Commit Graph

112 Commits

Author SHA256 Message Date
6c6fb17632 Accepting request 1089432 from home:AndreasStieger:branches:network
- openssh-askpass-gnome: require only openssh-clients, not the full
  openssh (including -server), to avoid pulling in excessive
  dependencies when installing git on Gnome (boo#1211446)

OBS-URL: https://build.opensuse.org/request/show/1089432
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=248
2023-06-02 21:14:12 +00:00
Hans Petter Jansson
03fc1a6def Accepting request 1087770 from home:alarrosa:branches:network
- Update to openssh 9.3p1
  * No changes for askpass, see main package changelog for
    details

- Update to openssh 9.3p1:
  = Security
  * ssh-add(1): when adding smartcard keys to ssh-agent(1) with the
   per-hop destination constraints (ssh-add -h ...) added in
   OpenSSH 8.9, a logic error prevented the constraints from being
   communicated to the agent. This resulted in the keys being added
   without constraints. The common cases of non-smartcard keys and
   keys without destination constraints are unaffected. This
   problem was reported by Luci Stanescu.
 * ssh(1): Portable OpenSSH provides an implementation of the
   getrrsetbyname(3) function if the standard library does not
   provide it, for use by the VerifyHostKeyDNS feature. A
   specifically crafted DNS response could cause this function to
   perform an out-of-bounds read of adjacent stack data, but this
   condition does not appear to be exploitable beyond denial-of-
   service to the ssh(1) client.
   The getrrsetbyname(3) replacement is only included if the
   system's standard library lacks this function and portable
   OpenSSH was not compiled with the ldns library (--with-ldns).
   getrrsetbyname(3) is only invoked if using VerifyHostKeyDNS to
   fetch SSHFP records. This problem was found by the Coverity
   static analyzer.
  = New features
  * ssh-keygen(1), ssh-keyscan(1): accept -Ohashalg=sha1|sha256
    when outputting SSHFP fingerprints to allow algorithm
    selection. bz3493

OBS-URL: https://build.opensuse.org/request/show/1087770
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=247
2023-05-22 19:32:26 +00:00
0957114f91 Accepting request 960041 from home:hpjansson:openssh-tw
- Version update to 8.9p1:
  = Security
  * sshd(8): fix an integer overflow in the user authentication path
    that, in conjunction with other logic errors, could have yielded
    unauthenticated access under difficult to exploit conditions.
    This situation is not exploitable because of independent checks in
    the privilege separation monitor. Privilege separation has been
    enabled by default in since openssh-3.2.2 (released in 2002) and
    has been mandatory since openssh-7.5 (released in 2017). Moreover,
    portable OpenSSH has used toolchain features available in most
    modern compilers to abort on signed integer overflow since
    openssh-6.5 (released in 2014).
    Thanks to Malcolm Stagg for finding and reporting this bug.
  = Potentially-incompatible changes
  * sshd(8), portable OpenSSH only: this release removes in-built
    support for MD5-hashed passwords. If you require these on your
    system then we recommend linking against libxcrypt or similar.
  * This release modifies the FIDO security key middleware interface
    and increments SSH_SK_VERSION_MAJOR.
  = New features
  * ssh(1), sshd(8), ssh-add(1), ssh-agent(1): add a system for
    restricting forwarding and use of keys added to ssh-agent(1)
    A detailed description of the feature is available at
    https://www.openssh.com/agent-restrict.html and the protocol
    extensions are documented in the PROTOCOL and PROTOCOL.agent
    files in the source release.
  * ssh(1), sshd(8): add the sntrup761x25519-sha512@openssh.com hybrid
    ECDH/x25519 + Streamlined NTRU Prime post-quantum KEX to the
    default KEXAlgorithms list (after the ECDH methods but before the
    prime-group DH ones). The next release of OpenSSH is likely to
    make this key exchange the default method.
  * ssh-keygen(1): when downloading resident keys from a FIDO token,
    pass back the user ID that was used when the key was created and
    append it to the filename the key is written to (if it is not the
    default). Avoids keys being clobbered if the user created multiple
    resident keys with the same application string but different user
    IDs.
  * ssh-keygen(1), ssh(1), ssh-agent(1): better handling for FIDO keys
    on tokens that provide user verification (UV) on the device itself,
    including biometric keys, avoiding unnecessary PIN prompts.
  * ssh-keygen(1): add "ssh-keygen -Y match-principals" operation to
    perform matching of principals names against an allowed signers
    file. To be used towards a TOFU model for SSH signatures in git.
  * ssh-add(1), ssh-agent(1): allow pin-required FIDO keys to be added
    to ssh-agent(1). $SSH_ASKPASS will be used to request the PIN at
    authentication time.
  * ssh-keygen(1): allow selection of hash at sshsig signing time
    (either sha512 (default) or sha256).
  * ssh(1), sshd(8): read network data directly to the packet input
    buffer instead of indirectly via a small stack buffer. Provides a
    modest performance improvement.
  * ssh(1), sshd(8): read data directly to the channel input buffer,
    providing a similar modest performance improvement.
  * ssh(1): extend the PubkeyAuthentication configuration directive to
    accept yes|no|unbound|host-bound to allow control over one of the
    protocol extensions used to implement agent-restricted keys.
  = Bugfixes
  * sshd(8): document that CASignatureAlgorithms, ExposeAuthInfo and
    PubkeyAuthOptions can be used in a Match block. PR277.
  * sshd(8): fix possible string truncation when constructing paths to
    .rhosts/.shosts files with very long user home directory names.
  * ssh-keysign(1): unbreak for KEX algorithms that use SHA384/512
    exchange hashes
  * ssh(1): don't put the TTY into raw mode when SessionType=none,
    avoids ^C being unable to kill such a session. bz3360
  * scp(1): fix some corner-case bugs in SFTP-mode handling of
    ~-prefixed paths.
  * ssh(1): unbreak hostbased auth using RSA keys. Allow ssh(1) to
    select RSA keys when only RSA/SHA2 signature algorithms are
    configured (this is the default case). Previously RSA keys were
    not being considered in the default case.
  * ssh-keysign(1): make ssh-keysign use the requested signature
    algorithm and not the default for the key type. Part of unbreaking
    hostbased auth for RSA/SHA2 keys.
  * ssh(1): stricter UpdateHostkey signature verification logic on
    the client- side. Require RSA/SHA2 signatures for RSA hostkeys
    except when RSA/SHA1 was explicitly negotiated during initial
    KEX; bz3375
  * ssh(1), sshd(8): fix signature algorithm selection logic for
    UpdateHostkeys on the server side. The previous code tried to
    prefer RSA/SHA2 for hostkey proofs of RSA keys, but missed some
    cases. This will use RSA/SHA2 signatures for RSA keys if the
    client proposed these algorithms in initial KEX. bz3375
  * All: convert all uses of select(2)/pselect(2) to poll(2)/ppoll(2).
    This includes the mainloops in ssh(1), ssh-agent(1), ssh-agent(1)
    and sftp-server(8), as well as the sshd(8) listen loop and all
    other FD read/writability checks. On platforms with missing or
    broken poll(2)/ppoll(2) syscalls a select(2)-based compat shim is
    available.
  * ssh-keygen(1): the "-Y find-principals" command was verifying key
    validity when using ca certs but not with simple key lifetimes
    within the allowed signers file.
  * ssh-keygen(1): make sshsig verify-time argument parsing optional
  * sshd(8): fix truncation in rhosts/shosts path construction.
  * ssh(1), ssh-agent(1): avoid xmalloc(0) for PKCS#11 keyid for ECDSA
    keys (we already did this for RSA keys). Avoids fatal errors for
    PKCS#11 libraries that return empty keyid, e.g. Microchip ATECC608B
    "cryptoauthlib"; bz#3364
  * ssh(1), ssh-agent(1): improve the testing of credentials against
    inserted FIDO: ask the token whether a particular key belongs to
    it in cases where the token supports on-token user-verification
    (e.g. biometrics) rather than just assuming that it will accept it.
    Will reduce spurious "Confirm user presence" notifications for key
    handles that relate to FIDO keys that are not currently inserted in at
    least some cases. bz3366
  * ssh(1), sshd(8): correct value for IPTOS_DSCP_LE. It needs to
    allow for the preceding two ECN bits. bz#3373
  * ssh-keygen(1): add missing -O option to usage() for the "-Y sign"
    option.
  * ssh-keygen(1): fix a NULL deref when using the find-principals
    function, when matching an allowed_signers line that contains a
    namespace restriction, but no restriction specified on the
    command-line
  * ssh-agent(1): fix memleak in process_extension(); oss-fuzz
    issue #42719
  * ssh(1): suppress "Connection to xxx closed" messages when LogLevel
    is set to "error" or above. bz3378
  * ssh(1), sshd(8): use correct zlib flags when inflate(3)-ing
    compressed packet data. bz3372
  * scp(1): when recursively transferring files in SFTP mode, create the
    destination directory if it doesn't already exist to match scp(1) in
    legacy RCP mode behaviour.
  * scp(1): many improvements in error message consistency between scp(1)
    in SFTP mode vs legacy RCP mode.
  * sshd(8): fix potential race in SIGTERM handling PR289
  * ssh(1), ssh(8): since DSA keys are deprecated, move them to the
    end of the default list of public keys so that they will be tried
    last. PR295
  * ssh-keygen(1): allow 'ssh-keygen -Y find-principals' to match
    wildcard principals in allowed_signers files
  = Portability
  * ssh(1), sshd(8): don't trust closefrom(2) on Linux. glibc's
    implementation does not work in a chroot when the kernel does not
    have close_range(2). It tries to read from /proc/self/fd and when
    that fails dies with an assertion of sorts. Instead, call
    close_range(2) directly from our compat code and fall back if
    that fails.  bz#3349,
  * OS X poll(2) is broken; use compat replacement. For character-
    special devices like /dev/null, Darwin's poll(2) returns POLLNVAL
    when polled with POLLIN. Apparently this is Apple bug 3710161 -
    not public but a websearch will find other OSS projects
    rediscovering it periodically since it was first identified in
    2005.
  * Correct handling of exceptfds/POLLPRI in our select(2)-based
    poll(2)/ppoll(2) compat implementation.
  * Cygwin: correct checking of mbstowcs() return value.
  * Add a basic SECURITY.md that refers people to the openssh.com
    website.
  * Enable additional compiler warnings and toolchain hardening flags,
    including -Wbitwise-instead-of-logical, -Wmisleading-indentation,
    -fzero-call-used-regs and -ftrivial-auto-var-init.
  * HP/UX. Use compat getline(3) on HP-UX 10.x, where the libc version
    is not reliable.
- Rebased patches:
  * openssh-7.7p1-ldap.patch
  * openssh-8.0p1-gssapi-keyex.patch
  * openssh-8.1p1-audit.patch
  * openssh-8.4p1-vendordir.patch
  * openssh-reenable-dh-group14-sha1-default.patch

