The NetBSD Project

CVS log for pkgsrc/security/openssh/options.mk

[BACK] Up to [cvs.NetBSD.org] / pkgsrc / security / openssh

Request diff between arbitrary revisions


Keyword substitution: kv
Default branch: MAIN


Revision 1.50: download - view: text, markup, annotated - select for diffs
Tue Jul 23 06:38:22 2024 UTC (4 months, 2 weeks ago) by wiz
Branches: MAIN
CVS tags: pkgsrc-2024Q3-base, pkgsrc-2024Q3, HEAD
Diff to: previous 1.49: preferred, colored
Changes since revision 1.49: +6 -3 lines
openssh: rename legacymodsz option to openssh-legacymodsz

Revision 1.49: download - view: text, markup, annotated - select for diffs
Thu Apr 11 05:29:57 2024 UTC (8 months ago) by schmonz
Branches: MAIN
CVS tags: pkgsrc-2024Q2-base, pkgsrc-2024Q2
Diff to: previous 1.48: preferred, colored
Changes since revision 1.48: +2 -2 lines
openssh: default-on pam for macOS, create pid dir.

Revision 1.48: download - view: text, markup, annotated - select for diffs
Fri Dec 1 11:01:05 2023 UTC (12 months, 1 week ago) by nia
Branches: MAIN
CVS tags: pkgsrc-2024Q1-base, pkgsrc-2024Q1, pkgsrc-2023Q4-base, pkgsrc-2023Q4
Diff to: previous 1.47: preferred, colored
Changes since revision 1.47: +4 -8 lines
openssh: Query PLATFORM_SUPPORTS_FIDO2 for fido option default

Revision 1.47: download - view: text, markup, annotated - select for diffs
Wed Nov 8 10:48:45 2023 UTC (13 months ago) by nia
Branches: MAIN
Diff to: previous 1.46: preferred, colored
Changes since revision 1.46: +2 -2 lines
openssh: Be a bit less optimistic about fidoo2 support in legacy Darwin.

Revision 1.46: download - view: text, markup, annotated - select for diffs
Tue Nov 7 00:40:43 2023 UTC (13 months ago) by gdt
Branches: MAIN
Diff to: previous 1.45: preferred, colored
Changes since revision 1.45: +8 -3 lines
security/openssh: Enable fido option on all platforms where libfido2 is not BROKEN

Revision 1.45: download - view: text, markup, annotated - select for diffs
Mon Nov 6 13:48:41 2023 UTC (13 months ago) by gdt
Branches: MAIN
Diff to: previous 1.44: preferred, colored
Changes since revision 1.44: +1 -3 lines
security/openssh: Don't set MESSAGE vars for pam

because the MESSAGE is gone

Revision 1.44: download - view: text, markup, annotated - select for diffs
Mon Nov 6 13:34:32 2023 UTC (13 months ago) by gdt
Branches: MAIN
Diff to: previous 1.43: preferred, colored
Changes since revision 1.43: +11 -3 lines
security/openssh: Only disable fido on SunOS

Relative to revision 1.40, this disables the fido option on SunOS,
because libfido2 doesn't build there.  This differs from the previous
commits, which disabled fido everywhere but NetBSD, and then
everywhere but NetBSD and Darwin.  Surely it works on Linux, and in
general it ought to work everywhere.

Revision 1.43: download - view: text, markup, annotated - select for diffs
Mon Nov 6 10:21:09 2023 UTC (13 months ago) by jperkin
Branches: MAIN
Diff to: previous 1.42: preferred, colored
Changes since revision 1.42: +3 -9 lines
openssh: Use OPSYSVARS.

Revision 1.42: download - view: text, markup, annotated - select for diffs
Mon Nov 6 10:11:34 2023 UTC (13 months ago) by wiz
Branches: MAIN
Diff to: previous 1.41: preferred, colored
Changes since revision 1.41: +4 -1 lines
openssh: enable fido for Darwin

Revision 1.41: download - view: text, markup, annotated - select for diffs
Mon Nov 6 09:27:57 2023 UTC (13 months ago) by jperkin
Branches: MAIN
Diff to: previous 1.40: preferred, colored
Changes since revision 1.40: +3 -3 lines
openssh: Only enable fido by default on NetBSD.

Revision 1.40: download - view: text, markup, annotated - select for diffs
Thu Oct 19 12:28:01 2023 UTC (13 months, 3 weeks ago) by wiz
Branches: MAIN
Diff to: previous 1.39: preferred, colored
Changes since revision 1.39: +2 -2 lines
openssh: update to 9.5p1.

pkgsrc change: enable fido2 support by default, to match NetBSD base.

Changes since OpenSSH 9.4
=========================

This release fixes a number of bugs and adds some small features.

Potentially incompatible changes
--------------------------------

 * ssh-keygen(1): generate Ed25519 keys by default. Ed25519 public keys
   are very convenient due to their small size. Ed25519 keys are
   specified in RFC 8709 and OpenSSH has supported them since version 6.5
   (January 2014).

 * sshd(8): the Subsystem directive now accurately preserves quoting of
   subsystem commands and arguments. This may change behaviour for exotic
   configurations, but the most common subsystem configuration
   (sftp-server) is unlikely to be affected.

New features
------------

 * ssh(1): add keystroke timing obfuscation to the client. This attempts
   to hide inter-keystroke timings by sending interactive traffic at
   fixed intervals (default: every 20ms) when there is only a small
   amount of data being sent. It also sends fake "chaff" keystrokes for
   a random interval after the last real keystroke. These are
   controlled by a new ssh_config ObscureKeystrokeTiming keyword.

 * ssh(1), sshd(8): Introduce a transport-level ping facility. This adds
   a pair of SSH transport protocol messages SSH2_MSG_PING/PONG to
   implement a ping capability. These messages use numbers in the "local
   extensions" number space and are advertised using a "ping@openssh.com"
   ext-info message with a string version number of "0".

 * sshd(8): allow override of Subsystem directives in sshd Match blocks.

Bugfixes
--------

 * scp(1): fix scp in SFTP mode recursive upload and download of
   directories that contain symlinks to other directories. In scp mode,
   the links would be followed, but in SFTP mode they were not. bz3611

 * ssh-keygen(1): handle cr+lf (instead of just cr) line endings in
   sshsig signature files.

 * ssh(1): interactive mode for ControlPersist sessions if they
   originally requested a tty.

 * sshd(8): make PerSourceMaxStartups first-match-wins

 * sshd(8): limit artificial login delay to a reasonable maximum (5s)
   and don't delay at all for the "none" authentication mechanism.cw
    bz3602

 * sshd(8): Log errors in kex_exchange_identification() with level
   verbose instead of error to reduce preauth log spam. All of those
   get logged with a more generic error message by sshpkt_fatal().

 * sshd(8): correct math for ClientAliveInterval that caused the probes
    to be sent less frequently than configured.

 * ssh(1): fix regression in OpenSSH 9.4 (mux.c r1.99) that caused
   multiplexed sessions to ignore SIGINT under some circumstances.

Changes since OpenSSH 9.3p2
===========================

This release fixes a number of bugs and adds some small features.

Potentially incompatible changes
--------------------------------

 * This release removes support for older versions of libcrypto.
   OpenSSH now requires LibreSSL >= 3.1.0 or OpenSSL >= 1.1.1.
   Note that these versions are already deprecated by their upstream
   vendors.

 * ssh-agent(1): PKCS#11 modules must now be specified by their full
   paths. Previously dlopen(3) could search for them in system
   library directories.

New features
------------

 * ssh(1): allow forwarding Unix Domain sockets via ssh -W.

 * ssh(1): add support for configuration tags to ssh(1).
   This adds a ssh_config(5) "Tag" directive and corresponding
   "Match tag" predicate that may be used to select blocks of
   configuration similar to the pf.conf(5) keywords of the same
   name.

 * ssh(1): add a "match localnetwork" predicate. This allows matching
   on the addresses of available network interfaces and may be used to
   vary the effective client configuration based on network location.

 * ssh(1), sshd(8), ssh-keygen(1): infrastructure support for KRL
   extensions.  This defines wire formats for optional KRL extensions
   and implements parsing of the new submessages. No actual extensions
   are supported at this point.

 * sshd(8): AuthorizedPrincipalsCommand and AuthorizedKeysCommand now
   accept two additional %-expansion sequences: %D which expands to
   the routing domain of the connected session and %C which expands
   to the addresses and port numbers for the source and destination
   of the connection.

 * ssh-keygen(1): increase the default work factor (rounds) for the
   bcrypt KDF used to derive symmetric encryption keys for passphrase
   protected key files by 50%.

Bugfixes
--------

 * ssh-agent(1): improve isolation between loaded PKCS#11 modules
   by running separate ssh-pkcs11-helpers for each loaded provider.

 * ssh(1): make -f (fork after authentication) work correctly with
   multiplexed connections, including ControlPersist. bz3589 bz3589

 * ssh(1): make ConnectTimeout apply to multiplexing sockets and not
   just to network connections.

 * ssh-agent(1), ssh(1): improve defences against invalid PKCS#11
   modules being loaded by checking that the requested module
   contains the required symbol before loading it.

 * sshd(8): fix AuthorizedPrincipalsCommand when AuthorizedKeysCommand
   appears before it in sshd_config. Since OpenSSH 8.7 the
   AuthorizedPrincipalsCommand directive was incorrectly ignored in
   this situation. bz3574

 * sshd(8), ssh(1), ssh-keygen(1): remove vestigal support for KRL
   signatures When the KRL format was originally defined, it included
   support for signing of KRL objects. However, the code to sign KRLs
   and verify KRL signatues was never completed in OpenSSH. This
   release removes the partially-implemented code to verify KRLs.
   All OpenSSH tools now ignore KRL_SECTION_SIGNATURE sections in
   KRL files.

 * All: fix a number of memory leaks and unreachable/harmless integer
   overflows.

 * ssh-agent(1), ssh(1): don't truncate strings logged from PKCS#11
   modules; GHPR406

 * sshd(8), ssh(1): better validate CASignatureAlgorithms in
   ssh_config and sshd_config. Previously this directive would accept
   certificate algorithm names, but these were unusable in practice as
   OpenSSH does not support CA chains. bz3577

 * ssh(1): make `ssh -Q CASignatureAlgorithms` only list signature
   algorithms that are valid for CA signing. Previous behaviour was
   to list all signing algorithms, including certificate algorithms.

 * ssh-keyscan(1): gracefully handle systems where rlimits or the
   maximum number of open files is larger than INT_MAX; bz3581

 * ssh-keygen(1): fix "no comment" not showing on when running
   `ssh-keygen -l` on multiple keys where one has a comment and other
   following keys do not. bz3580

 * scp(1), sftp(1): adjust ftruncate() logic to handle servers that
   reorder requests. Previously, if the server reordered requests then
   the resultant file would be erroneously truncated.

 * ssh(1): don't incorrectly disable hostname canonicalization when
   CanonicalizeHostname=yes and ProxyJump was expicitly set to
   "none". bz3567

 * scp(1): when copying local->remote, check that the source file
   exists before opening an SFTP connection to the server. Based on
   GHPR#370

Revision 1.39: download - view: text, markup, annotated - select for diffs
Fri Aug 21 01:49:24 2020 UTC (4 years, 3 months ago) by riastradh
Branches: MAIN
CVS tags: pkgsrc-2023Q3-base, pkgsrc-2023Q3, pkgsrc-2023Q2-base, pkgsrc-2023Q2, pkgsrc-2023Q1-base, pkgsrc-2023Q1, pkgsrc-2022Q4-base, pkgsrc-2022Q4, pkgsrc-2022Q3-base, pkgsrc-2022Q3, pkgsrc-2022Q2-base, pkgsrc-2022Q2, pkgsrc-2022Q1-base, pkgsrc-2022Q1, pkgsrc-2021Q4-base, pkgsrc-2021Q4, pkgsrc-2021Q3-base, pkgsrc-2021Q3, pkgsrc-2021Q2-base, pkgsrc-2021Q2, pkgsrc-2021Q1-base, pkgsrc-2021Q1, pkgsrc-2020Q4-base, pkgsrc-2020Q4, pkgsrc-2020Q3-base, pkgsrc-2020Q3
Diff to: previous 1.38: preferred, colored
Changes since revision 1.38: +7 -2 lines
security/openssh: New fido option.

This enables built-in U2F/FIDO security key support, without any
SSH_SK_PROVIDER middleware library needed.  Works only on platforms
with working libfido2, so not enabled by default yet.  We should
enable it by default in NetBSD>=10 and maybe some other platforms.

