summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2020-06-07Add DebianBanner server configuration optionKees Cook
Setting this to "no" causes sshd to omit the Debian revision from its initial protocol handshake, for those scared by package-versioning.patch. Bug-Debian: http://bugs.debian.org/562048 Forwarded: not-needed Last-Update: 2020-06-07 Patch-Name: debian-banner.patch
2020-06-07Include the Debian version in our identificationMatthew Vernon
This makes it easier to audit networks for versions patched against security vulnerabilities. It has little detrimental effect, as attackers will generally just try attacks rather than bothering to scan for vulnerable-looking version strings. (However, see debian-banner.patch.) Forwarded: not-needed Last-Update: 2019-06-05 Patch-Name: package-versioning.patch
2020-06-07Mention ssh-keygen in ssh fingerprint changed warningScott Moser
Author: Chris Lamb <lamby@debian.org> Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1843 Bug-Ubuntu: https://bugs.launchpad.net/bugs/686607 Last-Update: 2017-08-22 Patch-Name: mention-ssh-keygen-on-keychange.patch
2020-06-07Force use of DNSSEC even if "options edns0" isn't in resolv.confColin Watson
This allows SSHFP DNS records to be verified if glibc 2.11 is installed. Origin: vendor, https://cvs.fedoraproject.org/viewvc/F-12/openssh/openssh-5.2p1-edns.patch?revision=1.1&view=markup Bug: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=572049 Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=572049 Last-Update: 2010-04-06 Patch-Name: dnssec-sshfp.patch
2020-06-07Look for $SHELL on the path for ProxyCommand/LocalCommandColin Watson
There's some debate on the upstream bug about whether POSIX requires this. I (Colin Watson) agree with Vincent and think it does. Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1494 Bug-Debian: http://bugs.debian.org/492728 Last-Update: 2020-02-21 Patch-Name: shell-path.patch
2020-06-07Adjust scp quoting in verbose modeNicolas Valcárcel
Tweak scp's reporting of filenames in verbose mode to be a bit less confusing with spaces. This should be revised to mimic real shell quoting. Bug-Ubuntu: https://bugs.launchpad.net/bugs/89945 Last-Update: 2010-02-27 Patch-Name: scp-quoting.patch
2020-06-07Allow harmless group-writabilityColin Watson
Allow secure files (~/.ssh/config, ~/.ssh/authorized_keys, etc.) to be group-writable, provided that the group in question contains only the file's owner. Rejected upstream for IMO incorrect reasons (e.g. a misunderstanding about the contents of gr->gr_mem). Given that per-user groups and umask 002 are the default setup in Debian (for good reasons - this makes operating in setgid directories with other groups much easier), we need to permit this by default. Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1060 Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=314347 Last-Update: 2019-10-09 Patch-Name: user-group-modes.patch
2020-06-07"LogLevel SILENT" compatibilityNatalie Amery
"LogLevel SILENT" (-qq) was introduced in Debian openssh 1:3.0.1p1-1 to match the behaviour of non-free SSH, in which -q does not suppress fatal errors. However, this was unintentionally broken in 1:4.6p1-2 and nobody complained, so we've dropped most of it. The parts that remain are basic configuration file compatibility, and an adjustment to "Pseudo-terminal will not be allocated ..." which should be split out into a separate patch. Author: Matthew Vernon <matthew@debian.org> Author: Colin Watson <cjwatson@debian.org> Last-Update: 2013-09-14 Patch-Name: syslog-level-silent.patch
2020-06-07Various keepalive extensionsRichard Kettlewell
Add compatibility aliases for ProtocolKeepAlives and SetupTimeOut, supported in previous versions of Debian's OpenSSH package but since superseded by ServerAliveInterval. (We're probably stuck with this bit for compatibility.) In batch mode, default ServerAliveInterval to five minutes. Adjust documentation to match and to give some more advice on use of keepalives. Author: Ian Jackson <ian@chiark.greenend.org.uk> Author: Matthew Vernon <matthew@debian.org> Author: Colin Watson <cjwatson@debian.org> Last-Update: 2020-02-21 Patch-Name: keepalive-extensions.patch
2020-06-07Accept obsolete ssh-vulnkey configuration optionsColin Watson
These options were used as part of Debian's response to CVE-2008-0166. Nearly six years later, we no longer need to continue carrying the bulk of that patch, but we do need to avoid failing when the associated configuration options are still present. Last-Update: 2014-02-09 Patch-Name: ssh-vulnkey-compat.patch
