installs the binaries directly in /usr and places the manpages and example
files in the correct hier(7) locations. We don't register installation in
this case because the package database can't handle it. We deal with the
ssh config files and directories as follows:
NetBSD-1.5.* use /etc/ssh_config, /etc/sshd_config
NetBSD-1.6 use /etc/ssh/ssh_config, /etc/ssh/sshd_config
We also emit a warning in the MESSAGE file that /etc/ssh.conf and
/etc/sshd.conf should be renamed in order to keep using them. Lastly,
there is a new target "tarball" to generate a tarball of the installed
files that might be used to install quickly on many machines, though it
may be only of limited utility.
These changes are only active if UPDATE_INTREE_OPENSSH is defined.
Note: it was already as part of CONFIGURE_ENV value, this change only makes
it more "readable" IMHO.
Remove explicit addition of PKG_SYSCONFDIR to BUILD_DEFS in a couple of
Makefiles.
20020626
- (stevesk) [monitor.c] remove duplicate proto15 dispatch entry for PAM
- (bal) OpenBSD CVS Sync
- markus@cvs.openbsd.org 2002/06/23 21:34:07
[channels.c]
tcode is u_int
- markus@cvs.openbsd.org 2002/06/24 13:12:23
[ssh-agent.1]
the socket name contains ssh-agent's ppid; via mpech@ from form@
- markus@cvs.openbsd.org 2002/06/24 14:33:27
[channels.c channels.h clientloop.c serverloop.c]
move channel counter to u_int
- markus@cvs.openbsd.org 2002/06/24 14:55:38
[authfile.c kex.c ssh-agent.c]
cat to (void) when output from buffer_get_X is ignored
- itojun@cvs.openbsd.org 2002/06/24 15:49:22
[msg.c]
printf type pedant
- deraadt@cvs.openbsd.org 2002/06/24 17:57:20
[sftp-server.c sshpty.c]
explicit (u_int) for uid and gid
- markus@cvs.openbsd.org 2002/06/25 16:22:42
[authfd.c]
unnecessary cast
- markus@cvs.openbsd.org 2002/06/25 18:51:04
[sshd.c]
lightweight do_setusercontext after chroot()
- (bal) Updated AIX package build. Patch by dtucker@zip.com.au
- (tim) [Makefile.in] fix test on installing ssh-rand-helper.8
- (bal) added back in error check for mmap(). I screwed up, Pointed
out by stevesk@
- (tim) [README.privsep] UnixWare tip no longer needed.
- (bal) fixed NeXTStep missing munmap() issue. It defines HAVE_MMAP,
but it all damned lies.
- (stevesk) [README.privsep] more for sshd pseudo-account.
- (tim) [contrib/caldera/openssh.spec] add support for privsep
- (djm) setlogin needs pgid==pid on BSD/OS; from itojun@
- (djm) OpenBSD CVS Sync
- markus@cvs.openbsd.org 2002/06/26 08:53:12
[bufaux.c]
limit size of BNs to 8KB; ok provos/deraadt
- markus@cvs.openbsd.org 2002/06/26 08:54:18
[buffer.c]
limit append to 1MB and buffers to 10MB
- markus@cvs.openbsd.org 2002/06/26 08:55:02
[channels.c]
limit # of channels to 10000
- markus@cvs.openbsd.org 2002/06/26 08:58:26
[session.c]
limit # of env vars to 1000; ok deraadt/djm
- deraadt@cvs.openbsd.org 2002/06/26 13:20:57
[monitor.c]
be careful in mm_zalloc
- deraadt@cvs.openbsd.org 2002/06/26 13:49:26
[session.c]
disclose less information from environment files; based on input
from djm, and dschultz@uclink.Berkeley.EDU
- markus@cvs.openbsd.org 2002/06/26 13:55:37
[auth2-chall.c]
make sure # of response matches # of queries, fixes int overflow;
from ISS
- markus@cvs.openbsd.org 2002/06/26 13:56:27
[version.h]
3.4
- (djm) Require krb5 devel for RPM build w/ KrbV
- (djm) Improve PAMAuthenticationViaKbdInt text from Nalin Dahyabhai
<nalin@redhat.com>
- (djm) Update spec files for release
- (djm) Fix int overflow in auth2-pam.c, similar to one discovered by ISS
- (djm) Release 3.4p1
20020625
- (stevesk) [INSTALL acconfig.h configure.ac defines.h] remove --with-rsh
- (stevesk) [README.privsep] minor updates
- (djm) Create privsep directory and warn if privsep user is missing
during make install
- (bal) Started list of PrivSep issues in TODO
- (bal) if mmap() is substandard, don't allow compression on server side.
