summaryrefslogtreecommitdiff
path: root/security
AgeCommit message (Collapse)AuthorFilesLines
2008-01-06Update sudo package to 1.6.9p11.taca2-8/+6
637) Fixed a compilation problem on SCO related to how they store the high resolution timestamps in struct stat. 638) Avoid checking the passwd file group multiple times in the LDAP query when the user's passwd group is also listed in the supplemental group vector. 639) The URI specifier can now be used in ldap.conf even when the LDAP SDK doesn't support ldap_initialize(). 640) New %p prompt escape that expands to the user whose password is being prompted, as specified by the rootpw, targetpw and runaspw sudoers flags. Based on a diff from Patrick Schoenfeld.
2008-01-05Fixed a few pkglint warnings.rillig3-7/+8
2008-01-05Change MASTER_SITES to locatoin for old archive,obache1-2/+2
noticed by Zafer Aydogan in private mail.
2008-01-05Change MASTER_SITES to new location, noticed by Zafer Aydogan in private mail.obache1-3/+3
Also change HOMEPAGE.
2008-01-05Old url is not available now, noticed by Zafer Aydogan in private mail.obache1-4/+3
Switch HOMEPAGE and MASTER_SITES to new location.
2008-01-05*.tbz does not exist now, noticed by Zafer Aydogan in private mail.obache2-6/+6
Switch to *.tgz, no differ from *.tbz.
2008-01-05Change HOMEPAGE and MASTER_SITES to new location.obache1-3/+3
2008-01-04The package needs a C compiler.heinz1-1/+3
2008-01-04Removed the special-case handling of PKG_SYSCONFDIR for NetBSD. Now therillig1-6/+2
configuration files are installed in the usual pkgsrc place, not in /etc. PKGREVISION++ Ok'ed by jlam@.
2008-01-04Update to 2.1.4adrianp4-23/+20
27 Nov 2007 - 2.1.4 ------------------- * Updated included Core Ruleset to version 1.5 and noted in the docs that XML support is required to use the rules without modification. * Fixed an evasion FP, mistaking a multipart non-boundary for a boundary. * Fixed multiple warnings on Solaris and/or 64bit builds. * Do not process subrequests in phase 2-4, but do hand off the request data. * Fixed a blocking FP in the multipart parser, which affected Safari. 11 Sep 2007 - 2.1.3 ------------------- * Updated multipart parsing code adding variables to allow checking for various parsing issues (request body abnormalities). * Allow mod_rpaf and mod_extract_forwarded2 to work before ModSecurity. * Quiet some compiler warnings. * Do not block internal ErrorDocument requests after blocking request. * Added ability to compile without an external API (use -DNO_MODSEC_API). 27 Jul 2007 - 2.1.2 ------------------- * Cleaned up and clarified some documentation. * Update included core rules to latest version (1.4.3). * Enhanced ability to alert/audit failed requests. * Do not trigger "pause" action for internal requests. * Fixed issue with requests that use internal requests. These had the potential to be intercepted incorrectly when other Apache httpd modules that used internal requests were used with mod_security. * Added Solaris and Cygwin to the list of platforms not supporting the hidden visibility attribute. * Fixed decoding full-width unicode in t:urlDecodeUni. * Lessen some overhead of debugging messages and calculations. * Do not try to intercept a request after a failed rule. This fixes the issue associated with an "Internal Error: Asked to intercept request but was_intercepted is zero" error message. * Added SecAuditLog2 directive to allow redundent concurrent audit log index files. This will allow sending audit data to two consoles, etc. * Small performance improvement in memory management for rule execution.
2008-01-03Install the binaries readable for the owner, so that a package can berillig3-6/+7
created in unprivileged pkgsrc mode. PKGREVISION++
2008-01-02Look out for the case where audit-packages is already installed with theadrianp1-1/+10
base OS on NetBSD.
2007-12-30Replaced outdated mirrors by working mirrors.heinz1-4/+5
2007-12-30* Honor PKGMANDIR and PKG_SYSCONFBASE.obache4-8/+67
* Install config files by CONF_FILES instead of install directly. * Correct path of tools and config in sample config files and a manual page. * Add DESTDIR support. Bump PKGREVISION.
2007-12-28Recognize the MIT Kerberos bundled with Mac OS X Leopard.tron1-1/+7
2007-12-28This package uses BSD Makefile.obache3-2/+21
Honor PKGMANDIR and DESTDIR ready.
2007-12-28Require pre-created sbin directory.obache1-2/+2
2007-12-28DESTDIR ready.obache1-1/+3
2007-12-28Fixes invalid lvalue in assignment.obache2-1/+15
2007-12-28Also need for NetBSD.obache2-4/+4
2007-12-28Switch to SUBST framework.obache1-21/+19
2007-12-28Honor PKGMANDIR.obache1-2/+2
2007-12-27Remove deprecated "fee-based commercial use" license for idea, mdc2,gdt1-11/+8
rc5, and replace with {idea,mdc2,rc5}-nonlicense. Because pkgsrc does not yet handle multiple licenses, set LICENSE to openssl-patented-algorithms-nonlicense.
