ||
1525 | - ssh(1)/ssh-agent(1): honour $TMPDIR for client xauth and ssh-agent | ||
1526 | temporary directories (closes: #357469, although only if you arrange | ||
1527 | for ssh-agent to actually see $TMPDIR since the setgid bit will cause | ||
1528 | it to be stripped off). | ||
1529 | * Update to current GSSAPI patch from | ||
1530 | http://www.sxw.org.uk/computing/patches/openssh-5.7p1-gsskex-all-20110125.patch: | ||
1531 | - Add GSSAPIServerIdentity option. | ||
1532 | * Generate ECDSA host keys on fresh installations. Upgraders who wish to | ||
1533 | add such host keys should manually add 'HostKey | ||
1534 | /etc/ssh/ssh_host_ecdsa_key' to /etc/ssh/sshd_config and run 'ssh-keygen | ||
1535 | -q -f /etc/ssh/ssh_host_ecdsa_key -N "" -t ecdsa'. | ||
1536 | * Build-depend on libssl-dev (>= 0.9.8g) to ensure sufficient ECC support. | ||
1537 | * Backport SELinux build fix from CVS. | ||
1538 | * Rearrange selinux-role.patch so that it links properly given this | ||
1539 | SELinux build fix. | ||
1540 | |||
1541 | -- Colin Watson <cjwatson@debian.org> Wed, 26 Jan 2011 23:48:02 +0000 | ||
1542 | |||
1543 | openssh (1:5.6p1-3) experimental; urgency=low | ||
1544 | |||
1545 | * Drop override for desktop-file-but-no-dh_desktop-call, which Lintian no | ||
1546 | longer issues. | ||
1547 | * Merge 1:5.5p1-6. | ||
1548 | |||
1549 | -- Colin Watson <cjwatson@debian.org> Thu, 30 Dec 2010 11:48:00 +0000 | ||
1550 | |||
1551 | openssh (1:5.6p1-2) experimental; urgency=low | ||
1552 | |||
1553 | * Backport upstream patch to install a SIGCHLD handler to reap expired ssh | ||
1554 | child processes, preventing lots of zombies when using ControlPersist | ||
1555 | (closes: #594687). | ||
1556 | |||
1557 | -- Colin Watson <cjwatson@debian.org> Tue, 26 Oct 2010 14:46:40 +0100 | ||
1558 | |||
1559 | openssh (1:5.6p1-1) experimental; urgency=low | ||
1560 | |||
1561 | * New upstream release (http://www.openssh.com/txt/release-5.6): | ||
1562 | - Added a ControlPersist option to ssh_config(5) that automatically | ||
1563 | starts a background ssh(1) multiplex master when connecting. This | ||
1564 | connection can stay alive indefinitely, or can be set to automatically | ||
1565 | close after a user-specified duration of inactivity (closes: #335697, | ||
1566 | #350898, #454787, #500573, #550262). | ||
1567 | - Support AuthorizedKeysFile, AuthorizedPrincipalsFile, | ||
1568 | HostbasedUsesNameFromPacketOnly, and PermitTunnel in sshd_config(5) | ||
1569 | Match blocks (closes: #549858). | ||
1570 | - sftp(1): fix ls in working directories that contain globbing | ||
1571 | characters in their pathnames (LP: #530714). | ||
1572 | |||
1573 | -- Colin Watson <cjwatson@debian.org> Tue, 24 Aug 2010 00:37:54 +0100 | ||
1574 | |||
1575 | openssh (1:5.5p1-6) unstable; urgency=low | ||
1576 | |||
1577 | * Touch /var/run/sshd/.placeholder in the preinst so that /var/run/sshd, | ||
1578 | which is intentionally no longer shipped in the openssh-server package | ||
1579 | due to /var/run often being a temporary directory, is not removed on | ||
1580 | upgrade (closes: #575582). | ||
1581 | |||
1582 | -- Colin Watson <cjwatson@debian.org> Sun, 26 Dec 2010 18:09:29 +0000 | ||
1583 | |||
1584 | openssh (1:5.5p1-5) unstable; urgency=low | ||
1585 | |||
1586 | * Use an architecture wildcard for libselinux1-dev (closes: #591740). | ||
1587 | * debconf template translations: | ||
1588 | - Update Danish (thanks, Joe Hansen; closes: #592800). | ||
1589 | |||
1590 | -- Colin Watson <cjwatson@debian.org> Mon, 23 Aug 2010 22:59:03 +0100 | ||
1591 | |||
1592 | openssh (1:5.5p1-4) unstable; urgency=low | ||
1593 | |||
1594 | [ Sebastian Andrzej Siewior ] | ||
1595 | * Add powerpcspe to architecture list for libselinux1-dev build-dependency | ||
1596 | (closes: #579843). | ||
1597 | |||
1598 | [ Colin Watson ] | ||
1599 | * Allow ~/.ssh/authorized_keys and other secure files to be | ||
1600 | group-writable, provided that the group in question contains only the | ||
1601 | file's owner; this extends a patch previously applied to ~/.ssh/config | ||
1602 | (closes: #581919). | ||
1603 | * Check primary group memberships as well as supplementary group | ||
1604 | memberships, and only allow group-writability by groups with exactly one | ||
1605 | member, as zero-member groups are typically used by setgid binaries | ||
1606 | rather than being user-private groups (closes: #581697). | ||
1607 | |||
1608 | -- Colin Watson <cjwatson@debian.org> Sat, 22 May 2010 23:37:20 +0100 | ||
1609 | |||
1610 | openssh (1:5.5p1-3) unstable; urgency=low | ||
1611 | |||
1612 | * Discard error messages while checking whether rsh, rlogin, and rcp | ||
1613 | alternatives exist (closes: #579285). | ||
1614 | * Drop IDEA key check; I don't think it works properly any more due to | ||
1615 | textual changes in error output, it's only relevant for direct upgrades | ||
1616 | from truly ancient versions, and it breaks upgrades if | ||
1617 | /etc/ssh/ssh_host_key can't be loaded (closes: #579570). | ||
1618 | |||
1619 | -- Colin Watson <cjwatson@debian.org> Wed, 28 Apr 2010 22:12:47 +0100 | ||
1620 | |||
1621 | openssh (1:5.5p1-2) unstable; urgency=low | ||
1622 | |||
1623 | * Use dh_installinit -n, since our maintainer scripts already handle this | ||
1624 | more carefully (thanks, Julien Cristau). | ||
1625 | |||
1626 | -- Colin Watson <cjwatson@debian.org> Sat, 17 Apr 2010 12:55:56 +0100 | ||
1627 | |||
1628 | openssh (1:5.5p1-1) unstable; urgency=low | ||
1629 | |||
1630 | * New upstream release: | ||
1631 | - Unbreak sshd_config's AuthorizedKeysFile option for $HOME-relative | ||
1632 | paths. | ||
1633 | - Include a language tag when sending a protocol 2 disconnection | ||
1634 | message. | ||
1635 | - Make logging of certificates used for user authentication more clear | ||
1636 | and consistent between CAs specified using TrustedUserCAKeys and | ||
1637 | authorized_keys. | ||
1638 | |||
1639 | -- Colin Watson <cjwatson@debian.org> Fri, 16 Apr 2010 10:27:30 +0100 | ||
1640 | |||
1641 | openssh (1:5.4p1-2) unstable; urgency=low | ||
1642 | |||
1643 | * Borrow patch from Fedora to add DNSSEC support: if glibc 2.11 is | ||
1644 | installed, the host key is published in an SSHFP RR secured with DNSSEC, | ||
1645 | and VerifyHostKeyDNS=yes, then ssh will no longer prompt for host key | ||
1646 | verification (closes: #572049). | ||
1647 | * Convert to dh(1), and use dh_installdocs --link-doc. | ||
1648 | * Drop lpia support, since Ubuntu no longer supports this architecture. | ||
1649 | * Use dh_install more effectively. | ||
1650 | * Add a NEWS.Debian entry about changes in smartcard support relative to | ||
1651 | previous unofficial builds (closes: #231472). | ||
1652 | |||
1653 | -- Colin Watson <cjwatson@debian.org> Sat, 10 Apr 2010 01:08:59 +0100 | ||
1654 | |||
1655 | openssh (1:5.4p1-1) unstable; urgency=low | ||
1656 | |||
1657 | * New upstream release (LP: #535029). | ||
1658 | - After a transition period of about 10 years, this release disables SSH | ||
1659 | protocol 1 by default. Clients and servers that need to use the | ||
1660 | legacy protocol must explicitly enable it in ssh_config / sshd_config | ||
1661 | or on the command-line. | ||
1662 | - Remove the libsectok/OpenSC-based smartcard code and add support for | ||
1663 | PKCS#11 tokens. This support is enabled by default in the Debian | ||
1664 | packaging, since it now doesn't involve additional library | ||
1665 | dependencies (closes: #231472, LP: #16918). | ||
1666 | - Add support for certificate authentication of users and hosts using a | ||
1667 | new, minimal OpenSSH certificate format (closes: #482806). | ||
1668 | - Added a 'netcat mode' to ssh(1): "ssh -W host:port ...". | ||
1669 | - Add the ability to revoke keys in sshd(8) and ssh(1). (For the Debian | ||
1670 | package, this overlaps with the key blacklisting facility added in | ||
1671 | openssh 1:4.7p1-9, but with different file formats and slightly | ||
1672 | different scopes; for the moment, I've roughly merged the two.) | ||
1673 | - Various multiplexing improvements, including support for requesting | ||
1674 | port-forwardings via the multiplex protocol (closes: #360151). | ||
1675 | - Allow setting an explicit umask on the sftp-server(8) commandline to | ||
1676 | override whatever default the user has (closes: #496843). | ||
1677 | - Many sftp client improvements, including tab-completion, more options, | ||
1678 | and recursive transfer support for get/put (LP: #33378). The old | ||
1679 | mget/mput commands never worked properly and have been removed | ||
1680 | (closes: #270399, #428082). | ||
1681 | - Do not prompt for a passphrase if we fail to open a keyfile, and log | ||
1682 | the reason why the open failed to debug (closes: #431538). | ||
1683 | - Prevent sftp from crashing when given a "-" without a command. Also, | ||
1684 | allow whitespace to follow a "-" (closes: #531561). | ||
1685 | |||
1686 | * Fix 'debian/rules quilt-setup' to avoid writing .orig files if some | ||
1687 | patches apply with offsets. | ||
1688 | * Include debian/ssh-askpass-gnome.png in the Debian tarball now that | ||
1689 | we're using a source format that permits this, rather than messing | ||
1690 | around with uudecode. | ||
1691 | * Drop compatibility with the old gssapi mechanism used in ssh-krb5 << | ||
1692 | 3.8.1p1-1. Simon Wilkinson refused this patch since the old gssapi | ||
1693 | mechanism was removed due to a serious security hole, and since these | ||
1694 | versions of ssh-krb5 are no longer security-supported by Debian I don't | ||
1695 | think there's any point keeping client compatibility for them. | ||
1696 | * Fix substitution of ETC_PAM_D_SSH, following the rename in 1:4.7p1-4. | ||
1697 | * Hardcode the location of xauth to /usr/bin/xauth rather than | ||
1698 | /usr/bin/X11/xauth (thanks, Aron Griffis; closes: #575725, LP: #8440). | ||
1699 | xauth no longer depends on x11-common, so we're no longer guaranteed to | ||
1700 | have the /usr/bin/X11 symlink available. I was taking advantage of the | ||
1701 | /usr/bin/X11 symlink to smooth X's move to /usr/bin, but this is far | ||
1702 | enough in the past now that it's probably safe to just use /usr/bin. | ||
1703 | * Remove SSHD_OOM_ADJUST configuration. sshd now unconditionally makes | ||
1704 | itself non-OOM-killable, and doesn't require configuration to avoid log | ||
1705 | spam in virtualisation containers (closes: #555625). | ||
1706 | * Drop Debian-specific removal of OpenSSL version check. Upstream ignores | ||
1707 | the two patchlevel nybbles now, which is sufficient to address the | ||
1708 | original reason this change was introduced, and it appears that any | ||
1709 | change in the major/minor/fix nybbles would involve a new libssl package | ||
1710 | name. (We'd still lose if the status nybble were ever changed, but that | ||
1711 | would mean somebody had packaged a development/beta version rather than | ||
1712 | a proper release, which doesn't appear to be normal practice.) | ||
1713 | * Drop most of our "LogLevel SILENT" (-qq) patch. This was originally | ||
1714 | introduced to match the behaviour of non-free SSH, in which -q does not | ||
1715 | suppress fatal errors, but matching the behaviour of OpenSSH upstream is | ||
1716 | much more important nowadays. We no longer document that -q does not | ||
1717 | suppress fatal errors (closes: #280609). Migrate "LogLevel SILENT" to | ||
1718 | "LogLevel QUIET" in sshd_config on upgrade. | ||
1719 | * Policy version 3.8.4: | ||
1720 | - Add a Homepage field. | ||
1721 | |||
1722 | -- Colin Watson <cjwatson@debian.org> Tue, 06 Apr 2010 22:38:31 +0100 | ||
1723 | |||
1724 | openssh (1:5.3p1-3) unstable; urgency=low | ||
1725 | |||
1726 | * Convert to source format 3.0 (quilt). | ||
1727 | * Update README.source to match, and add a 'quilt-setup' target to | ||
1728 | debian/rules for the benefit of those checking out the package from | ||
1729 | revision control. | ||
1730 | * All patches are now maintained separately and tagged according to DEP-3. | ||
1731 | * Add GSSAPIStoreCredentialsOnRekey to 'sshd -T' configuration dump. | ||
1732 | * Remove documentation of building for Debian 3.0 in README.Debian. | ||
1733 | Support for this was removed in 1:4.7p1-2. | ||
1734 | * Remove obsolete header from README.Debian dating from when people | ||
1735 | expected non-free SSH. | ||
1736 | * Update copyright years for GSSAPI patch. | ||
1737 | |||
1738 | -- Colin Watson <cjwatson@debian.org> Sun, 28 Feb 2010 01:35:53 +0000 | ||
1739 | |||
1740 | openssh (1:5.3p1-2) unstable; urgency=low | ||
1741 | |||
1742 | * Link with -Wl,--as-needed (closes: #560155). | ||
1743 | * Install upstream sshd_config as an example (closes: #415008). | ||
1744 | * Use dh_lintian. | ||
1745 | * Honour DEB_BUILD_OPTIONS=nocheck. | ||
1746 | |||
1747 | -- Colin Watson <cjwatson@debian.org> Mon, 22 Feb 2010 12:43:24 +0000 | ||
1748 | |||
1749 | openssh (1:5.3p1-1) unstable; urgency=low | ||
1750 | |||
1751 | * New upstream release. | ||
1752 | * Update to GSSAPI patch from | ||
1753 | http://www.sxw.org.uk/computing/patches/openssh-5.3p1-gsskex-all-20100124.patch. | ||
1754 | * Backport from upstream: | ||
1755 | - Do not fall back to adding keys without constraints (ssh-add -c / -t | ||
1756 | ...) when the agent refuses the constrained add request. This was a | ||
1757 | useful migration measure back in 2002 when constraints were new, but | ||
1758 | just adds risk now (LP: #209447). | ||
1759 | * Drop change from 1:3.8p1-3 to avoid setresuid() and setresgid() system | ||
1760 | calls. This only applied to Linux 2.2, which it's no longer feasible to | ||
1761 | run anyway (see 1:5.2p1-2 changelog). | ||
1762 | |||
1763 | -- Colin Watson <cjwatson@debian.org> Tue, 26 Jan 2010 11:55:29 +0000 | ||
1764 | |||
1765 | openssh (1:5.2p1-2) unstable; urgency=low | ||
1766 | |||
1767 | [ Colin Watson ] | ||
1768 | * Backport from upstream: | ||
1769 | - After sshd receives a SIGHUP, ignore subsequent HUPs while sshd | ||
1770 | re-execs itself. Prevents two HUPs in quick succession from resulting | ||
1771 | in sshd dying (LP: #497781). | ||
1772 | - Output a debug if we can't open an existing keyfile (LP: #505301). | ||
1773 | * Use host compiler for ssh-askpass-gnome when cross-compiling. | ||
1774 | * Don't run tests when cross-compiling. | ||
1775 | * Drop change from 1:3.6.1p2-5 to disable cmsg_type check for file | ||
1776 | descriptor passing when running on Linux 2.0. The previous stable | ||
1777 | release of Debian dropped support for Linux 2.4, let alone 2.0, so this | ||
1778 | very likely has no remaining users depending on it. | ||
1779 | |||
1780 | [ Kees Cook ] | ||
1781 | * Implement DebianBanner server configuration flag that can be set to "no" | ||
1782 | to allow sshd to run without the Debian-specific extra version in the | ||
1783 | initial protocol handshake (closes: #562048). | ||
1784 | |||
1785 | -- Colin Watson <cjwatson@debian.org> Sat, 16 Jan 2010 01:28:58 +0000 | ||
1786 | |||
1787 | openssh (1:5.2p1-1) unstable; urgency=low | ||
1788 | |||
1789 | * New upstream release (closes: #536182). Yes, I know 5.3p1 has been out | ||
1790 | for a while, but there's no GSSAPI patch available for it yet. | ||
1791 | - Change the default cipher order to prefer the AES CTR modes and the | ||
1792 | revised "arcfour256" mode to CBC mode ciphers that are susceptible to | ||
1793 | CPNI-957037 "Plaintext Recovery Attack Against SSH". | ||
1794 | - Add countermeasures to mitigate CPNI-957037-style attacks against the | ||
1795 | SSH protocol's use of CBC-mode ciphers. Upon detection of an invalid | ||
1796 | packet length or Message Authentication Code, ssh/sshd will continue | ||
1797 | reading up to the maximum supported packet length rather than | ||
1798 | immediately terminating the connection. This eliminates most of the | ||
1799 | known differences in behaviour that leaked information about the | ||
1800 | plaintext of injected data which formed the basis of this attack | ||
1801 | (closes: #506115, LP: #379329). | ||
1802 | - ForceCommand directive now accepts commandline arguments for the | ||
1803 | internal-sftp server (closes: #524423, LP: #362511). | ||
1804 | - Add AllowAgentForwarding to available Match keywords list (closes: | ||
1805 | #540623). | ||
1806 | - Make ssh(1) send the correct channel number for | ||
1807 | SSH2_MSG_CHANNEL_SUCCESS and SSH2_MSG_CHANNEL_FAILURE messages to | ||
1808 | avoid triggering 'Non-public channel' error messages on sshd(8) in | ||
1809 | openssh-5.1. | ||
1810 | - Avoid printing 'Non-public channel' warnings in sshd(8), since the | ||
1811 | ssh(1) has sent incorrect channel numbers since ~2004 (this reverts a | ||
1812 | behaviour introduced in openssh-5.1; closes: #496017). | ||
1813 | - Disable nonfunctional ssh(1) ~C escape handler in multiplex slave | ||
1814 | connections (closes: #507541). | ||
1815 | - Fix "whitepsace" typo in ssh_config(5) (closes: #514313, LP: #303835). | ||
1816 | * Update to GSSAPI patch from | ||
1817 | http://www.sxw.org.uk/computing/patches/openssh-5.2p1-gsskex-all-20090726.patch, | ||
1818 | including cascading credentials support (LP: #416958). | ||
1819 | * Use x11.pc when compiling/linking gnome-ssh-askpass2 (closes: #555951). | ||
1820 | * Moved to bzr.debian.org; add Vcs-Bzr and Vcs-Browser control fields. | ||
1821 | * Add debian/README.source with instructions on bzr handling. | ||
1822 | * Make ChrootDirectory work with SELinux (thanks, Russell Coker; closes: | ||
1823 | #556644). | ||
1824 | * Initialise sc to NULL in ssh_selinux_getctxbyname (thanks, Václav Ovsík; | ||
1825 | closes: #498684). | ||
1826 | * Don't duplicate backslashes when displaying server banner (thanks, | ||
1827 | Michał Górny; closes: #505378, LP: #425346). | ||
1828 | * Use hardening-includes for hardening logic (thanks, Kees Cook; closes: | ||
1829 | #561887). | ||
1830 | * Update OpenSSH FAQ to revision 1.110. | ||
1831 | * Remove ssh/new_config, only needed for direct upgrades from potato which | ||
1832 | are no longer particularly feasible anyway (closes: #420682). | ||
1833 | * Cope with insserv reordering of init script links. | ||
1834 | * Remove init script stop link in rc1, as killprocs handles it already. | ||
1835 | * Adjust short descriptions to avoid relying on previous experience with | ||
1836 | rsh, based on suggestions from Reuben Thomas (closes: #512198). | ||
1837 | * Remove manual page references to login.conf, which aren't applicable on | ||
1838 | non-BSD systems (closes: #154434). | ||
1839 | * Remove/adjust manual page references to BSD-specific /etc/rc (closes: | ||
1840 | #513417). | ||
1841 | * Refer to sshd_config(5) rather than sshd(8) in postinst-written | ||
1842 | /etc/ssh/sshd_config, and add UsePAM commentary from upstream-shipped | ||
1843 | configuration file (closes: #415008, although unfortunately this will | ||
1844 | only be conveniently visible on new installations). | ||
1845 | * Include URL to OpenBSD's ssl(8) in ssh(1), since I don't see a better | ||
1846 | source for the same information among Debian's manual pages (closes: | ||
1847 | #530692, LP: #456660). | ||
1848 | |||
1849 | -- Colin Watson <cjwatson@debian.org> Mon, 04 Jan 2010 13:23:35 +0000 | ||
1850 | |||
1851 | openssh (1:5.1p1-8) unstable; urgency=low | ||
1852 | |||
1853 | * Build with just -fPIC on mips/mipsel, not -fPIE as well (thanks, LIU Qi; | ||
1854 | closes: #538313). | ||
1855 | * Build-depend on libselinux1-dev on sh4 too (thanks, Nobuhiro Iwamatsu; | ||
1856 | closes: #547103). | ||
1857 | * Fix grammar in if-up script (closes: #549128). | ||
1858 | * Pass $SSHD_OPTS when checking configuration too (thanks, "sobtwmxt"; | ||
1859 | closes: #548662). | ||
1860 | |||
1861 | -- Colin Watson <cjwatson@debian.org> Mon, 05 Oct 2009 13:30:49 +0100 | ||
1862 | |||
1863 | openssh (1:5.1p1-7) unstable; urgency=low | ||
1864 | |||
1865 | * Update config.guess and config.sub from autotools-dev 20090611.1 | ||
1866 | (closes: #538301). | ||
1867 | * Set umask to 022 in the init script as well as postinsts (closes: | ||
1868 | #539030). | ||
1869 | * Add ${misc:Depends} to keep Lintian happy. | ||
1870 | * Use 'which' rather than 'type' in maintainer scripts. | ||
1871 | * Upgrade to debhelper v7. | ||
1872 | |||
1873 | -- Colin Watson <cjwatson@debian.org> Fri, 31 Jul 2009 16:28:10 +0100 | ||
1874 | |||
1875 | openssh (1:5.1p1-6) unstable; urgency=low | ||
1876 | |||
1877 | * Open /proc/self/oom_adj with O_RDONLY or O_WRONLY as necessary, rather | ||
1878 | than O_RDWR. | ||
1879 | * Disable OOM adjustment for vserver/OpenVZ (thanks, Karl Chen; closes: | ||
1880 | #511771). | ||
1881 | * Add ufw integration (thanks, Didier Roche; see | ||
1882 | https://wiki.ubuntu.com/UbuntuFirewall#Integrating%20UFW%20with%20Packages; | ||
1883 | LP: #261884). | ||
1884 | * Add a comment above PermitRootLogin in sshd_config pointing to | ||
1885 | README.Debian. | ||
1886 | * Check if delgroup is present in openssh-client.postrm (closes: #530501). | ||
1887 | * Build with -fPIC on mips/mipsel (thanks, Luk Claes; closes: #531942). | ||
1888 | * Remove /var/run/sshd from openssh-server package; it will be created at | ||
1889 | run-time before starting the server. | ||
1890 | * Use invoke-rc.d in openssh-server's if-up script. | ||
1891 | |||
1892 | -- Colin Watson <cjwatson@debian.org> Fri, 05 Jun 2009 11:56:03 +0100 | ||
1893 | |||
1894 | openssh (1:5.1p1-5) unstable; urgency=low | ||
1895 | |||
1896 | * Backport from upstream CVS (Markus Friedl): | ||
1897 | - packet_disconnect() on padding error, too. Should reduce the success | ||
1898 | probability for the CPNI-957037 Plaintext Recovery Attack to 2^-18. | ||
1899 | * Check that /var/run/sshd.pid exists and that the process ID listed there | ||
1900 | corresponds to sshd before running '/etc/init.d/ssh reload' from if-up | ||
1901 | script; SIGHUP is racy if called at boot before sshd has a chance to | ||
1902 | install its signal handler, but fortunately the pid file is written | ||
1903 | after that which lets us avoid the race (closes: #502444). | ||
1904 | * While the above is a valuable sanity-check, it turns out that it doesn't | ||
1905 | really fix the bug (thanks to Kevin Price for testing), so for the | ||
1906 | meantime we'll just use '/etc/init.d/ssh restart', even though it is | ||
1907 | unfortunately heavyweight. | ||
1908 | |||
1909 | -- Colin Watson <cjwatson@debian.org> Wed, 14 Jan 2009 00:34:08 +0000 | ||
1910 | |||
1911 | openssh (1:5.1p1-4) unstable; urgency=low | ||
1912 | |||
1913 | * ssh-copy-id: Strip trailing colons from hostname (closes: #226172, | ||
1914 | LP: #249706; thanks to Karl Goetz for nudging this along; forwarded | ||
1915 | upstream as https://bugzilla.mindrot.org/show_bug.cgi?id=1530). | ||
1916 | * Backport from upstream CVS (Markus Friedl): | ||
1917 | - Only send eow and no-more-sessions requests to openssh 5 and newer; | ||
1918 | fixes interop problems with broken ssh v2 implementations (closes: | ||
1919 | #495917). | ||
1920 | * Fix double-free when failing to parse a forwarding specification given | ||
1921 | using ~C (closes: #505330; forwarded upstream as | ||
1922 | https://bugzilla.mindrot.org/show_bug.cgi?id=1539). | ||
1923 | |||
1924 | -- Colin Watson <cjwatson@debian.org> Sun, 23 Nov 2008 14:46:10 +0000 | ||
1925 | |||
1926 | openssh (1:5.1p1-3) unstable; urgency=low | ||
1927 | |||
1928 | * Remove unnecessary ssh-vulnkey output in non-verbose mode when no | ||
1929 | compromised or unknown keys were found (closes: #496495). | ||
1930 | * Configure with --disable-strip; dh_strip will deal with stripping | ||
1931 | binaries and will honour DEB_BUILD_OPTIONS (thanks, Bernhard R. Link; | ||
1932 | closes: #498681). | ||
1933 | * Fix handling of zero-length server banners (thanks, Tomas Mraz; closes: | ||
1934 | #497026). | ||
1935 | |||
1936 | -- Colin Watson <cjwatson@debian.org> Tue, 30 Sep 2008 23:09:58 +0100 | ||
1937 | |||
1938 | openssh (1:5.1p1-2) unstable; urgency=low | ||
1939 | |||
1940 | * Look for $SHELL on the path when executing ProxyCommands or | ||
1941 | LocalCommands (closes: #492728). | ||
1942 | |||
1943 | -- Colin Watson <cjwatson@debian.org> Tue, 29 Jul 2008 15:31:25 +0100 | ||
1944 | |||
1945 | openssh (1:5.1p1-1) unstable; urgency=low | ||
1946 | |||
1947 | * New upstream release (closes: #474301). Important changes not previously | ||
1948 | backported to 4.7p1: | ||
1949 | - 4.9/4.9p1 (http://www.openssh.com/txt/release-4.9): | ||
1950 | + Added chroot(2) support for sshd(8), controlled by a new option | ||
1951 | "ChrootDirectory" (closes: #139047, LP: #24777). | ||
1952 | + Linked sftp-server(8) into sshd(8). The internal sftp server is used | ||
1953 | when the command "internal-sftp" is specified in a Subsystem or | ||
1954 | ForceCommand declaration. When used with ChrootDirectory, the | ||
1955 | internal sftp server requires no special configuration of files | ||
1956 | inside the chroot environment. | ||
1957 | + Added a protocol extension method "posix-rename@openssh.com" for | ||
1958 | sftp-server(8) to perform POSIX atomic rename() operations; sftp(1) | ||
1959 | prefers this if available (closes: #308561). | ||
1960 | + Removed the fixed limit of 100 file handles in sftp-server(8). | ||
1961 | + ssh(8) will now skip generation of SSH protocol 1 ephemeral server | ||
1962 | keys when in inetd mode and protocol 2 connections are negotiated. | ||
1963 | This speeds up protocol 2 connections to inetd-mode servers that | ||
1964 | also allow Protocol 1. | ||
1965 | + Accept the PermitRootLogin directive in a sshd_config(5) Match | ||
1966 | block. Allows for, e.g. permitting root only from the local network. | ||
1967 | + Reworked sftp(1) argument splitting and escaping to be more | ||
1968 | internally consistent (i.e. between sftp commands) and more | ||
1969 | consistent with sh(1). Please note that this will change the | ||
1970 | interpretation of some quoted strings, especially those with | ||
1971 | embedded backslash escape sequences. | ||
1972 | + Support "Banner=none" in sshd_config(5) to disable sending of a | ||
1973 | pre-login banner (e.g. in a Match block). | ||
1974 | + ssh(1) ProxyCommands are now executed with $SHELL rather than | ||
1975 | /bin/sh. | ||
1976 | + ssh(1)'s ConnectTimeout option is now applied to both the TCP | ||
1977 | connection and the SSH banner exchange (previously it just covered | ||
1978 | the TCP connection). This allows callers of ssh(1) to better detect | ||
1979 | and deal with stuck servers that accept a TCP connection but don't | ||
1980 | progress the protocol, and also makes ConnectTimeout useful for | ||
1981 | connections via a ProxyCommand. | ||
1982 | + scp(1) incorrectly reported "stalled" on slow copies (closes: | ||
1983 | #140828). | ||
1984 | + scp(1) date underflow for timestamps before epoch. | ||
1985 | + ssh(1) used the obsolete SIG DNS RRtype for host keys in DNS, | ||
1986 | instead of the current standard RRSIG. | ||
1987 | + Correctly drain ACKs when a sftp(1) upload write fails midway, | ||
1988 | avoids a fatal() exit from what should be a recoverable condition. | ||
1989 | + Fixed ssh-keygen(1) selective host key hashing (i.e. "ssh-keygen -HF | ||
1990 | hostname") to not include any IP address in the data to be hashed. | ||
1991 | + Make ssh(1) skip listening on the IPv6 wildcard address when a | ||
1992 | binding address of 0.0.0.0 is used against an old SSH server that | ||
1993 | does not support the RFC4254 syntax for wildcard bind addresses. | ||
1994 | + Enable IPV6_V6ONLY socket option on sshd(8) listen socket, as is | ||
1995 | already done for X11/TCP forwarding sockets (closes: #439661). | ||
1996 | + Fix FD leak that could hang a ssh(1) connection multiplexing master. | ||
1997 | + Make ssh(1) -q option documentation consistent with reality. | ||
1998 | + Fixed sshd(8) PAM support not calling pam_session_close(), or | ||
1999 | failing to call it with root privileges (closes: #372680). | ||
2000 | + Fix activation of OpenSSL engine support when requested in configure | ||
2001 | (LP: #119295). | ||
2002 | + Cache SELinux status earlier so we know if it's enabled after a | ||
2003 | chroot (LP: #237557). | ||
2004 | - 5.1/5.1p1 (http://www.openssh.com/txt/release-5.1): | ||
2005 | + Introduce experimental SSH Fingerprint ASCII Visualisation to ssh(1) | ||
2006 | and ssh-keygen(1). Visual fingerprint display is controlled by a new | ||
2007 | ssh_config(5) option "VisualHostKey". The intent is to render SSH | ||
2008 | host keys in a visual form that is amenable to easy recall and | ||
2009 | rejection of changed host keys. | ||
2010 | + sshd_config(5) now supports CIDR address/masklen matching in "Match | ||
2011 | address" blocks, with a fallback to classic wildcard matching. | ||
2012 | + sshd(8) now supports CIDR matching in ~/.ssh/authorized_keys | ||
2013 | from="..." restrictions, also with a fallback to classic wildcard | ||
2014 | matching. | ||
2015 | + Added an extended test mode (-T) to sshd(8) to request that it write | ||
2016 | its effective configuration to stdout and exit. Extended test mode | ||
2017 | also supports the specification of connection parameters (username, | ||
2018 | source address and hostname) to test the application of | ||
2019 | sshd_config(5) Match rules. | ||
2020 | + ssh(1) now prints the number of bytes transferred and the overall | ||
2021 | connection throughput for SSH protocol 2 sessions when in verbose | ||
2022 | mode (previously these statistics were displayed for protocol 1 | ||
2023 | connections only). | ||
2024 | + sftp-server(8) now supports extension methods statvfs@openssh.com | ||
2025 | and fstatvfs@openssh.com that implement statvfs(2)-like operations. | ||
2026 | + sftp(1) now has a "df" command to the sftp client that uses the | ||
2027 | statvfs@openssh.com to produce a df(1)-like display of filesystem | ||
2028 | space and inode utilisation (requires statvfs@openssh.com support on | ||
2029 | the server). | ||
2030 | + Added a MaxSessions option to sshd_config(5) to allow control of the | ||
2031 | number of multiplexed sessions supported over a single TCP | ||
2032 | connection. This allows increasing the number of allowed sessions | ||
2033 | above the previous default of 10, disabling connection multiplexing | ||
2034 | (MaxSessions=1) or disallowing login/shell/subsystem sessions | ||
2035 | entirely (MaxSessions=0). | ||
2036 | + Added a no-more-sessions@openssh.com global request extension that | ||
2037 | is sent from ssh(1) to sshd(8) when the client knows that it will | ||
2038 | never request another session (i.e. when session multiplexing is | ||
2039 | disabled). This allows a server to disallow further session requests | ||
2040 | and terminate the session in cases where the client has been | ||
2041 | hijacked. | ||
2042 | + ssh-keygen(1) now supports the use of the -l option in combination | ||
2043 | with -F to search for a host in ~/.ssh/known_hosts and display its | ||
2044 | fingerprint. | ||
2045 | + ssh-keyscan(1) now defaults to "rsa" (protocol 2) keys, instead of | ||
2046 | "rsa1" (LP: #129794). | ||
2047 | + Added an AllowAgentForwarding option to sshd_config(8) to control | ||
2048 | whether authentication agent forwarding is permitted. Note that this | ||
2049 | is a loose control, as a client may install their own unofficial | ||
2050 | forwarder. | ||
2051 | + ssh(1) and sshd(8): avoid unnecessary malloc/copy/free when | ||
2052 | receiving network data, resulting in a ~10% speedup. | ||
2053 | + ssh(1) and sshd(8) will now try additional addresses when connecting | ||
2054 | to a port forward destination whose DNS name resolves to more than | ||
2055 | one address. The previous behaviour was to try the only first | ||
2056 | address and give up if that failed. | ||
2057 | + ssh(1) and sshd(8) now support signalling that channels are | ||
2058 | half-closed for writing, through a channel protocol extension | ||
2059 | notification "eow@openssh.com". This allows propagation of closed | ||
2060 | file descriptors, so that commands such as "ssh -2 localhost od | ||
2061 | /bin/ls | true" do not send unnecessary data over the wire. | ||
2062 | + sshd(8): increased the default size of ssh protocol 1 ephemeral keys | ||
2063 | from 768 to 1024 bits. | ||
2064 | + When ssh(1) has been requested to fork after authentication ("ssh | ||
2065 | -f") with ExitOnForwardFailure enabled, delay the fork until after | ||
2066 | replies for any -R forwards have been seen. Allows for robust | ||
2067 | detection of -R forward failure when using -f. | ||
2068 | + "Match group" blocks in sshd_config(5) now support negation of | ||
2069 | groups. E.g. "Match group staff,!guests". | ||
2070 | + sftp(1) and sftp-server(8) now allow chmod-like operations to set | ||
2071 | set[ug]id/sticky bits. | ||
2072 | + The MaxAuthTries option is now permitted in sshd_config(5) match | ||
2073 | blocks. | ||
2074 | + Multiplexed ssh(1) sessions now support a subset of the ~ escapes | ||
2075 | that are available to a primary connection. | ||
2076 | + ssh(1) connection multiplexing will now fall back to creating a new | ||
2077 | connection in most error cases (closes: #352830). | ||
2078 | + Make ssh(1) deal more gracefully with channel requests that fail. | ||
2079 | Previously it would optimistically assume that requests would always | ||
2080 | succeed, which could cause hangs if they did not (e.g. when the | ||
2081 | server runs out of file descriptors). | ||
2082 | + ssh(1) now reports multiplexing errors via the multiplex slave's | ||
2083 | stderr where possible (subject to LogLevel in the mux master). | ||
2084 | + Fixed an UMAC alignment problem that manifested on Itanium | ||
2085 | platforms. | ||
2086 | * Remove our local version of moduli(5) now that there's one upstream. | ||
2087 | * Say "GTK+" rather than "GTK" in ssh-askpass-gnome's description. | ||
2088 | * Add lintian overrides for empty /usr/share/doc/openssh-client | ||
2089 | directories in openssh-server and ssh (necessary due to being symlink | ||
2090 | targets). | ||
2091 | * Merge from Ubuntu: | ||
2092 | - Add 'status' action to openssh-server init script, requiring lsb-base | ||
2093 | (>= 3.2-13) (thanks, Dustin Kirkland). | ||
2094 | * debconf template translations: | ||
2095 | - Update Korean (thanks, Sunjae Park; closes: #484821). | ||
2096 | |||
2097 | -- Colin Watson <cjwatson@debian.org> Fri, 25 Jul 2008 10:45:08 +0100 | ||
2098 | |||
2099 | openssh (1:4.7p1-13) unstable; urgency=low | ||
2100 | |||
2101 | * Add some helpful advice to the end of ssh-vulnkey's output if there are | ||
2102 | unknown or compromised keys (thanks, Dan Jacobson; closes: #483756). | ||
2103 | * Check compromised key blacklist in ssh or ssh-add, as well as in the | ||
2104 | server (LP: #232391). To override the blacklist check in ssh | ||
2105 | temporarily, use 'ssh -o UseBlacklistedKeys=yes'; there is no override | ||
2106 | for the blacklist check in ssh-add. | ||
2107 | * Add cross-references to ssh-vulnkey(1) to ssh(1), ssh-add(1), | ||
2108 | ssh-keygen(1), and sshd(8) (closes: #484451). | ||
2109 | * Change openssh-client-udeb's Installer-Menu-Item from 99900 to 99999 | ||
2110 | (thanks, Frans Pop). | ||
2111 | * Drop openssh-client-udeb isinstallable hack, as main-menu (>= 1.26) now | ||
2112 | takes care of that (thanks, Frans Pop; closes: #484404). | ||
2113 | * Update DEB_BUILD_OPTIONS parsing code from policy 3.8.0. | ||
2114 | * Add documentation on removing openssh-blacklist locally (see #484269). | ||
2115 | * Clarify documentation of SSHD_OOM_ADJUST, and make setting it to the | ||
2116 | empty string actually skip adjustment as intended (closes: #487325). | ||
2117 | * Remove empty /usr/share/applications directory in ssh-askpass-gnome. | ||
2118 | * debconf template translations: | ||
2119 | - Update Romanian (thanks, Cătălin Feștilă; closes: #485415). | ||
2120 | |||
2121 | -- Colin Watson <cjwatson@debian.org> Mon, 21 Jul 2008 12:18:28 +0100 | ||
2122 | |||
2123 | openssh (1:4.7p1-12) unstable; urgency=low | ||
2124 | |||
2125 | * Fill in CVE identifier for ssh-vulnkey bug fixed in 1:4.7p1-10. | ||
2126 | * Refactor rejection of blacklisted user keys into a single | ||
2127 | reject_blacklisted_key function in auth.c (thanks, Dmitry V. Levin). | ||
2128 | * Fix memory leak of blacklisted host keys (thanks, Dmitry V. Levin). | ||
2129 | * debconf template translations: | ||
2130 | - Update Dutch (thanks, Bart Cornelis; closes: #483004). | ||
2131 | - Update Brazilian Portuguese (thanks, Eder L. Marques; closes: | ||
2132 | #483142). | ||
2133 | - Update Slovak (thanks, Ivan Masár; closes: #483517). | ||
2134 | |||
2135 | -- Colin Watson <cjwatson@debian.org> Thu, 29 May 2008 21:41:29 +0100 | ||
2136 | |||
2137 | openssh (1:4.7p1-11) unstable; urgency=low | ||
2138 | |||
2139 | * Make init script depend on $syslog, and fix some other dependency | ||
2140 | glitches (thanks, Petter Reinholdtsen; closes: #481018). | ||
2141 | * Remove 0 and 6 from Default-Stop in init script (thanks, Kel Modderman; | ||
2142 | closes: #481151). | ||
2143 | * Restore OOM killer adjustment for child processes (thanks, Vaclav Ovsik; | ||
2144 | closes: #480020). | ||
2145 | * Allow building with heimdal-dev (LP: #125805). | ||
2146 | |||
2147 | * Check RSA1 keys without the need for a separate blacklist. Thanks to | ||
2148 | Simon Tatham for the idea. | ||
2149 | * Generate two keys with the PID forced to the same value and test that | ||
2150 | they differ, to defend against recurrences of the recent Debian OpenSSL | ||
2151 | vulnerability. | ||
2152 | * Recommend openssh-blacklist from openssh-client (closes: #481187). | ||
2153 | * Recommend openssh-blacklist-extra from openssh-client and | ||
2154 | openssh-server. | ||
2155 | * Make ssh-vulnkey report the file name and line number for each key | ||
2156 | (thanks, Heiko Schlittermann and Christopher Perry; closes: #481398). | ||
2157 | * Check for blacklists in /usr/share/ssh/ as well as /etc/ssh/ (see | ||
2158 | #481283). | ||
2159 | * Log IP addresses of hosts attempting to use blacklisted keys (closes: | ||
2160 | #481721). | ||
2161 | * Incorporate various ssh-vulnkey suggestions from Hugh Daniel: | ||
2162 | - Add -v (verbose) option, and don't print output for keys that have a | ||
2163 | blacklist file but that are not listed unless in verbose mode. | ||
2164 | - Move exit status documentation to a separate section. | ||
2165 | - Document key status descriptions. | ||
2166 | - Add key type to output. | ||
2167 | - Fix error output if ssh-vulnkey fails to read key files, with the | ||
2168 | exception of host keys unless -a was given. | ||
2169 | - In verbose mode, output the name of each file examined. | ||
2170 | * Handle leading IP addresses in ssh-vulnkey input (LP: #230497). | ||
2171 | * Fix various ssh-vulnkey problems pointed out by Solar Designer: | ||
2172 | - Fix some buffer handling inconsistencies. | ||
2173 | - Use xasprintf to build user key file names, avoiding truncation | ||
2174 | problems. | ||
2175 | - Drop to the user's UID when reading user keys with -a. | ||
2176 | - Use EUID rather than UID when run with no file names and without -a. | ||
2177 | - Reword "Unknown (no blacklist information)" to "Unknown (blacklist | ||
2178 | file not installed)". | ||
2179 | |||
2180 | * Fix typo in ssh/vulnerable_host_keys message (thanks, Esko Arajärvi). | ||
2181 | * debconf template translations: | ||
2182 | - Update Finnish (thanks, Esko Arajärvi; closes: #481530). | ||
2183 | - Update French (thanks, Christian Perrier; closes: #481576). | ||
2184 | - Update Norwegian Bokmål (thanks, Bjørn Steensrud; closes: #481591). | ||
2185 | - Update Galician (thanks, Jacobo Tarrio; closes: #481596). | ||
2186 | - Update Japanese (thanks, Kenshi Muto; closes: #481621). | ||
2187 | - Update Czech (thanks, Miroslav Kure; closes: #481624). | ||
2188 | - Update German (thanks, Helge Kreutzmann; closes: #481676). | ||
2189 | - Update Portuguese (thanks, Ricardo Silva; closes: #481781). | ||
2190 | - Update Basque (thanks, Piarres Beobide; closes: #481836). | ||
2191 | - Update Bulgarian (thanks, Damyan Ivanov; closes: #481870). | ||
2192 | - Update Vietnamese (thanks, Clytie Siddall; closes: #481876). | ||
2193 | - Update Spanish (thanks, Javier Fernandez-Sanguino Peña; closes: | ||
2194 | #482341). | ||
2195 | - Update Turkish (thanks, Mert Dirik; closes: #482548). | ||
2196 | - Update Russian (thanks, Yuri Kozlov; closes: #482887). | ||
2197 | - Update Swedish (thanks, Martin Bagge; closes: #482464). | ||
2198 | - Update Italian (thanks, Luca Monducci; closes: #482808). | ||
2199 | |||
2200 | -- Colin Watson <cjwatson@debian.org> Mon, 26 May 2008 12:21:39 +0100 | ||
2201 | |||
2202 | openssh (1:4.7p1-10) unstable; urgency=low | ||
2203 | |||
2204 | * Add a FILES section to ssh-vulnkey(1) (thanks, Hugh Daniel). | ||
2205 | * CVE-2008-2285: ssh-vulnkey handles options in authorized_keys | ||
2206 | (LP: #230029), and treats # as introducing a comment even if it is | ||
2207 | preceded by whitespace. | ||
2208 | |||
2209 | -- Colin Watson <cjwatson@debian.org> Wed, 14 May 2008 12:35:05 +0100 | ||
2210 | |||
2211 | openssh (1:4.7p1-9) unstable; urgency=critical | ||
2212 | |||
2213 | * Fill in CVE identifier for security vulnerability fixed in 1:4.7p1-8. | ||
2214 | * Mitigate OpenSSL security vulnerability (CVE-2008-0166): | ||
2215 | - Add key blacklisting support. Keys listed in | ||
2216 | /etc/ssh/blacklist.TYPE-LENGTH will be rejected for authentication by | ||
2217 | sshd, unless "PermitBlacklistedKeys yes" is set in | ||
2218 | /etc/ssh/sshd_config. | ||
2219 | - Add a new program, ssh-vulnkey, which can be used to check keys | ||
2220 | against these blacklists. | ||
2221 | - Depend on openssh-blacklist. | ||
2222 | - Force dependencies on libssl0.9.8 / libcrypto0.9.8-udeb to at least | ||
2223 | 0.9.8g-9. | ||
2224 | - Automatically regenerate known-compromised host keys, with a | ||
2225 | critical-priority debconf note. (I regret that there was no time to | ||
2226 | gather translations.) | ||
2227 | |||
2228 | -- Colin Watson <cjwatson@debian.org> Tue, 13 May 2008 12:33:38 +0100 | ||
2229 | |||
2230 | openssh (1:4.7p1-8) unstable; urgency=high | ||
2231 | |||
2232 | * Fill in CVE identifier for security vulnerability fixed in 1:4.7p1-5. | ||
2233 | * Rename KeepAlive to TCPKeepAlive in sshd_config, cleaning up from old | ||
2234 | configurations (LP: #211400). | ||
2235 | * Tweak scp's reporting of filenames in verbose mode to be a bit less | ||
2236 | confusing with spaces (thanks, Nicolas Valcárcel; LP: #89945). | ||
2237 | * Backport from 4.9p1: | ||
2238 | - CVE-2008-1657: Ignore ~/.ssh/rc if a sshd_config ForceCommand is | ||
2239 | specified. | ||
2240 | - Add no-user-rc authorized_keys option to disable execution of | ||
2241 | ~/.ssh/rc. | ||
2242 | * Backport from Simon Wilkinson's GSSAPI key exchange patch for 5.0p1: | ||
2243 | - Add code to actually implement GSSAPIStrictAcceptorCheck, which had | ||
2244 | somehow been omitted from a previous version of this patch (closes: | ||
2245 | #474246). | ||
2246 | |||
2247 | -- Colin Watson <cjwatson@debian.org> Sun, 06 Apr 2008 12:34:19 +0100 | ||
2248 | |||
2249 | openssh (1:4.7p1-7) unstable; urgency=low | ||
2250 | |||
2251 | * Ignore errors writing to oom_adj (closes: #473573). | ||
2252 | |||
2253 | -- Colin Watson <cjwatson@debian.org> Mon, 31 Mar 2008 16:24:44 +0100 | ||
2254 | |||
2255 | openssh (1:4.7p1-6) unstable; urgency=low | ||
2256 | |||
2257 | * Disable the Linux kernel's OOM-killer for the sshd parent; tweak | ||
2258 | SSHD_OOM_ADJUST in /etc/default/ssh to change this (closes: #341767). | ||
2259 | |||
2260 | -- Colin Watson <cjwatson@debian.org> Sun, 30 Mar 2008 21:14:12 +0100 | ||
2261 | |||
2262 | openssh (1:4.7p1-5) unstable; urgency=low | ||
2263 | |||
2264 | * Recommends: xauth rather than Suggests: xbase-clients. | ||
2265 | * Document in ssh(1) that '-S none' disables connection sharing | ||
2266 | (closes: #471437). | ||
2267 | * Patch from Red Hat / Fedora: | ||
2268 | - CVE-2008-1483: Don't use X11 forwarding port which can't be bound on | ||
2269 | all address families, preventing hijacking of X11 forwarding by | ||
2270 | unprivileged users when both IPv4 and IPv6 are configured (closes: | ||
2271 | #463011). | ||
2272 | * Use printf rather than echo -en (a bashism) in openssh-server.config and | ||
2273 | openssh-server.preinst. | ||
2274 | * debconf template translations: | ||
2275 | - Update Finnish (thanks, Esko Arajärvi; closes: #468563). | ||
2276 | |||
2277 | -- Colin Watson <cjwatson@debian.org> Sat, 22 Mar 2008 12:37:00 +0000 | ||
2278 | |||
2279 | openssh (1:4.7p1-4) unstable; urgency=low | ||
2280 | |||
2281 | [ Caleb Case ] | ||
2282 | * Fix configure detection of getseuserbyname and | ||
2283 | get_default_context_with_level (closes: #465614, LP: #188136). | ||
2284 | |||
2285 | [ Colin Watson ] | ||
2286 | * Include the autogenerated debian/copyright in the source package. | ||
2287 | * Move /etc/pam.d/ssh to /etc/pam.d/sshd, allowing us to stop defining | ||
2288 | SSHD_PAM_SERVICE (closes: #255870). | ||
2289 | |||
2290 | -- Colin Watson <cjwatson@debian.org> Wed, 13 Feb 2008 18:18:52 +0000 | ||
2291 | |||
2292 | openssh (1:4.7p1-3) unstable; urgency=low | ||
2293 | |||
2294 | * Improve grammar of ssh-askpass-gnome description. | ||
2295 | * Backport from upstream: | ||
2296 | - Use the correct packet maximum sizes for remote port and agent | ||
2297 | forwarding. Prevents the server from killing the connection if too | ||
2298 | much data is queued and an excessively large packet gets sent | ||
2299 | (https://bugzilla.mindrot.org/show_bug.cgi?id=1360). | ||
2300 | * Allow passing temporary daemon parameters on the init script's command | ||
2301 | line, e.g. '/etc/init.d/ssh start "-o PermitRootLogin=yes"' (thanks, | ||
2302 | Marc Haber; closes: #458547). | ||
2303 | |||
2304 | -- Colin Watson <cjwatson@debian.org> Fri, 01 Feb 2008 21:59:59 +0000 | ||
2305 | |||
2306 | openssh (1:4.7p1-2) unstable; urgency=low | ||
2307 | |||
2308 | * Adjust many relative links in faq.html to point to | ||
2309 | http://www.openssh.com/ (thanks, Dan Jacobson; mentioned in #459807). | ||
2310 | * Pass --with-mantype=doc to configure rather than build-depending on | ||
2311 | groff (closes: #460121). | ||
2312 | * Add armel to architecture list for libselinux1-dev build-dependency | ||
2313 | (closes: #460136). | ||
2314 | * Drop source-compatibility with Debian 3.0: | ||
2315 | - Remove support for building with GNOME 1. This allows simplification | ||
2316 | of our GNOME build-dependencies (see #460136). | ||
2317 | - Remove hacks to support the old PAM configuration scheme. | ||
2318 | - Remove compatibility for building without po-debconf. | ||
2319 | * Build-depend on libgtk2.0-dev rather than libgnomeui-dev. As far as I | ||
2320 | can see, the GTK2 version of ssh-askpass-gnome has never required | ||
2321 | libgnomeui-dev. | ||
2322 | |||
2323 | -- Colin Watson <cjwatson@debian.org> Fri, 11 Jan 2008 00:14:10 +0000 | ||
2324 | |||
2325 | openssh (1:4.7p1-1) unstable; urgency=low | ||
2326 | |||
2327 | * New upstream release (closes: #453367). | ||
2328 | - CVE-2007-4752: Prevent ssh(1) from using a trusted X11 cookie if | ||
2329 | creation of an untrusted cookie fails; found and fixed by Jan Pechanec | ||
2330 | (closes: #444738). | ||
2331 | - sshd(8) in new installations defaults to SSH Protocol 2 only. Existing | ||
2332 | installations are unchanged. | ||
2333 | - The SSH channel window size has been increased, and both ssh(1) | ||
2334 | sshd(8) now send window updates more aggressively. These improves | ||
2335 | performance on high-BDP (Bandwidth Delay Product) networks. | ||
2336 | - ssh(1) and sshd(8) now preserve MAC contexts between packets, which | ||
2337 | saves 2 hash calls per packet and results in 12-16% speedup for | ||
2338 | arcfour256/hmac-md5. | ||
2339 | - A new MAC algorithm has been added, UMAC-64 (RFC4418) as | ||
2340 | "umac-64@openssh.com". UMAC-64 has been measured to be approximately | ||
2341 | 20% faster than HMAC-MD5. | ||
2342 | - Failure to establish a ssh(1) TunnelForward is now treated as a fatal | ||
2343 | error when the ExitOnForwardFailure option is set. | ||
2344 | - ssh(1) returns a sensible exit status if the control master goes away | ||
2345 | without passing the full exit status. | ||
2346 | - When using a ProxyCommand in ssh(1), set the outgoing hostname with | ||
2347 | gethostname(2), allowing hostbased authentication to work. | ||
2348 | - Make scp(1) skip FIFOs rather than hanging (closes: #246774). | ||
2349 | - Encode non-printing characters in scp(1) filenames. These could cause | ||
2350 | copies to be aborted with a "protocol error". | ||
2351 | - Handle SIGINT in sshd(8) privilege separation child process to ensure | ||
2352 | that wtmp and lastlog records are correctly updated. | ||
2353 | - Report GSSAPI mechanism in errors, for libraries that support multiple | ||
2354 | mechanisms. | ||
2355 | - Improve documentation for ssh-add(1)'s -d option. | ||
2356 | - Rearrange and tidy GSSAPI code, removing server-only code being linked | ||
2357 | into the client. | ||
2358 | - Delay execution of ssh(1)'s LocalCommand until after all forwardings | ||
2359 | have been established. | ||
2360 | - In scp(1), do not truncate non-regular files. | ||
2361 | - Improve exit message from ControlMaster clients. | ||
2362 | - Prevent sftp-server(8) from reading until it runs out of buffer space, | ||
2363 | whereupon it would exit with a fatal error (closes: #365541). | ||
2364 | - pam_end() was not being called if authentication failed | ||
2365 | (closes: #405041). | ||
2366 | - Manual page datestamps updated (closes: #433181). | ||
2367 | * Install the OpenSSH FAQ in /usr/share/doc/openssh-client. | ||
2368 | - Includes documentation on copying files with colons using scp | ||
2369 | (closes: #303453). | ||
2370 | * Create /var/run/sshd on start even if /etc/ssh/sshd_not_to_be_run exists | ||
2371 | (closes: #453285). | ||
2372 | * Fix "overriden" typo in ssh(1) (thanks, A. Costa; closes: #390699). | ||
2373 | * Refactor debian/rules configure and make invocations to make development | ||
2374 | easier. | ||
2375 | * Remove the hideously old /etc/ssh/primes on upgrade (closes: #123013). | ||
2376 | * Update moduli(5) to revision 1.11 from OpenBSD CVS. | ||
2377 | * Document the non-default options we set as standard in ssh_config(5) and | ||
2378 | sshd_config(5) (closes: #327886, #345628). | ||
2379 | * Recode LICENCE to UTF-8 when concatenating it to debian/copyright. | ||
2380 | * Override desktop-file-but-no-dh_desktop-call lintian warning; the | ||
2381 | .desktop file is intentionally not installed (see 1:3.8.1p1-10). | ||
2382 | * Update copyright dates for Kerberos patch in debian/copyright.head. | ||
2383 | * Policy version 3.7.3: no changes required. | ||
2384 | |||
2385 | -- Colin Watson <cjwatson@debian.org> Mon, 24 Dec 2007 16:43:02 +0000 | ||
2386 | |||
2387 | openssh (1:4.6p1-7) unstable; urgency=low | ||
2388 | |||
2389 | * Don't build PIE executables on m68k (closes: #451192). | ||
2390 | * Use autotools-dev's recommended configure --build and --host options. | ||
2391 | * Adjust README.Debian to suggest mailing debian-ssh@lists.debian.org | ||
2392 | rather than Matthew. | ||
2393 | * Check whether deluser exists in postrm (closes: #454085). | ||
2394 | |||
2395 | -- Colin Watson <cjwatson@debian.org> Mon, 03 Dec 2007 11:11:02 +0000 | ||
2396 | |||
2397 | openssh (1:4.6p1-6) unstable; urgency=low | ||
2398 | |||
2399 | * Remove blank line between head comment and first template in | ||
2400 | debian/openssh-server.templates.master; apparently it confuses some | ||
2401 | versions of debconf. | ||
2402 | * Install authorized_keys(5) as a symlink to sshd(8) (thanks, Tomas | ||
2403 | Pospisek; closes: #441817). | ||
2404 | * Discard error output from dpkg-query in preinsts, in case the ssh | ||
2405 | metapackage is not installed. | ||
2406 | * Fix sshd/inittab advice in README.Debian to account for rc.d movement | ||
2407 | (closes: #450632). | ||
2408 | * Suppress error from debian/rules if lsb-release is not installed. | ||
2409 | * Don't ignore errors from 'make -C contrib clean'. | ||
2410 | * Adjust categories in ssh-askpass-gnome.desktop to comply with the | ||
2411 | Desktop Menu Specification. | ||
2412 | * debconf template translations: | ||
2413 | - Add Slovak (thanks, Ivan Masár; closes: #441690). | ||
2414 | - Update Brazilian Portuguese (thanks, Eder L. Marques; | ||
2415 | closes: #447145). | ||
2416 | |||
2417 | -- Colin Watson <cjwatson@debian.org> Mon, 12 Nov 2007 11:47:28 +0000 | ||
2418 | |||
2419 | openssh (1:4.6p1-5) unstable; urgency=low | ||
2420 | |||
2421 | * Identify ssh as a metapackage rather than a transitional package. It's | ||
2422 | still useful as a quick way to install both the client and the server. | ||
2423 | * ssh-copy-id now checks the exit status of ssh-add -L (thanks, Adeodato | ||
2424 | Simó; closes: #221675). | ||
2425 | * ssh-copy-id no longer prints the output of expr (thanks, Peter | ||
2426 | Eisentraut; closes: #291534). | ||
2427 | * ssh-copy-id defaults to ~/.ssh/id_rsa.pub rather than | ||
2428 | ~/.ssh/identity.pub, in line with ssh-keygen (thanks, Greg Norris; | ||
2429 | closes: #234627). | ||
2430 | * Build-depend on libselinux1-dev on lpia. | ||
2431 | * openssh-client Suggests: keychain. | ||
2432 | * debconf template translations: | ||
2433 | - Update Catalan (thanks, Jordà Polo; closes: #431970). | ||
2434 | |||
2435 | -- Colin Watson <cjwatson@debian.org> Mon, 30 Jul 2007 09:34:38 +0100 | ||
2436 | |||
2437 | openssh (1:4.6p1-4) unstable; urgency=low | ||
2438 | |||
2439 | * Don't build PIE executables on hppa, as they crash. | ||
2440 | |||
2441 | -- Colin Watson <cjwatson@debian.org> Thu, 05 Jul 2007 11:06:54 +0100 | ||
2442 | |||
2443 | openssh (1:4.6p1-3) unstable; urgency=low | ||
2444 | |||
2445 | * Only build PIE executables on Linux and NetBSD (closes: #430455). | ||
2446 | * Fix broken switch fallthrough when SELinux is running in permissive mode | ||
2447 | (closes: #430838). | ||
2448 | * Document that HashKnownHosts may break tab-completion (closes: #430154). | ||
2449 | |||
2450 | -- Colin Watson <cjwatson@debian.org> Fri, 29 Jun 2007 07:15:38 +0100 | ||
2451 | |||
2452 | openssh (1:4.6p1-2) unstable; urgency=low | ||
2453 | |||
2454 | * Fix ordering of SYSLOG_LEVEL_QUIET and SYSLOG_LEVEL_FATAL. | ||
2455 | * Clarify that 'ssh -q -q' still prints errors caused by bad arguments | ||
2456 | (i.e. before the logging system is initialised). | ||
2457 | * Suppress "Connection to <host> closed" and "Connection to master closed" | ||
2458 | messages at loglevel SILENT (thanks, Jaap Eldering; closes: #409788). | ||
2459 | * Suppress "Pseudo-terminal will not be allocated because stdin is not a | ||
2460 | terminal" message at loglevels QUIET and SILENT (closes: #366814). | ||
2461 | * Document the SILENT loglevel in sftp-server(8), ssh_config(5), and | ||
2462 | sshd_config(5). | ||
2463 | * Add try-restart action to init script. | ||
2464 | * Add /etc/network/if-up.d/openssh-server to restart sshd when new | ||
2465 | interfaces appear (LP: #103436). | ||
2466 | * Backport from upstream: | ||
2467 | - Move C/R -> kbdint special case to after the defaults have been | ||
2468 | loaded, which makes ChallengeResponse default to yes again. This was | ||
2469 | broken by the Match changes and not fixed properly subsequently | ||
2470 | (closes: #428968). | ||
2471 | - Silence spurious error messages from hang-on-exit fix | ||
2472 | (http://bugzilla.mindrot.org/show_bug.cgi?id=1306, closes: #429531). | ||
2473 | |||
2474 | -- Colin Watson <cjwatson@debian.org> Wed, 20 Jun 2007 11:52:44 +0100 | ||
2475 | |||
2476 | openssh (1:4.6p1-1) unstable; urgency=low | ||
2477 | |||
2478 | * New upstream release (closes: #395507, #397961, #420035). Important | ||
2479 | changes not previously backported to 4.3p2: | ||
2480 | - 4.4/4.4p1 (http://www.openssh.com/txt/release-4.4): | ||
2481 | + On portable OpenSSH, fix a GSSAPI authentication abort that could be | ||
2482 | used to determine the validity of usernames on some platforms. | ||
2483 | + Implemented conditional configuration in sshd_config(5) using the | ||
2484 | "Match" directive. This allows some configuration options to be | ||
2485 | selectively overridden if specific criteria (based on user, group, | ||
2486 | hostname and/or address) are met. So far a useful subset of | ||
2487 | post-authentication options are supported and more are expected to | ||
2488 | be added in future releases. | ||
2489 | + Add support for Diffie-Hellman group exchange key agreement with a | ||
2490 | final hash of SHA256. | ||
2491 | + Added a "ForceCommand" directive to sshd_config(5). Similar to the | ||
2492 | command="..." option accepted in ~/.ssh/authorized_keys, this forces | ||
2493 | the execution of the specified command regardless of what the user | ||
2494 | requested. This is very useful in conjunction with the new "Match" | ||
2495 | option. | ||
2496 | + Add a "PermitOpen" directive to sshd_config(5). This mirrors the | ||
2497 | permitopen="..." authorized_keys option, allowing fine-grained | ||
2498 | control over the port-forwardings that a user is allowed to | ||
2499 | establish. | ||
2500 | + Add optional logging of transactions to sftp-server(8). | ||
2501 | + ssh(1) will now record port numbers for hosts stored in | ||
2502 | ~/.ssh/known_hosts when a non-standard port has been requested | ||
2503 | (closes: #50612). | ||
2504 | + Add an "ExitOnForwardFailure" option to cause ssh(1) to exit (with a | ||
2505 | non-zero exit code) when requested port forwardings could not be | ||
2506 | established. | ||
2507 | + Extend sshd_config(5) "SubSystem" declarations to allow the | ||
2508 | specification of command-line arguments. | ||
2509 | + Replacement of all integer overflow susceptible invocations of | ||
2510 | malloc(3) and realloc(3) with overflow-checking equivalents. | ||
2511 | + Many manpage fixes and improvements. | ||
2512 | + Add optional support for OpenSSL hardware accelerators (engines), | ||
2513 | enabled using the --with-ssl-engine configure option. | ||
2514 | + Tokens in configuration files may be double-quoted in order to | ||
2515 | contain spaces (closes: #319639). | ||
2516 | + Move a debug() call out of a SIGCHLD handler, fixing a hang when the | ||
2517 | session exits very quickly (closes: #307890). | ||
2518 | + Fix some incorrect buffer allocation calculations (closes: #410599). | ||
2519 | + ssh-add doesn't ask for a passphrase if key file permissions are too | ||
2520 | liberal (closes: #103677). | ||
2521 | + Likewise, ssh doesn't ask either (closes: #99675). | ||
2522 | - 4.6/4.6p1 (http://www.openssh.com/txt/release-4.6): | ||
2523 | + sshd now allows the enabling and disabling of authentication methods | ||
2524 | on a per user, group, host and network basis via the Match directive | ||
2525 | in sshd_config. | ||
2526 | + Fixed an inconsistent check for a terminal when displaying scp | ||
2527 | progress meter (closes: #257524). | ||
2528 | + Fix "hang on exit" when background processes are running at the time | ||
2529 | of exit on a ttyful/login session (closes: #88337). | ||
2530 | * Update to current GSSAPI patch from | ||
2531 | http://www.sxw.org.uk/computing/patches/openssh-4.6p1-gsskex-20070312.patch; | ||
2532 | install ChangeLog.gssapi. | ||
2533 | * Build the .deb --with-ssl-engine (closes: #408027, LP: #119295). | ||
2534 | * Use LSB functions in init scripts, and add an LSB-style header (partly | ||
2535 | from Ubuntu and partly thanks to Christian Perrier; closes: #389038). | ||
2536 | * Move init script start links to S16, move rc1 stop link to K84, and | ||
2537 | remove rc0 and rc6 stop links altogether (the last part from Ubuntu; | ||
2538 | closes: #122188). | ||
2539 | * Emit a slightly more informative message from the init script if | ||
2540 | /dev/null has somehow become not a character device (closes: #369964). | ||
2541 | * Belatedly build-depend on zlib1g-dev (>= 1:1.2.3-1) (closes: #333447). | ||
2542 | * Merge from Ubuntu: | ||
2543 | - Build position-independent executables (only for debs, not for udebs) | ||
2544 | to take advantage of address space layout randomisation. | ||
2545 | - If building on Ubuntu, add /sbin, /usr/sbin, and /usr/local/sbin to | ||
2546 | the default path. | ||
2547 | * Use ${binary:Version} rather than ${Source-Version} in openssh-server -> | ||
2548 | openssh-client dependency. | ||
2549 | |||
2550 | -- Colin Watson <cjwatson@debian.org> Wed, 13 Jun 2007 00:28:26 +0100 | ||
2551 | |||
2552 | openssh (1:4.3p2-11) unstable; urgency=low | ||
2553 | |||
2554 | * It's been four and a half years now since I took over as "temporary" | ||
2555 | maintainer, so the Maintainer field is getting a bit inaccurate. Set | ||
2556 | Maintainer to debian-ssh@lists.debian.org and leave Matthew and myself | ||
2557 | as Uploaders. | ||
2558 | * Use dpkg-query to fetch conffile md5sums rather than parsing | ||
2559 | /var/lib/dpkg/status directly. | ||
2560 | * openssh-client Suggests: libpam-ssh (closes: #427840). | ||
2561 | * Use 'start-stop-daemon --oknodo' so that openssh-server's init script | ||
2562 | exits successfully if sshd is already running (closes: #426858). | ||
2563 | |||
2564 | * Apply results of debconf templates and package descriptions review by | ||
2565 | debian-l10n-english (closes: #420107, #420742). | ||
2566 | * debconf template translations: | ||
2567 | - Update Dutch (thanks, Machteld de Kok; closes: #419260). | ||
2568 | - Update Norwegian Bokmål (thanks, Bjørn Steensrud; closes: #420630). | ||
2569 | - Update Galician (thanks, Jacobo Tarrio; closes: #420635). | ||
2570 | - Update Spanish (thanks, Javier Fernández-Sanguino Peña; | ||
2571 | closes: #420651). | ||
2572 | - Update Swedish (thanks, Daniel Nylander; closes: #420663). | ||
2573 | - Add Bulgarian (thanks, Damyan Ivanov; closes: #420703). | ||
2574 | - Add Tamil (thanks, Tirumurti Vasudevan; closes: #420739). | ||
2575 | - Update German (thanks, Helge Kreutzmann; closes: #420743). | ||
2576 | - Update Japanese (thanks, Kenshi Muto; closes: #420946). | ||
2577 | - Add Basque (thanks, Piarres Beobide; closes: #421238). | ||
2578 | - Update Italian (thanks, Luca Monducci; closes: #421348). | ||
2579 | - Update Czech (thanks, Miroslav Kure; closes: #421484). | ||
2580 | - Update Romanian (thanks, Igor Stirbu; closes: #421760). | ||
2581 | - Update Russian (thanks, Yuriy Talakan' and Sergey Alyoshin; | ||
2582 | closes: #420862). | ||
2583 | - Update Dutch (thanks, Bart Cornelis; closes: #422767). | ||
2584 | - Update Portuguese (thanks, Ricardo Silva; closes: #423112). | ||
2585 | - Update French (thanks, Christian Perrier). | ||
2586 | - Add Korean (thanks, Sunjae Park; closes: #424008). | ||
2587 | - Update Vietnamese (thanks, Clytie Siddall; closes: #426991). | ||
2588 | |||
2589 | -- Colin Watson <cjwatson@debian.org> Sun, 10 Jun 2007 08:59:42 +0100 | ||
2590 | |||
2591 | openssh (1:4.3p2-10) unstable; urgency=low | ||
2592 | |||
2593 | * Multiply openssh-client-udeb's Installer-Menu-Item by 100. | ||
2594 | * Increase MAX_SESSIONS to 64. | ||
2595 | |||
2596 | -- Colin Watson <cjwatson@debian.org> Tue, 10 Apr 2007 19:17:20 +0100 | ||
2597 | |||
2598 | openssh (1:4.3p2-9) unstable; urgency=high | ||
2599 | |||
2600 | [ Russ Allbery ] | ||
2601 | * Fix GSSAPIKeyExchange configuration file handling logic in ssh-krb5 | ||
2602 | (closes: #404863). | ||
2603 | * Fix uncommenting of GSSAPI options by ssh-krb5 (closes: #407766). | ||
2604 | |||
2605 | [ Colin Watson ] | ||
2606 | * debconf template translations: | ||
2607 | - Add Norwegian Bokmål (thanks, Bjørn Steensrud; closes: #412330). | ||
2608 | |||
2609 | -- Colin Watson <cjwatson@debian.org> Mon, 5 Mar 2007 16:13:50 +0000 | ||
2610 | |||
2611 | openssh (1:4.3p2-8) unstable; urgency=medium | ||
2612 | |||
2613 | [ Vincent Untz ] | ||
2614 | * Give the ssh-askpass-gnome window a default icon; remove unnecessary | ||
2615 | icon extension from .desktop file (closes: | ||
2616 | https://launchpad.net/bugs/27152). | ||
2617 | |||
2618 | [ Colin Watson ] | ||
2619 | * Drop versioning on ssh/ssh-krb5 Replaces, as otherwise it isn't | ||
2620 | sufficient to replace conffiles (closes: #402804). | ||
2621 | * Make GSSAPICleanupCreds a compatibility alias for | ||
2622 | GSSAPICleanupCredentials. Mark GSSUseSessionCCache and | ||
2623 | GSSAPIUseSessionCredCache as known-but-unsupported options, and migrate | ||
2624 | away from them on upgrade. | ||
2625 | * It turns out that the people who told me that removing a conffile in the | ||
2626 | preinst was sufficient to have dpkg replace it without prompting when | ||
2627 | moving a conffile between packages were very much mistaken. As far as I | ||
2628 | can tell, the only way to do this reliably is to write out the desired | ||
2629 | new text of the conffile in the preinst. This is gross, and requires | ||
2630 | shipping the text of all conffiles in the preinst too, but there's | ||
2631 | nothing for it. Fortunately this nonsense is only required for smooth | ||
2632 | upgrades from sarge. | ||
2633 | * debconf template translations: | ||
2634 | - Add Romanian (thanks, Stan Ioan-Eugen; closes: #403528). | ||
2635 | |||
2636 | -- Colin Watson <cjwatson@debian.org> Sat, 23 Dec 2006 18:38:33 +0000 | ||
2637 | |||
2638 | openssh (1:4.3p2-7) unstable; urgency=medium | ||
2639 | |||
2640 | [ Colin Watson ] | ||
2641 | * Ignore errors from usermod when changing sshd's shell, since it will | ||
2642 | fail if the sshd user is not local (closes: #398436). | ||
2643 | * Remove version control tags from /etc/ssh/moduli and /etc/ssh/ssh_config | ||
2644 | to avoid unnecessary conffile resolution steps for administrators | ||
2645 | (thanks, Jari Aalto; closes: #335259). | ||
2646 | * Fix quoting error in configure.ac and regenerate configure (thanks, Ben | ||
2647 | Pfaff; closes: #391248). | ||
2648 | * When installing openssh-client or openssh-server from scratch, remove | ||
2649 | any unchanged conffiles from the pre-split ssh package to work around a | ||
2650 | bug in sarge's dpkg (thanks, Justin Pryzby and others; closes: #335276). | ||
2651 | |||
2652 | [ Russ Allbery ] | ||
2653 | * Create transitional ssh-krb5 package which enables GSSAPI configuration | ||
2654 | in sshd_config (closes: #390986). | ||
2655 | * Default client to attempting GSSAPI authentication. | ||
2656 | * Remove obsolete GSSAPINoMICAuthentication from sshd_config if it's | ||
2657 | found. | ||
2658 | * Add ssh -K option, the converse of -k, to enable GSSAPI credential | ||
2659 | delegation (closes: #401483). | ||
2660 | |||
2661 | -- Colin Watson <cjwatson@debian.org> Wed, 6 Dec 2006 23:00:49 +0000 | ||
2662 | |||
2663 | openssh (1:4.3p2-6) unstable; urgency=low | ||
2664 | |||
2665 | * Acknowledge NMU (thanks, Manoj; closes: #394795). | ||
2666 | * Backport from 4.5p1: | ||
2667 | - Fix a bug in the sshd privilege separation monitor that weakened its | ||
2668 | verification of successful authentication. This bug is not known to be | ||
2669 | exploitable in the absence of additional vulnerabilities. | ||
2670 | * openssh-server Suggests: molly-guard (closes: #395473). | ||
2671 | * debconf template translations: | ||
2672 | - Update German (thanks, Helge Kreutzmann; closes: #395947). | ||
2673 | |||
2674 | -- Colin Watson <cjwatson@debian.org> Wed, 15 Nov 2006 00:07:32 +0000 | ||
2675 | |||
2676 | openssh (1:4.3p2-5.1) unstable; urgency=low | ||
2677 | |||
2678 | * NMU to update SELinux patch, bringing it in line with current selinux | ||
2679 | releases. The patch for this NMU is simply the Bug#394795 patch, | ||
2680 | and no other changes. (closes: #394795) | ||
2681 | |||
2682 | -- Manoj Srivastava <srivasta@debian.org> Mon, 23 Oct 2006 14:11:24 -0500 | ||
2683 | |||
2684 | openssh (1:4.3p2-5) unstable; urgency=low | ||
2685 | |||
2686 | * Remove ssh/insecure_telnetd check altogether (closes: #391081). | ||
2687 | * debconf template translations: | ||
2688 | - Update Danish (thanks, Claus Hindsgaul; closes: #390612). | ||
2689 | |||
2690 | -- Colin Watson <cjwatson@debian.org> Thu, 5 Oct 2006 09:04:19 +0100 | ||
2691 | |||
2692 | openssh (1:4.3p2-4) unstable; urgency=high | ||
2693 | |||
2694 | * Backport from 4.4p1 (since I don't have an updated version of the GSSAPI | ||
2695 | patch yet): | ||
2696 | - CVE-2006-4924: Fix a pre-authentication denial of service found by | ||
2697 | Tavis Ormandy, that would cause sshd(8) to spin until the login grace | ||
2698 | time expired (closes: #389995). | ||
2699 | - CVE-2006-5051: Fix an unsafe signal hander reported by Mark Dowd. The | ||
2700 | signal handler was vulnerable to a race condition that could be | ||
2701 | exploited to perform a pre-authentication denial of service. On | ||
2702 | portable OpenSSH, this vulnerability could theoretically lead to | ||
2703 | pre-authentication remote code execution if GSSAPI authentication is | ||
2704 | enabled, but the likelihood of successful exploitation appears remote. | ||
2705 | |||
2706 | * Read /etc/default/locale as well as /etc/environment (thanks, Raphaël | ||
2707 | Hertzog; closes: #369395). | ||
2708 | * Remove no-longer-used ssh/insecure_rshd debconf template. | ||
2709 | * Make ssh/insecure_telnetd Type: error (closes: #388946). | ||
2710 | |||
2711 | * debconf template translations: | ||
2712 | - Update Portuguese (thanks, Rui Branco; closes: #381942). | ||
2713 | - Update Spanish (thanks, Javier Fernández-Sanguino Peña; | ||
2714 | closes: #382966). | ||
2715 | |||
2716 | -- Colin Watson <cjwatson@debian.org> Fri, 29 Sep 2006 16:28:24 +0100 | ||
2717 | |||
2718 | openssh (1:4.3p2-3) unstable; urgency=low | ||
2719 | |||
2720 | * Document KeepAlive->TCPKeepAlive renaming in sshd_config(5) (closes: | ||
2721 | https://launchpad.net/bugs/50702). | ||
2722 | * Change sshd user's shell to /usr/sbin/nologin (closes: #366541). | ||
2723 | Introduces dependency on passwd for usermod. | ||
2724 | * debconf template translations: | ||
2725 | - Update French (thanks, Denis Barbier; closes: #368503). | ||
2726 | - Update Dutch (thanks, Bart Cornelis; closes: #375100). | ||
2727 | - Update Japanese (thanks, Kenshi Muto; closes: #379950). | ||
2728 | |||
2729 | -- Colin Watson <cjwatson@debian.org> Thu, 27 Jul 2006 00:12:36 +0100 | ||
2730 | |||
2731 | openssh (1:4.3p2-2) unstable; urgency=low | ||
2732 | |||
2733 | * Include commented-out pam_access example in /etc/pam.d/ssh. | ||
2734 | * On '/etc/init.d/ssh restart', create /var/run/sshd before checking the | ||
2735 | server configuration, as otherwise 'sshd -t' will complain about the | ||
2736 | lack of /var/run/sshd (closes: https://launchpad.net/bugs/45234). | ||
2737 | * debconf template translations: | ||
2738 | - Update Russian (thanks, Yuriy Talakan'; closes: #367143). | ||
2739 | - Update Czech (thanks, Miroslav Kure; closes: #367161). | ||
2740 | - Update Italian (thanks, Luca Monducci; closes: #367186). | ||
2741 | - Update Galician (thanks, Jacobo Tarrio; closes: #367318). | ||
2742 | - Update Swedish (thanks, Daniel Nylander; closes: #367971). | ||
2743 | |||
2744 | -- Colin Watson <cjwatson@debian.org> Fri, 19 May 2006 09:14:27 +0100 | ||
2745 | |||
2746 | openssh (1:4.3p2-1) unstable; urgency=low | ||
2747 | |||
2748 | * New upstream release (closes: #361032). | ||
2749 | - CVE-2006-0225: scp (as does rcp, on which it is based) invoked a | ||
2750 | subshell to perform local to local, and remote to remote copy | ||
2751 | operations. This subshell exposed filenames to shell expansion twice; | ||
2752 | allowing a local attacker to create filenames containing shell | ||
2753 | metacharacters that, if matched by a wildcard, could lead to execution | ||
2754 | of attacker-specified commands with the privilege of the user running | ||
2755 | scp (closes: #349645). | ||
2756 | - Add support for tunneling arbitrary network packets over a connection | ||
2757 | between an OpenSSH client and server via tun(4) virtual network | ||
2758 | interfaces. This allows the use of OpenSSH (4.3+) to create a true VPN | ||
2759 | between the client and server providing real network connectivity at | ||
2760 | layer 2 or 3. This feature is experimental. | ||
2761 | - Reduce default key length for new DSA keys generated by ssh-keygen | ||
2762 | back to 1024 bits. DSA is not specified for longer lengths and does | ||
2763 | not fully benefit from simply making keys longer. As per FIPS 186-2 | ||
2764 | Change Notice 1, ssh-keygen will refuse to generate a new DSA key | ||
2765 | smaller or larger than 1024 bits. | ||
2766 | - Fixed X forwarding failing to start when the X11 client is executed in | ||
2767 | background at the time of session exit. | ||
2768 | - Change ssh-keygen to generate a protocol 2 RSA key when invoked | ||
2769 | without arguments (closes: #114894). | ||
2770 | - Fix timing variance for valid vs. invalid accounts when attempting | ||
2771 | Kerberos authentication. | ||
2772 | - Ensure that ssh always returns code 255 on internal error | ||
2773 | (closes: #259865). | ||
2774 | - Cleanup wtmp files on SIGTERM when not using privsep. | ||
2775 | - Set SO_REUSEADDR on X11 listeners to avoid problems caused by | ||
2776 | lingering sockets from previous session (X11 applications can | ||
2777 | sometimes not connect to 127.0.0.1:60xx) (closes: | ||
2778 | https://launchpad.net/bugs/25528). | ||
2779 | - Ensure that fds 0, 1 and 2 are always attached in all programs, by | ||
2780 | duping /dev/null to them if necessary. | ||
2781 | - Xauth list invocation had bogus "." argument. | ||
2782 | - Remove internal assumptions on key exchange hash algorithm and output | ||
2783 | length, preparing OpenSSH for KEX methods with alternate hashes. | ||
2784 | - Ignore junk sent by a server before it sends the "SSH-" banner. | ||
2785 | - Many manual page improvements. | ||
2786 | - Lots of cleanups, including fixes to memory leaks on error paths and | ||
2787 | possible crashes. | ||
2788 | * Update to current GSSAPI patch from | ||
2789 | http://www.sxw.org.uk/computing/patches/openssh-4.3p2-gsskex-20060223.patch | ||
2790 | (closes: #352042). | ||
2791 | * debian/rules: Resynchronise CFLAGS with that generated by configure. | ||
2792 | * Restore pam_nologin to /etc/pam.d/ssh; sshd no longer checks this itself | ||
2793 | when PAM is enabled, but relies on PAM to do it. | ||
2794 | * Rename KeepAlive to TCPKeepAlive in default sshd_config | ||
2795 | (closes: #349896). | ||
2796 | * Rephrase ssh/new_config and ssh/encrypted_host_key_but_no_keygen debconf | ||
2797 | templates to make boolean short descriptions end with a question mark | ||
2798 | and to avoid use of the first person. | ||
2799 | * Ship README.tun. | ||
2800 | * Policy version 3.7.2: no changes required. | ||
2801 | * debconf template translations: | ||
2802 | - Update Italian (thanks, Luca Monducci; closes: #360348). | ||
2803 | - Add Galician (thanks, Jacobo Tarrio; closes: #361220). | ||
2804 | |||
2805 | -- Colin Watson <cjwatson@debian.org> Fri, 12 May 2006 12:48:24 +0100 | ||
2806 | |||
2807 | openssh (1:4.2p1-8) unstable; urgency=low | ||
2808 | |||
2809 | [ Frans Pop ] | ||
2810 | * Use udeb support introduced in debhelper 4.2.0 (available in sarge) | ||
2811 | rather than constructing udebs by steam. | ||
2812 | * Require debhelper 5.0.22, which generates correct shared library | ||
2813 | dependencies for udebs (closes: #360068). This build-dependency can be | ||
2814 | ignored if building on sarge. | ||
2815 | |||
2816 | [ Colin Watson ] | ||
2817 | * Switch to debhelper compatibility level 4, since we now require | ||
2818 | debhelper 4 even on sarge anyway for udeb support. | ||
2819 | |||
2820 | -- Colin Watson <cjwatson@debian.org> Fri, 31 Mar 2006 09:44:55 +0100 | ||
2821 | |||
2822 | openssh (1:4.2p1-7) unstable; urgency=low | ||
2823 | |||
2824 | * I accidentally applied the default $PATH change in 1:4.2p1-6 to the udeb | ||
2825 | rather than the deb. Fixed. | ||
2826 | |||
2827 | -- Colin Watson <cjwatson@debian.org> Wed, 1 Mar 2006 16:19:00 +0000 | ||
2828 | |||
2829 | openssh (1:4.2p1-6) unstable; urgency=low | ||
2830 | |||
2831 | * Sync default values of $PATH from shadow 1:4.0.12-6, adding /usr/bin/X11 | ||
2832 | to the normal and superuser paths and /usr/games to the normal path. | ||
2833 | * When the client receives a signal, don't fatal() with "Killed by signal | ||
2834 | %d." (which produces unhelpful noise on stderr and causes confusion for | ||
2835 | users of some applications that wrap ssh); instead, generate a debug | ||
2836 | message and exit with the traditional status (closes: #313371). | ||
2837 | * debconf template translations: | ||
2838 | - Add Swedish (thanks, Daniel Nylander; closes: #333133). | ||
2839 | - Update Spanish (thanks, Javier Fernández-Sanguino Peña; | ||
2840 | closes: #341371). | ||
2841 | - Correct erroneously-changed Last-Translator headers in Greek and | ||
2842 | Spanish translations. | ||
2843 | |||
2844 | -- Colin Watson <cjwatson@debian.org> Mon, 20 Feb 2006 16:50:55 +0000 | ||
2845 | |||
2846 | openssh (1:4.2p1-5) unstable; urgency=low | ||
2847 | |||
2848 | * Add a CVE name to the 1:4.0p1-1 changelog entry. | ||
2849 | * Build-depend on libselinux1-dev on armeb. | ||
2850 | * Only send GSSAPI proposal if GSSAPIAuthentication is enabled. | ||
2851 | * Build-depend on libssl-dev (>= 0.9.8-1) to cope with surprise OpenSSL | ||
2852 | transition, since otherwise who knows what the buildds will do. If | ||
2853 | you're building openssh yourself, you can safely ignore this and use an | ||
2854 | older libssl-dev. | ||
2855 | |||
2856 | -- Colin Watson <cjwatson@debian.org> Fri, 7 Oct 2005 12:23:42 +0100 | ||
2857 | |||
2858 | openssh (1:4.2p1-4) unstable; urgency=low | ||
2859 | |||
2860 | * Initialise token to GSS_C_EMPTY_BUFFER in ssh_gssapi_check_mechanism | ||
2861 | (closes: #328606). | ||
2862 | |||
2863 | -- Colin Watson <cjwatson@debian.org> Fri, 16 Sep 2005 12:50:16 +0100 | ||
2864 | |||
2865 | openssh (1:4.2p1-3) unstable; urgency=low | ||
2866 | |||
2867 | * Add prototype for ssh_gssapi_server_mechanisms (closes: #328372). | ||
2868 | * Interoperate with ssh-krb5 << 3.8.1p1-1 servers, which used a slightly | ||
2869 | different version of the gssapi authentication method (thanks, Aaron M. | ||
2870 | Ucko; closes: #328388). | ||
2871 | * Explicitly tell po2debconf to use the 'popular' output encoding, so that | ||
2872 | the woody-compatibility hack works even with po-debconf 0.9.0. | ||
2873 | |||
2874 | -- Colin Watson <cjwatson@debian.org> Thu, 15 Sep 2005 09:28:21 +0100 | ||
2875 | |||
2876 | openssh (1:4.2p1-2) unstable; urgency=low | ||
2877 | |||
2878 | * Annotate 1:4.2p1-1 changelog with CVE references. | ||
2879 | * Add remaining pieces of Kerberos support (closes: #152657, #275472): | ||
2880 | - Add GSSAPI key exchange support from | ||
2881 | http://www.sxw.org.uk/computing/patches/openssh.html (thanks, Stephen | ||
2882 | Frost). | ||
2883 | - Build-depend on libkrb5-dev and configure --with-kerberos5=/usr. | ||
2884 | - openssh-client and openssh-server replace ssh-krb5. | ||
2885 | - Update commented-out Kerberos/GSSAPI options in default sshd_config. | ||
2886 | - Fix HAVE_GSSAPI_KRB5_H/HAVE_GSSAPI_GSSAPI_KRB5_H typos in | ||
2887 | gss-serv-krb5.c. | ||
2888 | |||
2889 | -- Colin Watson <cjwatson@debian.org> Wed, 14 Sep 2005 18:28:49 +0100 | ||
2890 | |||
2891 | openssh (1:4.2p1-1) unstable; urgency=low | ||
2892 | |||
2893 | * New upstream release. | ||
2894 | - SECURITY (CAN-2005-2797): Fix a bug introduced in OpenSSH 4.0 that | ||
2895 | caused GatewayPorts to be incorrectly activated for dynamic ("-D") | ||
2896 | port forwardings when no listen address was explicitly specified | ||
2897 | (closes: #326065). | ||
2898 | - SECURITY (CAN-2005-2798): Fix improper delegation of GSSAPI | ||
2899 | credentials. This code is only built in openssh-krb5, not openssh, but | ||
2900 | I mention the CVE reference here anyway for completeness. | ||
2901 | - Add a new compression method ("Compression delayed") that delays zlib | ||
2902 | compression until after authentication, eliminating the risk of zlib | ||
2903 | vulnerabilities being exploited by unauthenticated users. Note that | ||
2904 | users of OpenSSH versions earlier than 3.5 will need to disable | ||
2905 | compression on the client or set "Compression yes" (losing this | ||
2906 | security benefit) on the server. | ||
2907 | - Increase the default size of new RSA/DSA keys generated by ssh-keygen | ||
2908 | from 1024 to 2048 bits (closes: #181162). | ||
2909 | - Many bugfixes and improvements to connection multiplexing. | ||
2910 | - Don't pretend to accept $HOME (closes: #208648). | ||
2911 | * debian/rules: Resynchronise CFLAGS with that generated by configure. | ||
2912 | * openssh-client and openssh-server conflict with pre-split ssh to avoid | ||
2913 | problems when ssh is left un-upgraded (closes: #324695). | ||
2914 | * Set X11Forwarding to yes in the default sshd_config (new installs only). | ||
2915 | At least when X11UseLocalhost is turned on, which is the default, the | ||
2916 | security risks of using X11 forwarding are risks to the client, not to | ||
2917 | the server (closes: #320104). | ||
2918 | |||
2919 | -- Colin Watson <cjwatson@debian.org> Wed, 14 Sep 2005 15:16:14 +0100 | ||
2920 | |||
2921 | openssh (1:4.1p1-7) unstable; urgency=low | ||
2922 | |||
