summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2017-02-03prefer to use ldns-config to find libldnsDamien Miller
Should fix bz#2603 - "Build with ldns and without kerberos support fails if ldns compiled with kerberos support" by including correct cflags/libs ok dtucker@
2017-02-03upstream commitdtucker@openbsd.org
Make ssh_packet_set_rekey_limits take u32 for the number of seconds until rekeying (negative values are rejected at config parse time). This allows the removal of some casts and a signed vs unsigned comparison warning. rekey_time is cast to int64 for the comparison which is a no-op on OpenBSD, but should also do the right thing in -portable on anything still using 32bit time_t (until the system time actually wraps, anyway). some early guidance deraadt@, ok djm@ Upstream-ID: c9f18613afb994a07e7622eb326f49de3d123b6c
2017-02-03upstream commitjsg@openbsd.org
In vasnmprintf() return an error if malloc fails and don't set a function argument to the address of free'd memory. ok djm@ Upstream-ID: 1efffffff2f51d53c9141f245b90ac23d33b9779
2017-02-03upstream commitdtucker@openbsd.org
Return true reason for port forwarding failures where feasible rather than always "administratively prohibited". bz#2674, ok djm@ Upstream-ID: d901d9887951774e604ca970e1827afaaef9e419
2017-02-03upstream commitdtucker@openbsd.org
Small correction to the known_hosts section on when it is updated. Patch from lkppo at free.fr some time ago, pointed out by smallm at sdf.org Upstream-ID: 1834d7af179dea1a12ad2137f84566664af225d5
2017-02-03Remove _XOPEN_SOURCE from wide char detection.Darren Tucker
Having _XOPEN_SOURCE unconditionally causes problems on some platforms and configurations, notably Solaris 64-bit binaries. It was there for the benefit of Linux put the required bits in the *-*linux* section. Patch from yvoinov at gmail.com.
2017-01-30upstream commitdjm@openbsd.org
fully unbreak: some $SSH invocations did not have -F specified and could pick up the ~/.ssh/config of the user running the tests Upstream-Regress-ID: f362d1892c0d3e66212d5d3fc02d915c58ef6b89
2017-01-30upstream commitdjm@openbsd.org
partially unbreak: was not specifying hostname on some $SSH invocations Upstream-Regress-ID: bc8a5e98e57bad0a92ef4f34ed91c1d18294e2cc
2017-01-30upstream commitdjm@openbsd.org
revise keys/principals command hang fix (bz#2655) to consume entire output, avoiding sending SIGPIPE to subprocesses early; ok dtucker@ Upstream-ID: 7cb04b31a61f8c78c4e48ceededcd2fd5c4ee1bc
2017-01-30upstream commitdjm@openbsd.org
small cleanup post SSHv1 removal: remove SSHv1-isms in commented examples reorder token table to group deprecated and compile-time conditional tokens better fix config dumping code for some compile-time conditional options that weren't being correctly skipped (SSHv1 and PKCS#11) Upstream-ID: f2e96b3cb3158d857c5a91ad2e15925df3060105
2017-01-30upstream commitdjm@openbsd.org
some explicit NULL tests when dumping configured forwardings; from Karsten Weiss Upstream-ID: 40957b8dea69672b0e50df6b4a91a94e3e37f72d
2017-01-30upstream commitdjm@openbsd.org
misplaced braces in test; from Karsten Weiss Upstream-ID: f7b794074d3aae8e35b69a91d211c599c94afaae
2017-01-30upstream commitdjm@openbsd.org
don't dereference authctxt before testing != NULL, it causes compilers to make assumptions; from Karsten Weiss Upstream-ID: 794243aad1e976ebc717885b7a97a25e00c031b2
2017-01-30upstream commitdjm@openbsd.org
use correct ssh-add program; bz#2654, from Colin Watson Upstream-Regress-ID: 7042a36e1bdaec6562f6e57e9d047efe9c7a6030
2017-01-30upstream commitdtucker@openbsd.org
Account for timeouts in the integrity tests as failures. If the first test in a series for a given MAC happens to modify the low bytes of a packet length, then ssh will time out and this will be interpreted as a test failure. Patch from cjwatson at debian.org via bz#2658. Upstream-Regress-ID: e7467613b0badedaa300bc6fc7495ec2f44e2fb9
2017-01-30upstream commitdtucker@openbsd.org
Make forwarding test less racy by using unix domain sockets instead of TCP ports where possible. Patch from cjwatson at debian.org via bz#2659. Upstream-Regress-ID: 4756375aac5916ef9d25452a1c1d5fa9e90299a9
2017-01-30upstream commitdtucker@openbsd.org
Fix typo in ~C error message for bad port forward cancellation. bz#2672, from Brad Marshall via Colin Watson and Ubuntu's bugtracker. Upstream-ID: 0d4a7e5ead6cc59c9a44b4c1e5435ab3aada09af
2017-01-30upstream commitguenther@openbsd.org
