Commit Graph

178 Commits

Author SHA256 Message Date
Hans Petter Jansson
916f9ab5d2 Accepting request 849311 from home:hpjansson:branches:network
- Fix build breakage caused by missing security key objects:
  + Modify openssh-7.7p1-cavstest-ctr.patch.
  + Modify openssh-7.7p1-cavstest-kdf.patch.
  + Add openssh-link-with-sk.patch.

- Add openssh-fips-ensure-approved-moduli.patch (bsc#1177939).
  This ensures only approved DH parameters are used in FIPS mode.

- Add openssh-8.1p1-ed25519-use-openssl-rng.patch (bsc#1173799).
  This uses OpenSSL's RAND_bytes() directly instead of the internal
  ChaCha20-based implementation to obtain random bytes for Ed25519
  curve computations. This is required for FIPS compliance.

OBS-URL: https://build.opensuse.org/request/show/849311
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=219
2020-11-22 16:59:16 +00:00
Hans Petter Jansson
f0e7b033d5 Accepting request 840337 from home:hpjansson:sle-14821
- Work around %service_add_post disabling sshd on upgrade with
  package name change (bsc#1177039).

- Use of DISABLE_RESTART_ON_UPDATE is deprecated.
  Replace it with %service_del_postun_without_restart

OBS-URL: https://build.opensuse.org/request/show/840337
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=218
2020-10-15 14:25:21 +00:00
Hans Petter Jansson
633a41eb24 Accepting request 837497 from home:dimstar:Factory
- Fix fillup-template usage:
  + %post server needs to reference ssh (not sshd), which matches
    the sysconfig.ssh file name the package ships.
  + %post client does not need any fillup_ calls, as there is no
    client-relevant sysconfig file present. The naming of the
    sysconfig file (ssh instead of sshd) is unfortunate.

OBS-URL: https://build.opensuse.org/request/show/837497
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=215
2020-09-25 19:42:09 +00:00
Hans Petter Jansson
bda5168147 Accepting request 835301 from home:jengelh:branches:network
(re)based onto//includes 835039


- Move some Requires to the right subpackage.

OBS-URL: https://build.opensuse.org/request/show/835301
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=214
2020-09-18 17:44:52 +00:00
c5fddd4115 Accepting request 833579 from home:hpjansson:sle-14821
- Split openssh package into openssh, openssh-server and
  openssh-clients. This allows for the ssh clients to be installed
  without the server component (bsc#1176434).

- Supplement openssh-clients instead of openssh (bsc#1176434).

OBS-URL: https://build.opensuse.org/request/show/833579
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=213
2020-09-14 10:47:29 +00:00
dbcbd30908 Accepting request 811897 from home:hpjansson:openssh-8.3
- Version update to 8.3p1:
  = Potentially-incompatible changes
  * sftp(1): reject an argument of "-1" in the same way as ssh(1) and
    scp(1) do instead of accepting and silently ignoring it.
  = New features
  * sshd(8): make IgnoreRhosts a tri-state option: "yes" to ignore
    rhosts/shosts, "no" allow rhosts/shosts or (new) "shosts-only"
    to allow .shosts files but not .rhosts.
  * sshd(8): allow the IgnoreRhosts directive to appear anywhere in a
    sshd_config, not just before any Match blocks.
  * ssh(1): add %TOKEN percent expansion for the LocalFoward and
    RemoteForward keywords when used for Unix domain socket forwarding.
  * all: allow loading public keys from the unencrypted envelope of a
    private key file if no corresponding public key file is present.
  * ssh(1), sshd(8): prefer to use chacha20 from libcrypto where
    possible instead of the (slower) portable C implementation included
    in OpenSSH.
  * ssh-keygen(1): add ability to dump the contents of a binary key
    revocation list via "ssh-keygen -lQf /path".
- Additional changes from 8.2p1 release:
  = Potentially-incompatible changes
  * ssh(1), sshd(8), ssh-keygen(1): this release removes the "ssh-rsa"
    (RSA/SHA1) algorithm from those accepted for certificate signatures
    (i.e. the client and server CASignatureAlgorithms option) and will
    use the rsa-sha2-512 signature algorithm by default when the
    ssh-keygen(1) CA signs new certificates.
  * ssh(1), sshd(8): this release removes diffie-hellman-group14-sha1
    from the default key exchange proposal for both the client and
    server.
  * ssh-keygen(1): the command-line options related to the generation

