2023-06-02 23:14:12 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Sun May 28 09:16:44 UTC 2023 - Andreas Stieger <andreas.stieger@gmx.de>
|
|
|
|
|
|
|
|
|
|
- openssh-askpass-gnome: require only openssh-clients, not the full
|
|
|
|
|
openssh (including -server), to avoid pulling in excessive
|
|
|
|
|
dependencies when installing git on Gnome (boo#1211446)
|
|
|
|
|
|
2023-05-22 21:32:26 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Thu May 11 07:01:54 UTC 2023 - Antonio Larrosa <alarrosa@suse.com>
|
|
|
|
|
|
|
|
|
|
- Update to openssh 9.3p1
|
|
|
|
|
* No changes for askpass, see main package changelog for
|
|
|
|
|
details
|
|
|
|
|
|
Accepting request 922068 from home:hpjansson:branches:network
- Version upgrade to 8.8p1
* No changes for askpass, see main package changelog for
details
- Version update to 8.8p1:
= Security
* sshd(8) from OpenSSH 6.2 through 8.7 failed to correctly initialise
supplemental groups when executing an AuthorizedKeysCommand or
AuthorizedPrincipalsCommand, where a AuthorizedKeysCommandUser or
AuthorizedPrincipalsCommandUser directive has been set to run the
command as a different user. Instead these commands would inherit
the groups that sshd(8) was started with.
Depending on system configuration, inherited groups may allow
AuthorizedKeysCommand/AuthorizedPrincipalsCommand helper programs to
gain unintended privilege.
Neither AuthorizedKeysCommand nor AuthorizedPrincipalsCommand are
enabled by default in sshd_config(5).
= Potentially-incompatible changes
* This release disables RSA signatures using the SHA-1 hash algorithm
by default. This change has been made as the SHA-1 hash algorithm is
cryptographically broken, and it is possible to create chosen-prefix
hash collisions for <USD$50K.
For most users, this change should be invisible and there is
no need to replace ssh-rsa keys. OpenSSH has supported RFC8332
RSA/SHA-256/512 signatures since release 7.2 and existing ssh-rsa keys
will automatically use the stronger algorithm where possible.
Incompatibility is more likely when connecting to older SSH
implementations that have not been upgraded or have not closely tracked
improvements in the SSH protocol. For these cases, it may be necessary
to selectively re-enable RSA/SHA1 to allow connection and/or user
authentication via the HostkeyAlgorithms and PubkeyAcceptedAlgorithms
options.
= New features
* ssh(1): allow the ssh_config(5) CanonicalizePermittedCNAMEs
directive to accept a "none" argument to specify the default
behaviour.
= Bugfixes
* scp(1): when using the SFTP protocol, continue transferring files
after a transfer error occurs, better matching original scp/rcp
behaviour.
* ssh(1): fixed a number of memory leaks in multiplexing,
* ssh-keygen(1): avoid crash when using the -Y find-principals
command.
* A number of documentation and manual improvements, including
bz#3340, PR139, PR215, PR241, PR257
- Additional changes from 8.7p1 release:
= Potentially-incompatible changes
* scp(1): this release changes the behaviour of remote to remote
copies (e.g. "scp host-a:/path host-b:") to transfer through the
local host by default. This was previously available via the -3
flag. This mode avoids the need to expose credentials on the
origin hop, avoids triplicate interpretation of filenames by the
shell (by the local system, the copy origin and the destination)
and, in conjunction with the SFTP support for scp(1) mentioned
below, allows use of all authentication methods to the remote
hosts (previously, only non-interactive methods could be used).
A -R flag has been added to select the old behaviour.
* ssh(1)/sshd(8): both the client and server are now using a
stricter configuration file parser. The new parser uses more
shell-like rules for quotes, space and escape characters. It is
also more strict in rejecting configurations that include options
lacking arguments. Previously some options (e.g. DenyUsers) could
appear on a line with no subsequent arguments. This release will
reject such configurations. The new parser will also reject
configurations with unterminated quotes and multiple '='
characters after the option name.
* ssh(1): when using SSHFP DNS records for host key verification,
ssh(1) will verify all matching records instead of just those
with the specific signature type requested. This may cause host
key verification problems if stale SSHFP records of a different
or legacy signature type exist alongside other records for a
particular host. bz#3322
* ssh-keygen(1): when generating a FIDO key and specifying an
explicit attestation challenge (using -Ochallenge), the challenge
will now be hashed by the builtin security key middleware. This
removes the (undocumented) requirement that challenges be exactly
32 bytes in length and matches the expectations of libfido2.
