summaryrefslogtreecommitdiff
path: root/security/openssh
AgeCommit message (Collapse)AuthorFilesLines
2007-03-18Update openssh pacakge to 4.6.1.taca5-33/+19
Changes since OpenSSH 4.5: ============================ * sshd now allows the enabling and disabling of authentication methods on a per user, group, host and network basis via the Match directive in sshd_config. * The following bugs have been fixed in this release: - Clear SIGALRM when restarting due to SIGHUP. Prevents stray signal from taking down sshd if a connection was pending at the time SIGHUP was received - sftp returned a zero exit status when upload failed due to write errors (bugzilla #1252) - fixed an inconsistent check for a terminal when displaying scp progress meter (bugzilla #1265) - Parsing of time values in Match blocks was incorrectly applied to the global configuration (bugzilla #1275) - Allow multiple forwarding options to work when specified in a PermitOpen directive (bugzilla #1267) - Interoperate with ssh.com versions that do not support binding remote port forwarding sessions to a hostname (bugzilla #1019) * Portable OpenSSH bugs fixed: - "hang on exit" when background processes are running at the time of exit on a ttyful/login session (bugzilla #52) - Fix typos in the ssh-rand-helper(8) man page (bugzilla #1259) - Check that some SIG records have been returned in getrrsetbyname (bugzilla #1281) - Fix contrib/findssl for platforms that lack "which" (bugzilla #1237) - Work around bug in OpenSSL 0.9.8e that broke aes256-ctr, aes192-ctr, arcfour256 (bugzilla #1291)
2007-03-16Bring in patch suggested in http://bugzilla.mindrot.org/show_bug.cgi?id=1299 .cjs3-3/+25
This fixes the issue that, when "options edns0" is turned on (usually in /etc/resolv.conf), ssh doesn't see it, and thus fails to request a DNSSEC response, which in turn leads to SSHFP records being considered insecure.
2007-02-22Whitespace cleanup, courtesy of pkglint.wiz2-4/+4
Patch provided by Sergey Svishchev in private mail.
2007-01-27* added a patch to ensure compatibility with IRIX 5 (Changes says it is al-schwarz3-16/+14
ready included with that release of OpenSSH, but in fact it is not) * removed hacks.mk which is no longer necessary with that version of OpenSSH
2007-01-20Update hpn-patch; openssh-4.4p1-hpn12v13 to openssh-4.5p1-hpn12v14.taca3-7/+8
Accurate changes are unknown. Bump PKGREVISION.
2006-11-21Add explicit IOV_MAX for Interix -- openssh tries to use _XOPEN_IOV_MAXtv1-1/+2
in an autoarray, but on Interix that is the same as INT_MAX[!].
2006-11-21regen for patchestv1-2/+2
2006-11-21fix variable name in Interix part of patchtv1-2/+2
2006-11-08Update openssh package to 4.5.1 (openssh-4.5p1).taca4-59/+58
Changes: Security bugs resolved in this release: * Fix a bug in the sshd privilege separation monitor that weakened its verification of successful authentication. This bug is not known to be exploitable in the absence of additional vulnerabilities. This release includes the following non-security fixes: * Several compilation fixes for portable OpenSSH * Fixes to Solaris SMF/process contract support (bugzilla #1255)
2006-11-07Update hpn-patch to hpn12v13 since old one has gone.taca3-8/+8
Bump PKGREVISION.
