1. 29 Feb, 2016 2 commits
    • Simon Wilkinson's avatar
      GSSAPI key exchange support · 374db175
      Simon Wilkinson authored
      This patch has been rejected upstream: "None of the OpenSSH developers are
      in favour of adding this, and this situation has not changed for several
      years.  This is not a slight on Simon's patch, which is of fine quality, but
      just that a) we don't trust GSSAPI implementations that much and b) we don't
      like adding new KEX since they are pre-auth attack surface.  This one is
      particularly scary, since it requires hooks out to typically root-owned
      system resources."
      However, quite a lot of people rely on this in Debian, and it's better to
      have it merged into the main openssh package rather than having separate
      -krb5 packages (as we used to have).  It seems to have a generally good
      security history.
      Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1242
      Last-Updated: 2016-01-04
      Patch-Name: gssapi.patch
    • Colin Watson's avatar
      Import openssh_7.2p1.orig.tar.gz · c52a95cc
      Colin Watson authored
  2. 26 Feb, 2016 1 commit
  3. 23 Feb, 2016 10 commits
    • Darren Tucker's avatar
      Skip PrintLastLog in config dump mode. · fd4e4f24
      Darren Tucker authored
      When DISABLE_LASTLOG is set, do not try to include PrintLastLog in the
      config dump since it'll be reported as UNKNOWN.
    • Damien Miller's avatar
    • Damien Miller's avatar
      put back portable patchlevel to p1 · b86a334a
      Damien Miller authored
    • djm@openbsd.org's avatar
      upstream commit · 555dd35f
      djm@openbsd.org authored
      Upstream-ID: 9db776b26014147fc907ece8460ef2bcb0f11e78
    • Damien Miller's avatar
      Disable tests where fs perms are incorrect · 1acc058d
      Damien Miller authored
      Some tests have strict requirements on the filesystem permissions
      for certain files and directories. This adds a regress/check-perm
      tool that copies the relevant logic from sshd to exactly test
      the paths in question. This lets us skip tests when the local
      filesystem doesn't conform to our expectations rather than
      continuing and failing the test run.
      ok dtucker@
    • Damien Miller's avatar
      fix sandbox on OSX Lion · 39f303b1
      Damien Miller authored
      sshd was failing with:
      ssh_sandbox_child: sandbox_init: dlopen(/usr/lib/libsandbox.1.dylib, 261):cw
        image not found [preauth]
      caused by chroot before sandboxing. Avoid by explicitly linking libsandbox
      to sshd. Spotted by Darren.
    • djm@openbsd.org's avatar
      upstream commit · 0d1451a3
      djm@openbsd.org authored
      fix spurious error message when incorrect passphrase
       entered for keys; reported by espie@ ok deraadt@
      Upstream-ID: 58b2e46e63ed6912ed1ee780bd3bd8560f9a5899
    • sobrado@openbsd.org's avatar
      upstream commit · 09d87d79
      sobrado@openbsd.org authored
      set ssh(1) protocol version to 2 only.
      ok djm@
      Upstream-ID: e168daf9d27d7e392e3c9923826bd8e87b2b3a10
    • sobrado@openbsd.org's avatar
      upstream commit · 9262e078
      sobrado@openbsd.org authored
      add missing ~/.ssh/id_ecdsa and ~/.ssh/id_ed25519 to
      ok djm@
      Upstream-ID: 6ce99466312e4ae7708017c3665e3edb976f70cf
    • sobrado@openbsd.org's avatar
      upstream commit · c12f0fdc
      sobrado@openbsd.org authored
      AddressFamily defaults to any.
      ok djm@
      Upstream-ID: 0d94aa06a4b889bf57a7f631c45ba36d24c13e0c
  4. 18 Feb, 2016 1 commit
    • Darren Tucker's avatar
      Make Solaris privs code build on older systems. · 907091ac
      Darren Tucker authored
      Not all systems with Solaris privs have priv_basicset so factor that
      out and provide backward compatibility code.  Similarly, not all have
      PRIV_NET_ACCESS so wrap that in #ifdef.  Based on code from
      alex at cooperi.net and djm@ with help from carson at taltos.org and
      wieland at purdue.edu.
  5. 17 Feb, 2016 9 commits
    • djm@openbsd.org's avatar
      upstream commit · 292a8dee
      djm@openbsd.org authored
      rekey refactor broke SSH1; spotted by Tom G. Christensen
      Upstream-ID: 43f0d57928cc077c949af0bfa71ef574dcb58243
    • djm@openbsd.org's avatar
      upstream commit · 3a13cb54
      djm@openbsd.org authored
      rsa-sha2-512,rsa-sha2-256 cannot be selected explicitly
       in *KeyTypes options yet. Remove them from the lists of algorithms for now.
       committing on behalf of markus@ ok djm@
      Upstream-ID: c6e8820eb8e610ac21551832c0c89684a9a51bb7
    • jmc@openbsd.org's avatar
      upstream commit · a685ae8d
      jmc@openbsd.org authored
      since these pages now clearly tell folks to avoid v1,
       normalise the docs from a v2 perspective (i.e. stop pointing out which bits
       are v2 only);
      ok/tweaks djm ok markus
      Upstream-ID: eb474f8c36fb6a532dc05c282f7965e38dcfa129
    • djm@openbsd.org's avatar
      upstream commit · c5c3f327
      djm@openbsd.org authored
      make sandboxed privilege separation the default, not just
       for new installs; "absolutely" deraadt@
      Upstream-ID: 5221ef3b927d2df044e9aa3f5db74ae91743f69b
    • jmc@openbsd.org's avatar
      upstream commit · eb3f7337
      jmc@openbsd.org authored
      no need to state that protocol 2 is the default twice;
      Upstream-ID: b1e4c36b0c2e12e338e5b66e2978f2ac953b95eb
    • djm@openbsd.org's avatar
      upstream commit · e7901efa
      djm@openbsd.org authored
      Replace list of ciphers and MACs adjacent to -1/-2 flag
       descriptions in ssh(1) with a strong recommendation not to use protocol 1.
