- (dtucker) [auth.c openbsd-compat/port-aix.c] Bug #1207: always call

[openssh.git] / ChangeLog

diff --git a/ChangeLog b/ChangeLog
index 6eb0086b684e8907f9fbf984c2962bd697a36cca..8f18cdac9852b60b9ac5f780ee06239f00ac7753 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -27,6 +27,15 @@
      [version.h]
      crank to 4.4
  - (djm) [openbsd-compat/xcrypt.c] needs unistd.h
+ - (dtucker) [auth.c openbsd-compat/port-aix.c] Bug #1207: always call
+   loginsuccess on AIX immediately after authentication to clear the failed
+   login count.  Previously this would only happen when an interactive
+   session starts (ie when a pty is allocated) but this means that accounts
+   that have primarily non-interactive sessions (eg scp's) may gradually
+   accumulate enough failures to lock out an account.  This change may have
+   a side effect of creating two audit records, one with a tty of "ssh"
+   corresponding to the authentication and one with the allocated pty per
+   interactive session.
 
 20060824
  - (dtucker) [openbsd-compat/basename.c] Include errno.h.