summaryrefslogtreecommitdiff
path: root/security
AgeCommit message (Collapse)AuthorFilesLines
2006-11-02Force to detect correct library when ${SASL_DBTYPE}=="berkeley".obache5-10/+41
Reported by David Carrel in pkgsrc-users@.
2006-11-02 Added missing fflush to scp when priting statistics. Fixed bugkivinen4-5/+59
in the reverse dns queries for IPv6 addresses (overwriting 12 bytes of local variables on the stack). Disabled x11-security on all platforms, as it does not seem to work on i386 either. Incremented PKGREVISION to 7.
2006-10-31Update to 0.5.11:wiz3-7/+8
Noteworthy changes in version 0.5.11 (2006-10-26) ------------------------------------------------ * Add a new self test "basic" to test cdk_check_version. * Add prototype of cdk_stream_decrypt to opencdk.h, reported by Adam Langley. * Fix crash in cdk_data_transform triggered by self-tests.
2006-10-31Update openssh package to 4.4.1 (openssh-4.4p1).taca30-359/+218
- A few pkglint warning clean up. - Major changes are here. For complete changes, see http://www.openssh.com/txt/release-4.4. Changes since OpenSSH 4.3: ============================ Security bugs resolved in this release: * Fix a pre-authentication denial of service found by Tavis Ormandy, that would cause sshd(8) to spin until the login grace time expired. * Fix an unsafe signal hander reported by Mark Dowd. The signal handler was vulnerable to a race condition that could be exploited to perform a pre-authentication denial of service. On portable OpenSSH, this vulnerability could theoretically lead to pre-authentication remote code execution if GSSAPI authentication is enabled, but the likelihood of successful exploitation appears remote. * On portable OpenSSH, fix a GSSAPI authentication abort that could be used to determine the validity of usernames on some platforms. This release includes the following new functionality and fixes: * Implemented conditional configuration in sshd_config(5) using the "Match" directive. This allows some configuration options to be selectively overridden if specific criteria (based on user, group, hostname and/or address) are met. So far a useful subset of post- authentication options are supported and more are expected to be added in future releases. * Add support for Diffie-Hellman group exchange key agreement with a final hash of SHA256. * Added a "ForceCommand" directive to sshd_config(5). Similar to the command="..." option accepted in ~/.ssh/authorized_keys, this forces the execution of the specified command regardless of what the user requested. This is very useful in conjunction with the new "Match" option. * Add a "PermitOpen" directive to sshd_config(5). This mirrors the permitopen="..." authorized_keys option, allowing fine-grained control over the port-forwardings that a user is allowed to establish. * Add optional logging of transactions to sftp-server(8). * ssh(1) will now record port numbers for hosts stored in ~/.ssh/authorized_keys when a non-standard port has been requested. * Add an "ExitOnForwardFailure" option to cause ssh(1) to exit (with a non-zero exit code) when requested port forwardings could not be established. * Extend sshd_config(5) "SubSystem" declarations to allow the specification of command-line arguments. * Replacement of all integer overflow susceptible invocations of malloc(3) and realloc(3) with overflow-checking equivalents. * Many manpage fixes and improvements * New portable OpenSSH-specific features: - Add optional support for SELinux, controlled using the --with-selinux configure option (experimental) - Add optional support for Solaris process contracts, enabled using the --with-solaris-contracts configure option (experimental) This option will also include SMF metadata in Solaris packages built using the "make package" target - Add optional support for OpenSSL hardware accelerators (engines), enabled using the --with-ssl-engine configure option.
