summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2010-08-05 - djm@cvs.openbsd.org 2010/08/04 05:42:47Damien Miller
[auth.c auth2-hostbased.c authfile.c authfile.h ssh-keysign.8] [ssh-keysign.c ssh.c] enable certificates for hostbased authentication, from Iain Morgan; "looks ok" markus@
2010-08-05 - djm@cvs.openbsd.org 2010/08/04 05:40:39Damien Miller
[PROTOCOL.certkeys ssh-keygen.c] tighten the rules for certificate encoding by requiring that options appear in lexical order and make our ssh-keygen comply. ok markus@
2010-08-05 - djm@cvs.openbsd.org 2010/08/04 05:37:01Damien Miller
[ssh.1 ssh_config.5 sshd.8] Remove mentions of weird "addr/port" alternate address format for IPv6 addresses combinations. It hasn't worked for ages and we have supported the more commen "[addr]:port" format for a long time. ok jmc@ markus@
2010-08-03 - dtucker@cvs.openbsd.org 2010/07/23 08:49:25Damien Miller
[ssh.1] Ciphers is documented in ssh_config(5) these days
2010-08-03 - djm@cvs.openbsd.org 2010/07/21 02:10:58Damien Miller
[misc.c] sync timingsafe_bcmp() with the one dempsky@ committed to sys/lib/libkern
2010-08-03 - djm@cvs.openbsd.org 2010/07/19 09:15:12Damien Miller
[clientloop.c readconf.c readconf.h ssh.c ssh_config.5] add a "ControlPersist" option that automatically starts a background ssh(1) multiplex master when connecting. This connection can stay alive indefinitely, or can be set to automatically close after a user-specified duration of inactivity. bz#1330 - patch by dwmw2 AT infradead.org, but further hacked on by wmertens AT cisco.com, apb AT cequrux.com, martin-mindrot-bugzilla AT earth.li and myself; "looks ok" markus@
2010-08-03 - djm@cvs.openbsd.org 2010/07/19 03:16:33Damien Miller
[sftp-client.c] bz#1797: fix swapped args in upload_dir_internal(), breaking recursive upload depth checks and causing verbose printing of transfers to always be turned on; patch from imorgan AT nas.nasa.gov
2010-08-03 - djm@cvs.openbsd.org 2010/07/16 14:07:35Damien Miller
[ssh-rsa.c] more timing paranoia - compare all parts of the expected decrypted data before returning. AFAIK not exploitable in the SSH protocol. "groovy" deraadt@
2010-08-03 - OpenBSD CVS SyncDamien Miller
- djm@cvs.openbsd.org 2010/07/16 04:45:30 [ssh-keygen.c] avoid bogus compiler warning
2010-08-03 - (dtucker) [monitor.c] Bug #1795: Initialize the values to be returned fromDarren Tucker
PAM to sane values in case the PAM method doesn't write to them. Spotted by Bitman Zhou, ok djm@.
2010-07-19 - (dtucker) [contrib/ssh-copy-ud.1] Bug #1786: update ssh-copy-id.1 with moreDarren Tucker
details about its behaviour WRT existing directories. Patch from asguthrie at gmail com, ok djm.
