Import OpenSSH-8.8:
Future deprecation notice
=========================
A near-future release of OpenSSH will switch scp(1) from using the
legacy scp/rcp protocol to using SFTP by default.
Legacy scp/rcp performs wildcard expansion of remote filenames (e.g.
"scp host:* .") through the remote shell. This has the side effect of
requiring double quoting of shell meta-characters in file names
included on scp(1) command-lines, otherwise they could be interpreted
as shell commands on the remote side.
This creates one area of potential incompatibility: scp(1) when using
the SFTP protocol no longer requires this finicky and brittle quoting,
and attempts to use it may cause transfers to fail. We consider the
removal of the need for double-quoting shell characters in file names
to be a benefit and do not intend to introduce bug- compatibility for
legacy scp/rcp in scp(1) when using the SFTP protocol.
Another area of potential incompatibility relates to the use of remote
paths relative to other user's home directories, for example -
"scp host:~user/file /tmp". The SFTP protocol has no native way to
expand a ~user path. However, sftp-server(8) in OpenSSH 8.7 and later
support a protocol extension "expand-path@openssh.com" to support
this.
Security
========
sshd(8) from OpenSSH 6.2 through 8.7 failed to correctly initialise
supplemental groups when executing an AuthorizedKeysCommand or
AuthorizedPrincipalsCommand, where a AuthorizedKeysCommandUser or
AuthorizedPrincipalsCommandUser directive has been set to run the
command as a different user. Instead these commands would inherit
the groups that sshd(8) was started with.
Depending on system configuration, inherited groups may allow
AuthorizedKeysCommand/AuthorizedPrincipalsCommand helper programs to
gain unintended privilege.
Neither AuthorizedKeysCommand nor AuthorizedPrincipalsCommand are
enabled by default in sshd_config(5).
Potentially-incompatible changes
================================
This release disables RSA signatures using the SHA-1 hash algorithm
by default. This change has been made as the SHA-1 hash algorithm is
cryptographically broken, and it is possible to create chosen-prefix
hash collisions for <USD$50K [1]
For most users, this change should be invisible and there is
no need to replace ssh-rsa keys. OpenSSH has supported RFC8332
RSA/SHA-256/512 signatures since release 7.2 and existing ssh-rsa keys
will automatically use the stronger algorithm where possible.
Incompatibility is more likely when connecting to older SSH
implementations that have not been upgraded or have not closely tracked
improvements in the SSH protocol. For these cases, it may be necessary
to selectively re-enable RSA/SHA1 to allow connection and/or user
authentication via the HostkeyAlgorithms and PubkeyAcceptedAlgorithms
options. For example, the following stanza in ~/.ssh/config will enable
RSA/SHA1 for host and user authentication for a single destination host:
Host old-host
HostkeyAlgorithms +ssh-rsa
PubkeyAcceptedAlgorithms +ssh-rsa
We recommend enabling RSA/SHA1 only as a stopgap measure until legacy
implementations can be upgraded or reconfigured with another key type
(such as ECDSA or Ed25519).
[1] "SHA-1 is a Shambles: First Chosen-Prefix Collision on SHA-1 and
Application to the PGP Web of Trust" Leurent, G and Peyrin, T
(2020) https://eprint.iacr.org/2020/014.pdf
Changes since OpenSSH 8.7
=========================
This release is motivated primarily by the above deprecation and
security fix.
New features
------------
* ssh(1): allow the ssh_config(5) CanonicalizePermittedCNAMEs
directive to accept a "none" argument to specify the default
behaviour.
Bugfixes
--------
* scp(1): when using the SFTP protocol, continue transferring files
after a transfer error occurs, better matching original scp/rcp
behaviour.
* ssh(1): fixed a number of memory leaks in multiplexing,
* ssh-keygen(1): avoid crash when using the -Y find-principals
command.
* A number of documentation and manual improvements, including
bz#3340, PR#139, PR#215, PR#241, PR#257
Portability
-----------
* ssh-agent(1): on FreeBSD, use procctl to disable ptrace(2)
* ssh(1)/sshd(8): some fixes to the pselect(2) replacement
compatibility code. bz#3345
This commit is contained in:
christos
parent
b74a14ac5e
commit
dd1df6f56c
|
|
@ -1,4 +1,4 @@
|
|||
/* $OpenBSD: channels.c,v 1.407 2021/05/19 01:24:05 djm Exp $ */
|
||||
/* $OpenBSD: channels.c,v 1.408 2021/09/14 11:04:21 mbuhl Exp $ */
|
||||
/*
|
||||
* Author: Tatu Ylonen <ylo@cs.hut.fi>
|
||||
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
|
||||
|
|
@ -619,9 +619,11 @@ channel_free(struct ssh *ssh, Channel *c)
|
|||
debug("channel %d: free: %s, nchannels %u", c->self,
|
||||
c->remote_name ? c->remote_name : "???", n);
|
||||
|
||||
if (c->type == SSH_CHANNEL_MUX_CLIENT)
|
||||
if (c->type == SSH_CHANNEL_MUX_CLIENT) {
|
||||
mux_remove_remote_forwardings(ssh, c);
|
||||
else if (c->type == SSH_CHANNEL_MUX_LISTENER) {
|
||||
free(c->mux_ctx);
|
||||
c->mux_ctx = NULL;
|
||||
} else if (c->type == SSH_CHANNEL_MUX_LISTENER) {
|
||||
free(c->mux_ctx);
|
||||
c->mux_ctx = NULL;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
/* $OpenBSD: clientloop.c,v 1.369 2021/07/23 04:04:52 djm Exp $ */
|
||||
/* $OpenBSD: clientloop.c,v 1.370 2021/08/29 23:44:07 djm Exp $ */
|
||||
/*
|
||||
* Author: Tatu Ylonen <ylo@cs.hut.fi>
|
||||
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
|
||||
|
|
@ -1397,7 +1397,8 @@ client_loop(struct ssh *ssh, int have_pty, int escape_char_arg,
|
|||
* exit status to be returned. In that case, clear error code if the
|
||||
* connection was deliberately terminated at this end.