2006-10-31Update openssh package to 4.4.1 (openssh-4.4p1).taca30-359/+218
- A few pkglint warning clean up. - Major changes are here. For complete changes, see http://www.openssh.com/txt/release-4.4. Changes since OpenSSH 4.3: ============================ Security bugs resolved in this release: * Fix a pre-authentication denial of service found by Tavis Ormandy, that would cause sshd(8) to spin until the login grace time expired. * Fix an unsafe signal hander reported by Mark Dowd. The signal handler was vulnerable to a race condition that could be exploited to perform a pre-authentication denial of service. On portable OpenSSH, this vulnerability could theoretically lead to pre-authentication remote code execution if GSSAPI authentication is enabled, but the likelihood of successful exploitation appears remote. * On portable OpenSSH, fix a GSSAPI authentication abort that could be used to determine the validity of usernames on some platforms. This release includes the following new functionality and fixes: * Implemented conditional configuration in sshd_config(5) using the "Match" directive. This allows some configuration options to be selectively overridden if specific criteria (based on user, group, hostname and/or address) are met. So far a useful subset of post- authentication options are supported and more are expected to be added in future releases. * Add support for Diffie-Hellman group exchange key agreement with a final hash of SHA256. * Added a "ForceCommand" directive to sshd_config(5). Similar to the command="..." option accepted in ~/.ssh/authorized_keys, this forces the execution of the specified command regardless of what the user requested. This is very useful in conjunction with the new "Match" option. * Add a "PermitOpen" directive to sshd_config(5). This mirrors the permitopen="..." authorized_keys option, allowing fine-grained control over the port-forwardings that a user is allowed to establish. * Add optional logging of transactions to sftp-server(8). * ssh(1) will now record port numbers for hosts stored in ~/.ssh/authorized_keys when a non-standard port has been requested. * Add an "ExitOnForwardFailure" option to cause ssh(1) to exit (with a non-zero exit code) when requested port forwardings could not be established. * Extend sshd_config(5) "SubSystem" declarations to allow the specification of command-line arguments. * Replacement of all integer overflow susceptible invocations of malloc(3) and realloc(3) with overflow-checking equivalents. * Many manpage fixes and improvements * New portable OpenSSH-specific features: - Add optional support for SELinux, controlled using the --with-selinux configure option (experimental) - Add optional support for Solaris process contracts, enabled using the --with-solaris-contracts configure option (experimental) This option will also include SMF metadata in Solaris packages built using the "make package" target - Add optional support for OpenSSL hardware accelerators (engines), enabled using the --with-ssl-engine configure option.
2006-09-28Update to openssh-4.3.2 (OpenSSH 4.3p2). I missed existence of PR/32858taca2-8/+8
at previous commit. Note: OpenSSH 4.4p1 has already released, there is no hpn-patch patch yet, so I don't update to it while pkgsrc-freeze is in effect. 20060211 - (dtucker) [README] Bump release notes URL. - (djm) Release 4.3p2 20060208 - (tim) [session.c] Logout records were not updated on systems with post auth privsep disabled due to bug 1086 changes. Analysis and patch by vinschen at redhat.com. OK tim@, dtucker@. - (dtucker) [configure.ac] Typo in Ultrix and NewsOS sections (NEED_SETPRGP -> NEED_SETPGRP), reported by Berhard Simon. ok tim@ 20060206 - (tim) [configure.ac] Remove unnecessary tests for net/if.h and netinet/in_systm.h. OK dtucker@. 20060205 - (tim) [configure.ac] Add AC_REVISION. Add sys/time.h to lastlog.h test for Solaris. OK dtucker@. - (tim) [configure.ac] Bug #1149. Changes in QNX section only. Patch by kraai at ftbfs.org. 20060203 - (tim) [configure.ac] test for egrep (AC_PROG_EGREP) before first AC_CHECK_HEADERS test. Without it, if AC_CHECK_HEADERS is first run by a platform specific check, builtin standard includes tests will be skipped on the other platforms. Analysis and suggestion by vinschen at redhat.com, patch by dtucker@. OK tim@, djm@. 20060202 - (dtucker) [configure.ac] Bug #1148: Fix "crippled AES" test so that it works with picky compilers. Patch from alex.kiernan at thus.net.
2006-09-27Add patches to fix the problem reported by Secunia Advisory SA22091 (alsotaca5-5/+167
CVS-2006-4924); "OpenSSH Identical Blocks Denial of Service Vulnerability" referring to OpenBSD's CVS repository. Bump PKGREVISION.
2006-06-04Remove OPENSSH_GID and OPENSSH_UID, it happened to work before,joerg1-3/+1
since those are the values in NetBSD. In reality, they haven't been used for ages though.
2006-05-14added a hack that works around a bug (variable name conflict) in OpenSSHschwarz1-0/+15
3.4p1 and 3.4p2 that shows up on IRIX 5.
2006-05-09PKG_GROUPS should now only contain the group name because group IDs arejlam1-2/+2
specified with PKG_GID.<group>.
2006-04-23Modify packages that set PKG_USERS and PKG_GROUPS to follow the newjlam1-2/+7
syntax as specified in pkgsrc/mk/install/bsd.pkginstall.mk:1.47.
