SHA256
1
0
forked from pool/openssh
Commit Graph

141 Commits

Author SHA256 Message Date
Tomáš Chvátal
c159d0ce66 - Disable ssh1 protocol support as neither RH or Debian enable
this protocol by default anymore either.

OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=154
2018-10-17 09:24:31 +00:00
Tomáš Chvátal
7bccbbd821 Accepting request 642573 from home:scarabeus_iv:branches:network
- Update to 7.8p1:
  * no actual changes for the askpass
- Format with spec-cleaner
- Respect cflags
- Use gtk3 rather than gtk2 which is being phased out

- Remove the mention of the SLE12 in the README.SUSE
- Install firewall rules only when really needed (<SLE15)

- Version update to 7.8p1:
  * For most details see release notes file
  * ssh-keygen(1): write OpenSSH format private keys by default
    instead of using OpenSSL's PEM format
- Rebase patches to apply on 7.8p1 release:
  * openssh-7.7p1-fips.patch
  * openssh-7.7p1-cavstest-kdf.patch
  * openssh-7.7p1-fips_checks.patch
  * openssh-7.7p1-gssapi_key_exchange.patch
  * openssh-7.7p1-audit.patch
  * openssh-7.7p1-openssl_1.1.0.patch
  * openssh-7.7p1-ldap.patch
  * openssh-7.7p1-IPv6_X_forwarding.patch
  * openssh-7.7p1-sftp_print_diagnostic_messages.patch
  * openssh-7.7p1-disable_short_DH_parameters.patch
  * openssh-7.7p1-hostname_changes_when_forwarding_X.patch
  * openssh-7.7p1-pam_check_locks.patch
  * openssh-7.7p1-seed-prng.patch
  * openssh-7.7p1-systemd-notify.patch
  * openssh-7.7p1-X11_trusted_forwarding.patch
- Dropped patches:

OBS-URL: https://build.opensuse.org/request/show/642573
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=153
2018-10-17 08:57:56 +00:00
f56a5ff67f Accepting request 636347 from home:Andreas_Schwab:Factory
- seccomp_filter sandbox is not supported on ppc

OBS-URL: https://build.opensuse.org/request/show/636347
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=151
2018-09-21 09:56:44 +00:00
Ismail Dönmez
3a2700bb0a Accepting request 631714 from home:scarabeus_iv:branches:network
- Depend explicitly on zlib-devel, previously pulled in by openssl

OBS-URL: https://build.opensuse.org/request/show/631714
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=149
2018-08-27 09:51:09 +00:00
4d4a31fec0 Accepting request 619019 from home:AndreasStieger:branches:network
- BuildRequire pkgconfig(krb5) instead of krb5-mini-devel to ensure
  zypper si can pick a resolvable provider. Build cycle remains
  solved via project config pulling in -mini. (bsc#1099044)

OBS-URL: https://build.opensuse.org/request/show/619019
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=147
2018-07-04 07:19:08 +00:00
Petr Cerny
223282b58f Accepting request 611002 from home:pcerny:factory
- Upgrade to 7.7p1 (bsc#1094068)

- Upgrade to 7.7p1 (bsc#1094068)
  Most important changes (more details below):
  * Drop compatibility support for pre-2001 SSH implementations
  * sshd(1) does not load DSA keys by default
  Distilled upstream log:
  ---- Potentially-incompatible changes
  * ssh(1)/sshd(8): Drop compatibility support for some very old
    SSH implementations, including ssh.com <=2.* and OpenSSH <=
    3.*.  These versions were all released in or before 2001 and
    predate the final SSH RFCs. The support in question isn't
    necessary for RFC-compliant SSH implementations.
  ---- New Features
  * experimental support for PQC XMSS keys (Extended Hash-Based
    Signatures), not compiled in by default.
  * sshd(8): Add a "rdomain" criteria for the sshd_config Match
    keyword to allow conditional configuration that depends on
    which routing domain a connection was received on (currently
    supported on OpenBSD and Linux).
  * sshd_config(5): Add an optional rdomain qualifier to the
    ListenAddress directive to allow listening on different
    routing domains. This is supported only on OpenBSD and Linux
    at present.
  * sshd_config(5): Add RDomain directive to allow the
    authenticated session to be placed in an explicit routing
    domain. This is only supported on OpenBSD at present.
  * sshd(8): Add "expiry-time" option for authorized_keys files
    to allow for expiring keys.
  * ssh(1): Add a BindInterface option to allow binding the

OBS-URL: https://build.opensuse.org/request/show/611002
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=145
2018-05-21 21:57:42 +00:00
Petr Cerny
5e850f6d73 Accepting request 602971 from home:dimstar:Factory
- Use TIRPC on suse_version >= 1500: sunrpc is deprecated and
  should be replaced by TIRPC.

