Dag-Erling Smørgrav
b74df5b26f
Merge conflicts.
2006-03-22 20:41:37 +00:00
Dag-Erling Smørgrav
021d409f5b
Vendor import of OpenSSH 4.3p1.
2006-03-22 19:46:12 +00:00
Dag-Erling Smørgrav
4f87d65874
This commit was generated by cvs2svn to compensate for changes in r157016,
...
which included commits to RCS files with non-trunk default branches.
2006-03-22 19:46:12 +00:00
Ruslan Ermilov
e1fe3dba5c
Reimplementation of world/kernel build options. For details, see:
...
http://lists.freebsd.org/pipermail/freebsd-current/2006-March/061725.html
The src.conf(5) manpage is to follow in a few days.
Brought to you by: imp, jhb, kris, phk, ru (all bugs are mine)
2006-03-17 18:54:44 +00:00
Doug Rabson
c0b9f4fe65
Add a new extensible GSS-API layer which can support GSS-API plugins,
...
similar the the Solaris implementation. Repackage the krb5 GSS mechanism
as a plugin library for the new implementation. This also includes a
comprehensive set of manpages for the GSS-API functions with text mostly
taken from the RFC.
Reviewed by: Love Hörnquist Åstrand <lha@it.su.se>, ru (build system), des (openssh parts)
2005-12-29 14:40:22 +00:00
Dag-Erling Smørgrav
184ad7d3be
Regenerate
2005-09-03 07:08:51 +00:00
Dag-Erling Smørgrav
d4ecd10857
Resolve conflicts.
2005-09-03 07:04:25 +00:00
Dag-Erling Smørgrav
043840df5b
Vendor import of OpenSSH 4.2p1.
2005-09-03 06:59:33 +00:00
Dag-Erling Smørgrav
f8a2a7f14a
This commit was generated by cvs2svn to compensate for changes in r149749,
...
which included commits to RCS files with non-trunk default branches.
2005-09-03 06:59:33 +00:00
Dag-Erling Smørgrav
ad69811c17
fine-tune.
2005-09-03 06:42:11 +00:00
Dag-Erling Smørgrav
c032a2803f
Forgot to bump the version addendum.
2005-06-05 18:30:53 +00:00
Dag-Erling Smørgrav
19bccc89b4
Regenerate.
2005-06-05 15:46:27 +00:00
Dag-Erling Smørgrav
aa49c9264c
Resolve conflicts.
2005-06-05 15:46:09 +00:00
Dag-Erling Smørgrav
6dbd30e786
Update for 4.1p1.
2005-06-05 15:43:57 +00:00
Dag-Erling Smørgrav
4518870c72
Vendor import of OpenSSH 4.1p1.
2005-06-05 15:41:57 +00:00
Dag-Erling Smørgrav
6d014e2f60
This commit was generated by cvs2svn to compensate for changes in r147001,
...
which included commits to RCS files with non-trunk default branches.
2005-06-05 15:41:57 +00:00
Dag-Erling Smørgrav
5e8dbd04ef
Vendor import of OpenSSH 4.0p1.
2005-06-05 15:40:50 +00:00
Dag-Erling Smørgrav
1f6afdc098
This commit was generated by cvs2svn to compensate for changes in r146998,
...
which included commits to RCS files with non-trunk default branches.
2005-06-05 15:40:50 +00:00
Dag-Erling Smørgrav
5bfbdca45a
Rewrite some of the regexps so they don't match themselves.
2005-06-04 23:18:33 +00:00
Dag-Erling Smørgrav
d49dad04cb
Better Xlist command line.
2004-10-28 16:13:28 +00:00
Dag-Erling Smørgrav
21e764df0c
Resolve conflicts
2004-10-28 16:11:31 +00:00
Dag-Erling Smørgrav
d74d50a84b
Vendor import of OpenSSH 3.9p1.
2004-10-28 16:03:53 +00:00
Dag-Erling Smørgrav
3b4228da23
This commit was generated by cvs2svn to compensate for changes in r137015,
...
which included commits to RCS files with non-trunk default branches.
2004-10-28 16:03:53 +00:00
Dag-Erling Smørgrav
39b9ae0d72
These are unnecessary and have been causing imp@ trouble.
2004-10-27 19:07:36 +00:00
Dag-Erling Smørgrav
3c8487013c
Regenerate.
2004-04-20 09:49:37 +00:00
Dag-Erling Smørgrav
cfa59440c5
One more conflict.
2004-04-20 09:47:13 +00:00
Dag-Erling Smørgrav
5962c0e9a3
Resolve conflicts.
2004-04-20 09:46:41 +00:00
Dag-Erling Smørgrav
562de5d9f6
Adjust version number and addendum.
2004-04-20 09:37:29 +00:00
Dag-Erling Smørgrav
52028650db
Vendor import of OpenSSH 3.8.1p1.
2004-04-20 09:35:04 +00:00
Dag-Erling Smørgrav
b247dbc706
This commit was generated by cvs2svn to compensate for changes in r128456,
...
which included commits to RCS files with non-trunk default branches.
2004-04-20 09:35:04 +00:00
Dag-Erling Smørgrav
d2b1b4f3c5
Correctly document the default value of UsePAM.
2004-03-15 18:38:29 +00:00
Dag-Erling Smørgrav
eea81d70c9
Update VersionAddendum in config files and man pages.
2004-02-26 11:54:03 +00:00
Dag-Erling Smørgrav
98e0062102
Define HAVE_GSSAPI_H.
2004-02-26 11:06:29 +00:00
Dag-Erling Smørgrav
7dbb68c469
Regenerate.
2004-02-26 10:57:38 +00:00
Dag-Erling Smørgrav
3ee07a3a90
Document recently changed configuration defaults.
2004-02-26 10:57:28 +00:00
Dag-Erling Smørgrav
1ec0d75429
Resolve conflicts.
2004-02-26 10:52:33 +00:00
Dag-Erling Smørgrav
efcad6b72f
Vendor import of OpenSSH 3.8p1.
2004-02-26 10:38:49 +00:00
Dag-Erling Smørgrav
6b475b41d8
This commit was generated by cvs2svn to compensate for changes in r126274,
...
which included commits to RCS files with non-trunk default branches.
2004-02-26 10:38:49 +00:00
Dag-Erling Smørgrav
476cd3b2f0
Merge OpenSSH 3.8p1.
2004-02-26 10:38:38 +00:00
Dag-Erling Smørgrav
3aedec2adb
Prepare for upcoming 3.8p1 import.
2004-02-26 10:37:34 +00:00
Dag-Erling Smørgrav
028c324ac8
Pull asbesthos underpants on and disable protocol version 1 by default.
2004-02-26 10:24:07 +00:00
Dag-Erling Smørgrav
b909c84bf2
Turn non-PAM password authentication off by default when USE_PAM is
...
defined. Too many users are getting bitten by it.
2004-02-19 15:53:31 +00:00
Dag-Erling Smørgrav
c880b0438e
Update the "overview of FreeBSD changes to OpenSSH-portable" to reflect
...
reality.
2004-01-25 13:09:56 +00:00
Dag-Erling Smørgrav
8d71fed0f2
Work around removal of EAI_NODATA from netdb.h.
2004-01-18 22:31:30 +00:00
Dag-Erling Smørgrav
002696701b
Don't output the terminating '\0' (already fixed in OpenSSH CVS)
2004-01-09 12:57:36 +00:00
Dag-Erling Smørgrav
2735d723cb
This commit was generated by cvs2svn to compensate for changes in r124287,
...
which included commits to RCS files with non-trunk default branches.
2004-01-09 12:57:36 +00:00
Dag-Erling Smørgrav
f0477b2653
Egg on my face: UsePAM was off by default.
...
Pointed out by: Sean McNeil <sean@mcneil.com>
2004-01-09 08:07:12 +00:00
Dag-Erling Smørgrav
a5ac46fb04
Regenerate config.h; I don't know why this didn't hit CVS yesterday.
2004-01-08 09:42:35 +00:00
Dag-Erling Smørgrav
8cf8104b8f
Remove obsolete files on the vendor branch.
2004-01-08 09:33:46 +00:00
Dag-Erling Smørgrav
e2fb0b2a6b
Update to reflect changes since the last version.
2004-01-07 11:51:18 +00:00
Dag-Erling Smørgrav
cf2b5f3b6d
Resolve conflicts and remove obsolete files.
...
Sponsored by: registrar.no
2004-01-07 11:16:27 +00:00
Dag-Erling Smørgrav
d95e11bf7e
Vendor import of OpenSSH 3.7.1p2.
2004-01-07 11:10:17 +00:00
Dag-Erling Smørgrav
fb7dd0a77c
This commit was generated by cvs2svn to compensate for changes in r124208,
...
which included commits to RCS files with non-trunk default branches.
2004-01-07 11:10:17 +00:00
Dag-Erling Smørgrav
221552e490
Merge OpenSSH 3.7.1p2.
