122 files changed, 20786 insertions, 0 deletions

diff --git a/debian/NEWS b/debian/NEWS
new file mode 100644
index 000000000..7a67e1528
--- /dev/null
+++ b/debian/NEWS
@@ -0,0 +1,42 @@
+openssh (1:5.4p1-2) unstable; urgency=low
+
+  Smartcard support is now available using PKCS#11 tokens.  If you were
+  previously using an unofficial build of Debian's OpenSSH package with
+  OpenSC-based smartcard support added, then note that commands like
+  'ssh-add -s 0' will no longer work; you need to use 'ssh-add -s
+  /usr/lib/opensc-pkcs11.so' instead.
+
+ -- Colin Watson <cjwatson@debian.org>  Sat, 10 Apr 2010 01:08:59 +0100
+
+openssh (1:3.8.1p1-9) experimental; urgency=low
+
+  The ssh package has been split into openssh-client and openssh-server. If
+  you had previously requested that the sshd server should not be run, then
+  that request will still be honoured. However, the recommended approach is
+  now to remove the openssh-server package if you do not want to run sshd.
+  You can remove the old /etc/ssh/sshd_not_to_be_run marker file after doing
+  that.
+
+ -- Colin Watson <cjwatson@debian.org>  Mon,  2 Aug 2004 20:48:54 +0100
+
+openssh (1:3.5p1-1) unstable; urgency=low
+
+  This version of OpenSSH disables the environment option for public keys by
+  default, in order to avoid certain attacks (for example, LD_PRELOAD). If
+  you are using this option in an authorized_keys file, beware that the keys
+  in question will no longer work until the option is removed.
+
+  To re-enable this option, set "PermitUserEnvironment yes" in
+  /etc/ssh/sshd_config after the upgrade is complete, taking note of the
+  warning in the sshd_config(5) manual page.
+
+ -- Colin Watson <cjwatson@debian.org>  Sat, 26 Oct 2002 19:41:51 +0100
+
+openssh (1:3.0.1p1-1) unstable; urgency=high
+
+  As of version 3, OpenSSH no longer uses separate files for ssh1 and ssh2
+  keys. This means the authorized_keys2 and known_hosts2 files are no longer
+  needed. They will still be read in order to maintain backward
+  compatibility.
+
+ -- Matthew Vernon <matthew@debian.org>  Thu, 28 Nov 2001 17:43:01 +0000
diff --git a/debian/README.Debian b/debian/README.Debian
new file mode 100644
index 000000000..f37cce4b0
--- /dev/null
+++ b/debian/README.Debian
@@ -0,0 +1,234 @@
+OpenSSH for Debian
+------------------
+
+UPGRADE ISSUES
+==============
+
+Privilege Separation
+--------------------
+
+As of 3.3, openssh has employed privilege separation to reduce the
+quantity of code that runs as root, thereby reducing the impact of
+some security holes in sshd. This now also works properly with PAM.
+
+Privilege separation is turned on by default, so, if you decide you
+want it turned off, you need to add "UsePrivilegeSeparation no" to
+/etc/ssh/sshd_config.
+
+PermitRootLogin set to yes
+--------------------------
+
+This is now the default setting (in line with upstream), and people
+who asked for an automatically-generated configuration file when
+upgrading from potato (or on a new install) will have this setting in
+their /etc/ssh/sshd_config file.
+
+Should you wish to change this setting, edit /etc/ssh/sshd_config, and
+change:
+PermitRootLogin yes
+to:
+PermitRootLogin no
+
+Having PermitRootLogin set to yes means that an attacker that knows
+the root password can ssh in directly (without having to go via a user
+account). If you set it to no, then they must compromise a normal user
+account. In the vast majority of cases, this does not give added
+security; remember that any account you su to root from is equivalent
+to root - compromising this account gives an attacker access to root
+easily. If you only ever log in as root from the physical console,
+then you probably want to set this value to no.
+
+As an aside, PermitRootLogin can also be set to "without-password" or
+"forced-commands-only" - see sshd(8) for more details.
+
+DO NOT FILE BUG REPORTS SAYING YOU THINK THIS DEFAULT IS INCORRECT!
+
+The argument above is somewhat condensed; I have had this discussion
+at great length with many people. If you think the default is
+incorrect, and feel strongly enough to want to argue about it, then
+send email to debian-ssh@lists.debian.org. I will close bug reports
+claiming the default is incorrect.
+
+SSH now uses protocol 2 by default
+----------------------------------
+
+This means all your keyfiles you used for protocol version 1 need to
+be re-generated. The server keys are done automatically, but for RSA
+authentication, please read the ssh-keygen manpage.
+
+If you have an automatically generated configuration file, and decide
+at a later stage that you do want to support protocol version 1 (not
+recommended, but note that the ssh client shipped with Debian potato
+only supported protocol version 1), then you need to do the following:
+
+Change /etc/ssh/sshd_config such that:
+Protocol 2
+becomes:
+Protocol 2,1
+Also add the line:
+HostKey /etc/ssh/ssh_host_key
+
+If you do not already have an RSA1 host key in /etc/ssh/ssh_host_key,
+you will need to generate one. To do so, run this command as root:
+
+  ssh-keygen -f /etc/ssh/ssh_host_key -N '' -t rsa1
+
+As of openssh-server 1:4.1p1-2, the option to support protocol version 1
+is no longer available via debconf. You must edit the configuration file
+instead.
+
+X11 Forwarding
+--------------
+
+ssh's default for ForwardX11 has been changed to ``no'' because it has
+been pointed out that logging into remote systems administered by
+untrusted people is likely to open you up to X11 attacks, so you
+should have to actively decide that you trust the remote machine's
+root, before enabling X11.  I strongly recommend that you do this on a
+machine-by-machine basis, rather than just enabling it in the default
+host settings.
+
+In order for X11 forwarding to work, you need to install xauth on the
+server. In Debian this is in the xbase-clients package.
+
+As of OpenSSH 3.1, the remote $DISPLAY uses localhost by default to reduce
+the security risks of X11 forwarding. Look up X11UseLocalhost in
+sshd_config(8) if this is a problem.
+
+OpenSSH 3.8 invented ForwardX11Trusted, which when set to no causes the
+ssh client to create an untrusted X cookie so that attacks on the
+forwarded X11 connection can't become attacks on X clients on the remote
+machine. However, this has some problems in implementation - notably a
+very short timeout of the untrusted cookie - breaks large numbers of
+existing setups, and generally seems immature. The Debian package
+therefore sets the default for this option to "yes" (in ssh itself,
+rather than in ssh_config).
+
+Fallback to RSH
+---------------
+
+The default for this setting has been changed from Yes to No, for
+security reasons, and to stop the delay attempting to rsh to machines
+that don't offer the service.  Simply switch it back on in either
+/etc/ssh/ssh_config or ~/.ssh/config for those machines that you need
+it for.
+
+Setgid ssh-agent and environment variables
+------------------------------------------
+
+As of version 1:3.5p1-1, ssh-agent is installed setgid to prevent ptrace()
+attacks retrieving private key material. This has the side-effect of causing
+glibc to remove certain environment variables which might have security
+implications for set-id programs, including LD_PRELOAD, LD_LIBRARY_PATH, and
+TMPDIR.
+
+If you need to set any of these environment variables, you will need to do
+so in the program exec()ed by ssh-agent. This may involve creating a small
+wrapper script.
+
+Symlink Hostname invocation
+---------------------------
+
+This version of ssh no longer includes support for invoking ssh with the
+hostname as the name of the file run.  People wanting this support should
+use the ssh-argv0 script.
+
+=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
+
+OTHER ISSUES
+============
+
+/usr/bin/ssh not SUID
+---------------------
+
+Due to Debian bug #164325, RhostsRSAAuthentication can only be used if ssh
+is SUID.  Until this is fixed, if that is a problem, use:
+
+   dpkg-statoverride
+
+or if that's also missing, use this:
+
+   chown root.root /usr/bin/ssh
+   chmod 04755 /usr/bin/ssh
+
+Authorization Forwarding
+------------------------
+
+Similarly, root on a remote server could make use of your ssh-agent
+(while you're logged into their machine) to obtain access to machines
+which trust your keys.  This feature is therefore disabled by default.
+You should only re-enable it for those hosts (in your ~/.ssh/config or
+/etc/ssh/ssh_config) where you are confident that the remote machine
+is not a threat.
+
+Problems logging in with RSA authentication
+-------------------------------------------
+
+If you have trouble logging in with RSA authentication then the
+problem is probably caused by the fact that you have your home
+directory writable by group, as well as user (this is the default on
+Debian systems).
+
+Depending upon other settings on your system (i.e. other users being
+in your group) this could open a security hole, so you will need to
+make your home directory writable only by yourself.  Run this command,
+as yourself:
+
+  chmod g-w ~/
+
+to remove group write permissions.  If you use ssh-copy-id to install your
+keys, it does this for you.
+
+-L option of ssh nonfree
+------------------------
+
+non-free ssh supported the usage of the option -L to use a non privileged
+port for scp. This option will not be supported by scp from openssh.
+
+Please use instead scp -o "UsePrivilegedPort=no" as documented in the
+manpage to scp itself.
+
+Problem logging in because of TCP-Wrappers
+------------------------------------------
+
+ssh is compiled with support for tcp-wrappers. So if you can no longer
+log into your system, please check that /etc/hosts.allow and /etc/hosts.deny
+are configured so that ssh is not blocked.
+
+Kerberos support
+----------------
+
+ssh is now compiled with Kerberos support. Unfortunately, privilege
+separation is incompatible with Kerberos support for SSH protocol 1 and
+parts of the support for protocol 2; you may need to run kinit after logging
+in.
+
+Interoperability between scp and the ssh.com SSH server
+-------------------------------------------------------
+
+In version 2 and greater of the commercial SSH server produced by SSH
+Communications Security, scp was changed to use SFTP (SSH2's file transfer
+protocol) instead of the traditional rcp-over-ssh, thereby breaking
+compatibility. The OpenSSH developers regard this as a bug in the ssh.com
+server, and do not currently intend to change OpenSSH's scp to match.
+
+Workarounds for this problem are to install scp1 on the server (scp2 will
+fall back to it), to use sftp, or to use some other transfer mechanism such
+as rsync-over-ssh or tar-over-ssh.
+
+Running sshd from inittab
+-------------------------
+
+Some people find it useful to run the sshd server from inittab, to make sure
+that it always stays running. To do this, stop sshd ('/etc/init.d/ssh
+stop'), add the following line to /etc/inittab, and run 'telinit q':
+
+  ss:2345:respawn:/usr/sbin/sshd -D
+
+If you do this, note that you will need to stop sshd being started in the
+normal way ('rm -f /etc/rc[2345].d/S16ssh') and that you will need to
+restart this sshd manually on upgrades.
+
+-- 
+Matthew Vernon <matthew@debian.org>
+Colin Watson <cjwatson@debian.org>
diff --git a/debian/README.compromised-keys b/debian/README.compromised-keys
new file mode 100644
index 000000000..7a9cb7657
--- /dev/null
+++ b/debian/README.compromised-keys
@@ -0,0 +1,167 @@
+The following instructions relate to CVE-2008-0166. They were prepared by
+Matt Zimmerman, assisted by Colin Watson.
+
+== What Happened ==
+
+A weakness has been discovered in the random number generator used by OpenSSL
+on Debian and Ubuntu systems.  As a result of this weakness, certain encryption
+keys are much more common than they should be, such that an attacker could
+guess the key through a brute-force attack given minimal knowledge of the
+system.  This particularly affects the use of encryption keys in OpenSSH,
+OpenVPN and SSL certificates.
+
+This vulnerability only affects operating systems which (like Ubuntu) are based
+on Debian.  However, other systems can be indirectly affected if weak keys are
+imported into them.
+
+We consider this an extremely serious vulnerability, and urge all users to act
+immediately to secure their systems.
+
+== Who is affected ==
+
+Systems which are running any of the following releases:
+
+ * Debian 4.0 (etch)
+ * Ubuntu 7.04 (Feisty)
+ * Ubuntu 7.10 (Gutsy)
+ * Ubuntu 8.04 LTS (Hardy)
+ * Ubuntu "Intrepid Ibex" (development): libssl <= 0.9.8g-8
+
+and have openssh-server installed or have been used to create an OpenSSH key or
+X.509 (SSL) certificate.
+
+All OpenSSH and X.509 keys generated on such systems must be considered
+untrustworthy, regardless of the system on which they are used, even after the
+update has been applied.
+
+This includes the automatically generated host keys used by OpenSSH, which are
+the basis for its server spoofing and man-in-the-middle protection.
+
+The specific package versions affected are:
+
+ * Debian 4.0: libssl <= 0.9.8c-4etch3
+ * Ubuntu 7.04: libssl <= 0.9.8c-4ubuntu0.2
+ * Ubuntu 7.10: libssl <= 0.9.8e-5ubuntu3.1
+ * Ubuntu 8.04: libssl <= 0.9.8g-4ubuntu3
+
+== What to do if you are affected ==
+
+OpenSSH:
+
+1. Install the security updates
+
+   Once the update is applied, weak user keys will be automatically rejected
+   where possible (though they cannot be detected in all cases).  If you are
+   using such keys for user authentication, they will immediately stop working
+   and will need to be replaced (see step 3).
+   
+   OpenSSH host keys can be automatically regenerated when the OpenSSH security
+   update is applied.  The update will prompt for confirmation before taking
+   this step.
+   
+2. Update OpenSSH known_hosts files
+
+   The regeneration of host keys will cause a warning to be displayed when
+   connecting to the system using SSH until the host key is updated in the
+   known_hosts file.  The warning will look like this:
+
+   @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
+   @    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
+   @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
+   IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
+   Someone could be eavesdropping on you right now (man-in-the-middle attack)!
+   It is also possible that the RSA host key has just been changed.
+
+   In this case, the host key has simply been changed, and you should update
+   the relevant known_hosts file as indicated in the error message.
+
+3. Check all OpenSSH user keys
+
+   The safest course of action is to regenerate all OpenSSH user keys,
+   except where it can be established to a high degree of certainty that the
+   key was generated on an unaffected system.
+
+   Check whether your key is affected by running the ssh-vulnkey tool, included
+   in the security update.  By default, ssh-vulnkey will check the standard
+   location for user keys (~/.ssh/id_rsa, ~/.ssh/id_dsa and ~/.ssh/identity),
+   your authorized_keys file (~/.ssh/authorized_keys and
+   ~/.ssh/authorized_keys2), and the system's host keys
+   (/etc/ssh/ssh_host_dsa_key and /etc/ssh/ssh_host_rsa_key).
+
+   To check all your own keys, assuming they are in the standard
+   locations (~/.ssh/id_rsa, ~/.ssh/id_dsa, or ~/.ssh/identity):
+
+     ssh-vulnkey
+
+   To check all keys on your system:
+
+     sudo ssh-vulnkey -a
+
+   To check a key in a non-standard location:
+
+     ssh-vulnkey /path/to/key
+
+   If ssh-vulnkey says "Unknown (no blacklist information)", then it has no
+   information about whether that key is affected.  If in doubt, destroy the
+   key and generate a new one.
+
+4. Regenerate any affected user keys
+
+   OpenSSH keys used for user authentication must be manually regenerated,
+   including those which may have since been transferred to a different system
+   after being generated.
+
+   New keys can be generated using ssh-keygen, e.g.:
+
+   $ ssh-keygen 
+   Generating public/private rsa key pair.
+   Enter file in which to save the key (/home/user/.ssh/id_rsa): 
+   Enter passphrase (empty for no passphrase): 
+   Enter same passphrase again: 
+   Your identification has been saved in /home/user/.ssh/id_rsa.
+   Your public key has been saved in /home/user/.ssh/id_rsa.pub.
+   The key fingerprint is:
+   00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00 user@host
+
+5. Update authorized_keys files (if necessary)
+
+   Once the user keys have been regenerated, the relevant public keys must
+   be propagated to any authorized_keys files on remote systems.  Be sure to
+   delete the affected key.
+
+OpenSSL:
+
+1. Install the security update
+
+2. Create new certificates to replace any server or client certificates in use
+   on the system
+
+3. If certificates have been generated for use on other systems, they must be
+   found and replaced as well.
+
+== Removing openssh-blacklist ==
+
+For the moment, the openssh-server package depends on openssh-blacklist, in
+order that the blacklist is deployed to the maximum possible number of
+systems to reduce the potential spread of worms exploiting this
+vulnerability. We acknowledge that this may be inconvenient for some small
+systems, but nevertheless feel that this was the best course of action.
+
+If you absolutely need to remove the blacklist from your system, then you
+can run the following commands to substitute a fake package for
+openssh-blacklist:
+
+  sudo apt-get install equivs
+  equivs-control openssh-blacklist.ctl
+  sed -i 's/^Package:.*/Package: openssh-blacklist/' openssh-blacklist.ctl
+  sed -i 's/^# Version:.*/Version: 9:1.0/' openssh-blacklist.ctl
+  equivs-build openssh-blacklist.ctl
+  sudo dpkg -i openssh-blacklist_1.0_all.deb
+
+Be warned: this circumvents a security measure for the sake of disk space.
+You should only do this if you have no other option, and if you are certain
+that no compromised keys will ever be generated on or copied onto this
+system.
+
+Once a sufficient amount of time and number of releases have passed, the
+openssh-blacklist package will be phased out.
diff --git a/debian/README.source b/debian/README.source
new file mode 100644
index 000000000..d99ddb7a7
--- /dev/null
+++ b/debian/README.source
@@ -0,0 +1,222 @@
+Debian OpenSSH source package handling
+======================================
+
+The Debian package of OpenSSH is maintained in Bazaar
+(http://bazaar-vcs.org/, or the 'bzr' package in Debian). You will need at
+least version 1.16.1; the version in Debian testing as of the time of
+writing (2009-12-21) is fine, or you can use the version in lenny-backports.
+URLs are as follows:
+
+  Anonymous branch: http://bzr.debian.org/pkg-ssh/openssh/trunk
+  Web browsing:     http://bzr.debian.org/loggerhead/pkg-ssh/openssh/trunk
+  Authenticated, for developers with commit access only:
+                    bzr+ssh://bzr.debian.org/bzr/pkg-ssh/openssh/trunk
+
+Although it's possible that I may use something like bzr-loom in the future
+to better manage things like the Kerberos/GSSAPI patch, right now there's no
+funny business and all that developers need to do is:
+
+  # To check out:
+  bzr co bzr+ssh://bzr.debian.org/bzr/pkg-ssh/openssh/trunk openssh
+
+  # To update:
+  bzr up
+
+  # To edit:
+  # hack hack hack, and 'bzr add' any new files
+  debcommit # or bzr commit
+  # note that this pushes automatically; you can use 'bzr unbind' to
+  # temporarily prevent this, or 'bzr branch' to create a local branch which
+  # you can merge later
+
+  # To release:
+  dch -r && debcommit -r
+
+If you have lots of branches, you'll probably want to use a shared
+repository to save space. Run 'bzr init-repo .' in an ancestor directory of
+all your OpenSSH working directories. For example, I have a shared
+repository in ~/src/debian/openssh/, upstream checkouts in
+~/src/debian/openssh/upstream/, and my own working trees in
+~/src/debian/openssh/trunk/.
+
+Patch handling
+--------------
+
+This package uses quilt to manage all modifications to the upstream source.
+Changes are stored in the source package as diffs in debian/patches and
+applied automatically by dpkg-source when the source package is extracted.
+
+To configure quilt to use debian/patches instead of patches, you want either
+to export QUILT_PATCHES=debian/patches in your environment or use this
+snippet in your ~/.quiltrc:
+
+    for where in ./ ../ ../../ ../../../ ../../../../ ../../../../../; do
+        if [ -e ${where}debian/rules -a -d ${where}debian/patches ]; then
+                export QUILT_PATCHES=debian/patches
+                break
+        fi
+    done
+
+After unpacking the source package, all patches will be applied, and you can
+use quilt normally.
+
+If you check out the source code from bzr, then all patches will be applied,
+but you will need to inform quilt of this manually.  Do this by running:
+
+    debian/rules quilt-setup
+
+To add a new set of changes, first run quilt push -a, and then run:
+
+    quilt new <patch>
+
+where <patch> is a descriptive name for the patch, used as the filename in
+debian/patches.  Then, for every file that will be modified by this patch,
+run:
+
+    quilt add <file>
+
+before editing those files.  You must tell quilt with quilt add what files
+will be part of the patch before making changes or quilt will not work
+properly.  After editing the files, run:
+
+    quilt refresh
+
+to save the results as a patch.
+
+Alternately, if you already have an external patch and you just want to add
+it to the build system, run quilt push -a and then:
+
+    quilt import -P <patch> /path/to/patch
+    quilt push -a
+
+(add -p 0 to quilt import if needed). <patch> as above is the filename to
+use in debian/patches.  The last quilt push -a will apply the patch to make
+sure it works properly.
+
+To remove an existing patch from the list of patches that will be applied,
+run:
+
+    quilt delete <patch>
+
+You may need to run quilt pop -a to unapply patches first before running
+this command.
+
+You should only commit changes to bzr with all patches applied, i.e. after
+'quilt push -a'.
+
+Merging new upstream releases
+-----------------------------
+
+(Most developers will not need to read this section.)
+
+Thanks to the import from Portable OpenSSH CVS provided by Launchpad
+(https://code.launchpad.net/~vcs-imports/openssh/main, accessible by the
+shortcut 'lp:openssh' from the bzr client), the Debian branch is a true DVCS
+branch from upstream. This is a worthwhile property, but preserving it does
+take a little bit of work.
+
+Launchpad only imports CVS HEAD, but upstream sometimes produces releases
+from a branch. We use the same software used by Launchpad to import the
+branch as well, but a few small hacks are necessary to do good branch
+imports. In Bazaar, it's important that the same file in different branches
+should have the same file-id, otherwise merge attempts will try to delete
+and re-add the file which usually doesn't work out very well. Occasionally a
+file is added to CVS HEAD and then also added to a branch, and cscvs isn't
+quite smart enough to spot this and copy over the file-id. We need to help
+it out.
+
+To fetch the necessary code:
+
+  bzr get lp:~cjwatson/launchpad-cscvs/openssh-branch-imports
+  # or 'bzr pull' in the appropriate directory to update this, if you
+  # already have a copy
+
+To import a branch, V_5_3 in this example:
+
+  export PATH="/path/to/cscvs/openssh-branch-imports:$PATH"
+  export PYTHONPATH=/path/to/cscvs/openssh-branch-imports/modules:/path/to/cscvs/openssh-branch-imports
+  # in a CVS checkout of :ext:anoncvs@anoncvs.mindrot.org:/cvs module
+  # openssh:
+  cscvs cache -b
+  # or 'cscvs cache -u' if you've done this before and want to update
+  cvs up -rV_5_3
+
+  # Now we need to get a few bits of information from cscvs' cache.
+  sqlite CVS/Catalog.sqlite
+  sqlite> select csnum,log from changeset where branch = 'V_5_3' order by startdate;
+  # There will be a solid block of "Creation of branch V_5_3" changesets at
+  # the start; look for the first revision *after* this. Substitute this in
+  # the following wherever you see "CSX".
+  sqlite> select revision,filename from revision where branch = 'V_5_3' and csnum >= CSX and revision not like '%.%.%' order by filename;
+  # Anything listed here will need to be added to the openssh_ids dictionary
+  # in modules/CVS/StorageLayer.py in cscvs. Please send Colin Watson a
+  # patch if you do this.
+
+  # Next, look up the branchpoint revision in the main bzr import (bzr get
+  # lp:openssh). It's usually easiest to just look it up by commit message
+  # and double-check the timestamp. Substitute this revision number for
+  # "BPR" in the following. /path/to/openssh/main is wherever you've checked
+  # out lp:openssh.
+  bzr get -rBPR /path/to/openssh/main /path/to/openssh/5.3
+  # If you're using Bazaar signed commits with a GPG agent, make sure that
+  # your agent has seen your passphrase recently. Now you can start the
+  # actual import!
+  cscvs -D4 totla -SC V_5_3.CSX: /path/to/openssh/5.3
+  # If this fails at the end with a "directories differ" message, you may
+  # have forgotten to switch your CVS checkout to the appropriate branch
+  # with 'cvs up -r...' above. Otherwise you'll have to debug this for
+  # yourself. It's also worth double-checking that any files added to the
+  # branch have file-ids matching those on the trunk, using 'bzr ls -R
+  # --show-ids'.
+
+Now we have a Bazaar branch corresponding to what's in CVS. Previous such
+branches are available from Launchpad, for reference purposes:
+
+  https://code.launchpad.net/openssh
+
+However, upstream releases involve a 'make distprep' step as well to
+construct the tarball, and we need to import the results of this as well to
+get a clean package.
+
+Start by unpacking the upstream tarball (remember to check its GPG signature
+first!). Copy the .bzr directory from the upstream branch you prepared
+earlier. Now we have another branch, but with a working tree corresponding
+to the upstream tarball. Modifications and deletions are handled
+automatically, but we need to handle additions explicitly to make sure
+file-ids are correct (see above). Run:
+
+  bzr add --file-ids-from=/path/to/openssh/debian/trunk
+  bzr st --show-ids
+  # compare this with 'bzr ls --show-ids' in the Debian trunk to make sure
+  # the result will be mergeable
+  bzr ci -m 'Import 5.3p1 tarball'
+
+Add a parent revision for the previous tarball branch, to make it easier for
+bzr to compute accurate merges.
+
+  bzr log -n0 /path/to/openssh/debian/trunk | less
+  # find revision number for previous tarball import, hence 'PREVIOUS'
+  bzr merge -rPREVIOUS /path/to/openssh/debian/trunk
+  # merge history only, no file changes
+  bzr revert .
+  bzr ci -m 'add 5.2p1 tarball parent revision'
+
+Next, merge this into the gssapi branch
+(bzr+ssh://bzr.debian.org/bzr/pkg-ssh/openssh/gssapi/). For this branch, we
+want to ignore the normal results of merging and take only the patch from
+http://www.sxw.org.uk/computing/patches/openssh.html; of course such a patch
+needs to exist first! To do this, run this in the gssapi branch:
+
+  bzr merge /path/to/openssh/tarball/branch
+  bzr revert -rrevno:-1:/path/to/openssh/tarball/branch .
+  patch -p1 </path/to/openssh/gssapi/patch
+  bzr add --file-ids-from=/path/to/openssh/debian/trunk
+  # you may need to deal with applying configure.ac changes to configure
+  # here
+  bzr ci -m 'import openssh-5.3p1-gsskex-all-20100124.patch'
+
+You should now be able to 'bzr merge' from the gssapi branch into the Debian
+trunk, resolve conflicts, and commit. If you see lots of "Contents conflict"
+messages, you may have got the file-ids wrong. Once you've committed the
+merge, you can throw away the tarball branch, as all its history will have
+been incorporated.
diff --git a/debian/changelog b/debian/changelog
new file mode 100644
index 000000000..4a72d01e4
--- /dev/null
+++ b/debian/changelog
@@ -0,0 +1,3120 @@
+openssh (1:5.6p1-1) UNRELEASED; urgency=low
+
+  * New upstream release (http://www.openssh.com/txt/release-5.6):
+    - Added a ControlPersist option to ssh_config(5) that automatically
+      starts a background ssh(1) multiplex master when connecting.  This
+      connection can stay alive indefinitely, or can be set to automatically
+      close after a user-specified duration of inactivity (closes: #335697,
+      #350898, #454787, #500573, #550262).
+    - Support AuthorizedKeysFile, AuthorizedPrincipalsFile,
+      HostbasedUsesNameFromPacketOnly, and PermitTunnel in sshd_config(5)
+      Match blocks (closes: #549858).
+    - sftp(1): fix ls in working directories that contain globbing
+      characters in their pathnames (LP: #530714).
+
+ -- Colin Watson <cjwatson@debian.org>  Mon, 23 Aug 2010 23:22:10 +0100
+
+openssh (1:5.5p1-5) unstable; urgency=low
+
+  * Use an architecture wildcard for libselinux1-dev (closes: #591740).
+  * debconf template translations:
+    - Update Danish (thanks, Joe Hansen; closes: #592800).
+
+ -- Colin Watson <cjwatson@debian.org>  Mon, 23 Aug 2010 22:59:03 +0100
+
+openssh (1:5.5p1-4) unstable; urgency=low
+
+  [ Sebastian Andrzej Siewior ]
+  * Add powerpcspe to architecture list for libselinux1-dev build-dependency
+    (closes: #579843).
+
+  [ Colin Watson ]
+  * Allow ~/.ssh/authorized_keys and other secure files to be
+    group-writable, provided that the group in question contains only the
+    file's owner; this extends a patch previously applied to ~/.ssh/config
+    (closes: #581919).
+  * Check primary group memberships as well as supplementary group
+    memberships, and only allow group-writability by groups with exactly one
+    member, as zero-member groups are typically used by setgid binaries
+    rather than being user-private groups (closes: #581697).
+
+ -- Colin Watson <cjwatson@debian.org>  Sat, 22 May 2010 23:37:20 +0100
+
+openssh (1:5.5p1-3) unstable; urgency=low
+
+  * Discard error messages while checking whether rsh, rlogin, and rcp
+    alternatives exist (closes: #579285).
+  * Drop IDEA key check; I don't think it works properly any more due to
+    textual changes in error output, it's only relevant for direct upgrades
+    from truly ancient versions, and it breaks upgrades if
+    /etc/ssh/ssh_host_key can't be loaded (closes: #579570).
+
+ -- Colin Watson <cjwatson@debian.org>  Wed, 28 Apr 2010 22:12:47 +0100
+
+openssh (1:5.5p1-2) unstable; urgency=low
+
+  * Use dh_installinit -n, since our maintainer scripts already handle this
+    more carefully (thanks, Julien Cristau).
+
+ -- Colin Watson <cjwatson@debian.org>  Sat, 17 Apr 2010 12:55:56 +0100
+
+openssh (1:5.5p1-1) unstable; urgency=low
+
+  * New upstream release:
+    - Unbreak sshd_config's AuthorizedKeysFile option for $HOME-relative
+      paths.
+    - Include a language tag when sending a protocol 2 disconnection
+      message.
+    - Make logging of certificates used for user authentication more clear
+      and consistent between CAs specified using TrustedUserCAKeys and
+      authorized_keys.
+
+ -- Colin Watson <cjwatson@debian.org>  Fri, 16 Apr 2010 10:27:30 +0100
+
+openssh (1:5.4p1-2) unstable; urgency=low
+
+  * Borrow patch from Fedora to add DNSSEC support: if glibc 2.11 is
+    installed, the host key is published in an SSHFP RR secured with DNSSEC,
+    and VerifyHostKeyDNS=yes, then ssh will no longer prompt for host key
+    verification (closes: #572049).
+  * Convert to dh(1), and use dh_installdocs --link-doc.
+  * Drop lpia support, since Ubuntu no longer supports this architecture.
+  * Use dh_install more effectively.
+  * Add a NEWS.Debian entry about changes in smartcard support relative to
+    previous unofficial builds (closes: #231472).
+
+ -- Colin Watson <cjwatson@debian.org>  Sat, 10 Apr 2010 01:08:59 +0100
+
+openssh (1:5.4p1-1) unstable; urgency=low
+
+  * New upstream release (LP: #535029).
+    - After a transition period of about 10 years, this release disables SSH
+      protocol 1 by default.  Clients and servers that need to use the
+      legacy protocol must explicitly enable it in ssh_config / sshd_config
+      or on the command-line.
+    - Remove the libsectok/OpenSC-based smartcard code and add support for
+      PKCS#11 tokens.  This support is enabled by default in the Debian
+      packaging, since it now doesn't involve additional library
+      dependencies (closes: #231472, LP: #16918).
+    - Add support for certificate authentication of users and hosts using a
+      new, minimal OpenSSH certificate format (closes: #482806).
+    - Added a 'netcat mode' to ssh(1): "ssh -W host:port ...".
+    - Add the ability to revoke keys in sshd(8) and ssh(1).  (For the Debian
+      package, this overlaps with the key blacklisting facility added in
+      openssh 1:4.7p1-9, but with different file formats and slightly
+      different scopes; for the moment, I've roughly merged the two.)
+    - Various multiplexing improvements, including support for requesting
+      port-forwardings via the multiplex protocol (closes: #360151).
+    - Allow setting an explicit umask on the sftp-server(8) commandline to
+      override whatever default the user has (closes: #496843).
+    - Many sftp client improvements, including tab-completion, more options,
+      and recursive transfer support for get/put (LP: #33378).  The old
+      mget/mput commands never worked properly and have been removed
+      (closes: #270399, #428082).
+    - Do not prompt for a passphrase if we fail to open a keyfile, and log
+      the reason why the open failed to debug (closes: #431538).
+    - Prevent sftp from crashing when given a "-" without a command.  Also,
+      allow whitespace to follow a "-" (closes: #531561).
+
+  * Fix 'debian/rules quilt-setup' to avoid writing .orig files if some
+    patches apply with offsets.
+  * Include debian/ssh-askpass-gnome.png in the Debian tarball now that
+    we're using a source format that permits this, rather than messing
+    around with uudecode.
+  * Drop compatibility with the old gssapi mechanism used in ssh-krb5 <<
+    3.8.1p1-1.  Simon Wilkinson refused this patch since the old gssapi
+    mechanism was removed due to a serious security hole, and since these
+    versions of ssh-krb5 are no longer security-supported by Debian I don't
+    think there's any point keeping client compatibility for them.
+  * Fix substitution of ETC_PAM_D_SSH, following the rename in 1:4.7p1-4.
+  * Hardcode the location of xauth to /usr/bin/xauth rather than
+    /usr/bin/X11/xauth (thanks, Aron Griffis; closes: #575725, LP: #8440).
+    xauth no longer depends on x11-common, so we're no longer guaranteed to
+    have the /usr/bin/X11 symlink available.  I was taking advantage of the
+    /usr/bin/X11 symlink to smooth X's move to /usr/bin, but this is far
+    enough in the past now that it's probably safe to just use /usr/bin.
+  * Remove SSHD_OOM_ADJUST configuration.  sshd now unconditionally makes
+    itself non-OOM-killable, and doesn't require configuration to avoid log
+    spam in virtualisation containers (closes: #555625).
+  * Drop Debian-specific removal of OpenSSL version check.  Upstream ignores
+    the two patchlevel nybbles now, which is sufficient to address the
+    original reason this change was introduced, and it appears that any
+    change in the major/minor/fix nybbles would involve a new libssl package
+    name.  (We'd still lose if the status nybble were ever changed, but that
+    would mean somebody had packaged a development/beta version rather than
+    a proper release, which doesn't appear to be normal practice.)
+  * Drop most of our "LogLevel SILENT" (-qq) patch.  This was originally
+    introduced to match the behaviour of non-free SSH, in which -q does not
+    suppress fatal errors, but matching the behaviour of OpenSSH upstream is
+    much more important nowadays.  We no longer document that -q does not
+    suppress fatal errors (closes: #280609).  Migrate "LogLevel SILENT" to
+    "LogLevel QUIET" in sshd_config on upgrade.
+  * Policy version 3.8.4:
+    - Add a Homepage field.
+
+ -- Colin Watson <cjwatson@debian.org>  Tue, 06 Apr 2010 22:38:31 +0100
+
+openssh (1:5.3p1-3) unstable; urgency=low
+
+  * Convert to source format 3.0 (quilt).
+  * Update README.source to match, and add a 'quilt-setup' target to
+    debian/rules for the benefit of those checking out the package from
+    revision control.
+  * All patches are now maintained separately and tagged according to DEP-3.
+  * Add GSSAPIStoreCredentialsOnRekey to 'sshd -T' configuration dump.
+  * Remove documentation of building for Debian 3.0 in README.Debian.
+    Support for this was removed in 1:4.7p1-2.
+  * Remove obsolete header from README.Debian dating from when people
+    expected non-free SSH.
+  * Update copyright years for GSSAPI patch.
+
+ -- Colin Watson <cjwatson@debian.org>  Sun, 28 Feb 2010 01:35:53 +0000
+
+openssh (1:5.3p1-2) unstable; urgency=low
+
+  * Link with -Wl,--as-needed (closes: #560155).
+  * Install upstream sshd_config as an example (closes: #415008).
+  * Use dh_lintian.
+  * Honour DEB_BUILD_OPTIONS=nocheck.
+
+ -- Colin Watson <cjwatson@debian.org>  Mon, 22 Feb 2010 12:43:24 +0000
+
+openssh (1:5.3p1-1) unstable; urgency=low
+
+  * New upstream release.
+  * Update to GSSAPI patch from
+    http://www.sxw.org.uk/computing/patches/openssh-5.3p1-gsskex-all-20100124.patch.
+  * Backport from upstream:
+    - Do not fall back to adding keys without constraints (ssh-add -c / -t
+      ...) when the agent refuses the constrained add request. This was a
+      useful migration measure back in 2002 when constraints were new, but
+      just adds risk now (LP: #209447).
+  * Drop change from 1:3.8p1-3 to avoid setresuid() and setresgid() system
+    calls.  This only applied to Linux 2.2, which it's no longer feasible to
+    run anyway (see 1:5.2p1-2 changelog).
+
+ -- Colin Watson <cjwatson@debian.org>  Tue, 26 Jan 2010 11:55:29 +0000
+
+openssh (1:5.2p1-2) unstable; urgency=low
+
+  [ Colin Watson ]
+  * Backport from upstream:
+    - After sshd receives a SIGHUP, ignore subsequent HUPs while sshd
+      re-execs itself.  Prevents two HUPs in quick succession from resulting
+      in sshd dying (LP: #497781).
+    - Output a debug if we can't open an existing keyfile (LP: #505301).
+  * Use host compiler for ssh-askpass-gnome when cross-compiling.
+  * Don't run tests when cross-compiling.
+  * Drop change from 1:3.6.1p2-5 to disable cmsg_type check for file
+    descriptor passing when running on Linux 2.0.  The previous stable
+    release of Debian dropped support for Linux 2.4, let alone 2.0, so this
+    very likely has no remaining users depending on it.
+
+  [ Kees Cook ]
+  * Implement DebianBanner server configuration flag that can be set to "no"
+    to allow sshd to run without the Debian-specific extra version in the
+    initial protocol handshake (closes: #562048).
+
+ -- Colin Watson <cjwatson@debian.org>  Sat, 16 Jan 2010 01:28:58 +0000
+
+openssh (1:5.2p1-1) unstable; urgency=low
+
+  * New upstream release (closes: #536182). Yes, I know 5.3p1 has been out
+    for a while, but there's no GSSAPI patch available for it yet.
+    - Change the default cipher order to prefer the AES CTR modes and the
+      revised "arcfour256" mode to CBC mode ciphers that are susceptible to
+      CPNI-957037 "Plaintext Recovery Attack Against SSH".
+    - Add countermeasures to mitigate CPNI-957037-style attacks against the
+      SSH protocol's use of CBC-mode ciphers. Upon detection of an invalid
+      packet length or Message Authentication Code, ssh/sshd will continue
+      reading up to the maximum supported packet length rather than
+      immediately terminating the connection. This eliminates most of the
+      known differences in behaviour that leaked information about the
+      plaintext of injected data which formed the basis of this attack
+      (closes: #506115, LP: #379329).
+    - ForceCommand directive now accepts commandline arguments for the
+      internal-sftp server (closes: #524423, LP: #362511).
+    - Add AllowAgentForwarding to available Match keywords list (closes:
+      #540623).
+    - Make ssh(1) send the correct channel number for
+      SSH2_MSG_CHANNEL_SUCCESS and SSH2_MSG_CHANNEL_FAILURE messages to
+      avoid triggering 'Non-public channel' error messages on sshd(8) in
+      openssh-5.1.
+    - Avoid printing 'Non-public channel' warnings in sshd(8), since the
+      ssh(1) has sent incorrect channel numbers since ~2004 (this reverts a
+      behaviour introduced in openssh-5.1; closes: #496017).
+    - Disable nonfunctional ssh(1) ~C escape handler in multiplex slave
+      connections (closes: #507541).
+    - Fix "whitepsace" typo in ssh_config(5) (closes: #514313, LP: #303835).
+  * Update to GSSAPI patch from
+    http://www.sxw.org.uk/computing/patches/openssh-5.2p1-gsskex-all-20090726.patch,
+    including cascading credentials support (LP: #416958).
+  * Use x11.pc when compiling/linking gnome-ssh-askpass2 (closes: #555951).
+  * Moved to bzr.debian.org; add Vcs-Bzr and Vcs-Browser control fields.
+  * Add debian/README.source with instructions on bzr handling.
+  * Make ChrootDirectory work with SELinux (thanks, Russell Coker; closes:
+    #556644).
+  * Initialise sc to NULL in ssh_selinux_getctxbyname (thanks, Václav Ovsík;
+    closes: #498684).
+  * Don't duplicate backslashes when displaying server banner (thanks,
+    Michał Górny; closes: #505378, LP: #425346).
+  * Use hardening-includes for hardening logic (thanks, Kees Cook; closes:
+    #561887).
+  * Update OpenSSH FAQ to revision 1.110.
+  * Remove ssh/new_config, only needed for direct upgrades from potato which
+    are no longer particularly feasible anyway (closes: #420682).
+  * Cope with insserv reordering of init script links.
+  * Remove init script stop link in rc1, as killprocs handles it already.
+  * Adjust short descriptions to avoid relying on previous experience with
+    rsh, based on suggestions from Reuben Thomas (closes: #512198).
+  * Remove manual page references to login.conf, which aren't applicable on
+    non-BSD systems (closes: #154434).
+  * Remove/adjust manual page references to BSD-specific /etc/rc (closes:
+    #513417).
+  * Refer to sshd_config(5) rather than sshd(8) in postinst-written
+    /etc/ssh/sshd_config, and add UsePAM commentary from upstream-shipped
+    configuration file (closes: #415008, although unfortunately this will
+    only be conveniently visible on new installations).
+  * Include URL to OpenBSD's ssl(8) in ssh(1), since I don't see a better
+    source for the same information among Debian's manual pages (closes:
+    #530692, LP: #456660).
+
+ -- Colin Watson <cjwatson@debian.org>  Mon, 04 Jan 2010 13:23:35 +0000
+
+openssh (1:5.1p1-8) unstable; urgency=low
+
+  * Build with just -fPIC on mips/mipsel, not -fPIE as well (thanks, LIU Qi;
+    closes: #538313).
+  * Build-depend on libselinux1-dev on sh4 too (thanks, Nobuhiro Iwamatsu;
+    closes: #547103).
+  * Fix grammar in if-up script (closes: #549128).
+  * Pass $SSHD_OPTS when checking configuration too (thanks, "sobtwmxt";
+    closes: #548662).
+
+ -- Colin Watson <cjwatson@debian.org>  Mon, 05 Oct 2009 13:30:49 +0100
+
+openssh (1:5.1p1-7) unstable; urgency=low
+
+  * Update config.guess and config.sub from autotools-dev 20090611.1
+    (closes: #538301).
+  * Set umask to 022 in the init script as well as postinsts (closes:
+    #539030).
+  * Add ${misc:Depends} to keep Lintian happy.
+  * Use 'which' rather than 'type' in maintainer scripts.
+  * Upgrade to debhelper v7.
+
+ -- Colin Watson <cjwatson@debian.org>  Fri, 31 Jul 2009 16:28:10 +0100
+
+openssh (1:5.1p1-6) unstable; urgency=low
+
+  * Open /proc/self/oom_adj with O_RDONLY or O_WRONLY as necessary, rather
+    than O_RDWR.
+  * Disable OOM adjustment for vserver/OpenVZ (thanks, Karl Chen; closes:
+    #511771).
+  * Add ufw integration (thanks, Didier Roche; see
+    https://wiki.ubuntu.com/UbuntuFirewall#Integrating%20UFW%20with%20Packages;
+    LP: #261884).
+  * Add a comment above PermitRootLogin in sshd_config pointing to
+    README.Debian.
+  * Check if delgroup is present in openssh-client.postrm (closes: #530501).
+  * Build with -fPIC on mips/mipsel (thanks, Luk Claes; closes: #531942).
+  * Remove /var/run/sshd from openssh-server package; it will be created at
+    run-time before starting the server.
+  * Use invoke-rc.d in openssh-server's if-up script.
+
+ -- Colin Watson <cjwatson@debian.org>  Fri, 05 Jun 2009 11:56:03 +0100
+
+openssh (1:5.1p1-5) unstable; urgency=low
+
+  * Backport from upstream CVS (Markus Friedl):
+    - packet_disconnect() on padding error, too. Should reduce the success
+      probability for the CPNI-957037 Plaintext Recovery Attack to 2^-18.
+  * Check that /var/run/sshd.pid exists and that the process ID listed there
+    corresponds to sshd before running '/etc/init.d/ssh reload' from if-up
+    script; SIGHUP is racy if called at boot before sshd has a chance to
+    install its signal handler, but fortunately the pid file is written
+    after that which lets us avoid the race (closes: #502444).
+  * While the above is a valuable sanity-check, it turns out that it doesn't
+    really fix the bug (thanks to Kevin Price for testing), so for the
+    meantime we'll just use '/etc/init.d/ssh restart', even though it is
+    unfortunately heavyweight.
+
+ -- Colin Watson <cjwatson@debian.org>  Wed, 14 Jan 2009 00:34:08 +0000
+
+openssh (1:5.1p1-4) unstable; urgency=low
+
+  * ssh-copy-id: Strip trailing colons from hostname (closes: #226172,
+    LP: #249706; thanks to Karl Goetz for nudging this along; forwarded
+    upstream as https://bugzilla.mindrot.org/show_bug.cgi?id=1530).
+  * Backport from upstream CVS (Markus Friedl):
+    - Only send eow and no-more-sessions requests to openssh 5 and newer;
+      fixes interop problems with broken ssh v2 implementations (closes:
+      #495917).
+  * Fix double-free when failing to parse a forwarding specification given
+    using ~C (closes: #505330; forwarded upstream as
+    https://bugzilla.mindrot.org/show_bug.cgi?id=1539).
+
+ -- Colin Watson <cjwatson@debian.org>  Sun, 23 Nov 2008 14:46:10 +0000
+
+openssh (1:5.1p1-3) unstable; urgency=low
+
+  * Remove unnecessary ssh-vulnkey output in non-verbose mode when no
+    compromised or unknown keys were found (closes: #496495).
+  * Configure with --disable-strip; dh_strip will deal with stripping
+    binaries and will honour DEB_BUILD_OPTIONS (thanks, Bernhard R. Link;
+    closes: #498681).
+  * Fix handling of zero-length server banners (thanks, Tomas Mraz; closes:
+    #497026).
+
+ -- Colin Watson <cjwatson@debian.org>  Tue, 30 Sep 2008 23:09:58 +0100
+
+openssh (1:5.1p1-2) unstable; urgency=low
+
+  * Look for $SHELL on the path when executing ProxyCommands or
+    LocalCommands (closes: #492728).
+
+ -- Colin Watson <cjwatson@debian.org>  Tue, 29 Jul 2008 15:31:25 +0100
+
+openssh (1:5.1p1-1) unstable; urgency=low
+
+  * New upstream release (closes: #474301). Important changes not previously
+    backported to 4.7p1:
+    - 4.9/4.9p1 (http://www.openssh.com/txt/release-4.9):
+      + Added chroot(2) support for sshd(8), controlled by a new option
+        "ChrootDirectory" (closes: #139047, LP: #24777).
+      + Linked sftp-server(8) into sshd(8). The internal sftp server is used
+        when the command "internal-sftp" is specified in a Subsystem or
+        ForceCommand declaration. When used with ChrootDirectory, the
+        internal sftp server requires no special configuration of files
+        inside the chroot environment.
+      + Added a protocol extension method "posix-rename@openssh.com" for
+        sftp-server(8) to perform POSIX atomic rename() operations; sftp(1)
+        prefers this if available (closes: #308561).
+      + Removed the fixed limit of 100 file handles in sftp-server(8).
+      + ssh(8) will now skip generation of SSH protocol 1 ephemeral server
+        keys when in inetd mode and protocol 2 connections are negotiated.
+        This speeds up protocol 2 connections to inetd-mode servers that
+        also allow Protocol 1.
+      + Accept the PermitRootLogin directive in a sshd_config(5) Match
+        block. Allows for, e.g. permitting root only from the local network.
+      + Reworked sftp(1) argument splitting and escaping to be more
+        internally consistent (i.e. between sftp commands) and more
+        consistent with sh(1). Please note that this will change the
+        interpretation of some quoted strings, especially those with
+        embedded backslash escape sequences.
+      + Support "Banner=none" in sshd_config(5) to disable sending of a
+        pre-login banner (e.g. in a Match block).
+      + ssh(1) ProxyCommands are now executed with $SHELL rather than
+        /bin/sh.
+      + ssh(1)'s ConnectTimeout option is now applied to both the TCP
+        connection and the SSH banner exchange (previously it just covered
+        the TCP connection). This allows callers of ssh(1) to better detect
+        and deal with stuck servers that accept a TCP connection but don't
+        progress the protocol, and also makes ConnectTimeout useful for
+        connections via a ProxyCommand.
+      + scp(1) incorrectly reported "stalled" on slow copies (closes:
+        #140828).
+      + scp(1) date underflow for timestamps before epoch.
+      + ssh(1) used the obsolete SIG DNS RRtype for host keys in DNS,
+        instead of the current standard RRSIG.
+      + Correctly drain ACKs when a sftp(1) upload write fails midway,
+        avoids a fatal() exit from what should be a recoverable condition.
+      + Fixed ssh-keygen(1) selective host key hashing (i.e. "ssh-keygen -HF
+        hostname") to not include any IP address in the data to be hashed.
+      + Make ssh(1) skip listening on the IPv6 wildcard address when a
+        binding address of 0.0.0.0 is used against an old SSH server that
+        does not support the RFC4254 syntax for wildcard bind addresses.
+      + Enable IPV6_V6ONLY socket option on sshd(8) listen socket, as is
+        already done for X11/TCP forwarding sockets (closes: #439661).
+      + Fix FD leak that could hang a ssh(1) connection multiplexing master.
+      + Make ssh(1) -q option documentation consistent with reality.
+      + Fixed sshd(8) PAM support not calling pam_session_close(), or
+        failing to call it with root privileges (closes: #372680).
+      + Fix activation of OpenSSL engine support when requested in configure
+        (LP: #119295).
+      + Cache SELinux status earlier so we know if it's enabled after a
+        chroot (LP: #237557).
+    - 5.1/5.1p1 (http://www.openssh.com/txt/release-5.1):
+      + Introduce experimental SSH Fingerprint ASCII Visualisation to ssh(1)
+        and ssh-keygen(1). Visual fingerprint display is controlled by a new
+        ssh_config(5) option "VisualHostKey". The intent is to render SSH
+        host keys in a visual form that is amenable to easy recall and
+        rejection of changed host keys.
+      + sshd_config(5) now supports CIDR address/masklen matching in "Match
+        address" blocks, with a fallback to classic wildcard matching.
+      + sshd(8) now supports CIDR matching in ~/.ssh/authorized_keys
+        from="..." restrictions, also with a fallback to classic wildcard
+        matching.
+      + Added an extended test mode (-T) to sshd(8) to request that it write
+        its effective configuration to stdout and exit. Extended test mode
+        also supports the specification of connection parameters (username,
+        source address and hostname) to test the application of
+        sshd_config(5) Match rules. 
+      + ssh(1) now prints the number of bytes transferred and the overall
+        connection throughput for SSH protocol 2 sessions when in verbose
+        mode (previously these statistics were displayed for protocol 1
+        connections only).
+      + sftp-server(8) now supports extension methods statvfs@openssh.com
+        and fstatvfs@openssh.com that implement statvfs(2)-like operations.
+      + sftp(1) now has a "df" command to the sftp client that uses the
+        statvfs@openssh.com to produce a df(1)-like display of filesystem
+        space and inode utilisation (requires statvfs@openssh.com support on
+        the server).
+      + Added a MaxSessions option to sshd_config(5) to allow control of the
+        number of multiplexed sessions supported over a single TCP
+        connection. This allows increasing the number of allowed sessions
+        above the previous default of 10, disabling connection multiplexing
+        (MaxSessions=1) or disallowing login/shell/subsystem sessions
+        entirely (MaxSessions=0).
+      + Added a no-more-sessions@openssh.com global request extension that
+        is sent from ssh(1) to sshd(8) when the client knows that it will
+        never request another session (i.e. when session multiplexing is
+        disabled). This allows a server to disallow further session requests
+        and terminate the session in cases where the client has been
+        hijacked.
+      + ssh-keygen(1) now supports the use of the -l option in combination
+        with -F to search for a host in ~/.ssh/known_hosts and display its
+        fingerprint.
+      + ssh-keyscan(1) now defaults to "rsa" (protocol 2) keys, instead of
+        "rsa1" (LP: #129794).
+      + Added an AllowAgentForwarding option to sshd_config(8) to control
+        whether authentication agent forwarding is permitted. Note that this
+        is a loose control, as a client may install their own unofficial
+        forwarder.
+      + ssh(1) and sshd(8): avoid unnecessary malloc/copy/free when
+        receiving network data, resulting in a ~10% speedup.
+      + ssh(1) and sshd(8) will now try additional addresses when connecting
+        to a port forward destination whose DNS name resolves to more than
+        one address. The previous behaviour was to try the only first
+        address and give up if that failed.
+      + ssh(1) and sshd(8) now support signalling that channels are
+        half-closed for writing, through a channel protocol extension
+        notification "eow@openssh.com". This allows propagation of closed
+        file descriptors, so that commands such as "ssh -2 localhost od
+        /bin/ls | true" do not send unnecessary data over the wire.
+      + sshd(8): increased the default size of ssh protocol 1 ephemeral keys
+        from 768 to 1024 bits.
+      + When ssh(1) has been requested to fork after authentication ("ssh
+        -f") with ExitOnForwardFailure enabled, delay the fork until after
+        replies for any -R forwards have been seen. Allows for robust
+        detection of -R forward failure when using -f.
+      + "Match group" blocks in sshd_config(5) now support negation of
+        groups. E.g. "Match group staff,!guests".
+      + sftp(1) and sftp-server(8) now allow chmod-like operations to set
+        set[ug]id/sticky bits.
+      + The MaxAuthTries option is now permitted in sshd_config(5) match
+        blocks.
+      + Multiplexed ssh(1) sessions now support a subset of the ~ escapes
+        that are available to a primary connection.
+      + ssh(1) connection multiplexing will now fall back to creating a new
+        connection in most error cases (closes: #352830).
+      + Make ssh(1) deal more gracefully with channel requests that fail.
+        Previously it would optimistically assume that requests would always
+        succeed, which could cause hangs if they did not (e.g. when the
+        server runs out of file descriptors).
+      + ssh(1) now reports multiplexing errors via the multiplex slave's
+        stderr where possible (subject to LogLevel in the mux master).
+      + Fixed an UMAC alignment problem that manifested on Itanium
+        platforms.
+  * Remove our local version of moduli(5) now that there's one upstream.
+  * Say "GTK+" rather than "GTK" in ssh-askpass-gnome's description.
+  * Add lintian overrides for empty /usr/share/doc/openssh-client
+    directories in openssh-server and ssh (necessary due to being symlink
+    targets).
+  * Merge from Ubuntu:
+    - Add 'status' action to openssh-server init script, requiring lsb-base
+      (>= 3.2-13) (thanks, Dustin Kirkland).
+  * debconf template translations:
+    - Update Korean (thanks, Sunjae Park; closes: #484821).
+
+ -- Colin Watson <cjwatson@debian.org>  Fri, 25 Jul 2008 10:45:08 +0100
+
+openssh (1:4.7p1-13) unstable; urgency=low
+
+  * Add some helpful advice to the end of ssh-vulnkey's output if there are
+    unknown or compromised keys (thanks, Dan Jacobson; closes: #483756).
+  * Check compromised key blacklist in ssh or ssh-add, as well as in the
+    server (LP: #232391). To override the blacklist check in ssh
+    temporarily, use 'ssh -o UseBlacklistedKeys=yes'; there is no override
+    for the blacklist check in ssh-add.
+  * Add cross-references to ssh-vulnkey(1) to ssh(1), ssh-add(1),
+    ssh-keygen(1), and sshd(8) (closes: #484451).
+  * Change openssh-client-udeb's Installer-Menu-Item from 99900 to 99999
+    (thanks, Frans Pop).
+  * Drop openssh-client-udeb isinstallable hack, as main-menu (>= 1.26) now
+    takes care of that (thanks, Frans Pop; closes: #484404).
+  * Update DEB_BUILD_OPTIONS parsing code from policy 3.8.0.
+  * Add documentation on removing openssh-blacklist locally (see #484269).
+  * Clarify documentation of SSHD_OOM_ADJUST, and make setting it to the
+    empty string actually skip adjustment as intended (closes: #487325).
+  * Remove empty /usr/share/applications directory in ssh-askpass-gnome.
+  * debconf template translations:
+    - Update Romanian (thanks, Cătălin Feștilă; closes: #485415).
+
+ -- Colin Watson <cjwatson@debian.org>  Mon, 21 Jul 2008 12:18:28 +0100
+
+openssh (1:4.7p1-12) unstable; urgency=low
+
+  * Fill in CVE identifier for ssh-vulnkey bug fixed in 1:4.7p1-10.
+  * Refactor rejection of blacklisted user keys into a single
+    reject_blacklisted_key function in auth.c (thanks, Dmitry V. Levin).
+  * Fix memory leak of blacklisted host keys (thanks, Dmitry V. Levin).
+  * debconf template translations:
+    - Update Dutch (thanks, Bart Cornelis; closes: #483004).
+    - Update Brazilian Portuguese (thanks, Eder L. Marques; closes:
+      #483142).
+    - Update Slovak (thanks, Ivan Masár; closes: #483517).
+
+ -- Colin Watson <cjwatson@debian.org>  Thu, 29 May 2008 21:41:29 +0100
+
+openssh (1:4.7p1-11) unstable; urgency=low
+
+  * Make init script depend on $syslog, and fix some other dependency
+    glitches (thanks, Petter Reinholdtsen; closes: #481018).
+  * Remove 0 and 6 from Default-Stop in init script (thanks, Kel Modderman;
+    closes: #481151).
+  * Restore OOM killer adjustment for child processes (thanks, Vaclav Ovsik;
+    closes: #480020).
+  * Allow building with heimdal-dev (LP: #125805).
+
+  * Check RSA1 keys without the need for a separate blacklist. Thanks to
+    Simon Tatham for the idea.
+  * Generate two keys with the PID forced to the same value and test that
+    they differ, to defend against recurrences of the recent Debian OpenSSL
+    vulnerability.
+  * Recommend openssh-blacklist from openssh-client (closes: #481187).
+  * Recommend openssh-blacklist-extra from openssh-client and
+    openssh-server.
+  * Make ssh-vulnkey report the file name and line number for each key
+    (thanks, Heiko Schlittermann and Christopher Perry; closes: #481398).
+  * Check for blacklists in /usr/share/ssh/ as well as /etc/ssh/ (see
+    #481283).
+  * Log IP addresses of hosts attempting to use blacklisted keys (closes:
+    #481721).
+  * Incorporate various ssh-vulnkey suggestions from Hugh Daniel:
+    - Add -v (verbose) option, and don't print output for keys that have a
+      blacklist file but that are not listed unless in verbose mode.
+    - Move exit status documentation to a separate section.
+    - Document key status descriptions.
+    - Add key type to output.
+    - Fix error output if ssh-vulnkey fails to read key files, with the
+      exception of host keys unless -a was given.
+    - In verbose mode, output the name of each file examined.
+  * Handle leading IP addresses in ssh-vulnkey input (LP: #230497).
+  * Fix various ssh-vulnkey problems pointed out by Solar Designer:
+    - Fix some buffer handling inconsistencies.
+    - Use xasprintf to build user key file names, avoiding truncation
+      problems.
+    - Drop to the user's UID when reading user keys with -a.
+    - Use EUID rather than UID when run with no file names and without -a.
+    - Reword "Unknown (no blacklist information)" to "Unknown (blacklist
+      file not installed)".
+
+  * Fix typo in ssh/vulnerable_host_keys message (thanks, Esko Arajärvi).
+  * debconf template translations:
+    - Update Finnish (thanks, Esko Arajärvi; closes: #481530).
+    - Update French (thanks, Christian Perrier; closes: #481576).
+    - Update Norwegian Bokmål (thanks, Bjørn Steensrud; closes: #481591).
+    - Update Galician (thanks, Jacobo Tarrio; closes: #481596).
+    - Update Japanese (thanks, Kenshi Muto; closes: #481621).
+    - Update Czech (thanks, Miroslav Kure; closes: #481624).
+    - Update German (thanks, Helge Kreutzmann; closes: #481676).
+    - Update Portuguese (thanks, Ricardo Silva; closes: #481781).
+    - Update Basque (thanks, Piarres Beobide; closes: #481836).
+    - Update Bulgarian (thanks, Damyan Ivanov; closes: #481870).
+    - Update Vietnamese (thanks, Clytie Siddall; closes: #481876).
+    - Update Spanish (thanks, Javier Fernandez-Sanguino Peña; closes:
+      #482341).
+    - Update Turkish (thanks, Mert Dirik; closes: #482548).
+    - Update Russian (thanks, Yuri Kozlov; closes: #482887).
+    - Update Swedish (thanks, Martin Bagge; closes: #482464).
+    - Update Italian (thanks, Luca Monducci; closes: #482808).
+
+ -- Colin Watson <cjwatson@debian.org>  Mon, 26 May 2008 12:21:39 +0100
+
+openssh (1:4.7p1-10) unstable; urgency=low
+
+  * Add a FILES section to ssh-vulnkey(1) (thanks, Hugh Daniel).
+  * CVE-2008-2285: ssh-vulnkey handles options in authorized_keys
+    (LP: #230029), and treats # as introducing a comment even if it is
+    preceded by whitespace.
+
+ -- Colin Watson <cjwatson@debian.org>  Wed, 14 May 2008 12:35:05 +0100
+
+openssh (1:4.7p1-9) unstable; urgency=critical
+
+  * Fill in CVE identifier for security vulnerability fixed in 1:4.7p1-8.
+  * Mitigate OpenSSL security vulnerability (CVE-2008-0166):
+    - Add key blacklisting support. Keys listed in
+      /etc/ssh/blacklist.TYPE-LENGTH will be rejected for authentication by
+      sshd, unless "PermitBlacklistedKeys yes" is set in
+      /etc/ssh/sshd_config.
+    - Add a new program, ssh-vulnkey, which can be used to check keys
+      against these blacklists.
+    - Depend on openssh-blacklist.
+    - Force dependencies on libssl0.9.8 / libcrypto0.9.8-udeb to at least
+      0.9.8g-9.
+    - Automatically regenerate known-compromised host keys, with a
+      critical-priority debconf note. (I regret that there was no time to
+      gather translations.)
+
+ -- Colin Watson <cjwatson@debian.org>  Tue, 13 May 2008 12:33:38 +0100
+
+openssh (1:4.7p1-8) unstable; urgency=high
+
+  * Fill in CVE identifier for security vulnerability fixed in 1:4.7p1-5.
+  * Rename KeepAlive to TCPKeepAlive in sshd_config, cleaning up from old
+    configurations (LP: #211400).
+  * Tweak scp's reporting of filenames in verbose mode to be a bit less
+    confusing with spaces (thanks, Nicolas Valcárcel; LP: #89945).
+  * Backport from 4.9p1:
+    - CVE-2008-1657: Ignore ~/.ssh/rc if a sshd_config ForceCommand is
+      specified.
+    - Add no-user-rc authorized_keys option to disable execution of
+      ~/.ssh/rc.
+  * Backport from Simon Wilkinson's GSSAPI key exchange patch for 5.0p1:
+    - Add code to actually implement GSSAPIStrictAcceptorCheck, which had
+      somehow been omitted from a previous version of this patch (closes:
+      #474246).
+
+ -- Colin Watson <cjwatson@debian.org>  Sun, 06 Apr 2008 12:34:19 +0100
+
+openssh (1:4.7p1-7) unstable; urgency=low
+
+  * Ignore errors writing to oom_adj (closes: #473573).
+
+ -- Colin Watson <cjwatson@debian.org>  Mon, 31 Mar 2008 16:24:44 +0100
+
+openssh (1:4.7p1-6) unstable; urgency=low
+
+  * Disable the Linux kernel's OOM-killer for the sshd parent; tweak
+    SSHD_OOM_ADJUST in /etc/default/ssh to change this (closes: #341767).
+
+ -- Colin Watson <cjwatson@debian.org>  Sun, 30 Mar 2008 21:14:12 +0100
+
+openssh (1:4.7p1-5) unstable; urgency=low
+
+  * Recommends: xauth rather than Suggests: xbase-clients.
+  * Document in ssh(1) that '-S none' disables connection sharing
+    (closes: #471437).
+  * Patch from Red Hat / Fedora:
+    - CVE-2008-1483: Don't use X11 forwarding port which can't be bound on
+      all address families, preventing hijacking of X11 forwarding by
+      unprivileged users when both IPv4 and IPv6 are configured (closes:
+      #463011).
+  * Use printf rather than echo -en (a bashism) in openssh-server.config and
+    openssh-server.preinst.
+  * debconf template translations:
+    - Update Finnish (thanks, Esko Arajärvi; closes: #468563).
+
+ -- Colin Watson <cjwatson@debian.org>  Sat, 22 Mar 2008 12:37:00 +0000
+
+openssh (1:4.7p1-4) unstable; urgency=low
+
+  [ Caleb Case ]
+  * Fix configure detection of getseuserbyname and
+    get_default_context_with_level (closes: #465614, LP: #188136).
+
+  [ Colin Watson ]
+  * Include the autogenerated debian/copyright in the source package.
+  * Move /etc/pam.d/ssh to /etc/pam.d/sshd, allowing us to stop defining
+    SSHD_PAM_SERVICE (closes: #255870).
+
+ -- Colin Watson <cjwatson@debian.org>  Wed, 13 Feb 2008 18:18:52 +0000
+
+openssh (1:4.7p1-3) unstable; urgency=low
+
+  * Improve grammar of ssh-askpass-gnome description.
+  * Backport from upstream:
+    - Use the correct packet maximum sizes for remote port and agent
+      forwarding. Prevents the server from killing the connection if too
+      much data is queued and an excessively large packet gets sent
+      (https://bugzilla.mindrot.org/show_bug.cgi?id=1360).
+  * Allow passing temporary daemon parameters on the init script's command
+    line, e.g. '/etc/init.d/ssh start "-o PermitRootLogin=yes"' (thanks,
+    Marc Haber; closes: #458547).
+
+ -- Colin Watson <cjwatson@debian.org>  Fri, 01 Feb 2008 21:59:59 +0000
+
+openssh (1:4.7p1-2) unstable; urgency=low
+
+  * Adjust many relative links in faq.html to point to
+    http://www.openssh.org/ (thanks, Dan Jacobson; mentioned in #459807).
+  * Pass --with-mantype=doc to configure rather than build-depending on
+    groff (closes: #460121).
+  * Add armel to architecture list for libselinux1-dev build-dependency
+    (closes: #460136).
+  * Drop source-compatibility with Debian 3.0:
+    - Remove support for building with GNOME 1. This allows simplification
+      of our GNOME build-dependencies (see #460136).
+    - Remove hacks to support the old PAM configuration scheme.
+    - Remove compatibility for building without po-debconf.
+  * Build-depend on libgtk2.0-dev rather than libgnomeui-dev. As far as I
+    can see, the GTK2 version of ssh-askpass-gnome has never required
+    libgnomeui-dev.
+
+ -- Colin Watson <cjwatson@debian.org>  Fri, 11 Jan 2008 00:14:10 +0000
+
+openssh (1:4.7p1-1) unstable; urgency=low
+
+  * New upstream release (closes: #453367).
+    - CVE-2007-4752: Prevent ssh(1) from using a trusted X11 cookie if
+      creation of an untrusted cookie fails; found and fixed by Jan Pechanec
+      (closes: #444738).
+    - sshd(8) in new installations defaults to SSH Protocol 2 only. Existing
+      installations are unchanged.
+    - The SSH channel window size has been increased, and both ssh(1)
+      sshd(8) now send window updates more aggressively. These improves
+      performance on high-BDP (Bandwidth Delay Product) networks.
+    - ssh(1) and sshd(8) now preserve MAC contexts between packets, which
+      saves 2 hash calls per packet and results in 12-16% speedup for
+      arcfour256/hmac-md5.
+    - A new MAC algorithm has been added, UMAC-64 (RFC4418) as
+      "umac-64@openssh.com". UMAC-64 has been measured to be approximately
+      20% faster than HMAC-MD5.
+    - Failure to establish a ssh(1) TunnelForward is now treated as a fatal
+      error when the ExitOnForwardFailure option is set.
+    - ssh(1) returns a sensible exit status if the control master goes away
+      without passing the full exit status.
+    - When using a ProxyCommand in ssh(1), set the outgoing hostname with
+      gethostname(2), allowing hostbased authentication to work.
+    - Make scp(1) skip FIFOs rather than hanging (closes: #246774).
+    - Encode non-printing characters in scp(1) filenames. These could cause
+      copies to be aborted with a "protocol error".
+    - Handle SIGINT in sshd(8) privilege separation child process to ensure
+      that wtmp and lastlog records are correctly updated.
+    - Report GSSAPI mechanism in errors, for libraries that support multiple
+      mechanisms.
+    - Improve documentation for ssh-add(1)'s -d option.
+    - Rearrange and tidy GSSAPI code, removing server-only code being linked
+      into the client.
+    - Delay execution of ssh(1)'s LocalCommand until after all forwardings
+      have been established.
+    - In scp(1), do not truncate non-regular files.
+    - Improve exit message from ControlMaster clients.
+    - Prevent sftp-server(8) from reading until it runs out of buffer space,
+      whereupon it would exit with a fatal error (closes: #365541).
+    - pam_end() was not being called if authentication failed
+      (closes: #405041).
+    - Manual page datestamps updated (closes: #433181).
+  * Install the OpenSSH FAQ in /usr/share/doc/openssh-client.
+    - Includes documentation on copying files with colons using scp
+      (closes: #303453).
+  * Create /var/run/sshd on start even if /etc/ssh/sshd_not_to_be_run exists
+    (closes: #453285).
+  * Fix "overriden" typo in ssh(1) (thanks, A. Costa; closes: #390699).
+  * Refactor debian/rules configure and make invocations to make development
+    easier.
+  * Remove the hideously old /etc/ssh/primes on upgrade (closes: #123013).
+  * Update moduli(5) to revision 1.11 from OpenBSD CVS.
+  * Document the non-default options we set as standard in ssh_config(5) and
+    sshd_config(5) (closes: #327886, #345628).
+  * Recode LICENCE to UTF-8 when concatenating it to debian/copyright.
+  * Override desktop-file-but-no-dh_desktop-call lintian warning; the
+    .desktop file is intentionally not installed (see 1:3.8.1p1-10).
+  * Update copyright dates for Kerberos patch in debian/copyright.head.
+  * Policy version 3.7.3: no changes required.
+
+ -- Colin Watson <cjwatson@debian.org>  Mon, 24 Dec 2007 16:43:02 +0000
+
+openssh (1:4.6p1-7) unstable; urgency=low
+
+  * Don't build PIE executables on m68k (closes: #451192).
+  * Use autotools-dev's recommended configure --build and --host options.
+  * Adjust README.Debian to suggest mailing debian-ssh@lists.debian.org
+    rather than Matthew.
+  * Check whether deluser exists in postrm (closes: #454085).
+
+ -- Colin Watson <cjwatson@debian.org>  Mon, 03 Dec 2007 11:11:02 +0000
+
+openssh (1:4.6p1-6) unstable; urgency=low
+
+  * Remove blank line between head comment and first template in
+    debian/openssh-server.templates.master; apparently it confuses some
+    versions of debconf.
+  * Install authorized_keys(5) as a symlink to sshd(8) (thanks, Tomas
+    Pospisek; closes: #441817).
+  * Discard error output from dpkg-query in preinsts, in case the ssh
+    metapackage is not installed.
+  * Fix sshd/inittab advice in README.Debian to account for rc.d movement
+    (closes: #450632).
+  * Suppress error from debian/rules if lsb-release is not installed.
+  * Don't ignore errors from 'make -C contrib clean'.
+  * Adjust categories in ssh-askpass-gnome.desktop to comply with the
+    Desktop Menu Specification.
+  * debconf template translations:
+    - Add Slovak (thanks, Ivan Masár; closes: #441690).
+    - Update Brazilian Portuguese (thanks, Eder L. Marques;
+      closes: #447145).
+
+ -- Colin Watson <cjwatson@debian.org>  Mon, 12 Nov 2007 11:47:28 +0000
+
+openssh (1:4.6p1-5) unstable; urgency=low
+
+  * Identify ssh as a metapackage rather than a transitional package. It's
+    still useful as a quick way to install both the client and the server.
+  * ssh-copy-id now checks the exit status of ssh-add -L (thanks, Adeodato
+    Simó; closes: #221675).
+  * ssh-copy-id no longer prints the output of expr (thanks, Peter
+    Eisentraut; closes: #291534).
+  * ssh-copy-id defaults to ~/.ssh/id_rsa.pub rather than
+    ~/.ssh/identity.pub, in line with ssh-keygen (thanks, Greg Norris;
+    closes: #234627).
+  * Build-depend on libselinux1-dev on lpia.
+  * openssh-client Suggests: keychain.
+  * debconf template translations:
+    - Update Catalan (thanks, Jordà Polo; closes: #431970).
+
+ -- Colin Watson <cjwatson@debian.org>  Mon, 30 Jul 2007 09:34:38 +0100
+
+openssh (1:4.6p1-4) unstable; urgency=low
+
+  * Don't build PIE executables on hppa, as they crash.
+
+ -- Colin Watson <cjwatson@debian.org>  Thu, 05 Jul 2007 11:06:54 +0100
+
+openssh (1:4.6p1-3) unstable; urgency=low
+
+  * Only build PIE executables on Linux and NetBSD (closes: #430455).
+  * Fix broken switch fallthrough when SELinux is running in permissive mode
+    (closes: #430838).
+  * Document that HashKnownHosts may break tab-completion (closes: #430154).
+
+ -- Colin Watson <cjwatson@debian.org>  Fri, 29 Jun 2007 07:15:38 +0100
+
+openssh (1:4.6p1-2) unstable; urgency=low
+
+  * Fix ordering of SYSLOG_LEVEL_QUIET and SYSLOG_LEVEL_FATAL.
+  * Clarify that 'ssh -q -q' still prints errors caused by bad arguments
+    (i.e. before the logging system is initialised).
+  * Suppress "Connection to <host> closed" and "Connection to master closed"
+    messages at loglevel SILENT (thanks, Jaap Eldering; closes: #409788).
+  * Suppress "Pseudo-terminal will not be allocated because stdin is not a
+    terminal" message at loglevels QUIET and SILENT (closes: #366814).
+  * Document the SILENT loglevel in sftp-server(8), ssh_config(5), and
+    sshd_config(5).
+  * Add try-restart action to init script.
+  * Add /etc/network/if-up.d/openssh-server to restart sshd when new
+    interfaces appear (LP: #103436).
+  * Backport from upstream:
+    - Move C/R -> kbdint special case to after the defaults have been
+      loaded, which makes ChallengeResponse default to yes again. This was
+      broken by the Match changes and not fixed properly subsequently
+      (closes: #428968).
+    - Silence spurious error messages from hang-on-exit fix
+      (http://bugzilla.mindrot.org/show_bug.cgi?id=1306, closes: #429531).
+
+ -- Colin Watson <cjwatson@debian.org>  Wed, 20 Jun 2007 11:52:44 +0100
+
+openssh (1:4.6p1-1) unstable; urgency=low
+
+  * New upstream release (closes: #395507, #397961, #420035). Important
+    changes not previously backported to 4.3p2:
+    - 4.4/4.4p1 (http://www.openssh.org/txt/release-4.4):
+      + On portable OpenSSH, fix a GSSAPI authentication abort that could be
+        used to determine the validity of usernames on some platforms.
+      + Implemented conditional configuration in sshd_config(5) using the
+        "Match" directive. This allows some configuration options to be
+        selectively overridden if specific criteria (based on user, group,
+        hostname and/or address) are met. So far a useful subset of
+        post-authentication options are supported and more are expected to
+        be added in future releases.
+      + Add support for Diffie-Hellman group exchange key agreement with a
+        final hash of SHA256.
+      + Added a "ForceCommand" directive to sshd_config(5). Similar to the
+        command="..." option accepted in ~/.ssh/authorized_keys, this forces
+        the execution of the specified command regardless of what the user
+        requested. This is very useful in conjunction with the new "Match"
+        option.
+      + Add a "PermitOpen" directive to sshd_config(5). This mirrors the
+        permitopen="..." authorized_keys option, allowing fine-grained
+        control over the port-forwardings that a user is allowed to
+        establish.
+      + Add optional logging of transactions to sftp-server(8).
+      + ssh(1) will now record port numbers for hosts stored in
+        ~/.ssh/known_hosts when a non-standard port has been requested
+        (closes: #50612).
+      + Add an "ExitOnForwardFailure" option to cause ssh(1) to exit (with a
+        non-zero exit code) when requested port forwardings could not be
+        established.
+      + Extend sshd_config(5) "SubSystem" declarations to allow the
+        specification of command-line arguments.
+      + Replacement of all integer overflow susceptible invocations of
+        malloc(3) and realloc(3) with overflow-checking equivalents.
+      + Many manpage fixes and improvements.
+      + Add optional support for OpenSSL hardware accelerators (engines),
+        enabled using the --with-ssl-engine configure option.
+      + Tokens in configuration files may be double-quoted in order to
+        contain spaces (closes: #319639).
+      + Move a debug() call out of a SIGCHLD handler, fixing a hang when the
+        session exits very quickly (closes: #307890).
+      + Fix some incorrect buffer allocation calculations (closes: #410599).
+      + ssh-add doesn't ask for a passphrase if key file permissions are too
+        liberal (closes: #103677).
+      + Likewise, ssh doesn't ask either (closes: #99675).
+    - 4.6/4.6p1 (http://www.openssh.org/txt/release-4.6):
+      + sshd now allows the enabling and disabling of authentication methods
+        on a per user, group, host and network basis via the Match directive
+        in sshd_config.
+      + Fixed an inconsistent check for a terminal when displaying scp
+        progress meter (closes: #257524).
+      + Fix "hang on exit" when background processes are running at the time
+        of exit on a ttyful/login session (closes: #88337).
+  * Update to current GSSAPI patch from
+    http://www.sxw.org.uk/computing/patches/openssh-4.6p1-gsskex-20070312.patch;
+    install ChangeLog.gssapi.
+  * Build the .deb --with-ssl-engine (closes: #408027, LP: #119295).
+  * Use LSB functions in init scripts, and add an LSB-style header (partly
+    from Ubuntu and partly thanks to Christian Perrier; closes: #389038).
+  * Move init script start links to S16, move rc1 stop link to K84, and
+    remove rc0 and rc6 stop links altogether (the last part from Ubuntu;
+    closes: #122188).
+  * Emit a slightly more informative message from the init script if
+    /dev/null has somehow become not a character device (closes: #369964).
+  * Belatedly build-depend on zlib1g-dev (>= 1:1.2.3-1) (closes: #333447).
+  * Merge from Ubuntu:
+    - Build position-independent executables (only for debs, not for udebs)
+      to take advantage of address space layout randomisation.
+    - If building on Ubuntu, add /sbin, /usr/sbin, and /usr/local/sbin to
+      the default path.
+  * Use ${binary:Version} rather than ${Source-Version} in openssh-server ->
+    openssh-client dependency.
+
+ -- Colin Watson <cjwatson@debian.org>  Wed, 13 Jun 2007 00:28:26 +0100
+
+openssh (1:4.3p2-11) unstable; urgency=low
+
+  * It's been four and a half years now since I took over as "temporary"
+    maintainer, so the Maintainer field is getting a bit inaccurate. Set
+    Maintainer to debian-ssh@lists.debian.org and leave Matthew and myself
+    as Uploaders.
+  * Use dpkg-query to fetch conffile md5sums rather than parsing
+    /var/lib/dpkg/status directly.
+  * openssh-client Suggests: libpam-ssh (closes: #427840).
+  * Use 'start-stop-daemon --oknodo' so that openssh-server's init script
+    exits successfully if sshd is already running (closes: #426858).
+
+  * Apply results of debconf templates and package descriptions review by
+    debian-l10n-english (closes: #420107, #420742).
+  * debconf template translations:
+    - Update Dutch (thanks, Machteld de Kok; closes: #419260).
+    - Update Norwegian Bokmål (thanks, Bjørn Steensrud; closes: #420630).
+    - Update Galician (thanks, Jacobo Tarrio; closes: #420635).
+    - Update Spanish (thanks, Javier Fernández-Sanguino Peña;
+      closes: #420651).
+    - Update Swedish (thanks, Daniel Nylander; closes: #420663).
+    - Add Bulgarian (thanks, Damyan Ivanov; closes: #420703).
+    - Add Tamil (thanks, Tirumurti Vasudevan; closes: #420739).
+    - Update German (thanks, Helge Kreutzmann; closes: #420743).
+    - Update Japanese (thanks, Kenshi Muto; closes: #420946).
+    - Add Basque (thanks, Piarres Beobide; closes: #421238).
+    - Update Italian (thanks, Luca Monducci; closes: #421348).
+    - Update Czech (thanks, Miroslav Kure; closes: #421484).
+    - Update Romanian (thanks, Igor Stirbu; closes: #421760).
+    - Update Russian (thanks, Yuriy Talakan' and Sergey Alyoshin;
+      closes: #420862).
+    - Update Dutch (thanks, Bart Cornelis; closes: #422767).
+    - Update Portuguese (thanks, Ricardo Silva; closes: #423112).
+    - Update French (thanks, Christian Perrier).
+    - Add Korean (thanks, Sunjae Park; closes: #424008).
+    - Update Vietnamese (thanks, Clytie Siddall; closes: #426991).
+
+ -- Colin Watson <cjwatson@debian.org>  Sun, 10 Jun 2007 08:59:42 +0100
+
+openssh (1:4.3p2-10) unstable; urgency=low
+
+  * Multiply openssh-client-udeb's Installer-Menu-Item by 100.
+  * Increase MAX_SESSIONS to 64.
+
+ -- Colin Watson <cjwatson@debian.org>  Tue, 10 Apr 2007 19:17:20 +0100
+
+openssh (1:4.3p2-9) unstable; urgency=high
+
+  [ Russ Allbery ]
+  * Fix GSSAPIKeyExchange configuration file handling logic in ssh-krb5
+    (closes: #404863).
+  * Fix uncommenting of GSSAPI options by ssh-krb5 (closes: #407766).
+
+  [ Colin Watson ]
+  * debconf template translations:
+    - Add Norwegian Bokmål (thanks, Bjørn Steensrud; closes: #412330).
+
+ -- Colin Watson <cjwatson@debian.org>  Mon,  5 Mar 2007 16:13:50 +0000
+
+openssh (1:4.3p2-8) unstable; urgency=medium
+
+  [ Vincent Untz ]
+  * Give the ssh-askpass-gnome window a default icon; remove unnecessary
+    icon extension from .desktop file (closes:
+    https://launchpad.net/bugs/27152).
+
+  [ Colin Watson ]
+  * Drop versioning on ssh/ssh-krb5 Replaces, as otherwise it isn't
+    sufficient to replace conffiles (closes: #402804).
+  * Make GSSAPICleanupCreds a compatibility alias for
+    GSSAPICleanupCredentials. Mark GSSUseSessionCCache and
+    GSSAPIUseSessionCredCache as known-but-unsupported options, and migrate
+    away from them on upgrade.
+  * It turns out that the people who told me that removing a conffile in the
+    preinst was sufficient to have dpkg replace it without prompting when
+    moving a conffile between packages were very much mistaken. As far as I
+    can tell, the only way to do this reliably is to write out the desired
+    new text of the conffile in the preinst. This is gross, and requires
+    shipping the text of all conffiles in the preinst too, but there's
+    nothing for it. Fortunately this nonsense is only required for smooth
+    upgrades from sarge.
+  * debconf template translations:
+    - Add Romanian (thanks, Stan Ioan-Eugen; closes: #403528).
+
+ -- Colin Watson <cjwatson@debian.org>  Sat, 23 Dec 2006 18:38:33 +0000
+
+openssh (1:4.3p2-7) unstable; urgency=medium
+
+  [ Colin Watson ]
+  * Ignore errors from usermod when changing sshd's shell, since it will
+    fail if the sshd user is not local (closes: #398436).
+  * Remove version control tags from /etc/ssh/moduli and /etc/ssh/ssh_config
+    to avoid unnecessary conffile resolution steps for administrators
+    (thanks, Jari Aalto; closes: #335259).
+  * Fix quoting error in configure.ac and regenerate configure (thanks, Ben
+    Pfaff; closes: #391248).
+  * When installing openssh-client or openssh-server from scratch, remove
+    any unchanged conffiles from the pre-split ssh package to work around a
+    bug in sarge's dpkg (thanks, Justin Pryzby and others; closes: #335276).
+
+  [ Russ Allbery ]
+  * Create transitional ssh-krb5 package which enables GSSAPI configuration
+    in sshd_config (closes: #390986).
+  * Default client to attempting GSSAPI authentication.
+  * Remove obsolete GSSAPINoMICAuthentication from sshd_config if it's
+    found.
+  * Add ssh -K option, the converse of -k, to enable GSSAPI credential
+    delegation (closes: #401483).
+
+ -- Colin Watson <cjwatson@debian.org>  Wed,  6 Dec 2006 23:00:49 +0000
+
+openssh (1:4.3p2-6) unstable; urgency=low
+
+  * Acknowledge NMU (thanks, Manoj; closes: #394795).
+  * Backport from 4.5p1:
+    - Fix a bug in the sshd privilege separation monitor that weakened its
+      verification of successful authentication. This bug is not known to be
+      exploitable in the absence of additional vulnerabilities.
+  * openssh-server Suggests: molly-guard (closes: #395473).
+  * debconf template translations:
+    - Update German (thanks, Helge Kreutzmann; closes: #395947).
+
+ -- Colin Watson <cjwatson@debian.org>  Wed, 15 Nov 2006 00:07:32 +0000
+
+openssh (1:4.3p2-5.1) unstable; urgency=low
+
+  * NMU to update SELinux patch, bringing it in line with current selinux
+    releases.  The patch for this NMU is simply the Bug#394795 patch, 
+    and no other changes.                       (closes: #394795)
+
+ -- Manoj Srivastava <srivasta@debian.org>  Mon,  23 Oct 2006 14:11:24 -0500
+
+openssh (1:4.3p2-5) unstable; urgency=low
+
+  * Remove ssh/insecure_telnetd check altogether (closes: #391081).
+  * debconf template translations:
+    - Update Danish (thanks, Claus Hindsgaul; closes: #390612).
+
+ -- Colin Watson <cjwatson@debian.org>  Thu,  5 Oct 2006 09:04:19 +0100
+
+openssh (1:4.3p2-4) unstable; urgency=high
+
+  * Backport from 4.4p1 (since I don't have an updated version of the GSSAPI
+    patch yet):
+    - CVE-2006-4924: Fix a pre-authentication denial of service found by
+      Tavis Ormandy, that would cause sshd(8) to spin until the login grace
+      time expired (closes: #389995).
+    - CVE-2006-5051: Fix an unsafe signal hander reported by Mark Dowd. The
+      signal handler was vulnerable to a race condition that could be
+      exploited to perform a pre-authentication denial of service. On
+      portable OpenSSH, this vulnerability could theoretically lead to
+      pre-authentication remote code execution if GSSAPI authentication is
+      enabled, but the likelihood of successful exploitation appears remote.
+
+  * Read /etc/default/locale as well as /etc/environment (thanks, Raphaël
+    Hertzog; closes: #369395).
+  * Remove no-longer-used ssh/insecure_rshd debconf template.
+  * Make ssh/insecure_telnetd Type: error (closes: #388946).
+
+  * debconf template translations:
+    - Update Portuguese (thanks, Rui Branco; closes: #381942).
+    - Update Spanish (thanks, Javier Fernández-Sanguino Peña;
+      closes: #382966).
+
+ -- Colin Watson <cjwatson@debian.org>  Fri, 29 Sep 2006 16:28:24 +0100
+
+openssh (1:4.3p2-3) unstable; urgency=low
+
+  * Document KeepAlive->TCPKeepAlive renaming in sshd_config(5) (closes:
+    https://launchpad.net/bugs/50702).
+  * Change sshd user's shell to /usr/sbin/nologin (closes: #366541).
+    Introduces dependency on passwd for usermod.
+  * debconf template translations:
+    - Update French (thanks, Denis Barbier; closes: #368503).
+    - Update Dutch (thanks, Bart Cornelis; closes: #375100).
+    - Update Japanese (thanks, Kenshi Muto; closes: #379950).
+
+ -- Colin Watson <cjwatson@debian.org>  Thu, 27 Jul 2006 00:12:36 +0100
+
+openssh (1:4.3p2-2) unstable; urgency=low
+
+  * Include commented-out pam_access example in /etc/pam.d/ssh.
+  * On '/etc/init.d/ssh restart', create /var/run/sshd before checking the
+    server configuration, as otherwise 'sshd -t' will complain about the
+    lack of /var/run/sshd (closes: https://launchpad.net/bugs/45234).
+  * debconf template translations:
+    - Update Russian (thanks, Yuriy Talakan'; closes: #367143).
+    - Update Czech (thanks, Miroslav Kure; closes: #367161).
+    - Update Italian (thanks, Luca Monducci; closes: #367186).
+    - Update Galician (thanks, Jacobo Tarrio; closes: #367318).
+    - Update Swedish (thanks, Daniel Nylander; closes: #367971).
+
+ -- Colin Watson <cjwatson@debian.org>  Fri, 19 May 2006 09:14:27 +0100
+
+openssh (1:4.3p2-1) unstable; urgency=low
+
+  * New upstream release (closes: #361032).
+    - CVE-2006-0225: scp (as does rcp, on which it is based) invoked a
+      subshell to perform local to local, and remote to remote copy
+      operations. This subshell exposed filenames to shell expansion twice;
+      allowing a local attacker to create filenames containing shell
+      metacharacters that, if matched by a wildcard, could lead to execution
+      of attacker-specified commands with the privilege of the user running
+      scp (closes: #349645).
+    - Add support for tunneling arbitrary network packets over a connection
+      between an OpenSSH client and server via tun(4) virtual network
+      interfaces. This allows the use of OpenSSH (4.3+) to create a true VPN
+      between the client and server providing real network connectivity at
+      layer 2 or 3. This feature is experimental.
+    - Reduce default key length for new DSA keys generated by ssh-keygen
+      back to 1024 bits. DSA is not specified for longer lengths and does
+      not fully benefit from simply making keys longer. As per FIPS 186-2
+      Change Notice 1, ssh-keygen will refuse to generate a new DSA key
+      smaller or larger than 1024 bits.
+    - Fixed X forwarding failing to start when the X11 client is executed in
+      background at the time of session exit.
+    - Change ssh-keygen to generate a protocol 2 RSA key when invoked
+      without arguments (closes: #114894).
+    - Fix timing variance for valid vs. invalid accounts when attempting
+      Kerberos authentication.
+    - Ensure that ssh always returns code 255 on internal error
+      (closes: #259865).
+    - Cleanup wtmp files on SIGTERM when not using privsep.
+    - Set SO_REUSEADDR on X11 listeners to avoid problems caused by
+      lingering sockets from previous session (X11 applications can
+      sometimes not connect to 127.0.0.1:60xx) (closes:
+      https://launchpad.net/bugs/25528).
+    - Ensure that fds 0, 1 and 2 are always attached in all programs, by
+      duping /dev/null to them if necessary.
+    - Xauth list invocation had bogus "." argument.
+    - Remove internal assumptions on key exchange hash algorithm and output
+      length, preparing OpenSSH for KEX methods with alternate hashes.
+    - Ignore junk sent by a server before it sends the "SSH-" banner.
+    - Many manual page improvements.
+    - Lots of cleanups, including fixes to memory leaks on error paths and
+      possible crashes.
+  * Update to current GSSAPI patch from
+    http://www.sxw.org.uk/computing/patches/openssh-4.3p2-gsskex-20060223.patch
+    (closes: #352042).
+  * debian/rules: Resynchronise CFLAGS with that generated by configure.
+  * Restore pam_nologin to /etc/pam.d/ssh; sshd no longer checks this itself
+    when PAM is enabled, but relies on PAM to do it.
+  * Rename KeepAlive to TCPKeepAlive in default sshd_config
+    (closes: #349896).
+  * Rephrase ssh/new_config and ssh/encrypted_host_key_but_no_keygen debconf
+    templates to make boolean short descriptions end with a question mark
+    and to avoid use of the first person.
+  * Ship README.tun.
+  * Policy version 3.7.2: no changes required.
+  * debconf template translations:
+    - Update Italian (thanks, Luca Monducci; closes: #360348).
+    - Add Galician (thanks, Jacobo Tarrio; closes: #361220).
+
+ -- Colin Watson <cjwatson@debian.org>  Fri, 12 May 2006 12:48:24 +0100
+
+openssh (1:4.2p1-8) unstable; urgency=low
+
+  [ Frans Pop ]
+  * Use udeb support introduced in debhelper 4.2.0 (available in sarge)
+    rather than constructing udebs by steam.
+  * Require debhelper 5.0.22, which generates correct shared library
+    dependencies for udebs (closes: #360068). This build-dependency can be
+    ignored if building on sarge.
+
+  [ Colin Watson ]
+  * Switch to debhelper compatibility level 4, since we now require
+    debhelper 4 even on sarge anyway for udeb support.
+
+ -- Colin Watson <cjwatson@debian.org>  Fri, 31 Mar 2006 09:44:55 +0100
+
+openssh (1:4.2p1-7) unstable; urgency=low
+
+  * I accidentally applied the default $PATH change in 1:4.2p1-6 to the udeb
+    rather than the deb. Fixed.
+
+ -- Colin Watson <cjwatson@debian.org>  Wed,  1 Mar 2006 16:19:00 +0000
+
+openssh (1:4.2p1-6) unstable; urgency=low
+
+  * Sync default values of $PATH from shadow 1:4.0.12-6, adding /usr/bin/X11
+    to the normal and superuser paths and /usr/games to the normal path.
+  * When the client receives a signal, don't fatal() with "Killed by signal
+    %d." (which produces unhelpful noise on stderr and causes confusion for
+    users of some applications that wrap ssh); instead, generate a debug
+    message and exit with the traditional status (closes: #313371).
+  * debconf template translations:
+    - Add Swedish (thanks, Daniel Nylander; closes: #333133).
+    - Update Spanish (thanks, Javier Fernández-Sanguino Peña;
+      closes: #341371).
+    - Correct erroneously-changed Last-Translator headers in Greek and
+      Spanish translations.
+
+ -- Colin Watson <cjwatson@debian.org>  Mon, 20 Feb 2006 16:50:55 +0000
+
+openssh (1:4.2p1-5) unstable; urgency=low
+
+  * Add a CVE name to the 1:4.0p1-1 changelog entry.
+  * Build-depend on libselinux1-dev on armeb.
+  * Only send GSSAPI proposal if GSSAPIAuthentication is enabled.
+  * Build-depend on libssl-dev (>= 0.9.8-1) to cope with surprise OpenSSL
+    transition, since otherwise who knows what the buildds will do. If
+    you're building openssh yourself, you can safely ignore this and use an
+    older libssl-dev.
+
+ -- Colin Watson <cjwatson@debian.org>  Fri,  7 Oct 2005 12:23:42 +0100
+
+openssh (1:4.2p1-4) unstable; urgency=low
+
+  * Initialise token to GSS_C_EMPTY_BUFFER in ssh_gssapi_check_mechanism
+    (closes: #328606).
+
+ -- Colin Watson <cjwatson@debian.org>  Fri, 16 Sep 2005 12:50:16 +0100
+
+openssh (1:4.2p1-3) unstable; urgency=low
+
+  * Add prototype for ssh_gssapi_server_mechanisms (closes: #328372).
+  * Interoperate with ssh-krb5 << 3.8.1p1-1 servers, which used a slightly
+    different version of the gssapi authentication method (thanks, Aaron M.
+    Ucko; closes: #328388).
+  * Explicitly tell po2debconf to use the 'popular' output encoding, so that
+    the woody-compatibility hack works even with po-debconf 0.9.0.
+
+ -- Colin Watson <cjwatson@debian.org>  Thu, 15 Sep 2005 09:28:21 +0100
+
+openssh (1:4.2p1-2) unstable; urgency=low
+
+  * Annotate 1:4.2p1-1 changelog with CVE references.
+  * Add remaining pieces of Kerberos support (closes: #152657, #275472):
+    - Add GSSAPI key exchange support from
+      http://www.sxw.org.uk/computing/patches/openssh.html (thanks, Stephen
+      Frost).
+    - Build-depend on libkrb5-dev and configure --with-kerberos5=/usr.
+    - openssh-client and openssh-server replace ssh-krb5.
+    - Update commented-out Kerberos/GSSAPI options in default sshd_config.
+    - Fix HAVE_GSSAPI_KRB5_H/HAVE_GSSAPI_GSSAPI_KRB5_H typos in
+      gss-serv-krb5.c.
+
+ -- Colin Watson <cjwatson@debian.org>  Wed, 14 Sep 2005 18:28:49 +0100
+
+openssh (1:4.2p1-1) unstable; urgency=low
+
+  * New upstream release.
+    - SECURITY (CAN-2005-2797): Fix a bug introduced in OpenSSH 4.0 that
+      caused GatewayPorts to be incorrectly activated for dynamic ("-D")
+      port forwardings when no listen address was explicitly specified
+      (closes: #326065).
+    - SECURITY (CAN-2005-2798): Fix improper delegation of GSSAPI
+      credentials. This code is only built in openssh-krb5, not openssh, but
+      I mention the CVE reference here anyway for completeness.
+    - Add a new compression method ("Compression delayed") that delays zlib
+      compression until after authentication, eliminating the risk of zlib
+      vulnerabilities being exploited by unauthenticated users. Note that
+      users of OpenSSH versions earlier than 3.5 will need to disable
+      compression on the client or set "Compression yes" (losing this
+      security benefit) on the server.
+    - Increase the default size of new RSA/DSA keys generated by ssh-keygen
+      from 1024 to 2048 bits (closes: #181162).
+    - Many bugfixes and improvements to connection multiplexing.
+    - Don't pretend to accept $HOME (closes: #208648).
+  * debian/rules: Resynchronise CFLAGS with that generated by configure.
+  * openssh-client and openssh-server conflict with pre-split ssh to avoid
+    problems when ssh is left un-upgraded (closes: #324695).
+  * Set X11Forwarding to yes in the default sshd_config (new installs only).
+    At least when X11UseLocalhost is turned on, which is the default, the
+    security risks of using X11 forwarding are risks to the client, not to
+    the server (closes: #320104).
+
+ -- Colin Watson <cjwatson@debian.org>  Wed, 14 Sep 2005 15:16:14 +0100
+
+openssh (1:4.1p1-7) unstable; urgency=low
+
+  * Do the IDEA host key check on a temporary file to avoid altering
+    /etc/ssh/ssh_host_key itself (closes: #312312).
+  * Work around the ssh-askpass alternative somehow ending up in manual mode
+    pointing to the obsolete /usr/lib/ssh/gnome-ssh-askpass.
+  * Add GNU/kFreeBSD support (thanks, Aurelien Jarno; closes: #318113).
+  * Fix XSIish uses of 'test' in openssh-server.preinst.
+  * Policy version 3.6.2: no changes required.
+
+ -- Colin Watson <cjwatson@debian.org>  Fri,  2 Sep 2005 16:18:11 +0100
+
+openssh (1:4.1p1-6) unstable; urgency=low
+
+  * Fix one-character typo that meant the binaries in openssh-client and
+    openssh-server got recompiled with the wrong options during
+    'debian/rules install' (closes: #317088, #317238, #317241).
+
+ -- Colin Watson <cjwatson@debian.org>  Thu,  7 Jul 2005 10:56:16 +0100
+
+openssh (1:4.1p1-5) unstable; urgency=low
+
+  * Build-depend on libselinux1-dev on ppc64 too (closes: #314625).
+  * Drop priority of ssh to extra to match the override file.
+  * Make /usr/share/doc/openssh-server and /usr/share/doc/ssh symlinks to
+    /usr/share/doc/openssh-client (closes: #314745).
+  * Ship README.dns (closes: #284874).
+  * Disable btmp logging, since Debian's /var/log/btmp has inappropriate
+    permissions (closes: #314956).
+  * Allow ~/.ssh/config to be group-writable, provided that the group in
+    question contains only the file's owner (closes: #314347).
+  * debconf template translations:
+    - Update Brazilian Portuguese (thanks, André Luís Lopes;
+      closes: #315477).
+    - Add Vietnamese (thanks, Clytie Siddall; closes: #316636).
+
+ -- Colin Watson <cjwatson@debian.org>  Sun,  3 Jul 2005 17:08:08 +0100
+
+openssh (1:4.1p1-4) unstable; urgency=low
+
+  * openssh-client and openssh-server conflict with ssh-krb5, as ssh-krb5
+    only conflicts with ssh (closes: #312475).
+  * SELinux support (thanks, Manoj Srivastava; closes: #308555):
+    - Added SELinux capability, and turned it on be default. Added
+      restorecon calls in preinst and postinst (should not matter if the
+      machine is not SELinux aware). By and large, the changes made should
+      have no effect unless the rules file calls --with-selinux; and even
+      then there should be no performance hit for machines not actively
+      running SELinux.
+    - Modified the preinst and postinst to call restorecon to set the
+      security context for the generated public key files.
+    - Added a comment to /etc/pam.d/ssh to indicate that an SELinux system
+      may want to also include pam_selinux.so.
+  * Re-enable ssh-askpass-gnome on the Hurd, now that its build-dependencies
+    are available.
+  * Restore /usr/lib/sftp-server temporarily, as a symlink to
+    /usr/lib/openssh/sftp-server (closes: #312891).
+  * Switch to debhelper compatibility level 3, since 2 is deprecated.
+  * debconf template translations:
+    - Update German (thanks, Jens Seidel; closes: #313949).
+
+ -- Colin Watson <cjwatson@debian.org>  Fri, 17 Jun 2005 14:20:20 +0100
+
+openssh (1:4.1p1-3) unstable; urgency=low
+
+  * Upload to unstable.
+
+ -- Colin Watson <cjwatson@debian.org>  Mon,  6 Jun 2005 22:28:33 +0100
+
+openssh (1:4.1p1-2) experimental; urgency=low
+
+  * Drop debconf support for allowing SSH protocol 1, which is discouraged
+    and has not been the default since openssh 1:3.0.1p1-1. Users who need
+    this should edit sshd_config instead (closes: #147212).
+  * Since ssh-keysign isn't used by default (you need to set
+    EnableSSHKeysign to "yes" in /etc/ssh/ssh_config), having a debconf
+    question to ask whether it should be setuid is overkill, and the
+    question text had got out of date anyway. Remove this question, ship
+    ssh-keysign setuid in openssh-client.deb, and set a statoverride if the
+    debconf question was previously set to false.
+  * Add lintian overrides for the above (setuid-binary,
+    no-debconf-templates).
+  * Fix picky lintian errors about slogin symlinks.
+  * Fix DEB_HOST_ARCH_OS/DEB_HOST_GNU_SYSTEM compatibility handling.
+  * Apply Linux 2.2 workaround (see #239999) only on Linux.
+
+ -- Colin Watson <cjwatson@debian.org>  Thu,  2 Jun 2005 00:55:58 +0100
+
+openssh (1:4.1p1-1) experimental; urgency=low
+
+  * New upstream release.
+    - Normalise socket addresses returned by get_remote_hostname(), fixing
+      4-in-6 mapping issues with AllowUsers et al (closes: #192234).
+  * Take upstream's hint and disable the unsupported USE_POSIX_THREADS
+    (closes: #295757, #308868, and possibly others; may open other bugs).
+    Use PAM password authentication to avoid #278394. In future I may
+    provide two sets of binaries built with and without this option, since
+    it seems I can't win.
+  * Disable ChallengeResponseAuthentication in new installations, returning
+    to PasswordAuthentication by default, since it now supports PAM and
+    apparently works better with a non-threaded sshd (closes: #247521).
+  * openssh-server Suggests: rssh (closes: #233012).
+  * Change libexecdir to /usr/lib/openssh, and fix up various alternatives
+    and configuration files to match (closes: #87900, #151321).
+  * Fix up very old sshd_config files that refer to /usr/libexec/sftp-server
+    (closes: #141979).
+
+ -- Colin Watson <cjwatson@debian.org>  Tue, 31 May 2005 01:33:33 +0100
+
+openssh (1:4.0p1-1) experimental; urgency=low
+
+  * New upstream release.
+    - Port-forwarding specifications now take optional bind addresses, and
+      the server allows client-specified bind addresses for remote port
+      forwardings when configured with "GatewayPorts clientspecified"
+      (closes: #87253, #192206).
+    - ssh and ssh-keyscan now support hashing of known_hosts files for
+      improved privacy (CAN-2005-2666). ssh-keygen has new options for
+      managing known_hosts files, which understand hashing.
+    - sftp supports command history and editing support using libedit
+      (closes: #287013).
+    - Have scp and sftp wait for the spawned ssh to exit before they exit
+      themselves, allowing ssh to restore terminal modes (closes: #257130).
+    - Improved the handling of bad data in authorized_keys files,
+      eliminating fatal errors on corrupt or very large keys; e.g. linefeeds
+      in keys only produce errors in auth.log now (closes: #220726).
+    - Add "command mode" to ssh connection multiplexing (closes: #303452).
+    - Mention $HOME/.hushlogin in sshd(8) FILES section (closes: #163933).
+  * Make gnome-ssh-askpass stay above other windows (thanks, Liyang HU;
+    closes: #296487).
+  * Remove obsolete and unnecessary ssh/forward_warning debconf note.
+  * Hurd build fixes (although sshd still doesn't work):
+    - Restore X forwarding fix from #102991, lost somewhere along the way.
+    - Link with -lcrypt.
+    - Link with -lpthread rather than -pthread.
+    - Don't build ssh-askpass-gnome on the Hurd, until GNOME is available to
+      satisfy build-dependencies.
+  * Drop workaround for #242462 on amd64; it's been fixed properly upstream.
+  * Enable HashKnownHosts by default. This only affects new entries; use
+    'ssh-keygen -H' to convert an entire known_hosts file to hashed format.
+  * Note in ssh_config(5) that the SetupTimeOut option is Debian-specific
+    (closes: #307069).
+  * debconf template translations:
+    - Update Czech (thanks, Miroslav Kure; closes: #298744).
+    - Update Finnish (thanks, Matti Pöllä; closes: #303787).
+    - Synchronise Spanish with sarge branch (thanks, Javier
+      Fernández-Sanguino Peña; closes: #298536).
+    - Add Ukrainian (thanks, Eugeniy Meshcheryakov; closes: #301852).
+
+ -- Colin Watson <cjwatson@debian.org>  Thu, 26 May 2005 11:23:18 +0100
+
+openssh (1:3.9p1-3) experimental; urgency=low
+
+  * Explain how to run sshd from inittab in README.Debian (closes: #147360).
+  * Add debian/watch file.
+
+ -- Colin Watson <cjwatson@debian.org>  Fri, 18 Feb 2005 00:20:16 +0000
+
+openssh (1:3.9p1-2) experimental; urgency=low
+
+  * Remove pam_nologin from /etc/pam.d/ssh, as sshd's built-in support
+    appears to be sufficient and more useful (closes: #162996).
+  * Depend on debconf | debconf-2.0.
+  * Drop LoginGraceTime back to the upstream default of two minutes on new
+    installs (closes: #289573).
+  * debconf template translations from Ubuntu bug #1232:
+    - Update Greek (thanks, Logiotatidis George).
+    - Update Spanish (thanks, Santiago Erquicia).
+
+ -- Colin Watson <cjwatson@debian.org>  Sat, 15 Jan 2005 12:37:54 +0000
+
+openssh (1:3.9p1-1) experimental; urgency=low
+
+  * New upstream release.
+    - PAM password authentication implemented again (closes: #238699,
+      #242119).
+    - Implemented the ability to pass selected environment variables between
+      the client and the server.
+    - Fix ssh-keyscan breakage when remote server doesn't speak SSH protocol
+      (closes: #228828).
+    - Fix res_query detection (closes: #242462).
+    - 'ssh -c' documentation improved (closes: #265627).
+  * Pass LANG and LC_* environment variables from the client by default, and
+    accept them to the server by default in new installs, although not on
+    upgrade (closes: #264024).
+  * Build ssh in binary-indep, not binary-arch (thanks, LaMont Jones).
+  * Expand on openssh-client package description (closes: #273831).
+
+ -- Colin Watson <cjwatson@debian.org>  Tue,  4 Jan 2005 14:18:31 +0000
+
+openssh (1:3.8.1p1-14) experimental; urgency=low
+
+  * We use DH_COMPAT=2, so build-depend on debhelper (>= 2).
+  * Fix timing information leak allowing discovery of invalid usernames in
+    PAM keyboard-interactive authentication (backported from a patch by
+    Darren Tucker; closes: #281595).
+  * Make sure that there's a delay in PAM keyboard-interactive
+    authentication when PermitRootLogin is not set to yes and the correct
+    root password is entered (closes: #248747).
+
+ -- Colin Watson <cjwatson@debian.org>  Sun, 28 Nov 2004 18:09:37 +0000
+
+openssh (1:3.8.1p1-13) experimental; urgency=low
+
+  * Enable threading for PAM, on Sam Hartman's advice (closes: #278394).
+  * debconf template translations:
+    - Update Dutch (thanks, cobaco; closes: #278715).
+  * Correct README.Debian's ForwardX11Trusted description (closes: #280190).
+
+ -- Colin Watson <cjwatson@debian.org>  Fri, 12 Nov 2004 12:03:13 +0000
+
+openssh (1:3.8.1p1-12) experimental; urgency=low
+
+  * Preserve /etc/ssh/sshd_config ownership/permissions (closes: #276754).
+  * Shorten the version string from the form "OpenSSH_3.8.1p1 Debian
+    1:3.8.1p1-8.sarge.1" to "OpenSSH_3.8.1p1 Debian-8.sarge.1", as some SSH
+    implementations apparently have problems with the long version string.
