summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2019-02-25Tighten up start-stop-daemon invocationsColin Watson
Pass "--exec /usr/sbin/sshd" to start-stop-daemon on stop as well as start and pass "--chuid 0:0" on start, to avoid problems with non-root groups leaking into the ownership of /run/sshd.pid. Closes: #922365
2019-02-25Update logind recommendationColin Watson
Recommend "default-logind | logind | libpam-systemd" rather than just libpam-systemd. (I've retained libpam-systemd as an alternative for a while to avoid backporting accidents, although it can be removed later.) Thanks, Adam Borowski. Closes: #923199
2019-02-08releasing package openssh version 1:7.9p1-6Colin Watson
2019-02-08scp: Check remote->local directory copy filenamesColin Watson
CVE-2019-6111
2019-02-08upstream: check in scp client that filenames sent duringdjm@openbsd.org
remote->local directory copies satisfy the wildcard specified by the user. This checking provides some protection against a malicious server sending unexpected filenames, but it comes at a risk of rejecting wanted files due to differences between client and server wildcard expansion rules. For this reason, this also adds a new -T flag to disable the check. reported by Harry Sintonen fix approach suggested by markus@; has been in snaps for ~1wk courtesy deraadt@ OpenBSD-Commit-ID: 00f44b50d2be8e321973f3c6d014260f8f7a8eda CVE-2019-6111 Origin: backport, https://anongit.mindrot.org/openssh.git/commit/?id=391ffc4b9d31fa1f4ad566499fef9176ff8a07dc Last-Update: 2019-02-08 Patch-Name: check-filenames-in-scp-client.patch
2019-02-08Sanitize scp filenames via snmprintfColin Watson
CVE-2019-6109 Closes: #793412
2019-02-08upstream: Have progressmeter force an update at the beginning anddtucker@openbsd.org
end of each transfer. Fixes the problem recently introduces where very quick transfers do not display the progressmeter at all. Spotted by naddy@ OpenBSD-Commit-ID: 68dc46c259e8fdd4f5db3ec2a130f8e4590a7a9a Origin: upstream, https://anongit.mindrot.org/openssh.git/commit/?id=bdc6c63c80b55bcbaa66b5fde31c1cb1d09a41eb Last-Update: 2019-02-08 Patch-Name: have-progressmeter-force-update-at-beginning-and-end-transfer.patch
2019-02-08upstream: Sanitize scp filenames via snmprintf. To do this we movedtucker@openbsd.org
the progressmeter formatting outside of signal handler context and have the atomicio callback called for EINTR too. bz#2434 with contributions from djm and jjelen at redhat.com, ok djm@ OpenBSD-Commit-ID: 1af61c1f70e4f3bd8ab140b9f1fa699481db57d8 CVE-2019-6109 Origin: backport, https://anongit.mindrot.org/openssh.git/commit/?id=8976f1c4b2721c26e878151f52bdf346dfe2d54c Bug-Debian: https://bugs.debian.org/793412 Last-Update: 2019-02-08 Patch-Name: sanitize-scp-filenames-via-snmprintf.patch
2019-01-13releasing package openssh version 1:7.9p1-5Colin Watson
2019-01-12scp: disallow empty incoming filename or "."Colin Watson
Closes: #919101
2019-01-12upstream: disallow empty incoming filename or ones that refer to thedjm@openbsd.org
current directory; based on report/patch from Harry Sintonen OpenBSD-Commit-ID: f27651b30eaee2df49540ab68d030865c04f6de9 Origin: upstream, https://anongit.mindrot.org/openssh.git/commit/?id=6010c0303a422a9c5fa8860c061bf7105eb7f8b2 Bug-Debian: https://bugs.debian.org/919101 Last-Update: 2019-01-12 Patch-Name: scp-disallow-dot-or-empty-filename.patch
2018-12-26Drop obsolete alternate build-dependency on libssl1.0-devColin Watson
Closes: #917342
2018-12-06Move /etc/ssh/moduli to openssh-serverColin Watson
It's reasonably large and only used by sshd. Closes: #858050
2018-11-16releasing package openssh version 1:7.9p1-4Colin Watson
2018-11-16Use dpkg_vendor_derives_from againColin Watson
This time with syntax that works.
2018-11-15Fix Ubuntu detection in debian/rulesColin Watson
The documentation comment for dpkg_vendor_derives_from is wrong (thanks, Jeremy Bicha; see #913816).
2018-11-15releasing package openssh version 1:7.9p1-3Colin Watson
2018-11-15Restore some direct test dependenciesColin Watson
Restore direct test dependencies on openssl, putty-tools, and python-twisted-conch; these are really only indirect dependencies via openssh-tests, but including them means that this package will be retested when they change.