* sshd(8): environment="..." directives in authorized_keys files are
now first-match-wins and limited to 1024 discrete environment
variable names.
= New features
* scp(1): experimental support for transfers using the SFTP protocol
as a replacement for the venerable SCP/RCP protocol that it has
traditionally used. SFTP offers more predictable filename handling
and does not require expansion of glob(3) patterns via the shell
on the remote side.
* sftp-server(8): add a protocol extension to support expansion of
~/ and ~user/ prefixed paths. This was added to support these
paths when used by scp(1) while in SFTP mode.
* ssh(1): add a ForkAfterAuthentication ssh_config(5) counterpart to
the ssh(1) -f flag. GHPR231
* ssh(1): add a StdinNull directive to ssh_config(5) that allows the
config file to do the same thing as -n does on the ssh(1) command-
line. GHPR231
* ssh(1): add a SessionType directive to ssh_config, allowing the
configuration file to offer equivalent control to the -N (no
session) and -s (subsystem) command-line flags. GHPR231
* ssh-keygen(1): allowed signers files used by ssh-keygen(1)
signatures now support listing key validity intervals alongside
they key, and ssh-keygen(1) can optionally check during signature
verification whether a specified time falls inside this interval.
This feature is intended for use by git to support signing and
verifying objects using ssh keys.
* ssh-keygen(8): support printing of the full public key in a sshsig
signature via a -Oprint-pubkey flag.
= Bugfixes
* ssh(1)/sshd(8): start time-based re-keying exactly on schedule in
the client and server mainloops. Previously the re-key timeout
could expire but re-keying would not start until a packet was sent
or received, causing a spin in select() if the connection was
quiescent.
* ssh-keygen(1): avoid Y2038 problem in printing certificate
validity lifetimes. Dates past 2^31-1 seconds since epoch were
displayed incorrectly on some platforms. bz#3329
* scp(1): allow spaces to appear in usernames for local to remote
and scp -3 remote to remote copies. bz#1164
* ssh(1)/sshd(8): remove references to ChallengeResponseAuthentication
in favour of KbdInteractiveAuthentication. The former is what was in
SSHv1, the latter is what is in SSHv2 (RFC4256) and they were
treated as somewhat but not entirely equivalent. We retain the old
name as a deprecated alias so configuration files continue to work
as well as a reference in the man page for people looking for it.
bz#3303
* ssh(1)/ssh-add(1)/ssh-keygen(1): fix decoding of X.509 subject name
when extracting a key from a PKCS#11 certificate. bz#3327
* ssh(1): restore blocking status on stdio fds before close. ssh(1)
needs file descriptors in non-blocking mode to operate but it was
not restoring the original state on exit. This could cause
problems with fds shared with other programs via the shell,
bz#3280 and GHPR246
* ssh(1)/sshd(8): switch both client and server mainloops from
select(3) to pselect(3). Avoids race conditions where a signal
may arrive immediately before select(3) and not be processed until
an event fires. bz#2158
* ssh(1): sessions started with ControlPersist were incorrectly
executing a shell when the -N (no shell) option was specified.
bz#3290
* ssh(1): check if IPQoS or TunnelDevice are already set before
overriding. Prevents values in config files from overriding values
supplied on the command line. bz#3319
* ssh(1): fix debug message when finding a private key to match a
certificate being attempted for user authentication. Previously it
would print the certificate's path, whereas it was supposed to be
showing the private key's path. GHPR247
* sshd(8): match host certificates against host public keys, not
private keys. Allows use of certificates with private keys held in
a ssh-agent. bz#3524
* ssh(1): add a workaround for a bug in OpenSSH 7.4 sshd(8), which
allows RSA/SHA2 signatures for public key authentication but fails
to advertise this correctly via SSH2_MSG_EXT_INFO. This causes
clients of these server to incorrectly match
PubkeyAcceptedAlgorithmse and potentially refuse to offer valid
keys. bz#3213
* sftp(1)/scp(1): degrade gracefully if a sftp-server offers the
limits@openssh.com extension but fails when the client tries to
invoke it. bz#3318
* ssh(1): allow ssh_config SetEnv to override $TERM, which is
otherwise handled specially by the protocol. Useful in ~/.ssh/config
to set TERM to something generic (e.g. "xterm" instead of
"xterm-256color") for destinations that lack terminfo entries.