2923 | * Do the IDEA host key check on a temporary file to avoid altering | ||
2924 | /etc/ssh/ssh_host_key itself (closes: #312312). | ||
2925 | * Work around the ssh-askpass alternative somehow ending up in manual mode | ||
2926 | pointing to the obsolete /usr/lib/ssh/gnome-ssh-askpass. | ||
2927 | * Add GNU/kFreeBSD support (thanks, Aurelien Jarno; closes: #318113). | ||
2928 | * Fix XSIish uses of 'test' in openssh-server.preinst. | ||
2929 | * Policy version 3.6.2: no changes required. | ||
2930 | |||
2931 | -- Colin Watson <cjwatson@debian.org> Fri, 2 Sep 2005 16:18:11 +0100 | ||
2932 | |||
2933 | openssh (1:4.1p1-6) unstable; urgency=low | ||
2934 | |||
2935 | * Fix one-character typo that meant the binaries in openssh-client and | ||
2936 | openssh-server got recompiled with the wrong options during | ||
2937 | 'debian/rules install' (closes: #317088, #317238, #317241). | ||
2938 | |||
2939 | -- Colin Watson <cjwatson@debian.org> Thu, 7 Jul 2005 10:56:16 +0100 | ||
2940 | |||
2941 | openssh (1:4.1p1-5) unstable; urgency=low | ||
2942 | |||
2943 | * Build-depend on libselinux1-dev on ppc64 too (closes: #314625). | ||
2944 | * Drop priority of ssh to extra to match the override file. | ||
2945 | * Make /usr/share/doc/openssh-server and /usr/share/doc/ssh symlinks to | ||
2946 | /usr/share/doc/openssh-client (closes: #314745). | ||
2947 | * Ship README.dns (closes: #284874). | ||
2948 | * Disable btmp logging, since Debian's /var/log/btmp has inappropriate | ||
2949 | permissions (closes: #314956). | ||
2950 | * Allow ~/.ssh/config to be group-writable, provided that the group in | ||
2951 | question contains only the file's owner (closes: #314347). | ||
2952 | * debconf template translations: | ||
2953 | - Update Brazilian Portuguese (thanks, André Luís Lopes; | ||
2954 | closes: #315477). | ||
2955 | - Add Vietnamese (thanks, Clytie Siddall; closes: #316636). | ||
2956 | |||
2957 | -- Colin Watson <cjwatson@debian.org> Sun, 3 Jul 2005 17:08:08 +0100 | ||
2958 | |||
2959 | openssh (1:4.1p1-4) unstable; urgency=low | ||
2960 | |||
2961 | * openssh-client and openssh-server conflict with ssh-krb5, as ssh-krb5 | ||
2962 | only conflicts with ssh (closes: #312475). | ||
2963 | * SELinux support (thanks, Manoj Srivastava; closes: #308555): | ||
2964 | - Added SELinux capability, and turned it on be default. Added | ||
2965 | restorecon calls in preinst and postinst (should not matter if the | ||
2966 | machine is not SELinux aware). By and large, the changes made should | ||
2967 | have no effect unless the rules file calls --with-selinux; and even | ||
2968 | then there should be no performance hit for machines not actively | ||
2969 | running SELinux. | ||
2970 | - Modified the preinst and postinst to call restorecon to set the | ||
2971 | security context for the generated public key files. | ||
2972 | - Added a comment to /etc/pam.d/ssh to indicate that an SELinux system | ||
2973 | may want to also include pam_selinux.so. | ||
2974 | * Re-enable ssh-askpass-gnome on the Hurd, now that its build-dependencies | ||
2975 | are available. | ||
2976 | * Restore /usr/lib/sftp-server temporarily, as a symlink to | ||
2977 | /usr/lib/openssh/sftp-server (closes: #312891). | ||
2978 | * Switch to debhelper compatibility level 3, since 2 is deprecated. | ||
2979 | * debconf template translations: | ||
2980 | - Update German (thanks, Jens Seidel; closes: #313949). | ||
2981 | |||
2982 | -- Colin Watson <cjwatson@debian.org> Fri, 17 Jun 2005 14:20:20 +0100 | ||
2983 | |||
2984 | openssh (1:4.1p1-3) unstable; urgency=low | ||
2985 | |||
2986 | * Upload to unstable. | ||
2987 | |||
2988 | -- Colin Watson <cjwatson@debian.org> Mon, 6 Jun 2005 22:28:33 +0100 | ||
2989 | |||
2990 | openssh (1:4.1p1-2) experimental; urgency=low | ||
2991 | |||
2992 | * Drop debconf support for allowing SSH protocol 1, which is discouraged | ||
2993 | and has not been the default since openssh 1:3.0.1p1-1. Users who need | ||
2994 | this should edit sshd_config instead (closes: #147212). | ||
2995 | * Since ssh-keysign isn't used by default (you need to set | ||
2996 | EnableSSHKeysign to "yes" in /etc/ssh/ssh_config), having a debconf | ||
2997 | question to ask whether it should be setuid is overkill, and the | ||
2998 | question text had got out of date anyway. Remove this question, ship | ||
2999 | ssh-keysign setuid in openssh-client.deb, and set a statoverride if the | ||
3000 | debconf question was previously set to false. | ||
3001 | * Add lintian overrides for the above (setuid-binary, | ||
3002 | no-debconf-templates). | ||
3003 | * Fix picky lintian errors about slogin symlinks. | ||
3004 | * Fix DEB_HOST_ARCH_OS/DEB_HOST_GNU_SYSTEM compatibility handling. | ||
3005 | * Apply Linux 2.2 workaround (see #239999) only on Linux. | ||
3006 | |||
3007 | -- Colin Watson <cjwatson@debian.org> Thu, 2 Jun 2005 00:55:58 +0100 | ||
3008 | |||
3009 | openssh (1:4.1p1-1) experimental; urgency=low | ||
3010 | |||
3011 | * New upstream release. | ||
3012 | - Normalise socket addresses returned by get_remote_hostname(), fixing | ||
3013 | 4-in-6 mapping issues with AllowUsers et al (closes: #192234). | ||
3014 | * Take upstream's hint and disable the unsupported USE_POSIX_THREADS | ||
3015 | (closes: #295757, #308868, and possibly others; may open other bugs). | ||
3016 | Use PAM password authentication to avoid #278394. In future I may | ||
3017 | provide two sets of binaries built with and without this option, since | ||
3018 | it seems I can't win. | ||
3019 | * Disable ChallengeResponseAuthentication in new installations, returning | ||
3020 | to PasswordAuthentication by default, since it now supports PAM and | ||
3021 | apparently works better with a non-threaded sshd (closes: #247521). | ||
3022 | * openssh-server Suggests: rssh (closes: #233012). | ||
3023 | * Change libexecdir to /usr/lib/openssh, and fix up various alternatives | ||
3024 | and configuration files to match (closes: #87900, #151321). | ||
3025 | * Fix up very old sshd_config files that refer to /usr/libexec/sftp-server | ||
3026 | (closes: #141979). | ||
3027 | |||
3028 | -- Colin Watson <cjwatson@debian.org> Tue, 31 May 2005 01:33:33 +0100 | ||
3029 | |||
3030 | openssh (1:4.0p1-1) experimental; urgency=low | ||
3031 | |||
3032 | * New upstream release. | ||
3033 | - Port-forwarding specifications now take optional bind addresses, and | ||
3034 | the server allows client-specified bind addresses for remote port | ||
3035 | forwardings when configured with "GatewayPorts clientspecified" | ||
3036 | (closes: #87253, #192206). | ||
3037 | - ssh and ssh-keyscan now support hashing of known_hosts files for | ||
3038 | improved privacy (CAN-2005-2666). ssh-keygen has new options for | ||
3039 | managing known_hosts files, which understand hashing. | ||
3040 | - sftp supports command history and editing support using libedit | ||
3041 | (closes: #287013). | ||
3042 | - Have scp and sftp wait for the spawned ssh to exit before they exit | ||
3043 | themselves, allowing ssh to restore terminal modes (closes: #257130). | ||
3044 | - Improved the handling of bad data in authorized_keys files, | ||
3045 | eliminating fatal errors on corrupt or very large keys; e.g. linefeeds | ||
3046 | in keys only produce errors in auth.log now (closes: #220726). | ||
3047 | - Add "command mode" to ssh connection multiplexing (closes: #303452). | ||
3048 | - Mention $HOME/.hushlogin in sshd(8) FILES section (closes: #163933). | ||
3049 | * Make gnome-ssh-askpass stay above other windows (thanks, Liyang HU; | ||
3050 | closes: #296487). | ||
3051 | * Remove obsolete and unnecessary ssh/forward_warning debconf note. | ||
3052 | * Hurd build fixes (although sshd still doesn't work): | ||
3053 | - Restore X forwarding fix from #102991, lost somewhere along the way. | ||
3054 | - Link with -lcrypt. | ||
3055 | - Link with -lpthread rather than -pthread. | ||
3056 | - Don't build ssh-askpass-gnome on the Hurd, until GNOME is available to | ||
3057 | satisfy build-dependencies. | ||
3058 | * Drop workaround for #242462 on amd64; it's been fixed properly upstream. | ||
3059 | * Enable HashKnownHosts by default. This only affects new entries; use | ||
3060 | 'ssh-keygen -H' to convert an entire known_hosts file to hashed format. | ||
3061 | * Note in ssh_config(5) that the SetupTimeOut option is Debian-specific | ||
3062 | (closes: #307069). | ||
3063 | * debconf template translations: | ||
3064 | - Update Czech (thanks, Miroslav Kure; closes: #298744). | ||
3065 | - Update Finnish (thanks, Matti Pöllä; closes: #303787). | ||
3066 | - Synchronise Spanish with sarge branch (thanks, Javier | ||
3067 | Fernández-Sanguino Peña; closes: #298536). | ||
3068 | - Add Ukrainian (thanks, Eugeniy Meshcheryakov; closes: #301852). | ||
3069 | |||
3070 | -- Colin Watson <cjwatson@debian.org> Thu, 26 May 2005 11:23:18 +0100 | ||
3071 | |||
3072 | openssh (1:3.9p1-3) experimental; urgency=low | ||
3073 | |||
3074 | * Explain how to run sshd from inittab in README.Debian (closes: #147360). | ||
3075 | * Add debian/watch file. | ||
3076 | |||
3077 | -- Colin Watson <cjwatson@debian.org> Fri, 18 Feb 2005 00:20:16 +0000 | ||
3078 | |||
3079 | openssh (1:3.9p1-2) experimental; urgency=low | ||
3080 | |||
3081 | * Remove pam_nologin from /etc/pam.d/ssh, as sshd's built-in support | ||
3082 | appears to be sufficient and more useful (closes: #162996). | ||
3083 | * Depend on debconf | debconf-2.0. | ||
3084 | * Drop LoginGraceTime back to the upstream default of two minutes on new | ||
3085 | installs (closes: #289573). | ||
3086 | * debconf template translations from Ubuntu bug #1232: | ||
3087 | - Update Greek (thanks, Logiotatidis George). | ||
3088 | - Update Spanish (thanks, Santiago Erquicia). | ||
3089 | |||
3090 | -- Colin Watson <cjwatson@debian.org> Sat, 15 Jan 2005 12:37:54 +0000 | ||
3091 | |||
3092 | openssh (1:3.9p1-1) experimental; urgency=low | ||
3093 | |||
3094 | * New upstream release. | ||
3095 | - PAM password authentication implemented again (closes: #238699, | ||
3096 | #242119). | ||
3097 | - Implemented the ability to pass selected environment variables between | ||
3098 | the client and the server. | ||
3099 | - Fix ssh-keyscan breakage when remote server doesn't speak SSH protocol | ||
3100 | (closes: #228828). | ||
3101 | - Fix res_query detection (closes: #242462). | ||
3102 | - 'ssh -c' documentation improved (closes: #265627). | ||
3103 | * Pass LANG and LC_* environment variables from the client by default, and | ||
3104 | accept them to the server by default in new installs, although not on | ||
3105 | upgrade (closes: #264024). | ||
3106 | * Build ssh in binary-indep, not binary-arch (thanks, LaMont Jones). | ||
3107 | * Expand on openssh-client package description (closes: #273831). | ||
3108 | |||
3109 | -- Colin Watson <cjwatson@debian.org> Tue, 4 Jan 2005 14:18:31 +0000 | ||
3110 | |||
3111 | openssh (1:3.8.1p1-14) experimental; urgency=low | ||
3112 | |||
3113 | * We use DH_COMPAT=2, so build-depend on debhelper (>= 2). | ||
3114 | * Fix timing information leak allowing discovery of invalid usernames in | ||
3115 | PAM keyboard-interactive authentication (backported from a patch by | ||
3116 | Darren Tucker; closes: #281595). | ||
3117 | * Make sure that there's a delay in PAM keyboard-interactive | ||
3118 | authentication when PermitRootLogin is not set to yes and the correct | ||
3119 | root password is entered (closes: #248747). | ||
3120 | |||
3121 | -- Colin Watson <cjwatson@debian.org> Sun, 28 Nov 2004 18:09:37 +0000 | ||
3122 | |||
3123 | openssh (1:3.8.1p1-13) experimental; urgency=low | ||
3124 | |||
3125 | * Enable threading for PAM, on Sam Hartman's advice (closes: #278394). | ||
3126 | * debconf template translations: | ||
3127 | - Update Dutch (thanks, cobaco; closes: #278715). | ||
3128 | * Correct README.Debian's ForwardX11Trusted description (closes: #280190). | ||
3129 | |||
3130 | -- Colin Watson <cjwatson@debian.org> Fri, 12 Nov 2004 12:03:13 +0000 | ||
3131 | |||
3132 | openssh (1:3.8.1p1-12) experimental; urgency=low | ||
3133 | |||
3134 | * Preserve /etc/ssh/sshd_config ownership/permissions (closes: #276754). | ||
3135 | * Shorten the version string from the form "OpenSSH_3.8.1p1 Debian | ||
3136 | 1:3.8.1p1-8.sarge.1" to "OpenSSH_3.8.1p1 Debian-8.sarge.1", as some SSH | ||
3137 | implementations apparently have problems with the long version string. | ||
3138 | This is of course a bug in those implementations, but since the extent | ||
3139 | of the problem is unknown it's best to play safe (closes: #275731). | ||
3140 | * debconf template translations: | ||
3141 | - Add Finnish (thanks, Matti Pöllä; closes: #265339). | ||
3142 | - Update Danish (thanks, Morten Brix Pedersen; closes: #275895). | ||
3143 | - Update French (thanks, Denis Barbier; closes: #276703). | ||
3144 | - Update Japanese (thanks, Kenshi Muto; closes: #277438). | ||
3145 | |||
3146 | -- Colin Watson <cjwatson@debian.org> Sun, 24 Oct 2004 19:21:17 +0100 | ||
3147 | |||
3148 | openssh (1:3.8.1p1-11) experimental; urgency=high | ||
3149 | |||
3150 | * Move sshd_config(5) to openssh-server, where it belongs. | ||
3151 | * If PasswordAuthentication is disabled, then offer to disable | ||
3152 | ChallengeResponseAuthentication too. The current PAM code will attempt | ||
3153 | password-style authentication if ChallengeResponseAuthentication is | ||
3154 | enabled (closes: #250369). | ||
3155 | * This will ask a question of anyone who installed fresh with 1:3.8p1-2 or | ||
3156 | later and then upgraded. Sorry about that ... for this reason, the | ||
3157 | default answer is to leave ChallengeResponseAuthentication enabled. | ||
3158 | |||
3159 | -- Colin Watson <cjwatson@debian.org> Wed, 6 Oct 2004 14:28:20 +0100 | ||
3160 | |||
3161 | openssh (1:3.8.1p1-10) experimental; urgency=low | ||
3162 | |||
3163 | * Don't install the ssh-askpass-gnome .desktop file by default; I've had | ||
3164 | too many GNOME people tell me it's the wrong thing to be doing. I've | ||
3165 | left it in /usr/share/doc/ssh-askpass-gnome/examples/ for now. | ||
3166 | |||
3167 | -- Colin Watson <cjwatson@debian.org> Wed, 25 Aug 2004 18:18:14 +0100 | ||
3168 | |||
3169 | openssh (1:3.8.1p1-9) experimental; urgency=low | ||
3170 | |||
3171 | * Split the ssh binary package into openssh-client and openssh-server | ||
3172 | (closes: #39741). openssh-server depends on openssh-client for some | ||
3173 | common functionality; it didn't seem worth creating yet another package | ||
3174 | for this. openssh-client is priority standard, openssh-server optional. | ||
3175 | * New transitional ssh package, priority optional, depending on | ||
3176 | openssh-client and openssh-server. May be removed once nothing depends | ||
3177 | on it. | ||
3178 | * When upgrading from ssh to openssh-{client,server}, it's very difficult | ||
3179 | for the maintainer scripts to find out what version we're upgrading from | ||
3180 | without dodgy dpkg hackery. I've therefore taken the opportunity to move | ||
3181 | a couple of debconf notes into NEWS files, namely ssh/ssh2_keys_merged | ||
3182 | and ssh/user_environment_tell. | ||
3183 | * Add a heuristic to try to make sure the sshd_config upgrade to >= 3.7 | ||
3184 | happens even though we don't know what version we're upgrading from. | ||
3185 | * Remove /etc/ssh/sshd_not_to_be_run on purge of openssh-server. For now | ||
3186 | (until sarge+2) it's still honoured to avoid breaking existing | ||
3187 | configurations, but the right approach is now to remove the | ||
3188 | openssh-server package if you don't want to run the server. Add a NEWS | ||
3189 | item to that effect. | ||
3190 | |||
3191 | -- Colin Watson <cjwatson@debian.org> Mon, 2 Aug 2004 20:48:54 +0100 | ||
3192 | |||
3193 | openssh (1:3.8.1p1-8.sarge.4) unstable; urgency=high | ||
3194 | |||
3195 | * Fix timing information leak allowing discovery of invalid usernames in | ||
3196 | PAM keyboard-interactive authentication (backported from a patch by | ||
3197 | Darren Tucker; closes: #281595). | ||
3198 | * Make sure that there's a delay in PAM keyboard-interactive | ||
3199 | authentication when PermitRootLogin is not set to yes and the correct | ||
3200 | root password is entered (closes: #248747). | ||
3201 | |||
3202 | -- Colin Watson <cjwatson@debian.org> Sun, 28 Nov 2004 12:37:16 +0000 | ||
3203 | |||
3204 | openssh (1:3.8.1p1-8.sarge.3) unstable; urgency=low | ||
3205 | |||
3206 | * Enable threading for PAM, on Sam Hartman's advice (closes: #278394). | ||
3207 | * debconf template translations: | ||
3208 | - Update Dutch (thanks, cobaco; closes: #278715). | ||
3209 | * Correct README.Debian's ForwardX11Trusted description (closes: #280190). | ||
3210 | |||
3211 | -- Colin Watson <cjwatson@debian.org> Fri, 12 Nov 2004 10:31:12 +0000 | ||
3212 | |||
3213 | openssh (1:3.8.1p1-8.sarge.2) unstable; urgency=low | ||
3214 | |||
3215 | * Preserve /etc/ssh/sshd_config ownership/permissions (closes: #276754). | ||
3216 | * Shorten the version string from the form "OpenSSH_3.8.1p1 Debian | ||
3217 | 1:3.8.1p1-8.sarge.1" to "OpenSSH_3.8.1p1 Debian-8.sarge.1", as some SSH | ||
3218 | implementations apparently have problems with the long version string. | ||
3219 | This is of course a bug in those implementations, but since the extent | ||
3220 | of the problem is unknown it's best to play safe (closes: #275731). | ||
3221 | * debconf template translations: | ||
3222 | - Add Finnish (thanks, Matti Pöllä; closes: #265339). | ||
3223 | - Update Danish (thanks, Morten Brix Pedersen; closes: #275895). | ||
3224 | - Update French (thanks, Denis Barbier; closes: #276703). | ||
3225 | - Update Japanese (thanks, Kenshi Muto; closes: #277438). | ||
3226 | |||
3227 | -- Colin Watson <cjwatson@debian.org> Sun, 24 Oct 2004 17:57:14 +0100 | ||
3228 | |||
3229 | openssh (1:3.8.1p1-8.sarge.1) unstable; urgency=high | ||
3230 | |||
3231 | * If PasswordAuthentication is disabled, then offer to disable | ||
3232 | ChallengeResponseAuthentication too. The current PAM code will attempt | ||
3233 | password-style authentication if ChallengeResponseAuthentication is | ||
3234 | enabled (closes: #250369). | ||
3235 | * This will ask a question of anyone who installed fresh with 1:3.8p1-2 or | ||
3236 | later and then upgraded. Sorry about that ... for this reason, the | ||
3237 | default answer is to leave ChallengeResponseAuthentication enabled. | ||
3238 | |||
3239 | -- Colin Watson <cjwatson@debian.org> Wed, 6 Oct 2004 14:21:55 +0100 | ||
3240 | |||
3241 | openssh (1:3.8.1p1-8) unstable; urgency=high | ||
3242 | |||
3243 | * Matthew Vernon: | ||
3244 | - Add a GPL exception to the licensing terms of the Debian patch | ||
3245 | (closes: #211644). | ||
3246 | |||
3247 | -- Colin Watson <cjwatson@debian.org> Thu, 29 Jul 2004 13:28:47 +0100 | ||
3248 | |||
3249 | openssh (1:3.8.1p1-7) unstable; urgency=low | ||
3250 | |||
3251 | * Re-enable shadow password support in openssh-server-udeb, at Bastian | ||
3252 | Blank's request (closes: #260800). | ||
3253 | |||
3254 | -- Colin Watson <cjwatson@debian.org> Thu, 22 Jul 2004 10:56:06 +0100 | ||
3255 | |||
3256 | openssh (1:3.8.1p1-6) unstable; urgency=low | ||
3257 | |||
3258 | * Implement hack in | ||
3259 | http://lists.debian.org/debian-boot/2004/07/msg01207.html to get | ||
3260 | openssh-client-udeb to show up as a retrievable debian-installer | ||
3261 | component. | ||
3262 | * Generate host keys in postinst only if the relevant HostKey directives | ||
3263 | are found in sshd_config (closes: #87946). | ||
3264 | |||
3265 | -- Colin Watson <cjwatson@debian.org> Wed, 21 Jul 2004 15:14:46 +0100 | ||
3266 | |||
3267 | openssh (1:3.8.1p1-5) unstable; urgency=medium | ||
3268 | |||
3269 | * Update German debconf template translation (thanks, Helge Kreutzmann; | ||
3270 | closes: #252226). | ||
3271 | * Remove Suggests: dnsutils, as it was only needed for | ||
3272 | make-ssh-known-hosts (#93265), which has been replaced by ssh-keyscan. | ||
3273 | * Disable shadow password support in openssh-server-udeb. | ||
3274 | * Fix non-portable shell constructs in maintainer scripts, Makefile, and | ||
3275 | ssh-copy-id (thanks, David Weinehall; closes: #258517). | ||
3276 | * Apply patch from Darren Tucker to make the PAM authentication SIGCHLD | ||
3277 | handler kill the PAM thread if its waitpid() call returns 0, as well as | ||
3278 | the previous check for -1 (closes: #252676). | ||
3279 | * Add scp and sftp to openssh-client-udeb. It might not be very 'u' any | ||
3280 | more; oh well. | ||
3281 | |||
3282 | -- Colin Watson <cjwatson@debian.org> Sat, 10 Jul 2004 13:57:27 +0100 | ||
3283 | |||
3284 | openssh (1:3.8.1p1-4) unstable; urgency=medium | ||
3285 | |||
3286 | * Kill off PAM thread if privsep slave dies (closes: #248125). | ||
3287 | |||
3288 | -- Colin Watson <cjwatson@debian.org> Fri, 28 May 2004 17:58:45 -0300 | ||
3289 | |||
3290 | openssh (1:3.8.1p1-3) unstable; urgency=low | ||
3291 | |||
3292 | * Add ssh-keygen to openssh-server-udeb. | ||
3293 | |||
3294 | -- Colin Watson <cjwatson@debian.org> Thu, 20 May 2004 16:31:52 +0100 | ||
3295 | |||
3296 | openssh (1:3.8.1p1-2) unstable; urgency=low | ||
3297 | |||
3298 | * Add Catalan debconf template translation (thanks, Aleix Badia i Bosch; | ||
3299 | closes: #248748). | ||
3300 | * openssh-client-udeb and openssh-server-udeb depend on libnss-files-udeb | ||
3301 | (not yet uploaded). | ||
3302 | * Restore ssh-askpass-gnome binary, lost by mistake. | ||
3303 | * Don't link against libnsl in udeb builds. | ||
3304 | |||
3305 | -- Colin Watson <cjwatson@debian.org> Thu, 20 May 2004 11:15:58 +0100 | ||
3306 | |||
3307 | openssh (1:3.8.1p1-1) unstable; urgency=low | ||
3308 | |||
3309 | * New upstream release. | ||
3310 | - Use a longer buffer for tty names in utmp (closes: #247538). | ||
3311 | * Make sure there's a newline at the end of sshd_config before adding | ||
3312 | 'UsePAM yes' (closes: #244829). | ||
3313 | * Generate a new .orig.tar.gz without RFC.nroff, and remove | ||
3314 | /usr/share/doc/ssh/RFC.gz (closes: #211640). It isn't DFSG-free and only | ||
3315 | documents the obsolete SSH1 protocol, not to mention that it was never a | ||
3316 | real RFC but only an Internet-Draft. It's available from | ||
3317 | http://www.free.lp.se/bamse/draft-ylonen-ssh-protocol-00.txt if you want | ||
3318 | it for some reason. | ||
3319 | * Add openssh-client-udeb and openssh-server-udeb binary packages for use | ||
3320 | in debian-installer. They still need libnss_files to be supplied in udeb | ||
3321 | form by glibc. | ||
3322 | * Work around lack of res_query weak alias in libresolv on amd64 (see | ||
3323 | #242462, awaiting real fix upstream). | ||
3324 | * Fix grammar in sshd(8) (closes: #238753). | ||
3325 | * Add .desktop file and icon for ssh-askpass-gnome (closes: #232333). | ||
3326 | * Update Polish debconf template translation (thanks, Emil Nowak; | ||
3327 | closes: #242808). | ||
3328 | * Add Turkish debconf template translation (thanks, Recai Oktaş; | ||
3329 | closes: #246068). | ||
3330 | |||
3331 | -- Colin Watson <cjwatson@debian.org> Tue, 11 May 2004 23:38:10 +0100 | ||
3332 | |||
3333 | openssh (1:3.8p1-3) unstable; urgency=low | ||
3334 | |||
3335 | * Remove deprecated ReverseMappingCheck option from newly generated | ||
3336 | sshd_config files (closes: #239987). | ||
3337 | * Build everything apart from contrib in a subdirectory, to allow for | ||
3338 | multiple builds. | ||
3339 | * Some older kernels are missing setresuid() and setresgid(), so don't try | ||
3340 | to use them. setreuid() and setregid() will do well enough for our | ||
3341 | purposes (closes: #239999). | ||
3342 | |||
3343 | -- Colin Watson <cjwatson@debian.org> Mon, 5 Apr 2004 21:23:43 +0100 | ||
3344 | |||
3345 | openssh (1:3.8p1-2) unstable; urgency=medium | ||
3346 | |||
3347 | * Disable PasswordAuthentication for new installations (closes: #236810). | ||
3348 | * Turn off the new ForwardX11Trusted by default, returning to the | ||
3349 | semantics of 3.7 and earlier, since it seems immature and causes far too | ||
3350 | many problems with existing setups. See README.Debian for details | ||
3351 | (closes: #237021). | ||
3352 | |||
3353 | -- Colin Watson <cjwatson@debian.org> Wed, 10 Mar 2004 10:33:07 +0000 | ||
3354 | |||
3355 | openssh (1:3.8p1-1) unstable; urgency=low | ||
3356 | |||
3357 | * New upstream release (closes: #232281): | ||
3358 | - New PAM implementation based on that in FreeBSD. This runs PAM session | ||
3359 | modules before dropping privileges (closes: #132681, #150968). | ||
3360 | - Since PAM session modules are run as root, we can turn pam_limits back | ||
3361 | on by default, and it no longer spits out "Operation not permitted" to | ||
3362 | syslog (closes: #171673). | ||
3363 | - Password expiry works again (closes: #153235). | ||
3364 | - 'ssh -q' suppresses login banner (closes: #134589). | ||
3365 | - sshd doesn't lie to PAM about invalid usernames (closes: #157078). | ||
3366 | - ssh-add prints key comment on each prompt (closes: #181869). | ||
3367 | - Punctuation formatting fixed in man pages (closes: #191131). | ||
3368 | - EnableSSHKeysign documented in ssh_config(5) (closes: #224457). | ||
3369 | * Add 'UsePAM yes' to /etc/ssh/sshd_config on upgrade from versions older | ||
3370 | than this, to maintain the standard Debian sshd configuration. | ||
3371 | * Comment out PAMAuthenticationViaKbdInt and RhostsAuthentication in | ||
3372 | sshd_config on upgrade. Neither option is supported any more. | ||
3373 | * Privilege separation and PAM are now properly supported together, so | ||
3374 | remove both debconf questions related to them and simply set it | ||
3375 | unconditionally in newly generated sshd_config files (closes: #228838). | ||
3376 | * ServerAliveInterval implemented upstream, so ProtocolKeepAlives is now a | ||
3377 | compatibility alias. The semantics differ slightly, though; see | ||
3378 | ssh_config(5) for details. | ||
3379 | * Implement SSH1 support for ServerAliveInterval using SSH_MSG_IGNORE. As | ||
3380 | documented in ssh_config(5), it's not as good as the SSH2 version. | ||
3381 | * Remove -fno-builtin-log, -DHAVE_MMAP_ANON_SHARED, and | ||
3382 | -D__FILE_OFFSET_BITS=64 compiler options, which are no longer necessary. | ||
3383 | * Update config.guess and config.sub from autotools-dev 20040105.1. | ||
3384 | * Darren Tucker: | ||
3385 | - Reset signal status when starting pam auth thread, prevent hanging | ||
3386 | during PAM keyboard-interactive authentications. | ||
3387 | - Fix a non-security-critical segfault in PAM authentication. | ||
3388 | * Add debconf template translations: | ||
3389 | - Greek (thanks, Konstantinos Margaritis; closes: #232843). | ||
3390 | - Italian (thanks, Renato Gini; closes: #234777). | ||
3391 | |||
3392 | -- Colin Watson <cjwatson@debian.org> Sat, 6 Mar 2004 18:43:44 +0000 | ||
3393 | |||
3394 | openssh (1:3.6.1p2-12) unstable; urgency=low | ||
3395 | |||
3396 | * Update Spanish debconf template translation (thanks, Javier | ||
3397 | Fernández-Sanguino Peña; closes: #228242). | ||
3398 | * Add debconf template translations: | ||
3399 | - Czech (thanks, Miroslav Kure; closes: #230110). | ||
3400 | - Simplified Chinese (thanks, Hiei Xu; closes: #230726). | ||
3401 | |||
3402 | -- Colin Watson <cjwatson@debian.org> Wed, 11 Feb 2004 09:37:57 +0000 | ||
3403 | |||
3404 | openssh (1:3.6.1p2-11) unstable; urgency=low | ||
3405 | |||
3406 | * Comment out pam_limits in default configuration, for now at least | ||
3407 | (closes: #198254). | ||
3408 | * Use invoke-rc.d (if it exists) to run the init script. | ||
3409 | * Backport format string bug fix in sshconnect.c (closes: #225238). | ||
3410 | * ssh-copy-id exits if ssh fails (closes: #215252). | ||
3411 | |||
3412 | -- Colin Watson <cjwatson@debian.org> Sun, 4 Jan 2004 18:59:21 +0000 | ||
3413 | |||
3414 | openssh (1:3.6.1p2-10) unstable; urgency=low | ||
3415 | |||
3416 | * Use --retry in init script when restarting rather than sleeping, to make | ||
3417 | sure the old process is dead (thanks, Herbert Xu; closes: #212117). | ||
3418 | Depend on dpkg (>= 1.9.0) for start-stop-daemon's --retry option. | ||
3419 | * Update debconf template translations: | ||
3420 | - Brazilian Portuguese (thanks, Andre Luis Lopes; closes: #219844). | ||
3421 | - Danish (thanks, Morten Brix Pedersen; closes: #217964). | ||
3422 | - Japanese (thanks, Kenshi Muto; closes: #212497). | ||
3423 | - Russian (thanks, Ilgiz Kalmetev). | ||
3424 | - Spanish (thanks, Carlos Valdivia Yagüe; closes: #211832). | ||
3425 | * Add Dutch debconf template translation (thanks, cobaco; | ||
3426 | closes: #215372). | ||
3427 | * Update config.guess and config.sub from autotools-dev 20031007.1 | ||
3428 | (closes: #217696). | ||
3429 | * Implement New World Order for PAM configuration, including | ||
3430 | /etc/pam.d/common-* from /etc/pam.d/ssh (closes: #212959). | ||
3431 | - To backport this release to woody, you need to set DEB_BUILD_SSH_WOODY | ||
3432 | in your environment. See README.Debian. | ||
3433 | * Add more commentary to /etc/pam.d/ssh. | ||
3434 | |||
3435 | -- Colin Watson <cjwatson@debian.org> Sun, 16 Nov 2003 01:14:16 +0000 | ||
3436 | |||
3437 | openssh (1:3.6.1p2-9) unstable; urgency=high | ||
3438 | |||
3439 | * Merge even more buffer allocation fixes from upstream (CAN-2003-0682; | ||
3440 | closes: #211434). | ||
3441 | |||
3442 | -- Colin Watson <cjwatson@debian.org> Fri, 19 Sep 2003 10:25:25 +0100 | ||
3443 | |||
3444 | openssh (1:3.6.1p2-8) unstable; urgency=high | ||
3445 | |||
3446 | * Merge more buffer allocation fixes from new upstream version 3.7.1p1 | ||
3447 | (closes: #211324). | ||
3448 | |||
3449 | -- Colin Watson <cjwatson@debian.org> Wed, 17 Sep 2003 03:07:19 +0100 | ||
3450 | |||
3451 | openssh (1:3.6.1p2-7) unstable; urgency=high | ||
3452 | |||
3453 | * Update debconf template translations: | ||
3454 | - French (thanks, Christian Perrier; closes: #208801). | ||
3455 | - Japanese (thanks, Kenshi Muto; closes: #210380). | ||
3456 | * Some small improvements to the English templates courtesy of Christian | ||
3457 | Perrier. I've manually unfuzzied a few translations where it was | ||
3458 | obvious, on Christian's advice, but the others will have to be updated. | ||
3459 | * Document how to generate an RSA1 host key (closes: #141703). | ||
3460 | * Incorporate NMU fix for early buffer expansion vulnerability, | ||
3461 | CAN-2003-0693 (closes: #211205). Thanks to Michael Stone. | ||
3462 | |||
3463 | -- Colin Watson <cjwatson@debian.org> Tue, 16 Sep 2003 14:32:28 +0100 | ||
3464 | |||
3465 | openssh (1:3.6.1p2-6.0) unstable; urgency=high | ||
3466 | |||
3467 | * SECURITY: fix for CAN-2003-0693, buffer allocation error | ||
3468 | |||
3469 | -- Michael Stone <mstone@debian.org> Tue, 16 Sep 2003 08:27:07 -0400 | ||
3470 | |||
3471 | openssh (1:3.6.1p2-6) unstable; urgency=medium | ||
3472 | |||
3473 | * Use a more CVS-friendly means of setting SSH_VERSION. | ||
3474 | * Update Brazilian Portuguese debconf template translation (thanks, Andre | ||
3475 | Luis Lopes; closes: #208036). | ||
3476 | * Don't run 'sshd -t' in init script if the server isn't to be run | ||
3477 | (closes: #197576). | ||
3478 | * Fix login delay, spurious auth.log entry, and PermitRootLogin | ||
3479 | information leakage due to PAM issues with upstream's recent security | ||
3480 | update (thanks, Darren Tucker; closes: #99168, #192207, #193546). | ||
3481 | * Policy version 3.6.1: recode this changelog to UTF-8. | ||
3482 | |||
3483 | -- Colin Watson <cjwatson@debian.org> Wed, 3 Sep 2003 19:14:02 +0100 | ||
3484 | |||
3485 | openssh (1:3.6.1p2-5) unstable; urgency=low | ||
3486 | |||
3487 | * Disable cmsg_type check for file descriptor passing when running on | ||
3488 | Linux 2.0 (closes: #150976). Remove comments about non-functional | ||
3489 | privilege separation on 2.0 from ssh/privsep_ask and ssh/privsep_tell | ||
3490 | debconf questions and from README.Debian, since it should all now work. | ||
3491 | * Fix "defails" typo in generated sshd_config (closes: #206484). | ||
3492 | * Backport upstream patch to strip trailing whitespace (including | ||
3493 | newlines) from configuration directives (closes: #192079). | ||
3494 | |||
3495 | -- Colin Watson <cjwatson@debian.org> Wed, 27 Aug 2003 02:19:57 +0100 | ||
3496 | |||
3497 | openssh (1:3.6.1p2-4) unstable; urgency=low | ||
3498 | |||
3499 | * getent can get just one key; no need to use grep (thanks, James Troup). | ||
3500 | * Move /usr/local/bin to the front of the default path, following | ||
3501 | /etc/login.defs (closes: #201150). | ||
3502 | * Remove specifics of problematic countries from package description | ||
3503 | (closes: #197040). | ||
3504 | * Update Spanish debconf template translation (thanks, Carlos Valdivia | ||
3505 | Yagüe; closes: #198456). | ||
3506 | * Backport upstream patch to pass monitor signals through to child | ||
3507 | (closes: #164797). | ||
3508 | |||
3509 | -- Colin Watson <cjwatson@debian.org> Sun, 27 Jul 2003 17:31:15 +0100 | ||
3510 | |||
3511 | openssh (1:3.6.1p2-3) unstable; urgency=low | ||
3512 | |||
3513 | * Update French debconf template translation (thanks, Christian Perrier; | ||
3514 | closes: #194323). | ||
3515 | * Version the adduser dependency for --no-create-home (closes: #195756). | ||
3516 | * Add a version of moduli(5), namely revision 1.7 of | ||
3517 | http://www.openbsd.org/cgi-bin/cvsweb/src/share/man/man5/moduli.5 with | ||
3518 | '/etc/moduli' changed to '/etc/ssh/moduli' throughout (closes: #196061). | ||
3519 | |||
3520 | -- Colin Watson <cjwatson@debian.org> Mon, 9 Jun 2003 02:51:35 +0100 | ||
3521 | |||
3522 | openssh (1:3.6.1p2-2) unstable; urgency=low | ||
3523 | |||
3524 | * Force /etc/default/ssh to be non-executable, since dpkg apparently | ||
3525 | doesn't deal with permissions changes on conffiles (closes: #192966). | ||
3526 | * Use debconf 0.5's seen flag rather than the deprecated isdefault. | ||
3527 | * Add GPL location to copyright file. | ||
3528 | * Remove debian/postinst.old. | ||
3529 | * Switch to po-debconf, with some careful manual use of po2debconf to | ||
3530 | ensure that the source package continues to build smoothly on woody | ||
3531 | (closes: #183986). | ||
3532 | * Update debconf template translations: | ||
3533 | - Brazilian Portugese (thanks, Andre Luis Lopes; see #183986). | ||
3534 | - Japanese (thanks, Tomohiro KUBOTA; closes: #192429). | ||
3535 | * Compile with -fno-builtin-log for now, otherwise gcc-3.3 complains | ||
3536 | "log.h:59: warning: conflicting types for built-in function `log'". The | ||
3537 | OpenSSH log() function has been renamed in upstream CVS. | ||
3538 | |||
3539 | -- Colin Watson <cjwatson@debian.org> Mon, 19 May 2003 01:52:38 +0100 | ||
3540 | |||
3541 | openssh (1:3.6.1p2-1) unstable; urgency=medium | ||
3542 | |||
3543 | * New upstream release, including fix for PAM user-discovery security hole | ||
3544 | (closes: #191681). | ||
3545 | * Fix ChallengeResponseAuthentication default in generated sshd_config | ||
3546 | (closes: #106037). | ||
3547 | * Put newlines after full stops in man page documentation for | ||
3548 | ProtocolKeepAlives and SetupTimeOut. | ||
3549 | * Policy version 3.5.9: support DEB_BUILD_OPTIONS=noopt, build | ||
3550 | gnome-ssh-askpass with -g and -Wall flags. | ||
3551 | * Really ask ssh/new_config debconf question before trying to fetch its | ||
3552 | value (closes: #188721). | ||
3553 | * On purge, remove only the files we know about in /etc/ssh rather than | ||
3554 | the whole thing, and remove the directory if that leaves it empty | ||
3555 | (closes: #176679). | ||
3556 | * ssh has depended on debconf for some time now with no complaints, so: | ||
3557 | - Simplify the postinst by relying on debconf being present. (The absent | ||
3558 | case was buggy anyway.) | ||
3559 | - Get rid of "if you have not installed debconf" text in README.Debian, | ||
3560 | and generally update the "/usr/bin/ssh not SUID" entry. | ||
3561 | * More README.Debian work: | ||
3562 | - Reorganize into "UPGRADE ISSUES" and "OTHER ISSUES", in an effort to | ||
3563 | make it easier for people to find the former. The upgrade issues | ||
3564 | should probably be sorted by version somehow. | ||
3565 | - Document X11UseLocalhost under "X11 Forwarding" (closes: #150913). | ||
3566 | * Fix setting of IP flags for interactive sessions (upstream bug #541). | ||
3567 | |||
3568 | -- Colin Watson <cjwatson@debian.org> Mon, 5 May 2003 17:47:40 +0100 | ||
3569 | |||
3570 | openssh (1:3.6.1p1-1) unstable; urgency=low | ||
3571 | |||
3572 | * New upstream release (thanks, Laurence J. Lane). | ||
3573 | * debian/control: ssh-askpass-gnome is now Section: gnome, following the | ||
3574 | override file. | ||
3575 | |||
3576 | -- Colin Watson <cjwatson@debian.org> Wed, 2 Apr 2003 00:51:02 +0100 | ||
3577 | |||
3578 | openssh (1:3.6p1-1) unstable; urgency=low | ||
3579 | |||
3580 | * New upstream release. | ||
3581 | - Workaround applied upstream for a bug in the interaction of glibc's | ||
3582 | getaddrinfo() with the Linux 2.2 kernel (closes: #155814). | ||
3583 | - As such, it should now be safe to remove --with-ipv4-default, so | ||
3584 | starting sshd with -6 is no longer necessary (closes: #79861 and lots | ||
3585 | of other merged bugs). | ||
3586 | - ssh-copy-id prints usage when run without arguments (closes: #71376). | ||
3587 | - scp exits 1 if ssh fails (closes: #138400). | ||
3588 | - sshd writes to utmp's ut_addr_v6 field in IPv6 mode (closes: #167867). | ||
3589 | - 'ssh-add -c' causes ssh-agent to ask the user each time a key is used | ||
3590 | (closes: #109795). | ||
3591 | * Install /etc/default/ssh non-executable (closes: #185537). | ||
3592 | |||
3593 | -- Colin Watson <cjwatson@debian.org> Mon, 31 Mar 2003 23:00:59 +0100 | ||
3594 | |||
3595 | openssh (1:3.5p1-5) unstable; urgency=low | ||
3596 | |||
3597 | * Add /etc/default/ssh (closes: #161049). | ||
3598 | * Run the init script under 'set -e' (closes: #175010). | ||
3599 | * Change the default superuser path to include /sbin, /usr/sbin, and | ||
3600 | /usr/local/sbin (closes: #128235, #151267). Using login.defs would be | ||
3601 | nice, but that belongs to another package. Without a defined API to | ||
3602 | retrieve its settings, parsing it is off-limits. | ||
3603 | * Build ssh-askpass-gnome with GNOME 2. The source package should still | ||
3604 | support building on stable with GNOME 1, using the alternate | ||
3605 | libgnome-dev build-dependency (thanks, Colin Walters; closes: #167582). | ||
3606 | |||
3607 | -- Colin Watson <cjwatson@debian.org> Sun, 9 Mar 2003 20:12:10 +0000 | ||
3608 | |||
3609 | openssh (1:3.5p1-4) unstable; urgency=low | ||
3610 | |||
3611 | * Point rlogin and rcp alternatives at slogin and scp respectively rather | ||
3612 | than ssh (closes: #121103, #151666). Fix alternative removal to match; | ||
3613 | previously it was completely wrong anyway. | ||
3614 | * Find out whether /etc/ssh/sshd_not_to_be_run exists and set the debconf | ||
3615 | question's default using that information, rather than using debconf as | ||
3616 | a registry. Other solutions may be better in the long run, but this is | ||
3617 | at least correct (thanks, Matthew Woodcraft; closes: #84725). | ||
3618 | * Stop using pam_lastlog, as it doesn't currently work well as a session | ||
3619 | module when privilege separation is enabled; it can usually read | ||
3620 | /var/log/lastlog but can't write to it. Instead, just use sshd's | ||
3621 | built-in support, already enabled by default (closes: #151297, #169938). | ||
3622 | * Use 'ssh-keygen -q' rather than redirecting output to /dev/null. | ||
3623 | * Add a "this may take some time" warning when creating host keys on | ||
3624 | installation (part of #110094). | ||
3625 | * When restarting via the init script, check for sshd_not_to_be_run after | ||
3626 | stopping sshd (idea from Tomas Pospisek; closes: #149850). | ||
3627 | * Append /usr/sbin:/sbin to the init script's $PATH, just in case of | ||
3628 | strangeness (closes: #115138). | ||
3629 | * Fix a dpkg-statoverride call to redirect stdout to /dev/null, not | ||
3630 | stderr. | ||
3631 | * Correct copyright file typo: "orignal" -> "original" (closes: #176490). | ||
3632 | * Rebuild with libssl0.9.7 (closes: #176983). | ||
3633 | * We're up to policy version 3.5.6. DEB_BUILD_OPTIONS stuff still needs to | ||
3634 | be looked at. | ||
3635 | |||
3636 | -- Colin Watson <cjwatson@debian.org> Sat, 18 Jan 2003 01:37:23 +0000 | ||
3637 | |||
3638 | openssh (1:3.5p1-3) unstable; urgency=low | ||
3639 | |||
3640 | * Happy new year! | ||
3641 | * Use getent rather than id to find out whether the sshd user exists | ||
3642 | (closes: #150974). | ||
3643 | * Remove some duplication from the postinst's ssh-keysign setuid code. | ||
3644 | * Replace db_text with db_input throughout debian/config. (db_text has | ||
3645 | been a compatibility wrapper since debconf 0.1.5.) | ||
3646 | * Warn about PermitUserEnvironment on upgrade (closes: #167895). | ||
3647 | * Use 'make install-nokeys', and disable unused debhelper commands, | ||
3648 | thereby forward-porting the last pieces of Zack Weinberg's patch | ||
3649 | (closes: #68341). | ||
3650 | * Move the man page for gnome-ssh-askpass from the ssh package to | ||
3651 | ssh-askpass-gnome (closes: #174449). | ||
3652 | * Build with -DLOGIN_NO_ENDOPT, since Debian's /bin/login doesn't accept | ||
3653 | '--' to terminate the list of options (closes: #171554). | ||
3654 | * Add Jonathan Amery's ssh-argv0 script (closes: #111341). | ||
3655 | * Update Danish debconf template (thanks, Morten Brix Pedersen; | ||
3656 | closes: #174757). | ||
3657 | * Document setgid ssh-agent's effect on certain environment variables in | ||
3658 | README.Debian (closes: #167974). | ||
3659 | * Document interoperability problems between scp and ssh.com's server in | ||
3660 | README.Debian, and suggest some workarounds (closes: #174662). | ||
3661 | |||
3662 | -- Colin Watson <cjwatson@debian.org> Wed, 1 Jan 2003 14:18:30 +0000 | ||
3663 | |||
3664 | openssh (1:3.5p1-2) unstable; urgency=low | ||
3665 | |||
3666 | * Mention in the ssh package description that it provides both ssh and | ||
3667 | sshd (closes: #99680). | ||
3668 | * Create a system group for ssh-agent, not a user group (closes: #167669). | ||
3669 | |||
3670 | -- Colin Watson <cjwatson@debian.org> Mon, 4 Nov 2002 13:43:53 +0000 | ||
3671 | |||
3672 | openssh (1:3.5p1-1) unstable; urgency=low | ||
3673 | |||
3674 | * New upstream release. | ||
3675 | - Fixes typo in ssh-add usage (closes: #152239). | ||
3676 | - Fixes 'PermitRootLogin forced-commands-only' (closes: #166184). | ||
3677 | - ~/.ssh/environment and environment= options in ~/.ssh/authorized_keys | ||
3678 | are deprecated for security reasons and will eventually go away. For | ||
3679 | now they can be re-enabled by setting 'PermitUserEnvironment yes' in | ||
3680 | sshd_config. | ||
3681 | - ssh-agent is installed setgid to prevent ptrace() attacks. The group | ||
3682 | actually doesn't matter, as it drops privileges immediately, but to | ||
3683 | avoid confusion the postinst creates a new 'ssh' group for it. | ||
3684 | * Obsolete patches: | ||
3685 | - Solar Designer's privsep+compression patch for Linux 2.2 (see | ||
3686 | 1:3.3p1-0.0woody1). | ||
3687 | - Hostbased auth ssh-keysign backport (see 1:3.4p1-4). | ||
3688 | |||
3689 | * Remove duplicated phrase in ssh_config(5) (closes: #152404). | ||
3690 | * Source the debconf confmodule at the top of the postrm rather than at | ||
3691 | the bottom, to avoid making future non-idempotency problems worse (see | ||
3692 | #151035). | ||
3693 | * Debconf templates: | ||
3694 | - Add Polish (thanks, Grzegorz Kusnierz). | ||
3695 | - Update French (thanks, Denis Barbier; closes: #132509). | ||
3696 | - Update Spanish (thanks, Carlos Valdivia Yagüe; closes: #164716). | ||
3697 | * Write a man page for gnome-ssh-askpass, and link it to ssh-askpass.1 if | ||
3698 | this is the selected ssh-askpass alternative (closes: #67775). | ||
3699 | |||
3700 | -- Colin Watson <cjwatson@debian.org> Sat, 26 Oct 2002 19:41:51 +0100 | ||
3701 | |||
3702 | openssh (1:3.4p1-4) unstable; urgency=low | ||
3703 | |||
3704 | * Allow ssh-krb5 in ssh-askpass-gnome's dependencies (closes: #129532). | ||
3705 | * Restore Russia to list of countries where encryption is problematic (see | ||
3706 | #148951 and http://www.average.org/freecrypto/). | ||
3707 | * Drop ssh-askpass-gnome's priority to optional, per the override file. | ||
3708 | * Drop the PAM special case for hurd-i386 (closes: #99157). | ||
3709 | * s/dile/idle/ in ssh_config(5) (closes: #118331). | ||
3710 | * Note in README.Debian that you need xauth from xbase-clients on the | ||
3711 | server for X11 forwarding (closes: #140269). | ||
3712 | * Use correct path to upstream README in copyright file (closes: #146037). | ||
3713 | * Document the units for ProtocolKeepAlives (closes: #159479). | ||
3714 | * Backport upstream patch to fix hostbased auth (closes: #117114). | ||
3715 | * Add -g to CFLAGS. | ||
3716 | |||
3717 | -- Colin Watson <cjwatson@debian.org> Sun, 13 Oct 2002 18:58:53 +0100 | ||
3718 | |||
3719 | openssh (1:3.4p1-3) unstable; urgency=low | ||
3720 | |||
3721 | * Add myself to Uploaders: and begin acting as temporary maintainer, at | ||
3722 | Matthew's request. (Normal service will resume in some months' time.) | ||
3723 | * Add sharutils to Build-Depends (closes: #138465). | ||
3724 | * Stop creating the /usr/doc/ssh symlink. | ||
3725 | |||
3726 | * Fix some debconf template typos (closes: #160358). | ||
3727 | * Split debconf templates into one file per language. | ||
3728 | * Add debconf template translations: | ||
3729 | - Brazilian Portuguese (thanks, Andre Luis Lopes; closes: #106173). | ||
3730 | - Danish (thanks, Claus Hindsgaul; closes: #126607). | ||
3731 | - Japanese (thanks, Tomohiro KUBOTA; closes: #137427). | ||
3732 | - Russian (thanks, Ilgiz Kalmetev; closes: #136610). | ||
3733 | - Spanish (thanks, Carlos Valdivia Yagüe; closes: #129041). | ||
3734 | * Update debconf template translations: | ||
3735 | - French (thanks, Igor Genibel; closes: #151361). | ||
3736 | - German (thanks, Axel Noetzold; closes: #147069). | ||
3737 | * Some of these translations are fuzzy. Please send updates. | ||
3738 | |||
3739 | -- Colin Watson <cjwatson@debian.org> Sun, 13 Oct 2002 14:09:57 +0100 | ||
3740 | |||
3741 | openssh (1:3.4p1-2) unstable; urgency=high | ||
3742 | |||
3743 | * Get a security-fixed version into unstable | ||
3744 | * Also tidy README.Debian up a little | ||
3745 | |||
3746 | -- Matthew Vernon <matthew@debian.org> Fri, 28 Jun 2002 17:20:59 +0100 | ||
3747 | |||
3748 | openssh (1:3.4p1-1) testing; urgency=high | ||
3749 | |||
3750 | * Extend my tendrils back into this package (Closes: #150915, #151098) | ||
3751 | * thanks to the security team for their work | ||
3752 | * no thanks to ISS/Theo de Raadt for their handling of these bugs | ||
3753 | * save old sshd_configs to sshd_config.dpkg-old when auto-generating a | ||
3754 | new one | ||
3755 | * tell/ask the user about PriviledgeSeparation | ||
3756 | * /etc/init.d/ssh run will now create the chroot empty dir if necessary | ||
3757 | * Remove our previous statoverride on /usr/bin/ssh (only for people | ||
3758 | upgrading from a version where we'd put one in ourselves!) | ||
3759 | * Stop slandering Russia, since someone asked so nicely (Closes: #148951) | ||
3760 | * Reduce the sleep time in /etc/init.d/ssh during a restart | ||
3761 | |||
3762 | -- Matthew Vernon <matthew@debian.org> Fri, 28 Jun 2002 15:52:10 +0100 | ||
3763 | |||
3764 | openssh (1:3.4p1-0.0woody1) testing-security; urgency=high | ||
3765 | |||
3766 | * NMU by the security team. | ||
3767 | * New upstream version | ||
3768 | |||
3769 | -- Michael Stone <mstone@debian.org> Wed, 26 Jun 2002 15:40:38 -0400 | ||
3770 | |||
3771 | openssh (1:3.3p1-0.0woody4) testing-security; urgency=high | ||
3772 | |||
3773 | * NMU by the security team. | ||
3774 | * fix error when /etc/ssh/sshd_config exists on new install | ||
3775 | * check that user doesn't exist before running adduser | ||
3776 | * use openssl internal random unconditionally | ||
3777 | |||
3778 | -- Michael Stone <mstone@debian.org> Tue, 25 Jun 2002 19:44:39 -0400 | ||
3779 | |||
3780 | openssh (1:3.3p1-0.0woody3) testing-security; urgency=high | ||
3781 | |||
3782 | * NMU by the security team. | ||
3783 | * use correct home directory when sshd user is created | ||
3784 | |||
3785 | -- Michael Stone <mstone@debian.org> Tue, 25 Jun 2002 08:59:50 -0400 | ||
3786 | |||
3787 | openssh (1:3.3p1-0.0woody2) testing-security; urgency=high | ||
3788 | |||
3789 | * NMU by the security team. | ||
3790 | * Fix rsa1 key creation (Closes: #150949) | ||
3791 | * don't fail if sshd user removal fails | ||
3792 | * depends: on adduser (Closes: #150907) | ||
3793 | |||
3794 | -- Michael Stone <mstone@debian.org> Tue, 25 Jun 2002 08:59:50 -0400 | ||
3795 | |||
3796 | openssh (1:3.3p1-0.0woody1) testing-security; urgency=high | ||
3797 | |||
3798 | * NMU by the security team. | ||
3799 | * New upstream version. | ||
3800 | - Enable privilege separation by default. | ||
3801 | * Include patch from Solar Designer for privilege separation and | ||
3802 | compression on 2.2.x kernels. | ||
3803 | * Remove --disable-suid-ssh from configure. | ||
3804 | * Support setuid ssh-keysign binary instead of setuid ssh client. | ||
3805 | * Check sshd configuration before restarting. | ||
3806 | |||
3807 | -- Daniel Jacobowitz <dan@debian.org> Mon, 24 Jun 2002 13:43:44 -0400 | ||
3808 | |||
3809 | openssh (1:3.0.2p1-9) unstable; urgency=high | ||
3810 | |||
3811 | * Thanks to those who NMUd | ||
3812 | * The only change in this version is to debian/control - I've removed | ||
3813 | the bit that says you can't export it from the US - it would look | ||
3814 | pretty daft to say this about a package in main! Also, it's now OK | ||
3815 | to use crypto in France, so I've edited that comment slightly | ||
3816 | * Correct a path in README.Debian too (Closes: #138634) | ||
3817 | |||
3818 | -- Matthew Vernon <matthew@debian.org> Sun, 4 Apr 2002 09:52:59 +0100 | ||
3819 | |||
3820 | openssh (1:3.0.2p1-8.3) unstable; urgency=medium | ||
3821 | |||
3822 | * NMU | ||
3823 | * Really set urgency to medium this time (oops) | ||
3824 | * Fix priority to standard per override while I'm at it | ||
3825 | |||
3826 | -- Aaron M. Ucko <ucko@debian.org> Sun, 24 Mar 2002 09:00:08 -0500 | ||
3827 | |||
3828 | openssh (1:3.0.2p1-8.2) unstable; urgency=low | ||
3829 | |||
3830 | * NMU with maintainer's permission | ||
3831 | * Prepare for upcoming ssh-nonfree transitional packages per | ||
3832 | <http://lists.debian.org/debian-ssh/2002/debian-ssh-200203/msg00008.html> | ||
3833 | * Urgency medium because it would really be good to get this into woody | ||
3834 | before it releases | ||
3835 | * Fix sections to match override file | ||
3836 | * Reissued due to clash with non-US -> main move | ||
3837 | |||
3838 | -- Aaron M. Ucko <ucko@debian.org> Sat, 23 Mar 2002 21:21:52 -0500 | ||
3839 | |||
3840 | openssh (1:3.0.2p1-8.1) unstable; urgency=low | ||
3841 | |||
3842 | * NMU | ||
3843 | * Move from non-US to mani | ||
3844 | |||
3845 | -- LaMont Jones <lamont@debian.org> Thu, 21 Mar 2002 09:33:50 -0700 | ||
3846 | |||
3847 | openssh (1:3.0.2p1-8) unstable; urgency=critical | ||
3848 | |||
3849 | * Security fix - patch from upstream (Closes: #137209, #137210) | ||
3850 | * Undo the changes in the unreleased -7, since they appear to break | ||
3851 | things here. Accordingly, the code change is minimal, and I'm | ||
3852 | happy to get it into testing ASAP | ||
3853 | |||
3854 | -- Matthew Vernon <matthew@debian.org> Thu, 7 Mar 2002 14:25:23 +0000 | ||
3855 | |||
3856 | openssh (1:3.0.2p1-7) unstable; urgency=high | ||
3857 | |||
3858 | * Build to support IPv6 and IPv4 by default again | ||
3859 | |||
3860 | -- Matthew Vernon <matthew@debian.org> Sat, 2 Mar 2002 00:25:05 +0000 | ||
3861 | |||
3862 | openssh (1:3.0.2p1-6) unstable; urgency=high | ||
3863 | |||
3864 | * Correct error in the clean target (Closes: #130868) | ||
3865 | |||
3866 | -- Matthew Vernon <matthew@debian.org> Sat, 26 Jan 2002 00:32:00 +0000 | ||
3867 | |||
3868 | openssh (1:3.0.2p1-5) unstable; urgency=medium | ||
3869 | |||
3870 | * Include the Debian version in our identification, to make it easier to | ||
3871 | audit networks for patched versions in future | ||
3872 | |||
3873 | -- Matthew Vernon <matthew@debian.org> Mon, 21 Jan 2002 17:16:10 +0000 | ||
3874 | |||
3875 | openssh (1:3.0.2p1-4) unstable; urgency=medium | ||
3876 | |||
3877 | * If we're asked to not run sshd, stop any running sshd's first | ||
3878 | (Closes: #129327) | ||
3879 | |||
3880 | -- Matthew Vernon <matthew@debian.org> Wed, 16 Jan 2002 21:24:16 +0000 | ||
3881 | |||
3882 | openssh (1:3.0.2p1-3) unstable; urgency=high | ||
3883 | |||
3884 | * Fix /etc/pam.d/ssh to not set $MAIL (Closes: #128913) | ||
3885 | * Remove extra debconf suggestion (Closes: #128094) | ||
3886 | * Mmm. speedy bug-fixing :-) | ||
3887 | |||
3888 | -- Matthew Vernon <matthew@debian.org> Sat, 12 Jan 2002 17:23:58 +0000 | ||
3889 | |||
3890 | openssh (1:3.0.2p1-2) unstable; urgency=high | ||
3891 | |||
3892 | * Fix postinst to not automatically overwrite sshd_config (!) | ||
3893 | (Closes: #127842, #127867) | ||
3894 | * Add section in README.Debian about the PermitRootLogin setting | ||
3895 | |||
3896 | -- Matthew Vernon <matthew@debian.org> Sat, 5 Jan 2003 05:26:30 +0000 | ||
3897 | |||
3898 | openssh (1:3.0.2p1-1) unstable; urgency=high | ||
3899 | |||
3900 | * Incorporate fix from Colin's NMU | ||
3901 | * New upstream version (fixes the bug Wichert fixed) (Closes: #124035) | ||
3902 | * Capitalise IETF (Closes: #125379) | ||
3903 | * Refer to the correct sftp-server location (Closes: #126854, #126224) | ||
3904 | * Do what we're asked re SetUID ssh (Closes: #124065, #124154, #123247) | ||
3905 | * Ask people upgrading from potato if they want a new conffile | ||
3906 | (Closes: #125642) | ||
3907 | * Fix a typo in postinst (Closes: #122192, #122410, #123440) | ||
3908 | * Frob the default config a little (Closes: #122284, #125827, #125696, | ||
3909 | #123854) | ||
3910 | * Make /etc/init.d/ssh be more clear about ssh not running (Closes: | ||
3911 | #123552) | ||
3912 | * Fix typo in templates file (Closes: #123411) | ||
3913 | |||
3914 | -- Matthew Vernon <matthew@debian.org> Fri, 4 Jan 2002 16:01:52 +0000 | ||
3915 | |||
3916 | openssh (1:3.0.1p1-1.2) unstable; urgency=high | ||
3917 | |||
3918 | * Non-maintainer upload | ||
3919 | * Prevent local users from passing environment variables to the login | ||
3920 | process when UseLogin is enabled | ||
3921 | |||
3922 | -- Wichert Akkerman <wakkerma@debian.org> Mon, 3 Dec 2001 19:34:45 +0100 | ||
3923 | |||
3924 | openssh (1:3.0.1p1-1.1) unstable; urgency=low | ||
3925 | |||
3926 | * Non-maintainer upload, at Matthew's request. | ||
3927 | * Remove sa_restorer assignment to fix compilation on alpha, hppa, and | ||
3928 | ia64 (closes: #122086). | ||
3929 | |||
3930 | -- Colin Watson <cjwatson@debian.org> Sun, 2 Dec 2001 18:54:16 +0000 | ||
3931 | |||
3932 | openssh (1:3.0.1p1-1) unstable; urgency=high | ||
3933 | |||
3934 | * New upstream version (Closes: #113646, #113513, #114707, #118564) | ||
3935 | * Building with a libc that works (!) (Closes: #115228) | ||
3936 | * Patches forward-ported are -1/-2 options for scp, the improvement to | ||
3937 | 'waiting for forwarded connections to terminate...' | ||
3938 | * Fix /etc/init.d/ssh to stop sshd properly (Closes: #115228) | ||
3939 | * /etc/ssh/sshd_config is no longer a conffile but generated in the postinst | ||
3940 | * Remove suidregister leftover from postrm | ||
3941 | * Mention key we are making in the postinst | ||
3942 | * Default to not enable SSH protocol 1 support, since protocol 2 is | ||
3943 | much safer anyway. | ||
3944 | * New version of the vpn-fixes patch, from Ian Jackson | ||
3945 | * New handling of -q, and added new -qq option; thanks to Jon Amery | ||
3946 | * Experimental smartcard support not enabled, since I have no way of | ||
3947 | testing it. | ||
3948 | |||
3949 | -- Matthew Vernon <matthew@debian.org> Thu, 28 Nov 2001 17:43:01 +0000 | ||
3950 | |||
3951 | openssh (1:2.9p2-6) unstable; urgency=low | ||
3952 | |||
3953 | * check for correct file in /etc/init.d/ssh (Closes: #110876) | ||
3954 | * correct location of version 2 keys in ssh.1 (Closes: #110439) | ||
3955 | * call update-alternatives --quiet (Closes: #103314) | ||
3956 | * hack ssh-copy-id to chmod go-w (Closes: #95551) | ||
3957 | * TEMPORARY fix to provide largefile support using a -D in the cflags | ||
3958 | line. long-term, upstream will patch the autoconf stuff | ||
3959 | (Closes: #106809, #111849) | ||
3960 | * remove /etc/rc references in ssh-keygen.1 (Closes: #68350) | ||
3961 | * scp.1 patch from Adam McKenna to document -r properly (Closes: #76054) | ||
3962 | * Check for files containing a newline character (Closes: #111692) | ||
3963 | |||
3964 | -- Matthew Vernon <matthew@debian.org> Thu, 13 Sep 2001 16:47:36 +0100 | ||
3965 | |||
3966 | openssh (1:2.9p2-5) unstable; urgency=high | ||
3967 | |||
3968 | * Thanks to all the bug-fixers who helped! | ||
3969 | * remove sa_restorer assignment (Closes: #102837) | ||
3970 | * patch from Peter Benie to DTRT wrt X forwarding if the server refuses | ||
3971 | us access (Closes: #48297) | ||
3972 | * patch from upstream CVS to fix port forwarding (Closes: #107132) | ||
3973 | * patch from Jonathan Amery to document ssh-keygen behaviour | ||
3974 | (Closes:#106643, #107512) | ||
3975 | * patch to postinst from Jonathan Amery (Closes: #106411) | ||
3976 | * patch to manpage from Jonathan Amery (Closes: #107364) | ||
3977 | * patch from Matthew Vernon to make -q emit fatal errors as that is the | ||
3978 | documented behaviour (Closes: #64347) | ||
3979 | * patch from Ian Jackson to cause us to destroy a file when we scp it | ||
3980 | onto itself, rather than dumping bits of our memory into it, which was | ||
3981 | a security hole (see #51955) | ||
3982 | * patch from Jonathan Amery to document lack of Kerberos support | ||
3983 | (Closes: #103726) | ||
3984 | * patch from Matthew Vernon to make the 'waiting for connections to | ||
3985 | terminate' message more helpful (Closes: #50308) | ||
3986 | |||
3987 | -- Matthew Vernon <matthew@debian.org> Thu, 23 Aug 2001 02:14:09 +0100 | ||
3988 | |||
3989 | openssh (1:2.9p2-4) unstable; urgency=high | ||
3990 | |||
3991 | * Today's build of ssh is strawberry flavoured | ||
3992 | * Patch from mhp to reduce length of time sshd is stopped for (Closes: #106176) | ||
3993 | * Tidy up debconf template (Closes: #106152) | ||
3994 | * If called non-setuid, then setgid()'s failure should not be fatal (see | ||
3995 | #105854) | ||
3996 | |||
3997 | -- Matthew Vernon <matthew@debian.org> Sun, 22 Jul 2001 14:19:43 +0100 | ||
3998 | |||
3999 | openssh (1:2.9p2-3) unstable; urgency=low | ||
4000 | |||
4001 | * Patch from yours truly to add -1 and -2 options to scp (Closes: #106061) | ||
4002 | * Improve the IdentityFile section in the man page (Closes: #106038) | ||
4003 | |||
4004 | -- Matthew Vernon <matthew@debian.org> Sat, 21 Jul 2001 14:47:27 +0100 | ||
4005 | |||
4006 | openssh (1:2.9p2-2) unstable; urgency=low | ||
4007 | |||
4008 | * Document the protocol version 2 and IPV6 changes (Closes: #105845, #105868) | ||
4009 | * Make PrintLastLog 'no' by default (Closes: #105893) | ||
4010 | |||
4011 | -- Matthew Vernon <matthew@debian.org> Thu, 19 Jul 2001 18:36:41 +0100 | ||
4012 | |||
4013 | openssh (1:2.9p2-1) unstable; urgency=low | ||
4014 | |||
4015 | * new (several..) upstream version (Closes: #96726, #81856, #96335) | ||
4016 | * Hopefully, this will close some other bugs too | ||
4017 | |||
4018 | -- Matthew Vernon <matthew@debian.org> Tue, 17 Jul 2001 19:41:58 +0100 | ||
4019 | |||
4020 | openssh (1:2.5.2p2-3) unstable; urgency=low | ||
4021 | |||
4022 | * Taking Over this package | ||
4023 | * Patches from Robert Bihlmeyer for the Hurd (Closes: #102991) | ||
4024 | * Put PermitRootLogin back to yes (Closes: #67334, #67371, #78274) | ||
4025 | * Don't fiddle with conf-files any more (Closes: #69501) | ||
4026 | |||
4027 | -- Matthew Vernon <matthew@debian.org> Tue, 03 Jul 2001 02:58:13 +0100 | ||
4028 | |||
4029 | openssh (1:2.5.2p2-2.2) unstable; urgency=low | ||
4030 | |||
4031 | * NMU | ||
4032 | * Include Hurd compatibility patches from Robert Bihlmeyer (Closes: #76033) | ||
4033 | * Patch from Richard Kettlewell for protocolkeepalives (Closes: #99273) | ||
4034 | * Patch from Matthew Vernon for BannerTimeOut, batchmode, and | ||
4035 | documentation for protocolkeepalives. Makes ssh more generally useful | ||
4036 | for scripting uses (Closes: #82877, #99275) | ||
4037 | * Set a umask, so ourpidfile isn't world-writable (closes: #100012, | ||
4038 | #98286, #97391) | ||
4039 | |||
4040 | -- Matthew Vernon <matthew@debian.org> Thu, 28 Jun 2001 23:15:42 +0100 | ||
4041 | |||
4042 | openssh (1:2.5.2p2-2.1) unstable; urgency=low | ||
4043 | |||
4044 | * NMU | ||
4045 | * Remove duplicate Build-Depends for libssl096-dev and change it to | ||
4046 | depend on libssl-dev instaed. Also adding in virtual | real package | ||
4047 | style build-deps. (Closes: #93793, #75228) | ||
4048 | * Removing add-log entry (Closes: #79266) | ||
4049 | * This was a pam bug from a while back (Closes: #86908, #88457, #86843) | ||
4050 | * pam build-dep already exists (Closes: #93683) | ||
4051 | * libgnome-dev build-dep already exists (Closes: #93694) | ||
4052 | * No longer in non-free (Closes: #85401) | ||
4053 | * Adding in fr debconf translations (Closes: #83783) | ||
4054 | * Already suggests xbase-clients (Closes: #79741) | ||
4055 | * No need to suggest libpam-pwdb anymore (Closes: #81658) | ||
4056 | * Providing rsh-client (Closes: #79437) | ||
4057 | * hurd patch was already applied (Closes: #76033) | ||
4058 | * default set to no (Closes: #73682) | ||
4059 | * Adding in a suggests for dnsutils (Closes: #93265) | ||
4060 | * postinst bugs fixed (Closes: #88057, #88066, #88196, #88405, #88612) | ||
4061 | (Closes: #88774, #88196, #89556, #90123, #90228, #90833, #87814, #85465) | ||
4062 | * Adding in debconf dependency | ||
4063 | |||
4064 | -- Ivan E. Moore II <rkrusty@debian.org> Mon, 16 Apr 2001 14:11:04 +0100 | ||
4065 | |||
4066 | openssh (1:2.5.2p2-2) unstable; urgency=high | ||
4067 | |||
4068 | * disable the OpenSSL version check in entropy.c | ||
4069 | (closes: #93581, #93588, #93590, #93614, #93619, #93635, #93648) | ||
4070 | |||
4071 | -- Philip Hands <phil@uk.alcove.com> Wed, 11 Apr 2001 20:30:04 +0100 | ||
4072 | |||
4073 | openssh (1:2.5.2p2-1) unstable; urgency=low | ||
4074 | |||
4075 | * New upstream release | ||
4076 | * removed make-ssh-known-hosts, since ssh-keyscan does that job (closes: #86069, #87748) | ||
4077 | * fix double space indent in german templates (closes: #89493) | ||
4078 | * make postinst check for ssh_host_rsa_key | ||
4079 | * get rid of the last of the misguided debian/rules NMU debris :-/ | ||
4080 | |||
4081 | -- Philip Hands <phil@hands.com> Sat, 24 Mar 2001 20:59:33 +0000 | ||
4082 | |||
4083 | openssh (1:2.5.1p2-2) unstable; urgency=low | ||
4084 | |||
4085 | * rebuild with new debhelper (closes: #89558, #89536, #90225) | ||
4086 | * fix broken dpkg-statoverride test in postinst | ||
4087 | (closes: #89612, #90474, #90460, #89605) | ||
4088 | * NMU bug fixed but not closed in last upload (closes: #88206) | ||
4089 | |||
4090 | -- Philip Hands <phil@hands.com> Fri, 23 Mar 2001 16:11:33 +0000 | ||
4091 | |||
4092 | openssh (1:2.5.1p2-1) unstable; urgency=high | ||
4093 | |||
4094 | * New upstream release | ||
4095 | * fix typo in postinst (closes: #88110) | ||
4096 | * revert to setting PAM service name in debian/rules, backing out last | ||
4097 | NMU, which also (closes: #88101) | ||
4098 | * restore the pam lastlog/motd lines, lost during the NMUs, and sshd_config | ||
4099 | * restore printlastlog option patch | ||
4100 | * revert to using debhelper, which had been partially disabled in NMUs | ||
4101 | |||
4102 | -- Philip Hands <phil@hands.com> Tue, 13 Mar 2001 01:41:34 +0000 | ||
4103 | |||
4104 | openssh (1:2.5.1p1-1.8) unstable; urgency=high | ||
4105 | |||
4106 | * And now the old pam-bug s/sshd/ssh in ssh.c is also fixed | ||
4107 | |||
4108 | -- Christian Kurz <shorty@debian.org> Thu, 1 Mar 2001 19:48:01 +0100 | ||
4109 | |||
4110 | openssh (1:2.5.1p1-1.7) unstable; urgency=high | ||
4111 | |||
4112 | * And now we mark the correct binary as setuid, when a user requested | ||
4113 | to install it setuid. | ||
4114 | |||
4115 | -- Christian Kurz <shorty@debian.org> Thu, 1 Mar 2001 07:19:56 +0100 | ||
4116 | |||
4117 | openssh (1:2.5.1p1-1.6) unstable; urgency=high | ||
4118 | |||
4119 | * Fixes postinst to handle overrides that are already there. Damn, I | ||
4120 | should have noticed the bug earlier. | ||
4121 | |||
4122 | -- Christian Kurz <shorty@debian.org> Wed, 28 Feb 2001 22:35:00 +0100 | ||
4123 | |||
4124 | openssh (1:2.5.1p1-1.5) unstable; urgency=high | ||
4125 | |||
4126 | * Rebuild ssh with pam-support. | ||
4127 | |||
4128 | -- Christian Kurz <shorty@debian.org> Mon, 26 Feb 2001 21:55:51 +0100 | ||
4129 | |||
4130 | openssh (1:2.5.1p1-1.4) unstable; urgency=low | ||
4131 | |||
4132 | * Added Build-Depends on libssl096-dev. | ||
4133 | * Fixed sshd_config file to disallow root logins again. | ||
4134 | |||
4135 | -- Christian Kurz <shorty@debian.org> Sun, 25 Feb 2001 20:03:55 +0100 | ||
4136 | |||
4137 | openssh (1:2.5.1p1-1.3) unstable; urgency=low | ||
4138 | |||
4139 | * Fixed missing manpages for sftp.1 and ssh-keyscan.1 | ||
4140 | * Made package policy 3.5.2 compliant. | ||
4141 | |||
4142 | -- Christian Kurz <shorty@debian.org> Sun, 25 Feb 2001 15:46:26 +0100 | ||
4143 | |||
4144 | openssh (1:2.5.1p1-1.2) unstable; urgency=low | ||
4145 | |||
4146 | * Added Conflict with sftp, since we now provide our own sftp-client. | ||
4147 | * Added a fix for our broken dpkg-statoverride call in the | ||
4148 | 2.3.0p1-13. | ||
4149 | * Fixed some config pathes in the comments of sshd_config. | ||
4150 | * Removed ssh-key-exchange-vulnerability-patch since it's not needed | ||
4151 | anymore because upstream included the fix. | ||
4152 | |||
4153 | -- Christian Kurz <shorty@debian.org> Sun, 25 Feb 2001 13:46:58 +0100 | ||
4154 | |||
4155 | openssh (1:2.5.1p1-1.1) unstable; urgency=high | ||
4156 | |||
4157 | * Another NMU to get the new upstream version 2.5.1p1 into | ||
4158 | unstable. (Closes: #87123) | ||
4159 | * Corrected postinst to mark ssh as setuid. (Closes: #86391, #85766) | ||
4160 | * Key Exchange patch is already included by upstream. (Closes: #86015) | ||
4161 | * Upgrading should be possible now. (Closes: #85525, #85523) | ||
4162 | * Added --disable-suid-ssh as compile option, so ssh won't get installed | ||
4163 | suid per default. | ||
4164 | * Fixed postinst to run dpkg-statoverride only, when dpkg-statoverride | ||
4165 | is available and the mode of the binary should be 4755. And also added | ||
4166 | suggestion for a newer dpkg. | ||
4167 | (Closes: #85734, #85741, #86876) | ||
4168 | * sftp and ssh-keyscan will also be included from now on. (Closes: #79994) | ||
4169 | * scp now understands spaces in filenames (Closes: #53783, #58958, | ||
4170 | #66723) | ||
4171 | * ssh-keygen now supports showing DSA fingerprints. (Closes: #68623) | ||
4172 | * ssh doesn' t show motd anymore when switch -t is used. (Closes #69035) | ||
4173 | * ssh supports the usage of other dsa keys via the ssh command line | ||
4174 | options. (Closes: #81250) | ||
4175 | * Documentation in sshd_config fixed. (Closes: #81088) | ||
4176 | * primes file included by upstream and included now. (Closes: #82101) | ||
4177 | * scp now allows dots in the username. (Closes: #82477) | ||
4178 | * Spelling error in ssh-copy-id.1 corrected by upstream. (Closes: #78124) | ||
4179 | |||
4180 | -- Christian Kurz <shorty@debian.org> Sun, 25 Feb 2001 10:06:08 +0100 | ||
4181 | |||
4182 | openssh (1:2.3.0p1-1.13) unstable; urgency=low | ||
4183 | |||
4184 | * Config should now also be fixed with this hopefully last NMU. | ||
4185 | |||
4186 | -- Christian Kurz <shorty@debian.org> Sat, 10 Feb 2001 22:56:36 +0100 | ||
4187 | |||
4188 | openssh (1:2.3.0p1-1.12) unstable; urgency=high | ||
4189 | |||
4190 | * Added suggest for xbase-clients to control-file. (Closes #85227) | ||
4191 | * Applied patch from Markus Friedl to fix a vulnerability in | ||
4192 | the rsa keyexchange. | ||
4193 | * Fixed position of horizontal line. (Closes: #83613) | ||
4194 | * Fixed hopefully the grep problem in the config-file. (Closes: #78802) | ||
4195 | * Converted package from suidregister to dpkg-statoverride. | ||
4196 | |||
4197 | -- Christian Kurz <shorty@debian.org> Fri, 9 Feb 2001 19:43:55 +0100 | ||
4198 | |||
4199 | openssh (1:2.3.0p1-1.11) unstable; urgency=medium | ||
4200 | |||
4201 | * Fixed some typos in the german translation of the debconf | ||
4202 | template. | ||
4203 | |||
4204 | -- Christian Kurz <shorty@debian.org> Wed, 24 Jan 2001 18:22:38 +0100 | ||
4205 | |||
4206 | openssh (1:2.3.0p1-1.10) unstable; urgency=medium | ||
4207 | |||
4208 | * Fixed double printing of motd. (Closes: #82618) | ||
4209 | |||
4210 | -- Christian Kurz <shorty@debian.org> Tue, 23 Jan 2001 21:03:43 +0100 | ||
4211 | |||
4212 | openssh (1:2.3.0p1-1.9) unstable; urgency=high | ||
4213 | |||
4214 | * And the next NMU which includes the patch from Andrew Bartlett | ||
4215 | and Markus Friedl to fix the root privileges handling of openssh. | ||
4216 | (Closes: #82657) | ||
4217 | |||
4218 | -- Christian Kurz <shorty@debian.org> Wed, 17 Jan 2001 22:20:54 +0100 | ||
4219 | |||
4220 | openssh (1:2.3.0p1-1.8) unstable; urgency=high | ||
4221 | |||
4222 | * Applied fix from Ryan Murray to allow building on other architectures | ||
4223 | since the hurd patch was wrong. (Closes: #82471) | ||
4224 | |||
4225 | -- Christian Kurz <shorty@debian.org> Tue, 16 Jan 2001 22:45:51 +0100 | ||
4226 | |||
4227 | openssh (1:2.3.0p1-1.7) unstable; urgency=medium | ||
4228 | |||
4229 | * Fixed another typo on sshd_config | ||
4230 | |||
4231 | -- Christian Kurz <shorty@debian.org> Sun, 14 Jan 2001 19:01:31 +0100 | ||
4232 | |||
4233 | openssh (1:2.3.0p1-1.6) unstable; urgency=high | ||
4234 | |||
4235 | * Added Build-Dependency on groff (Closes: #81886) | ||
4236 | * Added Build-Depencency on debhelper (Closes: #82072) | ||
4237 | * Fixed entry for known_hosts in sshd_config (Closes: #82096) | ||
4238 | |||
4239 | -- Christian Kurz <shorty@debian.org> Thu, 11 Jan 2001 23:08:16 +0100 | ||
4240 | |||
4241 | openssh (1:2.3.0p1-1.5) unstable; urgency=high | ||
4242 | |||
4243 | * Fixed now also the problem with sshd used as default ipv4 and | ||
4244 | didn't use IPv6. This should be now fixed. | ||
4245 | |||
4246 | -- Christian Kurz <shorty@debian.org> Thu, 11 Jan 2001 21:25:55 +0100 | ||
4247 | |||
4248 | openssh (1:2.3.0p1-1.4) unstable; urgency=high | ||
4249 | |||
4250 | * Fixed buggy entry in postinst. | ||
4251 | |||
4252 | -- Christian Kurz <shorty@debian.org> Wed, 10 Jan 2001 23:12:16 +0100 | ||
4253 | |||
4254 | openssh (1:2.3.0p1-1.3) unstable; urgency=high | ||
4255 | |||
4256 | * After finishing the rewrite of the rules-file I had to notice that | ||
4257 | the manpage installation was broken. This should now work again. | ||
4258 | |||
4259 | -- Christian Kurz <shorty@debian.org> Wed, 10 Jan 2001 22:11:59 +0100 | ||
4260 | |||
4261 | openssh (1:2.3.0p1-1.2) unstable; urgency=high | ||
4262 | |||
4263 | * Fixed the screwed up build-dependency. | ||
4264 | * Removed --with-ipv4-default to support ipv6. | ||
4265 | * Changed makefile to use /etc/pam.d/ssh instead of /etc/pam.d/sshd. | ||
4266 | * Fixed location to sftp-server in config. | ||
4267 | * Since debian still relies on /etc/pam.d/ssh instead of moving to | ||
4268 | /etc/pam.d/sshd, I had to hack ssh.h to get ssh to use this name. | ||
4269 | * Fixed path to host key in sshd_config. | ||
4270 | |||
4271 | -- Christian Kurz <shorty@debian.org> Wed, 10 Jan 2001 08:23:47 +0100 | ||
4272 | |||
4273 | openssh (1:2.3.0p1-1.1) unstable; urgency=medium | ||
4274 | |||
4275 | * NMU with permission of Phil Hands. | ||
4276 | * New upstream release | ||
4277 | * Update Build-Depends to point to new libssl096. | ||
4278 | * This upstream release doesn't leak any information depending | ||
4279 | on the setting of PermitRootLogin (Closes: #59933) | ||
4280 | * New upstream release contains fix against forcing a client to | ||
4281 | do X/agent forwarding (Closes: #76788) | ||
4282 | * Changed template to contain correct path to the documentation | ||
4283 | (Closes: #67245) | ||
4284 | * Added --with-4in6 switch as compile option into debian/rules. | ||
4285 | * Added --with-ipv4-default as compile option into debian/rules. | ||
4286 | (Closes: #75037) | ||
4287 | * Changed default path to also contain /usr/local/bin and | ||
4288 | /usr/X11R6/bin (Closes: #62472,#54567,#62810) | ||
4289 | * Changed path to sftp-server in sshd_config to match the | ||
4290 | our package (Closes: #68347) | ||
4291 | * Replaced OpenBSDh with OpenBSD in the init-script. | ||
4292 | * Changed location to original source in copyright.head | ||
4293 | * Changed behaviour of init-script when invoked with the option | ||
4294 | restart (Closes: #68706,#72560) | ||
4295 | * Added a note about -L option of scp to README.Debian | ||
4296 | * ssh won't print now the motd if invoked with -t option | ||
4297 | (Closes: #59933) | ||
4298 | * RFC.nroff.gz get's now converted into RFC.gz. (Closes: #63867) | ||
4299 | * Added a note about tcp-wrapper support to README.Debian | ||
4300 | (Closes: #72807,#22190) | ||
4301 | * Removed two unneeded options from building process. | ||
4302 | * Added sshd.pam into debian dir and install it. | ||
4303 | * Commented out unnecessary call to dh_installinfo. | ||
4304 | * Added a line to sshd.pam so that limits will be paid attention | ||
4305 | to (Closes: #66904) | ||
4306 | * Restart Option has a Timeout of 10 seconds (Closes: 51264) | ||
4307 | * scp won't override files anymore (Closes: 51955) | ||
4308 | * Removed pam_lastlog module, so that the lastlog is now printed | ||
4309 | only once (Closes: #71742, #68335, #69592, #71495, #77781) | ||
4310 | * If password is expired, openssh now forces the user to change it. | ||
4311 | (Closes: #51747) | ||
4312 | * scp should now have no more problems with shell-init-files that | ||
4313 | produces ouput (Closes: #56280,#59873) | ||
4314 | * ssh now prints the motd correctly (Closes: #66926) | ||
4315 | * ssh upgrade should disable ssh daemon only if users has choosen | ||
4316 | to do so (Closes: #67478) | ||
4317 | * ssh can now be installed suid (Closes: #70879) | ||
4318 | * Modified debian/rules to support hurd. | ||
4319 | |||
4320 | -- Christian Kurz <shorty@debian.org> Wed, 27 Dec 2000 20:06:57 +0100 | ||
4321 | |||
4322 | openssh (1:2.2.0p1-1.1) unstable; urgency=medium | ||
4323 | |||
4324 | * Non-Maintainer Upload | ||
4325 | * Check for new returns in the new libc | ||
4326 | (closes: #72803, #74393, #72797, #71307, #71702) | ||
4327 | * Link against libssl095a (closes: #66304) | ||
4328 | * Correct check for PermitRootLogin (closes: #69448) | ||
4329 | |||
4330 | -- Ryan Murray <rmurray@debian.org> Wed, 18 Oct 2000 00:48:18 -0700 | ||
4331 | |||
4332 | openssh (1:2.2.0p1-1) unstable; urgency=low | ||
4333 | |||
4334 | * New upstream release | ||
4335 | |||
4336 | -- Philip Hands <phil@hands.com> Mon, 11 Sep 2000 14:49:43 +0100 | ||
4337 | |||
4338 | openssh (1:2.1.1p4-3) unstable; urgency=low | ||
4339 | |||
4340 | * add rsh alternatives | ||
4341 | * add -S option to scp (using Tommi Virtanen's patch) (closes: #63097) | ||
4342 | * do the IPV4_DEFAULT thing properly this time | ||
4343 | |||
4344 | -- Philip Hands <phil@hands.com> Fri, 11 Aug 2000 18:14:37 +0100 | ||
4345 | |||
4346 | openssh (1:2.1.1p4-2) unstable; urgency=low | ||
4347 | |||
4348 | * reinstate manpage .out patch from 1:1.2.3 | ||
4349 | * fix typo in postinst | ||
4350 | * only compile ssh with IPV4_DEFAULT | ||
4351 | * apply James Troup's patch to add a -o option to scp and updated manpage | ||
4352 | |||
4353 | -- Philip Hands <phil@hands.com> Sun, 30 Jul 2000 00:12:49 +0100 | ||
4354 | |||
4355 | openssh (1:2.1.1p4-1) unstable; urgency=low | ||
4356 | |||
4357 | * New upstream release | ||
4358 | |||
4359 | -- Philip Hands <phil@hands.com> Sat, 29 Jul 2000 14:46:16 +0100 | ||
4360 | |||
4361 | openssh (1:1.2.3-10) unstable; urgency=low | ||
4362 | |||
4363 | * add version to libpam-modules dependency, because old versions of | ||
4364 | pam_motd make it impossible to log in. | ||
4365 | |||
4366 | -- Philip Hands <phil@hands.com> Sat, 29 Jul 2000 13:28:22 +0100 | ||
4367 | |||
4368 | openssh (1:1.2.3-9) frozen unstable; urgency=low | ||
4369 | |||
4370 | * force location of /usr/bin/X11/xauth | ||
4371 | (closes: #64424, #66437, #66859) *RC* | ||
4372 | * typos in config (closes: #66779, #66780) | ||
4373 | * sshd_not_to_be_run could be assumed to be true, in error, if the config | ||
4374 | script died in an unusual way --- I've reversed this (closes: #66335) | ||
4375 | * Apply Zack Weinberg <zack@wolery.cumb.org>'s patch to ssh-askpass-ptk | ||
4376 | (closes: #65981) | ||
4377 | * change default for PermitRootLogin to "no" (closes: #66406) | ||
4378 | |||
4379 | -- Philip Hands <phil@hands.com> Tue, 11 Jul 2000 20:51:18 +0100 | ||
4380 | |||
4381 | openssh (1:1.2.3-8) frozen unstable; urgency=low | ||
4382 | |||
4383 | * get rid of Provides: rsh-server (this will mean that rstartd | ||
4384 | will need to change it's depends to deal with #63948, which I'm | ||
4385 | reopening) (closes: #66257) | ||
4386 | Given that this is also a trivial change, and is a reversal of a | ||
4387 | change that was mistakenly made after the freeze, I think this should | ||
4388 | also go into frozen. | ||
4389 | |||
4390 | -- Philip Hands <phil@hands.com> Wed, 28 Jun 2000 03:26:30 +0100 | ||
4391 | |||
4392 | openssh (1:1.2.3-7) frozen unstable; urgency=low | ||
4393 | |||
4394 | * check if debconf is installed before calling db_stop in postinst. | ||
4395 | This is required to allow ssh to be installed when debconf is not | ||
4396 | wanted, which probably makes it an RC upload (hopefully the last of | ||
4397 | too many). | ||
4398 | |||
4399 | -- Philip Hands <phil@hands.com> Wed, 28 Jun 2000 03:19:47 +0100 | ||
4400 | |||
4401 | openssh (1:1.2.3-6) frozen unstable; urgency=low | ||
4402 | |||
4403 | * fixed depressing little bug involving a line wrap looking like | ||
4404 | a blank line in the templates file *RC* | ||
4405 | (closes: #66090, #66078, #66083, #66182) | ||
4406 | |||
4407 | -- Philip Hands <phil@hands.com> Mon, 26 Jun 2000 00:45:05 +0100 | ||
4408 | |||
4409 | openssh (1:1.2.3-5) frozen unstable; urgency=low | ||
4410 | |||
4411 | * add code to prevent UseLogin exploit, although I think our PAM | ||
4412 | conditional code breaks UseLogin in a way that protects us from this | ||
4413 | exploit anyway. ;-) (closes: #65495) *RC* | ||
4414 | * Apply Zack Weinberg <zack@wolery.cumb.org>'s patch to fix keyboard | ||
4415 | grab vulnerability in ssh-askpass-gnome (closes: #64795) *RC* | ||
4416 | * stop redirection of sshd's file descriptors (introduced in 1:1.2.3-3) | ||
4417 | and use db_stop in the postinst to solve that problem instead | ||
4418 | (closes: #65104) | ||
4419 | * add Provides: rsh-server to ssh (closes: #63948) | ||
4420 | * provide config option not to run sshd | ||
4421 | |||
4422 | -- Philip Hands <phil@hands.com> Mon, 12 Jun 2000 23:05:11 +0100 | ||
4423 | |||
4424 | openssh (1:1.2.3-4) frozen unstable; urgency=low | ||
4425 | |||
4426 | * fixes #63436 which is *RC* | ||
4427 | * add 10 second pause in init.d restart (closes: #63844) | ||
4428 | * get rid of noenv in PAM mail line (closes: #63856) | ||
4429 | * fix host key path in make-ssh-known-hosts (closes: #63713) | ||
4430 | * change wording of SUID template (closes: #62788, #63436) | ||
4431 | |||
4432 | -- Philip Hands <phil@hands.com> Sat, 27 May 2000 11:18:06 +0100 | ||
4433 | |||
4434 | openssh (1:1.2.3-3) frozen unstable; urgency=low | ||
4435 | |||
4436 | * redirect sshd's file descriptors to /dev/null in init to | ||
4437 | prevent debconf from locking up during installation | ||
4438 | ** grave bug just submited by me ** | ||
4439 | |||
4440 | -- Philip Hands <phil@hands.com> Thu, 20 Apr 2000 17:10:59 +0100 | ||
4441 | |||
4442 | openssh (1:1.2.3-2) frozen unstable; urgency=low | ||
4443 | |||
4444 | * allow user to select SUID status of /usr/bin/ssh (closes: 62462) ** RC ** | ||
4445 | * suggest debconf | ||
4446 | * conflict with debconf{,-tiny} (<<0.2.17) so I can clean up the preinst | ||
4447 | |||
4448 | -- Philip Hands <phil@hands.com> Wed, 19 Apr 2000 17:49:15 +0100 | ||
4449 | |||
4450 | openssh (1:1.2.3-1) frozen unstable; urgency=low | ||
4451 | |||
4452 | * New upstream release | ||
4453 | * patch sshd to create extra xauth key required for localhost | ||
4454 | (closes: #49944) *** RC *** | ||
4455 | * FallbacktoRsh now defaults to ``no'' to match impression | ||
4456 | given in sshd_config | ||
4457 | * stop setting suid bit on ssh (closes: #58711, #58558) | ||
4458 | This breaks Rhosts authentication (which nobody uses) and allows | ||
4459 | the LD_PRELOAD trick to get socks working, so seems like a net benefit. | ||
4460 | |||
4461 | -- Philip Hands <phil@hands.com> Thu, 13 Apr 2000 20:01:54 +0100 | ||
