head 1.9; access; symbols pkgsrc-2013Q2:1.9.0.2 pkgsrc-2013Q2-base:1.9 pkgsrc-2013Q1:1.8.0.32 pkgsrc-2013Q1-base:1.8 pkgsrc-2012Q4:1.8.0.30 pkgsrc-2012Q4-base:1.8 pkgsrc-2012Q3:1.8.0.28 pkgsrc-2012Q3-base:1.8 pkgsrc-2012Q2:1.8.0.26 pkgsrc-2012Q2-base:1.8 pkgsrc-2012Q1:1.8.0.24 pkgsrc-2012Q1-base:1.8 pkgsrc-2011Q4:1.8.0.22 pkgsrc-2011Q4-base:1.8 pkgsrc-2011Q3:1.8.0.20 pkgsrc-2011Q3-base:1.8 pkgsrc-2011Q2:1.8.0.18 pkgsrc-2011Q2-base:1.8 pkgsrc-2011Q1:1.8.0.16 pkgsrc-2011Q1-base:1.8 pkgsrc-2010Q4:1.8.0.14 pkgsrc-2010Q4-base:1.8 pkgsrc-2010Q3:1.8.0.12 pkgsrc-2010Q3-base:1.8 pkgsrc-2010Q2:1.8.0.10 pkgsrc-2010Q2-base:1.8 pkgsrc-2010Q1:1.8.0.8 pkgsrc-2010Q1-base:1.8 pkgsrc-2009Q4:1.8.0.6 pkgsrc-2009Q4-base:1.8 pkgsrc-2009Q3:1.8.0.4 pkgsrc-2009Q3-base:1.8 pkgsrc-2009Q2:1.8.0.2 pkgsrc-2009Q2-base:1.8 pkgsrc-2009Q1:1.7.0.24 pkgsrc-2009Q1-base:1.7 pkgsrc-2008Q4:1.7.0.22 pkgsrc-2008Q4-base:1.7 pkgsrc-2008Q3:1.7.0.20 pkgsrc-2008Q3-base:1.7 cube-native-xorg:1.7.0.18 cube-native-xorg-base:1.7 pkgsrc-2008Q2:1.7.0.16 pkgsrc-2008Q2-base:1.7 cwrapper:1.7.0.14 pkgsrc-2008Q1:1.7.0.12 pkgsrc-2008Q1-base:1.7 pkgsrc-2007Q4:1.7.0.10 pkgsrc-2007Q4-base:1.7 pkgsrc-2007Q3:1.7.0.8 pkgsrc-2007Q3-base:1.7 pkgsrc-2007Q2:1.7.0.6 pkgsrc-2007Q2-base:1.7 pkgsrc-2007Q1:1.7.0.4 pkgsrc-2007Q1-base:1.7 pkgsrc-2006Q4:1.7.0.2 pkgsrc-2006Q4-base:1.7 pkgsrc-2006Q3:1.6.0.8 pkgsrc-2006Q3-base:1.6 pkgsrc-2006Q2:1.6.0.6 pkgsrc-2006Q2-base:1.6 pkgsrc-2006Q1:1.6.0.4 pkgsrc-2006Q1-base:1.6 pkgsrc-2005Q4:1.6.0.2 pkgsrc-2005Q4-base:1.6 pkgsrc-2005Q3:1.5.0.2 pkgsrc-2005Q3-base:1.5 pkgsrc-2005Q2:1.4.0.4 pkgsrc-2005Q2-base:1.4 pkgsrc-2005Q1:1.4.0.2 pkgsrc-2005Q1-base:1.4 pkgsrc-2004Q4:1.3.0.2 pkgsrc-2004Q4-base:1.3 pkgsrc-2004Q3:1.2.0.4 pkgsrc-2004Q3-base:1.2 pkgsrc-2004Q2:1.2.0.2 pkgsrc-2004Q2-base:1.2; locks; strict; comment @# @; 1.9 date 2013.05.01.19.58.26; author imil; state dead; branches; next 1.8; 1.8 date 2009.05.21.03.22.29; author taca; state Exp; branches; next 1.7; 1.7 date 2006.10.31.03.31.20; author taca; state Exp; branches; next 1.6; 1.6 date 2005.11.04.14.47.17; author tv; state Exp; branches 1.6.8.1; next 1.5; 1.5 date 2005.09.21.18.07.09; author reed; state Exp; branches; next 1.4; 1.4 date 2005.03.07.23.29.50; author tv; state Exp; branches; next 1.3; 1.3 date 2004.11.04.12.46.33; author markd; state Exp; branches; next 1.2; 1.2 date 2004.05.10.18.12.43; author wiz; state dead; branches; next 1.1; 1.1 date 2004.04.28.04.00.17; author jlam; state Exp; branches; next ; 1.6.8.1 date 2006.11.10.11.50.26; author salo; state Exp; branches; next ; desc @@ 1.9 log @Changes since OpenSSH 6.1 ========================= This release introduces a number of new features: Features: * ssh(1)/sshd(8): Added support for AES-GCM authenticated encryption in SSH protocol 2. The new cipher is available as aes128-gcm@@openssh.com and aes256-gcm@@openssh.com. It uses an identical packet format to the AES-GCM mode specified in RFC 5647, but uses simpler and different selection rules during key exchange. * ssh(1)/sshd(8): Added support for encrypt-then-mac (EtM) MAC modes for SSH protocol 2. These modes alter the packet format and compute the MAC over the packet length and encrypted packet rather than over the plaintext data. These modes are considered more secure and are used by default when available. * ssh(1)/sshd(8): Added support for the UMAC-128 MAC as "umac-128@@openssh.com" and "umac-128-etm@@openssh.com". The latter being an encrypt-then-mac mode. * sshd(8): Added support for multiple required authentication in SSH protocol 2 via an AuthenticationMethods option. This option lists one or more comma-separated lists of authentication method names. Successful completion of all the methods in any list is required for authentication to complete. This allows, for example, requiring a user having to authenticate via public key or GSSAPI before they are offered password authentication. * sshd(8)/ssh-keygen(1): Added support for Key Revocation Lists (KRLs), a compact binary format to represent lists of revoked keys and certificates that take as little as one bit per certificate when revoking by serial number. KRLs may be generated using ssh-keygen(1) and are loaded into sshd(8) via the existing RevokedKeys sshd_config option. * ssh(1): IdentitiesOnly now applies to keys obtained from a PKCS11Provider. This allows control of which keys are offered from tokens using IdentityFile. * sshd(8): sshd_config(5)'s AllowTcpForwarding now accepts "local" and "remote" in addition to its previous "yes"/"no" keywords to allow the server to specify whether just local or