2010-07-16 - schwarze@cvs.openbsd.org 2010/07/15 21:20:38Damien Miller
[ssh-keygen.1] repair incorrect block nesting, which screwed up indentation; problem reported and fix OK by jmc@
2010-07-16 - jmc@cvs.openbsd.org 2010/07/14 17:06:58Damien Miller
[ssh.1] finally ssh synopsis looks nice again! this commit just removes a ton of hacks we had in place to make it work with old groff;
2010-07-16 - djm@cvs.openbsd.org 2010/07/13 23:13:16Damien Miller
[auth-rsa.c channels.c jpake.c key.c misc.c misc.h monitor.c packet.c] [ssh-rsa.c] s/timing_safe_cmp/timingsafe_bcmp/g
2010-07-16 - djm@cvs.openbsd.org 2010/07/13 11:52:06Damien Miller
[auth-rsa.c channels.c jpake.c key.c misc.c misc.h monitor.c] [packet.c ssh-rsa.c] implement a timing_safe_cmp() function to compare memory without leaking timing information by short-circuiting like memcmp() and use it for some of the more sensitive comparisons (though nothing high-value was readily attackable anyway); "looks ok" markus@
2010-07-16 - djm@cvs.openbsd.org 2010/07/12 22:41:13Damien Miller
[ssh.c ssh_config.5] expand %h to the hostname in ssh_config Hostname options. While this sounds useless, it is actually handy for working with unqualified hostnames: Host *.* Hostname %h Host * Hostname %h.example.org "I like it" markus@
2010-07-16 - djm@cvs.openbsd.org 2010/07/12 22:38:52Damien Miller
[ssh.c] Make ExitOnForwardFailure work with fork-after-authentication ("ssh -f") for protocol 2. ok markus@
2010-07-16 - djm@cvs.openbsd.org 2010/07/02 04:32:44Damien Miller
[misc.c] unbreak strdelim() skipping past quoted strings, e.g. AllowUsers "blah blah" blah was broken; report and fix in bz#1757 from bitman.zhou AT centrify.com ok dtucker;
2010-07-14 - (tim) [contrib/redhat/openssh.spec] Bug 1796: Test for skip_x11_askpassTim Rice
(line 77) should have been for no_x11_askpass.
2010-07-02 - djm@cvs.openbsd.org 2010/06/29 23:59:54Damien Miller
[cert-userkey.sh] regress tests for key options in AuthorizedPrincipals
2010-07-02 - phessler@cvs.openbsd.org 2010/06/27 19:19:56Damien Miller
[Makefile] fix how we run the tests so we can successfully use SUDO='sudo -E' in our env
2010-07-02 - millert@cvs.openbsd.org 2010/07/01 13:06:59Damien Miller
[scp.c] Fix a longstanding problem where if you suspend scp at the password/passphrase prompt the terminal mode is not restored. OK djm@
2010-07-02 - jmc@cvs.openbsd.org 2010/06/30 07:28:34Damien Miller
[sshd_config.5] tweak previous;
2010-07-02 - jmc@cvs.openbsd.org 2010/06/30 07:26:03Damien Miller
[ssh-keygen.c] sort usage();
2010-07-02 - jmc@cvs.openbsd.org 2010/06/30 07:24:25Damien Miller
[ssh-keygen.1] tweak previous;
2010-07-02 - djm@cvs.openbsd.org 2010/06/29 23:16:46Damien Miller
[auth2-pubkey.c sshd_config.5] allow key options (command="..." and friends) in AuthorizedPrincipals; ok markus@
2010-07-02 - djm@cvs.openbsd.org 2010/06/29 23:15:30Damien Miller
[ssh-keygen.1 ssh-keygen.c] allow import (-i) and export (-e) of PEM and PKCS#8 encoded keys; bz#1749; ok markus@
2010-07-02 - djm@cvs.openbsd.org 2010/06/26 23:04:04Damien Miller
[ssh.c] oops, forgot to #include <canohost.h>; spotted and patch from chl@
2010-07-02 - jmc@cvs.openbsd.org 2010/06/26 00:57:07Damien Miller
[ssh_config.5] tweak previous;
2010-06-26 - (tim) [openbsd-compat/port-uw.c] Reorder includes. auth-options.h now needsTim Rice
key.h.
