summaryrefslogtreecommitdiff
path: root/debian
AgeCommit message (Collapse)Author
2009-11-12Use x11.pc when compiling/linking gnome-ssh-askpass2 (closes: #555951).Colin Watson
2009-10-05releasing version 1:5.1p1-8Colin Watson
2009-10-04Pass $SSHD_OPTS when checking configuration too (thanks, "sobtwmxt";Colin Watson
closes: #548662).
2009-09-30Fix grammar in if-up script (closes: #549128).Colin Watson
2009-09-17Build-depend on libselinux1-dev on sh4 too (thanks, Nobuhiro Iwamatsu;Colin Watson
closes: #547103).
2009-08-28Build with just -fPIC on mips/mipsel, not -fPIE as well (thanks, LIU Qi;Colin Watson
closes: #538313).
2009-07-31releasing version 1:5.1p1-7Colin Watson
2009-07-31Upgrade to debhelper v7.Colin Watson
2009-07-31Use 'which' rather than 'type' in maintainer scripts.Colin Watson
2009-07-31Add ${misc:Depends} to keep Lintian happy.Colin Watson
2009-07-28Set umask to 022 in the init script as well as postinsts (closes:Colin Watson
#539030).
2009-07-24Update config.guess and config.sub from autotools-dev 20090611.1Colin Watson
(closes: #538301).
2009-06-05releasing version 1:5.1p1-6Colin Watson
2009-06-05this isn't needed, already removed aboveColin Watson
2009-06-05Use invoke-rc.d in openssh-server's if-up script.Colin Watson
2009-06-05Remove /var/run/sshd from openssh-server package; it will be created atColin Watson
run-time before starting the server.
2009-06-05Build with -fPIC on mips/mipsel (thanks, Luk Claes; closes: #531942).Colin Watson
2009-05-28Check if delgroup is present in openssh-client.postrm (closes: #530501).Colin Watson
2009-04-06Add a comment above PermitRootLogin in sshd_config pointing toColin Watson
README.Debian.
2009-01-28Add ufw integration (thanks, Didier Roche; seeColin Watson
https://wiki.ubuntu.com/UbuntuFirewall#Integrating%20UFW%20with%20Packages; LP: #261884).
2009-01-14Disable OOM adjustment for vserver/OpenVZ (thanks, Karl Chen; closes:Colin Watson
#511771).
2009-01-14Open /proc/self/oom_adj with O_RDONLY or O_WRONLY as necessary, ratherColin Watson
than O_RDWR.
2009-01-14releasing version 1:5.1p1-5Colin Watson
2009-01-14While the above is a valuable sanity-check, it turns out that it doesn'tColin Watson
really fix the bug (thanks to Kevin Price for testing), so for the meantime we'll just use '/etc/init.d/ssh restart', even though it is unfortunately heavyweight.
2009-01-13fix reversed logicColin Watson
2009-01-13Check that /var/run/sshd.pid exists and that the process ID listed thereColin Watson
corresponds to sshd before running '/etc/init.d/ssh reload' from if-up script; SIGHUP is racy if called at boot before sshd has a chance to install its signal handler, but fortunately the pid file is written after that which lets us avoid the race (closes: #502444).
2009-01-13* Backport from upstream CVS (Markus Friedl):Colin Watson
- packet_disconnect() on padding error, too. Should reduce the success probability for the CPNI-957037 Plaintext Recovery Attack to 2^-18.
2008-11-23releasing version 1:5.1p1-4Colin Watson
2008-11-23Fix double-free when failing to parse a forwarding specification givenColin Watson
using ~C (closes: #505330; forwarded upstream as https://bugzilla.mindrot.org/show_bug.cgi?id=1539).
2008-11-23* Backport from upstream CVS (Markus Friedl):Colin Watson
- Only send eow and no-more-sessions requests to openssh 5 and newer; fixes interop problems with broken ssh v2 implementations (closes: #495917).
2008-10-09add upstream bug linkColin Watson
2008-10-09ssh-copy-id: Strip trailing colons from hostname (closes: #226172,Colin Watson
LP: #249706; thanks to Karl Goetz for nudging this along).
2008-09-30releasing version 1:5.1p1-3Colin Watson
2008-09-29Fix handling of zero-length server banners (thanks, Tomas Mraz; closes:Colin Watson
#497026).
2008-09-12Configure with --disable-strip; dh_strip will deal with strippingColin Watson
binaries and will honour DEB_BUILD_OPTIONS (thanks, Bernhard R. Link; closes: #498681).