This has several effects:
* We get RPC support back... from build log in oS:F/standard:

[   48s] checking rpc/types.h usability... no
[   48s] checking rpc/types.h presence... no
[   48s] checking for rpc/types.h... no

vs this branch:
[   50s] checking rpc/types.h usability... yes
[   50s] checking rpc/types.h presence... yes
[   50s] checking for rpc/types.h... yes

AND as a side-effect, FALSE for ldapbody.c is now defined (not the
  nicest of side-effects, but seems that ldap patch relies on RPC
  headers to be included.

So all in all: this fixes the build failures for openSUSE Tumblewee

OBS-URL: https://build.opensuse.org/request/show/602971
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=143
2018-05-02 12:05:42 +00:00
Petr Cerny
67804a0124 Accepting request 602709 from home:pcerny:factory
- additional rebased patches (bsc#1080779)
  * auditing support
  * LDAP integration
  * various distribution tweaks from SLE12 
    (X forwarding over IPv6, sftp forced permissions
     and verbose batch mode)

OBS-URL: https://build.opensuse.org/request/show/602709
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=142
2018-04-30 23:44:41 +00:00
OBS User mrdocs
731c398148 Accepting request 593522 from home:kukuk:branches:network
- Use %license instead of %doc [bsc#1082318]

OBS-URL: https://build.opensuse.org/request/show/593522
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=140
2018-04-06 04:49:00 +00:00
01100ac5fc OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=138 2018-03-05 16:42:43 +00:00
f82cf6b5da (update tracker: bsc#1080779)
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=137
2018-03-05 16:40:33 +00:00
Petr Cerny
0a67e4f87e Accepting request 575957 from home:pcerny:factory
- add OpenSSL 1.0 to 1.1 shim to remove dependency on old OpenSSL

OBS-URL: https://build.opensuse.org/request/show/575957
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=136
2018-02-12 23:48:52 +00:00
OBS User mrdocs
2baed0da9e Accepting request 566484 from home:dimstar:Factory
- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  allow the scheduler to pick systemd-mini flavors to get build
  going.


I shortened the diff, to have less conversation topics - this part should be undisputed

OBS-URL: https://build.opensuse.org/request/show/566484
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=132
2018-01-21 05:39:42 +00:00
Petr Cerny
d8a13def71 Accepting request 563833 from home:pcerny:factory
- Replace forgotten references to /var/adm/fillup-templates
  with new %_fillupdir macro (boo#1069468)
- tighten configuration access rights

OBS-URL: https://build.opensuse.org/request/show/563833
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=130
2018-01-12 12:57:27 +00:00
Petr Cerny
13e1fadf84 Accepting request 563725 from home:pcerny:factory
reworking packaging, gssapi kex patch

OBS-URL: https://build.opensuse.org/request/show/563725
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=129
2018-01-12 00:48:48 +00:00
Petr Cerny
a03a137de1 Accepting request 563724 from home:pcerny:factory
reworking packaging, gssapi kex patch

OBS-URL: https://build.opensuse.org/request/show/563724
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=128
2018-01-12 00:42:53 +00:00
Petr Cerny
b813991fe5 Accepting request 551548 from home:pcerny:factory
- upgrade to 7.6p1
  see main package changelog for details

- Replace references to /var/adm/fillup-templates with new 
  %_fillupdir macro (boo#1069468)

- Update to vanilla 7.6p1
  Most important changes (more details below):
  * complete removal of the ancient SSHv1 protocol
  * sshd(8) cannot run without privilege separation
  * removal of suport for arcfourm blowfish and CAST ciphers
    and RIPE-MD160 HMAC
  * refuse RSA keys shorter than 1024 bits
  Distilled upstream log:
- OpenSSH 7.3
  ---- Security
  * sshd(8): Mitigate a potential denial-of-service attack
    against the system's crypt(3) function via sshd(8). An
    attacker could send very long passwords that would cause
    excessive CPU use in crypt(3). sshd(8) now refuses to accept
    password authentication requests of length greater than 1024
    characters. Independently reported by Tomas Kuthan (Oracle),
    Andres Rojas and Javier Nieto.
  * sshd(8): Mitigate timing differences in password
    authentication that could be used to discern valid from
    invalid account names when long passwords were sent and
    particular password hashing algorithms are in use on the
    server. CVE-2016-6210, reported by EddieEzra.Harari at
    verint.com
  * ssh(1), sshd(8): Fix observable timing weakness in the CBC

