25e766824a
OpenSSL 0.9.6e. includes major security fixes (already applied)
2002-07-30 23:57:34 +00:00
e9316c8858
apply patch supplied with OpenSSL Security Advisory [30 July 2002]
...
advisory 1: four potentially remotely-exploitable vulnerability in
SSL2/SSL3 code
advisory 2: ASN1 parser vulnerability (all SSL/TLS apps affected)
2002-07-30 12:55:08 +00:00
3fd219f644
add utmpx support.
2002-07-28 23:43:33 +00:00
6742cb1812
sweep of errx/warnx, remove unnecessary trailing \n
2002-07-20 08:36:17 +00:00
24ef72afbf
print connect failure on debugging mode. sync w/openbsd
2002-07-12 13:28:36 +00:00
4b20971f01
Spell acquire with a 'c'.
2002-07-10 23:16:32 +00:00
bdfa549223
bark if all connection attemp fails. sync w/openbsd
2002-07-10 10:28:00 +00:00
92b7524e7d
silently connect(2) to next address. sync w/openbsd
2002-07-09 12:04:10 +00:00
a2a47b15ce
don't warn even if reverse lookup fails. sync w/openbsd
2002-07-09 12:03:54 +00:00
9a2478a3b0
/var/empty -> /var/chroot/sshd. PR 17519
2002-07-08 14:39:53 +00:00
968294e218
>make ssh-keysign read /etc/ssh/ssh_config
...
>and exit if HostbasedAuthentication is disabled globally. based on discussions
>with deraadt, itojun and sommerfeld; ok itojun@
sync w/openbsd
2002-07-03 14:23:13 +00:00
92ea28e291
>for compression=yes, we fallback to no-compression if the server does
...
>not support compression, vice versa for compression=no. ok mouring@
sync w/openbsd
2002-07-03 10:07:48 +00:00
673c1a7ac1
>use RSA_blinding_on() for rsa hostkeys (suggested by Bill Sommerfeld)
...
>in order to avoid a possible Kocher timing attack pointed out by Charles
>Hannum; ok provos@
2002-07-03 10:06:39 +00:00
c28e7ac1f6
correct signed/unsigned mixup; openbsd
2002-07-03 10:05:58 +00:00
8d3378688a
pednatic check on command line args. correct signed/unsigned mixup.
...
sync w/ openbsd
2002-07-01 06:17:11 +00:00
84559971ee
make use of xfree() consistent. from openbsd
2002-07-01 05:56:45 +00:00
11792b93b1
don't use freed memory. sync w/openbsd
2002-07-01 05:54:03 +00:00
5bdd56b128
sync with 3.4
2002-06-26 14:08:29 +00:00
b8f8e01057
OpenSSH 3.4 around 2002/6/26.
...
most significant change:
>make sure # of response matches # of queries, fixes int overflow; from ISS
as we have already enabled privsep by default, we should have been safe.
2002-06-26 14:02:54 +00:00
603dca2ed2
sync whitespace w/ openbsd tree
2002-06-24 15:47:25 +00:00
bc7b65a647
don't lose information while we cast
2002-06-24 15:46:34 +00:00
7d6a7caf6a
Cast arguments so that this file will compile on less forgiving architectures
...
like arm32.
2002-06-24 15:32:58 +00:00
3ea946f134
sync with openssh 3.3.
...
local mods included to make it compile with openssl 0.9.6d.
2002-06-24 05:48:24 +00:00
3dfc6702ef
clean ssh-keysign build dir before import.
2002-06-24 05:45:17 +00:00
9486e6fd01
it shouldn't be imported
2002-06-24 05:28:32 +00:00
b5222aff66
OpenSSH 3.3 as of June 24, 2002.
...
- ssh is no longer seruid root. ssh-keyscan is added to read secret host keys.
protocol version 1 rsh-like authentication is gone.
- FallBackToRsh is deprecated.
2002-06-24 05:25:39 +00:00
c650ef5756
Remove (commented out) krb_equiv(3) reference, suggested by joda.
2002-06-13 11:19:48 +00:00
d844f0d7b1
Fix Xrefs.
2002-06-13 00:15:09 +00:00
78c59017cc
Remove photurisd reference.
2002-06-13 00:14:26 +00:00
8def406232
Comment out Xref to krb_equiv(3), which does not exist.
