d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
149,599 Commits 6 Branches 133 Tags 2.6 GiB
a330ed7cd1
Commit Graph

410 Commits

Author SHA1 Message Date
Dag-Erling Smørgrav
35d4ccfb55 Document FreeBSD defaults and paths. 
Sponsored by:	DARPA, NAI Labs
 2002-06-29 10:53:57 +00:00
Dag-Erling Smørgrav
3d48a988f6 Remove duplicate. 2002-06-29 10:52:42 +00:00
Dag-Erling Smørgrav
975616f046 Apply FreeBSD's configuration defaults. 
Sponsored by:	DARPA, NAI Labs
 2002-06-29 10:51:56 +00:00
Dag-Erling Smørgrav
db58a8e40c Add the VersionAddendum configuration variable. 
Sponsored by:	DARPA, NAI Labs
 2002-06-29 10:49:57 +00:00
Dag-Erling Smørgrav
edb557f8bb Support OPIE as an alternative to S/Key. 
Sponsored by:	DARPA, NAI Labs
 2002-06-29 10:44:37 +00:00
Dag-Erling Smørgrav
ba11afcc21 Document the upgrade process. 2002-06-29 10:39:14 +00:00
Dag-Erling Smørgrav
2e3e4630c5 Files we don't want to import. 2002-06-29 10:39:02 +00:00
Dag-Erling Smørgrav
989dd127e4 Forcibly revert to mainline. 2002-06-27 22:42:11 +00:00
Dag-Erling Smørgrav
83d2307d00 Vendor import of OpenSSH 3.3p1. 2002-06-27 22:31:32 +00:00
Dag-Erling Smørgrav
db5fd092db This commit was generated by cvs2svn to compensate for changes in r98937, 
which included commits to RCS files with non-trunk default branches.
 2002-06-27 22:31:32 +00:00
Dirk Meyer
742e9f76c3 remove declaration of authlog 
use variable from_host
Reviewed by:	des
 2002-06-24 11:11:30 +00:00
Dag-Erling Smørgrav
ccc9bac89c IPv4or6 is already defined in libssh. 2002-06-24 10:15:26 +00:00
Dag-Erling Smørgrav
614c49a910 Resolve conflicts and document local changes. 2002-06-23 21:42:47 +00:00
Dag-Erling Smørgrav
6f562d4003 Correctly export the environment variables set by setusercontext(). 
Sponsored by:	DARPA, NAI Labs
 2002-06-23 20:22:49 +00:00
Dag-Erling Smørgrav
80628bacb0 Resolve conflicts. Known issues: 
- sshd fails to set TERM correctly.
 - privilege separation may break PAM and is currently turned off.
 - man pages have not yet been updated

I will have these issues resolved, and privilege separation turned on by
default, in time for DP2.

Sponsored by:	DARPA, NAI Labs
 2002-06-23 16:09:08 +00:00
Dag-Erling Smørgrav
545d5eca42 Vendor import of OpenSSH 3.3. 2002-06-23 14:01:54 +00:00
Dag-Erling Smørgrav
f6342a9bad This commit was generated by cvs2svn to compensate for changes in r98675, 
which included commits to RCS files with non-trunk default branches.
 2002-06-23 14:01:54 +00:00
Chris D. Faulhaber
c2fc1c7365 Remove _PATH_CP now that it is defined in paths.h 
Reviewed by:	des
 2002-05-12 01:52:11 +00:00
David E. O'Brien
259bbc7376 Usual after-import fixup of SCM IDs. 2002-05-01 22:39:53 +00:00
Dag-Erling Smørgrav
8024187191 Back out previous commit. 2002-04-25 16:53:25 +00:00
Jordan K. Hubbard
44493e088a Change default challenge/response behavior of sshd by popular demand. 
This brings us into sync with the behavior of sshd on other Unix platforms.

Submitted by:	Joshua Goodall <joshua@roughtrade.net>
 2002-04-25 05:59:53 +00:00
Andrey A. Chernov
098de0c172 1) Proberly conditionalize PAM "last login" printout. 
2) For "copyright" case #ifdef HAVE_LOGIN_CAP was placed on too big block,
narrow it down.
3) Don't check the same conditions twice (for "copyright" and "welcome"),
put them under single block.
4) Print \n between "copyright" and "welcome" as our login does.

Reviewed by:	des (1)
 2002-04-23 12:36:11 +00:00
Dag-Erling Smørgrav
6e8ced7fd0 Don't report last login time in PAM case. (perforce change 10057) 
Sponsored by:	DARPA, NAI Labs
 2002-04-22 06:26:29 +00:00
Dag-Erling Smørgrav
a5763cd1f0 Fix warnings + wait for child so it doesn't go zombie (perforce change 10122) 2002-04-22 06:25:13 +00:00
Andrey A. Chernov
940bc501bd Move LOGIN_CAP calls before all file descriptors are closed hard, since some 
descriptors may be used by LOGIN_CAP internally, add login_close().

Use "nocheckmail" LOGIN_CAP capability too like our login does.
 2002-04-21 13:31:56 +00:00
Andrey A. Chernov
a37da82a78 Fix TZ & TERM handling for use_login case of rev. 1.24 2002-04-20 09:56:10 +00:00
Andrey A. Chernov
b36e10eee6 1) Surprisingly, "CheckMail" handling code completely removed from this 
version, so documented "CheckMail" option exists but does nothing.
Bring it back to life adding code back.

2) Cosmetique. Reduce number of args in do_setusercontext()
 2002-04-20 09:26:43 +00:00
Andrey A. Chernov
32eb065e64 1) Fix overlook in my prev. commit - forget HAVE_ prefix in one place in old 
code merge.

