summaryrefslogtreecommitdiff
path: root/contrib
AgeCommit message (Collapse)Author
2007-12-24* New upstream release (closes: #453367).Colin Watson
- CVE-2007-4752: Prevent ssh(1) from using a trusted X11 cookie if creation of an untrusted cookie fails; found and fixed by Jan Pechanec (closes: #444738). - sshd(8) in new installations defaults to SSH Protocol 2 only. Existing installations are unchanged. - The SSH channel window size has been increased, and both ssh(1) sshd(8) now send window updates more aggressively. These improves performance on high-BDP (Bandwidth Delay Product) networks. - ssh(1) and sshd(8) now preserve MAC contexts between packets, which saves 2 hash calls per packet and results in 12-16% speedup for arcfour256/hmac-md5. - A new MAC algorithm has been added, UMAC-64 (RFC4418) as "umac-64@openssh.com". UMAC-64 has been measured to be approximately 20% faster than HMAC-MD5. - Failure to establish a ssh(1) TunnelForward is now treated as a fatal error when the ExitOnForwardFailure option is set. - ssh(1) returns a sensible exit status if the control master goes away without passing the full exit status. - When using a ProxyCommand in ssh(1), set the outgoing hostname with gethostname(2), allowing hostbased authentication to work. - Make scp(1) skip FIFOs rather than hanging (closes: #246774). - Encode non-printing characters in scp(1) filenames. These could cause copies to be aborted with a "protocol error". - Handle SIGINT in sshd(8) privilege separation child process to ensure that wtmp and lastlog records are correctly updated. - Report GSSAPI mechanism in errors, for libraries that support multiple mechanisms. - Improve documentation for ssh-add(1)'s -d option. - Rearrange and tidy GSSAPI code, removing server-only code being linked into the client. - Delay execution of ssh(1)'s LocalCommand until after all forwardings have been established. - In scp(1), do not truncate non-regular files. - Improve exit message from ControlMaster clients. - Prevent sftp-server(8) from reading until it runs out of buffer space, whereupon it would exit with a fatal error (closes: #365541). - pam_end() was not being called if authentication failed (closes: #405041). - Manual page datestamps updated (closes: #433181).
2007-12-23Import OpenSSH 4.7p1.Colin Watson
2007-08-15 - (dtucker) [README contrib/caldera/openssh.spec contrib/redhat/openssh.specDarren Tucker
contrib/suse/openssh.spec] Crank version.
2007-07-17* ssh-copy-id defaults to ~/.ssh/id_rsa.pub rather thanColin Watson
~/.ssh/identity.pub, in line with ssh-keygen (thanks, Greg Norris; closes: #234627).
2007-07-17* ssh-copy-id no longer prints the output of expr (thanks, PeterColin Watson
Eisentraut; closes: #291534).
2007-07-17* ssh-copy-id checks the exit status of ssh-add -L (thanks, Adeodato Simó;Colin Watson
closes: #221675).
