summaryrefslogtreecommitdiff
path: root/security
AgeCommit message (Collapse)AuthorFilesLines
2007-10-22Pullup ticket 2209 - requested by adrianpghen3-14/+48
security fix for openssl - pkgsrc/security/openssl/Makefile 1.128 - pkgsrc/security/openssl/distinfo 1.56 - pkgsrc/security/openssl/patches/patch-ao 1.2 Module Name: pkgsrc Committed By: adrianp Date: Sun Oct 21 17:52:53 UTC 2007 Modified Files: pkgsrc/security/openssl: Makefile distinfo pkgsrc/security/openssl/patches: patch-ao Log Message: Full and proper fix for CVE-2007-5135 PKGREVISION++
2007-10-10Update sudo package to 1.6.9p6.taca2-6/+6
Major changes since Sudo 1.6.9p5: o Worked around bugs in the session support of some PAM implementations. The full tty path is now passed to PAM as well. o Sudo now only prints the password prompt if the process is in the foreground. o inttypes.h is now included when appropriate if it is present. o Simplified alias allocation in the parser.
2007-10-09Remove trailing spaces.martti1-2/+2
2007-10-09Needs pre-created directories.rillig1-4/+3
2007-10-02Make this package compile and run with recent C++ from gcc4.agc11-9/+152
Take maintainership. Anglicise some of the text in DESCR.
2007-09-30Reset maintainer -- shell@ is inactive.wiz4-8/+8
2007-09-26PKG_OPTIONS_OPTIONAL_GROUPS/PKG_OPTIONS_NONEMPTY_SETS have their respectivebjs1-2/+2
options added to PKG_SUPPORTED_OPTIONS automagically. Duplicate options removed.
2007-09-25This package requires libgpg-error>=1.4.minskim1-1/+3
Bump PKGREVISION.
2007-09-25Fix comment (GConf2 -> GConf).hira3-6/+6
2007-09-24Update pgpdump package to 0.26. Add support of DESTDIR_SUPPORT, too.taca3-16/+20
0.26 2007/09/06 * Catching upto ID 22. (http://www.ietf.org/internet-drafts/draft-ietf-openpgp-rfc2440bis-22.txt)
2007-09-23Fix typo in comment.wiz1-2/+3
2007-09-23Update HOMEPAGE.wiz1-2/+2
2007-09-21Fix paths for GConf, libglade, libart, libsigc++, lablgtk moves.wiz9-29/+29
Bump PKGREVISION.
2007-09-20Adapt for librsvg rename. Bump PKGREVISION.wiz1-2/+2
2007-09-20Adapt eel dependencies; bump PKGREVISION.wiz1-2/+2
2007-09-20Note, add and enable security/mozilla-rootcerts.jlam1-1/+2
2007-09-20Import security/mozilla-rootcerts:jlam5-0/+224
This package provides a script which can be used to extract the root CA certificates distributed by the Mozilla Project into the current working directory and to rehash the existing certificates. The directory can be used by most SSL-aware programs that expect a "CA certificate path".
2007-09-19Bump PKGREVISION for gnome-vfs rename.wiz2-4/+4
2007-09-19Use gnome-vfs instead of gnome-vfs2.wiz4-11/+11
2007-09-19Use DIST_SUBDIR for changed distfiles noted by wiz@ with private mail.taca2-8/+10
Bump PKGREVISION.
2007-09-19openssh-4.7p1-hpn12v18.diff.gz has updated without change file name.taca1-3/+3
It seems that it corrected SSH_HPN definition to "-hpn12v18".
2007-09-18Update to 1.09:wiz2-6/+6
v1.09 - new method stop_SSL as opposite of start_SSL based on a idea of Bron Gondwana <brong[AT]fastmail[DOT]fm> To support this method the SSL_shutdown handling had to be fixed, e.g. in close a proper unidirectional shutdown should be done while in stop_SSL a bidirectional shutdown - try to make it clearer that thread support is buggy
2007-09-15Fix build issus on DragonFly with GNUlib and don't use d_reclen as thejoerg3-1/+39
assertion is ensured already by opendir.
2007-09-14Hack around stupid GNUlib mess to allow building on DragonFly.joerg3-1/+49
2007-09-14Fix self-references. Sort PLIST. Use @dirrm instead of rm -rf.joerg2-64/+76
Bump revision.
2007-09-09Update sudo pacakge to 1.6.9p5.taca4-304/+48
617) Fixed a bug in the IP address matching introduced by the IPV6 merge. 618) For "visudo -f file" we now use the permissions of the original file and not the hard-coded sudoers owner/group/mode. This makes it possible to use visudo with a revision control system. 619) Fixed sudoedit when used on a non-existent file. 620) Regenerated configure using autoconf 2.6.1 and libtool 1.5.24. 621) Groups and netgroups are now valid in an LDAP sudoRunas statement.