remote TCP forwarding is enabled. * sshd(8): Added a sshd_config(5) option AuthorizedKeysCommand to support fetching authorized_keys from a command in addition to (or instead of) from the filesystem. The command is run under an account specified by an AuthorizedKeysCommandUser sshd_config(5) option. * sftp-server(8): Now supports a -d option to allow the starting directory to be something other than the user's home directory. * ssh-keygen(1): Now allows fingerprinting of keys hosted in PKCS#11 tokens using "ssh-keygen -lD pkcs11_provider". * ssh(1): When SSH protocol 2 only is selected (the default), ssh(1) now immediately sends its SSH protocol banner to the server without waiting to receive the server's banner, saving time when connecting. * ssh(1): Added ~v and ~V escape sequences to raise and lower the logging level respectively. * ssh(1): Made the escape command help (~?) context sensitive so that only commands that will work in the current session are shown. * ssh-keygen(1): When deleting host lines from known_hosts using "ssh-keygen -R host", ssh-keygen(1) now prints details of which lines were removed. Bugfixes: * ssh(1): Force a clean shutdown of ControlMaster client sessions when the ~. escape sequence is used. This means that ~. should now work in mux clients even if the server is no longer responding. * ssh(1): Correctly detect errors during local TCP forward setup in multiplexed clients. bz#2055 * ssh-add(1): Made deleting explicit keys "ssh-add -d" symmetric with adding keys with respect to certificates. It now tries to delete the corresponding certificate and respects the -k option to allow deleting of the key only. * sftp(1): Fix a number of parsing and command-editing bugs, including bz#1956 * ssh(1): When muxmaster is run with -N, ensured that it shuts down gracefully when a client sends it "-O stop" rather than hanging around. bz#1985 * ssh-keygen(1): When screening moduli candidates, append to the file rather than overwriting to allow resumption. bz#1957 * ssh(1): Record "Received disconnect" messages at ERROR rather than INFO priority. bz#2057. * ssh(1): Loudly warn if explicitly-provided private key is unreadable. bz#1981 Portable OpenSSH: * sshd(8): The Linux seccomp-filter sandbox is now supported on ARM platforms where the kernel supports it. * sshd(8): The seccomp-filter sandbox will not be enabled if the system headers support it at compile time, regardless of whether it can be enabled then. If the run-time system does not support seccomp-filter, sshd will fall back to the rlimit pseudo-sandbox. * ssh(1): Don't link in the Kerberos libraries. They aren't necessary on the client, just on sshd(8). bz#2072 * Fix GSSAPI linking on Solaris, which uses a differently-named GSSAPI library. bz#2073 * Fix compilation on systems with openssl-1.0.0-fips. * Fix a number of errors in the RPM spec files. Changes since OpenSSH 6.0 ========================= This is primarily a bugfix release. Features: * sshd(8): This release turns on pre-auth sandboxing sshd by default for new installs, by setting UsePrivilegeSeparation=sandbox in sshd_config. * ssh-keygen(1): Add options to specify starting line number and number of lines to process when screening moduli candidates, allowing processing of different parts of a candidate moduli file in parallel * sshd(8): The Match directive now supports matching on the local (listen) address and port upon which the incoming connection was received via LocalAddress and LocalPort clauses. * sshd(8): Extend sshd_config Match directive to allow setting AcceptEnv and {Allow,Deny}{Users,Groups} * Add support for RFC6594 SSHFP DNS records for ECDSA key types. bz#1978 * ssh-keygen(1): Allow conversion of RSA1 keys to public PEM and PKCS8 * sshd(8): Allow the sshd_config PermitOpen directive to accept "none" as an argument to refuse all port-forwarding requests. * sshd(8): Support "none" as an argument for AuthorizedPrincipalsFile * ssh-keyscan(1): Look for ECDSA keys by default. bz#1971 * sshd(8): Add "VersionAddendum" to sshd_config to allow server operators to append some arbitrary text to the server SSH protocol banner. Bugfixes: * ssh(1)/sshd(8): Don't spin in accept() in situations of file descriptor exhaustion. Instead back off for a while. * ssh(1)/sshd(8): Remove hmac-sha2-256-96 and hmac-sha2-512-96 MACs as they were removed from the specification. bz#2023, * sshd(8): Handle long comments in config files better. bz#2025 * ssh(1): Delay setting tty_flag so RequestTTY options are correctly picked up. bz#1995 * sshd(8): Fix handling of /etc/nologin incorrectly