efb05e6527
- Update of the underlying OpenSSH to 6.6p1
- update to 6.6p1
Security:
* sshd(8): when using environment passing with a sshd_config(5)
AcceptEnv pattern with a wildcard. OpenSSH prior to 6.6 could
be tricked into accepting any enviornment variable that
contains the characters before the wildcard character.
Features since 6.5p1:
* ssh(1), sshd(8): removal of the J-PAKE authentication code,
which was experimental, never enabled and has been
unmaintained for some time.
* ssh(1): skip 'exec' clauses other clauses predicates failed
to match while processing Match blocks.
* ssh(1): if hostname canonicalisation is enabled and results
in the destination hostname being changed, then re-parse
ssh_config(5) files using the new destination hostname. This
gives 'Host' and 'Match' directives that use the expanded
hostname a chance to be applied.
Bugfixes:
* ssh(1): avoid spurious "getsockname failed: Bad file
descriptor" in ssh -W. bz#2200, debian#738692
* sshd(8): allow the shutdown(2) syscall in seccomp-bpf and
systrace sandbox modes, as it is reachable if the connection
is terminated during the pre-auth phase.
* ssh(1), sshd(8): fix unsigned overflow that in SSH protocol 1
bignum parsing. Minimum key length checks render this bug
unexploitable to compromise SSH 1 sessions.
* sshd_config(5): clarify behaviour of a keyword that appears
in multiple matching Match blocks. bz#2184
OBS-URL: https://build.opensuse.org/request/show/230097
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=76
86 lines
2.3 KiB
Diff
86 lines
2.3 KiB
Diff
# fix paths and references in sshd man pages
|
|
|
|
diff --git a/openssh-6.6p1/sshd.8 b/openssh-6.6p1/sshd.8
|
|
--- a/openssh-6.6p1/sshd.8
|
|
+++ b/openssh-6.6p1/sshd.8
|
|
@@ -875,17 +875,17 @@ See
|
|
If this file exists,
|
|
.Nm
|
|
refuses to let anyone except root log in.
|
|
The contents of the file
|
|
are displayed to anyone trying to log in, and non-root connections are
|
|
refused.
|
|
The file should be world-readable.
|
|
.Pp
|
|
-.It Pa /etc/shosts.equiv
|
|
+.It Pa /etc/ssh/shosts.equiv
|
|
This file is used in exactly the same way as
|
|
.Pa hosts.equiv ,
|
|
but allows host-based authentication without permitting login with
|
|
rlogin/rsh.
|
|
.Pp
|
|
.It Pa /etc/ssh/ssh_host_key
|
|
.It Pa /etc/ssh/ssh_host_dsa_key
|
|
.It Pa /etc/ssh/ssh_host_ecdsa_key
|
|
@@ -956,17 +956,17 @@ The content of this file is not sensitiv
|
|
.Xr sftp 1 ,
|
|
.Xr ssh 1 ,
|
|
.Xr ssh-add 1 ,
|
|
.Xr ssh-agent 1 ,
|
|
.Xr ssh-keygen 1 ,
|
|
.Xr ssh-keyscan 1 ,
|
|
.Xr chroot 2 ,
|
|
.Xr hosts_access 5 ,
|
|
-.Xr login.conf 5 ,
|
|
+.Xr login.defs 5 ,
|
|
.Xr moduli 5 ,
|
|
.Xr sshd_config 5 ,
|
|
.Xr inetd 8 ,
|
|
.Xr sftp-server 8
|
|
.Sh AUTHORS
|
|
OpenSSH is a derivative of the original and free
|
|
ssh 1.2.12 release by Tatu Ylonen.
|
|
Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos,
|
|
diff --git a/openssh-6.6p1/sshd_config.5 b/openssh-6.6p1/sshd_config.5
|
|
--- a/openssh-6.6p1/sshd_config.5
|
|
+++ b/openssh-6.6p1/sshd_config.5
|
|
@@ -278,18 +278,17 @@ The contents of the specified file are s
|
|
authentication is allowed.
|
|
If the argument is
|
|
.Dq none
|
|
then no banner is displayed.
|
|
This option is only available for protocol version 2.
|
|
By default, no banner is displayed.
|
|
.It Cm ChallengeResponseAuthentication
|
|
Specifies whether challenge-response authentication is allowed (e.g. via
|
|
-PAM or though authentication styles supported in
|
|
-.Xr login.conf 5 )
|
|
+PAM)
|
|
The default is
|
|
.Dq yes .
|
|
.It Cm ChrootDirectory
|
|
Specifies the pathname of a directory to
|
|
.Xr chroot 2
|
|
to after authentication.
|
|
All components of the pathname must be root-owned directories that are
|
|
not writable by any other user or group.
|
|
@@ -576,17 +575,17 @@ and
|
|
.Pa .shosts
|
|
files will not be used in
|
|
.Cm RhostsRSAAuthentication
|
|
or
|
|
.Cm HostbasedAuthentication .
|
|
.Pp
|
|
.Pa /etc/hosts.equiv
|
|
and
|
|
-.Pa /etc/shosts.equiv
|
|
+.Pa /etc/ssh/shosts.equiv
|
|
are still used.
|
|
The default is
|
|
.Dq yes .
|
|
.It Cm IgnoreUserKnownHosts
|
|
Specifies whether
|
|
.Xr sshd 8
|
|
should ignore the user's
|
|
.Pa ~/.ssh/known_hosts
|