+    This is of course a bug in those implementations, but since the extent
+    of the problem is unknown it's best to play safe (closes: #275731).
+  * debconf template translations:
+    - Add Finnish (thanks, Matti Pöllä; closes: #265339).
+    - Update Danish (thanks, Morten Brix Pedersen; closes: #275895).
+    - Update French (thanks, Denis Barbier; closes: #276703).
+    - Update Japanese (thanks, Kenshi Muto; closes: #277438).
+
+ -- Colin Watson <cjwatson@debian.org>  Sun, 24 Oct 2004 19:21:17 +0100
+
+openssh (1:3.8.1p1-11) experimental; urgency=high
+
+  * Move sshd_config(5) to openssh-server, where it belongs.
+  * If PasswordAuthentication is disabled, then offer to disable
+    ChallengeResponseAuthentication too. The current PAM code will attempt
+    password-style authentication if ChallengeResponseAuthentication is
+    enabled (closes: #250369).
+  * This will ask a question of anyone who installed fresh with 1:3.8p1-2 or
+    later and then upgraded. Sorry about that ... for this reason, the
+    default answer is to leave ChallengeResponseAuthentication enabled.
+
+ -- Colin Watson <cjwatson@debian.org>  Wed,  6 Oct 2004 14:28:20 +0100
+
+openssh (1:3.8.1p1-10) experimental; urgency=low
+
+  * Don't install the ssh-askpass-gnome .desktop file by default; I've had
+    too many GNOME people tell me it's the wrong thing to be doing. I've
+    left it in /usr/share/doc/ssh-askpass-gnome/examples/ for now.
+
+ -- Colin Watson <cjwatson@debian.org>  Wed, 25 Aug 2004 18:18:14 +0100
+
+openssh (1:3.8.1p1-9) experimental; urgency=low
+
+  * Split the ssh binary package into openssh-client and openssh-server
+    (closes: #39741). openssh-server depends on openssh-client for some
+    common functionality; it didn't seem worth creating yet another package
+    for this. openssh-client is priority standard, openssh-server optional.
+  * New transitional ssh package, priority optional, depending on
+    openssh-client and openssh-server. May be removed once nothing depends
+    on it.
+  * When upgrading from ssh to openssh-{client,server}, it's very difficult
+    for the maintainer scripts to find out what version we're upgrading from
+    without dodgy dpkg hackery. I've therefore taken the opportunity to move
+    a couple of debconf notes into NEWS files, namely ssh/ssh2_keys_merged
+    and ssh/user_environment_tell.
+  * Add a heuristic to try to make sure the sshd_config upgrade to >= 3.7
+    happens even though we don't know what version we're upgrading from.
+  * Remove /etc/ssh/sshd_not_to_be_run on purge of openssh-server. For now
+    (until sarge+2) it's still honoured to avoid breaking existing
+    configurations, but the right approach is now to remove the
+    openssh-server package if you don't want to run the server. Add a NEWS
+    item to that effect.
+
+ -- Colin Watson <cjwatson@debian.org>  Mon,  2 Aug 2004 20:48:54 +0100
+
+openssh (1:3.8.1p1-8.sarge.4) unstable; urgency=high
+
+  * Fix timing information leak allowing discovery of invalid usernames in
+    PAM keyboard-interactive authentication (backported from a patch by
+    Darren Tucker; closes: #281595).
+  * Make sure that there's a delay in PAM keyboard-interactive
+    authentication when PermitRootLogin is not set to yes and the correct
+    root password is entered (closes: #248747).
+
+ -- Colin Watson <cjwatson@debian.org>  Sun, 28 Nov 2004 12:37:16 +0000
+
+openssh (1:3.8.1p1-8.sarge.3) unstable; urgency=low
+
+  * Enable threading for PAM, on Sam Hartman's advice (closes: #278394).
+  * debconf template translations:
+    - Update Dutch (thanks, cobaco; closes: #278715).
+  * Correct README.Debian's ForwardX11Trusted description (closes: #280190).
+
+ -- Colin Watson <cjwatson@debian.org>  Fri, 12 Nov 2004 10:31:12 +0000
+
+openssh (1:3.8.1p1-8.sarge.2) unstable; urgency=low
+
+  * Preserve /etc/ssh/sshd_config ownership/permissions (closes: #276754).
+  * Shorten the version string from the form "OpenSSH_3.8.1p1 Debian
+    1:3.8.1p1-8.sarge.1" to "OpenSSH_3.8.1p1 Debian-8.sarge.1", as some SSH
+    implementations apparently have problems with the long version string.
+    This is of course a bug in those implementations, but since the extent
+    of the problem is unknown it's best to play safe (closes: #275731).
+  * debconf template translations:
+    - Add Finnish (thanks, Matti Pöllä; closes: #265339).
+    - Update Danish (thanks, Morten Brix Pedersen; closes: #275895).
+    - Update French (thanks, Denis Barbier; closes: #276703).
+    - Update Japanese (thanks, Kenshi Muto; closes: #277438).
+
+ -- Colin Watson <cjwatson@debian.org>  Sun, 24 Oct 2004 17:57:14 +0100
+
+openssh (1:3.8.1p1-8.sarge.1) unstable; urgency=high
+
+  * If PasswordAuthentication is disabled, then offer to disable
+    ChallengeResponseAuthentication too. The current PAM code will attempt
+    password-style authentication if ChallengeResponseAuthentication is
+    enabled (closes: #250369).
+  * This will ask a question of anyone who installed fresh with 1:3.8p1-2 or
+    later and then upgraded. Sorry about that ... for this reason, the
+    default answer is to leave ChallengeResponseAuthentication enabled.
+
+ -- Colin Watson <cjwatson@debian.org>  Wed,  6 Oct 2004 14:21:55 +0100
+
+openssh (1:3.8.1p1-8) unstable; urgency=high
+
+  * Matthew Vernon:
+    - Add a GPL exception to the licensing terms of the Debian patch
+      (closes: #211644).
+
+ -- Colin Watson <cjwatson@debian.org>  Thu, 29 Jul 2004 13:28:47 +0100
+
+openssh (1:3.8.1p1-7) unstable; urgency=low
+
+  * Re-enable shadow password support in openssh-server-udeb, at Bastian
+    Blank's request (closes: #260800).
+
+ -- Colin Watson <cjwatson@debian.org>  Thu, 22 Jul 2004 10:56:06 +0100
+
+openssh (1:3.8.1p1-6) unstable; urgency=low
+
+  * Implement hack in
+    http://lists.debian.org/debian-boot/2004/07/msg01207.html to get
+    openssh-client-udeb to show up as a retrievable debian-installer
+    component.
+  * Generate host keys in postinst only if the relevant HostKey directives
+    are found in sshd_config (closes: #87946).
+
+ -- Colin Watson <cjwatson@debian.org>  Wed, 21 Jul 2004 15:14:46 +0100
+
+openssh (1:3.8.1p1-5) unstable; urgency=medium
+
+  * Update German debconf template translation (thanks, Helge Kreutzmann;
+    closes: #252226).
+  * Remove Suggests: dnsutils, as it was only needed for
+    make-ssh-known-hosts (#93265), which has been replaced by ssh-keyscan.
+  * Disable shadow password support in openssh-server-udeb.
+  * Fix non-portable shell constructs in maintainer scripts, Makefile, and
+    ssh-copy-id (thanks, David Weinehall; closes: #258517).
+  * Apply patch from Darren Tucker to make the PAM authentication SIGCHLD
+    handler kill the PAM thread if its waitpid() call returns 0, as well as
+    the previous check for -1 (closes: #252676).
+  * Add scp and sftp to openssh-client-udeb. It might not be very 'u' any
+    more; oh well.
+
+ -- Colin Watson <cjwatson@debian.org>  Sat, 10 Jul 2004 13:57:27 +0100
+
+openssh (1:3.8.1p1-4) unstable; urgency=medium
+
+  * Kill off PAM thread if privsep slave dies (closes: #248125).
+
+ -- Colin Watson <cjwatson@debian.org>  Fri, 28 May 2004 17:58:45 -0300
+
+openssh (1:3.8.1p1-3) unstable; urgency=low
+
+  * Add ssh-keygen to openssh-server-udeb.
+
+ -- Colin Watson <cjwatson@debian.org>  Thu, 20 May 2004 16:31:52 +0100
+
+openssh (1:3.8.1p1-2) unstable; urgency=low
+
+  * Add Catalan debconf template translation (thanks, Aleix Badia i Bosch;
+    closes: #248748).
+  * openssh-client-udeb and openssh-server-udeb depend on libnss-files-udeb
+    (not yet uploaded).
+  * Restore ssh-askpass-gnome binary, lost by mistake.
+  * Don't link against libnsl in udeb builds.
+
+ -- Colin Watson <cjwatson@debian.org>  Thu, 20 May 2004 11:15:58 +0100
+
+openssh (1:3.8.1p1-1) unstable; urgency=low
+
+  * New upstream release.
+    - Use a longer buffer for tty names in utmp (closes: #247538).
+  * Make sure there's a newline at the end of sshd_config before adding
+    'UsePAM yes' (closes: #244829).
+  * Generate a new .orig.tar.gz without RFC.nroff, and remove
+    /usr/share/doc/ssh/RFC.gz (closes: #211640). It isn't DFSG-free and only
+    documents the obsolete SSH1 protocol, not to mention that it was never a
+    real RFC but only an Internet-Draft. It's available from
+    http://www.free.lp.se/bamse/draft-ylonen-ssh-protocol-00.txt if you want
+    it for some reason.
+  * Add openssh-client-udeb and openssh-server-udeb binary packages for use
+    in debian-installer. They still need libnss_files to be supplied in udeb
+    form by glibc.
+  * Work around lack of res_query weak alias in libresolv on amd64 (see
+    #242462, awaiting real fix upstream).
+  * Fix grammar in sshd(8) (closes: #238753).
+  * Add .desktop file and icon for ssh-askpass-gnome (closes: #232333).
+  * Update Polish debconf template translation (thanks, Emil Nowak;
+    closes: #242808).
+  * Add Turkish debconf template translation (thanks, Recai OktaÅŸ;
+    closes: #246068).
+
+ -- Colin Watson <cjwatson@debian.org>  Tue, 11 May 2004 23:38:10 +0100
+
+openssh (1:3.8p1-3) unstable; urgency=low
+
+  * Remove deprecated ReverseMappingCheck option from newly generated
+    sshd_config files (closes: #239987).
+  * Build everything apart from contrib in a subdirectory, to allow for
+    multiple builds.
+  * Some older kernels are missing setresuid() and setresgid(), so don't try
+    to use them. setreuid() and setregid() will do well enough for our
+    purposes (closes: #239999).
+
+ -- Colin Watson <cjwatson@debian.org>  Mon,  5 Apr 2004 21:23:43 +0100
+
+openssh (1:3.8p1-2) unstable; urgency=medium
+
+  * Disable PasswordAuthentication for new installations (closes: #236810).
+  * Turn off the new ForwardX11Trusted by default, returning to the
+    semantics of 3.7 and earlier, since it seems immature and causes far too
+    many problems with existing setups. See README.Debian for details
+    (closes: #237021).
+
+ -- Colin Watson <cjwatson@debian.org>  Wed, 10 Mar 2004 10:33:07 +0000
+
+openssh (1:3.8p1-1) unstable; urgency=low
+
+  * New upstream release (closes: #232281):
+    - New PAM implementation based on that in FreeBSD. This runs PAM session
+      modules before dropping privileges (closes: #132681, #150968).
+    - Since PAM session modules are run as root, we can turn pam_limits back
+      on by default, and it no longer spits out "Operation not permitted" to
+      syslog (closes: #171673).
+    - Password expiry works again (closes: #153235).
+    - 'ssh -q' suppresses login banner (closes: #134589).
+    - sshd doesn't lie to PAM about invalid usernames (closes: #157078).
+    - ssh-add prints key comment on each prompt (closes: #181869).
+    - Punctuation formatting fixed in man pages (closes: #191131).
+    - EnableSSHKeysign documented in ssh_config(5) (closes: #224457).
+  * Add 'UsePAM yes' to /etc/ssh/sshd_config on upgrade from versions older
+    than this, to maintain the standard Debian sshd configuration.
+  * Comment out PAMAuthenticationViaKbdInt and RhostsAuthentication in
+    sshd_config on upgrade. Neither option is supported any more.
+  * Privilege separation and PAM are now properly supported together, so
+    remove both debconf questions related to them and simply set it
+    unconditionally in newly generated sshd_config files (closes: #228838).
+  * ServerAliveInterval implemented upstream, so ProtocolKeepAlives is now a
+    compatibility alias. The semantics differ slightly, though; see
+    ssh_config(5) for details.
+  * Implement SSH1 support for ServerAliveInterval using SSH_MSG_IGNORE. As
+    documented in ssh_config(5), it's not as good as the SSH2 version.
+  * Remove -fno-builtin-log, -DHAVE_MMAP_ANON_SHARED, and
+    -D__FILE_OFFSET_BITS=64 compiler options, which are no longer necessary.
+  * Update config.guess and config.sub from autotools-dev 20040105.1.
+  * Darren Tucker:
+    - Reset signal status when starting pam auth thread, prevent hanging
+      during PAM keyboard-interactive authentications.
+    - Fix a non-security-critical segfault in PAM authentication.
+  * Add debconf template translations:
+    - Greek (thanks, Konstantinos Margaritis; closes: #232843).
+    - Italian (thanks, Renato Gini; closes: #234777).
+
+ -- Colin Watson <cjwatson@debian.org>  Sat,  6 Mar 2004 18:43:44 +0000
+
+openssh (1:3.6.1p2-12) unstable; urgency=low
+
+  * Update Spanish debconf template translation (thanks, Javier
+    Fernández-Sanguino Peña; closes: #228242).
+  * Add debconf template translations:
+    - Czech (thanks, Miroslav Kure; closes: #230110).
+    - Simplified Chinese (thanks, Hiei Xu; closes: #230726).
+
+ -- Colin Watson <cjwatson@debian.org>  Wed, 11 Feb 2004 09:37:57 +0000
+
+openssh (1:3.6.1p2-11) unstable; urgency=low
+
+  * Comment out pam_limits in default configuration, for now at least
+    (closes: #198254).
+  * Use invoke-rc.d (if it exists) to run the init script.
+  * Backport format string bug fix in sshconnect.c (closes: #225238).
+  * ssh-copy-id exits if ssh fails (closes: #215252).
+
+ -- Colin Watson <cjwatson@debian.org>  Sun,  4 Jan 2004 18:59:21 +0000
+
+openssh (1:3.6.1p2-10) unstable; urgency=low
+
+  * Use --retry in init script when restarting rather than sleeping, to make
+    sure the old process is dead (thanks, Herbert Xu; closes: #212117).
+    Depend on dpkg (>= 1.9.0) for start-stop-daemon's --retry option.
+  * Update debconf template translations:
+    - Brazilian Portuguese (thanks, Andre Luis Lopes; closes: #219844).
+    - Danish (thanks, Morten Brix Pedersen; closes: #217964).
+    - Japanese (thanks, Kenshi Muto; closes: #212497).
+    - Russian (thanks, Ilgiz Kalmetev).
+    - Spanish (thanks, Carlos Valdivia Yagüe; closes: #211832).
+  * Add Dutch debconf template translation (thanks, cobaco;
+    closes: #215372).
+  * Update config.guess and config.sub from autotools-dev 20031007.1
+    (closes: #217696).
+  * Implement New World Order for PAM configuration, including
+    /etc/pam.d/common-* from /etc/pam.d/ssh (closes: #212959).
+    - To backport this release to woody, you need to set DEB_BUILD_SSH_WOODY
+      in your environment. See README.Debian.
+  * Add more commentary to /etc/pam.d/ssh.
+
+ -- Colin Watson <cjwatson@debian.org>  Sun, 16 Nov 2003 01:14:16 +0000
+
+openssh (1:3.6.1p2-9) unstable; urgency=high
+
+  * Merge even more buffer allocation fixes from upstream (CAN-2003-0682;
+    closes: #211434).
+
+ -- Colin Watson <cjwatson@debian.org>  Fri, 19 Sep 2003 10:25:25 +0100
+
+openssh (1:3.6.1p2-8) unstable; urgency=high
+
+  * Merge more buffer allocation fixes from new upstream version 3.7.1p1
+    (closes: #211324).
+
+ -- Colin Watson <cjwatson@debian.org>  Wed, 17 Sep 2003 03:07:19 +0100
+
+openssh (1:3.6.1p2-7) unstable; urgency=high
+
+  * Update debconf template translations:
+    - French (thanks, Christian Perrier; closes: #208801).
+    - Japanese (thanks, Kenshi Muto; closes: #210380).
+  * Some small improvements to the English templates courtesy of Christian
+    Perrier. I've manually unfuzzied a few translations where it was
+    obvious, on Christian's advice, but the others will have to be updated.
+  * Document how to generate an RSA1 host key (closes: #141703).
+  * Incorporate NMU fix for early buffer expansion vulnerability,
+    CAN-2003-0693 (closes: #211205). Thanks to Michael Stone.
+
+ -- Colin Watson <cjwatson@debian.org>  Tue, 16 Sep 2003 14:32:28 +0100
+
+openssh (1:3.6.1p2-6.0) unstable; urgency=high
+
+  * SECURITY: fix for CAN-2003-0693, buffer allocation error
+
+ -- Michael Stone <mstone@debian.org>  Tue, 16 Sep 2003 08:27:07 -0400
+
+openssh (1:3.6.1p2-6) unstable; urgency=medium
+
+  * Use a more CVS-friendly means of setting SSH_VERSION.
+  * Update Brazilian Portuguese debconf template translation (thanks, Andre
+    Luis Lopes; closes: #208036).
+  * Don't run 'sshd -t' in init script if the server isn't to be run
+    (closes: #197576).
+  * Fix login delay, spurious auth.log entry, and PermitRootLogin
+    information leakage due to PAM issues with upstream's recent security
+    update (thanks, Darren Tucker; closes: #99168, #192207, #193546).
+  * Policy version 3.6.1: recode this changelog to UTF-8.
+
+ -- Colin Watson <cjwatson@debian.org>  Wed,  3 Sep 2003 19:14:02 +0100
+
+openssh (1:3.6.1p2-5) unstable; urgency=low
+
+  * Disable cmsg_type check for file descriptor passing when running on
+    Linux 2.0 (closes: #150976). Remove comments about non-functional
+    privilege separation on 2.0 from ssh/privsep_ask and ssh/privsep_tell
+    debconf questions and from README.Debian, since it should all now work.
+  * Fix "defails" typo in generated sshd_config (closes: #206484).
+  * Backport upstream patch to strip trailing whitespace (including
+    newlines) from configuration directives (closes: #192079).
+
+ -- Colin Watson <cjwatson@debian.org>  Wed, 27 Aug 2003 02:19:57 +0100
+
+openssh (1:3.6.1p2-4) unstable; urgency=low
+
+  * getent can get just one key; no need to use grep (thanks, James Troup).
+  * Move /usr/local/bin to the front of the default path, following
+    /etc/login.defs (closes: #201150).
+  * Remove specifics of problematic countries from package description
+    (closes: #197040).
+  * Update Spanish debconf template translation (thanks, Carlos Valdivia
+    Yagüe; closes: #198456).
+  * Backport upstream patch to pass monitor signals through to child
+    (closes: #164797).
+
+ -- Colin Watson <cjwatson@debian.org>  Sun, 27 Jul 2003 17:31:15 +0100
+
+openssh (1:3.6.1p2-3) unstable; urgency=low
+
+  * Update French debconf template translation (thanks, Christian Perrier;
+    closes: #194323).
+  * Version the adduser dependency for --no-create-home (closes: #195756).
+  * Add a version of moduli(5), namely revision 1.7 of
+    http://www.openbsd.org/cgi-bin/cvsweb/src/share/man/man5/moduli.5 with
+    '/etc/moduli' changed to '/etc/ssh/moduli' throughout (closes: #196061).
+
+ -- Colin Watson <cjwatson@debian.org>  Mon,  9 Jun 2003 02:51:35 +0100
+
+openssh (1:3.6.1p2-2) unstable; urgency=low
+
+  * Force /etc/default/ssh to be non-executable, since dpkg apparently
+    doesn't deal with permissions changes on conffiles (closes: #192966).
+  * Use debconf 0.5's seen flag rather than the deprecated isdefault.
+  * Add GPL location to copyright file.
+  * Remove debian/postinst.old.
+  * Switch to po-debconf, with some careful manual use of po2debconf to
+    ensure that the source package continues to build smoothly on woody
+    (closes: #183986).
+  * Update debconf template translations:
+    - Brazilian Portugese (thanks, Andre Luis Lopes; see #183986).
+    - Japanese (thanks, Tomohiro KUBOTA; closes: #192429).
+  * Compile with -fno-builtin-log for now, otherwise gcc-3.3 complains
+    "log.h:59: warning: conflicting types for built-in function `log'". The
+    OpenSSH log() function has been renamed in upstream CVS.
+
+ -- Colin Watson <cjwatson@debian.org>  Mon, 19 May 2003 01:52:38 +0100
+
+openssh (1:3.6.1p2-1) unstable; urgency=medium
+
+  * New upstream release, including fix for PAM user-discovery security hole
+    (closes: #191681).
+  * Fix ChallengeResponseAuthentication default in generated sshd_config
+    (closes: #106037).
+  * Put newlines after full stops in man page documentation for
+    ProtocolKeepAlives and SetupTimeOut.
+  * Policy version 3.5.9: support DEB_BUILD_OPTIONS=noopt, build
+    gnome-ssh-askpass with -g and -Wall flags.
+  * Really ask ssh/new_config debconf question before trying to fetch its
+    value (closes: #188721).
+  * On purge, remove only the files we know about in /etc/ssh rather than
+    the whole thing, and remove the directory if that leaves it empty
+    (closes: #176679).
+  * ssh has depended on debconf for some time now with no complaints, so:
+    - Simplify the postinst by relying on debconf being present. (The absent
+      case was buggy anyway.)
+    - Get rid of "if you have not installed debconf" text in README.Debian,
+      and generally update the "/usr/bin/ssh not SUID" entry.
+  * More README.Debian work:
+    - Reorganize into "UPGRADE ISSUES" and "OTHER ISSUES", in an effort to
+      make it easier for people to find the former. The upgrade issues
+      should probably be sorted by version somehow.
+    - Document X11UseLocalhost under "X11 Forwarding" (closes: #150913).
+  * Fix setting of IP flags for interactive sessions (upstream bug #541).
+
+ -- Colin Watson <cjwatson@debian.org>  Mon,  5 May 2003 17:47:40 +0100
+
+openssh (1:3.6.1p1-1) unstable; urgency=low
+
+  * New upstream release (thanks, Laurence J. Lane).
+  * debian/control: ssh-askpass-gnome is now Section: gnome, following the
+    override file.
+
+ -- Colin Watson <cjwatson@debian.org>  Wed,  2 Apr 2003 00:51:02 +0100
+
+openssh (1:3.6p1-1) unstable; urgency=low
+
+  * New upstream release.
+    - Workaround applied upstream for a bug in the interaction of glibc's
+      getaddrinfo() with the Linux 2.2 kernel (closes: #155814).
+    - As such, it should now be safe to remove --with-ipv4-default, so
+      starting sshd with -6 is no longer necessary (closes: #79861 and lots
+      of other merged bugs).
+    - ssh-copy-id prints usage when run without arguments (closes: #71376).
+    - scp exits 1 if ssh fails (closes: #138400).
+    - sshd writes to utmp's ut_addr_v6 field in IPv6 mode (closes: #167867).
+    - 'ssh-add -c' causes ssh-agent to ask the user each time a key is used
+      (closes: #109795).
+  * Install /etc/default/ssh non-executable (closes: #185537).
+
+ -- Colin Watson <cjwatson@debian.org>  Mon, 31 Mar 2003 23:00:59 +0100
+
+openssh (1:3.5p1-5) unstable; urgency=low
+
+  * Add /etc/default/ssh (closes: #161049).
+  * Run the init script under 'set -e' (closes: #175010).
+  * Change the default superuser path to include /sbin, /usr/sbin, and
+    /usr/local/sbin (closes: #128235, #151267). Using login.defs would be
+    nice, but that belongs to another package. Without a defined API to
+    retrieve its settings, parsing it is off-limits.
+  * Build ssh-askpass-gnome with GNOME 2. The source package should still
+    support building on stable with GNOME 1, using the alternate
+    libgnome-dev build-dependency (thanks, Colin Walters; closes: #167582).
+
+ -- Colin Watson <cjwatson@debian.org>  Sun,  9 Mar 2003 20:12:10 +0000
+
+openssh (1:3.5p1-4) unstable; urgency=low
+
+  * Point rlogin and rcp alternatives at slogin and scp respectively rather
+    than ssh (closes: #121103, #151666). Fix alternative removal to match;
+    previously it was completely wrong anyway.
+  * Find out whether /etc/ssh/sshd_not_to_be_run exists and set the debconf
+    question's default using that information, rather than using debconf as
+    a registry. Other solutions may be better in the long run, but this is
+    at least correct (thanks, Matthew Woodcraft; closes: #84725).
+  * Stop using pam_lastlog, as it doesn't currently work well as a session
+    module when privilege separation is enabled; it can usually read
+    /var/log/lastlog but can't write to it. Instead, just use sshd's
+    built-in support, already enabled by default (closes: #151297, #169938).
+  * Use 'ssh-keygen -q' rather than redirecting output to /dev/null.
+  * Add a "this may take some time" warning when creating host keys on
+    installation (part of #110094).
+  * When restarting via the init script, check for sshd_not_to_be_run after
+    stopping sshd (idea from Tomas Pospisek; closes: #149850).
+  * Append /usr/sbin:/sbin to the init script's $PATH, just in case of
+    strangeness (closes: #115138).
+  * Fix a dpkg-statoverride call to redirect stdout to /dev/null, not
+    stderr.
+  * Correct copyright file typo: "orignal" -> "original" (closes: #176490).
+  * Rebuild with libssl0.9.7 (closes: #176983).
+  * We're up to policy version 3.5.6. DEB_BUILD_OPTIONS stuff still needs to
+    be looked at.
+
+ -- Colin Watson <cjwatson@debian.org>  Sat, 18 Jan 2003 01:37:23 +0000
+
+openssh (1:3.5p1-3) unstable; urgency=low
+
+  * Happy new year!
+  * Use getent rather than id to find out whether the sshd user exists
+    (closes: #150974).
+  * Remove some duplication from the postinst's ssh-keysign setuid code.
+  * Replace db_text with db_input throughout debian/config. (db_text has
+    been a compatibility wrapper since debconf 0.1.5.)
+  * Warn about PermitUserEnvironment on upgrade (closes: #167895).
+  * Use 'make install-nokeys', and disable unused debhelper commands,
+    thereby forward-porting the last pieces of Zack Weinberg's patch
+    (closes: #68341).
+  * Move the man page for gnome-ssh-askpass from the ssh package to
+    ssh-askpass-gnome (closes: #174449).
+  * Build with -DLOGIN_NO_ENDOPT, since Debian's /bin/login doesn't accept
+    '--' to terminate the list of options (closes: #171554).
+  * Add Jonathan Amery's ssh-argv0 script (closes: #111341).
+  * Update Danish debconf template (thanks, Morten Brix Pedersen;
+    closes: #174757).
+  * Document setgid ssh-agent's effect on certain environment variables in
+    README.Debian (closes: #167974).
+  * Document interoperability problems between scp and ssh.com's server in
+    README.Debian, and suggest some workarounds (closes: #174662).
+
+ -- Colin Watson <cjwatson@debian.org>  Wed,  1 Jan 2003 14:18:30 +0000
+
+openssh (1:3.5p1-2) unstable; urgency=low
+
+  * Mention in the ssh package description that it provides both ssh and
+    sshd (closes: #99680).
+  * Create a system group for ssh-agent, not a user group (closes: #167669).
+
+ -- Colin Watson <cjwatson@debian.org>  Mon,  4 Nov 2002 13:43:53 +0000
+
+openssh (1:3.5p1-1) unstable; urgency=low
+
+  * New upstream release.
+    - Fixes typo in ssh-add usage (closes: #152239).
+    - Fixes 'PermitRootLogin forced-commands-only' (closes: #166184).
+    - ~/.ssh/environment and environment= options in ~/.ssh/authorized_keys
+      are deprecated for security reasons and will eventually go away. For
+      now they can be re-enabled by setting 'PermitUserEnvironment yes' in
+      sshd_config.
+    - ssh-agent is installed setgid to prevent ptrace() attacks. The group
+      actually doesn't matter, as it drops privileges immediately, but to
+      avoid confusion the postinst creates a new 'ssh' group for it.
+  * Obsolete patches:
+    - Solar Designer's privsep+compression patch for Linux 2.2 (see
+      1:3.3p1-0.0woody1).
+    - Hostbased auth ssh-keysign backport (see 1:3.4p1-4).
+
+  * Remove duplicated phrase in ssh_config(5) (closes: #152404).
+  * Source the debconf confmodule at the top of the postrm rather than at
+    the bottom, to avoid making future non-idempotency problems worse (see
+    #151035).
+  * Debconf templates:
+    - Add Polish (thanks, Grzegorz Kusnierz).
+    - Update French (thanks, Denis Barbier; closes: #132509).
+    - Update Spanish (thanks, Carlos Valdivia Yagüe; closes: #164716).
+  * Write a man page for gnome-ssh-askpass, and link it to ssh-askpass.1 if
+    this is the selected ssh-askpass alternative (closes: #67775).
+
+ -- Colin Watson <cjwatson@debian.org>  Sat, 26 Oct 2002 19:41:51 +0100
+
+openssh (1:3.4p1-4) unstable; urgency=low
+
+  * Allow ssh-krb5 in ssh-askpass-gnome's dependencies (closes: #129532).
+  * Restore Russia to list of countries where encryption is problematic (see
+    #148951 and http://www.average.org/freecrypto/).
+  * Drop ssh-askpass-gnome's priority to optional, per the override file.
+  * Drop the PAM special case for hurd-i386 (closes: #99157).
+  * s/dile/idle/ in ssh_config(5) (closes: #118331).
+  * Note in README.Debian that you need xauth from xbase-clients on the
+    server for X11 forwarding (closes: #140269).
+  * Use correct path to upstream README in copyright file (closes: #146037).
+  * Document the units for ProtocolKeepAlives (closes: #159479).
+  * Backport upstream patch to fix hostbased auth (closes: #117114).
+  * Add -g to CFLAGS.
+
+ -- Colin Watson <cjwatson@debian.org>  Sun, 13 Oct 2002 18:58:53 +0100
+
+openssh (1:3.4p1-3) unstable; urgency=low
+
+  * Add myself to Uploaders: and begin acting as temporary maintainer, at
+    Matthew's request. (Normal service will resume in some months' time.)
+  * Add sharutils to Build-Depends (closes: #138465).
+  * Stop creating the /usr/doc/ssh symlink.
+
+  * Fix some debconf template typos (closes: #160358).
+  * Split debconf templates into one file per language.
+  * Add debconf template translations:
+    - Brazilian Portuguese (thanks, Andre Luis Lopes; closes: #106173).
+    - Danish (thanks, Claus Hindsgaul; closes: #126607).
+    - Japanese (thanks, Tomohiro KUBOTA; closes: #137427).
+    - Russian (thanks, Ilgiz Kalmetev; closes: #136610).
+    - Spanish (thanks, Carlos Valdivia Yagüe; closes: #129041).
+  * Update debconf template translations:
+    - French (thanks, Igor Genibel; closes: #151361).
+    - German (thanks, Axel Noetzold; closes: #147069).
+  * Some of these translations are fuzzy. Please send updates.
+
+ -- Colin Watson <cjwatson@debian.org>  Sun, 13 Oct 2002 14:09:57 +0100
+
+openssh (1:3.4p1-2) unstable; urgency=high
+
+  * Get a security-fixed version into unstable
+  * Also tidy README.Debian up a little
+
+ -- Matthew Vernon <matthew@debian.org>  Fri, 28 Jun 2002 17:20:59 +0100
+
+openssh (1:3.4p1-1) testing; urgency=high
+
+  * Extend my tendrils back into this package (Closes: #150915, #151098)
+  * thanks to the security team for their work
+  * no thanks to ISS/Theo de Raadt for their handling of these bugs
+  * save old sshd_configs to sshd_config.dpkg-old when auto-generating a
+    new one
+  * tell/ask the user about PriviledgeSeparation
+  * /etc/init.d/ssh run will now create the chroot empty dir if necessary 
+  * Remove our previous statoverride on /usr/bin/ssh (only for people 
+    upgrading from a version where we'd put one in ourselves!)
+  * Stop slandering Russia, since someone asked so nicely (Closes: #148951)
+  * Reduce the sleep time in /etc/init.d/ssh during a restart
+
+ -- Matthew Vernon <matthew@debian.org>  Fri, 28 Jun 2002 15:52:10 +0100
+
+openssh (1:3.4p1-0.0woody1) testing-security; urgency=high
+
+  * NMU by the security team.
+  * New upstream version
+
+ -- Michael Stone <mstone@debian.org>  Wed, 26 Jun 2002 15:40:38 -0400
+
+openssh (1:3.3p1-0.0woody4) testing-security; urgency=high
+
+  * NMU by the security team.
+  * fix error when /etc/ssh/sshd_config exists on new install
+  * check that user doesn't exist before running adduser
+  * use openssl internal random unconditionally
+
+ -- Michael Stone <mstone@debian.org>  Tue, 25 Jun 2002 19:44:39 -0400
+
+openssh (1:3.3p1-0.0woody3) testing-security; urgency=high
+
+  * NMU by the security team.
+  * use correct home directory when sshd user is created
+
+ -- Michael Stone <mstone@debian.org>  Tue, 25 Jun 2002 08:59:50 -0400
+
+openssh (1:3.3p1-0.0woody2) testing-security; urgency=high
+
+  * NMU by the security team.
+  * Fix rsa1 key creation (Closes: #150949)
+  * don't fail if sshd user removal fails
+  * depends: on adduser (Closes: #150907)
+
+ -- Michael Stone <mstone@debian.org>  Tue, 25 Jun 2002 08:59:50 -0400
+
+openssh (1:3.3p1-0.0woody1) testing-security; urgency=high
+
+  * NMU by the security team.
+  * New upstream version.
+    - Enable privilege separation by default.
+  * Include patch from Solar Designer for privilege separation and
+    compression on 2.2.x kernels.
+  * Remove --disable-suid-ssh from configure.
+  * Support setuid ssh-keysign binary instead of setuid ssh client.
+  * Check sshd configuration before restarting.
+
+ -- Daniel Jacobowitz <dan@debian.org>  Mon, 24 Jun 2002 13:43:44 -0400
+
+openssh (1:3.0.2p1-9) unstable; urgency=high
+
+  * Thanks to those who NMUd
+  * The only change in this version is to debian/control - I've removed
+    the bit that says you can't export it from the US - it would look 
+    pretty daft to say this about a package in main! Also, it's now OK
+    to use crypto in France, so I've edited that comment slightly
+  * Correct a path in README.Debian too (Closes: #138634)
+
+ -- Matthew Vernon <matthew@debian.org>  Sun,  4 Apr 2002 09:52:59 +0100
+
+openssh (1:3.0.2p1-8.3) unstable; urgency=medium
+
+  * NMU
+  * Really set urgency to medium this time (oops)
+  * Fix priority to standard per override while I'm at it
+
+ -- Aaron M. Ucko <ucko@debian.org>  Sun, 24 Mar 2002 09:00:08 -0500
+
+openssh (1:3.0.2p1-8.2) unstable; urgency=low
+
+  * NMU with maintainer's permission
+  * Prepare for upcoming ssh-nonfree transitional packages per
+    <http://lists.debian.org/debian-ssh/2002/debian-ssh-200203/msg00008.html>
+  * Urgency medium because it would really be good to get this into woody
+    before it releases
+  * Fix sections to match override file
+  * Reissued due to clash with non-US -> main move
+
+ -- Aaron M. Ucko <ucko@debian.org>  Sat, 23 Mar 2002 21:21:52 -0500
+
+openssh (1:3.0.2p1-8.1) unstable; urgency=low
+
+  * NMU
+  * Move from non-US to mani
+
+ -- LaMont Jones <lamont@debian.org>  Thu, 21 Mar 2002 09:33:50 -0700
+
+openssh (1:3.0.2p1-8) unstable; urgency=critical
+
+  * Security fix - patch from upstream (Closes: #137209, #137210)
+  * Undo the changes in the unreleased -7, since they appear to break 
+    things here. Accordingly, the code change is minimal, and I'm 
+    happy to get it into testing ASAP
+
+ -- Matthew Vernon <matthew@debian.org>  Thu,  7 Mar 2002 14:25:23 +0000
+
+openssh (1:3.0.2p1-7) unstable; urgency=high
+
+  * Build to support IPv6 and IPv4 by default again
+
+ -- Matthew Vernon <matthew@debian.org>  Sat,  2 Mar 2002 00:25:05 +0000
+
+openssh (1:3.0.2p1-6) unstable; urgency=high
+
+  * Correct error in the clean target (Closes: #130868)
+
+ -- Matthew Vernon <matthew@debian.org>  Sat, 26 Jan 2002 00:32:00 +0000
+
+openssh (1:3.0.2p1-5) unstable; urgency=medium
+
+  * Include the Debian version in our identification, to make it easier to
+    audit networks for patched versions in future
+
+ -- Matthew Vernon <matthew@debian.org>  Mon, 21 Jan 2002 17:16:10 +0000
+
+openssh (1:3.0.2p1-4) unstable; urgency=medium
+
+  * If we're asked to not run sshd, stop any running sshd's first 
+    (Closes: #129327)
+
+ -- Matthew Vernon <matthew@debian.org>  Wed, 16 Jan 2002 21:24:16 +0000
+
+openssh (1:3.0.2p1-3) unstable; urgency=high
+
+  * Fix /etc/pam.d/ssh to not set $MAIL (Closes: #128913)
+  * Remove extra debconf suggestion (Closes: #128094)
+  * Mmm. speedy bug-fixing :-)
+
+ -- Matthew Vernon <matthew@debian.org>  Sat, 12 Jan 2002 17:23:58 +0000
+
+openssh (1:3.0.2p1-2) unstable; urgency=high
+
+  * Fix postinst to not automatically overwrite sshd_config (!) 
+    (Closes: #127842, #127867)
+  * Add section in README.Debian about the PermitRootLogin setting
+
+ -- Matthew Vernon <matthew@debian.org>  Sat,  5 Jan 2003 05:26:30 +0000
+
+openssh (1:3.0.2p1-1) unstable; urgency=high
+
+  * Incorporate fix from Colin's NMU
+  * New upstream version (fixes the bug Wichert fixed) (Closes: #124035)
+  * Capitalise IETF (Closes: #125379)
+  * Refer to the correct sftp-server location (Closes: #126854, #126224)
+  * Do what we're asked re SetUID ssh (Closes: #124065, #124154, #123247)
+  * Ask people upgrading from potato if they want a new conffile 
+    (Closes: #125642)
+  * Fix a typo in postinst (Closes: #122192, #122410, #123440)
+  * Frob the default config a little (Closes: #122284, #125827, #125696,
+    #123854)
+  * Make /etc/init.d/ssh be more clear about ssh not running (Closes:
+    #123552)
+  * Fix typo in templates file (Closes: #123411)
+
+ -- Matthew Vernon <matthew@debian.org>  Fri,  4 Jan 2002 16:01:52 +0000
+
+openssh (1:3.0.1p1-1.2) unstable; urgency=high
+
+  * Non-maintainer upload
+  * Prevent local users from passing environment variables to the login
+    process when UseLogin is enabled
+
+ -- Wichert Akkerman <wakkerma@debian.org>  Mon,  3 Dec 2001 19:34:45 +0100
+
+openssh (1:3.0.1p1-1.1) unstable; urgency=low
+
+  * Non-maintainer upload, at Matthew's request.
+  * Remove sa_restorer assignment to fix compilation on alpha, hppa, and
+    ia64 (closes: #122086).
+
+ -- Colin Watson <cjwatson@debian.org>  Sun,  2 Dec 2001 18:54:16 +0000
+
+openssh (1:3.0.1p1-1) unstable; urgency=high
+
+  * New upstream version (Closes: #113646, #113513, #114707, #118564)
+  * Building with a libc that works (!) (Closes: #115228)
+  * Patches forward-ported are -1/-2 options for scp, the improvement to
+    'waiting for forwarded connections to terminate...'
+  * Fix /etc/init.d/ssh to stop sshd properly (Closes: #115228)
+  * /etc/ssh/sshd_config is no longer a conffile but generated in the postinst
+  * Remove suidregister leftover from postrm
+  * Mention key we are making in the postinst
+  * Default to not enable SSH protocol 1 support, since protocol 2 is
+    much safer anyway.
+  * New version of the vpn-fixes patch, from Ian Jackson
+  * New handling of -q, and added new -qq option; thanks to Jon Amery
+  * Experimental smartcard support not enabled, since I have no way of
+    testing it.
+
+ -- Matthew Vernon <matthew@debian.org>  Thu, 28 Nov 2001 17:43:01 +0000
+
+openssh (1:2.9p2-6) unstable; urgency=low
+
+  * check for correct file in /etc/init.d/ssh (Closes: #110876)
+  * correct location of version 2 keys in ssh.1 (Closes: #110439)
+  * call update-alternatives --quiet (Closes: #103314)
+  * hack ssh-copy-id to chmod go-w (Closes: #95551)
+  * TEMPORARY fix to provide largefile support using a -D in the cflags
+    line. long-term, upstream will patch the autoconf stuff
+    (Closes: #106809, #111849)
+  * remove /etc/rc references in ssh-keygen.1 (Closes: #68350)
+  * scp.1 patch from Adam McKenna to document -r properly (Closes: #76054)
+  * Check for files containing a newline character (Closes: #111692)
+
+ -- Matthew Vernon <matthew@debian.org>  Thu, 13 Sep 2001 16:47:36 +0100
+
+openssh (1:2.9p2-5) unstable; urgency=high
+
+  * Thanks to all the bug-fixers who helped!
+  * remove sa_restorer assignment (Closes: #102837)
+  * patch from Peter Benie to DTRT wrt X forwarding if the server refuses
+    us access (Closes: #48297)
+  * patch from upstream CVS to fix port forwarding (Closes: #107132)
+  * patch from Jonathan Amery to document ssh-keygen behaviour 
+    (Closes:#106643, #107512)
+  * patch to postinst from Jonathan Amery (Closes: #106411)
+  * patch to manpage from Jonathan Amery (Closes: #107364)
+  * patch from Matthew Vernon to make -q emit fatal errors as that is the
+    documented behaviour (Closes: #64347)
+  * patch from Ian Jackson to cause us to destroy a file when we scp it
+    onto itself, rather than dumping bits of our memory into it, which was
+    a security hole (see #51955)
+  * patch from Jonathan Amery to document lack of Kerberos support 
+    (Closes: #103726)
+  * patch from Matthew Vernon to make the 'waiting for connections to
+    terminate' message more helpful (Closes: #50308)
+
+ -- Matthew Vernon <matthew@debian.org>  Thu, 23 Aug 2001 02:14:09 +0100
+
+openssh (1:2.9p2-4) unstable; urgency=high
+
+  * Today's build of ssh is strawberry flavoured
+  * Patch from mhp to reduce length of time sshd is stopped for (Closes: #106176)
+  * Tidy up debconf template (Closes: #106152)
+  * If called non-setuid, then setgid()'s failure should not be fatal (see
+    #105854)
+
+ -- Matthew Vernon <matthew@debian.org>  Sun, 22 Jul 2001 14:19:43 +0100
+
+openssh (1:2.9p2-3) unstable; urgency=low
+
+  * Patch from yours truly to add -1 and -2 options to scp (Closes: #106061)
+  * Improve the IdentityFile section in the man page (Closes: #106038)
+
+ -- Matthew Vernon <matthew@debian.org>  Sat, 21 Jul 2001 14:47:27 +0100
+
+openssh (1:2.9p2-2) unstable; urgency=low
+
+  * Document the protocol version 2 and IPV6 changes (Closes: #105845, #105868)
+  * Make PrintLastLog 'no' by default (Closes: #105893)
+
+ -- Matthew Vernon <matthew@debian.org>  Thu, 19 Jul 2001 18:36:41 +0100
+
+openssh (1:2.9p2-1) unstable; urgency=low
+
+  * new (several..) upstream version (Closes: #96726, #81856, #96335)
+  * Hopefully, this will close some other bugs too
+
+ -- Matthew Vernon <matthew@debian.org>  Tue, 17 Jul 2001 19:41:58 +0100
+
+openssh (1:2.5.2p2-3) unstable; urgency=low
+
+  * Taking Over this package
+  * Patches from Robert Bihlmeyer for the Hurd (Closes: #102991)
+  * Put PermitRootLogin back to yes (Closes: #67334, #67371, #78274)
+  * Don't fiddle with conf-files any more (Closes: #69501)
+
+ -- Matthew Vernon <matthew@debian.org>  Tue, 03 Jul 2001 02:58:13 +0100
+
+openssh (1:2.5.2p2-2.2) unstable; urgency=low
+
+  * NMU
+  * Include Hurd compatibility patches from Robert Bihlmeyer (Closes: #76033)
+  * Patch from Richard Kettlewell for protocolkeepalives (Closes: #99273)
+  * Patch from Matthew Vernon for BannerTimeOut, batchmode, and
+    documentation for protocolkeepalives. Makes ssh more generally useful
+    for scripting uses (Closes: #82877, #99275)
+  * Set a umask, so ourpidfile isn't world-writable (closes: #100012,
+    #98286, #97391)
+
+ -- Matthew Vernon <matthew@debian.org>  Thu, 28 Jun 2001 23:15:42 +0100
+
+openssh (1:2.5.2p2-2.1) unstable; urgency=low
+ 
+  * NMU
+  * Remove duplicate Build-Depends for libssl096-dev and change it to 
+    depend on libssl-dev instaed.  Also adding in virtual | real package
+    style build-deps.  (Closes: #93793, #75228)
+  * Removing add-log entry (Closes: #79266)
+  * This was a pam bug from a while back (Closes: #86908, #88457, #86843)
+  * pam build-dep already exists (Closes: #93683)
+  * libgnome-dev build-dep already exists (Closes: #93694)
+  * No longer in non-free (Closes: #85401)
+  * Adding in fr debconf translations (Closes: #83783)
+  * Already suggests xbase-clients (Closes: #79741)
+  * No need to suggest libpam-pwdb anymore (Closes: #81658)
+  * Providing rsh-client (Closes: #79437)
+  * hurd patch was already applied (Closes: #76033)
+  * default set to no (Closes: #73682)
+  * Adding in a suggests for dnsutils (Closes: #93265)
+  * postinst bugs fixed (Closes: #88057, #88066, #88196, #88405, #88612)
+    (Closes: #88774, #88196, #89556, #90123, #90228, #90833, #87814, #85465)
+  * Adding in debconf dependency
+ 
+ -- Ivan E. Moore II <rkrusty@debian.org>  Mon, 16 Apr 2001 14:11:04 +0100
+
+openssh (1:2.5.2p2-2) unstable; urgency=high
+
+  * disable the OpenSSL version check in entropy.c
+    (closes: #93581, #93588, #93590, #93614, #93619, #93635, #93648)
+
+ -- Philip Hands <phil@uk.alcove.com>  Wed, 11 Apr 2001 20:30:04 +0100
+
+openssh (1:2.5.2p2-1) unstable; urgency=low
+
+  * New upstream release
+  * removed make-ssh-known-hosts, since ssh-keyscan does that job (closes: #86069, #87748)
+  * fix double space indent in german templates (closes: #89493)
+  * make postinst check for ssh_host_rsa_key
+  * get rid of the last of the misguided debian/rules NMU debris  :-/
+
+ -- Philip Hands <phil@hands.com>  Sat, 24 Mar 2001 20:59:33 +0000
+
+openssh (1:2.5.1p2-2) unstable; urgency=low
+
+  * rebuild with new debhelper (closes: #89558, #89536, #90225)
+  * fix broken dpkg-statoverride test in postinst
+    (closes: #89612, #90474, #90460, #89605)
+  * NMU bug fixed but not closed in last upload  (closes: #88206)
+  
+ -- Philip Hands <phil@hands.com>  Fri, 23 Mar 2001 16:11:33 +0000
+
+openssh (1:2.5.1p2-1) unstable; urgency=high
+
+  * New upstream release
+  * fix typo in postinst (closes: #88110)
+  * revert to setting PAM service name in debian/rules, backing out last
+    NMU, which also (closes: #88101)
+  * restore the pam lastlog/motd lines, lost during the NMUs, and sshd_config
+  * restore printlastlog option patch
+  * revert to using debhelper, which had been partially disabled in NMUs
+
+ -- Philip Hands <phil@hands.com>  Tue, 13 Mar 2001 01:41:34 +0000
+
+openssh (1:2.5.1p1-1.8) unstable; urgency=high
+
+  * And now the old pam-bug s/sshd/ssh in ssh.c is also fixed
+
+ -- Christian Kurz <shorty@debian.org>  Thu,  1 Mar 2001 19:48:01 +0100
+
+openssh (1:2.5.1p1-1.7) unstable; urgency=high
+
+  * And now we mark the correct binary as setuid, when a user requested
+    to install it setuid.
+
+ -- Christian Kurz <shorty@debian.org>  Thu,  1 Mar 2001 07:19:56 +0100
+
+openssh (1:2.5.1p1-1.6) unstable; urgency=high
+
+  * Fixes postinst to handle overrides that are already there. Damn, I 
+    should have noticed the bug earlier.
+
+ -- Christian Kurz <shorty@debian.org>  Wed, 28 Feb 2001 22:35:00 +0100
+
+openssh (1:2.5.1p1-1.5) unstable; urgency=high
+
+  * Rebuild ssh with pam-support.
+
+ -- Christian Kurz <shorty@debian.org>  Mon, 26 Feb 2001 21:55:51 +0100
+
+openssh (1:2.5.1p1-1.4) unstable; urgency=low
+
+  * Added Build-Depends on libssl096-dev.
+  * Fixed sshd_config file to disallow root logins again.
+
+ -- Christian Kurz <shorty@debian.org>  Sun, 25 Feb 2001 20:03:55 +0100
+
+openssh (1:2.5.1p1-1.3) unstable; urgency=low
+
+  * Fixed missing manpages for sftp.1 and ssh-keyscan.1
+  * Made package policy 3.5.2 compliant.
+
+ -- Christian Kurz <shorty@debian.org>  Sun, 25 Feb 2001 15:46:26 +0100
+
+openssh (1:2.5.1p1-1.2) unstable; urgency=low
+
+  * Added Conflict with sftp, since we now provide our own sftp-client.
+  * Added a fix for our broken dpkg-statoverride call in the 
+    2.3.0p1-13.
+  * Fixed some config pathes in the comments of sshd_config.
+  * Removed ssh-key-exchange-vulnerability-patch since it's not needed
+    anymore because upstream included the fix.
+
+ -- Christian Kurz <shorty@debian.org>  Sun, 25 Feb 2001 13:46:58 +0100
+
+openssh (1:2.5.1p1-1.1) unstable; urgency=high
+
+  * Another NMU to get the new upstream version 2.5.1p1 into
+    unstable. (Closes: #87123)
+  * Corrected postinst to mark ssh as setuid. (Closes: #86391, #85766)
+  * Key Exchange patch is already included by upstream. (Closes: #86015)
+  * Upgrading should be possible now. (Closes: #85525, #85523)
+  * Added --disable-suid-ssh as compile option, so ssh won't get installed
+    suid per default.
+  * Fixed postinst to run dpkg-statoverride only, when dpkg-statoverride
+    is available and the mode of the binary should be 4755. And also added
+    suggestion for a newer dpkg.
+    (Closes: #85734, #85741, #86876)
+  * sftp and ssh-keyscan will also be included from now on. (Closes: #79994)
+  * scp now understands spaces in filenames (Closes: #53783, #58958,
+    #66723)
+  * ssh-keygen now supports showing DSA fingerprints. (Closes: #68623)
+  * ssh doesn' t show motd anymore when switch -t is used. (Closes #69035)
+  * ssh supports the usage of other dsa keys via the ssh command line
+    options. (Closes: #81250)
+  * Documentation in sshd_config fixed. (Closes: #81088)
+  * primes file included by upstream and included now. (Closes: #82101)
+  * scp now allows dots in the username. (Closes: #82477)
+  * Spelling error in ssh-copy-id.1 corrected by upstream. (Closes: #78124)
+
+ -- Christian Kurz <shorty@debian.org>  Sun, 25 Feb 2001 10:06:08 +0100
+
+openssh (1:2.3.0p1-1.13) unstable; urgency=low
+
+  * Config should now also be fixed with this hopefully last NMU.
+
+ -- Christian Kurz <shorty@debian.org>  Sat, 10 Feb 2001 22:56:36 +0100
+
+openssh (1:2.3.0p1-1.12) unstable; urgency=high
+
+  * Added suggest for xbase-clients to control-file. (Closes #85227)
+  * Applied patch from Markus Friedl to fix a vulnerability in 
+    the rsa keyexchange.
+  * Fixed position of horizontal line. (Closes: #83613)
+  * Fixed hopefully the grep problem in the config-file. (Closes: #78802)
+  * Converted package from suidregister to dpkg-statoverride.
+
+ -- Christian Kurz <shorty@debian.org>  Fri,  9 Feb 2001 19:43:55 +0100
+
+openssh (1:2.3.0p1-1.11) unstable; urgency=medium
+
+  * Fixed some typos in the german translation of the debconf
+    template.
+
+ -- Christian Kurz <shorty@debian.org>  Wed, 24 Jan 2001 18:22:38 +0100
+
+openssh (1:2.3.0p1-1.10) unstable; urgency=medium
+
+  * Fixed double printing of motd. (Closes: #82618)
+
+ -- Christian Kurz <shorty@debian.org>  Tue, 23 Jan 2001 21:03:43 +0100
+
+openssh (1:2.3.0p1-1.9) unstable; urgency=high
+
+  * And the next NMU which includes the patch from Andrew Bartlett
+    and Markus Friedl to fix the root privileges handling of openssh.
+    (Closes: #82657)
+
+ -- Christian Kurz <shorty@debian.org>  Wed, 17 Jan 2001 22:20:54 +0100
+
+openssh (1:2.3.0p1-1.8) unstable; urgency=high
+
+  * Applied fix from Ryan Murray to allow building on other architectures
+    since the hurd patch was wrong. (Closes: #82471)
+
+ -- Christian Kurz <shorty@debian.org>  Tue, 16 Jan 2001 22:45:51 +0100
+
+openssh (1:2.3.0p1-1.7) unstable; urgency=medium
+
+  * Fixed another typo on sshd_config
+
+ -- Christian Kurz <shorty@debian.org>  Sun, 14 Jan 2001 19:01:31 +0100
+
+openssh (1:2.3.0p1-1.6) unstable; urgency=high
+
+  * Added Build-Dependency on groff (Closes: #81886)
+  * Added Build-Depencency on debhelper (Closes: #82072)
+  * Fixed entry for known_hosts in sshd_config (Closes: #82096)
+
+ -- Christian Kurz <shorty@debian.org>  Thu, 11 Jan 2001 23:08:16 +0100
+
+openssh (1:2.3.0p1-1.5) unstable; urgency=high
+
+  * Fixed now also the problem with sshd used as default ipv4 and
+    didn't use IPv6. This should be now fixed.
+
+ -- Christian Kurz <shorty@debian.org>  Thu, 11 Jan 2001 21:25:55 +0100
+
+openssh (1:2.3.0p1-1.4) unstable; urgency=high
+
+  * Fixed buggy entry in postinst.
+
+ -- Christian Kurz <shorty@debian.org>  Wed, 10 Jan 2001 23:12:16 +0100
+
+openssh (1:2.3.0p1-1.3) unstable; urgency=high
+
+  * After finishing the rewrite of the rules-file I had to notice that
+    the manpage installation was broken. This should now work again.
+
+ -- Christian Kurz <shorty@debian.org>  Wed, 10 Jan 2001 22:11:59 +0100
+
+openssh (1:2.3.0p1-1.2) unstable; urgency=high
+
+  * Fixed the screwed up build-dependency.
+  * Removed --with-ipv4-default to support ipv6.
+  * Changed makefile to use /etc/pam.d/ssh instead of /etc/pam.d/sshd.
+  * Fixed location to sftp-server in config.
+  * Since debian still relies on /etc/pam.d/ssh instead of moving to
+    /etc/pam.d/sshd, I had to hack ssh.h to get ssh to use this name.
+  * Fixed path to host key in sshd_config.
+
+ -- Christian Kurz <shorty@debian.org>  Wed, 10 Jan 2001 08:23:47 +0100
+
+openssh (1:2.3.0p1-1.1) unstable; urgency=medium
+
+  * NMU with permission of Phil Hands.
+  * New upstream release
+  * Update Build-Depends to point to new libssl096.
+  * This upstream release doesn't leak any information depending
+    on the setting of PermitRootLogin (Closes: #59933)
+  * New upstream release contains fix against forcing a client to 
+    do X/agent forwarding (Closes: #76788)
+  * Changed template to contain correct path to the documentation 
+    (Closes: #67245)
+  * Added --with-4in6 switch as compile option into debian/rules.       
+  * Added --with-ipv4-default as compile option into debian/rules. 
+    (Closes: #75037)
+  * Changed default path to also contain /usr/local/bin and 
+    /usr/X11R6/bin (Closes: #62472,#54567,#62810)
+  * Changed path to sftp-server in sshd_config to match the
+    our package (Closes: #68347)
+  * Replaced OpenBSDh with OpenBSD in the init-script.  
+  * Changed location to original source in copyright.head
+  * Changed behaviour of init-script when invoked with the option
+    restart (Closes: #68706,#72560)
+  * Added a note about -L option of scp to README.Debian        
+  * ssh won't print now the motd if invoked with -t option
+    (Closes: #59933)
+  * RFC.nroff.gz get's now converted into RFC.gz. (Closes: #63867)      
+  * Added a note about tcp-wrapper support to README.Debian 
+    (Closes: #72807,#22190)
+  * Removed two unneeded options from building process. 
+  * Added sshd.pam into debian dir and install it.
+  * Commented out unnecessary call to dh_installinfo.
+  * Added a line to sshd.pam so that limits will be paid attention
+    to (Closes: #66904)
+  * Restart Option has a Timeout of 10 seconds (Closes: 51264)
+  * scp won't override files anymore (Closes: 51955)
+  * Removed pam_lastlog module, so that the lastlog is now printed
+    only once (Closes: #71742, #68335, #69592, #71495, #77781)
+  * If password is expired, openssh now forces the user to change it.
+    (Closes: #51747)
+  * scp should now have no more problems with shell-init-files that
+    produces ouput (Closes: #56280,#59873)
+  * ssh now prints the motd correctly (Closes: #66926)  
+  * ssh upgrade should disable ssh daemon only if users has choosen
+    to do so (Closes: #67478)
+  * ssh can now be installed suid (Closes: #70879)      
+  * Modified debian/rules to support hurd.
+
+ -- Christian Kurz <shorty@debian.org>  Wed, 27 Dec 2000 20:06:57 +0100
+
+openssh (1:2.2.0p1-1.1) unstable; urgency=medium
+
+  * Non-Maintainer Upload
+  * Check for new returns in the new libc
+    (closes: #72803, #74393, #72797, #71307, #71702)
+  * Link against libssl095a (closes: #66304)
+  * Correct check for PermitRootLogin (closes: #69448)
+
+ -- Ryan Murray <rmurray@debian.org>  Wed, 18 Oct 2000 00:48:18 -0700
+
+openssh (1:2.2.0p1-1) unstable; urgency=low
+
+  * New upstream release
+
+ -- Philip Hands <phil@hands.com>  Mon, 11 Sep 2000 14:49:43 +0100
+
+openssh (1:2.1.1p4-3) unstable; urgency=low
+
+  * add rsh alternatives
+  * add -S option to scp (using Tommi Virtanen's patch) (closes: #63097)
+  * do the IPV4_DEFAULT thing properly this time
+
+ -- Philip Hands <phil@hands.com>  Fri, 11 Aug 2000 18:14:37 +0100
+
+openssh (1:2.1.1p4-2) unstable; urgency=low
+
+  * reinstate manpage .out patch from 1:1.2.3
+  * fix typo in postinst
+  * only compile ssh with IPV4_DEFAULT
+  * apply James Troup's patch to add a -o option to scp and updated manpage
+
+ -- Philip Hands <phil@hands.com>  Sun, 30 Jul 2000 00:12:49 +0100
+
+openssh (1:2.1.1p4-1) unstable; urgency=low
+
+  * New upstream release
+
+ -- Philip Hands <phil@hands.com>  Sat, 29 Jul 2000 14:46:16 +0100
+
+openssh (1:1.2.3-10) unstable; urgency=low
+
+  * add version to libpam-modules dependency, because old versions of
+    pam_motd make it impossible to log in.
+
+ -- Philip Hands <phil@hands.com>  Sat, 29 Jul 2000 13:28:22 +0100
+
+openssh (1:1.2.3-9) frozen unstable; urgency=low
+
+  * force location of /usr/bin/X11/xauth
+    (closes: #64424, #66437, #66859)  *RC*
+  * typos in config (closes: #66779, #66780)
+  * sshd_not_to_be_run could be assumed to be true, in error, if the config
+    script died in an unusual way --- I've reversed this (closes: #66335)  
+  * Apply Zack Weinberg <zack@wolery.cumb.org>'s patch to ssh-askpass-ptk
+    (closes: #65981)
+  * change default for PermitRootLogin to "no" (closes: #66406)
+
+ -- Philip Hands <phil@hands.com>  Tue, 11 Jul 2000 20:51:18 +0100
+
+openssh (1:1.2.3-8) frozen unstable; urgency=low
+
+  * get rid of Provides: rsh-server (this will mean that rstartd
+    will need to change it's depends to deal with #63948, which I'm
+    reopening)  (closes: #66257)
+    Given that this is also a trivial change, and is a reversal of a
+    change that was mistakenly made after the freeze, I think this should
+    also go into frozen.
+
+ -- Philip Hands <phil@hands.com>  Wed, 28 Jun 2000 03:26:30 +0100
+
+openssh (1:1.2.3-7) frozen unstable; urgency=low
+
+  * check if debconf is installed before calling db_stop in postinst.
+    This is required to allow ssh to be installed when debconf is not
+    wanted, which probably makes it an RC upload (hopefully the last of
+    too many).
+
+ -- Philip Hands <phil@hands.com>  Wed, 28 Jun 2000 03:19:47 +0100
+
+openssh (1:1.2.3-6) frozen unstable; urgency=low
+
+  * fixed depressing little bug involving a line wrap looking like
+    a blank line in the templates file   *RC*
+    (closes: #66090, #66078, #66083, #66182)
+
+ -- Philip Hands <phil@hands.com>  Mon, 26 Jun 2000 00:45:05 +0100
+
+openssh (1:1.2.3-5) frozen unstable; urgency=low
+
+  * add code to prevent UseLogin exploit, although I think our PAM
+    conditional code breaks UseLogin in a way that protects us from this
+    exploit anyway. ;-)  (closes: #65495)  *RC*
+  * Apply Zack Weinberg <zack@wolery.cumb.org>'s patch to fix keyboard
+    grab vulnerability in ssh-askpass-gnome (closes: #64795) *RC*
+  * stop redirection of sshd's file descriptors (introduced in 1:1.2.3-3)
+    and use db_stop in the postinst to solve that problem instead
+    (closes: #65104)
+  * add Provides: rsh-server to ssh (closes: #63948)
+  * provide config option not to run sshd
+
+ -- Philip Hands <phil@hands.com>  Mon, 12 Jun 2000 23:05:11 +0100
+
+openssh (1:1.2.3-4) frozen unstable; urgency=low
+
+  * fixes #63436 which is *RC*
+  * add 10 second pause in init.d restart (closes: #63844)
+  * get rid of noenv in PAM mail line (closes: #63856)
+  * fix host key path in make-ssh-known-hosts (closes: #63713)
+  * change wording of SUID template (closes: #62788, #63436)
+
+ -- Philip Hands <phil@hands.com>  Sat, 27 May 2000 11:18:06 +0100
+
+openssh (1:1.2.3-3) frozen unstable; urgency=low
+
+  * redirect sshd's file descriptors to /dev/null in init to
+    prevent debconf from locking up during installation 
+    ** grave bug just submited by me **
+
+ -- Philip Hands <phil@hands.com>  Thu, 20 Apr 2000 17:10:59 +0100
+
+openssh (1:1.2.3-2) frozen  unstable; urgency=low
+
+  * allow user to select SUID status of /usr/bin/ssh (closes: 62462) ** RC **
+  * suggest debconf
+  * conflict with debconf{,-tiny} (<<0.2.17) so I can clean up the preinst
+
+ -- Philip Hands <phil@hands.com>  Wed, 19 Apr 2000 17:49:15 +0100
+
+openssh (1:1.2.3-1) frozen unstable; urgency=low
+
+  * New upstream release
+  * patch sshd to create extra xauth key required for localhost
+    (closes: #49944)  *** RC ***
+  * FallbacktoRsh now defaults to ``no'' to match impression
+    given in sshd_config
+  * stop setting suid bit on ssh (closes: #58711, #58558)
+    This breaks Rhosts authentication (which nobody uses) and allows
+    the LD_PRELOAD trick to get socks working, so seems like a net benefit.
+
+ -- Philip Hands <phil@hands.com>  Thu, 13 Apr 2000 20:01:54 +0100
+
+openssh (1:1.2.2-1.4) frozen unstable; urgency=low
+
+  * Recompile for frozen, contains fix for RC bug.
+
+ -- Tommi Virtanen <tv@debian.org>  Tue, 29 Feb 2000 22:14:58 +0200
+
+openssh (1:1.2.2-1.3) unstable; urgency=low
+
+  * Integrated man page addition for PrintLastLog.
+    This bug was filed on "openssh", and I ended up
+    creating my own patch for this (closes: #59054)
+  * Improved error message when ssh_exchange_identification
+    gets EOF (closes: #58904)
+  * Fixed typo (your -> you're) in debian/preinst.
+  * Added else-clauses to config to make this upgradepath possible:
+    oldssh -> openssh preinst fails due to upgrade_to_openssh=false
+    -> ssh-nonfree -> openssh. Without these, debconf remembered
+    the old answer, config didn't force asking it, and preinst always
+    aborted (closes: #56596, #57782)
+  * Moved setting upgrade_to_openssh isdefault flag to the place
+    where preinst would abort. This means no double question to most
+    users, people who currently suffer from "can't upgrade" may need
+    to run apt-get install ssh twice. Did not do the same for 
+    use_old_init_script, as the situation is a bit different, and
+    less common (closes: #54010, #56224)
+  * Check for existance of ssh-keygen before attempting to use it in
+    preinst, added warning for non-existant ssh-keygen in config. This
+    happens when the old ssh is removed (say, due to ssh-nonfree getting
+    installed).
+
+ -- Tommi Virtanen <tv@debian.org>  Sun, 27 Feb 2000 21:36:43 +0200
+
+openssh (1:1.2.2-1.2) frozen unstable; urgency=low
+
+  * Non-maintainer upload.
+  * Added configuration option PrintLastLog, default off due to PAM
+    (closes: #54007, #55042)
+  * ssh-askpass-{gnome,ptk} now provide ssh-askpass, making ssh's
+    Suggests: line more accurate. Also closing related bugs fixed
+    earlier, when default ssh-askpass moved to /usr/bin.
+    (closes: #52403, #54741, #50607, #52298, #50967, #51661)
+  * Patched to call vhangup, with autoconf detection and all
+    (closes: #55379)
+  * Added --with-ipv4-default workaround to a glibc bug causing
+    slow DNS lookups, as per UPGRADING. Use -6 to really use
+    IPv6 addresses. (closes: #57891, #58744, #58713, #57970)
+  * Added noenv to PAM pam_mail line. Thanks to Ben Collins.
+    (closes: #58429)
+  * Added the UPGRADING file to the package.
+  * Added frozen to the changelog line and recompiled before
+    package was installed into the archive.
+
+ -- Tommi Virtanen <tv@debian.org>  Fri, 25 Feb 2000 22:08:57 +0200
+
+openssh (1:1.2.2-1.1) frozen unstable; urgency=low
+
+  * Non-maintainer upload.
+  * Integrated scp pipe buffer patch from Ben Collins
+    <benc@debian.org>, should now work even if reading
+    a pipe gives less than fstat st_blksize bytes. 
+    Should now work on Alpha and Sparc Linux (closes: #53697, #52071)
+  * Made ssh depend on libssl09 (>= 0.9.4-3) (closes: #51393)
+  * Integrated patch from Ben Collins <benc@debian.org>
+    to do full shadow account locking and expiration
+    checking (closes: #58165, #51747)
+
+ -- Tommi Virtanen <tv@debian.org>  Tue, 22 Feb 2000 20:46:12 +0200
+
+openssh (1:1.2.2-1) frozen unstable; urgency=medium
+
+  * New upstream release (closes: #56870, #56346)
+  * built against new libesd (closes: #56805)
+  * add  Colin Watson <cjw44@cam.ac.uk> =NULL patch
+    (closes: #49902, #54894)
+  * use socketpairs as suggested by Andrew Tridgell to eliminate rsync
+    (and other) lockups
+  * patch SSHD_PAM_SERVICE back into auth-pam.c, again :-/
+    (closes: #49902, #55872, #56959)
+  * uncoment the * line in ssh_config (closes: #56444)
+  
+  * #54894 & #49902 are release critical, so this should go in frozen
+
+ -- Philip Hands <phil@hands.com>  Wed,  9 Feb 2000 04:52:04 +0000
+
+openssh (1:1.2.1pre24-1) unstable; urgency=low
+
+  * New upstream release
+
+ -- Philip Hands <phil@hands.com>  Fri, 31 Dec 1999 02:47:24 +0000
+
+openssh (1:1.2.1pre23-1) unstable; urgency=low
+
+  * New upstream release
+  * excape ? in /etc/init.d/ssh (closes: #53269)
+
+ -- Philip Hands <phil@hands.com>  Wed, 29 Dec 1999 16:50:46 +0000
+
+openssh (1:1.2pre17-1) unstable; urgency=low
+
+  * New upstream release
+
+ -- Philip Hands <phil@hands.com>  Thu,  9 Dec 1999 16:50:40 +0000
+
+openssh (1:1.2pre16-1) unstable; urgency=low
+
+  * New upstream release
+  * upstream release (1.2pre14) (closes: #50299)
+  * make ssh depend on libwrap0 (>= 7.6-1.1) (closes: #50973, #50776)
+  * dispose of grep -q broken pipe message in config script (closes: #50855)
+  * add make-ssh-known-hosts (closes: #50660)
+  * add -i option to ssh-copy-id (closes: #50657)
+  * add check for *LK* in password, indicating a locked account
+
+ -- Philip Hands <phil@hands.com>  Wed,  8 Dec 1999 22:59:38 +0000
+
+openssh (1:1.2pre13-1) unstable; urgency=low
+
+  * New upstream release
+  * make sshd.c use SSHD_PAM_SERVICE and define it as "ssh" in debian/rules
+  * remove duplicate line in /etc/pam.d/ssh (closes: #50310)
+  * mention ssh -A option in ssh.1 & ssh_config
+  * enable forwarding to localhost in default ssh_config (closes: #50373)
+  * tweak preinst to deal with debconf being `unpacked'
+  * use --with-tcp-wrappers (closes: #49545)
+
+ -- Philip Hands <phil@hands.com>  Sat, 20 Nov 1999 14:20:04 +0000
+
+openssh (1:1.2pre11-2) unstable; urgency=low
+
+  * oops, just realised that I forgot to strip out the unpleasant
+    fiddling mentioned below (which turned not to be a fix anyway)
+
+ -- Philip Hands <phil@hands.com>  Mon, 15 Nov 1999 01:35:23 +0000
+
+openssh (1:1.2pre11-1) unstable; urgency=low
+
+  * New upstream release (closes: #49722)
+  * add 2>/dev/null to dispose of spurious message casused by grep -q
+    (closes: #49876, #49604)
+  * fix typo in debian/control (closes: #49841)
+  * Do some unpleasant fiddling with upgraded keys in the preinst, which
+    should make the keylength problem go away.   (closes: #49676)
+  * make pam_start in sshd use ``ssh'' as the service name (closes: #49956)
+  * If /etc/ssh/NOSERVER exist, stop sshd from starting (closes: #47107)
+  * apply Ben Collins <bcollins@debian.org>'s shadow patch
+  * disable lastlogin and motd printing if using pam (closes: #49957)
+  * add ssh-copy-id script and manpage
+
+ -- Philip Hands <phil@hands.com>  Fri, 12 Nov 1999 01:03:38 +0000
+
+openssh (1:1.2pre9-1) unstable; urgency=low
+
+  * New upstream release
+  * apply Chip Salzenberg <chip@valinux.com>'s SO_REUSEADDR patch
+    to channels.c, to make forwarded ports instantly reusable
+  * replace Pre-Depend: debconf with some check code in preinst
+  * make the ssh-add ssh-askpass failure message more helpful
+  * fix the ssh-agent getopts bug (closes: #49426)
+  * fixed typo on Suggests: line (closes: #49704, #49571)
+  * tidy up ssh package description (closes: #49642)
+  * make ssh suid (closes: #49635)
+  * in preinst upgrade code, ensure ssh_host_keys is mode 600 (closes: #49606)
+  * disable agent forwarding by default, for the similar reasons as
+    X forwarding (closes: #49586)
+
+ -- Philip Hands <phil@hands.com>  Tue,  9 Nov 1999 09:57:47 +0000
+
+openssh (1:1.2pre7-4) unstable; urgency=low
+
+  * predepend on debconf (>= 0.2.17) should now allow preinst questions
+
+ -- Philip Hands <phil@hands.com>  Sat,  6 Nov 1999 10:31:06 +0000
+
+openssh (1:1.2pre7-3) unstable; urgency=low
+
+  * add ssh-askpass package using Tommi Virtanen's perl-tk script
+  * add ssh-preconfig package cludge
+  * add usage hints to ssh-agent.1
+
+ -- Philip Hands <phil@hands.com>  Fri,  5 Nov 1999 00:38:33 +0000
+
+openssh (1:1.2pre7-2) unstable; urgency=low
+
+  * use pam patch from Ben Collins <bcollins@debian.org>
+  * add slogin symlink to Makefile.in
+  * change /usr/bin/login to LOGIN_PROGRAM define of /bin/login 
+  * sort out debconf usage
+  * patch from Tommi Virtanen <tv@debian.org>'s makes ssh-add use ssh-askpass
+
+ -- Philip Hands <phil@hands.com>  Thu,  4 Nov 1999 11:08:54 +0000
+
+openssh (1:1.2pre7-1) unstable; urgency=low
+
+  * New upstream release
+
+ -- Philip Hands <phil@hands.com>  Tue,  2 Nov 1999 21:02:37 +0000
+
+openssh (1:1.2.0.pre6db1-2) unstable; urgency=low
+
+  * change the binary package name to ssh (the non-free branch of ssh has
+    been renamed to ssh-nonfree)
+  * make pam file comply with Debian standards
+  * use an epoch to make sure openssh supercedes ssh-nonfree
+
+ -- Philip Hands <phil@hands.com>  Sat, 30 Oct 1999 16:26:05 +0100
+
+openssh (1.2pre6db1-1) unstable; urgency=low
+
+  * New upstream source
+  * sshd accepts logins now!
+
+ -- Dan Brosemer <odin@linuxfreak.com>  Fri, 29 Oct 1999 11:13:38 -0500
+
+openssh (1.2.0.19991028-1) unstable; urgency=low
+
+  * New upstream source
+  * Added test for -lnsl to configure script
+
+ -- Dan Brosemer <odin@linuxfreak.com>  Thu, 28 Oct 1999 18:52:09 -0500
+
+openssh (1.2.0.19991027-3) unstable; urgency=low
+
+  * Initial release
+
+ -- Dan Brosemer <odin@linuxfreak.com>  Wed, 27 Oct 1999 19:39:46 -0500
diff --git a/debian/clean b/debian/clean
new file mode 100644
index 000000000..5da17f8eb
--- /dev/null
+++ b/debian/clean
@@ -0,0 +1 @@
+config.log
diff --git a/debian/compat b/debian/compat
new file mode 100644
index 000000000..7f8f011eb
--- /dev/null
+++ b/debian/compat
@@ -0,0 +1 @@
+7
diff --git a/debian/control b/debian/control
new file mode 100644
index 000000000..2b0fcb8c2
--- /dev/null
+++ b/debian/control
@@ -0,0 +1,133 @@
+Source: openssh
+Section: net
+Priority: standard
+Maintainer: Debian OpenSSH Maintainers <debian-ssh@lists.debian.org>
+Build-Depends: libwrap0-dev | libwrap-dev, zlib1g-dev (>= 1:1.2.3-1), libssl-dev (>= 0.9.8-1), libpam0g-dev | libpam-dev, libgtk2.0-dev, libedit-dev, debhelper (>= 7.4.2~), libselinux1-dev [linux-any], libkrb5-dev | heimdal-dev, hardening-includes
+Standards-Version: 3.8.4
+Uploaders: Colin Watson <cjwatson@debian.org>, Matthew Vernon <matthew@debian.org>
+Homepage: http://www.openssh.org/
+Vcs-Bzr: http://bzr.debian.org/pkg-ssh/openssh/trunk
+Vcs-Browser: http://bzr.debian.org/loggerhead/pkg-ssh/openssh/trunk
+
+Package: openssh-client
+Architecture: any
+Depends: ${shlibs:Depends}, ${misc:Depends}, debconf (>= 1.2.0) | debconf-2.0, adduser (>= 3.10), dpkg (>= 1.7.0), passwd, libssl0.9.8 (>= 0.9.8g-9)
+Recommends: xauth, openssh-blacklist, openssh-blacklist-extra
+Conflicts: ssh (<< 1:3.8.1p1-9), sftp, rsh-client (<<0.16.1-1), ssh-krb5 (<< 1:4.3p2-7)
+Replaces: ssh, ssh-krb5
+Suggests: ssh-askpass, libpam-ssh, keychain
+Provides: rsh-client, ssh-client
+Description: secure shell (SSH) client, for secure access to remote machines
+ This is the portable version of OpenSSH, a free implementation of
+ the Secure Shell protocol as specified by the IETF secsh working
+ group.
+ .
+ Ssh (Secure Shell) is a program for logging into a remote machine
+ and for executing commands on a remote machine.
+ It provides secure encrypted communications between two untrusted
+ hosts over an insecure network. X11 connections and arbitrary TCP/IP
+ ports can also be forwarded over the secure channel.
+ It can be used to provide applications with a secure communication
+ channel.
+ .
+ This package provides the ssh, scp and sftp clients, the ssh-agent
+ and ssh-add programs to make public key authentication more convenient,
+ and the ssh-keygen, ssh-keyscan, ssh-copy-id and ssh-argv0 utilities.
+ .
+ In some countries it may be illegal to use any encryption at all
+ without a special permit.
+ .
+ ssh replaces the insecure rsh, rcp and rlogin programs, which are
+ obsolete for most purposes.
+
+Package: openssh-server
+Priority: optional
+Architecture: any
+Depends: ${shlibs:Depends}, ${misc:Depends}, debconf (>= 1.2.0) | debconf-2.0, libpam-runtime (>= 0.76-14), libpam-modules (>= 0.72-9), adduser (>= 3.9), dpkg (>= 1.9.0), openssh-client (= ${binary:Version}), lsb-base (>= 3.2-13), libssl0.9.8 (>= 0.9.8g-9), openssh-blacklist, procps
+Recommends: xauth, openssh-blacklist-extra
+Conflicts: ssh (<< 1:3.8.1p1-9), ssh-nonfree (<<2), ssh-socks, ssh2, sftp, rsh-client (<<0.16.1-1), ssh-krb5 (<< 1:4.3p2-7)
+Replaces: ssh, openssh-client (<< 1:3.8.1p1-11), ssh-krb5
+Suggests: ssh-askpass, rssh, molly-guard, ufw
+Provides: ssh-server
+Description: secure shell (SSH) server, for secure access from remote machines
+ This is the portable version of OpenSSH, a free implementation of
+ the Secure Shell protocol as specified by the IETF secsh working
+ group.
+ .
+ Ssh (Secure Shell) is a program for logging into a remote machine
+ and for executing commands on a remote machine.
+ It provides secure encrypted communications between two untrusted
+ hosts over an insecure network. X11 connections and arbitrary TCP/IP
+ ports can also be forwarded over the secure channel.
+ It can be used to provide applications with a secure communication
+ channel.
+ .
+ This package provides the sshd server.
+ .
+ In some countries it may be illegal to use any encryption at all
+ without a special permit.
+ .
+ sshd replaces the insecure rshd program, which is obsolete for most
+ purposes.
+
+Package: ssh
+Priority: extra
+Architecture: all
+Depends: ${misc:Depends}, openssh-client, openssh-server
+Description: secure shell client and server (metapackage)
+ This metapackage is a convenient way to install both the OpenSSH client
+ and the OpenSSH server. It provides nothing in and of itself, so you
+ may remove it if nothing depends on it.
+
+Package: ssh-krb5
+Priority: extra
+Architecture: all
+Depends: ${misc:Depends}, openssh-client, openssh-server
+Description: secure shell client and server (transitional package)
+ This is a transitional package depending on the regular Debian OpenSSH
+ client and server, which now support GSSAPI natively. It will add the
+ necessary GSSAPI options to the server configuration file. You can
+ remove it once the upgrade is complete and nothing depends on it.
+
+Package: ssh-askpass-gnome
+Section: gnome
+Priority: optional
+Architecture: any
+Depends: ${shlibs:Depends}, ${misc:Depends}, openssh-client | ssh (>= 1:1.2pre7-4) | ssh-krb5
+Replaces: ssh (<< 1:3.5p1-3)
+Provides: ssh-askpass
+Description: interactive X program to prompt users for a passphrase for ssh-add
+ This has been split out of the main openssh-client package so that
+ openssh-client does not need to depend on GTK+.
+ .
+ You probably want the ssh-askpass package instead, but this is
+ provided to add to your choice and/or confusion.
+
+Package: openssh-client-udeb
+XC-Package-Type: udeb
+Section: debian-installer
+Priority: optional
+Architecture: any
+Depends: ${shlibs:Depends}, libnss-files-udeb, libcrypto0.9.8-udeb (>= 0.9.8g-9)
+XB-Installer-Menu-Item: 99999
+Description: secure shell client for the Debian installer
+ This is the portable version of OpenSSH, a free implementation of
+ the Secure Shell protocol as specified by the IETF secsh working
+ group.
+ .
+ This package provides the ssh client for use in debian-installer.
+
+Package: openssh-server-udeb
+XC-Package-Type: udeb
+Section: debian-installer
+Priority: optional
+Architecture: any
+Depends: ${shlibs:Depends}, libnss-files-udeb, libcrypto0.9.8-udeb (>= 0.9.8g-9)
+Description: secure shell server for the Debian installer
+ This is the portable version of OpenSSH, a free implementation of
+ the Secure Shell protocol as specified by the IETF secsh working
+ group.
+ .
+ This package provides the sshd server for use in debian-installer.
+ Since it is expected to be used in specialized situations (e.g. S/390
+ installs with no console), it does not provide any configuration.
diff --git a/debian/copyright.head b/debian/copyright.head
new file mode 100644
index 000000000..311a06a7e
--- /dev/null
+++ b/debian/copyright.head
@@ -0,0 +1,52 @@
+This package was debianized by Philip Hands <phil@hands.com> on 31 Oct 1999
+(with help from  Dan Brosemer <odin@linuxfreak.com>)
+
+It was downloaded from here:
+  ftp://ftp.fu-berlin.de/unix/security/openssh/openssh-2.3.0p1.tar.gz
+
+worldwide mirrors are listed here:
+  http://www.openssh.com/ftp.html
+
+The Debian specific parts of the package are mostly taken from the
+original ssh package, which has since been renamed as ssh-nonfree.
+
+The Debian patch is distributed under the terms of the GPL, which you
+can find in /usr/share/common-licenses/GPL.
+
+In addition, as a special exception, Matthew Vernon gives permission
+to link the code of the Debian patch with any version of the OpenSSH
+code which is distributed under a license identical to that listed in
+the included Copyright file, and distribute linked combinations
+including the two.  You must obey the GNU General Public License in
+all respects for all of the code used other than OpenSSH.  If you
+modify this file, you may extend this exception to your version of the
+file, but you are not obligated to do so.  If you do not wish to do
+so, delete this exception statement from your version.
+
+The upstream source for this package is a combination of the ssh
+branch that is being maintained by the OpenBSD team (starting from
+the last version of SSH that was distributed under a free license),
+and porting work by Damien Miller <damien@ibs.com.au> to get it
+working on Linux.  Other people also contributed to this, and are
+credited in /usr/share/doc/ssh/README.
+
+This package contains Kerberos version 5 patches from
+http://www.sxw.org.uk/computing/patches/openssh.html; this is Copyright
+(c) 2001-2009 Simon Wilkinson and provided under the standard 2-term BSD
+licence used elsewhere in OpenSSH.
+
+Copyright:
+
+Code in helper.[ch] is Copyright Internet Business Solutions and is
+released under a X11-style license (see source file for details).
+
+(A)RC4 code in rc4.[ch] is Copyright Damien Miller. It too is under a
+X11-style license (see source file for details).
+
+make-ssh-known-hosts is Copyright Tero Kivinen <Tero.Kivinen@hut.fi>,
+and is distributed under the GPL (see source file for details).
+
+The copyright for the original SSH version follows.  It has been
+modified with [comments] to reflect the changes that the OpenBSD folks
+have made:
+
diff --git a/debian/faq.html b/debian/faq.html
new file mode 100644
index 000000000..812234d2f
--- /dev/null
+++ b/debian/faq.html
@@ -0,0 +1,1182 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
+<html>
+<head>
+<title>OpenSSH FAQ</title>
+<link rev= "made" href= "mailto:www@openbsd.org">
+<meta name= "resource-type" content= "document">
+<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
+<meta name= "description"   content= "the OpenSSH FAQ page">
+<meta name= "keywords"      content= "OpenSSH,SSH,Secure Shell,faq">
+<meta name= "distribution"  content= "global">
+<meta name= "copyright"     content= "This document copyright 1999-2005 OpenBSD.">
+</head>
+
+<body bgcolor= "#ffffff" text= "#000000" link= "#23238E">
+<a href="http://www.openssh.org/index.html"><img alt="[OpenSSH]" height="30" width="141" src="images/smalltitle.gif" border="0"></a>
+<p>
+
+<h1>OpenSSH FAQ (Frequently asked questions)</h1>
+
+<strong>Date: 2005/09/20</strong>
+
+<hr>
+
+<blockquote>
+<h3><a href= "#1.0">1.0 - What Is OpenSSH and Where Can I Get It?</a></h3>
+<ul>
+<li><a href= "#1.1">1.1 - What is OpenSSH and where can I download it?</a>
+<li><a href= "#1.2">1.2 - Why should it be used?</a>
+<li><a href= "#1.3">1.3 - What Operating Systems are supported?</a>
+<li><a href= "#1.4">1.4 - What about copyright, usage and patents?</a>
+<li><a href= "#1.5">1.5 - Where should I ask for help?</a>
+<li><a href= "#1.6">1.6 - I have found a bug. Where do I report it?</a>
+</ul>
+
+<h3><a href= "#2.0">2.0 - General Questions</a></h3>
+<ul>
+<li><a href= "#2.1">2.1 - Why does ssh/scp make connections from low-numbered ports. My firewall blocks these.</a>
+<li><a href= "#2.2">2.2 - Why is the ssh client setuid root?</a>
+<li><a href= "#2.3">2.3 - Why does SSH 2.3 have problems interoperating with OpenSSH 2.1.1?</a>
+<li><a href= "#2.4">2.4 - Why does OpenSSH print: Dispatch protocol error: type 20</a>
+<li><a href= "#2.5">2.5 - Old versions of commercial SSH encrypt host keys with IDEA.</a>
+<li><a href= "#2.6">2.6 - What are these warning messages about key lengths?</a>
+<li><a href= "#2.7">2.7 - X11 and/or agent forwarding does not work.</a>
+<li><a href= "#2.8">2.8 - After upgrading OpenSSH I lost SSH2 support.</a>
+<li><a href= "#2.9">2.9 - sftp/scp fails at connection, but ssh is OK.</a>
+<li><a href= "#2.10">2.10 - Will you add [foo] to scp?</a>
+<li><a href= "#2.11">2.11 - How do I use port forwarding?</a>
+<li><a href= "#2.12">2.12 - My ssh connection freezes or drops out after N minutes of inactivity.</a>
+<li><a href= "#2.13">2.13 - How do I use scp to copy a file with a colon in it?</a>
+<li><a href= "#2.14">2.14 - Why does OpenSSH report its version to clients?</a>
+</ul>
+
+<h3><a href= "#3.0">3.0 - Portable OpenSSH Questions</a></h3>
+<ul>
+<li><a href= "#3.1">3.1 - Spurious PAM authentication messages in logfiles.</a>
+<li><a href= "#3.2">3.2 - Empty passwords not allowed with PAM authentication.</a>
+<li><a href= "#3.3">3.3 - ssh(1) takes a long time to connect or log in</a>
+<li><a href= "#3.4">3.4 - "Can't locate module net-pf-10" messages in log under Linux.</a>
+<li><a href= "#3.5">3.5 - Password authentication doesn't work (eg on Slackware 7.0 or Red Hat Linux 6.x)</a>
+<li><a href= "#3.6">3.6 - Configure or sshd(8) complain about lack of RSA support</a>
+<li><a href= "#3.7">3.7 - "scp: command not found" errors</a>
+<li><a href= "#3.8">3.8 - Unable to read passphrase</a>
+<li><a href= "#3.9">3.9 - 'configure' missing or make fails</a>
+<li><a href= "#3.10">3.10 - Hangs when exiting ssh</a>
+<li><a href= "#3.11">3.11 - Why does ssh hang on exit?</a>
+<li><a href= "#3.12">3.12 - I upgraded to OpenSSH 3.1 and X11 forwarding stopped working.</a>
+<li><a href= "#3.13">3.13 - I upgraded to OpenSSH 3.8 and some X11 programs stopped working.</a>
+<li><a href= "#3.14">3.14 - I copied my public key to authorized_keys but public-key authentication still doesn't work.</a>
+<li><a href= "#3.15">3.15 - OpenSSH versions and PAM behaviour.</a>
+<li><a href= "#3.16">3.16 - Why doesn't "w" or "who" on AIX 5.x show users logged in via ssh?</a>
+</ul>
+
+</blockquote>
+
+<hr>
+
+<h2><u><a name= "1.0">1.0 - What Is OpenSSH and Where Can I Get It?</a></u></h2>
+
+<h2><a name= "1.1">1.1 - What is OpenSSH and where can I download it?</a></h2>
+
+<p>
+OpenSSH is a <b>FREE</b> version of the SSH suite of network connectivity 
+tools that increasing numbers of people on the Internet are coming to 
+rely on. Many users of telnet, rlogin, ftp, and other such programs might 
+not realize that their password is transmitted across the Internet 
+unencrypted, but it is. OpenSSH encrypts all traffic (including passwords)
+to effectively eliminate eavesdropping, connection hijacking, 
+and other network-level attacks.
+
+<p>
+The OpenSSH suite includes the 
+<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh&amp;sektion=1">ssh(1)</a> 
+program which replaces rlogin and telnet, and 
+<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=scp&amp;sektion=1">scp(1)</a> 
+which replaces 
+<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=rcp&amp;sektion=1">rcp(1)</a> and 
+<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ftp&amp;sektion=1">ftp(1)</a>. 
+OpenSSH has also added 
+<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sftp&amp;sektion=1">sftp(1)</a> and 
+<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sftp-server&amp;sektion=8">sftp-server(8)</a> 
+which implement an easier solution for file-transfer. This is based upon the 
+<a href="http://www.openssh.org/txt/draft-ietf-secsh-filexfer-02.txt">secsh-filexfer</a> IETF draft.
+
+
+<p><strong>OpenSSH consists of a number of programs.</strong>
+
+<ul>
+<li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sshd&amp;sektion=8">sshd(8)</a> - Server program run on the server machine. This listens for connections from client machines, and whenever it receives a connection, it performs authentication and starts serving the client.
+Its behaviour is controlled by the config file <i><a
+href="http://www.openbsd.org/cgi-bin/man.cgi?query=sshd_config&amp;sektion=5">
+sshd_config(5)</a></i>.
+<li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh&amp;sektion=1">ssh(1)</a> - This is the client program used to log into another machine or to execute commands on the other machine. <i>slogin</i> is another name for this program.
+Its behaviour is controlled by the global config file <i><a
+href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh_config&amp;sektion=5">
+ssh_config(5)</a></i> and individual users' <i>$HOME/.ssh/config</i> files.
+<li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=scp&amp;sektion=1">scp(1)</a> - Securely copies files from one machine to another.
+<li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh-keygen&amp;sektion=1">ssh-keygen(1)</a> - Used to create Pubkey Authentication (RSA or DSA) keys (host keys and user authentication keys).
+<li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh-agent&amp;sektion=1">ssh-agent(1)</a> - Authentication agent.  This can be used to hold RSA keys for authentication.
+<li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh-add&amp;sektion=1">ssh-add(1)</a> - Used to register new keys with the agent.
+<li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sftp-server&amp;sektion=8">sftp-server(8)</a> - SFTP server subsystem.
+<li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sftp&amp;sektion=1">sftp(1)</a> - Secure file transfer program.
+<li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh-keyscan&amp;sektion=1">ssh-keyscan(1)</a> - gather ssh public keys.
+<li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh-keysign&amp;sektion=8">ssh-keysign(8)</a> - ssh helper program for hostbased authentication.
+</ul>
+
+<h3>Downloading</h3>
+
+<p>
+OpenSSH comes in two downloadable distributions: the native <a
+href="http://www.openssh.org/openbsd.html">OpenBSD</a> distribution and the multi-platform
+<a href="http://www.openssh.org/portable.html">Portable</a> distribution.  If you want
+OpenSSH for a recent OpenBSD or integration into a product, you
+probably want the <a href="http://www.openssh.org/openbsd.html">OpenBSD</a> distribution.
+If you want OpenSSH for another platform, or an older OpenBSD, you
+probably want the <a href="http://www.openssh.org/portable.html">Portable</a> distribution.
+
+<p>
+When downloading, please use a <a href="http://www.openssh.org/portable.html#mirrors">mirror</a>
+near you.
+
+<h2><a name= "1.2">1.2 - Why should it be used?</a></h2>
+
+<p>
+OpenSSH is a suite of tools to help secure your network 
+connections. Here is a list of features:
+
+
+<ul>
+        <li>Strong authentication.  Closes several security holes (e.g., IP, routing, and DNS spoofing).
+        <li>Improved privacy.  All communications are automatically and transparently encrypted.
+        <li>Secure X11 sessions.  The program automatically sets DISPLAY on the server machine, and forwards any X11 connections over the secure channel.
+        <li>Arbitrary TCP/IP ports can be redirected through the encrypted channel in both directions (e.g., for e-cash transactions).
+        <li>No retraining needed for normal users.
+        <li>Never trusts the network. Minimal trust on the remote side of the connection. Minimal trust on domain name servers. Pure RSA authentication never trusts anything but the private key.
+        <li>Client RSA-authenticates the server machine in the beginning of every connection to prevent trojan horses (by routing or DNS spoofing) and man-in-the-middle attacks, and the server RSA-authenticates the client machine before accepting <i>.rhosts</i> or <i>/etc/hosts.equiv</i> authentication (to prevent DNS, routing, or IP-spoofing).
+        <li>Host authentication key distribution can be centrally by the administration, automatically when the first connection is made to a machine.
+        <li>Any user can create any number of user authentication RSA keys for his/her own use.
+        <li>The server program has its own server RSA key which is automatically regenerated every hour.
+        <li>An authentication agent, running in the user's laptop or local workstation, can be used to hold the user's RSA authentication keys.
+        <li>The software can be installed and used (with restricted functionality) even without root privileges.
+        <li>The client is customizable in system-wide and per-user configuration files.
+        <li>Optional compression of all data with gzip (including forwarded X11 and TCP/IP port data), which may result in significant speedups on slow connections.
+        <li>Complete replacement for rlogin, rsh, and rcp.
+</ul>
+
+<p>
+Currently, almost all communications in computer networks are done
+without encryption.  As a consequence, anyone who has access to any
+machine connected to the network can listen in on any communication.
+This is being done by hackers, curious administrators, employers,
+criminals, industrial spies, and governments.  Some networks leak off
+enough electromagnetic radiation that data may be captured even from a
+distance.
+
+
+<p>
+When you log in, your password goes in the network in plain
+text.  Thus, any listener can then use your account to do any evil he
+likes.  Many incidents have been encountered worldwide where crackers
+have started programs on workstations without the owner's knowledge
+just to listen to the network and collect passwords.  Programs for
+doing this are available on the Internet, or can be built by a
+competent programmer in a few hours.
+
+
+<p>
+Businesses have trade secrets, patent applications in preparation,
+pricing information, subcontractor information, client data, personnel
+data, financial information, etc.  Currently, anyone with access to
+the network (any machine on the network) can listen to anything that
+goes in the network, without any regard to normal access restrictions.
+
+
+<p>
+Many companies are not aware that information can so easily be
+recovered from the network.  They trust that their data is safe
+since nobody is supposed to know that there is sensitive information
+in the network, or because so much other data is transferred in the
+network.  This is not a safe policy.
+
+
+<h2><a name= "1.3">1.3 - What operating systems are supported?</a></h2>
+
+<p>
+Even though OpenSSH is developed on 
+<a href="http://www.openbsd.org/">OpenBSD</a> a wide variety of 
+ports to other operating systems exist. The portable version of OpenSSH 
+is headed by <a href="mailto:djm@openbsd.org">Damien Miller</a>. 
+For a quick overview of the portable version of OpenSSH see 
+<a href="http://www.openssh.org/portable.html">OpenSSH Portable Release</a>.
+Currently, the supported operating systems are:
+
+
+<ul>
+        <li>OpenBSD
+        <li>NetBSD
+        <li>FreeBSD
+        <li>AIX 
+        <li>HP-UX 
+        <li>IRIX 
+        <li>Linux 
+        <li>NeXT 
+        <li>SCO 
+        <li>SNI/Reliant Unix 
+        <li>Solaris 
+        <li>Digital Unix/Tru64/OSF 
+        <li>Mac OS X 
+        <li>Cygwin
+</ul>
+
+<p>
+A list of vendors that include OpenSSH in their distributions 
+is located in the <a href="http://www.openssh.org/users.html">OpenSSH Users page</a>.
+
+<h2><a name= "1.4">1.4 - What about copyrights, usage and patents?</a></h2>
+<p>
+The OpenSSH developers have tried very hard to keep OpenSSH free of any 
+patent or copyright problems. To do this, some options had to be 
+stripped from OpenSSH. Namely support for patented algorithms.
+
+<p>
+OpenSSH does not support any patented transport algorithms. In SSH1 mode, 
+only 3DES and Blowfish are available options. In SSH2 mode, only 3DES, 
+Blowfish, CAST128, Arcfour and AES can be selected. 
+The patented IDEA algorithm is not supported.
+
+<p>
+OpenSSH provides support for both SSH1 and SSH2 protocols. 
+
+<p>
+Since the RSA patent has expired, there are no restrictions on the use 
+of RSA algorithm using software, including OpenBSD.
+
+<h2><a name= "1.5">1.5 - Where should I ask for help?</a></h2>
+<p>
+There are many places to turn to for help. In addition to the main
+<a href="http://www.openssh.org/index.html">OpenSSH website</a>, 
+there are many mailing lists to try. Before trying any mailing lists, 
+please search through all mailing list archives to see if your question 
+has already been answered. The OpenSSH Mailing List has been archived and 
+put in searchable form and can be found at 
+<a href="http://marc.info/?l=openssh-unix-dev&amp;r=1&amp;w=2">marc.info</a>.
+
+<p>
+For more information on subscribing to OpenSSH related mailing lists, 
+please see <a href="http://www.openssh.org/list.html">OpenSSH Mailing lists</a>.
+
+<h2><a name= "1.6">1.6 - I have found a bug. Where do I report it?</a></h2>
+<p>
+Information about submitting bug reports can be found at the OpenSSH
+<a href="http://www.openssh.org/report.html">Reporting bugs</a> page.
+<p>
+If you wish to report a security bug, please contact the private developers
+list &lt;<a href="mailto:openssh@openssh.com">openssh@openssh.com</a>&gt;.
+
+<h2><u><a name= "2.0">2.0 - General Questions</a></u></h2>
+
+<h2><a name= "2.1">2.1 - Why does ssh/scp make connections from low-numbered ports.</a></h2>
+<p>
+The OpenSSH client uses low numbered ports for rhosts and rhosts-rsa 
+authentication because the server needs to trust the username provided by 
+the client. To get around this, you can add the below example to your 
+<i>ssh_config</i> or <i>~/.ssh/config</i> file.
+
+
+<blockquote>
+<table border=0 width="800">
+        <tr>
+                <td nowrap bgcolor="#EEEEEE">
+<b>UsePrivilegedPort no</b>
+                </td>
+        </tr>
+</table>
+</blockquote>
+
+<p>
+Or you can specify this option on the command line, using the <b>-o</b> 
+option to 
+<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh&amp;sektion=1">ssh(1)</a> command.
+
+<blockquote>
+<table border=0 width="800">
+        <tr>
+                <td nowrap bgcolor="#EEEEEE">
+$ <b>ssh -o "UsePrivilegedPort no" host.com</b>
+                </td>
+        </tr>
+</table>
+</blockquote>
+
+<h2><a name= "2.2">2.2 - Why is the ssh client setuid root?</a></h2>
+
+<p>
+In conjunction with the previous question, (<a href="#2.1">2.1</a>)
+OpenSSH needs root authority to be able to bind to low-numbered ports to 
+facilitate <i>rhosts authentication</i>.
+A privileged port is also required for rhosts-rsa authentication to older
+SSH releases.
+
+<p>
+Additionally, for both <i>rhosts-rsa authentication</i> (in protocol 
+version 1) and <i>hostbased authentication</i> (in protocol version 2) 
+the ssh client needs to access the <i>private host key</i> in order to 
+authenticate the client machine to the server.
+OpenSSH versions prior to 3.3 required the <code>ssh</code> binary to be
+setuid root to enable this, and you may safely remove it if you don't
+want to use these authentication methods.
+
+<p>
+Starting in OpenSSH 3.3, <code>ssh</code> is not setuid by default.  <a
+href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh-keysign">ssh-keysign</a>,
+is used for access to the private hosts keys, and ssh does not use privileged
+source ports by default.  If you wish to use a privileged source port, you must
+manually set the setuid bit on <code>ssh</code>.
+
+<h2><a name= "2.3">2.3 - Why does SSH 2.3 have problems interoperating with OpenSSH 2.1.1?</a></h2>
+
+<p>
+SSH 2.3 and earlier versions contain a flaw in their HMAC implementation. 
+Their code was not supplying the full data block output from the digest, 
+and instead always provided 128 bits. For longer digests, this caused 
+SSH 2.3 to not interoperate with OpenSSH.
+
+<p>
+OpenSSH 2.2.0 detects that SSH 2.3 has this flaw. Recent versions of SSH 
+will have this bug fixed. Or you can add the following to 
+SSH 2.3 <i>sshd2_config</i>.
+
+
+<blockquote>
+<table border=0 width="800">
+        <tr>
+                <td nowrap bgcolor="#EEEEEE">
+<b>Mac hmac-md5</b>
+               </td>
+        </tr>
+</table>
+</blockquote>
+
+<h2><a name= "2.4">2.4 - Why does OpenSSH print: Dispatch protocol error: type 20</a></h2>
+
+<p>
+Problems in interoperation have been seen because older versions of 
+OpenSSH did not support session rekeying. However the commercial SSH 2.3 
+tries to negotiate this feature, and you might experience connection 
+freezes or see the error message &quot;<b>Dispatch protocol error: 
+type 20 </b>&quot;. 
+To solve this problem, either upgrade to a recent OpenSSH release or 
+disable rekeying by adding the following to your commercial SSH 2.3's
+<i>ssh2_config</i> or <i>sshd2_config</i>.
+
+
+<blockquote>
+<table border=0 width="800">
+        <tr>
+                <td nowrap bgcolor="#EEEEEE">
+<b>RekeyIntervalSeconds 0</b>
+                </td>
+        </tr>
+</table>
+</blockquote>
+
+<h2><a name= "2.5">2.5 - Old versions of commercial SSH encrypt host keys with IDEA.</a></h2>
+
+<p>
+The old versions of SSH used a patented algorithm to encrypt their 
+<i>/etc/ssh/ssh_host_key</i>. This problem will manifest as 
+<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sshd&amp;sektion=8">sshd(8)</a> 
+not being able to read its host key. To solve this, use the command below 
+to convert your ssh_host_key to use 3DES. 
+<b>NOTE:</b> Use the 
+<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh-keygen&amp;sektion=1">ssh-keygen(1)</a> 
+program from the Commercial SSH product, *NOT* OpenSSH for the example 
+below.
+
+
+<blockquote>
+<table border=0 width="800">
+        <tr>
+                <td nowrap bgcolor="#EEEEEE">
+# <b>ssh-keygen -u -f /etc/ssh/ssh_host_key</b>
+                </td>
+        </tr>
+</table>
+</blockquote>
+
+<h2><a name= "2.6">2.6 - What are these warning messages about key lengths</a></h2>
+
+<p>
+Commercial SSH's 
+<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh-keygen&amp;sektion=1">ssh-keygen(1)</a> 
+program contained a bug which caused it to occasionally generate Pubkey 
+Authentication (RSA or DSA) keys which had their Most Significant Bit 
+(MSB) unset. Such keys were advertised as being full-length, but are 
+actually, half the time, smaller than advertised.
+
+<p>
+OpenSSH will print warning messages when it encounters such keys. To rid 
+yourself of these message, edit your <i>known_hosts</i> files and replace the 
+incorrect key length (usually "1024") with the correct key length 
+(usually "1023").
+
+<h2><a name= "2.7">2.7 - X11 and/or agent forwarding does not work.</a></h2>
+
+<p>
+Check your <i>ssh_config</i> and <i>sshd_config</i>. The default 
+configuration files disable authentication agent and X11 forwarding. To 
+enable it, put the line below in <i>sshd_config</i>:
+
+<blockquote>
+<table border=0 width="800">
+        <tr>
+                <td nowrap bgcolor="#EEEEEE">
+<b>X11Forwarding yes</b>
+                </td>
+        </tr>
+</table>
+</blockquote>
+
+<p>
+and put the following lines in <i>ssh_config</i>:
+
+<blockquote>
+<table border=0 width="800">
+        <tr>
+                <td nowrap bgcolor="#EEEEEE">
+<b>ForwardAgent yes</b><br>
+<b>ForwardX11 yes</b>
+                </td>
+        </tr>
+</table>
+</blockquote>
+
+<p>
+X11 forwarding requires a working <a
+href="http://www.openbsd.org/cgi-bin/man.cgi?query=xauth&amp;sektion=1"
+>xauth(1)</a> binary.  On OpenBSD this is in the <i>xbase</i> file
+set but will probably be different on other platforms.  For OpenSSH
+Portable, xauth must be either found at configure time or specified
+via <b>XAuthLocation</b> in sshd_config(5) and ssh_config(5).
+
+<p>
+Note on agent interoperability: There are two different and
+incompatible agent forwarding mechanisms within the SSH2 protocol.
+OpenSSH has always used an extension of the original SSH1 agent
+requests, however some commercial products use a different, non-free
+agent forwarding protocol.  This means that agent forwarding cannot
+be used between OpenSSH and those products.
+
+<p>
+<b>NOTE:</b> For users of Linux Mandrake 7.2, Mandrake modifies the 
+<i>XAUTHORITY</i> environment variable in <i>/etc/skel/.bashrc</i>, 
+and thus any bash user's home directory. This variable is set by OpenSSH 
+and for either of the above options to work, you need to comment out 
+the line:
+
+
+<blockquote>
+<table border=0 width="800">
+        <tr>
+                <td nowrap bgcolor="#EEEEEE">
+<b># export XAUTHORITY=$HOME/.Xauthority</b>
+                </td>
+        </tr>
+</table>
+</blockquote>
+
+<h2><a name= "2.8">2.8 - After upgrading OpenSSH I lost SSH2 support.</a></h2>
+
+<p>
+Between versions changes can be made to <i>sshd_config</i> or 
+<i>ssh_config</i>. You should always check on these changes when upgrading 
+versions of OpenSSH. After OpenSSH Version 2.3.0 you need to add the 
+following to your <i>sshd_config</i>:
+
+
+<blockquote>
+<table border=0 width="800">
+        <tr>
+                <td nowrap bgcolor="#EEEEEE">
+<b>HostKey /etc/ssh_host_dsa_key</b><br>
+<b>HostKey /etc/ssh_host_rsa_key</b>
+                </td>
+        </tr>
+</table>
+</blockquote>
+
+<h2><a name= "2.9">2.9 - sftp/scp fails at connection, but ssh is OK.</a></h2>
+
+<p>
+sftp and/or scp may fail at connection time if you have shell 
+initialization (.profile, .bashrc, .cshrc, etc) which produces output 
+for non-interactive sessions. This output confuses the sftp/scp client.  
+You can verify if your shell is doing this by executing:
+
+<blockquote>
+<table border=0 width="800">
+        <tr>
+                <td nowrap bgcolor="#EEEEEE">
+<b>ssh yourhost /usr/bin/true</b>
+                </td>
+        </tr>
+</table>
+</blockquote>
+
+<p>
+If the above command produces any output, then you need to modify your 
+shell initialization.
+
+<h2><a name= "2.10">2.10 - Will you add [foo] to scp?</a></h2>
+
+<p>
+Short Answer: no.
+
+<p>
+Long Answer: scp is not standardized. The closest thing it has to a
+specification is "what rcp does".  Since the same command is used on both ends
+of the connection, adding features or options risks breaking interoperability with other
+implementations.
+
+<p>
+New features are more likely in sftp, since the protocol is standardized
+(well, a <a href="http://www.ietf.org/html.charters/OLD/secsh-charter.html">
+draft standard</a>), extensible, and the client and server are decoupled.
