Commit Graph

11 Commits

Author SHA256 Message Date
Hans Petter Jansson
03fc1a6def Accepting request 1087770 from home:alarrosa:branches:network
- Update to openssh 9.3p1
  * No changes for askpass, see main package changelog for
    details

- Update to openssh 9.3p1:
  = Security
  * ssh-add(1): when adding smartcard keys to ssh-agent(1) with the
   per-hop destination constraints (ssh-add -h ...) added in
   OpenSSH 8.9, a logic error prevented the constraints from being
   communicated to the agent. This resulted in the keys being added
   without constraints. The common cases of non-smartcard keys and
   keys without destination constraints are unaffected. This
   problem was reported by Luci Stanescu.
 * ssh(1): Portable OpenSSH provides an implementation of the
   getrrsetbyname(3) function if the standard library does not
   provide it, for use by the VerifyHostKeyDNS feature. A
   specifically crafted DNS response could cause this function to
   perform an out-of-bounds read of adjacent stack data, but this
   condition does not appear to be exploitable beyond denial-of-
   service to the ssh(1) client.
   The getrrsetbyname(3) replacement is only included if the
   system's standard library lacks this function and portable
   OpenSSH was not compiled with the ldns library (--with-ldns).
   getrrsetbyname(3) is only invoked if using VerifyHostKeyDNS to
   fetch SSHFP records. This problem was found by the Coverity
   static analyzer.
  = New features
  * ssh-keygen(1), ssh-keyscan(1): accept -Ohashalg=sha1|sha256
    when outputting SSHFP fingerprints to allow algorithm
    selection. bz3493

OBS-URL: https://build.opensuse.org/request/show/1087770
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=247
2023-05-22 19:32:26 +00:00
3fed02069e Accepting request 922068 from home:hpjansson:branches:network
- Version upgrade to 8.8p1
  * No changes for askpass, see main package changelog for
    details