OBS-URL: https://build.opensuse.org/request/show/551548
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=127
2017-12-05 12:47:07 +00:00
Petr Cerny
ad9209ae06 Accepting request 547285 from home:pcerny:factory-temp
temporarily downgrading to 7.2p2 to run tests on additional 7.2p2 patches

OBS-URL: https://build.opensuse.org/request/show/547285
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=126
2017-12-01 22:12:05 +00:00
Petr Cerny
56e0af8154 Accepting request 547144 from home:pcerny:factory
temporarily downgrading to 7.2p2 to run tests on additional 7.2p2 patches

OBS-URL: https://build.opensuse.org/request/show/547144
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=124
2017-12-01 15:03:13 +00:00
3a77b6ed2a Accepting request 544667 from home:RBrownSUSE:branches:network
Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468)

OBS-URL: https://build.opensuse.org/request/show/544667
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=123
2017-11-24 10:22:32 +00:00
Petr Cerny
d83100ae13 Accepting request 539322 from home:pcerny:factory
- upgrade to 7.6p1
  see main package changelog for details

- Update to vanilla 7.6p1
  Most important changes (more details below):
  * complete removal of the ancient SSHv1 protocol
  * sshd(8) cannot run without privilege separation
  * removal of suport for arcfourm blowfish and CAST ciphers
    and RIPE-MD160 HMAC
  * refuse RSA keys shorter than 1024 bits
  Distilled upstream log:
- OpenSSH 7.3
  ---- Security
  * sshd(8): Mitigate a potential denial-of-service attack
    against the system's crypt(3) function via sshd(8). An
    attacker could send very long passwords that would cause
    excessive CPU use in crypt(3). sshd(8) now refuses to accept
    password authentication requests of length greater than 1024
    characters. Independently reported by Tomas Kuthan (Oracle),
    Andres Rojas and Javier Nieto.
  * sshd(8): Mitigate timing differences in password
    authentication that could be used to discern valid from
    invalid account names when long passwords were sent and
    particular password hashing algorithms are in use on the
    server. CVE-2016-6210, reported by EddieEzra.Harari at
    verint.com
  * ssh(1), sshd(8): Fix observable timing weakness in the CBC
    padding oracle countermeasures. Reported by Jean Paul
    Degabriele, Kenny Paterson, Torben Hansen and Martin
    Albrecht. Note that CBC ciphers are disabled by default and

OBS-URL: https://build.opensuse.org/request/show/539322
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=122
2017-11-06 14:50:53 +00:00
c84af5da00 Accepting request 536578 from home:jsegitz:branches:network
- sshd_config is has now permissions 0600 in secure mode

OBS-URL: https://build.opensuse.org/request/show/536578
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=120
2017-10-26 10:23:16 +00:00
Petr Cerny
e8b9919265 Accepting request 500279 from home:pcerny:factory
- Fix preauth seccomp separation on mainframes (bsc#1016709)
  [openssh-7.2p2-s390_hw_crypto_syscalls.patch]
  [openssh-7.2p2-s390_OpenSSL-ibmpkcs11_syscalls.patch]
- enable case-insensitive hostname matching (bsc#1017099)
  [openssh-7.2p2-ssh_case_insensitive_host_matching.patch]
- add CAVS tests 
  [openssh-7.2p2-cavstest-ctr.patch]
  [openssh-7.2p2-cavstest-kdf.patch]
- Adding missing pieces for user matching (bsc#1021626)
- Properly verify CIDR masks in configuration
  (bsc#1005893)
  [openssh-7.2p2-verify_CIDR_address_ranges.patch]
- Remove pre-auth compression support from the server to prevent
  possible cryptographic attacks.
  (CVE-2016-10012, bsc#1016370)
  [openssh-7.2p2-disable_preauth_compression.patch]
- limit directories for loading PKCS11 modules
  (CVE-2016-10009, bsc#1016366)
  [openssh-7.2p2-restrict_pkcs11-modules.patch]
- Prevent possible leaks of host private keys to low-privilege
  process handling authentication
  (CVE-2016-10011, bsc#1016369)
  [openssh-7.2p2-prevent_private_key_leakage.patch]
- Do not allow unix socket forwarding when running without
  privilege separation
  (CVE-2016-10010, bsc#1016368)
  [openssh-7.2p2-secure_unix_sockets_forwarding.patch]
- prevent resource depletion during key exchange
  (bsc#1005480, CVE-2016-8858)
  [openssh-7.2p2-kex_resource_depletion.patch]