being applied to root on platforms that use login_cap. Portable OpenSSH: * sshd(8): Allow sshd pre-auth sandboxing to fall-back to the rlimit sandbox from the Linux SECCOMP filter sandbox when the latter is not available in the kernel. * ssh(1): Fix NULL dereference when built with LDNS and using DNSSEC to retrieve a CNAME SSHFP record. * Fix cross-compilation problems related to pkg-config. bz#1996 Changes since OpenSSH 5.9 ========================= This is primarily a bugfix release. Features: * ssh-keygen(1): Add optional checkpoints for moduli screening * ssh-add(1): new -k option to load plain keys (skipping certificates) * sshd(8): Add wildcard support to PermitOpen, allowing things like "PermitOpen localhost:*". bz #1857 * ssh(1): support for cancelling local and remote port forwards via the multiplex socket. Use ssh -O cancel -L xx:xx:xx -R yy:yy:yy user@@host" to request the cancellation of the specified forwardings * support cancellation of local/dynamic forwardings from ~C commandline Bugfixes: * ssh(1): ensure that $DISPLAY contains only valid characters before using it to extract xauth data so that it can't be used to play local shell metacharacter games. * ssh(1): unbreak remote portforwarding with dynamic allocated listen ports * scp(1): uppress adding '--' to remote commandlines when the first argument does not start with '-'. saves breakage on some difficult-to-upgrade embedded/router platforms * ssh(1)/sshd(8): fix typo in IPQoS parsing: there is no "AF14" class, but there is an "AF21" class * ssh(1)/sshd(8): do not permit SSH2_MSG_SERVICE_REQUEST/ACCEPT during rekeying * ssh(1): skip attempting to create ~/.ssh when -F is passed * sshd(8): unbreak stdio forwarding when ControlPersist is in use; bz#1943 * sshd(1): send tty break to pty master instead of (probably already closed) slave side; bz#1859 * sftp(1): silence error spam for "ls */foo" in directory with files; bz#1683 * Fixed a number of memory and file descriptor leaks Portable OpenSSH: * Add a new privilege separation sandbox implementation for Linux's new seccomp sandbox, automatically enabled on platforms that support it. (Note: privilege separation sandboxing is still experimental) * Fix compilation problems on FreeBSD, where libutil contained openpty() but not login(). * ssh-keygen(1): don't fail in -A on platforms that don't support ECC * Add optional support for LDNS, a BSD licensed DNS resolver library which supports DNSSEC * Relax OpenSSL version check to allow running OpenSSH binaries on systems with OpenSSL libraries with a newer "fix" or "patch" level than the binaries were originally compiled on (previous check only allowed movement within "patch" releases). bz#1991 * Fix builds using contributed Redhat spec file. bz#1992 Changes since OpenSSH 5.8 ========================= Features: * Introduce sandboxing of the pre-auth privsep child using an optional sshd_config(5) "UsePrivilegeSeparation=sandbox" mode that enables mandatory restrictions on the syscalls the privsep child can perform. This intention is to prevent a compromised privsep child from being used to attack other hosts (by opening sockets and proxying) or probing local kernel attack surface. Three concrete sandbox implementation are provided (selected at configure time): systrace, seatbelt and rlimit. The systrace sandbox uses systrace(4) in unsupervised "fast-path" mode, where a list of permitted syscalls is supplied. Any syscall not on the list results in SIGKILL being sent to the privsep child. Note that this requires a kernel with the new SYSTR_POLICY_KILL option (only OpenBSD has this mode at present). The seatbelt sandbox uses OS X/Darwin sandbox(7) facilities with a strict (kSBXProfilePureComputation) policy that disables access to filesystem and network resources. The rlimit sandbox is a fallback choice for platforms that don't support a better one; it uses setrlimit() to reset the hard-limit of file descriptors and processes to zero, which should prevent the privsep child from forking or opening new network connections. Sandboxing of the privilege separated child process is currently experimental but should become the default in a future release. Native sandboxes for other platforms are welcome (e.g. Capsicum, Linux pid/net namespaces, etc.) * Add new SHA256-based HMAC transport integrity modes from http://www.ietf.org/id/draft-dbider-sha2-mac-for-ssh-02.txt These modes are hmac-sha2-256, hmac-sha2-256-96, hmac-sha2-512, and hmac-sha2-512-96, and are available by default in ssh(1) and sshd(8) * The pre-authentication sshd(8) privilege