+
+<h2><a name= "2.11">2.11 - How do I use port forwarding?</a></h2>
+
+<p>
+If the remote server is running sshd(8), it may be possible to
+``tunnel'' certain services via ssh.  This may be desirable, for
+example, to encrypt POP or SMTP connections, even though the software
+does not directly support encrypted communications.  Tunnelling uses
+port forwarding to create a connection between the client and server.
+The client software must be able to specify a non-standard port to
+connect to for this to work.
+
+<p>
+The idea is that the user connects to the remote host using ssh,
+and specifies which port on the client's machine should be used to
+forward connections to the remote server.  After that it is possible
+to start the service which is to be encrypted (e.g. fetchmail, irc)
+on the client machine, specifying the same local port passed to
+ssh, and the connection will be tunnelled through ssh.  By default,
+the system running the forward will only accept connections from
+itself.
+
+<p>
+The options most relevant to tunnelling are the -L and -R options,
+which allow the user to forward connections, the -D option, which
+permits dynamic port forwarding, the -g option, which permits other
+hosts to use port forwards, and the -f option, which instructs ssh
+to put itself in the background after authentication.  See the <a
+href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh&amp;sektion=1"
+>ssh(1)</a> man page for further details.
+
+<p>
+This is an example of tunnelling an IRC session from client machine
+``127.0.0.1'' (localhost) to remote server ``server.example.com'':
+
+<blockquote>
+<table border=0 width="800">
+        <tr>
+                <td nowrap bgcolor="#EEEEEE">
+<b>ssh -f -L 1234:server.example.com:6667 server.example.com sleep 10<br>
+irc -c '#users' -p 1234 pinky 127.0.0.1</b>
+        </td>
+        </tr>
+</table>
+</blockquote>
+
+<p>
+This tunnels a connection to IRC server server.example.com, joining
+channel ``#users'', using the nickname ``pinky''.  The local port used
+in this example is 1234.  It does not matter which port is used, as
+long as it's greater than 1023 (remember, only root can open sockets on
+privileged ports) and doesn't conflict with any ports already in use.
+The connection is forwarded to port 6667 on the remote server, since
+that's the standard port for IRC services.
+
+<p>
+The remote command ``sleep 10'' was specified to allow an amount
+of time (10 seconds, in the example) to start the service which is to
+be tunnelled.  If no connections are made within the time specified,
+ssh will exit.  If more time is required, the sleep(1) value can be
+increased appropriately or, alternatively, the example above could
+be added as a function to the user's shell.  See ksh(1) and csh(1)
+for more details about user-defined functions.
+
+<p>
+ssh also has an -N option, convenient for use with port forwarding:
+if -N is specified, it is not necessary to specify a remote command
+(``sleep 10'' in the example above).  However, use of this option
+causes ssh to wait around for ever (as opposed to exiting after a
+remote command has completed), and the user must take care to manually
+kill(1) the process afterwards.
+
+<h2><a name= "2.12">2.12 - My ssh connection freezes or drops out after N minutes of inactivity.</a></h2>
+
+<p>
+This is usually the result of a packet filter or NAT device
+timing out your TCP connection due to inactivity.  You can enable
+<b>ClientAliveInterval</b> in the server's <i><a
+href="http://www.openbsd.org/cgi-bin/man.cgi?query=sshd_config&amp;sektion=5">
+sshd_config</a></i>, or enable <b>ServerAliveInterval</b> in the
+client's <i><a
+href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh_config&amp;sektion=5">
+ssh_config</a></i> (the latter is available in OpenSSH 3.8 and newer).
+
+<p>
+Enabling either option and setting the interval for less than the time
+it takes to time out your session will ensure that the connection is
+kept "fresh" in the device's connection table.
+
+<h2><a name= "2.13">2.13 - How do I use scp to copy a file with a colon in it?</a></h2>
+
+<b><a
+href="http://www.openbsd.org/cgi-bin/man.cgi?query=scp&amp;sektion=1">
+scp</a></b> will interpret the component before the colon to be a remote
+server name and attempt to connect to it.  To prevent this, refer to
+the file by a relative or absolute path, eg:
+
+<blockquote>
+<table border=0 width="800">
+        <tr>
+                <td nowrap bgcolor="#EEEEEE">
+$ scp ./source:file sshserver:
+                </td>
+        </tr>
+</table>
+</blockquote>
+
+<h2><a name= "2.14">2.14 - Why does OpenSSH report its version to clients?</a></h2>
+
+<p>
+OpenSSH, like most SSH implementations, reports its name and version to clients
+when they connect, e.g.
+</p>
+
+<blockquote>
+SSH-2.0-OpenSSH_3.9
+</blockquote>
+
+<p>
+This information is used by clients and servers to enable protocol 
+compatibility tweaks to work around changed, buggy or missing features in 
+the implementation they are talking to. This protocol feature checking is 
+still required at present because versions with incompatibilities are still
+in wide use.
+</p>
+
+<h2><u><a name= "3.0">3.0 - Portable OpenSSH Questions</a></u></h2>
+
+<h2><a name= "3.1">3.1 - Spurious PAM authentication messages in logfiles.</a></h2>
+
+<p>
+The portable version of OpenSSH will generate spurious authentication 
+failures at every login, similar to:
+
+
+<blockquote>
+<table border=0 width="800">
+        <tr>
+                <td nowrap bgcolor="#EEEEEE">
+&quot;<b>authentication failure; (uid=0) -&gt; root for sshd service</b>&quot;
+                </td>
+        </tr>
+</table>
+</blockquote>
+
+<p>
+These are generated because OpenSSH first tries to determine whether a 
+user needs authentication to login (e.g. empty password). Unfortunately 
+PAM likes to log all authentication events, this one included.
+
+<p>
+If it annoys you too much, set &quot;<b>PermitEmptyPasswords no</b>&quot; 
+in <i>sshd_config</i>. This will quiet the error message at the expense 
+of disabling logins to accounts with no password set. 
+This is the default if you use the supplied <i>sshd_config</i> file.
+
+<h2><a name= "3.2">3.2 - Empty passwords not allowed with PAM authentication.</a></h2>
+
+<p>
+To enable empty passwords with a version of OpenSSH built with PAM you 
+must add the flag nullok to the end of the password checking module 
+in the <i>/etc/pam.d/sshd</i> file. For example:
+
+<blockquote>
+<table border=0 width="800">
+        <tr>
+                <td nowrap bgcolor="#EEEEEE">
+auth required/lib/security/pam_unix.so shadow nodelay nullok
+                </td>
+        </tr>
+</table>
+</blockquote>
+
+<p>
+This must be done in addition to setting &quot;<b>PermitEmptyPasswords 
+yes</b>&quot; in the <i>sshd_config</i> file. 
+
+<p>
+There is one caveat when using empty passwords with PAM authentication: 
+PAM will allow any password when authenticating an account with an empty 
+password. This breaks the check that 
+<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sshd&amp;sektion=8">sshd(8)</a> 
+uses to determine whether an account has no password set and grant 
+users access to the account regardless of the policy specified by 
+<b>PermitEmptyPasswords</b>. For this reason, it is recommended that you 
+do not add the <b>nullok</b> directive to your PAM configuration file 
+unless you specifically wish to allow empty passwords.
+
+
+<h2><a name= "3.3">3.3 - ssh(1) takes a long time to connect or log
+in</a></h2>
+
+<p>
+Large delays (more that 10 seconds) are typically caused a problem with
+name resolution:
+<ul>
+<li>Some versions of glibc (notably glibc 2.1 shipped with Red Hat 6.1)
+can take a long time to resolve "IPv6 or IPv4" addresses from domain
+names. This can be worked around with by specifying <b>AddressFamily
+inet</b> option in <i>ssh_config</i>.</li>
+
+<li>There may be a DNS lookup problem, either at the client or server.
+You can use the <code>nslookup</code> command to check this on both client
+and server by looking up the other end's name and IP address.  In
+addition, on the server look up the name returned by the client's
+IP-name lookup.  You can disable most of the server-side lookups by
+setting <b>UseDNS no</b> in <i>sshd_config</i>.</li>
+</ul>
+
+<p>
+Delays less than 10 seconds can have other causes.
+
+<ul>
+
+<li>OpenSSH releases prior to 3.8 had an <i>moduli</i> file with
+moduli that were just smaller than what sshd would look for, and
+as a result, sshd would end up using moduli significantly larger
+than requested, which resulted in a speed penalty.  Replacing the
+<i>moduli</i> file will resolve this (note that in most cases this
+file will not be replaced during an upgrade and must be replaced
+manually).</li>
+
+<li>OpenSSH releases prior to 3.8 had a flaw in <code>ssh</code> that
+would cause it to request moduli larger than intended (which when
+combined with the above resulted in significant slowdowns).
+Upgrading the client to 3.8 or higher will resolve this issue.</li>
+
+<li>If either the client or server lack a kernel-based random number
+device (eg Solaris &lt; 9, AIX &lt; 5.2, HP-UX &lt; 11.11) and no
+substitute is available (eg <a href=
+"ftp://ftp.ayamura.org/pub/prngd/">prngd</a>) it's possible that
+one of the programs called by <code>ssh-rand-helper</code> to
+generate entropy is hanging.  This can be investigated by running
+it in debug mode:
+
+<blockquote>
+<table border=0 width="800">
+        <tr>
+                <td nowrap bgcolor="#EEEEEE">
+/usr/local/libexec/ssh-rand-helper -vvv
+                </td>
+        </tr>
+</table>
+</blockquote>
+
+Any significant delays should be investigated and rectified, or the
+corresponding commands should be removed from <i>ssh_prng_cmds</i>.
+</li>
+
+</ul>
+
+<h3>How slow is "slow"?</h3>
+Under normal conditions, the speed of SSH logins is dependant on
+CPU speed of client and server.  For comparison the following are
+typical connect times for <code>time ssh localhost true</code>
+with a 1024-bit RSA key on otherwise unloaded hosts.  OpenSSH and
+OpenSSL were compiled with gcc 3.3.x.
+
+<p>
+<table>
+<tr><th>CPU</th><th>Time (SSHv1)<a href="#3.3fn1">[1]</a></th>
+        <th>Time (SSHv2)</th></tr>
+<tr><td>170MHz SPARC/sun4m</td><td>0.74 sec</td><td>1.25 sec</td></tr>
+<tr><td>236MHz HPPA/8200<a href="#3.3fn2">[2]</a></td><td>0.44 sec</td>
+        <td>0.79 sec</td></tr>
+<tr><td>375MHz PowerPC/604e</td><td>0.38 sec</td><td>0.51 sec</td></tr>
+<tr><td>933MHz VIA Ezra</td><td>0.34 sec</td><td>0.44 sec</td></tr>
+<tr><td>2.1GHz Athlon XP 2600+</td><td>0.14 sec</td><td>0.22 sec</td></tr>
+</table>
+
+<br>
+
+<a name="3.3fn1">[1]</a> The SSHv1 protocol is faster but is
+cryptographically weaker than SSHv2.<br>
+
+<a name="3.3fn2">[2]</a> At the time of writing, gcc generates
+relatively slow code on HPPA for RSA and Diffie-Hellman operations
+(see <a href= "http://gcc.gnu.org/bugzilla/show_bug.cgi?id=7625">gcc
+bug #7625</a> and <a
+href="http://marc.info/?l=openssh-unix-dev&amp;m=102646106016694">
+discussion on openssh-unix-dev</a>).
+
+<h2><a name= "3.4">3.4 - "Can't locate module net-pf-10" messages in log under Linux.</a></h2>
+
+<p>
+The Linux kernel is looking (via modprobe) for protocol family 10 (IPv6). 
+Either load the appropriate kernel module, enter the correct alias in 
+<i>/etc/modules.conf</i> or disable IPv6 in <i>/etc/modules.conf</i>.
+
+
+<p>
+For some silly reason <i>/etc/modules.conf</i> may also be named 
+<i>/etc/conf.modules</i>.
+
+
+<h2><a name= "3.5">3.5 - Password authentication doesn't work (eg on Slackware 7.0 or Red Hat 6.x)</a></h2>
+
+<p>
+If the password is correct password the login is still denied, the
+usual cause is that the system is configured to use MD5-type passwords
+but the
+<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=crypt&amp;sektion=3"
+>crypt(3)</a> function used by sshd doesn't understand them.
+
+<p>
+Affected accounts will have password strings in <i>/etc/passwd</i>
+or <i>/etc/shadow</i> that start with <b>$1$</b>.
+If password authentication fails for new accounts or accounts with
+recently changed passwords, but works for old accounts, this is the
+likely culprit.
+
+<p>
+The underlying cause is that some versions of OpenSSL have a crypt(3)
+function that does not understand MD5 passwords, and the link order of
+sshd means that OpenSSL's crypt(3) is used instead of the system's.
+OpensSSH's configure attempts to correct for this but is not always
+successful.
+
+<p>
+There are several possible solutions:
+
+<ul>
+<li>
+<p>
+Enable sshd's built-in support for MD5 passwords at build time.
+
+<blockquote>
+<table border=0 width="800">
+        <tr>
+                <td nowrap bgcolor="#EEEEEE">
+./configure --with-md5-passwords [options]
+                </td>
+        </tr>
+</table>
+</blockquote>
+
+This is safe even if you have both types of encryption as sshd will
+select the correct algorithm for each account automatically.
+
+<li>
+<p>
+If your system has a separate libcrypt library (eg Slackware 7) then you
+can manually add -lcrypt to the LIBS list so it's used instead of
+OpenSSL's:
+
+<blockquote>
+<table border=0 width="800">
+        <tr>
+                <td nowrap bgcolor="#EEEEEE">
+LIBS=-lcrypt ./configure [options]
+                </td>
+        </tr>
+</table>
+</blockquote>
+
+<li>
+<p>
+If your platforms supports PAM, you may configure sshd to use it
+(see <a href= "#3.15" >section 3.15</a>).  This will mean that sshd will
+not verify passwords itself but will defer to the configured PAM modules.
+</ul>
+
+<h2><a name= "3.6">3.6 - Configure or sshd(8) complain about lack of RSA or DSA support</a></h2>
+
+<p>
+Ensure that your OpenSSL libraries have been built to include RSA or DSA 
+support either internally or through RSAref.
+
+
+<h2><a name= "3.7">3.7 - "scp: command not found" errors</a></h2>
+
+<p>
+<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=scp&amp;sektion=1">scp(1)</a> 
+must be in the default PATH on both the client and the server. You may 
+need to use the <b>--with-default-path</b> option to specify a custom 
+path to search on the server. This option replaces the default path, 
+so you need to specify all the current directories on your path as well 
+as where you have installed scp. For example:
+
+<blockquote>
+<table border=0 width="800">
+        <tr>
+                <td nowrap bgcolor="#EEEEEE">
+$ <b>./configure --with-default-path=/bin:/usr/bin:/usr/local/bin:/path/to/scp</b>
+                </td>
+        </tr>
+</table>
+</blockquote>
+
+<p>
+Note that configuration by the server's admin will take precedence over the
+setting of <b>--with-default-path</b>.  This includes resetting PATH in
+<i>/etc/profile</i>, PATH in <i>/etc/environment</i> on AIX, or (for 3.7p1 and
+above) setting PATH or SUPATH in <i>/etc/default/login</i> on Solaris or
+Reliant Unix.
+
+<h2><a name= "3.8">3.8 - Unable to read passphrase</a></h2>
+
+<p>
+Some operating systems set <i>/dev/tty</i> with incorrect modes, causing 
+the reading of passwords to fail with the following error:
+
+<blockquote>
+<table border=0 width="800">
+        <tr>
+                <td nowrap bgcolor="#EEEEEE">
+You have no controlling tty.  Cannot read passphrase.
+                </td>
+        </tr>
+</table>
+</blockquote>
+
+<p>
+The solution to this is to reset the permissions on <i>/dev/tty</i> 
+to mode 0666 and report the error as a bug to your OS vendor. 
+
+
+<h2><a name= "3.9">3.9 - 'configure' missing or make fails</a></h2>
+
+<p>
+If there is no 'configure' file in the tar.gz file that you downloaded 
+or make fails with "missing separator" errors, you have probably 
+downloaded the OpenBSD distribution of OpenSSH and are attempting to 
+compile it on another platform. Please refer to the information on the 
+<a href="http://www.openssh.org/portable.html">portable version</a>.
+
+
+<h2><a name= "3.10">3.10 - Hangs when exiting ssh</a></h2>
+
+<p>
+OpenSSH may hang when exiting.  This can occur when there is an active 
+background process.  This is known to occur on Linux and HP-UX.  
+The problem can be verified by doing the following:
+
+<blockquote>
+<table border=0 width="800">
+        <tr>
+                <td nowrap bgcolor="#EEEEEE">
+$ <b>sleep 20 &amp; exit</b>
+                </td>
+        </tr>
+</table>
+</blockquote>
+
+Try to use this instead:
+<blockquote>
+<table border=0 width="800">
+        <tr>
+                <td nowrap bgcolor="#EEEEEE">
+$ <b>sleep 20 &lt; /dev/null &gt; /dev/null 2&gt;&amp;1 &amp;</b>
+                </td>
+        </tr>
+</table>
+</blockquote>
+
+<p>
+A work around for bash users is to place <b>"shopt -s huponexit"</b> 
+in either /etc/bashrc  or ~/.bashrc.  Otherwise, consult your shell's 
+man page for an option to enable it to send a HUP signal to active 
+jobs when exiting.  See <a
+href="http://bugzilla.mindrot.org/show_bug.cgi?id=52">bug #52</a>
+for other workarounds.
+
+<h2><a name= "3.11">3.11 - Why does ssh hang on exit?</a></h2>
+
+<p>
+When executing
+<blockquote>
+<table border=0 width="800">
+        <tr>
+                <td nowrap bgcolor="#EEEEEE">
+$ <b>ssh host command</b>
+                </td>
+        </tr>
+</table>
+</blockquote>
+ssh <b>needs</b> to hang, because it needs to wait:
+<ul>
+<li>
+until it can be sure that <code>command</code> does not need
+more input.
+<li>
+until it can be sure that <code>command</code> does not produce
+more output. 
+<li>
+until <code>command</code> exits because sshd needs to tell
+the exit status from <code>command</code> to ssh.
+</ul>
+<p>
+
+<h2><a name= "3.12">3.12 - I upgraded to OpenSSH 3.1 and X11
+forwarding stopped working.</a></h2>
+
+Starting with OpenSSH 3.1, the sshd x11 forwarding server listens on
+localhost by default; see the sshd <b>X11UseLocalhost</b> option to
+revert to prior behaviour if your older X11 clients do not function
+with this configuration.<p>
+
+In general, X11 clients using X11 R6 should work with the default
+setting.  Some vendors, including HP, ship X11 clients with R6
+and R5 libs, so some clients will work, and others will not work.
+This is true for HP-UX 11.X.<p>
+
+<h2><a name= "3.13">3.13 - I upgraded to OpenSSH 3.8 and some
+X11 programs stopped working.</a></h2>
+
+<p>
+As documented in the <a href="http://www.openssh.org/txt/release-3.8">3.8 release notes</a>,
+<code>ssh</code> will now use untrusted X11 cookies by 
+default.  The previous behaviour can be restored by setting
+<b>ForwardX11Trusted yes</b> in <i>ssh_config</i>.
+
+<p>
+Possible symptoms include:<br>
+<code>BadWindow (invalid Window parameter)<br>
+BadAccess (attempt to access private resource denied)<br>
+X Error of failed request:  BadAtom (invalid Atom parameter)<br>
+Major opcode of failed request:  20 (X_GetProperty)<br></code>
+
+<h2><a name= "3.14">3.14 - I copied my public key to authorized_keys
+but public-key authentication still doesn't work.</a></h2>
+
+<p>
+Typically this is caused by the file permissions on $HOME, $HOME/.ssh or
+$HOME/.ssh/authorized_keys being more permissive than sshd allows by default.
+
+<p>
+In this case, it can be solved by executing the following on the server.
+<blockquote>
+<table border=0 width="800">
+<tr>
+  <td nowrap bgcolor="#EEEEEE">
+$ <b>chmod go-w $HOME $HOME/.ssh</b><br>
+$ <b>chmod 600 $HOME/.ssh/authorized_keys</b>
+$ <b>chown `whoami` $HOME/.ssh/authorized_keys</b><br>
+  </td>
+</tr>
+</table>
+</blockquote>
+
+<p>
+If this is not possible for some reason, an alternative is to set
+<b>StrictModes no</b> in <i>sshd_config</i>, however this is not
+recommended.
+
+<h2><a name= "3.15">3.15 - OpenSSH versions and PAM behaviour.</a></h2>
+
+Portable OpenSSH has a configure-time option to enable sshd's use of the
+<a href="http://www.opengroup.org/onlinepubs/008329799/">PAM</a>
+(Pluggable Authentication Modules) interface.
+
+<blockquote>
+<table border=0 width="800">
+        <tr>
+                <td nowrap bgcolor="#EEEEEE">
+./configure --with-pam [options]
+                </td>
+        </tr>
+</table>
+</blockquote>
+
+To use PAM at all, this option must be provided at build time.
+The run-time behaviour when PAM is built in varies with the version of
+Portable OpenSSH, and on later versions it must also be enabled by setting
+<b>UsePAM</b> to <b>yes</b> in <i>sshd_config</i>.
+
+<p>
+The behaviour of the relevant authentications options when PAM support is built
+in is summarised by the following table.
+
+<p>
+<table border="1">
+  <tr> <th>Version</th> <th>UsePAM</th> <th>PasswordAuthentication</th> <th>ChallengeResponseAuthentication</th> </tr>
+  <tr>
+    <td>&lt;=3.6.1p2</td>
+    <td>Not applicable</td>
+    <td>Uses PAM</td>
+    <td>Uses PAM if <b>PAMAuthenticationViaKbdInt</b> is enabled</td>
+  </tr>
+  <tr>
+    <td>3.7p1 - 3.7.1p1</td>
+    <td>Defaults to <b>yes</b></td>
+    <td>Does not use PAM</td>
+    <td>Uses PAM if <b>UsePAM</b> is enabled</td>
+  </tr>
+  <tr>
+    <td>3.7.1p2 - 3.8.1p1</td>
+    <td>Defaults to <b>no</b></td>
+    <td>Does not use PAM <a href="#3.15fn1">[1]</a></td>
+    <td>Uses PAM if <b>UsePAM</b> is enabled</td>
+  </tr>
+  <tr>
+    <td>3.9p1</td>
+    <td>Defaults to <b>no</b></td>
+    <td>Uses PAM if <b>UsePAM</b> is enabled</td>
+    <td>Uses PAM if <b>UsePAM</b> is enabled</td>
+  </tr>
+</table>
+<p>
+
+<a name= "3.15fn1">[1]</a> Some vendors, notably Redhat/Fedora, have
+backported the PasswordAuthentication from 3.9p1 to their 3.8x based
+packages.  If you're using a vendor-supplied package then consult their
+documentation.
+
+<p>
+OpenSSH Portable's PAM interface still has problems with a few modules,
+however we hope that this number will reduce in the future.  As at the
+3.9p1 release, the known problems are:
+
+<ul>
+  <li>Modules relying on module-private data (eg pam_dhkeys, pam_krb5, AFS)
+  may fail to correctly establish credentials (bug <a
+  href="http://bugzilla.mindrot.org/show_bug.cgi?id=688">#688</a>) when
+  authenticating via <b>ChallengeResponseAuthentication</b>.
+  <b>PasswordAuthentication</b> with 3.9p1 and above should work.
+</ul>
+
+You can also check <a
+href="http://bugzilla.mindrot.org/buglist.cgi?product=Portable+OpenSSH&amp;bug_status=RESOLVED&amp;bug_status=NEW&amp;bug_status=ACCEPTED&amp;component=PAM+support"
+>bugzilla for current PAM issues</a>.
+
+<h2><a name= "3.16">3.16 - Why doesn't "w" or "who" on AIX 5.x show users
+logged in via ssh?</a></h2>
+
+Between AIX 4.3.3 and AIX 5.x, the format of the wtmp struct changed.  This
+means that sshd binaries built on AIX 4.x will not correctly write wtmp
+entries when run on AIX 5.x.  This can be fixed by simply recompiling 
+sshd on an AIX 5.x system and using that.
+
+<hr>
+<a href="http://www.openssh.org/index.html"><img height=24 width=24 src="back.gif" border=0 alt=OpenSSH></a>
+<a href="mailto:www@openbsd.org">www@openbsd.org</a>
+<br>
+<small>$OpenBSD: faq.html,v 1.110 2009/11/23 23:38:17 dtucker Exp $</small>
+
+</body>
+</html>
diff --git a/debian/gnome-ssh-askpass.1 b/debian/gnome-ssh-askpass.1
new file mode 100644
index 000000000..b74c410a8
--- /dev/null
+++ b/debian/gnome-ssh-askpass.1
@@ -0,0 +1,51 @@
+.TH GNOME-SSH-ASKPASS 1
+.SH NAME
+gnome\-ssh\-askpass \- prompts a user for a passphrase using GNOME
+.SH SYNOPSIS
+.B gnome\-ssh\-askpass
+.SH DESCRIPTION
+.B gnome\-ssh\-askpass
+is a GNOME-based passphrase dialog for use with OpenSSH.
+It is intended to be called by the
+.BR ssh\-add (1)
+program and not invoked directly.
+It allows
+.BR ssh\-add (1)
+to obtain a passphrase from a user, even if not connected to a terminal
+(assuming that an X display is available).
+This happens automatically in the case where
+.B ssh\-add
+is invoked from one's
+.B ~/.xsession
+or as one of the GNOME startup programs, for example.
+.PP
+In order to be called automatically by
+.BR ssh\-add ,
+.B gnome\-ssh\-askpass
+should be installed as
+.IR /usr/bin/ssh\-askpass .
+.SH "ENVIRONMENT VARIABLES"
+The following environment variables are recognized:
+.TP
+.I GNOME_SSH_ASKPASS_GRAB_SERVER
+Causes
+.B gnome\-ssh\-askpass
+to grab the X server before asking for a passphrase.
+.TP
+.I GNOME_SSH_ASKPASS_GRAB_POINTER
+Causes
+.B gnome\-ssh\-askpass
+to grab the mouse pointer using
+.IR gdk_pointer_grab ()
+before asking for a passphrase.
+.PP
+Regardless of whether either of these environment variables is set,
+.B gnome\-ssh\-askpass
+will grab the keyboard using
+.IR gdk_keyboard_grab ().
+.SH AUTHOR
+This manual page was written by Colin Watson <cjwatson@debian.org>
+for the Debian system (but may be used by others).
+It was based on that for
+.B x11\-ssh\-askpass
+by Philip Hands.
diff --git a/debian/openssh-client-udeb.dirs b/debian/openssh-client-udeb.dirs
new file mode 100644
index 000000000..e77248175
--- /dev/null
+++ b/debian/openssh-client-udeb.dirs
@@ -0,0 +1 @@
+usr/bin
diff --git a/debian/openssh-client-udeb.install b/debian/openssh-client-udeb.install
new file mode 100644
index 000000000..b3891f02d
--- /dev/null
+++ b/debian/openssh-client-udeb.install
@@ -0,0 +1,3 @@
+scp usr/bin
+sftp usr/bin
+ssh usr/bin
diff --git a/debian/openssh-client.config b/debian/openssh-client.config
new file mode 100644
index 000000000..736e464ed
--- /dev/null
+++ b/debian/openssh-client.config
@@ -0,0 +1,26 @@
+#!/bin/sh
+
+action=$1
+version=$2
+
+# Source debconf library.
+. /usr/share/debconf/confmodule
+db_version 2.0
+
+if [ -d /etc/ssh-nonfree ] && [ ! -d /etc/ssh ]; then
+  version=1.2.27
+  cp -a /etc/ssh-nonfree /etc/ssh
+fi
+
+# Was ssh-keysign's setuid bit turned off using the obsolete debconf
+# question? If so, turn this into a statoverride. (Ugh.)
+if dpkg --compare-versions "$2" lt 1:4.1p1-2 && \
+    db_get ssh/SUID_client && [ "$RET" = false ] &&
+    [ -x /usr/sbin/dpkg-statoverride ] && \
+    ! dpkg-statoverride --list /usr/lib/ssh-keysign && \
+    ! dpkg-statoverride --list /usr/lib/openssh/ssh-keysign; then
+        dpkg-statoverride --update --add root root 0755 \
+                /usr/lib/openssh/ssh-keysign
+fi
+
+exit 0
diff --git a/debian/openssh-client.dirs b/debian/openssh-client.dirs
new file mode 100644
index 000000000..1da8fba83
--- /dev/null
+++ b/debian/openssh-client.dirs
@@ -0,0 +1 @@
+usr/share/lintian/overrides
diff --git a/debian/openssh-client.docs b/debian/openssh-client.docs
new file mode 100644
index 000000000..00fd691c4
--- /dev/null
+++ b/debian/openssh-client.docs
@@ -0,0 +1,7 @@
+ChangeLog.gssapi
+OVERVIEW
+README
+README.dns
+README.tun
+debian/faq.html
+debian/README.compromised-keys
diff --git a/debian/openssh-client.install b/debian/openssh-client.install
new file mode 100644
index 000000000..fd9e8feab
--- /dev/null
+++ b/debian/openssh-client.install
@@ -0,0 +1,29 @@
+etc/ssh/moduli
+etc/ssh/ssh_config
+usr/bin/scp
+usr/bin/sftp
+usr/bin/slogin
+usr/bin/ssh
+usr/bin/ssh-add
+usr/bin/ssh-agent
+usr/bin/ssh-keygen
+usr/bin/ssh-keyscan
+usr/bin/ssh-vulnkey
+usr/lib/openssh/ssh-keysign
+usr/lib/openssh/ssh-pkcs11-helper
+usr/share/man/man1/scp.1
+usr/share/man/man1/sftp.1
+usr/share/man/man1/slogin.1
+usr/share/man/man1/ssh-add.1
+usr/share/man/man1/ssh-agent.1
+usr/share/man/man1/ssh-keygen.1
+usr/share/man/man1/ssh-keyscan.1
+usr/share/man/man1/ssh-vulnkey.1
+usr/share/man/man1/ssh.1
+usr/share/man/man5/moduli.5
+usr/share/man/man5/ssh_config.5
+usr/share/man/man8/ssh-keysign.8
+usr/share/man/man8/ssh-pkcs11-helper.8
+
+contrib/ssh-copy-id usr/bin
+debian/ssh-argv0 usr/bin
diff --git a/debian/openssh-client.lintian-overrides b/debian/openssh-client.lintian-overrides
new file mode 100644
index 000000000..8c4bd1751
--- /dev/null
+++ b/debian/openssh-client.lintian-overrides
@@ -0,0 +1,2 @@
+openssh-client: setuid-binary usr/lib/openssh/ssh-keysign 4755 root/root
+openssh-client: no-debconf-templates
diff --git a/debian/openssh-client.manpages b/debian/openssh-client.manpages
new file mode 100644
index 000000000..690bd8a22
--- /dev/null
+++ b/debian/openssh-client.manpages
@@ -0,0 +1,2 @@
+contrib/ssh-copy-id.1
+debian/ssh-argv0.1
diff --git a/debian/openssh-client.postinst b/debian/openssh-client.postinst
new file mode 100644
index 000000000..cff282d70
--- /dev/null
+++ b/debian/openssh-client.postinst
@@ -0,0 +1,115 @@
+#!/bin/sh -e
+
+action="$1"
+oldversion="$2"
+
+. /usr/share/debconf/confmodule
+db_version 2.0
+
+umask 022
+
+if [ "$action" != configure ]
+  then
+  exit 0
+fi
+
+
+fix_rsh_diversion() {
+# get rid of mistaken rsh diversion (circa 1.2.27-1)
+
+        if [ -L /usr/bin/rsh ] &&
+                dpkg-divert --list '/usr/bin/rsh.real/rsh' | grep -q ' ssh$' ; then
+                for cmd in rlogin  rsh rcp ; do
+                        [ -L /usr/bin/$cmd ] && rm /usr/bin/$cmd
+                        dpkg-divert --package ssh --remove --rename \
+                                --divert /usr/bin/rsh.real/$cmd /usr/bin/$cmd
+
+                        [ -L /usr/man/man1/$cmd.1.gz ] && rm /usr/man/man1/$$cmd.1.gz
+                        dpkg-divert --package ssh --remove --rename \
+                                --divert /usr/man/man1/$cmd.real.1.gz /usr/man/man1/$cmd.1.gz
+                done
+
+                rmdir /usr/bin/rsh.real
+        fi
+}
+
+create_alternatives() {
+# Create alternatives for the various r* tools.
+# Make sure we don't change existing alternatives that a user might have
+# changed, but clean up after some old alternatives that mistakenly pointed
+# rlogin and rcp to ssh.
+        update-alternatives --quiet --remove rlogin /usr/bin/ssh
+        update-alternatives --quiet --remove rcp /usr/bin/ssh
+        for cmd in rsh rlogin rcp; do
+                scmd="s${cmd#r}"
+                if ! update-alternatives --display "$cmd" 2>/dev/null | \
+                                grep -q "$scmd"; then
+                        update-alternatives --quiet --install "/usr/bin/$cmd" "$cmd" "/usr/bin/$scmd" 20 \
+                                --slave "/usr/share/man/man1/$cmd.1.gz" "$cmd.1.gz" "/usr/share/man/man1/$scmd.1.gz"
+                fi
+        done
+}
+
+set_ssh_permissions() {
+        if dpkg --compare-versions "$oldversion" lt-nl 1:3.4p1-1 ; then
+            if [ -x /usr/sbin/dpkg-statoverride ] ; then
+                if dpkg-statoverride --list /usr/bin/ssh >/dev/null; then
+                    dpkg-statoverride --remove /usr/bin/ssh >/dev/null
+                fi 
+            fi
+        fi
+
+        # libexecdir changed, so migrate old statoverrides.
+        if [ -x /usr/sbin/dpkg-statoverride ] &&
+            override="$(dpkg-statoverride --list /usr/lib/ssh-keysign)"; then
+                override_user="${override%% *}"
+                override="${override#* }"
+                override_group="${override%% *}"
+                override="${override#* }"
+                override_mode="${override%% *}"
+                if dpkg-statoverride --update --add \
+                    "$override_user" "$override_group" "$override_mode" \
+                    /usr/lib/openssh/ssh-keysign; then
+                        dpkg-statoverride --remove /usr/lib/ssh-keysign || true
+                fi
+        fi
+}
+
+fix_ssh_group() {
+        # Try to remove non-system group mistakenly created by 1:3.5p1-1.
+        # set_ssh_agent_permissions() below will re-create it properly.
+        if getent group ssh >/dev/null; then
+                delgroup --quiet ssh || true
+        fi
+}
+
+set_ssh_agent_permissions() {
+        if ! getent group ssh >/dev/null; then
+                addgroup --system --quiet ssh
+        fi
+        if ! [ -x /usr/sbin/dpkg-statoverride ] || \
+            ! dpkg-statoverride --list /usr/bin/ssh-agent >/dev/null ; then
+                chgrp ssh /usr/bin/ssh-agent
+                chmod 2755 /usr/bin/ssh-agent
+        fi
+}
+
+commit_transfer_conffile () {
+        CONFFILE="$1"
+        if [ -e "$CONFFILE.moved-by-preinst" ]; then
+                rm -f "$CONFFILE.moved-by-preinst"
+        fi
+}
+
+
+fix_rsh_diversion
+create_alternatives
+set_ssh_permissions
+if [ "$2" = "1:3.5p1-1" ]; then
+    fix_ssh_group
+fi
+set_ssh_agent_permissions
+commit_transfer_conffile /etc/ssh/moduli
+commit_transfer_conffile /etc/ssh/ssh_config
+
+exit 0
diff --git a/debian/openssh-client.postrm b/debian/openssh-client.postrm
new file mode 100644
index 000000000..eb6fde06b
--- /dev/null
+++ b/debian/openssh-client.postrm
@@ -0,0 +1,34 @@
+#!/bin/sh -e
+
+#DEBHELPER#
+
+abort_transfer_conffile () {
+        CONFFILE="$1"
+        if [ -e "$CONFFILE.moved-by-preinst" ]; then
+                echo >&2 "Aborting ownership transfer of conffile $CONFFILE ..."
+                mv -f "$CONFFILE.moved-by-preinst" "$CONFFILE"
+                return 0
+        fi
+}
+
+case $1 in
+        abort-install|abort-upgrade)
+                abort_transfer_conffile /etc/ssh/moduli
+                abort_transfer_conffile /etc/ssh/ssh_config
+                ;;
+        purge)
+                # Remove all non-conffiles that ssh might create, so that we
+                # can smoothly remove /etc/ssh if and only if the user
+                # hasn't dropped some other files in there. Conffiles have
+                # already been removed at this point.
+                rm -f /etc/ssh/moduli /etc/ssh/primes
+                rm -f /etc/ssh/ssh_known_hosts /etc/ssh/ssh_known_hosts2
+                rmdir --ignore-fail-on-non-empty /etc/ssh
+
+                if which delgroup; then
+                        delgroup --quiet ssh > /dev/null || true
+                fi
+                ;;
+esac
+
+exit 0
diff --git a/debian/openssh-client.preinst b/debian/openssh-client.preinst
new file mode 100644
index 000000000..0b29c051d
--- /dev/null
+++ b/debian/openssh-client.preinst
@@ -0,0 +1,49 @@
+#! /bin/sh -e
+
+ETC_SSH_MODULI=@ETC_SSH_MODULI@
+
+ETC_SSH_SSH_CONFIG=@ETC_SSH_SSH_CONFIG@
+
+action="$1"
+version="$2"
+
+prepare_transfer_conffile () {
+        CONFFILE="$1"
+        TEXT="$2"
+        MODE="$3"
+        [ "$CONFFILES" ] || return 0
+        [ -e "$CONFFILE" ] || return 0
+
+        md5sum="$(md5sum "$CONFFILE" |sed -e 's/ .*//')"
+        old_md5sum="$(echo "$CONFFILES" | awk '$1 == "'"$CONFFILE"'" { print $2 }')"
+        if [ "$md5sum" = "$old_md5sum" ]; then
+                echo >&2 "Transferring ownership of conffile $CONFFILE ..."
+                # We have to write out the desired new text of the conffile,
+                # which is tricky in the preinst, hence the nasty way we
+                # have to hardcode the text here. Fortunately, this is only
+                # necessary with sarge's dpkg and older.
+                if echo "$TEXT" | head -n1 | grep -q '^@.*@$'; then
+                        echo >&2 'Unsubstituted conffile text! Please report this bug.'
+                        exit 1
+                fi
+                printf '%s' "$TEXT" >"$CONFFILE.dpkg-new"
+                chmod "$MODE" "$CONFFILE.dpkg-new"
+                mv -f "$CONFFILE" "$CONFFILE.moved-by-preinst"
+                mv -f "$CONFFILE.dpkg-new" "$CONFFILE"
+                return 0
+        fi
+}
+
+case $action in
+        install|upgrade)
+                if dpkg --compare-versions "$version" lt 0; then
+                        CONFFILES="$(dpkg-query -W -f '${Conffiles}\n' ssh 2>/dev/null | sed 's/^ *//')"
+                        prepare_transfer_conffile /etc/ssh/moduli "$ETC_SSH_MODULI" 0644
+                        prepare_transfer_conffile /etc/ssh/ssh_config "$ETC_SSH_SSH_CONFIG" 0644
+                fi
+                ;;
+esac
+
+#DEBHELPER#
+
+exit 0
diff --git a/debian/openssh-client.prerm b/debian/openssh-client.prerm
new file mode 100644
index 000000000..2d631cb9c
--- /dev/null
+++ b/debian/openssh-client.prerm
@@ -0,0 +1,39 @@
+#! /bin/sh
+# prerm script for ssh
+#
+# see: dh_installdeb(1)
+
+set -e
+
+# summary of how this script can be called:
+#        * <prerm> `remove'
+#        * <old-prerm> `upgrade' <new-version>
+#        * <new-prerm> `failed-upgrade' <old-version>
+#        * <conflictor's-prerm> `remove' `in-favour' <package> <new-version>
+#        * <deconfigured's-prerm> `deconfigure' `in-favour'
+#          <package-being-installed> <version> `removing'
+#          <conflicting-package> <version>
+# for details, see /usr/share/doc/packaging-manual/
+
+case "$1" in
+    remove|deconfigure)
+        update-alternatives --quiet --remove rsh /usr/bin/ssh
+        update-alternatives --quiet --remove rlogin /usr/bin/slogin
+        update-alternatives --quiet --remove rcp /usr/bin/scp
+        ;;
+    upgrade)
+        ;;
+    failed-upgrade)
+        ;;
+    *)
+        echo "prerm called with unknown argument \`$1'" >&2
+        exit 0
+    ;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
diff --git a/debian/openssh-server-udeb.dirs b/debian/openssh-server-udeb.dirs
new file mode 100644
index 000000000..f2b0bd9da
--- /dev/null
+++ b/debian/openssh-server-udeb.dirs
@@ -0,0 +1,3 @@
+usr/bin
+usr/sbin
+var/run/sshd
diff --git a/debian/openssh-server-udeb.install b/debian/openssh-server-udeb.install
new file mode 100644
index 000000000..05ccbf7af
--- /dev/null
+++ b/debian/openssh-server-udeb.install
@@ -0,0 +1,2 @@
+sshd usr/sbin
+ssh-keygen usr/bin
diff --git a/debian/openssh-server.config b/debian/openssh-server.config
new file mode 100644
index 000000000..2a01aa806
--- /dev/null
+++ b/debian/openssh-server.config
@@ -0,0 +1,71 @@
+#!/bin/sh 
+
+action=$1
+version=$2
+
+# Source debconf library.
+. /usr/share/debconf/confmodule
+db_version 2.0
+
+
+get_config_option() {
+        option="$1"
+
+        [ -f /etc/ssh/sshd_config ] || return
+
+        # TODO: actually only one '=' allowed after option
+        perl -ne 'print if s/^[[:space:]]*'"$option"'[[:space:]=]+//i' \
+           /etc/ssh/sshd_config 2>/dev/null
+}
+
+
+if [ -e /etc/init.d/ssh ] && ! grep -q pidfile /etc/init.d/ssh
+then
+  db_fset ssh/use_old_init_script seen false
+  db_input medium ssh/use_old_init_script || true
+  db_go
+
+  db_get ssh/use_old_init_script
+  [ "$RET" = "false" ] && exit 0
+else
+  db_set ssh/use_old_init_script true
+  db_fset ssh/use_old_init_script seen true
+fi
+
+if [ -e /etc/ssh/sshd_config ]
+then
+    # An empty version means we're upgrading from before the package split,
+    # so check.
+    if dpkg --compare-versions "$version" lt 1:3.8.1p1-11
+    then
+        passwordauth="$(get_config_option PasswordAuthentication)"
+        crauth="$(get_config_option ChallengeResponseAuthentication)"
+        if [ "$passwordauth" = no ] && \
+           ([ -z "$crauth" ] || [ "$crauth" = yes ])
+        then
+            db_input critical ssh/disable_cr_auth || true
+        fi
+    fi
+fi 
+
+key=/etc/ssh/ssh_host_key
+export key
+if [ -n "$version" ] && [ -f $key ] && [ ! -x /usr/bin/ssh-keygen ] &&
+     dpkg --compare-versions "$version" lt 1.2.28
+then
+  # make sure that keys get updated to get rid of IDEA; preinst
+  # actually does the work, but if the old ssh-keygen is not found,
+  # it can't do that -- thus, we tell the user that he must create
+  # a new host key.
+  printf '\0\0' | 3<&0 sh -c \
+      'dd if=$key bs=1 skip=32 count=2 2>/dev/null | cmp -s - /dev/fd/3' || {
+    # this means that bytes 32&33 of the key were not both zero, in which
+    # case the key is encrypted, which we need to fix
+    db_input high ssh/encrypted_host_key_but_no_keygen || true
+  }
+fi
+
+
+db_go
+
+exit 0
diff --git a/debian/openssh-server.dirs b/debian/openssh-server.dirs
new file mode 100644
index 000000000..b008fbf2c
--- /dev/null
+++ b/debian/openssh-server.dirs
@@ -0,0 +1,9 @@
+etc/init.d
+etc/default
+etc/network/if-up.d
+etc/ufw/applications.d
+usr/lib/openssh
+usr/sbin
+usr/share/lintian/overrides
+usr/share/man/man5
+usr/share/man/man8
diff --git a/debian/openssh-server.examples b/debian/openssh-server.examples
new file mode 100644
index 000000000..0d0e55a7a
--- /dev/null
+++ b/debian/openssh-server.examples
@@ -0,0 +1 @@
+sshd_config
diff --git a/debian/openssh-server.if-up b/debian/openssh-server.if-up
new file mode 100644
index 000000000..ce5d4dd17
--- /dev/null
+++ b/debian/openssh-server.if-up
@@ -0,0 +1,40 @@
+#! /bin/sh
+# Reload the OpenSSH server when an interface comes up, to allow it to start
+# listening on new addresses.
+
+set -e
+
+# Don't bother to restart sshd when lo is configured.
+if [ "$IFACE" = lo ]; then
+        exit 0
+fi
+
+# Only run from ifup.
+if [ "$MODE" != start ]; then
+        exit 0
+fi
+
+# OpenSSH only cares about inet and inet6. Get ye gone, strange people
+# still using ipx.
+if [ "$ADDRFAM" != inet ] && [ "$ADDRFAM" != inet6 ]; then
+        exit 0
+fi
+
+# Is /usr mounted?
+if [ ! -e /usr/sbin/sshd ]; then
+        exit 0
+fi
+
+if [ ! -f /var/run/sshd.pid ] || \
+   [ "$(ps -p "$(cat /var/run/sshd.pid)" -o comm=)" != sshd ]; then
+        exit 0
+fi
+
+# We'd like to use 'reload' here, but it has some problems; see #502444.
+if [ -x /usr/sbin/invoke-rc.d ]; then
+        invoke-rc.d ssh restart >/dev/null 2>&1 || true
+else
+        /etc/init.d/ssh restart >/dev/null 2>&1 || true
+fi
+
+exit 0
diff --git a/debian/openssh-server.install b/debian/openssh-server.install
new file mode 100644
index 000000000..8e04c4170
--- /dev/null
+++ b/debian/openssh-server.install
@@ -0,0 +1,6 @@
+usr/lib/openssh/sftp-server
+usr/sbin/sshd
+usr/share/man/man5/authorized_keys.5
+usr/share/man/man5/sshd_config.5
+usr/share/man/man8/sftp-server.8
+usr/share/man/man8/sshd.8
diff --git a/debian/openssh-server.links b/debian/openssh-server.links
new file mode 100644
index 000000000..2d98b1dcb
--- /dev/null
+++ b/debian/openssh-server.links
@@ -0,0 +1 @@
+usr/lib/openssh/sftp-server usr/lib/sftp-server
diff --git a/debian/openssh-server.lintian-overrides b/debian/openssh-server.lintian-overrides
new file mode 100644
index 000000000..17d912cb0
--- /dev/null
+++ b/debian/openssh-server.lintian-overrides
@@ -0,0 +1 @@
+openssh-server: package-contains-empty-directory usr/share/doc/openssh-client/
diff --git a/debian/openssh-server.postinst b/debian/openssh-server.postinst
new file mode 100644
index 000000000..325af4ef4
--- /dev/null
+++ b/debian/openssh-server.postinst
@@ -0,0 +1,480 @@
+#!/bin/sh -e
+
+action="$1"
+oldversion="$2"
+
+. /usr/share/debconf/confmodule
+db_version 2.0
+
+umask 022
+
+if [ "$action" != configure ]
+  then
+  exit 0
+fi
+
+
+fix_doc_symlink() {
+        if [ ! -L /usr/share/doc/openssh-server ] && \
+           dpkg --compare-versions "$oldversion" lt-nl 1:4.1p1-5; then
+                rm -rf /usr/share/doc/openssh-server
+                ln -s openssh-client /usr/share/doc/openssh-server
+        fi
+}
+
+
+get_config_option() {
+        option="$1"
+
+        [ -f /etc/ssh/sshd_config ] || return
+
+        # TODO: actually only one '=' allowed after option
+        perl -lne 's/\s+/ /g; print if s/^\s*'"$option"'[[:space:]=]+//i' \
+           /etc/ssh/sshd_config
+}
+
+
+set_config_option() {
+        option="$1"
+        value="$2"
+
+        perl -le '
+                $option = $ARGV[0]; $value = $ARGV[1]; $done = 0;
+                while (<STDIN>) {
+                        chomp;
+                        (my $match = $_) =~ s/\s+/ /g;
+                        if ($match =~ s/^\s*\Q$option\E\s+.*/$option $value/) {
+                                $_ = $match;
+                                $done = 1;
+                        }
+                        print;
+                }
+                print "$option $value" unless $done;' \
+                "$option" "$value" \
+                < /etc/ssh/sshd_config > /etc/ssh/sshd_config.dpkg-new
+        chown --reference /etc/ssh/sshd_config /etc/ssh/sshd_config.dpkg-new
+        chmod --reference /etc/ssh/sshd_config /etc/ssh/sshd_config.dpkg-new
+        mv /etc/ssh/sshd_config.dpkg-new /etc/ssh/sshd_config
+}
+
+
+disable_config_option() {
+        option="$1"
+
+        value="$(get_config_option "$option")"
+        [ "$value" ] || return 0
+
+        perl -le '
+                $option = $ARGV[0];
+                while (<STDIN>) {
+                        chomp;
+                        (my $match = $_) =~ s/\s+/ /g;
+                        # TODO: actually only one "=" allowed after option
+                        if ($match =~ s/^(\s*\Q$option\E[[:space:]=]+.*)/#$1/i) {
+                                $_ = $match;
+                        }
+                        print;
+                }' \
+                "$option" \
+                < /etc/ssh/sshd_config > /etc/ssh/sshd_config.dpkg-new
+        chown --reference /etc/ssh/sshd_config /etc/ssh/sshd_config.dpkg-new
+        chmod --reference /etc/ssh/sshd_config /etc/ssh/sshd_config.dpkg-new
+        mv /etc/ssh/sshd_config.dpkg-new /etc/ssh/sshd_config
+}
+
+
+rename_config_option() {
+        oldoption="$1"
+        newoption="$2"
+
+        value="$(get_config_option "$oldoption")"
+        [ "$value" ] || return 0
+
+        perl -le '
+                $oldoption = $ARGV[0]; $newoption = $ARGV[1];
+                while (<STDIN>) {
+                        chomp;
+                        (my $match = $_) =~ s/\s+/ /g;
+                        # TODO: actually only one "=" allowed after option
+                        if ($match =~ s/^(\s*)\Q$oldoption\E([[:space:]=]+)/$1$newoption$2/i) {
+                                $_ = $match;
+                        }
+                        print;
+                }' \
+                "$oldoption" "$newoption" \
+                < /etc/ssh/sshd_config > /etc/ssh/sshd_config.dpkg-new
+        chown --reference /etc/ssh/sshd_config /etc/ssh/sshd_config.dpkg-new
+        chmod --reference /etc/ssh/sshd_config /etc/ssh/sshd_config.dpkg-new
+        mv /etc/ssh/sshd_config.dpkg-new /etc/ssh/sshd_config
+}
+
+
+remove_obsolete_gssapi() {
+        disable_config_option GSSAPINoMICAuthentication
+        disable_config_option GSSUseSessionCCache
+        disable_config_option GSSAPIUseSessionCredCache
+}
+
+
+host_keys_required() {
+        hostkeys="$(get_config_option HostKey)"
+        if [ "$hostkeys" ]; then
+                echo "$hostkeys"
+        else
+                # No HostKey directives at all, so the server picks some
+                # defaults depending on the setting of Protocol.
+                protocol="$(get_config_option Protocol)"
+                [ "$protocol" ] || protocol=1,2
+                if echo "$protocol" | grep 1 >/dev/null; then
+                        echo /etc/ssh/ssh_host_key
+                fi
+                if echo "$protocol" | grep 2 >/dev/null; then
+                        echo /etc/ssh/ssh_host_rsa_key
+                        echo /etc/ssh/ssh_host_dsa_key
+                fi
+        fi
+}
+
+
+create_key() {
+        msg="$1"
+        shift
+        hostkeys="$1"
+        shift
+        file="$1"
+        shift
+
+        if echo "$hostkeys" | grep -x "$file" >/dev/null && \
+           [ ! -f "$file" ] ; then
+                echo -n $msg
+                ssh-keygen -q -f "$file" -N '' "$@"
+                echo
+                if which restorecon >/dev/null 2>&1; then
+                        restorecon "$file.pub"
+                fi
+        fi
+}
+
+
+create_keys() {
+        hostkeys="$(host_keys_required)"
+
+        create_key "Creating SSH1 key; this may take some time ..." \
+                "$hostkeys" /etc/ssh/ssh_host_key -t rsa1
+
+        create_key "Creating SSH2 RSA key; this may take some time ..." \
+                "$hostkeys" /etc/ssh/ssh_host_rsa_key -t rsa
+        create_key "Creating SSH2 DSA key; this may take some time ..." \
+                "$hostkeys" /etc/ssh/ssh_host_dsa_key -t dsa
+}
+
+
+vulnerable_host_keys() {
+        # If the admin has explicitly put the vulnerable keys back, we
+        # assume they can look after themselves.
+        db_fget ssh/vulnerable_host_keys seen
+        if [ "$RET" = true ]; then
+                return 0
+        fi
+
+        hostkeys="$(host_keys_required)"
+        vulnerable=
+        for hostkey in $hostkeys; do
+                [ -f "$hostkey" ] || continue
+                if ssh-vulnkey -q "$hostkey"; then
+                        vulnerable="${vulnerable:+$vulnerable }$hostkey"
+                fi
+        done
+        if [ "$vulnerable" ]; then
+                db_subst ssh/vulnerable_host_keys HOST_KEYS "$vulnerable"
+                db_input critical ssh/vulnerable_host_keys || true
+                db_go
+                for hostkey in $vulnerable; do
+                        mv "$hostkey" "$hostkey.broken" || true
+                        mv "$hostkey.pub" "$hostkey.pub.broken" || true
+                done
+                create_keys
+        fi
+}
+
+
+check_password_auth() {
+        passwordauth="$(get_config_option PasswordAuthentication)"
+        crauth="$(get_config_option ChallengeResponseAuthentication)"
+        if [ "$passwordauth" = no ] && \
+           ([ -z "$crauth" ] || [ "$crauth" = yes ]); then
+                db_get ssh/disable_cr_auth
+                if [ "$RET" = true ]; then
+                        set_config_option ChallengeResponseAuthentication no
+                fi
+        fi
+}
+
+
+move_subsystem_sftp() {
+        subsystem_sftp="$(get_config_option 'Subsystem sftp')"
+        if [ "$subsystem_sftp" = /usr/lib/sftp-server ] || \
+           [ "$subsystem_sftp" = /usr/libexec/sftp-server ]; then
+                set_config_option 'Subsystem sftp' /usr/lib/openssh/sftp-server
+        fi
+}
+
+
+fix_loglevel_silent() {
+        if [ "$(get_config_option LogLevel)" = SILENT ]; then
+                set_config_option LogLevel QUIET
+        fi
+}
+
+
+create_sshdconfig() {
+        if [ -e /etc/ssh/sshd_config ] ; then
+            # Upgrade an existing sshd configuration.
+
+            if (dpkg --compare-versions "$oldversion" lt-nl 1:3.8p1-1 && \
+                ! grep -iq ^UsePAM /etc/ssh/sshd_config) || \
+               grep -Eiq '^(PAMAuthenticationViaKbdInt|RhostsAuthentication)' \
+                 /etc/ssh/sshd_config ; then
+                # Upgrade from pre-3.7: UsePAM needed to maintain standard
+                # Debian configuration.
+                # Note that --compare-versions is sadly not reliable enough
+                # here due to the package split of ssh into openssh-client
+                # and openssh-server. The extra grep for some deprecated
+                # options should with any luck be a good enough heuristic.
+                echo -n 'Upgrading sshd_config (old version in .dpkg-old) ...'
+                cp -a /etc/ssh/sshd_config /etc/ssh/sshd_config.dpkg-old
+                perl -pe 's/^(PAMAuthenticationViaKbdInt|RhostsAuthentication)\b/#$1/i' \
+                    /etc/ssh/sshd_config > /etc/ssh/sshd_config.dpkg-new
+                echo >> /etc/ssh/sshd_config.dpkg-new
+                echo 'UsePAM yes' >> /etc/ssh/sshd_config.dpkg-new
+                chown --reference /etc/ssh/sshd_config \
+                                  /etc/ssh/sshd_config.dpkg-new
+                chmod --reference /etc/ssh/sshd_config \
+                                  /etc/ssh/sshd_config.dpkg-new
+                mv /etc/ssh/sshd_config.dpkg-new /etc/ssh/sshd_config
+                echo
+            fi
+
+            # An empty version means we're upgrading from before the
+            # package split, so check.
+            if dpkg --compare-versions "$oldversion" lt 1:3.8.1p1-11; then
+                check_password_auth
+            fi
+
+            # libexecdir changed, so fix up 'Subsystem sftp'.
+            if dpkg --compare-versions "$oldversion" lt 1:4.1p1-1; then
+                move_subsystem_sftp
+            fi
+
+            # Remove obsolete GSSAPI options.
+            if dpkg --compare-versions "$oldversion" lt 1:4.3p2-8; then
+                remove_obsolete_gssapi
+            fi
+
+            # This option was renamed in 3.8p1, but we never took care
+            # of adjusting the configuration file until now.
+            if dpkg --compare-versions "$oldversion" lt 1:4.7p1-8; then
+                rename_config_option KeepAlive TCPKeepAlive
+            fi
+
+            # 'LogLevel SILENT' is now equivalent to QUIET.
+            if dpkg --compare-versions "$oldversion" lt 1:5.4p1-1; then
+                fix_loglevel_silent
+            fi
+
+            return 0
+        fi
+
+        #Preserve old sshd_config before generating a new one
+        if [ -e /etc/ssh/sshd_config ] ; then 
+            mv /etc/ssh/sshd_config /etc/ssh/sshd_config.dpkg-old
+        fi
+
+        cat <<EOF > /etc/ssh/sshd_config
+# Package generated configuration file
+# See the sshd_config(5) manpage for details
+
+# What ports, IPs and protocols we listen for
+Port 22
+# Use these options to restrict which interfaces/protocols sshd will bind to
+#ListenAddress ::
+#ListenAddress 0.0.0.0
+Protocol 2
+# HostKeys for protocol version 2
+HostKey /etc/ssh/ssh_host_rsa_key
+HostKey /etc/ssh/ssh_host_dsa_key
+#Privilege Separation is turned on for security
+UsePrivilegeSeparation yes
+
+# Lifetime and size of ephemeral version 1 server key
+KeyRegenerationInterval 3600
+ServerKeyBits 768
+
+# Logging
+SyslogFacility AUTH
+LogLevel INFO
+
+# Authentication:
+LoginGraceTime 120
+PermitRootLogin yes
+StrictModes yes
+
+RSAAuthentication yes
+PubkeyAuthentication yes
+#AuthorizedKeysFile     %h/.ssh/authorized_keys
+
+# Don't read the user's ~/.rhosts and ~/.shosts files
+IgnoreRhosts yes
+# For this to work you will also need host keys in /etc/ssh_known_hosts
+RhostsRSAAuthentication no
+# similar for protocol version 2
+HostbasedAuthentication no
+# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
+#IgnoreUserKnownHosts yes
+
+# To enable empty passwords, change to yes (NOT RECOMMENDED)
+PermitEmptyPasswords no
+
+# Change to yes to enable challenge-response passwords (beware issues with
+# some PAM modules and threads)
+ChallengeResponseAuthentication no
+
+# Change to no to disable tunnelled clear text passwords
+#PasswordAuthentication yes
+
+# Kerberos options
+#KerberosAuthentication no
+#KerberosGetAFSToken no
+#KerberosOrLocalPasswd yes
+#KerberosTicketCleanup yes
+
+# GSSAPI options
+#GSSAPIAuthentication no
+#GSSAPICleanupCredentials yes
+
+X11Forwarding yes
+X11DisplayOffset 10
+PrintMotd no
+PrintLastLog yes
+TCPKeepAlive yes
+#UseLogin no
+
+#MaxStartups 10:30:60
+#Banner /etc/issue.net
+
+# Allow client to pass locale environment variables
+AcceptEnv LANG LC_*
+
+Subsystem sftp /usr/lib/openssh/sftp-server
+
+# Set this to 'yes' to enable PAM authentication, account processing,
+# and session processing. If this is enabled, PAM authentication will
+# be allowed through the ChallengeResponseAuthentication and
+# PasswordAuthentication.  Depending on your PAM configuration,
+# PAM authentication via ChallengeResponseAuthentication may bypass
+# the setting of "PermitRootLogin without-password".
+# If you just want the PAM account and session checks to run without
+# PAM authentication, then enable this but set PasswordAuthentication
+# and ChallengeResponseAuthentication to 'no'.
+UsePAM yes
+EOF
+}
+
+fix_statoverride() {
+# Remove an erronous override for sshd (we should have overridden ssh)
+        if [ -x /usr/sbin/dpkg-statoverride ]; then
+                if dpkg-statoverride --list /usr/sbin/sshd >/dev/null ; then
+                        dpkg-statoverride --remove /usr/sbin/sshd
+                fi
+        fi
+}
+
+fix_sshd_shell() {
+        if getent passwd sshd | grep -q ':/bin/false$'; then
+                usermod -s /usr/sbin/nologin sshd || true
+        fi
+}
+
+setup_sshd_user() {
+        if ! getent passwd sshd >/dev/null; then
+                adduser --quiet --system --no-create-home --home /var/run/sshd --shell /usr/sbin/nologin sshd
+        fi
+}
+
+fix_conffile_permissions() {
+        # Clean up after executable /etc/default/ssh in 1:3.5p1-5. dpkg
+        # doesn't do this for us; see bug #192981.
+        chmod 644 /etc/default/ssh
+}
+
+remove_old_init_links() {
+        # Yes, this only works with the SysV init script layout. I know.
+        # The important thing is that it doesn't actually *break* with
+        # file-rc ...
+        if [ -e /etc/rc2.d/S20ssh ]; then
+                update-rc.d -f ssh remove >/dev/null 2>&1
+        fi
+        rm -f /etc/rc0.d/K??ssh /etc/rc1.d/K??ssh /etc/rc6.d/K??ssh
+}
+
+setup_init() {
+        if [ -x /etc/init.d/ssh ]; then
+                update-rc.d ssh start 16 2 3 4 5 . >/dev/null
+                if [ -x /usr/sbin/invoke-rc.d ]; then
+                        invoke-rc.d ssh restart
+                else
+                        /etc/init.d/ssh restart
+                fi
+        fi
+}
+
+commit_transfer_conffile () {
+        CONFFILE="$1"
+        if [ -e "$CONFFILE.moved-by-preinst" ]; then
+                rm -f "$CONFFILE.moved-by-preinst"
+        fi
+}
+
+commit_mv_conffile () {
+        OLDCONFFILE="$1"
+        NEWCONFFILE="$2"
+
+        if [ -e "$OLDCONFFILE.moving" ]; then
+                echo "Preserving user changes to $NEWCONFFILE ..."
+                mv -f "$NEWCONFFILE" "$NEWCONFFILE.dpkg-new"
+                mv -f "$OLDCONFFILE.moving" "$NEWCONFFILE"
+        elif [ -e "$OLDCONFFILE.dpkg-old" ]; then
+                rm -f "$OLDCONFFILE.dpkg-old"
+        fi
+}
+
+
+fix_doc_symlink
+create_sshdconfig
+create_keys
+vulnerable_host_keys
+fix_statoverride
+if dpkg --compare-versions "$2" lt 1:4.3p2-3; then
+    fix_sshd_shell
+fi
+setup_sshd_user
+if dpkg --compare-versions "$2" lt 1:3.6.1p2-2; then
+    fix_conffile_permissions
+fi
+if dpkg --compare-versions "$2" lt 1:5.2p1-1; then
+    remove_old_init_links
+fi
+setup_init
+commit_transfer_conffile /etc/default/ssh
+commit_transfer_conffile /etc/init.d/ssh
+commit_transfer_conffile /etc/pam.d/ssh
+commit_mv_conffile /etc/pam.d/ssh /etc/pam.d/sshd
+# Renamed to /etc/ssh/moduli in 2.9.9 (!)
+if dpkg --compare-versions "$2" lt 1:4.7p1-1; then
+    rm -f /etc/ssh/primes
+fi
+
+
+db_stop
+
+exit 0
diff --git a/debian/openssh-server.postrm b/debian/openssh-server.postrm
new file mode 100644
index 000000000..7258d5f99
--- /dev/null
+++ b/debian/openssh-server.postrm
@@ -0,0 +1,65 @@
+#!/bin/sh -e
+
+#DEBHELPER#
+
+abort_mv_conffile () {
+        CONFFILE="$1"
+
+        if [ ! -e "$CONFFILE" ]; then
+                if [ -e "$CONFFILE.dpkg-old" ]; then
+                        mv -f "$CONFFILE.dpkg-old" "$CONFFILE"
+                elif [ -e "$CONFFILE.moving" ]; then
+                        mv -f "$CONFFILE.moving" "$CONFFILE"
+                fi
+        fi
+}
+
+finish_mv_conffile () {
+        CONFFILE="$1"
+
+        if [ -e "$CONFFILE.dpkg-old" ]; then
+                rm -f "$CONFFILE.dpkg-old"
+        fi
+}
+
+abort_transfer_conffile () {
+        CONFFILE="$1"
+        if [ -e "$CONFFILE.moved-by-preinst" ]; then
+                echo >&2 "Aborting ownership transfer of conffile $CONFFILE ..."
+                mv -f "$CONFFILE.moved-by-preinst" "$CONFFILE"
+                return 0
+        fi
+}
+
+case $1 in
+        abort-install|abort-upgrade)
+                if dpkg --compare-versions "$2" lt 1:4.7p1-4; then
+                        abort_mv_conffile /etc/pam.d/ssh
+                fi
+                abort_transfer_conffile /etc/default/ssh
+                abort_transfer_conffile /etc/init.d/ssh
+                abort_transfer_conffile /etc/pam.d/ssh
+                ;;
+        purge)
+                # Remove all non-conffiles that ssh might create, so that we
+                # can smoothly remove /etc/ssh if and only if the user
+                # hasn't dropped some other files in there. Conffiles have
+                # already been removed at this point.
+                rm -f /etc/ssh/ssh_host_key /etc/ssh/ssh_host_key.pub
+                rm -f /etc/ssh/ssh_host_rsa_key /etc/ssh/ssh_host_rsa_key.pub
+                rm -f /etc/ssh/ssh_host_dsa_key /etc/ssh/ssh_host_dsa_key.pub
+                rm -f /etc/ssh/sshd_config
+                rm -f /etc/ssh/sshd_not_to_be_run
+                rmdir --ignore-fail-on-non-empty /etc/ssh
+
+                update-rc.d ssh remove >/dev/null
+
+                if which deluser >/dev/null 2>&1; then
+                        deluser --quiet sshd > /dev/null || true
+                fi
+
+                finish_mv_conffile /etc/pam.d/ssh
+                ;;
+esac
+
+exit 0
diff --git a/debian/openssh-server.preinst b/debian/openssh-server.preinst
new file mode 100644
index 000000000..43c4b57f9
--- /dev/null
+++ b/debian/openssh-server.preinst
@@ -0,0 +1,139 @@
+#!/bin/sh -e
+
+ETC_DEFAULT_SSH=@ETC_DEFAULT_SSH@
+
+ETC_INIT_D_SSH=@ETC_INIT_D_SSH@
+
+ETC_PAM_D_SSH=@ETC_PAM_D_SSH@
+
+action=$1
+version=$2
+
+prepare_transfer_conffile () {
+        CONFFILE="$1"
+        TEXT="$2"
+        MODE="$3"
+        [ "$CONFFILES" ] || return 0
+        [ -e "$CONFFILE" ] || return 0
+
+        md5sum="$(md5sum "$CONFFILE" |sed -e 's/ .*//')"
+        old_md5sum="$(echo "$CONFFILES" | awk '$1 == "'"$CONFFILE"'" { print $2 }')"
+        if [ "$md5sum" = "$old_md5sum" ]; then
+                echo >&2 "Transferring ownership of conffile $CONFFILE ..."
+                # We have to write out the desired new text of the conffile,
+                # which is tricky in the preinst, hence the nasty way we
+                # have to hardcode the text here. Fortunately, this is only
+                # necessary with sarge's dpkg and older.
+                if echo "$TEXT" | head -n1 | grep -q '^@.*@$'; then
+                        echo >&2 'Unsubstituted conffile text! Please report this bug.'
+                        exit 1
+                fi
+                printf '%s' "$TEXT" >"$CONFFILE.dpkg-new"
+                chmod "$MODE" "$CONFFILE.dpkg-new"
+                mv -f "$CONFFILE" "$CONFFILE.moved-by-preinst"
+                mv -f "$CONFFILE.dpkg-new" "$CONFFILE"
+                return 0
+        fi
+}
+
+prepare_mv_conffile () {
+        CONFFILE="$1"
+        [ -e "$CONFFILE" ] || return 0
+
+        md5sum="$(md5sum "$CONFFILE" | sed -e 's/ .*//')"
+        old_md5sum="$(dpkg-query -W -f '${Conffiles}\n' openssh-server 2>/dev/null | sed 's/^ *//' | awk '$1 == "'"$CONFFILE"'" { print $2 }')"
+        if [ "$md5sum" = "$old_md5sum" ]; then
+                mv -f "$CONFFILE" "$CONFFILE.dpkg-old"
+        else
+                mv -f "$CONFFILE" "$CONFFILE.moving"
+        fi
+}
+
+if [ -d /etc/ssh-nonfree ] && [ ! -d /etc/ssh ]; then
+  version=1.2.27
+fi
+
+if [ "$action" = upgrade ] || [ "$action" = install ]
+then
+  # check if debconf is missing
+  if ! test -f /usr/share/debconf/confmodule
+  then
+    cat <<EOF
+
+WARNING: ssh's pre-configuration script relies on debconf to tell you
+about some problems that might prevent you from logging in if you are
+upgrading from the old, Non-free version of ssh.
+
+If this is a new installation, you don't need to worry about this.
+Just go ahead and install ssh (make sure to read .../ssh/README.Debian).
+
+If you are upgrading, but you have alternative ways of logging into
+the machine (i.e. you're sitting in front of it, or you have telnetd
+running), then you also don't need to worry too much, because you can
+fix it up afterwards if there's a problem.
+
+If you're upgrading from an older (non-free) version of ssh, and ssh
+is the only way you have to access this machine, then you should
+probably abort the installation of ssh, install debconf, and then
+retry the installation of ssh.
+
+EOF
+    echo -n "Do you want to install SSH anyway [yN]: "
+    read input
+    expr "$input" : '[Yy]' >/dev/null || exit 1
+
+    # work around for missing debconf
+    db_get() { : ; }
+    RET=true
+    if [ -d /etc/ssh-nonfree ] && [ ! -d /etc/ssh ]; then
+      cp -a /etc/ssh-nonfree /etc/ssh
+    fi
+  else
+    # Source debconf library.
+    . /usr/share/debconf/confmodule
+    db_version 2.0
+  fi
+
+  db_get ssh/use_old_init_script
+  if [ "$RET" = "false" ]; then
+    echo "ssh config: Aborting because ssh/use_old_init_script = false" >&2
+    exit 1
+  fi
+
+  # deal with upgrading from pre-OpenSSH versions
+  key=/etc/ssh/ssh_host_key
+  export key
+  if [ -n "$version" ] && [ -x /usr/bin/ssh-keygen ] && [ -f $key ] &&
+     dpkg --compare-versions "$version" lt 1.2.28
+  then
+    # make sure that keys get updated to get rid of IDEA
+    #
+    # N.B. this only works because we've still got the old
+    # nonfree ssh-keygen at this point
+    #
+    # First, check if we need to bother
+    printf '\0\0' | 3<&0 sh -c \
+        'dd if=$key bs=1 skip=32 count=2 2>/dev/null | cmp -s - /dev/fd/3' || {
+      # this means that bytes 32&33 of the key were not both zero, in which
+      # case the key is encrypted, which we need to fix
+      chmod 600 $key
+      ssh-keygen -u -f $key >/dev/null
+      if which restorecon >/dev/null 2>&1; then
+        restorecon "$key.pub"
+      fi
+    }
+  fi
+
+  if dpkg --compare-versions "$version" lt 0; then
+    CONFFILES="$(dpkg-query -W -f '${Conffiles}\n' ssh 2>/dev/null | sed 's/^ *//')"
+    prepare_transfer_conffile /etc/default/ssh "$ETC_DEFAULT_SSH" 0644
+    prepare_transfer_conffile /etc/init.d/ssh "$ETC_INIT_D_SSH" 0755
+    prepare_transfer_conffile /etc/pam.d/ssh "$ETC_PAM_D_SSH" 0644
+  fi
+
+  if dpkg --compare-versions "$version" lt 1:4.7p1-4; then
+    prepare_mv_conffile /etc/pam.d/ssh
+  fi
+fi
+
+#DEBHELPER#
diff --git a/debian/openssh-server.prerm b/debian/openssh-server.prerm
new file mode 100644
index 000000000..9c3313aac
--- /dev/null
+++ b/debian/openssh-server.prerm
@@ -0,0 +1,48 @@
+#! /bin/sh
+# prerm script for ssh
+#
+# see: dh_installdeb(1)
+
+set -e
+
+# summary of how this script can be called:
+#        * <prerm> `remove'
+#        * <old-prerm> `upgrade' <new-version>
+#        * <new-prerm> `failed-upgrade' <old-version>
+#        * <conflictor's-prerm> `remove' `in-favour' <package> <new-version>
+#        * <deconfigured's-prerm> `deconfigure' `in-favour'
+#          <package-being-installed> <version> `removing'
+#          <conflicting-package> <version>
+# for details, see /usr/share/doc/packaging-manual/
+
+case "$1" in
+    remove|deconfigure)
+        if [ -x /etc/init.d/ssh ]; then
+                if [ -x /usr/sbin/invoke-rc.d ]; then
+                        invoke-rc.d ssh stop
+                else
+                        /etc/init.d/ssh stop
+                fi
+        fi
+        ;;
+    upgrade)
+        # remove symlink on downgrade to when it was a directory
+        if [ -L /usr/share/doc/openssh-server ] && \
+           dpkg --compare-versions "$2" lt-nl 1:4.1p1-5; then
+                rm -f /usr/share/doc/openssh-server
+        fi
+        ;;
+    failed-upgrade)
+        ;;
+    *)
+        echo "prerm called with unknown argument \`$1'" >&2
+        exit 0
+    ;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
diff --git a/debian/openssh-server.ssh.default b/debian/openssh-server.ssh.default
new file mode 100644
index 000000000..304042224
--- /dev/null
+++ b/debian/openssh-server.ssh.default
@@ -0,0 +1,5 @@
+# Default settings for openssh-server. This file is sourced by /bin/sh from
+# /etc/init.d/ssh.
+
+# Options to pass to sshd
+SSHD_OPTS=
diff --git a/debian/openssh-server.ssh.init b/debian/openssh-server.ssh.init
new file mode 100644
index 000000000..62bcc21d4
--- /dev/null
+++ b/debian/openssh-server.ssh.init
@@ -0,0 +1,164 @@
+#! /bin/sh
+
+### BEGIN INIT INFO
+# Provides:             sshd
+# Required-Start:       $remote_fs $syslog
+# Required-Stop:        $remote_fs $syslog
+# Default-Start:        2 3 4 5
+# Default-Stop:         
+# Short-Description:    OpenBSD Secure Shell server
+### END INIT INFO
+
+set -e
+
+# /etc/init.d/ssh: start and stop the OpenBSD "secure shell(tm)" daemon
+
+test -x /usr/sbin/sshd || exit 0
+( /usr/sbin/sshd -\? 2>&1 | grep -q OpenSSH ) 2>/dev/null || exit 0
+
+umask 022
+
+if test -f /etc/default/ssh; then
+    . /etc/default/ssh
+fi
+
+. /lib/lsb/init-functions
+
+if [ -n "$2" ]; then
+    SSHD_OPTS="$SSHD_OPTS $2"
+fi
+
+# Are we running from init?
+run_by_init() {
+    ([ "$previous" ] && [ "$runlevel" ]) || [ "$runlevel" = S ]
+}
+
+check_for_no_start() {
+    # forget it if we're trying to start, and /etc/ssh/sshd_not_to_be_run exists
+    if [ -e /etc/ssh/sshd_not_to_be_run ]; then 
+        if [ "$1" = log_end_msg ]; then
+            log_end_msg 0
+        fi
+        if ! run_by_init; then
+            log_action_msg "OpenBSD Secure Shell server not in use (/etc/ssh/sshd_not_to_be_run)"
+        fi
+        exit 0
+    fi
+}
+
+check_dev_null() {
+    if [ ! -c /dev/null ]; then
+        if [ "$1" = log_end_msg ]; then
+            log_end_msg 1 || true
+        fi
+        if ! run_by_init; then
+            log_action_msg "/dev/null is not a character device!"
+        fi
+        exit 1
+    fi
+}
+
+check_privsep_dir() {
+    # Create the PrivSep empty dir if necessary
+    if [ ! -d /var/run/sshd ]; then
+        mkdir /var/run/sshd
+        chmod 0755 /var/run/sshd
+    fi
+}
+
+check_config() {
+    if [ ! -e /etc/ssh/sshd_not_to_be_run ]; then
+        /usr/sbin/sshd $SSHD_OPTS -t || exit 1
+    fi
+}
+
+export PATH="${PATH:+$PATH:}/usr/sbin:/sbin"
+
+case "$1" in
+  start)
+        check_privsep_dir
+        check_for_no_start
+        check_dev_null
+        log_daemon_msg "Starting OpenBSD Secure Shell server" "sshd"
+        if start-stop-daemon --start --quiet --oknodo --pidfile /var/run/sshd.pid --exec /usr/sbin/sshd -- $SSHD_OPTS; then
+            log_end_msg 0
+        else
+            log_end_msg 1
+        fi
+        ;;
+  stop)
+        log_daemon_msg "Stopping OpenBSD Secure Shell server" "sshd"
+        if start-stop-daemon --stop --quiet --oknodo --pidfile /var/run/sshd.pid; then
+            log_end_msg 0
+        else
+            log_end_msg 1
+        fi
+        ;;
+
+  reload|force-reload)
+        check_for_no_start
+        check_config
+        log_daemon_msg "Reloading OpenBSD Secure Shell server's configuration" "sshd"
+        if start-stop-daemon --stop --signal 1 --quiet --oknodo --pidfile /var/run/sshd.pid --exec /usr/sbin/sshd; then
+            log_end_msg 0
+        else
+            log_end_msg 1
+        fi
+        ;;
+
+  restart)
+        check_privsep_dir
+        check_config
+        log_daemon_msg "Restarting OpenBSD Secure Shell server" "sshd"
+        start-stop-daemon --stop --quiet --oknodo --retry 30 --pidfile /var/run/sshd.pid
+        check_for_no_start log_end_msg
+        check_dev_null log_end_msg
+        if start-stop-daemon --start --quiet --oknodo --pidfile /var/run/sshd.pid --exec /usr/sbin/sshd -- $SSHD_OPTS; then
+            log_end_msg 0
+        else
+            log_end_msg 1
+        fi
+        ;;
+
+  try-restart)
+        check_privsep_dir
+        check_config
+        log_daemon_msg "Restarting OpenBSD Secure Shell server" "sshd"
+        set +e
+        start-stop-daemon --stop --quiet --retry 30 --pidfile /var/run/sshd.pid
+        RET="$?"
+        set -e
+        case $RET in
+            0)
+                # old daemon stopped
+                check_for_no_start log_end_msg
+                check_dev_null log_end_msg
+                if start-stop-daemon --start --quiet --oknodo --pidfile /var/run/sshd.pid --exec /usr/sbin/sshd -- $SSHD_OPTS; then
+                    log_end_msg 0
+                else
+                    log_end_msg 1
+                fi
+                ;;
+            1)
+                # daemon not running
+                log_progress_msg "(not running)"
+                log_end_msg 0
+                ;;
+            *)
+                # failed to stop
+                log_progress_msg "(failed to stop)"
+                log_end_msg 1
+                ;;
+        esac
+        ;;
+
+  status)
+        status_of_proc -p /var/run/sshd.pid /usr/sbin/sshd sshd && exit 0 || exit $?
+        ;;
+
+  *)
+        log_action_msg "Usage: /etc/init.d/ssh {start|stop|reload|force-reload|restart|try-restart|status}"
+        exit 1
+esac
+
+exit 0
diff --git a/debian/openssh-server.sshd.pam b/debian/openssh-server.sshd.pam
new file mode 100644
index 000000000..9b7695184
--- /dev/null
+++ b/debian/openssh-server.sshd.pam
@@ -0,0 +1,39 @@
+# PAM configuration for the Secure Shell service
+
+# Read environment variables from /etc/environment and
+# /etc/security/pam_env.conf.
+auth       required     pam_env.so # [1]
+# In Debian 4.0 (etch), locale-related environment variables were moved to
+# /etc/default/locale, so read that as well.
+auth       required     pam_env.so envfile=/etc/default/locale
+
+# Standard Un*x authentication.
+@include common-auth
+
+# Disallow non-root logins when /etc/nologin exists.
+account    required     pam_nologin.so
+
+# Uncomment and edit /etc/security/access.conf if you need to set complex
+# access limits that are hard to express in sshd_config.
+# account  required     pam_access.so
+
+# Standard Un*x authorization.
+@include common-account
+
+# Standard Un*x session setup and teardown.
+@include common-session
+
+# Print the message of the day upon successful login.
+session    optional     pam_motd.so # [1]
+
+# Print the status of the user's mailbox upon successful login.
+session    optional     pam_mail.so standard noenv # [1]
+
+# Set up user limits from /etc/security/limits.conf.
+session    required     pam_limits.so
+
+# Set up SELinux capabilities (need modified pam)
+# session  required     pam_selinux.so multiple
+
+# Standard Un*x password updating.
+@include common-password
diff --git a/debian/openssh-server.templates b/debian/openssh-server.templates
new file mode 100644
index 000000000..6c7d3999d
--- /dev/null
+++ b/debian/openssh-server.templates
@@ -0,0 +1,68 @@
+# These templates have been reviewed by the debian-l10n-english
+# team
+#
+# If modifications/additions/rewording are needed, please ask
+# for an advice to debian-l10n-english@lists.debian.org
+#
+# Even minor modifications require translation updates and such
+# changes should be coordinated with translators and reviewers.
+#
+Template: ssh/use_old_init_script
+Type: boolean
+Default: false
+_Description: Do you want to risk killing active SSH sessions?
+ The currently installed version of /etc/init.d/ssh is likely to kill
+ all running sshd instances. If you are doing this upgrade via an SSH
+ session, you're likely to be disconnected and leave the upgrade
+ procedure unfinished.
+ .
+ This can be fixed by manually adding "--pidfile /var/run/sshd.pid" to
+ the start-stop-daemon line in the stop section of the file.
+
+Template: ssh/encrypted_host_key_but_no_keygen
+Type: note
+_Description: New host key mandatory
+ The current host key, in /etc/ssh/ssh_host_key, is encrypted with the
+ IDEA algorithm. OpenSSH can not handle this host key file, and the
+ ssh-keygen utility from the old (non-free) SSH installation does not
+ appear to be available.
+ .
+ You need to manually generate a new host key.
+
+Template: ssh/disable_cr_auth
+Type: boolean
+Default: false
+_Description: Disable challenge-response authentication?
+ Password authentication appears to be disabled in the current OpenSSH
+ server configuration. In order to prevent users from logging in using
+ passwords (perhaps using only public key authentication instead) with
+ recent versions of OpenSSH, you must disable challenge-response
+ authentication, or else ensure that your PAM configuration does not allow
+ Unix password file authentication.
+ .
+ If you disable challenge-response authentication, then users will not be
+ able to log in using passwords. If you leave it enabled (the default
+ answer), then the 'PasswordAuthentication no' option will have no useful
+ effect unless you also adjust your PAM configuration in /etc/pam.d/ssh.
+
+Template: ssh/vulnerable_host_keys
+Type: note
+#flag:translate!:5
+_Description: Vulnerable host keys will be regenerated
+ Some of the OpenSSH server host keys on this system were generated with a
+ version of OpenSSL that had a broken random number generator. As a result,
+ these host keys are from a well-known set, are subject to brute-force
+ attacks, and must be regenerated.
+ .
+ Users of this system should be informed of this change, as they will be
+ prompted about the host key change the next time they log in. Use
+ 'ssh-keygen -l -f HOST_KEY_FILE' after the upgrade to print the
+ fingerprints of the new host keys.
+ .
+ The affected host keys are:
+ .
+ ${HOST_KEYS}
+ .
+ User keys may also be affected by this problem. The 'ssh-vulnkey' command
+ may be used as a partial test for this. See
+ /usr/share/doc/openssh-server/README.compromised-keys.gz for more details.
diff --git a/debian/openssh-server.ufw.profile b/debian/openssh-server.ufw.profile
new file mode 100644
index 000000000..9bbe906bc
--- /dev/null
+++ b/debian/openssh-server.ufw.profile
@@ -0,0 +1,4 @@
+[OpenSSH]
+title=Secure shell server, an rshd replacement
+description=OpenSSH is a free implementation of the Secure Shell protocol.
+ports=22/tcp
diff --git a/debian/patches/authorized-keys-man-symlink.patch b/debian/patches/authorized-keys-man-symlink.patch
new file mode 100644
index 000000000..34535f001
--- /dev/null
+++ b/debian/patches/authorized-keys-man-symlink.patch
@@ -0,0 +1,18 @@
+Description: Install authorized_keys(5) as a symlink to sshd(8)
+Author: Tomas Pospisek <tpo_deb@sourcepole.ch>
+Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1720
+Bug-Debian: http://bugs.debian.org/441817
+Last-Update: 2010-03-01
+
+Index: b/Makefile.in
+===================================================================
+--- a/Makefile.in
++++ b/Makefile.in
+@@ -284,6 +284,7 @@
+        $(INSTALL) -m 644 sshd_config.5.out $(DESTDIR)$(mandir)/$(mansubdir)5/sshd_config.5
+        $(INSTALL) -m 644 ssh_config.5.out $(DESTDIR)$(mandir)/$(mansubdir)5/ssh_config.5
+        $(INSTALL) -m 644 sshd.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sshd.8
++       ln -s ../$(mansubdir)8/sshd.8 $(DESTDIR)$(mandir)/$(mansubdir)5/authorized_keys.5
+        if [ ! -z "$(INSTALL_SSH_RAND_HELPER)" ]; then \
+                $(INSTALL) -m 644 ssh-rand-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-rand-helper.8 ; \
+        fi
diff --git a/debian/patches/debian-banner.patch b/debian/patches/debian-banner.patch
new file mode 100644
index 000000000..b0761420e
--- /dev/null
+++ b/debian/patches/debian-banner.patch
@@ -0,0 +1,99 @@
+Description: Add DebianBanner server configuration option
+ Setting this to "no" causes sshd to omit the Debian revision from its
+ initial protocol handshake, for those scared by package-versioning.patch.
+Author: Kees Cook <kees@debian.org>
+Bug-Debian: http://bugs.debian.org/562048
+Forwarded: not-needed
+Last-Update: 2010-02-28
+
+Index: b/servconf.c
+===================================================================
+--- a/servconf.c
++++ b/servconf.c
+@@ -136,6 +136,7 @@
+        options->revoked_keys_file = NULL;
+        options->trusted_user_ca_keys = NULL;
+        options->authorized_principals_file = NULL;
++       options->debian_banner = -1;
+ }
+ 
+ void
+@@ -278,6 +279,8 @@
+                options->permit_tun = SSH_TUNMODE_NO;
+        if (options->zero_knowledge_password_authentication == -1)
+                options->zero_knowledge_password_authentication = 0;
++       if (options->debian_banner == -1)
++               options->debian_banner = 1;
+ 
+        /* Turn privilege separation on by default */
+        if (use_privsep == -1)
+@@ -326,6 +329,7 @@
+        sUsePrivilegeSeparation, sAllowAgentForwarding,
+        sZeroKnowledgePasswordAuthentication, sHostCertificate,
+        sRevokedKeys, sTrustedUserCAKeys, sAuthorizedPrincipalsFile,
++       sDebianBanner,
+        sDeprecated, sUnsupported
+ } ServerOpCodes;
+ 
+@@ -459,6 +463,7 @@
+        { "revokedkeys", sRevokedKeys, SSHCFG_ALL },
+        { "trustedusercakeys", sTrustedUserCAKeys, SSHCFG_ALL },
+        { "authorizedprincipalsfile", sAuthorizedPrincipalsFile, SSHCFG_ALL },
++       { "debianbanner", sDebianBanner, SSHCFG_GLOBAL },
+        { NULL, sBadOption, 0 }
+ };
+ 
+@@ -1392,6 +1397,10 @@
+                charptr = &options->revoked_keys_file;
+                goto parse_filename;
+ 
++       case sDebianBanner:
++               intptr = &options->debian_banner;
++               goto parse_int;
++
+        case sDeprecated:
+                logit("%s line %d: Deprecated option %s",
+                    filename, linenum, arg);
+Index: b/servconf.h
+===================================================================
+--- a/servconf.h
++++ b/servconf.h
+@@ -157,6 +157,8 @@
+ 
+        int     num_permitted_opens;
+ 
++       int     debian_banner;
++
+        char   *chroot_directory;
+        char   *revoked_keys_file;
+        char   *trusted_user_ca_keys;
+Index: b/sshd.c
+===================================================================
+--- a/sshd.c
++++ b/sshd.c
+@@ -422,7 +422,8 @@
+                minor = PROTOCOL_MINOR_1;
+        }
+        snprintf(buf, sizeof buf, "SSH-%d.%d-%.100s%s", major, minor,
+-           SSH_RELEASE, newline);
++           options.debian_banner ? SSH_RELEASE : SSH_RELEASE_MINIMUM,
++           newline);
+        server_version_string = xstrdup(buf);
+ 
+        /* Send our protocol version identification. */
+Index: b/sshd_config.5
+===================================================================
+--- a/sshd_config.5
++++ b/sshd_config.5
+@@ -340,6 +340,11 @@
+ .Dq no .
+ The default is
+ .Dq delayed .
++.It Cm DebianBanner
++Specifies whether the distribution-specified extra version suffix is
++included during initial protocol handshake.
++The default is
++.Dq yes .
+ .It Cm DenyGroups
+ This keyword can be followed by a list of group name patterns, separated
+ by spaces.
diff --git a/debian/patches/debian-config.patch b/debian/patches/debian-config.patch
new file mode 100644
index 000000000..2fe365639
--- /dev/null
+++ b/debian/patches/debian-config.patch
@@ -0,0 +1,146 @@
+Description: Various Debian-specific configuration changes
+ ssh: Enable ForwardX11Trusted, returning to earlier semantics which cause
+ fewer problems with existing setups (http://bugs.debian.org/237021).
+ .
+ ssh: Set 'SendEnv LANG LC_*' by default (http://bugs.debian.org/264024).
+ .
+ ssh: Enable HashKnownHosts by default to try to limit the spread of ssh
+ worms.
+ .
+ ssh: Enable GSSAPIAuthentication and disable GSSAPIDelegateCredentials by
+ default.
+ .
+ sshd: Refer to /usr/share/doc/openssh-server/README.Debian.gz alongside
+ PermitRootLogin default.
+ .
+ Document all of this, along with several sshd defaults set in
+ debian/openssh-server.postinst.
+Author: Colin Watson <cjwatson@debian.org>
+Author: Russ Allbery <rra@debian.org>
+Forwarded: not-needed
+Last-Update: 2010-02-28
+
+Index: b/readconf.c
+===================================================================
+--- a/readconf.c
++++ b/readconf.c
+@@ -1179,7 +1179,7 @@
+        if (options->forward_x11 == -1)
+                options->forward_x11 = 0;
+        if (options->forward_x11_trusted == -1)
+-               options->forward_x11_trusted = 0;
++               options->forward_x11_trusted = 1;
+        if (options->forward_x11_timeout == -1)
+                options->forward_x11_timeout = 1200;
+        if (options->exit_on_forward_failure == -1)
+Index: b/ssh_config
+===================================================================
+--- a/ssh_config
++++ b/ssh_config
+@@ -17,9 +17,10 @@
+ # list of available options, their meanings and defaults, please see the
+ # ssh_config(5) man page.
+ 
+-# Host *
++Host *
+ #   ForwardAgent no
+ #   ForwardX11 no
++#   ForwardX11Trusted yes
+ #   RhostsRSAAuthentication no
+ #   RSAAuthentication yes
+ #   PasswordAuthentication yes
+@@ -47,3 +48,7 @@
+ #   PermitLocalCommand no
+ #   VisualHostKey no
+ #   ProxyCommand ssh -q -W %h:%p gateway.example.com
++    SendEnv LANG LC_*
++    HashKnownHosts yes
++    GSSAPIAuthentication yes
++    GSSAPIDelegateCredentials no
+Index: b/ssh_config.5
+===================================================================
+--- a/ssh_config.5
++++ b/ssh_config.5
+@@ -72,6 +72,22 @@
+ host-specific declarations should be given near the beginning of the
+ file, and general defaults at the end.
+ .Pp
++Note that the Debian
++.Ic openssh-client
++package sets several options as standard in
++.Pa /etc/ssh/ssh_config
++which are not the default in
++.Xr ssh 1 :
++.Pp
++.Bl -bullet -offset indent -compact
++.It
++.Cm SendEnv No LANG LC_*
++.It
++.Cm HashKnownHosts No yes
++.It
++.Cm GSSAPIAuthentication No yes
++.El
++.Pp
+ The configuration file has the following format:
+ .Pp
+ Empty lines and lines starting with
+@@ -483,7 +499,8 @@
+ Remote clients will be refused access after this time.
+ .Pp
+ The default is
+-.Dq no .
++.Dq yes
++(Debian-specific).
+ .Pp
+ See the X11 SECURITY extension specification for full details on
+ the restrictions imposed on untrusted clients.
+Index: b/sshd_config
+===================================================================
+--- a/sshd_config
++++ b/sshd_config
+@@ -36,6 +36,7 @@
+ # Authentication:
+ 
+ #LoginGraceTime 2m
++# See /usr/share/doc/openssh-server/README.Debian.gz.
+ #PermitRootLogin yes
+ #StrictModes yes
+ #MaxAuthTries 6
+Index: b/sshd_config.5
+===================================================================
+--- a/sshd_config.5
++++ b/sshd_config.5
+@@ -58,6 +58,33 @@
+ .Pq \&"
+ in order to represent arguments containing spaces.
+ .Pp
++Note that the Debian
++.Ic openssh-server
++package sets several options as standard in
++.Pa /etc/ssh/sshd_config
++which are not the default in
++.Xr sshd 8 .
++The exact list depends on whether the package was installed fresh or
++upgraded from various possible previous versions, but includes at least the
++following:
++.Pp
++.Bl -bullet -offset indent -compact
++.It
++.Cm Protocol No 2
++.It
++.Cm ChallengeResponseAuthentication No no
++.It
++.Cm X11Forwarding No yes
++.It
++.Cm PrintMotd No no
++.It
++.Cm AcceptEnv No LANG LC_*
++.It
++.Cm Subsystem No sftp /usr/lib/openssh/sftp-server
++.It
++.Cm UsePAM No yes
++.El
++.Pp
+ The possible
+ keywords and their meanings are as follows (note that
+ keywords are case-insensitive and arguments are case-sensitive):
diff --git a/debian/patches/dnssec-sshfp.patch b/debian/patches/dnssec-sshfp.patch
new file mode 100644
index 000000000..a71b42f0f
--- /dev/null
+++ b/debian/patches/dnssec-sshfp.patch
@@ -0,0 +1,82 @@
+Description: Force use of DNSSEC even if "options edns0" isn't in resolv.conf
+ This allows SSHFP DNS records to be verified if glibc 2.11 is installed.
+Origin: vendor, https://cvs.fedoraproject.org/viewvc/F-12/openssh/openssh-5.2p1-edns.patch?revision=1.1&view=markup
+Bug: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=572049
+Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=572049
+Last-Update: 2010-04-06
+
+Index: b/dns.c
+===================================================================
+--- a/dns.c
++++ b/dns.c
+@@ -176,6 +176,7 @@
+ {
+        u_int counter;
+        int result;
++       unsigned int rrset_flags = 0;
+        struct rrsetinfo *fingerprints = NULL;
+ 
+        u_int8_t hostkey_algorithm;
+@@ -199,8 +200,19 @@
+                return -1;
+        }
+ 
++       /*
++        * Original getrrsetbyname function, found on OpenBSD for example,
++        * doesn't accept any flag and prerequisite for obtaining AD bit in
++        * DNS response is set by "options edns0" in resolv.conf.
++        *
++        * Our version is more clever and use RRSET_FORCE_EDNS0 flag.
++        */
++#ifndef HAVE_GETRRSETBYNAME
++       rrset_flags |= RRSET_FORCE_EDNS0;
++#endif
+        result = getrrsetbyname(hostname, DNS_RDATACLASS_IN,
+-           DNS_RDATATYPE_SSHFP, 0, &fingerprints);
++           DNS_RDATATYPE_SSHFP, rrset_flags, &fingerprints);
++
+        if (result) {
+                verbose("DNS lookup error: %s", dns_result_totext(result));
+                return -1;
+Index: b/openbsd-compat/getrrsetbyname.c
+===================================================================
+--- a/openbsd-compat/getrrsetbyname.c
++++ b/openbsd-compat/getrrsetbyname.c
+@@ -209,8 +209,8 @@
+                goto fail;
+        }
+ 
+-       /* don't allow flags yet, unimplemented */
+-       if (flags) {
++       /* Allow RRSET_FORCE_EDNS0 flag only. */
++       if ((flags & !RRSET_FORCE_EDNS0) != 0) {
+                result = ERRSET_INVAL;
+                goto fail;
+        }
+@@ -226,9 +226,9 @@
+ #endif /* DEBUG */
+ 
+ #ifdef RES_USE_DNSSEC
+-       /* turn on DNSSEC if EDNS0 is configured */
+-       if (_resp->options & RES_USE_EDNS0)
+-               _resp->options |= RES_USE_DNSSEC;
++       /* turn on DNSSEC if required  */
++       if (flags & RRSET_FORCE_EDNS0)
++               _resp->options |= (RES_USE_EDNS0|RES_USE_DNSSEC);
+ #endif /* RES_USE_DNSEC */
+ 
+        /* make query */
+Index: b/openbsd-compat/getrrsetbyname.h
+===================================================================
+--- a/openbsd-compat/getrrsetbyname.h
++++ b/openbsd-compat/getrrsetbyname.h
+@@ -72,6 +72,9 @@
+ #ifndef RRSET_VALIDATED
+ # define RRSET_VALIDATED       1
+ #endif
++#ifndef RRSET_FORCE_EDNS0
++# define RRSET_FORCE_EDNS0     0x0001
++#endif
+ 
+ /*
+  * Return codes for getrrsetbyname()
diff --git a/debian/patches/doc-hash-tab-completion.patch b/debian/patches/doc-hash-tab-completion.patch
new file mode 100644
index 000000000..fb522013c
--- /dev/null
+++ b/debian/patches/doc-hash-tab-completion.patch
@@ -0,0 +1,20 @@
+Description: Document that HashKnownHosts may break tab-completion
+Author: Colin Watson <cjwatson@debian.org>
+Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1727
+Bug-Debian: http://bugs.debian.org/430154
+Last-Update: 2010-03-01
+
+Index: b/ssh_config.5
+===================================================================
+--- a/ssh_config.5
++++ b/ssh_config.5
+@@ -562,6 +562,9 @@
+ will not be converted automatically,
+ but may be manually hashed using
+ .Xr ssh-keygen 1 .
++Use of this option may break facilities such as tab-completion that rely
++on being able to read unhashed host names from
++.Pa ~/.ssh/known_hosts .
+ .It Cm HostbasedAuthentication
+ Specifies whether to try rhosts based authentication with public key
+ authentication.
diff --git a/debian/patches/gnome-ssh-askpass2-icon.patch b/debian/patches/gnome-ssh-askpass2-icon.patch
new file mode 100644
index 000000000..96bbf3a09
--- /dev/null
+++ b/debian/patches/gnome-ssh-askpass2-icon.patch
@@ -0,0 +1,18 @@
+Description: Give the ssh-askpass-gnome window a default icon
+Author: Vincent Untz <vuntz@ubuntu.com>
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/27152
+Last-Update: 2010-02-28
+
+Index: b/contrib/gnome-ssh-askpass2.c
+===================================================================
+--- a/contrib/gnome-ssh-askpass2.c
++++ b/contrib/gnome-ssh-askpass2.c
+@@ -209,6 +209,8 @@
+ 
+        gtk_init(&argc, &argv);
+ 
++       gtk_window_set_default_icon_from_file ("/usr/share/pixmaps/ssh-askpass-gnome.png", NULL);
++
+        if (argc > 1) {
+                message = g_strjoinv(" ", argv + 1);
+        } else {
diff --git a/debian/patches/gssapi-autoconf.patch b/debian/patches/gssapi-autoconf.patch
new file mode 100644
index 000000000..d88382dcb
--- /dev/null
+++ b/debian/patches/gssapi-autoconf.patch
@@ -0,0 +1,29 @@
+Description: Update config.h.in following GSSAPI patch
+Author: Colin Watson <cjwatson@debian.org>
+Forwarded: not-needed
+Last-Updated: 2010-02-27
+
+Index: b/config.h.in
+===================================================================
+--- a/config.h.in
++++ b/config.h.in
+@@ -1387,6 +1387,9 @@
+ /* Use btmp to log bad logins */
+ #undef USE_BTMP
+ 
++/* platform uses an in-memory credentials cache */
++#undef USE_CCAPI
++
+ /* Use libedit for sftp */
+ #undef USE_LIBEDIT
+ 
+@@ -1399,6 +1402,9 @@
+ /* Use PIPES instead of a socketpair() */
+ #undef USE_PIPES
+ 
++/* platform has the Security Authorization Session API */
++#undef USE_SECURITY_SESSION_API
++
+ /* Define if you have Solaris process contracts */
+ #undef USE_SOLARIS_PROCESS_CONTRACTS
+ 
diff --git a/debian/patches/gssapi-compat.patch b/debian/patches/gssapi-compat.patch
new file mode 100644
index 000000000..b93134933
--- /dev/null
+++ b/debian/patches/gssapi-compat.patch
@@ -0,0 +1,33 @@
+Description: Compatibility with old GSSAPI option names
+ These options were supported by the old ssh-krb5 package in Debian.
+ .
+ Forwarded to Simon Wilkinson for inclusion in the GSSAPI patch.
+Author: Colin Watson <cjwatson@debian.org>
+Forwarded: yes
+Last-Updated: 2010-03-01
+
+Index: b/servconf.c
+===================================================================
+--- a/servconf.c
++++ b/servconf.c
+@@ -381,16 +381,20 @@
+ #ifdef GSSAPI
+        { "gssapiauthentication", sGssAuthentication, SSHCFG_ALL },
+        { "gssapicleanupcredentials", sGssCleanupCreds, SSHCFG_GLOBAL },
++       { "gssapicleanupcreds", sGssCleanupCreds, SSHCFG_GLOBAL },
+        { "gssapistrictacceptorcheck", sGssStrictAcceptor, SSHCFG_GLOBAL },
+        { "gssapikeyexchange", sGssKeyEx, SSHCFG_GLOBAL },
+        { "gssapistorecredentialsonrekey", sGssStoreRekey, SSHCFG_GLOBAL },
+ #else
+        { "gssapiauthentication", sUnsupported, SSHCFG_ALL },
+        { "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL },
++       { "gssapicleanupcreds", sUnsupported, SSHCFG_GLOBAL },
+        { "gssapistrictacceptorcheck", sUnsupported, SSHCFG_GLOBAL },
+        { "gssapikeyexchange", sUnsupported, SSHCFG_GLOBAL },
+        { "gssapistorecredentialsonrekey", sUnsupported, SSHCFG_GLOBAL },
+ #endif
++       { "gssusesessionccache", sUnsupported, SSHCFG_GLOBAL },
++       { "gssapiusesessioncredcache", sUnsupported, SSHCFG_GLOBAL },
+        { "passwordauthentication", sPasswordAuthentication, SSHCFG_ALL },
+        { "kbdinteractiveauthentication", sKbdInteractiveAuthentication, SSHCFG_ALL },
+        { "challengeresponseauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL },
diff --git a/debian/patches/gssapi-dump.patch b/debian/patches/gssapi-dump.patch
new file mode 100644
index 000000000..0969c59b4
--- /dev/null
+++ b/debian/patches/gssapi-dump.patch
@@ -0,0 +1,24 @@
+Description: GSSAPI configuration dump fixes
+ Add GSSAPIKeyExchange, GSSAPIStrictAcceptorCheck, and
+ GSSAPIStoreCredentialsOnRekey to sshd -T configuration dump.
+ .
+ Forwarded to Simon Wilkinson for inclusion in the GSSAPI patch.
+Author: Colin Watson <cjwatson@debian.org>
+Forwarded: yes
+Last-Updated: 2010-02-27
+
+Index: b/servconf.c
+===================================================================
+--- a/servconf.c
++++ b/servconf.c
+@@ -1688,7 +1688,10 @@
+ #endif
+ #ifdef GSSAPI
+        dump_cfg_fmtint(sGssAuthentication, o->gss_authentication);
++       dump_cfg_fmtint(sGssKeyEx, o->gss_keyex);
+        dump_cfg_fmtint(sGssCleanupCreds, o->gss_cleanup_creds);
++       dump_cfg_fmtint(sGssStrictAcceptor, o->gss_strict_acceptor);
++       dump_cfg_fmtint(sGssStoreRekey, o->gss_store_rekey);
+ #endif
+ #ifdef JPAKE
+        dump_cfg_fmtint(sZeroKnowledgePasswordAuthentication,
diff --git a/debian/patches/gssapi.patch b/debian/patches/gssapi.patch
new file mode 100644
index 000000000..778c23023
--- /dev/null
+++ b/debian/patches/gssapi.patch
@@ -0,0 +1,2991 @@
+Description: GSSAPI key exchange support
+ This patch has been rejected upstream: "None of the OpenSSH developers are
+ in favour of adding this, and this situation has not changed for several
+ years.  This is not a slight on Simon's patch, which is of fine quality,
+ but just that a) we don't trust GSSAPI implementations that much and b) we
+ don't like adding new KEX since they are pre-auth attack surface.  This one
+ is particularly scary, since it requires hooks out to typically root-owned
+ system resources."
+ .
+ However, quite a lot of people rely on this in Debian, and it's better to
+ have it merged into the main openssh package rather than having separate
+ -krb5 packages (as we used to have).  It seems to have a generally good
+ security history.
+Author: Simon Wilkinson <simon@sxw.org.uk>
+Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1242
+Last-Updated: 2010-02-27
+
+Index: b/ChangeLog.gssapi
+===================================================================
+--- /dev/null
++++ b/ChangeLog.gssapi
+@@ -0,0 +1,103 @@
++20100124
++  - [ sshconnect2.c ]
++    Adapt to deal with additional element in Authmethod structure. Thanks to
++    Colin Wilson
++  - [ clientloop.c ]
++    Protect credentials updated code with suitable #ifdefs. Thanks to Colin
++    Wilson
++
++20090615
++  - [ gss-genr.c gss-serv.c kexgssc.c kexgsss.c monitor.c sshconnect2.c
++      sshd.c ]
++    Fix issues identified by Greg Hudson following a code review
++       Check return value of gss_indicate_mechs
++       Protect GSSAPI calls in monitor, so they can only be used if enabled
++       Check return values of bignum functions in key exchange
++       Use BN_clear_free to clear other side's DH value
++       Make ssh_gssapi_id_kex more robust
++       Only configure kex table pointers if GSSAPI is enabled
++       Don't leak mechanism list, or gss mechanism list
++       Cast data.length before printing
++       If serverkey isn't provided, use an empty string, rather than NULL
++
++20090201
++  - [ gss-genr.c gss-serv.c kex.h kexgssc.c readconf.c readconf.h ssh-gss.h
++      ssh_config.5 sshconnet2.c ]
++    Add support for the GSSAPIClientIdentity option, which allows the user
++    to specify which GSSAPI identity to use to contact a given server
++
++20080404
++  - [ gss-serv.c ]
++    Add code to actually implement GSSAPIStrictAcceptCheck, which had somehow
++    been omitted from a previous version of this patch. Reported by Borislav
++    Stoichkov
++
++20070317
++  - [ gss-serv-krb5.c ]
++    Remove C99ism, where new_ccname was being declared in the middle of a 
++    function
++
++20061220
++  - [ servconf.c ]
++    Make default for GSSAPIStrictAcceptorCheck be Yes, to match previous, and 
++    documented, behaviour. Reported by Dan Watson.
++
++20060910
++  - [ gss-genr.c kexgssc.c kexgsss.c kex.h monitor.c sshconnect2.c sshd.c
++      ssh-gss.h ]
++    add support for gss-group14-sha1 key exchange mechanisms
++  - [ gss-serv.c servconf.c servconf.h sshd_config sshd_config.5 ]
++    Add GSSAPIStrictAcceptorCheck option to allow the disabling of
++    acceptor principal checking on multi-homed machines.