2) In addition honor "timezone" and "term" capabilities from login.conf,
not overwrite them once they set (they are TZ and TERM variables).
 2002-04-20 05:44:36 +00:00
Andrey A. Chernov
03df31a6fc Please repeat after me: setusercontext() modifies _current_ environment, but 
sshd uses separate child_env. So, to make setusercontext() really does
something, environment must be switched before call and passed to child_env
back after it.

The error here was that modified environment not passed back to child_env,
so all variables that setusercontext() adds are lost, including ones from
~/.login_conf
 2002-04-20 04:38:07 +00:00
Dag-Erling Smørgrav
ca99146106 Fix some warnings. Don't record logins twice in USE_PAM case. Strip 
"/dev/" off the tty name before passing it to auth_ttyok or PAM.

Inspired by:	dinoex
Sponsored by:	DARPA, NAI Labs
 2002-04-14 16:24:36 +00:00
Dag-Erling Smørgrav
cd3dfe6d6e Back out previous backout. It seems I was right to begin with, and DSA is 
preferrable to RSA (not least because the SECSH draft standard requires
DSA while RSA is only recommended).
 2002-04-12 15:52:10 +00:00
Dag-Erling Smørgrav
8f8855cff0 Knowledgeable persons assure me that RSA is preferable to DSA and that we 
should transition away from DSA.
 2002-04-11 22:04:40 +00:00
Dag-Erling Smørgrav
6cef489c5c Prefer DSA to RSA if both are available. 2002-04-11 16:08:48 +00:00
Dag-Erling Smørgrav
9c0adca3e7 Do not attempt to load an ssh2 RSA host key by default. 2002-04-11 16:08:02 +00:00
Ruslan Ermilov
f2f306b622 Align for const poisoning in -lutil. 2002-04-08 11:07:51 +00:00
Dag-Erling Smørgrav
5e022fc6f0 Nuke stale copy of the pam_ssh(8) source code. 2002-04-06 04:46:01 +00:00
Dag-Erling Smørgrav
5297e48d04 Revert to vendor version, what little was left of our local patches here 
was incorrect.

Pointed out by:	Markus Friedl <markus@openbsd.org>
 2002-04-02 23:07:31 +00:00
Dag-Erling Smørgrav
43e73ba0c2 Change the FreeBSD version addendum to "FreeBSD-20020402". This shortens 
the version string to 28 characters, which is below the 40-character limit
specified in the proposed SECSH standard.  Some servers, however (like the
one built into the Foundry BigIron line of switches) will hang when
confronted with a version string longer than 24 characters, so some users
may need to shorten it further.

Sponsored by:	DARPA, NAI Labs
 2002-04-02 21:53:54 +00:00
Dag-Erling Smørgrav
9e2cbe04ff Make the various ssh clients understand the VersionAddendum option. 
Submitted by:	pb
 2002-04-02 21:48:51 +00:00
Ruslan Ermilov
2735cfee64 Switch over to using pam_login_access(8) module in sshd(8). 
(Fixes static compilation.  Reduces diffs to OpenSSH.)

Reviewed by:	bde
 2002-03-26 12:52:28 +00:00
Jacques Vidrine
7fd1ca3b0c REALLY correct typo this time. 
Noticed by:	roam
 2002-03-26 12:27:43 +00:00
Jacques Vidrine
26241f6368 Fix typo (missing paren) affecting KRB4 && KRB5 case. 
Approved by:	des
 2002-03-25 14:55:41 +00:00
Dag-Erling Smørgrav
f0cf488b75 We keep moduli(5) in /etc/ssh, not /etc. 2002-03-23 19:26:21 +00:00
Dag-Erling Smørgrav
6b11d510fd Correctly set PAM_RHOST so e.g. pam_login_access(8) can do its job. 
Sponsored by:	DARPA, NAI Labs
 2002-03-21 12:55:21 +00:00
Dag-Erling Smørgrav
fe49ecbc93 Use the "sshd" service instead of "csshd". The latter was only needed 
because of bugs (incorrect design decisions, actually) in Linux-PAM.

Sponsored by:	DARPA, NAI Labs
 2002-03-21 12:23:09 +00:00
cvs2svn
556a3fb01e This commit was manufactured by cvs2svn to create branch 
'VENDOR-crypto-openssh'.
 2002-03-21 12:18:28 +00:00
Dag-Erling Smørgrav
da4dc1eeb5 Use PAM instead of S/Key (or OPIE) for SSH2. 
Sponsored by:	DARPA, NAI Labs
 2002-03-21 12:18:27 +00:00
Dag-Erling Smørgrav
97ec1da11a Note that portions of this software were 
Sponsored by:	DARPA, NAI Labs
 2002-03-20 22:10:10 +00:00
Dag-Erling Smørgrav
3a17de1501 - Change the prompt from "S/Key Password: " to "OPIE Password: " 
- If the user doesn't have an OPIE key, don't challenge him.  This is
   a workaround until I get PAM to work properly with ssh2.