OBS-URL: https://build.opensuse.org/request/show/500279
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=117
2017-05-31 23:09:14 +00:00
5829a44f01 Accepting request 459897 from home:elvigia:branches:network
- sshd.service: Set TasksMax=infinity, as there should be
  no limit on the amount of tasks sshd can run.

OBS-URL: https://build.opensuse.org/request/show/459897
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=115
2017-03-01 11:01:26 +00:00
Petr Cerny
6c861e0b33 Accepting request 433779 from home:pcerny:factory
- remaining patches that were still missing
  since the update to 7.2p2 (FATE#319675):
  [openssh-7.2p2-disable_openssl_abi_check.patch]
- fix forwarding with IPv6 addresses in DISPLAY (bnc#847710)
  [openssh-7.2p2-IPv6_X_forwarding.patch]
- ignore PAM environment when using login
  (bsc#975865, CVE-2015-8325)
  [openssh-7.2p2-ignore_PAM_with_UseLogin.patch]
- limit accepted password length (prevents possible DoS)
  (bsc#992533, CVE-2016-6515)
  [openssh-7.2p2-limit_password_length.patch]
- Prevent user enumeration through the timing of password
  processing (bsc#989363, CVE-2016-6210)
  [openssh-7.2p2-prevent_timing_user_enumeration.patch]
- Add auditing for PRNG re-seeding
  [openssh-7.2p2-audit_seed_prng.patch]

OBS-URL: https://build.opensuse.org/request/show/433779
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=113
2016-10-07 15:57:29 +00:00
Petr Cerny
fe873a1c10 Accepting request 432093 from home:pcerny:factory
next round of patches
- allow X forwarding over IPv4 when IPv6 sockets is not available
  [openssh-7.2p2-X_forward_with_disabled_ipv6.patch]
- do not write PID file when not daemonizing
  [openssh-7.2p2-no_fork-no_pid_file.patch]
- use correct options when invoking login
  [openssh-7.2p2-login_options.patch]
- helper application for retrieving users' public keys from
  an LDAP server
  [openssh-7.2p2-ldap.patch]
- allow forcing permissions over sftp
  [openssh-7.2p2-sftp_force_permissions.patch]
- do not perform run-time checks for OpenSSL API/ABI change
  [openssh-7.2p2-disable-openssl-abi-check.patch]
- suggest commands for cleaning known hosts file
  [openssh-7.2p2-host_ident.patch]
- sftp home chroot patch
  [openssh-7.2p2-sftp_homechroot.patch]
- ssh sessions auditing
  [openssh-7.2p2-audit.patch]
- enable seccomp sandbox on additional architectures
  [openssh-7.2p2-additional_seccomp_archs.patch]

OBS-URL: https://build.opensuse.org/request/show/432093
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=112
2016-09-30 20:34:19 +00:00
Petr Cerny
e0d7fb0744 Accepting request 428544 from home:pcerny:factory
- FIPS compatibility (no selfchecks, only crypto restrictions)
  [openssh-7.2p2-fips.patch]
- PRNG re-seeding
  [openssh-7.2p2-seed-prng.patch]
- preliminary version of GSSAPI KEX
  [openssh-7.2p2-gssapi_key_exchange.patch]

OBS-URL: https://build.opensuse.org/request/show/428544
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=110
2016-09-18 23:04:18 +00:00
a412ed9d8d - fixed url, added gpg signature
- added gpg signature and keyring from 
  http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh_gzsig_key.pub

OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=108
2016-07-25 13:47:29 +00:00
Petr Cerny
6dac324cb7 Accepting request 407066 from home:pcerny:factory
- enable support for SSHv1 protocol and discourage its usage
  (bsc#983307)
- enable DSA by default for backward compatibility and discourage
  its usage (bsc#983784)
  [openssh-7.2p2-allow_DSS_by_default.patch]

