rpms/openssh
7
0
Fork 1
Code Issues Pull Requests Releases Activity
328 Commits 10 Branches 63 Tags 11 MiB
8ecc9b0555
Commit Graph

296 Commits

Author SHA1 Message Date
Jan F. Chadima
42225a2417 Update to 5.4p1 2010-03-09 07:00:50 +00:00
Jan F. Chadima
d1a73d1a80 Update to 5.4p1 2010-03-09 06:54:34 +00:00
Jan F. Chadima
974c89c195 Prepare update to 5.4p1 2010-03-03 09:36:51 +00:00
Jan F. Chadima
806a11fa62 ImplicitDSOLinking 2010-02-15 12:20:04 +00:00
Jan F. Chadima
a2a0cf4842 Allow to use hardware crypto if awailable 2010-01-29 10:20:07 +00:00
Jan F. Chadima
606b55d024 optimized FD_CLOEXEC on accept socket 2010-01-25 18:59:02 +00:00
Tomáš Mráz
7451555c05 - updated pam_ssh_agent_auth to new version from upstream (just a licence 
change)
 2010-01-25 14:36:10 +00:00
Jan F. Chadima
e39eb5b75f optimized RAND_cleanup patch 2010-01-21 09:00:42 +00:00
Jan F. Chadima
28355b8c50 add RAND_cleanup at the exit of each program using RAND 2010-01-20 18:43:25 +00:00
Jan F. Chadima
3131004032 set FD_CLOEXEC on accepted socket 2010-01-19 09:07:39 +00:00
Jan F. Chadima
37c0ae034e s/define/global/ in macros 2010-01-11 08:32:06 +00:00
Jan F. Chadima
b8bdc7cf55 s/define/global/ in macros 2010-01-08 11:30:34 +00:00
Jan F. Chadima
9051e5753d Update the pka patch 2010-01-05 09:27:12 +00:00
Jan F. Chadima
ecd50fd460 Update the audit patch 2009-12-21 10:54:59 +00:00
Jan F. Chadima
c32d4acc8b Add possibility to autocreate only RSA key into initscript 2009-12-04 13:31:18 +00:00
Jan F. Chadima
6323f67e20 Prepare NSS key patch for future SEC_ERROR_LOCKED_PASSWORD 2009-11-27 13:22:15 +00:00
Jan F. Chadima
0a64234930 Update NSS key patch 2009-11-24 13:53:46 +00:00
Jan F. Chadima
3d742c1851 Add gssapi key exchange patch 2009-11-20 15:06:47 +00:00
Jan F. Chadima
201f4ac5e9 Add public key agent patch 2009-11-20 10:51:18 +00:00
Jan F. Chadima
d2767e5768 Repair canohost patch to allow gssapi to work when host is acessed via pipe 
proxy
 2009-11-02 11:29:48 +00:00
Jan F. Chadima
5fb555b7fa Modify the init script to prevent it to hang during generating the keys 2009-10-29 09:30:48 +00:00
Jan F. Chadima
838d936248 Add README.nss 2009-10-27 13:48:48 +00:00
Tomáš Mráz
e47cb00157 - Add pam_ssh_agent_auth module to a subpackage. 2009-10-19 07:32:33 +00:00
Jan F. Chadima
2ed3f9b53a Renable audit. 2009-10-17 07:46:49 +00:00
Jan F. Chadima
c54a8b0af7 Upgrade to new wersion 5.3p1 2009-10-02 13:50:30 +00:00
Jan F. Chadima
35695c001b Upgrade to new wersion 5.3p1 2009-10-02 13:17:07 +00:00
Jan F. Chadima
71e8744e6a Resolve locking in ssh-add 2009-09-30 06:43:43 +00:00
Jan F. Chadima
f013bee3ec Repair initscript to be acord to guidelines 2009-09-24 16:05:27 +00:00
Jan F. Chadima
cee78eb11c Repair initscript to be acord to guidelines 2009-09-24 12:34:16 +00:00
Jan F. Chadima
4330e6af2b Changed pam stack to password-auth 2009-09-16 08:12:30 +00:00
Jan F. Chadima
3d51c727c3 Dropped homechroot path 2009-09-11 08:10:13 +00:00
Jan F. Chadima
0447c9e3b7 Dropped homechrot patch 2009-09-11 08:04:22 +00:00