2004-01-07 11:10:02 +00:00
Simon L. B. Nielsen
b0a159ccab
Add a missing word.
...
Submitted by: Michel Lavondes <fox@vader.aacc.cc.md.us>
Reviewed by: des
MFC after: 1 week
2003-10-31 21:49:47 +00:00
Dag-Erling Smørgrav
522a040d24
Plug a memory leak in the PAM child process. It is of no great consequence
...
as the process is short-lived, and the leak occurs very rarely and always
shortly before the process terminates.
MFC after: 3 days
2003-10-23 08:27:16 +00:00
Josef Karthauser
dcf5581978
Additional corrections to OpenSSH buffer handling.
...
Obtained from: openssh.org
Originally committed to head by: nectar
2003-09-26 19:15:53 +00:00
Josef Karthauser
a7e41a41f9
This commit was generated by cvs2svn to compensate for changes in r120489,
...
which included commits to RCS files with non-trunk default branches.
2003-09-26 19:15:53 +00:00
Josef Karthauser
3533e7e58a
Additional corrections to OpenSSH buffer handling.
...
Obtained from: openssh.org
Originally committed to head by: nectar
2003-09-26 19:15:53 +00:00
Dag-Erling Smørgrav
44172b702c
Update version string.
2003-09-24 19:20:23 +00:00
Dag-Erling Smørgrav
b584000fa2
Remove bogus calls to xfree().
2003-09-24 19:11:52 +00:00
Dag-Erling Smørgrav
8cc2c63b43
resp is a pointer to an array of structs, not an array of pointers to structs.
2003-09-24 18:26:29 +00:00
Dag-Erling Smørgrav
7961e48467
Return the correct error value when a null query fails.
2003-09-24 18:24:27 +00:00
Dag-Erling Smørgrav
da26b3794a
Fix broken shell code.
2003-09-19 11:29:51 +00:00
Jacques Vidrine
454412956c
Correct more cases of allocation size bookkeeping being updated before
...
calling functions which can potentially fail and cause cleanups to be
invoked.
Submitted by: Solar Designer <solar@openwall.com>
2003-09-17 14:36:14 +00:00
Jacques Vidrine
78ad1843d4
This commit was generated by cvs2svn to compensate for changes in r120161,
...
which included commits to RCS files with non-trunk default branches.
2003-09-17 14:36:14 +00:00
Jacques Vidrine
b69cd7f2b0
Correct more cases of allocation size bookkeeping being updated before
...
calling functions which can potentially fail and cause cleanups to be
invoked.
Submitted by: Solar Designer <solar@openwall.com>
2003-09-17 14:36:14 +00:00
Jacques Vidrine
979af4e167
Update the OpenSSH addendum string for the buffer handling fix.
2003-09-16 14:33:04 +00:00
Jacques Vidrine
8947bcb756
Do not record expanded size before attempting to reallocate associated
...
memory.
Obtained from: OpenBSD
2003-09-16 06:11:58 +00:00
Jacques Vidrine
9267dca39a
This commit was generated by cvs2svn to compensate for changes in r120113,
...
which included commits to RCS files with non-trunk default branches.
2003-09-16 06:11:58 +00:00
Dag-Erling Smørgrav
af8524a91e
Add a "return" that was missing from 3.6.1p1. Since it's been fixed in
...
the OpenSSH-portable CVS repo, I'm committing this on the vendor branch.
2003-06-24 19:30:44 +00:00
Dag-Erling Smørgrav
07e57fee7d
This commit was generated by cvs2svn to compensate for changes in r116791,
...
which included commits to RCS files with non-trunk default branches.
2003-06-24 19:30:44 +00:00
Dag-Erling Smørgrav
da05574c54
Fix off-by-one and initialization errors which prevented sshd from
...
restarting when sent a SIGHUP.
Submitted by: tegge
Approved by: re (jhb)
2003-05-28 19:39:33 +00:00
Dag-Erling Smørgrav
fbafac351f
Revert unnecessary part of previous commit.
2003-05-13 10:18:49 +00:00
Dag-Erling Smørgrav
57f64f4e2f
Rename a few functions to avoid stealing common words (error, log, debug
...
etc.) from the application namespace for programs that use pam_ssh(8).
Use #defines to avoid changing the actual source code.
Approved by: re (rwatson)
2003-05-12 19:22:47 +00:00
Dag-Erling Smørgrav
d12c7b01da
Remove RCSID from files which have no other diffs to the vendor branch.
2003-05-01 15:05:43 +00:00
Dag-Erling Smørgrav
2d61bc6706
Nit.
2003-04-23 17:23:06 +00:00
Dag-Erling Smørgrav
ae48cf5798
Improvements to the proposed shell code.
2003-04-23 17:21:55 +00:00
Dag-Erling Smørgrav
07a3a2906c
Regenerate.
2003-04-23 17:21:27 +00:00
Dag-Erling Smørgrav
e73e9afa91
Resolve conflicts.
2003-04-23 17:13:13 +00:00
Dag-Erling Smørgrav
d0c8c0bcc2
Vendor import of OpenSSH-portable 3.6.1p1.
2003-04-23 16:53:02 +00:00
Dag-Erling Smørgrav
486cd0043e
This commit was generated by cvs2svn to compensate for changes in r113908,
...
which included commits to RCS files with non-trunk default branches.
2003-04-23 16:53:02 +00:00
Dag-Erling Smørgrav
7a94787140
- when using a child process instead of a thread, change the child's
...
name to reflect its role
- try to handle expired passwords a little better
MFC after: 1 week
2003-03-31 13:48:18 +00:00
Dag-Erling Smørgrav
fc0824d97d
If an ssh1 client initiated challenge-response authentication but did
...
not respond to challenge, and later successfully authenticated itself
using another method, the kbdint context would never be released,
leaving the PAM child process behind even after the connection ended.
Fix this by automatically releasing the kbdint context if a packet of
type SSH_CMSG_AUTH_TIS is follwed by anything but a packet of type
SSH_CMSG_AUTH_TIS_RESPONSE.
MFC after: 1 week
2003-03-31 13:45:36 +00:00
Dag-Erling Smørgrav
b7f9a9adc7
Paranoia: instead of a NULL conversation function, use one that always
...
returns PAM_CONV_ERR; moreover, make sure we always have the right
conversation function installed before calling PAM service functions.
Also unwrap some not-so-long lines.
MFC after: 3 days
2003-02-16 11:03:55 +00:00
Dag-Erling Smørgrav
9794bba8a8
document the current default value for VersionAddendum.
2003-02-11 12:11:15 +00:00
Dag-Erling Smørgrav
1e731869b2
Set the ruid to the euid at startup as a workaround for a bug in pam_ssh.
...
MFC after: 3 days
2003-02-07 15:48:27 +00:00
Tom Rhodes
fb256a4a54
The manual page lists only 2 files, however it reads as `three files' which is
...
obviously incorrect.
PR: 46841
Submitted by: Sakamoto Seiji <s-siji@hyper.ocn.ne.jp>
2003-02-05 02:14:03 +00:00
Dag-Erling Smørgrav
2adf4e49c2
Linux-PAM's pam_start(3) fails with a bogus error message if passed the
...
pam_conv argument is NULL. OpenPAM doesn't care, but to make things
easier for people porting this code to other systems (or -STABLE), use
a dummy struct pam_conv instead of NULL.
Pointed out by: Damien Miller <djm@mindrot.org>
2003-02-03 14:10:28 +00:00
Dag-Erling Smørgrav
b946f5e1ff
Bump patch date to 2003-02-01 (the day after I fixed PAM authentication
...
for ssh1)
2003-02-03 11:11:36 +00:00
Dag-Erling Smørgrav
07fd326c9c
Fix keyboard-interactive authentication for ssh1. The problem was twofold:
...
- The PAM kbdint device sometimes doesn't know authentication succeeded
until you re-query it. The ssh1 kbdint code would never re-query the
device, so authentication would always fail. This patch has been
submitted to the OpenSSH developers.
- The monitor code for PAM sometimes forgot to tell the monitor that
authentication had succeeded. This caused the monitor to veto the
privsep child's decision to allow the connection.
These patches have been tested with OpenSSH clients on -STABLE, NetBSD and
Linux, and with ssh.com's ssh1 on Solaris.
Sponsored by: DARPA, NAI Labs
2003-01-31 11:08:07 +00:00
Dag-Erling Smørgrav
84860c33f0
Force early initialization of the resolver library, since the resolver
...
configuration files will no longer be available once sshd is chrooted.
PR: 39953, 40894
Submitted by: dinoex
MFC after: 3 days
2003-01-22 14:12:59 +00:00
Dag-Erling Smørgrav
d46e273b14
The previous commit contained a stupid mistake: ctxt->pam_[cp]sock was
...
initialized after the call to pthread_create() instead of before. It just
happened to work with threads enabled because ctxt is shared, but of
course it doesn't work when we use a child process instead of threads.
