d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
95,901 Commits 4 Branches 49 Tags 2 GiB
b25ecb5dd4
Commit Graph

300 Commits

Author SHA1 Message Date
des
4db40e9ca5 IPv4or6 is already defined in libssh. 2002-06-24 10:15:26 +00:00
des
2894284b2a Resolve conflicts and document local changes. 2002-06-23 21:42:47 +00:00
des
5375a0a2ad Correctly export the environment variables set by setusercontext(). 
Sponsored by:	DARPA, NAI Labs
 2002-06-23 20:22:49 +00:00
des
fa8aa6dfe7 Resolve conflicts. Known issues: 
- sshd fails to set TERM correctly.
 - privilege separation may break PAM and is currently turned off.
 - man pages have not yet been updated

I will have these issues resolved, and privilege separation turned on by
default, in time for DP2.

Sponsored by:	DARPA, NAI Labs
 2002-06-23 16:09:08 +00:00
des
610201f50f Vendor import of OpenSSH 3.3. 2002-06-23 14:01:54 +00:00
des
0161794f0d This commit was generated by cvs2svn to compensate for changes in r98675, 
which included commits to RCS files with non-trunk default branches.
 2002-06-23 14:01:54 +00:00
jedgar
a679ebf88a Remove _PATH_CP now that it is defined in paths.h 
Reviewed by:	des
 2002-05-12 01:52:11 +00:00
obrien
0908b99eb0 Usual after-import fixup of SCM IDs. 2002-05-01 22:39:53 +00:00
des
ec4b7563a5 Back out previous commit. 2002-04-25 16:53:25 +00:00
jkh
04da61f7a8 Change default challenge/response behavior of sshd by popular demand. 
This brings us into sync with the behavior of sshd on other Unix platforms.

Submitted by:	Joshua Goodall <joshua@roughtrade.net>
 2002-04-25 05:59:53 +00:00
ache
162e53dcfe 1) Proberly conditionalize PAM "last login" printout. 
2) For "copyright" case #ifdef HAVE_LOGIN_CAP was placed on too big block,
narrow it down.
3) Don't check the same conditions twice (for "copyright" and "welcome"),
put them under single block.
4) Print \n between "copyright" and "welcome" as our login does.

Reviewed by:	des (1)
 2002-04-23 12:36:11 +00:00
des
ad8d1ef864 Don't report last login time in PAM case. (perforce change 10057) 
Sponsored by:	DARPA, NAI Labs
 2002-04-22 06:26:29 +00:00
des
1a6399fa3b Fix warnings + wait for child so it doesn't go zombie (perforce change 10122) 2002-04-22 06:25:13 +00:00
ache
ac2b640032 Move LOGIN_CAP calls before all file descriptors are closed hard, since some 
descriptors may be used by LOGIN_CAP internally, add login_close().

Use "nocheckmail" LOGIN_CAP capability too like our login does.
 2002-04-21 13:31:56 +00:00
ache
b8f64a3c9b Fix TZ & TERM handling for use_login case of rev. 1.24 2002-04-20 09:56:10 +00:00
ache
a9f47835a0 1) Surprisingly, "CheckMail" handling code completely removed from this 
version, so documented "CheckMail" option exists but does nothing.
Bring it back to life adding code back.

2) Cosmetique. Reduce number of args in do_setusercontext()
 2002-04-20 09:26:43 +00:00
ache
4c135df5a2 1) Fix overlook in my prev. commit - forget HAVE_ prefix in one place in old 
code merge.

2) In addition honor "timezone" and "term" capabilities from login.conf,
not overwrite them once they set (they are TZ and TERM variables).
 2002-04-20 05:44:36 +00:00
ache
9cec8df7cf Please repeat after me: setusercontext() modifies _current_ environment, but 
sshd uses separate child_env. So, to make setusercontext() really does
something, environment must be switched before call and passed to child_env
back after it.

The error here was that modified environment not passed back to child_env,
so all variables that setusercontext() adds are lost, including ones from
~/.login_conf
 2002-04-20 04:38:07 +00:00
des
67bfdd081a Fix some warnings. Don't record logins twice in USE_PAM case. Strip 
"/dev/" off the tty name before passing it to auth_ttyok or PAM.

