rpms/openssh
7
0
Fork 1
Code Issues Pull Requests Releases Activity
1,230 Commits 9 Branches 61 Tags 11 MiB
c10s
Commit Graph

909 Commits

Author SHA1 Message Date
Jakub Jelen
08cb909f5d Move cavs tests into subpackage -cavs (#1194320) 2015-02-20 13:24:42 +01:00
Jakub Jelen
2f556360f6 6.7p1-3 + 0.9.3-4 2015-02-18 16:11:48 +01:00
Jakub Jelen
6df422d544 Fix ssh-copy-id on non-sh shells (#1045191) 2015-02-18 16:01:39 +01:00
Jakub Jelen
bb3e880c01 Add SSH KDF CAVS test driver for future FIPS validation (#1193045) 2015-02-18 15:48:10 +01:00
Jakub Jelen
14c675f3a5 Use global hardening specification instead of hardening made by openssh. 
Openssh uses by default -fPIE flag, which didn't allow to build
pam_ssh_agent_auth.so with from libssh.a.
Validated using /CoreOS/openssh/Regression/bz642927-add-relro-flag
 2015-02-18 10:34:40 +01:00
Jakub Jelen
0a4ac4f4d3 Enable seccomp sandboxing after resolving problems with audit patch (#1062953) 2015-02-11 14:08:42 +01:00
Jakub Jelen
b552eb6714 Make output of sshd -T more consistent, using upstream patch (#1187521) 2015-02-03 14:17:05 +01:00
Jakub Jelen
580f986839 Update coverity patch after rebase to 6.7 2015-02-03 14:09:51 +01:00
Jakub Jelen
6c6416dc9d 6.7p1-2 + 0.9.3-4 2015-01-27 14:10:18 +01:00
Jakub Jelen
021326a6ae Fix audit patch after rebase to 6.7 2015-01-27 12:07:13 +01:00
Petr Lautrbach
9b4e25cce0 temporarily disable audit patch causing segmentation faults 2015-01-20 17:08:25 +01:00
Petr Lautrbach
f29c8784c6 restore tcp wrappers support, based on Debian patch 
https://lists.mindrot.org/pipermail/openssh-unix-dev/2014-April/032497.html
 2015-01-20 17:06:46 +01:00
Petr Lautrbach
1900351913 6.7p1-1 + 0.9.3-4 2015-01-20 13:21:45 +01:00
Petr Lautrbach
b457c98bec use upstream FigerPrintHash for fingerprint - 56d1c83cdd1ac76f1c6bd41e01e80dad834f3994 2015-01-19 15:26:56 +01:00
Jakub Jelen
3ffcb799b3 Fix changelog entry 2015-01-15 15:03:12 +01:00
Jakub Jelen
2109ab67c2 6.6.1p1-11 + 0.9.3-3 2015-01-14 17:15:02 +01:00
Petr Lautrbach
140e5ca05d add new option GSSAPIEnablek5users and disable using ~/.k5users by default 
CVE-2014-9278 (#1170745)
 2015-01-14 17:10:40 +01:00
Jakub Jelen
9080a85b54 Update vendor-patchlevel string 2015-01-14 16:55:27 +01:00
Jakub Jelen
b9d68e7db4 Fix config parser for ip:port values (#1130733) 2015-01-14 16:48:32 +01:00
Jakub Jelen
fd06d69c6a Fix confusing error message in scp (#1142223) 2015-01-14 16:46:23 +01:00
Petr Lautrbach
62986c5e87 6.6.1p1-10 + 0.9.3-3 2014-12-19 10:24:59 +01:00
Petr Lautrbach
7a7b8f0984 log via monitor in chroots without /dev/log 2014-12-19 10:14:36 +01:00
Petr Lautrbach
720cf82ef2 record pfs= field in CRYPTO_SESSION audit event 2014-12-15 18:59:39 +01:00
Petr Lautrbach
276c16ce71 6.6.1p1-9 + 0.9.3-3 2014-12-03 18:18:19 +01:00
Petr Lautrbach
56a647f5e3 the .local domain example should be in ssh_config, not in sshd_config 2014-12-03 18:15:25 +01:00
Petr Lautrbach
08fe9e8e47 use different values for DH for Cisco servers (#1026430) 2014-12-03 17:10:47 +01:00
Petr Lautrbach
823364a11e 6.6.1p1-8 + 0.9.3-3 2014-11-13 22:21:52 +01:00
Petr Lautrbach
44f0ac8d08 fix several coverity issues Resolves: rhbz#1139794 2014-11-13 22:16:51 +01:00
Petr Lautrbach
a1e1ac2bfc 6.6.1p1-7 + 0.9.3-3 2014-11-07 12:53:03 +01:00
Petr Lautrbach
3b7c8620a1 6.6.1p1-6 + 0.9.3-3 2014-11-04 19:09:42 +01:00
Petr Lautrbach
5296a797aa privsep_preauth: use SELinux context from selinux-policy (#1008580) 2014-11-04 19:06:14 +01:00
Petr Lautrbach
0f0e055d6a Ignore SIGXFSZ in postauth monitor 
https://bugzilla.mindrot.org/show_bug.cgi?id=2263
 2014-09-29 08:37:05 +02:00
Petr Lautrbach
4b24967a9c fix parsing of empty arguments in sshd_conf 
https://bugzilla.mindrot.org/show_bug.cgi?id=2281
 2014-09-25 11:45:47 +02:00
Petr Lautrbach
afde9f8153 6.6.1p1-5 + 0.9.3-3 2014-09-08 10:35:57 +02:00
Petr Lautrbach
ce2d80b4e7 don't consider a partial success as a failure 2014-09-04 16:33:25 +02:00
Petr Lautrbach
163064841f apply RFC3454 stringprep to banners when possible 
https://bugzilla.mindrot.org/show_bug.cgi?id=2058
 2014-09-04 16:12:11 +02:00
Petr Lautrbach
0a3f4e122d set a client's address right after a connection is set 
http://bugzilla.mindrot.org/show_bug.cgi?id=2257
 2014-09-02 10:49:31 +02:00
Peter Robinson
662c5a05b3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild 2014-08-17 14:08:07 +00:00
Tom Callaway
e336e33a32 fix license handling 2014-07-18 19:28:30 -04:00
Petr Lautrbach
8ff21c966a 6.6.1p1-3 + 0.9.3-2 2014-07-18 08:38:51 +02:00
Petr Lautrbach
817071dc4d standardise on NI_MAXHOST for gethostname() string lengths (#1051490) 2014-07-17 14:28:16 +02:00
Petr Lautrbach
cef0d582b6 6.6.1p1-2 + 0.9.3-2 2014-07-14 12:35:16 +02:00
Petr Lautrbach
d8b90ac6f8 minor spec file cleanup 2014-07-09 21:40:06 +02:00
Petr Lautrbach
8028159313 fix and rebase fips patch to 6.6.1p1 2014-07-09 21:16:53 +02:00
Petr Lautrbach
5160c9c8f3 rebase audit patch for 6.6.1p1 2014-07-08 17:42:18 +02:00
Petr Lautrbach
86f29c353e bring back openssh-5.5p1-x11.patch 2014-07-03 16:42:56 +02:00
Petr Lautrbach
5fcfcac428 drop openssh-5.8p2-remove-stale-control-socket.patch 2014-07-03 16:23:00 +02:00
Petr Lautrbach
8b5feef2c8 bring back the openssh-5.8p2-sigpipe.patch 2014-07-03 16:14:38 +02:00
Dennis Gilmore
d1b0938acc - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild 2014-06-07 12:01:42 -05:00
Petr Lautrbach
5cde9cd3f2 6.6.1p1-1 + 0.9.3-2 2014-06-03 17:52:36 +02:00
Petr Lautrbach
fb6f390a78 drop openssh-server-sysvinit subpackage 2014-06-03 17:42:49 +02:00
Petr Lautrbach
44fb3c6aeb OpenSSH 6.5 and 6.6 sometimes encode a value used in the 
curve25519 key exchange incorrectly, causing connection failures
about 0.2% of the time when this method is used against a peer that
implements the method properly.

Fix the problem and disable the curve25519 KEX when speaking to
OpenSSH 6.5 or 6.6. This version will identify itself as 6.6.1
to enable the compatability code.

