+
+20001229
+ - (bal) Fixed spelling of 'authorized_keys' in ssh-copy-id.1 by Christian
+ Kurz <shorty@debain.org>
+ - (bal) OpenBSD CVS Update
+ - markus@cvs.openbsd.org 2000/12/28 14:25:51
+ [auth.h auth2.c]
+ count authentication failures only
+ - markus@cvs.openbsd.org 2000/12/28 14:25:03
+ [sshconnect.c]
+ fingerprint for MITM attacks, too.
+ - markus@cvs.openbsd.org 2000/12/28 12:03:57
+ [sshd.8 sshd.c]
+ document -D
+ - markus@cvs.openbsd.org 2000/12/27 14:19:21
+ [serverloop.c]
+ less chatty
+ - markus@cvs.openbsd.org 2000/12/27 12:34
+ [auth1.c sshconnect2.c sshd.c]
+ typo
+ - markus@cvs.openbsd.org 2000/12/27 12:30:19
+ [readconf.c readconf.h ssh.1 sshconnect.c]
+ new option: HostKeyAlias: allow the user to record the host key
+ under a different name. This is useful for ssh tunneling over
+ forwarded connections or if you run multiple sshd's on different
+ ports on the same machine.
+ - markus@cvs.openbsd.org 2000/12/27 11:51:53
+ [ssh.1 ssh.c]
+ multiple -t force pty allocation, document ORIGINAL_COMMAND
+ - markus@cvs.openbsd.org 2000/12/27 11:41:31
+ [sshd.8]
+ update for ssh-2
+
+20001228
+ - (bal) Patch to add libutil.h to loginrec.c only if the platform has
+ libutil.h. Suggested by Pekka Savola <pekka@netcore.fi>
+ - (djm) Update to new x11-askpass in RPM spec
+ - (bal) SCO patch to not include <sys/queue.h> since it's unrelated
+ header. Patch by Tim Rice <tim@multitalents.net>
+ - Updated TODO w/ known HP/UX issue
+ - (bal) removed extra <netdb.h> noticed by Kevin Steves and removed the
+ bad reference to 'NeXT including it else were' on the #ifdef version.
+
+20001227
+ - (bal) Typo in configure.in: entut?ent should be endut?ent. Suggested by
+ Takumi Yamane <yamtak@b-session.com>
+ - (bal) Checks for getrlimit(), sysconf(), and setdtablesize(). Patch
+ by Corinna Vinschen <vinschen@redhat.com>
+ - (djm) Fix catman-do target for non-bash
+ - (bal) Typo in configure.in: entut?ent should be endut?ent. Suggested by
+ Takumi Yamane <yamtak@b-session.com>
+ - (bal) Checks for getrlimit(), sysconf(), and setdtablesize(). Patch
+ by Corinna Vinschen <vinschen@redhat.com>
+ - (djm) Fix catman-do target for non-bash
+ - (bal) Fixed NeXT's lack of CPPFLAGS honoring.
+ - (bal) ssh-keyscan.c: NeXT (and older BSDs) don't support getrlimit() w/
+ 'RLIMIT_NOFILE'
+ - (djm) Remove *.Ylonen files. They are no longer in the OpenBSD tree,
+ the info in COPYING.Ylonen has been moved to the start of each
+ SSH1-derived file and README.Ylonen is well out of date.