OBS-URL: https://build.opensuse.org/request/show/960041
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=237
2022-03-08 07:49:22 +00:00
3fed02069e Accepting request 922068 from home:hpjansson:branches:network
- Version upgrade to 8.8p1
  * No changes for askpass, see main package changelog for
    details

- Version update to 8.8p1:
  = Security
  * sshd(8) from OpenSSH 6.2 through 8.7 failed to correctly initialise
    supplemental groups when executing an AuthorizedKeysCommand or
    AuthorizedPrincipalsCommand, where a AuthorizedKeysCommandUser or
    AuthorizedPrincipalsCommandUser directive has been set to run the
    command as a different user. Instead these commands would inherit
    the groups that sshd(8) was started with.
    Depending on system configuration, inherited groups may allow
    AuthorizedKeysCommand/AuthorizedPrincipalsCommand helper programs to
    gain unintended privilege.
    Neither AuthorizedKeysCommand nor AuthorizedPrincipalsCommand are
    enabled by default in sshd_config(5).
  = Potentially-incompatible changes
  * This release disables RSA signatures using the SHA-1 hash algorithm
    by default. This change has been made as the SHA-1 hash algorithm is
    cryptographically broken, and it is possible to create chosen-prefix
    hash collisions for <USD$50K.
    For most users, this change should be invisible and there is
    no need to replace ssh-rsa keys. OpenSSH has supported RFC8332
    RSA/SHA-256/512 signatures since release 7.2 and existing ssh-rsa keys
    will automatically use the stronger algorithm where possible.
    Incompatibility is more likely when connecting to older SSH
    implementations that have not been upgraded or have not closely tracked
    improvements in the SSH protocol. For these cases, it may be necessary
    to selectively re-enable RSA/SHA1 to allow connection and/or user
    authentication via the HostkeyAlgorithms and PubkeyAcceptedAlgorithms
    options.
  = New features
  * ssh(1): allow the ssh_config(5) CanonicalizePermittedCNAMEs
    directive to accept a "none" argument to specify the default
    behaviour.
  = Bugfixes
  * scp(1): when using the SFTP protocol, continue transferring files
    after a transfer error occurs, better matching original scp/rcp
    behaviour.
  * ssh(1): fixed a number of memory leaks in multiplexing,
  * ssh-keygen(1): avoid crash when using the -Y find-principals
    command.
  * A number of documentation and manual improvements, including
    bz#3340, PR139, PR215, PR241, PR257
- Additional changes from 8.7p1 release:
  = Potentially-incompatible changes
  * scp(1): this release changes the behaviour of remote to remote
    copies (e.g. "scp host-a:/path host-b:") to transfer through the
    local host by default. This was previously available via the -3
    flag. This mode avoids the need to expose credentials on the
    origin hop, avoids triplicate interpretation of filenames by the
    shell (by the local system, the copy origin and the destination)
    and, in conjunction with the SFTP support for scp(1) mentioned
    below, allows use of all authentication methods to the remote
    hosts (previously, only non-interactive methods could be used).
    A -R flag has been added to select the old behaviour.
  * ssh(1)/sshd(8): both the client and server are now using a
    stricter configuration file parser. The new parser uses more
    shell-like rules for quotes, space and escape characters. It is
    also more strict in rejecting configurations that include options
    lacking arguments. Previously some options (e.g. DenyUsers) could
    appear on a line with no subsequent arguments. This release will
    reject such configurations. The new parser will also reject
    configurations with unterminated quotes and multiple '='
    characters after the option name.
  * ssh(1): when using SSHFP DNS records for host key verification,
    ssh(1) will verify all matching records instead of just those
    with the specific signature type requested. This may cause host
    key verification problems if stale SSHFP records of a different
    or legacy signature type exist alongside other records for a
    particular host. bz#3322
  * ssh-keygen(1): when generating a FIDO key and specifying an
    explicit attestation challenge (using -Ochallenge), the challenge
    will now be hashed by the builtin security key middleware. This
    removes the (undocumented) requirement that challenges be exactly
    32 bytes in length and matches the expectations of libfido2.
  * sshd(8): environment="..." directives in authorized_keys files are
    now first-match-wins and limited to 1024 discrete environment
    variable names.
  = New features
  * scp(1): experimental support for transfers using the SFTP protocol
    as a replacement for the venerable SCP/RCP protocol that it has
    traditionally used. SFTP offers more predictable filename handling
    and does not require expansion of glob(3) patterns via the shell
    on the remote side.
  * sftp-server(8): add a protocol extension to support expansion of
    ~/ and ~user/ prefixed paths. This was added to support these
    paths when used by scp(1) while in SFTP mode.
  * ssh(1): add a ForkAfterAuthentication ssh_config(5) counterpart to
    the ssh(1) -f flag. GHPR231
  * ssh(1): add a StdinNull directive to ssh_config(5) that allows the
    config file to do the same thing as -n does on the ssh(1) command-
    line. GHPR231
  * ssh(1): add a SessionType directive to ssh_config, allowing the
    configuration file to offer equivalent control to the -N (no
    session) and -s (subsystem) command-line flags. GHPR231
  * ssh-keygen(1): allowed signers files used by ssh-keygen(1)
    signatures now support listing key validity intervals alongside
    they key, and ssh-keygen(1) can optionally check during signature
    verification whether a specified time falls inside this interval.
    This feature is intended for use by git to support signing and
    verifying objects using ssh keys.
  * ssh-keygen(8): support printing of the full public key in a sshsig
    signature via a -Oprint-pubkey flag.
  = Bugfixes
  * ssh(1)/sshd(8): start time-based re-keying exactly on schedule in
    the client and server mainloops. Previously the re-key timeout
    could expire but re-keying would not start until a packet was sent
    or received, causing a spin in select() if the connection was
    quiescent.
  * ssh-keygen(1): avoid Y2038 problem in printing certificate
    validity lifetimes. Dates past 2^31-1 seconds since epoch were
    displayed incorrectly on some platforms. bz#3329
  * scp(1): allow spaces to appear in usernames for local to remote
    and scp -3 remote to remote copies. bz#1164
  * ssh(1)/sshd(8): remove references to ChallengeResponseAuthentication
    in favour of KbdInteractiveAuthentication. The former is what was in
    SSHv1, the latter is what is in SSHv2 (RFC4256) and they were
    treated as somewhat but not entirely equivalent. We retain the old
    name as a deprecated alias so configuration files continue to work
    as well as a reference in the man page for people looking for it.
    bz#3303
  * ssh(1)/ssh-add(1)/ssh-keygen(1): fix decoding of X.509 subject name
    when extracting a key from a PKCS#11 certificate. bz#3327
  * ssh(1): restore blocking status on stdio fds before close. ssh(1)
    needs file descriptors in non-blocking mode to operate but it was
    not restoring the original state on exit. This could cause
    problems with fds shared with other programs via the shell,
    bz#3280 and GHPR246
  * ssh(1)/sshd(8): switch both client and server mainloops from
    select(3) to pselect(3). Avoids race conditions where a signal
    may arrive immediately before select(3) and not be processed until
    an event fires. bz#2158
  * ssh(1): sessions started with ControlPersist were incorrectly
    executing a shell when the -N (no shell) option was specified.
    bz#3290
  * ssh(1): check if IPQoS or TunnelDevice are already set before
    overriding. Prevents values in config files from overriding values
    supplied on the command line. bz#3319
  * ssh(1): fix debug message when finding a private key to match a
    certificate being attempted for user authentication. Previously it
    would print the certificate's path, whereas it was supposed to be
    showing the private key's path. GHPR247
  * sshd(8): match host certificates against host public keys, not
    private keys. Allows use of certificates with private keys held in
    a ssh-agent.  bz#3524
  * ssh(1): add a workaround for a bug in OpenSSH 7.4 sshd(8), which
    allows RSA/SHA2 signatures for public key authentication but fails
    to advertise this correctly via SSH2_MSG_EXT_INFO. This causes
    clients of these server to incorrectly match
    PubkeyAcceptedAlgorithmse and potentially refuse to offer valid
    keys. bz#3213
  * sftp(1)/scp(1): degrade gracefully if a sftp-server offers the
    limits@openssh.com extension but fails when the client tries to
    invoke it. bz#3318
  * ssh(1): allow ssh_config SetEnv to override $TERM, which is
    otherwise handled specially by the protocol. Useful in ~/.ssh/config
    to set TERM to something generic (e.g. "xterm" instead of
    "xterm-256color") for destinations that lack terminfo entries.
  * sftp-server(8): the limits@openssh.com extension was incorrectly
    marked as an operation that writes to the filesystem, which made it
    unavailable in sftp-server read-only mode. bz#3318