|
||||
*/
|
||||
if (options.session_type == SESSION_TYPE_NONE && received_signal == SIGTERM) {
|
||||
if (options.session_type == SESSION_TYPE_NONE &&
|
||||
received_signal == SIGTERM) {
|
||||
received_signal = 0;
|
||||
exit_status = 0;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
/* $OpenBSD: compat.c,v 1.118 2021/06/06 03:40:39 djm Exp $ */
|
||||
/* $OpenBSD: compat.c,v 1.119 2021/09/10 05:46:09 djm Exp $ */
|
||||
/*
|
||||
* Copyright (c) 1999, 2000, 2001, 2002 Markus Friedl. All rights reserved.
|
||||
*
|
||||
|
|
@ -67,7 +67,6 @@ compat_banner(struct ssh *ssh, const char *version)
|
|||
"OpenSSH_7.1*,"
|
||||
"OpenSSH_7.2*,"
|
||||
"OpenSSH_7.3*,"
|
||||
"OpenSSH_7.4*,"
|
||||
"OpenSSH_7.5*,"
|
||||
"OpenSSH_7.6*,"
|
||||
"OpenSSH_7.7*", SSH_NEW_OPENSSH|SSH_BUG_SIGTYPE},
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
/* $OpenBSD: log.c,v 1.59 2021/05/07 04:11:51 djm Exp $ */
|
||||
/* $OpenBSD: log.c,v 1.60 2021/09/16 15:11:19 djm Exp $ */
|
||||
/*
|
||||
* Author: Tatu Ylonen <ylo@cs.hut.fi>
|
||||
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
|
||||
|
|
@ -311,6 +311,7 @@ do_log(LogLevel level, int force, const char *suffix, const char *fmt,
|
|||
int pri = LOG_INFO;
|
||||
int saved_errno = errno;
|
||||
log_handler_fn *tmp_handler;
|
||||
const char *progname = argv0 != NULL ? argv0 : __progname;
|
||||
|
||||
if (!force && level > log_level)
|
||||
return;
|
||||
|
|
@ -367,11 +368,13 @@ do_log(LogLevel level, int force, const char *suffix, const char *fmt,
|
|||
tmp_handler(level, force, fmtbuf, log_handler_ctx);
|
||||
log_handler = tmp_handler;
|
||||
} else if (log_on_stderr) {
|
||||
snprintf(msgbuf, sizeof msgbuf, "%.*s\r\n",
|
||||
snprintf(msgbuf, sizeof msgbuf, "%s%s%.*s\r\n",
|
||||
(log_on_stderr > 1) ? progname : "",
|
||||
(log_on_stderr > 1) ? ": " : "",
|
||||
(int)sizeof msgbuf - 3, fmtbuf);
|
||||
(void)write(log_stderr_fd, msgbuf, strlen(msgbuf));
|
||||
} else {
|
||||
openlog_r(argv0 ? argv0 : __progname, LOG_PID, log_facility, &sdata);
|
||||
openlog_r(progname, LOG_PID, log_facility, &sdata);
|
||||
syslog_r(pri, &sdata, "%.500s", fmtbuf);
|
||||
closelog_r(&sdata);
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
/* $OpenBSD: misc.c,v 1.169 2021/08/09 23:47:44 djm Exp $ */
|
||||
/* $OpenBSD: misc.c,v 1.170 2021/09/26 14:01:03 djm Exp $ */
|
||||
/*
|
||||
* Copyright (c) 2000 Markus Friedl. All rights reserved.
|
||||
* Copyright (c) 2005-2020 Damien Miller. All rights reserved.
|
||||
|
|
@ -2594,6 +2594,12 @@ subprocess(const char *tag, const char *command,
|
|||
}
|
||||
closefrom(STDERR_FILENO + 1);
|
||||
|
||||
if (geteuid() == 0 &&
|
||||
initgroups(pw->pw_name, pw->pw_gid) == -1) {
|
||||
error("%s: initgroups(%s, %u): %s", tag,
|
||||
pw->pw_name, (u_int)pw->pw_gid, strerror(errno));
|
||||
_exit(1);
|
||||
}
|
||||
if (setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) == -1) {
|
||||
error("%s: setresgid %u: %s", tag, (u_int)pw->pw_gid,
|
||||
strerror(errno));
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
/* $OpenBSD: myproposal.h,v 1.68 2020/10/03 04:15:06 djm Exp $ */
|
||||
/* $OpenBSD: myproposal.h,v 1.69 2021/08/29 23:53:10 djm Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2000 Markus Friedl. All rights reserved.
