Last commit made on 2006-05-18
Get this branch:
git clone -b ubuntu/dapper https://git.launchpad.net/ubuntu/+source/openssh
Members of Ubuntu Server Dev import team can upload to this branch. Log in for directions.

Branch merges

Branch information


Recent commits

7e66677... by Colin Watson on 2006-05-17

Import patches-unapplied version 1:4.2p1-7ubuntu3 to ubuntu/dapper

Imported using git-ubuntu import.

Changelog parent: 8b11a29ade34b074fc04f6275cc1d8817de56015

New changelog entries:
  * On '/etc/init.d/ssh restart', create /var/run/sshd before checking the
    server configuration, as otherwise 'sshd -t' will complain about the
    lack of /var/run/sshd (closes: Malone #45234).

8b11a29... by Colin Watson on 2006-05-12

Import patches-unapplied version 1:4.2p1-7ubuntu2 to ubuntu/dapper

Imported using git-ubuntu import.

Changelog parent: ad34150514c6f03c5110f40de409fc67426482c6

New changelog entries:
  * Backport from OpenSSH 4.3 (closes: Malone #25528):
    - Set SO_REUSEADDR on X11 listeners to avoid problems caused by
      lingering sockets from previous session (X11 applications can
      sometimes not connect to

ad34150... by Colin Watson on 2006-03-01

Import patches-unapplied version 1:4.2p1-7ubuntu1 to ubuntu/dapper

Imported using git-ubuntu import.

Changelog parent: c56287d6ffe914bc67b3bb532b5166198a38c300

New changelog entries:
  * Resynchronise with Debian.
  * I accidentally applied the default $PATH change in 1:4.2p1-6 to the udeb
    rather than the deb. Fixed.
  * Sync default values of $PATH from shadow 1:4.0.12-6, adding /usr/bin/X11
    to the normal and superuser paths and /usr/games to the normal path.
  * When the client receives a signal, don't fatal() with "Killed by signal
    %d." (which produces unhelpful noise on stderr and causes confusion for
    users of some applications that wrap ssh); instead, generate a debug
    message and exit with the traditional status (closes: #313371).
  * debconf template translations:
    - Add Swedish (thanks, Daniel Nylander; closes: #333133).
    - Update Spanish (thanks, Javier Fernández-Sanguino Peña;
      closes: #341371).
    - Correct erroneously-changed Last-Translator headers in Greek and
      Spanish translations.

c56287d... by Martin Pitt on 2006-02-20

Import patches-unapplied version 1:4.2p1-5ubuntu2 to ubuntu/dapper

Imported using git-ubuntu import.

Changelog parent: d200ad971406bdf4a0a63d383a349d6c64bc66d8

New changelog entries:
  * SECURITY UPDATE: Shell code injection with crafted file names in scp.
  * Ported upstream patch from 4.3p2 to replace system() call with a proper
    exec() call; this avoids expanding shell metacharacters in local-to-local
    or remote-to-remote copies.
  * CVE-2006-0225

d200ad9... by Colin Watson on 2005-10-31

Import patches-unapplied version 1:4.2p1-5ubuntu1 to ubuntu/dapper

Imported using git-ubuntu import.