Jan F. Chadima
257d66a4fb Add check for nosuid, nodev in homechroot 2009-09-07 10:20:22 +00:00
Jan F. Chadima
49d0cf7e60 add correct patch for ip-opts 2009-09-01 18:51:41 +00:00
Jan F. Chadima
bd8eb961cd replace ip-opts patch by an upstream candidate version 2009-09-01 14:02:15 +00:00
Jan F. Chadima
ce94daebbc Upstream convergence 2009-08-31 12:40:05 +00:00
Jan F. Chadima
726565c3b0 Upstream convergence 2009-08-31 12:38:20 +00:00
Jan F. Chadima
56bb42082f rearange sesftp patch acording to upstream request 2009-08-28 22:43:53 +00:00
Jan F. Chadima
15914f24ed rearange patches 2009-08-28 21:46:27 +00:00
Jan F. Chadima
214b7b9738 minor change in sesftp patch 2009-08-26 11:01:42 +00:00
Tomáš Mráz
80bcb17706 - rebuilt with new openssl 2009-08-21 15:08:09 +00:00
Jan F. Chadima
986cee7298 Added dnssec support. 2009-07-30 08:29:01 +00:00
Jesse Keating
42c539189a - Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild 2009-07-25 20:53:38 +00:00
Jan F. Chadima
aa89838a87 only INTERNAL_SFTP can be home-chrooted save _u and _r parts of context 
changing to sftpd_t
 2009-07-24 06:15:35 +00:00
Jan F. Chadima
3d6b00af7e changed internal-sftp context to sftpd_t 2009-07-17 07:06:59 +00:00
Jan F. Chadima
ca05b36451 create '~/.ssh/known_hosts' within proper context 2009-06-30 10:26:13 +00:00
Jan F. Chadima
f4b0b4b772 length of home path in ssh now limited by PATH_MAX 2009-06-29 20:51:17 +00:00
Jan F. Chadima
eca05fc45d final version chroot %%h (sftp only) 2009-06-27 06:24:04 +00:00
Jan F. Chadima
c1398b876e repair broken ls in chroot %%h 2009-06-23 17:59:23 +00:00
Jan F. Chadima
ecd8460a44 add XMODIFIERS to exported environment 2009-06-12 12:57:27 +00:00
Jan F. Chadima
5341122cd7 add XMODIFIERS to exported environment 2009-06-12 12:29:54 +00:00
Jan F. Chadima
e45f2ca7df add XMODIFIERS to exported environment 2009-06-12 12:12:51 +00:00
Tomáš Mráz
76f329ece1 - allow only protocol 2 in the FIPS mode 2009-05-15 14:44:21 +00:00
Tomáš Mráz
685b6239bb - do integrity verification only on binaries which are part of the OpenSSH 
FIPS modules
 2009-04-30 12:03:29 +00:00
Tomáš Mráz
0a4fa5d1ed - log if FIPS mode is initialized 
- make aes-ctr cipher modes work in the FIPS mode
 2009-04-20 12:18:49 +00:00
Jan F. Chadima
3a94ae1476 *** empty log message *** 2009-04-03 13:03:29 +00:00
Jan F. Chadima
061e214116 - fix logging after chroot 
- enable non root users to use chroot %h in internal-sftp
 2009-04-03 12:37:30 +00:00
Tomáš Mráz
0f07b4ad95 - add AES-CTR ciphers to the FIPS mode proposal 2009-03-13 10:32:52 +00:00
Jan F. Chadima
a3ba41c854 Bounce openssh to version 5.2p1 2009-03-10 11:54:44 +00:00
Jesse Keating
c5f25a5f48 - Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild 2009-02-26 08:48:36 +00:00
Tomáš Mráz
d93958db19 - drop obsolete triggers 
- add testing FIPS mode support
- LSBize the initscript (#247014)
 2009-02-12 18:19:52 +00:00
Tomáš Mráz
ff6d597308 - enable use of ssl engines (#481100) 2009-01-30 15:44:41 +00:00
Tomáš Mráz
