X-Git-Url: http://andersk.mit.edu/gitweb/openssh.git/blobdiff_plain/8f02e0be25b8a5e1ba08453309fa5d35c2cc788d..6c7770902dc739dfa50de491e7af058309ccd560:/ChangeLog

diff --git a/ChangeLog b/ChangeLog
index 0f8da6a8..b5945b84 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,8 +1,66 @@
+20080704
+ - (dtucker) OpenBSD CVS Sync
+   - djm@cvs.openbsd.org 2008/07/02 13:30:34
+     [auth2.c]
+     really really remove the freebie "none" auth try for protocol 2
+   - djm@cvs.openbsd.org 2008/07/02 13:47:39
+     [ssh.1 ssh.c]
+     When forking after authentication ("ssh -f") with ExitOnForwardFailure
+     enabled, delay the fork until after replies for any -R forwards have
+     been seen. Allows for robust detection of -R forward failure when
+     using -f (similar to bz#92); ok dtucker@
+
 20080702
  - (dtucker) OpenBSD CVS Sync
     - djm@cvs.openbsd.org 2008/06/30 08:05:59
       [PROTOCOL.agent]
       typo: s/constraint_date/constraint_data/
+   - djm@cvs.openbsd.org 2008/06/30 12:15:39
+     [serverloop.c]
+     only pass channel requests on session channels through to the session
+     channel handler, avoiding spurious log messages; ok! markus@
+   - djm@cvs.openbsd.org 2008/06/30 12:16:02
+     [nchan.c]
+     only send eow@openssh.com notifications for session channels; ok! markus@
+   - djm@cvs.openbsd.org 2008/06/30 12:18:34
+     [PROTOCOL]
+     clarify that eow@openssh.com is only sent on session channels
+   - dtucker@cvs.openbsd.org 2008/07/01 07:20:52
+     [sshconnect.c]
+     Check ExitOnForwardFailure if forwardings are disabled due to a failed
+     host key check.  ok djm@
+   - dtucker@cvs.openbsd.org 2008/07/01 07:24:22
+     [sshconnect.c sshd.c]
+     Send CR LF during protocol banner exchanges, but only for Protocol 2 only,
+     in order to comply with RFC 4253.  bz #1443, ok djm@
+   - stevesk@cvs.openbsd.org 2008/07/01 23:12:47
+     [PROTOCOL.agent]
+     fix some typos; ok djm@
+   - djm@cvs.openbsd.org 2008/07/02 02:24:18
+     [sshd_config sshd_config.5 sshd.8 servconf.c]
+     increase default size of ssh protocol 1 ephemeral key from 768 to 1024
+     bits; prodded by & ok dtucker@ ok deraadt@
+   - dtucker@cvs.openbsd.org 2008/07/02 12:03:51
+     [auth-rsa.c auth.c auth2-pubkey.c auth.h]
+     Merge duplicate host key file checks, based in part on a patch from Rob
+     Holland via bz #1348 .  Also checks for non-regular files during protocol
+     1 RSA auth.  ok djm@
+   - djm@cvs.openbsd.org 2008/07/02 12:36:39
+     [auth2-none.c auth2.c]
+     Make protocol 2 MaxAuthTries behaviour a little more sensible:
+     Check whether client has exceeded MaxAuthTries before running
+     an authentication method and skip it if they have, previously it
+     would always allow one try (for "none" auth).
+     Preincrement failure count before post-auth test - previously this
+     checked and postincremented, also to allow one "none" try.
+     Together, these two changes always count the "none" auth method
+     which could be skipped by a malicious client (e.g. an SSH worm)
+     to get an extra attempt at a real auth method. They also make
+     MaxAuthTries=0 a useful way to block users entirely (esp. in a
+     sshd_config Match block).
+     Also, move sending of any preauth banner from "none" auth method
+     to the first call to input_userauth_request(), so worms that skip
+     the "none" method get to see it too.
 
 20080630
  - (djm) OpenBSD CVS Sync