3ed6191f56
6.3p1-5 + 0.9.3-7
2013-11-01 17:07:27 +01:00
5795323a53
don't use xfree in pam_ssh_agent_auth sources <geertj@gmail.com> ( #1024965 )
2013-11-01 17:06:02 +01:00
7feb965804
6.3p1-4 + 0.9.3-6
2013-10-25 15:46:49 +02:00
2add7a8ff5
rebuild with openssl-1.0.1e-29.fc20 to enable ECC support
2013-10-25 15:19:26 +02:00
f0aa6e5f51
rebuild with openssl-1.0.1e-29.fc20 to enable ECC support
2013-10-25 14:46:48 +02:00
a5e23f2861
6.3p1-3 + 0.9.3-6
2013-10-24 16:45:21 +02:00
ff7a26b109
6.3p1-2 + 0.9.3-6
2013-10-23 23:14:38 +02:00
1f36406833
Increase the size of the Diffie-Hellman groups requested for a each
...
symmetric key size. New values from NIST Special Publication 800-57 with
the upper limit specified by RFC4419. Pointed out by Peter Backes, ok
djm@. (#1010607 )
2013-10-23 22:41:53 +02:00
d088f94bd9
use default_ccache_name from /etc/krb5.conf for a kerberos cache ( #991186 )
2013-10-23 22:08:19 +02:00
e40d5d19d9
added Obsoletes: *fips
2013-10-15 17:55:40 +02:00
a92e916970
6.3p1-1 + 0.9.3-6
2013-10-14 15:55:03 +02:00
84822b5dec
rebase for openssh-6.3p1, remove unused patches ( #1007769 )
2013-10-14 15:54:41 +02:00
c33ef551ca
6.2p2-9 + 0.9.3-5
2013-10-08 17:28:16 +02:00
2ae5f9ff89
Revert "add -fips subpackages that contains the FIPS module files"
...
This reverts commit 227f4f7628
2013-10-08 17:13:39 +02:00
d4d8299c30
Revert "add missing Requires: openssl-fips in -fips subpackages"
...
This reverts commit a19397fdd2
2013-10-08 17:06:14 +02:00
b61d9c10d3
Revert "use hmac_suffix for ssh{,d} hmac checksums"
...
This reverts commit c6724c72f4
2013-10-08 17:04:53 +02:00
0cc0054215
Revert "use {?dist} tag in suffixes for hmac checksum files"
...
This reverts commit 15244ec178
2013-10-08 17:04:40 +02:00
f344f8490c
6.2p2-8 + 0.9.3-5
2013-09-25 14:13:01 +02:00
15244ec178
use {?dist} tag in suffixes for hmac checksum files
2013-09-20 17:11:49 +02:00
eba55f9c1b
6.2p2-7 + 0.9.3-5
2013-09-11 16:54:14 +02:00
c6724c72f4
use hmac_suffix for ssh{,d} hmac checksums
2013-09-11 16:05:58 +02:00
a19397fdd2
add missing Requires: openssl-fips in -fips subpackages
...