OBS-URL: https://build.opensuse.org/request/show/811897
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=211
2020-06-06 06:49:00 +00:00
Vítězslav Čížek
059b14422b Accepting request 810465 from home:AndreasStieger:branches:network
- add upstream signing key to actually verify source signature

OBS-URL: https://build.opensuse.org/request/show/810465
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=209
2020-06-03 13:03:53 +00:00
Tomáš Chvátal
9a4705bd68 Accepting request 780330 from home:lnussel:branches:network
- Don't recommend xauth to avoid pulling in X.

OBS-URL: https://build.opensuse.org/request/show/780330
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=207
2020-02-29 10:06:47 +00:00
Vítězslav Čížek
7fc5bd5b80 Add missing piece of changelog:
- Add openssh-7.9p1-keygen-preserve-perms.patch (bsc#1150574).
  This attempts to preserve the permissions of any existing
  known_hosts file when modified by ssh-keygen (for instance,
  with -R).

OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=206
2020-02-28 12:29:57 +00:00
Vítězslav Čížek
302f567739 Accepting request 779739 from home:hpjansson:branches:network
Add openssh-8.1p1-use-openssl-kdf.patch (jsc#SLE-9443). This
  performs key derivation using OpenSSL's SSHKDF facility, which
  allows OpenSSH to benefit from the former's FIPS certification
  status.

Make sure ssh-keygen runs if SSHD_AUTO_KEYGEN variable is unset
  or contains an unrecognized value (bsc#1157176).

OBS-URL: https://build.opensuse.org/request/show/779739
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=205
2020-02-28 12:19:42 +00:00
Dominique Leuenberger
b71bd2f41b Accepting request 775237 from home:favogt:branches:network
- Add patches to fix the sandbox blocking glibc on 32bit platforms
  (boo#1164061):
  * openssh-8.1p1-seccomp-clock_nanosleep_time64.patch
  * openssh-8.1p1-seccomp-clock_gettime64.patch

OBS-URL: https://build.opensuse.org/request/show/775237
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=203
2020-02-18 15:10:09 +00:00
Tomáš Chvátal
2d48f44a64 Accepting request 746672 from home:elvigia:branches:network
- Add openssh-8.1p1-seccomp-clock_nanosleep.patch, allow clock_nanosleep
  glibc master implements multiple functions using that syscall making
  the privsep sandbox kill the preauth process.

OBS-URL: https://build.opensuse.org/request/show/746672
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=201
2019-11-14 15:26:26 +00:00
Tomáš Chvátal
5c5997059e - Add patch from upstream openssh-7.9p1-revert-new-qos-defaults.patch
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=199
2019-10-15 08:09:16 +00:00
Tomáš Chvátal
fbcab3da0e Accepting request 738490 from home:hpjansson:branches:network
Add openssh-7.9p1-keygen-preserve-perms.patch (bsc#1150574).
This attempts to preserve the permissions of any existing
known_hosts file when modified by ssh-keygen (for instance,
with -R).

Run 'ssh-keygen -A' on startup only if SSHD_AUTO_KEYGEN="yes"
in /etc/sysconfig/ssh. This is set to "yes" by default, but
can be changed by the system administrator (bsc#1139089).

Add openssh-7.9p1-keygen-preserve-perms.patch (bsc#1150574).
This attempts to preserve the permissions of any existing
known_hosts file when modified by ssh-keygen (for instance,
with -R).