Sponsored by:	DARPA, NAI Labs
 2002-03-20 22:02:02 +00:00
Dag-Erling Smørgrav
1d9e2b0ad5 Unbreak for KRB4 ^ KRB5 case. 
Sponsored by:	DARPA, NAI Labs
 2002-03-19 16:44:11 +00:00
Dag-Erling Smørgrav
8bf26f5d41 Revive this file (which is used for opie rather than skey) 2002-03-18 10:31:33 +00:00
Dag-Erling Smørgrav
af12a3e74a Fix conflicts. 2002-03-18 10:09:43 +00:00
Dag-Erling Smørgrav
ae1f160d56 Vendor import of OpenSSH 3.1 2002-03-18 09:55:03 +00:00
Dag-Erling Smørgrav
996836565f This commit was generated by cvs2svn to compensate for changes in r92555, 
which included commits to RCS files with non-trunk default branches.
 2002-03-18 09:55:03 +00:00
Dag-Erling Smørgrav
a681ab0abe Diff reduction. 
Sponsored by:	DARPA, NAI Labs
 2002-03-16 08:03:48 +00:00
Jacques Vidrine
1acac5eba8 Update version string. 2002-03-07 14:36:28 +00:00
Jacques Vidrine
d96f3089f2 Fix off-by-one error. 
Obtained from:	OpenBSD
 2002-03-05 14:27:19 +00:00
Brian Feldman
885a59f2e0 Use login_getpwclass() instead of login_getclass() so that default 
mapping of user login classes works.

Obtained from:	TrustedBSD project
Sponsored by:	DARPA, NAI Labs
 2002-02-27 22:36:30 +00:00
Ruslan Ermilov
fd4ca9e02d Make libssh.so useable (undefined reference to IPv4or6). 
Reviewed by:	des, markm
Approved by:	markm
 2002-01-23 15:06:47 +00:00
Brian Feldman
27e5f9f620 Fix a coredump bug occurring if ssh-keygen attempts to change the password 
on a DSA key.

Submitted by:	ian j hart <ianjhart@ntlworld.com>
 2002-01-07 15:55:20 +00:00
Jacques Vidrine
eb5bc300e8 Update version string since we applied a fix for the UseLogin issue. 2001-12-03 22:47:51 +00:00
Jacques Vidrine
1c5093bbbc Do not pass user-defined environmental variables to /usr/bin/login. 
Obtained from:	OpenBSD
Approved by:	green
 2001-12-03 00:51:47 +00:00
David Malone
46fdbb8ad4 In the "UseLogin yes" case we need env to be NULL to make sure it 
will be correctly initialised.

PR:		32065
Tested by:	The Anarcat <anarcat@anarcat.dyndns.org>
MFC after:	3 days
 2001-11-19 19:40:14 +00:00
Brian Feldman
ccf35be189 Modify a "You don't exist" message, pretty rude for transient YP failures. 2001-09-27 18:54:42 +00:00
Assar Westerlund
1f131ac4bd fix renamed options in some of the code that was #ifdef AFS 
also print an error if krb5 ticket passing is disabled

Submitted by:	Jonathan Chen <jon@spock.org>
 2001-09-04 13:27:04 +00:00
Paul Saab
20a18c35f4 Backout last change. I didnt follow the thread and made a mistake 
with this.  localisations is a valid spelling.  Oops
 2001-08-27 10:37:50 +00:00
Paul Saab
95576c53ef Correctly spell localizations 2001-08-27 10:20:02 +00:00
Brian Feldman
0e513252b5 Update the OpenSSH minor-version string. 
Requested by:	obrien
Reviewed by:	rwatson
 2001-08-16 19:26:19 +00:00
Jacques Vidrine
b33edd3956 Bug fix: When the client connects to a server and Kerberos 
authentication is  enabled, the  client effectively ignores  any error
from krb5_rd_rep due to a missing branch.

In  theory  this could  result  in  an  ssh  client using  Kerberos  5
authentication accepting  a spoofed  AP-REP.  I doubt  this is  a real
possiblity, however, because  the AP-REP is passed from  the server to
the client via the SSH  encrypted channel.  Any tampering should cause
the decryption or MAC to fail.

Approved by:	green
MFC after:	1 week
 2001-07-13 18:12:13 +00:00
Brian Feldman
d9769eeead Fix an incorrect conflict resolution which prevented TISAuthentication 
from working right in 2.9.
 2001-07-07 14:19:53 +00:00
Brian Feldman
a15906e7aa Also add a colon to "Bad passphrase, please try again ". 2001-06-29 16:43:13 +00:00
Brian Feldman
69b8e053cb Put in a missing colon in the "Enter passphrase" message. 2001-06-29 16:34:14 +00:00
Brian Feldman
0c82706bc0 Back out the last change which is probably actually a red herring. Argh! 2001-06-26 15:15:22 +00:00
Brian Feldman
c3e2f3baec Don't pointlessly kill a channel because the first (forced) 
non-blocking read returns 0.

Now I can finally tunnel CVSUP again...
 2001-06-26 14:17:35 +00:00
Assar Westerlund
07de0e4353 (do_authloop): handle !KRB4 && KRB5 2001-06-16 07:44:17 +00:00
Mark Murray
7e40a391bc Unbreak OpenSSH for the KRB5-and-no-KRB4 case. Asking for KRB5 does 
not imply that you want, need or have kerberosIV headers.
 2001-06-15 08:12:31 +00:00
Brian Feldman
e7edf5a116 Enable Kerberos 5 support in sshd again. 2001-06-12 03:43:47 +00:00
Brian Feldman
e9fd63dfdd Switch to the user's uid before attempting to unlink the auth forwarding 
file, nullifying the effects of a race.

Obtained from:	OpenBSD
 2001-06-08 22:22:09 +00:00
David E. O'Brien
e8f64f5ebf Fix $FreeBSD$ style committer messed up in rev 1.7 for some reason. 2001-05-24 07:22:08 +00:00
David E. O'Brien
d3ebe37cd0 Restore the RSA host key to /etc/ssh/ssh_host_key. 
Also fix $FreeBSD$ spamage in crypto/openssh/sshd_config rev. 1.16.
 2001-05-18 18:10:02 +00:00
Brian Feldman
62c931e0a4 If a host would exceed 16 characters in the utmp entry, record only 
it's IP address/base host instead.