Revision 1.38: download - view: text, markup, annotated - select for diffs
Mon Nov 4 21:12:56 2019 UTC (5 years, 1 month ago) by rillig
Branches: MAIN
CVS tags: pkgsrc-2020Q2-base, pkgsrc-2020Q2, pkgsrc-2020Q1-base, pkgsrc-2020Q1, pkgsrc-2019Q4-base, pkgsrc-2019Q4
Diff to: previous 1.37: preferred, colored
Changes since revision 1.37: +2 -2 lines
security: align variable assignments

pkglint -Wall -F --only aligned --only indent -r

No manual corrections.

Revision 1.37: download - view: text, markup, annotated - select for diffs
Fri Sep 6 09:03:00 2019 UTC (5 years, 3 months ago) by manu
Branches: MAIN
CVS tags: pkgsrc-2019Q3-base, pkgsrc-2019Q3
Diff to: previous 1.36: preferred, colored
Changes since revision 1.36: +6 -2 lines
Add legacymodsz option to allow short (insecure) RSA keys

This may be required in order to access old, non-upgradable, devices for
which modulus size is less than 1024 bits (frequently 768 bits).

Revision 1.36: download - view: text, markup, annotated - select for diffs
Thu Apr 25 14:55:04 2019 UTC (5 years, 7 months ago) by tron
Branches: MAIN
CVS tags: pkgsrc-2019Q2-base, pkgsrc-2019Q2
Diff to: previous 1.35: preferred, colored
Changes since revision 1.35: +10 -5 lines
openssh: Add optional command line editing to "sftp"

Add new package option "editline" (enabled by default) which adds
command line editing and filename completion to the "sftp" client.

Bump the package revision because of this change.

Revision 1.35: download - view: text, markup, annotated - select for diffs
Mon Jul 24 16:33:22 2017 UTC (7 years, 4 months ago) by he
Branches: MAIN
CVS tags: pkgsrc-2019Q1-base, pkgsrc-2019Q1, pkgsrc-2018Q4-base, pkgsrc-2018Q4, pkgsrc-2018Q3-base, pkgsrc-2018Q3, pkgsrc-2018Q2-base, pkgsrc-2018Q2, pkgsrc-2018Q1-base, pkgsrc-2018Q1, pkgsrc-2017Q4-base, pkgsrc-2017Q4, pkgsrc-2017Q3-base, pkgsrc-2017Q3
Diff to: previous 1.34: preferred, colored
Changes since revision 1.34: +5 -1 lines
Include 'pam' in the suggested/default list of options on NetBSD.
Add LICENSE setting, near as I can tell "modified-bsd".
Bump PKGREVISION.

Revision 1.33.4.1: download - view: text, markup, annotated - select for diffs
Sun Jan 8 11:05:07 2017 UTC (7 years, 11 months ago) by bsiegert
Branches: pkgsrc-2016Q4
Diff to: previous 1.33: preferred, colored; next MAIN 1.34: preferred, colored
Changes since revision 1.33: +7 -7 lines
Pullup ticket #5178 - requested by taca
security/openssh: security fix

Revisions pulled up:
- security/openssh/Makefile                                     1.250
- security/openssh/distinfo                                     1.103
- security/openssh/options.mk                                   1.34
- security/openssh/patches/patch-auth1.c                        deleted
- security/openssh/patches/patch-clientloop.c                   1.5
- security/openssh/patches/patch-openbsd-compat_bsd-openpty.c   1.4
- security/openssh/patches/patch-session.c                      1.8
- security/openssh/patches/patch-sshd.c                         1.8

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Fri Dec 30 04:43:16 UTC 2016

   Modified Files:
   	pkgsrc/security/openssh: Makefile distinfo options.mk
   	pkgsrc/security/openssh/patches: patch-clientloop.c
   	    patch-openbsd-compat_bsd-openpty.c patch-session.c patch-sshd.c
   Removed Files:
   	pkgsrc/security/openssh/patches: patch-auth1.c

   Log Message:
   Update openssh to 7.4.1 (7.4p1), including security fixes.

   For full changes, please refer ChangeLog file.

   Future deprecation notice
   =========================

   We plan on retiring more legacy cryptography in future releases,
   specifically:

    * In approximately August 2017, removing remaining support for the
      SSH v.1 protocol (client-only and currently compile-time disabled).

    * In the same release, removing support for Blowfish and RC4 ciphers
      and the RIPE-MD160 HMAC. (These are currently run-time disabled).

    * Refusing all RSA keys smaller than 1024 bits (the current minimum
      is 768 bits)

    * The next release of OpenSSH will remove support for running sshd(8)
      with privilege separation disabled.

    * The next release of portable OpenSSH will remove support for
      OpenSSL version prior to 1.0.1.

   This list reflects our current intentions, but please check the final
   release notes for future releases.

   Potentially-incompatible changes
   ================================

   This release includes a number of changes that may affect existing
   configurations:

    * This release removes server support for the SSH v.1 protocol.

    * ssh(1): Remove 3des-cbc from the client's default proposal. 64-bit
      block ciphers are not safe in 2016 and we don't want to wait until
      attacks like SWEET32 are extended to SSH. As 3des-cbc was the
      only mandatory cipher in the SSH RFCs, this may cause problems
      connecting to older devices using the default configuration,
      but it's highly likely that such devices already need explicit
      configuration for key exchange and hostkey algorithms already
      anyway.

    * sshd(8): Remove support for pre-authentication compression.
      Doing compression early in the protocol probably seemed reasonable
      in the 1990s, but today it's clearly a bad idea in terms of both
      cryptography (cf. multiple compression oracle attacks in TLS) and
      attack surface. Pre-auth compression support has been disabled by
      default for >10 years. Support remains in the client.

    * ssh-agent will refuse to load PKCS#11 modules outside a whitelist
      of trusted paths by default. The path whitelist may be specified
      at run-time.

    * sshd(8): When a forced-command appears in both a certificate and
      an authorized keys/principals command= restriction, sshd will now
      refuse to accept the certificate unless they are identical.
      The previous (documented) behaviour of having the certificate
      forced-command override the other could be a bit confusing and
      error-prone.

    * sshd(8): Remove the UseLogin configuration directive and support
      for having /bin/login manage login sessions.

   Changes since OpenSSH 7.3
   =========================

   This is primarily a bugfix release.

   Security
   --------

    * ssh-agent(1): Will now refuse to load PKCS#11 modules from paths
      outside a trusted whitelist (run-time configurable). Requests to
      load modules could be passed via agent forwarding and an attacker
      could attempt to load a hostile PKCS#11 module across the forwarded
      agent channel: PKCS#11 modules are shared libraries, so this would
      result in code execution on the system running the ssh-agent if the
      attacker has control of the forwarded agent-socket (on the host
      running the sshd server) and the ability to write to the filesystem
      of the host running ssh-agent (usually the host running the ssh
      client). Reported by Jann Horn of Project Zero.

    * sshd(8): When privilege separation is disabled, forwarded Unix-
      domain sockets would be created by sshd(8) with the privileges of
      'root' instead of the authenticated user. This release refuses
      Unix-domain socket forwarding when privilege separation is disabled
      (Privilege separation has been enabled by default for 14 years).
      Reported by Jann Horn of Project Zero.

    * sshd(8): Avoid theoretical leak of host private key material to
      privilege-separated child processes via realloc() when reading
      keys. No such leak was observed in practice for normal-sized keys,
      nor does a leak to the child processes directly expose key material
      to unprivileged users. Reported by Jann Horn of Project Zero.

    * sshd(8): The shared memory manager used by pre-authentication
      compression support had a bounds checks that could be elided by
      some optimising compilers. Additionally, this memory manager was
      incorrectly accessible when pre-authentication compression was
      disabled. This could potentially allow attacks against the
      privileged monitor process from the sandboxed privilege-separation
      process (a compromise of the latter would be required first).
      This release removes support for pre-authentication compression
      from sshd(8). Reported by Guido Vranken using the Stack unstable
      optimisation identification tool (http://css.csail.mit.edu/stack/)

    * sshd(8): Fix denial-of-service condition where an attacker who
      sends multiple KEXINIT messages may consume up to 128MB per
      connection. Reported by Shi Lei of Gear Team, Qihoo 360.

    * sshd(8): Validate address ranges for AllowUser and DenyUsers
      directives at configuration load time and refuse to accept invalid
      ones. It was previously possible to specify invalid CIDR address
      ranges (e.g. user@127.1.2.3/55) and these would always match,
      possibly resulting in granting access where it was not intended.
      Reported by Laurence Parry.

Revision 1.34: download - view: text, markup, annotated - select for diffs
Fri Dec 30 04:43:16 2016 UTC (7 years, 11 months ago) by taca
Branches: MAIN
CVS tags: pkgsrc-2017Q2-base, pkgsrc-2017Q2, pkgsrc-2017Q1-base, pkgsrc-2017Q1
Diff to: previous 1.33: preferred, colored
Changes since revision 1.33: +7 -7 lines
Update openssh to 7.4.1 (7.4p1), including security fixes.

For full changes, please refer ChangeLog file.


Future deprecation notice
=========================

We plan on retiring more legacy cryptography in future releases,
specifically:

 * In approximately August 2017, removing remaining support for the
   SSH v.1 protocol (client-only and currently compile-time disabled).

 * In the same release, removing support for Blowfish and RC4 ciphers
   and the RIPE-MD160 HMAC. (These are currently run-time disabled).

 * Refusing all RSA keys smaller than 1024 bits (the current minimum
   is 768 bits)

 * The next release of OpenSSH will remove support for running sshd(8)
   with privilege separation disabled.

 * The next release of portable OpenSSH will remove support for
   OpenSSL version prior to 1.0.1.

This list reflects our current intentions, but please check the final
release notes for future releases.

Potentially-incompatible changes
================================

This release includes a number of changes that may affect existing
configurations:

 * This release removes server support for the SSH v.1 protocol.

 * ssh(1): Remove 3des-cbc from the client's default proposal. 64-bit
   block ciphers are not safe in 2016 and we don't want to wait until
   attacks like SWEET32 are extended to SSH. As 3des-cbc was the
   only mandatory cipher in the SSH RFCs, this may cause problems
   connecting to older devices using the default configuration,
   but it's highly likely that such devices already need explicit
   configuration for key exchange and hostkey algorithms already
   anyway.

 * sshd(8): Remove support for pre-authentication compression.
   Doing compression early in the protocol probably seemed reasonable
   in the 1990s, but today it's clearly a bad idea in terms of both
   cryptography (cf. multiple compression oracle attacks in TLS) and
   attack surface. Pre-auth compression support has been disabled by
   default for >10 years. Support remains in the client.

 * ssh-agent will refuse to load PKCS#11 modules outside a whitelist
   of trusted paths by default. The path whitelist may be specified
   at run-time.

 * sshd(8): When a forced-command appears in both a certificate and
   an authorized keys/principals command= restriction, sshd will now
   refuse to accept the certificate unless they are identical.
   The previous (documented) behaviour of having the certificate
   forced-command override the other could be a bit confusing and
   error-prone.

 * sshd(8): Remove the UseLogin configuration directive and support
   for having /bin/login manage login sessions.

Changes since OpenSSH 7.3
=========================

This is primarily a bugfix release.

Security
--------

 * ssh-agent(1): Will now refuse to load PKCS#11 modules from paths
   outside a trusted whitelist (run-time configurable). Requests to
   load modules could be passed via agent forwarding and an attacker
   could attempt to load a hostile PKCS#11 module across the forwarded
   agent channel: PKCS#11 modules are shared libraries, so this would
   result in code execution on the system running the ssh-agent if the
   attacker has control of the forwarded agent-socket (on the host
   running the sshd server) and the ability to write to the filesystem
   of the host running ssh-agent (usually the host running the ssh
   client). Reported by Jann Horn of Project Zero.

 * sshd(8): When privilege separation is disabled, forwarded Unix-
   domain sockets would be created by sshd(8) with the privileges of
   'root' instead of the authenticated user. This release refuses
   Unix-domain socket forwarding when privilege separation is disabled
   (Privilege separation has been enabled by default for 14 years).
   Reported by Jann Horn of Project Zero.

 * sshd(8): Avoid theoretical leak of host private key material to
   privilege-separated child processes via realloc() when reading
   keys. No such leak was observed in practice for normal-sized keys,
   nor does a leak to the child processes directly expose key material
   to unprivileged users. Reported by Jann Horn of Project Zero.