|
||||
|
|
@ -46,7 +46,6 @@
|
|||
"sk-ecdsa-sha2-nistp256-cert-v01@openssh.com," \
|
||||
"rsa-sha2-512-cert-v01@openssh.com," \
|
||||
"rsa-sha2-256-cert-v01@openssh.com," \
|
||||
"ssh-rsa-cert-v01@openssh.com," \
|
||||
"ssh-ed25519," \
|
||||
"ecdsa-sha2-nistp256," \
|
||||
"ecdsa-sha2-nistp384," \
|
||||
|
|
@ -54,8 +53,7 @@
|
|||
"sk-ssh-ed25519@openssh.com," \
|
||||
"sk-ecdsa-sha2-nistp256@openssh.com," \
|
||||
"rsa-sha2-512," \
|
||||
"rsa-sha2-256," \
|
||||
"ssh-rsa"
|
||||
"rsa-sha2-256"
|
||||
|
||||
#define KEX_SERVER_ENCRYPT \
|
||||
"chacha20-poly1305@openssh.com," \
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
/* $OpenBSD: readconf.c,v 1.361 2021/07/23 04:04:52 djm Exp $ */
|
||||
/* $OpenBSD: readconf.c,v 1.363 2021/09/16 05:36:03 djm Exp $ */
|
||||
/*
|
||||
* Author: Tatu Ylonen <ylo@cs.hut.fi>
|
||||
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
|
||||
|
|
@ -1997,11 +1997,23 @@ parse_pubkey_algos:
|
|||
|
||||
case oCanonicalizePermittedCNAMEs:
|
||||
value = options->num_permitted_cnames != 0;
|
||||
i = 0;
|
||||
while ((arg = argv_next(&ac, &av)) != NULL) {
|
||||
/* Either '*' for everything or 'list:list' */
|
||||
if (strcmp(arg, "*") == 0)
|
||||
/*
|
||||
* Either 'none' (only in first position), '*' for
|
||||
* everything or 'list:list'
|
||||
*/
|
||||
if (strcasecmp(arg, "none") == 0) {
|
||||
if (i > 0 || ac > 0) {
|
||||
error("%s line %d: keyword %s \"none\" "
|
||||
"argument must appear alone.",
|
||||
filename, linenum, keyword);
|
||||
goto out;
|
||||
}
|
||||
arg2 = "";
|
||||
} else if (strcmp(arg, "*") == 0) {
|
||||
arg2 = arg;
|
||||
else {
|
||||
} else {
|
||||
lowercase(arg);
|
||||
if ((arg2 = strchr(arg, ':')) == NULL ||
|
||||
arg2[1] == '\0') {
|
||||
|
|
@ -2013,6 +2025,7 @@ parse_pubkey_algos:
|
|||
*arg2 = '\0';
|
||||
arg2++;
|
||||
}
|
||||
i++;
|
||||
if (!*activep || value)
|
||||
continue;
|
||||
if (options->num_permitted_cnames >=
|
||||
|
|
@ -2266,6 +2279,20 @@ option_clear_or_none(const char *o)
|
|||
return o == NULL || strcasecmp(o, "none") == 0;
|
||||
}
|
||||
|
||||
/*
|
||||
* Returns 1 if CanonicalizePermittedCNAMEs have been specified, 0 otherwise.
|
||||
* Allowed to be called on non-final configuration.
|
||||
*/
|
||||
int
|
||||
config_has_permitted_cnames(Options *options)
|
||||
{
|
||||
if (options->num_permitted_cnames == 1 &&
|
||||
strcasecmp(options->permitted_cnames[0].source_list, "none") == 0 &&
|
||||
strcmp(options->permitted_cnames[0].target_list, "") == 0)
|
||||
return 0;
|
||||
return options->num_permitted_cnames > 0;
|
||||
}
|
||||
|
||||
/*
|
||||
* Initializes options to special values that indicate that they have not yet
|
||||
* been set. Read_config_file will only set options with this value. Options
|
||||
|
|
@ -2627,6 +2654,15 @@ fill_default_options(Options * options)
|
|||
free(options->jump_host);
|
||||
options->jump_host = NULL;
|
||||
}
|
||||
if (options->num_permitted_cnames == 1 &&
|
||||
!config_has_permitted_cnames(options)) {
|
||||
/* clean up CanonicalizePermittedCNAMEs=none */
|
||||
free(options->permitted_cnames[0].source_list);
|
||||
free(options->permitted_cnames[0].target_list);
|
||||
memset(options->permitted_cnames, '\0',
|
||||
sizeof(*options->permitted_cnames));
|
||||
options->num_permitted_cnames = 0;
|
||||
}
|
||||
/* options->identity_agent distinguishes NULL from 'none' */
|
||||
/* options->user will be set in the main program if appropriate */
|
||||
/* options->hostname will be set in the main program if appropriate */
|
||||
|
|
@ -3342,14 +3378,14 @@ dump_client_config(Options *o, const char *host)
|
|||
printf("\n");
|
||||
|
||||
/* oCanonicalizePermittedCNAMEs */
|
||||
if ( o->num_permitted_cnames > 0) {
|
||||
printf("canonicalizePermittedcnames");
|
||||
for (i = 0; i < o->num_permitted_cnames; i++) {
|
||||
printf(" %s:%s", o->permitted_cnames[i].source_list,
|
||||
o->permitted_cnames[i].target_list);
|
||||
}
|
||||
printf("\n");
|
||||
printf("canonicalizePermittedcnames");
|
||||
if (o->num_permitted_cnames == 0)
|
||||
printf(" none");
|
||||
for (i = 0; i < o->num_permitted_cnames; i++) {
|
||||
printf(" %s:%s", o->permitted_cnames[i].source_list,
|
||||
o->permitted_cnames[i].target_list);
|
||||
}
|
||||
printf("\n");
|
||||
|
||||
/* oControlPersist */
|
||||
if (o->control_persist == 0 || o->control_persist_timeout == 0)
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
/* $OpenBSD: readconf.h,v 1.144 2021/07/23 04:04:52 djm Exp $ */
|
||||
/* $OpenBSD: readconf.h,v 1.145 2021/09/15 06:56:01 djm Exp $ */
|
||||
|
||||
/*
|
||||
* Author: Tatu Ylonen <ylo@cs.hut.fi>
|
||||
|
|
@ -228,6 +228,7 @@ int parse_jump(const char *, Options *, int);
|
|||
int parse_ssh_uri(const char *, char **, char **, int *);
|
||||
int default_ssh_port(void);
|
||||
int option_clear_or_none(const char *);
|
||||
int config_has_permitted_cnames(Options *);
|
||||
void dump_client_config(Options *o, const char *host);
|
||||
|
||||
void add_local_forward(Options *, const struct Forward *);
|
||||
|
|
|
|||
|
|
@ -8,9 +8,9 @@
|
|||
.\"
|
||||
.\" Created: Sun May 7 00:14:37 1995 ylo
|
||||
.\"
|
||||
.\" $OpenBSD: scp.1,v 1.100 2021/08/11 14:07:54 naddy Exp $
|
||||
.\" $OpenBSD: scp.1,v 1.105 2021/09/20 06:53:56 djm Exp $
|
||||
.\"
|
||||
.Dd $Mdocdate: August 11 2021 $
|
||||
.Dd $Mdocdate: September 20 2021 $
|
||||
.Dt SCP 1
|
||||
.Os
|
||||
.Sh NAME
|
||||
|
|
@ -37,9 +37,6 @@ It uses
|
|||
.Xr ssh 1
|
||||
for data transfer, and uses the same authentication and provides the
|
||||
same security as a login session.
|
||||
The scp protocol requires execution of the remote user's shell to perform
|
||||
.Xr glob 3
|
||||
pattern matching.