  * ssh(1): fix SEGV in UpdateHostkeys debug() message, triggered when
    the update removed more host keys than remain present.
  * Many manual page fixes.
- Additional changes from 8.6p1 release:
  = Security
  * sshd(8): OpenSSH 8.5 introduced the LogVerbose keyword. When this
    option was enabled with a set of patterns that activated logging
    in code that runs in the low-privilege sandboxed sshd process, the
    log messages were constructed in such a way that printf(3) format
    strings could effectively be specified the low-privilege code.
  = New features
  * sftp-server(8): add a new limits@openssh.com protocol extension
    that allows a client to discover various server limits, including
    maximum packet size and maximum read/write length.
  * sftp(1): use the new limits@openssh.com extension (when available)
    to select better transfer lengths in the client.
  * sshd(8): Add ModuliFile keyword to sshd_config to specify the
    location of the "moduli" file containing the groups for DH-GEX.
  * unit tests: Add a TEST_SSH_ELAPSED_TIMES environment variable to
    enable printing of the elapsed time in seconds of each test.
  = Bugfixes
  * ssh_config(5), sshd_config(5): sync CASignatureAlgorithms lists in
    manual pages with the current default. GHPR174
  * ssh(1): ensure that pkcs11_del_provider() is called before exit.
    GHPR234
  * ssh(1), sshd(8): fix problems in string->argv conversion. Multiple
    backslashes were not being dequoted correctly and quoted space in
    the middle of a string was being incorrectly split. GHPR223
  * ssh(1): return non-zero exit status when killed by signal; bz#3281
  * sftp-server(8): increase maximum SSH2_FXP_READ to match the maximum
    packet size. Also handle zero-length reads that are not explicitly
    banned by the spec.
- Additional changes from 8.5p1 release:
  = Security
  * ssh-agent(1): fixed a double-free memory corruption that was
    introduced in OpenSSH 8.2 . We treat all such memory faults as
    potentially exploitable. This bug could be reached by an attacker
    with access to the agent socket.
  = Potentially-incompatible changes
  * ssh(1), sshd(8): this release changes the first-preference signature
    algorithm from ECDSA to ED25519.
  * ssh(1), sshd(8): set the TOS/DSCP specified in the configuration
    for interactive use prior to TCP connect. The connection phase of
    the SSH session is time-sensitive and often explicitly interactive.
    The ultimate interactive/bulk TOS/DSCP will be set after
    authentication completes.
  * ssh(1), sshd(8): remove the pre-standardization cipher
    rijndael-cbc@lysator.liu.se. It is an alias for aes256-cbc before
    it was standardized in RFC4253 (2006), has been deprecated and
    disabled by default since OpenSSH 7.2 (2016) and was only briefly
    documented in ssh.1 in 2001.
  * ssh(1), sshd(8): update/replace the experimental post-quantum
    hybrid key exchange method based on Streamlined NTRU Prime coupled
    with X25519. The previous sntrup4591761x25519-sha512@tinyssh.org
    method is replaced with sntrup761x25519-sha512@openssh.com.
  * ssh(1): disable CheckHostIP by default. It provides insignificant
    benefits while making key rotation significantly more difficult,
    especially for hosts behind IP-based load-balancers.
  = New features
  * ssh(1): this release enables UpdateHostkeys by default subject to
    some conservative preconditions:
    - The key was matched in the UserKnownHostsFile (and not in the
      GlobalKnownHostsFile).
    - The same key does not exist under another name.
    - A certificate host key is not in use.
    - known_hosts contains no matching wildcard hostname pattern.
    - VerifyHostKeyDNS is not enabled.
    - The default UserKnownHostsFile is in use.
  * ssh(1), sshd(8): add a new LogVerbose configuration directive for
    that allows forcing maximum debug logging by file/function/line
    pattern-lists.
  * ssh(1): when prompting the user to accept a new hostkey, display
    any other host names/addresses already associated with the key.
  * ssh(1): allow UserKnownHostsFile=none to indicate that no
    known_hosts file should be used to identify host keys.
  * ssh(1): add a ssh_config KnownHostsCommand option that allows the
    client to obtain known_hosts data from a command in addition to
    the usual files.
  * ssh(1): add a ssh_config PermitRemoteOpen option that allows the
    client to restrict the destination when RemoteForward is used
    with SOCKS.
  * ssh(1): for FIDO keys, if a signature operation fails with a
    "incorrect PIN" reason and no PIN was initially requested from the
    user, then request a PIN and retry the operation. This supports
    some biometric devices that fall back to requiring PIN when reading
    of the biometric failed, and devices that require PINs for all
    hosted credentials.
  * sshd(8): implement client address-based rate-limiting via new
    sshd_config(5) PerSourceMaxStartups and PerSourceNetBlockSize
    directives that provide more fine-grained control on a per-origin
    address basis than the global MaxStartups limit.
  = Bugfixes
   * ssh(1): Prefix keyboard interactive prompts with "(user@host)" to
   make it easier to determine which connection they are associated
   with in cases like scp -3, ProxyJump, etc. bz#3224
  * sshd(8): fix sshd_config SetEnv directives located inside Match
    blocks. GHPR201
  * ssh(1): when requesting a FIDO token touch on stderr, inform the
    user once the touch has been recorded.
  * ssh(1): prevent integer overflow when ridiculously large
    ConnectTimeout values are specified, capping the effective value
    (for most platforms) at 24 days. bz#3229
  * ssh(1): consider the ECDSA key subtype when ordering host key
    algorithms in the client.
  * ssh(1), sshd(8): rename the PubkeyAcceptedKeyTypes keyword to
    PubkeyAcceptedAlgorithms. The previous name incorrectly suggested
    that it control allowed key algorithms, when this option actually
    specifies the signature algorithms that are accepted. The previous
    name remains available as an alias. bz#3253
  * ssh(1), sshd(8): similarly, rename HostbasedKeyTypes (ssh) and
    HostbasedAcceptedKeyTypes (sshd) to HostbasedAcceptedAlgorithms.
  * sftp-server(8): add missing lsetstat@openssh.com documentation
    and advertisement in the server's SSH2_FXP_VERSION hello packet.
  * ssh(1), sshd(8): more strictly enforce KEX state-machine by
    banning packet types once they are received. Fixes memleak caused
    by duplicate SSH2_MSG_KEX_DH_GEX_REQUEST (oss-fuzz #30078).
  * sftp(1): allow the full range of UIDs/GIDs for chown/chgrp on 32bit
    platforms instead of being limited by LONG_MAX. bz#3206
  * Minor man page fixes (capitalization, commas, etc.) bz#3223
  * sftp(1): when doing an sftp recursive upload or download of a
    read-only directory, ensure that the directory is created with
    write and execute permissions in the interim so that the transfer
    can actually complete, then set the directory permission as the
    final step. bz#3222
  * ssh-keygen(1): document the -Z, check the validity of its argument
    earlier and provide a better error message if it's not correct.
    bz#2879
  * ssh(1): ignore comments at the end of config lines in ssh_config,
    similar to what we already do for sshd_config. bz#2320
  * sshd_config(5): mention that DisableForwarding is valid in a
    sshd_config Match block. bz3239
  * sftp(1): fix incorrect sorting of "ls -ltr" under some
    circumstances. bz3248.
  * ssh(1), sshd(8): fix potential integer truncation of (unlikely)
    timeout values. bz#3250
  * ssh(1): make hostbased authentication send the signature algorithm
    in its SSH2_MSG_USERAUTH_REQUEST packets instead of the key type.
    This make HostbasedAcceptedAlgorithms do what it is supposed to -
    filter on signature algorithm and not key type.
- Rebased patches:
  * openssh-7.7p1-IPv6_X_forwarding.patch
  * openssh-7.7p1-X11_trusted_forwarding.patch
  * openssh-7.7p1-X_forward_with_disabled_ipv6.patch
  * openssh-7.7p1-cavstest-ctr.patch
  * openssh-7.7p1-cavstest-kdf.patch
  * openssh-7.7p1-disable_openssl_abi_check.patch
  * openssh-7.7p1-eal3.patch
  * openssh-7.7p1-enable_PAM_by_default.patch
  * openssh-7.7p1-fips.patch
  * openssh-7.7p1-fips_checks.patch
  * openssh-7.7p1-host_ident.patch
  * openssh-7.7p1-hostname_changes_when_forwarding_X.patch
  * openssh-7.7p1-ldap.patch
  * openssh-7.7p1-no_fork-no_pid_file.patch
  * openssh-7.7p1-pam_check_locks.patch
  * openssh-7.7p1-pts_names_formatting.patch
  * openssh-7.7p1-remove_xauth_cookies_on_exit.patch
  * openssh-7.7p1-seccomp_ipc_flock.patch
  * openssh-7.7p1-seccomp_stat.patch
  * openssh-7.7p1-send_locale.patch
  * openssh-7.7p1-sftp_force_permissions.patch
  * openssh-7.7p1-sftp_print_diagnostic_messages.patch
  * openssh-7.7p1-systemd-notify.patch
  * openssh-7.9p1-keygen-preserve-perms.patch
  * openssh-7.9p1-revert-new-qos-defaults.patch
  * openssh-8.0p1-gssapi-keyex.patch
  * openssh-8.1p1-audit.patch
  * openssh-8.1p1-seccomp-clock_gettime64.patch
  * openssh-8.1p1-seccomp-clock_nanosleep.patch
  * openssh-8.1p1-seccomp-clock_nanosleep_time64.patch
  * openssh-8.1p1-use-openssl-kdf.patch
  * openssh-8.4p1-vendordir.patch
  * openssh-fips-ensure-approved-moduli.patch
  * openssh-link-with-sk.patch
  * openssh-reenable-dh-group14-sha1-default.patch
  * openssh-whitelist-syscalls.patch
- Removed openssh-fix-ssh-copy-id.patch (fixed upstream).

