393) Users in the 'exempt' group shouldn't get their $PATH overridden
by 'secure-path'. Patch from jmknoble@pobox.com.
395) Fixed a bug that caused an infinite loop when the password
timeout was disabled.
396) It is now possible to set the path to the editor for visudo as well
as the flag that determines whether or not visudo will look at
$EDITOR in the sudoers file.
398) Added rootpw, runaspw, and targetpw to prompt for the root, runas_default
and target user's passwords respectively (instead of the invoking user's
password).
399) Added -S flag to force password read from stdin.
400) Restore coredumpsize resource limit before exec'ing the child
process (sudo sets it to 0 internally).
404) Fixed a bug where sudo would hang around and consume CPU if we spawn
a long-running process.
406) Added set_logname run-time option. When unset, sudo will not set
the USER and LOGNAME environment variables.
407) Wildcards are now allowed in the hostnames specified in sudoers.
The 'fqdn' option is often required for this to be useful.
408) Fixed a bug where host and user qualifiers in a Defaults entry were
not being used correctly and the entry was being applied globally.
409) Fixed targetpw, rootpw, and runaspw options when used with non-passwd
authentication (pam, etc).
410) When the targetpw flag is set, use the target username as part
of the timestamp path.
411) Fixed a bug that prevented the -H option from being useful.
412) Fixed a case where a string was used after it has been freed.
Add a new USE_LIBTOOL definition that uses the libtool package instead of
pkglibtool which is now considered outdated.
USE_PKGLIBTOOL is available for backwards compatibility with old packages
but is deprecated for new packages.
if you are tired of using racoon, you may want to try it.
(may not work as expected due to PF_KEY differences)
---
This is isakmpd, a BSD-licensed ISAKMP/Oakley (a.k.a. IKE)
implementation. It's written by Niklas Hallqvist and Niels Provos,
funded by Ericsson Radio Systems AB. Currently it is work in
progress, although it can be used for real setups. There are
releases, but this distribution is not a release and is not named with
ordinary version numbers. When you got the source, hopefully the
archive was named with a date which reflects when it was created.
These archives are also known as snapshots and will be created at
irregular intervals and put up on ftp.gsnig.net and ftp.appli.se in
/pub/isakmpd. From Nov 14, 1998 isakmpd is also available in the
OpenBSD main source tree under src/sbin/isakmpd, though slightly
modified because I don't want to carry support files for other OSes in
that distribution. Look at http://www.openbsd.org/ for details on how
to get OpenBSD source.
security/ssh6: IPv4/v6 ready, socks unavailable, kerberos available (not tested)
security/ssh: IPv4 onlyready, socks available, kerberos available (not tested)
should be integrated into one whenever socks support becomes aware of
getaddrinfo/getnameinfo. two directories with tons of patches/patch-* is
a maintenance headache.
file integrity, into the NetBSD packages collection.
It creates a database from the regular expression rules that it finds
from the config file. Once this database is initialized it can be
used to verify the integrity of the files. It has several message
digest algorithms (md5,sha1,rmd160,tiger,haval,etc.) that are used to
check the integrity of the file. More algorithms can be added with
relative ease. All of the usual file attributes can also be checked
for inconsistencies. It can read databases from older or newer
versions. See the manual pages within the distribution for further
info. There is also a beginning of a manual at
http://www.cs.tut.fi/~rammer/aide/manual.html
This package is very similar to tripwire, but without its licen[cs]e
constraints.
Takahiro Kambe <taca@sky.yamashina.kyoto.jp> in pkg/9477.
Changes since 1.0.0:
* New command --verify-files. New option --fast-list-mode.
* $http_proxy is now used when --honor-http-proxy is set.
* Fixed some minor bugs and the problem with conventional encrypted
packets which did use the gpg v3 partial length headers.
* Add Indonesian and Portugese translations.
* Fixed a bug with symmetric-only encryption using the non-default 3DES.