* sftp-server(8): the limits@openssh.com extension was incorrectly
marked as an operation that writes to the filesystem, which made it
unavailable in sftp-server read-only mode. bz#3318
* ssh(1): fix SEGV in UpdateHostkeys debug() message, triggered when
the update removed more host keys than remain present.
* Many manual page fixes.
- Additional changes from 8.6p1 release:
= Security
* sshd(8): OpenSSH 8.5 introduced the LogVerbose keyword. When this
option was enabled with a set of patterns that activated logging
in code that runs in the low-privilege sandboxed sshd process, the
log messages were constructed in such a way that printf(3) format
strings could effectively be specified the low-privilege code.
= New features
* sftp-server(8): add a new limits@openssh.com protocol extension
that allows a client to discover various server limits, including
maximum packet size and maximum read/write length.
* sftp(1): use the new limits@openssh.com extension (when available)
to select better transfer lengths in the client.
* sshd(8): Add ModuliFile keyword to sshd_config to specify the
location of the "moduli" file containing the groups for DH-GEX.
* unit tests: Add a TEST_SSH_ELAPSED_TIMES environment variable to
enable printing of the elapsed time in seconds of each test.
= Bugfixes
* ssh_config(5), sshd_config(5): sync CASignatureAlgorithms lists in
manual pages with the current default. GHPR174
* ssh(1): ensure that pkcs11_del_provider() is called before exit.
GHPR234
* ssh(1), sshd(8): fix problems in string->argv conversion. Multiple
backslashes were not being dequoted correctly and quoted space in
the middle of a string was being incorrectly split. GHPR223
* ssh(1): return non-zero exit status when killed by signal; bz#3281
* sftp-server(8): increase maximum SSH2_FXP_READ to match the maximum
packet size. Also handle zero-length reads that are not explicitly
banned by the spec.
- Additional changes from 8.5p1 release:
= Security
* ssh-agent(1): fixed a double-free memory corruption that was
introduced in OpenSSH 8.2 . We treat all such memory faults as
potentially exploitable. This bug could be reached by an attacker
with access to the agent socket.
= Potentially-incompatible changes
* ssh(1), sshd(8): this release changes the first-preference signature
algorithm from ECDSA to ED25519.
* ssh(1), sshd(8): set the TOS/DSCP specified in the configuration
for interactive use prior to TCP connect. The connection phase of
the SSH session is time-sensitive and often explicitly interactive.
The ultimate interactive/bulk TOS/DSCP will be set after
authentication completes.
* ssh(1), sshd(8): remove the pre-standardization cipher
rijndael-cbc@lysator.liu.se. It is an alias for aes256-cbc before
it was standardized in RFC4253 (2006), has been deprecated and
disabled by default since OpenSSH 7.2 (2016) and was only briefly
documented in ssh.1 in 2001.
* ssh(1), sshd(8): update/replace the experimental post-quantum
hybrid key exchange method based on Streamlined NTRU Prime coupled
with X25519. The previous sntrup4591761x25519-sha512@tinyssh.org
method is replaced with sntrup761x25519-sha512@openssh.com.
* ssh(1): disable CheckHostIP by default. It provides insignificant
benefits while making key rotation significantly more difficult,
especially for hosts behind IP-based load-balancers.
= New features
* ssh(1): this release enables UpdateHostkeys by default subject to
some conservative preconditions:
- The key was matched in the UserKnownHostsFile (and not in the
GlobalKnownHostsFile).
- The same key does not exist under another name.
- A certificate host key is not in use.
- known_hosts contains no matching wildcard hostname pattern.
- VerifyHostKeyDNS is not enabled.
- The default UserKnownHostsFile is in use.
* ssh(1), sshd(8): add a new LogVerbose configuration directive for
that allows forcing maximum debug logging by file/function/line
pattern-lists.
* ssh(1): when prompting the user to accept a new hostkey, display
any other host names/addresses already associated with the key.
* ssh(1): allow UserKnownHostsFile=none to indicate that no
known_hosts file should be used to identify host keys.
* ssh(1): add a ssh_config KnownHostsCommand option that allows the
client to obtain known_hosts data from a command in addition to
the usual files.
* ssh(1): add a ssh_config PermitRemoteOpen option that allows the
client to restrict the destination when RemoteForward is used
with SOCKS.
