1. 29 Feb, 2016 2 commits
    • Simon Wilkinson's avatar
      GSSAPI key exchange support · 374db175
      Simon Wilkinson authored
      This patch has been rejected upstream: "None of the OpenSSH developers are
      in favour of adding this, and this situation has not changed for several
      years.  This is not a slight on Simon's patch, which is of fine quality, but
      just that a) we don't trust GSSAPI implementations that much and b) we don't
      like adding new KEX since they are pre-auth attack surface.  This one is
      particularly scary, since it requires hooks out to typically root-owned
      system resources."
      
      However, quite a lot of people rely on this in Debian, and it's better to
      have it merged into the main openssh package rather than having separate
      -krb5 packages (as we used to have).  It seems to have a generally good
      security history.
      
      Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1242
      Last-Updated: 2016-01-04
      
      Patch-Name: gssapi.patch
      374db175
    • Colin Watson's avatar
      Import openssh_7.2p1.orig.tar.gz · c52a95cc
      Colin Watson authored
      c52a95cc
  2. 26 Feb, 2016 1 commit
  3. 23 Feb, 2016 10 commits
    • Darren Tucker's avatar
      Skip PrintLastLog in config dump mode. · fd4e4f24
      Darren Tucker authored
      When DISABLE_LASTLOG is set, do not try to include PrintLastLog in the
      config dump since it'll be reported as UNKNOWN.
      fd4e4f24
    • Damien Miller's avatar
      99135c76
    • Damien Miller's avatar
      put back portable patchlevel to p1 · b86a334a
      Damien Miller authored
      b86a334a
    • djm@openbsd.org's avatar
      upstream commit · 555dd35f
      djm@openbsd.org authored
      openssh-7.2
      
      Upstream-ID: 9db776b26014147fc907ece8460ef2bcb0f11e78
      555dd35f
    • Damien Miller's avatar
      Disable tests where fs perms are incorrect · 1acc058d
      Damien Miller authored
      Some tests have strict requirements on the filesystem permissions
      for certain files and directories. This adds a regress/check-perm
      tool that copies the relevant logic from sshd to exactly test
      the paths in question. This lets us skip tests when the local
      filesystem doesn't conform to our expectations rather than
      continuing and failing the test run.
      
      ok dtucker@
      1acc058d
    • Damien Miller's avatar
      fix sandbox on OSX Lion · 39f303b1
      Damien Miller authored
      sshd was failing with:
      
      ssh_sandbox_child: sandbox_init: dlopen(/usr/lib/libsandbox.1.dylib, 261):cw
        image not found [preauth]
      
      caused by chroot before sandboxing. Avoid by explicitly linking libsandbox
      to sshd. Spotted by Darren.
      39f303b1
    • djm@openbsd.org's avatar
      upstream commit · 0d1451a3
      djm@openbsd.org authored
      fix spurious error message when incorrect passphrase
       entered for keys; reported by espie@ ok deraadt@
      
      Upstream-ID: 58b2e46e63ed6912ed1ee780bd3bd8560f9a5899
      0d1451a3
    • sobrado@openbsd.org's avatar
      upstream commit · 09d87d79
      sobrado@openbsd.org authored
      set ssh(1) protocol version to 2 only.
      
      ok djm@
      
      Upstream-ID: e168daf9d27d7e392e3c9923826bd8e87b2b3a10
      09d87d79
    • sobrado@openbsd.org's avatar
      upstream commit · 9262e078
      sobrado@openbsd.org authored
      add missing ~/.ssh/id_ecdsa and ~/.ssh/id_ed25519 to
       IdentityFile.
      
      ok djm@
      
      Upstream-ID: 6ce99466312e4ae7708017c3665e3edb976f70cf
      9262e078
    • sobrado@openbsd.org's avatar
      upstream commit · c12f0fdc
      sobrado@openbsd.org authored
      AddressFamily defaults to any.
      