The option --emulate-3des-s2k-bug may be used to decrypt documents
which have been encrypted this way; this should be done immediately
as this workaround will be remove in 1.1
* Can now handle (but not display) PGP's photo IDs. I don't know the
format of that packet but after stripping a few bytes from the start
it looks like a JPEG (at least my test data). Handling of this
package is required because otherwise it would mix up the
self signatures and you can't import those keys.
* Passing non-ascii user IDs on the commandline should now work in all
cases.
* New keys are now generated with an additional preference to Blowfish.
* Removed the GNU Privacy Handbook from the distribution as it will go
into a separate one.
393) Users in the 'exempt' group shouldn't get their $PATH overridden
by 'secure-path'. Patch from jmknoble@pobox.com.
394) Pam now works on HP-UX 11.0, thanks to Jeff A. Earickson.
Changes from Sudo 1.6.1:
383) Better behavior for -l and -v flags in conjunction with NOPASSWD and
added "verifypw" and "listpw" options.
384) For HP-UX with cc, add the -Aa flag along with -D_HPUX_SOURCE.
385) Fix compilation with K&R compilers.
386) For netgroup host matching, match against the short version of the
hostname as well as the long one if they are different.
387) Terminate passwd reading on '\r' in addition to '\n'
388) Visudo used to loop endlessly if a user entered ^D at the whatnow
prompt. EOF is now treaded as 'x' (exit w/o saving changes).
389) The 'shell_noargs' runtime option is back based on a patch from
bguillory@email.com.
390) Systems that return RLIM_INFINITY for RLIMIT_NOFILE (like AIX)
would loop for a very loing time during sudo startup. A value of
RLIM_INFINITY is now ignored (getdtablesize/sysconf is used instead).
391) Locking in visudo was broken. We now lock the sudoers file, not the
sudoers temp file, which should be safe.
392) PAM fixups: custom prompts now work correctly and errors are
dealt with more sanely. Patches from Cloyce D. Spradling.
the reason of failure: openssh configure.in tries to include specwise
incorrect header (netinet/in6.h), and checks for function availablility
with too high warning level.
1.2.2 (fixing PR 9304 by David Rankin <drankin@bohemians.lexington.ky.us>.
Changes:
20000125
- Fix NULL pointer dereference in login.c. Fix from Andre Lucas
<andre.lucas@dial.pipex.com>
- Reorder PAM initialisation so it does not mess up lastlog. Reported
by Andre Lucas <andre.lucas@dial.pipex.com>
- Use preformatted manpages on SCO, report from Gary E. Miller
<gem@rellim.com>
- New URL for x11-ssh-askpass.
- Fixpaths was missing /etc/ssh_known_hosts. Report from Jim Knoble
<jmknoble@pobox.com>
- Added 'DESTDIR' option to Makefile to ease package building. Patch from
Jim Knoble <jmknoble@pobox.com>
- Updated RPM spec files to use DESTDIR
20000124
- Pick up version 1.2.2 from OpenBSD CVS (no changes, just version number
increment)
20000123
- OpenBSD CVS:
- [packet.c]
getsockname() requires initialized tolen; andy@guildsoftware.com
- AIX patch from Matt Richards <v2matt@btv.ibm.com> and David Rankin
<drankin@bohemians.lexington.ky.us>
- Fix lastlog support, patch from Andre Lucas <andre.lucas@dial.pipex.com>
20000122
- Fix compilation of bsd-snprintf.c on Solaris, fix from Ben Taylor
<bent@clark.net>
- Merge preformatted manpage patch from Andre Lucas
<andre.lucas@dial.pipex.com>
- Make IPv4 use the default in RPM packages
- Irix uses preformatted manpages
- Missing htons() in bsd-bindresvport.c, fix from Holger Trapp
<Holger.Trapp@Informatik.TU-Chemnitz.DE>
- OpenBSD CVS updates:
- [packet.c]
use getpeername() in packet_connection_is_on_socket(), fixes sshd -i;
from Holger.Trapp@Informatik.TU-Chemnitz.DE
- [sshd.c]
log with level log() not fatal() if peer behaves badly.