2002-12-21 15:09:58 +00:00
Dag-Erling Smørgrav
d953f52834
If possible, use pthreads instead of a child process for PAM.
...
Reimplement the necessary bits from auth_pam.c and auth2_pam.c so that
they share the PAM context used by the keyboard-interactive thread. If
a child process is used instead, they will (necessarily) use a separate
context.
Constify do_pam_account() and do_pam_session().
Sponsored by: DARPA, NAI Labs
2002-12-14 13:52:39 +00:00
Dag-Erling Smørgrav
9be00009ed
Add a missing #include "canohost.h".
2002-12-14 13:48:47 +00:00
Dag-Erling Smørgrav
bdb8839451
Remove code related to the PAMAuthenticationViaKbdInt option (which we've
...
disabled). This removes the only reference to auth2_pam().
2002-12-14 13:48:13 +00:00
Dag-Erling Smørgrav
3600b2f406
Back out a lastlog-related change which is no longer relevant.
2002-12-14 13:40:21 +00:00
Dag-Erling Smørgrav
b6fd52a01d
Fix a rounding error in the block size calculation.
...
Submitted by: tjr
2002-12-14 13:38:49 +00:00
Dag-Erling Smørgrav
5d93b6af54
Since OpenSSH drops privileges before calling pam_open_session(3),
...
pam_lastlog(8) can't possibly work, so let OpenSSH handle lastlog.
Approved by: re (rwatson)
2002-12-03 15:48:11 +00:00
Dag-Erling Smørgrav
810a15b120
Add caveats regarding the effect of PAM on PasswordAuthentication and
...
PermitRootLogin.
PR: docs/43776
MFC after: 1 week
2002-11-06 08:04:56 +00:00
Dag-Erling Smørgrav
dc04779010
Document the current default for VersionAddendum.
2002-11-05 17:25:15 +00:00
Dag-Erling Smørgrav
ee8aeb145a
Accurately reflect our local changes and additions.
2002-11-05 17:24:01 +00:00
Dag-Erling Smørgrav
0061710269
Document the current default value for VersionAddendum.
2002-11-05 17:17:09 +00:00
Dag-Erling Smørgrav
7e4224fafd
Switch to two-clause license, with NAI's permission.
2002-11-02 19:55:23 +00:00
Dag-Erling Smørgrav
f388f5ef26
Resolve conflicts.
2002-10-29 10:16:02 +00:00
Dag-Erling Smørgrav
dd5f4be98b
Protect against tag expansion + fix some brainos.
2002-10-29 10:12:51 +00:00
Dag-Erling Smørgrav
ef8cdc4065
Some tricks I use when I upgrade.
2002-10-29 09:56:16 +00:00
Dag-Erling Smørgrav
d73be2d96a
Correct shell code to expand globs in FREEBSD-Xlist
2002-10-29 09:55:28 +00:00
Dag-Erling Smørgrav
8488d4a48c
More cruft.
2002-10-29 09:54:53 +00:00
Dag-Erling Smørgrav
4b17dab0ba
Vendor import of OpenSSH-portable 3.5p1.
2002-10-29 09:43:00 +00:00
Dag-Erling Smørgrav
a8694a9a06
This commit was generated by cvs2svn to compensate for changes in r106121,
...
which included commits to RCS files with non-trunk default branches.
2002-10-29 09:43:00 +00:00
Hajimu UMEMOTO
7ac3260308
sshd didn't handle actual size of struct sockaddr correctly,
...
and did copy it as long as just size of struct sockaddr. So,
If connection is via IPv6, sshd didn't log hostname into utmp
correctly.
This problem occured only under FreeBSD because of our hack.
However, this is potential problem of OpenSSH-portable, and
they agreed to fix this.
Though, there is no fixed version of OpenSSH-portable available
yet, since this problem is serious for IPv6 users, I commit the
fix.
Reported by: many people
Reviewed by: current@ and stable@ (no objection)
MFC after: 3 days
2002-09-09 16:49:11 +00:00
Jun Kuriyama
b811072634
Fix typo (s@src/crypto/openssh-portable@src/crypto/openssh@).
2002-09-09 02:00:28 +00:00
Andrey A. Chernov
bccd761645
Do login cap calls _before_ descriptors are hardly closed because close may
...
invalidate login cap descriptor.
Reviewed by: des
2002-08-05 16:06:35 +00:00
Tony Finch
f38aa77fc8
Use login_getpwclass() instead of login_getclass() so that the root
...
vs. default login class distinction is made correctly.
PR: 37416
Approved by: des
MFC after: 4 days
2002-07-29 00:36:24 +00:00
Tony Finch
a02377d3e2
FreeBSD doesn't use the host RSA key by default.
...
Reviewed by: des
2002-07-26 15:16:56 +00:00
Andrey A. Chernov
59ac432a4d
Problems addressed:
...
1) options.print_lastlog was not honored.
2) "Last login: ..." was printed twice.
3) "copyright" was not printed
4) No newline was before motd.
Reviewed by: maintainer's silence in 2 weeks (with my constant reminders)
2002-07-26 02:20:00 +00:00
Tony Finch
a9a70dec76
Document the FreeBSD default for CheckHostIP, which was changed in
...
rev 1.2 of readconf.c.
Approved by: des
2002-07-25 15:59:40 +00:00
Dag-Erling Smørgrav
c6b7459669
Whitespace nit.
2002-07-23 17:57:17 +00:00
Dag-Erling Smørgrav
f335483476
In pam_init_ctx(), register a cleanup function that will kill the child
...
process if a fatal error occurs. Deregister it in pam_free_ctx().
2002-07-17 17:44:02 +00:00
Dag-Erling Smørgrav
a9f7d76b96
Use realhostname_sa(3) so the IP address will be used instead of the
...
hostname if the latter is too long for utmp.
Submitted by: ru
MFC after: 3 days
2002-07-11 10:36:10 +00:00
Dag-Erling Smørgrav
77741b874a
Do not try to use PAM for password authentication, as it is
...
already (and far better) supported by the challenge/response
authentication mechanism.
2002-07-10 23:05:13 +00:00
Dag-Erling Smørgrav
645ca8e839
Don't forget to clear the buffer before reusing it.
2002-07-10 23:04:07 +00:00
Dag-Erling Smørgrav
d2030524ec
Rewrite to use the buffer API instead of roll-your-own messaging.
...
Suggested by: Markus Friedl <markus@openbsd.org>
Sponsored by: DARPA, NAI Labs
2002-07-05 15:27:26 +00:00
Dag-Erling Smørgrav
21f19a0cbf
(forgot to commit) We don't need --with-opie since PAM takes care of it.
2002-07-05 15:25:55 +00:00
Dag-Erling Smørgrav
b770f258b3
- Don't enable OpenSSH's OPIE support, since we let PAM handle OPIE.
...
- We don't have setutent(3) etc., and I have no idea why configure ever
thought we did.
2002-07-03 00:12:09 +00:00
Dag-Erling Smørgrav
53282320d1
Two FreeBSD-specific nits in comments:
...
- ChallengeResponseAuthentication controls PAM, not S/Key
- We don't honor PAMAuthenticationViaKbdInt, because the code path it
controls doesn't make sense for us, so don't mention it.
Sponsored by: DARPA, NAI Labs
2002-07-03 00:08:19 +00:00
Dag-Erling Smørgrav
9f95720321
Version bump for mm_answer_pam_respond() fix.
2002-07-02 13:07:37 +00:00
Dag-Erling Smørgrav
669e440e50
Fix a braino in mm_answer_pam_respond() which would cause sshd to abort if
...
PAM authentication failed due to an incorrect response.
2002-07-02 13:07:17 +00:00
Dag-Erling Smørgrav
9a97937550
Forgot to update the addendum in the config files.
2002-06-30 10:32:09 +00:00
Dag-Erling Smørgrav
e12c24615a
Regenerate.
2002-06-29 11:58:32 +00:00
Dag-Erling Smørgrav
076b29c735
<sys/mman.h> requires <sys/types.h>.
2002-06-29 11:57:51 +00:00
Dag-Erling Smørgrav
a82e551f0f
Resolve conflicts.
...
Sponsored by: DARPA, NAI Labs
2002-06-29 11:48:59 +00:00
Dag-Erling Smørgrav
ee21a45f81
Vendor import of OpenSSH 3.4p1.
2002-06-29 11:34:13 +00:00
Dag-Erling Smørgrav
d2a34caedb
This commit was generated by cvs2svn to compensate for changes in r99060,
...
which included commits to RCS files with non-trunk default branches.
2002-06-29 11:34:13 +00:00
Dag-Erling Smørgrav
effdee7ce0
Commit config.h so we don't need autoconf to build world.
