summaryrefslogtreecommitdiff
path: root/security/openssh
AgeCommit message (Collapse)AuthorFilesLines
2002-09-24Complete standardization of messages according to latest pkglint.wiz2-7/+8
2002-09-20Make these scripts more portable by taking advantage of automatic rc.dgrant1-2/+2
script handling and using @RCD_SCRIPTS_SHELL@. as discussed with jlam.
2002-09-19Take advantage of the auto-generation and installation of rc.d scripts.jlam1-5/+1
2002-09-18When using bsd.pkg.install.mk, if a DEINSTALL or INSTALL file alreadyjlam1-2/+1
exists, then use it as the default value of DEINSTALL_EXTRA_TMPL or INSTALL_EXTRA_TMPL.
2002-09-09Fix IPv6 detection on Darwin. Patch supplied by itojun in private e-mail.jlam3-17/+85
2002-08-31Add variables for openssh privilege separation to bsd.pkg.defaults.mk:grant2-15/+13
OPENSSH_USER OPENSSH_UID OPENSSH_GROUP OPENSSH_GID OPENSSH_CHROOT Use these to automatically create user/group if they do not already exist. Assists platforms which do not have an 'sshd' user by default, while adding flexibility for NetBSD systems. Checked by Stoned Elipot <seb@netbsd.org>.
2002-08-30ssh-rand-helper is also installed when /dev/urandom does not exist.grant1-1/+2
Checked by Stoned Elipot <seb@netbsd.org>.
2002-08-28Support building with S/Key support on Darwin, and move the check forjlam4-54/+142
libcrypt-before-libcrypto into a section that is protected by something we can set in the configure script (check_for_libcrypt_before). This should fix the latter part of pkg/18091 by grant beattie.
2002-08-28We actually use the openssl buildlink2.mk file.jlam1-2/+2
2002-08-28It's 0.9.6f, not 0.9.5f, and move things around so that IGNORE is set tojlam1-12/+13
the proper message.
2002-08-23Remove Solaris specific SSH_PID_DIR, as Solaris 8/9 do indeed have agrant1-6/+1
/var/run directory, tmpfs is mounted on /var/run by default. /var/run does not exist by default on Solaris 7, but some daemons appear to make use of it after it is created (eg. syslogd).
2002-08-20openssl/buildlink.mk enforces OpenSSL>=0.9.5f due to the DoS fix. Do not botherabs1-4/+6
trying to ask for 0.9.5a as we will not be allowed to use it anyway.
2002-08-19Fix test for rc.d in configure script, so that this works on 1.4.x.wiz1-2/+2
Gleaned from apache's startup script.
2002-08-01Comment out master sites because the file on "ftp.openbsd.org" andtron1-4/+4
possibly on its mirrors is obviously infected with a trojan. The file on "ftp.netbsd.org" is safe.
2002-07-26Add skey support on Solaris.grant1-1/+6
2002-07-24Change explicit build dependencies on perl into "USE_PERL5=build". Thisjlam1-2/+2
makes these packages build correctly on Darwin where perl>=5.8.0 is required.
2002-06-29minor formatting fix.grant1-4/+4
2002-06-28IGNORE platforms that aren't noted to have an in-tree OpenSSH. For now,jlam1-1/+3
this means only NetBSD-1.5.* and NetBSD-1.6* can do this update.
2002-06-28No need to substitute for @PREFIX@, as ${PKG_PREFIX} already has thatjlam1-2/+2
value.
2002-06-28Only allow an in-tree update to occur if OpenSSL>=0.9.5a is in the basejlam2-6/+14
distribution. This prevents surprises like "hey, why is /usr/sbin/sshd broken" if a pkgsrc openssl is pkg_delete'd. Idea by itojun.
2002-06-28Add ability to update the in-tree OpenSSH directly from pkgsrc. Thisjlam3-19/+70
installs the binaries directly in /usr and places the manpages and example files in the correct hier(7) locations. We don't register installation in this case because the package database can't handle it. We deal with the ssh config files and directories as follows: NetBSD-1.5.* use /etc/ssh_config, /etc/sshd_config NetBSD-1.6 use /etc/ssh/ssh_config, /etc/ssh/sshd_config We also emit a warning in the MESSAGE file that /etc/ssh.conf and /etc/sshd.conf should be renamed in order to keep using them. Lastly, there is a new target "tarball" to generate a tarball of the installed files that might be used to install quickly on many machines, though it may be only of limited utility. These changes are only active if UPDATE_INTREE_OPENSSH is defined.