|
||||
.Pp
|
||||
.Nm
|
||||
will ask for passwords or passphrases if they are needed for
|
||||
|
|
@ -79,7 +76,7 @@ The options are as follows:
|
|||
Copies between two remote hosts are transferred through the local host.
|
||||
Without this option the data is copied directly between the two remote
|
||||
hosts.
|
||||
Note that, when using the legacy SCP protocol (the default), this option
|
||||
Note that, when using the original SCP protocol (the default), this option
|
||||
selects batch mode for the second host as
|
||||
.Nm
|
||||
cannot ask for passwords or passphrases for both hosts.
|
||||
|
|
@ -112,7 +109,7 @@ This option is directly passed to
|
|||
.Xr ssh 1 .
|
||||
.It Fl D Ar sftp_server_path
|
||||
When using the SFTP protocol support via
|
||||
.Fl M ,
|
||||
.Fl s ,
|
||||
connect directly to a local SFTP server program rather than a
|
||||
remote one via
|
||||
.Xr ssh 1 .
|
||||
|
|
@ -144,10 +141,12 @@ This option is directly passed to
|
|||
.It Fl l Ar limit
|
||||
Limits the used bandwidth, specified in Kbit/s.
|
||||
.It Fl O
|
||||
Use the legacy SCP protocol for file transfers instead of the SFTP protocol.
|
||||
Use the original SCP protocol for file transfers instead of the SFTP protocol.
|
||||
Forcing the use of the SCP protocol may be necessary for servers that do
|
||||
not implement SFTP or for backwards-compatibility for particular filename
|
||||
wildcard patterns.
|
||||
not implement SFTP, for backwards-compatibility for particular filename
|
||||
wildcard patterns and for expanding paths with a
|
||||
.Sq ~
|
||||
prefix for older SFTP servers.
|
||||
This mode is the default.
|
||||
.It Fl o Ar ssh_option
|
||||
Can be used to pass options to
|
||||
|
|
@ -229,10 +228,10 @@ Note that this option is written with a capital
|
|||
.Sq P ,
|
||||
because
|
||||
.Fl p
|
||||
is already reserved for preserving the times and modes of the file.
|
||||
is already reserved for preserving the times and mode bits of the file.
|
||||
.It Fl p
|
||||
Preserves modification times, access times, and modes from the
|
||||
original file.
|
||||
Preserves modification times, access times, and file mode bits from the
|
||||
source file.
|
||||
.It Fl q
|
||||
Quiet mode: disables the progress meter as well as warning and diagnostic
|
||||
messages from
|
||||
|
|
@ -259,15 +258,7 @@ The program must understand
|
|||
.Xr ssh 1
|
||||
options.
|
||||
.It Fl s
|
||||
Use the SFTP protocol for file transfers instead of the legacy SCP protocol.
|
||||
Using SFTP avoids invoking a shell on the remote side and provides
|
||||
more predictable filename handling, as the SCP protocol
|
||||
relied on the remote shell for expanding
|
||||
.Xr glob 3
|
||||
wildcards.
|
||||
.Pp
|
||||
A near-future release of OpenSSH will make the SFTP protocol the default.
|
||||
This option will be deleted before the end of 2022.
|
||||
Use the SFTP protocol for transfers rather than the original scp protocol.
|
||||
.It Fl T
|
||||
Disable strict filename checking.
|
||||
By default when copying files from a remote host to a local directory
|
||||
|
|
@ -307,3 +298,10 @@ source code from the Regents of the University of California.
|
|||
.Sh AUTHORS
|
||||
.An Timo Rinne Aq Mt tri@iki.fi
|
||||
.An Tatu Ylonen Aq Mt ylo@cs.hut.fi
|
||||
.Sh CAVEATS
|
||||
The original SCP protocol (used by default) requires execution of the
|
||||
remote user's shell to perform
|
||||
.Xr glob 3
|
||||
pattern matching.
|
||||
This requires careful quoting of any characters that have special meaning to
|
||||
the remote shell, such as quote characters.
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
/* $OpenBSD: scp.c,v 1.232 2021/08/11 14:07:54 naddy Exp $ */
|
||||
/* $OpenBSD: scp.c,v 1.239 2021/09/20 06:53:56 djm Exp $ */
|
||||
/*
|
||||
* scp - secure remote copy. This is basically patched BSD rcp which
|
||||
* uses ssh to do the data transfer (instead of using rcmd).