+
+20001223
+ - (bal) Fixed Makefile.in to support recompile of all ssh and sshd objects
+ if a change to config.h has occurred. Suggested by Gert Doering
+ <gert@greenie.muc.de>
+ - (bal) OpenBSD CVS Update:
+ - markus@cvs.openbsd.org 2000/12/22 16:49:40
+ [ssh-keygen.c]
+ fix ssh-keygen -x -t type > file; from Roumen.Petrov@skalasoft.com
+
+20001222
+ - Updated RCSID for pty.c
+ - (bal) OpenBSD CVS Updates:
+ - markus@cvs.openbsd.org 2000/12/21 15:10:16
+ [auth-rh-rsa.c hostfile.c hostfile.h sshconnect.c]
+ print keyfile:line for changed hostkeys, for deraadt@, ok deraadt@
+ - markus@cvs.openbsd.org 2000/12/20 19:26:56
+ [authfile.c]
+ allow ssh -i userkey for root
+ - markus@cvs.openbsd.org 2000/12/20 19:37:21
+ [authfd.c authfd.h kex.c sshconnect2.c sshd.c uidswap.c uidswap.h]
+ fix prototypes; from stevesk@pobox.com
+ - markus@cvs.openbsd.org 2000/12/20 19:32:08
+ [sshd.c]
+ init pointer to NULL; report from Jan.Ivan@cern.ch
+ - markus@cvs.openbsd.org 2000/12/19 23:17:54
+ [auth-krb4.c auth-options.c auth-options.h auth-rhosts.c auth-rsa.c
+ auth1.c auth2-skey.c auth2.c authfd.c authfd.h authfile.c bufaux.c
+ bufaux.h buffer.c canohost.c channels.c clientloop.c compress.c
+ crc32.c deattack.c getput.h hmac.c hmac.h hostfile.c kex.c kex.h
+ key.c key.h log.c login.c match.c match.h mpaux.c mpaux.h packet.c
+ packet.h radix.c readconf.c rsa.c scp.c servconf.c servconf.h
+ serverloop.c session.c sftp-server.c ssh-agent.c ssh-dss.c ssh-dss.h
+ ssh-keygen.c ssh-keyscan.c ssh-rsa.c ssh-rsa.h ssh.c ssh.h uuencode.c
+ uuencode.h sshconnect1.c sshconnect2.c sshd.c tildexpand.c]
+ replace 'unsigned bla' with 'u_bla' everywhere. also replace 'char
+ unsigned' with u_char.
+
+20001221
+ - (stevesk) OpenBSD CVS updates:
+ - markus@cvs.openbsd.org 2000/12/19 15:43:45
+ [authfile.c channels.c sftp-server.c ssh-agent.c]
+ remove() -> unlink() for consistency
+ - markus@cvs.openbsd.org 2000/12/19 15:48:09
+ [ssh-keyscan.c]
+ replace <ssl/x.h> with <openssl/x.h>
+ - markus@cvs.openbsd.org 2000/12/17 02:33:40
+ [uidswap.c]
+ typo; from wsanchez@apple.com
+
+20001220
+ - (djm) Workaround PAM inconsistencies between Solaris derived PAM code
+ and Linux-PAM. Based on report and fix from Andrew Morgan
+ <morgan@transmeta.com>
+
+20001218
+ - (stevesk) rsa.c: entropy.h not needed.
+ - (bal) split CFLAGS into CFLAGS and CPPFLAGS in configure.in and Makefile.
+ Suggested by Wilfredo Sanchez <wsanchez@apple.com>
+
+20001216
+ - (stevesk) OpenBSD CVS updates:
+ - markus@cvs.openbsd.org 2000/12/16 02:53:57
+ [scp.c]
+ allow + in usernames; request from Florian.Weimer@RUS.Uni-Stuttgart.DE
+ - markus@cvs.openbsd.org 2000/12/16 02:39:57
+ [scp.c]
+ unused; from stevesk@pobox.com
+
+20001215
+ - (stevesk) Old OpenBSD patch wasn't completely applied:
+ - markus@cvs.openbsd.org 2000/01/24 22:11:20
+ [scp.c]
+ allow '.' in usernames; from jedgar@fxp.org
+ - (stevesk) OpenBSD CVS updates:
+ - markus@cvs.openbsd.org 2000/12/13 16:26:53
+ [ssh-keyscan.c]
+ fatal already adds \n; from stevesk@pobox.com
+ - markus@cvs.openbsd.org 2000/12/13 16:25:44
+ [ssh-agent.c]
+ remove redundant spaces; from stevesk@pobox.com
+ - ho@cvs.openbsd.org 2000/12/12 15:50:21
+ [pty.c]
+ When failing to set tty owner and mode on a read-only filesystem, don't
+ abort if the tty already has correct owner and reasonably sane modes.