 * sshd(8): The shared memory manager used by pre-authentication
   compression support had a bounds checks that could be elided by
   some optimising compilers. Additionally, this memory manager was
   incorrectly accessible when pre-authentication compression was
   disabled. This could potentially allow attacks against the
   privileged monitor process from the sandboxed privilege-separation
   process (a compromise of the latter would be required first).
   This release removes support for pre-authentication compression
   from sshd(8). Reported by Guido Vranken using the Stack unstable
   optimisation identification tool (http://css.csail.mit.edu/stack/)

 * sshd(8): Fix denial-of-service condition where an attacker who
   sends multiple KEXINIT messages may consume up to 128MB per
   connection. Reported by Shi Lei of Gear Team, Qihoo 360.

 * sshd(8): Validate address ranges for AllowUser and DenyUsers
   directives at configuration load time and refuse to accept invalid
   ones. It was previously possible to specify invalid CIDR address
   ranges (e.g. user@127.1.2.3/55) and these would always match,
   possibly resulting in granting access where it was not intended.
   Reported by Laurence Parry.

Revision 1.33: download - view: text, markup, annotated - select for diffs
Sun Jul 10 10:41:38 2016 UTC (8 years, 5 months ago) by rillig
Branches: MAIN
CVS tags: pkgsrc-2016Q4-base, pkgsrc-2016Q3-base, pkgsrc-2016Q3
Branch point for: pkgsrc-2016Q4
Diff to: previous 1.32: preferred, colored
Changes since revision 1.32: +4 -4 lines
Fixed pkglint warnings about indentation.

Revision 1.32: download - view: text, markup, annotated - select for diffs
Fri Jun 10 23:15:36 2016 UTC (8 years, 6 months ago) by alnsn
Branches: MAIN
CVS tags: pkgsrc-2016Q2-base, pkgsrc-2016Q2
Diff to: previous 1.31: preferred, colored
Changes since revision 1.31: +10 -2 lines
Add an option to build without openssl. Fix pkg/50936. Improve PIE build.

Revision 1.29.12.2: download - view: text, markup, annotated - select for diffs
Thu Sep 3 19:30:17 2015 UTC (9 years, 3 months ago) by tron
Branches: pkgsrc-2015Q2
Diff to: previous 1.29.12.1: preferred, colored; branchpoint 1.29: preferred, colored; next MAIN 1.30: preferred, colored
Changes since revision 1.29.12.1: +1 -1 lines
Pullup ticket #4807 - requested by taca
security/openssh: build fix patch

Revisions pulled up:
- security/openssh/distinfo                                     1.97
- security/openssh/options.mk                                   1.31

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Sat Aug 22 05:17:22 UTC 2015

   Modified Files:
   	pkgsrc/security/openssh: distinfo options.mk

   Log Message:
   Revive hpn-patch patch although not yet tested well.

Revision 1.31: download - view: text, markup, annotated - select for diffs
Sat Aug 22 05:17:22 2015 UTC (9 years, 3 months ago) by taca
Branches: MAIN
CVS tags: pkgsrc-2016Q1-base, pkgsrc-2016Q1, pkgsrc-2015Q4-base, pkgsrc-2015Q4, pkgsrc-2015Q3-base, pkgsrc-2015Q3
Diff to: previous 1.30: preferred, colored
Changes since revision 1.30: +2 -2 lines
Revive hpn-patch patch although not yet tested well.

Revision 1.29.12.1: download - view: text, markup, annotated - select for diffs
Tue Jul 14 22:03:39 2015 UTC (9 years, 5 months ago) by tron
Branches: pkgsrc-2015Q2
Diff to: previous 1.29: preferred, colored
Changes since revision 1.29: +2 -2 lines
Pullup ticket #4771 - requested by taca
security/openssh: security update

Revisions pulled up:
- security/openssh/Makefile                                     1.233
- security/openssh/distinfo                                     1.92-1.93
- security/openssh/options.mk                                   1.30
- security/openssh/patches/patch-Makefile.in                    1.4
- security/openssh/patches/patch-auth-passwd.c                  1.2
- security/openssh/patches/patch-auth-rhosts.c                  1.2
- security/openssh/patches/patch-auth.c                         1.3
- security/openssh/patches/patch-auth1.c                        1.3
- security/openssh/patches/patch-auth2.c                        1.4
- security/openssh/patches/patch-channels.c                     1.2
- security/openssh/patches/patch-clientloop.c                   1.2
- security/openssh/patches/patch-compat.c                       deleted
- security/openssh/patches/patch-config.h.in                    1.4
- security/openssh/patches/patch-configure                      deleted
- security/openssh/patches/patch-configure.ac                   1.4
- security/openssh/patches/patch-defines.h                      1.3
- security/openssh/patches/patch-includes.h                     1.3
- security/openssh/patches/patch-openbsd-compat_openbsd-compat.h 1.3
- security/openssh/patches/patch-openbsd-compat_port-tun.c      1.2
- security/openssh/patches/patch-platform.c                     1.4
- security/openssh/patches/patch-scp.c                          1.3
- security/openssh/patches/patch-session.c                      1.4
- security/openssh/patches/patch-ssh.c                          1.4
- security/openssh/patches/patch-sshconnect.c                   deleted
- security/openssh/patches/patch-sshd.8                         1.1
- security/openssh/patches/patch-sshd.c                         1.4
- security/openssh/patches/patch-sshpty.c                       1.2

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Thu Jul  9 16:14:24 UTC 2015

   Modified Files:
   	pkgsrc/security/openssh: Makefile distinfo options.mk
   	pkgsrc/security/openssh/patches: patch-Makefile.in patch-auth-passwd.c
   	    patch-auth-rhosts.c patch-auth.c patch-auth1.c patch-auth2.c
   	    patch-channels.c patch-clientloop.c patch-config.h.in
   	    patch-configure.ac patch-defines.h patch-includes.h
   	    patch-openbsd-compat_openbsd-compat.h
   	    patch-openbsd-compat_port-tun.c patch-platform.c patch-scp.c
   	    patch-session.c patch-ssh.c patch-sshd.c patch-sshpty.c
   Added Files:
   	pkgsrc/security/openssh/patches: patch-sshd.8
   Removed Files:
   	pkgsrc/security/openssh/patches: patch-compat.c patch-configure
   	    patch-sshconnect.c

   Log Message:
   Update openssh to 6.9.1 (OpenSSH 6.9p1) which contains security fix.

   pkgsrc change:

   * tcp_wrappers support was removed from release 6.7, but add it refering
     FreeBSD's ports.
   * hpn-patch is also based on FreeBSD's ports.

   Security
   --------

    * ssh(1): when forwarding X11 connections with ForwardX11Trusted=no,
      connections made after ForwardX11Timeout expired could be permitted
      and no longer subject to XSECURITY restrictions because of an
      ineffective timeout check in ssh(1) coupled with "fail open"
      behaviour in the X11 server when clients attempted connections with
      expired credentials. This problem was reported by Jann Horn.

    * ssh-agent(1): fix weakness of agent locking (ssh-add -x) to
      password guessing by implementing an increasing failure delay,
      storing a salted hash of the password rather than the password
      itself and using a timing-safe comparison function for verifying
      unlock attempts. This problem was reported by Ryan Castellucci.

   For more information, please refer release announce.

   	http://www.openssh.com/txt/release-6.9
   	http://www.openssh.com/txt/release-6.8
   	http://www.openssh.com/txt/release-6.7

---
   Module Name:	pkgsrc
   Committed By:	dsainty
   Date:		Fri Jul 10 07:00:29 UTC 2015

   Modified Files:
   	pkgsrc/security/openssh: distinfo

   Log Message:
   Remove dangling stale hash for patch-sshconnect.c

Revision 1.30: download - view: text, markup, annotated - select for diffs
Thu Jul 9 16:14:23 2015 UTC (9 years, 5 months ago) by taca
Branches: MAIN
Diff to: previous 1.29: preferred, colored
Changes since revision 1.29: +2 -2 lines
Update openssh to 6.9.1 (OpenSSH 6.9p1) which contains security fix.

pkgsrc change:

* tcp_wrappers support was removed from release 6.7, but add it refering
  FreeBSD's ports.
* hpn-patch is also based on FreeBSD's ports.


Security
--------

 * ssh(1): when forwarding X11 connections with ForwardX11Trusted=no,
   connections made after ForwardX11Timeout expired could be permitted
   and no longer subject to XSECURITY restrictions because of an
   ineffective timeout check in ssh(1) coupled with "fail open"
   behaviour in the X11 server when clients attempted connections with
   expired credentials. This problem was reported by Jann Horn.

 * ssh-agent(1): fix weakness of agent locking (ssh-add -x) to
   password guessing by implementing an increasing failure delay,
   storing a salted hash of the password rather than the password
   itself and using a timing-safe comparison function for verifying
   unlock attempts. This problem was reported by Ryan Castellucci.

For more information, please refer release announce.

	http://www.openssh.com/txt/release-6.9
	http://www.openssh.com/txt/release-6.8
	http://www.openssh.com/txt/release-6.7

Revision 1.29: download - view: text, markup, annotated - select for diffs
Sat Mar 29 10:30:15 2014 UTC (10 years, 8 months ago) by taca
Branches: MAIN
CVS tags: pkgsrc-2015Q2-base, pkgsrc-2015Q1-base, pkgsrc-2015Q1, pkgsrc-2014Q4-base, pkgsrc-2014Q4, pkgsrc-2014Q3-base, pkgsrc-2014Q3, pkgsrc-2014Q2-base, pkgsrc-2014Q2, pkgsrc-2014Q1-base, pkgsrc-2014Q1
Branch point for: pkgsrc-2015Q2
Diff to: previous 1.28: preferred, colored
Changes since revision 1.28: +3 -2 lines
Always add pam in PLIST_VARS.

Revision 1.28: download - view: text, markup, annotated - select for diffs
Sat Mar 29 09:38:11 2014 UTC (10 years, 8 months ago) by taca
Branches: MAIN
Diff to: previous 1.27: preferred, colored
Changes since revision 1.27: +7 -3 lines
Update openssh to 6.6.1 (OpenSSH 6.6p1).

pkgsrc change

    * Use PLIST_VARS.
    * Update hpn-patch based on openssh-6.5p1-hpnssh14v4.diff.gz.

Fixes security problem (SA57488).

For full changes, please refer below release notes.

	http://www.openssh.com/txt/release-6.5
	http://www.openssh.com/txt/release-6.6

Revision 1.27: download - view: text, markup, annotated - select for diffs
Thu Dec 5 14:37:01 2013 UTC (11 years ago) by taca
Branches: MAIN
CVS tags: pkgsrc-2013Q4-base, pkgsrc-2013Q4
Diff to: previous 1.26: preferred, colored
Changes since revision 1.26: +1 -2 lines
No need to specify -p1 as arguments of patch(1).

Revision 1.25.4.1: download - view: text, markup, annotated - select for diffs
Thu Dec 5 09:52:53 2013 UTC (11 years ago) by tron
Branches: pkgsrc-2013Q3
Diff to: previous 1.25: preferred, colored; next MAIN 1.26: preferred, colored
Changes since revision 1.25: +3 -3 lines
Pullup ticket #4262 - requested by taca
security/openssh: security update

Revisions pulled up:
- security/openssh/Makefile                                     1.214
- security/openssh/distinfo                                     1.85
- security/openssh/options.mk                                   1.26
- security/openssh/patches/patch-Makefile.in                    1.2
- security/openssh/patches/patch-auth.c                         1.2
- security/openssh/patches/patch-auth1.c                        1.2
- security/openssh/patches/patch-auth2.c                        1.2
- security/openssh/patches/patch-config.h.in                    1.2
- security/openssh/patches/patch-configure                      1.2
- security/openssh/patches/patch-configure.ac                   1.2
- security/openssh/patches/patch-includes.h                     1.2
- security/openssh/patches/patch-scp.c                          1.2
- security/openssh/patches/patch-session.c                      1.2
- security/openssh/patches/patch-sftp-common.c                  1.1
- security/openssh/patches/patch-ssh.c                          1.2
- security/openssh/patches/patch-sshd.c                         1.2
- security/openssh/patches/patch-uidswap.c                      1.2

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Sun Dec  1 06:11:41 UTC 2013

   Modified Files:
   	pkgsrc/security/openssh: Makefile distinfo options.mk
   	pkgsrc/security/openssh/patches: patch-Makefile.in patch-auth.c
   	    patch-auth1.c patch-auth2.c patch-config.h.in patch-configure
   	    patch-configure.ac patch-includes.h patch-scp.c patch-session.c
   	    patch-ssh.c patch-sshd.c patch-uidswap.c
   Added Files:
   	pkgsrc/security/openssh/patches: patch-sftp-common.c

   Log Message:
   Update openssh to 6.4.1 (OpenSSH 6.4p1).