Inspired by:	dinoex
Sponsored by:	DARPA, NAI Labs
 2002-04-14 16:24:36 +00:00
des
0e80f55d44 Back out previous backout. It seems I was right to begin with, and DSA is 
preferrable to RSA (not least because the SECSH draft standard requires
DSA while RSA is only recommended).
 2002-04-12 15:52:10 +00:00
des
0264ee3296 Knowledgeable persons assure me that RSA is preferable to DSA and that we 
should transition away from DSA.
 2002-04-11 22:04:40 +00:00
des
d48b9c1d4a Prefer DSA to RSA if both are available. 2002-04-11 16:08:48 +00:00
des
be2e00cce9 Do not attempt to load an ssh2 RSA host key by default. 2002-04-11 16:08:02 +00:00
ru
54bcb55671 Align for const poisoning in -lutil. 2002-04-08 11:07:51 +00:00
des
a3900e7d70 Nuke stale copy of the pam_ssh(8) source code. 2002-04-06 04:46:01 +00:00
des
a06ed407a7 Revert to vendor version, what little was left of our local patches here 
was incorrect.

Pointed out by:	Markus Friedl <markus@openbsd.org>
 2002-04-02 23:07:31 +00:00
des
26f5df0f67 Change the FreeBSD version addendum to "FreeBSD-20020402". This shortens 
the version string to 28 characters, which is below the 40-character limit
specified in the proposed SECSH standard.  Some servers, however (like the
one built into the Foundry BigIron line of switches) will hang when
confronted with a version string longer than 24 characters, so some users
may need to shorten it further.

Sponsored by:	DARPA, NAI Labs
 2002-04-02 21:53:54 +00:00
des
ac025bb036 Make the various ssh clients understand the VersionAddendum option. 
Submitted by:	pb
 2002-04-02 21:48:51 +00:00
ru
065ea04bd8 Switch over to using pam_login_access(8) module in sshd(8). 
(Fixes static compilation.  Reduces diffs to OpenSSH.)

Reviewed by:	bde
 2002-03-26 12:52:28 +00:00
nectar
6a3cd1f6ba REALLY correct typo this time. 
Noticed by:	roam
 2002-03-26 12:27:43 +00:00
nectar
8624a5ead1 Fix typo (missing paren) affecting KRB4 && KRB5 case. 
Approved by:	des
 2002-03-25 14:55:41 +00:00
des
c379ca4071 We keep moduli(5) in /etc/ssh, not /etc. 2002-03-23 19:26:21 +00:00
des
0f9782fc45 Correctly set PAM_RHOST so e.g. pam_login_access(8) can do its job. 
Sponsored by:	DARPA, NAI Labs
 2002-03-21 12:55:21 +00:00
des
af3f1ef24c Use the "sshd" service instead of "csshd". The latter was only needed 
because of bugs (incorrect design decisions, actually) in Linux-PAM.

Sponsored by:	DARPA, NAI Labs
 2002-03-21 12:23:09 +00:00
cvs2svn
f58c4e7f5e This commit was manufactured by cvs2svn to create branch 
'VENDOR-crypto-openssh'.
 2002-03-21 12:18:28 +00:00
des
cb58035239 Use PAM instead of S/Key (or OPIE) for SSH2. 
Sponsored by:	DARPA, NAI Labs
 2002-03-21 12:18:27 +00:00
des
2e58ec0271 Note that portions of this software were 
Sponsored by:	DARPA, NAI Labs
 2002-03-20 22:10:10 +00:00
des
8528b8bd57 - Change the prompt from "S/Key Password: " to "OPIE Password: " 
- If the user doesn't have an OPIE key, don't challenge him.  This is
   a workaround until I get PAM to work properly with ssh2.

