summaryrefslogtreecommitdiff
path: root/ChangeLog
AgeCommit message (Collapse)Author
2008-07-04 - djm@cvs.openbsd.org 2008/07/02 13:30:34Darren Tucker
[auth2.c] really really remove the freebie "none" auth try for protocol 2
2008-07-02 - djm@cvs.openbsd.org 2008/07/02 12:36:39Darren Tucker
[auth2-none.c auth2.c] Make protocol 2 MaxAuthTries behaviour a little more sensible: Check whether client has exceeded MaxAuthTries before running an authentication method and skip it if they have, previously it would always allow one try (for "none" auth). Preincrement failure count before post-auth test - previously this checked and postincremented, also to allow one "none" try. Together, these two changes always count the "none" auth method which could be skipped by a malicious client (e.g. an SSH worm) to get an extra attempt at a real auth method. They also make MaxAuthTries=0 a useful way to block users entirely (esp. in a sshd_config Match block). Also, move sending of any preauth banner from "none" auth method to the first call to input_userauth_request(), so worms that skip the "none" method get to see it too.
2008-07-02 - dtucker@cvs.openbsd.org 2008/07/02 12:03:51Darren Tucker
[auth-rsa.c auth.c auth2-pubkey.c auth.h] Merge duplicate host key file checks, based in part on a patch from Rob Holland via bz #1348 . Also checks for non-regular files during protocol 1 RSA auth. ok djm@
2008-07-02 - djm@cvs.openbsd.org 2008/07/02 02:24:18Darren Tucker
[sshd_config sshd_config.5 sshd.8 servconf.c] increase default size of ssh protocol 1 ephemeral key from 768 to 1024 bits; prodded by & ok dtucker@ ok deraadt@
2008-07-02 - stevesk@cvs.openbsd.org 2008/07/01 23:12:47Darren Tucker
[PROTOCOL.agent] fix some typos; ok djm@
2008-07-02 - dtucker@cvs.openbsd.org 2008/07/01 07:24:22Darren Tucker
[sshconnect.c sshd.c] Send CR LF during protocol banner exchanges, but only for Protocol 2 only, in order to comply with RFC 4253. bz #1443, ok djm@
2008-07-02 - dtucker@cvs.openbsd.org 2008/07/01 07:20:52Darren Tucker
[sshconnect.c] Check ExitOnForwardFailure if forwardings are disabled due to a failed host key check. ok djm@
2008-07-02 - djm@cvs.openbsd.org 2008/06/30 12:18:34Darren Tucker
[PROTOCOL] clarify that eow@openssh.com is only sent on session channels
2008-07-02 - djm@cvs.openbsd.org 2008/06/30 12:16:02Darren Tucker
[nchan.c] only send eow@openssh.com notifications for session channels; ok! markus@
2008-07-02 - djm@cvs.openbsd.org 2008/06/30 12:15:39Darren Tucker
[serverloop.c] only pass channel requests on session channels through to the session channel handler, avoiding spurious log messages; ok! markus@
2008-07-02 - djm@cvs.openbsd.org 2008/06/30 08:05:59Darren Tucker
[PROTOCOL.agent] typo: s/constraint_date/constraint_data/
2008-06-30 - (djm) [regress/Makefile] search for conch by path, like we do puttyDamien Miller
2008-06-30 - djm@cvs.openbsd.org 2008/06/28 13:57:25Damien Miller