|
||||
|
|
@ -437,7 +437,7 @@ main(int argc, char **argv)
|
|||
newargv[n] = xstrdup(argv[n]);
|
||||
argv = newargv;
|
||||
|
||||
log_init(argv0, log_level, SYSLOG_FACILITY_USER, 1);
|
||||
log_init(argv0, log_level, SYSLOG_FACILITY_USER, 2);
|
||||
|
||||
memset(&args, '\0', sizeof(args));
|
||||
memset(&remote_remote_args, '\0', sizeof(remote_remote_args));
|
||||
|
|
@ -555,7 +555,7 @@ main(int argc, char **argv)
|
|||
argc -= optind;
|
||||
argv += optind;
|
||||
|
||||
log_init(argv0, log_level, SYSLOG_FACILITY_USER, 1);
|
||||
log_init(argv0, log_level, SYSLOG_FACILITY_USER, 2);
|
||||
|
||||
/* Do this last because we want the user to be able to override it */
|
||||
addargs(&args, "-oForwardAgent=no");
|
||||
|
|
@ -619,7 +619,7 @@ main(int argc, char **argv)
|
|||
* Finally check the exit status of the ssh process, if one was forked
|
||||
* and no error has occurred yet
|
||||
*/
|
||||
if (do_cmd_pid != -1 && errs == 0) {
|
||||
if (do_cmd_pid != -1 && (mode == MODE_SFTP || errs == 0)) {
|
||||
if (remin != -1)
|
||||
(void) close(remin);
|
||||
if (remout != -1)
|
||||
|
|
@ -1180,8 +1180,7 @@ tolocal(int argc, char **argv, enum scp_mode_e mode, char *sftp_direct)
|
|||
conn = do_sftp_connect(host, suser, sport,
|
||||
sftp_direct, &remin, &remout, &do_cmd_pid);
|
||||
if (conn == NULL) {
|
||||
error("Couldn't make sftp connection "
|
||||
"to server");
|
||||
error("sftp connection failed");
|
||||
++errs;
|
||||
continue;
|
||||
}
|
||||
|
|
@ -1228,7 +1227,8 @@ prepare_remote_path(struct sftp_conn *conn, const char *path)
|
|||
if (can_expand_path(conn))
|
||||
return do_expand_path(conn, path);
|
||||
/* No protocol extension */
|
||||
error("~user paths are not currently supported");
|
||||
error("server expand-path extension is required "
|
||||
"for ~user paths in SFTP mode");
|
||||
return NULL;
|
||||
}
|
||||
|
||||
|
|
@ -1263,11 +1263,14 @@ source_sftp(int argc, char *src, char *targ, struct sftp_conn *conn)
|
|||
if (local_is_dir(src) && iamrecursive) {
|
||||
if (upload_dir(conn, src, abs_dst, pflag,
|
||||
SFTP_PROGRESS_ONLY, 0, 0, 1) != 0) {
|
||||
fatal("failed to upload directory %s to %s",
|
||||
error("failed to upload directory %s to %s",
|
||||
src, abs_dst);
|
||||
errs = 1;
|
||||
}
|
||||
} else if (do_upload(conn, src, abs_dst, pflag, 0, 0) != 0)
|
||||
fatal("failed to upload file %s to %s", src, abs_dst);
|
||||
} else if (do_upload(conn, src, abs_dst, pflag, 0, 0) != 0) {
|
||||
error("failed to upload file %s to %s", src, abs_dst);
|
||||
errs = 1;
|
||||
}
|
||||
|
||||
free(abs_dst);
|
||||
free(target);
|
||||
|
|
@ -1457,9 +1460,9 @@ sink_sftp(int argc, char *dst, const char *src, struct sftp_conn *conn)
|
|||
debug3_f("copying remote %s to local %s", abs_src, dst);
|
||||
if ((r = remote_glob(conn, abs_src, GLOB_MARK, NULL, &g)) != 0) {
|
||||
if (r == GLOB_NOSPACE)
|
||||
error("Too many glob matches for \"%s\".", abs_src);
|
||||
error("%s: too many glob matches", abs_src);
|
||||
else
|
||||
error("File \"%s\" not found.", abs_src);
|
||||
error("%s: %s", abs_src, strerror(ENOENT));
|
||||
err = -1;
|
||||
goto out;
|
||||
}
|
||||
|
|
@ -1504,9 +1507,8 @@ out:
|
|||
free(abs_src);
|
||||
free(tmp);
|
||||
globfree(&g);
|
||||
if (err == -1) {
|
||||
fatal("Failed to download file '%s'", src);
|
||||
}
|
||||
if (err == -1)
|
||||
errs = 1;
|
||||
}
|
||||
|
||||
|
||||
|
|
@ -1846,7 +1848,7 @@ throughlocal_sftp(struct sftp_conn *from, struct sftp_conn *to,
|
|||
|
||||
targetisdir = remote_is_dir(to, target);
|
||||
if (!targetisdir && targetshouldbedirectory) {
|
||||
error("Destination path \"%s\" is not a directory", target);
|
||||
error("%s: destination is not a directory", target);
|
||||
err = -1;
|
||||
goto out;
|
||||
}
|
||||
|
|
@ -1854,9 +1856,9 @@ throughlocal_sftp(struct sftp_conn *from, struct sftp_conn *to,
|
|||
debug3_f("copying remote %s to remote %s", abs_src, target);
|
||||
if ((r = remote_glob(from, abs_src, GLOB_MARK, NULL, &g)) != 0) {
|
||||
if (r == GLOB_NOSPACE)
|
||||
error("Too many glob matches for \"%s\".", abs_src);
|
||||
error("%s: too many glob matches", abs_src);
|
||||
else
|
||||
error("File \"%s\" not found.", abs_src);
|
||||
error("%s: %s", abs_src, strerror(ENOENT));
|
||||
err = -1;
|
||||
goto out;
|
||||
}
|
||||
|
|
@ -1897,7 +1899,7 @@ out:
|
|||
free(tmp);
|
||||
globfree(&g);
|
||||
if (err == -1)
|
||||
fatal("Failed to download file '%s'", src);
|
||||
errs = 1;
|
||||
}
|
||||
|
||||
int
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
|
||||
/* $OpenBSD: servconf.c,v 1.381 2021/07/02 05:11:21 dtucker Exp $ */
|
||||
/* $OpenBSD: servconf.c,v 1.382 2021/09/06 00:36:01 millert Exp $ */
|
||||
/*
|
||||
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
|
||||
* All rights reserved
|
||||
|
|
@ -462,9 +462,8 @@ typedef enum {
|
|||
sPort, sHostKeyFile, sLoginGraceTime,
|
||||
sPermitRootLogin, sLogFacility, sLogLevel, sLogVerbose,
|
||||
sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup,
|
||||
sKerberosGetAFSToken, sChallengeResponseAuthentication,
|
||||