Sponsored by:	DARPA, NAI Labs
 2002-03-20 22:02:02 +00:00
des
2423fff46f Unbreak for KRB4 ^ KRB5 case. 
Sponsored by:	DARPA, NAI Labs
 2002-03-19 16:44:11 +00:00
des
0ddd6e4b65 Revive this file (which is used for opie rather than skey) 2002-03-18 10:31:33 +00:00
des
6534271ec8 Fix conflicts. 2002-03-18 10:09:43 +00:00
des
2fc4a48897 Vendor import of OpenSSH 3.1 2002-03-18 09:55:03 +00:00
des
ec85a15f0e This commit was generated by cvs2svn to compensate for changes in r92555, 
which included commits to RCS files with non-trunk default branches.
 2002-03-18 09:55:03 +00:00
des
160859d708 Diff reduction. 
Sponsored by:	DARPA, NAI Labs
 2002-03-16 08:03:48 +00:00
nectar
f2ed33b521 Update version string. 2002-03-07 14:36:28 +00:00
nectar
6ee5449e7c Fix off-by-one error. 
Obtained from:	OpenBSD
 2002-03-05 14:27:19 +00:00
green
445306ca92 Use login_getpwclass() instead of login_getclass() so that default 
mapping of user login classes works.

Obtained from:	TrustedBSD project
Sponsored by:	DARPA, NAI Labs
 2002-02-27 22:36:30 +00:00
ru
5307ecb83c Make libssh.so useable (undefined reference to IPv4or6). 
Reviewed by:	des, markm
Approved by:	markm
 2002-01-23 15:06:47 +00:00
green
fe27adc46b Fix a coredump bug occurring if ssh-keygen attempts to change the password 
on a DSA key.

Submitted by:	ian j hart <ianjhart@ntlworld.com>
 2002-01-07 15:55:20 +00:00
nectar
d69c342a45 Update version string since we applied a fix for the UseLogin issue. 2001-12-03 22:47:51 +00:00
nectar
b0b55f7f5f Do not pass user-defined environmental variables to /usr/bin/login. 
Obtained from:	OpenBSD
Approved by:	green
 2001-12-03 00:51:47 +00:00
dwmalone
9a6b4717f3 In the "UseLogin yes" case we need env to be NULL to make sure it 
will be correctly initialised.

PR:		32065
Tested by:	The Anarcat <anarcat@anarcat.dyndns.org>
MFC after:	3 days
 2001-11-19 19:40:14 +00:00
green
e990e27894 Modify a "You don't exist" message, pretty rude for transient YP failures. 2001-09-27 18:54:42 +00:00
assar
6d29950919 fix renamed options in some of the code that was #ifdef AFS 
also print an error if krb5 ticket passing is disabled

Submitted by:	Jonathan Chen <jon@spock.org>
 2001-09-04 13:27:04 +00:00
ps
e7bdb473a8 Backout last change. I didnt follow the thread and made a mistake 
with this.  localisations is a valid spelling.  Oops
 2001-08-27 10:37:50 +00:00
ps
4e55facbeb Correctly spell localizations 2001-08-27 10:20:02 +00:00
green
9f287caebc Update the OpenSSH minor-version string. 
Requested by:	obrien
Reviewed by:	rwatson
 2001-08-16 19:26:19 +00:00
nectar
0e7f0df834 Bug fix: When the client connects to a server and Kerberos 
authentication is  enabled, the  client effectively ignores  any error
from krb5_rd_rep due to a missing branch.

In  theory  this could  result  in  an  ssh  client using  Kerberos  5
authentication accepting  a spoofed  AP-REP.  I doubt  this is  a real
possiblity, however, because  the AP-REP is passed from  the server to
the client via the SSH  encrypted channel.  Any tampering should cause
the decryption or MAC to fail.

Approved by:	green
MFC after:	1 week
 2001-07-13 18:12:13 +00:00
green
961721080a Fix an incorrect conflict resolution which prevented TISAuthentication 
from working right in 2.9.
 2001-07-07 14:19:53 +00:00
green
93a6a41112 Also add a colon to "Bad passphrase, please try again ". 2001-06-29 16:43:13 +00:00
green
5d06029221 Put in a missing colon in the "Enter passphrase" message. 2001-06-29 16:34:14 +00:00
green
fe0162ddb3 Back out the last change which is probably actually a red herring. Argh! 2001-06-26 15:15:22 +00:00
green
c3258d9fdd Don't pointlessly kill a channel because the first (forced) 
non-blocking read returns 0.

