to debug (on the server) why a login failed with this information.
* If _PASSWORD_CHGNOW is defined (it's -1 in NetBSD), check that pw_change
is not set to that before testing if the password has expired.
Still prevent the login, but log a different failure message in this case.
XXX: we need to decide if we let interactive logins occur in this case,
but force a password change, a la login(1).
- krb4/5 support for privsep (krb5 diff was already applied)
includes fake implementaation of getpeereid() from openssh-portable, which
does nothing useful - need improvement.
so that we can get rid of local changes.
openssh side do not like static functions so put prototypes into each files
rather than making function static.
major behavior changes: (made in openssh master tree - openbsd usr.bin/ssh)
- ssh(1) now defaults to ssh protocol version 2.
if you want version 1 to take precedence, use /etc/ssh.conf to override.
- config change: ~/.ssh/id_rsa[12] is now ~/.ssh/id_rsa (changed 4/3)
- forced client rekey for protocol version 2 (~R)
- swap gid when uid swaps.
- ListenAddress syntax can take [foo]:port for IPv6 numerics.
- "ssh -D 1080" allows us to use ssh tunnel as SOCKS4 proxy.
openssh changes:
- SIGWINCH propagated correctly
- mitigate SSH1 traffic analysis
- sprintf -> snprintf and lots of other cleanups
netbsd local changes:
- include OpenBSD RCSID into binary again, which helps us diagnose later.
with openssh tree to ease future upgrade. re-do local changes, including:
- prototype pedants
- IgnoreRootRhosts
- login.conf user validation
some of the local changes that weren't used are omitted for now. we may
need to revisit those afterwards.
it adds "sftp".