Post 'event' we will add more options.
- (tim) [contrib/caldera/openssh.spec] Sync with Caldera
- (bal) moved aix_usrinfo() and noted not setting real TTY. Patch by
dtucker@zip.com.au
- (tim) [acconfig.h configure.ac sshd.c] BROKEN_FD_PASSING fix from Markus
for Cygwin, Cray, & SCO
20020624
- OpenBSD CVS Sync
- deraadt@cvs.openbsd.org 2002/06/23 03:25:50
[tildexpand.c]
KNF
- deraadt@cvs.openbsd.org 2002/06/23 03:26:19
[cipher.c key.c]
KNF
- deraadt@cvs.openbsd.org 2002/06/23 03:30:58
[scard.c ssh-dss.c ssh-rsa.c sshconnect.c sshconnect2.c sshd.c sshlogin.c
sshpty.c]
various KNF and %d for unsigned
- deraadt@cvs.openbsd.org 2002/06/23 09:30:14
[sftp-client.c sftp-client.h sftp-common.c sftp-int.c sftp-server.c
sftp.c]
bunch of u_int vs int stuff
- deraadt@cvs.openbsd.org 2002/06/23 09:39:55
[ssh-keygen.c]
u_int stuff
- deraadt@cvs.openbsd.org 2002/06/23 09:46:51
[bufaux.c servconf.c]
minor KNF. things the fingers do while you read
- deraadt@cvs.openbsd.org 2002/06/23 10:29:52
[ssh-agent.c sshd.c]
some minor KNF and %u
- deraadt@cvs.openbsd.org 2002/06/23 20:39:45
[session.c]
compression_level is u_int
- deraadt@cvs.openbsd.org 2002/06/23 21:06:13
[sshpty.c]
KNF
- deraadt@cvs.openbsd.org 2002/06/23 21:06:41
[channels.c channels.h session.c session.h]
display, screen, row, col, xpixel, ypixel are u_int; markus ok
- deraadt@cvs.openbsd.org 2002/06/23 21:10:02
[packet.c]
packet_get_int() returns unsigned for reason & seqnr
- (bal) Also fixed IPADDR_IN_DISPLAY case where display, screen, row, col,
xpixel are u_int.
20020623
- (stevesk) [configure.ac] bug #255 LOGIN_NEEDS_UTMPX for AIX.
- (bal) removed GNUism for getops in ssh-agent since glibc lacks optreset.
- (bal) add extern char *getopt. Based on report by dtucker@zip.com.au
- OpenBSD CVS Sync
- stevesk@cvs.openbsd.org 2002/06/22 02:00:29
[ssh.h]
correct comment
- stevesk@cvs.openbsd.org 2002/06/22 02:40:23
[ssh.1]
section 5 not 4 for ssh_config
- naddy@cvs.openbsd.org 2002/06/22 11:51:39
[ssh.1]
typo
- stevesk@cvs.openbsd.org 2002/06/22 16:32:54
[sshd.8]
add /var/empty in FILES section
- stevesk@cvs.openbsd.org 2002/06/22 16:40:19
[sshd.c]
check /var/empty owner mode; ok provos@
- stevesk@cvs.openbsd.org 2002/06/22 16:41:57
[scp.1]
typo
- stevesk@cvs.openbsd.org 2002/06/22 16:45:29
[ssh-agent.1 sshd.8 sshd_config.5]
use process ID vs. pid/PID/process identifier
- stevesk@cvs.openbsd.org 2002/06/22 20:05:27
[sshd.c]
don't call setsid() if debugging or run from inetd; no "Operation not
permitted" errors now; ok millert@ markus@
- stevesk@cvs.openbsd.org 2002/06/22 23:09:51
[monitor.c]
save auth method before monitor_reset_key_state(); bugzilla bug #284;
ok provos@
Remove `-p' from mkdir arguments, it is already part of ${MKDIR}.