OBS-URL: https://build.opensuse.org/request/show/922068
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=235
2021-10-07 08:06:58 +00:00
Hans Petter Jansson
6543c1a02b Accepting request 863944 from home:dirkmueller:branches:network
- update to 8.4p1:
  Security
  ========
 * ssh-agent(1): restrict ssh-agent from signing web challenges for
   FIDO/U2F keys.
 * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating
   a FIDO resident key.
 * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for
   each use. These keys may be generated using ssh-keygen using a new
   "verify-required" option. When a PIN-required key is used, the user
   will be prompted for a PIN to complete the signature operation.
  New Features
  ------------
 * sshd(8): authorized_keys now supports a new "verify-required"
   option to require FIDO signatures assert that the token verified
   that the user was present before making the signature. The FIDO
   protocol supports multiple methods for user-verification, but
   currently OpenSSH only supports PIN verification.
 * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn
   signatures. Webauthn is a standard for using FIDO keys in web
   browsers. These signatures are a slightly different format to plain
   FIDO signatures and thus require explicit support.
 * ssh(1): allow some keywords to expand shell-style ${ENV}
   environment variables. The supported keywords are CertificateFile,
   ControlPath, IdentityAgent and IdentityFile, plus LocalForward and
   RemoteForward when used for Unix domain socket paths. bz#3140
 * ssh(1), ssh-agent(1): allow some additional control over the use of
   ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable,
   including forcibly enabling and disabling its use. bz#69
 * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time

OBS-URL: https://build.opensuse.org/request/show/863944
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=222
2021-01-18 01:12:55 +00:00
Hans Petter Jansson
bda5168147 Accepting request 835301 from home:jengelh:branches:network
(re)based onto//includes 835039


- Move some Requires to the right subpackage.

OBS-URL: https://build.opensuse.org/request/show/835301
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=214
2020-09-18 17:44:52 +00:00
c5fddd4115 Accepting request 833579 from home:hpjansson:sle-14821
- Split openssh package into openssh, openssh-server and
  openssh-clients. This allows for the ssh clients to be installed
  without the server component (bsc#1176434).

- Supplement openssh-clients instead of openssh (bsc#1176434).

