Git log: commit e250ef620fa8f8fb9f252d9806de60dfa0760fa5
Merge: e50a98bd cfa01c63
Author: Colin Watson <cjwatson@debian.org>
Date: Tue Oct 22 11:05:50 2019 +0100
Drop seccomp-s390-flock-ipc.patch for now
Drop "Allow flock and ipc syscall for s390 architecture" patch for now;
upstream has security concerns with it and it doesn't currently seem to
be needed.
commit cfa01c635debb10e05f5ac34d269809c77c582dc
Author: Colin Watson <cjwatson@debian.org>
Date: Mon Apr 8 10:46:29 2019 +0100
Revert "upstream: Update default IPQoS in ssh(1), sshd(8) to DSCP AF21 for"
This reverts commit 5ee8448ad7c306f05a9f56769f95336a8269f379.
The IPQoS default changes have some unfortunate interactions with
iptables (see https://bugs.debian.org/923880) and VMware, so I'm
temporarily reverting them until those have been fixed.
Bug-Debian: https://bugs.debian.org/923879
Bug-Debian: https://bugs.debian.org/926229
Bug-Ubuntu: https://bugs.launchpad.net/bugs/1822370
Last-Update: 2019-04-08
Patch-Name: revert-ipqos-defaults.patch
commit bbce4380e516e8bfed1ae09af0bc3661e427794a
Author: Colin Watson <cjwatson@debian.org>
Date: Thu Aug 30 00:58:56 2018 +0100
Work around conch interoperability failure
Twisted Conch fails to read private keys in the new format
(https://twistedmatrix.com/trac/ticket/9515). Work around this until it
can be fixed in Twisted.
Forwarded: not-needed
Last-Update: 2019-10-09
Patch-Name: conch-old-privkey-format.patch
commit e50a98bda787a3b9f53ed67bdccbbac0bde1f9ae
Author: Colin Watson <cjwatson@debian.org>
Date: Sun Oct 13 18:45:41 2019 +0100
Update NEWS entry timestamp to match changelog
commit d07bd4e51f43ae74b7a08294d68bcd104933403e
Author: Colin Watson <cjwatson@debian.org>
Date: Thu Oct 10 10:27:43 2019 +0100
releasing package openssh version 1:8.1p1-1
commit e94cbd8370c27e6c28ea400eba2bcf7be45e4868
Author: Colin Watson <cjwatson@debian.org>
Date: Wed Oct 9 23:52:05 2019 +0100
Re-enable hardening on hppa
The corresponding GCC bug is apparently fixed.
commit 32ddb2b545cb9a18b6467091575c80e180e6fbb7
Merge: 767ee84d 660f3529
Author: Colin Watson <cjwatson@debian.org>
Date: Wed Oct 9 23:47:26 2019 +0100
Fix Launchpad bug URL
commit 660f35293504f04d744d2d6ab6276a83fff305a3
Author: Colin Watson <cjwatson@debian.org>
Date: Mon Apr 8 10:46:29 2019 +0100
Revert "upstream: Update default IPQoS in ssh(1), sshd(8) to DSCP AF21 for"
This reverts commit 5ee8448ad7c306f05a9f56769f95336a8269f379.
The IPQoS default changes have some unfortunate interactions with
iptables (see https://bugs.debian.org/923880) and VMware, so I'm
temporarily reverting them until those have been fixed.
Bug-Debian: https://bugs.debian.org/923879
Bug-Debian: https://bugs.debian.org/926229
Bug-Ubuntu: https://bugs.launchpad.net/bugs/1822370
Last-Update: 2019-04-08
Patch-Name: revert-ipqos-defaults.patch
commit 767ee84d3465b6d244a9108de5c167a9ab866df9
Merge: ddeaf9ee efef1282
Author: Colin Watson <cjwatson@debian.org>
Date: Wed Oct 9 22:59:48 2019 +0100
New upstream release (8.1p1)
commit efef12825b9582c1710da3b7e50135870963d4f4
Author: Colin Watson <cjwatson@debian.org>
Date: Mon Apr 8 10:46:29 2019 +0100
Revert "upstream: Update default IPQoS in ssh(1), sshd(8) to DSCP AF21 for"
This reverts commit 5ee8448ad7c306f05a9f56769f95336a8269f379.
The IPQoS default changes have some unfortunate interactions with
iptables (see https://bugs.debian.org/923880) and VMware, so I'm
temporarily reverting them until those have been fixed.
Bug-Debian: https://bugs.debian.org/923879
Bug-Debian: https://bugs.debian.org/926229
Bug-Ubuntu: https://bugs.launchpad.net/1822370
Last-Update: 2019-04-08
Patch-Name: revert-ipqos-defaults.patch
commit 46352085d71fe406537828a1cee3c2ce896eccb9
Author: Colin Watson <cjwatson@debian.org>
Date: Thu Aug 30 00:58:56 2018 +0100
Work around conch interoperability failure
Twisted Conch fails to read private keys in the new format
(https://twistedmatrix.com/trac/ticket/9515). Work around this until it
can be fixed in Twisted.
Forwarded: not-needed
Last-Update: 2019-10-09
Patch-Name: conch-old-privkey-format.patch
commit f0c916d8008c30809fef44469bee1b74426a3071
Author: Colin Watson <cjwatson@debian.org>
Date: Sun Mar 5 02:02:11 2017 +0000
Restore reading authorized_keys2 by default
Upstream seems to intend to gradually phase this out, so don't assume
that this will remain the default forever. However, we were late in
adopting the upstream sshd_config changes, so it makes sense to extend
the grace period.
Bug-Debian: https://bugs.debian.org/852320
Forwarded: not-needed
Last-Update: 2017-03-05
Patch-Name: restore-authorized_keys2.patch
commit cfc30ca51eba79f9f725c22528e3bfec036aa927
Author: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
Date: Tue May 9 10:53:04 2017 -0300
Allow flock and ipc syscall for s390 architecture
In order to use the OpenSSL-ibmpkcs11 engine it is needed to allow flock
and ipc calls, because this engine calls OpenCryptoki (a PKCS#11
implementation) which calls the libraries that will communicate with the
crypto cards. OpenCryptoki makes use of flock and ipc and, as of now,
this is only need on s390 architecture.