4462 | |||
4463 | openssh (1:1.2.2-1.4) frozen unstable; urgency=low | ||
4464 | |||
4465 | * Recompile for frozen, contains fix for RC bug. | ||
4466 | |||
4467 | -- Tommi Virtanen <tv@debian.org> Tue, 29 Feb 2000 22:14:58 +0200 | ||
4468 | |||
4469 | openssh (1:1.2.2-1.3) unstable; urgency=low | ||
4470 | |||
4471 | * Integrated man page addition for PrintLastLog. | ||
4472 | This bug was filed on "openssh", and I ended up | ||
4473 | creating my own patch for this (closes: #59054) | ||
4474 | * Improved error message when ssh_exchange_identification | ||
4475 | gets EOF (closes: #58904) | ||
4476 | * Fixed typo (your -> you're) in debian/preinst. | ||
4477 | * Added else-clauses to config to make this upgradepath possible: | ||
4478 | oldssh -> openssh preinst fails due to upgrade_to_openssh=false | ||
4479 | -> ssh-nonfree -> openssh. Without these, debconf remembered | ||
4480 | the old answer, config didn't force asking it, and preinst always | ||
4481 | aborted (closes: #56596, #57782) | ||
4482 | * Moved setting upgrade_to_openssh isdefault flag to the place | ||
4483 | where preinst would abort. This means no double question to most | ||
4484 | users, people who currently suffer from "can't upgrade" may need | ||
4485 | to run apt-get install ssh twice. Did not do the same for | ||
4486 | use_old_init_script, as the situation is a bit different, and | ||
4487 | less common (closes: #54010, #56224) | ||
4488 | * Check for existance of ssh-keygen before attempting to use it in | ||
4489 | preinst, added warning for non-existant ssh-keygen in config. This | ||
4490 | happens when the old ssh is removed (say, due to ssh-nonfree getting | ||
4491 | installed). | ||
4492 | |||
4493 | -- Tommi Virtanen <tv@debian.org> Sun, 27 Feb 2000 21:36:43 +0200 | ||
4494 | |||
4495 | openssh (1:1.2.2-1.2) frozen unstable; urgency=low | ||
4496 | |||
4497 | * Non-maintainer upload. | ||
4498 | * Added configuration option PrintLastLog, default off due to PAM | ||
4499 | (closes: #54007, #55042) | ||
4500 | * ssh-askpass-{gnome,ptk} now provide ssh-askpass, making ssh's | ||
4501 | Suggests: line more accurate. Also closing related bugs fixed | ||
4502 | earlier, when default ssh-askpass moved to /usr/bin. | ||
4503 | (closes: #52403, #54741, #50607, #52298, #50967, #51661) | ||
4504 | * Patched to call vhangup, with autoconf detection and all | ||
4505 | (closes: #55379) | ||
4506 | * Added --with-ipv4-default workaround to a glibc bug causing | ||
4507 | slow DNS lookups, as per UPGRADING. Use -6 to really use | ||
4508 | IPv6 addresses. (closes: #57891, #58744, #58713, #57970) | ||
4509 | * Added noenv to PAM pam_mail line. Thanks to Ben Collins. | ||
4510 | (closes: #58429) | ||
4511 | * Added the UPGRADING file to the package. | ||
4512 | * Added frozen to the changelog line and recompiled before | ||
4513 | package was installed into the archive. | ||
4514 | |||
4515 | -- Tommi Virtanen <tv@debian.org> Fri, 25 Feb 2000 22:08:57 +0200 | ||
4516 | |||
4517 | openssh (1:1.2.2-1.1) frozen unstable; urgency=low | ||
4518 | |||
4519 | * Non-maintainer upload. | ||
4520 | * Integrated scp pipe buffer patch from Ben Collins | ||
4521 | <benc@debian.org>, should now work even if reading | ||
4522 | a pipe gives less than fstat st_blksize bytes. | ||
4523 | Should now work on Alpha and Sparc Linux (closes: #53697, #52071) | ||
4524 | * Made ssh depend on libssl09 (>= 0.9.4-3) (closes: #51393) | ||
4525 | * Integrated patch from Ben Collins <benc@debian.org> | ||
4526 | to do full shadow account locking and expiration | ||
4527 | checking (closes: #58165, #51747) | ||
4528 | |||
4529 | -- Tommi Virtanen <tv@debian.org> Tue, 22 Feb 2000 20:46:12 +0200 | ||
4530 | |||
4531 | openssh (1:1.2.2-1) frozen unstable; urgency=medium | ||
4532 | |||
4533 | * New upstream release (closes: #56870, #56346) | ||
4534 | * built against new libesd (closes: #56805) | ||
4535 | * add Colin Watson <cjw44@cam.ac.uk> =NULL patch | ||
4536 | (closes: #49902, #54894) | ||
4537 | * use socketpairs as suggested by Andrew Tridgell to eliminate rsync | ||
4538 | (and other) lockups | ||
4539 | * patch SSHD_PAM_SERVICE back into auth-pam.c, again :-/ | ||
4540 | (closes: #49902, #55872, #56959) | ||
4541 | * uncoment the * line in ssh_config (closes: #56444) | ||
4542 | |||
4543 | * #54894 & #49902 are release critical, so this should go in frozen | ||
4544 | |||
4545 | -- Philip Hands <phil@hands.com> Wed, 9 Feb 2000 04:52:04 +0000 | ||
4546 | |||
4547 | openssh (1:1.2.1pre24-1) unstable; urgency=low | ||
4548 | |||
4549 | * New upstream release | ||
4550 | |||
4551 | -- Philip Hands <phil@hands.com> Fri, 31 Dec 1999 02:47:24 +0000 | ||
4552 | |||
4553 | openssh (1:1.2.1pre23-1) unstable; urgency=low | ||
4554 | |||
4555 | * New upstream release | ||
4556 | * excape ? in /etc/init.d/ssh (closes: #53269) | ||
4557 | |||
4558 | -- Philip Hands <phil@hands.com> Wed, 29 Dec 1999 16:50:46 +0000 | ||
4559 | |||
4560 | openssh (1:1.2pre17-1) unstable; urgency=low | ||
4561 | |||
4562 | * New upstream release | ||
4563 | |||
4564 | -- Philip Hands <phil@hands.com> Thu, 9 Dec 1999 16:50:40 +0000 | ||
4565 | |||
4566 | openssh (1:1.2pre16-1) unstable; urgency=low | ||
4567 | |||
4568 | * New upstream release | ||
4569 | * upstream release (1.2pre14) (closes: #50299) | ||
4570 | * make ssh depend on libwrap0 (>= 7.6-1.1) (closes: #50973, #50776) | ||
4571 | * dispose of grep -q broken pipe message in config script (closes: #50855) | ||
4572 | * add make-ssh-known-hosts (closes: #50660) | ||
4573 | * add -i option to ssh-copy-id (closes: #50657) | ||
4574 | * add check for *LK* in password, indicating a locked account | ||
4575 | |||
4576 | -- Philip Hands <phil@hands.com> Wed, 8 Dec 1999 22:59:38 +0000 | ||
4577 | |||
4578 | openssh (1:1.2pre13-1) unstable; urgency=low | ||
4579 | |||
4580 | * New upstream release | ||
4581 | * make sshd.c use SSHD_PAM_SERVICE and define it as "ssh" in debian/rules | ||
4582 | * remove duplicate line in /etc/pam.d/ssh (closes: #50310) | ||
4583 | * mention ssh -A option in ssh.1 & ssh_config | ||
4584 | * enable forwarding to localhost in default ssh_config (closes: #50373) | ||
4585 | * tweak preinst to deal with debconf being `unpacked' | ||
4586 | * use --with-tcp-wrappers (closes: #49545) | ||
4587 | |||
4588 | -- Philip Hands <phil@hands.com> Sat, 20 Nov 1999 14:20:04 +0000 | ||
4589 | |||
4590 | openssh (1:1.2pre11-2) unstable; urgency=low | ||
4591 | |||
4592 | * oops, just realised that I forgot to strip out the unpleasant | ||
4593 | fiddling mentioned below (which turned not to be a fix anyway) | ||
4594 | |||
4595 | -- Philip Hands <phil@hands.com> Mon, 15 Nov 1999 01:35:23 +0000 | ||
4596 | |||
4597 | openssh (1:1.2pre11-1) unstable; urgency=low | ||
4598 | |||
4599 | * New upstream release (closes: #49722) | ||
4600 | * add 2>/dev/null to dispose of spurious message casused by grep -q | ||
4601 | (closes: #49876, #49604) | ||
4602 | * fix typo in debian/control (closes: #49841) | ||
4603 | * Do some unpleasant fiddling with upgraded keys in the preinst, which | ||
4604 | should make the keylength problem go away. (closes: #49676) | ||
4605 | * make pam_start in sshd use ``ssh'' as the service name (closes: #49956) | ||
4606 | * If /etc/ssh/NOSERVER exist, stop sshd from starting (closes: #47107) | ||
4607 | * apply Ben Collins <bcollins@debian.org>'s shadow patch | ||
4608 | * disable lastlogin and motd printing if using pam (closes: #49957) | ||
4609 | * add ssh-copy-id script and manpage | ||
4610 | |||
4611 | -- Philip Hands <phil@hands.com> Fri, 12 Nov 1999 01:03:38 +0000 | ||
4612 | |||
4613 | openssh (1:1.2pre9-1) unstable; urgency=low | ||
4614 | |||
4615 | * New upstream release | ||
4616 | * apply Chip Salzenberg <chip@valinux.com>'s SO_REUSEADDR patch | ||
4617 | to channels.c, to make forwarded ports instantly reusable | ||
4618 | * replace Pre-Depend: debconf with some check code in preinst | ||
4619 | * make the ssh-add ssh-askpass failure message more helpful | ||
4620 | * fix the ssh-agent getopts bug (closes: #49426) | ||
4621 | * fixed typo on Suggests: line (closes: #49704, #49571) | ||
4622 | * tidy up ssh package description (closes: #49642) | ||
4623 | * make ssh suid (closes: #49635) | ||
4624 | * in preinst upgrade code, ensure ssh_host_keys is mode 600 (closes: #49606) | ||
4625 | * disable agent forwarding by default, for the similar reasons as | ||
4626 | X forwarding (closes: #49586) | ||
4627 | |||
4628 | -- Philip Hands <phil@hands.com> Tue, 9 Nov 1999 09:57:47 +0000 | ||
4629 | |||
4630 | openssh (1:1.2pre7-4) unstable; urgency=low | ||
4631 | |||
4632 | * predepend on debconf (>= 0.2.17) should now allow preinst questions | ||
4633 | |||
4634 | -- Philip Hands <phil@hands.com> Sat, 6 Nov 1999 10:31:06 +0000 | ||
4635 | |||
4636 | openssh (1:1.2pre7-3) unstable; urgency=low | ||
4637 | |||
4638 | * add ssh-askpass package using Tommi Virtanen's perl-tk script | ||
4639 | * add ssh-preconfig package cludge | ||
4640 | * add usage hints to ssh-agent.1 | ||
4641 | |||
4642 | -- Philip Hands <phil@hands.com> Fri, 5 Nov 1999 00:38:33 +0000 | ||
4643 | |||
4644 | openssh (1:1.2pre7-2) unstable; urgency=low | ||
4645 | |||
4646 | * use pam patch from Ben Collins <bcollins@debian.org> | ||
4647 | * add slogin symlink to Makefile.in | ||
4648 | * change /usr/bin/login to LOGIN_PROGRAM define of /bin/login | ||
4649 | * sort out debconf usage | ||
4650 | * patch from Tommi Virtanen <tv@debian.org>'s makes ssh-add use ssh-askpass | ||
4651 | |||
4652 | -- Philip Hands <phil@hands.com> Thu, 4 Nov 1999 11:08:54 +0000 | ||
4653 | |||
4654 | openssh (1:1.2pre7-1) unstable; urgency=low | ||
4655 | |||
4656 | * New upstream release | ||
4657 | |||
4658 | -- Philip Hands <phil@hands.com> Tue, 2 Nov 1999 21:02:37 +0000 | ||
4659 | |||
4660 | openssh (1:1.2.0.pre6db1-2) unstable; urgency=low | ||
4661 | |||
4662 | * change the binary package name to ssh (the non-free branch of ssh has | ||
4663 | been renamed to ssh-nonfree) | ||
4664 | * make pam file comply with Debian standards | ||
4665 | * use an epoch to make sure openssh supercedes ssh-nonfree | ||
4666 | |||
4667 | -- Philip Hands <phil@hands.com> Sat, 30 Oct 1999 16:26:05 +0100 | ||
4668 | |||
4669 | openssh (1.2pre6db1-1) unstable; urgency=low | ||
4670 | |||
4671 | * New upstream source | ||
4672 | * sshd accepts logins now! | ||
4673 | |||
4674 | -- Dan Brosemer <odin@linuxfreak.com> Fri, 29 Oct 1999 11:13:38 -0500 | ||
4675 | |||
4676 | openssh (1.2.0.19991028-1) unstable; urgency=low | ||
4677 | |||
4678 | * New upstream source | ||
4679 | * Added test for -lnsl to configure script | ||
4680 | |||
4681 | -- Dan Brosemer <odin@linuxfreak.com> Thu, 28 Oct 1999 18:52:09 -0500 | ||
4682 | |||
4683 | openssh (1.2.0.19991027-3) unstable; urgency=low | ||
4684 | |||
4685 | * Initial release | ||
4686 | |||
4687 | -- Dan Brosemer <odin@linuxfreak.com> Wed, 27 Oct 1999 19:39:46 -0500 | ||
diff --git a/debian/clean b/debian/clean new file mode 100644 index 000000000..fcd68b77e --- /dev/null +++ b/debian/clean | |||
@@ -0,0 +1,2 @@ | |||
1 | config.log | ||
2 | debian/openssh-server.sshd.pam | ||
diff --git a/debian/compat b/debian/compat new file mode 100644 index 000000000..ec635144f --- /dev/null +++ b/debian/compat | |||
@@ -0,0 +1 @@ | |||
9 | |||
diff --git a/debian/control b/debian/control new file mode 100644 index 000000000..411731a4a --- /dev/null +++ b/debian/control | |||
@@ -0,0 +1,255 @@ | |||
1 | Source: openssh | ||
2 | Section: net | ||
3 | Priority: standard | ||
4 | Maintainer: Debian OpenSSH Maintainers <debian-ssh@lists.debian.org> | ||
5 | Build-Depends: autotools-dev, | ||
6 | debhelper (>= 9~), | ||
7 | dh-autoreconf, | ||
8 | dh-exec, | ||
9 | dh-systemd (>= 1.4), | ||
10 | dpkg-dev (>= 1.16.1~), | ||
11 | libaudit-dev [linux-any], | ||
12 | libedit-dev, | ||
13 | libgtk-3-dev, | ||
14 | libkrb5-dev | heimdal-dev, | ||
15 | libpam0g-dev | libpam-dev, | ||
16 | libselinux1-dev [linux-any], | ||
17 | libssl1.0-dev | libssl-dev (<< 1.1.0~), | ||
18 | libsystemd-dev [linux-any], | ||
19 | libwrap0-dev | libwrap-dev, | ||
20 | zlib1g-dev (>= 1:1.2.3), | ||
21 | Standards-Version: 3.9.8 | ||
22 | Uploaders: Colin Watson <cjwatson@debian.org>, | ||
23 | Matthew Vernon <matthew@debian.org>, | ||
24 | Homepage: http://www.openssh.com/ | ||
25 | Vcs-Git: https://anonscm.debian.org/git/pkg-ssh/openssh.git | ||
26 | Vcs-Browser: https://anonscm.debian.org/cgit/pkg-ssh/openssh.git | ||
27 | |||
28 | Package: openssh-client | ||
29 | Architecture: any | ||
30 | Depends: adduser (>= 3.10), | ||
31 | dpkg (>= 1.7.0), | ||
32 | passwd, | ||
33 | ${misc:Depends}, | ||
34 | ${shlibs:Depends}, | ||
35 | Recommends: xauth, | ||
36 | Conflicts: sftp, | ||
37 | Replaces: ssh, | ||
38 | ssh-krb5, | ||
39 | Suggests: keychain, | ||
40 | libpam-ssh, | ||
41 | monkeysphere, | ||
42 | ssh-askpass, | ||
43 | Provides: rsh-client, | ||
44 | ssh-client, | ||
45 | Multi-Arch: foreign | ||
46 | Description: secure shell (SSH) client, for secure access to remote machines | ||
47 | This is the portable version of OpenSSH, a free implementation of | ||
48 | the Secure Shell protocol as specified by the IETF secsh working | ||
49 | group. | ||
50 | . | ||
51 | Ssh (Secure Shell) is a program for logging into a remote machine | ||
52 | and for executing commands on a remote machine. | ||
53 | It provides secure encrypted communications between two untrusted | ||
54 | hosts over an insecure network. X11 connections and arbitrary TCP/IP | ||
55 | ports can also be forwarded over the secure channel. | ||
56 | It can be used to provide applications with a secure communication | ||
57 | channel. | ||
58 | . | ||
59 | This package provides the ssh, scp and sftp clients, the ssh-agent | ||
60 | and ssh-add programs to make public key authentication more convenient, | ||
61 | and the ssh-keygen, ssh-keyscan, ssh-copy-id and ssh-argv0 utilities. | ||
62 | . | ||
63 | In some countries it may be illegal to use any encryption at all | ||
64 | without a special permit. | ||
65 | . | ||
66 | ssh replaces the insecure rsh, rcp and rlogin programs, which are | ||
67 | obsolete for most purposes. | ||
68 | |||
69 | Package: openssh-client-ssh1 | ||
70 | Priority: extra | ||
71 | Architecture: any | ||
72 | Depends: openssh-client (= ${binary:Version}), | ||
73 | ${misc:Depends}, | ||
74 | ${shlibs:Depends}, | ||
75 | Multi-Arch: foreign | ||
76 | Description: secure shell (SSH) client for legacy SSH1 protocol | ||
77 | This is the portable version of OpenSSH, a free implementation of | ||
78 | the Secure Shell protocol as specified by the IETF secsh working | ||
79 | group. | ||
80 | . | ||
81 | Ssh (Secure Shell) is a program for logging into a remote machine | ||
82 | and for executing commands on a remote machine. | ||
83 | It provides secure encrypted communications between two untrusted | ||
84 | hosts over an insecure network. X11 connections and arbitrary TCP/IP | ||
85 | ports can also be forwarded over the secure channel. | ||
86 | It can be used to provide applications with a secure communication | ||
87 | channel. | ||
88 | . | ||
89 | This package provides the ssh1 and scp1 clients and the ssh-keygen1 | ||
90 | utility, all built with support for the legacy SSH1 protocol. This | ||
91 | protocol is obsolete and should not normally be used, but in some cases | ||
92 | there may be no alternative way to connect to outdated servers. | ||
93 | . | ||
94 | In some countries it may be illegal to use any encryption at all | ||
95 | without a special permit. | ||
96 | . | ||
97 | ssh replaces the insecure rsh, rcp and rlogin programs, which are | ||
98 | obsolete for most purposes. | ||
99 | |||
100 | Package: openssh-server | ||
101 | Priority: optional | ||
102 | Architecture: any | ||
103 | Pre-Depends: ${misc:Pre-Depends}, | ||
104 | Depends: adduser (>= 3.9), | ||
105 | dpkg (>= 1.9.0), | ||
106 | libpam-modules (>= 0.72-9), | ||
107 | libpam-runtime (>= 0.76-14), | ||
108 | lsb-base (>= 4.1+Debian3), | ||
109 | openssh-client (= ${binary:Version}), | ||
110 | openssh-sftp-server, | ||
111 | procps, | ||
112 | ucf (>= 0.28), | ||
113 | ${misc:Depends}, | ||
114 | ${shlibs:Depends}, | ||
115 | Recommends: libpam-systemd, | ||
116 | ncurses-term, | ||
117 | xauth, | ||
118 | ${openssh-server:Recommends}, | ||
119 | Conflicts: sftp, | ||
120 | ssh-socks, | ||
121 | ssh2, | ||
122 | Replaces: ssh, | ||
123 | ssh-krb5, | ||
124 | Suggests: molly-guard, | ||
125 | monkeysphere, | ||
126 | rssh, | ||
127 | ssh-askpass, | ||
128 | ufw, | ||
129 | Provides: ssh-server, | ||
130 | Multi-Arch: foreign | ||
131 | Description: secure shell (SSH) server, for secure access from remote machines | ||
132 | This is the portable version of OpenSSH, a free implementation of | ||
133 | the Secure Shell protocol as specified by the IETF secsh working | ||
134 | group. | ||
135 | . | ||
136 | Ssh (Secure Shell) is a program for logging into a remote machine | ||
137 | and for executing commands on a remote machine. | ||
138 | It provides secure encrypted communications between two untrusted | ||
139 | hosts over an insecure network. X11 connections and arbitrary TCP/IP | ||
140 | ports can also be forwarded over the secure channel. | ||
141 | It can be used to provide applications with a secure communication | ||
142 | channel. | ||
143 | . | ||
144 | This package provides the sshd server. | ||
145 | . | ||
146 | In some countries it may be illegal to use any encryption at all | ||
147 | without a special permit. | ||
148 | . | ||
149 | sshd replaces the insecure rshd program, which is obsolete for most | ||
150 | purposes. | ||
151 | |||
152 | Package: openssh-sftp-server | ||
153 | Priority: optional | ||
154 | Architecture: any | ||
155 | Depends: ${misc:Depends}, | ||
156 | ${shlibs:Depends}, | ||
157 | Recommends: openssh-server | ssh-server, | ||
158 | Breaks: openssh-server (<< 1:6.5p1-5), | ||
159 | Replaces: openssh-server (<< 1:6.5p1-5), | ||
160 | Enhances: openssh-server, | ||
161 | ssh-server, | ||
162 | Description: secure shell (SSH) sftp server module, for SFTP access from remote machines | ||
163 | This is the portable version of OpenSSH, a free implementation of | ||
164 | the Secure Shell protocol as specified by the IETF secsh working | ||
165 | group. | ||
166 | . | ||
167 | Ssh (Secure Shell) is a program for logging into a remote machine | ||
168 | and for executing commands on a remote machine. | ||
169 | It provides secure encrypted communications between two untrusted | ||
170 | hosts over an insecure network. X11 connections and arbitrary TCP/IP | ||
171 | ports can also be forwarded over the secure channel. | ||
172 | It can be used to provide applications with a secure communication | ||
173 | channel. | ||
174 | . | ||
175 | This package provides the SFTP server module for the SSH server. It | ||
176 | is needed if you want to access your SSH server with SFTP. The SFTP | ||
177 | server module also works with other SSH daemons like dropbear. | ||
178 | . | ||
179 | OpenSSH's sftp and sftp-server implement revision 3 of the SSH filexfer | ||
180 | protocol described in: | ||
181 | . | ||
182 | http://www.openssh.com/txt/draft-ietf-secsh-filexfer-02.txt | ||
183 | . | ||
184 | Newer versions of the draft will not be supported, though some features | ||
185 | are individually implemented as extensions. | ||
186 | |||
187 | Package: ssh | ||
188 | Priority: extra | ||
189 | Architecture: all | ||
190 | Pre-Depends: dpkg (>= 1.17.5), | ||
191 | Depends: openssh-client (>= ${binary:Version}), | ||
192 | openssh-server (>= ${binary:Version}), | ||
193 | ${misc:Depends}, | ||
194 | Description: secure shell client and server (metapackage) | ||
195 | This metapackage is a convenient way to install both the OpenSSH client | ||
196 | and the OpenSSH server. It provides nothing in and of itself, so you | ||
197 | may remove it if nothing depends on it. | ||
198 | |||
199 | Package: ssh-krb5 | ||
200 | Section: oldlibs | ||
201 | Priority: extra | ||
202 | Architecture: all | ||
203 | Depends: openssh-client (>= ${binary:Version}), | ||
204 | openssh-server (>= ${binary:Version}), | ||
205 | ${misc:Depends}, | ||
206 | Description: secure shell client and server (transitional package) | ||
207 | This is a transitional package depending on the regular Debian OpenSSH | ||
208 | client and server, which now support GSSAPI natively. It will add the | ||
209 | necessary GSSAPI options to the server configuration file. You can | ||
210 | remove it once the upgrade is complete and nothing depends on it. | ||
211 | |||
212 | Package: ssh-askpass-gnome | ||
213 | Section: gnome | ||
214 | Priority: optional | ||
215 | Architecture: any | ||
216 | Depends: openssh-client | ssh (>= 1:1.2pre7-4) | ssh-krb5, | ||
217 | ${misc:Depends}, | ||
218 | ${shlibs:Depends}, | ||
219 | Replaces: ssh (<< 1:3.5p1-3), | ||
220 | Provides: ssh-askpass, | ||
221 | Description: interactive X program to prompt users for a passphrase for ssh-add | ||
222 | This has been split out of the main openssh-client package so that | ||
223 | openssh-client does not need to depend on GTK+. | ||
224 | . | ||
225 | You probably want the ssh-askpass package instead, but this is | ||
226 | provided to add to your choice and/or confusion. | ||
227 | |||
228 | Package: openssh-client-udeb | ||
229 | Package-Type: udeb | ||
230 | Section: debian-installer | ||
231 | Priority: optional | ||
232 | Architecture: any | ||
233 | Depends: ${shlibs:Depends}, | ||
234 | XB-Installer-Menu-Item: 99999 | ||
235 | Description: secure shell client for the Debian installer | ||
236 | This is the portable version of OpenSSH, a free implementation of | ||
237 | the Secure Shell protocol as specified by the IETF secsh working | ||
238 | group. | ||
239 | . | ||
240 | This package provides the ssh client for use in debian-installer. | ||
241 | |||
242 | Package: openssh-server-udeb | ||
243 | Package-Type: udeb | ||
244 | Section: debian-installer | ||
245 | Priority: optional | ||
246 | Architecture: any | ||
247 | Depends: ${shlibs:Depends}, | ||
248 | Description: secure shell server for the Debian installer | ||
249 | This is the portable version of OpenSSH, a free implementation of | ||
250 | the Secure Shell protocol as specified by the IETF secsh working | ||
251 | group. | ||
252 | . | ||
253 | This package provides the sshd server for use in debian-installer. | ||
254 | Since it is expected to be used in specialized situations (e.g. S/390 | ||
255 | installs with no console), it does not provide any configuration. | ||
diff --git a/debian/copyright b/debian/copyright new file mode 100644 index 000000000..3822727b3 --- /dev/null +++ b/debian/copyright | |||
@@ -0,0 +1,267 @@ | |||
1 | Format: http://www.debian.org/doc/packaging-manuals/copyright-format/1.0/ | ||
2 | Upstream-Name: OpenSSH | ||
3 | Upstream-Contact: openssh-unix-dev@mindrot.org | ||
4 | Source: http://www.openssh.com/portable.html | ||
5 | Comment: | ||
6 | The overall licence of the OpenSSH upstream code amounts to BSD-3-clause or | ||
7 | various less restrictive licences, with the additional restrictions that | ||
8 | derived versions must be clearly marked as such and that if derived works | ||
9 | are incompatible with the RFC-specified protocol then they must be called | ||
10 | by a name other than "ssh" or "Secure Shell". | ||
11 | |||
12 | Files: * | ||
13 | Copyright: | ||
14 | 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | ||
15 | Markus Friedl | ||
16 | Theo de Raadt | ||
17 | Niels Provos | ||
18 | Dug Song | ||
19 | Aaron Campbell | ||
20 | Damien Miller | ||
21 | Kevin Steves | ||
22 | Daniel Kouril | ||
23 | Wesley Griffin | ||
24 | Per Allansson | ||
25 | Nils Nordman | ||
26 | Simon Wilkinson | ||
27 | Ben Lindstrom | ||
28 | Tim Rice | ||
29 | Andre Lucas | ||
30 | Chris Adams | ||
31 | Corinna Vinschen | ||
32 | Cray Inc. | ||
33 | Denis Parker | ||
34 | Gert Doering | ||
35 | Jakob Schlyter | ||
36 | Jason Downs | ||
37 | Juha Yrjölä | ||
38 | Michael Stone | ||
39 | Networks Associates Technology, Inc. | ||
40 | Solar Designer | ||
41 | Todd C. Miller | ||
42 | Wayne Schroeder | ||
43 | William Jones | ||
44 | Darren Tucker | ||
45 | Sun Microsystems | ||
46 | The SCO Group | ||
47 | Daniel Walsh | ||
48 | Red Hat, Inc | ||
49 | Simon Vallet / Genoscope | ||
50 | Internet Software Consortium | ||
51 | Reyk Floeter | ||
52 | Chad Mynhier | ||
53 | License: OpenSSH | ||
54 | Tatu Ylonen's original licence is as follows (excluding some terms about | ||
55 | third-party code which are no longer relevant; see the LICENCE file for | ||
56 | details): | ||
57 | . | ||
58 | As far as I am concerned, the code I have written for this software | ||
59 | can be used freely for any purpose. Any derived versions of this | ||
60 | software must be clearly marked as such, and if the derived work is | ||
61 | incompatible with the protocol description in the RFC file, it must be | ||
62 | called by a name other than "ssh" or "Secure Shell". | ||
63 | . | ||
64 | Note that any information and cryptographic algorithms used in this | ||
65 | software are publicly available on the Internet and at any major | ||
66 | bookstore, scientific library, and patent office worldwide. More | ||
67 | information can be found e.g. at "http://www.cs.hut.fi/crypto". | ||
68 | . | ||
69 | The legal status of this program is some combination of all these | ||
70 | permissions and restrictions. Use only at your own responsibility. | ||
71 | You will be responsible for any legal consequences yourself; I am not | ||
72 | making any claims whether possessing or using this is legal or not in | ||
73 | your country, and I am not taking any responsibility on your behalf. | ||
74 | . | ||
75 | Most remaining components of the software are provided under a standard | ||
76 | 2-term BSD licence: | ||
77 | . | ||
78 | Redistribution and use in source and binary forms, with or without | ||
79 | modification, are permitted provided that the following conditions | ||
80 | are met: | ||
81 | 1. Redistributions of source code must retain the above copyright | ||
82 | notice, this list of conditions and the following disclaimer. | ||
83 | 2. Redistributions in binary form must reproduce the above copyright | ||
84 | notice, this list of conditions and the following disclaimer in the | ||
85 | documentation and/or other materials provided with the distribution. | ||
86 | . | ||
87 | THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR | ||
88 | IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES | ||
89 | OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. | ||
90 | IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, | ||
91 | INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT | ||
92 | NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, | ||
93 | DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY | ||
94 | THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT | ||
95 | (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF | ||
96 | THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | ||
97 | . | ||
98 | Some code is licensed under an ISC-style license, to the following | ||
99 | copyright holders: | ||
100 | . | ||
101 | Permission to use, copy, modify, and distribute this software for any | ||
102 | purpose with or without fee is hereby granted, provided that the above | ||
103 | copyright notice and this permission notice appear in all copies. | ||
104 | . | ||
105 | THE SOFTWARE IS PROVIDED "AS IS" AND TODD C. MILLER DISCLAIMS ALL | ||
106 | WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES | ||
107 | OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL TODD C. MILLER BE LIABLE | ||
108 | FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES | ||
109 | WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION | ||
110 | OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN | ||
111 | CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. | ||
112 | |||
113 | Files: deattack.* | ||
114 | Copyright: 1998 CORE SDI S.A., Buenos Aires, Argentina | ||
115 | License: CORE-SDI-BSD-style | ||
116 | All rights reserved. Redistribution and use in source and binary | ||
117 | forms, with or without modification, are permitted provided that | ||
118 | this copyright notice is retained. | ||
119 | . | ||
120 | THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED | ||
121 | WARRANTIES ARE DISCLAIMED. IN NO EVENT SHALL CORE SDI S.A. BE | ||
122 | LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY OR | ||
123 | CONSEQUENTIAL DAMAGES RESULTING FROM THE USE OR MISUSE OF THIS | ||
124 | SOFTWARE. | ||
125 | . | ||
126 | Ariel Futoransky <futo@core-sdi.com> | ||
127 | <http://www.core-sdi.com> | ||
128 | |||
129 | Files: ssh-keyscan.* | ||
130 | Copyright: 1995, 1996 David Mazieres <dm@lcs.mit.edu> | ||
131 | License: Mazieres-BSD-style | ||
132 | Modification and redistribution in source and binary forms is | ||
133 | permitted provided that due credit is given to the author and the | ||
134 | OpenBSD project by leaving this copyright notice intact. | ||
135 | |||
136 | Files: rijndael.* | ||
137 | License: public-domain | ||
138 | This code is from a reference implementation of the Rijndael cipher which | ||
139 | has been dedicated to the public domain. | ||
140 | . | ||
141 | @version 3.0 (December 2000) | ||
142 | . | ||
143 | Optimised ANSI C code for the Rijndael cipher (now AES) | ||
144 | . | ||
145 | @author Vincent Rijmen <vincent.rijmen@esat.kuleuven.ac.be> | ||
146 | @author Antoon Bosselaers <antoon.bosselaers@esat.kuleuven.ac.be> | ||
147 | @author Paulo Barreto <paulo.barreto@terra.com.br> | ||
148 | . | ||
149 | This code is hereby placed in the public domain. | ||
150 | . | ||
151 | THIS SOFTWARE IS PROVIDED BY THE AUTHORS ''AS IS'' AND ANY EXPRESS | ||
152 | OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED | ||
153 | WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE | ||
154 | ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE | ||
155 | LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR | ||
156 | CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF | ||
157 | SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR | ||
158 | BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, | ||
159 | WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE | ||
160 | OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, | ||
161 | EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | ||
162 | |||
163 | Files: loginrec.c openbsd-compat/* scp.c | ||
164 | Copyright: | ||
165 | 1983, 1995-1997 Eric P. Allman | ||
166 | 1999 Aaron Campbell | ||
167 | 1993 by Digital Equipment Corporation | ||
168 | 2000 Andre Lucas | ||
169 | 1999-2010 Damien Miller | ||
170 | 1997-2010 Todd C. Miller | ||
171 | 1995, 1996, 1998, 1999, 2008 Theo de Raadt | ||
172 | 2003 Constantin S. Svintsoff <kostik@iclub.nsu.ru> | ||
173 | 1980, 1983, 1987, 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995 The Regents of the University of California | ||
174 | License: BSD-3-clause | ||
175 | Redistribution and use in source and binary forms, with or without | ||
176 | modification, are permitted provided that the following conditions | ||
177 | are met: | ||
178 | 1. Redistributions of source code must retain the above copyright | ||
179 | notice, this list of conditions and the following disclaimer. | ||
180 | 2. Redistributions in binary form must reproduce the above copyright | ||
181 | notice, this list of conditions and the following disclaimer in the | ||
182 | documentation and/or other materials provided with the distribution. | ||
183 | 3. Neither the name of the University nor the names of its contributors | ||
184 | may be used to endorse or promote products derived from this software | ||
185 | without specific prior written permission. | ||
186 | . | ||
187 | THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND | ||
188 | ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | ||
189 | IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE | ||
190 | ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE | ||
191 | FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL | ||
192 | DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS | ||
193 | OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | ||
194 | HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT | ||
195 | LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY | ||
196 | OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF | ||
197 | SUCH DAMAGE. | ||
198 | |||
199 | Files: md5crypt.* | ||
200 | Copyright: Poul-Henning Kamp | ||
201 | License: Beer-ware | ||
202 | "THE BEER-WARE LICENSE" (Revision 42): | ||
203 | <phk@login.dknet.dk> wrote this file. As long as you retain this | ||
204 | notice you can do whatever you want with this stuff. If we meet | ||
205 | some day, and you think this stuff is worth it, you can buy me a | ||
206 | beer in return. Poul-Henning Kamp | ||
207 | |||
208 | Files: openbsd-compat/bsd-snprintf.c | ||
209 | Copyright: 1995 Patrick Powell | ||
210 | License: Powell-BSD-style | ||
211 | This code is based on code written by Patrick Powell | ||
212 | (papowell@astart.com) It may be used for any purpose as long as this | ||
213 | notice remains intact on all source code distributions | ||
214 | |||
215 | Files: openbsd-compat/sigact.* | ||
216 | Copyright: 1998, 2000 Free Software Foundation, Inc. | ||
217 | License: Expat-with-advertising-restriction | ||
218 | Permission is hereby granted, free of charge, to any person obtaining a | ||
219 | copy of this software and associated documentation files (the | ||
220 | "Software"), to deal in the Software without restriction, including | ||
221 | without limitation the rights to use, copy, modify, merge, publish, | ||
222 | distribute, distribute with modifications, sublicense, and/or sell | ||
223 | copies of the Software, and to permit persons to whom the Software is | ||
224 | furnished to do so, subject to the following conditions: | ||
225 | . | ||
226 | The above copyright notice and this permission notice shall be included | ||
227 | in all copies or substantial portions of the Software. | ||
228 | . | ||
229 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS | ||
230 | OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF | ||
231 | MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. | ||
232 | IN NO EVENT SHALL THE ABOVE COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, | ||
233 | DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR | ||
234 | OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR | ||
235 | THE USE OR OTHER DEALINGS IN THE SOFTWARE. | ||
236 | . | ||
237 | Except as contained in this notice, the name(s) of the above copyright | ||
238 | holders shall not be used in advertising or otherwise to promote the | ||
239 | sale, use or other dealings in this Software without prior written | ||
240 | authorization. | ||
241 | |||
242 | Files: debian/* | ||
243 | Copyright: Matthew Vernon, Colin Watson | ||
244 | License: GPL-2 with OpenSSH-linking exception | ||
245 | This program is free software; you can redistribute it and/or modify | ||
246 | it under the terms of the GNU General Public License as published by | ||
247 | the Free Software Foundation; either version 2 of the License, or | ||
248 | (at your option) any later version. | ||
249 | . | ||
250 | This program is distributed in the hope that it will be useful, | ||
251 | but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
252 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||
253 | GNU General Public License for more details. | ||
254 | . | ||
255 | You should have received a copy of the GNU General Public License along | ||
256 | with this program; if not, write to the Free Software Foundation, Inc., | ||
257 | 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | ||
258 | . | ||
259 | In addition, as a special exception, Matthew Vernon gives permission | ||
260 | to link the code of the Debian patch with any version of the OpenSSH | ||
261 | code which is distributed under a license identical to that listed in | ||
262 | the included Copyright file, and distribute linked combinations | ||
263 | including the two. You must obey the GNU General Public License in | ||
264 | all respects for all of the code used other than OpenSSH. If you | ||
265 | modify this file, you may extend this exception to your version of the | ||
266 | file, but you are not obligated to do so. If you do not wish to do | ||
267 | so, delete this exception statement from your version. | ||
diff --git a/debian/faq.html b/debian/faq.html new file mode 100644 index 000000000..7f0252891 --- /dev/null +++ b/debian/faq.html | |||
@@ -0,0 +1,1187 @@ | |||
1 | <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> | ||
2 | <html> | ||
3 | <head> | ||
4 | <title>OpenSSH FAQ</title> | ||
5 | <link rev= "made" href= "mailto:www@openbsd.org"> | ||
6 | <meta name= "resource-type" content= "document"> | ||
7 | <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> | ||
8 | <meta name= "description" content= "the OpenSSH FAQ page"> | ||
9 | <meta name= "keywords" content= "OpenSSH,SSH,Secure Shell,faq"> | ||
10 | <meta name= "distribution" content= "global"> | ||
11 | <meta name= "copyright" content= "This document copyright 1999-2010 OpenBSD."> | ||
12 | </head> | ||
13 | |||
14 | <body bgcolor= "#ffffff" text= "#000000" link= "#23238E"> | ||
15 | <a href="http://www.openssh.com/index.html"><img alt="[OpenSSH]" height="30" width="141" src="images/smalltitle.gif" border="0"></a> | ||
16 | <p> | ||
17 | |||
18 | <h1>OpenSSH FAQ (Frequently asked questions)</h1> | ||
19 | |||
20 | <hr> | ||
21 | |||
22 | <blockquote> | ||
23 | <h3><a href= "#1.0">1.0 - What Is OpenSSH and Where Can I Get It?</a></h3> | ||
24 | <ul> | ||
25 | <li><a href= "#1.1">1.1 - What is OpenSSH and where can I download it?</a> | ||
26 | <li><a href= "#1.2">1.2 - Why should it be used?</a> | ||
27 | <li><a href= "#1.3">1.3 - What Operating Systems are supported?</a> | ||
28 | <li><a href= "#1.4">1.4 - What about copyright, usage and patents?</a> | ||
29 | <li><a href= "#1.5">1.5 - Where should I ask for help?</a> | ||
30 | <li><a href= "#1.6">1.6 - I have found a bug. Where do I report it?</a> | ||
31 | </ul> | ||
32 | |||
33 | <h3><a href= "#2.0">2.0 - General Questions</a></h3> | ||
34 | <ul> | ||
35 | <li><a href= "#2.1">2.1 - Why does ssh/scp make connections from low-numbered ports. My firewall blocks these.</a> | ||
36 | <li><a href= "#2.2">2.2 - Why is the ssh client setuid root?</a> | ||
37 | <li><a href= "#2.3">2.3 - Why does SSH 2.3 have problems interoperating with OpenSSH 2.1.1?</a> | ||
38 | <li><a href= "#2.4">2.4 - Why does OpenSSH print: Dispatch protocol error: type 20</a> | ||
39 | <li><a href= "#2.5">2.5 - Old versions of commercial SSH encrypt host keys with IDEA.</a> | ||
40 | <li><a href= "#2.6">2.6 - What are these warning messages about key lengths?</a> | ||
41 | <li><a href= "#2.7">2.7 - X11 and/or agent forwarding does not work.</a> | ||
42 | <li><a href= "#2.8">2.8 - After upgrading OpenSSH I lost SSH2 support.</a> | ||
43 | <li><a href= "#2.9">2.9 - sftp/scp fails at connection, but ssh is OK.</a> | ||
44 | <li><a href= "#2.10">2.10 - Will you add [foo] to scp?</a> | ||
45 | <li><a href= "#2.11">2.11 - How do I use port forwarding?</a> | ||
46 | <li><a href= "#2.12">2.12 - My ssh connection freezes or drops out after N minutes of inactivity.</a> | ||
47 | <li><a href= "#2.13">2.13 - How do I use scp to copy a file with a colon in it?</a> | ||
48 | <li><a href= "#2.14">2.14 - Why does OpenSSH report its version to clients?</a> | ||
49 | </ul> | ||
50 | |||
51 | <h3><a href= "#3.0">3.0 - Portable OpenSSH Questions</a></h3> | ||
52 | <ul> | ||
53 | <li><a href= "#3.1">3.1 - Spurious PAM authentication messages in logfiles.</a> | ||
54 | <li><a href= "#3.2">3.2 - Empty passwords not allowed with PAM authentication.</a> | ||
55 | <li><a href= "#3.3">3.3 - ssh(1) takes a long time to connect or log in</a> | ||
56 | <li><a href= "#3.4">3.4 - "Can't locate module net-pf-10" messages in log under Linux.</a> | ||
57 | <li><a href= "#3.5">3.5 - Password authentication doesn't work (eg on Slackware 7.0 or Red Hat Linux 6.x)</a> | ||
58 | <li><a href= "#3.6">3.6 - Configure or sshd(8) complain about lack of RSA support</a> | ||
59 | <li><a href= "#3.7">3.7 - "scp: command not found" errors</a> | ||
60 | <li><a href= "#3.8">3.8 - Unable to read passphrase</a> | ||
61 | <li><a href= "#3.9">3.9 - 'configure' missing or make fails</a> | ||
62 | <li><a href= "#3.10">3.10 - Hangs when exiting ssh</a> | ||
63 | <li><a href= "#3.11">3.11 - Why does ssh hang on exit?</a> | ||
64 | <li><a href= "#3.12">3.12 - I upgraded to OpenSSH 3.1 and X11 forwarding stopped working.</a> | ||
65 | <li><a href= "#3.13">3.13 - I upgraded to OpenSSH 3.8 and some X11 programs stopped working.</a> | ||
66 | <li><a href= "#3.14">3.14 - I copied my public key to authorized_keys but public-key authentication still doesn't work.</a> | ||
67 | <li><a href= "#3.15">3.15 - OpenSSH versions and PAM behaviour.</a> | ||
68 | <li><a href= "#3.16">3.16 - Why doesn't "w" or "who" on AIX 5.x show users logged in via ssh?</a> | ||
69 | </ul> | ||
70 | |||
71 | </blockquote> | ||
72 | |||
73 | <hr> | ||
74 | |||
75 | <h2><u><a name= "1.0">1.0 - What Is OpenSSH and Where Can I Get It?</a></u></h2> | ||
76 | |||
77 | <h2><a name= "1.1">1.1 - What is OpenSSH and where can I download it?</a></h2> | ||
78 | |||
79 | OpenSSH provides end-to-end encrypted replacement of applications such as | ||
80 | telnet, rlogin, and ftp. | ||
81 | Unlike these legacy applications, OpenSSH never passes anything | ||
82 | (including username and password) over the wire in unencrypted form, and | ||
83 | provides host authentication, to verify that you really are talking to | ||
84 | the system that you think you are and that no one else can take over | ||
85 | that session. | ||
86 | |||
87 | <p> | ||
88 | The OpenSSH suite includes the | ||
89 | <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh&sektion=1">ssh(1)</a> | ||
90 | program which replaces rlogin and telnet, and | ||
91 | <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=scp&sektion=1">scp(1)</a> | ||
92 | which replaces | ||
93 | <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=rcp&sektion=1">rcp(1)</a> and | ||
94 | <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ftp&sektion=1">ftp(1)</a>. | ||
95 | OpenSSH has also added | ||
96 | <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sftp&sektion=1">sftp(1)</a> and | ||
97 | <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sftp-server&sektion=8">sftp-server(8)</a> | ||
98 | which implement an easier solution for file-transfer. This is based upon the | ||
99 | <a href="http://www.openssh.com/txt/draft-ietf-secsh-filexfer-02.txt">secsh-filexfer</a> IETF draft. | ||
100 | |||
101 | |||
102 | <p><strong>OpenSSH consists of a number of programs.</strong> | ||
103 | |||
104 | <ul> | ||
105 | <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sshd&sektion=8">sshd(8)</a> - Server program run on the server machine. This listens for connections from client machines, and whenever it receives a connection, it performs authentication and starts serving the client. | ||
106 | Its behaviour is controlled by the config file <i><a | ||
107 | href="http://www.openbsd.org/cgi-bin/man.cgi?query=sshd_config&sektion=5"> | ||
108 | sshd_config(5)</a></i>. | ||
109 | <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh&sektion=1">ssh(1)</a> - This is the client program used to log into another machine or to execute commands on the other machine. <i>slogin</i> is another name for this program. | ||
110 | Its behaviour is controlled by the global config file <i><a | ||
111 | href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh_config&sektion=5"> | ||
112 | ssh_config(5)</a></i> and individual users' <i>$HOME/.ssh/config</i> files. | ||
113 | <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=scp&sektion=1">scp(1)</a> - Securely copies files from one machine to another. | ||
114 | <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh-keygen&sektion=1">ssh-keygen(1)</a> - Used to create Pubkey Authentication (RSA or DSA) keys (host keys and user authentication keys). | ||
115 | <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh-agent&sektion=1">ssh-agent(1)</a> - Authentication agent. This can be used to hold RSA keys for authentication. | ||
116 | <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh-add&sektion=1">ssh-add(1)</a> - Used to register new keys with the agent. | ||
117 | <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sftp-server&sektion=8">sftp-server(8)</a> - SFTP server subsystem. | ||
118 | <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sftp&sektion=1">sftp(1)</a> - Secure file transfer program. | ||
119 | <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh-keyscan&sektion=1">ssh-keyscan(1)</a> - gather ssh public keys. | ||
120 | <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh-keysign&sektion=8">ssh-keysign(8)</a> - ssh helper program for hostbased authentication. | ||
121 | </ul> | ||
122 | |||
123 | <h3>Downloading</h3> | ||
124 | |||
125 | <p> | ||
126 | The most recent version of OpenSSH is included with the current | ||
127 | distribution of <a href="http://www.openbsd.org/">OpenBSD</a>, and | ||
128 | installed as part of a basic install. | ||
129 | |||
130 | <p> | ||
131 | Today, most other operating systems include some version of OpenSSH | ||
132 | (often re-badged or privately labeled), so most users can immediately | ||
133 | use it. | ||
134 | However, sometimes the included versions are quite old, and missing | ||
135 | features of the current release of OpenSSH, and you may wish to install | ||
136 | the current version, or install it on one of the few OSs that lacked it, | ||
137 | and where the OS publisher does not make a modern version available. | ||
138 | You may also wish to use OpenSSH on your embedded application. | ||
139 | |||
140 | <p> | ||
141 | Non-OpenBSD users will want to download, compile and install the | ||
142 | multi-platform <a href="http://www.openssh.com/portable.html">Portable</a> distribution from a | ||
143 | <a href="http://www.openssh.com/portable.html#mirrors">mirror</a> near you. | ||
144 | |||
145 | |||
146 | <h2><a name= "1.2">1.2 - Why should it be used?</a></h2> | ||
147 | |||
148 | <p> | ||
149 | OpenSSH is a suite of tools to help secure your network | ||
150 | connections. Here is a list of features: | ||
151 | |||
152 | |||
153 | <ul> | ||
154 | <li>Strong authentication. Closes several security holes (e.g., IP, routing, and DNS spoofing). | ||
155 | <li>Improved privacy. All communications are automatically and transparently encrypted. | ||
156 | <li>Secure X11 sessions. The program automatically sets DISPLAY on the server machine, and forwards any X11 connections over the secure channel. | ||
157 | <li>Arbitrary TCP/IP ports can be redirected through the encrypted channel in both directions (e.g., for e-cash transactions). | ||
158 | <li>No retraining needed for normal users. | ||
159 | <li>Never trusts the network. Minimal trust on the remote side of the connection. Minimal trust on domain name servers. Pure RSA authentication never trusts anything but the private key. | ||
160 | <li>Client RSA-authenticates the server machine in the beginning of every connection to prevent trojan horses (by routing or DNS spoofing) and man-in-the-middle attacks, and the server RSA-authenticates the client machine before accepting <i>.rhosts</i> or <i>/etc/hosts.equiv</i> authentication (to prevent DNS, routing, or IP-spoofing). | ||
161 | <li>Host authentication key distribution can be centrally by the administration, automatically when the first connection is made to a machine. | ||
162 | <li>Any user can create any number of user authentication RSA keys for his/her own use. | ||
163 | <li>The server program has its own server RSA key which is automatically regenerated every hour. | ||
164 | <li>An authentication agent, running in the user's laptop or local workstation, can be used to hold the user's RSA authentication keys. | ||
165 | <li>The software can be installed and used (with restricted functionality) even without root privileges. | ||
166 | <li>The client is customizable in system-wide and per-user configuration files. | ||
167 | <li>Optional compression of all data with gzip (including forwarded X11 and TCP/IP port data), which may result in significant speedups on slow connections. | ||
168 | <li>Complete replacement for rlogin, rsh, and rcp. | ||
169 | </ul> | ||
170 | |||
171 | <p> | ||
172 | Currently, almost all communications in computer networks are done | ||
173 | without encryption. As a consequence, anyone who has access to any | ||
174 | machine connected to the network can listen in on any communication. | ||
175 | This is being done by hackers, curious administrators, employers, | ||
176 | criminals, industrial spies, and governments. Some networks leak off | ||
177 | enough electromagnetic radiation that data may be captured even from a | ||
178 | distance. | ||
179 | |||
180 | |||
181 | <p> | ||
182 | When you log in, your password goes in the network in plain | ||
183 | text. Thus, any listener can then use your account to do any evil he | ||
184 | likes. Many incidents have been encountered worldwide where crackers | ||
185 | have started programs on workstations without the owner's knowledge | ||
186 | just to listen to the network and collect passwords. Programs for | ||
187 | doing this are available on the Internet, or can be built by a | ||
188 | competent programmer in a few hours. | ||
189 | |||
190 | |||
191 | <p> | ||
192 | Businesses have trade secrets, patent applications in preparation, | ||
193 | pricing information, subcontractor information, client data, personnel | ||
194 | data, financial information, etc. Currently, anyone with access to | ||
195 | the network (any machine on the network) can listen to anything that | ||
196 | goes in the network, without any regard to normal access restrictions. | ||
197 | |||
198 | |||
199 | <p> | ||
200 | Many companies are not aware that information can so easily be | ||
201 | recovered from the network. They trust that their data is safe | ||
202 | since nobody is supposed to know that there is sensitive information | ||
203 | in the network, or because so much other data is transferred in the | ||
204 | network. This is not a safe policy. | ||
205 | |||
206 | |||
207 | <h2><a name= "1.3">1.3 - What operating systems are supported?</a></h2> | ||
208 | |||
209 | <p> | ||
210 | Even though OpenSSH is developed on | ||
211 | <a href="http://www.openbsd.org/">OpenBSD</a> a wide variety of | ||
212 | ports to other operating systems exist. The portable version of OpenSSH | ||
213 | is headed by <a href="mailto:djm@openbsd.org">Damien Miller</a>. | ||
214 | For a quick overview of the portable version of OpenSSH see | ||
215 | <a href="http://www.openssh.com/portable.html">OpenSSH Portable Release</a>. | ||
216 | Currently, the supported operating systems are: | ||
217 | |||
218 | |||
219 | <ul> | ||
220 | <li>OpenBSD | ||
221 | <li>NetBSD | ||
222 | <li>FreeBSD | ||
223 | <li>AIX | ||
224 | <li>HP-UX | ||
225 | <li>IRIX | ||
226 | <li>Linux | ||
227 | <li>NeXT | ||
228 | <li>SCO | ||
229 | <li>SNI/Reliant Unix | ||
230 | <li>Solaris | ||
231 | <li>Digital Unix/Tru64/OSF | ||
232 | <li>Mac OS X | ||
233 | <li>Cygwin | ||
234 | </ul> | ||
235 | |||
236 | <p> | ||
237 | A list of vendors that include OpenSSH in their distributions | ||
238 | is located in the <a href="http://www.openssh.com/users.html">OpenSSH Users page</a>. | ||
239 | |||
240 | <h2><a name= "1.4">1.4 - What about copyrights, usage and patents?</a></h2> | ||
241 | <p> | ||
242 | The OpenSSH developers have tried very hard to keep OpenSSH free of any | ||
243 | patent or copyright problems. To do this, some options had to be | ||
244 | stripped from OpenSSH. Namely support for patented algorithms. | ||
245 | |||
246 | <p> | ||
247 | OpenSSH does not support any patented transport algorithms. In SSH1 mode, | ||
248 | only 3DES and Blowfish are available options. In SSH2 mode, only 3DES, | ||
249 | Blowfish, CAST128, Arcfour and AES can be selected. | ||
250 | The patented IDEA algorithm is not supported. | ||
251 | |||
252 | <p> | ||
253 | OpenSSH provides support for both SSH1 and SSH2 protocols. | ||
254 | |||
255 | <p> | ||
256 | Since the RSA patent has expired, there are no restrictions on the use | ||
257 | of RSA algorithm using software, including OpenBSD. | ||
258 | |||
259 | <h2><a name= "1.5">1.5 - Where should I ask for help?</a></h2> | ||
260 | <p> | ||
261 | There are many places to turn to for help. In addition to the main | ||
262 | <a href="http://www.openssh.com/index.html">OpenSSH website</a>, | ||
263 | there are many mailing lists to try. Before trying any mailing lists, | ||
264 | please search through all mailing list archives to see if your question | ||
265 | has already been answered. The OpenSSH Mailing List has been archived and | ||
266 | put in searchable form and can be found at | ||
267 | <a href="http://marc.info/?l=openssh-unix-dev&r=1&w=2">marc.info</a>. | ||
268 | |||
269 | <p> | ||
270 | For more information on subscribing to OpenSSH related mailing lists, | ||
271 | please see <a href="http://www.openssh.com/list.html">OpenSSH Mailing lists</a>. | ||
272 | |||
273 | <h2><a name= "1.6">1.6 - I have found a bug. Where do I report it?</a></h2> | ||
274 | <p> | ||
275 | Information about submitting bug reports can be found at the OpenSSH | ||
276 | <a href="http://www.openssh.com/report.html">Reporting bugs</a> page. | ||
277 | <p> | ||
278 | If you wish to report a security bug, please contact the private developers | ||
279 | list <<a href="mailto:openssh@openssh.com">openssh@openssh.com</a>>. | ||
280 | |||
281 | <h2><u><a name= "2.0">2.0 - General Questions</a></u></h2> | ||
282 | |||
283 | <h2><a name= "2.1">2.1 - Why does ssh/scp make connections from low-numbered ports.</a></h2> | ||
284 | <p> | ||
285 | The OpenSSH client uses low numbered ports for rhosts and rhosts-rsa | ||
286 | authentication because the server needs to trust the username provided by | ||
287 | the client. To get around this, you can add the below example to your | ||
288 | <i>ssh_config</i> or <i>~/.ssh/config</i> file. | ||
289 | |||
290 | |||
291 | <blockquote> | ||
292 | <table border=0 width="800"> | ||
293 | <tr> | ||
294 | <td nowrap bgcolor="#EEEEEE"> | ||
295 | <b>UsePrivilegedPort no</b> | ||
296 | </td> | ||
297 | </tr> | ||
298 | </table> | ||
299 | </blockquote> | ||
300 | |||
301 | <p> | ||
302 | Or you can specify this option on the command line, using the <b>-o</b> | ||
303 | option to | ||
304 | <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh&sektion=1">ssh(1)</a> command. | ||
305 | |||
306 | <blockquote> | ||
307 | <table border=0 width="800"> | ||
308 | <tr> | ||
309 | <td nowrap bgcolor="#EEEEEE"> | ||
310 | $ <b>ssh -o "UsePrivilegedPort no" host.com</b> | ||
311 | </td> | ||
312 | </tr> | ||
313 | </table> | ||
314 | </blockquote> | ||
315 | |||
316 | <h2><a name= "2.2">2.2 - Why is the ssh client setuid root?</a></h2> | ||
317 | |||
318 | <p> | ||
319 | In conjunction with the previous question, (<a href="#2.1">2.1</a>) | ||
320 | OpenSSH needs root authority to be able to bind to low-numbered ports to | ||
321 | facilitate <i>rhosts authentication</i>. | ||
322 | A privileged port is also required for rhosts-rsa authentication to older | ||
323 | SSH releases. | ||
324 | |||
325 | <p> | ||
326 | Additionally, for both <i>rhosts-rsa authentication</i> (in protocol | ||
327 | version 1) and <i>hostbased authentication</i> (in protocol version 2) | ||
328 | the ssh client needs to access the <i>private host key</i> in order to | ||
329 | authenticate the client machine to the server. | ||
330 | OpenSSH versions prior to 3.3 required the <code>ssh</code> binary to be | ||
331 | setuid root to enable this, and you may safely remove it if you don't | ||
332 | want to use these authentication methods. | ||
333 | |||
334 | <p> | ||
335 | Starting in OpenSSH 3.3, <code>ssh</code> is not setuid by default. <a | ||
336 | href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh-keysign">ssh-keysign</a>, | ||
337 | is used for access to the private hosts keys, and ssh does not use privileged | ||
338 | source ports by default. If you wish to use a privileged source port, you must | ||
339 | manually set the setuid bit on <code>ssh</code>. | ||
340 | |||
341 | <h2><a name= "2.3">2.3 - Why does SSH 2.3 have problems interoperating with OpenSSH 2.1.1?</a></h2> | ||
342 | |||
343 | <p> | ||
344 | SSH 2.3 and earlier versions contain a flaw in their HMAC implementation. | ||
345 | Their code was not supplying the full data block output from the digest, | ||
346 | and instead always provided 128 bits. For longer digests, this caused | ||
347 | SSH 2.3 to not interoperate with OpenSSH. | ||
348 | |||
349 | <p> | ||
350 | OpenSSH 2.2.0 detects that SSH 2.3 has this flaw. Recent versions of SSH | ||
351 | will have this bug fixed. Or you can add the following to | ||
352 | SSH 2.3 <i>sshd2_config</i>. | ||
353 | |||
354 | |||
355 | <blockquote> | ||
356 | <table border=0 width="800"> | ||
357 | <tr> | ||
358 | <td nowrap bgcolor="#EEEEEE"> | ||
359 | <b>Mac hmac-md5</b> | ||
360 | </td> | ||
361 | </tr> | ||
362 | </table> | ||
363 | </blockquote> | ||
364 | |||
365 | <h2><a name= "2.4">2.4 - Why does OpenSSH print: Dispatch protocol error: type 20</a></h2> | ||
366 | |||
367 | <p> | ||
368 | Problems in interoperation have been seen because older versions of | ||
369 | OpenSSH did not support session rekeying. However the commercial SSH 2.3 | ||
370 | tries to negotiate this feature, and you might experience connection | ||
371 | freezes or see the error message "<b>Dispatch protocol error: | ||
372 | type 20 </b>". | ||
373 | To solve this problem, either upgrade to a recent OpenSSH release or | ||
374 | disable rekeying by adding the following to your commercial SSH 2.3's | ||
375 | <i>ssh2_config</i> or <i>sshd2_config</i>. | ||
376 | |||
377 | |||
378 | <blockquote> | ||
379 | <table border=0 width="800"> | ||
380 | <tr> | ||
381 | <td nowrap bgcolor="#EEEEEE"> | ||
382 | <b>RekeyIntervalSeconds 0</b> | ||
383 | </td> | ||
384 | </tr> | ||
385 | </table> | ||
386 | </blockquote> | ||
387 | |||
388 | <h2><a name= "2.5">2.5 - Old versions of commercial SSH encrypt host keys with IDEA.</a></h2> | ||
389 | |||
390 | <p> | ||
391 | The old versions of SSH used a patented algorithm to encrypt their | ||
392 | <i>/etc/ssh/ssh_host_key</i>. This problem will manifest as | ||
393 | <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sshd&sektion=8">sshd(8)</a> | ||
394 | not being able to read its host key. To solve this, use the command below | ||
395 | to convert your ssh_host_key to use 3DES. | ||
396 | <b>NOTE:</b> Use the | ||
397 | <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh-keygen&sektion=1">ssh-keygen(1)</a> | ||
398 | program from the Commercial SSH product, *NOT* OpenSSH for the example | ||
399 | below. | ||
400 | |||
401 | |||
402 | <blockquote> | ||
403 | <table border=0 width="800"> | ||
404 | <tr> | ||
405 | <td nowrap bgcolor="#EEEEEE"> | ||
406 | # <b>ssh-keygen -u -f /etc/ssh/ssh_host_key</b> | ||
407 | </td> | ||
408 | </tr> | ||
409 | </table> | ||
410 | </blockquote> | ||
411 | |||
412 | <h2><a name= "2.6">2.6 - What are these warning messages about key lengths</a></h2> | ||
413 | |||
414 | <p> | ||
415 | Commercial SSH's | ||
416 | <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh-keygen&sektion=1">ssh-keygen(1)</a> | ||
417 | program contained a bug which caused it to occasionally generate Pubkey | ||
418 | Authentication (RSA or DSA) keys which had their Most Significant Bit | ||
419 | (MSB) unset. Such keys were advertised as being full-length, but are | ||
420 | actually, half the time, smaller than advertised. | ||
421 | |||
422 | <p> | ||
423 | OpenSSH will print warning messages when it encounters such keys. To rid | ||
424 | yourself of these message, edit your <i>known_hosts</i> files and replace the | ||
425 | incorrect key length (usually "1024") with the correct key length | ||
426 | (usually "1023"). | ||
427 | |||
428 | <h2><a name= "2.7">2.7 - X11 and/or agent forwarding does not work.</a></h2> | ||
429 | |||
430 | <p> | ||
431 | Check your <i>ssh_config</i> and <i>sshd_config</i>. The default | ||
432 | configuration files disable authentication agent and X11 forwarding. To | ||
433 | enable it, put the line below in <i>sshd_config</i>: | ||
434 | |||
435 | <blockquote> | ||
436 | <table border=0 width="800"> | ||
437 | <tr> | ||
438 | <td nowrap bgcolor="#EEEEEE"> | ||
439 | <b>X11Forwarding yes</b> | ||
440 | </td> | ||
441 | </tr> | ||
442 | </table> | ||
443 | </blockquote> | ||
444 | |||
445 | <p> | ||
446 | and put the following lines in <i>ssh_config</i>: | ||
447 | |||
448 | <blockquote> | ||
449 | <table border=0 width="800"> | ||
450 | <tr> | ||
451 | <td nowrap bgcolor="#EEEEEE"> | ||
452 | <b>ForwardAgent yes</b><br> | ||
453 | <b>ForwardX11 yes</b> | ||
454 | </td> | ||
455 | </tr> | ||
456 | </table> | ||
457 | </blockquote> | ||
458 | |||
459 | <p> | ||
460 | X11 forwarding requires a working <a | ||
461 | href="http://www.openbsd.org/cgi-bin/man.cgi?query=xauth&sektion=1" | ||
462 | >xauth(1)</a> binary. On OpenBSD this is in the <i>xbase</i> file | ||
463 | set but will probably be different on other platforms. For OpenSSH | ||
464 | Portable, xauth must be either found at configure time or specified | ||
465 | via <b>XAuthLocation</b> in sshd_config(5) and ssh_config(5). | ||
466 | |||
467 | <p> | ||
468 | Note on agent interoperability: There are two different and | ||
469 | incompatible agent forwarding mechanisms within the SSH2 protocol. | ||
470 | OpenSSH has always used an extension of the original SSH1 agent | ||
471 | requests, however some commercial products use a different, non-free | ||
472 | agent forwarding protocol. This means that agent forwarding cannot | ||
473 | be used between OpenSSH and those products. | ||
474 | |||
475 | <p> | ||
476 | <b>NOTE:</b> For users of Linux Mandrake 7.2, Mandrake modifies the | ||
477 | <i>XAUTHORITY</i> environment variable in <i>/etc/skel/.bashrc</i>, | ||
478 | and thus any bash user's home directory. This variable is set by OpenSSH | ||
479 | and for either of the above options to work, you need to comment out | ||
480 | the line: | ||
481 | |||
482 | |||
483 | <blockquote> | ||
484 | <table border=0 width="800"> | ||
485 | <tr> | ||
486 | <td nowrap bgcolor="#EEEEEE"> | ||
487 | <b># export XAUTHORITY=$HOME/.Xauthority</b> | ||
488 | </td> | ||
489 | </tr> | ||
490 | </table> | ||
491 | </blockquote> | ||
492 | |||
493 | <h2><a name= "2.8">2.8 - After upgrading OpenSSH I lost SSH2 support.</a></h2> | ||
494 | |||
495 | <p> | ||
496 | Between versions changes can be made to <i>sshd_config</i> or | ||
497 | <i>ssh_config</i>. You should always check on these changes when upgrading | ||
498 | versions of OpenSSH. After OpenSSH Version 2.3.0 you need to add the | ||
499 | following to your <i>sshd_config</i>: | ||
500 | |||
501 | |||
502 | <blockquote> | ||
503 | <table border=0 width="800"> | ||
504 | <tr> | ||
505 | <td nowrap bgcolor="#EEEEEE"> | ||
506 | <b>HostKey /etc/ssh_host_dsa_key</b><br> | ||
507 | <b>HostKey /etc/ssh_host_rsa_key</b> | ||
508 | </td> | ||
509 | </tr> | ||
510 | </table> | ||
511 | </blockquote> | ||
512 | |||
513 | <h2><a name= "2.9">2.9 - sftp/scp fails at connection, but ssh is OK.</a></h2> | ||
514 | |||
515 | <p> | ||
516 | sftp and/or scp may fail at connection time if you have shell | ||
517 | initialization (.profile, .bashrc, .cshrc, etc) which produces output | ||
518 | for non-interactive sessions. This output confuses the sftp/scp client. | ||
519 | You can verify if your shell is doing this by executing: | ||
520 | |||
521 | <blockquote> | ||
522 | <table border=0 width="800"> | ||
523 | <tr> | ||
524 | <td nowrap bgcolor="#EEEEEE"> | ||
525 | <b>ssh yourhost /usr/bin/true</b> | ||
526 | </td> | ||
527 | </tr> | ||
528 | </table> | ||
529 | </blockquote> | ||
530 | |||
531 | <p> | ||
532 | If the above command produces any output, then you need to modify your | ||
533 | shell initialization. | ||
534 | |||
535 | <h2><a name= "2.10">2.10 - Will you add [foo] to scp?</a></h2> | ||
536 | |||
537 | <p> | ||
538 | Short Answer: no. | ||
539 | |||
540 | <p> | ||
541 | Long Answer: scp is not standardized. The closest thing it has to a | ||
542 | specification is "what rcp does". Since the same command is used on both ends | ||
543 | of the connection, adding features or options risks breaking interoperability with other | ||
544 | implementations. | ||
545 | |||
546 | <p> | ||
547 | New features are more likely in sftp, since the protocol is standardized | ||
548 | (well, a <a href="http://www.ietf.org/html.charters/OLD/secsh-charter.html"> | ||
549 | draft standard</a>), extensible, and the client and server are decoupled. | ||
550 | |||
551 | <h2><a name= "2.11">2.11 - How do I use port forwarding?</a></h2> | ||
552 | |||
553 | <p> | ||
554 | If the remote server is running sshd(8), it may be possible to | ||
555 | ``tunnel'' certain services via ssh. This may be desirable, for | ||
556 | example, to encrypt POP or SMTP connections, even though the software | ||
557 | does not directly support encrypted communications. Tunnelling uses | ||
558 | port forwarding to create a connection between the client and server. | ||
559 | The client software must be able to specify a non-standard port to | ||
560 | connect to for this to work. | ||
561 | |||
562 | <p> | ||
563 | The idea is that the user connects to the remote host using ssh, | ||
564 | and specifies which port on the client's machine should be used to | ||
565 | forward connections to the remote server. After that it is possible | ||
566 | to start the service which is to be encrypted (e.g. fetchmail, irc) | ||
567 | on the client machine, specifying the same local port passed to | ||
568 | ssh, and the connection will be tunnelled through ssh. By default, | ||
569 | the system running the forward will only accept connections from | ||
570 | itself. | ||
571 | |||
572 | <p> | ||
573 | The options most relevant to tunnelling are the -L and -R options, | ||
574 | which allow the user to forward connections, the -D option, which | ||
575 | permits dynamic port forwarding, the -g option, which permits other | ||
576 | hosts to use port forwards, and the -f option, which instructs ssh | ||
577 | to put itself in the background after authentication. See the <a | ||
578 | href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh&sektion=1" | ||
579 | >ssh(1)</a> man page for further details. | ||
580 | |||
581 | <p> | ||
582 | This is an example of tunnelling an IRC session from client machine | ||
583 | ``127.0.0.1'' (localhost) to remote server ``server.example.com'': | ||
584 | |||
585 | <blockquote> | ||
586 | <table border=0 width="800"> | ||
587 | <tr> | ||
588 | <td nowrap bgcolor="#EEEEEE"> | ||
589 | <b>ssh -f -L 1234:server.example.com:6667 server.example.com sleep 10<br> | ||
590 | irc -c '#users' -p 1234 pinky 127.0.0.1</b> | ||
591 | </td> | ||
592 | </tr> | ||
593 | </table> | ||
594 | </blockquote> | ||
595 | |||
596 | <p> | ||
597 | This tunnels a connection to IRC server server.example.com, joining | ||
598 | channel ``#users'', using the nickname ``pinky''. The local port used | ||
599 | in this example is 1234. It does not matter which port is used, as | ||
600 | long as it's greater than 1023 (remember, only root can open sockets on | ||
601 | privileged ports) and doesn't conflict with any ports already in use. | ||
602 | The connection is forwarded to port 6667 on the remote server, since | ||
603 | that's the standard port for IRC services. | ||
604 | |||
605 | <p> | ||
606 | The remote command ``sleep 10'' was specified to allow an amount | ||
607 | of time (10 seconds, in the example) to start the service which is to | ||
608 | be tunnelled. If no connections are made within the time specified, | ||
609 | ssh will exit. If more time is required, the sleep(1) value can be | ||
610 | increased appropriately or, alternatively, the example above could | ||
611 | be added as a function to the user's shell. See ksh(1) and csh(1) | ||
612 | for more details about user-defined functions. | ||
613 | |||
614 | <p> | ||
615 | ssh also has an -N option, convenient for use with port forwarding: | ||
616 | if -N is specified, it is not necessary to specify a remote command | ||
617 | (``sleep 10'' in the example above). However, use of this option | ||
618 | causes ssh to wait around for ever (as opposed to exiting after a | ||
619 | remote command has completed), and the user must take care to manually | ||
620 | kill(1) the process afterwards. | ||
621 | |||
622 | <h2><a name= "2.12">2.12 - My ssh connection freezes or drops out after N minutes of inactivity.</a></h2> | ||
623 | |||
624 | <p> | ||
625 | This is usually the result of a packet filter or NAT device | ||
626 | timing out your TCP connection due to inactivity. You can enable | ||
627 | <b>ClientAliveInterval</b> in the server's <i><a | ||
628 | href="http://www.openbsd.org/cgi-bin/man.cgi?query=sshd_config&sektion=5"> | ||
629 | sshd_config</a></i>, or enable <b>ServerAliveInterval</b> in the | ||
630 | client's <i><a | ||
631 | href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh_config&sektion=5"> | ||
632 | ssh_config</a></i> (the latter is available in OpenSSH 3.8 and newer). | ||
633 | |||
634 | <p> | ||
635 | Enabling either option and setting the interval for less than the time | ||
636 | it takes to time out your session will ensure that the connection is | ||
637 | kept "fresh" in the device's connection table. | ||
638 | |||
639 | <h2><a name= "2.13">2.13 - How do I use scp to copy a file with a colon in it?</a></h2> | ||
640 | |||
641 | <b><a | ||
642 | href="http://www.openbsd.org/cgi-bin/man.cgi?query=scp&sektion=1"> | ||
643 | scp</a></b> will interpret the component before the colon to be a remote | ||
644 | server name and attempt to connect to it. To prevent this, refer to | ||
645 | the file by a relative or absolute path, eg: | ||
646 | |||
647 | <blockquote> | ||
648 | <table border=0 width="800"> | ||
649 | <tr> | ||
650 | <td nowrap bgcolor="#EEEEEE"> | ||
651 | $ scp ./source:file sshserver: | ||
652 | </td> | ||
653 | </tr> | ||
654 | </table> | ||
655 | </blockquote> | ||
656 | |||
657 | <h2><a name= "2.14">2.14 - Why does OpenSSH report its version to clients?</a></h2> | ||
658 | |||
659 | <p> | ||
660 | OpenSSH, like most SSH implementations, reports its name and version to clients | ||
661 | when they connect, e.g. | ||
662 | </p> | ||
663 | |||
664 | <blockquote> | ||
665 | SSH-2.0-OpenSSH_3.9 | ||
666 | </blockquote> | ||
667 | |||
668 | <p> | ||
669 | This information is used by clients and servers to enable protocol | ||
670 | compatibility tweaks to work around changed, buggy or missing features in | ||
671 | the implementation they are talking to. This protocol feature checking is | ||
672 | still required at present because versions with incompatibilities are still | ||
673 | in wide use. | ||
674 | </p> | ||
675 | |||
676 | <h2><u><a name= "3.0">3.0 - Portable OpenSSH Questions</a></u></h2> | ||
677 | |||
678 | <h2><a name= "3.1">3.1 - Spurious PAM authentication messages in logfiles.</a></h2> | ||
679 | |||
680 | <p> | ||
681 | The portable version of OpenSSH will generate spurious authentication | ||
682 | failures at every login, similar to: | ||
683 | |||
684 | |||
685 | <blockquote> | ||
686 | <table border=0 width="800"> | ||
687 | <tr> | ||
688 | <td nowrap bgcolor="#EEEEEE"> | ||
689 | "<b>authentication failure; (uid=0) -> root for sshd service</b>" | ||
690 | </td> | ||
691 | </tr> | ||
692 | </table> | ||
693 | </blockquote> | ||
694 | |||
695 | <p> | ||
696 | These are generated because OpenSSH first tries to determine whether a | ||
697 | user needs authentication to login (e.g. empty password). Unfortunately | ||
698 | PAM likes to log all authentication events, this one included. | ||
699 | |||
700 | <p> | ||
701 | If it annoys you too much, set "<b>PermitEmptyPasswords no</b>" | ||
702 | in <i>sshd_config</i>. This will quiet the error message at the expense | ||
703 | of disabling logins to accounts with no password set. | ||
704 | This is the default if you use the supplied <i>sshd_config</i> file. | ||
705 | |||
706 | <h2><a name= "3.2">3.2 - Empty passwords not allowed with PAM authentication.</a></h2> | ||
707 | |||
708 | <p> | ||
709 | To enable empty passwords with a version of OpenSSH built with PAM you | ||
710 | must add the flag nullok to the end of the password checking module | ||
711 | in the <i>/etc/pam.d/sshd</i> file. For example: | ||
712 | |||
713 | <blockquote> | ||
714 | <table border=0 width="800"> | ||
715 | <tr> | ||
716 | <td nowrap bgcolor="#EEEEEE"> | ||
717 | auth required/lib/security/pam_unix.so shadow nodelay nullok | ||
718 | </td> | ||
719 | </tr> | ||
720 | </table> | ||
721 | </blockquote> | ||
722 | |||
723 | <p> | ||
724 | This must be done in addition to setting "<b>PermitEmptyPasswords | ||
725 | yes</b>" in the <i>sshd_config</i> file. | ||
726 | |||
727 | <p> | ||
728 | There is one caveat when using empty passwords with PAM authentication: | ||
729 | PAM will allow any password when authenticating an account with an empty | ||
730 | password. This breaks the check that | ||
731 | <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sshd&sektion=8">sshd(8)</a> | ||
732 | uses to determine whether an account has no password set and grant | ||
733 | users access to the account regardless of the policy specified by | ||
734 | <b>PermitEmptyPasswords</b>. For this reason, it is recommended that you | ||
735 | do not add the <b>nullok</b> directive to your PAM configuration file | ||
736 | unless you specifically wish to allow empty passwords. | ||
737 | |||
738 | |||
739 | <h2><a name= "3.3">3.3 - ssh(1) takes a long time to connect or log | ||
740 | in</a></h2> | ||
741 | |||
742 | <p> | ||
743 | Large delays (more than 10 seconds) are typically caused by a problem with | ||
744 | name resolution: | ||
745 | <ul> | ||
746 | <li>Some versions of glibc (notably glibc 2.1 shipped with Red Hat 6.1) | ||
747 | can take a long time to resolve "IPv6 or IPv4" addresses from domain | ||
748 | names. This can be worked around with by specifying <b>AddressFamily | ||
749 | inet</b> option in <i>ssh_config</i>.</li> | ||
750 | |||
751 | <li>There may be a DNS lookup problem, either at the client or server. | ||
752 | You can use the <code>nslookup</code> command to check this on both client | ||
753 | and server by looking up the other end's name and IP address. In | ||
754 | addition, on the server look up the name returned by the client's | ||
755 | IP-name lookup. You can disable most of the server-side lookups by | ||
756 | setting <b>UseDNS no</b> in <i>sshd_config</i>.</li> | ||
757 | </ul> | ||
758 | |||
759 | <p> | ||
760 | Delays less than 10 seconds can have other causes. | ||
761 | |||
762 | <ul> | ||
763 | |||
764 | <li>OpenSSH releases prior to 3.8 had an <i>moduli</i> file with | ||
765 | moduli that were just smaller than what sshd would look for, and | ||
766 | as a result, sshd would end up using moduli significantly larger | ||
767 | than requested, which resulted in a speed penalty. Replacing the | ||
768 | <i>moduli</i> file will resolve this (note that in most cases this | ||
769 | file will not be replaced during an upgrade and must be replaced | ||
770 | manually).</li> | ||
771 | |||
772 | <li>OpenSSH releases prior to 3.8 had a flaw in <code>ssh</code> that | ||
773 | would cause it to request moduli larger than intended (which when | ||
774 | combined with the above resulted in significant slowdowns). | ||
775 | Upgrading the client to 3.8 or higher will resolve this issue.</li> | ||
776 | |||
777 | <li>If either the client or server lack a kernel-based random number | ||
778 | device (eg Solaris < 9, AIX < 5.2, HP-UX < 11.11) and no | ||
779 | substitute is available (eg <a href= | ||
780 | "ftp://ftp.ayamura.org/pub/prngd/">prngd</a>) it's possible that | ||
781 | one of the programs called by <code>ssh-rand-helper</code> to | ||
782 | generate entropy is hanging. This can be investigated by running | ||
783 | it in debug mode: | ||
784 | |||
785 | <blockquote> | ||
786 | <table border=0 width="800"> | ||
787 | <tr> | ||
788 | <td nowrap bgcolor="#EEEEEE"> | ||
789 | /usr/local/libexec/ssh-rand-helper -vvv | ||
790 | </td> | ||
791 | </tr> | ||
792 | </table> | ||
793 | </blockquote> | ||
794 | |||
795 | Any significant delays should be investigated and rectified, or the | ||
796 | corresponding commands should be removed from <i>ssh_prng_cmds</i>. | ||
797 | </li> | ||
798 | |||
799 | </ul> | ||
800 | |||
801 | <h3>How slow is "slow"?</h3> | ||
802 | Under normal conditions, the speed of SSH logins is dependant on | ||
803 | CPU speed of client and server. For comparison the following are | ||
804 | typical connect times for <code>time ssh localhost true</code> | ||
805 | with a 1024-bit RSA key on otherwise unloaded hosts. OpenSSH and | ||
806 | OpenSSL were compiled with gcc 3.3.x. | ||
807 | |||
808 | <p> | ||
809 | <table> | ||
810 | <tr><th>CPU</th><th>Time (SSHv1)<a href="#3.3fn1">[1]</a></th> | ||
811 | <th>Time (SSHv2)</th></tr> | ||
812 | <tr><td>170MHz SPARC/sun4m</td><td>0.74 sec</td><td>1.25 sec</td></tr> | ||
813 | <tr><td>236MHz HPPA/8200<a href="#3.3fn2">[2]</a></td><td>0.44 sec</td> | ||
814 | <td>0.79 sec</td></tr> | ||
815 | <tr><td>375MHz PowerPC/604e</td><td>0.38 sec</td><td>0.51 sec</td></tr> | ||
816 | <tr><td>933MHz VIA Ezra</td><td>0.34 sec</td><td>0.44 sec</td></tr> | ||
817 | <tr><td>2.1GHz Athlon XP 2600+</td><td>0.14 sec</td><td>0.22 sec</td></tr> | ||
818 | </table> | ||
819 | |||
820 | <br> | ||
821 | |||
822 | <a name="3.3fn1">[1]</a> The SSHv1 protocol is faster but is | ||
823 | cryptographically weaker than SSHv2.<br> | ||
824 | |||
825 | <a name="3.3fn2">[2]</a> At the time of writing, gcc generates | ||
826 | relatively slow code on HPPA for RSA and Diffie-Hellman operations | ||
827 | (see <a href= "http://gcc.gnu.org/bugzilla/show_bug.cgi?id=7625">gcc | ||
828 | bug #7625</a> and <a | ||
829 | href="http://marc.info/?l=openssh-unix-dev&m=102646106016694"> | ||
830 | discussion on openssh-unix-dev</a>). | ||
831 | |||
832 | <h2><a name= "3.4">3.4 - "Can't locate module net-pf-10" messages in log under Linux.</a></h2> | ||
833 | |||
834 | <p> | ||
835 | The Linux kernel is looking (via modprobe) for protocol family 10 (IPv6). | ||
836 | Either load the appropriate kernel module, enter the correct alias in | ||
837 | <i>/etc/modules.conf</i> or disable IPv6 in <i>/etc/modules.conf</i>. | ||
838 | |||
839 | |||
840 | <p> | ||
841 | For some silly reason <i>/etc/modules.conf</i> may also be named | ||
842 | <i>/etc/conf.modules</i>. | ||
843 | |||
844 | |||
845 | <h2><a name= "3.5">3.5 - Password authentication doesn't work (eg on Slackware 7.0 or Red Hat 6.x)</a></h2> | ||
846 | |||
847 | <p> | ||
848 | If the password is correct password the login is still denied, the | ||
849 | usual cause is that the system is configured to use MD5-type passwords | ||
850 | but the | ||
851 | <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=crypt&sektion=3" | ||
852 | >crypt(3)</a> function used by sshd doesn't understand them. | ||
853 | |||
854 | <p> | ||
855 | Affected accounts will have password strings in <i>/etc/passwd</i> | ||
856 | or <i>/etc/shadow</i> that start with <b>$1$</b>. | ||
857 | If password authentication fails for new accounts or accounts with | ||
858 | recently changed passwords, but works for old accounts, this is the | ||
859 | likely culprit. | ||
860 | |||
861 | <p> | ||
862 | The underlying cause is that some versions of OpenSSL have a crypt(3) | ||
863 | function that does not understand MD5 passwords, and the link order of | ||
864 | sshd means that OpenSSL's crypt(3) is used instead of the system's. | ||
865 | OpensSSH's configure attempts to correct for this but is not always | ||
866 | successful. | ||
867 | |||
868 | <p> | ||
869 | There are several possible solutions: | ||
870 | |||
871 | <ul> | ||
872 | <li> | ||
873 | <p> | ||
874 | Enable sshd's built-in support for MD5 passwords at build time. | ||
875 | |||
876 | <blockquote> | ||
877 | <table border=0 width="800"> | ||
878 | <tr> | ||
879 | <td nowrap bgcolor="#EEEEEE"> | ||
880 | ./configure --with-md5-passwords [options] | ||
881 | </td> | ||
882 | </tr> | ||
883 | </table> | ||
884 | </blockquote> | ||
885 | |||
886 | This is safe even if you have both types of encryption as sshd will | ||
887 | select the correct algorithm for each account automatically. | ||
888 | |||
889 | <li> | ||
890 | <p> | ||
891 | If your system has a separate libcrypt library (eg Slackware 7) then you | ||
892 | can manually add -lcrypt to the LIBS list so it's used instead of | ||
893 | OpenSSL's: | ||
894 | |||
895 | <blockquote> | ||
896 | <table border=0 width="800"> | ||
897 | <tr> | ||
898 | <td nowrap bgcolor="#EEEEEE"> | ||
899 | LIBS=-lcrypt ./configure [options] | ||
900 | </td> | ||
901 | </tr> | ||
902 | </table> | ||
903 | </blockquote> | ||