   Changes since OpenSSH 6.3
   =========================

   This release fixes a security bug:

    * sshd(8): fix a memory corruption problem triggered during rekeying
      when an AES-GCM cipher is selected. Full details of the vulnerability
      are available at: http://www.openssh.com/txt/gcmrekey.adv

   Changes since OpenSSH 6.2 is too many to write here, please refer
   the release note: http://www.openssh.com/txt/release-6.3.

Revision 1.26: download - view: text, markup, annotated - select for diffs
Sun Dec 1 06:11:41 2013 UTC (11 years ago) by taca
Branches: MAIN
Diff to: previous 1.25: preferred, colored
Changes since revision 1.25: +3 -3 lines
Update openssh to 6.4.1 (OpenSSH 6.4p1).

Changes since OpenSSH 6.3
=========================

This release fixes a security bug:

 * sshd(8): fix a memory corruption problem triggered during rekeying
   when an AES-GCM cipher is selected. Full details of the vulnerability
   are available at: http://www.openssh.com/txt/gcmrekey.adv

Changes since OpenSSH 6.2 is too many to write here, please refer
the release note: http://www.openssh.com/txt/release-6.3.

Revision 1.25: download - view: text, markup, annotated - select for diffs
Wed May 1 19:58:25 2013 UTC (11 years, 7 months ago) by imil
Branches: MAIN
CVS tags: pkgsrc-2013Q3-base, pkgsrc-2013Q2-base, pkgsrc-2013Q2
Branch point for: pkgsrc-2013Q3
Diff to: previous 1.24: preferred, colored
Changes since revision 1.24: +4 -20 lines
Changes since OpenSSH 6.1
=========================

This release introduces a number of new features:

Features:

 * ssh(1)/sshd(8): Added support for AES-GCM authenticated encryption in
   SSH protocol 2. The new cipher is available as aes128-gcm@openssh.com
   and aes256-gcm@openssh.com. It uses an identical packet format to the
   AES-GCM mode specified in RFC 5647, but uses simpler and different
   selection rules during key exchange.

 * ssh(1)/sshd(8): Added support for encrypt-then-mac (EtM) MAC modes
   for SSH protocol 2. These modes alter the packet format and compute
   the MAC over the packet length and encrypted packet rather than over
   the plaintext data. These modes are considered more secure and are
   used by default when available.

 * ssh(1)/sshd(8): Added support for the UMAC-128 MAC as
   "umac-128@openssh.com" and "umac-128-etm@openssh.com". The latter
   being an encrypt-then-mac mode.

 * sshd(8): Added support for multiple required authentication in SSH
   protocol 2 via an AuthenticationMethods option. This option lists
   one or more comma-separated lists of authentication method names.
   Successful completion of all the methods in any list is required for
   authentication to complete. This allows, for example, requiring a
   user having to authenticate via public key or GSSAPI before they
   are offered password authentication.

 * sshd(8)/ssh-keygen(1): Added support for Key Revocation Lists
   (KRLs), a compact binary format to represent lists of revoked keys
   and certificates that take as little as one bit per certificate when
   revoking by serial number. KRLs may be generated using ssh-keygen(1)
   and are loaded into sshd(8) via the existing RevokedKeys sshd_config
   option.

 * ssh(1): IdentitiesOnly now applies to keys obtained from a
   PKCS11Provider. This allows control of which keys are offered from
   tokens using IdentityFile.

 * sshd(8): sshd_config(5)'s AllowTcpForwarding now accepts "local"
   and "remote" in addition to its previous "yes"/"no" keywords to allow
   the server to specify whether just local or remote TCP forwarding is
   enabled.

 * sshd(8): Added a sshd_config(5) option AuthorizedKeysCommand to
   support fetching authorized_keys from a command in addition to (or
   instead of) from the filesystem. The command is run under an account
   specified by an AuthorizedKeysCommandUser sshd_config(5) option.

 * sftp-server(8): Now supports a -d option to allow the starting
   directory to be something other than the user's home directory.

 * ssh-keygen(1): Now allows fingerprinting of keys hosted in PKCS#11
   tokens using "ssh-keygen -lD pkcs11_provider".

 * ssh(1): When SSH protocol 2 only is selected (the default), ssh(1)
   now immediately sends its SSH protocol banner to the server without
   waiting to receive the server's banner, saving time when connecting.

 * ssh(1): Added ~v and ~V escape sequences to raise and lower the
   logging level respectively.

 * ssh(1): Made the escape command help (~?) context sensitive so that
   only commands that will work in the current session are shown.

 * ssh-keygen(1): When deleting host lines from known_hosts using
   "ssh-keygen -R host", ssh-keygen(1) now prints details of which lines
   were removed.

Bugfixes:

 * ssh(1): Force a clean shutdown of ControlMaster client sessions when
   the ~. escape sequence is used. This means that ~. should now work in
   mux clients even if the server is no longer responding.

 * ssh(1): Correctly detect errors during local TCP forward setup in
   multiplexed clients. bz#2055

 * ssh-add(1): Made deleting explicit keys "ssh-add -d" symmetric with
   adding keys with respect to certificates. It now tries to delete the
   corresponding certificate and respects the -k option to allow deleting
   of the key only.

 * sftp(1): Fix a number of parsing and command-editing bugs, including
   bz#1956

 * ssh(1): When muxmaster is run with -N, ensured that it shuts down
   gracefully when a client sends it "-O stop" rather than hanging around.
   bz#1985

 * ssh-keygen(1): When screening moduli candidates, append to the file
   rather than overwriting to allow resumption. bz#1957

 * ssh(1): Record "Received disconnect" messages at ERROR rather than
   INFO priority. bz#2057.

 * ssh(1): Loudly warn if explicitly-provided private key is unreadable.
   bz#1981

Portable OpenSSH:

 * sshd(8): The Linux seccomp-filter sandbox is now supported on ARM
   platforms where the kernel supports it.

 * sshd(8): The seccomp-filter sandbox will not be enabled if the system
   headers support it at compile time, regardless of whether it can be
   enabled then. If the run-time system does not support seccomp-filter,
   sshd will fall back to the rlimit pseudo-sandbox.

 * ssh(1): Don't link in the Kerberos libraries. They aren't necessary
   on the client, just on sshd(8). bz#2072

 * Fix GSSAPI linking on Solaris, which uses a differently-named GSSAPI
   library. bz#2073

 * Fix compilation on systems with openssl-1.0.0-fips.

 * Fix a number of errors in the RPM spec files.

Changes since OpenSSH 6.0
=========================

This is primarily a bugfix release.

Features:

 * sshd(8): This release turns on pre-auth sandboxing sshd by default for
   new installs, by setting UsePrivilegeSeparation=sandbox in sshd_config.
 * ssh-keygen(1): Add options to specify starting line number and number of
   lines to process when screening moduli candidates, allowing processing
   of different parts of a candidate moduli file in parallel
 * sshd(8): The Match directive now supports matching on the local (listen)
   address and port upon which the incoming connection was received via
   LocalAddress and LocalPort clauses.
 * sshd(8): Extend sshd_config Match directive to allow setting AcceptEnv
   and {Allow,Deny}{Users,Groups}
 * Add support for RFC6594 SSHFP DNS records for ECDSA key types. bz#1978
 * ssh-keygen(1): Allow conversion of RSA1 keys to public PEM and PKCS8
 * sshd(8): Allow the sshd_config PermitOpen directive to accept "none" as
   an argument to refuse all port-forwarding requests.
 * sshd(8): Support "none" as an argument for AuthorizedPrincipalsFile
 * ssh-keyscan(1): Look for ECDSA keys by default. bz#1971
 * sshd(8): Add "VersionAddendum" to sshd_config to allow server operators
   to append some arbitrary text to the server SSH protocol banner.

Bugfixes:

 * ssh(1)/sshd(8): Don't spin in accept() in situations of file
   descriptor exhaustion. Instead back off for a while.
 * ssh(1)/sshd(8): Remove hmac-sha2-256-96 and hmac-sha2-512-96 MACs as
   they were removed from the specification. bz#2023,
 * sshd(8): Handle long comments in config files better. bz#2025
 * ssh(1): Delay setting tty_flag so RequestTTY options are correctly
   picked up. bz#1995
 * sshd(8): Fix handling of /etc/nologin incorrectly being applied to root
   on platforms that use login_cap.

Portable OpenSSH:

 * sshd(8): Allow sshd pre-auth sandboxing to fall-back to the rlimit
   sandbox from the Linux SECCOMP filter sandbox when the latter is
   not available in the kernel.
 * ssh(1): Fix NULL dereference when built with LDNS and using DNSSEC to
   retrieve a CNAME SSHFP record.
 * Fix cross-compilation problems related to pkg-config. bz#1996

Changes since OpenSSH 5.9
=========================

This is primarily a bugfix release.

Features:

 * ssh-keygen(1): Add optional checkpoints for moduli screening
 * ssh-add(1): new -k option to load plain keys (skipping certificates)
 * sshd(8): Add wildcard support to PermitOpen, allowing things like
   "PermitOpen localhost:*".  bz #1857
 * ssh(1): support for cancelling local and remote port forwards via the
   multiplex socket. Use ssh -O cancel -L xx:xx:xx -R yy:yy:yy user@host"
   to request the cancellation of the specified forwardings
 * support cancellation of local/dynamic forwardings from ~C commandline

Bugfixes:

 * ssh(1): ensure that $DISPLAY contains only valid characters before
   using it to extract xauth data so that it can't be used to play local
   shell metacharacter games.
 * ssh(1): unbreak remote portforwarding with dynamic allocated listen ports
 * scp(1): uppress adding '--' to remote commandlines when the first
   argument does not start with '-'. saves breakage on some
   difficult-to-upgrade embedded/router platforms
 * ssh(1)/sshd(8): fix typo in IPQoS parsing: there is no "AF14" class,
   but there is an "AF21" class
 * ssh(1)/sshd(8): do not permit SSH2_MSG_SERVICE_REQUEST/ACCEPT during
   rekeying
 * ssh(1): skip attempting to create ~/.ssh when -F is passed
 * sshd(8): unbreak stdio forwarding when ControlPersist is in use; bz#1943
 * sshd(1): send tty break to pty master instead of (probably already
   closed) slave side; bz#1859
 * sftp(1): silence error spam for "ls */foo" in directory with files;
   bz#1683
 * Fixed a number of memory and file descriptor leaks

Portable OpenSSH:

 * Add a new privilege separation sandbox implementation for Linux's
   new seccomp sandbox, automatically enabled on platforms that support
   it. (Note: privilege separation sandboxing is still experimental)
 * Fix compilation problems on FreeBSD, where libutil contained openpty()
   but not login().
 * ssh-keygen(1): don't fail in -A on platforms that don't support ECC
 * Add optional support for LDNS, a BSD licensed DNS resolver library
   which supports DNSSEC
 * Relax OpenSSL version check to allow running OpenSSH binaries on
   systems with OpenSSL libraries with a newer "fix" or "patch" level
   than the binaries were originally compiled on (previous check only
   allowed movement within "patch" releases). bz#1991
 * Fix builds using contributed Redhat spec file. bz#1992

Changes since OpenSSH 5.8
=========================

Features:

 * Introduce sandboxing of the pre-auth privsep child using an optional
   sshd_config(5) "UsePrivilegeSeparation=sandbox" mode that enables
   mandatory restrictions on the syscalls the privsep child can perform.
   This intention is to prevent a compromised privsep child from being
   used to attack other hosts (by opening sockets and proxying) or
   probing local kernel attack surface.

   Three concrete sandbox implementation are provided (selected at
   configure time): systrace, seatbelt and rlimit.

   The systrace sandbox uses systrace(4) in unsupervised "fast-path"
   mode, where a list of permitted syscalls is supplied. Any syscall not
   on the list results in SIGKILL being sent to the privsep child. Note
   that this requires a kernel with the new SYSTR_POLICY_KILL option
   (only OpenBSD has this mode at present).

   The seatbelt sandbox uses OS X/Darwin sandbox(7) facilities with a
   strict (kSBXProfilePureComputation) policy that disables access to
   filesystem and network resources.

   The rlimit sandbox is a fallback choice for platforms that don't
   support a better one; it uses setrlimit() to reset the hard-limit
   of file descriptors and processes to zero, which should prevent
   the privsep child from forking or opening new network connections.