Now I can finally tunnel CVSUP again...
 2001-06-26 14:17:35 +00:00
assar
116337ea17 (do_authloop): handle !KRB4 && KRB5 2001-06-16 07:44:17 +00:00
markm
5fa9d6f739 Unbreak OpenSSH for the KRB5-and-no-KRB4 case. Asking for KRB5 does 
not imply that you want, need or have kerberosIV headers.
 2001-06-15 08:12:31 +00:00
green
fdb0c1688a Enable Kerberos 5 support in sshd again. 2001-06-12 03:43:47 +00:00
green
45d207659b Switch to the user's uid before attempting to unlink the auth forwarding 
file, nullifying the effects of a race.

Obtained from:	OpenBSD
 2001-06-08 22:22:09 +00:00
obrien
a26134411c Fix $FreeBSD$ style committer messed up in rev 1.7 for some reason. 2001-05-24 07:22:08 +00:00
obrien
bac609c202 Restore the RSA host key to /etc/ssh/ssh_host_key. 
Also fix $FreeBSD$ spamage in crypto/openssh/sshd_config rev. 1.16.
 2001-05-18 18:10:02 +00:00
green
a407780211 If a host would exceed 16 characters in the utmp entry, record only 
it's IP address/base host instead.

Submitted by:	brian
 2001-05-15 01:50:40 +00:00
ru
3add9296c0 mdoc(7) police: finished fixing conflicts in revision 1.18. 2001-05-14 18:13:34 +00:00
markm
cdb0cb9ccd Fix make world in the kerberosIV case. 2001-05-11 09:36:17 +00:00
alfred
bd16bfd06f Fix some of the handling in the pam module, don't unregister things 
that were never registered.  At the same time handle a failure from
pam_setcreds with a bit more paranioa than the previous fix.

Sync a bit with the "Portable OpenSSH" work to make comparisons a easier.
 2001-05-09 03:40:37 +00:00
green
9c961719a9 Since PAM is broken, let pam_setcred() failure be non-fatal. 2001-05-08 22:30:18 +00:00
green
3f59c74031 sshd_config should still be keeping ssh host keys in /etc/ssh, not /etc. 2001-05-05 13:48:13 +00:00
green
094816f4b2 Finish committing _more_ somehow-uncommitted OpenSSH 2.9 updates. 
(Missing Delta Brigade, tally-ho!)
 2001-05-05 01:12:45 +00:00
green
729aac1a81 Get ssh(1) compiling with MAKE_KERBEROS5. 2001-05-04 04:37:49 +00:00
green
d1f65ecd2b Remove obsoleted files. 2001-05-04 04:15:22 +00:00
green
119a11eb6b Fix conflicts for OpenSSH 2.9. 2001-05-04 04:14:23 +00:00
green
8acd87ac47 Say "hi" to the latest in the OpenSSH series, version 2.9! 
Happy birthday to:	rwatson
 2001-05-04 03:57:05 +00:00
green
08fd06354d This commit was generated by cvs2svn to compensate for changes in r76259, 
which included commits to RCS files with non-trunk default branches.
 2001-05-04 03:57:05 +00:00
green
461d7e1472 Add a "VersionAddendum" configuration setting for sshd which allows 
anyone to easily change the part of the OpenSSH version after the main
version number.  The FreeBSD-specific version banner could be disabled
that way, for example:

# Call ourselves plain OpenSSH
VersionAddendum
 2001-05-03 00:29:28 +00:00
green
6d6d6e45ee Backout completely canonical lookup modifications. 2001-05-03 00:26:47 +00:00
green
b9a62213ae Suggested by kris, OpenSSH shall have a version designated to note that 
it's not "plain" OpenSSH 2.3.0.
 2001-03-20 02:11:25 +00:00
green
e1c06db961 Make password attacks based on traffic analysis harder by requiring that 
"non-echoed" characters are still echoed back in a null packet, as well
as pad passwords sent to not give hints to the length otherwise.

Obtained from:	OpenBSD
 2001-03-20 02:06:40 +00:00
asmodai
355885cfa7 Fix double mention of ssh. 
This file is already off the vendorbranch, nonetheless it needs to be
submitted back to the OpenSSH people.