Submitted by:	brian
 2001-05-15 01:50:40 +00:00
Ruslan Ermilov
bb60401e7a mdoc(7) police: finished fixing conflicts in revision 1.18. 2001-05-14 18:13:34 +00:00
Mark Murray
fa83754c4e Fix make world in the kerberosIV case. 2001-05-11 09:36:17 +00:00
Alfred Perlstein
2c917d39b2 Fix some of the handling in the pam module, don't unregister things 
that were never registered.  At the same time handle a failure from
pam_setcreds with a bit more paranioa than the previous fix.

Sync a bit with the "Portable OpenSSH" work to make comparisons a easier.
 2001-05-09 03:40:37 +00:00
Brian Feldman
00e38eaf7f Since PAM is broken, let pam_setcred() failure be non-fatal. 2001-05-08 22:30:18 +00:00
Brian Feldman
3817a12c9b sshd_config should still be keeping ssh host keys in /etc/ssh, not /etc. 2001-05-05 13:48:13 +00:00
Brian Feldman
4c5de86978 Finish committing _more_ somehow-uncommitted OpenSSH 2.9 updates. 
(Missing Delta Brigade, tally-ho!)
 2001-05-05 01:12:45 +00:00
Brian Feldman
87767895f0 Get ssh(1) compiling with MAKE_KERBEROS5. 2001-05-04 04:37:49 +00:00
Brian Feldman
345012bf8b Remove obsoleted files. 2001-05-04 04:15:22 +00:00
Brian Feldman
ca3176e7c8 Fix conflicts for OpenSSH 2.9. 2001-05-04 04:14:23 +00:00
Brian Feldman
1e8db6e2f6 Say "hi" to the latest in the OpenSSH series, version 2.9! 
Happy birthday to:	rwatson
 2001-05-04 03:57:05 +00:00
Brian Feldman
3ed16d1511 This commit was generated by cvs2svn to compensate for changes in r76259, 
which included commits to RCS files with non-trunk default branches.
 2001-05-04 03:57:05 +00:00
Brian Feldman
933ca70f8f Add a "VersionAddendum" configuration setting for sshd which allows 
anyone to easily change the part of the OpenSSH version after the main
version number.  The FreeBSD-specific version banner could be disabled
that way, for example:

# Call ourselves plain OpenSSH
VersionAddendum
 2001-05-03 00:29:28 +00:00
Brian Feldman
1f5ce8f412 Backout completely canonical lookup modifications. 2001-05-03 00:26:47 +00:00
Brian Feldman
313cb084c4 Suggested by kris, OpenSSH shall have a version designated to note that 
it's not "plain" OpenSSH 2.3.0.
 2001-03-20 02:11:25 +00:00
Brian Feldman
e0fbb1d2de Make password attacks based on traffic analysis harder by requiring that 
"non-echoed" characters are still echoed back in a null packet, as well
as pad passwords sent to not give hints to the length otherwise.

Obtained from:	OpenBSD
 2001-03-20 02:06:40 +00:00
Jeroen Ruigrok van der Werven
f7191d4fae Fix double mention of ssh. 
This file is already off the vendorbranch, nonetheless it needs to be
submitted back to the OpenSSH people.

PR:		25743
Submitted by:	David Wolfskill <dhw@whistle.com>
 2001-03-15 09:24:40 +00:00
Brian Feldman
e4fe1ca667 Don't dump core when an attempt is made to login using protocol 2 with 
an invalid user name.
 2001-03-15 03:15:18 +00:00
Assar Westerlund
aeccfe991a (try_krb5_authentication): simplify code. from joda@netbsd.org 2001-03-13 04:42:38 +00:00
Assar Westerlund
a16a9b0f1e Fix LP64 problem in Kerberos 5 TGT passing. 
Obtained from: NetBSD (done by thorpej@netbsd.org)
 2001-03-12 08:14:22 +00:00
Brian Feldman
46c9472cd6 Reenable the SIGPIPE signal handler default in all cases for spawned 
sessions.
 2001-03-11 02:26:57 +00:00
Assar Westerlund
cb96ab3672 Add code for being compatible with ssh.com's krb5 authentication. 
It is done by using the same ssh messages for v4 and v5 authentication
(since the ssh.com does not now anything about v4) and looking at the
contents after unpacking it to see if it is v4 or v5.
Based on code from Björn Grönvall <bg@sics.se>

PR:		misc/20504
 2001-03-04 02:22:04 +00:00
Paul Saab
8e97fe726f Make ConnectionsPerPeriod non-fatal for real. 2001-02-18 01:33:31 +00:00
Assar Westerlund
c9e3f8cfb9 update to new heimdal libkrb5 2001-02-13 16:58:04 +00:00
Kris Kennaway
a09221f83c Patches backported from later development version of OpenSSH which prevent 
(instead of just mitigating through connection limits) the Bleichenbacher
attack which can lead to guessing of the server key (not host key) by
regenerating it when an RSA failure is detected.

Reviewed by:	rwatson
 2001-02-12 06:44:51 +00:00
Brian Feldman
ffd692be66 Correctly fill in the sun_len for a sockaddr_sun. 
Submitted by:	Alexander Leidinger <Alexander@leidinger.net>
 2001-02-04 20:23:17 +00:00
Brian Feldman
a61d605eda MFS: Don't use the canonical hostname here, too. 2001-02-04 20:16:14 +00:00
Brian Feldman
895b03b1e8 MFF: Make ConnectionsPerPeriod usage a warning, not fatal. 2001-02-04 20:15:53 +00:00
Brian Feldman
926581ede3 Actually propagate back to the rest of the application that a command 
was specified when using -t mode with the SSH client.