OBS-URL: https://build.opensuse.org/request/show/738490
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=198
2019-10-15 07:47:08 +00:00
Tomáš Chvátal
318211936a Accepting request 737034 from home:hpjansson:branches:network
Version update to 8.1p1:
  * ssh-keygen(1): when acting as a CA and signing certificates with
    an RSA key, default to using the rsa-sha2-512 signature algorithm.
    Certificates signed by RSA keys will therefore be incompatible
    with OpenSSH versions prior to 7.2 unless the default is
    overridden (using "ssh-keygen -t ssh-rsa -s ...").
  * ssh(1): Allow %n to be expanded in ProxyCommand strings
  * ssh(1), sshd(8): Allow prepending a list of algorithms to the
    default set by starting the list with the '^' character, E.g.
    "HostKeyAlgorithms ^ssh-ed25519"
  * ssh-keygen(1): add an experimental lightweight signature and
    verification ability. Signatures may be made using regular ssh keys
    held on disk or stored in a ssh-agent and verified against an
    authorized_keys-like list of allowed keys. Signatures embed a
    namespace that prevents confusion and attacks between different
    usage domains (e.g. files vs email).
  * ssh-keygen(1): print key comment when extracting public key from a
    private key.
  * ssh-keygen(1): accept the verbose flag when searching for host keys
    in known hosts (i.e. "ssh-keygen -vF host") to print the matching
    host's random-art signature too.
  * All: support PKCS8 as an optional format for storage of private
    keys to disk.  The OpenSSH native key format remains the default,
    but PKCS8 is a superior format to PEM if interoperability with
    non-OpenSSH software is required, as it may use a less insecure
    key derivation function than PEM's.
- Additional changes from 8.0p1 release:
  * scp(1): Add "-T" flag to disable client-side filtering of
    server file list.
  * sshd(8): Remove support for obsolete "host/port" syntax.

OBS-URL: https://build.opensuse.org/request/show/737034
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=197
2019-10-10 13:32:50 +00:00
Tomáš Chvátal
9a25e259e6 Accepting request 724531 from home:kukuk:branches:network
- don't install SuSEfirewall2 service on Factory, since SuSEfirewall2
  has been replaced by firewalld, see [1].
  [1]: https://lists.opensuse.org/opensuse-factory/2019-01/msg00490.html

OBS-URL: https://build.opensuse.org/request/show/724531
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=195
2019-08-19 09:45:46 +00:00
Hans Petter Jansson
084c35400e Accepting request 717662 from home:Vogtinator:branches:network
- ssh-askpass: Try a fallback if the other option is not available

OBS-URL: https://build.opensuse.org/request/show/717662
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=192
2019-07-22 18:28:13 +00:00
Tomáš Chvátal
a0c02d63e8 Accepting request 706687 from home:vitezslav_cizek:branches:network
- Fix a crash with GSSAPI key exchange (bsc#1136104)
  * modify openssh-7.7p1-gssapi_key_exchange.patch

OBS-URL: https://build.opensuse.org/request/show/706687
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=189
2019-05-31 18:07:22 +00:00
Vítězslav Čížek
bd816c8da4 Accepting request 689347 from home:vitezslav_cizek:branches:network
- Fix a double free() in the KDF CAVS testing tool (bsc#1065237)
  * modify openssh-7.7p1-cavstest-kdf.patch

OBS-URL: https://build.opensuse.org/request/show/689347
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=187
2019-03-28 13:07:24 +00:00
Vítězslav Čížek
8ca4d6f6f4 Accepting request 684353 from home:vitezslav_cizek:branches:network
- Minor clean-up of the fips patches, modified
  openssh-7.7p1-fips.patch
  openssh-7.7p1-fips_checks.patch

OBS-URL: https://build.opensuse.org/request/show/684353
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=185
2019-03-12 15:19:34 +00:00
Vítězslav Čížek
d9fe580505 Accepting request 684224 from home:vitezslav_cizek:branches:network
- Fix two race conditions in sshd relating to SIGHUP (bsc#1119183)
  * 0001-upstream-Fix-two-race-conditions-in-sshd-relating-to.patch