Changelog parent: fbef8cdcb6187bd382103833c21da8513f795c8a

New changelog entries:
  * Resynchronise with Debian.
  * Add a CVE name to the 1:4.0p1-1 changelog entry.
  * Build-depend on libselinux1-dev on armeb.
  * Only send GSSAPI proposal if GSSAPIAuthentication is enabled.
  * Build-depend on libssl-dev (>= 0.9.8-1) to cope with surprise OpenSSL
    transition, since otherwise who knows what the buildds will do. If
    you're building openssh yourself, you can safely ignore this and use an
    older libssl-dev.
  * Initialise token to GSS_C_EMPTY_BUFFER in ssh_gssapi_check_mechanism
    (closes: #328606).
  * Add prototype for ssh_gssapi_server_mechanisms (closes: #328372).
  * Interoperate with ssh-krb5 << 3.8.1p1-1 servers, which used a slightly
    different version of the gssapi authentication method (thanks, Aaron M.
    Ucko; closes: #328388).
  * Explicitly tell po2debconf to use the 'popular' output encoding, so that
    the woody-compatibility hack works even with po-debconf 0.9.0.
  * Annotate 1:4.2p1-1 changelog with CVE references.
  * Add remaining pieces of Kerberos support (closes: #152657, #275472):
    - Add GSSAPI key exchange support from
      http://www.sxw.org.uk/computing/patches/openssh.html (thanks, Stephen
    - Build-depend on libkrb5-dev and configure --with-kerberos5=/usr.
    - openssh-client and openssh-server replace ssh-krb5.
    - Update commented-out Kerberos/GSSAPI options in default sshd_config.
  * New upstream release.
    - SECURITY (CAN-2005-2797): Fix a bug introduced in OpenSSH 4.0 that
      caused GatewayPorts to be incorrectly activated for dynamic ("-D")
      port forwardings when no listen address was explicitly specified
      (closes: #326065).
    - SECURITY (CAN-2005-2798): Fix improper delegation of GSSAPI
      credentials. This code is only built in openssh-krb5, not openssh, but
      I mention the CVE reference here anyway for completeness.
    - Add a new compression method ("Compression delayed") that delays zlib
      compression until after authentication, eliminating the risk of zlib
      vulnerabilities being exploited by unauthenticated users. Note that
      users of OpenSSH versions earlier than 3.5 will need to disable
      compression on the client or set "Compression yes" (losing this
      security benefit) on the server.
    - Increase the default size of new RSA/DSA keys generated by ssh-keygen
      from 1024 to 2048 bits (closes: #181162).
    - Many bugfixes and improvements to connection multiplexing.
    - Don't pretend to accept $HOME (closes: #208648).
  * debian/rules: Resynchronise CFLAGS with that generated by configure.
  * openssh-client and openssh-server conflict with pre-split ssh to avoid
    problems when ssh is left un-upgraded (closes: #324695).
  * Set X11Forwarding to yes in the default sshd_config (new installs only).
    At least when X11UseLocalhost is turned on, which is the default, the
    security risks of using X11 forwarding are risks to the client, not to
    the server (closes: #320104).

fbef8cd... by Colin Watson on 2005-10-10

Import patches-unapplied version 1:4.1p1-7ubuntu4 to ubuntu/breezy

Imported using git-ubuntu import.