2002-06-29 11:31:02 +00:00
Dag-Erling Smørgrav
0ff2975460
OpenBSD lifted this code our tree. Preserve the original CVS id.
2002-06-29 11:25:20 +00:00
Dag-Erling Smørgrav
9e1547ea49
Use our __RCSID().
2002-06-29 11:22:20 +00:00
Dag-Erling Smørgrav
c62005fc13
Make sure the environment variables set by setusercontext() are passed on
...
to the child process.
Reviewed by: ache
Sponsored by: DARPA, NAI Labs
2002-06-29 11:21:58 +00:00
Dag-Erling Smørgrav
bf2e2524a2
Canonicize the host name before looking it up in the host file.
...
Sponsored by: DARPA, NAI Labs
2002-06-29 10:57:53 +00:00
Dag-Erling Smørgrav
5b400a39b8
Apply class-imposed login restrictions.
...
Sponsored by: DARPA, NAI Labs
2002-06-29 10:57:13 +00:00
Dag-Erling Smørgrav
382d19ee61
PAM support, the FreeBSD way.
...
Sponsored by: DARPA, NAI Labs
2002-06-29 10:56:23 +00:00
Dag-Erling Smørgrav
1f334c7bc7
Document FreeBSD defaults.
...
Sponsored by: DARPA, NAI Labs
2002-06-29 10:55:18 +00:00
Dag-Erling Smørgrav
35d4ccfb55
Document FreeBSD defaults and paths.
...
Sponsored by: DARPA, NAI Labs
2002-06-29 10:53:57 +00:00
Dag-Erling Smørgrav
3d48a988f6
Remove duplicate.
2002-06-29 10:52:42 +00:00
Dag-Erling Smørgrav
975616f046
Apply FreeBSD's configuration defaults.
...
Sponsored by: DARPA, NAI Labs
2002-06-29 10:51:56 +00:00
Dag-Erling Smørgrav
db58a8e40c
Add the VersionAddendum configuration variable.
...
Sponsored by: DARPA, NAI Labs
2002-06-29 10:49:57 +00:00
Dag-Erling Smørgrav
edb557f8bb
Support OPIE as an alternative to S/Key.
...
Sponsored by: DARPA, NAI Labs
2002-06-29 10:44:37 +00:00
Dag-Erling Smørgrav
ba11afcc21
Document the upgrade process.
2002-06-29 10:39:14 +00:00
Dag-Erling Smørgrav
2e3e4630c5
Files we don't want to import.
2002-06-29 10:39:02 +00:00
Dag-Erling Smørgrav
989dd127e4
Forcibly revert to mainline.
2002-06-27 22:42:11 +00:00
Dag-Erling Smørgrav
83d2307d00
Vendor import of OpenSSH 3.3p1.
2002-06-27 22:31:32 +00:00
Dag-Erling Smørgrav
db5fd092db
This commit was generated by cvs2svn to compensate for changes in r98937,
...
which included commits to RCS files with non-trunk default branches.
2002-06-27 22:31:32 +00:00
Dirk Meyer
742e9f76c3
remove declaration of authlog
...
use variable from_host
Reviewed by: des
2002-06-24 11:11:30 +00:00
Dag-Erling Smørgrav
ccc9bac89c
IPv4or6 is already defined in libssh.
2002-06-24 10:15:26 +00:00
Dag-Erling Smørgrav
614c49a910
Resolve conflicts and document local changes.
2002-06-23 21:42:47 +00:00
Dag-Erling Smørgrav
6f562d4003
Correctly export the environment variables set by setusercontext().
...
Sponsored by: DARPA, NAI Labs
2002-06-23 20:22:49 +00:00
Dag-Erling Smørgrav
80628bacb0
Resolve conflicts. Known issues:
...
- sshd fails to set TERM correctly.
- privilege separation may break PAM and is currently turned off.
- man pages have not yet been updated
I will have these issues resolved, and privilege separation turned on by
default, in time for DP2.
Sponsored by: DARPA, NAI Labs
2002-06-23 16:09:08 +00:00
Dag-Erling Smørgrav
545d5eca42
Vendor import of OpenSSH 3.3.
2002-06-23 14:01:54 +00:00
Dag-Erling Smørgrav
f6342a9bad
This commit was generated by cvs2svn to compensate for changes in r98675,
...
which included commits to RCS files with non-trunk default branches.
2002-06-23 14:01:54 +00:00
Chris D. Faulhaber
c2fc1c7365
Remove _PATH_CP now that it is defined in paths.h
...
Reviewed by: des
2002-05-12 01:52:11 +00:00
David E. O'Brien
259bbc7376
Usual after-import fixup of SCM IDs.
2002-05-01 22:39:53 +00:00
Dag-Erling Smørgrav
8024187191
Back out previous commit.
2002-04-25 16:53:25 +00:00
Jordan K. Hubbard
44493e088a
Change default challenge/response behavior of sshd by popular demand.
...
This brings us into sync with the behavior of sshd on other Unix platforms.
Submitted by: Joshua Goodall <joshua@roughtrade.net>
2002-04-25 05:59:53 +00:00
Andrey A. Chernov
098de0c172
1) Proberly conditionalize PAM "last login" printout.
...
2) For "copyright" case #ifdef HAVE_LOGIN_CAP was placed on too big block,
narrow it down.
3) Don't check the same conditions twice (for "copyright" and "welcome"),
put them under single block.
4) Print \n between "copyright" and "welcome" as our login does.
Reviewed by: des (1)
2002-04-23 12:36:11 +00:00
Dag-Erling Smørgrav
6e8ced7fd0
Don't report last login time in PAM case. (perforce change 10057)
...
Sponsored by: DARPA, NAI Labs
2002-04-22 06:26:29 +00:00
Dag-Erling Smørgrav
a5763cd1f0
Fix warnings + wait for child so it doesn't go zombie (perforce change 10122)
2002-04-22 06:25:13 +00:00
Andrey A. Chernov
940bc501bd
Move LOGIN_CAP calls before all file descriptors are closed hard, since some
...
descriptors may be used by LOGIN_CAP internally, add login_close().
Use "nocheckmail" LOGIN_CAP capability too like our login does.
2002-04-21 13:31:56 +00:00
Andrey A. Chernov
a37da82a78
Fix TZ & TERM handling for use_login case of rev. 1.24
2002-04-20 09:56:10 +00:00
Andrey A. Chernov
b36e10eee6
1) Surprisingly, "CheckMail" handling code completely removed from this
...
version, so documented "CheckMail" option exists but does nothing.
Bring it back to life adding code back.
2) Cosmetique. Reduce number of args in do_setusercontext()
2002-04-20 09:26:43 +00:00
Andrey A. Chernov
32eb065e64
1) Fix overlook in my prev. commit - forget HAVE_ prefix in one place in old
...
code merge.
2) In addition honor "timezone" and "term" capabilities from login.conf,
not overwrite them once they set (they are TZ and TERM variables).
2002-04-20 05:44:36 +00:00
Andrey A. Chernov
03df31a6fc
Please repeat after me: setusercontext() modifies _current_ environment, but
...
sshd uses separate child_env. So, to make setusercontext() really does
something, environment must be switched before call and passed to child_env
back after it.
The error here was that modified environment not passed back to child_env,
so all variables that setusercontext() adds are lost, including ones from
~/.login_conf
2002-04-20 04:38:07 +00:00
Dag-Erling Smørgrav
ca99146106
Fix some warnings. Don't record logins twice in USE_PAM case. Strip
...
"/dev/" off the tty name before passing it to auth_ttyok or PAM.
Inspired by: dinoex
Sponsored by: DARPA, NAI Labs
2002-04-14 16:24:36 +00:00
Dag-Erling Smørgrav
cd3dfe6d6e
Back out previous backout. It seems I was right to begin with, and DSA is
...
preferrable to RSA (not least because the SECSH draft standard requires
DSA while RSA is only recommended).
2002-04-12 15:52:10 +00:00
Dag-Erling Smørgrav
8f8855cff0
Knowledgeable persons assure me that RSA is preferable to DSA and that we
...
should transition away from DSA.
2002-04-11 22:04:40 +00:00
Dag-Erling Smørgrav
6cef489c5c
Prefer DSA to RSA if both are available.
2002-04-11 16:08:48 +00:00
Dag-Erling Smørgrav
9c0adca3e7
Do not attempt to load an ssh2 RSA host key by default.
2002-04-11 16:08:02 +00:00
Ruslan Ermilov
f2f306b622
Align for const poisoning in -lutil.
2002-04-08 11:07:51 +00:00
Dag-Erling Smørgrav
5e022fc6f0
Nuke stale copy of the pam_ssh(8) source code.
2002-04-06 04:46:01 +00:00
Dag-Erling Smørgrav
5297e48d04
Revert to vendor version, what little was left of our local patches here
...
was incorrect.