2002-06-28Warn about what to do if you have /etc/ssh.conf and /etc/sshd.conf.jlam1-2/+7
2002-06-28Add PKG_SYSCONFDIR to BUILD_DEFS.seb1-2/+1
Note: it was already as part of CONFIGURE_ENV value, this change only makes it more "readable" IMHO. Remove explicit addition of PKG_SYSCONFDIR to BUILD_DEFS in a couple of Makefiles.
2002-06-28s/${PKG_SYSCONFDIR}/@PKG_SYSCONFDIR@/grant1-3/+3
2002-06-27backout 1.77 with comment, to get working blowfish support. pkg/17405.itojun1-2/+3
2002-06-27use ${CAT} not @CAT@, as it is set by pkgsrc/mk/install/header.itojun1-2/+2
From: Stoned Elipot <seb@script.jussieu.fr>
2002-06-27use @PREFIX@ and @CAT. From: Stoned Elipot <seb@script.jussieu.fr>itojun1-3/+3
2002-06-27add /usr/pkg/etc/ssh to the targetitojun1-2/+2
2002-06-27add POST-INSTALL warning if sshd configuration file is found in agrant3-4/+42
previous configuration directory. format MESSAGE consistently.
2002-06-26upgrade to 3.4p1 (openssh-3.4.0.1).itojun4-51/+6
20020626 - (stevesk) [monitor.c] remove duplicate proto15 dispatch entry for PAM - (bal) OpenBSD CVS Sync - markus@cvs.openbsd.org 2002/06/23 21:34:07 [channels.c] tcode is u_int - markus@cvs.openbsd.org 2002/06/24 13:12:23 [ssh-agent.1] the socket name contains ssh-agent's ppid; via mpech@ from form@ - markus@cvs.openbsd.org 2002/06/24 14:33:27 [channels.c channels.h clientloop.c serverloop.c] move channel counter to u_int - markus@cvs.openbsd.org 2002/06/24 14:55:38 [authfile.c kex.c ssh-agent.c] cat to (void) when output from buffer_get_X is ignored - itojun@cvs.openbsd.org 2002/06/24 15:49:22 [msg.c] printf type pedant - deraadt@cvs.openbsd.org 2002/06/24 17:57:20 [sftp-server.c sshpty.c] explicit (u_int) for uid and gid - markus@cvs.openbsd.org 2002/06/25 16:22:42 [authfd.c] unnecessary cast - markus@cvs.openbsd.org 2002/06/25 18:51:04 [sshd.c] lightweight do_setusercontext after chroot() - (bal) Updated AIX package build. Patch by dtucker@zip.com.au - (tim) [Makefile.in] fix test on installing ssh-rand-helper.8 - (bal) added back in error check for mmap(). I screwed up, Pointed out by stevesk@ - (tim) [README.privsep] UnixWare tip no longer needed. - (bal) fixed NeXTStep missing munmap() issue. It defines HAVE_MMAP, but it all damned lies. - (stevesk) [README.privsep] more for sshd pseudo-account. - (tim) [contrib/caldera/openssh.spec] add support for privsep - (djm) setlogin needs pgid==pid on BSD/OS; from itojun@ - (djm) OpenBSD CVS Sync - markus@cvs.openbsd.org 2002/06/26 08:53:12 [bufaux.c] limit size of BNs to 8KB; ok provos/deraadt - markus@cvs.openbsd.org 2002/06/26 08:54:18 [buffer.c] limit append to 1MB and buffers to 10MB - markus@cvs.openbsd.org 2002/06/26 08:55:02 [channels.c] limit # of channels to 10000 - markus@cvs.openbsd.org 2002/06/26 08:58:26 [session.c] limit # of env vars to 1000; ok deraadt/djm - deraadt@cvs.openbsd.org 2002/06/26 13:20:57 [monitor.c] be careful in mm_zalloc - deraadt@cvs.openbsd.org 2002/06/26 13:49:26 [session.c] disclose less information from environment files; based on input from djm, and dschultz@uclink.Berkeley.EDU - markus@cvs.openbsd.org 2002/06/26 13:55:37 [auth2-chall.c] make sure # of response matches # of queries, fixes int overflow; from ISS - markus@cvs.openbsd.org 2002/06/26 13:56:27 [version.h] 3.4 - (djm) Require krb5 devel for RPM build w/ KrbV - (djm) Improve PAMAuthenticationViaKbdInt text from Nalin Dahyabhai <nalin@redhat.com> - (djm) Update spec files