904 | |||
905 | <li> | ||
906 | <p> | ||
907 | If your platforms supports PAM, you may configure sshd to use it | ||
908 | (see <a href= "#3.15" >section 3.15</a>). This will mean that sshd will | ||
909 | not verify passwords itself but will defer to the configured PAM modules. | ||
910 | </ul> | ||
911 | |||
912 | <h2><a name= "3.6">3.6 - Configure or sshd(8) complain about lack of RSA or DSA support</a></h2> | ||
913 | |||
914 | <p> | ||
915 | Ensure that your OpenSSL libraries have been built to include RSA or DSA | ||
916 | support either internally or through RSAref. | ||
917 | |||
918 | |||
919 | <h2><a name= "3.7">3.7 - "scp: command not found" errors</a></h2> | ||
920 | |||
921 | <p> | ||
922 | <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=scp&sektion=1">scp(1)</a> | ||
923 | must be in the default PATH on both the client and the server. You may | ||
924 | need to use the <b>--with-default-path</b> option to specify a custom | ||
925 | path to search on the server. This option replaces the default path, | ||
926 | so you need to specify all the current directories on your path as well | ||
927 | as where you have installed scp. For example: | ||
928 | |||
929 | <blockquote> | ||
930 | <table border=0 width="800"> | ||
931 | <tr> | ||
932 | <td nowrap bgcolor="#EEEEEE"> | ||
933 | $ <b>./configure --with-default-path=/bin:/usr/bin:/usr/local/bin:/path/to/scp</b> | ||
934 | </td> | ||
935 | </tr> | ||
936 | </table> | ||
937 | </blockquote> | ||
938 | |||
939 | <p> | ||
940 | Note that configuration by the server's admin will take precedence over the | ||
941 | setting of <b>--with-default-path</b>. This includes resetting PATH in | ||
942 | <i>/etc/profile</i>, PATH in <i>/etc/environment</i> on AIX, or (for 3.7p1 and | ||
943 | above) setting PATH or SUPATH in <i>/etc/default/login</i> on Solaris or | ||
944 | Reliant Unix. | ||
945 | |||
946 | <h2><a name= "3.8">3.8 - Unable to read passphrase</a></h2> | ||
947 | |||
948 | <p> | ||
949 | Some operating systems set <i>/dev/tty</i> with incorrect modes, causing | ||
950 | the reading of passwords to fail with the following error: | ||
951 | |||
952 | <blockquote> | ||
953 | <table border=0 width="800"> | ||
954 | <tr> | ||
955 | <td nowrap bgcolor="#EEEEEE"> | ||
956 | You have no controlling tty. Cannot read passphrase. | ||
957 | </td> | ||
958 | </tr> | ||
959 | </table> | ||
960 | </blockquote> | ||
961 | |||
962 | <p> | ||
963 | The solution to this is to reset the permissions on <i>/dev/tty</i> | ||
964 | to mode 0666 and report the error as a bug to your OS vendor. | ||
965 | |||
966 | |||
967 | <h2><a name= "3.9">3.9 - 'configure' missing or make fails</a></h2> | ||
968 | |||
969 | <p> | ||
970 | If there is no 'configure' file in the tar.gz file that you downloaded | ||
971 | or make fails with "missing separator" errors, you have probably | ||
972 | downloaded the OpenBSD distribution of OpenSSH and are attempting to | ||
973 | compile it on another platform. Please refer to the information on the | ||
974 | <a href="http://www.openssh.com/portable.html">portable version</a>. | ||
975 | |||
976 | |||
977 | <h2><a name= "3.10">3.10 - Hangs when exiting ssh</a></h2> | ||
978 | |||
979 | <p> | ||
980 | OpenSSH may hang when exiting. This can occur when there is an active | ||
981 | background process. This is known to occur on Linux and HP-UX. | ||
982 | The problem can be verified by doing the following: | ||
983 | |||
984 | <blockquote> | ||
985 | <table border=0 width="800"> | ||
986 | <tr> | ||
987 | <td nowrap bgcolor="#EEEEEE"> | ||
988 | $ <b>sleep 20 & exit</b> | ||
989 | </td> | ||
990 | </tr> | ||
991 | </table> | ||
992 | </blockquote> | ||
993 | |||
994 | Try to use this instead: | ||
995 | <blockquote> | ||
996 | <table border=0 width="800"> | ||
997 | <tr> | ||
998 | <td nowrap bgcolor="#EEEEEE"> | ||
999 | $ <b>sleep 20 < /dev/null > /dev/null 2>&1 &</b> | ||
1000 | </td> | ||
1001 | </tr> | ||
1002 | </table> | ||
1003 | </blockquote> | ||
1004 | |||
1005 | <p> | ||
1006 | A work around for bash users is to place <b>"shopt -s huponexit"</b> | ||
1007 | in either /etc/bashrc or ~/.bashrc. Otherwise, consult your shell's | ||
1008 | man page for an option to enable it to send a HUP signal to active | ||
1009 | jobs when exiting. See <a | ||
1010 | href="http://bugzilla.mindrot.org/show_bug.cgi?id=52">bug #52</a> | ||
1011 | for other workarounds. | ||
1012 | |||
1013 | <h2><a name= "3.11">3.11 - Why does ssh hang on exit?</a></h2> | ||
1014 | |||
1015 | <p> | ||
1016 | When executing | ||
1017 | <blockquote> | ||
1018 | <table border=0 width="800"> | ||
1019 | <tr> | ||
1020 | <td nowrap bgcolor="#EEEEEE"> | ||
1021 | $ <b>ssh host command</b> | ||
1022 | </td> | ||
1023 | </tr> | ||
1024 | </table> | ||
1025 | </blockquote> | ||
1026 | ssh <b>needs</b> to hang, because it needs to wait: | ||
1027 | <ul> | ||
1028 | <li> | ||
1029 | until it can be sure that <code>command</code> does not need | ||
1030 | more input. | ||
1031 | <li> | ||
1032 | until it can be sure that <code>command</code> does not produce | ||
1033 | more output. | ||
1034 | <li> | ||
1035 | until <code>command</code> exits because sshd needs to tell | ||
1036 | the exit status from <code>command</code> to ssh. | ||
1037 | </ul> | ||
1038 | <p> | ||
1039 | |||
1040 | <h2><a name= "3.12">3.12 - I upgraded to OpenSSH 3.1 and X11 | ||
1041 | forwarding stopped working.</a></h2> | ||
1042 | |||
1043 | Starting with OpenSSH 3.1, the sshd x11 forwarding server listens on | ||
1044 | localhost by default; see the sshd <b>X11UseLocalhost</b> option to | ||
1045 | revert to prior behaviour if your older X11 clients do not function | ||
1046 | with this configuration.<p> | ||
1047 | |||
1048 | In general, X11 clients using X11 R6 should work with the default | ||
1049 | setting. Some vendors, including HP, ship X11 clients with R6 | ||
1050 | and R5 libs, so some clients will work, and others will not work. | ||
1051 | This is true for HP-UX 11.X.<p> | ||
1052 | |||
1053 | <h2><a name= "3.13">3.13 - I upgraded to OpenSSH 3.8 and some | ||
1054 | X11 programs stopped working.</a></h2> | ||
1055 | |||
1056 | <p> | ||
1057 | As documented in the <a href="http://www.openssh.com/txt/release-3.8">3.8 release notes</a>, | ||
1058 | <code>ssh</code> will now use untrusted X11 cookies by | ||
1059 | default. The previous behaviour can be restored by setting | ||
1060 | <b>ForwardX11Trusted yes</b> in <i>ssh_config</i>. | ||
1061 | |||
1062 | <p> | ||
1063 | Possible symptoms include:<br> | ||
1064 | <code>BadWindow (invalid Window parameter)<br> | ||
1065 | BadAccess (attempt to access private resource denied)<br> | ||
1066 | X Error of failed request: BadAtom (invalid Atom parameter)<br> | ||
1067 | Major opcode of failed request: 20 (X_GetProperty)<br></code> | ||
1068 | |||
1069 | <h2><a name= "3.14">3.14 - I copied my public key to authorized_keys | ||
1070 | but public-key authentication still doesn't work.</a></h2> | ||
1071 | |||
1072 | <p> | ||
1073 | Typically this is caused by the file permissions on $HOME, $HOME/.ssh or | ||
1074 | $HOME/.ssh/authorized_keys being more permissive than sshd allows by default. | ||
1075 | |||
1076 | <p> | ||
1077 | In this case, it can be solved by executing the following on the server. | ||
1078 | <blockquote> | ||
1079 | <table border=0 width="800"> | ||
1080 | <tr> | ||
1081 | <td nowrap bgcolor="#EEEEEE"> | ||
1082 | $ <b>chmod go-w $HOME $HOME/.ssh</b><br> | ||
1083 | $ <b>chmod 600 $HOME/.ssh/authorized_keys</b><br> | ||
1084 | $ <b>chown `whoami` $HOME/.ssh/authorized_keys</b><br> | ||
1085 | </td> | ||
1086 | </tr> | ||
1087 | </table> | ||
1088 | </blockquote> | ||
1089 | |||
1090 | <p> | ||
1091 | If this is not possible for some reason, an alternative is to set | ||
1092 | <b>StrictModes no</b> in <i>sshd_config</i>, however this is not | ||
1093 | recommended. | ||
1094 | |||
1095 | <h2><a name= "3.15">3.15 - OpenSSH versions and PAM behaviour.</a></h2> | ||
1096 | |||
1097 | Portable OpenSSH has a configure-time option to enable sshd's use of the | ||
1098 | <a href="http://www.opengroup.org/onlinepubs/008329799/">PAM</a> | ||
1099 | (Pluggable Authentication Modules) interface. | ||
1100 | |||
1101 | <blockquote> | ||
1102 | <table border=0 width="800"> | ||
1103 | <tr> | ||
1104 | <td nowrap bgcolor="#EEEEEE"> | ||
1105 | ./configure --with-pam [options] | ||
1106 | </td> | ||
1107 | </tr> | ||
1108 | </table> | ||
1109 | </blockquote> | ||
1110 | |||
1111 | To use PAM at all, this option must be provided at build time. | ||
1112 | The run-time behaviour when PAM is built in varies with the version of | ||
1113 | Portable OpenSSH, and on later versions it must also be enabled by setting | ||
1114 | <b>UsePAM</b> to <b>yes</b> in <i>sshd_config</i>. | ||
1115 | |||
1116 | <p> | ||
1117 | The behaviour of the relevant authentications options when PAM support is built | ||
1118 | in is summarised by the following table. | ||
1119 | |||
1120 | <p> | ||
1121 | <table border="1"> | ||
1122 | <tr> <th>Version</th> <th>UsePAM</th> <th>PasswordAuthentication</th> <th>ChallengeResponseAuthentication</th> </tr> | ||
1123 | <tr> | ||
1124 | <td><=3.6.1p2</td> | ||
1125 | <td>Not applicable</td> | ||
1126 | <td>Uses PAM</td> | ||
1127 | <td>Uses PAM if <b>PAMAuthenticationViaKbdInt</b> is enabled</td> | ||
1128 | </tr> | ||
1129 | <tr> | ||
1130 | <td>3.7p1 - 3.7.1p1</td> | ||
1131 | <td>Defaults to <b>yes</b></td> | ||
1132 | <td>Does not use PAM</td> | ||
1133 | <td>Uses PAM if <b>UsePAM</b> is enabled</td> | ||
1134 | </tr> | ||
1135 | <tr> | ||
1136 | <td>3.7.1p2 - 3.8.1p1</td> | ||
1137 | <td>Defaults to <b>no</b></td> | ||
1138 | <td>Does not use PAM <a href="#3.15fn1">[1]</a></td> | ||
1139 | <td>Uses PAM if <b>UsePAM</b> is enabled</td> | ||
1140 | </tr> | ||
1141 | <tr> | ||
1142 | <td>3.9p1</td> | ||
1143 | <td>Defaults to <b>no</b></td> | ||
1144 | <td>Uses PAM if <b>UsePAM</b> is enabled</td> | ||
1145 | <td>Uses PAM if <b>UsePAM</b> is enabled</td> | ||
1146 | </tr> | ||
1147 | </table> | ||
1148 | <p> | ||
1149 | |||
1150 | <a name= "3.15fn1">[1]</a> Some vendors, notably Redhat/Fedora, have | ||
1151 | backported the PasswordAuthentication from 3.9p1 to their 3.8x based | ||
1152 | packages. If you're using a vendor-supplied package then consult their | ||
1153 | documentation. | ||
1154 | |||
1155 | <p> | ||
1156 | OpenSSH Portable's PAM interface still has problems with a few modules, | ||
1157 | however we hope that this number will reduce in the future. As at the | ||
1158 | 3.9p1 release, the known problems are: | ||
1159 | |||
1160 | <ul> | ||
1161 | <li>Modules relying on module-private data (eg pam_dhkeys, pam_krb5, AFS) | ||
1162 | may fail to correctly establish credentials (bug <a | ||
1163 | href="http://bugzilla.mindrot.org/show_bug.cgi?id=688">#688</a>) when | ||
1164 | authenticating via <b>ChallengeResponseAuthentication</b>. | ||
1165 | <b>PasswordAuthentication</b> with 3.9p1 and above should work. | ||
1166 | </ul> | ||
1167 | |||
1168 | You can also check <a | ||
1169 | href="http://bugzilla.mindrot.org/buglist.cgi?product=Portable+OpenSSH&bug_status=RESOLVED&bug_status=NEW&bug_status=ACCEPTED&component=PAM+support" | ||
1170 | >bugzilla for current PAM issues</a>. | ||
1171 | |||
1172 | <h2><a name= "3.16">3.16 - Why doesn't "w" or "who" on AIX 5.x show users | ||
1173 | logged in via ssh?</a></h2> | ||
1174 | |||
1175 | Between AIX 4.3.3 and AIX 5.x, the format of the wtmp struct changed. This | ||
1176 | means that sshd binaries built on AIX 4.x will not correctly write wtmp | ||
1177 | entries when run on AIX 5.x. This can be fixed by simply recompiling | ||
1178 | sshd on an AIX 5.x system and using that. | ||
1179 | |||
1180 | <hr> | ||
1181 | <a href="http://www.openssh.com/index.html"><img height=24 width=24 src="back.gif" border=0 alt=OpenSSH></a> | ||
1182 | <a href="mailto:www@openbsd.org">www@openbsd.org</a> | ||
1183 | <br> | ||
1184 | <small>$OpenBSD: faq.html,v 1.113 2012/04/21 12:12:22 dtucker Exp $</small> | ||
1185 | |||
1186 | </body> | ||
1187 | </html> | ||
diff --git a/debian/gnome-ssh-askpass.1 b/debian/gnome-ssh-askpass.1 new file mode 100644 index 000000000..b74c410a8 --- /dev/null +++ b/debian/gnome-ssh-askpass.1 | |||
@@ -0,0 +1,51 @@ | |||
1 | .TH GNOME-SSH-ASKPASS 1 | ||
2 | .SH NAME | ||
3 | gnome\-ssh\-askpass \- prompts a user for a passphrase using GNOME | ||
4 | .SH SYNOPSIS | ||
5 | .B gnome\-ssh\-askpass | ||
6 | .SH DESCRIPTION | ||
7 | .B gnome\-ssh\-askpass | ||
8 | is a GNOME-based passphrase dialog for use with OpenSSH. | ||
9 | It is intended to be called by the | ||
10 | .BR ssh\-add (1) | ||
11 | program and not invoked directly. | ||
12 | It allows | ||
13 | .BR ssh\-add (1) | ||
14 | to obtain a passphrase from a user, even if not connected to a terminal | ||
15 | (assuming that an X display is available). | ||
16 | This happens automatically in the case where | ||
17 | .B ssh\-add | ||
18 | is invoked from one's | ||
19 | .B ~/.xsession | ||
20 | or as one of the GNOME startup programs, for example. | ||
21 | .PP | ||
22 | In order to be called automatically by | ||
23 | .BR ssh\-add , | ||
24 | .B gnome\-ssh\-askpass | ||
25 | should be installed as | ||
26 | .IR /usr/bin/ssh\-askpass . | ||
27 | .SH "ENVIRONMENT VARIABLES" | ||
28 | The following environment variables are recognized: | ||
29 | .TP | ||
30 | .I GNOME_SSH_ASKPASS_GRAB_SERVER | ||
31 | Causes | ||
32 | .B gnome\-ssh\-askpass | ||
33 | to grab the X server before asking for a passphrase. | ||
34 | .TP | ||
35 | .I GNOME_SSH_ASKPASS_GRAB_POINTER | ||
36 | Causes | ||
37 | .B gnome\-ssh\-askpass | ||
38 | to grab the mouse pointer using | ||
39 | .IR gdk_pointer_grab () | ||
40 | before asking for a passphrase. | ||
41 | .PP | ||
42 | Regardless of whether either of these environment variables is set, | ||
43 | .B gnome\-ssh\-askpass | ||
44 | will grab the keyboard using | ||
45 | .IR gdk_keyboard_grab (). | ||
46 | .SH AUTHOR | ||
47 | This manual page was written by Colin Watson <cjwatson@debian.org> | ||
48 | for the Debian system (but may be used by others). | ||
49 | It was based on that for | ||
50 | .B x11\-ssh\-askpass | ||
51 | by Philip Hands. | ||
diff --git a/debian/keygen-test/Makefile b/debian/keygen-test/Makefile new file mode 100644 index 000000000..666ed8227 --- /dev/null +++ b/debian/keygen-test/Makefile | |||
@@ -0,0 +1,12 @@ | |||
1 | test: getpid.so | ||
2 | chmod +x keygen-test | ||
3 | ./keygen-test | ||
4 | |||
5 | getpid.o: getpid.c | ||
6 | gcc -fPIC -c $< -o $@ | ||
7 | |||
8 | getpid.so: getpid.o | ||
9 | gcc -shared -o $@ $< | ||
10 | |||
11 | clean: | ||
12 | rm -f getpid.o getpid.so key1 key1.pub key2 key2.pub | ||
diff --git a/debian/keygen-test/getpid.c b/debian/keygen-test/getpid.c new file mode 100644 index 000000000..c9e35b87e --- /dev/null +++ b/debian/keygen-test/getpid.c | |||
@@ -0,0 +1,39 @@ | |||
1 | /* | ||
2 | * Compile: | ||
3 | |||
4 | gcc -fPIC -c getpid.c -o getpid.o | ||
5 | gcc -shared -o getpid.so getpid.o | ||
6 | |||
7 | * Use: | ||
8 | |||
9 | FORCE_PID=1234 LD_PRELOAD=./getpid.so bash | ||
10 | |||
11 | # | ||
12 | # Copyright (C) 2001-2008 Kees Cook | ||
13 | # kees@outflux.net, http://outflux.net/ | ||
14 | # | ||
15 | # This program is free software; you can redistribute it and/or | ||
16 | # modify it under the terms of the GNU General Public License | ||
17 | # as published by the Free Software Foundation; either version 2 | ||
18 | # of the License, or (at your option) any later version. | ||
19 | # | ||
20 | # This program is distributed in the hope that it will be useful, | ||
21 | # but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
22 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||
23 | # GNU General Public License for more details. | ||
24 | # | ||
25 | # You should have received a copy of the GNU General Public License | ||
26 | # along with this program; if not, write to the Free Software | ||
27 | # Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. | ||
28 | # http://www.gnu.org/copyleft/gpl.html | ||
29 | |||
30 | */ | ||
31 | |||
32 | #include <sys/types.h> | ||
33 | #include <unistd.h> | ||
34 | #include <stdlib.h> | ||
35 | |||
36 | pid_t getpid(void) | ||
37 | { | ||
38 | return atoi(getenv("FORCE_PID")); | ||
39 | } | ||
diff --git a/debian/keygen-test/keygen-test b/debian/keygen-test/keygen-test new file mode 100755 index 000000000..2abe815ef --- /dev/null +++ b/debian/keygen-test/keygen-test | |||
@@ -0,0 +1,12 @@ | |||
1 | #! /bin/sh | ||
2 | |||
3 | rm -f key1 key1.pub key2 key2.pub | ||
4 | LD_PRELOAD="$(pwd)/getpid.so" FORCE_PID=1234 \ | ||
5 | ../build-deb/ssh-keygen -N '' -f key1 >/dev/null | ||
6 | LD_PRELOAD="$(pwd)/getpid.so" FORCE_PID=1234 \ | ||
7 | ../build-deb/ssh-keygen -N '' -f key2 >/dev/null | ||
8 | if cmp -s key1 key2; then | ||
9 | echo "Generated two identical keys!" >&2 | ||
10 | exit 1 | ||
11 | fi | ||
12 | exit 0 | ||
diff --git a/debian/openssh-client-ssh1.install b/debian/openssh-client-ssh1.install new file mode 100755 index 000000000..60a8bc58a --- /dev/null +++ b/debian/openssh-client-ssh1.install | |||
@@ -0,0 +1,5 @@ | |||
1 | #! /usr/bin/dh-exec | ||
2 | |||
3 | debian/build-deb-ssh1/scp => usr/bin/scp1 | ||
4 | debian/build-deb-ssh1/ssh => usr/bin/ssh1 | ||
5 | debian/build-deb-ssh1/ssh-keygen => usr/bin/ssh-keygen1 | ||
diff --git a/debian/openssh-client-udeb.install b/debian/openssh-client-udeb.install new file mode 100644 index 000000000..b3891f02d --- /dev/null +++ b/debian/openssh-client-udeb.install | |||
@@ -0,0 +1,3 @@ | |||
1 | scp usr/bin | ||
2 | sftp usr/bin | ||
3 | ssh usr/bin | ||
diff --git a/debian/openssh-client.apport b/debian/openssh-client.apport new file mode 100644 index 000000000..3dbc8e5e6 --- /dev/null +++ b/debian/openssh-client.apport | |||
@@ -0,0 +1,32 @@ | |||
1 | #!/usr/bin/python | ||
2 | |||
3 | '''apport hook for openssh-client | ||
4 | |||
5 | (c) 2010 Canonical Ltd. | ||
6 | Author: Chuck Short <chuck.short@canonical.com> | ||
7 | |||
8 | This program is free software; you can redistribute it and/or modify it | ||
9 | under the terms of the GNU General Public License as published by the | ||
10 | Free Software Foundation; either version 2 of the License, or (at your | ||
11 | option) any later version. See http://www.gnu.org/copyleft/gpl.html for | ||
12 | the full text of the license. | ||
13 | ''' | ||
14 | |||
15 | from apport.hookutils import * | ||
16 | |||
17 | def add_info(report, ui): | ||
18 | response = ui.yesno("The contents of your /etc/ssh/ssh_config file " | ||
19 | "may help developers diagnose your bug more " | ||
20 | "quickly. However, it may contain sensitive " | ||
21 | "information. Do you want to include it in your " | ||
22 | "bug report?") | ||
23 | |||
24 | if response == None: # user cancelled | ||
25 | raise StopIteration | ||
26 | |||
27 | elif response == True: | ||
28 | attach_conffiles(report, 'openssh-client') | ||
29 | |||
30 | attach_related_packages(report, | ||
31 | ['ssh-askpass', 'libpam-ssh', 'keychain', 'ssh-askpass-gnome']) | ||
32 | report['SSHClientVersion'] = command_output(['/usr/bin/ssh', '-V']) | ||
diff --git a/debian/openssh-client.docs b/debian/openssh-client.docs new file mode 100644 index 000000000..d80ec1262 --- /dev/null +++ b/debian/openssh-client.docs | |||
@@ -0,0 +1,6 @@ | |||
1 | ChangeLog.gssapi | ||
2 | OVERVIEW | ||
3 | README | ||
4 | README.dns | ||
5 | README.tun | ||
6 | debian/faq.html | ||
diff --git a/debian/openssh-client.install b/debian/openssh-client.install new file mode 100755 index 000000000..b8b798d91 --- /dev/null +++ b/debian/openssh-client.install | |||
@@ -0,0 +1,41 @@ | |||
1 | #! /usr/bin/dh-exec | ||
2 | |||
3 | etc/ssh/moduli | ||
4 | etc/ssh/ssh_config | ||
5 | usr/bin/scp | ||
6 | usr/bin/sftp | ||
7 | usr/bin/ssh | ||
8 | usr/bin/ssh-add | ||
9 | usr/bin/ssh-agent | ||
10 | usr/bin/ssh-keygen | ||
11 | usr/bin/ssh-keyscan | ||
12 | usr/lib/openssh/ssh-keysign | ||
13 | usr/lib/openssh/ssh-pkcs11-helper | ||
14 | usr/share/man/man1/scp.1 | ||
15 | usr/share/man/man1/sftp.1 | ||
16 | usr/share/man/man1/ssh-add.1 | ||
17 | usr/share/man/man1/ssh-agent.1 | ||
18 | usr/share/man/man1/ssh-keygen.1 | ||
19 | usr/share/man/man1/ssh-keyscan.1 | ||
20 | usr/share/man/man1/ssh.1 | ||
21 | usr/share/man/man5/moduli.5 | ||
22 | usr/share/man/man5/ssh_config.5 | ||
23 | usr/share/man/man8/ssh-keysign.8 | ||
24 | usr/share/man/man8/ssh-pkcs11-helper.8 | ||
25 | |||
26 | contrib/ssh-copy-id usr/bin | ||
27 | debian/ssh-argv0 usr/bin | ||
28 | |||
29 | debian/agent-launch usr/lib/openssh | ||
30 | |||
31 | # dh_apport would be neater, but at the time of writing it isn't in unstable | ||
32 | # yet. | ||
33 | debian/openssh-client.apport => usr/share/apport/package-hooks/openssh-client.py | ||
34 | |||
35 | # Upstart user job (only used under user sessions). | ||
36 | debian/ssh-agent.user-session.upstart => usr/share/upstart/sessions/ssh-agent.conf | ||
37 | |||
38 | # systemd user unit (only used under sessions) | ||
39 | debian/systemd/ssh-agent.service usr/lib/systemd/user | ||
40 | # disable above upstart job when running the systemd user unit | ||
41 | debian/systemd/ssh-agent.override usr/share/upstart/systemd-session/upstart | ||
diff --git a/debian/openssh-client.links b/debian/openssh-client.links new file mode 100644 index 000000000..1d94c74e8 --- /dev/null +++ b/debian/openssh-client.links | |||
@@ -0,0 +1,4 @@ | |||
1 | usr/bin/ssh usr/bin/slogin | ||
2 | usr/share/man/man1/ssh.1 usr/share/man/man1/slogin.1 | ||
3 | # enable systemd user unit for graphical sessions that use systemd | ||
4 | usr/lib/systemd/user/ssh-agent.service usr/lib/systemd/user/graphical-session-pre.target.wants/ssh-agent.service | ||
diff --git a/debian/openssh-client.lintian-overrides b/debian/openssh-client.lintian-overrides new file mode 100644 index 000000000..486567744 --- /dev/null +++ b/debian/openssh-client.lintian-overrides | |||
@@ -0,0 +1 @@ | |||
openssh-client: setuid-binary usr/lib/openssh/ssh-keysign 4755 root/root | |||
diff --git a/debian/openssh-client.manpages b/debian/openssh-client.manpages new file mode 100644 index 000000000..690bd8a22 --- /dev/null +++ b/debian/openssh-client.manpages | |||
@@ -0,0 +1,2 @@ | |||
1 | contrib/ssh-copy-id.1 | ||
2 | debian/ssh-argv0.1 | ||
diff --git a/debian/openssh-client.postinst b/debian/openssh-client.postinst new file mode 100644 index 000000000..ec0ad2b2b --- /dev/null +++ b/debian/openssh-client.postinst | |||
@@ -0,0 +1,45 @@ | |||
1 | #!/bin/sh | ||
2 | set -e | ||
3 | |||
4 | action="$1" | ||
5 | oldversion="$2" | ||
6 | |||
7 | umask 022 | ||
8 | |||
9 | |||
10 | create_alternatives() { | ||
11 | # Create alternatives for the various r* tools. | ||
12 | # Make sure we don't change existing alternatives that a user might have | ||
13 | # changed, but clean up after some old alternatives that mistakenly pointed | ||
14 | # rlogin and rcp to ssh. | ||
15 | update-alternatives --quiet --remove rlogin /usr/bin/ssh | ||
16 | update-alternatives --quiet --remove rcp /usr/bin/ssh | ||
17 | for cmd in rsh rlogin rcp; do | ||
18 | scmd="s${cmd#r}" | ||
19 | if ! update-alternatives --display "$cmd" 2>/dev/null | \ | ||
20 | grep -q "$scmd"; then | ||
21 | update-alternatives --quiet --install "/usr/bin/$cmd" "$cmd" "/usr/bin/$scmd" 20 \ | ||
22 | --slave "/usr/share/man/man1/$cmd.1.gz" "$cmd.1.gz" "/usr/share/man/man1/$scmd.1.gz" | ||
23 | fi | ||
24 | done | ||
25 | } | ||
26 | |||
27 | set_ssh_agent_permissions() { | ||
28 | if ! getent group ssh >/dev/null; then | ||
29 | addgroup --system --quiet ssh | ||
30 | fi | ||
31 | if ! dpkg-statoverride --list /usr/bin/ssh-agent >/dev/null; then | ||
32 | chgrp ssh /usr/bin/ssh-agent | ||
33 | chmod 2755 /usr/bin/ssh-agent | ||
34 | fi | ||
35 | } | ||
36 | |||
37 | |||
38 | if [ "$action" = configure ]; then | ||
39 | create_alternatives | ||
40 | set_ssh_agent_permissions | ||
41 | fi | ||
42 | |||
43 | #DEBHELPER# | ||
44 | |||
45 | exit 0 | ||
diff --git a/debian/openssh-client.postrm b/debian/openssh-client.postrm new file mode 100644 index 000000000..68c354481 --- /dev/null +++ b/debian/openssh-client.postrm | |||
@@ -0,0 +1,22 @@ | |||
1 | #!/bin/sh | ||
2 | set -e | ||
3 | |||
4 | #DEBHELPER# | ||
5 | |||
6 | case $1 in | ||
7 | purge) | ||
8 | # Remove all non-conffiles that ssh might create, so that we | ||
9 | # can smoothly remove /etc/ssh if and only if the user | ||
10 | # hasn't dropped some other files in there. Conffiles have | ||
11 | # already been removed at this point. | ||
12 | rm -f /etc/ssh/moduli /etc/ssh/primes | ||
13 | rm -f /etc/ssh/ssh_known_hosts /etc/ssh/ssh_known_hosts2 | ||
14 | rmdir --ignore-fail-on-non-empty /etc/ssh | ||
15 | |||
16 | if which delgroup >/dev/null 2>&1; then | ||
17 | delgroup --quiet ssh > /dev/null || true | ||
18 | fi | ||
19 | ;; | ||
20 | esac | ||
21 | |||
22 | exit 0 | ||
diff --git a/debian/openssh-client.prerm b/debian/openssh-client.prerm new file mode 100644 index 000000000..2d631cb9c --- /dev/null +++ b/debian/openssh-client.prerm | |||
@@ -0,0 +1,39 @@ | |||
1 | #! /bin/sh | ||
2 | # prerm script for ssh | ||
3 | # | ||
4 | # see: dh_installdeb(1) | ||
5 | |||
6 | set -e | ||
7 | |||
8 | # summary of how this script can be called: | ||
9 | # * <prerm> `remove' | ||
10 | # * <old-prerm> `upgrade' <new-version> | ||
11 | # * <new-prerm> `failed-upgrade' <old-version> | ||
12 | # * <conflictor's-prerm> `remove' `in-favour' <package> <new-version> | ||
13 | # * <deconfigured's-prerm> `deconfigure' `in-favour' | ||
14 | # <package-being-installed> <version> `removing' | ||
15 | # <conflicting-package> <version> | ||
16 | # for details, see /usr/share/doc/packaging-manual/ | ||
17 | |||
18 | case "$1" in | ||
19 | remove|deconfigure) | ||
20 | update-alternatives --quiet --remove rsh /usr/bin/ssh | ||
21 | update-alternatives --quiet --remove rlogin /usr/bin/slogin | ||
22 | update-alternatives --quiet --remove rcp /usr/bin/scp | ||
23 | ;; | ||
24 | upgrade) | ||
25 | ;; | ||
26 | failed-upgrade) | ||
27 | ;; | ||
28 | *) | ||
29 | echo "prerm called with unknown argument \`$1'" >&2 | ||
30 | exit 0 | ||
31 | ;; | ||
32 | esac | ||
33 | |||
34 | # dh_installdeb will replace this with shell code automatically | ||
35 | # generated by other debhelper scripts. | ||
36 | |||
37 | #DEBHELPER# | ||
38 | |||
39 | exit 0 | ||
diff --git a/debian/openssh-server-udeb.dirs b/debian/openssh-server-udeb.dirs new file mode 100644 index 000000000..e730fc43d --- /dev/null +++ b/debian/openssh-server-udeb.dirs | |||
@@ -0,0 +1 @@ | |||
run/sshd | |||
diff --git a/debian/openssh-server-udeb.install b/debian/openssh-server-udeb.install new file mode 100644 index 000000000..05ccbf7af --- /dev/null +++ b/debian/openssh-server-udeb.install | |||
@@ -0,0 +1,2 @@ | |||
1 | sshd usr/sbin | ||
2 | ssh-keygen usr/bin | ||
diff --git a/debian/openssh-server.apport b/debian/openssh-server.apport new file mode 100644 index 000000000..3644bd855 --- /dev/null +++ b/debian/openssh-server.apport | |||
@@ -0,0 +1,28 @@ | |||
1 | #!/usr/bin/python | ||
2 | |||
3 | '''apport hook for openssh-server | ||
4 | |||
5 | (c) 2010 Canonical Ltd. | ||
6 | Author: Chuck Short <chuck.short@canonical.com> | ||
7 | |||
8 | This program is free software; you can redistribute it and/or modify it | ||
9 | under the terms of the GNU General Public License as published by the | ||
10 | Free Software Foundation; either version 2 of the License, or (at your | ||
11 | option) any later version. See http://www.gnu.org/copyleft/gpl.html for | ||
12 | the full text of the license. | ||
13 | ''' | ||
14 | |||
15 | from apport.hookutils import * | ||
16 | |||
17 | def add_info(report, ui): | ||
18 | response = ui.yesno("The contents of your /etc/ssh/sshd_config file " | ||
19 | "may help developers diagnose your bug more " | ||
20 | "quickly. However, it may contain sensitive " | ||
21 | "information. Do you want to include it in your " | ||
22 | "bug report?") | ||
23 | |||
24 | if response == None: # user cancelled | ||
25 | raise StopIteration | ||
26 | |||
27 | elif response == True: | ||
28 | report['SSHDConfig'] = root_command_output(['/usr/sbin/sshd', '-T']) | ||
diff --git a/debian/openssh-server.config b/debian/openssh-server.config new file mode 100644 index 000000000..1cad01cff --- /dev/null +++ b/debian/openssh-server.config | |||
@@ -0,0 +1,40 @@ | |||
1 | #! /bin/sh | ||
2 | set -e | ||
3 | |||
4 | . /usr/share/debconf/confmodule | ||
5 | db_version 2.0 | ||
6 | |||
7 | get_config_option() { | ||
8 | option="$1" | ||
9 | |||
10 | [ -f /etc/ssh/sshd_config ] || return | ||
11 | |||
12 | # TODO: actually only one '=' allowed after option | ||
13 | perl -lne ' | ||
14 | s/[[:space:]]+/ /g; s/[[:space:]]+$//; | ||
15 | print if s/^[[:space:]]*'"$option"'[[:space:]=]+//i' \ | ||
16 | /etc/ssh/sshd_config 2>/dev/null | ||
17 | } | ||
18 | |||
19 | permit_root_login="$(get_config_option PermitRootLogin)" || true | ||
20 | if [ -f /etc/ssh/sshd_config ]; then | ||
21 | # Make sure the debconf database is in sync with the current state | ||
22 | # of the system. | ||
23 | if [ "$permit_root_login" = yes ]; then | ||
24 | db_set openssh-server/permit-root-login false | ||
25 | else | ||
26 | db_set openssh-server/permit-root-login true | ||
27 | fi | ||
28 | fi | ||
29 | |||
30 | if dpkg --compare-versions "$2" lt-nl 1:6.6p1-1 && \ | ||
31 | [ "$permit_root_login" = yes ]; then | ||
32 | if [ "$(getent shadow root | cut -d: -f2)" = "!" ]; then | ||
33 | db_set openssh-server/permit-root-login true | ||
34 | else | ||
35 | db_input high openssh-server/permit-root-login || true | ||
36 | db_go | ||
37 | fi | ||
38 | fi | ||
39 | |||
40 | exit 0 | ||
diff --git a/debian/openssh-server.examples b/debian/openssh-server.examples new file mode 100644 index 000000000..9f15e1fa7 --- /dev/null +++ b/debian/openssh-server.examples | |||
@@ -0,0 +1 @@ | |||
debian/systemd/ssh-session-cleanup.service | |||
diff --git a/debian/openssh-server.if-up b/debian/openssh-server.if-up new file mode 100644 index 000000000..525c2153b --- /dev/null +++ b/debian/openssh-server.if-up | |||
@@ -0,0 +1,42 @@ | |||
1 | #! /bin/sh | ||
2 | # Reload the OpenSSH server when an interface comes up, to allow it to start | ||
3 | # listening on new addresses. | ||
4 | |||
5 | set -e | ||
6 | |||
7 | # Don't bother to restart sshd when lo is configured. | ||
8 | if [ "$IFACE" = lo ]; then | ||
9 | exit 0 | ||
10 | fi | ||
11 | |||
12 | # Only run from ifup. | ||
13 | if [ "$MODE" != start ]; then | ||
14 | exit 0 | ||
15 | fi | ||
16 | |||
17 | # OpenSSH only cares about inet and inet6. Get ye gone, strange people | ||
18 | # still using ipx. | ||
19 | if [ "$ADDRFAM" != inet ] && [ "$ADDRFAM" != inet6 ]; then | ||
20 | exit 0 | ||
21 | fi | ||
22 | |||
23 | # Is /usr mounted? | ||
24 | if [ ! -e /usr/sbin/sshd ]; then | ||
25 | exit 0 | ||
26 | fi | ||
27 | |||
28 | if [ ! -f /run/sshd.pid ] || \ | ||
29 | [ "$(ps -p "$(cat /run/sshd.pid)" -o comm=)" != sshd ]; then | ||
30 | exit 0 | ||
31 | fi | ||
32 | |||
33 | # We'd like to use 'reload' here, but it has some problems; see #502444. On | ||
34 | # the other hand, repeated restarts of ssh make systemd unhappy | ||
35 | # (#756547/#757822), so use reload in that case. | ||
36 | if [ -d /run/systemd/system ]; then | ||
37 | systemctl reload --no-block ssh.service >/dev/null 2>&1 || true | ||
38 | else | ||
39 | invoke-rc.d ssh restart >/dev/null 2>&1 || true | ||
40 | fi | ||
41 | |||
42 | exit 0 | ||
diff --git a/debian/openssh-server.install b/debian/openssh-server.install new file mode 100755 index 000000000..7fdf609a7 --- /dev/null +++ b/debian/openssh-server.install | |||
@@ -0,0 +1,20 @@ | |||
1 | #! /usr/bin/dh-exec | ||
2 | |||
3 | usr/sbin/sshd | ||
4 | usr/share/man/man5/authorized_keys.5 | ||
5 | usr/share/man/man5/sshd_config.5 | ||
6 | usr/share/man/man8/sshd.8 | ||
7 | |||
8 | sshd_config => usr/share/openssh/sshd_config | ||
9 | debian/openssh-server.ucf-md5sum => usr/share/openssh/sshd_config.md5sum | ||
10 | |||
11 | debian/openssh-server.if-up => etc/network/if-up.d/openssh-server | ||
12 | debian/openssh-server.ufw.profile => etc/ufw/applications.d/openssh-server | ||
13 | debian/systemd/ssh.socket lib/systemd/system | ||
14 | debian/systemd/ssh@.service lib/systemd/system | ||
15 | debian/systemd/sshd.conf usr/lib/tmpfiles.d | ||
16 | debian/systemd/ssh-session-cleanup usr/lib/openssh | ||
17 | |||
18 | # dh_apport would be neater, but at the time of writing it isn't in unstable | ||
19 | # yet. | ||
20 | debian/openssh-server.apport => usr/share/apport/package-hooks/openssh-server.py | ||
diff --git a/debian/openssh-server.links b/debian/openssh-server.links new file mode 100644 index 000000000..e69de29bb --- /dev/null +++ b/debian/openssh-server.links | |||
diff --git a/debian/openssh-server.lintian-overrides b/debian/openssh-server.lintian-overrides new file mode 100644 index 000000000..17d912cb0 --- /dev/null +++ b/debian/openssh-server.lintian-overrides | |||
@@ -0,0 +1 @@ | |||
openssh-server: package-contains-empty-directory usr/share/doc/openssh-client/ | |||
diff --git a/debian/openssh-server.maintscript b/debian/openssh-server.maintscript new file mode 100644 index 000000000..f9e3c4d53 --- /dev/null +++ b/debian/openssh-server.maintscript | |||
@@ -0,0 +1 @@ | |||
mv_conffile /etc/pam.d/ssh /etc/pam.d/sshd 1:4.7p1-4~ | |||
diff --git a/debian/openssh-server.postinst b/debian/openssh-server.postinst new file mode 100644 index 000000000..f0ebe48b8 --- /dev/null +++ b/debian/openssh-server.postinst | |||
@@ -0,0 +1,157 @@ | |||
1 | #!/bin/sh | ||
2 | set -e | ||
3 | |||
4 | . /usr/share/debconf/confmodule | ||
5 | db_version 2.0 | ||
6 | |||
7 | action="$1" | ||
8 | oldversion="$2" | ||
9 | |||
10 | umask 022 | ||
11 | |||
12 | |||
13 | get_config_option() { | ||
14 | option="$1" | ||
15 | |||
16 | [ -f /etc/ssh/sshd_config ] || return | ||
17 | |||
18 | # TODO: actually only one '=' allowed after option | ||
19 | perl -lne ' | ||
20 | s/[[:space:]]+/ /g; s/[[:space:]]+$//; | ||
21 | print if s/^[[:space:]]*'"$option"'[[:space:]=]+//i' \ | ||
22 | /etc/ssh/sshd_config | ||
23 | } | ||
24 | |||
25 | |||
26 | host_keys_required() { | ||
27 | hostkeys="$(get_config_option HostKey)" | ||
28 | if [ "$hostkeys" ]; then | ||
29 | echo "$hostkeys" | ||
30 | else | ||
31 | # No HostKey directives at all, so the server picks some | ||
32 | # defaults. | ||
33 | echo /etc/ssh/ssh_host_rsa_key | ||
34 | echo /etc/ssh/ssh_host_ecdsa_key | ||
35 | echo /etc/ssh/ssh_host_ed25519_key | ||
36 | fi | ||
37 | } | ||
38 | |||
39 | |||
40 | create_key() { | ||
41 | msg="$1" | ||
42 | shift | ||
43 | hostkeys="$1" | ||
44 | shift | ||
45 | file="$1" | ||
46 | shift | ||
47 | |||
48 | if echo "$hostkeys" | grep -x "$file" >/dev/null && \ | ||
49 | [ ! -f "$file" ] ; then | ||
50 | echo -n $msg | ||
51 | ssh-keygen -q -f "$file" -N '' "$@" | ||
52 | echo | ||
53 | if which restorecon >/dev/null 2>&1; then | ||
54 | restorecon "$file" "$file.pub" | ||
55 | fi | ||
56 | ssh-keygen -l -f "$file.pub" | ||
57 | fi | ||
58 | } | ||
59 | |||
60 | |||
61 | create_keys() { | ||
62 | hostkeys="$(host_keys_required)" | ||
63 | |||
64 | create_key "Creating SSH2 RSA key; this may take some time ..." \ | ||
65 | "$hostkeys" /etc/ssh/ssh_host_rsa_key -t rsa | ||
66 | create_key "Creating SSH2 DSA key; this may take some time ..." \ | ||
67 | "$hostkeys" /etc/ssh/ssh_host_dsa_key -t dsa | ||
68 | create_key "Creating SSH2 ECDSA key; this may take some time ..." \ | ||
69 | "$hostkeys" /etc/ssh/ssh_host_ecdsa_key -t ecdsa | ||
70 | create_key "Creating SSH2 ED25519 key; this may take some time ..." \ | ||
71 | "$hostkeys" /etc/ssh/ssh_host_ed25519_key -t ed25519 | ||
72 | } | ||
73 | |||
74 | |||
75 | new_config= | ||
76 | |||
77 | cleanup() { | ||
78 | if [ "$new_config" ]; then | ||
79 | rm -f "$new_config" | ||
80 | fi | ||
81 | } | ||
82 | |||
83 | |||
84 | create_sshdconfig() { | ||
85 | # XXX cjwatson 2016-12-24: This debconf template is very confusingly | ||
86 | # named; its description is "Disable SSH password authentication for | ||
87 | # root?", so true -> prohibit-password (the upstream default), | ||
88 | # false -> yes. | ||
89 | db_get openssh-server/permit-root-login | ||
90 | permit_root_login="$RET" | ||
91 | |||
92 | trap cleanup EXIT | ||
93 | new_config="$(tempfile)" | ||
94 | cp -a /usr/share/openssh/sshd_config "$new_config" | ||
95 | if [ "$permit_root_login" != true ]; then | ||
96 | sed -i 's/^#*PermitRootLogin .*/PermitRootLogin yes/' \ | ||
97 | "$new_config" | ||
98 | fi | ||
99 | ucf --three-way --debconf-ok \ | ||
100 | --sum-file /usr/share/openssh/sshd_config.md5sum \ | ||
101 | "$new_config" /etc/ssh/sshd_config | ||
102 | ucfr openssh-server /etc/ssh/sshd_config | ||
103 | } | ||
104 | |||
105 | fix_statoverride() { | ||
106 | # Remove an erronous override for sshd (we should have overridden ssh) | ||
107 | if dpkg-statoverride --list /usr/sbin/sshd >/dev/null; then | ||
108 | dpkg-statoverride --remove /usr/sbin/sshd | ||
109 | fi | ||
110 | } | ||
111 | |||
112 | setup_sshd_user() { | ||
113 | if ! getent passwd sshd >/dev/null; then | ||
114 | adduser --quiet --system --no-create-home --home /run/sshd --shell /usr/sbin/nologin sshd | ||
115 | fi | ||
116 | } | ||
117 | |||
118 | if [ "$action" = configure ]; then | ||
119 | create_sshdconfig | ||
120 | create_keys | ||
121 | fix_statoverride | ||
122 | setup_sshd_user | ||
123 | # Renamed to /etc/ssh/moduli in 2.9.9 (!) | ||
124 | if dpkg --compare-versions "$2" lt-nl 1:4.7p1-1; then | ||
125 | rm -f /etc/ssh/primes | ||
126 | fi | ||
127 | if dpkg --compare-versions "$2" lt-nl 1:5.5p1-6; then | ||
128 | rm -f /run/sshd/.placeholder | ||
129 | fi | ||
130 | if dpkg --compare-versions "$2" lt-nl 1:6.2p2-3 && \ | ||
131 | which initctl >/dev/null && initctl version 2>/dev/null | grep -q upstart && \ | ||
132 | ! status ssh 2>/dev/null | grep -q ' start/'; then | ||
133 | # We must stop the sysvinit-controlled sshd before we can | ||
134 | # restart it under Upstart. | ||
135 | start-stop-daemon --stop --quiet --oknodo --pidfile /run/sshd.pid || true | ||
136 | fi | ||
137 | if dpkg --compare-versions "$2" lt-nl 1:6.5p1-2 && \ | ||
138 | deb-systemd-helper debian-installed ssh.socket && \ | ||
139 | deb-systemd-helper --quiet was-enabled ssh.service && \ | ||
140 | deb-systemd-helper --quiet was-enabled ssh.socket; then | ||
141 | # 1:6.5p1-1 mistakenly left both ssh.service and ssh.socket | ||
142 | # enabled. | ||
143 | deb-systemd-helper disable ssh.socket >/dev/null || true | ||
144 | fi | ||
145 | if dpkg --compare-versions "$2" lt-nl 1:6.5p1-3 && \ | ||
146 | [ -d /run/systemd/system ]; then | ||
147 | # We must stop the sysvinit-controlled sshd before we can | ||
148 | # restart it under systemd. | ||
149 | start-stop-daemon --stop --quiet --oknodo --pidfile /run/sshd.pid --exec /usr/sbin/sshd || true | ||
150 | fi | ||
151 | fi | ||
152 | |||
153 | #DEBHELPER# | ||
154 | |||
155 | db_stop | ||
156 | |||
157 | exit 0 | ||
diff --git a/debian/openssh-server.postrm b/debian/openssh-server.postrm new file mode 100644 index 000000000..ff16e5619 --- /dev/null +++ b/debian/openssh-server.postrm | |||
@@ -0,0 +1,35 @@ | |||
1 | #!/bin/sh | ||
2 | set -e | ||
3 | |||
4 | #DEBHELPER# | ||
5 | |||
6 | case $1 in | ||
7 | purge) | ||
8 | # Remove all non-conffiles that ssh might create, so that we | ||
9 | # can smoothly remove /etc/ssh if and only if the user | ||
10 | # hasn't dropped some other files in there. Conffiles have | ||
11 | # already been removed at this point. | ||
12 | rm -f /etc/ssh/ssh_host_key /etc/ssh/ssh_host_key.pub | ||
13 | rm -f /etc/ssh/ssh_host_rsa_key /etc/ssh/ssh_host_rsa_key.pub | ||
14 | rm -f /etc/ssh/ssh_host_dsa_key /etc/ssh/ssh_host_dsa_key.pub | ||
15 | rm -f /etc/ssh/ssh_host_ecdsa_key /etc/ssh/ssh_host_ecdsa_key.pub | ||
16 | rm -f /etc/ssh/ssh_host_ed25519_key /etc/ssh/ssh_host_ed25519_key.pub | ||
17 | for ext in .ucf-new .ucf-old .ucf-dist ""; do | ||
18 | rm -f "/etc/ssh/sshd_config$ext" | ||
19 | done | ||
20 | if which ucf >/dev/null 2>&1; then | ||
21 | ucf --purge /etc/ssh/sshd_config | ||
22 | fi | ||
23 | if which ucfr >/dev/null 2>&1; then | ||
24 | ucfr --purge openssh-server /etc/ssh/sshd_config | ||
25 | fi | ||
26 | rm -f /etc/ssh/sshd_not_to_be_run | ||
27 | rmdir --ignore-fail-on-non-empty /etc/ssh | ||
28 | |||
29 | if which deluser >/dev/null 2>&1; then | ||
30 | deluser --quiet sshd > /dev/null || true | ||
31 | fi | ||
32 | ;; | ||
33 | esac | ||
34 | |||
35 | exit 0 | ||
diff --git a/debian/openssh-server.preinst b/debian/openssh-server.preinst new file mode 100644 index 000000000..f5b75124e --- /dev/null +++ b/debian/openssh-server.preinst | |||
@@ -0,0 +1,18 @@ | |||
1 | #!/bin/sh | ||
2 | set -e | ||
3 | |||
4 | action=$1 | ||
5 | version=$2 | ||
6 | |||
7 | if [ "$action" = upgrade ] || [ "$action" = install ] | ||
8 | then | ||
9 | if dpkg --compare-versions "$version" lt 1:5.5p1-6 && \ | ||
10 | [ -d /run/sshd ]; then | ||
11 | # make sure /run/sshd is not removed on upgrades | ||
12 | touch /run/sshd/.placeholder | ||
13 | fi | ||
14 | fi | ||
15 | |||
16 | #DEBHELPER# | ||
17 | |||
18 | exit 0 | ||
diff --git a/debian/openssh-server.ssh.default b/debian/openssh-server.ssh.default new file mode 100644 index 000000000..304042224 --- /dev/null +++ b/debian/openssh-server.ssh.default | |||
@@ -0,0 +1,5 @@ | |||
1 | # Default settings for openssh-server. This file is sourced by /bin/sh from | ||
2 | # /etc/init.d/ssh. | ||
3 | |||
4 | # Options to pass to sshd | ||
5 | SSHD_OPTS= | ||
diff --git a/debian/openssh-server.ssh.init b/debian/openssh-server.ssh.init new file mode 100644 index 000000000..70a6c38f2 --- /dev/null +++ b/debian/openssh-server.ssh.init | |||
@@ -0,0 +1,174 @@ | |||
1 | #! /bin/sh | ||
2 | |||
3 | ### BEGIN INIT INFO | ||
4 | # Provides: sshd | ||
5 | # Required-Start: $remote_fs $syslog | ||
6 | # Required-Stop: $remote_fs $syslog | ||
7 | # Default-Start: 2 3 4 5 | ||
8 | # Default-Stop: | ||
9 | # Short-Description: OpenBSD Secure Shell server | ||
10 | ### END INIT INFO | ||
11 | |||
12 | set -e | ||
13 | |||
14 | # /etc/init.d/ssh: start and stop the OpenBSD "secure shell(tm)" daemon | ||
15 | |||
16 | test -x /usr/sbin/sshd || exit 0 | ||
17 | ( /usr/sbin/sshd -\? 2>&1 | grep -q OpenSSH ) 2>/dev/null || exit 0 | ||
18 | |||
19 | umask 022 | ||
20 | |||
21 | if test -f /etc/default/ssh; then | ||
22 | . /etc/default/ssh | ||
23 | fi | ||
24 | |||
25 | . /lib/lsb/init-functions | ||
26 | |||
27 | if [ -n "$2" ]; then | ||
28 | SSHD_OPTS="$SSHD_OPTS $2" | ||
29 | fi | ||
30 | |||
31 | # Are we running from init? | ||
32 | run_by_init() { | ||
33 | ([ "$previous" ] && [ "$runlevel" ]) || [ "$runlevel" = S ] | ||
34 | } | ||
35 | |||
36 | check_for_upstart() { | ||
37 | if init_is_upstart; then | ||
38 | exit $1 | ||
39 | fi | ||
40 | } | ||
41 | |||
42 | check_for_no_start() { | ||
43 | # forget it if we're trying to start, and /etc/ssh/sshd_not_to_be_run exists | ||
44 | if [ -e /etc/ssh/sshd_not_to_be_run ]; then | ||
45 | if [ "$1" = log_end_msg ]; then | ||
46 | log_end_msg 0 || true | ||
47 | fi | ||
48 | if ! run_by_init; then | ||
49 | log_action_msg "OpenBSD Secure Shell server not in use (/etc/ssh/sshd_not_to_be_run)" || true | ||
50 | fi | ||
51 | exit 0 | ||
52 | fi | ||
53 | } | ||
54 | |||
55 | check_dev_null() { | ||
56 | if [ ! -c /dev/null ]; then | ||
57 | if [ "$1" = log_end_msg ]; then | ||
58 | log_end_msg 1 || true | ||
59 | fi | ||
60 | if ! run_by_init; then | ||
61 | log_action_msg "/dev/null is not a character device!" || true | ||
62 | fi | ||
63 | exit 1 | ||
64 | fi | ||
65 | } | ||
66 | |||
67 | check_privsep_dir() { | ||
68 | # Create the PrivSep empty dir if necessary | ||
69 | if [ ! -d /run/sshd ]; then | ||
70 | mkdir /run/sshd | ||
71 | chmod 0755 /run/sshd | ||
72 | fi | ||
73 | } | ||
74 | |||
75 | check_config() { | ||
76 | if [ ! -e /etc/ssh/sshd_not_to_be_run ]; then | ||
77 | /usr/sbin/sshd $SSHD_OPTS -t || exit 1 | ||
78 | fi | ||
79 | } | ||
80 | |||
81 | export PATH="${PATH:+$PATH:}/usr/sbin:/sbin" | ||
82 | |||
83 | case "$1" in | ||
84 | start) | ||
85 | check_for_upstart 1 | ||
86 | check_privsep_dir | ||
87 | check_for_no_start | ||
88 | check_dev_null | ||
89 | log_daemon_msg "Starting OpenBSD Secure Shell server" "sshd" || true | ||
90 | if start-stop-daemon --start --quiet --oknodo --pidfile /run/sshd.pid --exec /usr/sbin/sshd -- $SSHD_OPTS; then | ||
91 | log_end_msg 0 || true | ||
92 | else | ||
93 | log_end_msg 1 || true | ||
94 | fi | ||
95 | ;; | ||
96 | stop) | ||
97 | check_for_upstart 0 | ||
98 | log_daemon_msg "Stopping OpenBSD Secure Shell server" "sshd" || true | ||
99 | if start-stop-daemon --stop --quiet --oknodo --pidfile /run/sshd.pid; then | ||
100 | log_end_msg 0 || true | ||
101 | else | ||
102 | log_end_msg 1 || true | ||
103 | fi | ||
104 | ;; | ||
105 | |||
106 | reload|force-reload) | ||
107 | check_for_upstart 1 | ||
108 | check_for_no_start | ||
109 | check_config | ||
110 | log_daemon_msg "Reloading OpenBSD Secure Shell server's configuration" "sshd" || true | ||
111 | if start-stop-daemon --stop --signal 1 --quiet --oknodo --pidfile /run/sshd.pid --exec /usr/sbin/sshd; then | ||
112 | log_end_msg 0 || true | ||
113 | else | ||
114 | log_end_msg 1 || true | ||
115 | fi | ||
116 | ;; | ||
117 | |||
118 | restart) | ||
119 | check_for_upstart 1 | ||
120 | check_privsep_dir | ||
121 | check_config | ||
122 | log_daemon_msg "Restarting OpenBSD Secure Shell server" "sshd" || true | ||
123 | start-stop-daemon --stop --quiet --oknodo --retry 30 --pidfile /run/sshd.pid | ||
124 | check_for_no_start log_end_msg | ||
125 | check_dev_null log_end_msg | ||
126 | if start-stop-daemon --start --quiet --oknodo --pidfile /run/sshd.pid --exec /usr/sbin/sshd -- $SSHD_OPTS; then | ||
127 | log_end_msg 0 || true | ||
128 | else | ||
129 | log_end_msg 1 || true | ||
130 | fi | ||
131 | ;; | ||
132 | |||
133 | try-restart) | ||
134 | check_for_upstart 1 | ||
135 | check_privsep_dir | ||
136 | check_config | ||
137 | log_daemon_msg "Restarting OpenBSD Secure Shell server" "sshd" || true | ||
138 | RET=0 | ||
139 | start-stop-daemon --stop --quiet --retry 30 --pidfile /run/sshd.pid || RET="$?" | ||
140 | case $RET in | ||
141 | 0) | ||
142 | # old daemon stopped | ||
143 | check_for_no_start log_end_msg | ||
144 | check_dev_null log_end_msg | ||
145 | if start-stop-daemon --start --quiet --oknodo --pidfile /run/sshd.pid --exec /usr/sbin/sshd -- $SSHD_OPTS; then | ||
146 | log_end_msg 0 || true | ||
147 | else | ||
148 | log_end_msg 1 || true | ||
149 | fi | ||
150 | ;; | ||
151 | 1) | ||
152 | # daemon not running | ||
153 | log_progress_msg "(not running)" || true | ||
154 | log_end_msg 0 || true | ||
155 | ;; | ||
156 | *) | ||
157 | # failed to stop | ||
158 | log_progress_msg "(failed to stop)" || true | ||
159 | log_end_msg 1 || true | ||
160 | ;; | ||
161 | esac | ||
162 | ;; | ||
163 | |||
164 | status) | ||
165 | check_for_upstart 1 | ||
166 | status_of_proc -p /run/sshd.pid /usr/sbin/sshd sshd && exit 0 || exit $? | ||
167 | ;; | ||
168 | |||
169 | *) | ||
170 | log_action_msg "Usage: /etc/init.d/ssh {start|stop|reload|force-reload|restart|try-restart|status}" || true | ||
171 | exit 1 | ||
172 | esac | ||
173 | |||
174 | exit 0 | ||
diff --git a/debian/openssh-server.ssh.service b/debian/openssh-server.ssh.service new file mode 120000 index 000000000..609457230 --- /dev/null +++ b/debian/openssh-server.ssh.service | |||
@@ -0,0 +1 @@ | |||
systemd/ssh.service \ No newline at end of file | |||
diff --git a/debian/openssh-server.ssh.upstart b/debian/openssh-server.ssh.upstart new file mode 100644 index 000000000..9b0e95450 --- /dev/null +++ b/debian/openssh-server.ssh.upstart | |||
@@ -0,0 +1,29 @@ | |||
1 | # ssh - OpenBSD Secure Shell server | ||
2 | # | ||
3 | # The OpenSSH server provides secure shell access to the system. | ||
4 | |||
5 | description "OpenSSH server" | ||
6 | |||
7 | start on runlevel [2345] | ||
8 | stop on runlevel [!2345] | ||
9 | |||
10 | respawn | ||
11 | respawn limit 10 5 | ||
12 | umask 022 | ||
13 | |||
14 | env SSH_SIGSTOP=1 | ||
15 | expect stop | ||
16 | |||
17 | # 'sshd -D' leaks stderr and confuses things in conjunction with 'console log' | ||
18 | console none | ||
19 | |||
20 | pre-start script | ||
21 | test -x /usr/sbin/sshd || { stop; exit 0; } | ||
22 | test -e /etc/ssh/sshd_not_to_be_run && { stop; exit 0; } | ||
23 | |||
24 | mkdir -p -m0755 /run/sshd | ||
25 | end script | ||
26 | |||
27 | # if you used to set SSHD_OPTS in /etc/default/ssh, you can change the | ||
28 | # 'exec' line here instead | ||
29 | exec /usr/sbin/sshd -D | ||
diff --git a/debian/openssh-server.sshd.pam.in b/debian/openssh-server.sshd.pam.in new file mode 100644 index 000000000..2cad67da6 --- /dev/null +++ b/debian/openssh-server.sshd.pam.in | |||
@@ -0,0 +1,55 @@ | |||
1 | # PAM configuration for the Secure Shell service | ||
2 | |||
3 | # Standard Un*x authentication. | ||
4 | @include common-auth | ||
5 | |||
6 | # Disallow non-root logins when /etc/nologin exists. | ||
7 | account required pam_nologin.so | ||
8 | |||
9 | # Uncomment and edit /etc/security/access.conf if you need to set complex | ||
10 | # access limits that are hard to express in sshd_config. | ||
11 | # account required pam_access.so | ||
12 | |||
13 | # Standard Un*x authorization. | ||
14 | @include common-account | ||
15 | |||
16 | # SELinux needs to be the first session rule. This ensures that any | ||
17 | # lingering context has been cleared. Without this it is possible that a | ||
18 | # module could execute code in the wrong domain. | ||
19 | session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close | ||
20 | |||
21 | # Set the loginuid process attribute. | ||
22 | session required pam_loginuid.so | ||
23 | |||
24 | @IF_KEYINIT@# Create a new session keyring. | ||
25 | @IF_KEYINIT@session optional pam_keyinit.so force revoke | ||
26 | |||
27 | # Standard Un*x session setup and teardown. | ||
28 | @include common-session | ||
29 | |||
30 | # Print the message of the day upon successful login. | ||
31 | # This includes a dynamically generated part from /run/motd.dynamic | ||
32 | # and a static (admin-editable) part from /etc/motd. | ||
33 | session optional pam_motd.so motd=/run/motd.dynamic | ||
34 | session optional pam_motd.so noupdate | ||
35 | |||
36 | # Print the status of the user's mailbox upon successful login. | ||
37 | session optional pam_mail.so standard noenv # [1] | ||
38 | |||
39 | # Set up user limits from /etc/security/limits.conf. | ||
40 | session required pam_limits.so | ||
41 | |||
42 | # Read environment variables from /etc/environment and | ||
43 | # /etc/security/pam_env.conf. | ||
44 | session required pam_env.so # [1] | ||
45 | # In Debian 4.0 (etch), locale-related environment variables were moved to | ||
46 | # /etc/default/locale, so read that as well. | ||
47 | session required pam_env.so user_readenv=1 envfile=/etc/default/locale | ||
48 | |||
49 | # SELinux needs to intervene at login time to ensure that the process starts | ||
50 | # in the proper default security context. Only sessions which are intended | ||
51 | # to run in the user's context should be run after this. | ||
52 | session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open | ||
53 | |||
54 | # Standard Un*x password updating. | ||
55 | @include common-password | ||
diff --git a/debian/openssh-server.templates b/debian/openssh-server.templates new file mode 100644 index 000000000..27907f25d --- /dev/null +++ b/debian/openssh-server.templates | |||
@@ -0,0 +1,15 @@ | |||
1 | Template: openssh-server/permit-root-login | ||
2 | Type: boolean | ||
3 | Default: true | ||
4 | _Description: Disable SSH password authentication for root? | ||
5 | Previous versions of openssh-server permitted logging in as root over SSH | ||
6 | using password authentication. The default for new installations is now | ||
7 | "PermitRootLogin prohibit-password", which disables password authentication | ||
8 | for root without breaking systems that have explicitly configured SSH | ||
9 | public key authentication for root. | ||
10 | . | ||
11 | This change makes systems more secure against brute-force password | ||
12 | dictionary attacks on the root user (a very common target for such | ||
13 | attacks). However, it may break systems that are set up with the | ||
14 | expectation of being able to SSH as root using password authentication. You | ||
15 | should only make this change if you do not need to do that. | ||
diff --git a/debian/openssh-server.ucf-md5sum b/debian/openssh-server.ucf-md5sum new file mode 100644 index 000000000..c9c89d429 --- /dev/null +++ b/debian/openssh-server.ucf-md5sum | |||
@@ -0,0 +1,48 @@ | |||
1 | # Historical md5sums of the default /etc/ssh/sshd_config up to and including | ||
2 | # 1:7.3p1-5. | ||
3 | 0d06fc337cee10609d4833dc88df740f | ||
4 | 10dc68360f6658910a98a051273de22c | ||
5 | 11f9e107b4d13bbcabe7f8e8da734371 | ||
6 | 16c827adcff44efaca05ec5eea6383d7 | ||
7 | 2eeff28468576c3f2e538314e177687b | ||
8 | 386c8b9079625b78f6d624ae506958ae | ||
9 | 38fc7b31b3e3078848f0eec457d3e050 | ||
10 | 395c5e13801f9b4f17c2cb54aa634fbd | ||
11 | 423d5796cee663af2d0f24c4d520b578 | ||
12 | 42be2cb5b64bc91443b2e46969d2d539 | ||
13 | 42cd8b7c5ea9e440d3efa50b9a1bb444 | ||
14 | 4f56ca8d0b5dfdaeb732becd3292ce5d | ||
15 | 54998a682a97af8449e9de0316eacf1d | ||
16 | 5c0bdc1735accbdc062381149937ec4a | ||
17 | 6357b54acf8e089c57544e06d1bbec53 | ||
18 | 6a621d8bc448987e5a8a613c40307a4c | ||
19 | 702a79962e60aa17c6d3df742e8ec670 | ||
20 | 7a69eff91ec92b4e065b8dd8846366b2 | ||
21 | 7c60e22f183b6219c684f15ce24153fd | ||
22 | 8304e780c43d4a606f695c8965f48299 | ||
23 | 8b9e70ee87f4b822714e2ed7af5b70dc | ||
24 | 8caefdd9e251b7cc1baa37874149a870 | ||
25 | 90baeb1c778464d2da610f8268939719 | ||
26 | 962a382e51f43f80109131838ca326ba | ||
27 | 96eaf22faba705a37905282f6ad69d64 | ||
28 | 9cb6cd83be1c21f73476be629b163c01 | ||
29 | a07a9865cd33b85a1426cd67954c6fa0 | ||
30 | ae1e844b43986e2a964cf84f46b50c5b | ||
31 | b516afa5a1e298f4cd00952b36dd623f | ||
32 | b69fc974ee9b5a111bd473ef54cdd232 | ||
33 | ba9c3f808c811d6f944ad10a508c4767 | ||
34 | bccf9af9c7027afd0895d8ff8e02761a | ||
35 | bd3a2b95f8b4b180eed707794ad81e4d | ||
36 | c34586b56496f81a10615c002685fc74 | ||
37 | c47555a21189a6b703d2c5d37d2c50ed | ||
38 | cac079e87c0ae0d77eafc9b285e36348 | ||
39 | d224f92823483333432974f63cb6dc66 | ||
40 | d50ef9ef2aa51cb9f808f6a776260c0a | ||
41 | e0029e1e9871d4d2b673ee6d70a38614 | ||
42 | e086e7eb521ccc5776371b2e198f0702 | ||
43 | e101f74dc7381527e9aefa1f78b01a7f | ||
44 | e24f749808133a27d94fda84a89bb27b | ||
45 | ec16c3dd0203f13885d74ce529719fda | ||
46 | efcff5380823d4e3f5039620c2e08459 | ||
47 | f58056370a64dbd2017d7486421c281d | ||
48 | fe396d52df77f1fbf710591d4dbf3311 | ||
diff --git a/debian/openssh-server.ufw.profile b/debian/openssh-server.ufw.profile new file mode 100644 index 000000000..9bbe906bc --- /dev/null +++ b/debian/openssh-server.ufw.profile | |||
@@ -0,0 +1,4 @@ | |||
1 | [OpenSSH] | ||
2 | title=Secure shell server, an rshd replacement | ||
3 | description=OpenSSH is a free implementation of the Secure Shell protocol. | ||
4 | ports=22/tcp | ||
diff --git a/debian/openssh-sftp-server.install b/debian/openssh-sftp-server.install new file mode 100644 index 000000000..25b12dc09 --- /dev/null +++ b/debian/openssh-sftp-server.install | |||
@@ -0,0 +1,2 @@ | |||
1 | usr/lib/openssh/sftp-server | ||
2 | usr/share/man/man8/sftp-server.8 | ||
diff --git a/debian/openssh-sftp-server.links b/debian/openssh-sftp-server.links new file mode 100644 index 000000000..2d98b1dcb --- /dev/null +++ b/debian/openssh-sftp-server.links | |||
@@ -0,0 +1 @@ | |||
usr/lib/openssh/sftp-server usr/lib/sftp-server | |||
diff --git a/debian/patches/auth-log-verbosity.patch b/debian/patches/auth-log-verbosity.patch new file mode 100644 index 000000000..cf6febf31 --- /dev/null +++ b/debian/patches/auth-log-verbosity.patch | |||
@@ -0,0 +1,119 @@ | |||
1 | From b2b04daa38b264f346acd81e08d224dbf33bac5b Mon Sep 17 00:00:00 2001 | ||
2 | From: Colin Watson <cjwatson@debian.org> | ||
3 | Date: Sun, 9 Feb 2014 16:10:02 +0000 | ||
4 | Subject: Quieten logs when multiple from= restrictions are used | ||
5 | |||
6 | Bug-Debian: http://bugs.debian.org/630606 | ||
7 | Forwarded: no | ||
8 | Last-Update: 2013-09-14 | ||
9 | |||
10 | Patch-Name: auth-log-verbosity.patch | ||
11 | --- | ||
12 | auth-options.c | 35 ++++++++++++++++++++++++++--------- | ||
13 | auth-options.h | 1 + | ||
14 | auth2-pubkey.c | 3 +++ | ||
15 | 3 files changed, 30 insertions(+), 9 deletions(-) | ||
16 | |||
17 | diff --git a/auth-options.c b/auth-options.c | ||
18 | index 57b49f7f..7eb87b35 100644 | ||
19 | --- a/auth-options.c | ||
20 | +++ b/auth-options.c | ||
21 | @@ -59,9 +59,20 @@ int forced_tun_device = -1; | ||
22 | /* "principals=" option. */ | ||
23 | char *authorized_principals = NULL; | ||
24 | |||
25 | +/* Throttle log messages. */ | ||
26 | +int logged_from_hostip = 0; | ||
27 | +int logged_cert_hostip = 0; | ||
28 | + | ||
29 | extern ServerOptions options; | ||
30 | |||
31 | void | ||
32 | +auth_start_parse_options(void) | ||
33 | +{ | ||
34 | + logged_from_hostip = 0; | ||
35 | + logged_cert_hostip = 0; | ||
36 | +} | ||
37 | + | ||
38 | +void | ||
39 | auth_clear_options(void) | ||
40 | { | ||
41 | no_agent_forwarding_flag = 0; | ||
42 | @@ -316,10 +327,13 @@ auth_parse_options(struct passwd *pw, char *opts, char *file, u_long linenum) | ||
43 | /* FALLTHROUGH */ | ||
44 | case 0: | ||
45 | free(patterns); | ||
46 | - logit("Authentication tried for %.100s with " | ||
47 | - "correct key but not from a permitted " | ||
48 | - "host (host=%.200s, ip=%.200s).", | ||
49 | - pw->pw_name, remote_host, remote_ip); | ||
50 | + if (!logged_from_hostip) { | ||
51 | + logit("Authentication tried for %.100s with " | ||
52 | + "correct key but not from a permitted " | ||
53 | + "host (host=%.200s, ip=%.200s).", | ||
54 | + pw->pw_name, remote_host, remote_ip); | ||
55 | + logged_from_hostip = 1; | ||
56 | + } | ||
57 | auth_debug_add("Your host '%.200s' is not " | ||
58 | "permitted to use this key for login.", | ||
59 | remote_host); | ||
60 | @@ -543,11 +557,14 @@ parse_option_list(struct sshbuf *oblob, struct passwd *pw, | ||
61 | break; | ||
62 | case 0: | ||
63 | /* no match */ | ||
64 | - logit("Authentication tried for %.100s " | ||
65 | - "with valid certificate but not " | ||
66 | - "from a permitted host " | ||
67 | - "(ip=%.200s).", pw->pw_name, | ||
68 | - remote_ip); | ||
69 | + if (!logged_cert_hostip) { | ||
70 | + logit("Authentication tried for %.100s " | ||
71 | + "with valid certificate but not " | ||
72 | + "from a permitted host " | ||
73 | + "(ip=%.200s).", pw->pw_name, | ||
74 | + remote_ip); | ||
75 | + logged_cert_hostip = 1; | ||
76 | + } | ||
77 | auth_debug_add("Your address '%.200s' " | ||
78 | "is not permitted to use this " | ||
79 | "certificate for login.", | ||
80 | diff --git a/auth-options.h b/auth-options.h | ||
81 | index 52cbb42a..82355276 100644 | ||
82 | --- a/auth-options.h | ||
83 | +++ b/auth-options.h | ||
84 | @@ -33,6 +33,7 @@ extern int forced_tun_device; | ||
85 | extern int key_is_cert_authority; | ||
86 | extern char *authorized_principals; | ||
87 | |||
88 | +void auth_start_parse_options(void); | ||
89 | int auth_parse_options(struct passwd *, char *, char *, u_long); | ||
90 | void auth_clear_options(void); | ||
91 | int auth_cert_options(struct sshkey *, struct passwd *, const char **); | ||
92 | diff --git a/auth2-pubkey.c b/auth2-pubkey.c | ||
93 | index 20f3309e..add77136 100644 | ||
94 | --- a/auth2-pubkey.c | ||
95 | +++ b/auth2-pubkey.c | ||
96 | @@ -566,6 +566,7 @@ process_principals(FILE *f, char *file, struct passwd *pw, | ||
97 | u_long linenum = 0; | ||
98 | u_int i; | ||
99 | |||
100 | + auth_start_parse_options(); | ||
101 | while (read_keyfile_line(f, file, line, sizeof(line), &linenum) != -1) { | ||
102 | /* Skip leading whitespace. */ | ||
103 | for (cp = line; *cp == ' ' || *cp == '\t'; cp++) | ||
104 | @@ -764,6 +765,7 @@ check_authkeys_file(FILE *f, char *file, Key* key, struct passwd *pw) | ||
105 | found_key = 0; | ||
106 | |||
107 | found = NULL; | ||
108 | + auth_start_parse_options(); | ||
109 | while (read_keyfile_line(f, file, line, sizeof(line), &linenum) != -1) { | ||
110 | char *cp, *key_options = NULL, *fp = NULL; | ||
111 | const char *reason = NULL; | ||
112 | @@ -911,6 +913,7 @@ user_cert_trusted_ca(struct passwd *pw, Key *key) | ||
113 | if (key_cert_check_authority(key, 0, 1, | ||
114 | use_authorized_principals ? NULL : pw->pw_name, &reason) != 0) | ||
115 | goto fail_reason; | ||
116 | + auth_start_parse_options(); | ||
117 | if (auth_cert_options(key, pw, &reason) != 0) | ||
118 | goto fail_reason; | ||
119 | |||
diff --git a/debian/patches/authorized-keys-man-symlink.patch b/debian/patches/authorized-keys-man-symlink.patch new file mode 100644 index 000000000..a3306e339 --- /dev/null +++ b/debian/patches/authorized-keys-man-symlink.patch | |||
@@ -0,0 +1,26 @@ | |||
1 | From 7ad6dd01af3f4531ccc8e918bc857738e195fd3d Mon Sep 17 00:00:00 2001 | ||
2 | From: Tomas Pospisek <tpo_deb@sourcepole.ch> | ||
3 | Date: Sun, 9 Feb 2014 16:10:07 +0000 | ||
4 | Subject: Install authorized_keys(5) as a symlink to sshd(8) | ||
5 | |||
6 | Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1720 | ||
7 | Bug-Debian: http://bugs.debian.org/441817 | ||
8 | Last-Update: 2013-09-14 | ||
9 | |||
10 | Patch-Name: authorized-keys-man-symlink.patch | ||
11 | --- | ||
12 | Makefile.in | 1 + | ||
13 | 1 file changed, 1 insertion(+) | ||
14 | |||
15 | diff --git a/Makefile.in b/Makefile.in | ||
16 | index 00a320e1..a6eb81ec 100644 | ||
17 | --- a/Makefile.in | ||
18 | +++ b/Makefile.in | ||
19 | @@ -335,6 +335,7 @@ install-files: | ||
20 | $(INSTALL) -m 644 sshd_config.5.out $(DESTDIR)$(mandir)/$(mansubdir)5/sshd_config.5 | ||
21 | $(INSTALL) -m 644 ssh_config.5.out $(DESTDIR)$(mandir)/$(mansubdir)5/ssh_config.5 | ||
22 | $(INSTALL) -m 644 sshd.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sshd.8 | ||
23 | + ln -s ../$(mansubdir)8/sshd.8 $(DESTDIR)$(mandir)/$(mansubdir)5/authorized_keys.5 | ||
24 | $(INSTALL) -m 644 sftp.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/sftp.1 | ||
25 | $(INSTALL) -m 644 sftp-server.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8 | ||
26 | $(INSTALL) -m 644 ssh-keysign.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8 | ||
diff --git a/debian/patches/debian-banner.patch b/debian/patches/debian-banner.patch new file mode 100644 index 000000000..874728b02 --- /dev/null +++ b/debian/patches/debian-banner.patch | |||
@@ -0,0 +1,111 @@ | |||
1 | From 2a1aeb898e4214f98acc210c992d33334e6710dd Mon Sep 17 00:00:00 2001 | ||
2 | From: Kees Cook <kees@debian.org> | ||
3 | Date: Sun, 9 Feb 2014 16:10:06 +0000 | ||
4 | Subject: Add DebianBanner server configuration option | ||
5 | |||
6 | Setting this to "no" causes sshd to omit the Debian revision from its | ||
7 | initial protocol handshake, for those scared by package-versioning.patch. | ||
8 | |||
9 | Bug-Debian: http://bugs.debian.org/562048 | ||
10 | Forwarded: not-needed | ||
11 | Last-Update: 2015-11-29 | ||
12 | |||
13 | Patch-Name: debian-banner.patch | ||
14 | --- | ||
15 | servconf.c | 9 +++++++++ | ||
16 | servconf.h | 2 ++ | ||
17 | sshd.c | 3 ++- | ||
18 | sshd_config.5 | 5 +++++ | ||
19 | 4 files changed, 18 insertions(+), 1 deletion(-) | ||
20 | |||
21 | diff --git a/servconf.c b/servconf.c | ||
22 | index 49d3bdc8..1cee3d6c 100644 | ||
23 | --- a/servconf.c | ||
24 | +++ b/servconf.c | ||
25 | @@ -166,6 +166,7 @@ initialize_server_options(ServerOptions *options) | ||
26 | options->version_addendum = NULL; | ||
27 | options->fingerprint_hash = -1; | ||
28 | options->disable_forwarding = -1; | ||
29 | + options->debian_banner = -1; | ||
30 | } | ||
31 | |||
32 | /* Returns 1 if a string option is unset or set to "none" or 0 otherwise. */ | ||
33 | @@ -339,6 +340,8 @@ fill_default_server_options(ServerOptions *options) | ||
34 | options->fingerprint_hash = SSH_FP_HASH_DEFAULT; | ||
35 | if (options->disable_forwarding == -1) | ||
36 | options->disable_forwarding = 0; | ||
37 | + if (options->debian_banner == -1) | ||
38 | + options->debian_banner = 1; | ||
39 | |||
40 | assemble_algorithms(options); | ||
41 | |||
42 | @@ -425,6 +428,7 @@ typedef enum { | ||
43 | sAuthenticationMethods, sHostKeyAgent, sPermitUserRC, | ||
44 | sStreamLocalBindMask, sStreamLocalBindUnlink, | ||
45 | sAllowStreamLocalForwarding, sFingerprintHash, sDisableForwarding, | ||
46 | + sDebianBanner, | ||
47 | sDeprecated, sIgnore, sUnsupported | ||
48 | } ServerOpCodes; | ||
49 | |||
50 | @@ -577,6 +581,7 @@ static struct { | ||
51 | { "allowstreamlocalforwarding", sAllowStreamLocalForwarding, SSHCFG_ALL }, | ||
52 | { "fingerprinthash", sFingerprintHash, SSHCFG_GLOBAL }, | ||
53 | { "disableforwarding", sDisableForwarding, SSHCFG_ALL }, | ||
54 | + { "debianbanner", sDebianBanner, SSHCFG_GLOBAL }, | ||
55 | { NULL, sBadOption, 0 } | ||
56 | }; | ||
57 | |||
58 | @@ -1860,6 +1865,10 @@ process_server_config_line(ServerOptions *options, char *line, | ||
59 | options->fingerprint_hash = value; | ||
60 | break; | ||
61 | |||
62 | + case sDebianBanner: | ||
63 | + intptr = &options->debian_banner; | ||
64 | + goto parse_int; | ||
65 | + | ||
66 | case sDeprecated: | ||
67 | case sIgnore: | ||
68 | case sUnsupported: | ||
69 | diff --git a/servconf.h b/servconf.h | ||
70 | index 90dfa4c2..913a21b3 100644 | ||
71 | --- a/servconf.h | ||
72 | +++ b/servconf.h | ||
73 | @@ -191,6 +191,8 @@ typedef struct { | ||
74 | char *auth_methods[MAX_AUTH_METHODS]; | ||
75 | |||
76 | int fingerprint_hash; | ||
77 | + | ||
78 | + int debian_banner; | ||
79 | } ServerOptions; | ||
80 | |||
81 | /* Information about the incoming connection as used by Match */ | ||
82 | diff --git a/sshd.c b/sshd.c | ||
83 | index 49f3a2e5..eebf1984 100644 | ||
84 | --- a/sshd.c | ||
85 | +++ b/sshd.c | ||
86 | @@ -378,7 +378,8 @@ sshd_exchange_identification(struct ssh *ssh, int sock_in, int sock_out) | ||
87 | char remote_version[256]; /* Must be at least as big as buf. */ | ||
88 | |||
89 | xasprintf(&server_version_string, "SSH-%d.%d-%.100s%s%s%s", | ||
90 | - PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE, | ||
91 | + PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, | ||
92 | + options.debian_banner ? SSH_RELEASE : SSH_RELEASE_MINIMUM, | ||
93 | *options.version_addendum == '\0' ? "" : " ", | ||
94 | options.version_addendum, newline); | ||
95 | |||
96 | diff --git a/sshd_config.5 b/sshd_config.5 | ||
97 | index 283ba889..4ea0a9c3 100644 | ||
98 | --- a/sshd_config.5 | ||
99 | +++ b/sshd_config.5 | ||
100 | @@ -526,6 +526,11 @@ or | ||
101 | .Cm no . | ||
102 | The default is | ||
103 | .Cm yes . | ||
104 | +.It Cm DebianBanner | ||
105 | +Specifies whether the distribution-specified extra version suffix is | ||
106 | +included during initial protocol handshake. | ||
107 | +The default is | ||
108 | +.Cm yes . | ||
109 | .It Cm DenyGroups | ||
110 | This keyword can be followed by a list of group name patterns, separated | ||
111 | by spaces. | ||
diff --git a/debian/patches/debian-config.patch b/debian/patches/debian-config.patch new file mode 100644 index 000000000..ff3f5f42d --- /dev/null +++ b/debian/patches/debian-config.patch | |||
@@ -0,0 +1,238 @@ | |||
1 | From 2b53482aec037f0747198f19e449f51d921acd30 Mon Sep 17 00:00:00 2001 | ||
2 | From: Colin Watson <cjwatson@debian.org> | ||
3 | Date: Sun, 9 Feb 2014 16:10:18 +0000 | ||
4 | Subject: Various Debian-specific configuration changes | ||
5 | |||
6 | ssh: Enable ForwardX11Trusted, returning to earlier semantics which cause | ||
7 | fewer problems with existing setups (http://bugs.debian.org/237021). | ||
8 | |||
9 | ssh: Set 'SendEnv LANG LC_*' by default (http://bugs.debian.org/264024). | ||
10 | |||
11 | ssh: Enable HashKnownHosts by default to try to limit the spread of ssh | ||
12 | worms. | ||
13 | |||
14 | ssh: Enable GSSAPIAuthentication by default. | ||
15 | |||
16 | sshd: Enable PAM, disable ChallengeResponseAuthentication, and disable | ||
17 | PrintMotd. | ||
18 | |||
19 | sshd: Enable X11Forwarding. | ||
20 | |||
21 | sshd: Set 'AcceptEnv LANG LC_*' by default. | ||
22 | |||
23 | sshd: Change sftp subsystem path to /usr/lib/openssh/sftp-server. | ||
24 | |||
25 | Document all of this. | ||
26 | |||
27 | Author: Russ Allbery <rra@debian.org> | ||
28 | Forwarded: not-needed | ||
29 | Last-Update: 2016-12-26 | ||
30 | |||
31 | Patch-Name: debian-config.patch | ||
32 | --- | ||
33 | readconf.c | 2 +- | ||
34 | ssh.1 | 21 +++++++++++++++++++++ | ||
35 | ssh_config | 6 +++++- | ||
36 | ssh_config.5 | 19 ++++++++++++++++++- | ||
37 | sshd_config | 16 ++++++++++------ | ||
38 | sshd_config.5 | 22 ++++++++++++++++++++++ | ||
39 | 6 files changed, 77 insertions(+), 9 deletions(-) | ||
40 | |||
41 | diff --git a/readconf.c b/readconf.c | ||
42 | index c02cdf63..d1091cbd 100644 | ||
43 | --- a/readconf.c | ||
44 | +++ b/readconf.c | ||
45 | @@ -1927,7 +1927,7 @@ fill_default_options(Options * options) | ||
46 | if (options->forward_x11 == -1) | ||
47 | options->forward_x11 = 0; | ||
48 | if (options->forward_x11_trusted == -1) | ||
49 | - options->forward_x11_trusted = 0; | ||
50 | + options->forward_x11_trusted = 1; | ||
51 | if (options->forward_x11_timeout == -1) | ||
52 | options->forward_x11_timeout = 1200; | ||
53 | /* | ||
54 | diff --git a/ssh.1 b/ssh.1 | ||
55 | index 22e56a7b..6aa57c46 100644 | ||
56 | --- a/ssh.1 | ||
57 | +++ b/ssh.1 | ||
58 | @@ -785,6 +785,16 @@ directive in | ||
59 | .Xr ssh_config 5 | ||
60 | for more information. | ||
61 | .Pp | ||
62 | +(Debian-specific: X11 forwarding is not subjected to X11 SECURITY extension | ||
63 | +restrictions by default, because too many programs currently crash in this | ||
64 | +mode. | ||
65 | +Set the | ||
66 | +.Cm ForwardX11Trusted | ||
67 | +option to | ||
68 | +.Dq no | ||
69 | +to restore the upstream behaviour. | ||
70 | +This may change in future depending on client-side improvements.) | ||
71 | +.Pp | ||
72 | .It Fl x | ||
73 | Disables X11 forwarding. | ||
74 | .Pp | ||
75 | @@ -793,6 +803,17 @@ Enables trusted X11 forwarding. | ||
76 | Trusted X11 forwardings are not subjected to the X11 SECURITY extension | ||
77 | controls. | ||
78 | .Pp | ||
79 | +(Debian-specific: This option does nothing in the default configuration: it | ||
80 | +is equivalent to | ||
81 | +.Dq Cm ForwardX11Trusted No yes , | ||
82 | +which is the default as described above. | ||
83 | +Set the | ||
84 | +.Cm ForwardX11Trusted | ||
85 | +option to | ||
86 | +.Dq no | ||
87 | +to restore the upstream behaviour. | ||
88 | +This may change in future depending on client-side improvements.) | ||
89 | +.Pp | ||
90 | .It Fl y | ||
91 | Send log information using the | ||
92 | .Xr syslog 3 | ||
93 | diff --git a/ssh_config b/ssh_config | ||
94 | index 4e879cd2..093c8366 100644 | ||
95 | --- a/ssh_config | ||
96 | +++ b/ssh_config | ||
97 | @@ -17,9 +17,10 @@ | ||
98 | # list of available options, their meanings and defaults, please see the | ||
99 | # ssh_config(5) man page. | ||
100 | |||
101 | -# Host * | ||
102 | +Host * | ||
103 | # ForwardAgent no | ||
104 | # ForwardX11 no | ||
105 | +# ForwardX11Trusted yes | ||
106 | # RhostsRSAAuthentication no | ||
107 | # RSAAuthentication yes | ||
108 | # PasswordAuthentication yes | ||
109 | @@ -50,3 +51,6 @@ | ||
110 | # VisualHostKey no | ||
111 | # ProxyCommand ssh -q -W %h:%p gateway.example.com | ||
112 | # RekeyLimit 1G 1h | ||
113 | + SendEnv LANG LC_* | ||
114 | + HashKnownHosts yes | ||
115 | + GSSAPIAuthentication yes | ||
116 | diff --git a/ssh_config.5 b/ssh_config.5 | ||
117 | index 8698c28e..26f983a3 100644 | ||
118 | --- a/ssh_config.5 | ||
119 | +++ b/ssh_config.5 | ||
120 | @@ -74,6 +74,22 @@ Since the first obtained value for each parameter is used, more | ||
121 | host-specific declarations should be given near the beginning of the | ||
122 | file, and general defaults at the end. | ||
123 | .Pp | ||
124 | +Note that the Debian | ||
125 | +.Ic openssh-client | ||
126 | +package sets several options as standard in | ||
127 | +.Pa /etc/ssh/ssh_config | ||
128 | +which are not the default in | ||
129 | +.Xr ssh 1 : | ||
130 | +.Pp | ||
131 | +.Bl -bullet -offset indent -compact | ||
132 | +.It | ||
133 | +.Cm SendEnv No LANG LC_* | ||
134 | +.It | ||
135 | +.Cm HashKnownHosts No yes | ||
136 | +.It | ||
137 | +.Cm GSSAPIAuthentication No yes | ||
138 | +.El | ||
139 | +.Pp | ||
140 | The file contains keyword-argument pairs, one per line. | ||
141 | Lines starting with | ||
142 | .Ql # | ||
143 | @@ -711,11 +727,12 @@ elapsed. | ||
144 | .It Cm ForwardX11Trusted | ||
145 | If this option is set to | ||
146 | .Cm yes , | ||
147 | +(the Debian-specific default), | ||
148 | remote X11 clients will have full access to the original X11 display. | ||
149 | .Pp | ||
150 | If this option is set to | ||
151 | .Cm no | ||
152 | -(the default), | ||
153 | +(the upstream default), | ||
154 | remote X11 clients will be considered untrusted and prevented | ||
155 | from stealing or tampering with data belonging to trusted X11 | ||
156 | clients. | ||
157 | diff --git a/sshd_config b/sshd_config | ||
158 | index 00e5a728..13cbe2c6 100644 | ||
159 | --- a/sshd_config | ||
160 | +++ b/sshd_config | ||
161 | @@ -58,8 +58,9 @@ AuthorizedKeysFile .ssh/authorized_keys | ||
162 | #PasswordAuthentication yes | ||
163 | #PermitEmptyPasswords no | ||
164 | |||
165 | -# Change to no to disable s/key passwords | ||
166 | -#ChallengeResponseAuthentication yes | ||
167 | +# Change to yes to enable challenge-response passwords (beware issues with | ||
168 | +# some PAM modules and threads) | ||
169 | +ChallengeResponseAuthentication no | ||
170 | |||
171 | # Kerberos options | ||
172 | #KerberosAuthentication no | ||
173 | @@ -82,16 +83,16 @@ AuthorizedKeysFile .ssh/authorized_keys | ||
174 | # If you just want the PAM account and session checks to run without | ||
175 | # PAM authentication, then enable this but set PasswordAuthentication | ||
176 | # and ChallengeResponseAuthentication to 'no'. | ||
177 | -#UsePAM no | ||
178 | +UsePAM yes | ||
179 | |||
180 | #AllowAgentForwarding yes | ||
181 | #AllowTcpForwarding yes | ||
182 | #GatewayPorts no | ||
183 | -#X11Forwarding no | ||
184 | +X11Forwarding yes | ||
185 | #X11DisplayOffset 10 | ||
186 | #X11UseLocalhost yes | ||
187 | #PermitTTY yes | ||
188 | -#PrintMotd yes | ||
189 | +PrintMotd no | ||
190 | #PrintLastLog yes | ||
191 | #TCPKeepAlive yes | ||
192 | #UseLogin no | ||
193 | @@ -110,8 +111,11 @@ AuthorizedKeysFile .ssh/authorized_keys | ||
194 | # no default banner path | ||
195 | #Banner none | ||
196 | |||
197 | +# Allow client to pass locale environment variables | ||
198 | +AcceptEnv LANG LC_* | ||
199 | + | ||
200 | # override default of no subsystems | ||
201 | -Subsystem sftp /usr/libexec/sftp-server | ||
202 | +Subsystem sftp /usr/lib/openssh/sftp-server | ||
203 | |||
204 | # Example of overriding settings on a per-user basis | ||
205 | #Match User anoncvs | ||
206 | diff --git a/sshd_config.5 b/sshd_config.5 | ||
207 | index e45a8937..703a9cdd 100644 | ||
208 | --- a/sshd_config.5 | ||
209 | +++ b/sshd_config.5 | ||
210 | @@ -57,6 +57,28 @@ Arguments may optionally be enclosed in double quotes | ||
211 | .Pq \&" | ||
212 | in order to represent arguments containing spaces. | ||
213 | .Pp | ||
214 | +Note that the Debian | ||
215 | +.Ic openssh-server | ||
216 | +package sets several options as standard in | ||
217 | +.Pa /etc/ssh/sshd_config | ||
218 | +which are not the default in | ||
219 | +.Xr sshd 8 : | ||
220 | +.Pp | ||
221 | +.Bl -bullet -offset indent -compact | ||
222 | +.It | ||
223 | +.Cm ChallengeResponseAuthentication No no | ||
224 | +.It | ||
225 | +.Cm X11Forwarding No yes | ||
226 | +.It | ||
227 | +.Cm PrintMotd No no | ||
228 | +.It | ||
229 | +.Cm AcceptEnv No LANG LC_* | ||
230 | +.It | ||
231 | +.Cm Subsystem No sftp /usr/lib/openssh/sftp-server | ||
232 | +.It | ||
233 | +.Cm UsePAM No yes | ||
234 | +.El | ||
235 | +.Pp | ||
236 | The possible | ||
237 | keywords and their meanings are as follows (note that | ||
238 | keywords are case-insensitive and arguments are case-sensitive): | ||
diff --git a/debian/patches/dnssec-sshfp.patch b/debian/patches/dnssec-sshfp.patch new file mode 100644 index 000000000..2e2f9610d --- /dev/null +++ b/debian/patches/dnssec-sshfp.patch | |||
@@ -0,0 +1,94 @@ | |||
1 | From c1248ea6dcbbf5702d65efc1750763f66a97ba19 Mon Sep 17 00:00:00 2001 | ||
2 | From: Colin Watson <cjwatson@debian.org> | ||
3 | Date: Sun, 9 Feb 2014 16:10:01 +0000 | ||
4 | Subject: Force use of DNSSEC even if "options edns0" isn't in resolv.conf | ||
5 | |||
6 | This allows SSHFP DNS records to be verified if glibc 2.11 is installed. | ||
7 | |||
8 | Origin: vendor, https://cvs.fedoraproject.org/viewvc/F-12/openssh/openssh-5.2p1-edns.patch?revision=1.1&view=markup | ||
9 | Bug: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=572049 | ||
10 | Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=572049 | ||
11 | Last-Update: 2010-04-06 | ||
12 | |||
13 | Patch-Name: dnssec-sshfp.patch | ||
14 | --- | ||
15 | dns.c | 14 +++++++++++++- | ||
16 | openbsd-compat/getrrsetbyname.c | 10 +++++----- | ||
17 | openbsd-compat/getrrsetbyname.h | 3 +++ | ||
18 | 3 files changed, 21 insertions(+), 6 deletions(-) | ||
19 | |||
20 | diff --git a/dns.c b/dns.c | ||
21 | index e813afea..fce2e308 100644 | ||
22 | --- a/dns.c | ||
23 | +++ b/dns.c | ||
24 | @@ -206,6 +206,7 @@ verify_host_key_dns(const char *hostname, struct sockaddr *address, | ||
25 | { | ||
26 | u_int counter; | ||
27 | int result; | ||
28 | + unsigned int rrset_flags = 0; | ||
29 | struct rrsetinfo *fingerprints = NULL; | ||
30 | |||
31 | u_int8_t hostkey_algorithm; | ||
32 | @@ -229,8 +230,19 @@ verify_host_key_dns(const char *hostname, struct sockaddr *address, | ||
33 | return -1; | ||
34 | } | ||
35 | |||
36 | + /* | ||
37 | + * Original getrrsetbyname function, found on OpenBSD for example, | ||
38 | + * doesn't accept any flag and prerequisite for obtaining AD bit in | ||
39 | + * DNS response is set by "options edns0" in resolv.conf. | ||
40 | + * | ||
41 | + * Our version is more clever and use RRSET_FORCE_EDNS0 flag. | ||
42 | + */ | ||
43 | +#ifndef HAVE_GETRRSETBYNAME | ||
44 | + rrset_flags |= RRSET_FORCE_EDNS0; | ||
45 | +#endif | ||
46 | result = getrrsetbyname(hostname, DNS_RDATACLASS_IN, | ||
47 | - DNS_RDATATYPE_SSHFP, 0, &fingerprints); | ||
48 | + DNS_RDATATYPE_SSHFP, rrset_flags, &fingerprints); | ||
49 | + | ||
50 | if (result) { | ||
51 | verbose("DNS lookup error: %s", dns_result_totext(result)); | ||
52 | return -1; | ||
53 | diff --git a/openbsd-compat/getrrsetbyname.c b/openbsd-compat/getrrsetbyname.c | ||
54 | index dc6fe053..e061a290 100644 | ||
55 | --- a/openbsd-compat/getrrsetbyname.c | ||
56 | +++ b/openbsd-compat/getrrsetbyname.c | ||
57 | @@ -209,8 +209,8 @@ getrrsetbyname(const char *hostname, unsigned int rdclass, | ||
58 | goto fail; | ||
59 | } | ||
60 | |||
61 | - /* don't allow flags yet, unimplemented */ | ||
62 | - if (flags) { | ||
63 | + /* Allow RRSET_FORCE_EDNS0 flag only. */ | ||
64 | + if ((flags & !RRSET_FORCE_EDNS0) != 0) { | ||
65 | result = ERRSET_INVAL; | ||
66 | goto fail; | ||
67 | } | ||
68 | @@ -226,9 +226,9 @@ getrrsetbyname(const char *hostname, unsigned int rdclass, | ||
69 | #endif /* DEBUG */ | ||
70 | |||
71 | #ifdef RES_USE_DNSSEC | ||
72 | - /* turn on DNSSEC if EDNS0 is configured */ | ||
73 | - if (_resp->options & RES_USE_EDNS0) | ||
74 | - _resp->options |= RES_USE_DNSSEC; | ||
75 | + /* turn on DNSSEC if required */ | ||
76 | + if (flags & RRSET_FORCE_EDNS0) | ||
77 | + _resp->options |= (RES_USE_EDNS0|RES_USE_DNSSEC); | ||
78 | #endif /* RES_USE_DNSEC */ | ||
79 | |||
80 | /* make query */ | ||
81 | diff --git a/openbsd-compat/getrrsetbyname.h b/openbsd-compat/getrrsetbyname.h | ||
82 | index 1283f550..dbbc85a2 100644 | ||
83 | --- a/openbsd-compat/getrrsetbyname.h | ||
84 | +++ b/openbsd-compat/getrrsetbyname.h | ||
85 | @@ -72,6 +72,9 @@ | ||
86 | #ifndef RRSET_VALIDATED | ||
87 | # define RRSET_VALIDATED 1 | ||
88 | #endif | ||
89 | +#ifndef RRSET_FORCE_EDNS0 | ||
90 | +# define RRSET_FORCE_EDNS0 0x0001 | ||
91 | +#endif | ||
92 | |||
93 | /* | ||
94 | * Return codes for getrrsetbyname() | ||
diff --git a/debian/patches/doc-hash-tab-completion.patch b/debian/patches/doc-hash-tab-completion.patch new file mode 100644 index 000000000..814d8ad7b --- /dev/null +++ b/debian/patches/doc-hash-tab-completion.patch | |||
@@ -0,0 +1,28 @@ | |||
1 | From 87e480b4f405f3249d7f8a912849eb6263456353 Mon Sep 17 00:00:00 2001 | ||
2 | From: Colin Watson <cjwatson@debian.org> | ||
3 | Date: Sun, 9 Feb 2014 16:10:11 +0000 | ||
4 | Subject: Document that HashKnownHosts may break tab-completion | ||
5 | |||
6 | Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1727 | ||
7 | Bug-Debian: http://bugs.debian.org/430154 | ||
8 | Last-Update: 2013-09-14 | ||
9 | |||
10 | Patch-Name: doc-hash-tab-completion.patch | ||
11 | --- | ||
12 | ssh_config.5 | 3 +++ | ||
13 | 1 file changed, 3 insertions(+) | ||
14 | |||
15 | diff --git a/ssh_config.5 b/ssh_config.5 | ||
16 | index 0483a1ee..8698c28e 100644 | ||
17 | --- a/ssh_config.5 | ||
18 | +++ b/ssh_config.5 | ||
19 | @@ -805,6 +805,9 @@ Note that existing names and addresses in known hosts files | ||
20 | will not be converted automatically, | ||
21 | but may be manually hashed using | ||
22 | .Xr ssh-keygen 1 . | ||
23 | +Use of this option may break facilities such as tab-completion that rely | ||