Signed-off-by: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
Origin: other, https://bugzilla.mindrot.org/show_bug.cgi?id=2752
Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=2752
Bug-Ubuntu: https://bugs.launchpad.net/bugs/1686618
Last-Update: 2018-10-19
Patch-Name: seccomp-s390-flock-ipc.patch
commit 7abde40896668ce9debfe056c7dabc6a70ef7da4
Author: Colin Watson <cjwatson@debian.org>
Date: Sun Feb 9 16:10:18 2014 +0000
Various Debian-specific configuration changes
ssh: Enable ForwardX11Trusted, returning to earlier semantics which cause
fewer problems with existing setups (http://bugs.debian.org/237021).
ssh: Set 'SendEnv LANG LC_*' by default (http://bugs.debian.org/264024).
ssh: Enable HashKnownHosts by default to try to limit the spread of ssh
worms.
ssh: Enable GSSAPIAuthentication by default.
sshd: Enable PAM, disable ChallengeResponseAuthentication, and disable
PrintMotd.
sshd: Enable X11Forwarding.
sshd: Set 'AcceptEnv LANG LC_*' by default.
sshd: Change sftp subsystem path to /usr/lib/openssh/sftp-server.
Document all of this.
Author: Russ Allbery <rra@debian.org>
Forwarded: not-needed
Last-Update: 2017-10-04
Patch-Name: debian-config.patch
commit ab765b2bd55062a704f09da8f8c1c4ad1d6630a7
Author: Michael Biebl <biebl@debian.org>
Date: Mon Dec 21 16:08:47 2015 +0000
Add systemd readiness notification support
Bug-Debian: https://bugs.debian.org/778913
Forwarded: no
Last-Update: 2017-08-22
Patch-Name: systemd-readiness.patch
commit 4360244ab2ed367bdb2c836292e761c589355950
Author: Vincent Untz <vuntz@ubuntu.com>
Date: Sun Feb 9 16:10:16 2014 +0000
Give the ssh-askpass-gnome window a default icon
Bug-Ubuntu: https://bugs.launchpad.net/bugs/27152
Last-Update: 2010-02-28
Patch-Name: gnome-ssh-askpass2-icon.patch
commit ed88eee326ca80e1e0fdb6f9ef0346f6d5e021a8
Author: Kurt Roeckx <kurt@roeckx.be>
Date: Sun Feb 9 16:10:14 2014 +0000
Don't check the status field of the OpenSSL version
There is no reason to check the version of OpenSSL (in Debian). If it's
not compatible the soname will change. OpenSSH seems to want to do a
check for the soname based on the version number, but wants to keep the
status of the release the same. Remove that check on the status since
it doesn't tell you anything about how compatible that version is.
Author: Colin Watson <cjwatson@debian.org>
Bug-Debian: https://bugs.debian.org/93581
Bug-Debian: https://bugs.debian.org/664383
Bug-Debian: https://bugs.debian.org/732940
Forwarded: not-needed
Last-Update: 2014-10-07
Patch-Name: no-openssl-version-status.patch
commit a8b5ec5c28805f0ab6b1b05474531521ac42eb12
Author: Colin Watson <cjwatson@debian.org>
Date: Sun Feb 9 16:10:13 2014 +0000
Document consequences of ssh-agent being setgid in ssh-agent(1)
Bug-Debian: http://bugs.debian.org/711623
Forwarded: no
Last-Update: 2013-06-08
Patch-Name: ssh-agent-setgid.patch
commit 944653642de12f09baa546011429fb69ffc0065a
Author: Colin Watson <cjwatson@debian.org>
Date: Sun Feb 9 16:10:11 2014 +0000
Document that HashKnownHosts may break tab-completion
Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1727
Bug-Debian: http://bugs.debian.org/430154
Last-Update: 2013-09-14
Patch-Name: doc-hash-tab-completion.patch
commit e9f961ffa4e4e73ed22103b5697147d135d88b4f
Author: Colin Watson <cjwatson@debian.org>
Date: Sun Feb 9 16:10:10 2014 +0000
ssh(1): Refer to ssh-argv0(1)
Old versions of OpenSSH (up to 2.5 or thereabouts) allowed creating symlinks
to ssh with the name of the host you want to connect to. Debian ships an
ssh-argv0 script restoring this feature; this patch refers to its manual
page from ssh(1).
Bug-Debian: http://bugs.debian.org/111341
Forwarded: not-needed
Last-Update: 2013-09-14
Patch-Name: ssh-argv0.patch
commit 8fb8f70b0534897791c61f2757e97bd13385944e
Author: Colin Watson <cjwatson@debian.org>
Date: Sun Feb 9 16:10:09 2014 +0000
Adjust various OpenBSD-specific references in manual pages
No single bug reference for this patch, but history includes:
http://bugs.debian.org/154434 (login.conf(5))
http://bugs.debian.org/513417 (/etc/rc)
http://bugs.debian.org/530692 (ssl(8))
https://bugs.launchpad.net/bugs/456660 (ssl(8))
Forwarded: not-needed
Last-Update: 2017-10-04
Patch-Name: openbsd-docs.patch
commit 7febe5a4b6bcb94d887ac1fe22e8a1742ffb609f
Author: Tomas Pospisek <tpo_deb@sourcepole.ch>
Date: Sun Feb 9 16:10:07 2014 +0000
Install authorized_keys(5) as a symlink to sshd(8)
Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1720
Bug-Debian: http://bugs.debian.org/441817
Last-Update: 2013-09-14
Patch-Name: authorized-keys-man-symlink.patch
commit 4eb06adf69f21f387e4f2d29dad01b2ca1303094
Author: Kees Cook <kees@debian.org>
Date: Sun Feb 9 16:10:06 2014 +0000
Add DebianBanner server configuration option
Setting this to "no" causes sshd to omit the Debian revision from its
initial protocol handshake, for those scared by package-versioning.patch.
Bug-Debian: http://bugs.debian.org/562048
Forwarded: not-needed
Last-Update: 2019-06-05
Patch-Name: debian-banner.patch
commit 6a8dfab1a067a52b004594fadb3a90578a8cc094
Author: Matthew Vernon <matthew@debian.org>
Date: Sun Feb 9 16:10:05 2014 +0000
Include the Debian version in our identification
This makes it easier to audit networks for versions patched against security
vulnerabilities. It has little detrimental effect, as attackers will
generally just try attacks rather than bothering to scan for
vulnerable-looking version strings. (However, see debian-banner.patch.)
Forwarded: not-needed
Last-Update: 2019-06-05
Patch-Name: package-versioning.patch
commit fdcf8c0343564121a89be817386c5feabd40c609
Author: Scott Moser <smoser@ubuntu.com>
Date: Sun Feb 9 16:10:03 2014 +0000
Mention ssh-keygen in ssh fingerprint changed warning
Author: Chris Lamb <lamby@debian.org>
Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1843
Bug-Ubuntu: https://bugs.launchpad.net/bugs/686607
Last-Update: 2017-08-22
Patch-Name: mention-ssh-keygen-on-keychange.patch
commit 6220be7f65137290fbe3ad71b83667e71e4ccd03
Author: Colin Watson <cjwatson@debian.org>
Date: Sun Feb 9 16:10:01 2014 +0000
Force use of DNSSEC even if "options edns0" isn't in resolv.conf
This allows SSHFP DNS records to be verified if glibc 2.11 is installed.