sPasswordAuthentication, sKbdInteractiveAuthentication,
|
||||
sListenAddress, sAddressFamily,
|
||||
sKerberosGetAFSToken, sPasswordAuthentication,
|
||||
sKbdInteractiveAuthentication, sListenAddress, sAddressFamily,
|
||||
sPrintMotd, sPrintLastLog, sIgnoreRhosts,
|
||||
sX11Forwarding, sX11DisplayOffset, sX11UseLocalhost,
|
||||
sPermitTTY, sStrictModes, sEmptyPasswd, sTCPKeepAlive,
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
/* $OpenBSD: sftp-client.c,v 1.154 2021/08/09 23:47:44 djm Exp $ */
|
||||
/* $OpenBSD: sftp-client.c,v 1.155 2021/09/03 05:12:25 dtucker Exp $ */
|
||||
/*
|
||||
* Copyright (c) 2001-2004 Damien Miller <djm@openbsd.org>
|
||||
*
|
||||
|
|
@ -2014,7 +2014,6 @@ upload_dir_internal(struct sftp_conn *conn, const char *src, const char *dst,
|
|||
if (print_flag && print_flag != SFTP_PROGRESS_ONLY)
|
||||
mprintf("Entering %s\n", src);
|
||||
|
||||
attrib_clear(&a);
|
||||
stat_to_attrib(&sb, &a);
|
||||
a.flags &= ~SSH2_FILEXFER_ATTR_SIZE;
|
||||
a.flags &= ~SSH2_FILEXFER_ATTR_UIDGID;
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
/* $OpenBSD: sftp-realpath.c,v 1.1 2019/07/05 04:55:40 djm Exp $ */
|
||||
/* $OpenBSD: sftp-realpath.c,v 1.2 2021/09/02 21:03:54 deraadt Exp $ */
|
||||
/*
|
||||
* Copyright (c) 2003 Constantin S. Svintsoff <kostik@iclub.nsu.ru>
|
||||
*
|
||||
|
|
@ -28,7 +28,6 @@
|
|||
*/
|
||||
|
||||
#include <sys/types.h>
|
||||
#include <sys/param.h>
|
||||
#include <sys/stat.h>
|
||||
|
||||
#include <errno.h>
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
/* $OpenBSD: sftp.c,v 1.211 2021/08/12 09:59:00 schwarze Exp $ */
|
||||
/* $OpenBSD: sftp.c,v 1.212 2021/09/11 09:05:50 schwarze Exp $ */
|
||||
/*
|
||||
* Copyright (c) 2001-2004 Damien Miller <djm@openbsd.org>
|
||||
*
|
||||
|
|
@ -2172,29 +2172,29 @@ interactive_loop(struct sftp_conn *conn, char *file1, char *file2)
|
|||
interactive = !batchmode && isatty(STDIN_FILENO);
|
||||
err = 0;
|
||||
for (;;) {
|
||||
struct sigaction sa;
|
||||
const char *line;
|
||||
int count = 0;
|
||||
|
||||
interrupted = 0;
|
||||
memset(&sa, 0, sizeof(sa));
|
||||
sa.sa_handler = interactive ? read_interrupt : killchild;
|
||||
if (sigaction(SIGINT, &sa, NULL) == -1) {
|
||||
debug3("sigaction(%s): %s", strsignal(SIGINT),
|
||||
strerror(errno));
|
||||
break;
|
||||
}
|
||||
if (el == NULL) {
|
||||
ssh_signal(SIGINT, SIG_IGN);
|
||||
if (interactive)
|
||||
printf("sftp> ");
|
||||
if (fgets(cmd, sizeof(cmd), infile) == NULL) {
|
||||
if (interactive)
|
||||
printf("\n");
|
||||
if (interrupted)
|
||||
continue;
|
||||
break;
|
||||
}
|
||||
} else {
|
||||
struct sigaction sa;
|
||||
|
||||
interrupted = 0;
|
||||
memset(&sa, 0, sizeof(sa));
|
||||
sa.sa_handler = read_interrupt;
|
||||
if (sigaction(SIGINT, &sa, NULL) == -1) {
|
||||
debug3("sigaction(%s): %s",
|
||||
strsignal(SIGINT), strerror(errno));
|
||||
break;
|
||||
}
|
||||
if ((line = el_gets(el, &count)) == NULL ||
|
||||
count <= 0) {
|
||||
printf("\n");
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
/* $OpenBSD: ssh-keygen.c,v 1.435 2021/08/11 08:54:17 djm Exp $ */
|
||||
/* $OpenBSD: ssh-keygen.c,v 1.437 2021/09/08 03:23:44 djm Exp $ */
|
||||
/*
|
||||
* Author: Tatu Ylonen <ylo@cs.hut.fi>
|
||||
* Copyright (c) 1994 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
|
||||
|
|
@ -2657,7 +2657,8 @@ sig_process_opts(char * const *opts, size_t nopts, uint64_t *verify_timep,
|
|||
time_t now;
|
||||
|
||||
*verify_timep = 0;
|
||||
*print_pubkey = 0;
|
||||
if (print_pubkey != NULL)
|
||||
*print_pubkey = 0;
|
||||
for (i = 0; i < nopts; i++) {
|
||||
if (strncasecmp(opts[i], "verify-time=", 12) == 0) {
|
||||
if (parse_absolute_time(opts[i] + 12,
|
||||
|
|
|
|||
|
|
@ -33,8 +33,8 @@
|
|||
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
||||
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
.\"
|
||||
.\" $OpenBSD: ssh.1,v 1.425 2021/07/28 05:57:42 jmc Exp $
|
||||
.Dd $Mdocdate: July 28 2021 $
|
||||
.\" $OpenBSD: ssh.1,v 1.427 2021/09/10 10:26:02 dtucker Exp $
|
||||
.Dd $Mdocdate: September 10 2021 $
|
||||
.Dt SSH 1
|
||||
.Os
|
||||
.Sh NAME
|
||||
|
|
@ -65,7 +65,7 @@
|
|||
.Op Fl W Ar host : Ns Ar port
|
||||
.Op Fl w Ar local_tun Ns Op : Ns Ar remote_tun
|
||||
.Ar destination
|
||||
.Op Ar command
|
||||
.Op Ar command Op Ar argument ...
|
||||
.Sh DESCRIPTION
|
||||
.Nm
|
||||
(SSH client) is a program for logging into a remote machine and for
|
||||
|
|
@ -94,7 +94,12 @@ their identity to the remote machine using one of several methods
|
|||
If a
|
||||
.Ar command
|
||||
is specified,
|
||||
it is executed on the remote host instead of a login shell.
|
||||
it will be executed on the remote host instead of a login shell.
|
||||
A complete command line may be specified as
|
||||
.Ar command ,
|
||||
or it may have additional arguments.
|
||||
If supplied, the arguments will be appended to the command, separated by
|
||||
spaces, before it is sent to the server to be executed.
|
||||
.Pp
|
||||
The options are as follows:
|
||||
.Pp
|
||||
|
|
@ -288,6 +293,10 @@ authentication.