2007-12-27Add a PCRE bl3 depends to fix builds (found by DragonFly bulk builds)adrianp1-1/+3
PKGREVISION++
2007-12-27Explicitly depend on Perl. Bump revision.joerg1-2/+3
2007-12-27Change MASTER_SITES to archive directory, 1.4.11 only exsits in it.obache1-2/+2
2007-12-27Try to create target directories before install manuals.obache1-1/+3
2007-12-27Try to fix build problem on NetBSD, use the same strategies as DragonFly.obache1-1/+2
2007-12-25Now that package is installed into qt4 subdirectory, pkg-config can'tmarkd2-3/+7
find the qca2.pc file so copy to where it can. OKed jdolecek. Bump PKGREVISION.
2007-12-23restore security/qca-tls to state on pkgsrc-2007Q3-base tag (just beforejdolecek4-26/+29
the removal), rather then revision 1.1 of all files, used for original revival test compiled on Mac OS X 10.5
2007-12-22install qca2 files into qt4 subdirectory, so that qca 1.x and qca2 couldjdolecek1-4/+6
be installed at the same time bump PKGREVISION
2007-12-21I18N (PR 37581) and DESTDIR support.joerg2-3/+12
2007-12-21Update sudo pacakge to 1.6.9p10.taca2-7/+6
Major changes since Sudo 1.6.9p9: o Moved LDAP options into a table for simplified parsing/setting. o Fixed a problem with how some LDAP options were being applied. o Added support for connecting directly to LDAP servers via SSL/TLS for servers that don't support the start_tls extension.
2007-12-21install qca2 files into qt4 subdirectory, so that qca 1.x and qca2 couldjdolecek5-37/+60
be installed at the same time; also speedup build by disabling building tests and other miscellaneous cleanup bump PKGREVISION
2007-12-20put back qca-tls, add qca2 and qca2-ossljdolecek1-2/+4
2007-12-20move back to version 1.0 for security/qca and re-add security/qca-tlsjdolecek10-39/+118
(for qca 1.x), so that kdenetwork3 works again XXX these should be renamed to qca1* after current freeze
2007-12-20files moved to security/qca2-ossljdolecek4-46/+0
2007-12-20reimport security/qca-ossl as security/qca2-ossl (it's qca 2.x only)jdolecek4-0/+46
2007-12-20re-import security/qca version 2.0.0 as security/qca2 in preparation forjdolecek5-0/+91
having both qca 1.x and qca 2.x in tree
2007-12-19add qca-ossljdolecek1-1/+2
2007-12-19Add qca-ossl 2.0.0-beta3 - OpenSSL plugin for security/qcajdolecek4-0/+46
2007-12-19remove qca-tls - it's replaced by qca-ossl in QCA 2.xjdolecek7-105/+1
2007-12-19Update qca to version 2.0.0 (needed for update of chat/psi). Change listjdolecek4-18/+39
is not available, but the project now depends on QT 4.2 and was incorporated into KDE4 too
2007-12-17pull in pam.buildlink3.mk for proper handling of the various PAMdrochner1-8/+2
versions, fixes PR pkg/37545 by Ondrej Tuma, and makes special handling of Darwin unnecessary (tested by Matthias Scheler)
2007-12-14Update to version 1.7.1.bjs3-8/+11
Changes: Update to version 1.7.1. Changes: v1.7.1 (Amy) 10jun07 -------------------- * windows SSH agent support can use the 'ctypes' module now if 'win32all' is not available [patch from alexander belchenko] * SFTPClient.listdir_attr() now preserves the 'longname' field [patch from wesley augur] * SFTPClient.get_channel() API added * SSHClient constuctor takes an optional 'timeout' parameter [patch from james bardin] v1.7 (zubat) 18feb07 -------------------- * added x11 channel support (patch from david guerizec) * added reverse port forwarding support * (bug 75370) raise an exception when contacting a broken SFTP server * (bug 80295) SSHClient shouldn't expand the user directory twice when reading RSA/DSS keys * (bug 82383) typo in DSS key in SSHClient * (bug 83523) python 2.5 warning when encoding a file's modification time * if connecting to an SSH agent fails, silently fallback instead of raising an exception v1.6.4 (yanma) 19nov06 ---------------------- * fix setup.py on osx (oops!) * (bug 69330) check for the existence of RSA/DSA keys before trying to open them in SFTPClient * (bug 69222) catch EAGAIN in socket code to workaround a bug in recent Linux 2.6 kernels * (bug 70398) improve dict emulation in HostKeys objects * try harder to make sure all worker threads are joined on Transport.close() v1.6.3 (xatu) 14oct06 --------------------- * fixed bug where HostKeys.