While here substitute a couple of ${PREFIX} by `%D' in
`@exec ${MKDIR} ...' lines and add a couple of missing `%D' in such lines too!
(the following change may include pre-3.2.3p1 change)
20020622
- (djm) Update README.privsep; spotted by fries@
- (djm) Release 3.3p1
20020621
- (djm) Sync:
- djm@cvs.openbsd.org 2002/06/21 05:50:51
[monitor.c]
Don't initialise compression buffers when compression=no in sshd_config;
ok Niels@
- ID sync for auth-passwd.c
- (djm) Warn and disable compression on platforms which can't handle both
useprivilegeseparation=yes and compression=yes
- (djm) contrib/redhat/openssh.spec hacking:
- Merge in spec changes from seba@iq.pl (Sebastian Pachuta)
- Add new {ssh,sshd}_config.5 manpages
- Add new ssh-keysign program and remove setuid from ssh client
20020620
- (bal) Fixed AIX environment handling, use setpcred() instead of existing
code. (Bugzilla Bug 261)
- (bal) OpenBSD CVS Sync
- todd@cvs.openbsd.org 2002/06/14 21:35:00
[monitor_wrap.c]
spelling; from Brian Poole <raj@cerias.purdue.edu>
- markus@cvs.openbsd.org 2002/06/15 00:01:36
[authfd.c authfd.h ssh-add.c ssh-agent.c]
break agent key lifetime protocol and allow other contraints for key
usage.
- markus@cvs.openbsd.org 2002/06/15 00:07:38
[authfd.c authfd.h ssh-add.c ssh-agent.c]
fix stupid typo
- markus@cvs.openbsd.org 2002/06/15 01:27:48
[authfd.c authfd.h ssh-add.c ssh-agent.c]
remove the CONSTRAIN_IDENTITY messages and introduce a new
ADD_ID message with contraints instead. contraints can be
only added together with the private key.
- itojun@cvs.openbsd.org 2002/06/16 21:30:58
[ssh-keyscan.c]
use TAILQ_xx macro. from lukem@netbsd. markus ok
- deraadt@cvs.openbsd.org 2002/06/17 06:05:56
[scp.c]
make usage like man page
- deraadt@cvs.openbsd.org 2002/06/19 00:27:55
[auth-bsdauth.c auth-skey.c auth1.c auth2-chall.c auth2-none.c authfd.c
authfd.h monitor_wrap.c msg.c nchan.c radix.c readconf.c scp.c sftp.1
ssh-add.1 ssh-add.c ssh-agent.1 ssh-agent.c ssh-keygen.1 ssh-keygen.c
ssh-keysign.c ssh.1 sshconnect.c sshconnect.h sshconnect2.c ttymodes.c
xmalloc.h]
KNF done automatically while reading....
- markus@cvs.openbsd.org 2002/06/19 18:01:00
[cipher.c monitor.c monitor_wrap.c packet.c packet.h]
make the monitor sync the transfer ssh1 session key;
transfer keycontext only for RC4 (this is still depends on EVP
implementation details and is broken).