- Version update to 8.8p1:
  = Security
  * sshd(8) from OpenSSH 6.2 through 8.7 failed to correctly initialise
    supplemental groups when executing an AuthorizedKeysCommand or
    AuthorizedPrincipalsCommand, where a AuthorizedKeysCommandUser or
    AuthorizedPrincipalsCommandUser directive has been set to run the
    command as a different user. Instead these commands would inherit
    the groups that sshd(8) was started with.
    Depending on system configuration, inherited groups may allow
    AuthorizedKeysCommand/AuthorizedPrincipalsCommand helper programs to
    gain unintended privilege.
    Neither AuthorizedKeysCommand nor AuthorizedPrincipalsCommand are
    enabled by default in sshd_config(5).
  = Potentially-incompatible changes
  * This release disables RSA signatures using the SHA-1 hash algorithm
    by default. This change has been made as the SHA-1 hash algorithm is
    cryptographically broken, and it is possible to create chosen-prefix
    hash collisions for <USD$50K.
    For most users, this change should be invisible and there is
    no need to replace ssh-rsa keys. OpenSSH has supported RFC8332
    RSA/SHA-256/512 signatures since release 7.2 and existing ssh-rsa keys
    will automatically use the stronger algorithm where possible.
    Incompatibility is more likely when connecting to older SSH
    implementations that have not been upgraded or have not closely tracked
    improvements in the SSH protocol. For these cases, it may be necessary
    to selectively re-enable RSA/SHA1 to allow connection and/or user
    authentication via the HostkeyAlgorithms and PubkeyAcceptedAlgorithms
    options.
  = New features
  * ssh(1): allow the ssh_config(5) CanonicalizePermittedCNAMEs
    directive to accept a "none" argument to specify the default
    behaviour.
  = Bugfixes
  * scp(1): when using the SFTP protocol, continue transferring files
    after a transfer error occurs, better matching original scp/rcp
    behaviour.
  * ssh(1): fixed a number of memory leaks in multiplexing,
  * ssh-keygen(1): avoid crash when using the -Y find-principals
    command.
  * A number of documentation and manual improvements, including
    bz#3340, PR139, PR215, PR241, PR257
- Additional changes from 8.7p1 release:
  = Potentially-incompatible changes
  * scp(1): this release changes the behaviour of remote to remote
    copies (e.g. "scp host-a:/path host-b:") to transfer through the
    local host by default. This was previously available via the -3
    flag. This mode avoids the need to expose credentials on the
    origin hop, avoids triplicate interpretation of filenames by the
    shell (by the local system, the copy origin and the destination)
    and, in conjunction with the SFTP support for scp(1) mentioned
    below, allows use of all authentication methods to the remote
    hosts (previously, only non-interactive methods could be used).
    A -R flag has been added to select the old behaviour.
  * ssh(1)/sshd(8): both the client and server are now using a
    stricter configuration file parser. The new parser uses more
    shell-like rules for quotes, space and escape characters. It is
    also more strict in rejecting configurations that include options
    lacking arguments. Previously some options (e.g. DenyUsers) could
    appear on a line with no subsequent arguments. This release will
    reject such configurations. The new parser will also reject
    configurations with unterminated quotes and multiple '='
    characters after the option name.
  * ssh(1): when using SSHFP DNS records for host key verification,
    ssh(1) will verify all matching records instead of just those
    with the specific signature type requested. This may cause host
    key verification problems if stale SSHFP records of a different
    or legacy signature type exist alongside other records for a
    particular host. bz#3322
  * ssh-keygen(1): when generating a FIDO key and specifying an
    explicit attestation challenge (using -Ochallenge), the challenge
    will now be hashed by the builtin security key middleware. This
    removes the (undocumented) requirement that challenges be exactly
    32 bytes in length and matches the expectations of libfido2.
  * sshd(8): environment="..." directives in authorized_keys files are
    now first-match-wins and limited to 1024 discrete environment
    variable names.
  = New features
  * scp(1): experimental support for transfers using the SFTP protocol
    as a replacement for the venerable SCP/RCP protocol that it has
    traditionally used. SFTP offers more predictable filename handling
    and does not require expansion of glob(3) patterns via the shell
    on the remote side.
  * sftp-server(8): add a protocol extension to support expansion of
    ~/ and ~user/ prefixed paths. This was added to support these
    paths when used by scp(1) while in SFTP mode.
  * ssh(1): add a ForkAfterAuthentication ssh_config(5) counterpart to
    the ssh(1) -f flag. GHPR231
  * ssh(1): add a StdinNull directive to ssh_config(5) that allows the
    config file to do the same thing as -n does on the ssh(1) command-
    line. GHPR231
  * ssh(1): add a SessionType directive to ssh_config, allowing the
    configuration file to offer equivalent control to the -N (no
    session) and -s (subsystem) command-line flags. GHPR231
  * ssh-keygen(1): allowed signers files used by ssh-keygen(1)
    signatures now support listing key validity intervals alongside
    they key, and ssh-keygen(1) can optionally check during signature
    verification whether a specified time falls inside this interval.
    This feature is intended for use by git to support signing and
    verifying objects using ssh keys.
  * ssh-keygen(8): support printing of the full public key in a sshsig
    signature via a -Oprint-pubkey flag.
  = Bugfixes
  * ssh(1)/sshd(8): start time-based re-keying exactly on schedule in
    the client and server mainloops. Previously the re-key timeout
    could expire but re-keying would not start until a packet was sent
    or received, causing a spin in select() if the connection was
    quiescent.
  * ssh-keygen(1): avoid Y2038 problem in printing certificate
    validity lifetimes. Dates past 2^31-1 seconds since epoch were
    displayed incorrectly on some platforms. bz#3329
  * scp(1): allow spaces to appear in usernames for local to remote
    and scp -3 remote to remote copies. bz#1164
  * ssh(1)/sshd(8): remove references to ChallengeResponseAuthentication
    in favour of KbdInteractiveAuthentication. The former is what was in
    SSHv1, the latter is what is in SSHv2 (RFC4256) and they were
    treated as somewhat but not entirely equivalent. We retain the old
    name as a deprecated alias so configuration files continue to work
    as well as a reference in the man page for people looking for it.
    bz#3303
  * ssh(1)/ssh-add(1)/ssh-keygen(1): fix decoding of X.509 subject name
    when extracting a key from a PKCS#11 certificate. bz#3327
  * ssh(1): restore blocking status on stdio fds before close. ssh(1)
    needs file descriptors in non-blocking mode to operate but it was
    not restoring the original state on exit. This could cause
    problems with fds shared with other programs via the shell,
    bz#3280 and GHPR246
  * ssh(1)/sshd(8): switch both client and server mainloops from
    select(3) to pselect(3). Avoids race conditions where a signal
    may arrive immediately before select(3) and not be processed until
    an event fires. bz#2158
  * ssh(1): sessions started with ControlPersist were incorrectly
    executing a shell when the -N (no shell) option was specified.
    bz#3290
  * ssh(1): check if IPQoS or TunnelDevice are already set before
    overriding. Prevents values in config files from overriding values
    supplied on the command line. bz#3319
  * ssh(1): fix debug message when finding a private key to match a
    certificate being attempted for user authentication. Previously it
    would print the certificate's path, whereas it was supposed to be
    showing the private key's path. GHPR247
  * sshd(8): match host certificates against host public keys, not
    private keys. Allows use of certificates with private keys held in
    a ssh-agent.  bz#3524
  * ssh(1): add a workaround for a bug in OpenSSH 7.4 sshd(8), which
    allows RSA/SHA2 signatures for public key authentication but fails
    to advertise this correctly via SSH2_MSG_EXT_INFO. This causes
    clients of these server to incorrectly match
    PubkeyAcceptedAlgorithmse and potentially refuse to offer valid
    keys. bz#3213
  * sftp(1)/scp(1): degrade gracefully if a sftp-server offers the
    limits@openssh.com extension but fails when the client tries to
    invoke it. bz#3318
  * ssh(1): allow ssh_config SetEnv to override $TERM, which is
    otherwise handled specially by the protocol. Useful in ~/.ssh/config
    to set TERM to something generic (e.g. "xterm" instead of
    "xterm-256color") for destinations that lack terminfo entries.
  * sftp-server(8): the limits@openssh.com extension was incorrectly
    marked as an operation that writes to the filesystem, which made it
    unavailable in sftp-server read-only mode. bz#3318
  * ssh(1): fix SEGV in UpdateHostkeys debug() message, triggered when
    the update removed more host keys than remain present.
  * Many manual page fixes.