2006-10-30Fix man path - this should fix PR# 34948 opened by Robert Elzadrianp1-2/+2
2006-10-29PLIST correctionshannonjr3-17/+45
2006-10-28Some more HOMEPAGE/MASTER_SITES updates from Sergey Svishchev.wiz1-3/+3
2006-10-28fixed code to satisfy picky SGI ido ccschwarz2-7/+16
2006-10-27Update to 5.2adrianp4-39/+44
Fix builds on -current Grab MAINTAINER pkglintification From CHANGES: v5.2 September 2005 (THC public release) ! THIS IS A THC TAX ANNIVERSARY SPECIAL RELEASE ! HAVE FUN ! * Included patch from ka0ttic@gentoo.org for cleaner gcc compile * Added SSL_Pending() to prevent rare locking on SSL ports, thanks to michel(at)arboi.fr.eu.org for reporting * Added lots of fingerprints, most from Johnny Cyberpunk / THC - THANKS! v5.1 June 2005 (THC public release) * Big appdefs.resp update. Thanks to all contributors! * Finally and forever fixed the --prefix= issue * Fixed the web update function for bad inet_pton implementations * Added support for nmap files with IPv6 addresses * You can scan/check port 0 now (wish from nbach<at>deloitte.dk) * Less error prone "make install"
2006-10-25Update ipsec-tools to 0.6.6.bad2-6/+6
Changes since 0.6.3: 0.6.6 * src/racoon/isakmp_xauth.c: Build fix * src/racoon/pfkey.c: Sets NAT-T ports to 0 if no NAT encapsulation in pk_sendgetspi(). * src/racoon/pfkey.c: Sets NAT-T ports to 0 if no NAT encapsulation in pk_sendupdate(). * src/racoon/isakmp_xauth.c: fix memory leak * src/racoon/{cfparse.y|handler.h}: typos 0.6.5 * src/racoon/isakmp.c: Fixed zombie PH1 handler when isakmp_send() fails in isakmp_ph1resend() * src/racoon/{cfparse.y|ipsec_doi.c}: Temporary fix for /32 subnets parsing. * src/racoon/isakmp_cfg.c: make software behave as the documentation advertise for INTERNAL_NETMASK4. Keep the old INTERNAL_MASK4 to avoid breaking backward compatibility. * src/racoon/session.c: Fixed / cleaned up signal handling. 0.6.4 * configure.ac src/racoon/plog.c: backported Fred's workaround for %zu problems on (at least) FreeBSD4. * src/racoon/session.c: backport: fix possible race conditions in signal handlers (see session.c 1.17). * src/libipsec/pfkey_dump.c: fixed compilation when NAT_T disabled (Fred has still some CVS problems). * src/libipsec/{libpfkey.h|pfkey_dump.c}: add a sadump_withports function to display SAD entries with their associated ports. * src/setkey/{parse.y|setkey.c|setkey.8}: allow to use setkey -p flag in conjunction with -D to show SADs with the port, allow both get and delete commands to use bracketed ports if needed. * src/racoon/racoon.conf.5: Style changes
2006-10-23Update to 1.2.5adrianp2-8/+9
- Added check for base_users and base_roles tables in base_main.php - Kevin Johnson - Added . to VAR_PUNC to fix query issue - Kevin johnson - Fixed issue with base_users table being required - Kevin Johnson - Added search punctuation fix - Bruce Briggs - Added FQDN to display -- Jonathan W Miner - PrintForm() fixes - Bruce Briggs - Settings for automatic expansion of the IP and Payload Criteria on Search screen - Bruce Briggs - Save the fields entered on the Search screen for Back button proper refilling - Bruce Briggs - RFE 1520185 Add support for managing last_cid - Eric Jacobsen - Changed show_rows to 49 in base_conf.php.dist to fix IE 6/7 bug - Bruce Briggs - Fixed link to FAQ - Juergen Leising - Fixed VAR_BOOLEAN error and some typos in the footer - Eric Jacobsen - Trivial patch to make base_stat_time.php use GET insted of POST to avoid the 'resend data' warning on refresh - GaRaGeD - Added base-rss.php to the contrib section - Dan Michitsch
2006-10-23Remove another directory created by the package. Bump revision.joerg2-3/+4
2006-10-23Update to 0.5.10:wiz3-7/+10
Noteworthy changes in version 0.5.10 (2006-10-11) ------------------------------------------------ * Fix double-free in cdk_pklist_encrypt, reported by Adam Langley. * Fix keydb_idx_search() to handle keys at offset 0, thanks to Adam Langley. * A pkg-config script was added, thanks to Andreas Metzler. * Autobuild time stamps are used, for easier build robot testing.
2006-10-22Disable expressly database drivers which is not specified by option.obache1-1/+7
Possibly fix PR 34555.
