lp:ubuntu/gutsy-security/openssh
- Get this branch:
- bzr branch lp:ubuntu/gutsy-security/openssh
Branch merges
Branch information
Recent revisions
- 30. By Kees Cook
-
* SECURITY UPDATE: block .ssh/rc processing when running ForceCommand.
* References
CVE-2008-1657 - 29. By Jamie Strandboge
-
* Add a FILES section to ssh-vulnkey(1) (thanks, Hugh Daniel).
* ssh-vulnkey handles options in authorized_keys (LP: #230029), and treats
# as introducing a comment even if it is preceded by whitespace (thanks
Colin Watson) - 27. By Jamie Strandboge
-
* Mitigate OpenSSL security vulnerability thank to Colin Watson:
- Add key blacklisting support. Keys listed in
/etc/ssh/blacklist. TYPE-LENGTH will be rejected for authentication by
sshd, unless "PermitBlacklistedKeys yes" is set in
/etc/ssh/sshd_ config.
- Add a new program, ssh-vulnkey, which can be used to check keys
against these blacklists.
- Depend on openssh-blacklist.
- Force dependencies on libssl0.9.8 / libcrypto0.9.8-udeb to at least
0.9.8c-4ubuntu0. 3.
- Automatically regenerate known-compromised host keys, with a
critical-priority debconf note. (I regret that there was no time to
gather translations.)
* added README.compromised- keys thanks to Colin Watson
* References
CVE-2008-0166
http://www.ubuntu. com/usn/ usn-612- 1 - 26. By Kees Cook
-
* SECURITY UPDATE: X11 forward hijacking via alternate address families.
* channels.c: upstream fixes, patched inline. Thanks to Nicolas Valcarcel
(LP: #210175).
* References
CVE-2008-1483 - 25. By Kees Cook
-
* SECURITY UPDATE: trusted cookie leak when untrusted cookie cannot be
generated.
* debian/control: Updated Maintainer Field to follow Ubuntu Maintainer Policy
* clientloop.c: Applied patch according to openssh upstream (LP: #162171),
thanks to Stephan Hermann.
* References:
CVE-2007-4752
http://bugs.debian. org/cgi- bin/bugreport. cgi?bug= 444738
http://www.openbsd. org/cgi- bin/cvsweb/ src/usr. bin/ssh/ clientloop. c.diff? r1=1.180& r2=1.181 - 23. By Colin Watson
-
* Identify ssh as a metapackage rather than a transitional package. It's
still useful as a quick way to install both the client and the server.
* ssh-copy-id now checks the exit status of ssh-add -L (thanks, Adeodato
Simó; closes: #221675).
* ssh-copy-id no longer prints the output of expr (thanks, Peter
Eisentraut; closes: #291534).
* ssh-copy-id defaults to ~/.ssh/id_rsa.pub rather than
~/.ssh/identity. pub, in line with ssh-keygen (thanks, Greg Norris;
closes: #234627).
* Build-depend on libselinux1-dev on lpia.
* openssh-client Suggests: keychain.
* debconf template translations:
- Update Catalan (thanks, Jordà Polo; closes: #431970). - 22. By Colin Watson
-
* Fix ordering of SYSLOG_LEVEL_QUIET and SYSLOG_LEVEL_FATAL.
* Clarify that 'ssh -q -q' still prints errors caused by bad arguments
(i.e. before the logging system is initialised).
* Suppress "Connection to <host> closed" and "Connection to master closed"
messages at loglevel SILENT (thanks, Jaap Eldering; closes: #409788).
* Suppress "Pseudo-terminal will not be allocated because stdin is not a
terminal" message at loglevels QUIET and SILENT (closes: #366814).
* Document the SILENT loglevel in sftp-server(8), ssh_config(5), and
sshd_config(5).
* Add try-restart action to init script.
* Add /etc/network/if-up.d/ openssh- server to restart sshd when new
interfaces appear (LP: #103436).
* Backport from upstream:
- Move C/R -> kbdint special case to after the defaults have been
loaded, which makes ChallengeResponse default to yes again. This was
broken by the Match changes and not fixed properly subsequently
(closes: #428968).