PR:		25743
Submitted by:	David Wolfskill <dhw@whistle.com>
 2001-03-15 09:24:40 +00:00
green
8b51db0ce8 Don't dump core when an attempt is made to login using protocol 2 with 
an invalid user name.
 2001-03-15 03:15:18 +00:00
assar
95047bd0c5 (try_krb5_authentication): simplify code. from joda@netbsd.org 2001-03-13 04:42:38 +00:00
assar
07c5543bb1 Fix LP64 problem in Kerberos 5 TGT passing. 
Obtained from: NetBSD (done by thorpej@netbsd.org)
 2001-03-12 08:14:22 +00:00
green
f261519030 Reenable the SIGPIPE signal handler default in all cases for spawned 
sessions.
 2001-03-11 02:26:57 +00:00
assar
4e2eb78eca Add code for being compatible with ssh.com's krb5 authentication. 
It is done by using the same ssh messages for v4 and v5 authentication
(since the ssh.com does not now anything about v4) and looking at the
contents after unpacking it to see if it is v4 or v5.
Based on code from Björn Grönvall <bg@sics.se>

PR:		misc/20504
 2001-03-04 02:22:04 +00:00
ps
4abb31bd7d Make ConnectionsPerPeriod non-fatal for real. 2001-02-18 01:33:31 +00:00
assar
e25a9ea1d2 update to new heimdal libkrb5 2001-02-13 16:58:04 +00:00
kris
94cb603894 Patches backported from later development version of OpenSSH which prevent 
(instead of just mitigating through connection limits) the Bleichenbacher
attack which can lead to guessing of the server key (not host key) by
regenerating it when an RSA failure is detected.

Reviewed by:	rwatson
 2001-02-12 06:44:51 +00:00
green
c0460ef928 Correctly fill in the sun_len for a sockaddr_sun. 
Submitted by:	Alexander Leidinger <Alexander@leidinger.net>
 2001-02-04 20:23:17 +00:00
green
007d3cc3ed MFS: Don't use the canonical hostname here, too. 2001-02-04 20:16:14 +00:00
green
8ae23e3ef8 MFF: Make ConnectionsPerPeriod usage a warning, not fatal. 2001-02-04 20:15:53 +00:00
green
42801d85d9 Actually propagate back to the rest of the application that a command 
was specified when using -t mode with the SSH client.

Submitted by:	Dima Dorfman <dima@unixfreak.org>
 2001-01-21 05:45:27 +00:00
green
759414f218 /Really/ deprecate ConnectionsPerPeriod, ripping out the code for it 
and giving a dire error to its lingering users.
 2001-01-13 07:57:43 +00:00
green
a121b36822 Fix a long-standing bug that resulted in a dropped session sometimes 
when an X11-forwarded client was closed.  For some reason, sshd didn't
disable the SIGPIPE exit handler and died a horrible death (well, okay,
a silent death really).  Set SIGPIPE's handler to SIG_IGN.
 2001-01-06 21:15:07 +00:00
cvs2svn
5bcde1229c This commit was manufactured by cvs2svn to create branch 
'VENDOR-crypto-openssh'.
 2000-12-05 02:55:13 +00:00
green
ab6b35a1d6 Update to OpenSSH 2.3.0 with FreeBSD modifications. OpenSSH 2.3.0 
new features description elided in favor of checking out their
website.

Important new FreeBSD-version stuff: PAM support has been worked
in, partially from the "Unix" OpenSSH version, and a lot due to the
work of Eivind Eklend, too.

This requires at least the following in pam.conf:

sshd    auth    sufficient      pam_skey.so
sshd    auth    required        pam_unix.so                     try_first_pass
sshd    session required        pam_permit.so

Parts by:	Eivind Eklend <eivind@FreeBSD.org>
 2000-12-05 02:55:12 +00:00
green
6202ac1614 Forgot to remove the old line in the last commit. 2000-12-05 02:41:01 +00:00
green
2aecee364f Import of OpenSSH 2.3.0 (virgin OpenBSD source release). 2000-12-05 02:20:19 +00:00
green
1c5144a169 This commit was generated by cvs2svn to compensate for changes in r69587, 
which included commits to RCS files with non-trunk default branches.
 2000-12-05 02:20:19 +00:00
brian
17a750ff36 Remove duplicate line 
Not responded to by: kris, then green
 2000-12-04 22:57:53 +00:00
green
163406c6e5 In env_destroy(), it is a bad idea to env_swap(self, 0) to switch 
back to the original environ unconditionally.  The setting of the
variable to save the previous environ is conditional; it happens when
ENV.e_committed is set.  Therefore, don't try to swap the env back
unless the previous env has been initialized.