      ok djm@
      
      Upstream-ID: 0d94aa06a4b889bf57a7f631c45ba36d24c13e0c
      c12f0fdc
  4. 18 Feb, 2016 1 commit
    • Darren Tucker's avatar
      Make Solaris privs code build on older systems. · 907091ac
      Darren Tucker authored
      Not all systems with Solaris privs have priv_basicset so factor that
      out and provide backward compatibility code.  Similarly, not all have
      PRIV_NET_ACCESS so wrap that in #ifdef.  Based on code from
      alex at cooperi.net and djm@ with help from carson at taltos.org and
      wieland at purdue.edu.
      907091ac
  5. 17 Feb, 2016 9 commits
    • djm@openbsd.org's avatar
      upstream commit · 292a8dee
      djm@openbsd.org authored
      rekey refactor broke SSH1; spotted by Tom G. Christensen
      
      Upstream-ID: 43f0d57928cc077c949af0bfa71ef574dcb58243
      292a8dee
    • djm@openbsd.org's avatar
      upstream commit · 3a13cb54
      djm@openbsd.org authored
      rsa-sha2-512,rsa-sha2-256 cannot be selected explicitly
       in *KeyTypes options yet. Remove them from the lists of algorithms for now.
       committing on behalf of markus@ ok djm@
      
      Upstream-ID: c6e8820eb8e610ac21551832c0c89684a9a51bb7
      3a13cb54
    • jmc@openbsd.org's avatar
      upstream commit · a685ae8d
      jmc@openbsd.org authored
      since these pages now clearly tell folks to avoid v1,
       normalise the docs from a v2 perspective (i.e. stop pointing out which bits
       are v2 only);
      
      ok/tweaks djm ok markus
      
      Upstream-ID: eb474f8c36fb6a532dc05c282f7965e38dcfa129
      a685ae8d
    • djm@openbsd.org's avatar
      upstream commit · c5c3f327
      djm@openbsd.org authored
      make sandboxed privilege separation the default, not just
       for new installs; "absolutely" deraadt@
      
      Upstream-ID: 5221ef3b927d2df044e9aa3f5db74ae91743f69b
      c5c3f327
    • jmc@openbsd.org's avatar
      upstream commit · eb3f7337
      jmc@openbsd.org authored
      no need to state that protocol 2 is the default twice;
      
      Upstream-ID: b1e4c36b0c2e12e338e5b66e2978f2ac953b95eb
      eb3f7337
    • djm@openbsd.org's avatar
      upstream commit · e7901efa
      djm@openbsd.org authored
      Replace list of ciphers and MACs adjacent to -1/-2 flag
       descriptions in ssh(1) with a strong recommendation not to use protocol 1.
       Add a similar warning to the Protocol option descriptions in ssh_config(5)
       and sshd_config(5);
      
      prompted by and ok mmcc@
      
      Upstream-ID: 961f99e5437d50e636feca023978950a232ead5e
      e7901efa
    • djm@openbsd.org's avatar
      upstream commit · 5a0fcb77
      djm@openbsd.org authored
      add a "Close session" log entry (at loglevel=verbose) to
       correspond to the existing "Starting session" one. Also include the session
       id number to make multiplexed sessions more apparent.
      
      feedback and ok dtucker@
      
      Upstream-ID: e72d2ac080e02774376325136e532cb24c2e617c
      5a0fcb77
    • djm@openbsd.org's avatar
      upstream commit · 624fd395
      djm@openbsd.org authored
      include bad $SSH_CONNECTION in failure output
      
      Upstream-Regress-ID: b22d72edfde78c403aaec2b9c9753ef633cc0529
      624fd395
    • Darren Tucker's avatar
      Rollback addition of va_start. · 60d860e5
      Darren Tucker authored
      va_start was added in 0f754e29, however
      it has the wrong number of args and it's not usable in non-variadic
      functions anyway so it breaks things (for example Solaris 2.6 as
      reported by Tom G. Christensen).i  ok djm@
      60d860e5
  6. 16 Feb, 2016 1 commit
  7. 15 Feb, 2016 4 commits
  8. 12 Feb, 2016 1 commit
    • djm@openbsd.org's avatar
      upstream commit · d2d772f5
      djm@openbsd.org authored
      avoid fatal() for PKCS11 tokens that present empty key IDs
       bz#1773, ok markus@
      
