The NetBSD Project

CVS log for pkgsrc/security/openssh/options.mk

[BACK] Up to [cvs.NetBSD.org] / pkgsrc / security / openssh

Request diff between arbitrary revisions


Default branch: MAIN


Revision 1.39 / (download) - annotate - [select for diffs], Fri Aug 21 01:49:24 2020 UTC (2 years, 5 months ago) by riastradh
Branch: MAIN
CVS Tags: pkgsrc-2022Q4-base, pkgsrc-2022Q4, pkgsrc-2022Q3-base, pkgsrc-2022Q3, pkgsrc-2022Q2-base, pkgsrc-2022Q2, pkgsrc-2022Q1-base, pkgsrc-2022Q1, pkgsrc-2021Q4-base, pkgsrc-2021Q4, pkgsrc-2021Q3-base, pkgsrc-2021Q3, pkgsrc-2021Q2-base, pkgsrc-2021Q2, pkgsrc-2021Q1-base, pkgsrc-2021Q1, pkgsrc-2020Q4-base, pkgsrc-2020Q4, pkgsrc-2020Q3-base, pkgsrc-2020Q3, HEAD
Changes since 1.38: +7 -2 lines
Diff to previous 1.38 (colored)

security/openssh: New fido option.

This enables built-in U2F/FIDO security key support, without any
SSH_SK_PROVIDER middleware library needed.  Works only on platforms
with working libfido2, so not enabled by default yet.  We should
enable it by default in NetBSD>=10 and maybe some other platforms.

Revision 1.38 / (download) - annotate - [select for diffs], Mon Nov 4 21:12:56 2019 UTC (3 years, 2 months ago) by rillig
Branch: MAIN
CVS Tags: pkgsrc-2020Q2-base, pkgsrc-2020Q2, pkgsrc-2020Q1-base, pkgsrc-2020Q1, pkgsrc-2019Q4-base, pkgsrc-2019Q4
Changes since 1.37: +2 -2 lines
Diff to previous 1.37 (colored)

security: align variable assignments

pkglint -Wall -F --only aligned --only indent -r

No manual corrections.

Revision 1.37 / (download) - annotate - [select for diffs], Fri Sep 6 09:03:00 2019 UTC (3 years, 4 months ago) by manu
Branch: MAIN
CVS Tags: pkgsrc-2019Q3-base, pkgsrc-2019Q3
Changes since 1.36: +6 -2 lines
Diff to previous 1.36 (colored)

Add legacymodsz option to allow short (insecure) RSA keys

This may be required in order to access old, non-upgradable, devices for
which modulus size is less than 1024 bits (frequently 768 bits).

Revision 1.36 / (download) - annotate - [select for diffs], Thu Apr 25 14:55:04 2019 UTC (3 years, 9 months ago) by tron
Branch: MAIN
CVS Tags: pkgsrc-2019Q2-base, pkgsrc-2019Q2
Changes since 1.35: +10 -5 lines
Diff to previous 1.35 (colored)

openssh: Add optional command line editing to "sftp"

Add new package option "editline" (enabled by default) which adds
command line editing and filename completion to the "sftp" client.

Bump the package revision because of this change.

Revision 1.35 / (download) - annotate - [select for diffs], Mon Jul 24 16:33:22 2017 UTC (5 years, 6 months ago) by he
Branch: MAIN
CVS Tags: pkgsrc-2019Q1-base, pkgsrc-2019Q1, pkgsrc-2018Q4-base, pkgsrc-2018Q4, pkgsrc-2018Q3-base, pkgsrc-2018Q3, pkgsrc-2018Q2-base, pkgsrc-2018Q2, pkgsrc-2018Q1-base, pkgsrc-2018Q1, pkgsrc-2017Q4-base, pkgsrc-2017Q4, pkgsrc-2017Q3-base, pkgsrc-2017Q3
Changes since 1.34: +5 -1 lines
Diff to previous 1.34 (colored)

Include 'pam' in the suggested/default list of options on NetBSD.
Add LICENSE setting, near as I can tell "modified-bsd".
Bump PKGREVISION.

Revision 1.33.4.1 / (download) - annotate - [select for diffs], Sun Jan 8 11:05:07 2017 UTC (6 years ago) by bsiegert
Branch: pkgsrc-2016Q4
Changes since 1.33: +7 -7 lines
Diff to previous 1.33 (colored) next main 1.34 (colored)

Pullup ticket #5178 - requested by taca
security/openssh: security fix

Revisions pulled up:
- security/openssh/Makefile                                     1.250
- security/openssh/distinfo                                     1.103
- security/openssh/options.mk                                   1.34
- security/openssh/patches/patch-auth1.c                        deleted
- security/openssh/patches/patch-clientloop.c                   1.5
- security/openssh/patches/patch-openbsd-compat_bsd-openpty.c   1.4
- security/openssh/patches/patch-session.c                      1.8
- security/openssh/patches/patch-sshd.c                         1.8

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Fri Dec 30 04:43:16 UTC 2016

   Modified Files:
   	pkgsrc/security/openssh: Makefile distinfo options.mk
   	pkgsrc/security/openssh/patches: patch-clientloop.c
   	    patch-openbsd-compat_bsd-openpty.c patch-session.c patch-sshd.c
   Removed Files:
   	pkgsrc/security/openssh/patches: patch-auth1.c

   Log Message:
   Update openssh to 7.4.1 (7.4p1), including security fixes.

   For full changes, please refer ChangeLog file.

   Future deprecation notice
   =========================

   We plan on retiring more legacy cryptography in future releases,
   specifically:

    * In approximately August 2017, removing remaining support for the
      SSH v.1 protocol (client-only and currently compile-time disabled).

    * In the same release, removing support for Blowfish and RC4 ciphers
      and the RIPE-MD160 HMAC. (These are currently run-time disabled).

    * Refusing all RSA keys smaller than 1024 bits (the current minimum
      is 768 bits)

    * The next release of OpenSSH will remove support for running sshd(8)
      with privilege separation disabled.

    * The next release of portable OpenSSH will remove support for
      OpenSSL version prior to 1.0.1.

   This list reflects our current intentions, but please check the final
   release notes for future releases.

   Potentially-incompatible changes
   ================================

   This release includes a number of changes that may affect existing
   configurations:

    * This release removes server support for the SSH v.1 protocol.

    * ssh(1): Remove 3des-cbc from the client's default proposal. 64-bit
      block ciphers are not safe in 2016 and we don't want to wait until
      attacks like SWEET32 are extended to SSH. As 3des-cbc was the
      only mandatory cipher in the SSH RFCs, this may cause problems
      connecting to older devices using the default configuration,
      but it's highly likely that such devices already need explicit
      configuration for key exchange and hostkey algorithms already
      anyway.

    * sshd(8): Remove support for pre-authentication compression.
      Doing compression early in the protocol probably seemed reasonable
      in the 1990s, but today it's clearly a bad idea in terms of both
      cryptography (cf. multiple compression oracle attacks in TLS) and
      attack surface. Pre-auth compression support has been disabled by
      default for >10 years. Support remains in the client.

    * ssh-agent will refuse to load PKCS#11 modules outside a whitelist
      of trusted paths by default. The path whitelist may be specified
      at run-time.

    * sshd(8): When a forced-command appears in both a certificate and
      an authorized keys/principals command= restriction, sshd will now
      refuse to accept the certificate unless they are identical.
      The previous (documented) behaviour of having the certificate
      forced-command override the other could be a bit confusing and
      error-prone.

    * sshd(8): Remove the UseLogin configuration directive and support
      for having /bin/login manage login sessions.

   Changes since OpenSSH 7.3
   =========================

   This is primarily a bugfix release.

   Security
   --------

    * ssh-agent(1): Will now refuse to load PKCS#11 modules from paths
      outside a trusted whitelist (run-time configurable). Requests to
      load modules could be passed via agent forwarding and an attacker
      could attempt to load a hostile PKCS#11 module across the forwarded
      agent channel: PKCS#11 modules are shared libraries, so this would
      result in code execution on the system running the ssh-agent if the
      attacker has control of the forwarded agent-socket (on the host
      running the sshd server) and the ability to write to the filesystem
      of the host running ssh-agent (usually the host running the ssh
      client). Reported by Jann Horn of Project Zero.

    * sshd(8): When privilege separation is disabled, forwarded Unix-
      domain sockets would be created by sshd(8) with the privileges of
      'root' instead of the authenticated user. This release refuses
      Unix-domain socket forwarding when privilege separation is disabled
      (Privilege separation has been enabled by default for 14 years).
      Reported by Jann Horn of Project Zero.

    * sshd(8): Avoid theoretical leak of host private key material to
      privilege-separated child processes via realloc() when reading
      keys. No such leak was observed in practice for normal-sized keys,
      nor does a leak to the child processes directly expose key material
      to unprivileged users. Reported by Jann Horn of Project Zero.

    * sshd(8): The shared memory manager used by pre-authentication
      compression support had a bounds checks that could be elided by
      some optimising compilers. Additionally, this memory manager was
      incorrectly accessible when pre-authentication compression was
      disabled. This could potentially allow attacks against the
      privileged monitor process from the sandboxed privilege-separation
      process (a compromise of the latter would be required first).
      This release removes support for pre-authentication compression
      from sshd(8). Reported by Guido Vranken using the Stack unstable
      optimisation identification tool (http://css.csail.mit.edu/stack/)

    * sshd(8): Fix denial-of-service condition where an attacker who
      sends multiple KEXINIT messages may consume up to 128MB per
      connection. Reported by Shi Lei of Gear Team, Qihoo 360.

    * sshd(8): Validate address ranges for AllowUser and DenyUsers
      directives at configuration load time and refuse to accept invalid
      ones. It was previously possible to specify invalid CIDR address
      ranges (e.g. user@127.1.2.3/55) and these would always match,
      possibly resulting in granting access where it was not intended.
      Reported by Laurence Parry.

Revision 1.34 / (download) - annotate - [select for diffs], Fri Dec 30 04:43:16 2016 UTC (6 years, 1 month ago) by taca
Branch: MAIN
CVS Tags: pkgsrc-2017Q2-base, pkgsrc-2017Q2, pkgsrc-2017Q1-base, pkgsrc-2017Q1
Changes since 1.33: +7 -7 lines
Diff to previous 1.33 (colored)

Update openssh to 7.4.1 (7.4p1), including security fixes.

For full changes, please refer ChangeLog file.


Future deprecation notice
=========================

We plan on retiring more legacy cryptography in future releases,
specifically:

 * In approximately August 2017, removing remaining support for the
   SSH v.1 protocol (client-only and currently compile-time disabled).

 * In the same release, removing support for Blowfish and RC4 ciphers
   and the RIPE-MD160 HMAC. (These are currently run-time disabled).

 * Refusing all RSA keys smaller than 1024 bits (the current minimum
   is 768 bits)

 * The next release of OpenSSH will remove support for running sshd(8)
   with privilege separation disabled.

 * The next release of portable OpenSSH will remove support for
   OpenSSL version prior to 1.0.1.