++    <Bugzilla #928>
++  - [ sshd_config ssh_config ]
++    Add settings for GSSAPIKeyExchange and GSSAPITrustDNS to the sample
++    configuration files
++  - [ kexgss.c kegsss.c sshconnect2.c sshd.c ]
++    Code cleanup. Replace strlen/xmalloc/snprintf sequences with xasprintf()
++    Limit length of error messages displayed by client
++
++20060909
++  - [ gss-genr.c gss-serv.c ]
++    move ssh_gssapi_acquire_cred() and ssh_gssapi_server_ctx to be server
++    only, where they belong 
++    <Bugzilla #1225>
++
++20060829
++  - [ gss-serv-krb5.c ]
++    Fix CCAPI credentials cache name when creating KRB5CCNAME environment 
++    variable
++
++20060828
++  - [ gss-genr.c ]
++    Avoid Heimdal context freeing problem
++    <Fixed upstream 20060829>
++
++20060818
++  - [ gss-genr.c ssh-gss.h sshconnect2.c ]
++    Make sure that SPENGO is disabled 
++    <Bugzilla #1218 - Fixed upstream 20060818>
++
++20060421
++  - [ gssgenr.c, sshconnect2.c ]
++    a few type changes (signed versus unsigned, int versus size_t) to
++    fix compiler errors/warnings 
++    (from jbasney AT ncsa.uiuc.edu)
++  - [ kexgssc.c, sshconnect2.c ]
++    fix uninitialized variable warnings
++    (from jbasney AT ncsa.uiuc.edu)
++  - [ gssgenr.c ]
++    pass oid to gss_display_status (helpful when using GSSAPI mechglue)
++    (from jbasney AT ncsa.uiuc.edu)
++    <Bugzilla #1220 >
++  - [ gss-serv-krb5.c ]
++    #ifdef HAVE_GSSAPI_KRB5 should be #ifdef HAVE_GSSAPI_KRB5_H
++    (from jbasney AT ncsa.uiuc.edu)
++    <Fixed upstream 20060304>
++  - [ readconf.c, readconf.h, ssh_config.5, sshconnect2.c 
++    add client-side GssapiKeyExchange option
++    (from jbasney AT ncsa.uiuc.edu)
++  - [ sshconnect2.c ]
++    add support for GssapiTrustDns option for gssapi-with-mic
++    (from jbasney AT ncsa.uiuc.edu)
++    <gssapi-with-mic support is Bugzilla #1008>
+Index: b/Makefile.in
+===================================================================
+--- a/Makefile.in
++++ b/Makefile.in
+@@ -74,7 +74,7 @@
+        monitor_fdpass.o rijndael.o ssh-dss.o ssh-rsa.o dh.o kexdh.o \
+        kexgex.o kexdhc.o kexgexc.o msg.o progressmeter.o dns.o \
+        entropy.o gss-genr.o umac.o jpake.o schnorr.o \
+-       ssh-pkcs11.o
++       ssh-pkcs11.o kexgssc.o
+ 
+ SSHOBJS= ssh.o readconf.o clientloop.o sshtty.o \
+        sshconnect.o sshconnect1.o sshconnect2.o mux.o \
+@@ -88,7 +88,7 @@
+        auth2-none.o auth2-passwd.o auth2-pubkey.o auth2-jpake.o \
+        monitor_mm.o monitor.o monitor_wrap.o kexdhs.o kexgexs.o \
+        auth-krb5.o \
+-       auth2-gss.o gss-serv.o gss-serv-krb5.o \
++       auth2-gss.o gss-serv.o gss-serv-krb5.o kexgsss.o\
+        loginrec.o auth-pam.o auth-shadow.o auth-sia.o md5crypt.o \
+        audit.o audit-bsm.o platform.o sftp-server.o sftp-common.o \
+        roaming_common.o roaming_serv.o
+Index: b/auth-krb5.c
+===================================================================
+--- a/auth-krb5.c
++++ b/auth-krb5.c
+@@ -170,8 +170,13 @@
+ 
+        len = strlen(authctxt->krb5_ticket_file) + 6;
+        authctxt->krb5_ccname = xmalloc(len);
++#ifdef USE_CCAPI
++       snprintf(authctxt->krb5_ccname, len, "API:%s",
++           authctxt->krb5_ticket_file);
++#else
+        snprintf(authctxt->krb5_ccname, len, "FILE:%s",
+            authctxt->krb5_ticket_file);
++#endif
+ 
+ #ifdef USE_PAM
+        if (options.use_pam)
+@@ -226,15 +231,22 @@
+ #ifndef HEIMDAL
+ krb5_error_code
+ ssh_krb5_cc_gen(krb5_context ctx, krb5_ccache *ccache) {
+-       int tmpfd, ret;
++       int ret;
+        char ccname[40];
+        mode_t old_umask;
++#ifdef USE_CCAPI
++       char cctemplate[] = "API:krb5cc_%d";
++#else
++       char cctemplate[] = "FILE:/tmp/krb5cc_%d_XXXXXXXXXX";
++       int tmpfd;
++#endif
+ 
+        ret = snprintf(ccname, sizeof(ccname),
+-           "FILE:/tmp/krb5cc_%d_XXXXXXXXXX", geteuid());
++           cctemplate, geteuid());
+        if (ret < 0 || (size_t)ret >= sizeof(ccname))
+                return ENOMEM;
+ 
++#ifndef USE_CCAPI
+        old_umask = umask(0177);
+        tmpfd = mkstemp(ccname + strlen("FILE:"));
+        umask(old_umask);
+@@ -249,6 +261,7 @@
+                return errno;
+        }
+        close(tmpfd);
++#endif
+ 
+        return (krb5_cc_resolve(ctx, ccname, ccache));
+ }
+Index: b/auth.h
+===================================================================
+--- a/auth.h
++++ b/auth.h
+@@ -53,6 +53,7 @@
+        int              valid;         /* user exists and is allowed to login */
+        int              attempt;
+        int              failures;
++       int              server_caused_failure; 
+        int              force_pwchange;
+        char            *user;          /* username sent by the client */
+        char            *service;
+Index: b/auth2-gss.c
+===================================================================
+--- a/auth2-gss.c
++++ b/auth2-gss.c
+@@ -1,7 +1,7 @@
+ /* $OpenBSD: auth2-gss.c,v 1.16 2007/10/29 00:52:45 dtucker Exp $ */
+ 
+ /*
+- * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
++ * Copyright (c) 2001-2007 Simon Wilkinson. All rights reserved.
+  *
+  * Redistribution and use in source and binary forms, with or without
+  * modification, are permitted provided that the following conditions
+@@ -52,6 +52,40 @@
+ static void input_gssapi_exchange_complete(int type, u_int32_t plen, void *ctxt);
+ static void input_gssapi_errtok(int, u_int32_t, void *);
+ 
++/* 
++ * The 'gssapi_keyex' userauth mechanism.
++ */
++static int
++userauth_gsskeyex(Authctxt *authctxt)
++{
++       int authenticated = 0;
++       Buffer b;
++       gss_buffer_desc mic, gssbuf;
++       u_int len;
++
++       mic.value = packet_get_string(&len);
++       mic.length = len;
++
++       packet_check_eom();
++
++       ssh_gssapi_buildmic(&b, authctxt->user, authctxt->service,
++           "gssapi-keyex");
++
++       gssbuf.value = buffer_ptr(&b);
++       gssbuf.length = buffer_len(&b);
++
++       /* gss_kex_context is NULL with privsep, so we can't check it here */
++       if (!GSS_ERROR(PRIVSEP(ssh_gssapi_checkmic(gss_kex_context, 
++           &gssbuf, &mic))))
++               authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user,
++                   authctxt->pw));
++       
++       buffer_free(&b);
++       xfree(mic.value);
++
++       return (authenticated);
++}
++
+ /*
+  * We only support those mechanisms that we know about (ie ones that we know
+  * how to check local user kuserok and the like)
+@@ -102,6 +136,7 @@
+ 
+        if (!present) {
+                xfree(doid);
++               authctxt->server_caused_failure = 1;
+                return (0);
+        }
+ 
+@@ -109,6 +144,7 @@
+                if (ctxt != NULL)
+                        ssh_gssapi_delete_ctx(&ctxt);
+                xfree(doid);
++               authctxt->server_caused_failure = 1;
+                return (0);
+        }
+ 
+@@ -242,7 +278,8 @@
+ 
+        packet_check_eom();
+ 
+-       authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user));
++       authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user,
++           authctxt->pw));
+ 
+        authctxt->postponed = 0;
+        dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
+@@ -277,7 +314,8 @@
+        gssbuf.length = buffer_len(&b);
+ 
+        if (!GSS_ERROR(PRIVSEP(ssh_gssapi_checkmic(gssctxt, &gssbuf, &mic))))
+-               authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user));
++               authenticated = 
++                   PRIVSEP(ssh_gssapi_userok(authctxt->user, authctxt->pw));
+        else
+                logit("GSSAPI MIC check failed");
+ 
+@@ -292,6 +330,12 @@
+        userauth_finish(authctxt, authenticated, "gssapi-with-mic");
+ }
+ 
++Authmethod method_gsskeyex = {
++       "gssapi-keyex",
++       userauth_gsskeyex,
++       &options.gss_authentication
++};
++
+ Authmethod method_gssapi = {
+        "gssapi-with-mic",
+        userauth_gssapi,
+Index: b/auth2.c
+===================================================================
+--- a/auth2.c
++++ b/auth2.c
+@@ -69,6 +69,7 @@
+ extern Authmethod method_kbdint;
+ extern Authmethod method_hostbased;
+ #ifdef GSSAPI
++extern Authmethod method_gsskeyex;
+ extern Authmethod method_gssapi;
+ #endif
+ #ifdef JPAKE
+@@ -79,6 +80,7 @@
+        &method_none,
+        &method_pubkey,
+ #ifdef GSSAPI
++       &method_gsskeyex,
+        &method_gssapi,
+ #endif
+ #ifdef JPAKE
+@@ -274,6 +276,7 @@
+ #endif
+ 
+        authctxt->postponed = 0;
++       authctxt->server_caused_failure = 0;
+ 
+        /* try to authenticate user */
+        m = authmethod_lookup(method);
+@@ -346,7 +349,8 @@
+        } else {
+ 
+                /* Allow initial try of "none" auth without failure penalty */
+-               if (authctxt->attempt > 1 || strcmp(method, "none") != 0)
++               if (!authctxt->server_caused_failure &&
++                   (authctxt->attempt > 1 || strcmp(method, "none") != 0))
+                        authctxt->failures++;
+                if (authctxt->failures >= options.max_authtries) {
+ #ifdef SSH_AUDIT_EVENTS
+Index: b/clientloop.c
+===================================================================
+--- a/clientloop.c
++++ b/clientloop.c
+@@ -111,6 +111,10 @@
+ #include "msg.h"
+ #include "roaming.h"
+ 
++#ifdef GSSAPI
++#include "ssh-gss.h"
++#endif
++
+ /* import options */
+ extern Options options;
+ 
+@@ -1483,6 +1487,15 @@
+                /* Do channel operations unless rekeying in progress. */
+                if (!rekeying) {
+                        channel_after_select(readset, writeset);
++
++#ifdef GSSAPI
++                       if (options.gss_renewal_rekey &&
++                           ssh_gssapi_credentials_updated(GSS_C_NO_CONTEXT)) {
++                               debug("credentials updated - forcing rekey");
++                               need_rekeying = 1;
++                       }
++#endif
++
+                        if (need_rekeying || packet_need_rekeying()) {
+                                debug("need rekeying");
+                                xxx_kex->done = 0;
+Index: b/configure.ac
+===================================================================
+--- a/configure.ac
++++ b/configure.ac
+@@ -477,6 +477,30 @@
+            [Use tunnel device compatibility to OpenBSD])
+        AC_DEFINE(SSH_TUN_PREPEND_AF, 1,
+            [Prepend the address family to IP tunnel traffic])
++       AC_MSG_CHECKING(if we have the Security Authorization Session API)
++       AC_TRY_COMPILE([#include <Security/AuthSession.h>],
++               [SessionCreate(0, 0);],
++               [ac_cv_use_security_session_api="yes"
++                AC_DEFINE(USE_SECURITY_SESSION_API, 1, 
++                       [platform has the Security Authorization Session API])
++                LIBS="$LIBS -framework Security"
++                AC_MSG_RESULT(yes)],
++               [ac_cv_use_security_session_api="no"
++                AC_MSG_RESULT(no)])
++       AC_MSG_CHECKING(if we have an in-memory credentials cache)
++       AC_TRY_COMPILE(
++               [#include <Kerberos/Kerberos.h>],
++               [cc_context_t c;
++                (void) cc_initialize (&c, 0, NULL, NULL);],
++               [AC_DEFINE(USE_CCAPI, 1, 
++                       [platform uses an in-memory credentials cache])
++                LIBS="$LIBS -framework Security"
++                AC_MSG_RESULT(yes)
++                if test "x$ac_cv_use_security_session_api" = "xno"; then
++                       AC_MSG_ERROR(*** Need a security framework to use the credentials cache API ***)
++               fi],
++               [AC_MSG_RESULT(no)]
++       )
+        m4_pattern_allow(AU_IPv)
+        AC_CHECK_DECL(AU_IPv4, [], 
+            AC_DEFINE(AU_IPv4, 0, [System only supports IPv4 audit records])
+Index: b/gss-genr.c
+===================================================================
+--- a/gss-genr.c
++++ b/gss-genr.c
+@@ -1,7 +1,7 @@
+ /* $OpenBSD: gss-genr.c,v 1.20 2009/06/22 05:39:28 dtucker Exp $ */
+ 
+ /*
+- * Copyright (c) 2001-2007 Simon Wilkinson. All rights reserved.
++ * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.
+  *
+  * Redistribution and use in source and binary forms, with or without
+  * modification, are permitted provided that the following conditions
+@@ -39,12 +39,167 @@
+ #include "buffer.h"
+ #include "log.h"
+ #include "ssh2.h"
++#include "cipher.h"
++#include "key.h"
++#include "kex.h"
++#include <openssl/evp.h>
+ 
+ #include "ssh-gss.h"
+ 
+ extern u_char *session_id2;
+ extern u_int session_id2_len;
+ 
++typedef struct {
++       char *encoded;
++       gss_OID oid;
++} ssh_gss_kex_mapping;
++
++/*
++ * XXX - It would be nice to find a more elegant way of handling the
++ * XXX   passing of the key exchange context to the userauth routines
++ */
++
++Gssctxt *gss_kex_context = NULL;
++
++static ssh_gss_kex_mapping *gss_enc2oid = NULL;
++
++int 
++ssh_gssapi_oid_table_ok() {
++       return (gss_enc2oid != NULL);
++}
++
++/*
++ * Return a list of the gss-group1-sha1 mechanisms supported by this program
++ *
++ * We test mechanisms to ensure that we can use them, to avoid starting
++ * a key exchange with a bad mechanism
++ */
++
++char *
++ssh_gssapi_client_mechanisms(const char *host, const char *client) {
++       gss_OID_set gss_supported;
++       OM_uint32 min_status;
++
++       if (GSS_ERROR(gss_indicate_mechs(&min_status, &gss_supported)))
++               return NULL;
++
++       return(ssh_gssapi_kex_mechs(gss_supported, ssh_gssapi_check_mechanism,
++           host, client));
++}
++
++char *
++ssh_gssapi_kex_mechs(gss_OID_set gss_supported, ssh_gssapi_check_fn *check,
++    const char *host, const char *client) {
++       Buffer buf;
++       size_t i;
++       int oidpos, enclen;
++       char *mechs, *encoded;
++       u_char digest[EVP_MAX_MD_SIZE];
++       char deroid[2];
++       const EVP_MD *evp_md = EVP_md5();
++       EVP_MD_CTX md;
++
++       if (gss_enc2oid != NULL) {
++               for (i = 0; gss_enc2oid[i].encoded != NULL; i++)
++                       xfree(gss_enc2oid[i].encoded);
++               xfree(gss_enc2oid);
++       }
++
++       gss_enc2oid = xmalloc(sizeof(ssh_gss_kex_mapping) *
++           (gss_supported->count + 1));
++
++       buffer_init(&buf);
++
++       oidpos = 0;
++       for (i = 0; i < gss_supported->count; i++) {
++               if (gss_supported->elements[i].length < 128 &&
++                   (*check)(NULL, &(gss_supported->elements[i]), host, client)) {
++
++                       deroid[0] = SSH_GSS_OIDTYPE;
++                       deroid[1] = gss_supported->elements[i].length;
++
++                       EVP_DigestInit(&md, evp_md);
++                       EVP_DigestUpdate(&md, deroid, 2);
++                       EVP_DigestUpdate(&md,
++                           gss_supported->elements[i].elements,
++                           gss_supported->elements[i].length);
++                       EVP_DigestFinal(&md, digest, NULL);
++
++                       encoded = xmalloc(EVP_MD_size(evp_md) * 2);
++                       enclen = __b64_ntop(digest, EVP_MD_size(evp_md),
++                           encoded, EVP_MD_size(evp_md) * 2);
++
++                       if (oidpos != 0)
++                               buffer_put_char(&buf, ',');
++
++                       buffer_append(&buf, KEX_GSS_GEX_SHA1_ID,
++                           sizeof(KEX_GSS_GEX_SHA1_ID) - 1);
++                       buffer_append(&buf, encoded, enclen);
++                       buffer_put_char(&buf, ',');
++                       buffer_append(&buf, KEX_GSS_GRP1_SHA1_ID, 
++                           sizeof(KEX_GSS_GRP1_SHA1_ID) - 1);
++                       buffer_append(&buf, encoded, enclen);
++                       buffer_put_char(&buf, ',');
++                       buffer_append(&buf, KEX_GSS_GRP14_SHA1_ID,
++                           sizeof(KEX_GSS_GRP14_SHA1_ID) - 1);
++                       buffer_append(&buf, encoded, enclen);
++
++                       gss_enc2oid[oidpos].oid = &(gss_supported->elements[i]);
++                       gss_enc2oid[oidpos].encoded = encoded;
++                       oidpos++;
++               }
++       }
++       gss_enc2oid[oidpos].oid = NULL;
++       gss_enc2oid[oidpos].encoded = NULL;
++
++       buffer_put_char(&buf, '\0');
++
++       mechs = xmalloc(buffer_len(&buf));
++       buffer_get(&buf, mechs, buffer_len(&buf));
++       buffer_free(&buf);
++
++       if (strlen(mechs) == 0) {
++               xfree(mechs);
++               mechs = NULL;
++       }
++       
++       return (mechs);
++}
++
++gss_OID
++ssh_gssapi_id_kex(Gssctxt *ctx, char *name, int kex_type) {
++       int i = 0;
++       
++       switch (kex_type) {
++       case KEX_GSS_GRP1_SHA1:
++               if (strlen(name) < sizeof(KEX_GSS_GRP1_SHA1_ID))
++                       return GSS_C_NO_OID;
++               name += sizeof(KEX_GSS_GRP1_SHA1_ID) - 1;
++               break;
++       case KEX_GSS_GRP14_SHA1:
++               if (strlen(name) < sizeof(KEX_GSS_GRP14_SHA1_ID))
++                       return GSS_C_NO_OID;
++               name += sizeof(KEX_GSS_GRP14_SHA1_ID) - 1;
++               break;
++       case KEX_GSS_GEX_SHA1:
++               if (strlen(name) < sizeof(KEX_GSS_GEX_SHA1_ID))
++                       return GSS_C_NO_OID;
++               name += sizeof(KEX_GSS_GEX_SHA1_ID) - 1;
++               break;
++       default:
++               return GSS_C_NO_OID;
++       }
++
++       while (gss_enc2oid[i].encoded != NULL &&
++           strcmp(name, gss_enc2oid[i].encoded) != 0)
++               i++;
++
++       if (gss_enc2oid[i].oid != NULL && ctx != NULL)
++               ssh_gssapi_set_oid(ctx, gss_enc2oid[i].oid);
++
++       return gss_enc2oid[i].oid;
++}
++
+ /* Check that the OID in a data stream matches that in the context */
+ int
+ ssh_gssapi_check_oid(Gssctxt *ctx, void *data, size_t len)
+@@ -197,7 +352,7 @@
+        }
+ 
+        ctx->major = gss_init_sec_context(&ctx->minor,
+-           GSS_C_NO_CREDENTIAL, &ctx->context, ctx->name, ctx->oid,
++           ctx->client_creds, &ctx->context, ctx->name, ctx->oid,
+            GSS_C_MUTUAL_FLAG | GSS_C_INTEG_FLAG | deleg_flag,
+            0, NULL, recv_tok, NULL, send_tok, flags, NULL);
+ 
+@@ -227,8 +382,42 @@
+ }
+ 
+ OM_uint32
++ssh_gssapi_client_identity(Gssctxt *ctx, const char *name)
++{
++       gss_buffer_desc gssbuf;
++       gss_name_t gssname;
++       OM_uint32 status;
++       gss_OID_set oidset;
++
++       gssbuf.value = (void *) name;
++       gssbuf.length = strlen(gssbuf.value);
++
++       gss_create_empty_oid_set(&status, &oidset);
++       gss_add_oid_set_member(&status, ctx->oid, &oidset);
++
++       ctx->major = gss_import_name(&ctx->minor, &gssbuf,
++           GSS_C_NT_USER_NAME, &gssname);
++
++       if (!ctx->major)
++               ctx->major = gss_acquire_cred(&ctx->minor, 
++                   gssname, 0, oidset, GSS_C_INITIATE, 
++                   &ctx->client_creds, NULL, NULL);
++
++       gss_release_name(&status, &gssname);
++       gss_release_oid_set(&status, &oidset);
++
++       if (ctx->major)
++               ssh_gssapi_error(ctx);
++
++       return(ctx->major);
++}
++
++OM_uint32
+ ssh_gssapi_sign(Gssctxt *ctx, gss_buffer_t buffer, gss_buffer_t hash)
+ {
++       if (ctx == NULL) 
++               return -1;
++
+        if ((ctx->major = gss_get_mic(&ctx->minor, ctx->context,
+            GSS_C_QOP_DEFAULT, buffer, hash)))
+                ssh_gssapi_error(ctx);
+@@ -236,6 +425,19 @@
+        return (ctx->major);
+ }
+ 
++/* Priviledged when used by server */
++OM_uint32
++ssh_gssapi_checkmic(Gssctxt *ctx, gss_buffer_t gssbuf, gss_buffer_t gssmic)
++{
++       if (ctx == NULL)
++               return -1;
++
++       ctx->major = gss_verify_mic(&ctx->minor, ctx->context,
++           gssbuf, gssmic, NULL);
++
++       return (ctx->major);
++}
++
+ void
+ ssh_gssapi_buildmic(Buffer *b, const char *user, const char *service,
+     const char *context)
+@@ -249,11 +451,16 @@
+ }
+ 
+ int
+-ssh_gssapi_check_mechanism(Gssctxt **ctx, gss_OID oid, const char *host)
++ssh_gssapi_check_mechanism(Gssctxt **ctx, gss_OID oid, const char *host, 
++    const char *client)
+ {
+        gss_buffer_desc token = GSS_C_EMPTY_BUFFER;
+        OM_uint32 major, minor;
+        gss_OID_desc spnego_oid = {6, (void *)"\x2B\x06\x01\x05\x05\x02"};
++       Gssctxt *intctx = NULL;
++
++       if (ctx == NULL)
++               ctx = &intctx;
+ 
+        /* RFC 4462 says we MUST NOT do SPNEGO */
+        if (oid->length == spnego_oid.length && 
+@@ -263,6 +470,10 @@
+        ssh_gssapi_build_ctx(ctx);
+        ssh_gssapi_set_oid(*ctx, oid);
+        major = ssh_gssapi_import_name(*ctx, host);
++
++       if (!GSS_ERROR(major) && client)
++               major = ssh_gssapi_client_identity(*ctx, client);
++
+        if (!GSS_ERROR(major)) {
+                major = ssh_gssapi_init_ctx(*ctx, 0, GSS_C_NO_BUFFER, &token, 
+                    NULL);
+@@ -272,10 +483,67 @@
+                            GSS_C_NO_BUFFER);
+        }
+ 
+-       if (GSS_ERROR(major)) 
++       if (GSS_ERROR(major) || intctx != NULL) 
+                ssh_gssapi_delete_ctx(ctx);
+ 
+        return (!GSS_ERROR(major));
+ }
+ 
++int
++ssh_gssapi_credentials_updated(Gssctxt *ctxt) {
++       static gss_name_t saved_name = GSS_C_NO_NAME;
++       static OM_uint32 saved_lifetime = 0;
++       static gss_OID saved_mech = GSS_C_NO_OID;
++       static gss_name_t name;
++       static OM_uint32 last_call = 0;
++       OM_uint32 lifetime, now, major, minor;
++       int equal;
++       gss_cred_usage_t usage = GSS_C_INITIATE;
++       
++       now = time(NULL);
++
++       if (ctxt) {
++               debug("Rekey has happened - updating saved versions");
++
++               if (saved_name != GSS_C_NO_NAME)
++                       gss_release_name(&minor, &saved_name);
++
++               major = gss_inquire_cred(&minor, GSS_C_NO_CREDENTIAL,
++                   &saved_name, &saved_lifetime, NULL, NULL);
++
++               if (!GSS_ERROR(major)) {
++                       saved_mech = ctxt->oid;
++                       saved_lifetime+= now;
++               } else {
++                       /* Handle the error */
++               }
++               return 0;
++       }
++
++       if (now - last_call < 10)
++               return 0;
++
++       last_call = now;
++
++       if (saved_mech == GSS_C_NO_OID)
++               return 0;
++       
++       major = gss_inquire_cred(&minor, GSS_C_NO_CREDENTIAL, 
++           &name, &lifetime, NULL, NULL);
++       if (major == GSS_S_CREDENTIALS_EXPIRED)
++               return 0;
++       else if (GSS_ERROR(major))
++               return 0;
++
++       major = gss_compare_name(&minor, saved_name, name, &equal);
++       gss_release_name(&minor, &name);
++       if (GSS_ERROR(major))
++               return 0;
++
++       if (equal && (saved_lifetime < lifetime + now - 10))
++               return 1;
++
++       return 0;
++}
++
+ #endif /* GSSAPI */
+Index: b/gss-serv-krb5.c
+===================================================================
+--- a/gss-serv-krb5.c
++++ b/gss-serv-krb5.c
+@@ -1,7 +1,7 @@
+ /* $OpenBSD: gss-serv-krb5.c,v 1.7 2006/08/03 03:34:42 deraadt Exp $ */
+ 
+ /*
+- * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
++ * Copyright (c) 2001-2007 Simon Wilkinson. All rights reserved.
+  *
+  * Redistribution and use in source and binary forms, with or without
+  * modification, are permitted provided that the following conditions
+@@ -120,6 +120,7 @@
+        krb5_principal princ;
+        OM_uint32 maj_status, min_status;
+        int len;
++       const char *new_ccname;
+ 
+        if (client->creds == NULL) {
+                debug("No credentials stored");
+@@ -168,11 +169,16 @@
+                return;
+        }
+ 
+-       client->store.filename = xstrdup(krb5_cc_get_name(krb_context, ccache));
++       new_ccname = krb5_cc_get_name(krb_context, ccache);
++
+        client->store.envvar = "KRB5CCNAME";
+-       len = strlen(client->store.filename) + 6;
+-       client->store.envval = xmalloc(len);
+-       snprintf(client->store.envval, len, "FILE:%s", client->store.filename);
++#ifdef USE_CCAPI
++       xasprintf(&client->store.envval, "API:%s", new_ccname);
++       client->store.filename = NULL;
++#else
++       xasprintf(&client->store.envval, "FILE:%s", new_ccname);
++       client->store.filename = xstrdup(new_ccname);
++#endif
+ 
+ #ifdef USE_PAM
+        if (options.use_pam)
+@@ -184,6 +190,71 @@
+        return;
+ }
+ 
++int
++ssh_gssapi_krb5_updatecreds(ssh_gssapi_ccache *store, 
++    ssh_gssapi_client *client)
++{
++       krb5_ccache ccache = NULL;
++       krb5_principal principal = NULL;
++       char *name = NULL;
++       krb5_error_code problem;
++       OM_uint32 maj_status, min_status;
++
++       if ((problem = krb5_cc_resolve(krb_context, store->envval, &ccache))) {
++                logit("krb5_cc_resolve(): %.100s",
++                    krb5_get_err_text(krb_context, problem));
++                return 0;
++               }
++       
++       /* Find out who the principal in this cache is */
++       if ((problem = krb5_cc_get_principal(krb_context, ccache, 
++           &principal))) {
++               logit("krb5_cc_get_principal(): %.100s",
++                   krb5_get_err_text(krb_context, problem));
++               krb5_cc_close(krb_context, ccache);
++               return 0;
++       }
++
++       if ((problem = krb5_unparse_name(krb_context, principal, &name))) {
++               logit("krb5_unparse_name(): %.100s",
++                   krb5_get_err_text(krb_context, problem));
++               krb5_free_principal(krb_context, principal);
++               krb5_cc_close(krb_context, ccache);
++               return 0;
++       }
++
++
++       if (strcmp(name,client->exportedname.value)!=0) {
++               debug("Name in local credentials cache differs. Not storing");
++               krb5_free_principal(krb_context, principal);
++               krb5_cc_close(krb_context, ccache);
++               krb5_free_unparsed_name(krb_context, name);
++               return 0;
++       }
++       krb5_free_unparsed_name(krb_context, name);
++
++       /* Name matches, so lets get on with it! */
++
++       if ((problem = krb5_cc_initialize(krb_context, ccache, principal))) {
++               logit("krb5_cc_initialize(): %.100s",
++                   krb5_get_err_text(krb_context, problem));
++               krb5_free_principal(krb_context, principal);
++               krb5_cc_close(krb_context, ccache);
++               return 0;
++       }
++
++       krb5_free_principal(krb_context, principal);
++
++       if ((maj_status = gss_krb5_copy_ccache(&min_status, client->creds,
++           ccache))) {
++               logit("gss_krb5_copy_ccache() failed. Sorry!");
++               krb5_cc_close(krb_context, ccache);
++               return 0;
++       }
++
++       return 1;
++}
++
+ ssh_gssapi_mech gssapi_kerberos_mech = {
+        "toWM5Slw5Ew8Mqkay+al2g==",
+        "Kerberos",
+@@ -191,7 +262,8 @@
+        NULL,
+        &ssh_gssapi_krb5_userok,
+        NULL,
+-       &ssh_gssapi_krb5_storecreds
++       &ssh_gssapi_krb5_storecreds,
++       &ssh_gssapi_krb5_updatecreds
+ };
+ 
+ #endif /* KRB5 */
+Index: b/gss-serv.c
+===================================================================
+--- a/gss-serv.c
++++ b/gss-serv.c
+@@ -1,7 +1,7 @@
+ /* $OpenBSD: gss-serv.c,v 1.22 2008/05/08 12:02:23 djm Exp $ */
+ 
+ /*
+- * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
++ * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.
+  *
+  * Redistribution and use in source and binary forms, with or without
+  * modification, are permitted provided that the following conditions
+@@ -45,15 +45,20 @@
+ #include "channels.h"
+ #include "session.h"
+ #include "misc.h"
++#include "servconf.h"
++#include "uidswap.h"
+ 
+ #include "ssh-gss.h"
++#include "monitor_wrap.h"
++
++extern ServerOptions options;
+ 
+ static ssh_gssapi_client gssapi_client =
+     { GSS_C_EMPTY_BUFFER, GSS_C_EMPTY_BUFFER,
+-    GSS_C_NO_CREDENTIAL, NULL, {NULL, NULL, NULL}};
++    GSS_C_NO_CREDENTIAL, GSS_C_NO_NAME,  NULL, {NULL, NULL, NULL}, 0, 0};
+ 
+ ssh_gssapi_mech gssapi_null_mech =
+-    { NULL, NULL, {0, NULL}, NULL, NULL, NULL, NULL};
++    { NULL, NULL, {0, NULL}, NULL, NULL, NULL, NULL, NULL};
+ 
+ #ifdef KRB5
+ extern ssh_gssapi_mech gssapi_kerberos_mech;
+@@ -81,25 +86,32 @@
+        char lname[MAXHOSTNAMELEN];
+        gss_OID_set oidset;
+ 
+-       gss_create_empty_oid_set(&status, &oidset);
+-       gss_add_oid_set_member(&status, ctx->oid, &oidset);
++       if (options.gss_strict_acceptor) {
++               gss_create_empty_oid_set(&status, &oidset);
++               gss_add_oid_set_member(&status, ctx->oid, &oidset);
++
++               if (gethostname(lname, MAXHOSTNAMELEN)) {
++                       gss_release_oid_set(&status, &oidset);
++                       return (-1);
++               }
+ 
+-       if (gethostname(lname, MAXHOSTNAMELEN)) {
+-               gss_release_oid_set(&status, &oidset);
+-               return (-1);
+-       }
++               if (GSS_ERROR(ssh_gssapi_import_name(ctx, lname))) {
++                       gss_release_oid_set(&status, &oidset);
++                       return (ctx->major);
++               }
++
++               if ((ctx->major = gss_acquire_cred(&ctx->minor,
++                   ctx->name, 0, oidset, GSS_C_ACCEPT, &ctx->creds, 
++                   NULL, NULL)))
++                       ssh_gssapi_error(ctx);
+ 
+-       if (GSS_ERROR(ssh_gssapi_import_name(ctx, lname))) {
+                gss_release_oid_set(&status, &oidset);
+                return (ctx->major);
++       } else {
++               ctx->name = GSS_C_NO_NAME;
++               ctx->creds = GSS_C_NO_CREDENTIAL;
+        }
+-
+-       if ((ctx->major = gss_acquire_cred(&ctx->minor,
+-           ctx->name, 0, oidset, GSS_C_ACCEPT, &ctx->creds, NULL, NULL)))
+-               ssh_gssapi_error(ctx);
+-
+-       gss_release_oid_set(&status, &oidset);
+-       return (ctx->major);
++       return GSS_S_COMPLETE;
+ }
+ 
+ /* Privileged */
+@@ -114,6 +126,29 @@
+ }
+ 
+ /* Unprivileged */
++char *
++ssh_gssapi_server_mechanisms() {
++       gss_OID_set     supported;
++
++       ssh_gssapi_supported_oids(&supported);
++       return (ssh_gssapi_kex_mechs(supported, &ssh_gssapi_server_check_mech,
++           NULL, NULL));
++}
++
++/* Unprivileged */
++int
++ssh_gssapi_server_check_mech(Gssctxt **dum, gss_OID oid, const char *data,
++    const char *dummy) {
++       Gssctxt *ctx = NULL;
++       int res;
++ 
++       res = !GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctx, oid)));
++       ssh_gssapi_delete_ctx(&ctx);
++
++       return (res);
++}
++
++/* Unprivileged */
+ void
+ ssh_gssapi_supported_oids(gss_OID_set *oidset)
+ {
+@@ -123,7 +158,9 @@
+        gss_OID_set supported;
+ 
+        gss_create_empty_oid_set(&min_status, oidset);
+-       gss_indicate_mechs(&min_status, &supported);
++
++       if (GSS_ERROR(gss_indicate_mechs(&min_status, &supported)))
++               return;
+ 
+        while (supported_mechs[i]->name != NULL) {
+                if (GSS_ERROR(gss_test_oid_set_member(&min_status,
+@@ -247,8 +284,48 @@
+ ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client)
+ {
+        int i = 0;
++       int equal = 0;
++       gss_name_t new_name = GSS_C_NO_NAME;
++       gss_buffer_desc ename = GSS_C_EMPTY_BUFFER;
++
++       if (options.gss_store_rekey && client->used && ctx->client_creds) {
++               if (client->mech->oid.length != ctx->oid->length ||
++                   (memcmp(client->mech->oid.elements,
++                    ctx->oid->elements, ctx->oid->length) !=0)) {
++                       debug("Rekeyed credentials have different mechanism");
++                       return GSS_S_COMPLETE;
++               }
++
++               if ((ctx->major = gss_inquire_cred_by_mech(&ctx->minor, 
++                   ctx->client_creds, ctx->oid, &new_name, 
++                   NULL, NULL, NULL))) {
++                       ssh_gssapi_error(ctx);
++                       return (ctx->major);
++               }
++
++               ctx->major = gss_compare_name(&ctx->minor, client->name, 
++                   new_name, &equal);
+ 
+-       gss_buffer_desc ename;
++               if (GSS_ERROR(ctx->major)) {
++                       ssh_gssapi_error(ctx);
++                       return (ctx->major);
++               }
++ 
++               if (!equal) {
++                       debug("Rekeyed credentials have different name");
++                       return GSS_S_COMPLETE;
++               }
++
++               debug("Marking rekeyed credentials for export");
++
++               gss_release_name(&ctx->minor, &client->name);
++               gss_release_cred(&ctx->minor, &client->creds);
++               client->name = new_name;
++               client->creds = ctx->client_creds;
++               ctx->client_creds = GSS_C_NO_CREDENTIAL;
++               client->updated = 1;
++               return GSS_S_COMPLETE;
++       }
+ 
+        client->mech = NULL;
+ 
+@@ -263,6 +340,13 @@
+        if (client->mech == NULL)
+                return GSS_S_FAILURE;
+ 
++       if (ctx->client_creds &&
++           (ctx->major = gss_inquire_cred_by_mech(&ctx->minor,
++            ctx->client_creds, ctx->oid, &client->name, NULL, NULL, NULL))) {
++               ssh_gssapi_error(ctx);
++               return (ctx->major);
++       }
++
+        if ((ctx->major = gss_display_name(&ctx->minor, ctx->client,
+            &client->displayname, NULL))) {
+                ssh_gssapi_error(ctx);
+@@ -280,6 +364,8 @@
+                return (ctx->major);
+        }
+ 
++       gss_release_buffer(&ctx->minor, &ename);
++
+        /* We can't copy this structure, so we just move the pointer to it */
+        client->creds = ctx->client_creds;
+        ctx->client_creds = GSS_C_NO_CREDENTIAL;
+@@ -327,7 +413,7 @@
+ 
+ /* Privileged */
+ int
+-ssh_gssapi_userok(char *user)
++ssh_gssapi_userok(char *user, struct passwd *pw)
+ {
+        OM_uint32 lmin;
+ 
+@@ -337,9 +423,11 @@
+                return 0;
+        }
+        if (gssapi_client.mech && gssapi_client.mech->userok)
+-               if ((*gssapi_client.mech->userok)(&gssapi_client, user))
++               if ((*gssapi_client.mech->userok)(&gssapi_client, user)) {
++                       gssapi_client.used = 1;
++                       gssapi_client.store.owner = pw;
+                        return 1;
+-               else {
++               } else {
+                        /* Destroy delegated credentials if userok fails */
+                        gss_release_buffer(&lmin, &gssapi_client.displayname);
+                        gss_release_buffer(&lmin, &gssapi_client.exportedname);
+@@ -352,14 +440,90 @@
+        return (0);
+ }
+ 
+-/* Privileged */
+-OM_uint32
+-ssh_gssapi_checkmic(Gssctxt *ctx, gss_buffer_t gssbuf, gss_buffer_t gssmic)
++/* These bits are only used for rekeying. The unpriviledged child is running 
++ * as the user, the monitor is root.
++ *
++ * In the child, we want to :
++ *    *) Ask the monitor to store our credentials into the store we specify
++ *    *) If it succeeds, maybe do a PAM update
++ */
++
++/* Stuff for PAM */
++
++#ifdef USE_PAM
++static int ssh_gssapi_simple_conv(int n, const struct pam_message **msg, 
++    struct pam_response **resp, void *data)
+ {
+-       ctx->major = gss_verify_mic(&ctx->minor, ctx->context,
+-           gssbuf, gssmic, NULL);
++       return (PAM_CONV_ERR);
++}
++#endif
+ 
+-       return (ctx->major);
++void
++ssh_gssapi_rekey_creds() {
++       int ok;
++       int ret;
++#ifdef USE_PAM
++       pam_handle_t *pamh = NULL;
++       struct pam_conv pamconv = {ssh_gssapi_simple_conv, NULL};
++       char *envstr;
++#endif
++
++       if (gssapi_client.store.filename == NULL && 
++           gssapi_client.store.envval == NULL &&
++           gssapi_client.store.envvar == NULL)
++               return;
++ 
++       ok = PRIVSEP(ssh_gssapi_update_creds(&gssapi_client.store));
++
++       if (!ok)
++               return;
++
++       debug("Rekeyed credentials stored successfully");
++
++       /* Actually managing to play with the ssh pam stack from here will
++        * be next to impossible. In any case, we may want different options
++        * for rekeying. So, use our own :)
++        */
++#ifdef USE_PAM 
++       if (!use_privsep) {
++               debug("Not even going to try and do PAM with privsep disabled");
++               return;
++       }
++
++       ret = pam_start("sshd-rekey", gssapi_client.store.owner->pw_name,
++           &pamconv, &pamh);
++       if (ret)
++               return;
++
++       xasprintf(&envstr, "%s=%s", gssapi_client.store.envvar, 
++           gssapi_client.store.envval);
++
++       ret = pam_putenv(pamh, envstr);
++       if (!ret)
++               pam_setcred(pamh, PAM_REINITIALIZE_CRED);
++       pam_end(pamh, PAM_SUCCESS);
++#endif
++}
++
++int 
++ssh_gssapi_update_creds(ssh_gssapi_ccache *store) {
++       int ok = 0;
++
++       /* Check we've got credentials to store */
++       if (!gssapi_client.updated)
++               return 0;
++
++       gssapi_client.updated = 0;
++
++       temporarily_use_uid(gssapi_client.store.owner);
++       if (gssapi_client.mech && gssapi_client.mech->updatecreds)
++               ok = (*gssapi_client.mech->updatecreds)(store, &gssapi_client);
++       else
++               debug("No update function for this mechanism");
++
++       restore_uid();
++
++       return ok;
+ }
+ 
+ #endif
+Index: b/kex.c
+===================================================================
+--- a/kex.c
++++ b/kex.c
+@@ -50,6 +50,10 @@
+ #include "monitor.h"
+ #include "roaming.h"
+ 
++#ifdef GSSAPI
++#include "ssh-gss.h"
++#endif
++
+ #if OPENSSL_VERSION_NUMBER >= 0x00907000L
+ # if defined(HAVE_EVP_SHA256)
+ # define evp_ssh_sha256 EVP_sha256
+@@ -326,6 +330,20 @@
+                k->kex_type = KEX_DH_GEX_SHA256;
+                k->evp_md = evp_ssh_sha256();
+ #endif
++#ifdef GSSAPI
++       } else if (strncmp(k->name, KEX_GSS_GEX_SHA1_ID,
++           sizeof(KEX_GSS_GEX_SHA1_ID) - 1) == 0) {
++               k->kex_type = KEX_GSS_GEX_SHA1;
++               k->evp_md = EVP_sha1();
++       } else if (strncmp(k->name, KEX_GSS_GRP1_SHA1_ID,
++           sizeof(KEX_GSS_GRP1_SHA1_ID) - 1) == 0) {
++               k->kex_type = KEX_GSS_GRP1_SHA1;
++               k->evp_md = EVP_sha1();
++       } else if (strncmp(k->name, KEX_GSS_GRP14_SHA1_ID,
++           sizeof(KEX_GSS_GRP14_SHA1_ID) - 1) == 0) {
++               k->kex_type = KEX_GSS_GRP14_SHA1;
++               k->evp_md = EVP_sha1();
++#endif
+        } else
+                fatal("bad kex alg %s", k->name);
+ }
+Index: b/kex.h
+===================================================================
+--- a/kex.h
++++ b/kex.h
+@@ -67,6 +67,9 @@
+        KEX_DH_GRP14_SHA1,
+        KEX_DH_GEX_SHA1,
+        KEX_DH_GEX_SHA256,
++       KEX_GSS_GRP1_SHA1,
++       KEX_GSS_GRP14_SHA1,
++       KEX_GSS_GEX_SHA1,
+        KEX_MAX
+ };
+ 
+@@ -123,6 +126,12 @@
+        sig_atomic_t done;
+        int     flags;
+        const EVP_MD *evp_md;
++#ifdef GSSAPI
++       int     gss_deleg_creds;
++       int     gss_trust_dns;
++       char    *gss_host;
++       char    *gss_client;
++#endif
+        char    *client_version_string;
+        char    *server_version_string;
+        int     (*verify_host_key)(Key *);
+@@ -146,6 +155,11 @@
+ void    kexgex_client(Kex *);
+ void    kexgex_server(Kex *);
+ 
++#ifdef GSSAPI
++void   kexgss_client(Kex *);
++void   kexgss_server(Kex *);
++#endif
++
+ void
+ kex_dh_hash(char *, char *, char *, int, char *, int, u_char *, int,
+     BIGNUM *, BIGNUM *, BIGNUM *, u_char **, u_int *);
+Index: b/kexgssc.c
+===================================================================
+--- /dev/null
++++ b/kexgssc.c
+@@ -0,0 +1,334 @@
++/*
++ * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer.
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in the
++ *    documentation and/or other materials provided with the distribution.
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR `AS IS'' AND ANY EXPRESS OR
++ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
++ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
++ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
++ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
++ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
++ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
++ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++ */
++
++#include "includes.h"
++
++#ifdef GSSAPI
++
++#include "includes.h"
++
++#include <openssl/crypto.h>
++#include <openssl/bn.h>
++
++#include <string.h>
++
++#include "xmalloc.h"
++#include "buffer.h"
++#include "ssh2.h"
++#include "key.h"
++#include "cipher.h"
++#include "kex.h"
++#include "log.h"
++#include "packet.h"
++#include "dh.h"
++
++#include "ssh-gss.h"
++
++void
++kexgss_client(Kex *kex) {
++       gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
++       gss_buffer_desc recv_tok, gssbuf, msg_tok, *token_ptr;
++       Gssctxt *ctxt;
++       OM_uint32 maj_status, min_status, ret_flags;
++       u_int klen, kout, slen = 0, hashlen, strlen;
++       DH *dh; 
++       BIGNUM *dh_server_pub = NULL;
++       BIGNUM *shared_secret = NULL;
++       BIGNUM *p = NULL;
++       BIGNUM *g = NULL;       
++       u_char *kbuf, *hash;
++       u_char *serverhostkey = NULL;
++       u_char *empty = "";
++       char *msg;
++       char *lang;
++       int type = 0;
++       int first = 1;
++       int nbits = 0, min = DH_GRP_MIN, max = DH_GRP_MAX;
++
++       /* Initialise our GSSAPI world */       
++       ssh_gssapi_build_ctx(&ctxt);
++       if (ssh_gssapi_id_kex(ctxt, kex->name, kex->kex_type) 
++           == GSS_C_NO_OID)
++               fatal("Couldn't identify host exchange");
++
++       if (ssh_gssapi_import_name(ctxt, kex->gss_host))
++               fatal("Couldn't import hostname");
++
++       if (kex->gss_client && 
++           ssh_gssapi_client_identity(ctxt, kex->gss_client))
++               fatal("Couldn't acquire client credentials");
++
++       switch (kex->kex_type) {
++       case KEX_GSS_GRP1_SHA1:
++               dh = dh_new_group1();
++               break;
++       case KEX_GSS_GRP14_SHA1:
++               dh = dh_new_group14();
++               break;
++       case KEX_GSS_GEX_SHA1:
++               debug("Doing group exchange\n");
++               nbits = dh_estimate(kex->we_need * 8);
++               packet_start(SSH2_MSG_KEXGSS_GROUPREQ);
++               packet_put_int(min);
++               packet_put_int(nbits);
++               packet_put_int(max);
++
++               packet_send();
++
++               packet_read_expect(SSH2_MSG_KEXGSS_GROUP);
++
++               if ((p = BN_new()) == NULL)
++                       fatal("BN_new() failed");
++               packet_get_bignum2(p);
++               if ((g = BN_new()) == NULL)
++                       fatal("BN_new() failed");
++               packet_get_bignum2(g);
++               packet_check_eom();
++
++               if (BN_num_bits(p) < min || BN_num_bits(p) > max)
++                       fatal("GSSGRP_GEX group out of range: %d !< %d !< %d",
++                           min, BN_num_bits(p), max);
++
++               dh = dh_new_group(g, p);
++               break;
++       default:
++               fatal("%s: Unexpected KEX type %d", __func__, kex->kex_type);
++       }
++       
++       /* Step 1 - e is dh->pub_key */
++       dh_gen_key(dh, kex->we_need * 8);
++
++       /* This is f, we initialise it now to make life easier */
++       dh_server_pub = BN_new();
++       if (dh_server_pub == NULL)
++               fatal("dh_server_pub == NULL");
++
++       token_ptr = GSS_C_NO_BUFFER;
++                        
++       do {
++               debug("Calling gss_init_sec_context");
++               
++               maj_status = ssh_gssapi_init_ctx(ctxt,
++                   kex->gss_deleg_creds, token_ptr, &send_tok,
++                   &ret_flags);
++
++               if (GSS_ERROR(maj_status)) {
++                       if (send_tok.length != 0) {
++                               packet_start(SSH2_MSG_KEXGSS_CONTINUE);
++                               packet_put_string(send_tok.value,
++                                   send_tok.length);
++                       }
++                       fatal("gss_init_context failed");
++               }
++
++               /* If we've got an old receive buffer get rid of it */
++               if (token_ptr != GSS_C_NO_BUFFER)
++                       xfree(recv_tok.value);
++
++               if (maj_status == GSS_S_COMPLETE) {
++                       /* If mutual state flag is not true, kex fails */
++                       if (!(ret_flags & GSS_C_MUTUAL_FLAG))
++                               fatal("Mutual authentication failed");
++
++                       /* If integ avail flag is not true kex fails */
++                       if (!(ret_flags & GSS_C_INTEG_FLAG))
++                               fatal("Integrity check failed");
++               }
++
++               /* 
++                * If we have data to send, then the last message that we
++                * received cannot have been a 'complete'. 
++                */
++               if (send_tok.length != 0) {
++                       if (first) {
++                               packet_start(SSH2_MSG_KEXGSS_INIT);
++                               packet_put_string(send_tok.value,
++                                   send_tok.length);
++                               packet_put_bignum2(dh->pub_key);
++                               first = 0;
++                       } else {
++                               packet_start(SSH2_MSG_KEXGSS_CONTINUE);
++                               packet_put_string(send_tok.value,
++                                   send_tok.length);
++                       }
++                       packet_send();
++                       gss_release_buffer(&min_status, &send_tok);
++
++                       /* If we've sent them data, they should reply */
++                       do {    
++                               type = packet_read();
++                               if (type == SSH2_MSG_KEXGSS_HOSTKEY) {
++                                       debug("Received KEXGSS_HOSTKEY");
++                                       if (serverhostkey)
++                                               fatal("Server host key received more than once");
++                                       serverhostkey = 
++                                           packet_get_string(&slen);
++                               }
++                       } while (type == SSH2_MSG_KEXGSS_HOSTKEY);
++
++                       switch (type) {
++                       case SSH2_MSG_KEXGSS_CONTINUE:
++                               debug("Received GSSAPI_CONTINUE");
++                               if (maj_status == GSS_S_COMPLETE) 
++                                       fatal("GSSAPI Continue received from server when complete");
++                               recv_tok.value = packet_get_string(&strlen);
++                               recv_tok.length = strlen; 
++                               break;
++                       case SSH2_MSG_KEXGSS_COMPLETE:
++                               debug("Received GSSAPI_COMPLETE");
++                               packet_get_bignum2(dh_server_pub);
++                               msg_tok.value =  packet_get_string(&strlen);
++                               msg_tok.length = strlen; 
++
++                               /* Is there a token included? */
++                               if (packet_get_char()) {
++                                       recv_tok.value=
++                                           packet_get_string(&strlen);
++                                       recv_tok.length = strlen;
++                                       /* If we're already complete - protocol error */
++                                       if (maj_status == GSS_S_COMPLETE)
++                                               packet_disconnect("Protocol error: received token when complete");
++                                       } else {
++                                               /* No token included */
++                                               if (maj_status != GSS_S_COMPLETE)
++                                                       packet_disconnect("Protocol error: did not receive final token");
++                               }
++                               break;
++                       case SSH2_MSG_KEXGSS_ERROR:
++                               debug("Received Error");
++                               maj_status = packet_get_int();
++                               min_status = packet_get_int();
++                               msg = packet_get_string(NULL);
++                               lang = packet_get_string(NULL);
++                               fatal("GSSAPI Error: \n%.400s",msg);
++                       default:
++                               packet_disconnect("Protocol error: didn't expect packet type %d",
++                               type);
++                       }
++                       token_ptr = &recv_tok;
++               } else {
++                       /* No data, and not complete */
++                       if (maj_status != GSS_S_COMPLETE)
++                               fatal("Not complete, and no token output");
++               }
++       } while (maj_status & GSS_S_CONTINUE_NEEDED);
++
++       /* 
++        * We _must_ have received a COMPLETE message in reply from the 
++        * server, which will have set dh_server_pub and msg_tok 
++        */
++
++       if (type != SSH2_MSG_KEXGSS_COMPLETE)
++               fatal("Didn't receive a SSH2_MSG_KEXGSS_COMPLETE when I expected it");
++
++       /* Check f in range [1, p-1] */
++       if (!dh_pub_is_valid(dh, dh_server_pub))
++               packet_disconnect("bad server public DH value");
++
++       /* compute K=f^x mod p */
++       klen = DH_size(dh);
++       kbuf = xmalloc(klen);
++       kout = DH_compute_key(kbuf, dh_server_pub, dh);
++       if (kout < 0)
++               fatal("DH_compute_key: failed");
++
++       shared_secret = BN_new();
++       if (shared_secret == NULL)
++               fatal("kexgss_client: BN_new failed");
++
++       if (BN_bin2bn(kbuf, kout, shared_secret) == NULL)
++               fatal("kexdh_client: BN_bin2bn failed");
++
++       memset(kbuf, 0, klen);
++       xfree(kbuf);
++
++       switch (kex->kex_type) {
++       case KEX_GSS_GRP1_SHA1:
++       case KEX_GSS_GRP14_SHA1:
++               kex_dh_hash( kex->client_version_string, 
++                   kex->server_version_string,
++                   buffer_ptr(&kex->my), buffer_len(&kex->my),
++                   buffer_ptr(&kex->peer), buffer_len(&kex->peer),
++                   (serverhostkey ? serverhostkey : empty), slen,
++                   dh->pub_key,        /* e */
++                   dh_server_pub,      /* f */
++                   shared_secret,      /* K */
++                   &hash, &hashlen
++               );
++               break;
++       case KEX_GSS_GEX_SHA1:
++               kexgex_hash(
++                   kex->evp_md,
++                   kex->client_version_string,
++                   kex->server_version_string,
++                   buffer_ptr(&kex->my), buffer_len(&kex->my),
++                   buffer_ptr(&kex->peer), buffer_len(&kex->peer),
++                   (serverhostkey ? serverhostkey : empty), slen,
++                   min, nbits, max,
++                   dh->p, dh->g,
++                   dh->pub_key,
++                   dh_server_pub,
++                   shared_secret,
++                   &hash, &hashlen
++               );
++               break;
++       default:
++               fatal("%s: Unexpected KEX type %d", __func__, kex->kex_type);
++       }
++
++       gssbuf.value = hash;
++       gssbuf.length = hashlen;
++
++       /* Verify that the hash matches the MIC we just got. */
++       if (GSS_ERROR(ssh_gssapi_checkmic(ctxt, &gssbuf, &msg_tok)))
++               packet_disconnect("Hash's MIC didn't verify");
++
++       xfree(msg_tok.value);
++
++       DH_free(dh);
++       if (serverhostkey)
++               xfree(serverhostkey);
++       BN_clear_free(dh_server_pub);
++
++       /* save session id */
++       if (kex->session_id == NULL) {
++               kex->session_id_len = hashlen;
++               kex->session_id = xmalloc(kex->session_id_len);
++               memcpy(kex->session_id, hash, kex->session_id_len);
++       }
++
++       if (kex->gss_deleg_creds)
++               ssh_gssapi_credentials_updated(ctxt);
++
++       if (gss_kex_context == NULL)
++               gss_kex_context = ctxt;
++       else
++               ssh_gssapi_delete_ctx(&ctxt);
++
++       kex_derive_keys(kex, hash, hashlen, shared_secret);
++       BN_clear_free(shared_secret);
++       kex_finish(kex);
++}
++
++#endif /* GSSAPI */
+Index: b/kexgsss.c
+===================================================================
+--- /dev/null
++++ b/kexgsss.c
+@@ -0,0 +1,288 @@
++/*
++ * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer.
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in the
++ *    documentation and/or other materials provided with the distribution.
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR `AS IS'' AND ANY EXPRESS OR
++ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
++ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
++ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
++ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
++ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
++ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
++ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++ */
++
++#include "includes.h"
++
++#ifdef GSSAPI
++
++#include <string.h>
++
++#include <openssl/crypto.h>
++#include <openssl/bn.h>
++
++#include "xmalloc.h"
++#include "buffer.h"
++#include "ssh2.h"
++#include "key.h"
++#include "cipher.h"
++#include "kex.h"
++#include "log.h"
++#include "packet.h"
++#include "dh.h"
++#include "ssh-gss.h"
++#include "monitor_wrap.h"
++#include "servconf.h"
++
++extern ServerOptions options;
++
++void
++kexgss_server(Kex *kex)
++{
++       OM_uint32 maj_status, min_status;
++       
++       /* 
++        * Some GSSAPI implementations use the input value of ret_flags (an
++        * output variable) as a means of triggering mechanism specific 
++        * features. Initializing it to zero avoids inadvertently 
++        * activating this non-standard behaviour.
++        */
++
++       OM_uint32 ret_flags = 0;
++       gss_buffer_desc gssbuf, recv_tok, msg_tok;
++       gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
++       Gssctxt *ctxt = NULL;
++       u_int slen, klen, kout, hashlen;
++       u_char *kbuf, *hash;
++       DH *dh;
++       int min = -1, max = -1, nbits = -1;
++       BIGNUM *shared_secret = NULL;
++       BIGNUM *dh_client_pub = NULL;
++       int type = 0;
++       gss_OID oid;
++       char *mechs;
++
++       /* Initialise GSSAPI */
++
++       /* If we're rekeying, privsep means that some of the private structures
++        * in the GSSAPI code are no longer available. This kludges them back
++        * into life
++        */
++       if (!ssh_gssapi_oid_table_ok()) 
++               if ((mechs = ssh_gssapi_server_mechanisms()))
++                       xfree(mechs);
++
++       debug2("%s: Identifying %s", __func__, kex->name);
++       oid = ssh_gssapi_id_kex(NULL, kex->name, kex->kex_type);
++       if (oid == GSS_C_NO_OID)
++          fatal("Unknown gssapi mechanism");
++
++       debug2("%s: Acquiring credentials", __func__);
++
++       if (GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctxt, oid))))
++               fatal("Unable to acquire credentials for the server");
++
++       switch (kex->kex_type) {
++       case KEX_GSS_GRP1_SHA1:
++               dh = dh_new_group1();
++               break;
++       case KEX_GSS_GRP14_SHA1:
++               dh = dh_new_group14();
++               break;
++       case KEX_GSS_GEX_SHA1:
++               debug("Doing group exchange");
++               packet_read_expect(SSH2_MSG_KEXGSS_GROUPREQ);
++               min = packet_get_int();
++               nbits = packet_get_int();
++               max = packet_get_int();
++               min = MAX(DH_GRP_MIN, min);
++               max = MIN(DH_GRP_MAX, max);
++               packet_check_eom();
++               if (max < min || nbits < min || max < nbits)
++                       fatal("GSS_GEX, bad parameters: %d !< %d !< %d",
++                           min, nbits, max);
++               dh = PRIVSEP(choose_dh(min, nbits, max));
++               if (dh == NULL)
++                       packet_disconnect("Protocol error: no matching group found");
++
++               packet_start(SSH2_MSG_KEXGSS_GROUP);
++               packet_put_bignum2(dh->p);
++               packet_put_bignum2(dh->g);
++               packet_send();
++
++               packet_write_wait();
++               break;
++       default:
++               fatal("%s: Unexpected KEX type %d", __func__, kex->kex_type);
++       }
++
++       dh_gen_key(dh, kex->we_need * 8);
++
++       do {
++               debug("Wait SSH2_MSG_GSSAPI_INIT");
++               type = packet_read();
++               switch(type) {
++               case SSH2_MSG_KEXGSS_INIT:
++                       if (dh_client_pub != NULL) 
++                               fatal("Received KEXGSS_INIT after initialising");
++                       recv_tok.value = packet_get_string(&slen);
++                       recv_tok.length = slen; 
++
++                       if ((dh_client_pub = BN_new()) == NULL)
++                               fatal("dh_client_pub == NULL");
++
++                       packet_get_bignum2(dh_client_pub);
++
++                       /* Send SSH_MSG_KEXGSS_HOSTKEY here, if we want */
++                       break;
++               case SSH2_MSG_KEXGSS_CONTINUE:
++                       recv_tok.value = packet_get_string(&slen);
++                       recv_tok.length = slen; 
++                       break;
++               default:
++                       packet_disconnect(
++                           "Protocol error: didn't expect packet type %d",
++                           type);
++               }
++
++               maj_status = PRIVSEP(ssh_gssapi_accept_ctx(ctxt, &recv_tok, 
++                   &send_tok, &ret_flags));
++
++               xfree(recv_tok.value);
++
++               if (maj_status != GSS_S_COMPLETE && send_tok.length == 0)
++                       fatal("Zero length token output when incomplete");
++
++               if (dh_client_pub == NULL)
++                       fatal("No client public key");
++               
++               if (maj_status & GSS_S_CONTINUE_NEEDED) {
++                       debug("Sending GSSAPI_CONTINUE");
++                       packet_start(SSH2_MSG_KEXGSS_CONTINUE);
++                       packet_put_string(send_tok.value, send_tok.length);
++                       packet_send();
++                       gss_release_buffer(&min_status, &send_tok);
++               }
++       } while (maj_status & GSS_S_CONTINUE_NEEDED);
++
++       if (GSS_ERROR(maj_status)) {
++               if (send_tok.length > 0) {
++                       packet_start(SSH2_MSG_KEXGSS_CONTINUE);
++                       packet_put_string(send_tok.value, send_tok.length);
++                       packet_send();
++               }
++               fatal("accept_ctx died");
++       }
++
++       if (!(ret_flags & GSS_C_MUTUAL_FLAG))
++               fatal("Mutual Authentication flag wasn't set");
++
++       if (!(ret_flags & GSS_C_INTEG_FLAG))
++               fatal("Integrity flag wasn't set");
++       
++       if (!dh_pub_is_valid(dh, dh_client_pub))
++               packet_disconnect("bad client public DH value");
++
++       klen = DH_size(dh);
++       kbuf = xmalloc(klen); 
++       kout = DH_compute_key(kbuf, dh_client_pub, dh);
++       if (kout < 0)
++               fatal("DH_compute_key: failed");
++
++       shared_secret = BN_new();
++       if (shared_secret == NULL)
++               fatal("kexgss_server: BN_new failed");
++
++       if (BN_bin2bn(kbuf, kout, shared_secret) == NULL)
++               fatal("kexgss_server: BN_bin2bn failed");
++
++       memset(kbuf, 0, klen);
++       xfree(kbuf);
++
++       switch (kex->kex_type) {
++       case KEX_GSS_GRP1_SHA1:
++       case KEX_GSS_GRP14_SHA1:
++               kex_dh_hash(
++                   kex->client_version_string, kex->server_version_string,
++                   buffer_ptr(&kex->peer), buffer_len(&kex->peer),
++                   buffer_ptr(&kex->my), buffer_len(&kex->my),
++                   NULL, 0, /* Change this if we start sending host keys */
++                   dh_client_pub, dh->pub_key, shared_secret,
++                   &hash, &hashlen
++               );
++               break;
++       case KEX_GSS_GEX_SHA1:
++               kexgex_hash(
++                   kex->evp_md,
++                   kex->client_version_string, kex->server_version_string,
++                   buffer_ptr(&kex->peer), buffer_len(&kex->peer),
++                   buffer_ptr(&kex->my), buffer_len(&kex->my),
++                   NULL, 0,
++                   min, nbits, max,
++                   dh->p, dh->g,
++                   dh_client_pub,
++                   dh->pub_key,
++                   shared_secret,
++                   &hash, &hashlen
++               );
++               break;
++       default:
++               fatal("%s: Unexpected KEX type %d", __func__, kex->kex_type);
++       }
++
++       BN_clear_free(dh_client_pub);
++
++       if (kex->session_id == NULL) {
++               kex->session_id_len = hashlen;
++               kex->session_id = xmalloc(kex->session_id_len);
++               memcpy(kex->session_id, hash, kex->session_id_len);
++       }
++
++       gssbuf.value = hash;
++       gssbuf.length = hashlen;
++
++       if (GSS_ERROR(PRIVSEP(ssh_gssapi_sign(ctxt,&gssbuf,&msg_tok))))
++               fatal("Couldn't get MIC");
++
++       packet_start(SSH2_MSG_KEXGSS_COMPLETE);
++       packet_put_bignum2(dh->pub_key);
++       packet_put_string(msg_tok.value,msg_tok.length);
++
++       if (send_tok.length != 0) {
++               packet_put_char(1); /* true */
++               packet_put_string(send_tok.value, send_tok.length);
++       } else {
++               packet_put_char(0); /* false */
++       }
++       packet_send();
++
++       gss_release_buffer(&min_status, &send_tok);
++       gss_release_buffer(&min_status, &msg_tok);
++
++       if (gss_kex_context == NULL)
++               gss_kex_context = ctxt;
++       else 
++               ssh_gssapi_delete_ctx(&ctxt);
++
++       DH_free(dh);
++
++       kex_derive_keys(kex, hash, hashlen, shared_secret);
++       BN_clear_free(shared_secret);
++       kex_finish(kex);
++
++       /* If this was a rekey, then save out any delegated credentials we
++        * just exchanged.  */
++       if (options.gss_store_rekey)
++               ssh_gssapi_rekey_creds();
++}
++#endif /* GSSAPI */
+Index: b/key.c
+===================================================================
+--- a/key.c
++++ b/key.c
+@@ -1020,6 +1020,8 @@
+                return KEY_RSA_CERT;
+        } else if (strcmp(name, "ssh-dss-cert-v01@openssh.com") == 0) {
+                return KEY_DSA_CERT;
++       } else if (strcmp(name, "null") == 0) {
++               return KEY_NULL;
+        }
+        debug2("key_type_from_name: unknown key type '%s'", name);
+        return KEY_UNSPEC;
+Index: b/key.h
+===================================================================
+--- a/key.h
++++ b/key.h
+@@ -39,6 +39,7 @@
+        KEY_DSA_CERT,
+        KEY_RSA_CERT_V00,
+        KEY_DSA_CERT_V00,
++       KEY_NULL,
+        KEY_UNSPEC
+ };
+ enum fp_type {
+Index: b/monitor.c
+===================================================================
+--- a/monitor.c
++++ b/monitor.c
+@@ -172,6 +172,8 @@
+ int mm_answer_gss_accept_ctx(int, Buffer *);
+ int mm_answer_gss_userok(int, Buffer *);
+ int mm_answer_gss_checkmic(int, Buffer *);
++int mm_answer_gss_sign(int, Buffer *);
++int mm_answer_gss_updatecreds(int, Buffer *);
+ #endif
+ 
+ #ifdef SSH_AUDIT_EVENTS
+@@ -241,6 +243,7 @@
+     {MONITOR_REQ_GSSSTEP, MON_ISAUTH, mm_answer_gss_accept_ctx},
+     {MONITOR_REQ_GSSUSEROK, MON_AUTH, mm_answer_gss_userok},
+     {MONITOR_REQ_GSSCHECKMIC, MON_ISAUTH, mm_answer_gss_checkmic},
++    {MONITOR_REQ_GSSSIGN, MON_ONCE, mm_answer_gss_sign},
+ #endif
+ #ifdef JPAKE
+     {MONITOR_REQ_JPAKE_GET_PWDATA, MON_ONCE, mm_answer_jpake_get_pwdata},
+@@ -253,6 +256,12 @@
+ };
+ 
+ struct mon_table mon_dispatch_postauth20[] = {
++#ifdef GSSAPI
++    {MONITOR_REQ_GSSSETUP, 0, mm_answer_gss_setup_ctx},
++    {MONITOR_REQ_GSSSTEP, 0, mm_answer_gss_accept_ctx},
++    {MONITOR_REQ_GSSSIGN, 0, mm_answer_gss_sign},
++    {MONITOR_REQ_GSSUPCREDS, 0, mm_answer_gss_updatecreds},
++#endif
+     {MONITOR_REQ_MODULI, 0, mm_answer_moduli},
+     {MONITOR_REQ_SIGN, 0, mm_answer_sign},
+     {MONITOR_REQ_PTY, 0, mm_answer_pty},
+@@ -357,6 +366,10 @@
+                /* Permit requests for moduli and signatures */
+                monitor_permit(mon_dispatch, MONITOR_REQ_MODULI, 1);
+                monitor_permit(mon_dispatch, MONITOR_REQ_SIGN, 1);
++#ifdef GSSAPI
++               /* and for the GSSAPI key exchange */
++               monitor_permit(mon_dispatch, MONITOR_REQ_GSSSETUP, 1);
++#endif
+        } else {
+                mon_dispatch = mon_dispatch_proto15;
+ 
+@@ -443,6 +456,10 @@
+                monitor_permit(mon_dispatch, MONITOR_REQ_MODULI, 1);
+                monitor_permit(mon_dispatch, MONITOR_REQ_SIGN, 1);
+                monitor_permit(mon_dispatch, MONITOR_REQ_TERM, 1);
++#ifdef GSSAPI
++               /* and for the GSSAPI key exchange */
++               monitor_permit(mon_dispatch, MONITOR_REQ_GSSSETUP, 1);
++#endif         
+        } else {
+                mon_dispatch = mon_dispatch_postauth15;
+                monitor_permit(mon_dispatch, MONITOR_REQ_TERM, 1);
+@@ -1691,6 +1708,13 @@
+        kex->kex[KEX_DH_GRP14_SHA1] = kexdh_server;
+        kex->kex[KEX_DH_GEX_SHA1] = kexgex_server;
+        kex->kex[KEX_DH_GEX_SHA256] = kexgex_server;
++#ifdef GSSAPI
++       if (options.gss_keyex) {
++               kex->kex[KEX_GSS_GRP1_SHA1] = kexgss_server;
++               kex->kex[KEX_GSS_GRP14_SHA1] = kexgss_server;
++               kex->kex[KEX_GSS_GEX_SHA1] = kexgss_server;
++       }
++#endif
+        kex->server = 1;
+        kex->hostkey_type = buffer_get_int(m);
+        kex->kex_type = buffer_get_int(m);
+@@ -1897,6 +1921,9 @@
+        OM_uint32 major;
+        u_int len;
+ 
++       if (!options.gss_authentication && !options.gss_keyex)
++               fatal("In GSSAPI monitor when GSSAPI is disabled");
++
+        goid.elements = buffer_get_string(m, &len);
+        goid.length = len;
+ 
+@@ -1924,6 +1951,9 @@
+        OM_uint32 flags = 0; /* GSI needs this */
+        u_int len;
+ 
++       if (!options.gss_authentication && !options.gss_keyex)
++               fatal("In GSSAPI monitor when GSSAPI is disabled");
++
+        in.value = buffer_get_string(m, &len);
+        in.length = len;
+        major = ssh_gssapi_accept_ctx(gsscontext, &in, &out, &flags);
+@@ -1941,6 +1971,7 @@
+                monitor_permit(mon_dispatch, MONITOR_REQ_GSSSTEP, 0);
+                monitor_permit(mon_dispatch, MONITOR_REQ_GSSUSEROK, 1);
+                monitor_permit(mon_dispatch, MONITOR_REQ_GSSCHECKMIC, 1);
++               monitor_permit(mon_dispatch, MONITOR_REQ_GSSSIGN, 1);
+        }
+        return (0);
+ }
+@@ -1952,6 +1983,9 @@
+        OM_uint32 ret;
+        u_int len;
+ 
++       if (!options.gss_authentication && !options.gss_keyex)
++               fatal("In GSSAPI monitor when GSSAPI is disabled");
++
+        gssbuf.value = buffer_get_string(m, &len);
+        gssbuf.length = len;
+        mic.value = buffer_get_string(m, &len);
+@@ -1978,7 +2012,11 @@
+ {
+        int authenticated;
+ 
+-       authenticated = authctxt->valid && ssh_gssapi_userok(authctxt->user);
++       if (!options.gss_authentication && !options.gss_keyex)
++               fatal("In GSSAPI monitor when GSSAPI is disabled");
++
++       authenticated = authctxt->valid && 
++           ssh_gssapi_userok(authctxt->user, authctxt->pw);
+ 
+        buffer_clear(m);
+        buffer_put_int(m, authenticated);
+@@ -1991,6 +2029,74 @@
+        /* Monitor loop will terminate if authenticated */
+        return (authenticated);
+ }
++
++int 
++mm_answer_gss_sign(int socket, Buffer *m)
++{
++       gss_buffer_desc data;
++       gss_buffer_desc hash = GSS_C_EMPTY_BUFFER;
++       OM_uint32 major, minor;
++       u_int len;
++
++       if (!options.gss_authentication && !options.gss_keyex)
++               fatal("In GSSAPI monitor when GSSAPI is disabled");
++
++       data.value = buffer_get_string(m, &len);
++       data.length = len;
++       if (data.length != 20) 
++               fatal("%s: data length incorrect: %d", __func__, 
++                   (int) data.length);
++
++       /* Save the session ID on the first time around */
++       if (session_id2_len == 0) {
++               session_id2_len = data.length;
++               session_id2 = xmalloc(session_id2_len);
++               memcpy(session_id2, data.value, session_id2_len);
++       }
++       major = ssh_gssapi_sign(gsscontext, &data, &hash);
++
++       xfree(data.value);
++
++       buffer_clear(m);
++       buffer_put_int(m, major);
++       buffer_put_string(m, hash.value, hash.length);
++
++       mm_request_send(socket, MONITOR_ANS_GSSSIGN, m);
++
++       gss_release_buffer(&minor, &hash);
++
++       /* Turn on getpwnam permissions */
++       monitor_permit(mon_dispatch, MONITOR_REQ_PWNAM, 1);
++       
++       /* And credential updating, for when rekeying */
++       monitor_permit(mon_dispatch, MONITOR_REQ_GSSUPCREDS, 1);
++
++       return (0);
++}
++
++int
++mm_answer_gss_updatecreds(int socket, Buffer *m) {
++       ssh_gssapi_ccache store;
++       int ok;
++
++       store.filename = buffer_get_string(m, NULL);
++       store.envvar   = buffer_get_string(m, NULL);
++       store.envval   = buffer_get_string(m, NULL);
++
++       ok = ssh_gssapi_update_creds(&store);
++
++       xfree(store.filename);
++       xfree(store.envvar);
++       xfree(store.envval);
++
++       buffer_clear(m);
++       buffer_put_int(m, ok);
++
++       mm_request_send(socket, MONITOR_ANS_GSSUPCREDS, m);
++
++       return(0);
++}
++
+ #endif /* GSSAPI */
+ 
+ #ifdef JPAKE
+Index: b/monitor.h
+===================================================================
+--- a/monitor.h
++++ b/monitor.h
+@@ -53,6 +53,8 @@
+        MONITOR_REQ_GSSSTEP, MONITOR_ANS_GSSSTEP,
+        MONITOR_REQ_GSSUSEROK, MONITOR_ANS_GSSUSEROK,
+        MONITOR_REQ_GSSCHECKMIC, MONITOR_ANS_GSSCHECKMIC,
++       MONITOR_REQ_GSSSIGN, MONITOR_ANS_GSSSIGN,
++       MONITOR_REQ_GSSUPCREDS, MONITOR_ANS_GSSUPCREDS,
+        MONITOR_REQ_PAM_START,
+        MONITOR_REQ_PAM_ACCOUNT, MONITOR_ANS_PAM_ACCOUNT,
+        MONITOR_REQ_PAM_INIT_CTX, MONITOR_ANS_PAM_INIT_CTX,
+Index: b/monitor_wrap.c
+===================================================================
+--- a/monitor_wrap.c
++++ b/monitor_wrap.c
+@@ -1231,7 +1231,7 @@
+ }
+ 
+ int
+-mm_ssh_gssapi_userok(char *user)
++mm_ssh_gssapi_userok(char *user, struct passwd *pw)
+ {
+        Buffer m;
+        int authenticated = 0;
+@@ -1248,6 +1248,51 @@
+        debug3("%s: user %sauthenticated",__func__, authenticated ? "" : "not ");
+        return (authenticated);
+ }
++
++OM_uint32
++mm_ssh_gssapi_sign(Gssctxt *ctx, gss_buffer_desc *data, gss_buffer_desc *hash)
++{
++       Buffer m;
++       OM_uint32 major;
++       u_int len;
++
++       buffer_init(&m);
++       buffer_put_string(&m, data->value, data->length);
++
++       mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSSIGN, &m);
++       mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_GSSSIGN, &m);
++
++       major = buffer_get_int(&m);
++       hash->value = buffer_get_string(&m, &len);
++       hash->length = len;
++
++       buffer_free(&m);
++
++       return(major);
++}
++
++int
++mm_ssh_gssapi_update_creds(ssh_gssapi_ccache *store)
++{
++       Buffer m;
++       int ok;
++
++       buffer_init(&m);
++
++       buffer_put_cstring(&m, store->filename ? store->filename : "");
++       buffer_put_cstring(&m, store->envvar ? store->envvar : "");
++       buffer_put_cstring(&m, store->envval ? store->envval : "");
++       
++       mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSUPCREDS, &m);
++       mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_GSSUPCREDS, &m);
++
++       ok = buffer_get_int(&m);
++
++       buffer_free(&m);
++       
++       return (ok);
++}
++
+ #endif /* GSSAPI */
+ 
+ #ifdef JPAKE
+Index: b/monitor_wrap.h
+===================================================================
+--- a/monitor_wrap.h
++++ b/monitor_wrap.h
+@@ -57,8 +57,10 @@
+ OM_uint32 mm_ssh_gssapi_server_ctx(Gssctxt **, gss_OID);
+ OM_uint32 mm_ssh_gssapi_accept_ctx(Gssctxt *,
+    gss_buffer_desc *, gss_buffer_desc *, OM_uint32 *);
+-int mm_ssh_gssapi_userok(char *user);
++int mm_ssh_gssapi_userok(char *user, struct passwd *);
+ OM_uint32 mm_ssh_gssapi_checkmic(Gssctxt *, gss_buffer_t, gss_buffer_t);
++OM_uint32 mm_ssh_gssapi_sign(Gssctxt *, gss_buffer_t, gss_buffer_t);
++int mm_ssh_gssapi_update_creds(ssh_gssapi_ccache *);
+ #endif
+ 
+ #ifdef USE_PAM
+Index: b/readconf.c
+===================================================================
+--- a/readconf.c
++++ b/readconf.c
+@@ -127,6 +127,7 @@
+        oClearAllForwardings, oNoHostAuthenticationForLocalhost,
+        oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout,
+        oAddressFamily, oGssAuthentication, oGssDelegateCreds,
++       oGssTrustDns, oGssKeyEx, oGssClientIdentity, oGssRenewalRekey,
+        oServerAliveInterval, oServerAliveCountMax, oIdentitiesOnly,
+        oSendEnv, oControlPath, oControlMaster, oControlPersist,
+        oHashKnownHosts,
+@@ -166,10 +167,18 @@
+        { "afstokenpassing", oUnsupported },
+ #if defined(GSSAPI)
+        { "gssapiauthentication", oGssAuthentication },
++       { "gssapikeyexchange", oGssKeyEx },
+        { "gssapidelegatecredentials", oGssDelegateCreds },
++       { "gssapitrustdns", oGssTrustDns },
++       { "gssapiclientidentity", oGssClientIdentity },
++       { "gssapirenewalforcesrekey", oGssRenewalRekey },
+ #else
+        { "gssapiauthentication", oUnsupported },
++       { "gssapikeyexchange", oUnsupported },
+        { "gssapidelegatecredentials", oUnsupported },
++       { "gssapitrustdns", oUnsupported },
++       { "gssapiclientidentity", oUnsupported },
++       { "gssapirenewalforcesrekey", oUnsupported },
+ #endif
+        { "fallbacktorsh", oDeprecated },
+        { "usersh", oDeprecated },
+@@ -474,10 +483,26 @@
+                intptr = &options->gss_authentication;
+                goto parse_flag;
+ 
++       case oGssKeyEx:
++               intptr = &options->gss_keyex;
++               goto parse_flag;
++
+        case oGssDelegateCreds:
+                intptr = &options->gss_deleg_creds;
+                goto parse_flag;
+ 
++       case oGssTrustDns:
++               intptr = &options->gss_trust_dns;
++               goto parse_flag;
++
++       case oGssClientIdentity:
++               charptr = &options->gss_client_identity;
++               goto parse_string;
++
++       case oGssRenewalRekey:
++               intptr = &options->gss_renewal_rekey;
++               goto parse_flag;
++
+        case oBatchMode:
+                intptr = &options->batch_mode;
+                goto parse_flag;
+@@ -1058,7 +1083,11 @@
+        options->pubkey_authentication = -1;
+        options->challenge_response_authentication = -1;
+        options->gss_authentication = -1;
++       options->gss_keyex = -1;
+        options->gss_deleg_creds = -1;
++       options->gss_trust_dns = -1;
++       options->gss_renewal_rekey = -1;
++       options->gss_client_identity = NULL;
+        options->password_authentication = -1;
+        options->kbd_interactive_authentication = -1;
+        options->kbd_interactive_devices = NULL;
+@@ -1156,8 +1185,14 @@
+                options->challenge_response_authentication = 1;
+        if (options->gss_authentication == -1)
+                options->gss_authentication = 0;
++       if (options->gss_keyex == -1)
++               options->gss_keyex = 0;
+        if (options->gss_deleg_creds == -1)
+                options->gss_deleg_creds = 0;
++       if (options->gss_trust_dns == -1)
++               options->gss_trust_dns = 0;
++       if (options->gss_renewal_rekey == -1)
++               options->gss_renewal_rekey = 0;
+        if (options->password_authentication == -1)
+                options->password_authentication = 1;
+        if (options->kbd_interactive_authentication == -1)
+Index: b/readconf.h
+===================================================================
+--- a/readconf.h
++++ b/readconf.h
+@@ -46,7 +46,11 @@
+        int     challenge_response_authentication;
+                                        /* Try S/Key or TIS, authentication. */
+        int     gss_authentication;     /* Try GSS authentication */
++       int     gss_keyex;              /* Try GSS key exchange */
+        int     gss_deleg_creds;        /* Delegate GSS credentials */
++       int     gss_trust_dns;          /* Trust DNS for GSS canonicalization */
++       int     gss_renewal_rekey;      /* Credential renewal forces rekey */
++       char    *gss_client_identity;   /* Principal to initiate GSSAPI with */
+        int     password_authentication;        /* Try password
+                                                 * authentication. */
+        int     kbd_interactive_authentication; /* Try keyboard-interactive auth. */
+Index: b/servconf.c
+===================================================================
+--- a/servconf.c
++++ b/servconf.c
+@@ -93,7 +93,10 @@
+        options->kerberos_ticket_cleanup = -1;
+        options->kerberos_get_afs_token = -1;
+        options->gss_authentication=-1;
++       options->gss_keyex = -1;
+        options->gss_cleanup_creds = -1;
++       options->gss_strict_acceptor = -1;
++       options->gss_store_rekey = -1;
+        options->password_authentication = -1;
+        options->kbd_interactive_authentication = -1;
+        options->challenge_response_authentication = -1;
+@@ -215,8 +218,14 @@
+                options->kerberos_get_afs_token = 0;
+        if (options->gss_authentication == -1)
+                options->gss_authentication = 0;
++       if (options->gss_keyex == -1)
++               options->gss_keyex = 0;
+        if (options->gss_cleanup_creds == -1)
+                options->gss_cleanup_creds = 1;
++       if (options->gss_strict_acceptor == -1)
++               options->gss_strict_acceptor = 1;
++       if (options->gss_store_rekey == -1)
++               options->gss_store_rekey = 0;
+        if (options->password_authentication == -1)
+                options->password_authentication = 1;
+        if (options->kbd_interactive_authentication == -1)
+@@ -307,7 +316,9 @@
+        sBanner, sUseDNS, sHostbasedAuthentication,
+        sHostbasedUsesNameFromPacketOnly, sClientAliveInterval,
+        sClientAliveCountMax, sAuthorizedKeysFile, sAuthorizedKeysFile2,
+-       sGssAuthentication, sGssCleanupCreds, sAcceptEnv, sPermitTunnel,
++       sGssAuthentication, sGssCleanupCreds, sGssStrictAcceptor,
++       sGssKeyEx, sGssStoreRekey,
++       sAcceptEnv, sPermitTunnel,
+        sMatch, sPermitOpen, sForceCommand, sChrootDirectory,
+        sUsePrivilegeSeparation, sAllowAgentForwarding,
+        sZeroKnowledgePasswordAuthentication, sHostCertificate,
+@@ -370,9 +381,15 @@
+ #ifdef GSSAPI
+        { "gssapiauthentication", sGssAuthentication, SSHCFG_ALL },
+        { "gssapicleanupcredentials", sGssCleanupCreds, SSHCFG_GLOBAL },
++       { "gssapistrictacceptorcheck", sGssStrictAcceptor, SSHCFG_GLOBAL },
++       { "gssapikeyexchange", sGssKeyEx, SSHCFG_GLOBAL },
++       { "gssapistorecredentialsonrekey", sGssStoreRekey, SSHCFG_GLOBAL },
+ #else
+        { "gssapiauthentication", sUnsupported, SSHCFG_ALL },
+        { "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL },
++       { "gssapistrictacceptorcheck", sUnsupported, SSHCFG_GLOBAL },
++       { "gssapikeyexchange", sUnsupported, SSHCFG_GLOBAL },
++       { "gssapistorecredentialsonrekey", sUnsupported, SSHCFG_GLOBAL },
+ #endif
+        { "passwordauthentication", sPasswordAuthentication, SSHCFG_ALL },
+        { "kbdinteractiveauthentication", sKbdInteractiveAuthentication, SSHCFG_ALL },
+@@ -926,10 +943,22 @@
+                intptr = &options->gss_authentication;
+                goto parse_flag;
+ 
++       case sGssKeyEx:
++               intptr = &options->gss_keyex;
++               goto parse_flag;
++
+        case sGssCleanupCreds:
+                intptr = &options->gss_cleanup_creds;
+                goto parse_flag;
+ 
++       case sGssStrictAcceptor:
++               intptr = &options->gss_strict_acceptor;
++               goto parse_flag;
++
++       case sGssStoreRekey:
++               intptr = &options->gss_store_rekey;
++               goto parse_flag;
++
+        case sPasswordAuthentication:
+                intptr = &options->password_authentication;
+                goto parse_flag;
+Index: b/servconf.h
+===================================================================
+--- a/servconf.h
++++ b/servconf.h
+@@ -94,7 +94,10 @@
+        int     kerberos_get_afs_token;         /* If true, try to get AFS token if
+                                                 * authenticated with Kerberos. */
+        int     gss_authentication;     /* If true, permit GSSAPI authentication */
++       int     gss_keyex;              /* If true, permit GSSAPI key exchange */
+        int     gss_cleanup_creds;      /* If true, destroy cred cache on logout */
++       int     gss_strict_acceptor;    /* If true, restrict the GSSAPI acceptor name */
++       int     gss_store_rekey;
+        int     password_authentication;        /* If true, permit password
+                                                 * authentication. */
+        int     kbd_interactive_authentication; /* If true, permit */
+Index: b/ssh-gss.h
+===================================================================
+--- a/ssh-gss.h
++++ b/ssh-gss.h
+@@ -1,6 +1,6 @@
+ /* $OpenBSD: ssh-gss.h,v 1.10 2007/06/12 08:20:00 djm Exp $ */
+ /*
+- * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
++ * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.
+  *
+  * Redistribution and use in source and binary forms, with or without
+  * modification, are permitted provided that the following conditions
+@@ -60,10 +60,22 @@
+ 
+ #define SSH_GSS_OIDTYPE 0x06
+ 
++#define SSH2_MSG_KEXGSS_INIT                            30
++#define SSH2_MSG_KEXGSS_CONTINUE                        31
++#define SSH2_MSG_KEXGSS_COMPLETE                        32
++#define SSH2_MSG_KEXGSS_HOSTKEY                         33
++#define SSH2_MSG_KEXGSS_ERROR                           34
++#define SSH2_MSG_KEXGSS_GROUPREQ                       40
++#define SSH2_MSG_KEXGSS_GROUP                          41
++#define KEX_GSS_GRP1_SHA1_ID                           "gss-group1-sha1-"
++#define KEX_GSS_GRP14_SHA1_ID                          "gss-group14-sha1-"
++#define KEX_GSS_GEX_SHA1_ID                            "gss-gex-sha1-"
++
+ typedef struct {
+        char *filename;
+        char *envvar;
+        char *envval;
++       struct passwd *owner;
+        void *data;
+ } ssh_gssapi_ccache;
+ 
+@@ -71,8 +83,11 @@
+        gss_buffer_desc displayname;
+        gss_buffer_desc exportedname;
+        gss_cred_id_t creds;
++       gss_name_t name;
+        struct ssh_gssapi_mech_struct *mech;
+        ssh_gssapi_ccache store;
++       int used;
++       int updated;
+ } ssh_gssapi_client;
+ 
+ typedef struct ssh_gssapi_mech_struct {
+@@ -83,6 +98,7 @@
+        int (*userok) (ssh_gssapi_client *, char *);
+        int (*localname) (ssh_gssapi_client *, char **);
+        void (*storecreds) (ssh_gssapi_client *);
++       int (*updatecreds) (ssh_gssapi_ccache *, ssh_gssapi_client *);
+ } ssh_gssapi_mech;
+ 
+ typedef struct {
+@@ -93,10 +109,11 @@
+        gss_OID         oid; /* client */
+        gss_cred_id_t   creds; /* server */
+        gss_name_t      client; /* server */
+-       gss_cred_id_t   client_creds; /* server */
++       gss_cred_id_t   client_creds; /* both */
+ } Gssctxt;
+ 
+ extern ssh_gssapi_mech *supported_mechs[];
++extern Gssctxt *gss_kex_context;
+ 
+ int  ssh_gssapi_check_oid(Gssctxt *, void *, size_t);
+ void ssh_gssapi_set_oid_data(Gssctxt *, void *, size_t);
+@@ -116,16 +133,30 @@
+ void ssh_gssapi_delete_ctx(Gssctxt **);
+ OM_uint32 ssh_gssapi_sign(Gssctxt *, gss_buffer_t, gss_buffer_t);
+ void ssh_gssapi_buildmic(Buffer *, const char *, const char *, const char *);
+-int ssh_gssapi_check_mechanism(Gssctxt **, gss_OID, const char *);
++int ssh_gssapi_check_mechanism(Gssctxt **, gss_OID, const char *, const char *);
++OM_uint32 ssh_gssapi_client_identity(Gssctxt *, const char *);
++int ssh_gssapi_credentials_updated(Gssctxt *);
+ 
+ /* In the server */
++typedef int ssh_gssapi_check_fn(Gssctxt **, gss_OID, const char *, 
++    const char *);
++char *ssh_gssapi_client_mechanisms(const char *, const char *);
++char *ssh_gssapi_kex_mechs(gss_OID_set, ssh_gssapi_check_fn *, const char *,
++    const char *);
++gss_OID ssh_gssapi_id_kex(Gssctxt *, char *, int);
++int ssh_gssapi_server_check_mech(Gssctxt **,gss_OID, const char *, 
++    const char *);
+ OM_uint32 ssh_gssapi_server_ctx(Gssctxt **, gss_OID);
+-int ssh_gssapi_userok(char *name);
++int ssh_gssapi_userok(char *name, struct passwd *);
+ OM_uint32 ssh_gssapi_checkmic(Gssctxt *, gss_buffer_t, gss_buffer_t);
+ void ssh_gssapi_do_child(char ***, u_int *);
+ void ssh_gssapi_cleanup_creds(void);
+ void ssh_gssapi_storecreds(void);
+ 
++char *ssh_gssapi_server_mechanisms(void);
++int ssh_gssapi_oid_table_ok();
++
++int ssh_gssapi_update_creds(ssh_gssapi_ccache *store);
+ #endif /* GSSAPI */
+ 
+ #endif /* _SSH_GSS_H */
+Index: b/ssh_config
+===================================================================
+--- a/ssh_config
++++ b/ssh_config
+@@ -26,6 +26,8 @@
+ #   HostbasedAuthentication no
+ #   GSSAPIAuthentication no
+ #   GSSAPIDelegateCredentials no
++#   GSSAPIKeyExchange no
++#   GSSAPITrustDNS no
+ #   BatchMode no
+ #   CheckHostIP yes
+ #   AddressFamily any
+Index: b/ssh_config.5
+===================================================================
+--- a/ssh_config.5
++++ b/ssh_config.5
+@@ -509,11 +509,38 @@
+ The default is
+ .Dq no .
+ Note that this option applies to protocol version 2 only.
++.It Cm GSSAPIKeyExchange
++Specifies whether key exchange based on GSSAPI may be used. When using
++GSSAPI key exchange the server need not have a host key.
++The default is
++.Dq no .
++Note that this option applies to protocol version 2 only.
++.It Cm GSSAPIClientIdentity
++If set, specifies the GSSAPI client identity that ssh should use when 
++connecting to the server. The default is unset, which means that the default 
++identity will be used.
+ .It Cm GSSAPIDelegateCredentials
+ Forward (delegate) credentials to the server.
+ The default is
+ .Dq no .
+-Note that this option applies to protocol version 2 only.
++Note that this option applies to protocol version 2 connections using GSSAPI.
++.It Cm GSSAPIRenewalForcesRekey
++If set to 
++.Dq yes
++then renewal of the client's GSSAPI credentials will force the rekeying of the
++ssh connection. With a compatible server, this can delegate the renewed 
++credentials to a session on the server.
++The default is
++.Dq no .
++.It Cm GSSAPITrustDns
++Set to 
++.Dq yes to indicate that the DNS is trusted to securely canonicalize
++the name of the host being connected to. If 
++.Dq no, the hostname entered on the
++command line will be passed untouched to the GSSAPI library.
++The default is
++.Dq no .
++This option only applies to protocol version 2 connections using GSSAPI.
+ .It Cm HashKnownHosts
+ Indicates that
+ .Xr ssh 1
+Index: b/sshconnect2.c
+===================================================================
+--- a/sshconnect2.c
++++ b/sshconnect2.c
+@@ -106,9 +106,34 @@
+ {
+        Kex *kex;
+ 
++#ifdef GSSAPI
++       char *orig = NULL, *gss = NULL;
++       char *gss_host = NULL;
++#endif
++
+        xxx_host = host;
+        xxx_hostaddr = hostaddr;
+ 
++#ifdef GSSAPI
++       if (options.gss_keyex) {
++               /* Add the GSSAPI mechanisms currently supported on this 
++                * client to the key exchange algorithm proposal */
++               orig = myproposal[PROPOSAL_KEX_ALGS];
++
++               if (options.gss_trust_dns)
++                       gss_host = (char *)get_canonical_hostname(1);
++               else
++                       gss_host = host;
++
++               gss = ssh_gssapi_client_mechanisms(gss_host, options.gss_client_identity);
++               if (gss) {
++                       debug("Offering GSSAPI proposal: %s", gss);
++                       xasprintf(&myproposal[PROPOSAL_KEX_ALGS],
++                           "%s,%s", gss, orig);
++               }
++       }
++#endif
++
+        if (options.ciphers == (char *)-1) {
+                logit("No valid ciphers for protocol version 2 given, using defaults.");
+                options.ciphers = NULL;
+@@ -136,6 +161,17 @@
+                myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] =
+                    options.hostkeyalgorithms;
+ 
++#ifdef GSSAPI
++       /* If we've got GSSAPI algorithms, then we also support the
++        * 'null' hostkey, as a last resort */
++       if (options.gss_keyex && gss) {
++               orig = myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS];
++               xasprintf(&myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS], 
++                   "%s,null", orig);
++               xfree(gss);
++       }
++#endif
++
+        if (options.rekey_limit)
+                packet_set_rekey_limit((u_int32_t)options.rekey_limit);
+ 
+@@ -145,10 +181,26 @@
+        kex->kex[KEX_DH_GRP14_SHA1] = kexdh_client;
+        kex->kex[KEX_DH_GEX_SHA1] = kexgex_client;
+        kex->kex[KEX_DH_GEX_SHA256] = kexgex_client;
++#ifdef GSSAPI
++       if (options.gss_keyex) {
++               kex->kex[KEX_GSS_GRP1_SHA1] = kexgss_client;
++               kex->kex[KEX_GSS_GRP14_SHA1] = kexgss_client;
++               kex->kex[KEX_GSS_GEX_SHA1] = kexgss_client;
++       }
++#endif
+        kex->client_version_string=client_version_string;
+        kex->server_version_string=server_version_string;
+        kex->verify_host_key=&verify_host_key_callback;
+ 
++#ifdef GSSAPI
++       if (options.gss_keyex) {
++               kex->gss_deleg_creds = options.gss_deleg_creds;
++               kex->gss_trust_dns = options.gss_trust_dns;
++               kex->gss_client = options.gss_client_identity;
++               kex->gss_host = gss_host;
++       }
++#endif
++
+        xxx_kex = kex;
+ 
+        dispatch_run(DISPATCH_BLOCK, &kex->done, kex);
+@@ -243,6 +295,7 @@
+ void   input_gssapi_hash(int type, u_int32_t, void *);
+ void   input_gssapi_error(int, u_int32_t, void *);
+ void   input_gssapi_errtok(int, u_int32_t, void *);
++int    userauth_gsskeyex(Authctxt *authctxt);
+ #endif
+ 
+ void   userauth(Authctxt *, char *);
+@@ -258,6 +311,11 @@
+ 
+ Authmethod authmethods[] = {
+ #ifdef GSSAPI
++       {"gssapi-keyex",
++               userauth_gsskeyex,
++               NULL,
++               &options.gss_authentication,
++               NULL},
+        {"gssapi-with-mic",
+                userauth_gssapi,
+                NULL,
+@@ -564,19 +622,29 @@
+        static u_int mech = 0;
+        OM_uint32 min;
+        int ok = 0;
++       const char *gss_host;
++
++       if (options.gss_trust_dns)
++               gss_host = get_canonical_hostname(1);
++       else
++               gss_host = authctxt->host;
+ 
+        /* Try one GSSAPI method at a time, rather than sending them all at
+         * once. */
+ 
+        if (gss_supported == NULL)
+-               gss_indicate_mechs(&min, &gss_supported);
++               if (GSS_ERROR(gss_indicate_mechs(&min, &gss_supported))) {
++                       gss_supported = NULL;
++                       return 0;
++               }
+ 
+        /* Check to see if the mechanism is usable before we offer it */
+        while (mech < gss_supported->count && !ok) {
+                /* My DER encoding requires length<128 */
+                if (gss_supported->elements[mech].length < 128 &&
+                    ssh_gssapi_check_mechanism(&gssctxt, 
+-                   &gss_supported->elements[mech], authctxt->host)) {
++                   &gss_supported->elements[mech], gss_host, 
++                    options.gss_client_identity)) {
+                        ok = 1; /* Mechanism works */
+                } else {
+                        mech++;
+@@ -673,8 +741,8 @@
+ {
+        Authctxt *authctxt = ctxt;
+        Gssctxt *gssctxt;
+-       int oidlen;
+-       char *oidv;
++       u_int oidlen;
++       u_char *oidv;
+ 
+        if (authctxt == NULL)
+                fatal("input_gssapi_response: no authentication context");
+@@ -784,6 +852,48 @@
+        xfree(msg);
+        xfree(lang);
+ }
++
++int
++userauth_gsskeyex(Authctxt *authctxt)
++{
++       Buffer b;
++       gss_buffer_desc gssbuf;
++       gss_buffer_desc mic = GSS_C_EMPTY_BUFFER;
++       OM_uint32 ms;
++
++       static int attempt = 0;
++       if (attempt++ >= 1)
++               return (0);
++
++       if (gss_kex_context == NULL) {
++               debug("No valid Key exchange context"); 
++               return (0);
++       }
++
++       ssh_gssapi_buildmic(&b, authctxt->server_user, authctxt->service,
++           "gssapi-keyex");
++
++       gssbuf.value = buffer_ptr(&b);
++       gssbuf.length = buffer_len(&b);
++
++       if (GSS_ERROR(ssh_gssapi_sign(gss_kex_context, &gssbuf, &mic))) {
++               buffer_free(&b);
++               return (0);
++       }
++
++       packet_start(SSH2_MSG_USERAUTH_REQUEST);
++       packet_put_cstring(authctxt->server_user);
++       packet_put_cstring(authctxt->service);
++       packet_put_cstring(authctxt->method->name);
++       packet_put_string(mic.value, mic.length);
++       packet_send();
++
++       buffer_free(&b);
++       gss_release_buffer(&ms, &mic);
++
++       return (1);
++}
++
+ #endif /* GSSAPI */
+ 
+ int
+Index: b/sshd.c
+===================================================================
+--- a/sshd.c
++++ b/sshd.c
+@@ -120,6 +120,10 @@
+ #include "roaming.h"
+ #include "version.h"
+ 
++#ifdef USE_SECURITY_SESSION_API
++#include <Security/AuthSession.h>
++#endif
++
+ #ifdef LIBWRAP
+ #include <tcpd.h>
+ #include <syslog.h>
+@@ -1586,10 +1590,13 @@
+                logit("Disabling protocol version 1. Could not load host key");
+                options.protocol &= ~SSH_PROTO_1;
+        }
++#ifndef GSSAPI
++       /* The GSSAPI key exchange can run without a host key */
+        if ((options.protocol & SSH_PROTO_2) && !sensitive_data.have_ssh2_key) {
+                logit("Disabling protocol version 2. Could not load host key");
+                options.protocol &= ~SSH_PROTO_2;
+        }
++#endif
+        if (!(options.protocol & (SSH_PROTO_1|SSH_PROTO_2))) {
+                logit("sshd: no hostkeys available -- exiting.");
+                exit(1);
+@@ -1918,6 +1925,60 @@
+        /* Log the connection. */
+        verbose("Connection from %.500s port %d", remote_ip, remote_port);
+ 
++#ifdef USE_SECURITY_SESSION_API
++       /*
++        * Create a new security session for use by the new user login if
++        * the current session is the root session or we are not launched
++        * by inetd (eg: debugging mode or server mode).  We do not
++        * necessarily need to create a session if we are launched from
++        * inetd because Panther xinetd will create a session for us.
++        *
++        * The only case where this logic will fail is if there is an
++        * inetd running in a non-root session which is not creating
++        * new sessions for us.  Then all the users will end up in the
++        * same session (bad).
++        *
++        * When the client exits, the session will be destroyed for us
++        * automatically.
++        *
++        * We must create the session before any credentials are stored
++        * (including AFS pags, which happens a few lines below).
++        */
++       {
++               OSStatus err = 0;
++               SecuritySessionId sid = 0;
++               SessionAttributeBits sattrs = 0;
++
++               err = SessionGetInfo(callerSecuritySession, &sid, &sattrs);
++               if (err)
++                       error("SessionGetInfo() failed with error %.8X",
++                           (unsigned) err);
++               else
++                       debug("Current Session ID is %.8X / Session Attributes are %.8X",
++                           (unsigned) sid, (unsigned) sattrs);
++
++               if (inetd_flag && !(sattrs & sessionIsRoot))
++                       debug("Running in inetd mode in a non-root session... "
++                           "assuming inetd created the session for us.");
++               else {
++                       debug("Creating new security session...");
++                       err = SessionCreate(0, sessionHasTTY | sessionIsRemote);
++                       if (err)
++                               error("SessionCreate() failed with error %.8X",
++                                   (unsigned) err);
++
++                       err = SessionGetInfo(callerSecuritySession, &sid, 
++                           &sattrs);
++                       if (err)
++                               error("SessionGetInfo() failed with error %.8X",
++                                   (unsigned) err);
++                       else
++                               debug("New Session ID is %.8X / Session Attributes are %.8X",
++                                   (unsigned) sid, (unsigned) sattrs);
++               }
++       }
++#endif
++
+        /*
+         * We don't want to listen forever unless the other side
+         * successfully authenticates itself.  So we set up an alarm which is
+@@ -2296,12 +2357,61 @@
+ 
+        myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = list_hostkey_types();
+ 
++#ifdef GSSAPI
++       {
++       char *orig;
++       char *gss = NULL;
++       char *newstr = NULL;
++       orig = myproposal[PROPOSAL_KEX_ALGS];
++
++       /* 
++        * If we don't have a host key, then there's no point advertising
++        * the other key exchange algorithms
++        */
++
++       if (strlen(myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS]) == 0)
++               orig = NULL;
++
++       if (options.gss_keyex)
++               gss = ssh_gssapi_server_mechanisms();
++       else
++               gss = NULL;
++
++       if (gss && orig)
++               xasprintf(&newstr, "%s,%s", gss, orig);
++       else if (gss)
++               newstr = gss;
++       else if (orig)
++               newstr = orig;
++
++       /* 
++        * If we've got GSSAPI mechanisms, then we've got the 'null' host
++        * key alg, but we can't tell people about it unless its the only
++        * host key algorithm we support
++        */
++       if (gss && (strlen(myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS])) == 0)
++               myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = "null";
++
++       if (newstr)
++               myproposal[PROPOSAL_KEX_ALGS] = newstr;
++       else
++               fatal("No supported key exchange algorithms");
++       }
++#endif
++
+        /* start key exchange */
+        kex = kex_setup(myproposal);
+        kex->kex[KEX_DH_GRP1_SHA1] = kexdh_server;
+        kex->kex[KEX_DH_GRP14_SHA1] = kexdh_server;
+        kex->kex[KEX_DH_GEX_SHA1] = kexgex_server;
+        kex->kex[KEX_DH_GEX_SHA256] = kexgex_server;
++#ifdef GSSAPI
++       if (options.gss_keyex) {
++               kex->kex[KEX_GSS_GRP1_SHA1] = kexgss_server;
++               kex->kex[KEX_GSS_GRP14_SHA1] = kexgss_server;
++               kex->kex[KEX_GSS_GEX_SHA1] = kexgss_server;
++       }
++#endif
+        kex->server = 1;
+        kex->client_version_string=client_version_string;
+        kex->server_version_string=server_version_string;
+Index: b/sshd_config
+===================================================================
+--- a/sshd_config
++++ b/sshd_config
+@@ -71,6 +71,8 @@
+ # GSSAPI options
+ #GSSAPIAuthentication no
+ #GSSAPICleanupCredentials yes
++#GSSAPIStrictAcceptorCheck yes
++#GSSAPIKeyExchange no
+ 
+ # Set this to 'yes' to enable PAM authentication, account processing, 
+ # and session processing. If this is enabled, PAM authentication will 
+Index: b/sshd_config.5
+===================================================================
+--- a/sshd_config.5
++++ b/sshd_config.5
+@@ -424,12 +424,40 @@
+ The default is
+ .Dq no .
+ Note that this option applies to protocol version 2 only.
++.It Cm GSSAPIKeyExchange
++Specifies whether key exchange based on GSSAPI is allowed. GSSAPI key exchange
++doesn't rely on ssh keys to verify host identity.
++The default is
++.Dq no .
++Note that this option applies to protocol version 2 only.
+ .It Cm GSSAPICleanupCredentials
+ Specifies whether to automatically destroy the user's credentials cache
+ on logout.
+ The default is
+ .Dq yes .
+ Note that this option applies to protocol version 2 only.
++.It Cm GSSAPIStrictAcceptorCheck
++Determines whether to be strict about the identity of the GSSAPI acceptor 
++a client authenticates against. If
++.Dq yes
++then the client must authenticate against the
++.Pa host
++service on the current hostname. If 
++.Dq no
++then the client may authenticate against any service key stored in the 
++machine's default store. This facility is provided to assist with operation 
++on multi homed machines. 
++The default is
++.Dq yes .
++Note that this option applies only to protocol version 2 GSSAPI connections,
++and setting it to 
++.Dq no
++may only work with recent Kerberos GSSAPI libraries.
++.It Cm GSSAPIStoreCredentialsOnRekey
++Controls whether the user's GSSAPI credentials should be updated following a 
++successful connection rekeying. This option can be used to accepted renewed 
++or updated credentials from a compatible client. The default is
++.Dq no .
+ .It Cm HostbasedAuthentication
+ Specifies whether rhosts or /etc/hosts.equiv authentication together
+ with successful public key client host authentication is allowed
diff --git a/debian/patches/helpful-wait-terminate.patch b/debian/patches/helpful-wait-terminate.patch
new file mode 100644
index 000000000..857f86456
--- /dev/null
+++ b/debian/patches/helpful-wait-terminate.patch
@@ -0,0 +1,18 @@
+Description: Mention ~& when waiting for forwarded connections to terminate
+Author: Matthew Vernon <matthew@debian.org>
+Bug-Debian: http://bugs.debian.org/50308
+Last-Update: 2010-02-27
+
+Index: b/serverloop.c
+===================================================================
+--- a/serverloop.c
++++ b/serverloop.c
+@@ -680,7 +680,7 @@
+                        if (!channel_still_open())
+                                break;
+                        if (!waiting_termination) {
+-                               const char *s = "Waiting for forwarded connections to terminate...\r\n";
++                               const char *s = "Waiting for forwarded connections to terminate... (press ~& to background)\r\n";
+                                char *cp;
+                                waiting_termination = 1;
+                                buffer_append(&stderr_buffer, s, strlen(s));
diff --git a/debian/patches/keepalive-extensions.patch b/debian/patches/keepalive-extensions.patch
new file mode 100644
index 000000000..9e1705719
--- /dev/null
+++ b/debian/patches/keepalive-extensions.patch
@@ -0,0 +1,124 @@
+Description: Various keepalive extensions
+ Add compatibility aliases for ProtocolKeepAlives and SetupTimeOut,
+ supported in previous versions of Debian's OpenSSH package but since
+ superseded by ServerAliveInterval.  (We're probably stuck with this bit for
+ compatibility.)
+ .
+ In batch mode, default ServerAliveInterval to five minutes.
+ .
+ Adjust documentation to match and to give some more advice on use of
+ keepalives.