- upgrade to 7.2p2
  upstream package without any SUSE patches
  Distilled upstream log:
- OpenSSH 6.7
  Potentially-incompatible changes:
  * sshd(8): The default set of ciphers and MACs has been
    altered to remove unsafe algorithms. In particular, CBC
    ciphers and arcfour* are disabled by default.
    The full set of algorithms remains available if configured
    explicitly via the Ciphers and MACs sshd_config options.
  * sshd(8): Support for tcpwrappers/libwrap has been removed.
  * OpenSSH 6.5 and 6.6 have a bug that causes ~0.2% of
    connections using the curve25519-sha256@libssh.org KEX
    exchange method to fail when connecting with something that
    implements the specification correctly. OpenSSH 6.7 disables
    this KEX method when speaking to one of the affected
    versions.
  New Features:
  * ssh(1), sshd(8): Add support for Unix domain socket
    forwarding. A remote TCP port may be forwarded to a local
    Unix domain socket and vice versa or both ends may be a Unix
    domain socket.
  * ssh(1), ssh-keygen(1): Add support for SSHFP DNS records for
    ED25519 key types.

OBS-URL: https://build.opensuse.org/request/show/407066
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=107
2016-07-07 07:07:23 +00:00
Petr Cerny
b22c39e677 Accepting request 398992 from home:pcerny:factory
OBS-URL: https://build.opensuse.org/request/show/398992
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=106
2016-05-30 15:53:09 +00:00
Petr Cerny
5093e42eaa Accepting request 398802 from home:pcerny:factory
- upgrade to 7.2p2

- changing license to 2-clause BSD to match source

- enable trusted X11 forwarding by default
  [-X11_trusted_forwarding]
- set UID for lastlog properly [-lastlog]
- enable use of PAM by default [-enable_PAM_by_default]
- copy command line arguments properly [-saveargv-fix]
- do not use pthreads in PAM code [-dont_use_pthreads_in_PAM]
- fix paths in documentation [-eal3]
- prevent race consitions triggered by SIGALRM [-blocksigalrm]
- do send and accept locale environment variables by default
  [-send_locale]
- handle hostnames changes during X forwarding
  [-hostname_changes_when_forwarding_X]
- try to remove xauth cookies on exit
  [-remove_xauth_cookies_on_exit]
- properly format pts names for ?tmp? log files
  [-pts_names_formatting]
- check locked accounts when using PAM [-pam_check_locks]
- chenge default PermitRootLogin to 'yes' to prevent unwanted
  surprises on updates from older versions.
  See README.SUSE for details
  [-allow_root_password_login]
- Disable DH parameters under 2048 bits by default and allow
  lowering the limit back to the RFC 4419 specified minimum
  through an option (bsc#932483, bsc#948902)
  [-disable_short_DH_parameters]
- Add getuid() and stat() syscalls to the seccomp filter

OBS-URL: https://build.opensuse.org/request/show/398802
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=103
2016-05-30 01:36:18 +00:00
Petr Cerny
252ed8ae18 Accepting request 392909 from home:pcerny:factory
fix broken seccomp sandbox

OBS-URL: https://build.opensuse.org/request/show/392909
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=101
2016-04-29 16:34:58 +00:00
13651d3d21 restore factory state, so we can fix bugs.
old stuff is still in the old revisions

OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=98
2016-04-06 11:34:51 +00:00
Petr Cerny
c818e705ca bothed update, DO NOT TOUCH UNITL PROPERLY REVIEWED
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=97
2016-02-17 19:00:04 +00:00
Petr Cerny
b83f96744f Accepting request 358392 from home:elvigia:branches:network
- openssh-alloc_size.patch: anotate xmalloc.h with alloc_size
 attribute so the compiler knows these functions allocate memory
 so overflow or misuse can be detected sooner.
- openssh-allow_getrandom.patch; allow the getrandom(2) system
  call in the seccomp sandbox, upstream commit 26ad18247213
- openssh-fix-b64_xx-detection.patch: configure.ac has incorrect
  tests for b64_ntop, b64_pton on linux/glibc.

