summaryrefslogtreecommitdiff
path: root/debian/changelog
AgeCommit message (Collapse)Author
2010-03-17Fix substitution of ETC_PAM_D_SSH, following the rename in 1:4.7p1-4.Colin Watson
2010-03-08Drop compatibility with the old gssapi mechanism used in ssh-krb5 <<Colin Watson
3.8.1p1-1. Simon Wilkinson refused this patch since the old gssapi mechanism was removed due to a serious security hole, and since these versions of ssh-krb5 are no longer security-supported by Debian I don't think there's any point keeping client compatibility for them.
2010-03-01Include debian/ssh-askpass-gnome.png in the Debian tarball now thatColin Watson
we're using a source format that permits this, rather than messing around with uudecode.
2010-03-01Fix 'debian/rules quilt-setup' to avoid writing .orig files if someColin Watson
patches apply with offsets.
2010-02-28releasing version 1:5.3p1-3Colin Watson
2010-02-28Update copyright years for GSSAPI patch.Colin Watson
2010-02-28Remove obsolete header from README.Debian dating from when peopleColin Watson
expected non-free SSH.
2010-02-28Remove documentation of building for Debian 3.0 in README.Debian.Colin Watson
Support for this was removed in 1:4.7p1-2.
2010-02-28Add GSSAPIStoreCredentialsOnRekey to 'sshd -T' configuration dump.Colin Watson
2010-02-28* Update README.source to match, and add a 'quilt-setup' target toColin Watson
debian/rules for the benefit of those checking out the package from revision control. * All patches are now maintained separately and tagged according to DEP-3.
2010-02-27Convert to source format 3.0 (quilt).Colin Watson
2010-02-22releasing version 1:5.3p1-2Colin Watson
2010-01-31Honour DEB_BUILD_OPTIONS=nocheck.Colin Watson
2010-01-31Use dh_lintian.Colin Watson
2010-01-31Install upstream sshd_config as an example (closes: #415008).Colin Watson
2010-01-31fix typo in 1:5.3p1-1 changelogColin Watson
2010-01-31Link with -Wl,--as-needed (closes: #560155).Colin Watson
2010-01-26releasing version 1:5.3p1-1Colin Watson
2010-01-25Drop change from 1:3.8p1-3 to avoid setresuid() and setresgid() systemColin Watson
calls. This only applied to Linux 2.2, which it's no longer feasible to run anyway (see 1:5.2p1-2 changelog).
2010-01-25* Backport from upstream:Colin Watson
- Do not fall back to adding keys without contraints (ssh-add -c / -t ...) when the agent refuses the constrained add request. This was a useful migration measure back in 2002 when constraints were new, but just adds risk now (LP: #209447).
2010-01-24* New upstream release.Colin Watson
* Update to GSSAPI patch from http://www.sxw.org.uk/computing/patches/openssh-5.3p1-gsskex-all-20100124.patch.
2010-01-16releasing version 1:5.2p1-2Colin Watson
2010-01-16Output a debug if we can't open an existing keyfile (LP: #505301).Colin Watson
2010-01-16Implement DebianBanner server configuration flag that can be set to "no"Colin Watson
to allow sshd to run without the Debian-specific extra version in the initial protocol handshake (closes: #562048).
2010-01-15spacingColin Watson
2010-01-15Drop change from 1:3.6.1p2-5 to disable cmsg_type check for fileColin Watson
descriptor passing when running on Linux 2.0. The previous stable release of Debian dropped support for Linux 2.4, let alone 2.0, so this very likely has no remaining users depending on it.
2010-01-12Don't run tests when cross-compiling.Colin Watson
2010-01-12Use host compiler for ssh-askpass-gnome when cross-compiling.Colin Watson
2010-01-10* Backport from upstream:Colin Watson
- After sshd receives a SIGHUP, ignore subsequent HUPs while sshd re-execs itself. Prevents two HUPs in quick succession from resulting in sshd dying (LP: #497781).
