summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2020-02-21Various keepalive extensionsRichard Kettlewell
Add compatibility aliases for ProtocolKeepAlives and SetupTimeOut, supported in previous versions of Debian's OpenSSH package but since superseded by ServerAliveInterval. (We're probably stuck with this bit for compatibility.) In batch mode, default ServerAliveInterval to five minutes. Adjust documentation to match and to give some more advice on use of keepalives. Author: Ian Jackson <ian@chiark.greenend.org.uk> Author: Matthew Vernon <matthew@debian.org> Author: Colin Watson <cjwatson@debian.org> Last-Update: 2020-02-21 Patch-Name: keepalive-extensions.patch
2020-02-21Accept obsolete ssh-vulnkey configuration optionsColin Watson
These options were used as part of Debian's response to CVE-2008-0166. Nearly six years later, we no longer need to continue carrying the bulk of that patch, but we do need to avoid failing when the associated configuration options are still present. Last-Update: 2014-02-09 Patch-Name: ssh-vulnkey-compat.patch
2020-02-21Handle SELinux authorisation rolesManoj Srivastava
Rejected upstream due to discomfort with magic usernames; a better approach will need an SSH protocol change. In the meantime, this came from Debian's SELinux maintainer, so we'll keep it until we have something better. Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1641 Bug-Debian: http://bugs.debian.org/394795 Last-Update: 2020-02-21 Patch-Name: selinux-role.patch
2020-02-21Restore TCP wrappers supportColin Watson
Support for TCP wrappers was dropped in OpenSSH 6.7. See this message and thread: https://lists.mindrot.org/pipermail/openssh-unix-dev/2014-April/032497.html It is true that this reduces preauth attack surface in sshd. On the other hand, this support seems to be quite widely used, and abruptly dropping it (from the perspective of users who don't read openssh-unix-dev) could easily cause more serious problems in practice. It's not entirely clear what the right long-term answer for Debian is, but it at least probably doesn't involve dropping this feature shortly before a freeze. Forwarded: not-needed Last-Update: 2019-06-05 Patch-Name: restore-tcp-wrappers.patch
2020-02-21GSSAPI key exchange supportSimon Wilkinson
This patch has been rejected upstream: "None of the OpenSSH developers are in favour of adding this, and this situation has not changed for several years. This is not a slight on Simon's patch, which is of fine quality, but just that a) we don't trust GSSAPI implementations that much and b) we don't like adding new KEX since they are pre-auth attack surface. This one is particularly scary, since it requires hooks out to typically root-owned system resources." However, quite a lot of people rely on this in Debian, and it's better to have it merged into the main openssh package rather than having separate -krb5 packages (as we used to have). It seems to have a generally good security history. Origin: other, https://github.com/openssh-gsskex/openssh-gsskex/commits/debian/master Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1242 Last-Updated: 2020-02-21 Patch-Name: gssapi.patch
2020-02-21Import openssh_8.2p1.orig.tar.gzColin Watson
2020-02-14upstream: openssh-8.2djm@openbsd.org
OpenBSD-Commit-ID: 0a1340ff65fad0d84b997ac58dd1b393dec7c19b
2020-02-12crank version numbersDamien Miller
2020-02-11Minor documentation update:Darren Tucker
- remove duplication of dependency information (it's all in INSTALL). - SSHFP is now an RFC.