Pointed out by: Markus Friedl <markus@openbsd.org>
2002-04-02 23:07:31 +00:00
Dag-Erling Smørgrav
43e73ba0c2
Change the FreeBSD version addendum to "FreeBSD-20020402". This shortens
...
the version string to 28 characters, which is below the 40-character limit
specified in the proposed SECSH standard. Some servers, however (like the
one built into the Foundry BigIron line of switches) will hang when
confronted with a version string longer than 24 characters, so some users
may need to shorten it further.
Sponsored by: DARPA, NAI Labs
2002-04-02 21:53:54 +00:00
Dag-Erling Smørgrav
9e2cbe04ff
Make the various ssh clients understand the VersionAddendum option.
...
Submitted by: pb
2002-04-02 21:48:51 +00:00
Ruslan Ermilov
2735cfee64
Switch over to using pam_login_access(8) module in sshd(8).
...
(Fixes static compilation. Reduces diffs to OpenSSH.)
Reviewed by: bde
2002-03-26 12:52:28 +00:00
Jacques Vidrine
7fd1ca3b0c
REALLY correct typo this time.
...
Noticed by: roam
2002-03-26 12:27:43 +00:00
Jacques Vidrine
26241f6368
Fix typo (missing paren) affecting KRB4 && KRB5 case.
...
Approved by: des
2002-03-25 14:55:41 +00:00
Dag-Erling Smørgrav
f0cf488b75
We keep moduli(5) in /etc/ssh, not /etc.
2002-03-23 19:26:21 +00:00
Dag-Erling Smørgrav
6b11d510fd
Correctly set PAM_RHOST so e.g. pam_login_access(8) can do its job.
...
Sponsored by: DARPA, NAI Labs
2002-03-21 12:55:21 +00:00
Dag-Erling Smørgrav
fe49ecbc93
Use the "sshd" service instead of "csshd". The latter was only needed
...
because of bugs (incorrect design decisions, actually) in Linux-PAM.
Sponsored by: DARPA, NAI Labs
2002-03-21 12:23:09 +00:00
cvs2svn
556a3fb01e
This commit was manufactured by cvs2svn to create branch
...
'VENDOR-crypto-openssh'.
2002-03-21 12:18:28 +00:00
Dag-Erling Smørgrav
da4dc1eeb5
Use PAM instead of S/Key (or OPIE) for SSH2.
...
Sponsored by: DARPA, NAI Labs
2002-03-21 12:18:27 +00:00
Dag-Erling Smørgrav
97ec1da11a
Note that portions of this software were
...
Sponsored by: DARPA, NAI Labs
2002-03-20 22:10:10 +00:00
Dag-Erling Smørgrav
3a17de1501
- Change the prompt from "S/Key Password: " to "OPIE Password: "
...
- If the user doesn't have an OPIE key, don't challenge him. This is
a workaround until I get PAM to work properly with ssh2.
Sponsored by: DARPA, NAI Labs
2002-03-20 22:02:02 +00:00
Dag-Erling Smørgrav
1d9e2b0ad5
Unbreak for KRB4 ^ KRB5 case.
...
Sponsored by: DARPA, NAI Labs
2002-03-19 16:44:11 +00:00
Dag-Erling Smørgrav
8bf26f5d41
Revive this file (which is used for opie rather than skey)
2002-03-18 10:31:33 +00:00
Dag-Erling Smørgrav
af12a3e74a
Fix conflicts.
2002-03-18 10:09:43 +00:00
Dag-Erling Smørgrav
ae1f160d56
Vendor import of OpenSSH 3.1
2002-03-18 09:55:03 +00:00
Dag-Erling Smørgrav
996836565f
This commit was generated by cvs2svn to compensate for changes in r92555,
...
which included commits to RCS files with non-trunk default branches.
2002-03-18 09:55:03 +00:00
Dag-Erling Smørgrav
a681ab0abe
Diff reduction.
...
Sponsored by: DARPA, NAI Labs
2002-03-16 08:03:48 +00:00
Jacques Vidrine
1acac5eba8
Update version string.
2002-03-07 14:36:28 +00:00
Jacques Vidrine
d96f3089f2
Fix off-by-one error.
...
Obtained from: OpenBSD
2002-03-05 14:27:19 +00:00
Brian Feldman
885a59f2e0
Use login_getpwclass() instead of login_getclass() so that default
...
mapping of user login classes works.
Obtained from: TrustedBSD project
Sponsored by: DARPA, NAI Labs
2002-02-27 22:36:30 +00:00
Ruslan Ermilov
fd4ca9e02d
Make libssh.so useable (undefined reference to IPv4or6).
...
Reviewed by: des, markm
Approved by: markm
2002-01-23 15:06:47 +00:00
Brian Feldman
27e5f9f620
Fix a coredump bug occurring if ssh-keygen attempts to change the password
...
on a DSA key.
Submitted by: ian j hart <ianjhart@ntlworld.com>
2002-01-07 15:55:20 +00:00
Jacques Vidrine
eb5bc300e8
Update version string since we applied a fix for the UseLogin issue.
2001-12-03 22:47:51 +00:00
Jacques Vidrine
1c5093bbbc
Do not pass user-defined environmental variables to /usr/bin/login.
...
Obtained from: OpenBSD
Approved by: green
2001-12-03 00:51:47 +00:00
David Malone
46fdbb8ad4
In the "UseLogin yes" case we need env to be NULL to make sure it
...
will be correctly initialised.
PR: 32065
Tested by: The Anarcat <anarcat@anarcat.dyndns.org>
MFC after: 3 days
2001-11-19 19:40:14 +00:00
Brian Feldman
ccf35be189
Modify a "You don't exist" message, pretty rude for transient YP failures.
2001-09-27 18:54:42 +00:00
Assar Westerlund
1f131ac4bd
fix renamed options in some of the code that was #ifdef AFS
...
also print an error if krb5 ticket passing is disabled
Submitted by: Jonathan Chen <jon@spock.org>
2001-09-04 13:27:04 +00:00
Paul Saab
20a18c35f4
Backout last change. I didnt follow the thread and made a mistake
...
with this. localisations is a valid spelling. Oops
2001-08-27 10:37:50 +00:00
Paul Saab
95576c53ef
Correctly spell localizations
2001-08-27 10:20:02 +00:00
Brian Feldman
0e513252b5
Update the OpenSSH minor-version string.
...
Requested by: obrien
Reviewed by: rwatson
2001-08-16 19:26:19 +00:00
Jacques Vidrine
b33edd3956
Bug fix: When the client connects to a server and Kerberos
...
authentication is enabled, the client effectively ignores any error
from krb5_rd_rep due to a missing branch.
In theory this could result in an ssh client using Kerberos 5
authentication accepting a spoofed AP-REP. I doubt this is a real
possiblity, however, because the AP-REP is passed from the server to
the client via the SSH encrypted channel. Any tampering should cause
the decryption or MAC to fail.
Approved by: green
MFC after: 1 week
2001-07-13 18:12:13 +00:00
Brian Feldman
d9769eeead
Fix an incorrect conflict resolution which prevented TISAuthentication
...
from working right in 2.9.
2001-07-07 14:19:53 +00:00
Brian Feldman
a15906e7aa
Also add a colon to "Bad passphrase, please try again ".
2001-06-29 16:43:13 +00:00
Brian Feldman
69b8e053cb
Put in a missing colon in the "Enter passphrase" message.
2001-06-29 16:34:14 +00:00
Brian Feldman
0c82706bc0
Back out the last change which is probably actually a red herring. Argh!
2001-06-26 15:15:22 +00:00
Brian Feldman
c3e2f3baec
Don't pointlessly kill a channel because the first (forced)
...
non-blocking read returns 0.
Now I can finally tunnel CVSUP again...
2001-06-26 14:17:35 +00:00
Assar Westerlund
07de0e4353
(do_authloop): handle !KRB4 && KRB5
2001-06-16 07:44:17 +00:00
Mark Murray
7e40a391bc
Unbreak OpenSSH for the KRB5-and-no-KRB4 case. Asking for KRB5 does
...
not imply that you want, need or have kerberosIV headers.
2001-06-15 08:12:31 +00:00
Brian Feldman
e7edf5a116
Enable Kerberos 5 support in sshd again.
2001-06-12 03:43:47 +00:00
Brian Feldman
e9fd63dfdd
Switch to the user's uid before attempting to unlink the auth forwarding
...
file, nullifying the effects of a race.
Obtained from: OpenBSD
2001-06-08 22:22:09 +00:00
David E. O'Brien
e8f64f5ebf
Fix $FreeBSD$ style committer messed up in rev 1.7 for some reason.
2001-05-24 07:22:08 +00:00
David E. O'Brien
d3ebe37cd0
Restore the RSA host key to /etc/ssh/ssh_host_key.
...
Also fix $FreeBSD$ spamage in crypto/openssh/sshd_config rev. 1.16.