[regress/Makefile regress/test-exec.sh regress/conch-ciphers.sh] very basic regress test against Twisted Conch in "make interop" target (conch is available in ports/devel/py-twisted/conch); ok markus@
2008-06-30 - dtucker@cvs.openbsd.org 2008/06/11 23:11:40Damien Miller
[Makefile] Don't run cipher-speed test by default; mistakenly enabled by me
2008-06-30 - dtucker@cvs.openbsd.org 2008/06/10 23:13:43Damien Miller
[regress/Makefile regress/key-options.sh] Add regress test for key options. ok djm@
2008-06-30 - djm@cvs.openbsd.org 2008/06/28 14:08:30Damien Miller
[PROTOCOL PROTOCOL.agent] document the protocol used by ssh-agent; "looks ok" markus@
2008-06-30 - djm@cvs.openbsd.org 2008/06/28 14:05:15Damien Miller
[ssh-agent.c] reset global compat flag after processing a protocol 2 signature request with the legacy DSA encoding flag set; ok markus
2008-06-30 - djm@cvs.openbsd.org 2008/06/28 13:58:23Damien Miller
[ssh-agent.c] refuse to add a key that has unknown constraints specified; ok markus
2008-06-30 - djm@cvs.openbsd.org 2008/06/28 07:25:07Damien Miller
[PROTOCOL] spelling fixes
2008-06-30 - jmc@cvs.openbsd.org 2008/06/26 21:11:46Damien Miller
[ssh.1] add VisualHostKey to the list of options listed in -o;
2008-06-30 - grunk@cvs.openbsd.org 2008/06/26 11:46:31Damien Miller
[readconf.c readconf.h ssh.1 ssh_config.5 sshconnect.c] Move SSH Fingerprint Visualization away from sharing the config option CheckHostIP to an own config option named VisualHostKey. While there, fix the behaviour that ssh would draw a random art picture on every newly seen host even when the option was not enabled. prodded by deraadt@, discussions, help and ok markus@ djm@ dtucker@
2008-06-29 - djm@cvs.openbsd.org 2008/06/26 09:19:40Damien Miller
[dh.c dh.h moduli.c] when loading moduli from /etc/moduli in sshd(8), check that they are of the expected "safe prime" structure and have had appropriate primality tests performed; feedback and ok dtucker@
2008-06-29 - djm@cvs.openbsd.org 2008/06/26 06:10:09Damien Miller
[sftp-client.c sftp-server.c] allow the sftp chmod(2)-equivalent operation to set set[ug]id/sticky bits. Note that this only affects explicit setting of modes (e.g. via sftp(1)'s chmod command) and not file transfers. (bz#1310) ok deraadt@ at c2k8
2008-06-29 - otto@cvs.openbsd.org 2008/06/25 11:13:43Damien Miller
[key.c] add key length to visual fingerprint; zap magical constants; ok grunk@ djm@
2008-06-29 - (djm) OpenBSD CVS SyncDamien Miller
- martynas@cvs.openbsd.org 2008/06/21 07:46:46 [sftp.c] use optopt to get invalid flag, instead of return value of getopt, which is always '?'; ok djm@
2008-06-28 - (djm) [RFC.nroff contrib/cygwin/Makefile contrib/suse/openssh.spec]Damien Miller
RFC.nroff lacks a license, remove it (it is long gone in OpenBSD).
2008-06-26 - (djm) [ contrib/caldera/openssh.spec contrib/redhat/openssh.spec]Damien Miller
[contrib/suse/openssh.spec] Include moduli.5 in RPM spec files.