24 | +on being able to read unhashed host names from | ||
25 | +.Pa ~/.ssh/known_hosts . | ||
26 | .It Cm HostbasedAuthentication | ||
27 | Specifies whether to try rhosts based authentication with public key | ||
28 | authentication. | ||
diff --git a/debian/patches/doc-upstart.patch b/debian/patches/doc-upstart.patch new file mode 100644 index 000000000..14d6ff88d --- /dev/null +++ b/debian/patches/doc-upstart.patch | |||
@@ -0,0 +1,29 @@ | |||
1 | From 7ea8a3c1e0c2ff4998b3fe3caaaba8ff42e513ff Mon Sep 17 00:00:00 2001 | ||
2 | From: Colin Watson <cjwatson@ubuntu.com> | ||
3 | Date: Sun, 9 Feb 2014 16:10:12 +0000 | ||
4 | Subject: Refer to ssh's Upstart job as well as its init script | ||
5 | |||
6 | Forwarded: not-needed | ||
7 | Last-Update: 2013-09-14 | ||
8 | |||
9 | Patch-Name: doc-upstart.patch | ||
10 | --- | ||
11 | sshd.8 | 5 ++++- | ||
12 | 1 file changed, 4 insertions(+), 1 deletion(-) | ||
13 | |||
14 | diff --git a/sshd.8 b/sshd.8 | ||
15 | index e6915141..38a72540 100644 | ||
16 | --- a/sshd.8 | ||
17 | +++ b/sshd.8 | ||
18 | @@ -65,7 +65,10 @@ over an insecure network. | ||
19 | .Nm | ||
20 | listens for connections from clients. | ||
21 | It is normally started at boot from | ||
22 | -.Pa /etc/init.d/ssh . | ||
23 | +.Pa /etc/init.d/ssh | ||
24 | +(or | ||
25 | +.Pa /etc/init/ssh.conf | ||
26 | +on systems using the Upstart init daemon). | ||
27 | It forks a new | ||
28 | daemon for each incoming connection. | ||
29 | The forked daemons handle | ||
diff --git a/debian/patches/gnome-ssh-askpass2-icon.patch b/debian/patches/gnome-ssh-askpass2-icon.patch new file mode 100644 index 000000000..1558dbd8f --- /dev/null +++ b/debian/patches/gnome-ssh-askpass2-icon.patch | |||
@@ -0,0 +1,26 @@ | |||
1 | From 0327e9b3a5f6d1e945f1f028e742e14cf5823962 Mon Sep 17 00:00:00 2001 | ||
2 | From: Vincent Untz <vuntz@ubuntu.com> | ||
3 | Date: Sun, 9 Feb 2014 16:10:16 +0000 | ||
4 | Subject: Give the ssh-askpass-gnome window a default icon | ||
5 | |||
6 | Bug-Ubuntu: https://bugs.launchpad.net/bugs/27152 | ||
7 | Last-Update: 2010-02-28 | ||
8 | |||
9 | Patch-Name: gnome-ssh-askpass2-icon.patch | ||
10 | --- | ||
11 | contrib/gnome-ssh-askpass2.c | 2 ++ | ||
12 | 1 file changed, 2 insertions(+) | ||
13 | |||
14 | diff --git a/contrib/gnome-ssh-askpass2.c b/contrib/gnome-ssh-askpass2.c | ||
15 | index 535a6927..e37a1338 100644 | ||
16 | --- a/contrib/gnome-ssh-askpass2.c | ||
17 | +++ b/contrib/gnome-ssh-askpass2.c | ||
18 | @@ -211,6 +211,8 @@ main(int argc, char **argv) | ||
19 | |||
20 | gtk_init(&argc, &argv); | ||
21 | |||
22 | + gtk_window_set_default_icon_from_file ("/usr/share/pixmaps/ssh-askpass-gnome.png", NULL); | ||
23 | + | ||
24 | if (argc > 1) { | ||
25 | message = g_strjoinv(" ", argv + 1); | ||
26 | } else { | ||
diff --git a/debian/patches/gssapi.patch b/debian/patches/gssapi.patch new file mode 100644 index 000000000..7196d16b6 --- /dev/null +++ b/debian/patches/gssapi.patch | |||
@@ -0,0 +1,3297 @@ | |||
1 | From 48fbb156bdc676fb6ba6817770e4e971fbf85b1f Mon Sep 17 00:00:00 2001 | ||
2 | From: Simon Wilkinson <simon@sxw.org.uk> | ||
3 | Date: Sun, 9 Feb 2014 16:09:48 +0000 | ||
4 | Subject: GSSAPI key exchange support | ||
5 | |||
6 | This patch has been rejected upstream: "None of the OpenSSH developers are | ||
7 | in favour of adding this, and this situation has not changed for several | ||
8 | years. This is not a slight on Simon's patch, which is of fine quality, but | ||
9 | just that a) we don't trust GSSAPI implementations that much and b) we don't | ||
10 | like adding new KEX since they are pre-auth attack surface. This one is | ||
11 | particularly scary, since it requires hooks out to typically root-owned | ||
12 | system resources." | ||
13 | |||
14 | However, quite a lot of people rely on this in Debian, and it's better to | ||
15 | have it merged into the main openssh package rather than having separate | ||
16 | -krb5 packages (as we used to have). It seems to have a generally good | ||
17 | security history. | ||
18 | |||
19 | Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1242 | ||
20 | Last-Updated: 2017-01-16 | ||
21 | |||
22 | Patch-Name: gssapi.patch | ||
23 | --- | ||
24 | ChangeLog.gssapi | 113 +++++++++++++++++++ | ||
25 | Makefile.in | 3 +- | ||
26 | auth-krb5.c | 17 ++- | ||
27 | auth.c | 96 +--------------- | ||
28 | auth2-gss.c | 48 +++++++- | ||
29 | auth2.c | 2 + | ||
30 | canohost.c | 93 +++++++++++++++ | ||
31 | canohost.h | 3 + | ||
32 | clientloop.c | 15 ++- | ||
33 | config.h.in | 6 + | ||
34 | configure.ac | 24 ++++ | ||
35 | gss-genr.c | 275 +++++++++++++++++++++++++++++++++++++++++++- | ||
36 | gss-serv-krb5.c | 85 ++++++++++++-- | ||
37 | gss-serv.c | 184 +++++++++++++++++++++++++++--- | ||
38 | kex.c | 19 ++++ | ||
39 | kex.h | 14 +++ | ||
40 | kexgssc.c | 338 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ | ||
41 | kexgsss.c | 295 ++++++++++++++++++++++++++++++++++++++++++++++++ | ||
42 | monitor.c | 115 +++++++++++++++++-- | ||
43 | monitor.h | 3 + | ||
44 | monitor_wrap.c | 47 +++++++- | ||
45 | monitor_wrap.h | 4 +- | ||
46 | readconf.c | 42 +++++++ | ||
47 | readconf.h | 5 + | ||
48 | servconf.c | 28 ++++- | ||
49 | servconf.h | 2 + | ||
50 | ssh-gss.h | 41 ++++++- | ||
51 | ssh_config | 2 + | ||
52 | ssh_config.5 | 32 ++++++ | ||
53 | sshconnect2.c | 131 ++++++++++++++++++++- | ||
54 | sshd.c | 112 +++++++++++++++++- | ||
55 | sshd_config | 2 + | ||
56 | sshd_config.5 | 10 ++ | ||
57 | sshkey.c | 3 +- | ||
58 | sshkey.h | 1 + | ||
59 | 35 files changed, 2062 insertions(+), 148 deletions(-) | ||
60 | create mode 100644 ChangeLog.gssapi | ||
61 | create mode 100644 kexgssc.c | ||
62 | create mode 100644 kexgsss.c | ||
63 | |||
64 | diff --git a/ChangeLog.gssapi b/ChangeLog.gssapi | ||
65 | new file mode 100644 | ||
66 | index 00000000..f117a336 | ||
67 | --- /dev/null | ||
68 | +++ b/ChangeLog.gssapi | ||
69 | @@ -0,0 +1,113 @@ | ||
70 | +20110101 | ||
71 | + - Finally update for OpenSSH 5.6p1 | ||
72 | + - Add GSSAPIServerIdentity option from Jim Basney | ||
73 | + | ||
74 | +20100308 | ||
75 | + - [ Makefile.in, key.c, key.h ] | ||
76 | + Updates for OpenSSH 5.4p1 | ||
77 | + - [ servconf.c ] | ||
78 | + Include GSSAPI options in the sshd -T configuration dump, and flag | ||
79 | + some older configuration options as being unsupported. Thanks to Colin | ||
80 | + Watson. | ||
81 | + - | ||
82 | + | ||
83 | +20100124 | ||
84 | + - [ sshconnect2.c ] | ||
85 | + Adapt to deal with additional element in Authmethod structure. Thanks to | ||
86 | + Colin Watson | ||
87 | + | ||
88 | +20090615 | ||
89 | + - [ gss-genr.c gss-serv.c kexgssc.c kexgsss.c monitor.c sshconnect2.c | ||
90 | + sshd.c ] | ||
91 | + Fix issues identified by Greg Hudson following a code review | ||
92 | + Check return value of gss_indicate_mechs | ||
93 | + Protect GSSAPI calls in monitor, so they can only be used if enabled | ||
94 | + Check return values of bignum functions in key exchange | ||
95 | + Use BN_clear_free to clear other side's DH value | ||
96 | + Make ssh_gssapi_id_kex more robust | ||
97 | + Only configure kex table pointers if GSSAPI is enabled | ||
98 | + Don't leak mechanism list, or gss mechanism list | ||
99 | + Cast data.length before printing | ||
100 | + If serverkey isn't provided, use an empty string, rather than NULL | ||
101 | + | ||
102 | +20090201 | ||
103 | + - [ gss-genr.c gss-serv.c kex.h kexgssc.c readconf.c readconf.h ssh-gss.h | ||
104 | + ssh_config.5 sshconnet2.c ] | ||
105 | + Add support for the GSSAPIClientIdentity option, which allows the user | ||
106 | + to specify which GSSAPI identity to use to contact a given server | ||
107 | + | ||
108 | +20080404 | ||
109 | + - [ gss-serv.c ] | ||
110 | + Add code to actually implement GSSAPIStrictAcceptCheck, which had somehow | ||
111 | + been omitted from a previous version of this patch. Reported by Borislav | ||
112 | + Stoichkov | ||
113 | + | ||
114 | +20070317 | ||
115 | + - [ gss-serv-krb5.c ] | ||
116 | + Remove C99ism, where new_ccname was being declared in the middle of a | ||
117 | + function | ||
118 | + | ||
119 | +20061220 | ||
120 | + - [ servconf.c ] | ||
121 | + Make default for GSSAPIStrictAcceptorCheck be Yes, to match previous, and | ||
122 | + documented, behaviour. Reported by Dan Watson. | ||
123 | + | ||
124 | +20060910 | ||
125 | + - [ gss-genr.c kexgssc.c kexgsss.c kex.h monitor.c sshconnect2.c sshd.c | ||
126 | + ssh-gss.h ] | ||
127 | + add support for gss-group14-sha1 key exchange mechanisms | ||
128 | + - [ gss-serv.c servconf.c servconf.h sshd_config sshd_config.5 ] | ||
129 | + Add GSSAPIStrictAcceptorCheck option to allow the disabling of | ||
130 | + acceptor principal checking on multi-homed machines. | ||
131 | + <Bugzilla #928> | ||
132 | + - [ sshd_config ssh_config ] | ||
133 | + Add settings for GSSAPIKeyExchange and GSSAPITrustDNS to the sample | ||
134 | + configuration files | ||
135 | + - [ kexgss.c kegsss.c sshconnect2.c sshd.c ] | ||
136 | + Code cleanup. Replace strlen/xmalloc/snprintf sequences with xasprintf() | ||
137 | + Limit length of error messages displayed by client | ||
138 | + | ||
139 | +20060909 | ||
140 | + - [ gss-genr.c gss-serv.c ] | ||
141 | + move ssh_gssapi_acquire_cred() and ssh_gssapi_server_ctx to be server | ||
142 | + only, where they belong | ||
143 | + <Bugzilla #1225> | ||
144 | + | ||
145 | +20060829 | ||
146 | + - [ gss-serv-krb5.c ] | ||
147 | + Fix CCAPI credentials cache name when creating KRB5CCNAME environment | ||
148 | + variable | ||
149 | + | ||
150 | +20060828 | ||
151 | + - [ gss-genr.c ] | ||
152 | + Avoid Heimdal context freeing problem | ||
153 | + <Fixed upstream 20060829> | ||
154 | + | ||
155 | +20060818 | ||
156 | + - [ gss-genr.c ssh-gss.h sshconnect2.c ] | ||
157 | + Make sure that SPENGO is disabled | ||
158 | + <Bugzilla #1218 - Fixed upstream 20060818> | ||
159 | + | ||
160 | +20060421 | ||
161 | + - [ gssgenr.c, sshconnect2.c ] | ||
162 | + a few type changes (signed versus unsigned, int versus size_t) to | ||
163 | + fix compiler errors/warnings | ||
164 | + (from jbasney AT ncsa.uiuc.edu) | ||
165 | + - [ kexgssc.c, sshconnect2.c ] | ||
166 | + fix uninitialized variable warnings | ||
167 | + (from jbasney AT ncsa.uiuc.edu) | ||
168 | + - [ gssgenr.c ] | ||
169 | + pass oid to gss_display_status (helpful when using GSSAPI mechglue) | ||
170 | + (from jbasney AT ncsa.uiuc.edu) | ||
171 | + <Bugzilla #1220 > | ||
172 | + - [ gss-serv-krb5.c ] | ||
173 | + #ifdef HAVE_GSSAPI_KRB5 should be #ifdef HAVE_GSSAPI_KRB5_H | ||
174 | + (from jbasney AT ncsa.uiuc.edu) | ||
175 | + <Fixed upstream 20060304> | ||
176 | + - [ readconf.c, readconf.h, ssh_config.5, sshconnect2.c | ||
177 | + add client-side GssapiKeyExchange option | ||
178 | + (from jbasney AT ncsa.uiuc.edu) | ||
179 | + - [ sshconnect2.c ] | ||
180 | + add support for GssapiTrustDns option for gssapi-with-mic | ||
181 | + (from jbasney AT ncsa.uiuc.edu) | ||
182 | + <gssapi-with-mic support is Bugzilla #1008> | ||
183 | diff --git a/Makefile.in b/Makefile.in | ||
184 | index e10f3742..00a320e1 100644 | ||
185 | --- a/Makefile.in | ||
186 | +++ b/Makefile.in | ||
187 | @@ -92,6 +92,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \ | ||
188 | kex.o kexdh.o kexgex.o kexecdh.o kexc25519.o \ | ||
189 | kexdhc.o kexgexc.o kexecdhc.o kexc25519c.o \ | ||
190 | kexdhs.o kexgexs.o kexecdhs.o kexc25519s.o \ | ||
191 | + kexgssc.o \ | ||
192 | platform-pledge.o platform-tracing.o | ||
193 | |||
194 | SSHOBJS= ssh.o readconf.o clientloop.o sshtty.o \ | ||
195 | @@ -105,7 +106,7 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passwd.o \ | ||
196 | auth-skey.o auth-bsdauth.o auth2-hostbased.o auth2-kbdint.o \ | ||
197 | auth2-none.o auth2-passwd.o auth2-pubkey.o \ | ||
198 | monitor.o monitor_wrap.o auth-krb5.o \ | ||
199 | - auth2-gss.o gss-serv.o gss-serv-krb5.o \ | ||
200 | + auth2-gss.o gss-serv.o gss-serv-krb5.o kexgsss.o \ | ||
201 | loginrec.o auth-pam.o auth-shadow.o auth-sia.o md5crypt.o \ | ||
202 | sftp-server.o sftp-common.o \ | ||
203 | sandbox-null.o sandbox-rlimit.o sandbox-systrace.o sandbox-darwin.o \ | ||
204 | diff --git a/auth-krb5.c b/auth-krb5.c | ||
205 | index a5a81ed2..38e7fee2 100644 | ||
206 | --- a/auth-krb5.c | ||
207 | +++ b/auth-krb5.c | ||
208 | @@ -182,8 +182,13 @@ auth_krb5_password(Authctxt *authctxt, const char *password) | ||
209 | |||
210 | len = strlen(authctxt->krb5_ticket_file) + 6; | ||
211 | authctxt->krb5_ccname = xmalloc(len); | ||
212 | +#ifdef USE_CCAPI | ||
213 | + snprintf(authctxt->krb5_ccname, len, "API:%s", | ||
214 | + authctxt->krb5_ticket_file); | ||
215 | +#else | ||
216 | snprintf(authctxt->krb5_ccname, len, "FILE:%s", | ||
217 | authctxt->krb5_ticket_file); | ||
218 | +#endif | ||
219 | |||
220 | #ifdef USE_PAM | ||
221 | if (options.use_pam) | ||
222 | @@ -240,15 +245,22 @@ krb5_cleanup_proc(Authctxt *authctxt) | ||
223 | #ifndef HEIMDAL | ||
224 | krb5_error_code | ||
225 | ssh_krb5_cc_gen(krb5_context ctx, krb5_ccache *ccache) { | ||
226 | - int tmpfd, ret, oerrno; | ||
227 | + int ret, oerrno; | ||
228 | char ccname[40]; | ||
229 | mode_t old_umask; | ||
230 | +#ifdef USE_CCAPI | ||
231 | + char cctemplate[] = "API:krb5cc_%d"; | ||
232 | +#else | ||
233 | + char cctemplate[] = "FILE:/tmp/krb5cc_%d_XXXXXXXXXX"; | ||
234 | + int tmpfd; | ||
235 | +#endif | ||
236 | |||
237 | ret = snprintf(ccname, sizeof(ccname), | ||
238 | - "FILE:/tmp/krb5cc_%d_XXXXXXXXXX", geteuid()); | ||
239 | + cctemplate, geteuid()); | ||
240 | if (ret < 0 || (size_t)ret >= sizeof(ccname)) | ||
241 | return ENOMEM; | ||
242 | |||
243 | +#ifndef USE_CCAPI | ||
244 | old_umask = umask(0177); | ||
245 | tmpfd = mkstemp(ccname + strlen("FILE:")); | ||
246 | oerrno = errno; | ||
247 | @@ -265,6 +277,7 @@ ssh_krb5_cc_gen(krb5_context ctx, krb5_ccache *ccache) { | ||
248 | return oerrno; | ||
249 | } | ||
250 | close(tmpfd); | ||
251 | +#endif | ||
252 | |||
253 | return (krb5_cc_resolve(ctx, ccname, ccache)); | ||
254 | } | ||
255 | diff --git a/auth.c b/auth.c | ||
256 | index 6ee6116d..c6390687 100644 | ||
257 | --- a/auth.c | ||
258 | +++ b/auth.c | ||
259 | @@ -372,7 +372,8 @@ auth_root_allowed(const char *method) | ||
260 | case PERMIT_NO_PASSWD: | ||
261 | if (strcmp(method, "publickey") == 0 || | ||
262 | strcmp(method, "hostbased") == 0 || | ||
263 | - strcmp(method, "gssapi-with-mic") == 0) | ||
264 | + strcmp(method, "gssapi-with-mic") == 0 || | ||
265 | + strcmp(method, "gssapi-keyex") == 0) | ||
266 | return 1; | ||
267 | break; | ||
268 | case PERMIT_FORCED_ONLY: | ||
269 | @@ -795,99 +796,6 @@ fakepw(void) | ||
270 | } | ||
271 | |||
272 | /* | ||
273 | - * Returns the remote DNS hostname as a string. The returned string must not | ||
274 | - * be freed. NB. this will usually trigger a DNS query the first time it is | ||
275 | - * called. | ||
276 | - * This function does additional checks on the hostname to mitigate some | ||
277 | - * attacks on legacy rhosts-style authentication. | ||
278 | - * XXX is RhostsRSAAuthentication vulnerable to these? | ||
279 | - * XXX Can we remove these checks? (or if not, remove RhostsRSAAuthentication?) | ||
280 | - */ | ||
281 | - | ||
282 | -static char * | ||
283 | -remote_hostname(struct ssh *ssh) | ||
284 | -{ | ||
285 | - struct sockaddr_storage from; | ||
286 | - socklen_t fromlen; | ||
287 | - struct addrinfo hints, *ai, *aitop; | ||
288 | - char name[NI_MAXHOST], ntop2[NI_MAXHOST]; | ||
289 | - const char *ntop = ssh_remote_ipaddr(ssh); | ||
290 | - | ||
291 | - /* Get IP address of client. */ | ||
292 | - fromlen = sizeof(from); | ||
293 | - memset(&from, 0, sizeof(from)); | ||
294 | - if (getpeername(ssh_packet_get_connection_in(ssh), | ||
295 | - (struct sockaddr *)&from, &fromlen) < 0) { | ||
296 | - debug("getpeername failed: %.100s", strerror(errno)); | ||
297 | - return strdup(ntop); | ||
298 | - } | ||
299 | - | ||
300 | - ipv64_normalise_mapped(&from, &fromlen); | ||
301 | - if (from.ss_family == AF_INET6) | ||
302 | - fromlen = sizeof(struct sockaddr_in6); | ||
303 | - | ||
304 | - debug3("Trying to reverse map address %.100s.", ntop); | ||
305 | - /* Map the IP address to a host name. */ | ||
306 | - if (getnameinfo((struct sockaddr *)&from, fromlen, name, sizeof(name), | ||
307 | - NULL, 0, NI_NAMEREQD) != 0) { | ||
308 | - /* Host name not found. Use ip address. */ | ||
309 | - return strdup(ntop); | ||
310 | - } | ||
311 | - | ||
312 | - /* | ||
313 | - * if reverse lookup result looks like a numeric hostname, | ||
314 | - * someone is trying to trick us by PTR record like following: | ||
315 | - * 1.1.1.10.in-addr.arpa. IN PTR 2.3.4.5 | ||
316 | - */ | ||
317 | - memset(&hints, 0, sizeof(hints)); | ||
318 | - hints.ai_socktype = SOCK_DGRAM; /*dummy*/ | ||
319 | - hints.ai_flags = AI_NUMERICHOST; | ||
320 | - if (getaddrinfo(name, NULL, &hints, &ai) == 0) { | ||
321 | - logit("Nasty PTR record \"%s\" is set up for %s, ignoring", | ||
322 | - name, ntop); | ||
323 | - freeaddrinfo(ai); | ||
324 | - return strdup(ntop); | ||
325 | - } | ||
326 | - | ||
327 | - /* Names are stored in lowercase. */ | ||
328 | - lowercase(name); | ||
329 | - | ||
330 | - /* | ||
331 | - * Map it back to an IP address and check that the given | ||
332 | - * address actually is an address of this host. This is | ||
333 | - * necessary because anyone with access to a name server can | ||
334 | - * define arbitrary names for an IP address. Mapping from | ||
335 | - * name to IP address can be trusted better (but can still be | ||
336 | - * fooled if the intruder has access to the name server of | ||
337 | - * the domain). | ||
338 | - */ | ||
339 | - memset(&hints, 0, sizeof(hints)); | ||
340 | - hints.ai_family = from.ss_family; | ||
341 | - hints.ai_socktype = SOCK_STREAM; | ||
342 | - if (getaddrinfo(name, NULL, &hints, &aitop) != 0) { | ||
343 | - logit("reverse mapping checking getaddrinfo for %.700s " | ||
344 | - "[%s] failed.", name, ntop); | ||
345 | - return strdup(ntop); | ||
346 | - } | ||
347 | - /* Look for the address from the list of addresses. */ | ||
348 | - for (ai = aitop; ai; ai = ai->ai_next) { | ||
349 | - if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop2, | ||
350 | - sizeof(ntop2), NULL, 0, NI_NUMERICHOST) == 0 && | ||
351 | - (strcmp(ntop, ntop2) == 0)) | ||
352 | - break; | ||
353 | - } | ||
354 | - freeaddrinfo(aitop); | ||
355 | - /* If we reached the end of the list, the address was not there. */ | ||
356 | - if (ai == NULL) { | ||
357 | - /* Address not found for the host name. */ | ||
358 | - logit("Address %.100s maps to %.600s, but this does not " | ||
359 | - "map back to the address.", ntop, name); | ||
360 | - return strdup(ntop); | ||
361 | - } | ||
362 | - return strdup(name); | ||
363 | -} | ||
364 | - | ||
365 | -/* | ||
366 | * Return the canonical name of the host in the other side of the current | ||
367 | * connection. The host name is cached, so it is efficient to call this | ||
368 | * several times. | ||
369 | diff --git a/auth2-gss.c b/auth2-gss.c | ||
370 | index 1ca83577..3b5036df 100644 | ||
371 | --- a/auth2-gss.c | ||
372 | +++ b/auth2-gss.c | ||
373 | @@ -1,7 +1,7 @@ | ||
374 | /* $OpenBSD: auth2-gss.c,v 1.22 2015/01/19 20:07:45 markus Exp $ */ | ||
375 | |||
376 | /* | ||
377 | - * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved. | ||
378 | + * Copyright (c) 2001-2007 Simon Wilkinson. All rights reserved. | ||
379 | * | ||
380 | * Redistribution and use in source and binary forms, with or without | ||
381 | * modification, are permitted provided that the following conditions | ||
382 | @@ -53,6 +53,40 @@ static int input_gssapi_mic(int type, u_int32_t plen, void *ctxt); | ||
383 | static int input_gssapi_exchange_complete(int type, u_int32_t plen, void *ctxt); | ||
384 | static int input_gssapi_errtok(int, u_int32_t, void *); | ||
385 | |||
386 | +/* | ||
387 | + * The 'gssapi_keyex' userauth mechanism. | ||
388 | + */ | ||
389 | +static int | ||
390 | +userauth_gsskeyex(Authctxt *authctxt) | ||
391 | +{ | ||
392 | + int authenticated = 0; | ||
393 | + Buffer b; | ||
394 | + gss_buffer_desc mic, gssbuf; | ||
395 | + u_int len; | ||
396 | + | ||
397 | + mic.value = packet_get_string(&len); | ||
398 | + mic.length = len; | ||
399 | + | ||
400 | + packet_check_eom(); | ||
401 | + | ||
402 | + ssh_gssapi_buildmic(&b, authctxt->user, authctxt->service, | ||
403 | + "gssapi-keyex"); | ||
404 | + | ||
405 | + gssbuf.value = buffer_ptr(&b); | ||
406 | + gssbuf.length = buffer_len(&b); | ||
407 | + | ||
408 | + /* gss_kex_context is NULL with privsep, so we can't check it here */ | ||
409 | + if (!GSS_ERROR(PRIVSEP(ssh_gssapi_checkmic(gss_kex_context, | ||
410 | + &gssbuf, &mic)))) | ||
411 | + authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user, | ||
412 | + authctxt->pw)); | ||
413 | + | ||
414 | + buffer_free(&b); | ||
415 | + free(mic.value); | ||
416 | + | ||
417 | + return (authenticated); | ||
418 | +} | ||
419 | + | ||
420 | /* | ||
421 | * We only support those mechanisms that we know about (ie ones that we know | ||
422 | * how to check local user kuserok and the like) | ||
423 | @@ -238,7 +272,8 @@ input_gssapi_exchange_complete(int type, u_int32_t plen, void *ctxt) | ||
424 | |||
425 | packet_check_eom(); | ||
426 | |||
427 | - authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user)); | ||
428 | + authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user, | ||
429 | + authctxt->pw)); | ||
430 | |||
431 | authctxt->postponed = 0; | ||
432 | dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL); | ||
433 | @@ -274,7 +309,8 @@ input_gssapi_mic(int type, u_int32_t plen, void *ctxt) | ||
434 | gssbuf.length = buffer_len(&b); | ||
435 | |||
436 | if (!GSS_ERROR(PRIVSEP(ssh_gssapi_checkmic(gssctxt, &gssbuf, &mic)))) | ||
437 | - authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user)); | ||
438 | + authenticated = | ||
439 | + PRIVSEP(ssh_gssapi_userok(authctxt->user, authctxt->pw)); | ||
440 | else | ||
441 | logit("GSSAPI MIC check failed"); | ||
442 | |||
443 | @@ -290,6 +326,12 @@ input_gssapi_mic(int type, u_int32_t plen, void *ctxt) | ||
444 | return 0; | ||
445 | } | ||
446 | |||
447 | +Authmethod method_gsskeyex = { | ||
448 | + "gssapi-keyex", | ||
449 | + userauth_gsskeyex, | ||
450 | + &options.gss_authentication | ||
451 | +}; | ||
452 | + | ||
453 | Authmethod method_gssapi = { | ||
454 | "gssapi-with-mic", | ||
455 | userauth_gssapi, | ||
456 | diff --git a/auth2.c b/auth2.c | ||
457 | index 9108b861..ce0d3760 100644 | ||
458 | --- a/auth2.c | ||
459 | +++ b/auth2.c | ||
460 | @@ -70,6 +70,7 @@ extern Authmethod method_passwd; | ||
461 | extern Authmethod method_kbdint; | ||
462 | extern Authmethod method_hostbased; | ||
463 | #ifdef GSSAPI | ||
464 | +extern Authmethod method_gsskeyex; | ||
465 | extern Authmethod method_gssapi; | ||
466 | #endif | ||
467 | |||
468 | @@ -77,6 +78,7 @@ Authmethod *authmethods[] = { | ||
469 | &method_none, | ||
470 | &method_pubkey, | ||
471 | #ifdef GSSAPI | ||
472 | + &method_gsskeyex, | ||
473 | &method_gssapi, | ||
474 | #endif | ||
475 | &method_passwd, | ||
476 | diff --git a/canohost.c b/canohost.c | ||
477 | index f71a0856..404731d2 100644 | ||
478 | --- a/canohost.c | ||
479 | +++ b/canohost.c | ||
480 | @@ -35,6 +35,99 @@ | ||
481 | #include "canohost.h" | ||
482 | #include "misc.h" | ||
483 | |||
484 | +/* | ||
485 | + * Returns the remote DNS hostname as a string. The returned string must not | ||
486 | + * be freed. NB. this will usually trigger a DNS query the first time it is | ||
487 | + * called. | ||
488 | + * This function does additional checks on the hostname to mitigate some | ||
489 | + * attacks on legacy rhosts-style authentication. | ||
490 | + * XXX is RhostsRSAAuthentication vulnerable to these? | ||
491 | + * XXX Can we remove these checks? (or if not, remove RhostsRSAAuthentication?) | ||
492 | + */ | ||
493 | + | ||
494 | +char * | ||
495 | +remote_hostname(struct ssh *ssh) | ||
496 | +{ | ||
497 | + struct sockaddr_storage from; | ||
498 | + socklen_t fromlen; | ||
499 | + struct addrinfo hints, *ai, *aitop; | ||
500 | + char name[NI_MAXHOST], ntop2[NI_MAXHOST]; | ||
501 | + const char *ntop = ssh_remote_ipaddr(ssh); | ||
502 | + | ||
503 | + /* Get IP address of client. */ | ||
504 | + fromlen = sizeof(from); | ||
505 | + memset(&from, 0, sizeof(from)); | ||
506 | + if (getpeername(ssh_packet_get_connection_in(ssh), | ||
507 | + (struct sockaddr *)&from, &fromlen) < 0) { | ||
508 | + debug("getpeername failed: %.100s", strerror(errno)); | ||
509 | + return strdup(ntop); | ||
510 | + } | ||
511 | + | ||
512 | + ipv64_normalise_mapped(&from, &fromlen); | ||
513 | + if (from.ss_family == AF_INET6) | ||
514 | + fromlen = sizeof(struct sockaddr_in6); | ||
515 | + | ||
516 | + debug3("Trying to reverse map address %.100s.", ntop); | ||
517 | + /* Map the IP address to a host name. */ | ||
518 | + if (getnameinfo((struct sockaddr *)&from, fromlen, name, sizeof(name), | ||
519 | + NULL, 0, NI_NAMEREQD) != 0) { | ||
520 | + /* Host name not found. Use ip address. */ | ||
521 | + return strdup(ntop); | ||
522 | + } | ||
523 | + | ||
524 | + /* | ||
525 | + * if reverse lookup result looks like a numeric hostname, | ||
526 | + * someone is trying to trick us by PTR record like following: | ||
527 | + * 1.1.1.10.in-addr.arpa. IN PTR 2.3.4.5 | ||
528 | + */ | ||
529 | + memset(&hints, 0, sizeof(hints)); | ||
530 | + hints.ai_socktype = SOCK_DGRAM; /*dummy*/ | ||
531 | + hints.ai_flags = AI_NUMERICHOST; | ||
532 | + if (getaddrinfo(name, NULL, &hints, &ai) == 0) { | ||
533 | + logit("Nasty PTR record \"%s\" is set up for %s, ignoring", | ||
534 | + name, ntop); | ||
535 | + freeaddrinfo(ai); | ||
536 | + return strdup(ntop); | ||
537 | + } | ||
538 | + | ||
539 | + /* Names are stored in lowercase. */ | ||
540 | + lowercase(name); | ||
541 | + | ||
542 | + /* | ||
543 | + * Map it back to an IP address and check that the given | ||
544 | + * address actually is an address of this host. This is | ||
545 | + * necessary because anyone with access to a name server can | ||
546 | + * define arbitrary names for an IP address. Mapping from | ||
547 | + * name to IP address can be trusted better (but can still be | ||
548 | + * fooled if the intruder has access to the name server of | ||
549 | + * the domain). | ||
550 | + */ | ||
551 | + memset(&hints, 0, sizeof(hints)); | ||
552 | + hints.ai_family = from.ss_family; | ||
553 | + hints.ai_socktype = SOCK_STREAM; | ||
554 | + if (getaddrinfo(name, NULL, &hints, &aitop) != 0) { | ||
555 | + logit("reverse mapping checking getaddrinfo for %.700s " | ||
556 | + "[%s] failed.", name, ntop); | ||
557 | + return strdup(ntop); | ||
558 | + } | ||
559 | + /* Look for the address from the list of addresses. */ | ||
560 | + for (ai = aitop; ai; ai = ai->ai_next) { | ||
561 | + if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop2, | ||
562 | + sizeof(ntop2), NULL, 0, NI_NUMERICHOST) == 0 && | ||
563 | + (strcmp(ntop, ntop2) == 0)) | ||
564 | + break; | ||
565 | + } | ||
566 | + freeaddrinfo(aitop); | ||
567 | + /* If we reached the end of the list, the address was not there. */ | ||
568 | + if (ai == NULL) { | ||
569 | + /* Address not found for the host name. */ | ||
570 | + logit("Address %.100s maps to %.600s, but this does not " | ||
571 | + "map back to the address.", ntop, name); | ||
572 | + return strdup(ntop); | ||
573 | + } | ||
574 | + return strdup(name); | ||
575 | +} | ||
576 | + | ||
577 | void | ||
578 | ipv64_normalise_mapped(struct sockaddr_storage *addr, socklen_t *len) | ||
579 | { | ||
580 | diff --git a/canohost.h b/canohost.h | ||
581 | index 26d62855..0cadc9f1 100644 | ||
582 | --- a/canohost.h | ||
583 | +++ b/canohost.h | ||
584 | @@ -15,6 +15,9 @@ | ||
585 | #ifndef _CANOHOST_H | ||
586 | #define _CANOHOST_H | ||
587 | |||
588 | +struct ssh; | ||
589 | + | ||
590 | +char *remote_hostname(struct ssh *); | ||
591 | char *get_peer_ipaddr(int); | ||
592 | int get_peer_port(int); | ||
593 | char *get_local_ipaddr(int); | ||
594 | diff --git a/clientloop.c b/clientloop.c | ||
595 | index 4289a408..99c68b69 100644 | ||
596 | --- a/clientloop.c | ||
597 | +++ b/clientloop.c | ||
598 | @@ -113,6 +113,10 @@ | ||
599 | #include "ssherr.h" | ||
600 | #include "hostfile.h" | ||
601 | |||
602 | +#ifdef GSSAPI | ||
603 | +#include "ssh-gss.h" | ||
604 | +#endif | ||
605 | + | ||
606 | /* import options */ | ||
607 | extern Options options; | ||
608 | |||
609 | @@ -1664,9 +1668,18 @@ client_loop(int have_pty, int escape_char_arg, int ssh2_chan_id) | ||
610 | break; | ||
611 | |||
612 | /* Do channel operations unless rekeying in progress. */ | ||
613 | - if (!ssh_packet_is_rekeying(active_state)) | ||
614 | + if (!ssh_packet_is_rekeying(active_state)) { | ||
615 | channel_after_select(readset, writeset); | ||
616 | |||
617 | +#ifdef GSSAPI | ||
618 | + if (options.gss_renewal_rekey && | ||
619 | + ssh_gssapi_credentials_updated(NULL)) { | ||
620 | + debug("credentials updated - forcing rekey"); | ||
621 | + need_rekeying = 1; | ||
622 | + } | ||
623 | +#endif | ||
624 | + } | ||
625 | + | ||
626 | /* Buffer input from the connection. */ | ||
627 | client_process_net_input(readset); | ||
628 | |||
629 | diff --git a/config.h.in b/config.h.in | ||
630 | index 75e02ab4..afe540e9 100644 | ||
631 | --- a/config.h.in | ||
632 | +++ b/config.h.in | ||
633 | @@ -1667,6 +1667,9 @@ | ||
634 | /* Use btmp to log bad logins */ | ||
635 | #undef USE_BTMP | ||
636 | |||
637 | +/* platform uses an in-memory credentials cache */ | ||
638 | +#undef USE_CCAPI | ||
639 | + | ||
640 | /* Use libedit for sftp */ | ||
641 | #undef USE_LIBEDIT | ||
642 | |||
643 | @@ -1682,6 +1685,9 @@ | ||
644 | /* Use PIPES instead of a socketpair() */ | ||
645 | #undef USE_PIPES | ||
646 | |||
647 | +/* platform has the Security Authorization Session API */ | ||
648 | +#undef USE_SECURITY_SESSION_API | ||
649 | + | ||
650 | /* Define if you have Solaris privileges */ | ||
651 | #undef USE_SOLARIS_PRIVS | ||
652 | |||
653 | diff --git a/configure.ac b/configure.ac | ||
654 | index eb9f45dc..5fdc696c 100644 | ||
655 | --- a/configure.ac | ||
656 | +++ b/configure.ac | ||
657 | @@ -623,6 +623,30 @@ main() { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16)) | ||
658 | [Use tunnel device compatibility to OpenBSD]) | ||
659 | AC_DEFINE([SSH_TUN_PREPEND_AF], [1], | ||
660 | [Prepend the address family to IP tunnel traffic]) | ||
661 | + AC_MSG_CHECKING([if we have the Security Authorization Session API]) | ||
662 | + AC_TRY_COMPILE([#include <Security/AuthSession.h>], | ||
663 | + [SessionCreate(0, 0);], | ||
664 | + [ac_cv_use_security_session_api="yes" | ||
665 | + AC_DEFINE([USE_SECURITY_SESSION_API], [1], | ||
666 | + [platform has the Security Authorization Session API]) | ||
667 | + LIBS="$LIBS -framework Security" | ||
668 | + AC_MSG_RESULT([yes])], | ||
669 | + [ac_cv_use_security_session_api="no" | ||
670 | + AC_MSG_RESULT([no])]) | ||
671 | + AC_MSG_CHECKING([if we have an in-memory credentials cache]) | ||
672 | + AC_TRY_COMPILE( | ||
673 | + [#include <Kerberos/Kerberos.h>], | ||
674 | + [cc_context_t c; | ||
675 | + (void) cc_initialize (&c, 0, NULL, NULL);], | ||
676 | + [AC_DEFINE([USE_CCAPI], [1], | ||
677 | + [platform uses an in-memory credentials cache]) | ||
678 | + LIBS="$LIBS -framework Security" | ||
679 | + AC_MSG_RESULT([yes]) | ||
680 | + if test "x$ac_cv_use_security_session_api" = "xno"; then | ||
681 | + AC_MSG_ERROR([*** Need a security framework to use the credentials cache API ***]) | ||
682 | + fi], | ||
683 | + [AC_MSG_RESULT([no])] | ||
684 | + ) | ||
685 | m4_pattern_allow([AU_IPv]) | ||
686 | AC_CHECK_DECL([AU_IPv4], [], | ||
687 | AC_DEFINE([AU_IPv4], [0], [System only supports IPv4 audit records]) | ||
688 | diff --git a/gss-genr.c b/gss-genr.c | ||
689 | index 62559ed9..0b3ae073 100644 | ||
690 | --- a/gss-genr.c | ||
691 | +++ b/gss-genr.c | ||
692 | @@ -1,7 +1,7 @@ | ||
693 | /* $OpenBSD: gss-genr.c,v 1.24 2016/09/12 01:22:38 deraadt Exp $ */ | ||
694 | |||
695 | /* | ||
696 | - * Copyright (c) 2001-2007 Simon Wilkinson. All rights reserved. | ||
697 | + * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved. | ||
698 | * | ||
699 | * Redistribution and use in source and binary forms, with or without | ||
700 | * modification, are permitted provided that the following conditions | ||
701 | @@ -40,12 +40,167 @@ | ||
702 | #include "buffer.h" | ||
703 | #include "log.h" | ||
704 | #include "ssh2.h" | ||
705 | +#include "cipher.h" | ||
706 | +#include "key.h" | ||
707 | +#include "kex.h" | ||
708 | +#include <openssl/evp.h> | ||
709 | |||
710 | #include "ssh-gss.h" | ||
711 | |||
712 | extern u_char *session_id2; | ||
713 | extern u_int session_id2_len; | ||
714 | |||
715 | +typedef struct { | ||
716 | + char *encoded; | ||
717 | + gss_OID oid; | ||
718 | +} ssh_gss_kex_mapping; | ||
719 | + | ||
720 | +/* | ||
721 | + * XXX - It would be nice to find a more elegant way of handling the | ||
722 | + * XXX passing of the key exchange context to the userauth routines | ||
723 | + */ | ||
724 | + | ||
725 | +Gssctxt *gss_kex_context = NULL; | ||
726 | + | ||
727 | +static ssh_gss_kex_mapping *gss_enc2oid = NULL; | ||
728 | + | ||
729 | +int | ||
730 | +ssh_gssapi_oid_table_ok(void) { | ||
731 | + return (gss_enc2oid != NULL); | ||
732 | +} | ||
733 | + | ||
734 | +/* | ||
735 | + * Return a list of the gss-group1-sha1 mechanisms supported by this program | ||
736 | + * | ||
737 | + * We test mechanisms to ensure that we can use them, to avoid starting | ||
738 | + * a key exchange with a bad mechanism | ||
739 | + */ | ||
740 | + | ||
741 | +char * | ||
742 | +ssh_gssapi_client_mechanisms(const char *host, const char *client) { | ||
743 | + gss_OID_set gss_supported; | ||
744 | + OM_uint32 min_status; | ||
745 | + | ||
746 | + if (GSS_ERROR(gss_indicate_mechs(&min_status, &gss_supported))) | ||
747 | + return NULL; | ||
748 | + | ||
749 | + return(ssh_gssapi_kex_mechs(gss_supported, ssh_gssapi_check_mechanism, | ||
750 | + host, client)); | ||
751 | +} | ||
752 | + | ||
753 | +char * | ||
754 | +ssh_gssapi_kex_mechs(gss_OID_set gss_supported, ssh_gssapi_check_fn *check, | ||
755 | + const char *host, const char *client) { | ||
756 | + Buffer buf; | ||
757 | + size_t i; | ||
758 | + int oidpos, enclen; | ||
759 | + char *mechs, *encoded; | ||
760 | + u_char digest[EVP_MAX_MD_SIZE]; | ||
761 | + char deroid[2]; | ||
762 | + const EVP_MD *evp_md = EVP_md5(); | ||
763 | + EVP_MD_CTX md; | ||
764 | + | ||
765 | + if (gss_enc2oid != NULL) { | ||
766 | + for (i = 0; gss_enc2oid[i].encoded != NULL; i++) | ||
767 | + free(gss_enc2oid[i].encoded); | ||
768 | + free(gss_enc2oid); | ||
769 | + } | ||
770 | + | ||
771 | + gss_enc2oid = xmalloc(sizeof(ssh_gss_kex_mapping) * | ||
772 | + (gss_supported->count + 1)); | ||
773 | + | ||
774 | + buffer_init(&buf); | ||
775 | + | ||
776 | + oidpos = 0; | ||
777 | + for (i = 0; i < gss_supported->count; i++) { | ||
778 | + if (gss_supported->elements[i].length < 128 && | ||
779 | + (*check)(NULL, &(gss_supported->elements[i]), host, client)) { | ||
780 | + | ||
781 | + deroid[0] = SSH_GSS_OIDTYPE; | ||
782 | + deroid[1] = gss_supported->elements[i].length; | ||
783 | + | ||
784 | + EVP_DigestInit(&md, evp_md); | ||
785 | + EVP_DigestUpdate(&md, deroid, 2); | ||
786 | + EVP_DigestUpdate(&md, | ||
787 | + gss_supported->elements[i].elements, | ||
788 | + gss_supported->elements[i].length); | ||
789 | + EVP_DigestFinal(&md, digest, NULL); | ||
790 | + | ||
791 | + encoded = xmalloc(EVP_MD_size(evp_md) * 2); | ||
792 | + enclen = __b64_ntop(digest, EVP_MD_size(evp_md), | ||
793 | + encoded, EVP_MD_size(evp_md) * 2); | ||
794 | + | ||
795 | + if (oidpos != 0) | ||
796 | + buffer_put_char(&buf, ','); | ||
797 | + | ||
798 | + buffer_append(&buf, KEX_GSS_GEX_SHA1_ID, | ||
799 | + sizeof(KEX_GSS_GEX_SHA1_ID) - 1); | ||
800 | + buffer_append(&buf, encoded, enclen); | ||
801 | + buffer_put_char(&buf, ','); | ||
802 | + buffer_append(&buf, KEX_GSS_GRP1_SHA1_ID, | ||
803 | + sizeof(KEX_GSS_GRP1_SHA1_ID) - 1); | ||
804 | + buffer_append(&buf, encoded, enclen); | ||
805 | + buffer_put_char(&buf, ','); | ||
806 | + buffer_append(&buf, KEX_GSS_GRP14_SHA1_ID, | ||
807 | + sizeof(KEX_GSS_GRP14_SHA1_ID) - 1); | ||
808 | + buffer_append(&buf, encoded, enclen); | ||
809 | + | ||
810 | + gss_enc2oid[oidpos].oid = &(gss_supported->elements[i]); | ||
811 | + gss_enc2oid[oidpos].encoded = encoded; | ||
812 | + oidpos++; | ||
813 | + } | ||
814 | + } | ||
815 | + gss_enc2oid[oidpos].oid = NULL; | ||
816 | + gss_enc2oid[oidpos].encoded = NULL; | ||
817 | + | ||
818 | + buffer_put_char(&buf, '\0'); | ||
819 | + | ||
820 | + mechs = xmalloc(buffer_len(&buf)); | ||
821 | + buffer_get(&buf, mechs, buffer_len(&buf)); | ||
822 | + buffer_free(&buf); | ||
823 | + | ||
824 | + if (strlen(mechs) == 0) { | ||
825 | + free(mechs); | ||
826 | + mechs = NULL; | ||
827 | + } | ||
828 | + | ||
829 | + return (mechs); | ||
830 | +} | ||
831 | + | ||
832 | +gss_OID | ||
833 | +ssh_gssapi_id_kex(Gssctxt *ctx, char *name, int kex_type) { | ||
834 | + int i = 0; | ||
835 | + | ||
836 | + switch (kex_type) { | ||
837 | + case KEX_GSS_GRP1_SHA1: | ||
838 | + if (strlen(name) < sizeof(KEX_GSS_GRP1_SHA1_ID)) | ||
839 | + return GSS_C_NO_OID; | ||
840 | + name += sizeof(KEX_GSS_GRP1_SHA1_ID) - 1; | ||
841 | + break; | ||
842 | + case KEX_GSS_GRP14_SHA1: | ||
843 | + if (strlen(name) < sizeof(KEX_GSS_GRP14_SHA1_ID)) | ||
844 | + return GSS_C_NO_OID; | ||
845 | + name += sizeof(KEX_GSS_GRP14_SHA1_ID) - 1; | ||
846 | + break; | ||
847 | + case KEX_GSS_GEX_SHA1: | ||
848 | + if (strlen(name) < sizeof(KEX_GSS_GEX_SHA1_ID)) | ||
849 | + return GSS_C_NO_OID; | ||
850 | + name += sizeof(KEX_GSS_GEX_SHA1_ID) - 1; | ||
851 | + break; | ||
852 | + default: | ||
853 | + return GSS_C_NO_OID; | ||
854 | + } | ||
855 | + | ||
856 | + while (gss_enc2oid[i].encoded != NULL && | ||
857 | + strcmp(name, gss_enc2oid[i].encoded) != 0) | ||
858 | + i++; | ||
859 | + | ||
860 | + if (gss_enc2oid[i].oid != NULL && ctx != NULL) | ||
861 | + ssh_gssapi_set_oid(ctx, gss_enc2oid[i].oid); | ||
862 | + | ||
863 | + return gss_enc2oid[i].oid; | ||
864 | +} | ||
865 | + | ||
866 | /* Check that the OID in a data stream matches that in the context */ | ||
867 | int | ||
868 | ssh_gssapi_check_oid(Gssctxt *ctx, void *data, size_t len) | ||
869 | @@ -198,7 +353,7 @@ ssh_gssapi_init_ctx(Gssctxt *ctx, int deleg_creds, gss_buffer_desc *recv_tok, | ||
870 | } | ||
871 | |||
872 | ctx->major = gss_init_sec_context(&ctx->minor, | ||
873 | - GSS_C_NO_CREDENTIAL, &ctx->context, ctx->name, ctx->oid, | ||
874 | + ctx->client_creds, &ctx->context, ctx->name, ctx->oid, | ||
875 | GSS_C_MUTUAL_FLAG | GSS_C_INTEG_FLAG | deleg_flag, | ||
876 | 0, NULL, recv_tok, NULL, send_tok, flags, NULL); | ||
877 | |||
878 | @@ -228,8 +383,42 @@ ssh_gssapi_import_name(Gssctxt *ctx, const char *host) | ||
879 | } | ||
880 | |||
881 | OM_uint32 | ||
882 | +ssh_gssapi_client_identity(Gssctxt *ctx, const char *name) | ||
883 | +{ | ||
884 | + gss_buffer_desc gssbuf; | ||
885 | + gss_name_t gssname; | ||
886 | + OM_uint32 status; | ||
887 | + gss_OID_set oidset; | ||
888 | + | ||
889 | + gssbuf.value = (void *) name; | ||
890 | + gssbuf.length = strlen(gssbuf.value); | ||
891 | + | ||
892 | + gss_create_empty_oid_set(&status, &oidset); | ||
893 | + gss_add_oid_set_member(&status, ctx->oid, &oidset); | ||
894 | + | ||
895 | + ctx->major = gss_import_name(&ctx->minor, &gssbuf, | ||
896 | + GSS_C_NT_USER_NAME, &gssname); | ||
897 | + | ||
898 | + if (!ctx->major) | ||
899 | + ctx->major = gss_acquire_cred(&ctx->minor, | ||
900 | + gssname, 0, oidset, GSS_C_INITIATE, | ||
901 | + &ctx->client_creds, NULL, NULL); | ||
902 | + | ||
903 | + gss_release_name(&status, &gssname); | ||
904 | + gss_release_oid_set(&status, &oidset); | ||
905 | + | ||
906 | + if (ctx->major) | ||
907 | + ssh_gssapi_error(ctx); | ||
908 | + | ||
909 | + return(ctx->major); | ||
910 | +} | ||
911 | + | ||
912 | +OM_uint32 | ||
913 | ssh_gssapi_sign(Gssctxt *ctx, gss_buffer_t buffer, gss_buffer_t hash) | ||
914 | { | ||
915 | + if (ctx == NULL) | ||
916 | + return -1; | ||
917 | + | ||
918 | if ((ctx->major = gss_get_mic(&ctx->minor, ctx->context, | ||
919 | GSS_C_QOP_DEFAULT, buffer, hash))) | ||
920 | ssh_gssapi_error(ctx); | ||
921 | @@ -237,6 +426,19 @@ ssh_gssapi_sign(Gssctxt *ctx, gss_buffer_t buffer, gss_buffer_t hash) | ||
922 | return (ctx->major); | ||
923 | } | ||
924 | |||
925 | +/* Priviledged when used by server */ | ||
926 | +OM_uint32 | ||
927 | +ssh_gssapi_checkmic(Gssctxt *ctx, gss_buffer_t gssbuf, gss_buffer_t gssmic) | ||
928 | +{ | ||
929 | + if (ctx == NULL) | ||
930 | + return -1; | ||
931 | + | ||
932 | + ctx->major = gss_verify_mic(&ctx->minor, ctx->context, | ||
933 | + gssbuf, gssmic, NULL); | ||
934 | + | ||
935 | + return (ctx->major); | ||
936 | +} | ||
937 | + | ||
938 | void | ||
939 | ssh_gssapi_buildmic(Buffer *b, const char *user, const char *service, | ||
940 | const char *context) | ||
941 | @@ -250,11 +452,16 @@ ssh_gssapi_buildmic(Buffer *b, const char *user, const char *service, | ||
942 | } | ||
943 | |||
944 | int | ||
945 | -ssh_gssapi_check_mechanism(Gssctxt **ctx, gss_OID oid, const char *host) | ||
946 | +ssh_gssapi_check_mechanism(Gssctxt **ctx, gss_OID oid, const char *host, | ||
947 | + const char *client) | ||
948 | { | ||
949 | gss_buffer_desc token = GSS_C_EMPTY_BUFFER; | ||
950 | OM_uint32 major, minor; | ||
951 | gss_OID_desc spnego_oid = {6, (void *)"\x2B\x06\x01\x05\x05\x02"}; | ||
952 | + Gssctxt *intctx = NULL; | ||
953 | + | ||
954 | + if (ctx == NULL) | ||
955 | + ctx = &intctx; | ||
956 | |||
957 | /* RFC 4462 says we MUST NOT do SPNEGO */ | ||
958 | if (oid->length == spnego_oid.length && | ||
959 | @@ -264,6 +471,10 @@ ssh_gssapi_check_mechanism(Gssctxt **ctx, gss_OID oid, const char *host) | ||
960 | ssh_gssapi_build_ctx(ctx); | ||
961 | ssh_gssapi_set_oid(*ctx, oid); | ||
962 | major = ssh_gssapi_import_name(*ctx, host); | ||
963 | + | ||
964 | + if (!GSS_ERROR(major) && client) | ||
965 | + major = ssh_gssapi_client_identity(*ctx, client); | ||
966 | + | ||
967 | if (!GSS_ERROR(major)) { | ||
968 | major = ssh_gssapi_init_ctx(*ctx, 0, GSS_C_NO_BUFFER, &token, | ||
969 | NULL); | ||
970 | @@ -273,10 +484,66 @@ ssh_gssapi_check_mechanism(Gssctxt **ctx, gss_OID oid, const char *host) | ||
971 | GSS_C_NO_BUFFER); | ||
972 | } | ||
973 | |||
974 | - if (GSS_ERROR(major)) | ||
975 | + if (GSS_ERROR(major) || intctx != NULL) | ||
976 | ssh_gssapi_delete_ctx(ctx); | ||
977 | |||
978 | return (!GSS_ERROR(major)); | ||
979 | } | ||
980 | |||
981 | +int | ||
982 | +ssh_gssapi_credentials_updated(Gssctxt *ctxt) { | ||
983 | + static gss_name_t saved_name = GSS_C_NO_NAME; | ||
984 | + static OM_uint32 saved_lifetime = 0; | ||
985 | + static gss_OID saved_mech = GSS_C_NO_OID; | ||
986 | + static gss_name_t name; | ||
987 | + static OM_uint32 last_call = 0; | ||
988 | + OM_uint32 lifetime, now, major, minor; | ||
989 | + int equal; | ||
990 | + | ||
991 | + now = time(NULL); | ||
992 | + | ||
993 | + if (ctxt) { | ||
994 | + debug("Rekey has happened - updating saved versions"); | ||
995 | + | ||
996 | + if (saved_name != GSS_C_NO_NAME) | ||
997 | + gss_release_name(&minor, &saved_name); | ||
998 | + | ||
999 | + major = gss_inquire_cred(&minor, GSS_C_NO_CREDENTIAL, | ||
1000 | + &saved_name, &saved_lifetime, NULL, NULL); | ||
1001 | + | ||
1002 | + if (!GSS_ERROR(major)) { | ||
1003 | + saved_mech = ctxt->oid; | ||
1004 | + saved_lifetime+= now; | ||
1005 | + } else { | ||
1006 | + /* Handle the error */ | ||
1007 | + } | ||
1008 | + return 0; | ||
1009 | + } | ||
1010 | + | ||
1011 | + if (now - last_call < 10) | ||
1012 | + return 0; | ||
1013 | + | ||
1014 | + last_call = now; | ||
1015 | + | ||
1016 | + if (saved_mech == GSS_C_NO_OID) | ||
1017 | + return 0; | ||
1018 | + | ||
1019 | + major = gss_inquire_cred(&minor, GSS_C_NO_CREDENTIAL, | ||
1020 | + &name, &lifetime, NULL, NULL); | ||
1021 | + if (major == GSS_S_CREDENTIALS_EXPIRED) | ||
1022 | + return 0; | ||
1023 | + else if (GSS_ERROR(major)) | ||
1024 | + return 0; | ||
1025 | + | ||
1026 | + major = gss_compare_name(&minor, saved_name, name, &equal); | ||
1027 | + gss_release_name(&minor, &name); | ||
1028 | + if (GSS_ERROR(major)) | ||
1029 | + return 0; | ||
1030 | + | ||
1031 | + if (equal && (saved_lifetime < lifetime + now - 10)) | ||
1032 | + return 1; | ||
1033 | + | ||
1034 | + return 0; | ||
1035 | +} | ||
1036 | + | ||
1037 | #endif /* GSSAPI */ | ||
1038 | diff --git a/gss-serv-krb5.c b/gss-serv-krb5.c | ||
1039 | index 795992d9..fd8b3718 100644 | ||
1040 | --- a/gss-serv-krb5.c | ||
1041 | +++ b/gss-serv-krb5.c | ||
1042 | @@ -1,7 +1,7 @@ | ||
1043 | /* $OpenBSD: gss-serv-krb5.c,v 1.8 2013/07/20 01:55:13 djm Exp $ */ | ||
1044 | |||
1045 | /* | ||
1046 | - * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved. | ||
1047 | + * Copyright (c) 2001-2007 Simon Wilkinson. All rights reserved. | ||
1048 | * | ||
1049 | * Redistribution and use in source and binary forms, with or without | ||
1050 | * modification, are permitted provided that the following conditions | ||
1051 | @@ -121,8 +121,8 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client) | ||
1052 | krb5_error_code problem; | ||
1053 | krb5_principal princ; | ||
1054 | OM_uint32 maj_status, min_status; | ||
1055 | - int len; | ||
1056 | const char *errmsg; | ||
1057 | + const char *new_ccname; | ||
1058 | |||
1059 | if (client->creds == NULL) { | ||
1060 | debug("No credentials stored"); | ||
1061 | @@ -181,11 +181,16 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client) | ||
1062 | return; | ||
1063 | } | ||
1064 | |||
1065 | - client->store.filename = xstrdup(krb5_cc_get_name(krb_context, ccache)); | ||
1066 | + new_ccname = krb5_cc_get_name(krb_context, ccache); | ||
1067 | + | ||
1068 | client->store.envvar = "KRB5CCNAME"; | ||
1069 | - len = strlen(client->store.filename) + 6; | ||
1070 | - client->store.envval = xmalloc(len); | ||
1071 | - snprintf(client->store.envval, len, "FILE:%s", client->store.filename); | ||
1072 | +#ifdef USE_CCAPI | ||
1073 | + xasprintf(&client->store.envval, "API:%s", new_ccname); | ||
1074 | + client->store.filename = NULL; | ||
1075 | +#else | ||
1076 | + xasprintf(&client->store.envval, "FILE:%s", new_ccname); | ||
1077 | + client->store.filename = xstrdup(new_ccname); | ||
1078 | +#endif | ||
1079 | |||
1080 | #ifdef USE_PAM | ||
1081 | if (options.use_pam) | ||
1082 | @@ -197,6 +202,71 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client) | ||
1083 | return; | ||
1084 | } | ||
1085 | |||
1086 | +int | ||
1087 | +ssh_gssapi_krb5_updatecreds(ssh_gssapi_ccache *store, | ||
1088 | + ssh_gssapi_client *client) | ||
1089 | +{ | ||
1090 | + krb5_ccache ccache = NULL; | ||
1091 | + krb5_principal principal = NULL; | ||
1092 | + char *name = NULL; | ||
1093 | + krb5_error_code problem; | ||
1094 | + OM_uint32 maj_status, min_status; | ||
1095 | + | ||
1096 | + if ((problem = krb5_cc_resolve(krb_context, store->envval, &ccache))) { | ||
1097 | + logit("krb5_cc_resolve(): %.100s", | ||
1098 | + krb5_get_err_text(krb_context, problem)); | ||
1099 | + return 0; | ||
1100 | + } | ||
1101 | + | ||
1102 | + /* Find out who the principal in this cache is */ | ||
1103 | + if ((problem = krb5_cc_get_principal(krb_context, ccache, | ||
1104 | + &principal))) { | ||
1105 | + logit("krb5_cc_get_principal(): %.100s", | ||
1106 | + krb5_get_err_text(krb_context, problem)); | ||
1107 | + krb5_cc_close(krb_context, ccache); | ||
1108 | + return 0; | ||
1109 | + } | ||
1110 | + | ||
1111 | + if ((problem = krb5_unparse_name(krb_context, principal, &name))) { | ||
1112 | + logit("krb5_unparse_name(): %.100s", | ||
1113 | + krb5_get_err_text(krb_context, problem)); | ||
1114 | + krb5_free_principal(krb_context, principal); | ||
1115 | + krb5_cc_close(krb_context, ccache); | ||
1116 | + return 0; | ||
1117 | + } | ||
1118 | + | ||
1119 | + | ||
1120 | + if (strcmp(name,client->exportedname.value)!=0) { | ||
1121 | + debug("Name in local credentials cache differs. Not storing"); | ||
1122 | + krb5_free_principal(krb_context, principal); | ||
1123 | + krb5_cc_close(krb_context, ccache); | ||
1124 | + krb5_free_unparsed_name(krb_context, name); | ||
1125 | + return 0; | ||
1126 | + } | ||
1127 | + krb5_free_unparsed_name(krb_context, name); | ||
1128 | + | ||
1129 | + /* Name matches, so lets get on with it! */ | ||
1130 | + | ||
1131 | + if ((problem = krb5_cc_initialize(krb_context, ccache, principal))) { | ||
1132 | + logit("krb5_cc_initialize(): %.100s", | ||
1133 | + krb5_get_err_text(krb_context, problem)); | ||
1134 | + krb5_free_principal(krb_context, principal); | ||
1135 | + krb5_cc_close(krb_context, ccache); | ||
1136 | + return 0; | ||
1137 | + } | ||
1138 | + | ||
1139 | + krb5_free_principal(krb_context, principal); | ||
1140 | + | ||
1141 | + if ((maj_status = gss_krb5_copy_ccache(&min_status, client->creds, | ||
1142 | + ccache))) { | ||
1143 | + logit("gss_krb5_copy_ccache() failed. Sorry!"); | ||
1144 | + krb5_cc_close(krb_context, ccache); | ||
1145 | + return 0; | ||
1146 | + } | ||
1147 | + | ||
1148 | + return 1; | ||
1149 | +} | ||
1150 | + | ||
1151 | ssh_gssapi_mech gssapi_kerberos_mech = { | ||
1152 | "toWM5Slw5Ew8Mqkay+al2g==", | ||
1153 | "Kerberos", | ||
1154 | @@ -204,7 +274,8 @@ ssh_gssapi_mech gssapi_kerberos_mech = { | ||
1155 | NULL, | ||
1156 | &ssh_gssapi_krb5_userok, | ||
1157 | NULL, | ||
1158 | - &ssh_gssapi_krb5_storecreds | ||
1159 | + &ssh_gssapi_krb5_storecreds, | ||
1160 | + &ssh_gssapi_krb5_updatecreds | ||
1161 | }; | ||
1162 | |||
1163 | #endif /* KRB5 */ | ||
1164 | diff --git a/gss-serv.c b/gss-serv.c | ||
1165 | index 53993d67..2e27cbf9 100644 | ||
1166 | --- a/gss-serv.c | ||
1167 | +++ b/gss-serv.c | ||
1168 | @@ -1,7 +1,7 @@ | ||
1169 | /* $OpenBSD: gss-serv.c,v 1.29 2015/05/22 03:50:02 djm Exp $ */ | ||
1170 | |||
1171 | /* | ||
1172 | - * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved. | ||
1173 | + * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved. | ||
1174 | * | ||
1175 | * Redistribution and use in source and binary forms, with or without | ||
1176 | * modification, are permitted provided that the following conditions | ||
1177 | @@ -45,17 +45,22 @@ | ||
1178 | #include "session.h" | ||
1179 | #include "misc.h" | ||
1180 | #include "servconf.h" | ||
1181 | +#include "uidswap.h" | ||
1182 | |||
1183 | #include "ssh-gss.h" | ||
1184 | +#include "monitor_wrap.h" | ||
1185 | + | ||
1186 | +extern ServerOptions options; | ||
1187 | |||
1188 | extern ServerOptions options; | ||
1189 | |||
1190 | static ssh_gssapi_client gssapi_client = | ||
1191 | { GSS_C_EMPTY_BUFFER, GSS_C_EMPTY_BUFFER, | ||
1192 | - GSS_C_NO_CREDENTIAL, NULL, {NULL, NULL, NULL, NULL}}; | ||
1193 | + GSS_C_NO_CREDENTIAL, GSS_C_NO_NAME, NULL, | ||
1194 | + {NULL, NULL, NULL, NULL, NULL}, 0, 0}; | ||
1195 | |||
1196 | ssh_gssapi_mech gssapi_null_mech = | ||
1197 | - { NULL, NULL, {0, NULL}, NULL, NULL, NULL, NULL}; | ||
1198 | + { NULL, NULL, {0, NULL}, NULL, NULL, NULL, NULL, NULL}; | ||
1199 | |||
1200 | #ifdef KRB5 | ||
1201 | extern ssh_gssapi_mech gssapi_kerberos_mech; | ||
1202 | @@ -142,6 +147,28 @@ ssh_gssapi_server_ctx(Gssctxt **ctx, gss_OID oid) | ||
1203 | } | ||
1204 | |||
1205 | /* Unprivileged */ | ||
1206 | +char * | ||
1207 | +ssh_gssapi_server_mechanisms(void) { | ||
1208 | + if (supported_oids == NULL) | ||
1209 | + ssh_gssapi_prepare_supported_oids(); | ||
1210 | + return (ssh_gssapi_kex_mechs(supported_oids, | ||
1211 | + &ssh_gssapi_server_check_mech, NULL, NULL)); | ||
1212 | +} | ||
1213 | + | ||
1214 | +/* Unprivileged */ | ||
1215 | +int | ||
1216 | +ssh_gssapi_server_check_mech(Gssctxt **dum, gss_OID oid, const char *data, | ||
1217 | + const char *dummy) { | ||
1218 | + Gssctxt *ctx = NULL; | ||
1219 | + int res; | ||
1220 | + | ||
1221 | + res = !GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctx, oid))); | ||
1222 | + ssh_gssapi_delete_ctx(&ctx); | ||
1223 | + | ||
1224 | + return (res); | ||
1225 | +} | ||
1226 | + | ||
1227 | +/* Unprivileged */ | ||
1228 | void | ||
1229 | ssh_gssapi_supported_oids(gss_OID_set *oidset) | ||
1230 | { | ||
1231 | @@ -151,7 +178,9 @@ ssh_gssapi_supported_oids(gss_OID_set *oidset) | ||
1232 | gss_OID_set supported; | ||
1233 | |||
1234 | gss_create_empty_oid_set(&min_status, oidset); | ||
1235 | - gss_indicate_mechs(&min_status, &supported); | ||
1236 | + | ||
1237 | + if (GSS_ERROR(gss_indicate_mechs(&min_status, &supported))) | ||
1238 | + return; | ||
1239 | |||
1240 | while (supported_mechs[i]->name != NULL) { | ||
1241 | if (GSS_ERROR(gss_test_oid_set_member(&min_status, | ||
1242 | @@ -277,8 +306,48 @@ OM_uint32 | ||
1243 | ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client) | ||
1244 | { | ||
1245 | int i = 0; | ||
1246 | + int equal = 0; | ||
1247 | + gss_name_t new_name = GSS_C_NO_NAME; | ||
1248 | + gss_buffer_desc ename = GSS_C_EMPTY_BUFFER; | ||
1249 | + | ||
1250 | + if (options.gss_store_rekey && client->used && ctx->client_creds) { | ||
1251 | + if (client->mech->oid.length != ctx->oid->length || | ||
1252 | + (memcmp(client->mech->oid.elements, | ||
1253 | + ctx->oid->elements, ctx->oid->length) !=0)) { | ||
1254 | + debug("Rekeyed credentials have different mechanism"); | ||
1255 | + return GSS_S_COMPLETE; | ||
1256 | + } | ||
1257 | + | ||
1258 | + if ((ctx->major = gss_inquire_cred_by_mech(&ctx->minor, | ||
1259 | + ctx->client_creds, ctx->oid, &new_name, | ||
1260 | + NULL, NULL, NULL))) { | ||
1261 | + ssh_gssapi_error(ctx); | ||
1262 | + return (ctx->major); | ||
1263 | + } | ||
1264 | + | ||
1265 | + ctx->major = gss_compare_name(&ctx->minor, client->name, | ||
1266 | + new_name, &equal); | ||
1267 | + | ||
1268 | + if (GSS_ERROR(ctx->major)) { | ||
1269 | + ssh_gssapi_error(ctx); | ||
1270 | + return (ctx->major); | ||
1271 | + } | ||
1272 | + | ||
1273 | + if (!equal) { | ||
1274 | + debug("Rekeyed credentials have different name"); | ||
1275 | + return GSS_S_COMPLETE; | ||
1276 | + } | ||
1277 | |||
1278 | - gss_buffer_desc ename; | ||
1279 | + debug("Marking rekeyed credentials for export"); | ||
1280 | + | ||
1281 | + gss_release_name(&ctx->minor, &client->name); | ||
1282 | + gss_release_cred(&ctx->minor, &client->creds); | ||
1283 | + client->name = new_name; | ||
1284 | + client->creds = ctx->client_creds; | ||
1285 | + ctx->client_creds = GSS_C_NO_CREDENTIAL; | ||
1286 | + client->updated = 1; | ||
1287 | + return GSS_S_COMPLETE; | ||
1288 | + } | ||
1289 | |||
1290 | client->mech = NULL; | ||
1291 | |||
1292 | @@ -293,6 +362,13 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client) | ||
1293 | if (client->mech == NULL) | ||
1294 | return GSS_S_FAILURE; | ||
1295 | |||
1296 | + if (ctx->client_creds && | ||
1297 | + (ctx->major = gss_inquire_cred_by_mech(&ctx->minor, | ||
1298 | + ctx->client_creds, ctx->oid, &client->name, NULL, NULL, NULL))) { | ||
1299 | + ssh_gssapi_error(ctx); | ||
1300 | + return (ctx->major); | ||
1301 | + } | ||
1302 | + | ||
1303 | if ((ctx->major = gss_display_name(&ctx->minor, ctx->client, | ||
1304 | &client->displayname, NULL))) { | ||
1305 | ssh_gssapi_error(ctx); | ||
1306 | @@ -310,6 +386,8 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client) | ||
1307 | return (ctx->major); | ||
1308 | } | ||
1309 | |||
1310 | + gss_release_buffer(&ctx->minor, &ename); | ||
1311 | + | ||
1312 | /* We can't copy this structure, so we just move the pointer to it */ | ||
1313 | client->creds = ctx->client_creds; | ||
1314 | ctx->client_creds = GSS_C_NO_CREDENTIAL; | ||
1315 | @@ -357,7 +435,7 @@ ssh_gssapi_do_child(char ***envp, u_int *envsizep) | ||
1316 | |||
1317 | /* Privileged */ | ||
1318 | int | ||
1319 | -ssh_gssapi_userok(char *user) | ||
1320 | +ssh_gssapi_userok(char *user, struct passwd *pw) | ||
1321 | { | ||
1322 | OM_uint32 lmin; | ||
1323 | |||
1324 | @@ -367,9 +445,11 @@ ssh_gssapi_userok(char *user) | ||
1325 | return 0; | ||
1326 | } | ||
1327 | if (gssapi_client.mech && gssapi_client.mech->userok) | ||
1328 | - if ((*gssapi_client.mech->userok)(&gssapi_client, user)) | ||
1329 | + if ((*gssapi_client.mech->userok)(&gssapi_client, user)) { | ||
1330 | + gssapi_client.used = 1; | ||
1331 | + gssapi_client.store.owner = pw; | ||
1332 | return 1; | ||
1333 | - else { | ||
1334 | + } else { | ||
1335 | /* Destroy delegated credentials if userok fails */ | ||
1336 | gss_release_buffer(&lmin, &gssapi_client.displayname); | ||
1337 | gss_release_buffer(&lmin, &gssapi_client.exportedname); | ||
1338 | @@ -383,14 +463,90 @@ ssh_gssapi_userok(char *user) | ||
1339 | return (0); | ||
1340 | } | ||
1341 | |||
1342 | -/* Privileged */ | ||
1343 | -OM_uint32 | ||
1344 | -ssh_gssapi_checkmic(Gssctxt *ctx, gss_buffer_t gssbuf, gss_buffer_t gssmic) | ||
1345 | +/* These bits are only used for rekeying. The unpriviledged child is running | ||
1346 | + * as the user, the monitor is root. | ||
1347 | + * | ||
1348 | + * In the child, we want to : | ||
1349 | + * *) Ask the monitor to store our credentials into the store we specify | ||
1350 | + * *) If it succeeds, maybe do a PAM update | ||
1351 | + */ | ||
1352 | + | ||
1353 | +/* Stuff for PAM */ | ||
1354 | + | ||
1355 | +#ifdef USE_PAM | ||
1356 | +static int ssh_gssapi_simple_conv(int n, const struct pam_message **msg, | ||
1357 | + struct pam_response **resp, void *data) | ||
1358 | { | ||
1359 | - ctx->major = gss_verify_mic(&ctx->minor, ctx->context, | ||
1360 | - gssbuf, gssmic, NULL); | ||
1361 | + return (PAM_CONV_ERR); | ||
1362 | +} | ||
1363 | +#endif | ||
1364 | |||
1365 | - return (ctx->major); | ||
1366 | +void | ||
1367 | +ssh_gssapi_rekey_creds(void) { | ||
1368 | + int ok; | ||
1369 | + int ret; | ||
1370 | +#ifdef USE_PAM | ||
1371 | + pam_handle_t *pamh = NULL; | ||
1372 | + struct pam_conv pamconv = {ssh_gssapi_simple_conv, NULL}; | ||
1373 | + char *envstr; | ||
1374 | +#endif | ||
1375 | + | ||
1376 | + if (gssapi_client.store.filename == NULL && | ||
1377 | + gssapi_client.store.envval == NULL && | ||
1378 | + gssapi_client.store.envvar == NULL) | ||
1379 | + return; | ||
1380 | + | ||
1381 | + ok = PRIVSEP(ssh_gssapi_update_creds(&gssapi_client.store)); | ||
1382 | + | ||
1383 | + if (!ok) | ||
1384 | + return; | ||
1385 | + | ||
1386 | + debug("Rekeyed credentials stored successfully"); | ||
1387 | + | ||
1388 | + /* Actually managing to play with the ssh pam stack from here will | ||
1389 | + * be next to impossible. In any case, we may want different options | ||
1390 | + * for rekeying. So, use our own :) | ||
1391 | + */ | ||
1392 | +#ifdef USE_PAM | ||
1393 | + if (!use_privsep) { | ||
1394 | + debug("Not even going to try and do PAM with privsep disabled"); | ||
1395 | + return; | ||
1396 | + } | ||
1397 | + | ||
1398 | + ret = pam_start("sshd-rekey", gssapi_client.store.owner->pw_name, | ||
1399 | + &pamconv, &pamh); | ||
1400 | + if (ret) | ||
1401 | + return; | ||
1402 | + | ||
1403 | + xasprintf(&envstr, "%s=%s", gssapi_client.store.envvar, | ||
1404 | + gssapi_client.store.envval); | ||
1405 | + | ||
1406 | + ret = pam_putenv(pamh, envstr); | ||
1407 | + if (!ret) | ||
1408 | + pam_setcred(pamh, PAM_REINITIALIZE_CRED); | ||
1409 | + pam_end(pamh, PAM_SUCCESS); | ||
1410 | +#endif | ||
1411 | +} | ||
1412 | + | ||
1413 | +int | ||
1414 | +ssh_gssapi_update_creds(ssh_gssapi_ccache *store) { | ||
1415 | + int ok = 0; | ||
1416 | + | ||
1417 | + /* Check we've got credentials to store */ | ||
1418 | + if (!gssapi_client.updated) | ||
1419 | + return 0; | ||
1420 | + | ||
1421 | + gssapi_client.updated = 0; | ||
1422 | + | ||
1423 | + temporarily_use_uid(gssapi_client.store.owner); | ||
1424 | + if (gssapi_client.mech && gssapi_client.mech->updatecreds) | ||
1425 | + ok = (*gssapi_client.mech->updatecreds)(store, &gssapi_client); | ||
1426 | + else | ||
1427 | + debug("No update function for this mechanism"); | ||
1428 | + | ||
1429 | + restore_uid(); | ||
1430 | + | ||
1431 | + return ok; | ||
1432 | } | ||
1433 | |||
1434 | #endif | ||
1435 | diff --git a/kex.c b/kex.c | ||
1436 | index 6a94bc53..d8708684 100644 | ||
1437 | --- a/kex.c | ||
1438 | +++ b/kex.c | ||
1439 | @@ -54,6 +54,10 @@ | ||
1440 | #include "sshbuf.h" | ||
1441 | #include "digest.h" | ||
1442 | |||
1443 | +#ifdef GSSAPI | ||
1444 | +#include "ssh-gss.h" | ||
1445 | +#endif | ||
1446 | + | ||
1447 | #if OPENSSL_VERSION_NUMBER >= 0x00907000L | ||
1448 | # if defined(HAVE_EVP_SHA256) | ||
1449 | # define evp_ssh_sha256 EVP_sha256 | ||
1450 | @@ -113,6 +117,14 @@ static const struct kexalg kexalgs[] = { | ||
1451 | #endif /* HAVE_EVP_SHA256 || !WITH_OPENSSL */ | ||
1452 | { NULL, -1, -1, -1}, | ||
1453 | }; | ||
1454 | +static const struct kexalg kexalg_prefixes[] = { | ||
1455 | +#ifdef GSSAPI | ||
1456 | + { KEX_GSS_GEX_SHA1_ID, KEX_GSS_GEX_SHA1, 0, SSH_DIGEST_SHA1 }, | ||
1457 | + { KEX_GSS_GRP1_SHA1_ID, KEX_GSS_GRP1_SHA1, 0, SSH_DIGEST_SHA1 }, | ||
1458 | + { KEX_GSS_GRP14_SHA1_ID, KEX_GSS_GRP14_SHA1, 0, SSH_DIGEST_SHA1 }, | ||
1459 | +#endif | ||
1460 | + { NULL, -1, -1, -1 }, | ||
1461 | +}; | ||
1462 | |||
1463 | char * | ||
1464 | kex_alg_list(char sep) | ||
1465 | @@ -145,6 +157,10 @@ kex_alg_by_name(const char *name) | ||
1466 | if (strcmp(k->name, name) == 0) | ||
1467 | return k; | ||
1468 | } | ||
1469 | + for (k = kexalg_prefixes; k->name != NULL; k++) { | ||
1470 | + if (strncmp(k->name, name, strlen(k->name)) == 0) | ||
1471 | + return k; | ||
1472 | + } | ||
1473 | return NULL; | ||
1474 | } | ||
1475 | |||
1476 | @@ -597,6 +613,9 @@ kex_free(struct kex *kex) | ||
1477 | sshbuf_free(kex->peer); | ||
1478 | sshbuf_free(kex->my); | ||
1479 | free(kex->session_id); | ||
1480 | +#ifdef GSSAPI | ||
1481 | + free(kex->gss_host); | ||
1482 | +#endif /* GSSAPI */ | ||
1483 | free(kex->client_version_string); | ||
1484 | free(kex->server_version_string); | ||
1485 | free(kex->failed_choice); | ||
1486 | diff --git a/kex.h b/kex.h | ||
1487 | index 3794f212..fd56171d 100644 | ||
1488 | --- a/kex.h | ||
1489 | +++ b/kex.h | ||
1490 | @@ -99,6 +99,9 @@ enum kex_exchange { | ||
1491 | KEX_DH_GEX_SHA256, | ||
1492 | KEX_ECDH_SHA2, | ||
1493 | KEX_C25519_SHA256, | ||
1494 | + KEX_GSS_GRP1_SHA1, | ||
1495 | + KEX_GSS_GRP14_SHA1, | ||
1496 | + KEX_GSS_GEX_SHA1, | ||
1497 | KEX_MAX | ||
1498 | }; | ||
1499 | |||
1500 | @@ -147,6 +150,12 @@ struct kex { | ||
1501 | u_int flags; | ||
1502 | int hash_alg; | ||
1503 | int ec_nid; | ||
1504 | +#ifdef GSSAPI | ||
1505 | + int gss_deleg_creds; | ||
1506 | + int gss_trust_dns; | ||
1507 | + char *gss_host; | ||
1508 | + char *gss_client; | ||
1509 | +#endif | ||
1510 | char *client_version_string; | ||
1511 | char *server_version_string; | ||
1512 | char *failed_choice; | ||
1513 | @@ -197,6 +206,11 @@ int kexecdh_server(struct ssh *); | ||
1514 | int kexc25519_client(struct ssh *); | ||
1515 | int kexc25519_server(struct ssh *); | ||
1516 | |||
1517 | +#ifdef GSSAPI | ||
1518 | +int kexgss_client(struct ssh *); | ||
1519 | +int kexgss_server(struct ssh *); | ||
1520 | +#endif | ||
1521 | + | ||
1522 | int kex_dh_hash(int, const char *, const char *, | ||
1523 | const u_char *, size_t, const u_char *, size_t, const u_char *, size_t, | ||
1524 | const BIGNUM *, const BIGNUM *, const BIGNUM *, u_char *, size_t *); | ||
1525 | diff --git a/kexgssc.c b/kexgssc.c | ||
1526 | new file mode 100644 | ||
1527 | index 00000000..10447f2b | ||
1528 | --- /dev/null | ||
1529 | +++ b/kexgssc.c | ||
1530 | @@ -0,0 +1,338 @@ | ||
1531 | +/* | ||
1532 | + * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved. | ||
1533 | + * | ||
1534 | + * Redistribution and use in source and binary forms, with or without | ||
1535 | + * modification, are permitted provided that the following conditions | ||
1536 | + * are met: | ||
1537 | + * 1. Redistributions of source code must retain the above copyright | ||
1538 | + * notice, this list of conditions and the following disclaimer. | ||
1539 | + * 2. Redistributions in binary form must reproduce the above copyright | ||
1540 | + * notice, this list of conditions and the following disclaimer in the | ||
1541 | + * documentation and/or other materials provided with the distribution. | ||
1542 | + * | ||
1543 | + * THIS SOFTWARE IS PROVIDED BY THE AUTHOR `AS IS'' AND ANY EXPRESS OR | ||
1544 | + * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES | ||
1545 | + * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. | ||
1546 | + * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, | ||
1547 | + * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT | ||
1548 | + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, | ||
1549 | + * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY | ||
1550 | + * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT | ||
1551 | + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF | ||
1552 | + * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | ||
1553 | + */ | ||
1554 | + | ||
1555 | +#include "includes.h" | ||
1556 | + | ||
1557 | +#ifdef GSSAPI | ||
1558 | + | ||
1559 | +#include "includes.h" | ||
1560 | + | ||
1561 | +#include <openssl/crypto.h> | ||
1562 | +#include <openssl/bn.h> | ||
1563 | + | ||
1564 | +#include <string.h> | ||
1565 | + | ||
1566 | +#include "xmalloc.h" | ||
1567 | +#include "buffer.h" | ||
1568 | +#include "ssh2.h" | ||
1569 | +#include "key.h" | ||
1570 | +#include "cipher.h" | ||
1571 | +#include "kex.h" | ||
1572 | +#include "log.h" | ||
1573 | +#include "packet.h" | ||
1574 | +#include "dh.h" | ||
1575 | +#include "digest.h" | ||
1576 | + | ||
1577 | +#include "ssh-gss.h" | ||
1578 | + | ||
1579 | +int | ||
1580 | +kexgss_client(struct ssh *ssh) { | ||
1581 | + gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER; | ||
1582 | + gss_buffer_desc recv_tok, gssbuf, msg_tok, *token_ptr; | ||
1583 | + Gssctxt *ctxt; | ||
1584 | + OM_uint32 maj_status, min_status, ret_flags; | ||
1585 | + u_int klen, kout, slen = 0, strlen; | ||
1586 | + DH *dh; | ||
1587 | + BIGNUM *dh_server_pub = NULL; | ||
1588 | + BIGNUM *shared_secret = NULL; | ||
1589 | + BIGNUM *p = NULL; | ||
1590 | + BIGNUM *g = NULL; | ||
1591 | + u_char *kbuf; | ||
1592 | + u_char *serverhostkey = NULL; | ||
1593 | + u_char *empty = ""; | ||
1594 | + char *msg; | ||
1595 | + int type = 0; | ||
1596 | + int first = 1; | ||
1597 | + int nbits = 0, min = DH_GRP_MIN, max = DH_GRP_MAX; | ||
1598 | + u_char hash[SSH_DIGEST_MAX_LENGTH]; | ||
1599 | + size_t hashlen; | ||
1600 | + | ||
1601 | + /* Initialise our GSSAPI world */ | ||
1602 | + ssh_gssapi_build_ctx(&ctxt); | ||
1603 | + if (ssh_gssapi_id_kex(ctxt, ssh->kex->name, ssh->kex->kex_type) | ||
1604 | + == GSS_C_NO_OID) | ||
1605 | + fatal("Couldn't identify host exchange"); | ||
1606 | + | ||
1607 | + if (ssh_gssapi_import_name(ctxt, ssh->kex->gss_host)) | ||
1608 | + fatal("Couldn't import hostname"); | ||
1609 | + | ||
1610 | + if (ssh->kex->gss_client && | ||
1611 | + ssh_gssapi_client_identity(ctxt, ssh->kex->gss_client)) | ||
1612 | + fatal("Couldn't acquire client credentials"); | ||
1613 | + | ||
1614 | + switch (ssh->kex->kex_type) { | ||
1615 | + case KEX_GSS_GRP1_SHA1: | ||
1616 | + dh = dh_new_group1(); | ||
1617 | + break; | ||
1618 | + case KEX_GSS_GRP14_SHA1: | ||
1619 | + dh = dh_new_group14(); | ||
1620 | + break; | ||
1621 | + case KEX_GSS_GEX_SHA1: | ||
1622 | + debug("Doing group exchange\n"); | ||
1623 | + nbits = dh_estimate(ssh->kex->we_need * 8); | ||
1624 | + packet_start(SSH2_MSG_KEXGSS_GROUPREQ); | ||
1625 | + packet_put_int(min); | ||
1626 | + packet_put_int(nbits); | ||
1627 | + packet_put_int(max); | ||
1628 | + | ||
1629 | + packet_send(); | ||
1630 | + | ||
1631 | + packet_read_expect(SSH2_MSG_KEXGSS_GROUP); | ||
1632 | + | ||
1633 | + if ((p = BN_new()) == NULL) | ||
1634 | + fatal("BN_new() failed"); | ||
1635 | + packet_get_bignum2(p); | ||
1636 | + if ((g = BN_new()) == NULL) | ||
1637 | + fatal("BN_new() failed"); | ||
1638 | + packet_get_bignum2(g); | ||
1639 | + packet_check_eom(); | ||
1640 | + | ||
1641 | + if (BN_num_bits(p) < min || BN_num_bits(p) > max) | ||
1642 | + fatal("GSSGRP_GEX group out of range: %d !< %d !< %d", | ||
1643 | + min, BN_num_bits(p), max); | ||
1644 | + | ||
1645 | + dh = dh_new_group(g, p); | ||
1646 | + break; | ||
1647 | + default: | ||
1648 | + fatal("%s: Unexpected KEX type %d", __func__, ssh->kex->kex_type); | ||
1649 | + } | ||
1650 | + | ||
1651 | + /* Step 1 - e is dh->pub_key */ | ||
1652 | + dh_gen_key(dh, ssh->kex->we_need * 8); | ||
1653 | + | ||
1654 | + /* This is f, we initialise it now to make life easier */ | ||
1655 | + dh_server_pub = BN_new(); | ||
1656 | + if (dh_server_pub == NULL) | ||
1657 | + fatal("dh_server_pub == NULL"); | ||
1658 | + | ||
1659 | + token_ptr = GSS_C_NO_BUFFER; | ||
1660 | + | ||
1661 | + do { | ||
1662 | + debug("Calling gss_init_sec_context"); | ||
1663 | + | ||
1664 | + maj_status = ssh_gssapi_init_ctx(ctxt, | ||
1665 | + ssh->kex->gss_deleg_creds, token_ptr, &send_tok, | ||
1666 | + &ret_flags); | ||
1667 | + | ||
1668 | + if (GSS_ERROR(maj_status)) { | ||
1669 | + if (send_tok.length != 0) { | ||
1670 | + packet_start(SSH2_MSG_KEXGSS_CONTINUE); | ||
1671 | + packet_put_string(send_tok.value, | ||
1672 | + send_tok.length); | ||
1673 | + } | ||
1674 | + fatal("gss_init_context failed"); | ||
1675 | + } | ||
1676 | + | ||
1677 | + /* If we've got an old receive buffer get rid of it */ | ||
1678 | + if (token_ptr != GSS_C_NO_BUFFER) | ||
1679 | + free(recv_tok.value); | ||
1680 | + | ||
1681 | + if (maj_status == GSS_S_COMPLETE) { | ||
1682 | + /* If mutual state flag is not true, kex fails */ | ||
1683 | + if (!(ret_flags & GSS_C_MUTUAL_FLAG)) | ||
1684 | + fatal("Mutual authentication failed"); | ||
1685 | + | ||
1686 | + /* If integ avail flag is not true kex fails */ | ||
1687 | + if (!(ret_flags & GSS_C_INTEG_FLAG)) | ||
1688 | + fatal("Integrity check failed"); | ||
1689 | + } | ||
1690 | + | ||
1691 | + /* | ||
1692 | + * If we have data to send, then the last message that we | ||
1693 | + * received cannot have been a 'complete'. | ||
1694 | + */ | ||
1695 | + if (send_tok.length != 0) { | ||
1696 | + if (first) { | ||
1697 | + packet_start(SSH2_MSG_KEXGSS_INIT); | ||
1698 | + packet_put_string(send_tok.value, | ||
1699 | + send_tok.length); | ||
1700 | + packet_put_bignum2(dh->pub_key); | ||
1701 | + first = 0; | ||
1702 | + } else { | ||
1703 | + packet_start(SSH2_MSG_KEXGSS_CONTINUE); | ||
1704 | + packet_put_string(send_tok.value, | ||
1705 | + send_tok.length); | ||
1706 | + } | ||
1707 | + packet_send(); | ||
1708 | + gss_release_buffer(&min_status, &send_tok); | ||
1709 | + | ||
1710 | + /* If we've sent them data, they should reply */ | ||
1711 | + do { | ||
1712 | + type = packet_read(); | ||
1713 | + if (type == SSH2_MSG_KEXGSS_HOSTKEY) { | ||
1714 | + debug("Received KEXGSS_HOSTKEY"); | ||
1715 | + if (serverhostkey) | ||
1716 | + fatal("Server host key received more than once"); | ||
1717 | + serverhostkey = | ||
1718 | + packet_get_string(&slen); | ||
1719 | + } | ||
1720 | + } while (type == SSH2_MSG_KEXGSS_HOSTKEY); | ||
1721 | + | ||
1722 | + switch (type) { | ||
1723 | + case SSH2_MSG_KEXGSS_CONTINUE: | ||
1724 | + debug("Received GSSAPI_CONTINUE"); | ||
1725 | + if (maj_status == GSS_S_COMPLETE) | ||
1726 | + fatal("GSSAPI Continue received from server when complete"); | ||
1727 | + recv_tok.value = packet_get_string(&strlen); | ||
1728 | + recv_tok.length = strlen; | ||
1729 | + break; | ||
1730 | + case SSH2_MSG_KEXGSS_COMPLETE: | ||
1731 | + debug("Received GSSAPI_COMPLETE"); | ||
1732 | + packet_get_bignum2(dh_server_pub); | ||
1733 | + msg_tok.value = packet_get_string(&strlen); | ||
1734 | + msg_tok.length = strlen; | ||
1735 | + | ||
1736 | + /* Is there a token included? */ | ||
1737 | + if (packet_get_char()) { | ||
1738 | + recv_tok.value= | ||
1739 | + packet_get_string(&strlen); | ||
1740 | + recv_tok.length = strlen; | ||
1741 | + /* If we're already complete - protocol error */ | ||
1742 | + if (maj_status == GSS_S_COMPLETE) | ||
1743 | + packet_disconnect("Protocol error: received token when complete"); | ||
1744 | + } else { | ||
1745 | + /* No token included */ | ||
1746 | + if (maj_status != GSS_S_COMPLETE) | ||
1747 | + packet_disconnect("Protocol error: did not receive final token"); | ||
1748 | + } | ||
1749 | + break; | ||
1750 | + case SSH2_MSG_KEXGSS_ERROR: | ||
1751 | + debug("Received Error"); | ||
1752 | + maj_status = packet_get_int(); | ||
1753 | + min_status = packet_get_int(); | ||
1754 | + msg = packet_get_string(NULL); | ||
1755 | + (void) packet_get_string_ptr(NULL); | ||
1756 | + fatal("GSSAPI Error: \n%.400s",msg); | ||
1757 | + default: | ||
1758 | + packet_disconnect("Protocol error: didn't expect packet type %d", | ||
1759 | + type); | ||
1760 | + } | ||
1761 | + token_ptr = &recv_tok; | ||
1762 | + } else { | ||
1763 | + /* No data, and not complete */ | ||
1764 | + if (maj_status != GSS_S_COMPLETE) | ||
1765 | + fatal("Not complete, and no token output"); | ||
1766 | + } | ||
1767 | + } while (maj_status & GSS_S_CONTINUE_NEEDED); | ||
1768 | + | ||
1769 | + /* | ||
1770 | + * We _must_ have received a COMPLETE message in reply from the | ||
1771 | + * server, which will have set dh_server_pub and msg_tok | ||
1772 | + */ | ||
1773 | + | ||
1774 | + if (type != SSH2_MSG_KEXGSS_COMPLETE) | ||
1775 | + fatal("Didn't receive a SSH2_MSG_KEXGSS_COMPLETE when I expected it"); | ||
1776 | + | ||
1777 | + /* Check f in range [1, p-1] */ | ||
1778 | + if (!dh_pub_is_valid(dh, dh_server_pub)) | ||
1779 | + packet_disconnect("bad server public DH value"); | ||
1780 | + | ||
1781 | + /* compute K=f^x mod p */ | ||
1782 | + klen = DH_size(dh); | ||
1783 | + kbuf = xmalloc(klen); | ||
1784 | + kout = DH_compute_key(kbuf, dh_server_pub, dh); | ||
1785 | + if (kout < 0) | ||
1786 | + fatal("DH_compute_key: failed"); | ||
1787 | + | ||
1788 | + shared_secret = BN_new(); | ||
1789 | + if (shared_secret == NULL) | ||
1790 | + fatal("kexgss_client: BN_new failed"); | ||
1791 | + | ||
1792 | + if (BN_bin2bn(kbuf, kout, shared_secret) == NULL) | ||
1793 | + fatal("kexdh_client: BN_bin2bn failed"); | ||
1794 | + | ||
1795 | + memset(kbuf, 0, klen); | ||
1796 | + free(kbuf); | ||
1797 | + | ||
1798 | + hashlen = sizeof(hash); | ||
1799 | + switch (ssh->kex->kex_type) { | ||
1800 | + case KEX_GSS_GRP1_SHA1: | ||
1801 | + case KEX_GSS_GRP14_SHA1: | ||
1802 | + kex_dh_hash( | ||
1803 | + ssh->kex->hash_alg, | ||
1804 | + ssh->kex->client_version_string, | ||
1805 | + ssh->kex->server_version_string, | ||
1806 | + buffer_ptr(ssh->kex->my), buffer_len(ssh->kex->my), | ||
1807 | + buffer_ptr(ssh->kex->peer), buffer_len(ssh->kex->peer), | ||
1808 | + (serverhostkey ? serverhostkey : empty), slen, | ||
1809 | + dh->pub_key, /* e */ | ||
1810 | + dh_server_pub, /* f */ | ||
1811 | + shared_secret, /* K */ | ||
1812 | + hash, &hashlen | ||
1813 | + ); | ||
1814 | + break; | ||
1815 | + case KEX_GSS_GEX_SHA1: | ||
1816 | + kexgex_hash( | ||
1817 | + ssh->kex->hash_alg, | ||
1818 | + ssh->kex->client_version_string, | ||
1819 | + ssh->kex->server_version_string, | ||
1820 | + buffer_ptr(ssh->kex->my), buffer_len(ssh->kex->my), | ||
1821 | + buffer_ptr(ssh->kex->peer), buffer_len(ssh->kex->peer), | ||
1822 | + (serverhostkey ? serverhostkey : empty), slen, | ||
1823 | + min, nbits, max, | ||
1824 | + dh->p, dh->g, | ||
1825 | + dh->pub_key, | ||
1826 | + dh_server_pub, | ||
1827 | + shared_secret, | ||
1828 | + hash, &hashlen | ||
1829 | + ); | ||
1830 | + break; | ||
1831 | + default: | ||
1832 | + fatal("%s: Unexpected KEX type %d", __func__, ssh->kex->kex_type); | ||
1833 | + } | ||
1834 | + | ||
1835 | + gssbuf.value = hash; | ||
1836 | + gssbuf.length = hashlen; | ||
1837 | + | ||
1838 | + /* Verify that the hash matches the MIC we just got. */ | ||
1839 | + if (GSS_ERROR(ssh_gssapi_checkmic(ctxt, &gssbuf, &msg_tok))) | ||
1840 | + packet_disconnect("Hash's MIC didn't verify"); | ||
1841 | + | ||
1842 | + free(msg_tok.value); | ||
1843 | + | ||
1844 | + DH_free(dh); | ||
1845 | + free(serverhostkey); | ||
1846 | + BN_clear_free(dh_server_pub); | ||
1847 | + | ||
1848 | + /* save session id */ | ||
1849 | + if (ssh->kex->session_id == NULL) { | ||
1850 | + ssh->kex->session_id_len = hashlen; | ||
1851 | + ssh->kex->session_id = xmalloc(ssh->kex->session_id_len); | ||
1852 | + memcpy(ssh->kex->session_id, hash, ssh->kex->session_id_len); | ||
1853 | + } | ||
1854 | + | ||
1855 | + if (ssh->kex->gss_deleg_creds) | ||
1856 | + ssh_gssapi_credentials_updated(ctxt); | ||
1857 | + | ||
1858 | + if (gss_kex_context == NULL) | ||
1859 | + gss_kex_context = ctxt; | ||
1860 | + else | ||
1861 | + ssh_gssapi_delete_ctx(&ctxt); | ||
1862 | + | ||
1863 | + kex_derive_keys_bn(ssh, hash, hashlen, shared_secret); | ||
1864 | + BN_clear_free(shared_secret); | ||
1865 | + return kex_send_newkeys(ssh); | ||
1866 | +} | ||
1867 | + | ||
1868 | +#endif /* GSSAPI */ | ||
1869 | diff --git a/kexgsss.c b/kexgsss.c | ||
1870 | new file mode 100644 | ||
1871 | index 00000000..38ca082b | ||
1872 | --- /dev/null | ||
1873 | +++ b/kexgsss.c | ||
1874 | @@ -0,0 +1,295 @@ | ||
1875 | +/* | ||
1876 | + * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved. | ||
1877 | + * | ||
1878 | + * Redistribution and use in source and binary forms, with or without | ||
1879 | + * modification, are permitted provided that the following conditions | ||
1880 | + * are met: | ||
1881 | + * 1. Redistributions of source code must retain the above copyright | ||
1882 | + * notice, this list of conditions and the following disclaimer. | ||
1883 | + * 2. Redistributions in binary form must reproduce the above copyright | ||
1884 | + * notice, this list of conditions and the following disclaimer in the | ||
1885 | + * documentation and/or other materials provided with the distribution. | ||
1886 | + * | ||
1887 | + * THIS SOFTWARE IS PROVIDED BY THE AUTHOR `AS IS'' AND ANY EXPRESS OR | ||
1888 | + * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES | ||
1889 | + * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. | ||
1890 | + * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, | ||
1891 | + * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT | ||
1892 | + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, | ||
1893 | + * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY | ||
1894 | + * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT | ||
1895 | + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF | ||
1896 | + * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | ||
1897 | + */ | ||
1898 | + | ||
1899 | +#include "includes.h" | ||
1900 | + | ||
1901 | +#ifdef GSSAPI | ||
1902 | + | ||
1903 | +#include <string.h> | ||
1904 | + | ||
1905 | +#include <openssl/crypto.h> | ||
1906 | +#include <openssl/bn.h> | ||
1907 | + | ||
1908 | +#include "xmalloc.h" | ||
1909 | +#include "buffer.h" | ||
1910 | +#include "ssh2.h" | ||
1911 | +#include "key.h" | ||
1912 | +#include "cipher.h" | ||
1913 | +#include "kex.h" | ||
1914 | +#include "log.h" | ||
1915 | +#include "packet.h" | ||
1916 | +#include "dh.h" | ||
1917 | +#include "ssh-gss.h" | ||
1918 | +#include "monitor_wrap.h" | ||
1919 | +#include "misc.h" | ||
1920 | +#include "servconf.h" | ||
1921 | +#include "digest.h" | ||
1922 | + | ||
1923 | +extern ServerOptions options; | ||
1924 | + | ||
1925 | +int | ||
1926 | +kexgss_server(struct ssh *ssh) | ||
1927 | +{ | ||
1928 | + OM_uint32 maj_status, min_status; | ||
1929 | + | ||
1930 | + /* | ||
1931 | + * Some GSSAPI implementations use the input value of ret_flags (an | ||
1932 | + * output variable) as a means of triggering mechanism specific | ||
1933 | + * features. Initializing it to zero avoids inadvertently | ||
1934 | + * activating this non-standard behaviour. | ||
1935 | + */ | ||
1936 | + | ||
1937 | + OM_uint32 ret_flags = 0; | ||
1938 | + gss_buffer_desc gssbuf, recv_tok, msg_tok; | ||
1939 | + gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER; | ||
1940 | + Gssctxt *ctxt = NULL; | ||
1941 | + u_int slen, klen, kout; | ||
1942 | + u_char *kbuf; | ||
1943 | + DH *dh; | ||
1944 | + int min = -1, max = -1, nbits = -1; | ||
1945 | + BIGNUM *shared_secret = NULL; | ||
1946 | + BIGNUM *dh_client_pub = NULL; | ||
1947 | + int type = 0; | ||
1948 | + gss_OID oid; | ||
1949 | + char *mechs; | ||
1950 | + u_char hash[SSH_DIGEST_MAX_LENGTH]; | ||
1951 | + size_t hashlen; | ||
1952 | + | ||
1953 | + /* Initialise GSSAPI */ | ||
1954 | + | ||
1955 | + /* If we're rekeying, privsep means that some of the private structures | ||
1956 | + * in the GSSAPI code are no longer available. This kludges them back | ||
1957 | + * into life | ||
1958 | + */ | ||
1959 | + if (!ssh_gssapi_oid_table_ok()) { | ||
1960 | + mechs = ssh_gssapi_server_mechanisms(); | ||
1961 | + free(mechs); | ||
1962 | + } | ||
1963 | + | ||
1964 | + debug2("%s: Identifying %s", __func__, ssh->kex->name); | ||
1965 | + oid = ssh_gssapi_id_kex(NULL, ssh->kex->name, ssh->kex->kex_type); | ||
1966 | + if (oid == GSS_C_NO_OID) | ||
1967 | + fatal("Unknown gssapi mechanism"); | ||
1968 | + | ||
1969 | + debug2("%s: Acquiring credentials", __func__); | ||
1970 | + | ||
1971 | + if (GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctxt, oid)))) | ||
1972 | + fatal("Unable to acquire credentials for the server"); | ||
1973 | + | ||
1974 | + switch (ssh->kex->kex_type) { | ||
1975 | + case KEX_GSS_GRP1_SHA1: | ||
1976 | + dh = dh_new_group1(); | ||
1977 | + break; | ||
1978 | + case KEX_GSS_GRP14_SHA1: | ||
1979 | + dh = dh_new_group14(); | ||
1980 | + break; | ||
1981 | + case KEX_GSS_GEX_SHA1: | ||
1982 | + debug("Doing group exchange"); | ||
1983 | + packet_read_expect(SSH2_MSG_KEXGSS_GROUPREQ); | ||
1984 | + min = packet_get_int(); | ||