OBS-URL: https://build.opensuse.org/request/show/833579
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=213
2020-09-14 10:47:29 +00:00
dbcbd30908 Accepting request 811897 from home:hpjansson:openssh-8.3
- Version update to 8.3p1:
  = Potentially-incompatible changes
  * sftp(1): reject an argument of "-1" in the same way as ssh(1) and
    scp(1) do instead of accepting and silently ignoring it.
  = New features
  * sshd(8): make IgnoreRhosts a tri-state option: "yes" to ignore
    rhosts/shosts, "no" allow rhosts/shosts or (new) "shosts-only"
    to allow .shosts files but not .rhosts.
  * sshd(8): allow the IgnoreRhosts directive to appear anywhere in a
    sshd_config, not just before any Match blocks.
  * ssh(1): add %TOKEN percent expansion for the LocalFoward and
    RemoteForward keywords when used for Unix domain socket forwarding.
  * all: allow loading public keys from the unencrypted envelope of a
    private key file if no corresponding public key file is present.
  * ssh(1), sshd(8): prefer to use chacha20 from libcrypto where
    possible instead of the (slower) portable C implementation included
    in OpenSSH.
  * ssh-keygen(1): add ability to dump the contents of a binary key
    revocation list via "ssh-keygen -lQf /path".
- Additional changes from 8.2p1 release:
  = Potentially-incompatible changes
  * ssh(1), sshd(8), ssh-keygen(1): this release removes the "ssh-rsa"
    (RSA/SHA1) algorithm from those accepted for certificate signatures
    (i.e. the client and server CASignatureAlgorithms option) and will
    use the rsa-sha2-512 signature algorithm by default when the
    ssh-keygen(1) CA signs new certificates.
  * ssh(1), sshd(8): this release removes diffie-hellman-group14-sha1
    from the default key exchange proposal for both the client and
    server.
  * ssh-keygen(1): the command-line options related to the generation

OBS-URL: https://build.opensuse.org/request/show/811897
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=211
2020-06-06 06:49:00 +00:00
Vítězslav Čížek
7fc5bd5b80 Add missing piece of changelog:
- Add openssh-7.9p1-keygen-preserve-perms.patch (bsc#1150574).
  This attempts to preserve the permissions of any existing
  known_hosts file when modified by ssh-keygen (for instance,
  with -R).

OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=206
2020-02-28 12:29:57 +00:00
Vítězslav Čížek
302f567739 Accepting request 779739 from home:hpjansson:branches:network
Add openssh-8.1p1-use-openssl-kdf.patch (jsc#SLE-9443). This
  performs key derivation using OpenSSL's SSHKDF facility, which
  allows OpenSSH to benefit from the former's FIPS certification
  status.

Make sure ssh-keygen runs if SSHD_AUTO_KEYGEN variable is unset
  or contains an unrecognized value (bsc#1157176).

OBS-URL: https://build.opensuse.org/request/show/779739
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=205
2020-02-28 12:19:42 +00:00
Dominique Leuenberger
b71bd2f41b Accepting request 775237 from home:favogt:branches:network
- Add patches to fix the sandbox blocking glibc on 32bit platforms
  (boo#1164061):
  * openssh-8.1p1-seccomp-clock_nanosleep_time64.patch
  * openssh-8.1p1-seccomp-clock_gettime64.patch

OBS-URL: https://build.opensuse.org/request/show/775237
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=203
2020-02-18 15:10:09 +00:00
Tomáš Chvátal
2d48f44a64 Accepting request 746672 from home:elvigia:branches:network
- Add openssh-8.1p1-seccomp-clock_nanosleep.patch, allow clock_nanosleep
  glibc master implements multiple functions using that syscall making
  the privsep sandbox kill the preauth process.

OBS-URL: https://build.opensuse.org/request/show/746672
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=201
2019-11-14 15:26:26 +00:00
Tomáš Chvátal
318211936a Accepting request 737034 from home:hpjansson:branches:network
Version update to 8.1p1:
  * ssh-keygen(1): when acting as a CA and signing certificates with
    an RSA key, default to using the rsa-sha2-512 signature algorithm.
    Certificates signed by RSA keys will therefore be incompatible
    with OpenSSH versions prior to 7.2 unless the default is
    overridden (using "ssh-keygen -t ssh-rsa -s ...").
  * ssh(1): Allow %n to be expanded in ProxyCommand strings
  * ssh(1), sshd(8): Allow prepending a list of algorithms to the
    default set by starting the list with the '^' character, E.g.
    "HostKeyAlgorithms ^ssh-ed25519"
  * ssh-keygen(1): add an experimental lightweight signature and
    verification ability. Signatures may be made using regular ssh keys
    held on disk or stored in a ssh-agent and verified against an
    authorized_keys-like list of allowed keys. Signatures embed a
    namespace that prevents confusion and attacks between different
    usage domains (e.g. files vs email).
  * ssh-keygen(1): print key comment when extracting public key from a
    private key.
  * ssh-keygen(1): accept the verbose flag when searching for host keys
    in known hosts (i.e. "ssh-keygen -vF host") to print the matching
    host's random-art signature too.
  * All: support PKCS8 as an optional format for storage of private
    keys to disk.  The OpenSSH native key format remains the default,
    but PKCS8 is a superior format to PEM if interoperability with
    non-OpenSSH software is required, as it may use a less insecure
    key derivation function than PEM's.
- Additional changes from 8.0p1 release:
  * scp(1): Add "-T" flag to disable client-side filtering of
    server file list.
  * sshd(8): Remove support for obsolete "host/port" syntax.

OBS-URL: https://build.opensuse.org/request/show/737034
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=197
2019-10-10 13:32:50 +00:00
Hans Petter Jansson
084c35400e Accepting request 717662 from home:Vogtinator:branches:network
- ssh-askpass: Try a fallback if the other option is not available

OBS-URL: https://build.opensuse.org/request/show/717662
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=192
2019-07-22 18:28:13 +00:00
5c0c497eea Accepting request 716585 from home:favogt:branches:network
- Supplement libgtk-3-0 instead to avoid installation on a textmode install
  (boo#1142000)

OBS-URL: https://build.opensuse.org/request/show/716585
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=191
2019-07-22 16:43:06 +00:00
Tomáš Chvátal
05c990c804 - Supplement the openssh and libx11 together to ensure this package
is installed on machines where there is X stack

OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=176
2019-02-14 10:37:25 +00:00
Tomáš Chvátal
ed403ddfcd Accepting request 668656 from home:pmonrealgonzalez:branches:network
- Move ssh-ldap* man pages into openssh-helpers [bsc#1051531]

- Allow root login by default [bsc#1118114, bsc#1121196]
  * Added/updated previous patch openssh-7.7p1-allow_root_password_login.patch

- Added SLE conditionals in the spec files:
  * Keep gtk2-devel in openssh-askpass-gnome in SLE
  * Keep krb5-mini-devel in SLE
- Removed obsolete configure options:
  * SSH protocol 1 --with-ssh1
  * Smart card --with-opensc
- Cleaned spec file with spec-cleaner

OBS-URL: https://build.opensuse.org/request/show/668656
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=172
2019-01-28 08:02:07 +00:00
Tomáš Chvátal
518034998f Accepting request 662676 from home:pmonrealgonzalez:branches:network
- Added compatibility with SuSEfirewall2 [bsc#1118044]

OBS-URL: https://build.opensuse.org/request/show/662676
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=167
2019-01-04 06:19:36 +00:00
Tomáš Chvátal
b21be4c6b4 Accepting request 643660 from home:pmonrealgonzalez:branches:network
- Version update to 7.9p1
  * No actual changes for the askpass
  * See main package changelog for details

- Version update to 7.9p1
  * ssh(1), sshd(8): the setting of the new CASignatureAlgorithms
    option (see below) bans the use of DSA keys as certificate
    authorities.
  * sshd(8): the authentication success/failure log message has
    changed format slightly. It now includes the certificate
    fingerprint (previously it included only key ID and CA key
    fingerprint).
  * ssh(1), sshd(8): allow most port numbers to be specified using
    service names from getservbyname(3) (typically /etc/services).
  * sshd(8): support signalling sessions via the SSH protocol.
    A limited subset of signals is supported and only for login or
    command sessions (i.e. not subsystems) that were not subject to
    a forced command via authorized_keys or sshd_config. bz#1424
  * ssh(1): support "ssh -Q sig" to list supported signature options.
    Also "ssh -Q help" to show the full set of supported queries.
  * ssh(1), sshd(8): add a CASignatureAlgorithms option for the
    client and server configs to allow control over which signature
    formats are allowed for CAs to sign certificates. For example,
    this allows banning CAs that sign certificates using the RSA-SHA1
    signature algorithm.
  * sshd(8), ssh-keygen(1): allow key revocation lists (KRLs) to
    revoke keys specified by SHA256 hash.
  * ssh-keygen(1): allow creation of key revocation lists directly
    from base64-encoded SHA256 fingerprints. This supports revoking
    keys using only the information contained in sshd(8)

OBS-URL: https://build.opensuse.org/request/show/643660
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=159
2018-10-22 09:08:19 +00:00
Tomáš Chvátal
7bccbbd821 Accepting request 642573 from home:scarabeus_iv:branches:network
- Update to 7.8p1:
  * no actual changes for the askpass
- Format with spec-cleaner
- Respect cflags
- Use gtk3 rather than gtk2 which is being phased out