2008-08-25Remove unnecessary ssh-vulnkey output in non-verbose mode when noColin Watson
compromised or unknown keys were found (closes: #496495).
2008-07-29releasing version 1:5.1p1-2Colin Watson
2008-07-29Look for $SHELL on the path when executing ProxyCommands orColin Watson
LocalCommands (closes: #492728).
2008-07-25releasing version 1:5.1p1-1Colin Watson
2008-07-25this doesn't seem to work yet; remove changelog entry claiming it does at ↵Colin Watson
least until I figure it out
2008-07-24typoColin Watson
2008-07-23* Merge from Ubuntu:Colin Watson
- Add 'status' action to openssh-server init script, requiring lsb-base (>= 3.2-13) (thanks, Dustin Kirkland).
2008-07-23note SELinux status caching (LP: #237557) and ssh-keyscan rsa default (LP: ↵Colin Watson
#129794)
2008-07-23* debconf template translations:Colin Watson
- Update Korean (thanks, Sunjae Park; closes: #484821).
2008-07-23Add lintian overrides for empty /usr/share/doc/openssh-clientColin Watson
directories in openssh-server and ssh (necessary due to being symlink targets).
2008-07-22Say "GTK+" rather than "GTK" in ssh-askpass-gnome's description.Colin Watson
2008-07-22Remove our local version of moduli(5) now that there's one upstream.Colin Watson
2008-07-22* New upstream release (closes: #474301). Important changes not previouslyColin Watson
backported to 4.7p1: - 4.9/4.9p1 (http://www.openssh.com/txt/release-4.9): + Added chroot(2) support for sshd(8), controlled by a new option "ChrootDirectory" (closes: #139047, LP: #24777). + Linked sftp-server(8) into sshd(8). The internal sftp server is used when the command "internal-sftp" is specified in a Subsystem or ForceCommand declaration. When used with ChrootDirectory, the internal sftp server requires no special configuration of files inside the chroot environment. + Added a protocol extension method "posix-rename@openssh.com" for sftp-server(8) to perform POSIX atomic rename() operations; sftp(1) prefers this if available (closes: #308561). + Removed the fixed limit of 100 file handles in sftp-server(8). + ssh(8) will now skip generation of SSH protocol 1 ephemeral server keys when in inetd mode and protocol 2 connections are negotiated. This speeds up protocol 2 connections to inetd-mode servers that also allow Protocol 1. + Accept the PermitRootLogin directive in a sshd_config(5) Match block. Allows for, e.g. permitting root only from the local network. + Reworked sftp(1) argument splitting and escaping to be more internally consistent (i.e. between sftp commands) and more consistent with sh(1). Please note that this will change the interpretation of some quoted strings, especially those with embedded backslash escape sequences. + Support "Banner=none" in sshd_config(5) to disable sending of a pre-login banner (e.g. in a Match block). + ssh(1) ProxyCommands are now executed with $SHELL rather than /bin/sh. + ssh(1)'s ConnectTimeout option is now applied to both the TCP connection and the SSH banner exchange (previously it just covered the TCP connection). This allows callers of ssh(1) to better detect and deal with stuck servers that accept a TCP connection but don't progress the protocol, and also makes ConnectTimeout useful for connections via a ProxyCommand. + scp(1) incorrectly reported "stalled" on slow copies (closes: #140828). + scp(1) date underflow for timestamps before epoch. + ssh(1) used the obsolete SIG DNS RRtype for host keys in DNS, instead of the current standard RRSIG. + Correctly drain ACKs when a sftp(1) upload write fails midway, avoids a fatal() exit from what should be a recoverable condition. + Fixed ssh-keygen(1) selective host key hashing (i.e. "ssh-keygen -HF hostname") to not include any IP address in the data to be hashed. + Make ssh(1) skip listening on the IPv6 wildcard address when a binding address of 0.0.0.0 is used against an old SSH server that does not support the RFC4254 syntax for wildcard bind addresses. + Enable IPV6_V6ONLY socket option on sshd(8) listen socket, as is already done for X11/TCP forwarding sockets (closes: #439661). + Fix FD leak that could hang a ssh(1) connection multiplexing master. + Make ssh(1) -q option documentation consistent with reality. + Fixed sshd(8) PAM support not calling pam_session_close(), or failing to call it with root privileges (closes: #372680). + Fix activation of OpenSSL engine support when requested in configure (LP: #119295). - 5.1/5.1p1 (http://www.openssh.com/txt/release-5.1): + Introduce experimental SSH Fingerprint ASCII Visualisation to ssh(1) and ssh-keygen(1). Visual fingerprint display is controlled by a new ssh_config(5) option "VisualHostKey". The intent is to