openssh-6.6.1p1
 2014-06-03 17:18:36 +02:00
Petr Lautrbach
94c6f8ddcc rebase to openssh-6.6p1 2014-06-03 16:51:07 +02:00
Petr Lautrbach
d75575229f 6.4p1-4 + 0.9.3-1 2014-05-15 10:37:16 +02:00
Petr Lautrbach
8f8619e1e6 ignore environment variables with embedded '=' or '\0' characters (#1077843) 
CVE-2014-2532
 2014-05-15 10:24:04 +02:00
Petr Lautrbach
d271e02296 prevent a server from skipping SSHFP lookup (#1081338) 
CVE-2014-2653
 2014-05-15 10:23:46 +02:00
Petr Lautrbach
9a031d2641 try CLOCK_BOOTTIME with fallback (#1091992) 2014-05-14 17:30:43 +02:00
Petr Lautrbach
f9f83a00b5 make /etc/ssh/moduli file public (#1043661) 2014-02-26 15:54:02 +01:00
Petr Lautrbach
96df3b5ecb use tty allocation for a remote scp 2014-01-23 18:30:39 +01:00
Petr Lautrbach
b898cbf5e1 Run ssh-copy-id in the legacy mode when SSH_COPY_ID_LEGACY variable is set 2014-01-23 18:30:03 +01:00
Petr Lautrbach
084bc6fca5 FIPS mode - adjust the key echange DH groups and ssh-keygen according to SP800-131A 2014-01-23 18:29:02 +01:00
Petr Lautrbach
222dd2e358 6.4p1-3 + 0.9.3-1 2013-12-11 14:32:11 +01:00
Petr Lautrbach
89d920b074 6.4p1-2 + 0.9.3-1 2013-11-26 15:28:39 +01:00
Petr Lautrbach
09e9ef3d7c 6.4p1-1 + 0.9.3-1 2013-11-08 14:04:33 +01:00
Petr Lautrbach
3ed6191f56 6.3p1-5 + 0.9.3-7 2013-11-01 17:07:27 +01:00
Petr Lautrbach
5795323a53 don't use xfree in pam_ssh_agent_auth sources <geertj@gmail.com> (#1024965) 2013-11-01 17:06:02 +01:00
Petr Lautrbach
7feb965804 6.3p1-4 + 0.9.3-6 2013-10-25 15:46:49 +02:00
Petr Lautrbach
2add7a8ff5 rebuild with openssl-1.0.1e-29.fc20 to enable ECC support 2013-10-25 15:19:26 +02:00
Petr Lautrbach
f0aa6e5f51 rebuild with openssl-1.0.1e-29.fc20 to enable ECC support 2013-10-25 14:46:48 +02:00
Petr Lautrbach
a5e23f2861 6.3p1-3 + 0.9.3-6 2013-10-24 16:45:21 +02:00
Petr Lautrbach
ff7a26b109 6.3p1-2 + 0.9.3-6 2013-10-23 23:14:38 +02:00
Petr Lautrbach
1f36406833 Increase the size of the Diffie-Hellman groups requested for a each 
symmetric key size.  New values from NIST Special Publication 800-57 with
the upper limit specified by RFC4419.  Pointed out by Peter Backes, ok
djm@. (#1010607)
 2013-10-23 22:41:53 +02:00
Petr Lautrbach
d088f94bd9 use default_ccache_name from /etc/krb5.conf for a kerberos cache (#991186) 2013-10-23 22:08:19 +02:00
Petr Lautrbach
e40d5d19d9 added Obsoletes: *fips 2013-10-15 17:55:40 +02:00
Petr Lautrbach
a92e916970 6.3p1-1 + 0.9.3-6 2013-10-14 15:55:03 +02:00
Petr Lautrbach
84822b5dec rebase for openssh-6.3p1, remove unused patches (#1007769) 2013-10-14 15:54:41 +02:00
Petr Lautrbach
c33ef551ca 6.2p2-9 + 0.9.3-5 2013-10-08 17:28:16 +02:00
Petr Lautrbach
2ae5f9ff89 Revert "add -fips subpackages that contains the FIPS module files" 
This reverts commit 227f4f7628.
 2013-10-08 17:13:39 +02:00
Petr Lautrbach
d4d8299c30 Revert "add missing Requires: openssl-fips in -fips subpackages" 
This reverts commit a19397fdd2.

Conflicts:
	openssh.spec
 2013-10-08 17:06:14 +02:00
Petr Lautrbach
b61d9c10d3 Revert "use hmac_suffix for ssh{,d} hmac checksums" 
This reverts commit c6724c72f4.
 2013-10-08 17:04:53 +02:00
Petr Lautrbach
0cc0054215 Revert "use {?dist} tag in suffixes for hmac checksum files" 
This reverts commit 15244ec178.
 2013-10-08 17:04:40 +02:00
Petr Lautrbach
f344f8490c 6.2p2-8 + 0.9.3-5 2013-09-25 14:13:01 +02:00
Petr Lautrbach
15244ec178 use {?dist} tag in suffixes for hmac checksum files 2013-09-20 17:11:49 +02:00
Petr Lautrbach
eba55f9c1b 6.2p2-7 + 0.9.3-5 2013-09-11 16:54:14 +02:00
Petr Lautrbach
c6724c72f4 use hmac_suffix for ssh{,d} hmac checksums 2013-09-11 16:05:58 +02:00
Petr Lautrbach
a19397fdd2 add missing Requires: openssl-fips in -fips subpackages 
6.2p2-6.1 + 0.9.3-5
 2013-08-29 09:32:04 +02:00
Petr Lautrbach
f4e927b62d 6.2p2-6 + 0.9.3-5 2013-08-28 21:28:04 +02:00
Petr Lautrbach
227f4f7628 add -fips subpackages that contains the FIPS module files 2013-08-28 19:37:08 +02:00
Petr Lautrbach
631ffb2c5b 6.2p2-5 + 0.9.3-5 2013-08-01 09:50:41 +02:00
Petr Lautrbach
115aad3f92 6.2p2-4 + 0.9.3-5 2013-07-23 16:01:17 +02:00
Petr Lautrbach
17df27c668 don't show Success for EAI_SYSTEM (#985964) 2013-07-23 12:07:49 +02:00
Petr Lautrbach
2ee6810919 make sftp's libedit interface marginally multibyte aware (#841771) 2013-06-19 17:10:49 +02:00
Petr Lautrbach
66608a1ded 6.2p2-3 + 0.9.3-5 2013-06-17 17:30:04 +02:00
Petr Lautrbach
e99c4840f1 6.2p2-2 + 0.9.3-5 2013-05-21 18:38:15 +02:00
Petr Lautrbach
678b8081f1 add socket activated sshd units to the package (#963268) 2013-05-21 18:37:18 +02:00
Petr Lautrbach
21acbc4795 6.2p2-1 + 0.9.3-5 2013-05-20 09:31:57 +02:00
Petr Lautrbach
d48f1a7bde always use /sbin/nologin as privsep user's shell 2013-04-24 18:08:00 +02:00
Petr Lautrbach
a92d7445da 6.2p1-4 + 0.9.3-4 2013-04-17 17:12:32 +02:00
Petr Lautrbach
1d76d11f64 cleanup spec file and patches 2013-04-16 18:30:43 +02:00
Petr Lautrbach
c276d31b49 6.2p1-3 + 0.9.3-4 2013-04-16 18:15:20 +02:00
Petr Lautrbach
894ab5eaaf add latest config.{sub,guess} to support aarch64 (#926284) 2013-04-16 18:12:15 +02:00
Petr Lautrbach
1042786f58 6.2p1-2 + 0.9.3-4 2013-04-09 23:25:17 +02:00
Petr Lautrbach
fcef7f6231 keep track of which IndentityFile options were manually supplied and which were default options, and don't warn if the latter are missing. (mindrot#2084) 2013-04-09 23:22:42 +02:00
Petr Lautrbach
b6f89abe5c 6.2p1-1 + 0.9.3-4 2013-04-09 00:07:04 +02:00
Petr Lautrbach
d3d59da0b5 merge all -audit* patches together 2013-04-08 17:17:10 +02:00
Petr Lautrbach
8d97022c57 build regress/modpipe tests with $(CFLAGS) 2013-04-04 16:50:06 +02:00
Petr Lautrbach
8a29dedfa7 rebase to openssh-6.2p1 (#924727) 
ACSS was removed from upstream sources
 2013-04-04 16:49:30 +02:00
Petr Lautrbach
1b95bc38df 6.1p1-7 + 0.9.3-3 2013-03-06 10:41:50 +01:00
Petr Lautrbach
2a7883d153 6.1p1-6 + 0.9.3-3 2013-02-14 18:08:21 +01:00
Petr Lautrbach
d2b3b9a27e pam_ssh_agent_auth - change paths from %{_lib} to %{_libdir} 2013-02-12 09:42:54 +01:00
Petr Lautrbach
19725a9954 fix bogus day names in changelog dates 2013-02-08 15:44:40 +01:00
Petr Lautrbach
cab7f53408 6.1p1-5 + 0.9.3-3 2013-02-08 14:56:47 +01:00
Petr Lautrbach
5bc906c19a change default value of MaxStartups - CVE-2010-5107 - #908707 2013-02-08 14:32:20 +01:00
Petr Lautrbach
87391b7d01 add BuildRequires: perl-podlators 2013-02-07 14:21:38 +01:00