6a5e296ba7 - remove obsolete --with-rsh (#478298) 
- add pam_sepermit to allow blocking confined users in permissive mode
    (#471746)
- move system-auth after pam_selinux in the session stack
 2009-01-15 10:52:07 +00:00
Tomáš Mráz
9e5c6ecd02 - set FD_CLOEXEC on channel sockets (#475866) 
- adjust summary
- adjust nss-keys patch so it is applicable without selinux patches
    (#470859)
 2008-12-11 21:48:41 +00:00
Tomáš Mráz
b9a07ad737 - fix compatibility with some servers (#466818) 2008-10-17 08:34:36 +00:00
Tomáš Mráz
578f0d08a9 - fixed zero length banner problem (#457326) 2008-07-31 09:22:18 +00:00
Tomáš Mráz
ec5276165c - rediff for no fuzz 2008-07-23 17:33:16 +00:00
Tomáš Mráz
09510adc7c - rediff for zero fuzz tolerance 2008-07-23 16:30:14 +00:00
Tomáš Mráz
93a4744539 - upgrade to new upstream release 
- fixed a problem with public key authentication and explicitely specified
    SELinux role
 2008-07-23 14:50:23 +00:00
Tomáš Mráz
077dad7320 - pass the connection socket to ssh-keysign (#447680) 2008-05-21 08:16:23 +00:00
Tomáš Mráz
1961bc12e6 - add LANGUAGE to accepted/sent environment variables (#443231) 
- use pam_selinux to obtain the user context instead of doing it itself
- unbreak server keep alive settings (patch from upstream)
- small addition to scp manpage
 2008-05-19 16:53:29 +00:00
Tomáš Mráz
ca47f63941 - upgrade to new upstream (#441066) 
- prevent initscript from killing itself on halt with upstart (#438449)
- initscript status should show that the daemon is running only when the
    main daemon is still alive (#430882)
 2008-04-07 20:14:31 +00:00
Tomáš Mráz
2cb0e73a4e - set FD_CLOEXEC on client socket 
- apply real fix for window size problem (#286181) from upstream
- apply fix for the spurious failed bind from upstream
- apply open handle leak in sftp fix from upstream
 2008-02-29 16:34:03 +00:00
Dennis Gilmore
91bdf496cd we build sparc32 sparcv9 by default now it needed adding to the -fPIE list 2008-02-13 03:52:43 +00:00
Tomáš Mráz
993dd1a3db - fix gssapi auth with explicit selinux role requested (#427303) - patch by 
Nalin Dahyabhai
 2008-01-03 17:45:59 +00:00
Tomáš Mráz
3457e3e00f - explicitly source krb5-devel profile script 2007-12-04 19:03:49 +00:00
Tomáš Mráz
2cc09c66ed - explicitly source krb5-devel profile script 
- rebuild for openssl bump
 2007-12-04 18:58:25 +00:00
Jesse Keating
9eac427785 - Rebuild for openssl bump 2007-12-04 18:47:33 +00:00
Tomáš Mráz
320a1c8f0e - localtime in chroot no longer needed 2007-11-20 18:38:37 +00:00
Tomáš Mráz
0a9a4072ef - must require ncurses-devel for libedit 2007-11-20 18:26:30 +00:00
Tomáš Mráz
b1ffa00b4c - version bump 2007-11-20 15:04:37 +00:00
Tomáš Mráz
8b8c4dc83c - do not copy /etc/localtime into the chroot as it is not necessary anymore 
(#193184)
- call setkeycreatecon when selinux context is established
- test for NULL privk when freeing key (#391871) - patch by Pierre Ossman
 2007-11-20 14:53:45 +00:00
Tomáš Mráz
95be083504 - revert default window size adjustments (#286181) 2007-09-17 21:33:02 +00:00