The POSIX APIs that that sockaddrs all ignore the s*_len field in the incoming socket, so userspace doesn't need to set it unless it has its own reasons for tracking the size along with the sockaddr. ok phessler@ deraadt@ florian@ Upstream-ID: ca6e49e2f22f2b9e81d6d924b90ecd7e422e7437
2017-01-30upstream commitjmc@openbsd.org
keep the tokens list sorted; Upstream-ID: b96239dae4fb3aa94146bb381afabcc7740a1638
2017-01-30upstream commitdjm@openbsd.org
fix previous Upstream-ID: c107d6a69bc22325d79fbf78a2a62e04bcac6895
2017-01-30upstream commitdjm@openbsd.org
show a useful error message when included config files can't be opened; bz#2653, ok dtucker@ Upstream-ID: f598b73b5dfe497344cec9efc9386b4e5a3cb95b
2017-01-30upstream commitdjm@openbsd.org
sshd_config is documented to set GSSAPIStrictAcceptorCheck=yes by default, so actually make it do this. bz#2637 ok dtucker Upstream-ID: 99ef8ac51f17f0f7aec166cb2e34228d4d72a665
2017-01-30upstream commitdjm@openbsd.org
Avoid confusing error message when attempting to use ssh-keyscan built without SSH protocol v.1 to scan for v.1 keys; bz#2583 Upstream-ID: 5d214abd3a21337d67c6dcc5aa6f313298d0d165
2017-01-30upstream commitdtucker@openbsd.org
Re-add '%k' token for AuthorizedKeysCommand which was lost during the re-org in rev 1.235. bz#2656, from jboning at gmail.com. Upstream-ID: 2884e203c02764d7b3fe7472710d9c24bdc73e38
2017-01-30upstream commitdjm@openbsd.org
unbreak Unix domain socket forwarding for root; ok markus@ Upstream-ID: 6649c76eb7a3fa15409373295ca71badf56920a2
2017-01-29Don't set "PermitRootLogin yes" on fresh installations (regression ↵Colin Watson
introduced in 1:7.4p1-1; closes: #852781).
2017-01-16releasing package openssh version 1:7.4p1-6Colin Watson
2017-01-16Rekeying patch fixes LP: #1608965 tooColin Watson
2017-01-16Fix rekeying failure with GSSAPI key exchange (thanks, Harald Barth; closes: ↵Colin Watson
#819361).
2017-01-16Remove ssh_host_dsa_key from HostKey defaultColin Watson
The client no longer accepts DSA host keys, and servers using the default HostKey setting should have better host keys available. Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=2662 Bug-Debian: https://bugs.debian.org/850614 Last-Update: 2017-01-16 Patch-Name: no-dsa-host-key-by-default.patch
2017-01-16Work around clock_gettime kernel bug on Linux x32Colin Watson
On Linux x32, the clock_gettime VDSO currently falls back to the x86-64 syscall, so allow that as well as its x32 sibling. Bug-Debian: https://bugs.debian.org/849923 Forwarded: no Last-Update: 2017-01-03 Patch-Name: sandbox-x32-workaround.patch
2017-01-16Create mux socket for regress in temp directoryColin Watson
In some setups, creating the socket under OBJ may result in a path that is too long for a Unix domain socket. Add a helper to let us portably create a temporary directory instead. Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=2660 Last-Update: 2017-01-03 Patch-Name: regress-mktemp.patch
2017-01-16Fix race conditions in forwarding testsColin Watson
The forwarding tests sometimes seem to fail in a way that suggests ports are in use even though they shouldn't be. Convert more of them to use a mux socket rather than relying on sleeps in the hope that that makes behaviour more consistent. Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=2659 Patch-Name: regress-forwarding-race.patch Last-Update: 2017-01-02
2017-01-16Make integrity tests more robust against timeoutsColin Watson
If the first test in a series for a given MAC happens to modify the low bytes of a packet length, then ssh will time out and this will be interpreted as a test failure. Handle this failure mode. Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=2658 Patch-Name: regress-integrity-robust.patch Last-Update: 2017-01-01
2017-01-16Various Debian-specific configuration changesColin Watson
ssh: Enable ForwardX11Trusted, returning to earlier semantics which cause fewer problems with existing setups (http://bugs.debian.org/237021). ssh: Set 'SendEnv LANG LC_*' by default (http://bugs.debian.org/264024). ssh: Enable HashKnownHosts by default to try to limit the spread of ssh worms. ssh: Enable GSSAPIAuthentication by default. sshd: Enable PAM, disable ChallengeResponseAuthentication, and disable PrintMotd. sshd: Enable X11Forwarding. sshd: Set 'AcceptEnv LANG LC_*' by default. sshd: Change sftp subsystem path to /usr/lib/openssh/sftp-server. Document all of this. Author: Russ Allbery <rra@debian.org> Forwarded: not-needed Last-Update: 2016-12-26 Patch-Name: debian-config.patch
2017-01-16Add systemd readiness notification supportMichael Biebl