Petr Lautrbach
7642de98e4 6.1p1-4 + 0.9.3-3 2012-12-03 17:16:39 +01:00
Petr Lautrbach
790103e764 6.1p1-3 + 0.9.3-3 2012-12-03 10:29:07 +01:00
Petr Lautrbach
fe661c5cbb obsolete RequiredAuthentications[12] options 2012-11-30 21:40:22 +01:00
Petr Lautrbach
5039c7c85d reformat several patches after openssh-6.1p1-authenticationmethods.patch 2012-11-30 16:25:51 +01:00
Petr Lautrbach
bffd1c2234 replace RequiredAuthentications2 with AuthenticationMethods according to upstream 
the upstream refused original patch with RequiredAuthentications2, but they came with their own implementation of required authentications,
see https://bugzilla.mindrot.org/show_bug.cgi?id=983. The new method is more robust and flexible
it will be included in next openssh-6.2 release
 2012-11-30 16:23:29 +01:00
Petr Lautrbach
ab30b92bd6 fix the man moduli page (#841065) 2012-11-06 09:59:17 +01:00
bach
f7f8b483b0 adapt openssh-6.1p1-akc.patch to the upstream version - https://bugzilla.mindrot.org/show_bug.cgi?id=1663 2012-11-05 14:43:22 +01:00
Petr Lautrbach
52c8eca4d9 fix gssapi canohost patch (#863350) 2012-10-30 11:06:45 +01:00
Petr Lautrbach
af2ebf77dc 6.1p1-2 + 0.9.3-3 2012-10-26 17:15:55 +02:00
Petr Lautrbach
afd52c4857 drop openssh-5.9p1-sftp-chroot.patch (#830237) 2012-10-26 17:04:25 +02:00
Petr Lautrbach
470ebd7abc add SELinux comment to /etc/ssh/sshd_config about SELinux command to modify port (#861400) 2012-10-26 16:34:55 +02:00
Petr Lautrbach
13cf2478d6 smartcard support is replaced with PKCS#11 support already in 5.4p1 https://bugzilla.mindrot.org/show_bug.cgi?id=1371 2012-10-26 15:42:59 +02:00
Petr Lautrbach
1a5c95ee57 drop required chkconfig (#865498) 2012-10-12 13:03:26 +02:00
Petr Lautrbach
d0630aa358 6.1p1-1 + 0.9.3-3 2012-09-15 13:48:14 +02:00
Petr Lautrbach
fd408ed2a5 to run tests use --with check 2012-09-15 13:48:13 +02:00
Petr Lautrbach
e58e548a57 don't use /bin and /sbin paths (#856590) 2012-09-15 13:48:13 +02:00
Petr Lautrbach
581bf30d07 don't use chroot_user_t for chrooted users (#830237) 2012-09-15 13:47:45 +02:00
Petr Lautrbach
9fe1afc163 rebase to openssh-6.1p1 (#852651) 2012-09-15 13:29:49 +02:00
Petr Lautrbach
51ca3be245 use DIR: kerberos cache type (#848228) 2012-09-15 13:28:23 +02:00
Petr Lautrbach
94943d59db replace scriptlets with systemd macros (#850249) 2012-09-15 13:28:01 +02:00
Petr Lautrbach
65ba94ef1a rebase to openssh-6.0p1 
6.0p1-1 + 0.9.3-2
 2012-08-06 21:33:33 +02:00
Petr Lautrbach
90e11f338c 5.9p1-26 + 0.9.3-1 2012-08-06 19:42:13 +02:00
Petr Lautrbach
5382ccbe9b handle crypt() returning NULL (#815993) 2012-08-06 09:08:52 +02:00
Petr Lautrbach
b648890ead 5.9p1-25 + 0.9.3-1 2012-07-27 14:35:43 +02:00
Tomas Mraz
e9620308c8 allow sha256 and sha512 hmacs in the FIPS mode 2012-07-17 21:03:59 +02:00
Tomas Mraz
4f4687ce80 fix segfault in su when pam_ssh_agent_auth is used and the ssh-agent 
is not running, most probably not exploitable
update pam_ssh_agent_auth to 0.9.3 upstream version
 2012-06-22 14:52:35 +02:00
Petr Lautrbach
2649d91e06 5.9p1-22 + 0.9.2-32 2012-04-06 21:01:27 +02:00
Petr Lautrbach
009f534b09 don't install sshd-keygen.service (#810419) 2012-04-06 21:01:06 +02:00
Petr Lautrbach
7294a991a2 5.9p1-21 + 0.9.2-32 2012-03-30 20:07:50 +02:00
Petr Lautrbach
22f0191d84 5.9p1-20 + 0.9.2-32 2012-03-23 09:16:52 +01:00
Petr Lautrbach
1027fdc205 don't enable sshd-keygen.service (#805338) 2012-03-23 09:16:10 +01:00
Petr Lautrbach
33e0acc5ef 5.9p1-19 + 0.9.2-32 2012-02-22 09:03:07 +01:00
Petr Lautrbach
feb99ea644 Look for x11 forward sockets with AI_ADDRCONFIG flag getaddrinfo (#735889) 2012-02-14 18:11:26 +01:00
Petr Lautrbach
d3ab95741d 5.9p1-18 + 0.9.2-32 2012-02-06 22:16:49 +01:00
Petr Lautrbach
d9e6186c71 replace TwoFactorAuth with RequiredAuthentications[12] 
https://bugzilla.mindrot.org/show_bug.cgi?id=983
 2012-02-06 22:16:38 +01:00
Petr Lautrbach
21699d5622 5.9p1-17 + 0.9.2-32 2012-01-31 14:09:17 +01:00
Petr Lautrbach
cd5891d0d5 run privsep slave process as the users SELinux context (#781634) 2012-01-31 14:09:00 +01:00
Tomas Mraz
017c65d99b add CAVS test driver for the aes-ctr ciphers 2012-01-13 18:28:47 +01:00
Tomas Mraz
6148abd585 enable aes-ctr ciphers use the EVP engines from OpenSSL such as the AES-NI 2012-01-11 19:11:33 +01:00
Petr Lautrbach
2e12878998 5.9p1-14 + 0.9.2-32 2011-12-06 17:42:00 +01:00
Petr Lautrbach
5bd5aa2976 warn about unsupported option UsePAM=no (#757545) 2011-12-06 17:41:06 +01:00
Tomas Mraz
4fc167470d add back the restorecon call to ssh-copy-id - it might be needed on older 
distributions (#739989)
 2011-11-21 09:03:05 +01:00
Tomas Mraz
81da99ed9b Fix permissions of sshd private keys created by sshd-keygen script (#754779) 2011-11-18 09:26:19 +01:00
Tomas Mraz
17eb1038b2 still support /etc/sysconfig/sshd loading in sshd service (#754732) 2011-11-18 09:20:54 +01:00
Tomas Mraz
0fcb25a8d2 remove unnecessary requires on initscripts 
set VerifyHostKeyDNS to ask in the default configuration (#739856)
 2011-10-14 18:19:47 +02:00
Jan F. Chadima
fcc5bdd01d selinux sandbox rewrite 
two factor authentication tweaking
 2011-09-20 08:14:45 +02:00
Jan F. Chadima
28b0dc63f4 selinux sandbox rewrite 
two factor authentication tweaking
 2011-09-19 07:26:32 +02:00
Jan F. Chadima
cff1d0c39d coverity upgrade 
wipe off nonfunctional nss
selinux sandbox tweaking
 2011-09-14 17:03:03 +02:00
Jan F. Chadima
c870e661c7 coverity upgrade 
experimental selinux sandbox
 2011-09-13 17:14:48 +02:00
JFCH
c2ea13d263 fully reanable auditing 2011-09-13 01:53:08 -04:00
Jan F. Chadima
1df0cf4657 repair signedness in akc patch 2011-09-12 20:44:35 +02:00
Jan F. Chadima
026db1cf63 temporarily disable part of audit4 patch 2011-09-12 08:34:27 +02:00
Jan F. Chadima
39b26b5169 temporarily disable part of audit4 patch 2011-09-12 08:11:41 +02:00
Jan F. Chadima
ea97ffa1ed Coverity second pass 
Reenable akc patch
 2011-09-09 21:18:35 +02:00
Jan F. Chadima
3b545be5d7 Coverity first pass 2011-09-09 00:54:28 +02:00
Jan F. Chadima
311e6bb088 Rebase to 5.9p1 
Add chroot sftp patch
Add two factor auth patch
 2011-09-07 15:31:21 +02:00
Jan F. Chadima
69dd72f6ef ignore SIGPIPE in ssh keyscan 2011-09-07 15:12:54 +02:00
Jan F. Chadima
19d4c790a8 ignore SIGPIPE in ssh keyscan 2011-08-23 19:01:59 +02:00
Jan F. Chadima
2b67a53348 save ssh-askpass's debuginfo 2011-08-09 15:15:23 +02:00