1985 | + nbits = packet_get_int(); | ||
1986 | + max = packet_get_int(); | ||
1987 | + packet_check_eom(); | ||
1988 | + if (max < min || nbits < min || max < nbits) | ||
1989 | + fatal("GSS_GEX, bad parameters: %d !< %d !< %d", | ||
1990 | + min, nbits, max); | ||
1991 | + dh = PRIVSEP(choose_dh(MAX(DH_GRP_MIN, min), | ||
1992 | + nbits, MIN(DH_GRP_MAX, max))); | ||
1993 | + if (dh == NULL) | ||
1994 | + packet_disconnect("Protocol error: no matching group found"); | ||
1995 | + | ||
1996 | + packet_start(SSH2_MSG_KEXGSS_GROUP); | ||
1997 | + packet_put_bignum2(dh->p); | ||
1998 | + packet_put_bignum2(dh->g); | ||
1999 | + packet_send(); | ||
2000 | + | ||
2001 | + packet_write_wait(); | ||
2002 | + break; | ||
2003 | + default: | ||
2004 | + fatal("%s: Unexpected KEX type %d", __func__, ssh->kex->kex_type); | ||
2005 | + } | ||
2006 | + | ||
2007 | + dh_gen_key(dh, ssh->kex->we_need * 8); | ||
2008 | + | ||
2009 | + do { | ||
2010 | + debug("Wait SSH2_MSG_GSSAPI_INIT"); | ||
2011 | + type = packet_read(); | ||
2012 | + switch(type) { | ||
2013 | + case SSH2_MSG_KEXGSS_INIT: | ||
2014 | + if (dh_client_pub != NULL) | ||
2015 | + fatal("Received KEXGSS_INIT after initialising"); | ||
2016 | + recv_tok.value = packet_get_string(&slen); | ||
2017 | + recv_tok.length = slen; | ||
2018 | + | ||
2019 | + if ((dh_client_pub = BN_new()) == NULL) | ||
2020 | + fatal("dh_client_pub == NULL"); | ||
2021 | + | ||
2022 | + packet_get_bignum2(dh_client_pub); | ||
2023 | + | ||
2024 | + /* Send SSH_MSG_KEXGSS_HOSTKEY here, if we want */ | ||
2025 | + break; | ||
2026 | + case SSH2_MSG_KEXGSS_CONTINUE: | ||
2027 | + recv_tok.value = packet_get_string(&slen); | ||
2028 | + recv_tok.length = slen; | ||
2029 | + break; | ||
2030 | + default: | ||
2031 | + packet_disconnect( | ||
2032 | + "Protocol error: didn't expect packet type %d", | ||
2033 | + type); | ||
2034 | + } | ||
2035 | + | ||
2036 | + maj_status = PRIVSEP(ssh_gssapi_accept_ctx(ctxt, &recv_tok, | ||
2037 | + &send_tok, &ret_flags)); | ||
2038 | + | ||
2039 | + free(recv_tok.value); | ||
2040 | + | ||
2041 | + if (maj_status != GSS_S_COMPLETE && send_tok.length == 0) | ||
2042 | + fatal("Zero length token output when incomplete"); | ||
2043 | + | ||
2044 | + if (dh_client_pub == NULL) | ||
2045 | + fatal("No client public key"); | ||
2046 | + | ||
2047 | + if (maj_status & GSS_S_CONTINUE_NEEDED) { | ||
2048 | + debug("Sending GSSAPI_CONTINUE"); | ||
2049 | + packet_start(SSH2_MSG_KEXGSS_CONTINUE); | ||
2050 | + packet_put_string(send_tok.value, send_tok.length); | ||
2051 | + packet_send(); | ||
2052 | + gss_release_buffer(&min_status, &send_tok); | ||
2053 | + } | ||
2054 | + } while (maj_status & GSS_S_CONTINUE_NEEDED); | ||
2055 | + | ||
2056 | + if (GSS_ERROR(maj_status)) { | ||
2057 | + if (send_tok.length > 0) { | ||
2058 | + packet_start(SSH2_MSG_KEXGSS_CONTINUE); | ||
2059 | + packet_put_string(send_tok.value, send_tok.length); | ||
2060 | + packet_send(); | ||
2061 | + } | ||
2062 | + fatal("accept_ctx died"); | ||
2063 | + } | ||
2064 | + | ||
2065 | + if (!(ret_flags & GSS_C_MUTUAL_FLAG)) | ||
2066 | + fatal("Mutual Authentication flag wasn't set"); | ||
2067 | + | ||
2068 | + if (!(ret_flags & GSS_C_INTEG_FLAG)) | ||
2069 | + fatal("Integrity flag wasn't set"); | ||
2070 | + | ||
2071 | + if (!dh_pub_is_valid(dh, dh_client_pub)) | ||
2072 | + packet_disconnect("bad client public DH value"); | ||
2073 | + | ||
2074 | + klen = DH_size(dh); | ||
2075 | + kbuf = xmalloc(klen); | ||
2076 | + kout = DH_compute_key(kbuf, dh_client_pub, dh); | ||
2077 | + if (kout < 0) | ||
2078 | + fatal("DH_compute_key: failed"); | ||
2079 | + | ||
2080 | + shared_secret = BN_new(); | ||
2081 | + if (shared_secret == NULL) | ||
2082 | + fatal("kexgss_server: BN_new failed"); | ||
2083 | + | ||
2084 | + if (BN_bin2bn(kbuf, kout, shared_secret) == NULL) | ||
2085 | + fatal("kexgss_server: BN_bin2bn failed"); | ||
2086 | + | ||
2087 | + memset(kbuf, 0, klen); | ||
2088 | + free(kbuf); | ||
2089 | + | ||
2090 | + hashlen = sizeof(hash); | ||
2091 | + switch (ssh->kex->kex_type) { | ||
2092 | + case KEX_GSS_GRP1_SHA1: | ||
2093 | + case KEX_GSS_GRP14_SHA1: | ||
2094 | + kex_dh_hash( | ||
2095 | + ssh->kex->hash_alg, | ||
2096 | + ssh->kex->client_version_string, ssh->kex->server_version_string, | ||
2097 | + buffer_ptr(ssh->kex->peer), buffer_len(ssh->kex->peer), | ||
2098 | + buffer_ptr(ssh->kex->my), buffer_len(ssh->kex->my), | ||
2099 | + NULL, 0, /* Change this if we start sending host keys */ | ||
2100 | + dh_client_pub, dh->pub_key, shared_secret, | ||
2101 | + hash, &hashlen | ||
2102 | + ); | ||
2103 | + break; | ||
2104 | + case KEX_GSS_GEX_SHA1: | ||
2105 | + kexgex_hash( | ||
2106 | + ssh->kex->hash_alg, | ||
2107 | + ssh->kex->client_version_string, ssh->kex->server_version_string, | ||
2108 | + buffer_ptr(ssh->kex->peer), buffer_len(ssh->kex->peer), | ||
2109 | + buffer_ptr(ssh->kex->my), buffer_len(ssh->kex->my), | ||
2110 | + NULL, 0, | ||
2111 | + min, nbits, max, | ||
2112 | + dh->p, dh->g, | ||
2113 | + dh_client_pub, | ||
2114 | + dh->pub_key, | ||
2115 | + shared_secret, | ||
2116 | + hash, &hashlen | ||
2117 | + ); | ||
2118 | + break; | ||
2119 | + default: | ||
2120 | + fatal("%s: Unexpected KEX type %d", __func__, ssh->kex->kex_type); | ||
2121 | + } | ||
2122 | + | ||
2123 | + BN_clear_free(dh_client_pub); | ||
2124 | + | ||
2125 | + if (ssh->kex->session_id == NULL) { | ||
2126 | + ssh->kex->session_id_len = hashlen; | ||
2127 | + ssh->kex->session_id = xmalloc(ssh->kex->session_id_len); | ||
2128 | + memcpy(ssh->kex->session_id, hash, ssh->kex->session_id_len); | ||
2129 | + } | ||
2130 | + | ||
2131 | + gssbuf.value = hash; | ||
2132 | + gssbuf.length = hashlen; | ||
2133 | + | ||
2134 | + if (GSS_ERROR(PRIVSEP(ssh_gssapi_sign(ctxt,&gssbuf,&msg_tok)))) | ||
2135 | + fatal("Couldn't get MIC"); | ||
2136 | + | ||
2137 | + packet_start(SSH2_MSG_KEXGSS_COMPLETE); | ||
2138 | + packet_put_bignum2(dh->pub_key); | ||
2139 | + packet_put_string(msg_tok.value,msg_tok.length); | ||
2140 | + | ||
2141 | + if (send_tok.length != 0) { | ||
2142 | + packet_put_char(1); /* true */ | ||
2143 | + packet_put_string(send_tok.value, send_tok.length); | ||
2144 | + } else { | ||
2145 | + packet_put_char(0); /* false */ | ||
2146 | + } | ||
2147 | + packet_send(); | ||
2148 | + | ||
2149 | + gss_release_buffer(&min_status, &send_tok); | ||
2150 | + gss_release_buffer(&min_status, &msg_tok); | ||
2151 | + | ||
2152 | + if (gss_kex_context == NULL) | ||
2153 | + gss_kex_context = ctxt; | ||
2154 | + else | ||
2155 | + ssh_gssapi_delete_ctx(&ctxt); | ||
2156 | + | ||
2157 | + DH_free(dh); | ||
2158 | + | ||
2159 | + kex_derive_keys_bn(ssh, hash, hashlen, shared_secret); | ||
2160 | + BN_clear_free(shared_secret); | ||
2161 | + kex_send_newkeys(ssh); | ||
2162 | + | ||
2163 | + /* If this was a rekey, then save out any delegated credentials we | ||
2164 | + * just exchanged. */ | ||
2165 | + if (options.gss_store_rekey) | ||
2166 | + ssh_gssapi_rekey_creds(); | ||
2167 | + return 0; | ||
2168 | +} | ||
2169 | +#endif /* GSSAPI */ | ||
2170 | diff --git a/monitor.c b/monitor.c | ||
2171 | index 43f48470..76d9e346 100644 | ||
2172 | --- a/monitor.c | ||
2173 | +++ b/monitor.c | ||
2174 | @@ -157,6 +157,8 @@ int mm_answer_gss_setup_ctx(int, Buffer *); | ||
2175 | int mm_answer_gss_accept_ctx(int, Buffer *); | ||
2176 | int mm_answer_gss_userok(int, Buffer *); | ||
2177 | int mm_answer_gss_checkmic(int, Buffer *); | ||
2178 | +int mm_answer_gss_sign(int, Buffer *); | ||
2179 | +int mm_answer_gss_updatecreds(int, Buffer *); | ||
2180 | #endif | ||
2181 | |||
2182 | #ifdef SSH_AUDIT_EVENTS | ||
2183 | @@ -230,11 +232,18 @@ struct mon_table mon_dispatch_proto20[] = { | ||
2184 | {MONITOR_REQ_GSSSTEP, 0, mm_answer_gss_accept_ctx}, | ||
2185 | {MONITOR_REQ_GSSUSEROK, MON_ONCE|MON_AUTHDECIDE, mm_answer_gss_userok}, | ||
2186 | {MONITOR_REQ_GSSCHECKMIC, MON_ONCE, mm_answer_gss_checkmic}, | ||
2187 | + {MONITOR_REQ_GSSSIGN, MON_ONCE, mm_answer_gss_sign}, | ||
2188 | #endif | ||
2189 | {0, 0, NULL} | ||
2190 | }; | ||
2191 | |||
2192 | struct mon_table mon_dispatch_postauth20[] = { | ||
2193 | +#ifdef GSSAPI | ||
2194 | + {MONITOR_REQ_GSSSETUP, 0, mm_answer_gss_setup_ctx}, | ||
2195 | + {MONITOR_REQ_GSSSTEP, 0, mm_answer_gss_accept_ctx}, | ||
2196 | + {MONITOR_REQ_GSSSIGN, 0, mm_answer_gss_sign}, | ||
2197 | + {MONITOR_REQ_GSSUPCREDS, 0, mm_answer_gss_updatecreds}, | ||
2198 | +#endif | ||
2199 | #ifdef WITH_OPENSSL | ||
2200 | {MONITOR_REQ_MODULI, 0, mm_answer_moduli}, | ||
2201 | #endif | ||
2202 | @@ -301,6 +310,10 @@ monitor_child_preauth(Authctxt *_authctxt, struct monitor *pmonitor) | ||
2203 | /* Permit requests for moduli and signatures */ | ||
2204 | monitor_permit(mon_dispatch, MONITOR_REQ_MODULI, 1); | ||
2205 | monitor_permit(mon_dispatch, MONITOR_REQ_SIGN, 1); | ||
2206 | +#ifdef GSSAPI | ||
2207 | + /* and for the GSSAPI key exchange */ | ||
2208 | + monitor_permit(mon_dispatch, MONITOR_REQ_GSSSETUP, 1); | ||
2209 | +#endif | ||
2210 | |||
2211 | /* The first few requests do not require asynchronous access */ | ||
2212 | while (!authenticated) { | ||
2213 | @@ -400,6 +413,10 @@ monitor_child_postauth(struct monitor *pmonitor) | ||
2214 | monitor_permit(mon_dispatch, MONITOR_REQ_MODULI, 1); | ||
2215 | monitor_permit(mon_dispatch, MONITOR_REQ_SIGN, 1); | ||
2216 | monitor_permit(mon_dispatch, MONITOR_REQ_TERM, 1); | ||
2217 | +#ifdef GSSAPI | ||
2218 | + /* and for the GSSAPI key exchange */ | ||
2219 | + monitor_permit(mon_dispatch, MONITOR_REQ_GSSSETUP, 1); | ||
2220 | +#endif | ||
2221 | |||
2222 | if (!no_pty_flag) { | ||
2223 | monitor_permit(mon_dispatch, MONITOR_REQ_PTY, 1); | ||
2224 | @@ -1601,6 +1618,13 @@ monitor_apply_keystate(struct monitor *pmonitor) | ||
2225 | # endif | ||
2226 | #endif /* WITH_OPENSSL */ | ||
2227 | kex->kex[KEX_C25519_SHA256] = kexc25519_server; | ||
2228 | +#ifdef GSSAPI | ||
2229 | + if (options.gss_keyex) { | ||
2230 | + kex->kex[KEX_GSS_GRP1_SHA1] = kexgss_server; | ||
2231 | + kex->kex[KEX_GSS_GRP14_SHA1] = kexgss_server; | ||
2232 | + kex->kex[KEX_GSS_GEX_SHA1] = kexgss_server; | ||
2233 | + } | ||
2234 | +#endif | ||
2235 | kex->load_host_public_key=&get_hostkey_public_by_type; | ||
2236 | kex->load_host_private_key=&get_hostkey_private_by_type; | ||
2237 | kex->host_key_index=&get_hostkey_index; | ||
2238 | @@ -1680,8 +1704,8 @@ mm_answer_gss_setup_ctx(int sock, Buffer *m) | ||
2239 | OM_uint32 major; | ||
2240 | u_int len; | ||
2241 | |||
2242 | - if (!options.gss_authentication) | ||
2243 | - fatal("%s: GSSAPI authentication not enabled", __func__); | ||
2244 | + if (!options.gss_authentication && !options.gss_keyex) | ||
2245 | + fatal("%s: GSSAPI not enabled", __func__); | ||
2246 | |||
2247 | goid.elements = buffer_get_string(m, &len); | ||
2248 | goid.length = len; | ||
2249 | @@ -1710,8 +1734,8 @@ mm_answer_gss_accept_ctx(int sock, Buffer *m) | ||
2250 | OM_uint32 flags = 0; /* GSI needs this */ | ||
2251 | u_int len; | ||
2252 | |||
2253 | - if (!options.gss_authentication) | ||
2254 | - fatal("%s: GSSAPI authentication not enabled", __func__); | ||
2255 | + if (!options.gss_authentication && !options.gss_keyex) | ||
2256 | + fatal("%s: GSSAPI not enabled", __func__); | ||
2257 | |||
2258 | in.value = buffer_get_string(m, &len); | ||
2259 | in.length = len; | ||
2260 | @@ -1730,6 +1754,7 @@ mm_answer_gss_accept_ctx(int sock, Buffer *m) | ||
2261 | monitor_permit(mon_dispatch, MONITOR_REQ_GSSSTEP, 0); | ||
2262 | monitor_permit(mon_dispatch, MONITOR_REQ_GSSUSEROK, 1); | ||
2263 | monitor_permit(mon_dispatch, MONITOR_REQ_GSSCHECKMIC, 1); | ||
2264 | + monitor_permit(mon_dispatch, MONITOR_REQ_GSSSIGN, 1); | ||
2265 | } | ||
2266 | return (0); | ||
2267 | } | ||
2268 | @@ -1741,8 +1766,8 @@ mm_answer_gss_checkmic(int sock, Buffer *m) | ||
2269 | OM_uint32 ret; | ||
2270 | u_int len; | ||
2271 | |||
2272 | - if (!options.gss_authentication) | ||
2273 | - fatal("%s: GSSAPI authentication not enabled", __func__); | ||
2274 | + if (!options.gss_authentication && !options.gss_keyex) | ||
2275 | + fatal("%s: GSSAPI not enabled", __func__); | ||
2276 | |||
2277 | gssbuf.value = buffer_get_string(m, &len); | ||
2278 | gssbuf.length = len; | ||
2279 | @@ -1770,10 +1795,11 @@ mm_answer_gss_userok(int sock, Buffer *m) | ||
2280 | { | ||
2281 | int authenticated; | ||
2282 | |||
2283 | - if (!options.gss_authentication) | ||
2284 | - fatal("%s: GSSAPI authentication not enabled", __func__); | ||
2285 | + if (!options.gss_authentication && !options.gss_keyex) | ||
2286 | + fatal("%s: GSSAPI not enabled", __func__); | ||
2287 | |||
2288 | - authenticated = authctxt->valid && ssh_gssapi_userok(authctxt->user); | ||
2289 | + authenticated = authctxt->valid && | ||
2290 | + ssh_gssapi_userok(authctxt->user, authctxt->pw); | ||
2291 | |||
2292 | buffer_clear(m); | ||
2293 | buffer_put_int(m, authenticated); | ||
2294 | @@ -1786,5 +1812,76 @@ mm_answer_gss_userok(int sock, Buffer *m) | ||
2295 | /* Monitor loop will terminate if authenticated */ | ||
2296 | return (authenticated); | ||
2297 | } | ||
2298 | + | ||
2299 | +int | ||
2300 | +mm_answer_gss_sign(int socket, Buffer *m) | ||
2301 | +{ | ||
2302 | + gss_buffer_desc data; | ||
2303 | + gss_buffer_desc hash = GSS_C_EMPTY_BUFFER; | ||
2304 | + OM_uint32 major, minor; | ||
2305 | + u_int len; | ||
2306 | + | ||
2307 | + if (!options.gss_authentication && !options.gss_keyex) | ||
2308 | + fatal("%s: GSSAPI not enabled", __func__); | ||
2309 | + | ||
2310 | + data.value = buffer_get_string(m, &len); | ||
2311 | + data.length = len; | ||
2312 | + if (data.length != 20) | ||
2313 | + fatal("%s: data length incorrect: %d", __func__, | ||
2314 | + (int) data.length); | ||
2315 | + | ||
2316 | + /* Save the session ID on the first time around */ | ||
2317 | + if (session_id2_len == 0) { | ||
2318 | + session_id2_len = data.length; | ||
2319 | + session_id2 = xmalloc(session_id2_len); | ||
2320 | + memcpy(session_id2, data.value, session_id2_len); | ||
2321 | + } | ||
2322 | + major = ssh_gssapi_sign(gsscontext, &data, &hash); | ||
2323 | + | ||
2324 | + free(data.value); | ||
2325 | + | ||
2326 | + buffer_clear(m); | ||
2327 | + buffer_put_int(m, major); | ||
2328 | + buffer_put_string(m, hash.value, hash.length); | ||
2329 | + | ||
2330 | + mm_request_send(socket, MONITOR_ANS_GSSSIGN, m); | ||
2331 | + | ||
2332 | + gss_release_buffer(&minor, &hash); | ||
2333 | + | ||
2334 | + /* Turn on getpwnam permissions */ | ||
2335 | + monitor_permit(mon_dispatch, MONITOR_REQ_PWNAM, 1); | ||
2336 | + | ||
2337 | + /* And credential updating, for when rekeying */ | ||
2338 | + monitor_permit(mon_dispatch, MONITOR_REQ_GSSUPCREDS, 1); | ||
2339 | + | ||
2340 | + return (0); | ||
2341 | +} | ||
2342 | + | ||
2343 | +int | ||
2344 | +mm_answer_gss_updatecreds(int socket, Buffer *m) { | ||
2345 | + ssh_gssapi_ccache store; | ||
2346 | + int ok; | ||
2347 | + | ||
2348 | + if (!options.gss_authentication && !options.gss_keyex) | ||
2349 | + fatal("%s: GSSAPI not enabled", __func__); | ||
2350 | + | ||
2351 | + store.filename = buffer_get_string(m, NULL); | ||
2352 | + store.envvar = buffer_get_string(m, NULL); | ||
2353 | + store.envval = buffer_get_string(m, NULL); | ||
2354 | + | ||
2355 | + ok = ssh_gssapi_update_creds(&store); | ||
2356 | + | ||
2357 | + free(store.filename); | ||
2358 | + free(store.envvar); | ||
2359 | + free(store.envval); | ||
2360 | + | ||
2361 | + buffer_clear(m); | ||
2362 | + buffer_put_int(m, ok); | ||
2363 | + | ||
2364 | + mm_request_send(socket, MONITOR_ANS_GSSUPCREDS, m); | ||
2365 | + | ||
2366 | + return(0); | ||
2367 | +} | ||
2368 | + | ||
2369 | #endif /* GSSAPI */ | ||
2370 | |||
2371 | diff --git a/monitor.h b/monitor.h | ||
2372 | index d68f6745..ec41404c 100644 | ||
2373 | --- a/monitor.h | ||
2374 | +++ b/monitor.h | ||
2375 | @@ -65,6 +65,9 @@ enum monitor_reqtype { | ||
2376 | MONITOR_REQ_PAM_FREE_CTX = 110, MONITOR_ANS_PAM_FREE_CTX = 111, | ||
2377 | MONITOR_REQ_AUDIT_EVENT = 112, MONITOR_REQ_AUDIT_COMMAND = 113, | ||
2378 | |||
2379 | + MONITOR_REQ_GSSSIGN = 150, MONITOR_ANS_GSSSIGN = 151, | ||
2380 | + MONITOR_REQ_GSSUPCREDS = 152, MONITOR_ANS_GSSUPCREDS = 153, | ||
2381 | + | ||
2382 | }; | ||
2383 | |||
2384 | struct monitor { | ||
2385 | diff --git a/monitor_wrap.c b/monitor_wrap.c | ||
2386 | index 64ff9288..d5cb640a 100644 | ||
2387 | --- a/monitor_wrap.c | ||
2388 | +++ b/monitor_wrap.c | ||
2389 | @@ -924,7 +924,7 @@ mm_ssh_gssapi_checkmic(Gssctxt *ctx, gss_buffer_t gssbuf, gss_buffer_t gssmic) | ||
2390 | } | ||
2391 | |||
2392 | int | ||
2393 | -mm_ssh_gssapi_userok(char *user) | ||
2394 | +mm_ssh_gssapi_userok(char *user, struct passwd *pw) | ||
2395 | { | ||
2396 | Buffer m; | ||
2397 | int authenticated = 0; | ||
2398 | @@ -941,5 +941,50 @@ mm_ssh_gssapi_userok(char *user) | ||
2399 | debug3("%s: user %sauthenticated",__func__, authenticated ? "" : "not "); | ||
2400 | return (authenticated); | ||
2401 | } | ||
2402 | + | ||
2403 | +OM_uint32 | ||
2404 | +mm_ssh_gssapi_sign(Gssctxt *ctx, gss_buffer_desc *data, gss_buffer_desc *hash) | ||
2405 | +{ | ||
2406 | + Buffer m; | ||
2407 | + OM_uint32 major; | ||
2408 | + u_int len; | ||
2409 | + | ||
2410 | + buffer_init(&m); | ||
2411 | + buffer_put_string(&m, data->value, data->length); | ||
2412 | + | ||
2413 | + mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSSIGN, &m); | ||
2414 | + mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_GSSSIGN, &m); | ||
2415 | + | ||
2416 | + major = buffer_get_int(&m); | ||
2417 | + hash->value = buffer_get_string(&m, &len); | ||
2418 | + hash->length = len; | ||
2419 | + | ||
2420 | + buffer_free(&m); | ||
2421 | + | ||
2422 | + return(major); | ||
2423 | +} | ||
2424 | + | ||
2425 | +int | ||
2426 | +mm_ssh_gssapi_update_creds(ssh_gssapi_ccache *store) | ||
2427 | +{ | ||
2428 | + Buffer m; | ||
2429 | + int ok; | ||
2430 | + | ||
2431 | + buffer_init(&m); | ||
2432 | + | ||
2433 | + buffer_put_cstring(&m, store->filename ? store->filename : ""); | ||
2434 | + buffer_put_cstring(&m, store->envvar ? store->envvar : ""); | ||
2435 | + buffer_put_cstring(&m, store->envval ? store->envval : ""); | ||
2436 | + | ||
2437 | + mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSUPCREDS, &m); | ||
2438 | + mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_GSSUPCREDS, &m); | ||
2439 | + | ||
2440 | + ok = buffer_get_int(&m); | ||
2441 | + | ||
2442 | + buffer_free(&m); | ||
2443 | + | ||
2444 | + return (ok); | ||
2445 | +} | ||
2446 | + | ||
2447 | #endif /* GSSAPI */ | ||
2448 | |||
2449 | diff --git a/monitor_wrap.h b/monitor_wrap.h | ||
2450 | index db5902f5..8f9dd896 100644 | ||
2451 | --- a/monitor_wrap.h | ||
2452 | +++ b/monitor_wrap.h | ||
2453 | @@ -55,8 +55,10 @@ int mm_key_verify(Key *, u_char *, u_int, u_char *, u_int); | ||
2454 | OM_uint32 mm_ssh_gssapi_server_ctx(Gssctxt **, gss_OID); | ||
2455 | OM_uint32 mm_ssh_gssapi_accept_ctx(Gssctxt *, | ||
2456 | gss_buffer_desc *, gss_buffer_desc *, OM_uint32 *); | ||
2457 | -int mm_ssh_gssapi_userok(char *user); | ||
2458 | +int mm_ssh_gssapi_userok(char *user, struct passwd *); | ||
2459 | OM_uint32 mm_ssh_gssapi_checkmic(Gssctxt *, gss_buffer_t, gss_buffer_t); | ||
2460 | +OM_uint32 mm_ssh_gssapi_sign(Gssctxt *, gss_buffer_t, gss_buffer_t); | ||
2461 | +int mm_ssh_gssapi_update_creds(ssh_gssapi_ccache *); | ||
2462 | #endif | ||
2463 | |||
2464 | #ifdef USE_PAM | ||
2465 | diff --git a/readconf.c b/readconf.c | ||
2466 | index fa3fab8f..7902ef26 100644 | ||
2467 | --- a/readconf.c | ||
2468 | +++ b/readconf.c | ||
2469 | @@ -160,6 +160,8 @@ typedef enum { | ||
2470 | oClearAllForwardings, oNoHostAuthenticationForLocalhost, | ||
2471 | oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout, | ||
2472 | oAddressFamily, oGssAuthentication, oGssDelegateCreds, | ||
2473 | + oGssTrustDns, oGssKeyEx, oGssClientIdentity, oGssRenewalRekey, | ||
2474 | + oGssServerIdentity, | ||
2475 | oServerAliveInterval, oServerAliveCountMax, oIdentitiesOnly, | ||
2476 | oSendEnv, oControlPath, oControlMaster, oControlPersist, | ||
2477 | oHashKnownHosts, | ||
2478 | @@ -205,10 +207,19 @@ static struct { | ||
2479 | { "afstokenpassing", oUnsupported }, | ||
2480 | #if defined(GSSAPI) | ||
2481 | { "gssapiauthentication", oGssAuthentication }, | ||
2482 | + { "gssapikeyexchange", oGssKeyEx }, | ||
2483 | { "gssapidelegatecredentials", oGssDelegateCreds }, | ||
2484 | + { "gssapitrustdns", oGssTrustDns }, | ||
2485 | + { "gssapiclientidentity", oGssClientIdentity }, | ||
2486 | + { "gssapiserveridentity", oGssServerIdentity }, | ||
2487 | + { "gssapirenewalforcesrekey", oGssRenewalRekey }, | ||
2488 | #else | ||
2489 | { "gssapiauthentication", oUnsupported }, | ||
2490 | + { "gssapikeyexchange", oUnsupported }, | ||
2491 | { "gssapidelegatecredentials", oUnsupported }, | ||
2492 | + { "gssapitrustdns", oUnsupported }, | ||
2493 | + { "gssapiclientidentity", oUnsupported }, | ||
2494 | + { "gssapirenewalforcesrekey", oUnsupported }, | ||
2495 | #endif | ||
2496 | { "fallbacktorsh", oDeprecated }, | ||
2497 | { "usersh", oDeprecated }, | ||
2498 | @@ -961,10 +972,30 @@ parse_time: | ||
2499 | intptr = &options->gss_authentication; | ||
2500 | goto parse_flag; | ||
2501 | |||
2502 | + case oGssKeyEx: | ||
2503 | + intptr = &options->gss_keyex; | ||
2504 | + goto parse_flag; | ||
2505 | + | ||
2506 | case oGssDelegateCreds: | ||
2507 | intptr = &options->gss_deleg_creds; | ||
2508 | goto parse_flag; | ||
2509 | |||
2510 | + case oGssTrustDns: | ||
2511 | + intptr = &options->gss_trust_dns; | ||
2512 | + goto parse_flag; | ||
2513 | + | ||
2514 | + case oGssClientIdentity: | ||
2515 | + charptr = &options->gss_client_identity; | ||
2516 | + goto parse_string; | ||
2517 | + | ||
2518 | + case oGssServerIdentity: | ||
2519 | + charptr = &options->gss_server_identity; | ||
2520 | + goto parse_string; | ||
2521 | + | ||
2522 | + case oGssRenewalRekey: | ||
2523 | + intptr = &options->gss_renewal_rekey; | ||
2524 | + goto parse_flag; | ||
2525 | + | ||
2526 | case oBatchMode: | ||
2527 | intptr = &options->batch_mode; | ||
2528 | goto parse_flag; | ||
2529 | @@ -1776,7 +1807,12 @@ initialize_options(Options * options) | ||
2530 | options->pubkey_authentication = -1; | ||
2531 | options->challenge_response_authentication = -1; | ||
2532 | options->gss_authentication = -1; | ||
2533 | + options->gss_keyex = -1; | ||
2534 | options->gss_deleg_creds = -1; | ||
2535 | + options->gss_trust_dns = -1; | ||
2536 | + options->gss_renewal_rekey = -1; | ||
2537 | + options->gss_client_identity = NULL; | ||
2538 | + options->gss_server_identity = NULL; | ||
2539 | options->password_authentication = -1; | ||
2540 | options->kbd_interactive_authentication = -1; | ||
2541 | options->kbd_interactive_devices = NULL; | ||
2542 | @@ -1920,8 +1956,14 @@ fill_default_options(Options * options) | ||
2543 | options->challenge_response_authentication = 1; | ||
2544 | if (options->gss_authentication == -1) | ||
2545 | options->gss_authentication = 0; | ||
2546 | + if (options->gss_keyex == -1) | ||
2547 | + options->gss_keyex = 0; | ||
2548 | if (options->gss_deleg_creds == -1) | ||
2549 | options->gss_deleg_creds = 0; | ||
2550 | + if (options->gss_trust_dns == -1) | ||
2551 | + options->gss_trust_dns = 0; | ||
2552 | + if (options->gss_renewal_rekey == -1) | ||
2553 | + options->gss_renewal_rekey = 0; | ||
2554 | if (options->password_authentication == -1) | ||
2555 | options->password_authentication = 1; | ||
2556 | if (options->kbd_interactive_authentication == -1) | ||
2557 | diff --git a/readconf.h b/readconf.h | ||
2558 | index cef55f71..fd3d7c75 100644 | ||
2559 | --- a/readconf.h | ||
2560 | +++ b/readconf.h | ||
2561 | @@ -45,7 +45,12 @@ typedef struct { | ||
2562 | int challenge_response_authentication; | ||
2563 | /* Try S/Key or TIS, authentication. */ | ||
2564 | int gss_authentication; /* Try GSS authentication */ | ||
2565 | + int gss_keyex; /* Try GSS key exchange */ | ||
2566 | int gss_deleg_creds; /* Delegate GSS credentials */ | ||
2567 | + int gss_trust_dns; /* Trust DNS for GSS canonicalization */ | ||
2568 | + int gss_renewal_rekey; /* Credential renewal forces rekey */ | ||
2569 | + char *gss_client_identity; /* Principal to initiate GSSAPI with */ | ||
2570 | + char *gss_server_identity; /* GSSAPI target principal */ | ||
2571 | int password_authentication; /* Try password | ||
2572 | * authentication. */ | ||
2573 | int kbd_interactive_authentication; /* Try keyboard-interactive auth. */ | ||
2574 | diff --git a/servconf.c b/servconf.c | ||
2575 | index 795ddbab..14c81fa9 100644 | ||
2576 | --- a/servconf.c | ||
2577 | +++ b/servconf.c | ||
2578 | @@ -113,8 +113,10 @@ initialize_server_options(ServerOptions *options) | ||
2579 | options->kerberos_ticket_cleanup = -1; | ||
2580 | options->kerberos_get_afs_token = -1; | ||
2581 | options->gss_authentication=-1; | ||
2582 | + options->gss_keyex = -1; | ||
2583 | options->gss_cleanup_creds = -1; | ||
2584 | options->gss_strict_acceptor = -1; | ||
2585 | + options->gss_store_rekey = -1; | ||
2586 | options->password_authentication = -1; | ||
2587 | options->kbd_interactive_authentication = -1; | ||
2588 | options->challenge_response_authentication = -1; | ||
2589 | @@ -267,10 +269,14 @@ fill_default_server_options(ServerOptions *options) | ||
2590 | options->kerberos_get_afs_token = 0; | ||
2591 | if (options->gss_authentication == -1) | ||
2592 | options->gss_authentication = 0; | ||
2593 | + if (options->gss_keyex == -1) | ||
2594 | + options->gss_keyex = 0; | ||
2595 | if (options->gss_cleanup_creds == -1) | ||
2596 | options->gss_cleanup_creds = 1; | ||
2597 | if (options->gss_strict_acceptor == -1) | ||
2598 | - options->gss_strict_acceptor = 0; | ||
2599 | + options->gss_strict_acceptor = 1; | ||
2600 | + if (options->gss_store_rekey == -1) | ||
2601 | + options->gss_store_rekey = 0; | ||
2602 | if (options->password_authentication == -1) | ||
2603 | options->password_authentication = 1; | ||
2604 | if (options->kbd_interactive_authentication == -1) | ||
2605 | @@ -407,6 +413,7 @@ typedef enum { | ||
2606 | sHostKeyAlgorithms, | ||
2607 | sClientAliveInterval, sClientAliveCountMax, sAuthorizedKeysFile, | ||
2608 | sGssAuthentication, sGssCleanupCreds, sGssStrictAcceptor, | ||
2609 | + sGssKeyEx, sGssStoreRekey, | ||
2610 | sAcceptEnv, sPermitTunnel, | ||
2611 | sMatch, sPermitOpen, sForceCommand, sChrootDirectory, | ||
2612 | sUsePrivilegeSeparation, sAllowAgentForwarding, | ||
2613 | @@ -480,12 +487,20 @@ static struct { | ||
2614 | #ifdef GSSAPI | ||
2615 | { "gssapiauthentication", sGssAuthentication, SSHCFG_ALL }, | ||
2616 | { "gssapicleanupcredentials", sGssCleanupCreds, SSHCFG_GLOBAL }, | ||
2617 | + { "gssapicleanupcreds", sGssCleanupCreds, SSHCFG_GLOBAL }, | ||
2618 | { "gssapistrictacceptorcheck", sGssStrictAcceptor, SSHCFG_GLOBAL }, | ||
2619 | + { "gssapikeyexchange", sGssKeyEx, SSHCFG_GLOBAL }, | ||
2620 | + { "gssapistorecredentialsonrekey", sGssStoreRekey, SSHCFG_GLOBAL }, | ||
2621 | #else | ||
2622 | { "gssapiauthentication", sUnsupported, SSHCFG_ALL }, | ||
2623 | { "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL }, | ||
2624 | + { "gssapicleanupcreds", sUnsupported, SSHCFG_GLOBAL }, | ||
2625 | { "gssapistrictacceptorcheck", sUnsupported, SSHCFG_GLOBAL }, | ||
2626 | + { "gssapikeyexchange", sUnsupported, SSHCFG_GLOBAL }, | ||
2627 | + { "gssapistorecredentialsonrekey", sUnsupported, SSHCFG_GLOBAL }, | ||
2628 | #endif | ||
2629 | + { "gssusesessionccache", sUnsupported, SSHCFG_GLOBAL }, | ||
2630 | + { "gssapiusesessioncredcache", sUnsupported, SSHCFG_GLOBAL }, | ||
2631 | { "passwordauthentication", sPasswordAuthentication, SSHCFG_ALL }, | ||
2632 | { "kbdinteractiveauthentication", sKbdInteractiveAuthentication, SSHCFG_ALL }, | ||
2633 | { "challengeresponseauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL }, | ||
2634 | @@ -1207,6 +1222,10 @@ process_server_config_line(ServerOptions *options, char *line, | ||
2635 | intptr = &options->gss_authentication; | ||
2636 | goto parse_flag; | ||
2637 | |||
2638 | + case sGssKeyEx: | ||
2639 | + intptr = &options->gss_keyex; | ||
2640 | + goto parse_flag; | ||
2641 | + | ||
2642 | case sGssCleanupCreds: | ||
2643 | intptr = &options->gss_cleanup_creds; | ||
2644 | goto parse_flag; | ||
2645 | @@ -1215,6 +1234,10 @@ process_server_config_line(ServerOptions *options, char *line, | ||
2646 | intptr = &options->gss_strict_acceptor; | ||
2647 | goto parse_flag; | ||
2648 | |||
2649 | + case sGssStoreRekey: | ||
2650 | + intptr = &options->gss_store_rekey; | ||
2651 | + goto parse_flag; | ||
2652 | + | ||
2653 | case sPasswordAuthentication: | ||
2654 | intptr = &options->password_authentication; | ||
2655 | goto parse_flag; | ||
2656 | @@ -2248,7 +2271,10 @@ dump_config(ServerOptions *o) | ||
2657 | #endif | ||
2658 | #ifdef GSSAPI | ||
2659 | dump_cfg_fmtint(sGssAuthentication, o->gss_authentication); | ||
2660 | + dump_cfg_fmtint(sGssKeyEx, o->gss_keyex); | ||
2661 | dump_cfg_fmtint(sGssCleanupCreds, o->gss_cleanup_creds); | ||
2662 | + dump_cfg_fmtint(sGssStrictAcceptor, o->gss_strict_acceptor); | ||
2663 | + dump_cfg_fmtint(sGssStoreRekey, o->gss_store_rekey); | ||
2664 | #endif | ||
2665 | dump_cfg_fmtint(sPasswordAuthentication, o->password_authentication); | ||
2666 | dump_cfg_fmtint(sKbdInteractiveAuthentication, | ||
2667 | diff --git a/servconf.h b/servconf.h | ||
2668 | index 5853a974..90dfa4c2 100644 | ||
2669 | --- a/servconf.h | ||
2670 | +++ b/servconf.h | ||
2671 | @@ -112,8 +112,10 @@ typedef struct { | ||
2672 | int kerberos_get_afs_token; /* If true, try to get AFS token if | ||
2673 | * authenticated with Kerberos. */ | ||
2674 | int gss_authentication; /* If true, permit GSSAPI authentication */ | ||
2675 | + int gss_keyex; /* If true, permit GSSAPI key exchange */ | ||
2676 | int gss_cleanup_creds; /* If true, destroy cred cache on logout */ | ||
2677 | int gss_strict_acceptor; /* If true, restrict the GSSAPI acceptor name */ | ||
2678 | + int gss_store_rekey; | ||
2679 | int password_authentication; /* If true, permit password | ||
2680 | * authentication. */ | ||
2681 | int kbd_interactive_authentication; /* If true, permit */ | ||
2682 | diff --git a/ssh-gss.h b/ssh-gss.h | ||
2683 | index a99d7f08..914701bc 100644 | ||
2684 | --- a/ssh-gss.h | ||
2685 | +++ b/ssh-gss.h | ||
2686 | @@ -1,6 +1,6 @@ | ||
2687 | /* $OpenBSD: ssh-gss.h,v 1.11 2014/02/26 20:28:44 djm Exp $ */ | ||
2688 | /* | ||
2689 | - * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved. | ||
2690 | + * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved. | ||
2691 | * | ||
2692 | * Redistribution and use in source and binary forms, with or without | ||
2693 | * modification, are permitted provided that the following conditions | ||
2694 | @@ -61,10 +61,22 @@ | ||
2695 | |||
2696 | #define SSH_GSS_OIDTYPE 0x06 | ||
2697 | |||
2698 | +#define SSH2_MSG_KEXGSS_INIT 30 | ||
2699 | +#define SSH2_MSG_KEXGSS_CONTINUE 31 | ||
2700 | +#define SSH2_MSG_KEXGSS_COMPLETE 32 | ||
2701 | +#define SSH2_MSG_KEXGSS_HOSTKEY 33 | ||
2702 | +#define SSH2_MSG_KEXGSS_ERROR 34 | ||
2703 | +#define SSH2_MSG_KEXGSS_GROUPREQ 40 | ||
2704 | +#define SSH2_MSG_KEXGSS_GROUP 41 | ||
2705 | +#define KEX_GSS_GRP1_SHA1_ID "gss-group1-sha1-" | ||
2706 | +#define KEX_GSS_GRP14_SHA1_ID "gss-group14-sha1-" | ||
2707 | +#define KEX_GSS_GEX_SHA1_ID "gss-gex-sha1-" | ||
2708 | + | ||
2709 | typedef struct { | ||
2710 | char *filename; | ||
2711 | char *envvar; | ||
2712 | char *envval; | ||
2713 | + struct passwd *owner; | ||
2714 | void *data; | ||
2715 | } ssh_gssapi_ccache; | ||
2716 | |||
2717 | @@ -72,8 +84,11 @@ typedef struct { | ||
2718 | gss_buffer_desc displayname; | ||
2719 | gss_buffer_desc exportedname; | ||
2720 | gss_cred_id_t creds; | ||
2721 | + gss_name_t name; | ||
2722 | struct ssh_gssapi_mech_struct *mech; | ||
2723 | ssh_gssapi_ccache store; | ||
2724 | + int used; | ||
2725 | + int updated; | ||
2726 | } ssh_gssapi_client; | ||
2727 | |||
2728 | typedef struct ssh_gssapi_mech_struct { | ||
2729 | @@ -84,6 +99,7 @@ typedef struct ssh_gssapi_mech_struct { | ||
2730 | int (*userok) (ssh_gssapi_client *, char *); | ||
2731 | int (*localname) (ssh_gssapi_client *, char **); | ||
2732 | void (*storecreds) (ssh_gssapi_client *); | ||
2733 | + int (*updatecreds) (ssh_gssapi_ccache *, ssh_gssapi_client *); | ||
2734 | } ssh_gssapi_mech; | ||
2735 | |||
2736 | typedef struct { | ||
2737 | @@ -94,10 +110,11 @@ typedef struct { | ||
2738 | gss_OID oid; /* client */ | ||
2739 | gss_cred_id_t creds; /* server */ | ||
2740 | gss_name_t client; /* server */ | ||
2741 | - gss_cred_id_t client_creds; /* server */ | ||
2742 | + gss_cred_id_t client_creds; /* both */ | ||
2743 | } Gssctxt; | ||
2744 | |||
2745 | extern ssh_gssapi_mech *supported_mechs[]; | ||
2746 | +extern Gssctxt *gss_kex_context; | ||
2747 | |||
2748 | int ssh_gssapi_check_oid(Gssctxt *, void *, size_t); | ||
2749 | void ssh_gssapi_set_oid_data(Gssctxt *, void *, size_t); | ||
2750 | @@ -119,16 +136,32 @@ void ssh_gssapi_build_ctx(Gssctxt **); | ||
2751 | void ssh_gssapi_delete_ctx(Gssctxt **); | ||
2752 | OM_uint32 ssh_gssapi_sign(Gssctxt *, gss_buffer_t, gss_buffer_t); | ||
2753 | void ssh_gssapi_buildmic(Buffer *, const char *, const char *, const char *); | ||
2754 | -int ssh_gssapi_check_mechanism(Gssctxt **, gss_OID, const char *); | ||
2755 | +int ssh_gssapi_check_mechanism(Gssctxt **, gss_OID, const char *, const char *); | ||
2756 | +OM_uint32 ssh_gssapi_client_identity(Gssctxt *, const char *); | ||
2757 | +int ssh_gssapi_credentials_updated(Gssctxt *); | ||
2758 | |||
2759 | /* In the server */ | ||
2760 | +typedef int ssh_gssapi_check_fn(Gssctxt **, gss_OID, const char *, | ||
2761 | + const char *); | ||
2762 | +char *ssh_gssapi_client_mechanisms(const char *, const char *); | ||
2763 | +char *ssh_gssapi_kex_mechs(gss_OID_set, ssh_gssapi_check_fn *, const char *, | ||
2764 | + const char *); | ||
2765 | +gss_OID ssh_gssapi_id_kex(Gssctxt *, char *, int); | ||
2766 | +int ssh_gssapi_server_check_mech(Gssctxt **,gss_OID, const char *, | ||
2767 | + const char *); | ||
2768 | OM_uint32 ssh_gssapi_server_ctx(Gssctxt **, gss_OID); | ||
2769 | -int ssh_gssapi_userok(char *name); | ||
2770 | +int ssh_gssapi_userok(char *name, struct passwd *); | ||
2771 | OM_uint32 ssh_gssapi_checkmic(Gssctxt *, gss_buffer_t, gss_buffer_t); | ||
2772 | void ssh_gssapi_do_child(char ***, u_int *); | ||
2773 | void ssh_gssapi_cleanup_creds(void); | ||
2774 | void ssh_gssapi_storecreds(void); | ||
2775 | |||
2776 | +char *ssh_gssapi_server_mechanisms(void); | ||
2777 | +int ssh_gssapi_oid_table_ok(void); | ||
2778 | + | ||
2779 | +int ssh_gssapi_update_creds(ssh_gssapi_ccache *store); | ||
2780 | +void ssh_gssapi_rekey_creds(void); | ||
2781 | + | ||
2782 | #endif /* GSSAPI */ | ||
2783 | |||
2784 | #endif /* _SSH_GSS_H */ | ||
2785 | diff --git a/ssh_config b/ssh_config | ||
2786 | index 90fb63f0..4e879cd2 100644 | ||
2787 | --- a/ssh_config | ||
2788 | +++ b/ssh_config | ||
2789 | @@ -26,6 +26,8 @@ | ||
2790 | # HostbasedAuthentication no | ||
2791 | # GSSAPIAuthentication no | ||
2792 | # GSSAPIDelegateCredentials no | ||
2793 | +# GSSAPIKeyExchange no | ||
2794 | +# GSSAPITrustDNS no | ||
2795 | # BatchMode no | ||
2796 | # CheckHostIP yes | ||
2797 | # AddressFamily any | ||
2798 | diff --git a/ssh_config.5 b/ssh_config.5 | ||
2799 | index 591365f3..a7703fc7 100644 | ||
2800 | --- a/ssh_config.5 | ||
2801 | +++ b/ssh_config.5 | ||
2802 | @@ -748,10 +748,42 @@ The default is | ||
2803 | Specifies whether user authentication based on GSSAPI is allowed. | ||
2804 | The default is | ||
2805 | .Cm no . | ||
2806 | +.It Cm GSSAPIKeyExchange | ||
2807 | +Specifies whether key exchange based on GSSAPI may be used. When using | ||
2808 | +GSSAPI key exchange the server need not have a host key. | ||
2809 | +The default is | ||
2810 | +.Cm no . | ||
2811 | +.It Cm GSSAPIClientIdentity | ||
2812 | +If set, specifies the GSSAPI client identity that ssh should use when | ||
2813 | +connecting to the server. The default is unset, which means that the default | ||
2814 | +identity will be used. | ||
2815 | +.It Cm GSSAPIServerIdentity | ||
2816 | +If set, specifies the GSSAPI server identity that ssh should expect when | ||
2817 | +connecting to the server. The default is unset, which means that the | ||
2818 | +expected GSSAPI server identity will be determined from the target | ||
2819 | +hostname. | ||
2820 | .It Cm GSSAPIDelegateCredentials | ||
2821 | Forward (delegate) credentials to the server. | ||
2822 | The default is | ||
2823 | .Cm no . | ||
2824 | +.It Cm GSSAPIRenewalForcesRekey | ||
2825 | +If set to | ||
2826 | +.Cm yes | ||
2827 | +then renewal of the client's GSSAPI credentials will force the rekeying of the | ||
2828 | +ssh connection. With a compatible server, this can delegate the renewed | ||
2829 | +credentials to a session on the server. | ||
2830 | +The default is | ||
2831 | +.Cm no . | ||
2832 | +.It Cm GSSAPITrustDns | ||
2833 | +Set to | ||
2834 | +.Cm yes | ||
2835 | +to indicate that the DNS is trusted to securely canonicalize | ||
2836 | +the name of the host being connected to. If | ||
2837 | +.Cm no , | ||
2838 | +the hostname entered on the | ||
2839 | +command line will be passed untouched to the GSSAPI library. | ||
2840 | +The default is | ||
2841 | +.Cm no . | ||
2842 | .It Cm HashKnownHosts | ||
2843 | Indicates that | ||
2844 | .Xr ssh 1 | ||
2845 | diff --git a/sshconnect2.c b/sshconnect2.c | ||
2846 | index 103a2b36..c35a0bd5 100644 | ||
2847 | --- a/sshconnect2.c | ||
2848 | +++ b/sshconnect2.c | ||
2849 | @@ -162,6 +162,11 @@ ssh_kex2(char *host, struct sockaddr *hostaddr, u_short port) | ||
2850 | struct kex *kex; | ||
2851 | int r; | ||
2852 | |||
2853 | +#ifdef GSSAPI | ||
2854 | + char *orig = NULL, *gss = NULL; | ||
2855 | + char *gss_host = NULL; | ||
2856 | +#endif | ||
2857 | + | ||
2858 | xxx_host = host; | ||
2859 | xxx_hostaddr = hostaddr; | ||
2860 | |||
2861 | @@ -192,6 +197,35 @@ ssh_kex2(char *host, struct sockaddr *hostaddr, u_short port) | ||
2862 | order_hostkeyalgs(host, hostaddr, port)); | ||
2863 | } | ||
2864 | |||
2865 | +#ifdef GSSAPI | ||
2866 | + if (options.gss_keyex) { | ||
2867 | + /* Add the GSSAPI mechanisms currently supported on this | ||
2868 | + * client to the key exchange algorithm proposal */ | ||
2869 | + orig = myproposal[PROPOSAL_KEX_ALGS]; | ||
2870 | + | ||
2871 | + if (options.gss_server_identity) | ||
2872 | + gss_host = xstrdup(options.gss_server_identity); | ||
2873 | + else if (options.gss_trust_dns) | ||
2874 | + gss_host = remote_hostname(active_state); | ||
2875 | + else | ||
2876 | + gss_host = xstrdup(host); | ||
2877 | + | ||
2878 | + gss = ssh_gssapi_client_mechanisms(gss_host, | ||
2879 | + options.gss_client_identity); | ||
2880 | + if (gss) { | ||
2881 | + debug("Offering GSSAPI proposal: %s", gss); | ||
2882 | + xasprintf(&myproposal[PROPOSAL_KEX_ALGS], | ||
2883 | + "%s,%s", gss, orig); | ||
2884 | + | ||
2885 | + /* If we've got GSSAPI algorithms, then we also | ||
2886 | + * support the 'null' hostkey, as a last resort */ | ||
2887 | + orig = myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS]; | ||
2888 | + xasprintf(&myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS], | ||
2889 | + "%s,null", orig); | ||
2890 | + } | ||
2891 | + } | ||
2892 | +#endif | ||
2893 | + | ||
2894 | if (options.rekey_limit || options.rekey_interval) | ||
2895 | packet_set_rekey_limits((u_int32_t)options.rekey_limit, | ||
2896 | (time_t)options.rekey_interval); | ||
2897 | @@ -213,15 +247,41 @@ ssh_kex2(char *host, struct sockaddr *hostaddr, u_short port) | ||
2898 | # endif | ||
2899 | #endif | ||
2900 | kex->kex[KEX_C25519_SHA256] = kexc25519_client; | ||
2901 | +#ifdef GSSAPI | ||
2902 | + if (options.gss_keyex) { | ||
2903 | + kex->kex[KEX_GSS_GRP1_SHA1] = kexgss_client; | ||
2904 | + kex->kex[KEX_GSS_GRP14_SHA1] = kexgss_client; | ||
2905 | + kex->kex[KEX_GSS_GEX_SHA1] = kexgss_client; | ||
2906 | + } | ||
2907 | +#endif | ||
2908 | kex->client_version_string=client_version_string; | ||
2909 | kex->server_version_string=server_version_string; | ||
2910 | kex->verify_host_key=&verify_host_key_callback; | ||
2911 | |||
2912 | +#ifdef GSSAPI | ||
2913 | + if (options.gss_keyex) { | ||
2914 | + kex->gss_deleg_creds = options.gss_deleg_creds; | ||
2915 | + kex->gss_trust_dns = options.gss_trust_dns; | ||
2916 | + kex->gss_client = options.gss_client_identity; | ||
2917 | + kex->gss_host = gss_host; | ||
2918 | + } | ||
2919 | +#endif | ||
2920 | + | ||
2921 | dispatch_run(DISPATCH_BLOCK, &kex->done, active_state); | ||
2922 | |||
2923 | /* remove ext-info from the KEX proposals for rekeying */ | ||
2924 | myproposal[PROPOSAL_KEX_ALGS] = | ||
2925 | compat_kex_proposal(options.kex_algorithms); | ||
2926 | +#ifdef GSSAPI | ||
2927 | + /* repair myproposal after it was crumpled by the */ | ||
2928 | + /* ext-info removal above */ | ||
2929 | + if (gss) { | ||
2930 | + orig = myproposal[PROPOSAL_KEX_ALGS]; | ||
2931 | + xasprintf(&myproposal[PROPOSAL_KEX_ALGS], | ||
2932 | + "%s,%s", gss, orig); | ||
2933 | + free(gss); | ||
2934 | + } | ||
2935 | +#endif | ||
2936 | if ((r = kex_prop2buf(kex->my, myproposal)) != 0) | ||
2937 | fatal("kex_prop2buf: %s", ssh_err(r)); | ||
2938 | |||
2939 | @@ -311,6 +371,7 @@ int input_gssapi_token(int type, u_int32_t, void *); | ||
2940 | int input_gssapi_hash(int type, u_int32_t, void *); | ||
2941 | int input_gssapi_error(int, u_int32_t, void *); | ||
2942 | int input_gssapi_errtok(int, u_int32_t, void *); | ||
2943 | +int userauth_gsskeyex(Authctxt *authctxt); | ||
2944 | #endif | ||
2945 | |||
2946 | void userauth(Authctxt *, char *); | ||
2947 | @@ -327,6 +388,11 @@ static char *authmethods_get(void); | ||
2948 | |||
2949 | Authmethod authmethods[] = { | ||
2950 | #ifdef GSSAPI | ||
2951 | + {"gssapi-keyex", | ||
2952 | + userauth_gsskeyex, | ||
2953 | + NULL, | ||
2954 | + &options.gss_authentication, | ||
2955 | + NULL}, | ||
2956 | {"gssapi-with-mic", | ||
2957 | userauth_gssapi, | ||
2958 | NULL, | ||
2959 | @@ -652,25 +718,40 @@ userauth_gssapi(Authctxt *authctxt) | ||
2960 | static u_int mech = 0; | ||
2961 | OM_uint32 min; | ||
2962 | int ok = 0; | ||
2963 | + char *gss_host; | ||
2964 | + | ||
2965 | + if (options.gss_server_identity) | ||
2966 | + gss_host = xstrdup(options.gss_server_identity); | ||
2967 | + else if (options.gss_trust_dns) | ||
2968 | + gss_host = remote_hostname(active_state); | ||
2969 | + else | ||
2970 | + gss_host = xstrdup(authctxt->host); | ||
2971 | |||
2972 | /* Try one GSSAPI method at a time, rather than sending them all at | ||
2973 | * once. */ | ||
2974 | |||
2975 | if (gss_supported == NULL) | ||
2976 | - gss_indicate_mechs(&min, &gss_supported); | ||
2977 | + if (GSS_ERROR(gss_indicate_mechs(&min, &gss_supported))) { | ||
2978 | + gss_supported = NULL; | ||
2979 | + free(gss_host); | ||
2980 | + return 0; | ||
2981 | + } | ||
2982 | |||
2983 | /* Check to see if the mechanism is usable before we offer it */ | ||
2984 | while (mech < gss_supported->count && !ok) { | ||
2985 | /* My DER encoding requires length<128 */ | ||
2986 | if (gss_supported->elements[mech].length < 128 && | ||
2987 | ssh_gssapi_check_mechanism(&gssctxt, | ||
2988 | - &gss_supported->elements[mech], authctxt->host)) { | ||
2989 | + &gss_supported->elements[mech], gss_host, | ||
2990 | + options.gss_client_identity)) { | ||
2991 | ok = 1; /* Mechanism works */ | ||
2992 | } else { | ||
2993 | mech++; | ||
2994 | } | ||
2995 | } | ||
2996 | |||
2997 | + free(gss_host); | ||
2998 | + | ||
2999 | if (!ok) | ||
3000 | return 0; | ||
3001 | |||
3002 | @@ -761,8 +842,8 @@ input_gssapi_response(int type, u_int32_t plen, void *ctxt) | ||
3003 | { | ||
3004 | Authctxt *authctxt = ctxt; | ||
3005 | Gssctxt *gssctxt; | ||
3006 | - int oidlen; | ||
3007 | - char *oidv; | ||
3008 | + u_int oidlen; | ||
3009 | + u_char *oidv; | ||
3010 | |||
3011 | if (authctxt == NULL) | ||
3012 | fatal("input_gssapi_response: no authentication context"); | ||
3013 | @@ -875,6 +956,48 @@ input_gssapi_error(int type, u_int32_t plen, void *ctxt) | ||
3014 | free(lang); | ||
3015 | return 0; | ||
3016 | } | ||
3017 | + | ||
3018 | +int | ||
3019 | +userauth_gsskeyex(Authctxt *authctxt) | ||
3020 | +{ | ||
3021 | + Buffer b; | ||
3022 | + gss_buffer_desc gssbuf; | ||
3023 | + gss_buffer_desc mic = GSS_C_EMPTY_BUFFER; | ||
3024 | + OM_uint32 ms; | ||
3025 | + | ||
3026 | + static int attempt = 0; | ||
3027 | + if (attempt++ >= 1) | ||
3028 | + return (0); | ||
3029 | + | ||
3030 | + if (gss_kex_context == NULL) { | ||
3031 | + debug("No valid Key exchange context"); | ||
3032 | + return (0); | ||
3033 | + } | ||
3034 | + | ||
3035 | + ssh_gssapi_buildmic(&b, authctxt->server_user, authctxt->service, | ||
3036 | + "gssapi-keyex"); | ||
3037 | + | ||
3038 | + gssbuf.value = buffer_ptr(&b); | ||
3039 | + gssbuf.length = buffer_len(&b); | ||
3040 | + | ||
3041 | + if (GSS_ERROR(ssh_gssapi_sign(gss_kex_context, &gssbuf, &mic))) { | ||
3042 | + buffer_free(&b); | ||
3043 | + return (0); | ||
3044 | + } | ||
3045 | + | ||
3046 | + packet_start(SSH2_MSG_USERAUTH_REQUEST); | ||
3047 | + packet_put_cstring(authctxt->server_user); | ||
3048 | + packet_put_cstring(authctxt->service); | ||
3049 | + packet_put_cstring(authctxt->method->name); | ||
3050 | + packet_put_string(mic.value, mic.length); | ||
3051 | + packet_send(); | ||
3052 | + | ||
3053 | + buffer_free(&b); | ||
3054 | + gss_release_buffer(&ms, &mic); | ||
3055 | + | ||
3056 | + return (1); | ||
3057 | +} | ||
3058 | + | ||
3059 | #endif /* GSSAPI */ | ||
3060 | |||
3061 | int | ||
3062 | diff --git a/sshd.c b/sshd.c | ||
3063 | index 1dc4d182..0970f297 100644 | ||
3064 | --- a/sshd.c | ||
3065 | +++ b/sshd.c | ||
3066 | @@ -123,6 +123,10 @@ | ||
3067 | #include "version.h" | ||
3068 | #include "ssherr.h" | ||
3069 | |||
3070 | +#ifdef USE_SECURITY_SESSION_API | ||
3071 | +#include <Security/AuthSession.h> | ||
3072 | +#endif | ||
3073 | + | ||
3074 | /* Re-exec fds */ | ||
3075 | #define REEXEC_DEVCRYPTO_RESERVED_FD (STDERR_FILENO + 1) | ||
3076 | #define REEXEC_STARTUP_PIPE_FD (STDERR_FILENO + 2) | ||
3077 | @@ -531,7 +535,7 @@ privsep_preauth_child(void) | ||
3078 | |||
3079 | #ifdef GSSAPI | ||
3080 | /* Cache supported mechanism OIDs for later use */ | ||
3081 | - if (options.gss_authentication) | ||
3082 | + if (options.gss_authentication || options.gss_keyex) | ||
3083 | ssh_gssapi_prepare_supported_oids(); | ||
3084 | #endif | ||
3085 | |||
3086 | @@ -1705,10 +1709,13 @@ main(int ac, char **av) | ||
3087 | key ? "private" : "agent", i, sshkey_ssh_name(pubkey), fp); | ||
3088 | free(fp); | ||
3089 | } | ||
3090 | +#ifndef GSSAPI | ||
3091 | + /* The GSSAPI key exchange can run without a host key */ | ||
3092 | if (!sensitive_data.have_ssh2_key) { | ||
3093 | logit("sshd: no hostkeys available -- exiting."); | ||
3094 | exit(1); | ||
3095 | } | ||
3096 | +#endif | ||
3097 | |||
3098 | /* | ||
3099 | * Load certificates. They are stored in an array at identical | ||
3100 | @@ -1978,6 +1985,60 @@ main(int ac, char **av) | ||
3101 | remote_ip, remote_port, laddr, ssh_local_port(ssh)); | ||
3102 | free(laddr); | ||
3103 | |||
3104 | +#ifdef USE_SECURITY_SESSION_API | ||
3105 | + /* | ||
3106 | + * Create a new security session for use by the new user login if | ||
3107 | + * the current session is the root session or we are not launched | ||
3108 | + * by inetd (eg: debugging mode or server mode). We do not | ||
3109 | + * necessarily need to create a session if we are launched from | ||
3110 | + * inetd because Panther xinetd will create a session for us. | ||
3111 | + * | ||
3112 | + * The only case where this logic will fail is if there is an | ||
3113 | + * inetd running in a non-root session which is not creating | ||
3114 | + * new sessions for us. Then all the users will end up in the | ||
3115 | + * same session (bad). | ||
3116 | + * | ||
3117 | + * When the client exits, the session will be destroyed for us | ||
3118 | + * automatically. | ||
3119 | + * | ||
3120 | + * We must create the session before any credentials are stored | ||
3121 | + * (including AFS pags, which happens a few lines below). | ||
3122 | + */ | ||
3123 | + { | ||
3124 | + OSStatus err = 0; | ||
3125 | + SecuritySessionId sid = 0; | ||
3126 | + SessionAttributeBits sattrs = 0; | ||
3127 | + | ||
3128 | + err = SessionGetInfo(callerSecuritySession, &sid, &sattrs); | ||
3129 | + if (err) | ||
3130 | + error("SessionGetInfo() failed with error %.8X", | ||
3131 | + (unsigned) err); | ||
3132 | + else | ||
3133 | + debug("Current Session ID is %.8X / Session Attributes are %.8X", | ||
3134 | + (unsigned) sid, (unsigned) sattrs); | ||
3135 | + | ||
3136 | + if (inetd_flag && !(sattrs & sessionIsRoot)) | ||
3137 | + debug("Running in inetd mode in a non-root session... " | ||
3138 | + "assuming inetd created the session for us."); | ||
3139 | + else { | ||
3140 | + debug("Creating new security session..."); | ||
3141 | + err = SessionCreate(0, sessionHasTTY | sessionIsRemote); | ||
3142 | + if (err) | ||
3143 | + error("SessionCreate() failed with error %.8X", | ||
3144 | + (unsigned) err); | ||
3145 | + | ||
3146 | + err = SessionGetInfo(callerSecuritySession, &sid, | ||
3147 | + &sattrs); | ||
3148 | + if (err) | ||
3149 | + error("SessionGetInfo() failed with error %.8X", | ||
3150 | + (unsigned) err); | ||
3151 | + else | ||
3152 | + debug("New Session ID is %.8X / Session Attributes are %.8X", | ||
3153 | + (unsigned) sid, (unsigned) sattrs); | ||
3154 | + } | ||
3155 | + } | ||
3156 | +#endif | ||
3157 | + | ||
3158 | /* | ||
3159 | * We don't want to listen forever unless the other side | ||
3160 | * successfully authenticates itself. So we set up an alarm which is | ||
3161 | @@ -2159,6 +2220,48 @@ do_ssh2_kex(void) | ||
3162 | myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = compat_pkalg_proposal( | ||
3163 | list_hostkey_types()); | ||
3164 | |||
3165 | +#ifdef GSSAPI | ||
3166 | + { | ||
3167 | + char *orig; | ||
3168 | + char *gss = NULL; | ||
3169 | + char *newstr = NULL; | ||
3170 | + orig = myproposal[PROPOSAL_KEX_ALGS]; | ||
3171 | + | ||
3172 | + /* | ||
3173 | + * If we don't have a host key, then there's no point advertising | ||
3174 | + * the other key exchange algorithms | ||
3175 | + */ | ||
3176 | + | ||
3177 | + if (strlen(myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS]) == 0) | ||
3178 | + orig = NULL; | ||
3179 | + | ||
3180 | + if (options.gss_keyex) | ||
3181 | + gss = ssh_gssapi_server_mechanisms(); | ||
3182 | + else | ||
3183 | + gss = NULL; | ||
3184 | + | ||
3185 | + if (gss && orig) | ||
3186 | + xasprintf(&newstr, "%s,%s", gss, orig); | ||
3187 | + else if (gss) | ||
3188 | + newstr = gss; | ||
3189 | + else if (orig) | ||
3190 | + newstr = orig; | ||
3191 | + | ||
3192 | + /* | ||
3193 | + * If we've got GSSAPI mechanisms, then we've got the 'null' host | ||
3194 | + * key alg, but we can't tell people about it unless its the only | ||
3195 | + * host key algorithm we support | ||
3196 | + */ | ||
3197 | + if (gss && (strlen(myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS])) == 0) | ||
3198 | + myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = "null"; | ||
3199 | + | ||
3200 | + if (newstr) | ||
3201 | + myproposal[PROPOSAL_KEX_ALGS] = newstr; | ||
3202 | + else | ||
3203 | + fatal("No supported key exchange algorithms"); | ||
3204 | + } | ||
3205 | +#endif | ||
3206 | + | ||
3207 | /* start key exchange */ | ||
3208 | if ((r = kex_setup(active_state, myproposal)) != 0) | ||
3209 | fatal("kex_setup: %s", ssh_err(r)); | ||
3210 | @@ -2176,6 +2279,13 @@ do_ssh2_kex(void) | ||
3211 | # endif | ||
3212 | #endif | ||
3213 | kex->kex[KEX_C25519_SHA256] = kexc25519_server; | ||
3214 | +#ifdef GSSAPI | ||
3215 | + if (options.gss_keyex) { | ||
3216 | + kex->kex[KEX_GSS_GRP1_SHA1] = kexgss_server; | ||
3217 | + kex->kex[KEX_GSS_GRP14_SHA1] = kexgss_server; | ||
3218 | + kex->kex[KEX_GSS_GEX_SHA1] = kexgss_server; | ||
3219 | + } | ||
3220 | +#endif | ||
3221 | kex->server = 1; | ||
3222 | kex->client_version_string=client_version_string; | ||
3223 | kex->server_version_string=server_version_string; | ||
3224 | diff --git a/sshd_config b/sshd_config | ||
3225 | index 9f09e4a6..00e5a728 100644 | ||
3226 | --- a/sshd_config | ||
3227 | +++ b/sshd_config | ||
3228 | @@ -70,6 +70,8 @@ AuthorizedKeysFile .ssh/authorized_keys | ||
3229 | # GSSAPI options | ||
3230 | #GSSAPIAuthentication no | ||
3231 | #GSSAPICleanupCredentials yes | ||
3232 | +#GSSAPIStrictAcceptorCheck yes | ||
3233 | +#GSSAPIKeyExchange no | ||
3234 | |||
3235 | # Set this to 'yes' to enable PAM authentication, account processing, | ||
3236 | # and session processing. If this is enabled, PAM authentication will | ||
3237 | diff --git a/sshd_config.5 b/sshd_config.5 | ||
3238 | index 32b29d24..dd765b39 100644 | ||
3239 | --- a/sshd_config.5 | ||
3240 | +++ b/sshd_config.5 | ||
3241 | @@ -623,6 +623,11 @@ The default is | ||
3242 | Specifies whether user authentication based on GSSAPI is allowed. | ||
3243 | The default is | ||
3244 | .Cm no . | ||
3245 | +.It Cm GSSAPIKeyExchange | ||
3246 | +Specifies whether key exchange based on GSSAPI is allowed. GSSAPI key exchange | ||
3247 | +doesn't rely on ssh keys to verify host identity. | ||
3248 | +The default is | ||
3249 | +.Cm no . | ||
3250 | .It Cm GSSAPICleanupCredentials | ||
3251 | Specifies whether to automatically destroy the user's credentials cache | ||
3252 | on logout. | ||
3253 | @@ -642,6 +647,11 @@ machine's default store. | ||
3254 | This facility is provided to assist with operation on multi homed machines. | ||
3255 | The default is | ||
3256 | .Cm yes . | ||
3257 | +.It Cm GSSAPIStoreCredentialsOnRekey | ||
3258 | +Controls whether the user's GSSAPI credentials should be updated following a | ||
3259 | +successful connection rekeying. This option can be used to accepted renewed | ||
3260 | +or updated credentials from a compatible client. The default is | ||
3261 | +.Cm no . | ||
3262 | .It Cm HostbasedAcceptedKeyTypes | ||
3263 | Specifies the key types that will be accepted for hostbased authentication | ||
3264 | as a comma-separated pattern list. | ||
3265 | diff --git a/sshkey.c b/sshkey.c | ||
3266 | index c01da6c3..377d72fa 100644 | ||
3267 | --- a/sshkey.c | ||
3268 | +++ b/sshkey.c | ||
3269 | @@ -114,6 +114,7 @@ static const struct keytype keytypes[] = { | ||
3270 | # endif /* OPENSSL_HAS_NISTP521 */ | ||
3271 | # endif /* OPENSSL_HAS_ECC */ | ||
3272 | #endif /* WITH_OPENSSL */ | ||
3273 | + { "null", "null", KEY_NULL, 0, 0, 0 }, | ||
3274 | { NULL, NULL, -1, -1, 0, 0 } | ||
3275 | }; | ||
3276 | |||
3277 | @@ -202,7 +203,7 @@ sshkey_alg_list(int certs_only, int plain_only, char sep) | ||
3278 | const struct keytype *kt; | ||
3279 | |||
3280 | for (kt = keytypes; kt->type != -1; kt++) { | ||
3281 | - if (kt->name == NULL || kt->sigonly) | ||
3282 | + if (kt->name == NULL || kt->sigonly || kt->type == KEY_NULL) | ||
3283 | continue; | ||
3284 | if ((certs_only && !kt->cert) || (plain_only && kt->cert)) | ||
3285 | continue; | ||
3286 | diff --git a/sshkey.h b/sshkey.h | ||
3287 | index f3936384..7eb2a139 100644 | ||
3288 | --- a/sshkey.h | ||
3289 | +++ b/sshkey.h | ||
3290 | @@ -62,6 +62,7 @@ enum sshkey_types { | ||
3291 | KEY_DSA_CERT, | ||
3292 | KEY_ECDSA_CERT, | ||
3293 | KEY_ED25519_CERT, | ||
3294 | + KEY_NULL, | ||
3295 | KEY_UNSPEC | ||
3296 | }; | ||
3297 | |||
diff --git a/debian/patches/keepalive-extensions.patch b/debian/patches/keepalive-extensions.patch new file mode 100644 index 000000000..59b39cd84 --- /dev/null +++ b/debian/patches/keepalive-extensions.patch | |||
@@ -0,0 +1,134 @@ | |||
1 | From 9078d9722d24a42b8f86621d20a6a6b42ba18d37 Mon Sep 17 00:00:00 2001 | ||
2 | From: Richard Kettlewell <rjk@greenend.org.uk> | ||
3 | Date: Sun, 9 Feb 2014 16:09:52 +0000 | ||
4 | Subject: Various keepalive extensions | ||
5 | |||
6 | Add compatibility aliases for ProtocolKeepAlives and SetupTimeOut, supported | ||
7 | in previous versions of Debian's OpenSSH package but since superseded by | ||
8 | ServerAliveInterval. (We're probably stuck with this bit for | ||
9 | compatibility.) | ||
10 | |||
11 | In batch mode, default ServerAliveInterval to five minutes. | ||
12 | |||
13 | Adjust documentation to match and to give some more advice on use of | ||
14 | keepalives. | ||
15 | |||
16 | Author: Ian Jackson <ian@chiark.greenend.org.uk> | ||
17 | Author: Matthew Vernon <matthew@debian.org> | ||
18 | Author: Colin Watson <cjwatson@debian.org> | ||
19 | Last-Update: 2016-12-26 | ||
20 | |||
21 | Patch-Name: keepalive-extensions.patch | ||
22 | --- | ||
23 | readconf.c | 14 ++++++++++++-- | ||
24 | ssh_config.5 | 21 +++++++++++++++++++-- | ||
25 | sshd_config.5 | 3 +++ | ||
26 | 3 files changed, 34 insertions(+), 4 deletions(-) | ||
27 | |||
28 | diff --git a/readconf.c b/readconf.c | ||
29 | index c1c3aae0..3efba242 100644 | ||
30 | --- a/readconf.c | ||
31 | +++ b/readconf.c | ||
32 | @@ -173,6 +173,7 @@ typedef enum { | ||
33 | oStreamLocalBindMask, oStreamLocalBindUnlink, oRevokedHostKeys, | ||
34 | oFingerprintHash, oUpdateHostkeys, oHostbasedKeyTypes, | ||
35 | oPubkeyAcceptedKeyTypes, oProxyJump, | ||
36 | + oProtocolKeepAlives, oSetupTimeOut, | ||
37 | oIgnoredUnknownOption, oDeprecated, oUnsupported | ||
38 | } OpCodes; | ||
39 | |||
40 | @@ -308,6 +309,8 @@ static struct { | ||
41 | { "pubkeyacceptedkeytypes", oPubkeyAcceptedKeyTypes }, | ||
42 | { "ignoreunknown", oIgnoreUnknown }, | ||
43 | { "proxyjump", oProxyJump }, | ||
44 | + { "protocolkeepalives", oProtocolKeepAlives }, | ||
45 | + { "setuptimeout", oSetupTimeOut }, | ||
46 | |||
47 | { NULL, oBadOption } | ||
48 | }; | ||
49 | @@ -1402,6 +1405,8 @@ parse_keytypes: | ||
50 | goto parse_flag; | ||
51 | |||
52 | case oServerAliveInterval: | ||
53 | + case oProtocolKeepAlives: /* Debian-specific compatibility alias */ | ||
54 | + case oSetupTimeOut: /* Debian-specific compatibility alias */ | ||
55 | intptr = &options->server_alive_interval; | ||
56 | goto parse_time; | ||
57 | |||
58 | @@ -2047,8 +2052,13 @@ fill_default_options(Options * options) | ||
59 | options->rekey_interval = 0; | ||
60 | if (options->verify_host_key_dns == -1) | ||
61 | options->verify_host_key_dns = 0; | ||
62 | - if (options->server_alive_interval == -1) | ||
63 | - options->server_alive_interval = 0; | ||
64 | + if (options->server_alive_interval == -1) { | ||
65 | + /* in batch mode, default is 5mins */ | ||
66 | + if (options->batch_mode == 1) | ||
67 | + options->server_alive_interval = 300; | ||
68 | + else | ||
69 | + options->server_alive_interval = 0; | ||
70 | + } | ||
71 | if (options->server_alive_count_max == -1) | ||
72 | options->server_alive_count_max = 3; | ||
73 | if (options->control_master == -1) | ||
74 | diff --git a/ssh_config.5 b/ssh_config.5 | ||
75 | index a7703fc7..a0457314 100644 | ||
76 | --- a/ssh_config.5 | ||
77 | +++ b/ssh_config.5 | ||
78 | @@ -250,8 +250,12 @@ Valid arguments are | ||
79 | If set to | ||
80 | .Cm yes , | ||
81 | passphrase/password querying will be disabled. | ||
82 | +In addition, the | ||
83 | +.Cm ServerAliveInterval | ||
84 | +option will be set to 300 seconds by default (Debian-specific). | ||
85 | This option is useful in scripts and other batch jobs where no user | ||
86 | -is present to supply the password. | ||
87 | +is present to supply the password, | ||
88 | +and where it is desirable to detect a broken network swiftly. | ||
89 | The argument must be | ||
90 | .Cm yes | ||
91 | or | ||
92 | @@ -1485,7 +1489,14 @@ from the server, | ||
93 | will send a message through the encrypted | ||
94 | channel to request a response from the server. | ||
95 | The default | ||
96 | -is 0, indicating that these messages will not be sent to the server. | ||
97 | +is 0, indicating that these messages will not be sent to the server, | ||
98 | +or 300 if the | ||
99 | +.Cm BatchMode | ||
100 | +option is set (Debian-specific). | ||
101 | +.Cm ProtocolKeepAlives | ||
102 | +and | ||
103 | +.Cm SetupTimeOut | ||
104 | +are Debian-specific compatibility aliases for this option. | ||
105 | .It Cm StreamLocalBindMask | ||
106 | Sets the octal file creation mode mask | ||
107 | .Pq umask | ||
108 | @@ -1544,6 +1555,12 @@ Specifies whether the system should send TCP keepalive messages to the | ||
109 | other side. | ||
110 | If they are sent, death of the connection or crash of one | ||
111 | of the machines will be properly noticed. | ||
112 | +This option only uses TCP keepalives (as opposed to using ssh level | ||
113 | +keepalives), so takes a long time to notice when the connection dies. | ||
114 | +As such, you probably want | ||
115 | +the | ||
116 | +.Cm ServerAliveInterval | ||
117 | +option as well. | ||
118 | However, this means that | ||
119 | connections will die if the route is down temporarily, and some people | ||
120 | find it annoying. | ||
121 | diff --git a/sshd_config.5 b/sshd_config.5 | ||
122 | index dd765b39..283ba889 100644 | ||
123 | --- a/sshd_config.5 | ||
124 | +++ b/sshd_config.5 | ||
125 | @@ -1427,6 +1427,9 @@ This avoids infinitely hanging sessions. | ||
126 | .Pp | ||
127 | To disable TCP keepalive messages, the value should be set to | ||
128 | .Cm no . | ||
129 | +.Pp | ||
130 | +This option was formerly called | ||
131 | +.Cm KeepAlive . | ||
132 | .It Cm TrustedUserCAKeys | ||
133 | Specifies a file containing public keys of certificate authorities that are | ||
134 | trusted to sign user certificates for authentication, or | ||
diff --git a/debian/patches/mention-ssh-keygen-on-keychange.patch b/debian/patches/mention-ssh-keygen-on-keychange.patch new file mode 100644 index 000000000..4d27c68ab --- /dev/null +++ b/debian/patches/mention-ssh-keygen-on-keychange.patch | |||
@@ -0,0 +1,42 @@ | |||
1 | From 360c4ebd14706887879f1c6d542cd092afffb07b Mon Sep 17 00:00:00 2001 | ||
2 | From: Scott Moser <smoser@ubuntu.com> | ||
3 | Date: Sun, 9 Feb 2014 16:10:03 +0000 | ||
4 | Subject: Mention ssh-keygen in ssh fingerprint changed warning | ||
5 | |||
6 | Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1843 | ||
7 | Bug-Ubuntu: https://bugs.launchpad.net/bugs/686607 | ||
8 | Last-Update: 2015-09-08 | ||
9 | |||
10 | Patch-Name: mention-ssh-keygen-on-keychange.patch | ||
11 | --- | ||
12 | sshconnect.c | 8 +++++++- | ||
13 | 1 file changed, 7 insertions(+), 1 deletion(-) | ||
14 | |||
15 | diff --git a/sshconnect.c b/sshconnect.c | ||
16 | index 698a0711..1cc556e8 100644 | ||
17 | --- a/sshconnect.c | ||
18 | +++ b/sshconnect.c | ||
19 | @@ -1080,9 +1080,13 @@ check_host_key(char *hostname, struct sockaddr *hostaddr, u_short port, | ||
20 | error("%s. This could either mean that", key_msg); | ||
21 | error("DNS SPOOFING is happening or the IP address for the host"); | ||
22 | error("and its host key have changed at the same time."); | ||
23 | - if (ip_status != HOST_NEW) | ||
24 | + if (ip_status != HOST_NEW) { | ||
25 | error("Offending key for IP in %s:%lu", | ||
26 | ip_found->file, ip_found->line); | ||
27 | + error(" remove with:"); | ||
28 | + error(" ssh-keygen -f \"%s\" -R %s", | ||
29 | + ip_found->file, ip); | ||
30 | + } | ||
31 | } | ||
32 | /* The host key has changed. */ | ||
33 | warn_changed_key(host_key); | ||
34 | @@ -1090,6 +1094,8 @@ check_host_key(char *hostname, struct sockaddr *hostaddr, u_short port, | ||
35 | user_hostfiles[0]); | ||
36 | error("Offending %s key in %s:%lu", key_type(host_found->key), | ||
37 | host_found->file, host_found->line); | ||
38 | + error(" remove with:"); | ||
39 | + error(" ssh-keygen -f \"%s\" -R %s", host_found->file, host); | ||
40 | |||
41 | /* | ||
42 | * If strict host key checking is in use, the user will have | ||
diff --git a/debian/patches/no-dsa-host-key-by-default.patch b/debian/patches/no-dsa-host-key-by-default.patch new file mode 100644 index 000000000..bfe6033b1 --- /dev/null +++ b/debian/patches/no-dsa-host-key-by-default.patch | |||
@@ -0,0 +1,83 @@ | |||
1 | From 3f1016b4535faf6e48aa71e21569aa714a25193f Mon Sep 17 00:00:00 2001 | ||
2 | From: Colin Watson <cjwatson@debian.org> | ||
3 | Date: Mon, 16 Jan 2017 13:53:04 +0000 | ||
4 | Subject: Remove ssh_host_dsa_key from HostKey default | ||
5 | |||
6 | The client no longer accepts DSA host keys, and servers using the | ||
7 | default HostKey setting should have better host keys available. | ||
8 | |||
9 | Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=2662 | ||
10 | Bug-Debian: https://bugs.debian.org/850614 | ||
11 | Last-Update: 2017-01-16 | ||
12 | |||
13 | Patch-Name: no-dsa-host-key-by-default.patch | ||
14 | --- | ||
15 | servconf.c | 2 -- | ||
16 | sshd.8 | 7 +++---- | ||
17 | sshd_config | 1 - | ||
18 | sshd_config.5 | 7 +++---- | ||
19 | 4 files changed, 6 insertions(+), 11 deletions(-) | ||
20 | |||
21 | diff --git a/servconf.c b/servconf.c | ||
22 | index 1cee3d6c..202c4506 100644 | ||
23 | --- a/servconf.c | ||
24 | +++ b/servconf.c | ||
25 | @@ -204,8 +204,6 @@ fill_default_server_options(ServerOptions *options) | ||
26 | /* fill default hostkeys for protocols */ | ||
27 | options->host_key_files[options->num_host_key_files++] = | ||
28 | _PATH_HOST_RSA_KEY_FILE; | ||
29 | - options->host_key_files[options->num_host_key_files++] = | ||
30 | - _PATH_HOST_DSA_KEY_FILE; | ||
31 | #ifdef OPENSSL_HAS_ECC | ||
32 | options->host_key_files[options->num_host_key_files++] = | ||
33 | _PATH_HOST_ECDSA_KEY_FILE; | ||
34 | diff --git a/sshd.8 b/sshd.8 | ||
35 | index 38a72540..e8f1fde8 100644 | ||
36 | --- a/sshd.8 | ||
37 | +++ b/sshd.8 | ||
38 | @@ -167,11 +167,10 @@ This option must be given if | ||
39 | is not run as root (as the normal | ||
40 | host key files are normally not readable by anyone but root). | ||
41 | The default is | ||
42 | -.Pa /etc/ssh/ssh_host_dsa_key , | ||
43 | -.Pa /etc/ssh/ssh_host_ecdsa_key , | ||
44 | -.Pa /etc/ssh/ssh_host_ed25519_key | ||
45 | +.Pa /etc/ssh/ssh_host_rsa_key , | ||
46 | +.Pa /etc/ssh/ssh_host_ecdsa_key | ||
47 | and | ||
48 | -.Pa /etc/ssh/ssh_host_rsa_key . | ||
49 | +.Pa /etc/ssh/ssh_host_ed25519_key . | ||
50 | It is possible to have multiple host key files for | ||
51 | the different host key algorithms. | ||
52 | .It Fl i | ||
53 | diff --git a/sshd_config b/sshd_config | ||
54 | index 13cbe2c6..4aea6c72 100644 | ||
55 | --- a/sshd_config | ||
56 | +++ b/sshd_config | ||
57 | @@ -16,7 +16,6 @@ | ||
58 | #ListenAddress :: | ||
59 | |||
60 | #HostKey /etc/ssh/ssh_host_rsa_key | ||
61 | -#HostKey /etc/ssh/ssh_host_dsa_key | ||
62 | #HostKey /etc/ssh/ssh_host_ecdsa_key | ||
63 | #HostKey /etc/ssh/ssh_host_ed25519_key | ||
64 | |||
65 | diff --git a/sshd_config.5 b/sshd_config.5 | ||
66 | index 703a9cdd..8f8fbb66 100644 | ||
67 | --- a/sshd_config.5 | ||
68 | +++ b/sshd_config.5 | ||
69 | @@ -733,11 +733,10 @@ is not to load any certificates. | ||
70 | Specifies a file containing a private host key | ||
71 | used by SSH. | ||
72 | The defaults are | ||
73 | -.Pa /etc/ssh/ssh_host_dsa_key , | ||
74 | -.Pa /etc/ssh/ssh_host_ecdsa_key , | ||
75 | -.Pa /etc/ssh/ssh_host_ed25519_key | ||
76 | +.Pa /etc/ssh/ssh_host_rsa_key , | ||
77 | +.Pa /etc/ssh/ssh_host_ecdsa_key | ||
78 | and | ||
79 | -.Pa /etc/ssh/ssh_host_rsa_key . | ||
80 | +.Pa /etc/ssh/ssh_host_ed25519_key . | ||
81 | .Pp | ||
82 | Note that | ||
83 | .Xr sshd 8 | ||
diff --git a/debian/patches/no-openssl-version-status.patch b/debian/patches/no-openssl-version-status.patch new file mode 100644 index 000000000..b1c045643 --- /dev/null +++ b/debian/patches/no-openssl-version-status.patch | |||
@@ -0,0 +1,62 @@ | |||
1 | From 48c127fe8f40037d0f33efa8da19cb32514b440e Mon Sep 17 00:00:00 2001 | ||
2 | From: Kurt Roeckx <kurt@roeckx.be> | ||
3 | Date: Sun, 9 Feb 2014 16:10:14 +0000 | ||
4 | Subject: Don't check the status field of the OpenSSL version | ||
5 | |||
6 | There is no reason to check the version of OpenSSL (in Debian). If it's | ||
7 | not compatible the soname will change. OpenSSH seems to want to do a | ||
8 | check for the soname based on the version number, but wants to keep the | ||
9 | status of the release the same. Remove that check on the status since | ||
10 | it doesn't tell you anything about how compatible that version is. | ||
11 | |||
12 | Author: Colin Watson <cjwatson@debian.org> | ||
13 | Bug-Debian: https://bugs.debian.org/93581 | ||
14 | Bug-Debian: https://bugs.debian.org/664383 | ||
15 | Bug-Debian: https://bugs.debian.org/732940 | ||
16 | Forwarded: not-needed | ||
17 | Last-Update: 2014-10-07 | ||
18 | |||
19 | Patch-Name: no-openssl-version-status.patch | ||
20 | --- | ||
21 | openbsd-compat/openssl-compat.c | 6 +++--- | ||
22 | openbsd-compat/regress/opensslvertest.c | 1 + | ||
23 | 2 files changed, 4 insertions(+), 3 deletions(-) | ||
24 | |||
25 | diff --git a/openbsd-compat/openssl-compat.c b/openbsd-compat/openssl-compat.c | ||
26 | index 259fccbe..aaa953f2 100644 | ||
27 | --- a/openbsd-compat/openssl-compat.c | ||
28 | +++ b/openbsd-compat/openssl-compat.c | ||
29 | @@ -34,7 +34,7 @@ | ||
30 | /* | ||
31 | * OpenSSL version numbers: MNNFFPPS: major minor fix patch status | ||
32 | * We match major, minor, fix and status (not patch) for <1.0.0. | ||
33 | - * After that, we acceptable compatible fix versions (so we | ||
34 | + * After that, we accept compatible fix and status versions (so we | ||
35 | * allow 1.0.1 to work with 1.0.0). Going backwards is only allowed | ||
36 | * within a patch series. | ||
37 | */ | ||
38 | @@ -55,10 +55,10 @@ ssh_compatible_openssl(long headerver, long libver) | ||
39 | } | ||
40 | |||
41 | /* | ||
42 | - * For versions >= 1.0.0, major,minor,status must match and library | ||
43 | + * For versions >= 1.0.0, major,minor must match and library | ||
44 | * fix version must be equal to or newer than the header. | ||
45 | */ | ||
46 | - mask = 0xfff0000fL; /* major,minor,status */ | ||
47 | + mask = 0xfff00000L; /* major,minor */ | ||
48 | hfix = (headerver & 0x000ff000) >> 12; | ||
49 | lfix = (libver & 0x000ff000) >> 12; | ||
50 | if ( (headerver & mask) == (libver & mask) && lfix >= hfix) | ||
51 | diff --git a/openbsd-compat/regress/opensslvertest.c b/openbsd-compat/regress/opensslvertest.c | ||
52 | index 5d019b59..58474873 100644 | ||
53 | --- a/openbsd-compat/regress/opensslvertest.c | ||
54 | +++ b/openbsd-compat/regress/opensslvertest.c | ||
55 | @@ -35,6 +35,7 @@ struct version_test { | ||
56 | |||
57 | /* built with 1.0.1b release headers */ | ||
58 | { 0x1000101fL, 0x1000101fL, 1},/* exact match */ | ||
59 | + { 0x1000101fL, 0x10001010L, 1}, /* different status: ok */ | ||
60 | { 0x1000101fL, 0x1000102fL, 1}, /* newer library patch version: ok */ | ||
61 | { 0x1000101fL, 0x1000100fL, 1}, /* older library patch version: ok */ | ||
62 | { 0x1000101fL, 0x1000201fL, 1}, /* newer library fix version: ok */ | ||
diff --git a/debian/patches/openbsd-docs.patch b/debian/patches/openbsd-docs.patch new file mode 100644 index 000000000..9a7edf949 --- /dev/null +++ b/debian/patches/openbsd-docs.patch | |||
@@ -0,0 +1,148 @@ | |||
1 | From 4badfe75ad62ee50394afa9aaac62b3465fd384e Mon Sep 17 00:00:00 2001 | ||
2 | From: Colin Watson <cjwatson@debian.org> | ||
3 | Date: Sun, 9 Feb 2014 16:10:09 +0000 | ||
4 | Subject: Adjust various OpenBSD-specific references in manual pages | ||
5 | |||
6 | No single bug reference for this patch, but history includes: | ||
7 | http://bugs.debian.org/154434 (login.conf(5)) | ||
8 | http://bugs.debian.org/513417 (/etc/rc) | ||
9 | http://bugs.debian.org/530692 (ssl(8)) | ||
10 | https://bugs.launchpad.net/bugs/456660 (ssl(8)) | ||
11 | |||
12 | Forwarded: not-needed | ||
13 | Last-Update: 2014-10-07 | ||
14 | |||
15 | Patch-Name: openbsd-docs.patch | ||
16 | --- | ||
17 | moduli.5 | 4 ++-- | ||
18 | ssh-keygen.1 | 12 ++++-------- | ||
19 | ssh.1 | 4 ++++ | ||
20 | sshd.8 | 5 ++--- | ||
21 | sshd_config.5 | 3 +-- | ||
22 | 5 files changed, 13 insertions(+), 15 deletions(-) | ||
23 | |||
24 | diff --git a/moduli.5 b/moduli.5 | ||
25 | index ef0de085..149846c8 100644 | ||
26 | --- a/moduli.5 | ||
27 | +++ b/moduli.5 | ||
28 | @@ -21,7 +21,7 @@ | ||
29 | .Nd Diffie-Hellman moduli | ||
30 | .Sh DESCRIPTION | ||
31 | The | ||
32 | -.Pa /etc/moduli | ||
33 | +.Pa /etc/ssh/moduli | ||
34 | file contains prime numbers and generators for use by | ||
35 | .Xr sshd 8 | ||
36 | in the Diffie-Hellman Group Exchange key exchange method. | ||
37 | @@ -110,7 +110,7 @@ first estimates the size of the modulus required to produce enough | ||
38 | Diffie-Hellman output to sufficiently key the selected symmetric cipher. | ||
39 | .Xr sshd 8 | ||
40 | then randomly selects a modulus from | ||
41 | -.Fa /etc/moduli | ||
42 | +.Fa /etc/ssh/moduli | ||
43 | that best meets the size requirement. | ||
44 | .Sh SEE ALSO | ||
45 | .Xr ssh-keygen 1 , | ||
46 | diff --git a/ssh-keygen.1 b/ssh-keygen.1 | ||
47 | index ce2213c7..01711dff 100644 | ||
48 | --- a/ssh-keygen.1 | ||
49 | +++ b/ssh-keygen.1 | ||
50 | @@ -178,9 +178,7 @@ key in | ||
51 | .Pa ~/.ssh/id_ed25519 | ||
52 | or | ||
53 | .Pa ~/.ssh/id_rsa . | ||
54 | -Additionally, the system administrator may use this to generate host keys, | ||
55 | -as seen in | ||
56 | -.Pa /etc/rc . | ||
57 | +Additionally, the system administrator may use this to generate host keys. | ||
58 | .Pp | ||
59 | Normally this program generates the key and asks for a file in which | ||
60 | to store the private key. | ||
61 | @@ -227,9 +225,7 @@ For each of the key types (rsa1, rsa, dsa, ecdsa and ed25519) | ||
62 | for which host keys | ||
63 | do not exist, generate the host keys with the default key file path, | ||
64 | an empty passphrase, default bits for the key type, and default comment. | ||
65 | -This is used by | ||
66 | -.Pa /etc/rc | ||
67 | -to generate new host keys. | ||
68 | +This is used by system administration scripts to generate new host keys. | ||
69 | .It Fl a Ar rounds | ||
70 | When saving a new-format private key (i.e. an ed25519 key or any SSH protocol | ||
71 | 2 key when the | ||
72 | @@ -644,7 +640,7 @@ option. | ||
73 | Valid generator values are 2, 3, and 5. | ||
74 | .Pp | ||
75 | Screened DH groups may be installed in | ||
76 | -.Pa /etc/moduli . | ||
77 | +.Pa /etc/ssh/moduli . | ||
78 | It is important that this file contains moduli of a range of bit lengths and | ||
79 | that both ends of a connection share common moduli. | ||
80 | .Sh CERTIFICATES | ||
81 | @@ -843,7 +839,7 @@ on all machines | ||
82 | where the user wishes to log in using public key authentication. | ||
83 | There is no need to keep the contents of this file secret. | ||
84 | .Pp | ||
85 | -.It Pa /etc/moduli | ||
86 | +.It Pa /etc/ssh/moduli | ||
87 | Contains Diffie-Hellman groups used for DH-GEX. | ||
88 | The file format is described in | ||
89 | .Xr moduli 5 . | ||
90 | diff --git a/ssh.1 b/ssh.1 | ||
91 | index feef81a5..b1f128c2 100644 | ||
92 | --- a/ssh.1 | ||
93 | +++ b/ssh.1 | ||
94 | @@ -877,6 +877,10 @@ implements public key authentication protocol automatically, | ||
95 | using one of the DSA, ECDSA, Ed25519 or RSA algorithms. | ||
96 | The HISTORY section of | ||
97 | .Xr ssl 8 | ||
98 | +(on non-OpenBSD systems, see | ||
99 | +.nh | ||
100 | +http://www.openbsd.org/cgi\-bin/man.cgi?query=ssl&sektion=8#HISTORY) | ||
101 | +.hy | ||
102 | contains a brief discussion of the DSA and RSA algorithms. | ||
103 | .Pp | ||
104 | The file | ||
105 | diff --git a/sshd.8 b/sshd.8 | ||
106 | index c6784602..e6915141 100644 | ||
107 | --- a/sshd.8 | ||
108 | +++ b/sshd.8 | ||
109 | @@ -65,7 +65,7 @@ over an insecure network. | ||
110 | .Nm | ||
111 | listens for connections from clients. | ||
112 | It is normally started at boot from | ||
113 | -.Pa /etc/rc . | ||
114 | +.Pa /etc/init.d/ssh . | ||
115 | It forks a new | ||
116 | daemon for each incoming connection. | ||
117 | The forked daemons handle | ||
118 | @@ -836,7 +836,7 @@ This file is for host-based authentication (see | ||
119 | .Xr ssh 1 ) . | ||
120 | It should only be writable by root. | ||
121 | .Pp | ||
122 | -.It Pa /etc/moduli | ||
123 | +.It Pa /etc/ssh/moduli | ||
124 | Contains Diffie-Hellman groups used for the "Diffie-Hellman Group Exchange" | ||
125 | key exchange method. | ||
126 | The file format is described in | ||
127 | @@ -936,7 +936,6 @@ The content of this file is not sensitive; it can be world-readable. | ||
128 | .Xr ssh-keyscan 1 , | ||
129 | .Xr chroot 2 , | ||
130 | .Xr hosts_access 5 , | ||
131 | -.Xr login.conf 5 , | ||
132 | .Xr moduli 5 , | ||
133 | .Xr sshd_config 5 , | ||
134 | .Xr inetd 8 , | ||
135 | diff --git a/sshd_config.5 b/sshd_config.5 | ||
136 | index 4ea0a9c3..e45a8937 100644 | ||
137 | --- a/sshd_config.5 | ||
138 | +++ b/sshd_config.5 | ||
139 | @@ -372,8 +372,7 @@ then no banner is displayed. | ||
140 | By default, no banner is displayed. | ||
141 | .It Cm ChallengeResponseAuthentication | ||
142 | Specifies whether challenge-response authentication is allowed (e.g. via | ||
143 | -PAM or through authentication styles supported in | ||
144 | -.Xr login.conf 5 ) | ||
145 | +PAM). | ||
146 | The default is | ||
147 | .Cm yes . | ||
148 | .It Cm ChrootDirectory | ||
diff --git a/debian/patches/package-versioning.patch b/debian/patches/package-versioning.patch new file mode 100644 index 000000000..fcc231fc9 --- /dev/null +++ b/debian/patches/package-versioning.patch | |||
@@ -0,0 +1,65 @@ | |||
1 | From c89c88a0bcada4616262e3d7d9b165aca709927b Mon Sep 17 00:00:00 2001 | ||
2 | From: Matthew Vernon <matthew@debian.org> | ||
3 | Date: Sun, 9 Feb 2014 16:10:05 +0000 | ||
4 | Subject: Include the Debian version in our identification | ||
5 | |||
6 | This makes it easier to audit networks for versions patched against security | ||
7 | vulnerabilities. It has little detrimental effect, as attackers will | ||
8 | generally just try attacks rather than bothering to scan for | ||
9 | vulnerable-looking version strings. (However, see debian-banner.patch.) | ||
10 | |||
11 | Forwarded: not-needed | ||
12 | Last-Update: 2013-09-14 | ||
13 | |||
14 | Patch-Name: package-versioning.patch | ||
15 | --- | ||
16 | sshconnect.c | 4 ++-- | ||
17 | sshd.c | 2 +- | ||
18 | version.h | 7 ++++++- | ||
19 | 3 files changed, 9 insertions(+), 4 deletions(-) | ||
20 | |||
21 | diff --git a/sshconnect.c b/sshconnect.c | ||
22 | index 1cc556e8..c64c51bb 100644 | ||
23 | --- a/sshconnect.c | ||
24 | +++ b/sshconnect.c | ||
25 | @@ -526,10 +526,10 @@ send_client_banner(int connection_out, int minor1) | ||
26 | /* Send our own protocol version identification. */ | ||
27 | if (compat20) { | ||
28 | xasprintf(&client_version_string, "SSH-%d.%d-%.100s\r\n", | ||
29 | - PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION); | ||
30 | + PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE); | ||
31 | } else { | ||
32 | xasprintf(&client_version_string, "SSH-%d.%d-%.100s\n", | ||
33 | - PROTOCOL_MAJOR_1, minor1, SSH_VERSION); | ||
34 | + PROTOCOL_MAJOR_1, minor1, SSH_RELEASE); | ||
35 | } | ||
36 | if (atomicio(vwrite, connection_out, client_version_string, | ||
37 | strlen(client_version_string)) != strlen(client_version_string)) | ||
38 | diff --git a/sshd.c b/sshd.c | ||
39 | index 9aab36c3..49f3a2e5 100644 | ||
40 | --- a/sshd.c | ||
41 | +++ b/sshd.c | ||
42 | @@ -378,7 +378,7 @@ sshd_exchange_identification(struct ssh *ssh, int sock_in, int sock_out) | ||
43 | char remote_version[256]; /* Must be at least as big as buf. */ | ||
44 | |||
45 | xasprintf(&server_version_string, "SSH-%d.%d-%.100s%s%s%s", | ||
46 | - PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION, | ||
47 | + PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE, | ||
48 | *options.version_addendum == '\0' ? "" : " ", | ||
49 | options.version_addendum, newline); | ||
50 | |||
51 | diff --git a/version.h b/version.h | ||
52 | index 269ebcda..850a2f7d 100644 | ||
53 | --- a/version.h | ||
54 | +++ b/version.h | ||
55 | @@ -3,4 +3,9 @@ | ||
56 | #define SSH_VERSION "OpenSSH_7.4" | ||
57 | |||
58 | #define SSH_PORTABLE "p1" | ||
59 | -#define SSH_RELEASE SSH_VERSION SSH_PORTABLE | ||
60 | +#define SSH_RELEASE_MINIMUM SSH_VERSION SSH_PORTABLE | ||
61 | +#ifdef SSH_EXTRAVERSION | ||
62 | +#define SSH_RELEASE SSH_RELEASE_MINIMUM " " SSH_EXTRAVERSION | ||
63 | +#else | ||
64 | +#define SSH_RELEASE SSH_RELEASE_MINIMUM | ||
65 | +#endif | ||
diff --git a/debian/patches/quieter-signals.patch b/debian/patches/quieter-signals.patch new file mode 100644 index 000000000..c19fc46fe --- /dev/null +++ b/debian/patches/quieter-signals.patch | |||
@@ -0,0 +1,40 @@ | |||
1 | From 71809791262478c78d1db2ca1004604c39db8150 Mon Sep 17 00:00:00 2001 | ||
2 | From: Peter Samuelson <peter@p12n.org> | ||
3 | Date: Sun, 9 Feb 2014 16:09:55 +0000 | ||
4 | Subject: Reduce severity of "Killed by signal %d" | ||
5 | |||
6 | This produces irritating messages when using ProxyCommand or other programs | ||
7 | that use ssh under the covers (e.g. Subversion). These messages are more | ||
8 | normally printed by the calling program, such as the shell. | ||
9 | |||
10 | According to the upstream bug, the right way to avoid this is to use the -q | ||
11 | option, so we may drop this patch after further investigation into whether | ||
12 | any software in Debian is still relying on it. | ||
13 | |||
14 | Author: Colin Watson <cjwatson@debian.org> | ||
15 | Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1118 | ||
16 | Bug-Debian: http://bugs.debian.org/313371 | ||
17 | Last-Update: 2013-09-14 | ||
18 | |||
19 | Patch-Name: quieter-signals.patch | ||
20 | --- | ||
21 | clientloop.c | 6 ++++-- | ||
22 | 1 file changed, 4 insertions(+), 2 deletions(-) | ||
23 | |||
24 | diff --git a/clientloop.c b/clientloop.c | ||
25 | index 99c68b69..5876cc9a 100644 | ||
26 | --- a/clientloop.c | ||