Origin: vendor, https://cvs.fedoraproject.org/viewvc/F-12/openssh/openssh-5.2p1-edns.patch?revision=1.1&view=markup
Bug: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=572049
Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=572049
Last-Update: 2010-04-06
Patch-Name: dnssec-sshfp.patch
commit 5d1aab0eb6baeb044516660a0bde36cba2a3f9c2
Author: Colin Watson <cjwatson@debian.org>
Date: Sun Feb 9 16:10:00 2014 +0000
Look for $SHELL on the path for ProxyCommand/LocalCommand
There's some debate on the upstream bug about whether POSIX requires this.
I (Colin Watson) agree with Vincent and think it does.
Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1494
Bug-Debian: http://bugs.debian.org/492728
Last-Update: 2013-09-14
Patch-Name: shell-path.patch
commit 2d8e679834c81fc381d02974986e08cafe3efa29
Author: Nicolas Valcárcel <nvalcarcel@ubuntu.com>
Date: Sun Feb 9 16:09:59 2014 +0000
Adjust scp quoting in verbose mode
Tweak scp's reporting of filenames in verbose mode to be a bit less
confusing with spaces.
This should be revised to mimic real shell quoting.
Bug-Ubuntu: https://bugs.launchpad.net/bugs/89945
Last-Update: 2010-02-27
Patch-Name: scp-quoting.patch
commit 19f1d075a06f4d3c9b440d7272272569d8bb0a17
Author: Colin Watson <cjwatson@debian.org>
Date: Sun Feb 9 16:09:58 2014 +0000
Allow harmless group-writability
Allow secure files (~/.ssh/config, ~/.ssh/authorized_keys, etc.) to be
group-writable, provided that the group in question contains only the file's
owner. Rejected upstream for IMO incorrect reasons (e.g. a misunderstanding
about the contents of gr->gr_mem). Given that per-user groups and umask 002
are the default setup in Debian (for good reasons - this makes operating in
setgid directories with other groups much easier), we need to permit this by
default.
Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1060
Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=314347
Last-Update: 2019-10-09
Patch-Name: user-group-modes.patch
commit 3d1a993f484e9043e57af3ae37b7c9c608d5a5f1
Author: Natalie Amery <nmamery@chiark.greenend.org.uk>
Date: Sun Feb 9 16:09:54 2014 +0000
"LogLevel SILENT" compatibility
"LogLevel SILENT" (-qq) was introduced in Debian openssh 1:3.0.1p1-1 to
match the behaviour of non-free SSH, in which -q does not suppress fatal
errors. However, this was unintentionally broken in 1:4.6p1-2 and nobody
complained, so we've dropped most of it. The parts that remain are basic
configuration file compatibility, and an adjustment to "Pseudo-terminal will
not be allocated ..." which should be split out into a separate patch.
Author: Matthew Vernon <matthew@debian.org>
Author: Colin Watson <cjwatson@debian.org>
Last-Update: 2013-09-14
Patch-Name: syslog-level-silent.patch
commit 26d9fe60e31c78018bdfd49bba1196ea7c44405d
Author: Richard Kettlewell <rjk@greenend.org.uk>
Date: Sun Feb 9 16:09:52 2014 +0000
Various keepalive extensions
Add compatibility aliases for ProtocolKeepAlives and SetupTimeOut, supported
in previous versions of Debian's OpenSSH package but since superseded by
ServerAliveInterval. (We're probably stuck with this bit for
compatibility.)
In batch mode, default ServerAliveInterval to five minutes.
Adjust documentation to match and to give some more advice on use of
keepalives.
Author: Ian Jackson <ian@chiark.greenend.org.uk>
Author: Matthew Vernon <matthew@debian.org>
Author: Colin Watson <cjwatson@debian.org>
Last-Update: 2018-10-19
Patch-Name: keepalive-extensions.patch
commit 42c820f76fddf2f2e537dbe10842aa39f6154059
Author: Colin Watson <cjwatson@ubuntu.com>
Date: Sun Feb 9 16:09:50 2014 +0000
Accept obsolete ssh-vulnkey configuration options
These options were used as part of Debian's response to CVE-2008-0166.
Nearly six years later, we no longer need to continue carrying the bulk
of that patch, but we do need to avoid failing when the associated
configuration options are still present.
Last-Update: 2014-02-09
Patch-Name: ssh-vulnkey-compat.patch
commit 3131e3bb3c56a6c6ee8cb9d68f542af04cd9e8ff
Author: Manoj Srivastava <srivasta@debian.org>
Date: Sun Feb 9 16:09:49 2014 +0000
Handle SELinux authorisation roles
Rejected upstream due to discomfort with magic usernames; a better approach
will need an SSH protocol change. In the meantime, this came from Debian's
SELinux maintainer, so we'll keep it until we have something better.
Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1641
Bug-Debian: http://bugs.debian.org/394795
Last-Update: 2019-06-05
Patch-Name: selinux-role.patch
commit 57c1dd662f9259f58a47801e2d4b0f84e973441d
Author: Colin Watson <cjwatson@debian.org>
Date: Tue Oct 7 13:22:41 2014 +0100
Restore TCP wrappers support
Support for TCP wrappers was dropped in OpenSSH 6.7. See this message
and thread:
https://lists.mindrot.org/pipermail/openssh-unix-dev/2014-April/032497.html
It is true that this reduces preauth attack surface in sshd. On the
other hand, this support seems to be quite widely used, and abruptly
dropping it (from the perspective of users who don't read
openssh-unix-dev) could easily cause more serious problems in practice.
It's not entirely clear what the right long-term answer for Debian is,
but it at least probably doesn't involve dropping this feature shortly
before a freeze.
Forwarded: not-needed
Last-Update: 2019-06-05
Patch-Name: restore-tcp-wrappers.patch
commit 9da806e67101afdc0d3a1d304659927acf18f5c5
Author: Simon Wilkinson <simon@sxw.org.uk>
Date: Sun Feb 9 16:09:48 2014 +0000
GSSAPI key exchange support
This patch has been rejected upstream: "None of the OpenSSH developers are
in favour of adding this, and this situation has not changed for several
years. This is not a slight on Simon's patch, which is of fine quality, but
just that a) we don't trust GSSAPI implementations that much and b) we don't
like adding new KEX since they are pre-auth attack surface. This one is
particularly scary, since it requires hooks out to typically root-owned
system resources."