separation slave process now logs via a socket shared with the master process, avoiding the need to maintain /dev/log inside the chroot. * ssh(1) now warns when a server refuses X11 forwarding * sshd_config(5)'s AuthorizedKeysFile now accepts multiple paths, separated by whitespace. The undocumented AuthorizedKeysFile2 option is deprecated (though the default for AuthorizedKeysFile includes .ssh/authorized_keys2) * sshd_config(5): similarly deprecate UserKnownHostsFile2 and GlobalKnownHostsFile2 by making UserKnownHostsFile and GlobalKnownHostsFile accept multiple options and default to include known_hosts2 * Retain key comments when loading v.2 keys. These will be visible in "ssh-add -l" and other places. bz#439 * ssh(1) and sshd(8): set IPv6 traffic class from IPQoS (as well as IPv4 ToS/DSCP). bz#1855 * ssh_config(5)'s ControlPath option now expands %L to the host portion of the destination host name. * ssh_config(5) "Host" options now support negated Host matching, e.g. Host *.example.org !c.example.org User mekmitasdigoat Will match "a.example.org", "b.example.org", but not "c.example.org" * ssh_config(5): a new RequestTTY option provides control over when a TTY is requested for a connection, similar to the existing -t/-tt/-T ssh(1) commandline options. * sshd(8): allow GSSAPI authentication to detect when a server-side failure causes authentication failure and don't count such failures against MaxAuthTries; bz#1244 * ssh-keygen(1): Add -A option. For each of the key types (rsa1, rsa, dsa and ecdsa) for which host keys do not exist, generate the host keys with the default key file path, an empty passphrase, default bits for the key type, and default comment. This is useful for system initialisation scripts. * ssh(1): Allow graceful shutdown of multiplexing: request that a mux server removes its listener socket and refuse future multiplexing requests but don't kill existing connections. This may be requested using "ssh -O stop ..." * ssh-add(1) now accepts keys piped from standard input. E.g. "ssh-add - < /path/to/key" * ssh-keysign(8) now signs hostbased authentication challenges correctly using ECDSA keys; bz#1858 * sftp(1): document that sftp accepts square brackets to delimit addresses (useful for IPv6); bz#1847a * ssh(1): when using session multiplexing, the master process will change its process title to reflect the control path in use and when a ControlPersist-ed master is waiting to close; bz#1883 and bz#1911 * Other minor bugs fixed: 1849 1861 1862 1869 1875 1878 1879 1892 1900 1905 1913 Portable OpenSSH Bugfixes: * Fix a compilation error in the SELinux support code. bz#1851 * This release removes support for ssh-rand-helper. OpenSSH now obtains its random numbers directly from OpenSSL or from a PRNGd/EGD instance specified at configure time. * sshd(8) now resets the SELinux process execution context before executing passwd for password changes; bz#1891 * Since gcc >= 4.x ignores all -Wno-options options, test only the corresponding -W-option when trying to determine whether it is accepted; bz#1901 * Add ECDSA key generation to the Cygwin ssh-{host,user}-config scripts. * Updated .spec and init files for Linux; bz#1920 * Improved SELinux error messages in context change failures and suppress error messages when attempting to change from the "unconfined_t" type; bz#1924 bz#1919 * Fix build errors on platforms without dlopen(); bz#1929 @ text @$NetBSD: patch-ar,v 1.8 2009/05/21 03:22:29 taca Exp $ --- uidswap.c.orig 2009-01-21 14:04:24.000000000 +0900 +++ uidswap.c @@@@ -66,13 +66,13 @@@@ temporarily_use_uid(struct passwd *pw) (u_int)pw->pw_uid, (u_int)pw->pw_gid, (u_int)saved_euid, (u_int)saved_egid); #ifndef HAVE_CYGWIN - if (saved_euid != 0) { + if (saved_euid != ROOTUID) { privileged = 0; return; } #endif #else - if (geteuid() != 0) { + if (geteuid() != ROOTUID) { privileged = 0; return; } @@@@ -96,9 +96,11 @@@@ temporarily_use_uid(struct passwd *pw) /* set and save the user's groups */ if (user_groupslen == -1) { +#ifndef HAVE_INTERIX if (initgroups(pw->pw_name, pw->pw_gid) < 0) fatal("initgroups: %s: %.100s", pw->pw_name, strerror(errno)); +#endif user_groupslen = getgroups(0, NULL); if (user_groupslen < 0) @@@@ -113,9 +115,11 @@@@ temporarily_use_uid(struct passwd *pw) xfree(user_groups); } } +#ifndef HAVE_INTERIX /* Set the effective uid to the given (unprivileged) uid. */ if (setgroups(user_groupslen, user_groups) < 0) fatal("setgroups: %.100s", strerror(errno)); +#endif #ifndef SAVED_IDS_WORK_WITH_SETEUID /* Propagate the privileged gid to all of our gids. */ if (setgid(getegid()) < 