2018-11-15Re-export debian/upstream/signing-key.asc without extra signaturesColin Watson
2018-11-15debian/control: Remove trailing whitespaceColin Watson
2018-11-15Avoid incorrect Makefile symlink in openssh-testsColin Watson
Be more specific about what files to install in openssh-tests, to avoid installing a symlink into the build tree.
2018-11-14releasing package openssh version 1:7.9p1-2Colin Watson
2018-11-05Add an openssh-tests binary packageColin Watson
This contains enough files to run the upstream regression tests. Doing this allows autopkgtest to run more efficiently, as it doesn't have to build part of the source tree again.
2018-11-05Set TEST_SHELL againColin Watson
There's no default for this in regress/Makefile (only in the top-level Makefile), so leaving it unset here doesn't work.
2018-11-03Drop "set -x" verbosity from the autopkgtestColin Watson
I think we can do without this in most cases nowadays, as things have been pretty stable for a while.
2018-11-03Make the autopkgtest create /run/sshd if it doesn't already existColin Watson
2018-11-03Add GitLab CI configurationColin Watson
2018-10-22Mark debian/NEWS entry as releasedColin Watson
2018-10-21releasing package openssh version 1:7.9p1-1Colin Watson
2018-10-21Remove /etc/network/if-up.d/openssh-serverColin Watson
It causes more problems than it solves. Add an "if-up hook removed" section to README.Debian documenting the corner case that may need configuration adjustments. Thanks, Christian Ehrhardt, Andreas Hasenack, and David Britton. Closes: #789532 LP: #1037738, #1674330, #1718227
2018-10-21Simplify debian/rules using /usr/share/dpkg/default.mk.Colin Watson
2018-10-20Remove dh_builddeb override to use xz compressionColin Watson
This has been the default since dpkg 1.17.0.
2018-10-20New upstream release (7.9p1)Colin Watson
2018-10-20Work around conch interoperability failureColin Watson
Twisted Conch fails to read private keys in the new format (https://twistedmatrix.com/trac/ticket/9515). Work around this until it can be fixed in Twisted. Forwarded: not-needed Last-Update: 2018-08-30 Patch-Name: conch-old-privkey-format.patch
2018-10-20Enable specific ioctl call for EP11 crypto card (s390)Eduardo Barretto
The EP11 crypto card needs to make an ioctl call, which receives an specific argument. This crypto card is for s390 only. Signed-off-by: Eduardo Barretto <ebarretto@linux.vnet.ibm.com> Origin: other, https://bugzilla.mindrot.org/show_bug.cgi?id=2752 Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=2752 Bug-Ubuntu: https://bugs.launchpad.net/bugs/1686618 Last-Update: 2017-08-28 Patch-Name: seccomp-s390-ioctl-ep11-crypto.patch
2018-10-20Allow flock and ipc syscall for s390 architectureEduardo Barretto
In order to use the OpenSSL-ibmpkcs11 engine it is needed to allow flock and ipc calls, because this engine calls OpenCryptoki (a PKCS#11 implementation) which calls the libraries that will communicate with the crypto cards. OpenCryptoki makes use of flock and ipc and, as of now, this is only need on s390 architecture. Signed-off-by: Eduardo Barretto <ebarretto@linux.vnet.ibm.com> Origin: other, https://bugzilla.mindrot.org/show_bug.cgi?id=2752 Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=2752 Bug-Ubuntu: https://bugs.launchpad.net/bugs/1686618 Last-Update: 2018-10-19 Patch-Name: seccomp-s390-flock-ipc.patch
2018-10-20Restore reading authorized_keys2 by defaultColin Watson
Upstream seems to intend to gradually phase this out, so don't assume that this will remain the default forever. However, we were late in adopting the upstream sshd_config changes, so it makes sense to extend the grace period. Bug-Debian: https://bugs.debian.org/852320 Forwarded: not-needed Last-Update: 2017-03-05 Patch-Name: restore-authorized_keys2.patch
2018-10-20Various Debian-specific configuration changesColin Watson
ssh: Enable ForwardX11Trusted, returning to earlier semantics which cause fewer problems with existing setups (http://bugs.debian.org/237021). ssh: Set 'SendEnv LANG LC_*' by default (http://bugs.debian.org/264024). ssh: Enable HashKnownHosts by default to try to limit the spread of ssh worms. ssh: Enable GSSAPIAuthentication by default. sshd: Enable PAM, disable ChallengeResponseAuthentication, and disable PrintMotd. sshd: Enable X11Forwarding. sshd: Set 'AcceptEnv LANG LC_*' by default. sshd: Change sftp subsystem path to /usr/lib/openssh/sftp-server. Document all of this. Author: Russ Allbery <rra@debian.org> Forwarded: not-needed Last-Update: 2017-10-04 Patch-Name: debian-config.patch