Jan F. Chadima
56b50ec772 compile ssh-askpass with corect CFLAGS 2011-08-08 23:32:31 +02:00
Jan F. Chadima
eed2da95a4 improve selinux's change context log 2011-08-08 13:37:15 +02:00
Jan F. Chadima
54f33f6451 improve selinux's change context log 2011-08-08 13:24:47 +02:00
Jan F. Chadima
ec3622478b repair broken man pages 2011-08-08 11:57:43 +02:00
Jan F. Chadima
1592780c7c rebuild 2011-07-25 09:39:35 +02:00
Jan F. Chadima
d704eab9f3 rebuild 2011-07-25 09:27:57 +02:00
Jan F. Chadima
cadffc562e Do not change context when run under unconfined_t 2011-07-21 15:26:11 +02:00
Jan F. Chadima
294ca75200 Do not change context when run under unconfined_t 2011-07-21 14:52:20 +02:00
Jan F. Chadima
d3d3406f12 Add postlogin to pam. (#718807) 2011-07-14 15:15:29 +02:00
Jan F. Chadima
0d4fd57729 Add postlogin to pam. (#718807) 2011-07-14 13:46:20 +02:00
Jan F. Chadima
d56cc37855 Systemd compatibility according to Mathieu Bridon <bochecha@fedoraproject.org> 
Split out the host keygen into their own command, to ease future migration
to systemd. Compatitbility with the init script was kept.
Migrate the package to full native systemd unit files, according to the Fedora
packaging guidelines.
Prepate the unit files for running an ondemand server. (do not add it actually)
 2011-06-29 08:03:00 +02:00
Jan F
d2cf533023 Systemd compatibility according to Mathieu Bridon <bochecha@fedoraproject.org> 
Split out the host keygen into their own command, to ease future migration
to systemd. Compatitbility with the init script was kept.
Migrate the package to full native systemd unit files, according to the Fedora
packaging guidelines.
Prepate the unit files for running an ondemand server. (do not add it actually)
 2011-06-28 11:11:10 +02:00
Jan F
5c8b5cb538 Systemd compatibility according to Mathieu Bridon <bochecha@fedoraproject.org> 
Split out the host keygen into their own command, to ease future migration
to systemd. Compatitbility with the init script was kept.
Migrate the package to full native systemd unit files, according to the Fedora
packaging guidelines.
Prepate the unit files for running an ondemand server. (do not add it actually)
 2011-06-28 10:35:28 +02:00
Jan F
29b683c1d2 Mention IPv6 usage in man pages 2011-06-21 11:01:06 +02:00
Jan F
d3542d5be8 Improve init script 2011-06-20 10:44:49 +02:00
Jan F
ef264f503b Improve init script 2011-06-16 15:44:03 +02:00
Jan F
6bd5ca2e17 Add possibility to compile openssh without downstream patches 2011-06-16 10:24:30 +02:00
Jan F. Chadima
6a2cfe2190 remove stale control sockets (#706396) 2011-06-09 16:10:59 +02:00
Jan F
bc60f31447 improove entropy manuals 2011-05-31 23:09:30 +02:00
Jan F
0e9135fc82 improove entropy handling 
concat ldap patches
 2011-05-28 22:03:43 +02:00
Jan F
ba32c8eafa improove ldap manuals 2011-05-24 19:08:34 +02:00
Jan F
5b4ccb39dd add gssapi forced command 2011-05-22 23:49:15 +02:00
Jan F
c2c99d4dd7 bounce the openssh version 2011-05-03 09:27:52 +02:00
Jan F
87ae97668f bounce the openssh version 2011-05-03 08:37:54 +02:00
Jan F
c0cd660be9 temporarily disabling systemd units 2011-04-28 12:43:31 +02:00
Jan F
9c4d06a341 add flags AI_V4MAPPED and AI_ADDRCONFIG to getaddrinfo 2011-04-27 12:16:14 +02:00
Jan F
6077c76b6e update scriptlets 2011-04-26 21:51:33 +02:00
Jan F
2cd304edac update scriptlets 2011-04-26 20:44:25 +02:00
Jan F
56091ffa2e add systemd units 2011-04-23 16:17:45 +02:00
Jan F
0ecc97b960 add systemd units 2011-04-23 16:15:56 +02:00
Jan F
d470c46f2b add systemd units 2011-04-23 13:43:22 +02:00
Jan F
53f618daef add systemd units 2011-04-23 09:13:06 +02:00
Jan F
0e46f275c6 the private keys may be 640 root:ssh_keys ssh_keysign is sgid 2011-04-22 11:43:01 +02:00
Jan F
e93cf2786f the private keys may be 640 root:ssh_keys ssh_keysign is sgid 2011-04-22 11:36:52 +02:00
Jan F
a8dc50b17f the private keys may be 640 root:ssh_keys ssh_keysign is sgid 2011-04-21 23:27:01 +02:00
Jan F
1ddd0ee5d7 the private keys may be 640 root:ssh_keys ssh_keysign is sgid 2011-04-21 17:22:18 +02:00
Jan F
c7ffe02211 improving sshd -> passwd transation 2011-04-20 21:59:24 +02:00
Jan F
e306854c4d the intermediate context is set to sshd_sftpd_t 
do not crash in packet.c if no connection
 2011-04-15 12:23:36 +02:00
Jan F
439c349423 the intermediate context is set to sshd_sftpd_t 
do not crash in packet.c if no connection
 2011-04-05 20:54:56 +02:00
Jan F
8bc65c49b7 the intermediate context is set to sshd_sftpd_t 
do not crash in packet.c if no connection
 2011-04-05 20:54:12 +02:00
Jan F
1f6bdc75f1 resolve warnings in port_linux.c 2011-04-01 09:04:38 +02:00
Jan F
3f220f2863 resolve warnings in port_linux.c 2011-03-31 21:48:35 +02:00
Jan F
8a77a1dfd5 resolve warnings in port_linux.c 2011-03-31 13:43:13 +02:00
Jan F
11896aa047 add /etc/sysconfig/sshd 2011-03-29 23:25:53 +02:00
Jan F
0553df85b0 improve reseeding and seed source (documentation) 2011-03-28 16:40:17 +02:00
Jan F
91d3b39c03 improve reseeding and seed source (cocumentation) 2011-03-28 16:19:03 +02:00
Jan F
e6d33e3bc4 improve reseeding and seed source (cocumentation) 2011-03-27 21:50:47 +02:00
Jan F
39c7b05d62 use /dev/random or /dev/urandom for seeding prng 
improve periodical reseeding of random generator
 2011-03-22 22:05:18 +01:00
Jan F
3657adf0ba use /dev/random or /dev/urandom for seeding prng 2011-03-22 19:04:37 +01:00
Jan F
0f7ccbf444 add periodical reseeding of random generator 
change selinux contex for internal sftp in do_usercontext
exit(0) after sigterm
 2011-03-17 11:31:16 +01:00
Jan F
8fe15092c3 add periodical reseeding of random generator 
change selinux contex for internal sftp in do_usercontext
exit(0) after sigterm
 2011-03-17 08:18:17 +01:00
Jan F
f33c99e38b improove ssh-ldap (documentation) 2011-03-10 21:59:08 +01:00
Jan F
9992a8e919 improove ssh-ldap (documentation) 2011-03-10 21:48:09 +01:00
Jan F
9404cdd3e3 improove ssh-ldap (documentation) 2011-03-10 18:26:11 +01:00
Jan F
a864d61df9 improve session keys audit 2011-03-10 15:52:21 +01:00
Jan F
ffd063fe18 improve session keys audit 2011-03-09 09:07:16 +01:00
Jan F
d1fc5c2d41 improve session keys audit 2011-03-09 08:48:51 +01:00
Jan F
71d3d9c683 CVE-2010-4755 2011-03-07 20:31:52 +01:00
Jan F
825921b7f3 improove ssk-keycat (documentation) 2011-03-04 15:22:12 +01:00
Jan F
