summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2014-04-20 - djm@cvs.openbsd.org 2014/04/01 02:05:27Damien Miller
[ssh-keysign.c] include fingerprint of key not found use arc4random_buf() instead of loop+arc4random()
2014-04-20 - jmc@cvs.openbsd.org 2014/03/31 13:39:34Damien Miller
[ssh-keygen.1] the text for the -K option was inserted in the wrong place in -r1.108; fix From: Matthew Clarke
2014-04-20 - naddy@cvs.openbsd.org 2014/03/28 05:17:11Damien Miller
[ssh_config.5 sshd_config.5] sync available and default algorithms, improve algorithm list formatting help from jmc@ and schwarze@, ok deraadt@
2014-04-20 - tedu@cvs.openbsd.org 2014/03/26 19:58:37Damien Miller
[sshd.8 sshd.c] remove libwrap support. ok deraadt djm mfriedl
2014-04-20 - djm@cvs.openbsd.org 2014/03/26 04:55:35Damien Miller
[chacha.h cipher-chachapoly.h digest.h hmac.h kex.h kexc25519.c [misc.h poly1305.h ssh-pkcs11.c] use __bounded(...) attribute recently added to sys/cdefs.h instead of longform __attribute__(__bounded(...)); for brevity and a warning free compilation with llvm/clang
2014-04-20Three commits in one (since they touch the same heavily-diverged fileDamien Miller
repeatedly): - markus@cvs.openbsd.org 2014/03/25 09:40:03 [myproposal.h] trimm default proposals. This commit removes the weaker pre-SHA2 hashes, the broken ciphers (arcfour), and the broken modes (CBC) from the default configuration (the patch only changes the default, all the modes are still available for the config files). ok djm@, reminded by tedu@ & naddy@ and discussed with many - deraadt@cvs.openbsd.org 2014/03/26 17:16:26 [myproposal.h] The current sharing of myproposal[] between both client and server code makes the previous diff highly unpallatable. We want to go in that direction for the server, but not for the client. Sigh. Brought up by naddy. - markus@cvs.openbsd.org 2014/03/27 23:01:27 [myproposal.h ssh-keyscan.c sshconnect2.c sshd.c] disable weak proposals in sshd, but keep them in ssh; ok djm@
2014-04-20 - tedu@cvs.openbsd.org 2014/03/19 14:42:44Damien Miller
[scp.1] there is no need for rcp anymore ok deraadt millert
2014-04-20 - tedu@cvs.openbsd.org 2014/03/17 19:44:10Damien Miller
[ssh.1] old descriptions of des and blowfish are old. maybe ok deraadt
2014-04-20 - deraadt@cvs.openbsd.org 2014/03/15 17:28:26Damien Miller
[ssh-agent.c ssh-keygen.1 ssh-keygen.c] Improve usage() and documentation towards the standard form. In particular, this line saves a lot of man page reading time. usage: ssh-keygen [-q] [-b bits] [-t dsa | ecdsa | ed25519 | rsa | rsa1] [-N new_passphrase] [-C comment] [-f output_keyfile] ok schwarze jmc
2014-04-20 - naddy@cvs.openbsd.org 2014/03/12 13:06:59Damien Miller
[ssh-keyscan.1] scan for Ed25519 keys by default too
2014-04-20 - djm@cvs.openbsd.org 2014/03/12 04:51:12Damien Miller
[authfile.c] correct test that kdf name is not "none" or "bcrypt"
2014-04-20 - djm@cvs.openbsd.org 2014/03/12 04:50:32Damien Miller
[auth-bsdauth.c ssh-keygen.c] don't count on things that accept arguments by reference to clear things for us on error; most things do, but it's unsafe form.
2014-04-20 - djm@cvs.openbsd.org 2014/03/12 04:44:58Damien Miller
[ssh-keyscan.c] scan for Ed25519 keys by default too
2014-04-20 - djm@cvs.openbsd.org 2014/03/03 22:22:30Damien Miller
[session.c] ignore enviornment variables with embedded '=' or '\0' characters; spotted by Jann Horn; ok deraadt@ Id sync only - portable already has this.