OBS-URL: https://build.opensuse.org/request/show/358392
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=96
2016-02-10 15:40:35 +00:00
Ismail Dönmez
642f5e8889 Accepting request 354941 from home:scarabeus_iv:branches:network
- Cleanup with spec-cleaner
- Update of the master OpenSSH to 7.1p2

- Take refreshed and updated audit patch from redhat
  * Remove our old patches:
    + openssh-6.6p1-audit1-remove_duplicit_audit.patch
    + openssh-6.6p1-audit2-better_audit_of_user_actions.patch
    + openssh-6.6p1-audit3-key_auth_usage-fips.patch
    + openssh-6.6p1-audit3-key_auth_usage.patch
    + openssh-6.6p1-audit4-kex_results-fips.patch
    + openssh-6.6p1-audit4-kex_results.patch
    + openssh-6.6p1-audit5-session_key_destruction.patch
    + openssh-6.6p1-audit6-server_key_destruction.patch
    + openssh-6.6p1-audit7-libaudit_compat.patch
    + openssh-6.6p1-audit8-libaudit_dns_timeouts.patch
  * add openssh-6.7p1-audit.patch
- Reenable the openssh-6.6p1-ldap.patch
- Update the fips patch from RH build openssh-6.6p1-fips.patch
- Update and refresh openssh-6.6p1-gssapi_key_exchange.patch
- Remove fips-check patch as it is merged to fips patch
  * openssh-6.6p1-fips-checks.patch
- Rebase and enable chroot patch:
  * openssh-6.6p1-sftp_homechroot.patch
- Reenable rebased patch for linux seed:
  * openssh-6.6p1-seed-prng.patch
- Reenable key converting patch:
  * openssh-6.6p1-key-converter.patch

- Version update to 7.1p2:
  * various upstream bugfixes and cleanups

OBS-URL: https://build.opensuse.org/request/show/354941
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=95
2016-01-21 07:28:30 +00:00
Ismail Dönmez
1c5ff2cc6c Accepting request 353717 from home:AndreasStieger:branches:network
Security update for OpenSSH
CVE-2016-0777, bsc#961642, CVE-2016-0778, bsc#961645
https://lists.mindrot.org/pipermail/openssh-unix-announce/2016-January/000124.html

OBS-URL: https://build.opensuse.org/request/show/353717
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=93
2016-01-14 16:36:52 +00:00
d9f8a6a210 OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=91 2015-01-12 10:45:13 +00:00
a86956def1 - gpg signature and keyring added.
pub  3200R/6D920D30 2013-12-10 [expires: 2021-01-01]
  uid                            Damien Miller <djm@mindrot.org>
  sub  3200R/672A1105 2013-12-10 [expires: 2021-01-01]

OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=90
2015-01-12 10:35:52 +00:00
Petr Cerny
9913e17746 Accepting request 241774 from home:posophe:branches:network
Do not depend on insserv if the package build with systemd support;
  it's useless

OBS-URL: https://build.opensuse.org/request/show/241774
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=84
2014-07-21 16:02:23 +00:00
Petr Cerny
4187c8a645 Accepting request 234473 from home:elvigia:branches:network
- Remove tcpwrappers support now, This feature was removed
  in upstream code at the end of April and the underlying
  libraries are abandonware.
  See: http://comments.gmane.org/gmane.linux.suse.general/348119

OBS-URL: https://build.opensuse.org/request/show/234473
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=82
2014-05-19 10:15:21 +00:00
Petr Cerny
9fb40d132b Accepting request 231427 from home:pcerny:factory
- curve25519 key exchange fix (-curve25519-6.6.1p1.patch)
- patch re-ordering (-audit3-key_auth_usage-fips.patch,
    -audit4-kex_results-fips.patch)

OBS-URL: https://build.opensuse.org/request/show/231427
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=80
2014-04-25 13:11:58 +00:00
Andrey Karepin
4dd2bec462 Accepting request 230928 from home:namtrac:bugfix
- Add fix-curve25519-kex.patch to fix a key-exchange problem
  with curve25519-sha256@libssh.org, see
  http://marc.info/?l=openssh-unix-dev&m=139797807804698&w=2

OBS-URL: https://build.opensuse.org/request/show/230928
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=79
2014-04-24 10:08:13 +00:00
Petr Cerny
5b66f43acd Accepting request 230167 from home:rhafer:branches:network
OBS-URL: https://build.opensuse.org/request/show/230167
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=77
2014-04-15 11:28:24 +00:00
Petr Cerny
efb05e6527 Accepting request 230097 from home:pcerny:factory
- Update of the underlying OpenSSH to 6.6p1