2006-03-14Modify the pkginstall framework so that it manages all aspects ofjlam1-3/+1
INSTALL/DEINSTALL script creation within pkgsrc. If an INSTALL or DEINSTALL script is found in the package directory, it is automatically used as a template for the pkginstall-generated scripts. If instead, they should be used simply as the full scripts, then the package Makefile should set INSTALL_SRC or DEINSTALL_SRC explicitly, e.g.: INSTALL_SRC= ${PKGDIR}/INSTALL DEINSTALL_SRC= # emtpy As part of the restructuring of the pkginstall framework internals, we now *always* generate temporary INSTALL or DEINSTALL scripts. By comparing these temporary scripts with minimal INSTALL/DEINSTALL scripts formed from only the base templates, we determine whether or not the INSTALL/DEINSTALL scripts are actually needed by the package (see the generate-install-scripts target in bsd.pkginstall.mk). In addition, more variables in the framework have been made private. The *_EXTRA_TMPL variables have been renamed to *_TEMPLATE, which are more sensible names given the very few exported variables in this framework. The only public variables relating to the templates are: INSTALL_SRC INSTALL_TEMPLATE DEINSTALL_SRC DEINSTALL_TEMPLATE HEADER_TEMPLATE The packages in pkgsrc have been modified to reflect the changes in the pkginstall framework.
2006-03-04Point MAINTAINER to pkgsrc-users@NetBSD.org in the case where nojlam1-2/+2
developer is officially maintaining the package. The rationale for changing this from "tech-pkg" to "pkgsrc-users" is that it implies that any user can try to maintain the package (by submitting patches to the mailing list). Since the folks most likely to care about the package are the folks that want to use it or are already using it, this would leverage the energy of users who aren't developers.
2006-02-23Fix build on DragonFly.joerg2-1/+18
2006-02-12Update to version 3.4p1salo14-109/+115
From Jason White via PR pkg/32780 Changes: Security bugs resolved in this release: * CVE-2006-0225: scp (as does rcp, on which it is based) invoked a subshell to perform local to local, and remote to remote copy operations. This subshell exposed filenames to shell expansion twice; allowing a local attacker to create filenames containing shell metacharacters that, if matched by a wildcard, could lead to execution of attacker-specified commands with the privilege of the user running scp (Bugzilla #1094) This is primarily a bug-fix release, only one new feature has been added: * Add support for tunneling arbitrary network packets over a connection between an OpenSSH client and server via tun(4) virtual network interfaces. This allows the use of OpenSSH (4.3+) to create a true VPN between the client and server providing real network connectivity at layer 2 or 3. This feature is experimental and is currently supported on OpenBSD, Linux, NetBSD (IPv4 only) and FreeBSD. Other operating systems with tun/tap interface capability may be added in future portable OpenSSH releases. Please refer to the README.tun file in the source distribution for further details and usage examples. Some of the other bugs resolved and internal improvements are: * Reduce default key length for new DSA keys generated by ssh-keygen back to 1024 bits. DSA is not specified for longer lengths and does not fully benefit from simply making keys longer. As per FIPS 186-2 Change Notice 1, ssh-keygen will refuse to generate a new DSA key smaller or larger than 1024 bits * Fixed X forwarding failing to start when a the X11 client is executed in background at the time of session exit (Bugzilla #1086) * Change ssh-keygen to generate a protocol 2 RSA key when invoked without arguments (Bugzilla #1064) * Fix timing variance for valid vs. invalid accounts when attempting Kerberos authentication (Bugzilla #975) * Ensure that ssh always returns code 255 on internal error (Bugzilla #1137) * Cleanup wtmp files on SIGTERM when not using privsep (Bugzilla #1029) * Set SO_REUSEADDR on X11 listeners to avoid problems caused by lingering sockets from previous session (X11 applications can sometimes not connect to 127.0.0.1:60xx) (Bugzilla #1076) * Ensure that fds 0, 1 and 2 are always attached in all programs, by duping /dev/null to them if necessary. * Xauth list invocation had bogus "." argument (Bugzilla #1082) * Remove internal assumptions on key exchange hash algorithm and output length, preparing OpenSSH for KEX methods with alternate hashes. * Ignore junk sent by a server before it sends the "SSH-" banner (Bugzilla #1067) * The manpages has been significantly improves and rearranged, in addition to other specific manpage fixes: #1037 - Man page entries for -L and -R should mention -g. #1077 - Descriptions for "ssh -D" and DynamicForward should mention they can specify "bind_address" optionally. #1088 - Incorrect descriptions in ssh_config man page for ControlMaster=no. #1121 - Several corrections for ssh_agent manpages * Lots of cleanups, including fixes to memory leaks on error paths (Bugzilla #1109, #1110, #1111 and more) and possible crashes (#1092) * Portable OpenSSH-specific fixes: - Pass random seed during re-exec for each connection: speeds up processing of new connections on platforms using the OpenSSH's builtin entropy collector (ssh-rand-helper) - PAM fixes and improvements: #1045 - Missing option for ignoring the /etc/nologin file #1087 - Show PAM password expiry message from LDAP on login #1028 - Forward final non-query conversations to client #1126 - Prevent user from being forced to change an expired password repeatedly on AIX in some PAM configurations. #1045 - Do not check /etc/nologin when PAM is enabled, instead allow PAM to handle it. Note that on platforms using PAM, the pam_nologin module should be used in sshd's session stack in order to maintain past behaviour - Portability-related fixes: #989 - Fix multiplexing regress test on Solaris #1097 - Cross-compile fixes. #1096 - ssh-keygen broken on HPUX. #1098 - $MAIL being set incorrectly for HPUX server login. #1104 - Compile error on Tru64 Unix 4.0f #1106 - Updated .spec file and startup for SuSE. #1122 - Use _GNU_SOURCE define in favor of __USE_GNU, fixing compilation problems on glibc 2.4
2005-12-29Remove USE_PKGINSTALL from pkgsrc now that mk/install/pkginstall.mkjlam1-2/+1
automatically detects whether we want the pkginstall machinery to be used by the package Makefile.
2005-12-05Ran "pkglint --autofix", which corrected some of the quoting issues inrillig2-8/+8
CONFIGURE_ARGS.
2005-12-05Fixed pkglint warnings. The warnings are mostly quoting issues, forrillig1-5/+4
example MAKE_ENV+=FOO=${BAR} is changed to MAKE_ENV+=FOO=${BAR:Q}. Some other changes are outlined in http://mail-index.netbsd.org/tech-pkg/2005/12/02/0034.html
2005-11-14stop openssh from complaining about zlib version numbers, as pkgsrcgrant1-1/+5
already enforces a "secure" version of zlib via dependencies.
2005-11-07Skip two more setgroups(3) instances on Interix; openssh now builds again.tv2-9/+23
2005-11-07Fix typo in Interix-specific bit.tv2-4/+4
2005-11-07Revive hpn-patch distfile.taca1-1/+4
2005-11-04Change the __dead patches into the form I'm submitting back to thetv3-14/+14
openssh-portable team (elide the extra cpp macro level).
2005-11-04SETGROUPS_NOOP disappeared, so we're relying only on HAVE_INTERIX in thosetv3-39/+40
specific cases.
2005-11-04regentv1-5/+3
2005-11-04Add more Interix fixes: Need prototype for strtoll(), and two moretv2-6/+44
instances of setgroups() that are not usable on that platform.
2005-10-07Remove CONFIGURE_ARGS for --mandir as this is now donereed1-2/+1
for GNU_CONFIGURE.
2005-09-24Add back openssh-4.2p1-hpn11.diff entries that were removedreed1-1/+4
in revision 1.42.
2005-09-23The checksum of patch-aa has changed, too.rillig1-2/+2
2005-09-23Be quiet pkglint:taca4-7/+8
- Remove trailing white space from Makefile. - Add NetBSD Id to patch-aa and patch-ah.
