| Age | Commit message (Collapse) | Author |
|---|
|
[kexgexs.c]
fix hash calculation for KEXGEX: hash over the original client-supplied
values and not the sanity checked versions that we acutally use;
bz#1540 reported by john.smith AT arrows.demon.co.uk
ok markus@
|
|
[channels.c]
call channel destroy callbacks on receipt of open failure messages.
fixes client hangs when connecting to a server that has MaxSessions=0
set spotted by imorgan AT nas.nasa.gov; ok markus@
|
|
[sshd_config.5]
add AllowAgentForwarding to available Match keywords list
ok djm
|
|
[pathnames.h]
no need to escape single quotes in comments
|
|
[ssh-keyscan.1]
fix example, default key type is rsa for 3+ years; from
frederic.perrin@resel.fr
|
|
[addrmatch.c]
o cannot be NULL here but use xfree() to be consistent; ok djm@
|
|
[clientloop.c]
fix typo in error message
|
|
[sftp.1 sftp.c]
update for the synopses displayed by the 'help' command, there are a
few missing flags; add 'bye' to the output of 'help'; sorting and spacing.
jmc@ suggested replacing .Oo/.Oc with a single .Op macro.
ok jmc@
|
|
[auth2-chall.c]
replace by-hand string building with xasprinf(); ok deraadt@
|
|
[channels.c servconf.c]
channel_print_adm_permitted_opens() should deal with all the printing
for that config option. suggested by markus@; ok markus@ djm@
dtucker@
|
|
ssh-copy-id copy id_rsa.pub by default (instead of the legacy "identity"
key). Patch from cjwatson AT debian.org
|
|
launchd on OS X; patch from vgiffin AT apple.com, slightly tweaked;
ok dtucker@
|
|
Patch based on one from vgiffin AT apple.com; ok dtucker@
|
|
OpenServer 6 doesn't need libcrypt.
|
|
openbsd-compat/xcrypt.c] Add SECUREWARE support to OpenServer 6 SVR5 ABI.
OK djm@ dtucker@
|
|
[sftp.1 sftp.c]
correct sftp(1) and corresponding usage syntax;
bz#1518 patch from imorgan AT nas.nasa.gov; ok deraadt@ improved diff jmc@
|
|
[readconf.c]
don't leave junk (free'd) pointers around in Forward *fwd argument on
failure; avoids double-free in ~C -L handler when given an invalid
forwarding specification; bz#1539 report from adejong AT debian.org
via Colin Watson; ok markus@ dtucker@
|
|
[sftp.c]
Deal correctly with failures in remote stat() operation in sftp,
correcting fail-on-error behaviour in batchmode. bz#1541 report and
fix from anedvedicky AT gmail.com; ok markus@
|
|
[clientloop.c]
The ~C escape handler does not work correctly for multiplexed sessions -
it opens a commandline on the master session, instead of on the slave
that requested it. Disable it on slave sessions until such time as it
is fixed; bz#1543 report from Adrian Bridgett via Colin Watson
ok markus@
|
|
[channels.c]
s/remote_id/id/ to be more consistent with other code; ok djm@
|
|
[serverloop.c]
backout 1.149, since it's not necessary and openssh clients send
broken CHANNEL_FAILURE/SUCCESS messages since about 2004; ok djm@
|
|
[clientloop.c]
we have to use the recipient's channel number (RFC 4254) for
SSH2_MSG_CHANNEL_SUCCESS/SSH2_MSG_CHANNEL_FAILURE messages,
otherwise we trigger 'Non-public channel' error messages on sshd
systems with clientkeepalive enabled; noticed by sturm; ok djm;
|
|
use some stack in main().
Report and suggested fix from vapier AT gentoo.org
|
|
[monitor_fdpass.c]
Retry sendmsg/recvmsg on EAGAIN and EINTR; ok djm@
|
|
[packet.c]
packet_disconnect() on padding error, too. should reduce the success
probability for the CPNI-957037 Plaintext Recovery Attack to 2^-18
ok djm@
|
|
and tweak the is-sshd-running check in ssh-host-config. Patch from
vinschen at redhat com.
|
|
|
|
declarations, removing an unnecessary union member and adding whitespace.
ok djm some time ago.
|
|
member of sockaddr_in6. Also reported in Bug 1491 by David Leonard. OK and
feedback by djm@
|
|
|
|
[regress/putty-ciphers.sh]
PuTTY supports AES CTR modes, so interop test against them too
|
|
[channels.c]
for sshd -T print 'permitopen any' vs. 'permitopen' for case of no
permitopen's; ok and input dtucker@
|
|
[servconf.c]
USE_AFS not referenced so remove #ifdef. fixes sshd -T not printing
kerberosgetafstoken. ok dtucker@
(Id sync only, we still want the ifdef in portable)
|
|
[session.c ssh.1]
typo fixed (overriden -> overridden)
ok espie, jmc
|
|
[auth2-jpake.c]
Move JPAKE define to make life easier for portable. ok djm@
|
|
[nchan.c]
add space to some log/debug messages for readability; ok djm@ markus@
|
|
[ssh-keygen.c]
spelling/typo in comment
|
|
- jmc@cvs.openbsd.org 2008/11/05 11:22:54
[servconf.c]
passord -> password;
fixes user/5975 from Rene Maroufi
|
|
[clientloop.c ssh.1]
add dynamic forward escape command line; ok djm@
|
|
[readconf.c]
because parse_forward() is now used to parse all forward types (DLR),
and it malloc's space for host variables, we don't need to malloc
here. fixes small memory leaks.
previously dynamic forwards were not parsed in parse_forward() and
space was not malloc'd in that case.
ok djm@
|
|
[auth.h auth2.c monitor.c monitor.h monitor_wrap.c monitor_wrap.h]
[readconf.c readconf.h servconf.c servconf.h ssh2.h ssh_config.5]
[sshconnect2.c sshd_config.5 jpake.c jpake.h schnorr.c auth2-jpake.c]
[Makefile.in]
Add support for an experimental zero-knowledge password authentication
method using the J-PAKE protocol described in F. Hao, P. Ryan,
"Password Authenticated Key Exchange by Juggling", 16th Workshop on
Security Protocols, Cambridge, April 2008.
This method allows password-based authentication without exposing
the password to the server. Instead, the client and server exchange
cryptographic proofs to demonstrate of knowledge of the password while
revealing nothing useful to an attacker or compromised endpoint.
This is experimental, work-in-progress code and is presently
compiled-time disabled (turn on -DJPAKE in Makefile.inc).
"just commit it. It isn't too intrusive." deraadt@
|
|
[auth.c]
need unistd.h for close() prototype
(ID sync only)
|
|
- djm@cvs.openbsd.org 2008/11/03 08:59:41
[servconf.c]
include MaxSessions in sshd -T output; patch from imorgan AT nas.nasa.gov
|
|
[contrib/redhat/sshd.pam] Move pam_nologin to account group from
incorrect auth group in example files;
patch from imorgan AT nas.nasa.gov
|
|
Make example scripts generate keys with default sizes rather than fixed,
non-default 1024 bits; patch from imorgan AT nas.nasa.gov
|
|
[readconf.c]
fix comment
|
|
[readconf.c]
remove valueless comment
|
|
[ttymodes.c]
protocol 2 tty modes support is now 7.5 years old so remove these
debug3()s; ok deraadt@
|
|
[clientloop.c readconf.c readconf.h ssh.c]
merge dynamic forward parsing into parse_forward(); 'i think this is OK' djm@
|
|
[ssh-keyscan.1 ssh-keyscan.c]
the ellipsis is not an optional argument; while here, improve spacing.
|