However, quite a lot of people rely on this in Debian, and it's better to
have it merged into the main openssh package rather than having separate
-krb5 packages (as we used to have). It seems to have a generally good
security history.
Origin: other, https://github.com/openssh-gsskex/openssh-gsskex/commits/debian/master
Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1242
Last-Updated: 2019-10-09
Patch-Name: gssapi.patch
commit 4213eec74e74de6310c27a40c3e9759a08a73996
Merge: 102062f8 cdf1d0a9
Author: Colin Watson <cjwatson@debian.org>
Date: Wed Oct 9 22:59:48 2019 +0100
Import openssh_8.1p1.orig.tar.gz
commit ddeaf9ee7d5c6612b88f1c4a83fc6fbccb93bf60
Author: Colin Watson <cjwatson@debian.org>
Date: Sat Oct 5 22:41:20 2019 +0100
releasing package openssh version 1:8.0p1-7
commit 699f6971bc8a142016c60e712839a9722886522f
Merge: 07252689 ceefaa8e
Author: Colin Watson <cjwatson@debian.org>
Date: Sat Oct 5 22:29:01 2019 +0100
Deny (non-fatal) shmget/shmat/shmdt in preauth privsep child
This copes with changes in OpenSSL 1.1.1d that broke OpenSSH on Linux
kernels before 3.19.
Closes: #941663
commit ceefaa8ee80b63c0890d24c42369dc51880f53ea
Author: Lonnie Abelbeck <lonnie@abelbeck.com>
Date: Tue Oct 1 09:05:09 2019 -0500
Deny (non-fatal) shmget/shmat/shmdt in preauth privsep child.
New wait_random_seeded() function on OpenSSL 1.1.1d uses shmget, shmat, and shmdt
in the preauth codepath, deny (non-fatal) in seccomp_filter sandbox.
Bug: https://github.com/openssh/openssh-portable/pull/149
Bug-Debian: https://bugs.debian.org/941663
Origin: upstream, https://anongit.mindrot.org/openssh.git/commit/?id=3ef92a657444f172b61f92d5da66d94fa8265602
Last-Update: 2019-10-05
Patch-Name: seccomp-handle-shm.patch
commit 07252689f247e0ea037027ebd17b09b33ce1f5b4
Author: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
Date: Wed Aug 28 13:21:09 2019 -0400
runit: Correct typo
The name of the file that we check when sshd is supposed to be down is
correct in the script, but not in the comments :)
Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
commit 338dd52a7ec3977ac46513f6937898223f1f4930
Author: Colin Watson <cjwatson@debian.org>
Date: Wed Aug 28 10:53:27 2019 +0100
releasing package openssh version 1:8.0p1-6
commit e4d758fc1d3ee62f8aa1ee47ecb52128176cdd6d
Author: Colin Watson <cjwatson@debian.org>
Date: Wed Aug 28 10:34:44 2019 +0100
Only run dh_runit on openssh-server
Closes: #935936
commit 630a8fe264bc6e42a91a22e5f5d51dfb0d688f71
Author: Colin Watson <cjwatson@debian.org>
Date: Tue Aug 27 15:19:02 2019 +0100
releasing package openssh version 1:8.0p1-5
commit f5e0907876b1168f8d77fb4a8b96fc62965dd6f4
Author: Colin Watson <cjwatson@debian.org>
Date: Tue Aug 13 10:44:32 2019 +0100
Add a runscript for runit
Changelog entry for Lorenzo Puliti's recently-merged commit.
Closes: #933999
commit 54568d642443c196b9eec75f0d719f117907175f
Author: Colin Watson <cjwatson@debian.org>
Date: Tue Aug 13 10:39:06 2019 +0100
Consistent whitespace
commit 30465dd0efdf99fa32bc7f829c403f474e1f6bc3
Merge: e5fc1684 b48697c6
Author: Colin Watson <cjwatson@debian.org>
Date: Tue Aug 13 09:35:04 2019 +0000
Merge branch 'runit' into 'master'
Please add a runscript for runit
See merge request ssh-team/openssh!7
commit b48697c64a0ac57eed494104f4c82d61f5b6fc89
Author: Lorenzo Puliti <lorenzo.ru.g@gmail.com>
Date: Mon Aug 5 20:24:41 2019 +0200
Add a runscript for runit
Add a 'run' and a 'finish' script for runit init system;
rely on dh-runit for maintscript code.
commit e5fc16844f5772a12808e22a72c0ee50977c4e60
Author: Colin Watson <cjwatson@debian.org>
Date: Sat Aug 3 13:34:00 2019 +0100
releasing package openssh version 1:8.0p1-4
commit 528e959145752e8192682da7c1ebf85f95deb7d8
Author: Colin Watson <cjwatson@debian.org>
Date: Sat Aug 3 13:33:14 2019 +0100
Run regression tests against the Python 3 version of Twisted Conch
commit c0e57836abe9ef24f07c258198283689b51e3613
Author: Colin Watson <cjwatson@debian.org>
Date: Sat Aug 3 13:27:22 2019 +0100
debian/*.apport: Fix flake8 errors
commit 9e0323ffdc00a48e282b4bd7f0f974665ffe35e1
Author: Colin Watson <cjwatson@debian.org>
Date: Sat Aug 3 13:25:07 2019 +0100
debian/*.apport: Avoid star imports
commit 5c02b384dce466dc4a4b67b7b1ec0c05f3e53639
Author: Colin Watson <cjwatson@debian.org>
Date: Sat Aug 3 13:22:57 2019 +0100
Remove #! lines from apport hooks
These aren't executed as top-level programs.
commit 353ded3a81570c17b74fdee6c604068ccf4c8650
Author: Colin Watson <cjwatson@debian.org>
Date: Sat Aug 3 12:49:23 2019 +0100
Use debhelper-compat instead of debian/compat
commit 2b9c6bc550c0491427600ec5f0c9fbca32cd4745
Author: Colin Watson <cjwatson@debian.org>
Date: Mon Jul 8 17:22:09 2019 +0100
releasing package openssh version 1:8.0p1-3
commit a8e1c8f5f50d69dfcf9d854ea17058b624239ba9
Author: Colin Watson <cjwatson@debian.org>
Date: Mon Jul 8 17:19:33 2019 +0100
Upload to unstable
commit 09a03c340c425799a863ea5897ddfb4853e24f7f
Merge: d7e7059a 61d27066
Author: Colin Watson <cjwatson@debian.org>
Date: Fri Jun 21 16:14:15 2019 +0100
Update contact information for Natalie Amery
commit 61d2706623ed144ee9cbd212d13eeba202a7ce26
Author: Darren Tucker <dtucker@dtucker.net>
Date: Fri Jun 7 23:47:37 2019 +1000
Update utimensat test.