* ssh(1): for FIDO keys, if a signature operation fails with a
"incorrect PIN" reason and no PIN was initially requested from the
user, then request a PIN and retry the operation. This supports
some biometric devices that fall back to requiring PIN when reading
of the biometric failed, and devices that require PINs for all
hosted credentials.
* sshd(8): implement client address-based rate-limiting via new
sshd_config(5) PerSourceMaxStartups and PerSourceNetBlockSize
directives that provide more fine-grained control on a per-origin
address basis than the global MaxStartups limit.
= Bugfixes
* ssh(1): Prefix keyboard interactive prompts with "(user@host)" to
make it easier to determine which connection they are associated
with in cases like scp -3, ProxyJump, etc. bz#3224
* sshd(8): fix sshd_config SetEnv directives located inside Match
blocks. GHPR201
* ssh(1): when requesting a FIDO token touch on stderr, inform the
user once the touch has been recorded.
* ssh(1): prevent integer overflow when ridiculously large
ConnectTimeout values are specified, capping the effective value
(for most platforms) at 24 days. bz#3229
* ssh(1): consider the ECDSA key subtype when ordering host key
algorithms in the client.
* ssh(1), sshd(8): rename the PubkeyAcceptedKeyTypes keyword to
PubkeyAcceptedAlgorithms. The previous name incorrectly suggested
that it control allowed key algorithms, when this option actually
specifies the signature algorithms that are accepted. The previous
name remains available as an alias. bz#3253
* ssh(1), sshd(8): similarly, rename HostbasedKeyTypes (ssh) and
HostbasedAcceptedKeyTypes (sshd) to HostbasedAcceptedAlgorithms.
* sftp-server(8): add missing lsetstat@openssh.com documentation
and advertisement in the server's SSH2_FXP_VERSION hello packet.
* ssh(1), sshd(8): more strictly enforce KEX state-machine by
banning packet types once they are received. Fixes memleak caused
by duplicate SSH2_MSG_KEX_DH_GEX_REQUEST (oss-fuzz #30078).
* sftp(1): allow the full range of UIDs/GIDs for chown/chgrp on 32bit
platforms instead of being limited by LONG_MAX. bz#3206
* Minor man page fixes (capitalization, commas, etc.) bz#3223
* sftp(1): when doing an sftp recursive upload or download of a
read-only directory, ensure that the directory is created with
write and execute permissions in the interim so that the transfer
can actually complete, then set the directory permission as the
final step. bz#3222
* ssh-keygen(1): document the -Z, check the validity of its argument
earlier and provide a better error message if it's not correct.
bz#2879
* ssh(1): ignore comments at the end of config lines in ssh_config,
similar to what we already do for sshd_config. bz#2320
* sshd_config(5): mention that DisableForwarding is valid in a
sshd_config Match block. bz3239
* sftp(1): fix incorrect sorting of "ls -ltr" under some
circumstances. bz3248.
* ssh(1), sshd(8): fix potential integer truncation of (unlikely)
timeout values. bz#3250
* ssh(1): make hostbased authentication send the signature algorithm
in its SSH2_MSG_USERAUTH_REQUEST packets instead of the key type.
This make HostbasedAcceptedAlgorithms do what it is supposed to -
filter on signature algorithm and not key type.
- Rebased patches:
* openssh-7.7p1-IPv6_X_forwarding.patch
* openssh-7.7p1-X11_trusted_forwarding.patch
* openssh-7.7p1-X_forward_with_disabled_ipv6.patch
* openssh-7.7p1-cavstest-ctr.patch
* openssh-7.7p1-cavstest-kdf.patch
* openssh-7.7p1-disable_openssl_abi_check.patch
* openssh-7.7p1-eal3.patch
* openssh-7.7p1-enable_PAM_by_default.patch
* openssh-7.7p1-fips.patch
* openssh-7.7p1-fips_checks.patch
* openssh-7.7p1-host_ident.patch
* openssh-7.7p1-hostname_changes_when_forwarding_X.patch
* openssh-7.7p1-ldap.patch
* openssh-7.7p1-no_fork-no_pid_file.patch
* openssh-7.7p1-pam_check_locks.patch
* openssh-7.7p1-pts_names_formatting.patch
* openssh-7.7p1-remove_xauth_cookies_on_exit.patch
* openssh-7.7p1-seccomp_ipc_flock.patch
* openssh-7.7p1-seccomp_stat.patch
* openssh-7.7p1-send_locale.patch
* openssh-7.7p1-sftp_force_permissions.patch
* openssh-7.7p1-sftp_print_diagnostic_messages.patch
* openssh-7.7p1-systemd-notify.patch
* openssh-7.9p1-keygen-preserve-perms.patch
* openssh-7.9p1-revert-new-qos-defaults.patch
* openssh-8.0p1-gssapi-keyex.patch
* openssh-8.1p1-audit.patch
* openssh-8.1p1-seccomp-clock_gettime64.patch
* openssh-8.1p1-seccomp-clock_nanosleep.patch
* openssh-8.1p1-seccomp-clock_nanosleep_time64.patch
* openssh-8.1p1-use-openssl-kdf.patch
* openssh-8.4p1-vendordir.patch
* openssh-fips-ensure-approved-moduli.patch
* openssh-link-with-sk.patch
* openssh-reenable-dh-group14-sha1-default.patch
* openssh-whitelist-syscalls.patch
- Removed openssh-fix-ssh-copy-id.patch (fixed upstream).