edc1723011 improve audit of logins and auths 2011-03-03 10:54:47 +01:00
Jan F
5c54191b0a improove ssk-keycat 2011-03-02 07:03:38 +01:00
Jan F
5928f9047b improove ssk-keycat 2011-03-01 17:10:09 +01:00
Jan F
1499a28f37 improove ssk-keycat 2011-03-01 07:44:22 +01:00
Jan F
99f427602c add ssk-keycat 2011-02-28 16:42:58 +01:00
Jan F
b934981de5 reenable auth-keys ldap backend 2011-02-25 12:07:01 +01:00
Jan F
48446f1f1b another audit improovements 2011-02-25 09:30:56 +01:00
Jan F
aefa65dfca another audit improovements 2011-02-24 14:25:14 +01:00
Jan F
f9ff105e58 another audit improovements 2011-02-24 14:17:34 +01:00
Jan F
1732b09b93 another audit improovements 2011-02-23 10:23:28 +01:00
Jan F
842f4397cd another audit improovements 2011-02-22 15:07:26 +01:00
Jan F
9cefae06b0 another audit improovements 2011-02-21 19:33:56 +01:00
Jan F
2c1a4adbdd improve audit of server ket management 2011-02-17 17:54:23 +01:00
Jan F
b9127ef973 improve audit of logins and auths 2011-02-16 23:36:59 +01:00
Jan F
483c73337b improve audit of logins and auths 2011-02-16 17:30:51 +01:00
Jan F
003cb0b27f - bump openssh version to 5.8p1 2011-02-14 15:32:49 +01:00
Dennis Gilmore
fa335ee67e - Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild 2011-02-08 21:31:13 -06:00
Jan F
cfb0f30feb - clean the data structures in the non privileged process 
- clean the data structures when roaming
 2011-02-07 20:47:23 +01:00
Jan F
865391f74f - clean the data structures when roaming 2011-02-07 09:21:27 +01:00
Jan F
ee23b09ac6 - clean the data structures in the privileged process 2011-02-02 10:18:01 +01:00
Jan F
f32d86bd8a - clean the data structures in the privileged process 2011-02-02 09:28:26 +01:00
Jan F
6f931660c8 - clean the data structures in the privileged process 2011-01-31 17:04:10 +01:00
Jan F
f00e4a3ddc - clean the data structures before exit net process 2011-01-25 14:06:13 +01:00
Jan F
af8738486c - make audit compatible with the fips mode 2011-01-16 23:50:01 +01:00
Jan F
377ba3cfce - add audit of destruction the server keys 2011-01-14 10:20:53 +01:00
Jan F
9828ffb5fc - add audit of destruction the server keys 2011-01-14 10:18:17 +01:00
Jan F
92eab14042 - add audit of destruction the server keys 2011-01-14 09:45:08 +01:00
Jan F
5c20fa8d2d - add audit of destruction the session keys 2011-01-12 11:09:58 +01:00
Jan F. Chadima
a7cb7d2954 - reenable run sshd as non root user 
- renable rekeying
 2010-10-28 13:04:45 +02:00
Jan F
436639ac40 - reapair clientloop crash (#627332) 
- properly restore euid in case connect to the ssh-agent socket fails
 2010-11-24 08:24:42 +01:00
Jan F
bb5eb00d2d - properly restore euid in case connect to the ssh-agent socket fails 2010-11-24 07:49:04 +01:00
Jan F. Chadima
d2ed53bfc6 - striped read permissions from suid and sgid binaries 
- properly restore euid in case connect to the ssh-agent socket fails
 2010-10-10 05:43:12 +02:00
Jan F
7c53d7e5af - used upstream version of the biguid patch 2010-11-15 14:01:18 +01:00
Jan F
82036abfa2 - improoved kuserok patch 2010-11-15 10:35:33 +01:00
Jan F
5daee12df3 - add auditing the host based key ussage 
- repait X11 abstract layer socket (#648896)
 2010-11-05 17:31:30 +01:00
Jan F. Chadima
f44bdee1ed - add auditing the kex result 2010-09-21 05:36:25 +02:00
Jan F
f8f722ebad - add auditing the key ussage 2010-11-02 21:10:16 +01:00
Jan F
0f4c82ee87 - add auditing the key ussage 2010-11-02 13:10:33 +01:00
Jan F
2d0bc8b9f6 - update gsskex patch (#645389) 2010-10-22 15:45:07 +02:00
Jan F
ba25ecfbc7 - rebase linux audit according to upstream 2010-10-20 11:52:05 +02:00
Jan F. Chadima
cf74d509bc - add missing headers to linux audit 2010-08-31 21:47:07 +02:00
Jan F
faae1e801d - audit module now uses openssh audit framevork 2010-09-29 09:17:40 +02:00
Jan F
cae7368913 - Add the GSSAPI kuserok switch to the kuserok patch 2010-09-15 19:21:47 +02:00
Jan F
46c77f5af2 - Add the GSSAPI kuserok switch to the kuserok patch 2010-09-15 15:55:55 +02:00
Jan F
4c4aa13bbb - Repaired the kuserok patch 2010-09-15 10:07:41 +02:00
Jan F
abe4bc8a6b - Repaired the problem with puting entries with very big uid into lastlog 2010-09-13 14:22:31 +02:00
Jan F
10c6ac8404 - Repaired the problem with puting entries with very big uid into lastlog 2010-09-13 13:08:30 +02:00
Jan F
ce0606e548 - Repaired the problem with puting entries with very big uid into lastlog 2010-09-13 13:02:01 +02:00
Jan F
2bdd0209d2 - Merging selabel patch with the upstream version. (#632914) 2010-09-13 11:40:52 +02:00
Jan F
84d568abcc - Merging selabel patch with the upstream version. (#632914) 2010-09-13 11:38:26 +02:00
Jan F
93909d91af - Tweaking selabel batch to work properly without selinux rules loaded. (#632914) 2010-09-13 10:26:50 +02:00
Tomas Mraz
13fa787ecc - Make fipscheck hmacs compliant with FHS - requires new fipscheck 2010-09-08 09:00:22 +02:00
Jan F
f7e15d5204 - Added -z relro -z now to LDFLAGS 2010-09-08 08:41:29 +02:00
Jan F. Chadima
c6801b909e - Rebased to openssh5.6p1 
- Added -z relro -z now to LDFLAGS
 2010-08-12 07:41:58 +02:00
Jan F. Chadima
1b8a267cb9 Upgrade to openssh-5.6p1 2010-08-03 02:41:49 +02:00
Jan F. Chadima
98ba34ae05 upgrade to openssh-5.6p1 2010-08-03 01:10:26 +02:00
Jan F. Chadima
7818e56d62 - merged with newer bugzilla's version of authorized keys command patch 2010-07-07 13:48:36 +00:00
Jan F. Chadima
eb358aa2e5 - improved the x11 patch according to upstream (#598671) 2010-06-30 14:50:51 +00:00
Jan F. Chadima
a3dee6b29d - improved the x11 patch (#598671) 2010-06-25 12:08:42 +00:00
Jan F. Chadima
41a56c5d4d - changed _PATH_UNIX_X to unexistent file name (#598671) 2010-06-24 07:02:37 +00:00
Jan F. Chadima
411b917379 - sftp works in deviceless chroot again (broken from 5.5p1-3) 2010-06-23 13:53:38 +00:00
Jan F. Chadima
59d42d3dc6 - add option to switch out krb5_kuserok 2010-06-08 10:06:35 +00:00
Jan F. Chadima
2fd105489c - synchronize uid and gid for the user sshd 2010-05-21 13:23:44 +00:00
Jan F. Chadima
b1a625a446 - Typo in ssh-ldap.conf(5) and ssh-ladap-helper(8) 2010-05-20 07:02:32 +00:00
Jan F. Chadima
99d9a391f4 - Repair the reference in man ssh-ldap-helper(8) 
- Repair the PubkeyAgent section in sshd_config(5)
- Provide example ldap.conf
 2010-05-14 08:19:04 +00:00
Jan F. Chadima
86b2d1c41c - Make the Ldap configuration widely compatible 
- create the aditional docs for LDAP support.