Submitted by:	Dima Dorfman <dima@unixfreak.org>
 2001-01-21 05:45:27 +00:00
Brian Feldman
ea0187039a /Really/ deprecate ConnectionsPerPeriod, ripping out the code for it 
and giving a dire error to its lingering users.
 2001-01-13 07:57:43 +00:00
Brian Feldman
39567f8cee Fix a long-standing bug that resulted in a dropped session sometimes 
when an X11-forwarded client was closed.  For some reason, sshd didn't
disable the SIGPIPE exit handler and died a horrible death (well, okay,
a silent death really).  Set SIGPIPE's handler to SIG_IGN.
 2001-01-06 21:15:07 +00:00
Brian Feldman
099584266b Update to OpenSSH 2.3.0 with FreeBSD modifications. OpenSSH 2.3.0 
new features description elided in favor of checking out their
website.

Important new FreeBSD-version stuff: PAM support has been worked
in, partially from the "Unix" OpenSSH version, and a lot due to the
work of Eivind Eklend, too.

This requires at least the following in pam.conf:

sshd    auth    sufficient      pam_skey.so
sshd    auth    required        pam_unix.so                     try_first_pass
sshd    session required        pam_permit.so

Parts by:	Eivind Eklend <eivind@FreeBSD.org>
 2000-12-05 02:55:12 +00:00
Brian Feldman
386879a128 Forgot to remove the old line in the last commit. 2000-12-05 02:41:01 +00:00
Brian Feldman
5b9b2fafd4 Import of OpenSSH 2.3.0 (virgin OpenBSD source release). 2000-12-05 02:20:19 +00:00
Brian Feldman
803a607983 This commit was generated by cvs2svn to compensate for changes in r69587, 
which included commits to RCS files with non-trunk default branches.
 2000-12-05 02:20:19 +00:00
Brian Somers
3c3d69579f Remove duplicate line 
Not responded to by: kris, then green
 2000-12-04 22:57:53 +00:00
Brian Feldman
ee510eab3f In env_destroy(), it is a bad idea to env_swap(self, 0) to switch 
back to the original environ unconditionally.  The setting of the
variable to save the previous environ is conditional; it happens when
ENV.e_committed is set.  Therefore, don't try to swap the env back
unless the previous env has been initialized.

PR:		bin/22670
Submitted by:	Takanori Saneto <sanewo@ba2.so-net.ne.jp>
 2000-11-25 02:00:35 +00:00
Bill Fumerola
2a644691bc Correct an arguement to ssh_add_identity, this matches what is currently 
in ports/security/openssh/files/pam_ssh.c

PR:		22164
Submitted by:	Takanori Saneto <sanewo@ba2.so-net.ne.jp>
Reviewed by:	green
Approved by:	green
 2000-11-25 01:55:42 +00:00
Brian Feldman
03e72be8c8 Add login_cap and login_access support. Previously, these FreeBSD-local 
checks were only made when using the 1.x protocol.
 2000-11-14 04:35:03 +00:00
Brian Feldman
4899dde749 Import a security fix: the client would allow a server to use its 
ssh-agent or X11 forwarding even if it was disabled.

This is the vendor fix provided, not an actual revision of clientloop.c.

Submitted by:	Markus Friedl <markus@OpenBSD.org> via kris
 2000-11-14 03:51:53 +00:00
Brian Feldman
786df71457 This commit was generated by cvs2svn to compensate for changes in r68700, 
which included commits to RCS files with non-trunk default branches.
 2000-11-14 03:51:53 +00:00
Brian Feldman
4a950c224b Fix a few style oddities. 2000-09-10 18:04:12 +00:00
Brian Feldman
dd5f9dffd6 Fix a goof in timevaldiff. 2000-09-10 18:03:46 +00:00
Kris Kennaway
b8c2df609a Remove files no longer present in OpenSSH 2.2.0 and beyond 2000-09-10 10:26:07 +00:00
Kris Kennaway
c2d3a5594b Resolve conflicts and update for OpenSSH 2.2.0 
Reviewed by:	gshapiro, peter, green
 2000-09-10 09:35:38 +00:00
Kris Kennaway
b66f2d16a0 Initial import of OpenSSH post-2.2.0 snapshot dated 2000-09-09 2000-09-10 08:31:17 +00:00
Kris Kennaway
c7b5135400 This commit was generated by cvs2svn to compensate for changes in r65668, 
which included commits to RCS files with non-trunk default branches.
 2000-09-10 08:31:17 +00:00
Kris Kennaway
690a362571 Nuke RSAREF support from orbit. 
It's the only way to be sure.
 2000-09-10 00:09:37 +00:00
Kris Kennaway
5ed779ad1e ttyname was not being passed into do_login(), so we were erroneously picking 
up the function definition from unistd.h instead. Use s->tty instead.

Submitted by:	peter
 2000-09-04 08:43:05 +00:00
Kris Kennaway
cabf13fcdb bzero() the struct timeval for paranoia 
Submitted by:	gshapiro
 2000-09-03 07:58:35 +00:00
Kris Kennaway
939c32909c Err, we weren't even compiling auth1.c with LOGIN_CAP at all. Guess nobody 
was using this feature.
 2000-09-02 07:32:05 +00:00
Kris Kennaway
80bbcbe344 Repair a broken conflict resolution in r1.2 which had the effect of nullifying 
the login_cap and login.access checks for whether a user/host is allowed
access to the system for users other than root. But since we currently don't
have a similar check in the ssh2 code path anyway, it's um, "okay".