OBS-URL: https://build.opensuse.org/request/show/922068
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=235
2021-10-07 10:06:58 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Tue Sep 28 19:05:15 UTC 2021 - Hans Petter Jansson <hpj@suse.com>
|
|
|
|
|
|
|
|
|
|
- Version upgrade to 8.8p1
|
|
|
|
|
* No changes for askpass, see main package changelog for
|
|
|
|
|
details
|
|
|
|
|
|
2020-09-18 19:44:52 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Thu Sep 17 20:41:39 UTC 2020 - Jan Engelhardt <jengelh@inai.de>
|
|
|
|
|
|
|
|
|
|
- Upgrade some old specfile constructs/macros.
|
|
|
|
|
|
2020-09-14 12:47:29 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Thu Sep 10 22:44:00 UTC 2020 - Hans Petter Jansson <hpj@suse.com>
|
|
|
|
|
|
|
|
|
|
- Supplement openssh-clients instead of openssh (bsc#1176434).
|
|
|
|
|
|
2019-07-22 18:43:06 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Thu Jul 18 14:07:56 UTC 2019 - Fabian Vogt <fvogt@suse.com>
|
|
|
|
|
|
|
|
|
|
- Supplement libgtk-3-0 instead to avoid installation on a textmode install
|
|
|
|
|
(boo#1142000)
|
|
|
|
|
|
2019-02-14 11:37:25 +01:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Thu Feb 14 10:36:03 UTC 2019 - Tomáš Chvátal <tchvatal@suse.com>
|
|
|
|
|
|
|
|
|
|
- Supplement the openssh and libx11 together to ensure this package
|
|
|
|
|
is installed on machines where there is X stack
|
|
|
|
|
|
2018-10-22 11:08:19 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Mon Oct 22 08:59:02 UTC 2018 - Pedro Monreal Gonzalez <pmonrealgonzalez@suse.com>
|
|
|
|
|
|
|
|
|
|
- Version update to 7.9p1
|
|
|
|
|
* No actual changes for the askpass
|
|
|
|
|
* See main package changelog for details
|
|
|
|
|
|
2018-10-17 10:57:56 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Tue Oct 9 10:52:15 UTC 2018 - Tomáš Chvátal <tchvatal@suse.com>
|
|
|
|
|
|
|
|
|
|
- Update to 7.8p1:
|
|
|
|
|
* no actual changes for the askpass
|
|
|
|
|
- Format with spec-cleaner
|
|
|
|
|
- Respect cflags
|
|
|
|
|
- Use gtk3 rather than gtk2 which is being phased out
|
|
|
|
|
|
2018-05-21 23:57:42 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Mon May 21 15:19:03 UTC 2018 - pcerny@suse.com
|
|
|
|
|
|
|
|
|
|
- Upgrade to 7.7p1 (bsc#1094068)
|
|
|
|
|
|
2018-02-01 01:18:29 +01:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Wed Jan 31 22:54:55 UTC 2018 - pcerny@suse.com
|
|
|
|
|
|
|
|
|
|
- .spec file cleanup
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Fri Nov 3 12:27:18 UTC 2017 - pcerny@suse.com
|
|
|
|
|
|
|
|
|
|
- upgrade to 7.6p1
|
|
|
|
|
see main package changelog for details
|
|
|
|
|
|
2016-07-25 15:47:29 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Mon Jul 25 13:45:53 UTC 2016 - meissner@suse.com
|
|
|
|
|
|
|
|
|
|
- fixed url
|
|
|
|
|
|
2016-05-30 03:36:18 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Sun Apr 17 23:27:51 UTC 2016 - pcerny@suse.com
|
|
|
|
|
|
|
|
|
|
- upgrade to 7.2p2
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Tue Feb 10 13:28:56 UTC 2015 - pcerny@suse.com
|
|
|
|
|
|
|
|
|
|
- changing license to 2-clause BSD to match source
|
|
|
|
|
|