- Additional changes from 8.6p1 release:
  = Security
  * sshd(8): OpenSSH 8.5 introduced the LogVerbose keyword. When this
    option was enabled with a set of patterns that activated logging
    in code that runs in the low-privilege sandboxed sshd process, the
    log messages were constructed in such a way that printf(3) format
    strings could effectively be specified the low-privilege code.
  = New features
  * sftp-server(8): add a new limits@openssh.com protocol extension
    that allows a client to discover various server limits, including
    maximum packet size and maximum read/write length.
  * sftp(1): use the new limits@openssh.com extension (when available)
    to select better transfer lengths in the client.
  * sshd(8): Add ModuliFile keyword to sshd_config to specify the
    location of the "moduli" file containing the groups for DH-GEX.
  * unit tests: Add a TEST_SSH_ELAPSED_TIMES environment variable to
    enable printing of the elapsed time in seconds of each test.
  = Bugfixes
  * ssh_config(5), sshd_config(5): sync CASignatureAlgorithms lists in
    manual pages with the current default. GHPR174
  * ssh(1): ensure that pkcs11_del_provider() is called before exit.
    GHPR234
  * ssh(1), sshd(8): fix problems in string->argv conversion. Multiple
    backslashes were not being dequoted correctly and quoted space in
    the middle of a string was being incorrectly split. GHPR223
  * ssh(1): return non-zero exit status when killed by signal; bz#3281
  * sftp-server(8): increase maximum SSH2_FXP_READ to match the maximum
    packet size. Also handle zero-length reads that are not explicitly
    banned by the spec.
- Additional changes from 8.5p1 release:
  = Security
  * ssh-agent(1): fixed a double-free memory corruption that was
    introduced in OpenSSH 8.2 . We treat all such memory faults as
    potentially exploitable. This bug could be reached by an attacker
    with access to the agent socket.
  = Potentially-incompatible changes
  * ssh(1), sshd(8): this release changes the first-preference signature
    algorithm from ECDSA to ED25519.
  * ssh(1), sshd(8): set the TOS/DSCP specified in the configuration
    for interactive use prior to TCP connect. The connection phase of
    the SSH session is time-sensitive and often explicitly interactive.
    The ultimate interactive/bulk TOS/DSCP will be set after
    authentication completes.
  * ssh(1), sshd(8): remove the pre-standardization cipher
    rijndael-cbc@lysator.liu.se. It is an alias for aes256-cbc before
    it was standardized in RFC4253 (2006), has been deprecated and
    disabled by default since OpenSSH 7.2 (2016) and was only briefly
    documented in ssh.1 in 2001.
  * ssh(1), sshd(8): update/replace the experimental post-quantum
    hybrid key exchange method based on Streamlined NTRU Prime coupled
    with X25519. The previous sntrup4591761x25519-sha512@tinyssh.org
    method is replaced with sntrup761x25519-sha512@openssh.com.
  * ssh(1): disable CheckHostIP by default. It provides insignificant
    benefits while making key rotation significantly more difficult,
    especially for hosts behind IP-based load-balancers.
  = New features
  * ssh(1): this release enables UpdateHostkeys by default subject to
    some conservative preconditions:
    - The key was matched in the UserKnownHostsFile (and not in the
      GlobalKnownHostsFile).
    - The same key does not exist under another name.
    - A certificate host key is not in use.
    - known_hosts contains no matching wildcard hostname pattern.
    - VerifyHostKeyDNS is not enabled.
    - The default UserKnownHostsFile is in use.
  * ssh(1), sshd(8): add a new LogVerbose configuration directive for
    that allows forcing maximum debug logging by file/function/line
    pattern-lists.
  * ssh(1): when prompting the user to accept a new hostkey, display
    any other host names/addresses already associated with the key.
  * ssh(1): allow UserKnownHostsFile=none to indicate that no
    known_hosts file should be used to identify host keys.
  * ssh(1): add a ssh_config KnownHostsCommand option that allows the
    client to obtain known_hosts data from a command in addition to
    the usual files.
  * ssh(1): add a ssh_config PermitRemoteOpen option that allows the
    client to restrict the destination when RemoteForward is used
    with SOCKS.
  * ssh(1): for FIDO keys, if a signature operation fails with a
    "incorrect PIN" reason and no PIN was initially requested from the
    user, then request a PIN and retry the operation. This supports
    some biometric devices that fall back to requiring PIN when reading
    of the biometric failed, and devices that require PINs for all
    hosted credentials.
  * sshd(8): implement client address-based rate-limiting via new
    sshd_config(5) PerSourceMaxStartups and PerSourceNetBlockSize
    directives that provide more fine-grained control on a per-origin
    address basis than the global MaxStartups limit.
  = Bugfixes
   * ssh(1): Prefix keyboard interactive prompts with "(user@host)" to
   make it easier to determine which connection they are associated
   with in cases like scp -3, ProxyJump, etc. bz#3224
  * sshd(8): fix sshd_config SetEnv directives located inside Match
    blocks. GHPR201
  * ssh(1): when requesting a FIDO token touch on stderr, inform the
    user once the touch has been recorded.
  * ssh(1): prevent integer overflow when ridiculously large
    ConnectTimeout values are specified, capping the effective value
    (for most platforms) at 24 days. bz#3229
  * ssh(1): consider the ECDSA key subtype when ordering host key
    algorithms in the client.
  * ssh(1), sshd(8): rename the PubkeyAcceptedKeyTypes keyword to
    PubkeyAcceptedAlgorithms. The previous name incorrectly suggested
    that it control allowed key algorithms, when this option actually
    specifies the signature algorithms that are accepted. The previous
    name remains available as an alias. bz#3253
  * ssh(1), sshd(8): similarly, rename HostbasedKeyTypes (ssh) and
    HostbasedAcceptedKeyTypes (sshd) to HostbasedAcceptedAlgorithms.
  * sftp-server(8): add missing lsetstat@openssh.com documentation
    and advertisement in the server's SSH2_FXP_VERSION hello packet.
  * ssh(1), sshd(8): more strictly enforce KEX state-machine by
    banning packet types once they are received. Fixes memleak caused
    by duplicate SSH2_MSG_KEX_DH_GEX_REQUEST (oss-fuzz #30078).
  * sftp(1): allow the full range of UIDs/GIDs for chown/chgrp on 32bit
    platforms instead of being limited by LONG_MAX. bz#3206
  * Minor man page fixes (capitalization, commas, etc.) bz#3223
  * sftp(1): when doing an sftp recursive upload or download of a
    read-only directory, ensure that the directory is created with
    write and execute permissions in the interim so that the transfer
    can actually complete, then set the directory permission as the
    final step. bz#3222
  * ssh-keygen(1): document the -Z, check the validity of its argument
    earlier and provide a better error message if it's not correct.
    bz#2879
  * ssh(1): ignore comments at the end of config lines in ssh_config,
    similar to what we already do for sshd_config. bz#2320
  * sshd_config(5): mention that DisableForwarding is valid in a
    sshd_config Match block. bz3239
  * sftp(1): fix incorrect sorting of "ls -ltr" under some
    circumstances. bz3248.
  * ssh(1), sshd(8): fix potential integer truncation of (unlikely)
    timeout values. bz#3250
  * ssh(1): make hostbased authentication send the signature algorithm
    in its SSH2_MSG_USERAUTH_REQUEST packets instead of the key type.
    This make HostbasedAcceptedAlgorithms do what it is supposed to -
    filter on signature algorithm and not key type.
- Rebased patches:
  * openssh-7.7p1-IPv6_X_forwarding.patch
  * openssh-7.7p1-X11_trusted_forwarding.patch
  * openssh-7.7p1-X_forward_with_disabled_ipv6.patch
  * openssh-7.7p1-cavstest-ctr.patch
  * openssh-7.7p1-cavstest-kdf.patch
  * openssh-7.7p1-disable_openssl_abi_check.patch
  * openssh-7.7p1-eal3.patch
  * openssh-7.7p1-enable_PAM_by_default.patch
  * openssh-7.7p1-fips.patch
  * openssh-7.7p1-fips_checks.patch
  * openssh-7.7p1-host_ident.patch
  * openssh-7.7p1-hostname_changes_when_forwarding_X.patch
  * openssh-7.7p1-ldap.patch
  * openssh-7.7p1-no_fork-no_pid_file.patch
  * openssh-7.7p1-pam_check_locks.patch
  * openssh-7.7p1-pts_names_formatting.patch
  * openssh-7.7p1-remove_xauth_cookies_on_exit.patch
  * openssh-7.7p1-seccomp_ipc_flock.patch
  * openssh-7.7p1-seccomp_stat.patch
  * openssh-7.7p1-send_locale.patch
  * openssh-7.7p1-sftp_force_permissions.patch
  * openssh-7.7p1-sftp_print_diagnostic_messages.patch
  * openssh-7.7p1-systemd-notify.patch
  * openssh-7.9p1-keygen-preserve-perms.patch
  * openssh-7.9p1-revert-new-qos-defaults.patch
  * openssh-8.0p1-gssapi-keyex.patch
  * openssh-8.1p1-audit.patch
  * openssh-8.1p1-seccomp-clock_gettime64.patch
  * openssh-8.1p1-seccomp-clock_nanosleep.patch
  * openssh-8.1p1-seccomp-clock_nanosleep_time64.patch
  * openssh-8.1p1-use-openssl-kdf.patch
  * openssh-8.4p1-vendordir.patch
  * openssh-fips-ensure-approved-moduli.patch
  * openssh-link-with-sk.patch
  * openssh-reenable-dh-group14-sha1-default.patch
  * openssh-whitelist-syscalls.patch
- Removed openssh-fix-ssh-copy-id.patch (fixed upstream).