2010-01-04releasing version 1:5.2p1-1Colin Watson
2010-01-04LP bug closure tooColin Watson
2010-01-04reasoningColin Watson
2010-01-04Include URL to OpenBSD's ssl(8) in ssh(1) (closes: #530692).Colin Watson
2010-01-04Refer to sshd_config(5) rather than sshd(8) in postinst-writtenColin Watson
/etc/ssh/sshd_config, and add UsePAM commentary from upstream-shipped configuration file (closes: #415008, although unfortunately this will only be conveniently visible on new installations).
2010-01-04Remove/adjust manual page references to BSD-specific /etc/rc (closes:Colin Watson
#513417).
2010-01-04Remove manual page references to login.conf, which aren't applicable onColin Watson
non-BSD systems (closes: #154434).
2010-01-04Adjust short descriptions to avoid relying on previous experience withColin Watson
rsh, based on suggestions from Reuben Thomas (closes: #512198).
2010-01-02Remove init script stop link in rc1, as killprocs handles it already.Colin Watson
2010-01-02Cope with insserv reordering of init script links.Colin Watson
2010-01-02Remove ssh/new_config, only needed for direct upgrades from potato whichColin Watson
are no longer particularly feasible anyway (closes: #420682).
2010-01-02Update OpenSSH FAQ to revision 1.110.Colin Watson
2010-01-02yet another report of thisColin Watson
2010-01-02Use hardening-includes for hardening logic (thanks, Kees Cook; closes:Colin Watson
#561887).
2010-01-02Don't duplicate backslashes when displaying server banner (thanks,Colin Watson
Michał Górny; closes: #505378, LP: #425346).
2010-01-02Initialise sc to NULL in ssh_selinux_getctxbyname (thanks, Václav Ovsík;Colin Watson
closes: #498684).
2010-01-02Make ChrootDirectory work with SELinux (thanks, Russell Coker; closes:Colin Watson
#556644).
2010-01-02more bug fix notesColin Watson
2010-01-01* New upstream release (closes: #536182). Yes, I know 5.3p1 has been outColin Watson
for a while, but there's no GSSAPI patch available for it yet. - Change the default cipher order to prefer the AES CTR modes and the revised "arcfour256" mode to CBC mode ciphers that are susceptible to CPNI-957037 "Plaintext Recovery Attack Against SSH". - Add countermeasures to mitigate CPNI-957037-style attacks against the SSH protocol's use of CBC-mode ciphers. Upon detection of an invalid packet length or Message Authentication Code, ssh/sshd will continue reading up to the maximum supported packet length rather than immediately terminating the connection. This eliminates most of the known differences in behaviour that leaked information about the plaintext of injected data which formed the basis of this attack (closes: #506115, LP: #379329). - ForceCommand directive now accepts commandline arguments for the internal-sftp server (closes: #524423, LP: #362511). - Add AllowAgentForwarding to available Match keywords list (closes: #540623). - Make ssh(1) send the correct channel number for SSH2_MSG_CHANNEL_SUCCESS and SSH2_MSG_CHANNEL_FAILURE messages to avoid triggering 'Non-public channel' error messages on sshd(8) in openssh-5.1. - Avoid printing 'Non-public channel' warnings in sshd(8), since the ssh(1) has sent incorrect channel numbers since ~2004 (this reverts a behaviour introduced in openssh-5.1; closes: #496017). * Update to GSSAPI patch from http://www.sxw.org.uk/computing/patches/openssh-5.2p1-gsskex-all-20090726.patch, including cascading credentials support (LP: #416958).
2009-12-21Add debian/README.source with instructions on bzr handling.Colin Watson
2009-12-21Moved to bzr.debian.org; add Vcs-Bzr and Vcs-Browser control fields.Colin Watson
generated by cgit v1.2.3 (git 2.39.1) at 2024-10-03 05:29:27 +0000