POSIX specifies that when given a symlink, AT_SYMLINK_NOFOLLOW should
update the symlink and not the destination. The compat code doesn't
have a way to do this, so where possible it fails instead of following a
symlink when explicitly asked not to. Instead of checking for an explicit
failure, check that it does not update the destination, which both the
real and compat implementations should honour.
Inspired by github pull req #125 from chutzpah at gentoo.org.
Origin: upstream, https://anongit.mindrot.org/openssh.git/commit/?id=182898192d4b720e4faeafd5b39c2cfb3b92aa21
Last-Update: 2019-06-09
Patch-Name: fix-utimensat-test.patch
commit f08fbfbaad10ae0bd9f057de8e18071e588146a6
Author: Colin Watson <cjwatson@debian.org>
Date: Mon Apr 8 10:46:29 2019 +0100
Revert "upstream: Update default IPQoS in ssh(1), sshd(8) to DSCP AF21 for"
This reverts commit 5ee8448ad7c306f05a9f56769f95336a8269f379.
The IPQoS default changes have some unfortunate interactions with
iptables (see https://bugs.debian.org/923880) and VMware, so I'm
temporarily reverting them until those have been fixed.
Bug-Debian: https://bugs.debian.org/923879
Bug-Debian: https://bugs.debian.org/926229
Bug-Ubuntu: https://bugs.launchpad.net/1822370
Last-Update: 2019-04-08
Patch-Name: revert-ipqos-defaults.patch
commit a20835ce2f9899305421bc478ba29d6524e89433
Author: Colin Watson <cjwatson@debian.org>
Date: Thu Aug 30 00:58:56 2018 +0100
Work around conch interoperability failure
Twisted Conch fails to read private keys in the new format
(https://twistedmatrix.com/trac/ticket/9515). Work around this until it
can be fixed in Twisted.
Forwarded: not-needed
Last-Update: 2019-06-14
Patch-Name: conch-old-privkey-format.patch
commit 42519a0f32765726ccd18a14aa6e877413a69662
Author: Colin Watson <cjwatson@debian.org>
Date: Fri Jun 14 11:57:15 2019 +0100
Fix interop tests for recent regress changes
A recent regress change (2a9b3a2ce411d16cda9c79ab713c55f65b0ec257 in
portable) broke the PuTTY and Twisted Conch interop tests, because the
key they want to use is now called ssh-rsa rather than rsa. Fix them.
Forwarded: https://bugzilla.mindrot.org/show_bug.cgi?id=3020
Last-Update: 2019-06-14
Patch-Name: fix-interop-tests.patch
commit d38283cc4cba6bf7685a16898a3b9d3a6cecf661
Author: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
Date: Tue May 9 13:33:30 2017 -0300
Enable specific ioctl call for EP11 crypto card (s390)
The EP11 crypto card needs to make an ioctl call, which receives an
specific argument. This crypto card is for s390 only.
Signed-off-by: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
Origin: other, https://bugzilla.mindrot.org/show_bug.cgi?id=2752
Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=2752
Bug-Ubuntu: https://bugs.launchpad.net/bugs/1686618
Last-Update: 2017-08-28
Patch-Name: seccomp-s390-ioctl-ep11-crypto.patch
commit a85bb8a31b789276d5edb0c34023ce833a402b00
Author: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
Date: Tue May 9 10:53:04 2017 -0300
Allow flock and ipc syscall for s390 architecture
In order to use the OpenSSL-ibmpkcs11 engine it is needed to allow flock
and ipc calls, because this engine calls OpenCryptoki (a PKCS#11
implementation) which calls the libraries that will communicate with the
crypto cards. OpenCryptoki makes use of flock and ipc and, as of now,
this is only need on s390 architecture.
Signed-off-by: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
Origin: other, https://bugzilla.mindrot.org/show_bug.cgi?id=2752
Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=2752
Bug-Ubuntu: https://bugs.launchpad.net/bugs/1686618
Last-Update: 2018-10-19
Patch-Name: seccomp-s390-flock-ipc.patch
commit 4eb4bf18caacd2fe12dbdde381347629dd8b3c95
Author: Colin Watson <cjwatson@debian.org>
Date: Sun Mar 5 02:02:11 2017 +0000
Restore reading authorized_keys2 by default
Upstream seems to intend to gradually phase this out, so don't assume
that this will remain the default forever. However, we were late in
adopting the upstream sshd_config changes, so it makes sense to extend
the grace period.
Bug-Debian: https://bugs.debian.org/852320
Forwarded: not-needed
Last-Update: 2017-03-05
Patch-Name: restore-authorized_keys2.patch
commit d9eede9b2c86ddaccb35477f2904bfbdf223ffd4
Author: Colin Watson <cjwatson@debian.org>
Date: Sun Feb 9 16:10:18 2014 +0000
Various Debian-specific configuration changes
ssh: Enable ForwardX11Trusted, returning to earlier semantics which cause
fewer problems with existing setups (http://bugs.debian.org/237021).
ssh: Set 'SendEnv LANG LC_*' by default (http://bugs.debian.org/264024).
ssh: Enable HashKnownHosts by default to try to limit the spread of ssh
worms.
ssh: Enable GSSAPIAuthentication by default.
sshd: Enable PAM, disable ChallengeResponseAuthentication, and disable
PrintMotd.
sshd: Enable X11Forwarding.
sshd: Set 'AcceptEnv LANG LC_*' by default.
sshd: Change sftp subsystem path to /usr/lib/openssh/sftp-server.
Document all of this.
Author: Russ Allbery <rra@debian.org>
Forwarded: not-needed
Last-Update: 2017-10-04
Patch-Name: debian-config.patch
commit d23f57ff1e85ded1298886968c9949282c4cba08
Author: Michael Biebl <biebl@debian.org>
Date: Mon Dec 21 16:08:47 2015 +0000
Add systemd readiness notification support
Bug-Debian: https://bugs.debian.org/778913
Forwarded: no
Last-Update: 2017-08-22
Patch-Name: systemd-readiness.patch
commit 734ffc23e368f9b0df085b4f191d66e21ed52d12
Author: Vincent Untz <vuntz@ubuntu.com>
Date: Sun Feb 9 16:10:16 2014 +0000
Give the ssh-askpass-gnome window a default icon
Bug-Ubuntu: https://bugs.launchpad.net/bugs/27152
Last-Update: 2010-02-28
Patch-Name: gnome-ssh-askpass2-icon.patch
commit 4cf082890d12604fcd28e7387b5eb4a5fb09695e
Author: Kurt Roeckx <kurt@roeckx.be>
Date: Sun Feb 9 16:10:14 2014 +0000
Don't check the status field of the OpenSSL version
There is no reason to check the version of OpenSSL (in Debian). If it's
not compatible the soname will change. OpenSSH seems to want to do a
check for the soname based on the version number, but wants to keep the
status of the release the same. Remove that check on the status since
it doesn't tell you anything about how compatible that version is.