0) @@@@ -198,8 +202,10 @@@@ restore_uid(void) setgid(getgid()); #endif /* SAVED_IDS_WORK_WITH_SETEUID */ +#ifndef HAVE_INTERIX if (setgroups(saved_egroupslen, saved_egroups) < 0) fatal("setgroups: %.100s", strerror(errno)); +#endif temporarily_use_uid_effective = 0; } @@@@ -220,6 +226,10 @@@@ permanently_set_uid(struct passwd *pw) debug("permanently_set_uid: %u/%u", (u_int)pw->pw_uid, (u_int)pw->pw_gid); +#if defined(HAVE_INTERIX) + if (setuser(pw->pw_name, NULL, SU_COMPLETE)) + fatal("setuser %u: %.100s", (u_int)pw->pw_gid, strerror(errno)); +#else #if defined(HAVE_SETRESGID) && !defined(BROKEN_SETRESGID) if (setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) < 0) fatal("setresgid %u: %.100s", (u_int)pw->pw_gid, strerror(errno)); @@@@ -278,6 +288,7 @@@@ permanently_set_uid(struct passwd *pw) (setuid(old_uid) != -1 || seteuid(old_uid) != -1)) fatal("%s: was able to restore old [e]uid", __func__); #endif +#endif /* HAVE_INTERIX */ /* Verify UID drop was successful */ if (getuid() != pw->pw_uid || geteuid() != pw->pw_uid) { @ 1.8 log @Update openssh package to 5.2.1(5.2p1). Changes since OpenSSH 5.1 ========================= Security: * This release changes the default cipher order to prefer the AES CTR modes and the revised "arcfour256" mode to CBC mode ciphers that are susceptible to CPNI-957037 "Plaintext Recovery Attack Against SSH". * This release also adds countermeasures to mitigate CPNI-957037-style attacks against the SSH protocol's use of CBC-mode ciphers. Upon detection of an invalid packet length or Message Authentication Code, ssh/sshd will continue reading up to the maximum supported packet length rather than immediately terminating the connection. This eliminates most of the known differences in behaviour that leaked information about the plaintext of injected data which formed the basis of this attack. We believe that these attacks are rendered infeasible by these changes. New features: * Added a -y option to ssh(1) to force logging to syslog rather than stderr, which is useful when running daemonised (ssh -f) * The sshd_config(5) ForceCommand directive now accepts commandline arguments for the internal-sftp server. * The ssh(1) ~C escape commandline now support runtime creation of dynamic (-D) port forwards. * Support the SOCKS4A protocol in ssh(1) dynamic (-D) forwards. (bz#1482) * Support remote port forwarding with a listen port of '0'. This informs the server that it should dynamically allocate a listen port and report it back to the client. (bz#1003) * sshd(8) now supports setting PermitEmptyPasswords and AllowAgentForwarding in Match blocks Bug and documentation fixes * Repair a ssh(1) crash introduced in openssh-5.1 when the client is sent a zero-length banner (bz#1496) * Due to interoperability problems with certain broken SSH implementations, the eow@@openssh.com and no-more-sessions@@openssh.com protocol extensions are now only sent to peers that identify themselves as OpenSSH. * Make ssh(1) send the correct channel number for SSH2_MSG_CHANNEL_SUCCESS and SSH2_MSG_CHANNEL_FAILURE messages to avoid triggering 'Non-public channel' error messages on sshd(8) in openssh-5.1. * Avoid printing 'Non-public channel' warnings in sshd(8), since the ssh(1) has sent incorrect channel numbers since ~2004 (this reverts a behaviour introduced in openssh-5.1). * Avoid double-free in ssh(1) ~C escape -L handler (bz#1539) * Correct fail-on-error behaviour in sftp(1) batchmode for remote stat operations. (bz#1541) * Disable nonfunctional ssh(1) ~C escape handler in multiplex slave connections. (bz#1543) * Avoid hang in ssh(1) when attempting to connect to a server that has MaxSessions=0 set. * Multiple fixes to sshd(8) configuration test (-T) mode * Several core and portable OpenSSH bugs fixed: 1380, 1412, 1418, 1419, 1421, 1490, 1491, 1492, 1514, 1515, 1518, 1520, 1538, 1540 * Many manual page improvements. @ text @d1 1 a1 1 $NetBSD: patch-ar,v 1.7 2006/10/31 03:31:20 taca Exp $ @ 1.7 log @Update openssh package to 4.4.1 (openssh-4.4p1). - A few pkglint warning clean up. - Major changes are here. For complete changes, see http://www.openssh.com/txt/release-4.4. Changes since OpenSSH 4.3: ============================ Security bugs resolved in this release: * Fix a pre-authentication denial of service found by Tavis Ormandy, that would cause sshd(8) to spin until the login grace time expired. * Fix an unsafe signal hander reported by Mark Dowd. The signal handler was vulnerable to a race condition that could be exploited to perform a pre-authentication denial of service. On portable