2007-09-08Remove superfluous @dirrm. Bump PKGREVISION.wiz2-3/+3
2007-09-08Correct PLIST ommission and bump PKGREVISIONshannonjr2-3/+7
2007-09-07Convert packages that test and use USE_INET6 to use the options frameworkjlam5-13/+17
and to support the "inet6" option instead. Remaining usage of USE_INET6 was solely for the benefit of the scripts that generate the README.html files. Replace: BUILD_DEFS+= USE_INET6 with BUILD_DEFS+= IPV6_READY and teach the README-generation tools to look for that instead. This nukes USE_INET6 from pkgsrc proper. We leave a tiny bit of code to continue to support USE_INET6 for pkgsrc-wip until it has been nuked from there as well.
2007-09-07Allow packages that use OpenSSL to specify that they need an OpenSSLjlam2-12/+35
built with support for threads. This is done by adding the following line to the package Makefile before the inclusion of openssl/buildlink3.mk: USE_FEATURES.openssl= threads The openssl/builtin.mk file is also adjusted to detect whether or not the built-in OpenSSL was built with support for threads and the result is used accordingly to determine whether or not a pkgsrc OpenSSL is needed.
2007-09-07Update openssh package to 4.7.1 (4.7p1).taca5-61/+12
Changes since OpenSSH 4.6: ============================ Security bugs resolved in this release: * Prevent ssh(1) from using a trusted X11 cookie if creation of an untrusted cookie fails; found and fixed by Jan Pechanec. Other changes, new functionality and fixes in this release: * sshd(8) in new installations defaults to SSH Protocol 2 only. Existing installations are unchanged. * The SSH channel window size has been increased, and both ssh(1) sshd(8) now send window updates more aggressively. These improves performance on high-BDP (Bandwidth Delay Product) networks. * ssh(1) and sshd(8) now preserve MAC contexts between packets, which saves 2 hash calls per packet and results in 12-16% speedup for arcfour256/hmac-md5. * A new MAC algorithm has been added, UMAC-64 (RFC4418) as "umac-64@openssh.com". UMAC-64 has been measured to be approximately 20% faster than HMAC-MD5. * A -K flag was added to ssh(1) to set GSSAPIAuthentication=Yes * Failure to establish a ssh(1) TunnelForward is now treated as a fatal error when the ExitOnForwardFailure option is set. * ssh(1) returns a sensible exit status if the control master goes away without passing the full exit status. (bz #1261) * The following bugs have been fixed in this release: - When using a ProxyCommand in ssh(1), set the outgoing hostname with gethostname(2), allowing hostbased authentication to work (bz #616) - Make scp(1) skip FIFOs rather than hanging (bz #856) - Encode non-printing characters in scp(1) filenames. these could cause copies to be aborted with a "protocol error" (bz #891) - Handle SIGINT in sshd(8) privilege separation child process to ensure that wtmp and lastlog records are correctly updated (bz #1196) - Report GSSAPI mechanism in errors, for libraries that support multiple mechanisms (bz #1220) - Improve documentation for ssh-add(1)'s -d option (bz #1224) - Rearrange and tidy GSSAPI code, removing server-only code being linked into the client. (bz #1225) - Delay execution of ssh(1)'s LocalCommand until after all forwadings have been established. (bz #1232) - In scp(1), do not truncate non-regular files (bz #1236) - Improve exit message from ControlMaster clients. (bz #1262) - Prevent sftp-server(8) from reading until it runs out of buffer space, whereupon it would exit with a fatal error. (bz #1286) * Portable OpenSSH bugs fixed: - Fix multiple inclusion of paths.h on AIX 5.1 systems. (bz #1243) - Implement getpeereid for Solaris using getpeerucred. Solaris systems will now refuse ssh-agent(1) and ssh(1) ControlMaster clients from different, non-root users (bz #1287) - Fix compilation warnings by including string.h if found. (bz #1294) - Remove redefinition of _res in getrrsetbyname.c for platforms that already define it. (bz #1299) - Fix spurious "chan_read_failed for istate 3" errors from sshd(8), a side-effect of the "hang on exit" fix introduced in 4.6p1. (bz #1306) - pam_end() was not being called if authentication failed (bz #1322) - Fix SELinux support when SELinux is in permissive mode. Previously sshd(8) was treating SELinux errors as always fatal. (bz #1325) - Ensure that pam_setcred(..., PAM_ESTABLISH_CRED) is called before pam_setcred(..., PAM_REINITIALIZE_CRED), fixing pam_dhkeys. (bz #1339) - Fix privilege separation on QNX - pre-auth only, this platform does not support file descriptior passing needed for post-auth privilege separation. (bz #1343)
2007-09-06Honor PKG_SYSCONFDIR. The default host keys for dropbear are now found injlam3-8/+33
${PKG_SYSCONFDIR}/dropbear. Bump the PKGREVISION to 2.
2007-09-06Update to OpenPAM Figwort (20050616):joerg4-13/+25
- BUGFIX: Correct several small signedness and initialization bugs discovered during review by the NetBSD team. - BUGFIX: Modify gendoc.pl to sort cross-references in dictionary order within each section. - ENHANCE: if a policy specifies a relative module path, prepend the module directory so we never call dlopen(3) with a relative path. - ENHANCE: add a pam.conf(5) manual page.
2007-09-06Install the manual pages for dropbear. Bump the PKGREVISION to 1.jlam2-2/+11
2007-09-06Put variable declarations at beginning of a block to work with olderjlam2-1/+25
compilers.
