Added --disable-root-mailer to CONFIGURE_ARGS better security.
Changes from 1.6.3p7 to 1.6.5 is attached bellow.
417) Visudo now checks for the existence of an editor and gives a sensible
error if it does not exist.
418) The path to the editor for visudo is now a colon-separated list of
allowable editors. If the user has $EDITOR set and it matches
one of the allowed editors that editor will be used. If not,
the first editor that actually exists is used.
419) Visudo now does its own fork/exec instead of calling system(3).
420) Allow special characters (including '#') to be embedded in pathnames
if quoted by a '\\'. The quoted chars will be dealt with by fnmatch().
Unfortunately, 'sudo -l' still prints the '\\'.
421) Added the always_set_home option.
422) Strip NLSPATH and PATH_LOCALE out from the environment to prevent
reading of protected files by a less privileged user.
423) Added support for BSD authentication and associated -a flag.
424) Added check for _innetgr(3) since NCR systems have this instead
of innetgr(3).
425) Added stay_setuid option for systems that have libraries that perform
extra paranoia checks in system libraries for setuid programs.
426) Environment munging is now done by hand. The environment is zeroed
upon sudo startup and a new environment is built before the command
is executed. This means we don't rely on getenv(3), putenv(3),
or setenv(3).
427) Added a class of environment variables that are only cleared if they
contain '/' or '%' characters.
428) Use stashed user_gid when checking against exempt gid since sudo
sets its gid to SUDOERS_GID, making getgid() return that, not the
real gid. Fixes problem with setting exempt group == SUDOERS_GID.
Fix from Paul Kranenburg.
429) Fixed file locking in visudo on NeXT which has a broken lockf().
Patch from twetzel@gwdg.de.
430) Regenerated configure script with autoconf-2.52 (required some
tweaking of configure.in and friends).
431) Added mail_badpass option to send mail when the user does not
authenticate successfully.
432) Added env_reset Defaults option to reset the environment to
a clean slate. Also implemented env_keep Defaults option
to specify variables to be preserved when resetting the
environment.
433) Added env_check and env_delete Defaults options to allow the admin
to modify the builtin list of environment variables to remove.
434) If timestamp_timeout < 0 then the timestamp never expires. This
allows users to manage their own timestamps and create or delete
them via 'sudo -v' and 'sudo -k' respectively.
435) Authentication routines that use sudo's tgetpass() now accept
^C or ^Z at the password prompt and sudo will act appropriately.
436) Added a check-only mode to visudo to check an existing sudoers
file for sanity.
437) Visudo can now edit an alternate sudoers file.
438) If sudo is configured with S/Key support and the system has
skeyaccess(3) use that to determine whether or not to allow
a normal Unix password or just S/Key.
439) Fixed CIDR handling in sudoers.
440) Fixed a segv if the local hostname is not resolvable and
the 'fqdn' option is set.
441) "listpw=never" was not having an effect for users who did not
appear in sudoers--now it does.
442) The --without-sendmail option now works on systems with
a /usr/include/paths.h file that defines _PATH_SENDMAIL.
443) Removed the "secure_path" Defaults option as it does not work and
cannot work until the parser is overhauled.
444) Added new -P flag and "preserve_groups" sudoers option to cause
sudo to preserve the group vector instead of setting it to that
of the target user. Previously, if the target user was root
the group vector was not changed. Now it is always changed unless
the -P flag or "preserve_groups" option was given.
445) If find_path() fails as root, try again as the invoking user (useful
for NFS). Idea from Chip Capelik.
446) Use setpwent()/endpwent() and its shadow equivalents to be sure
the passwd/shadow file gets closed.
447) Use getifaddrs(3) to get the list of network interfaces if it is
available.
448) Dump list of local IP addresses and environment variables to clear
when 'sudo -V' is run as root.
449) Reorganized the lexer a bit and added more states. Sudo now does a
better job of parsing command arguments in the sudoers file.
450) Wrap each call to syslog() with openlog()/closelog() since some
things (such as PAM) may call closelog(3) behind sudo's back.
451) The LOGNAME and USER environment variables are now set if the user
specified a target uid and that uid exists in the password database.
452) configure will no longer add the -g flag to CFLAGS by default.
453) Now call pam_setcreds() to setup creds for the target user when
PAM is in use. On Linux this often sets resource limits.
454) If "make install" is run by non-root and the destination dir
is writable, install things normally but don't set owner and mode.