- Remove the mention of the SLE12 in the README.SUSE
- Install firewall rules only when really needed (<SLE15)

- Version update to 7.8p1:
  * For most details see release notes file
  * ssh-keygen(1): write OpenSSH format private keys by default
    instead of using OpenSSL's PEM format
- Rebase patches to apply on 7.8p1 release:
  * openssh-7.7p1-fips.patch
  * openssh-7.7p1-cavstest-kdf.patch
  * openssh-7.7p1-fips_checks.patch
  * openssh-7.7p1-gssapi_key_exchange.patch
  * openssh-7.7p1-audit.patch
  * openssh-7.7p1-openssl_1.1.0.patch
  * openssh-7.7p1-ldap.patch
  * openssh-7.7p1-IPv6_X_forwarding.patch
  * openssh-7.7p1-sftp_print_diagnostic_messages.patch
  * openssh-7.7p1-disable_short_DH_parameters.patch
  * openssh-7.7p1-hostname_changes_when_forwarding_X.patch
  * openssh-7.7p1-pam_check_locks.patch
  * openssh-7.7p1-seed-prng.patch
  * openssh-7.7p1-systemd-notify.patch
  * openssh-7.7p1-X11_trusted_forwarding.patch
- Dropped patches:

OBS-URL: https://build.opensuse.org/request/show/642573
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=153
2018-10-17 08:57:56 +00:00
Petr Cerny
223282b58f Accepting request 611002 from home:pcerny:factory
- Upgrade to 7.7p1 (bsc#1094068)

- Upgrade to 7.7p1 (bsc#1094068)
  Most important changes (more details below):
  * Drop compatibility support for pre-2001 SSH implementations
  * sshd(1) does not load DSA keys by default
  Distilled upstream log:
  ---- Potentially-incompatible changes
  * ssh(1)/sshd(8): Drop compatibility support for some very old
    SSH implementations, including ssh.com <=2.* and OpenSSH <=
    3.*.  These versions were all released in or before 2001 and
    predate the final SSH RFCs. The support in question isn't
    necessary for RFC-compliant SSH implementations.
  ---- New Features
  * experimental support for PQC XMSS keys (Extended Hash-Based
    Signatures), not compiled in by default.
  * sshd(8): Add a "rdomain" criteria for the sshd_config Match
    keyword to allow conditional configuration that depends on
    which routing domain a connection was received on (currently
    supported on OpenBSD and Linux).
  * sshd_config(5): Add an optional rdomain qualifier to the
    ListenAddress directive to allow listening on different
    routing domains. This is supported only on OpenBSD and Linux
    at present.
  * sshd_config(5): Add RDomain directive to allow the
    authenticated session to be placed in an explicit routing
    domain. This is only supported on OpenBSD at present.
  * sshd(8): Add "expiry-time" option for authorized_keys files
    to allow for expiring keys.
  * ssh(1): Add a BindInterface option to allow binding the

OBS-URL: https://build.opensuse.org/request/show/611002
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=145
2018-05-21 21:57:42 +00:00
f82cf6b5da (update tracker: bsc#1080779)
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=137
2018-03-05 16:40:33 +00:00
Petr Cerny
183de6e669 Accepting request 571576 from home:pcerny:factory
- .spec file cleanup

- upgrade to 7.6p1
  see main package changelog for details

- Add missing crypto hardware enablement patches for IBM mainframes
  (FATE#323902)

- add missing part of systemd integration (unit type)

OBS-URL: https://build.opensuse.org/request/show/571576
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=134
2018-02-01 00:18:29 +00:00
Petr Cerny
a03a137de1 Accepting request 563724 from home:pcerny:factory
reworking packaging, gssapi kex patch

OBS-URL: https://build.opensuse.org/request/show/563724
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=128
2018-01-12 00:42:53 +00:00
Petr Cerny
b813991fe5 Accepting request 551548 from home:pcerny:factory
- upgrade to 7.6p1
  see main package changelog for details

- Replace references to /var/adm/fillup-templates with new 
  %_fillupdir macro (boo#1069468)

- Update to vanilla 7.6p1
  Most important changes (more details below):
  * complete removal of the ancient SSHv1 protocol
  * sshd(8) cannot run without privilege separation
  * removal of suport for arcfourm blowfish and CAST ciphers
    and RIPE-MD160 HMAC
  * refuse RSA keys shorter than 1024 bits
  Distilled upstream log:
- OpenSSH 7.3
  ---- Security
  * sshd(8): Mitigate a potential denial-of-service attack
    against the system's crypt(3) function via sshd(8). An
    attacker could send very long passwords that would cause
    excessive CPU use in crypt(3). sshd(8) now refuses to accept
    password authentication requests of length greater than 1024
    characters. Independently reported by Tomas Kuthan (Oracle),
    Andres Rojas and Javier Nieto.
  * sshd(8): Mitigate timing differences in password
    authentication that could be used to discern valid from
    invalid account names when long passwords were sent and
    particular password hashing algorithms are in use on the
    server. CVE-2016-6210, reported by EddieEzra.Harari at
    verint.com
  * ssh(1), sshd(8): Fix observable timing weakness in the CBC

OBS-URL: https://build.opensuse.org/request/show/551548
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=127
2017-12-05 12:47:07 +00:00
Petr Cerny
56e0af8154 Accepting request 547144 from home:pcerny:factory
temporarily downgrading to 7.2p2 to run tests on additional 7.2p2 patches

OBS-URL: https://build.opensuse.org/request/show/547144
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=124
2017-12-01 15:03:13 +00:00
3a77b6ed2a Accepting request 544667 from home:RBrownSUSE:branches:network
Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468)

OBS-URL: https://build.opensuse.org/request/show/544667
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=123
2017-11-24 10:22:32 +00:00
Petr Cerny
d83100ae13 Accepting request 539322 from home:pcerny:factory
- upgrade to 7.6p1
  see main package changelog for details

- Update to vanilla 7.6p1
  Most important changes (more details below):
  * complete removal of the ancient SSHv1 protocol
  * sshd(8) cannot run without privilege separation
  * removal of suport for arcfourm blowfish and CAST ciphers
    and RIPE-MD160 HMAC
  * refuse RSA keys shorter than 1024 bits
  Distilled upstream log:
- OpenSSH 7.3
  ---- Security
  * sshd(8): Mitigate a potential denial-of-service attack
    against the system's crypt(3) function via sshd(8). An
    attacker could send very long passwords that would cause
    excessive CPU use in crypt(3). sshd(8) now refuses to accept
    password authentication requests of length greater than 1024
    characters. Independently reported by Tomas Kuthan (Oracle),
    Andres Rojas and Javier Nieto.
  * sshd(8): Mitigate timing differences in password
    authentication that could be used to discern valid from
    invalid account names when long passwords were sent and
    particular password hashing algorithms are in use on the
    server. CVE-2016-6210, reported by EddieEzra.Harari at
    verint.com
  * ssh(1), sshd(8): Fix observable timing weakness in the CBC
    padding oracle countermeasures. Reported by Jean Paul
    Degabriele, Kenny Paterson, Torben Hansen and Martin
    Albrecht. Note that CBC ciphers are disabled by default and

OBS-URL: https://build.opensuse.org/request/show/539322
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=122
2017-11-06 14:50:53 +00:00
c84af5da00 Accepting request 536578 from home:jsegitz:branches:network
- sshd_config is has now permissions 0600 in secure mode