2007-09-06For the "pam" package option, one needs to include pam.buildlink3.mk.jlam1-1/+2
2007-09-06Fix typo in comment.wiz1-2/+2
2007-09-05update to 2.0.0drochner10-59/+116
While an update to a .0 version is somehow risky, it finishes the unfortunate state that the pkgsrc gnutls didn't work with the pkgsrc opencdk, which I wouldn't like to go into the next stable branch. Release candidates have worked for me, and there is some time left before the Q3 branch, so I'm confident. changes: * Support for external RSA/DSA signing for TLS client authentication -many X.509 enhancements Support for Supplemental handshakes messages (RFC 4680) * Support for TLS authorization extension (draft-housley-tls-authz-extns-07) * Improve logic of gnutls_set_default_priority() * New APIs to enumerate supported algorithms in the library * Certtool can export more than one certificate to PKCS#12 * Several message translation improvements * Improved manual * Many bugfixes and minor improvements
2007-09-05update to 0.50drochner3-18/+9
changes: - Add DROPBEAR_PASSWORD environment variable to specify a dbclient password - Use /dev/urandom by default, since that's what everyone does anyway - Exit with an exit code of 1 if dropbear can't bind to any ports - Improve network performance and add a -W <receive_window> argument for adjusting the tradeoff between network performance and memory consumption - Fix a problem where reply packets could be sent during key exchange, in violation of the SSH spec. This could manifest itself with connections being terminated after 8 hours with new TCP-forward connections being established - Add -K <keepalive_time> argument, ensuring that data is transmitted over the connection at least every N seconds - dropbearkey will no longer generate DSS keys of sizes other than 1024 bits, as required by the DSS specification. (Other sizes are still accepted for use to provide backwards compatibility)
2007-09-05PLIST fixshannonjr1-1/+5
2007-09-05-add DESTDIR support, from Blair Sadewitzdrochner2-12/+36
(I didn't adopt the libtool change for now because it is not clear for be whether that PAM modules is useful for non-NetBSD.) -block SIGCHLD while the forked helper process is running, so that a calling process with a SIGCHLD handler won't steal the exit status which is used to report success of the authentication. This makes the "dropbear" ssh server usable if started with user privileges. bump revision to 1.1
2007-09-05Update to 0.9.9.1. Changes:shannonjr2-7/+8
- Fix for new libprelude (0.9.15) runtime warning. - Add documentation for SQLite3 in the template configuration file (Sébastien Tricaud <toady at gscore.org>).
2007-09-05Update to 0.9.13. Changes:shannonjr3-9/+11
- Source and Target now use a 16 bits index (required for CorrelationAlert with large number of source/target). CorrelationAlert Alertident now use a 32 bits index (required to link large number of Alert together). - Fix compilation on system without ENOTSUP (fix #227): Include modified patch from Alexandre Anriot <aanriot@atlantilde.com>. conversions preventing PostgreSQL to use indexes (fix #225). - [preludedb-admin] Use separate alert / heartbeat command: this is done to have a coherent implementation of the --offset and --count command line options. - [preludedb-admin] Fix --offset with the load command. - [preludedb-admin] Give the delete table a decent size, should speedup the delete command. - [documentation] preludedb-admin manpage (fix #230), by Pierre Chifflier <chifflier@inl.fr>.
2007-09-05Corrected my misunderstanding of CONF_FILESshannonjr10-80/+138
infrastrure. Fixed several configuration file installation problems.
2007-09-05Move variable declarations to start of block to appease older C compilers.jlam2-1/+24
2007-09-04Apply fixes for substitution errors reported in PR pkg/36898 by Nicolasjlam2-5/+4
Joly. Bump PKGREVISION due to fixed script update_dat.sh script.
2007-09-03Correct test for existing configuration fileshannonjr3-8/+9
2007-09-03Added entry for prelude-pfloggershannonjr1-1/+2
2007-09-03Prelude sensor for OpenBSD's PF (Packet Filter)shannonjr8-0/+145
that reports to Prelude Manager.
2007-09-03Update to 0.9.10.1. Changes:shannonjr2-7/+8
- Make SSH rules IPv6 compliants, allowing to merge old IPv6 only rules with IPv4 rules. Some additional minor bug fixes (fix #232). - Fix incorrect target user assignment, as well as incorrect PCRE reference in assessment.impact.description (Paul Robert Marino <prmarino1@gmail.com>) (fix #232). - CISCO router acl lists can now use names instead of numbers. This made rule id=500 in cisco-router.rules fail to alert on packet denys on newer cisco devices (Paul Robert Marino <prmarino1@gmail.com>). - Fix Apache formating when Apache logname or user is set (Robin Gruyters <r.gruyters@yirdis.nl> and <andre@vandervlies.xs4all.nl>) (fix #229). - Invalid user.user_id(0).name assignement in SSH rule 1913 (Scott Olihovik <skippylou@gmail.com>) (fix #243). - Various bug fixes and minor improvements.
generated by cgit v1.2.3 (git 2.39.1) at 2024-06-04 20:31:21 +0000