Author: Colin Watson <cjwatson@debian.org>
Bug-Debian: https://bugs.debian.org/93581
Bug-Debian: https://bugs.debian.org/664383
Bug-Debian: https://bugs.debian.org/732940
Forwarded: not-needed
Last-Update: 2014-10-07
Patch-Name: no-openssl-version-status.patch
commit 22d2b4adcb38771adba96e326749cc67ee33d172
Author: Colin Watson <cjwatson@debian.org>
Date: Sun Feb 9 16:10:13 2014 +0000
Document consequences of ssh-agent being setgid in ssh-agent(1)
Bug-Debian: http://bugs.debian.org/711623
Forwarded: no
Last-Update: 2013-06-08
Patch-Name: ssh-agent-setgid.patch
commit 63f45f055fe3b0b1edd31a94b7627ee4e40647e8
Author: Colin Watson <cjwatson@debian.org>
Date: Sun Feb 9 16:10:11 2014 +0000
Document that HashKnownHosts may break tab-completion
Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1727
Bug-Debian: http://bugs.debian.org/430154
Last-Update: 2013-09-14
Patch-Name: doc-hash-tab-completion.patch
commit a3f10aefc2ed6ea656f5e57985400f86f56c40f6
Author: Colin Watson <cjwatson@debian.org>
Date: Sun Feb 9 16:10:10 2014 +0000
ssh(1): Refer to ssh-argv0(1)
Old versions of OpenSSH (up to 2.5 or thereabouts) allowed creating symlinks
to ssh with the name of the host you want to connect to. Debian ships an
ssh-argv0 script restoring this feature; this patch refers to its manual
page from ssh(1).
Bug-Debian: http://bugs.debian.org/111341
Forwarded: not-needed
Last-Update: 2013-09-14
Patch-Name: ssh-argv0.patch
commit b3a38ffd3427b5404210f841c8e29c2df21e1825
Author: Colin Watson <cjwatson@debian.org>
Date: Sun Feb 9 16:10:09 2014 +0000
Adjust various OpenBSD-specific references in manual pages
No single bug reference for this patch, but history includes:
http://bugs.debian.org/154434 (login.conf(5))
http://bugs.debian.org/513417 (/etc/rc)
http://bugs.debian.org/530692 (ssl(8))
https://bugs.launchpad.net/bugs/456660 (ssl(8))
Forwarded: not-needed
Last-Update: 2017-10-04
Patch-Name: openbsd-docs.patch
commit df7d113a48bd33e42754ee5e83d3cda84cc219f9
Author: Tomas Pospisek <tpo_deb@sourcepole.ch>
Date: Sun Feb 9 16:10:07 2014 +0000
Install authorized_keys(5) as a symlink to sshd(8)
Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1720
Bug-Debian: http://bugs.debian.org/441817
Last-Update: 2013-09-14
Patch-Name: authorized-keys-man-symlink.patch
commit 0a938d856d024bfff79fac63e65df382ffa444a4
Author: Kees Cook <kees@debian.org>
Date: Sun Feb 9 16:10:06 2014 +0000
Add DebianBanner server configuration option
Setting this to "no" causes sshd to omit the Debian revision from its
initial protocol handshake, for those scared by package-versioning.patch.
Bug-Debian: http://bugs.debian.org/562048
Forwarded: not-needed
Last-Update: 2019-06-05
Patch-Name: debian-banner.patch
commit 0085b2106eb5307ebdae9601471d8387961b2e83
Author: Matthew Vernon <matthew@debian.org>
Date: Sun Feb 9 16:10:05 2014 +0000
Include the Debian version in our identification
This makes it easier to audit networks for versions patched against security
vulnerabilities. It has little detrimental effect, as attackers will
generally just try attacks rather than bothering to scan for
vulnerable-looking version strings. (However, see debian-banner.patch.)
Forwarded: not-needed
Last-Update: 2019-06-05
Patch-Name: package-versioning.patch
commit f9185fc3df5af5f724bca35a957f60309af1d89e
Author: Scott Moser <smoser@ubuntu.com>
Date: Sun Feb 9 16:10:03 2014 +0000
Mention ssh-keygen in ssh fingerprint changed warning
Author: Chris Lamb <lamby@debian.org>
Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1843
Bug-Ubuntu: https://bugs.launchpad.net/bugs/686607
Last-Update: 2017-08-22
Patch-Name: mention-ssh-keygen-on-keychange.patch
commit 6397deaa7d0951552afa7dbd6898d6172850378a
Author: Colin Watson <cjwatson@debian.org>
Date: Sun Feb 9 16:10:01 2014 +0000
Force use of DNSSEC even if "options edns0" isn't in resolv.conf
This allows SSHFP DNS records to be verified if glibc 2.11 is installed.
Origin: vendor, https://cvs.fedoraproject.org/viewvc/F-12/openssh/openssh-5.2p1-edns.patch?revision=1.1&view=markup
Bug: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=572049
Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=572049
Last-Update: 2010-04-06
Patch-Name: dnssec-sshfp.patch
commit 2cbb28cbd60e1c5c13a8457ad77a62c7787ba4a8
Author: Colin Watson <cjwatson@debian.org>
Date: Sun Feb 9 16:10:00 2014 +0000
Look for $SHELL on the path for ProxyCommand/LocalCommand
There's some debate on the upstream bug about whether POSIX requires this.
I (Colin Watson) agree with Vincent and think it does.
Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1494
Bug-Debian: http://bugs.debian.org/492728
Last-Update: 2013-09-14
Patch-Name: shell-path.patch
commit 08821a1b464a0d0d62f735d6bf1e6305faf73fa1
Author: Nicolas Valcárcel <nvalcarcel@ubuntu.com>
Date: Sun Feb 9 16:09:59 2014 +0000
Adjust scp quoting in verbose mode
Tweak scp's reporting of filenames in verbose mode to be a bit less
confusing with spaces.