Tomáš Mráz
c9833c96a4 - upgrade to latest upstream 
- use libedit in sftp (#203009)
- fixed audit log injection problem (CVE-2007-3102)
 2007-09-06 19:49:16 +00:00
Tomáš Mráz
f370730d3b - fix sftp client problems on write error (#247802) 
- allow disabling autocreation of server keys (#235466)
 2007-08-09 18:33:41 +00:00
Tomáš Mráz
fc2f31df03 - oops committed testing only change 2007-06-20 19:33:53 +00:00
Tomáš Mráz
0092bbd526 - add buildrequires nss-devel to build with the nss-keys patch 2007-06-20 19:11:49 +00:00
Tomáš Mráz
c3274ccb32 - experimental NSS keys support 
- correctly setup context when empty level requested (#234951)
 2007-06-20 17:47:18 +00:00
Tomáš Mráz
7210c0162a - mls level check must be done with default role same as requested 2007-03-20 09:13:40 +00:00
Tomáš Mráz
b40baab181 - make profile.d/gnome-ssh-askpass.* regular files (#226218) 2007-03-19 11:57:36 +00:00
Tomáš Mráz
546fdd9f47 - reject connection if requested mls range is not obtained (#229278) 2007-03-01 08:28:22 +00:00
Tomáš Mráz
9d725bd1ab - improve Buildroot 
- remove duplicate /etc/ssh from files
 2007-02-22 13:00:51 +00:00
Tomáš Mráz
c2b35d09c0 - support mls on labeled networks (#220487) 
- support mls level selection on unlabeled networks
- allow / in usernames in scp (only beginning /, ./, and ../ is special)
 2007-01-16 20:58:00 +00:00
Tomáš Mráz
45f17da853 - buildrequire tcp_wrappers-devel 2006-12-21 13:59:55 +00:00
Tomáš Mráz
ad07b998ed - update to 4.5p1 (#212606) 2006-12-21 13:42:47 +00:00
Tomáš Mráz
914284ff3f - fix gssapi with DNS loadbalanced clusters (#216857) 2006-11-30 10:50:12 +00:00
Tomáš Mráz
d63dc67db7 - improved pam_session patch so it doesn't regress, the patch is necessary 
for the pam_session_close to be called correctly as uid 0
 2006-11-28 21:14:50 +00:00
Tomáš Mráz
ad61b116d1 - CVE-2006-5794 - properly detect failed key verify in monitor (#214641) 2006-11-10 10:00:04 +00:00
Tomáš Mráz
19675afc7c - merge sshd initscript patches 
- kill all ssh sessions when stop is called in halt or reboot runlevel
- remove -TERM option from killproc so we don't race on sshd restart
 2006-11-02 13:33:37 +00:00
Tomáš Mráz
7114c4238b - improve gssapi-no-spnego patch (#208102) 
- CVE-2006-4924 - prevent DoS on deattack detector (#207957)
- CVE-2006-5051 - don't call cleanups from signal handler (#208459)
 2006-10-02 17:35:50 +00:00
Tomáš Mráz
ac4818c499 - don't report duplicate syslog messages, use correct local time (#189158) 
- don't allow spnego as gssapi mechanism (from upstream)
- fixed memleaks found by Coverity (from upstream)
- allow ip options except source routing (#202856) (patch by HP)
 2006-08-23 21:06:38 +00:00
Tomáš Mráz
c12d6ba86c - drop the pam-session patch from the previous build (#201341) 
- don't set IPV6_V6ONLY sock opt when listening on wildcard addr (#201594)
 2006-08-08 11:58:33 +00:00
Tomáš Mráz
762e407bd5 - dropped old ssh obsoletes 
- call the pam_session_open/close from the monitor when privsep is enabled