2010-06-26 - djm@cvs.openbsd.org 2010/06/25 23:10:30Damien Miller
[ssh.c] log the hostname and address that we connected to at LogLevel=verbose after authentication is successful to mitigate "phishing" attacks by servers with trusted keys that accept authentication silently and automatically before presenting fake password/passphrase prompts; "nice!" markus@
2010-06-26 - djm@cvs.openbsd.org 2010/06/25 23:10:30Damien Miller
[ssh.c] log the hostname and address that we connected to at LogLevel=verbose after authentication is successful to mitigate "phishing" attacks by servers with trusted keys that accept authentication silently and automatically before presenting fake password/passphrase prompts; "nice!" markus@
2010-06-26 - djm@cvs.openbsd.org 2010/06/25 08:46:17Damien Miller
[auth1.c auth2-none.c] skip the initial check for access with an empty password when PermitEmptyPasswords=no; bz#1638; ok markus@
2010-06-26 - djm@cvs.openbsd.org 2010/06/25 07:20:04Damien Miller
[channels.c session.c] bz#1750: fix requirement for /dev/null inside ChrootDirectory for internal-sftp accidentally introduced in r1.253 by removing the code that opens and dup /dev/null to stderr and modifying the channels code to read stderr but discard it instead; ok markus@
2010-06-26 - djm@cvs.openbsd.org 2010/06/25 07:14:46Damien Miller
[channels.c mux.c readconf.c readconf.h ssh.h] bz#1327: remove hardcoded limit of 100 permitopen clauses and port forwards per direction; ok markus@ stevesk@
2010-06-26 - djm@cvs.openbsd.org 2010/06/23 02:59:02Damien Miller
[ssh-keygen.c] fix printing of extensions in v01 certificates that I broke in r1.190
2010-06-26 - djm@cvs.openbsd.org 2010/06/22 04:59:12Damien Miller
[session.c] include the user name on "subsystem request for ..." log messages; bz#1571; ok dtucker@
2010-06-26 - djm@cvs.openbsd.org 2010/06/22 04:54:30Damien Miller
[ssh-keyscan.c] replace verbose and overflow-prone Linebuf code with read_keyfile_line() based on patch from joachim AT joachimschipper.nl; bz#1565; ok dtucker@
2010-06-26 - djm@cvs.openbsd.org 2010/06/22 04:49:47Damien Miller
[auth.c] queue auth debug messages for bad ownership or permissions on the user's keyfiles. These messages will be sent after the user has successfully authenticated (where our client will display them with LogLevel=debug).
2010-06-26 - djm@cvs.openbsd.org 2010/06/22 04:32:06Damien Miller
[ssh-keygen.c] standardise error messages when attempting to open private key files to include "progname: filename: error reason" bz#1783; ok dtucker@
2010-06-26 - djm@cvs.openbsd.org 2010/06/22 04:22:59Damien Miller
[servconf.c sshd_config.5] expose some more sshd_config options inside Match blocks: AuthorizedKeysFile AuthorizedPrincipalsFile HostbasedUsesNameFromPacketOnly PermitTunnel bz#1764; feedback from imorgan AT nas.nasa.gov; ok dtucker@
2010-06-26 - djm@cvs.openbsd.org 2010/06/18 04:43:08Damien Miller
[sftp-client.c] fix memory leak in do_realpath() error path; bz#1771, patch from anicka AT suse.cz
2010-06-26 - djm@cvs.openbsd.org 2010/06/18 03:16:03Damien Miller
[session.c] Missing check for chroot_director == "none" (we already checked against NULL); bz#1564 from Jan.Pechanec AT Sun.COM
2010-06-26 - djm@cvs.openbsd.org 2010/06/18 00:58:39Damien Miller
[sftp.c] unbreak ls in working directories that contains globbing characters in their pathnames. bz#1655 reported by vgiffin AT apple.com
2010-06-26 - djm@cvs.openbsd.org 2010/06/17 07:07:30Damien Miller
[mux.c] Correct sizing of object to be allocated by calloc(), replacing sizeof(state) with sizeof(*state). This worked by accident since the struct contained a single int at present, but could have broken in the future. patch from hyc AT symas.com
2010-06-26 - markus@cvs.openbsd.org 2010/06/08 21:32:19Damien Miller
[ssh-pkcs11.c] check length of value returned C_GetAttributValue for != 0 from mdrtbugzilla@codefive.co.uk; bugzilla #1773; ok dtucker@
2010-06-26 - OpenBSD CVS SyncDamien Miller
- djm@cvs.openbsd.org 2010/05/21 05:00:36 [misc.c] colon() returns char*, so s/return (0)/return NULL/
2010-06-22 - (djm) [loginrec.c] crank LINFO_NAMESIZE (username length) to 512Damien Miller
bz#1579; ok dtucker
2010-06-18 - (djm) [contrib/ssh-copy-id] Update key file explicitly under ~Damien Miller
rather than assuming that $CWD == $HOME. bz#1500, patch from timothy AT gelter.com
2010-06-17 - (tim) [contrib/cygwin/README] Remove a reference to the obsoleteTim Rice
minires-devel package, and to add the reference to the libedit-devel package since CYgwin now provides libedit. Patch from Corinna Vinschen.