2007-06-12* New upstream release (closes: #395507, #397961, #420035). ImportantColin Watson
changes not previously backported to 4.3p2: - 4.4/4.4p1 (http://www.openssh.org/txt/release-4.4): + On portable OpenSSH, fix a GSSAPI authentication abort that could be used to determine the validity of usernames on some platforms. + Implemented conditional configuration in sshd_config(5) using the "Match" directive. This allows some configuration options to be selectively overridden if specific criteria (based on user, group, hostname and/or address) are met. So far a useful subset of post-authentication options are supported and more are expected to be added in future releases. + Add support for Diffie-Hellman group exchange key agreement with a final hash of SHA256. + Added a "ForceCommand" directive to sshd_config(5). Similar to the command="..." option accepted in ~/.ssh/authorized_keys, this forces the execution of the specified command regardless of what the user requested. This is very useful in conjunction with the new "Match" option. + Add a "PermitOpen" directive to sshd_config(5). This mirrors the permitopen="..." authorized_keys option, allowing fine-grained control over the port-forwardings that a user is allowed to establish. + Add optional logging of transactions to sftp-server(8). + ssh(1) will now record port numbers for hosts stored in ~/.ssh/known_hosts when a non-standard port has been requested (closes: #50612). + Add an "ExitOnForwardFailure" option to cause ssh(1) to exit (with a non-zero exit code) when requested port forwardings could not be established. + Extend sshd_config(5) "SubSystem" declarations to allow the specification of command-line arguments. + Replacement of all integer overflow susceptible invocations of malloc(3) and realloc(3) with overflow-checking equivalents. + Many manpage fixes and improvements. + Add optional support for OpenSSL hardware accelerators (engines), enabled using the --with-ssl-engine configure option. + Tokens in configuration files may be double-quoted in order to contain spaces (closes: #319639). + Move a debug() call out of a SIGCHLD handler, fixing a hang when the session exits very quickly (closes: #307890). + Fix some incorrect buffer allocation calculations (closes: #410599). + ssh-add doesn't ask for a passphrase if key file permissions are too liberal (closes: #103677). + Likewise, ssh doesn't ask either (closes: #99675). - 4.6/4.6p1 (http://www.openssh.org/txt/release-4.6): + sshd now allows the enabling and disabling of authentication methods on a per user, group, host and network basis via the Match directive in sshd_config. + Fixed an inconsistent check for a terminal when displaying scp progress meter (closes: #257524). + Fix "hang on exit" when background processes are running at the time of exit on a ttyful/login session (closes: #88337). * Update to current GSSAPI patch from http://www.sxw.org.uk/computing/patches/openssh-4.6p1-gsskex-20070312.patch; install ChangeLog.gssapi.
2007-06-12Import OpenSSH 4.6p1.Colin Watson
2007-03-06 - (djm) [contrib/caldera/openssh.spec contrib/redhat/openssh.spec]Damien Miller
[contrib/suse/openssh.spec] crank spec files for release
2007-02-19 - (dtucker) [contrib/findssl.sh] Add "which" as a shell function since someDarren Tucker
platforms don't have it. Patch from dleonard at vintela.com.
2006-12-11* Give the ssh-askpass-gnome window a default icon; remove unnecessaryColin Watson
icon extension from .desktop file (closes: https://launchpad.net/bugs/27152).
2006-11-07 - (dtucker) [README contrib/{caldera,redhat,contrib}/openssh.spec] BumpDarren Tucker
versions.
2006-09-10 - (dtucker) [contrib/aix/buildbff.sh] Ensure that perl is available.Darren Tucker
2006-09-09 - (dtucker) [contrib/aix/buildbff.sh] Always create privsep user.Darren Tucker
2006-09-01 - (dtucker) [README contrib/{caldera,redhat,suse}/openssh.spec] CrankDarren Tucker
versions.
2006-08-31 - (dtucker) [contrib/cygwin/ssh-host-config] Add SeTcbPrivilege privilegeDarren Tucker
while setting up the ssh service account. Patch from Corinna Vinschen.
2006-05-12Merge 4.3p2 to the trunk.Colin Watson
2006-05-12Import OpenSSH 4.3p2.Colin Watson
2006-04-22 - (djm) [Makefile.in configure.ac session.c sshpty.c]Damien Miller
[contrib/redhat/sshd.init openbsd-compat/Makefile.in] [openbsd-compat/openbsd-compat.h openbsd-compat/port-linux.c] [openbsd-compat/port-linux.h] Add support for SELinux, setting the execution and TTY contexts. based on patch from Daniel Walsh, bz #880; ok dtucker@
2006-03-04 - (dtucker) [contrib/cygwin/ssh-host-config] Require use of lastlog as aDarren Tucker
file rather than directory, required as Cygwin will be importing lastlog(1). Also tightens up permissions on the file. Patch from vinschen@redhat.com.
2006-02-12 - (dtucker) [README version.h contrib/caldera/openssh.specDarren Tucker
contrib/redhat/openssh.spec contrib/suse/openssh.spec] Bump version strings to match 4.3p2 release.
2006-02-11 - (djm) Release 4.3p2Damien Miller
2006-02-01 - (djm) [contrib/caldera/openssh.spec contrib/redhat/openssh.spec]Damien Miller
[contrib/suse/openssh.spec] Update versions ahead of release
2006-01-10 - (dtucker) [contrib/cygwin/ssh-host-config] Make sshd service depend onDarren Tucker
tcpip service so it's always started after IP is up. Patch from vinschen at redhat.com.
