| Age | Commit message (Collapse) | Author |
|---|
|
[serverloop.c]
backout 1.149, since it's not necessary and openssh clients send
broken CHANNEL_FAILURE/SUCCESS messages since about 2004; ok djm@
|
|
[clientloop.c]
we have to use the recipient's channel number (RFC 4254) for
SSH2_MSG_CHANNEL_SUCCESS/SSH2_MSG_CHANNEL_FAILURE messages,
otherwise we trigger 'Non-public channel' error messages on sshd
systems with clientkeepalive enabled; noticed by sturm; ok djm;
|
|
use some stack in main().
Report and suggested fix from vapier AT gentoo.org
|
|
[monitor_fdpass.c]
Retry sendmsg/recvmsg on EAGAIN and EINTR; ok djm@
|
|
[packet.c]
packet_disconnect() on padding error, too. should reduce the success
probability for the CPNI-957037 Plaintext Recovery Attack to 2^-18
ok djm@
|
|
and tweak the is-sshd-running check in ssh-host-config. Patch from
vinschen at redhat com.
|
|
|
|
declarations, removing an unnecessary union member and adding whitespace.
ok djm some time ago.
|
|
member of sockaddr_in6. Also reported in Bug 1491 by David Leonard. OK and
feedback by djm@
|
|
|
|
[regress/putty-ciphers.sh]
PuTTY supports AES CTR modes, so interop test against them too
|
|
[channels.c]
for sshd -T print 'permitopen any' vs. 'permitopen' for case of no
permitopen's; ok and input dtucker@
|
|
[servconf.c]
USE_AFS not referenced so remove #ifdef. fixes sshd -T not printing
kerberosgetafstoken. ok dtucker@
(Id sync only, we still want the ifdef in portable)
|
|
[session.c ssh.1]
typo fixed (overriden -> overridden)
ok espie, jmc
|
|
[auth2-jpake.c]
Move JPAKE define to make life easier for portable. ok djm@
|
|
[nchan.c]
add space to some log/debug messages for readability; ok djm@ markus@
|
|
[ssh-keygen.c]
spelling/typo in comment
|
|
- jmc@cvs.openbsd.org 2008/11/05 11:22:54
[servconf.c]
passord -> password;
fixes user/5975 from Rene Maroufi
|
|
[clientloop.c ssh.1]
add dynamic forward escape command line; ok djm@
|
|
[readconf.c]
because parse_forward() is now used to parse all forward types (DLR),
and it malloc's space for host variables, we don't need to malloc
here. fixes small memory leaks.
previously dynamic forwards were not parsed in parse_forward() and
space was not malloc'd in that case.
ok djm@
|
|
[auth.h auth2.c monitor.c monitor.h monitor_wrap.c monitor_wrap.h]
[readconf.c readconf.h servconf.c servconf.h ssh2.h ssh_config.5]
[sshconnect2.c sshd_config.5 jpake.c jpake.h schnorr.c auth2-jpake.c]
[Makefile.in]
Add support for an experimental zero-knowledge password authentication
method using the J-PAKE protocol described in F. Hao, P. Ryan,
"Password Authenticated Key Exchange by Juggling", 16th Workshop on
Security Protocols, Cambridge, April 2008.
This method allows password-based authentication without exposing
the password to the server. Instead, the client and server exchange
cryptographic proofs to demonstrate of knowledge of the password while
revealing nothing useful to an attacker or compromised endpoint.
This is experimental, work-in-progress code and is presently
compiled-time disabled (turn on -DJPAKE in Makefile.inc).
"just commit it. It isn't too intrusive." deraadt@
|
|
[auth.c]
need unistd.h for close() prototype
(ID sync only)
|
|
- djm@cvs.openbsd.org 2008/11/03 08:59:41
[servconf.c]
include MaxSessions in sshd -T output; patch from imorgan AT nas.nasa.gov
|
|
[contrib/redhat/sshd.pam] Move pam_nologin to account group from
incorrect auth group in example files;
patch from imorgan AT nas.nasa.gov
|
|
Make example scripts generate keys with default sizes rather than fixed,
non-default 1024 bits; patch from imorgan AT nas.nasa.gov
|
|
[readconf.c]
fix comment
|
|
[readconf.c]
remove valueless comment
|
|
[ttymodes.c]
protocol 2 tty modes support is now 7.5 years old so remove these
debug3()s; ok deraadt@
|
|
[clientloop.c readconf.c readconf.h ssh.c]
merge dynamic forward parsing into parse_forward(); 'i think this is OK' djm@
|
|
[ssh-keyscan.1 ssh-keyscan.c]
the ellipsis is not an optional argument; while here, improve spacing.
|
|
[channels.c]
fix some typos in log messages; ok djm@
|
|
[sshconnect2.c]
sprinkle ARGSUSED on dispatch handlers
nuke stale unusued prototype
|
|
[dispatch.c]
remove unused #define DISPATCH_MIN; ok markus@
|
|
[clientloop.c sshd.c]
don't need to #include "monitor_fdpass.h"
|
|
[ssh_config.5]
correct and clarify VisualHostKey; ok jmc@
|
|
[sshconnect.c]
use #define ROQUIET here; no binary change. ok dtucker@
|
|
[ssh_config.5]
use 'Privileged ports can be forwarded only when logging in as root on
the remote machine.' for RemoteForward just like ssh.1 -R.
ok djm@ jmc@
|
|
[key.c]
typo in error message; ok djm@
|
|
[scp.c]
spelling in comment; ok djm@
|
|
[ssh.c]
add -y to usage();
|
|
[servconf.c sshd_config.5]
support setting PermitEmptyPasswords in a Match block
requested in PR3891; ok dtucker@
|
|
[ssh.1 ssh.c]
Add -y option to force logging via syslog rather than stderr.
Useful for daemonised ssh connection (ssh -f). Patch originally from
and ok'd by markus@
|
|
[sshconnect2.c]
Repair strnvis() buffersize of 4*n+1, with termination gauranteed by the
function.
spotted by des@freebsd, who commited an incorrect fix to the freebsd tree
and (as is fairly typical) did not report the problem to us. But this fix
is correct.
ok djm
|
|
[sshd.8]
do not give an example of how to chmod files: we can presume the user
knows that. removes an ambiguity in the permission of authorized_keys;
ok deraadt
|
|
[session.c]
Convert an unchecked strdup to xstrdup. OK deraadt@
|
|
[compat.c compat.h nchan.c ssh.c]
only send eow and no-more-sessions requests to openssh 5 and newer;
fixes interop problems with broken ssh v2 implementations; ok djm@
|
|
[kex.c]
OpenSSL 0.9.8h supplies a real EVP_sha256 so we do not need our
replacement anymore
(ID sync only for portable - we still need this)
|
|
[session.c]
allow ForceCommand internal-sftp with arguments. based on patch from
michael.barabanov AT gmail.com; ok markus@
|
|
[ssh_config.5]
whitepsace -> whitespace. From Matthew Clarke via bugs@.
|
|
[sshconnect2.c]
don't allocate space for empty banners; report t8m at centrum.cz;
ok deraadt
|
