summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2010-01-02fix build with GSSAPI disabledColin Watson
2010-01-02yet another report of thisColin Watson
2010-01-02Use hardening-includes for hardening logic (thanks, Kees Cook; closes:Colin Watson
#561887).
2010-01-02Don't duplicate backslashes when displaying server banner (thanks,Colin Watson
Michał Górny; closes: #505378, LP: #425346).
2010-01-02Initialise sc to NULL in ssh_selinux_getctxbyname (thanks, Václav Ovsík;Colin Watson
closes: #498684).
2010-01-02Make ChrootDirectory work with SELinux (thanks, Russell Coker; closes:Colin Watson
#556644).
2010-01-02more bug fix notesColin Watson
2010-01-02merge from gssapi branchColin Watson
2010-01-02autoconfColin Watson
2010-01-01* New upstream release (closes: #536182). Yes, I know 5.3p1 has been outColin Watson
for a while, but there's no GSSAPI patch available for it yet. - Change the default cipher order to prefer the AES CTR modes and the revised "arcfour256" mode to CBC mode ciphers that are susceptible to CPNI-957037 "Plaintext Recovery Attack Against SSH". - Add countermeasures to mitigate CPNI-957037-style attacks against the SSH protocol's use of CBC-mode ciphers. Upon detection of an invalid packet length or Message Authentication Code, ssh/sshd will continue reading up to the maximum supported packet length rather than immediately terminating the connection. This eliminates most of the known differences in behaviour that leaked information about the plaintext of injected data which formed the basis of this attack (closes: #506115, LP: #379329). - ForceCommand directive now accepts commandline arguments for the internal-sftp server (closes: #524423, LP: #362511). - Add AllowAgentForwarding to available Match keywords list (closes: #540623). - Make ssh(1) send the correct channel number for SSH2_MSG_CHANNEL_SUCCESS and SSH2_MSG_CHANNEL_FAILURE messages to avoid triggering 'Non-public channel' error messages on sshd(8) in openssh-5.1. - Avoid printing 'Non-public channel' warnings in sshd(8), since the ssh(1) has sent incorrect channel numbers since ~2004 (this reverts a behaviour introduced in openssh-5.1; closes: #496017). * Update to GSSAPI patch from http://www.sxw.org.uk/computing/patches/openssh-5.2p1-gsskex-all-20090726.patch, including cascading credentials support (LP: #416958).
2010-01-01TODO for gssapi branch handlingColin Watson
2010-01-01import openssh-5.2p1-gsskex-all-20090726.patchColin Watson
2010-01-01Import 5.2p1 tarballColin Watson
2009-12-29no-op merge from constructed gssapi branch, to ease future upstream mergesColin Watson
2009-12-29import openssh-5.1p1-gsskex-cjwatson-20080722.patchColin Watson
2009-12-29import openssh-4.7p1-gsskex-20070927.patchColin Watson
2009-12-29import openssh-4.6p1-gsskex-20070312.patchColin Watson
2009-12-29import openssh-4.3p2-gsskex-20060223.patchColin Watson
2009-12-29import openssh-4.2p1-gsskex-20050926-2.patchColin Watson
2009-12-29import openssh-4.0p1-gssapikex.patchColin Watson
2009-12-21pushed some previous upstream release branches to LaunchpadColin Watson
2009-12-21Add debian/README.source with instructions on bzr handling.Colin Watson
2009-12-21move local ignores to .bzrignore and resync .cvsignore files with upstreamColin Watson
2009-12-21Moved to bzr.debian.org; add Vcs-Bzr and Vcs-Browser control fields.Colin Watson
2009-11-12Use x11.pc when compiling/linking gnome-ssh-askpass2 (closes: #555951).Colin Watson
2009-10-05releasing version 1:5.1p1-8Colin Watson
2009-10-04Pass $SSHD_OPTS when checking configuration too (thanks, "sobtwmxt";Colin Watson
closes: #548662).