+Author: Richard Kettlewell <rjk@greenend.org.uk>
+Author: Ian Jackson <ian@chiark.greenend.org.uk>
+Author: Matthew Vernon <matthew@debian.org>
+Author: Colin Watson <cjwatson@debian.org>
+Last-Update: 2010-02-27
+
+Index: b/readconf.c
+===================================================================
+--- a/readconf.c
++++ b/readconf.c
+@@ -134,6 +134,7 @@
+        oHashKnownHosts,
+        oTunnel, oTunnelDevice, oLocalCommand, oPermitLocalCommand,
+        oVisualHostKey, oUseRoaming, oZeroKnowledgePasswordAuthentication,
++       oProtocolKeepAlives, oSetupTimeOut,
+        oDeprecated, oUnsupported
+ } OpCodes;
+ 
+@@ -251,6 +252,8 @@
+ #else
+        { "zeroknowledgepasswordauthentication", oUnsupported },
+ #endif
++       { "protocolkeepalives", oProtocolKeepAlives },
++       { "setuptimeout", oSetupTimeOut },
+ 
+        { NULL, oBadOption }
+ };
+@@ -865,6 +868,8 @@
+                goto parse_flag;
+ 
+        case oServerAliveInterval:
++       case oProtocolKeepAlives: /* Debian-specific compatibility alias */
++       case oSetupTimeOut:       /* Debian-specific compatibility alias */
+                intptr = &options->server_alive_interval;
+                goto parse_time;
+ 
+@@ -1284,8 +1289,13 @@
+                options->rekey_limit = 0;
+        if (options->verify_host_key_dns == -1)
+                options->verify_host_key_dns = 0;
+-       if (options->server_alive_interval == -1)
+-               options->server_alive_interval = 0;
++       if (options->server_alive_interval == -1) {
++               /* in batch mode, default is 5mins */
++               if (options->batch_mode == 1)
++                       options->server_alive_interval = 300;
++               else
++                       options->server_alive_interval = 0;
++       }
+        if (options->server_alive_count_max == -1)
+                options->server_alive_count_max = 3;
+        if (options->control_master == -1)
+Index: b/ssh_config.5
+===================================================================
+--- a/ssh_config.5
++++ b/ssh_config.5
+@@ -128,8 +128,12 @@
+ If set to
+ .Dq yes ,
+ passphrase/password querying will be disabled.
++In addition, the
++.Cm ServerAliveInterval
++option will be set to 300 seconds by default.
+ This option is useful in scripts and other batch jobs where no user
+-is present to supply the password.
++is present to supply the password,
++and where it is desirable to detect a broken network swiftly.
+ The argument must be
+ .Dq yes
+ or
+@@ -994,8 +998,15 @@
+ will send a message through the encrypted
+ channel to request a response from the server.
+ The default
+-is 0, indicating that these messages will not be sent to the server.
++is 0, indicating that these messages will not be sent to the server,
++or 300 if the
++.Cm BatchMode
++option is set.
+ This option applies to protocol version 2 only.
++.Cm ProtocolKeepAlives
++and
++.Cm SetupTimeOut
++are Debian-specific compatibility aliases for this option.
+ .It Cm StrictHostKeyChecking
+ If this flag is set to
+ .Dq yes ,
+@@ -1034,6 +1045,12 @@
+ other side.
+ If they are sent, death of the connection or crash of one
+ of the machines will be properly noticed.
++This option only uses TCP keepalives (as opposed to using ssh level
++keepalives), so takes a long time to notice when the connection dies.
++As such, you probably want
++the
++.Cm ServerAliveInterval
++option as well.
+ However, this means that
+ connections will die if the route is down temporarily, and some people
+ find it annoying.
+Index: b/sshd_config.5
+===================================================================
+--- a/sshd_config.5
++++ b/sshd_config.5
+@@ -985,6 +985,9 @@
+ .Pp
+ To disable TCP keepalive messages, the value should be set to
+ .Dq no .
++.Pp
++This option was formerly called
++.Cm KeepAlive .
+ .It Cm TrustedUserCAKeys
+ Specifies a file containing public keys of certificate authorities that are
+ trusted to sign user certificates for authentication.
diff --git a/debian/patches/lintian-symlink-pickiness.patch b/debian/patches/lintian-symlink-pickiness.patch
new file mode 100644
index 000000000..955d38b50
--- /dev/null
+++ b/debian/patches/lintian-symlink-pickiness.patch
@@ -0,0 +1,23 @@
+Description: Fix picky lintian errors about slogin symlinks
+ Apparently this breaks some SVR4 packaging systems, so upstream can't win
+ either way and opted to keep the status quo.  We need this patch anyway.
+Author: Colin Watson <cjwatson@debian.org>
+Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1728
+Last-Update: 2010-04-10
+
+Index: b/Makefile.in
+===================================================================
+--- a/Makefile.in
++++ b/Makefile.in
+@@ -294,9 +294,9 @@
+        $(INSTALL) -m 644 ssh-pkcs11-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8
+        $(INSTALL) -m 644 ssh-vulnkey.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-vulnkey.1
+        -rm -f $(DESTDIR)$(bindir)/slogin
+-       ln -s ./ssh$(EXEEXT) $(DESTDIR)$(bindir)/slogin
++       ln -s ssh$(EXEEXT) $(DESTDIR)$(bindir)/slogin
+        -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/slogin.1
+-       ln -s ./ssh.1 $(DESTDIR)$(mandir)/$(mansubdir)1/slogin.1
++       ln -s ssh.1 $(DESTDIR)$(mandir)/$(mansubdir)1/slogin.1
+ 
+ install-sysconf:
+        if [ ! -d $(DESTDIR)$(sysconfdir) ]; then \
diff --git a/debian/patches/openbsd-docs.patch b/debian/patches/openbsd-docs.patch
new file mode 100644
index 000000000..de63e46f8
--- /dev/null
+++ b/debian/patches/openbsd-docs.patch
@@ -0,0 +1,117 @@
+Description: Adjust various OpenBSD-specific references in manual pages
+ No single bug reference for this patch, but history includes:
+  http://bugs.debian.org/154434 (login.conf(5))
+  http://bugs.debian.org/513417 (/etc/rc)
+  http://bugs.debian.org/530692 (ssl(8))
+  https://bugs.launchpad.net/bugs/456660 (ssl(8))
+Author: Colin Watson <cjwatson@debian.org>
+Forwarded: not-needed
+Last-Update: 2010-02-28
+
+Index: b/moduli.5
+===================================================================
+--- a/moduli.5
++++ b/moduli.5
+@@ -21,7 +21,7 @@
+ .Nd Diffie Hellman moduli
+ .Sh DESCRIPTION
+ The
+-.Pa /etc/moduli
++.Pa /etc/ssh/moduli
+ file contains prime numbers and generators for use by 
+ .Xr sshd 8
+ in the Diffie-Hellman Group Exchange key exchange method.
+@@ -111,7 +111,7 @@
+ Diffie Hellman output to sufficiently key the selected symmetric cipher.
+ .Xr sshd 8
+ then randomly selects a modulus from
+-.Fa /etc/moduli
++.Fa /etc/ssh/moduli
+ that best meets the size requirement.
+ .Pp
+ .Sh SEE ALSO
+Index: b/ssh-keygen.1
+===================================================================
+--- a/ssh-keygen.1
++++ b/ssh-keygen.1
+@@ -148,9 +148,7 @@
+ .Pa ~/.ssh/id_dsa
+ or
+ .Pa ~/.ssh/id_rsa .
+-Additionally, the system administrator may use this to generate host keys,
+-as seen in
+-.Pa /etc/rc .
++Additionally, the system administrator may use this to generate host keys.
+ .Pp
+ Normally this program generates the key and asks for a file in which
+ to store the private key.
+@@ -394,9 +392,7 @@
+ .It Fl q
+ Silence
+ .Nm ssh-keygen .
+-Used by
+-.Pa /etc/rc
+-when creating a new key.
++Used by system administration scripts when creating a new key.
+ .It Fl R Ar hostname
+ Removes all keys belonging to
+ .Ar hostname
+Index: b/ssh.1
+===================================================================
+--- a/ssh.1
++++ b/ssh.1
+@@ -728,6 +728,10 @@
+ .Sx HISTORY
+ section of
+ .Xr ssl 8
++(on non-OpenBSD systems, see
++.nh
++http://www.openbsd.org/cgi\-bin/man.cgi?query=ssl&sektion=8#HISTORY)
++.hy
+ contains a brief discussion of the two algorithms.
+ .Pp
+ The file
+Index: b/sshd.8
+===================================================================
+--- a/sshd.8
++++ b/sshd.8
+@@ -70,7 +70,7 @@
+ .Nm
+ listens for connections from clients.
+ It is normally started at boot from
+-.Pa /etc/rc .
++.Pa /etc/init.d/ssh .
+ It forks a new
+ daemon for each incoming connection.
+ The forked daemons handle
+@@ -845,7 +845,7 @@
+ .Xr ssh 1 ) .
+ It should only be writable by root.
+ .Pp
+-.It /etc/moduli
++.It /etc/ssh/moduli
+ Contains Diffie-Hellman groups used for the "Diffie-Hellman Group Exchange".
+ The file format is described in
+ .Xr moduli 5 .
+@@ -941,7 +941,6 @@
+ .Xr ssh-vulnkey 1 ,
+ .Xr chroot 2 ,
+ .Xr hosts_access 5 ,
+-.Xr login.conf 5 ,
+ .Xr moduli 5 ,
+ .Xr sshd_config 5 ,
+ .Xr inetd 8 ,
+Index: b/sshd_config.5
+===================================================================
+--- a/sshd_config.5
++++ b/sshd_config.5
+@@ -222,8 +222,7 @@
+ By default, no banner is displayed.
+ .It Cm ChallengeResponseAuthentication
+ Specifies whether challenge-response authentication is allowed (e.g. via
+-PAM or though authentication styles supported in
+-.Xr login.conf 5 )
++PAM).
+ The default is
+ .Dq yes .
+ .It Cm ChrootDirectory
diff --git a/debian/patches/package-versioning.patch b/debian/patches/package-versioning.patch
new file mode 100644
index 000000000..67e014002
--- /dev/null
+++ b/debian/patches/package-versioning.patch
@@ -0,0 +1,50 @@
+Description: Include the Debian version in our identification
+ This makes it easier to audit networks for versions patched against
+ security vulnerabilities.  It has little detrimental effect, as attackers
+ will generally just try attacks rather than bothering to scan for
+ vulnerable-looking version strings.  (However, see debian-banner.patch.)
+Author: Matthew Vernon <matthew@debian.org>
+Forwarded: not-needed
+Last-Update: 2010-02-28
+
+Index: b/sshconnect.c
+===================================================================
+--- a/sshconnect.c
++++ b/sshconnect.c
+@@ -542,7 +542,7 @@
+        snprintf(buf, sizeof buf, "SSH-%d.%d-%.100s%s",
+            compat20 ? PROTOCOL_MAJOR_2 : PROTOCOL_MAJOR_1,
+            compat20 ? PROTOCOL_MINOR_2 : minor1,
+-           SSH_VERSION, compat20 ? "\r\n" : "\n");
++           SSH_RELEASE, compat20 ? "\r\n" : "\n");
+        if (roaming_atomicio(vwrite, connection_out, buf, strlen(buf))
+            != strlen(buf))
+                fatal("write: %.100s", strerror(errno));
+Index: b/sshd.c
+===================================================================
+--- a/sshd.c
++++ b/sshd.c
+@@ -422,7 +422,7 @@
+                minor = PROTOCOL_MINOR_1;
+        }
+        snprintf(buf, sizeof buf, "SSH-%d.%d-%.100s%s", major, minor,
+-           SSH_VERSION, newline);
++           SSH_RELEASE, newline);
+        server_version_string = xstrdup(buf);
+ 
+        /* Send our protocol version identification. */
+Index: b/version.h
+===================================================================
+--- a/version.h
++++ b/version.h
+@@ -3,4 +3,9 @@
+ #define SSH_VERSION    "OpenSSH_5.6"
+ 
+ #define SSH_PORTABLE   "p1"
+-#define SSH_RELEASE    SSH_VERSION SSH_PORTABLE
++#define SSH_RELEASE_MINIMUM    SSH_VERSION SSH_PORTABLE
++#ifdef SSH_EXTRAVERSION
++#define SSH_RELEASE    SSH_RELEASE_MINIMUM " " SSH_EXTRAVERSION
++#else
++#define SSH_RELEASE    SSH_RELEASE_MINIMUM
++#endif
diff --git a/debian/patches/quieter-signals.patch b/debian/patches/quieter-signals.patch
new file mode 100644
index 000000000..f8bc5fd4e
--- /dev/null
+++ b/debian/patches/quieter-signals.patch
@@ -0,0 +1,31 @@
+Description: Reduce severity of "Killed by signal %d"
+ This produces irritating messages when using ProxyCommand or other programs
+ that use ssh under the covers (e.g. Subversion).  These messages are more
+ normally printed by the calling program, such as the shell.
+ .
+ According to the upstream bug, the right way to avoid this is to use the -q
+ option, so we may drop this patch after further investigation into whether
+ any software in Debian is still relying on it.
+Author: Peter Samuelson <peter@p12n.org>
+Author: Colin Watson <cjwatson@debian.org>
+Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1118
+Bug-Debian: http://bugs.debian.org/313371
+Last-Update: 2010-02-27
+
+Index: b/clientloop.c
+===================================================================
+--- a/clientloop.c
++++ b/clientloop.c
+@@ -1594,8 +1594,10 @@
+                exit_status = 0;
+        }
+ 
+-       if (received_signal)
+-               fatal("Killed by signal %d.", (int) received_signal);
++       if (received_signal) {
++               debug("Killed by signal %d.", (int) received_signal);
++               cleanup_exit((int) received_signal + 128);
++       }
+ 
+        /*
+         * In interactive mode (with pseudo tty) display a message indicating
diff --git a/debian/patches/scp-quoting.patch b/debian/patches/scp-quoting.patch
new file mode 100644
index 000000000..3f06225ad
--- /dev/null
+++ b/debian/patches/scp-quoting.patch
@@ -0,0 +1,32 @@
+Description: Adjust scp quoting in verbose mode
+ Tweak scp's reporting of filenames in verbose mode to be a bit less
+ confusing with spaces.
+ .
+ This should be revised to mimic real shell quoting.
+Author: Nicolas Valcárcel <nvalcarcel@ubuntu.com>
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/89945
+Last-Update: 2010-02-27
+
+Index: b/scp.c
+===================================================================
+--- a/scp.c
++++ b/scp.c
+@@ -182,8 +182,16 @@
+ 
+        if (verbose_mode) {
+                fprintf(stderr, "Executing:");
+-               for (i = 0; i < a->num; i++)
+-                       fprintf(stderr, " %s", a->list[i]);
++               for (i = 0; i < a->num; i++) {
++                       if (i == 0)
++                               fprintf(stderr, " %s", a->list[i]);
++                       else
++                               /*
++                                * TODO: misbehaves if a->list[i] contains a
++                                * single quote
++                                */
++                               fprintf(stderr, " '%s'", a->list[i]);
++               }
+                fprintf(stderr, "\n");
+        }
+        if ((pid = fork()) == -1)
diff --git a/debian/patches/selinux-role.patch b/debian/patches/selinux-role.patch
new file mode 100644
index 000000000..8a7e7c687
--- /dev/null
+++ b/debian/patches/selinux-role.patch
@@ -0,0 +1,293 @@
+Description: Handle SELinux authorisation roles
+ Rejected upstream due to discomfort with magic usernames; a better approach
+ will need an SSH protocol change.  In the meantime, this came from Debian's
+ SELinux maintainer, so we'll keep it until we have something better.
+Author: Manoj Srivastava <srivasta@debian.org>
+Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1641
+Bug-Debian: http://bugs.debian.org/394795
+Last-Update: 2010-02-27
+
+Index: b/auth.h
+===================================================================
+--- a/auth.h
++++ b/auth.h
+@@ -59,6 +59,7 @@
+        char            *service;
+        struct passwd   *pw;            /* set if 'valid' */
+        char            *style;
++       char            *role;
+        void            *kbdintctxt;
+        void            *jpake_ctx;
+ #ifdef BSD_AUTH
+Index: b/auth1.c
+===================================================================
+--- a/auth1.c
++++ b/auth1.c
+@@ -383,7 +383,7 @@
+ do_authentication(Authctxt *authctxt)
+ {
+        u_int ulen;
+-       char *user, *style = NULL;
++       char *user, *style = NULL, *role = NULL;
+ 
+        /* Get the name of the user that we wish to log in as. */
+        packet_read_expect(SSH_CMSG_USER);
+@@ -392,11 +392,17 @@
+        user = packet_get_string(&ulen);
+        packet_check_eom();
+ 
++       if ((role = strchr(user, '/')) != NULL)
++               *role++ = '\0';
++
+        if ((style = strchr(user, ':')) != NULL)
+                *style++ = '\0';
++       else if (role && (style = strchr(role, ':')) != NULL)
++               *style++ = '\0';
+ 
+        authctxt->user = user;
+        authctxt->style = style;
++       authctxt->role = role;
+ 
+        /* Verify that the user is a valid user. */
+        if ((authctxt->pw = PRIVSEP(getpwnamallow(user))) != NULL)
+Index: b/auth2.c
+===================================================================
+--- a/auth2.c
++++ b/auth2.c
+@@ -217,7 +217,7 @@
+ {
+        Authctxt *authctxt = ctxt;
+        Authmethod *m = NULL;
+-       char *user, *service, *method, *style = NULL;
++       char *user, *service, *method, *style = NULL, *role = NULL;
+        int authenticated = 0;
+ 
+        if (authctxt == NULL)
+@@ -229,8 +229,13 @@
+        debug("userauth-request for user %s service %s method %s", user, service, method);
+        debug("attempt %d failures %d", authctxt->attempt, authctxt->failures);
+ 
++       if ((role = strchr(user, '/')) != NULL)
++               *role++ = 0;
++
+        if ((style = strchr(user, ':')) != NULL)
+                *style++ = 0;
++       else if (role && (style = strchr(role, ':')) != NULL)
++               *style++ = '\0';
+ 
+        if (authctxt->attempt++ == 0) {
+                /* setup auth context */
+@@ -254,8 +259,9 @@
+                    use_privsep ? " [net]" : "");
+                authctxt->service = xstrdup(service);
+                authctxt->style = style ? xstrdup(style) : NULL;
++               authctxt->role = role ? xstrdup(role) : NULL;
+                if (use_privsep)
+-                       mm_inform_authserv(service, style);
++                       mm_inform_authserv(service, style, role);
+                userauth_banner();
+        } else if (strcmp(user, authctxt->user) != 0 ||
+            strcmp(service, authctxt->service) != 0) {
+Index: b/monitor.c
+===================================================================
+--- a/monitor.c
++++ b/monitor.c
+@@ -137,6 +137,7 @@
+ int mm_answer_pwnamallow(int, Buffer *);
+ int mm_answer_auth2_read_banner(int, Buffer *);
+ int mm_answer_authserv(int, Buffer *);
++int mm_answer_authrole(int, Buffer *);
+ int mm_answer_authpassword(int, Buffer *);
+ int mm_answer_bsdauthquery(int, Buffer *);
+ int mm_answer_bsdauthrespond(int, Buffer *);
+@@ -215,6 +216,7 @@
+     {MONITOR_REQ_SIGN, MON_ONCE, mm_answer_sign},
+     {MONITOR_REQ_PWNAM, MON_ONCE, mm_answer_pwnamallow},
+     {MONITOR_REQ_AUTHSERV, MON_ONCE, mm_answer_authserv},
++    {MONITOR_REQ_AUTHROLE, MON_ONCE, mm_answer_authrole},
+     {MONITOR_REQ_AUTH2_READ_BANNER, MON_ONCE, mm_answer_auth2_read_banner},
+     {MONITOR_REQ_AUTHPASSWORD, MON_AUTH, mm_answer_authpassword},
+ #ifdef USE_PAM
+@@ -699,6 +701,7 @@
+        else {
+                /* Allow service/style information on the auth context */
+                monitor_permit(mon_dispatch, MONITOR_REQ_AUTHSERV, 1);
++               monitor_permit(mon_dispatch, MONITOR_REQ_AUTHROLE, 1);
+                monitor_permit(mon_dispatch, MONITOR_REQ_AUTH2_READ_BANNER, 1);
+        }
+ 
+@@ -732,14 +735,37 @@
+ 
+        authctxt->service = buffer_get_string(m, NULL);
+        authctxt->style = buffer_get_string(m, NULL);
+-       debug3("%s: service=%s, style=%s",
+-           __func__, authctxt->service, authctxt->style);
++       authctxt->role = buffer_get_string(m, NULL);
++       debug3("%s: service=%s, style=%s, role=%s",
++           __func__, authctxt->service, authctxt->style, authctxt->role);
+ 
+        if (strlen(authctxt->style) == 0) {
+                xfree(authctxt->style);
+                authctxt->style = NULL;
+        }
+ 
++       if (strlen(authctxt->role) == 0) {
++               xfree(authctxt->role);
++               authctxt->role = NULL;
++       }
++
++       return (0);
++}
++
++int
++mm_answer_authrole(int sock, Buffer *m)
++{
++       monitor_permit_authentications(1);
++
++       authctxt->role = buffer_get_string(m, NULL);
++       debug3("%s: role=%s",
++           __func__, authctxt->role);
++
++       if (strlen(authctxt->role) == 0) {
++               xfree(authctxt->role);
++               authctxt->role = NULL;
++       }
++
+        return (0);
+ }
+ 
+Index: b/monitor.h
+===================================================================
+--- a/monitor.h
++++ b/monitor.h
+@@ -30,7 +30,7 @@
+ 
+ enum monitor_reqtype {
+        MONITOR_REQ_MODULI, MONITOR_ANS_MODULI,
+-       MONITOR_REQ_FREE, MONITOR_REQ_AUTHSERV,
++       MONITOR_REQ_FREE, MONITOR_REQ_AUTHSERV, MONITOR_REQ_AUTHROLE,
+        MONITOR_REQ_SIGN, MONITOR_ANS_SIGN,
+        MONITOR_REQ_PWNAM, MONITOR_ANS_PWNAM,
+        MONITOR_REQ_AUTH2_READ_BANNER, MONITOR_ANS_AUTH2_READ_BANNER,
+Index: b/monitor_wrap.c
+===================================================================
+--- a/monitor_wrap.c
++++ b/monitor_wrap.c
+@@ -279,10 +279,10 @@
+        return (banner);
+ }
+ 
+-/* Inform the privileged process about service and style */
++/* Inform the privileged process about service, style, and role */
+ 
+ void
+-mm_inform_authserv(char *service, char *style)
++mm_inform_authserv(char *service, char *style, char *role)
+ {
+        Buffer m;
+ 
+@@ -291,12 +291,30 @@
+        buffer_init(&m);
+        buffer_put_cstring(&m, service);
+        buffer_put_cstring(&m, style ? style : "");
++       buffer_put_cstring(&m, role ? role : "");
+ 
+        mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUTHSERV, &m);
+ 
+        buffer_free(&m);
+ }
+ 
++/* Inform the privileged process about role */
++
++void
++mm_inform_authrole(char *role)
++{
++       Buffer m;
++
++       debug3("%s entering", __func__);
++
++       buffer_init(&m);
++       buffer_put_cstring(&m, role ? role : "");
++
++       mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUTHROLE, &m);
++
++       buffer_free(&m);
++}
++
+ /* Do the password authentication */
+ int
+ mm_auth_password(Authctxt *authctxt, char *password)
+Index: b/monitor_wrap.h
+===================================================================
+--- a/monitor_wrap.h
++++ b/monitor_wrap.h
+@@ -40,7 +40,8 @@
+ int mm_is_monitor(void);
+ DH *mm_choose_dh(int, int, int);
+ int mm_key_sign(Key *, u_char **, u_int *, u_char *, u_int);
+-void mm_inform_authserv(char *, char *);
++void mm_inform_authserv(char *, char *, char *);
++void mm_inform_authrole(char *);
+ struct passwd *mm_getpwnamallow(const char *);
+ char *mm_auth2_read_banner(void);
+ int mm_auth_password(struct Authctxt *, char *);
+Index: b/openbsd-compat/port-linux.c
+===================================================================
+--- a/openbsd-compat/port-linux.c
++++ b/openbsd-compat/port-linux.c
+@@ -29,6 +29,12 @@
+ #include <string.h>
+ #include <stdio.h>
+ 
++#ifdef WITH_SELINUX
++#include "key.h"
++#include "hostfile.h"
++#include "auth.h"
++#endif
++
+ #include "log.h"
+ #include "xmalloc.h"
+ #include "port-linux.h"
+@@ -38,6 +44,8 @@
+ #include <selinux/flask.h>
+ #include <selinux/get_context_list.h>
+ 
++extern Authctxt *the_authctxt;
++
+ /* Wrapper around is_selinux_enabled() to log its return value once only */
+ int
+ ssh_selinux_enabled(void)
+@@ -56,8 +64,8 @@
+ static security_context_t
+ ssh_selinux_getctxbyname(char *pwname)
+ {
+-       security_context_t sc;
+-       char *sename = NULL, *lvl = NULL;
++       security_context_t sc = NULL;
++       char *sename = NULL, *role = NULL, *lvl = NULL;
+        int r;
+ 
+ #ifdef HAVE_GETSEUSERBYNAME
+@@ -67,11 +75,20 @@
+        sename = pwname;
+        lvl = NULL;
+ #endif
++       if (the_authctxt)
++               role = the_authctxt->role;
+ 
+ #ifdef HAVE_GET_DEFAULT_CONTEXT_WITH_LEVEL
+-       r = get_default_context_with_level(sename, lvl, NULL, &sc);
++       if (role != NULL && role[0])
++               r = get_default_context_with_rolelevel(sename, role, lvl, NULL,
++                                                      &sc);
++       else
++               r = get_default_context_with_level(sename, lvl, NULL, &sc);
+ #else
+-       r = get_default_context(sename, NULL, &sc);
++       if (role != NULL && role[0])
++               r = get_default_context_with_role(sename, role, NULL, &sc);
++       else
++               r = get_default_context(sename, NULL, &sc);
+ #endif
+ 
+        if (r != 0) {
diff --git a/debian/patches/series b/debian/patches/series
new file mode 100644
index 000000000..fe14d7a8d
--- /dev/null
+++ b/debian/patches/series
@@ -0,0 +1,43 @@
+# GSSAPI
+gssapi.patch
+gssapi-autoconf.patch
+gssapi-compat.patch
+gssapi-dump.patch
+
+# SELinux
+selinux-role.patch
+
+# Key blacklisting
+ssh-vulnkey.patch
+
+# Keepalive handling
+ssh1-keepalive.patch
+keepalive-extensions.patch
+
+# Message adjustments
+syslog-level-silent.patch
+quieter-signals.patch
+helpful-wait-terminate.patch
+
+# Miscellaneous bug fixes
+user-group-modes.patch
+scp-quoting.patch
+shell-path.patch
+dnssec-sshfp.patch
+
+# Versioning
+package-versioning.patch
+debian-banner.patch
+
+# File system layout
+authorized-keys-man-symlink.patch
+lintian-symlink-pickiness.patch
+
+# Documentation
+openbsd-docs.patch
+ssh-argv0.patch
+doc-hash-tab-completion.patch
+
+# Debian-specific configuration
+gnome-ssh-askpass2-icon.patch
+debian-config.patch
diff --git a/debian/patches/shell-path.patch b/debian/patches/shell-path.patch
new file mode 100644
index 000000000..ddae43a45
--- /dev/null
+++ b/debian/patches/shell-path.patch
@@ -0,0 +1,30 @@
+Description: Look for $SHELL on the path for ProxyCommand/LocalCommand
+ There's some debate on the upstream bug about whether POSIX requires this.
+ I (Colin Watson) agree with Vincent and think it does.
+Author: Colin Watson <cjwatson@debian.org>
+Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1494
+Bug-Debian: http://bugs.debian.org/492728
+Last-Update: 2010-02-27
+
+Index: b/sshconnect.c
+===================================================================
+--- a/sshconnect.c
++++ b/sshconnect.c
+@@ -141,7 +141,7 @@
+ 
+                /* Execute the proxy command.  Note that we gave up any
+                   extra privileges above. */
+-               execv(argv[0], argv);
++               execvp(argv[0], argv);
+                perror(argv[0]);
+                exit(1);
+        }
+@@ -1243,7 +1243,7 @@
+        pid = fork();
+        if (pid == 0) {
+                debug3("Executing %s -c \"%s\"", shell, args);
+-               execl(shell, shell, "-c", args, (char *)NULL);
++               execlp(shell, shell, "-c", args, (char *)NULL);
+                error("Couldn't execute %s -c \"%s\": %s",
+                    shell, args, strerror(errno));
+                _exit(1);
diff --git a/debian/patches/ssh-argv0.patch b/debian/patches/ssh-argv0.patch
new file mode 100644
index 000000000..4a651bfa1
--- /dev/null
+++ b/debian/patches/ssh-argv0.patch
@@ -0,0 +1,21 @@
+Description: ssh(1): Refer to ssh-argv0(1)
+ Old versions of OpenSSH (up to 2.5 or thereabouts) allowed creating
+ symlinks to ssh with the name of the host you want to connect to.  Debian
+ ships an ssh-argv0 script restoring this feature; this patch refers to its
+ manual page from ssh(1).
+Bug-Debian: http://bugs.debian.org/111341
+Forwarded: not-needed
+Last-Update: 2010-02-28
+
+Index: b/ssh.1
+===================================================================
+--- a/ssh.1
++++ b/ssh.1
+@@ -1396,6 +1396,7 @@
+ .Xr sftp 1 ,
+ .Xr ssh-add 1 ,
+ .Xr ssh-agent 1 ,
++.Xr ssh-argv0 1 ,
+ .Xr ssh-keygen 1 ,
+ .Xr ssh-keyscan 1 ,
+ .Xr ssh-vulnkey 1 ,
diff --git a/debian/patches/ssh-vulnkey.patch b/debian/patches/ssh-vulnkey.patch
new file mode 100644
index 000000000..ecb6e0c64
--- /dev/null
+++ b/debian/patches/ssh-vulnkey.patch
@@ -0,0 +1,1385 @@
+Description: Reject vulnerable keys to mitigate Debian OpenSSL flaw
+ In 2008, Debian (and derived distributions such as Ubuntu) shipped an
+ OpenSSL package with a flawed random number generator, causing OpenSSH to
+ generate only a very limited set of keys which were subject to private half
+ precomputation.  To mitigate this, this patch checks key authentications
+ against a blacklist of known-vulnerable keys, and adds a new ssh-vulnkey
+ program which can be used to explicitly check keys against that blacklist.
+ See CVE-2008-0166.
+Author: Colin Watson <cjwatson@ubuntu.com>
+Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1469
+Last-Update: 2010-02-27
+
+Index: b/Makefile.in
+===================================================================
+--- a/Makefile.in
++++ b/Makefile.in
+@@ -27,6 +27,7 @@
+ SSH_KEYSIGN=$(libexecdir)/ssh-keysign
+ SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper
+ RAND_HELPER=$(libexecdir)/ssh-rand-helper
++SSH_DATADIR=$(datadir)/ssh
+ PRIVSEP_PATH=@PRIVSEP_PATH@
+ SSH_PRIVSEP_USER=@SSH_PRIVSEP_USER@
+ STRIP_OPT=@STRIP_OPT@
+@@ -39,7 +40,8 @@
+        -D_PATH_SSH_PKCS11_HELPER=\"$(SSH_PKCS11_HELPER)\" \
+        -D_PATH_SSH_PIDDIR=\"$(piddir)\" \
+        -D_PATH_PRIVSEP_CHROOT_DIR=\"$(PRIVSEP_PATH)\" \
+-       -DSSH_RAND_HELPER=\"$(RAND_HELPER)\"
++       -DSSH_RAND_HELPER=\"$(RAND_HELPER)\" \
++       -D_PATH_SSH_DATADIR=\"$(SSH_DATADIR)\"
+ 
+ CC=@CC@
+ LD=@LD@
+@@ -62,7 +64,7 @@
+ INSTALL_SSH_PRNG_CMDS=@INSTALL_SSH_PRNG_CMDS@
+ INSTALL_SSH_RAND_HELPER=@INSTALL_SSH_RAND_HELPER@
+ 
+-TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) ssh-rand-helper${EXEEXT} sftp-server$(EXEEXT) sftp$(EXEEXT)
++TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) ssh-rand-helper${EXEEXT} sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-vulnkey$(EXEEXT)
+ 
+ LIBSSH_OBJS=acss.o authfd.o authfile.o bufaux.o bufbn.o buffer.o \
+        canohost.o channels.o cipher.o cipher-acss.o cipher-aes.o \
+@@ -93,8 +95,8 @@
+        audit.o audit-bsm.o platform.o sftp-server.o sftp-common.o \
+        roaming_common.o roaming_serv.o
+ 
+-MANPAGES       = moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-rand-helper.8.out ssh-keysign.8.out ssh-pkcs11-helper.8.out sshd_config.5.out ssh_config.5.out
+-MANPAGES_IN    = moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-rand-helper.8 ssh-keysign.8 ssh-pkcs11-helper.8 sshd_config.5 ssh_config.5
++MANPAGES       = moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-rand-helper.8.out ssh-keysign.8.out ssh-pkcs11-helper.8.out ssh-vulnkey.1.out sshd_config.5.out ssh_config.5.out
++MANPAGES_IN    = moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-rand-helper.8 ssh-keysign.8 ssh-pkcs11-helper.8 ssh-vulnkey.1 sshd_config.5 ssh_config.5
+ MANTYPE                = @MANTYPE@
+ 
+ CONFIGFILES=sshd_config.out ssh_config.out moduli.out
+@@ -174,6 +176,9 @@
+ ssh-rand-helper${EXEEXT}: $(LIBCOMPAT) libssh.a ssh-rand-helper.o
+        $(LD) -o $@ ssh-rand-helper.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
+ 
++ssh-vulnkey$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-vulnkey.o
++       $(LD) -o $@ ssh-vulnkey.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
++
+ # test driver for the loginrec code - not built by default
+ logintest: logintest.o $(LIBCOMPAT) libssh.a loginrec.o
+        $(LD) -o $@ logintest.o $(LDFLAGS) loginrec.o -lopenbsd-compat -lssh $(LIBS)
+@@ -268,6 +273,7 @@
+        $(INSTALL) -m 0755 $(STRIP_OPT) ssh-pkcs11-helper$(EXEEXT) $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT)
+        $(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT)
+        $(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
++       $(INSTALL) -m 0755 $(STRIP_OPT) ssh-vulnkey$(EXEEXT) $(DESTDIR)$(bindir)/ssh-vulnkey$(EXEEXT)
+        $(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
+        $(INSTALL) -m 644 scp.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/scp.1
+        $(INSTALL) -m 644 ssh-add.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-add.1
+@@ -285,6 +291,7 @@
+        $(INSTALL) -m 644 sftp-server.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8
+        $(INSTALL) -m 644 ssh-keysign.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8
+        $(INSTALL) -m 644 ssh-pkcs11-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8
++       $(INSTALL) -m 644 ssh-vulnkey.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-vulnkey.1
+        -rm -f $(DESTDIR)$(bindir)/slogin
+        ln -s ./ssh$(EXEEXT) $(DESTDIR)$(bindir)/slogin
+        -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/slogin.1
+@@ -366,6 +373,7 @@
+        -rm -f $(DESTDIR)$(bindir)/ssh-agent$(EXEEXT)
+        -rm -f $(DESTDIR)$(bindir)/ssh-keygen$(EXEEXT)
+        -rm -f $(DESTDIR)$(bindir)/ssh-keyscan$(EXEEXT)
++       -rm -f $(DESTDIR)$(bindir)/ssh-vulnkey$(EXEEXT)
+        -rm -f $(DESTDIR)$(bindir)/sftp$(EXEEXT)
+        -rm -f $(DESTDIR)$(sbindir)/sshd$(EXEEXT)
+        -rm -r $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
+@@ -379,6 +387,7 @@
+        -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-keygen.1
+        -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/sftp.1
+        -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-keyscan.1
++       -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-vulnkey.1
+        -rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/sshd.8
+        -rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-rand-helper.8
+        -rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8
+Index: b/auth-rh-rsa.c
+===================================================================
+--- a/auth-rh-rsa.c
++++ b/auth-rh-rsa.c
+@@ -44,7 +44,7 @@
+ {
+        HostStatus host_status;
+ 
+-       if (auth_key_is_revoked(client_host_key))
++       if (auth_key_is_revoked(client_host_key, 0))
+                return 0;
+ 
+        /* Check if we would accept it using rhosts authentication. */
+Index: b/auth-rsa.c
+===================================================================
+--- a/auth-rsa.c
++++ b/auth-rsa.c
+@@ -94,7 +94,7 @@
+        MD5_CTX md;
+        int len;
+ 
+-       if (auth_key_is_revoked(key))
++       if (auth_key_is_revoked(key, 0))
+                return 0;
+ 
+        /* don't allow short keys */
+Index: b/auth.c
+===================================================================
+--- a/auth.c
++++ b/auth.c
+@@ -59,6 +59,7 @@
+ #include "servconf.h"
+ #include "key.h"
+ #include "hostfile.h"
++#include "authfile.h"
+ #include "auth.h"
+ #include "auth-options.h"
+ #include "canohost.h"
+@@ -615,10 +616,34 @@
+ 
+ /* Returns 1 if key is revoked by revoked_keys_file, 0 otherwise */
+ int
+-auth_key_is_revoked(Key *key)
++auth_key_is_revoked(Key *key, int hostkey)
+ {
+        char *key_fp;
+ 
++       if (blacklisted_key(key, &key_fp) == 1) {
++               if (options.permit_blacklisted_keys) {
++                       if (hostkey)
++                               error("Host key %s blacklisted (see "
++                                   "ssh-vulnkey(1)); continuing anyway",
++                                   key_fp);
++                       else
++                               logit("Public key %s from %s blacklisted (see "
++                                   "ssh-vulnkey(1)); continuing anyway",
++                                   key_fp, get_remote_ipaddr());
++                       xfree(key_fp);
++               } else {
++                       if (hostkey)
++                               error("Host key %s blacklisted (see "
++                                   "ssh-vulnkey(1))", key_fp);
++                       else
++                               logit("Public key %s from %s blacklisted (see "
++                                   "ssh-vulnkey(1))",
++                                   key_fp, get_remote_ipaddr());
++                       xfree(key_fp);
++                       return 1;
++               }
++       }
++
+        if (options.revoked_keys_file == NULL)
+                return 0;
+ 
+Index: b/auth.h
+===================================================================
+--- a/auth.h
++++ b/auth.h
+@@ -175,7 +175,7 @@
+ 
+ FILE   *auth_openkeyfile(const char *, struct passwd *, int);
+ FILE   *auth_openprincipals(const char *, struct passwd *, int);
+-int     auth_key_is_revoked(Key *);
++int     auth_key_is_revoked(Key *, int);
+ 
+ HostStatus
+ check_key_in_hostfiles(struct passwd *, Key *, const char *,
+Index: b/auth2-hostbased.c
+===================================================================
+--- a/auth2-hostbased.c
++++ b/auth2-hostbased.c
+@@ -146,7 +146,7 @@
+        int len;
+        char *fp;
+ 
+-       if (auth_key_is_revoked(key))
++       if (auth_key_is_revoked(key, 0))
+                return 0;
+ 
+        resolvedname = get_canonical_hostname(options.use_dns);
+Index: b/auth2-pubkey.c
+===================================================================
+--- a/auth2-pubkey.c
++++ b/auth2-pubkey.c
+@@ -439,9 +439,10 @@
+        int success;
+        char *file;
+ 
+-       if (auth_key_is_revoked(key))
++       if (auth_key_is_revoked(key, 0))
+                return 0;
+-       if (key_is_cert(key) && auth_key_is_revoked(key->cert->signature_key))
++       if (key_is_cert(key) &&
++           auth_key_is_revoked(key->cert->signature_key, 0))
+                return 0;
+ 
+        success = user_cert_trusted_ca(pw, key);
+Index: b/authfile.c
+===================================================================
+--- a/authfile.c
++++ b/authfile.c
+@@ -68,6 +68,7 @@
+ #include "rsa.h"
+ #include "misc.h"
+ #include "atomicio.h"
++#include "pathnames.h"
+ 
+ /* Version identification string for SSH v1 identity files. */
+ static const char authfile_id_string[] =
+@@ -814,3 +815,140 @@
+        return ret;
+ }
+ 
++/* Scan a blacklist of known-vulnerable keys in blacklist_file. */
++static int
++blacklisted_key_in_file(const Key *key, const char *blacklist_file, char **fp)
++{
++       int fd = -1;
++       char *dgst_hex = NULL;
++       char *dgst_packed = NULL, *p;
++       int i;
++       size_t line_len;
++       struct stat st;
++       char buf[256];
++       off_t start, lower, upper;
++       int ret = 0;
++
++       debug("Checking blacklist file %s", blacklist_file);
++       fd = open(blacklist_file, O_RDONLY);
++       if (fd < 0) {
++               ret = -1;
++               goto out;
++       }
++
++       dgst_hex = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
++       /* Remove all colons */
++       dgst_packed = xcalloc(1, strlen(dgst_hex) + 1);
++       for (i = 0, p = dgst_packed; dgst_hex[i]; i++)
++               if (dgst_hex[i] != ':')
++                       *p++ = dgst_hex[i];
++       /* Only compare least-significant 80 bits (to keep the blacklist
++        * size down)
++        */
++       line_len = strlen(dgst_packed + 12);
++       if (line_len > 32)
++               goto out;
++
++       /* Skip leading comments */
++       start = 0;
++       for (;;) {
++               ssize_t r;
++               char *newline;
++
++               r = atomicio(read, fd, buf, sizeof(buf));
++               if (r <= 0)
++                       goto out;
++               if (buf[0] != '#')
++                       break;
++
++               newline = memchr(buf, '\n', sizeof(buf));
++               if (!newline)
++                       goto out;
++               start += newline + 1 - buf;
++               if (lseek(fd, start, SEEK_SET) < 0)
++                       goto out;
++       }
++
++       /* Initialise binary search record numbers */
++       if (fstat(fd, &st) < 0)
++               goto out;
++       lower = 0;
++       upper = (st.st_size - start) / (line_len + 1);
++
++       while (lower != upper) {
++               off_t cur;
++               int cmp;
++
++               cur = lower + (upper - lower) / 2;
++
++               /* Read this line and compare to digest; this is
++                * overflow-safe since cur < max(off_t) / (line_len + 1) */
++               if (lseek(fd, start + cur * (line_len + 1), SEEK_SET) < 0)
++                       break;
++               if (atomicio(read, fd, buf, line_len) != line_len)
++                       break;
++               cmp = memcmp(buf, dgst_packed + 12, line_len);
++               if (cmp < 0) {
++                       if (cur == lower)
++                               break;
++                       lower = cur;
++               } else if (cmp > 0) {
++                       if (cur == upper)
++                               break;
++                       upper = cur;
++               } else {
++                       debug("Found %s in blacklist", dgst_hex);
++                       ret = 1;
++                       break;
++               }
++       }
++
++out:
++       if (dgst_packed)
++               xfree(dgst_packed);
++       if (ret != 1 && dgst_hex) {
++               xfree(dgst_hex);
++               dgst_hex = NULL;
++       }
++       if (fp)
++               *fp = dgst_hex;
++       if (fd >= 0)
++               close(fd);
++       return ret;
++}
++
++/*
++ * Scan blacklists of known-vulnerable keys. If a vulnerable key is found,
++ * its fingerprint is returned in *fp, unless fp is NULL.
++ */
++int
++blacklisted_key(const Key *key, char **fp)
++{
++       Key *public;
++       char *blacklist_file;
++       int ret, ret2;
++
++       public = key_demote(key);
++       if (public->type == KEY_RSA1)
++               public->type = KEY_RSA;
++
++       xasprintf(&blacklist_file, "%s.%s-%u",
++           _PATH_BLACKLIST, key_type(public), key_size(public));
++       ret = blacklisted_key_in_file(public, blacklist_file, fp);
++       xfree(blacklist_file);
++       if (ret > 0) {
++               key_free(public);
++               return ret;
++       }
++
++       xasprintf(&blacklist_file, "%s.%s-%u",
++           _PATH_BLACKLIST_CONFIG, key_type(public), key_size(public));
++       ret2 = blacklisted_key_in_file(public, blacklist_file, fp);
++       xfree(blacklist_file);
++       if (ret2 > ret)
++               ret = ret2;
++
++       key_free(public);
++       return ret;
++}
++
+Index: b/authfile.h
+===================================================================
+--- a/authfile.h
++++ b/authfile.h
+@@ -26,4 +26,6 @@
+ int     key_perm_ok(int, const char *);
+ int     key_in_file(Key *, const char *, int);
+ 
++int     blacklisted_key(const Key *key, char **fp);
++
+ #endif
+Index: b/pathnames.h
+===================================================================
+--- a/pathnames.h
++++ b/pathnames.h
+@@ -18,6 +18,10 @@
+ #define SSHDIR                         ETCDIR "/ssh"
+ #endif
+ 
++#ifndef _PATH_SSH_DATADIR
++#define _PATH_SSH_DATADIR              "/usr/share/ssh"
++#endif
++
+ #ifndef _PATH_SSH_PIDDIR
+ #define _PATH_SSH_PIDDIR               "/var/run"
+ #endif
+@@ -43,6 +47,9 @@
+ /* Backwards compatibility */
+ #define _PATH_DH_PRIMES                        SSHDIR "/primes"
+ 
++#define _PATH_BLACKLIST                        _PATH_SSH_DATADIR "/blacklist"
++#define _PATH_BLACKLIST_CONFIG         SSHDIR "/blacklist"
++
+ #ifndef _PATH_SSH_PROGRAM
+ #define _PATH_SSH_PROGRAM              "/usr/bin/ssh"
+ #endif
+Index: b/readconf.c
+===================================================================
+--- a/readconf.c
++++ b/readconf.c
+@@ -123,6 +123,7 @@
+        oGlobalKnownHostsFile2, oUserKnownHostsFile2, oPubkeyAuthentication,
+        oKbdInteractiveAuthentication, oKbdInteractiveDevices, oHostKeyAlias,
+        oDynamicForward, oPreferredAuthentications, oHostbasedAuthentication,
++       oUseBlacklistedKeys,
+        oHostKeyAlgorithms, oBindAddress, oPKCS11Provider,
+        oClearAllForwardings, oNoHostAuthenticationForLocalhost,
+        oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout,
+@@ -154,6 +155,7 @@
+        { "passwordauthentication", oPasswordAuthentication },
+        { "kbdinteractiveauthentication", oKbdInteractiveAuthentication },
+        { "kbdinteractivedevices", oKbdInteractiveDevices },
++       { "useblacklistedkeys", oUseBlacklistedKeys },
+        { "rsaauthentication", oRSAAuthentication },
+        { "pubkeyauthentication", oPubkeyAuthentication },
+        { "dsaauthentication", oPubkeyAuthentication },             /* alias */
+@@ -479,6 +481,10 @@
+                intptr = &options->challenge_response_authentication;
+                goto parse_flag;
+ 
++       case oUseBlacklistedKeys:
++               intptr = &options->use_blacklisted_keys;
++               goto parse_flag;
++
+        case oGssAuthentication:
+                intptr = &options->gss_authentication;
+                goto parse_flag;
+@@ -1093,6 +1099,7 @@
+        options->kbd_interactive_devices = NULL;
+        options->rhosts_rsa_authentication = -1;
+        options->hostbased_authentication = -1;
++       options->use_blacklisted_keys = -1;
+        options->batch_mode = -1;
+        options->check_host_ip = -1;
+        options->strict_host_key_checking = -1;
+@@ -1201,6 +1208,8 @@
+                options->rhosts_rsa_authentication = 0;
+        if (options->hostbased_authentication == -1)
+                options->hostbased_authentication = 0;
++       if (options->use_blacklisted_keys == -1)
++               options->use_blacklisted_keys = 0;
+        if (options->batch_mode == -1)
+                options->batch_mode = 0;
+        if (options->check_host_ip == -1)
+Index: b/readconf.h
+===================================================================
+--- a/readconf.h
++++ b/readconf.h
+@@ -56,6 +56,7 @@
+        int     kbd_interactive_authentication; /* Try keyboard-interactive auth. */
+        char    *kbd_interactive_devices; /* Keyboard-interactive auth devices. */
+        int     zero_knowledge_password_authentication; /* Try jpake */
++       int     use_blacklisted_keys;   /* If true, send */
+        int     batch_mode;     /* Batch mode: do not ask for passwords. */
+        int     check_host_ip;  /* Also keep track of keys for IP address */
+        int     strict_host_key_checking;       /* Strict host key checking. */
+Index: b/servconf.c
+===================================================================
+--- a/servconf.c
++++ b/servconf.c
+@@ -100,6 +100,7 @@
+        options->password_authentication = -1;
+        options->kbd_interactive_authentication = -1;
+        options->challenge_response_authentication = -1;
++       options->permit_blacklisted_keys = -1;
+        options->permit_empty_passwd = -1;
+        options->permit_user_env = -1;
+        options->use_login = -1;
+@@ -232,6 +233,8 @@
+                options->kbd_interactive_authentication = 0;
+        if (options->challenge_response_authentication == -1)
+                options->challenge_response_authentication = 1;
++       if (options->permit_blacklisted_keys == -1)
++               options->permit_blacklisted_keys = 0;
+        if (options->permit_empty_passwd == -1)
+                options->permit_empty_passwd = 0;
+        if (options->permit_user_env == -1)
+@@ -307,7 +310,7 @@
+        sListenAddress, sAddressFamily,
+        sPrintMotd, sPrintLastLog, sIgnoreRhosts,
+        sX11Forwarding, sX11DisplayOffset, sX11UseLocalhost,
+-       sStrictModes, sEmptyPasswd, sTCPKeepAlive,
++       sStrictModes, sPermitBlacklistedKeys, sEmptyPasswd, sTCPKeepAlive,
+        sPermitUserEnvironment, sUseLogin, sAllowTcpForwarding, sCompression,
+        sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups,
+        sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile,
+@@ -416,6 +419,7 @@
+        { "x11uselocalhost", sX11UseLocalhost, SSHCFG_ALL },
+        { "xauthlocation", sXAuthLocation, SSHCFG_GLOBAL },
+        { "strictmodes", sStrictModes, SSHCFG_GLOBAL },
++       { "permitblacklistedkeys", sPermitBlacklistedKeys, SSHCFG_GLOBAL },
+        { "permitemptypasswords", sEmptyPasswd, SSHCFG_ALL },
+        { "permituserenvironment", sPermitUserEnvironment, SSHCFG_GLOBAL },
+        { "uselogin", sUseLogin, SSHCFG_GLOBAL },
+@@ -1011,6 +1015,10 @@
+                intptr = &options->tcp_keep_alive;
+                goto parse_flag;
+ 
++       case sPermitBlacklistedKeys:
++               intptr = &options->permit_blacklisted_keys;
++               goto parse_flag;
++
+        case sEmptyPasswd:
+                intptr = &options->permit_empty_passwd;
+                goto parse_flag;
+@@ -1708,6 +1716,7 @@
+        dump_cfg_fmtint(sX11UseLocalhost, o->x11_use_localhost);
+        dump_cfg_fmtint(sStrictModes, o->strict_modes);
+        dump_cfg_fmtint(sTCPKeepAlive, o->tcp_keep_alive);
++       dump_cfg_fmtint(sPermitBlacklistedKeys, o->permit_blacklisted_keys);
+        dump_cfg_fmtint(sEmptyPasswd, o->permit_empty_passwd);
+        dump_cfg_fmtint(sPermitUserEnvironment, o->permit_user_env);
+        dump_cfg_fmtint(sUseLogin, o->use_login);
+Index: b/servconf.h
+===================================================================
+--- a/servconf.h
++++ b/servconf.h
+@@ -104,6 +104,7 @@
+        int     challenge_response_authentication;
+        int     zero_knowledge_password_authentication;
+                                        /* If true, permit jpake auth */
++       int     permit_blacklisted_keys;        /* If true, permit */
+        int     permit_empty_passwd;    /* If false, do not permit empty
+                                         * passwords. */
+        int     permit_user_env;        /* If true, read ~/.ssh/environment */
+Index: b/ssh-add.1
+===================================================================
+--- a/ssh-add.1
++++ b/ssh-add.1
+@@ -82,6 +82,10 @@
+ .Nm
+ to work.
+ .Pp
++Any keys recorded in the blacklist of known-compromised keys (see
++.Xr ssh-vulnkey 1 )
++will be refused.
++.Pp
+ The options are as follows:
+ .Bl -tag -width Ds
+ .It Fl c
+@@ -182,6 +186,7 @@
+ .Xr ssh 1 ,
+ .Xr ssh-agent 1 ,
+ .Xr ssh-keygen 1 ,
++.Xr ssh-vulnkey 1 ,
+ .Xr sshd 8
+ .Sh AUTHORS
+ OpenSSH is a derivative of the original and free
+Index: b/ssh-add.c
+===================================================================
+--- a/ssh-add.c
++++ b/ssh-add.c
+@@ -139,7 +139,7 @@
+ add_file(AuthenticationConnection *ac, const char *filename)
+ {
+        Key *private, *cert;
+-       char *comment = NULL;
++       char *comment = NULL, *fp;
+        char msg[1024], *certpath;
+        int fd, perms_ok, ret = -1;
+ 
+@@ -184,6 +184,14 @@
+                            "Bad passphrase, try again for %.200s: ", comment);
+                }
+        }
++       if (blacklisted_key(private, &fp) == 1) {
++               fprintf(stderr, "Public key %s blacklisted (see "
++                   "ssh-vulnkey(1)); refusing to add it\n", fp);
++               xfree(fp);
++               key_free(private);
++               xfree(comment);
++               return -1;
++       }
+ 
+        if (ssh_add_identity_constrained(ac, private, comment, lifetime,
+            confirm)) {
+Index: b/ssh-keygen.1
+===================================================================
+--- a/ssh-keygen.1
++++ b/ssh-keygen.1
+@@ -669,6 +669,7 @@
+ .Xr ssh 1 ,
+ .Xr ssh-add 1 ,
+ .Xr ssh-agent 1 ,
++.Xr ssh-vulnkey 1 ,
+ .Xr moduli 5 ,
+ .Xr sshd 8
+ .Rs
+Index: b/ssh-vulnkey.1
+===================================================================
+--- /dev/null
++++ b/ssh-vulnkey.1
+@@ -0,0 +1,242 @@
++.\" Copyright (c) 2008 Canonical Ltd.  All rights reserved.
++.\"
++.\" Redistribution and use in source and binary forms, with or without
++.\" modification, are permitted provided that the following conditions
++.\" are met:
++.\" 1. Redistributions of source code must retain the above copyright
++.\"    notice, this list of conditions and the following disclaimer.
++.\" 2. Redistributions in binary form must reproduce the above copyright
++.\"    notice, this list of conditions and the following disclaimer in the
++.\"    documentation and/or other materials provided with the distribution.
++.\"
++.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
++.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
++.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
++.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
++.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
++.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
++.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
++.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++.\"
++.Dd $Mdocdate: May 12 2008 $
++.Dt SSH-VULNKEY 1
++.Os
++.Sh NAME
++.Nm ssh-vulnkey
++.Nd check blacklist of compromised keys
++.Sh SYNOPSIS
++.Nm
++.Op Fl q | Fl v
++.Ar file ...
++.Nm
++.Fl a
++.Sh DESCRIPTION
++.Nm
++checks a key against a blacklist of compromised keys.
++.Pp
++A substantial number of keys are known to have been generated using a broken
++version of OpenSSL distributed by Debian which failed to seed its random
++number generator correctly.
++Keys generated using these OpenSSL versions should be assumed to be
++compromised.
++This tool may be useful in checking for such keys.
++.Pp
++Keys that are compromised cannot be repaired; replacements must be generated
++using
++.Xr ssh-keygen 1 .
++Make sure to update
++.Pa authorized_keys
++files on all systems where compromised keys were permitted to authenticate.
++.Pp
++The argument list will be interpreted as a list of paths to public key files
++or
++.Pa authorized_keys
++files.
++If no suitable file is found at a given path,
++.Nm
++will append
++.Pa .pub
++and retry, in case it was given a private key file.
++If no files are given as arguments,
++.Nm
++will check
++.Pa ~/.ssh/id_rsa ,
++.Pa ~/.ssh/id_dsa ,
++.Pa ~/.ssh/identity ,
++.Pa ~/.ssh/authorized_keys
++and
++.Pa ~/.ssh/authorized_keys2 ,
++as well as the system's host keys if readable.
++.Pp
++If
++.Dq -
++is given as an argument,
++.Nm
++will read from standard input.
++This can be used to process output from
++.Xr ssh-keyscan 1 ,
++for example:
++.Pp
++.Dl $ ssh-keyscan -t rsa remote.example.org | ssh-vulnkey -
++.Pp
++Unless the
++.Cm PermitBlacklistedKeys
++option is used,
++.Xr sshd 8
++will reject attempts to authenticate with keys in the compromised list.
++.Pp
++The output from
++.Nm
++looks like this:
++.Pp
++.Bd -literal -offset indent
++/etc/ssh/ssh_host_key:1: COMPROMISED: RSA1 2048 xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx root@host
++/home/user/.ssh/id_dsa:1: Not blacklisted: DSA 1024 xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx /home/user/.ssh/id_dsa.pub
++/home/user/.ssh/authorized_keys:3: Unknown (blacklist file not installed): RSA 1024 xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx user@host
++.Ed
++.Pp
++Each line is of the following format (any lines beginning with
++.Dq #
++should be ignored by scripts):
++.Pp
++.Dl Ar filename : Ns Ar line : Ar status : Ar type Ar size Ar fingerprint Ar comment
++.Pp
++It is important to distinguish between the possible values of
++.Ar status :
++.Pp
++.Bl -tag -width Ds
++.It COMPROMISED
++These keys are listed in a blacklist file, normally because their
++corresponding private keys are well-known.
++Replacements must be generated using
++.Xr ssh-keygen 1 .
++.It Not blacklisted
++A blacklist file exists for this key type and size, but this key is not
++listed in it.
++Unless there is some particular reason to believe otherwise, this key
++may be used safely.
++(Note that DSA keys used with the broken version of OpenSSL distributed
++by Debian may be compromised in the event that anyone captured a network
++trace, even if they were generated with a secure version of OpenSSL.)
++.It Unknown (blacklist file not installed)
++No blacklist file exists for this key type and size.
++You should find a suitable published blacklist and install it before
++deciding whether this key is safe to use.
++.El
++.Pp
++The options are as follows:
++.Bl -tag -width Ds
++.It Fl a
++Check keys of all users on the system.
++You will typically need to run
++.Nm
++as root to use this option.
++For each user,
++.Nm
++will check
++.Pa ~/.ssh/id_rsa ,
++.Pa ~/.ssh/id_dsa ,
++.Pa ~/.ssh/identity ,
++.Pa ~/.ssh/authorized_keys
++and
++.Pa ~/.ssh/authorized_keys2 .
++It will also check the system's host keys.
++.It Fl q
++Quiet mode.
++Normally,
++.Nm
++outputs the fingerprint of each key scanned, with a description of its
++status.
++This option suppresses that output.
++.It Fl v
++Verbose mode.
++Normally,
++.Nm
++does not output anything for keys that are not listed in their corresponding
++blacklist file (although it still produces output for keys for which there
++is no blacklist file, since their status is unknown).
++This option causes
++.Nm
++to produce output for all keys.
++.El
++.Sh EXIT STATUS
++.Nm
++will exit zero if any of the given keys were in the compromised list,
++otherwise non-zero.
++.Sh BLACKLIST FILE FORMAT
++The blacklist file may start with comments, on lines starting with
++.Dq # .
++After these initial comments, it must follow a strict format:
++.Pp
++.Bl -bullet -offset indent -compact
++.It
++All the lines must be exactly the same length (20 characters followed by a
++newline) and must be in sorted order.
++.It
++Each line must consist of the lower-case hexadecimal MD5 key fingerprint,
++without colons, and with the first 12 characters removed (that is, the least
++significant 80 bits of the fingerprint).
++.El
++.Pp
++The key fingerprint may be generated using
++.Xr ssh-keygen 1 :
++.Pp
++.Dl $ ssh-keygen -l -f /path/to/key
++.Pp
++This strict format is necessary to allow the blacklist file to be checked
++quickly, using a binary-search algorithm.
++.Sh FILES
++.Bl -tag -width Ds
++.It Pa ~/.ssh/id_rsa
++If present, contains the protocol version 2 RSA authentication identity of
++the user.
++.It Pa ~/.ssh/id_dsa
++If present, contains the protocol version 2 DSA authentication identity of
++the user.
++.It Pa ~/.ssh/identity
++If present, contains the protocol version 1 RSA authentication identity of
++the user.
++.It Pa ~/.ssh/authorized_keys
++If present, lists the public keys (RSA/DSA) that can be used for logging in
++as this user.
++.It Pa ~/.ssh/authorized_keys2
++Obsolete name for
++.Pa ~/.ssh/authorized_keys .
++This file may still be present on some old systems, but should not be
++created if it is missing.
++.It Pa /etc/ssh/ssh_host_rsa_key
++If present, contains the protocol version 2 RSA identity of the system.
++.It Pa /etc/ssh/ssh_host_dsa_key
++If present, contains the protocol version 2 DSA identity of the system.
++.It Pa /etc/ssh/ssh_host_key
++If present, contains the protocol version 1 RSA identity of the system.
++.It Pa /usr/share/ssh/blacklist. Ns Ar TYPE Ns Pa - Ns Ar LENGTH
++If present, lists the blacklisted keys of type
++.Ar TYPE
++.Pf ( Dq RSA
++or
++.Dq DSA )
++and bit length
++.Ar LENGTH .
++The format of this file is described above.
++RSA1 keys are converted to RSA before being checked in the blacklist.
++Note that the fingerprints of RSA1 keys are computed differently, so you
++will not be able to find them in the blacklist by hand.
++.It Pa /etc/ssh/blacklist. Ns Ar TYPE Ns Pa - Ns Ar LENGTH
++Same as
++.Pa /usr/share/ssh/blacklist. Ns Ar TYPE Ns Pa - Ns Ar LENGTH ,
++but may be edited by the system administrator to add new blacklist entries.
++.El
++.Sh SEE ALSO
++.Xr ssh-keygen 1 ,
++.Xr sshd 8
++.Sh AUTHORS
++.An -nosplit
++.An Colin Watson Aq cjwatson@ubuntu.com
++.Pp
++Florian Weimer suggested the option to check keys of all users, and the idea
++of processing
++.Xr ssh-keyscan 1
++output.
+Index: b/ssh-vulnkey.c
+===================================================================
+--- /dev/null
++++ b/ssh-vulnkey.c
+@@ -0,0 +1,388 @@
++/*
++ * Copyright (c) 2008 Canonical Ltd.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer.
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in the
++ *    documentation and/or other materials provided with the distribution.
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
++ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
++ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
++ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
++ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
++ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
++ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
++ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++ */
++
++#include "includes.h"
++
++#include <sys/types.h>
++#include <sys/stat.h>
++
++#include <errno.h>
++#include <string.h>
++#include <stdio.h>
++#include <fcntl.h>
++#include <unistd.h>
++
++#include <openssl/evp.h>
++
++#include "xmalloc.h"
++#include "ssh.h"
++#include "log.h"
++#include "key.h"
++#include "authfile.h"
++#include "pathnames.h"
++#include "uidswap.h"
++#include "misc.h"
++
++extern char *__progname;
++
++/* Default files to check */
++static char *default_host_files[] = {
++       _PATH_HOST_RSA_KEY_FILE,
++       _PATH_HOST_DSA_KEY_FILE,
++       _PATH_HOST_KEY_FILE,
++       NULL
++};
++static char *default_files[] = {
++       _PATH_SSH_CLIENT_ID_RSA,
++       _PATH_SSH_CLIENT_ID_DSA,
++       _PATH_SSH_CLIENT_IDENTITY,
++       _PATH_SSH_USER_PERMITTED_KEYS,
++       _PATH_SSH_USER_PERMITTED_KEYS2,
++       NULL
++};
++
++static int verbosity = 0;
++
++static int some_keys = 0;
++static int some_unknown = 0;
++static int some_compromised = 0;
++
++static void
++usage(void)
++{
++       fprintf(stderr, "usage: %s [-aqv] [file ...]\n", __progname);
++       fprintf(stderr, "Options:\n");
++       fprintf(stderr, "  -a          Check keys of all users.\n");
++       fprintf(stderr, "  -q          Quiet mode.\n");
++       fprintf(stderr, "  -v          Verbose mode.\n");
++       exit(1);
++}
++
++void
++describe_key(const char *filename, u_long linenum, const char *msg,
++    const Key *key, const char *comment, int min_verbosity)
++{
++       char *fp;
++
++       fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
++       if (verbosity >= min_verbosity) {
++               if (strchr(filename, ':'))
++                       printf("\"%s\"", filename);
++               else
++                       printf("%s", filename);
++               printf(":%lu: %s: %s %u %s %s\n", linenum, msg,
++                   key_type(key), key_size(key), fp, comment);
++       }
++       xfree(fp);
++}
++
++int
++do_key(const char *filename, u_long linenum,
++    const Key *key, const char *comment)
++{
++       Key *public;
++       int blacklist_status;
++       int ret = 1;
++
++       some_keys = 1;
++
++       public = key_demote(key);
++       if (public->type == KEY_RSA1)
++               public->type = KEY_RSA;
++
++       blacklist_status = blacklisted_key(public, NULL);
++       if (blacklist_status == -1) {
++               describe_key(filename, linenum,
++                   "Unknown (blacklist file not installed)", key, comment, 0);
++               some_unknown = 1;
++       } else if (blacklist_status == 1) {
++               describe_key(filename, linenum,
++                   "COMPROMISED", key, comment, 0);
++               some_compromised = 1;
++               ret = 0;
++       } else
++               describe_key(filename, linenum,
++                   "Not blacklisted", key, comment, 1);
++
++       key_free(public);
++
++       return ret;
++}
++
++int
++do_filename(const char *filename, int quiet_open)
++{
++       FILE *f;
++       char line[SSH_MAX_PUBKEY_BYTES];
++       char *cp;
++       u_long linenum = 0;
++       Key *key;
++       char *comment = NULL;
++       int found = 0, ret = 1;
++
++       /* Copy much of key_load_public's logic here so that we can read
++        * several keys from a single file (e.g. authorized_keys).
++        */
++
++       if (strcmp(filename, "-") != 0) {
++               int save_errno;
++               f = fopen(filename, "r");
++               save_errno = errno;
++               if (!f) {
++                       char pubfile[MAXPATHLEN];
++                       if (strlcpy(pubfile, filename, sizeof pubfile) <
++                           sizeof(pubfile) &&
++                           strlcat(pubfile, ".pub", sizeof pubfile) <
++                           sizeof(pubfile))
++                               f = fopen(pubfile, "r");
++               }
++               errno = save_errno; /* earlier errno is more useful */
++               if (!f) {
++                       if (!quiet_open)
++                               perror(filename);
++                       return -1;
++               }
++               if (verbosity > 0)
++                       printf("# %s\n", filename);
++       } else
++               f = stdin;
++       while (read_keyfile_line(f, filename, line, sizeof(line),
++                   &linenum) != -1) {
++               int i;
++               char *space;
++               int type;
++               char *end;
++
++               /* Chop trailing newline. */
++               i = strlen(line) - 1;
++               if (line[i] == '\n')
++                       line[i] = '\0';
++
++               /* Skip leading whitespace, empty and comment lines. */
++               for (cp = line; *cp == ' ' || *cp == '\t'; cp++)
++                       ;
++               if (!*cp || *cp == '\n' || *cp == '#')
++                       continue;
++
++               /* Cope with ssh-keyscan output and options in
++                * authorized_keys files.
++                */
++               space = strchr(cp, ' ');
++               if (!space)
++                       continue;
++               *space = '\0';
++               type = key_type_from_name(cp);
++               *space = ' ';
++               /* Leading number (RSA1) or valid type (RSA/DSA) indicates
++                * that we have no host name or options to skip.
++                */
++               if ((strtol(cp, &end, 10) == 0 || *end != ' ') &&
++                   type == KEY_UNSPEC) {
++                       int quoted = 0;
++
++                       for (; *cp && (quoted || (*cp != ' ' && *cp != '\t')); cp++) {
++                               if (*cp == '\\' && cp[1] == '"')
++                                       cp++;   /* Skip both */
++                               else if (*cp == '"')
++                                       quoted = !quoted;
++                       }
++                       /* Skip remaining whitespace. */
++                       for (; *cp == ' ' || *cp == '\t'; cp++)
++                               ;
++                       if (!*cp)
++                               continue;
++               }
++
++               /* Read and process the key itself. */
++               key = key_new(KEY_RSA1);
++               if (key_read(key, &cp) == 1) {
++                       while (*cp == ' ' || *cp == '\t')
++                               cp++;
++                       if (!do_key(filename, linenum,
++                           key, *cp ? cp : filename))
++                               ret = 0;
++                       found = 1;
++               } else {
++                       key_free(key);
++                       key = key_new(KEY_UNSPEC);
++                       if (key_read(key, &cp) == 1) {
++                               while (*cp == ' ' || *cp == '\t')
++                                       cp++;
++                               if (!do_key(filename, linenum,
++                                   key, *cp ? cp : filename))
++                                       ret = 0;
++                               found = 1;
++                       }
++               }
++               key_free(key);
++       }
++       if (f != stdin)
++               fclose(f);
++
++       if (!found && filename) {
++               key = key_load_public(filename, &comment);
++               if (key) {
++                       if (!do_key(filename, 1, key, comment))
++                               ret = 0;
++                       found = 1;
++               }
++               if (comment)
++                       xfree(comment);
++       }
++
++       return ret;
++}
++
++int
++do_host(int quiet_open)
++{
++       int i;
++       struct stat st;
++       int ret = 1;
++
++       for (i = 0; default_host_files[i]; i++) {
++               if (stat(default_host_files[i], &st) < 0 && errno == ENOENT)
++                       continue;
++               if (!do_filename(default_host_files[i], quiet_open))
++                       ret = 0;
++       }
++
++       return ret;
++}
++
++int
++do_user(const char *dir)
++{
++       int i;
++       char *file;
++       struct stat st;
++       int ret = 1;
++
++       for (i = 0; default_files[i]; i++) {
++               xasprintf(&file, "%s/%s", dir, default_files[i]);
++               if (stat(file, &st) < 0 && errno == ENOENT) {
++                       xfree(file);
++                       continue;
++               }
++               if (!do_filename(file, 0))
++                       ret = 0;
++               xfree(file);
++       }
++
++       return ret;
++}
++
++int
++main(int argc, char **argv)
++{
++       int opt, all_users = 0;
++       int ret = 1;
++       extern int optind;
++
++       /* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
++       sanitise_stdfd();
++
++       __progname = ssh_get_progname(argv[0]);
++
++       SSLeay_add_all_algorithms();
++       log_init(argv[0], SYSLOG_LEVEL_INFO, SYSLOG_FACILITY_USER, 1);
++
++       /* We don't need the RNG ourselves, but symbol references here allow
++        * ld to link us properly.
++        */
++       init_rng();
++       seed_rng();
++
++       while ((opt = getopt(argc, argv, "ahqv")) != -1) {
++               switch (opt) {
++               case 'a':
++                       all_users = 1;
++                       break;
++               case 'q':
++                       verbosity--;
++                       break;
++               case 'v':
++                       verbosity++;
++                       break;
++               case 'h':
++               default:
++                       usage();
++               }
++       }
++
++       if (all_users) {
++               struct passwd *pw;
++
++               if (!do_host(0))
++                       ret = 0;
++
++               while ((pw = getpwent()) != NULL) {
++                       if (pw->pw_dir) {
++                               temporarily_use_uid(pw);
++                               if (!do_user(pw->pw_dir))
++                                       ret = 0;
++                               restore_uid();
++                       }
++               }
++       } else if (optind == argc) {
++               struct passwd *pw;
++
++               if (!do_host(1))
++                       ret = 0;
++
++               if ((pw = getpwuid(geteuid())) == NULL)
++                       fprintf(stderr, "No user found with uid %u\n",
++                           (u_int)geteuid());
++               else {
++                       if (!do_user(pw->pw_dir))
++                               ret = 0;
++               }
++       } else {
++               while (optind < argc)
++                       if (!do_filename(argv[optind++], 0))
++                               ret = 0;
++       }
++
++       if (verbosity >= 0) {
++               if (some_unknown) {
++                       printf("#\n");
++                       printf("# The status of some keys on your system is unknown.\n");
++                       printf("# You may need to install additional blacklist files.\n");
++               }
++               if (some_compromised) {
++                       printf("#\n");
++                       printf("# Some keys on your system have been compromised!\n");
++                       printf("# You must replace them using ssh-keygen(1).\n");
++               }
++               if (some_unknown || some_compromised) {
++                       printf("#\n");
++                       printf("# See the ssh-vulnkey(1) manual page for further advice.\n");
++               } else if (some_keys && verbosity > 0) {
++                       printf("#\n");
++                       printf("# No blacklisted keys!\n");
++               }
++       }
++
++       return ret;
++}
+Index: b/ssh.1
+===================================================================
+--- a/ssh.1
++++ b/ssh.1
+@@ -1392,6 +1392,7 @@
+ .Xr ssh-agent 1 ,
+ .Xr ssh-keygen 1 ,
+ .Xr ssh-keyscan 1 ,
++.Xr ssh-vulnkey 1 ,
+ .Xr tun 4 ,
+ .Xr hosts.equiv 5 ,
+ .Xr ssh_config 5 ,
+Index: b/ssh.c
+===================================================================
+--- a/ssh.c
++++ b/ssh.c
+@@ -1422,7 +1422,7 @@
+ static void
+ load_public_identity_files(void)
+ {
+-       char *filename, *cp, thishost[NI_MAXHOST];
++       char *filename, *cp, thishost[NI_MAXHOST], *fp;
+        char *pwdir = NULL, *pwname = NULL;
+        int i = 0;
+        Key *public;
+@@ -1479,6 +1479,22 @@
+                public = key_load_public(filename, NULL);
+                debug("identity file %s type %d", filename,
+                    public ? public->type : -1);
++               if (public && blacklisted_key(public, &fp) == 1) {
++                       if (options.use_blacklisted_keys)
++                               logit("Public key %s blacklisted (see "
++                                   "ssh-vulnkey(1)); continuing anyway", fp);
++                       else
++                               logit("Public key %s blacklisted (see "
++                                   "ssh-vulnkey(1)); refusing to send it",
++                                   fp);
++                       xfree(fp);
++                       if (!options.use_blacklisted_keys) {
++                               key_free(public);
++                               xfree(filename);
++                               filename = NULL;
++                               public = NULL;
++                       }
++               }
+                xfree(options.identity_files[i]);
+                identity_files[n_ids] = filename;
+                identity_keys[n_ids] = public;
+Index: b/ssh_config.5
+===================================================================
+--- a/ssh_config.5
++++ b/ssh_config.5
+@@ -1082,6 +1082,23 @@
+ .Dq any .
+ The default is
+ .Dq any:any .
++.It Cm UseBlacklistedKeys
++Specifies whether
++.Xr ssh 1
++should use keys recorded in its blacklist of known-compromised keys (see
++.Xr ssh-vulnkey 1 )
++for authentication.
++If
++.Dq yes ,
++then attempts to use compromised keys for authentication will be logged but
++accepted.
++It is strongly recommended that this be used only to install new authorized
++keys on the remote system, and even then only with the utmost care.
++If
++.Dq no ,
++then attempts to use compromised keys for authentication will be prevented.
++The default is
++.Dq no .
+ .It Cm UsePrivilegedPort
+ Specifies whether to use a privileged port for outgoing connections.
+ The argument must be
+Index: b/sshconnect2.c
+===================================================================
+--- a/sshconnect2.c
++++ b/sshconnect2.c
+@@ -1421,6 +1421,8 @@
+ 
+        /* list of keys stored in the filesystem */
+        for (i = 0; i < options.num_identity_files; i++) {
++               if (options.identity_files[i] == NULL)
++                       continue;
+                key = options.identity_keys[i];
+                if (key && key->type == KEY_RSA1)
+                        continue;
+@@ -1514,7 +1516,7 @@
+                        debug("Offering %s public key: %s", key_type(id->key),
+                            id->filename);
+                        sent = send_pubkey_test(authctxt, id);
+-               } else if (id->key == NULL) {
++               } else if (id->key == NULL && id->filename) {
+                        debug("Trying private key: %s", id->filename);
+                        id->key = load_identity_file(id->filename);
+                        if (id->key != NULL) {
+Index: b/sshd.8
+===================================================================
+--- a/sshd.8
++++ b/sshd.8
+@@ -938,6 +938,7 @@
+ .Xr ssh-agent 1 ,
+ .Xr ssh-keygen 1 ,
+ .Xr ssh-keyscan 1 ,
++.Xr ssh-vulnkey 1 ,
+ .Xr chroot 2 ,
+ .Xr hosts_access 5 ,
+ .Xr login.conf 5 ,
+Index: b/sshd.c
+===================================================================
+--- a/sshd.c
++++ b/sshd.c
+@@ -1573,6 +1573,11 @@
+                        sensitive_data.host_keys[i] = NULL;
+                        continue;
+                }
++               if (auth_key_is_revoked(key, 1)) {
++                       key_free(key);
++                       sensitive_data.host_keys[i] = NULL;
++                       continue;
++               }
+                switch (key->type) {
+                case KEY_RSA1:
+                        sensitive_data.ssh1_host_key = key;
+Index: b/sshd_config.5
+===================================================================
+--- a/sshd_config.5
++++ b/sshd_config.5
+@@ -743,6 +743,20 @@
+ Specifies whether password authentication is allowed.
+ The default is
+ .Dq yes .
++.It Cm PermitBlacklistedKeys
++Specifies whether
++.Xr sshd 8
++should allow keys recorded in its blacklist of known-compromised keys (see
++.Xr ssh-vulnkey 1 ) .
++If
++.Dq yes ,
++then attempts to authenticate with compromised keys will be logged but
++accepted.
++If
++.Dq no ,
++then attempts to authenticate with compromised keys will be rejected.
++The default is
++.Dq no .
+ .It Cm PermitEmptyPasswords
+ When password authentication is allowed, it specifies whether the
+ server allows login to accounts with empty password strings.
diff --git a/debian/patches/ssh1-keepalive.patch b/debian/patches/ssh1-keepalive.patch
new file mode 100644
index 000000000..dac1ca1cc
--- /dev/null
+++ b/debian/patches/ssh1-keepalive.patch
@@ -0,0 +1,65 @@
+Description: Partial server keep-alive implementation for SSH1
+Author: Colin Watson <cjwatson@debian.org>
+Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1712
+Last-Update: 2010-02-27
+
+Index: b/clientloop.c
+===================================================================
+--- a/clientloop.c
++++ b/clientloop.c
+@@ -547,16 +547,21 @@
+ static void
+ server_alive_check(void)
+ {
+-       if (packet_inc_alive_timeouts() > options.server_alive_count_max) {
+-               logit("Timeout, server not responding.");
+-               cleanup_exit(255);
++       if (compat20) {
++               if (packet_inc_alive_timeouts() > options.server_alive_count_max) {
++                       logit("Timeout, server not responding.");
++                       cleanup_exit(255);
++               }
++               packet_start(SSH2_MSG_GLOBAL_REQUEST);
++               packet_put_cstring("keepalive@openssh.com");
++               packet_put_char(1);     /* boolean: want reply */
++               packet_send();
++               /* Insert an empty placeholder to maintain ordering */
++               client_register_global_confirm(NULL, NULL);
++       } else {
++               packet_send_ignore(0);
++               packet_send();
+        }
+-       packet_start(SSH2_MSG_GLOBAL_REQUEST);
+-       packet_put_cstring("keepalive@openssh.com");
+-       packet_put_char(1);     /* boolean: want reply */
+-       packet_send();
+-       /* Insert an empty placeholder to maintain ordering */
+-       client_register_global_confirm(NULL, NULL);
+ }
+ 
+ /*
+@@ -616,7 +621,7 @@
+         */
+ 
+        timeout_secs = INT_MAX; /* we use INT_MAX to mean no timeout */
+-       if (options.server_alive_interval > 0 && compat20)
++       if (options.server_alive_interval > 0)
+                timeout_secs = options.server_alive_interval;
+        set_control_persist_exit_time();
+        if (control_persist_exit_time > 0) {
+Index: b/ssh_config.5
+===================================================================
+--- a/ssh_config.5
++++ b/ssh_config.5
+@@ -983,7 +983,10 @@
+ .Cm ServerAliveCountMax
+ is left at the default, if the server becomes unresponsive,
+ ssh will disconnect after approximately 45 seconds.
+-This option applies to protocol version 2 only.
++This option applies to protocol version 2 only; in protocol version
++1 there is no mechanism to request a response from the server to the
++server alive messages, so disconnection is the responsibility of the TCP
++stack.
+ .It Cm ServerAliveInterval
+ Sets a timeout interval in seconds after which if no data has been received
+ from the server,
diff --git a/debian/patches/syslog-level-silent.patch b/debian/patches/syslog-level-silent.patch
new file mode 100644
index 000000000..3cb9fdc65
--- /dev/null
+++ b/debian/patches/syslog-level-silent.patch
@@ -0,0 +1,37 @@
+Description: "LogLevel SILENT" compatibility
+ "LogLevel SILENT" (-qq) was introduced in Debian openssh 1:3.0.1p1-1 to
+ match the behaviour of non-free SSH, in which -q does not suppress fatal
+ errors.  However, this was unintentionally broken in 1:4.6p1-2 and nobody
+ complained, so we've dropped most of it.  The parts that remain are basic
+ configuration file compatibility, and an adjustment to "Pseudo-terminal
+ will not be allocated ..." which should be split out into a separate patch.
+Author: Jonathan David Amery <jdamery@ysolde.ucam.org>
+Author: Matthew Vernon <matthew@debian.org>
+Author: Colin Watson <cjwatson@debian.org>
+Last-Update: 2010-03-31
+
+Index: b/log.c
+===================================================================
+--- a/log.c
++++ b/log.c
+@@ -90,6 +90,7 @@
+        LogLevel val;
+ } log_levels[] =
+ {
++       { "SILENT",     SYSLOG_LEVEL_QUIET }, /* compatibility */
+        { "QUIET",      SYSLOG_LEVEL_QUIET },
+        { "FATAL",      SYSLOG_LEVEL_FATAL },
+        { "ERROR",      SYSLOG_LEVEL_ERROR },
+Index: b/ssh.c
+===================================================================
+--- a/ssh.c
++++ b/ssh.c
+@@ -642,7 +642,7 @@
+                tty_flag = 0;
+        /* Do not allocate a tty if stdin is not a tty. */
+        if ((!isatty(fileno(stdin)) || stdin_null_flag) && !force_tty_flag) {
+-               if (tty_flag)
++               if (tty_flag && options.log_level != SYSLOG_LEVEL_QUIET)
+                        logit("Pseudo-terminal will not be allocated because "
+                            "stdin is not a terminal.");
+                tty_flag = 0;
diff --git a/debian/patches/user-group-modes.patch b/debian/patches/user-group-modes.patch
new file mode 100644
index 000000000..69700e592
--- /dev/null
+++ b/debian/patches/user-group-modes.patch
@@ -0,0 +1,202 @@
+Description: Allow harmless group-writability
+ Allow secure files (~/.ssh/config, ~/.ssh/authorized_keys, etc.) to be
+ group-writable, provided that the group in question contains only the
+ file's owner.  Rejected upstream for IMO incorrect reasons (e.g. a
+ misunderstanding about the contents of gr->gr_mem).  Given that
+ per-user groups and umask 002 are the default setup in Debian (for good
+ reasons - this makes operating in setgid directories with other groups
+ much easier), we need to permit this by default.
+Author: Colin Watson <cjwatson@debian.org>
+Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1060
+Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=314347
+Last-Update: 2010-02-27
+
+Index: b/readconf.c
+===================================================================
+--- a/readconf.c
++++ b/readconf.c
+@@ -28,6 +28,8 @@
+ #include <stdio.h>
+ #include <string.h>
+ #include <unistd.h>
++#include <pwd.h>
++#include <grp.h>
+ 
+ #include "xmalloc.h"
+ #include "ssh.h"
+@@ -1045,8 +1047,7 @@
+ 
+                if (fstat(fileno(f), &sb) == -1)
+                        fatal("fstat %s: %s", filename, strerror(errno));
+-               if (((sb.st_uid != 0 && sb.st_uid != getuid()) ||
+-                   (sb.st_mode & 022) != 0))
++               if (!secure_permissions(&sb, getuid()))
+                        fatal("Bad owner or permissions on %s", filename);
+        }
+ 
+Index: b/ssh.1
+===================================================================
+--- a/ssh.1
++++ b/ssh.1
+@@ -1290,6 +1290,8 @@
+ .Xr ssh_config 5 .
+ Because of the potential for abuse, this file must have strict permissions:
+ read/write for the user, and not accessible by others.
++It may be group-writable provided that the group in question contains only
++the user.
+ .Pp
+ .It ~/.ssh/environment
+ Contains additional definitions for environment variables; see
+Index: b/ssh_config.5
+===================================================================
+--- a/ssh_config.5
++++ b/ssh_config.5
+@@ -1235,6 +1235,8 @@
+ This file is used by the SSH client.
+ Because of the potential for abuse, this file must have strict permissions:
+ read/write for the user, and not accessible by others.
++It may be group-writable provided that the group in question contains only
++the user.
+ .It Pa /etc/ssh/ssh_config
+ Systemwide configuration file.
+ This file provides defaults for those
+Index: b/auth.c
+===================================================================
+--- a/auth.c
++++ b/auth.c
+@@ -393,8 +393,7 @@
+                user_hostfile = tilde_expand_filename(userfile, pw->pw_uid);
+                if (options.strict_modes &&
+                    (stat(user_hostfile, &st) == 0) &&
+-                   ((st.st_uid != 0 && st.st_uid != pw->pw_uid) ||
+-                   (st.st_mode & 022) != 0)) {
++                   !secure_permissions(&st, pw->pw_uid)) {
+                        logit("Authentication refused for %.100s: "
+                            "bad owner or modes for %.200s",
+                            pw->pw_name, user_hostfile);
+@@ -448,8 +447,7 @@
+ 
+        /* check the open file to avoid races */
+        if (fstat(fileno(f), &st) < 0 ||
+-           (st.st_uid != 0 && st.st_uid != uid) ||
+-           (st.st_mode & 022) != 0) {
++           !secure_permissions(&st, uid)) {
+                snprintf(err, errlen, "bad ownership or modes for file %s",
+                    buf);
+                return -1;
+@@ -465,8 +463,7 @@
+ 
+                debug3("secure_filename: checking '%s'", buf);
+                if (stat(buf, &st) < 0 ||
+-                   (st.st_uid != 0 && st.st_uid != uid) ||
+-                   (st.st_mode & 022) != 0) {
++                   !secure_permissions(&st, uid)) {
+                        snprintf(err, errlen,
+                            "bad ownership or modes for directory %s", buf);
+                        return -1;
+Index: b/misc.c
+===================================================================
+--- a/misc.c
++++ b/misc.c
+@@ -45,8 +45,9 @@
+ #include <netdb.h>
+ #ifdef HAVE_PATHS_H
+ # include <paths.h>
+-#include <pwd.h>
+ #endif
++#include <pwd.h>
++#include <grp.h>
+ #ifdef SSH_TUN_OPENBSD
+ #include <net/if.h>
+ #endif
+@@ -639,6 +640,55 @@
+ }
+ 
+ int
++secure_permissions(struct stat *st, uid_t uid)
++{
++       if (st->st_uid != 0 && st->st_uid != uid)
++               return 0;
++       if ((st->st_mode & 002) != 0)
++               return 0;
++       if ((st->st_mode & 020) != 0) {
++               /* If the file is group-writable, the group in question must
++                * have exactly one member, namely the file's owner.
++                * (Zero-member groups are typically used by setgid
++                * binaries, and are unlikely to be suitable.)
++                */
++               struct passwd *pw;
++               struct group *gr;
++               int members = 0;
++
++               gr = getgrgid(st->st_gid);
++               if (!gr)
++                       return 0;
++
++               /* Check primary group memberships. */
++               while ((pw = getpwent()) != NULL) {
++                       if (pw->pw_gid == gr->gr_gid) {
++                               ++members;
++                               if (pw->pw_uid != uid)
++                                       return 0;
++                       }
++               }
++               endpwent();
++
++               pw = getpwuid(st->st_uid);
++               if (!pw)
++                       return 0;
++
++               /* Check supplementary group memberships. */
++               if (gr->gr_mem[0]) {
++                       ++members;
++                       if (strcmp(pw->pw_name, gr->gr_mem[0]) ||
++                           gr->gr_mem[1])
++                               return 0;
++               }
++
++               if (!members)
++                       return 0;
++       }
++       return 1;
++}
++
++int
+ tun_open(int tun, int mode)
+ {
+ #if defined(CUSTOM_SYS_TUN_OPEN)
+Index: b/misc.h
+===================================================================
+--- a/misc.h
++++ b/misc.h
+@@ -92,4 +92,6 @@
+ int     ask_permission(const char *, ...) __attribute__((format(printf, 1, 2)));
+ int     read_keyfile_line(FILE *, const char *, char *, size_t, u_long *);
+ 
++int     secure_permissions(struct stat *st, uid_t uid);
++
+ #endif /* _MISC_H */
+Index: b/auth-rhosts.c
+===================================================================
+--- a/auth-rhosts.c
++++ b/auth-rhosts.c
+@@ -256,8 +256,7 @@
+                return 0;
+        }
+        if (options.strict_modes &&
+-           ((st.st_uid != 0 && st.st_uid != pw->pw_uid) ||
+-           (st.st_mode & 022) != 0)) {
++           !secure_permissions(&st, pw->pw_uid)) {
+                logit("Rhosts authentication refused for %.100s: "
+                    "bad ownership or modes for home directory.", pw->pw_name);
+                auth_debug_add("Rhosts authentication refused for %.100s: "
+@@ -283,8 +282,7 @@
+                 * allowing access to their account by anyone.
+                 */
+                if (options.strict_modes &&
+-                   ((st.st_uid != 0 && st.st_uid != pw->pw_uid) ||
+-                   (st.st_mode & 022) != 0)) {
++                   !secure_permissions(&st, pw->pw_uid)) {
+                        logit("Rhosts authentication refused for %.100s: bad modes for %.200s",
+                            pw->pw_name, buf);
+                        auth_debug_add("Bad file modes for %.200s", buf);
diff --git a/debian/po/POTFILES.in b/debian/po/POTFILES.in
new file mode 100644
index 000000000..c619f3451
--- /dev/null
+++ b/debian/po/POTFILES.in
@@ -0,0 +1 @@
+[type: gettext/rfc822deb] openssh-server.templates
diff --git a/debian/po/bg.po b/debian/po/bg.po
new file mode 100644
index 000000000..6b2bc0e8b
--- /dev/null
+++ b/debian/po/bg.po
@@ -0,0 +1,193 @@
+# translation of bg.po to Bulgarian
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the PACKAGE package.
+#
+# Damyan Ivanov <dmn@debian.org>, 2007, 2008.
+msgid ""
+msgstr ""
+"Project-Id-Version: openssh\n"
+"Report-Msgid-Bugs-To: openssh@packages.debian.org\n"
+"POT-Creation-Date: 2010-01-02 08:55+0000\n"
+"PO-Revision-Date: 2008-05-19 09:27+0300\n"
+"Last-Translator: Damyan Ivanov <dmn@debian.org>\n"
+"Language-Team: Bulgarian <dict@fsa-bg.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: KBabel 1.11.4\n"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid "Do you want to risk killing active SSH sessions?"
+msgstr "Да �е прекъ�нат ли текущите връзки по SSH?"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid ""
+"The currently installed version of /etc/init.d/ssh is likely to kill all "
+"running sshd instances. If you are doing this upgrade via an SSH session, "
+"you're likely to be disconnected and leave the upgrade procedure unfinished."
+msgstr ""
+"Много е веро�тно вер�и�та на /etc/init.d/ssh, ко�то е ин�талирана в момента "
+"да прекъ�не активните връзки. �ко извършвате обнов�ването отдалечено има "
+"опа�но�т връзката да �е разпадне и проце�ът да не завърши нормално."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid ""
+"This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the "
+"start-stop-daemon line in the stop section of the file."
+msgstr ""
+"Това може да бъде поправено ръчно � добав�нето на „--pidfile /var/run/sshd."
+"pid“ към командата start-stop-daemon в раздела „stop“ на файла."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "New host key mandatory"
+msgstr "�еобходим е нов ключ за хо�та"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid ""
+"The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA "
+"algorithm. OpenSSH can not handle this host key file, and the ssh-keygen "
+"utility from the old (non-free) SSH installation does not appear to be "
+"available."
+msgstr ""
+"В момента ключа на хо�та в /etc/ssh/ssh_host_key е шифриран � алгоритъма "
+"IDEA. OpenSSH не може да работи � този файл, а програмата ssh-keygen от "
+"�тарата ин�талаци� не е налична."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "You need to manually generate a new host key."
+msgstr "�еобходимо е да �е генерира ръчно нов ключ за хо�та."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid "Disable challenge-response authentication?"
+msgstr "Забрана на удо�товер�ването challenge-response?"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"Password authentication appears to be disabled in the current OpenSSH server "
+"configuration. In order to prevent users from logging in using passwords "
+"(perhaps using only public key authentication instead) with recent versions "
+"of OpenSSH, you must disable challenge-response authentication, or else "
+"ensure that your PAM configuration does not allow Unix password file "
+"authentication."
+msgstr ""
+"Изглежда че удо�товер�ването � парола е забранено в на�тройката на OpenSSH "
+"�ървъра. За пълна забрана на използването на пароли за удо�товер�ване "
+"(веро�тно о�тав�йки �амо удо�товер�ването � публичен ключ) е необходимо да "
+"бъде забранено удо�товер�ването „challenge-response“. В противен �лучай е "
+"нужно да �е на�трои PAM да не позвол�ва удо�товер�ване чрез файловете � "
+"пароли �тил Unix."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"If you disable challenge-response authentication, then users will not be "
+"able to log in using passwords. If you leave it enabled (the default "
+"answer), then the 'PasswordAuthentication no' option will have no useful "
+"effect unless you also adjust your PAM configuration in /etc/pam.d/ssh."
+msgstr ""
+"�ко удо�товер�ването chalenge-response е забрането, потребителите н�ма да "
+"могат да използват пароли за удо�товер�ване. �ко е разрешено (по "
+"подразбиране), на�тройката 'PasswordAuthentication no' н�ма да има ефект, "
+"о�вен ако не промените на�тройките за PAM в /etc/pam.d/ssh."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "Vulnerable host keys will be regenerated"
+msgstr "У�звимите ключове на хо�та ще бъдат �ъздадени наново"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Some of the OpenSSH server host keys on this system were generated with a "
+"version of OpenSSL that had a broken random number generator. As a result, "
+"these host keys are from a well-known set, are subject to brute-force "
+"attacks, and must be regenerated."
+msgstr ""
+"��кои от ключовете за у�лугата OpenSSH на хо�та �а �ъздадени � вер�и� на "
+"OpenSSL, ко�то използва повреден генератор на �лучайни чи�ла. Тези ключове "
+"�а широко изве�тни, у�звими �а към атаки и тр�бва да бъдат �менени."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Users of this system should be informed of this change, as they will be "
+"prompted about the host key change the next time they log in. Use 'ssh-"
+"keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of "
+"the new host keys."
+msgstr ""
+"Потребителите на �и�темата тр�бва да бъдат изве�тени за пром�ната, понеже "
+"при �ледващи�т им опит за връзка чрез SSH ще получат предупреждение за "
+"пром�на в ключовете на хо�та. За да получите отпечатъците на новите ключове "
+"използвайте „ssh-keygen -l -f файл-�-ключ“."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "The affected host keys are:"
+msgstr "За�егнатите ключове на хо�та �а:"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"User keys may also be affected by this problem. The 'ssh-vulnkey' command "
+"may be used as a partial test for this. See /usr/share/doc/openssh-server/"
+"README.compromised-keys.gz for more details."
+msgstr ""
+"Възможно е потребител�ките ключове �ъщо да �а за�егнати от проблема. Можете "
+"да използвате програмата „ssh-vulnkey“ за да ги проверите. За повече "
+"информаци� погледнете /usr/share/doc/openssh-server/README.compromised-keys."
+"gz."
+
+#~ msgid "Generate a new configuration file for OpenSSH?"
+#~ msgstr "Създаване на нов файл � на�тройки за OpenSSH?"
+
+#~ msgid ""
+#~ "This version of OpenSSH has a considerably changed configuration file "
+#~ "from the version shipped in Debian 'Potato', which you appear to be "
+#~ "upgrading from. This package can now generate a new configuration file (/"
+#~ "etc/ssh/sshd.config), which will work with the new server version, but "
+#~ "will not contain any customizations you made with the old version."
+#~ msgstr ""
+#~ "Файлът � на�тройки в тази вер�и� на OpenSSH е �илно променен в �равнение "
+#~ "� вер�и�та в Debian 'Potato', ко�то изглежда �е обнов�ва. Може да бъде "
+#~ "�ъздаден нов файл � на�тройки (/etc/ssh/sshd.config), който ще работи � "
+#~ "новата вер�и�, но н�ма да �ъдържа евентуални промени от �тари� файл."
+
+#~ msgid ""
+#~ "Please note that this new configuration file will set the value of "
+#~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password "
+#~ "can ssh directly in as root). Please read the README.Debian file for more "
+#~ "details about this design choice."
+#~ msgstr ""
+#~ "�ови�т файл ще �ъдържа 'PermitRootLogin yes' (разрешавайки отдалечен "
+#~ "до�тъп през ssh за админи�тративни� потребител root). Подробно�ти за "
+#~ "причините за тази на�тройка има във файла README.Debian."
+
+#~ msgid ""
+#~ "It is strongly recommended that you choose to generate a new "
+#~ "configuration file now."
+#~ msgstr "Препоръчва �е да изберете �ъздаването на нов файл � на�тройки."
+
+#~ msgid "${HOST_KEYS}"
+#~ msgstr "${HOST_KEYS}"
diff --git a/debian/po/ca.po b/debian/po/ca.po
new file mode 100644
index 000000000..04bcdea8f
--- /dev/null
+++ b/debian/po/ca.po
@@ -0,0 +1,352 @@
+#
+# Catalan translation for openssh package.
+# Copyright (C) 2007 Matthew Vernon.
+# This file is distributed under the same license as the openssh package.
+#
+# Aleix Badia i Bosch <abadia@ica.es>, 2004
+# Jordà Polo <jorda@ettin.org>, 2007.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: 1:4.6p1-2\n"
+"Report-Msgid-Bugs-To: openssh@packages.debian.org\n"
+"POT-Creation-Date: 2010-01-02 08:55+0000\n"
+"PO-Revision-Date: 2007-06-30 01:13+0200\n"
+"Last-Translator: Jordà Polo <jorda@ettin.org>\n"
+"Language-Team: Català <debian-l10n-catalan@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid "Do you want to risk killing active SSH sessions?"
+msgstr "Voleu arriscar-vos a aturar les sessions SSH actives?"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid ""
+"The currently installed version of /etc/init.d/ssh is likely to kill all "
+"running sshd instances. If you are doing this upgrade via an SSH session, "
+"you're likely to be disconnected and leave the upgrade procedure unfinished."
+msgstr ""
+"És possible que la versió de «/etc/init.d/ssh» que teniu instal·lada "
+"actualment aturi les instàncies de l'sshd que s'estan executant. Si esteu "
+"actualitzant des d'una sessió SSH, és possible que es talli la connexió i "
+"quedi el procés d'actualització a mitges."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid ""
+"This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the "
+"start-stop-daemon line in the stop section of the file."
+msgstr ""
+"Ho podeu arreglar afegint «--pidfile /var/run/sshd.pid» a la línia «start-stop-"
+"daemon» de la secció «stop» del mateix fitxer."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "New host key mandatory"
+msgstr "Nova clau obligatòria"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid ""
+"The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA "
+"algorithm. OpenSSH can not handle this host key file, and the ssh-keygen "
+"utility from the old (non-free) SSH installation does not appear to be "
+"available."
+msgstr ""
+"L'actual clau de la màquina, a /etc/ssh/ssh_host_key, està xifrada amb "
+"l'algorisme IDEA. OpenSSH no pot gestionar aquest fitxer de clau, i no es "
+"pot trobar l'eina ssh-keygen de la instal·lació d'SSH anterior (non-free)."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "You need to manually generate a new host key."
+msgstr "Haureu de generar manualment una nova clau per a la màquina."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid "Disable challenge-response authentication?"
+msgstr "Voleu desactivar l'autenticació «challenge-response»?"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"Password authentication appears to be disabled in the current OpenSSH server "
+"configuration. In order to prevent users from logging in using passwords "
+"(perhaps using only public key authentication instead) with recent versions "
+"of OpenSSH, you must disable challenge-response authentication, or else "
+"ensure that your PAM configuration does not allow Unix password file "
+"authentication."
+msgstr ""
+"Sembla que l'autenticació per contrasenya està desactivada en l'actual "
+"configuració del servidor OpenSSH. Per tal d'evitar que els usuaris entrin "
+"al sistema utilitzant contrasenyes (i utilitzin només autenticació basada en "
+"clau pública), en les darreres versions d'OpenSSH heu de desactivar "
+"l'autenticació «challenge-response», o altrament assegurar-vos que la "
+"configuració de PAM no permet autenticar mitjançant el fitxer de "
+"contrasenyes de Unix."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"If you disable challenge-response authentication, then users will not be "
+"able to log in using passwords. If you leave it enabled (the default "
+"answer), then the 'PasswordAuthentication no' option will have no useful "
+"effect unless you also adjust your PAM configuration in /etc/pam.d/ssh."
+msgstr ""
+"Si desactiveu l'autenticació «challenge-response», aleshores els usuaris no "
+"podran entrar utilitzant contrasenyes. Si la deixeu activada (que és l'opció "
+"predeterminada), aleshores «PasswordAuthentication no» no tindrà cap valor a "
+"menys que ajusteu la configuració de PAM a /etc/pam.d/ssh."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "Vulnerable host keys will be regenerated"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Some of the OpenSSH server host keys on this system were generated with a "
+"version of OpenSSL that had a broken random number generator. As a result, "
+"these host keys are from a well-known set, are subject to brute-force "
+"attacks, and must be regenerated."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Users of this system should be informed of this change, as they will be "
+"prompted about the host key change the next time they log in. Use 'ssh-"
+"keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of "
+"the new host keys."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "The affected host keys are:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"User keys may also be affected by this problem. The 'ssh-vulnkey' command "
+"may be used as a partial test for this. See /usr/share/doc/openssh-server/"
+"README.compromised-keys.gz for more details."
+msgstr ""
+
+#~ msgid "Generate a new configuration file for OpenSSH?"
+#~ msgstr "Voleu generar un nou fitxer de configuració per a l'OpenSSH?"
+
+#~ msgid ""
+#~ "This version of OpenSSH has a considerably changed configuration file "
+#~ "from the version shipped in Debian 'Potato', which you appear to be "
+#~ "upgrading from. This package can now generate a new configuration file (/"
+#~ "etc/ssh/sshd.config), which will work with the new server version, but "
+#~ "will not contain any customizations you made with the old version."
+#~ msgstr ""
+#~ "Els fitxers de configuració de l'OpenSSH s'han modificat considerablement "
+#~ "respecte als de Debian «Potato», versió des de la qual sembla que esteu "
+#~ "actualitzant. Aquest paquet pot generar ara un nou fitxer de configuració "
+#~ "(/etc/sshd/sshd.config), que funcionarà amb la nova versió del servidor "
+#~ "però no contindrà els paràmetres de configuració personalitzats de la "
+#~ "versió anterior."
+
+#~ msgid ""
+#~ "Please note that this new configuration file will set the value of "
+#~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password "
+#~ "can ssh directly in as root). Please read the README.Debian file for more "
+#~ "details about this design choice."
+#~ msgstr ""
+#~ "Tingueu en compte que el nou fitxer de configuració establirà el valor de "
+#~ "«PermitRootLogin» a «yes» (és a dir, qualsevol que conegui la contrasenya "
+#~ "de root podrà connectar-se directament mitjançant ssh). Si us plau, "
+#~ "llegiu el fitxer README.Debian per a més detalls sobre aquesta opció."
+
+#~ msgid ""
+#~ "It is strongly recommended that you choose to generate a new "
+#~ "configuration file now."
+#~ msgstr ""
+#~ "És molt recomanable que trieu generar el nou fitxer de configuració ara."
+
+#~ msgid "Warning: you must create a new host key"
+#~ msgstr "Avís: heu de crear una nova clau del servidor central"
+
+#~ msgid "Warning: telnetd is installed --- probably not a good idea"
+#~ msgstr ""
+#~ "Avís: el telnetd està instal·lat --- probablement no sigui una bona idea"
+
+#~ msgid ""
+#~ "I'd advise you to either remove the telnetd package (if you don't "
+#~ "actually need to offer telnet access) or install telnetd-ssl so that "
+#~ "there is at least some chance that telnet sessions will not be sending "
+#~ "unencrypted login/password and session information over the network."
+#~ msgstr ""
+#~ "Es aconsellable suprimir el paquet telnetd (si no heu d'oferir accés a "
+#~ "telnet) o torneu a instal·lar el paquet telnetd-ssl si més no per "
+#~ "assegurar que les sessions de telnet no enviaran les informació del nom "
+#~ "d'usuari i contrasenya sense xifrar a través de la xarxa."
+
+#~ msgid "Warning: rsh-server is installed --- probably not a good idea"
+#~ msgstr ""
+#~ "Avís: el servidor rsh-server està instal·lat --- probablement no sigui "
+#~ "una bona idea"
+
+#~ msgid ""
+#~ "having rsh-server installed undermines the security that you were "
+#~ "probably wanting to obtain by installing ssh.  I'd advise you to remove "
+#~ "that package."
+#~ msgstr ""
+#~ "si teniu instal·lat l'rsh-server perdreu la seguretat que esperàveu "
+#~ "obtenir instal·lant l'ssh. És aconsellable suprimir el paquet."
+
+#~ msgid "Do you want ssh-keysign to be installed SUID root?"
+#~ msgstr "Voleu que el fitxer ssh-keysign s'instal·li SUID root?"
+
+#~ msgid ""
+#~ "You have the option of installing the ssh-keysign helper with the SUID "
+#~ "bit set."
+#~ msgstr "Podeu instal·lar l'ajudant del ssh-keysign amb el bit SUID definit."
+
+#~ msgid ""
+#~ "If you make ssh-keysign SUID, you will be able to use SSH's Protocol 2 "
+#~ "host-based authentication."
+#~ msgstr ""
+#~ "Si definiu l'ssh-keysign SUID podreu utilitzat l'autenticació basada en "
+#~ "l'ordinador central del Protocol 2 de l'SSH."
+
+#~ msgid ""
+#~ "If in doubt, I suggest you install it with SUID.  If it causes problems "
+#~ "you can change your mind later by running:   dpkg-reconfigure ssh"
+#~ msgstr ""
+#~ "Si dubteu instal·leu-lo amb el SUID. Si us causa algun problema ho podeu "
+#~ "modificar posteriorment executant l'ordre:  dpkg-reconfigure ssh"
+
+#~ msgid "Allow SSH protocol 2 only"
+#~ msgstr "Permet únicament la versió 2 del protocol d'SSH"
+
+#~ msgid ""
+#~ "This version of OpenSSH supports version 2 of the ssh protocol, which is "
+#~ "much more secure.  Disabling ssh 1 is encouraged, however this will slow "
+#~ "things down on low end machines and might prevent older clients from "
+#~ "connecting (the ssh client shipped with \"potato\" is affected)."
+#~ msgstr ""
+#~ "Aquesta versió de l'OpenSSH suporta la versió 2 del protocol d'ssh, "
+#~ "aquesta versió és molt més segura. És recomanable inhabilitar la versió 1 "
+#~ "del protocol, tot i que això alentirà el funcionament dels ordinadors més "
+#~ "antics i no permetrà les connexions als clients antics (afectarà al "
+#~ "client proporcionat per la \"potato\")."
+
+#~ msgid ""
+#~ "Also please note that keys used for protocol 1 are different so you will "
+#~ "not be able to use them if you only allow protocol 2 connections."
+#~ msgstr ""
+#~ "Recordeu que les claus que utilitza la versió 1 del protocol són "
+#~ "diferents i no les podreu utilitzar si habiliteu únicament les connexions "
+#~ "de la versió 2 del protocol."
+
+#~ msgid ""
+#~ "If you later change your mind about this setting, README.Debian has "
+#~ "instructions on what to do to your sshd_config file."
+#~ msgstr ""
+#~ "Si posteriorment canvieu d'opinió respecte a la configuració, podeu "
+#~ "trobar les instruccions per modificar el fitxer sshd_config a README."
+#~ "Debian."
+
+#~ msgid "NOTE: Forwarding of X11 and Authorization disabled by default."
+#~ msgstr ""
+#~ "Nota: les opcions de reenviament de les X11 i autorització estan "
+#~ "inhabilitades per defecte."
+
+#~ msgid ""
+#~ "For security reasons, the Debian version of ssh has ForwardX11 and "
+#~ "ForwardAgent set to ``off'' by default."
+#~ msgstr ""
+#~ "Per raons de seguretat  i de forma predeterminada la versió d'ssh de "
+#~ "Debian té les opcions ForwardX11 i ForwardAgent definides a \"off\"."
+
+#~ msgid ""
+#~ "You can enable it for servers you trust, either in one of the "
+#~ "configuration files, or with the -X command line option."
+#~ msgstr ""
+#~ "Ho podeu habilitar pels servidors de confiança, ja sigui en un dels "
+#~ "fitxers de configuració o a través de l'opció de la línia d'ordre -X."
+
+#~ msgid "More details can be found in /usr/share/doc/ssh/README.Debian"
+#~ msgstr ""
+#~ "Podeu trobar més informació al fitxer /usr/share/doc/ssh/README.Debian"
+
+#~ msgid "ssh2 keys merged in configuration files"
+#~ msgstr "S'han combinat les claus de l'ssh2 als fitxers de configuració"
+
+#~ msgid ""
+#~ "As of version 3 OpenSSH no longer uses separate files for ssh1 and ssh2 "
+#~ "keys. This means the authorized_keys2 and known_hosts2 files are no "
+#~ "longer needed. They will still be read in order to maintain backwards "
+#~ "compatibility"
+#~ msgstr ""
+#~ "Des de la versió 3 de l'OpenSSH ja no s'utilitzaran fitxers separats per "
+#~ "les claus de l'ssh1 i ssg2. Ja no caldran els fitxer authorized_keys2 i "
+#~ "known_hosts2. Es continuaran llegint per mantenir la compatibilitat amb "
+#~ "les versions anteriors."
+
+#~ msgid "Do you want to run the sshd server?"
+#~ msgstr "Voleu executar el servidor d'sshd?"
+
+#~ msgid "This package contains both the ssh client, and the sshd server."
+#~ msgstr "El paquet conté el client i el servidor d'ssh."