    so it is always called as root (patch by Darren Tucker)
 2006-07-20 11:06:42 +00:00
Tomáš Mráz
ef32423955 - improve selinux patch (by Jan Kiszka) 
- upstream patch for buffer append space error (#191940)
- fixed typo in configure.ac (#198986)
- added pam_keyinit to pam configuration (#198628)
- improved error message when askpass dialog cannot grab keyboard input
    (#198332)
- buildrequires xauth instead of xorg-x11-xauth
- fixed a few rpmlint warnings
 2006-07-17 14:09:15 +00:00
Jesse Keating
d446e97b50 bumped for rebuild 2006-07-12 07:35:41 +00:00
Tomáš Mráz
7e1c558992 - don't request pseudoterminal allocation if stdin is not tty (#188983) 2006-04-14 08:26:10 +00:00
Tomáš Mráz
5f29aca399 - allow access if audit is not compiled in kernel (#183243) 2006-03-02 21:37:28 +00:00
Tomáš Mráz
e01ed66930 - enable the subprocess in chroot to send messages to system log 
- sshd should prevent login if audit call fails
 2006-02-24 14:07:41 +00:00
Tomáš Mráz
b5e849f024 - print error from scp if not remote (patch by Bjorn Augustsson #178923) 2006-02-21 16:00:42 +00:00
Tomáš Mráz
f16d34eebb - new version 2006-02-13 14:11:41 +00:00
Jesse Keating
3de0ff3efe bump for bug in double-long on ppc(64) 2006-02-11 04:53:48 +00:00
Tomáš Mráz
f223ebd938 - fixed another place where syslog was called in signal handler 
- pass locale environment variables to server, accept them there (#179851)
 2006-02-06 20:16:03 +00:00
Tomáš Mráz
fd638ab458 - new version, dropped obsolete patches 2006-02-01 16:26:13 +00:00
Tomáš Mráz
6b14a037c1 - get rid of the .1 in release 2005-12-20 14:50:27 +00:00
Tomáš Mráz
bb93ea2b3c - hopefully make the askpass dialog less confusing (#174765) 2005-12-20 14:44:46 +00:00
Jesse Keating
6e3ae48bee gcc update bump 2005-12-09 22:42:35 +00:00
Tomáš Mráz
09d7e68ab5 - drop x11-ssh-askpass from the package 
- drop old build_6x ifs from spec file
- improve gnome-ssh-askpass so it doesn't reveal number of passphrase
    characters to person looking at the display
- less hackish fix for the __USE_GNU problem
 2005-11-22 16:48:57 +00:00
Nalin Dahyabhai
db25651586 remove now-obsolete builddep on xauth 2005-11-18 17:12:23 +00:00
Nalin Dahyabhai
3ef0dd1d9a actually bump the release number 2005-11-18 17:05:07 +00:00
Nalin Dahyabhai
05c945b8c1 - work around gccmakedep not being there by fooling the build machinery 
into using makedepend (which is there) instead
 2005-11-18 17:03:02 +00:00
Warren Togami
0e58628723 - buildreq audit-libs-devel 
- buildreq automake for aclocal
- buildreq imake for xmkmf
- -D_GNU_SOURCE in flags in order to get it to build Ugly hack to
    workaround openssh defining __USE_GNU which is not allowed and causes
    problems according to Ulrich Drepper fix this the correct way after
    FC5test1
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=173568 Note that it
    seems we are unable to rebuild openssh at this time because gccmakedep
    seems to be missing from modular X packages.