2020-06-07Handle SELinux authorisation rolesManoj Srivastava
Rejected upstream due to discomfort with magic usernames; a better approach will need an SSH protocol change. In the meantime, this came from Debian's SELinux maintainer, so we'll keep it until we have something better. Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1641 Bug-Debian: http://bugs.debian.org/394795 Last-Update: 2020-02-21 Patch-Name: selinux-role.patch
2020-06-07Restore TCP wrappers supportColin Watson
Support for TCP wrappers was dropped in OpenSSH 6.7. See this message and thread: https://lists.mindrot.org/pipermail/openssh-unix-dev/2014-April/032497.html It is true that this reduces preauth attack surface in sshd. On the other hand, this support seems to be quite widely used, and abruptly dropping it (from the perspective of users who don't read openssh-unix-dev) could easily cause more serious problems in practice. It's not entirely clear what the right long-term answer for Debian is, but it at least probably doesn't involve dropping this feature shortly before a freeze. Forwarded: not-needed Last-Update: 2019-06-05 Patch-Name: restore-tcp-wrappers.patch
2020-06-07GSSAPI key exchange supportSimon Wilkinson
This patch has been rejected upstream: "None of the OpenSSH developers are in favour of adding this, and this situation has not changed for several years. This is not a slight on Simon's patch, which is of fine quality, but just that a) we don't trust GSSAPI implementations that much and b) we don't like adding new KEX since they are pre-auth attack surface. This one is particularly scary, since it requires hooks out to typically root-owned system resources." However, quite a lot of people rely on this in Debian, and it's better to have it merged into the main openssh package rather than having separate -krb5 packages (as we used to have). It seems to have a generally good security history. Author: Simon Wilkinson <simon@sxw.org.uk> Author: Colin Watson <cjwatson@debian.org> Author: Jakub Jelen <jjelen@redhat.com> Origin: other, https://github.com/openssh-gsskex/openssh-gsskex/commits/debian/master Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1242 Last-Updated: 2020-06-07 Patch-Name: gssapi.patch
2020-06-07Import openssh_8.3p1.orig.tar.gzColin Watson
2020-06-05upstream: unbreak "sshd -ddd" - close of config passing fd happened toodjm@openbsd.org
early. ok markus@ OpenBSD-Commit-ID: 49346e945c6447aca3e904e65fc400128d2f8ed0
2020-06-05Add support for AUDIT_ARCH_RISCV64Andreas Schwab
2020-06-05upstream: make sshbuf_putb(b, NULL) a no-opdjm@openbsd.org
OpenBSD-Commit-ID: 976fdc99b500e347023d430df372f31c1dd128f7
2020-06-05upstream: make sshbuf_dump() args constdjm@openbsd.org
OpenBSD-Commit-ID: b4a5accae750875d665b862504169769bcf663bd
2020-06-05upstream: wrap long linedjm@openbsd.org
OpenBSD-Commit-ID: ed405a12bd27bdc9c52e169bc5ff3529b4ebbbb2
2020-06-05upstream: Correct historical comment: provos@ modified OpenSSH todtucker@openbsd.org
work with SSLeay (very quickly replaced by OpenSSL) not SSL in general. ok deraadt, historical context markus@ OpenBSD-Commit-ID: 7209e07a2984b50411ed8ca5a4932da5030d2b90
2020-06-05upstream: Import regenerated moduli file.dtucker@openbsd.org
OpenBSD-Commit-ID: 52ff0e3205036147b2499889353ac082e505ea54
2020-06-05Test fallthrough in OSSH_CHECK_CFLAG_COMPILE.Darren Tucker
clang 10's -Wimplicit-fallthrough does not understand /* FALLTHROUGH */ comments and we don't use the __attribute__((fallthrough)) that it's looking for. This has the effect of turning off -Wimplicit-fallthrough where it does not currently help (particularly with -Werror). ok djm@
2020-06-04upstream: Import regenerated moduli file.dtucker@openbsd.org
OpenBSD-Commit-ID: 52ff0e3205036147b2499889353ac082e505ea54
2020-06-04upstream: Remove now-unused proto_spec and associated definitions.dtucker@openbsd.org
ok djm@ OpenBSD-Commit-ID: 2e2b18e3aa6ee22a7b69c39f2d3bd679ec35c362
2020-05-30upstream: Fix error message on close(2) and add printf formatmillert@openbsd.org
attributes. From Christos Zoulas, OK markus@ OpenBSD-Commit-ID: 41523c999a9e3561fcc7082fd38ea2e0629ee07e
2020-05-29upstream: Make dollar_expand variadic and pass a real va_list todtucker@openbsd.org
vdollar_percent_expand. Fixes build error on arm64 spotted by otto@. OpenBSD-Commit-ID: 181910d7ae489f40ad609b4cf4a20f3d068a7279
2020-05-29Omit ToS setting if we don't have IPV6_TCLASS too.Darren Tucker
Fixes tests on old BSDs.
