5093e42eaa
- upgrade to 7.2p2 - changing license to 2-clause BSD to match source - enable trusted X11 forwarding by default [-X11_trusted_forwarding] - set UID for lastlog properly [-lastlog] - enable use of PAM by default [-enable_PAM_by_default] - copy command line arguments properly [-saveargv-fix] - do not use pthreads in PAM code [-dont_use_pthreads_in_PAM] - fix paths in documentation [-eal3] - prevent race consitions triggered by SIGALRM [-blocksigalrm] - do send and accept locale environment variables by default [-send_locale] - handle hostnames changes during X forwarding [-hostname_changes_when_forwarding_X] - try to remove xauth cookies on exit [-remove_xauth_cookies_on_exit] - properly format pts names for ?tmp? log files [-pts_names_formatting] - check locked accounts when using PAM [-pam_check_locks] - chenge default PermitRootLogin to 'yes' to prevent unwanted surprises on updates from older versions. See README.SUSE for details [-allow_root_password_login] - Disable DH parameters under 2048 bits by default and allow lowering the limit back to the RFC 4419 specified minimum through an option (bsc#932483, bsc#948902) [-disable_short_DH_parameters] - Add getuid() and stat() syscalls to the seccomp filter OBS-URL: https://build.opensuse.org/request/show/398802 OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=103
66 lines
2.3 KiB
Diff
66 lines
2.3 KiB
Diff
# HG changeset patch
|
|
# Parent e75958369c26f618744c229ef1a9925d8ccb1dcb
|
|
# enable trusted X11 forwarding by default in both sshd and sshsystem-wide
|
|
# configuration
|
|
# bnc#50836 (was suse #35836)
|
|
Enable Trusted X11 forwarding by default, since the security benefits of
|
|
having it disabled are negligible these days with XI2 being widely used.
|
|
|
|
diff --git a/openssh-7.2p2/ssh_config b/openssh-7.2p2/ssh_config
|
|
--- a/openssh-7.2p2/ssh_config
|
|
+++ b/openssh-7.2p2/ssh_config
|
|
@@ -12,19 +12,30 @@
|
|
# Any configuration value is only changed the first time it is set.
|
|
# Thus, host-specific definitions should be at the beginning of the
|
|
# configuration file, and defaults at the end.
|
|
|
|
# Site-wide defaults for some commonly used options. For a comprehensive
|
|
# list of available options, their meanings and defaults, please see the
|
|
# ssh_config(5) man page.
|
|
|
|
-# Host *
|
|
+Host *
|
|
# ForwardAgent no
|
|
# ForwardX11 no
|
|
+
|
|
+# If you do not trust your remote host (or its administrator), you
|
|
+# should not forward X11 connections to your local X11-display for
|
|
+# security reasons: Someone stealing the authentification data on the
|
|
+# remote side (the "spoofed" X-server by the remote sshd) can read your
|
|
+# keystrokes as you type, just like any other X11 client could do.
|
|
+# Set this to "no" here for global effect or in your own ~/.ssh/config
|
|
+# file if you want to have the remote X11 authentification data to
|
|
+# expire after twenty minutes after remote login.
|
|
+ ForwardX11Trusted yes
|
|
+
|
|
# RhostsRSAAuthentication no
|
|
# RSAAuthentication yes
|
|
# PasswordAuthentication yes
|
|
# HostbasedAuthentication no
|
|
# GSSAPIAuthentication no
|
|
# GSSAPIDelegateCredentials no
|
|
# BatchMode no
|
|
# CheckHostIP yes
|
|
diff --git a/openssh-7.2p2/sshd_config b/openssh-7.2p2/sshd_config
|
|
--- a/openssh-7.2p2/sshd_config
|
|
+++ b/openssh-7.2p2/sshd_config
|
|
@@ -94,17 +94,17 @@ AuthorizedKeysFile .ssh/authorized_keys
|
|
# If you just want the PAM account and session checks to run without
|
|
# PAM authentication, then enable this but set PasswordAuthentication
|
|
# and ChallengeResponseAuthentication to 'no'.
|
|
#UsePAM no
|
|
|
|
#AllowAgentForwarding yes
|
|
#AllowTcpForwarding yes
|
|
#GatewayPorts no
|
|
-#X11Forwarding no
|
|
+X11Forwarding yes
|
|
#X11DisplayOffset 10
|
|
#X11UseLocalhost yes
|
|
#PermitTTY yes
|
|
#PrintMotd yes
|
|
#PrintLastLog yes
|
|
#TCPKeepAlive yes
|
|
#UseLogin no
|
|
#UsePrivilegeSeparation sandbox
|