 2005-11-18 04:37:53 +00:00
Warren Togami
19e22ad819 - xorg-x11-devel -> libXt-devel 
- rebuild for new xauth location so X forwarding works
 2005-11-17 20:02:37 +00:00
Warren Togami
d40b8ce60d rebuild to pick up new xauth location so X forwarding works 2005-11-17 19:47:35 +00:00
Jeremy Katz
c799b385d1 xfree86-devel is gone 2005-11-10 00:12:18 +00:00
Jeremy Katz
35e1e0c440 - rebuild against new openssl 2005-11-10 00:10:18 +00:00
Tomáš Mráz
fc72c21070 - put back the possibility to skip SELinux patch 
- add patch for user login auditing by Steve Grubb
 2005-10-28 16:02:53 +00:00
Daniel J Walsh
5312560fd5 Update selinux patch to use rolelevel call 2005-10-18 20:57:59 +00:00
Daniel J Walsh
0e07edf81f - Update selinux patch to use getseuserbyname 2005-10-13 21:14:36 +00:00
Tomáš Mráz
092218f61b - typo 2005-10-07 12:52:51 +00:00
Tomáš Mráz
896122bfea - use include instead of pam_stack in pam config 
- use fork+exec instead of system in scp (#168167)
- upstream patch for displaying authentication errors
 2005-10-07 12:46:20 +00:00
Tomáš Mráz
5bab487cc3 - use include instead of pam_stack in pam config 
- use fork+exec instead of system in scp (#168167)
- upstream patch for displaying authentication errors
 2005-10-07 12:29:15 +00:00
Tomáš Mráz
de2e7a36f5 - upgrade to a new upstream version 2005-09-06 19:55:17 +00:00
Tomáš Mráz
f94d8f533f - use x11-ssh-askpass if openssh-askpass-gnome is not installed (#165207) 
- install ssh-copy-id from contrib (#88707)
 2005-08-16 11:18:44 +00:00
Tomáš Mráz
fa148157e7 - don't deadlock on exit with multiple X forwarded channels (#152432) 
- don't use X11 port which can't be bound on all IP families (#163732)
 2005-07-27 11:42:36 +00:00
Tomáš Mráz
79c96868ce - fix small regression caused by the nologin patch (#161956) 
- fix race in getpeername error checking (mindrot #1054)
 2005-06-29 11:24:36 +00:00
Tomáš Mráz
8552577357 - release up 2005-06-09 19:59:04 +00:00
Tomáš Mráz
9ac1c8b26a - use only pam_nologin for nologin testing 2005-06-09 19:58:01 +00:00
Tomáš Mráz
9cf4ab1e9b - upgrade to a new upstream version 
- call pam_loginuid as a pam session module
 2005-06-06 19:45:23 +00:00
Tomáš Mráz
9c577134e8 - link libselinux only to sshd (#157678) 2005-05-16 17:18:02 +00:00
Tomáš Mráz
1e27c055b8 - fixed Local/RemoteForward in ssh_config.5 manpage 
- fix fatal when Local/RemoteForward is used and scp run (#153258)
- don't leak user validity when using krb5 authentication
 2005-04-04 09:37:28 +00:00
Tomáš Mráz
5de53f1782 - upgrade to 4.0p1 
- remove obsolete groups patch
 2005-03-24 12:02:37 +00:00
Elliot Lee
683f4f3371 sync 2005-03-16 21:38:56 +00:00
Nalin Dahyabhai
4f9d64ccfb rebuild so that configure can detect that krb5_init_ets is gone now 2005-02-28 23:39:06 +00:00
Tomáš Mráz
8d62bf1038 - allow password authentication when copying from remote to remote machine 
(#103364)
 2005-02-21 17:18:42 +00:00
Tomáš Mráz
d048f9204a - don't call syslog in signal handler 2005-02-21 17:07:55 +00:00
Nalin Dahyabhai
389c43143e s/RedHat 7.2/Red Hat Linux 7.2/ 2005-02-14 22:57:10 +00:00
Tomáš Mráz
504978bf94 - add spaces to messages in initscript (#138508) 2005-02-09 14:19:14 +00:00
Tomáš Mráz
4c55a53547 - enable trusted forwarding by default if X11 forwarding is required by 
user (#137685 and duplicates)
- disable protocol 1 support by default in sshd server config (#88329)
- keep the gnome-askpass dialog above others (#69131)
 2005-02-08 14:44:52 +00:00
Tomáš Mráz
5a8f6b5538 - change permissions on pam.d/sshd to 0644 
- patch initscript so it doesn't kill opened sessions if the sshd daemon
    isn't running anymore
 2005-02-04 13:25:38 +00:00
Nalin Dahyabhai
fe42506764 - remove mitm backward-compatibility patch for 3.8, clean up a reject hunk 
for
3.9 with the showpatchlevel patch as a prerequisite
 2005-02-02 23:03:55 +00:00