   Sandboxing of the privilege separated child process is currently
   experimental but should become the default in a future release.
   Native sandboxes for other platforms are welcome (e.g. Capsicum,
   Linux pid/net namespaces, etc.)

 * Add new SHA256-based HMAC transport integrity modes from
   http://www.ietf.org/id/draft-dbider-sha2-mac-for-ssh-02.txt
   These modes are hmac-sha2-256, hmac-sha2-256-96, hmac-sha2-512,
   and hmac-sha2-512-96, and are available by default in ssh(1) and
   sshd(8)

 * The pre-authentication sshd(8) privilege separation slave process
   now logs via a socket shared with the master process, avoiding the
   need to maintain /dev/log inside the chroot.

 * ssh(1) now warns when a server refuses X11 forwarding

 * sshd_config(5)'s AuthorizedKeysFile now accepts multiple paths,
   separated by whitespace. The undocumented AuthorizedKeysFile2
   option is deprecated (though the default for AuthorizedKeysFile
   includes .ssh/authorized_keys2)

 * sshd_config(5): similarly deprecate UserKnownHostsFile2 and
   GlobalKnownHostsFile2 by making UserKnownHostsFile and
   GlobalKnownHostsFile accept multiple options and default to
   include known_hosts2

 * Retain key comments when loading v.2 keys. These will be visible
   in "ssh-add -l" and other places. bz#439

 * ssh(1) and sshd(8): set IPv6 traffic class from IPQoS (as well as
   IPv4 ToS/DSCP). bz#1855

 * ssh_config(5)'s ControlPath option now expands %L to the host
   portion of the destination host name.

 * ssh_config(5) "Host" options now support negated Host matching, e.g.

     Host *.example.org !c.example.org
        User mekmitasdigoat

   Will match "a.example.org", "b.example.org", but not "c.example.org"

 * ssh_config(5): a new RequestTTY option provides control over when a
   TTY is requested for a connection, similar to the existing -t/-tt/-T
   ssh(1) commandline options.

 * sshd(8): allow GSSAPI authentication to detect when a server-side
   failure causes authentication failure and don't count such failures
   against MaxAuthTries; bz#1244

 * ssh-keygen(1): Add -A option. For each of the key types (rsa1, rsa,
   dsa and ecdsa) for which host keys do not exist, generate the host
   keys with the default key file path, an empty passphrase, default
   bits for the key type, and default comment. This is useful for
   system initialisation scripts.

 * ssh(1): Allow graceful shutdown of multiplexing: request that a mux
   server removes its listener socket and refuse future multiplexing
   requests but don't kill existing connections. This may be requested
   using "ssh -O stop ..."

 * ssh-add(1) now accepts keys piped from standard input. E.g.
   "ssh-add - < /path/to/key"

 * ssh-keysign(8) now signs hostbased authentication
   challenges correctly using ECDSA keys; bz#1858

 * sftp(1): document that sftp accepts square brackets to delimit
   addresses (useful for IPv6); bz#1847a

 * ssh(1): when using session multiplexing, the master process will
   change its process title to reflect the control path in use and
   when a ControlPersist-ed master is waiting to close; bz#1883 and
   bz#1911

 * Other minor bugs fixed: 1849 1861 1862 1869 1875 1878 1879 1892
   1900 1905 1913

Portable OpenSSH Bugfixes:

 * Fix a compilation error in the SELinux support code. bz#1851

 * This release removes support for ssh-rand-helper. OpenSSH now
   obtains its random numbers directly from OpenSSL or from
   a PRNGd/EGD instance specified at configure time.

 * sshd(8) now resets the SELinux process execution context before
   executing passwd for password changes; bz#1891

 * Since gcc >= 4.x ignores all -Wno-options options, test only the
   corresponding -W-option when trying to determine whether it is
   accepted; bz#1901

 * Add ECDSA key generation to the Cygwin ssh-{host,user}-config
   scripts.

 * Updated .spec and init files for Linux; bz#1920

 * Improved SELinux error messages in context change failures and
   suppress error messages when attempting to change from the
   "unconfined_t" type; bz#1924 bz#1919

 * Fix build errors on platforms without dlopen(); bz#1929

Revision 1.24: download - view: text, markup, annotated - select for diffs
Fri Jan 11 12:41:16 2013 UTC (11 years, 11 months ago) by jperkin
Branches: MAIN
CVS tags: pkgsrc-2013Q1-base, pkgsrc-2013Q1
Diff to: previous 1.23: preferred, colored
Changes since revision 1.23: +2 -2 lines
Switch HPN patch site to the one FreeBSD uses, upstream have hidden it
behind a session-based page.

Revision 1.23: download - view: text, markup, annotated - select for diffs
Thu May 31 11:58:37 2012 UTC (12 years, 6 months ago) by imil
Branches: MAIN
CVS tags: pkgsrc-2012Q4-base, pkgsrc-2012Q4, pkgsrc-2012Q3-base, pkgsrc-2012Q3, pkgsrc-2012Q2-base, pkgsrc-2012Q2
Diff to: previous 1.22: preferred, colored
Changes since revision 1.22: +18 -2 lines
Added support for OpenSSH-lpk

The OpenSSH LDAP Public Key patch provides an easy way of centralizing strong
user authentication by using an LDAP server for retrieving public keys instead
of ~/.ssh/authorized_keys.

Revision 1.22: download - view: text, markup, annotated - select for diffs
Mon Jan 9 05:25:36 2012 UTC (12 years, 11 months ago) by manu
Branches: MAIN
CVS tags: pkgsrc-2012Q1-base, pkgsrc-2012Q1
Diff to: previous 1.21: preferred, colored
Changes since revision 1.21: +2 -8 lines
Re-enable PAM support, as it works fine provided one does not mix multiple
versions of libcrypto in sshd. This can happen if OpenSSH is linked with
pkgsrc's OpenSSL and if using nss_ldap, which pulls base-system OpenSSL
through kerberos libraries. One needs to disable the krb5 of nss_ldap
in order to fix that.

Revision 1.21: download - view: text, markup, annotated - select for diffs
Thu Sep 1 19:24:01 2011 UTC (13 years, 3 months ago) by shattered
Branches: MAIN
CVS tags: pkgsrc-2011Q4-base, pkgsrc-2011Q4, pkgsrc-2011Q3-base, pkgsrc-2011Q3
Diff to: previous 1.20: preferred, colored
Changes since revision 1.20: +4 -1 lines
PR/38394 -- disable KAFS detection for mit-krb5

Revision 1.20: download - view: text, markup, annotated - select for diffs
Wed Feb 16 17:45:08 2011 UTC (13 years, 9 months ago) by taca
Branches: MAIN
CVS tags: pkgsrc-2011Q2-base, pkgsrc-2011Q2, pkgsrc-2011Q1-base, pkgsrc-2011Q1
Diff to: previous 1.19: preferred, colored
Changes since revision 1.19: +2 -2 lines
Update openssh package to 5.8.1 (5.8p1).

For changes from 5.5 to 5.7, please refer http://openssh.com/txt/release-5.7
and http://openssh.com/txt/release-5.6 in detail.

Changes since OpenSSH 5.7
=========================

Security:

 * Fix vulnerability in legacy certificate signing introduced in
   OpenSSH-5.6 and found by Mateusz Kocielski.

   Legacy certificates signed by OpenSSH 5.6 or 5.7 included data from
   the stack in place of a random nonce field. The contents of the stack
   do not appear to contain private data at this point, but this cannot
   be stated with certainty for all platform, library and compiler
   combinations. In particular, there exists a risk that some bytes from
   the privileged CA key may be accidentally included.

   A full advisory for this issue is available at:
   http://www.openssh.com/txt/legacy-cert.adv

Portable OpenSSH Bugfixes:

 * Fix compilation failure when enableing SELinux support.

 * Do not attempt to call SELinux functions when SELinux is disabled.
   bz#1851

Revision 1.19: download - view: text, markup, annotated - select for diffs
Tue Jun 15 03:11:52 2010 UTC (14 years, 6 months ago) by taca
Branches: MAIN
CVS tags: pkgsrc-2010Q4-base, pkgsrc-2010Q4, pkgsrc-2010Q3-base, pkgsrc-2010Q3, pkgsrc-2010Q2-base, pkgsrc-2010Q2
Diff to: previous 1.18: preferred, colored
Changes since revision 1.18: +2 -2 lines
Add hpn-patch for OpenSSH 5.5p1.

No PKGREVISION bump since this option never worked
with OpenSSH 5.5p1 before.

Revision 1.18: download - view: text, markup, annotated - select for diffs
Thu Feb 18 08:04:35 2010 UTC (14 years, 9 months ago) by martti
Branches: MAIN
CVS tags: pkgsrc-2010Q1-base, pkgsrc-2010Q1
Diff to: previous 1.17: preferred, colored
Changes since revision 1.17: +2 -2 lines
Updated OpenSSH to 5.3.1 (pkg/42635 by Fredrik Pettai)

This is a bugfix release, no new features have been added.

Changes since OpenSSH 5.2
=========================

General Bugfixes:

 * Do not limit home directory paths to 256 characters. bz#1615

 * Several minor documentation and correctness fixes.

Portable OpenSSH Bugfixes:

 * This release removes for support for very old versions of Cygwin and
   for Windows 95/98/ME

 * Move the deletion of PAM credentials on logout to after the session
   close. bz#1534

 * Make PrintLastLog work on AIX. bz#1595

 * Avoid compile errors on FreeBSD from conflicts in glob.h. bz#1634

 * Delay dropping of root privileges on AIX so chroot and pam_open_session
   work correctly. bz#1249 and bz#1567

 * Increase client IO buffer on Cygwin to 64K, realising a significant
   performance improvement.

 * Roll back bz#1241 (better handling for expired passwords on Tru64).
   The change broke password logins on some configurations.

 * Accept ENOSYS as a fallback error when attempting atomic
   rename(). bz#1535

 * Fix passing of variables to recursive make(1) invocations on Solaris.
   bz#1505

 * Skip the tcgetattr call on the pty master on Solaris, since it never
   succeeds and can hang if large amounts of data is sent to the slave
   (eg a copy-paste). bz#1528

 * Fix detection of krb5-config. bz#1639

 * Fix test for server-assigned remote forwarding port for non-root users.
   bz#1578

 * Fix detection of libresolv on OSX 10.6.

Revision 1.17: download - view: text, markup, annotated - select for diffs
Thu May 21 03:22:29 2009 UTC (15 years, 6 months ago) by taca
Branches: MAIN
CVS tags: pkgsrc-2009Q4-base, pkgsrc-2009Q4, pkgsrc-2009Q3-base, pkgsrc-2009Q3, pkgsrc-2009Q2-base, pkgsrc-2009Q2
Diff to: previous 1.16: preferred, colored
Changes since revision 1.16: +2 -2 lines
Update openssh package to 5.2.1(5.2p1).

Changes since OpenSSH 5.1
=========================

Security:

 * This release changes the default cipher order to prefer the AES CTR
   modes and the revised "arcfour256" mode to CBC mode ciphers that are
   susceptible to CPNI-957037 "Plaintext Recovery Attack Against SSH".

 * This release also adds countermeasures to mitigate CPNI-957037-style
   attacks against the SSH protocol's use of CBC-mode ciphers. Upon
   detection of an invalid packet length or Message Authentication
   Code, ssh/sshd will continue reading up to the maximum supported
   packet length rather than immediately terminating the connection.
   This eliminates most of the known differences in behaviour that
   leaked information about the plaintext of injected data which formed
   the basis of this attack. We believe that these attacks are rendered
   infeasible by these changes.

New features:

 * Added a -y option to ssh(1) to force logging to syslog rather than
   stderr, which is useful when running daemonised (ssh -f)

 * The sshd_config(5) ForceCommand directive now accepts commandline
   arguments for the internal-sftp server.

 * The ssh(1) ~C escape commandline now support runtime creation of
   dynamic (-D) port forwards.

 * Support the SOCKS4A protocol in ssh(1) dynamic (-D) forwards.
   (bz#1482)

 * Support remote port forwarding with a listen port of '0'. This
   informs the server that it should dynamically allocate a listen
   port and report it back to the client. (bz#1003)

 * sshd(8) now supports setting PermitEmptyPasswords and
   AllowAgentForwarding in Match blocks

Bug and documentation fixes

 * Repair a ssh(1) crash introduced in openssh-5.1 when the client is
   sent a zero-length banner (bz#1496)

 * Due to interoperability problems with certain
   broken SSH implementations, the eow@openssh.com and
   no-more-sessions@openssh.com protocol extensions are now only sent
   to peers that identify themselves as OpenSSH.