OpenSSH, this vulnerability could theoretically lead to pre-authentication remote code execution if GSSAPI authentication is enabled, but the likelihood of successful exploitation appears remote. * On portable OpenSSH, fix a GSSAPI authentication abort that could be used to determine the validity of usernames on some platforms. This release includes the following new functionality and fixes: * Implemented conditional configuration in sshd_config(5) using the "Match" directive. This allows some configuration options to be selectively overridden if specific criteria (based on user, group, hostname and/or address) are met. So far a useful subset of post- authentication options are supported and more are expected to be added in future releases. * Add support for Diffie-Hellman group exchange key agreement with a final hash of SHA256. * Added a "ForceCommand" directive to sshd_config(5). Similar to the command="..." option accepted in ~/.ssh/authorized_keys, this forces the execution of the specified command regardless of what the user requested. This is very useful in conjunction with the new "Match" option. * Add a "PermitOpen" directive to sshd_config(5). This mirrors the permitopen="..." authorized_keys option, allowing fine-grained control over the port-forwardings that a user is allowed to establish. * Add optional logging of transactions to sftp-server(8). * ssh(1) will now record port numbers for hosts stored in ~/.ssh/authorized_keys when a non-standard port has been requested. * Add an "ExitOnForwardFailure" option to cause ssh(1) to exit (with a non-zero exit code) when requested port forwardings could not be established. * Extend sshd_config(5) "SubSystem" declarations to allow the specification of command-line arguments. * Replacement of all integer overflow susceptible invocations of malloc(3) and realloc(3) with overflow-checking equivalents. * Many manpage fixes and improvements * New portable OpenSSH-specific features: - Add optional support for SELinux, controlled using the --with-selinux configure option (experimental) - Add optional support for Solaris process contracts, enabled using the --with-solaris-contracts configure option (experimental) This option will also include SMF metadata in Solaris packages built using the "make package" target - Add optional support for OpenSSL hardware accelerators (engines), enabled using the --with-ssl-engine configure option. @ text @d1 1 a1 1 $NetBSD: patch-ar,v 1.6 2005/11/04 14:47:17 tv Exp $ d3 1 a3 1 --- uidswap.c.orig 2006-08-05 11:39:41.000000000 +0900 d67 1 a67 1 @@@@ -268,6 +278,7 @@@@ permanently_set_uid(struct passwd *pw) @ 1.6 log @Add more Interix fixes: Need prototype for strtoll(), and two more instances of setgroups() that are not usable on that platform. @ text @d1 1 a1 1 $NetBSD$ d3 1 a3 1 --- uidswap.c.orig 2005-02-22 01:57:13.000000000 -0500 d5 1 a5 1 @@@@ -57,13 +57,13 @@@@ temporarily_use_uid(struct passwd *pw) d21 1 a21 1 @@@@ -87,9 +87,11 @@@@ temporarily_use_uid(struct passwd *pw) d33 1 a33 1 @@@@ -104,9 +106,11 @@@@ temporarily_use_uid(struct passwd *pw) d45 1 a45 1 @@@@ -154,8 +158,10 @@@@ restore_uid(void) d56 1 a56 1 @@@@ -174,6 +180,10 @@@@ permanently_set_uid(struct passwd *pw) d67 1 a67 1 @@@@ -222,6 +232,7 @@@@ permanently_set_uid(struct passwd *pw) @ 1.6.8.1 log @Pullup ticket 1909 - requested by taca security update for openssh Revisions pulled up: - pkgsrc/security/openssh/Makefile 1.172, 1.173, 1.174 - pkgsrc/security/openssh/distinfo 1.55, 1.56, 1.57 - pkgsrc/security/openssh/hacks.mk 1.2 - pkgsrc/security/openssh/options.mk 1.9, 1.10 - pkgsrc/security/openssh/patches/patch-aa 1.42, 1.43 - pkgsrc/security/openssh/patches/patch-ab 1.24, 1.25 - pkgsrc/security/openssh/patches/patch-ac 1.16 - pkgsrc/security/openssh/patches/patch-ad 1.12 - pkgsrc/security/openssh/patches/patch-ae 1.12 - pkgsrc/security/openssh/patches/patch-af 1.10 - pkgsrc/security/openssh/patches/patch-ag 1.9 - pkgsrc/security/openssh/patches/patch-ah 1.24 - pkgsrc/security/openssh/patches/patch-ai 1.10 - pkgsrc/security/openssh/patches/patch-aj 1.7 - pkgsrc/security/openssh/patches/patch-ak 1.8 - pkgsrc/security/openssh/patches/patch-al 1.7 - pkgsrc/security/openssh/patches/patch-am 1.7 - pkgsrc/security/openssh/patches/patch-an 1.8 - pkgsrc/security/openssh/patches/patch-ao 1.9 - pkgsrc/security/openssh/patches/patch-ap 1.8 - pkgsrc/security/openssh/patches/patch-aq 1.6 - pkgsrc/security/openssh/patches/patch-ar 1.7 - pkgsrc/security/openssh/patches/patch-as 1.5 - pkgsrc/security/openssh/patches/patch-at removed - pkgsrc/security/openssh/patches/patch-au 