openssh/openssh-7.6p1-enable_PAM_by_default.patch

# HG changeset patch
# Parent  d47e806f23ad0649ef38b24e8cb9d5617e5d5d15
# force PAM in defaullt install (this was removed from upstream in 3.8p1)
# bnc#46749
# --used to be called '-pam-fix2'

diff --git a/openssh-7.6p1/sshd_config b/openssh-7.6p1/sshd_config
--- a/openssh-7.6p1/sshd_config
+++ b/openssh-7.6p1/sshd_config
@@ -75,17 +75,17 @@ AuthorizedKeysFile	.ssh/authorized_keys
 # and session processing. If this is enabled, PAM authentication will
 # be allowed through the ChallengeResponseAuthentication and
 # PasswordAuthentication.  Depending on your PAM configuration,
 # PAM authentication via ChallengeResponseAuthentication may bypass
 # the setting of "PermitRootLogin without-password".
 # If you just want the PAM account and session checks to run without
 # PAM authentication, then enable this but set PasswordAuthentication
 # and ChallengeResponseAuthentication to 'no'.
-#UsePAM no
+UsePAM yes
 
 #AllowAgentForwarding yes
 #AllowTcpForwarding yes
 #GatewayPorts no
 X11Forwarding yes
 #X11DisplayOffset 10
 #X11UseLocalhost yes
 #PermitTTY yes
Accepting request 539322 from home:pcerny:factory - upgrade to 7.6p1 see main package changelog for details - Update to vanilla 7.6p1 Most important changes (more details below): * complete removal of the ancient SSHv1 protocol * sshd(8) cannot run without privilege separation * removal of suport for arcfourm blowfish and CAST ciphers and RIPE-MD160 HMAC * refuse RSA keys shorter than 1024 bits Distilled upstream log: - OpenSSH 7.3 ---- Security * sshd(8): Mitigate a potential denial-of-service attack against the system's crypt(3) function via sshd(8). An attacker could send very long passwords that would cause excessive CPU use in crypt(3). sshd(8) now refuses to accept password authentication requests of length greater than 1024 characters. Independently reported by Tomas Kuthan (Oracle), Andres Rojas and Javier Nieto. * sshd(8): Mitigate timing differences in password authentication that could be used to discern valid from invalid account names when long passwords were sent and particular password hashing algorithms are in use on the server. CVE-2016-6210, reported by EddieEzra.Harari at verint.com * ssh(1), sshd(8): Fix observable timing weakness in the CBC padding oracle countermeasures. Reported by Jean Paul Degabriele, Kenny Paterson, Torben Hansen and Martin Albrecht. Note that CBC ciphers are disabled by default and OBS-URL: https://build.opensuse.org/request/show/539322 OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=122 2017-11-06 15:50:53 +01:00			`# HG changeset patch`
			`# Parent d47e806f23ad0649ef38b24e8cb9d5617e5d5d15`
			`# force PAM in defaullt install (this was removed from upstream in 3.8p1)`
			`# bnc#46749`
			`# --used to be called '-pam-fix2'`

			`diff --git a/openssh-7.6p1/sshd_config b/openssh-7.6p1/sshd_config`
			`--- a/openssh-7.6p1/sshd_config`
			`+++ b/openssh-7.6p1/sshd_config`
			`@@ -75,17 +75,17 @@ AuthorizedKeysFile .ssh/authorized_keys`
			`# and session processing. If this is enabled, PAM authentication will`
			`# be allowed through the ChallengeResponseAuthentication and`
			`# PasswordAuthentication. Depending on your PAM configuration,`
			`# PAM authentication via ChallengeResponseAuthentication may bypass`
			`# the setting of "PermitRootLogin without-password".`
			`# If you just want the PAM account and session checks to run without`
			`# PAM authentication, then enable this but set PasswordAuthentication`
			`# and ChallengeResponseAuthentication to 'no'.`
			`-#UsePAM no`
			`+UsePAM yes`

			`#AllowAgentForwarding yes`
			`#AllowTcpForwarding yes`
			`#GatewayPorts no`
			`X11Forwarding yes`
			`#X11DisplayOffset 10`
			`#X11UseLocalhost yes`
			`#PermitTTY yes`