455) The Makefile now supports installing in a shadow hierarchy
specified via the DESTDIR variable.
456) config.h.in is now generated by autoheader.
Sudo 1.6.4 released.
457) Move the call to rebuild_env() until after MODE_RESET_HOME is set.
Otherwise, the set_home option has no effect.
458) Fix use of freed memory when the "fqdn" flag is set. This was
introduced by the fix for the "segv when gethostbynam() fails" bug.
459) Add 'continue' statements to optimize the switch statement.
From Solar Designer.
Sudo 1.6.4p1 released.
460) Some special characters were not being escaped properly (e..g '\,')
in command line arguments and would cause a syntax error instead.
461) "sudo -l" would not work if the always_set_home option was set.
462) Added a configure option to disable use of POSIX saved IDs for
operating systems where these are broken.
463) The SHELL environment variable was preserved from the user's environment
instead of being reset based on the passwd database even when the
"env_reset" option was set.
Sudo 1.6.4p2 released.
464) Added a configure option to cause mail sent by sudo to be run as
the invoking user instead of root. Some people consider this to
be safer.
465) If the mailer is being run as root, use a hard-coded environment
that is not influenced in any way by the invoking user's environment.
466) Fixed the call to skeyaccess(). Patch from Phillip E. Lobbes.
Sudo 1.6.5 released.
* The list of keyservers is now read form the file "keyservers" in the
GPA configuration directory which by default is ~/.gnupg. The new
option keyserver may be used in the gpa.conf file to select the
default keyserver - it implictly adds this server to the list of
keyservers.
hierarchy. Whilst this is not desirable, it's the only way to get this
package to execute properly, since it makes assumptions about absolute
and relative paths, and expects its own versions of certain commands (md5,
file), so it's best to keep these off to one side.
Here is quote from README.
$Id: README,v 1.3 2001/11/18 19:00:06 majkl Exp $
'OpenSSL for Ruby' project
Copyright (C) 2001 Michal Rokos <m.rokos@sh.cvut.cz>
All rights reserved.
This program is licenced under the same licence as Ruby.
(See the file 'LICENCE'.)
[Done] (but not fully tested)
= OpenSSL config file parser (part) --- TO BE DROPPED? (any idea?)
= PKey:: RSA,DSA keys - new, load, export
= X509::Certificate - generating new certs, load, looking inside
= X509::CRL - load, new, looking inside
= X509::Name - new, export to_str, to_a, to_h (hash)
= X509::Revoked - new, looking inside (on parameters)
= X509::Store - new, import trusted certs and CRL, verifiing certs
= Digest::... - various hashes
= X509::Request - Cert requests
= X509::Attribute - as X509Request extensions (not tested)
= X509::Extension - to Certs, CRLs...
= X509::ExtensionMaker - for easy creating new Extensions
= Netscape::SPKI - for requests from NetscapeCommunicators
= Cipher::... - various ciphers
= basic PRNG functions (random generator) for OpenSSL module and class Random
= SSLSocket (merged Gotou Yuuzou's SSLsocket-Ruby project)
= PKCS7 (signing&data_verify is working, rest needs some testing)
[To-Do]
= check for memory leaking :-))
= cleaner code
= examples
= RubyUnit to be used!
= API documentation
= comments to sources!!!
= further functionality to existing
= Std. Extensions, Attributes to be made as Classes?
= AttributeFactory?
= add aliases to to_pem as s_dump s_load to support Marshal module
= CipherFactory?
= autogen random IVs for Ciphers
= safe BigNums
= PKCS12
= PKCS8
= HMAC
= ASN.1 ???
= BIO ???
= compat tests for RSA/DSA sign/encrypt
appropriate place. Pointed out in private mail by someone who wishes
to remain anonymous.
XXX The PLIST's location for these files needs to be fixed by someone
more knowledgable than me in these black arts.
- str[n]{cpy,cat} -> strl{cpy,cat}, sprintf -> snprintf
- strftime format fixes
- Don't hang waiting for select() with SIGTERM + no active SA
- Add UI option 'R' to trigger isakmpd reinit (same as SIGHUP)
...
http://www.openbsd.org/cgi-bin/cvsweb/src/sbin/isakmpd/
* Added a "--local" option for removing the ${HOSTNAME} from the various
files that keychain creates. Handy for non-NFS users.
* Using the Bourne shell "type" builtin rather than using the external
"which" command. Should make things a lot more robust and slightly
faster.
* Solaris' "which" command outputs "no lockfile in..." to stdout rather
than stderr. A one-line fix (test the error condition) has been
applied.