 2010-05-13 14:25:38 +00:00
Jan F. Chadima
222d52deed - Make the Ldap configuration widely compatible 
- create the aditional docs for LDAP support.
 2010-05-13 13:53:16 +00:00
Jan F. Chadima
4669c37784 - Make LDAP config elements TLS_CACERT and TLS_REQCERT compatiple with 
pam_ldap (#589360)
 2010-05-06 14:01:16 +00:00
Jan F. Chadima
b6bdf18518 - Make LDAP config element tls_checkpeer compatiple with nss_ldap (#589360) 2010-05-06 09:39:44 +00:00
Jan F. Chadima
bd929b4662 - Comment spec.file 
- Sync patches from upstream
 2010-05-04 07:50:13 +00:00
Jan F. Chadima
6fa4d807de - Comment spec.file 
- Sync patches from upstream
 2010-05-04 07:27:28 +00:00
Jan F. Chadima
3fdf10cdb4 - Create separate ldap package 
- Tweak the ldap patch
- Rename stderr patch properly
 2010-05-03 13:32:38 +00:00
Jan F. Chadima
7e7fb423e6 - Added LDAP support 2010-04-28 11:07:03 +00:00
Jan F. Chadima
2220e6858f - Ignore .bashrc output to stderr in the subsystems 2010-04-26 09:50:26 +00:00
Jan F. Chadima
9e777a245e - Drop dependency on man 2010-04-20 07:25:26 +00:00
Jan F. Chadima
82bc825ff1 - Update to 5.5p1 2010-04-16 08:09:50 +00:00
Jan F. Chadima
e18b1170a3 - repair configure script of pam_ssh_agent 
- repair error mesage in ssh-keygen
 2010-03-20 04:06:11 +00:00
Jan F. Chadima
b823409b8f - repair configure script of pam_ssh_agent 
- repair error mesage in ssh-keygen
 2010-03-19 20:21:36 +00:00
Jan F. Chadima
50a3ddbbcb - repair configure script of pam_ssh_agent 2010-03-19 20:11:25 +00:00
Jan F. Chadima
2640293ec8 source krb5-devel profile script only if exists 2010-03-12 10:47:29 +00:00
Jan F. Chadima
04cab1dcbc Update to 5.4p1 2010-03-09 09:58:14 +00:00
Jan F. Chadima
42225a2417 Update to 5.4p1 2010-03-09 07:00:50 +00:00
Jan F. Chadima
d1a73d1a80 Update to 5.4p1 2010-03-09 06:54:34 +00:00
Jan F. Chadima
974c89c195 Prepare update to 5.4p1 2010-03-03 09:36:51 +00:00
Jan F. Chadima
806a11fa62 ImplicitDSOLinking 2010-02-15 12:20:04 +00:00
Jan F. Chadima
a2a0cf4842 Allow to use hardware crypto if awailable 2010-01-29 10:20:07 +00:00
Jan F. Chadima
606b55d024 optimized FD_CLOEXEC on accept socket 2010-01-25 18:59:02 +00:00
Tomáš Mráz
7451555c05 - updated pam_ssh_agent_auth to new version from upstream (just a licence 
change)
 2010-01-25 14:36:10 +00:00
Jan F. Chadima
e39eb5b75f optimized RAND_cleanup patch 2010-01-21 09:00:42 +00:00
Jan F. Chadima
28355b8c50 add RAND_cleanup at the exit of each program using RAND 2010-01-20 18:43:25 +00:00
Jan F. Chadima
3131004032 set FD_CLOEXEC on accepted socket 2010-01-19 09:07:39 +00:00
Jan F. Chadima
37c0ae034e s/define/global/ in macros 2010-01-11 08:32:06 +00:00
Jan F. Chadima
b8bdc7cf55 s/define/global/ in macros 2010-01-08 11:30:34 +00:00
Jan F. Chadima
9051e5753d Update the pka patch 2010-01-05 09:27:12 +00:00
Jan F. Chadima
ecd50fd460 Update the audit patch 2009-12-21 10:54:59 +00:00
Jan F. Chadima
c32d4acc8b Add possibility to autocreate only RSA key into initscript 2009-12-04 13:31:18 +00:00
Jan F. Chadima
6323f67e20 Prepare NSS key patch for future SEC_ERROR_LOCKED_PASSWORD 2009-11-27 13:22:15 +00:00
Jan F. Chadima
0a64234930 Update NSS key patch 2009-11-24 13:53:46 +00:00
Jan F. Chadima
3d742c1851 Add gssapi key exchange patch 2009-11-20 15:06:47 +00:00
Jan F. Chadima
201f4ac5e9 Add public key agent patch 2009-11-20 10:51:18 +00:00
Jan F. Chadima
d2767e5768 Repair canohost patch to allow gssapi to work when host is acessed via pipe 
proxy
 2009-11-02 11:29:48 +00:00
Jan F. Chadima
5fb555b7fa Modify the init script to prevent it to hang during generating the keys 2009-10-29 09:30:48 +00:00
Jan F. Chadima
838d936248 Add README.nss 2009-10-27 13:48:48 +00:00
Tomáš Mráz
e47cb00157 - Add pam_ssh_agent_auth module to a subpackage. 2009-10-19 07:32:33 +00:00
Jan F. Chadima
2ed3f9b53a Renable audit. 2009-10-17 07:46:49 +00:00
Jan F. Chadima
c54a8b0af7 Upgrade to new wersion 5.3p1 2009-10-02 13:50:30 +00:00
Jan F. Chadima
35695c001b Upgrade to new wersion 5.3p1 2009-10-02 13:17:07 +00:00
Jan F. Chadima
71e8744e6a Resolve locking in ssh-add 2009-09-30 06:43:43 +00:00
Jan F. Chadima
f013bee3ec Repair initscript to be acord to guidelines 2009-09-24 16:05:27 +00:00
Jan F. Chadima
cee78eb11c Repair initscript to be acord to guidelines 2009-09-24 12:34:16 +00:00
Jan F. Chadima
4330e6af2b Changed pam stack to password-auth 2009-09-16 08:12:30 +00:00
Jan F. Chadima
3d51c727c3 Dropped homechroot path 2009-09-11 08:10:13 +00:00
Jan F. Chadima
0447c9e3b7 Dropped homechrot patch 2009-09-11 08:04:22 +00:00
Jan F. Chadima
257d66a4fb Add check for nosuid, nodev in homechroot 2009-09-07 10:20:22 +00:00
Jan F. Chadima
49d0cf7e60 add correct patch for ip-opts 2009-09-01 18:51:41 +00:00
Jan F. Chadima
bd8eb961cd replace ip-opts patch by an upstream candidate version 2009-09-01 14:02:15 +00:00
Jan F. Chadima
ce94daebbc Upstream convergence 2009-08-31 12:40:05 +00:00
Jan F. Chadima
726565c3b0 Upstream convergence 2009-08-31 12:38:20 +00:00
Jan F. Chadima
56bb42082f rearange sesftp patch acording to upstream request 2009-08-28 22:43:53 +00:00
Jan F. Chadima
15914f24ed rearange patches 2009-08-28 21:46:27 +00:00
Jan F. Chadima
214b7b9738 minor change in sesftp patch 2009-08-26 11:01:42 +00:00
Tomáš Mráz
80bcb17706 - rebuilt with new openssl 2009-08-21 15:08:09 +00:00
Jan F. Chadima
986cee7298 Added dnssec support. 2009-07-30 08:29:01 +00:00
Jesse Keating
42c539189a - Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild 2009-07-25 20:53:38 +00:00
Jan F. Chadima
aa89838a87 only INTERNAL_SFTP can be home-chrooted save _u and _r parts of context 
changing to sftpd_t
 2009-07-24 06:15:35 +00:00
Jan F. Chadima
3d6b00af7e changed internal-sftp context to sftpd_t 2009-07-17 07:06:59 +00:00
Jan F. Chadima
ca05b36451 create '~/.ssh/known_hosts' within proper context 2009-06-30 10:26:13 +00:00
Jan F. Chadima
f4b0b4b772 length of home path in ssh now limited by PATH_MAX 2009-06-29 20:51:17 +00:00
Jan F. Chadima
eca05fc45d final version chroot %%h (sftp only) 2009-06-27 06:24:04 +00:00
Jan F. Chadima
c1398b876e repair broken ls in chroot %%h 2009-06-23 17:59:23 +00:00
Jan F. Chadima
ecd8460a44 add XMODIFIERS to exported environment 2009-06-12 12:57:27 +00:00