- stevesk@cvs.openbsd.org 2002/06/20 19:56:07
[ssh.1 sshd.8]
move configuration file options from ssh.1/sshd.8 to
ssh_config.5/sshd_config.5; ok deraadt@ millert@
- stevesk@cvs.openbsd.org 2002/06/20 20:00:05
[scp.1 sftp.1]
ssh_config(5)
- stevesk@cvs.openbsd.org 2002/06/20 20:03:34
[ssh_config sshd_config]
refer to config file man page
- markus@cvs.openbsd.org 2002/06/20 23:05:56
[servconf.c servconf.h session.c sshd.c]
allow Compression=yes/no in sshd_config
- markus@cvs.openbsd.org 2002/06/20 23:37:12
[sshd_config]
add Compression
- stevesk@cvs.openbsd.org 2002/05/25 20:40:08
[LICENCE]
missed Per Allansson (auth2-chall.c)
- (bal) Cygwin special handling of empty passwords wrong. Patch by
vinschen@redhat.com
- (bal) Missed integrating ssh_config.5 and sshd_config.5
- (bal) Still more Makefile.in updates for ssh{d}_config.5
20020613
- (bal) typo of setgroup for cygwin. Patch by vinschen@redhat.com
20020612
- (bal) OpenBSD CVS Sync
- markus@cvs.openbsd.org 2002/06/11 23:03:54
[ssh.c]
remove unused cruft.
- markus@cvs.openbsd.org 2002/06/12 01:09:52
[ssh.c]
ssh_connect returns 0 on success
- (bal) Build noop setgroups() for cygwin to clean up code (For other
platforms without the setgroups() requirement, you MUST define
SETGROUPS_NOOP in the configure.ac) Based on patch by vinschen@redhat.com
- (bal) Some platforms don't have ONLCR (Notable Mint)
20020611
- (bal) ssh-agent.c RCSD fix (|unexpand already done)
- (bal) OpenBSD CVS Sync
- stevesk@cvs.openbsd.org 2002/06/09 22:15:15
[ssh.1]
update for no setuid root and ssh-keysign; ok deraadt@
- itojun@cvs.openbsd.org 2002/06/09 22:17:21
[sshconnect.c]
pass salen to sockaddr_ntop so that we are happy on linux/solaris
- stevesk@cvs.openbsd.org 2002/06/10 16:53:06
[auth-rsa.c ssh-rsa.c]
display minimum RSA modulus in error(); ok markus@
- stevesk@cvs.openbsd.org 2002/06/10 16:56:30
[ssh-keysign.8]
merge in stuff from my man page; ok markus@
- stevesk@cvs.openbsd.org 2002/06/10 17:36:23
[ssh-add.1 ssh-add.c]
use convtime() to parse and validate key lifetime. can now
use '-t 2h' etc. ok markus@ provos@
- stevesk@cvs.openbsd.org 2002/06/10 17:45:20
[readconf.c ssh.1]
change RhostsRSAAuthentication and RhostsAuthentication default to no
since ssh is no longer setuid root by default; ok markus@
- stevesk@cvs.openbsd.org 2002/06/10 21:21:10
[ssh_config]
update defaults for RhostsRSAAuthentication and RhostsAuthentication
here too (all options commented out with default value).
- markus@cvs.openbsd.org 2002/06/10 22:28:41
[channels.c channels.h session.c]
move creation of agent socket to session.c; no need for uidswapping
in channel.c.
- markus@cvs.openbsd.org 2002/06/11 04:14:26
[ssh.c sshconnect.c sshconnect.h]
no longer use uidswap.[ch] from the ssh client
run less code with euid==0 if ssh is installed setuid root
just switch the euid, don't switch the complete set of groups
(this is only needed by sshd). ok provos@
- mpech@cvs.openbsd.org 2002/06/11 05:46:20
[auth-krb4.c monitor.h serverloop.c session.c ssh-agent.c sshd.c]
pid_t cleanup. Markus need this now to keep hacking.