2005-10-30 - (djm) [contrib/suse/openssh.spec contrib/suse/rc.Damien Miller
sshd contrib/suse/sysconfig.ssh] Bug #1106: Updated SuSE spec and init files from imorgan AT nas.nasa.gov
2005-10-25 - (dtucker) [contrib/cygwin/ssh-user-config] Remove duplicate yes/noDarren Tucker
prompt. Patch from vinschen at redhat.com.
2005-09-14Merge 4.2p1 to the trunk.Colin Watson
2005-09-14Import OpenSSH 4.2p1.Colin Watson
2005-09-01 - (djm) Update RPM spec file versionsDamien Miller
2005-06-17Manoj Srivastava:Colin Watson
- Added SELinux capability, and turned it on be default. Added restorecon calls in preinst and postinst (should not matter if the machine is not SELinux aware). By and large, the changes made should have no effect unless the rules file calls --with-selinux; and even then there should be no performance hit for machines not actively running SELinux. - Modified the preinst and postinst to call restorecon to set the security context for the generated public key files. - Added a comment to /etc/pam.d/ssh to indicate that an SELinux system may want to also include pam_selinux.so.
2005-05-31 - (dtucker) [contrib/aix/pam.conf] Correct comments. From davidl atDarren Tucker
vintela.com.
2005-05-30Merge 4.1p1 to the trunk.Colin Watson
2005-05-30Import OpenSSH 4.1p1.Colin Watson
2005-05-25Merge 4.0p1 to the trunk.Colin Watson
2005-05-25 - (djm) [contrib/caldera/openssh.spec contrib/redhat/openssh.spec]Damien Miller
[contrib/suse/openssh.spec] Update spec file versions to 4.1p1
2005-05-09 - (dtucker) [contrib/cygwin/ssh-host-config] Add a test and warning for aDarren Tucker
user-mode mounts in Cygwin installation. Patch from vinschen at redhat.com.
2005-03-29 - (dtucker) [contrib/aix/buildbff.sh] Bug #1005: Look up only the user we'reDarren Tucker
interested in which is much faster in large (eg LDAP or NIS) environments. Patch from dleonard at vintela.com.
2005-03-14 - (tim) [contrib/caldera/openssh.spec] links in rc?.d were getting trashedTim Rice
with a rpm -F
2005-03-13 - (dtucker) [contrib/cygwin/ssh-host-config] Makes the query for theDarren Tucker
localized name of the local administrators group more reliable. From vinschen at redhat.com.
2005-03-10Import OpenSSH 4.0p1.Colin Watson
2005-03-09 - (djm) [contrib/caldera/openssh.spec contrib/redhat/openssh.spec]Damien Miller
[contrib/suse/openssh.spec] Update spec file versions
2005-03-05 - (djm) [contrib/cygwin/README] Improve Cygwin build documentation. PatchDamien Miller
from vinschen at redhat.com
2005-02-22Make gnome-ssh-askpass stay above other windows (thanks, Liyang HU; closes:Colin Watson
#296487).
2005-01-04Merge 3.9p1 to the trunk.Colin Watson
2005-01-04Import OpenSSH 3.9p1.Colin Watson
2004-12-13 - (dtucker) [contrib/findssh.sh] Clean up on interrupt; fromDarren Tucker
amarendra.godbole at ge com.
2004-09-21 - (dtucker) [contrib/cygwin/ssh-host-config] Update to match current CygwinDarren Tucker
install process. Patch from vinschen at redhat.com.
2004-08-30 - (dtucker) [Makefile.in contrib/ssh-copy-id] Bug #894: Improve portabilityDarren Tucker
of shell constructs. Patch from cjwatson at debian.org.
2004-08-17 - (djm) Crank RPM spec version numbersDamien Miller
2004-07-21 - (djm) [contrib/redhat/sshd.pam] bz #903: Remove redundant entries; fromDamien Miller
peak AT argo.troja.mff.cuni.cz