summaryrefslogtreecommitdiffstats
path: root/security/openssh/files
Commit message (Collapse)AuthorAgeFilesLines
* Update to openssh-3.0.1 and openssh-portable-3.0.1p1dinoex2001-11-182-21/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - now in protocol2: Background ssh at logout when waiting for forwarded connection / X11 sessions to terminate disabled -DSKEY from Changelog (not complete): 20011115 - (djm) Fix IPv4 default in ssh-keyscan. Spotted by Dan Astoorian <djast@cs.toronto.edu> Fix from markus@ - (djm) Release 3.0.1p1 20011113 - (djm) Fix early (and double) free of remote user when using Kerberos. Patch from Simon Wilkinson <simon@sxw.org.uk> - (djm) AIX login{success,failed} changes. Move loginsuccess call to do_authenticated. Call loginfailed for protocol 2 failures > MAX like we do for protocol 1. Reports from Ralf Wenk <wera0003@fh-karlsruhe.de>, K.Wolkersdorfer@fz-juelich.de and others - (djm) OpenBSD CVS Sync - dugsong@cvs.openbsd.org 2001/11/11 18:47:10 [auth-krb5.c] fix krb5 authorization check. found by <jhawk@MIT.EDU>. from art@, deraadt@ ok - markus@cvs.openbsd.org 2001/11/12 11:17:07 [servconf.c] enable authorized_keys2 again. tested by fries@ 20011112 - OpenBSD CVS Sync - markus@cvs.openbsd.org 2001/10/24 08:41:41 [sshd.c] mention remote port in debug message - markus@cvs.openbsd.org 2001/10/24 08:51:35 [clientloop.c ssh.c] ignore SIGPIPE early, makes ssh work if agent dies, netbsd-pr via itojun@ - markus@cvs.openbsd.org 2001/10/24 19:57:40 [clientloop.c] make ~& (backgrounding) work again for proto v1; add support ~& for v2, too - markus@cvs.openbsd.org 2001/10/25 21:14:32 [ssh-keygen.1 ssh-keygen.c] better docu for fingerprinting, ok deraadt@ - markus@cvs.openbsd.org 2001/10/29 19:27:15 [sshconnect2.c] hostbased: check for client hostkey before building chost - markus@cvs.openbsd.org 2001/11/07 16:03:17 [packet.c packet.h sshconnect2.c] pad using the padding field from the ssh2 packet instead of sending extra ignore messages. tested against several other ssh servers. - markus@cvs.openbsd.org 2001/11/07 21:40:21 [ssh-rsa.c] ssh_rsa_sign/verify: SSH_BUG_SIGBLOB not supported - markus@cvs.openbsd.org 2001/11/07 22:10:28 [ssh-dss.c ssh-rsa.c] missing free and sync dss/rsa code. - markus@cvs.openbsd.org 2001/11/07 22:53:21 [channels.h] crank c->path to 256 so they can hold a full hostname; dwd@bell-labs.com - markus@cvs.openbsd.org 2001/11/08 10:51:08 [readpass.c] don't strdup too much data; from gotoh@taiyo.co.jp; ok millert. - markus@cvs.openbsd.org 2001/11/10 13:22:42 [ssh-rsa.c] KNF (unexpand) - markus@cvs.openbsd.org 2001/11/11 13:02:31 [servconf.c] make AuthorizedKeysFile2 fallback to AuthorizedKeysFile if AuthorizedKeysFile is specified. 20011109 - (stevesk) auth-pam.c: use do_pam_authenticate(PAM_DISALLOW_NULL_AUTHTOK) if permit_empty_passwd == 0 so null password check cannot be bypassed. jayaraj@amritapuri.com OpenBSD bug 2168
* cvs rm'ing patch-coredump, as the current versions are safe.dinoex2001-10-251-11/+0
| | | | It does no harm, so a second bump of PORTVERSION is not needed.