|
|||
.It Fl i Ar identity_file
|
||||
Selects a file from which the identity (private key) for
|
||||
public key authentication is read.
|
||||
You can also specify a public key file to use the corresponding
|
||||
private key that is loaded in
|
||||
.Xr ssh-agent 1
|
||||
when the private key file is not present locally.
|
||||
The default is
|
||||
.Pa ~/.ssh/id_dsa ,
|
||||
.Pa ~/.ssh/id_ecdsa ,
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
/* $OpenBSD: ssh.c,v 1.566 2021/08/08 08:49:09 dtucker Exp $ */
|
||||
/* $OpenBSD: ssh.c,v 1.569 2021/09/20 04:02:13 dtucker Exp $ */
|
||||
/*
|
||||
* Author: Tatu Ylonen <ylo@cs.hut.fi>
|
||||
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
|
||||
|
|
@ -169,7 +169,7 @@ usage(void)
|
|||
" [-i identity_file] [-J [user@]host[:port]] [-L address]\n"
|
||||
" [-l login_name] [-m mac_spec] [-O ctl_cmd] [-o option] [-p port]\n"
|
||||
" [-Q query_option] [-R address] [-S ctl_path] [-W host:port]\n"
|
||||
" [-w local_tun[:remote_tun]] destination [command]\n"
|
||||
" [-w local_tun[:remote_tun]] destination [command [argument ...]]\n"
|
||||
);
|
||||
exit(255);
|
||||
}
|
||||
|
|
@ -243,6 +243,7 @@ resolve_host(const char *name, int port, int logerr, char *cname, size_t clen)
|
|||
port = default_ssh_port();
|
||||
if (cname != NULL)
|
||||
*cname = '\0';
|
||||
debug3_f("lookup %s:%d", name, port);
|
||||
|
||||
snprintf(strport, sizeof strport, "%d", port);
|
||||
memset(&hints, 0, sizeof(hints));
|
||||
|
|
@ -366,7 +367,7 @@ check_follow_cname(int direct, char **namep, const char *cname)
|
|||
int i;
|
||||
struct allowed_cname *rule;
|
||||
|
||||
if (*cname == '\0' || options.num_permitted_cnames == 0 ||
|
||||
if (*cname == '\0' || !config_has_permitted_cnames(&options) ||
|
||||
strcmp(*namep, cname) == 0)
|
||||
return 0;
|
||||
if (options.canonicalize_hostname == SSH_CANONICALISE_NO)
|
||||
|
|
@ -1165,7 +1166,7 @@ main(int ac, char **av)
|
|||
*/
|
||||
direct = option_clear_or_none(options.proxy_command) &&
|
||||
options.jump_host == NULL;
|
||||
if (addrs == NULL && options.num_permitted_cnames != 0 && (direct ||
|
||||
if (addrs == NULL && config_has_permitted_cnames(&options) && (direct ||
|
||||
options.canonicalize_hostname == SSH_CANONICALISE_ALWAYS)) {
|
||||
if ((addrs = resolve_host(host, options.port,
|
||||
direct, cname, sizeof(cname))) == NULL) {
|
||||
|
|
@ -1771,7 +1772,8 @@ ssh_confirm_remote_forward(struct ssh *ssh, int type, u_int32_t seq, void *ctxt)
|
|||
rfwd->allocated_port = (int)port;
|
||||
logit("Allocated port %u for remote "
|
||||
"forward to %s:%d",
|
||||
rfwd->allocated_port, rfwd->connect_host,
|
||||
rfwd->allocated_port, rfwd->connect_path ?
|
||||
rfwd->connect_path : rfwd->connect_host,
|
||||
rfwd->connect_port);
|
||||
channel_update_permission(ssh,
|
||||
rfwd->handle, rfwd->allocated_port);
|
||||
|
|
|
|||
|
|
@ -33,8 +33,8 @@
|
|||
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
||||
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
.\"
|
||||
.\" $OpenBSD: ssh_config.5,v 1.362 2021/08/12 23:59:25 djm Exp $
|
||||
.Dd $Mdocdate: August 12 2021 $
|
||||
.\" $OpenBSD: ssh_config.5,v 1.366 2021/09/25 09:40:33 kn Exp $
|
||||
.Dd $Mdocdate: September 25 2021 $
|
||||
.Dt SSH_CONFIG 5
|
||||
.Os
|
||||
.Sh NAME
|
||||
|
|
@ -372,6 +372,11 @@ to be canonicalized to names in the
|
|||
or
|
||||
.Qq *.c.example.com
|
||||
domains.
|
||||
.Pp
|
||||
A single argument of
|
||||
.Qq none
|
||||
causes no CNAMEs to be considered for canonicalization.
|
||||
This is the default behaviour.
|
||||
.It Cm CASignatureAlgorithms
|
||||
Specifies which algorithms are allowed for signing of certificates
|
||||
by certificate authorities (CAs).
|
||||
|
|
@ -874,12 +879,11 @@ sk-ssh-ed25519-cert-v01@openssh.com,
|
|||
sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
|
||||
rsa-sha2-512-cert-v01@openssh.com,
|
||||
rsa-sha2-256-cert-v01@openssh.com,
|
||||
ssh-rsa-cert-v01@openssh.com,
|
||||
ssh-ed25519,
|
||||
ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
|
||||
sk-ssh-ed25519@openssh.com,
|
||||
sk-ecdsa-sha2-nistp256@openssh.com,
|
||||
rsa-sha2-512,rsa-sha2-256,ssh-rsa
|
||||
rsa-sha2-512,rsa-sha2-256
|
||||
.Ed
|
||||
.Pp
|
||||
The
|
||||
|
|
@ -921,12 +925,11 @@ sk-ssh-ed25519-cert-v01@openssh.com,
|
|||
sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
|
||||
rsa-sha2-512-cert-v01@openssh.com,
|
||||
rsa-sha2-256-cert-v01@openssh.com,
|
||||
ssh-rsa-cert-v01@openssh.com,
|
||||
ssh-ed25519,
|
||||
ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
|
||||
sk-ecdsa-sha2-nistp256@openssh.com,
|
||||
sk-ssh-ed25519@openssh.com,
|
||||
rsa-sha2-512,rsa-sha2-256,ssh-rsa
|
||||
rsa-sha2-512,rsa-sha2-256
|
||||
.Ed
|
||||
.Pp
|
||||
If hostkeys are known for the destination host then this default is modified
|
||||
|
|
@ -1151,15 +1154,15 @@ Specifies the available KEX (Key Exchange) algorithms.