2014-04-14 23:53:01 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Fri Apr 11 21:50:51 UTC 2014 - pcerny@suse.com
|
|
|
|
|
|
|
|
|
|
- Update of the underlying OpenSSH to 6.6p1
|
|
|
|
|
|
2014-02-14 15:54:10 +01:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Wed Feb 12 01:24:16 UTC 2014 - pcerny@suse.com
|
|
|
|
|
|
|
|
|
|
- Update of the underlying OpenSSH to 6.5p1
|
|
|
|
|
|
2014-01-31 13:18:41 +01:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Fri Jan 24 15:13:09 UTC 2014 - pcerny@suse.com
|
|
|
|
|
|
|
|
|
|
- Update of the underlying OpenSSH to 6.4p1
|
|
|
|
|
|
2013-08-05 09:15:19 +02:00
|
|
|
-------------------------------------------------------------------
|
2013-09-19 06:09:33 +02:00
|
|
|
Thu Sep 19 02:02:56 UTC 2013 - pcerny@suse.com
|
|
|
|
|
|
|
|
|
|
- spec file cleanup (don't pointelssly build whole OpenSSH)
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
2013-08-05 09:15:19 +02:00
|
|
|
Sat Aug 3 18:12:20 UTC 2013 - crrodriguez@opensuse.org
|
|
|
|
|
|
|
|
|
|
- Update for 6.2p2
|
|
|
|
|
|
2012-11-13 11:50:53 +01:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Tue Nov 13 10:51:12 UTC 2012 - meissner@suse.com
|
|
|
|
|
|
|
|
|
|
- Updated to 6.1p1, a bugfix release
|
|
|
|
|
Features:
|
|
|
|
|
* sshd(8): This release turns on pre-auth sandboxing sshd by default for
|
|
|
|
|
new installs, by setting UsePrivilegeSeparation=sandbox in sshd_config.
|
|
|
|
|
* ssh-keygen(1): Add options to specify starting line number and number of
|
|
|
|
|
lines to process when screening moduli candidates, allowing processing
|
|
|
|
|
of different parts of a candidate moduli file in parallel
|
|
|
|
|
* sshd(8): The Match directive now supports matching on the local (listen)
|
|
|
|
|
address and port upon which the incoming connection was received via
|
|
|
|
|
LocalAddress and LocalPort clauses.
|
|
|
|
|
* sshd(8): Extend sshd_config Match directive to allow setting AcceptEnv
|
|
|
|
|
and {Allow,Deny}{Users,Groups}
|
|
|
|
|
* Add support for RFC6594 SSHFP DNS records for ECDSA key types. bz#1978
|
|
|
|
|
* ssh-keygen(1): Allow conversion of RSA1 keys to public PEM and PKCS8
|
|
|
|
|
* sshd(8): Allow the sshd_config PermitOpen directive to accept "none" as
|
|
|
|
|
an argument to refuse all port-forwarding requests.
|
|
|
|
|
* sshd(8): Support "none" as an argument for AuthorizedPrincipalsFile
|
|
|
|
|
* ssh-keyscan(1): Look for ECDSA keys by default. bz#1971
|
|
|
|
|
* sshd(8): Add "VersionAddendum" to sshd_config to allow server operators
|
|
|
|
|
to append some arbitrary text to the server SSH protocol banner.
|
|
|
|
|
Bugfixes:
|
|
|
|
|
* ssh(1)/sshd(8): Don't spin in accept() in situations of file
|
|
|
|
|
descriptor exhaustion. Instead back off for a while.
|
|
|
|
|
* ssh(1)/sshd(8): Remove hmac-sha2-256-96 and hmac-sha2-512-96 MACs as
|
|
|
|
|
they were removed from the specification. bz#2023,
|
|
|
|
|
* sshd(8): Handle long comments in config files better. bz#2025
|
|
|
|
|
* ssh(1): Delay setting tty_flag so RequestTTY options are correctly
|
|
|
|
|
picked up. bz#1995
|
|
|
|
|
* sshd(8): Fix handling of /etc/nologin incorrectly being applied to root
|
|
|
|
|
on platforms that use login_cap.
