13 files changed, 199 insertions, 80 deletions

diff --git a/regress/Makefile b/regress/Makefile
index 9e98e5880..4f47bc3fd 100644
--- a/regress/Makefile
+++ b/regress/Makefile
@@ -1,4 +1,4 @@
-#       $OpenBSD: Makefile,v 1.31 2004/06/24 19:32:00 djm Exp $
+#       $OpenBSD: Makefile,v 1.36 2005/03/04 08:48:46 djm Exp $
 
 REGRESS_TARGETS=        t1 t2 t3 t4 t5 t6 t7 t-exec
 tests:          $(REGRESS_TARGETS)
@@ -34,20 +34,22 @@ LTESTS= 	connect \
                 sftp-cmds \
                 sftp-badcmds \
                 sftp-batch \
+                sftp-glob \
                 reconfigure \
                 dynamic-forward \
                 forwarding \
                 multiplex \
-                reexec
+                reexec \
+                brokenkeys
 
 USER!=          id -un
 CLEANFILES=     t2.out t6.out1 t6.out2 t7.out t7.out.pub copy.1 copy.2 \
                 authorized_keys_${USER} known_hosts pidfile \
-                ssh_config ssh_proxy sshd_config sshd_proxy \
+                ssh_config sshd_config.orig ssh_proxy sshd_config sshd_proxy \
                 rsa.pub rsa rsa1.pub rsa1 host.rsa host.rsa1 \
                 rsa-agent rsa-agent.pub rsa1-agent rsa1-agent.pub \
                 ls.copy banner.in banner.out empty.in \
-                scp-ssh-wrapper.exe \
+                scp-ssh-wrapper.scp ssh_proxy_envpass \
                 remote_pid
 
 #LTESTS +=      ssh-com ssh-com-client ssh-com-keygen ssh-com-sftp
@@ -90,5 +92,5 @@ t-exec:	${LTESTS:=.sh}
         @if [ "x$?" = "x" ]; then exit 0; fi; \
         for TEST in ""$?; do \
                 echo "run test $${TEST}" ... 1>&2; \
-                (sh ${.CURDIR}/test-exec.sh ${.OBJDIR} ${.CURDIR}/$${TEST}) || exit $$?; \
+                (env SUDO=${SUDO} sh ${.CURDIR}/test-exec.sh ${.OBJDIR} ${.CURDIR}/$${TEST}) || exit $$?; \
         done
diff --git a/regress/agent-ptrace.sh b/regress/agent-ptrace.sh
index bd79d7cb8..4de2638e4 100644
--- a/regress/agent-ptrace.sh
+++ b/regress/agent-ptrace.sh
@@ -5,7 +5,7 @@ tid="disallow agent ptrace attach"
 
 if have_prog uname ; then
         case `uname` in
-        AIX|CYGWIN*)
+        AIX|CYGWIN*|OSF1)
                 echo "skipped (not supported on this platform)"
                 exit 0
                 ;;
@@ -41,7 +41,7 @@ EOF
         if [ $? -ne 0 ]; then
                 fail "gdb failed: exit code $?"
         fi
-        egrep 'ptrace: Operation not permitted.|procfs:.*Permission denied.|ttrace attach: Permission denied.' >/dev/null ${OBJ}/gdb.out
+        egrep 'ptrace: Operation not permitted.|procfs:.*Permission denied.|ttrace attach: Permission denied.|procfs:.*: Invalid argument.' >/dev/null ${OBJ}/gdb.out
         r=$?
         rm -f ${OBJ}/gdb.out
         if [ $r -ne 0 ]; then
diff --git a/regress/brokenkeys.sh b/regress/brokenkeys.sh
new file mode 100644
index 000000000..3e70c348a
--- /dev/null
+++ b/regress/brokenkeys.sh
@@ -0,0 +1,23 @@
+#       $OpenBSD: brokenkeys.sh,v 1.1 2004/10/29 23:59:22 djm Exp $
+#       Placed in the Public Domain.
+
+tid="broken keys"
+
+KEYS="$OBJ/authorized_keys_${USER}"
+
+start_sshd
+
+mv ${KEYS} ${KEYS}.bak
+
+# Truncated key
+echo "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEABTM= bad key" > $KEYS
+cat ${KEYS}.bak >> ${KEYS}
+cat $OBJ/$t.pub >> $OBJ/authorized_keys_$USER
+
+${SSH} -2 -F $OBJ/ssh_config somehost true
+if [ $? -ne 0 ]; then
+        fail "ssh connect with protocol $p failed"
+fi
+
+mv ${KEYS}.bak ${KEYS}
+
diff --git a/regress/dynamic-forward.sh b/regress/dynamic-forward.sh
index 392fc1978..4674a7baf 100644
--- a/regress/dynamic-forward.sh
+++ b/regress/dynamic-forward.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: dynamic-forward.sh,v 1.3 2004/02/28 12:16:57 dtucker Exp $
+#       $OpenBSD: dynamic-forward.sh,v 1.4 2004/06/22 22:55:56 dtucker Exp $
 #       Placed in the Public Domain.
 