Submitted by:	gshapiro
 2000-09-02 05:40:50 +00:00
Kris Kennaway
14ef7e2794 Repair my dyslexia: s/opt/otp/ in the OPIE challenge. D'oh! 
Submitted by:	gshapiro
 2000-09-02 04:41:33 +00:00
Kris Kennaway
ac70abf4bc Re-add missing "break" which was lost during a previous patch 
integration. This currently has no effect.

Submitted by:	gshapiro
 2000-09-02 04:37:51 +00:00
Kris Kennaway
1610cd7fa6 Turn on X11Forwarding by default on the server. Any risk is to the client, 
where it is already disabled by default.

Reminded by:	peter
 2000-09-02 03:49:22 +00:00
Kris Kennaway
b87db7cec0 Increase the default value of LoginGraceTime from 60 seconds to 120 
seconds.

PR:		20488
Submitted by:	rwatson
 2000-08-23 09:47:25 +00:00
Kris Kennaway
4d858ef441 Respect X11BASE to derive the location of xauth(1) 
PR:		17818
Submitted by:	Bjoern Fischer <bfischer@Techfak.Uni-Bielefeld.DE>
 2000-08-23 09:39:20 +00:00
Jeroen Ruigrok van der Werven
f30cce5c6c Chalk up another phkmalloc victim. 
It seems as if uninitialised memory was the culprit.

We may want to contribute this back to the OpenSSH project.

Submitted by:	Alexander Leidinger <Alexander@Leidinger.net> on -current.
 2000-08-01 08:07:15 +00:00
Jeroen Ruigrok van der Werven
870fb37275 Fix a weird typo, is -> are. 
The OpenSSH maintainer probably want to contribute this back to the
real OpenSSH guys.

Submitted by:	Jon Perkin <sketchy@netcraft.com>
 2000-07-27 19:21:15 +00:00
Mark Ovens
85ea01646c Fixed a minor typo in the header. 
Pointed out by:	asmodai
 2000-07-27 17:21:07 +00:00
Mark Ovens
2abceb0402 Committed, Thanks!! 
PR:		20108
Submitted by:	Doug Lee
 2000-07-25 16:49:48 +00:00
Peter Wemm
365c420eb1 Sync sshd_config with sshd and manapage internal defaults (Checkmail = yes) 2000-07-11 09:54:24 +00:00
Peter Wemm
44de2297a4 Sync LoginGraceTime with sshd_config = 60 seconds by default, not 600. 2000-07-11 09:52:14 +00:00
Peter Wemm
e213d985b2 Fix out-of-sync defaults. PermitRootLogin is supposed to be 'no' but 
sshd's internal default was 'yes'.  (if some cracker managed to trash
/etc/ssh/sshd_config, then root logins could be reactivated)

Approved by: kris
 2000-07-11 09:50:15 +00:00
Peter Wemm
a3d6796930 Make FallBackToRsh off by default. Falling back to rsh by default is 
silly in this day and age.

Approved by: kris
 2000-07-11 09:39:34 +00:00
Brian Feldman
c8ef594c0f Allow restarting on SIGHUP when the full path was not given as argv[0]. 
We do have /proc/curproc/file :)
 2000-07-04 06:43:26 +00:00
Brian Feldman
21deafa350 So /this/ is what has made OpenSSH's SSHv2 support never work right! 
In some cases, limits did not get set to the proper class, but
instead always to "default", because not all passwd copies were
done to completion.
 2000-06-27 21:16:06 +00:00
Brian Feldman
c342fc930b Also make sure to close the socket that exceeds your rate limit. 2000-06-26 23:39:26 +00:00
Brian Feldman
7e03cf33e9 Make rate limiting work per-listening-socket. Log better messages than 
before for this, requiring a new function (get_ipaddr()).  canohost.c
receives a $FreeBSD$ line.

Suggested by:	Niels Provos <niels@OpenBSD.org>
 2000-06-26 05:44:23 +00:00
Kris Kennaway
fb633b3056 Fix syntax error in previous commit. 
Submitted by:	Udo Schweigert <ust@cert.siemens.de>
 2000-06-11 21:41:25 +00:00
Kris Kennaway
95e2a710ad Fix security botch in "UseLogin Yes" case: commands are executed with 
uid 0.

Obtained from:	OpenBSD
 2000-06-10 22:32:57 +00:00
Ruslan Ermilov
b3ba283ebe Make `ssh-agent -k' work for csh(1)-like shells. 2000-06-10 14:14:28 +00:00
Brian Feldman
2803b77e52 Allow "DenyUsers" to function. 2000-06-06 06:16:55 +00:00
Kris Kennaway
c322fe352d Resolve conflicts 2000-06-03 09:58:15 +00:00
Kris Kennaway
2632b0c875 Initial import of OpenSSH snapshot from 2000/05/30 
Obtained from:	OpenBSD
 2000-06-03 09:52:37 +00:00
Kris Kennaway
7513668808 This commit was generated by cvs2svn to compensate for changes in r61209, 
which included commits to RCS files with non-trunk default branches.
 2000-06-03 09:52:37 +00:00
Kris Kennaway
cfa18fd2ba Resolve conflicts 2000-06-03 09:23:13 +00:00
Kris Kennaway
87e372b8a2 Import from vendor repository. 
Obtained from:	OpenBSD
 2000-06-03 09:20:19 +00:00
Kris Kennaway
48fb0b1aa9 This commit was generated by cvs2svn to compensate for changes in r61206, 
which included commits to RCS files with non-trunk default branches.
 2000-06-03 09:20:19 +00:00
Kris Kennaway
db1cb46ca2 Bring vendor patches onto the main branch, and resolve conflicts. 2000-06-03 07:31:44 +00:00
Kris Kennaway
1ae2db81a5 Import vendor patches: the first is written by 
Brian Feldman <green@FreeBSD.org>