- update to 6.6p1
  Security:
  * sshd(8): when using environment passing with a sshd_config(5)
    AcceptEnv pattern with a wildcard. OpenSSH prior to 6.6 could
    be tricked into accepting any enviornment variable that
    contains the characters before the wildcard character.
  Features since 6.5p1:
  * ssh(1), sshd(8): removal of the J-PAKE authentication code,
    which was experimental, never enabled and has been
    unmaintained for some time.
  * ssh(1): skip 'exec' clauses other clauses predicates failed
    to match while processing Match blocks.
  * ssh(1): if hostname canonicalisation is enabled and results
    in the destination hostname being changed, then re-parse
    ssh_config(5) files using the new destination hostname. This
    gives 'Host' and 'Match' directives that use the expanded
    hostname a chance to be applied.
  Bugfixes:
  * ssh(1): avoid spurious "getsockname failed: Bad file
    descriptor" in ssh -W. bz#2200, debian#738692
  * sshd(8): allow the shutdown(2) syscall in seccomp-bpf and
    systrace sandbox modes, as it is reachable if the connection
    is terminated during the pre-auth phase.
  * ssh(1), sshd(8): fix unsigned overflow that in SSH protocol 1
    bignum parsing. Minimum key length checks render this bug
    unexploitable to compromise SSH 1 sessions.
  * sshd_config(5): clarify behaviour of a keyword that appears
    in multiple matching Match blocks. bz#2184

OBS-URL: https://build.opensuse.org/request/show/230097
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=76
2014-04-14 21:53:01 +00:00
Petr Cerny
5d4cc441c8 Accepting request 226334 from home:pcerny:factory
- re-enabling the GSSAPI Key Exchange patch 
!!! currently breaks anythng else than Factory

OBS-URL: https://build.opensuse.org/request/show/226334
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=72
2014-03-17 02:46:40 +00:00
Petr Cerny
25f021b853 Accepting request 224302 from home:pcerny:factory
- re-enabling FIPS-enablement patch
- enable X11 forwarding when IPv6 is present but disabled on server
  (bnc#712683, FATE#31503; -X_forward_with_disabled_ipv6.patch)

OBS-URL: https://build.opensuse.org/request/show/224302
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=70
2014-03-01 00:05:55 +00:00
Petr Cerny
f2774839fb Accepting request 222710 from home:pcerny:factory
- re-enabling the seccomp sandbox
  (allowing use of getuid the syscall)

OBS-URL: https://build.opensuse.org/request/show/222710
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=66
2014-02-18 13:04:57 +00:00
Petr Cerny
eedbb4ea75 Accepting request 222560 from home:pcerny:factory
- reverting to rlimit sandbox even for newer distributions, since
  it seems not to work properly (bnc#864171)

OBS-URL: https://build.opensuse.org/request/show/222560
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=65
2014-02-17 11:31:08 +00:00
Petr Cerny
08f9072513 Accepting request 222365 from home:pcerny:factory
- Update of the underlying OpenSSH to 6.5p1

- Update to 6.5p1
  Features since 6.4p1:
  * ssh(1), sshd(8): support for key exchange using ECDH in
    Daniel Bernstein's Curve25519; default when both the client
    and server support it.
  * ssh(1), sshd(8): support for Ed25519 as a public key type fo
    rboth server and client.  Ed25519 is an EC signature offering
    better security than ECDSA and DSA and good performance.
  * Add a new private key format that uses a bcrypt KDF to better
    protect keys at rest. Used unconditionally for Ed25519 keys,
    on demand for other key types via the -o ssh-keygen(1)
    option.  Intended to become default in the near future.
    Details documented in PROTOCOL.key.
  * ssh(1), sshd(8): new transport cipher
    "chacha20-poly1305@openssh.com" combining Daniel Bernstein's
    ChaCha20 stream cipher and Poly1305 MAC to build an
    authenticated encryption mode. Details documented
    PROTOCOL.chacha20poly1305.
  * ssh(1), sshd(8): refuse RSA keys from old proprietary clients
    and servers that use the obsolete RSA+MD5 signature scheme.
    It will still be possible to connect with these
    clients/servers but only DSA keys will be accepted, and
    OpenSSH will refuse connection entirely in a future release.
  * ssh(1), sshd(8): refuse old proprietary clients and servers
    that use a weaker key exchange hash calculation.
  * ssh(1): increase the size of the Diffie-Hellman groups
    requested for each symmetric key size. New values from NIST
    Special Publication 800-57 with the upper limit specified by

OBS-URL: https://build.opensuse.org/request/show/222365
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=63
2014-02-14 14:54:10 +00:00