       Add a similar warning to the Protocol option descriptions in ssh_config(5)
       and sshd_config(5);
      prompted by and ok mmcc@
      Upstream-ID: 961f99e5437d50e636feca023978950a232ead5e
    • djm@openbsd.org's avatar
      upstream commit · 5a0fcb77
      djm@openbsd.org authored
      add a "Close session" log entry (at loglevel=verbose) to
       correspond to the existing "Starting session" one. Also include the session
       id number to make multiplexed sessions more apparent.
      feedback and ok dtucker@
      Upstream-ID: e72d2ac080e02774376325136e532cb24c2e617c
    • djm@openbsd.org's avatar
      upstream commit · 624fd395
      djm@openbsd.org authored
      include bad $SSH_CONNECTION in failure output
      Upstream-Regress-ID: b22d72edfde78c403aaec2b9c9753ef633cc0529
    • Darren Tucker's avatar
      Rollback addition of va_start. · 60d860e5
      Darren Tucker authored
      va_start was added in 0f754e29, however
      it has the wrong number of args and it's not usable in non-variadic
      functions anyway so it breaks things (for example Solaris 2.6 as
      reported by Tom G. Christensen).i  ok djm@
  6. 16 Feb, 2016 1 commit
  7. 15 Feb, 2016 4 commits
  8. 12 Feb, 2016 1 commit
    • djm@openbsd.org's avatar
      upstream commit · d2d772f5
      djm@openbsd.org authored
      avoid fatal() for PKCS11 tokens that present empty key IDs
       bz#1773, ok markus@
      Upstream-ID: 044a764fee526f2c4a9d530bd10695422d01fc54
  9. 11 Feb, 2016 2 commits
    • djm@openbsd.org's avatar
      upstream commit · e4c918a6
      djm@openbsd.org authored
      sync crypto algorithm lists in ssh_config(5) and
       sshd_config(5) with current reality. bz#2527
      Upstream-ID: d7fd1b6c1ed848d866236bcb1d7049d2bb9b2ff6
    • djm@openbsd.org's avatar
      upstream commit · e30cabfa
      djm@openbsd.org authored
      fix regression in openssh-6.8 sftp client: existing
       destination directories would incorrectly terminate recursive uploads;
      Upstream-ID: 3306be469f41f26758e3d447987ac6d662623e18
  10. 09 Feb, 2016 2 commits
    • djm@openbsd.org's avatar
      upstream commit · 714e3672
      djm@openbsd.org authored
      turn off more old crypto in the client: hmac-md5, ripemd,
       truncated HMACs, RC4, blowfish. ok markus@ dtucker@
      Upstream-ID: 96aa11c2c082be45267a690c12f1d2aae6acd46e
    • djm@openbsd.org's avatar
      upstream commit · 5a622844
      djm@openbsd.org authored
      don't attempt to percent_expand() already-canonicalised
       addresses, avoiding unnecessary failures when attempting to connect to scoped
       IPv6 addresses (that naturally contain '%' characters)
      Upstream-ID: f24569cffa1a7cbde5f08dc739a72f4d78aa5c6a
  11. 08 Feb, 2016 5 commits
    • djm@openbsd.org's avatar
      upstream commit · 19bcf2ea
      djm@openbsd.org authored
      refactor activation of rekeying
      This makes automatic rekeying internal to the packet code (previously
      the server and client loops needed to assist). In doing to it makes
      application of rekey limits more accurate by accounting for packets
      about to be sent as well as packets queued during rekeying events
      Based on a patch from dtucker@ which was in turn based on a patch
      Aleksander Adamowski in bz#2521; ok markus@
      Upstream-ID: a441227fd64f9739850ca97b4cf794202860fcd8
    • naddy@openbsd.org's avatar
      upstream commit · 603ba411
      naddy@openbsd.org authored
      Only check errno if read() has returned an error.  EOF is
       not an error. This fixes a problem where the mux master would sporadically
       fail to notice that the client had exited. ok mikeb@ djm@
      Upstream-ID: 3c2dadc21fac6ef64665688aac8a75fffd57ae53
    • jsg@openbsd.org's avatar
      upstream commit · 56d7dac7
      jsg@openbsd.org authored
      avoid an uninitialised value when NumberOfPasswordPrompts
       is 0 ok markus@ djm@
      Upstream-ID: 11b068d83c2865343aeb46acf1e9eec00f829b6b
    • djm@openbsd.org's avatar
      upstream commit · deae7d52
      djm@openbsd.org authored
      mention internal DH-GEX fallback groups; bz#2302
      Upstream-ID: e7b395fcca3122cd825515f45a2e41c9a157e09e
    • djm@openbsd.org's avatar
      upstream commit · cac3b666
      djm@openbsd.org authored
      better description for MaxSessions; bz#2531
      Upstream-ID: e2c0d74ee185cd1a3e9d4ca1f1b939b745b354da
  12. 04 Feb, 2016 2 commits
    • Damien Miller's avatar
      avoid FreeBSD RCS Id in comment · 5ef4b0fd
      Damien Miller authored
      Change old $FreeBSD version string in comment so it doesn't
      become an RCS ident downstream; requested by des AT des.no
    • djm@openbsd.org's avatar
      upstream commit · 696d1268
      djm@openbsd.org authored
      printf argument casts to avoid warnings on strict
      Upstream-ID: 7b9f6712cef01865ad29070262d366cf13587c9c