This should be revised to mimic real shell quoting.
Bug-Ubuntu: https://bugs.launchpad.net/bugs/89945
Last-Update: 2010-02-27
Patch-Name: scp-quoting.patch
commit 0fc2ac6707abe076cd6b444f73c478eeda54b25f
Author: Colin Watson <cjwatson@debian.org>
Date: Sun Feb 9 16:09:58 2014 +0000
Allow harmless group-writability
Allow secure files (~/.ssh/config, ~/.ssh/authorized_keys, etc.) to be
group-writable, provided that the group in question contains only the file's
owner. Rejected upstream for IMO incorrect reasons (e.g. a misunderstanding
about the contents of gr->gr_mem). Given that per-user groups and umask 002
are the default setup in Debian (for good reasons - this makes operating in
setgid directories with other groups much easier), we need to permit this by
default.
Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1060
Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=314347
Last-Update: 2019-06-05
Patch-Name: user-group-modes.patch
commit e9dd9cd95fe8fe2da9b114a1546a90634b3ce4be
Author: Natalie Amery <nmamery@chiark.greenend.org.uk>
Date: Sun Feb 9 16:09:54 2014 +0000
"LogLevel SILENT" compatibility
"LogLevel SILENT" (-qq) was introduced in Debian openssh 1:3.0.1p1-1 to
match the behaviour of non-free SSH, in which -q does not suppress fatal
errors. However, this was unintentionally broken in 1:4.6p1-2 and nobody
complained, so we've dropped most of it. The parts that remain are basic
configuration file compatibility, and an adjustment to "Pseudo-terminal will
not be allocated ..." which should be split out into a separate patch.
Author: Matthew Vernon <matthew@debian.org>
Author: Colin Watson <cjwatson@debian.org>
Last-Update: 2013-09-14
Patch-Name: syslog-level-silent.patch
commit d7e7059a085282da470bd0a4b40b60f01c16806d
Author: Colin Watson <cjwatson@debian.org>
Date: Fri Jun 14 14:32:56 2019 +0100
releasing package openssh version 1:8.0p1-2
commit 836c96c7d2d96b16bf571ab4f452520ea5d8d404
Merge: 86395f5f 0c3b0631
Author: Colin Watson <cjwatson@debian.org>
Date: Fri Jun 14 12:05:19 2019 +0100
Fix interop tests for recent regress changes
commit 0c3b0631695be33f711eda233bfee3dab77d405c
Author: Darren Tucker <dtucker@dtucker.net>
Date: Fri Jun 7 23:47:37 2019 +1000
Update utimensat test.
POSIX specifies that when given a symlink, AT_SYMLINK_NOFOLLOW should
update the symlink and not the destination. The compat code doesn't
have a way to do this, so where possible it fails instead of following a
symlink when explicitly asked not to. Instead of checking for an explicit
failure, check that it does not update the destination, which both the
real and compat implementations should honour.
Inspired by github pull req #125 from chutzpah at gentoo.org.
Origin: upstream, https://anongit.mindrot.org/openssh.git/commit/?id=182898192d4b720e4faeafd5b39c2cfb3b92aa21
Last-Update: 2019-06-09
Patch-Name: fix-utimensat-test.patch
commit 907bd73e8b0d031a96a0f800c0f6cef03ff1fcc4
Author: Colin Watson <cjwatson@debian.org>
Date: Mon Apr 8 10:46:29 2019 +0100
Revert "upstream: Update default IPQoS in ssh(1), sshd(8) to DSCP AF21 for"
This reverts commit 5ee8448ad7c306f05a9f56769f95336a8269f379.
The IPQoS default changes have some unfortunate interactions with
iptables (see https://bugs.debian.org/923880) and VMware, so I'm
temporarily reverting them until those have been fixed.
Bug-Debian: https://bugs.debian.org/923879
Bug-Debian: https://bugs.debian.org/926229
Bug-Ubuntu: https://bugs.launchpad.net/1822370
Last-Update: 2019-04-08
Patch-Name: revert-ipqos-defaults.patch
commit 715b72009450c3448de10729817687c53554efb2
Author: Colin Watson <cjwatson@debian.org>
Date: Thu Aug 30 00:58:56 2018 +0100
Work around conch interoperability failure
Twisted Conch fails to read private keys in the new format
(https://twistedmatrix.com/trac/ticket/9515). Work around this until it
can be fixed in Twisted.
Forwarded: not-needed
Last-Update: 2019-06-14
Patch-Name: conch-old-privkey-format.patch
commit 440ef75890c282e75534689cd4e0d3938279b8e0
Author: Colin Watson <cjwatson@debian.org>
Date: Fri Jun 14 11:57:15 2019 +0100
Fix interop tests for recent regress changes
A recent regress change (2a9b3a2ce411d16cda9c79ab713c55f65b0ec257 in
portable) broke the PuTTY and Twisted Conch interop tests, because the
key they want to use is now called ssh-rsa rather than rsa. Fix them.
Forwarded: https://bugzilla.mindrot.org/show_bug.cgi?id=3020
Last-Update: 2019-06-14
Patch-Name: fix-interop-tests.patch
commit 86395f5f3444767002802ce4b5c27dcbb5d32286
Author: Colin Watson <cjwatson@debian.org>
Date: Sun Jun 9 22:51:10 2019 +0100
releasing package openssh version 1:8.0p1-1
commit edf60d2bf70b7cc9a651434faa87b732af081808
Merge: 865a97e0 bbc5ff0a
Author: Colin Watson <cjwatson@debian.org>
Date: Sun Jun 9 22:09:35 2019 +0100
Fix utimensat tests when not using compat code
commit bbc5ff0a295797174b4ef3928f58969e43f5adfe
Author: Darren Tucker <dtucker@dtucker.net>
Date: Fri Jun 7 23:47:37 2019 +1000
Update utimensat test.
POSIX specifies that when given a symlink, AT_SYMLINK_NOFOLLOW should
update the symlink and not the destination. The compat code doesn't
have a way to do this, so where possible it fails instead of following a
symlink when explicitly asked not to. Instead of checking for an explicit
failure, check that it does not update the destination, which both the
real and compat implementations should honour.
Inspired by github pull req #125 from chutzpah at gentoo.org.