2002-06-13 00:09:06 +00:00
b745604c00
sync sockaddr_ntop with latest openssh (minor change)
2002-06-09 22:22:55 +00:00
7c75b5ec2f
sync with 0.9.6d. shlib minor for libssl and libcrypto
...
is cranked for additional functions.
2002-06-09 16:12:52 +00:00
7720435b28
openssl 0.9.6d
2002-06-09 15:21:32 +00:00
f0231f96aa
do not propose IDEA cipher on SSL connection, as our default installation
...
does not handle IDEA.
TODO: dynamically enable IDEA if libcrypto_idea is linked
2002-06-09 02:16:18 +00:00
be5f1d082c
use getnameinfo on diag printing. sync w/openssh in openbsd
2002-06-08 21:17:57 +00:00
e67961b545
check sshd uid/chroot dir on UsePrivilegeSeparation mode, and die if they
...
do not exist. sync w/openssh
2002-05-29 23:54:29 +00:00
a5c3041a1b
bump date for rhosts auth fix
2002-05-27 13:45:40 +00:00
b274d69ad0
correct rhosts authentication. should fix PR 17023
2002-05-27 13:45:17 +00:00
a46557038c
now arc4random is in libc, we don't need to supply local version
2002-05-25 00:29:52 +00:00
a0da78395e
correct sha2 interoperability. From: "JuanJo Ciarlante" <jjo@mendoza.gov.ar>
2002-05-20 13:12:45 +00:00
e26b1052bb
use /var/chroot/sshd instead of /var/empty. suggested by christos
2002-05-16 20:59:35 +00:00
f47caddaf3
turn on privilege separation, as 3.2.1 default do.
...
requires sshd uid/gid as well as /var/empty directory.
2002-05-14 23:33:07 +00:00
ca89359407
sync with 3.2.1 as of 5/13.
...
NOTE: privilege separation is turned off by default
as it seems there still are issues with setsid().
2002-05-13 02:58:17 +00:00
24255a6a60
OpenSSH 3.2.1 as of 2002/5/13
2002-05-13 02:28:40 +00:00
c68a2428ba
correct handling of "unique" policy. bump version to 20020507
...
(corresponds to filename in ftp://ftp.kame.net/pub/kame).
2002-05-13 02:10:34 +00:00
c0fa39f338
correct plogv().
2002-05-07 08:58:32 +00:00
244b762de1
Complete the conversion back to the OpenSSH default configuration files of
...
"/etc/ssh/ssh_config" (from "/etc/ssh/ssh.conf") for ssh(1) and other
userland tools, and "/etc/ssh/sshd_config (from "/etc/ssh/sshd.conf")
for sshd(8).
etc/postinstall will detect this, and if "fix" is given, rename the files.
2002-04-29 08:23:34 +00:00
812e154ef2
netbsd uses EXIT STATUS, not RETURN VALUES, for commands
2002-04-26 02:48:54 +00:00
77e1048dc4
Whitespace fixes, use standard headers, RCS police.
2002-04-26 02:33:00 +00:00
8366b5d7de
Sort sections and SEE ALSO, add NetBSD tag.
2002-04-26 02:31:10 +00:00
cd1e16de59
upgrade to KAME racoon as of 2002/4/26.
...
file descriptor leak fix.
null encryption algorithm key length fix (should use 0).
couple of null-pointer reference fixes.
set port # to 500 in ID payload (possible interop issue - spec is unclear).
correctly match address pair on informational exchange
2002-04-26 02:25:13 +00:00
b4df5a033c
KAME racoon as of 2002/4/26
2002-04-26 02:16:38 +00:00
936168b29d
correct afs/kerberos token-passing. notified by markus@openbsd
2002-04-24 01:48:04 +00:00
34b40b030e
sync with openssh 3.2 as of 2002/4/22.
...
- privilege separation
- afs/kerberos auth security issue fixed
2002-04-22 07:59:35 +00:00
ff10d69ea5
OpenSSH 3.2 as of 2002/4/22. bring in sys/sys/tree.h
2002-04-22 07:47:47 +00:00
f597d4ec88
OpenSSH 3.2 as of 2002/4/22. fixes issues with AFS/kerberos auth
2002-04-22 07:35:39 +00:00
f7136b499f
Remove .cvsignore files.
...
<URL:http://www.netbsd.org/developers/cvs-repos/notes.html#cvsignore >
2002-04-04 17:07:06 +00:00
abe35ee7d1
correct initial contact payload handling. PR 15949. sync with kame
2002-03-29 01:18:08 +00:00
16bd2c3983
handle RTM_NEWADDR correctly. PR 15693. sync w/kame
2002-03-22 03:58:43 +00:00
1c9c09e3be
Simple file static function had wrong function definition :
...