This list reflects our current intentions, but please check the final
release notes for future releases.

Potentially-incompatible changes
================================

This release includes a number of changes that may affect existing
configurations:

 * This release removes server support for the SSH v.1 protocol.

 * ssh(1): Remove 3des-cbc from the client's default proposal. 64-bit
   block ciphers are not safe in 2016 and we don't want to wait until
   attacks like SWEET32 are extended to SSH. As 3des-cbc was the
   only mandatory cipher in the SSH RFCs, this may cause problems
   connecting to older devices using the default configuration,
   but it's highly likely that such devices already need explicit
   configuration for key exchange and hostkey algorithms already
   anyway.

 * sshd(8): Remove support for pre-authentication compression.
   Doing compression early in the protocol probably seemed reasonable
   in the 1990s, but today it's clearly a bad idea in terms of both
   cryptography (cf. multiple compression oracle attacks in TLS) and
   attack surface. Pre-auth compression support has been disabled by
   default for >10 years. Support remains in the client.

 * ssh-agent will refuse to load PKCS#11 modules outside a whitelist
   of trusted paths by default. The path whitelist may be specified
   at run-time.

 * sshd(8): When a forced-command appears in both a certificate and
   an authorized keys/principals command= restriction, sshd will now
   refuse to accept the certificate unless they are identical.
   The previous (documented) behaviour of having the certificate
   forced-command override the other could be a bit confusing and
   error-prone.

 * sshd(8): Remove the UseLogin configuration directive and support
   for having /bin/login manage login sessions.

Changes since OpenSSH 7.3
=========================

This is primarily a bugfix release.

Security
--------

 * ssh-agent(1): Will now refuse to load PKCS#11 modules from paths
   outside a trusted whitelist (run-time configurable). Requests to
   load modules could be passed via agent forwarding and an attacker
   could attempt to load a hostile PKCS#11 module across the forwarded
   agent channel: PKCS#11 modules are shared libraries, so this would
   result in code execution on the system running the ssh-agent if the
   attacker has control of the forwarded agent-socket (on the host
   running the sshd server) and the ability to write to the filesystem
   of the host running ssh-agent (usually the host running the ssh
   client). Reported by Jann Horn of Project Zero.

 * sshd(8): When privilege separation is disabled, forwarded Unix-
   domain sockets would be created by sshd(8) with the privileges of
   'root' instead of the authenticated user. This release refuses
   Unix-domain socket forwarding when privilege separation is disabled
   (Privilege separation has been enabled by default for 14 years).
   Reported by Jann Horn of Project Zero.

 * sshd(8): Avoid theoretical leak of host private key material to
   privilege-separated child processes via realloc() when reading
   keys. No such leak was observed in practice for normal-sized keys,
   nor does a leak to the child processes directly expose key material
   to unprivileged users. Reported by Jann Horn of Project Zero.

 * sshd(8): The shared memory manager used by pre-authentication
   compression support had a bounds checks that could be elided by
   some optimising compilers. Additionally, this memory manager was
   incorrectly accessible when pre-authentication compression was
   disabled. This could potentially allow attacks against the
   privileged monitor process from the sandboxed privilege-separation
   process (a compromise of the latter would be required first).
   This release removes support for pre-authentication compression
   from sshd(8). Reported by Guido Vranken using the Stack unstable
   optimisation identification tool (http://css.csail.mit.edu/stack/)

 * sshd(8): Fix denial-of-service condition where an attacker who
   sends multiple KEXINIT messages may consume up to 128MB per
   connection. Reported by Shi Lei of Gear Team, Qihoo 360.

 * sshd(8): Validate address ranges for AllowUser and DenyUsers
   directives at configuration load time and refuse to accept invalid
   ones. It was previously possible to specify invalid CIDR address
   ranges (e.g. user@127.1.2.3/55) and these would always match,
   possibly resulting in granting access where it was not intended.
   Reported by Laurence Parry.

Revision 1.33 / (download) - annotate - [select for diffs], Sun Jul 10 10:41:38 2016 UTC (6 years, 6 months ago) by rillig
Branch: MAIN
CVS Tags: pkgsrc-2016Q4-base, pkgsrc-2016Q3-base, pkgsrc-2016Q3
Branch point for: pkgsrc-2016Q4
Changes since 1.32: +4 -4 lines
Diff to previous 1.32 (colored)

Fixed pkglint warnings about indentation.

Revision 1.32 / (download) - annotate - [select for diffs], Fri Jun 10 23:15:36 2016 UTC (6 years, 7 months ago) by alnsn
Branch: MAIN
CVS Tags: pkgsrc-2016Q2-base, pkgsrc-2016Q2
Changes since 1.31: +10 -2 lines
Diff to previous 1.31 (colored)

Add an option to build without openssl. Fix pkg/50936. Improve PIE build.

Revision 1.29.12.2 / (download) - annotate - [select for diffs], Thu Sep 3 19:30:17 2015 UTC (7 years, 4 months ago) by tron
Branch: pkgsrc-2015Q2
Changes since 1.29.12.1: +1 -1 lines
Diff to previous 1.29.12.1 (colored) to branchpoint 1.29 (colored) next main 1.30 (colored)

Pullup ticket #4807 - requested by taca
security/openssh: build fix patch

Revisions pulled up:
- security/openssh/distinfo                                     1.97
- security/openssh/options.mk                                   1.31

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Sat Aug 22 05:17:22 UTC 2015

   Modified Files:
   	pkgsrc/security/openssh: distinfo options.mk

   Log Message:
   Revive hpn-patch patch although not yet tested well.

Revision 1.31 / (download) - annotate - [select for diffs], Sat Aug 22 05:17:22 2015 UTC (7 years, 5 months ago) by taca
Branch: MAIN
CVS Tags: pkgsrc-2016Q1-base, pkgsrc-2016Q1, pkgsrc-2015Q4-base, pkgsrc-2015Q4, pkgsrc-2015Q3-base, pkgsrc-2015Q3
Changes since 1.30: +2 -2 lines
Diff to previous 1.30 (colored)

Revive hpn-patch patch although not yet tested well.

Revision 1.29.12.1 / (download) - annotate - [select for diffs], Tue Jul 14 22:03:39 2015 UTC (7 years, 6 months ago) by tron
Branch: pkgsrc-2015Q2
Changes since 1.29: +2 -2 lines
Diff to previous 1.29 (colored)

Pullup ticket #4771 - requested by taca
security/openssh: security update

Revisions pulled up:
- security/openssh/Makefile                                     1.233
- security/openssh/distinfo                                     1.92-1.93
- security/openssh/options.mk                                   1.30
- security/openssh/patches/patch-Makefile.in                    1.4
- security/openssh/patches/patch-auth-passwd.c                  1.2
- security/openssh/patches/patch-auth-rhosts.c                  1.2
- security/openssh/patches/patch-auth.c                         1.3
- security/openssh/patches/patch-auth1.c                        1.3
- security/openssh/patches/patch-auth2.c                        1.4
- security/openssh/patches/patch-channels.c                     1.2
- security/openssh/patches/patch-clientloop.c                   1.2
- security/openssh/patches/patch-compat.c                       deleted
- security/openssh/patches/patch-config.h.in                    1.4
- security/openssh/patches/patch-configure                      deleted
- security/openssh/patches/patch-configure.ac                   1.4
- security/openssh/patches/patch-defines.h                      1.3
- security/openssh/patches/patch-includes.h                     1.3
- security/openssh/patches/patch-openbsd-compat_openbsd-compat.h 1.3
- security/openssh/patches/patch-openbsd-compat_port-tun.c      1.2
- security/openssh/patches/patch-platform.c                     1.4
- security/openssh/patches/patch-scp.c                          1.3
- security/openssh/patches/patch-session.c                      1.4
- security/openssh/patches/patch-ssh.c                          1.4
- security/openssh/patches/patch-sshconnect.c                   deleted
- security/openssh/patches/patch-sshd.8                         1.1
- security/openssh/patches/patch-sshd.c                         1.4
- security/openssh/patches/patch-sshpty.c                       1.2

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Thu Jul  9 16:14:24 UTC 2015

   Modified Files:
   	pkgsrc/security/openssh: Makefile distinfo options.mk
   	pkgsrc/security/openssh/patches: patch-Makefile.in patch-auth-passwd.c
   	    patch-auth-rhosts.c patch-auth.c patch-auth1.c patch-auth2.c
   	    patch-channels.c patch-clientloop.c patch-config.h.in
   	    patch-configure.ac patch-defines.h patch-includes.h
   	    patch-openbsd-compat_openbsd-compat.h
   	    patch-openbsd-compat_port-tun.c patch-platform.c patch-scp.c
   	    patch-session.c patch-ssh.c patch-sshd.c patch-sshpty.c
   Added Files:
   	pkgsrc/security/openssh/patches: patch-sshd.8
   Removed Files:
   	pkgsrc/security/openssh/patches: patch-compat.c patch-configure
   	    patch-sshconnect.c

   Log Message:
   Update openssh to 6.9.1 (OpenSSH 6.9p1) which contains security fix.

   pkgsrc change:

   * tcp_wrappers support was removed from release 6.7, but add it refering
     FreeBSD's ports.
   * hpn-patch is also based on FreeBSD's ports.

   Security
   --------

    * ssh(1): when forwarding X11 connections with ForwardX11Trusted=no,
      connections made after ForwardX11Timeout expired could be permitted
      and no longer subject to XSECURITY restrictions because of an
      ineffective timeout check in ssh(1) coupled with "fail open"
      behaviour in the X11 server when clients attempted connections with
      expired credentials. This problem was reported by Jann Horn.

    * ssh-agent(1): fix weakness of agent locking (ssh-add -x) to
      password guessing by implementing an increasing failure delay,
      storing a salted hash of the password rather than the password
      itself and using a timing-safe comparison function for verifying
      unlock attempts. This problem was reported by Ryan Castellucci.

   For more information, please refer release announce.

   	http://www.openssh.com/txt/release-6.9
   	http://www.openssh.com/txt/release-6.8
   	http://www.openssh.com/txt/release-6.7

---
   Module Name:	pkgsrc
   Committed By:	dsainty
   Date:		Fri Jul 10 07:00:29 UTC 2015

   Modified Files:
   	pkgsrc/security/openssh: distinfo

   Log Message:
   Remove dangling stale hash for patch-sshconnect.c

Revision 1.30 / (download) - annotate - [select for diffs], Thu Jul 9 16:14:23 2015 UTC (7 years, 6 months ago) by taca
Branch: MAIN
Changes since 1.29: +2 -2 lines
Diff to previous 1.29 (colored)

Update openssh to 6.9.1 (OpenSSH 6.9p1) which contains security fix.

pkgsrc change:

* tcp_wrappers support was removed from release 6.7, but add it refering
  FreeBSD's ports.
* hpn-patch is also based on FreeBSD's ports.


Security
--------

 * ssh(1): when forwarding X11 connections with ForwardX11Trusted=no,
   connections made after ForwardX11Timeout expired could be permitted
   and no longer subject to XSECURITY restrictions because of an
   ineffective timeout check in ssh(1) coupled with "fail open"
   behaviour in the X11 server when clients attempted connections with
   expired credentials. This problem was reported by Jann Horn.