 tid="dynamic forwarding"
@@ -44,4 +44,7 @@ for p in 1 2; do
         else
                 fail "no pid file: $OBJ/remote_pid"
         fi
+
+        # Must allow time for connection tear-down
+        sleep 2
 done
diff --git a/regress/envpass.sh b/regress/envpass.sh
index 5a7e178d8..af7eafe3d 100644
--- a/regress/envpass.sh
+++ b/regress/envpass.sh
@@ -1,13 +1,20 @@
-#       $OpenBSD: envpass.sh,v 1.3 2004/06/22 22:42:02 dtucker Exp $
+#       $OpenBSD: envpass.sh,v 1.4 2005/03/04 08:48:46 djm Exp $
 #       Placed in the Public Domain.
 
 tid="environment passing"
 
 # NB accepted env vars are in test-exec.sh (_XXX_TEST_* and _XXX_TEST)
 
+# Prepare a custom config to test for a configuration parsing bug fixed in 4.0
+cat << EOF > $OBJ/ssh_proxy_envpass
+Host test-sendenv-confparse-bug
+        SendEnv *
+EOF
+cat $OBJ/ssh_proxy >> $OBJ/ssh_proxy_envpass
+
 trace "pass env, don't accept"
 verbose "test $tid: pass env, don't accept"
-_TEST_ENV=blah ${SSH} -oSendEnv="*" -F $OBJ/ssh_proxy otherhost \
+_TEST_ENV=blah ${SSH} -oSendEnv="*" -F $OBJ/ssh_proxy_envpass otherhost \
         sh << 'EOF'
         test -z "$_TEST_ENV"
 EOF
@@ -18,7 +25,7 @@ fi
 
 trace "don't pass env, accept"
 verbose "test $tid: don't pass env, accept"
-${SSH} -F $OBJ/ssh_proxy otherhost \
+_XXX_TEST_A=1 _XXX_TEST_B=2 ${SSH} -F $OBJ/ssh_proxy_envpass otherhost \
         sh << 'EOF'
         test -z "$_XXX_TEST_A" && test -z "$_XXX_TEST_B"
 EOF
@@ -29,8 +36,8 @@ fi
 