OBS-URL: https://build.opensuse.org/request/show/536578
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=120
2017-10-26 10:23:16 +00:00
Petr Cerny
e8b9919265 Accepting request 500279 from home:pcerny:factory
- Fix preauth seccomp separation on mainframes (bsc#1016709)
  [openssh-7.2p2-s390_hw_crypto_syscalls.patch]
  [openssh-7.2p2-s390_OpenSSL-ibmpkcs11_syscalls.patch]
- enable case-insensitive hostname matching (bsc#1017099)
  [openssh-7.2p2-ssh_case_insensitive_host_matching.patch]
- add CAVS tests 
  [openssh-7.2p2-cavstest-ctr.patch]
  [openssh-7.2p2-cavstest-kdf.patch]
- Adding missing pieces for user matching (bsc#1021626)
- Properly verify CIDR masks in configuration
  (bsc#1005893)
  [openssh-7.2p2-verify_CIDR_address_ranges.patch]
- Remove pre-auth compression support from the server to prevent
  possible cryptographic attacks.
  (CVE-2016-10012, bsc#1016370)
  [openssh-7.2p2-disable_preauth_compression.patch]
- limit directories for loading PKCS11 modules
  (CVE-2016-10009, bsc#1016366)
  [openssh-7.2p2-restrict_pkcs11-modules.patch]
- Prevent possible leaks of host private keys to low-privilege
  process handling authentication
  (CVE-2016-10011, bsc#1016369)
  [openssh-7.2p2-prevent_private_key_leakage.patch]
- Do not allow unix socket forwarding when running without
  privilege separation
  (CVE-2016-10010, bsc#1016368)
  [openssh-7.2p2-secure_unix_sockets_forwarding.patch]
- prevent resource depletion during key exchange
  (bsc#1005480, CVE-2016-8858)
  [openssh-7.2p2-kex_resource_depletion.patch]

OBS-URL: https://build.opensuse.org/request/show/500279
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=117
2017-05-31 23:09:14 +00:00
5829a44f01 Accepting request 459897 from home:elvigia:branches:network
- sshd.service: Set TasksMax=infinity, as there should be
  no limit on the amount of tasks sshd can run.

OBS-URL: https://build.opensuse.org/request/show/459897
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=115
2017-03-01 11:01:26 +00:00
Petr Cerny
e0d7fb0744 Accepting request 428544 from home:pcerny:factory
- FIPS compatibility (no selfchecks, only crypto restrictions)
  [openssh-7.2p2-fips.patch]
- PRNG re-seeding
  [openssh-7.2p2-seed-prng.patch]
- preliminary version of GSSAPI KEX
  [openssh-7.2p2-gssapi_key_exchange.patch]

OBS-URL: https://build.opensuse.org/request/show/428544
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=110
2016-09-18 23:04:18 +00:00
a412ed9d8d - fixed url, added gpg signature
- added gpg signature and keyring from 
  http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh_gzsig_key.pub

OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=108
2016-07-25 13:47:29 +00:00
Petr Cerny
5093e42eaa Accepting request 398802 from home:pcerny:factory
- upgrade to 7.2p2

- changing license to 2-clause BSD to match source

- enable trusted X11 forwarding by default
  [-X11_trusted_forwarding]
- set UID for lastlog properly [-lastlog]
- enable use of PAM by default [-enable_PAM_by_default]
- copy command line arguments properly [-saveargv-fix]
- do not use pthreads in PAM code [-dont_use_pthreads_in_PAM]
- fix paths in documentation [-eal3]
- prevent race consitions triggered by SIGALRM [-blocksigalrm]
- do send and accept locale environment variables by default
  [-send_locale]
- handle hostnames changes during X forwarding
  [-hostname_changes_when_forwarding_X]
- try to remove xauth cookies on exit
  [-remove_xauth_cookies_on_exit]
- properly format pts names for ?tmp? log files
  [-pts_names_formatting]
- check locked accounts when using PAM [-pam_check_locks]
- chenge default PermitRootLogin to 'yes' to prevent unwanted
  surprises on updates from older versions.
  See README.SUSE for details
  [-allow_root_password_login]
- Disable DH parameters under 2048 bits by default and allow
  lowering the limit back to the RFC 4419 specified minimum
  through an option (bsc#932483, bsc#948902)
  [-disable_short_DH_parameters]
- Add getuid() and stat() syscalls to the seccomp filter

OBS-URL: https://build.opensuse.org/request/show/398802
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=103
2016-05-30 01:36:18 +00:00
Petr Cerny
252ed8ae18 Accepting request 392909 from home:pcerny:factory
fix broken seccomp sandbox

OBS-URL: https://build.opensuse.org/request/show/392909
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=101
2016-04-29 16:34:58 +00:00
13651d3d21 restore factory state, so we can fix bugs.
old stuff is still in the old revisions

OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=98
2016-04-06 11:34:51 +00:00
Petr Cerny
c818e705ca bothed update, DO NOT TOUCH UNITL PROPERLY REVIEWED
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=97
2016-02-17 19:00:04 +00:00
Ismail Dönmez
642f5e8889 Accepting request 354941 from home:scarabeus_iv:branches:network
- Cleanup with spec-cleaner
- Update of the master OpenSSH to 7.1p2

- Take refreshed and updated audit patch from redhat
  * Remove our old patches:
    + openssh-6.6p1-audit1-remove_duplicit_audit.patch
    + openssh-6.6p1-audit2-better_audit_of_user_actions.patch
    + openssh-6.6p1-audit3-key_auth_usage-fips.patch
    + openssh-6.6p1-audit3-key_auth_usage.patch
    + openssh-6.6p1-audit4-kex_results-fips.patch
    + openssh-6.6p1-audit4-kex_results.patch
    + openssh-6.6p1-audit5-session_key_destruction.patch
    + openssh-6.6p1-audit6-server_key_destruction.patch
    + openssh-6.6p1-audit7-libaudit_compat.patch
    + openssh-6.6p1-audit8-libaudit_dns_timeouts.patch
  * add openssh-6.7p1-audit.patch
- Reenable the openssh-6.6p1-ldap.patch
- Update the fips patch from RH build openssh-6.6p1-fips.patch
- Update and refresh openssh-6.6p1-gssapi_key_exchange.patch
- Remove fips-check patch as it is merged to fips patch
  * openssh-6.6p1-fips-checks.patch
- Rebase and enable chroot patch:
  * openssh-6.6p1-sftp_homechroot.patch
- Reenable rebased patch for linux seed:
  * openssh-6.6p1-seed-prng.patch
- Reenable key converting patch:
  * openssh-6.6p1-key-converter.patch

- Version update to 7.1p2:
  * various upstream bugfixes and cleanups

OBS-URL: https://build.opensuse.org/request/show/354941
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=95
2016-01-21 07:28:30 +00:00
Ismail Dönmez
1c5ff2cc6c Accepting request 353717 from home:AndreasStieger:branches:network
Security update for OpenSSH
CVE-2016-0777, bsc#961642, CVE-2016-0778, bsc#961645
https://lists.mindrot.org/pipermail/openssh-unix-announce/2016-January/000124.html

OBS-URL: https://build.opensuse.org/request/show/353717
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=93
2016-01-14 16:36:52 +00:00
a86956def1 - gpg signature and keyring added.
pub  3200R/6D920D30 2013-12-10 [expires: 2021-01-01]
  uid                            Damien Miller <djm@mindrot.org>
  sub  3200R/672A1105 2013-12-10 [expires: 2021-01-01]

OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=90
2015-01-12 10:35:52 +00:00
Petr Cerny
efb05e6527 Accepting request 230097 from home:pcerny:factory
- Update of the underlying OpenSSH to 6.6p1

- update to 6.6p1
  Security:
  * sshd(8): when using environment passing with a sshd_config(5)
    AcceptEnv pattern with a wildcard. OpenSSH prior to 6.6 could
    be tricked into accepting any enviornment variable that
    contains the characters before the wildcard character.
  Features since 6.5p1:
  * ssh(1), sshd(8): removal of the J-PAKE authentication code,
    which was experimental, never enabled and has been
    unmaintained for some time.
  * ssh(1): skip 'exec' clauses other clauses predicates failed
    to match while processing Match blocks.
  * ssh(1): if hostname canonicalisation is enabled and results
    in the destination hostname being changed, then re-parse
    ssh_config(5) files using the new destination hostname. This
    gives 'Host' and 'Match' directives that use the expanded
    hostname a chance to be applied.
  Bugfixes:
  * ssh(1): avoid spurious "getsockname failed: Bad file
    descriptor" in ssh -W. bz#2200, debian#738692
  * sshd(8): allow the shutdown(2) syscall in seccomp-bpf and
    systrace sandbox modes, as it is reachable if the connection
    is terminated during the pre-auth phase.
  * ssh(1), sshd(8): fix unsigned overflow that in SSH protocol 1
    bignum parsing. Minimum key length checks render this bug
    unexploitable to compromise SSH 1 sessions.
  * sshd_config(5): clarify behaviour of a keyword that appears
    in multiple matching Match blocks. bz#2184