for release - (djm) Fix int overflow in auth2-pam.c, similar to one discovered by ISS - (djm) Release 3.4p1 20020625 - (stevesk) [INSTALL acconfig.h configure.ac defines.h] remove --with-rsh - (stevesk) [README.privsep] minor updates - (djm) Create privsep directory and warn if privsep user is missing during make install - (bal) Started list of PrivSep issues in TODO - (bal) if mmap() is substandard, don't allow compression on server side. Post 'event' we will add more options. - (tim) [contrib/caldera/openssh.spec] Sync with Caldera - (bal) moved aix_usrinfo() and noted not setting real TTY. Patch by dtucker@zip.com.au - (tim) [acconfig.h configure.ac sshd.c] BROKEN_FD_PASSING fix from Markus for Cygwin, Cray, & SCO 20020624 - OpenBSD CVS Sync - deraadt@cvs.openbsd.org 2002/06/23 03:25:50 [tildexpand.c] KNF - deraadt@cvs.openbsd.org 2002/06/23 03:26:19 [cipher.c key.c] KNF - deraadt@cvs.openbsd.org 2002/06/23 03:30:58 [scard.c ssh-dss.c ssh-rsa.c sshconnect.c sshconnect2.c sshd.c sshlogin.c sshpty.c] various KNF and %d for unsigned - deraadt@cvs.openbsd.org 2002/06/23 09:30:14 [sftp-client.c sftp-client.h sftp-common.c sftp-int.c sftp-server.c sftp.c] bunch of u_int vs int stuff - deraadt@cvs.openbsd.org 2002/06/23 09:39:55 [ssh-keygen.c] u_int stuff - deraadt@cvs.openbsd.org 2002/06/23 09:46:51 [bufaux.c servconf.c] minor KNF. things the fingers do while you read - deraadt@cvs.openbsd.org 2002/06/23 10:29:52 [ssh-agent.c sshd.c] some minor KNF and %u - deraadt@cvs.openbsd.org 2002/06/23 20:39:45 [session.c] compression_level is u_int - deraadt@cvs.openbsd.org 2002/06/23 21:06:13 [sshpty.c] KNF - deraadt@cvs.openbsd.org 2002/06/23 21:06:41 [channels.c channels.h session.c session.h] display, screen, row, col, xpixel, ypixel are u_int; markus ok - deraadt@cvs.openbsd.org 2002/06/23 21:10:02 [packet.c] packet_get_int() returns unsigned for reason & seqnr - (bal) Also fixed IPADDR_IN_DISPLAY case where display, screen, row, col, xpixel are u_int. 20020623 - (stevesk) [configure.ac] bug #255 LOGIN_NEEDS_UTMPX for AIX. - (bal) removed GNUism for getops in ssh-agent since glibc lacks optreset. - (bal) add extern char *getopt. Based on report by dtucker@zip.com.au - OpenBSD CVS Sync - stevesk@cvs.openbsd.org 2002/06/22 02:00:29 [ssh.h] correct comment - stevesk@cvs.openbsd.org 2002/06/22 02:40:23 [ssh.1] section 5 not 4 for ssh_config - naddy@cvs.openbsd.org 2002/06/22 11:51:39 [ssh.1] typo - stevesk@cvs.openbsd.org 2002/06/22 16:32:54 [sshd.8] add /var/empty in FILES section - stevesk@cvs.openbsd.org 2002/06/22 16:40:19 [sshd.c] check /var/empty owner mode; ok provos@ - stevesk@cvs.openbsd.org 2002/06/22 16:41:57 [scp.1] typo - stevesk@cvs.openbsd.org 2002/06/22 16:45:29 [ssh-agent.1 sshd.8 sshd_config.5] use process ID vs. pid/PID/process identifier - stevesk@cvs.openbsd.org 2002/06/22 20:05:27 [sshd.c] don't call setsid() if debugging or run from inetd; no "Operation not permitted" errors now; ok millert@ markus@ - stevesk@cvs.openbsd.org 2002/06/22 23:09:51 [monitor.c] save auth method before monitor_reset_key_state(); bugzilla bug #284; ok provos@
2002-06-26add expiry fields to passwd entryitojun1-2/+2
2002-06-26Substitute a couple of `mkdir' by `${MKDIR}'.seb1-2/+2
Remove `-p' from mkdir arguments, it is already part of ${MKDIR}. While here substitute a couple of ${PREFIX} by `%D' in `@exec ${MKDIR} ...' lines and add a couple of missing `%D' in such lines too!