* Remove the gratuitous dependency on OpenSSL 0.9.5a (preparation for MFC)
* Disable agent forwarding by default in the client (security risk)

Submitted by:	green
Obtained from:	OpenBSD
 2000-06-03 07:18:09 +00:00
Kris Kennaway
7567fde002 This commit was generated by cvs2svn to compensate for changes in r61201, 
which included commits to RCS files with non-trunk default branches.
 2000-06-03 07:18:09 +00:00
Kris Kennaway
fcee55a281 Import vendor patch originally submitted by the below author: don't 
treat failure to create the authentication agent directory in /tmp as
a fatal error, but disable agent forwarding.

Submitted by:	Jan Koum <jkb@yahoo-inc.com>
 2000-06-03 07:06:14 +00:00
Kris Kennaway
6298712178 This commit was generated by cvs2svn to compensate for changes in r61199, 
which included commits to RCS files with non-trunk default branches.
 2000-06-03 07:06:14 +00:00
Kris Kennaway
830ccf58ce Import vendor fix: "fix key_read() for uuencoded keys w/o '='" 
This bug caused OpenSSH not to recognise some of the DSA keys it
generated.

Submitted by:	Christian Weisgerber <naddy@mips.inka.de>
Obtained from:	OpenBSD
 2000-06-03 06:51:30 +00:00
Kris Kennaway
4f00f8562d Update to the version of pam_ssh corresponding to OpenSSH 2.1 (taken 
from the openssh port)

Submitted by:	Hajimu UMEMOTO <ume@mahoroba.org>
 2000-05-30 09:03:15 +00:00
Jake Burkholder
e39756439c Back out the previous change to the queue(3) interface. 
It was not discussed and should probably not happen.

Requested by:		msmith and others
 2000-05-26 02:09:24 +00:00
Jake Burkholder
740a1973a6 Change the way that the queue(3) structures are declared; don't assume that 
the type argument to *_HEAD and *_ENTRY is a struct.

Suggested by:	phk
Reviewed by:	phk
Approved by:	mdodd
 2000-05-23 20:41:01 +00:00
Andrey A. Chernov
a4bc7676d4 Turn on CheckMail to be more login-compatible by default 2000-05-23 06:06:54 +00:00
Brian Somers
73813569e4 Don't USE_PIPES 
Spammed by: peter
Submitted by: mkn@uk.FreeBSD.org
 2000-05-22 09:51:18 +00:00
Kris Kennaway
ba0c6b0830 Correct two stupid typos in the DSA key location. 
Submitted by:	Udo Schweigert <ust@cert.siemens.de>
 2000-05-18 06:04:23 +00:00
Kris Kennaway
b787acb5e3 Unbreak Kerberos5 compilation. This still remains untested. 
Noticed by:	obrien
 2000-05-17 08:06:20 +00:00
Kris Kennaway
e551e5eafa Oops, rename S/Key to Opie in line with FreeBSD usage. 2000-05-15 06:11:30 +00:00
Kris Kennaway
0c11f6e187 Create a DSA host key if one does not already exist, and teach sshd_config 
about it.
 2000-05-15 05:40:27 +00:00
Kris Kennaway
e8aafc91b5 Resolve conflicts and update for FreeBSD. 2000-05-15 05:24:25 +00:00
Kris Kennaway
a04a10f891 Initial import of OpenSSH v2.1. 2000-05-15 04:37:24 +00:00
Kris Kennaway
fe01acb846 This commit was generated by cvs2svn to compensate for changes in r60573, 
which included commits to RCS files with non-trunk default branches.
 2000-05-15 04:37:24 +00:00
Nik Clayton
699cc2f5e1 Note that X11 Forwarding is off by default. 
PR:             docs/17566
Submitted by:   Keith Stevenson <ktstev01@louisville.edu>
 2000-04-30 22:41:58 +00:00
Kris Kennaway
e31adaffd9 Fix a memory leak. 
PR:		17360
Submitted by:	Andrew J. Korty <ajk@iu.edu>
 2000-03-29 08:24:37 +00:00
Kris Kennaway
18fa3c2ec9 #include <ssl/foo.h> -> #include <openssl/foo.h> 2000-03-26 10:00:28 +00:00
Kris Kennaway
3c6ae11886 Resolve conflicts. 2000-03-26 07:37:48 +00:00
Kris Kennaway
a8f6863aa6 Virgin import of OpenSSH sources dated 2000/03/25 2000-03-26 07:07:24 +00:00
Kris Kennaway
cc99d7f2df This commit was generated by cvs2svn to compensate for changes in r58582, 
which included commits to RCS files with non-trunk default branches.
 2000-03-26 07:07:24 +00:00
Brian Somers
727214e9b8 Use pipe() instead of socketpair() in sshd when communicating 
with the client.
This allows ppp/ssh style tunnels to function again.

Ok'd by:	markk
Submitted by:	markk@knigma.org
 2000-03-24 15:39:37 +00:00
Mike Pritchard
5c51cd6437 Fix a few spelling errors. 2000-03-24 02:26:54 +00:00
Sheldon Hearn
962a3f4e81 IgnoreUserKnownHosts is a boolean flag, not an integer value. 
The fix submitted in the attributed PR is identical to the one
adopted by OpenBSD.