OBS-URL: https://build.opensuse.org/request/show/922068
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=235
2021-10-07 08:06:58 +00:00
Hans Petter Jansson
6543c1a02b Accepting request 863944 from home:dirkmueller:branches:network
- update to 8.4p1:
  Security
  ========
 * ssh-agent(1): restrict ssh-agent from signing web challenges for
   FIDO/U2F keys.
 * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating
   a FIDO resident key.
 * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for
   each use. These keys may be generated using ssh-keygen using a new
   "verify-required" option. When a PIN-required key is used, the user
   will be prompted for a PIN to complete the signature operation.
  New Features
  ------------
 * sshd(8): authorized_keys now supports a new "verify-required"
   option to require FIDO signatures assert that the token verified
   that the user was present before making the signature. The FIDO
   protocol supports multiple methods for user-verification, but
   currently OpenSSH only supports PIN verification.
 * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn
   signatures. Webauthn is a standard for using FIDO keys in web
   browsers. These signatures are a slightly different format to plain
   FIDO signatures and thus require explicit support.
 * ssh(1): allow some keywords to expand shell-style ${ENV}
   environment variables. The supported keywords are CertificateFile,
   ControlPath, IdentityAgent and IdentityFile, plus LocalForward and
   RemoteForward when used for Unix domain socket paths. bz#3140
 * ssh(1), ssh-agent(1): allow some additional control over the use of
   ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable,
   including forcibly enabling and disabling its use. bz#69
 * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time