 * ssh-agent(1): fix weakness of agent locking (ssh-add -x) to
   password guessing by implementing an increasing failure delay,
   storing a salted hash of the password rather than the password
   itself and using a timing-safe comparison function for verifying
   unlock attempts. This problem was reported by Ryan Castellucci.

For more information, please refer release announce.

	http://www.openssh.com/txt/release-6.9
	http://www.openssh.com/txt/release-6.8
	http://www.openssh.com/txt/release-6.7

Revision 1.29 / (download) - annotate - [select for diffs], Sat Mar 29 10:30:15 2014 UTC (8 years, 10 months ago) by taca
Branch: MAIN
CVS Tags: pkgsrc-2015Q2-base, pkgsrc-2015Q1-base, pkgsrc-2015Q1, pkgsrc-2014Q4-base, pkgsrc-2014Q4, pkgsrc-2014Q3-base, pkgsrc-2014Q3, pkgsrc-2014Q2-base, pkgsrc-2014Q2, pkgsrc-2014Q1-base, pkgsrc-2014Q1
Branch point for: pkgsrc-2015Q2
Changes since 1.28: +3 -2 lines
Diff to previous 1.28 (colored)

Always add pam in PLIST_VARS.

Revision 1.28 / (download) - annotate - [select for diffs], Sat Mar 29 09:38:11 2014 UTC (8 years, 10 months ago) by taca
Branch: MAIN
Changes since 1.27: +7 -3 lines
Diff to previous 1.27 (colored)

Update openssh to 6.6.1 (OpenSSH 6.6p1).

pkgsrc change

    * Use PLIST_VARS.
    * Update hpn-patch based on openssh-6.5p1-hpnssh14v4.diff.gz.

Fixes security problem (SA57488).

For full changes, please refer below release notes.

	http://www.openssh.com/txt/release-6.5
	http://www.openssh.com/txt/release-6.6

Revision 1.27 / (download) - annotate - [select for diffs], Thu Dec 5 14:37:01 2013 UTC (9 years, 1 month ago) by taca
Branch: MAIN
CVS Tags: pkgsrc-2013Q4-base, pkgsrc-2013Q4
Changes since 1.26: +1 -2 lines
Diff to previous 1.26 (colored)

No need to specify -p1 as arguments of patch(1).

Revision 1.25.4.1 / (download) - annotate - [select for diffs], Thu Dec 5 09:52:53 2013 UTC (9 years, 1 month ago) by tron
Branch: pkgsrc-2013Q3
Changes since 1.25: +3 -3 lines
Diff to previous 1.25 (colored) next main 1.26 (colored)

Pullup ticket #4262 - requested by taca
security/openssh: security update

Revisions pulled up:
- security/openssh/Makefile                                     1.214
- security/openssh/distinfo                                     1.85
- security/openssh/options.mk                                   1.26
- security/openssh/patches/patch-Makefile.in                    1.2
- security/openssh/patches/patch-auth.c                         1.2
- security/openssh/patches/patch-auth1.c                        1.2
- security/openssh/patches/patch-auth2.c                        1.2
- security/openssh/patches/patch-config.h.in                    1.2
- security/openssh/patches/patch-configure                      1.2
- security/openssh/patches/patch-configure.ac                   1.2
- security/openssh/patches/patch-includes.h                     1.2
- security/openssh/patches/patch-scp.c                          1.2
- security/openssh/patches/patch-session.c                      1.2
- security/openssh/patches/patch-sftp-common.c                  1.1
- security/openssh/patches/patch-ssh.c                          1.2
- security/openssh/patches/patch-sshd.c                         1.2
- security/openssh/patches/patch-uidswap.c                      1.2

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Sun Dec  1 06:11:41 UTC 2013

   Modified Files:
   	pkgsrc/security/openssh: Makefile distinfo options.mk
   	pkgsrc/security/openssh/patches: patch-Makefile.in patch-auth.c
   	    patch-auth1.c patch-auth2.c patch-config.h.in patch-configure
   	    patch-configure.ac patch-includes.h patch-scp.c patch-session.c
   	    patch-ssh.c patch-sshd.c patch-uidswap.c
   Added Files:
   	pkgsrc/security/openssh/patches: patch-sftp-common.c

   Log Message:
   Update openssh to 6.4.1 (OpenSSH 6.4p1).

   Changes since OpenSSH 6.3
   =========================

   This release fixes a security bug:

    * sshd(8): fix a memory corruption problem triggered during rekeying
      when an AES-GCM cipher is selected. Full details of the vulnerability
      are available at: http://www.openssh.com/txt/gcmrekey.adv

   Changes since OpenSSH 6.2 is too many to write here, please refer
   the release note: http://www.openssh.com/txt/release-6.3.

Revision 1.26 / (download) - annotate - [select for diffs], Sun Dec 1 06:11:41 2013 UTC (9 years, 2 months ago) by taca
Branch: MAIN
Changes since 1.25: +3 -3 lines
Diff to previous 1.25 (colored)

Update openssh to 6.4.1 (OpenSSH 6.4p1).

Changes since OpenSSH 6.3
=========================

This release fixes a security bug:

 * sshd(8): fix a memory corruption problem triggered during rekeying
   when an AES-GCM cipher is selected. Full details of the vulnerability
   are available at: http://www.openssh.com/txt/gcmrekey.adv

Changes since OpenSSH 6.2 is too many to write here, please refer
the release note: http://www.openssh.com/txt/release-6.3.

Revision 1.25 / (download) - annotate - [select for diffs], Wed May 1 19:58:25 2013 UTC (9 years, 9 months ago) by imil
Branch: MAIN
CVS Tags: pkgsrc-2013Q3-base, pkgsrc-2013Q2-base, pkgsrc-2013Q2
Branch point for: pkgsrc-2013Q3
Changes since 1.24: +4 -20 lines
Diff to previous 1.24 (colored)

Changes since OpenSSH 6.1
=========================

This release introduces a number of new features:

Features:

 * ssh(1)/sshd(8): Added support for AES-GCM authenticated encryption in
   SSH protocol 2. The new cipher is available as aes128-gcm@openssh.com
   and aes256-gcm@openssh.com. It uses an identical packet format to the
   AES-GCM mode specified in RFC 5647, but uses simpler and different
   selection rules during key exchange.

 * ssh(1)/sshd(8): Added support for encrypt-then-mac (EtM) MAC modes
   for SSH protocol 2. These modes alter the packet format and compute
   the MAC over the packet length and encrypted packet rather than over
   the plaintext data. These modes are considered more secure and are
   used by default when available.

 * ssh(1)/sshd(8): Added support for the UMAC-128 MAC as
   "umac-128@openssh.com" and "umac-128-etm@openssh.com". The latter
   being an encrypt-then-mac mode.

 * sshd(8): Added support for multiple required authentication in SSH
   protocol 2 via an AuthenticationMethods option. This option lists
   one or more comma-separated lists of authentication method names.
   Successful completion of all the methods in any list is required for
   authentication to complete. This allows, for example, requiring a
   user having to authenticate via public key or GSSAPI before they
   are offered password authentication.

 * sshd(8)/ssh-keygen(1): Added support for Key Revocation Lists
   (KRLs), a compact binary format to represent lists of revoked keys
   and certificates that take as little as one bit per certificate when
   revoking by serial number. KRLs may be generated using ssh-keygen(1)
   and are loaded into sshd(8) via the existing RevokedKeys sshd_config
   option.

 * ssh(1): IdentitiesOnly now applies to keys obtained from a
   PKCS11Provider. This allows control of which keys are offered from
   tokens using IdentityFile.

 * sshd(8): sshd_config(5)'s AllowTcpForwarding now accepts "local"
   and "remote" in addition to its previous "yes"/"no" keywords to allow
   the server to specify whether just local or remote TCP forwarding is
   enabled.

 * sshd(8): Added a sshd_config(5) option AuthorizedKeysCommand to
   support fetching authorized_keys from a command in addition to (or
   instead of) from the filesystem. The command is run under an account
   specified by an AuthorizedKeysCommandUser sshd_config(5) option.

 * sftp-server(8): Now supports a -d option to allow the starting
   directory to be something other than the user's home directory.

 * ssh-keygen(1): Now allows fingerprinting of keys hosted in PKCS#11
   tokens using "ssh-keygen -lD pkcs11_provider".

 * ssh(1): When SSH protocol 2 only is selected (the default), ssh(1)
   now immediately sends its SSH protocol banner to the server without
   waiting to receive the server's banner, saving time when connecting.

 * ssh(1): Added ~v and ~V escape sequences to raise and lower the
   logging level respectively.

 * ssh(1): Made the escape command help (~?) context sensitive so that
   only commands that will work in the current session are shown.

 * ssh-keygen(1): When deleting host lines from known_hosts using
   "ssh-keygen -R host", ssh-keygen(1) now prints details of which lines
   were removed.

Bugfixes:

 * ssh(1): Force a clean shutdown of ControlMaster client sessions when
   the ~. escape sequence is used. This means that ~. should now work in
   mux clients even if the server is no longer responding.

 * ssh(1): Correctly detect errors during local TCP forward setup in
   multiplexed clients. bz#2055

 * ssh-add(1): Made deleting explicit keys "ssh-add -d" symmetric with
   adding keys with respect to certificates. It now tries to delete the
   corresponding certificate and respects the -k option to allow deleting
   of the key only.

 * sftp(1): Fix a number of parsing and command-editing bugs, including
   bz#1956

 * ssh(1): When muxmaster is run with -N, ensured that it shuts down
   gracefully when a client sends it "-O stop" rather than hanging around.
   bz#1985

 * ssh-keygen(1): When screening moduli candidates, append to the file
   rather than overwriting to allow resumption. bz#1957

 * ssh(1): Record "Received disconnect" messages at ERROR rather than
   INFO priority. bz#2057.

 * ssh(1): Loudly warn if explicitly-provided private key is unreadable.
   bz#1981

Portable OpenSSH:

 * sshd(8): The Linux seccomp-filter sandbox is now supported on ARM
   platforms where the kernel supports it.

 * sshd(8): The seccomp-filter sandbox will not be enabled if the system
   headers support it at compile time, regardless of whether it can be
   enabled then. If the run-time system does not support seccomp-filter,
   sshd will fall back to the rlimit pseudo-sandbox.

 * ssh(1): Don't link in the Kerberos libraries. They aren't necessary
   on the client, just on sshd(8). bz#2072

 * Fix GSSAPI linking on Solaris, which uses a differently-named GSSAPI
   library. bz#2073

 * Fix compilation on systems with openssl-1.0.0-fips.

 * Fix a number of errors in the RPM spec files.

Changes since OpenSSH 6.0
=========================

This is primarily a bugfix release.