2002-06-26need -pitojun1-2/+2
2002-06-26use ${MKDIR}itojun1-2/+2
2002-06-26it works with openssl 0.9.5aitojun1-2/+2
>(OpenSSL 0.9.5a is partially supported, but some ciphers (SSH protocol 1 >Blowfish included) do not work correctly.)
2002-06-25Add patches to enable compression and privsep on platforms without MAP_ANONtoshii3-1/+46
(such as Solaris2.6). Patches are partly from itojun.
2002-06-25warn that UsePrivilegeSeparation has to be yes.itojun1-3/+4
2002-06-25note required UID/GIDitojun1-1/+8
2002-06-25Back out previous and do it in a simpler way by setting PKG_SYSCONFSUBDIRjlam1-4/+6
(the subdirectory of ${PKG_SYSCONFBASE} where all of the config files for thii package will be found) to be "ssh".
2002-06-25use ${PKG_SYSCONFDIR}/ssh (who uses CONF_FILES?)itojun1-3/+3
2002-06-25use ${PKG_SYSCONFDIR}/ssh, to be consistent with plain NetBSD distributionitojun1-2/+2
2002-06-25upgrade to 3.3p1, with privilege separation enabled.itojun6-36/+57
(the following change may include pre-3.2.3p1 change) 20020622 - (djm) Update README.privsep; spotted by fries@ - (djm) Release 3.3p1 20020621 - (djm) Sync: - djm@cvs.openbsd.org 2002/06/21 05:50:51 [monitor.c] Don't initialise compression buffers when compression=no in sshd_config; ok Niels@ - ID sync for auth-passwd.c - (djm) Warn and disable compression on platforms which can't handle both useprivilegeseparation=yes and compression=yes - (djm) contrib/redhat/openssh.spec hacking: - Merge in spec changes from seba@iq.pl (Sebastian Pachuta) - Add new {ssh,sshd}_config.5 manpages - Add new ssh-keysign program and remove setuid from ssh client 20020620 - (bal) Fixed AIX environment handling, use setpcred() instead of existing code. (Bugzilla Bug 261) - (bal) OpenBSD CVS Sync - todd@cvs.openbsd.org 2002/06/14 21:35:00 [monitor_wrap.c] spelling; from Brian Poole <raj@cerias.purdue.edu> - markus@cvs.openbsd.org 2002/06/15 00:01:36 [authfd.c authfd.h ssh-add.c ssh-agent.c] break agent key lifetime protocol and allow other contraints for key usage. - markus@cvs.openbsd.org 2002/06/15 00:07:38 [authfd.c authfd.h ssh-add.c ssh-agent.c] fix stupid typo - markus@cvs.openbsd.org 2002/06/15 01:27:48 [authfd.c authfd.h ssh-add.c ssh-agent.c] remove the CONSTRAIN_IDENTITY messages and introduce a new ADD_ID message with contraints instead. contraints can be only added together with the private key. - itojun@cvs.openbsd.org 2002/06/16 21:30:58 [ssh-keyscan.c] use TAILQ_xx macro. from lukem@netbsd. markus ok - deraadt@cvs.openbsd.org 2002/06/17 06:05:56 [scp.c] make usage like man page - deraadt@cvs.openbsd.org 2002/06/19 00:27:55 [auth-bsdauth.c auth-skey.c auth1.c auth2-chall.c auth2-none.c authfd.c authfd.h monitor_wrap.c msg.c nchan.c radix.c readconf.c scp.c sftp.1 ssh-add.1 ssh-add.c ssh-agent.1 ssh-agent.c ssh-keygen.1 ssh-keygen.c ssh-keysign.c ssh.1 sshconnect.c sshconnect.h sshconnect2.c ttymodes.c xmalloc.h] KNF done automatically while reading.... - markus@cvs.openbsd.org 2002/06/19 18:01:00 [cipher.c monitor.c monitor_wrap.c packet.c packet.h] make the monitor sync the transfer ssh1 session key; transfer keycontext only for RC4 (this is still depends on EVP implementation details and is broken). - stevesk@cvs.openbsd.org 2002/06/20 19:56:07 [ssh.1 sshd.8] move configuration file options from ssh.1/sshd.8 to ssh_config.5/sshd_config.5; ok deraadt@ millert@ - stevesk@cvs.openbsd.org 2002/06/20 20:00:05 [scp.1 sftp.1] ssh_config(5) - stevesk@cvs.openbsd.org 2002/06/20 20:03:34 [ssh_config sshd_config] refer to config file man page - markus@cvs.openbsd.org 2002/06/20 23:05:56 [servconf.c servconf.h session.c sshd.c] allow Compression=yes/no in sshd_config - markus@cvs.openbsd.org 2002/06/20 23:37:12 [sshd_config] add Compression - stevesk@cvs.openbsd.org 2002/05/25 20:40:08 [LICENCE] missed Per Allansson (auth2-chall.c) - (bal) Cygwin special handling of empty passwords wrong. Patch by vinschen@redhat.com - (bal) Missed integrating ssh_config.5 and sshd_config.5 - (bal) Still more Makefile.in updates for ssh{d}_config.5 20020613 - (bal) typo of setgroup for cygwin. Patch by vinschen@redhat.com 20020612 - (bal) OpenBSD CVS Sync - markus@cvs.openbsd.org 2002/06/11 23:03:54 [ssh.c] remove unused cruft. - markus@cvs.openbsd.org 2002/06/12 01:09:52 [ssh.c] ssh_connect returns 0 on success - (bal) Build noop setgroups() for cygwin to clean up code (For other platforms without the setgroups() requirement, you MUST define SETGROUPS_NOOP in the configure.ac) Based on patch by vinschen@redhat.com - (bal) Some platforms don't have ONLCR (Notable Mint) 20020611 - (bal) ssh-agent.c RCSD fix (|unexpand already done) - (bal) OpenBSD CVS Sync - stevesk@cvs.openbsd.org 2002/06/09 22:15:15 [ssh.1] update for no setuid root and ssh-keysign; ok deraadt@ - itojun@cvs.openbsd.org 2002/06/09 22:17:21 [sshconnect.c] pass salen to sockaddr_ntop so that we are happy on linux/solaris - stevesk@cvs.openbsd.org 2002/06/10 16:53:06 [auth-rsa.c ssh-rsa.c] display minimum RSA modulus in error(); ok markus@ - stevesk@cvs.openbsd.org 2002/06/10 16:56:30 [ssh-keysign.8] merge in stuff from my man page; ok markus@ - stevesk@cvs.openbsd.org 2002/06/10 17:36:23 [ssh-add.1 ssh-add.c] use convtime() to parse and validate key lifetime. can now use '-t 2h' etc. ok markus@ provos@ - stevesk@cvs.openbsd.org 2002/06/10 17:45:20 [readconf.c ssh.1] change RhostsRSAAuthentication and RhostsAuthentication default to no since ssh is no longer setuid root by default; ok markus@ - stevesk@cvs.openbsd.org 2002/06/10 21:21:10 [ssh_config] update defaults for RhostsRSAAuthentication and RhostsAuthentication here too (all options commented out with default value). - markus@cvs.openbsd.org 2002/06/10 22:28:41 [channels.c channels.h session.c] move creation of agent socket to session.c; no need for uidswapping in channel.c. - markus@cvs.openbsd.org 2002/06/11 04:14:26 [ssh.c sshconnect.c sshconnect.h] no longer use uidswap.[ch] from the ssh client run less code with euid==0 if ssh is installed setuid root just switch the euid, don't switch the complete set of groups (this is only needed by sshd). ok provos@ - mpech@cvs.openbsd.org 2002/06/11 05:46:20 [auth-krb4.c monitor.h serverloop.c session.c ssh-agent.c sshd.c] pid_t cleanup. Markus need this now to keep hacking. markus@, millert@ ok - itojun@cvs.openbsd.org 2002/06/11 08:11:45 [canohost.c] use "ntop" only after initialized - (bal) Cygwin fix up from swap uid clean up in ssh.c patch by vinschen@redhat.com 20020609 - (bal) OpenBSD CVS Sync - markus@cvs.openbsd.org 2002/06/08 05:07:56 [ssh.c] nuke ptrace comment - markus@cvs.openbsd.org 2002/06/08 05:07:09 [ssh-keysign.c] only accept 20 byte session ids - markus@cvs.openbsd.org 2002/06/08 05:17:01 [readconf.c readconf.h ssh.1 ssh.c] deprecate FallBackToRsh and UseRsh; patch from djm@ - markus@cvs.openbsd.org 2002/06/08 05:40:01 [readconf.c] just warn about Deprecated options for now - markus@cvs.openbsd.org 2002/06/08 05:41:18 [ssh_config] remove FallBackToRsh/UseRsh - markus@cvs.openbsd.org 2002/06/08 12:36:53 [scp.c] remove FallBackToRsh - markus@cvs.openbsd.org 2002/06/08 12:46:14 [readconf.c] silently ignore deprecated options, since FallBackToRsh might be passed by remote scp commands. - itojun@cvs.openbsd.org 2002/06/08 21:15:27 [sshconnect.c] always use getnameinfo. (diag message only) - markus@cvs.openbsd.org 2002/06/09 04:33:27 [sshconnect.c] abort() - > fatal() - (bal) RCSID