2020-05-29upstream: Pass a NULL instead of zeroed out va_list fromdtucker@openbsd.org
dollar_expand. The original intent was in case there's some platform where va_list is not a pointer equivalent, but on i386 this chokes on the memset. This unbreaks that build, but will require further consideration. OpenBSD-Commit-ID: 7b90afcd8e1137a1d863204060052aef415baaf7
2020-05-29upstream: remove a stray .El;jmc@openbsd.org
OpenBSD-Commit-ID: 58ddfe6f8a15fe10209db6664ecbe7896f1d167c
2020-05-29upstream: Add regression and unit tests for ${ENV} styledtucker@openbsd.org
environment variable expansion in various keywords (bz#3140). ok djm@ OpenBSD-Regress-ID: 4d9ceb95d89365b7b674bc26cf064c15a5bbb197
2020-05-29upstream: Unit test for convtime. ok djm@dtucker@openbsd.org
OpenBSD-Regress-ID: cec4239efa2fc4c7062064f07a847e1cbdbcd5dd
2020-05-29upstream: mention that wildcards are processed in lexical order;djm@openbsd.org
bz#3165 OpenBSD-Commit-ID: 8856f3d1612bd42e9ee606d89386cae456dd165c
2020-05-29upstream: Allow some keywords to expand shell-style ${ENV}dtucker@openbsd.org
environment variables on the client side. The supported keywords are CertificateFile, ControlPath, IdentityAgent and IdentityFile, plus LocalForward and RemoteForward when used for Unix domain socket paths. This would for example allow forwarding of Unix domain socket paths that change at runtime. bz#3140, ok djm@ OpenBSD-Commit-ID: a4a2e801fc2d4df2fe0e58f50d9c81b03822dffa
2020-05-29dependDamien Miller
2020-05-29partial sync of regress/netcat.c with upstreamsobrado
synchronize synopsis and usage.
2020-05-29partial sync of regress/netcat.c with upstreamchl
remove unused variable ok tedu@
2020-05-29partial sync of regress/netcat.c with upstreamtobias
The code in socks.c writes multiple times in a row to a socket. If the socket becomes invalid between these calls (e.g. connection closed), write will throw SIGPIPE. With this patch, SIGPIPE is ignored so we can handle write's -1 return value (errno will be EPIPE). Ultimately, it leads to program exit, too -- but with nicer error message. :) with input by and ok djm
2020-05-29partial sync of regress/netcat.c with upstreamtobias
Check for short writes in fdpass(). Clean up while at it. ok djm
2020-05-29partial sync of regress/netcat.c with upstreamjca
Support for nc -T on IPv6 addresses. ok sthen@
2020-05-29upstream: fix compilation on !HAVE_DLOPEN platforms; stub functiondjm@openbsd.org
was not updated to match API change. From Dale Rahn via beck@ ok markus@ OpenBSD-Commit-ID: 2b8d054afe34c9ac85e417dae702ef981917b836
2020-05-29upstream: fix exit status for downloading of FIDO resident keys;djm@openbsd.org
from Pedro Martelletto, ok markus@ OpenBSD-Commit-ID: 0da77dc24a1084798eedd83c39a002a9d231faef
2020-05-29upstream: Fix multiplier in convtime when handling seconds afterdtucker@openbsd.org
other units. bz#3171, spotted by ronf at timeheart.net, ok djm@. OpenBSD-Commit-ID: 95b7a848e1083974a65fbb6ccb381d438e1dd5be
2020-05-28upstream: fix Include before Match in sshd_config; bz#3122 patchdjm@openbsd.org
from Jakub Jelen OpenBSD-Commit-ID: 1b0aaf135fe6732b5d326946042665dd3beba5f4
2020-05-28upstream: Do not call process_queued_listen_addrs() for everydjm@openbsd.org
included file from sshd_config; patch from Jakub Jelen OpenBSD-Commit-ID: 0ff603d6f06a7fab4881f12503b53024799d0a49
2020-05-28upstream: fix crash in recallocarray when deleting SendEnvdjm@openbsd.org
variables; spotted by & ok sthen@ OpenBSD-Commit-ID: b881e8e849edeec5082b5c0a87d8d7cff091a8fd
2020-05-28upstream: two new tests for Include in sshd_config, checking whetherdjm@openbsd.org
Port directives are processed correctly and handling of Include directives that appear before Match. Both tests currently fail. bz#3122 and bz#3169 - patch from Jakub Jelen OpenBSD-Regress-ID: 8ad5a4a385a63f0a1c59c59c763ff029b45715df
2020-05-27Document that libfido2 >= 1.4.0 is needed.Darren Tucker
2020-05-27dependDamien Miller
2020-05-27upstream: avoid possible NULL deref; from Pedro Martellettodjm@openbsd.org
OpenBSD-Commit-ID: e6099c3fbb70aa67eb106e84d8b43f1fa919b721
2020-05-27upstream: fix memleak of signature; from Pedro Martellettodjm@openbsd.org
OpenBSD-Commit-ID: d0a6eb07e77c001427d738b220dd024ddc64b2bb
generated by cgit v1.2.3 (git 2.39.1) at 2024-10-03 09:17:38 +0000