Changelog parent: 6ac1c57981395deee16b5535f8d13c89417c0829

New changelog entries:
  * Add /usr/games to the default $PATH for non-privileged users.
  * Explicitly tell po2debconf to use the 'popular' output encoding, to
    avoid huge automatic changes to debian/po/*.po with po-debconf 0.9.0.
  * Increase MAX_SESSIONS to 64.
  * Backport from OpenSSH 4.2p1:
    - SECURITY (CAN-2005-2797): Fix a bug introduced in OpenSSH 4.0 that
      caused GatewayPorts to be incorrectly activated for dynamic ("-D")
      port forwardings when no listen address was explicitly specified.
    - SECURITY (CAN-2005-2798): Fix improper delegation of GSSAPI
      credentials. This code is only built in openssh-krb5, not openssh, but
      I include the fix here anyway in case anyone is building this package
      themselves with Kerberos support.
  * Resynchronise with Debian.
  * Do the IDEA host key check on a temporary file to avoid altering
    /etc/ssh/ssh_host_key itself (closes: #312312).
  * Work around the ssh-askpass alternative somehow ending up in manual mode
    pointing to the obsolete /usr/lib/ssh/gnome-ssh-askpass.
  * Add GNU/kFreeBSD support (thanks, Aurelien Jarno; closes: #318113).
  * Fix XSIish uses of 'test' in openssh-server.preinst.
  * Policy version 3.6.2: no changes required.
  * Resynchronise with Debian.
  * Fix one-character typo that meant the binaries in openssh-client and
    openssh-server got recompiled with the wrong options during
    'debian/rules install' (closes: #317088, #317238, #317241).
  * Build-depend on libselinux1-dev on ppc64 too (closes: #314625).
  * Drop priority of ssh to extra to match the override file.
  * Make /usr/share/doc/openssh-server and /usr/share/doc/ssh symlinks to
    /usr/share/doc/openssh-client (closes: #314745).
  * Ship README.dns (closes: #284874).
  * Disable btmp logging, since Debian's /var/log/btmp has inappropriate
    permissions (closes: #314956).
  * Allow ~/.ssh/config to be group-writable, provided that the group in
    question contains only the file's owner (closes: #314347).
  * debconf template translations:
    - Update Brazilian Portuguese (thanks, André Luís Lopes;
      closes: #315477).
    - Add Vietnamese (thanks, Clytie Siddall; closes: #316636).
  * Resynchronise with Debian.
  * openssh-client and openssh-server conflict with ssh-krb5, as ssh-krb5
    only conflicts with ssh (closes: #312475).
  * SELinux support (thanks, Manoj Srivastava; closes: #308555):
    - Added SELinux capability, and turned it on be default. Added
      restorecon calls in preinst and postinst (should not matter if the
      machine is not SELinux aware). By and large, the changes made should
      have no effect unless the rules file calls --with-selinux; and even
      then there should be no performance hit for machines not actively
      running SELinux.
    - Modified the preinst and postinst to call restorecon to set the
      security context for the generated public key files.
    - Added a comment to /etc/pam.d/ssh to indicate that an SELinux system
      may want to also include pam_selinux.so.
  * Re-enable ssh-askpass-gnome on the Hurd, now that its build-dependencies
    are available.
  * Restore /usr/lib/sftp-server temporarily, as a symlink to
    /usr/lib/openssh/sftp-server (closes: #312891).
  * Switch to debhelper compatibility level 3, since 2 is deprecated.
  * debconf template translations:
    - Update German (thanks, Jens Seidel; closes: #313949).
  * Upload to unstable.
  * Set path of xauth to /usr/bin/xauth instead of /usr/bin/X11/auth.
  * Resynchronise with Debian.
  * Drop debconf support for allowing SSH protocol 1, which is discouraged
    and has not been the default since openssh 1:3.0.1p1-1. Users who need
    this should edit sshd_config instead (closes: #147212).
  * Since ssh-keysign isn't used by default (you need to set
    EnableSSHKeysign to "yes" in /etc/ssh/ssh_config), having a debconf
    question to ask whether it should be setuid is overkill, and the
    question text had got out of date anyway. Remove this question, ship
    ssh-keysign setuid in openssh-client.deb, and set a statoverride if the
    debconf question was previously set to false.
  * Add lintian overrides for the above (setuid-binary,
  * Fix picky lintian errors about slogin symlinks.
  * Fix DEB_HOST_ARCH_OS/DEB_HOST_GNU_SYSTEM compatibility handling.
  * Apply Linux 2.2 workaround (see #239999) only on Linux.
  * New upstream release.
    - Normalise socket addresses returned by get_remote_hostname(), fixing
      4-in-6 mapping issues with AllowUsers et al (closes: #192234).
  * Take upstream's hint and disable the unsupported USE_POSIX_THREADS
    (closes: #295757, #308868, and possibly others; may open other bugs).
    Use PAM password authentication to avoid #278394. In future I may
    provide two sets of binaries built with and without this option, since
    it seems I can't win.
  * Disable ChallengeResponseAuthentication in new installations, returning
    to PasswordAuthentication by default, since it now supports PAM and
    apparently works better with a non-threaded sshd (closes: #247521).
  * openssh-server Suggests: rssh (closes: #233012).
  * Change libexecdir to /usr/lib/openssh, and fix up various alternatives
    and configuration files to match (closes: #87900, #151321).
  * Fix up very old sshd_config files that refer to /usr/libexec/sftp-server
    (closes: #141979).
  * Resynchronise with Debian.
  * New upstream release.
    - Port-forwarding specifications now take optional bind addresses, and
      the server allows client-specified bind addresses for remote port
      forwardings when configured with "GatewayPorts clientspecified"
      (closes: #87253, #192206).
    - ssh and ssh-keyscan now support hashing of known_hosts files for
      improved privacy. ssh-keygen has new options for managing known_hosts
      files, which understand hashing.
    - sftp supports command history and editing support using libedit
      (closes: #287013).
    - Have scp and sftp wait for the spawned ssh to exit before they exit
      themselves, allowing ssh to restore terminal modes (closes: #257130).
    - Improved the handling of bad data in authorized_keys files,
      eliminating fatal errors on corrupt or very large keys; e.g. linefeeds
      in keys only produce errors in auth.log now (closes: #220726).
    - Add "command mode" to ssh connection multiplexing (closes: #303452).
    - Mention $HOME/.hushlogin in sshd(8) FILES section (closes: #163933).
  * Make gnome-ssh-askpass stay above other windows (thanks, Liyang HU;
    closes: #296487).
  * Remove obsolete and unnecessary ssh/forward_warning debconf note.
  * Hurd build fixes (although sshd still doesn't work):
    - Restore X forwarding fix from #102991, lost somewhere along the way.
    - Link with -lcrypt.
    - Link with -lpthread rather than -pthread.
    - Don't build ssh-askpass-gnome on the Hurd, until GNOME is available to
      satisfy build-dependencies.
  * Drop workaround for #242462 on amd64; it's been fixed properly upstream.
  * Enable HashKnownHosts by default. This only affects new entries; use
    'ssh-keygen -H' to convert an entire known_hosts file to hashed format.
  * Note in ssh_config(5) that the SetupTimeOut option is Debian-specific
    (closes: #307069).
  * debconf template translations:
    - Update Czech (thanks, Miroslav Kure; closes: #298744).
    - Update Finnish (thanks, Matti Pöllä; closes: #303787).
    - Synchronise Spanish with sarge branch (thanks, Javier
      Fernández-Sanguino Peña; closes: #298536).
    - Add Ukrainian (thanks, Eugeniy Meshcheryakov; closes: #301852).
  * Explain how to run sshd from inittab in README.Debian (closes: #147360).
  * Add debian/watch file.
  * Remove pam_nologin from /etc/pam.d/ssh, as sshd's built-in support
    appears to be sufficient and more useful (closes: #162996).
  * Depend on debconf | debconf-2.0.
  * Drop LoginGraceTime back to the upstream default of two minutes on new
    installs (closes: #289573).
  * debconf template translations from Ubuntu bug #1232:
    - Update Greek (thanks, Logiotatidis George).
    - Update Spanish (thanks, Santiago Erquicia).

