Merge lp:~logan/ubuntu/raring/nagios-nrpe/2.13-2ubuntu1 into lp:ubuntu/raring/nagios-nrpe

[Logan Rosen]

[Michael Terry (mterry)]

Looks good. Thanks!

I've pushed to raring.

review: Approve

=== modified file 'debian/README.Debian'
--- debian/README.Debian	2011-09-25 08:35:48 +0000
+++ debian/README.Debian	2013-02-24 20:34:21 +0000
@@ -8,4 +8,14 @@
 To enable the use of command argument processing change dont_blame_nrpe option
 in nrpe.cfg then create the commands you want in nrpe_local.cfg or
 /etc/nagios/nrpe.d/
-Most options can be overridden from there
+Most options can be overridden from there.
+
+Do not rely on SSL mode for security
+------------------------------------
+
+NRPE contains an SSL mode which encrypts the data over the NRPE channel.
+The current implementation does not verify client or server and uses
+pregenerated key data by default. It cannot be fixed right away because
+it would break the existing NRPE protocol.
+
+Please refer to the file SECURITY in this directory for more information.

=== modified file 'debian/changelog'
--- debian/changelog	2013-02-02 18:16:48 +0000
+++ debian/changelog	2013-02-24 20:34:21 +0000
@@ -1,3 +1,19 @@
+nagios-nrpe (2.13-2ubuntu1) raring; urgency=low
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/{rules,control}: Add hardening-includes to gain PIE security
+      builds.
+    - debian/rules: Use dpkg-buildflags.
+
+ -- Logan Rosen <[e-mail]>  Sun, 24 Feb 2013 15:29:43 -0500
+
+nagios-nrpe (2.13-2) unstable; urgency=high
+
+  [ Thijs Kinkhorst ]
+  * Add warning about the inadequateness of the 'ssl' option.
+
+ -- Alexander Wirt <[e-mail]>  Mon, 11 Feb 2013 17:45:20 +0100
+
 nagios-nrpe (2.13-1ubuntu1) raring; urgency=low
 
   * Merge from Debian unstable. Remaining changes:

=== modified file 'debian/docs'
--- debian/docs	2006-05-14 21:38:48 +0000
+++ debian/docs	2013-02-24 20:34:21 +0000
@@ -1,4 +1,3 @@
 README
-README.SSL
 LEGAL
 SECURITY

=== modified file 'debian/patches/00list'
--- debian/patches/00list	2009-07-06 07:08:26 +0000
+++ debian/patches/00list	2013-02-24 20:34:21 +0000
@@ -4,3 +4,4 @@
 04_weird_output.dpatch
 05_pid_privileges.dpatch
 06_pid_directory.dpatch
+07_warn_ssloption.dpatch

=== added file 'debian/patches/07_warn_ssloption.dpatch'
--- debian/patches/07_warn_ssloption.dpatch	1970-01-01 00:00:00 +0000
+++ debian/patches/07_warn_ssloption.dpatch	2013-02-24 20:34:21 +0000
@@ -0,0 +1,30 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 07_warn_ssloption.dpatch by Thijs Kinkhorst <[e-mail]>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Warn against inadequateness of NRPE's own SSL option.
+
+--- a/SECURITY	2013-02-10 15:07:18.000000000 +0100
++++ b/SECURITY	2013-02-10 15:08:50.000000000 +0100
+@@ -67,14 +67,17 @@
+ ----------
+ 
+ If you do enable support for command arguments in the NRPE daemon,
+-make sure that you encrypt communications either by using:
+-
+-   1.  Stunnel (see http://www.stunnel.org for more info)
+-   2.  Native SSL support
++make sure that you encrypt communications either by using, for
++example, Stunnel (see http://www.stunnel.org for more info).
+ 
+ Do NOT assume that just because the daemon is behind a firewall
+ that you are safe!  Always encrypt NRPE traffic!
+ 
++NOTE: the currently shipped native SSL support of NRPE is not an
++adequante protection, because it does not verify clients and
++server, and uses pregenerated key material. NRPE's SSL option is
++advised against. For more information, see Debian bug #547092.
++
+ 
+ USING ARGUMENTS
+ ---------------