Bug-Debian: https://bugs.debian.org/778913 Forwarded: no Last-Update: 2016-01-04 Patch-Name: systemd-readiness.patch
2017-01-16Support synchronisation with service supervisor using SIGSTOPColin Watson
Author: Robie Basak <robie.basak@ubuntu.com> Forwarded: no Last-Update: 2014-04-14 Patch-Name: sigstop.patch
2017-01-16Give the ssh-askpass-gnome window a default iconVincent Untz
Bug-Ubuntu: https://bugs.launchpad.net/bugs/27152 Last-Update: 2010-02-28 Patch-Name: gnome-ssh-askpass2-icon.patch
2017-01-16Don't check the status field of the OpenSSL versionKurt Roeckx
There is no reason to check the version of OpenSSL (in Debian). If it's not compatible the soname will change. OpenSSH seems to want to do a check for the soname based on the version number, but wants to keep the status of the release the same. Remove that check on the status since it doesn't tell you anything about how compatible that version is. Author: Colin Watson <cjwatson@debian.org> Bug-Debian: https://bugs.debian.org/93581 Bug-Debian: https://bugs.debian.org/664383 Bug-Debian: https://bugs.debian.org/732940 Forwarded: not-needed Last-Update: 2014-10-07 Patch-Name: no-openssl-version-status.patch
2017-01-16Document consequences of ssh-agent being setgid in ssh-agent(1)Colin Watson
Bug-Debian: http://bugs.debian.org/711623 Forwarded: no Last-Update: 2013-06-08 Patch-Name: ssh-agent-setgid.patch
2017-01-16Refer to ssh's Upstart job as well as its init scriptColin Watson
Forwarded: not-needed Last-Update: 2013-09-14 Patch-Name: doc-upstart.patch
2017-01-16Document that HashKnownHosts may break tab-completionColin Watson
Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1727 Bug-Debian: http://bugs.debian.org/430154 Last-Update: 2013-09-14 Patch-Name: doc-hash-tab-completion.patch
2017-01-16ssh(1): Refer to ssh-argv0(1)Colin Watson
Old versions of OpenSSH (up to 2.5 or thereabouts) allowed creating symlinks to ssh with the name of the host you want to connect to. Debian ships an ssh-argv0 script restoring this feature; this patch refers to its manual page from ssh(1). Bug-Debian: http://bugs.debian.org/111341 Forwarded: not-needed Last-Update: 2013-09-14 Patch-Name: ssh-argv0.patch
2017-01-16Adjust various OpenBSD-specific references in manual pagesColin Watson
No single bug reference for this patch, but history includes: http://bugs.debian.org/154434 (login.conf(5)) http://bugs.debian.org/513417 (/etc/rc) http://bugs.debian.org/530692 (ssl(8)) https://bugs.launchpad.net/bugs/456660 (ssl(8)) Forwarded: not-needed Last-Update: 2014-10-07 Patch-Name: openbsd-docs.patch
2017-01-16Install authorized_keys(5) as a symlink to sshd(8)Tomas Pospisek
Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1720 Bug-Debian: http://bugs.debian.org/441817 Last-Update: 2013-09-14 Patch-Name: authorized-keys-man-symlink.patch
2017-01-16Add DebianBanner server configuration optionKees Cook
Setting this to "no" causes sshd to omit the Debian revision from its initial protocol handshake, for those scared by package-versioning.patch. Bug-Debian: http://bugs.debian.org/562048 Forwarded: not-needed Last-Update: 2015-11-29 Patch-Name: debian-banner.patch
2017-01-16Include the Debian version in our identificationMatthew Vernon
This makes it easier to audit networks for versions patched against security vulnerabilities. It has little detrimental effect, as attackers will generally just try attacks rather than bothering to scan for vulnerable-looking version strings. (However, see debian-banner.patch.) Forwarded: not-needed Last-Update: 2013-09-14 Patch-Name: package-versioning.patch
2017-01-16Mention ssh-keygen in ssh fingerprint changed warningScott Moser
Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1843 Bug-Ubuntu: https://bugs.launchpad.net/bugs/686607 Last-Update: 2015-09-08 Patch-Name: mention-ssh-keygen-on-keychange.patch
2017-01-16Quieten logs when multiple from= restrictions are usedColin Watson
Bug-Debian: http://bugs.debian.org/630606 Forwarded: no Last-Update: 2013-09-14 Patch-Name: auth-log-verbosity.patch
2017-01-16Force use of DNSSEC even if "options edns0" isn't in resolv.confColin Watson
This allows SSHFP DNS records to be verified if glibc 2.11 is installed. Origin: vendor, https://cvs.fedoraproject.org/viewvc/F-12/openssh/openssh-5.2p1-edns.patch?revision=1.1&view=markup Bug: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=572049 Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=572049 Last-Update: 2010-04-06 Patch-Name: dnssec-sshfp.patch
generated by cgit v1.2.3 (git 2.39.1) at 2024-08-31 02:46:55 +0000