* - included an patch that solves a coredump in sshddinoex2001-10-241-0/+11
| | | | | | - Bumped PORTREVISION Submitted by: ryanb@goddamnbastard.org
* - Update to OpenSSH 2.9.9dinoex2001-10-0312-270/+99
| | | | | | - convert portname into lowercase - PREFIX support for default sshd_config - security-patch for cookie files obsolete
* - Extend patches in submakefiles, to build under 3.5 STABLEdinoex2001-07-223-9/+25
| | | | | PR: 28921 Submitted by: aito@sets.ne.jp
* This adds two environment variables into environment of user: LANG & MM_CHARSET,dinoex2001-06-251-3/+41
| | | | | | | | | | | | when used standard login via telnet or console However when used openssh, then sshd does not setup LANG & MM_CHARSET into envir onment for user in russian class Code for this operation did not exists in openssh port ! PR: 21146 Submitted by: odip@bionet.nsc.ru
* - Fix FreeBSD specific patch, exit now if change of password fails.dinoex2001-06-101-3/+5
| | | | | | Forwarded by dwcjr Submitted by: Udo.Schweigert@cert.siemens.de
* - Switch to the user's uid before attempting to unlink the auth forwardingdinoex2001-06-091-0/+193
| | | | | | | file, nullifying the effects of a race. - Bump PORTREVISION Submitted by: green@FreeBSD.org
* - Update from OpenSSH 2.2.0 to OpenSSH 2.9dinoex2001-06-0823-907/+176
| | | | | | | | | | | - Features: Possible use of sftp/sftp-server with older FreeBSD releases. Use a newer version independently from the Base system. Easier to test and fix possible security bugs. - Bugs: build of pam_ssm.so isn't be supported any more Any file named "cookie" can be deleted by this and any older "sshd" with X11 Forwarding.
* Add patch to prevent Bleichenbacher attack on SSH1 server. Bumpkris2001-02-121-0/+189
| | | | PORTREVISION.
* Add patch to deal with possible remote root exploit found bykris2001-02-094-20/+25
| | | | | | | Michal Zalewski of the Bindview RAZOR Team, and some patches to hopefully deal with compilation on older versions of FreeBSD. Submitted by: alfred
* Add the security fix for inability to actually deny ssh-agent or X11green2000-11-141-0/+50
| | | | forwarding requests.
* Update to OpenSSH 2.2.0. This is an end-of-life update for thegreen2000-11-0414-491/+107
| | | | | | ports-based OpenSSH. OpenSSH has been in the base system for more than long enough to justify not having to maintain two separate FreeBSD versions of OpenSSH.
* Fix Kerberos 4 support.green2000-07-302-6/+24
| | | | Mostly submitted by: Mark A Gebert <geeb@thugsrus.org>
* Update to OpenSSH 2.1.1 and fix SSHv2 serving (passwd botch).green2000-06-274-41/+51
|
* Fix this for OpenSSL versions <= 0.9.4. It seems that the OpenSSH peoplegreen2000-05-201-1/+10
| | | | | | | think that it's good to immediately switch to the newest API, despite the old API call being left deliberately compatible so that that wouldn't have to happen. OpenSSL_add_all_algorithms() is now, again, SSLeay_add_all_algorithms.
* Using login and executing a specific "command" are mutually exclusive,green2000-05-131-13/+66
| | | | | | so turn off use_login if there's a command. Submitted by: Vadim Vygonets <vadik@cs.huji.ac.il>
* Fix a mistake with pwcopy-related patches.green2000-05-133-15/+29
|
* Update to OpenSSH 2.1.0. They _FINALLY_ have distfiles, so now the CVS isgreen2000-05-138-56/+93
| | | | | | | | | not needed for the port. Big thanks to Issei-san for doing the majority of the work necessary for this upgrade! Submitted by: Issei Suzuki <issei@jp.FreeBSD.org>
* Upgrade to version 1.2.3 with a CVS of a few hours ago. New stuff ingreen2000-04-206-377/+298
| | | | | this release is mostly the support for lots of ssh2. Note that SSH2 is not fully supported here yet, but it's mostly there; see README.openssh2.