OBS-URL: https://build.opensuse.org/request/show/684224
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=184
2019-03-12 10:22:15 +00:00
Tomáš Chvátal
3f73bd9831 Accepting request 680202 from home:vitezslav_cizek:branches:network
- Correctly filter out non-compliant algorithms when in FIPS mode
  (bsc#1126397)
  * A hunk was applied to a wrong place due to a patch fuzz when
    the fips patch was being ported to openssh 7.9p1
- update openssh-7.7p1-fips.patch

OBS-URL: https://build.opensuse.org/request/show/680202
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=182
2019-02-28 20:03:36 +00:00
Tomáš Chvátal
5fcc01190a Accepting request 679869 from home:vitezslav_cizek:branches:network
- Remove the "KexDHMin" config keyword (bsc#1127180)
  It used to allow lowering of the minimal allowed DH group size,
  which was increased to 2048 by upstream in the light of the Logjam
  attack.
  The code was broken since the upgrade to 7.6p1, but nobody noticed.
  As apparently no one needs the functionality any more, let's drop
  the patch.
  It's still possible to use the fixed 1024-bit diffie-hellman-group1-sha1
  key exchange method when working with legacy systems.
- drop openssh-7.7p1-disable_short_DH_parameters.patch
- updated patches:
  openssh-7.7p1-fips.patch
  openssh-7.7p1-fips_checks.patch
  openssh-7.7p1-gssapi_key_exchange.patch

OBS-URL: https://build.opensuse.org/request/show/679869
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=181
2019-02-27 15:39:11 +00:00
Tomáš Chvátal
afefdefb8a * openssh-7.9p1-brace-expansion.patch
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=179
2019-02-19 08:19:52 +00:00
Tomáš Chvátal
adae0f9df2 Accepting request 677200 from home:pmonrealgonzalez:branches:network
- Handle brace expansion in scp when checking that filenames sent
  by the server side match what the client requested [bsc#1125687]

OBS-URL: https://build.opensuse.org/request/show/677200
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=178
2019-02-19 08:15:17 +00:00
Tomáš Chvátal
e882225f5d Accepting request 676348 from home:pmonrealgonzalez:branches:network
- Updated security fixes:
  * [bsc#1121816, CVE-2019-6109] Sanitize scp filenames via snmprintf
    and have progressmeter force an update at the beginning and end
    of each transfer. Added patches:
    - openssh-CVE-2019-6109-sanitize-scp-filenames.patch
    - openssh-CVE-2019-6109-force-progressmeter-update.patch
  * [bsc#1121821, CVE-2019-6111] Check in scp client that filenames
    sent during remote->local directory copies satisfy the wildcard
    specified by the user. Added patch:
    - openssh-CVE-2019-6111-scp-client-wildcard.patch
  * Removed openssh-7.9p1-scp-name-validator.patch

OBS-URL: https://build.opensuse.org/request/show/676348
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=177
2019-02-15 09:16:16 +00:00
Tomáš Chvátal
728923fa07 - Change the askpass wrapper to not use x11 interface:
* by default we use the -gnome UI (which is gtk3 only, no gnome dep)
  * if desktop is KDE/LxQt we use ksshaskpass

OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=175
2019-02-14 10:30:34 +00:00
Tomáš Chvátal
39cce89598 Accepting request 669019 from home:pmonrealgonzalez:branches:network
- Remove old conditionals

  * Mention the change in README.SUSE

OBS-URL: https://build.opensuse.org/request/show/669019
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=173
2019-01-28 10:41:40 +00:00
Tomáš Chvátal
ed403ddfcd Accepting request 668656 from home:pmonrealgonzalez:branches:network
- Move ssh-ldap* man pages into openssh-helpers [bsc#1051531]

- Allow root login by default [bsc#1118114, bsc#1121196]
  * Added/updated previous patch openssh-7.7p1-allow_root_password_login.patch

