6543c1a02b
- update to 8.4p1:
Security
========
* ssh-agent(1): restrict ssh-agent from signing web challenges for
FIDO/U2F keys.
* ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating
a FIDO resident key.
* ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for
each use. These keys may be generated using ssh-keygen using a new
"verify-required" option. When a PIN-required key is used, the user
will be prompted for a PIN to complete the signature operation.
New Features
------------
* sshd(8): authorized_keys now supports a new "verify-required"
option to require FIDO signatures assert that the token verified
that the user was present before making the signature. The FIDO
protocol supports multiple methods for user-verification, but
currently OpenSSH only supports PIN verification.
* sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn
signatures. Webauthn is a standard for using FIDO keys in web
browsers. These signatures are a slightly different format to plain
FIDO signatures and thus require explicit support.
* ssh(1): allow some keywords to expand shell-style ${ENV}
environment variables. The supported keywords are CertificateFile,
ControlPath, IdentityAgent and IdentityFile, plus LocalForward and
RemoteForward when used for Unix domain socket paths. bz#3140
* ssh(1), ssh-agent(1): allow some additional control over the use of
ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable,
including forcibly enabling and disabling its use. bz#69
* ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time
OBS-URL: https://build.opensuse.org/request/show/863944
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=222
84 lines
2.5 KiB
Diff
84 lines
2.5 KiB
Diff
# HG changeset patch
|
|
# Parent 5e19a205fa03584bb0d829ecbba7495ce1899b65
|
|
# -- uset do be called '-xauthlocalhostname'
|
|
handle hostname changes when forwarding X
|
|
|
|
Index: openssh-8.4p1/session.c
|
|
===================================================================
|
|
--- openssh-8.4p1.orig/session.c
|
|
+++ openssh-8.4p1/session.c
|
|
@@ -985,7 +985,7 @@ copy_environment(char **source, char ***
|
|
#endif
|
|
|
|
static char **
|
|
-do_setup_env(struct ssh *ssh, Session *s, const char *shell)
|
|
+do_setup_env(struct ssh *ssh, Session *s, const char *shell, int *env_size)
|
|
{
|
|
char buf[256];
|
|
size_t n;
|
|
@@ -1195,6 +1195,8 @@ do_setup_env(struct ssh *ssh, Session *s
|
|
for (i = 0; env[i]; i++)
|
|
fprintf(stderr, " %.200s\n", env[i]);
|
|
}
|
|
+
|
|
+ *env_size = envsize;
|
|
return env;
|
|
}
|
|
|
|
@@ -1203,7 +1205,7 @@ do_setup_env(struct ssh *ssh, Session *s
|
|
* first in this order).
|
|
*/
|
|
static void
|
|
-do_rc_files(struct ssh *ssh, Session *s, const char *shell)
|
|
+do_rc_files(struct ssh *ssh, Session *s, const char *shell, char **env, int *env_size)
|
|
{
|
|
FILE *f = NULL;
|
|
char *cmd = NULL, *user_rc = NULL;
|
|
@@ -1260,12 +1262,20 @@ do_rc_files(struct ssh *ssh, Session *s,
|
|
fatal("%s: xasprintf: %s", __func__, strerror(errno));
|
|
f = popen(cmd, "w");
|
|
if (f) {
|
|
+ char hostname[MAXHOSTNAMELEN];
|
|
+
|
|
fprintf(f, "remove %s\n",
|
|
s->auth_display);
|
|
fprintf(f, "add %s %s %s\n",
|
|
s->auth_display, s->auth_proto,
|
|
s->auth_data);
|
|
pclose(f);
|
|
+ if (gethostname(hostname,sizeof(hostname)) >= 0)
|
|
+ child_set_env(&env,env_size,"XAUTHLOCALHOSTNAME",
|
|
+ hostname);
|
|
+ else
|
|
+ debug("Cannot set up XAUTHLOCALHOSTNAME %s\n",
|
|
+ strerror(errno));
|
|
} else {
|
|
fprintf(stderr, "Could not run %s\n",
|
|
cmd);
|
|
@@ -1526,6 +1536,7 @@ do_child(struct ssh *ssh, Session *s, co
|
|
char **env, *argv[ARGV_MAX], remote_id[512];
|
|
const char *shell, *shell0;
|
|
struct passwd *pw = s->pw;
|
|
+ int env_size;
|
|
int r = 0;
|
|
|
|
sshpkt_fmt_connection_id(ssh, remote_id, sizeof(remote_id));
|
|
@@ -1582,7 +1593,7 @@ do_child(struct ssh *ssh, Session *s, co
|
|
* Make sure $SHELL points to the shell from the password file,
|
|
* even if shell is overridden from login.conf
|
|
*/
|
|
- env = do_setup_env(ssh, s, shell);
|
|
+ env = do_setup_env(ssh, s, shell, &env_size);
|
|
|
|
#ifdef HAVE_LOGIN_CAP
|
|
shell = login_getcapstr(lc, "shell", (char *)shell, (char *)shell);
|
|
@@ -1646,7 +1657,7 @@ do_child(struct ssh *ssh, Session *s, co
|
|
|
|
closefrom(STDERR_FILENO + 1);
|
|
|
|
- do_rc_files(ssh, s, shell);
|
|
+ do_rc_files(ssh, s, shell, env, &env_size);
|
|
|
|
/* restore SIGPIPE for child */
|
|
ssh_signal(SIGPIPE, SIG_DFL);
|