- [readpass.c]
instead of blocking SIGINT, catch it ourselves, so that we can clean
the tty modes up and kill ourselves -- instead of our process group
leader (scp, cvs, ...) going away and leaving us in noecho mode.
people with cbreak shells never even noticed..
- [ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh.1 sshd.8]
ie. -> i.e.,
20000120
- Don't use getaddrinfo on AIX
- Update to latest OpenBSD CVS:
- [auth-rsa.c]
- fix user/1056, sshd keeps restrictions; dbt@meat.net
- [sshconnect.c]
- disable agent fwding for proto 1.3, remove abuse of auth-rsa flags.
- destroy keys earlier
- split key exchange (kex) and user authentication (user-auth),
ok: provos@
- [sshd.c]
- no need for poll.h; from bright@wintelcom.net
- disable agent fwding for proto 1.3, remove abuse of auth-rsa flags.
- split key exchange (kex) and user authentication (user-auth),
ok: provos@
- [sshd.c]
- no need for poll.h; from bright@wintelcom.net
- disable agent fwding for proto 1.3, remove abuse of auth-rsa flags.
- split key exchange (kex) and user authentication (user-auth),
ok: provos@
- Big manpage and config file cleanup from Andre Lucas
<andre.lucas@dial.pipex.com>
- Re-added latest (unmodified) OpenBSD manpages
- Doc updates
- NetBSD patch from David Rankin <drankin@bohemians.lexington.ky.us> and
Christos Zoulas <christos@netbsd.org>
20000119
- SCO compile fixes from Gary E. Miller <gem@rellim.com>
- Compile fix from Darren_Hall@progressive.com
- Linux/glibc-2.1.2 takes a *long* time to look up names for AF_UNSPEC
addresses using getaddrinfo(). Added a configure switch to make the
default lookup mode AF_INET
20000118
- Fixed --with-pid-dir option
- Makefile fix from Gary E. Miller <gem@rellim.com>
- Compile fix for HPUX and Solaris from Andre Lucas
<andre.lucas@dial.pipex.com>
1.2.2 (fixing PR 9304 by David Rankin <drankin@bohemians.lexington.ky.us>.
Changes:
20000125
- Fix NULL pointer dereference in login.c. Fix from Andre Lucas
<andre.lucas@dial.pipex.com>
- Reorder PAM initialisation so it does not mess up lastlog. Reported
by Andre Lucas <andre.lucas@dial.pipex.com>
- Use preformatted manpages on SCO, report from Gary E. Miller
<gem@rellim.com>
- New URL for x11-ssh-askpass.
- Fixpaths was missing /etc/ssh_known_hosts. Report from Jim Knoble
<jmknoble@pobox.com>
- Added 'DESTDIR' option to Makefile to ease package building. Patch from
Jim Knoble <jmknoble@pobox.com>
- Updated RPM spec files to use DESTDIR
20000124
- Pick up version 1.2.2 from OpenBSD CVS (no changes, just version number
increment)
20000123
- OpenBSD CVS:
- [packet.c]
getsockname() requires initialized tolen; andy@guildsoftware.com
- AIX patch from Matt Richards <v2matt@btv.ibm.com> and David Rankin
<drankin@bohemians.lexington.ky.us>
- Fix lastlog support, patch from Andre Lucas <andre.lucas@dial.pipex.com>
20000122
- Fix compilation of bsd-snprintf.c on Solaris, fix from Ben Taylor
<bent@clark.net>
- Merge preformatted manpage patch from Andre Lucas
<andre.lucas@dial.pipex.com>
- Make IPv4 use the default in RPM packages
- Irix uses preformatted manpages
- Missing htons() in bsd-bindresvport.c, fix from Holger Trapp
<Holger.Trapp@Informatik.TU-Chemnitz.DE>
- OpenBSD CVS updates:
- [packet.c]
use getpeername() in packet_connection_is_on_socket(), fixes sshd -i;
from Holger.Trapp@Informatik.TU-Chemnitz.DE
- [sshd.c]
log with level log() not fatal() if peer behaves badly.