2006-10-21Sort PLISTadrianp1-3/+3
2006-10-21Update to 1.9.4adrianp3-20/+33
This package used to register as ap-modsecurity regardless of which apache version it built against. It will now register as ap13-modsecurity if building against apache 1.x and ap2-modsecurity if building against apache 2.x. Lots of changes including: * Enhanced memory utilisation. * Log level is now present on every entry in the debug log. * Added new actions (e.g. setenv, setnote, auditlog, noauditlog) * 404 responses are no longer considered relevant. * Added performance measurement to the Apache 2 versions. See CHANGES for all the details
2006-10-21Update sfs to 0.7.2nb7agc48-5/+1879
+ add support for gcc4
2006-10-21+rainbowcrackadrianp1-1/+2
2006-10-21Import rainbowcrack from pkgsrc-wip, packaged by David Howlandadrianp5-0/+100
RainbowCrack is a general propose implementation of Philippe Oechslin's faster time-memory trade-off technique. In short, the RainbowCrack tool is a hash cracker. A traditional brute force cracker try all possible plaintexts one by one in cracking time. It is time consuming to break complex password in this way. The idea of time-memory trade-off is to do all cracking time computation in advance and store the result in files so called "rainbow table". It does take a long time to precompute the tables. But once the one time precomputation is finished, a time-memory trade-off cracker can be hundreds of times faster than a brute force cracker, with the help of precomputed tables.
2006-10-20PLIST correctionshannonjr2-2/+7
2006-10-20Bump PKGREVISION for gpgsm change just committed.shannonjr1-1/+2
2006-10-20Fix gpgsm option so that it builds and works.shannonjr5-2/+57
2006-10-20Re: pkg/34856: upgrade to GnuPG 1.9.93shannonjr13-12/+308
This release is mainly to fix bugs found in 1.9.92.
2006-10-20Update to 1.4 (Required by gnupg-devel 1.93)shannonjr2-6/+6
2006-10-17Update p5-Authen-SASL to 2.10.obache2-7/+7
Patch provided by Martin Wilke via PR 34396. Modify to avoid interaction when buildling. Authen-SASL 2.10 -- Sat Mar 25 13:11:47 CST 2006 Enhancements * Added Authen::SASL::Perl::GSSAPI * Added error method to Authen::SASL to obtain error from last connection Bug Fixes * Authen::SASL::Perl::DIGEST_MD5 - Fixed response to server to pass digest-uri - Correct un-escaping behaviour when reading the challenge, - check for required fields (according to the RFC), - allow for qop not to be sent from the server (according to the RFC), - add a callback for the realm. Authen-SASL 2.09 -- Tue Apr 26 06:55:10 CDT 2005 Enhancements * authname support in Authen::SASL::Perl::DIGEST_MD5 * flexible plugin selection in Authen::SASL using import() i.e. use Authen::SASL qw(Authen::SASL::Cyrus); * new documentation for - Authen::SASL::Perl::ANONYMOUS - Authen::SASL::Perl::CRAM_MD5 - Authen::SASL::Perl::EXTERNAL - Authen::SASL::Perl::LOGIN - Authen::SASL::Perl::PLAIN - Authen::SASL::Perl * updates in the tests Authen-SASL 2.08 -- Tue May 25 11:24:21 BST 2004 Bug Fixes * Fix the handling of qop in Digest-MD5 Authen-SASL 2.07 -- Sat Apr 10 09:06:21 BST 2004 Bug Fixes * Fixed test bug if Digest::HMAC_MD5 was not installed * Fixed order of values sent in the PLAIN mechanism Enhancements * Added support in the framework for server-side plugins 2003-11-01 18:48 Graham Barr * lib/Authen/SASL.pm: Release 2.06 2003-10-21 19:59 Graham Barr * MANIFEST, lib/Authen/SASL/Perl.pm, lib/Authen/SASL/Perl/ANONYMOUS.pm, lib/Authen/SASL/Perl/CRAM_MD5.pm, lib/Authen/SASL/Perl/DIGEST_MD5.pm, lib/Authen/SASL/Perl/EXTERNAL.pm, lib/Authen/SASL/Perl/LOGIN.pm, lib/Authen/SASL/Perl/PLAIN.pm, t/order.t: Add ordering so we always pich the best of the available methods instead of just the first 2003-10-17 22:12 Graham Barr * lib/Authen/SASL.pm: Release 2.05 2003-10-17 22:06 Graham Barr * MANIFEST, Makefile.PL: use Module::Install to generate Makefile and add SIGNATURE and META.yml 2003-10-17 21:19 Graham Barr * lib/Authen/SASL/Perl/DIGEST_MD5.pm: Fix typo 2003-10-17 21:17 Graham Barr * lib/Authen/SASL/: Perl.pm, Perl/DIGEST_MD5.pm: Don't call die in DIGEST_MD5, but call set_error and return an empty list 2003-10-17 21:16 Graham Barr * lib/Authen/SASL.pod: Update docs to reflect that client_start and client_step return an emtpy list on error
2006-10-17HTTP download URLs for HTTP-only sites.dsainty1-2/+4
2006-10-16nb1: Put conf and pid files back where they belong after the 4.15 update.tv3-2/+17
(PKG_SYSCONFDIR already includes "stunnel" by default, so avoid the package adding another and making $PREFIX/etc/stunnel/stunnel/stunnel.conf; the pidfile does not normally belong under $PREFIX as $PREFIX/var/run is not normally cleaned/checked by OS-supplied processes.)