6.2p2-6.1 + 0.9.3-5
2013-08-29 09:32:04 +02:00
f4e927b62d
6.2p2-6 + 0.9.3-5
2013-08-28 21:28:04 +02:00
227f4f7628
add -fips subpackages that contains the FIPS module files
2013-08-28 19:37:08 +02:00
631ffb2c5b
6.2p2-5 + 0.9.3-5
2013-08-01 09:50:41 +02:00
115aad3f92
6.2p2-4 + 0.9.3-5
2013-07-23 16:01:17 +02:00
17df27c668
don't show Success for EAI_SYSTEM ( #985964 )
2013-07-23 12:07:49 +02:00
2ee6810919
make sftp's libedit interface marginally multibyte aware ( #841771 )
2013-06-19 17:10:49 +02:00
66608a1ded
6.2p2-3 + 0.9.3-5
2013-06-17 17:30:04 +02:00
e99c4840f1
6.2p2-2 + 0.9.3-5
2013-05-21 18:38:15 +02:00
678b8081f1
add socket activated sshd units to the package ( #963268 )
2013-05-21 18:37:18 +02:00
21acbc4795
6.2p2-1 + 0.9.3-5
2013-05-20 09:31:57 +02:00
d48f1a7bde
always use /sbin/nologin as privsep user's shell
2013-04-24 18:08:00 +02:00
a92d7445da
6.2p1-4 + 0.9.3-4
2013-04-17 17:12:32 +02:00
1d76d11f64
cleanup spec file and patches
2013-04-16 18:30:43 +02:00
c276d31b49
6.2p1-3 + 0.9.3-4
2013-04-16 18:15:20 +02:00
894ab5eaaf
add latest config.{sub,guess} to support aarch64 ( #926284 )
2013-04-16 18:12:15 +02:00
1042786f58
6.2p1-2 + 0.9.3-4
2013-04-09 23:25:17 +02:00
fcef7f6231
keep track of which IndentityFile options were manually supplied and which were default options, and don't warn if the latter are missing. (mindrot#2084)
2013-04-09 23:22:42 +02:00
b6f89abe5c
6.2p1-1 + 0.9.3-4
2013-04-09 00:07:04 +02:00
d3d59da0b5
merge all -audit* patches together
2013-04-08 17:17:10 +02:00
8d97022c57
build regress/modpipe tests with $(CFLAGS)
2013-04-04 16:50:06 +02:00
8a29dedfa7
rebase to openssh-6.2p1 ( #924727 )
...
ACSS was removed from upstream sources
2013-04-04 16:49:30 +02:00
1b95bc38df
6.1p1-7 + 0.9.3-3
2013-03-06 10:41:50 +01:00
2a7883d153
6.1p1-6 + 0.9.3-3
2013-02-14 18:08:21 +01:00
d2b3b9a27e
pam_ssh_agent_auth - change paths from %{_lib} to %{_libdir}
2013-02-12 09:42:54 +01:00
19725a9954
fix bogus day names in changelog dates
2013-02-08 15:44:40 +01:00
cab7f53408
6.1p1-5 + 0.9.3-3
2013-02-08 14:56:47 +01:00
5bc906c19a
change default value of MaxStartups - CVE-2010-5107 - #908707
2013-02-08 14:32:20 +01:00
87391b7d01
add BuildRequires: perl-podlators
2013-02-07 14:21:38 +01:00
7642de98e4
6.1p1-4 + 0.9.3-3
2012-12-03 17:16:39 +01:00
790103e764
6.1p1-3 + 0.9.3-3
2012-12-03 10:29:07 +01:00
fe661c5cbb
obsolete RequiredAuthentications[12] options
2012-11-30 21:40:22 +01:00
5039c7c85d
reformat several patches after openssh-6.1p1-authenticationmethods.patch
2012-11-30 16:25:51 +01:00
bffd1c2234
replace RequiredAuthentications2 with AuthenticationMethods according to upstream
...
