lp:ubuntu/gutsy-security/openssh

Created by James Westby and last modified
Get this branch:
bzr branch lp:ubuntu/gutsy-security/openssh
Members of Ubuntu branches can upload to this branch. Log in for directions.

Branch merges

Related bugs

Related blueprints

Branch information

Owner:
Ubuntu branches
Review team:
Ubuntu Development Team
Status:
Development

Recent revisions

30. By Kees Cook

* SECURITY UPDATE: block .ssh/rc processing when running ForceCommand.
* References
  CVE-2008-1657

29. By Jamie Strandboge

* Add a FILES section to ssh-vulnkey(1) (thanks, Hugh Daniel).
* ssh-vulnkey handles options in authorized_keys (LP: #230029), and treats
  # as introducing a comment even if it is preceded by whitespace (thanks
  Colin Watson)

28. By Jamie Strandboge

fix error in Template file

27. By Jamie Strandboge

* Mitigate OpenSSL security vulnerability thank to Colin Watson:
  - Add key blacklisting support. Keys listed in
    /etc/ssh/blacklist.TYPE-LENGTH will be rejected for authentication by
    sshd, unless "PermitBlacklistedKeys yes" is set in
    /etc/ssh/sshd_config.
  - Add a new program, ssh-vulnkey, which can be used to check keys
    against these blacklists.
  - Depend on openssh-blacklist.
  - Force dependencies on libssl0.9.8 / libcrypto0.9.8-udeb to at least
    0.9.8c-4ubuntu0.3.
  - Automatically regenerate known-compromised host keys, with a
    critical-priority debconf note. (I regret that there was no time to
    gather translations.)
* added README.compromised-keys thanks to Colin Watson
* References
  CVE-2008-0166
  http://www.ubuntu.com/usn/usn-612-1

26. By Kees Cook

* SECURITY UPDATE: X11 forward hijacking via alternate address families.
* channels.c: upstream fixes, patched inline. Thanks to Nicolas Valcarcel
  (LP: #210175).
* References
  CVE-2008-1483

25. By Kees Cook

* SECURITY UPDATE: trusted cookie leak when untrusted cookie cannot be
  generated.
* debian/control: Updated Maintainer Field to follow Ubuntu Maintainer Policy
* clientloop.c: Applied patch according to openssh upstream (LP: #162171),
  thanks to Stephan Hermann.
* References:
  CVE-2007-4752
  http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=444738
  http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/clientloop.c.diff?r1=1.180&r2=1.181

24. By LaMont Jones

Trigger rebuild for hppa

23. By Colin Watson

* Identify ssh as a metapackage rather than a transitional package. It's
  still useful as a quick way to install both the client and the server.
* ssh-copy-id now checks the exit status of ssh-add -L (thanks, Adeodato
  Simó; closes: #221675).
* ssh-copy-id no longer prints the output of expr (thanks, Peter
  Eisentraut; closes: #291534).
* ssh-copy-id defaults to ~/.ssh/id_rsa.pub rather than
  ~/.ssh/identity.pub, in line with ssh-keygen (thanks, Greg Norris;
  closes: #234627).
* Build-depend on libselinux1-dev on lpia.
* openssh-client Suggests: keychain.
* debconf template translations:
  - Update Catalan (thanks, Jordà Polo; closes: #431970).

22. By Colin Watson

* Fix ordering of SYSLOG_LEVEL_QUIET and SYSLOG_LEVEL_FATAL.
* Clarify that 'ssh -q -q' still prints errors caused by bad arguments
  (i.e. before the logging system is initialised).
* Suppress "Connection to <host> closed" and "Connection to master closed"
  messages at loglevel SILENT (thanks, Jaap Eldering; closes: #409788).
* Suppress "Pseudo-terminal will not be allocated because stdin is not a
  terminal" message at loglevels QUIET and SILENT (closes: #366814).
* Document the SILENT loglevel in sftp-server(8), ssh_config(5), and
  sshd_config(5).
* Add try-restart action to init script.
* Add /etc/network/if-up.d/openssh-server to restart sshd when new
  interfaces appear (LP: #103436).
* Backport from upstream:
  - Move C/R -> kbdint special case to after the defaults have been
    loaded, which makes ChallengeResponse default to yes again. This was
    broken by the Match changes and not fixed properly subsequently
    (closes: #428968).
  - Silence spurious error messages from hang-on-exit fix
    (http://bugzilla.mindrot.org/show_bug.cgi?id=1306, closes: #429531).