* lockfile settings tweak
* If you stop making progress providing valid passphrases, it's three
strikes and you're out.
* Some private keys can't be "ssh-keygen -l -f"'d; this patch causes
keychain to look for the corresponding public key if the private
key doesn't work. Thanks Constantine!
* CYAN color misdefined; fixed.
* A "quiet mode" (--quiet) fix; I missed an "echo".
* Missed another "kill -9"; it's now gone.
TCT is a collection of programs by Dan Farmer and Wietse Venema for a
post-mortem analysis of a UNIX system after break-in.
Notable TCT components are the grave-robber tool that captures
information, the ils and mactime tools that display access patterns of
files dead or alive, the unrm and lazarus tools that recover deleted
files, and the findkey tool that recovers cryptographic keys from a
running process or from files.
WARNING
This software is not for the faint of heart. It is relatively
unpolished compared to the software that Dan and Wietse usually
release. TCT can spend a lot of time collecting data. And although
TCT collects lots of data, many analysis tools still need to be
written.
Based on patches provided in PR 15081 by frazee.23@osu.edu.
- Fixed a bug in the mcrypt extension, where list destructors were not
properly being allocated. (Sterling)
- Fixed bugs in the mcrypt extension that caused crashes. (Derick)
1.0.10 :
Changes by Michael Scheidell <scheidell@fdma.com> :
- Backported Nessus 1.1.x plugins changes in nessus-plugins
Changes by Renaud Deraison <deraison@nessus.org> :
- Minor fixes
- Format string bug fixed in protocol.c
smtp, pop3 and nntp in client mode were affected.
(stunnel clients could be attacked by malicious servers)
- Certificate chain can be supplied with -p option or in stunnel.pem.
- Problem with -r and -l options used together fixed.
- memmove() instead of memcpy() is used to move data in buffers.
- More detailed information about negotiated ciphers is printed.
- New ./configure options: "--enable-no-rsa" and "--enable-dh".
Mirrordir is a suite of functions in one package. It contains the
following programs:
* pslogin: A remote login utility and daemon that provides a secure
shell. This can be considered as a GPL replacement to Ssh.
* copydir: A cp equivalent which additionally copies to and from ftp
servers. Use it to upload and download via ftp and via mirrordir's
secure daemon. Use it as a rigorous cp to correctly reproduce
hardlinks, permissions and access times.
* mirrordir: Mirrors filesystems over ftp or locally via a minimal
set of changes. It is optimised for locally mirroring a device as
an alternative to RAID devices. It duplicates file-systems in every
detail, even correctly recreating hardlinks, devices and access
times. It works well mirroring ftp sites that don't support ls-lR
summaries. Mirrordir can take a C script to customise the kind of
files to mirror based on their stat info, name, or other
information.
* recursdir: Pass a C script to recursdir to recursively perform
operations on files. This is a fast and overkill equivalent of find.
Taken from a suggestion by Jeff Sheinberg.
version 4.14.0 are:
- Support for ACE (WinACE) Archiver
- Support for additional packers: PKLITE32, ELiTeWrap, Joiner, PEBundle,
PEBundle Write-To-Disk, and tElock.
- Support for newer versions of packers: Petite, ASPack, UPX, NeoLite,
and PECompact.
- Support for BZIP compression format
- Support for additional LHA compression formats, LH6 and LH7
- Support for zcompress compression format
- Support for PDF 5.0 files
- Improved scanning for MIME formats
- Support for Unicode and Unicode big-endian saved scripts
- Support for Compiled Help files
- Support for Microsoft Exchange internal data-transfer format
- Support for Internet Message Connector (IMC) Archive format.
- Support for uncompressed VBA in Visio files
- Improved heuristic analysis for 32-bit Windows applications
- Support for compressed RTF and HTML in Microsoft Outlook messages
- Support for Script Component Type Libraries
- Improved performance when scanning Windows 32 applications
general INSTALL scripts and checking in the update_dat script that the
place to fetch the DAT files ends in a '/'. Changes include checking for
even more Internet worms (includes goner).
Changes :
- Patches for foreign program compatibility, initialization vectors
and padding methods from Jody Biggs <jody.biggs@paymybills.com>
- Removed debugging code
- Used Digest-MD5
Makefiles during the build process by touching various auto{conf,make}
source files to make them up-to-date. Packages that require regenerating
the configure script and Makefile.in files should make the appropriate
calls to auto{conf,make} in a pre-configure target. This allows the
various targets listed in ${_CONFIG_PREREQ} to modify the generated files
without triggering the GNU auto* tools and having the modifications be
overwritten.