2006-10-16Make pkglint happy.martti1-2/+1
2006-10-16Added yaficmartti1-1/+2
2006-10-16yafic is Yet Another File Integrity Checker, similar to programs likemartti4-0/+28
Tripwire and AIDE.
2006-10-16Updated security/keychain to 2.6.6martti2-6/+6
* keychain 2.6.6 (08 Sep 2006) 08 Sep 2006; Aron Griffis <agriffis@gentoo.org>: Make --lockwait -1 mean forever. Previously 0 meant forever but was undocumented. Add more locking regression tests #137981 * keychain 2.6.5 (08 Sep 2006) 08 Sep 2006; Aron Griffis <agriffis@gentoo.org>: Break out of loop when empty lockfile can't be removed #127471. Add locking regression tests: 100_lock_stale 101_lock_held 102_lock_empty 103_lock_empty_cant_remove * keychain 2.6.4 (08 Sep 2006) 08 Sep 2006; Aron Griffis <agriffis@gentoo.org>: Add validinherit function so that validity of SSH_AUTH_SOCK and friends can be validated from startagent rather than up front. The advantage is that warning messages aren't emitted unnecessarily when --inherit *-once. Fix --eval for fish, and add new testcases: 053_start_with_--eval_ksh 054_start_with_--eval_fish 055_start_with_--eval_csh * keychain 2.6.3 (07 Sep 2006) 07 Sep 2006; Aron Griffis <agriffis@gentoo.org>: Support fish: http://roo.no-ip.org/fish/ Thanks to Ilkka Poutanen for the patch.
2006-10-14Update stunnel to 4.15.obache5-53/+50
Patch provided by Shaun Amott via PR 34436, take maintainership. And define USE_LIBTOOL, regen patch with mkpatches.
2006-10-14Update MASTER_SITES and/or HOMEPAGE, from Sergey Svishchev.wiz1-2/+2
2006-10-14Fixed "test ==".rillig3-1/+29
2006-10-14Fixed "test ==" and pkglint warnings.rillig5-37/+69
2006-10-13Update security/caff to 0.4.8tonio2-7/+7
Changelog: * gpglist: do not die with with-fingerprint (Closes: #382019). * gpg-key2ps: add --list-key to gpg call (works around #382794). * caff: when set, use $ENV{'GNUPGHOME'} to find secring.gpg. Suggested by Gerfried Fuchs.
2006-10-13Add an HTTP download URL for when outbound FTP isn't available.dsainty1-2/+3
2006-10-12Fix dependency. No cookie for shannonjr.joerg1-2/+2
2006-10-11Latest pinentry has new GTK+-2 Pinentry option. Enable or disableshannonjr3-4/+15
according to build options.
2006-10-11Remove patch-ab, patch-ac, and patch-ad because they are no longer needed.shannonjr3-40/+0
2006-10-11Update to 0.7.2shannonjr4-9/+12
2006-10-11adjust comment explaining how this should be separate packages rathergdt1-5/+6
than options.
2006-10-11Update to 0.9.10. Changes:shannonjr2-6/+6
- Only export symbol starting with preludedb_. - Verbose error reporting in case of libpreludedb initialization failure.