tag updates on channels.c, clientloop.c, nchan.c, sftp-client.c, ssh-agenet.c, ssh-keygen.c and connect.h (we did unexpand independant of them) 20020607 - (bal) Removed --{enable/disable}-suid-ssh - (bal) Missed __progname in ssh-keysign.c patch by dtucker@zip.com.au - (bal) use 'LOGIN_PROGRAM' not '/usr/bin/login' in session.c patch by Bertrand.Velle@apogee-com.fr 20020606 - (bal) OpenBSD CVS Sync - markus@cvs.openbsd.org 2002/05/15 21:56:38 [servconf.c sshd.8 sshd_config] re-enable privsep and disable setuid for post-3.2.2 - markus@cvs.openbsd.org 2002/05/16 22:02:50 [cipher.c kex.h mac.c] fix warnings (openssl 0.9.7 requires const) - stevesk@cvs.openbsd.org 2002/05/16 22:09:59 [session.c ssh.c] don't limit xauth pathlen on client side and longer print length on server when debug; ok markus@ - deraadt@cvs.openbsd.org 2002/05/19 20:54:52 [log.h] extra commas in enum not 100% portable - deraadt@cvs.openbsd.org 2002/05/22 23:18:25 [ssh.c sshd.c] spelling; abishoff@arc.nasa.gov - markus@cvs.openbsd.org 2002/05/23 19:24:30 [authfile.c authfile.h pathnames.h ssh.c sshconnect.c sshconnect.h sshconnect1.c sshconnect2.c ssh-keysign.8 ssh-keysign.c Makefile.in] add /usr/libexec/ssh-keysign: a setuid helper program for hostbased authentication in protocol v2 (needs to access the hostkeys). - markus@cvs.openbsd.org 2002/05/23 19:39:34 [ssh.c] add comment about ssh-keysign - markus@cvs.openbsd.org 2002/05/24 08:45:14 [sshconnect2.c] stat ssh-keysign first, print error if stat fails; some debug->error; fix comment - markus@cvs.openbsd.org 2002/05/25 08:50:39 [sshconnect2.c] execlp->execl; from stevesk - markus@cvs.openbsd.org 2002/05/25 18:51:07 [auth.h auth2.c auth2-hostbased.c auth2-kbdint.c auth2-none.c auth2-passwd.c auth2-pubkey.c Makefile.in] split auth2.c into one file per method; ok provos@/deraadt@ - stevesk@cvs.openbsd.org 2002/05/26 20:35:10 [ssh.1] sort ChallengeResponseAuthentication; ok markus@ - stevesk@cvs.openbsd.org 2002/05/28 16:45:27 [monitor_mm.c] print strerror(errno) on mmap/munmap error; ok markus@ - stevesk@cvs.openbsd.org 2002/05/28 17:28:02 [uidswap.c] format spec change/casts and some KNF; ok markus@ - stevesk@cvs.openbsd.org 2002/05/28 21:24:00 [uidswap.c] use correct function name in fatal() - stevesk@cvs.openbsd.org 2002/05/29 03:06:30 [ssh.1 sshd.8] spelling - markus@cvs.openbsd.org 2002/05/29 11:21:57 [sshd.c] don't start if privsep is enabled and SSH_PRIVSEP_USER or _PATH_PRIVSEP_CHROOT_DIR are missing; ok deraadt@ - markus@cvs.openbsd.org 2002/05/30 08:07:31 [cipher.c] use rijndael/aes from libcrypto (openssl >= 0.9.7) instead of our own implementation. allow use of AES hardware via libcrypto, ok deraadt@ - markus@cvs.openbsd.org 2002/05/31 10:30:33 [sshconnect2.c] extent ssh-keysign protocol: pass # of socket-fd to ssh-keysign, keysign verfies locally used ip-address using this socket-fd, restricts fake local hostnames to actual local hostnames; ok stevesk@ - markus@cvs.openbsd.org 2002/05/31 11:35:15 [auth.h auth2.c] move Authmethod definitons to per-method file. - markus@cvs.openbsd.org 2002/05/31 13:16:48 [key.c] add comment: key_verify returns 1 for a correct signature, 0 for an incorrect signature and -1 on error. - markus@cvs.openbsd.org 2002/05/31 13:20:50 [ssh-rsa.c] pad received signature with leading zeros, because RSA_verify expects a signature of RSA_size. the drafts says the signature is transmitted unpadded (e.g. putty does not pad), reported by anakin@pobox.com - deraadt@cvs.openbsd.org 2002/06/03 12:04:07 [ssh.h] compatiblity -> compatibility decriptor -> descriptor authentciated -> authenticated transmition -> transmission - markus@cvs.openbsd.org 2002/06/04 19:42:35 [monitor.c] only allow