* Disabled scard-install (patch/patch-ah -- Do we need/want it?)
Changes since 2.9.9.2:
- Don't allow authorized_keys specified environment variables when
UseLogin in active
- Fix IPv4 default in ssh-keyscan
- Fix early (and double) free of remote user when using Kerberos
- fix krb5 authorization check
- enable authorized_keys2 again
- ignore SIGPIPE early, makes ssh work if agent dies, netbsd-pr via itojun@
- make ~& (backgrounding) work again for proto v1; add support ~& for v2, too
- pad using the padding field from the ssh2 packet instead of sending
extra ignore messages
- missing free and sync dss/rsa code
- crank c->path to 256 so they can hold a full hostname
- cleanup libwrap support
- Fix fd leak in loginrec.c
- avoid possible FD_ISSET overflow for channels established
during channnel_after_select()
- chdir $HOME after krb_afslog()
- stat subsystem command before calling do_exec
- close all channels if the connection to the remote host has been closed,
should fix sshd's hanging with WCHAN==wait
- add NoHostAuthenticationForLocalhost; note that the hostkey is
now check for localhost, too
- loginrec.c: fix type conversion problems exposed when using 64-bit off_t
- Update spec files for new x11-askpass
HMAC is used for message integrity checks between two parties that
share a secret key, and works in combination with some other Digest
algorithm, usually MD5 or SHA-1. The HMAC mechanism is described in
RFC 2104.
pkgsrc. Instead, a new variable PKGREVISION is invented that can get
bumped independent of DISTNAME and PKGNAME.
Example #1:
DISTNAME= foo-X.Y
PKGREVISION= Z
=> PKGNAME= foo-X.YnbZ
Example #2:
DISTNAME= barthing-X.Y
PKGNAME= bar-X.Y
PKGREVISION= Z
=> PKGNAME= bar=X.YnbZ (!)
On subsequent changes, only PKGREVISION needs to be bumped, no more risk
of getting DISTNAME changed accidentally.
1.09 20.8.2001,
- fixed Makefile.PL (computation of bin_path) and test.pl ($perl
use before defined) per Gordon Lack <gml4410@ggr.co.uk>
11.9.2001,
- Patch by Jeremy Mates <jmates@mbt.washington.edu> to make Handle.pm
more acceptable for older perls
25.9.2001,
- systematically implemented many of the newer functions of
openssl API (per popular request and for completeness)
This value may be customized in various ways:
PKG_SYSCONFBASE is the main config directory under which all package
configuration files are to be found.
PKG_SYSCONFSUBDIR is the subdirectory of PKG_SYSCONFBASE under which the
configuration files for a particular package may be found.
PKG_SYSCONFDIR.${PKGBASE} overrides the value of ${PKG_SYSCONFDIR} for a
particular package.
Users will typically want to set PKG_SYSCONFBASE to /etc, or accept the
default location of ${PREFIX}/etc.
This obsoletes the use of CONFDIR, which was active for only 6 days, so no
need to have a workaround to still accept old CONFDIR settings.
Changes since 2.06:
- changed keysize back to 0 apparently setting keysize to 8 triggered a bad
hack in Crypt::CBC which resulted in OpenSRS breaking.
the "bad hack" in question is:
$ks = $cipher =~ /blowfish/i ? 56 : 8 unless $ks > 0;
... anyway.. fixed.
- added two new functions: min_keysize and max_keysize
these allow modules like Crypt::CBC_IL and Crypt::CBC_R
to use variable key lengths with CBC modes.
- cleaned up test.pl
- updated README
- minor change in XS
- additions to reported platforms
Remove package version number from DESCR.
Changelog for version 3.21c, 2001.11.11, urgency: LOW:
* autoconf scripts upgraded to version 2.52.
* Problem with pthread_sigmask on Darwin fixed (I hope).
* Some documentation typos corrected.
* Attempt to ignore EINTR in transfer().
* Shared library version reported on startup.
* DLLs for OpenSSL 0.9.6b.
* Use procmail's lockfile to serialize the execution of critical parts of
keychain, thus avoiding multiple ssh-agent processes being started if
you happen to have multiple xterms open automatically when you log in.