* update compatible libraries to -current.sumikawa2000-04-176-228/+188
|
* Fix socklen_t for FreeBSD 3.fenner2000-03-201-1/+1
| | | | PR: ports/17491
* Update this to a CVS_DATE of a few minutes ago.green2000-03-032-18/+0
|
* Woops fix my previous incorrect patch.shin2000-02-271-7/+7
| | | | | | | | | For green's honor, the patch I sent him for review was correct. But because it is one line fix, I hand merged it into my cvs committing environment, and then mistake happend. This time, I applied correct fix which should have been aplied at last commit.
* Fix a coredump-y bug that crept in recently.green2000-02-251-2/+2
|
* Change install -C usage to install -c usage, fixing the install for oldergreen2000-02-231-4/+11
| | | | | | install(1)s. Submitted by: Jim Archuleta <JimArchuleta@usa.net>
* Use 'IPv4or6' instead of AF_UNSPEC for 1st getaddrinfo() ai_family.shin2000-02-191-3/+12
| | | | | | | Without this fix, still query to AAAA recored happens even if -4 options is specified. Reviewed by: green
* When IPv4-only client connected to a server which have IPv4 and IPv6sumikawa2000-02-151-3/+12
| | | | | addresses, the client couldn't connect to the server via IPv4 because the client gave up on first rresevport_af().
* Clean things up by using the new knob for OpenSSL usage.green2000-02-121-3/+3
| | | | Submitted by: kris
* Simplify IPv6 checking.sumikawa2000-02-091-7/+4
| | | | Suggested by: green
* - remove me from another MAINTAINERsumikawa2000-01-181-3/+3
| | | | | | | | - add 'ipv6' on CATEGORIES - use ${OSVERSION} instead of ${USE_INET6} for checking getaddrinfo() existence. - fix broken ${ECHO_MSG} - avoid duplicate copying rcmd.c
* Add the actual change of names in sockaddr_storage. This broke thingsgreen2000-01-141-8/+5
| | | | | | for people after what time my system was previously made. Sorry. Submitted by: sumikawa
* Update to a more current OpenSSH, including...green2000-01-1312-52/+3684
| | | | | | | | IPv6 support!! Thank you very much, Sumikawa san. Submitted by: Munechika SUMIKAWA <sumikawa@ebina.hitachi.co.jp>
* Upgrade to the pam_ssh module, version 1.1..green1999-12-281-12/+173
| | | | | | | | | | (From the author:) Primarily, I have added built-in functions for manipulating the environment, so putenv() is no longer used. XDM and its variants should now work without modification. Note that the new code uses the macros in <sys/queue.h>. Submitted by: Andrew J. Korty <ajk@iu.edu>
* Update to today's OpenSSH.green1999-12-231-0/+14
| | | | | | | | | The version is now 1.2.1, from 1.2. You can mv your old distfiles/OpenSSH-1.2 dir to distfiles/OpenSSH-1.2.1, if you want to not waste time/space. Some minor nits have been fixed, and a couple bugs. One sizeof(len) should have just been len, and, in markus's words, "fix get_remote_port() and friends for sshd -i".
* I've cleaned up ${CVS_DATE} usage a bit (keep spaces correctly), andgreen1999-12-083-32/+33
| | | | | | | | | | updated to today's snapshot of OpenSSH. Various updates from the latest ${CVS_DATE}, and requisite patch changes, are the "big new thing". Nothing major has changed; the biggest ones would be using atomicio() in a lot of places and a fix for a SIGHUP not updating sshd(8)'s configuration until the next connection.
* In the meantime (while things are being worked and decided on on thegreen1999-12-064-20/+326
| | | | | | | | | | | | | | | OpenBSD OpenSSH front), add ConnectionsPerPeriod to prevent DoS via running the system out of resources. In reality, this wouldn't be a full DoS, but would make a system slower, but this is a better thing to do than let the system get loaded down. So here we are, rate-limiting. The default settings are now: Five connections are allowed to authenticate (and not be rejected) in a period of ten seconds. One minute is given for login grace time. More work in this area is being done by alfred@FreeBSD.org and markus@OpenBSD.org, at the very least. This is, essentially, a stopgap solution; however, it is a properly implemented and documented one, and has an easily modifiable framework.