- Added SLE conditionals in the spec files:
  * Keep gtk2-devel in openssh-askpass-gnome in SLE
  * Keep krb5-mini-devel in SLE
- Removed obsolete configure options:
  * SSH protocol 1 --with-ssh1
  * Smart card --with-opensc
- Cleaned spec file with spec-cleaner

OBS-URL: https://build.opensuse.org/request/show/668656
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=172
2019-01-28 08:02:07 +00:00
Tomáš Chvátal
be528d6e10 Accepting request 666511 from home:pmonrealgonzalez:branches:network
- Security fix:
  * [bsc#1121816, CVE-2019-6109] scp client spoofing via object name
  * [bsc#1121818, CVE-2019-6110] scp client spoofing via stderr
  * [bsc#1121821, CVE-2019-6111] scp client missing received object
    name validation
  * Added patch openssh-7.9p1-scp-name-validator.patch

OBS-URL: https://build.opensuse.org/request/show/666511
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=170
2019-01-17 08:11:36 +00:00
Tomáš Chvátal
a485b7f4e0 Accepting request 664725 from home:pmonrealgonzalez:branches:network
- Security fix: [bsc#1121571, CVE-2018-20685]
  * The scp client allows remote SSH servers to bypass intended
    access restrictions
  * Added patch openssh-7.9p1-CVE-2018-20685.patch

OBS-URL: https://build.opensuse.org/request/show/664725
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=169
2019-01-11 17:55:43 +00:00
Tomáš Chvátal
518034998f Accepting request 662676 from home:pmonrealgonzalez:branches:network
- Added compatibility with SuSEfirewall2 [bsc#1118044]

OBS-URL: https://build.opensuse.org/request/show/662676
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=167
2019-01-04 06:19:36 +00:00
Tomáš Chvátal
cf45c4e386 Accepting request 657258 from home:pmonrealgonzalez:branches:network
- Update the firewall rules in Tumbleweed

OBS-URL: https://build.opensuse.org/request/show/657258
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=165
2018-12-11 16:01:09 +00:00
Tomáš Chvátal
c41fcd05a7 Accepting request 651986 from home:vitezslav_cizek:branches:network
- Fix build with openssl < 1.1.0
  * add openssh-openssl-1_0_0-compatibility.patch

OBS-URL: https://build.opensuse.org/request/show/651986
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=163
2018-11-26 14:06:38 +00:00
Tomáš Chvátal
81347795a3 Accepting request 645609 from home:elvigia:branches:network
- openssh-7.7p1-audit.patch: fix sshd fatal error in 
  mm_answer_keyverify: buffer error: incomplete message [bnc#1114008]

OBS-URL: https://build.opensuse.org/request/show/645609
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=162
2018-10-31 05:45:24 +00:00
Tomáš Chvátal
5f87526504 Accepting request 644397 from home:pmonrealgonzalez:branches:network
* openssh-7.7p1-cavstest-ctr.patch
  * openssh-7.7p1-ldap.patch

OBS-URL: https://build.opensuse.org/request/show/644397
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=161
2018-10-24 17:58:38 +00:00
Tomáš Chvátal
b21be4c6b4 Accepting request 643660 from home:pmonrealgonzalez:branches:network
- Version update to 7.9p1
  * No actual changes for the askpass
  * See main package changelog for details