2001-05-18 18:10:02 +00:00
Brian Feldman
62c931e0a4
If a host would exceed 16 characters in the utmp entry, record only
...
it's IP address/base host instead.
Submitted by: brian
2001-05-15 01:50:40 +00:00
Ruslan Ermilov
bb60401e7a
mdoc(7) police: finished fixing conflicts in revision 1.18.
2001-05-14 18:13:34 +00:00
Mark Murray
fa83754c4e
Fix make world in the kerberosIV case.
2001-05-11 09:36:17 +00:00
Alfred Perlstein
2c917d39b2
Fix some of the handling in the pam module, don't unregister things
...
that were never registered. At the same time handle a failure from
pam_setcreds with a bit more paranioa than the previous fix.
Sync a bit with the "Portable OpenSSH" work to make comparisons a easier.
2001-05-09 03:40:37 +00:00
Brian Feldman
00e38eaf7f
Since PAM is broken, let pam_setcred() failure be non-fatal.
2001-05-08 22:30:18 +00:00
Brian Feldman
3817a12c9b
sshd_config should still be keeping ssh host keys in /etc/ssh, not /etc.
2001-05-05 13:48:13 +00:00
Brian Feldman
4c5de86978
Finish committing _more_ somehow-uncommitted OpenSSH 2.9 updates.
...
(Missing Delta Brigade, tally-ho!)
2001-05-05 01:12:45 +00:00
Brian Feldman
87767895f0
Get ssh(1) compiling with MAKE_KERBEROS5.
2001-05-04 04:37:49 +00:00
Brian Feldman
345012bf8b
Remove obsoleted files.
2001-05-04 04:15:22 +00:00
Brian Feldman
ca3176e7c8
Fix conflicts for OpenSSH 2.9.
2001-05-04 04:14:23 +00:00
Brian Feldman
1e8db6e2f6
Say "hi" to the latest in the OpenSSH series, version 2.9!
...
Happy birthday to: rwatson
2001-05-04 03:57:05 +00:00
Brian Feldman
3ed16d1511
This commit was generated by cvs2svn to compensate for changes in r76259,
...
which included commits to RCS files with non-trunk default branches.
2001-05-04 03:57:05 +00:00
Brian Feldman
933ca70f8f
Add a "VersionAddendum" configuration setting for sshd which allows
...
anyone to easily change the part of the OpenSSH version after the main
version number. The FreeBSD-specific version banner could be disabled
that way, for example:
# Call ourselves plain OpenSSH
VersionAddendum
2001-05-03 00:29:28 +00:00
Brian Feldman
1f5ce8f412
Backout completely canonical lookup modifications.
2001-05-03 00:26:47 +00:00
Brian Feldman
313cb084c4
Suggested by kris, OpenSSH shall have a version designated to note that
...
it's not "plain" OpenSSH 2.3.0.
2001-03-20 02:11:25 +00:00
Brian Feldman
e0fbb1d2de
Make password attacks based on traffic analysis harder by requiring that
...
"non-echoed" characters are still echoed back in a null packet, as well
as pad passwords sent to not give hints to the length otherwise.
Obtained from: OpenBSD
2001-03-20 02:06:40 +00:00
Jeroen Ruigrok van der Werven
f7191d4fae
Fix double mention of ssh.
...
This file is already off the vendorbranch, nonetheless it needs to be
submitted back to the OpenSSH people.
PR: 25743
Submitted by: David Wolfskill <dhw@whistle.com>
2001-03-15 09:24:40 +00:00
Brian Feldman
e4fe1ca667
Don't dump core when an attempt is made to login using protocol 2 with
...
an invalid user name.
2001-03-15 03:15:18 +00:00
Assar Westerlund
aeccfe991a
(try_krb5_authentication): simplify code. from joda@netbsd.org
2001-03-13 04:42:38 +00:00
Assar Westerlund
a16a9b0f1e
Fix LP64 problem in Kerberos 5 TGT passing.
...
Obtained from: NetBSD (done by thorpej@netbsd.org )
2001-03-12 08:14:22 +00:00
Brian Feldman
46c9472cd6
Reenable the SIGPIPE signal handler default in all cases for spawned
...
sessions.
2001-03-11 02:26:57 +00:00
Assar Westerlund
cb96ab3672
Add code for being compatible with ssh.com's krb5 authentication.
...
It is done by using the same ssh messages for v4 and v5 authentication
(since the ssh.com does not now anything about v4) and looking at the
contents after unpacking it to see if it is v4 or v5.
Based on code from Björn Grönvall <bg@sics.se>
PR: misc/20504
2001-03-04 02:22:04 +00:00
Paul Saab
8e97fe726f
Make ConnectionsPerPeriod non-fatal for real.
2001-02-18 01:33:31 +00:00
Assar Westerlund
c9e3f8cfb9
update to new heimdal libkrb5
2001-02-13 16:58:04 +00:00
Kris Kennaway
a09221f83c
Patches backported from later development version of OpenSSH which prevent
...
(instead of just mitigating through connection limits) the Bleichenbacher
attack which can lead to guessing of the server key (not host key) by
regenerating it when an RSA failure is detected.
Reviewed by: rwatson
2001-02-12 06:44:51 +00:00
Brian Feldman
ffd692be66
Correctly fill in the sun_len for a sockaddr_sun.
...
Submitted by: Alexander Leidinger <Alexander@leidinger.net>
2001-02-04 20:23:17 +00:00
Brian Feldman
a61d605eda
MFS: Don't use the canonical hostname here, too.
2001-02-04 20:16:14 +00:00
Brian Feldman
895b03b1e8
MFF: Make ConnectionsPerPeriod usage a warning, not fatal.
2001-02-04 20:15:53 +00:00
Brian Feldman
926581ede3
Actually propagate back to the rest of the application that a command
...
was specified when using -t mode with the SSH client.
Submitted by: Dima Dorfman <dima@unixfreak.org>
2001-01-21 05:45:27 +00:00
Brian Feldman
ea0187039a
/Really/ deprecate ConnectionsPerPeriod, ripping out the code for it
...
and giving a dire error to its lingering users.
2001-01-13 07:57:43 +00:00
Brian Feldman
39567f8cee
Fix a long-standing bug that resulted in a dropped session sometimes
...
when an X11-forwarded client was closed. For some reason, sshd didn't
disable the SIGPIPE exit handler and died a horrible death (well, okay,
a silent death really). Set SIGPIPE's handler to SIG_IGN.
2001-01-06 21:15:07 +00:00
Brian Feldman
099584266b
Update to OpenSSH 2.3.0 with FreeBSD modifications. OpenSSH 2.3.0
...
new features description elided in favor of checking out their
website.
Important new FreeBSD-version stuff: PAM support has been worked
in, partially from the "Unix" OpenSSH version, and a lot due to the
work of Eivind Eklend, too.
This requires at least the following in pam.conf:
sshd auth sufficient pam_skey.so
sshd auth required pam_unix.so try_first_pass
sshd session required pam_permit.so
Parts by: Eivind Eklend <eivind@FreeBSD.org>
2000-12-05 02:55:12 +00:00
Brian Feldman
386879a128
Forgot to remove the old line in the last commit.
2000-12-05 02:41:01 +00:00
Brian Feldman
5b9b2fafd4
Import of OpenSSH 2.3.0 (virgin OpenBSD source release).
2000-12-05 02:20:19 +00:00
Brian Feldman
803a607983
This commit was generated by cvs2svn to compensate for changes in r69587,
...
which included commits to RCS files with non-trunk default branches.
2000-12-05 02:20:19 +00:00
Brian Somers
3c3d69579f
Remove duplicate line
...
Not responded to by: kris, then green
2000-12-04 22:57:53 +00:00
Brian Feldman
ee510eab3f
In env_destroy(), it is a bad idea to env_swap(self, 0) to switch
...
back to the original environ unconditionally. The setting of the
variable to save the previous environ is conditional; it happens when
ENV.e_committed is set. Therefore, don't try to swap the env back
unless the previous env has been initialized.
PR: bin/22670
Submitted by: Takanori Saneto <sanewo@ba2.so-net.ne.jp>
2000-11-25 02:00:35 +00:00
Bill Fumerola
2a644691bc
Correct an arguement to ssh_add_identity, this matches what is currently
...
in ports/security/openssh/files/pam_ssh.c
PR: 22164
Submitted by: Takanori Saneto <sanewo@ba2.so-net.ne.jp>
Reviewed by: green
Approved by: green
2000-11-25 01:55:42 +00:00
Brian Feldman
03e72be8c8
Add login_cap and login_access support. Previously, these FreeBSD-local
...
checks were only made when using the 1.x protocol.
2000-11-14 04:35:03 +00:00
Brian Feldman
4899dde749
Import a security fix: the client would allow a server to use its
...
ssh-agent or X11 forwarding even if it was disabled.
This is the vendor fix provided, not an actual revision of clientloop.c.