+ Example; permit 'root' to login to a firewall with read-only root fs.
+ (markus@ ok)
+ - deraadt@cvs.openbsd.org 2000/12/13 06:36:05
+ [pty.c]
+ KNF
+ - markus@cvs.openbsd.org 2000/12/12 14:45:21
+ [sshd.c]
+ source port < 1024 is no longer required for rhosts-rsa since it
+ adds no additional security.
+ - markus@cvs.openbsd.org 2000/12/12 16:11:49
+ [ssh.1 ssh.c]
+ rhosts-rsa is no longer automagically disabled if ssh is not privileged.
+ UsePrivilegedPort=no disables rhosts-rsa _only_ for old servers.
+ these changes should not change the visible default behaviour of the ssh client.
+ - deraadt@cvs.openbsd.org 2000/12/11 10:27:33
+ [scp.c]
+ when copying 0-sized files, do not re-print ETA time at completion
+ - provos@cvs.openbsd.org 2000/12/15 10:30:15
+ [kex.c kex.h sshconnect2.c sshd.c]
+ compute diffie-hellman in parallel between server and client. okay markus@
+
+20001213
+ - (djm) Make sure we reset the SIGPIPE disposition after we fork. Report
+ from Andreas M. Kirchwitz <amk@krell.zikzak.de>
+ - (stevesk) OpenBSD CVS update:
+ - markus@cvs.openbsd.org 2000/12/12 15:30:02
+ [ssh-keyscan.c ssh.c sshd.c]
+ consistently use __progname; from stevesk@pobox.com
+
+20001211
+ - (bal) Applied patch to include ssh-keyscan into Redhat's package, and
+ patch to install ssh-keyscan manpage. Patch by Pekka Savola
+ <pekka@netcore.fi>
+ - (bal) OpenbSD CVS update
+ - markus@cvs.openbsd.org 2000/12/10 17:01:53
+ [sshconnect1.c]
+ always request new challenge for skey/tis-auth, fixes interop with
+ other implementations; report from roth@feep.net
+
+20001210
+ - (bal) OpenBSD CVS updates
+ - markus@cvs.openbsd.org 2000/12/09 13:41:51
+ [cipher.c cipher.h rijndael.c rijndael.h rijndael_boxes.h]
+ undo rijndael changes
+ - markus@cvs.openbsd.org 2000/12/09 13:48:31
+ [rijndael.c]
+ fix byte order bug w/o introducing new implementation
+ - markus@cvs.openbsd.org 2000/12/09 14:08:27
+ [sftp-server.c]
+ "" -> "." for realpath; from vinschen@redhat.com
+ - markus@cvs.openbsd.org 2000/12/09 14:06:54
+ [ssh-agent.c]
+ extern int optind; from stevesk@sweden.hp.com
+ - provos@cvs.openbsd.org 2000/12/09 23:51:11
+ [compat.c]
+ remove unnecessary '\n'
+
+20001209
+ - (bal) OpenBSD CVS updates:
+ - djm@cvs.openbsd.org 2000/12/07 4:24:59
+ [ssh.1]
+ Typo fix from Wilfredo Sanchez <wsanchez@apple.com>; ok theo
+
+20001207
+ - (bal) OpenBSD CVS updates:
+ - markus@cvs.openbsd.org 2000/12/06 22:58:14
+ [compat.c compat.h packet.c]
+ disable debug messages for ssh.com/f-secure 2.0.1x, 2.1.0
+ - markus@cvs.openbsd.org 2000/12/06 23:10:39
+ [rijndael.c]
+ unexpand(1)
+ - markus@cvs.openbsd.org 2000/12/06 23:05:43
+ [cipher.c cipher.h rijndael.c rijndael.h rijndael_boxes.h]
+ new rijndael implementation. fixes endian bugs
+
+20001206
+ - (bal) OpenBSD CVS updates:
+ - markus@cvs.openbsd.org 2000/12/05 20:34:09
+ [channels.c channels.h clientloop.c serverloop.c]
+ async connects for -R/-L; ok deraadt@
+ - todd@cvs.openssh.org 2000/12/05 16:47:28
+ [sshd.c]
+ tweak comment to reflect real location of pid file; ok provos@
+ - (stevesk) Import <sys/queue.h> from OpenBSD for systems that don't
+ have it (used in ssh-keyscan).
