+20080704
+ - (dtucker) OpenBSD CVS Sync
+ - djm@cvs.openbsd.org 2008/07/02 13:30:34
+ [auth2.c]
+ really really remove the freebie "none" auth try for protocol 2
+ - djm@cvs.openbsd.org 2008/07/02 13:47:39
+ [ssh.1 ssh.c]
+ When forking after authentication ("ssh -f") with ExitOnForwardFailure
+ enabled, delay the fork until after replies for any -R forwards have
+ been seen. Allows for robust detection of -R forward failure when
+ using -f (similar to bz#92); ok dtucker@
+ - otto@cvs.openbsd.org 2008/07/03 21:46:58
+ [auth2-pubkey.c]
+ avoid nasty double free; ok dtucker@ djm@
+ - djm@cvs.openbsd.org 2008/07/04 03:44:59
+ [servconf.c groupaccess.h groupaccess.c]
+ support negation of groups in "Match group" block (bz#1315); ok dtucker@
+ - dtucker@cvs.openbsd.org 2008/07/04 03:47:02
+ [monitor.c]
+ Make debug a little clearer. ok djm@
+ - (dtucker) [sftp-server.c] Bug #1447: fall back to racy rename if link
+ returns EXDEV. Patch from Mike Garrison, ok djm@
+
+20080702
+ - (dtucker) OpenBSD CVS Sync
+ - djm@cvs.openbsd.org 2008/06/30 08:05:59
+ [PROTOCOL.agent]
+ typo: s/constraint_date/constraint_data/
+ - djm@cvs.openbsd.org 2008/06/30 12:15:39
+ [serverloop.c]
+ only pass channel requests on session channels through to the session
+ channel handler, avoiding spurious log messages; ok! markus@
+ - djm@cvs.openbsd.org 2008/06/30 12:16:02
+ [nchan.c]
+ only send eow@openssh.com notifications for session channels; ok! markus@
+ - djm@cvs.openbsd.org 2008/06/30 12:18:34
+ [PROTOCOL]
+ clarify that eow@openssh.com is only sent on session channels
+ - dtucker@cvs.openbsd.org 2008/07/01 07:20:52
+ [sshconnect.c]
+ Check ExitOnForwardFailure if forwardings are disabled due to a failed
+ host key check. ok djm@
+ - dtucker@cvs.openbsd.org 2008/07/01 07:24:22
+ [sshconnect.c sshd.c]
+ Send CR LF during protocol banner exchanges, but only for Protocol 2 only,
+ in order to comply with RFC 4253. bz #1443, ok djm@
+ - stevesk@cvs.openbsd.org 2008/07/01 23:12:47
+ [PROTOCOL.agent]
+ fix some typos; ok djm@
+ - djm@cvs.openbsd.org 2008/07/02 02:24:18
+ [sshd_config sshd_config.5 sshd.8 servconf.c]
+ increase default size of ssh protocol 1 ephemeral key from 768 to 1024
+ bits; prodded by & ok dtucker@ ok deraadt@
+ - dtucker@cvs.openbsd.org 2008/07/02 12:03:51
+ [auth-rsa.c auth.c auth2-pubkey.c auth.h]
+ Merge duplicate host key file checks, based in part on a patch from Rob
+ Holland via bz #1348 . Also checks for non-regular files during protocol
+ 1 RSA auth. ok djm@
+ - djm@cvs.openbsd.org 2008/07/02 12:36:39
+ [auth2-none.c auth2.c]
+ Make protocol 2 MaxAuthTries behaviour a little more sensible:
+ Check whether client has exceeded MaxAuthTries before running
+ an authentication method and skip it if they have, previously it
+ would always allow one try (for "none" auth).
+ Preincrement failure count before post-auth test - previously this
+ checked and postincremented, also to allow one "none" try.
+ Together, these two changes always count the "none" auth method
+ which could be skipped by a malicious client (e.g. an SSH worm)
+ to get an extra attempt at a real auth method. They also make
+ MaxAuthTries=0 a useful way to block users entirely (esp. in a
+ sshd_config Match block).
+ Also, move sending of any preauth banner from "none" auth method
+ to the first call to input_userauth_request(), so worms that skip
+ the "none" method get to see it too.
+
20080630
- (djm) OpenBSD CVS Sync
- dtucker@cvs.openbsd.org 2008/06/10 23:13:43
[regress/Makefile regress/key-options.sh]
Add regress test for key options. ok djm@
- dtucker@cvs.openbsd.org 2008/06/11 23:11:40
- [Makefile]
+ [regress/Makefile]
Don't run cipher-speed test by default; mistakenly enabled by me
+ - djm@cvs.openbsd.org 2008/06/28 13:57:25
+ [regress/Makefile regress/test-exec.sh regress/conch-ciphers.sh]
+ very basic regress test against Twisted Conch in "make interop"
+ target (conch is available in ports/devel/py-twisted/conch);
+ ok markus@
+ - (djm) [regress/Makefile] search for conch by path, like we do putty
20080629
- (djm) OpenBSD CVS Sync
andersk / openssh.git / blobdiff