| Age | Commit message (Collapse) | Author |
|---|
|
Make sshd default to PermitRootLogin=no; ok deraadt@
rpe@
|
|
fix compilation with OPENSSL=no; ok dtucker@
|
|
Include stdio.h for FILE (used in sshkey.h) so it
compiles with OPENSSL=no.
|
|
allow "sshd -f none" to skip reading the config file,
much like "ssh -F none" does. ok dtucker
|
|
combine -Dd onto one line and update usage();
|
|
add ssh-agent -D to leave ssh-agent in foreground
without enabling debug mode; bz#2381 ok dtucker@
|
|
2*len -> use xreallocarray() ok djm
|
|
rename xrealloc() to xreallocarray() since it follows
that form. ok djm
|
|
Two small fixes for sshd -T: ListenAddress'es are added
to a list head so reverse the order when printing them to ensure the
behaviour remains the same, and print StreamLocalBindMask as octal with
leading zero. ok deraadt@
|
|
Check for and reject missing arguments for
VersionAddendum and ForceCommand. bz#2281, patch from plautrba at redhat com,
ok djm@
|
|
unknown certificate extensions are non-fatal, so don't
fatal when they are encountered; bz#2387 reported by Bob Van Zant; ok
dtucker@
|
|
Add back a backslash removed in rev 1.42 so
KEX_SERVER_ENCRYPT will include aes again.
ok deraadt@
|
|
s/recommended/required/ that private keys be og-r this
wording change was made a while ago but got accidentally reverted
|
|
don't try to cleanup NULL KEX proposals in
kex_prop_free(); found by Jukka Taimisto and Markus Hietava
|
|
use error/logit/fatal instead of fprintf(stderr, ...)
and exit(0), fix a few errors that were being printed to stdout instead of
stderr and a few non-errors that were going to stderr instead of stdout
bz#2325; ok dtucker
|
|
debug log missing DISPLAY environment when X11
forwarding requested; bz#1682 ok dtucker@
|
|
don't call record_login() in monitor when UseLogin is
enabled; bz#278 reported by drk AT sgi.com; ok dtucker
|
|
Add some missing options to sshd -T and fix the output
of VersionAddendum HostCertificate. bz#2346, patch from jjelen at redhat
com, ok djm.
|
|
Document "none" for PidFile XAuthLocation
TrustedUserCAKeys and RevokedKeys. bz#2382, feedback from jmc@, ok djm@
|
|
Plug leak of address passed to logging. bz#2373, patch
from jjelen at redhat, ok markus@
|
|
Output remote username in debug output since with Host
and Match it's not always obvious what it will be. bz#2368, ok djm@
|
|
Part of bz#2346, patch from jjelen at redhat com.
|
|
|
|
This changes configure.ac to look for '${host}-ar' as set by
AC_CANONICAL_HOST before looking for the unprefixed 'ar'.
Useful when cross-compiling when all your binutils are prefixed.
Patch from moben at exherbo org via astrand at lysator liu se and
bz#2352.
|
|
|
|
|
|
|
|
deprecate ancient, pre-RFC4419 and undocumented
SSH2_MSG_KEX_DH_GEX_REQUEST_OLD message; ok markus@ deraadt@ "seems
reasonable" dtucker@
|
|
Don't send hostkey advertisments
(hostkeys-00@openssh.com) to current versions of Tera Term as they can't
handle them. Newer versions should be OK. Patch from Bryan Drewery and
IWAMOTO Kouichi, ok djm@
|
|
include port number if a non-default one has been
specified; based on patch from Michael Handler
|
|
treat Protocol=1,2|2,1 as Protocol=2 when compiled
without SSH1 support; ok dtucker@ millert@
|
|
Do not use int for sig_atomic_t; spotted by
christos@netbsd; ok markus@
|
|
From FreeBSD.
|
|
|
|
Patch from Bryan Drewery.
|
|
correct return value in pubkey parsing, spotted by Ben Hawkes
ok markus@
|
|
adapt to recent hostfile.c change: when parsing
known_hosts without fully parsing the keys therein, hostkeys_foreach() will
now correctly identify KEY_RSA1 keys; ok markus@ miod@
|
|
use ${SSH} for -Q instead of installed ssh
|
|
make CLEANFILES clean up more of the tests' droppings
|
|
downgrade error() for known_hosts parse errors to debug()
to quiet warnings from ssh1 keys present when compiled !ssh1.
also identify ssh1 keys when scanning, even when compiled !ssh1
ok markus@ miod@
|
|
fd leak for !ssh1 case; found by unittests; ok markus@
|
|
don't fatal when a !ssh1 sshd is reexeced from a w/ssh1
listener; reported by miod@; ok miod@ markus@
|
|
Comments are only supported for RSA1 keys. If a user
tried to add one and entered his passphrase, explicitly clear it before exit.
This is done in all other error paths, too.
ok djm
|
|
ssh-askpass(1) is the default, overridden by SSH_ASKPASS;
diff originally from jiri b;
|
|
fix uninitialised memory read when parsing a config file
consisting of a single nul byte. Found by hanno AT hboeck.de using AFL; ok
dtucker
|
|
sigp and lenp are not optional in ssh_agent_sign(); ok
djm@
|
|
don't try to load .ssh/identity by default if SSH1 is
disabled; ok markus@
|
|
ban all-zero curve25519 keys as recommended by latest
CFRG curves draft; ok markus
|
|
relax bits needed check to allow
diffie-hellman-group1-sha1 key exchange to complete for chacha20-poly1305 was
selected as symmetric cipher; ok markus
|
|
ignore v1 errors on ssh-add -D; only try v2 keys on
-l/-L (unless WITH_SSH1) ok djm@
|