 trace "pass single env, accept single env"
 verbose "test $tid: pass single env, accept single env"
-_XXX_TEST=blah ${SSH} -oSendEnv="_XXX_TEST" -F $OBJ/ssh_proxy otherhost \
-        sh << 'EOF'
+_XXX_TEST=blah ${SSH} -oSendEnv="_XXX_TEST" -F $OBJ/ssh_proxy_envpass \
+    otherhost sh << 'EOF'
         test X"$_XXX_TEST" = X"blah"
 EOF
 r=$?
@@ -41,7 +48,7 @@ fi
 trace "pass multiple env, accept multiple env"
 verbose "test $tid: pass multiple env, accept multiple env"
 _XXX_TEST_A=1 _XXX_TEST_B=2 ${SSH} -oSendEnv="_XXX_TEST_*" \
-    -F $OBJ/ssh_proxy otherhost \
+    -F $OBJ/ssh_proxy_envpass otherhost \
         sh << 'EOF'
         test X"$_XXX_TEST_A" = X"1" -a X"$_XXX_TEST_B" = X"2"
 EOF
@@ -49,3 +56,5 @@ r=$?
 if [ $r -ne 0 ]; then
         fail "environment not found"
 fi
+
+rm -f $OBJ/ssh_proxy_envpass
diff --git a/regress/login-timeout.sh b/regress/login-timeout.sh
index ce6edade5..15a887f74 100644
--- a/regress/login-timeout.sh
+++ b/regress/login-timeout.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: login-timeout.sh,v 1.3 2004/03/08 10:17:12 dtucker Exp $
+#       $OpenBSD: login-timeout.sh,v 1.4 2005/02/27 23:13:36 djm Exp $
 #       Placed in the Public Domain.
 
 tid="connect after login grace timeout"
@@ -8,7 +8,7 @@ echo "LoginGraceTime 10s" >> $OBJ/sshd_config
 echo "MaxStartups 1" >> $OBJ/sshd_config
 start_sshd
 
-(echo SSH-2.0-fake; sleep 60) | telnet localhost ${PORT} >/dev/null 2>&1 & 
+(echo SSH-2.0-fake; sleep 60) | telnet 127.0.0.1 ${PORT} >/dev/null 2>&1 & 
 sleep 15
 ${SSH} -F $OBJ/ssh_config somehost true
 if [ $? -ne 0 ]; then
@@ -21,7 +21,7 @@ trace "test login grace without privsep"
 echo "UsePrivilegeSeparation no" >> $OBJ/sshd_config
 start_sshd
 
-(echo SSH-2.0-fake; sleep 60) | telnet localhost ${PORT} >/dev/null 2>&1 & 
+(echo SSH-2.0-fake; sleep 60) | telnet 127.0.0.1 ${PORT} >/dev/null 2>&1 & 
 sleep 15
 ${SSH} -F $OBJ/ssh_config somehost true
 if [ $? -ne 0 ]; then
diff --git a/regress/multiplex.sh b/regress/multiplex.sh
index dbf2025be..e8cc1ac53 100644
--- a/regress/multiplex.sh
+++ b/regress/multiplex.sh
@@ -1,17 +1,28 @@
-#       $OpenBSD: multiplex.sh,v 1.8 2004/06/22 03:12:13 markus Exp $
+#       $OpenBSD: multiplex.sh,v 1.10 2005/02/27 11:33:30 dtucker Exp $
 #       Placed in the Public Domain.
 
 CTL=$OBJ/ctl-sock
 
 tid="connection multiplexing"
 
+if grep "#define.*DISABLE_FD_PASSING" ${BUILDDIR}/config.h >/dev/null 2>&1
+then
+        echo "skipped (not supported on this platform)"
+        exit 0
+fi
+
 DATA=/bin/ls${EXEEXT}
 COPY=$OBJ/ls.copy
+LOG=$TEST_SSH_LOGFILE
 
 start_sshd
 
 trace "start master, fork to background"
-${SSH} -2 -MS$CTL -F $OBJ/ssh_config -oSendEnv="_XXX_TEST" -f somehost sleep 120
+${SSH} -Nn2 -MS$CTL -F $OBJ/ssh_config -oSendEnv="_XXX_TEST" somehost &
+MASTER_PID=$!
+
+# Wait for master to start and authenticate
+sleep 5
 