* Reduce LoginGraceTime from 10 minutes (!!!) to 30 seconds. More togreen1999-12-041-2/+3
| | | | come, soon.
* Add the PAM SSH RSA key authentication module. For example, you can add,green1999-11-294-4/+353
| | | | | | | | | "login auth sufficient pam_ssh.so" to your /etc/pam.conf, and users with a ~/.ssh/identity can login(1) with their SSH key :) PR: 15158 Submitted by: Andrew J. Korty <ajk@waterspout.com> Reviewed by: obrien
* Update to a current CVS_DATE. The only real change I see is the (big)green1999-11-282-83/+85
| | | | | | | change of KNFization being finalized :) Patches had to be modified, but should look "better" according to style(9), now.
* Change CFLAGS to get modified in Makefile.inc, fixing thegreen1999-11-281-3/+6
| | | | | | problem several people have reported with make.conf setting ${CFLAGS}. Partially submitted by: Jos Backus <Jos.Backus@nl.origin-it.com>
* Also, set SSH_PROGRAM correctly.green1999-11-241-1/+1
|
* Update the CVS_DATE. This brings in support for TIS authentication,green1999-11-2419-244/+524
| | | | | | | | | | | | | | | | | | obsoleting a couple patches (it's the same code, though, except for additions). This also brings in KNFization of everything (please hold the cheering down :) and made me reroll all my patches. My patches have been almost entirely rewritten. The places are the same, but the code's rewritten. It fits with the style (KNF) now, and looks better. I've also added strlcat.c to the build, which, just like strlcpy.c, is necessary for compatibility with older libcs. After strlcat() snuck into the OpenSSH code recently, this would prevent OpenSSH from building on (e.g.) FreeBSD 3.2. Adding it to ssh/lib/ makes it work yet again :)
* Update to the latest CVS_DATE, obsoleting patches patch-a[yz].green1999-11-211-8/+0
| | | | | | | | | | | | | Add "ignorelogin" login.conf functionality to sshd. The biggest change: new port functionality. Making "fetchsrctarball" will soon work for those of you who cannot use CVS to get OpenSSH. Mark Murray, the savior he is :), will use "make makesrctarball" and put the snapshots of OpenSSH source in the proper place. The current ${MASTER_SITES} is just a guess at where the snapshot files could be hosted; something definite should be worked out very soon.
* Give OpenSSH TIS client-side authentication.green1999-11-204-0/+99
| | | | Submitted by: peter
* Change around sshd.sh for the last time.green1999-11-201-7/+0
|
* Make the second CVS site work for real.green1999-11-181-0/+7
| | | | | | | | | | | | | Move sshd.sh to files and ${INSTALL_SCRIPT}/${PERL} -pi it. Clean up the Makefile's style a bit (MNF anyone? :) Add WWW: to pkg/DESCR. Change MASTER_SITES back to CVS_SITES to avoid problems with MASTER_SITE_OVERRIDE. Parts submitted by: Christian Weisgerber <naddy@mips.rhein-neckar.de>, Robert Muir <rmuir@gibralter.net>
* Thanks to those who replied! The include (ssl versus openssl) transformgreen1999-11-1711-152/+0
| | | | | | is now done in post-patch. Submitted by: Anton Berezin <tobez@plab.ku.dk>, Christian Weisgerber <naddy@unix-ag.uni-kl.de>
* Prompted by Kris Kennaway <kris@FreeBSD.org>green1999-11-172-8/+8
| | | | | | | | | | | | | Update to to the current time for OpenSSH. The notable commit given to me for this new date is: (provos@cvs.openbsd.org) usr.bin/ssh : hostfile.c in known_hosts key lookup the entry for the bits does not need to match, all the information is contained in n and e. This solves the problem with buggy servers announcing the wrong modulus length. markus and me.
* Enable TCP wrapper support (conditionalized to turn off if tcpd.h isgreen1999-11-151-4/+4
| | | | nonexistant). Also, add the Makefile hooks for AFS, Kerberos, and S/Key.
OpenPOWER on IntegriCloud