the upstream refused original patch with RequiredAuthentications2, but they came with their own implementation of required authentications,
see https://bugzilla.mindrot.org/show_bug.cgi?id=983 . The new method is more robust and flexible
it will be included in next openssh-6.2 release
2012-11-30 16:23:29 +01:00
ab30b92bd6
fix the man moduli page ( #841065 )
2012-11-06 09:59:17 +01:00
f7f8b483b0
adapt openssh-6.1p1-akc.patch to the upstream version - https://bugzilla.mindrot.org/show_bug.cgi?id=1663
2012-11-05 14:43:22 +01:00
52c8eca4d9
fix gssapi canohost patch ( #863350 )
2012-10-30 11:06:45 +01:00
af2ebf77dc
6.1p1-2 + 0.9.3-3
2012-10-26 17:15:55 +02:00
afd52c4857
drop openssh-5.9p1-sftp-chroot.patch ( #830237 )
2012-10-26 17:04:25 +02:00
470ebd7abc
add SELinux comment to /etc/ssh/sshd_config about SELinux command to modify port ( #861400 )
2012-10-26 16:34:55 +02:00
13cf2478d6
smartcard support is replaced with PKCS#11 support already in 5.4p1 https://bugzilla.mindrot.org/show_bug.cgi?id=1371
2012-10-26 15:42:59 +02:00
1a5c95ee57
drop required chkconfig ( #865498 )
2012-10-12 13:03:26 +02:00
d0630aa358
6.1p1-1 + 0.9.3-3
2012-09-15 13:48:14 +02:00
fd408ed2a5
to run tests use --with check
2012-09-15 13:48:13 +02:00
e58e548a57
don't use /bin and /sbin paths ( #856590 )
2012-09-15 13:48:13 +02:00
581bf30d07
don't use chroot_user_t for chrooted users ( #830237 )
2012-09-15 13:47:45 +02:00
9fe1afc163
rebase to openssh-6.1p1 ( #852651 )
2012-09-15 13:29:49 +02:00
51ca3be245
use DIR: kerberos cache type ( #848228 )
2012-09-15 13:28:23 +02:00
94943d59db
replace scriptlets with systemd macros ( #850249 )
2012-09-15 13:28:01 +02:00
65ba94ef1a
rebase to openssh-6.0p1
...
6.0p1-1 + 0.9.3-2
2012-08-06 21:33:33 +02:00
90e11f338c
5.9p1-26 + 0.9.3-1
2012-08-06 19:42:13 +02:00
5382ccbe9b
handle crypt() returning NULL ( #815993 )
2012-08-06 09:08:52 +02:00
b648890ead
5.9p1-25 + 0.9.3-1
2012-07-27 14:35:43 +02:00
e9620308c8
allow sha256 and sha512 hmacs in the FIPS mode
2012-07-17 21:03:59 +02:00
4f4687ce80
fix segfault in su when pam_ssh_agent_auth is used and the ssh-agent
...
is not running, most probably not exploitable
update pam_ssh_agent_auth to 0.9.3 upstream version
2012-06-22 14:52:35 +02:00
2649d91e06
5.9p1-22 + 0.9.2-32
2012-04-06 21:01:27 +02:00
009f534b09
don't install sshd-keygen.service ( #810419 )
2012-04-06 21:01:06 +02:00
7294a991a2
5.9p1-21 + 0.9.2-32
2012-03-30 20:07:50 +02:00
22f0191d84
5.9p1-20 + 0.9.2-32
2012-03-23 09:16:52 +01:00
1027fdc205
don't enable sshd-keygen.service ( #805338 )
2012-03-23 09:16:10 +01:00
33e0acc5ef
5.9p1-19 + 0.9.2-32
2012-02-22 09:03:07 +01:00
feb99ea644
Look for x11 forward sockets with AI_ADDRCONFIG flag getaddrinfo ( #735889 )
2012-02-14 18:11:26 +01:00
d3ab95741d
5.9p1-18 + 0.9.2-32
2012-02-06 22:16:49 +01:00
d9e6186c71
replace TwoFactorAuth with RequiredAuthentications[12]
...
https://bugzilla.mindrot.org/show_bug.cgi?id=983
2012-02-06 22:16:38 +01:00
21699d5622
5.9p1-17 + 0.9.2-32
2012-01-31 14:09:17 +01:00
cd5891d0d5
run privsep slave process as the users SELinux context ( #781634 )
2012-01-31 14:09:00 +01:00
017c65d99b
add CAVS test driver for the aes-ctr ciphers
2012-01-13 18:28:47 +01:00
6148abd585
enable aes-ctr ciphers use the EVP engines from OpenSSL such as the AES-NI
2012-01-11 19:11:33 +01:00
2e12878998
5.9p1-14 + 0.9.2-32
2011-12-06 17:42:00 +01:00
5bd5aa2976
warn about unsupported option UsePAM=no ( #757545 )
2011-12-06 17:41:06 +01:00
4fc167470d
add back the restorecon call to ssh-copy-id - it might be needed on older
...