 verbose "test $tid: envpass"
 trace "env passing over multiplexed connection"
@@ -38,13 +49,13 @@ cmp ${DATA} ${COPY}		|| fail "ssh -S ctl: corrupted copy of ${DATA}"
 rm -f ${COPY}
 trace "sftp transfer over multiplexed connection and check result"
 echo "get ${DATA} ${COPY}" | \
-        ${SFTP} -S ${SSH} -oControlPath=$CTL otherhost >/dev/null 2>&1
+        ${SFTP} -S ${SSH} -oControlPath=$CTL otherhost >$LOG 2>&1
 test -f ${COPY}                 || fail "sftp: failed copy ${DATA}" 
 cmp ${DATA} ${COPY}             || fail "sftp: corrupted copy of ${DATA}"
 
 rm -f ${COPY}
 trace "scp transfer over multiplexed connection and check result"
-${SCP} -S ${SSH} -oControlPath=$CTL otherhost:${DATA} ${COPY} >/dev/null 2>&1
+${SCP} -S ${SSH} -oControlPath=$CTL otherhost:${DATA} ${COPY} >$LOG 2>&1
 test -f ${COPY}                 || fail "scp: failed copy ${DATA}" 
 cmp ${DATA} ${COPY}             || fail "scp: corrupted copy of ${DATA}"
 
@@ -69,6 +80,15 @@ for s in 0 1 4 5 44; do
         fi
 done
 
-# kill master, remove control socket.  ssh -MS will exit when sleep exits
-$SUDO kill `cat $PIDFILE`
-rm -f $CTL
+trace "test check command"
+${SSH} -S $CTL -Ocheck otherhost || fail "check command failed" 
+
+trace "test exit command"
+${SSH} -S $CTL -Oexit otherhost || fail "send exit command failed" 
+
+# Wait for master to exit
+sleep 2
+
+ps -p $MASTER_PID >/dev/null && fail "exit command failed" 
+
+cleanup
diff --git a/regress/reexec.sh b/regress/reexec.sh
index 39fffefbc..d69b8c577 100644
--- a/regress/reexec.sh
+++ b/regress/reexec.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: reexec.sh,v 1.3 2004/06/25 01:32:44 djm Exp $
+#       $OpenBSD: reexec.sh,v 1.5 2004/10/08 02:01:50 djm Exp $
 #       Placed in the Public Domain.
 
 tid="reexec tests"
@@ -6,36 +6,40 @@ tid="reexec tests"
 DATA=/bin/ls
 COPY=${OBJ}/copy
 SSHD_ORIG=$SSHD
-SSHD_COPY=$OBJ/sshd.copy
+SSHD_COPY=$OBJ/sshd
 
 # Start a sshd and then delete it
-start_sshd_copy_zap ()
+start_sshd_copy ()
 {
         cp $SSHD_ORIG $SSHD_COPY
         SSHD=$SSHD_COPY
         start_sshd
-        rm -f $SSHD_COPY
         SSHD=$SSHD_ORIG
 }
 
+# Do basic copy tests
+copy_tests ()
+{
+        rm -f ${COPY}
+        for p in 1 2; do
+                verbose "$tid: proto $p"
+                ${SSH} -nqo "Protocol=$p" -F $OBJ/ssh_config somehost \
+                    cat ${DATA} > ${COPY}
+                if [ $? -ne 0 ]; then
+                        fail "ssh cat $DATA failed"
+                fi
+                cmp ${DATA} ${COPY}             || fail "corrupted copy"
+                rm -f ${COPY}
+        done
+}
+
 verbose "test config passing"
-cp $OBJ/sshd_config $OBJ/sshd_config.orig
 
+cp $OBJ/sshd_config $OBJ/sshd_config.orig
 start_sshd
-
 echo "InvalidXXX=no" >> $OBJ/sshd_config
 
-rm -f ${COPY}
-for p in 1 2; do
-        verbose "$tid: proto $p"
-        ${SSH} -nqo "Protocol=$p" -F $OBJ/ssh_config somehost \
-            cat ${DATA} > ${COPY}
-        if [ $? -ne 0 ]; then
-                fail "ssh cat $DATA failed"
-        fi
-        cmp ${DATA} ${COPY}             || fail "corrupted copy"
-        rm -f ${COPY}
-done
+copy_tests
 