- Version update to 7.9p1
  * ssh(1), sshd(8): the setting of the new CASignatureAlgorithms
    option (see below) bans the use of DSA keys as certificate
    authorities.
  * sshd(8): the authentication success/failure log message has
    changed format slightly. It now includes the certificate
    fingerprint (previously it included only key ID and CA key
    fingerprint).
  * ssh(1), sshd(8): allow most port numbers to be specified using
    service names from getservbyname(3) (typically /etc/services).
  * sshd(8): support signalling sessions via the SSH protocol.
    A limited subset of signals is supported and only for login or
    command sessions (i.e. not subsystems) that were not subject to
    a forced command via authorized_keys or sshd_config. bz#1424
  * ssh(1): support "ssh -Q sig" to list supported signature options.
    Also "ssh -Q help" to show the full set of supported queries.
  * ssh(1), sshd(8): add a CASignatureAlgorithms option for the
    client and server configs to allow control over which signature
    formats are allowed for CAs to sign certificates. For example,
    this allows banning CAs that sign certificates using the RSA-SHA1
    signature algorithm.
  * sshd(8), ssh-keygen(1): allow key revocation lists (KRLs) to
    revoke keys specified by SHA256 hash.
  * ssh-keygen(1): allow creation of key revocation lists directly
    from base64-encoded SHA256 fingerprints. This supports revoking
    keys using only the information contained in sshd(8)

OBS-URL: https://build.opensuse.org/request/show/643660
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=159
2018-10-22 09:08:19 +00:00
Tomáš Chvátal
1d3b4a412f - Mention upstream bugs on multiple local patches
- Adjust service to not spam restart and reload only on fails

OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=157
2018-10-19 13:24:01 +00:00
Tomáš Chvátal
59e5b4e5de - Update openssh-7.7p1-sftp_force_permissions.patch from the
upstream bug, and mention the bug in the spec

OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=156
2018-10-19 13:12:48 +00:00
Tomáš Chvátal
704eb5c303 - Drop patch openssh-7.7p1-allow_root_password_login.patch
* There is no reason to set less secure default value, if
    users need the behaviour they can still set it up themselves
- Drop patch openssh-7.7p1-blocksigalrm.patch
  * We had a bug way in past about this but it was never reproduced
    or even confirmed in the ticket, thus rather drop the patch

OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=155
2018-10-19 08:41:04 +00:00
Tomáš Chvátal
c159d0ce66 - Disable ssh1 protocol support as neither RH or Debian enable
this protocol by default anymore either.

OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=154
2018-10-17 09:24:31 +00:00
Tomáš Chvátal
7bccbbd821 Accepting request 642573 from home:scarabeus_iv:branches:network
- Update to 7.8p1:
  * no actual changes for the askpass
- Format with spec-cleaner
- Respect cflags
- Use gtk3 rather than gtk2 which is being phased out

- Remove the mention of the SLE12 in the README.SUSE
- Install firewall rules only when really needed (<SLE15)

- Version update to 7.8p1:
  * For most details see release notes file
  * ssh-keygen(1): write OpenSSH format private keys by default
    instead of using OpenSSL's PEM format
- Rebase patches to apply on 7.8p1 release:
  * openssh-7.7p1-fips.patch
  * openssh-7.7p1-cavstest-kdf.patch
  * openssh-7.7p1-fips_checks.patch
  * openssh-7.7p1-gssapi_key_exchange.patch
  * openssh-7.7p1-audit.patch
  * openssh-7.7p1-openssl_1.1.0.patch
  * openssh-7.7p1-ldap.patch
  * openssh-7.7p1-IPv6_X_forwarding.patch
  * openssh-7.7p1-sftp_print_diagnostic_messages.patch
  * openssh-7.7p1-disable_short_DH_parameters.patch
  * openssh-7.7p1-hostname_changes_when_forwarding_X.patch
  * openssh-7.7p1-pam_check_locks.patch
  * openssh-7.7p1-seed-prng.patch
  * openssh-7.7p1-systemd-notify.patch
  * openssh-7.7p1-X11_trusted_forwarding.patch
- Dropped patches:

OBS-URL: https://build.opensuse.org/request/show/642573
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=153
2018-10-17 08:57:56 +00:00
f56a5ff67f Accepting request 636347 from home:Andreas_Schwab:Factory
- seccomp_filter sandbox is not supported on ppc

OBS-URL: https://build.opensuse.org/request/show/636347
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=151
2018-09-21 09:56:44 +00:00
Ismail Dönmez
3a2700bb0a Accepting request 631714 from home:scarabeus_iv:branches:network
- Depend explicitly on zlib-devel, previously pulled in by openssl