-find_etype(hdb_entry *princ, unsigned *etypes, unsigned len,
+find_etype(hdb_entry *princ, krb5_enctype *etypes, unsigned len,
In the Acorn32 port an enum doesn't have to be unsigned (!) int's ... but
can also be a byte/char sized var.
2002-03-21 21:02:16 +00:00
24460e83d2
Actually use the 8003 patch joda applied upstream, rather than the one I sent
...
him (oops).
2002-03-18 19:16:04 +00:00
4284d720b1
CKSUMTYPE needs to include 0x8003, since some things use that.
...
Approved by joda and committed upstream.
2002-03-18 19:07:49 +00:00
0a2445c3b6
move sshd config files to /etc/ssh
2002-03-11 04:57:55 +00:00
68c304f103
Fix several LL128 format string mismatches with a chainsaw.
...
%llu is "unsigned long long", not "uint64_t"; the former can be 128
bits on LP64 systems.
2002-03-09 15:03:33 +00:00
9d597e40f3
printf type mismatch.
2002-03-08 06:03:21 +00:00
295a85a1c9
sync better with reality (LoginGraceTime)
2002-03-08 02:18:11 +00:00
af34a358ff
sync w/ 3.1 as of 2002/3/8. configuration file directory is still /etc
...
(openbsd usr.bin/ssh is using /etc/ssh)
2002-03-08 02:00:50 +00:00
797a097779
OpenSSH 3.1 as of 2002/3/8. plugs off-by-one security hole
2002-03-08 01:20:24 +00:00
9097d36b33
Fix off by one error described in "PINE-CERT-20020301" advisory.
2002-03-07 16:02:22 +00:00
a50cd7c5cd
Add SYNOPSIS.
2002-03-06 14:25:42 +00:00
e4446468a6
s/IPSec/IPsec/.
2002-03-06 00:21:36 +00:00
a8d19a98fc
don't try to use the krb5 context if the init fails; should fix
...
bin/15585
2002-02-26 11:16:08 +00:00
4845a9458f
Rather than assuming that -1 is a valid value for a LogLevel or LogFacility,
...
explicitly declare SYSLOG_LEVEL_NOT_SET and SYSLOG_FACILITY_NOT_SET and use
those instead.
This is necessary for -fshort-enums platforms, and corresponds to the
following OpenBSD revisions:
log.c 1.21
log.h 1.5
readconf.c 1.95
servconf.c 1.53
2002-02-10 16:23:33 +00:00
57a0815fae
Clean up the distinction between krb5_enctype and int, and between
...
krb5_key_usage and unsigned. These patches are necessary for
platforms with short enums, and should already be in Heimdal CVS.
2002-02-10 15:31:18 +00:00
8dd8e58e76
import heimdal rev 1.42: we have to create our own param struct before
...
marshaling (fixes bin/15520)
2002-02-08 18:35:30 +00:00
f6d51843ea
Mirror 32-bit alignment change in crypto/dist/heimdal/lib/roken/resolve.c.
2002-01-08 03:27:59 +00:00
5f9568a12e
Make sure the state array passed to initstate(3) is 32-bit aligned,
...
as that is how it is accessed within the random(3) suite of routines.
2002-01-08 02:15:24 +00:00
19a95cad9c
Fix warnings generated by gcc 3.1.
2001-12-31 20:09:53 +00:00
ad08960f5c
When calling krb5_verify_user(), we must restore root's uid, since it will need to read /etc/krb5.keytab.
2001-12-19 10:28:47 +00:00
a18ce029f6
Deal with lossage caused by the addition of the netbsd-1-5 branch tag
...
to these files.
Apparently, the "magic" which causes the latest version on the
vendor branch to appear at the head in the repository broke when
the netbsd-1-5 tag was added. Thus, merge in the lost revisions from
the vendor tag to work around this.
2001-12-13 15:53:54 +00:00
e2970b134f
sync with openbsd/remove variable name from prototype
2001-12-12 17:24:46 +00:00
684138909c
fix constness difference in prototype and func def.
2001-12-12 17:16:16 +00:00
718900f830
sync with 3.0.2
2001-12-06 03:54:04 +00:00
d97f5d9481
OpenSSH 3.0.2 as of 2001/12/06. fixes environment variable passing in UseLogin=yes
2001-12-06 03:46:04 +00:00
b4371d47f5
Replace some misuses of "then" with "than".