27 | +++ b/clientloop.c | ||
28 | @@ -1755,8 +1755,10 @@ client_loop(int have_pty, int escape_char_arg, int ssh2_chan_id) | ||
29 | exit_status = 0; | ||
30 | } | ||
31 | |||
32 | - if (received_signal) | ||
33 | - fatal("Killed by signal %d.", (int) received_signal); | ||
34 | + if (received_signal) { | ||
35 | + debug("Killed by signal %d.", (int) received_signal); | ||
36 | + cleanup_exit((int) received_signal + 128); | ||
37 | + } | ||
38 | |||
39 | /* | ||
40 | * In interactive mode (with pseudo tty) display a message indicating | ||
diff --git a/debian/patches/regress-forwarding-race.patch b/debian/patches/regress-forwarding-race.patch new file mode 100644 index 000000000..f1a535fb2 --- /dev/null +++ b/debian/patches/regress-forwarding-race.patch | |||
@@ -0,0 +1,115 @@ | |||
1 | From 166f04046035ffca27c820649df360eaa5dd1b99 Mon Sep 17 00:00:00 2001 | ||
2 | From: Colin Watson <cjwatson@debian.org> | ||
3 | Date: Mon, 2 Jan 2017 14:55:16 +0000 | ||
4 | Subject: Fix race conditions in forwarding tests | ||
5 | |||
6 | The forwarding tests sometimes seem to fail in a way that suggests ports | ||
7 | are in use even though they shouldn't be. Convert more of them to use a | ||
8 | mux socket rather than relying on sleeps in the hope that that makes | ||
9 | behaviour more consistent. | ||
10 | |||
11 | Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=2659 | ||
12 | Patch-Name: regress-forwarding-race.patch | ||
13 | |||
14 | Last-Update: 2017-01-02 | ||
15 | --- | ||
16 | regress/forwarding.sh | 32 +++++++++++++++++++------------- | ||
17 | 1 file changed, 19 insertions(+), 13 deletions(-) | ||
18 | |||
19 | diff --git a/regress/forwarding.sh b/regress/forwarding.sh | ||
20 | index 2539db9b..a1a4b13f 100644 | ||
21 | --- a/regress/forwarding.sh | ||
22 | +++ b/regress/forwarding.sh | ||
23 | @@ -11,7 +11,6 @@ base=33 | ||
24 | last=$PORT | ||
25 | fwd="" | ||
26 | CTL=$OBJ/ctl-sock | ||
27 | -rm -f $CTL | ||
28 | |||
29 | for j in 0 1 2; do | ||
30 | for i in 0 1 2; do | ||
31 | @@ -29,7 +28,8 @@ for p in ${SSH_PROTOCOLS}; do | ||
32 | q=$p | ||
33 | fi | ||
34 | trace "start forwarding, fork to background" | ||
35 | - ${SSH} -$p -F $OBJ/ssh_config -f $fwd somehost sleep 10 | ||
36 | + rm -f $CTL | ||
37 | + ${SSH} -S $CTL -M -$p -F $OBJ/ssh_config -f $fwd somehost sleep 10 | ||
38 | |||
39 | trace "transfer over forwarded channels and check result" | ||
40 | ${SSH} -$q -F $OBJ/ssh_config -p$last -o 'ConnectionAttempts=4' \ | ||
41 | @@ -37,7 +37,7 @@ for p in ${SSH_PROTOCOLS}; do | ||
42 | test -s ${COPY} || fail "failed copy of ${DATA}" | ||
43 | cmp ${DATA} ${COPY} || fail "corrupted copy of ${DATA}" | ||
44 | |||
45 | - sleep 10 | ||
46 | + ${SSH} -S $CTL -O exit somehost | ||
47 | done | ||
48 | |||
49 | for p in ${SSH_PROTOCOLS}; do | ||
50 | @@ -75,7 +75,8 @@ for p in ${SSH_PROTOCOLS}; do | ||
51 | ${SSH} -$p -F $OBJ/ssh_config -oClearAllForwardings=yes somehost true | ||
52 | |||
53 | trace "clear local forward proto $p" | ||
54 | - ${SSH} -$p -f -F $OBJ/ssh_config -L ${base}01:127.0.0.1:$PORT \ | ||
55 | + rm -f $CTL | ||
56 | + ${SSH} -S $CTL -M -$p -f -F $OBJ/ssh_config -L ${base}01:127.0.0.1:$PORT \ | ||
57 | -oClearAllForwardings=yes somehost sleep 10 | ||
58 | if [ $? != 0 ]; then | ||
59 | fail "connection failed with cleared local forwarding" | ||
60 | @@ -85,10 +86,11 @@ for p in ${SSH_PROTOCOLS}; do | ||
61 | >>$TEST_REGRESS_LOGFILE 2>&1 && \ | ||
62 | fail "local forwarding not cleared" | ||
63 | fi | ||
64 | - sleep 10 | ||
65 | + ${SSH} -S $CTL -O exit somehost | ||
66 | |||
67 | trace "clear remote forward proto $p" | ||
68 | - ${SSH} -$p -f -F $OBJ/ssh_config -R ${base}01:127.0.0.1:$PORT \ | ||
69 | + rm -f $CTL | ||
70 | + ${SSH} -S $CTL -M -$p -f -F $OBJ/ssh_config -R ${base}01:127.0.0.1:$PORT \ | ||
71 | -oClearAllForwardings=yes somehost sleep 10 | ||
72 | if [ $? != 0 ]; then | ||
73 | fail "connection failed with cleared remote forwarding" | ||
74 | @@ -98,7 +100,7 @@ for p in ${SSH_PROTOCOLS}; do | ||
75 | >>$TEST_REGRESS_LOGFILE 2>&1 && \ | ||
76 | fail "remote forwarding not cleared" | ||
77 | fi | ||
78 | - sleep 10 | ||
79 | + ${SSH} -S $CTL -O exit somehost | ||
80 | done | ||
81 | |||
82 | for p in 2; do | ||
83 | @@ -115,6 +117,7 @@ echo "LocalForward ${base}01 127.0.0.1:$PORT" >> $OBJ/ssh_config | ||
84 | echo "RemoteForward ${base}02 127.0.0.1:${base}01" >> $OBJ/ssh_config | ||
85 | for p in ${SSH_PROTOCOLS}; do | ||
86 | trace "config file: start forwarding, fork to background" | ||
87 | + rm -f $CTL | ||
88 | ${SSH} -S $CTL -M -$p -F $OBJ/ssh_config -f somehost sleep 10 | ||
89 | |||
90 | trace "config file: transfer over forwarded channels and check result" | ||
91 | @@ -129,15 +132,18 @@ done | ||
92 | for p in 2; do | ||
93 | trace "transfer over chained unix domain socket forwards and check result" | ||
94 | rm -f $OBJ/unix-[123].fwd | ||
95 | - ${SSH} -f -F $OBJ/ssh_config -R${base}01:[$OBJ/unix-1.fwd] somehost sleep 10 | ||
96 | - ${SSH} -f -F $OBJ/ssh_config -L[$OBJ/unix-1.fwd]:[$OBJ/unix-2.fwd] somehost sleep 10 | ||
97 | - ${SSH} -f -F $OBJ/ssh_config -R[$OBJ/unix-2.fwd]:[$OBJ/unix-3.fwd] somehost sleep 10 | ||
98 | - ${SSH} -f -F $OBJ/ssh_config -L[$OBJ/unix-3.fwd]:127.0.0.1:$PORT somehost sleep 10 | ||
99 | + rm -f $CTL $CTL.[123] | ||
100 | + ${SSH} -S $CTL -M -f -F $OBJ/ssh_config -R${base}01:[$OBJ/unix-1.fwd] somehost sleep 10 | ||
101 | + ${SSH} -S $CTL.1 -M -f -F $OBJ/ssh_config -L[$OBJ/unix-1.fwd]:[$OBJ/unix-2.fwd] somehost sleep 10 | ||
102 | + ${SSH} -S $CTL.2 -M -f -F $OBJ/ssh_config -R[$OBJ/unix-2.fwd]:[$OBJ/unix-3.fwd] somehost sleep 10 | ||
103 | + ${SSH} -S $CTL.3 -M -f -F $OBJ/ssh_config -L[$OBJ/unix-3.fwd]:127.0.0.1:$PORT somehost sleep 10 | ||
104 | ${SSH} -F $OBJ/ssh_config -p${base}01 -o 'ConnectionAttempts=4' \ | ||
105 | somehost cat ${DATA} > ${COPY} | ||
106 | test -s ${COPY} || fail "failed copy ${DATA}" | ||
107 | cmp ${DATA} ${COPY} || fail "corrupted copy of ${DATA}" | ||
108 | |||
109 | - #wait | ||
110 | - sleep 10 | ||
111 | + ${SSH} -S $CTL -O exit somehost | ||
112 | + ${SSH} -S $CTL.1 -O exit somehost | ||
113 | + ${SSH} -S $CTL.2 -O exit somehost | ||
114 | + ${SSH} -S $CTL.3 -O exit somehost | ||
115 | done | ||
diff --git a/debian/patches/regress-integrity-robust.patch b/debian/patches/regress-integrity-robust.patch new file mode 100644 index 000000000..651a7a88e --- /dev/null +++ b/debian/patches/regress-integrity-robust.patch | |||
@@ -0,0 +1,57 @@ | |||
1 | From 7ce93c802065cd926e7cbfd10e629f3a2d352301 Mon Sep 17 00:00:00 2001 | ||
2 | From: Colin Watson <cjwatson@debian.org> | ||
3 | Date: Sun, 1 Jan 2017 15:21:10 +0000 | ||
4 | Subject: Make integrity tests more robust against timeouts | ||
5 | |||
6 | If the first test in a series for a given MAC happens to modify the low | ||
7 | bytes of a packet length, then ssh will time out and this will be | ||
8 | interpreted as a test failure. Handle this failure mode. | ||
9 | |||
10 | Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=2658 | ||
11 | Patch-Name: regress-integrity-robust.patch | ||
12 | |||
13 | Last-Update: 2017-01-01 | ||
14 | --- | ||
15 | regress/integrity.sh | 9 +++++---- | ||
16 | 1 file changed, 5 insertions(+), 4 deletions(-) | ||
17 | |||
18 | diff --git a/regress/integrity.sh b/regress/integrity.sh | ||
19 | index 39d310de..fd7d58bc 100644 | ||
20 | --- a/regress/integrity.sh | ||
21 | +++ b/regress/integrity.sh | ||
22 | @@ -5,8 +5,6 @@ tid="integrity" | ||
23 | cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak | ||
24 | |||
25 | # start at byte 2900 (i.e. after kex) and corrupt at different offsets | ||
26 | -# XXX the test hangs if we modify the low bytes of the packet length | ||
27 | -# XXX and ssh tries to read... | ||
28 | tries=10 | ||
29 | startoffset=2900 | ||
30 | macs=`${SSH} -Q mac` | ||
31 | @@ -27,6 +25,7 @@ for m in $macs; do | ||
32 | elen=0 | ||
33 | epad=0 | ||
34 | emac=0 | ||
35 | + etmo=0 | ||
36 | ecnt=0 | ||
37 | skip=0 | ||
38 | for off in `jot $tries $startoffset`; do | ||
39 | @@ -61,14 +60,16 @@ for m in $macs; do | ||
40 | Corrupted?MAC* | *message?authentication?code?incorrect*) | ||
41 | emac=`expr $emac + 1`; skip=0;; | ||
42 | padding*) epad=`expr $epad + 1`; skip=0;; | ||
43 | + *Timeout,?server*) | ||
44 | + etmo=`expr $etmo + 1`; skip=0;; | ||
45 | *) fail "unexpected error mac $m at $off: $out";; | ||
46 | esac | ||
47 | done | ||
48 | - verbose "test $tid: $ecnt errors: mac $emac padding $epad length $elen" | ||
49 | + verbose "test $tid: $ecnt errors: mac $emac padding $epad length $elen timeout $etmo" | ||
50 | if [ $emac -eq 0 ]; then | ||
51 | fail "$m: no mac errors" | ||
52 | fi | ||
53 | - expect=`expr $ecnt - $epad - $elen` | ||
54 | + expect=`expr $ecnt - $epad - $elen - $etmo` | ||
55 | if [ $emac -ne $expect ]; then | ||
56 | fail "$m: expected $expect mac errors, got $emac" | ||
57 | fi | ||
diff --git a/debian/patches/regress-mktemp.patch b/debian/patches/regress-mktemp.patch new file mode 100644 index 000000000..f5cfde1e8 --- /dev/null +++ b/debian/patches/regress-mktemp.patch | |||
@@ -0,0 +1,167 @@ | |||
1 | From 6ca09916439a58f0789deb79960ee5defc05a946 Mon Sep 17 00:00:00 2001 | ||
2 | From: Colin Watson <cjwatson@debian.org> | ||
3 | Date: Tue, 3 Jan 2017 12:09:42 +0000 | ||
4 | Subject: Create mux socket for regress in temp directory | ||
5 | |||
6 | In some setups, creating the socket under OBJ may result in a path that | ||
7 | is too long for a Unix domain socket. Add a helper to let us portably | ||
8 | create a temporary directory instead. | ||
9 | |||
10 | Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=2660 | ||
11 | Last-Update: 2017-01-03 | ||
12 | |||
13 | Patch-Name: regress-mktemp.patch | ||
14 | --- | ||
15 | Makefile.in | 5 +++++ | ||
16 | regress/forwarding.sh | 3 ++- | ||
17 | regress/mkdtemp.c | 59 +++++++++++++++++++++++++++++++++++++++++++++++++++ | ||
18 | regress/multiplex.sh | 3 ++- | ||
19 | regress/test-exec.sh | 11 ++++++++++ | ||
20 | 5 files changed, 79 insertions(+), 2 deletions(-) | ||
21 | create mode 100644 regress/mkdtemp.c | ||
22 | |||
23 | diff --git a/Makefile.in b/Makefile.in | ||
24 | index a6eb81ec..a00347e2 100644 | ||
25 | --- a/Makefile.in | ||
26 | +++ b/Makefile.in | ||
27 | @@ -459,6 +459,10 @@ regress/check-perm$(EXEEXT): $(srcdir)/regress/check-perm.c $(REGRESSLIBS) | ||
28 | $(CC) $(CFLAGS) $(CPPFLAGS) -o $@ $(srcdir)/regress/check-perm.c \ | ||
29 | $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS) | ||
30 | |||
31 | +regress/mkdtemp$(EXEEXT): $(srcdir)/regress/mkdtemp.c $(REGRESSLIBS) | ||
32 | + $(CC) $(CFLAGS) $(CPPFLAGS) -o $@ $(srcdir)/regress/mkdtemp.c \ | ||
33 | + $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS) | ||
34 | + | ||
35 | UNITTESTS_TEST_HELPER_OBJS=\ | ||
36 | regress/unittests/test_helper/test_helper.o \ | ||
37 | regress/unittests/test_helper/fuzz.o | ||
38 | @@ -557,6 +561,7 @@ regress-binaries: regress/modpipe$(EXEEXT) \ | ||
39 | regress/setuid-allowed$(EXEEXT) \ | ||
40 | regress/netcat$(EXEEXT) \ | ||
41 | regress/check-perm$(EXEEXT) \ | ||
42 | + regress/mkdtemp$(EXEEXT) \ | ||
43 | regress/unittests/sshbuf/test_sshbuf$(EXEEXT) \ | ||
44 | regress/unittests/sshkey/test_sshkey$(EXEEXT) \ | ||
45 | regress/unittests/bitmap/test_bitmap$(EXEEXT) \ | ||
46 | diff --git a/regress/forwarding.sh b/regress/forwarding.sh | ||
47 | index a1a4b13f..592de7bc 100644 | ||
48 | --- a/regress/forwarding.sh | ||
49 | +++ b/regress/forwarding.sh | ||
50 | @@ -10,7 +10,8 @@ start_sshd | ||
51 | base=33 | ||
52 | last=$PORT | ||
53 | fwd="" | ||
54 | -CTL=$OBJ/ctl-sock | ||
55 | +make_tmpdir | ||
56 | +CTL=$TMP/ctl-sock | ||
57 | |||
58 | for j in 0 1 2; do | ||
59 | for i in 0 1 2; do | ||
60 | diff --git a/regress/mkdtemp.c b/regress/mkdtemp.c | ||
61 | new file mode 100644 | ||
62 | index 00000000..8c7d2e21 | ||
63 | --- /dev/null | ||
64 | +++ b/regress/mkdtemp.c | ||
65 | @@ -0,0 +1,59 @@ | ||
66 | +/* | ||
67 | + * Copyright (c) 2017 Colin Watson <cjwatson@debian.org> | ||
68 | + * | ||
69 | + * Permission to use, copy, modify, and distribute this software for any | ||
70 | + * purpose with or without fee is hereby granted, provided that the above | ||
71 | + * copyright notice and this permission notice appear in all copies. | ||
72 | + * | ||
73 | + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES | ||
74 | + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF | ||
75 | + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR | ||
76 | + * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES | ||
77 | + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN | ||
78 | + * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF | ||
79 | + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. | ||
80 | + */ | ||
81 | + | ||
82 | +/* Roughly equivalent to "mktemp -d -t TEMPLATE", but portable. */ | ||
83 | + | ||
84 | +#include "includes.h" | ||
85 | + | ||
86 | +#include <limits.h> | ||
87 | +#include <stdio.h> | ||
88 | +#include <stdlib.h> | ||
89 | + | ||
90 | +#include "log.h" | ||
91 | + | ||
92 | +static void | ||
93 | +usage(void) | ||
94 | +{ | ||
95 | + fprintf(stderr, "mkdtemp template\n"); | ||
96 | + exit(1); | ||
97 | +} | ||
98 | + | ||
99 | +int | ||
100 | +main(int argc, char **argv) | ||
101 | +{ | ||
102 | + const char *base; | ||
103 | + const char *tmpdir; | ||
104 | + char template[PATH_MAX]; | ||
105 | + int r; | ||
106 | + char *dir; | ||
107 | + | ||
108 | + if (argc != 2) | ||
109 | + usage(); | ||
110 | + base = argv[1]; | ||
111 | + | ||
112 | + if ((tmpdir = getenv("TMPDIR")) == NULL) | ||
113 | + tmpdir = "/tmp"; | ||
114 | + r = snprintf(template, sizeof(template), "%s/%s", tmpdir, base); | ||
115 | + if (r < 0 || (size_t)r >= sizeof(template)) | ||
116 | + fatal("template string too long"); | ||
117 | + dir = mkdtemp(template); | ||
118 | + if (dir == NULL) { | ||
119 | + perror("mkdtemp"); | ||
120 | + exit(1); | ||
121 | + } | ||
122 | + puts(dir); | ||
123 | + return 0; | ||
124 | +} | ||
125 | diff --git a/regress/multiplex.sh b/regress/multiplex.sh | ||
126 | index acb9234d..0ac4065e 100644 | ||
127 | --- a/regress/multiplex.sh | ||
128 | +++ b/regress/multiplex.sh | ||
129 | @@ -1,7 +1,8 @@ | ||
130 | # $OpenBSD: multiplex.sh,v 1.27 2014/12/22 06:14:29 djm Exp $ | ||
131 | # Placed in the Public Domain. | ||
132 | |||
133 | -CTL=/tmp/openssh.regress.ctl-sock.$$ | ||
134 | +make_tmpdir | ||
135 | +CTL=$TMP/ctl-sock | ||
136 | |||
137 | tid="connection multiplexing" | ||
138 | |||
139 | diff --git a/regress/test-exec.sh b/regress/test-exec.sh | ||
140 | index bfa48803..13a8e18f 100644 | ||
141 | --- a/regress/test-exec.sh | ||
142 | +++ b/regress/test-exec.sh | ||
143 | @@ -317,6 +317,14 @@ stop_sshd () | ||
144 | fi | ||
145 | } | ||
146 | |||
147 | +TMP= | ||
148 | + | ||
149 | +make_tmpdir () | ||
150 | +{ | ||
151 | + TMP="$($OBJ/mkdtemp openssh-regress-XXXXXXXXXXXX)" || \ | ||
152 | + fatal "failed to create temporary directory" | ||
153 | +} | ||
154 | + | ||
155 | # helper | ||
156 | cleanup () | ||
157 | { | ||
158 | @@ -327,6 +335,9 @@ cleanup () | ||
159 | kill $SSH_PID | ||
160 | fi | ||
161 | fi | ||
162 | + if [ "x$TMP" != "x" ]; then | ||
163 | + rm -rf "$TMP" | ||
164 | + fi | ||
165 | stop_sshd | ||
166 | } | ||
167 | |||
diff --git a/debian/patches/restore-authorized_keys2.patch b/debian/patches/restore-authorized_keys2.patch new file mode 100644 index 000000000..86da09c7e --- /dev/null +++ b/debian/patches/restore-authorized_keys2.patch | |||
@@ -0,0 +1,35 @@ | |||
1 | From e18d2ba71e6bf009c53e65509da84b712c300471 Mon Sep 17 00:00:00 2001 | ||
2 | From: Colin Watson <cjwatson@debian.org> | ||
3 | Date: Sun, 5 Mar 2017 02:02:11 +0000 | ||
4 | Subject: Restore reading authorized_keys2 by default | ||
5 | |||
6 | Upstream seems to intend to gradually phase this out, so don't assume | ||
7 | that this will remain the default forever. However, we were late in | ||
8 | adopting the upstream sshd_config changes, so it makes sense to extend | ||
9 | the grace period. | ||
10 | |||
11 | Bug-Debian: https://bugs.debian.org/852320 | ||
12 | Forwarded: not-needed | ||
13 | Last-Update: 2017-03-05 | ||
14 | |||
15 | Patch-Name: restore-authorized_keys2.patch | ||
16 | --- | ||
17 | sshd_config | 5 ++--- | ||
18 | 1 file changed, 2 insertions(+), 3 deletions(-) | ||
19 | |||
20 | diff --git a/sshd_config b/sshd_config | ||
21 | index 4aea6c72..bcf3ac17 100644 | ||
22 | --- a/sshd_config | ||
23 | +++ b/sshd_config | ||
24 | @@ -36,9 +36,8 @@ | ||
25 | |||
26 | #PubkeyAuthentication yes | ||
27 | |||
28 | -# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2 | ||
29 | -# but this is overridden so installations will only check .ssh/authorized_keys | ||
30 | -AuthorizedKeysFile .ssh/authorized_keys | ||
31 | +# Expect .ssh/authorized_keys2 to be disregarded by default in future. | ||
32 | +#AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2 | ||
33 | |||
34 | #AuthorizedPrincipalsFile none | ||
35 | |||
diff --git a/debian/patches/restore-tcp-wrappers.patch b/debian/patches/restore-tcp-wrappers.patch new file mode 100644 index 000000000..ec958d3ab --- /dev/null +++ b/debian/patches/restore-tcp-wrappers.patch | |||
@@ -0,0 +1,172 @@ | |||
1 | From 5488e924267d7a845fb86a0b6b4db1e340799a5a Mon Sep 17 00:00:00 2001 | ||
2 | From: Colin Watson <cjwatson@debian.org> | ||
3 | Date: Tue, 7 Oct 2014 13:22:41 +0100 | ||
4 | Subject: Restore TCP wrappers support | ||
5 | |||
6 | Support for TCP wrappers was dropped in OpenSSH 6.7. See this message | ||
7 | and thread: | ||
8 | |||
9 | https://lists.mindrot.org/pipermail/openssh-unix-dev/2014-April/032497.html | ||
10 | |||
11 | It is true that this reduces preauth attack surface in sshd. On the | ||
12 | other hand, this support seems to be quite widely used, and abruptly | ||
13 | dropping it (from the perspective of users who don't read | ||
14 | openssh-unix-dev) could easily cause more serious problems in practice. | ||
15 | |||
16 | It's not entirely clear what the right long-term answer for Debian is, | ||
17 | but it at least probably doesn't involve dropping this feature shortly | ||
18 | before a freeze. | ||
19 | |||
20 | Forwarded: not-needed | ||
21 | Last-Update: 2014-10-07 | ||
22 | |||
23 | Patch-Name: restore-tcp-wrappers.patch | ||
24 | --- | ||
25 | configure.ac | 57 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++ | ||
26 | sshd.8 | 7 +++++++ | ||
27 | sshd.c | 25 +++++++++++++++++++++++++ | ||
28 | 3 files changed, 89 insertions(+) | ||
29 | |||
30 | diff --git a/configure.ac b/configure.ac | ||
31 | index 5fdc696c..4747ce4a 100644 | ||
32 | --- a/configure.ac | ||
33 | +++ b/configure.ac | ||
34 | @@ -1491,6 +1491,62 @@ AC_ARG_WITH([skey], | ||
35 | ] | ||
36 | ) | ||
37 | |||
38 | +# Check whether user wants TCP wrappers support | ||
39 | +TCPW_MSG="no" | ||
40 | +AC_ARG_WITH([tcp-wrappers], | ||
41 | + [ --with-tcp-wrappers[[=PATH]] Enable tcpwrappers support (optionally in PATH)], | ||
42 | + [ | ||
43 | + if test "x$withval" != "xno" ; then | ||
44 | + saved_LIBS="$LIBS" | ||
45 | + saved_LDFLAGS="$LDFLAGS" | ||
46 | + saved_CPPFLAGS="$CPPFLAGS" | ||
47 | + if test -n "${withval}" && \ | ||
48 | + test "x${withval}" != "xyes"; then | ||
49 | + if test -d "${withval}/lib"; then | ||
50 | + if test -n "${need_dash_r}"; then | ||
51 | + LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}" | ||
52 | + else | ||
53 | + LDFLAGS="-L${withval}/lib ${LDFLAGS}" | ||
54 | + fi | ||
55 | + else | ||
56 | + if test -n "${need_dash_r}"; then | ||
57 | + LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}" | ||
58 | + else | ||
59 | + LDFLAGS="-L${withval} ${LDFLAGS}" | ||
60 | + fi | ||
61 | + fi | ||
62 | + if test -d "${withval}/include"; then | ||
63 | + CPPFLAGS="-I${withval}/include ${CPPFLAGS}" | ||
64 | + else | ||
65 | + CPPFLAGS="-I${withval} ${CPPFLAGS}" | ||
66 | + fi | ||
67 | + fi | ||
68 | + LIBS="-lwrap $LIBS" | ||
69 | + AC_MSG_CHECKING([for libwrap]) | ||
70 | + AC_LINK_IFELSE([AC_LANG_PROGRAM([[ | ||
71 | +#include <sys/types.h> | ||
72 | +#include <sys/socket.h> | ||
73 | +#include <netinet/in.h> | ||
74 | +#include <tcpd.h> | ||
75 | +int deny_severity = 0, allow_severity = 0; | ||
76 | + ]], [[ | ||
77 | + hosts_access(0); | ||
78 | + ]])], [ | ||
79 | + AC_MSG_RESULT([yes]) | ||
80 | + AC_DEFINE([LIBWRAP], [1], | ||
81 | + [Define if you want | ||
82 | + TCP Wrappers support]) | ||
83 | + SSHDLIBS="$SSHDLIBS -lwrap" | ||
84 | + TCPW_MSG="yes" | ||
85 | + ], [ | ||
86 | + AC_MSG_ERROR([*** libwrap missing]) | ||
87 | + | ||
88 | + ]) | ||
89 | + LIBS="$saved_LIBS" | ||
90 | + fi | ||
91 | + ] | ||
92 | +) | ||
93 | + | ||
94 | # Check whether user wants to use ldns | ||
95 | LDNS_MSG="no" | ||
96 | AC_ARG_WITH(ldns, | ||
97 | @@ -5105,6 +5161,7 @@ echo " KerberosV support: $KRB5_MSG" | ||
98 | echo " SELinux support: $SELINUX_MSG" | ||
99 | echo " Smartcard support: $SCARD_MSG" | ||
100 | echo " S/KEY support: $SKEY_MSG" | ||
101 | +echo " TCP Wrappers support: $TCPW_MSG" | ||
102 | echo " MD5 password support: $MD5_MSG" | ||
103 | echo " libedit support: $LIBEDIT_MSG" | ||
104 | echo " Solaris process contract support: $SPC_MSG" | ||
105 | diff --git a/sshd.8 b/sshd.8 | ||
106 | index 41fc5051..c6784602 100644 | ||
107 | --- a/sshd.8 | ||
108 | +++ b/sshd.8 | ||
109 | @@ -825,6 +825,12 @@ the user's home directory becomes accessible. | ||
110 | This file should be writable only by the user, and need not be | ||
111 | readable by anyone else. | ||
112 | .Pp | ||
113 | +.It Pa /etc/hosts.allow | ||
114 | +.It Pa /etc/hosts.deny | ||
115 | +Access controls that should be enforced by tcp-wrappers are defined here. | ||
116 | +Further details are described in | ||
117 | +.Xr hosts_access 5 . | ||
118 | +.Pp | ||
119 | .It Pa /etc/hosts.equiv | ||
120 | This file is for host-based authentication (see | ||
121 | .Xr ssh 1 ) . | ||
122 | @@ -929,6 +935,7 @@ The content of this file is not sensitive; it can be world-readable. | ||
123 | .Xr ssh-keygen 1 , | ||
124 | .Xr ssh-keyscan 1 , | ||
125 | .Xr chroot 2 , | ||
126 | +.Xr hosts_access 5 , | ||
127 | .Xr login.conf 5 , | ||
128 | .Xr moduli 5 , | ||
129 | .Xr sshd_config 5 , | ||
130 | diff --git a/sshd.c b/sshd.c | ||
131 | index 0970f297..72d85de1 100644 | ||
132 | --- a/sshd.c | ||
133 | +++ b/sshd.c | ||
134 | @@ -127,6 +127,13 @@ | ||
135 | #include <Security/AuthSession.h> | ||
136 | #endif | ||
137 | |||
138 | +#ifdef LIBWRAP | ||
139 | +#include <tcpd.h> | ||
140 | +#include <syslog.h> | ||
141 | +int allow_severity; | ||
142 | +int deny_severity; | ||
143 | +#endif /* LIBWRAP */ | ||
144 | + | ||
145 | /* Re-exec fds */ | ||
146 | #define REEXEC_DEVCRYPTO_RESERVED_FD (STDERR_FILENO + 1) | ||
147 | #define REEXEC_STARTUP_PIPE_FD (STDERR_FILENO + 2) | ||
148 | @@ -1978,6 +1985,24 @@ main(int ac, char **av) | ||
149 | #ifdef SSH_AUDIT_EVENTS | ||
150 | audit_connection_from(remote_ip, remote_port); | ||
151 | #endif | ||
152 | +#ifdef LIBWRAP | ||
153 | + allow_severity = options.log_facility|LOG_INFO; | ||
154 | + deny_severity = options.log_facility|LOG_WARNING; | ||
155 | + /* Check whether logins are denied from this host. */ | ||
156 | + if (packet_connection_is_on_socket()) { | ||
157 | + struct request_info req; | ||
158 | + | ||
159 | + request_init(&req, RQ_DAEMON, __progname, RQ_FILE, sock_in, 0); | ||
160 | + fromhost(&req); | ||
161 | + | ||
162 | + if (!hosts_access(&req)) { | ||
163 | + debug("Connection refused by tcp wrapper"); | ||
164 | + refuse(&req); | ||
165 | + /* NOTREACHED */ | ||
166 | + fatal("libwrap refuse returns"); | ||
167 | + } | ||
168 | + } | ||
169 | +#endif /* LIBWRAP */ | ||
170 | |||
171 | /* Log the connection. */ | ||
172 | laddr = get_local_ipaddr(sock_in); | ||
diff --git a/debian/patches/sandbox-x32-workaround.patch b/debian/patches/sandbox-x32-workaround.patch new file mode 100644 index 000000000..340363de9 --- /dev/null +++ b/debian/patches/sandbox-x32-workaround.patch | |||
@@ -0,0 +1,37 @@ | |||
1 | From 8c1a0893f0e55a793071af9734d2fa2eb1f3a2a6 Mon Sep 17 00:00:00 2001 | ||
2 | From: Colin Watson <cjwatson@debian.org> | ||
3 | Date: Tue, 3 Jan 2017 14:01:56 +0000 | ||
4 | Subject: Work around clock_gettime kernel bug on Linux x32 | ||
5 | |||
6 | On Linux x32, the clock_gettime VDSO currently falls back to the x86-64 | ||
7 | syscall, so allow that as well as its x32 sibling. | ||
8 | |||
9 | Bug-Debian: https://bugs.debian.org/849923 | ||
10 | Forwarded: no | ||
11 | Last-Update: 2017-01-03 | ||
12 | |||
13 | Patch-Name: sandbox-x32-workaround.patch | ||
14 | --- | ||
15 | sandbox-seccomp-filter.c | 9 +++++++++ | ||
16 | 1 file changed, 9 insertions(+) | ||
17 | |||
18 | diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c | ||
19 | index 2e1ed2c5..62c578d3 100644 | ||
20 | --- a/sandbox-seccomp-filter.c | ||
21 | +++ b/sandbox-seccomp-filter.c | ||
22 | @@ -137,6 +137,15 @@ static const struct sock_filter preauth_insns[] = { | ||
23 | #endif | ||
24 | #ifdef __NR_clock_gettime | ||
25 | SC_ALLOW(clock_gettime), | ||
26 | +# if defined(__x86_64__) && defined(__ILP32__) | ||
27 | + /* On Linux x32, the clock_gettime VDSO currently falls back to the | ||
28 | + * x86-64 syscall (see https://bugs.debian.org/849923), so allow | ||
29 | + * that too. | ||
30 | + */ | ||
31 | + BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, | ||
32 | + __NR_clock_gettime & ~__X32_SYSCALL_BIT, 0, 1), | ||
33 | + BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW), | ||
34 | +# endif | ||
35 | #endif | ||
36 | #ifdef __NR_close | ||
37 | SC_ALLOW(close), | ||
diff --git a/debian/patches/scp-quoting.patch b/debian/patches/scp-quoting.patch new file mode 100644 index 000000000..f318c49fb --- /dev/null +++ b/debian/patches/scp-quoting.patch | |||
@@ -0,0 +1,41 @@ | |||
1 | From cfc11fb9604f8049957a409ff0835f642a047496 Mon Sep 17 00:00:00 2001 | ||
2 | From: =?UTF-8?q?Nicolas=20Valc=C3=A1rcel?= <nvalcarcel@ubuntu.com> | ||
3 | Date: Sun, 9 Feb 2014 16:09:59 +0000 | ||
4 | Subject: Adjust scp quoting in verbose mode | ||
5 | |||
6 | Tweak scp's reporting of filenames in verbose mode to be a bit less | ||
7 | confusing with spaces. | ||
8 | |||
9 | This should be revised to mimic real shell quoting. | ||
10 | |||
11 | Bug-Ubuntu: https://bugs.launchpad.net/bugs/89945 | ||
12 | Last-Update: 2010-02-27 | ||
13 | |||
14 | Patch-Name: scp-quoting.patch | ||
15 | --- | ||
16 | scp.c | 12 ++++++++++-- | ||
17 | 1 file changed, 10 insertions(+), 2 deletions(-) | ||
18 | |||
19 | diff --git a/scp.c b/scp.c | ||
20 | index b4db8519..18c27720 100644 | ||
21 | --- a/scp.c | ||
22 | +++ b/scp.c | ||
23 | @@ -191,8 +191,16 @@ do_local_cmd(arglist *a) | ||
24 | |||
25 | if (verbose_mode) { | ||
26 | fprintf(stderr, "Executing:"); | ||
27 | - for (i = 0; i < a->num; i++) | ||
28 | - fmprintf(stderr, " %s", a->list[i]); | ||
29 | + for (i = 0; i < a->num; i++) { | ||
30 | + if (i == 0) | ||
31 | + fmprintf(stderr, " %s", a->list[i]); | ||
32 | + else | ||
33 | + /* | ||
34 | + * TODO: misbehaves if a->list[i] contains a | ||
35 | + * single quote | ||
36 | + */ | ||
37 | + fmprintf(stderr, " '%s'", a->list[i]); | ||
38 | + } | ||
39 | fprintf(stderr, "\n"); | ||
40 | } | ||
41 | if ((pid = fork()) == -1) | ||
diff --git a/debian/patches/selinux-role.patch b/debian/patches/selinux-role.patch new file mode 100644 index 000000000..98be50fad --- /dev/null +++ b/debian/patches/selinux-role.patch | |||
@@ -0,0 +1,473 @@ | |||
1 | From a01822fe1c50668ef7918dfd28b1c7e88ff16254 Mon Sep 17 00:00:00 2001 | ||
2 | From: Manoj Srivastava <srivasta@debian.org> | ||
3 | Date: Sun, 9 Feb 2014 16:09:49 +0000 | ||
4 | Subject: Handle SELinux authorisation roles | ||
5 | |||
6 | Rejected upstream due to discomfort with magic usernames; a better approach | ||
7 | will need an SSH protocol change. In the meantime, this came from Debian's | ||
8 | SELinux maintainer, so we'll keep it until we have something better. | ||
9 | |||
10 | Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1641 | ||
11 | Bug-Debian: http://bugs.debian.org/394795 | ||
12 | Last-Update: 2015-08-19 | ||
13 | |||
14 | Patch-Name: selinux-role.patch | ||
15 | --- | ||
16 | auth.h | 1 + | ||
17 | auth2.c | 10 ++++++++-- | ||
18 | monitor.c | 32 +++++++++++++++++++++++++++++--- | ||
19 | monitor.h | 2 ++ | ||
20 | monitor_wrap.c | 22 ++++++++++++++++++++-- | ||
21 | monitor_wrap.h | 3 ++- | ||
22 | openbsd-compat/port-linux.c | 27 ++++++++++++++++++++------- | ||
23 | openbsd-compat/port-linux.h | 4 ++-- | ||
24 | platform.c | 4 ++-- | ||
25 | platform.h | 2 +- | ||
26 | session.c | 10 +++++----- | ||
27 | session.h | 2 +- | ||
28 | sshd.c | 2 +- | ||
29 | sshpty.c | 4 ++-- | ||
30 | sshpty.h | 2 +- | ||
31 | 15 files changed, 97 insertions(+), 30 deletions(-) | ||
32 | |||
33 | diff --git a/auth.h b/auth.h | ||
34 | index 338a62da..8c658d16 100644 | ||
35 | --- a/auth.h | ||
36 | +++ b/auth.h | ||
37 | @@ -62,6 +62,7 @@ struct Authctxt { | ||
38 | char *service; | ||
39 | struct passwd *pw; /* set if 'valid' */ | ||
40 | char *style; | ||
41 | + char *role; | ||
42 | void *kbdintctxt; | ||
43 | char *info; /* Extra info for next auth_log */ | ||
44 | #ifdef BSD_AUTH | ||
45 | diff --git a/auth2.c b/auth2.c | ||
46 | index ce0d3760..461311bd 100644 | ||
47 | --- a/auth2.c | ||
48 | +++ b/auth2.c | ||
49 | @@ -216,7 +216,7 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt) | ||
50 | { | ||
51 | Authctxt *authctxt = ctxt; | ||
52 | Authmethod *m = NULL; | ||
53 | - char *user, *service, *method, *style = NULL; | ||
54 | + char *user, *service, *method, *style = NULL, *role = NULL; | ||
55 | int authenticated = 0; | ||
56 | |||
57 | if (authctxt == NULL) | ||
58 | @@ -228,8 +228,13 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt) | ||
59 | debug("userauth-request for user %s service %s method %s", user, service, method); | ||
60 | debug("attempt %d failures %d", authctxt->attempt, authctxt->failures); | ||
61 | |||
62 | + if ((role = strchr(user, '/')) != NULL) | ||
63 | + *role++ = 0; | ||
64 | + | ||
65 | if ((style = strchr(user, ':')) != NULL) | ||
66 | *style++ = 0; | ||
67 | + else if (role && (style = strchr(role, ':')) != NULL) | ||
68 | + *style++ = '\0'; | ||
69 | |||
70 | if (authctxt->attempt++ == 0) { | ||
71 | /* setup auth context */ | ||
72 | @@ -253,8 +258,9 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt) | ||
73 | use_privsep ? " [net]" : ""); | ||
74 | authctxt->service = xstrdup(service); | ||
75 | authctxt->style = style ? xstrdup(style) : NULL; | ||
76 | + authctxt->role = role ? xstrdup(role) : NULL; | ||
77 | if (use_privsep) | ||
78 | - mm_inform_authserv(service, style); | ||
79 | + mm_inform_authserv(service, style, role); | ||
80 | userauth_banner(); | ||
81 | if (auth2_setup_methods_lists(authctxt) != 0) | ||
82 | packet_disconnect("no authentication methods enabled"); | ||
83 | diff --git a/monitor.c b/monitor.c | ||
84 | index 76d9e346..64286a12 100644 | ||
85 | --- a/monitor.c | ||
86 | +++ b/monitor.c | ||
87 | @@ -127,6 +127,7 @@ int mm_answer_sign(int, Buffer *); | ||
88 | int mm_answer_pwnamallow(int, Buffer *); | ||
89 | int mm_answer_auth2_read_banner(int, Buffer *); | ||
90 | int mm_answer_authserv(int, Buffer *); | ||
91 | +int mm_answer_authrole(int, Buffer *); | ||
92 | int mm_answer_authpassword(int, Buffer *); | ||
93 | int mm_answer_bsdauthquery(int, Buffer *); | ||
94 | int mm_answer_bsdauthrespond(int, Buffer *); | ||
95 | @@ -204,6 +205,7 @@ struct mon_table mon_dispatch_proto20[] = { | ||
96 | {MONITOR_REQ_SIGN, MON_ONCE, mm_answer_sign}, | ||
97 | {MONITOR_REQ_PWNAM, MON_ONCE, mm_answer_pwnamallow}, | ||
98 | {MONITOR_REQ_AUTHSERV, MON_ONCE, mm_answer_authserv}, | ||
99 | + {MONITOR_REQ_AUTHROLE, MON_ONCE, mm_answer_authrole}, | ||
100 | {MONITOR_REQ_AUTH2_READ_BANNER, MON_ONCE, mm_answer_auth2_read_banner}, | ||
101 | {MONITOR_REQ_AUTHPASSWORD, MON_AUTH, mm_answer_authpassword}, | ||
102 | #ifdef USE_PAM | ||
103 | @@ -786,6 +788,7 @@ mm_answer_pwnamallow(int sock, Buffer *m) | ||
104 | |||
105 | /* Allow service/style information on the auth context */ | ||
106 | monitor_permit(mon_dispatch, MONITOR_REQ_AUTHSERV, 1); | ||
107 | + monitor_permit(mon_dispatch, MONITOR_REQ_AUTHROLE, 1); | ||
108 | monitor_permit(mon_dispatch, MONITOR_REQ_AUTH2_READ_BANNER, 1); | ||
109 | |||
110 | #ifdef USE_PAM | ||
111 | @@ -816,14 +819,37 @@ mm_answer_authserv(int sock, Buffer *m) | ||
112 | |||
113 | authctxt->service = buffer_get_string(m, NULL); | ||
114 | authctxt->style = buffer_get_string(m, NULL); | ||
115 | - debug3("%s: service=%s, style=%s", | ||
116 | - __func__, authctxt->service, authctxt->style); | ||
117 | + authctxt->role = buffer_get_string(m, NULL); | ||
118 | + debug3("%s: service=%s, style=%s, role=%s", | ||
119 | + __func__, authctxt->service, authctxt->style, authctxt->role); | ||
120 | |||
121 | if (strlen(authctxt->style) == 0) { | ||
122 | free(authctxt->style); | ||
123 | authctxt->style = NULL; | ||
124 | } | ||
125 | |||
126 | + if (strlen(authctxt->role) == 0) { | ||
127 | + free(authctxt->role); | ||
128 | + authctxt->role = NULL; | ||
129 | + } | ||
130 | + | ||
131 | + return (0); | ||
132 | +} | ||
133 | + | ||
134 | +int | ||
135 | +mm_answer_authrole(int sock, Buffer *m) | ||
136 | +{ | ||
137 | + monitor_permit_authentications(1); | ||
138 | + | ||
139 | + authctxt->role = buffer_get_string(m, NULL); | ||
140 | + debug3("%s: role=%s", | ||
141 | + __func__, authctxt->role); | ||
142 | + | ||
143 | + if (strlen(authctxt->role) == 0) { | ||
144 | + free(authctxt->role); | ||
145 | + authctxt->role = NULL; | ||
146 | + } | ||
147 | + | ||
148 | return (0); | ||
149 | } | ||
150 | |||
151 | @@ -1458,7 +1484,7 @@ mm_answer_pty(int sock, Buffer *m) | ||
152 | res = pty_allocate(&s->ptyfd, &s->ttyfd, s->tty, sizeof(s->tty)); | ||
153 | if (res == 0) | ||
154 | goto error; | ||
155 | - pty_setowner(authctxt->pw, s->tty); | ||
156 | + pty_setowner(authctxt->pw, s->tty, authctxt->role); | ||
157 | |||
158 | buffer_put_int(m, 1); | ||
159 | buffer_put_cstring(m, s->tty); | ||
160 | diff --git a/monitor.h b/monitor.h | ||
161 | index ec41404c..4c7955d7 100644 | ||
162 | --- a/monitor.h | ||
163 | +++ b/monitor.h | ||
164 | @@ -68,6 +68,8 @@ enum monitor_reqtype { | ||
165 | MONITOR_REQ_GSSSIGN = 150, MONITOR_ANS_GSSSIGN = 151, | ||
166 | MONITOR_REQ_GSSUPCREDS = 152, MONITOR_ANS_GSSUPCREDS = 153, | ||
167 | |||
168 | + MONITOR_REQ_AUTHROLE = 154, | ||
169 | + | ||
170 | }; | ||
171 | |||
172 | struct monitor { | ||
173 | diff --git a/monitor_wrap.c b/monitor_wrap.c | ||
174 | index d5cb640a..2ff8064a 100644 | ||
175 | --- a/monitor_wrap.c | ||
176 | +++ b/monitor_wrap.c | ||
177 | @@ -327,10 +327,10 @@ mm_auth2_read_banner(void) | ||
178 | return (banner); | ||
179 | } | ||
180 | |||
181 | -/* Inform the privileged process about service and style */ | ||
182 | +/* Inform the privileged process about service, style, and role */ | ||
183 | |||
184 | void | ||
185 | -mm_inform_authserv(char *service, char *style) | ||
186 | +mm_inform_authserv(char *service, char *style, char *role) | ||
187 | { | ||
188 | Buffer m; | ||
189 | |||
190 | @@ -339,12 +339,30 @@ mm_inform_authserv(char *service, char *style) | ||
191 | buffer_init(&m); | ||
192 | buffer_put_cstring(&m, service); | ||
193 | buffer_put_cstring(&m, style ? style : ""); | ||
194 | + buffer_put_cstring(&m, role ? role : ""); | ||
195 | |||
196 | mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUTHSERV, &m); | ||
197 | |||
198 | buffer_free(&m); | ||
199 | } | ||
200 | |||
201 | +/* Inform the privileged process about role */ | ||
202 | + | ||
203 | +void | ||
204 | +mm_inform_authrole(char *role) | ||
205 | +{ | ||
206 | + Buffer m; | ||
207 | + | ||
208 | + debug3("%s entering", __func__); | ||
209 | + | ||
210 | + buffer_init(&m); | ||
211 | + buffer_put_cstring(&m, role ? role : ""); | ||
212 | + | ||
213 | + mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUTHROLE, &m); | ||
214 | + | ||
215 | + buffer_free(&m); | ||
216 | +} | ||
217 | + | ||
218 | /* Do the password authentication */ | ||
219 | int | ||
220 | mm_auth_password(Authctxt *authctxt, char *password) | ||
221 | diff --git a/monitor_wrap.h b/monitor_wrap.h | ||
222 | index 8f9dd896..3e75867c 100644 | ||
223 | --- a/monitor_wrap.h | ||
224 | +++ b/monitor_wrap.h | ||
225 | @@ -41,7 +41,8 @@ void mm_log_handler(LogLevel, const char *, void *); | ||
226 | int mm_is_monitor(void); | ||
227 | DH *mm_choose_dh(int, int, int); | ||
228 | int mm_key_sign(Key *, u_char **, u_int *, const u_char *, u_int, const char *); | ||
229 | -void mm_inform_authserv(char *, char *); | ||
230 | +void mm_inform_authserv(char *, char *, char *); | ||
231 | +void mm_inform_authrole(char *); | ||
232 | struct passwd *mm_getpwnamallow(const char *); | ||
233 | char *mm_auth2_read_banner(void); | ||
234 | int mm_auth_password(struct Authctxt *, char *); | ||
235 | diff --git a/openbsd-compat/port-linux.c b/openbsd-compat/port-linux.c | ||
236 | index e4c5d1b7..e26faf08 100644 | ||
237 | --- a/openbsd-compat/port-linux.c | ||
238 | +++ b/openbsd-compat/port-linux.c | ||
239 | @@ -27,6 +27,12 @@ | ||
240 | #include <string.h> | ||
241 | #include <stdio.h> | ||
242 | |||
243 | +#ifdef WITH_SELINUX | ||
244 | +#include "key.h" | ||
245 | +#include "hostfile.h" | ||
246 | +#include "auth.h" | ||
247 | +#endif | ||
248 | + | ||
249 | #include "log.h" | ||
250 | #include "xmalloc.h" | ||
251 | #include "port-linux.h" | ||
252 | @@ -56,7 +62,7 @@ ssh_selinux_enabled(void) | ||
253 | |||
254 | /* Return the default security context for the given username */ | ||
255 | static security_context_t | ||
256 | -ssh_selinux_getctxbyname(char *pwname) | ||
257 | +ssh_selinux_getctxbyname(char *pwname, const char *role) | ||
258 | { | ||
259 | security_context_t sc = NULL; | ||
260 | char *sename = NULL, *lvl = NULL; | ||
261 | @@ -71,9 +77,16 @@ ssh_selinux_getctxbyname(char *pwname) | ||
262 | #endif | ||
263 | |||
264 | #ifdef HAVE_GET_DEFAULT_CONTEXT_WITH_LEVEL | ||
265 | - r = get_default_context_with_level(sename, lvl, NULL, &sc); | ||
266 | + if (role != NULL && role[0]) | ||
267 | + r = get_default_context_with_rolelevel(sename, role, lvl, NULL, | ||
268 | + &sc); | ||
269 | + else | ||
270 | + r = get_default_context_with_level(sename, lvl, NULL, &sc); | ||
271 | #else | ||
272 | - r = get_default_context(sename, NULL, &sc); | ||
273 | + if (role != NULL && role[0]) | ||
274 | + r = get_default_context_with_role(sename, role, NULL, &sc); | ||
275 | + else | ||
276 | + r = get_default_context(sename, NULL, &sc); | ||
277 | #endif | ||
278 | |||
279 | if (r != 0) { | ||
280 | @@ -103,7 +116,7 @@ ssh_selinux_getctxbyname(char *pwname) | ||
281 | |||
282 | /* Set the execution context to the default for the specified user */ | ||
283 | void | ||
284 | -ssh_selinux_setup_exec_context(char *pwname) | ||
285 | +ssh_selinux_setup_exec_context(char *pwname, const char *role) | ||
286 | { | ||
287 | security_context_t user_ctx = NULL; | ||
288 | |||
289 | @@ -112,7 +125,7 @@ ssh_selinux_setup_exec_context(char *pwname) | ||
290 | |||
291 | debug3("%s: setting execution context", __func__); | ||
292 | |||
293 | - user_ctx = ssh_selinux_getctxbyname(pwname); | ||
294 | + user_ctx = ssh_selinux_getctxbyname(pwname, role); | ||
295 | if (setexeccon(user_ctx) != 0) { | ||
296 | switch (security_getenforce()) { | ||
297 | case -1: | ||
298 | @@ -134,7 +147,7 @@ ssh_selinux_setup_exec_context(char *pwname) | ||
299 | |||
300 | /* Set the TTY context for the specified user */ | ||
301 | void | ||
302 | -ssh_selinux_setup_pty(char *pwname, const char *tty) | ||
303 | +ssh_selinux_setup_pty(char *pwname, const char *tty, const char *role) | ||
304 | { | ||
305 | security_context_t new_tty_ctx = NULL; | ||
306 | security_context_t user_ctx = NULL; | ||
307 | @@ -145,7 +158,7 @@ ssh_selinux_setup_pty(char *pwname, const char *tty) | ||
308 | |||
309 | debug3("%s: setting TTY context on %s", __func__, tty); | ||
310 | |||
311 | - user_ctx = ssh_selinux_getctxbyname(pwname); | ||
312 | + user_ctx = ssh_selinux_getctxbyname(pwname, role); | ||
313 | |||
314 | /* XXX: should these calls fatal() upon failure in enforcing mode? */ | ||
315 | |||
316 | diff --git a/openbsd-compat/port-linux.h b/openbsd-compat/port-linux.h | ||
317 | index 3c22a854..c8812942 100644 | ||
318 | --- a/openbsd-compat/port-linux.h | ||
319 | +++ b/openbsd-compat/port-linux.h | ||
320 | @@ -19,8 +19,8 @@ | ||
321 | |||
322 | #ifdef WITH_SELINUX | ||
323 | int ssh_selinux_enabled(void); | ||
324 | -void ssh_selinux_setup_pty(char *, const char *); | ||
325 | -void ssh_selinux_setup_exec_context(char *); | ||
326 | +void ssh_selinux_setup_pty(char *, const char *, const char *); | ||
327 | +void ssh_selinux_setup_exec_context(char *, const char *); | ||
328 | void ssh_selinux_change_context(const char *); | ||
329 | void ssh_selinux_setfscreatecon(const char *); | ||
330 | #endif | ||
331 | diff --git a/platform.c b/platform.c | ||
332 | index 973a63e4..cd7bf566 100644 | ||
333 | --- a/platform.c | ||
334 | +++ b/platform.c | ||
335 | @@ -143,7 +143,7 @@ platform_setusercontext(struct passwd *pw) | ||
336 | * called if sshd is running as root. | ||
337 | */ | ||
338 | void | ||
339 | -platform_setusercontext_post_groups(struct passwd *pw) | ||
340 | +platform_setusercontext_post_groups(struct passwd *pw, const char *role) | ||
341 | { | ||
342 | #if !defined(HAVE_LOGIN_CAP) && defined(USE_PAM) | ||
343 | /* | ||
344 | @@ -184,7 +184,7 @@ platform_setusercontext_post_groups(struct passwd *pw) | ||
345 | } | ||
346 | #endif /* HAVE_SETPCRED */ | ||
347 | #ifdef WITH_SELINUX | ||
348 | - ssh_selinux_setup_exec_context(pw->pw_name); | ||
349 | + ssh_selinux_setup_exec_context(pw->pw_name, role); | ||
350 | #endif | ||
351 | } | ||
352 | |||
353 | diff --git a/platform.h b/platform.h | ||
354 | index ea4f9c58..60d72ffe 100644 | ||
355 | --- a/platform.h | ||
356 | +++ b/platform.h | ||
357 | @@ -25,7 +25,7 @@ void platform_post_fork_parent(pid_t child_pid); | ||
358 | void platform_post_fork_child(void); | ||
359 | int platform_privileged_uidswap(void); | ||
360 | void platform_setusercontext(struct passwd *); | ||
361 | -void platform_setusercontext_post_groups(struct passwd *); | ||
362 | +void platform_setusercontext_post_groups(struct passwd *, const char *); | ||
363 | char *platform_get_krb5_client(const char *); | ||
364 | char *platform_krb5_get_principal_name(const char *); | ||
365 | int platform_sys_dir_uid(uid_t); | ||
366 | diff --git a/session.c b/session.c | ||
367 | index a08aa69d..ea3871eb 100644 | ||
368 | --- a/session.c | ||
369 | +++ b/session.c | ||
370 | @@ -1325,7 +1325,7 @@ safely_chroot(const char *path, uid_t uid) | ||
371 | |||
372 | /* Set login name, uid, gid, and groups. */ | ||
373 | void | ||
374 | -do_setusercontext(struct passwd *pw) | ||
375 | +do_setusercontext(struct passwd *pw, const char *role) | ||
376 | { | ||
377 | char *chroot_path, *tmp; | ||
378 | |||
379 | @@ -1353,7 +1353,7 @@ do_setusercontext(struct passwd *pw) | ||
380 | endgrent(); | ||
381 | #endif | ||
382 | |||
383 | - platform_setusercontext_post_groups(pw); | ||
384 | + platform_setusercontext_post_groups(pw, role); | ||
385 | |||
386 | if (!in_chroot && options.chroot_directory != NULL && | ||
387 | strcasecmp(options.chroot_directory, "none") != 0) { | ||
388 | @@ -1489,7 +1489,7 @@ do_child(Session *s, const char *command) | ||
389 | |||
390 | /* Force a password change */ | ||
391 | if (s->authctxt->force_pwchange) { | ||
392 | - do_setusercontext(pw); | ||
393 | + do_setusercontext(pw, s->authctxt->role); | ||
394 | child_close_fds(); | ||
395 | do_pwchange(s); | ||
396 | exit(1); | ||
397 | @@ -1511,7 +1511,7 @@ do_child(Session *s, const char *command) | ||
398 | /* When PAM is enabled we rely on it to do the nologin check */ | ||
399 | if (!options.use_pam) | ||
400 | do_nologin(pw); | ||
401 | - do_setusercontext(pw); | ||
402 | + do_setusercontext(pw, s->authctxt->role); | ||
403 | /* | ||
404 | * PAM session modules in do_setusercontext may have | ||
405 | * generated messages, so if this in an interactive | ||
406 | @@ -1903,7 +1903,7 @@ session_pty_req(Session *s) | ||
407 | tty_parse_modes(s->ttyfd, &n_bytes); | ||
408 | |||
409 | if (!use_privsep) | ||
410 | - pty_setowner(s->pw, s->tty); | ||
411 | + pty_setowner(s->pw, s->tty, s->authctxt->role); | ||
412 | |||
413 | /* Set window size from the packet. */ | ||
414 | pty_change_window_size(s->ptyfd, s->row, s->col, s->xpixel, s->ypixel); | ||
415 | diff --git a/session.h b/session.h | ||
416 | index 98e1dafe..0a31dce4 100644 | ||
417 | --- a/session.h | ||
418 | +++ b/session.h | ||
419 | @@ -76,7 +76,7 @@ void session_pty_cleanup2(Session *); | ||
420 | Session *session_new(void); | ||
421 | Session *session_by_tty(char *); | ||
422 | void session_close(Session *); | ||
423 | -void do_setusercontext(struct passwd *); | ||
424 | +void do_setusercontext(struct passwd *, const char *); | ||
425 | void child_set_env(char ***envp, u_int *envsizep, const char *name, | ||
426 | const char *value); | ||
427 | |||
428 | diff --git a/sshd.c b/sshd.c | ||
429 | index 72d85de1..9aab36c3 100644 | ||
430 | --- a/sshd.c | ||
431 | +++ b/sshd.c | ||
432 | @@ -678,7 +678,7 @@ privsep_postauth(Authctxt *authctxt) | ||
433 | reseed_prngs(); | ||
434 | |||
435 | /* Drop privileges */ | ||
436 | - do_setusercontext(authctxt->pw); | ||
437 | + do_setusercontext(authctxt->pw, authctxt->role); | ||
438 | |||
439 | skip: | ||
440 | /* It is safe now to apply the key state */ | ||
441 | diff --git a/sshpty.c b/sshpty.c | ||
442 | index fe2fb5aa..feb22b06 100644 | ||
443 | --- a/sshpty.c | ||
444 | +++ b/sshpty.c | ||
445 | @@ -187,7 +187,7 @@ pty_change_window_size(int ptyfd, u_int row, u_int col, | ||
446 | } | ||
447 | |||
448 | void | ||
449 | -pty_setowner(struct passwd *pw, const char *tty) | ||
450 | +pty_setowner(struct passwd *pw, const char *tty, const char *role) | ||
451 | { | ||
452 | struct group *grp; | ||
453 | gid_t gid; | ||
454 | @@ -209,7 +209,7 @@ pty_setowner(struct passwd *pw, const char *tty) | ||
455 | strerror(errno)); | ||
456 | |||
457 | #ifdef WITH_SELINUX | ||
458 | - ssh_selinux_setup_pty(pw->pw_name, tty); | ||
459 | + ssh_selinux_setup_pty(pw->pw_name, tty, role); | ||
460 | #endif | ||
461 | |||
462 | if (st.st_uid != pw->pw_uid || st.st_gid != gid) { | ||
463 | diff --git a/sshpty.h b/sshpty.h | ||
464 | index 9ec7e9a1..de7e000a 100644 | ||
465 | --- a/sshpty.h | ||
466 | +++ b/sshpty.h | ||
467 | @@ -24,5 +24,5 @@ int pty_allocate(int *, int *, char *, size_t); | ||
468 | void pty_release(const char *); | ||
469 | void pty_make_controlling_tty(int *, const char *); | ||
470 | void pty_change_window_size(int, u_int, u_int, u_int, u_int); | ||
471 | -void pty_setowner(struct passwd *, const char *); | ||
472 | +void pty_setowner(struct passwd *, const char *, const char *); | ||
473 | void disconnect_controlling_tty(void); | ||
diff --git a/debian/patches/series b/debian/patches/series new file mode 100644 index 000000000..c5fc81486 --- /dev/null +++ b/debian/patches/series | |||
@@ -0,0 +1,36 @@ | |||
1 | gssapi.patch | ||
2 | restore-tcp-wrappers.patch | ||
3 | selinux-role.patch | ||
4 | ssh-vulnkey-compat.patch | ||
5 | keepalive-extensions.patch | ||
6 | syslog-level-silent.patch | ||
7 | quieter-signals.patch | ||
8 | user-group-modes.patch | ||
9 | scp-quoting.patch | ||
10 | shell-path.patch | ||
11 | dnssec-sshfp.patch | ||
12 | auth-log-verbosity.patch | ||
13 | mention-ssh-keygen-on-keychange.patch | ||
14 | package-versioning.patch | ||
15 | debian-banner.patch | ||
16 | authorized-keys-man-symlink.patch | ||
17 | openbsd-docs.patch | ||
18 | ssh-argv0.patch | ||
19 | doc-hash-tab-completion.patch | ||
20 | doc-upstart.patch | ||
21 | ssh-agent-setgid.patch | ||
22 | no-openssl-version-status.patch | ||
23 | gnome-ssh-askpass2-icon.patch | ||
24 | sigstop.patch | ||
25 | systemd-readiness.patch | ||
26 | debian-config.patch | ||
27 | regress-integrity-robust.patch | ||
28 | regress-forwarding-race.patch | ||
29 | regress-mktemp.patch | ||
30 | sandbox-x32-workaround.patch | ||
31 | no-dsa-host-key-by-default.patch | ||
32 | restore-authorized_keys2.patch | ||
33 | ssh-keygen-hash-corruption.patch | ||
34 | ssh-keyscan-hash-port.patch | ||
35 | ssh-keygen-null-deref.patch | ||
36 | unbreak-unix-forwarding-for-root.patch | ||
diff --git a/debian/patches/shell-path.patch b/debian/patches/shell-path.patch new file mode 100644 index 000000000..c263dd7f1 --- /dev/null +++ b/debian/patches/shell-path.patch | |||
@@ -0,0 +1,39 @@ | |||
1 | From 5ec0d5f79166a7e2aeab5c7f13d64bb08c4621bd Mon Sep 17 00:00:00 2001 | ||
2 | From: Colin Watson <cjwatson@debian.org> | ||
3 | Date: Sun, 9 Feb 2014 16:10:00 +0000 | ||
4 | Subject: Look for $SHELL on the path for ProxyCommand/LocalCommand | ||
5 | |||
6 | There's some debate on the upstream bug about whether POSIX requires this. | ||
7 | I (Colin Watson) agree with Vincent and think it does. | ||
8 | |||
9 | Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1494 | ||
10 | Bug-Debian: http://bugs.debian.org/492728 | ||
11 | Last-Update: 2013-09-14 | ||
12 | |||
13 | Patch-Name: shell-path.patch | ||
14 | --- | ||
15 | sshconnect.c | 4 ++-- | ||
16 | 1 file changed, 2 insertions(+), 2 deletions(-) | ||
17 | |||
18 | diff --git a/sshconnect.c b/sshconnect.c | ||
19 | index 96b91ce1..698a0711 100644 | ||
20 | --- a/sshconnect.c | ||
21 | +++ b/sshconnect.c | ||
22 | @@ -231,7 +231,7 @@ ssh_proxy_connect(const char *host, u_short port, const char *proxy_command) | ||
23 | /* Execute the proxy command. Note that we gave up any | ||
24 | extra privileges above. */ | ||
25 | signal(SIGPIPE, SIG_DFL); | ||
26 | - execv(argv[0], argv); | ||
27 | + execvp(argv[0], argv); | ||
28 | perror(argv[0]); | ||
29 | exit(1); | ||
30 | } | ||
31 | @@ -1498,7 +1498,7 @@ ssh_local_cmd(const char *args) | ||
32 | if (pid == 0) { | ||
33 | signal(SIGPIPE, SIG_DFL); | ||
34 | debug3("Executing %s -c \"%s\"", shell, args); | ||
35 | - execl(shell, shell, "-c", args, (char *)NULL); | ||
36 | + execlp(shell, shell, "-c", args, (char *)NULL); | ||
37 | error("Couldn't execute %s -c \"%s\": %s", | ||
38 | shell, args, strerror(errno)); | ||
39 | _exit(1); | ||
diff --git a/debian/patches/sigstop.patch b/debian/patches/sigstop.patch new file mode 100644 index 000000000..fa4d0a8cc --- /dev/null +++ b/debian/patches/sigstop.patch | |||
@@ -0,0 +1,35 @@ | |||
1 | From 218ecbc433b69b8584000380626a9d9aa31c095b Mon Sep 17 00:00:00 2001 | ||
2 | From: Colin Watson <cjwatson@debian.org> | ||
3 | Date: Sun, 9 Feb 2014 16:10:17 +0000 | ||
4 | Subject: Support synchronisation with service supervisor using SIGSTOP | ||
5 | |||
6 | Author: Robie Basak <robie.basak@ubuntu.com> | ||
7 | Forwarded: no | ||
8 | Last-Update: 2014-04-14 | ||
9 | |||
10 | Patch-Name: sigstop.patch | ||
11 | --- | ||
12 | sshd.c | 10 ++++++++++ | ||
13 | 1 file changed, 10 insertions(+) | ||
14 | |||
15 | diff --git a/sshd.c b/sshd.c | ||
16 | index eebf1984..b6826c84 100644 | ||
17 | --- a/sshd.c | ||
18 | +++ b/sshd.c | ||
19 | @@ -1878,6 +1878,16 @@ main(int ac, char **av) | ||
20 | } | ||
21 | } | ||
22 | |||
23 | + if (getenv("SSH_SIGSTOP")) { | ||
24 | + /* Tell service supervisor that we are ready. */ | ||
25 | + kill(getpid(), SIGSTOP); | ||
26 | + /* The service supervisor only ever expects a single | ||
27 | + * STOP signal, so do not ever signal it again, even | ||
28 | + * in the case of a re-exec or future children. | ||
29 | + */ | ||
30 | + unsetenv("SSH_SIGSTOP"); | ||
31 | + } | ||
32 | + | ||
33 | /* Accept a connection and return in a forked child */ | ||
34 | server_accept_loop(&sock_in, &sock_out, | ||
35 | &newsock, config_s); | ||
diff --git a/debian/patches/ssh-agent-setgid.patch b/debian/patches/ssh-agent-setgid.patch new file mode 100644 index 000000000..b14ec01d4 --- /dev/null +++ b/debian/patches/ssh-agent-setgid.patch | |||
@@ -0,0 +1,40 @@ | |||
1 | From 0ae30d0171b789953318670ac8679127ddfb3cd1 Mon Sep 17 00:00:00 2001 | ||
2 | From: Colin Watson <cjwatson@debian.org> | ||
3 | Date: Sun, 9 Feb 2014 16:10:13 +0000 | ||
4 | Subject: Document consequences of ssh-agent being setgid in ssh-agent(1) | ||
5 | |||
6 | Bug-Debian: http://bugs.debian.org/711623 | ||
7 | Forwarded: no | ||
8 | Last-Update: 2013-06-08 | ||
9 | |||
10 | Patch-Name: ssh-agent-setgid.patch | ||
11 | --- | ||
12 | ssh-agent.1 | 15 +++++++++++++++ | ||
13 | 1 file changed, 15 insertions(+) | ||
14 | |||
15 | diff --git a/ssh-agent.1 b/ssh-agent.1 | ||
16 | index 83b2b41c..7230704a 100644 | ||
17 | --- a/ssh-agent.1 | ||
18 | +++ b/ssh-agent.1 | ||
19 | @@ -206,6 +206,21 @@ environment variable holds the agent's process ID. | ||
20 | .Pp | ||
21 | The agent exits automatically when the command given on the command | ||
22 | line terminates. | ||
23 | +.Pp | ||
24 | +In Debian, | ||
25 | +.Nm | ||
26 | +is installed with the set-group-id bit set, to prevent | ||
27 | +.Xr ptrace 2 | ||
28 | +attacks retrieving private key material. | ||
29 | +This has the side-effect of causing the run-time linker to remove certain | ||
30 | +environment variables which might have security implications for set-id | ||
31 | +programs, including | ||
32 | +.Ev LD_PRELOAD , | ||
33 | +.Ev LD_LIBRARY_PATH , | ||
34 | +and | ||
35 | +.Ev TMPDIR . | ||
36 | +If you need to set any of these environment variables, you will need to do | ||
37 | +so in the program executed by ssh-agent. | ||
38 | .Sh FILES | ||
39 | .Bl -tag -width Ds | ||
40 | .It Pa $TMPDIR/ssh-XXXXXXXXXX/agent.<ppid> | ||
diff --git a/debian/patches/ssh-argv0.patch b/debian/patches/ssh-argv0.patch new file mode 100644 index 000000000..7fbaa25dd --- /dev/null +++ b/debian/patches/ssh-argv0.patch | |||
@@ -0,0 +1,31 @@ | |||
1 | From e39339d49d1b05e1db45c6420d7e6da29cf483dc Mon Sep 17 00:00:00 2001 | ||
2 | From: Colin Watson <cjwatson@debian.org> | ||
3 | Date: Sun, 9 Feb 2014 16:10:10 +0000 | ||
4 | Subject: ssh(1): Refer to ssh-argv0(1) | ||
5 | |||
6 | Old versions of OpenSSH (up to 2.5 or thereabouts) allowed creating symlinks | ||
7 | to ssh with the name of the host you want to connect to. Debian ships an | ||
8 | ssh-argv0 script restoring this feature; this patch refers to its manual | ||
9 | page from ssh(1). | ||
10 | |||
11 | Bug-Debian: http://bugs.debian.org/111341 | ||
12 | Forwarded: not-needed | ||
13 | Last-Update: 2013-09-14 | ||
14 | |||
15 | Patch-Name: ssh-argv0.patch | ||
16 | --- | ||
17 | ssh.1 | 1 + | ||
18 | 1 file changed, 1 insertion(+) | ||
19 | |||
20 | diff --git a/ssh.1 b/ssh.1 | ||
21 | index b1f128c2..22e56a7b 100644 | ||
22 | --- a/ssh.1 | ||
23 | +++ b/ssh.1 | ||
24 | @@ -1586,6 +1586,7 @@ if an error occurred. | ||
25 | .Xr sftp 1 , | ||
26 | .Xr ssh-add 1 , | ||
27 | .Xr ssh-agent 1 , | ||
28 | +.Xr ssh-argv0 1 , | ||
29 | .Xr ssh-keygen 1 , | ||
30 | .Xr ssh-keyscan 1 , | ||
31 | .Xr tun 4 , | ||
diff --git a/debian/patches/ssh-keygen-hash-corruption.patch b/debian/patches/ssh-keygen-hash-corruption.patch new file mode 100644 index 000000000..7ef3c637c --- /dev/null +++ b/debian/patches/ssh-keygen-hash-corruption.patch | |||
@@ -0,0 +1,44 @@ | |||
1 | From 78800aa252da1ebbfb55f7e593f43c337e694cc3 Mon Sep 17 00:00:00 2001 | ||
2 | From: "djm@openbsd.org" <djm@openbsd.org> | ||
3 | Date: Fri, 3 Mar 2017 06:13:11 +0000 | ||
4 | Subject: upstream commit | ||
5 | |||
6 | fix ssh-keygen -H accidentally corrupting known_hosts that | ||
7 | contained already-hashed entries. HKF_MATCH_HOST_HASHED is only set by | ||
8 | hostkeys_foreach() when hostname matching is in use, so we need to look for | ||
9 | the hash marker explicitly. | ||
10 | |||
11 | Upstream-ID: da82ad653b93e8a753580d3cf5cd448bc2520528 | ||
12 | |||
13 | Origin: https://anongit.mindrot.org/openssh.git/commit/?id=12d3767ba4c84c32150cbe6ff6494498780f12c9 | ||
14 | Bug-Debian: https://bugs.debian.org/851734 | ||
15 | Bug-Ubuntu: https://bugs.launchpad.net/bugs/1668093 | ||
16 | Last-Update: 2017-03-09 | ||
17 | |||
18 | Patch-Name: ssh-keygen-hash-corruption.patch | ||
19 | --- | ||
20 | ssh-keygen.c | 4 ++-- | ||
21 | 1 file changed, 2 insertions(+), 2 deletions(-) | ||
22 | |||
23 | diff --git a/ssh-keygen.c b/ssh-keygen.c | ||
24 | index 2a7939bf..0833ee61 100644 | ||
25 | --- a/ssh-keygen.c | ||
26 | +++ b/ssh-keygen.c | ||
27 | @@ -1082,6 +1082,7 @@ known_hosts_hash(struct hostkey_foreach_line *l, void *_ctx) | ||
28 | struct known_hosts_ctx *ctx = (struct known_hosts_ctx *)_ctx; | ||
29 | char *hashed, *cp, *hosts, *ohosts; | ||
30 | int has_wild = l->hosts && strcspn(l->hosts, "*?!") != strlen(l->hosts); | ||
31 | + int was_hashed = l->hosts[0] == HASH_DELIM; | ||
32 | |||
33 | switch (l->status) { | ||
34 | case HKF_STATUS_OK: | ||
35 | @@ -1090,8 +1091,7 @@ known_hosts_hash(struct hostkey_foreach_line *l, void *_ctx) | ||
36 | * Don't hash hosts already already hashed, with wildcard | ||
37 | * characters or a CA/revocation marker. | ||
38 | */ | ||
39 | - if ((l->match & HKF_MATCH_HOST_HASHED) != 0 || | ||
40 | - has_wild || l->marker != MRK_NONE) { | ||
41 | + if (was_hashed || has_wild || l->marker != MRK_NONE) { | ||
42 | fprintf(ctx->out, "%s\n", l->line); | ||
43 | if (has_wild && !find_host) { | ||
44 | logit("%s:%ld: ignoring host name " | ||
diff --git a/debian/patches/ssh-keygen-null-deref.patch b/debian/patches/ssh-keygen-null-deref.patch new file mode 100644 index 000000000..0220d7c66 --- /dev/null +++ b/debian/patches/ssh-keygen-null-deref.patch | |||
@@ -0,0 +1,31 @@ | |||
1 | From 35b2ea77a74348b575d680061f35ec7992b26ec8 Mon Sep 17 00:00:00 2001 | ||
2 | From: "dtucker@openbsd.org" <dtucker@openbsd.org> | ||
3 | Date: Mon, 6 Mar 2017 02:03:20 +0000 | ||
4 | Subject: upstream commit | ||
5 | |||
6 | Check l->hosts before dereferencing; fixes potential null | ||
7 | pointer deref. ok djm@ | ||
8 | |||
9 | Upstream-ID: 81c0327c6ec361da794b5c680601195cc23d1301 | ||
10 | |||
11 | Origin: https://anongit.mindrot.org/openssh.git/commit/?id=18501151cf272a15b5f2c5e777f2e0933633c513 | ||
12 | Last-Update: 2017-03-16 | ||
13 | |||
14 | Patch-Name: ssh-keygen-null-deref.patch | ||
15 | --- | ||
16 | ssh-keygen.c | 2 +- | ||
17 | 1 file changed, 1 insertion(+), 1 deletion(-) | ||
18 | |||
19 | diff --git a/ssh-keygen.c b/ssh-keygen.c | ||
20 | index 0833ee61..a7c1e80b 100644 | ||
21 | --- a/ssh-keygen.c | ||
22 | +++ b/ssh-keygen.c | ||
23 | @@ -1082,7 +1082,7 @@ known_hosts_hash(struct hostkey_foreach_line *l, void *_ctx) | ||
24 | struct known_hosts_ctx *ctx = (struct known_hosts_ctx *)_ctx; | ||
25 | char *hashed, *cp, *hosts, *ohosts; | ||
26 | int has_wild = l->hosts && strcspn(l->hosts, "*?!") != strlen(l->hosts); | ||
27 | - int was_hashed = l->hosts[0] == HASH_DELIM; | ||
28 | + int was_hashed = l->hosts && l->hosts[0] == HASH_DELIM; | ||
29 | |||
30 | switch (l->status) { | ||
31 | case HKF_STATUS_OK: | ||
diff --git a/debian/patches/ssh-keyscan-hash-port.patch b/debian/patches/ssh-keyscan-hash-port.patch new file mode 100644 index 000000000..32a2f6a01 --- /dev/null +++ b/debian/patches/ssh-keyscan-hash-port.patch | |||
@@ -0,0 +1,48 @@ | |||
1 | From a0f9daa9c3cc2b37b9707b228263eb717d201371 Mon Sep 17 00:00:00 2001 | ||
2 | From: "djm@openbsd.org" <djm@openbsd.org> | ||
3 | Date: Fri, 10 Mar 2017 03:18:24 +0000 | ||
4 | Subject: upstream commit | ||
5 | |||
6 | correctly hash hosts with a port number. Reported by Josh | ||
7 | Powers in bz#2692; ok dtucker@ | ||
8 | |||
9 | Upstream-ID: 468e357ff143e00acc05bdd2803a696b3d4b6442 | ||
10 | |||
11 | Origin: https://anongit.mindrot.org/openssh.git/commit/?id=8a2834454c73dfc1eb96453c0e97690595f3f4c2 | ||
12 | Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=2692 | ||
13 | Bug-Debian: https://bugs.debian.org/857736 | ||
14 | Bug-Ubuntu: https://bugs.launchpad.net/bugs/1670745 | ||
15 | Last-Update: 2017-03-14 | ||
16 | |||
17 | Patch-Name: ssh-keyscan-hash-port.patch | ||
18 | --- | ||
19 | ssh-keyscan.c | 11 ++++++----- | ||
20 | 1 file changed, 6 insertions(+), 5 deletions(-) | ||
21 | |||
22 | diff --git a/ssh-keyscan.c b/ssh-keyscan.c | ||
23 | index c30d54e6..24b51ff1 100644 | ||
24 | --- a/ssh-keyscan.c | ||
25 | +++ b/ssh-keyscan.c | ||
26 | @@ -321,16 +321,17 @@ keygrab_ssh2(con *c) | ||
27 | } | ||
28 | |||
29 | static void | ||
30 | -keyprint_one(char *host, struct sshkey *key) | ||
31 | +keyprint_one(const char *host, struct sshkey *key) | ||
32 | { | ||
33 | char *hostport; | ||
34 | - | ||
35 | - if (hash_hosts && (host = host_hash(host, NULL, 0)) == NULL) | ||
36 | - fatal("host_hash failed"); | ||
37 | + const char *known_host, *hashed; | ||
38 | |||
39 | hostport = put_host_port(host, ssh_port); | ||
40 | + if (hash_hosts && (hashed = host_hash(host, NULL, 0)) == NULL) | ||
41 | + fatal("host_hash failed"); | ||
42 | + known_host = hash_hosts ? hashed : hostport; | ||
43 | if (!get_cert) | ||
44 | - fprintf(stdout, "%s ", hostport); | ||
45 | + fprintf(stdout, "%s ", known_host); | ||
46 | sshkey_write(key, stdout); | ||
47 | fputs("\n", stdout); | ||
48 | free(hostport); | ||
diff --git a/debian/patches/ssh-vulnkey-compat.patch b/debian/patches/ssh-vulnkey-compat.patch new file mode 100644 index 000000000..fbe64336b --- /dev/null +++ b/debian/patches/ssh-vulnkey-compat.patch | |||
@@ -0,0 +1,42 @@ | |||
1 | From ffecece153b7caedf997dccf17747633675631fd Mon Sep 17 00:00:00 2001 | ||
2 | From: Colin Watson <cjwatson@ubuntu.com> | ||
3 | Date: Sun, 9 Feb 2014 16:09:50 +0000 | ||
4 | Subject: Accept obsolete ssh-vulnkey configuration options | ||
5 | |||
6 | These options were used as part of Debian's response to CVE-2008-0166. | ||
7 | Nearly six years later, we no longer need to continue carrying the bulk | ||
8 | of that patch, but we do need to avoid failing when the associated | ||
9 | configuration options are still present. | ||
10 | |||
11 | Last-Update: 2014-02-09 | ||
12 | |||
13 | Patch-Name: ssh-vulnkey-compat.patch | ||
14 | --- | ||
15 | readconf.c | 1 + | ||
16 | servconf.c | 1 + | ||
17 | 2 files changed, 2 insertions(+) | ||
18 | |||
19 | diff --git a/readconf.c b/readconf.c | ||
20 | index 7902ef26..c1c3aae0 100644 | ||
21 | --- a/readconf.c | ||
22 | +++ b/readconf.c | ||
23 | @@ -194,6 +194,7 @@ static struct { | ||
24 | { "passwordauthentication", oPasswordAuthentication }, | ||
25 | { "kbdinteractiveauthentication", oKbdInteractiveAuthentication }, | ||
26 | { "kbdinteractivedevices", oKbdInteractiveDevices }, | ||
27 | + { "useblacklistedkeys", oDeprecated }, | ||
28 | { "rsaauthentication", oRSAAuthentication }, | ||
29 | { "pubkeyauthentication", oPubkeyAuthentication }, | ||
30 | { "dsaauthentication", oPubkeyAuthentication }, /* alias */ | ||
31 | diff --git a/servconf.c b/servconf.c | ||
32 | index 14c81fa9..49d3bdc8 100644 | ||
33 | --- a/servconf.c | ||
34 | +++ b/servconf.c | ||
35 | @@ -521,6 +521,7 @@ static struct { | ||
36 | { "x11uselocalhost", sX11UseLocalhost, SSHCFG_ALL }, | ||
37 | { "xauthlocation", sXAuthLocation, SSHCFG_GLOBAL }, | ||
38 | { "strictmodes", sStrictModes, SSHCFG_GLOBAL }, | ||
39 | + { "permitblacklistedkeys", sDeprecated, SSHCFG_GLOBAL }, | ||
40 | { "permitemptypasswords", sEmptyPasswd, SSHCFG_ALL }, | ||
41 | { "permituserenvironment", sPermitUserEnvironment, SSHCFG_GLOBAL }, | ||
42 | { "uselogin", sDeprecated, SSHCFG_GLOBAL }, | ||
diff --git a/debian/patches/syslog-level-silent.patch b/debian/patches/syslog-level-silent.patch new file mode 100644 index 000000000..7a4839c03 --- /dev/null +++ b/debian/patches/syslog-level-silent.patch | |||
@@ -0,0 +1,47 @@ | |||
1 | From f4d9efefeae948e1e00212bf9702245c3c51c8c5 Mon Sep 17 00:00:00 2001 | ||
2 | From: Jonathan David Amery <jdamery@ysolde.ucam.org> | ||
3 | Date: Sun, 9 Feb 2014 16:09:54 +0000 | ||
4 | Subject: "LogLevel SILENT" compatibility | ||
5 | |||
6 | "LogLevel SILENT" (-qq) was introduced in Debian openssh 1:3.0.1p1-1 to | ||
7 | match the behaviour of non-free SSH, in which -q does not suppress fatal | ||
8 | errors. However, this was unintentionally broken in 1:4.6p1-2 and nobody | ||
9 | complained, so we've dropped most of it. The parts that remain are basic | ||
10 | configuration file compatibility, and an adjustment to "Pseudo-terminal will | ||
11 | not be allocated ..." which should be split out into a separate patch. | ||
12 | |||
13 | Author: Matthew Vernon <matthew@debian.org> | ||
14 | Author: Colin Watson <cjwatson@debian.org> | ||
15 | Last-Update: 2013-09-14 | ||
16 | |||
17 | Patch-Name: syslog-level-silent.patch | ||
18 | --- | ||
19 | log.c | 1 + | ||
20 | ssh.c | 2 +- | ||
21 | 2 files changed, 2 insertions(+), 1 deletion(-) | ||
22 | |||
23 | diff --git a/log.c b/log.c | ||
24 | index 2b59c427..ffc8ffbb 100644 | ||
25 | --- a/log.c | ||
26 | +++ b/log.c | ||
27 | @@ -93,6 +93,7 @@ static struct { | ||
28 | LogLevel val; | ||
29 | } log_levels[] = | ||
30 | { | ||
31 | + { "SILENT", SYSLOG_LEVEL_QUIET }, /* compatibility */ | ||
32 | { "QUIET", SYSLOG_LEVEL_QUIET }, | ||
33 | { "FATAL", SYSLOG_LEVEL_FATAL }, | ||
34 | { "ERROR", SYSLOG_LEVEL_ERROR }, | ||
35 | diff --git a/ssh.c b/ssh.c | ||
36 | index ee0b16dc..39609e79 100644 | ||
37 | --- a/ssh.c | ||
38 | +++ b/ssh.c | ||
39 | @@ -1167,7 +1167,7 @@ main(int ac, char **av) | ||
40 | /* Do not allocate a tty if stdin is not a tty. */ | ||
41 | if ((!isatty(fileno(stdin)) || stdin_null_flag) && | ||
42 | options.request_tty != REQUEST_TTY_FORCE) { | ||
43 | - if (tty_flag) | ||
44 | + if (tty_flag && options.log_level != SYSLOG_LEVEL_QUIET) | ||
45 | logit("Pseudo-terminal will not be allocated because " | ||
46 | "stdin is not a terminal."); | ||
47 | tty_flag = 0; | ||
diff --git a/debian/patches/systemd-readiness.patch b/debian/patches/systemd-readiness.patch new file mode 100644 index 000000000..6c8cf9b6d --- /dev/null +++ b/debian/patches/systemd-readiness.patch | |||
@@ -0,0 +1,84 @@ | |||
1 | From 0fd4134a3ef467e1e69db5b19b7903cf306ec64b Mon Sep 17 00:00:00 2001 | ||
2 | From: Michael Biebl <biebl@debian.org> | ||
3 | Date: Mon, 21 Dec 2015 16:08:47 +0000 | ||
4 | Subject: Add systemd readiness notification support | ||
5 | |||
6 | Bug-Debian: https://bugs.debian.org/778913 | ||
7 | Forwarded: no | ||
8 | Last-Update: 2016-01-04 | ||
9 | |||
10 | Patch-Name: systemd-readiness.patch | ||
11 | --- | ||
12 | configure.ac | 24 ++++++++++++++++++++++++ | ||
13 | sshd.c | 9 +++++++++ | ||
14 | 2 files changed, 33 insertions(+) | ||
15 | |||
16 | diff --git a/configure.ac b/configure.ac | ||
17 | index 4747ce4a..9f59794b 100644 | ||
18 | --- a/configure.ac | ||
19 | +++ b/configure.ac | ||
20 | @@ -4364,6 +4364,29 @@ AC_ARG_WITH([kerberos5], | ||
21 | AC_SUBST([GSSLIBS]) | ||
22 | AC_SUBST([K5LIBS]) | ||
23 | |||
24 | +# Check whether user wants systemd support | ||
25 | +SYSTEMD_MSG="no" | ||
26 | +AC_ARG_WITH(systemd, | ||
27 | + [ --with-systemd Enable systemd support], | ||
28 | + [ if test "x$withval" != "xno" ; then | ||
29 | + AC_PATH_TOOL([PKGCONFIG], [pkg-config], [no]) | ||
30 | + if test "$PKGCONFIG" != "no"; then | ||
31 | + AC_MSG_CHECKING([for libsystemd]) | ||
32 | + if $PKGCONFIG --exists libsystemd; then | ||
33 | + SYSTEMD_CFLAGS=`$PKGCONFIG --cflags libsystemd` | ||
34 | + SYSTEMD_LIBS=`$PKGCONFIG --libs libsystemd` | ||
35 | + CPPFLAGS="$CPPFLAGS $SYSTEMD_CFLAGS" | ||
36 | + SSHDLIBS="$SSHDLIBS $SYSTEMD_LIBS" | ||
37 | + AC_MSG_RESULT([yes]) | ||
38 | + AC_DEFINE(HAVE_SYSTEMD, 1, [Define if you want systemd support.]) | ||
39 | + SYSTEMD_MSG="yes" | ||
40 | + else | ||
41 | + AC_MSG_RESULT([no]) | ||
42 | + fi | ||
43 | + fi | ||
44 | + fi ] | ||
45 | +) | ||
46 | + | ||
47 | # Looking for programs, paths and files | ||
48 | |||
49 | PRIVSEP_PATH=/var/empty | ||
50 | @@ -5167,6 +5190,7 @@ echo " libedit support: $LIBEDIT_MSG" | ||
51 | echo " Solaris process contract support: $SPC_MSG" | ||
52 | echo " Solaris project support: $SP_MSG" | ||
53 | echo " Solaris privilege support: $SPP_MSG" | ||
54 | +echo " systemd support: $SYSTEMD_MSG" | ||
55 | echo " IP address in \$DISPLAY hack: $DISPLAY_HACK_MSG" | ||
56 | echo " Translate v4 in v6 hack: $IPV4_IN6_HACK_MSG" | ||
57 | echo " BSD Auth support: $BSD_AUTH_MSG" | ||
58 | diff --git a/sshd.c b/sshd.c | ||
59 | index b6826c84..027daa9d 100644 | ||
60 | --- a/sshd.c | ||
61 | +++ b/sshd.c | ||
62 | @@ -85,6 +85,10 @@ | ||
63 | #include <prot.h> | ||
64 | #endif | ||
65 | |||
66 | +#ifdef HAVE_SYSTEMD | ||
67 | +#include <systemd/sd-daemon.h> | ||
68 | +#endif | ||
69 | + | ||
70 | #include "xmalloc.h" | ||
71 | #include "ssh.h" | ||
72 | #include "ssh2.h" | ||
73 | @@ -1888,6 +1892,11 @@ main(int ac, char **av) | ||
74 | unsetenv("SSH_SIGSTOP"); | ||
75 | } | ||
76 | |||
77 | +#ifdef HAVE_SYSTEMD | ||
78 | + /* Signal systemd that we are ready to accept connections */ | ||
79 | + sd_notify(0, "READY=1"); | ||
80 | +#endif | ||
81 | + | ||
82 | /* Accept a connection and return in a forked child */ | ||
83 | server_accept_loop(&sock_in, &sock_out, | ||
84 | &newsock, config_s); | ||
diff --git a/debian/patches/unbreak-unix-forwarding-for-root.patch b/debian/patches/unbreak-unix-forwarding-for-root.patch new file mode 100644 index 000000000..8408a118a --- /dev/null +++ b/debian/patches/unbreak-unix-forwarding-for-root.patch | |||
@@ -0,0 +1,80 @@ | |||
1 | From 904bc482ad87648a2c799c441dc6a8449f24e15a Mon Sep 17 00:00:00 2001 | ||
2 | From: "djm@openbsd.org" <djm@openbsd.org> | ||
3 | Date: Wed, 4 Jan 2017 05:37:40 +0000 | ||
4 | Subject: upstream commit | ||
5 | |||
6 | unbreak Unix domain socket forwarding for root; ok | ||
7 | markus@ | ||
8 | |||
9 | Upstream-ID: 6649c76eb7a3fa15409373295ca71badf56920a2 | ||
10 | |||
11 | Origin: https://anongit.mindrot.org/openssh.git/commit/?id=51045869fa084cdd016fdd721ea760417c0a3bf3 | ||
12 | Bug-Debian: https://bugs.debian.org/858252 | ||
13 | Last-Update: 2017-03-30 | ||
14 | |||
15 | Patch-Name: unbreak-unix-forwarding-for-root.patch | ||
16 | --- | ||
17 | serverloop.c | 19 ++++++++++++------- | ||
18 | 1 file changed, 12 insertions(+), 7 deletions(-) | ||
19 | |||
20 | diff --git a/serverloop.c b/serverloop.c | ||
21 | index c4e4699d..c55d203b 100644 | ||
22 | --- a/serverloop.c | ||
23 | +++ b/serverloop.c | ||
24 | @@ -468,6 +468,10 @@ server_request_direct_streamlocal(void) | ||
25 | Channel *c = NULL; | ||
26 | char *target, *originator; | ||
27 | u_short originator_port; | ||
28 | + struct passwd *pw = the_authctxt->pw; | ||
29 | + | ||
30 | + if (pw == NULL || !the_authctxt->valid) | ||
31 | + fatal("server_input_global_request: no/invalid user"); | ||
32 | |||
33 | target = packet_get_string(NULL); | ||
34 | originator = packet_get_string(NULL); | ||
35 | @@ -480,7 +484,7 @@ server_request_direct_streamlocal(void) | ||
36 | /* XXX fine grained permissions */ | ||
37 | if ((options.allow_streamlocal_forwarding & FORWARD_LOCAL) != 0 && | ||
38 | !no_port_forwarding_flag && !options.disable_forwarding && | ||
39 | - use_privsep) { | ||
40 | + (pw->pw_uid == 0 || use_privsep)) { | ||
41 | c = channel_connect_to_path(target, | ||
42 | "direct-streamlocal@openssh.com", "direct-streamlocal"); | ||
43 | } else { | ||
44 | @@ -702,6 +706,10 @@ server_input_global_request(int type, u_int32_t seq, void *ctxt) | ||
45 | int want_reply; | ||
46 | int r, success = 0, allocated_listen_port = 0; | ||
47 | struct sshbuf *resp = NULL; | ||
48 | + struct passwd *pw = the_authctxt->pw; | ||
49 | + | ||
50 | + if (pw == NULL || !the_authctxt->valid) | ||
51 | + fatal("server_input_global_request: no/invalid user"); | ||
52 | |||
53 | rtype = packet_get_string(NULL); | ||
54 | want_reply = packet_get_char(); | ||
55 | @@ -709,12 +717,8 @@ server_input_global_request(int type, u_int32_t seq, void *ctxt) | ||
56 | |||
57 | /* -R style forwarding */ | ||
58 | if (strcmp(rtype, "tcpip-forward") == 0) { | ||
59 | - struct passwd *pw; | ||
60 | struct Forward fwd; | ||
61 | |||
62 | - pw = the_authctxt->pw; | ||
63 | - if (pw == NULL || !the_authctxt->valid) | ||
64 | - fatal("server_input_global_request: no/invalid user"); | ||
65 | memset(&fwd, 0, sizeof(fwd)); | ||
66 | fwd.listen_host = packet_get_string(NULL); | ||
67 | fwd.listen_port = (u_short)packet_get_int(); | ||
68 | @@ -762,9 +766,10 @@ server_input_global_request(int type, u_int32_t seq, void *ctxt) | ||
69 | /* check permissions */ | ||
70 | if ((options.allow_streamlocal_forwarding & FORWARD_REMOTE) == 0 | ||
71 | || no_port_forwarding_flag || options.disable_forwarding || | ||
72 | - !use_privsep) { | ||
73 | + (pw->pw_uid != 0 && !use_privsep)) { | ||
74 | success = 0; | ||
75 | - packet_send_debug("Server has disabled port forwarding."); | ||
76 | + packet_send_debug("Server has disabled " | ||
77 | + "streamlocal forwarding."); | ||
78 | } else { | ||
79 | /* Start listening on the socket */ | ||
80 | success = channel_setup_remote_fwd_listener( | ||
diff --git a/debian/patches/user-group-modes.patch b/debian/patches/user-group-modes.patch new file mode 100644 index 000000000..2e32f9d76 --- /dev/null +++ b/debian/patches/user-group-modes.patch | |||
@@ -0,0 +1,259 @@ | |||
1 | From c20ad02ad58a523c6f4974e1ca124e71b7b801b1 Mon Sep 17 00:00:00 2001 | ||
2 | From: Colin Watson <cjwatson@debian.org> | ||
3 | Date: Sun, 9 Feb 2014 16:09:58 +0000 | ||
4 | Subject: Allow harmless group-writability | ||
5 | |||
6 | Allow secure files (~/.ssh/config, ~/.ssh/authorized_keys, etc.) to be | ||
7 | group-writable, provided that the group in question contains only the file's | ||
8 | owner. Rejected upstream for IMO incorrect reasons (e.g. a misunderstanding | ||
9 | about the contents of gr->gr_mem). Given that per-user groups and umask 002 | ||
10 | are the default setup in Debian (for good reasons - this makes operating in | ||
11 | setgid directories with other groups much easier), we need to permit this by | ||
12 | default. | ||
13 | |||
14 | Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1060 | ||
15 | Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=314347 | ||
16 | Last-Update: 2013-09-14 | ||
17 | |||
18 | Patch-Name: user-group-modes.patch | ||
19 | --- | ||
20 | auth-rhosts.c | 6 ++---- | ||
21 | auth.c | 9 +++----- | ||
22 | misc.c | 69 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++- | ||
23 | misc.h | 2 ++ | ||
24 | platform.c | 16 -------------- | ||
25 | readconf.c | 3 +-- | ||
26 | ssh.1 | 2 ++ | ||
27 | ssh_config.5 | 2 ++ | ||
28 | 8 files changed, 80 insertions(+), 29 deletions(-) | ||
29 | |||
30 | diff --git a/auth-rhosts.c b/auth-rhosts.c | ||
31 | index ecf956f0..4dccd5e6 100644 | ||
32 | --- a/auth-rhosts.c | ||
33 | +++ b/auth-rhosts.c | ||
34 | @@ -261,8 +261,7 @@ auth_rhosts2(struct passwd *pw, const char *client_user, const char *hostname, | ||
35 | return 0; | ||
36 | } | ||
37 | if (options.strict_modes && | ||
38 | - ((st.st_uid != 0 && st.st_uid != pw->pw_uid) || | ||
39 | - (st.st_mode & 022) != 0)) { | ||
40 | + !secure_permissions(&st, pw->pw_uid)) { | ||
41 | logit("Rhosts authentication refused for %.100s: " | ||
42 | "bad ownership or modes for home directory.", pw->pw_name); | ||
43 | auth_debug_add("Rhosts authentication refused for %.100s: " | ||
44 | @@ -288,8 +287,7 @@ auth_rhosts2(struct passwd *pw, const char *client_user, const char *hostname, | ||
45 | * allowing access to their account by anyone. | ||
46 | */ | ||
47 | if (options.strict_modes && | ||
48 | - ((st.st_uid != 0 && st.st_uid != pw->pw_uid) || | ||
49 | - (st.st_mode & 022) != 0)) { | ||
50 | + !secure_permissions(&st, pw->pw_uid)) { | ||
51 | logit("Rhosts authentication refused for %.100s: bad modes for %.200s", | ||
52 | pw->pw_name, buf); | ||
53 | auth_debug_add("Bad file modes for %.200s", buf); | ||
54 | diff --git a/auth.c b/auth.c | ||
55 | index c6390687..90390724 100644 | ||
56 | --- a/auth.c | ||
57 | +++ b/auth.c | ||
58 | @@ -444,8 +444,7 @@ check_key_in_hostfiles(struct passwd *pw, Key *key, const char *host, | ||
59 | user_hostfile = tilde_expand_filename(userfile, pw->pw_uid); | ||
60 | if (options.strict_modes && | ||
61 | (stat(user_hostfile, &st) == 0) && | ||
62 | - ((st.st_uid != 0 && st.st_uid != pw->pw_uid) || | ||
63 | - (st.st_mode & 022) != 0)) { | ||
64 | + !secure_permissions(&st, pw->pw_uid)) { | ||
65 | logit("Authentication refused for %.100s: " | ||
66 | "bad owner or modes for %.200s", | ||
67 | pw->pw_name, user_hostfile); | ||
68 | @@ -507,8 +506,7 @@ auth_secure_path(const char *name, struct stat *stp, const char *pw_dir, | ||
69 | snprintf(err, errlen, "%s is not a regular file", buf); | ||
70 | return -1; | ||
71 | } | ||
72 | - if ((!platform_sys_dir_uid(stp->st_uid) && stp->st_uid != uid) || | ||
73 | - (stp->st_mode & 022) != 0) { | ||
74 | + if (!secure_permissions(stp, uid)) { | ||
75 | snprintf(err, errlen, "bad ownership or modes for file %s", | ||
76 | buf); | ||
77 | return -1; | ||
78 | @@ -523,8 +521,7 @@ auth_secure_path(const char *name, struct stat *stp, const char *pw_dir, | ||
79 | strlcpy(buf, cp, sizeof(buf)); | ||
80 | |||
81 | if (stat(buf, &st) < 0 || | ||
82 | - (!platform_sys_dir_uid(st.st_uid) && st.st_uid != uid) || | ||
83 | - (st.st_mode & 022) != 0) { | ||
84 | + !secure_permissions(&st, uid)) { | ||
85 | snprintf(err, errlen, | ||
86 | "bad ownership or modes for directory %s", buf); | ||
87 | return -1; | ||
88 | diff --git a/misc.c b/misc.c | ||
89 | index 65c9222a..bf9153a6 100644 | ||
90 | --- a/misc.c | ||
91 | +++ b/misc.c | ||
92 | @@ -51,8 +51,9 @@ | ||
93 | #include <netdb.h> | ||
94 | #ifdef HAVE_PATHS_H | ||
95 | # include <paths.h> | ||
96 | -#include <pwd.h> | ||
97 | #endif | ||
98 | +#include <pwd.h> | ||
99 | +#include <grp.h> | ||
100 | #ifdef SSH_TUN_OPENBSD | ||
101 | #include <net/if.h> | ||
102 | #endif | ||
103 | @@ -61,6 +62,7 @@ | ||
104 | #include "misc.h" | ||
105 | #include "log.h" | ||
106 | #include "ssh.h" | ||
107 | +#include "platform.h" | ||
108 | |||
109 | /* remove newline at end of string */ | ||
110 | char * | ||
111 | @@ -708,6 +710,71 @@ read_keyfile_line(FILE *f, const char *filename, char *buf, size_t bufsz, | ||
112 | return -1; | ||
113 | } | ||
114 | |||
115 | +/* | ||
116 | + * return 1 if the specified uid is a uid that may own a system directory | ||
117 | + * otherwise 0. | ||
118 | + */ | ||
119 | +int | ||
120 | +platform_sys_dir_uid(uid_t uid) | ||
121 | +{ | ||
122 | + if (uid == 0) | ||
123 | + return 1; | ||
124 | +#ifdef PLATFORM_SYS_DIR_UID | ||
125 | + if (uid == PLATFORM_SYS_DIR_UID) | ||
126 | + return 1; | ||
127 | +#endif | ||
128 | + return 0; | ||
129 | +} | ||
130 | + | ||
131 | +int | ||
132 | +secure_permissions(struct stat *st, uid_t uid) | ||
133 | +{ | ||
134 | + if (!platform_sys_dir_uid(st->st_uid) && st->st_uid != uid) | ||
135 | + return 0; | ||
136 | + if ((st->st_mode & 002) != 0) | ||
137 | + return 0; | ||
138 | + if ((st->st_mode & 020) != 0) { | ||
139 | + /* If the file is group-writable, the group in question must | ||
140 | + * have exactly one member, namely the file's owner. | ||
141 | + * (Zero-member groups are typically used by setgid | ||
142 | + * binaries, and are unlikely to be suitable.) | ||
143 | + */ | ||
144 | + struct passwd *pw; | ||
145 | + struct group *gr; | ||
146 | + int members = 0; | ||
147 | + | ||
148 | + gr = getgrgid(st->st_gid); | ||
149 | + if (!gr) | ||
150 | + return 0; | ||
151 | + | ||
152 | + /* Check primary group memberships. */ | ||
153 | + while ((pw = getpwent()) != NULL) { | ||
154 | + if (pw->pw_gid == gr->gr_gid) { | ||
155 | + ++members; | ||
156 | + if (pw->pw_uid != uid) | ||
157 | + return 0; | ||
158 | + } | ||
159 | + } | ||
160 | + endpwent(); | ||
161 | + | ||
162 | + pw = getpwuid(st->st_uid); | ||
163 | + if (!pw) | ||
164 | + return 0; | ||
165 | + | ||
166 | + /* Check supplementary group memberships. */ | ||
167 | + if (gr->gr_mem[0]) { | ||
168 | + ++members; | ||
169 | + if (strcmp(pw->pw_name, gr->gr_mem[0]) || | ||
170 | + gr->gr_mem[1]) | ||
171 | + return 0; | ||
172 | + } | ||
173 | + | ||
174 | + if (!members) | ||
175 | + return 0; | ||
176 | + } | ||
177 | + return 1; | ||
178 | +} | ||
179 | + | ||
180 | int | ||
181 | tun_open(int tun, int mode) | ||
182 | { | ||
183 | diff --git a/misc.h b/misc.h | ||
184 | index c242f901..8b223b55 100644 | ||
185 | --- a/misc.h | ||
186 | +++ b/misc.h | ||
187 | @@ -143,6 +143,8 @@ char *read_passphrase(const char *, int); | ||
188 | int ask_permission(const char *, ...) __attribute__((format(printf, 1, 2))); | ||
189 | int read_keyfile_line(FILE *, const char *, char *, size_t, u_long *); | ||
190 | |||
191 | +int secure_permissions(struct stat *st, uid_t uid); | ||
192 | + | ||
193 | #define MINIMUM(a, b) (((a) < (b)) ? (a) : (b)) | ||
194 | #define MAXIMUM(a, b) (((a) > (b)) ? (a) : (b)) | ||
195 | #define ROUNDUP(x, y) ((((x)+((y)-1))/(y))*(y)) | ||
196 | diff --git a/platform.c b/platform.c | ||
197 | index cd7bf566..380ee3a4 100644 | ||
198 | --- a/platform.c | ||
199 | +++ b/platform.c | ||
200 | @@ -197,19 +197,3 @@ platform_krb5_get_principal_name(const char *pw_name) | ||
201 | return NULL; | ||
202 | #endif | ||
203 | } | ||
204 | - | ||
205 | -/* | ||
206 | - * return 1 if the specified uid is a uid that may own a system directory | ||
207 | - * otherwise 0. | ||
208 | - */ | ||
209 | -int | ||
210 | -platform_sys_dir_uid(uid_t uid) | ||
211 | -{ | ||
212 | - if (uid == 0) | ||
213 | - return 1; | ||
214 | -#ifdef PLATFORM_SYS_DIR_UID | ||
215 | - if (uid == PLATFORM_SYS_DIR_UID) | ||
216 | - return 1; | ||
217 | -#endif | ||
218 | - return 0; | ||
219 | -} | ||
220 | diff --git a/readconf.c b/readconf.c | ||
221 | index 3efba242..c02cdf63 100644 | ||
222 | --- a/readconf.c | ||
223 | +++ b/readconf.c | ||
224 | @@ -1752,8 +1752,7 @@ read_config_file_depth(const char *filename, struct passwd *pw, | ||
225 | |||
226 | if (fstat(fileno(f), &sb) == -1) | ||
227 | fatal("fstat %s: %s", filename, strerror(errno)); | ||