2018-10-20Add systemd readiness notification supportMichael Biebl
Bug-Debian: https://bugs.debian.org/778913 Forwarded: no Last-Update: 2017-08-22 Patch-Name: systemd-readiness.patch
2018-10-20Give the ssh-askpass-gnome window a default iconVincent Untz
Bug-Ubuntu: https://bugs.launchpad.net/bugs/27152 Last-Update: 2010-02-28 Patch-Name: gnome-ssh-askpass2-icon.patch
2018-10-20Don't check the status field of the OpenSSL versionKurt Roeckx
There is no reason to check the version of OpenSSL (in Debian). If it's not compatible the soname will change. OpenSSH seems to want to do a check for the soname based on the version number, but wants to keep the status of the release the same. Remove that check on the status since it doesn't tell you anything about how compatible that version is. Author: Colin Watson <cjwatson@debian.org> Bug-Debian: https://bugs.debian.org/93581 Bug-Debian: https://bugs.debian.org/664383 Bug-Debian: https://bugs.debian.org/732940 Forwarded: not-needed Last-Update: 2014-10-07 Patch-Name: no-openssl-version-status.patch
2018-10-20Document consequences of ssh-agent being setgid in ssh-agent(1)Colin Watson
Bug-Debian: http://bugs.debian.org/711623 Forwarded: no Last-Update: 2013-06-08 Patch-Name: ssh-agent-setgid.patch
2018-10-20Document that HashKnownHosts may break tab-completionColin Watson
Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1727 Bug-Debian: http://bugs.debian.org/430154 Last-Update: 2013-09-14 Patch-Name: doc-hash-tab-completion.patch
2018-10-20ssh(1): Refer to ssh-argv0(1)Colin Watson
Old versions of OpenSSH (up to 2.5 or thereabouts) allowed creating symlinks to ssh with the name of the host you want to connect to. Debian ships an ssh-argv0 script restoring this feature; this patch refers to its manual page from ssh(1). Bug-Debian: http://bugs.debian.org/111341 Forwarded: not-needed Last-Update: 2013-09-14 Patch-Name: ssh-argv0.patch
2018-10-20Adjust various OpenBSD-specific references in manual pagesColin Watson
No single bug reference for this patch, but history includes: http://bugs.debian.org/154434 (login.conf(5)) http://bugs.debian.org/513417 (/etc/rc) http://bugs.debian.org/530692 (ssl(8)) https://bugs.launchpad.net/bugs/456660 (ssl(8)) Forwarded: not-needed Last-Update: 2017-10-04 Patch-Name: openbsd-docs.patch
2018-10-20Install authorized_keys(5) as a symlink to sshd(8)Tomas Pospisek
Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1720 Bug-Debian: http://bugs.debian.org/441817 Last-Update: 2013-09-14 Patch-Name: authorized-keys-man-symlink.patch
2018-10-20Add DebianBanner server configuration optionKees Cook
Setting this to "no" causes sshd to omit the Debian revision from its initial protocol handshake, for those scared by package-versioning.patch. Bug-Debian: http://bugs.debian.org/562048 Forwarded: not-needed Last-Update: 2018-10-19 Patch-Name: debian-banner.patch
2018-10-20Include the Debian version in our identificationMatthew Vernon
This makes it easier to audit networks for versions patched against security vulnerabilities. It has little detrimental effect, as attackers will generally just try attacks rather than bothering to scan for vulnerable-looking version strings. (However, see debian-banner.patch.) Forwarded: not-needed Last-Update: 2017-10-04 Patch-Name: package-versioning.patch
2018-10-20Mention ssh-keygen in ssh fingerprint changed warningScott Moser
Author: Chris Lamb <lamby@debian.org> Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1843 Bug-Ubuntu: https://bugs.launchpad.net/bugs/686607 Last-Update: 2017-08-22 Patch-Name: mention-ssh-keygen-on-keychange.patch
2018-10-20Force use of DNSSEC even if "options edns0" isn't in resolv.confColin Watson
This allows SSHFP DNS records to be verified if glibc 2.11 is installed. Origin: vendor, https://cvs.fedoraproject.org/viewvc/F-12/openssh/openssh-5.2p1-edns.patch?revision=1.1&view=markup Bug: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=572049 Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=572049 Last-Update: 2010-04-06 Patch-Name: dnssec-sshfp.patch
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-11 18:11:21 +0000