2001-12-04 17:56:30 +00:00
cce3152281
Deal with an LP64 printf format issue.
2001-11-30 00:46:36 +00:00
d4b3b8bf82
update version date to 20011127
2001-11-27 04:16:08 +00:00
f7146cb367
resolve one more conflict
2001-11-27 04:11:23 +00:00
ce0e2b2976
resolve conflicts on 3.0.1 import
2001-11-27 04:10:22 +00:00
c0c77d470a
OpenSSH 3.0.1 as of 2001/11/27. minor bugfixes only.
2001-11-27 04:03:44 +00:00
8c1a59d37e
Drop .Os argument, and sort sections.
2001-11-23 08:20:48 +00:00
1ea6bbe92f
- include LIBRARY section
...
- reference the correct location of the header file
- remove irrelevant BUGS section
- spelling fixes
Note: this man page only documents the Kerberos 4 interface; the
krb5 interface remains undocumented.
2001-11-23 07:35:19 +00:00
1510317819
Spelling fix.
2001-11-21 20:30:09 +00:00
1fd7eeefcd
"than" instead of "then".
2001-11-21 19:14:19 +00:00
a984ffbe34
less than, not then, and re-established, not re-estabished
2001-11-21 19:11:44 +00:00
1f1e26bd6d
Presence looks better with a 'c' instead of an 's'.
2001-11-21 19:01:31 +00:00
78ade3c6d9
Use standard headers, and a whitespace nit.
2001-11-21 10:46:23 +00:00
04a019cf46
Use standard headers.
2001-11-21 10:45:02 +00:00
6beeed91dd
Fix pasto.
2001-11-21 06:11:35 +00:00
13b12e76bb
Add documentation.
2001-11-21 05:39:49 +00:00
4b5703f57d
Include the full path to the other header files so they get found.
2001-11-21 05:38:40 +00:00
289e069e67
Clean up terminology and clarify a few things. Add a simple example.
2001-11-21 05:36:33 +00:00
6ececc36b4
openssh 3.0 krb5 auth problem has been plugged,
...
sync up version number to 3.0.1 so that we can identify it.
2001-11-19 07:39:57 +00:00
1eb2191d4f
fix auth_krb5() error case behavior. found by jhawk, sync with openbsd tree
2001-11-12 05:45:29 +00:00
0b47c7a3f0
Improve markup in two places, and fix a typo.
2001-11-10 08:16:45 +00:00
54c913f1cb
Add compile_et(1).
2001-11-10 07:50:16 +00:00
73322f1e45
Drop an unnecessary empty line.
2001-11-08 20:40:44 +00:00
7be1bf7993
Drop 'HEIMDAL' from Os, fix punctuation in one place, and sort SEE ALSO.
2001-11-08 20:21:07 +00:00
440da35ad1
Sort SEE ALSO.
2001-11-08 20:20:29 +00:00
c214b605c7
Fix Dd, and two punctuation nits.
2001-11-08 20:20:01 +00:00
e704cca5ec
Drop unnecessary empty lines.
2001-11-08 20:18:57 +00:00
43ac9b6569
Fix Xrefs.
2001-11-08 20:18:10 +00:00
f7b5c3a4df
Uppercase Dt argument.
2001-11-08 20:17:09 +00:00
f243ad4c28
Customise documentation for NetBSD:
...
- introduce krb5.3 as an entry-point to libkrb5 documentation
- add LIBRARY sections
- reference the real headers in <krb5/krb5.h>
2001-11-08 19:47:37 +00:00
29574d25c5
sync with 3.0 as of 2001/11/7.
2001-11-07 06:26:47 +00:00
29c34cbb94
OpenSSH 3.0 as of 2001/11/7
2001-11-07 06:20:12 +00:00
9de5bfcf8f
Turn on TCP_NODELAY over loopback
2001-10-18 19:46:12 +00:00
880aff49c4
buffix from openbsd tree: users config should overwrite system config.
2001-10-02 00:39:14 +00:00
ba613513e8
sync with openssh 2.9.9 around 9/27.
2001-09-27 03:24:01 +00:00
bcdc367f57
OpenSSH 2.9.9 as of 2001/9/27
2001-09-27 02:00:33 +00:00
00489c2412
apply the following advisory. 2.9.9 will be imported soon.