+ - (stevesk) OpenBSD CVS update:
+ - markus@cvs.openbsd.org 2000/12/06 19:57:48
+ [ssh-keyscan.c]
+ err(3) -> internal error(), from stevesk@sweden.hp.com
+
+20001205
+ - (bal) OpenBSD CVS updates:
+ - markus@cvs.openbsd.org 2000/12/04 19:24:02
+ [ssh-keyscan.c ssh-keyscan.1]
+ David Maziere's ssh-keyscan, ok niels@
+ - (bal) Updated Makefile.in to include ssh-keyscan that was just added
+ to the recent OpenBSD source tree.
+ - (stevesk) fix typos in contrib/hpux/README
+
+20001204
+ - (bal) More C functions defined in NeXT that are unaccessable without
+ defining -POSIX.
+ - (bal) OpenBSD CVS updates:
+ - markus@cvs.openbsd.org 2000/12/03 11:29:04
+ [compat.c]
+ remove fallback to SSH_BUG_HMAC now that the drafts are updated
+ - markus@cvs.openbsd.org 2000/12/03 11:27:55
+ [compat.c]
+ correctly match "2.1.0.pl2 SSH" etc; from
+ pekkas@netcore.fi/bugzilla.redhat
+ - markus@cvs.openbsd.org 2000/12/03 11:15:03
+ [auth2.c compat.c compat.h sshconnect2.c]
+ support f-secure/ssh.com 2.0.12; ok niels@
+
+20001203
+ - (bal) OpenBSD CVS updates:
+ - markus@cvs.openbsd.org 2000/11/30 22:54:31
+ [channels.c]
+ debug->warn if tried to do -R style fwd w/o client requesting this;
+ ok neils@
+ - markus@cvs.openbsd.org 2000/11/29 20:39:17
+ [cipher.c]
+ des_cbc_encrypt -> des_ncbc_encrypt since it already updates the IV
+ - markus@cvs.openbsd.org 2000/11/30 18:33:05
+ [ssh-agent.c]
+ agents must not dump core, ok niels@
+ - markus@cvs.openbsd.org 2000/11/30 07:04:02
+ [ssh.1]
+ T is for both protocols
+ - markus@cvs.openbsd.org 2000/12/01 00:00:51
+ [ssh.1]
+ typo; from green@FreeBSD.org
+ - markus@cvs.openbsd.org 2000/11/30 07:02:35
+ [ssh.c]
+ check -T before isatty()
+ - provos@cvs.openbsd.org 2000/11/29 13:51:27
+ [sshconnect.c]
+ show IP address and hostname when new key is encountered. okay markus@
+ - markus@cvs.openbsd.org 2000/11/30 22:53:35
+ [sshconnect.c]
+ disable agent/x11/port fwding if hostkey has changed; ok niels@
+ - marksu@cvs.openbsd.org 2000/11/29 21:11:59
+ [sshd.c]
+ sshd -D, startup w/o deamon(), for monitoring scripts or inittab;
+ from handler@sub-rosa.com and eric@urbanrange.com; ok niels@
+ - (djm) Added patch from Nalin Dahyabhai <nalin@redhat.com> to enable
+ PAM authentication using KbdInteractive.
+ - (djm) Added another TODO
+
+20001202
+ - (bal) Backed out of part of Alain St-Denis' loginrec.c patch.
+ - (bal) Irix need some sort of mansubdir, patch by Michael Stone
+ <mstone@cs.loyola.edu>
+
+20001129
+ - (djm) Back out all the serverloop.c hacks. sshd will now hang again
+ if there are background children with open fds.