Features:

 * sshd(8): This release turns on pre-auth sandboxing sshd by default for
   new installs, by setting UsePrivilegeSeparation=sandbox in sshd_config.
 * ssh-keygen(1): Add options to specify starting line number and number of
   lines to process when screening moduli candidates, allowing processing
   of different parts of a candidate moduli file in parallel
 * sshd(8): The Match directive now supports matching on the local (listen)
   address and port upon which the incoming connection was received via
   LocalAddress and LocalPort clauses.
 * sshd(8): Extend sshd_config Match directive to allow setting AcceptEnv
   and {Allow,Deny}{Users,Groups}
 * Add support for RFC6594 SSHFP DNS records for ECDSA key types. bz#1978
 * ssh-keygen(1): Allow conversion of RSA1 keys to public PEM and PKCS8
 * sshd(8): Allow the sshd_config PermitOpen directive to accept "none" as
   an argument to refuse all port-forwarding requests.
 * sshd(8): Support "none" as an argument for AuthorizedPrincipalsFile
 * ssh-keyscan(1): Look for ECDSA keys by default. bz#1971
 * sshd(8): Add "VersionAddendum" to sshd_config to allow server operators
   to append some arbitrary text to the server SSH protocol banner.

Bugfixes:

 * ssh(1)/sshd(8): Don't spin in accept() in situations of file
   descriptor exhaustion. Instead back off for a while.
 * ssh(1)/sshd(8): Remove hmac-sha2-256-96 and hmac-sha2-512-96 MACs as
   they were removed from the specification. bz#2023,
 * sshd(8): Handle long comments in config files better. bz#2025
 * ssh(1): Delay setting tty_flag so RequestTTY options are correctly
   picked up. bz#1995
 * sshd(8): Fix handling of /etc/nologin incorrectly being applied to root
   on platforms that use login_cap.

Portable OpenSSH:

 * sshd(8): Allow sshd pre-auth sandboxing to fall-back to the rlimit
   sandbox from the Linux SECCOMP filter sandbox when the latter is
   not available in the kernel.
 * ssh(1): Fix NULL dereference when built with LDNS and using DNSSEC to
   retrieve a CNAME SSHFP record.
 * Fix cross-compilation problems related to pkg-config. bz#1996

Changes since OpenSSH 5.9
=========================

This is primarily a bugfix release.

Features:

 * ssh-keygen(1): Add optional checkpoints for moduli screening
 * ssh-add(1): new -k option to load plain keys (skipping certificates)
 * sshd(8): Add wildcard support to PermitOpen, allowing things like
   "PermitOpen localhost:*".  bz #1857
 * ssh(1): support for cancelling local and remote port forwards via the
   multiplex socket. Use ssh -O cancel -L xx:xx:xx -R yy:yy:yy user@host"
   to request the cancellation of the specified forwardings
 * support cancellation of local/dynamic forwardings from ~C commandline

Bugfixes:

 * ssh(1): ensure that $DISPLAY contains only valid characters before
   using it to extract xauth data so that it can't be used to play local
   shell metacharacter games.
 * ssh(1): unbreak remote portforwarding with dynamic allocated listen ports
 * scp(1): uppress adding '--' to remote commandlines when the first
   argument does not start with '-'. saves breakage on some
   difficult-to-upgrade embedded/router platforms
 * ssh(1)/sshd(8): fix typo in IPQoS parsing: there is no "AF14" class,
   but there is an "AF21" class
 * ssh(1)/sshd(8): do not permit SSH2_MSG_SERVICE_REQUEST/ACCEPT during
   rekeying
 * ssh(1): skip attempting to create ~/.ssh when -F is passed
 * sshd(8): unbreak stdio forwarding when ControlPersist is in use; bz#1943
 * sshd(1): send tty break to pty master instead of (probably already
   closed) slave side; bz#1859
 * sftp(1): silence error spam for "ls */foo" in directory with files;
   bz#1683
 * Fixed a number of memory and file descriptor leaks

Portable OpenSSH:

 * Add a new privilege separation sandbox implementation for Linux's
   new seccomp sandbox, automatically enabled on platforms that support
   it. (Note: privilege separation sandboxing is still experimental)
 * Fix compilation problems on FreeBSD, where libutil contained openpty()
   but not login().
 * ssh-keygen(1): don't fail in -A on platforms that don't support ECC
 * Add optional support for LDNS, a BSD licensed DNS resolver library
   which supports DNSSEC
 * Relax OpenSSL version check to allow running OpenSSH binaries on
   systems with OpenSSL libraries with a newer "fix" or "patch" level
   than the binaries were originally compiled on (previous check only
   allowed movement within "patch" releases). bz#1991
 * Fix builds using contributed Redhat spec file. bz#1992

Changes since OpenSSH 5.8
=========================

Features:

 * Introduce sandboxing of the pre-auth privsep child using an optional
   sshd_config(5) "UsePrivilegeSeparation=sandbox" mode that enables
   mandatory restrictions on the syscalls the privsep child can perform.
   This intention is to prevent a compromised privsep child from being
   used to attack other hosts (by opening sockets and proxying) or
   probing local kernel attack surface.

   Three concrete sandbox implementation are provided (selected at
   configure time): systrace, seatbelt and rlimit.

   The systrace sandbox uses systrace(4) in unsupervised "fast-path"
   mode, where a list of permitted syscalls is supplied. Any syscall not
   on the list results in SIGKILL being sent to the privsep child. Note
   that this requires a kernel with the new SYSTR_POLICY_KILL option
   (only OpenBSD has this mode at present).

   The seatbelt sandbox uses OS X/Darwin sandbox(7) facilities with a
   strict (kSBXProfilePureComputation) policy that disables access to
   filesystem and network resources.

   The rlimit sandbox is a fallback choice for platforms that don't
   support a better one; it uses setrlimit() to reset the hard-limit
   of file descriptors and processes to zero, which should prevent
   the privsep child from forking or opening new network connections.

   Sandboxing of the privilege separated child process is currently
   experimental but should become the default in a future release.
   Native sandboxes for other platforms are welcome (e.g. Capsicum,
   Linux pid/net namespaces, etc.)

 * Add new SHA256-based HMAC transport integrity modes from
   http://www.ietf.org/id/draft-dbider-sha2-mac-for-ssh-02.txt
   These modes are hmac-sha2-256, hmac-sha2-256-96, hmac-sha2-512,
   and hmac-sha2-512-96, and are available by default in ssh(1) and
   sshd(8)

 * The pre-authentication sshd(8) privilege separation slave process
   now logs via a socket shared with the master process, avoiding the
   need to maintain /dev/log inside the chroot.

 * ssh(1) now warns when a server refuses X11 forwarding

 * sshd_config(5)'s AuthorizedKeysFile now accepts multiple paths,
   separated by whitespace. The undocumented AuthorizedKeysFile2
   option is deprecated (though the default for AuthorizedKeysFile
   includes .ssh/authorized_keys2)

 * sshd_config(5): similarly deprecate UserKnownHostsFile2 and
   GlobalKnownHostsFile2 by making UserKnownHostsFile and
   GlobalKnownHostsFile accept multiple options and default to
   include known_hosts2

 * Retain key comments when loading v.2 keys. These will be visible
   in "ssh-add -l" and other places. bz#439

 * ssh(1) and sshd(8): set IPv6 traffic class from IPQoS (as well as
   IPv4 ToS/DSCP). bz#1855

 * ssh_config(5)'s ControlPath option now expands %L to the host
   portion of the destination host name.

 * ssh_config(5) "Host" options now support negated Host matching, e.g.

     Host *.example.org !c.example.org
        User mekmitasdigoat

   Will match "a.example.org", "b.example.org", but not "c.example.org"

 * ssh_config(5): a new RequestTTY option provides control over when a
   TTY is requested for a connection, similar to the existing -t/-tt/-T
   ssh(1) commandline options.

 * sshd(8): allow GSSAPI authentication to detect when a server-side
   failure causes authentication failure and don't count such failures
   against MaxAuthTries; bz#1244

 * ssh-keygen(1): Add -A option. For each of the key types (rsa1, rsa,
   dsa and ecdsa) for which host keys do not exist, generate the host
   keys with the default key file path, an empty passphrase, default
   bits for the key type, and default comment. This is useful for
   system initialisation scripts.

 * ssh(1): Allow graceful shutdown of multiplexing: request that a mux
   server removes its listener socket and refuse future multiplexing
   requests but don't kill existing connections. This may be requested
   using "ssh -O stop ..."

 * ssh-add(1) now accepts keys piped from standard input. E.g.
   "ssh-add - < /path/to/key"

 * ssh-keysign(8) now signs hostbased authentication
   challenges correctly using ECDSA keys; bz#1858

 * sftp(1): document that sftp accepts square brackets to delimit
   addresses (useful for IPv6); bz#1847a

 * ssh(1): when using session multiplexing, the master process will
   change its process title to reflect the control path in use and
   when a ControlPersist-ed master is waiting to close; bz#1883 and
   bz#1911

 * Other minor bugs fixed: 1849 1861 1862 1869 1875 1878 1879 1892
   1900 1905 1913

Portable OpenSSH Bugfixes:

 * Fix a compilation error in the SELinux support code. bz#1851

 * This release removes support for ssh-rand-helper. OpenSSH now
   obtains its random numbers directly from OpenSSL or from
   a PRNGd/EGD instance specified at configure time.

 * sshd(8) now resets the SELinux process execution context before
   executing passwd for password changes; bz#1891

 * Since gcc >= 4.x ignores all -Wno-options options, test only the
   corresponding -W-option when trying to determine whether it is
   accepted; bz#1901

 * Add ECDSA key generation to the Cygwin ssh-{host,user}-config
   scripts.

 * Updated .spec and init files for Linux; bz#1920

 * Improved SELinux error messages in context change failures and
   suppress error messages when attempting to change from the
   "unconfined_t" type; bz#1924 bz#1919

 * Fix build errors on platforms without dlopen(); bz#1929

Revision 1.24 / (download) - annotate - [select for diffs], Fri Jan 11 12:41:16 2013 UTC (10 years ago) by jperkin
Branch: MAIN
CVS Tags: pkgsrc-2013Q1-base, pkgsrc-2013Q1
Changes since 1.23: +2 -2 lines
Diff to previous 1.23 (colored)

Switch HPN patch site to the one FreeBSD uses, upstream have hidden it
behind a session-based page.

Revision 1.23 / (download) - annotate - [select for diffs], Thu May 31 11:58:37 2012 UTC (10 years, 8 months ago) by imil
Branch: MAIN
CVS Tags: pkgsrc-2012Q4-base, pkgsrc-2012Q4, pkgsrc-2012Q3-base, pkgsrc-2012Q3, pkgsrc-2012Q2-base, pkgsrc-2012Q2
Changes since 1.22: +18 -2 lines
Diff to previous 1.22 (colored)

Added support for OpenSSH-lpk

The OpenSSH LDAP Public Key patch provides an easy way of centralizing strong
user authentication by using an LDAP server for retrieving public keys instead
of ~/.ssh/authorized_keys.