OBS-URL: https://build.opensuse.org/request/show/863944
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=222
2021-01-18 01:12:55 +00:00
dbcbd30908 Accepting request 811897 from home:hpjansson:openssh-8.3
- Version update to 8.3p1:
  = Potentially-incompatible changes
  * sftp(1): reject an argument of "-1" in the same way as ssh(1) and
    scp(1) do instead of accepting and silently ignoring it.
  = New features
  * sshd(8): make IgnoreRhosts a tri-state option: "yes" to ignore
    rhosts/shosts, "no" allow rhosts/shosts or (new) "shosts-only"
    to allow .shosts files but not .rhosts.
  * sshd(8): allow the IgnoreRhosts directive to appear anywhere in a
    sshd_config, not just before any Match blocks.
  * ssh(1): add %TOKEN percent expansion for the LocalFoward and
    RemoteForward keywords when used for Unix domain socket forwarding.
  * all: allow loading public keys from the unencrypted envelope of a
    private key file if no corresponding public key file is present.
  * ssh(1), sshd(8): prefer to use chacha20 from libcrypto where
    possible instead of the (slower) portable C implementation included
    in OpenSSH.
  * ssh-keygen(1): add ability to dump the contents of a binary key
    revocation list via "ssh-keygen -lQf /path".
- Additional changes from 8.2p1 release:
  = Potentially-incompatible changes
  * ssh(1), sshd(8), ssh-keygen(1): this release removes the "ssh-rsa"
    (RSA/SHA1) algorithm from those accepted for certificate signatures
    (i.e. the client and server CASignatureAlgorithms option) and will
    use the rsa-sha2-512 signature algorithm by default when the
    ssh-keygen(1) CA signs new certificates.
  * ssh(1), sshd(8): this release removes diffie-hellman-group14-sha1
    from the default key exchange proposal for both the client and
    server.
  * ssh-keygen(1): the command-line options related to the generation