+ - (djm) bsd-rresvport.c bzero -> memset
+ - (djm) Don't fail in defines.h on absence of 64 bit types (we will
+ still fail during compilation of sftp-server).
+ - (djm) Fail if ar is not found during configure
+ - (djm) OpenBSD CVS updates:
+ - provos@cvs.openbsd.org 2000/11/22 08:38:31
+ [sshd.8]
+ talk about /etc/primes, okay markus@
+ - markus@cvs.openbsd.org 2000/11/23 14:03:48
+ [ssh.c sshconnect1.c sshconnect2.c]
+ complain about invalid ciphers for ssh1/ssh2, fall back to reasonable
+ defaults
+ - markus@cvs.openbsd.org 2000/11/25 09:42:53
+ [sshconnect1.c]
+ reorder check for illegal ciphers, bugreport from espie@
+ - markus@cvs.openbsd.org 2000/11/25 10:19:34
+ [ssh-keygen.c ssh.h]
+ print keytype when generating a key.
+ reasonable defaults for RSA1/RSA/DSA keys.
+ - (djm) Patch from Pekka Savola <Pekka.Savola@netcore.fi> to include a few
+ more manpage paths in fixpaths calls
+ - (djm) Also add xauth path at Pekka's suggestion.
+ - (djm) Add Redhat RPM patch for AUTHPRIV SyslogFacility
+
+20001125
+ - (djm) Give up privs when reading seed file
+
+20001123
+ - (bal) Merge OpenBSD changes:
+ - markus@cvs.openbsd.org 2000/11/15 22:31:36
+ [auth-options.c]
+ case insensitive key options; from stevesk@sweeden.hp.com
+ - markus@cvs.openbsd.org 2000/11/16 17:55:43
+ [dh.c]
+ do not use perror() in sshd, after child is forked()
+ - markus@cvs.openbsd.org 2000/11/14 23:42:40
+ [auth-rsa.c]
+ parse option only if key matches; fix some confusing seen by the client
+ - markus@cvs.openbsd.org 2000/11/14 23:44:19
+ [session.c]
+ check no_agent_forward_flag for ssh-2, too
+ - markus@cvs.openbsd.org 2000/11/15
+ [ssh-agent.1]
+ reorder SYNOPSIS; typo, use .It
+ - markus@cvs.openbsd.org 2000/11/14 23:48:55
+ [ssh-agent.c]
+ do not reorder keys if a key is removed
+ - markus@cvs.openbsd.org 2000/11/15 19:58:08
+ [ssh.c]
+ just ignore non existing user keys
+ - millert@cvs.openbsd.org 200/11/15 20:24:43
+ [ssh-keygen.c]
+ Add missing \n at end of error message.
+
+20001122
+ - (bal) Minor patch to ensure platforms lacking IRIX job limit supports
+ are compilable.
+ - (bal) Updated TODO as of 11/18/2000 with known things to resolve.
+
+20001117
+ - (bal) Changed from 'primes' to 'primes.out' for consistancy sake. It
+ has no affect the output. Patch by Corinna Vinschen <vinschen@redhat.com>
+ - (stevesk) Reworked progname support.
+ - (bal) Misplaced #include "includes.h" in bsd-setproctitle.c. Patch by
+ Shinichi Maruyama <marya@st.jip.co.jp>
+
+20001116
+ - (bal) Added in MAXSYMLINK test in bsd-realpath.c. Required for some SCO
+ releases.