Revision 1.22 / (download) - annotate - [select for diffs], Mon Jan 9 05:25:36 2012 UTC (11 years ago) by manu
Branch: MAIN
CVS Tags: pkgsrc-2012Q1-base, pkgsrc-2012Q1
Changes since 1.21: +2 -8 lines
Diff to previous 1.21 (colored)

Re-enable PAM support, as it works fine provided one does not mix multiple
versions of libcrypto in sshd. This can happen if OpenSSH is linked with
pkgsrc's OpenSSL and if using nss_ldap, which pulls base-system OpenSSL
through kerberos libraries. One needs to disable the krb5 of nss_ldap
in order to fix that.

Revision 1.21 / (download) - annotate - [select for diffs], Thu Sep 1 19:24:01 2011 UTC (11 years, 5 months ago) by shattered
Branch: MAIN
CVS Tags: pkgsrc-2011Q4-base, pkgsrc-2011Q4, pkgsrc-2011Q3-base, pkgsrc-2011Q3
Changes since 1.20: +4 -1 lines
Diff to previous 1.20 (colored)

PR/38394 -- disable KAFS detection for mit-krb5

Revision 1.20 / (download) - annotate - [select for diffs], Wed Feb 16 17:45:08 2011 UTC (11 years, 11 months ago) by taca
Branch: MAIN
CVS Tags: pkgsrc-2011Q2-base, pkgsrc-2011Q2, pkgsrc-2011Q1-base, pkgsrc-2011Q1
Changes since 1.19: +2 -2 lines
Diff to previous 1.19 (colored)

Update openssh package to 5.8.1 (5.8p1).

For changes from 5.5 to 5.7, please refer http://openssh.com/txt/release-5.7
and http://openssh.com/txt/release-5.6 in detail.

Changes since OpenSSH 5.7
=========================

Security:

 * Fix vulnerability in legacy certificate signing introduced in
   OpenSSH-5.6 and found by Mateusz Kocielski.

   Legacy certificates signed by OpenSSH 5.6 or 5.7 included data from
   the stack in place of a random nonce field. The contents of the stack
   do not appear to contain private data at this point, but this cannot
   be stated with certainty for all platform, library and compiler
   combinations. In particular, there exists a risk that some bytes from
   the privileged CA key may be accidentally included.

   A full advisory for this issue is available at:
   http://www.openssh.com/txt/legacy-cert.adv

Portable OpenSSH Bugfixes:

 * Fix compilation failure when enableing SELinux support.

 * Do not attempt to call SELinux functions when SELinux is disabled.
   bz#1851

Revision 1.19 / (download) - annotate - [select for diffs], Tue Jun 15 03:11:52 2010 UTC (12 years, 7 months ago) by taca
Branch: MAIN
CVS Tags: pkgsrc-2010Q4-base, pkgsrc-2010Q4, pkgsrc-2010Q3-base, pkgsrc-2010Q3, pkgsrc-2010Q2-base, pkgsrc-2010Q2
Changes since 1.18: +2 -2 lines
Diff to previous 1.18 (colored)

Add hpn-patch for OpenSSH 5.5p1.

No PKGREVISION bump since this option never worked
with OpenSSH 5.5p1 before.

Revision 1.18 / (download) - annotate - [select for diffs], Thu Feb 18 08:04:35 2010 UTC (12 years, 11 months ago) by martti
Branch: MAIN
CVS Tags: pkgsrc-2010Q1-base, pkgsrc-2010Q1
Changes since 1.17: +2 -2 lines
Diff to previous 1.17 (colored)

Updated OpenSSH to 5.3.1 (pkg/42635 by Fredrik Pettai)

This is a bugfix release, no new features have been added.

Changes since OpenSSH 5.2
=========================

General Bugfixes:

 * Do not limit home directory paths to 256 characters. bz#1615

 * Several minor documentation and correctness fixes.

Portable OpenSSH Bugfixes:

 * This release removes for support for very old versions of Cygwin and
   for Windows 95/98/ME

 * Move the deletion of PAM credentials on logout to after the session
   close. bz#1534

 * Make PrintLastLog work on AIX. bz#1595

 * Avoid compile errors on FreeBSD from conflicts in glob.h. bz#1634

 * Delay dropping of root privileges on AIX so chroot and pam_open_session
   work correctly. bz#1249 and bz#1567

 * Increase client IO buffer on Cygwin to 64K, realising a significant
   performance improvement.

 * Roll back bz#1241 (better handling for expired passwords on Tru64).
   The change broke password logins on some configurations.

 * Accept ENOSYS as a fallback error when attempting atomic
   rename(). bz#1535

 * Fix passing of variables to recursive make(1) invocations on Solaris.
   bz#1505

 * Skip the tcgetattr call on the pty master on Solaris, since it never
   succeeds and can hang if large amounts of data is sent to the slave
   (eg a copy-paste). bz#1528

 * Fix detection of krb5-config. bz#1639

 * Fix test for server-assigned remote forwarding port for non-root users.
   bz#1578

 * Fix detection of libresolv on OSX 10.6.

Revision 1.17 / (download) - annotate - [select for diffs], Thu May 21 03:22:29 2009 UTC (13 years, 8 months ago) by taca
Branch: MAIN
CVS Tags: pkgsrc-2009Q4-base, pkgsrc-2009Q4, pkgsrc-2009Q3-base, pkgsrc-2009Q3, pkgsrc-2009Q2-base, pkgsrc-2009Q2
Changes since 1.16: +2 -2 lines
Diff to previous 1.16 (colored)

Update openssh package to 5.2.1(5.2p1).

Changes since OpenSSH 5.1
=========================

Security:

 * This release changes the default cipher order to prefer the AES CTR
   modes and the revised "arcfour256" mode to CBC mode ciphers that are
   susceptible to CPNI-957037 "Plaintext Recovery Attack Against SSH".

 * This release also adds countermeasures to mitigate CPNI-957037-style
   attacks against the SSH protocol's use of CBC-mode ciphers. Upon
   detection of an invalid packet length or Message Authentication
   Code, ssh/sshd will continue reading up to the maximum supported
   packet length rather than immediately terminating the connection.
   This eliminates most of the known differences in behaviour that
   leaked information about the plaintext of injected data which formed
   the basis of this attack. We believe that these attacks are rendered
   infeasible by these changes.

New features:

 * Added a -y option to ssh(1) to force logging to syslog rather than
   stderr, which is useful when running daemonised (ssh -f)

 * The sshd_config(5) ForceCommand directive now accepts commandline
   arguments for the internal-sftp server.

 * The ssh(1) ~C escape commandline now support runtime creation of
   dynamic (-D) port forwards.

 * Support the SOCKS4A protocol in ssh(1) dynamic (-D) forwards.
   (bz#1482)

 * Support remote port forwarding with a listen port of '0'. This
   informs the server that it should dynamically allocate a listen
   port and report it back to the client. (bz#1003)

 * sshd(8) now supports setting PermitEmptyPasswords and
   AllowAgentForwarding in Match blocks

Bug and documentation fixes

 * Repair a ssh(1) crash introduced in openssh-5.1 when the client is
   sent a zero-length banner (bz#1496)

 * Due to interoperability problems with certain
   broken SSH implementations, the eow@openssh.com and
   no-more-sessions@openssh.com protocol extensions are now only sent
   to peers that identify themselves as OpenSSH.

 * Make ssh(1) send the correct channel number for
   SSH2_MSG_CHANNEL_SUCCESS and SSH2_MSG_CHANNEL_FAILURE messages to
   avoid triggering 'Non-public channel' error messages on sshd(8) in
   openssh-5.1.

 * Avoid printing 'Non-public channel' warnings in sshd(8), since the
   ssh(1) has sent incorrect channel numbers since ~2004 (this reverts
   a behaviour introduced in openssh-5.1).

 * Avoid double-free in ssh(1) ~C escape -L handler (bz#1539)

 * Correct fail-on-error behaviour in sftp(1) batchmode for remote
   stat operations. (bz#1541)

 * Disable nonfunctional ssh(1) ~C escape handler in multiplex slave
   connections. (bz#1543)

 * Avoid hang in ssh(1) when attempting to connect to a server that
   has MaxSessions=0 set.

 * Multiple fixes to sshd(8) configuration test (-T) mode

 * Several core and portable OpenSSH bugs fixed: 1380, 1412, 1418,
   1419, 1421, 1490, 1491, 1492, 1514, 1515, 1518, 1520, 1538, 1540

 * Many manual page improvements.

Revision 1.16 / (download) - annotate - [select for diffs], Tue Sep 16 12:53:08 2008 UTC (14 years, 4 months ago) by taca
Branch: MAIN
CVS Tags: pkgsrc-2009Q1-base, pkgsrc-2009Q1, pkgsrc-2008Q4-base, pkgsrc-2008Q4, pkgsrc-2008Q3-base, pkgsrc-2008Q3
Changes since 1.15: +2 -2 lines
Diff to previous 1.15 (colored)

Update openssh package to 5.1.1 (5.1p1)

Changes from OpenSSH 5.0 is huge to write here, please refer its
release note: http://www.openssh.com/txt/release-5.1.
I quote only Security section from the release note.

Security:

 * sshd(8): Avoid X11 man-in-the-middle attack on HP/UX (and possibly
   other platforms) when X11UseLocalhost=no

   When attempting to bind(2) to a port that has previously been bound
   with SO_REUSEADDR set, most operating systems check that either the
   effective user-id matches the previous bind (common on BSD-derived
   systems) or that the bind addresses do not overlap (Linux and
   Solaris).

   Some operating systems, such as HP/UX, do not perform these checks
   and are vulnerable to an X11 man-in-the-middle attack when the
   sshd_config(5) option X11UseLocalhost has been set to "no" - an
   attacker may establish a more-specific bind, which will be used in
   preference to sshd's wildcard listener.

   Modern BSD operating systems, Linux, OS X and Solaris implement the
   above checks and are not vulnerable to this attack, nor are systems
   where the X11UseLocalhost has been left at the default value of
   "yes".

   Portable OpenSSH 5.1 avoids this problem for all operating systems
   by not setting SO_REUSEADDR when X11UseLocalhost is set to no.

   This vulnerability was reported by sway2004009 AT hotmail.com.

Revision 1.15 / (download) - annotate - [select for diffs], Sun Apr 27 00:34:27 2008 UTC (14 years, 9 months ago) by tnn
Branch: MAIN
CVS Tags: pkgsrc-2008Q2-base, pkgsrc-2008Q2, cwrapper, cube-native-xorg-base, cube-native-xorg
Changes since 1.14: +2 -2 lines
Diff to previous 1.14 (colored)

Update to OpenSSH 5.0p1.
Changes since 4.7:
- fix two security issues
- chroot support for sshd(8)
- sftp server internalized in sshd(8)
- assorted bug fixes

Revision 1.14 / (download) - annotate - [select for diffs], Fri Sep 7 10:41:12 2007 UTC (15 years, 4 months ago) by taca
Branch: MAIN
CVS Tags: pkgsrc-2008Q1-base, pkgsrc-2008Q1, pkgsrc-2007Q4-base, pkgsrc-2007Q4, pkgsrc-2007Q3-base, pkgsrc-2007Q3
Changes since 1.13: +2 -2 lines
Diff to previous 1.13 (colored)

Update openssh package to 4.7.1 (4.7p1).