6ac1c57... by Colin Watson on 2005-03-15

Import patches-unapplied version 1:3.9p1-1ubuntu2 to ubuntu/hoary

Imported using git-ubuntu import.

Changelog parent: 3053cc0aa054e1edab75b86126dd2c87a66d3316

New changelog entries:
  * Don't ask unnecessary and misplaced ssh/forward_warning debconf note
    (closes: Ubuntu #7363).
  * Resynchronise with Debian.
  * New upstream release.
    - PAM password authentication implemented again (closes: #238699,
    - Implemented the ability to pass selected environment variables between
      the client and the server.
    - Fix ssh-keyscan breakage when remote server doesn't speak SSH protocol
      (closes: #228828).
    - Fix res_query detection (closes: #242462).
    - 'ssh -c' documentation improved (closes: #265627).
  * Pass LANG and LC_* environment variables from the client by default, and
    accept them to the server by default in new installs, although not on
    upgrade (closes: #264024).
  * Build ssh in binary-indep, not binary-arch (thanks, LaMont Jones).
  * Expand on openssh-client package description (closes: #273831).
  * Resynchronise with Debian.
  * We use DH_COMPAT=2, so build-depend on debhelper (>= 2).
  * Fix timing information leak allowing discovery of invalid usernames in
    PAM keyboard-interactive authentication (backported from a patch by
    Darren Tucker; closes: #281595).
  * Make sure that there's a delay in PAM keyboard-interactive
    authentication when PermitRootLogin is not set to yes and the correct
    root password is entered (closes: #248747).
  * Resynchronise with Debian.
  * Enable threading for PAM, on Sam Hartman's advice (closes: #278394).
  * debconf template translations:
    - Update Dutch (thanks, cobaco; closes: #278715).
  * Correct README.Debian's ForwardX11Trusted description (closes: #280190).
  * Resynchronise with Debian.
  * Preserve /etc/ssh/sshd_config ownership/permissions (closes: #276754).
  * Shorten the version string from the form "OpenSSH_3.8.1p1 Debian
    1:3.8.1p1-8.sarge.1" to "OpenSSH_3.8.1p1 Debian-8.sarge.1", as some SSH
    implementations apparently have problems with the long version string.
    This is of course a bug in those implementations, but since the extent
    of the problem is unknown it's best to play safe (closes: #275731).
  * debconf template translations:
    - Add Finnish (thanks, Matti Pöllä; closes: #265339).
    - Update Danish (thanks, Morten Brix Pedersen; closes: #275895).
    - Update French (thanks, Denis Barbier; closes: #276703).
    - Update Japanese (thanks, Kenshi Muto; closes: #277438).

3053cc0... by Colin Watson on 2004-10-07

Import patches-unapplied version 1:3.8.1p1-11ubuntu3 to ubuntu/warty

Imported using git-ubuntu import.