+ - (bal) Make builds work outside of source tree. Patch by Mark D. Roth
+ <roth@feep.net>
+
+20001113
+ - (djm) Add pointer to http://www.imasy.or.jp/~gotoh/connect.c to
+ contrib/README
+ - (djm) Merge OpenBSD changes:
+ - markus@cvs.openbsd.org 2000/11/06 16:04:56
+ [channels.c channels.h clientloop.c nchan.c serverloop.c]
+ [session.c ssh.c]
+ agent forwarding and -R for ssh2, based on work from
+ jhuuskon@messi.uku.fi
+ - markus@cvs.openbsd.org 2000/11/06 16:13:27
+ [ssh.c sshconnect.c sshd.c]
+ do not disabled rhosts(rsa) if server port > 1024; from
+ pekkas@netcore.fi
+ - markus@cvs.openbsd.org 2000/11/06 16:16:35
+ [sshconnect.c]
+ downgrade client to 1.3 if server is 1.4; help from mdb@juniper.net
+ - markus@cvs.openbsd.org 2000/11/09 18:04:40
+ [auth1.c]
+ typo; from mouring@pconline.com
+ - markus@cvs.openbsd.org 2000/11/12 12:03:28
+ [ssh-agent.c]
+ off-by-one when removing a key from the agent
+ - markus@cvs.openbsd.org 2000/11/12 12:50:39
+ [auth-rh-rsa.c auth2.c authfd.c authfd.h]
+ [authfile.c hostfile.c kex.c kex.h key.c key.h myproposal.h]
+ [readconf.c readconf.h rsa.c rsa.h servconf.c servconf.h ssh-add.c]
+ [ssh-agent.c ssh-keygen.1 ssh-keygen.c ssh.1 ssh.c ssh_config]
+ [sshconnect1.c sshconnect2.c sshd.8 sshd.c sshd_config ssh-dss.c]
+ [ssh-dss.h ssh-rsa.c ssh-rsa.h dsa.c dsa.h]
+ add support for RSA to SSH2. please test.
+ there are now 3 types of keys: RSA1 is used by ssh-1 only,
+ RSA and DSA are used by SSH2.
+ you can use 'ssh-keygen -t rsa -f ssh2_rsa_file' to generate RSA
+ keys for SSH2 and use the RSA keys for hostkeys or for user keys.
+ SSH2 RSA or DSA keys are added to .ssh/authorised_keys2 as before.
+ - (djm) Fix up Makefile and Redhat init script to create RSA host keys
+ - (djm) Change to interim version
+ - (djm) Fix RPM spec file stupidity
+ - (djm) fixpaths to DSA and RSA keys too
+
+20001112
+ - (bal) SCO Patch to add needed libraries for configure.in. Patch by
+ Phillips Porch <root@theporch.com>
+ - (bal) IRIX patch to adding Job Limits. Patch by Denis Parker
+ <dcp@sgi.com>
+ - (stevesk) pty.c: HP-UX 10 and 11 don't define TIOCSCTTY. Add error() to
+ failed ioctl(TIOCSCTTY) call.
+
+20001111
+ - (djm) Added /etc/primes for kex DH group neg, fixup Makefile.in and
+ packaging files
+ - (djm) Fix new Makefile.in warnings
+ - (djm) Fix vsprintf("%h") in bsd-snprintf.c, short int va_args are
+ promoted to type int. Report and fix from Dan Astoorian
+ <djast@cs.toronto.edu>
+ - (djm) Hardwire sysconfdir in RPM spec files as some RPM versions get
+ it wrong. Report from Bennett Todd <bet@rahul.net>
+
+20001110
+ - (bal) Fixed dropped answer from skey_keyinfo() in auth1.c
+ - (bal) Changed from --with-skey to --with-skey=PATH in configure.in
+ - (bal) Added in check to verify S/Key library is being detected in
+ configure.in
+ - (bal) next-posix.h - added another prototype wrapped in POSIX ifdef/endif.
+ Patch by Mark Miller <markm@swoon.net>
+ - (bal) Added 'util.h' header to loginrec.c only if HAVE_UTIL_H is defined
+ to remove warnings under MacOS X. Patch by Mark Miller <markm@swoon.net>
+ - (bal) Fixed LDFLAG mispelling in configure.in for --with-afs
+
20001107
- (bal) acconfig.in - removed the double "USE_PIPES" entry. Patch by
Mark Miller <markm@swoon.net>