 $SUDO kill `cat $PIDFILE`
 rm -f $PIDFILE
@@ -44,19 +48,10 @@ cp $OBJ/sshd_config.orig $OBJ/sshd_config
 
 verbose "test reexec fallback"
 
-start_sshd_copy_zap
-
-rm -f ${COPY}
-for p in 1 2; do
-        verbose "$tid: proto $p"
-        ${SSH} -nqo "Protocol=$p" -F $OBJ/ssh_config somehost \
-            cat ${DATA} > ${COPY}
-        if [ $? -ne 0 ]; then
-                fail "ssh cat $DATA failed"
-        fi
-        cmp ${DATA} ${COPY}             || fail "corrupted copy"
-        rm -f ${COPY}
-done
+start_sshd_copy
+rm -f $SSHD_COPY
+
+copy_tests
 
 $SUDO kill `cat $PIDFILE`
 rm -f $PIDFILE
@@ -66,22 +61,12 @@ verbose "test reexec fallback without privsep"
 cp $OBJ/sshd_config.orig $OBJ/sshd_config
 echo "UsePrivilegeSeparation=no" >> $OBJ/sshd_config
 
-start_sshd_copy_zap
-
-rm -f ${COPY}
-for p in 1 2; do
-        verbose "$tid: proto $p"
-        ${SSH} -nqo "Protocol=$p" -F $OBJ/ssh_config somehost \
-            cat ${DATA} > ${COPY}
-        if [ $? -ne 0 ]; then
-                fail "ssh cat $DATA failed"
-        fi
-        cmp ${DATA} ${COPY}             || fail "corrupted copy"
-        rm -f ${COPY}
-done
+start_sshd_copy
+rm -f $SSHD_COPY
+
+copy_tests
 
 $SUDO kill `cat $PIDFILE`
 rm -f $PIDFILE
 
-cp $OBJ/sshd_config.orig $OBJ/sshd_config
 
diff --git a/regress/rekey.sh b/regress/rekey.sh
index 6b7e845ec..3c5f266fc 100644
--- a/regress/rekey.sh
+++ b/regress/rekey.sh
@@ -8,6 +8,7 @@ COPY=${OBJ}/copy
 LOG=${OBJ}/log
 
 rm -f ${COPY} ${LOG} ${DATA}
+touch ${DATA}
 dd if=/bin/ls${EXEEXT} of=${DATA} bs=1k seek=511 count=1 > /dev/null 2>&1
 
 for s in 16 1k 128k 256k; do
diff --git a/regress/scp.sh b/regress/scp.sh
index 703cc0893..c3034b6e7 100644
--- a/regress/scp.sh
+++ b/regress/scp.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: scp.sh,v 1.2 2004/06/16 13:15:09 dtucker Exp $
+#       $OpenBSD: scp.sh,v 1.3 2004/07/08 12:59:35 dtucker Exp $
 #       Placed in the Public Domain.
 
 tid="scp"
@@ -12,16 +12,16 @@ else
         DIFFOPT="-r"
 fi
 
-DATA=/bin/ls
+DATA=/bin/ls${EXEEXT}
 COPY=${OBJ}/copy
 COPY2=${OBJ}/copy2
 DIR=${COPY}.dd
 DIR2=${COPY}.dd2
 
 SRC=`dirname ${SCRIPT}`
-cp ${SRC}/scp-ssh-wrapper.sh ${OBJ}/scp-ssh-wrapper.exe
-chmod 755 ${OBJ}/scp-ssh-wrapper.exe
-scpopts="-q -S ${OBJ}/scp-ssh-wrapper.exe"
+cp ${SRC}/scp-ssh-wrapper.sh ${OBJ}/scp-ssh-wrapper.scp
+chmod 755 ${OBJ}/scp-ssh-wrapper.scp
+scpopts="-q -S ${OBJ}/scp-ssh-wrapper.scp"
 
 scpclean() {
         rm -rf ${COPY} ${COPY2} ${DIR} ${DIR2}
@@ -64,6 +64,19 @@ cp ${DATA} ${DIR}/copy
 $SCP $scpopts -r somehost:${DIR} ${DIR2} || fail "copy failed"
 diff ${DIFFOPT} ${DIR} ${DIR2} || fail "corrupted copy"
 