Keychain will now auto-detect whether lockfile is installed; if it is,
keychain will automatically use it
* No longer "kill -9" our ssh-agent processes
* Added argument "--quiet | -q"
* Added "-h" as alias for "--help", added "-k" as alias for "--stop"
* Add /usr/ucb to path for Solaris systems
* Try to add multiple keys using ssh-add; avoid typing in identical
passphrases more than once.
* Misc. compatibility, signal handling, cleanup fixes
* We now use .ssh-agent-[hostname] instead of .ssh-agent
* "source" to "." shell-compatibility fixes.
* "rm -f $pidf" after stopping ssh-agent fix
* Problem with errno and posix threads fixed.
* It is assumed that system has getopt() if it has getopt.h header file.
* SSL_CLIENT_DN and SSL_CLIENT_I_DN environment variables set in local mode
(-l) process. This feature doesn't work if
client mode (-c) or protocol negotiation (-n) is used.
* Winsock error descriptions hardcoded (English version only).
* SetConsoleCtrlHandler() used to handle CTRL+C, logoff and shutdown on Win32.
* Stunnel always requests peer certificate with -v 0.
* sysconf()/getrlimit() used to calculate number of clients allowed.
* SSL mode changed for OpenSSL >= 0.9.6.
* close-on-exec option used to avoid socket inheriting.
* Buffer size increased from 8KB to 16KB.
* fdscanf()/fdprintf() changes:
- non-blocking socket support,
- timeout after 1 minute of inactivity.
* auth_user() redesigned to force 1 minute timeout.
* Some source arrangement towards 4.x architecture.
* No need for "goto" any more.
* New Makefile "test" rule. It performs basic test of
standalone/inetd, remote/local and server/client mode.
* pop3 server mode support added.
the main virus scanning script has been rewritten in perl, replacing
the original shell script.
The currently supported MTAs are exim, qmail, postfix, and sendmail.
Please refer to the corresponding README.mta file for further
documentation.
The automatic truncation in gensolpkg doesn't work for packages which
have the same package name for the first 5-6 chars.
e.g. amanda-server and amanda-client would be named amanda and amanda.
Now, we add a SVR4_PKGNAME and use amacl for amanda-client and amase for
amanda-server.
All svr4 packages also have a vendor tag, so we have to reserve some chars
for this tag, which is normaly 3 or 4 chars. Thats why we can only use 6
or 5 chars for SVR4_PKGNAME. I used 5 for all the packages, to give the
vendor tag enough room.
All p5-* packages and a few other packages have now a SVR4_PKGNAME.
from version 4.0.5 include moving from the www category, and:
- Fixed bug in the mcrypt extension that caused segfaults when using a key
that is too large for the used algorithm, and a bug that caused
mcrypt_generic() to segfault PHP (Derick)
- Bug fixes
- MD4 and MD5 now compile on big endian machines
- TIGER now compiles on big endian machines.
- Corrected Tiger implementation
- Added MD4, TIGER128 and TIGER160
- added mhash_hmac_end_m() and mhash_end_m() functions which allow to specify
the malloc function.
- added mhash_cp() - Copy a context
- added mhash_get_mhash_algo() - Returns the name of the algorithm of the
context
- Bug fixes and memory leaks
- Added new modes: nCFG
- Due to an endianness handling problem Blowfish algorithm was not compatible
with other implementations. Now it has been corrected. If you want
to access the old algorithm used use the "blowfish-compat" module.
- Corrected bug in rijndael-256. This makes the algorithm incompatible with
previous versions.
foo-* to foo-[0-9]*. This is to cause the dependencies to match only the
packages whose base package name is "foo", and not those named "foo-bar".
A concrete example is p5-Net-* matching p5-Net-DNS as well as p5-Net. Also
change dependency examples in Packages.txt to reflect this.
fixes to the update script:
- correctly parse the new readme.txt files
- be verbose only if -v option is given (for cron-lovers)
- optional parameter to specify an alternate download location
IO::Socket::SSL is a class implementing an object-oriented interface to
SSL sockets. The class is a descendent of IO::Socket::INET and provides a
subset of the base class's interface methods as well as SSL-specific methods.
Provided in pkg/14036 by Sen Nagata <sen@eccosys.com>.
Net::SSLeay.pm is a perl module that allows you to call Secure Sockets
Layer (SSL) functions of the SSLeay library directly from your perl
scripts. It is useful if you want to program robots that access secure web
servers or if you want to build your own applications over SSL encrypted
tunnels.
Provided in pkg/14035 by Sen Nagata <sen@eccosys.com>.