PR:		17027
Submitted by:	David Malone <dwmalone@maths.tcd.ie>
Obtained from:	OpenBSD
 2000-03-22 09:36:35 +00:00
Kris Kennaway
9fd4066575 Add a new function stub to libcrypto() which resolves to a symbol in 
the librsa* library and reports which version of the library (OpenSSL/RSAREF)
is being used.

This is then used in openssh to detect the failure case of RSAREF and a RSA key
>1024 bits, to print a more helpful error message than 'rsa_public_encrypt() fai
led.'

This is a 4.0-RELEASE candidate.
 2000-03-13 09:55:53 +00:00
Kris Kennaway
6a8633db4e Various manpage style/grammar/formatting cleanups 
Submitted by:	Peter Jeremy <peter.jeremy@alcatel.com.au>, jedgar
PR:		17292 (remainder of)
 2000-03-13 00:17:43 +00:00
Nik Clayton
8ff0a8c302 - typos 
- Add double spaces following full stops to improve typeset output
- mdoc-ification.  (Though I'm uncertain whether option values and
  contents should be .Dq or something else).
- Fix a missed /etc/ssh change
- Expand wording on RandomSeed and behaviour when X11 isn't forwarded.
- Change examples to literal mode.
- Trim trailing whitespace

PR:		docs/17292
Submitted by:	Peter Jeremy <peter.jeremy@alcatel.com.au>
 2000-03-10 11:48:49 +00:00
Mark Murray
c59bf09996 Make LOGIN_CAP work properly. 2000-03-09 14:52:31 +00:00
Kris Kennaway
2134165c54 /etc -> /etc/ssh 
Submitted by:	Ben Smithurst <ben@scientia.demon.co.uk>
 2000-03-08 03:44:00 +00:00
John Hay
2216ad9c7e MFI: Use krb5 functions in krb5 files. 
Reviewed by:	markm
 2000-03-03 20:31:58 +00:00
Brian Feldman
5dc73ebebe Turn off X11 forwarding in the client. X11 forwarding in the server by 
default should probably also get turned on, now.

Requested by:	kris
Obtained from:	OpenBSD
 2000-03-03 05:58:39 +00:00
Hajimu UMEMOTO
e51ec40ec8 Enable connection logging. FreeBSD's libwrap is IPv6 ready. 
OpenSSH is in our source tree, now.  It's a time to enable it.

Reviewed by:	markm, shin
Approved by:	jkh
 2000-02-29 19:37:04 +00:00
Mark Murray
fe5fd0173b 1) Add kerberos5 functionality. 
by Daniel Kouril <kouril@informatics.muni.cz>
2) Add full LOGIN_CAP capability
   by Andrey Chernov
 2000-02-28 19:03:50 +00:00
Brian Somers
ccd16b43ed Don't put truncated hostnames in utmp 
Approved by: jkh
 2000-02-28 18:51:30 +00:00
Peter Wemm
2307080405 Redo this with a repo copy from the original file and reset the 
__PREFIX__ markers.
 2000-02-26 09:59:14 +00:00
Peter Wemm
4d3289a849 oops, update path to /etc/ssh/ssh_host_key 2000-02-26 02:24:38 +00:00
Peter Wemm
9ceffc938a Merge from internat.freebsd.org; move ssh files from /etc to /etc/ssh 2000-02-25 14:25:10 +00:00
Brian Feldman
8261034302 Fix a bug that crawled in pretty recently (from the port). It made 
sshd coredump :(
 2000-02-25 05:22:14 +00:00
Peter Wemm
38ba484ce1 Fix garbage in SSH_PROGRAM (only on freefall, not internat) 2000-02-25 04:41:06 +00:00
Brian Feldman
a95c122521 Make "CheckHostIP" default to off. This was proposed on -security and 
earlier IRC, but despite my inital feeling against it, this seems
the more proper thing to do.

Proposed by:	rwatson
 2000-02-25 03:04:29 +00:00
Brian Feldman
18a711954e The includes must be <openssl/.*\.h>, not <ssl/.*\.h>. 2000-02-25 01:53:12 +00:00
Mark Murray
b719e3c926 remove more ports crud. 2000-02-24 23:54:00 +00:00
Mark Murray
6ecb050733 remove ports junk 2000-02-24 23:46:38 +00:00
Mark Murray
42f71286cd Add the patches fom ports (QV: ports/security/openssh/patches/patch-*) 2000-02-24 15:29:42 +00:00
Mark Murray
511b41d2a1 Vendor import of OpenSSH. 2000-02-24 14:29:47 +00:00
Mark Murray
8e3e42fe07 This commit was generated by cvs2svn to compensate for changes in r57429, 
which included commits to RCS files with non-trunk default branches.
 2000-02-24 14:29:47 +00:00
Brian Feldman
0e17bca17c Upgrade to the pam_ssh module, version 1.1.. 
(From the author:)
Primarily, I have added built-in functions for manipulating the
environment, so putenv() is no longer used.  XDM and its variants
should now work without modification.  Note that the new code uses
the macros in <sys/queue.h>.

Submitted by:	Andrew J. Korty <ajk@iu.edu>
 1999-12-28 05:32:54 +00:00
Brian Feldman
b71e3dafa5 Add the PAM SSH RSA key authentication module. For example, you can add, 
"login  auth    sufficient      pam_ssh.so" to your /etc/pam.conf, and
users with a ~/.ssh/identity can login(1) with their SSH key :)

PR:		15158
Submitted by:	Andrew J. Korty <ajk@waterspout.com>
Reviewed by:	obrien
 1999-11-29 07:09:44 +00:00