2009-09-30Fix grammar in if-up script (closes: #549128).Colin Watson
2009-09-26 - (djm) Release 5.3p1Damien Miller
2009-09-26 - (djm) [packet.c] Restore EWOULDBLOCK handling that got lost somewhereDamien Miller
2009-09-26 - (djm) [README] update relnotes URLDamien Miller
2009-09-26 - (djm) [contrib/caldera/openssh.spec contrib/redhat/openssh.spec]Damien Miller
[contrib/suse/openssh.spec] Update for release
2009-09-17Build-depend on libselinux1-dev on sh4 too (thanks, Nobuhiro Iwamatsu;Colin Watson
closes: #547103).
2009-09-11 - (dtucker) [configure.ac] Change the -lresolv check so it works on Mac OS XDarren Tucker
10.6 (which doesn't have BIND8_COMPAT and thus uses res_9_query). Patch from jbasney at ncsa uiuc edu.
2009-09-09 - (djm) [serverloop.c] Fix test for server-assigned remote forwarding portDamien Miller
(-R 0:...); bz#1578, spotted and fix by gavin AT emf.net; ok dtucker@
2009-09-01 - (dtucker) [configure.ac] Bug #1639: use AC_PATH_PROG to search the path forDarren Tucker
krb5-config if it's not in the location specified by --with-kerberos5. Patch from jchadima at redhat.
2009-08-29 - (dtucker) [README.platform] Add text about development packages, based onDarren Tucker
text from Chris Pepper in bug #1631.
2009-08-28Build with just -fPIC on mips/mipsel, not -fPIE as well (thanks, LIU Qi;Colin Watson
closes: #538313).
2009-08-28 - (dtucker) [configure.ac] Fix the syntax of the Solaris tcgetattr entry.Darren Tucker
2009-08-28 - (dtucker) [clientloop.c configure.ac defines.h] Make the client's IO bufferDarren Tucker
size a compile-time option and set it to 64k on Cygwin, since Corinna reports that it makes a significant difference to performance. ok djm@
2009-08-28 - (dtucker) [channels.c configure.ac] Bug #1528: skip the tcgetattr call onDarren Tucker
the pty master on Solaris, since it never succeeds and can hang if large amounts of data is sent to the slave (eg a copy-paste). Based on a patch originally from Doke Scott, ok djm@
2009-08-28 - (djm) [Makefile.in] bz#1505: Solaris make(1) doesn't accept make variablesDamien Miller
in argv, so pass them in the environment; ok dtucker@
2009-08-28- (djm) [sftp-server.c] bz#1535: accept ENOSYS as a fallback error whenDamien Miller
attempting atomic rename(); ok dtucker@
2009-08-28 - (djm) [sshd_config.5] downgrade mention of login.conf to be an exampleDamien Miller
and mention PAM as another provider for ChallengeResponseAuthentication; bz#1408; ok dtucker@
2009-08-28downgrade mention of login.conf to be an example and mention PAM asDamien Miller
another provider for ChallengeResponseAuthentication; bz#1408; ok dtucker@
2009-08-28 - dtucker [auth-sia.c] Roll back the change for bug #1241 as it apparentlyDarren Tucker
causes problems in some Tru64 configurations.
2009-08-20 - (dtucker) [session.c openbsd-compat/port-aix.h] Bugs #1249 and #1567: moveDarren Tucker
the setpcred call on AIX to immediately before the permanently_set_uid(). Ensures that we still have privileges when we call chroot and pam_open_sesson. Based on a patch from David Leonard.
2009-08-20 - (dtucker) [includes.h] Bug #1634: do not include system glob.h if we're notDarren Tucker
using it since the type conflicts can cause problems on FreeBSD. Patch from Jonathan Chen.
2009-08-17 - (dtucker) [sshlogin.c openbsd-compat/port-aix.{c,h}] Bug #1595: makeDarren Tucker
PrintLastLog work on AIX. Based in part on a patch from Miguel Sanders.
2009-08-17 - (dtucker) [configure.ac] Check for headers before libraries for openssl anDarren Tucker
zlib, which should make the errors slightly more meaningful on platforms where there's separate "-devel" packages for those.
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-08 14:26:10 +0000