OBS-URL: https://build.opensuse.org/request/show/811897
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=211
2020-06-06 06:49:00 +00:00
Tomáš Chvátal
318211936a Accepting request 737034 from home:hpjansson:branches:network
Version update to 8.1p1:
  * ssh-keygen(1): when acting as a CA and signing certificates with
    an RSA key, default to using the rsa-sha2-512 signature algorithm.
    Certificates signed by RSA keys will therefore be incompatible
    with OpenSSH versions prior to 7.2 unless the default is
    overridden (using "ssh-keygen -t ssh-rsa -s ...").
  * ssh(1): Allow %n to be expanded in ProxyCommand strings
  * ssh(1), sshd(8): Allow prepending a list of algorithms to the
    default set by starting the list with the '^' character, E.g.
    "HostKeyAlgorithms ^ssh-ed25519"
  * ssh-keygen(1): add an experimental lightweight signature and
    verification ability. Signatures may be made using regular ssh keys
    held on disk or stored in a ssh-agent and verified against an
    authorized_keys-like list of allowed keys. Signatures embed a
    namespace that prevents confusion and attacks between different
    usage domains (e.g. files vs email).
  * ssh-keygen(1): print key comment when extracting public key from a
    private key.
  * ssh-keygen(1): accept the verbose flag when searching for host keys
    in known hosts (i.e. "ssh-keygen -vF host") to print the matching
    host's random-art signature too.
  * All: support PKCS8 as an optional format for storage of private
    keys to disk.  The OpenSSH native key format remains the default,
    but PKCS8 is a superior format to PEM if interoperability with
    non-OpenSSH software is required, as it may use a less insecure
    key derivation function than PEM's.
- Additional changes from 8.0p1 release:
  * scp(1): Add "-T" flag to disable client-side filtering of
    server file list.
  * sshd(8): Remove support for obsolete "host/port" syntax.