...
Subject: OpenSSH Security Advisory (adv.option)
From: Markus Friedl <markus@openbsd.org>
Message-ID: <20010926231823.A15229@folly>
2001-09-27 00:12:42 +00:00
4c99916337
va_{start,end} audit:
...
Make sure that each va_start has one and only one matching va_end,
especially in error cases.
If the va_list is used multiple times, do multiple va_starts/va_ends.
If a function gets va_list as argument, don't let it use va_end (since
it's the callers responsibility).
Improved by comments from enami and christos -- thanks!
Heimdal/krb4/KAME changes already fed back, rest to follow.
Inspired by, but not not based on, OpenBSD.
2001-09-24 13:22:25 +00:00
f6f3964e5e
Remove formatted man pages. Ok'd by joda.
2001-09-24 12:37:41 +00:00
7b980ee03e
remove files that were not part of last import
2001-09-23 05:03:52 +00:00
ea130a2327
removed not-used files
...
noticed by Bernd Ernesti <netbsd@veego.de>
2001-09-21 14:40:30 +00:00
123c0ecfea
Printf formats on LP64.
2001-09-18 03:11:22 +00:00
c6cbe4853a
fix merge-o's
2001-09-17 15:06:48 +00:00
5b9616a3e3
merge heimdal 0.4e
2001-09-17 12:32:33 +00:00
e4d8a8f3dd
import of heimdal 0.4e
2001-09-17 12:24:30 +00:00
d318b56bd0
merge krb4-1.1
2001-09-17 12:21:41 +00:00
1877630d24
import krb4-1.1
2001-09-17 12:09:38 +00:00
d814de63b5
For consistency, make permit_root_login default to PERMIT_NO if not specified
...
in the config file. Thanks to itojun for pointing this out.
2001-09-03 04:23:10 +00:00
8d327e93bf
Include <string.h> for memcpy() prototype.
2001-09-02 08:45:22 +00:00
ee42f09d5b
upgrade to KAME 2001/8/31.
2001-08-31 10:36:08 +00:00
9e9f5f3086
KAME as of 2001/8/31
2001-08-31 09:59:03 +00:00
da09d12c1e
Document that PermitRootLogin's default is now "no".
2001-08-31 09:00:29 +00:00
894936aa50
Do not permit direct root logins. This makes ssh consistent with
...
NetBSD's default security policy in this area: if you are not on
a secure terminal, you must be able to authenticate as a user in
the "wheel" group before you may attempt to authenticate as root
using the root password.
2001-08-31 08:16:24 +00:00
e99543f805
validate certs correctly. sync with kame
2001-08-06 08:17:40 +00:00
0f6cbd66d3
need string.h for alpha. from chuck
2001-08-06 05:48:50 +00:00
d4d587fb31
(should) fix build on alpha. From: Chuck Silvers <chuq@chuq.com>
2001-08-05 18:52:13 +00:00
7c0934f7f5
While writing sushi's support for sshd.conf, I found out that the manpage
...
lies wrt to MaxStartups. Make the manpage match the code.
2001-08-03 02:29:07 +00:00
5abda287b4
Get rid of "Os KAME".
2001-08-02 12:19:45 +00:00
366bd307b0
sync with 2001/8/2 KAME racoon/libipsec.
2001-08-02 12:15:00 +00:00
7295c743a4
bring in latest racoon/libipsec from KAME. lots of lots of stability fixes.
2001-08-02 12:06:08 +00:00
3f1d5c2789
sshd is now able to log in an user if the filesystem is readonly and the tty
...
owned by root. Note that the tty still must be mode 620, and sshd does not
check which group owns the tty (more problems here?).
This closes NetBSD PR bin/13499
The fix has been commited to OpenSSH CVS. See OpenBSD's PR user/1946.
2001-07-27 23:34:27 +00:00
76371341d1
remove a (potentially) double free
2001-07-18 21:54:56 +00:00
7fc834dc03
upgrade to 0.9.6b. no shlib major/minor bump is necessary.
2001-07-11 06:50:53 +00:00
0eb42056bd
OpenSSL 0.9.6b
2001-07-11 03:54:20 +00:00
a549080f85
OpenSSL 0.9.6b
2001-07-11 03:53:32 +00:00
c1f85780da
Remove another one, noted by Love <lha@stacken.kth.se>, confirmed by thorpej.
2001-07-10 21:52:46 +00:00
itojun