 * Make ssh(1) send the correct channel number for
   SSH2_MSG_CHANNEL_SUCCESS and SSH2_MSG_CHANNEL_FAILURE messages to
   avoid triggering 'Non-public channel' error messages on sshd(8) in
   openssh-5.1.

 * Avoid printing 'Non-public channel' warnings in sshd(8), since the
   ssh(1) has sent incorrect channel numbers since ~2004 (this reverts
   a behaviour introduced in openssh-5.1).

 * Avoid double-free in ssh(1) ~C escape -L handler (bz#1539)

 * Correct fail-on-error behaviour in sftp(1) batchmode for remote
   stat operations. (bz#1541)

 * Disable nonfunctional ssh(1) ~C escape handler in multiplex slave
   connections. (bz#1543)

 * Avoid hang in ssh(1) when attempting to connect to a server that
   has MaxSessions=0 set.

 * Multiple fixes to sshd(8) configuration test (-T) mode

 * Several core and portable OpenSSH bugs fixed: 1380, 1412, 1418,
   1419, 1421, 1490, 1491, 1492, 1514, 1515, 1518, 1520, 1538, 1540

 * Many manual page improvements.

Revision 1.16: download - view: text, markup, annotated - select for diffs
Tue Sep 16 12:53:08 2008 UTC (16 years, 2 months ago) by taca
Branches: MAIN
CVS tags: pkgsrc-2009Q1-base, pkgsrc-2009Q1, pkgsrc-2008Q4-base, pkgsrc-2008Q4, pkgsrc-2008Q3-base, pkgsrc-2008Q3
Diff to: previous 1.15: preferred, colored
Changes since revision 1.15: +2 -2 lines
Update openssh package to 5.1.1 (5.1p1)

Changes from OpenSSH 5.0 is huge to write here, please refer its
release note: http://www.openssh.com/txt/release-5.1.
I quote only Security section from the release note.

Security:

 * sshd(8): Avoid X11 man-in-the-middle attack on HP/UX (and possibly
   other platforms) when X11UseLocalhost=no

   When attempting to bind(2) to a port that has previously been bound
   with SO_REUSEADDR set, most operating systems check that either the
   effective user-id matches the previous bind (common on BSD-derived
   systems) or that the bind addresses do not overlap (Linux and
   Solaris).

   Some operating systems, such as HP/UX, do not perform these checks
   and are vulnerable to an X11 man-in-the-middle attack when the
   sshd_config(5) option X11UseLocalhost has been set to "no" - an
   attacker may establish a more-specific bind, which will be used in
   preference to sshd's wildcard listener.

   Modern BSD operating systems, Linux, OS X and Solaris implement the
   above checks and are not vulnerable to this attack, nor are systems
   where the X11UseLocalhost has been left at the default value of
   "yes".

   Portable OpenSSH 5.1 avoids this problem for all operating systems
   by not setting SO_REUSEADDR when X11UseLocalhost is set to no.

   This vulnerability was reported by sway2004009 AT hotmail.com.

Revision 1.15: download - view: text, markup, annotated - select for diffs
Sun Apr 27 00:34:27 2008 UTC (16 years, 7 months ago) by tnn
Branches: MAIN
CVS tags: pkgsrc-2008Q2-base, pkgsrc-2008Q2, cwrapper, cube-native-xorg-base, cube-native-xorg
Diff to: previous 1.14: preferred, colored
Changes since revision 1.14: +2 -2 lines
Update to OpenSSH 5.0p1.
Changes since 4.7:
- fix two security issues
- chroot support for sshd(8)
- sftp server internalized in sshd(8)
- assorted bug fixes

Revision 1.14: download - view: text, markup, annotated - select for diffs
Fri Sep 7 10:41:12 2007 UTC (17 years, 3 months ago) by taca
Branches: MAIN
CVS tags: pkgsrc-2008Q1-base, pkgsrc-2008Q1, pkgsrc-2007Q4-base, pkgsrc-2007Q4, pkgsrc-2007Q3-base, pkgsrc-2007Q3
Diff to: previous 1.13: preferred, colored
Changes since revision 1.13: +2 -2 lines
Update openssh package to 4.7.1 (4.7p1).


Changes since OpenSSH 4.6:
============================

Security bugs resolved in this release:

 * Prevent ssh(1) from using a trusted X11 cookie if creation of an
   untrusted cookie fails; found and fixed by Jan Pechanec.

Other changes, new functionality and fixes in this release:

 * sshd(8) in new installations defaults to SSH Protocol 2 only.
   Existing installations are unchanged.

 * The SSH channel window size has been increased, and both ssh(1)
   sshd(8) now send window updates more aggressively. These improves
   performance on high-BDP (Bandwidth Delay Product) networks.

 * ssh(1) and sshd(8) now preserve MAC contexts between packets, which
   saves 2 hash calls per packet and results in 12-16% speedup for
   arcfour256/hmac-md5.

 * A new MAC algorithm has been added, UMAC-64 (RFC4418) as
   "umac-64@openssh.com". UMAC-64 has been measured to be
   approximately 20% faster than HMAC-MD5.

 * A -K flag was added to ssh(1) to set GSSAPIAuthentication=Yes

 * Failure to establish a ssh(1) TunnelForward is now treated as a
   fatal error when the ExitOnForwardFailure option is set.

 * ssh(1) returns a sensible exit status if the control master goes
   away without passing the full exit status. (bz #1261)

 * The following bugs have been fixed in this release:

   - When using a ProxyCommand in ssh(1), set the outgoing hostname with
     gethostname(2), allowing hostbased authentication to work (bz #616)
   - Make scp(1) skip FIFOs rather than hanging (bz #856)
   - Encode non-printing characters in scp(1) filenames.
     these could cause copies to be aborted with a "protocol error"
     (bz #891)
   - Handle SIGINT in sshd(8) privilege separation child process to
     ensure that wtmp and lastlog records are correctly updated
     (bz #1196)
   - Report GSSAPI mechanism in errors, for libraries that support
     multiple mechanisms (bz #1220)
   - Improve documentation for ssh-add(1)'s -d option (bz #1224)
   - Rearrange and tidy GSSAPI code, removing server-only code being
     linked into the client. (bz #1225)
   - Delay execution of ssh(1)'s LocalCommand until after all forwadings
     have been established. (bz #1232)
   - In scp(1), do not truncate non-regular files (bz #1236)
   - Improve exit message from ControlMaster clients. (bz #1262)
   - Prevent sftp-server(8) from reading until it runs out of buffer
     space, whereupon it would exit with a fatal error. (bz #1286)

 * Portable OpenSSH bugs fixed:

   - Fix multiple inclusion of paths.h on AIX 5.1 systems. (bz #1243)
   - Implement getpeereid for Solaris using getpeerucred. Solaris
     systems will now refuse ssh-agent(1) and ssh(1) ControlMaster
     clients from different, non-root users (bz #1287)
   - Fix compilation warnings by including string.h if found. (bz #1294)
   - Remove redefinition of _res in getrrsetbyname.c for platforms that
     already define it. (bz #1299)
   - Fix spurious "chan_read_failed for istate 3" errors from sshd(8),
     a side-effect of the "hang on exit" fix introduced in 4.6p1.
     (bz #1306)
   - pam_end() was not being called if authentication failed (bz #1322)
   - Fix SELinux support when SELinux is in permissive mode. Previously
     sshd(8) was treating SELinux errors as always fatal. (bz #1325)
   - Ensure that pam_setcred(..., PAM_ESTABLISH_CRED) is called before
     pam_setcred(..., PAM_REINITIALIZE_CRED), fixing pam_dhkeys.
     (bz #1339)
   - Fix privilege separation on QNX - pre-auth only, this platform does
     not support file descriptior passing needed for post-auth privilege
     separation. (bz #1343)

Revision 1.13: download - view: text, markup, annotated - select for diffs
Sun Mar 18 12:38:45 2007 UTC (17 years, 8 months ago) by taca
Branches: MAIN
CVS tags: pkgsrc-2007Q2-base, pkgsrc-2007Q2, pkgsrc-2007Q1-base, pkgsrc-2007Q1
Diff to: previous 1.12: preferred, colored
Changes since revision 1.12: +2 -2 lines
Update openssh pacakge to 4.6.1.


Changes since OpenSSH 4.5:
============================

 * sshd now allows the enabling and disabling of authentication
   methods on a per user, group, host and network basis via the
   Match directive in sshd_config.

 * The following bugs have been fixed in this release:

   - Clear SIGALRM when restarting due to SIGHUP. Prevents stray
     signal from taking down sshd if a connection was pending at
     the time SIGHUP was received
   - sftp returned a zero exit status when upload failed due to write
     errors (bugzilla #1252)
   - fixed an inconsistent check for a terminal when displaying scp
     progress meter (bugzilla #1265)
   - Parsing of time values in Match blocks was incorrectly applied
     to the global configuration (bugzilla #1275)
   - Allow multiple forwarding options to work when specified in a
     PermitOpen directive (bugzilla #1267)
   - Interoperate with ssh.com versions that do not support binding
     remote port forwarding sessions to a hostname (bugzilla #1019)

 * Portable OpenSSH bugs fixed:

   - "hang on exit" when background processes are running at the time
     of exit on a ttyful/login session (bugzilla #52)
   - Fix typos in the ssh-rand-helper(8) man page (bugzilla #1259)
   - Check that some SIG records have been returned in getrrsetbyname
     (bugzilla #1281)
   - Fix contrib/findssl for platforms that lack "which" (bugzilla
     #1237)
   - Work around bug in OpenSSL 0.9.8e that broke aes256-ctr,
     aes192-ctr, arcfour256 (bugzilla #1291)

Revision 1.12: download - view: text, markup, annotated - select for diffs
Thu Feb 22 19:27:08 2007 UTC (17 years, 9 months ago) by wiz
Branches: MAIN
Diff to: previous 1.11: preferred, colored
Changes since revision 1.11: +2 -2 lines
Whitespace cleanup, courtesy of pkglint.
Patch provided by Sergey Svishchev in private mail.

Revision 1.11: download - view: text, markup, annotated - select for diffs
Sat Jan 20 10:03:39 2007 UTC (17 years, 10 months ago) by taca
Branches: MAIN
Diff to: previous 1.10: preferred, colored
Changes since revision 1.10: +2 -2 lines
Update hpn-patch; openssh-4.4p1-hpn12v13 to openssh-4.5p1-hpn12v14.
Accurate changes are unknown.

Bump PKGREVISION.

Revision 1.8.6.1: download - view: text, markup, annotated - select for diffs
Fri Nov 10 11:50:25 2006 UTC (18 years, 1 month ago) by salo
Branches: pkgsrc-2006Q3
Diff to: previous 1.8: preferred, colored; next MAIN 1.9: preferred, colored
Changes since revision 1.8: +2 -2 lines
Pullup ticket 1909 - requested by taca
security update for openssh

Revisions pulled up:
- pkgsrc/security/openssh/Makefile		1.172, 1.173, 1.174
- pkgsrc/security/openssh/distinfo		1.55, 1.56, 1.57
- pkgsrc/security/openssh/hacks.mk		1.2
- pkgsrc/security/openssh/options.mk		1.9, 1.10
- pkgsrc/security/openssh/patches/patch-aa	1.42, 1.43
- pkgsrc/security/openssh/patches/patch-ab	1.24, 1.25
- pkgsrc/security/openssh/patches/patch-ac	1.16
- pkgsrc/security/openssh/patches/patch-ad	1.12
- pkgsrc/security/openssh/patches/patch-ae	1.12
- pkgsrc/security/openssh/patches/patch-af	1.10
- pkgsrc/security/openssh/patches/patch-ag	1.9
- pkgsrc/security/openssh/patches/patch-ah	1.24
- pkgsrc/security/openssh/patches/patch-ai	1.10
- pkgsrc/security/openssh/patches/patch-aj	1.7
- pkgsrc/security/openssh/patches/patch-ak	1.8
- pkgsrc/security/openssh/patches/patch-al	1.7
- pkgsrc/security/openssh/patches/patch-am	1.7
- pkgsrc/security/openssh/patches/patch-an	1.8
- pkgsrc/security/openssh/patches/patch-ao	1.9
- pkgsrc/security/openssh/patches/patch-ap	1.8
- pkgsrc/security/openssh/patches/patch-aq	1.6
- pkgsrc/security/openssh/patches/patch-ar	1.7
- pkgsrc/security/openssh/patches/patch-as	1.5
- pkgsrc/security/openssh/patches/patch-at	removed
- pkgsrc/security/openssh/patches/patch-au	1.3
- pkgsrc/security/openssh/patches/patch-av	1.5
- pkgsrc/security/openssh/patches/patch-aw	1.2
- pkgsrc/security/openssh/patches/patch-ax	removed
- pkgsrc/security/openssh/patches/patch-ay	removed
- pkgsrc/security/openssh/patches/patch-az	removed

   Module Name:		pkgsrc
   Committed By:	taca
   Date:		Tue Oct 31 03:31:20 UTC 2006

   Modified Files:
   	pkgsrc/security/openssh: Makefile distinfo hacks.mk options.mk
   	pkgsrc/security/openssh/patches: patch-aa patch-ab patch-ac patch-ad
   	    patch-ae patch-af patch-ag patch-ah patch-ai patch-aj patch-ak
   	    patch-al patch-am patch-an patch-ao patch-ap patch-aq patch-ar
   	    patch-as patch-au patch-av patch-aw
   Removed Files:
   	pkgsrc/security/openssh/patches: patch-at patch-ax patch-ay patch-az

   Log Message:
   Update openssh package to 4.4.1 (openssh-4.4p1).