PR:		bin/22670
Submitted by:	Takanori Saneto <sanewo@ba2.so-net.ne.jp>
 2000-11-25 02:00:35 +00:00
billf
de5ab7abc1 Correct an arguement to ssh_add_identity, this matches what is currently 
in ports/security/openssh/files/pam_ssh.c

PR:		22164
Submitted by:	Takanori Saneto <sanewo@ba2.so-net.ne.jp>
Reviewed by:	green
Approved by:	green
 2000-11-25 01:55:42 +00:00
green
0bc5843790 Add login_cap and login_access support. Previously, these FreeBSD-local 
checks were only made when using the 1.x protocol.
 2000-11-14 04:35:03 +00:00
green
100d82038d Import a security fix: the client would allow a server to use its 
ssh-agent or X11 forwarding even if it was disabled.

This is the vendor fix provided, not an actual revision of clientloop.c.

Submitted by:	Markus Friedl <markus@OpenBSD.org> via kris
 2000-11-14 03:51:53 +00:00
green
fb253173ae This commit was generated by cvs2svn to compensate for changes in r68700, 
which included commits to RCS files with non-trunk default branches.
 2000-11-14 03:51:53 +00:00
green
3c8715d5d7 Fix a few style oddities. 2000-09-10 18:04:12 +00:00
green
bb24bb397b Fix a goof in timevaldiff. 2000-09-10 18:03:46 +00:00
kris
c5a4794750 Remove files no longer present in OpenSSH 2.2.0 and beyond 2000-09-10 10:26:07 +00:00
kris
24372e6c10 Resolve conflicts and update for OpenSSH 2.2.0 
Reviewed by:	gshapiro, peter, green
 2000-09-10 09:35:38 +00:00
kris
0ca2bdc2f7 Initial import of OpenSSH post-2.2.0 snapshot dated 2000-09-09 2000-09-10 08:31:17 +00:00
kris
f2912c8208 This commit was generated by cvs2svn to compensate for changes in r65668, 
which included commits to RCS files with non-trunk default branches.
 2000-09-10 08:31:17 +00:00
kris
e4a753d311 Nuke RSAREF support from orbit. 
It's the only way to be sure.
 2000-09-10 00:09:37 +00:00
kris
2450bc1f18 ttyname was not being passed into do_login(), so we were erroneously picking 
up the function definition from unistd.h instead. Use s->tty instead.

Submitted by:	peter
 2000-09-04 08:43:05 +00:00
kris
175e5fe4dd bzero() the struct timeval for paranoia 
Submitted by:	gshapiro
 2000-09-03 07:58:35 +00:00
kris
868b20c6a8 Err, we weren't even compiling auth1.c with LOGIN_CAP at all. Guess nobody 
was using this feature.
 2000-09-02 07:32:05 +00:00
kris
458b9e5882 Repair a broken conflict resolution in r1.2 which had the effect of nullifying 
the login_cap and login.access checks for whether a user/host is allowed
access to the system for users other than root. But since we currently don't
have a similar check in the ssh2 code path anyway, it's um, "okay".

Submitted by:	gshapiro
 2000-09-02 05:40:50 +00:00
kris
8b99f6e1dc Repair my dyslexia: s/opt/otp/ in the OPIE challenge. D'oh! 
Submitted by:	gshapiro
 2000-09-02 04:41:33 +00:00
kris
6eee534256 Re-add missing "break" which was lost during a previous patch 
integration. This currently has no effect.

Submitted by:	gshapiro
 2000-09-02 04:37:51 +00:00
kris
42ae81df48 Turn on X11Forwarding by default on the server. Any risk is to the client, 
where it is already disabled by default.

Reminded by:	peter
 2000-09-02 03:49:22 +00:00
kris
3ae9606341 Increase the default value of LoginGraceTime from 60 seconds to 120 
seconds.

PR:		20488
Submitted by:	rwatson
 2000-08-23 09:47:25 +00:00
kris
aba57a02e8 Respect X11BASE to derive the location of xauth(1) 
PR:		17818
Submitted by:	Bjoern Fischer <bfischer@Techfak.Uni-Bielefeld.DE>
 2000-08-23 09:39:20 +00:00
asmodai
5209950187 Chalk up another phkmalloc victim. 
It seems as if uninitialised memory was the culprit.