2020-02-09Check if UINT32_MAX is defined before redefining.Darren Tucker
2020-02-07typo; reported by Phil PennockDamien Miller
2020-02-07upstream: sync the description of the $SSH_SK_PROVIDER environmentdjm@openbsd.org
variable with that of the SecurityKeyProvider ssh/sshd_config(5) directive, as the latter was more descriptive. OpenBSD-Commit-ID: 0488f09530524a7e53afca6b6e1780598022552f
2020-02-07upstream: Add ssh -Q key-sig for all key and signature types.dtucker@openbsd.org
Teach ssh -Q to accept ssh_config(5) and sshd_config(5) algorithm keywords as an alias for the corresponding query. Man page help jmc@, ok djm@. OpenBSD-Commit-ID: 1e110aee3db2fc4bc5bee2d893b7128fd622e0f8
2020-02-07upstream: fix two PIN entry bugs on FIDO keygen: 1) it would allow moredjm@openbsd.org
than the intended number of prompts (3) and 2) it would SEGV too many incorrect PINs were entered; based on patch by Gabriel Kihlman OpenBSD-Commit-ID: 9c0011f28ba8bd8adf2014424b64960333da1718
2020-02-07upstream: When using HostkeyAlgorithms to merely append or removedjm@openbsd.org
algorithms from the default set (i.e. HostkeyAlgorithms=+/-...), retain the default behaviour of preferring those algorithms that have existing keys in known_hosts; ok markus OpenBSD-Commit-ID: 040e7fcc38ea00146b5d224ce31ce7a1795ee6ed
2020-02-07upstream: expand HostkeyAlgorithms prior to config dump, matchingdjm@openbsd.org
other algorithm lists; ok markus@ OpenBSD-Commit-ID: a66f0fca8cc5ce30405a2867bc115fff600671d0
2020-02-07upstream: Add Include to the list of permitted keywords after anaddy@openbsd.org
Match keyword. ok markus@ OpenBSD-Commit-ID: 342e940538b13dd41e0fa167dc9ab192b9f6e2eb
2020-02-07upstream: Replace "security key" with "authenticator" in programnaddy@openbsd.org
messages. This replaces "security key" in error/usage/verbose messages and distinguishes between "authenticator" and "authenticator-hosted key". ok djm@ OpenBSD-Commit-ID: 7c63800e9c340c59440a054cde9790a78f18592e
2020-02-06Don't look for UINT32_MAX in inttypes.hDarren Tucker
... unless we are actually going to use it. Fixes build on HP-UX without the potential impact to other platforms of a header change shortly before release.
2020-02-06dependDamien Miller
2020-02-06Fix sha2 MAKE_CLONE no-op definitionMichael Forney
The point of the dummy declaration is so that MAKE_CLONE(...) can have a trailing semicolon without introducing an empty declaration. So, the macro replacement text should *not* have a trailing semicolon, just like DEF_WEAK.
2020-02-04upstream: require FIDO application strings to start with "ssh:"; okdjm@openbsd.org
markus@ OpenBSD-Commit-ID: 94e9c1c066d42b76f035a3d58250a32b14000afb
2020-02-04upstream: revert enabling UpdateHostKeys by default - there are stilldjm@openbsd.org
corner cases we need to address; ok markus OpenBSD-Commit-ID: ff7ad941bfdc49fb1d8baa95fd0717a61adcad57
2020-02-04upstream: use better markup for challenge and write-attestation, andjmc@openbsd.org
rejig the challenge text a little; ok djm OpenBSD-Commit-ID: 9f351e6da9edfdc907d5c3fdaf2e9ff3ab0a7a6f
2020-02-03mention libfido2 in dependencies sectionDamien Miller
2020-02-03add clock_gettime64(2) to sandbox allowed syscallsDamien Miller
bz3093
2020-02-02upstream: Output (none) in debug in the case in the CheckHostIP=no casedtucker@openbsd.org
as suggested by markus@ OpenBSD-Commit-ID: 4ab9117ee5261cbbd1868717fcc3142eea6385cf
2020-02-02upstream: Prevent possible null pointer deref of ip_str in debug.dtucker@openbsd.org
OpenBSD-Commit-ID: 37b252e2e6f690efed6682437ef75734dbc8addf
2020-02-02upstream: shuffle the challenge keyword to keep the -O list sorted;jmc@openbsd.org
OpenBSD-Commit-ID: 08efad608b790949a9a048d65578fae9ed5845fe
2020-02-02upstream: tweak previous;jmc@openbsd.org
OpenBSD-Commit-ID: 0c42851cdc88583402b4ab2b110a6348563626d3
2020-02-01Use sys-queue.h from compat library.Darren Tucker
Fixes build on platforms that don't have sys/queue.h (eg MUSL).