|
|||
Multiple algorithms must be comma-separated.
|
||||
If the specified list begins with a
|
||||
.Sq +
|
||||
character, then the specified methods will be appended to the default set
|
||||
character, then the specified algorithms will be appended to the default set
|
||||
instead of replacing them.
|
||||
If the specified list begins with a
|
||||
.Sq -
|
||||
character, then the specified methods (including wildcards) will be removed
|
||||
character, then the specified algorithms (including wildcards) will be removed
|
||||
from the default set instead of replacing them.
|
||||
If the specified list begins with a
|
||||
.Sq ^
|
||||
character, then the specified methods will be placed at the head of the
|
||||
character, then the specified algorithms will be placed at the head of the
|
||||
default set.
|
||||
The default is:
|
||||
.Bd -literal -offset indent
|
||||
|
|
@ -1505,12 +1508,11 @@ sk-ssh-ed25519-cert-v01@openssh.com,
|
|||
sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
|
||||
rsa-sha2-512-cert-v01@openssh.com,
|
||||
rsa-sha2-256-cert-v01@openssh.com,
|
||||
ssh-rsa-cert-v01@openssh.com,
|
||||
ssh-ed25519,
|
||||
ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
|
||||
sk-ssh-ed25519@openssh.com,
|
||||
sk-ecdsa-sha2-nistp256@openssh.com,
|
||||
rsa-sha2-512,rsa-sha2-256,ssh-rsa
|
||||
rsa-sha2-512,rsa-sha2-256
|
||||
.Ed
|
||||
.Pp
|
||||
The list of available signature algorithms may also be obtained using
|
||||
|
|
@ -1789,15 +1791,15 @@ This option forces the user to manually
|
|||
add all new hosts.
|
||||
.Pp
|
||||
If this flag is set to
|
||||
.Dq accept-new
|
||||
.Cm accept-new
|
||||
then ssh will automatically add new host keys to the user's
|
||||
.Pa known_hosts
|
||||
file, but will not permit connections to hosts with
|
||||
changed host keys.
|
||||
If this flag is set to
|
||||
.Dq no
|
||||
.Cm no
|
||||
or
|
||||
.Dq off ,
|
||||
.Cm off ,
|
||||
ssh will automatically add new host keys to the user known hosts files
|
||||
and allow connections to hosts with changed hostkeys to proceed,
|
||||
subject to some restrictions.
|
||||
|
|
|
|||
|
|
@ -33,8 +33,8 @@
|
|||
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
||||
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
.\"
|
||||
.\" $OpenBSD: sshd.8,v 1.316 2021/07/30 14:28:13 jmc Exp $
|
||||
.Dd $Mdocdate: July 30 2021 $
|
||||
.\" $OpenBSD: sshd.8,v 1.317 2021/09/10 11:38:38 dtucker Exp $
|
||||
.Dd $Mdocdate: September 10 2021 $
|
||||
.Dt SSHD 8
|
||||
.Os
|
||||
.Sh NAME
|
||||
|
|
@ -276,7 +276,12 @@ things like allocating a pseudo-tty, forwarding X11 connections,
|
|||
forwarding TCP connections, or forwarding the authentication agent
|
||||
connection over the secure channel.
|
||||
.Pp
|
||||
After this, the client either requests a shell or execution of a command.
|
||||
After this, the client either requests an interactive shell or execution
|
||||
or a non-interactive command, which
|
||||
.Nm
|
||||
will execute via the user's shell using its
|
||||
.Fl c
|
||||
option.
|
||||
The sides then enter session mode.
|
||||
In this mode, either side may send
|
||||
data at any time, and such data is forwarded to/from the shell or
|
||||
|
|
|
|||
|
|
@ -33,8 +33,8 @@
|
|||
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
||||
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
.\"
|
||||
.\" $OpenBSD: sshd_config.5,v 1.334 2021/08/12 23:59:25 djm Exp $
|
||||
.Dd $Mdocdate: August 12 2021 $
|
||||
.\" $OpenBSD: sshd_config.5,v 1.335 2021/09/03 05:25:50 dtucker Exp $
|
||||
.Dd $Mdocdate: September 3 2021 $
|
||||
.Dt SSHD_CONFIG 5
|
||||
.Os
|
||||
.Sh NAME
|
||||
|
|
@ -921,15 +921,15 @@ Specifies the available KEX (Key Exchange) algorithms.
|
|||
Multiple algorithms must be comma-separated.
|
||||
Alternately if the specified list begins with a
|
||||
.Sq +
|
||||
character, then the specified methods will be appended to the default set
|
||||
character, then the specified algorithms will be appended to the default set
|
||||
instead of replacing them.
|
||||
If the specified list begins with a
|
||||
.Sq -
|
||||
character, then the specified methods (including wildcards) will be removed
|
||||
character, then the specified algorithms (including wildcards) will be removed
|
||||
from the default set instead of replacing them.
|
||||
If the specified list begins with a
|
||||
.Sq ^
|
||||
character, then the specified methods will be placed at the head of the
|
||||
character, then the specified algorithms will be placed at the head of the
|
||||
default set.
|
||||
The supported algorithms are:
|
||||
.Pp
|
||||
|
|
|
|||
|
|
@ -1,3 +1,3 @@
|
|||
/* $OpenBSD: version.h,v 1.91 2021/08/20 03:22:55 djm Exp $ */
|
||||
/* $OpenBSD: version.h,v 1.92 2021/09/26 14:01:11 djm Exp $ */
|
||||
|
||||
#define SSH_VERSION "OpenSSH_8.7"
|
||||
#define SSH_VERSION "OpenSSH_8.8"
|
||||
|
|
|
|||
Loading…
Reference in New Issue