- [readpass.c]
instead of blocking SIGINT, catch it ourselves, so that we can clean
the tty modes up and kill ourselves -- instead of our process group
leader (scp, cvs, ...) going away and leaving us in noecho mode.
people with cbreak shells never even noticed..
- [ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh.1 sshd.8]
ie. -> i.e.,
20000120
- Don't use getaddrinfo on AIX
- Update to latest OpenBSD CVS:
- [auth-rsa.c]
- fix user/1056, sshd keeps restrictions; dbt@meat.net
- [sshconnect.c]
- disable agent fwding for proto 1.3, remove abuse of auth-rsa flags.
- destroy keys earlier
- split key exchange (kex) and user authentication (user-auth),
ok: provos@
- [sshd.c]
- no need for poll.h; from bright@wintelcom.net
- disable agent fwding for proto 1.3, remove abuse of auth-rsa flags.
- split key exchange (kex) and user authentication (user-auth),
ok: provos@
- [sshd.c]
- no need for poll.h; from bright@wintelcom.net
- disable agent fwding for proto 1.3, remove abuse of auth-rsa flags.
- split key exchange (kex) and user authentication (user-auth),
ok: provos@
- Big manpage and config file cleanup from Andre Lucas
<andre.lucas@dial.pipex.com>
- Re-added latest (unmodified) OpenBSD manpages
- Doc updates
- NetBSD patch from David Rankin <drankin@bohemians.lexington.ky.us> and
Christos Zoulas <christos@netbsd.org>
20000119
- SCO compile fixes from Gary E. Miller <gem@rellim.com>
- Compile fix from Darren_Hall@progressive.com
- Linux/glibc-2.1.2 takes a *long* time to look up names for AF_UNSPEC
addresses using getaddrinfo(). Added a configure switch to make the
default lookup mode AF_INET
20000118
- Fixed --with-pid-dir option
- Makefile fix from Gary E. Miller <gem@rellim.com>
- Compile fix for HPUX and Solaris from Andre Lucas
<andre.lucas@dial.pipex.com>
states that the motivation for this program was to speed up cvs work,
but it works just as well with "rsync" and other programs that use ssh
for the transport. This is a set of python scripts: "fsh" uses ssh,
(or optionally rsh or lsh) to start and set up a connection to "fshd"
on the remote host, also includes "fcp", and docs in "info" format.
compiled. This also fixes problems with Kerberos IV and V
support clashing (you still have to choose one or the other
at compile time, though).
Compiles and runs on 1.4O -- needs testing on 1.4.2, and
also some closer looking at certain patches (e.g. patch-au
has a "#if 0" that could maybe be something else).
RSA*Encrypt() routines, require 3 bytes extra space for PKCS tags.
From Bugtraq posting <3845D352.95E47E26@core-sdi.com>, by
Gerardo Richarte <core.lists.bugtraq@CORE-SDI.COM>, dated
Wed, 1 Dec 1999 23:09:12 -0300
If you build packages with USE_RSAREF2 set, it is advisable to update
the rsaref package and any packages which may depend on it (openssl,
pgp2, ssh).
/* XXX someone should test this in i386/aout, maybe that broke
in exchange, so someone would need to fix it. I have no system
to test on. But since this package was totaly broken, its an
improvement... XXX */
Noteworthy changes in version 1.0.0 (1999-09-07)
-----------------------------------
* Add a very preliminary version of the GNU Privacy Handbook to
the distribution (lynx doc/gph/index.html).
* Changed the version number to GnuPG 2001 ;-)
Noteworthy changes in version 0.9.11
------------------------------------
* UTF-8 strings are now correctly printed (if --charset is set correctly).
Output of --with-colons remains C-style escaped UTF-8.
* Workaround for a problem with PGP 5 detached signature in textmode.