2020-02-01upstream: regress test for sshd_config Include directive; from Jakubdjm@openbsd.org
Jelen OpenBSD-Regress-ID: 0d9224de3297c7a5f51ba68d6e3725a2a9345fa4
2020-02-01upstream: whitespacedjm@openbsd.org
OpenBSD-Commit-ID: 564cf7a5407ecf5da2d94ec15474e07427986772
2020-02-01upstream: force early logging to stderr if debug_flag (-d) is set;djm@openbsd.org
avoids missing messages from re-exec config passing OpenBSD-Commit-ID: 02484b8241c1f49010e7a543a7098e6910a8c9ff
2020-02-01upstream: mistake in previous: filling the incorrect bufferdjm@openbsd.org
OpenBSD-Commit-ID: 862ee84bd4b97b529f64aec5d800c3dcde952e3a
2020-02-01upstream: Add a sshd_config "Include" directive to allow inclusiondjm@openbsd.org
of files. This has sensible semantics wrt Match blocks and accepts glob(3) patterns to specify the included files. Based on patch by Jakub Jelen in bz2468; feedback and ok markus@ OpenBSD-Commit-ID: 36ed0e845b872e33f03355b936a4fff02d5794ff
2020-02-01upstream: spelling fix;jmc@openbsd.org
OpenBSD-Commit-ID: 3c079523c4b161725a4b15dd06348186da912402
2020-01-31upstream: document changed default for UpdateHostKeysdjm@openbsd.org
OpenBSD-Commit-ID: 25c390b21d142f78ac0106241d13441c4265fd2c
2020-01-31upstream: enable UpdateKnownHosts=yes if the configurationdjm@openbsd.org
specifies only the default known_hosts files, otherwise select UpdateKnownHosts=ask; ok markus@ OpenBSD-Commit-ID: ab401a5ec4a33d2e1a9449eae6202e4b6d427df7
2020-01-30Look in inttypes.h for UINT32_MAX.Darren Tucker
Should prevent warnings on at least some AIX versions.
2020-01-30upstream: use sshpkt_fatal() instead of plain fatal() fordjm@openbsd.org
ssh_packet_write_poll() failures here too as the former yields better error messages; ok dtucker@ OpenBSD-Commit-ID: 1f7a6ca95bc2b716c2e948fc1370753be772d8e3
2020-01-30upstream: check the return value of ssh_packet_write_poll() anddjm@openbsd.org
call sshpkt_fatal() if it fails; avoid potential busy-loop under some circumstances. Based on patch by Mike Frysinger; ok dtucker@ OpenBSD-Commit-ID: c79fe5cf4f0cd8074cb6db257c1394d5139408ec
2020-01-30upstream: have sshpkt_fatal() save/restore errno before wedjm@openbsd.org
potentially call strerror() (via ssh_err()); ok dtucker OpenBSD-Commit-ID: 5590df31d21405498c848245b85c24acb84ad787
2020-01-30upstream: markus suggests a simplification to previousdjm@openbsd.org
OpenBSD-Commit-ID: 10bbfb6607ebbb9a018dcd163f0964941adf58de
2020-01-29upstream: give more context to UpdateHostKeys messages, mentioningdjm@openbsd.org
that the changes are validated by the existing trusted host key. Prompted by espie@ feedback and ok markus@ OpenBSD-Commit-ID: b3d95f4a45f2692f4143b9e77bb241184dbb8dc5
2020-01-29upstream: changes to support FIDO attestationdjm@openbsd.org
Allow writing to disk the attestation certificate that is generated by the FIDO token at key enrollment time. These certificates may be used by an out-of-band workflow to prove that a particular key is held in trustworthy hardware. Allow passing in a challenge that will be sent to the card during key enrollment. These are needed to build an attestation workflow that resists replay attacks. ok markus@ OpenBSD-Commit-ID: 457dc3c3d689ba39eed328f0817ed9b91a5f78f6
2020-01-29upstream: disable UpdateHostKeys=ask when in quiet mode; "work fordjm@openbsd.org
me" matthieu@ OpenBSD-Commit-ID: 60d7b5eb91accf935ed9852650a826d86db2ddc7
2020-01-28compat for missing IPTOS_DSCP_LE in system headersDamien Miller
2020-01-28upstream: make IPTOS_DSCP_LE available via IPQoS directive; bz2986,djm@openbsd.org
based on patch by veegish AT cyberstorm.mu OpenBSD-Commit-ID: 9902bf4fbb4ea51de2193ac2b1d965bc5d99c425
2020-01-28upstream: disable UpdateHostKeys=ask if command is specified; okmarkus@openbsd.org
djm@ sthen@ OpenBSD-Commit-ID: e5bcc45eadb78896637d4143d289f1e42c2ef5d7
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-15 07:27:52 +0000