+
+#~ msgid ""
+#~ "Normally the sshd Secure Shell Server will be run to allow remote logins "
+#~ "via ssh."
+#~ msgstr ""
+#~ "L'sshd (servidor de l'intèrpret d'ordres segur) s'executarà, normalment, "
+#~ "per permetre l'entrada remota a través de l'ssh."
+
+#~ msgid ""
+#~ "If you are only interested in using the ssh client for outbound "
+#~ "connections on this machine, and don't want to log into it at all using "
+#~ "ssh, then you can disable sshd here."
+#~ msgstr ""
+#~ "Podeu inhabilitar l'sshd si voleu utilitzar el client d'ssh únicament per "
+#~ "connexions a l'exterior i no per acceptar connexions remotes."
+
+#~ msgid "Environment options on keys have been deprecated"
+#~ msgstr "S'ha prohibit les opcions d'entorn a les claus."
+
+#~ msgid ""
+#~ "This version of OpenSSH disables the environment option for public keys "
+#~ "by default, in order to avoid certain attacks (for example, LD_PRELOAD). "
+#~ "If you are using this option in an authorized_keys file, beware that the "
+#~ "keys in question will no longer work until the option is removed."
+#~ msgstr ""
+#~ "L'OpenSSH inhabilita, per defecte i per evitar diversos atacs (per "
+#~ "exemple LD_PRELOAD), les opcions d'entorn per les claus públiques. Si "
+#~ "utilitzeu aquesta opció al fitxer authorized_keys recordeu que les claus "
+#~ "de la qüestió no funcionaran fins que no se suprimeixi l'opció."
+
+#~ msgid ""
+#~ "To re-enable this option, set \"PermitUserEnvironment yes\" in /etc/ssh/"
+#~ "sshd_config after the upgrade is complete, taking note of the warning in "
+#~ "the sshd_config(5) manual page."
+#~ msgstr ""
+#~ "Per tornar a habilitar l'opció definiu \"PermitUserEnvironment yes\" al "
+#~ "fitxer /etc/ssh/sshd_config al finalitzar l'actualització (recordeu la "
+#~ "nota d'avís de la pàgina del manual sshd_config(5)). "
diff --git a/debian/po/cs.po b/debian/po/cs.po
new file mode 100644
index 000000000..5e023da5f
--- /dev/null
+++ b/debian/po/cs.po
@@ -0,0 +1,357 @@
+#
+#    Translators, if you are not familiar with the PO format, gettext
+#    documentation is worth reading, especially sections dedicated to
+#    this format, e.g. by running:
+#         info -n '(gettext)PO Files'
+#         info -n '(gettext)Header Entry'
+#
+#    Some information specific to po-debconf are available at
+#            /usr/share/doc/po-debconf/README-trans
+#         or http://www.debian.org/intl/l10n/po-debconf/README-trans
+#
+#    Developers do not need to manually edit POT or PO files.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: openssh\n"
+"Report-Msgid-Bugs-To: openssh@packages.debian.org\n"
+"POT-Creation-Date: 2010-01-02 08:55+0000\n"
+"PO-Revision-Date: 2008-05-17 14:49+0200\n"
+"Last-Translator: Miroslav Kure <kurem@debian.cz>\n"
+"Language-Team: Czech <debian-l10n-czech@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid "Do you want to risk killing active SSH sessions?"
+msgstr "Chcete riskovat ukon�ení aktivních SSH spojení?"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid ""
+"The currently installed version of /etc/init.d/ssh is likely to kill all "
+"running sshd instances. If you are doing this upgrade via an SSH session, "
+"you're likely to be disconnected and leave the upgrade procedure unfinished."
+msgstr ""
+"Stávající verze /etc/init.d/ssh pravděpodobně pozabíjí všechny běžící "
+"instance sshd. Pokud tuto aktualizaci provádíte přes SSH, budete nejspíše "
+"odpojeni a aktualizace skon�í na půli cesty."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid ""
+"This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the "
+"start-stop-daemon line in the stop section of the file."
+msgstr ""
+"Můžete to spravit ru�ním přidáním „--pidfile /var/run/sshd.pid“ na řádek "
+"start-stop-daemon v sekci stop."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "New host key mandatory"
+msgstr "Nutný nový serverový klí�"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid ""
+"The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA "
+"algorithm. OpenSSH can not handle this host key file, and the ssh-keygen "
+"utility from the old (non-free) SSH installation does not appear to be "
+"available."
+msgstr ""
+"Aktuální serverový klí� v /etc/ssh/ssh_host_key je šifrovaný algoritmem "
+"IDEA. OpenSSH neumí tento soubor zpracovat a zdá se, že utilita ssh-keygen "
+"ze staré (nesvobodné) instalace SSH není k dispozici."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "You need to manually generate a new host key."
+msgstr "Musíte ru�ně vygenerovat nový serverový klí�"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid "Disable challenge-response authentication?"
+msgstr "Zakázat autentizaci challenge-response?"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"Password authentication appears to be disabled in the current OpenSSH server "
+"configuration. In order to prevent users from logging in using passwords "
+"(perhaps using only public key authentication instead) with recent versions "
+"of OpenSSH, you must disable challenge-response authentication, or else "
+"ensure that your PAM configuration does not allow Unix password file "
+"authentication."
+msgstr ""
+"Zdá se, že autentizace pomocí hesel je ve vaší stávající konfiguraci OpenSSH "
+"serveru zakázána. Abyste zabránili uživatelům v přihlášení pouze pomocí "
+"hesla, musíte v posledních verzích OpenSSH zakázat autentizaci challenge-"
+"response, nebo jinak zajistit, aby PAM nepovolilo autentizaci vů�i unixovému "
+"souboru hesel."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"If you disable challenge-response authentication, then users will not be "
+"able to log in using passwords. If you leave it enabled (the default "
+"answer), then the 'PasswordAuthentication no' option will have no useful "
+"effect unless you also adjust your PAM configuration in /etc/pam.d/ssh."
+msgstr ""
+"Zakážete-li autentizaci challenge-response, uživatelé se nebudou moci "
+"přihlásit pomocí hesel. Necháte-li ji povolenu (přednastavená odpově�), pak "
+"nebude mít volba „PasswordAuthentication no“ žádný efekt, pokud ovšem "
+"neupravíte nastavení PAM v /etc/pam.d/ssh."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "Vulnerable host keys will be regenerated"
+msgstr "Zranitelné serverové klí�e budou přegenerovány"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Some of the OpenSSH server host keys on this system were generated with a "
+"version of OpenSSL that had a broken random number generator. As a result, "
+"these host keys are from a well-known set, are subject to brute-force "
+"attacks, and must be regenerated."
+msgstr ""
+"Některé serverové klí�e OpenSSH na tomto systému byly vytvořeny verzí "
+"OpenSSL, která měla narušený generátor náhodných �ísel. Ve výsledku jsou "
+"tyto dobře známé klí�e předmětem útoků hrubou silou a musí být přegenerovány."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Users of this system should be informed of this change, as they will be "
+"prompted about the host key change the next time they log in. Use 'ssh-"
+"keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of "
+"the new host keys."
+msgstr ""
+"Uživatelé tohoto systému by měli být informováni o změně, protože budou při "
+"příštím přihlášení varováni o změně serverového klí�e. Po aktualizaci můžete "
+"zjistit nové otisky serverových klí�ů příkazem „ssh-keygen -l -f "
+"SOUBOR_SE_SERVEROV�M_KL�ČEM“."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "The affected host keys are:"
+msgstr "Postižené serverové klí�e:"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"User keys may also be affected by this problem. The 'ssh-vulnkey' command "
+"may be used as a partial test for this. See /usr/share/doc/openssh-server/"
+"README.compromised-keys.gz for more details."
+msgstr ""
+"Tímto problémem mohou být postiženy také uživatelské klí�e. Pro �áste�nou "
+"kontrolu můžete použít příkaz „ssh-vulnkey“. Více informací naleznete v "
+"souboru /usr/share/doc/openssh-server/README.compromised-keys.gz."
+
+#~ msgid "Generate a new configuration file for OpenSSH?"
+#~ msgstr "Vytvořit nový konfigura�ní soubor OpenSSH?"
+
+#~ msgid ""
+#~ "This version of OpenSSH has a considerably changed configuration file "
+#~ "from the version shipped in Debian 'Potato', which you appear to be "
+#~ "upgrading from. This package can now generate a new configuration file (/"
+#~ "etc/ssh/sshd.config), which will work with the new server version, but "
+#~ "will not contain any customizations you made with the old version."
+#~ msgstr ""
+#~ "Tato verze OpenSSH má oproti verzi dodávané s Debianem 2.2, kterou nyní "
+#~ "pravděpodobně aktualizujete, zna�ně odlišný konfigura�ní soubor. Balík "
+#~ "nyní může vytvořit nový konfigura�ní soubor (/etc/ssh/sshd.config), který "
+#~ "bude fungovat s novou verzí serveru, ale nebude obsahovat žádné úpravy, "
+#~ "které jste provedli ve staré verzi."
+
+#~ msgid ""
+#~ "Please note that this new configuration file will set the value of "
+#~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password "
+#~ "can ssh directly in as root). Please read the README.Debian file for more "
+#~ "details about this design choice."
+#~ msgstr ""
+#~ "V novém konfigura�ním souboru bude parametr PermitRootLogin nastaven na "
+#~ "hodnotu „yes“. To znamená, že se kdokoliv se znalostí rootova hesla může "
+#~ "přihlásit rovnou jako root. Více o tomto rozhodnutí se dozvíte v souboru "
+#~ "README.Debian."
+
+#~ msgid ""
+#~ "It is strongly recommended that you choose to generate a new "
+#~ "configuration file now."
+#~ msgstr ""
+#~ "Je vřele doporu�eno nechat si nyní vytvořit nový konfigura�ní soubor."
+
+#~ msgid "Warning: you must create a new host key"
+#~ msgstr "Varování: musíte vytvořit nový serverový klí�"
+
+#~ msgid "Warning: telnetd is installed --- probably not a good idea"
+#~ msgstr "Varování: je nainstalován telnetd --- to není dobrý nápad"
+
+#~ msgid ""
+#~ "I'd advise you to either remove the telnetd package (if you don't "
+#~ "actually need to offer telnet access) or install telnetd-ssl so that "
+#~ "there is at least some chance that telnet sessions will not be sending "
+#~ "unencrypted login/password and session information over the network."
+#~ msgstr ""
+#~ "Doporu�ujeme bu� odstranit balík telnetd (pokud telnet přístup "
+#~ "nepotřebujete), nebo nainstalovat telnetd-ssl, kde je alespoň nějaká "
+#~ "šance, že spojení nebudou po síti zasílat nezašifrovaná jména/hesla/"
+#~ "informace."
+
+#~ msgid "Warning: rsh-server is installed --- probably not a good idea"
+#~ msgstr "Varování: je nainstalován rsh-server --- to není dobrý nápad"
+
+#~ msgid ""
+#~ "having rsh-server installed undermines the security that you were "
+#~ "probably wanting to obtain by installing ssh.  I'd advise you to remove "
+#~ "that package."
+#~ msgstr ""
+#~ "nainstalováním rsh-server si bouráte bezpe�nost, kterou jste "
+#~ "pravděpodobně chtěli dosáhnout instalací ssh. Doporu�ujeme tento balík "
+#~ "odstranit."
+
+#~ msgid "Do you want ssh-keysign to be installed SUID root?"
+#~ msgstr "Chcete ssh-keysign nainstalovat jako SUID root?"
+
+#~ msgid ""
+#~ "You have the option of installing the ssh-keysign helper with the SUID "
+#~ "bit set."
+#~ msgstr ""
+#~ "Můžete si vybrat, zda chcete nainstalovat ssh-keysign s nastaveným SUID "
+#~ "bitem."
+
+#~ msgid ""
+#~ "If you make ssh-keysign SUID, you will be able to use SSH's Protocol 2 "
+#~ "host-based authentication."
+#~ msgstr ""
+#~ "Pokud nastavíte ssh-keysign SUID, můžete používat „host-based“ "
+#~ "autentizaci protokolu verze 2."
+
+#~ msgid ""
+#~ "If in doubt, I suggest you install it with SUID.  If it causes problems "
+#~ "you can change your mind later by running:   dpkg-reconfigure ssh"
+#~ msgstr ""
+#~ "Pokud jste na pochybách, doporu�ujeme SUID bit povolit. Pokud zaznamenáte "
+#~ "problémy, můžete nastavení změnit spuštěním:   dpkg-reconfigure ssh"
+
+#~ msgid "Allow SSH protocol 2 only"
+#~ msgstr "Povolit pouze SSH protokol verze 2"
+
+#~ msgid ""
+#~ "This version of OpenSSH supports version 2 of the ssh protocol, which is "
+#~ "much more secure.  Disabling ssh 1 is encouraged, however this will slow "
+#~ "things down on low end machines and might prevent older clients from "
+#~ "connecting (the ssh client shipped with \"potato\" is affected)."
+#~ msgstr ""
+#~ "Tato verze OpenSSH podporuje ssh protokol ve verzi 2, který je mnohem "
+#~ "bezpe�nější. Je dobré ssh verze 1 zakázat, nicméně na slabších po�íta�ích "
+#~ "se projeví zpomalení a také tím znemožníte přihlášení starších klientů "
+#~ "(například těch z Debianu 2.2)."
+
+#~ msgid ""
+#~ "Also please note that keys used for protocol 1 are different so you will "
+#~ "not be able to use them if you only allow protocol 2 connections."
+#~ msgstr ""
+#~ "Také si všimněte, že klí�e protokolu verze 1 jsou odlišné a pokud "
+#~ "povolíte pouze protokol verze 2, nebudete je moci použít. "
+
+#~ msgid ""
+#~ "If you later change your mind about this setting, README.Debian has "
+#~ "instructions on what to do to your sshd_config file."
+#~ msgstr ""
+#~ "Pokud se později rozhodnete jinak, v README.Debian se nachází přesný "
+#~ "návod, jak upravit soubor sshd_config."
+
+#~ msgid "ssh2 keys merged in configuration files"
+#~ msgstr "Klí�e ssh2 v konfigura�ních souborech byly spojeny"
+
+#~ msgid ""
+#~ "As of version 3 OpenSSH no longer uses separate files for ssh1 and ssh2 "
+#~ "keys. This means the authorized_keys2 and known_hosts2 files are no "
+#~ "longer needed. They will still be read in order to maintain backwards "
+#~ "compatibility"
+#~ msgstr ""
+#~ "OpenSSH verze 3 již nepoužívá oddělené soubory pro klí�e verze ssh1 a "
+#~ "ssh2. To znamená, že soubory authorized_keys2 a known_hosts2 již nejsou "
+#~ "potřeba, ovšem z důvodů zachování zpětné kompatibility jsou stále "
+#~ "na�ítány."
+
+#~ msgid "NOTE: Forwarding of X11 and Authorization disabled by default."
+#~ msgstr "POZN�MKA: Autorizace a přesměrování X11 je standardně vypnuto."
+
+#~ msgid ""
+#~ "For security reasons, the Debian version of ssh has ForwardX11 and "
+#~ "ForwardAgent set to ``off'' by default."
+#~ msgstr ""
+#~ "Z bezpe�nostních důvodů má verze ssh v Debianu standardně nastavené "
+#~ "ForwardX11 a ForwardAgent na hodnotu „off“."
+
+#~ msgid ""
+#~ "You can enable it for servers you trust, either in one of the "
+#~ "configuration files, or with the -X command line option."
+#~ msgstr ""
+#~ "Pro servery, kterým důvěřujete, můžete tyto parametry povolit v jednom z "
+#~ "konfigura�ních souborů, nebo z příkazové řádky parametrem -X."
+
+#~ msgid "More details can be found in /usr/share/doc/ssh/README.Debian"
+#~ msgstr "Více naleznete v /usr/share/doc/ssh/README.Debian"
+
+#~ msgid "Do you want to run the sshd server?"
+#~ msgstr "Chcete spustit sshd server?"
+
+#~ msgid "This package contains both the ssh client, and the sshd server."
+#~ msgstr "Tento balík obsahuje jak klienta ssh, tak server sshd."
+
+#~ msgid ""
+#~ "Normally the sshd Secure Shell Server will be run to allow remote logins "
+#~ "via ssh."
+#~ msgstr ""
+#~ "Obvykle se sshd (Secure Shell Server) spouští, aby se vzdálení uživatelé "
+#~ "mohli přihlašovat přes ssh."
+
+#~ msgid ""
+#~ "If you are only interested in using the ssh client for outbound "
+#~ "connections on this machine, and don't want to log into it at all using "
+#~ "ssh, then you can disable sshd here."
+#~ msgstr ""
+#~ "Pokud na tomto po�íta�i chcete využívat pouze ssh klienta pro odchozí "
+#~ "spojení, můžete zde sshd zakázat."
+
+#~ msgid "Environment options on keys have been deprecated"
+#~ msgstr "Volby prostředí spojené s klí�i jsou zakázány"
+
+#~ msgid ""
+#~ "This version of OpenSSH disables the environment option for public keys "
+#~ "by default, in order to avoid certain attacks (for example, LD_PRELOAD). "
+#~ "If you are using this option in an authorized_keys file, beware that the "
+#~ "keys in question will no longer work until the option is removed."
+#~ msgstr ""
+#~ "Pro zamezení ur�itých typů útoků (např. LD_PRELOAD), tato verze OpenSSH "
+#~ "standardně zabraňuje používat volbu prostředí u veřejných klí�ů. Pokud "
+#~ "tuto volbu používáte v souboru authorized_keys, tak postižené klí�e "
+#~ "nebudou fungovat, dokud jim tuto volbu nesmažete."
+
+#~ msgid ""
+#~ "To re-enable this option, set \"PermitUserEnvironment yes\" in /etc/ssh/"
+#~ "sshd_config after the upgrade is complete, taking note of the warning in "
+#~ "the sshd_config(5) manual page."
+#~ msgstr ""
+#~ "Pro znovupovolení této volby si po aktualizaci pře�těte varování v "
+#~ "manuálové stránce sshd_config(5) a v souboru /etc/ssh/sshd_config zadejte "
+#~ "„PermitUserEnvironment yes“."
diff --git a/debian/po/da.po b/debian/po/da.po
new file mode 100644
index 000000000..766b82ef4
--- /dev/null
+++ b/debian/po/da.po
@@ -0,0 +1,161 @@
+# Danish translation openssh.
+# Copyright (C) 2010 openssh & nedenstående oversættere.
+# This file is distributed under the same license as the openssh package.
+# Claus Hindsgaul <claus.hindsgaul@gmail.com>, 2006.
+# Joe Hansen (joedalton2@yahoo.dk), 2010.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: openssh\n"
+"Report-Msgid-Bugs-To: openssh@packages.debian.org\n"
+"POT-Creation-Date: 2010-01-02 08:55+0000\n"
+"PO-Revision-Date: 2010-08-12 17:30+01:00\n"
+"Last-Translator: Joe Hansen <joedalton2@yahoo.dk>\n"
+"Language-Team: Danish <debian-l10n-danish@lists.debian.org> \n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid "Do you want to risk killing active SSH sessions?"
+msgstr "Vil du risikere at afbryde aktive SSH-forbindelser?"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid ""
+"The currently installed version of /etc/init.d/ssh is likely to kill all "
+"running sshd instances. If you are doing this upgrade via an SSH session, "
+"you're likely to be disconnected and leave the upgrade procedure unfinished."
+msgstr ""
+"Den udgave af /etc/init.d/ssh, du har installeret, vil sandsynligvis afbryde "
+"alle sshd-instanser. Hvis du foretager denne opgradering via en SSH-session, "
+"vil du højst sandsynlig blive afbrudt og efterlade opgraderingsproceduren "
+"uafsluttet."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid ""
+"This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the "
+"start-stop-daemon line in the stop section of the file."
+msgstr ""
+"Du kan afhjælpe dette ved at tilføje »--pidfile /var/run/sshd.pid« til "
+"linjen start-stop-daemon i stop-afsnittet af filen."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "New host key mandatory"
+msgstr "Ny værtsnøgle er krævet"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid ""
+"The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA "
+"algorithm. OpenSSH can not handle this host key file, and the ssh-keygen "
+"utility from the old (non-free) SSH installation does not appear to be "
+"available."
+msgstr ""
+"Den aktuelle værtsnøgle, i /etc/ssh/ssh_host_key, er krypteret med en IDEA-"
+"algoritme. OpenSSH kan ikke håndtere en sådan værtsnøglefil, og værktøjet "
+"ssh-keygen fra den gamle (ikke-frie, 'non-free') SSH-installation lader ikke "
+"til at være tilgængeligt."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "You need to manually generate a new host key."
+msgstr "Du skal manuelt oprette en ny værtsnøgle."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid "Disable challenge-response authentication?"
+msgstr "Slå udfordrings-svar godkendelse fra?"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"Password authentication appears to be disabled in the current OpenSSH server "
+"configuration. In order to prevent users from logging in using passwords "
+"(perhaps using only public key authentication instead) with recent versions "
+"of OpenSSH, you must disable challenge-response authentication, or else "
+"ensure that your PAM configuration does not allow Unix password file "
+"authentication."
+msgstr ""
+"Adgangskodegodkendelse ser ud til at være deaktiveret i din nuværende "
+"OpenSSH-serveropsætning. For at forhindre brugere i at logge ind med "
+"adgangskoder (måske kun med brug af offentlig nøglegodkendelse) med nyere "
+"versioner af OpenSSH, skal du deaktivere udfordrings-svar godkendelse, eller "
+"sikre at din PAM-opsætning ikke tillader godkendelse via Unixadgangskodefil."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"If you disable challenge-response authentication, then users will not be "
+"able to log in using passwords. If you leave it enabled (the default "
+"answer), then the 'PasswordAuthentication no' option will have no useful "
+"effect unless you also adjust your PAM configuration in /etc/pam.d/ssh."
+msgstr ""
+"Hvis du deaktiverer udfordrings-svar godkendelse, vil brugere ikke være i "
+"stand til at logge ind med adgangskoder. Hvis du lader det være slået til "
+"(standardsvaret), så vil indstillingen 'PasswordAuthentication no' ikke have "
+"nogen effekt, medmindre du også redigerer din PAM-opsætning i /etc/pam.d/ssh."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "Vulnerable host keys will be regenerated"
+msgstr "Sårbare værtsnøgler vil blive oprettet"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Some of the OpenSSH server host keys on this system were generated with a "
+"version of OpenSSL that had a broken random number generator. As a result, "
+"these host keys are from a well-known set, are subject to brute-force "
+"attacks, and must be regenerated."
+msgstr ""
+"Nogle af OpenSSh-serverens værtsnøgler på dette system blev oprettet med en "
+"version af OpenSSL, som havde en ødelagt tilfældighedstalgenerator. Derfor "
+"er disse værtsnøgler fra et velkendt sæt, der er sårbare over for brutale "
+"(brute-force) angreb og skal derfor genskabes."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Users of this system should be informed of this change, as they will be "
+"prompted about the host key change the next time they log in. Use 'ssh-"
+"keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of "
+"the new host keys."
+msgstr ""
+"Brugere af dette system bør informeres om denne ændring, da de vil blive "
+"spurgt om værtsnøgleændringen den næste gang de logger ind. Brug 'ssh-keygen "
+"-l -f HOST_KEY_FILE' efter opgraderingen for at udskrive fingeraftryk på de "
+"nye værtsnøgler."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "The affected host keys are:"
+msgstr "De påvirkede værtsnøgler er:"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"User keys may also be affected by this problem. The 'ssh-vulnkey' command "
+"may be used as a partial test for this. See /usr/share/doc/openssh-server/"
+"README.compromised-keys.gz for more details."
+msgstr ""
+"Brugernøgler kan måske også være påvirket af dette problem. Kommandoen 'ssh-"
+"vulnkey' kan bruges som en delvis test vedrørende dette. Se /usr/share/doc/"
+"openssh-server/README.compromised-keys.gz for yderligere detaljer."
diff --git a/debian/po/de.po b/debian/po/de.po
new file mode 100644
index 000000000..55b363a67
--- /dev/null
+++ b/debian/po/de.po
@@ -0,0 +1,369 @@
+# Translation of openssh debconf templates to German
+# Copyright (C) Helge Kreutzmann <debian@helgefjell.de>, 2006-2008.
+# This file is distributed under the same license as the openssh package.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: openssh 1:4.7p1-9\n"
+"Report-Msgid-Bugs-To: openssh@packages.debian.org\n"
+"POT-Creation-Date: 2010-01-02 08:55+0000\n"
+"PO-Revision-Date: 2008-05-17 23:09+0200\n"
+"Last-Translator: Helge Kreutzmann <debian@helgefjell.de>\n"
+"Language-Team: de <debian-l10n-german@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=ISO-8859-15\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid "Do you want to risk killing active SSH sessions?"
+msgstr "Wollen Sie das Beenden aktiver SSH-Sitzungen riskieren?"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid ""
+"The currently installed version of /etc/init.d/ssh is likely to kill all "
+"running sshd instances. If you are doing this upgrade via an SSH session, "
+"you're likely to be disconnected and leave the upgrade procedure unfinished."
+msgstr ""
+"Die derzeit installierte Version von /etc/init.d/ssh wird vermutlich Ihre "
+"aktiven ssh-Instanzen beenden. Falls Sie dieses Upgrade über eine SSH-"
+"Sitzung durchführen, dann wird die Verbindung wahrscheinlich getrennt und "
+"der Upgrade-Vorgang nicht beendet."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid ""
+"This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the "
+"start-stop-daemon line in the stop section of the file."
+msgstr ""
+"Dieses Problem kann behoben werden, indem »--pidfile /var/run/sshd.pid« an "
+"die start-stop-daemon-Zeile in dem Abschnitt »stop« der Datei /etc/init.d/ssh "
+"manuell hinzugefügt wird."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "New host key mandatory"
+msgstr "Neuer Host-Schlüssel verpflichtend"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid ""
+"The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA "
+"algorithm. OpenSSH can not handle this host key file, and the ssh-keygen "
+"utility from the old (non-free) SSH installation does not appear to be "
+"available."
+msgstr ""
+"Der aktuelle Host-Schlüssel in /etc/ssh/ssh_host_key ist mit dem IDEA-"
+"Algorithmus verschlüsselt. OpenSSH kann diese Host-Schlüssel-Datei nicht "
+"verarbeiten und das ssh-keygen-Hilfswerkzeug von der alten (nicht-freien) "
+"SSH-Installation scheint nicht verfügbar zu sein."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "You need to manually generate a new host key."
+msgstr "Sie müssen manuell einen neuen Host-Schlüssel erzeugen."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid "Disable challenge-response authentication?"
+msgstr "Challenge-response-Authentifizierung deaktivieren?"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"Password authentication appears to be disabled in the current OpenSSH server "
+"configuration. In order to prevent users from logging in using passwords "
+"(perhaps using only public key authentication instead) with recent versions "
+"of OpenSSH, you must disable challenge-response authentication, or else "
+"ensure that your PAM configuration does not allow Unix password file "
+"authentication."
+msgstr ""
+"Passwort-Authentifizierung scheint in der aktuellen OpenSSH-Server-"
+"Konfiguration deaktiviert zu sein. Um in neueren Versionen von OpenSSH zu "
+"verhindern, dass Benutzer sich unter Verwendung von Passwörtern anmelden "
+"(möglicherweise stattdessen nur unter Verwendung von Public-Key-"
+"Authentifizierung), müssen Sie Challenge-response-Authentifizierung "
+"deaktivieren oder ansonsten sicherstellen, dass Ihre PAM-Konfiguration keine "
+"Authentifizierung über Unix-Password-Dateien erlaubt."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"If you disable challenge-response authentication, then users will not be "
+"able to log in using passwords. If you leave it enabled (the default "
+"answer), then the 'PasswordAuthentication no' option will have no useful "
+"effect unless you also adjust your PAM configuration in /etc/pam.d/ssh."
+msgstr ""
+"Falls Sie Challenge-response-Authentifizierung deaktivieren, werden Benutzer "
+"nicht in der Lage sein, sich mit Passwörtern anzumelden. Falls Sie es "
+"aktiviert lassen (die Standard-Antwort) wird die »PasswordAuthentication no«-"
+"Einstellung keinen nützlichen Effekt haben, es sei denn, sie passen auch "
+"Ihre PAM-Konfiguration in /etc/pam.d/ssh an."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "Vulnerable host keys will be regenerated"
+msgstr "Verwundbare Host-Schlüssel werden neu erzeugt"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Some of the OpenSSH server host keys on this system were generated with a "
+"version of OpenSSL that had a broken random number generator. As a result, "
+"these host keys are from a well-known set, are subject to brute-force "
+"attacks, and must be regenerated."
+msgstr ""
+"Einige der OpenSSH-Server-Host-Schlüssel auf diesem System wurden mit einer "
+"Version von OpenSSL erzeugt, die einen defekten Zufallszahlengenerator "
+"hatte. Als Ergebnis stammen diese Host-Schlüssel aus einer wohlbekannten "
+"Menge, unterliegen Rechen- (»brute-force«)-angriffen und müssen neu erstellt "
+"werden."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Users of this system should be informed of this change, as they will be "
+"prompted about the host key change the next time they log in. Use 'ssh-"
+"keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of "
+"the new host keys."
+msgstr ""
+"Die Benutzer dieses Systems sollten über diese Änderung informiert werden, "
+"da sie über die Änderung des Host-Schlüssels bei der nächsten Anmeldung "
+"befragt werden. Führen Sie nach dem Upgrade »ssh-keygen -l -f "
+"HOST_SCHLÜSSEL_DATEI« aus, um die Fingerabdrücke es neuen Host-Schlüssels "
+"anzuzeigen."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "The affected host keys are:"
+msgstr "Die betroffenen Host-Schlüssel sind:"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"User keys may also be affected by this problem. The 'ssh-vulnkey' command "
+"may be used as a partial test for this. See /usr/share/doc/openssh-server/"
+"README.compromised-keys.gz for more details."
+msgstr ""
+"Die Schüssel der Benutzer könnten auch von diesem Problem betroffen sein. "
+"Der Befehl »ssh-vulnkey« kann dazu verwandt werden, dieses Problem teilweise "
+"zu ermitteln. Lesen Sie /usr/share/doc/openssh-server/README.compromised-"
+"keys.gz für weitere Details."
+
+#~ msgid "Generate a new configuration file for OpenSSH?"
+#~ msgstr "Eine neue Konfigurationsdatei für OpenSSH erzeugen?"
+
+#~ msgid ""
+#~ "This version of OpenSSH has a considerably changed configuration file "
+#~ "from the version shipped in Debian 'Potato', which you appear to be "
+#~ "upgrading from. This package can now generate a new configuration file (/"
+#~ "etc/ssh/sshd.config), which will work with the new server version, but "
+#~ "will not contain any customizations you made with the old version."
+#~ msgstr ""
+#~ "Diese Version von OpenSSH hat eine deutlich geänderte Konfigurationsdatei "
+#~ "gegenüber der in »Potato« ausgelieferten Version, von der Sie anscheinend "
+#~ "ein Upgrade durchführen. Dieses Paket kann jetzt eine neue "
+#~ "Konfigurationsdatei (/etc/ssh/sshd.config) erzeugen, die mit der neuen "
+#~ "Server-Version zusammenarbeitet, aber keine Anpassungen aus der alten "
+#~ "Version enthält."
+
+#~ msgid ""
+#~ "Please note that this new configuration file will set the value of "
+#~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password "
+#~ "can ssh directly in as root). Please read the README.Debian file for more "
+#~ "details about this design choice."
+#~ msgstr ""
+#~ "Bitte beachten Sie, dass die neue Konfigurationsdatei »PermitRootLogin« "
+#~ "auf »yes« setzt (was bedeutet, dass jeder, der das Root-Passwort kennt, "
+#~ "sich direkt via ssh als root anmelden kann). Bitte lesen Sie die Datei "
+#~ "README.Debian für weitergehende Informationen über diese Design-"
+#~ "Entscheidung."
+
+#~ msgid ""
+#~ "It is strongly recommended that you choose to generate a new "
+#~ "configuration file now."
+#~ msgstr ""
+#~ "Es wird nachdrücklich empfohlen, dass Sie jetzt eine neue "
+#~ "Konfigurationsdatei erzeugen."
+
+#~ msgid "Warning: you must create a new host key"
+#~ msgstr "Warnung: Sie müssen einen neuen Host-Schlüssel erzeugen"
+
+#~ msgid "Warning: telnetd is installed --- probably not a good idea"
+#~ msgstr "Warnung: telnetd ist installiert --- wahrscheinlich keine gute Idee"
+
+#~ msgid ""
+#~ "I'd advise you to either remove the telnetd package (if you don't "
+#~ "actually need to offer telnet access) or install telnetd-ssl so that "
+#~ "there is at least some chance that telnet sessions will not be sending "
+#~ "unencrypted login/password and session information over the network."
+#~ msgstr ""
+#~ "Wir empfehlen das telnetd Paket zu entfernen (falls Sie keinen telnet "
+#~ "Zugang anbieten) oder telnetd-ssl zu installieren, so daß Sie verhindern "
+#~ "können, daß Login und Passwort unverschlüsselt durch das Netz gesendet "
+#~ "werden."
+
+#~ msgid "Warning: rsh-server is installed --- probably not a good idea"
+#~ msgstr ""
+#~ "Warnung: rsh-server ist installiert --- wahrscheinlich keine gute Idee"
+
+#~ msgid ""
+#~ "having rsh-server installed undermines the security that you were "
+#~ "probably wanting to obtain by installing ssh.  I'd advise you to remove "
+#~ "that package."
+#~ msgstr ""
+#~ "ist es eine schlechte Idee, den rsh-server installiert zu haben, da er "
+#~ "die Sicherheit untergräbt. Wir empfehlen, das Paket zu entfernen."
+
+#~ msgid "Do you want ssh-keysign to be installed SUID root?"
+#~ msgstr "Möchten Sie ssh-keysign SUID-Root installieren?"
+
+#~ msgid ""
+#~ "You have the option of installing the ssh-keysign helper with the SUID "
+#~ "bit set."
+#~ msgstr ""
+#~ "Sie haben die Möglichkeit, den ssh-keysign-Helfer mit gesetzten SUID-Bit "
+#~ "zu installieren."
+
+#~ msgid ""
+#~ "If you make ssh-keysign SUID, you will be able to use SSH's Protocol 2 "
+#~ "host-based authentication."
+#~ msgstr ""
+#~ "Falls Sie ssh-keysign SUID installieren, können Sie die Host-basierende "
+#~ "Authentisierung von SSH-Protokoll Version 2 verwenden."
+
+#~ msgid ""
+#~ "If in doubt, I suggest you install it with SUID.  If it causes problems "
+#~ "you can change your mind later by running:   dpkg-reconfigure ssh"
+#~ msgstr ""
+#~ "Falls Sie unsicher sind, empfehle ich, mit SUID zu installieren. Falls es "
+#~ "Probleme gibt, können Sie später Ihre Meinung ändern, indem Sie dpkg-"
+#~ "reconfigure ssh aufrufen."
+
+#~ msgid "Allow SSH protocol 2 only"
+#~ msgstr "Nur SSH-Protokoll Version 2 erlauben"
+
+#~ msgid ""
+#~ "This version of OpenSSH supports version 2 of the ssh protocol, which is "
+#~ "much more secure.  Disabling ssh 1 is encouraged, however this will slow "
+#~ "things down on low end machines and might prevent older clients from "
+#~ "connecting (the ssh client shipped with \"potato\" is affected)."
+#~ msgstr ""
+#~ "Diese Version von OpenSSH unterstützt Version 2 des SSH-Protokolls, die "
+#~ "sicherer ist. Es wird empfohlen, Version 1 zu deaktivieren, allerdings "
+#~ "kann dies Vorgänge auf langsamen Maschinen verzögern und alte Clients an "
+#~ "der Verbindungsaufnahme hindern (der ssh-Client von »potato« ist davon "
+#~ "betroffen)."
+
+#~ msgid ""
+#~ "Also please note that keys used for protocol 1 are different so you will "
+#~ "not be able to use them if you only allow protocol 2 connections."
+#~ msgstr ""
+#~ "Bitte beachten Sie auch, daß sich die für Protokoll 1 verwendeten "
+#~ "Schlüssel unterscheiden und Sie diese daher nicht verwenden können, wenn "
+#~ "Sie nur Protokoll Version 2-Verbindungen erlauben."
+
+#~ msgid ""
+#~ "If you later change your mind about this setting, README.Debian has "
+#~ "instructions on what to do to your sshd_config file."
+#~ msgstr ""
+#~ "Falls Sie später Ihre Meinung über diese Einstellung ändern, finden Sie "
+#~ "in README.Debian eine Anleitung was Sie mit der sshd_config-Datei machen "
+#~ "müssen."
+
+#~ msgid "NOTE: Forwarding of X11 and Authorization disabled by default."
+#~ msgstr "HINWEIS: Weiterleiten von X11 und Berechtigungen ist abgeschaltet."
+
+#~ msgid ""
+#~ "For security reasons, the Debian version of ssh has ForwardX11 and "
+#~ "ForwardAgent set to ``off'' by default."
+#~ msgstr ""
+#~ "Aus Sicherheitsgründen ist bei der Debian-Version von ssh ForwardX11 und "
+#~ "ForwardAgent auf »off« gesetzt."
+
+#~ msgid ""
+#~ "You can enable it for servers you trust, either in one of the "
+#~ "configuration files, or with the -X command line option."
+#~ msgstr ""
+#~ "Sie können dies für Server, denen Sie trauen, entweder per Eintrag in die "
+#~ "Konfigurations-Dateien oder per Kommando-Zeilen Option -X ändern."
+
+#~ msgid "More details can be found in /usr/share/doc/ssh/README.Debian"
+#~ msgstr ""
+#~ "Weitere Details können Sie in /usr/share/doc/ssh/README.Debian finden."
+
+#~ msgid "ssh2 keys merged in configuration files"
+#~ msgstr "ssh2-Schlüssel in die Konfigurationsdateien eingefügt"
+
+#~ msgid ""
+#~ "As of version 3 OpenSSH no longer uses separate files for ssh1 and ssh2 "
+#~ "keys. This means the authorized_keys2 and known_hosts2 files are no "
+#~ "longer needed. They will still be read in order to maintain backwards "
+#~ "compatibility"
+#~ msgstr ""
+#~ "Mit Version 3 verwendet OpenSSH nicht mehr separate Dateien für ssh1 und "
+#~ "ssh2 Schlüssel. Dies bedeutet, daß authorized_keys2 und known_hosts2 "
+#~ "nicht mehr benötigt werden. Sie werden noch eingelesen, um "
+#~ "Abwärtskompatibilität zu gewähren."
+
+#~ msgid "Do you want to run the sshd server?"
+#~ msgstr "Möchten Sie den sshd Server starten?"
+
+#~ msgid "This package contains both the ssh client, and the sshd server."
+#~ msgstr "Das Paket enthält sowohl den Client als auch den sshd Server."
+
+#~ msgid ""
+#~ "Normally the sshd Secure Shell Server will be run to allow remote logins "
+#~ "via ssh."
+#~ msgstr ""
+#~ "Normalerweise wird der sshd Secure Shell Server für Remote Logins per "
+#~ "sshgestartet."
+
+#~ msgid ""
+#~ "If you are only interested in using the ssh client for outbound "
+#~ "connections on this machine, and don't want to log into it at all using "
+#~ "ssh, then you can disable sshd here."
+#~ msgstr ""
+#~ "Wenn Sie nur den ssh client nutzen wollen, um sich mit anderen Rechnern "
+#~ "zu verbinden, und sich nicht per ssh in diesen Computer einloggen wollen, "
+#~ "dann können Sie hier den sshd abschalten."
+
+#~ msgid "Environment options on keys have been deprecated"
+#~ msgstr "Umgebungs-Optionen für Schlüssel wurden missbilligt"
+
+#~ msgid ""
+#~ "This version of OpenSSH disables the environment option for public keys "
+#~ "by default, in order to avoid certain attacks (for example, LD_PRELOAD). "
+#~ "If you are using this option in an authorized_keys file, beware that the "
+#~ "keys in question will no longer work until the option is removed."
+#~ msgstr ""
+#~ "Diese Version von OpenSSH deaktiviert standardmäßig die Umgebungsoption "
+#~ "füröffentliche Schlüssel um bestimmte Angriffe (zum Beispiel über "
+#~ "LD_PRELOAD) zu vermeiden. Falls Sie diese Option in einer authorized_keys-"
+#~ "Datei verwenden, beachten Sie, daß die in Frage kommenden Schlüssel nicht "
+#~ "funktionieren werden bis diese Option entfernt wurde."
+
+#~ msgid ""
+#~ "To re-enable this option, set \"PermitUserEnvironment yes\" in /etc/ssh/"
+#~ "sshd_config after the upgrade is complete, taking note of the warning in "
+#~ "the sshd_config(5) manual page."
+#~ msgstr ""
+#~ "Um diese Option wieder zu reaktivieren, setzen Sie, unter "
+#~ "Berücksichtigung der Warnung in der sshd_config(5)-Handbuchseite, "
+#~ "»PermitUserEnvironment yes« in /etc/ssh/sshd_config nachdem das Upgrade "
+#~ "erfolgt ist."
diff --git a/debian/po/el.po b/debian/po/el.po
new file mode 100644
index 000000000..4ca56384e
--- /dev/null
+++ b/debian/po/el.po
@@ -0,0 +1,451 @@
+# translation of el.po to Greek
+# translation of templates.po to Greek
+#
+#    Translators, if you are not familiar with the PO format, gettext
+#    documentation is worth reading, especially sections dedicated to
+#    this format, e.g. by running:
+#         info -n '(gettext)PO Files'
+#         info -n '(gettext)Header Entry'
+#    Some information specific to po-debconf are available at
+#            /usr/share/doc/po-debconf/README-trans
+#         or http://www.debian.org/intl/l10n/po-debconf/README-trans#
+#    Developers do not need to manually edit POT or PO files.
+# Konstantinos Margaritis <markos@debian.org>, 2004.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: el\n"
+"Report-Msgid-Bugs-To: openssh@packages.debian.org\n"
+"POT-Creation-Date: 2010-01-02 08:55+0000\n"
+"PO-Revision-Date: 2004-10-14 21:34+0300\n"
+"Last-Translator: Konstantinos Margaritis <markos@debian.org>\n"
+"Language-Team: Greek <debian-l10n-greek@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: KBabel 1.0.2\n"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+#, fuzzy
+#| msgid "Do you want to continue (and risk killing active ssh sessions)?"
+msgid "Do you want to risk killing active SSH sessions?"
+msgstr ""
+"Θέλετε να συνεχίσετε (με κίνδυνο τε�ματισμο� των ενε�γών συνεδ�ιών ssh);"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+#, fuzzy
+#| msgid ""
+#| "The version of /etc/init.d/ssh that you have installed, is likely to kill "
+#| "all running sshd instances.  If you are doing this upgrade via an ssh "
+#| "session, that would be a Bad Thing(tm)."
+msgid ""
+"The currently installed version of /etc/init.d/ssh is likely to kill all "
+"running sshd instances. If you are doing this upgrade via an SSH session, "
+"you're likely to be disconnected and leave the upgrade procedure unfinished."
+msgstr ""
+"Η τ�έχουσα έκδοση του /etc/init.d/ssh που είναι εγκατεστημένη, πιθανότατα θα "
+"τε�ματίσει όλες τις συνεδ�ίες του sshd.  Αν κάνετε αυτήν την αναβάθμιση μέσω "
+"μιας συνεδ�ίας ssh, αυτό είναι μάλλον κακή ιδέα..."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+#, fuzzy
+#| msgid ""
+#| "You can fix this by adding \"--pidfile /var/run/sshd.pid\" to the start-"
+#| "stop-daemon line in the stop section of the file."
+msgid ""
+"This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the "
+"start-stop-daemon line in the stop section of the file."
+msgstr ""
+"Μπο�είτε να το διο�θώσετε αυτό π�οσθέτοντας \"--pidfile /var/run/sshd.pid\" "
+"στη γ�αμμή start-stop-daemon στο τμήμα \"stop\" του α�χείου."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "New host key mandatory"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+#, fuzzy
+msgid ""
+"The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA "
+"algorithm. OpenSSH can not handle this host key file, and the ssh-keygen "
+"utility from the old (non-free) SSH installation does not appear to be "
+"available."
+msgstr ""
+"Υπά�χει ένα παλαιότε�ο κλειδί /etc/ssh/ssh_host_key, που είναι "
+"κ�υπτογ�αφημένο με τον αλγό�ιθμο IDEA. Το OpenSSH δε μπο�εί να χει�ιστεί "
+"αυτό το κλειδί και δεν έχει β�εθεί το ε�γαλείο ssh-keygen από την παλιά (μη "
+"ελε�θε�η) εγκατάσταση του SSH."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+#, fuzzy
+#| msgid "You will need to generate a new host key."
+msgid "You need to manually generate a new host key."
+msgstr "Π�έπει να δημιου�γήσετε ένα νέο κλειδί για τον υπολογιστή (host key)."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid "Disable challenge-response authentication?"
+msgstr "�α απενε�γοποιηθεί η πιστοποίηση challenge-response;"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+#, fuzzy
+#| msgid ""
+#| "Password authentication appears to be disabled in your current OpenSSH "
+#| "server configuration. In order to prevent users from logging in using "
+#| "passwords (perhaps using only public key authentication instead) with "
+#| "recent versions of OpenSSH, you must disable challenge-response "
+#| "authentication, or else ensure that your PAM configuration does not allow "
+#| "Unix password file authentication."
+msgid ""
+"Password authentication appears to be disabled in the current OpenSSH server "
+"configuration. In order to prevent users from logging in using passwords "
+"(perhaps using only public key authentication instead) with recent versions "
+"of OpenSSH, you must disable challenge-response authentication, or else "
+"ensure that your PAM configuration does not allow Unix password file "
+"authentication."
+msgstr ""
+"Η πιστοποίηση με κωδικό είναι απενε�γοποιημένη στο τω�ινό OpenSSH "
+"εξυπη�ετητή. Για να αποτ�έψετε την είσοδο τον χ�ηστών με χ�ήση κωδικο� (για "
+"πα�άδειγμα να γίνεται χ�ήση μόνο του δημοσίου κλειδιο�) με την π�όσφατες "
+"εκδόσεις του OpenSSH, θα π�έπει να απενε�γοποιήσετε την πιστοποίηση "
+"challenge-response ή να επιβεβαιώσετε ότι η διαμό�φωση του PAM δεν επιτ�έπει "
+"την πιστοποίηση με α�χείο κωδικών."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"If you disable challenge-response authentication, then users will not be "
+"able to log in using passwords. If you leave it enabled (the default "
+"answer), then the 'PasswordAuthentication no' option will have no useful "
+"effect unless you also adjust your PAM configuration in /etc/pam.d/ssh."
+msgstr ""
+"Εάν απενε�γοποιήσετε την πιστοποίηση challenge-response, οι χ�ήστες δεν θα "
+"μπο�ο�ν να εισέλθουν χ�ησιμοποιώντας τον κωδικό τους. Εάν το αφήσετε "
+"ενε�γοποιημένο (π�οεπιλογή), τότε η επιλογή 'PasswordAuthetication no' δεν "
+"θα επιδ�ά εκτός και εάν �υθμίσετε και το PAM στο α�χείο /etc/pam.d/ssh."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "Vulnerable host keys will be regenerated"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Some of the OpenSSH server host keys on this system were generated with a "
+"version of OpenSSL that had a broken random number generator. As a result, "
+"these host keys are from a well-known set, are subject to brute-force "
+"attacks, and must be regenerated."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Users of this system should be informed of this change, as they will be "
+"prompted about the host key change the next time they log in. Use 'ssh-"
+"keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of "
+"the new host keys."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "The affected host keys are:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"User keys may also be affected by this problem. The 'ssh-vulnkey' command "
+"may be used as a partial test for this. See /usr/share/doc/openssh-server/"
+"README.compromised-keys.gz for more details."
+msgstr ""
+
+#, fuzzy
+#~ msgid "Generate a new configuration file for OpenSSH?"
+#~ msgstr "Δημιου�γία νέου α�χείου �υθμίσεων"
+
+#, fuzzy
+#~ msgid ""
+#~ "This version of OpenSSH has a considerably changed configuration file "
+#~ "from the version shipped in Debian 'Potato', which you appear to be "
+#~ "upgrading from. This package can now generate a new configuration file (/"
+#~ "etc/ssh/sshd.config), which will work with the new server version, but "
+#~ "will not contain any customizations you made with the old version."
+#~ msgstr ""
+#~ "Αυτή η έκδοση του OpenSSH έχει σημαντικά διαφο�οποιημένο α�χείο �υθμίσεων "
+#~ "από την έκδοση που πε�ιλαμβάνεται στη διανομή 'Potato' του Debian, από "
+#~ "την οποία φαίνεται ότι π�αγματοποιείτε την αναβάθμιση. Στο σημείο αυτό, "
+#~ "σας δίνεται η δυνατότητα να δημιου�γήσετε ένα νέο α�χείο �υθμίσεων (/etc/"
+#~ "ssh/sshd_config), το οποίο χ�ησιμοποιείται από τη νέα έκδοση του δαίμονα, "
+#~ "αλλά δεν θα πε�ιέχει οποιαδήποτε πα�αμετ�οποίηση έχετε ήδη κάνει στην "
+#~ "παλιά έκδοση."
+
+#, fuzzy
+#~| msgid ""
+#~| "Please note that this new configuration file will set the value of "
+#~| "'PermitRootLogin' to yes (meaning that anyone knowing the root password "
+#~| "can ssh directly in as root). It is the opinion of the maintainer that "
+#~| "this is the correct default (see README.Debian for more details), but "
+#~| "you can always edit sshd_config and set it to no if you wish."
+#~ msgid ""
+#~ "Please note that this new configuration file will set the value of "
+#~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password "
+#~ "can ssh directly in as root). Please read the README.Debian file for more "
+#~ "details about this design choice."
+#~ msgstr ""
+#~ "Σημειώστε ότι το νέο α�χείο �υθμίσεων θα καθο�ίσει την τιμή της επιλογής "
+#~ "'PermitRootLogin' σε yes (εννοώντας ότι οποιοσδήποτε γνω�ίζει τον κωδικό "
+#~ "π�όσβασης του root μπο�εί να συνδεθεί ως χ�ήστης root). Κατά τον "
+#~ "συντη�ητή αυτή είναι και η σωστή π�οκαθο�ισμένη ��θμιση (δείτε το README."
+#~ "Debian για πε�ισσότε�ες λεπτομέ�ειες), αλλά μπο�είτε οποιαδήποτε στιγμή "
+#~ "να αλλάξετε την τιμή σε no στο α�χείο sshd_config."
+
+#, fuzzy
+#~ msgid ""
+#~ "It is strongly recommended that you choose to generate a new "
+#~ "configuration file now."
+#~ msgstr "Συνιστάται να επιλέξετε την δημιου�γία του νέου α�χείου �υθμίσεων."
+
+#~ msgid "Warning: you must create a new host key"
+#~ msgstr ""
+#~ "Π�οσοχή: π�έπει να δημιου�γήσετε ένα νέο κλειδί για τον υπολογιστή (host "
+#~ "key)"
+
+#~ msgid "Warning: telnetd is installed --- probably not a good idea"
+#~ msgstr ""
+#~ "Π�οσοχή: είναι ήδη εγκατεστημένος ο telnetd --- όχι και τοσο καλή ιδέα"
+
+#~ msgid ""
+#~ "I'd advise you to either remove the telnetd package (if you don't "
+#~ "actually need to offer telnet access) or install telnetd-ssl so that "
+#~ "there is at least some chance that telnet sessions will not be sending "
+#~ "unencrypted login/password and session information over the network."
+#~ msgstr ""
+#~ "Συνιστάται είτε να αφαι�έσετε το πακέτο telnetd (αν δεν είναι π�αγματικά "
+#~ "απα�αίτητη η π�όσβαση μέσω telnet) ή να εγκαταστήσετε το πακέτο telnetd-"
+#~ "ssl, ώστε να υπά�χει τουλάχιστον μια πιθανότητα οι συνδέσεις telnet να "
+#~ "μην αποστέλλουν μη κ�υπτογ�αφημένες πλη�οφο�ίες κωδικών π�όσβασης και "
+#~ "συνεδ�ιών μέσω δικτ�ου."
+
+#~ msgid "Warning: rsh-server is installed --- probably not a good idea"
+#~ msgstr ""
+#~ "Π�οσοχή: είναι ήδη εγκατεστημένος ο rsh-server --- όχι και τοσο καλή ιδέα"
+
+#~ msgid ""
+#~ "having rsh-server installed undermines the security that you were "
+#~ "probably wanting to obtain by installing ssh.  I'd advise you to remove "
+#~ "that package."
+#~ msgstr ""
+#~ "Η πα�ουσία του rsh-server υπονομε�ει την ασφάλεια του συστήματος, την "
+#~ "οποία θέλετε να εξασφαλίσετε με την εγκατάσταση του ssh. Συνιστάται η "
+#~ "αφαί�εση αυτο� του πακέτου."
+
+#~ msgid "Do you want ssh-keysign to be installed SUID root?"
+#~ msgstr "Θέλετε να εγκαταστήσετε το ssh-keysign ως SUID;"
+
+#~ msgid ""
+#~ "You have the option of installing the ssh-keysign helper with the SUID "
+#~ "bit set."
+#~ msgstr ""
+#~ "Έχετε την επιλογή της εγκατάστασης του ε�γαλείου ssh-keysign με το bit "
+#~ "SUID ενε�γοποιημένο."
+
+#~ msgid ""
+#~ "If you make ssh-keysign SUID, you will be able to use SSH's Protocol 2 "
+#~ "host-based authentication."
+#~ msgstr ""
+#~ "Αν εγκαταστήσετε το ssh-keysign SUID, θα μπο�είτε να χ�ησιμοποιήσετε την "
+#~ "πιστοποίηση υπολογιστή (host-based authentication) του π�ωτοκόλου SSH 2."
+
+#~ msgid ""
+#~ "If in doubt, I suggest you install it with SUID.  If it causes problems "
+#~ "you can change your mind later by running:   dpkg-reconfigure ssh"
+#~ msgstr ""
+#~ "Αν έχετε αμφιβολίες, συνιστάται να το εγκαταστήσετε SUID.  Αν "
+#~ "διαπιστώσετε π�οβλήματα μπο�είτε να αλλάξετε τη ��θμιση αυτή εκτελώντας:  "
+#~ "dpkg-reconfigure ssh"
+
+#~ msgid "Allow SSH protocol 2 only"
+#~ msgstr "�α επιτ�έπεται μόνο η χ�ήση του π�ωτοκόλλου SSH 2"
+
+#~ msgid ""
+#~ "This version of OpenSSH supports version 2 of the ssh protocol, which is "
+#~ "much more secure.  Disabling ssh 1 is encouraged, however this will slow "
+#~ "things down on low end machines and might prevent older clients from "
+#~ "connecting (the ssh client shipped with \"potato\" is affected)."
+#~ msgstr ""
+#~ "Αυτή η έκδοση του OpenSSH υποστη�ίζει την έκδοση 2 του π�ωτοκόλλου ssh, "
+#~ "που είναι πολ� πιο ασφαλής.  Συνιστάται η απενε�γοποίηση της έκδοσης 1, "
+#~ "ωστόσο αυτό θα γίνει εις βά�ος της ταχ�τητας σε χαμηλότε�ων επιδόσεων "
+#~ "συστήματα και θα απαγο�έψει τη σ�νδεση σε παλαιότε�α π�ογ�άμματα-πελάτες "
+#~ "(π.χ. ο πελάτης ssh που διανέμεται με την έκδοση \"potato\")."
+
+#~ msgid ""
+#~ "Also please note that keys used for protocol 1 are different so you will "
+#~ "not be able to use them if you only allow protocol 2 connections."
+#~ msgstr ""
+#~ "Επίσης, σημειώστε ότι τα κλειδιά που χ�ησιμοποιο�νταν στο π�ωτόκολλο 1 "
+#~ "είναι διαφο�ετικά και δε θα είναι δυνατή η χ�ήση τους αν επιτ�έψετε μόνο "
+#~ "τις συνδέσεις με το π�ωτόκολλο 2."
+
+#~ msgid ""
+#~ "If you later change your mind about this setting, README.Debian has "
+#~ "instructions on what to do to your sshd_config file."
+#~ msgstr ""
+#~ "Αν αποφασίσετε διαφο�ετικά α�γότε�α για αυτή τη ��θμιση, το α�χείο README."
+#~ "Debian έχει οδηγίες για την κατάλληλη τ�οποποίηση του α�χείου sshd_config."
+
+#~ msgid "NOTE: Forwarding of X11 and Authorization disabled by default."
+#~ msgstr ""
+#~ "ΣΗΜΕΙΩΣΗ: Η π�οώθηση των πακέτων X11 και πιστοποίησης είναι "
+#~ "απενε�γοποιημένηεξ ο�ισμο�."
+
+#~ msgid ""
+#~ "For security reasons, the Debian version of ssh has ForwardX11 and "
+#~ "ForwardAgent set to ``off'' by default."
+#~ msgstr ""
+#~ "Για λόγους ασφαλείας, η έκδοση του ssh στο Debian έχει τις επιλογές "
+#~ "ForwardX11 και ForwardAgent ο�ισμένες σε ``off'' εξ ο�ισμο�."
+
+#~ msgid ""
+#~ "You can enable it for servers you trust, either in one of the "
+#~ "configuration files, or with the -X command line option."
+#~ msgstr ""
+#~ "Μπο�είτε να τα ενε�γοποιήσετε για διακομιστές που εμπιστε�εστε, είτε σε "
+#~ "ένα από τα α�χεία �υθμίσεων, είτε μέσω της επιλογής -X στη γ�αμμή εντολών."
+
+#~ msgid "More details can be found in /usr/share/doc/ssh/README.Debian"
+#~ msgstr ""
+#~ "Πε�ισσότε�ες λεπτομέ�ειες μπο�είτε να β�είτε στο α�χείο /usr/share/doc/"
+#~ "ssh/README.Debian"
+
+#~ msgid "ssh2 keys merged in configuration files"
+#~ msgstr "Τα κλειδιά ssh2 συγχωνε�τηκαν στα α�χεία �υθμίσεων"
+
+#~ msgid ""
+#~ "As of version 3 OpenSSH no longer uses separate files for ssh1 and ssh2 "
+#~ "keys. This means the authorized_keys2 and known_hosts2 files are no "
+#~ "longer needed. They will still be read in order to maintain backwards "
+#~ "compatibility"
+#~ msgstr ""
+#~ "Από την έκδοση 3 και έπειτα, το OpenSSH δεν χ�ησιμοποιεί πλέον ξεχω�ιστά "
+#~ "α�χεία για τα κλειδιά των ssh1 και ssh2. Αυτό σημαίνει ότι τα α�χεία "
+#~ "authorized_keys2 και known_hosts2 δεν είναι πλέον απα�αίτητα. Θα "
+#~ "χ�ησιμοποιο�νται μόνο για λόγους συμβατότητας."
+
+#~ msgid "Do you want to run the sshd server?"
+#~ msgstr "Θέλετε να εκτελέσετε τον δαίμονα sshd;"
+
+#~ msgid "This package contains both the ssh client, and the sshd server."
+#~ msgstr "Το πακέτο αυτό πε�ιέχει το πελάτη ssh και το δαίμονα sshd."
+
+#~ msgid ""
+#~ "Normally the sshd Secure Shell Server will be run to allow remote logins "
+#~ "via ssh."
+#~ msgstr ""
+#~ "Κανονικά ο δαίμονας sshd (Δαίμονας Ασφαλο�ς Κελ�φους) θα εκτελείται για "
+#~ "απομακ�υσμένες συνδέσεις μέσω ssh."
+
+#~ msgid ""
+#~ "If you are only interested in using the ssh client for outbound "
+#~ "connections on this machine, and don't want to log into it at all using "
+#~ "ssh, then you can disable sshd here."
+#~ msgstr ""
+#~ "Αν ενδιαφέ�εστε μόνο για τη χ�ήση του πελάτη ssh για εξε�χόμενες "
+#~ "συνδέσεις από αυτόν τον υπολογιστή και δεν επιθυμείτε να συνδέεστε σε "
+#~ "αυτόν μέσω ssh, τότε μπο�είτε να απενε�γοποιήσετε τον sshd στο σημείο "
+#~ "αυτό."
+
+#~ msgid "Environment options on keys have been deprecated"
+#~ msgstr ""
+#~ "Οι επιλογές πε�ιβάλλοντος κελ�φους για τα κλειδιά είναι πλέον πα�ωχημένες."
+
+#~ msgid ""
+#~ "This version of OpenSSH disables the environment option for public keys "
+#~ "by default, in order to avoid certain attacks (for example, LD_PRELOAD). "
+#~ "If you are using this option in an authorized_keys file, beware that the "
+#~ "keys in question will no longer work until the option is removed."
+#~ msgstr ""
+#~ "Αυτή η έκδοση του OpenSSH απενε�γοποιεί τις επιλογές πε�ιβάλλοντος "
+#~ "κελ�φους για δημόσια κλειδιά εξ ο�ισμο�, ώστε να αποφευχθο�ν ο�ισμένου "
+#~ "τ�που επιθέσεις (για πα�άδειγμα, LD_PRELOAD). Αν χ�ησιμοποιείτε αυτήν την "
+#~ "επιλογή σε ένα α�χείο authorized_keys, έχετε υπόψιν σας ότι τα "
+#~ "συγκεκ�ιμένα κλειδιά δεν θα χ�ησιμοποιο�νται έως ότου αφαι�εθεί η επιλογή "
+#~ "αυτή."
+
+#~ msgid ""
+#~ "To re-enable this option, set \"PermitUserEnvironment yes\" in /etc/ssh/"
+#~ "sshd_config after the upgrade is complete, taking note of the warning in "
+#~ "the sshd_config(5) manual page."
+#~ msgstr ""
+#~ "Για να επανενε�γοποιήσετε αυτήν την επιλογή, ο�ίστε "
+#~ "\"PermitUserEnvironment yes\" στο α�χείο /etc/ssh/sshd_config μετά το "
+#~ "τέλος της αναβάθμισης, έχοντας υπόψιν την π�οειδοποίηση στη σελίδα "
+#~ "οδηγιών του sshd_config(5)."
+
+#~ msgid "Privilege separation"
+#~ msgstr "Διαχω�ισμός Π�ονομίων"
+
+#~ msgid ""
+#~ "Privilege separation is turned on by default, so if you decide you want "
+#~ "it turned off, you need to add \"UsePrivilegeSeparation no\" to /etc/ssh/"
+#~ "sshd_config."
+#~ msgstr ""
+#~ "Ο διαχω�ισμός π�ονομίων είναι ενε�γοποιημένος εξ ο�ισμο�, οπότε αν "
+#~ "αποφασίσετε ότι θέλετε να τον απενε�γοποιήσετε, π�έπει να π�οσθέσετε την "
+#~ "��θμιση \"UsePrivilegeSeparation no\" στο α�χείο sshd_config."
+
+#~ msgid "Enable Privilege separation"
+#~ msgstr "Ενε�γοποίηση Διαχω�ισμο� Π�ονομίων"
+
+#~ msgid ""
+#~ "This version of OpenSSH contains the new privilege separation option. "
+#~ "This significantly reduces the quantity of code that runs as root, and "
+#~ "therefore reduces the impact of security holes in sshd."
+#~ msgstr ""
+#~ "Αυτή η έκδοση του OpenSSH πε�ιλαμβάνει τη νέα επιλογή διαχω�ισμο� "
+#~ "π�ονομίων. Αυτό μειώνει δ�αστικά το ποσοστό των π�ογ�αμμάτων που "
+#~ "εκτελο�νται ως root, και κατά συνέπεια και τις τ��πες ασφαλείας του sshd."
+
+#~ msgid ""
+#~ "Unfortunately, privilege separation interacts badly with PAM. Any PAM "
+#~ "session modules that need to run as root (pam_mkhomedir, for example) "
+#~ "will fail, and PAM keyboard-interactive authentication won't work."
+#~ msgstr ""
+#~ "Δυστυχώς, ο διαχω�ισμός π�ονομίων δεν συνε�γάζεται σωστά με το PAM. "
+#~ "Οποιεσδήποτε μονάδες συνεδ�ίας (session modules) του PAM που π�έπει να "
+#~ "εκτελεστο�ν ως root (pam_mkhomedir, για πα�άδειγμα) θα αποτ�χουν, και η "
+#~ "πιστοποίηση μέσω πληκτ�ολογίου στο PAM δεν θα λειτου�γεί."
+
+#~ msgid ""
+#~ "Since you've opted to have me generate an sshd_config file for you, you "
+#~ "can choose whether or not to have privilege separation turned on or not. "
+#~ "Unless you know you need to use PAM features that won't work with this "
+#~ "option, you should enable it."
+#~ msgstr ""
+#~ "Εφόσον έχετε επιλέξει να δημιου�γήθεί αυτόματα το α�χείο sshd_config, "
+#~ "μπο�είτε να επιλέξετε επίσης αν θέλετε να ενε�γοποιήσετε το διαχω�ισμό "
+#~ "π�ονομίων ή όχι. Εκτός αν γνω�ίζετε ότι χ�ειάζεστε να χ�ησιμοποιήσετε "
+#~ "χα�ακτη�ιστικά του PAM που δε συνε�γάζονται με αυτή την επιλογή, "
+#~ "συνιστάται να την ενε�γοποιήσετε."
diff --git a/debian/po/es.po b/debian/po/es.po
new file mode 100644
index 000000000..94667d7af
--- /dev/null
+++ b/debian/po/es.po
@@ -0,0 +1,448 @@
+#
+# openssh debconf translation to spanish
+# Copyright (C) 2003-2007 Software in the Public Interest
+# This file is distributed under the same license as the XXXX package.
+#
+# Changes:
+# - Initial translation
+#    Carlos Valdivia Yagüe <valyag@dat,etsit.upm.es>, 2003
+# - Revision
+#    Javier Fernandez-Sanguino Peña <jfs@computer.org>, 2004
+# - Translation updates
+#    Javier Fernandez-Sanguino Peña <jfs@computer.org>, 2006-2008
+#
+#  Traductores, si no conoce el formato PO, merece la pena leer la 
+#  documentación de gettext, especialmente las secciones dedicadas a este
+#  formato, por ejemplo ejecutando:
+#         info -n '(gettext)PO Files'
+#         info -n '(gettext)Header Entry'
+#
+# Equipo de traducción al español, por favor lean antes de traducir
+# los siguientes documentos:
+#
+# - El proyecto de traducción de Debian al español
+#   http://www.debian.org/intl/spanish/coordinacion
+#   especialmente las notas de traducción en
+#   http://www.debian.org/intl/spanish/notas
+#
+# - La guía de traducción de po's de debconf:
+#   /usr/share/doc/po-debconf/README-trans
+#   o http://www.debian.org/intl/l10n/po-debconf/README-trans
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: openssh 3.6.1p2-11\n"
+"Report-Msgid-Bugs-To: openssh@packages.debian.org\n"
+"POT-Creation-Date: 2010-01-02 08:55+0000\n"
+"PO-Revision-Date: 2008-05-22 00:56+0200\n"
+"Last-Translator: Javier Fernandez-Sanguino Peña <jfs@debian.org>\n"
+"Language-Team: Debian L10n Spanish <debian-l10n-spanish@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=ISO-8859-15\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-POFile-SpellExtra: usr pid PasswordAuthentication PermitRootLogin server\n"
+"X-POFile-SpellExtra: PAM start OpenSSH OpenSSL init sshhostkey daemon var\n"
+"X-POFile-SpellExtra: config pam pidfile vulnkey run Potato keys share stop\n"
+"X-POFile-SpellExtra: gz README ssh sshd doc keygen ARCHIVOCLAVESISTEMA SSH\n"
+"X-POFile-SpellExtra: openssh root compromised\n"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid "Do you want to risk killing active SSH sessions?"
+msgstr "¿Desea correr el riesgo de matar las sesiones SSH activas?"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid ""
+"The currently installed version of /etc/init.d/ssh is likely to kill all "
+"running sshd instances. If you are doing this upgrade via an SSH session, "
+"you're likely to be disconnected and leave the upgrade procedure unfinished."
+msgstr ""
+"La versión de /etc/init.d/ssh que tiene instalada es muy probable que mate "
+"todas las estancias que están ejecutándose de sshd. Es muy probable que se "
+"le desconecte y el procedimiento de actualización quede a medidas si "
+"continúa y está realizando esta actualizando."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid ""
+"This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the "
+"start-stop-daemon line in the stop section of the file."
+msgstr ""
+"Puede arreglarlo añadiendo manualmente «--pidfile /var/run/sshd.pid» a la "
+"línea «start-stop-daemon», en la sección «stop» del fichero."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "New host key mandatory"
+msgstr "Nueva clave de sistema obligatoria"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid ""
+"The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA "
+"algorithm. OpenSSH can not handle this host key file, and the ssh-keygen "
+"utility from the old (non-free) SSH installation does not appear to be "
+"available."
+msgstr ""
+"La clave actual de su sistema, en /etc/ssh/ssh_host_key, está cifrada con el "
+"algoritmo IDEA. OpenSSH no puede manejar este fichero de clave y tampoco "
+"parece estar disponible la utilidad «ssh-keygen» de la instalación antigua de "
+"SSH (no libre)."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "You need to manually generate a new host key."
+msgstr "Debe generar manualmente una nueva clave de sistema."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid "Disable challenge-response authentication?"
+msgstr "¿Desea deshabilitar la autenticación basada en desafío-respuesta?"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"Password authentication appears to be disabled in the current OpenSSH server "
+"configuration. In order to prevent users from logging in using passwords "
+"(perhaps using only public key authentication instead) with recent versions "
+"of OpenSSH, you must disable challenge-response authentication, or else "
+"ensure that your PAM configuration does not allow Unix password file "
+"authentication."
+msgstr ""
+"Parece que la configuración actual de su servidor de OpenSSH tiene "
+"deshabilitada la autenticación mediante contraseñas. En las versiones "
+"recientes de OpenSSH para impedir que los usuarios se puedan conectar con "
+"contraseñas (y obligar la utilización de sistemas de autenticación con clave "
+"pública) debe deshabilitar la autenticación basada en desafío-respuesta o "
+"asegurarse de que su configuración PAM no permite autenticación basada en el "
+"fichero de contraseñas Unix."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"If you disable challenge-response authentication, then users will not be "
+"able to log in using passwords. If you leave it enabled (the default "
+"answer), then the 'PasswordAuthentication no' option will have no useful "
+"effect unless you also adjust your PAM configuration in /etc/pam.d/ssh."
+msgstr ""
+"Si deshabilita la autenticación mediante desafío-respuesta los usuarios no "
+"podrán acceder con contraseñas. Si la deja habilitada (respuesta por "
+"omisión) entonces la opción «PasswordAuthentication no» no tendrá ninguna "
+"utilidad a menos que ajuste su configuración de PAM en «/etc/pam.d/ssh»."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "Vulnerable host keys will be regenerated"
+msgstr "Se regenerarán las claves vulnerables del sistema"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Some of the OpenSSH server host keys on this system were generated with a "
+"version of OpenSSL that had a broken random number generator. As a result, "
+"these host keys are from a well-known set, are subject to brute-force "
+"attacks, and must be regenerated."
+msgstr ""
+"Algunas de las claves de sistema del servidor OpenSSH en este equipo se "
+"generaron con una versión de OpenSSL que tenía un generador de números "
+"aleatorios defectuoso. Consecuentemente, estas claves de sistema son de un "
+"conjunto de claves conocidas y están sujetas a ataques de fuerza bruta por "
+"lo que conviene regenerarlas."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Users of this system should be informed of this change, as they will be "
+"prompted about the host key change the next time they log in. Use 'ssh-"
+"keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of "
+"the new host keys."
+msgstr ""
+"Se informará a los usuarios de este sistema ya que se les informará del "
+"cambio de clave la siguiente vez que se conecten. Utilice «ssh-keygen -l -f "
+"ARCHIVO_CLAVE_SISTEMA» después de la actualización para obtener la huella "
+"digital de las nuevas claves del sistema."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "The affected host keys are:"
+msgstr "Las claves del sistema afectadas son:"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"User keys may also be affected by this problem. The 'ssh-vulnkey' command "
+"may be used as a partial test for this. See /usr/share/doc/openssh-server/"
+"README.compromised-keys.gz for more details."
+msgstr ""
+"Las claves de los usuarios también pueden estar afectadas por este problema. "
+"Se puede utilizar el programa «ssh-vulnkey» como un test parcial para "
+"detectar el problema. Consulte la información en «/usr/share/doc/openssh-"
+"server/README.compromised-keys.gz» para conocer los detalles."
+
+#~ msgid "Generate a new configuration file for OpenSSH?"
+#~ msgstr "¿Desea generar un nuevo fichero de configuración para OpenSSH?"
+
+#~ msgid ""
+#~ "This version of OpenSSH has a considerably changed configuration file "
+#~ "from the version shipped in Debian 'Potato', which you appear to be "
+#~ "upgrading from. This package can now generate a new configuration file (/"
+#~ "etc/ssh/sshd.config), which will work with the new server version, but "
+#~ "will not contain any customizations you made with the old version."
+#~ msgstr ""
+#~ "Esta versión de OpenSSH ha cambiado considerablemente el fichero de "
+#~ "configuración del incluido en Debian 'Potato', que es la versión desde la "
+#~ "que parece estar actualizando. Puede crear automáticamente un nuevo "
+#~ "fichero de configuración (/etc/ssh/sshd.config), que funcionará con la "
+#~ "nueva versión del servidor, pero no incluirá las modificaciones que "
+#~ "hiciera en la versión antigua."
+
+#~ msgid ""
+#~ "Please note that this new configuration file will set the value of "
+#~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password "
+#~ "can ssh directly in as root). Please read the README.Debian file for more "
+#~ "details about this design choice."
+#~ msgstr ""
+#~ "Además, recuerde que este nuevo fichero de configuración dirá sí en la "
+#~ "opción «PermitRootLogin», por lo que cualquiera que conozca la contraseña "
+#~ "de root podrá entrar mediante ssh directamente como root. Puede leer "
+#~ "README.Debian si quiere conocer más información sobre esta elección de "
+#~ "diseño."
+
+#~ msgid ""
+#~ "It is strongly recommended that you choose to generate a new "
+#~ "configuration file now."
+#~ msgstr ""
+#~ "Es muy recomendable que elija generar un nuevo fichero de configuración "
+#~ "ahora."
+
+#~ msgid "Warning: you must create a new host key"
+#~ msgstr "Aviso: debe crear una nueva clave para su servidor"
+
+#~ msgid "Warning: telnetd is installed --- probably not a good idea"
+#~ msgstr "Aviso: tiene telnetd instalado (posiblemente no es una buena idea)"
+
+#~ msgid ""
+#~ "I'd advise you to either remove the telnetd package (if you don't "
+#~ "actually need to offer telnet access) or install telnetd-ssl so that "
+#~ "there is at least some chance that telnet sessions will not be sending "
+#~ "unencrypted login/password and session information over the network."
+#~ msgstr ""
+#~ "Es muy aconsejable que borre el paquete telnetd si no necesita realmente "
+#~ "ofrecer acceso mediante telnet o instalar telnetd-ssl para que las "
+#~ "contraseñas, nombres de usuario y demás información de las sesiones "
+#~ "telnet no viajen sin cifrar por la red."
+
+#~ msgid "Warning: rsh-server is installed --- probably not a good idea"
+#~ msgstr ""
+#~ "Aviso: tiene rsh-server instalado (seguramente, esto no es una buena idea)"
+
+#~ msgid ""
+#~ "having rsh-server installed undermines the security that you were "
+#~ "probably wanting to obtain by installing ssh.  I'd advise you to remove "
+#~ "that package."
+#~ msgstr ""
+#~ "Tener rsh-server instalado representa un menoscabo de la seguridad que "
+#~ "probablemente desea obtener instalando ssh. Es muy aconsejable que borre "
+#~ "ese paquete."
+
+#~ msgid "Do you want ssh-keysign to be installed SUID root?"
+#~ msgstr "¿Quiere instalar ssh-keysign SUID root?"
+
+#~ msgid ""
+#~ "You have the option of installing the ssh-keysign helper with the SUID "
+#~ "bit set."
+#~ msgstr ""
+#~ "Puede instalar ssh-keysign con el bit SUID (se ejecutará con privilegios "
+#~ "de root)."
+
+#~ msgid ""
+#~ "If you make ssh-keysign SUID, you will be able to use SSH's Protocol 2 "
+#~ "host-based authentication."
+#~ msgstr ""
+#~ "Si hace ssh-keysign SUID, podrá usar la autenticación basada en servidor "
+#~ "de la versión 2 del protocolo SSH."
+
+#~ msgid ""
+#~ "If in doubt, I suggest you install it with SUID.  If it causes problems "
+#~ "you can change your mind later by running:   dpkg-reconfigure ssh"
+#~ msgstr ""
+#~ "Si duda, se recomienda que lo instale SUID. Si le causa problemas puede "
+#~ "cambiar de opinión posteriormente ejecutando «dpkg-reconfigure ssh»."
+
+#~ msgid "Allow SSH protocol 2 only"
+#~ msgstr "Permitir sólo la versión 2 del protocolo SSH"
+
+#~ msgid ""
+#~ "This version of OpenSSH supports version 2 of the ssh protocol, which is "
+#~ "much more secure.  Disabling ssh 1 is encouraged, however this will slow "
+#~ "things down on low end machines and might prevent older clients from "
+#~ "connecting (the ssh client shipped with \"potato\" is affected)."
+#~ msgstr ""
+#~ "Esta versión de OpenSSH soporta la versión 2 del protocolo ssh, que es "
+#~ "mucho más segura que la anterior. Se recomienda desactivar la versión 1, "
+#~ "aunque funcionará más lento en máquinas modestas y puede impedir que se "
+#~ "conecten clientes antiguos, como, por ejemplo, el incluido en «potato»."
+
+#~ msgid ""
+#~ "Also please note that keys used for protocol 1 are different so you will "
+#~ "not be able to use them if you only allow protocol 2 connections."
+#~ msgstr ""
+#~ "También tenga en cuenta que las claves utilizadas para el protocolo 1 son "
+#~ "diferentes, por lo que no podrá usarlas si únicamente permite conexiones "
+#~ "mediante la versión 2 del protocolo."
+
+#~ msgid ""
+#~ "If you later change your mind about this setting, README.Debian has "
+#~ "instructions on what to do to your sshd_config file."
+#~ msgstr ""
+#~ "Si más tarde cambia de opinión, el fichero README.Debian contiene "
+#~ "instrucciones sobre cómo modificar en el fichero sshd_config."
+
+#~ msgid "NOTE: Forwarding of X11 and Authorization disabled by default."
+#~ msgstr "NOTA: Reenvío de X11 y Autorización desactivadas por defecto."
+
+#~ msgid ""
+#~ "For security reasons, the Debian version of ssh has ForwardX11 and "
+#~ "ForwardAgent set to ``off'' by default."
+#~ msgstr ""
+#~ "Por razones de seguridad, la versión de ssh de Debian tiene por defecto "
+#~ "ForwardX11 y ForwardAgent desactivadas."
+
+#~ msgid ""
+#~ "You can enable it for servers you trust, either in one of the "
+#~ "configuration files, or with the -X command line option."
+#~ msgstr ""
+#~ "Puede activar estas opciones para los servidores en los que confíe, en "
+#~ "los ficheros de configuración o con la opción -X en línea de comandos."
+
+#~ msgid "More details can be found in /usr/share/doc/ssh/README.Debian"
+#~ msgstr "Puede encontrar más detalles en /usr/share/doc/ssh/README.Debian."
+
+#~ msgid "ssh2 keys merged in configuration files"
+#~ msgstr "Las claves ssh2 ya se incluyen en los ficheros de configuración"
+
+#~ msgid ""
+#~ "As of version 3 OpenSSH no longer uses separate files for ssh1 and ssh2 "
+#~ "keys. This means the authorized_keys2 and known_hosts2 files are no "
+#~ "longer needed. They will still be read in order to maintain backwards "
+#~ "compatibility"
+#~ msgstr ""
+#~ "A partir de la versión 3, OpenSSH ya no utiliza ficheros diferentes para "
+#~ "las claves ssh1 y ssh2. Esto quiere decir que ya no son necesarios los "
+#~ "ficheros authorized_keys2 y known_hosts2, aunque aún se seguirán leyendo "
+#~ "para mantener compatibilidad hacia atrás."
+
+#~ msgid "Do you want to run the sshd server?"
+#~ msgstr "¿Quiere ejecutar el servidor sshd?"
+
+#~ msgid "This package contains both the ssh client, and the sshd server."
+#~ msgstr "Este paquete contiene el cliente ssh y el servidor sshd."
+
+#~ msgid ""
+#~ "Normally the sshd Secure Shell Server will be run to allow remote logins "
+#~ "via ssh."
+#~ msgstr ""
+#~ "Generalmente, el servidor de ssh (Secure Shell Server) se ejecuta para "
+#~ "permitir el acceso remoto mediante ssh."
+
+#~ msgid ""
+#~ "If you are only interested in using the ssh client for outbound "
+#~ "connections on this machine, and don't want to log into it at all using "
+#~ "ssh, then you can disable sshd here."
+#~ msgstr ""
+#~ "Si sólo está interesado en usar el cliente ssh en conexiones salientes "
+#~ "del sistema y no quiere acceder a él mediante ssh, entonces puede "
+#~ "desactivar sshd."
+
+#~ msgid "Environment options on keys have been deprecated"
+#~ msgstr "Las opciones de entorno para las claves, en desuso"
+
+#~ msgid ""
+#~ "This version of OpenSSH disables the environment option for public keys "
+#~ "by default, in order to avoid certain attacks (for example, LD_PRELOAD). "
+#~ "If you are using this option in an authorized_keys file, beware that the "
+#~ "keys in question will no longer work until the option is removed."
+#~ msgstr ""
+#~ "Esta versión de OpenSSH tiene desactivada por defecto la opción de "
+#~ "entorno para las claves públicas, para evitar ciertos ataques (por "
+#~ "ejemplo, basados en LD_PRELOAD). Si utiliza esta opción en un fichero "
+#~ "authorized_keys, las claves implicadas no funcionarán hasta que borre la "
+#~ "opción."
+
+#~ msgid ""
+#~ "To re-enable this option, set \"PermitUserEnvironment yes\" in /etc/ssh/"
+#~ "sshd_config after the upgrade is complete, taking note of the warning in "
+#~ "the sshd_config(5) manual page."
+#~ msgstr ""
+#~ "Para volver a activar esta opción, escriba «PermitUserEnvironment yes» en /"
+#~ "etc/ssh/sshd_config al terminar la actualización, teniendo en cuenta el "
+#~ "aviso de la página de manual de sshd_config(5)."
+
+#~ msgid "Privilege separation"
+#~ msgstr "Separación de privilegios"
+
+#~ msgid ""
+#~ "Privilege separation is turned on by default, so if you decide you want "
+#~ "it turned off, you need to add \"UsePrivilegeSeparation no\" to /etc/ssh/"
+#~ "sshd_config."
+#~ msgstr ""
+#~ "La separación de privilegios está activa por defecto, por lo que si "
+#~ "decide desactivarla, tiene que añadir «UsePrivilegeSeparation no» al "
+#~ "fichero /etc/ssh/sshd_config."
+
+#~ msgid "Enable Privilege separation"
+#~ msgstr "Activar separación de privilegios"
+
+#~ msgid ""
+#~ "This version of OpenSSH contains the new privilege separation option. "
+#~ "This significantly reduces the quantity of code that runs as root, and "
+#~ "therefore reduces the impact of security holes in sshd."
+#~ msgstr ""
+#~ "Esta versión de OpenSSH incluye una nueva opción de separación de "
+#~ "privilegios que reduce significativamente la cantidad de código que se "
+#~ "ejecuta como root, por lo que reduce el impacto de posibles agujeros de "
+#~ "seguridad en sshd."
+
+#~ msgid ""
+#~ "Unfortunately, privilege separation interacts badly with PAM. Any PAM "
+#~ "session modules that need to run as root (pam_mkhomedir, for example) "
+#~ "will fail, and PAM keyboard-interactive authentication won't work."
+#~ msgstr ""
+#~ "Desafortunadamente, la separación de privilegios no funciona "
+#~ "correctamente con PAM. Cualquier módulo PAM que necesite ejecutarse como "
+#~ "root (como, por ejemplo, pam_mkhomedir) y la autenticación interactiva "
+#~ "PAM con teclado no funcionarán."
+
+#~ msgid ""
+#~ "Since you've opted to have me generate an sshd_config file for you, you "
+#~ "can choose whether or not to have privilege separation turned on or not. "
+#~ "Unless you know you need to use PAM features that won't work with this "
+#~ "option, you should enable it."
+#~ msgstr ""
+#~ "Puesto que ha elegido crear automáticamente el fichero sshd_config, puede "
+#~ "decidir ahora si quiere activar la opción de separación de privilegios. A "
+#~ "menos que necesite usar ciertas características de PAM que no funcionan "
+#~ "con esta opción, debería responder sí a esta pregunta."
+
+#~ msgid ""
+#~ "NB! If you are running a 2.0 series Linux kernel, then privilege "
+#~ "separation will not work at all, and your sshd will fail to start unless "
+#~ "you explicitly turn privilege separation off."
+#~ msgstr ""
+#~ "Nota: Si utiliza un núcleo Linux 2.0, la separación de privilegios "
+#~ "fallará estrepitosamente y sshd no funcionará a no ser que la desactive."
diff --git a/debian/po/eu.po b/debian/po/eu.po
new file mode 100644
index 000000000..efa16fa81
--- /dev/null
+++ b/debian/po/eu.po
@@ -0,0 +1,197 @@
+# translation of openssh-templates.po to basque
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the PACKAGE package.
+#
+# Piarres Beobide <pi@beobide.net>, 2007, 2008.
+msgid ""
+msgstr ""
+"Project-Id-Version: openssh-templates\n"
+"Report-Msgid-Bugs-To: openssh@packages.debian.org\n"
+"POT-Creation-Date: 2010-01-02 08:55+0000\n"
+"PO-Revision-Date: 2007-04-27 12:10+0200\n"
+"Last-Translator: Piarres Beobide <pi@beobide.net>\n"
+"Language-Team: librezale <librezale@librezale.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: Pootle 0.11\n"
+"Plural-Forms: nplurals=2; plural=(n != 1);\n"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid "Do you want to risk killing active SSH sessions?"
+msgstr "Irekirik dauden SSH saioak ixteko arriskua hartu nahi duzu?"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid ""
+"The currently installed version of /etc/init.d/ssh is likely to kill all "
+"running sshd instances. If you are doing this upgrade via an SSH session, "
+"you're likely to be disconnected and leave the upgrade procedure unfinished."
+msgstr ""
+"Instalaturik dagoen /etc/init.d/ssh bertsioak martxan dauden sshd "
+"instantziak hilko ditu. Bertsio berritze hau SSH bidez egiten ari bazara, "
+"ziurrenik deskonektatu egingo zara eta bertsio berritze prozedura ez da "
+"behar bezala amaituko."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid ""
+"This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the "
+"start-stop-daemon line in the stop section of the file."
+msgstr ""
+"Hau eskuz konpondu daiteke  \"--pidfile /var/run/sshd.pid\" gehituaz start-"
+"stop-daemon lerroan fitxategiaren \"stop\" atalean."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "New host key mandatory"
+msgstr "Ostalari gako berria beharrezkoa"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid ""
+"The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA "
+"algorithm. OpenSSH can not handle this host key file, and the ssh-keygen "
+"utility from the old (non-free) SSH installation does not appear to be "
+"available."
+msgstr ""
+"/etc/ssh/ssh_host_key-ko ostalari gakoa IDEA algoritmoaren bidez "
+"enkriptaturik dago. OpenSSH ez da ostalari gako mota hau kudeatzeko gai eta "
+"SSH instalazio zaharreko (ez-librea) ssh-keygen lanabesa dirudienez ez dago "
+"erabilgarri."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "You need to manually generate a new host key."
+msgstr "Ostalari gako berri bat eskuz sortu behar duzu."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid "Disable challenge-response authentication?"
+msgstr "erronka-erantzun autentifikazioa desgaitu?"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"Password authentication appears to be disabled in the current OpenSSH server "
+"configuration. In order to prevent users from logging in using passwords "
+"(perhaps using only public key authentication instead) with recent versions "
+"of OpenSSH, you must disable challenge-response authentication, or else "
+"ensure that your PAM configuration does not allow Unix password file "
+"authentication."
+msgstr ""
+"Pasahitz egiaztapena dirudienez desgaiturik dago instalaturik dagoen OpenSSH "
+"konfigurazioan. Pasahitzak erabiliaz OpenSSH bertsio berrietan saio hastea "
+"ezintzeko (agian gako publiko autentifikazioa bakarrik erabiliaz), erronka-"
+"erantzun (challenge-response) autentifikazioa desgaitu edo zure PAM "
+"konfigurazioak UNIX pasahitz fitxategi autentifikazioa onartzen ez duela "
+"ziurtatu beharko duzu."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"If you disable challenge-response authentication, then users will not be "
+"able to log in using passwords. If you leave it enabled (the default "
+"answer), then the 'PasswordAuthentication no' option will have no useful "
+"effect unless you also adjust your PAM configuration in /etc/pam.d/ssh."
+msgstr ""
+"Erronka-erantzun autentifikazioa des\tgaituaz gero erabiltzaileak ez dira "
+"pasahitza erabiliaz saio hasteko gai izango. Berau gaiturik utziaz gero "
+"(lehenetsiriko erantzuna), 'PasswordAuthentication no' aukerak ez du "
+"ondoriorik izango /etc/pam.d/ssh-eko PAM konfigurazioa doitzen ez baduzu."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "Vulnerable host keys will be regenerated"
+msgstr "Ostalari gako ahulak birsortu egingo dira"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Some of the OpenSSH server host keys on this system were generated with a "
+"version of OpenSSL that had a broken random number generator. As a result, "
+"these host keys are from a well-known set, are subject to brute-force "
+"attacks, and must be regenerated."
+msgstr ""
+"Sistema honetako zenbait OpenSSH ostalari gako hondaturiko ausazko zenbasi "
+"sortzaile bat zuen OpenSSL bertsio batez sortuak izan ziren. Hau dela eta, "
+"ostalari gako horiek ezagutza handiko pertsona batek indarrezko erasoei "
+"ahulak dira eta birsortuak izango dira."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Users of this system should be informed of this change, as they will be "
+"prompted about the host key change the next time they log in. Use 'ssh-"
+"keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of "
+"the new host keys."
+msgstr ""
+"Sistema honetako erabiltzaileak aldaketa honetaz ohartu beharko ziren, saio "
+"hasten duten hurrengoan ostalari gako aldaketaz galdetuko zaie eta. 'ssh-"
+"keygen -l -f OSTALARI_GAKO_FITX' erabili bertsio-berritzearen ondoren "
+"ostalari gako berrien hatzmarkak inprimatzeko."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "The affected host keys are:"
+msgstr "Ostalari gako hauei eragingo die:"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"User keys may also be affected by this problem. The 'ssh-vulnkey' command "
+"may be used as a partial test for this. See /usr/share/doc/openssh-server/"
+"README.compromised-keys.gz for more details."
+msgstr ""
+"Erabiltzaile gakoak ere arazo honengatik eragindak egon daitezke. 'ssh-"
+"vulnkey' komandoak honetarako proba bezala erdi-ziur erabili daiteke. Ikusi /"
+"usr/share/doc/openssh-server/README.compromised-keys.gz xehetasun "
+"gehiagorako."
+
+#~ msgid "Generate a new configuration file for OpenSSH?"
+#~ msgstr "OpenSSH-rentzat konfigurazio fitxategi berri bat sortu?"
+
+#~ msgid ""
+#~ "This version of OpenSSH has a considerably changed configuration file "
+#~ "from the version shipped in Debian 'Potato', which you appear to be "
+#~ "upgrading from. This package can now generate a new configuration file (/"
+#~ "etc/ssh/sshd.config), which will work with the new server version, but "
+#~ "will not contain any customizations you made with the old version."
+#~ msgstr ""
+#~ "OpenSSH bertsio honek konfigurazio fitxategia nahiko aldatu du Debian "
+#~ "'Potato' bertsioak banatu zuenetik, dirudienez zu bertsio horretatik "
+#~ "eguneratzen ari zara. Pakete honek konfigurazio fitxategi berri bat sortu "
+#~ "dezake (/etc/ssh/sshd.config) bertsio honetarako funtziona dezan baina ez "
+#~ "ditu zuk bertsio zaharrari egin ahal izan diezazkiokezun "
+#~ "pertsonalizazioak edukiko."
+
+#~ msgid ""
+#~ "Please note that this new configuration file will set the value of "
+#~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password "
+#~ "can ssh directly in as root). Please read the README.Debian file for more "
+#~ "details about this design choice."
+#~ msgstr ""
+#~ "Kontutan izan konfigurazio fitxategi berri honek 'PermitRootLogin' "
+#~ "parametroan balioa 'yes' bezala ezarriko duela (honek root erabiltzaileak "
+#~ "ssh bidez sartzeko aukera emango du). Mesedez irakurri README.Debian "
+#~ "fitxategia ezarpen honen xehetasun gehiagorako."
+
+#~ msgid ""
+#~ "It is strongly recommended that you choose to generate a new "
+#~ "configuration file now."
+#~ msgstr "Gomendagarria da konfigurazio fitxategi berri bat orain sortzea."
diff --git a/debian/po/fi.po b/debian/po/fi.po
new file mode 100644
index 000000000..b5e192db3
--- /dev/null
+++ b/debian/po/fi.po
@@ -0,0 +1,202 @@
+# translation of fi.po to Finnish
+# openssh translation
+#
+#    Translators, if you are not familiar with the PO format, gettext
+#    documentation is worth reading, especially sections dedicated to
+#    this format, e.g. by running:
+#         info -n '(gettext)PO Files'
+#         info -n '(gettext)Header Entry'
+#
+#    Some information specific to po-debconf are available at
+#            /usr/share/doc/po-debconf/README-trans
+#         or http://www.debian.org/intl/l10n/po-debconf/README-trans
+#
+#    Developers do not need to manually edit POT or PO files.
+#
+# Matti Pöllä <mpo@iki.fi>, 2004-2005.
+msgid ""
+msgstr ""
+"Project-Id-Version: openssh\n"
+"Report-Msgid-Bugs-To: openssh@packages.debian.org\n"
+"POT-Creation-Date: 2010-01-02 08:55+0000\n"
+"PO-Revision-Date: 2008-05-17 16:38+0200\n"
+"Last-Translator: Esko Arajärvi <edu@iki.fi>\n"
+"Language-Team: Finnish <debian-l10n-finnish@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid "Do you want to risk killing active SSH sessions?"
+msgstr "Haluatko ottaa riskin, että aktiiviset SSH-istunnot tapetaan?"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid ""
+"The currently installed version of /etc/init.d/ssh is likely to kill all "
+"running sshd instances. If you are doing this upgrade via an SSH session, "
+"you're likely to be disconnected and leave the upgrade procedure unfinished."
+msgstr ""
+"Tiedoston /etc/init.d/ssh asennettuna oleva versio tappaa todennäköisesti "
+"kaikki käynnissä olevat sshd-prosessit. Jos teet tätä päivitystä ssh-"
+"yhteyden yli, yhteytesi luultavasti katkeaa ja päivitysprosessi keskeytyy."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid ""
+"This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the "
+"start-stop-daemon line in the stop section of the file."
+msgstr ""
+"Tämä voidaan korjata lisäämällä merkkijono �--pidfile /var/run/sshd.pid� "
+"kyseisen tiedoston stop-osion start-stop-daemon-riville."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "New host key mandatory"
+msgstr "Uusi järjestelmäavain pakollinen"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid ""
+"The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA "
+"algorithm. OpenSSH can not handle this host key file, and the ssh-keygen "
+"utility from the old (non-free) SSH installation does not appear to be "
+"available."
+msgstr ""
+"Olemassa oleva järjestelmäavain /etc/ssh/ssh_host_key on salattu IDEA-"
+"algoritmilla. OpenSSH ei voi käsitellä tätä järjestelmäavaintiedostoa, eikä "
+"vanhan (ei-vapaan) SSH-asennuksen ssh-keygen-ohjelmaa löydy."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "You need to manually generate a new host key."
+msgstr "Uuden järjestelmäavaimen (host key) luominen on tarpeen."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid "Disable challenge-response authentication?"
+msgstr "Poistetaanko haaste-vaste-autentikointi käytöstä?"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"Password authentication appears to be disabled in the current OpenSSH server "
+"configuration. In order to prevent users from logging in using passwords "
+"(perhaps using only public key authentication instead) with recent versions "
+"of OpenSSH, you must disable challenge-response authentication, or else "
+"ensure that your PAM configuration does not allow Unix password file "
+"authentication."
+msgstr ""
+"OpenSSH-palvelimen nykyisissä asetuksissa salasana-autentikointi näyttää "
+"olevan poissa käytöstä. Estääksesi kirjautumiset salasanaa käyttäen (esim. "
+"salliaksesi kirjautumisen vain julkista avainta käyttäen), OpenSSH:n uusissa "
+"versioissa haaste-vaste-autentikointi tulee poistaa käytöstä tai muutoin "
+"varmistaa, että PAM-asetukset eivät salli Unixin salasanatiedostoon "
+"perustuvaa autentikointia."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"If you disable challenge-response authentication, then users will not be "
+"able to log in using passwords. If you leave it enabled (the default "
+"answer), then the 'PasswordAuthentication no' option will have no useful "
+"effect unless you also adjust your PAM configuration in /etc/pam.d/ssh."
+msgstr ""
+"Jos poistat haaste-vaste-autentikoinnin käytöstä, käyttäjät eivät voi "
+"kirjautua käyttäen salasanaa. Jos jätät sen päälle (oletus), asetuksella "
+"�PasswordAuthentication no� ei ole vaikutusta, ellet muuta myös PAM-"
+"asetuksia tiedostossa /etc/pam.d/ssh."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "Vulnerable host keys will be regenerated"
+msgstr "Haavoittuvaiset järjestelmäavaimet luodaan uudelleen"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Some of the OpenSSH server host keys on this system were generated with a "
+"version of OpenSSL that had a broken random number generator. As a result, "
+"these host keys are from a well-known set, are subject to brute-force "
+"attacks, and must be regenerated."
+msgstr ""
+"Jotkin tämän järjestelmän OpenSSH-palvelimen järjestelmäavaimista on luotu "
+"OpenSSL:n versiolla, jossa oli rikkinäinen satunnaislukugeneraattori. Tämän "
+"tuloksena nämä avaimet voidaan murtaa järjestelmällisellä läpikäynnillä ja "
+"ne tulee vaihtaa."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Users of this system should be informed of this change, as they will be "
+"prompted about the host key change the next time they log in. Use 'ssh-"
+"keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of "
+"the new host keys."
+msgstr ""
+"Järjestelmän käyttäjille tulisi tiedottaa tästä muutoksesta, koska heitä "
+"pyydetään hyväksymään muuttunut järjestelmäavain, kun he seuraavan kerran "
+"kirjautuvat järjestelmään. Komennolla �ssh-keygen -l -f HOST_KEY_FILE� "
+"voidaan tulostaa uusien järjestelmäavainten sormenjäljet päivityksen jälkeen."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "The affected host keys are:"
+msgstr "Järjestelmäavaimet, joihin tämä vaikuttaa:"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"User keys may also be affected by this problem. The 'ssh-vulnkey' command "
+"may be used as a partial test for this. See /usr/share/doc/openssh-server/"
+"README.compromised-keys.gz for more details."
+msgstr ""
+"Tämä ongelma saattaa vaikuttaa myös käyttäjien avaimiin. Komennolla �ssh-"
+"vulnkey� voidaan osittain testata tätä. Tiedostossa /usr/share/doc/openssh-"
+"server/README.compromised-keys.gz on lisätietoja."
+
+#~ msgid "Generate a new configuration file for OpenSSH?"
+#~ msgstr "Luodaanko OpenSSH:lle uusi asetustiedosto?"
+
+#~ msgid ""
+#~ "This version of OpenSSH has a considerably changed configuration file "
+#~ "from the version shipped in Debian 'Potato', which you appear to be "
+#~ "upgrading from. This package can now generate a new configuration file (/"
+#~ "etc/ssh/sshd.config), which will work with the new server version, but "
+#~ "will not contain any customizations you made with the old version."
+#~ msgstr ""
+#~ "Tämän OpenSSH:n version käyttämän asetustiedoston muoto poikkeaa "
+#~ "huomattavasti Debianin �Potato�-julkaisun mukana toimitetusta versiosta, "
+#~ "jota olet päivittämässä. Uusi asetustiedosto (/etc/ssh/sshd.config) "
+#~ "voidaan luoda nyt. Uudet asetukset toimivat uuden palvelinversion kanssa, "
+#~ "mutta vanhaan versioon itse tehdyt muokkaukset menetetään."
+
+#~ msgid ""
+#~ "Please note that this new configuration file will set the value of "
+#~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password "
+#~ "can ssh directly in as root). Please read the README.Debian file for more "
+#~ "details about this design choice."
+#~ msgstr ""
+#~ "Uudessa asetustiedostossa muuttujan �PermitRootLogin� arvo on "
+#~ "�yes� (tarkoittaen, että kuka tahansa pääkäyttäjän salasanan tietävä voi "
+#~ "kirjautua suoraan ssh:n avulla pääkäyttäjänä). Lisätietoja tästä "
+#~ "valinnasta löytyy (englanniksi) tiedostosta README.Debian."
+
+#~ msgid ""
+#~ "It is strongly recommended that you choose to generate a new "
+#~ "configuration file now."
+#~ msgstr "Uuden asetustiedoston luominen nyt on erittäin suositeltavaa."
diff --git a/debian/po/fr.po b/debian/po/fr.po
new file mode 100644
index 000000000..a8856906d
--- /dev/null
+++ b/debian/po/fr.po
@@ -0,0 +1,211 @@
+# translation of fr.po to French
+#
+#    Translators, if you are not familiar with the PO format, gettext
+#    documentation is worth reading, especially sections dedicated to
+#    this format, e.g. by running:
+#         info -n '(gettext)PO Files'
+#         info -n '(gettext)Header Entry'
+#
+#    Some information specific to po-debconf are available at
+#            /usr/share/doc/po-debconf/README-trans
+#         or http://www.debian.org/intl/l10n/po-debconf/README-trans
+#
+#    Developers do not need to manually edit POT or PO files.
+#
+# Christian Perrier <bubulle@debian.org>, 2007, 2008.
+msgid ""
+msgstr ""
+"Project-Id-Version: \n"
+"Report-Msgid-Bugs-To: openssh@packages.debian.org\n"
+"POT-Creation-Date: 2010-01-02 08:55+0000\n"
+"PO-Revision-Date: 2008-05-15 10:23+0200\n"
+"Last-Translator: Christian Perrier <bubulle@debian.org>\n"
+"Language-Team: French <debian-l10n-french@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: KBabel 1.11.4\n"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid "Do you want to risk killing active SSH sessions?"
+msgstr "Voulez-vous risquer de rompre les sessions SSH actives ?"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid ""
+"The currently installed version of /etc/init.d/ssh is likely to kill all "
+"running sshd instances. If you are doing this upgrade via an SSH session, "
+"you're likely to be disconnected and leave the upgrade procedure unfinished."
+msgstr ""
+"La version de /etc/init.d/ssh actuellement installée va vraisemblablement "
+"interrompre toutes les instances de sshd en cours. Si vous êtes en train de "
+"faire cette mise à niveau à l'aide de SSH, la connexion sera probablement "
+"coupée et la mise à jour sera interrompue."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid ""
+"This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the "
+"start-stop-daemon line in the stop section of the file."
+msgstr ""
+"Cela peut être corrigé en ajoutant « --pidfile /var/run/sshd.pid » à la ligne "
+"« start-stop-daemon » dans /etc/init.d/ssh, dans la section « stop » du "
+"fichier."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "New host key mandatory"
+msgstr "Nouvelle clé d'hôte obligatoire"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid ""
+"The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA "
+"algorithm. OpenSSH can not handle this host key file, and the ssh-keygen "
+"utility from the old (non-free) SSH installation does not appear to be "
+"available."
+msgstr ""
+"La clé d'hôte actuelle, /etc/ssh/ssh_host_key, est chiffrée avec IDEA. "
+"OpenSSH ne peut utiliser ce fichier de clé, et l'utilitaire ssh-keygen de "
+"l'installation précédente (non libre) de SSH n'a pas été trouvé."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "You need to manually generate a new host key."
+msgstr "Vous devez générer une nouvelle clé d'hôte vous-même."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid "Disable challenge-response authentication?"
+msgstr "Faut-il désactiver l'authentification par défi-réponse ?"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"Password authentication appears to be disabled in the current OpenSSH server "
+"configuration. In order to prevent users from logging in using passwords "
+"(perhaps using only public key authentication instead) with recent versions "
+"of OpenSSH, you must disable challenge-response authentication, or else "
+"ensure that your PAM configuration does not allow Unix password file "
+"authentication."
+msgstr ""
+"L'authentification par mots de passe semble être désactivée dans la "
+"configuration actuelle du serveur OpenSSH. Afin d'empêcher les utilisateurs "
+"de se connecter avec un mot de passe (pour, par exemple n'autoriser que "
+"l'authentification par clé publique) avec les versions récentes d'OpenSSH, "
+"vous devez aussi désactiver l'authentification par défi-réponse, ou alors "
+"vous assurer que votre configuration de PAM n'autorise pas "
+"l'authentification avec le fichier de mots de passe Unix."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"If you disable challenge-response authentication, then users will not be "
+"able to log in using passwords. If you leave it enabled (the default "
+"answer), then the 'PasswordAuthentication no' option will have no useful "
+"effect unless you also adjust your PAM configuration in /etc/pam.d/ssh."
+msgstr ""
+"Si vous désactivez l'authentification par défi-réponse, alors les "
+"utilisateurs ne pourront pas se connecter en entrant un mot de passe. Si "
+"vous la laissez active (ce qui est la valeur par défaut), alors l'option "
+"« PasswordAuthentication no » n'aura d'effet que si vous ajustez aussi la "
+"configuration de PAM dans /etc/pam.d/ssh."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "Vulnerable host keys will be regenerated"
+msgstr "Recréation des clés d'hôte vulnérables"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Some of the OpenSSH server host keys on this system were generated with a "
+"version of OpenSSL that had a broken random number generator. As a result, "
+"these host keys are from a well-known set, are subject to brute-force "
+"attacks, and must be regenerated."
+msgstr ""
+"Certaines clés d'hôte OpenSSH de ce serveur ont été créées avec une version "
+"d'OpenSSL affligée d'un défaut dans le générateur de nombres aléatoires. En "
+"conséquence, ces clés ont un contenu prévisible et peuvent être vulnérables "
+"à des attaques par force brute. Elles doivent être recréées."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Users of this system should be informed of this change, as they will be "
+"prompted about the host key change the next time they log in. Use 'ssh-"
+"keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of "
+"the new host keys."
+msgstr ""
+"Les utilisateurs de ce système devraient être informés de cette modification "
+"car le système leur signalera le changement de clé d'hôte à leur prochaine "
+"connexion. Vous pouvez utiliser la commande « ssh-keygen -l -f "
+"HOST_KEY_FILE » après la mise à jour pour afficher l'empreinte des nouvelles "
+"clés d'hôte."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "The affected host keys are:"
+msgstr "Les clés concernées sont les suivantes :"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"User keys may also be affected by this problem. The 'ssh-vulnkey' command "
+"may be used as a partial test for this. See /usr/share/doc/openssh-server/"
+"README.compromised-keys.gz for more details."
+msgstr ""
+"Les clés OpenSSH des utilisateurs sont aussi potentiellement affectées par "
+"ce problème. La commande « ssh-vulnkey » offre un test partiel pour cette "
+"vulnérabilité. Veuillez consulter le fichier /usr/share/doc/openssh-server/"
+"README.compromised-keys.gz pour plus d'informations."
+
+#~ msgid "Generate a new configuration file for OpenSSH?"
+#~ msgstr "Faut-il créer un nouveau fichier de configuration pour OpenSSH ?"
+
+#~ msgid ""
+#~ "This version of OpenSSH has a considerably changed configuration file "
+#~ "from the version shipped in Debian 'Potato', which you appear to be "
+#~ "upgrading from. This package can now generate a new configuration file (/"
+#~ "etc/ssh/sshd.config), which will work with the new server version, but "
+#~ "will not contain any customizations you made with the old version."
+#~ msgstr ""
+#~ "Cette version d'OpenSSH utilise un fichier de configuration qui a "
+#~ "fortement changé depuis la version contenue dans la distribution Debian "
+#~ "« Potato », depuis laquelle vous semblez faire une mise à jour. Un nouveau "
+#~ "fichier de configuration (/etc/ssh/sshd.config) qui fonctionnera avec la "
+#~ "nouvelle version du serveur peut être créé, mais ne contiendra aucun des "
+#~ "réglages que vous aviez faits avec la version précédente."
+
+#~ msgid ""
+#~ "Please note that this new configuration file will set the value of "
+#~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password "
+#~ "can ssh directly in as root). Please read the README.Debian file for more "
+#~ "details about this design choice."
+#~ msgstr ""
+#~ "Veuillez noter que ce nouveau fichier de configuration positionnera la "
+#~ "valeur de « PermitRootLogin » à « yes » (ce qui signifie que quiconque "
+#~ "connaissant le mot de passe du superutilisateur peut se connecter en tant "
+#~ "que tel sur la machine). Veuillez consulter le fichier README.Debian pour "
+#~ "plus d'informations à propos de ce choix."
+
+#~ msgid ""
+#~ "It is strongly recommended that you choose to generate a new "
+#~ "configuration file now."
+#~ msgstr ""
+#~ "Il est fortement recommandé de créer un nouveau fichier de configuration."
diff --git a/debian/po/gl.po b/debian/po/gl.po
new file mode 100644
index 000000000..acbb341b2
--- /dev/null
+++ b/debian/po/gl.po
@@ -0,0 +1,236 @@
+# Galician translation of openssh's debconf templates.
+# This file is distributed under the same license as the openssh package.
