| Age | Commit message (Collapse) | Author |
|---|
|
more carefully (thanks, Julien Cristau).
|
|
|
|
- Unbreak sshd_config's AuthorizedKeysFile option for $HOME-relative
paths.
- Include a language tag when sending a protocol 2 disconnection
message.
- Make logging of certificates used for user authentication more clear
and consistent between CAs specified using TrustedUserCAKeys and
authorized_keys.
|
|
|
|
|
|
|
|
back so we disable the IPv6 tests if we don't have it.
|
|
|
|
previous unofficial builds (closes: #231472).
|
|
utmpx support on FreeBSD where possible. Patch from Ed Schouten, ok djm@
|
|
have it and the path is not provided to --with-libedit. Based on a patch
from Iain Morgan.
|
|
ones. Based on a patch from Roumen Petrov.
|
|
|
|
handling
|
|
with debhelper v3 anyway
|
|
|
|
|
|
installed, the host key is published in an SSHFP RR secured with DNSSEC,
and VerifyHostKeyDNS=yes, then ssh will no longer prompt for host key
verification (closes: #572049).
|
|
|
|
|
|
- Add a Homepage field.
|
|
introduced to match the behaviour of non-free SSH, in which -q does not
suppress fatal errors, but matching the behaviour of OpenSSH upstream is
much more important nowadays. We no longer document that -q does not
suppress fatal errors (closes: #280609). Migrate "LogLevel SILENT" to
"LogLevel QUIET" in sshd_config on upgrade.
|
|
the two patchlevel nybbles now, which is sufficient to address the
original reason this change was introduced, and it appears that any
change in the major/minor/fix nybbles would involve a new libssl package
name. (We'd still lose if the status nybble were ever changed, but that
would mean somebody had packaged a development/beta version rather than
a proper release, which doesn't appear to be normal practice.)
|
|
itself non-OOM-killable, and doesn't require configuration to avoid log
spam in virtualisation containers (closes: #555625).
|
|
|
|
- After a transition period of about 10 years, this release disables SSH
protocol 1 by default. Clients and servers that need to use the
legacy protocol must explicitly enable it in ssh_config / sshd_config
or on the command-line.
- Remove the libsectok/OpenSC-based smartcard code and add support for
PKCS#11 tokens. This support is enabled by default in the Debian
packaging, since it now doesn't involve additional library
dependencies (closes: #231472, LP: #16918).
- Add support for certificate authentication of users and hosts using a
new, minimal OpenSSH certificate format (closes: #482806).
- Added a 'netcat mode' to ssh(1): "ssh -W host:port ...".
- Add the ability to revoke keys in sshd(8) and ssh(1). (For the Debian
package, this overlaps with the key blacklisting facility added in
openssh 1:4.7p1-9, but with different file formats and slightly
different scopes; for the moment, I've roughly merged the two.)
- Various multiplexing improvements, including support for requesting
port-forwardings via the multiplex protocol (closes: #360151).
- Allow setting an explicit umask on the sftp-server(8) commandline to
override whatever default the user has (closes: #496843).
- Many sftp client improvements, including tab-completion, more options,
and recursive transfer support for get/put (LP: #33378). The old
mget/mput commands never worked properly and have been removed
(closes: #270399, #428082).
- Do not prompt for a passphrase if we fail to open a keyfile, and log
the reason why the open failed to debug (closes: #431538).
- Prevent sftp from crashing when given a "-" without a command. Also,
allow whitespace to follow a "-" (closes: #531561).
|
|
|
|
|
|
|
|
/usr/bin/X11/xauth (thanks, Aron Griffis; closes: #575725, LP: #8440).
xauth no longer depends on x11-common, so we're no longer guaranteed to
have the /usr/bin/X11 symlink available. I was taking advantage of the
/usr/bin/X11 symlink to smooth X's move to /usr/bin, but this is far
enough in the past now that it's probably safe to just use /usr/bin.
|
|
[ssh_config.5]
Reformat default value of PreferredAuthentications entry (current
formatting implies ", " is acceptable as a separator, which it's not.
ok djm@
|
|
[ssh.1]
mention that -S none disables connection sharing; from Colin Watson
|
|
bz#1723 patch from Adeodato Simó via Colin Watson; ok dtucker@
|
|
pkg-config, patch from Colin Watson. Needed for newer linkers (ie gold).
|
|
ok dtucker@
|
|
set up SELinux execution context before chroot() call. From Russell
Coker via Colin watson; bz#1726 ok dtucker@
|
|
[servconf.c]
from portable: getcwd(NULL, 0) doesn't work on all platforms, so
use a stack buffer; ok dtucker@
|
|
by Ingo Weinhold via Scott McCreary, ok djm@
|
|
for arc4random_buf() and arc4random_uniform(); from Josh Gilkerson
|
|
containing the services file explicitely case-insensitive. This allows to
tweak the Windows services file reliably. Patch from vinschen at redhat.
|
|
[contrib/suse/openssh.spec] Crank version numbers
|
|
[version.h]
crank version to openssh-5.5 since we have a few fixes since 5.4;
requested deraadt@ kettenis@
|
|
[auth-options.c]
spelling in error message. ok djm kettenis
|
|
[key.c key.h ssh-keygen.c]
also print certificate type (user or host) for ssh-keygen -L
ok djm kettenis
|
|
[ssh-keygen.1]
fix a formatting error (args need quoted); noted by stevesk
|
|
[ssh-keygen.1]
Certificates are named *-cert.pub, not *_cert.pub; committing a diff
from stevesk@ ok me
|
|
[clientloop.c]
protocol conformance fix: send language tag when disconnecting normally;
spotted by 1.41421 AT gmail.com, ok markus@ deraadt@
|
|
[servconf.c]
do not prepend AuthorizedKeysFile with getcwd(), unbreaks relative paths
free() (not xfree()) the buffer returned by getcwd()
|
|
[servconf.c]
unbreak AuthorizedKeys option with a $HOME-relative path; reported by
vinschen AT redhat.com, ok dtucker@
|
|
[auth2-pubkey.c]
correct certificate logging and make it more consistent between
authorized_keys and TrustedCAKeys; ok markus@
|