Origin: upstream, https://anongit.mindrot.org/openssh.git/commit/?id=182898192d4b720e4faeafd5b39c2cfb3b92aa21
Last-Update: 2019-06-09
Patch-Name: fix-utimensat-test.patch
commit 865a97e05b6aab1619e1c8eeb33ccb8f9a9e48d3
Merge: ba627ba1 7d50f9e5
Author: Colin Watson <cjwatson@debian.org>
Date: Wed Jun 5 06:41:44 2019 +0100
New upstream release (8.0p1)
commit 9d4508c5c1d6466c662befcb26aff09f41966102
Author: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
Date: Tue May 9 13:33:30 2017 -0300
Enable specific ioctl call for EP11 crypto card (s390)
The EP11 crypto card needs to make an ioctl call, which receives an
specific argument. This crypto card is for s390 only.
Signed-off-by: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
Origin: other, https://bugzilla.mindrot.org/show_bug.cgi?id=2752
Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=2752
Bug-Ubuntu: https://bugs.launchpad.net/bugs/1686618
Last-Update: 2017-08-28
Patch-Name: seccomp-s390-ioctl-ep11-crypto.patch
commit 7d50f9e5be88179325983a1f58c9d51bb58f025a
Author: Colin Watson <cjwatson@debian.org>
Date: Mon Apr 8 10:46:29 2019 +0100
Revert "upstream: Update default IPQoS in ssh(1), sshd(8) to DSCP AF21 for"
This reverts commit 5ee8448ad7c306f05a9f56769f95336a8269f379.
The IPQoS default changes have some unfortunate interactions with
iptables (see https://bugs.debian.org/923880) and VMware, so I'm
temporarily reverting them until those have been fixed.
Bug-Debian: https://bugs.debian.org/923879
Bug-Debian: https://bugs.debian.org/926229
Bug-Ubuntu: https://bugs.launchpad.net/1822370
Last-Update: 2019-04-08
Patch-Name: revert-ipqos-defaults.patch
commit 9fa2ceb14b6e7e5e902cff416bc9ad3963be9883
Author: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
Date: Tue May 9 10:53:04 2017 -0300
Allow flock and ipc syscall for s390 architecture
In order to use the OpenSSL-ibmpkcs11 engine it is needed to allow flock
and ipc calls, because this engine calls OpenCryptoki (a PKCS#11
implementation) which calls the libraries that will communicate with the
crypto cards. OpenCryptoki makes use of flock and ipc and, as of now,
this is only need on s390 architecture.
Signed-off-by: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
Origin: other, https://bugzilla.mindrot.org/show_bug.cgi?id=2752
Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=2752
Bug-Ubuntu: https://bugs.launchpad.net/bugs/1686618
Last-Update: 2018-10-19
Patch-Name: seccomp-s390-flock-ipc.patch
commit 9c01e0ae9889c05bfe68b2f1f1c5e5019e63ff0b
Author: Colin Watson <cjwatson@debian.org>
Date: Thu Aug 30 00:58:56 2018 +0100
Work around conch interoperability failure
Twisted Conch fails to read private keys in the new format
(https://twistedmatrix.com/trac/ticket/9515). Work around this until it
can be fixed in Twisted.
Forwarded: not-needed
Last-Update: 2018-08-30
Patch-Name: conch-old-privkey-format.patch
commit 1af6147744892b18e2239c085abe87f5408cbaae
Author: Colin Watson <cjwatson@debian.org>
Date: Sun Mar 5 02:02:11 2017 +0000
Restore reading authorized_keys2 by default
Upstream seems to intend to gradually phase this out, so don't assume
that this will remain the default forever. However, we were late in
adopting the upstream sshd_config changes, so it makes sense to extend
the grace period.
Bug-Debian: https://bugs.debian.org/852320
Forwarded: not-needed
Last-Update: 2017-03-05
Patch-Name: restore-authorized_keys2.patch
commit ebd590550bb09fe129b103994d53143788683d05
Author: Colin Watson <cjwatson@debian.org>
Date: Sun Feb 9 16:10:18 2014 +0000
Various Debian-specific configuration changes
ssh: Enable ForwardX11Trusted, returning to earlier semantics which cause
fewer problems with existing setups (http://bugs.debian.org/237021).
ssh: Set 'SendEnv LANG LC_*' by default (http://bugs.debian.org/264024).
ssh: Enable HashKnownHosts by default to try to limit the spread of ssh
worms.
ssh: Enable GSSAPIAuthentication by default.
sshd: Enable PAM, disable ChallengeResponseAuthentication, and disable
PrintMotd.
sshd: Enable X11Forwarding.
sshd: Set 'AcceptEnv LANG LC_*' by default.
sshd: Change sftp subsystem path to /usr/lib/openssh/sftp-server.
Document all of this.
Author: Russ Allbery <rra@debian.org>
Forwarded: not-needed
Last-Update: 2017-10-04
Patch-Name: debian-config.patch
commit a88f67584ef5889d95c04b0294e92c11ed4904cd
Author: Michael Biebl <biebl@debian.org>
Date: Mon Dec 21 16:08:47 2015 +0000
Add systemd readiness notification support
Bug-Debian: https://bugs.debian.org/778913
Forwarded: no
Last-Update: 2017-08-22
Patch-Name: systemd-readiness.patch
commit 601332e5cc1198d6dabddc8168249a81c5dc822a
Author: Vincent Untz <vuntz@ubuntu.com>
Date: Sun Feb 9 16:10:16 2014 +0000
Give the ssh-askpass-gnome window a default icon
Bug-Ubuntu: https://bugs.launchpad.net/bugs/27152
Last-Update: 2010-02-28
Patch-Name: gnome-ssh-askpass2-icon.patch
commit 1f61e987ccec2a2af15044196c1a6730959ead98
Author: Kurt Roeckx <kurt@roeckx.be>
Date: Sun Feb 9 16:10:14 2014 +0000
Don't check the status field of the OpenSSL version
There is no reason to check the version of OpenSSL (in Debian). If it's
not compatible the soname will change. OpenSSH seems to want to do a
check for the soname based on the version number, but wants to keep the
status of the release the same. Remove that check on the status since
it doesn't tell you anything about how compatible that version is.
Author: Colin Watson <cjwatson@debian.org>
Bug-Debian: https://bugs.debian.org/93581
Bug-Debian: https://bugs.debian.org/664383
Bug-Debian: https://bugs.debian.org/732940
Forwarded: not-needed
Last-Update: 2014-10-07
Patch-Name: no-openssl-version-status.patch
commit 9e040aefaefa40bcbe5dcdc0f9f03555cf8fe2d0
Author: Colin Watson <cjwatson@debian.org>
Date: Sun Feb 9 16:10:13 2014 +0000
Document consequences of ssh-agent being setgid in ssh-agent(1)
Bug-Debian: http://bugs.debian.org/711623
Forwarded: no
Last-Update: 2013-06-08
Patch-Name: ssh-agent-setgid.patch
