- deraadt@cvs.openbsd.org 2002/05/22 23:18:25

[openssh.git] / TODO

diff --git a/TODO b/TODO
index c8b2e83fa802cf34361f50f2543a4e7d2e4120e7..11abaf67122c75c9da7c91823cc9eb8da2f1e825 100644 (file)
--- a/TODO
+++ b/TODO
@@ -1,16 +1,36 @@
 Programming:
 - Grep for 'XXX' comments and fix
 
+- Link order is incorrect for some systems using Kerberos 4 and AFS. Result
+  is multiple inclusion of DES symbols. Holger Trapp 
+  <holger.trapp@hrz.tu-chemnitz.de> reports that changing the configure
+  generated link order from:
+       -lresolv -lkrb -lz -lnsl  -lutil -lkafs -lkrb -ldes -lcrypto
+  to:
+       -lresolv -lkrb -lz -lnsl  -lutil -lcrypto -lkafs -lkrb -ldes
+  fixing the problem.
+
 - Write a test program that calls stat() to search for EGD/PRNGd socket
-  rather than use the (non-portable) "test -S".
+  rather than use the (non-portable) "test -S". 
+
+- Replacement for setproctitle() - HP-UX support only currently
 
-- Replacement for setproctitle() - HP/UX support only currently
+- Handle changing passwords for the non-PAM expired password case
 
 - Improve PAM support (a pam_lastlog module will cause sshd to exit)
   and maybe support alternate forms of authenications like OPIE via
   pam?
 
+- Rework PAM ChallengeResponseAuthentication
+ - Use kbdint request packet with 0 prompts for informational messages
+ - Use different PAM service name for kbdint vs regular auth (suggest from
+   Solar Designer)
+ - Ability to select which ChallengeResponseAuthentications may be used
+   and order to try them in e.g. "ChallengeResponseAuthentication skey, pam"
+
 - Complete Tru64 SIA support
+ - It looks like we could merge it into the password auth code to cut down
+   on diff size. Maybe PAM password auth too?
 
 - Finish integrating kernel-level auditing code for IRIX and SOLARIS
   (Gilbert.r.loomis@saic.com)
@@ -22,12 +42,14 @@ Programming:
   solutions break scp or leaves processes hanging around after the ssh
   connection has ended.  It seems to be linked to two things.  One
   select() under Linux is not as nice as others, and two the children
-  of the shell are not killed on exiting the shell.
+  of the shell are not killed on exiting the shell. Redhat have an excellent
+  description of this in their RPM package.
 
 - Build an automated test suite
 
-- Verify that It's safe to enable NGROUPS_MAX under NeXTStep for
-  groupaccess features.
+- 64-bit builds on HP-UX 11.X (stevesk@pobox.com):
+  - utmp/wtmp get corrupted (something in loginrec?)
+  - can't build with PAM (no 64-bit libpam yet)
 
 Documentation:
 - More and better
@@ -40,12 +62,10 @@ Documentation:
 - Create a Documentation/ directory?
 
 Clean up configure/makefiles:
-- Clean up configure.in - There are a few double #defined variables
-  left to do.  HAVE_LOGIN is one of them.  Consider NOT looking for information
-  in wtmpx or utmpx or any of that stuff if it's not detected from the start
-
-- Fix Make functionality so that build from a different directory work. 
-  (roth@feep.net)
+- Clean up configure.ac - There are a few double #defined variables
+  left to do.  HAVE_LOGIN is one of them.  Consider NOT looking for
+  information in wtmpx or utmpx or any of that stuff if it's not detected
+  from the start
 
 - Fails to compile when cross compile.
   (vinschen@redhat.com)
@@ -55,9 +75,16 @@ Clean up configure/makefiles:
 - Consider splitting the u_intXX_t test for sys/bitype.h  into seperate test
   to allow people to (right/wrongfully) link against Bind directly.
 
+- Consider splitting configure.ac into seperate files which do logically
+  similar tests. E.g move all the type detection stuff into one file, 
+  entropy related stuff into another.
+
 Packaging:
 - Solaris: Update packaging scripts and build new sysv startup scripts
+  Ideally the package metadata should be generated by autoconf.
   (gilbert.r.loomis@saic.com)
 
-- HP/UX: Provide DEPOT package scripts.
+- HP-UX: Provide DEPOT package scripts.
   (gilbert.r.loomis@saic.com)
+
+$Id$