+#
+# 2006, 2007, 2008 Jacobo Tarrio <jtarrio@debian.org>
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: openssh\n"
+"Report-Msgid-Bugs-To: openssh@packages.debian.org\n"
+"POT-Creation-Date: 2010-01-02 08:55+0000\n"
+"PO-Revision-Date: 2008-05-17 10:29+0100\n"
+"Last-Translator: Jacobo Tarrio <jtarrio@debian.org>\n"
+"Language-Team: Galician <proxecto@trasno.net>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid "Do you want to risk killing active SSH sessions?"
+msgstr "¿Quere arriscarse a matar as sesións de SSH activas?"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid ""
+"The currently installed version of /etc/init.d/ssh is likely to kill all "
+"running sshd instances. If you are doing this upgrade via an SSH session, "
+"you're likely to be disconnected and leave the upgrade procedure unfinished."
+msgstr ""
+"É posible que a versión de /etc/init.d/ssh que instalou vaia matar tódalas "
+"instancias de sshd en execución. Se está a facer esta actualización mediante "
+"unha sesión SSH, é probable que se desconecte e este procedemento de "
+"actualización quede sen rematar."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid ""
+"This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the "
+"start-stop-daemon line in the stop section of the file."
+msgstr ""
+"Isto pode arranxarse engadindo \"--pidfile /var/run/sshd.pid\" á liña start-"
+"stop-daemon da sección stop do ficheiro."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "New host key mandatory"
+msgstr "É obrigatorio ter unha nova clave de servidor"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid ""
+"The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA "
+"algorithm. OpenSSH can not handle this host key file, and the ssh-keygen "
+"utility from the old (non-free) SSH installation does not appear to be "
+"available."
+msgstr ""
+"A clave de servidor actual, armacenada en /etc/ssh/ssh_host_key, está "
+"cifrada mediante o algoritmo IDEA. OpenSSH non pode xestionar este ficheiro "
+"de clave de servidor, e non semella que estea dispoñible a utilidade ssh-"
+"keygen da anterior instalación de SSH (non libre)."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "You need to manually generate a new host key."
+msgstr "Ten que xerar unha nova clave de servidor."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid "Disable challenge-response authentication?"
+msgstr "¿Desactivar a autenticación por desafío-resposta?"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"Password authentication appears to be disabled in the current OpenSSH server "
+"configuration. In order to prevent users from logging in using passwords "
+"(perhaps using only public key authentication instead) with recent versions "
+"of OpenSSH, you must disable challenge-response authentication, or else "
+"ensure that your PAM configuration does not allow Unix password file "
+"authentication."
+msgstr ""
+"Semella que a autenticación por contrasinal está desactivada na "
+"configuración actual do servidor de OpenSSH. Para impedir que os usuarios se "
+"conecten empregando contrasinais (empregando no seu canto, por exemplo, "
+"autenticación mediante clave pública), nas versións recentes de OpenSSH ten "
+"que desactivar a autenticación por desafío-resposta ou asegurarse de que a "
+"súa configuración de PAM non permita a autenticación por ficheiro de "
+"contrasinais de Unix."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"If you disable challenge-response authentication, then users will not be "
+"able to log in using passwords. If you leave it enabled (the default "
+"answer), then the 'PasswordAuthentication no' option will have no useful "
+"effect unless you also adjust your PAM configuration in /etc/pam.d/ssh."
+msgstr ""
+"Se desactiva a autenticación por desafío-resposta, os usuarios non han poder "
+"conectarse empregando contrasinais. Se a deixa activada (a resposta por "
+"defecto) a opción \"PasswordAuthentication no\" non ha ter ningún efecto "
+"útil a menos que tamén axuste a súa configuración de PAM en /etc/pam.d/ssh."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "Vulnerable host keys will be regenerated"
+msgstr "Hanse rexenerar as claves de servidor vulnerables"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Some of the OpenSSH server host keys on this system were generated with a "
+"version of OpenSSL that had a broken random number generator. As a result, "
+"these host keys are from a well-known set, are subject to brute-force "
+"attacks, and must be regenerated."
+msgstr ""
+"Algunhas das claves de servidor de OpenSSH deste sistema xeráronse cunha "
+"versión de OpenSSL que tiña un xerador de números aleatorios que non "
+"funcionaba correctamente. Coma resultado, esas claves de servidor pertencen "
+"a un conxunto coñecido, son vulnerables a ataques por forza bruta, e teñen "
+"que se rexenerar."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Users of this system should be informed of this change, as they will be "
+"prompted about the host key change the next time they log in. Use 'ssh-"
+"keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of "
+"the new host keys."
+msgstr ""
+"É preciso informar deste cambio aos usuarios deste sistema, xa que se lles "
+"ha avisar do cambio de clave de servidor a próxima vez que se conecten. "
+"Empregue a orde \"ssh-keygen -l -f FICHEIRO_DE_CLAVE\" trala actualización "
+"para amosar as pegadas dactilares das novas claves de servidor."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "The affected host keys are:"
+msgstr "As claves de servidor afectadas son:"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"User keys may also be affected by this problem. The 'ssh-vulnkey' command "
+"may be used as a partial test for this. See /usr/share/doc/openssh-server/"
+"README.compromised-keys.gz for more details."
+msgstr ""
+"As claves dos usuarios tamén poden estar afectadas por este problema. Pódese "
+"empregar a orde \"ssh-vulnkey\" para facer unha comprobación parcial disto. "
+"Consulte /usr/share/doc/openssh-server/README.compromised-keys.gz para máis "
+"detalles."
+
+#~ msgid "Generate a new configuration file for OpenSSH?"
+#~ msgstr "¿Xerar un novo ficheiro de configuración para OpenSSH?"
+
+#~ msgid ""
+#~ "This version of OpenSSH has a considerably changed configuration file "
+#~ "from the version shipped in Debian 'Potato', which you appear to be "
+#~ "upgrading from. This package can now generate a new configuration file (/"
+#~ "etc/ssh/sshd.config), which will work with the new server version, but "
+#~ "will not contain any customizations you made with the old version."
+#~ msgstr ""
+#~ "Esta versión de OpenSSH ten un ficheiro de configuración que cambiou "
+#~ "moito con respecto á versión que se subministrou con Debian \"Potato\", "
+#~ "desde a que semella que se está a actualizar. Este paquete pode xerar "
+#~ "agora un novo ficheiro de configuración (/etc/ssh/sshd.config) que ha "
+#~ "funcionar coa nova versión do servidor, pero que non ha conter ningunha "
+#~ "personalización que teña feito na versión antiga."
+
+# | msgid ""
+# | "Please note that this new configuration file will set the value of "
+# | "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password "
+# | "can ssh directly in as root). Please read the README.Debian file for more "
+# | "details about this design choice."
+#~ msgid ""
+#~ "Please note that this new configuration file will set the value of "
+#~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password "
+#~ "can ssh directly in as root). Please read the README.Debian file for more "
+#~ "details about this design choice."
+#~ msgstr ""
+#~ "Teña en conta que este novo ficheiro de configuración ha establecer o "
+#~ "valor de de \"PermitRootLogin\" a \"yes\" (o que significa que calquera "
+#~ "que coñeza o contrasinal do administrador ha poder conectarse "
+#~ "directamente coma \"root\" mediante ssh). Consulte o ficheiro README."
+#~ "Debian para ter máis detalles sobre esta decisión de deseño."
+
+#~ msgid ""
+#~ "It is strongly recommended that you choose to generate a new "
+#~ "configuration file now."
+#~ msgstr ""
+#~ "Recoméndase encarecidamente que xere agora un novo ficheiro de "
+#~ "configuración."
+
+#~ msgid "Warning: you must create a new host key"
+#~ msgstr "Aviso: ten que crear unha nove chave de servidor"
+
+#~ msgid "Warning: telnetd is installed --- probably not a good idea"
+#~ msgstr ""
+#~ "Aviso: telnetd está instalado --- seguramente non sexa unha boa idea"
+
+#~ msgid ""
+#~ "I'd advise you to either remove the telnetd package (if you don't "
+#~ "actually need to offer telnet access) or install telnetd-ssl so that "
+#~ "there is at least some chance that telnet sessions will not be sending "
+#~ "unencrypted login/password and session information over the network."
+#~ msgstr ""
+#~ "Recoméndase que elimine o paquete telnetd (se non precisa de fornecer "
+#~ "acceso por telnet) ou instale telnetd-ssl para que exista alomenos "
+#~ "algunha posibilidade de que as sesións telnet non envíen información de "
+#~ "usuario/contrasinal e das sesións sen cifrar pola rede."
+
+#~ msgid "Warning: rsh-server is installed --- probably not a good idea"
+#~ msgstr ""
+#~ "Aviso: rsh-server está instalado --- seguramente non sexa unha boa idea"
+
+#~ msgid ""
+#~ "having rsh-server installed undermines the security that you were "
+#~ "probably wanting to obtain by installing ssh.  I'd advise you to remove "
+#~ "that package."
+#~ msgstr ""
+#~ "ao ter rsh-server instalado pérdese a seguridade que probablemente "
+#~ "pretendía obter ao instalar ssh. Recoméndase que se desinstale ese "
+#~ "paquete."
diff --git a/debian/po/it.po b/debian/po/it.po
new file mode 100644
index 000000000..047dd3f34
--- /dev/null
+++ b/debian/po/it.po
@@ -0,0 +1,202 @@
+# Italian (it) translation of debconf templates for openssh
+# Copyright (C) 2006 Software in the Public Interest
+# This file is distributed under the same license as the openssh package.
+# Renato Gini <rgini@openlabs.it>, 2003 - 2005
+# Luca Monducci <luca.mo@tiscali.it>, 2006, 2007.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: openssh 4.7p1 italian debconf templates\n"
+"Report-Msgid-Bugs-To: openssh@packages.debian.org\n"
+"POT-Creation-Date: 2010-01-02 08:55+0000\n"
+"PO-Revision-Date: 2008-05-18 12:08+0200\n"
+"Last-Translator: Luca Monducci <luca.mo@tiscali.it>\n"
+"Language-Team: Italian <debian-l10n-italian@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid "Do you want to risk killing active SSH sessions?"
+msgstr "Si vuole rischiare di terminare le sessioni SSH attive?"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid ""
+"The currently installed version of /etc/init.d/ssh is likely to kill all "
+"running sshd instances. If you are doing this upgrade via an SSH session, "
+"you're likely to be disconnected and leave the upgrade procedure unfinished."
+msgstr ""
+"È probabile che la versione di /etc/init.d/ssh attualmente installata "
+"termini tutte le istanze di sshd attive. Se si sta effettuando questo "
+"aggiornamento tramite una sessione SSH, è possibile che la sessione venga "
+"chiusa e che la procedura di aggiornamento rimanga incompleta."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid ""
+"This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the "
+"start-stop-daemon line in the stop section of the file."
+msgstr ""
+"È possibile evitare ciò aggiungendo manualmente «--pidfile /var/run/sshd.pid» "
+"alla riga start-stop-daemon nella sezione stop del file."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "New host key mandatory"
+msgstr "Necessaria una nuova chiave host"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid ""
+"The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA "
+"algorithm. OpenSSH can not handle this host key file, and the ssh-keygen "
+"utility from the old (non-free) SSH installation does not appear to be "
+"available."
+msgstr ""
+"L'attuale chiave host, contenuta in /etc/ssh/ssh_host_key, è cifrata con "
+"l'algoritmo IDEA. OpenSSH non è in grado di gestire questa chiave host e non "
+"è disponibile il programma (non-free) ssh-keygen dalla precedente "
+"installazione di SSH."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "You need to manually generate a new host key."
+msgstr "È necessario generare manualmente una nuova chiave host."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid "Disable challenge-response authentication?"
+msgstr "Disabilitare l'autenticazione interattiva?"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"Password authentication appears to be disabled in the current OpenSSH server "
+"configuration. In order to prevent users from logging in using passwords "
+"(perhaps using only public key authentication instead) with recent versions "
+"of OpenSSH, you must disable challenge-response authentication, or else "
+"ensure that your PAM configuration does not allow Unix password file "
+"authentication."
+msgstr ""
+"Nell'attuale configurazione del server OpenSSH è disabilitata "
+"l'autenticazione tramite password. Con le versioni più recenti di OpenSSH "
+"per impedire l'accesso degli utenti al sistema con la password (per esempio "
+"l'accesso deve essere possibile solo tramite chiavi pubbliche) si deve "
+"disabilitare l'autenticazione interattiva oppure si deve verificare che PAM "
+"sia configurato in modo da non consentire l'autenticazione tramite il file "
+"delle password Unix."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"If you disable challenge-response authentication, then users will not be "
+"able to log in using passwords. If you leave it enabled (the default "
+"answer), then the 'PasswordAuthentication no' option will have no useful "
+"effect unless you also adjust your PAM configuration in /etc/pam.d/ssh."
+msgstr ""
+"Se l'autenticazione interattiva è disabilitata gli utenti non possono "
+"effettuare l'accesso al sistema con la password. Invece se, come previsto "
+"dalla configurazione predefinita, è abilitata allora l'opzione "
+"«PasswordAuthentication no» non ha effetto fino a quando non si interviene "
+"anche sulla configurazione di PAM in /etc/pam.d/ssh."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "Vulnerable host keys will be regenerated"
+msgstr "Le chiavi host vulnerabili devono essere rigenerate"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Some of the OpenSSH server host keys on this system were generated with a "
+"version of OpenSSL that had a broken random number generator. As a result, "
+"these host keys are from a well-known set, are subject to brute-force "
+"attacks, and must be regenerated."
+msgstr ""
+"Alcune delle chiavi host OpenSSH per server presenti su questo sistema sono "
+"state create con una versione di OpenSSL afflitta da un problema al "
+"generatore di numeri casuali. Di conseguenza queste chiavi host appartengono "
+"a un insieme noto, quindi sono vulnerabili ad attacchi di tipo forza bruta e "
+"devono essere rigenerate."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Users of this system should be informed of this change, as they will be "
+"prompted about the host key change the next time they log in. Use 'ssh-"
+"keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of "
+"the new host keys."
+msgstr ""
+"Gli utenti del sistema dovrebbero essere informati di questo cambiamento "
+"poiché al prossimo accesso al sistema verrà loro mostrato un avvertimento "
+"relativo al cambiamento della chiave host. Dopo l'aggiornamento usare \"ssh-"
+"keygen -l -f FILE_CHIAVE_HOST\" per stampare i fingerprint delle nuove "
+"chiavi host."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "The affected host keys are:"
+msgstr "Le chiavi host vulnerabili sono:"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"User keys may also be affected by this problem. The 'ssh-vulnkey' command "
+"may be used as a partial test for this. See /usr/share/doc/openssh-server/"
+"README.compromised-keys.gz for more details."
+msgstr ""
+"Anche le chiavi utente potrebbero essere afflitte dallo stesso problema. È "
+"possibile usare il comando \"ssh-vulnkey\" per fare un test parziale sulla "
+"loro vulnerabilità. Si veda /usr/share/doc/openssh-server/README.compromised-"
+"keys.gz per ulteriori informazioni."
+
+#~ msgid "Generate a new configuration file for OpenSSH?"
+#~ msgstr "Generare un nuovo file di configurazione per OpenSSH?"
+
+#~ msgid ""
+#~ "This version of OpenSSH has a considerably changed configuration file "
+#~ "from the version shipped in Debian 'Potato', which you appear to be "
+#~ "upgrading from. This package can now generate a new configuration file (/"
+#~ "etc/ssh/sshd.config), which will work with the new server version, but "
+#~ "will not contain any customizations you made with the old version."
+#~ msgstr ""
+#~ "Questa versione di OpenSSH contiene un file di configurazione decisamente "
+#~ "diverso da quello distribuito in Debian \"Potato\", che sembra essere "
+#~ "quello che si sta aggiornando. Questo pacchetto è in grado di generare "
+#~ "automaticamente un nuovo file di configurazione (/etc/ssh/sshd.config) "
+#~ "adatto alla nuova versione del server, ma che non contiene nessuna delle "
+#~ "personalizzazioni apportate nella precedente versione."
+
+#~ msgid ""
+#~ "Please note that this new configuration file will set the value of "
+#~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password "
+#~ "can ssh directly in as root). Please read the README.Debian file for more "
+#~ "details about this design choice."
+#~ msgstr ""
+#~ "Notare che nel nuovo file di configurazione il valore di «PermitRootLogin» "
+#~ "è impostato a «yes» (quindi chiunque conosca la password di root può "
+#~ "collegarsi tramite ssh direttamente come root). Per ulteriori dettagli su "
+#~ "questa scelta si veda il file README.Debian."
+
+#~ msgid ""
+#~ "It is strongly recommended that you choose to generate a new "
+#~ "configuration file now."
+#~ msgstr ""
+#~ "È vivamente raccomandata la scelta di far generare automaticamente un "
+#~ "nuovo file di configurazione."
diff --git a/debian/po/ja.po b/debian/po/ja.po
new file mode 100644
index 000000000..b011ddc0a
--- /dev/null
+++ b/debian/po/ja.po
@@ -0,0 +1,197 @@
+#
+#    Translators, if you are not familiar with the PO format, gettext
+#    documentation is worth reading, especially sections dedicated to
+#    this format, e.g. by running:
+#         info -n '(gettext)PO Files'
+#         info -n '(gettext)Header Entry'
+#
+#    Some information specific to po-debconf are available at
+#            /usr/share/doc/po-debconf/README-trans
+#         or http://www.debian.org/intl/l10n/po-debconf/README-trans
+#
+#    Developers do not need to manually edit POT or PO files.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: openssh\n"
+"Report-Msgid-Bugs-To: openssh@packages.debian.org\n"
+"POT-Creation-Date: 2010-01-02 08:55+0000\n"
+"PO-Revision-Date: 2008-05-17 21:28+0900\n"
+"Last-Translator: Kenshi Muto <kmuto@debian.org>\n"
+"Language-Team: Japanese <debian-japanese@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid "Do you want to risk killing active SSH sessions?"
+msgstr "接続中� SSH セッション�切れる�も�れ��ん�よ����?"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid ""
+"The currently installed version of /etc/init.d/ssh is likely to kill all "
+"running sshd instances. If you are doing this upgrade via an SSH session, "
+"you're likely to be disconnected and leave the upgrade procedure unfinished."
+msgstr ""
+"�在インストール�れ��ージョン� /etc/init.d/ssh ����ら�実行中� sshd "
+"インスタンスを���殺���。��アップグレードを SSH セッション経由�行��"
+"�る場������切断�れ�アップグレード処���完全�����る��ょ�。"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid ""
+"This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the "
+"start-stop-daemon line in the stop section of the file."
+msgstr ""
+"��状�を修正�る���ファイル� stop セクション� start-stop-daemon �行�"
+"「--pidfile /var/run/sshd.pid��手動�追加���。"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "New host key mandatory"
+msgstr "新��ホストキー�必���"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid ""
+"The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA "
+"algorithm. OpenSSH can not handle this host key file, and the ssh-keygen "
+"utility from the old (non-free) SSH installation does not appear to be "
+"available."
+msgstr ""
+"/etc/ssh/ssh_host_key ��る�在�ホストキー� IDEA �暗�化�れ����。"
+"OpenSSH ���ホストキーファイルを扱����� (フリー����) SSH � ssh-"
+"keygen ユーティリティ�も�利用����ん。"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "You need to manually generate a new host key."
+msgstr "新��ホストキーを手動�生��る必���り��。"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid "Disable challenge-response authentication?"
+msgstr "�ャレンジ-レス�ンス�証を無効�����?"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"Password authentication appears to be disabled in the current OpenSSH server "
+"configuration. In order to prevent users from logging in using passwords "
+"(perhaps using only public key authentication instead) with recent versions "
+"of OpenSSH, you must disable challenge-response authentication, or else "
+"ensure that your PAM configuration does not allow Unix password file "
+"authentication."
+msgstr ""
+"�在� OpenSSH サー��設定��パスワード�証�無効�����るよ���。"
+"OpenSSH �最近��ージョン�パスワードを使��ユーザ�ログイン�る�を防� "
+"(多分公開��証��を代�り�使�) ������ャレンジ-レス�ンス�証を無効"
+"��る��PAM 設定� Unix パスワードファイル�証を絶対�許����よ���る"
+"必���り��。"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"If you disable challenge-response authentication, then users will not be "
+"able to log in using passwords. If you leave it enabled (the default "
+"answer), then the 'PasswordAuthentication no' option will have no useful "
+"effect unless you also adjust your PAM configuration in /etc/pam.d/ssh."
+msgstr ""
+"�ャレンジ-レス�ンス�証を無効��る場��ユーザ�パスワードを使��ログイン"
+"�����り��。有効 (デフォルト) ����������/etc/pam.d/ssh ��"
+"る PAM 設定を調節����り�'PasswordAuthentication no' オプション�効果を�"
+"����り��。"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "Vulnerable host keys will be regenerated"
+msgstr "脆弱�ホストキー��生��れ��"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Some of the OpenSSH server host keys on this system were generated with a "
+"version of OpenSSL that had a broken random number generator. As a result, "
+"these host keys are from a well-known set, are subject to brute-force "
+"attacks, and must be regenerated."
+msgstr ""
+"��システム� OpenSSH サー��ホストキー�������壊れ�乱数生�器を�"
+"� OpenSSL �ージョン�生��れ�����。�果�����れら�ホストキー�既"
+"知�組�����ら�り�ブルートフォース攻撃を��や��も������る�"
+"���生��る必���り��。"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Users of this system should be informed of this change, as they will be "
+"prompted about the host key change the next time they log in. Use 'ssh-"
+"keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of "
+"the new host keys."
+msgstr ""
+"次回�ログイン時�ホストキー�変更�示�れる������システム�ユーザ��"
+"��変更�通知を���る����り��。更新後�新��ホストキー�指紋を表示"
+"�る���'ssh-keygen -l -f HOST_KEY_FILE' を使���。"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "The affected host keys are:"
+msgstr "影響を��るホストキー�次���り��:"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"User keys may also be affected by this problem. The 'ssh-vulnkey' command "
+"may be used as a partial test for this. See /usr/share/doc/openssh-server/"
+"README.compromised-keys.gz for more details."
+msgstr ""
+"ユーザキーも���題�影響を����る�れ��り��。��部分的�テスト��"
+"��'ssh-vulnkey' コマンドを利用����。詳細����� /usr/share/doc/"
+"openssh-server/README.compromised-keys.gz を�照������。"
+
+#~ msgid "Generate a new configuration file for OpenSSH?"
+#~ msgstr "OpenSSH �新��設定ファイルを作り���?"
+
+#~ msgid ""
+#~ "This version of OpenSSH has a considerably changed configuration file "
+#~ "from the version shipped in Debian 'Potato', which you appear to be "
+#~ "upgrading from. This package can now generate a new configuration file (/"
+#~ "etc/ssh/sshd.config), which will work with the new server version, but "
+#~ "will not contain any customizations you made with the old version."
+#~ msgstr ""
+#~ "OpenSSH ����ージョン��Debian 'Potato' ��供�����ージョン (�"
+#~ "�����ージョン�ら��ージョンアップを試���る���) �ら�設定ファ"
+#~ "イル�大幅�変化�����。��パッケージ��新���ージョン�サー��使"
+#~ "������る新��設定ファイル (/etc/ssh/sshd.config) を今生��る���"
+#~ "���������ージョン�設定ファイル�加����カスタマイズ���れも"
+#~ "��れ��ん。"
+
+#~ msgid ""
+#~ "Please note that this new configuration file will set the value of "
+#~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password "
+#~ "can ssh directly in as root). Please read the README.Debian file for more "
+#~ "details about this design choice."
+#~ msgstr ""
+#~ "��新��設定ファイル��「PermitRootLogin�を「yes��設定��� (��"
+#~ "り�root �パスワードを知���る人�ら誰�も直接ログイン����)。��よ"
+#~ "��設計を�ん��る�由�詳細������README.Debian を読ん�����。"
+
+#~ msgid ""
+#~ "It is strongly recommended that you choose to generate a new "
+#~ "configuration file now."
+#~ msgstr "新��設定ファイルを今生��る��を強��勧����。"
diff --git a/debian/po/ko.po b/debian/po/ko.po
new file mode 100644
index 000000000..7cbf4c13c
--- /dev/null
+++ b/debian/po/ko.po
@@ -0,0 +1,189 @@
+# Korean translations for openssh package
+# openssh 패키지� 대한 한국어 번역문.
+# Copyright (C) 2007 THE openssh'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the openssh package.
+# Sunjae Park <darehanl@gmail.com>, 2007.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: openssh\n"
+"Report-Msgid-Bugs-To: openssh@packages.debian.org\n"
+"POT-Creation-Date: 2010-01-02 08:55+0000\n"
+"PO-Revision-Date: 2008-06-06 16:06-0400\n"
+"Last-Translator: Sunjae Park <darehanl@gmail.com>\n"
+"Language-Team: Korean <debian-l10n-korean@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"Plural-Forms: nplurals=1; plural=0;\n"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid "Do you want to risk killing active SSH sessions?"
+msgstr "현재 사용중� SSH 세션� 죽여� 괜찮습니까?"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid ""
+"The currently installed version of /etc/init.d/ssh is likely to kill all "
+"running sshd instances. If you are doing this upgrade via an SSH session, "
+"you're likely to be disconnected and leave the upgrade procedure unfinished."
+msgstr ""
+"현재 설치� /etc/init.d/ssh 버전� 사용중� sshd �스턴스를 모� 죽� 것입니"
+"다. 만약 SSH 세션� 통해 � 업그레�드를 하고 있다면 �중� 연결� 해제�어 "
+"업그레�드 작업� �중� 중단� 수 있습니다."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid ""
+"This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the "
+"start-stop-daemon line in the stop section of the file."
+msgstr ""
+"파�� stop 구역� 있는 start-stop-daemon� \"--pidfile /var/run/sshd.pid"
+"\"� 추가하시면 � 문제를 해결할 수 있습니다."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "New host key mandatory"
+msgstr "호스트키 새로 만들어야 함"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid ""
+"The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA "
+"algorithm. OpenSSH can not handle this host key file, and the ssh-keygen "
+"utility from the old (non-free) SSH installation does not appear to be "
+"available."
+msgstr ""
+"/etc/ssh/ssh_host_key� 있는 현재 호스트키늘 IDEA 알고리즘으로 암호화�어있습"
+"니다. OpenSSH는 � 호스트키 파�� 다루지 못하며, �전� 설치�었� (비�유) "
+"SSH 프로그램� ssh-keygen �용프로그램� 없는 것 같습니다."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "You need to manually generate a new host key."
+msgstr "호스트키를 �접 새로 �성하셔야 합니다."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid "Disable challenge-response authentication?"
+msgstr "제기-�답 ��방�� 해제하�� 할까요?"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"Password authentication appears to be disabled in the current OpenSSH server "
+"configuration. In order to prevent users from logging in using passwords "
+"(perhaps using only public key authentication instead) with recent versions "
+"of OpenSSH, you must disable challenge-response authentication, or else "
+"ensure that your PAM configuration does not allow Unix password file "
+"authentication."
+msgstr ""
+"현재� OpenSSH 서버 설정� 비밀번호 ��방�� 해제�어 있습니다. 최근 버전"
+"� OpenSSH�서 사용�들� (공개키 방�만 허용하기 위해서 등� �유로) 비밀번"
+"호로 로그�하지 못하�� 하시려면 제기-�답 ��방�� 해제하시든지 유닉스 "
+"password 파� ��방�� 사용하지 못하�� PAM 설정� 하셔야 합니다."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"If you disable challenge-response authentication, then users will not be "
+"able to log in using passwords. If you leave it enabled (the default "
+"answer), then the 'PasswordAuthentication no' option will have no useful "
+"effect unless you also adjust your PAM configuration in /etc/pam.d/ssh."
+msgstr ""
+"제기-�답 ��방�� 해제하면 사용�들� 비밀번호를 �용하여 로그�하지 못하"
+"게 �니다. (기본 설정대로) 해제하지 않으시면 /etc/pam.d/ssh� 있는 PAM 설정"
+"� 변경하지 않으실 경우 'PasswordAuthentication no' 옵션� 아무런 �향� 주"
+"지 못합니다."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "Vulnerable host keys will be regenerated"
+msgstr "취약한 호스트키를 다시 �성합니다"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Some of the OpenSSH server host keys on this system were generated with a "
+"version of OpenSSL that had a broken random number generator. As a result, "
+"these host keys are from a well-known set, are subject to brute-force "
+"attacks, and must be regenerated."
+msgstr ""
+"� 시스템� 있는 OpenSSH 서버� 호스트키는 잘못� 난수�성기를 사용한 버전� "
+"OpenSSL를 통해 만들어졌습니다. �러한 호스트키들� 잘 알려진 범위 내� 있게 "
+"�므로 brute-force 공격� 약할 수 있으며, 따�서 다시 만들어야 합니다."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Users of this system should be informed of this change, as they will be "
+"prompted about the host key change the next time they log in. Use 'ssh-"
+"keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of "
+"the new host keys."
+msgstr ""
+"� 시스템� 사용한 사람들� 다�� 로그�할 때 호스트키가 변경�었다는 사실"
+"� �지하게 �기 때문� 사용�들�게 � 사항� 알려주셔야 합니다. 업그레�드 "
+"후 'ssh-keygen -l -f 호스트키 파�명'� 사용하여 새로운 호스트키� 핑거프린트"
+"를 출력받� 수 있습니다."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "The affected host keys are:"
+msgstr "관련� 호스트키� 목��:"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"User keys may also be affected by this problem. The 'ssh-vulnkey' command "
+"may be used as a partial test for this. See /usr/share/doc/openssh-server/"
+"README.compromised-keys.gz for more details."
+msgstr ""
+"사용� 키 역시 � 문제� �향� 받� 수 있습니다. 'ssh-vulnkey' 명령� 사용하"
+"여 부분�으로나마 그렇한지를 검사할 수 있습니다. �세한 정보는 /usr/share/"
+"doc/openssh-server/README.compromised-keys.gz를 참조하십시오."
+
+#~ msgid "Generate a new configuration file for OpenSSH?"
+#~ msgstr "OpenSSH 설정 파�� 새로 만들까요?"
+
+#~ msgid ""
+#~ "This version of OpenSSH has a considerably changed configuration file "
+#~ "from the version shipped in Debian 'Potato', which you appear to be "
+#~ "upgrading from. This package can now generate a new configuration file (/"
+#~ "etc/ssh/sshd.config), which will work with the new server version, but "
+#~ "will not contain any customizations you made with the old version."
+#~ msgstr ""
+#~ "�번 OpenSSH 버전� 지금 사용하고 계시는 듯한 �비안 'Potato'� OpenSSH 버"
+#~ "전과는 �게 다른 설정 파�� 사용합니다. � 꾸러미는 새로 설치�는 서버 버"
+#~ "전� 맞는 설정 파�(/etc/ssh/sshd.config)� 새로 만들 수 있습니다만, �전 "
+#~ "버전�서 변경한 내역� �용�지 않습니다."
+
+#~ msgid ""
+#~ "Please note that this new configuration file will set the value of "
+#~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password "
+#~ "can ssh directly in as root). Please read the README.Debian file for more "
+#~ "details about this design choice."
+#~ msgstr ""
+#~ "참고로 새로 설치�는 설정파�� 'PermitRootLogin'� 값� 'yes'로 설정합니"
+#~ "다(따�서 root 비밀번호를 알고 있는 사람� 누구나 root로 �접 ssh 로그�"
+#~ "할 수 있습니다). �렇게 결정한 �유� 대해서 �세히 알고� 하신다면 "
+#~ "README.Debian 파�� 참조하시기 바�니다."
+
+#~ msgid ""
+#~ "It is strongly recommended that you choose to generate a new "
+#~ "configuration file now."
+#~ msgstr "설정 파�� 지금 새로 만드시길 강력히 권장합니다."
diff --git a/debian/po/nb.po b/debian/po/nb.po
new file mode 100644
index 000000000..415d5faf2
--- /dev/null
+++ b/debian/po/nb.po
@@ -0,0 +1,196 @@
+# translation of nb.po to Norwegian Bokmål
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the PACKAGE package.
+#
+# Bjørn Steensrud <bjornst@powertech.no>, 2007.
+# Bjørn Steensrud <bjornst@skogkatt.homelinux.org>, 2008.
+msgid ""
+msgstr ""
+"Project-Id-Version: nb\n"
+"Report-Msgid-Bugs-To: openssh@packages.debian.org\n"
+"POT-Creation-Date: 2010-01-02 08:55+0000\n"
+"PO-Revision-Date: 2008-05-17 11:04+0200\n"
+"Last-Translator: Bjørn Steensrud <bjornst@skogkatt.homelinux.org>\n"
+"Language-Team: Norwegian Bokmål <i18n-nb@lister.ping.uio.no>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: KBabel 1.11.4\n"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid "Do you want to risk killing active SSH sessions?"
+msgstr "Vil du risikere å avbryte aktive SSH-økter?"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid ""
+"The currently installed version of /etc/init.d/ssh is likely to kill all "
+"running sshd instances. If you are doing this upgrade via an SSH session, "
+"you're likely to be disconnected and leave the upgrade procedure unfinished."
+msgstr ""
+"Den versjonen av /etc/init.d/ssh som nå er installert vil antakelig stoppe "
+"alle sshd-instanser som kjører. Hvis denne oppgraderingen gjøres over en SSH-"
+"økt, så risikerer du å bli frakoblet og oppgraderingen blir ikke fullført."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid ""
+"This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the "
+"start-stop-daemon line in the stop section of the file."
+msgstr ""
+"Dette kan rettes på ved å legge til manuelt «--pidfile /var/run/sshd.pid» til "
+"start-stop-daemon linja i stopp-delen av fila."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "New host key mandatory"
+msgstr "Ny vertsnøkkel obligatorisk"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid ""
+"The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA "
+"algorithm. OpenSSH can not handle this host key file, and the ssh-keygen "
+"utility from the old (non-free) SSH installation does not appear to be "
+"available."
+msgstr ""
+"Den gjeldende vertsnøkkelen, i /etc/ssh/ssh_host_key, er kryptert med IDEA-"
+"algoritmen. OpenSSH kan ikke håndtere denne vertsnøkkelfila, og det ser ikke "
+"ut til at verktøyet ssh-keygen fra den gamle (ikke-frie) SSH-installasjonen "
+"er tilgjengelig."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "You need to manually generate a new host key."
+msgstr "En ny vertsnøkkel må lages manuelt."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid "Disable challenge-response authentication?"
+msgstr "Skal autentisering med utfordring/svar slås av?"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"Password authentication appears to be disabled in the current OpenSSH server "
+"configuration. In order to prevent users from logging in using passwords "
+"(perhaps using only public key authentication instead) with recent versions "
+"of OpenSSH, you must disable challenge-response authentication, or else "
+"ensure that your PAM configuration does not allow Unix password file "
+"authentication."
+msgstr ""
+"Det ser ut til at passord-autentisering er slått av i det gjeldende "
+"tjeneroppsettet for OpenSSH. For å hindre brukere i å logge inn med passord "
+"med nyere versjoner av OpenSSH (kanskje med autentisering med kryptonøkler i "
+"stedet), så må autentisering med utfordring-svar slås av, eller det må "
+"sjekkes at PAM-oppsettet er satt til ikke å tillate autentisering mot Unix "
+"passord-fila."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"If you disable challenge-response authentication, then users will not be "
+"able to log in using passwords. If you leave it enabled (the default "
+"answer), then the 'PasswordAuthentication no' option will have no useful "
+"effect unless you also adjust your PAM configuration in /etc/pam.d/ssh."
+msgstr ""
+"Hvis autentisering med utfordring-svar er slått av, så kan brukere ikke "
+"logge inn med passord. Hvis det står på (som er standard), så har det ingen "
+"virkning å sette «PasswordAuthentication no» med mindre PAM-oppsettet i /etc/"
+"pam.d/ssh også justeres."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "Vulnerable host keys will be regenerated"
+msgstr "Sårbare vertsnøkler vil bli laget på nytt"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Some of the OpenSSH server host keys on this system were generated with a "
+"version of OpenSSL that had a broken random number generator. As a result, "
+"these host keys are from a well-known set, are subject to brute-force "
+"attacks, and must be regenerated."
+msgstr ""
+"Noen av OpenSSHs vertsnøkler på dette systemet ble opprettet med versjon av "
+"OpenSSH som hadde en feil på slumptallsgeneratoren. Derfor tilhører disse "
+"nøklene et velkjent sett nøkler, kan knekkes med «rå kraft»-metoden og må "
+"lages på nytt."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Users of this system should be informed of this change, as they will be "
+"prompted about the host key change the next time they log in. Use 'ssh-"
+"keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of "
+"the new host keys."
+msgstr ""
+"De som bruker dette systemet bør få opplysning om denne endringen, siden de "
+"vkil få spørsmål om vertsnøkkelendringen neste gang de logger inn. Etter "
+"oppgraderingen kan fingeravtrykkene for de nye vertsnøklene skrives ut med "
+"kommandoen «keygen -l -f VERTSNØKKELFIL»."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "The affected host keys are:"
+msgstr "De vertsnøklene dette gjelder er:"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"User keys may also be affected by this problem. The 'ssh-vulnkey' command "
+"may be used as a partial test for this. See /usr/share/doc/openssh-server/"
+"README.compromised-keys.gz for more details."
+msgstr ""
+"Det kan være at brukernøkler også har dette problemet. En delvis test på "
+"dette kan gjøres med kommandoen «ssh-vulnkey». Mer detaljer finnes i /usr/"
+"share/doc/openssh-server/README.compromised-keys.gz."
+
+#~ msgid "Generate a new configuration file for OpenSSH?"
+#~ msgstr "Skal ny oppsettsfil for OpenSSH lages?"
+
+#~ msgid ""
+#~ "This version of OpenSSH has a considerably changed configuration file "
+#~ "from the version shipped in Debian 'Potato', which you appear to be "
+#~ "upgrading from. This package can now generate a new configuration file (/"
+#~ "etc/ssh/sshd.config), which will work with the new server version, but "
+#~ "will not contain any customizations you made with the old version."
+#~ msgstr ""
+#~ "Det ser ut til at du oppgraderer fra Debian «Potato», og denne versjonen "
+#~ "av OpenSSH har ganske store endringer i oppsettsfila. Denne pakka kan nå "
+#~ "lage en ny oppsettsfil (/etc/ssh/sshd.config) som fungerer med den nye "
+#~ "tjenerversjonen, men ikke inneholder noen tilpasninger som kan være gjort "
+#~ "lokalt i den gamle versjonen."
+
+#~ msgid ""
+#~ "Please note that this new configuration file will set the value of "
+#~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password "
+#~ "can ssh directly in as root). Please read the README.Debian file for more "
+#~ "details about this design choice."
+#~ msgstr ""
+#~ "Merk at denne nye oppsettsfila setter verdien av «PermitRootLogin» til "
+#~ "«yes» (slik at alle som kjenner root-passordet kan logge inn direkte med "
+#~ "ssh som root). Les README.Debian-fila for å finne ut mer om dette "
+#~ "oppsettsvalget."
+
+#~ msgid ""
+#~ "It is strongly recommended that you choose to generate a new "
+#~ "configuration file now."
+#~ msgstr ""
+#~ "Det anbefales sterkt at denne pakka får lov til å lage en ny oppsettsfil "
+#~ "nå."
diff --git a/debian/po/nl.po b/debian/po/nl.po
new file mode 100644
index 000000000..b88ca8276
--- /dev/null
+++ b/debian/po/nl.po
@@ -0,0 +1,208 @@
+#
+#    Translators, if you are not familiar with the PO format, gettext
+#    documentation is worth reading, especially sections dedicated to
+#    this format, e.g. by running:
+#         info -n '(gettext)PO Files'
+#         info -n '(gettext)Header Entry'
+#
+#    Some information specific to po-debconf are available at
+#            /usr/share/doc/po-debconf/README-trans
+#         or http://www.debian.org/intl/l10n/po-debconf/README-trans
+#
+#    Developers do not need to manually edit POT or PO files.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: openssh 3.6.1p2-9\n"
+"Report-Msgid-Bugs-To: openssh@packages.debian.org\n"
+"POT-Creation-Date: 2010-01-02 08:55+0000\n"
+"PO-Revision-Date: 2008-05-26 15:19+0200\n"
+"Last-Translator: Bart Cornelis <cobaco@skolelinux.no>\n"
+"Language-Team: debian-l10n-dutch <debian-l10n-dutch@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=utf-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Poedit-Language: Dutch\n"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid "Do you want to risk killing active SSH sessions?"
+msgstr "Wilt u het afsluiten van actieve SSH-sessies riskeren?"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid ""
+"The currently installed version of /etc/init.d/ssh is likely to kill all "
+"running sshd instances. If you are doing this upgrade via an SSH session, "
+"you're likely to be disconnected and leave the upgrade procedure unfinished."
+msgstr ""
+"De /etc/init.d/ssh versie die u geïnstalleerd hebt sluit waarschijnlijk alle "
+"lopende sshd-instanties af. Als u deze opwaardering via een SSH-sessie "
+"uitvoert verliest u waarschijnlijk de verbinding waardoor de "
+"opwaarderingsprocedure onafgemaakt blijft."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid ""
+"This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the "
+"start-stop-daemon line in the stop section of the file."
+msgstr ""
+"U kunt dit handmatig repareren door \"--pidfile /var/run/sshd.pid\" toe te "
+"voegen aan de start-stop-daemon regel in de stop-sectie van het bestand."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "New host key mandatory"
+msgstr "Een nieuwe computersleutel is verplicht"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid ""
+"The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA "
+"algorithm. OpenSSH can not handle this host key file, and the ssh-keygen "
+"utility from the old (non-free) SSH installation does not appear to be "
+"available."
+msgstr ""
+"De huidige computersleutel in /etc/ssh/ssh_host_key is versleuteld met het "
+"IDEA-algoritme. OpenSSH kan dit computer-sleutelbestand niet aan, en het ssh-"
+"keygen programma van de oude (niet-vrije) SSH-installatie is niet "
+"beschikbaar."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "You need to manually generate a new host key."
+msgstr "U dient bijgevolg handmatig een nieuwe computersleutel te genereren."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid "Disable challenge-response authentication?"
+msgstr "Challenge-response-authenticatie deactiveren?"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"Password authentication appears to be disabled in the current OpenSSH server "
+"configuration. In order to prevent users from logging in using passwords "
+"(perhaps using only public key authentication instead) with recent versions "
+"of OpenSSH, you must disable challenge-response authentication, or else "
+"ensure that your PAM configuration does not allow Unix password file "
+"authentication."
+msgstr ""
+"Zo te zien is wachtwoord-authenticatie momenteel gedeactiveerd in uw OpenSSH-"
+"serverconfiguratie. Om te voorkomen dat gebruikers van recente OpenSSH-"
+"versies inloggen met behulp van wachtwoorden (en in plaats daarvan enkel "
+"publieke-sleutel authenticatie te gebruiken), dient challenge-response-"
+"authenticatie gedeactiveerd te worden, of dient u ervoor te zorgen dat uw "
+"PAM-configuratie geen Unix 'password'-bestand-authenticatie toe laat."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"If you disable challenge-response authentication, then users will not be "
+"able to log in using passwords. If you leave it enabled (the default "
+"answer), then the 'PasswordAuthentication no' option will have no useful "
+"effect unless you also adjust your PAM configuration in /etc/pam.d/ssh."
+msgstr ""
+"Wanneer u challenge-response-authenticatie deactiveert kunnen gebruikers "
+"niet meer inloggen met behulp van wachtwoorden. Als u het geactiveerd laat "
+"(de standaarwaarde) zal de 'PasswordAuthentication no' optie geen (nuttig) "
+"effect hebben tenzij u ook de PAM-configuratie aanpast in /etc/pam.d/ssh."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "Vulnerable host keys will be regenerated"
+msgstr "Kwetsbare computersleutels worden opnieuw aangemaakt"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Some of the OpenSSH server host keys on this system were generated with a "
+"version of OpenSSL that had a broken random number generator. As a result, "
+"these host keys are from a well-known set, are subject to brute-force "
+"attacks, and must be regenerated."
+msgstr ""
+"Er zijn op dit systeem OpenSSH-computersleutels aangetroffen die aangemaakt "
+"zijn door een versie van OpenSSL met een onjuiste random-nummer-generator. "
+"Hierdoor zijn deze computersleutels kwetsbaar voor 'brute-force'-aanvallen "
+"en moeten ze opnieuw aangemaakt worden."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Users of this system should be informed of this change, as they will be "
+"prompted about the host key change the next time they log in. Use 'ssh-"
+"keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of "
+"the new host keys."
+msgstr ""
+"Gebruikers van dit systeem krijgen een melding omtrent de "
+"computersleutelverandering op hun scherm de volgende keer dat ze inloggen "
+"via ssh. U dient hun hierover dus te berichten. De vingerafdrukken van de "
+"nieuwe computersleutels kunt na de opwaardering opvragen via het commando "
+"'ssh-keygen -l -f HOST_KEY_FILE'."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "The affected host keys are:"
+msgstr "De getroffen computersleutels zijn:"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"User keys may also be affected by this problem. The 'ssh-vulnkey' command "
+"may be used as a partial test for this. See /usr/share/doc/openssh-server/"
+"README.compromised-keys.gz for more details."
+msgstr ""
+"Sleutels van gebruikers kunnen ook getroffen zijn door dit probleem. Het "
+"'ssh-vulnkey' commando kan gebruikt worden als een gedeeltelijke test, meer "
+"details vindt u in /usr/share/doc/openssh-server/README.compromised-keys."
+"gz . "
+
+#~ msgid "Generate a new configuration file for OpenSSH?"
+#~ msgstr ""
+#~ "Wilt u dat er een nieuw configuratiebestand aangemaakt wordt voor OpenSSH?"
+
+#~ msgid ""
+#~ "This version of OpenSSH has a considerably changed configuration file "
+#~ "from the version shipped in Debian 'Potato', which you appear to be "
+#~ "upgrading from. This package can now generate a new configuration file (/"
+#~ "etc/ssh/sshd.config), which will work with the new server version, but "
+#~ "will not contain any customizations you made with the old version."
+#~ msgstr ""
+#~ "Deze versie van OpenSSH gebruikt een configuratiebestand dat sterk "
+#~ "veranderd is ten opzichte van dat in Debian 'Potato' (waarvan u lijkt op "
+#~ "te waarderen). Het pakket kan nu een nieuw configuratiebestand (/etc/ssh/"
+#~ "sshd.config) genereren dat met de nieuwe versie werkt. Dit gegenereerde "
+#~ "bestand zal echter de door u gemaakte aanpassingen in het oude "
+#~ "configuratiebestand niet overnemen."
+
+#~ msgid ""
+#~ "Please note that this new configuration file will set the value of "
+#~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password "
+#~ "can ssh directly in as root). Please read the README.Debian file for more "
+#~ "details about this design choice."
+#~ msgstr ""
+#~ "Merk op dat dit nieuwe configuratiebestand de waarde van "
+#~ "'PermitRootLogin' op 'yes' zet (wat betekent dat iedereen die het root-"
+#~ "wachtwoord kent via ssh rechtstreeks als root kan aanmelden). Meer "
+#~ "informatie over deze ontwerpkeuze vindt u in het bestand README.Debian."
+
+#~ msgid ""
+#~ "It is strongly recommended that you choose to generate a new "
+#~ "configuration file now."
+#~ msgstr ""
+#~ "Het wordt ten sterkste aangeraden om nu het nieuwe configuratiebestand te "
+#~ "laten genereren."
diff --git a/debian/po/pl.po b/debian/po/pl.po
new file mode 100644
index 000000000..e70ee26ac
--- /dev/null
+++ b/debian/po/pl.po
@@ -0,0 +1,432 @@
+#
+#    Translators, if you are not familiar with the PO format, gettext
+#    documentation is worth reading, especially sections dedicated to
+#    this format, e.g. by running:
+#         info -n '(gettext)PO Files'
+#         info -n '(gettext)Header Entry'
+#
+#    Some information specific to po-debconf are available at
+#            /usr/share/doc/po-debconf/README-trans
+#         or http://www.debian.org/intl/l10n/po-debconf/README-trans
+#
+#    Developers do not need to manually edit POT or PO files.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: PACKAGE VERSION\n"
+"Report-Msgid-Bugs-To: openssh@packages.debian.org\n"
+"POT-Creation-Date: 2010-01-02 08:55+0000\n"
+"PO-Revision-Date: 2004-04-08 18:28+0200\n"
+"Last-Translator: Emil Nowak <emil5@go2.pl>\n"
+"Language-Team: Polish <translation-team-pl@lists.sourceforge.net>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=ISO-8859-2\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+#, fuzzy
+#| msgid "Do you want to continue (and risk killing active ssh sessions)?"
+msgid "Do you want to risk killing active SSH sessions?"
+msgstr "Czy chcesz kontynuowaæ (i ryzykowaæ przerwaniem aktywnych sesji ssh) ?"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+#, fuzzy
+#| msgid ""
+#| "The version of /etc/init.d/ssh that you have installed, is likely to kill "
+#| "all running sshd instances.  If you are doing this upgrade via an ssh "
+#| "session, that would be a Bad Thing(tm)."
+msgid ""
+"The currently installed version of /etc/init.d/ssh is likely to kill all "
+"running sshd instances. If you are doing this upgrade via an SSH session, "
+"you're likely to be disconnected and leave the upgrade procedure unfinished."
+msgstr ""
+"Zainstalowana w³a¶nie wersja /etc/init.d/ssh mo¿e zabiæ wszystkie dzia³aj±ce "
+"obecnie kopie sshd. Je¶li wykonujesz t± aktualizacjê przez ssh, to by³aby "
+"Z³a Rzecz(tm)."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+#, fuzzy
+#| msgid ""
+#| "You can fix this by adding \"--pidfile /var/run/sshd.pid\" to the start-"
+#| "stop-daemon line in the stop section of the file."
+msgid ""
+"This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the "
+"start-stop-daemon line in the stop section of the file."
+msgstr ""
+"Mo¿esz to naprawiæ dodaj±c \"--pidfile /var/run/sshd.pid\" do linijki start-"
+"stop-daemon w sekcji stop tego pliku."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "New host key mandatory"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+#, fuzzy
+msgid ""
+"The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA "
+"algorithm. OpenSSH can not handle this host key file, and the ssh-keygen "
+"utility from the old (non-free) SSH installation does not appear to be "
+"available."
+msgstr ""
+"Istnieje stary /etc/ssh/ssh_host_key, który jest zaszyfrowany przez IDEA. "
+"OpenSSH nie umie korzystaæ z tak zaszyfrowanego klucza, a nie mo¿e znale¼æ "
+"polecenia ssh-keygen ze starego SSH (non-free)."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+#, fuzzy
+#| msgid "You will need to generate a new host key."
+msgid "You need to manually generate a new host key."
+msgstr "Bêdziesz musia³ wygenerowaæ nowy klucz hosta."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid "Disable challenge-response authentication?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"Password authentication appears to be disabled in the current OpenSSH server "
+"configuration. In order to prevent users from logging in using passwords "
+"(perhaps using only public key authentication instead) with recent versions "
+"of OpenSSH, you must disable challenge-response authentication, or else "
+"ensure that your PAM configuration does not allow Unix password file "
+"authentication."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"If you disable challenge-response authentication, then users will not be "
+"able to log in using passwords. If you leave it enabled (the default "
+"answer), then the 'PasswordAuthentication no' option will have no useful "
+"effect unless you also adjust your PAM configuration in /etc/pam.d/ssh."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "Vulnerable host keys will be regenerated"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Some of the OpenSSH server host keys on this system were generated with a "
+"version of OpenSSL that had a broken random number generator. As a result, "
+"these host keys are from a well-known set, are subject to brute-force "
+"attacks, and must be regenerated."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Users of this system should be informed of this change, as they will be "
+"prompted about the host key change the next time they log in. Use 'ssh-"
+"keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of "
+"the new host keys."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "The affected host keys are:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"User keys may also be affected by this problem. The 'ssh-vulnkey' command "
+"may be used as a partial test for this. See /usr/share/doc/openssh-server/"
+"README.compromised-keys.gz for more details."
+msgstr ""
+
+#, fuzzy
+#~ msgid "Generate a new configuration file for OpenSSH?"
+#~ msgstr "Wygeneruj nowy plik konfiguracyjny"
+
+#, fuzzy
+#~ msgid ""
+#~ "This version of OpenSSH has a considerably changed configuration file "
+#~ "from the version shipped in Debian 'Potato', which you appear to be "
+#~ "upgrading from. This package can now generate a new configuration file (/"
+#~ "etc/ssh/sshd.config), which will work with the new server version, but "
+#~ "will not contain any customizations you made with the old version."
+#~ msgstr ""
+#~ "W tej wersji OpenSSH zmieni³ siê plik konfiguracyjny w stosunku do wersji "
+#~ "dostarczanej z Debianem 'Potato', któr± zdajesz siê aktualizowaæ. Mogê "
+#~ "teraz wygenerowaæ nowy plik konfiguracyjny (/etc/ssh/sshd.config), który "
+#~ "bêdzie dzia³a³ z now± wersj± serwera, ale nie bêdzie zawiera³ ¿adnych "
+#~ "dokonanych przez ciebie w starej wersji zmian."
+
+#, fuzzy
+#~| msgid ""
+#~| "Please note that this new configuration file will set the value of "
+#~| "'PermitRootLogin' to yes (meaning that anyone knowing the root password "
+#~| "can ssh directly in as root). It is the opinion of the maintainer that "
+#~| "this is the correct default (see README.Debian for more details), but "
+#~| "you can always edit sshd_config and set it to no if you wish."
+#~ msgid ""
+#~ "Please note that this new configuration file will set the value of "
+#~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password "
+#~ "can ssh directly in as root). Please read the README.Debian file for more "
+#~ "details about this design choice."
+#~ msgstr ""
+#~ "Zauwa¿ proszê, ¿e nowy plik konfiguracyjny bêdzie ustawia³ warto¶æ opcji "
+#~ "'PermitRootLogin' na 'tak' (co oznacza, ¿e ka¿dy kto zna has³o root'a "
+#~ "mo¿e zdalnie zalogowaæ siê przez ssh jako root). W opinii opiekuna "
+#~ "pakietu to jest poprawna warto¶æ domy¶lna (szczegó³y w README.Debian), "
+#~ "ale mo¿esz sobie wyedytowaæ sshd_config i ustawiæ tê opcjê na 'nie' je¶li "
+#~ "siê z t± opini± nie zgadzasz."
+
+#, fuzzy
+#~ msgid ""
+#~ "It is strongly recommended that you choose to generate a new "
+#~ "configuration file now."
+#~ msgstr ""
+#~ "Jest bardzo wskazane aby¶ pozwoli³ mi wygenerowaæ nowy plik "
+#~ "konfiguracyjny."
+
+#~ msgid "Warning: you must create a new host key"
+#~ msgstr "Uwaga: musisz utworzyæ nowy klucz hosta"
+
+#~ msgid "Warning: telnetd is installed --- probably not a good idea"
+#~ msgstr ""
+#~ "Uwaga: telnetd jest zainstalowany --- prawdopodobnie nienajlepszy pomys³"
+
+#~ msgid ""
+#~ "I'd advise you to either remove the telnetd package (if you don't "
+#~ "actually need to offer telnet access) or install telnetd-ssl so that "
+#~ "there is at least some chance that telnet sessions will not be sending "
+#~ "unencrypted login/password and session information over the network."
+#~ msgstr ""
+#~ "Radzi³bym albo usun±æ pakiet telnetd (je¶li nie potrzebujesz koniecznie "
+#~ "udostêpniaæ telnet'a) albo zainstalowaæ telnetd-ssl aby by³a choæ "
+#~ "szansza, ¿e sesje telnet nie bêd± przesy³aæ niezaszyfrowanego loginu/"
+#~ "has³a oraz danych sesji przez sieæ."
+
+#~ msgid "Warning: rsh-server is installed --- probably not a good idea"
+#~ msgstr ""
+#~ "Uwaga: serwer rsh jest zainstalowany --- prawdopodobnie nienajlepszy "
+#~ "pomys³"
+
+#~ msgid ""
+#~ "having rsh-server installed undermines the security that you were "
+#~ "probably wanting to obtain by installing ssh.  I'd advise you to remove "
+#~ "that package."
+#~ msgstr ""
+#~ "Posiadanie zainstalowanego serwera rsh podminowuje zabezpieczenia, które "
+#~ "prawdopodobnie starasz siê uzyskaæ instaluj±c ssh. Radzi³bym usun±æ ten "
+#~ "pakiet."
+
+#~ msgid "Do you want ssh-keysign to be installed SUID root?"
+#~ msgstr "Czy chcesz aby ssh-keysign by³ zainstalowany jako SUID root?"
+
+#~ msgid ""
+#~ "You have the option of installing the ssh-keysign helper with the SUID "
+#~ "bit set."
+#~ msgstr ""
+#~ "Masz mo¿liwo¶æ zainstalowania pomocniczego programu ssh-keysign z "
+#~ "w³±czonym bitem SETUID."
+
+#~ msgid ""
+#~ "If you make ssh-keysign SUID, you will be able to use SSH's Protocol 2 "
+#~ "host-based authentication."
+#~ msgstr ""
+#~ "Je¶li uczynisz ssh-keysign SUIDowym, bêdziesz móg³ u¿ywaæ opartej na "
+#~ "hostach autoryzacji drugiej wersji protoko³u SSH."
+
+#~ msgid ""
+#~ "If in doubt, I suggest you install it with SUID.  If it causes problems "
+#~ "you can change your mind later by running:   dpkg-reconfigure ssh"
+#~ msgstr ""
+#~ "Je¶li masz w±tpliwo¶ci, radzê zainstalowaæ go z SUIDem. Je¶li to sprawia "
+#~ "problemy, mo¿esz zmieniæ swoje zdanie uruchamiaj±c pó¼niej polecenie: "
+#~ "dpkg-reconfigure ssh"
+
+#~ msgid "Allow SSH protocol 2 only"
+#~ msgstr "Zezwalaj wy³±cznie na wersjê 2 protoko³u SSH"
+
+#~ msgid ""
+#~ "This version of OpenSSH supports version 2 of the ssh protocol, which is "
+#~ "much more secure.  Disabling ssh 1 is encouraged, however this will slow "
+#~ "things down on low end machines and might prevent older clients from "
+#~ "connecting (the ssh client shipped with \"potato\" is affected)."
+#~ msgstr ""
+#~ "Ta wersja OpenSSH wspiera drug± wersjê protoko³u ssh, która jest znacznie "
+#~ "bardziej bezpieczna. Wy³±czenie ssh 1 jest zalecane, choæ spowalnia to "
+#~ "dzia³anie na starych maszynach i mo¿e uniemo¿liwiæ po³±czenie starszym "
+#~ "wersjom klientów (dotyczy to np. klienta ssh do³±czanego do \"potato\")."
+
+#~ msgid ""
+#~ "Also please note that keys used for protocol 1 are different so you will "
+#~ "not be able to use them if you only allow protocol 2 connections."
+#~ msgstr ""
+#~ "Ponadto, zauwa¿ proszê, ¿e klucze u¿ywane przez protokó³ 1 s± inne, wiêc "
+#~ "nie bêdziesz móg³ ich u¿ywaæ je¶li zezwolisz na korzystanie wy³±cznie z "
+#~ "wersji 2 protoko³u."
+
+#~ msgid ""
+#~ "If you later change your mind about this setting, README.Debian has "
+#~ "instructions on what to do to your sshd_config file."
+#~ msgstr ""
+#~ "Je¶li pó¼niej zmienisz zdanie co do tego ustawienia, to instrukcje co "
+#~ "zmieniæ w sshd_config znajduj± siê w README.Debian."
+
+#~ msgid "NOTE: Forwarding of X11 and Authorization disabled by default."
+#~ msgstr ""
+#~ "UWAGA: Przekazywanie (forwarding) X11 i Autoryzacji jest domy¶lnie "
+#~ "wy³±czone."
+
+#~ msgid ""
+#~ "For security reasons, the Debian version of ssh has ForwardX11 and "
+#~ "ForwardAgent set to ``off'' by default."
+#~ msgstr ""
+#~ "Ze wzglêdów bezpieczeñstwa Debianowa wersja ssh ma ForwardX11 i "
+#~ "ForwardAgent ustawione  domy¶lnie na 'off'."
+
+#~ msgid ""
+#~ "You can enable it for servers you trust, either in one of the "
+#~ "configuration files, or with the -X command line option."
+#~ msgstr ""
+#~ "Dla zaufanych serwerów mo¿esz w³±czyæ te opcje w pliku konfiguracyjnym "
+#~ "lub przy pomocy opcji -X z linii komend."
+
+#~ msgid "More details can be found in /usr/share/doc/ssh/README.Debian"
+#~ msgstr "Wiêcej szczegó³ów znajdziesz w /usr/share/doc/ssh/README.Debian."
+
+#~ msgid "ssh2 keys merged in configuration files"
+#~ msgstr "klucze ssh2 w³±czone do plików konfiguracyjnych"
+
+#~ msgid ""
+#~ "As of version 3 OpenSSH no longer uses separate files for ssh1 and ssh2 "
+#~ "keys. This means the authorized_keys2 and known_hosts2 files are no "
+#~ "longer needed. They will still be read in order to maintain backwards "
+#~ "compatibility"
+#~ msgstr ""
+#~ "Pocz±wszy od wersji 3 OpenSSH nie u¿ywa ju¿ osobnych plików dla kluczy "
+#~ "ssh1 i ssh2. Oznacza to, ¿e pliki authorized_keys2 i known_hosts2 nie s± "
+#~ "ju¿ potrzebne. Bêd± one jednak odczytywane aby zachowaæ wsteczn± "
+#~ "kompatybilno¶æ."
+
+#~ msgid "Do you want to run the sshd server?"
+#~ msgstr "Czy chcesz uruchamiaæ serwer sshd ?"
+
+#~ msgid "This package contains both the ssh client, and the sshd server."
+#~ msgstr "Ten pakiet zawiera zarówno klienta ssh, jak i serwer sshd."
+
+#~ msgid ""
+#~ "Normally the sshd Secure Shell Server will be run to allow remote logins "
+#~ "via ssh."
+#~ msgstr ""
+#~ "Normalnie serwer sshd (Secure Shell Server) bêdzie uruchomiony aby "
+#~ "umo¿liwiæ zdalny dostêp przez ssh."
+
+#~ msgid ""
+#~ "If you are only interested in using the ssh client for outbound "
+#~ "connections on this machine, and don't want to log into it at all using "
+#~ "ssh, then you can disable sshd here."
+#~ msgstr ""
+#~ "Je¶li jeste¶ zainteresowany u¿ywaniem wy³±cznie klienta ssh dla po³±czeñ "
+#~ "wychodz±cych z tej maszyny, i nie chcesz siê na ni± logowaæ przy pomocy "
+#~ "ssh, to mo¿esz teraz wy³±czyæ serwer sshd."
+
+#~ msgid "Environment options on keys have been deprecated"
+#~ msgstr "Odradzamy stosowanie ustawieñ ¶rodowiskowych dla kluczy."
+
+#~ msgid ""
+#~ "This version of OpenSSH disables the environment option for public keys "
+#~ "by default, in order to avoid certain attacks (for example, LD_PRELOAD). "
+#~ "If you are using this option in an authorized_keys file, beware that the "
+#~ "keys in question will no longer work until the option is removed."
+#~ msgstr ""
+#~ "Ta wersja OpenSSH ma wy³±czon± opcjê wykorzystywania ustawieñ "
+#~ "¶rodowiskowych dla kluczy publicznych. Mo¿na dziêki temu unikn±æ pewnych "
+#~ "ataków (jak np.: LD_PRELOAD). Je¿eli u¿ywasz tej opcji w pliku "
+#~ "authorized_keys, to zawarte w nim klucze nie bêd± dzia³aæ dopóki ta opcja "
+#~ "nie zostanie usuniêta."
+
+#~ msgid ""
+#~ "To re-enable this option, set \"PermitUserEnvironment yes\" in /etc/ssh/"
+#~ "sshd_config after the upgrade is complete, taking note of the warning in "
+#~ "the sshd_config(5) manual page."
+#~ msgstr ""
+#~ "Aby ponownie w³±czyæ tê opcjê, nale¿y dodaæ wpis \"PermitUserEnvironment "
+#~ "yes\" do pliku /etc/ssh/sshd_config po ukoñczeniu aktualizacji. Przy "
+#~ "zmianie konfiguracji nale¿y zapoznaæ siê z informacjami zawartymi na "
+#~ "stronie podrêcznika systemowego sshd_config(5)."
+
+#~ msgid "Privilege separation"
+#~ msgstr "Separacja uprawnieñ"
+
+#~ msgid ""
+#~ "Privilege separation is turned on by default, so if you decide you want "
+#~ "it turned off, you need to add \"UsePrivilegeSeparation no\" to /etc/ssh/"
+#~ "sshd_config."
+#~ msgstr ""
+#~ "Separacja uprawnieñ jest domy¶lnie w³±czona, wiêc je¶li zdecydujesz siê "
+#~ "j± wy³±czyæ, musisz dodaæ \"UsePrivilegeSeparation no\" do pliku /etc/ssh/"
+#~ "sshd_config."
+
+#~ msgid "Enable Privilege separation"
+#~ msgstr "W³±czenie separacji uprawnieñ"
+
+#~ msgid ""
+#~ "This version of OpenSSH contains the new privilege separation option. "
+#~ "This significantly reduces the quantity of code that runs as root, and "
+#~ "therefore reduces the impact of security holes in sshd."
+#~ msgstr ""
+#~ "Ta wersja OpenSSH zawiera now± opcjê separacji uprawnieñ. Znacz±co "
+#~ "zmniejsza ona ilo¶æ kodu, który jest uruchamiany jako root i co za tym "
+#~ "idzie redukuje efekty luk bezpieczeñstwa w sshd."
+
+#~ msgid ""
+#~ "Unfortunately, privilege separation interacts badly with PAM. Any PAM "
+#~ "session modules that need to run as root (pam_mkhomedir, for example) "
+#~ "will fail, and PAM keyboard-interactive authentication won't work."
+#~ msgstr ""
+#~ "Niestety separacja uprawnieñ ¼le reaguje z PAMem. Jakikolwiek modu³ sesji "
+#~ "PAM, który musi byæ uruchamiany jako root (pam_mkhomedir, na przyk³ad) "
+#~ "zawiedzie. Nie bêdzie dzia³aæ równie¿ interaktywna autentykacja z "
+#~ "klawiatury (keyboard-interactive authentication)."
+
+#, fuzzy
+#~ msgid ""
+#~ "Since you've opted to have me generate an sshd_config file for you, you "
+#~ "can choose whether or not to have privilege separation turned on or not. "
+#~ "Unless you know you need to use PAM features that won't work with this "
+#~ "option, you should enable it."
+#~ msgstr ""
+#~ "Zdecydowa³e¶ siê na to abym wygenerowa³ dla ciebie plik sshd_config, i "
+#~ "mo¿esz wybraæ czy chcesz w³±czyæ Separacjê Uprawnieñ, czy te¿ nie. Je¶li "
+#~ "nie u¿ywasz j±dra z serii 2.0 (w którym to przypadku *musisz* "
+#~ "odpowiedzieæ tutaj 'nie' albo sshd w ogóle nie ruszy) i je¶li nie musisz "
+#~ "korzystaæ z mo¿liwo¶ci PAMa, które nie bêd± dzia³a³y z t± opcj±, "
+#~ "powiniene¶ odpowiedzieæ tutaj 'tak'."
+
+#~ msgid ""
+#~ "NB! If you are running a 2.0 series Linux kernel, then privilege "
+#~ "separation will not work at all, and your sshd will fail to start unless "
+#~ "you explicitly turn privilege separation off."
+#~ msgstr ""
+#~ "UWAGA! Je¿eli u¿ywasz j±dra Linux'a z serii 2.0, to separacja uprawnieñ w "
+#~ "ogóle nie bêdzie dzia³aæ i sshd nie wystartuje dopóki w³asnorêcznie nie "
+#~ "wy³±czysz separacji uprawnieñ w /etc/ssh/sshd_config."
diff --git a/debian/po/pt.po b/debian/po/pt.po
new file mode 100644
index 000000000..7fe576feb
--- /dev/null
+++ b/debian/po/pt.po
@@ -0,0 +1,195 @@
+# Portuguese translation of openssh debconf messages.
+# This file is distributed under the same license as the openssh package.
+# Ricardo Silva <ardoric@gmail.com>, 2007.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: openssh 4.7p1-9\n"
+"Report-Msgid-Bugs-To: openssh@packages.debian.org\n"
+"POT-Creation-Date: 2010-01-02 08:55+0000\n"
+"PO-Revision-Date: 2008-05-18 14:48+0100\n"
+"Last-Translator: Ricardo Silva <ardoric@gmail.com>\n"
+"Language-Team: Native Portuguese <traduz@debianpt.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid "Do you want to risk killing active SSH sessions?"
+msgstr "Quer arriscar matar sessões activas de SSH?"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid ""
+"The currently installed version of /etc/init.d/ssh is likely to kill all "
+"running sshd instances. If you are doing this upgrade via an SSH session, "
+"you're likely to be disconnected and leave the upgrade procedure unfinished."
+msgstr ""
+"A versão do /etc/init.d/ssh que tem instalado provavelmente terminará todas "
+"as instâncias de sshd. Se vai actualizar através de uma sessão ssh, é "
+"possível que a sua sessão seja terminada e que deixe o procedimento de "
+"actualização por terminar."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid ""
+"This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the "
+"start-stop-daemon line in the stop section of the file."
+msgstr ""
+"Isto pode ser arranjado adicionando \"--pidfile /var/run/sshd.pid\" à linha "
+"start-stop-daemon na secção stop do ficheiro."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "New host key mandatory"
+msgstr "Uma nova chave de anfitrião é obrigatória"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid ""
+"The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA "
+"algorithm. OpenSSH can not handle this host key file, and the ssh-keygen "
+"utility from the old (non-free) SSH installation does not appear to be "
+"available."
+msgstr ""
+"A chave actual, em /etc/ssh/ssh_host_key, está cifrada com o algoritmo IDEA. "
+"O OpenSSH não consegue usar este ficheiro, e o utilitário ssh-keygen da "
+"antiga (e não livre) instalação do SSH não parece estar disponível."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "You need to manually generate a new host key."
+msgstr "Terá de gerar manualmente uma nova chave para o host."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid "Disable challenge-response authentication?"
+msgstr "Desactivar autenticação por desafio-resposta?"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"Password authentication appears to be disabled in the current OpenSSH server "
+"configuration. In order to prevent users from logging in using passwords "
+"(perhaps using only public key authentication instead) with recent versions "
+"of OpenSSH, you must disable challenge-response authentication, or else "
+"ensure that your PAM configuration does not allow Unix password file "
+"authentication."
+msgstr ""
+"Autenticação por palavra-chave aparenta estar desactivada na sua "
+"configuração actual do servidor OpenSSH. De forma a impedir que os "
+"utilizadores se liguem usando palavras-chave (talvez usando apenas "
+"autenticação por chave pública) com versões recentes do OpenSSH, tem de "
+"desactivar a autenticação por desafio-resposta, ou assegurar-se que a sua "
+"configuração do PAM não permite autenticação pelo ficheiro password de Unix."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"If you disable challenge-response authentication, then users will not be "
+"able to log in using passwords. If you leave it enabled (the default "
+"answer), then the 'PasswordAuthentication no' option will have no useful "
+"effect unless you also adjust your PAM configuration in /etc/pam.d/ssh."
+msgstr ""
+"Se desactivar autenticação por pedido-resposta, os utilizadores não serão "
+"capazes de se ligar usando palavras-chave. Se deixar activado (a resposta "
+"por omissão), então a opção 'PasswordAuthentication no' não terá efeito a "
+"não ser que também ajuste a configuração do PAM em /etc/pam.d/ssh."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "Vulnerable host keys will be regenerated"
+msgstr "Chaves do anfitrião vulneráveis serão regeneradas"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Some of the OpenSSH server host keys on this system were generated with a "
+"version of OpenSSL that had a broken random number generator. As a result, "
+"these host keys are from a well-known set, are subject to brute-force "
+"attacks, and must be regenerated."
+msgstr ""
+"Algumas das chaves do servidor OpenSSH neste sistema foram criadas com uma "
+"versão do OpenSSL que tem um gerador de números aleatórios com problemas. "
+"Como resultado estas chaves, que fazem parte de um conjunto bem conhecido, "
+"estão sujeitas a ataques por força bruta, e têm de ser geradas de novo."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Users of this system should be informed of this change, as they will be "
+"prompted about the host key change the next time they log in. Use 'ssh-"
+"keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of "
+"the new host keys."
+msgstr ""
+"Os utilizadores deste sistema devem ser informados desta mudança, uma vez "
+"que vão ser avisados da mudança de chave da próxima vez que se ligarem. "
+"Utilize o comando 'ssh-keygen -l -f FICHEIRO_DA_CHAVE' depois da "
+"actualização para imprimir as impressões das novas chaves."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "The affected host keys are:"
+msgstr "As chaves afectadas são:"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"User keys may also be affected by this problem. The 'ssh-vulnkey' command "
+"may be used as a partial test for this. See /usr/share/doc/openssh-server/"
+"README.compromised-keys.gz for more details."
+msgstr ""
+"As chaves de utilizador também podem ser afectadas por este problema. O "
+"comando 'ssh-vulnkey' pode ser usado como um teste parcial para este caso. "
+"Veja o ficheiro /usr/share/doc/openssh-server/README.compromised-keys.gz "
+"para mais detalhes."
+
+#~ msgid "Generate a new configuration file for OpenSSH?"
+#~ msgstr "Gerar um ficheiro de configuração novo para o OpenSSH?"
+
+#~ msgid ""
+#~ "This version of OpenSSH has a considerably changed configuration file "
+#~ "from the version shipped in Debian 'Potato', which you appear to be "
+#~ "upgrading from. This package can now generate a new configuration file (/"
+#~ "etc/ssh/sshd.config), which will work with the new server version, but "
+#~ "will not contain any customizations you made with the old version."
+#~ msgstr ""
+#~ "Esta versão do OpenSSH tem um ficheiro de configuração bastante diferente "
+#~ "da versão que vinha com o Debian 'Potato', que parece ser de onde está a "
+#~ "actualizar. Este pacote pode agora gerar um novo ficheiro de configuração "
+#~ "(/etc/ssh/sshd.config), que irá funcionar com a nova versão do servidor, "
+#~ "mas não conterá nenhuma alteração que tenha feito à versão antiga."
+
+#~ msgid ""
+#~ "Please note that this new configuration file will set the value of "
+#~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password "
+#~ "can ssh directly in as root). Please read the README.Debian file for more "
+#~ "details about this design choice."
+#~ msgstr ""
+#~ "Por favor note que este novo ficheiro de configuração terá "
+#~ "'PermitRootLogin' definido para 'yes' (o que significa que qualquer "
+#~ "pessoa que saiba a palavra-chave de root pode ligar-se directamente como "
+#~ "root a partir do ssh). Por favor leia o ficheiro README.Debian para mais "
+#~ "detalhes sobre esta escolha."
+
+#~ msgid ""
+#~ "It is strongly recommended that you choose to generate a new "
+#~ "configuration file now."
+#~ msgstr ""
+#~ "É fortemente recomendado que escolha gerar um novo ficheiro de "
+#~ "configuração agora."
diff --git a/debian/po/pt_BR.po b/debian/po/pt_BR.po
new file mode 100644
index 000000000..fe2227190
--- /dev/null
+++ b/debian/po/pt_BR.po
@@ -0,0 +1,203 @@
+# openssh Brazilian Portuguese translation
+# Copyright (C) 2007, André Luís Lopes
+# This file is distributed under the same license as the openssh package.
+# André Luís Lopes <andrelop@debian.org>, 2007.
+# Eder L. Marques (frolic) <frolic@debian-ce.org>, 2008.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: openssh 1:4.7p1-9\n"
+"Report-Msgid-Bugs-To: openssh@packages.debian.org\n"
+"POT-Creation-Date: 2010-01-02 08:55+0000\n"
+"PO-Revision-Date: 2008-05-27 10:10-0300\n"
+"Last-Translator: Eder L. Marques (frolic) <frolic@debian-ce.org>\n"
+"Language-Team: Brazilian Portuguese <debian-l10n-portuguese@lists.debian."
+"org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"pt_BR utf-8\n"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid "Do you want to risk killing active SSH sessions?"
+msgstr "Você deseja arriscar matar (\"kill\") as sessões SSH ativas?"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid ""
+"The currently installed version of /etc/init.d/ssh is likely to kill all "
+"running sshd instances. If you are doing this upgrade via an SSH session, "
+"you're likely to be disconnected and leave the upgrade procedure unfinished."
+msgstr ""
+"A versão instalada atualmente de /etc/init.d/ssh está prestes a derrubar "
+"todas as instâncias sshd em execução. Se você estiver fazendo esta "
+"atualização através de uma sessão SSH, você provavelmente será desconectado "
+"e deixará este processo de atualização incompleto."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid ""
+"This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the "
+"start-stop-daemon line in the stop section of the file."
+msgstr ""
+"Você pode corrigir isto adicionando \"--pidfile /var/run/sshd.pid\" na linha "
+"start-stop-daemon na seção stop deste arquivo."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "New host key mandatory"
+msgstr "Nova chave de máquina obrigatória"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid ""
+"The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA "
+"algorithm. OpenSSH can not handle this host key file, and the ssh-keygen "
+"utility from the old (non-free) SSH installation does not appear to be "
+"available."
+msgstr ""
+"A chave de máquina atual, em /etc/ssh/ssh_host_key, é criptografada "
+"utilizando o algoritmo IDEA. O OpenSSH não pode gerenciar esse arquivo de "
+"chave de máquina, e o utilitário ssh-keygen da antiga (e não livre) "
+"instalação SSH não parece estar disponível."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "You need to manually generate a new host key."
+msgstr "Você precisa gerar manualmente uma chave de máquina."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid "Disable challenge-response authentication?"
+msgstr "Desabilitar autenticação desafio-resposta (\"challenge-response\")?"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"Password authentication appears to be disabled in the current OpenSSH server "
+"configuration. In order to prevent users from logging in using passwords "
+"(perhaps using only public key authentication instead) with recent versions "
+"of OpenSSH, you must disable challenge-response authentication, or else "
+"ensure that your PAM configuration does not allow Unix password file "
+"authentication."
+msgstr ""
+"A autenticação através de senha parece estar desabilitada em sua "
+"configuração atual do servidor OpenSSH. Para que seja possível evitar que "
+"usuários se autentiquem utilizando senhas (talvez utilizando somente "
+"autenticação através de chaves públicas) em versões recentes do OpenSSH você "
+"deve desabilitar a autenticação desafio-resposta (\"challenge-response\") ou "
+"então se certificar que sua configuração PAM não permita autenticação "
+"através do arquivos de senhas Unix (\"password\")."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"If you disable challenge-response authentication, then users will not be "
+"able to log in using passwords. If you leave it enabled (the default "
+"answer), then the 'PasswordAuthentication no' option will have no useful "
+"effect unless you also adjust your PAM configuration in /etc/pam.d/ssh."
+msgstr ""
+"Caso você desabilite a autenticação desafio-resposta (\"challenge-response"
+"\"), os usuários não poderão se autenticar utilizando suas senhas. Se você "
+"deixá-la habilitada (a resposta padrão), então a opção "
+"'PasswordAuthentication no' não terá efeito útil a menos que você também "
+"ajuste sua configuração PAM em /etc/pam.d/ssh."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "Vulnerable host keys will be regenerated"
+msgstr "Chaves de host vulneráveis serão regeradas"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Some of the OpenSSH server host keys on this system were generated with a "
+"version of OpenSSL that had a broken random number generator. As a result, "
+"these host keys are from a well-known set, are subject to brute-force "
+"attacks, and must be regenerated."
+msgstr ""
+"Algumas das chaves de host do servidor OpenSSH neste sistema foram geradas "
+"com uma versão do OpenSSL que tem um gerador de números aleatórios quebrado. "
+"Como resultado, estas chaves de host são originárias de um conjunto bem "
+"conhecido, ficando sujeitas a ataques de força bruta, e devem ser regeradas."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Users of this system should be informed of this change, as they will be "
+"prompted about the host key change the next time they log in. Use 'ssh-"
+"keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of "
+"the new host keys."
+msgstr ""
+"Usuários deste sistema deverão ser informados desta mudança, pois eles serão "
+"alertados sobre a mudança de chave de host na próxima vez que logarem. Use "
+"'ssh-keygen -l -f ARQUIVO_COM_A_CHAVE_DE_HOST' após a atualização para "
+"exibir as impressões digitais (\"fingerprints\") das novas chaves de host."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "The affected host keys are:"
+msgstr "As chaves de host afetadas são:"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"User keys may also be affected by this problem. The 'ssh-vulnkey' command "
+"may be used as a partial test for this. See /usr/share/doc/openssh-server/"
+"README.compromised-keys.gz for more details."
+msgstr ""
+"Chaves de usuários também podem ser afetadas por este problema. O comando "
+"'ssh-vulnkey' pode ser usado como um teste parcial para isso. Veja /usr/"
+"share/doc/openssh-server/README.compromised-keys.gz para mais detalhes."
+
+#~ msgid "Generate a new configuration file for OpenSSH?"
+#~ msgstr "Gerar um novo arquivo de configuração para o OpenSSH?"
+
+#~ msgid ""
+#~ "This version of OpenSSH has a considerably changed configuration file "
+#~ "from the version shipped in Debian 'Potato', which you appear to be "
+#~ "upgrading from. This package can now generate a new configuration file (/"
+#~ "etc/ssh/sshd.config), which will work with the new server version, but "
+#~ "will not contain any customizations you made with the old version."
+#~ msgstr ""
+#~ "Esta versão do OpenSSH possui um arquivo de configuração "
+#~ "consideravelmente diferente da versão fornecida com o Debian 'Potato', a "
+#~ "versão do Debian a partir da qual você parece estar atualizando. Este "
+#~ "pacote pode agora gerar um novo arquivo de configuração (/etc/ssh/"
+#~ "sshd_config), o qual irá funcionar com a nova versão do servidor sshd mas "
+#~ "não irá conter nenhuma personalização que você possa ter feito na versão "
+#~ "anterior."
+
+#~ msgid ""
+#~ "Please note that this new configuration file will set the value of "
+#~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password "
+#~ "can ssh directly in as root). Please read the README.Debian file for more "
+#~ "details about this design choice."
+#~ msgstr ""
+#~ "Por favor, note que este novo arquivo de configuração irá definir o valor "
+#~ "da opção 'PermitRootLogin' para 'yes' (o que significa que qualquer "
+#~ "pessoa que conheça a senha do root poderá conectar via ssh diretamente "
+#~ "como root). Por favor, leia os arquivos README.Debian para maiores "
+#~ "detalhes sobre essa escolha de projeto."
+
+#~ msgid ""
+#~ "It is strongly recommended that you choose to generate a new "
+#~ "configuration file now."
+#~ msgstr ""
+#~ "É fortemente recomendado que você escolha gerar um novo arquivo de "
+#~ "configuração agora."
diff --git a/debian/po/ro.po b/debian/po/ro.po
new file mode 100644
index 000000000..87480db23
--- /dev/null
+++ b/debian/po/ro.po
@@ -0,0 +1,224 @@
+# Romanian translation of openssh.
+# Copyright (C) 2006 THE openssh'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the openssh package.
+#
+# Stan Ioan-Eugen <stan.ieugen@gmail.com>, 2006.
+# Igor Stirbu <igor.stirbu@gmail.com>, 2007.
+# Cătălin Feștilă <catalinfest@gmail.com>,2008
+msgid ""
+msgstr ""
+"Project-Id-Version: openssh 1.4\n"
+"Report-Msgid-Bugs-To: openssh@packages.debian.org\n"
+"POT-Creation-Date: 2010-01-02 08:55+0000\n"
+"PO-Revision-Date: 2008-05-28 17:54+0200\n"
+"Last-Translator: Cătălin Feștilă <catalinfest@gmail.com>\n"
+"Language-Team: Romanian <debian-l10n-romanian@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: KBabel 1.11.4\n"
+"Plural-Forms: nplurals=3; plural=n==1 ? 0 : (n==0 || (n%100 > 0 && n%100 < "
+"20)) ? 1 : 2;\n"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid "Do you want to risk killing active SSH sessions?"
+msgstr "Doriți să riscați întreruperea sesiunilor ssh active?"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid ""
+"The currently installed version of /etc/init.d/ssh is likely to kill all "
+"running sshd instances. If you are doing this upgrade via an SSH session, "
+"you're likely to be disconnected and leave the upgrade procedure unfinished."
+msgstr ""
+"Este foarte probabil ca această versiune de /etc/init.d/ssh pe care o aveți "
+"instalată să omoare toate instanțele sshd care rulează. Dacă faceți această "
+"actualizare printr-o sesiune ssh, atunci este posibil să fiți deconectați și "
+"actualizarea să rămână neterminată."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid ""
+"This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the "
+"start-stop-daemon line in the stop section of the file."
+msgstr ""
+"Puteți repară manual acest lucru adăugând „--pidfile /var/run/sshd.pid� la "
+"linia start-stop-daemon în secțiunea stop a fișierului."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "New host key mandatory"
+msgstr "O cheie nouă este obligatorie"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid ""
+"The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA "
+"algorithm. OpenSSH can not handle this host key file, and the ssh-keygen "
+"utility from the old (non-free) SSH installation does not appear to be "
+"available."
+msgstr ""
+"Cheia curentă în /etc/ssh/ssh_host_key este criptată cu algoritmul IDEA. "
+"OpenSSH nu suportă acest tip de cheie, iar utilitarul ssh-keygen din "
+"versiunea SSH (non-liberă) anterior instalată nu pare să fie disponibil."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "You need to manually generate a new host key."
+msgstr "Va trebui să generați manual o nouă cheie pentru sistem."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid "Disable challenge-response authentication?"
+msgstr "Dezactivează modul de autentificare provocare-răspuns?"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"Password authentication appears to be disabled in the current OpenSSH server "
+"configuration. In order to prevent users from logging in using passwords "
+"(perhaps using only public key authentication instead) with recent versions "
+"of OpenSSH, you must disable challenge-response authentication, or else "
+"ensure that your PAM configuration does not allow Unix password file "
+"authentication."
+msgstr ""
+"Autentificarea pe bază de parole pare dezactivată în configurația curentă a "
+"serverului OpenSSH. Pentru a împiedica utilizatorii să se autentifice "
+"folosind parole (probabil folosind doar autentificarea cu chei publice) în "
+"versiunile recente OpenSSH trebuie să dezactivați autentificarea tip "
+"provocare-răspuns, sau asigurați-vă că configurația PAM nu permite "
+"autentificarea cu fișierul de parole Unix."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"If you disable challenge-response authentication, then users will not be "
+"able to log in using passwords. If you leave it enabled (the default "
+"answer), then the 'PasswordAuthentication no' option will have no useful "
+"effect unless you also adjust your PAM configuration in /etc/pam.d/ssh."
+msgstr ""
+"Dacă dezactivați autentificarea pe bază de provocare-răspuns, utilizatorii "
+"nu vor mai putea să se autentifice folosind parolele. Dacă nu o dezactivați "
+"(răspunsul implicit), atunci opțiunea 'PasswordAuthentification no' va fi "
+"utilizabilă doar dacă modificați și configurația PAM din /etc/pam.d/ssh."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "Vulnerable host keys will be regenerated"
+msgstr "Cheile vulnerabile vor fi regenerate"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Some of the OpenSSH server host keys on this system were generated with a "
+"version of OpenSSL that had a broken random number generator. As a result, "
+"these host keys are from a well-known set, are subject to brute-force "
+"attacks, and must be regenerated."
+msgstr ""
+"Unele dintre cheile serverului OpenSSH gazdă de pe acest sistem au fost "
+"generate cu o versiune de OpenSSL, care a avut un generator de numere "
+"aleatorii stricat. Ca rezultat, aceste chei gazda sunt un set binecunoscut, "
+"sunt supuse la atacuri brute-force și trebuie să fie regenerate."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Users of this system should be informed of this change, as they will be "
+"prompted about the host key change the next time they log in. Use 'ssh-"
+"keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of "
+"the new host keys."
+msgstr ""
+"Utilizatorii acestui sistem ar trebui să fie informați ce se schimbă, "
+"deoarece se va solicita cheia gazdă ce se schimba data viitoare când se "
+"autentifică. Folosiți 'ssh-keygen -l -f HOST_KEY_FILE' după ce faceți "
+"actualizare pentru a imprima amprentele digitale ale noilor chei gazdă."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "The affected host keys are:"
+msgstr "Cheile gazdă afectate sunt:"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"User keys may also be affected by this problem. The 'ssh-vulnkey' command "
+"may be used as a partial test for this. See /usr/share/doc/openssh-server/"
+"README.compromised-keys.gz for more details."
+msgstr ""
+"Cheile utilizatorului de asemenea, pot fi afectate de această problemă. "
+"Comanda 'ssh-vulnkey' poate fi folosită ca un test parțial pentru acestea. A "
+"se vedea /usr/share/doc/openssh-server/README.compromised-keys.gz pentru mai "
+"multe detalii."
+
+#~ msgid "Generate a new configuration file for OpenSSH?"
+#~ msgstr "Să se genereze un fișier nou de configurare pentru OpenSSH?"
+
+#~ msgid ""
+#~ "This version of OpenSSH has a considerably changed configuration file "
+#~ "from the version shipped in Debian 'Potato', which you appear to be "
+#~ "upgrading from. This package can now generate a new configuration file (/"
+#~ "etc/ssh/sshd.config), which will work with the new server version, but "
+#~ "will not contain any customizations you made with the old version."
+#~ msgstr ""
+#~ "Această versiune de OpenSSH are un fișier de configurare considerabil "
+#~ "modificat față de versiunea care vine cu Debian 'Potato', pe care se pare "
+#~ "că o actualizați. Acest pachet poate genera acum un nou fișier de "
+#~ "configurare (/etc/ssh/sshd.config), care va funcționa cu noua versiune de "
+#~ "server, dar nu va conține nici o personalizare făcută pentru versiunea "
+#~ "anterioară."
+
+#~ msgid ""
+#~ "Please note that this new configuration file will set the value of "
+#~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password "
+#~ "can ssh directly in as root). Please read the README.Debian file for more "
+#~ "details about this design choice."
+#~ msgstr ""
+#~ "A se reține că acest fișier nou de configurare va stabili valoarea "
+#~ "opțiunii 'PermitRootLogin' la „yes� (ceea ce înseamnă că cine știe parola "
+#~ "de root se poate autentifica prin ssh direct ca root). Părerea "
+#~ "responsabilului de pachet este că aceasta trebuie să fie valoarea "
+#~ "implicită (a se vedea fișierul README.Debian pentru detalii "
+#~ "suplimentare), dar, dacă doriți, puteți edita oricând fișierul "
+#~ "sshd_config pentru a stabili valoarea opțiunii la „no�."
+
+#~ msgid ""
+#~ "It is strongly recommended that you choose to generate a new "
+#~ "configuration file now."
+#~ msgstr ""
+#~ "Este indicat să alegeți acum generarea un nou fișier de configurare."
+
+#~ msgid "Warning: you must create a new host key"
+#~ msgstr "Avertizare: trebuie să creați o nouă cheie pentru sistem"
+
+#~ msgid "Warning: telnetd is installed --- probably not a good idea"
+#~ msgstr ""
+#~ "Avertizare: telnetd este instalat --- probabil că nu este o idee bună"
+
+#~ msgid ""
+#~ "I'd advise you to either remove the telnetd package (if you don't "
+#~ "actually need to offer telnet access) or install telnetd-ssl so that "
+#~ "there is at least some chance that telnet sessions will not be sending "
+#~ "unencrypted login/password and session information over the network."
+#~ msgstr ""
+#~ "Un sfat bun este fie să ștergeți pachetul telnetd (dacă întradevăr nu-l "
+#~ "utilizați) fie să instalați telnetd-ssl astfel încât să existe "
+#~ "posibilitatea ca sesiunile telnet să nu trimită informații necriptate de "
+#~ "autentificare/parole prin rețea."
+
+#~ msgid "${HOST_KEYS}"
+#~ msgstr "${HOST_KEYS}"
diff --git a/debian/po/ru.po b/debian/po/ru.po
new file mode 100644
index 000000000..23b8c0348
--- /dev/null
+++ b/debian/po/ru.po
@@ -0,0 +1,209 @@
+# translation of ru.po to Russian
+# translation of openssh to Russian
+#
+#    Translators, if you are not familiar with the PO format, gettext
+#    documentation is worth reading, especially sections dedicated to
+#    this format, e.g. by running:
+#         info -n '(gettext)PO Files'
+#         info -n '(gettext)Header Entry'
+#    Some information specific to po-debconf are available at
+#            /usr/share/doc/po-debconf/README-trans
+#         or http://www.debian.org/intl/l10n/po-debconf/README-trans#
+#    Developers do not need to manually edit POT or PO files.
+#
+# Yuriy Talakan' <yt@drsk.ru>, 2007.
+# Yuri Kozlov <kozlov.y@gmail.com>, 2008.
+msgid ""
+msgstr ""
+"Project-Id-Version: openssh 1:4.7p1-9\n"
+"Report-Msgid-Bugs-To: openssh@packages.debian.org\n"
+"POT-Creation-Date: 2010-01-02 08:55+0000\n"
+"PO-Revision-Date: 2008-05-18 08:55+0400\n"
+"Last-Translator: Yuri Kozlov <kozlov.y@gmail.com>\n"
+"Language-Team: Russian <debian-l10n-russian@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: KBabel 1.11.4\n"
+"Plural-Forms:  nplurals=3; plural=(n%10==1 && n%100!=11 ? 0 : n%10>=2 && n%"
+"10<=4 && (n%100<10 || n%100>=20) ? 1 : 2);\n"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid "Do you want to risk killing active SSH sessions?"
+msgstr "Вы хотите пойти на ри�к потер�ть активные SSH �оединени�?"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid ""
+"The currently installed version of /etc/init.d/ssh is likely to kill all "
+"running sshd instances. If you are doing this upgrade via an SSH session, "
+"you're likely to be disconnected and leave the upgrade procedure unfinished."
+msgstr ""
+"У�тановленна� в на�то�щее врем� вер�и� /etc/init.d/ssh, веро�тно, уничтожит "
+"в�е запущенные �кземпл�ры sshd. Е�ли вы выполн�ете �то обновление через SSH "
+"�оединение, то �корее в�его вы будете отключены и процедура обновлени� "
+"о�танет�� не завершенной."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid ""
+"This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the "
+"start-stop-daemon line in the stop section of the file."
+msgstr ""
+"Это может быть и�правлено вручную добавлением \"--pidfile /var/run/sshd.pid"
+"\" в �троку start-stop-daemon в разделе stop �того файла."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "New host key mandatory"
+msgstr "�еобходим новый ключ хо�та"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid ""
+"The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA "
+"algorithm. OpenSSH can not handle this host key file, and the ssh-keygen "
+"utility from the old (non-free) SSH installation does not appear to be "
+"available."
+msgstr ""
+"Текущий ключ хо�та, /etc/ssh/ssh_host_key, зашифрован алгоритмом IDEA. "
+"OpenSSH не может работать � таким файлом ключа хо�та, а утилита �оздани� ssh-"
+"ключа (ssh-keygen) из прежней (не �вободной) у�тановки SSH, кажет��, "
+"недо�тупна."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "You need to manually generate a new host key."
+msgstr "Вам нужно вручную �оздать новый ключ хо�та."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid "Disable challenge-response authentication?"
+msgstr "Отключить аутентификацию запро�-ответ?"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"Password authentication appears to be disabled in the current OpenSSH server "
+"configuration. In order to prevent users from logging in using passwords "
+"(perhaps using only public key authentication instead) with recent versions "
+"of OpenSSH, you must disable challenge-response authentication, or else "
+"ensure that your PAM configuration does not allow Unix password file "
+"authentication."
+msgstr ""
+"Кажет��, что парольна� аутентификаци� отключена в текущей на�тройке �ервера "
+"OpenSSH. Чтобы запретить пользовател�м вход � и�пользованием паролей "
+"(возможно, и�пользовав вме�то �того только аутентификацию по публичному "
+"ключу) в новых вер�и�х OpenSSH, вы должны отключить аутентификацию запро�-"
+"ответ, либо убедить��, что ваша на�тройка PAM не разрешает аутентификацию по "
+"файлу паролей Unix."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"If you disable challenge-response authentication, then users will not be "
+"able to log in using passwords. If you leave it enabled (the default "
+"answer), then the 'PasswordAuthentication no' option will have no useful "
+"effect unless you also adjust your PAM configuration in /etc/pam.d/ssh."
+msgstr ""
+"Е�ли вы запретите аутентификацию запро�-ответ, пользователи не �могут войти "
+"� и�пользованием паролей. Е�ли вы о�тавите её разрешенной (ответ по "
+"умолчанию), то параметр 'PasswordAuthentication no' не будет иметь �илы до "
+"тех пор, пока вы также не откорректируете на�тройки PAM в /etc/pam.d/ssh."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "Vulnerable host keys will be regenerated"
+msgstr "У�звимые ключи хо�та будут �озданы заново"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Some of the OpenSSH server host keys on this system were generated with a "
+"version of OpenSSL that had a broken random number generator. As a result, "
+"these host keys are from a well-known set, are subject to brute-force "
+"attacks, and must be regenerated."
+msgstr ""
+"�екоторые ключи хо�та �ервера OpenSSH в �той �и�теме были �озданы � помощью "
+"вер�ии OpenSSL, в которой был и�порченный генератор �лучайных чи�ел. В "
+"результате, такие ключи хо�та входили во в�ем изве�тный �пи�ок, что "
+"позвол�ло примен�ть атаку по�ледовательного подбора ключей. Ключи должны "
+"быть �озданы заново."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Users of this system should be informed of this change, as they will be "
+"prompted about the host key change the next time they log in. Use 'ssh-"
+"keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of "
+"the new host keys."
+msgstr ""
+"Пользователи �той �и�темы будут проинформированы об �том изменении, так как "
+"им будет выведено �ообщение о �мене ключа хо�та при �ледующем подключении. "
+"И�пользуйте команду 'ssh-keygen -l -f HOST_KEY_FILE' по�ле обновлени� дл� "
+"ра�печатки отпечатков новых ключей хо�та."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "The affected host keys are:"
+msgstr "Ключи хо�та, которые будут заменены:"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"User keys may also be affected by this problem. The 'ssh-vulnkey' command "
+"may be used as a partial test for this. See /usr/share/doc/openssh-server/"
+"README.compromised-keys.gz for more details."
+msgstr ""
+"Пользователь�кие ключи также имеют данную проблему. Дл� ча�тичной проверки "
+"можно во�пользовать�� командой 'ssh-vulnkey'. В файле /usr/share/doc/openssh-"
+"server/README.compromised-keys.gz дано более подробное опи�ание."
+
+#~ msgid "Generate a new configuration file for OpenSSH?"
+#~ msgstr "Создать новый файл на�троек дл� OpenSSH?"
+
+#~ msgid ""
+#~ "This version of OpenSSH has a considerably changed configuration file "
+#~ "from the version shipped in Debian 'Potato', which you appear to be "
+#~ "upgrading from. This package can now generate a new configuration file (/"
+#~ "etc/ssh/sshd.config), which will work with the new server version, but "
+#~ "will not contain any customizations you made with the old version."
+#~ msgstr ""
+#~ "Файл на�троек �той вер�ии OpenSSH значительно отличает�� от файла вер�ии, "
+#~ "котора� по�тавл�ла�ь � Debian 'Potato', и которую вы, кажет��, "
+#~ "обновл�ете. Этот пакет может �ейча� �оздать новый файл на�троек (/etc/ssh/"
+#~ "sshd.config), который будет работать � �ервером новой вер�ии, но не будет "
+#~ "�одержать на�троек, которые вы �делали в �тарой вер�ии."
+
+#~ msgid ""
+#~ "Please note that this new configuration file will set the value of "
+#~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password "
+#~ "can ssh directly in as root). Please read the README.Debian file for more "
+#~ "details about this design choice."
+#~ msgstr ""
+#~ "Обратите внимание, что �тот новый файл на�троек у�тановит значение "
+#~ "параметра 'PermitRootLogin' в 'yes' (�то означает, что каждый знающий "
+#~ "пароль �уперпользовател� может войти в �и�тему по ssh как "
+#~ "�уперпользователь). Пожалуй�та, прочтите файл README.Debian дл� "
+#~ "разъ��нени� деталей �того выбора."
+
+#~ msgid ""
+#~ "It is strongly recommended that you choose to generate a new "
+#~ "configuration file now."
+#~ msgstr ""
+#~ "�а�то�тельно рекомендует�� выбрать �ейча� �оздание нового файла на�троек."
diff --git a/debian/po/sk.po b/debian/po/sk.po
new file mode 100644
index 000000000..a10e09b6c
--- /dev/null
+++ b/debian/po/sk.po
@@ -0,0 +1,188 @@
+msgid ""
+msgstr ""
+"Project-Id-Version: openssh 1_4.6p1-5\n"
+"Report-Msgid-Bugs-To: openssh@packages.debian.org\n"
+"POT-Creation-Date: 2010-01-02 08:55+0000\n"
+"PO-Revision-Date: 2008-05-29 08:51+0100\n"
+"Last-Translator: Ivan Masár <helix84@centrum.sk>\n"
+"Language-Team: Slovak <sk-i18n@lists.linux.sk>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=utf-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid "Do you want to risk killing active SSH sessions?"
+msgstr "Chcete riskovať zrušenie aktívnych SSH relácií?"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid ""
+"The currently installed version of /etc/init.d/ssh is likely to kill all "
+"running sshd instances. If you are doing this upgrade via an SSH session, "
+"you're likely to be disconnected and leave the upgrade procedure unfinished."
+msgstr ""
+"Momentálne nainštalovaná verzia /etc/init.d/ssh pravdepodobne ukon�í všetky "
+"prebiehajúce inštancie sshd. Ak túto aktualizáciu vykonávate cez reláciu SSH "
+"pravdepodobne budete odpojený a aktualizácia zostane nedokon�ená."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid ""
+"This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the "
+"start-stop-daemon line in the stop section of the file."
+msgstr ""
+"Toto je možné manuálne napraviť tým, že pridáte „--pidfile /var/run/sshd."
+"pid“ do stop sekcie súboru start-stop-daemon."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "New host key mandatory"
+msgstr "Nový kľú� hostiteľa je povinný"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid ""
+"The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA "
+"algorithm. OpenSSH can not handle this host key file, and the ssh-keygen "
+"utility from the old (non-free) SSH installation does not appear to be "
+"available."
+msgstr ""
+"Aktuálny kľú� hostiteľa v /etc/ssh/ssh_host_key je kryptovaný algoritmom "
+"IDEA. OpenSSH nemôže pracovať s týmto súborom s kľú�om hostiteľa a nástroj "
+"ssh-keygen zo starej (neslobodnej) inštalácie SSH nie je dostupný."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "You need to manually generate a new host key."
+msgstr "Musíte ru�ne vygenerovať nový kľú� hostiteľa."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid "Disable challenge-response authentication?"
+msgstr "Vypnúť autentifikáciu výzva-odpove�?"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"Password authentication appears to be disabled in the current OpenSSH server "
+"configuration. In order to prevent users from logging in using passwords "
+"(perhaps using only public key authentication instead) with recent versions "
+"of OpenSSH, you must disable challenge-response authentication, or else "
+"ensure that your PAM configuration does not allow Unix password file "
+"authentication."
+msgstr ""
+"Zdá sa, že autentifikácia pomocou hesla je v aktuálnej konfigurácii OpenSSH "
+"servera vypnutá. Aby ste zabránili používateľom prihlasovať sa pomocou "
+"hesiel (sná� iba použitím autentifikácie svojím verejným kľú�om) pri novších "
+"verziách OpenSSH musíte vypnúť autentifikáciu výzva-odpove� alebo sa inak "
+"uistiť, že vaša konfigurácia PAM neumožňuje autentifikáciu pomocu unixového "
+"súboru s heslami."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"If you disable challenge-response authentication, then users will not be "
+"able to log in using passwords. If you leave it enabled (the default "
+"answer), then the 'PasswordAuthentication no' option will have no useful "
+"effect unless you also adjust your PAM configuration in /etc/pam.d/ssh."
+msgstr ""
+"Ak vypnete autentifikáciu výzva-odpove�, používatelia sa nebudú môcť "
+"prihlasovať pomocou hesiel. Ak ju necháte zapnutú (štandardná odpove�), "
+"potom nebude mať voľba „PasswordAuthentication no“ žiadny ú�inok v prípade, "
+"že tiež vhodne nenastavíte vašu konfiguráciu PAM v /etc/pam.d/ssh."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "Vulnerable host keys will be regenerated"
+msgstr "Namiesto zneužiteľných kľú�ov hostiteľa sa vytvoria nové"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Some of the OpenSSH server host keys on this system were generated with a "
+"version of OpenSSL that had a broken random number generator. As a result, "
+"these host keys are from a well-known set, are subject to brute-force "
+"attacks, and must be regenerated."
+msgstr ""
+"Niektoré z OpenSSH klú�ov hostiteľa na tomto systéme boli vytvorené verziou "
+"OpenSSL, ktorá mala chybný generátor náhodných �ísel. Dôsledkom je, že tieto "
+"klú�e hostiteľa sú z vopred známej množiny, je možné ich prelomiť hrubou "
+"silou a je potrebné vytvoriť namiesto nich nové."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Users of this system should be informed of this change, as they will be "
+"prompted about the host key change the next time they log in. Use 'ssh-"
+"keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of "
+"the new host keys."
+msgstr ""
+"Používateľov tohoto systému by ste mali informovať o tejto zmene, pretože "
+"pri najbližšom prihlásení sa im zobrazí výzva o zmenenom kľú�i hostiteľa. Po "
+"aktualizácii vypíšete odtla�ky nových kľú�ov hostiteľa príkazom „ssh-keygen -"
+"l -f HOST_KEY_FILE“."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "The affected host keys are:"
+msgstr "Postihnuté kľú�e sú:"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"User keys may also be affected by this problem. The 'ssh-vulnkey' command "
+"may be used as a partial test for this. See /usr/share/doc/openssh-server/"
+"README.compromised-keys.gz for more details."
+msgstr ""
+"Používateľské kľú�e tiež mohol ovplyvniť tento problém. Na �iasto�ný test "
+"zraniteľnosti je možné použiť príkaz „ssh-vulnkey“. Podrobnosti nájdete v /"
+"usr/share/doc/openssh-server/README.compromised-keys.gz"
+
+#~ msgid "Generate a new configuration file for OpenSSH?"
+#~ msgstr "Vytvoriť nový konfigura�ný súbor pre OpenSSH?"
+
+#~ msgid ""
+#~ "This version of OpenSSH has a considerably changed configuration file "
+#~ "from the version shipped in Debian 'Potato', which you appear to be "
+#~ "upgrading from. This package can now generate a new configuration file (/"
+#~ "etc/ssh/sshd.config), which will work with the new server version, but "
+#~ "will not contain any customizations you made with the old version."
+#~ msgstr ""
+#~ "Táto verzia OpenSSH má podstatne zmenený konfigura�ný súbor v porovnaní s "
+#~ "versiou, ktorá sa dodávala s Debian „Potato“, z ktorej, zdá sa, "
+#~ "aktualizujete. Tento balík teraz môže vytvoriť nový konfigura�ný súbor (/"
+#~ "etc/ssh/sshd.config), ktorý bude fungovať s novou verziou servera, ale "
+#~ "nebude obsahovať akékoľvek zmeny, ktoré ste urobili v starej verzii."
+
+#~ msgid ""
+#~ "Please note that this new configuration file will set the value of "
+#~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password "
+#~ "can ssh directly in as root). Please read the README.Debian file for more "
+#~ "details about this design choice."
+#~ msgstr ""
+#~ "Prosím, majte na pamäti, že tento nový konfigura�ný súbor nastaví hodnotu "
+#~ "„'PermitRootLogin“ na „áno“ (�o znamená, že každý, kto pozná heslo ú�tu "
+#~ "root, sa bude môcť pomocou ssh prihlásiť priamo ako root). Prosím, "
+#~ "pre�ítajte si podrobnosti o tejto voľbe pri návrhu v súbore README.Debian."
+
+#~ msgid ""
+#~ "It is strongly recommended that you choose to generate a new "
+#~ "configuration file now."
+#~ msgstr ""
+#~ "Silne sa odporú�a, aby ste teraz zvolili vytvorenie nového konfigura�ného "
+#~ "súboru."
diff --git a/debian/po/sv.po b/debian/po/sv.po
new file mode 100644
index 000000000..cd28386d0
--- /dev/null
+++ b/debian/po/sv.po
@@ -0,0 +1,197 @@
+# translation of openssh.po to swedish
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the PACKAGE package.
+#
+# Martin Bagge <martin.bagge@bthstudent.se>, 2008.
+msgid ""
+msgstr ""
+"Project-Id-Version: openssh\n"
+"Report-Msgid-Bugs-To: openssh@packages.debian.org\n"
+"POT-Creation-Date: 2010-01-02 08:55+0000\n"
+"PO-Revision-Date: 2008-05-25 23:32+0200\n"
+"Last-Translator: Martin Bagge <martin.bagge@bthstudent.se>\n"
+"Language-Team: swedish <sv@li.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: KBabel 1.11.4\n"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid "Do you want to risk killing active SSH sessions?"
+msgstr "Vill du riskera att döda aktiva SSH-sessioner?"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid ""
+"The currently installed version of /etc/init.d/ssh is likely to kill all "
+"running sshd instances. If you are doing this upgrade via an SSH session, "
+"you're likely to be disconnected and leave the upgrade procedure unfinished."
+msgstr ""
+"Den för närvarande installerade versionen av /etc/init.d/ssh kommer "
+"antagligen döda alla körande instanser av sshd.  Om du gör denna "
+"uppgradering via en SSH-session kommer du sannolikt att kopplas ner och "
+"uppgraderingsprocessen lämnas ofärdig."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid ""
+"This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the "
+"start-stop-daemon line in the stop section of the file."
