| Age | Commit message (Collapse) | Author |
|---|
|
[sshd.8]
the authorized_keys option for CA keys is "cert-authority", not
"from=cert-authority". spotted by imorgan AT nas.nasa.gov
|
|
- djm@cvs.openbsd.org 2010/03/03 01:44:36
[auth-options.c key.c]
reject strings with embedded ASCII nul chars in certificate key IDs,
principal names and constraints
|
|
|
|
|
|
on XFree86-devel with neutral /usr/include/X11/Xlib.h;
imorgan AT nas.nasa.gov in bz#1731
|
|
maybe-undefined global "optarg"
|
|
|
|
[ssh-keygen.c]
POSIX strptime is stricter than OpenBSD's so do a little dance to
appease it.
|
|
[ssh-keygen.c]
POSIX strptime is stricter than OpenBSD's so do a little dance to
appease it.
|
|
[ssh-add.c]
zap what seems to be a left-over debug message; ok markus@
|
|
[ssh-keygen.1 ssh.1 sshd.8]
tweak previous;
|
|
|
|
http://git.savannah.gnu.org/gitweb/ (2009-12-30 and 2010-01-22
respectively).
|
|
adjust log at verbose only, since according to cjwatson in bug #1470
some virtualization platforms don't allow writes.
|
|
"echo -n" with "echon" for portability.
|
|
to make older compilers (gcc 2.95) happy.
|
|
case from that matched in the system password database. On this
platform, passwords are stored case-insensitively, but sshd requires
exact case matching for Match blocks in sshd_config(5). Based on
a patch from vinschen AT redhat.com.
|
|
variables copied into sshd child processes. From vinschen AT redhat.com
|
|
|
|
[Makefile regress/cert-hostkey.sh regress/cert-userkey.sh]
regression tests for certified keys
|
|
- djm@cvs.openbsd.org 2010/02/26 20:29:54
[PROTOCOL PROTOCOL.agent PROTOCOL.certkeys addrmatch.c auth-options.c]
[auth-options.h auth.h auth2-pubkey.c authfd.c dns.c dns.h hostfile.c]
[hostfile.h kex.h kexdhs.c kexgexs.c key.c key.h match.h monitor.c]
[myproposal.h servconf.c servconf.h ssh-add.c ssh-agent.c ssh-dss.c]
[ssh-keygen.1 ssh-keygen.c ssh-rsa.c ssh.1 ssh.c ssh2.h sshconnect.c]
[sshconnect2.c sshd.8 sshd.c sshd_config.5]
Add support for certificate key types for users and hosts.
OpenSSH certificate key types are not X.509 certificates, but a much
simpler format that encodes a public key, identity information and
some validity constraints and signs it with a CA key. CA keys are
regular SSH keys. This certificate style avoids the attack surface
of X.509 certificates and is very easy to deploy.
Certified host keys allow automatic acceptance of new host keys
when a CA certificate is marked as sh/known_hosts.
see VERIFYING HOST KEYS in ssh(1) for details.
Certified user keys allow authentication of users when the signing
CA key is marked as trusted in authorized_keys. See "AUTHORIZED_KEYS
FILE FORMAT" in sshd(8) for details.
Certificates are minted using ssh-keygen(1), documentation is in
the "CERTIFICATES" section of that manpage.
Documentation on the format of certificates is in the file
PROTOCOL.certkeys
feedback and ok markus@
|
|
contrib/redhat/openssh.spec
contrib/suse/openssh.spec
|
|
|
|
[regress/Makefile keygen-convert.sh]
add regression test for ssh-keygen pubkey conversions
|
|
[regress/agent-pkcs11.sh]
test for PKCS#11 support (currently disabled)
|
|
[regress/test-exec.sh]
wait for sshd to fully stop in cleanup() function; avoids races in tests
that do multiple start_sshd/cleanup cycles; "I hate pidfiles" deraadt@
|
|
[regress/Makefile]
turn on all the malloc(3) checking options when running regression
tests. this has caught a few bugs for me in the past; ok dtucker@
|
|
[regress/addrmatch.sh]
clean up droppings
|
|
[regress/forwarding.sh]
regress test for stdio forwarding
|
|
[regress/Makefile]
add regression test for ssh-keygen pubkey conversions
|
|
[pathnames.h]
correct comment
|
|
[ssh-pkcs11.h] Add $OpenBSD$ RCS idents so we can sync portable
|
|
dlopen()
|
|
Use ssh_get_progname to fill __progname
|
|
Make it compile on OSX
|
|
[scard.c scard.h pkcs11.h scard/Makefile.in scard/Ssh.bin.uu scard/Ssh.java]
Remove obsolete smartcard support
|
|
[ssh.1]
libarary -> library;
|
|
[ssh-add.1 ssh-keygen.1 ssh.1 ssh_config.5]
pkcs#11 is no longer optional; improve wording; ok jmc@
|
|
[auth.c]
unbreak ChrootDirectory+internal-sftp by skipping check for executable
shell when chrooting; reported by danh AT wzrd.com; ok dtucker@
|
|
[buffer.c buffer.h]
constify the arguments to buffer_len, buffer_ptr and buffer_dump
|
|
[ssh-keygen.c]
fix -Wall
|
|
[ssh-agent.c]
fallout from PKCS#11: unbreak -D
|
|
[ssh-add.1 ssh-keygen.1 ssh.1 ssh.c]
tweak previous; ok markus
|
|
[pathnames.h readconf.c readconf.h scp.1 sftp.1 ssh-add.1 ssh-add.c]
[ssh-agent.c ssh-keygen.1 ssh-keygen.c ssh.1 ssh.c ssh_config.5]
replace our obsolete smartcard code with PKCS#11.
ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-11/v2-20/pkcs-11v2-20.pdf
ssh(1) and ssh-keygen(1) use dlopen(3) directly to talk to a PKCS#11
provider (shared library) while ssh-agent(1) delegates PKCS#11 to
a forked a ssh-pkcs11-helper process.
PKCS#11 is currently a compile time option.
feedback and ok djm@; inspired by patches from Alon Bar-Lev
`
|
|
[bufaux.c]
make buffer_get_string_ret() really non-fatal in all cases (it was
using buffer_get_int(), which could fatal() on buffer empty);
ok markus dtucker
|
|
getseuserbyname; patch from calebcase AT gmail.com via
cjwatson AT debian.org
|
|
at the time.
|
|
[channels.c]
fake local addr:port when stdio fowarding as some servers (Tectia at
least) validate that they are well-formed;
reported by imorgan AT nas.nasa.gov
ok dtucker
|
|
[sshd.8]
debug output goes to stderr, not "the system log"; ok markus dtucker
|
|
[mux.c]
don't mark channel as read failed if it is already closing; suppresses
harmless error messages when connecting to SSH.COM Tectia server
report by imorgan AT nas.nasa.gov
|