Changes since OpenSSH 4.6:
============================

Security bugs resolved in this release:

 * Prevent ssh(1) from using a trusted X11 cookie if creation of an
   untrusted cookie fails; found and fixed by Jan Pechanec.

Other changes, new functionality and fixes in this release:

 * sshd(8) in new installations defaults to SSH Protocol 2 only.
   Existing installations are unchanged.

 * The SSH channel window size has been increased, and both ssh(1)
   sshd(8) now send window updates more aggressively. These improves
   performance on high-BDP (Bandwidth Delay Product) networks.

 * ssh(1) and sshd(8) now preserve MAC contexts between packets, which
   saves 2 hash calls per packet and results in 12-16% speedup for
   arcfour256/hmac-md5.

 * A new MAC algorithm has been added, UMAC-64 (RFC4418) as
   "umac-64@openssh.com". UMAC-64 has been measured to be
   approximately 20% faster than HMAC-MD5.

 * A -K flag was added to ssh(1) to set GSSAPIAuthentication=Yes

 * Failure to establish a ssh(1) TunnelForward is now treated as a
   fatal error when the ExitOnForwardFailure option is set.

 * ssh(1) returns a sensible exit status if the control master goes
   away without passing the full exit status. (bz #1261)

 * The following bugs have been fixed in this release:

   - When using a ProxyCommand in ssh(1), set the outgoing hostname with
     gethostname(2), allowing hostbased authentication to work (bz #616)
   - Make scp(1) skip FIFOs rather than hanging (bz #856)
   - Encode non-printing characters in scp(1) filenames.
     these could cause copies to be aborted with a "protocol error"
     (bz #891)
   - Handle SIGINT in sshd(8) privilege separation child process to
     ensure that wtmp and lastlog records are correctly updated
     (bz #1196)
   - Report GSSAPI mechanism in errors, for libraries that support
     multiple mechanisms (bz #1220)
   - Improve documentation for ssh-add(1)'s -d option (bz #1224)
   - Rearrange and tidy GSSAPI code, removing server-only code being
     linked into the client. (bz #1225)
   - Delay execution of ssh(1)'s LocalCommand until after all forwadings
     have been established. (bz #1232)
   - In scp(1), do not truncate non-regular files (bz #1236)
   - Improve exit message from ControlMaster clients. (bz #1262)
   - Prevent sftp-server(8) from reading until it runs out of buffer
     space, whereupon it would exit with a fatal error. (bz #1286)

 * Portable OpenSSH bugs fixed:

   - Fix multiple inclusion of paths.h on AIX 5.1 systems. (bz #1243)
   - Implement getpeereid for Solaris using getpeerucred. Solaris
     systems will now refuse ssh-agent(1) and ssh(1) ControlMaster
     clients from different, non-root users (bz #1287)
   - Fix compilation warnings by including string.h if found. (bz #1294)
   - Remove redefinition of _res in getrrsetbyname.c for platforms that
     already define it. (bz #1299)
   - Fix spurious "chan_read_failed for istate 3" errors from sshd(8),
     a side-effect of the "hang on exit" fix introduced in 4.6p1.
     (bz #1306)
   - pam_end() was not being called if authentication failed (bz #1322)
   - Fix SELinux support when SELinux is in permissive mode. Previously
     sshd(8) was treating SELinux errors as always fatal. (bz #1325)
   - Ensure that pam_setcred(..., PAM_ESTABLISH_CRED) is called before
     pam_setcred(..., PAM_REINITIALIZE_CRED), fixing pam_dhkeys.
     (bz #1339)
   - Fix privilege separation on QNX - pre-auth only, this platform does
     not support file descriptior passing needed for post-auth privilege
     separation. (bz #1343)

Revision 1.13 / (download) - annotate - [select for diffs], Sun Mar 18 12:38:45 2007 UTC (15 years, 10 months ago) by taca
Branch: MAIN
CVS Tags: pkgsrc-2007Q2-base, pkgsrc-2007Q2, pkgsrc-2007Q1-base, pkgsrc-2007Q1
Changes since 1.12: +2 -2 lines
Diff to previous 1.12 (colored)

Update openssh pacakge to 4.6.1.


Changes since OpenSSH 4.5:
============================

 * sshd now allows the enabling and disabling of authentication
   methods on a per user, group, host and network basis via the
   Match directive in sshd_config.

 * The following bugs have been fixed in this release:

   - Clear SIGALRM when restarting due to SIGHUP. Prevents stray
     signal from taking down sshd if a connection was pending at
     the time SIGHUP was received
   - sftp returned a zero exit status when upload failed due to write
     errors (bugzilla #1252)
   - fixed an inconsistent check for a terminal when displaying scp
     progress meter (bugzilla #1265)
   - Parsing of time values in Match blocks was incorrectly applied
     to the global configuration (bugzilla #1275)
   - Allow multiple forwarding options to work when specified in a
     PermitOpen directive (bugzilla #1267)
   - Interoperate with ssh.com versions that do not support binding
     remote port forwarding sessions to a hostname (bugzilla #1019)

 * Portable OpenSSH bugs fixed:

   - "hang on exit" when background processes are running at the time
     of exit on a ttyful/login session (bugzilla #52)
   - Fix typos in the ssh-rand-helper(8) man page (bugzilla #1259)
   - Check that some SIG records have been returned in getrrsetbyname
     (bugzilla #1281)
   - Fix contrib/findssl for platforms that lack "which" (bugzilla
     #1237)
   - Work around bug in OpenSSL 0.9.8e that broke aes256-ctr,
     aes192-ctr, arcfour256 (bugzilla #1291)

Revision 1.12 / (download) - annotate - [select for diffs], Thu Feb 22 19:27:08 2007 UTC (15 years, 11 months ago) by wiz
Branch: MAIN
Changes since 1.11: +2 -2 lines
Diff to previous 1.11 (colored)

Whitespace cleanup, courtesy of pkglint.
Patch provided by Sergey Svishchev in private mail.

Revision 1.11 / (download) - annotate - [select for diffs], Sat Jan 20 10:03:39 2007 UTC (16 years ago) by taca
Branch: MAIN
Changes since 1.10: +2 -2 lines
Diff to previous 1.10 (colored)

Update hpn-patch; openssh-4.4p1-hpn12v13 to openssh-4.5p1-hpn12v14.
Accurate changes are unknown.

Bump PKGREVISION.

Revision 1.8.6.1 / (download) - annotate - [select for diffs], Fri Nov 10 11:50:25 2006 UTC (16 years, 2 months ago) by salo
Branch: pkgsrc-2006Q3
Changes since 1.8: +2 -2 lines
Diff to previous 1.8 (colored) next main 1.9 (colored)

Pullup ticket 1909 - requested by taca
security update for openssh

Revisions pulled up:
- pkgsrc/security/openssh/Makefile		1.172, 1.173, 1.174
- pkgsrc/security/openssh/distinfo		1.55, 1.56, 1.57
- pkgsrc/security/openssh/hacks.mk		1.2
- pkgsrc/security/openssh/options.mk		1.9, 1.10
- pkgsrc/security/openssh/patches/patch-aa	1.42, 1.43
- pkgsrc/security/openssh/patches/patch-ab	1.24, 1.25
- pkgsrc/security/openssh/patches/patch-ac	1.16
- pkgsrc/security/openssh/patches/patch-ad	1.12
- pkgsrc/security/openssh/patches/patch-ae	1.12
- pkgsrc/security/openssh/patches/patch-af	1.10
- pkgsrc/security/openssh/patches/patch-ag	1.9
- pkgsrc/security/openssh/patches/patch-ah	1.24
- pkgsrc/security/openssh/patches/patch-ai	1.10
- pkgsrc/security/openssh/patches/patch-aj	1.7
- pkgsrc/security/openssh/patches/patch-ak	1.8
- pkgsrc/security/openssh/patches/patch-al	1.7
- pkgsrc/security/openssh/patches/patch-am	1.7
- pkgsrc/security/openssh/patches/patch-an	1.8
- pkgsrc/security/openssh/patches/patch-ao	1.9
- pkgsrc/security/openssh/patches/patch-ap	1.8
- pkgsrc/security/openssh/patches/patch-aq	1.6
- pkgsrc/security/openssh/patches/patch-ar	1.7
- pkgsrc/security/openssh/patches/patch-as	1.5
- pkgsrc/security/openssh/patches/patch-at	removed
- pkgsrc/security/openssh/patches/patch-au	1.3
- pkgsrc/security/openssh/patches/patch-av	1.5
- pkgsrc/security/openssh/patches/patch-aw	1.2
- pkgsrc/security/openssh/patches/patch-ax	removed
- pkgsrc/security/openssh/patches/patch-ay	removed
- pkgsrc/security/openssh/patches/patch-az	removed

   Module Name:		pkgsrc
   Committed By:	taca
   Date:		Tue Oct 31 03:31:20 UTC 2006

   Modified Files:
   	pkgsrc/security/openssh: Makefile distinfo hacks.mk options.mk
   	pkgsrc/security/openssh/patches: patch-aa patch-ab patch-ac patch-ad
   	    patch-ae patch-af patch-ag patch-ah patch-ai patch-aj patch-ak
   	    patch-al patch-am patch-an patch-ao patch-ap patch-aq patch-ar
   	    patch-as patch-au patch-av patch-aw
   Removed Files:
   	pkgsrc/security/openssh/patches: patch-at patch-ax patch-ay patch-az

   Log Message:
   Update openssh package to 4.4.1 (openssh-4.4p1).

   - A few pkglint warning clean up.
   - Major changes are here.  For complete changes,
     see http://www.openssh.com/txt/release-4.4.

   Changes since OpenSSH 4.3:
   ============================

   Security bugs resolved in this release:

    * Fix a pre-authentication denial of service found by Tavis Ormandy,
      that would cause sshd(8) to spin until the login grace time
      expired.

    * Fix an unsafe signal hander reported by Mark Dowd. The signal
      handler was vulnerable to a race condition that could be exploited
      to perform a pre-authentication denial of service. On portable
      OpenSSH, this vulnerability could theoretically lead to
      pre-authentication remote code execution if GSSAPI authentication
      is enabled, but the likelihood of successful exploitation appears
      remote.

    * On portable OpenSSH, fix a GSSAPI authentication abort that could
      be used to determine the validity of usernames on some platforms.

   This release includes the following new functionality and fixes:

    * Implemented conditional configuration in sshd_config(5) using the
      "Match" directive. This allows some configuration options to be
      selectively overridden if specific criteria (based on user, group,
      hostname and/or address) are met. So far a useful subset of post-
      authentication options are supported and more are expected to be
      added in future releases.

    * Add support for Diffie-Hellman group exchange key agreement with a
      final hash of SHA256.

    * Added a "ForceCommand" directive to sshd_config(5). Similar to the
      command="..." option accepted in ~/.ssh/authorized_keys, this forces
      the execution of the specified command regardless of what the user
      requested. This is very useful in conjunction with the new "Match"
      option.