   - A few pkglint warning clean up.
   - Major changes are here.  For complete changes,
     see http://www.openssh.com/txt/release-4.4.

   Changes since OpenSSH 4.3:
   ============================

   Security bugs resolved in this release:

    * Fix a pre-authentication denial of service found by Tavis Ormandy,
      that would cause sshd(8) to spin until the login grace time
      expired.

    * Fix an unsafe signal hander reported by Mark Dowd. The signal
      handler was vulnerable to a race condition that could be exploited
      to perform a pre-authentication denial of service. On portable
      OpenSSH, this vulnerability could theoretically lead to
      pre-authentication remote code execution if GSSAPI authentication
      is enabled, but the likelihood of successful exploitation appears
      remote.

    * On portable OpenSSH, fix a GSSAPI authentication abort that could
      be used to determine the validity of usernames on some platforms.

   This release includes the following new functionality and fixes:

    * Implemented conditional configuration in sshd_config(5) using the
      "Match" directive. This allows some configuration options to be
      selectively overridden if specific criteria (based on user, group,
      hostname and/or address) are met. So far a useful subset of post-
      authentication options are supported and more are expected to be
      added in future releases.

    * Add support for Diffie-Hellman group exchange key agreement with a
      final hash of SHA256.

    * Added a "ForceCommand" directive to sshd_config(5). Similar to the
      command="..." option accepted in ~/.ssh/authorized_keys, this forces
      the execution of the specified command regardless of what the user
      requested. This is very useful in conjunction with the new "Match"
      option.

    * Add a "PermitOpen" directive to sshd_config(5). This mirrors the
      permitopen="..." authorized_keys option, allowing fine-grained
      control over the port-forwardings that a user is allowed to
      establish.

    * Add optional logging of transactions to sftp-server(8).

    * ssh(1) will now record port numbers for hosts stored in
      ~/.ssh/authorized_keys when a non-standard port has been requested.

    * Add an "ExitOnForwardFailure" option to cause ssh(1) to exit (with
      a non-zero exit code) when requested port forwardings could not be
      established.

    * Extend sshd_config(5) "SubSystem" declarations to allow the
      specification of command-line arguments.

    * Replacement of all integer overflow susceptible invocations of
      malloc(3) and realloc(3) with overflow-checking equivalents.

    * Many manpage fixes and improvements

    * New portable OpenSSH-specific features:

      - Add optional support for SELinux, controlled using the
        --with-selinux configure option (experimental)

      - Add optional support for Solaris process contracts, enabled
        using the --with-solaris-contracts configure option (experimental)
        This option will also include SMF metadata in Solaris packages
        built using the "make package" target

      - Add optional support for OpenSSL hardware accelerators (engines),
        enabled using the --with-ssl-engine configure option.
---
   Module Name:		pkgsrc
   Committed By:	taca
   Date:		Tue Nov  7 07:08:26 UTC 2006

   Modified Files:
   	pkgsrc/security/openssh: Makefile distinfo options.mk

   Log Message:
   Update hpn-patch to hpn12v13 since old one has gone.

   Bump PKGREVISION.
---
   Module Name:		pkgsrc
   Committed By:	taca
   Date:		Wed Nov  8 01:49:22 UTC 2006

   Modified Files:
   	pkgsrc/security/openssh: Makefile distinfo
   	pkgsrc/security/openssh/patches: patch-aa patch-ab

   Log Message:
   Update openssh package to 4.5.1 (openssh-4.5p1).

   Changes:

   Security bugs resolved in this release:

    * Fix a bug in the sshd privilege separation monitor that weakened its
      verification of successful authentication. This bug is not known to
      be exploitable in the absence of additional vulnerabilities.

   This release includes the following non-security fixes:

    * Several compilation fixes for portable OpenSSH

    * Fixes to Solaris SMF/process contract support (bugzilla #1255)

Revision 1.10: download - view: text, markup, annotated - select for diffs
Tue Nov 7 07:08:26 2006 UTC (18 years, 1 month ago) by taca
Branches: MAIN
CVS tags: pkgsrc-2006Q4-base, pkgsrc-2006Q4
Diff to: previous 1.9: preferred, colored
Changes since revision 1.9: +2 -2 lines
Update hpn-patch to hpn12v13 since old one has gone.

Bump PKGREVISION.

Revision 1.9: download - view: text, markup, annotated - select for diffs
Tue Oct 31 03:31:19 2006 UTC (18 years, 1 month ago) by taca
Branches: MAIN
Diff to: previous 1.8: preferred, colored
Changes since revision 1.8: +2 -2 lines
Update openssh package to 4.4.1 (openssh-4.4p1).

- A few pkglint warning clean up.
- Major changes are here.  For complete changes,
  see http://www.openssh.com/txt/release-4.4.

Changes since OpenSSH 4.3:
============================

Security bugs resolved in this release:

 * Fix a pre-authentication denial of service found by Tavis Ormandy,
   that would cause sshd(8) to spin until the login grace time
   expired.

 * Fix an unsafe signal hander reported by Mark Dowd. The signal
   handler was vulnerable to a race condition that could be exploited
   to perform a pre-authentication denial of service. On portable
   OpenSSH, this vulnerability could theoretically lead to
   pre-authentication remote code execution if GSSAPI authentication
   is enabled, but the likelihood of successful exploitation appears
   remote.

 * On portable OpenSSH, fix a GSSAPI authentication abort that could
   be used to determine the validity of usernames on some platforms.

This release includes the following new functionality and fixes:

 * Implemented conditional configuration in sshd_config(5) using the
   "Match" directive. This allows some configuration options to be
   selectively overridden if specific criteria (based on user, group,
   hostname and/or address) are met. So far a useful subset of post-
   authentication options are supported and more are expected to be
   added in future releases.

 * Add support for Diffie-Hellman group exchange key agreement with a
   final hash of SHA256.

 * Added a "ForceCommand" directive to sshd_config(5). Similar to the
   command="..." option accepted in ~/.ssh/authorized_keys, this forces
   the execution of the specified command regardless of what the user
   requested. This is very useful in conjunction with the new "Match"
   option.

 * Add a "PermitOpen" directive to sshd_config(5). This mirrors the
   permitopen="..." authorized_keys option, allowing fine-grained
   control over the port-forwardings that a user is allowed to
   establish.

 * Add optional logging of transactions to sftp-server(8).

 * ssh(1) will now record port numbers for hosts stored in
   ~/.ssh/authorized_keys when a non-standard port has been requested.

 * Add an "ExitOnForwardFailure" option to cause ssh(1) to exit (with
   a non-zero exit code) when requested port forwardings could not be
   established.

 * Extend sshd_config(5) "SubSystem" declarations to allow the
   specification of command-line arguments.

 * Replacement of all integer overflow susceptible invocations of
   malloc(3) and realloc(3) with overflow-checking equivalents.

 * Many manpage fixes and improvements

 * New portable OpenSSH-specific features:

   - Add optional support for SELinux, controlled using the
     --with-selinux configure option (experimental)

   - Add optional support for Solaris process contracts, enabled
     using the --with-solaris-contracts configure option (experimental)
     This option will also include SMF metadata in Solaris packages
     built using the "make package" target

   - Add optional support for OpenSSL hardware accelerators (engines),
     enabled using the --with-ssl-engine configure option.

Revision 1.7.2.1: download - view: text, markup, annotated - select for diffs
Sun Feb 12 01:53:43 2006 UTC (18 years, 10 months ago) by seb
Branches: pkgsrc-2005Q4
Diff to: previous 1.7: preferred, colored; next MAIN 1.8: preferred, colored
Changes since revision 1.7: +2 -2 lines
Pullup ticket 1118 - requested by Lubomir Sedlacik
update security/openssh including security fix

Revisions pulled up:
- pkgsrc/security/openssh/Makefile                            1.164
- pkgsrc/security/openssh/distinfo                            1.51
- pkgsrc/security/openssh/options.mk                          1.8
- pkgsrc/security/openssh/patches/patch-aa                    1.41
- pkgsrc/security/openssh/patches/patch-ab                    1.23
- pkgsrc/security/openssh/patches/patch-ac                    1.15
- pkgsrc/security/openssh/patches/patch-ae                    1.11
- pkgsrc/security/openssh/patches/patch-ag                    1.8
- pkgsrc/security/openssh/patches/patch-ao                    1.8
- pkgsrc/security/openssh/patches/patch-am                    1.6
- pkgsrc/security/openssh/patches/patch-an                    1.7
- pkgsrc/security/openssh/patches/patch-ap                    1.7
- pkgsrc/security/openssh/patches/patch-at                    1.3
- pkgsrc/security/openssh/patches/patch-av                    1.4

   Module Name:	pkgsrc
   Committed By:	salo
   Date:		Sun Feb 12 00:13:55 UTC 2006

   Modified Files:
   	pkgsrc/security/openssh: Makefile distinfo options.mk
   	pkgsrc/security/openssh/patches: patch-aa patch-ab patch-ac patch-ae
   	    patch-ag patch-am patch-an patch-ao patch-ap patch-at patch-av

   Log Message:
   Update to version 3.4p1

   From Jason White via PR pkg/32780

   Changes:

   Security bugs resolved in this release:

    * CVE-2006-0225: scp (as does rcp, on which it is based) invoked a
      subshell to perform local to local, and remote to remote copy
      operations. This subshell exposed filenames to shell expansion
      twice; allowing a local attacker to create filenames containing
      shell metacharacters that, if matched by a wildcard, could lead
      to execution of attacker-specified commands with the privilege of
      the user running scp (Bugzilla #1094)

   This is primarily a bug-fix release, only one new feature has been
   added:

    * Add support for tunneling arbitrary network packets over a
      connection between an OpenSSH client and server via tun(4) virtual
      network interfaces. This allows the use of OpenSSH (4.3+) to create
      a true VPN between the client and server providing real network
      connectivity at layer 2 or 3. This feature is experimental and is
      currently supported on OpenBSD, Linux, NetBSD (IPv4 only) and
      FreeBSD. Other operating systems with tun/tap interface capability
      may be added in future portable OpenSSH releases. Please refer to
      the README.tun file in the source distribution for further details
      and usage examples.

   Some of the other bugs resolved and internal improvements are:

    * Reduce default key length for new DSA keys generated by ssh-keygen
      back to 1024 bits. DSA is not specified for longer lengths and does
      not fully benefit from simply making keys longer. As per FIPS 186-2
      Change Notice 1, ssh-keygen will refuse to generate a new DSA key
      smaller or larger than 1024 bits

    * Fixed X forwarding failing to start when a the X11 client is executed
      in background at the time of session exit (Bugzilla #1086)

    * Change ssh-keygen to generate a protocol 2 RSA key when invoked
      without arguments (Bugzilla #1064)

    * Fix timing variance for valid vs. invalid accounts when attempting
      Kerberos authentication (Bugzilla #975)

    * Ensure that ssh always returns code 255 on internal error (Bugzilla
      #1137)

    * Cleanup wtmp files on SIGTERM when not using privsep (Bugzilla #1029)

    * Set SO_REUSEADDR on X11 listeners to avoid problems caused by
      lingering sockets from previous session (X11 applications can
      sometimes not connect to 127.0.0.1:60xx) (Bugzilla #1076)

    * Ensure that fds 0, 1 and 2 are always attached in all programs, by
      duping /dev/null to them if necessary.