- Silence spurious error messages from hang-on-exit fix
(http://bugzilla. mindrot. org/show_ bug.cgi? id=1306, closes: #429531). - 21. By Colin Watson
-
* New upstream release (closes: #395507, #397961, #420035). Important
changes not previously backported to 4.3p2:
- 4.4/4.4p1 (http://www.openssh. org/txt/ release- 4.4):
+ On portable OpenSSH, fix a GSSAPI authentication abort that could be
used to determine the validity of usernames on some platforms.
+ Implemented conditional configuration in sshd_config(5) using the
"Match" directive. This allows some configuration options to be
selectively overridden if specific criteria (based on user, group,
hostname and/or address) are met. So far a useful subset of
post-authentication options are supported and more are expected to
be added in future releases.
+ Add support for Diffie-Hellman group exchange key agreement with a
final hash of SHA256.
+ Added a "ForceCommand" directive to sshd_config(5). Similar to the
command="..." option accepted in ~/.ssh/authorized_ keys, this forces
the execution of the specified command regardless of what the user
requested. This is very useful in conjunction with the new "Match"
option.
+ Add a "PermitOpen" directive to sshd_config(5). This mirrors the
permitopen="..." authorized_keys option, allowing fine-grained
control over the port-forwardings that a user is allowed to
establish.
+ Add optional logging of transactions to sftp-server(8).
+ ssh(1) will now record port numbers for hosts stored in
~/.ssh/known_ hosts when a non-standard port has been requested
(closes: #50612).
+ Add an "ExitOnForwardFailure" option to cause ssh(1) to exit (with a
non-zero exit code) when requested port forwardings could not be
established.
+ Extend sshd_config(5) "SubSystem" declarations to allow the
specification of command-line arguments.
+ Replacement of all integer overflow susceptible invocations of
malloc(3) and realloc(3) with overflow-checking equivalents.
+ Many manpage fixes and improvements.
+ Add optional support for OpenSSL hardware accelerators (engines),
enabled using the --with-ssl-engine configure option.
+ Tokens in configuration files may be double-quoted in order to
contain spaces (closes: #319639).
+ Move a debug() call out of a SIGCHLD handler, fixing a hang when the
session exits very quickly (closes: #307890).
+ Fix some incorrect buffer allocation calculations (closes: #410599).
+ ssh-add doesn't ask for a passphrase if key file permissions are too
liberal (closes: #103677).
+ Likewise, ssh doesn't ask either (closes: #99675).
- 4.6/4.6p1 (http://www.openssh. org/txt/ release- 4.6):
+ sshd now allows the enabling and disabling of authentication methods
on a per user, group, host and network basis via the Match directive
in sshd_config.
+ Fixed an inconsistent check for a terminal when displaying scp
progress meter (closes: #257524).
+ Fix "hang on exit" when background processes are running at the time
of exit on a ttyful/login session (closes: #88337).
* Update to current GSSAPI patch from
http://www.sxw. org.uk/ computing/ patches/ openssh- 4.6p1-gsskex- 20070312. patch;
install ChangeLog.gssapi.
* Build the .deb --with-ssl-engine (closes: #408027, LP: #119295).
* Use LSB functions in init scripts, and add an LSB-style header (partly
from Ubuntu and partly thanks to Christian Perrier; closes: #389038).
* Move init script start links to S16, move rc1 stop link to K84, and
remove rc0 and rc6 stop links altogether (the last part from Ubuntu;
closes: #122188).
* Emit a slightly more informative message from the init script if
/dev/null has somehow become not a character device (closes: #369964).
* Belatedly build-depend on zlib1g-dev (>= 1:1.2.3-1) (closes: #333447).
* Merge from Ubuntu:
- Build position-independent executables (only for debs, not for udebs)
to take advantage of address space layout randomisation.
- If building on Ubuntu, add /sbin, /usr/sbin, and /usr/local/sbin to
the default path.
* Use ${binary:Version} rather than ${Source-Version} in openssh-server ->
openssh-client dependency.
Branch metadata
- Branch format:
- Branch format 7
- Repository format:
- Bazaar repository format 2a (needs bzr 1.16 or later)
- Stacked on:
- lp:ubuntu/lucid/openssh