    * Add a "PermitOpen" directive to sshd_config(5). This mirrors the
      permitopen="..." authorized_keys option, allowing fine-grained
      control over the port-forwardings that a user is allowed to
      establish.

    * Add optional logging of transactions to sftp-server(8).

    * ssh(1) will now record port numbers for hosts stored in
      ~/.ssh/authorized_keys when a non-standard port has been requested.

    * Add an "ExitOnForwardFailure" option to cause ssh(1) to exit (with
      a non-zero exit code) when requested port forwardings could not be
      established.

    * Extend sshd_config(5) "SubSystem" declarations to allow the
      specification of command-line arguments.

    * Replacement of all integer overflow susceptible invocations of
      malloc(3) and realloc(3) with overflow-checking equivalents.

    * Many manpage fixes and improvements

    * New portable OpenSSH-specific features:

      - Add optional support for SELinux, controlled using the
        --with-selinux configure option (experimental)

      - Add optional support for Solaris process contracts, enabled
        using the --with-solaris-contracts configure option (experimental)
        This option will also include SMF metadata in Solaris packages
        built using the "make package" target

      - Add optional support for OpenSSL hardware accelerators (engines),
        enabled using the --with-ssl-engine configure option.
---
   Module Name:		pkgsrc
   Committed By:	taca
   Date:		Tue Nov  7 07:08:26 UTC 2006

   Modified Files:
   	pkgsrc/security/openssh: Makefile distinfo options.mk

   Log Message:
   Update hpn-patch to hpn12v13 since old one has gone.

   Bump PKGREVISION.
---
   Module Name:		pkgsrc
   Committed By:	taca
   Date:		Wed Nov  8 01:49:22 UTC 2006

   Modified Files:
   	pkgsrc/security/openssh: Makefile distinfo
   	pkgsrc/security/openssh/patches: patch-aa patch-ab

   Log Message:
   Update openssh package to 4.5.1 (openssh-4.5p1).

   Changes:

   Security bugs resolved in this release:

    * Fix a bug in the sshd privilege separation monitor that weakened its
      verification of successful authentication. This bug is not known to
      be exploitable in the absence of additional vulnerabilities.

   This release includes the following non-security fixes:

    * Several compilation fixes for portable OpenSSH

    * Fixes to Solaris SMF/process contract support (bugzilla #1255)

Revision 1.10 / (download) - annotate - [select for diffs], Tue Nov 7 07:08:26 2006 UTC (16 years, 2 months ago) by taca
Branch: MAIN
CVS Tags: pkgsrc-2006Q4-base, pkgsrc-2006Q4
Changes since 1.9: +2 -2 lines
Diff to previous 1.9 (colored)

Update hpn-patch to hpn12v13 since old one has gone.

Bump PKGREVISION.

Revision 1.9 / (download) - annotate - [select for diffs], Tue Oct 31 03:31:19 2006 UTC (16 years, 3 months ago) by taca
Branch: MAIN
Changes since 1.8: +2 -2 lines
Diff to previous 1.8 (colored)

Update openssh package to 4.4.1 (openssh-4.4p1).

- A few pkglint warning clean up.
- Major changes are here.  For complete changes,
  see http://www.openssh.com/txt/release-4.4.

Changes since OpenSSH 4.3:
============================

Security bugs resolved in this release:

 * Fix a pre-authentication denial of service found by Tavis Ormandy,
   that would cause sshd(8) to spin until the login grace time
   expired.

 * Fix an unsafe signal hander reported by Mark Dowd. The signal
   handler was vulnerable to a race condition that could be exploited
   to perform a pre-authentication denial of service. On portable
   OpenSSH, this vulnerability could theoretically lead to
   pre-authentication remote code execution if GSSAPI authentication
   is enabled, but the likelihood of successful exploitation appears
   remote.

 * On portable OpenSSH, fix a GSSAPI authentication abort that could
   be used to determine the validity of usernames on some platforms.

This release includes the following new functionality and fixes:

 * Implemented conditional configuration in sshd_config(5) using the
   "Match" directive. This allows some configuration options to be
   selectively overridden if specific criteria (based on user, group,
   hostname and/or address) are met. So far a useful subset of post-
   authentication options are supported and more are expected to be
   added in future releases.

 * Add support for Diffie-Hellman group exchange key agreement with a
   final hash of SHA256.

 * Added a "ForceCommand" directive to sshd_config(5). Similar to the
   command="..." option accepted in ~/.ssh/authorized_keys, this forces
   the execution of the specified command regardless of what the user
   requested. This is very useful in conjunction with the new "Match"
   option.

 * Add a "PermitOpen" directive to sshd_config(5). This mirrors the
   permitopen="..." authorized_keys option, allowing fine-grained
   control over the port-forwardings that a user is allowed to
   establish.

 * Add optional logging of transactions to sftp-server(8).

 * ssh(1) will now record port numbers for hosts stored in
   ~/.ssh/authorized_keys when a non-standard port has been requested.

 * Add an "ExitOnForwardFailure" option to cause ssh(1) to exit (with
   a non-zero exit code) when requested port forwardings could not be
   established.

 * Extend sshd_config(5) "SubSystem" declarations to allow the
   specification of command-line arguments.

 * Replacement of all integer overflow susceptible invocations of
   malloc(3) and realloc(3) with overflow-checking equivalents.

 * Many manpage fixes and improvements

 * New portable OpenSSH-specific features:

   - Add optional support for SELinux, controlled using the
     --with-selinux configure option (experimental)

   - Add optional support for Solaris process contracts, enabled
     using the --with-solaris-contracts configure option (experimental)
     This option will also include SMF metadata in Solaris packages
     built using the "make package" target

   - Add optional support for OpenSSL hardware accelerators (engines),
     enabled using the --with-ssl-engine configure option.

Revision 1.7.2.1 / (download) - annotate - [select for diffs], Sun Feb 12 01:53:43 2006 UTC (16 years, 11 months ago) by seb
Branch: pkgsrc-2005Q4
Changes since 1.7: +2 -2 lines
Diff to previous 1.7 (colored) next main 1.8 (colored)

Pullup ticket 1118 - requested by Lubomir Sedlacik
update security/openssh including security fix

Revisions pulled up:
- pkgsrc/security/openssh/Makefile                            1.164
- pkgsrc/security/openssh/distinfo                            1.51
- pkgsrc/security/openssh/options.mk                          1.8
- pkgsrc/security/openssh/patches/patch-aa                    1.41
- pkgsrc/security/openssh/patches/patch-ab                    1.23
- pkgsrc/security/openssh/patches/patch-ac                    1.15
- pkgsrc/security/openssh/patches/patch-ae                    1.11
- pkgsrc/security/openssh/patches/patch-ag                    1.8
- pkgsrc/security/openssh/patches/patch-ao                    1.8
- pkgsrc/security/openssh/patches/patch-am                    1.6
- pkgsrc/security/openssh/patches/patch-an                    1.7
- pkgsrc/security/openssh/patches/patch-ap                    1.7
- pkgsrc/security/openssh/patches/patch-at                    1.3
- pkgsrc/security/openssh/patches/patch-av                    1.4

   Module Name:	pkgsrc
   Committed By:	salo
   Date:		Sun Feb 12 00:13:55 UTC 2006

   Modified Files:
   	pkgsrc/security/openssh: Makefile distinfo options.mk
   	pkgsrc/security/openssh/patches: patch-aa patch-ab patch-ac patch-ae
   	    patch-ag patch-am patch-an patch-ao patch-ap patch-at patch-av

   Log Message:
   Update to version 3.4p1

   From Jason White via PR pkg/32780

   Changes:

   Security bugs resolved in this release:

    * CVE-2006-0225: scp (as does rcp, on which it is based) invoked a
      subshell to perform local to local, and remote to remote copy
      operations. This subshell exposed filenames to shell expansion
      twice; allowing a local attacker to create filenames containing
      shell metacharacters that, if matched by a wildcard, could lead
      to execution of attacker-specified commands with the privilege of
      the user running scp (Bugzilla #1094)

   This is primarily a bug-fix release, only one new feature has been
   added:

    * Add support for tunneling arbitrary network packets over a
      connection between an OpenSSH client and server via tun(4) virtual
      network interfaces. This allows the use of OpenSSH (4.3+) to create
      a true VPN between the client and server providing real network
      connectivity at layer 2 or 3. This feature is experimental and is
      currently supported on OpenBSD, Linux, NetBSD (IPv4 only) and
      FreeBSD. Other operating systems with tun/tap interface capability
      may be added in future portable OpenSSH releases. Please refer to
      the README.tun file in the source distribution for further details
      and usage examples.

   Some of the other bugs resolved and internal improvements are:

    * Reduce default key length for new DSA keys generated by ssh-keygen
      back to 1024 bits. DSA is not specified for longer lengths and does
      not fully benefit from simply making keys longer. As per FIPS 186-2
      Change Notice 1, ssh-keygen will refuse to generate a new DSA key
      smaller or larger than 1024 bits

    * Fixed X forwarding failing to start when a the X11 client is executed
      in background at the time of session exit (Bugzilla #1086)

    * Change ssh-keygen to generate a protocol 2 RSA key when invoked
      without arguments (Bugzilla #1064)

    * Fix timing variance for valid vs. invalid accounts when attempting
      Kerberos authentication (Bugzilla #975)

    * Ensure that ssh always returns code 255 on internal error (Bugzilla
      #1137)

    * Cleanup wtmp files on SIGTERM when not using privsep (Bugzilla #1029)

    * Set SO_REUSEADDR on X11 listeners to avoid problems caused by
      lingering sockets from previous session (X11 applications can
      sometimes not connect to 127.0.0.1:60xx) (Bugzilla #1076)

    * Ensure that fds 0, 1 and 2 are always attached in all programs, by
      duping /dev/null to them if necessary.

    * Xauth list invocation had bogus "." argument (Bugzilla #1082)

    * Remove internal assumptions on key exchange hash algorithm and output
      length, preparing OpenSSH for KEX methods with alternate hashes.