* Fixed a problem when importing new subkeys (duplicated signatures).
Noteworthy changes in version 0.9.10
------------------------------------
* Some strange new options to help pgpgpg
* Cleaned up the dox a bit.
Noteworthy changes in version 0.9.9
-----------------------------------
* New options --[no-]utf8-strings.
* New edit-menu commands "enable" and "disable" for entire keys.
* You will be asked for a filename if gpg cannot deduce one.
* Changes to support libtool which is needed for the development
of libgcrypt.
* New script tools/lspgpot to help transferring assigned
trustvalues from PGP to GnuPG.
* New commands --lsign-key and made --sign-key a shortcut for --edit
and sign.
* New options (#122--126 ;-) --[no-]default-recipient[-self],
--disable-{cipher,pubkey}-algo. See the man page.
* Enhanced info output in case of multiple recipients and fixed exit code.
* New option --allow-non-selfsigned-uid to work around a problem with
the German IN way of separating signing and encryption keys.
Noteworthy changes in version 0.9.8
-----------------------------------
* New subcommand "delsig" in the edit menu.
* The name of the output file is not anymore the one which is
embedded in the processed message, but the used filename with
the extension stripped. To revert to the old behaviour you can
use the option --use-embedded-filename.
* Another hack to cope with pgp2 generated detached signatures.
* latin-2 character set works (--charset=iso-8859-2).
* New option --with-key-data to list the public key parameters.
New option -N to insert notations and a --set-policy-url.
A couple of other options to allow reseting of options.
* Better support for HPUX.
Noteworthy changes in version 0.9.7
-----------------------------------
* Add some work arounds for a bugs in pgp 2 which led to bad signatures
when used with canonical texts in some cases.
* Enhanced some status outputs.
Noteworthy changes in version 0.9.6
-----------------------------------
* Twofish is now statically linked by default. The experimental 128 bit
version is now disabled. Full support will be available as soon as
the OpenPGP WG has decided on an interpretation of rfc2440.
* Dropped support for the ancient Blowfish160 which is not OpenPGP.
* Merged gpgm and gpg into one binary.
* Add "revsig" and "revkey" commands to the edit menu. It is now
possible to revoke signature and subkeys.
Note that I reverted some LIBZ stuff in patch-ac that was (while
correct) not necessary and conflicted with the Kerberos patch.
I have not tested the combination of Kerberos IV and INET6 (yet).
Quick guide for compiling packages:
- set KERBEROS=4 or KERBEROS=5 in /etc/mk.conf
Quick guide for configuring Kerberos support in a package Makefile:
- test for KERBEROS value and enable the appropriate version with
CONFIGURE_ARGS or other means and set USE_KERBEROS=yes
- make sure to disable Kerberos support otherwise (especially if
using configure, which might automatically detect it)
- BUILD_DEFS and RESTRICTED are set automatically in bsd.pkg.mk
when USE_KERBEROS=yes is set
- revise patch-aq so it doesn't conflict with ipv6 patches.
- adjust checksums
- set up alternate patch-sum-v6 patchfile used when
v6 patches are added.
stub connections on client and server side. (it was correctly being
enabled over the long-haul connection, but somehow it got missed on
the loopback connections to the real X client and server)
This makes x2x over ssh actually pleasant to use.
was being performed by the Makefile, but there wouldn't have been any
substitutions made because there was no occurrence of @localbase@
in the target files.
Pointed out in PR 7794 by Mason Loring Bliss.
reorder some patches, and touch the timestamp on all Makefile.in files, so
that automake and autoconf are never run (regardless of whether they are
installed).
which is not in libc's md5, and is now being used by some dependencies.
This bumps the shared library major version; this package is NOT shared
library binary compatible with old rsaref dependent packages.
as pointed out by Bjoern Labitzke <hermit@cs.tu-berlin.de> in PR/7359.
While I'm at it, also correct the behaviour when invoked as "pgp5"
(give usage, not unhelpful 'invoked with unknown symbolic link').