distributions (#739989 )
2011-11-21 09:03:05 +01:00
81da99ed9b
Fix permissions of sshd private keys created by sshd-keygen script ( #754779 )
2011-11-18 09:26:19 +01:00
17eb1038b2
still support /etc/sysconfig/sshd loading in sshd service ( #754732 )
2011-11-18 09:20:54 +01:00
0fcb25a8d2
remove unnecessary requires on initscripts
...
set VerifyHostKeyDNS to ask in the default configuration (#739856 )
2011-10-14 18:19:47 +02:00
fcc5bdd01d
selinux sandbox rewrite
...
two factor authentication tweaking
2011-09-20 08:14:45 +02:00
28b0dc63f4
selinux sandbox rewrite
...
two factor authentication tweaking
2011-09-19 07:26:32 +02:00
cff1d0c39d
coverity upgrade
...
wipe off nonfunctional nss
selinux sandbox tweaking
2011-09-14 17:03:03 +02:00
c870e661c7
coverity upgrade
...
experimental selinux sandbox
2011-09-13 17:14:48 +02:00
c2ea13d263
fully reanable auditing
2011-09-13 01:53:08 -04:00
1df0cf4657
repair signedness in akc patch
2011-09-12 20:44:35 +02:00
026db1cf63
temporarily disable part of audit4 patch
2011-09-12 08:34:27 +02:00
39b26b5169
temporarily disable part of audit4 patch
2011-09-12 08:11:41 +02:00
ea97ffa1ed
Coverity second pass
...
Reenable akc patch
2011-09-09 21:18:35 +02:00
3b545be5d7
Coverity first pass
2011-09-09 00:54:28 +02:00
311e6bb088
Rebase to 5.9p1
...
Add chroot sftp patch
Add two factor auth patch
2011-09-07 15:31:21 +02:00
69dd72f6ef
ignore SIGPIPE in ssh keyscan
2011-09-07 15:12:54 +02:00
19d4c790a8
ignore SIGPIPE in ssh keyscan
2011-08-23 19:01:59 +02:00
2b67a53348
save ssh-askpass's debuginfo
2011-08-09 15:15:23 +02:00
56b50ec772
compile ssh-askpass with corect CFLAGS
2011-08-08 23:32:31 +02:00
eed2da95a4
improve selinux's change context log
2011-08-08 13:37:15 +02:00
54f33f6451
improve selinux's change context log
2011-08-08 13:24:47 +02:00
ec3622478b
repair broken man pages
2011-08-08 11:57:43 +02:00
1592780c7c
rebuild
2011-07-25 09:39:35 +02:00
d704eab9f3
rebuild
2011-07-25 09:27:57 +02:00
cadffc562e
Do not change context when run under unconfined_t
2011-07-21 15:26:11 +02:00
294ca75200
Do not change context when run under unconfined_t
2011-07-21 14:52:20 +02:00
d3d3406f12
Add postlogin to pam. ( #718807 )
2011-07-14 15:15:29 +02:00
0d4fd57729
Add postlogin to pam. ( #718807 )
2011-07-14 13:46:20 +02:00
d56cc37855
Systemd compatibility according to Mathieu Bridon <bochecha@fedoraproject.org>
...
Split out the host keygen into their own command, to ease future migration
to systemd. Compatitbility with the init script was kept.
Migrate the package to full native systemd unit files, according to the Fedora
packaging guidelines.