OBS-URL: https://build.opensuse.org/request/show/631714
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=149
2018-08-27 09:51:09 +00:00
4d4a31fec0 Accepting request 619019 from home:AndreasStieger:branches:network
- BuildRequire pkgconfig(krb5) instead of krb5-mini-devel to ensure
  zypper si can pick a resolvable provider. Build cycle remains
  solved via project config pulling in -mini. (bsc#1099044)

OBS-URL: https://build.opensuse.org/request/show/619019
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=147
2018-07-04 07:19:08 +00:00
Petr Cerny
223282b58f Accepting request 611002 from home:pcerny:factory
- Upgrade to 7.7p1 (bsc#1094068)

- Upgrade to 7.7p1 (bsc#1094068)
  Most important changes (more details below):
  * Drop compatibility support for pre-2001 SSH implementations
  * sshd(1) does not load DSA keys by default
  Distilled upstream log:
  ---- Potentially-incompatible changes
  * ssh(1)/sshd(8): Drop compatibility support for some very old
    SSH implementations, including ssh.com <=2.* and OpenSSH <=
    3.*.  These versions were all released in or before 2001 and
    predate the final SSH RFCs. The support in question isn't
    necessary for RFC-compliant SSH implementations.
  ---- New Features
  * experimental support for PQC XMSS keys (Extended Hash-Based
    Signatures), not compiled in by default.
  * sshd(8): Add a "rdomain" criteria for the sshd_config Match
    keyword to allow conditional configuration that depends on
    which routing domain a connection was received on (currently
    supported on OpenBSD and Linux).
  * sshd_config(5): Add an optional rdomain qualifier to the
    ListenAddress directive to allow listening on different
    routing domains. This is supported only on OpenBSD and Linux
    at present.
  * sshd_config(5): Add RDomain directive to allow the
    authenticated session to be placed in an explicit routing
    domain. This is only supported on OpenBSD at present.
  * sshd(8): Add "expiry-time" option for authorized_keys files
    to allow for expiring keys.
  * ssh(1): Add a BindInterface option to allow binding the

OBS-URL: https://build.opensuse.org/request/show/611002
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=145
2018-05-21 21:57:42 +00:00
Petr Cerny
5e850f6d73 Accepting request 602971 from home:dimstar:Factory
- Use TIRPC on suse_version >= 1500: sunrpc is deprecated and
  should be replaced by TIRPC.

This has several effects:
* We get RPC support back... from build log in oS:F/standard:

[   48s] checking rpc/types.h usability... no
[   48s] checking rpc/types.h presence... no
[   48s] checking for rpc/types.h... no

vs this branch:
[   50s] checking rpc/types.h usability... yes
[   50s] checking rpc/types.h presence... yes
[   50s] checking for rpc/types.h... yes

AND as a side-effect, FALSE for ldapbody.c is now defined (not the
  nicest of side-effects, but seems that ldap patch relies on RPC
  headers to be included.

So all in all: this fixes the build failures for openSUSE Tumblewee

OBS-URL: https://build.opensuse.org/request/show/602971
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=143
2018-05-02 12:05:42 +00:00
Petr Cerny
67804a0124 Accepting request 602709 from home:pcerny:factory
- additional rebased patches (bsc#1080779)
  * auditing support
  * LDAP integration
  * various distribution tweaks from SLE12 
    (X forwarding over IPv6, sftp forced permissions
     and verbose batch mode)

OBS-URL: https://build.opensuse.org/request/show/602709
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=142
2018-04-30 23:44:41 +00:00
OBS User mrdocs
731c398148 Accepting request 593522 from home:kukuk:branches:network
- Use %license instead of %doc [bsc#1082318]

OBS-URL: https://build.opensuse.org/request/show/593522
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=140
2018-04-06 04:49:00 +00:00
f82cf6b5da (update tracker: bsc#1080779)
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=137
2018-03-05 16:40:33 +00:00