djm [Mon, 3 Nov 2008 08:24:45 +0000 (08:24 +0000)]
- stevesk@cvs.openbsd.org 2008/10/10 16:43:27
[ssh_config.5]
use 'Privileged ports can be forwarded only when logging in as root on
the remote machine.' for RemoteForward just like ssh.1 -R.
ok djm@ jmc@
djm [Mon, 3 Nov 2008 08:23:10 +0000 (08:23 +0000)]
- djm@cvs.openbsd.org 2008/10/09 03:50:54
[servconf.c sshd_config.5]
support setting PermitEmptyPasswords in a Match block
requested in PR3891; ok dtucker@
djm [Mon, 3 Nov 2008 08:22:37 +0000 (08:22 +0000)]
- djm@cvs.openbsd.org 2008/10/08 23:34:03
[ssh.1 ssh.c]
Add -y option to force logging via syslog rather than stderr.
Useful for daemonised ssh connection (ssh -f). Patch originally from
and ok'd by markus@
djm [Mon, 3 Nov 2008 08:22:09 +0000 (08:22 +0000)]
aadt@cvs.openbsd.org 2008/10/03 23:56:28
[sshconnect2.c]
Repair strnvis() buffersize of 4*n+1, with termination gauranteed by the
function.
spotted by des@freebsd, who commited an incorrect fix to the freebsd tree
and (as is fairly typical) did not report the problem to us. But this fix
is correct.
ok djm
djm [Mon, 3 Nov 2008 08:21:21 +0000 (08:21 +0000)]
- jmc@cvs.openbsd.org 2008/10/03 13:08:12
[sshd.8]
do not give an example of how to chmod files: we can presume the user
knows that. removes an ambiguity in the permission of authorized_keys;
ok deraadt
djm [Mon, 3 Nov 2008 08:20:10 +0000 (08:20 +0000)]
- markus@cvs.openbsd.org 2008/09/11 14:22:37
[compat.c compat.h nchan.c ssh.c]
only send eow and no-more-sessions requests to openssh 5 and newer;
fixes interop problems with broken ssh v2 implementations; ok djm@
djm [Mon, 3 Nov 2008 08:19:12 +0000 (08:19 +0000)]
- djm@cvs.openbsd.org 2008/09/06 12:24:13
[kex.c]
OpenSSL 0.9.8h supplies a real EVP_sha256 so we do not need our
replacement anymore
(ID sync only for portable - we still need this)
djm [Mon, 3 Nov 2008 08:17:57 +0000 (08:17 +0000)]
- djm@cvs.openbsd.org 2008/08/21 04:09:57
[session.c]
allow ForceCommand internal-sftp with arguments. based on patch from
michael.barabanov AT gmail.com; ok markus@
djm [Mon, 3 Nov 2008 08:16:20 +0000 (08:16 +0000)]
- grunk@cvs.openbsd.org 2008/07/25 07:05:16
[key.c]
In random art visualization, make sure to use the end marker only at the
end. Initial diff by Dirk Loss, tweaks and ok djm@
dtucker [Fri, 29 Aug 2008 21:32:37 +0000 (21:32 +0000)]
- (dtucker) [openbsd-compat/bsd-poll.c] correctly check for number of FDs
larger than FD_SETSIZE (OpenSSH only ever uses poll with one fd). Patch
from Nicholas Marriott.
- djm@cvs.openbsd.org 2008/07/23 07:36:55
[servconf.c]
do not try to print options that have been compile-time disabled
in config test mode (sshd -T); report from nix-corp AT esperi.org.uk
ok dtucker@
- (dtucker) [openbsd-compat/bsd-cygwin_util.c] Remove long-unneeded compat
code, replace with equivalent cygwin library call. Patch from vinschen
at redhat.comi, ok djm@.