2014-04-15Spanish (thanks, Matías Bellone; closes: #744867).Colin Watson
2014-04-14releasing package openssh version 1:6.6p1-3Colin Watson
2014-04-14Never signal the service supervisor with SIGSTOP more than once, toColin Watson
prevent a hang on re-exec (thanks, Robie Basak; LP: #1306877).
2014-04-14Attempt SSHFP lookup even if server presents a certificateMatthew Vernon
If an ssh server presents a certificate to the client, then the client does not check the DNS for SSHFP records. This means that a malicious server can essentially disable DNS-host-key-checking, which means the client will fall back to asking the user (who will just say "yes" to the fingerprint, sadly). This patch is by Damien Miller (of openssh upstream). It's simpler than the patch by Mark Wooding which I applied yesterday; a copy is taken of the proffered key/cert, the key extracted from the cert (if necessary), and then the DNS consulted. Signed-off-by: Matthew Vernon <matthew@debian.org> Bug-Debian: http://bugs.debian.org/742513 Patch-Name: sshfp_with_server_cert_upstr
2014-04-14Various Debian-specific configuration changesColin Watson
ssh: Enable ForwardX11Trusted, returning to earlier semantics which cause fewer problems with existing setups (http://bugs.debian.org/237021). ssh: Set 'SendEnv LANG LC_*' by default (http://bugs.debian.org/264024). ssh: Enable HashKnownHosts by default to try to limit the spread of ssh worms. ssh: Enable GSSAPIAuthentication and disable GSSAPIDelegateCredentials by default. sshd: Refer to /usr/share/doc/openssh-server/README.Debian.gz alongside PermitRootLogin default. Document all of this, along with several sshd defaults set in debian/openssh-server.postinst. Author: Russ Allbery <rra@debian.org> Forwarded: not-needed Last-Update: 2014-02-12 Patch-Name: debian-config.patch
2014-04-14Support synchronisation with service supervisor using SIGSTOPColin Watson
Author: Robie Basak <robie.basak@ubuntu.com> Forwarded: no Last-Update: 2014-04-14 Patch-Name: sigstop.patch
2014-04-01French (thanks, Étienne Gilli; closes: #743242).Colin Watson
2014-04-01 - (djm) Use full release (e.g. 6.5p1) in debug output rather than justDamien Miller
version. From des@des.no
2014-04-01 - (djm) On platforms that support it, use prctl() to prevent sftp-serverDamien Miller
from accessing /proc/self/{mem,maps}; patch from jann AT thejh.net
2014-03-31releasing package openssh version 1:6.6p1-2Colin Watson
2014-03-31If no root password is set, then switch to "PermitRootLogin ↵Colin Watson
without-password" without asking (LP: #1300127).
2014-03-28releasing package openssh version 1:6.6p1-1Colin Watson
2014-03-28Don't start ssh-agent from the Upstart user session job if something like ↵Colin Watson
Xsession has already done so (based on work by Bruno Vasselle; LP: #1244736).
2014-03-28Add CVE-2014-2653 for SSHFP bug.Colin Watson
2014-03-28Italian (thanks, Beatrice Torracca).Colin Watson
2014-03-27Close LP bug asking for 6.6.Colin Watson
2014-03-27Add copyright information as requested by Stephan.Colin Watson
2014-03-27German (thanks, Stephan Beck; closes: #742541).Colin Watson
2014-03-27Japanese (thanks, victory).Colin Watson
2014-03-27Swedish (thanks, Andreas Rönnquist).Colin Watson
2014-03-27Russian (thanks, Yuri Kozlov; closes: #742308).Colin Watson
2014-03-27Portuguese (thanks, Américo Monteiro).Colin Watson
2014-03-27Danish (thanks, Joe Hansen).Colin Watson
2014-03-27Change to "PermitRootLogin without-password" for new installationsColin Watson
Also ask a debconf question when upgrading systems with "PermitRootLogin yes" from previous versions. Closes: #298138
2014-03-27Re-enable btmp logging, as its permissions were fixed a long time ago in ↵Colin Watson
response to #370050 (closes: #341883).