1.3 - pkgsrc/security/openssh/patches/patch-av 1.5 - pkgsrc/security/openssh/patches/patch-aw 1.2 - pkgsrc/security/openssh/patches/patch-ax removed - pkgsrc/security/openssh/patches/patch-ay removed - pkgsrc/security/openssh/patches/patch-az removed Module Name: pkgsrc Committed By: taca Date: Tue Oct 31 03:31:20 UTC 2006 Modified Files: pkgsrc/security/openssh: Makefile distinfo hacks.mk options.mk pkgsrc/security/openssh/patches: patch-aa patch-ab patch-ac patch-ad patch-ae patch-af patch-ag patch-ah patch-ai patch-aj patch-ak patch-al patch-am patch-an patch-ao patch-ap patch-aq patch-ar patch-as patch-au patch-av patch-aw Removed Files: pkgsrc/security/openssh/patches: patch-at patch-ax patch-ay patch-az Log Message: Update openssh package to 4.4.1 (openssh-4.4p1). - A few pkglint warning clean up. - Major changes are here. For complete changes, see http://www.openssh.com/txt/release-4.4. Changes since OpenSSH 4.3: ============================ Security bugs resolved in this release: * Fix a pre-authentication denial of service found by Tavis Ormandy, that would cause sshd(8) to spin until the login grace time expired. * Fix an unsafe signal hander reported by Mark Dowd. The signal handler was vulnerable to a race condition that could be exploited to perform a pre-authentication denial of service. On portable OpenSSH, this vulnerability could theoretically lead to pre-authentication remote code execution if GSSAPI authentication is enabled, but the likelihood of successful exploitation appears remote. * On portable OpenSSH, fix a GSSAPI authentication abort that could be used to determine the validity of usernames on some platforms. This release includes the following new functionality and fixes: * Implemented conditional configuration in sshd_config(5) using the "Match" directive. This allows some configuration options to be selectively overridden if specific criteria (based on user, group, hostname and/or address) are met. So far a useful subset of post- authentication options are supported and more are expected to be added in future releases. * Add support for Diffie-Hellman group exchange key agreement with a final hash of SHA256. * Added a "ForceCommand" directive to sshd_config(5). Similar to the command="..." option accepted in ~/.ssh/authorized_keys, this forces the execution of the specified command regardless of what the user requested. This is very useful in conjunction with the new "Match" option. * Add a "PermitOpen" directive to sshd_config(5). This mirrors the permitopen="..." authorized_keys option, allowing fine-grained control over the port-forwardings that a user is allowed to establish. * Add optional logging of transactions to sftp-server(8). * ssh(1) will now record port numbers for hosts stored in ~/.ssh/authorized_keys when a non-standard port has been requested. * Add an "ExitOnForwardFailure" option to cause ssh(1) to exit (with a non-zero exit code) when requested port forwardings could not be established. * Extend sshd_config(5) "SubSystem" declarations to allow the specification of command-line arguments. * Replacement of all integer overflow susceptible invocations of malloc(3) and realloc(3) with overflow-checking equivalents. * Many manpage fixes and improvements * New portable OpenSSH-specific features: - Add optional support for SELinux, controlled using the --with-selinux configure option (experimental) - Add optional support for Solaris process contracts, enabled using the --with-solaris-contracts configure option (experimental) This option will also include SMF metadata in Solaris packages built using the "make package" target - Add optional support for OpenSSL hardware accelerators (engines), enabled using the --with-ssl-engine configure option. --- Module Name: pkgsrc Committed By: taca Date: Tue Nov 7 07:08:26 UTC 2006 Modified Files: pkgsrc/security/openssh: Makefile distinfo options.mk Log Message: Update hpn-patch to hpn12v13 since old one has gone. Bump PKGREVISION. --- Module Name: pkgsrc Committed By: taca Date: Wed Nov 8 01:49:22 UTC 2006 Modified Files: pkgsrc/security/openssh: Makefile distinfo pkgsrc/security/openssh/patches: patch-aa patch-ab Log Message: Update openssh package to 4.5.1 (openssh-4.5p1). Changes: Security bugs resolved in this release: * Fix a bug in the sshd privilege separation monitor that weakened its verification of successful authentication. This bug is not known to be exploitable in the absence of additional vulnerabilities. This release includes the following non-security fixes: * Several compilation fixes