228 | - if (((sb.st_uid != 0 && sb.st_uid != getuid()) || | ||
229 | - (sb.st_mode & 022) != 0)) | ||
230 | + if (!secure_permissions(&sb, getuid())) | ||
231 | fatal("Bad owner or permissions on %s", filename); | ||
232 | } | ||
233 | |||
234 | diff --git a/ssh.1 b/ssh.1 | ||
235 | index 4011c65a..feef81a5 100644 | ||
236 | --- a/ssh.1 | ||
237 | +++ b/ssh.1 | ||
238 | @@ -1484,6 +1484,8 @@ The file format and configuration options are described in | ||
239 | .Xr ssh_config 5 . | ||
240 | Because of the potential for abuse, this file must have strict permissions: | ||
241 | read/write for the user, and not writable by others. | ||
242 | +It may be group-writable provided that the group in question contains only | ||
243 | +the user. | ||
244 | .Pp | ||
245 | .It Pa ~/.ssh/environment | ||
246 | Contains additional definitions for environment variables; see | ||
247 | diff --git a/ssh_config.5 b/ssh_config.5 | ||
248 | index a0457314..0483a1ee 100644 | ||
249 | --- a/ssh_config.5 | ||
250 | +++ b/ssh_config.5 | ||
251 | @@ -1803,6 +1803,8 @@ The format of this file is described above. | ||
252 | This file is used by the SSH client. | ||
253 | Because of the potential for abuse, this file must have strict permissions: | ||
254 | read/write for the user, and not accessible by others. | ||
255 | +It may be group-writable provided that the group in question contains only | ||
256 | +the user. | ||
257 | .It Pa /etc/ssh/ssh_config | ||
258 | Systemwide configuration file. | ||
259 | This file provides defaults for those | ||
diff --git a/debian/po/POTFILES.in b/debian/po/POTFILES.in new file mode 100644 index 000000000..c619f3451 --- /dev/null +++ b/debian/po/POTFILES.in | |||
@@ -0,0 +1 @@ | |||
[type: gettext/rfc822deb] openssh-server.templates | |||
diff --git a/debian/po/cs.po b/debian/po/cs.po new file mode 100644 index 000000000..d01e0ffdc --- /dev/null +++ b/debian/po/cs.po | |||
@@ -0,0 +1,55 @@ | |||
1 | # Czech PO debconf template translation of openssh. | ||
2 | # Copyright (C) 2014 Michal Simunek <michal.simunek@gmail.com> | ||
3 | # This file is distributed under the same license as the openssh package. | ||
4 | # Michal Simunek <michal.simunek@gmail.com>, 2014. | ||
5 | # | ||
6 | msgid "" | ||
7 | msgstr "" | ||
8 | "Project-Id-Version: openssh 1:6.6p1-1\n" | ||
9 | "Report-Msgid-Bugs-To: openssh@packages.debian.org\n" | ||
10 | "POT-Creation-Date: 2014-03-20 02:06+0000\n" | ||
11 | "PO-Revision-Date: 2014-06-12 12:25+0200\n" | ||
12 | "Last-Translator: Michal Simunek <michal.simunek@gmail.com>\n" | ||
13 | "Language-Team: Czech <debian-l10n-czech@lists.debian.org>\n" | ||
14 | "Language: cs\n" | ||
15 | "MIME-Version: 1.0\n" | ||
16 | "Content-Type: text/plain; charset=utf-8\n" | ||
17 | "Content-Transfer-Encoding: 8bit\n" | ||
18 | |||
19 | #. Type: boolean | ||
20 | #. Description | ||
21 | #: ../openssh-server.templates:1001 | ||
22 | msgid "Disable SSH password authentication for root?" | ||
23 | msgstr "Zakázat ověřování heslem pro uživatele root?" | ||
24 | |||
25 | #. Type: boolean | ||
26 | #. Description | ||
27 | #: ../openssh-server.templates:1001 | ||
28 | msgid "" | ||
29 | "Previous versions of openssh-server permitted logging in as root over SSH " | ||
30 | "using password authentication. The default for new installations is now " | ||
31 | "\"PermitRootLogin prohibit-password\", which disables password " | ||
32 | "authentication for root without breaking systems that have explicitly " | ||
33 | "configured SSH public key authentication for root." | ||
34 | msgstr "" | ||
35 | "Předchozí verze openssh-server dovolovala přihlašovat se přes SSH jako root " | ||
36 | "pomocí ověřování heslem. Výchozí volba pro nové instalace je nyní " | ||
37 | "\"PermitRootLogin prohibit-password\", která zakazuje ověřování heslem pro " | ||
38 | "uživatele root, aniž by to omezilo systémy, které mají explicitně nastaveno " | ||
39 | "ověřování veřejným SSH klíčem pro uživatele root." | ||
40 | |||
41 | #. Type: boolean | ||
42 | #. Description | ||
43 | #: ../openssh-server.templates:1001 | ||
44 | msgid "" | ||
45 | "This change makes systems more secure against brute-force password " | ||
46 | "dictionary attacks on the root user (a very common target for such attacks). " | ||
47 | "However, it may break systems that are set up with the expectation of being " | ||
48 | "able to SSH as root using password authentication. You should only make this " | ||
49 | "change if you do not need to do that." | ||
50 | msgstr "" | ||
51 | "Tato změna činí systémy zabezpečenějšími proti útokům hrubou silou na heslo " | ||
52 | "uživatele root pomocí slovníku (velmi častý cíl útoků). Nicméně, to může " | ||
53 | "poškodit systémy, které jsou nastaveny s předpokladem, že bude možné se " | ||
54 | "přihlašovat přes SSH jako root pomocí ověřování heslem. Změnu této volby " | ||
55 | "byste měli provést pouze pokud ověřování heslem potřebujete." | ||
diff --git a/debian/po/da.po b/debian/po/da.po new file mode 100644 index 000000000..70d576d7b --- /dev/null +++ b/debian/po/da.po | |||
@@ -0,0 +1,55 @@ | |||
1 | # Danish translation openssh. | ||
2 | # Copyright (C) 2014 openssh og nedenstående oversættere. | ||
3 | # This file is distributed under the same license as the openssh package. | ||
4 | # Joe Hansen <joedalton2@yahoo.dk>, 2014. | ||
5 | # | ||
6 | msgid "" | ||
7 | msgstr "" | ||
8 | "Project-Id-Version: openssh\n" | ||
9 | "Report-Msgid-Bugs-To: openssh@packages.debian.org\n" | ||
10 | "POT-Creation-Date: 2014-03-20 02:06+0000\n" | ||
11 | "PO-Revision-Date: 2014-03-21 23:51+0200\n" | ||
12 | "Last-Translator: Joe Hansen <joedalton2@yahoo.dk>\n" | ||
13 | "Language-Team: Danish <debian-l10n-danish@lists.debian.org>\n" | ||
14 | "Language: da\n" | ||
15 | "MIME-Version: 1.0\n" | ||
16 | "Content-Type: text/plain; charset=UTF-8\n" | ||
17 | "Content-Transfer-Encoding: 8bit\n" | ||
18 | |||
19 | #. Type: boolean | ||
20 | #. Description | ||
21 | #: ../openssh-server.templates:1001 | ||
22 | msgid "Disable SSH password authentication for root?" | ||
23 | msgstr "Deaktiver SSH-adgangskodegodkendelse for root?" | ||
24 | |||
25 | #. Type: boolean | ||
26 | #. Description | ||
27 | #: ../openssh-server.templates:1001 | ||
28 | msgid "" | ||
29 | "Previous versions of openssh-server permitted logging in as root over SSH " | ||
30 | "using password authentication. The default for new installations is now " | ||
31 | "\"PermitRootLogin prohibit-password\", which disables password " | ||
32 | "authentication for root without breaking systems that have explicitly " | ||
33 | "configured SSH public key authentication for root." | ||
34 | msgstr "" | ||
35 | "Tidligere versioner af openssh-server tillod indlogning som root over SSH " | ||
36 | "med brug af adgangskodegodkendelse. Standarden for nye installationer er nu " | ||
37 | "»PermitRootLogin prohibit-password«, som deaktiverer adgangskodegodkendelse " | ||
38 | "for root uden at ødelægge systemer, som eksplicit har konfigureret SSH-" | ||
39 | "offentlig nøglegodkendelse for root." | ||
40 | |||
41 | #. Type: boolean | ||
42 | #. Description | ||
43 | #: ../openssh-server.templates:1001 | ||
44 | msgid "" | ||
45 | "This change makes systems more secure against brute-force password " | ||
46 | "dictionary attacks on the root user (a very common target for such attacks). " | ||
47 | "However, it may break systems that are set up with the expectation of being " | ||
48 | "able to SSH as root using password authentication. You should only make this " | ||
49 | "change if you do not need to do that." | ||
50 | msgstr "" | ||
51 | "Denne ændring gør systemer mere sikre mod brute-force angreb vis ordlister " | ||
52 | "med adgangskoder på root-brugeren (et meget ofte mål for sådanne angreb). " | ||
53 | "Det kan dog ødelægge systemer, som er opsat med forventning om at kunne SSH " | ||
54 | "som root via brug af adgangskodegodkendelse. Du skal kun lave denne ændring, " | ||
55 | "hvis du ikke har brug for dette." | ||
diff --git a/debian/po/de.po b/debian/po/de.po new file mode 100644 index 000000000..ecba54b6c --- /dev/null +++ b/debian/po/de.po | |||
@@ -0,0 +1,61 @@ | |||
1 | # openssh. | ||
2 | # Copyright (C) 2014 Colin Watson | ||
3 | # Copyright (C) 2014 Stephan Beck | ||
4 | # This file is distributed under the same license as the openssh package. | ||
5 | # Stephan Beck <sbeck@mailbox.org>, 2014. | ||
6 | # | ||
7 | msgid "" | ||
8 | msgstr "" | ||
9 | "Project-Id-Version: openssh_1:6.6p1-1\n" | ||
10 | "Report-Msgid-Bugs-To: openssh@packages.debian.org\n" | ||
11 | "POT-Creation-Date: 2014-03-20 02:06+0000\n" | ||
12 | "PO-Revision-Date: 2014-03-24 22:21+0100\n" | ||
13 | "Last-Translator: Stephan Beck <sbeck@mailbox.org>\n" | ||
14 | "Language-Team: Debian German translation team <debian-l10n-german@lists." | ||
15 | "debian.org>\n" | ||
16 | "Language: de\n" | ||
17 | "MIME-Version: 1.0\n" | ||
18 | "Content-Type: text/plain; charset=UTF-8\n" | ||
19 | "Content-Transfer-Encoding: 8bit\n" | ||
20 | |||
21 | #. Type: boolean | ||
22 | #. Description | ||
23 | #: ../openssh-server.templates:1001 | ||
24 | msgid "Disable SSH password authentication for root?" | ||
25 | msgstr "SSH Passwort-Authentifizierung für »root« deaktivieren?" | ||
26 | |||
27 | #. Type: boolean | ||
28 | #. Description | ||
29 | #: ../openssh-server.templates:1001 | ||
30 | msgid "" | ||
31 | "Previous versions of openssh-server permitted logging in as root over SSH " | ||
32 | "using password authentication. The default for new installations is now " | ||
33 | "\"PermitRootLogin prohibit-password\", which disables password " | ||
34 | "authentication for root without breaking systems that have explicitly " | ||
35 | "configured SSH public key authentication for root." | ||
36 | msgstr "" | ||
37 | "Vorherige Versionen von openssh-server erlaubten das Anmelden als »root« " | ||
38 | "über SSH unter Verwendung von Passwort-Authentifizierung. Die " | ||
39 | "Standardeinstellung für Neuinstallationen lautet nun »PermitRootLogin " | ||
40 | "prohibit-password«, wodurch die Passwort-Authentifizierung für »root« " | ||
41 | "deaktiviert wird, und Systeme dennoch funktionsfähig bleiben, bei denen " | ||
42 | "ausdrücklich die Authentifizierung als »root« mittels öffentlichem SSH-" | ||
43 | "Schlüssel konfiguriert ist." | ||
44 | |||
45 | #. Type: boolean | ||
46 | #. Description | ||
47 | #: ../openssh-server.templates:1001 | ||
48 | msgid "" | ||
49 | "This change makes systems more secure against brute-force password " | ||
50 | "dictionary attacks on the root user (a very common target for such attacks). " | ||
51 | "However, it may break systems that are set up with the expectation of being " | ||
52 | "able to SSH as root using password authentication. You should only make this " | ||
53 | "change if you do not need to do that." | ||
54 | msgstr "" | ||
55 | "Diese Änderung sichert Systeme besser gegen jene Angriffe auf den Benutzer " | ||
56 | "»root« (ein verbreitetes Ziel solcher Angriffe) ab, die das Passwort durch " | ||
57 | "simples Ausprobieren aller Einträge von Wörterbüchern zu erraten versuchen. " | ||
58 | "Sie kann allerdings dazu führen, dass Systeme nicht mehr funktionieren, die " | ||
59 | "in der Absicht konfiguriert wurden, die Anmeldung als »root« über SSH unter " | ||
60 | "Verwendung von Passwort-Authentifizierung zuzulassen. Sie sollten diese " | ||
61 | "Änderung nur vornehmen, wenn Sie auf Letzteres verzichten können." | ||
diff --git a/debian/po/es.po b/debian/po/es.po new file mode 100644 index 000000000..de8a67ace --- /dev/null +++ b/debian/po/es.po | |||
@@ -0,0 +1,80 @@ | |||
1 | # openssh po-debconf translation to Spanish | ||
2 | # Copyright (C) 2014 Software in the Public Interest | ||
3 | # This file is distributed under the same license as the openssh package. | ||
4 | # | ||
5 | # Changes: | ||
6 | # - Initial translation | ||
7 | # Matías A. Bellone <matiasbellone+debian@gmail.com>, 2014 | ||
8 | # | ||
9 | # Traductores, si no conocen el formato PO, merece la pena leer la | ||
10 | # de gettext, especialmente las secciones dedicadas a este | ||
11 | # formato, por ejemplo ejecutando: | ||
12 | # info -n '(gettext)PO Files' | ||
13 | # info -n '(gettext)Header Entry' | ||
14 | # | ||
15 | # Equipo de traducción al español, por favor, lean antes de traducir | ||
16 | # los siguientes documentos: | ||
17 | # | ||
18 | # - El proyecto de traducción de Debian al español | ||
19 | # http://www.debian.org/intl/spanish/ | ||
20 | # especialmente las notas de traducción en | ||
21 | # http://www.debian.org/intl/spanish/notas | ||
22 | # | ||
23 | # - La guía de traducción de po's de debconf: | ||
24 | # /usr/share/doc/po-debconf/README-trans | ||
25 | # o http://www.debian.org/intl/l10n/po-debconf/README-trans | ||
26 | # | ||
27 | msgid "" | ||
28 | msgstr "" | ||
29 | "Project-Id-Version: openssh\n" | ||
30 | "Report-Msgid-Bugs-To: openssh@packages.debian.org\n" | ||
31 | "POT-Creation-Date: 2014-03-20 02:06+0000\n" | ||
32 | "PO-Revision-Date: 2014-03-23 20:43-0300\n" | ||
33 | "Last-Translator: Matías Bellone <matiasbellone+debian@gmail.com>\n" | ||
34 | "Language-Team: Debian l10n Spanish <debian-l10n-spanish@lists.debian.org>\n" | ||
35 | "Language: es\n" | ||
36 | "MIME-Version: 1.0\n" | ||
37 | "Content-Type: text/plain; charset=UTF-8\n" | ||
38 | "Content-Transfer-Encoding: 8bit\n" | ||
39 | |||
40 | #. Type: boolean | ||
41 | #. Description | ||
42 | #: ../openssh-server.templates:1001 | ||
43 | msgid "Disable SSH password authentication for root?" | ||
44 | msgstr "" | ||
45 | "¿Desea desactivar la autenticación SSH mediante contraseña para el usuario " | ||
46 | "root?" | ||
47 | |||
48 | #. Type: boolean | ||
49 | #. Description | ||
50 | #: ../openssh-server.templates:1001 | ||
51 | msgid "" | ||
52 | "Previous versions of openssh-server permitted logging in as root over SSH " | ||
53 | "using password authentication. The default for new installations is now " | ||
54 | "\"PermitRootLogin prohibit-password\", which disables password " | ||
55 | "authentication for root without breaking systems that have explicitly " | ||
56 | "configured SSH public key authentication for root." | ||
57 | msgstr "" | ||
58 | "Las versiones anteriores de openssh-server permitían iniciar sesión como " | ||
59 | "usuario root utilizando autenticación con contraseña. La configuración " | ||
60 | "predeterminada para las nuevas instalaciones ahora incluye «PermitRootLogin " | ||
61 | "prohibit-password», lo que desactiva la autenticación con contraseña para el " | ||
62 | "usuario root sin romper los sistemas que tienen configurado explícitamente " | ||
63 | "la autenticación SSH utilizando claves públicas para el usuario root." | ||
64 | |||
65 | #. Type: boolean | ||
66 | #. Description | ||
67 | #: ../openssh-server.templates:1001 | ||
68 | msgid "" | ||
69 | "This change makes systems more secure against brute-force password " | ||
70 | "dictionary attacks on the root user (a very common target for such attacks). " | ||
71 | "However, it may break systems that are set up with the expectation of being " | ||
72 | "able to SSH as root using password authentication. You should only make this " | ||
73 | "change if you do not need to do that." | ||
74 | msgstr "" | ||
75 | "Este cambio hace que los sistemas sean más resistentes contra ataques de " | ||
76 | "fuerza bruta basados en diccionarios sobre el usuario root (un objetivo muy " | ||
77 | "común para este tipo de ataques). Sin embargo, podría romper sistemas cuya " | ||
78 | "configuración permite que el usuario root inicie sesión a través de SSH " | ||
79 | "utilizando una contraseña. Sólo debería realizar este cambio si no necesita " | ||
80 | "este comportamiento." | ||
diff --git a/debian/po/fr.po b/debian/po/fr.po new file mode 100644 index 000000000..f7125e9a3 --- /dev/null +++ b/debian/po/fr.po | |||
@@ -0,0 +1,59 @@ | |||
1 | # Translation of openssh debconf template to French | ||
2 | # Copyright (C) 2014 | ||
3 | # This file is distributed under the same license as the openssh package. | ||
4 | # Étienne Gilli <etienne.gilli@gmail.com>, 2014. | ||
5 | # | ||
6 | msgid "" | ||
7 | msgstr "" | ||
8 | "Project-Id-Version: openssh_1:6.5p1-6\n" | ||
9 | "Report-Msgid-Bugs-To: openssh@packages.debian.org\n" | ||
10 | "POT-Creation-Date: 2014-03-20 02:06+0000\n" | ||
11 | "PO-Revision-Date: 2014-03-22 08:26+0100\n" | ||
12 | "Last-Translator: Étienne Gilli <etienne.gilli@gmail.com>\n" | ||
13 | "Language-Team: French <debian-l10n-french@lists.debian.org>\n" | ||
14 | "Language: fr\n" | ||
15 | "MIME-Version: 1.0\n" | ||
16 | "Content-Type: text/plain; charset=UTF-8\n" | ||
17 | "Content-Transfer-Encoding: 8bit\n" | ||
18 | |||
19 | #. Type: boolean | ||
20 | #. Description | ||
21 | #: ../openssh-server.templates:1001 | ||
22 | msgid "Disable SSH password authentication for root?" | ||
23 | msgstr "" | ||
24 | "Désactiver l’authentification SSH par mot de passe pour le superutilisateur ?" | ||
25 | |||
26 | #. Type: boolean | ||
27 | #. Description | ||
28 | #: ../openssh-server.templates:1001 | ||
29 | msgid "" | ||
30 | "Previous versions of openssh-server permitted logging in as root over SSH " | ||
31 | "using password authentication. The default for new installations is now " | ||
32 | "\"PermitRootLogin prohibit-password\", which disables password " | ||
33 | "authentication for root without breaking systems that have explicitly " | ||
34 | "configured SSH public key authentication for root." | ||
35 | msgstr "" | ||
36 | "Les versions précédentes du paquet openssh-server autorisaient la connexion " | ||
37 | "par SSH du superutilisateur (root) en utilisant l’authentification par mot " | ||
38 | "de passe. Par défaut, les nouvelles installations ont maintenant l’option " | ||
39 | "« PermitRootLogin prohibit-password », qui désactive l’authentification par " | ||
40 | "mot de passe pour le compte « root », sans casser les systèmes qui ont " | ||
41 | "configuré explicitement l’authentification SSH par clé publique pour ce " | ||
42 | "compte." | ||
43 | |||
44 | #. Type: boolean | ||
45 | #. Description | ||
46 | #: ../openssh-server.templates:1001 | ||
47 | msgid "" | ||
48 | "This change makes systems more secure against brute-force password " | ||
49 | "dictionary attacks on the root user (a very common target for such attacks). " | ||
50 | "However, it may break systems that are set up with the expectation of being " | ||
51 | "able to SSH as root using password authentication. You should only make this " | ||
52 | "change if you do not need to do that." | ||
53 | msgstr "" | ||
54 | "Cette modification rend les systèmes plus robustes face aux attaques par " | ||
55 | "force brute et par dictionnaire contre le superutilisateur (très souvent " | ||
56 | "pris pour cible par ce type d’attaque). Cependant, cela peut rendre " | ||
57 | "inutilisables les systèmes reposant sur la possibilité de se connecter au " | ||
58 | "compte « root » par SSH avec authentification par mot de passe. Vous ne " | ||
59 | "devriez appliquer cette modification que si ce n’est pas votre cas." | ||
diff --git a/debian/po/it.po b/debian/po/it.po new file mode 100644 index 000000000..dd7106090 --- /dev/null +++ b/debian/po/it.po | |||
@@ -0,0 +1,58 @@ | |||
1 | # Italian translation of openssh debconf messages. | ||
2 | # Copyright (C) 2014, openssh package copyright holder | ||
3 | # This file is distributed under the same license as the openssh package. | ||
4 | # Beatrice Torracca <beatricet@libero.it>, 2014. | ||
5 | msgid "" | ||
6 | msgstr "" | ||
7 | "Project-Id-Version: openssh\n" | ||
8 | "Report-Msgid-Bugs-To: openssh@packages.debian.org\n" | ||
9 | "POT-Creation-Date: 2014-03-20 02:06+0000\n" | ||
10 | "PO-Revision-Date: 2014-03-28 11:12+0200\n" | ||
11 | "Last-Translator: Beatrice Torracca <beatricet@libero.it>\n" | ||
12 | "Language-Team: Italian <debian-l10n-italian@lists.debian.org>\n" | ||
13 | "Language: it\n" | ||
14 | "MIME-Version: 1.0\n" | ||
15 | "Content-Type: text/plain; charset=UTF-8\n" | ||
16 | "Content-Transfer-Encoding: 8bit\n" | ||
17 | "Plural-Forms: nplurals=2; plural=(n != 1);\n" | ||
18 | "X-Generator: Virtaal 0.7.1\n" | ||
19 | |||
20 | #. Type: boolean | ||
21 | #. Description | ||
22 | #: ../openssh-server.templates:1001 | ||
23 | msgid "Disable SSH password authentication for root?" | ||
24 | msgstr "Disabilitare l'autenticazione SSH con password per root?" | ||
25 | |||
26 | #. Type: boolean | ||
27 | #. Description | ||
28 | #: ../openssh-server.templates:1001 | ||
29 | msgid "" | ||
30 | "Previous versions of openssh-server permitted logging in as root over SSH " | ||
31 | "using password authentication. The default for new installations is now " | ||
32 | "\"PermitRootLogin prohibit-password\", which disables password " | ||
33 | "authentication for root without breaking systems that have explicitly " | ||
34 | "configured SSH public key authentication for root." | ||
35 | msgstr "" | ||
36 | "Le versioni precedenti di openssh-server permettevano il login come root via " | ||
37 | "SSH, usando l'autenticazione con password. Il comportamento predefinito " | ||
38 | "delle nuove installazioni è «PermitRootLogin prohibit-password» che " | ||
39 | "disabilita l'autenticazione con password per root, senza rendere non " | ||
40 | "funzionanti sistemi che hanno esplicitamente configurato l'autenticazione " | ||
41 | "SSH con chiave pubblica per root." | ||
42 | |||
43 | #. Type: boolean | ||
44 | #. Description | ||
45 | #: ../openssh-server.templates:1001 | ||
46 | msgid "" | ||
47 | "This change makes systems more secure against brute-force password " | ||
48 | "dictionary attacks on the root user (a very common target for such attacks). " | ||
49 | "However, it may break systems that are set up with the expectation of being " | ||
50 | "able to SSH as root using password authentication. You should only make this " | ||
51 | "change if you do not need to do that." | ||
52 | msgstr "" | ||
53 | "Questo cambiamento rende i sistemi più al sicuro da attacchi di forza bruta " | ||
54 | "a dizionario sulle password per l'utente root (un obiettivo molto comune per " | ||
55 | "tali attacchi). Tuttavia, può rendere non funzionanti sistemi che sono " | ||
56 | "impostati facendo affidamento sulla possibilità di autenticazione SSH come " | ||
57 | "root usando la password. Si dovrebbe fare questo cambiamento solo se non si " | ||
58 | "ha bisogno di tale comportamento." | ||
diff --git a/debian/po/ja.po b/debian/po/ja.po new file mode 100644 index 000000000..db382f19a --- /dev/null +++ b/debian/po/ja.po | |||
@@ -0,0 +1,55 @@ | |||
1 | # SOME DESCRIPTIVE TITLE. | ||
2 | # Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER | ||
3 | # This file is distributed under the same license as the openssh package. | ||
4 | # victory <victory.deb@gmail.com>, 2014. | ||
5 | # | ||
6 | msgid "" | ||
7 | msgstr "" | ||
8 | "Project-Id-Version: openssh\n" | ||
9 | "Report-Msgid-Bugs-To: openssh@packages.debian.org\n" | ||
10 | "POT-Creation-Date: 2014-03-20 02:06+0000\n" | ||
11 | "PO-Revision-Date: 2014-03-20 11:06+0900\n" | ||
12 | "Last-Translator: victory <victory.deb@gmail.com>\n" | ||
13 | "Language-Team: Japanese <debian-japanese@lists.debian.org>\n" | ||
14 | "Language: ja\n" | ||
15 | "MIME-Version: 1.0\n" | ||
16 | "Content-Type: text/plain; charset=UTF-8\n" | ||
17 | "Content-Transfer-Encoding: 8bit\n" | ||
18 | |||
19 | #. Type: boolean | ||
20 | #. Description | ||
21 | #: ../openssh-server.templates:1001 | ||
22 | msgid "Disable SSH password authentication for root?" | ||
23 | msgstr "root での SSH パスワード認証を無効にしますか?" | ||
24 | |||
25 | #. Type: boolean | ||
26 | #. Description | ||
27 | #: ../openssh-server.templates:1001 | ||
28 | msgid "" | ||
29 | "Previous versions of openssh-server permitted logging in as root over SSH " | ||
30 | "using password authentication. The default for new installations is now " | ||
31 | "\"PermitRootLogin prohibit-password\", which disables password " | ||
32 | "authentication for root without breaking systems that have explicitly " | ||
33 | "configured SSH public key authentication for root." | ||
34 | msgstr "" | ||
35 | "openssh-server の以前のバージョンではパスワード認証を利用した SSH 経由の " | ||
36 | "root のログインを許可していました。新しくインストールした場合のデフォルト値が" | ||
37 | "現在は「PermitRootLogin prohibit-password」になり、root のパスワード認証を無" | ||
38 | "効化しますが SSH の公開鍵認証を root 用に明示的に設定しているシステムでは特に" | ||
39 | "問題はありません。" | ||
40 | |||
41 | #. Type: boolean | ||
42 | #. Description | ||
43 | #: ../openssh-server.templates:1001 | ||
44 | msgid "" | ||
45 | "This change makes systems more secure against brute-force password " | ||
46 | "dictionary attacks on the root user (a very common target for such attacks). " | ||
47 | "However, it may break systems that are set up with the expectation of being " | ||
48 | "able to SSH as root using password authentication. You should only make this " | ||
49 | "change if you do not need to do that." | ||
50 | msgstr "" | ||
51 | "この変更によりシステムは root ユーザ (こういった攻撃ではとても一般的な攻撃対" | ||
52 | "象です) へのブルートフォースによるパスワード辞書攻撃に対してはより安全になり" | ||
53 | "ます。しかしパスワード認証により root で SSH 接続できることを前提として構成し" | ||
54 | "たシステムでは問題が発生する可能性があります。そういった必要のない場合にのみ" | ||
55 | "この変更を行うようにしてください。" | ||
diff --git a/debian/po/nl.po b/debian/po/nl.po new file mode 100644 index 000000000..3afd6171e --- /dev/null +++ b/debian/po/nl.po | |||
@@ -0,0 +1,60 @@ | |||
1 | # Dutch translation of openssh debconf templates. | ||
2 | # Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER | ||
3 | # This file is distributed under the same license as the openssh package. | ||
4 | # Frans Spiesschaert <Frans.Spiesschaert@yucom.be>, 2014. | ||
5 | # | ||
6 | msgid "" | ||
7 | msgstr "" | ||
8 | "Project-Id-Version: openssh\n" | ||
9 | "Report-Msgid-Bugs-To: openssh@packages.debian.org\n" | ||
10 | "POT-Creation-Date: 2014-03-20 02:06+0000\n" | ||
11 | "PO-Revision-Date: 2014-10-03 23:54+0200\n" | ||
12 | "Last-Translator: Frans Spiesschaert <Frans.Spiesschaert@yucom.be>\n" | ||
13 | "Language-Team: Debian Dutch l10n Team <debian-l10n-dutch@lists.debian.org>\n" | ||
14 | "Language: nl\n" | ||
15 | "MIME-Version: 1.0\n" | ||
16 | "Content-Type: text/plain; charset=UTF-8\n" | ||
17 | "Content-Transfer-Encoding: 8bit\n" | ||
18 | "Plural-Forms: nplurals=2; plural=(n != 1);\n" | ||
19 | |||
20 | #. Type: boolean | ||
21 | #. Description | ||
22 | #: ../openssh-server.templates:1001 | ||
23 | msgid "Disable SSH password authentication for root?" | ||
24 | msgstr "" | ||
25 | "Wachtwoordauthenticatie over SSH voor de systeembeheerder uitschakelen?" | ||
26 | |||
27 | #. Type: boolean | ||
28 | #. Description | ||
29 | #: ../openssh-server.templates:1001 | ||
30 | msgid "" | ||
31 | "Previous versions of openssh-server permitted logging in as root over SSH " | ||
32 | "using password authentication. The default for new installations is now " | ||
33 | "\"PermitRootLogin prohibit-password\", which disables password " | ||
34 | "authentication for root without breaking systems that have explicitly " | ||
35 | "configured SSH public key authentication for root." | ||
36 | msgstr "" | ||
37 | "Eerdere versies van de openssh-server lieten de systeembeheerder toe om zich " | ||
38 | "over SSH te authenticeren met een wachtwoord. Voor nieuwe installaties is de " | ||
39 | "standaard nu \"PermitRootLogin prohibit-password\". Deze standaardinstelling " | ||
40 | "maakt het voor de systeembeheerder onmogelijk om zich via een wachtwoord te " | ||
41 | "authenticeren. Deze instelling heeft geen impact op systemen waarbij de SSH-" | ||
42 | "configuratie expliciet vereist dat de systeembeheerder zich authenticeert " | ||
43 | "via een publieke sleutel." | ||
44 | |||
45 | #. Type: boolean | ||
46 | #. Description | ||
47 | #: ../openssh-server.templates:1001 | ||
48 | msgid "" | ||
49 | "This change makes systems more secure against brute-force password " | ||
50 | "dictionary attacks on the root user (a very common target for such attacks). " | ||
51 | "However, it may break systems that are set up with the expectation of being " | ||
52 | "able to SSH as root using password authentication. You should only make this " | ||
53 | "change if you do not need to do that." | ||
54 | msgstr "" | ||
55 | "Deze wijziging maakt systemen veiliger tegenover aanvallen met brute kracht " | ||
56 | "(met een wachtwoordenwoordenboek) op de systeembeheerder, een zeer courant " | ||
57 | "doelwit voor zulke aanvallen. Maar het kan systemen onbruikbaar maken die " | ||
58 | "ingesteld werden vanuit de verwachting dat de systeembeheerder SSH kan " | ||
59 | "gebruiken met authenticatie via wachtwoord. Enkel wanneer u dit laatste niet " | ||
60 | "nodig heeft, zou u deze wijziging kunnen doorvoeren." | ||
diff --git a/debian/po/pt.po b/debian/po/pt.po new file mode 100644 index 000000000..2dab84ccf --- /dev/null +++ b/debian/po/pt.po | |||
@@ -0,0 +1,59 @@ | |||
1 | # Translation of openssh's debconf messages to European Portuguese | ||
2 | # Copyright (C) 2014 YEAR THE openssh'S COPYRIGHT HOLDER | ||
3 | # This file is distributed under the same license as the openssh package. | ||
4 | # | ||
5 | # Américo Monteiro <a_monteiro@gmx.com>, 2014. | ||
6 | msgid "" | ||
7 | msgstr "" | ||
8 | "Project-Id-Version: openssh 1:6.6p1-1\n" | ||
9 | "Report-Msgid-Bugs-To: openssh@packages.debian.org\n" | ||
10 | "POT-Creation-Date: 2014-03-20 02:06+0000\n" | ||
11 | "PO-Revision-Date: 2014-03-21 21:13+0000\n" | ||
12 | "Last-Translator: Américo Monteiro <a_monteiro@gmx.com>\n" | ||
13 | "Language-Team: Portuguese <traduz@debianpt.org>\n" | ||
14 | "Language: pt\n" | ||
15 | "MIME-Version: 1.0\n" | ||
16 | "Content-Type: text/plain; charset=UTF-8\n" | ||
17 | "Content-Transfer-Encoding: 8bit\n" | ||
18 | "Plural-Forms: nplurals=2; plural=(n != 1);\n" | ||
19 | "X-Generator: Lokalize 1.4\n" | ||
20 | |||
21 | #. Type: boolean | ||
22 | #. Description | ||
23 | #: ../openssh-server.templates:1001 | ||
24 | msgid "Disable SSH password authentication for root?" | ||
25 | msgstr "Desactivar a autenticação SSH por palavra passe para o root?" | ||
26 | |||
27 | #. Type: boolean | ||
28 | #. Description | ||
29 | #: ../openssh-server.templates:1001 | ||
30 | msgid "" | ||
31 | "Previous versions of openssh-server permitted logging in as root over SSH " | ||
32 | "using password authentication. The default for new installations is now " | ||
33 | "\"PermitRootLogin prohibit-password\", which disables password " | ||
34 | "authentication for root without breaking systems that have explicitly " | ||
35 | "configured SSH public key authentication for root." | ||
36 | msgstr "" | ||
37 | "As versões anteriores do servidor openssh permitiam iniciar sessão como root " | ||
38 | "sobre SSH usando autenticação por palavra-passe. A predefinição para novas " | ||
39 | "instalações é agora \"PermitRootLogin prohibit-password\", a qual desactiva " | ||
40 | "a autenticação por palavra-passe para o root sem danificar os sistemas que " | ||
41 | "têm configurados explicitamente autenticação SSH por chave pública para o " | ||
42 | "root." | ||
43 | |||
44 | #. Type: boolean | ||
45 | #. Description | ||
46 | #: ../openssh-server.templates:1001 | ||
47 | msgid "" | ||
48 | "This change makes systems more secure against brute-force password " | ||
49 | "dictionary attacks on the root user (a very common target for such attacks). " | ||
50 | "However, it may break systems that are set up with the expectation of being " | ||
51 | "able to SSH as root using password authentication. You should only make this " | ||
52 | "change if you do not need to do that." | ||
53 | msgstr "" | ||
54 | "Esta alteração torna os sistemas mais seguros contra ataques em que se " | ||
55 | "forçam dicionários de palavras-passe no utilizador root (um alvo muito comum " | ||
56 | "para tais ataques). No entanto, pode danificar sistemas que estão " | ||
57 | "configurados com a expectativa de serem capazes de SSH como root usando " | ||
58 | "autenticação por palavra-passe. Apenas deverá fazer esta alteração se não " | ||
59 | "precisa de tal método de autenticação." | ||
diff --git a/debian/po/pt_BR.po b/debian/po/pt_BR.po new file mode 100644 index 000000000..99b1182f1 --- /dev/null +++ b/debian/po/pt_BR.po | |||
@@ -0,0 +1,57 @@ | |||
1 | # Debconf translations for openssh. | ||
2 | # Copyright (C) 2014 THE openssh'S COPYRIGHT HOLDER | ||
3 | # This file is distributed under the same license as the openssh package. | ||
4 | # José de Figueiredo <deb.gnulinux@gmail.com>, 2014. | ||
5 | # | ||
6 | # | ||
7 | msgid "" | ||
8 | msgstr "" | ||
9 | "Project-Id-Version: openssh\n" | ||
10 | "Report-Msgid-Bugs-To: openssh@packages.debian.org\n" | ||
11 | "POT-Creation-Date: 2014-03-20 02:06+0000\n" | ||
12 | "PO-Revision-Date: 2014-11-23 23:49-0200\n" | ||
13 | "Last-Translator: José de Figueiredo <deb.gnulinux@gmail.com>\n" | ||
14 | "Language-Team: Brazilian Portuguese <debian-l10n-portuguese@lists.debian." | ||
15 | "org>\n" | ||
16 | "Language: pt_BR\n" | ||
17 | "MIME-Version: 1.0\n" | ||
18 | "Content-Type: text/plain; charset=UTF-8\n" | ||
19 | "Content-Transfer-Encoding: 8bit\n" | ||
20 | |||
21 | #. Type: boolean | ||
22 | #. Description | ||
23 | #: ../openssh-server.templates:1001 | ||
24 | msgid "Disable SSH password authentication for root?" | ||
25 | msgstr "Desabilitar autenticação por senha do SSH para root?" | ||
26 | |||
27 | #. Type: boolean | ||
28 | #. Description | ||
29 | #: ../openssh-server.templates:1001 | ||
30 | msgid "" | ||
31 | "Previous versions of openssh-server permitted logging in as root over SSH " | ||
32 | "using password authentication. The default for new installations is now " | ||
33 | "\"PermitRootLogin prohibit-password\", which disables password " | ||
34 | "authentication for root without breaking systems that have explicitly " | ||
35 | "configured SSH public key authentication for root." | ||
36 | msgstr "" | ||
37 | "Versões anteriores do openssh-server permitiam login como root sobre SSH " | ||
38 | "usando autenticação por senha. O padrão para as novas instalações agora é " | ||
39 | "\"PermitRootLogin prohibit-password\", que desabilita a autenticação por " | ||
40 | "senha para root sem quebrar sistemas que tenham configurado explicitamente o " | ||
41 | "SSH para autenticação por chave pública para root." | ||
42 | |||
43 | #. Type: boolean | ||
44 | #. Description | ||
45 | #: ../openssh-server.templates:1001 | ||
46 | msgid "" | ||
47 | "This change makes systems more secure against brute-force password " | ||
48 | "dictionary attacks on the root user (a very common target for such attacks). " | ||
49 | "However, it may break systems that are set up with the expectation of being " | ||
50 | "able to SSH as root using password authentication. You should only make this " | ||
51 | "change if you do not need to do that." | ||
52 | msgstr "" | ||
53 | "Esta alteração torna sistemas mais seguros contra ataques de força bruta por " | ||
54 | "dicionário de senhas no usuário root (um alvo muito comum destes ataques). " | ||
55 | "Entretanto, ela pode quebrar sistemas que foram configurados com a " | ||
56 | "expectativa de acesso SSH com root usando autenticação por senha. Você deve " | ||
57 | "fazer esta mudança somente se você não precisa fazer isso." | ||
diff --git a/debian/po/ru.po b/debian/po/ru.po new file mode 100644 index 000000000..f2e1dafc4 --- /dev/null +++ b/debian/po/ru.po | |||
@@ -0,0 +1,57 @@ | |||
1 | # Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER | ||
2 | # This file is distributed under the same license as the openssh package. | ||
3 | # | ||
4 | # Yuri Kozlov <yuray@komyakino.ru>, 2014. | ||
5 | msgid "" | ||
6 | msgstr "" | ||
7 | "Project-Id-Version: openssh 1:6.6p1-1\n" | ||
8 | "Report-Msgid-Bugs-To: openssh@packages.debian.org\n" | ||
9 | "POT-Creation-Date: 2014-03-20 02:06+0000\n" | ||
10 | "PO-Revision-Date: 2014-03-22 10:04+0400\n" | ||
11 | "Last-Translator: Yuri Kozlov <yuray@komyakino.ru>\n" | ||
12 | "Language-Team: Russian <debian-l10n-russian@lists.debian.org>\n" | ||
13 | "Language: ru\n" | ||
14 | "MIME-Version: 1.0\n" | ||
15 | "Content-Type: text/plain; charset=UTF-8\n" | ||
16 | "Content-Transfer-Encoding: 8bit\n" | ||
17 | "Plural-Forms: nplurals=3; plural=(n%10==1 && n%100!=11 ? 0 : n%10>=2 && n" | ||
18 | "%10<=4 && (n%100<10 || n%100>=20) ? 1 : 2);\n" | ||
19 | "X-Generator: Lokalize 1.4\n" | ||
20 | |||
21 | #. Type: boolean | ||
22 | #. Description | ||
23 | #: ../openssh-server.templates:1001 | ||
24 | msgid "Disable SSH password authentication for root?" | ||
25 | msgstr "Выключить в SSH аутентификацию по паролю для root?" | ||
26 | |||
27 | #. Type: boolean | ||
28 | #. Description | ||
29 | #: ../openssh-server.templates:1001 | ||
30 | msgid "" | ||
31 | "Previous versions of openssh-server permitted logging in as root over SSH " | ||
32 | "using password authentication. The default for new installations is now " | ||
33 | "\"PermitRootLogin prohibit-password\", which disables password " | ||
34 | "authentication for root without breaking systems that have explicitly " | ||
35 | "configured SSH public key authentication for root." | ||
36 | msgstr "" | ||
37 | "В предыдущих версиях openssh-server разрешён вход с правами пользователя " | ||
38 | "root через SSH с помощью аутентификации по паролю. При новых установках по " | ||
39 | "умолчанию теперь используется настройка «PermitRootLogin prohibit-password», " | ||
40 | "которая отключает аутентификацию по паролю для root, что не вредит системам, " | ||
41 | "у которых в SSH для root настроена аутентификация по открытому ключу." | ||
42 | |||
43 | #. Type: boolean | ||
44 | #. Description | ||
45 | #: ../openssh-server.templates:1001 | ||
46 | msgid "" | ||
47 | "This change makes systems more secure against brute-force password " | ||
48 | "dictionary attacks on the root user (a very common target for such attacks). " | ||
49 | "However, it may break systems that are set up with the expectation of being " | ||
50 | "able to SSH as root using password authentication. You should only make this " | ||
51 | "change if you do not need to do that." | ||
52 | msgstr "" | ||
53 | "Это изменение делает системы более стойкими к атакам методом перебора " | ||
54 | "словарных паролей для пользователя root (самая распространённая цель таких " | ||
55 | "атак). Однако, это вредит системам, в которых специально настроен вход для " | ||
56 | "root по SSH с парольной аутентификацией. Если это не ваш случай, то ответьте " | ||
57 | "утвердительно." | ||
diff --git a/debian/po/sv.po b/debian/po/sv.po new file mode 100644 index 000000000..278b0ccbf --- /dev/null +++ b/debian/po/sv.po | |||
@@ -0,0 +1,58 @@ | |||
1 | # Swedish translations for openssh package | ||
2 | # Svenska översättningar för paket openssh. | ||
3 | # Copyright (C) 2014 THE openssh'S COPYRIGHT HOLDER | ||
4 | # This file is distributed under the same license as the openssh package. | ||
5 | # Andreas Rönnquist <gusnan@gusnan.se>, 2014. | ||
6 | # | ||
7 | msgid "" | ||
8 | msgstr "" | ||
9 | "Project-Id-Version: openssh\n" | ||
10 | "Report-Msgid-Bugs-To: openssh@packages.debian.org\n" | ||
11 | "POT-Creation-Date: 2014-03-20 02:06+0000\n" | ||
12 | "PO-Revision-Date: 2014-03-21 21:36+0100\n" | ||
13 | "Last-Translator: Andreas Rönnquist <gusnan@gusnan.se>\n" | ||
14 | "Language-Team: Swedish\n" | ||
15 | "Language: sv\n" | ||
16 | "MIME-Version: 1.0\n" | ||
17 | "Content-Type: text/plain; charset=UTF-8\n" | ||
18 | "Content-Transfer-Encoding: 8bit\n" | ||
19 | "Plural-Forms: nplurals=2; plural=(n != 1);\n" | ||
20 | |||
21 | #. Type: boolean | ||
22 | #. Description | ||
23 | #: ../openssh-server.templates:1001 | ||
24 | msgid "Disable SSH password authentication for root?" | ||
25 | msgstr "Inaktivera SSH-lösenordsautentisering för root?" | ||
26 | |||
27 | #. Type: boolean | ||
28 | #. Description | ||
29 | #: ../openssh-server.templates:1001 | ||
30 | msgid "" | ||
31 | "Previous versions of openssh-server permitted logging in as root over SSH " | ||
32 | "using password authentication. The default for new installations is now " | ||
33 | "\"PermitRootLogin prohibit-password\", which disables password " | ||
34 | "authentication for root without breaking systems that have explicitly " | ||
35 | "configured SSH public key authentication for root." | ||
36 | msgstr "" | ||
37 | "Tidigare versioner av openssh-server tillät inloggning som root över SSH med " | ||
38 | "hjälp av lösenordsautentisering. Standardinställningen för nya " | ||
39 | "installationer är nu \"PermitRootLogin prohibit-password\", vilket " | ||
40 | "inaktiverar lösenordsautentisering för root utan att förstöra system som " | ||
41 | "explicit har konfigurerat nyckelautentisering med hjälp av publika nycklar " | ||
42 | "för root." | ||
43 | |||
44 | #. Type: boolean | ||
45 | #. Description | ||
46 | #: ../openssh-server.templates:1001 | ||
47 | msgid "" | ||
48 | "This change makes systems more secure against brute-force password " | ||
49 | "dictionary attacks on the root user (a very common target for such attacks). " | ||
50 | "However, it may break systems that are set up with the expectation of being " | ||
51 | "able to SSH as root using password authentication. You should only make this " | ||
52 | "change if you do not need to do that." | ||
53 | msgstr "" | ||
54 | "Denna förändring gör system säkrare mot brute-force-angrepp med hjälp av " | ||
55 | "ordlistor med lösenord på root-användaren (ett väldigt vanligt mål för " | ||
56 | "sådana angrepp). Dock så kan detta förstöra system som förväntas kunna " | ||
57 | "använda SSH som root med hjälp av lösenordsautentisering. Du skall endast " | ||
58 | "göra denna förändring om du inte har ett behov av att kunna göra detta." | ||
diff --git a/debian/po/templates.pot b/debian/po/templates.pot new file mode 100644 index 000000000..47c9e3686 --- /dev/null +++ b/debian/po/templates.pot | |||
@@ -0,0 +1,46 @@ | |||
1 | # SOME DESCRIPTIVE TITLE. | ||
2 | # Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER | ||
3 | # This file is distributed under the same license as the PACKAGE package. | ||
4 | # FIRST AUTHOR <EMAIL@ADDRESS>, YEAR. | ||
5 | # | ||
6 | #, fuzzy | ||
7 | msgid "" | ||
8 | msgstr "" | ||
9 | "Project-Id-Version: openssh\n" | ||
10 | "Report-Msgid-Bugs-To: openssh@packages.debian.org\n" | ||
11 | "POT-Creation-Date: 2014-03-20 02:06+0000\n" | ||
12 | "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" | ||
13 | "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n" | ||
14 | "Language-Team: LANGUAGE <LL@li.org>\n" | ||
15 | "Language: \n" | ||
16 | "MIME-Version: 1.0\n" | ||
17 | "Content-Type: text/plain; charset=CHARSET\n" | ||
18 | "Content-Transfer-Encoding: 8bit\n" | ||
19 | |||
20 | #. Type: boolean | ||
21 | #. Description | ||
22 | #: ../openssh-server.templates:1001 | ||
23 | msgid "Disable SSH password authentication for root?" | ||
24 | msgstr "" | ||
25 | |||
26 | #. Type: boolean | ||
27 | #. Description | ||
28 | #: ../openssh-server.templates:1001 | ||
29 | msgid "" | ||
30 | "Previous versions of openssh-server permitted logging in as root over SSH " | ||
31 | "using password authentication. The default for new installations is now " | ||
32 | "\"PermitRootLogin prohibit-password\", which disables password " | ||
33 | "authentication for root without breaking systems that have explicitly " | ||
34 | "configured SSH public key authentication for root." | ||
35 | msgstr "" | ||
36 | |||
37 | #. Type: boolean | ||
38 | #. Description | ||
39 | #: ../openssh-server.templates:1001 | ||
40 | msgid "" | ||
41 | "This change makes systems more secure against brute-force password " | ||
42 | "dictionary attacks on the root user (a very common target for such attacks). " | ||
43 | "However, it may break systems that are set up with the expectation of being " | ||
44 | "able to SSH as root using password authentication. You should only make this " | ||
45 | "change if you do not need to do that." | ||
46 | msgstr "" | ||
diff --git a/debian/po/tr.po b/debian/po/tr.po new file mode 100644 index 000000000..1ada04101 --- /dev/null +++ b/debian/po/tr.po | |||
@@ -0,0 +1,58 @@ | |||
1 | # Turkish translation of openssh package | ||
2 | # Copyright (C) 2014 Mert Dirik | ||
3 | # This file is distributed under the same license as the openssh package. | ||
4 | # Mert Dirik <mertdirik@gmail.com>, 2014. | ||
5 | # | ||
6 | msgid "" | ||
7 | msgstr "" | ||
8 | "Project-Id-Version: openssh-server\n" | ||
9 | "Report-Msgid-Bugs-To: openssh@packages.debian.org\n" | ||
10 | "POT-Creation-Date: 2014-03-20 02:06+0000\n" | ||
11 | "PO-Revision-Date: 2014-08-01 14:44+0200\n" | ||
12 | "Last-Translator: Mert Dirik <mertdirik@gmail.com>\n" | ||
13 | "Language-Team: Debian L10n Turkish <debian-l10n-turkish@lists.debian.org>\n" | ||
14 | "MIME-Version: 1.0\n" | ||
15 | "Content-Type: text/plain; charset=UTF-8\n" | ||
16 | "Content-Transfer-Encoding: 8bit\n" | ||
17 | "X-Generator: Poedit 1.5.4\n" | ||
18 | "Language: tr\n" | ||
19 | |||
20 | #. Type: boolean | ||
21 | #. Description | ||
22 | #: ../openssh-server.templates:1001 | ||
23 | msgid "Disable SSH password authentication for root?" | ||
24 | msgstr "root kullanıcısının parola ile kimlik doğrulaması engellensin mi?" | ||
25 | |||
26 | #. Type: boolean | ||
27 | #. Description | ||
28 | #: ../openssh-server.templates:1001 | ||
29 | msgid "" | ||
30 | "Previous versions of openssh-server permitted logging in as root over SSH " | ||
31 | "using password authentication. The default for new installations is now " | ||
32 | "\"PermitRootLogin prohibit-password\", which disables password " | ||
33 | "authentication for root without breaking systems that have explicitly " | ||
34 | "configured SSH public key authentication for root." | ||
35 | msgstr "" | ||
36 | "openssh-server'ın önceki sürümleri parola ile kimlik doğrulama kullanılarak " | ||
37 | "root kullanıcısının SSH üzerinden oturum açmasına izin veriyordu. Artık yeni " | ||
38 | "kurulumların öntanımlı ayarı \"PermitRootLogin prohibit-password\" " | ||
39 | "şeklindedir. Bu ayar root kullanıcısının parola kullanarak oturum açmasını " | ||
40 | "yasaklar. SSH genel anahtar doğrulama yöntemine ayrıca izin veren mevcut " | ||
41 | "sistemler bu ayardan etkilenmez." | ||
42 | |||
43 | #. Type: boolean | ||
44 | #. Description | ||
45 | #: ../openssh-server.templates:1001 | ||
46 | msgid "" | ||
47 | "This change makes systems more secure against brute-force password " | ||
48 | "dictionary attacks on the root user (a very common target for such attacks). " | ||
49 | "However, it may break systems that are set up with the expectation of being " | ||
50 | "able to SSH as root using password authentication. You should only make this " | ||
51 | "change if you do not need to do that." | ||
52 | msgstr "" | ||
53 | "Bu ayar sistemleri kaba kuvvet sözlükten parola saldırılarına karşı güvenli " | ||
54 | "hale getirir (root kullanıcısı bu tarz saldırıların en büyük " | ||
55 | "hedeflerindendir). Fakat bu ayarın etkinleştirilmesi, root kullanıcısına " | ||
56 | "parola doğrulama yöntemiyle oturum açılabileceği varsayımıyla hareket eden " | ||
57 | "sistemlerde eskiden çalışan düzenin bozulmasına sebep olacaktır. Bu " | ||
58 | "değişikliği yalnızca sorun çıkarmayacağından eminseniz yapın." | ||
diff --git a/debian/rules b/debian/rules new file mode 100755 index 000000000..c1aa9785c --- /dev/null +++ b/debian/rules | |||
@@ -0,0 +1,243 @@ | |||
1 | #!/usr/bin/make -f | ||
2 | |||
3 | # Uncomment this to turn on verbose mode. | ||
4 | # export DH_VERBOSE=1 | ||
5 | |||
6 | # This has to be exported to make some magic below work. | ||
7 | export DH_OPTIONS | ||
8 | |||
9 | ifeq (,$(filter nocheck,$(DEB_BUILD_OPTIONS))) | ||
10 | RUN_TESTS := yes | ||
11 | else | ||
12 | RUN_TESTS := | ||
13 | endif | ||
14 | |||
15 | ifeq (,$(filter parallel=%,$(DEB_BUILD_OPTIONS))) | ||
16 | PARALLEL := | ||
17 | else | ||
18 | PARALLEL := \ | ||
19 | -j$(patsubst parallel=%,%,$(filter parallel=%,$(DEB_BUILD_OPTIONS))) | ||
20 | endif | ||
21 | |||
22 | DEB_HOST_GNU_TYPE ?= $(shell dpkg-architecture -qDEB_HOST_GNU_TYPE) | ||
23 | DEB_BUILD_GNU_TYPE ?= $(shell dpkg-architecture -qDEB_BUILD_GNU_TYPE) | ||
24 | DEB_HOST_ARCH ?= $(shell dpkg-architecture -qDEB_HOST_ARCH) | ||
25 | |||
26 | ifeq ($(DEB_BUILD_GNU_TYPE),$(DEB_HOST_GNU_TYPE)) | ||
27 | CC := gcc | ||
28 | PKG_CONFIG = pkg-config | ||
29 | else | ||
30 | CC := $(DEB_HOST_GNU_TYPE)-gcc | ||
31 | PKG_CONFIG = $(DEB_HOST_GNU_TYPE)-pkg-config | ||
32 | RUN_TESTS := | ||
33 | endif | ||
34 | |||
35 | DEB_HOST_ARCH_OS := $(shell dpkg-architecture -qDEB_HOST_ARCH_OS 2>/dev/null) | ||
36 | |||
37 | # Take account of old dpkg-architecture output. | ||
38 | ifeq ($(DEB_HOST_ARCH_OS),) | ||
39 | DEB_HOST_ARCH_OS := $(subst -gnu,,$(shell dpkg-architecture -qDEB_HOST_GNU_SYSTEM)) | ||
40 | ifeq ($(DEB_HOST_ARCH_OS),gnu) | ||
41 | DEB_HOST_ARCH_OS := hurd | ||
42 | endif | ||
43 | endif | ||
44 | |||
45 | # Change the version string to reflect distribution | ||
46 | DISTRIBUTION := $(shell dpkg-vendor --query vendor) | ||
47 | SSH_EXTRAVERSION := $(DISTRIBUTION)-$(shell dpkg-parsechangelog | sed -n -e '/^Version:/s/Version: //p' | sed -e 's/[^-]*-//') | ||
48 | |||
49 | DISTRIBUTOR := $(shell if dpkg-vendor --derives-from Ubuntu 2>/dev/null; then echo Ubuntu; else echo Debian; fi) | ||
50 | ifeq ($(DISTRIBUTOR),Ubuntu) | ||
51 | DEFAULT_PATH := /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games | ||
52 | else | ||
53 | DEFAULT_PATH := /usr/local/bin:/usr/bin:/bin:/usr/games | ||
54 | endif | ||
55 | SUPERUSER_PATH := /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin | ||
56 | |||
57 | ifeq ($(DISTRIBUTOR),Ubuntu) | ||
58 | server_recommends := ssh-import-id | ||
59 | else | ||
60 | server_recommends := | ||
61 | endif | ||
62 | |||
63 | # Common path configuration. | ||
64 | confflags += --sysconfdir=/etc/ssh | ||
65 | confflags += --libexecdir=\$${prefix}/lib/openssh | ||
66 | |||
67 | # Common build options. | ||
68 | confflags += --disable-strip | ||
69 | confflags += --with-mantype=doc | ||
70 | confflags += --with-4in6 | ||
71 | confflags += --with-privsep-path=/run/sshd | ||
72 | confflags += --with-pid-dir=/run | ||
73 | |||
74 | # The Hurd needs libcrypt for res_query et al. | ||
75 | ifeq ($(DEB_HOST_ARCH_OS),hurd) | ||
76 | confflags += --with-libs=-lcrypt | ||
77 | endif | ||
78 | |||
79 | # http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60155 | ||
80 | ifeq ($(DEB_HOST_ARCH),hppa) | ||
81 | confflags += --without-hardening | ||
82 | endif | ||
83 | |||
84 | # Everything above here is common to the deb and udeb builds. | ||
85 | confflags_udeb := $(confflags) | ||
86 | |||
87 | # Options specific to the deb build. | ||
88 | confflags += --with-tcp-wrappers | ||
89 | confflags += --with-pam | ||
90 | confflags += --with-libedit | ||
91 | confflags += --with-kerberos5=/usr | ||
92 | confflags += --with-ssl-engine | ||
93 | ifeq ($(DEB_HOST_ARCH_OS),linux) | ||
94 | confflags += --with-selinux | ||
95 | confflags += --with-audit=linux | ||
96 | confflags += --with-systemd | ||
97 | endif | ||
98 | |||
99 | # The deb build wants xauth; the udeb build doesn't. | ||
100 | confflags += --with-xauth=/usr/bin/xauth | ||
101 | confflags_udeb += --without-xauth | ||
102 | |||
103 | # Default paths. The udeb build has /usr/games removed. | ||
104 | confflags += --with-default-path=$(DEFAULT_PATH) --with-superuser-path=$(SUPERUSER_PATH) | ||
105 | confflags_udeb += --with-default-path=/usr/local/bin:/usr/bin:/bin --with-superuser-path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin | ||
106 | |||
107 | # Compiler flags. | ||
108 | export DEB_BUILD_MAINT_OPTIONS := hardening=+all | ||
109 | include /usr/share/dpkg/buildflags.mk | ||
110 | cflags := $(CPPFLAGS) $(CFLAGS) | ||
111 | cflags += -DSSH_EXTRAVERSION=\"$(SSH_EXTRAVERSION)\" | ||
112 | cflags_udeb := -Os | ||
113 | cflags_udeb += -DSSH_EXTRAVERSION=\"$(SSH_EXTRAVERSION)\" | ||
114 | confflags += --with-cflags='$(cflags)' | ||
115 | confflags_udeb += --with-cflags='$(cflags_udeb)' | ||
116 | |||
117 | # Linker flags. | ||
118 | confflags += --with-ldflags='$(strip -Wl,--as-needed $(LDFLAGS))' | ||
119 | confflags_udeb += --with-ldflags='-Wl,--as-needed' | ||
120 | |||
121 | %: | ||
122 | dh $@ --with=autoreconf,systemd | ||
123 | |||
124 | autoreconf: | ||
125 | autoreconf -f -i | ||
126 | cp -f /usr/share/misc/config.guess /usr/share/misc/config.sub ./ | ||
127 | |||
128 | override_dh_autoreconf-arch: | ||
129 | dh_autoreconf debian/rules -- autoreconf | ||
130 | |||
131 | override_dh_autoreconf-indep: | ||
132 | |||
133 | override_dh_auto_configure-arch: | ||
134 | dh_auto_configure -Bdebian/build-deb -- $(confflags) | ||
135 | dh_auto_configure -Bdebian/build-deb-ssh1 -- $(confflags) --with-ssh1 | ||
136 | dh_auto_configure -Bdebian/build-udeb -- $(confflags_udeb) | ||
137 | |||
138 | override_dh_auto_configure-indep: | ||
139 | |||
140 | override_dh_auto_build-arch: | ||
141 | # Avoid libnsl linkage. Ugh. | ||
142 | perl -pi -e 's/ +-lnsl//' debian/build-udeb/config.status | ||
143 | cd debian/build-udeb && ./config.status | ||
144 | |||
145 | $(MAKE) -C debian/build-deb $(PARALLEL) ASKPASS_PROGRAM='/usr/bin/ssh-askpass' | ||
146 | $(MAKE) -C debian/build-deb-ssh1 $(PARALLEL) SSH_PROGRAM='/usr/bin/ssh1' ASKPASS_PROGRAM='/usr/bin/ssh-askpass' ssh scp ssh-keygen | ||
147 | $(MAKE) -C debian/build-udeb $(PARALLEL) ASKPASS_PROGRAM='/usr/bin/ssh-askpass' ssh scp sftp sshd ssh-keygen | ||
148 | |||
149 | $(MAKE) -C contrib gnome-ssh-askpass3 CC='$(CC) $(CPPFLAGS) $(CFLAGS) -Wall -Wl,--as-needed $(LDFLAGS)' PKG_CONFIG=$(PKG_CONFIG) | ||
150 | |||
151 | override_dh_auto_build-indep: | ||
152 | |||
153 | override_dh_auto_test-arch: | ||
154 | ifeq ($(RUN_TESTS),yes) | ||
155 | $(MAKE) -C debian/build-deb regress-prep | ||
156 | $(MAKE) -C debian/build-deb $(PARALLEL) regress-binaries | ||
157 | $(MAKE) -C debian/build-deb/regress \ | ||
158 | .OBJDIR="$(CURDIR)/debian/build-deb/regress" \ | ||
159 | .CURDIR="$(CURDIR)/regress" \ | ||
160 | unit | ||
161 | $(MAKE) -C debian/build-deb compat-tests | ||
162 | $(MAKE) -C debian/keygen-test | ||
163 | endif | ||
164 | |||
165 | override_dh_auto_test-indep: | ||
166 | |||
167 | override_dh_auto_clean: | ||
168 | rm -rf debian/build-deb debian/build-deb-ssh1 debian/build-udeb | ||
169 | ifeq ($(RUN_TESTS),yes) | ||
170 | $(MAKE) -C debian/keygen-test clean | ||
171 | endif | ||
172 | $(MAKE) -C contrib clean | ||
173 | |||
174 | override_dh_auto_install-arch: | ||
175 | $(MAKE) -C debian/build-deb DESTDIR=`pwd`/debian/tmp install-nokeys | ||
176 | |||
177 | override_dh_auto_install-indep: | ||
178 | |||
179 | override_dh_install-arch: | ||
180 | rm -f debian/tmp/etc/ssh/sshd_config | ||
181 | |||
182 | dh_install -Nopenssh-client-udeb -Nopenssh-server-udeb --fail-missing | ||
183 | dh_install -popenssh-client-udeb -popenssh-server-udeb \ | ||
184 | --sourcedir=debian/build-udeb | ||
185 | |||
186 | # Remove version control tags to avoid unnecessary conffile | ||
187 | # resolution steps for administrators. | ||
188 | sed -i '/\$$OpenBSD:/d' \ | ||
189 | debian/openssh-client/etc/ssh/moduli \ | ||
190 | debian/openssh-client/etc/ssh/ssh_config | ||
191 | |||
192 | # We'd like to use dh_install --fail-missing here, but that doesn't work | ||
193 | # well in combination with dh-exec: it complains that files generated by | ||
194 | # dh-exec for architecture-dependent packages aren't installed. | ||
195 | override_dh_install-indep: | ||
196 | rm -f debian/tmp/etc/ssh/sshd_config | ||
197 | dh_install | ||
198 | |||
199 | override_dh_installdocs: | ||
200 | dh_installdocs \ | ||
201 | -Nopenssh-client-ssh1 -Nopenssh-server -Nopenssh-sftp-server | ||
202 | dh_installdocs \ | ||
203 | -popenssh-client-ssh1 -popenssh-server -popenssh-sftp-server \ | ||
204 | --link-doc=openssh-client | ||
205 | # Avoid breaking dh_installexamples later. | ||
206 | mkdir -p debian/openssh-server/usr/share/doc/openssh-client | ||
207 | |||
208 | override_dh_systemd_enable: | ||
209 | dh_systemd_enable -popenssh-server --name ssh ssh.service | ||
210 | dh_systemd_enable -popenssh-server --name ssh --no-enable ssh.socket | ||
211 | |||
212 | override_dh_installinit: | ||
213 | dh_installinit -R --name ssh | ||
214 | |||
215 | debian/openssh-server.sshd.pam: debian/openssh-server.sshd.pam.in | ||
216 | ifeq ($(DEB_HOST_ARCH_OS),linux) | ||
217 | sed 's/^@IF_KEYINIT@//' $< > $@ | ||
218 | else | ||
219 | sed '/^@IF_KEYINIT@/d' $< > $@ | ||
220 | endif | ||
221 | |||
222 | override_dh_installpam: debian/openssh-server.sshd.pam | ||
223 | dh_installpam --name sshd | ||
224 | |||
225 | override_dh_fixperms-arch: | ||
226 | dh_fixperms | ||
227 | chmod u+s debian/openssh-client/usr/lib/openssh/ssh-keysign | ||
228 | |||
229 | # Tighten libssl dependencies to match the check in entropy.c. | ||
230 | override_dh_shlibdeps: | ||
231 | dh_shlibdeps | ||
232 | debian/adjust-openssl-dependencies | ||
233 | |||
234 | override_dh_gencontrol: | ||
235 | dh_gencontrol -- -V'openssh-server:Recommends=$(server_recommends)' | ||
236 | |||
237 | override_dh_builddeb: | ||
238 | dh_builddeb -- -Zxz | ||
239 | |||
240 | debian/faq.html: | ||
241 | wget -O - http://www.openssh.com/faq.html | \ | ||
242 | sed 's,\(href="\)\(txt/\|[^":]*\.html\),\1http://www.openssh.com/\2,g' \ | ||
243 | > debian/faq.html | ||
diff --git a/debian/source/format b/debian/source/format new file mode 100644 index 000000000..163aaf8d8 --- /dev/null +++ b/debian/source/format | |||
@@ -0,0 +1 @@ | |||
3.0 (quilt) | |||
diff --git a/debian/source/include-binaries b/debian/source/include-binaries new file mode 100644 index 000000000..df5790e2e --- /dev/null +++ b/debian/source/include-binaries | |||
@@ -0,0 +1 @@ | |||
debian/ssh-askpass-gnome.png | |||
diff --git a/debian/ssh-agent.user-session.upstart b/debian/ssh-agent.user-session.upstart new file mode 100644 index 000000000..672d2a0de --- /dev/null +++ b/debian/ssh-agent.user-session.upstart | |||
@@ -0,0 +1,7 @@ | |||
1 | description "SSH Agent" | ||
2 | author "Stéphane Graber <stgraber@ubuntu.com>" | ||
3 | |||
4 | start on starting xsession-init | ||
5 | |||
6 | exec /usr/lib/openssh/agent-launch start | ||
7 | post-stop exec /usr/lib/openssh/agent-launch stop | ||
diff --git a/debian/ssh-argv0 b/debian/ssh-argv0 new file mode 100644 index 000000000..37506a4d7 --- /dev/null +++ b/debian/ssh-argv0 | |||
@@ -0,0 +1,31 @@ | |||
1 | #! /bin/sh | ||
2 | set -e | ||
3 | |||
4 | # Copyright (c) 2001 Jonathan Amery. | ||
5 | # | ||
6 | # Redistribution and use in source and binary forms, with or without | ||
7 | # modification, are permitted provided that the following conditions | ||
8 | # are met: | ||
9 | # 1. Redistributions of source code must retain the above copyright | ||
10 | # notice, this list of conditions and the following disclaimer. | ||
11 | # 2. Redistributions in binary form must reproduce the above copyright | ||
12 | # notice, this list of conditions and the following disclaimer in the | ||
13 | # documentation and/or other materials provided with the distribution. | ||
14 | # | ||
15 | # THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR | ||
16 | # IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES | ||
17 | # OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. | ||
18 | # IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, | ||
19 | # INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT | ||
20 | # NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, | ||
21 | # DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY | ||
22 | # THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT | ||
23 | # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF | ||
24 | # THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | ||
25 | |||
26 | if [ "${0##*/}" = "ssh-argv0" ] | ||
27 | then | ||
28 | echo 'ssh-argv0: This script should not be run like this, see ssh-argv0(1) for details' 1>&2 | ||
29 | exit 1 | ||
30 | fi | ||
31 | exec ssh "${0##*/}" "$@" | ||
diff --git a/debian/ssh-argv0.1 b/debian/ssh-argv0.1 new file mode 100644 index 000000000..a36a63d40 --- /dev/null +++ b/debian/ssh-argv0.1 | |||
@@ -0,0 +1,64 @@ | |||
1 | .Dd September 7, 2001 | ||
2 | .Dt SSH-ARGV0 1 | ||
3 | .Os Debian Project | ||
4 | .Sh NAME | ||
5 | .Nm ssh-argv0 | ||
6 | .Nd replaces the old ssh command-name as hostname handling | ||
7 | .Sh SYNOPSIS | ||
8 | .Ar hostname | user@hostname | ||
9 | .Op Fl l Ar login_name | ||
10 | .Op Ar command | ||
11 | .Pp | ||
12 | .Ar hostname | user@hostname | ||
13 | .Op Fl afgknqstvxACNTX1246 | ||
14 | .Op Fl b Ar bind_address | ||
15 | .Op Fl c Ar cipher_spec | ||
16 | .Op Fl e Ar escape_char | ||
17 | .Op Fl i Ar identity_file | ||
18 | .Op Fl l Ar login_name | ||
19 | .Op Fl m Ar mac_spec | ||
20 | .Op Fl o Ar option | ||
21 | .Op Fl p Ar port | ||
22 | .Op Fl F Ar configfile | ||
23 | .Oo Fl L Xo | ||
24 | .Sm off | ||
25 | .Ar port : | ||
26 | .Ar host : | ||
27 | .Ar hostport | ||
28 | .Sm on | ||
29 | .Xc | ||
30 | .Oc | ||
31 | .Oo Fl R Xo | ||
32 | .Sm off | ||
33 | .Ar port : | ||
34 | .Ar host : | ||
35 | .Ar hostport | ||
36 | .Sm on | ||
37 | .Xc | ||
38 | .Oc | ||
39 | .Op Fl D Ar port | ||
40 | .Op Ar command | ||
41 | .Sh DESCRIPTION | ||
42 | .Nm | ||
43 | replaces the old ssh command-name as hostname handling. | ||
44 | If you link to this script with a hostname then executing the link is | ||
45 | equivalent to having executed ssh with that hostname as an argument. | ||
46 | All other arguments are passed to ssh and will be processed normally. | ||
47 | .Sh OPTIONS | ||
48 | See | ||
49 | .Xr ssh 1 . | ||
50 | .Sh FILES | ||
51 | See | ||
52 | .Xr ssh 1 . | ||
53 | .Sh AUTHORS | ||
54 | OpenSSH is a derivative of the original and free | ||
55 | ssh 1.2.12 release by Tatu Ylonen. | ||
56 | Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos, | ||
57 | Theo de Raadt and Dug Song | ||
58 | removed many bugs, re-added newer features and | ||
59 | created OpenSSH. | ||
60 | Markus Friedl contributed the support for SSH | ||
61 | protocol versions 1.5 and 2.0. | ||
62 | Jonathan Amery wrote this ssh-argv0 script and the associated documentation. | ||
63 | .Sh SEE ALSO | ||
64 | .Xr ssh 1 | ||
diff --git a/debian/ssh-askpass-gnome.desktop b/debian/ssh-askpass-gnome.desktop new file mode 100644 index 000000000..eba7a67d1 --- /dev/null +++ b/debian/ssh-askpass-gnome.desktop | |||
@@ -0,0 +1,12 @@ | |||
1 | [Desktop Entry] | ||
2 | Version=1.0 | ||
3 | Encoding=UTF-8 | ||
4 | Name=SSH AskPass | ||
5 | GenericName=ssh-add | ||
6 | Comment=Enter passphrase to authenticate to the ssh agent | ||
7 | Exec=/usr/bin/ssh-add | ||
8 | TryExec=ssh-add | ||
9 | Terminal=false | ||
10 | Type=Application | ||
11 | Icon=ssh-askpass-gnome | ||
12 | Categories=Network;Security; | ||
diff --git a/debian/ssh-askpass-gnome.examples b/debian/ssh-askpass-gnome.examples new file mode 100644 index 000000000..66fd8c0e4 --- /dev/null +++ b/debian/ssh-askpass-gnome.examples | |||
@@ -0,0 +1 @@ | |||
debian/ssh-askpass-gnome.desktop | |||
diff --git a/debian/ssh-askpass-gnome.install b/debian/ssh-askpass-gnome.install new file mode 100755 index 000000000..8715aafaf --- /dev/null +++ b/debian/ssh-askpass-gnome.install | |||
@@ -0,0 +1,3 @@ | |||
1 | #! /usr/bin/dh-exec | ||
2 | contrib/gnome-ssh-askpass3 => usr/lib/openssh/gnome-ssh-askpass | ||
3 | debian/ssh-askpass-gnome.png usr/share/pixmaps | ||
diff --git a/debian/ssh-askpass-gnome.manpages b/debian/ssh-askpass-gnome.manpages new file mode 100644 index 000000000..7749f13bb --- /dev/null +++ b/debian/ssh-askpass-gnome.manpages | |||
@@ -0,0 +1 @@ | |||
debian/gnome-ssh-askpass.1 | |||
diff --git a/debian/ssh-askpass-gnome.png b/debian/ssh-askpass-gnome.png new file mode 100644 index 000000000..06f75764e --- /dev/null +++ b/debian/ssh-askpass-gnome.png | |||
Binary files differ | |||
diff --git a/debian/ssh-askpass-gnome.postinst b/debian/ssh-askpass-gnome.postinst new file mode 100644 index 000000000..8a454e520 --- /dev/null +++ b/debian/ssh-askpass-gnome.postinst | |||
@@ -0,0 +1,48 @@ | |||
1 | #! /bin/sh | ||
2 | # postinst script for ssh-askpass-gnome | ||
3 | # | ||
4 | # see: dh_installdeb(1) | ||
5 | |||
6 | set -e | ||
7 | |||
8 | # summary of how this script can be called: | ||
9 | # * <postinst> `configure' <most-recently-configured-version> | ||
10 | # * <old-postinst> `abort-upgrade' <new version> | ||
11 | # * <conflictor's-postinst> `abort-remove' `in-favour' <package> | ||
12 | # <new-version> | ||
13 | # * <deconfigured's-postinst> `abort-deconfigure' `in-favour' | ||
14 | # <failed-install-package> <version> `removing' | ||
15 | # <conflicting-package> <version> | ||
16 | # for details, see /usr/share/doc/packaging-manual/ | ||
17 | # | ||
18 | # quoting from the policy: | ||
19 | # Any necessary prompting should almost always be confined to the | ||
20 | # post-installation script, and should be protected with a conditional | ||
21 | # so that unnecessary prompting doesn't happen if a package's | ||
22 | # installation fails and the `postinst' is called with `abort-upgrade', | ||
23 | # `abort-remove' or `abort-deconfigure'. | ||
24 | |||
25 | case "$1" in | ||
26 | configure) | ||
27 | update-alternatives --quiet \ | ||
28 | --install /usr/bin/ssh-askpass ssh-askpass \ | ||
29 | /usr/lib/openssh/gnome-ssh-askpass 30 \ | ||
30 | --slave /usr/share/man/man1/ssh-askpass.1.gz \ | ||
31 | ssh-askpass.1.gz /usr/share/man/man1/gnome-ssh-askpass.1.gz | ||
32 | ;; | ||
33 | |||
34 | abort-upgrade|abort-remove|abort-deconfigure) | ||
35 | ;; | ||
36 | |||
37 | *) | ||
38 | echo "postinst called with unknown argument \`$1'" >&2 | ||
39 | exit 0 | ||
40 | ;; | ||
41 | esac | ||
42 | |||
43 | # dh_installdeb will replace this with shell code automatically | ||
44 | # generated by other debhelper scripts. | ||
45 | |||
46 | #DEBHELPER# | ||
47 | |||
48 | exit 0 | ||
diff --git a/debian/ssh-askpass-gnome.prerm b/debian/ssh-askpass-gnome.prerm new file mode 100644 index 000000000..0adcfc76b --- /dev/null +++ b/debian/ssh-askpass-gnome.prerm | |||
@@ -0,0 +1,39 @@ | |||
1 | #! /bin/sh | ||
2 | # prerm script for ssh-askpass-gnome | ||
3 | # | ||
4 | # see: dh_installdeb(1) | ||
5 | |||
6 | set -e | ||
7 | |||
8 | # summary of how this script can be called: | ||
9 | # * <prerm> `remove' | ||
10 | # * <old-prerm> `upgrade' <new-version> | ||
11 | # * <new-prerm> `failed-upgrade' <old-version> | ||
12 | # * <conflictor's-prerm> `remove' `in-favour' <package> <new-version> | ||
13 | # * <deconfigured's-prerm> `deconfigure' `in-favour' | ||
14 | # <package-being-installed> <version> `removing' | ||
15 | # <conflicting-package> <version> | ||
16 | # for details, see /usr/share/doc/packaging-manual/ | ||
17 | |||
18 | case "$1" in | ||
19 | remove|deconfigure) | ||
20 | update-alternatives --quiet --remove ssh-askpass /usr/lib/openssh/gnome-ssh-askpass | ||
21 | ;; | ||
22 | upgrade) | ||
23 | ;; | ||
24 | failed-upgrade) | ||
25 | ;; | ||
26 | *) | ||
27 | echo "prerm called with unknown argument \`$1'" >&2 | ||
28 | exit 0 | ||
29 | ;; | ||
30 | esac | ||
31 | |||
32 | # dh_installdeb will replace this with shell code automatically | ||
33 | # generated by other debhelper scripts. | ||
34 | |||
35 | #DEBHELPER# | ||
36 | |||
37 | exit 0 | ||
38 | |||
39 | |||
diff --git a/debian/ssh-krb5.NEWS b/debian/ssh-krb5.NEWS new file mode 100644 index 000000000..5a6433ab2 --- /dev/null +++ b/debian/ssh-krb5.NEWS | |||
@@ -0,0 +1,18 @@ | |||
1 | ssh-krb5 (1:4.3p2-7) unstable; urgency=low | ||
2 | |||
3 | The normal openssh-server and openssh-client packages in Debian now | ||
4 | include full GSSAPI support, including key exchange. This package is | ||
5 | now only a transitional package that depends on openssh-server and | ||
6 | openssh-client and configures openssh-server for GSSAPI authentication | ||
7 | if it wasn't already. | ||
8 | |||
9 | You can now simply install openssh-server and openssh-client directly | ||
10 | and remove this package. Just make sure that /etc/ssh/sshd_config | ||
11 | contains: | ||
12 | |||
13 | GSSAPIAuthentication yes | ||
14 | GSSAPIKeyExchange yes | ||
15 | |||
16 | if you want to support GSSAPI authentication to your ssh server. | ||
17 | |||
18 | -- Russ Allbery <rra@debian.org> Tue, 03 Oct 2006 22:27:27 -0700 | ||
diff --git a/debian/ssh-krb5.postinst b/debian/ssh-krb5.postinst new file mode 100644 index 000000000..f799accfe --- /dev/null +++ b/debian/ssh-krb5.postinst | |||
@@ -0,0 +1,61 @@ | |||
1 | #!/bin/sh | ||
2 | |||
3 | set -e | ||
4 | |||
5 | action="$1" | ||
6 | oldversion="$2" | ||
7 | |||
8 | if [ "$action" = configure ] ; then | ||
9 | # Make sure that GSSAPI is enabled. If there is no uncommented GSSAPI | ||
10 | # configuration, uncomment any commented-out configuration if present | ||
11 | # (this will catch the case of a fresh install of openssh-server). | ||
12 | # Otherwise, add configuration turning on GSSAPIAuthentication and | ||
13 | # GSSAPIKeyExchange. | ||
14 | # | ||
15 | # If there is some configuration, we may be upgrading from ssh-krb5. It | ||
16 | # enabled GSSAPIKeyExchange without any configuration option. Therefore, | ||
17 | # if it isn't explicitly set, always enable it for compatible behavior | ||
18 | # with ssh-krb5. | ||
19 | if dpkg --compare-versions "$oldversion" ge 1:4.3p2-9; then | ||
20 | : | ||
21 | else | ||
22 | changed= | ||
23 | if grep -qi '^[ ]*GSSAPI' /etc/ssh/sshd_config ; then | ||
24 | if grep -qi '^[ ]*GSSAPIKeyExchange' /etc/ssh/sshd_config ; then | ||
25 | : | ||
26 | else | ||
27 | changed=true | ||
28 | cat >> /etc/ssh/sshd_config <<EOF | ||
29 | |||
30 | # GSSAPI key exchange (added by ssh-krb5 transitional package) | ||
31 | GSSAPIKeyExchange yes | ||
32 | EOF | ||
33 | fi | ||
34 | else | ||
35 | changed=true | ||
36 | if grep -qi '^#GSSAPI' /etc/ssh/sshd_config ; then | ||
37 | perl -pe 's/^\#(GSSAPI(Authentication|KeyExchange))\b.*/$1 yes/i' \ | ||
38 | < /etc/ssh/sshd_config > /etc/ssh/sshd_config.dpkg-new | ||
39 | chown --reference /etc/ssh/sshd_config \ | ||
40 | /etc/ssh/sshd_config.dpkg-new | ||
41 | chmod --reference /etc/ssh/sshd_config \ | ||
42 | /etc/ssh/sshd_config.dpkg-new | ||
43 | mv /etc/ssh/sshd_config.dpkg-new /etc/ssh/sshd_config | ||
44 | else | ||
45 | cat >> /etc/ssh/sshd_config <<EOF | ||
46 | |||
47 | # GSSAPI authentication (added by ssh-krb5 transitional package) | ||
48 | GSSAPIAuthentication yes | ||
49 | GSSAPIKeyExchange yes | ||
50 | EOF | ||
51 | fi | ||
52 | fi | ||
53 | if [ -n "$changed" ]; then | ||
54 | invoke-rc.d ssh restart | ||
55 | fi | ||
56 | fi | ||
57 | fi | ||
58 | |||
59 | #DEBHELPER# | ||
60 | |||
61 | exit 0 | ||
diff --git a/debian/ssh.lintian-overrides b/debian/ssh.lintian-overrides new file mode 100644 index 000000000..b9bf7ea08 --- /dev/null +++ b/debian/ssh.lintian-overrides | |||
@@ -0,0 +1 @@ | |||
ssh: package-contains-empty-directory usr/share/doc/openssh-client/ | |||
diff --git a/debian/ssh.maintscript b/debian/ssh.maintscript new file mode 100644 index 000000000..efd370e25 --- /dev/null +++ b/debian/ssh.maintscript | |||
@@ -0,0 +1 @@ | |||
symlink_to_dir /usr/share/doc/ssh /usr/share/doc/openssh-client 1:6.6p1-8~ | |||
diff --git a/debian/systemd/ssh-agent.override b/debian/systemd/ssh-agent.override new file mode 100644 index 000000000..2905494b6 --- /dev/null +++ b/debian/systemd/ssh-agent.override | |||
@@ -0,0 +1 @@ | |||
manual | |||
diff --git a/debian/systemd/ssh-agent.service b/debian/systemd/ssh-agent.service new file mode 100644 index 000000000..2297f8f75 --- /dev/null +++ b/debian/systemd/ssh-agent.service | |||
@@ -0,0 +1,8 @@ | |||
1 | [Unit] | ||
2 | Description=OpenSSH Agent | ||
3 | Before=graphical-session-pre.target | ||
4 | ConditionPathExists=/etc/X11/Xsession.options | ||
5 | |||
6 | [Service] | ||
7 | ExecStart=/usr/lib/openssh/agent-launch start | ||
8 | ExecStopPost=/usr/lib/openssh/agent-launch stop | ||
diff --git a/debian/systemd/ssh-session-cleanup b/debian/systemd/ssh-session-cleanup new file mode 100755 index 000000000..f283cc967 --- /dev/null +++ b/debian/systemd/ssh-session-cleanup | |||
@@ -0,0 +1,11 @@ | |||
1 | #! /bin/sh | ||
2 | |||
3 | ssh_session_pattern='sshd: \S.*@pts/[0-9]+' | ||
4 | |||
5 | IFS="$IFS@" | ||
6 | pgrep -a -f "$ssh_session_pattern" | while read pid daemon user pty; do | ||
7 | echo "Found ${daemon%:} session $pid on $pty; sending SIGTERM" | ||
8 | kill "$pid" || true | ||
9 | done | ||
10 | |||
11 | exit 0 | ||
diff --git a/debian/systemd/ssh-session-cleanup.service b/debian/systemd/ssh-session-cleanup.service new file mode 100644 index 000000000..b86727227 --- /dev/null +++ b/debian/systemd/ssh-session-cleanup.service | |||
@@ -0,0 +1,13 @@ | |||
1 | [Unit] | ||
2 | Description=OpenBSD Secure Shell session cleanup | ||
3 | Wants=network.target | ||
4 | After=network.target | ||
5 | |||
6 | [Service] | ||
7 | ExecStart=/bin/true | ||
8 | ExecStop=/usr/lib/openssh/ssh-session-cleanup | ||
9 | RemainAfterExit=yes | ||
10 | Type=oneshot | ||
11 | |||
12 | [Install] | ||
13 | WantedBy=multi-user.target | ||
diff --git a/debian/systemd/ssh.service b/debian/systemd/ssh.service new file mode 100644 index 000000000..3df8c6426 --- /dev/null +++ b/debian/systemd/ssh.service | |||
@@ -0,0 +1,17 @@ | |||
1 | [Unit] | ||
2 | Description=OpenBSD Secure Shell server | ||
3 | After=network.target auditd.service | ||
4 | ConditionPathExists=!/etc/ssh/sshd_not_to_be_run | ||
5 | |||
6 | [Service] | ||
7 | EnvironmentFile=-/etc/default/ssh | ||
8 | ExecStart=/usr/sbin/sshd -D $SSHD_OPTS | ||
9 | ExecReload=/bin/kill -HUP $MAINPID | ||
10 | KillMode=process | ||
11 | Restart=on-failure | ||
12 | RestartPreventExitStatus=255 | ||
13 | Type=notify | ||
14 | |||
15 | [Install] | ||
16 | WantedBy=multi-user.target | ||
17 | Alias=sshd.service | ||
diff --git a/debian/systemd/ssh.socket b/debian/systemd/ssh.socket new file mode 100644 index 000000000..5a766dcab --- /dev/null +++ b/debian/systemd/ssh.socket | |||
@@ -0,0 +1,12 @@ | |||
1 | [Unit] | ||
2 | Description=OpenBSD Secure Shell server socket | ||
3 | Before=ssh.service | ||
4 | Conflicts=ssh.service | ||
5 | ConditionPathExists=!/etc/ssh/sshd_not_to_be_run | ||
6 | |||
7 | [Socket] | ||
8 | ListenStream=22 | ||
9 | Accept=yes | ||
10 | |||
11 | [Install] | ||
12 | WantedBy=sockets.target | ||
diff --git a/debian/systemd/ssh@.service b/debian/systemd/ssh@.service new file mode 100644 index 000000000..4b0801dbc --- /dev/null +++ b/debian/systemd/ssh@.service | |||
@@ -0,0 +1,8 @@ | |||
1 | [Unit] | ||
2 | Description=OpenBSD Secure Shell server per-connection daemon | ||
3 | After=auditd.service | ||
4 | |||
5 | [Service] | ||
6 | EnvironmentFile=-/etc/default/ssh | ||
7 | ExecStart=-/usr/sbin/sshd -i $SSHD_OPTS | ||
8 | StandardInput=socket | ||
diff --git a/debian/systemd/sshd.conf b/debian/systemd/sshd.conf new file mode 100644 index 000000000..4fbeba1e8 --- /dev/null +++ b/debian/systemd/sshd.conf | |||
@@ -0,0 +1 @@ | |||
d /run/sshd 0755 root root | |||
diff --git a/debian/tests/control b/debian/tests/control new file mode 100644 index 000000000..df8f9b847 --- /dev/null +++ b/debian/tests/control | |||
@@ -0,0 +1,11 @@ | |||
1 | Tests: regress | ||
2 | Restrictions: needs-root allow-stderr | ||
3 | Depends: devscripts, | ||
4 | openssh-client, | ||
5 | openssh-server, | ||
6 | openssh-sftp-server, | ||
7 | openssl, | ||
8 | putty-tools (>= 0.67-2), | ||
9 | python-twisted-conch (>= 1:15.5.0-1), | ||
10 | sudo, | ||
11 | @builddeps@, | ||
diff --git a/debian/tests/regress b/debian/tests/regress new file mode 100755 index 000000000..662526b54 --- /dev/null +++ b/debian/tests/regress | |||
@@ -0,0 +1,70 @@ | |||
1 | #! /bin/sh | ||
2 | set -e | ||
3 | |||
4 | if [ "$(id -un)" != openssh-tests ]; then | ||
5 | TMP="$ADTTMP/user" | ||
6 | |||
7 | cleanup () { | ||
8 | rm -rf "$TMP" | ||
9 | rm -f /etc/sudoers.d/openssh-tests | ||
10 | if id openssh-tests >/dev/null 2>&1; then | ||
11 | deluser --remove-home openssh-tests | ||
12 | fi | ||
13 | } | ||
14 | trap cleanup EXIT | ||
15 | |||
16 | adduser --disabled-password --gecos 'OpenSSH tests' openssh-tests | ||
17 | cat >/etc/sudoers.d/openssh-tests <<EOF | ||
18 | openssh-tests ALL = (ALL:ALL) NOPASSWD: ALL | ||
19 | EOF | ||
20 | chmod 440 /etc/sudoers.d/openssh-tests | ||
21 | mkdir -p "$TMP" | ||
22 | cp -a . "$TMP/tree" | ||
23 | chown -R openssh-tests:openssh-tests "$TMP" | ||
24 | sudo -u openssh-tests env TMP="$TMP" "$0" "$@" | ||
25 | exit "$?" | ||
26 | fi | ||
27 | |||
28 | # Don't use "make tests"; we want to test the installed version. | ||
29 | |||
30 | cd "$TMP/tree" | ||
31 | |||
32 | # We aren't actually going to use most of this build, but we need a basic | ||
33 | # build tree in place in order to be able to build the regression tests. | ||
34 | autoreconf -f -i | ||
35 | cp -f /usr/share/misc/config.guess /usr/share/misc/config.sub ./ | ||
36 | ./configure | ||
37 | make | ||
38 | |||
39 | # The defaults for TEST_SSH_* in regress/test-exec.sh use the system | ||
40 | # versions, but the top-level Makefile sets things up to test the just-built | ||
41 | # versions, so we must bypass the latter in order to work correctly under | ||
42 | # autopkgtest. | ||
43 | make regress-prep | ||
44 | make regress-binaries | ||
45 | |||
46 | SRCDIR="$(pwd)" | ||
47 | BUILDDIR="$SRCDIR" | ||
48 | ret=0 | ||
49 | annotate-output +%H:%M:%S.%N make -C regress \ | ||
50 | .OBJDIR="$BUILDDIR/regress" \ | ||
51 | .CURDIR="$SRCDIR/regress" \ | ||
52 | BUILDDIR="$BUILDDIR" \ | ||
53 | OBJ="$BUILDDIR/regress" \ | ||
54 | SUDO=sudo \ | ||
55 | TEST_SHELL='sh -x' \ | ||
56 | TEST_SSH_SFTPSERVER=/usr/lib/openssh/sftp-server \ | ||
57 | TEST_SSH_PLINK=plink \ | ||
58 | TEST_SSH_PUTTYGEN=puttygen \ | ||
59 | TEST_SSH_CONCH=conch \ | ||
60 | TEST_SSH_IPV6=yes \ | ||
61 | TEST_SSH_ECC=yes \ | ||
62 | tests interop-tests </dev/zero || ret="$?" | ||
63 | if [ "$ret" -ne 0 ]; then | ||
64 | for log in failed-regress.log failed-ssh.log failed-sshd.log; do | ||
65 | if [ -e "$BUILDDIR/regress/$log" ]; then | ||
66 | tail -v -n+0 "$BUILDDIR/regress/$log" | ||
67 | fi | ||
68 | done | ||
69 | fi | ||
70 | exit "$ret" | ||
diff --git a/debian/upstream/signing-key.asc b/debian/upstream/signing-key.asc new file mode 100644 index 000000000..ac41e6e22 --- /dev/null +++ b/debian/upstream/signing-key.asc | |||
@@ -0,0 +1,44 @@ | |||
1 | -----BEGIN PGP PUBLIC KEY BLOCK----- | ||
2 | Version: GnuPG v1 | ||
3 | |||
4 | mQGdBFKmggUBDICUNqm4cNh7tdEbwaNhbnwqLiHpILeXT6sddGI0Stz5ofB1uvIH | ||
5 | m9kXYG5XUUwlc5ywjIZm2JeuKqrd/6wAz5laLagFA6k86EZzzuBE3b5FxSQ4EN4K | ||
6 | 5XZEJo61xASEF7z1mQCiqoA6/F407ht7nNoiVE95kOmqJlv4cqbpCw3n8f2VW+mV | ||
7 | UH6MYRZVrYAC9NnJWv24rem2fjgFhNT1/bx44G7H9bVJqL7hMEGa+xYQBI3YT/ul | ||
8 | Eu9HYmLFVeiZm1gB1eKXW7jS4ctLl5uPrxayA5DX/qNB2yqgVVlIKFwUm8gGPGPO | ||
9 | nsNKo0xBseE7E0F/KeGpaT5aS9yFgPm9A652Jx9felYgb0e9Ipt3lxriPQwgF/cx | ||
10 | LGuP/WEbN5fpWFnuV0ViklusuVI2e8GHJGU5bQD5AlzvWu4Sv6oBOcDCabScydY7 | ||
11 | IxPBk/XBWCF9QDIa2qa32Mc9dYc8EnJszPeVCHX5hG23omDRmdLGLwH7F+CuBvCx | ||
12 | AKCymZtJl5DhRmnhdzRg9d+0VG4hLF7O06ANABEBAAG0H0RhbWllbiBNaWxsZXIg | ||
13 | PGRqbUBtaW5kcm90Lm9yZz6JAc0EEwECACcCGwMFCQ1H67ECHgECF4AFAlKmjJwE | ||
14 | CwkIBwYVCgkICwIFFgIDAQAACgkQ0+X1a22SDTB2TAx9E1ozPJKUGWJPZefqsSr8 | ||
15 | KsO6Dp3QuPrw2Zwgo2QfeCT+uzNA5AKCDIAaYEpVbQsvu4sDy8dAW1+HENCxVrMX | ||
16 | WG+SH41lcdAdI4io0PGHVQDl42R5jX3e9pfjYCQALVv5BDXddK6054nyxEmudQ3I | ||
17 | CFCYXIcqQbA1nfj3Uk06jGhuM99B2/akbxCoFSiUX9uHDZKNYAGpU7/FCF9xCZF4 | ||
18 | Kd9Twvyy17jDIg7km3/Q4Jy++VP8FyvE5JjBdLRQSBzSG9GCjv9fyKWW7S0bMY4D | ||
19 | 3SKKt/Jm1XchEMgpRr4eBpgCs3rxO1hXjzqm3te97uy6/q8CuJUtupJsPKc9Wh4+ | ||
20 | ogUZifC0ta7UrxZp8yZTRvPSUxYrlvDzM32VDLQ3FX6Y2i4VNo48PSJMA+BPUx7D | ||
21 | TcZKIXt457zsLD4jF4sRdwOk/QF/GXCkH2GAyKHWCPXIOe+jIXgiuajcqZm9cAWj | ||
22 | L3hidSohKfefvKkzsg75mDmjhvAtDncIbmImJNjXIe2PQU4iY9Vq5i0vlaVKgBgK | ||
23 | SohGBBARAgAGBQJSpovfAAoJEM6OywOG/5xInf8An0A7MPrfJIz2e643VEV4AX3d | ||
24 | O9+IAJ9MOsQiB4LnqtTcc9NBMHf9VLE46LkBnQRSpoIFAQyA1OdwfpwXKch+O00W | ||
25 | 1FsQSMcEjahGmo84WTroM/qjTd7Ysld300PMv3wkQn2WdhyTca/EmkW0fVTGSYs7 | ||
26 | Z3v5SpPf0prYSjmfu8WlXoz64ApdXqGHjj9KAeq2OuUtWrwobgiQEzU4Hxlz94X/ | ||
27 | 65BgG5k7OTyE3J6bgRcMwJCgCkwjK85wbbBkGH+Jo9o/Zw9TPczQcE7BmGYkkLNA | ||
28 | Xbw7omKBOL4Z6w9sXToz9UnQ0EB9s4TvAbHGKX9y2PEQjZN+wkzR3DavWB7ql8vH | ||
29 | ZIRmspAsDAJvDT1ofsNtu8MB8wJcxvZaoZ7j9wULYpnaNYx9xxEhgbB9o1mBcYsd | ||
30 | Dj3xz5jrgtq/cpdgGC6bg+awDc/ylQ1mNglKfY8P9hFIhIANZilnmAlk5GSoWclP | ||
31 | /69m+u34KKoHU4Yc3I1pPNcL6Nyi0bh8mHqe9WedKfod7Y4yM1S20fXaS4vrLIlK | ||
32 | gxbsDpWiWrk0ltV03uyC7eqDe3nzzGW/2GLTHj5xsA2+HwGtPom5mmzjvV5PFNpS | ||
33 | 7a90JQARAQABiQG1BBgBAgAPBQJSpoIFAhsMBQkNR+uxAAoJENPl9Wttkg0wEScM | ||
34 | f2QjDWm3XawJxNA8pqqxrFeTEo+GESznVRTUeprrUFd1GHw33qaAvqLixZ+x8cr+ | ||
35 | 1Gj/fJd5eiIVJfRLYbXlC8su8JZXngfX0VhuMcUob/FTikfpcoYkRzriUsJEB3/O | ||
36 | mjlLjGgnQm5Gz9TV1ityF3bzoHkR8svWEKKKzNoIEPHLU3y7bqSkOrjnY3bZfdVR | ||
37 | h618XbjV28NMuoZsV8E4pOuQoy+3s5IjmIf/mkSiFE3VJwdaPem23UsXatFb/eoC | ||
38 | /Ahi0iCd/8ioFwi+oHT2Pnt9HrzVF6E8gBVO3vKo6UJgDTr9Qt27Nc6eHL0O5j50 | ||
39 | ins9ob/3DoOC3P5A08zhl+w466yGEv5+Es/usUAs/4ng4ksI3DTLK9Ygj70l5oBu | ||
40 | MFYd3b5KGVfAIlGc5mwIOIG41YLIzZTrGuOuTymjwCdC9cUZJ6R2Cv/Vx0htZ0hq | ||
41 | DdyaDO0Io9OG/W2s2T7160tY9ic4MwBCFemzwFELIBIIHNY/n/wsmxQGkI3Oj86J | ||
42 | pOVVgR5lXWR+BrGcBjkSEyg= | ||
43 | =T9xO | ||
44 | -----END PGP PUBLIC KEY BLOCK----- | ||
diff --git a/debian/watch b/debian/watch new file mode 100644 index 000000000..e05063598 --- /dev/null +++ b/debian/watch | |||
@@ -0,0 +1,3 @@ | |||
1 | version=3 | ||
2 | opts=pgpsigurlmangle=s/$/.asc/ \ | ||
3 | http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-(.*)\.tar\.gz | ||