|
|
|
|
|
Portable OpenSSH:
|
|
|
|
|
* sshd(8): Allow sshd pre-auth sandboxing to fall-back to the rlimit
|
|
|
|
|
sandbox from the Linux SECCOMP filter sandbox when the latter is
|
|
|
|
|
not available in the kernel.
|
|
|
|
|
* ssh(1): Fix NULL dereference when built with LDNS and using DNSSEC to
|
|
|
|
|
retrieve a CNAME SSHFP record.
|
|
|
|
|
* Fix cross-compilation problems related to pkg-config. bz#1996
|
|
|
|
|
|
2012-06-27 12:11:02 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Wed Jun 27 09:51:19 UTC 2012 - coolo@suse.com
|
|
|
|
|
|
|
|
|
|
- the gnome askpass does not require the x11 askpass - especially not
|
|
|
|
|
in the version of openssh (it's at 1.X)
|
|
|
|
|
|
2012-05-29 09:15:29 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Tue May 29 07:14:53 UTC 2012 - meissner@suse.com
|
|
|
|
|
|
|
|
|
|
- use correct tarball url
|
|
|
|
|
- update to 6.0p1.
|
|
|
|
|
|
2012-03-30 16:20:49 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Wed Mar 28 11:42:32 UTC 2012 - aj@suse.de
|
|
|
|
|
|
|
|
|
|
- Add build require on autoconf and automake.
|
|
|
|
|
|
2011-12-21 18:59:28 +01:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Wed Dec 21 10:31:42 UTC 2011 - coolo@suse.com
|
|
|
|
|
|
|
|
|
|
- remove call to suse_update_config (very old work around)
|
|
|
|
|
|
2011-10-19 04:18:13 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Wed Oct 19 00:40:15 UTC 2011 - pcerny@suse.com
|
|
|
|
|
|
|
|
|
|
- Update to 5.9p1
|
|
|
|
|
|
2011-02-04 14:58:22 +01:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Fri Feb 4 11:19:14 UTC 2011 - lchiquitto@novell.com
|
|
|
|
|
|
|
|
|
|
- Update to 5.8p1
|
|
|
|
|
|
2011-01-31 13:24:57 +01:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Mon Jan 24 11:51:10 UTC 2011 - lchiquitto@novell.com
|
|
|
|
|
|
|
|
|
|
- Update to 5.7p1
|
|
|
|
|
|
2011-01-14 01:30:23 +01:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Wed Jan 12 13:37:38 CET 2011 - sbrabec@suse.cz
|
|
|
|
|
|
|
|
|
|
- Removed relics of no more implemented opensc support.
|
|
|
|
|
|
2010-08-24 17:31:11 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Tue Aug 24 15:50:17 CEST 2010 - anicka@suse.cz
|
|
|
|
|
|
|
|
|
|
- update to 5.6p1
|
|
|
|
|
|
2010-03-26 16:29:14 +01:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Fri Mar 26 11:04:59 CET 2010 - anicka@suse.cz
|
|
|
|
|
|
|
|
|
|
- update to 5.4p1
|
|
|
|
|
- remove -pam-fix4.diff (in upstream now)
|
|
|
|
|
|
2009-03-03 22:42:45 +01:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Mon Feb 23 17:27:22 CET 2009 - anicka@suse.cz
|
|
|
|
|
|
|
|
|
|
- update to 5.2p1
|
|
|
|
|
|
2008-04-09 22:21:23 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Wed Apr 9 14:35:42 CEST 2008 - anicka@suse.cz
|
|
|
|
|
|
|
|
|
|
- update to 5.0p1
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Wed Apr 2 15:06:01 CEST 2008 - anicka@suse.cz
|
|
|
|
|
|
|
|
|
|
- update to 4.9p1
|
|
|
|
|
|
2007-12-06 16:29:46 +01:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Wed Dec 5 10:56:07 CET 2007 - anicka@suse.cz
|
|
|
|
|
|
|
|
|
|
- - update to 4.7p1
|
|
|
|
|
* Add "-K" flag for ssh to set GSSAPIAuthentication=yes and
|
|
|
|
|
GSSAPIDelegateCredentials=yes. This is symmetric with -k
|
|
|
|
|
* make scp try to skip FIFOs rather than blocking when nothing is
|
|
|
|
|
listening.
