summaryrefslogtreecommitdiff
path: root/security/lsh
AgeCommit message (Collapse)AuthorFilesLines
2005-05-22Remove USE_GNU_TOOLS and replace with the correct USE_TOOLS definitions:jlam1-2/+2
USE_GNU_TOOLS -> USE_TOOLS awk -> gawk m4 -> gm4 make -> gmake sed -> gsed yacc -> bison
2005-04-30Move the freshly update lsh-2.0.1 into a separate pkg and leavedrochner4-50/+30
security/lsh at 1.4.3. lsh-2.0.1 has interoperability problems with openssh servers (always gets "Invalid server signature" errors). lsh-1.4.3 is not affected by CAN-2003-0826. Add a patch to address CAN-2005-0814 and bump PKGREVISION.
2005-04-28Update to 2.0.1:wiz3-16/+50
News for the 2.0.1 release Fixed denial of service bug in lshd. Fixed a bug in lsh-make-seed, which could make the program go into an infinite loop on read errors. lsh now asks for passwords also in quite (-q) mode, as described in the manual. Control character filtering used to sometimes consider newline as a dangerous control character. Now newlines should be displayed normally. Removed support for the non-standard alias "diffie-hellman-group2-sha1". The standardized name is for this key exchange method is "diffie-hellman-group14-sha1". News for the 2.0 release Several programs have new default behaviour: * lshd enables X11 forwarding by default (lsh still does not). * lsh-keygen generates RSA rather than DSA keys by default. * lsh-writekey encrypts the private key by default, using aes256-cbc. Unless the --server flag is used. Improved the lcp script. It is now installed by default. Implemented the client side of "keyboard-interactive" user authentication. Support keyexchange with diffie-hellman-group14-sha1/diffie-hellman-group2-sha1 (the standardized name is at the moment not decided). Fixes to the utf8 encoder, and in particular interactions between utf8 and control character filtering. News for the 1.5.5 release Added SOCKS-style proxying to lsh and lshg. See the new -D command line option. Supports both SOCKS-4 and SOCKS-5. The lsh client no longer sets its stdio file descriptors into non-blocking mode, which should avoid a bunch of problems. As a consequence, the --cvs-workaround command line option has been deleted. In the user lookup code, lshd now ignores the shadow database if getspnam returns NULL. In the server pty setup code, use the group "system" as a fallback if the group "tty" doesn't exist. This is the case on AIX. (There are however more problems on AIX, which makes it uncertain that lshd will work out of the box). Deleted the --ssh1-fallback option for lshd. I hope ssh1 is dead by now; if it isn't, you have to run ssh1d and lshd on different ports. Deleted code for bug-compatibility with ancient versions of Datafellow's SSH2. There are zero bug-compatibility hacks in this version. News for the 1.5.4 release Added logging of tcpip-forward requests. Includes nettle-1.9, which have had some portability fixes and optimizations. In particular, arcfour on x86 should be much faster. Implemented flow control on the raw ssh connection. Enforce limits on the amount of buffered data waiting to be written to the socket. Moved all destructive string operations to a separate file lsh_string.c, which has exclusive rights of accessing string internals. Should make the code more robust, as buffer size and index calculations elsewhere in the code should hit an assert in lsh_string.c before doing damage. Some general simplification and cleanup of the code. News for the 1.5.3 release Fixed heap buffer overrun with potential remote root compromise. Initial bug report by Bennett Todd. Fixed a similar bug in the check for channel number allocation failure in the handling of channel_open, and in the experimental client SRP code. lshd now has an experimental mode similar to telnet, where it accepts the 'none' authentication method and automatically disables services such as X and TCP forwarding. This can be useful in environment where it's required that /bin/login or some other program handle authentication and session setup (e.g. handle security contexts and so on). News for the 1.5.2 release Encrypted private keys works again. New client escape sequence RET ~ ?, which lists all available escape sequences. Also fixed the werror functions so that they use \r\n to terminate lines when writing to a tty in raw mode. Implemented handling of multiple --interface options to lshd. As a side effect, The -p option must now be given before --interface to have any effect. Connecting to machines with multiple IP-adresses is smarter, it connects to a few addresses at a time, in parallel. Fixed a file descriptor leak in the server tcpip forwarding code. Lots of portability fixes. News for the 1.5.1 release Incompatible change to key format, to comply with the current spki structure draft. You can use the script lsh-upgrade to copy and convert the information in the old .lsh/known-hosts to the new file .lsh/host-acls. The new code uses libspki. Fixed IPv6 bug reported by Simon Kowallik. lshd now does the equivalence of ulimit -n unlimited, this is inherited by processes started upon client requests. If you don't want this, you should use /etc/{profile,login,whatever} to set limits for your users. Do note that PAM-based solutions will NOT work as PAM is used from a separate process that terminates as soon as the authentication is finished (this of course goes for environment variables too). lsh and and lshg now parses options from LSHFLAGS and LSHGFLAGS, these are parsed before and can be overridden by the command line. News for the 1.5 release Implemented the server side of X11 forwarding. Try lshd --x11-forward. There's one known bug: The server may start sending data on the session channel (typically your first shell prompt) before it has sent the reply to the client's "shell" or "exec" request. lsh will complain about, and ignore that data. As part of the X11 hacking, the socket code have been reorganized. Deleted one of the ipv6 configure tests. Now lsh will happily build ipv6 support even if ipv6 is not available at run-time on the build machine. Fixed bug preventing -c none from working. Another bug fix, call setsid even in the non-pty case. Various bug fixes.
2005-04-11Remove USE_BUILDLINK3 and NO_BUILDLINK; these are no longer used.tv1-2/+1
2005-02-24Add RMD160 digests.agc1-1/+2
2004-10-03Libtool fix for PR pkg/26633, and other issues. Update libtool to 1.5.10tv1-1/+2
in the process. (More information on tech-pkg.) Bump PKGREVISION and BUILDLINK_DEPENDS of all packages using libtool and installing .la files. Bump PKGREVISION (only) of all packages depending directly on the above via a buildlink3 include.
2004-04-25Convert to buildlink3.snj1-4/+4
2004-02-14USE_GNU_TOOLS should be appended to with +=grant1-2/+2
2004-02-14USE_GMAKE=yes -> USE_GNU_TOOLS=makeuebayasi1-2/+2
2004-01-12add a pkg for lsh-1.4.3, an alternative ssh2 client/serverdrochner6-0/+102