diff --git a/openssh-3.9p1-askpass-keep-above.patch b/openssh-3.9p1-askpass-keep-above.patch
new file mode 100644
index 0000000..1b9f48c
--- /dev/null
+++ b/openssh-3.9p1-askpass-keep-above.patch
@@ -0,0 +1,11 @@
+--- openssh-3.9p1/contrib/gnome-ssh-askpass2.c.keep-above	2003-11-21 13:48:56.000000000 +0100
++++ openssh-3.9p1/contrib/gnome-ssh-askpass2.c	2005-02-08 08:44:02.099739294 +0100
+@@ -119,6 +119,8 @@
+ 	g_signal_connect(G_OBJECT(entry), "activate",
+ 			 G_CALLBACK(ok_dialog), dialog);
+ 
++	gtk_window_set_keep_above(GTK_WINDOW(dialog), TRUE);
++
+ 	/* Grab focus */
+ 	gtk_widget_show_now(dialog);
+ 	if (grab_pointer) {
diff --git a/openssh.spec b/openssh.spec
index df871a0..44fe140 100644
--- a/openssh.spec
+++ b/openssh.spec
@@ -74,7 +74,7 @@
 Summary: The OpenSSH implementation of SSH protocol versions 1 and 2.
 Name: openssh
 Version: 3.9p1
-%define rel 9
+%define rel 10
 %if %{rescue}
 Release: %{rel}rescue
 %else
@@ -97,6 +97,7 @@ Patch5: openssh-3.9p1-noinitlog.patch
 Patch12: openssh-selinux.patch
 Patch20: openssh-3.9p1-gssapimitm.patch
 Patch21: openssh-3.9p1-safe-stop.patch
+Patch22: openssh-3.9p1-askpass-keep-above.patch
 License: BSD
 Group: Applications/Internet
 BuildRoot: %{_tmppath}/%{name}-%{version}-buildroot
@@ -231,6 +232,7 @@ environment.
 
 #%patch20 -p0 -b .gssapimitm
 %patch21 -p1 -b .safe-stop
+%patch22 -p1 -b .keep-above
 
 autoreconf
 
@@ -499,10 +501,16 @@ fi
 %endif
 
 %changelog
+* Tue Feb  8 2005 Tomas Mraz <tmraz@redhat.com> 3.9p1-10
+- enable trusted forwarding by default if X11 forwarding is 
+  required by user (#137685 and duplicates)
+- disable protocol 1 support by default in sshd server config (#88329)
+- keep the gnome-askpass dialog above others (#69131)
+
 * Fri Feb  4 2005 Tomas Mraz <tmraz@redhat.com>
-- change permissions on pam.d/sshd to 0644
+- change permissions on pam.d/sshd to 0644 (#64697)
 - patch initscript so it doesn't kill opened sessions if
-  the sshd daemon isn't running anymore
+  the sshd daemon isn't running anymore (#67624)
 
 * Mon Jan  3 2005 Bill Nottingham <notting@redhat.com> 3.9p1-9
 - don't use initlog