|
|
|
|
|
* increase default channel windows
|
|
|
|
|
* put the MAC list into a display
|
|
|
|
|
* many bugfixes
|
|
|
|
|
|
2007-01-07 17:26:05 +01:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Tue Dec 12 14:44:41 CET 2006 - anicka@suse.cz
|
|
|
|
|
|
|
|
|
|
- update to 4.5p1
|
|
|
|
|
* Use privsep_pw if we have it, but only require it if we
|
|
|
|
|
absolutely need it.
|
|
|
|
|
* Correctly check for bad signatures in the monitor, otherwise
|
|
|
|
|
the monitor and the unpriv process can get out of sync.
|
|
|
|
|
* Clear errno before calling the strtol functions.
|
|
|
|
|
* exit instead of doing a blocking tcp send if we detect
|
|
|
|
|
a client/server timeout, since the tcp sendqueue might
|
|
|
|
|
be already full (of alive requests)
|
|
|
|
|
* include signal.h, errno.h, sys/in.h
|
|
|
|
|
* some more bugfixes
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Wed Oct 4 12:56:40 CEST 2006 - postadal@suse.cz
|
|
|
|
|
|
|
|
|
|
- updated to version 4.4p1 [#208662]
|
|
|
|
|
* fixed pre-authentication DoS, that would cause sshd(8) to spin
|
|
|
|
|
until the login grace time expired
|
|
|
|
|
* fixed unsafe signal hander, which was vulnerable to a race condition
|
|
|
|
|
that could be exploited to perform a pre-authentication DoS
|
|
|
|
|
* fixed a GSSAPI authentication abort that could be used to determine
|
|
|
|
|
the validity of usernames on some platforms
|
|
|
|
|
* implemented conditional configuration in sshd_config(5) using the
|
|
|
|
|
"Match" directive
|
|
|
|
|
* added support for Diffie-Hellman group exchange key agreement with a
|
|
|
|
|
final hash of SHA256
|
|
|
|
|
* added a "ForceCommand", "PermitOpen" directive to sshd_config(5)
|
|
|
|
|
* added optional logging of transactions to sftp-server(8)
|
|
|
|
|
* ssh(1) will now record port numbers for hosts stored in
|
|
|
|
|
~/.ssh/authorized_keys when a non-standard port has been requested
|
|
|
|
|
* added an "ExitOnForwardFailure" option to cause ssh(1) to exit (with
|
|
|
|
|
a non-zero exit code) when requested port forwardings could not be
|
|
|
|
|
established
|
|
|
|
|
* extended sshd_config(5) "SubSystem" declarations to allow the
|
|
|
|
|
specification of command-line arguments
|
|
|
|
|
- removed obsoleted patches: autoconf-fix.patch
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Tue Jul 25 13:40:10 CEST 2006 - schwab@suse.de
|
|
|
|
|
|
|
|
|
|
- Fix syntax error in configure script.
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Wed Jan 25 21:39:06 CET 2006 - mls@suse.de
|
|
|
|
|
|
|
|
|
|
- converted neededforbuild to BuildRequires
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Tue Jan 3 15:54:49 CET 2006 - postadal@suse.cz
|
|
|
|
|
|
|
|
|
|
- updated to version 4.2p1
|
|
|
|
|
- removed obsoleted patches: upstream_fixes.diff, gssapi-secfix.patch
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Thu Sep 8 16:20:06 CEST 2005 - postadal@suse.cz
|
|
|
|
|
|
|
|
|
|
- don't strip
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Thu Aug 4 11:30:18 CEST 2005 - uli@suse.de
|
|
|
|
|
|
|
|
|
|
- parallelize build
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Fri Jun 10 16:24:22 CEST 2005 - postadal@suse.cz
|
|
|
|
|
|
|
|
|
|
- updated to version 4.1p1
|
|
|
|
|
- removed obsoleted patches: restore_terminal, pam-returnfromsession,
|
|
|
|
|
timing-attacks-fix, krb5ccname, gssapi-pam, logdenysource,
|
|
|
|
|
sendenv-fix, documentation-fix
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Wed Jan 19 18:25:29 CET 2005 - postadal@suse.cz
|
|
|
|
|
|
|
|
|
|
- renamed askpass-gnome package to openssh-askpass-gnome
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Wed Jan 19 15:58:07 CET 2005 - postadal@suse.cz
|
|
|
|
|
|
|
|
|
|
- splited spec file to decreas number of build dependencies
|
|
|
|
|
|