- djm@cvs.openbsd.org 2008/07/17 08:51:07
[auth2-hostbased.c]
strip trailing '.' from hostname when HostbasedUsesNameFromPacketOnly=yes
report and patch from res AT qoxp.net (bz#1200); ok markus@
- (djm) [openbsd-compat/fake-rfc2553.c openbsd-compat/fake-rfc2553.h]
return EAI_FAMILY when trying to lookup unsupported address family;
from vinschen AT redhat.com
- (djm) [openbsd-compat/bindresvport.c] Rename variables s/sin/in/ to
avoid clash with sin(3) function; reported by
cristian.ionescu-idbohrn AT axis.com
- djm@cvs.openbsd.org 2008/07/13 22:16:03
[sftp.c]
increase number of piplelined requests so they properly fill the
(recently increased) channel window. prompted by rapier AT psc.edu;
ok markus@
- djm@cvs.openbsd.org 2008/07/13 22:13:07
[channels.c]
use struct sockaddr_storage instead of struct sockaddr for accept(2)
address argument. from visibilis AT yahoo.com in bz#1485; ok markus@
- sthen@cvs.openbsd.org 2008/07/13 21:22:52
[ssh-keygen.c]
Change "ssh-keygen -F [host] -l" to not display random art unless
-v is also specified, making it consistent with the manual and other
uses of -l.
ok grunk@
- (djm) OpenBSD CVS Sync
- djm@cvs.openbsd.org 2008/07/12 04:52:50
[channels.c]
unbreak; move clearing of cctx struct to before first use
reported by dkrause@
- stevesk@cvs.openbsd.org 2008/07/07 23:32:51
[key.c]
/*NOTREACHED*/ for lint warning:
warning: function key_equal falls off bottom without returning value
ok djm@
- (djm) [auth1.c] Fix format string vulnerability in protocol 1 PAM
account check failure path. The vulnerable format buffer is supplied
from PAM and should not contain attacker-supplied data.
- djm@cvs.openbsd.org 2008/07/04 23:30:16
[auth1.c auth2.c]
Make protocol 1 MaxAuthTries logic match protocol 2's.
Do not treat the first protocol 2 authentication attempt as
a failure IFF it is for method "none".
Makes MaxAuthTries' user-visible behaviour identical for
protocol 1 vs 2.
ok dtucker@
- (djm) [atomicio.c configure.ac] Disable poll() fallback in atomiciov for
Tru64. readv doesn't seem to be a comparable object there.
bz#1386, patch from dtucker@ ok me
- (djm) [auth.c] Fixed test for locked account on HP/UX with shadowed
passwords disabled. bz#1083 report & patch from senthilkumar_sen AT
hotpop.com, w/ dtucker@
- (djm) [atomicio.c channels.c clientloop.c defines.h includes.h]
[packet.c scp.c serverloop.c sftp-client.c ssh-agent.c ssh-keyscan.c]
[sshd.c] Explicitly handle EWOULDBLOCK wherever we handle EAGAIN, on
some platforms (HP nonstop) it is a distinct errno;
bz#1467 reported by sconeu AT yahoo.com; ok dtucker@
- djm@cvs.openbsd.org 2008/07/04 03:44:59
[servconf.c groupaccess.h groupaccess.c]
support negation of groups in "Match group" block (bz#1315); ok dtucker@
- djm@cvs.openbsd.org 2008/07/02 13:47:39
[ssh.1 ssh.c]
When forking after authentication ("ssh -f") with ExitOnForwardFailure
enabled, delay the fork until after replies for any -R forwards have
been seen. Allows for robust detection of -R forward failure when
using -f (similar to bz#92); ok dtucker@
- djm@cvs.openbsd.org 2008/07/02 12:36:39
[auth2-none.c auth2.c]
Make protocol 2 MaxAuthTries behaviour a little more sensible:
Check whether client has exceeded MaxAuthTries before running
an authentication method and skip it if they have, previously it
would always allow one try (for "none" auth).
Preincrement failure count before post-auth test - previously this
checked and postincremented, also to allow one "none" try.