+msgstr ""
+"Det här kan rättas till genom att manuellt lägga till \"--pidfile /var/run/"
+"sshd.pid\" till raden \"start-stop-daemon\" i sektionen \"stop\" i filen."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "New host key mandatory"
+msgstr "Ny värdnyckel är obligatorisk"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid ""
+"The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA "
+"algorithm. OpenSSH can not handle this host key file, and the ssh-keygen "
+"utility from the old (non-free) SSH installation does not appear to be "
+"available."
+msgstr ""
+"Den aktuella värdnyckeln i /etc/ssh/ssh_host_key är krypterad med IDEA-"
+"algoritmen. OpenSSH kan inte hantera den här värdnyckelfilen och verktyget "
+"ssh-keygen från den gamla (ickefria) SSH-installationen verkar inte finnas "
+"tillgänglig."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "You need to manually generate a new host key."
+msgstr "Du behöver manuellt generera en ny värdnyckel."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid "Disable challenge-response authentication?"
+msgstr "Inaktivera challenge-response-autentisering?"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"Password authentication appears to be disabled in the current OpenSSH server "
+"configuration. In order to prevent users from logging in using passwords "
+"(perhaps using only public key authentication instead) with recent versions "
+"of OpenSSH, you must disable challenge-response authentication, or else "
+"ensure that your PAM configuration does not allow Unix password file "
+"authentication."
+msgstr ""
+"Lösenordsautentisering verkar vara inaktiverat i din aktuella konfiguration "
+"av OpenSSH-servern. För att förhindra att användare loggar in med lösenord "
+"(istället kanske endast använder publik nyckelautentisering) med senare "
+"versioner av OpenSSH, måste du inaktivera challenge-response-autentisering "
+"eller försäkra dig om att din PAM-konfiguration inte tillåter autentisering "
+"via Unix lösenordsfil."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"If you disable challenge-response authentication, then users will not be "
+"able to log in using passwords. If you leave it enabled (the default "
+"answer), then the 'PasswordAuthentication no' option will have no useful "
+"effect unless you also adjust your PAM configuration in /etc/pam.d/ssh."
+msgstr ""
+"Om du inaktiverar  challenge-response-autentisering så kan användarna inte "
+"logga in med lösenord. Om du lämnar det aktiverat (som är standard) så "
+"kommer \"PasswordAuthentication no\" inte att ha någon effekt om du inte "
+"justerar din PAM-konfiguration i /etc/pam.d/ssh."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "Vulnerable host keys will be regenerated"
+msgstr "Sårbara värdnycklar kommer att omskapas"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Some of the OpenSSH server host keys on this system were generated with a "
+"version of OpenSSL that had a broken random number generator. As a result, "
+"these host keys are from a well-known set, are subject to brute-force "
+"attacks, and must be regenerated."
+msgstr ""
+"Några av värdnycklarna för OpenSSH skapades med en version av OpenSSL som "
+"innehöll ett fel i slumptalsgeneratorn. På grund av detta är värden sårbar "
+"för en så kallad brute force-attack då nycklarna kommer från ett litet och "
+"välkänt spektra."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Users of this system should be informed of this change, as they will be "
+"prompted about the host key change the next time they log in. Use 'ssh-"
+"keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of "
+"the new host keys."
+msgstr ""
+"Användarna på det här systemet borde informeras om den här förändringen då "
+"de kommer att bli varse bytet av värdnyckel nästa gång de loggar in. Använd "
+"'ssh-keygen -l -f HOST_KEY_FILE' efter uppgraderingen har slutförst för att "
+"skriva ut fingeravtrycken för de nya värdnycklarna"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "The affected host keys are:"
+msgstr "De drabbade värdnycklarna är:"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"User keys may also be affected by this problem. The 'ssh-vulnkey' command "
+"may be used as a partial test for this. See /usr/share/doc/openssh-server/"
+"README.compromised-keys.gz for more details."
+msgstr ""
+"Användarnycklar kan också vara drabbade av detta fel. Kommandot 'ssh-"
+"vulnkey' kan användas som ett deltest. Läs /usr/share/doc/openssh-server/"
+"README.compromised-keys.gz för mer ingående detaljer."
+
+#~ msgid "Generate a new configuration file for OpenSSH?"
+#~ msgstr "Generera en ny konfigurationsfil för OpenSSH?"
+
+#~ msgid ""
+#~ "This version of OpenSSH has a considerably changed configuration file "
+#~ "from the version shipped in Debian 'Potato', which you appear to be "
+#~ "upgrading from. This package can now generate a new configuration file (/"
+#~ "etc/ssh/sshd.config), which will work with the new server version, but "
+#~ "will not contain any customizations you made with the old version."
+#~ msgstr ""
+#~ "Denna version av OpenSSH har ändrat konfigurationsfilen ansenligt från "
+#~ "den version som skickades med i Debians \"Potato\"-utgåva som du verkar "
+#~ "uppgradera från. Detta paket kan nu generera en ny konfigurationsfil (/"
+#~ "etc/ssh/sshd.config) som kommer att fungera med den nya serverversionen "
+#~ "men kommer inte att innehålla några anpassningar som du gjorde med den "
+#~ "gamla versionen."
+
+#~ msgid ""
+#~ "Please note that this new configuration file will set the value of "
+#~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password "
+#~ "can ssh directly in as root). Please read the README.Debian file for more "
+#~ "details about this design choice."
+#~ msgstr ""
+#~ "Observera att den nya konfigurationsfilen kommer att ställa in värdet för "
+#~ "\"PermitRootLogin\" till \"yes\" (vilket betyder att vem som helst som "
+#~ "kan root-lösenordet kan logga in direkt som root). Läs filen README."
+#~ "Debian för mer information om det här designvalet."
+
+#~ msgid ""
+#~ "It is strongly recommended that you choose to generate a new "
+#~ "configuration file now."
+#~ msgstr ""
+#~ "Det rekommenderas starkt att du väljer att generera en ny "
+#~ "konfigurationsfil nu."
diff --git a/debian/po/ta.po b/debian/po/ta.po
new file mode 100644
index 000000000..cab323a83
--- /dev/null
+++ b/debian/po/ta.po
@@ -0,0 +1,181 @@
+# translation of openssh.po to TAMIL
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the PACKAGE package.
+#
+# Dr.T.Vasudevan <agnihot3@gmail.com>, 2007.
+msgid ""
+msgstr ""
+"Project-Id-Version: openssh\n"
+"Report-Msgid-Bugs-To: openssh@packages.debian.org\n"
+"POT-Creation-Date: 2010-01-02 08:55+0000\n"
+"PO-Revision-Date: 2007-04-24 20:52+0530\n"
+"Last-Translator: Dr.T.Vasudevan <agnihot3@gmail.com>\n"
+"Language-Team: TAMIL <ubuntu-l10n-tam@lists.ubuntu.com>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: KBabel 1.11.4\n"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid "Do you want to risk killing active SSH sessions?"
+msgstr ""
+"செயலில� இர�க�க�ம� எஸ�எஸ�ஹெச� அமர�வ�களை செயல� நீக�கம� செய�வதை அன�மதிக�க விர�ம�ப�கிறீகளா?"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid ""
+"The currently installed version of /etc/init.d/ssh is likely to kill all "
+"running sshd instances. If you are doing this upgrade via an SSH session, "
+"you're likely to be disconnected and leave the upgrade procedure unfinished."
+msgstr ""
+"இப�போத� நிற�விய�ள�ள /etc/init.d/ssh பதிப�ப� எல�லா செயலில� இர�க�க�ம� எஸ�எஸ�ஹெச� "
+"அமர�வ�களை செயல� நீக�கம� செய�ய�ம�. நீங�கள� இந�த மேம�பட�த�தலை எஸ�எஸ�ஹெச� அமர�வ� வழியாக செய�த� "
+"கொண�டிர�ந�தால� வலை இணப�ப� த�ண�டிக�கப�பட�ட� மேம�பட�த�தல� நிறைவ�றாத�."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid ""
+"This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the "
+"start-stop-daemon line in the stop section of the file."
+msgstr ""
+"இத� கைம�றையாக கோப�பின� நிற�த�த� பக�தியில� ஆரம�பி-நிற�த�த�-கிங�கரன� வரியில� \"--"
+"pidfile /var/run/sshd.pid\" என சேர�ப�பதால� சரி செய�யப�பட�ம�."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "New host key mandatory"
+msgstr "ப�திய ப�ரவலன� விசை கட�டாயமாக�ம�"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid ""
+"The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA "
+"algorithm. OpenSSH can not handle this host key file, and the ssh-keygen "
+"utility from the old (non-free) SSH installation does not appear to be "
+"available."
+msgstr ""
+"இப�போதைய /etc/ssh/ssh_host_key இல� உள�ள ப�ரவலன� விசை IDEA அல�காரிதத�தில� க�றியீட� "
+"செய�யப�பட�டத�. இந�த ப�ரவலன� விசையை ஓபன� எஸ�எஸ�ஹெச� கையாள இயலாத�. பழைய பதிப�பிலிர�ந�த� "
+"ssh-keygen பயன�பாட� இர�ப�பில� இல�லை."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "You need to manually generate a new host key."
+msgstr "நீங�கள� கைம�றையாக ப�திய ப�ரவலன� விசையை உர�வாக�க வேண�ட�ம�."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid "Disable challenge-response authentication?"
+msgstr "கேள�வி பதில� உற�திப�பட�த�தலை செயலிழக�க செய�யவா?"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"Password authentication appears to be disabled in the current OpenSSH server "
+"configuration. In order to prevent users from logging in using passwords "
+"(perhaps using only public key authentication instead) with recent versions "
+"of OpenSSH, you must disable challenge-response authentication, or else "
+"ensure that your PAM configuration does not allow Unix password file "
+"authentication."
+msgstr ""
+"இப�போதைய ஓபன� எஸ�எஸ�ஹெச� சேவையக வடிவமைப�பில� கடவ�ச�சொல� உற�திப�பட�த�தலை செயலிழக�க "
+"செய�த�ள�ளத�. (திறந�த விசையை பயன�பட�த�தி) பயனர�கள� உள�ந�ழைவதை தட�க�க சமீபத�திய ஓபன� "
+"எஸ�எஸ�ஹெச� பதிப�ப�களில� நீங�கள� கேள�வி பதில� உற�திப�பட�த�தலை செயலிழக�க செய�ய வேண�ட�ம�. அல�லத� "
+"உங�கள� பாம� வடிவமைப�ப� யூனிக�ஸ� கடவ�ச�சொல� கோப�ப� உற�திப�பட�த�தலை �ற�காதவாற� அமைக�க "
+"வேண�ட�ம�."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"If you disable challenge-response authentication, then users will not be "
+"able to log in using passwords. If you leave it enabled (the default "
+"answer), then the 'PasswordAuthentication no' option will have no useful "
+"effect unless you also adjust your PAM configuration in /etc/pam.d/ssh."
+msgstr ""
+"நீங�கள� கேள�வி பதில� உற�திப�பட�த�தலை செயலிழக�க செய�தால� பயனர�கள� கடவ�ச�சொற�களை பயன� பட�த�தி "
+"உள� ந�ழைய இயலாத�. அதை செயல� படச�செய�தால� (கடவ�ச�சொல� உற�திப�பட�த�தல� தேர�வ� இல�லை) "
+"'PasswordAuthentication no'  தேர�வ� /etc/pam.d/ssh இல� பாம� வடிவமைப�பை சரி "
+"செய�தால� ஒழிய பயன� தராத�."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "Vulnerable host keys will be regenerated"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Some of the OpenSSH server host keys on this system were generated with a "
+"version of OpenSSL that had a broken random number generator. As a result, "
+"these host keys are from a well-known set, are subject to brute-force "
+"attacks, and must be regenerated."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Users of this system should be informed of this change, as they will be "
+"prompted about the host key change the next time they log in. Use 'ssh-"
+"keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of "
+"the new host keys."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "The affected host keys are:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"User keys may also be affected by this problem. The 'ssh-vulnkey' command "
+"may be used as a partial test for this. See /usr/share/doc/openssh-server/"
+"README.compromised-keys.gz for more details."
+msgstr ""
+
+#~ msgid "Generate a new configuration file for OpenSSH?"
+#~ msgstr "ஓபன� எஸ�எஸ�ஹெச� க�க� ப�திய வடிவமைப�ப� கோப�பை உர�வாக�கவா?"
+
+#~ msgid ""
+#~ "This version of OpenSSH has a considerably changed configuration file "
+#~ "from the version shipped in Debian 'Potato', which you appear to be "
+#~ "upgrading from. This package can now generate a new configuration file (/"
+#~ "etc/ssh/sshd.config), which will work with the new server version, but "
+#~ "will not contain any customizations you made with the old version."
+#~ msgstr ""
+#~ "இந�த பதிப�ப� ஓபன� எஸ�எஸ�ஹெச� நீங�கள� மேம�பட�த�த�ம� டெபியன� பொடாடோவில� அமைந�த பதிப�பை "
+#~ "காட�டில�ம� மிக மாறிய வடிவம� உடையத�. இந�த பொதி இப�போத� ப�திய வடிவமைப�ப� கோப�பை "
+#~ "உர�வாக�க�ம�. (/etc/ssh/sshd.config). இத� ப�திய சேவையக பதிப�பில� வேலை செய�ய�ம�. "
+#~ "ஆனால� நீங�கள� பழைய பதிப�பில� செய�த தனிப�பட�த�தல� இயலாத�."
+
+#~ msgid ""
+#~ "Please note that this new configuration file will set the value of "
+#~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password "
+#~ "can ssh directly in as root). Please read the README.Debian file for more "
+#~ "details about this design choice."
+#~ msgstr ""
+#~ "இந�த ப�திய வடிவமைப�ப� கோப�ப� 'PermitRootLogin மதிப�பை ஆம� என அமைக�க�ம� என "
+#~ "அறியவ�ம�. அதாவத� ரூட� கடவ�ச�சொல� அறிந�த யார�ம� ரூட�டாக ஓபன� எஸ�எஸ�ஹெச� வழியே "
+#~ "உள�ந�ழையலாம�. இந�த வடிவமைப�ப� க�றித�த� மேல�ம� README.Debian கோப�பில� காணவ�ம�."
+
+#~ msgid ""
+#~ "It is strongly recommended that you choose to generate a new "
+#~ "configuration file now."
+#~ msgstr ""
+#~ "நீங�கள� இப�போத� ப�திய வடிவமைப�ப� கோப�பை உர�வாக�க தேர�வ� செய�ய பலமாக "
+#~ "பரிந�த�ரைக�கப�பட�கிறத�."
diff --git a/debian/po/templates.pot b/debian/po/templates.pot
new file mode 100644
index 000000000..de8023b07
--- /dev/null
+++ b/debian/po/templates.pot
@@ -0,0 +1,131 @@
+# SOME DESCRIPTIVE TITLE.
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the PACKAGE package.
+# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
+#
+#, fuzzy
+msgid ""
+msgstr ""
+"Project-Id-Version: PACKAGE VERSION\n"
+"Report-Msgid-Bugs-To: openssh@packages.debian.org\n"
+"POT-Creation-Date: 2010-01-02 08:55+0000\n"
+"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
+"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
+"Language-Team: LANGUAGE <LL@li.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=CHARSET\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid "Do you want to risk killing active SSH sessions?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid ""
+"The currently installed version of /etc/init.d/ssh is likely to kill all "
+"running sshd instances. If you are doing this upgrade via an SSH session, "
+"you're likely to be disconnected and leave the upgrade procedure unfinished."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid ""
+"This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the "
+"start-stop-daemon line in the stop section of the file."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "New host key mandatory"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid ""
+"The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA "
+"algorithm. OpenSSH can not handle this host key file, and the ssh-keygen "
+"utility from the old (non-free) SSH installation does not appear to be "
+"available."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "You need to manually generate a new host key."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid "Disable challenge-response authentication?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"Password authentication appears to be disabled in the current OpenSSH server "
+"configuration. In order to prevent users from logging in using passwords "
+"(perhaps using only public key authentication instead) with recent versions "
+"of OpenSSH, you must disable challenge-response authentication, or else "
+"ensure that your PAM configuration does not allow Unix password file "
+"authentication."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"If you disable challenge-response authentication, then users will not be "
+"able to log in using passwords. If you leave it enabled (the default "
+"answer), then the 'PasswordAuthentication no' option will have no useful "
+"effect unless you also adjust your PAM configuration in /etc/pam.d/ssh."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "Vulnerable host keys will be regenerated"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Some of the OpenSSH server host keys on this system were generated with a "
+"version of OpenSSL that had a broken random number generator. As a result, "
+"these host keys are from a well-known set, are subject to brute-force "
+"attacks, and must be regenerated."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Users of this system should be informed of this change, as they will be "
+"prompted about the host key change the next time they log in. Use 'ssh-"
+"keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of "
+"the new host keys."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "The affected host keys are:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"User keys may also be affected by this problem. The 'ssh-vulnkey' command "
+"may be used as a partial test for this. See /usr/share/doc/openssh-server/"
+"README.compromised-keys.gz for more details."
+msgstr ""
diff --git a/debian/po/tr.po b/debian/po/tr.po
new file mode 100644
index 000000000..cff4ffae9
--- /dev/null
+++ b/debian/po/tr.po
@@ -0,0 +1,377 @@
+# Turkish translation of ssh.
+# This file is distributed under the same license as the ssh package.
+# Mert Dirik <mertdirik@gmail.com>, 2008.
+# Recai OktaÅŸ <roktas@omu.edu.tr>, 2004.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: ssh\n"
+"Report-Msgid-Bugs-To: openssh@packages.debian.org\n"
+"POT-Creation-Date: 2010-01-02 08:55+0000\n"
+"PO-Revision-Date: 2008-05-23 16:24+0200\n"
+"Last-Translator: Mert Dirik <mertdirik@gmail.com>\n"
+"Language-Team: Turkish <debian-l10n-turkish@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"Plural-Forms: nplurals=1; plural=0;\n"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid "Do you want to risk killing active SSH sessions?"
+msgstr "Etkin SSH oturumlarının öldürülmesi riskini göze alıyor musunuz?"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid ""
+"The currently installed version of /etc/init.d/ssh is likely to kill all "
+"running sshd instances. If you are doing this upgrade via an SSH session, "
+"you're likely to be disconnected and leave the upgrade procedure unfinished."
+msgstr ""
+"Kurmuş olduğunuz /etc/init.d/ssh sürümü büyük olasılıkla, çalışıyor olan tüm "
+"sshd süreçlerini öldürecek. Bu yükseltmeyi bir ssh oturumu üzerinden "
+"yapıyorsanız büyük olasılıkla bağlantınız kopacak ve yükseltme işlemi yarım "
+"kalacak."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid ""
+"This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the "
+"start-stop-daemon line in the stop section of the file."
+msgstr ""
+"Bu sorunu dosyanın (/etc/init.d/ssh) stop bölümündeki start-stop-daemon "
+"satırına \"--pidfile /var/run/sshd.pid\" ekleyerek düzeltebilirsiniz."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "New host key mandatory"
+msgstr "Yeni makine anahtarı zorunlu"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid ""
+"The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA "
+"algorithm. OpenSSH can not handle this host key file, and the ssh-keygen "
+"utility from the old (non-free) SSH installation does not appear to be "
+"available."
+msgstr ""
+"Şu anda kullandığınız makine anahtarı, /etc/ssh/ssh_host_key, IDEA "
+"algoritmasıyla şifrelenmiş. OpenSSH bu anahtar dosyasını yönetemez; ayrıca "
+"eski (özgür olmayan) SSH kurulumuna ait ssh-keygen aracı da ulaşılabilir "
+"deÄŸil."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "You need to manually generate a new host key."
+msgstr "Yeni bir makine anahtarı oluşturmanız gerekiyor."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid "Disable challenge-response authentication?"
+msgstr "Sorgula-yanıtla yöntemiyle kimlik doğrulama devre dışı bırakılsın mı?"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"Password authentication appears to be disabled in the current OpenSSH server "
+"configuration. In order to prevent users from logging in using passwords "
+"(perhaps using only public key authentication instead) with recent versions "
+"of OpenSSH, you must disable challenge-response authentication, or else "
+"ensure that your PAM configuration does not allow Unix password file "
+"authentication."
+msgstr ""
+"Şu anda kullanılan OpenSSH yapılandırmasında parola ile kimlik doğrulama "
+"devre dışı gibi görünüyor. OpenSSH'ın yeni versiyonlarında kullanıcıların "
+"parola kullanarak oturum açmalarını engellemek için (belki  bunun yerine "
+"açık anahtar yöntemiyle kimlik doğrulamayı kullanabilirsiniz) sorgula-"
+"yanıtla yöntemiyle kimlik doğrulamayı devre dışı bırakmalı ya da PAM "
+"yapılandırmanızın Unix parola dosyası yöntemiyle kimlik doğrulamaya izin "
+"vermediğinden emin olmalısınız."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"If you disable challenge-response authentication, then users will not be "
+"able to log in using passwords. If you leave it enabled (the default "
+"answer), then the 'PasswordAuthentication no' option will have no useful "
+"effect unless you also adjust your PAM configuration in /etc/pam.d/ssh."
+msgstr ""
+"Sorgula-yanıtla kimlik doğrulamayı devre dışı bırakırsanız, kullanıcılar "
+"parola kullanarak oturum açamayacaklar. Eğer sorgula-yanıtla kimlik "
+"doğrulamayı etkin halde bırakırsanız (öntanımlı yanıt); /etc/pam.d/ssh'daki "
+"PAM yapılandırmasını ayarlamadığınız sürece 'PasswordAuthentication no' "
+"seçeneği bir işe yaramayacak."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "Vulnerable host keys will be regenerated"
+msgstr "Saldırıya açık makine anahtarları yeniden yaratılacak"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Some of the OpenSSH server host keys on this system were generated with a "
+"version of OpenSSL that had a broken random number generator. As a result, "
+"these host keys are from a well-known set, are subject to brute-force "
+"attacks, and must be regenerated."
+msgstr ""
+"Bu sistemdeki OpenSSH sunucusu makine anahtarlarından bazıları OpenSSL'in "
+"rastgele sayı üreticisi bozuk olan bir versiyonuyla oluşturulmuş. Sonuç "
+"olarak, bu makine anahtarları iyi bilinen bir gruptan ve kaba kuvvet "
+"saldırılarına açık. Bu anahtarlar yeniden oluşturulmalı."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Users of this system should be informed of this change, as they will be "
+"prompted about the host key change the next time they log in. Use 'ssh-"
+"keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of "
+"the new host keys."
+msgstr ""
+"Bu sistemin kullanıcılarını makine anahtarı değişikliğinden haberdar "
+"etmelisiniz, çünkü  kullanıcılar sisteme ilk oturum açışlarında uyarılacak "
+"ve kullanıcılara oturum açmaya devam etmek isteyip istemedikleri sorulacak. "
+"Yeni makine anahtarlarının parmak izlerini görmek için yükseltmeden sonra "
+"'ssh-keygen -l -f MAKİNE_ANAHTARI_DOSYASI' komutunu kullanın."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "The affected host keys are:"
+msgstr "Etkilenmiş makine anahtarları:"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"User keys may also be affected by this problem. The 'ssh-vulnkey' command "
+"may be used as a partial test for this. See /usr/share/doc/openssh-server/"
+"README.compromised-keys.gz for more details."
+msgstr ""
+"Kullanıcı anahtarları da bu sorundan etkilenebilir.  'ssh-vulnkey' komutu bu "
+"sorun için kısmi bir test olarak kullanılabilir. Ayrıntılar için  /usr/share/"
+"doc/openssh-server/README.compromised-keys.gz belgesine bakın."
+
+#~ msgid "Generate a new configuration file for OpenSSH?"
+#~ msgstr "OpenSSH için yeni yapılandırma dosyası oluşturulsun mu?"
+
+#~ msgid ""
+#~ "This version of OpenSSH has a considerably changed configuration file "
+#~ "from the version shipped in Debian 'Potato', which you appear to be "
+#~ "upgrading from. This package can now generate a new configuration file (/"
+#~ "etc/ssh/sshd.config), which will work with the new server version, but "
+#~ "will not contain any customizations you made with the old version."
+#~ msgstr ""
+#~ "Debian 'Potato' dağıtımından yükseltme yapmış gibi görünüyorsunuz. "
+#~ "OpenSSH'ın bu sürümü Debian 'Potato' ile birlikte gelen sürümden çok "
+#~ "farklı bir yapılandırma dosyası kullanmakta. Bu paket şimdi sizin için "
+#~ "yeni bir yapılandırma dosyası (/etc/ssh/sshd.config) üretebilir. Bu dosya "
+#~ "yeni sunucu sürümüyle çalışacak, fakat eski sürümde yaptığınız "
+#~ "özelleştirmeleri içermeyecek."
+
+#~| msgid ""
+#~| "Please note that this new configuration file will set the value of "
+#~| "'PermitRootLogin' to yes (meaning that anyone knowing the root password "
+#~| "can ssh directly in as root). It is the opinion of the maintainer that "
+#~| "this is the correct default (see README.Debian for more details), but "
+#~| "you can always edit sshd_config and set it to no if you wish."
+#~ msgid ""
+#~ "Please note that this new configuration file will set the value of "
+#~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password "
+#~ "can ssh directly in as root). Please read the README.Debian file for more "
+#~ "details about this design choice."
+#~ msgstr ""
+#~ "Yeni yapılandırma dosyasının 'PermitRootLogin' seçeneğini 'yes' olarak "
+#~ "ayarlayacağını (yani root parolasını bilen herhangi birisinin ssh ile "
+#~ "doğrudan sisteme girebileceğini) unutmayın. Öntanımlı ayarın böyle olması "
+#~ "gerektiği paket geliştiricisinin kanaatidir (ayrıntılar için README."
+#~ "Debian dosyasını okuyun)."
+
+#~ msgid ""
+#~ "It is strongly recommended that you choose to generate a new "
+#~ "configuration file now."
+#~ msgstr ""
+#~ "Şimdi yeni bir yapılandırma dosyası üretmeyi seçmeniz kuvvetle tavsiye "
+#~ "edilir."
+
+#~ msgid "Warning: you must create a new host key"
+#~ msgstr "Uyarı: yeni bir makine anahtarı oluşturmalısınız"
+
+#~ msgid "Warning: telnetd is installed --- probably not a good idea"
+#~ msgstr "Uyarı: telnetd kurulmuş --- bu muhtemelen iyi bir fikir değil"
+
+#~ msgid ""
+#~ "I'd advise you to either remove the telnetd package (if you don't "
+#~ "actually need to offer telnet access) or install telnetd-ssl so that "
+#~ "there is at least some chance that telnet sessions will not be sending "
+#~ "unencrypted login/password and session information over the network."
+#~ msgstr ""
+#~ "Telnetd paketini (eğer gerçekten telnet erişimi sunmak gibi bir "
+#~ "zorunluluğunuz yoksa) kaldırmanızı veya en azından, telnet oturumlarında "
+#~ "şifrelenmemiş giriş/parola ve oturum bilgilerinin ağ üzerinden "
+#~ "gönderilmemesi olanağını sunan telnetd-ssl paketini kurmanızı öneririm."
+
+#~ msgid "Warning: rsh-server is installed --- probably not a good idea"
+#~ msgstr "Uyarı: rsh-server kurulmuş --- bu muhtemelen iyi bir fikir değil"
+
+#~ msgid ""
+#~ "having rsh-server installed undermines the security that you were "
+#~ "probably wanting to obtain by installing ssh.  I'd advise you to remove "
+#~ "that package."
+#~ msgstr ""
+#~ "rsh-server'ın kurulu durumda olması muhtemelen ssh'ı kurmakla elde "
+#~ "edilmesini istediğiniz güvenliği gölgeliyor. Bu paketi kaldırmanızı "
+#~ "öneririm."
+
+#~ msgid "Do you want ssh-keysign to be installed SUID root?"
+#~ msgstr ""
+#~ "ssh-keysign'ın root haklarıyla kurulmasını (SUID root) ister misiniz?"
+
+#~ msgid ""
+#~ "You have the option of installing the ssh-keysign helper with the SUID "
+#~ "bit set."
+#~ msgstr ""
+#~ "ssh-keysign yardımcı aracının SUID bit'i etkinleştirilerek kurulması "
+#~ "seçeneğine sahipsiniz."
+
+#~ msgid ""
+#~ "If you make ssh-keysign SUID, you will be able to use SSH's Protocol 2 "
+#~ "host-based authentication."
+#~ msgstr ""
+#~ "Eğer ssh-keysign'ı SUID yaparsanız, SSH'ın makine tabanlı Protokol 2 "
+#~ "yetkilendirmesini kullanabileceksiniz."
+
+#~ msgid ""
+#~ "If in doubt, I suggest you install it with SUID.  If it causes problems "
+#~ "you can change your mind later by running:   dpkg-reconfigure ssh"
+#~ msgstr ""
+#~ "Bu konuda şüpheliyseniz, size SUID'li kurulumu öneririm. Eğer bu "
+#~ "sorunlara yol açarsa ileride fikrinizi değiştirmek için şu komutu "
+#~ "çalıştırabilirsiniz: dpkg-reconfigure ssh"
+
+#~ msgid "Allow SSH protocol 2 only"
+#~ msgstr "Sadece SSH protokol 2'ye izin ver"
+
+#~ msgid ""
+#~ "This version of OpenSSH supports version 2 of the ssh protocol, which is "
+#~ "much more secure.  Disabling ssh 1 is encouraged, however this will slow "
+#~ "things down on low end machines and might prevent older clients from "
+#~ "connecting (the ssh client shipped with \"potato\" is affected)."
+#~ msgstr ""
+#~ "OpenSSH'ın bu sürümü ssh'ın çok daha güvenli olan sürüm 2 protokolünü "
+#~ "destekler. Sürüm 1 protokolünün etkisizleştirilmesini teşvik ediyoruz, "
+#~ "bununla beraber böyle yapılması halinde düşük düzeyli makinelerde "
+#~ "işlemler yavaşlayacak ve eski sürüm ssh istemcilerinden (\"potato\" ile "
+#~ "birlikte gelen ssh istemcisi gibi) bağlantı kurulamayacaktır."
+
+#~ msgid ""
+#~ "Also please note that keys used for protocol 1 are different so you will "
+#~ "not be able to use them if you only allow protocol 2 connections."
+#~ msgstr ""
+#~ "Protokol 1 anahtarları çok farklı olduğundan, sadece protokol 2 "
+#~ "bağlantılarına izin vermeniz halinde bu anahtarları kullanamayacağınızı "
+#~ "da lütfen not edin."
+
+#~ msgid ""
+#~ "If you later change your mind about this setting, README.Debian has "
+#~ "instructions on what to do to your sshd_config file."
+#~ msgstr ""
+#~ "Bu ayar hakkındaki fikriniz ileride değişirse, sshd_config dosyasında "
+#~ "yapacağınız işlemlerle ilgili talimatları README.Debian dosyasında "
+#~ "bulabilirsiniz."
+
+#~ msgid "NOTE: Forwarding of X11 and Authorization disabled by default."
+#~ msgstr ""
+#~ "NOT: X11 yönlendirme ve yetkilendirmesi öntanımlı olarak "
+#~ "etkisizleÅŸtirilmiÅŸtir."
+
+#~ msgid ""
+#~ "For security reasons, the Debian version of ssh has ForwardX11 and "
+#~ "ForwardAgent set to ``off'' by default."
+#~ msgstr ""
+#~ "Güvenlik gerekçeleriyle ssh'ın Debian sürümünde ForwardX11 ve "
+#~ "ForwardAgent seçenekleri öntanımlı ``off'' değerine ayarlıdır."
+
+#~ msgid ""
+#~ "You can enable it for servers you trust, either in one of the "
+#~ "configuration files, or with the -X command line option."
+#~ msgstr ""
+#~ "Güvendiğiniz sunucular için bu seçeneği yapılandırma dosyalarından "
+#~ "birinde veya -X komut satırı seçeneğiyle etkinleştirebilirsiniz."
+
+#~ msgid "More details can be found in /usr/share/doc/ssh/README.Debian"
+#~ msgstr ""
+#~ "Daha ayrıntılı bilgi /usr/share/doc/ssh/README.Debian dosyasında "
+#~ "bulunabilir."
+
+#~ msgid "ssh2 keys merged in configuration files"
+#~ msgstr "yapılandırma dosyalarındaki ssh2 anahtarları birleştirildi"
+
+#~ msgid ""
+#~ "As of version 3 OpenSSH no longer uses separate files for ssh1 and ssh2 "
+#~ "keys. This means the authorized_keys2 and known_hosts2 files are no "
+#~ "longer needed. They will still be read in order to maintain backwards "
+#~ "compatibility"
+#~ msgstr ""
+#~ "Sürüm 3 itibarıyla OpenSSH artık, ssh1 ve ssh2 için ayrı yapılandırma "
+#~ "dosyaları kullanmamaktadır. Bu, authorized_keys2 ve known_hosts2 "
+#~ "dosyalarının artık gerekmediği anlamına gelir. Geriye doğru uyumluluğu "
+#~ "korumak için bu dosyalar yine de okunacaktır."
+
+#~ msgid "Do you want to run the sshd server?"
+#~ msgstr "SSH sunucusu sshd'yi çalıştırmak istiyor musunuz?"
+
+#~ msgid "This package contains both the ssh client, and the sshd server."
+#~ msgstr "Bu paket hem ssh istemcisini hem de sshd sunucusunu içeriyor."
+
+#~ msgid ""
+#~ "Normally the sshd Secure Shell Server will be run to allow remote logins "
+#~ "via ssh."
+#~ msgstr ""
+#~ "Güvenli Kabuk Sunucusu sshd, normalde ssh ile uzaktan girişlere izin "
+#~ "vermek için çalıştırılacaktır."
+
+#~ msgid ""
+#~ "If you are only interested in using the ssh client for outbound "
+#~ "connections on this machine, and don't want to log into it at all using "
+#~ "ssh, then you can disable sshd here."
+#~ msgstr ""
+#~ "Eğer amacınız sadece bu makinedeki dış bağlantılar için ssh istemcisini "
+#~ "kullanmak ise ve bu makineye ssh'la girmek gibi bir ÅŸeyi de "
+#~ "istemiyorsanız, sshd sunucusunu bu adımda etkisizleştirebilirsiniz."
+
+#~ msgid "Environment options on keys have been deprecated"
+#~ msgstr "Anahtarlara ilişkin ortam seçenekleri geçerliliğini kaybetmiştir"
+
+#~ msgid ""
+#~ "This version of OpenSSH disables the environment option for public keys "
+#~ "by default, in order to avoid certain attacks (for example, LD_PRELOAD). "
+#~ "If you are using this option in an authorized_keys file, beware that the "
+#~ "keys in question will no longer work until the option is removed."
+#~ msgstr ""
+#~ "OpenSSH'ın bu sürümü belirli atakları önlemek için (ör. LD_PRELOAD) ortak "
+#~ "anahtarlara ait ortam seçeneklerini öntanımlı olarak etkisizleştirir. "
+#~ "Eğer bu seçeneği bir authorized_keys dosyasında kullanıyorsanız, ilgili "
+#~ "seçenek silininceye kadar bu anahtarın artık çalışmayacağını unutmayın."
+
+#~ msgid ""
+#~ "To re-enable this option, set \"PermitUserEnvironment yes\" in /etc/ssh/"
+#~ "sshd_config after the upgrade is complete, taking note of the warning in "
+#~ "the sshd_config(5) manual page."
+#~ msgstr ""
+#~ "Bu seçeneği tekrar etkinleştirmek için, sshd_config(5) kılavuz "
+#~ "sayfasındaki uyarı notunu dikkate alarak, sshd yükseltmesi "
+#~ "tamamlandığında /etc/ssh/ssh_config dosyasında \"PermitUserEnvironment yes"
+#~ "\" satırını kullanın."
diff --git a/debian/po/uk.po b/debian/po/uk.po
new file mode 100644
index 000000000..7663a96c0
--- /dev/null
+++ b/debian/po/uk.po
@@ -0,0 +1,387 @@
+# translation of openssh to Ukrainian
+#
+#    Translators, if you are not familiar with the PO format, gettext
+#    documentation is worth reading, especially sections dedicated to
+#    this format, e.g. by running:
+#         info -n '(gettext)PO Files'
+#         info -n '(gettext)Header Entry'
+#    Some information specific to po-debconf are available at
+#            /usr/share/doc/po-debconf/README-trans
+#         or http://www.debian.org/intl/l10n/po-debconf/README-trans#
+#    Developers do not need to manually edit POT or PO files.
+# Eugeniy Meshcheryakov <eugen@univ.kiev.ua>, 2005.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: openssh-uk\n"
+"Report-Msgid-Bugs-To: openssh@packages.debian.org\n"
+"POT-Creation-Date: 2010-01-02 08:55+0000\n"
+"PO-Revision-Date: 2005-03-28 22:28+0300\n"
+"Last-Translator: Eugeniy Meshcheryakov <eugen@univ.kiev.ua>\n"
+"Language-Team: Ukrainian\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: KBabel 1.9.1\n"
+"Plural-Forms:  nplurals=3; plural=(n%10==1 && n%100!=11 ? 0 : n%10>=2 && n%"
+"10<=4 && (n%100<10 || n%100>=20) ? 1 : 2);\n"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+#, fuzzy
+#| msgid "Do you want to continue (and risk killing active ssh sessions)?"
+msgid "Do you want to risk killing active SSH sessions?"
+msgstr ""
+"Чи бажаєте ви продовжувати (та ризикувати втратити активні �еан�и ssh)?"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+#, fuzzy
+#| msgid ""
+#| "The version of /etc/init.d/ssh that you have installed, is likely to kill "
+#| "all running sshd instances.  If you are doing this upgrade via an ssh "
+#| "session, that would be a Bad Thing(tm)."
+msgid ""
+"The currently installed version of /etc/init.d/ssh is likely to kill all "
+"running sshd instances. If you are doing this upgrade via an SSH session, "
+"you're likely to be disconnected and leave the upgrade procedure unfinished."
+msgstr ""
+"Вер�і� /etc/init.d/ssh, �ку ви в�тановили, імовірно зупинить в�і запущені "
+"проце�и sshd. Якщо ви оновлюєте�� через ssh, це буде Погана річ (tm)."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+#, fuzzy
+#| msgid ""
+#| "You can fix this by adding \"--pidfile /var/run/sshd.pid\" to the start-"
+#| "stop-daemon line in the stop section of the file."
+msgid ""
+"This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the "
+"start-stop-daemon line in the stop section of the file."
+msgstr ""
+"Ви можете виправити це, додавши \"--pidfile /var/run/sshd.pid\" до р�дка з "
+"викликом start-stop-daemon в ча�тині зупинки цього файла."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "New host key mandatory"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+#, fuzzy
+msgid ""
+"The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA "
+"algorithm. OpenSSH can not handle this host key file, and the ssh-keygen "
+"utility from the old (non-free) SSH installation does not appear to be "
+"available."
+msgstr ""
+"Старий ключ в /etc/ssh/ssh_host_key зашифрований за допомогою IDEA. OpenSSH "
+"не може обробл�ти такий файл ключа вузла, також неможливо знайти програму "
+"ssh-keygen зі �тарої (невільної) вер�ії SSH."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+#, fuzzy
+#| msgid "You will need to generate a new host key."
+msgid "You need to manually generate a new host key."
+msgstr "Вам потрібно �творити новий ключ вузла."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid "Disable challenge-response authentication?"
+msgstr "Заборонити автентифікацію запит-відповідь?"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+#, fuzzy
+#| msgid ""
+#| "Password authentication appears to be disabled in your current OpenSSH "
+#| "server configuration. In order to prevent users from logging in using "
+#| "passwords (perhaps using only public key authentication instead) with "
+#| "recent versions of OpenSSH, you must disable challenge-response "
+#| "authentication, or else ensure that your PAM configuration does not allow "
+#| "Unix password file authentication."
+msgid ""
+"Password authentication appears to be disabled in the current OpenSSH server "
+"configuration. In order to prevent users from logging in using passwords "
+"(perhaps using only public key authentication instead) with recent versions "
+"of OpenSSH, you must disable challenge-response authentication, or else "
+"ensure that your PAM configuration does not allow Unix password file "
+"authentication."
+msgstr ""
+"Схоже, що автентифікаці� з викори�танн�м паролів заборонена у поточній "
+"конфігурації �ервера OpenSSH. Щоб перешкодити кори�тувачам реє�трувати�� з "
+"викори�танн�м паролів (можливо, дл� автентифікації тільки за допомогою "
+"відкритих ключів) з о�танніми вер�і�ми OpenSSH, необхідно заборонити "
+"автентифікацію виклик-відгук або впевнити��, що налаштуванн� PAM не "
+"дозвол�ють автентифікацію за допомогою файла паролів Unix."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"If you disable challenge-response authentication, then users will not be "
+"able to log in using passwords. If you leave it enabled (the default "
+"answer), then the 'PasswordAuthentication no' option will have no useful "
+"effect unless you also adjust your PAM configuration in /etc/pam.d/ssh."
+msgstr ""
+"Якщо ви забороните автентифікацію виклик-відгук, то ваші кори�тувачі не "
+"зможуть реє�трувати�� викори�товуючи паролі. Якщо ви залишите її дозволеною "
+"(відповідь за замовчанн�м), то опці� 'PasswordAuthentication no' не буде "
+"мати кори�ного ефекту доки ви не при�то�уєте також налаштуванн� PAM в /etc/"
+"pam.d/ssh."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "Vulnerable host keys will be regenerated"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Some of the OpenSSH server host keys on this system were generated with a "
+"version of OpenSSL that had a broken random number generator. As a result, "
+"these host keys are from a well-known set, are subject to brute-force "
+"attacks, and must be regenerated."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Users of this system should be informed of this change, as they will be "
+"prompted about the host key change the next time they log in. Use 'ssh-"
+"keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of "
+"the new host keys."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "The affected host keys are:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"User keys may also be affected by this problem. The 'ssh-vulnkey' command "
+"may be used as a partial test for this. See /usr/share/doc/openssh-server/"
+"README.compromised-keys.gz for more details."
+msgstr ""
+
+#, fuzzy
+#~ msgid "Generate a new configuration file for OpenSSH?"
+#~ msgstr "Створити новий файл налаштувань"
+
+#, fuzzy
+#~ msgid ""
+#~ "This version of OpenSSH has a considerably changed configuration file "
+#~ "from the version shipped in Debian 'Potato', which you appear to be "
+#~ "upgrading from. This package can now generate a new configuration file (/"
+#~ "etc/ssh/sshd.config), which will work with the new server version, but "
+#~ "will not contain any customizations you made with the old version."
+#~ msgstr ""
+#~ "В цій вер�ії OpenSSH значно змінений файл налаштувань, в порівн�нні з "
+#~ "вер�ією, що входила в Debian 'Potato', і �ку ви, �хоже, оновлюєте. Зараз "
+#~ "можна �творити новий файл налаштувань (/etc/ssh/sshd.config), що буде "
+#~ "працювати з новою вер�ією �ервера, але не буде мі�тити будь-�кі зміни, "
+#~ "�кі ви вне�ли у �тару вер�ію."
+
+#, fuzzy
+#~| msgid ""
+#~| "Please note that this new configuration file will set the value of "
+#~| "'PermitRootLogin' to yes (meaning that anyone knowing the root password "
+#~| "can ssh directly in as root). It is the opinion of the maintainer that "
+#~| "this is the correct default (see README.Debian for more details), but "
+#~| "you can always edit sshd_config and set it to no if you wish."
+#~ msgid ""
+#~ "Please note that this new configuration file will set the value of "
+#~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password "
+#~ "can ssh directly in as root). Please read the README.Debian file for more "
+#~ "details about this design choice."
+#~ msgstr ""
+#~ "Зауважте, що в новій вер�ії файла налаштувань змінна 'PermitRootLogin' "
+#~ "буде мати значенн� yes (що означає, що будь-�ка людина, котра знає пароль "
+#~ "кори�тувача root, зможе увійти в �и�тему через ssh). �а думку "
+#~ "�упроводжуючого пакунку - це вірне значенн� за замовчанн�м (дивіть�� "
+#~ "також README.Debian), але ви завжди можете змінити значенн� цього "
+#~ "параметра у файлі sshd_config."
+
+#, fuzzy
+#~ msgid ""
+#~ "It is strongly recommended that you choose to generate a new "
+#~ "configuration file now."
+#~ msgstr "Рекомендуєть�� дозволити �творити новий файл налаштувань."
+
+#~ msgid "Warning: you must create a new host key"
+#~ msgstr "Попередженн�: ви повинні �творити новий ключ вузла"
+
+#~ msgid "Warning: telnetd is installed --- probably not a good idea"
+#~ msgstr "Попередженн�: telnetd в�тановлений - це погана іде�"
+
+#~ msgid ""
+#~ "I'd advise you to either remove the telnetd package (if you don't "
+#~ "actually need to offer telnet access) or install telnetd-ssl so that "
+#~ "there is at least some chance that telnet sessions will not be sending "
+#~ "unencrypted login/password and session information over the network."
+#~ msgstr ""
+#~ "Рекомендуєть�� або видалити пакунок telnetd (�кщо вам не потрібно "
+#~ "надавати до�туп через telnet), або в�тановити telnetd-ssl, щоб мати "
+#~ "можливі�ть не передавати незашифровані логін/пароль та іншу інформацію "
+#~ "через мережу."
+
+#~ msgid "Warning: rsh-server is installed --- probably not a good idea"
+#~ msgstr "Попередженн�: rsh-server в�тановлений - це погана іде�"
+
+#~ msgid ""
+#~ "having rsh-server installed undermines the security that you were "
+#~ "probably wanting to obtain by installing ssh.  I'd advise you to remove "
+#~ "that package."
+#~ msgstr ""
+#~ "В�тановлений rsh-server знижує рівень безпеки, �кий ви, можливо, хотіли "
+#~ "отримати в�тановивши ssh. Рекомендуєть�� видалити цей пакунок."
+
+#~ msgid "Do you want ssh-keysign to be installed SUID root?"
+#~ msgstr "Чи бажаєте ви, щоб ssh-keysign мав в�тановлений біт SUID?"
+
+#~ msgid ""
+#~ "You have the option of installing the ssh-keysign helper with the SUID "
+#~ "bit set."
+#~ msgstr "Ви маєте можливі�ть в�тановити біт SUID дл� програми ssh-keysign."
+
+#~ msgid ""
+#~ "If you make ssh-keysign SUID, you will be able to use SSH's Protocol 2 "
+#~ "host-based authentication."
+#~ msgstr ""
+#~ "Якщо ви в�тановите біт SUID дл� ssh-keysign, ви зможете викори�товувати "
+#~ "вузлову автентифікацію протоколу SSH вер�ії 2."
+
+#~ msgid ""
+#~ "If in doubt, I suggest you install it with SUID.  If it causes problems "
+#~ "you can change your mind later by running:   dpkg-reconfigure ssh"
+#~ msgstr ""
+#~ "Якщо �умніваєте�ь, то рекомендуєть�� дозволити в�тановити біт SUID. Якщо "
+#~ "це викликатиме проблеми, ви зможете в�е змінити запу�тивши dpkg-"
+#~ "reconfigure ssh"
+
+#~ msgid "Allow SSH protocol 2 only"
+#~ msgstr "Дозволити тільки SSH-протокол вер�ії 2"
+
+#~ msgid ""
+#~ "This version of OpenSSH supports version 2 of the ssh protocol, which is "
+#~ "much more secure.  Disabling ssh 1 is encouraged, however this will slow "
+#~ "things down on low end machines and might prevent older clients from "
+#~ "connecting (the ssh client shipped with \"potato\" is affected)."
+#~ msgstr ""
+#~ "Ц� вер�і� OpenSSH підтримує вер�ію 2 протоколу SSH, �ка є більш "
+#~ "безпечною. Рекомендуєть�� заборонити вер�ію 1, однак це може уповільнити "
+#~ "роботу на �лабких �и�темах та зробити неможливим з'єднанн� з "
+#~ "викори�танн�м �тарих клієнтів (включно з клієнтом ssh з \"potato\")."
+
+#~ msgid ""
+#~ "Also please note that keys used for protocol 1 are different so you will "
+#~ "not be able to use them if you only allow protocol 2 connections."
+#~ msgstr ""
+#~ "Також зверніть увагу, що ключі дл� вер�ії 1 відрізн�ють�� від ключів дл� "
+#~ "вер�ії 2, тому ви не зможете викори�товувати їх, �кщо дозволите з'єднанн� "
+#~ "тільки по протоколу вер�ії 2."
+
+#~ msgid ""
+#~ "If you later change your mind about this setting, README.Debian has "
+#~ "instructions on what to do to your sshd_config file."
+#~ msgstr ""
+#~ "Якщо ви пізніше передумаєте щодо цього параметра, файл README.Debian "
+#~ "мі�тить ін�трукції щодо вне�енн� змін до файла sshd_config."
+
+#~ msgid "ssh2 keys merged in configuration files"
+#~ msgstr "ssh2-ключі злиті у файлах налаштувань"
+
+#~ msgid ""
+#~ "As of version 3 OpenSSH no longer uses separate files for ssh1 and ssh2 "
+#~ "keys. This means the authorized_keys2 and known_hosts2 files are no "
+#~ "longer needed. They will still be read in order to maintain backwards "
+#~ "compatibility"
+#~ msgstr ""
+#~ "У вер�ії 3 OpenSSH більше не викори�товує окремі файли дл� ключів ssh1 та "
+#~ "ssh2. Це означає, що файли authorized_keys2 та known_hosts2 більше "
+#~ "непотрібні. Вони будуть читати�� з метою забезпеченн� зворотної "
+#~ "�умі�но�ті."
+
+#~ msgid "NOTE: Forwarding of X11 and Authorization disabled by default."
+#~ msgstr ""
+#~ "З�УВ�ЖЕ��Я: Форвардинг X11 та Authorization заборонені за замовчанн�м."
+
+#~ msgid ""
+#~ "For security reasons, the Debian version of ssh has ForwardX11 and "
+#~ "ForwardAgent set to ``off'' by default."
+#~ msgstr ""
+#~ "З міркувань безпеки в Debian-вер�ії ssh параметри ForwardX11 та "
+#~ "ForwardAgent за замовчанн�м мають значенн� \"off\"."
+
+#~ msgid ""
+#~ "You can enable it for servers you trust, either in one of the "
+#~ "configuration files, or with the -X command line option."
+#~ msgstr ""
+#~ "Ви можете дозволити їх дл� �ерверів, �ким довір�єте, або у одному з "
+#~ "файлів налаштувань, або за допомогою параметра командного р�дка -X."
+
+#~ msgid "More details can be found in /usr/share/doc/ssh/README.Debian"
+#~ msgstr "Подробиці можна прочитати у файлі /usr/share/doc/ssh/README.Debian"
+
+#~ msgid "Do you want to run the sshd server?"
+#~ msgstr "Чи бажаєте ви запу�тити �ервер sshd?"
+
+#~ msgid "This package contains both the ssh client, and the sshd server."
+#~ msgstr "Цей пакунок мі�тить �к клієнт ssh, так і �ервер sshd."
+
+#~ msgid ""
+#~ "Normally the sshd Secure Shell Server will be run to allow remote logins "
+#~ "via ssh."
+#~ msgstr ""
+#~ "Звичайно sshd (Secure Shell Server) запу�каєть�� щоб зробити можливим "
+#~ "віддалену реє�трацію в �и�темі за допомогою ssh."
+
+#~ msgid ""
+#~ "If you are only interested in using the ssh client for outbound "
+#~ "connections on this machine, and don't want to log into it at all using "
+#~ "ssh, then you can disable sshd here."
+#~ msgstr ""
+#~ "Якщо ва� цікавить викори�танн� тільки клієнта ssh на цій машині і ви не "
+#~ "бажаєте реє�трувати�� на ній викори�товуючи ssh, тоді ви можете "
+#~ "заборонити sshd."
+
+#~ msgid "Environment options on keys have been deprecated"
+#~ msgstr "Опції оточенн� дл� ключів не повинні викори�товувати��"
+
+#~ msgid ""
+#~ "This version of OpenSSH disables the environment option for public keys "
+#~ "by default, in order to avoid certain attacks (for example, LD_PRELOAD). "
+#~ "If you are using this option in an authorized_keys file, beware that the "
+#~ "keys in question will no longer work until the option is removed."
+#~ msgstr ""
+#~ "В цій вер�ії OpenSSH, з метою уникненн� де�ких атак (наприклад "
+#~ "LD_PRELOAD), за замовчанн�м заборонені опції оточенн� дл� відкритих "
+#~ "ключів. Якщо ви викори�товуєте цю опцію у файлі authorized_keys, майте на "
+#~ "увазі, що ключі з такими опці�ми не будуть працювати, доки опці� не буде "
+#~ "видалена."
+
+#~ msgid ""
+#~ "To re-enable this option, set \"PermitUserEnvironment yes\" in /etc/ssh/"
+#~ "sshd_config after the upgrade is complete, taking note of the warning in "
+#~ "the sshd_config(5) manual page."
+#~ msgstr ""
+#~ "Щоб дозволити цю опцію, в�тановіть \"PermitUserEnvironment yes\" в /etc/"
+#~ "ssh/sshd_config пі�л� завершенн� оновленн�; зверніть увагу на "
+#~ "попередженн� на �торінці підручника sshd_config(5)."
diff --git a/debian/po/vi.po b/debian/po/vi.po
new file mode 100644
index 000000000..a94514c22
--- /dev/null
+++ b/debian/po/vi.po
@@ -0,0 +1,212 @@
+# Vietnamese translation for OpenSSH.
+# Copyright © 2008 Free Software Foundation, Inc.
+# Clytie Siddall <clytie@riverland.net.au>, 2007-2008.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: openssh 1:4.7p1-9\n"
+"Report-Msgid-Bugs-To: openssh@packages.debian.org\n"
+"POT-Creation-Date: 2010-01-02 08:55+0000\n"
+"PO-Revision-Date: 2008-05-19 16:49+0930\n"
+"Last-Translator: Clytie Siddall <clytie@riverland.net.au>\n"
+"Language-Team: Vietnamese <vi-VN@googlegroups.com>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"Plural-Forms: nplurals=1; plural=0;\n"
+"X-Generator: LocFactoryEditor 1.7b3\n"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid "Do you want to risk killing active SSH sessions?"
+msgstr "Bạn có muốn rủi ro giết phiên bản SSH đang chạy không?"
+
+# The version of /etc/init.d/ssh that you have installed, is likely to kill
+# all running sshd instances.  If you are doing this upgrade via an ssh
+# session, that would be a Bad Thing(tm).
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid ""
+"The currently installed version of /etc/init.d/ssh is likely to kill all "
+"running sshd instances. If you are doing this upgrade via an SSH session, "
+"you're likely to be disconnected and leave the upgrade procedure unfinished."
+msgstr ""
+"Phiên bản « /etc/init.d/ssh » được cài đặt hiện th�i rất có thể giết m�i tiến "
+"trình sshd đang chạy. Nếu bạn có nâng cấp qua phiên chạy SSH, rất có thể bạn "
+"bị ngắt kết nối, để lại tiến trình nâng cấp chưa hoàn tất."
+
+# You can fix this by adding \"--pidfile /var/run/sshd.pid\" to the start-
+# stop-daemon line in the stop section of the file.
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+msgid ""
+"This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the "
+"start-stop-daemon line in the stop section of the file."
+msgstr ""
+"Bạn vẫn còn có thể sửa chữa vấn đ� này bằng cách tự thêm chuỗi « --pidfile /"
+"var/run/sshd.pid » vào dòng « start-stop-daemon » (khởi/ngừng chạy trình n�n) "
+"trong phần « stop » (ngừng chạy) của tập tin đó."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "New host key mandatory"
+msgstr "Bắt buộc phải có khoá máy mới"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid ""
+"The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA "
+"algorithm. OpenSSH can not handle this host key file, and the ssh-keygen "
+"utility from the old (non-free) SSH installation does not appear to be "
+"available."
+msgstr ""
+"Khoá máy hiện th�i, trong « /etc/ssh/ssh_host_key », được mặt mã bằng thuật "
+"toán IDEA. Phần m�m OpenSSH không thể xử lý tập tin khoá máy kiểu này; cũng "
+"có vẻ là tiện ích « ssh-keygen » (tạo khoá SSH) thuộc v� bản cài đặt SSH cũ "
+"(khác tự do) không sẵn sàng."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "You need to manually generate a new host key."
+msgstr "Vậy bạn cần phải tự tạo một khoá máy mới."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid "Disable challenge-response authentication?"
+msgstr "Tắt chức năng xác thực kiểu yêu cầu/đáp ứng không?"
+
+# Password authentication appears to be disabled in your current OpenSSH
+# server configuration. In order to prevent users from logging in using
+# passwords (perhaps using only public key authentication instead) with
+# recent versions of OpenSSH, you must disable challenge-response
+# authentication, or else ensure that your PAM configuration does not allow
+# Unix password file authentication.
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"Password authentication appears to be disabled in the current OpenSSH server "
+"configuration. In order to prevent users from logging in using passwords "
+"(perhaps using only public key authentication instead) with recent versions "
+"of OpenSSH, you must disable challenge-response authentication, or else "
+"ensure that your PAM configuration does not allow Unix password file "
+"authentication."
+msgstr ""
+"Có vẻ là chức năng xác thực bằng mật khẩu bị tắt trong cấu hình trình phục "
+"vụ OpenSSH hiện th�i. �ể ngăn cản ngư�i dùng đăng nhập bằng mật khẩu (có lẽ "
+"chỉ xác thực bằng khoá công)  với phiên bản OpenSSH gần đây, bạn cần phải "
+"tắt khả năng xác thực kiểu yêu cầu/đáp ứng (challenge-response "
+"authentication), không thì đảm bảo cấu hình PAM không cho phép xác thực bằng "
+"tập tin mật khẩu UNIX."
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"If you disable challenge-response authentication, then users will not be "
+"able to log in using passwords. If you leave it enabled (the default "
+"answer), then the 'PasswordAuthentication no' option will have no useful "
+"effect unless you also adjust your PAM configuration in /etc/pam.d/ssh."
+msgstr ""
+"Nếu bạn tắt khả năng xác thực kiểu yêu cầu/đáp ứng, ngư�i dùng sẽ không thể "
+"đăng nhập bằng mật khẩu. �ể lại hoạt động (trả l�i mặc định) thì tùy ch�n « "
+"PasswordAuthentication no » (xác thực bằng mật khẩu : không) sẽ không có tác "
+"động thật, nếu bạn không đi�u chỉnh cấu hình PAM trong « /etc/pam.d/ssh »"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "Vulnerable host keys will be regenerated"
+msgstr "M�i khoá máy dễ bị tấn công đ�u sẽ được tạo lại"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Some of the OpenSSH server host keys on this system were generated with a "
+"version of OpenSSL that had a broken random number generator. As a result, "
+"these host keys are from a well-known set, are subject to brute-force "
+"attacks, and must be regenerated."
+msgstr ""
+"Một số khoá máy kiểu trình phục vụ OpenSSH trên hệ thống này đã được tạo "
+"bằng một phiên bản OpenSSL có một cơ chế tạo số ngẫu nhiên mà bị h�ng. Kết "
+"quả là những khoá máy này thuộc v� một tập hợp ai cũng biết, có thể bị tấn "
+"công dùng sức mạnh vũ phu, và phải được tạo lại."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Users of this system should be informed of this change, as they will be "
+"prompted about the host key change the next time they log in. Use 'ssh-"
+"keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of "
+"the new host keys."
+msgstr ""
+"Các ngư�i dùng của hệ thống này nên được thông báo v� thay đổi này, vì h� sẽ "
+"được nhắc cho thay đổi khoá máy này lần kế tiếp đăng nhập. Hãy dùng câu lệnh "
+"« ssh-keygen -l -f TẬP_TIN_KHO�_M�Y » sau khi nâng cấp, để in ra các vân tay "
+"của những khoá máy mới."
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "The affected host keys are:"
+msgstr "Những máy khoá bị ảnh hưởng:"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"User keys may also be affected by this problem. The 'ssh-vulnkey' command "
+"may be used as a partial test for this. See /usr/share/doc/openssh-server/"
+"README.compromised-keys.gz for more details."
+msgstr ""
+"Các khoá kiểu ngư�i dùng cũng có thể bị vấn đ� này ảnh hưởng. Câu lệnh « ssh-"
+"vulnkey » có thể được sử dụng làm thử bộ phận để phát hiện các khoá vẫn còn "
+"dễ tấn công. Xem tài liệu ��c �i «  /usr/share/doc/openssh-server/README."
+"compromised-keys.gz » để tìm thêm chi tiết."
+
+#~ msgid "Generate a new configuration file for OpenSSH?"
+#~ msgstr "Tao ra tập tin cấu hình mới cho OpenSSH không?"
+
+#~ msgid ""
+#~ "This version of OpenSSH has a considerably changed configuration file "
+#~ "from the version shipped in Debian 'Potato', which you appear to be "
+#~ "upgrading from. This package can now generate a new configuration file (/"
+#~ "etc/ssh/sshd.config), which will work with the new server version, but "
+#~ "will not contain any customizations you made with the old version."
+#~ msgstr ""
+#~ "Phiên bản OpenSSH này có một tập tin cấu hình đã thay đổi nhi�u so với "
+#~ "phiên bản có sẵn trong bản phát hành « Potato » của Debian, trong đó có vẻ "
+#~ "là bạn đang cập nhật. Gói hiện th�i có khả năng tạo ra một tập tin cấu "
+#~ "hình mới (/etc/ssh/sshd.config), mà sẽ hoạt động được với phiên bản trình "
+#~ "phục vụ mới, nhưng không còn chứa lại mục sửa đổi nào bạn đã tạo trong "
+#~ "phiên bản cũ."
+
+# Please note that this new configuration file will set the value of
+# 'PermitRootLogin' to yes (meaning that anyone knowing the root password
+# can ssh directly in as root). It is the opinion of the maintainer that
+# this is the correct default (see README.Debian for more details), but you
+# can always edit sshd_config and set it to no if you wish.
+#~ msgid ""
+#~ "Please note that this new configuration file will set the value of "
+#~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password "
+#~ "can ssh directly in as root). Please read the README.Debian file for more "
+#~ "details about this design choice."
+#~ msgstr ""
+#~ "Ghi chú rằng tập tin cấu hình mới này sẽ đặt giá trị của « PermitRootLogin "
+#~ "» thành « yes » (có : nghĩa là ai đó biết mật khẩu ngư�i chủ thì có khả "
+#~ "năng truy cập trực tiếp qua ssh với tư cách là ngư�i chủ). Xem tập tin "
+#~ "��c �i « README.Debian » để tìm thêm chi tiết v� sự ch�n thiết kế này."
+
+#~ msgid ""
+#~ "It is strongly recommended that you choose to generate a new "
+#~ "configuration file now."
+#~ msgstr "Rất khuyên bạn ch�n tạo ra tập tin cấu hình mới ngay bây gi�."
diff --git a/debian/po/zh_CN.po b/debian/po/zh_CN.po
new file mode 100644
index 000000000..9eee59af9
--- /dev/null
+++ b/debian/po/zh_CN.po
@@ -0,0 +1,389 @@
+#
+#    Translators, if you are not familiar with the PO format, gettext
+#    documentation is worth reading, especially sections dedicated to
+#    this format, e.g. by running:
+#         info -n '(gettext)PO Files'
+#         info -n '(gettext)Header Entry'
+#
+#    Some information specific to po-debconf are available at
+#            /usr/share/doc/po-debconf/README-trans
+#         or http://www.debian.org/intl/l10n/po-debconf/README-trans
+#
+#    Developers do not need to manually edit POT or PO files.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: openssh 3.6.1p2-11\n"
+"Report-Msgid-Bugs-To: openssh@packages.debian.org\n"
+"POT-Creation-Date: 2010-01-02 08:55+0000\n"
+"PO-Revision-Date: 2004-02-02 18:48+1300\n"
+"Last-Translator: Hiei Xu <nicky@mail.edu.cn>\n"
+"Language-Team: Chinese/Simplified <i18n-translation@lists.linux.net.cn>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+#, fuzzy
+#| msgid "Do you want to continue (and risk killing active ssh sessions)?"
+msgid "Do you want to risk killing active SSH sessions?"
+msgstr "您�继续�(会有�死活动的 ssh 会�的�险)？"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+#, fuzzy
+#| msgid ""
+#| "The version of /etc/init.d/ssh that you have installed, is likely to kill "
+#| "all running sshd instances.  If you are doing this upgrade via an ssh "
+#| "session, that would be a Bad Thing(tm)."
+msgid ""
+"The currently installed version of /etc/init.d/ssh is likely to kill all "
+"running sshd instances. If you are doing this upgrade via an SSH session, "
+"you're likely to be disconnected and leave the upgrade procedure unfinished."
+msgstr ""
+"您安装的 /etc/init.d/ssh 版本很�能会�死所有�行中的 sshd 例程。如果您是在通"
+"过 ssh 会�进行这项�级，那�真是件糟糕的事情(tm)。"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:1001
+#, fuzzy
+#| msgid ""
+#| "You can fix this by adding \"--pidfile /var/run/sshd.pid\" to the start-"
+#| "stop-daemon line in the stop section of the file."
+msgid ""
+"This can be fixed by manually adding \"--pidfile /var/run/sshd.pid\" to the "
+"start-stop-daemon line in the stop section of the file."
+msgstr ""
+"您�以通过添加“--pidfile /var/run/sshd.pid�到这个文件的 stop 部分的 start-"
+"stop-daemon 行�修正这个问题。"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+msgid "New host key mandatory"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+#, fuzzy
+msgid ""
+"The current host key, in /etc/ssh/ssh_host_key, is encrypted with the IDEA "
+"algorithm. OpenSSH can not handle this host key file, and the ssh-keygen "
+"utility from the old (non-free) SSH installation does not appear to be "
+"available."
+msgstr ""
+"/etc/ssh/ssh_host_key 是由 IDEA 加密的旧密钥文件。OpenSSH �能处�这�密钥文"
+"件，我也无法找到旧的(�自由的) SSH 安装所带的 ssh-keygen 密钥生�工具。"
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:2001
+#, fuzzy
+#| msgid "You will need to generate a new host key."
+msgid "You need to manually generate a new host key."
+msgstr "您需�创建一个新的主机密钥。"
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid "Disable challenge-response authentication?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"Password authentication appears to be disabled in the current OpenSSH server "
+"configuration. In order to prevent users from logging in using passwords "
+"(perhaps using only public key authentication instead) with recent versions "
+"of OpenSSH, you must disable challenge-response authentication, or else "
+"ensure that your PAM configuration does not allow Unix password file "
+"authentication."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"If you disable challenge-response authentication, then users will not be "
+"able to log in using passwords. If you leave it enabled (the default "
+"answer), then the 'PasswordAuthentication no' option will have no useful "
+"effect unless you also adjust your PAM configuration in /etc/pam.d/ssh."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "Vulnerable host keys will be regenerated"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Some of the OpenSSH server host keys on this system were generated with a "
+"version of OpenSSL that had a broken random number generator. As a result, "
+"these host keys are from a well-known set, are subject to brute-force "
+"attacks, and must be regenerated."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"Users of this system should be informed of this change, as they will be "
+"prompted about the host key change the next time they log in. Use 'ssh-"
+"keygen -l -f HOST_KEY_FILE' after the upgrade to print the fingerprints of "
+"the new host keys."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid "The affected host keys are:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../openssh-server.templates:4001
+msgid ""
+"User keys may also be affected by this problem. The 'ssh-vulnkey' command "
+"may be used as a partial test for this. See /usr/share/doc/openssh-server/"
+"README.compromised-keys.gz for more details."
+msgstr ""
+
+#, fuzzy
+#~ msgid "Generate a new configuration file for OpenSSH?"
+#~ msgstr "生�新的�置文件"
+
+#, fuzzy
+#~ msgid ""
+#~ "This version of OpenSSH has a considerably changed configuration file "
+#~ "from the version shipped in Debian 'Potato', which you appear to be "
+#~ "upgrading from. This package can now generate a new configuration file (/"
+#~ "etc/ssh/sshd.config), which will work with the new server version, but "
+#~ "will not contain any customizations you made with the old version."
+#~ msgstr ""
+#~ "看�您正在从 Debian “Potato��级，当�版本和 Debian “Potato�所带的 "
+#~ "OpenSSH 版本的�置文件对比有了相当多的改�。我现在�以生�适用于新�务器版"
+#~ "本的新�置文件 (/etc/ssh/sshd_config)，但是它�会�留您为旧版本定制的任何"
+#~ "�置。"
+
+#, fuzzy
+#~| msgid ""
+#~| "Please note that this new configuration file will set the value of "
+#~| "'PermitRootLogin' to yes (meaning that anyone knowing the root password "
+#~| "can ssh directly in as root). It is the opinion of the maintainer that "
+#~| "this is the correct default (see README.Debian for more details), but "
+#~| "you can always edit sshd_config and set it to no if you wish."
+#~ msgid ""
+#~ "Please note that this new configuration file will set the value of "
+#~ "'PermitRootLogin' to 'yes' (meaning that anyone knowing the root password "
+#~ "can ssh directly in as root). Please read the README.Debian file for more "
+#~ "details about this design choice."
+#~ msgstr ""
+#~ "请注�新的�置文件将会把“PermitRootLogin�的值设置为 yes，(这�味�任何一个"
+#~ "知� root 密�的人都�以直接以 root 登录)。维护者认为这是一个正确的默认值 "
+#~ "(详情请阅读 README.Debian)，但如果您希望，也�以编辑 sshd_config 文件将其"
+#~ "设置为 no。"
+
+#, fuzzy
+#~ msgid ""
+#~ "It is strongly recommended that you choose to generate a new "
+#~ "configuration file now."
+#~ msgstr "强烈建议让我为您生�一份新的�置文件。"
+
+#~ msgid "Warning: you must create a new host key"
+#~ msgstr "警告：您必须创建一个新的主机密钥"
+
+#~ msgid "Warning: telnetd is installed --- probably not a good idea"
+#~ msgstr "警告：已�安装了 telnetd �务器 --- �能�是个好主�"
+
+#~ msgid ""
+#~ "I'd advise you to either remove the telnetd package (if you don't "
+#~ "actually need to offer telnet access) or install telnetd-ssl so that "
+#~ "there is at least some chance that telnet sessions will not be sending "
+#~ "unencrypted login/password and session information over the network."
+#~ msgstr ""
+#~ "我建议您删除 telnetd 包(如果您�是真的需��供 telnet 访问)，或者安装 "
+#~ "telnetd-ssl，这样至少有时候 telnet 会��会将未加密的 登录�/密� 和会�信"
+#~ "�通过网络��。"
+
+#~ msgid "Warning: rsh-server is installed --- probably not a good idea"
+#~ msgstr "警告：已�安装了 rsh �务器 --- �能�是个好主�"
+
+#~ msgid ""
+#~ "having rsh-server installed undermines the security that you were "
+#~ "probably wanting to obtain by installing ssh.  I'd advise you to remove "
+#~ "that package."
+#~ msgstr ""
+#~ "安装 rsh �务器很�能会�低您想�通过安装 ssh 得到的安全性。我建议您删除这"
+#~ "个包。"
+
+#~ msgid "Do you want ssh-keysign to be installed SUID root?"
+#~ msgstr "您�将 ssh-keysign 安装为 SUID root 程��？"
+
+#~ msgid ""
+#~ "You have the option of installing the ssh-keysign helper with the SUID "
+#~ "bit set."
+#~ msgstr "您使用为 ssh-keysign 帮助者程�设置 SUID �的选项。"
+
+#~ msgid ""
+#~ "If you make ssh-keysign SUID, you will be able to use SSH's Protocol 2 "
+#~ "host-based authentication."
+#~ msgstr ""
+#~ "如果您为 ssh-keysign 设置了 SUID，您将�以使用 SSH �议 2 的基于主机的认�"
+#~ "方�。"
+
+#~ msgid ""
+#~ "If in doubt, I suggest you install it with SUID.  If it causes problems "
+#~ "you can change your mind later by running:   dpkg-reconfigure ssh"
+#~ msgstr ""
+#~ "如果有疑问，我建议您将它安装为 SUID。如果它带�麻烦，您�以通过�行：dpkg-"
+#~ "reconfigure ssh �改�主�"
+
+#~ msgid "Allow SSH protocol 2 only"
+#~ msgstr "��许 SSH �议 2 (ssh2)。"
+
+#~ msgid ""
+#~ "This version of OpenSSH supports version 2 of the ssh protocol, which is "
+#~ "much more secure.  Disabling ssh 1 is encouraged, however this will slow "
+#~ "things down on low end machines and might prevent older clients from "
+#~ "connecting (the ssh client shipped with \"potato\" is affected)."
+#~ msgstr ""
+#~ "这个版本的 OpenSSH 支�更加安全的第二版本 ssh �议。我们鼓励您�用 ssh 1，"
+#~ "然而这会�低低端机器速度，并且会阻止�版客户端的连接(“potato�所带的 ssh 客"
+#~ "户端会�到影�)。"
+
+#~ msgid ""
+#~ "Also please note that keys used for protocol 1 are different so you will "
+#~ "not be able to use them if you only allow protocol 2 connections."
+#~ msgstr ""
+#~ "也请注��议 1 所用的密钥是��的，因此如果您��许�议 2 连接将会导致�能"
+#~ "使用它们。"
+
+#~ msgid ""
+#~ "If you later change your mind about this setting, README.Debian has "
+#~ "instructions on what to do to your sshd_config file."
+#~ msgstr ""
+#~ "如果您��想改�这个设置，README.Debian 上有说明告诉您如何修改 "
+#~ "sshd_Config 文件。"
+
+#~ msgid "NOTE: Forwarding of X11 and Authorization disabled by default."
+#~ msgstr "注�：X11 转�和认�默认被�止。"
+
+#~ msgid ""
+#~ "For security reasons, the Debian version of ssh has ForwardX11 and "
+#~ "ForwardAgent set to ``off'' by default."
+#~ msgstr ""
+#~ "因为安全性原因，默认情况下 Debian 版本的 ssh 将 ForwardX11 和 "
+#~ "ForwardAgent 设置为 off。"
+
+#~ msgid ""
+#~ "You can enable it for servers you trust, either in one of the "
+#~ "configuration files, or with the -X command line option."
+#~ msgstr ""
+#~ "您�以为信赖的�务器�用这个选项，�以通过其中之一的�置文件或者使用 -X 命"
+#~ "令行选项�实现。"
+
+#~ msgid "More details can be found in /usr/share/doc/ssh/README.Debian"
+#~ msgstr "更多细节�以在 /usr/share/doc/ssh/README.Debian 找到"
+
+#~ msgid "ssh2 keys merged in configuration files"
+#~ msgstr "ssh2 密钥被�并到�置文件"
+
+#~ msgid ""
+#~ "As of version 3 OpenSSH no longer uses separate files for ssh1 and ssh2 "
+#~ "keys. This means the authorized_keys2 and known_hosts2 files are no "
+#~ "longer needed. They will still be read in order to maintain backwards "
+#~ "compatibility"
+#~ msgstr ""
+#~ "在 OpenSSH 第 3 版��为 ssh1 和 ssh2 的密钥使用��的文件。这�味� "
+#~ "authorized_keys2 和 known_hosts2 文件将��需�。但为了����兼容性，它"
+#~ "们�会被读�。"
+
+#~ msgid "Do you want to run the sshd server?"
+#~ msgstr "您��行 sshd �务器�？"
+
+#~ msgid "This package contains both the ssh client, and the sshd server."
+#~ msgstr "这个软件包内� ssh 客户端和 sshd �务器。"
+
+#~ msgid ""
+#~ "Normally the sshd Secure Shell Server will be run to allow remote logins "
+#~ "via ssh."
+#~ msgstr "通常 sshd 安全 Shell �务器都会�行以便�许通过 ssh 进行远程登录。"
+
+#~ msgid ""
+#~ "If you are only interested in using the ssh client for outbound "
+#~ "connections on this machine, and don't want to log into it at all using "
+#~ "ssh, then you can disable sshd here."
+#~ msgstr ""
+#~ "如果您��在这�机器上使用 ssh 客户端对外连接，完全�想通过 ssh 登录到本"
+#~ "机，那么您�以在这里�用 sshd �务器。"
+
+#~ msgid "Environment options on keys have been deprecated"
+#~ msgstr "密钥的环境选项已被废弃"
+
+#~ msgid ""
+#~ "This version of OpenSSH disables the environment option for public keys "
+#~ "by default, in order to avoid certain attacks (for example, LD_PRELOAD). "
+#~ "If you are using this option in an authorized_keys file, beware that the "
+#~ "keys in question will no longer work until the option is removed."
+#~ msgstr ""
+#~ "为了��一些攻击(如 LD_PRELOAD)，这个版本的 OpenSSH 默认�用了公钥上的环境"
+#~ "选项。如果您在�个授�密钥(authorized_keys)文件中用了这个�数，请注�除�"
+#~ "删除了此选项，�则这个�疑的密钥将��起作用。"
+
+#~ msgid ""
+#~ "To re-enable this option, set \"PermitUserEnvironment yes\" in /etc/ssh/"
+#~ "sshd_config after the upgrade is complete, taking note of the warning in "
+#~ "the sshd_config(5) manual page."
+#~ msgstr ""
+#~ "��新�用这个选项，�级完��请在 /etc/ssh/sshd_config 中加入一"
+#~ "行：“PermitUserEnvironment yes�。请注� sshd_config(5) 手册页中�到的警"
+#~ "告。"
+
+#~ msgid "Privilege separation"
+#~ msgstr "��分离"
+
+#~ msgid ""
+#~ "Privilege separation is turned on by default, so if you decide you want "
+#~ "it turned off, you need to add \"UsePrivilegeSeparation no\" to /etc/ssh/"
+#~ "sshd_config."
+#~ msgstr ""
+#~ "��分离选项是默认打开的。如果想�关闭此选项，您需�在 /etc/ssh/"
+#~ "sshd_config 文件中添加一行“UsePrivilegeSeparation no�。"
+
+#~ msgid "Enable Privilege separation"
+#~ msgstr "�用��分离"
+
+#~ msgid ""
+#~ "This version of OpenSSH contains the new privilege separation option. "
+#~ "This significantly reduces the quantity of code that runs as root, and "
+#~ "therefore reduces the impact of security holes in sshd."
+#~ msgstr ""
+#~ "这个版本的 OpenSSH 包�了一个新的��分离的选项，目的是为了�少以 root �"
+#~ "行的代�数目，进而�少了 sshd 被安全�洞影�的机会。"
+
+#~ msgid ""
+#~ "Unfortunately, privilege separation interacts badly with PAM. Any PAM "
+#~ "session modules that need to run as root (pam_mkhomedir, for example) "
+#~ "will fail, and PAM keyboard-interactive authentication won't work."
+#~ msgstr ""
+#~ "�幸的是，��分离和 PAM �时使用会很糟糕。任何需�以 root �行的 PAM 会�"
+#~ "模� (如 pam_mkhomedir) 都会失败，而且 PAM 键盘交互�认�都�起作用。"
+
+#~ msgid ""
+#~ "Since you've opted to have me generate an sshd_config file for you, you "
+#~ "can choose whether or not to have privilege separation turned on or not. "
+#~ "Unless you know you need to use PAM features that won't work with this "
+#~ "option, you should enable it."
+#~ msgstr ""
+#~ "因为您选择了让我为您生� sshd_config 文件，您�以选择是�打开��分离选"
+#~ "项。除�您知�需�使用 PAM 这个�能和��分离�时工作的功能，�则就应该�"
+#~ "用它。"
diff --git a/debian/rules b/debian/rules
new file mode 100755
index 000000000..1c58630f3
--- /dev/null
+++ b/debian/rules
@@ -0,0 +1,218 @@
+#!/usr/bin/make -f
+
+# Uncomment this to turn on verbose mode.
+# export DH_VERBOSE=1
+
+include /usr/share/hardening-includes/hardening.make
+
+# This has to be exported to make some magic below work.
+export DH_OPTIONS
+
+ifeq (,$(filter noopt,$(DEB_BUILD_OPTIONS)))
+OPTFLAGS := -O2
+else
+OPTFLAGS := -O0
+endif
+
+ifeq (,$(filter nocheck,$(DEB_BUILD_OPTIONS)))
+  RUN_TESTS := yes
+else
+  RUN_TESTS :=
+endif
+
+DEB_HOST_GNU_TYPE  ?= $(shell dpkg-architecture -qDEB_HOST_GNU_TYPE)
+DEB_BUILD_GNU_TYPE ?= $(shell dpkg-architecture -qDEB_BUILD_GNU_TYPE)
+
+ifeq ($(DEB_BUILD_GNU_TYPE),$(DEB_HOST_GNU_TYPE))
+  CC := gcc
+else
+  CC := $(DEB_HOST_GNU_TYPE)-gcc
+  RUN_TESTS :=
+endif
+
+DEB_HOST_ARCH_OS := $(shell dpkg-architecture -qDEB_HOST_ARCH_OS 2>/dev/null)
+DEB_HOST_ARCH_CPU := $(shell dpkg-architecture -qDEB_HOST_ARCH_CPU 2>/dev/null)
+
+# Take account of old dpkg-architecture output.
+ifeq ($(DEB_HOST_ARCH_OS),)
+  DEB_HOST_ARCH_OS := $(subst -gnu,,$(shell dpkg-architecture -qDEB_HOST_GNU_SYSTEM))
+  ifeq ($(DEB_HOST_ARCH_OS),gnu)
+    DEB_HOST_ARCH_OS := hurd
+  endif
+endif
+ifeq ($(DEB_HOST_ARCH_CPU),)
+  DEB_HOST_ARCH_CPU := $(shell dpkg-architecture -qDEB_HOST_GNU_CPU)
+  ifeq ($(DEB_HOST_ARCH_CPU),x86_64)
+    DEB_HOST_ARCH_CPU := amd64
+  endif
+endif
+
+ifneq (,$(findstring :$(DEB_HOST_ARCH_OS):,:linux:knetbsd:))
+  ifneq (,$(findstring :$(DEB_HOST_ARCH_CPU):,:mips:mipsel:))
+    # Apparently this is not implied by -fPIE, at least on the mipsen.
+    PIC_CFLAGS := -fPIC
+    PIC_LDFLAGS := -fPIC
+  endif
+endif
+
+# Change the version string to include the Debian version
+SSH_EXTRAVERSION := Debian-$(shell dpkg-parsechangelog | sed -n -e '/^Version:/s/Version: //p' | sed -e 's/[^-]*-//')
+
+DISTRIBUTOR := $(shell lsb_release -is 2>/dev/null || echo Debian)
+ifeq ($(DISTRIBUTOR),Ubuntu)
+DEFAULT_PATH := /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/bin/X11:/usr/games
+else
+DEFAULT_PATH := /usr/local/bin:/usr/bin:/bin:/usr/bin/X11:/usr/games
+endif
+SUPERUSER_PATH := /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/bin/X11
+
+# Common path configuration.
+confflags += --sysconfdir=/etc/ssh
+
+# Common build options.
+confflags += --disable-strip
+confflags += --with-mantype=doc
+confflags += --with-4in6
+confflags += --with-privsep-path=/var/run/sshd
+confflags += --without-rand-helper
+
+# The Hurd needs libcrypt for res_query et al.
+ifeq ($(DEB_HOST_ARCH_OS),hurd)
+confflags += --with-libs=-lcrypt
+endif
+
+# Everything above here is common to the deb and udeb builds.
+confflags_udeb := $(confflags)
+
+# Options specific to the deb build.
+confflags += --with-tcp-wrappers
+confflags += --with-pam
+confflags += --with-libedit
+confflags += --with-kerberos5=/usr
+confflags += --with-ssl-engine
+ifeq ($(DEB_HOST_ARCH_OS),linux)
+confflags += --with-selinux
+endif
+
+# The deb build wants xauth; the udeb build doesn't.
+confflags += --with-xauth=/usr/bin/xauth
+confflags_udeb += --without-xauth
+
+# Default paths. The udeb build has /usr/bin/X11 and /usr/games removed.
+confflags += --with-default-path=$(DEFAULT_PATH) --with-superuser-path=$(SUPERUSER_PATH)
+confflags_udeb += --with-default-path=/usr/local/bin:/usr/bin:/bin --with-superuser-path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+
+# Compiler flags.
+cflags := $(OPTFLAGS) $(PIC_CFLAGS) $(HARDENING_CFLAGS)
+cflags += -DLOGIN_PROGRAM=\"/bin/login\" -DLOGIN_NO_ENDOPT
+cflags += -DSSH_EXTRAVERSION=\"$(SSH_EXTRAVERSION)\"
+cflags_udeb := -Os
+cflags_udeb += -DSSH_EXTRAVERSION=\"$(SSH_EXTRAVERSION)\"
+confflags += --with-cflags='$(cflags)'
+confflags_udeb += --with-cflags='$(cflags_udeb)'
+
+# Linker flags.
+confflags += --with-ldflags='$(strip -Wl,--as-needed $(PIC_LDFLAGS) $(HARDENING_LDFLAGS))'
+confflags_udeb += --with-ldflags='-Wl,--as-needed'
+
+%:
+        dh $@
+
+override_dh_auto_configure:
+        dh_auto_configure -Bbuild-deb -- $(confflags)
+        dh_auto_configure -Bbuild-udeb -- $(confflags_udeb)
+
+override_dh_auto_build:
+        # Debian's /var/log/btmp has inappropriate permissions.
+        perl -pi -e 's,.*#define USE_BTMP .*,/* #undef USE_BTMP */,' build-deb/config.h
+        perl -pi -e 's,.*#define USE_BTMP .*,/* #undef USE_BTMP */,' build-udeb/config.h
+
+        # Avoid libnsl linkage. Ugh.
+        perl -pi -e 's/ +-lnsl//' build-udeb/config.status
+        cd build-udeb && ./config.status
+
+        $(MAKE) -C build-deb -j 2 ASKPASS_PROGRAM='/usr/bin/ssh-askpass'
+        $(MAKE) -C build-udeb -j 2 ASKPASS_PROGRAM='/usr/bin/ssh-askpass' ssh scp sftp sshd ssh-keygen
+
+        $(MAKE) -C contrib gnome-ssh-askpass2 CC='$(CC) $(OPTFLAGS) -g -Wall -Wl,--as-needed'
+
+override_dh_auto_test:
+ifeq ($(RUN_TESTS),yes)
+        $(MAKE) -C debian/tests
+endif
+
+override_dh_auto_clean:
+        rm -rf build-deb build-udeb
+ifeq ($(RUN_TESTS),yes)
+        $(MAKE) -C debian/tests clean
+endif
+        $(MAKE) -C contrib clean
+        (cat debian/copyright.head; iconv -f ISO-8859-1 -t UTF-8 LICENCE) \
+                > debian/copyright
+
+override_dh_auto_install:
+        $(MAKE) -C build-deb DESTDIR=`pwd`/debian/tmp install-nokeys
+
+override_dh_install:
+        rm -f debian/tmp/etc/ssh/sshd_config
+
+        dh_install -Nopenssh-client-udeb -Nopenssh-server-udeb --fail-missing
+        dh_install -popenssh-client-udeb -popenssh-server-udeb \
+                --sourcedir=build-udeb
+
+        install -s -o root -g root -m 755 contrib/gnome-ssh-askpass2 debian/ssh-askpass-gnome/usr/lib/openssh/gnome-ssh-askpass
+
+        install -o root -g root debian/openssh-server.if-up debian/openssh-server/etc/network/if-up.d/openssh-server
+        install -o root -g root -m 644 debian/openssh-server.ufw.profile debian/openssh-server/etc/ufw/applications.d/openssh-server
+
+        # Remove version control tags to avoid unnecessary conffile
+        # resolution steps for administrators.
+        sed -i '/\$$OpenBSD:/d' \
+                debian/openssh-client/etc/ssh/moduli \
+                debian/openssh-client/etc/ssh/ssh_config
+
+override_dh_installdocs:
+        dh_installdocs -Nopenssh-server -Nssh
+        dh_installdocs -popenssh-server -pssh --link-doc=openssh-client
+        # Avoid breaking dh_installexamples later.
+        mkdir -p debian/openssh-server/usr/share/doc/openssh-client
+
+override_dh_installinit:
+        dh_installinit -n --name ssh
+
+override_dh_installpam:
+        dh_installpam --name sshd
+
+override_dh_fixperms:
+        dh_fixperms
+        chmod u+s debian/openssh-client/usr/lib/openssh/ssh-keysign
+
+override_dh_installdeb:
+        dh_installdeb
+        perl -i debian/substitute-conffile.pl \
+                ETC_SSH_MODULI debian/openssh-client/etc/ssh/moduli \
+                ETC_SSH_SSH_CONFIG debian/openssh-client/etc/ssh/ssh_config \
+                debian/openssh-client/DEBIAN/preinst
+        # Yes, ETC_PAM_D_SSH is meant to be spelled that way, to match the
+        # old configuration file name we need to transfer.
+        perl -i debian/substitute-conffile.pl \
+                ETC_DEFAULT_SSH debian/openssh-server/etc/default/ssh \
+                ETC_INIT_D_SSH debian/openssh-server/etc/init.d/ssh \
+                ETC_PAM_D_SSH debian/openssh-server/etc/pam.d/sshd \
+                debian/openssh-server/DEBIAN/preinst
+
+debian/faq.html:
+        wget -O - http://www.openssh.org/faq.html | \
+                sed 's,\(href="\)\(txt/\|[^":]*\.html\),\1http://www.openssh.org/\2,g' \
+                > debian/faq.html
+
+# You only need to run this immediately after checking out the package from
+# revision control.
+quilt-setup:
+        [ ! -d .pc ]
+        set -e; for patch in $$(quilt series | tac); do \
+                patch -p1 -R --no-backup-if-mismatch <"debian/patches/$$patch"; \
+        done
+        quilt push -a
+
+.PHONY: quilt-setup
diff --git a/debian/source.lintian-overrides b/debian/source.lintian-overrides
new file mode 100644
index 000000000..5ddb25600
--- /dev/null
+++ b/debian/source.lintian-overrides
@@ -0,0 +1,2 @@
+# .desktop file intentionally not installed
+openssh source: desktop-file-but-no-dh_desktop-call
diff --git a/debian/source/format b/debian/source/format
new file mode 100644
index 000000000..163aaf8d8
--- /dev/null
+++ b/debian/source/format
@@ -0,0 +1 @@
+3.0 (quilt)
diff --git a/debian/source/include-binaries b/debian/source/include-binaries
new file mode 100644
index 000000000..df5790e2e
--- /dev/null
+++ b/debian/source/include-binaries
@@ -0,0 +1 @@
+debian/ssh-askpass-gnome.png
diff --git a/debian/ssh-argv0 b/debian/ssh-argv0
new file mode 100644
index 000000000..67599aec2
--- /dev/null
+++ b/debian/ssh-argv0
@@ -0,0 +1,30 @@
+#! /bin/sh -e
+
+# Copyright (c) 2001 Jonathan Amery.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+# OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+# IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+# NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+if [ "${0##*/}" = "ssh-argv0" ]
+then
+  echo 'ssh-argv0: This script should not be run like this, see ssh-argv0(1) for details' 1>&2
+  exit 1
+fi
+exec ssh "${0##*/}" "$@"
diff --git a/debian/ssh-argv0.1 b/debian/ssh-argv0.1
new file mode 100644
index 000000000..a36a63d40
--- /dev/null
+++ b/debian/ssh-argv0.1
@@ -0,0 +1,64 @@
+.Dd September 7, 2001 
+.Dt SSH-ARGV0 1
+.Os Debian Project
+.Sh NAME
+.Nm ssh-argv0
+.Nd replaces the old ssh command-name as hostname handling
+.Sh SYNOPSIS
+.Ar hostname | user@hostname
+.Op Fl l Ar login_name
+.Op Ar command
+.Pp
+.Ar hostname | user@hostname
+.Op Fl afgknqstvxACNTX1246
+.Op Fl b Ar bind_address
+.Op Fl c Ar cipher_spec
+.Op Fl e Ar escape_char
+.Op Fl i Ar identity_file
+.Op Fl l Ar login_name
+.Op Fl m Ar mac_spec
+.Op Fl o Ar option
+.Op Fl p Ar port
+.Op Fl F Ar configfile
+.Oo Fl L Xo
+.Sm off
+.Ar port :
+.Ar host :
+.Ar hostport
+.Sm on
+.Xc
+.Oc
+.Oo Fl R Xo
+.Sm off
+.Ar port :
+.Ar host :
+.Ar hostport
+.Sm on
+.Xc
+.Oc
+.Op Fl D Ar port
+.Op Ar command
+.Sh DESCRIPTION
+.Nm
+replaces the old ssh command-name as hostname handling.
+If you link to this script with a hostname then executing the link is
+equivalent to having executed ssh with that hostname as an argument.
+All other arguments are passed to ssh and will be processed normally.
+.Sh OPTIONS
+See
+.Xr ssh 1 .
+.Sh FILES
+See
+.Xr ssh 1 .
+.Sh AUTHORS
+OpenSSH is a derivative of the original and free
+ssh 1.2.12 release by Tatu Ylonen.
+Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos,
+Theo de Raadt and Dug Song
+removed many bugs, re-added newer features and
+created OpenSSH.
+Markus Friedl contributed the support for SSH
+protocol versions 1.5 and 2.0.
+Jonathan Amery wrote this ssh-argv0 script and the associated documentation.
+.Sh SEE ALSO
+.Xr ssh 1
diff --git a/debian/ssh-askpass-gnome.copyright b/debian/ssh-askpass-gnome.copyright
new file mode 100644
index 000000000..4a71dda00
--- /dev/null
+++ b/debian/ssh-askpass-gnome.copyright
@@ -0,0 +1,44 @@
+This package contains a Gnome based implementation of ssh-askpass
+written by Damien Miller.
+
+It is split out from the main package to isolate the dependency on the
+Gnome and X11 libraries.
+
+It was packaged for Debian by Philip Hands <phil@hands.com>.
+
+Copyright:
+
+/*
+**
+** GNOME ssh passphrase requestor
+**
+** Damien Miller <djm@ibs.com.au>
+** 
+** Copyright 1999 Internet Business Solutions
+**
+** Permission is hereby granted, free of charge, to any person
+** obtaining a copy of this software and associated documentation
+** files (the "Software"), to deal in the Software without
+** restriction, including without limitation the rights to use, copy,
+** modify, merge, publish, distribute, sublicense, and/or sell copies
+** of the Software, and to permit persons to whom the Software is
+** furnished to do so, subject to the following conditions:
+**
+** The above copyright notice and this permission notice shall be
+** included in all copies or substantial portions of the Software.
+**
+** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY
+** KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
+** WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE
+** AND NONINFRINGEMENT.  IN NO EVENT SHALL DAMIEN MILLER OR INTERNET
+** BUSINESS SOLUTIONS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+** ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE
+** OR OTHER DEALINGS IN THE SOFTWARE.
+**
+** Except as contained in this notice, the name of Internet Business
+** Solutions shall not be used in advertising or otherwise to promote
+** the sale, use or other dealings in this Software without prior
+** written authorization from Internet Business Solutions.
+**
+*/
diff --git a/debian/ssh-askpass-gnome.desktop b/debian/ssh-askpass-gnome.desktop
new file mode 100644
index 000000000..eba7a67d1
--- /dev/null
+++ b/debian/ssh-askpass-gnome.desktop
@@ -0,0 +1,12 @@
+[Desktop Entry]
+Version=1.0
+Encoding=UTF-8
+Name=SSH AskPass
+GenericName=ssh-add
+Comment=Enter passphrase to authenticate to the ssh agent
+Exec=/usr/bin/ssh-add
+TryExec=ssh-add
+Terminal=false
+Type=Application
+Icon=ssh-askpass-gnome
+Categories=Network;Security;
diff --git a/debian/ssh-askpass-gnome.dirs b/debian/ssh-askpass-gnome.dirs
new file mode 100644
index 000000000..0ffa45024
--- /dev/null
+++ b/debian/ssh-askpass-gnome.dirs
@@ -0,0 +1,3 @@
+usr/lib/openssh
+usr/share/man/man1
+usr/share/pixmaps
diff --git a/debian/ssh-askpass-gnome.examples b/debian/ssh-askpass-gnome.examples
new file mode 100644
index 000000000..66fd8c0e4
--- /dev/null
+++ b/debian/ssh-askpass-gnome.examples
@@ -0,0 +1 @@
+debian/ssh-askpass-gnome.desktop
diff --git a/debian/ssh-askpass-gnome.install b/debian/ssh-askpass-gnome.install
new file mode 100644
index 000000000..8b6b5f045
--- /dev/null
+++ b/debian/ssh-askpass-gnome.install
@@ -0,0 +1 @@
+debian/ssh-askpass-gnome.png usr/share/pixmaps
diff --git a/debian/ssh-askpass-gnome.manpages b/debian/ssh-askpass-gnome.manpages
new file mode 100644
index 000000000..7749f13bb
--- /dev/null
+++ b/debian/ssh-askpass-gnome.manpages
@@ -0,0 +1 @@
+debian/gnome-ssh-askpass.1
diff --git a/debian/ssh-askpass-gnome.png b/debian/ssh-askpass-gnome.png
new file mode 100644
index 000000000..06f75764e
--- /dev/null
+++ b/debian/ssh-askpass-gnome.png
diff --git a/debian/ssh-askpass-gnome.postinst b/debian/ssh-askpass-gnome.postinst
new file mode 100644
index 000000000..b6c56d4e7
--- /dev/null
+++ b/debian/ssh-askpass-gnome.postinst
@@ -0,0 +1,65 @@
+#! /bin/sh
+# postinst script for ssh-askpass-gnome
+#
+# see: dh_installdeb(1)
+
+set -e
+
+# summary of how this script can be called:
+#        * <postinst> `configure' <most-recently-configured-version>
+#        * <old-postinst> `abort-upgrade' <new version>
+#        * <conflictor's-postinst> `abort-remove' `in-favour' <package>
+#          <new-version>
+#        * <deconfigured's-postinst> `abort-deconfigure' `in-favour'
+#          <failed-install-package> <version> `removing'
+#          <conflicting-package> <version>
+# for details, see /usr/share/doc/packaging-manual/
+#
+# quoting from the policy:
+#     Any necessary prompting should almost always be confined to the
+#     post-installation script, and should be protected with a conditional
+#     so that unnecessary prompting doesn't happen if a package's
+#     installation fails and the `postinst' is called with `abort-upgrade',
+#     `abort-remove' or `abort-deconfigure'.
+
+case "$1" in
+    configure)
+        if dpkg --compare-versions "$2" lt-nl 1:4.1p1-1; then
+            # libexecdir changed, so remove the obsolete alternative.
+            update-alternatives --quiet --remove ssh-askpass \
+                /usr/lib/ssh/gnome-ssh-askpass
+        fi
+        if dpkg --compare-versions "$2" lt-nl 1:4.1p1-7 && \
+                [ -h /etc/alternatives/ssh-askpass ] && \
+                [ "$(readlink /etc/alternatives/ssh-askpass)" = /usr/lib/ssh/gnome-ssh-askpass ]; then
+            # Work around the ssh-askpass alternative somehow ending up in
+            # manual mode.
+            update-alternatives --auto ssh-askpass
+        fi
+        update-alternatives --quiet \
+            --install /usr/bin/ssh-askpass ssh-askpass \
+                      /usr/lib/openssh/gnome-ssh-askpass 30 \
+            --slave /usr/share/man/man1/ssh-askpass.1.gz \
+                    ssh-askpass.1.gz /usr/share/man/man1/gnome-ssh-askpass.1.gz
+
+
+    ;;
+
+    abort-upgrade|abort-remove|abort-deconfigure)
+
+    ;;
+
+    *)
+        echo "postinst called with unknown argument \`$1'" >&2
+        exit 0
+    ;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
+
+
diff --git a/debian/ssh-askpass-gnome.prerm b/debian/ssh-askpass-gnome.prerm
new file mode 100644
index 000000000..e85f2d4a7
--- /dev/null
+++ b/debian/ssh-askpass-gnome.prerm
@@ -0,0 +1,41 @@
+#! /bin/sh
+# prerm script for ssh-askpass-gnome
+#
+# see: dh_installdeb(1)
+
+set -e
+
+# summary of how this script can be called:
+#        * <prerm> `remove'
+#        * <old-prerm> `upgrade' <new-version>
+#        * <new-prerm> `failed-upgrade' <old-version>
+#        * <conflictor's-prerm> `remove' `in-favour' <package> <new-version>
+#        * <deconfigured's-prerm> `deconfigure' `in-favour'
+#          <package-being-installed> <version> `removing'
+#          <conflicting-package> <version>
+# for details, see /usr/share/doc/packaging-manual/
+
+case "$1" in
+    remove|deconfigure)
+        update-alternatives --quiet --remove ssh-askpass /usr/lib/openssh/gnome-ssh-askpass
+#       install-info --quiet --remove /usr/info/ssh-askpass.info.gz
+        ;;
+    upgrade)
+#       install-info --quiet --remove /usr/info/ssh-askpass.info.gz
+        ;;
+    failed-upgrade)
+        ;;
+    *)
+        echo "prerm called with unknown argument \`$1'" >&2
+        exit 0
+    ;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
+
+
diff --git a/debian/ssh-krb5.NEWS b/debian/ssh-krb5.NEWS
new file mode 100644
index 000000000..5a6433ab2
--- /dev/null
+++ b/debian/ssh-krb5.NEWS
@@ -0,0 +1,18 @@
+ssh-krb5 (1:4.3p2-7) unstable; urgency=low
+
+  The normal openssh-server and openssh-client packages in Debian now
+  include full GSSAPI support, including key exchange.  This package is
+  now only a transitional package that depends on openssh-server and
+  openssh-client and configures openssh-server for GSSAPI authentication
+  if it wasn't already.
+
+  You can now simply install openssh-server and openssh-client directly
+  and remove this package.  Just make sure that /etc/ssh/sshd_config
+  contains:
+
+    GSSAPIAuthentication yes
+    GSSAPIKeyExchange yes
+
+  if you want to support GSSAPI authentication to your ssh server.
+
+ -- Russ Allbery <rra@debian.org>  Tue, 03 Oct 2006 22:27:27 -0700
diff --git a/debian/ssh-krb5.postinst b/debian/ssh-krb5.postinst
new file mode 100644
index 000000000..4d943d861
--- /dev/null
+++ b/debian/ssh-krb5.postinst
@@ -0,0 +1,73 @@
+#!/bin/sh
+
+set -e
+
+action="$1"
+oldversion="$2"
+
+if [ "$action" = configure ] ; then
+    if dpkg --compare-versions "$oldversion" lt-nl 1:4.3p2-7; then
+        # Replaced by /etc/init.d/ssh.
+        if [ -f /etc/init.d/ssh-krb5 ]; then
+            mv /etc/init.d/ssh-krb5 /etc/init.d/ssh-krb5.dpkg-old
+            update-rc.d ssh-krb5 remove || true
+        fi
+    fi
+
+    # Make sure that GSSAPI is enabled.  If there is no uncommented GSSAPI
+    # configuration, uncomment any commented-out configuration if present
+    # (this will catch the case of a fresh install of openssh-server).
+    # Otherwise, add configuration turning on GSSAPIAuthentication and
+    # GSSAPIKeyExchange.
+    #
+    # If there is some configuration, we may be upgrading from ssh-krb5.  It
+    # enabled GSSAPIKeyExchange without any configuration option.  Therefore,
+    # if it isn't explicitly set, always enable it for compatible behavior
+    # with ssh-krb5.
+    if dpkg --compare-versions "$oldversion" ge 1:4.3p2-9; then
+        :
+    else
+        changed=
+        if grep -qi '^[         ]*GSSAPI' /etc/ssh/sshd_config ; then
+            if grep -qi '^[     ]*GSSAPIKeyExchange' /etc/ssh/sshd_config ; then
+                :
+            else
+                changed=true
+                cat >> /etc/ssh/sshd_config <<EOF
+
+# GSSAPI key exchange (added by ssh-krb5 transitional package)
+GSSAPIKeyExchange yes
+EOF
+            fi
+        else
+            changed=true
+            if grep -qi '^#GSSAPI' /etc/ssh/sshd_config ; then
+                perl -pe 's/^\#(GSSAPI(Authentication|KeyExchange))\b.*/$1 yes/i' \
+                    < /etc/ssh/sshd_config > /etc/ssh/sshd_config.dpkg-new
+                chown --reference /etc/ssh/sshd_config \
+                    /etc/ssh/sshd_config.dpkg-new
+                chmod --reference /etc/ssh/sshd_config \
+                    /etc/ssh/sshd_config.dpkg-new
+                mv /etc/ssh/sshd_config.dpkg-new /etc/ssh/sshd_config
+            else
+                cat >> /etc/ssh/sshd_config <<EOF
+
+# GSSAPI authentication (added by ssh-krb5 transitional package)
+GSSAPIAuthentication yes
+GSSAPIKeyExchange yes
+EOF
+            fi
+        fi
+        if [ -n "$changed" ] && [ -x /etc/init.d/ssh ] ; then
+            if [ -x /usr/sbin/invoke-rc.d ] ; then
+                invoke-rc.d ssh restart
+            else
+                /etc/init.d/ssh restart
+            fi
+        fi
+    fi
+fi
+
+#DEBHELPER#
+
+exit 0
diff --git a/debian/ssh.dirs b/debian/ssh.dirs
new file mode 100644
index 000000000..1da8fba83
--- /dev/null
+++ b/debian/ssh.dirs
@@ -0,0 +1 @@
+usr/share/lintian/overrides
diff --git a/debian/ssh.lintian-overrides b/debian/ssh.lintian-overrides
new file mode 100644
index 000000000..b9bf7ea08
--- /dev/null
+++ b/debian/ssh.lintian-overrides
@@ -0,0 +1 @@
+ssh: package-contains-empty-directory usr/share/doc/openssh-client/
diff --git a/debian/ssh.postinst b/debian/ssh.postinst
new file mode 100644
index 000000000..cb1278033
--- /dev/null
+++ b/debian/ssh.postinst
@@ -0,0 +1,18 @@
+#!/bin/sh -e
+
+action="$1"
+oldversion="$2"
+
+if [ "$action" != configure ]; then
+        exit 0
+fi
+
+if [ ! -L /usr/share/doc/ssh ] && \
+   dpkg --compare-versions "$oldversion" lt-nl 1:4.1p1-5; then
+        rm -rf /usr/share/doc/ssh
+        ln -s openssh-client /usr/share/doc/ssh
+fi
+
+#DEBHELPER#
+
+exit 0
diff --git a/debian/ssh.prerm b/debian/ssh.prerm
new file mode 100644
index 000000000..400c92bed
--- /dev/null
+++ b/debian/ssh.prerm
@@ -0,0 +1,14 @@
+#!/bin/sh -e
+
+case $1 in
+        upgrade)
+                if [ -L /usr/share/doc/ssh ] && \
+                   dpkg --compare-versions "$2" lt-nl 1:4.1p1-5; then
+                        rm -f /usr/share/doc/ssh
+                fi
+                ;;
+esac
+
+#DEBHELPER#
+
+exit 0
diff --git a/debian/substitute-conffile.pl b/debian/substitute-conffile.pl
new file mode 100644
index 000000000..7dd23363e
--- /dev/null
+++ b/debian/substitute-conffile.pl
@@ -0,0 +1,26 @@
+#! /usr/bin/perl -p
+
+# This is needed for a nasty preinst hack to work around a bug in sarge's
+# version of dpkg. It substitutes the literal text of conffiles into preinst
+# scripts so that they can be used when moving conffiles between packages.
+
+BEGIN {
+    %texts = ();
+    while (@ARGV > 1) {
+        my $name = $ARGV[0];
+        shift;
+        local *FILE;
+        open FILE, '<', $ARGV[0];
+        local $/ = undef;
+        my $text = <FILE>;
+        close FILE;
+        # Quote for the shell.
+        $text =~ s/'/'\\''/g;
+        shift;
+        $texts{$name} = $text;
+    }
+}
+
+for my $name (keys %texts) {
+    s/\@$name\@/'$texts{$name}'/g;
+}
diff --git a/debian/tests/Makefile b/debian/tests/Makefile
new file mode 100644
index 000000000..666ed8227
--- /dev/null
+++ b/debian/tests/Makefile
@@ -0,0 +1,12 @@
+test: getpid.so
+        chmod +x keygen-test
+        ./keygen-test
+
+getpid.o: getpid.c
+        gcc -fPIC -c $< -o $@
+
+getpid.so: getpid.o
+        gcc -shared -o $@ $<
+
+clean:
+        rm -f getpid.o getpid.so key1 key1.pub key2 key2.pub
diff --git a/debian/tests/getpid.c b/debian/tests/getpid.c
new file mode 100644
index 000000000..c9e35b87e
--- /dev/null
+++ b/debian/tests/getpid.c
@@ -0,0 +1,39 @@
+/*
+ * Compile:
+
+gcc -fPIC -c getpid.c -o getpid.o
+gcc -shared -o getpid.so getpid.o
+
+ * Use:
+ 
+FORCE_PID=1234 LD_PRELOAD=./getpid.so bash
+
+#
+# Copyright (C) 2001-2008 Kees Cook
+# kees@outflux.net, http://outflux.net/
+# 
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+# 
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
+# http://www.gnu.org/copyleft/gpl.html
+
+*/
+
+#include <sys/types.h>
+#include <unistd.h>
+#include <stdlib.h>
+
+pid_t getpid(void)
+{
+    return atoi(getenv("FORCE_PID"));
+}
diff --git a/debian/tests/keygen-test b/debian/tests/keygen-test
new file mode 100755
index 000000000..02b7c761a
--- /dev/null
+++ b/debian/tests/keygen-test
@@ -0,0 +1,12 @@
+#! /bin/sh
+
+rm -f key1 key1.pub key2 key2.pub
+LD_PRELOAD="$(pwd)/getpid.so" FORCE_PID=1234 \
+        ../../build-deb/ssh-keygen -N '' -f key1 >/dev/null
+LD_PRELOAD="$(pwd)/getpid.so" FORCE_PID=1234 \
+        ../../build-deb/ssh-keygen -N '' -f key2 >/dev/null
+if cmp -s key1 key2; then
+        echo "Generated two identical keys!" >&2
+        exit 1
+fi
+exit 0
diff --git a/debian/watch b/debian/watch
new file mode 100644
index 000000000..6ffdc3708
--- /dev/null
+++ b/debian/watch
@@ -0,0 +1,3 @@
+version=2
+ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-(.*)\.tar\.gz \
+  debian uupdate