Jan F. Chadima
5341122cd7 add XMODIFIERS to exported environment 2009-06-12 12:29:54 +00:00
Jan F. Chadima
e45f2ca7df add XMODIFIERS to exported environment 2009-06-12 12:12:51 +00:00
Tomáš Mráz
76f329ece1 - allow only protocol 2 in the FIPS mode 2009-05-15 14:44:21 +00:00
Tomáš Mráz
685b6239bb - do integrity verification only on binaries which are part of the OpenSSH 
FIPS modules
 2009-04-30 12:03:29 +00:00
Tomáš Mráz
0a4fa5d1ed - log if FIPS mode is initialized 
- make aes-ctr cipher modes work in the FIPS mode
 2009-04-20 12:18:49 +00:00
Jan F. Chadima
3a94ae1476 *** empty log message *** 2009-04-03 13:03:29 +00:00
Jan F. Chadima
061e214116 - fix logging after chroot 
- enable non root users to use chroot %h in internal-sftp
 2009-04-03 12:37:30 +00:00
Tomáš Mráz
0f07b4ad95 - add AES-CTR ciphers to the FIPS mode proposal 2009-03-13 10:32:52 +00:00
Jan F. Chadima
a3ba41c854 Bounce openssh to version 5.2p1 2009-03-10 11:54:44 +00:00
Jesse Keating
c5f25a5f48 - Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild 2009-02-26 08:48:36 +00:00
Tomáš Mráz
d93958db19 - drop obsolete triggers 
- add testing FIPS mode support
- LSBize the initscript (#247014)
 2009-02-12 18:19:52 +00:00
Tomáš Mráz
ff6d597308 - enable use of ssl engines (#481100) 2009-01-30 15:44:41 +00:00
Tomáš Mráz
6a5e296ba7 - remove obsolete --with-rsh (#478298) 
- add pam_sepermit to allow blocking confined users in permissive mode
    (#471746)
- move system-auth after pam_selinux in the session stack
 2009-01-15 10:52:07 +00:00
Tomáš Mráz
9e5c6ecd02 - set FD_CLOEXEC on channel sockets (#475866) 
- adjust summary
- adjust nss-keys patch so it is applicable without selinux patches
    (#470859)
 2008-12-11 21:48:41 +00:00
Tomáš Mráz
b9a07ad737 - fix compatibility with some servers (#466818) 2008-10-17 08:34:36 +00:00
Tomáš Mráz
578f0d08a9 - fixed zero length banner problem (#457326) 2008-07-31 09:22:18 +00:00
Tomáš Mráz
ec5276165c - rediff for no fuzz 2008-07-23 17:33:16 +00:00
Tomáš Mráz
09510adc7c - rediff for zero fuzz tolerance 2008-07-23 16:30:14 +00:00
Tomáš Mráz
93a4744539 - upgrade to new upstream release 
- fixed a problem with public key authentication and explicitely specified
    SELinux role
 2008-07-23 14:50:23 +00:00
Tomáš Mráz
077dad7320 - pass the connection socket to ssh-keysign (#447680) 2008-05-21 08:16:23 +00:00
Tomáš Mráz
1961bc12e6 - add LANGUAGE to accepted/sent environment variables (#443231) 
- use pam_selinux to obtain the user context instead of doing it itself
- unbreak server keep alive settings (patch from upstream)
- small addition to scp manpage
 2008-05-19 16:53:29 +00:00
Tomáš Mráz
ca47f63941 - upgrade to new upstream (#441066) 
- prevent initscript from killing itself on halt with upstart (#438449)
- initscript status should show that the daemon is running only when the
    main daemon is still alive (#430882)
 2008-04-07 20:14:31 +00:00
Tomáš Mráz
2cb0e73a4e - set FD_CLOEXEC on client socket 
- apply real fix for window size problem (#286181) from upstream
- apply fix for the spurious failed bind from upstream
- apply open handle leak in sftp fix from upstream
 2008-02-29 16:34:03 +00:00
Dennis Gilmore
91bdf496cd we build sparc32 sparcv9 by default now it needed adding to the -fPIE list 2008-02-13 03:52:43 +00:00
Tomáš Mráz
993dd1a3db - fix gssapi auth with explicit selinux role requested (#427303) - patch by 
Nalin Dahyabhai
 2008-01-03 17:45:59 +00:00
Tomáš Mráz
3457e3e00f - explicitly source krb5-devel profile script 2007-12-04 19:03:49 +00:00
Tomáš Mráz
2cc09c66ed - explicitly source krb5-devel profile script 
- rebuild for openssl bump
 2007-12-04 18:58:25 +00:00
Jesse Keating
9eac427785 - Rebuild for openssl bump 2007-12-04 18:47:33 +00:00
Tomáš Mráz
320a1c8f0e - localtime in chroot no longer needed 2007-11-20 18:38:37 +00:00
Tomáš Mráz
0a9a4072ef - must require ncurses-devel for libedit 2007-11-20 18:26:30 +00:00
Tomáš Mráz
b1ffa00b4c - version bump 2007-11-20 15:04:37 +00:00
Tomáš Mráz
8b8c4dc83c - do not copy /etc/localtime into the chroot as it is not necessary anymore 
(#193184)
- call setkeycreatecon when selinux context is established
- test for NULL privk when freeing key (#391871) - patch by Pierre Ossman
 2007-11-20 14:53:45 +00:00
Tomáš Mráz
95be083504 - revert default window size adjustments (#286181) 2007-09-17 21:33:02 +00:00
Tomáš Mráz
c9833c96a4 - upgrade to latest upstream 
- use libedit in sftp (#203009)
- fixed audit log injection problem (CVE-2007-3102)
 2007-09-06 19:49:16 +00:00
Tomáš Mráz
f370730d3b - fix sftp client problems on write error (#247802) 
- allow disabling autocreation of server keys (#235466)
 2007-08-09 18:33:41 +00:00
Tomáš Mráz
fc2f31df03 - oops committed testing only change 2007-06-20 19:33:53 +00:00
Tomáš Mráz
0092bbd526 - add buildrequires nss-devel to build with the nss-keys patch 2007-06-20 19:11:49 +00:00
Tomáš Mráz
c3274ccb32 - experimental NSS keys support 
- correctly setup context when empty level requested (#234951)
 2007-06-20 17:47:18 +00:00
Tomáš Mráz
7210c0162a - mls level check must be done with default role same as requested 2007-03-20 09:13:40 +00:00
Tomáš Mráz
b40baab181 - make profile.d/gnome-ssh-askpass.* regular files (#226218) 2007-03-19 11:57:36 +00:00
Tomáš Mráz
546fdd9f47 - reject connection if requested mls range is not obtained (#229278) 2007-03-01 08:28:22 +00:00
Tomáš Mráz
9d725bd1ab - improve Buildroot 
- remove duplicate /etc/ssh from files
 2007-02-22 13:00:51 +00:00
Tomáš Mráz
c2b35d09c0 - support mls on labeled networks (#220487) 
- support mls level selection on unlabeled networks
- allow / in usernames in scp (only beginning /, ./, and ../ is special)
 2007-01-16 20:58:00 +00:00
Tomáš Mráz
45f17da853 - buildrequire tcp_wrappers-devel 2006-12-21 13:59:55 +00:00
Tomáš Mráz
ad07b998ed - update to 4.5p1 (#212606) 2006-12-21 13:42:47 +00:00
Tomáš Mráz
914284ff3f - fix gssapi with DNS loadbalanced clusters (#216857) 2006-11-30 10:50:12 +00:00
Tomáš Mráz
d63dc67db7 - improved pam_session patch so it doesn't regress, the patch is necessary 
for the pam_session_close to be called correctly as uid 0
 2006-11-28 21:14:50 +00:00
Tomáš Mráz