Submitted by: Markus Friedl <markus@OpenBSD.org> via kris
2000-11-14 03:51:53 +00:00
Brian Feldman
786df71457
This commit was generated by cvs2svn to compensate for changes in r68700,
...
which included commits to RCS files with non-trunk default branches.
2000-11-14 03:51:53 +00:00
Brian Feldman
4a950c224b
Fix a few style oddities.
2000-09-10 18:04:12 +00:00
Brian Feldman
dd5f9dffd6
Fix a goof in timevaldiff.
2000-09-10 18:03:46 +00:00
Kris Kennaway
b8c2df609a
Remove files no longer present in OpenSSH 2.2.0 and beyond
2000-09-10 10:26:07 +00:00
Kris Kennaway
c2d3a5594b
Resolve conflicts and update for OpenSSH 2.2.0
...
Reviewed by: gshapiro, peter, green
2000-09-10 09:35:38 +00:00
Kris Kennaway
b66f2d16a0
Initial import of OpenSSH post-2.2.0 snapshot dated 2000-09-09
2000-09-10 08:31:17 +00:00
Kris Kennaway
c7b5135400
This commit was generated by cvs2svn to compensate for changes in r65668,
...
which included commits to RCS files with non-trunk default branches.
2000-09-10 08:31:17 +00:00
Kris Kennaway
690a362571
Nuke RSAREF support from orbit.
...
It's the only way to be sure.
2000-09-10 00:09:37 +00:00
Kris Kennaway
5ed779ad1e
ttyname was not being passed into do_login(), so we were erroneously picking
...
up the function definition from unistd.h instead. Use s->tty instead.
Submitted by: peter
2000-09-04 08:43:05 +00:00
Kris Kennaway
cabf13fcdb
bzero() the struct timeval for paranoia
...
Submitted by: gshapiro
2000-09-03 07:58:35 +00:00
Kris Kennaway
939c32909c
Err, we weren't even compiling auth1.c with LOGIN_CAP at all. Guess nobody
...
was using this feature.
2000-09-02 07:32:05 +00:00
Kris Kennaway
80bbcbe344
Repair a broken conflict resolution in r1.2 which had the effect of nullifying
...
the login_cap and login.access checks for whether a user/host is allowed
access to the system for users other than root. But since we currently don't
have a similar check in the ssh2 code path anyway, it's um, "okay".
Submitted by: gshapiro
2000-09-02 05:40:50 +00:00
Kris Kennaway
14ef7e2794
Repair my dyslexia: s/opt/otp/ in the OPIE challenge. D'oh!
...
Submitted by: gshapiro
2000-09-02 04:41:33 +00:00
Kris Kennaway
ac70abf4bc
Re-add missing "break" which was lost during a previous patch
...
integration. This currently has no effect.
Submitted by: gshapiro
2000-09-02 04:37:51 +00:00
Kris Kennaway
1610cd7fa6
Turn on X11Forwarding by default on the server. Any risk is to the client,
...
where it is already disabled by default.
Reminded by: peter
2000-09-02 03:49:22 +00:00
Kris Kennaway
b87db7cec0
Increase the default value of LoginGraceTime from 60 seconds to 120
...
seconds.
PR: 20488
Submitted by: rwatson
2000-08-23 09:47:25 +00:00
Kris Kennaway
4d858ef441
Respect X11BASE to derive the location of xauth(1)
...
PR: 17818
Submitted by: Bjoern Fischer <bfischer@Techfak.Uni-Bielefeld.DE>
2000-08-23 09:39:20 +00:00
Jeroen Ruigrok van der Werven
f30cce5c6c
Chalk up another phkmalloc victim.
...
It seems as if uninitialised memory was the culprit.
We may want to contribute this back to the OpenSSH project.
Submitted by: Alexander Leidinger <Alexander@Leidinger.net> on -current.
2000-08-01 08:07:15 +00:00
Jeroen Ruigrok van der Werven
870fb37275
Fix a weird typo, is -> are.
...
The OpenSSH maintainer probably want to contribute this back to the
real OpenSSH guys.
Submitted by: Jon Perkin <sketchy@netcraft.com>
2000-07-27 19:21:15 +00:00
Mark Ovens
85ea01646c
Fixed a minor typo in the header.
...
Pointed out by: asmodai
2000-07-27 17:21:07 +00:00
Mark Ovens
2abceb0402
Committed, Thanks!!
...
PR: 20108
Submitted by: Doug Lee
2000-07-25 16:49:48 +00:00
Peter Wemm
365c420eb1
Sync sshd_config with sshd and manapage internal defaults (Checkmail = yes)
2000-07-11 09:54:24 +00:00
Peter Wemm
44de2297a4
Sync LoginGraceTime with sshd_config = 60 seconds by default, not 600.
2000-07-11 09:52:14 +00:00
Peter Wemm
e213d985b2
Fix out-of-sync defaults. PermitRootLogin is supposed to be 'no' but
...
sshd's internal default was 'yes'. (if some cracker managed to trash
/etc/ssh/sshd_config, then root logins could be reactivated)
Approved by: kris
2000-07-11 09:50:15 +00:00
Peter Wemm
a3d6796930
Make FallBackToRsh off by default. Falling back to rsh by default is
...
silly in this day and age.
Approved by: kris
2000-07-11 09:39:34 +00:00
Brian Feldman
c8ef594c0f
Allow restarting on SIGHUP when the full path was not given as argv[0].
...
We do have /proc/curproc/file :)
2000-07-04 06:43:26 +00:00
Brian Feldman
21deafa350
So /this/ is what has made OpenSSH's SSHv2 support never work right!
...
In some cases, limits did not get set to the proper class, but
instead always to "default", because not all passwd copies were
done to completion.
2000-06-27 21:16:06 +00:00
Brian Feldman
c342fc930b
Also make sure to close the socket that exceeds your rate limit.
2000-06-26 23:39:26 +00:00
Brian Feldman
7e03cf33e9
Make rate limiting work per-listening-socket. Log better messages than
...
before for this, requiring a new function (get_ipaddr()). canohost.c
receives a $FreeBSD$ line.
Suggested by: Niels Provos <niels@OpenBSD.org>
2000-06-26 05:44:23 +00:00
Kris Kennaway
fb633b3056
Fix syntax error in previous commit.
...
Submitted by: Udo Schweigert <ust@cert.siemens.de>
2000-06-11 21:41:25 +00:00
Kris Kennaway
95e2a710ad
Fix security botch in "UseLogin Yes" case: commands are executed with
...
uid 0.
Obtained from: OpenBSD
2000-06-10 22:32:57 +00:00
Ruslan Ermilov
b3ba283ebe
Make `ssh-agent -k' work for csh(1)-like shells.
2000-06-10 14:14:28 +00:00
Brian Feldman
2803b77e52
Allow "DenyUsers" to function.
2000-06-06 06:16:55 +00:00
Kris Kennaway
c322fe352d
Resolve conflicts
2000-06-03 09:58:15 +00:00
Kris Kennaway
2632b0c875
Initial import of OpenSSH snapshot from 2000/05/30
...
Obtained from: OpenBSD
2000-06-03 09:52:37 +00:00
Kris Kennaway
7513668808
This commit was generated by cvs2svn to compensate for changes in r61209,
...
which included commits to RCS files with non-trunk default branches.
2000-06-03 09:52:37 +00:00
Kris Kennaway
cfa18fd2ba
Resolve conflicts
2000-06-03 09:23:13 +00:00
Kris Kennaway
87e372b8a2
Import from vendor repository.
...
Obtained from: OpenBSD
2000-06-03 09:20:19 +00:00
Kris Kennaway
48fb0b1aa9
This commit was generated by cvs2svn to compensate for changes in r61206,
...
which included commits to RCS files with non-trunk default branches.
2000-06-03 09:20:19 +00:00
Kris Kennaway
db1cb46ca2
Bring vendor patches onto the main branch, and resolve conflicts.
2000-06-03 07:31:44 +00:00
Kris Kennaway
1ae2db81a5
Import vendor patches: the first is written by
...
Brian Feldman <green@FreeBSD.org>
* Remove the gratuitous dependency on OpenSSL 0.9.5a (preparation for MFC)
* Disable agent forwarding by default in the client (security risk)
Submitted by: green
Obtained from: OpenBSD
2000-06-03 07:18:09 +00:00
Kris Kennaway
7567fde002
This commit was generated by cvs2svn to compensate for changes in r61201,
...
which included commits to RCS files with non-trunk default branches.
2000-06-03 07:18:09 +00:00
Kris Kennaway
fcee55a281
Import vendor patch originally submitted by the below author: don't
...
treat failure to create the authentication agent directory in /tmp as
a fatal error, but disable agent forwarding.
Submitted by: Jan Koum <jkb@yahoo-inc.com>
2000-06-03 07:06:14 +00:00
Kris Kennaway
6298712178
This commit was generated by cvs2svn to compensate for changes in r61199,
...
which included commits to RCS files with non-trunk default branches.