2005-09-21Update openssh to 4.2p1. This is from PR #31331. Thank you, Jason.reed22-194/+202
Some changes different from patches provided in that PR are: - patch-aj, patch-aq, and patch-as not changed (they appeared to be identical to previous patches) - DragonFly support also added to configure script (patch-aa) because compilation failed due to missing crypt - and install-sysconf target removed from the installation target in Makefile.in (patch-ah). Just let the pkgsrc framework install this since it now will allow it to be removed correctly on deinstall. - use "pam" instead of "PAM" as option name in the post-install target. This removes patch-ai. This also now uses openssh-4.2p1-hpn11.diff patch. I didn't test with kerberos and hpn-patch options. I did test with PAM on Linux. (The PR reported that kerberos and hpn-patch options were tested for compiling.) I tested on NetBSD 2.0.2, Linux, and DragonFly. This includes two security fixes and several bug fixes and many improvemens. The changes are listed at http://www.mindrot.org/pipermail/openssh-unix-announce/2005-September/000083.html http://www.mindrot.org/pipermail/openssh-unix-announce/2005-May/000079.html TODO: get some of these patches committed upstream.
2005-08-23The real user name in PKG_USERS does not need to be escaped with doublerillig1-2/+2
backslashes anymore. A single backslash is enough. Changed the definition in all affected packages. For those that are not caught, an additional check is placed into bsd.pkginstall.mk.
2005-08-19Merge CONF_FILES/SUPPORT_FILES and CONF_FILES_PERMS/SUPPORT_FILES_PERMSjlam1-8/+3
as the INSTALL and DEINSTALL scripts no longer distinguish between the two types of files. Drop SUPPORT_FILES{,_PERMS} and modify the packages in pkgsrc accordingly.
2005-07-28MESSAGE file removed. As mentioned on tech-pkg in May, /etc/ssh.confreed3-25/+5
and /etc/sshd.conf is old (and I assume some configurations from there don't apply any more), user and group are not created automatically (only if PKG_CREATE_USERGROUP is at default YES), UsePrivilegeSeparation is the default, and seems to imply that openssh is insecure without it. Bump PKGREVISION. Change comment regarding MESSAGE.Interix. Removed unused MESSAGE_SUBST settings. Move one to the options.mk as it is for "pam" only.
2005-07-28My fix from eight days ago was broken. Add the "man" subdirectoryreed1-14/+14
for the man entries.
2005-07-20Remove MANDIR variable and just use "man" instead.reed2-19/+16
2005-07-16Get rid of USE_PERL5. The new way to express needing the Perl executablejlam1-2/+2
around at either build-time or at run-time is: USE_TOOLS+= perl # build-time USE_TOOLS+= perl:run # run-time Also remove some places where perl5/buildlink3.mk was being included by a package Makefile, but all that the package wanted was the Perl executable.
2005-05-31Rename option PAM to pam (so all options are lower case). Backwardsdillo1-3/+3
compatibility provided via PKG_OPTIONS_LEGACY_OPTS.
2005-05-25Fix typo introduced on August 4 that stopped wtmp logging under Linuxreed3-6/+6
and maybe other platforms. Bump PKGREVISION.
2005-05-25Noticed that the PAM +DISPLAY message was not displayedreed1-5/+5
and extra pam file was not included in +CONTENTS. So moved the include of options.mk to after the PLIST_SRC and MESSAGE_SRC are defined as empty. (MESSAGE_SRC is redefined if Interix and if PAM PKG_OPTION was enabled then this still needs to be fixed.)
2005-05-02RCD_SCRIPTS_EXAMPLEDIR is no longer customizable.reed1-1/+2
And always is defined as share/examples/rc.d which was the default before. This rc.d scripts are not automatically added to PLISTs now also. So add to each corresponding PLIST as required. This was discussed on tech-pkg in late January and late April. Todo: remove the RCD_SCRIPTS_EXAMPLEDIR uses in MESSAGES and elsewhere and remove the RCD_SCRIPTS_EXAMPLEDIR itself.
2005-04-28Add CONFLICTS with lsh (common man page).wiz1-1/+2
2005-04-11Remove USE_BUILDLINK3 and NO_BUILDLINK; these are no longer used.tv1-2/+1
2005-03-07nb5: Rework Interix support, based on work done by Interop Systemstv24-337/+613
*before* a BSD-with-advertising license was added to their diffs, and other work done personally by me. sshd now works. Most permissions checks work properly. Privsep is off by default, and the sshd user is not created, on Interix until some problems with privsep are fixed (perhaps by abstracting the auth functionality out to openpam).
generated by cgit v1.2.3 (git 2.39.1) at 2024-06-20 12:16:28 +0000