2006-10-11Update to 0.9.11. Changes:shannonjr4-40/+8
- Hook class comparison function. Accept NULL, equal, not equal operator. - Introduce better error checking in the idmef-class API, which is now considered public and might be used by external application. Rename error code to reflect the API. - Change to the way IDMEF listed element are handled. Specifying negative number as the position of the element from the low level API now allow to position the element at the specified (reversed) index. Using the high level API a negative index permit to address a list of element backward (replace an element). - Build fixes for SWIG > 1.3.27. - Modify idmef_value_match() so that it always unroll listed value (do it for both val1 and val2. Remove assertion, and let idmef_value_type_compare() return an error code in case there is an issue. - Handle path using IDMEF_LIST_APPEND or IDMEF_LIST_PREPEND as path using an undefined list index on idmef_path_get() call. - Make criteria parser accept (*) list index. - Implement comparison function for all IDMEF object.
2006-10-11Update to 0.9.3. Changes:shannonjr2-7/+7
* Portability fixes. * Pth is not anymore linked by means of weak symbol tricks. It is now required to link to the pth version of libassuan. New aufoconf macros are provided to to check for this. The pth version is only build if Pth is available. * configure does now check that descriptor passing is available. A way to check at runtime for this is also provided
2006-10-11Remove patches/patch-aa. It's no longer needed.shannonjr1-12/+0
2006-10-11Update to 1.9.92. Changes:shannonjr2-9/+8
* New "relax" flag for trustlist.txt to allow root CA certificates without BasicContraints. * [gpg2] Removed the -k PGP 2 compatibility hack. -k is now an alias for --list-keys. * [gpg2] Print a warning if "-sat" is used instead of "--clearsign". * Regular man pages for most tools are now build directly from the Texinfo source. * Included translations from gnupg 1.4.5. * The gpg code from 1.4.5 has been fully merged into this release. The configure option --enable-gpg is still required to build this gpg part. For production use of OpenPGP the gpg version 1.4.5 is still recommended. Note, that gpg will be installed under the name gpg2 to allow coexisting with an 1.4.x gpg. * API change in gpg-agent's pkdecrypt command. Thus an older gpgsm may not be used with the current gpg-agent. * The scdaemon will now call a script on reader status changes. * gpgsm now allows file descriptor passing for "INPUT", "OUTPUT" and "MESSAGE". * The gpgsm server may now output a key listing to the output file handle. This needs to be enabled using "OPTION list-to-output=1". * The --output option of gpgsm has now an effect on list-keys. * New gpgsm commands --dump-chain and list-chain. * gpg-connect-agent has new options to utilize descriptor passing. * A global trustlist may now be used. See doc/examples/trustlist.txt. * When creating a new pubring.kbx keybox common certificates are imported. * Enhanced pkcs#12 support to allow import from simple keyBags. * Exporting to pkcs#12 now create bag attributes so that Mozilla is able to import the files. * Pkcs#12 files are now created with a MAC. This is for better interoperability. * Fixed uploading of certain keys to the smart card. * New command APDU for scdaemon to allow using it for general card access. Might be used through gpg-connect-agent by using the SCD prefix command. * Support for the CardMan 4040 PCMCIA reader (Linux 2.6.15 required). * Scdaemon does not anymore reset cards at the end of a connection. * Kludge to allow use of Bundesnetzagentur issued X.509 certificates. * Added --hash=xxx option to scdaemon's PKSIGN command.
2006-10-11Update to 1.0.0. After about 5 years of beta testing, I am pleased to ↵shannonjr2-9/+10
announce the availability of libksba 1.0.0. Libksba is an X.509 and CMS (pkcs#7) library. It is for example required to build the S/MIME part of GnuPG (gpgsm)
2006-10-11Update to 0.9.6. Changes:shannonjr3-16/+17
* A couple of bug fixes for OCSP. * OCSP does now make use of the responder ID and optionally included certificates in the response to locate certificates. * No more lost file descriptors when loading CRLs via HTTP. * HTTP redirection for CRL and OCSP has been implemented. * Man pages are now build and installed from the texinfo source. Note, that you need to update libksba to version 1.0.0 for this release.
2006-10-11Update to 1.3 to sastify dependancies in several other packages.shannonjr3-11/+10
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-27 04:03:51 +0000