OBS-URL: https://build.opensuse.org/request/show/737034
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=197
2019-10-10 13:32:50 +00:00
Vítězslav Čížek
8ca4d6f6f4 Accepting request 684353 from home:vitezslav_cizek:branches:network
- Minor clean-up of the fips patches, modified
  openssh-7.7p1-fips.patch
  openssh-7.7p1-fips_checks.patch

OBS-URL: https://build.opensuse.org/request/show/684353
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=185
2019-03-12 15:19:34 +00:00
Tomáš Chvátal
3f73bd9831 Accepting request 680202 from home:vitezslav_cizek:branches:network
- Correctly filter out non-compliant algorithms when in FIPS mode
  (bsc#1126397)
  * A hunk was applied to a wrong place due to a patch fuzz when
    the fips patch was being ported to openssh 7.9p1
- update openssh-7.7p1-fips.patch

OBS-URL: https://build.opensuse.org/request/show/680202
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=182
2019-02-28 20:03:36 +00:00
Tomáš Chvátal
5fcc01190a Accepting request 679869 from home:vitezslav_cizek:branches:network
- Remove the "KexDHMin" config keyword (bsc#1127180)
  It used to allow lowering of the minimal allowed DH group size,
  which was increased to 2048 by upstream in the light of the Logjam
  attack.
  The code was broken since the upgrade to 7.6p1, but nobody noticed.
  As apparently no one needs the functionality any more, let's drop
  the patch.
  It's still possible to use the fixed 1024-bit diffie-hellman-group1-sha1
  key exchange method when working with legacy systems.
- drop openssh-7.7p1-disable_short_DH_parameters.patch
- updated patches:
  openssh-7.7p1-fips.patch
  openssh-7.7p1-fips_checks.patch
  openssh-7.7p1-gssapi_key_exchange.patch