2008-06-26 - (djm) [Makefile.in moduli.5] Include moduli(5) manpage from OpenBSD.Damien Miller
(bz#1372)
2008-06-16 - (dtucker) [channels.c] isatty -> is_tty here too.Darren Tucker
2008-06-16 - dtucker@cvs.openbsd.org 2008/06/16 13:22:53Darren Tucker
[session.c channels.c] Rename the isatty argument to is_tty so we don't shadow isatty(3). ok markus@
2008-06-16 - djm@cvs.openbsd.org 2008/06/15 20:06:26Damien Miller
[channels.c channels.h session.c] don't call isatty() on a pty master, instead pass a flag down to channel_set_fds() indicating that te fds refer to a tty. Fixes a hang on exit on Solaris (bz#1463) in portable but is actually a generic bug; ok dtucker deraadt markus
2008-06-16 - dtucker@cvs.openbsd.org 2008/06/15 16:58:40Damien Miller
[servconf.c sshd_config.5] Allow MaxAuthTries within a Match block. ok djm@
2008-06-16 - dtucker@cvs.openbsd.org 2008/06/15 16:55:38Damien Miller
[sshd_config.5] MaxSessions is allowed in a Match block too
2008-06-16 - dtucker@cvs.openbsd.org 2008/06/14 19:42:10Damien Miller
[scp.1] Mention that scp follows symlinks during -r. bz #1466, from nectar at apple
2008-06-16 - djm@cvs.openbsd.org 2008/06/14 18:33:43Damien Miller
[session.c] suppress the warning message from chdir(homedir) failures when chrooted (bz#1461); ok dtucker
2008-06-16 - dtucker@cvs.openbsd.org 2008/06/14 17:07:11Damien Miller
[sshd.c] ensure default umask disallows at least group and world write; ok djm@
2008-06-16 - OpenBSD CVS SyncDamien Miller
- dtucker@cvs.openbsd.org 2008/06/14 15:49:48 [sshd.c] wrap long line at 80 chars
2008-06-16 - (dtucker) [configure.ac] Enable -fno-builtin-memset when using gcc.Darren Tucker
2008-06-15 - (djm) [openbsd-compat/sigact.c] Avoid NULL derefs in ancient sigactionDamien Miller
replacement code; patch from ighighi AT gmail.com in bz#1240; ok dtucker
2008-06-14 - (dtucker) [configure.ac] Bug #1276: avoid linking against libgssapi, whichDarren Tucker
despite its name doesn't seem to implement all of GSSAPI. Patch from Jan Engelhardt, sanity checked by Simon Wilkinson.
2008-06-14 - grunk@cvs.openbsd.org 2008/06/13 20:13:26Darren Tucker
[ssh.1] Explain the use of SSH fpr visualization using random art, and cite the original scientific paper inspiring that technique. Much help with English and nroff by jmc@, thanks.
2008-06-14 - dtucker@cvs.openbsd.org 2008/06/13 18:55:22Darren Tucker
[scp.c] Prevent -Wsign-compare warnings on LP64 systems. bz #1192, ok deraadt@
2008-06-14 - dtucker@cvs.openbsd.org 2008/06/13 17:21:20Darren Tucker
[mux.c] Friendlier error messages for mux fallback. ok djm@
2008-06-14 - dtucker@cvs.openbsd.org 2008/06/13 14:18:51Darren Tucker
[auth2-pubkey.c auth-rhosts.c] Include unistd.h for close(), prevents warnings in -portable
2008-06-14 - dtucker@cvs.openbsd.org 2008/06/13 13:56:59Darren Tucker
[monitor.c] Clear key options in the monitor on failed authentication, prevents applying additional restrictions to non-pubkey authentications in the case where pubkey fails but another method subsequently succeeds. bz #1472, found by Colin Watson, ok markus@ djm
2008-06-13 - deraadt@cvs.openbsd.org 2008/06/13 09:44:36Darren Tucker
[packet.c] compile on older gcc; no decl after code
2008-06-13 - (dtucker) [openbsd-compat/setenv.c] Make offsets size_t to preventDarren Tucker
compiler warnings on some platforms. Based on a discussion with otto@
2008-06-13 - djm@cvs.openbsd.org 2008/06/13 04:40:22Darren Tucker
[auth2-pubkey.c auth-rhosts.c] refuse to read ~/.shosts or ~/.ssh/authorized_keys that are not regular files; report from Solar Designer via Colin Watson in bz#1471 ok dtucker@ deraadt@
2008-06-13 - dtucker@cvs.openbsd.org 2008/06/13 01:38:23Darren Tucker
[misc.c] upcast uid to long with matching %ld, prevents warnings in portable
2008-06-13 - (dtucker) [umac.c] STORE_UINT32_REVERSED and endian_convert are never usedDarren Tucker
on big endian machines, so ifdef them for little endian only to prevent unused function warnings.