+if [ ! -z "$SUDO" ]; then
+        verbose "$tid: skipped file after scp -p with failed chown+utimes"
+        scpclean
+        cp -p ${DATA} ${DIR}/copy
+        cp -p ${DATA} ${DIR}/copy2
+        cp ${DATA} ${DIR2}/copy
+        chmod 660 ${DIR2}/copy
+        $SUDO chown root ${DIR2}/copy
+        $SCP -p $scpopts somehost:${DIR}/\* ${DIR2} >/dev/null 2>&1
+        diff ${DIFFOPT} ${DIR} ${DIR2} || fail "corrupted copy"
+        $SUDO rm ${DIR2}/copy
+fi
+
 for i in 0 1 2 3 4; do
         verbose "$tid: disallow bad server #$i"
         SCPTESTMODE=badserver_$i
@@ -79,4 +92,4 @@ for i in 0 1 2 3 4; do
 done
 
 scpclean
-rm -f ${OBJ}/scp-ssh-wrapper.exe
+rm -f ${OBJ}/scp-ssh-wrapper.scp
diff --git a/regress/sftp-glob.sh b/regress/sftp-glob.sh
new file mode 100644
index 000000000..e238356a2
--- /dev/null
+++ b/regress/sftp-glob.sh
@@ -0,0 +1,28 @@
+#       $OpenBSD: sftp-glob.sh,v 1.1 2004/12/10 01:31:30 fgsch Exp $
+#       Placed in the Public Domain.
+
+tid="sftp glob"
+
+BASE=${OBJ}/glob
+DIR=${BASE}/dir
+DATA=${DIR}/file
+
+rm -rf ${BASE}
+mkdir -p ${DIR}
+touch ${DATA}
+
+verbose "$tid: ls file"
+echo "ls -l ${DIR}/fil*" | ${SFTP} -P ${SFTPSERVER} 2>/dev/null | \
+        grep ${DATA} >/dev/null 2>&1
+if [ $? -ne 0 ]; then
+        fail "globbed ls file failed"
+fi
+
+verbose "$tid: ls dir"
+echo "ls -l ${BASE}/d*" | ${SFTP} -P ${SFTPSERVER} 2>/dev/null | \
+        grep file >/dev/null 2>&1
+if [ $? -ne 0 ]; then
+        fail "globbed ls dir failed"
+fi
+
+rm -rf ${BASE}
diff --git a/regress/sshd-log-wrapper.sh b/regress/sshd-log-wrapper.sh
new file mode 100644
index 000000000..c7a5ef3a6
--- /dev/null
+++ b/regress/sshd-log-wrapper.sh
@@ -0,0 +1,13 @@
+#!/bin/sh
+#       $OpenBSD: sshd-log-wrapper.sh,v 1.2 2005/02/27 11:40:30 dtucker Exp $
+#       Placed in the Public Domain.
+#
+# simple wrapper for sshd proxy mode to catch stderr output
+# sh sshd-log-wrapper.sh /path/to/sshd /path/to/logfile
+
+sshd=$1
+log=$2
+shift
+shift
+
+exec $sshd $@ -e 2>>$log
diff --git a/regress/test-exec.sh b/regress/test-exec.sh
index 70250acd7..4e53449be 100644
--- a/regress/test-exec.sh
+++ b/regress/test-exec.sh
@@ -1,8 +1,19 @@
-#       $OpenBSD: test-exec.sh,v 1.23 2004/06/25 01:25:12 djm Exp $
+#       $OpenBSD: test-exec.sh,v 1.27 2005/02/27 11:33:30 dtucker Exp $
 #       Placed in the Public Domain.
 
