+20080704
+ - (dtucker) OpenBSD CVS Sync
+ - djm@cvs.openbsd.org 2008/07/02 13:30:34
+ [auth2.c]
+ really really remove the freebie "none" auth try for protocol 2
+ - djm@cvs.openbsd.org 2008/07/02 13:47:39
+ [ssh.1 ssh.c]
+ When forking after authentication ("ssh -f") with ExitOnForwardFailure
+ enabled, delay the fork until after replies for any -R forwards have
+ been seen. Allows for robust detection of -R forward failure when
+ using -f (similar to bz#92); ok dtucker@
+
20080702
- (dtucker) OpenBSD CVS Sync
- djm@cvs.openbsd.org 2008/06/30 08:05:59
[PROTOCOL.agent]
typo: s/constraint_date/constraint_data/
+ - djm@cvs.openbsd.org 2008/06/30 12:15:39
+ [serverloop.c]
+ only pass channel requests on session channels through to the session
+ channel handler, avoiding spurious log messages; ok! markus@
+ - djm@cvs.openbsd.org 2008/06/30 12:16:02
+ [nchan.c]
+ only send eow@openssh.com notifications for session channels; ok! markus@
+ - djm@cvs.openbsd.org 2008/06/30 12:18:34
+ [PROTOCOL]
+ clarify that eow@openssh.com is only sent on session channels
+ - dtucker@cvs.openbsd.org 2008/07/01 07:20:52
+ [sshconnect.c]
+ Check ExitOnForwardFailure if forwardings are disabled due to a failed
+ host key check. ok djm@
+ - dtucker@cvs.openbsd.org 2008/07/01 07:24:22
+ [sshconnect.c sshd.c]
+ Send CR LF during protocol banner exchanges, but only for Protocol 2 only,
+ in order to comply with RFC 4253. bz #1443, ok djm@
+ - stevesk@cvs.openbsd.org 2008/07/01 23:12:47
+ [PROTOCOL.agent]
+ fix some typos; ok djm@
+ - djm@cvs.openbsd.org 2008/07/02 02:24:18
+ [sshd_config sshd_config.5 sshd.8 servconf.c]
+ increase default size of ssh protocol 1 ephemeral key from 768 to 1024
+ bits; prodded by & ok dtucker@ ok deraadt@
+ - dtucker@cvs.openbsd.org 2008/07/02 12:03:51
+ [auth-rsa.c auth.c auth2-pubkey.c auth.h]
+ Merge duplicate host key file checks, based in part on a patch from Rob
+ Holland via bz #1348 . Also checks for non-regular files during protocol
+ 1 RSA auth. ok djm@
+ - djm@cvs.openbsd.org 2008/07/02 12:36:39
+ [auth2-none.c auth2.c]
+ Make protocol 2 MaxAuthTries behaviour a little more sensible:
+ Check whether client has exceeded MaxAuthTries before running
+ an authentication method and skip it if they have, previously it
+ would always allow one try (for "none" auth).
+ Preincrement failure count before post-auth test - previously this
+ checked and postincremented, also to allow one "none" try.
+ Together, these two changes always count the "none" auth method
+ which could be skipped by a malicious client (e.g. an SSH worm)
+ to get an extra attempt at a real auth method. They also make
+ MaxAuthTries=0 a useful way to block users entirely (esp. in a
+ sshd_config Match block).
+ Also, move sending of any preauth banner from "none" auth method
+ to the first call to input_userauth_request(), so worms that skip
+ the "none" method get to see it too.
20080630
- (djm) OpenBSD CVS Sync
andersk / openssh.git / blobdiff