    * Ignore junk sent by a server before it sends the "SSH-" banner
      (Bugzilla #1067)

    * The manpages has been significantly improves and rearranged, in
      addition to other specific manpage fixes:
      #1037 - Man page entries for -L and -R should mention -g.
      #1077 - Descriptions for "ssh -D" and DynamicForward should mention
              they can specify "bind_address" optionally.
      #1088 - Incorrect descriptions in ssh_config man page for
              ControlMaster=no.
      #1121 - Several corrections for ssh_agent manpages

    * Lots of cleanups, including fixes to memory leaks on error paths
      (Bugzilla #1109, #1110, #1111 and more) and possible crashes (#1092)

    * Portable OpenSSH-specific fixes:

      - Pass random seed during re-exec for each connection: speeds up
        processing of new connections on platforms using the OpenSSH's
        builtin entropy collector (ssh-rand-helper)

      - PAM fixes and improvements:
        #1045 - Missing option for ignoring the /etc/nologin file
        #1087 - Show PAM password expiry message from LDAP on login
        #1028 - Forward final non-query conversations to client
        #1126 - Prevent user from being forced to change an expired
                password repeatedly on AIX in some PAM configurations.
        #1045 - Do not check /etc/nologin when PAM is enabled, instead
                allow PAM to handle it. Note that on platforms using
                PAM, the pam_nologin module should be used in sshd's
                session stack in order to maintain past behaviour

      - Portability-related fixes:
        #989 - Fix multiplexing regress test on Solaris
        #1097 - Cross-compile fixes.
        #1096 - ssh-keygen broken on HPUX.
        #1098 - $MAIL being set incorrectly for HPUX server login.
        #1104 - Compile error on Tru64 Unix 4.0f
        #1106 - Updated .spec file and startup for SuSE.
        #1122 - Use _GNU_SOURCE define in favor of __USE_GNU, fixing
                compilation problems on glibc 2.4

Revision 1.8 / (download) - annotate - [select for diffs], Sun Feb 12 00:13:55 2006 UTC (16 years, 11 months ago) by salo
Branch: MAIN
CVS Tags: pkgsrc-2006Q3-base, pkgsrc-2006Q2-base, pkgsrc-2006Q2, pkgsrc-2006Q1-base, pkgsrc-2006Q1
Branch point for: pkgsrc-2006Q3
Changes since 1.7: +2 -2 lines
Diff to previous 1.7 (colored)

Update to version 3.4p1

From Jason White via PR pkg/32780

Changes:

Security bugs resolved in this release:

 * CVE-2006-0225: scp (as does rcp, on which it is based) invoked a
   subshell to perform local to local, and remote to remote copy
   operations. This subshell exposed filenames to shell expansion
   twice; allowing a local attacker to create filenames containing
   shell metacharacters that, if matched by a wildcard, could lead
   to execution of attacker-specified commands with the privilege of
   the user running scp (Bugzilla #1094)

This is primarily a bug-fix release, only one new feature has been
added:

 * Add support for tunneling arbitrary network packets over a
   connection between an OpenSSH client and server via tun(4) virtual
   network interfaces. This allows the use of OpenSSH (4.3+) to create
   a true VPN between the client and server providing real network
   connectivity at layer 2 or 3. This feature is experimental and is
   currently supported on OpenBSD, Linux, NetBSD (IPv4 only) and
   FreeBSD. Other operating systems with tun/tap interface capability
   may be added in future portable OpenSSH releases. Please refer to
   the README.tun file in the source distribution for further details
   and usage examples.

Some of the other bugs resolved and internal improvements are:

 * Reduce default key length for new DSA keys generated by ssh-keygen
   back to 1024 bits. DSA is not specified for longer lengths and does
   not fully benefit from simply making keys longer. As per FIPS 186-2
   Change Notice 1, ssh-keygen will refuse to generate a new DSA key
   smaller or larger than 1024 bits

 * Fixed X forwarding failing to start when a the X11 client is executed
   in background at the time of session exit (Bugzilla #1086)

 * Change ssh-keygen to generate a protocol 2 RSA key when invoked
   without arguments (Bugzilla #1064)

 * Fix timing variance for valid vs. invalid accounts when attempting
   Kerberos authentication (Bugzilla #975)

 * Ensure that ssh always returns code 255 on internal error (Bugzilla
   #1137)

 * Cleanup wtmp files on SIGTERM when not using privsep (Bugzilla #1029)

 * Set SO_REUSEADDR on X11 listeners to avoid problems caused by
   lingering sockets from previous session (X11 applications can
   sometimes not connect to 127.0.0.1:60xx) (Bugzilla #1076)

 * Ensure that fds 0, 1 and 2 are always attached in all programs, by
   duping /dev/null to them if necessary.

 * Xauth list invocation had bogus "." argument (Bugzilla #1082)

 * Remove internal assumptions on key exchange hash algorithm and output
   length, preparing OpenSSH for KEX methods with alternate hashes.

 * Ignore junk sent by a server before it sends the "SSH-" banner
   (Bugzilla #1067)

 * The manpages has been significantly improves and rearranged, in
   addition to other specific manpage fixes:
   #1037 - Man page entries for -L and -R should mention -g.
   #1077 - Descriptions for "ssh -D" and DynamicForward should mention
           they can specify "bind_address" optionally.
   #1088 - Incorrect descriptions in ssh_config man page for
           ControlMaster=no.
   #1121 - Several corrections for ssh_agent manpages

 * Lots of cleanups, including fixes to memory leaks on error paths
   (Bugzilla #1109, #1110, #1111 and more) and possible crashes (#1092)

 * Portable OpenSSH-specific fixes:

   - Pass random seed during re-exec for each connection: speeds up
     processing of new connections on platforms using the OpenSSH's
     builtin entropy collector (ssh-rand-helper)

   - PAM fixes and improvements:
     #1045 - Missing option for ignoring the /etc/nologin file
     #1087 - Show PAM password expiry message from LDAP on login
     #1028 - Forward final non-query conversations to client
     #1126 - Prevent user from being forced to change an expired
             password repeatedly on AIX in some PAM configurations.
     #1045 - Do not check /etc/nologin when PAM is enabled, instead
             allow PAM to handle it. Note that on platforms using
             PAM, the pam_nologin module should be used in sshd's
             session stack in order to maintain past behaviour

   - Portability-related fixes:
     #989 - Fix multiplexing regress test on Solaris
     #1097 - Cross-compile fixes.
     #1096 - ssh-keygen broken on HPUX.
     #1098 - $MAIL being set incorrectly for HPUX server login.
     #1104 - Compile error on Tru64 Unix 4.0f
     #1106 - Updated .spec file and startup for SuSE.
     #1122 - Use _GNU_SOURCE define in favor of __USE_GNU, fixing
             compilation problems on glibc 2.4

Revision 1.7 / (download) - annotate - [select for diffs], Mon Dec 5 23:55:18 2005 UTC (17 years, 1 month ago) by rillig
Branch: MAIN
CVS Tags: pkgsrc-2005Q4-base
Branch point for: pkgsrc-2005Q4
Changes since 1.6: +2 -2 lines
Diff to previous 1.6 (colored)

Ran "pkglint --autofix", which corrected some of the quoting issues in
CONFIGURE_ARGS.

Revision 1.6 / (download) - annotate - [select for diffs], Wed Sep 21 18:07:09 2005 UTC (17 years, 4 months ago) by reed
Branch: MAIN
CVS Tags: pkgsrc-2005Q3-base, pkgsrc-2005Q3
Changes since 1.5: +2 -2 lines
Diff to previous 1.5 (colored)

Update openssh to 4.2p1. This is from PR #31331. Thank you, Jason.

Some changes different from patches provided in that PR are:

- patch-aj, patch-aq, and patch-as not changed (they appeared to
  be identical to previous patches)

- DragonFly support also added to configure script (patch-aa)
  because compilation failed due to missing crypt

- and install-sysconf target removed from the installation target
  in Makefile.in (patch-ah). Just let the pkgsrc framework install
  this since it now will allow it to be removed correctly on
  deinstall.

- use "pam" instead of "PAM" as option name in the post-install
  target.

This removes patch-ai.

This also now uses openssh-4.2p1-hpn11.diff patch.

I didn't test with kerberos and hpn-patch options. I did test with
PAM on Linux. (The PR reported that kerberos and hpn-patch options
were tested for compiling.) I tested on NetBSD 2.0.2, Linux,
and DragonFly.

This includes two security fixes and several bug fixes and many
improvemens.  The changes are listed at
http://www.mindrot.org/pipermail/openssh-unix-announce/2005-September/000083.html
http://www.mindrot.org/pipermail/openssh-unix-announce/2005-May/000079.html

TODO: get some of these patches committed upstream.

Revision 1.5 / (download) - annotate - [select for diffs], Thu Jul 28 17:54:57 2005 UTC (17 years, 6 months ago) by reed
Branch: MAIN
Changes since 1.4: +2 -1 lines
Diff to previous 1.4 (colored)

MESSAGE file removed. As mentioned on tech-pkg in May, /etc/ssh.conf
and /etc/sshd.conf is old (and I assume some configurations from
there don't apply any more), user and group are not created
automatically (only if PKG_CREATE_USERGROUP is at default YES),
UsePrivilegeSeparation is the default, and seems to imply that
openssh is insecure without it.

Bump PKGREVISION.

Change comment regarding MESSAGE.Interix.

Removed unused MESSAGE_SUBST settings. Move one to the options.mk
as it is for "pam" only.

Revision 1.4 / (download) - annotate - [select for diffs], Tue May 31 11:24:33 2005 UTC (17 years, 8 months ago) by dillo
Branch: MAIN
CVS Tags: pkgsrc-2005Q2-base, pkgsrc-2005Q2
Changes since 1.3: +3 -3 lines
Diff to previous 1.3 (colored)

Rename option PAM to pam (so all options are lower case).  Backwards
compatibility provided via PKG_OPTIONS_LEGACY_OPTS.

Revision 1.3 / (download) - annotate - [select for diffs], Fri Jan 14 05:15:40 2005 UTC (18 years ago) by jlam
Branch: MAIN
CVS Tags: pkgsrc-2005Q1-base, pkgsrc-2005Q1
Changes since 1.2: +2 -2 lines
Diff to previous 1.2 (colored)

Create a pam.buildlink3.mk file that is used by PAM-using packages.
It includes the correct buildlink3.mk file from either Linux-PAM
(security/PAM) or OpenPAM (security/openpam) and eventually will
support solaris-pam.  pam.buildlink3.mk will:

	* set PAMBASE to the base directory of the PAM files;
	* set PAM_TYPE to the PAM implementation used.

There are two variables that can be used to tweak the selection of
the PAM implementation:

PAM_DEFAULT is a user-settable variable whose value is the default
	PAM implementation to use.

PAM_ACCEPTED is a package-settable list of PAM implementations
	that may be used by the package.

Modify most packages that include PAM/buildlink3.mk to include
pam.buildlink3.mk instead.

Revision 1.2 / (download) - annotate - [select for diffs], Wed Dec 22 21:46:25 2004 UTC (18 years, 1 month ago) by jlam
Branch: MAIN
Changes since 1.1: +1 -17 lines
Diff to previous 1.1 (colored)

Remove support for some variables that are supposed to go away after
pkgsrc-2004Q4 is branched.

Revision 1.1 / (download) - annotate - [select for diffs], Thu Nov 25 19:25:28 2004 UTC (18 years, 2 months ago) by xtraeme
Branch: MAIN
CVS Tags: pkgsrc-2004Q4-base, pkgsrc-2004Q4

Convert to use bsd.options.mk with the following options:

	hpn-patch kerberos PAM (only Linux)

The hpn-patch option uses the patch available in:
http://www.psc.edu/networking/projects/hpn-ssh/ to enable high performance
connections.

Also use VARBASE intead of hardcoding /var.

Bump PKGREVISION.

This form allows you to request diff's between any two revisions of a file. You may select a symbolic revision name using the selection box or you may type in a numeric name using the type-in text box.




CVSweb <webmaster@jp.NetBSD.org>