markus@, millert@ ok
- itojun@cvs.openbsd.org 2002/06/11 08:11:45
[canohost.c]
use "ntop" only after initialized
- (bal) Cygwin fix up from swap uid clean up in ssh.c patch by
vinschen@redhat.com
20020609
- (bal) OpenBSD CVS Sync
- markus@cvs.openbsd.org 2002/06/08 05:07:56
[ssh.c]
nuke ptrace comment
- markus@cvs.openbsd.org 2002/06/08 05:07:09
[ssh-keysign.c]
only accept 20 byte session ids
- markus@cvs.openbsd.org 2002/06/08 05:17:01
[readconf.c readconf.h ssh.1 ssh.c]
deprecate FallBackToRsh and UseRsh; patch from djm@
- markus@cvs.openbsd.org 2002/06/08 05:40:01
[readconf.c]
just warn about Deprecated options for now
- markus@cvs.openbsd.org 2002/06/08 05:41:18
[ssh_config]
remove FallBackToRsh/UseRsh
- markus@cvs.openbsd.org 2002/06/08 12:36:53
[scp.c]
remove FallBackToRsh
- markus@cvs.openbsd.org 2002/06/08 12:46:14
[readconf.c]
silently ignore deprecated options, since FallBackToRsh might be passed
by remote scp commands.
- itojun@cvs.openbsd.org 2002/06/08 21:15:27
[sshconnect.c]
always use getnameinfo. (diag message only)
- markus@cvs.openbsd.org 2002/06/09 04:33:27
[sshconnect.c]
abort() - > fatal()
- (bal) RCSID tag updates on channels.c, clientloop.c, nchan.c,
sftp-client.c, ssh-agenet.c, ssh-keygen.c and connect.h (we did unexpand
independant of them)
20020607
- (bal) Removed --{enable/disable}-suid-ssh
- (bal) Missed __progname in ssh-keysign.c patch by dtucker@zip.com.au
- (bal) use 'LOGIN_PROGRAM' not '/usr/bin/login' in session.c patch by
Bertrand.Velle@apogee-com.fr
20020606
- (bal) OpenBSD CVS Sync
- markus@cvs.openbsd.org 2002/05/15 21:56:38
[servconf.c sshd.8 sshd_config]
re-enable privsep and disable setuid for post-3.2.2
- markus@cvs.openbsd.org 2002/05/16 22:02:50
[cipher.c kex.h mac.c]
fix warnings (openssl 0.9.7 requires const)
- stevesk@cvs.openbsd.org 2002/05/16 22:09:59
[session.c ssh.c]
don't limit xauth pathlen on client side and longer print length on
server when debug; ok markus@
- deraadt@cvs.openbsd.org 2002/05/19 20:54:52
[log.h]
extra commas in enum not 100% portable
- deraadt@cvs.openbsd.org 2002/05/22 23:18:25
[ssh.c sshd.c]
spelling; abishoff@arc.nasa.gov
- markus@cvs.openbsd.org 2002/05/23 19:24:30
[authfile.c authfile.h pathnames.h ssh.c sshconnect.c sshconnect.h
sshconnect1.c sshconnect2.c ssh-keysign.8 ssh-keysign.c Makefile.in]
add /usr/libexec/ssh-keysign: a setuid helper program for hostbased
authentication in protocol v2 (needs to access the hostkeys).