21. By Colin Watson

* New upstream release (closes: #395507, #397961, #420035). Important
  changes not previously backported to 4.3p2:
  - 4.4/4.4p1 (http://www.openssh.org/txt/release-4.4):
    + On portable OpenSSH, fix a GSSAPI authentication abort that could be
      used to determine the validity of usernames on some platforms.
    + Implemented conditional configuration in sshd_config(5) using the
      "Match" directive. This allows some configuration options to be
      selectively overridden if specific criteria (based on user, group,
      hostname and/or address) are met. So far a useful subset of
      post-authentication options are supported and more are expected to
      be added in future releases.
    + Add support for Diffie-Hellman group exchange key agreement with a
      final hash of SHA256.
    + Added a "ForceCommand" directive to sshd_config(5). Similar to the
      command="..." option accepted in ~/.ssh/authorized_keys, this forces
      the execution of the specified command regardless of what the user
      requested. This is very useful in conjunction with the new "Match"
      option.
    + Add a "PermitOpen" directive to sshd_config(5). This mirrors the
      permitopen="..." authorized_keys option, allowing fine-grained
      control over the port-forwardings that a user is allowed to
      establish.
    + Add optional logging of transactions to sftp-server(8).
    + ssh(1) will now record port numbers for hosts stored in
      ~/.ssh/known_hosts when a non-standard port has been requested
      (closes: #50612).
    + Add an "ExitOnForwardFailure" option to cause ssh(1) to exit (with a
      non-zero exit code) when requested port forwardings could not be
      established.
    + Extend sshd_config(5) "SubSystem" declarations to allow the
      specification of command-line arguments.
    + Replacement of all integer overflow susceptible invocations of
      malloc(3) and realloc(3) with overflow-checking equivalents.
    + Many manpage fixes and improvements.
    + Add optional support for OpenSSL hardware accelerators (engines),
      enabled using the --with-ssl-engine configure option.
    + Tokens in configuration files may be double-quoted in order to
      contain spaces (closes: #319639).
    + Move a debug() call out of a SIGCHLD handler, fixing a hang when the
      session exits very quickly (closes: #307890).
    + Fix some incorrect buffer allocation calculations (closes: #410599).
    + ssh-add doesn't ask for a passphrase if key file permissions are too
      liberal (closes: #103677).
    + Likewise, ssh doesn't ask either (closes: #99675).
  - 4.6/4.6p1 (http://www.openssh.org/txt/release-4.6):
    + sshd now allows the enabling and disabling of authentication methods
      on a per user, group, host and network basis via the Match directive
      in sshd_config.
    + Fixed an inconsistent check for a terminal when displaying scp
      progress meter (closes: #257524).
    + Fix "hang on exit" when background processes are running at the time
      of exit on a ttyful/login session (closes: #88337).
* Update to current GSSAPI patch from
  http://www.sxw.org.uk/computing/patches/openssh-4.6p1-gsskex-20070312.patch;
  install ChangeLog.gssapi.
* Build the .deb --with-ssl-engine (closes: #408027, LP: #119295).
* Use LSB functions in init scripts, and add an LSB-style header (partly
  from Ubuntu and partly thanks to Christian Perrier; closes: #389038).
* Move init script start links to S16, move rc1 stop link to K84, and
  remove rc0 and rc6 stop links altogether (the last part from Ubuntu;
  closes: #122188).
* Emit a slightly more informative message from the init script if
  /dev/null has somehow become not a character device (closes: #369964).
* Belatedly build-depend on zlib1g-dev (>= 1:1.2.3-1) (closes: #333447).
* Merge from Ubuntu:
  - Build position-independent executables (only for debs, not for udebs)
    to take advantage of address space layout randomisation.
  - If building on Ubuntu, add /sbin, /usr/sbin, and /usr/local/sbin to
    the default path.
* Use ${binary:Version} rather than ${Source-Version} in openssh-server ->
  openssh-client dependency.

Branch metadata

Branch format:
Branch format 7
Repository format:
Bazaar repository format 2a (needs bzr 1.16 or later)
Stacked on:
lp:ubuntu/lucid/openssh
This branch contains Public information 
Everyone can see this information.

Subscribers