__setitem__ wouldn't always do the right thing * fixed bug in SFTPClient.chdir and SFTPAttributes.__str__ [patch from mike barber] * try harder not to raise EOFError from within SFTPClient * fixed bug where a thread waiting in accept() could block forever if the transport dies [patch from mike looijmans] v1.6.2 (weedle) 16aug06 ----------------------- * added support for "old" group-exchange server mode, for compatibility with the windows putty client * fixed some more interactions with SFTP file readv() and prefetch() * when saving the known_hosts file, preserve the original order [patch from warren young] * fix a couple of broken lines when exporting classes (bug 55946) v1.6.1 (vulpix) 10jul06 ----------------------- * more unit tests fixed for windows/cygwin (thanks to alexander belchenko) * a couple of fixes related to exceptions leaking out of SFTPClient * added ability to set items in HostKeys via __setitem__ * HostKeys now retains order and has a save() method * added PKey.write_private_key and PKey.from_private_key v1.6 (umbreon) 10may06 ---------------------- * pageant support on Windows thanks to john arbash meinel and todd whiteman * fixed unit tests to work under windows and cygwin (thanks to alexander belchenko for debugging) * various bugfixes/tweaks to SFTP file prefetch * added SSHClient for a higher-level API * SFTP readv() now yields results as it gets them * several APIs changed to throw an exception instead of "False" on failure
2007-12-13- added DESTDIR supportrhaen1-3/+5
- added USE_TOOLS - it should build now on NetBSD, Dragonfly - new maintainer - PKGREVISION bump
2007-12-12Reset maintainer on his request.wiz1-2/+2
2007-12-12Changes 2.1.15:adam11-72/+151
* Bug fix release
2007-12-05sudo-1.6.9p9.tar.gz was updated now. So, introduce DIST_SUBDIR andtaca2-5/+7
bump PKGREVISION. A little bug fix seems to applied. -rw-r--r-- 1 taca taca 578259 Dec 3 19:38 sudo-1.6.9p9.tar.gz-prev -rw-r--r-- 1 taca taca 578262 Dec 5 00:27 sudo-1.6.9p9.tar.gz diff -dupNr sudo-1.6.9p9-20071203/parse.c sudo-1.6.9p9/parse.c --- sudo-1.6.9p9-20071203/parse.c 2007-11-28 08:29:59.000000000 +0900 +++ sudo-1.6.9p9/parse.c 2007-12-05 00:26:40.000000000 +0900 @@ -90,7 +90,7 @@ #endif /* HAVE_EXTENDED_GLOB */ #ifndef lint -__unused static const char rcsid[] = "$Sudo: parse.c,v 1.160.2.14 2007/10/24 16:43:27 millert Exp $"; +__unused static const char rcsid[] = "$Sudo: parse.c,v 1.160.2.15 2007/12/04 15:26:40 millert Exp $"; #endif /* lint */ /* @@ -202,7 +202,7 @@ sudoers_lookup(pwflag) return(VALIDATE_OK | (no_passwd == TRUE ? FLAG_NOPASS : 0) | (no_execve == TRUE ? FLAG_NOEXEC : 0) | - (setenv_ok == TRUE ? FLAG_SETENV : 0)); + (setenv_ok >= TRUE ? FLAG_SETENV : 0)); } else if ((runas_matches == TRUE && cmnd_matches == FALSE) || (runas_matches == FALSE && cmnd_matches == TRUE)) { /* @@ -212,7 +212,7 @@ sudoers_lookup(pwflag) return(VALIDATE_NOT_OK | (no_passwd == TRUE ? FLAG_NOPASS : 0) | (no_execve == TRUE ? FLAG_NOEXEC : 0) | - (setenv_ok == TRUE ? FLAG_SETENV : 0)); + (setenv_ok >= TRUE ? FLAG_SETENV : 0)); } } top--; diff -dupNr sudo-1.6.9p9-20071203/sudo.c sudo-1.6.9p9/sudo.c --- sudo-1.6.9p9-20071203/sudo.c 2007-12-03 02:13:52.000000000 +0900 +++ sudo-1.6.9p9/sudo.c 2007-12-04 01:12:03.000000000 +0900 @@ -730,8 +730,10 @@ parse_args(argc, argv) while (NewArgc > 0) { if (NewArgv[0][0] == '-') { - if (NewArgv[0][1] != '\0' && NewArgv[0][2] != '\0') + if (NewArgv[0][1] != '\0' && NewArgv[0][2] != '\0') { warnx("please use single character options"); + usage(1); + } switch (NewArgv[0][1]) { case 'p':
2007-12-05Update sudo package to 1.6.9p9.taca2-6/+6
Major changes since Sudo 1.6.9p8: o The ALL command in sudoers now implies SETENV permissions. o The command search is now performed using the target user's auxiliary group vector, not just the target's primary group. o When determining if the PAM prompt is the default "Password: ", compare the localized version if possible. o New passprompt_override option in sudoers to cause sudo's prompt to be used in all cases. Also set when the -p flag is used.
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-25 08:29:26 +0000