We may want to contribute this back to the OpenSSH project.

Submitted by:	Alexander Leidinger <Alexander@Leidinger.net> on -current.
 2000-08-01 08:07:15 +00:00
asmodai
0a6c762555 Fix a weird typo, is -> are. 
The OpenSSH maintainer probably want to contribute this back to the
real OpenSSH guys.

Submitted by:	Jon Perkin <sketchy@netcraft.com>
 2000-07-27 19:21:15 +00:00
marko
1dcee686be Fixed a minor typo in the header. 
Pointed out by:	asmodai
 2000-07-27 17:21:07 +00:00
marko
674af77794 Committed, Thanks!! 
PR:		20108
Submitted by:	Doug Lee
 2000-07-25 16:49:48 +00:00
peter
d9df5f65de Sync sshd_config with sshd and manapage internal defaults (Checkmail = yes) 2000-07-11 09:54:24 +00:00
peter
5f6efaa063 Sync LoginGraceTime with sshd_config = 60 seconds by default, not 600. 2000-07-11 09:52:14 +00:00
peter
772dd17b51 Fix out-of-sync defaults. PermitRootLogin is supposed to be 'no' but 
sshd's internal default was 'yes'.  (if some cracker managed to trash
/etc/ssh/sshd_config, then root logins could be reactivated)

Approved by: kris
 2000-07-11 09:50:15 +00:00
peter
adeace1395 Make FallBackToRsh off by default. Falling back to rsh by default is 
silly in this day and age.

Approved by: kris
 2000-07-11 09:39:34 +00:00
green
be6e69fbed Allow restarting on SIGHUP when the full path was not given as argv[0]. 
We do have /proc/curproc/file :)
 2000-07-04 06:43:26 +00:00
green
26efc47d38 So /this/ is what has made OpenSSH's SSHv2 support never work right! 
In some cases, limits did not get set to the proper class, but
instead always to "default", because not all passwd copies were
done to completion.
 2000-06-27 21:16:06 +00:00
green
71e9ee0209 Also make sure to close the socket that exceeds your rate limit. 2000-06-26 23:39:26 +00:00
green
9bccae4f2e Make rate limiting work per-listening-socket. Log better messages than 
before for this, requiring a new function (get_ipaddr()).  canohost.c
receives a $FreeBSD$ line.

Suggested by:	Niels Provos <niels@OpenBSD.org>
 2000-06-26 05:44:23 +00:00
kris
4f57b24cfd Fix syntax error in previous commit. 
Submitted by:	Udo Schweigert <ust@cert.siemens.de>
 2000-06-11 21:41:25 +00:00
kris
ad6da2a572 Fix security botch in "UseLogin Yes" case: commands are executed with 
uid 0.

Obtained from:	OpenBSD
 2000-06-10 22:32:57 +00:00
ru
caf976b39e Make `ssh-agent -k' work for csh(1)-like shells. 2000-06-10 14:14:28 +00:00
green
ba3f3c2ac7 Allow "DenyUsers" to function. 2000-06-06 06:16:55 +00:00
kris
a55fcaa060 Resolve conflicts 2000-06-03 09:58:15 +00:00
kris
3639dd9ace Initial import of OpenSSH snapshot from 2000/05/30 
Obtained from:	OpenBSD
 2000-06-03 09:52:37 +00:00
kris
0a76acd42d This commit was generated by cvs2svn to compensate for changes in r61209, 
which included commits to RCS files with non-trunk default branches.
 2000-06-03 09:52:37 +00:00
kris
1e51208074 Resolve conflicts 2000-06-03 09:23:13 +00:00
kris
585dc667de Import from vendor repository. 
Obtained from:	OpenBSD
 2000-06-03 09:20:19 +00:00
kris
780d02839a This commit was generated by cvs2svn to compensate for changes in r61206, 
which included commits to RCS files with non-trunk default branches.
 2000-06-03 09:20:19 +00:00
kris
66c0eb5d8c Bring vendor patches onto the main branch, and resolve conflicts. 2000-06-03 07:31:44 +00:00