- markus@cvs.openbsd.org 2002/05/23 19:39:34
[ssh.c]
add comment about ssh-keysign
- markus@cvs.openbsd.org 2002/05/24 08:45:14
[sshconnect2.c]
stat ssh-keysign first, print error if stat fails;
some debug->error; fix comment
- markus@cvs.openbsd.org 2002/05/25 08:50:39
[sshconnect2.c]
execlp->execl; from stevesk
- markus@cvs.openbsd.org 2002/05/25 18:51:07
[auth.h auth2.c auth2-hostbased.c auth2-kbdint.c auth2-none.c
auth2-passwd.c auth2-pubkey.c Makefile.in]
split auth2.c into one file per method; ok provos@/deraadt@
- stevesk@cvs.openbsd.org 2002/05/26 20:35:10
[ssh.1]
sort ChallengeResponseAuthentication; ok markus@
- stevesk@cvs.openbsd.org 2002/05/28 16:45:27
[monitor_mm.c]
print strerror(errno) on mmap/munmap error; ok markus@
- stevesk@cvs.openbsd.org 2002/05/28 17:28:02
[uidswap.c]
format spec change/casts and some KNF; ok markus@
- stevesk@cvs.openbsd.org 2002/05/28 21:24:00
[uidswap.c]
use correct function name in fatal()
- stevesk@cvs.openbsd.org 2002/05/29 03:06:30
[ssh.1 sshd.8]
spelling
- markus@cvs.openbsd.org 2002/05/29 11:21:57
[sshd.c]
don't start if privsep is enabled and SSH_PRIVSEP_USER or
_PATH_PRIVSEP_CHROOT_DIR are missing; ok deraadt@
- markus@cvs.openbsd.org 2002/05/30 08:07:31
[cipher.c]
use rijndael/aes from libcrypto (openssl >= 0.9.7) instead of
our own implementation. allow use of AES hardware via libcrypto,
ok deraadt@
- markus@cvs.openbsd.org 2002/05/31 10:30:33
[sshconnect2.c]
extent ssh-keysign protocol:
pass # of socket-fd to ssh-keysign, keysign verfies locally used
ip-address using this socket-fd, restricts fake local hostnames
to actual local hostnames; ok stevesk@
- markus@cvs.openbsd.org 2002/05/31 11:35:15
[auth.h auth2.c]
move Authmethod definitons to per-method file.
- markus@cvs.openbsd.org 2002/05/31 13:16:48
[key.c]
add comment:
key_verify returns 1 for a correct signature, 0 for an incorrect signature
and -1 on error.
- markus@cvs.openbsd.org 2002/05/31 13:20:50
[ssh-rsa.c]
pad received signature with leading zeros, because RSA_verify expects
a signature of RSA_size. the drafts says the signature is transmitted
unpadded (e.g. putty does not pad), reported by anakin@pobox.com
- deraadt@cvs.openbsd.org 2002/06/03 12:04:07
[ssh.h]
compatiblity -> compatibility
decriptor -> descriptor
authentciated -> authenticated
transmition -> transmission
- markus@cvs.openbsd.org 2002/06/04 19:42:35
[monitor.c]
only allow enabled authentication methods; ok provos@
- markus@cvs.openbsd.org 2002/06/04 19:53:40
[monitor.c]
save the session id (hash) for ssh2 (it will be passed with the
initial sign request) and verify that this value is used during
authentication; ok provos@
- markus@cvs.openbsd.org 2002/06/04 23:02:06
[packet.c]
remove __FUNCTION__
- markus@cvs.openbsd.org 2002/06/04 23:05:49
[cipher.c monitor.c monitor_fdpass.c monitor_mm.c monitor_wrap.c]
__FUNCTION__ -> __func__
- markus@cvs.openbsd.org 2002/06/05 16:08:07
[ssh-agent.1 ssh-agent.c]
'-a bind_address' binds the agent to user-specified unix-domain
socket instead of /tmp/ssh-XXXXXXXX/agent.<pid>; ok djm@ (some time ago).
- markus@cvs.openbsd.org 2002/06/05 16:08:07
[ssh-agent.1 ssh-agent.c]
'-a bind_address' binds the agent to user-specified unix-domain
socket instead of /tmp/ssh-XXXXXXXX/agent.<pid>; ok djm@ (some time ago).
- markus@cvs.openbsd.org 2002/06/05 16:48:54
[ssh-agent.c]
copy current request into an extra buffer and just flush this
request on errors, ok provos@
- markus@cvs.openbsd.org 2002/06/05 19:57:12
[authfd.c authfd.h ssh-add.1 ssh-add.c ssh-agent.c]
ssh-add -x for lock and -X for unlocking the agent.
todo: encrypt private keys with locked...