OBS-URL: https://build.opensuse.org/request/show/230097
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=76
2014-04-14 21:53:01 +00:00
Petr Cerny
08f9072513 Accepting request 222365 from home:pcerny:factory
- Update of the underlying OpenSSH to 6.5p1

- Update to 6.5p1
  Features since 6.4p1:
  * ssh(1), sshd(8): support for key exchange using ECDH in
    Daniel Bernstein's Curve25519; default when both the client
    and server support it.
  * ssh(1), sshd(8): support for Ed25519 as a public key type fo
    rboth server and client.  Ed25519 is an EC signature offering
    better security than ECDSA and DSA and good performance.
  * Add a new private key format that uses a bcrypt KDF to better
    protect keys at rest. Used unconditionally for Ed25519 keys,
    on demand for other key types via the -o ssh-keygen(1)
    option.  Intended to become default in the near future.
    Details documented in PROTOCOL.key.
  * ssh(1), sshd(8): new transport cipher
    "chacha20-poly1305@openssh.com" combining Daniel Bernstein's
    ChaCha20 stream cipher and Poly1305 MAC to build an
    authenticated encryption mode. Details documented
    PROTOCOL.chacha20poly1305.
  * ssh(1), sshd(8): refuse RSA keys from old proprietary clients
    and servers that use the obsolete RSA+MD5 signature scheme.
    It will still be possible to connect with these
    clients/servers but only DSA keys will be accepted, and
    OpenSSH will refuse connection entirely in a future release.
  * ssh(1), sshd(8): refuse old proprietary clients and servers
    that use a weaker key exchange hash calculation.
  * ssh(1): increase the size of the Diffie-Hellman groups
    requested for each symmetric key size. New values from NIST
    Special Publication 800-57 with the upper limit specified by

OBS-URL: https://build.opensuse.org/request/show/222365
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=63
2014-02-14 14:54:10 +00:00
Petr Cerny
712ccf3395 Accepting request 220466 from home:pcerny:factory
- Update of the underlying OpenSSH to 6.4p1

- Update to 6.4p1
  Features since 6.2p2:
  * ssh-agent(1) support in sshd(8); allows encrypted hostkeys, or
    hostkeys on smartcards.
  * ssh(1)/sshd(8): allow optional time-based rekeying via a
    second argument to the existing RekeyLimit option. RekeyLimit
    is now supported in sshd_config as well as on the client.
  * sshd(8): standardise logging of information during user
    authentication.
  * The presented key/cert and the remote username (if available)
    is now logged in the authentication success/failure message on
    the same log line as the local username, remote host/port and
    protocol in use.  Certificates contents and the key
    fingerprint of the signing CA are logged too.
  * ssh(1) ability to query what cryptographic algorithms are
    supported in the binary.
  * ssh(1): ProxyCommand=- for cases where stdin and stdout
    already point to the proxy.
  * ssh(1): allow IdentityFile=none
  * ssh(1)/sshd(8): -E option to append debugging logs to a
    specified file instead of stderr or syslog.
  * sftp(1): support resuming partial downloads with the "reget"
    command and on the sftp commandline or on the "get"
    commandline with the "-a" (append) option.
  * ssh(1): "IgnoreUnknown" configuration option to selectively
    suppress errors arising from unknown configuration directives.
  * sshd(8): support for submethods to be appended to required
    authentication methods listed via AuthenticationMethods.

OBS-URL: https://build.opensuse.org/request/show/220466
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=58
2014-01-31 12:18:41 +00:00
Petr Cerny
6cd875acfc Accepting request 199679 from home:pcerny:factory
- spec file cleanup (don't pointelssly build whole OpenSSH)

- spec file and patch cleanup
  * removing obsoleted auditing patch
    (openssh-%{version}-audit.patch)
- added patches from SLE
  * GSSAPI key exchange
  * FIPS enablement (currently disabled)
  * small bugfixes 
- split the LDAP helper into a separate package: openssh-akc-ldap

OBS-URL: https://build.opensuse.org/request/show/199679
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=55
2013-09-19 04:09:33 +00:00
616ae5907d Accepting request 185789 from home:elvigia:branches:network
- Update for 6.2p2 

- Update to version 6.2p2 
* ssh(1)/sshd(8): Added support for AES-GCM authenticated encryption
* ssh(1)/sshd(8): Added support for encrypt-then-mac (EtM) MAC modes
* ssh(1)/sshd(8): Added support for the UMAC-128 MAC
* sshd(8): Added support for multiple required authentication
* sshd(8)/ssh-keygen(1): Added support for Key Revocation Lists
* ssh(1): When SSH protocol 2 only is selected (the default), ssh(1)
  now immediately sends its SSH protocol banner to the server without
  waiting to receive the server's banner, saving time when connecting.
* dozens of other changes, see http://www.openssh.org/txt/release-6.2

OBS-URL: https://build.opensuse.org/request/show/185789
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=51
2013-08-05 07:15:19 +00:00
Petr Cerny
892194f58f Accepting request 147497 from home:dirkmueller:branches:network
- use ssh-keygen(1) default keylengths in generating the host key
  instead of hardcoding it

OBS-URL: https://build.opensuse.org/request/show/147497
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=44
2013-01-08 10:22:21 +00:00
41221d925c - Updated to 6.1p1, a bugfix release
Features:
 * sshd(8): This release turns on pre-auth sandboxing sshd by default for
   new installs, by setting UsePrivilegeSeparation=sandbox in sshd_config.
 * ssh-keygen(1): Add options to specify starting line number and number of
   lines to process when screening moduli candidates, allowing processing
   of different parts of a candidate moduli file in parallel
 * sshd(8): The Match directive now supports matching on the local (listen)
   address and port upon which the incoming connection was received via
   LocalAddress and LocalPort clauses.
 * sshd(8): Extend sshd_config Match directive to allow setting AcceptEnv
   and {Allow,Deny}{Users,Groups}
 * Add support for RFC6594 SSHFP DNS records for ECDSA key types. bz#1978
 * ssh-keygen(1): Allow conversion of RSA1 keys to public PEM and PKCS8
 * sshd(8): Allow the sshd_config PermitOpen directive to accept "none" as
   an argument to refuse all port-forwarding requests.
 * sshd(8): Support "none" as an argument for AuthorizedPrincipalsFile
 * ssh-keyscan(1): Look for ECDSA keys by default. bz#1971
 * sshd(8): Add "VersionAddendum" to sshd_config to allow server operators
   to append some arbitrary text to the server SSH protocol banner.
 Bugfixes:
 * ssh(1)/sshd(8): Don't spin in accept() in situations of file
   descriptor exhaustion. Instead back off for a while.
 * ssh(1)/sshd(8): Remove hmac-sha2-256-96 and hmac-sha2-512-96 MACs as
   they were removed from the specification. bz#2023,
 * sshd(8): Handle long comments in config files better. bz#2025
 * ssh(1): Delay setting tty_flag so RequestTTY options are correctly
   picked up. bz#1995
 * sshd(8): Fix handling of /etc/nologin incorrectly being applied to root
   on platforms that use login_cap.

OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=42
2012-11-13 10:50:53 +00:00
cfb80ff52c Accepting request 126286 from home:coolo:branches:openSUSE:Factory
- the gnome askpass does not require the x11 askpass - especially not
  in the version of openssh (it's at 1.X)

OBS-URL: https://build.opensuse.org/request/show/126286
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=33
2012-06-27 10:11:02 +00:00
517f6527d0 - use correct tarball url
- update to 6.0p1.

- use correct download url and tarball format.

OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=28
2012-05-29 07:15:29 +00:00
9d7406f5e6 Accepting request 122649 from home:elvigia:branches:network
- Update to version 6.0, large list of changes, seen
  http://www.openssh.org/txt/release-6.0 for detail.

OBS-URL: https://build.opensuse.org/request/show/122649
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=27
2012-05-29 07:11:57 +00:00