| Age | Commit message (Collapse) | Author |
|---|
|
[readconf.c]
because parse_forward() is now used to parse all forward types (DLR),
and it malloc's space for host variables, we don't need to malloc
here. fixes small memory leaks.
previously dynamic forwards were not parsed in parse_forward() and
space was not malloc'd in that case.
ok djm@
|
|
[auth.h auth2.c monitor.c monitor.h monitor_wrap.c monitor_wrap.h]
[readconf.c readconf.h servconf.c servconf.h ssh2.h ssh_config.5]
[sshconnect2.c sshd_config.5 jpake.c jpake.h schnorr.c auth2-jpake.c]
[Makefile.in]
Add support for an experimental zero-knowledge password authentication
method using the J-PAKE protocol described in F. Hao, P. Ryan,
"Password Authenticated Key Exchange by Juggling", 16th Workshop on
Security Protocols, Cambridge, April 2008.
This method allows password-based authentication without exposing
the password to the server. Instead, the client and server exchange
cryptographic proofs to demonstrate of knowledge of the password while
revealing nothing useful to an attacker or compromised endpoint.
This is experimental, work-in-progress code and is presently
compiled-time disabled (turn on -DJPAKE in Makefile.inc).
"just commit it. It isn't too intrusive." deraadt@
|
|
[auth.c]
need unistd.h for close() prototype
(ID sync only)
|
|
- djm@cvs.openbsd.org 2008/11/03 08:59:41
[servconf.c]
include MaxSessions in sshd -T output; patch from imorgan AT nas.nasa.gov
|
|
[contrib/redhat/sshd.pam] Move pam_nologin to account group from
incorrect auth group in example files;
patch from imorgan AT nas.nasa.gov
|
|
Make example scripts generate keys with default sizes rather than fixed,
non-default 1024 bits; patch from imorgan AT nas.nasa.gov
|
|
[readconf.c]
fix comment
|
|
[readconf.c]
remove valueless comment
|
|
[ttymodes.c]
protocol 2 tty modes support is now 7.5 years old so remove these
debug3()s; ok deraadt@
|
|
[clientloop.c readconf.c readconf.h ssh.c]
merge dynamic forward parsing into parse_forward(); 'i think this is OK' djm@
|
|
[ssh-keyscan.1 ssh-keyscan.c]
the ellipsis is not an optional argument; while here, improve spacing.
|
|
[channels.c]
fix some typos in log messages; ok djm@
|
|
[sshconnect2.c]
sprinkle ARGSUSED on dispatch handlers
nuke stale unusued prototype
|
|
[dispatch.c]
remove unused #define DISPATCH_MIN; ok markus@
|
|
[clientloop.c sshd.c]
don't need to #include "monitor_fdpass.h"
|
|
[ssh_config.5]
correct and clarify VisualHostKey; ok jmc@
|
|
[sshconnect.c]
use #define ROQUIET here; no binary change. ok dtucker@
|
|
[ssh_config.5]
use 'Privileged ports can be forwarded only when logging in as root on
the remote machine.' for RemoteForward just like ssh.1 -R.
ok djm@ jmc@
|
|
[key.c]
typo in error message; ok djm@
|
|
[scp.c]
spelling in comment; ok djm@
|
|
[ssh.c]
add -y to usage();
|
|
[servconf.c sshd_config.5]
support setting PermitEmptyPasswords in a Match block
requested in PR3891; ok dtucker@
|
|
[ssh.1 ssh.c]
Add -y option to force logging via syslog rather than stderr.
Useful for daemonised ssh connection (ssh -f). Patch originally from
and ok'd by markus@
|
|
[sshconnect2.c]
Repair strnvis() buffersize of 4*n+1, with termination gauranteed by the
function.
spotted by des@freebsd, who commited an incorrect fix to the freebsd tree
and (as is fairly typical) did not report the problem to us. But this fix
is correct.
ok djm
|
|
[sshd.8]
do not give an example of how to chmod files: we can presume the user
knows that. removes an ambiguity in the permission of authorized_keys;
ok deraadt
|
|
[session.c]
Convert an unchecked strdup to xstrdup. OK deraadt@
|
|
[compat.c compat.h nchan.c ssh.c]
only send eow and no-more-sessions requests to openssh 5 and newer;
fixes interop problems with broken ssh v2 implementations; ok djm@
|
|
[kex.c]
OpenSSL 0.9.8h supplies a real EVP_sha256 so we do not need our
replacement anymore
(ID sync only for portable - we still need this)
|
|
[session.c]
allow ForceCommand internal-sftp with arguments. based on patch from
michael.barabanov AT gmail.com; ok markus@
|
|
[ssh_config.5]
whitepsace -> whitespace. From Matthew Clarke via bugs@.
|
|
[sshconnect2.c]
don't allocate space for empty banners; report t8m at centrum.cz;
ok deraadt
|
|
[key.c]
In random art visualization, make sure to use the end marker only at the
end. Initial diff by Dirk Loss, tweaks and ok djm@
|
|
[ssh_config]
Add VisualHostKey to example file, ok djm@
|
|
[ssh-keygen.1]
Add "ssh-keygen -F -l" to synopsis (displays fingerprint from
known_hosts). ok djm@
|
|
http://git.savannah.gnu.org/gitweb/ (2008-04-14 and 2008-06-16
respectively).
|
|
larger than FD_SETSIZE (OpenSSH only ever uses poll with one fd). Patch
from Nicholas Marriott.
|
|
has been compiled in); report from nix-corp AT esperi.org.uk
ok dtucker@
|
|
[servconf.c]
do not try to print options that have been compile-time disabled
in config test mode (sshd -T); report from nix-corp AT esperi.org.uk
ok dtucker@
|
|
|
|
[contrib/suse/openssh.spec] Update version number in README and RPM specs
|
|
[version.h]
openssh-5.1
|
|
[sftp-server.8]
no need for .Pp before or after .Sh;
|
|
|
|
code, replace with equivalent cygwin library call. Patch from vinschen
at redhat.comi, ok djm@.
|
|
[auth2-hostbased.c]
strip trailing '.' from hostname when HostbasedUsesNameFromPacketOnly=yes
report and patch from res AT qoxp.net (bz#1200); ok markus@
|
|
[sshconnect2.c]
strnvis preauth banner; pointed out by mpf@ ok markus@
|
|
[channels.c]
this loop index should be automatic, not static
|
|
[clientloop.c]
rename variable first_gc -> last_gc (since it is actually the last
in the list).
|
|
[sftp.1]
number of pipelined requests is now 64;
prodded by Iain.Morgan AT nasa.gov
|
|
return EAI_FAMILY when trying to lookup unsupported address family;
from vinschen AT redhat.com
|