OBS-URL: https://build.opensuse.org/request/show/679869
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=181
2019-02-27 15:39:11 +00:00
Tomáš Chvátal
5f87526504 Accepting request 644397 from home:pmonrealgonzalez:branches:network
* openssh-7.7p1-cavstest-ctr.patch
  * openssh-7.7p1-ldap.patch

OBS-URL: https://build.opensuse.org/request/show/644397
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=161
2018-10-24 17:58:38 +00:00
Tomáš Chvátal
b21be4c6b4 Accepting request 643660 from home:pmonrealgonzalez:branches:network
- Version update to 7.9p1
  * No actual changes for the askpass
  * See main package changelog for details

- Version update to 7.9p1
  * ssh(1), sshd(8): the setting of the new CASignatureAlgorithms
    option (see below) bans the use of DSA keys as certificate
    authorities.
  * sshd(8): the authentication success/failure log message has
    changed format slightly. It now includes the certificate
    fingerprint (previously it included only key ID and CA key
    fingerprint).
  * ssh(1), sshd(8): allow most port numbers to be specified using
    service names from getservbyname(3) (typically /etc/services).
  * sshd(8): support signalling sessions via the SSH protocol.
    A limited subset of signals is supported and only for login or
    command sessions (i.e. not subsystems) that were not subject to
    a forced command via authorized_keys or sshd_config. bz#1424
  * ssh(1): support "ssh -Q sig" to list supported signature options.
    Also "ssh -Q help" to show the full set of supported queries.
  * ssh(1), sshd(8): add a CASignatureAlgorithms option for the
    client and server configs to allow control over which signature
    formats are allowed for CAs to sign certificates. For example,
    this allows banning CAs that sign certificates using the RSA-SHA1
    signature algorithm.
  * sshd(8), ssh-keygen(1): allow key revocation lists (KRLs) to
    revoke keys specified by SHA256 hash.
  * ssh-keygen(1): allow creation of key revocation lists directly
    from base64-encoded SHA256 fingerprints. This supports revoking
    keys using only the information contained in sshd(8)

OBS-URL: https://build.opensuse.org/request/show/643660
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=159
2018-10-22 09:08:19 +00:00
Tomáš Chvátal
7bccbbd821 Accepting request 642573 from home:scarabeus_iv:branches:network
- Update to 7.8p1:
  * no actual changes for the askpass
- Format with spec-cleaner
- Respect cflags
- Use gtk3 rather than gtk2 which is being phased out

- Remove the mention of the SLE12 in the README.SUSE
- Install firewall rules only when really needed (<SLE15)

- Version update to 7.8p1:
  * For most details see release notes file
  * ssh-keygen(1): write OpenSSH format private keys by default
    instead of using OpenSSL's PEM format
- Rebase patches to apply on 7.8p1 release:
  * openssh-7.7p1-fips.patch
  * openssh-7.7p1-cavstest-kdf.patch
  * openssh-7.7p1-fips_checks.patch
  * openssh-7.7p1-gssapi_key_exchange.patch
  * openssh-7.7p1-audit.patch
  * openssh-7.7p1-openssl_1.1.0.patch
  * openssh-7.7p1-ldap.patch
  * openssh-7.7p1-IPv6_X_forwarding.patch
  * openssh-7.7p1-sftp_print_diagnostic_messages.patch
  * openssh-7.7p1-disable_short_DH_parameters.patch
  * openssh-7.7p1-hostname_changes_when_forwarding_X.patch
  * openssh-7.7p1-pam_check_locks.patch
  * openssh-7.7p1-seed-prng.patch
  * openssh-7.7p1-systemd-notify.patch
  * openssh-7.7p1-X11_trusted_forwarding.patch
- Dropped patches:

OBS-URL: https://build.opensuse.org/request/show/642573
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=153
2018-10-17 08:57:56 +00:00