enabled authentication methods; ok provos@ - markus@cvs.openbsd.org 2002/06/04 19:53:40 [monitor.c] save the session id (hash) for ssh2 (it will be passed with the initial sign request) and verify that this value is used during authentication; ok provos@ - markus@cvs.openbsd.org 2002/06/04 23:02:06 [packet.c] remove __FUNCTION__ - markus@cvs.openbsd.org 2002/06/04 23:05:49 [cipher.c monitor.c monitor_fdpass.c monitor_mm.c monitor_wrap.c] __FUNCTION__ -> __func__ - markus@cvs.openbsd.org 2002/06/05 16:08:07 [ssh-agent.1 ssh-agent.c] '-a bind_address' binds the agent to user-specified unix-domain socket instead of /tmp/ssh-XXXXXXXX/agent.<pid>; ok djm@ (some time ago). - markus@cvs.openbsd.org 2002/06/05 16:08:07 [ssh-agent.1 ssh-agent.c] '-a bind_address' binds the agent to user-specified unix-domain socket instead of /tmp/ssh-XXXXXXXX/agent.<pid>; ok djm@ (some time ago). - markus@cvs.openbsd.org 2002/06/05 16:48:54 [ssh-agent.c] copy current request into an extra buffer and just flush this request on errors, ok provos@ - markus@cvs.openbsd.org 2002/06/05 19:57:12 [authfd.c authfd.h ssh-add.1 ssh-add.c ssh-agent.c] ssh-add -x for lock and -X for unlocking the agent. todo: encrypt private keys with locked... - markus@cvs.openbsd.org 2002/06/05 20:56:39 [ssh-add.c] add -x/-X to usage - markus@cvs.openbsd.org 2002/06/05 21:55:44 [authfd.c authfd.h ssh-add.1 ssh-add.c ssh-agent.c] ssh-add -t life, Set lifetime (in seconds) when adding identities; ok provos@ - stevesk@cvs.openbsd.org 2002/06/06 01:09:41 [monitor.h] no trailing comma in enum; china@thewrittenword.com - markus@cvs.openbsd.org 2002/06/06 17:12:44 [sftp-server.c] discard remaining bytes of current request; ok provos@ - markus@cvs.openbsd.org 2002/06/06 17:30:11 [sftp-server.c] use get_int() macro (hide iqueue) - (bal) Missed msg.[ch] in merge. Required for ssh-keysign. - (bal) Forgot to add msg.c Makefile.in. - (bal) monitor_mm.c typos. - (bal) Refixed auth2.c. It was never fully commited while spliting out authentication to different files. - (bal) ssh-keysign should build and install correctly now. Phase two would be to clean out any dead wood and disable ssh setuid on install. - (bal) Reverse logic, use __func__ first since it's C99 20020604 - (stevesk) [channels.c] bug #164 patch from YOSHIFUJI Hideaki (changed setsockopt from debug to error for now). 20020527 - (tim) [configure.ac.orig monitor_fdpass.c] Enahnce msghdr tests to address build problem on Irix reported by Dave Love <d.love@dl.ac.uk>. Back out last monitor_fdpass.c changes that are no longer needed with new tests. Patch tested on Irix by Jan-Frode Myklebust <janfrode@parallab.uib.no> 20020522 - (djm) Fix spelling mistakes, spotted by Solar Designer i <solar@openwall.com> - Sync scard/ (not sure when it drifted) - (djm) OpenBSD CVS Sync: [auth.c] Fix typo/thinko. Pass in as to auth_approval(), not NULL. Closes PR 2659. - Crank version - Crank RPM spec versions 20020521 - (stevesk) [sshd.c] bug 245; disable setsid() for now - (stevesk) [sshd.c] #ifndef HAVE_CYGWIN for setgroups() 20020517 - (tim) [configure.ac] remove extra MD5_MSG="no" line. 20020515 - (bal) CVS ID fix up on auth-passwd.c - (bal) OpenBSD CVS Sync - deraadt@cvs.openbsd.org 2002/05/07 19:54:36 [ssh.h] use ssh uid - deraadt@cvs.openbsd.org 2002/05/08 21:06:34 [ssh.h] move to sshd.sshd instead - stevesk@cvs.openbsd.org 2002/05/11 20:24:48 [ssh.h] typo in comment - itojun@cvs.openbsd.org 2002/05/13 02:37:39 [auth-skey.c auth2.c] less warnings. skey_{respond,query} are public (in auth.h) - markus@cvs.openbsd.org 2002/05/13 20:44:58 [auth-options.c auth.c auth.h] move the packet_send_debug handling from auth-options.c to auth.c; ok provos@ - millert@cvs.openbsd.org 2002/05/13 15:53:19 [sshd.c] Call setsid() in the child after sshd accepts the connection and forks. This is needed for privsep which calls setlogin() when it changes uids. Without this, there is a race where the login name of an existing connection, as returned by getlogin(), may be changed to the privsep user (sshd). markus@ OK - markus@cvs.openbsd.org 2002/05/13 21:26:49 [auth-rhosts.c] handle debug messages during rhosts-rsa and hostbased authentication; ok provos@ - mouring@cvs.openbsd.org 2002/05/15 15:47:49 [kex.c monitor.c monitor_wrap.c sshd.c] 'monitor' variable clashes with at least one lame platform (NeXT). i Renamed to 'pmonitor'. provos@ - deraadt@cvs.openbsd.org 2002/05/04 02:39:35 [servconf.c sshd.8 sshd_config] enable privsep by default; provos ok - millert@cvs.openbsd.org 2002/05/06 23:34:33 [ssh.1 sshd.8] Kill/adjust r(login|exec)d? references now that those are no longer in the tree. - markus@cvs.openbsd.org 2002/05/15 21:02:53 [servconf.c sshd.8 sshd_config] disable privsep and enable setuid for the 3.2.2 release - (bal) Fixed up PAM case. I think. - (bal) Clarified openbsd-compat/*-cray.* Licence provided by Wendy - (bal) OpenBSD CVS Sync - markus@cvs.openbsd.org 2002/05/15 21:05:29 [version.h] enter OpenSSH_3.2.2 - (bal) Caldara, Suse, and Redhat openssh.specs updated.
2002-06-15Change USE_KERBEROS to PKG_USE_KERBEROS in pkgsrc. There was a "conflict"cjep1-2/+2
which the basesrc USE_KERBEROS variable. Discussed on packages@ This fixes PR#17182 from Takahiro Kambe. The problem was pointed out by FUKAUMI Naoki on a Japanese NetBSD mailing list.
2002-05-24upgrade to 3.2.3p1.itojun2-6/+6
- a defect in the BSD_AUTH access control handling for OpenBSD and BSD/OS systems: Under certain conditions, on systems using YP with netgroups in the password database, it is possible that sshd does ACL checks for the requested user name but uses the password database entry of a different user for authentication. This means that denied users might authenticate successfully while permitted users could be locked out (OpenBSD PR 2659). - login/tty problems on Solaris (bug #245) - build problems on Cygwin systems
2002-05-23comment; rationale for --with-md5-passwordsitojun1-1/+2
2002-05-20enable MD5 password support. PR 16546itojun1-1/+2
2002-05-19upgrade to 3.2.2p1. includes security changes.itojun5-46/+46
Security Changes: ================= - fixed buffer overflow in Kerberos/AFS token passing - fixed overflow in Kerberos client code - sshd no longer auto-enables Kerberos/AFS - experimental support for privilege separation, see UsePrivilegeSeparation in sshd(8) and http://www.citi.umich.edu/u/provos/ssh/privsep.html for more information. - only accept RSA keys of size SSH_RSA_MINIMUM_MODULUS_SIZE (768) or larger Other Changes: ============== - improved smartcard support (including support for OpenSC, see www.opensc.org) - improved Kerberos support (including support for MIT-Kerberos V) - fixed stderr handling in protocol v2 - client reports failure if -R style TCP forwarding fails in protocol v2 - support configuration of TCP forwarding during interactive sessions (~C) - improved support for older sftp servers - improved support for importing old DSA keys (from ssh.com software). - client side suport for PASSWD_CHANGEREQ in protocol v2 - fixed waitpid race conditions - record correct lastlogin time
2002-05-13OpenBSD/OpenSSH now in /opsys/ on gd.tuwien.ac.atgrant1-2/+2
2002-04-24Make this depend on OpenSSL 0.9.6. This fixes the compilation problemsmartti1-1/+3
in NetBSD 1.5.x.
2002-04-23Updated openssh to 3.1.1martti6-119/+30
* a lot of bug fixes
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-31 16:53:40 +0000