- markus@cvs.openbsd.org 2002/06/05 20:56:39
[ssh-add.c]
add -x/-X to usage
- markus@cvs.openbsd.org 2002/06/05 21:55:44
[authfd.c authfd.h ssh-add.1 ssh-add.c ssh-agent.c]
ssh-add -t life, Set lifetime (in seconds) when adding identities;
ok provos@
- stevesk@cvs.openbsd.org 2002/06/06 01:09:41
[monitor.h]
no trailing comma in enum; china@thewrittenword.com
- markus@cvs.openbsd.org 2002/06/06 17:12:44
[sftp-server.c]
discard remaining bytes of current request; ok provos@
- markus@cvs.openbsd.org 2002/06/06 17:30:11
[sftp-server.c]
use get_int() macro (hide iqueue)
- (bal) Missed msg.[ch] in merge. Required for ssh-keysign.
- (bal) Forgot to add msg.c Makefile.in.
- (bal) monitor_mm.c typos.
- (bal) Refixed auth2.c. It was never fully commited while spliting out
authentication to different files.
- (bal) ssh-keysign should build and install correctly now. Phase two
would be to clean out any dead wood and disable ssh setuid on install.
- (bal) Reverse logic, use __func__ first since it's C99
20020604
- (stevesk) [channels.c] bug #164 patch from YOSHIFUJI Hideaki (changed
setsockopt from debug to error for now).
20020527
- (tim) [configure.ac.orig monitor_fdpass.c] Enahnce msghdr tests to address
build problem on Irix reported by Dave Love <d.love@dl.ac.uk>. Back out
last monitor_fdpass.c changes that are no longer needed with new tests.
Patch tested on Irix by Jan-Frode Myklebust <janfrode@parallab.uib.no>
20020522
- (djm) Fix spelling mistakes, spotted by Solar Designer i
<solar@openwall.com>
- Sync scard/ (not sure when it drifted)
- (djm) OpenBSD CVS Sync:
[auth.c]
Fix typo/thinko. Pass in as to auth_approval(), not NULL.
Closes PR 2659.
- Crank version
- Crank RPM spec versions
20020521
- (stevesk) [sshd.c] bug 245; disable setsid() for now
- (stevesk) [sshd.c] #ifndef HAVE_CYGWIN for setgroups()
20020517
- (tim) [configure.ac] remove extra MD5_MSG="no" line.
20020515
- (bal) CVS ID fix up on auth-passwd.c
- (bal) OpenBSD CVS Sync
- deraadt@cvs.openbsd.org 2002/05/07 19:54:36
[ssh.h]
use ssh uid
- deraadt@cvs.openbsd.org 2002/05/08 21:06:34
[ssh.h]
move to sshd.sshd instead
- stevesk@cvs.openbsd.org 2002/05/11 20:24:48
[ssh.h]
typo in comment
- itojun@cvs.openbsd.org 2002/05/13 02:37:39
[auth-skey.c auth2.c]
less warnings. skey_{respond,query} are public (in auth.h)
- markus@cvs.openbsd.org 2002/05/13 20:44:58
[auth-options.c auth.c auth.h]
move the packet_send_debug handling from auth-options.c to auth.c;
ok provos@
- millert@cvs.openbsd.org 2002/05/13 15:53:19
[sshd.c]
Call setsid() in the child after sshd accepts the connection and forks.
This is needed for privsep which calls setlogin() when it changes uids.
Without this, there is a race where the login name of an existing
connection, as returned by getlogin(), may be changed to the privsep
user (sshd). markus@ OK
- markus@cvs.openbsd.org 2002/05/13 21:26:49
[auth-rhosts.c]
handle debug messages during rhosts-rsa and hostbased authentication;
ok provos@
- mouring@cvs.openbsd.org 2002/05/15 15:47:49
[kex.c monitor.c monitor_wrap.c sshd.c]
'monitor' variable clashes with at least one lame platform (NeXT). i
Renamed to 'pmonitor'. provos@
- deraadt@cvs.openbsd.org 2002/05/04 02:39:35
[servconf.c sshd.8 sshd_config]
enable privsep by default; provos ok
- millert@cvs.openbsd.org 2002/05/06 23:34:33
[ssh.1 sshd.8]
Kill/adjust r(login|exec)d? references now that those are no longer in
the tree.