Together, these two changes always count the "none" auth method
which could be skipped by a malicious client (e.g. an SSH worm)
to get an extra attempt at a real auth method. They also make
MaxAuthTries=0 a useful way to block users entirely (esp. in a
sshd_config Match block).
Also, move sending of any preauth banner from "none" auth method
to the first call to input_userauth_request(), so worms that skip
the "none" method get to see it too.
- dtucker@cvs.openbsd.org 2008/07/02 12:03:51
[auth-rsa.c auth.c auth2-pubkey.c auth.h]
Merge duplicate host key file checks, based in part on a patch from Rob
Holland via bz #1348 . Also checks for non-regular files during protocol
1 RSA auth. ok djm@
- djm@cvs.openbsd.org 2008/07/02 02:24:18
[sshd_config sshd_config.5 sshd.8 servconf.c]
increase default size of ssh protocol 1 ephemeral key from 768 to 1024
bits; prodded by & ok dtucker@ ok deraadt@
- dtucker@cvs.openbsd.org 2008/07/01 07:24:22
[sshconnect.c sshd.c]
Send CR LF during protocol banner exchanges, but only for Protocol 2 only,
in order to comply with RFC 4253. bz #1443, ok djm@
- dtucker@cvs.openbsd.org 2008/07/01 07:20:52
[sshconnect.c]
Check ExitOnForwardFailure if forwardings are disabled due to a failed
host key check. ok djm@
- djm@cvs.openbsd.org 2008/06/30 12:15:39
[serverloop.c]
only pass channel requests on session channels through to the session
channel handler, avoiding spurious log messages; ok! markus@
djm [Sun, 29 Jun 2008 22:07:56 +0000 (22:07 +0000)]
- djm@cvs.openbsd.org 2008/06/28 13:57:25
[regress/Makefile regress/test-exec.sh regress/conch-ciphers.sh]
very basic regress test against Twisted Conch in "make interop"
target (conch is available in ports/devel/py-twisted/conch);
ok markus@
djm [Sun, 29 Jun 2008 14:05:48 +0000 (14:05 +0000)]
- djm@cvs.openbsd.org 2008/06/28 14:05:15
[ssh-agent.c]
reset global compat flag after processing a protocol 2 signature
request with the legacy DSA encoding flag set; ok markus
djm [Sun, 29 Jun 2008 14:04:03 +0000 (14:04 +0000)]
- grunk@cvs.openbsd.org 2008/06/26 11:46:31
[readconf.c readconf.h ssh.1 ssh_config.5 sshconnect.c]
Move SSH Fingerprint Visualization away from sharing the config option
CheckHostIP to an own config option named VisualHostKey.
While there, fix the behaviour that ssh would draw a random art picture
on every newly seen host even when the option was not enabled.
prodded by deraadt@, discussions,
help and ok markus@ djm@ dtucker@
djm [Sun, 29 Jun 2008 12:47:04 +0000 (12:47 +0000)]
- djm@cvs.openbsd.org 2008/06/26 09:19:40
[dh.c dh.h moduli.c]
when loading moduli from /etc/moduli in sshd(8), check that they
are of the expected "safe prime" structure and have had
appropriate primality tests performed;
feedback and ok dtucker@
djm [Sun, 29 Jun 2008 12:46:35 +0000 (12:46 +0000)]
- djm@cvs.openbsd.org 2008/06/26 06:10:09
[sftp-client.c sftp-server.c]
allow the sftp chmod(2)-equivalent operation to set set[ug]id/sticky
bits. Note that this only affects explicit setting of modes (e.g. via
sftp(1)'s chmod command) and not file transfers. (bz#1310)
ok deraadt@ at c2k8
djm [Sun, 29 Jun 2008 12:45:13 +0000 (12:45 +0000)]
- (djm) OpenBSD CVS Sync
- martynas@cvs.openbsd.org 2008/06/21 07:46:46
[sftp.c]
use optopt to get invalid flag, instead of return value of getopt,
which is always '?'; ok djm@
andersk / openssh.git / log