2000-06-03 07:06:14 +00:00
Kris Kennaway
830ccf58ce
Import vendor fix: "fix key_read() for uuencoded keys w/o '='"
...
This bug caused OpenSSH not to recognise some of the DSA keys it
generated.
Submitted by: Christian Weisgerber <naddy@mips.inka.de>
Obtained from: OpenBSD
2000-06-03 06:51:30 +00:00
Kris Kennaway
4f00f8562d
Update to the version of pam_ssh corresponding to OpenSSH 2.1 (taken
...
from the openssh port)
Submitted by: Hajimu UMEMOTO <ume@mahoroba.org>
2000-05-30 09:03:15 +00:00
Jake Burkholder
e39756439c
Back out the previous change to the queue(3) interface.
...
It was not discussed and should probably not happen.
Requested by: msmith and others
2000-05-26 02:09:24 +00:00
Jake Burkholder
740a1973a6
Change the way that the queue(3) structures are declared; don't assume that
...
the type argument to *_HEAD and *_ENTRY is a struct.
Suggested by: phk
Reviewed by: phk
Approved by: mdodd
2000-05-23 20:41:01 +00:00
Andrey A. Chernov
a4bc7676d4
Turn on CheckMail to be more login-compatible by default
2000-05-23 06:06:54 +00:00
Brian Somers
73813569e4
Don't USE_PIPES
...
Spammed by: peter
Submitted by: mkn@uk.FreeBSD.org
2000-05-22 09:51:18 +00:00
Kris Kennaway
ba0c6b0830
Correct two stupid typos in the DSA key location.
...
Submitted by: Udo Schweigert <ust@cert.siemens.de>
2000-05-18 06:04:23 +00:00
Kris Kennaway
b787acb5e3
Unbreak Kerberos5 compilation. This still remains untested.
...
Noticed by: obrien
2000-05-17 08:06:20 +00:00
Kris Kennaway
e551e5eafa
Oops, rename S/Key to Opie in line with FreeBSD usage.
2000-05-15 06:11:30 +00:00
Kris Kennaway
0c11f6e187
Create a DSA host key if one does not already exist, and teach sshd_config
...
about it.
2000-05-15 05:40:27 +00:00
Kris Kennaway
e8aafc91b5
Resolve conflicts and update for FreeBSD.
2000-05-15 05:24:25 +00:00
Kris Kennaway
a04a10f891
Initial import of OpenSSH v2.1.
2000-05-15 04:37:24 +00:00
Kris Kennaway
fe01acb846
This commit was generated by cvs2svn to compensate for changes in r60573,
...
which included commits to RCS files with non-trunk default branches.
2000-05-15 04:37:24 +00:00
Nik Clayton
699cc2f5e1
Note that X11 Forwarding is off by default.
...
PR: docs/17566
Submitted by: Keith Stevenson <ktstev01@louisville.edu>
2000-04-30 22:41:58 +00:00
Kris Kennaway
e31adaffd9
Fix a memory leak.
...
PR: 17360
Submitted by: Andrew J. Korty <ajk@iu.edu>
2000-03-29 08:24:37 +00:00
Kris Kennaway
18fa3c2ec9
#include <ssl/foo.h> -> #include <openssl/foo.h>
2000-03-26 10:00:28 +00:00
Kris Kennaway
3c6ae11886
Resolve conflicts.
2000-03-26 07:37:48 +00:00
Kris Kennaway
a8f6863aa6
Virgin import of OpenSSH sources dated 2000/03/25
2000-03-26 07:07:24 +00:00
Kris Kennaway
cc99d7f2df
This commit was generated by cvs2svn to compensate for changes in r58582,
...
which included commits to RCS files with non-trunk default branches.
2000-03-26 07:07:24 +00:00
Brian Somers
727214e9b8
Use pipe() instead of socketpair() in sshd when communicating
...
with the client.
This allows ppp/ssh style tunnels to function again.
Ok'd by: markk
Submitted by: markk@knigma.org
2000-03-24 15:39:37 +00:00
Mike Pritchard
5c51cd6437
Fix a few spelling errors.
2000-03-24 02:26:54 +00:00
Sheldon Hearn
962a3f4e81
IgnoreUserKnownHosts is a boolean flag, not an integer value.
...
The fix submitted in the attributed PR is identical to the one
adopted by OpenBSD.
PR: 17027
Submitted by: David Malone <dwmalone@maths.tcd.ie>
Obtained from: OpenBSD
2000-03-22 09:36:35 +00:00
Kris Kennaway
9fd4066575
Add a new function stub to libcrypto() which resolves to a symbol in
...
the librsa* library and reports which version of the library (OpenSSL/RSAREF)
is being used.
This is then used in openssh to detect the failure case of RSAREF and a RSA key
>1024 bits, to print a more helpful error message than 'rsa_public_encrypt() fai
led.'
This is a 4.0-RELEASE candidate.
2000-03-13 09:55:53 +00:00
Kris Kennaway
6a8633db4e
Various manpage style/grammar/formatting cleanups
...
Submitted by: Peter Jeremy <peter.jeremy@alcatel.com.au>, jedgar
PR: 17292 (remainder of)
2000-03-13 00:17:43 +00:00
Nik Clayton
8ff0a8c302
- typos
...
- Add double spaces following full stops to improve typeset output
- mdoc-ification. (Though I'm uncertain whether option values and
contents should be .Dq or something else).
- Fix a missed /etc/ssh change
- Expand wording on RandomSeed and behaviour when X11 isn't forwarded.
- Change examples to literal mode.
- Trim trailing whitespace
PR: docs/17292
Submitted by: Peter Jeremy <peter.jeremy@alcatel.com.au>
2000-03-10 11:48:49 +00:00
Mark Murray
c59bf09996
Make LOGIN_CAP work properly.
2000-03-09 14:52:31 +00:00
Kris Kennaway
2134165c54
/etc -> /etc/ssh
...
Submitted by: Ben Smithurst <ben@scientia.demon.co.uk>
2000-03-08 03:44:00 +00:00
John Hay
2216ad9c7e
MFI: Use krb5 functions in krb5 files.
...
Reviewed by: markm
2000-03-03 20:31:58 +00:00
Brian Feldman
5dc73ebebe
Turn off X11 forwarding in the client. X11 forwarding in the server by
...
default should probably also get turned on, now.
Requested by: kris
Obtained from: OpenBSD
2000-03-03 05:58:39 +00:00
Hajimu UMEMOTO
e51ec40ec8
Enable connection logging. FreeBSD's libwrap is IPv6 ready.
...
OpenSSH is in our source tree, now. It's a time to enable it.
Reviewed by: markm, shin
Approved by: jkh
2000-02-29 19:37:04 +00:00
Mark Murray
fe5fd0173b
1) Add kerberos5 functionality.
...
by Daniel Kouril <kouril@informatics.muni.cz>
2) Add full LOGIN_CAP capability
by Andrey Chernov
2000-02-28 19:03:50 +00:00
Brian Somers
ccd16b43ed
Don't put truncated hostnames in utmp
...
Approved by: jkh
2000-02-28 18:51:30 +00:00
Peter Wemm
2307080405
Redo this with a repo copy from the original file and reset the
...
__PREFIX__ markers.
2000-02-26 09:59:14 +00:00
Peter Wemm
4d3289a849
oops, update path to /etc/ssh/ssh_host_key
2000-02-26 02:24:38 +00:00
Peter Wemm
9ceffc938a
Merge from internat.freebsd.org; move ssh files from /etc to /etc/ssh
2000-02-25 14:25:10 +00:00
Brian Feldman
8261034302
Fix a bug that crawled in pretty recently (from the port). It made
...
sshd coredump :(
2000-02-25 05:22:14 +00:00
Peter Wemm
38ba484ce1
Fix garbage in SSH_PROGRAM (only on freefall, not internat)
2000-02-25 04:41:06 +00:00
Brian Feldman
a95c122521
Make "CheckHostIP" default to off. This was proposed on -security and
...
earlier IRC, but despite my inital feeling against it, this seems
the more proper thing to do.
Proposed by: rwatson
2000-02-25 03:04:29 +00:00
Brian Feldman
18a711954e
The includes must be <openssl/.*\.h>, not <ssl/.*\.h>.
2000-02-25 01:53:12 +00:00
Mark Murray
b719e3c926
remove more ports crud.
2000-02-24 23:54:00 +00:00
Mark Murray
6ecb050733
remove ports junk
2000-02-24 23:46:38 +00:00
Mark Murray
42f71286cd
Add the patches fom ports (QV: ports/security/openssh/patches/patch-*)
2000-02-24 15:29:42 +00:00
Mark Murray
511b41d2a1
Vendor import of OpenSSH.
2000-02-24 14:29:47 +00:00