- markus@cvs.openbsd.org 2002/05/15 21:02:53
[servconf.c sshd.8 sshd_config]
disable privsep and enable setuid for the 3.2.2 release
- (bal) Fixed up PAM case. I think.
- (bal) Clarified openbsd-compat/*-cray.* Licence provided by Wendy
- (bal) OpenBSD CVS Sync
- markus@cvs.openbsd.org 2002/05/15 21:05:29
[version.h]
enter OpenSSH_3.2.2
- (bal) Caldara, Suse, and Redhat openssh.specs updated.
which the basesrc USE_KERBEROS variable. Discussed on packages@
This fixes PR#17182 from Takahiro Kambe. The problem was pointed out by
FUKAUMI Naoki on a Japanese NetBSD mailing list.
- a defect in the BSD_AUTH access control handling for
OpenBSD and BSD/OS systems:
Under certain conditions, on systems using YP with netgroups
in the password database, it is possible that sshd does ACL
checks for the requested user name but uses the password
database entry of a different user for authentication. This
means that denied users might authenticate successfully while
permitted users could be locked out (OpenBSD PR 2659).
- login/tty problems on Solaris (bug #245)
- build problems on Cygwin systems
Security Changes:
=================
- fixed buffer overflow in Kerberos/AFS token passing
- fixed overflow in Kerberos client code
- sshd no longer auto-enables Kerberos/AFS
- experimental support for privilege separation,
see UsePrivilegeSeparation in sshd(8) and
http://www.citi.umich.edu/u/provos/ssh/privsep.html
for more information.
- only accept RSA keys of size SSH_RSA_MINIMUM_MODULUS_SIZE (768) or larger
Other Changes:
==============
- improved smartcard support (including support for OpenSC, see www.opensc.org)
- improved Kerberos support (including support for MIT-Kerberos V)
- fixed stderr handling in protocol v2
- client reports failure if -R style TCP forwarding fails in protocol v2
- support configuration of TCP forwarding during interactive sessions (~C)
- improved support for older sftp servers
- improved support for importing old DSA keys (from ssh.com software).
- client side suport for PASSWD_CHANGEREQ in protocol v2
- fixed waitpid race conditions
- record correct lastlogin time
* Build properly on systems that don't have /dev/urandom by testing for
the presence of /dev/urandom, instead of just testing for Solaris.
* Add disabled code to handle PAM (not quite working yet with security/PAM).
* Make the sshd rc.d script more /etc/rc.subr-friendly.
* Minimize amount of diffs from pristine OpenSSH sources.
* Disabled scard-install (patch/patch-ah -- Do we need/want it?)
Changes since 2.9.9.2:
- Don't allow authorized_keys specified environment variables when
UseLogin in active
- Fix IPv4 default in ssh-keyscan
- Fix early (and double) free of remote user when using Kerberos
- fix krb5 authorization check
- enable authorized_keys2 again
- ignore SIGPIPE early, makes ssh work if agent dies, netbsd-pr via itojun@
- make ~& (backgrounding) work again for proto v1; add support ~& for v2, too
- pad using the padding field from the ssh2 packet instead of sending
extra ignore messages
- missing free and sync dss/rsa code
- crank c->path to 256 so they can hold a full hostname
- cleanup libwrap support
- Fix fd leak in loginrec.c
- avoid possible FD_ISSET overflow for channels established
during channnel_after_select()
- chdir $HOME after krb_afslog()
- stat subsystem command before calling do_exec
- close all channels if the connection to the remote host has been closed,
should fix sshd's hanging with WCHAN==wait
- add NoHostAuthenticationForLocalhost; note that the hostkey is
now check for localhost, too
- loginrec.c: fix type conversion problems exposed when using 64-bit off_t
- Update spec files for new x11-askpass