for portable OpenSSH * Fixes to Solaris SMF/process contract support (bugzilla #1255) @ text @d1 1 a1 1 $NetBSD: patch-ar,v 1.7 2006/10/31 03:31:20 taca Exp $ d3 1 a3 1 --- uidswap.c.orig 2006-08-05 11:39:41.000000000 +0900 d5 1 a5 1 @@@@ -66,13 +66,13 @@@@ temporarily_use_uid(struct passwd *pw) d21 1 a21 1 @@@@ -96,9 +96,11 @@@@ temporarily_use_uid(struct passwd *pw) d33 1 a33 1 @@@@ -113,9 +115,11 @@@@ temporarily_use_uid(struct passwd *pw) d45 1 a45 1 @@@@ -198,8 +202,10 @@@@ restore_uid(void) d56 1 a56 1 @@@@ -220,6 +226,10 @@@@ permanently_set_uid(struct passwd *pw) d67 1 a67 1 @@@@ -268,6 +278,7 @@@@ permanently_set_uid(struct passwd *pw) @ 1.5 log @Update openssh to 4.2p1. This is from PR #31331. Thank you, Jason. Some changes different from patches provided in that PR are: - patch-aj, patch-aq, and patch-as not changed (they appeared to be identical to previous patches) - DragonFly support also added to configure script (patch-aa) because compilation failed due to missing crypt - and install-sysconf target removed from the installation target in Makefile.in (patch-ah). Just let the pkgsrc framework install this since it now will allow it to be removed correctly on deinstall. - use "pam" instead of "PAM" as option name in the post-install target. This removes patch-ai. This also now uses openssh-4.2p1-hpn11.diff patch. I didn't test with kerberos and hpn-patch options. I did test with PAM on Linux. (The PR reported that kerberos and hpn-patch options were tested for compiling.) I tested on NetBSD 2.0.2, Linux, and DragonFly. This includes two security fixes and several bug fixes and many improvemens. The changes are listed at http://www.mindrot.org/pipermail/openssh-unix-announce/2005-September/000083.html http://www.mindrot.org/pipermail/openssh-unix-announce/2005-May/000079.html TODO: get some of these patches committed upstream. @ text @d1 1 a1 1 $NetBSD: patch-ar,v 1.4 2005/03/07 23:29:50 tv Exp $ d3 1 a3 1 --- uidswap.c.orig 2005-02-22 00:57:13.000000000 -0600 d5 1 a5 1 @@@@ -57,13 +57,13 @@@@ d21 1 a21 1 @@@@ -87,9 +87,11 @@@@ d33 24 a56 1 @@@@ -174,6 +176,10 @@@@ d67 1 a67 1 @@@@ -222,6 +228,7 @@@@ @ 1.4 log @nb5: Rework Interix support, based on work done by Interop Systems *before* a BSD-with-advertising license was added to their diffs, and other work done personally by me. sshd now works. Most permissions checks work properly. Privsep is off by default, and the sshd user is not created, on Interix until some problems with privsep are fixed (perhaps by abstracting the auth functionality out to openpam). @ text @d1 1 a1 1 $NetBSD$ d3 1 a3 1 --- uidswap.c.orig 2004-02-23 21:17:30.000000000 -0500 d5 1 a5 2 @@@@ -56,12 +56,12 @@@@ temporarily_use_uid(struct passwd *pw) debug("temporarily_use_uid: %u/%u (e=%u/%u)", d8 1 d14 1 d21 1 a21 1 @@@@ -85,9 +85,11 @@@@ temporarily_use_uid(struct passwd *pw) d33 1 a33 1 @@@@ -172,6 +174,10 @@@@ permanently_set_uid(struct passwd *pw) d44 1 a44 1 @@@@ -218,6 +224,7 @@@@ permanently_set_uid(struct passwd *pw) @ 1.3 log @Reorder inclusion of headers to fix build on Solaris when kerberos option is enabled. @ text @d3 18 a20 5 --- includes.h.orig 2004-08-15 02:01:48.000000000 +1200 +++ includes.h @@@@ -176,11 +176,6 @@@@ static /**/const char *const rcsid[] = { # include /* Openpty on FreeBSD at least */ #endif d22 7 a28 9 -#if defined(KRB5) && defined(USE_AFS) -# include -# include -#endif - /* * On HP-UX 11.11, shadow.h and prot.h provide conflicting declarations * of getspnam when _INCLUDE__STDC__ is defined, so we unset it here. @@@@ -195,6 +190,11 @@@@ static /**/const char *const rcsid[] = { d30 5 a34 1 #include "defines.h" d36 15 a50 8 +#if defined(KRB5) && defined(USE_AFS) +# include +# include +#endif + #include "version.h" #include "openbsd-compat/openbsd-compat.h" #include "openbsd-compat/bsd-nextstep.h" @ 1.2 log @Not needed after 3.8.1p1 update. @ text @d1 1 a1 1 $NetBSD: patch-ar,v 1.1 2004/04/28 04:00:17 jlam Exp $ d3 5 a7 5 --- auth-skey.c.orig Wed Jul 3 20:14:18 2002 +++ auth-skey.c @@@@ -47,7 +47,7 @@@@ skey_query(void *ctx, char **name, char int len; struct skey skey; d9 9 a17 3 - if (skeychallenge(&skey, authctxt->user, challenge) == -1) + if (SKEYCHALLENGE(&skey, authctxt->user, challenge, sizeof(challenge)) == -1) return -1; d19 10 a28 1 *name = xstrdup(""); @ 1.1 log @Fix up OpenSSH sources to allow building with S/Key support on NetBSD as well. Bump the PKGREVISION. XXX The right fix is to create a autoconf check for the number of args XXX that skeychallenge takes and do the right thing accordingly. @ text @d1 1 a1 1 $NetBSD$ @