    * Xauth list invocation had bogus "." argument (Bugzilla #1082)

    * Remove internal assumptions on key exchange hash algorithm and output
      length, preparing OpenSSH for KEX methods with alternate hashes.

    * Ignore junk sent by a server before it sends the "SSH-" banner
      (Bugzilla #1067)

    * The manpages has been significantly improves and rearranged, in
      addition to other specific manpage fixes:
      #1037 - Man page entries for -L and -R should mention -g.
      #1077 - Descriptions for "ssh -D" and DynamicForward should mention
              they can specify "bind_address" optionally.
      #1088 - Incorrect descriptions in ssh_config man page for
              ControlMaster=no.
      #1121 - Several corrections for ssh_agent manpages

    * Lots of cleanups, including fixes to memory leaks on error paths
      (Bugzilla #1109, #1110, #1111 and more) and possible crashes (#1092)

    * Portable OpenSSH-specific fixes:

      - Pass random seed during re-exec for each connection: speeds up
        processing of new connections on platforms using the OpenSSH's
        builtin entropy collector (ssh-rand-helper)

      - PAM fixes and improvements:
        #1045 - Missing option for ignoring the /etc/nologin file
        #1087 - Show PAM password expiry message from LDAP on login
        #1028 - Forward final non-query conversations to client
        #1126 - Prevent user from being forced to change an expired
                password repeatedly on AIX in some PAM configurations.
        #1045 - Do not check /etc/nologin when PAM is enabled, instead
                allow PAM to handle it. Note that on platforms using
                PAM, the pam_nologin module should be used in sshd's
                session stack in order to maintain past behaviour

      - Portability-related fixes:
        #989 - Fix multiplexing regress test on Solaris
        #1097 - Cross-compile fixes.
        #1096 - ssh-keygen broken on HPUX.
        #1098 - $MAIL being set incorrectly for HPUX server login.
        #1104 - Compile error on Tru64 Unix 4.0f
        #1106 - Updated .spec file and startup for SuSE.
        #1122 - Use _GNU_SOURCE define in favor of __USE_GNU, fixing
                compilation problems on glibc 2.4

Revision 1.8: download - view: text, markup, annotated - select for diffs
Sun Feb 12 00:13:55 2006 UTC (18 years, 10 months ago) by salo
Branches: MAIN
CVS tags: pkgsrc-2006Q3-base, pkgsrc-2006Q2-base, pkgsrc-2006Q2, pkgsrc-2006Q1-base, pkgsrc-2006Q1
Branch point for: pkgsrc-2006Q3
Diff to: previous 1.7: preferred, colored
Changes since revision 1.7: +2 -2 lines
Update to version 3.4p1

From Jason White via PR pkg/32780

Changes:

Security bugs resolved in this release:

 * CVE-2006-0225: scp (as does rcp, on which it is based) invoked a
   subshell to perform local to local, and remote to remote copy
   operations. This subshell exposed filenames to shell expansion
   twice; allowing a local attacker to create filenames containing
   shell metacharacters that, if matched by a wildcard, could lead
   to execution of attacker-specified commands with the privilege of
   the user running scp (Bugzilla #1094)

This is primarily a bug-fix release, only one new feature has been
added:

 * Add support for tunneling arbitrary network packets over a
   connection between an OpenSSH client and server via tun(4) virtual
   network interfaces. This allows the use of OpenSSH (4.3+) to create
   a true VPN between the client and server providing real network
   connectivity at layer 2 or 3. This feature is experimental and is
   currently supported on OpenBSD, Linux, NetBSD (IPv4 only) and
   FreeBSD. Other operating systems with tun/tap interface capability
   may be added in future portable OpenSSH releases. Please refer to
   the README.tun file in the source distribution for further details
   and usage examples.

Some of the other bugs resolved and internal improvements are:

 * Reduce default key length for new DSA keys generated by ssh-keygen
   back to 1024 bits. DSA is not specified for longer lengths and does
   not fully benefit from simply making keys longer. As per FIPS 186-2
   Change Notice 1, ssh-keygen will refuse to generate a new DSA key
   smaller or larger than 1024 bits

 * Fixed X forwarding failing to start when a the X11 client is executed
   in background at the time of session exit (Bugzilla #1086)

 * Change ssh-keygen to generate a protocol 2 RSA key when invoked
   without arguments (Bugzilla #1064)

 * Fix timing variance for valid vs. invalid accounts when attempting
   Kerberos authentication (Bugzilla #975)

 * Ensure that ssh always returns code 255 on internal error (Bugzilla
   #1137)

 * Cleanup wtmp files on SIGTERM when not using privsep (Bugzilla #1029)

 * Set SO_REUSEADDR on X11 listeners to avoid problems caused by
   lingering sockets from previous session (X11 applications can
   sometimes not connect to 127.0.0.1:60xx) (Bugzilla #1076)

 * Ensure that fds 0, 1 and 2 are always attached in all programs, by
   duping /dev/null to them if necessary.

 * Xauth list invocation had bogus "." argument (Bugzilla #1082)

 * Remove internal assumptions on key exchange hash algorithm and output
   length, preparing OpenSSH for KEX methods with alternate hashes.

 * Ignore junk sent by a server before it sends the "SSH-" banner
   (Bugzilla #1067)

 * The manpages has been significantly improves and rearranged, in
   addition to other specific manpage fixes:
   #1037 - Man page entries for -L and -R should mention -g.
   #1077 - Descriptions for "ssh -D" and DynamicForward should mention
           they can specify "bind_address" optionally.
   #1088 - Incorrect descriptions in ssh_config man page for
           ControlMaster=no.
   #1121 - Several corrections for ssh_agent manpages

 * Lots of cleanups, including fixes to memory leaks on error paths
   (Bugzilla #1109, #1110, #1111 and more) and possible crashes (#1092)

 * Portable OpenSSH-specific fixes:

   - Pass random seed during re-exec for each connection: speeds up
     processing of new connections on platforms using the OpenSSH's
     builtin entropy collector (ssh-rand-helper)

   - PAM fixes and improvements:
     #1045 - Missing option for ignoring the /etc/nologin file
     #1087 - Show PAM password expiry message from LDAP on login
     #1028 - Forward final non-query conversations to client
     #1126 - Prevent user from being forced to change an expired
             password repeatedly on AIX in some PAM configurations.
     #1045 - Do not check /etc/nologin when PAM is enabled, instead
             allow PAM to handle it. Note that on platforms using
             PAM, the pam_nologin module should be used in sshd's
             session stack in order to maintain past behaviour

   - Portability-related fixes:
     #989 - Fix multiplexing regress test on Solaris
     #1097 - Cross-compile fixes.
     #1096 - ssh-keygen broken on HPUX.
     #1098 - $MAIL being set incorrectly for HPUX server login.
     #1104 - Compile error on Tru64 Unix 4.0f
     #1106 - Updated .spec file and startup for SuSE.
     #1122 - Use _GNU_SOURCE define in favor of __USE_GNU, fixing
             compilation problems on glibc 2.4

Revision 1.7: download - view: text, markup, annotated - select for diffs
Mon Dec 5 23:55:18 2005 UTC (19 years ago) by rillig
Branches: MAIN
CVS tags: pkgsrc-2005Q4-base
Branch point for: pkgsrc-2005Q4
Diff to: previous 1.6: preferred, colored
Changes since revision 1.6: +2 -2 lines
Ran "pkglint --autofix", which corrected some of the quoting issues in
CONFIGURE_ARGS.

Revision 1.6: download - view: text, markup, annotated - select for diffs
Wed Sep 21 18:07:09 2005 UTC (19 years, 2 months ago) by reed
Branches: MAIN
CVS tags: pkgsrc-2005Q3-base, pkgsrc-2005Q3
Diff to: previous 1.5: preferred, colored
Changes since revision 1.5: +2 -2 lines
Update openssh to 4.2p1. This is from PR #31331. Thank you, Jason.

Some changes different from patches provided in that PR are:

- patch-aj, patch-aq, and patch-as not changed (they appeared to
  be identical to previous patches)

- DragonFly support also added to configure script (patch-aa)
  because compilation failed due to missing crypt

- and install-sysconf target removed from the installation target
  in Makefile.in (patch-ah). Just let the pkgsrc framework install
  this since it now will allow it to be removed correctly on
  deinstall.

- use "pam" instead of "PAM" as option name in the post-install
  target.

This removes patch-ai.

This also now uses openssh-4.2p1-hpn11.diff patch.

I didn't test with kerberos and hpn-patch options. I did test with
PAM on Linux. (The PR reported that kerberos and hpn-patch options
were tested for compiling.) I tested on NetBSD 2.0.2, Linux,
and DragonFly.

This includes two security fixes and several bug fixes and many
improvemens.  The changes are listed at
http://www.mindrot.org/pipermail/openssh-unix-announce/2005-September/000083.html
http://www.mindrot.org/pipermail/openssh-unix-announce/2005-May/000079.html

TODO: get some of these patches committed upstream.

Revision 1.5: download - view: text, markup, annotated - select for diffs
Thu Jul 28 17:54:57 2005 UTC (19 years, 4 months ago) by reed
Branches: MAIN
Diff to: previous 1.4: preferred, colored
Changes since revision 1.4: +2 -1 lines
MESSAGE file removed. As mentioned on tech-pkg in May, /etc/ssh.conf
and /etc/sshd.conf is old (and I assume some configurations from
there don't apply any more), user and group are not created
automatically (only if PKG_CREATE_USERGROUP is at default YES),
UsePrivilegeSeparation is the default, and seems to imply that
openssh is insecure without it.

Bump PKGREVISION.

Change comment regarding MESSAGE.Interix.

Removed unused MESSAGE_SUBST settings. Move one to the options.mk
as it is for "pam" only.

Revision 1.4: download - view: text, markup, annotated - select for diffs
Tue May 31 11:24:33 2005 UTC (19 years, 6 months ago) by dillo
Branches: MAIN
CVS tags: pkgsrc-2005Q2-base, pkgsrc-2005Q2
Diff to: previous 1.3: preferred, colored
Changes since revision 1.3: +3 -3 lines
Rename option PAM to pam (so all options are lower case).  Backwards
compatibility provided via PKG_OPTIONS_LEGACY_OPTS.

Revision 1.3: download - view: text, markup, annotated - select for diffs
Fri Jan 14 05:15:40 2005 UTC (19 years, 11 months ago) by jlam
Branches: MAIN
CVS tags: pkgsrc-2005Q1-base, pkgsrc-2005Q1
Diff to: previous 1.2: preferred, colored
Changes since revision 1.2: +2 -2 lines
Create a pam.buildlink3.mk file that is used by PAM-using packages.
It includes the correct buildlink3.mk file from either Linux-PAM
(security/PAM) or OpenPAM (security/openpam) and eventually will
support solaris-pam.  pam.buildlink3.mk will:

	* set PAMBASE to the base directory of the PAM files;
	* set PAM_TYPE to the PAM implementation used.

There are two variables that can be used to tweak the selection of
the PAM implementation:

PAM_DEFAULT is a user-settable variable whose value is the default
	PAM implementation to use.

PAM_ACCEPTED is a package-settable list of PAM implementations
	that may be used by the package.

Modify most packages that include PAM/buildlink3.mk to include
pam.buildlink3.mk instead.

Revision 1.2: download - view: text, markup, annotated - select for diffs
Wed Dec 22 21:46:25 2004 UTC (19 years, 11 months ago) by jlam
Branches: MAIN
Diff to: previous 1.1: preferred, colored
Changes since revision 1.1: +1 -17 lines
Remove support for some variables that are supposed to go away after
pkgsrc-2004Q4 is branched.

Revision 1.1: download - view: text, markup, annotated - select for diffs
Thu Nov 25 19:25:28 2004 UTC (20 years ago) by xtraeme
Branches: MAIN
CVS tags: pkgsrc-2004Q4-base, pkgsrc-2004Q4
Convert to use bsd.options.mk with the following options:

	hpn-patch kerberos PAM (only Linux)

The hpn-patch option uses the patch available in:
http://www.psc.edu/networking/projects/hpn-ssh/ to enable high performance
connections.

Also use VARBASE intead of hardcoding /var.

Bump PKGREVISION.

Diff request

This form allows you to request diffs between any two revisions of a file. You may select a symbolic revision name using the selection box or you may type in a numeric name using the type-in text box.

Log view options

CVSweb <webmaster@jp.NetBSD.org>