 #SUDO=sudo
 
+# Unbreak GNU head(1)
+_POSIX2_VERSION=199209
+export _POSIX2_VERSION
+
+case `uname -s 2>/dev/null` in
+OSF1*)
+        BIN_SH=xpg4
+        export BIN_SH
+        ;;
+esac
+
 if [ ! -z "$TEST_SSH_PORT" ]; then
         PORT="$TEST_SSH_PORT"
 else
@@ -43,6 +54,8 @@ else
 fi
 unset SSH_AUTH_SOCK
 
+SRC=`dirname ${SCRIPT}`
+
 # defaults
 SSH=ssh
 SSHD=sshd
@@ -83,7 +96,13 @@ if [ "x$TEST_SSH_SCP" != "x" ]; then
 fi
 
 # Path to sshd must be absolute for rexec
-SSHD=`which sshd`
+if [ ! -x /$SSHD ]; then
+        SSHD=`which sshd`
+fi
+
+if [ "x$TEST_SSH_LOGFILE" = "x" ]; then
+        TEST_SSH_LOGFILE=/dev/null
+fi
 
 # these should be used in tests
 export SSH SSHD SSHAGENT SSHADD SSHKEYGEN SSHKEYSCAN SFTP SFTPSERVER SCP
@@ -134,6 +153,7 @@ cleanup ()
 
 trace ()
 {
+        echo "trace: $@" >>$TEST_SSH_LOGFILE
         if [ "X$TEST_SSH_TRACE" = "Xyes" ]; then
                 echo "$@"
         fi
@@ -141,6 +161,7 @@ trace ()
 
 verbose ()
 {
+        echo "verbose: $@" >>$TEST_SSH_LOGFILE
         if [ "X$TEST_SSH_QUIET" != "Xyes" ]; then
                 echo "$@"
         fi
@@ -149,12 +170,14 @@ verbose ()
 
 fail ()
 {
+        echo "FAIL: $@" >>$TEST_SSH_LOGFILE
         RESULT=1
         echo "$@"
 }
 
 fatal ()
 {
+        echo "FATAL: $@" >>$TEST_SSH_LOGFILE
         echon "FATAL: "
         fail "$@"
         cleanup
@@ -174,7 +197,7 @@ cat << EOF > $OBJ/sshd_config
         #ListenAddress          ::1
         PidFile                 $PIDFILE
         AuthorizedKeysFile      $OBJ/authorized_keys_%u
-        LogLevel                QUIET
+        LogLevel                DEBUG
         AcceptEnv               _XXX_TEST_*
         AcceptEnv               _XXX_TEST
         Subsystem       sftp    $SFTPSERVER
@@ -205,7 +228,6 @@ Host *
         ChallengeResponseAuthentication no
         HostbasedAuthentication no
         PasswordAuthentication  no
-        RhostsRSAAuthentication no
         BatchMode               yes
         StrictHostKeyChecking   yes
 EOF
@@ -246,7 +268,7 @@ chmod 644 $OBJ/authorized_keys_$USER
 # create a proxy version of the client config
 (
         cat $OBJ/ssh_config
-        echo proxycommand ${SUDO} ${SSHD} -i -f $OBJ/sshd_proxy
+        echo proxycommand ${SUDO} sh ${SRC}/sshd-log-wrapper.sh ${SSHD} ${TEST_SSH_LOGFILE} -i -f $OBJ/sshd_proxy
 ) > $OBJ/ssh_proxy
 
 # check proxy config
@@ -256,7 +278,7 @@ start_sshd ()
 {
         # start sshd
         $SUDO ${SSHD} -f $OBJ/sshd_config -t    || fatal "sshd_config broken"
-        $SUDO ${SSHD} -f $OBJ/sshd_config
+        $SUDO ${SSHD} -f $OBJ/sshd_config -e >>$TEST_SSH_LOGFILE 2>&1
 
         trace "wait for sshd"
         i=0;