      Upstream-ID: 044a764fee526f2c4a9d530bd10695422d01fc54
      d2d772f5
  9. 11 Feb, 2016 2 commits
    • djm@openbsd.org's avatar
      upstream commit · e4c918a6
      djm@openbsd.org authored
      sync crypto algorithm lists in ssh_config(5) and
       sshd_config(5) with current reality. bz#2527
      
      Upstream-ID: d7fd1b6c1ed848d866236bcb1d7049d2bb9b2ff6
      e4c918a6
    • djm@openbsd.org's avatar
      upstream commit · e30cabfa
      djm@openbsd.org authored
      fix regression in openssh-6.8 sftp client: existing
       destination directories would incorrectly terminate recursive uploads;
       bz#2528
      
      Upstream-ID: 3306be469f41f26758e3d447987ac6d662623e18
      e30cabfa
  10. 09 Feb, 2016 2 commits
    • djm@openbsd.org's avatar
      upstream commit · 714e3672
      djm@openbsd.org authored
      turn off more old crypto in the client: hmac-md5, ripemd,
       truncated HMACs, RC4, blowfish. ok markus@ dtucker@
      
      Upstream-ID: 96aa11c2c082be45267a690c12f1d2aae6acd46e
      714e3672
    • djm@openbsd.org's avatar
      upstream commit · 5a622844
      djm@openbsd.org authored
      don't attempt to percent_expand() already-canonicalised
       addresses, avoiding unnecessary failures when attempting to connect to scoped
       IPv6 addresses (that naturally contain '%' characters)
      
      Upstream-ID: f24569cffa1a7cbde5f08dc739a72f4d78aa5c6a
      5a622844
  11. 08 Feb, 2016 5 commits
    • djm@openbsd.org's avatar
      upstream commit · 19bcf2ea
      djm@openbsd.org authored
      refactor activation of rekeying
      
      This makes automatic rekeying internal to the packet code (previously
      the server and client loops needed to assist). In doing to it makes
      application of rekey limits more accurate by accounting for packets
      about to be sent as well as packets queued during rekeying events
      themselves.
      
      Based on a patch from dtucker@ which was in turn based on a patch
      Aleksander Adamowski in bz#2521; ok markus@
      
      Upstream-ID: a441227fd64f9739850ca97b4cf794202860fcd8
      19bcf2ea
    • naddy@openbsd.org's avatar
      upstream commit · 603ba411
      naddy@openbsd.org authored
      Only check errno if read() has returned an error.  EOF is
       not an error. This fixes a problem where the mux master would sporadically
       fail to notice that the client had exited. ok mikeb@ djm@
      
      Upstream-ID: 3c2dadc21fac6ef64665688aac8a75fffd57ae53
      603ba411
    • jsg@openbsd.org's avatar
      upstream commit · 56d7dac7
      jsg@openbsd.org authored
      avoid an uninitialised value when NumberOfPasswordPrompts
       is 0 ok markus@ djm@
      
      Upstream-ID: 11b068d83c2865343aeb46acf1e9eec00f829b6b
      56d7dac7
    • djm@openbsd.org's avatar
      upstream commit · deae7d52
      djm@openbsd.org authored
      mention internal DH-GEX fallback groups; bz#2302
      
      Upstream-ID: e7b395fcca3122cd825515f45a2e41c9a157e09e
      deae7d52
    • djm@openbsd.org's avatar
      upstream commit · cac3b666
      djm@openbsd.org authored
      better description for MaxSessions; bz#2531
      
      Upstream-ID: e2c0d74ee185cd1a3e9d4ca1f1b939b745b354da
      cac3b666
  12. 04 Feb, 2016 2 commits
    • Damien Miller's avatar
      avoid FreeBSD RCS Id in comment · 5ef4b0fd
      Damien Miller authored
      Change old $FreeBSD version string in comment so it doesn't
      become an RCS ident downstream; requested by des AT des.no
      5ef4b0fd
    • djm@openbsd.org's avatar
      upstream commit · 696d1268
      djm@openbsd.org authored
      printf argument casts to avoid warnings on strict
       compilers
      
      Upstream-ID: 7b9f6712cef01865ad29070262d366cf13587c9c
      696d1268