ad61b116d1 - CVE-2006-5794 - properly detect failed key verify in monitor (#214641) 2006-11-10 10:00:04 +00:00
Tomáš Mráz
19675afc7c - merge sshd initscript patches 
- kill all ssh sessions when stop is called in halt or reboot runlevel
- remove -TERM option from killproc so we don't race on sshd restart
 2006-11-02 13:33:37 +00:00
Tomáš Mráz
7114c4238b - improve gssapi-no-spnego patch (#208102) 
- CVE-2006-4924 - prevent DoS on deattack detector (#207957)
- CVE-2006-5051 - don't call cleanups from signal handler (#208459)
 2006-10-02 17:35:50 +00:00
Tomáš Mráz
ac4818c499 - don't report duplicate syslog messages, use correct local time (#189158) 
- don't allow spnego as gssapi mechanism (from upstream)
- fixed memleaks found by Coverity (from upstream)
- allow ip options except source routing (#202856) (patch by HP)
 2006-08-23 21:06:38 +00:00
Tomáš Mráz
c12d6ba86c - drop the pam-session patch from the previous build (#201341) 
- don't set IPV6_V6ONLY sock opt when listening on wildcard addr (#201594)
 2006-08-08 11:58:33 +00:00
Tomáš Mráz
762e407bd5 - dropped old ssh obsoletes 
- call the pam_session_open/close from the monitor when privsep is enabled
    so it is always called as root (patch by Darren Tucker)
 2006-07-20 11:06:42 +00:00
Tomáš Mráz
ef32423955 - improve selinux patch (by Jan Kiszka) 
- upstream patch for buffer append space error (#191940)
- fixed typo in configure.ac (#198986)
- added pam_keyinit to pam configuration (#198628)
- improved error message when askpass dialog cannot grab keyboard input
    (#198332)
- buildrequires xauth instead of xorg-x11-xauth
- fixed a few rpmlint warnings
 2006-07-17 14:09:15 +00:00
Jesse Keating
d446e97b50 bumped for rebuild 2006-07-12 07:35:41 +00:00
Tomáš Mráz
7e1c558992 - don't request pseudoterminal allocation if stdin is not tty (#188983) 2006-04-14 08:26:10 +00:00
Tomáš Mráz
5f29aca399 - allow access if audit is not compiled in kernel (#183243) 2006-03-02 21:37:28 +00:00
Tomáš Mráz
e01ed66930 - enable the subprocess in chroot to send messages to system log 
- sshd should prevent login if audit call fails
 2006-02-24 14:07:41 +00:00
Tomáš Mráz
b5e849f024 - print error from scp if not remote (patch by Bjorn Augustsson #178923) 2006-02-21 16:00:42 +00:00
Tomáš Mráz
f16d34eebb - new version 2006-02-13 14:11:41 +00:00
Jesse Keating
3de0ff3efe bump for bug in double-long on ppc(64) 2006-02-11 04:53:48 +00:00
Tomáš Mráz
f223ebd938 - fixed another place where syslog was called in signal handler 
- pass locale environment variables to server, accept them there (#179851)
 2006-02-06 20:16:03 +00:00
Tomáš Mráz
fd638ab458 - new version, dropped obsolete patches 2006-02-01 16:26:13 +00:00
Tomáš Mráz
6b14a037c1 - get rid of the .1 in release 2005-12-20 14:50:27 +00:00
Tomáš Mráz
bb93ea2b3c - hopefully make the askpass dialog less confusing (#174765) 2005-12-20 14:44:46 +00:00
Jesse Keating
6e3ae48bee gcc update bump 2005-12-09 22:42:35 +00:00
Tomáš Mráz
09d7e68ab5 - drop x11-ssh-askpass from the package 
- drop old build_6x ifs from spec file
- improve gnome-ssh-askpass so it doesn't reveal number of passphrase
    characters to person looking at the display
- less hackish fix for the __USE_GNU problem
 2005-11-22 16:48:57 +00:00
Nalin Dahyabhai
db25651586 remove now-obsolete builddep on xauth 2005-11-18 17:12:23 +00:00
Nalin Dahyabhai
3ef0dd1d9a actually bump the release number 2005-11-18 17:05:07 +00:00
Nalin Dahyabhai
05c945b8c1 - work around gccmakedep not being there by fooling the build machinery 
into using makedepend (which is there) instead
 2005-11-18 17:03:02 +00:00
Warren Togami
0e58628723 - buildreq audit-libs-devel 
- buildreq automake for aclocal
- buildreq imake for xmkmf
- -D_GNU_SOURCE in flags in order to get it to build Ugly hack to
    workaround openssh defining __USE_GNU which is not allowed and causes
    problems according to Ulrich Drepper fix this the correct way after
    FC5test1
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=173568 Note that it
    seems we are unable to rebuild openssh at this time because gccmakedep
    seems to be missing from modular X packages.
 2005-11-18 04:37:53 +00:00
Warren Togami
19e22ad819 - xorg-x11-devel -> libXt-devel 
- rebuild for new xauth location so X forwarding works
 2005-11-17 20:02:37 +00:00
Warren Togami
d40b8ce60d rebuild to pick up new xauth location so X forwarding works 2005-11-17 19:47:35 +00:00
Jeremy Katz
c799b385d1 xfree86-devel is gone 2005-11-10 00:12:18 +00:00
Jeremy Katz
35e1e0c440 - rebuild against new openssl 2005-11-10 00:10:18 +00:00
Tomáš Mráz
fc72c21070 - put back the possibility to skip SELinux patch 
- add patch for user login auditing by Steve Grubb
 2005-10-28 16:02:53 +00:00
Daniel J Walsh
5312560fd5 Update selinux patch to use rolelevel call 2005-10-18 20:57:59 +00:00
Daniel J Walsh
0e07edf81f - Update selinux patch to use getseuserbyname 2005-10-13 21:14:36 +00:00
Tomáš Mráz
092218f61b - typo 2005-10-07 12:52:51 +00:00
Tomáš Mráz
896122bfea - use include instead of pam_stack in pam config 
- use fork+exec instead of system in scp (#168167)
- upstream patch for displaying authentication errors
 2005-10-07 12:46:20 +00:00
Tomáš Mráz
5bab487cc3 - use include instead of pam_stack in pam config 
- use fork+exec instead of system in scp (#168167)
- upstream patch for displaying authentication errors
 2005-10-07 12:29:15 +00:00
Tomáš Mráz
de2e7a36f5 - upgrade to a new upstream version 2005-09-06 19:55:17 +00:00
Tomáš Mráz
f94d8f533f - use x11-ssh-askpass if openssh-askpass-gnome is not installed (#165207) 
- install ssh-copy-id from contrib (#88707)
 2005-08-16 11:18:44 +00:00
Tomáš Mráz
fa148157e7 - don't deadlock on exit with multiple X forwarded channels (#152432) 
- don't use X11 port which can't be bound on all IP families (#163732)
 2005-07-27 11:42:36 +00:00
Tomáš Mráz
79c96868ce - fix small regression caused by the nologin patch (#161956) 
- fix race in getpeername error checking (mindrot #1054)
 2005-06-29 11:24:36 +00:00
Tomáš Mráz
8552577357 - release up 2005-06-09 19:59:04 +00:00
Tomáš Mráz
9ac1c8b26a - use only pam_nologin for nologin testing 2005-06-09 19:58:01 +00:00