render SSH host keys in a visual form that is amenable to easy recall and rejection of changed host keys. + sshd_config(5) now supports CIDR address/masklen matching in "Match address" blocks, with a fallback to classic wildcard matching. + sshd(8) now supports CIDR matching in ~/.ssh/authorized_keys from="..." restrictions, also with a fallback to classic wildcard matching. + Added an extended test mode (-T) to sshd(8) to request that it write its effective configuration to stdout and exit. Extended test mode also supports the specification of connection parameters (username, source address and hostname) to test the application of sshd_config(5) Match rules. + ssh(1) now prints the number of bytes transferred and the overall connection throughput for SSH protocol 2 sessions when in verbose mode (previously these statistics were displayed for protocol 1 connections only). + sftp-server(8) now supports extension methods statvfs@openssh.com and fstatvfs@openssh.com that implement statvfs(2)-like operations. + sftp(1) now has a "df" command to the sftp client that uses the statvfs@openssh.com to produce a df(1)-like display of filesystem space and inode utilisation (requires statvfs@openssh.com support on the server). + Added a MaxSessions option to sshd_config(5) to allow control of the number of multiplexed sessions supported over a single TCP connection. This allows increasing the number of allowed sessions above the previous default of 10, disabling connection multiplexing (MaxSessions=1) or disallowing login/shell/subsystem sessions entirely (MaxSessions=0). + Added a no-more-sessions@openssh.com global request extension that is sent from ssh(1) to sshd(8) when the client knows that it will never request another session (i.e. when session multiplexing is disabled). This allows a server to disallow further session requests and terminate the session in cases where the client has been hijacked. + ssh-keygen(1) now supports the use of the -l option in combination with -F to search for a host in ~/.ssh/known_hosts and display its fingerprint. + ssh-keyscan(1) now defaults to "rsa" (protocol 2) keys, instead of "rsa1". + Added an AllowAgentForwarding option to sshd_config(8) to control whether authentication agent forwarding is permitted. Note that this is a loose control, as a client may install their own unofficial forwarder. + ssh(1) and sshd(8): avoid unnecessary malloc/copy/free when receiving network data, resulting in a ~10% speedup. + ssh(1) and sshd(8) will now try additional addresses when connecting to a port forward destination whose DNS name resolves to more than one address. The previous behaviour was to try the only first address and give up if that failed. + ssh(1) and sshd(8) now support signalling that channels are half-closed for writing, through a channel protocol extension notification "eow@openssh.com". This allows propagation of closed file descriptors, so that commands such as "ssh -2 localhost od /bin/ls | true" do not send unnecessary data over the wire. + sshd(8): increased the default size of ssh protocol 1 ephemeral keys from 768 to 1024 bits. + When ssh(1) has been requested to fork after authentication ("ssh -f") with ExitOnForwardFailure enabled, delay the fork until after replies for any -R forwards have been seen. Allows for robust detection of -R forward failure when using -f. + "Match group" blocks in sshd_config(5) now support negation of groups. E.g. "Match group staff,!guests". + sftp(1) and sftp-server(8) now allow chmod-like operations to set set[ug]id/sticky bits. + The MaxAuthTries option is now permitted in sshd_config(5) match blocks. + Multiplexed ssh(1) sessions now support a subset of the ~ escapes that are available to a primary connection. + ssh(1) connection multiplexing will now fall back to creating a new connection in most error cases (closes: #352830). + Make ssh(1) deal more gracefully with channel requests that fail. Previously it would optimistically assume that requests would always succeed, which could cause hangs if they did not (e.g. when the server runs out of file descriptors). + ssh(1) now reports multiplexing errors via the multiplex slave's stderr where possible (subject to LogLevel in the mux master). + Prevent sshd(8) from erroneously applying public key restrictions leaned from ~/.ssh/authorized_keys to other authentication methods when public key authentication subsequently fails (LP: #161047). + Fixed an UMAC alignment problem that manifested on Itanium platforms.
2008-07-21releasing version 1:4.7p1-13Colin Watson
2008-07-21Remove empty /usr/share/applications directory in ssh-askpass-gnome.Colin Watson