2014-03-26merge patched into masterMatthew Vernon
2014-03-26Attempt SSHFP lookup even if server presents a certificateMatthew Vernon
If an ssh server presents a certificate to the client, then the client does not check the DNS for SSHFP records. This means that a malicious server can essentially disable DNS-host-key-checking, which means the client will fall back to asking the user (who will just say "yes" to the fingerprint, sadly). This patch is by Damien Miller (of openssh upstream). It's simpler than the patch by Mark Wooding which I applied yesterday; a copy is taken of the proffered key/cert, the key extracted from the cert (if necessary), and then the DNS consulted. Signed-off-by: Matthew Vernon <matthew@debian.org> Bug-Debian: http://bugs.debian.org/742513 Patch-Name: sshfp_with_server_cert_upstr
2014-03-25[ Colin Watson ]Matthew Vernon
[ Matthew Vernon ] Fix failure to check SSHFP records if server presents a certificate (bug reported by me, patch largely by Mark Wooding) (Closes: #742513)
2014-03-25merge patched into masterMatthew Vernon
2014-03-25Attempt SSHFP lookup even if server presents a certificateMatthew Vernon
If an ssh server presents a certificate to the client, then the client does not check the DNS for SSHFP records. This means that a malicious server can essentially disable DNS-host-key-checking, which means the client will fall back to asking the user (who will just say "yes" to the fingerprint, sadly). This patch means that the ssh client will, if necessary, extract the server key from the proffered certificate, and attempt to verify it against the DNS. The patch was written by Mark Wooding <mdw@distorted.org.uk>. I modified it to add one debug2 call, reviewed it, and tested it. Signed-off-by: Matthew Vernon <matthew@debian.org> Bug-Debian: http://bugs.debian.org/742513 Patch-Name: sshfp_with_server_cert
2014-03-21Mention CVE-2014-2532 in changelog.Colin Watson
2014-03-20Merge 6.6p1.Colin Watson
* New upstream release (http://www.openssh.com/txt/release-6.6).
2014-03-20Give the ssh-askpass-gnome window a default iconVincent Untz
Bug-Ubuntu: https://bugs.launchpad.net/bugs/27152 Last-Update: 2010-02-28 Patch-Name: gnome-ssh-askpass2-icon.patch
2014-03-20Various Debian-specific configuration changesColin Watson
ssh: Enable ForwardX11Trusted, returning to earlier semantics which cause fewer problems with existing setups (http://bugs.debian.org/237021). ssh: Set 'SendEnv LANG LC_*' by default (http://bugs.debian.org/264024). ssh: Enable HashKnownHosts by default to try to limit the spread of ssh worms. ssh: Enable GSSAPIAuthentication and disable GSSAPIDelegateCredentials by default. sshd: Refer to /usr/share/doc/openssh-server/README.Debian.gz alongside PermitRootLogin default. Document all of this, along with several sshd defaults set in debian/openssh-server.postinst. Author: Russ Allbery <rra@debian.org> Forwarded: not-needed Last-Update: 2014-02-12 Patch-Name: debian-config.patch
2014-03-20Disable OpenSSL version checkPhilip Hands
OpenSSL's SONAME is sufficient nowadays. Author: Colin Watson <cjwatson@debian.org> Bug-Debian: http://bugs.debian.org/93581 Bug-Debian: http://bugs.debian.org/664383 Forwarded: not-needed Last-Update: 2013-12-23 Patch-Name: no-openssl-version-check.patch
2014-03-20Support synchronisation with service supervisor using SIGSTOPColin Watson
Forwarded: no Last-Update: 2013-09-14 Patch-Name: sigstop.patch
generated by cgit v1.2.3 (git 2.39.1) at 2024-10-02 18:17:16 +0000