Prepate the unit files for running an ondemand server. (do not add it actually)
2011-06-29 08:03:00 +02:00
d2cf533023
Systemd compatibility according to Mathieu Bridon <bochecha@fedoraproject.org>
...
Split out the host keygen into their own command, to ease future migration
to systemd. Compatitbility with the init script was kept.
Migrate the package to full native systemd unit files, according to the Fedora
packaging guidelines.
Prepate the unit files for running an ondemand server. (do not add it actually)
2011-06-28 11:11:10 +02:00
5c8b5cb538
Systemd compatibility according to Mathieu Bridon <bochecha@fedoraproject.org>
...
Split out the host keygen into their own command, to ease future migration
to systemd. Compatitbility with the init script was kept.
Migrate the package to full native systemd unit files, according to the Fedora
packaging guidelines.
Prepate the unit files for running an ondemand server. (do not add it actually)
2011-06-28 10:35:28 +02:00
29b683c1d2
Mention IPv6 usage in man pages
2011-06-21 11:01:06 +02:00
d3542d5be8
Improve init script
2011-06-20 10:44:49 +02:00
ef264f503b
Improve init script
2011-06-16 15:44:03 +02:00
6bd5ca2e17
Add possibility to compile openssh without downstream patches
2011-06-16 10:24:30 +02:00
6a2cfe2190
remove stale control sockets ( #706396 )
2011-06-09 16:10:59 +02:00
bc60f31447
improove entropy manuals
2011-05-31 23:09:30 +02:00
0e9135fc82
improove entropy handling
...
concat ldap patches
2011-05-28 22:03:43 +02:00
ba32c8eafa
improove ldap manuals
2011-05-24 19:08:34 +02:00
5b4ccb39dd
add gssapi forced command
2011-05-22 23:49:15 +02:00
c2c99d4dd7
bounce the openssh version
2011-05-03 09:27:52 +02:00
87ae97668f
bounce the openssh version
2011-05-03 08:37:54 +02:00
c0cd660be9
temporarily disabling systemd units
2011-04-28 12:43:31 +02:00
9c4d06a341
add flags AI_V4MAPPED and AI_ADDRCONFIG to getaddrinfo
2011-04-27 12:16:14 +02:00
6077c76b6e
update scriptlets
2011-04-26 21:51:33 +02:00
2cd304edac
update scriptlets
2011-04-26 20:44:25 +02:00
56091ffa2e
add systemd units
2011-04-23 16:17:45 +02:00
0ecc97b960
add systemd units
2011-04-23 16:15:56 +02:00
d470c46f2b
add systemd units
2011-04-23 13:43:22 +02:00
53f618daef
add systemd units
2011-04-23 09:13:06 +02:00
0e46f275c6
the private keys may be 640 root:ssh_keys ssh_keysign is sgid
2011-04-22 11:43:01 +02:00
e93cf2786f
the private keys may be 640 root:ssh_keys ssh_keysign is sgid
2011-04-22 11:36:52 +02:00
a8dc50b17f
the private keys may be 640 root:ssh_keys ssh_keysign is sgid
2011-04-21 23:27:01 +02:00
1ddd0ee5d7
the private keys may be 640 root:ssh_keys ssh_keysign is sgid
2011-04-21 17:22:18 +02:00
c7ffe02211
improving sshd -> passwd transation
2011-04-20 21:59:24 +02:00
e306854c4d
the intermediate context is set to sshd_sftpd_t
...
do not crash in packet.c if no connection
2011-04-15 12:23:36 +02:00
439c349423
the intermediate context is set to sshd_sftpd_t
...
do not crash in packet.c if no connection
2011-04-05 20:54:56 +02:00
8bc65c49b7
the intermediate context is set to sshd_sftpd_t
...
do not crash in packet.c if no connection
2011-04-05 20:54:12 +02:00
1f6bdc75f1
resolve warnings in port_linux.c
2011-04-01 09:04:38 +02:00
3f220f2863
resolve warnings in port_linux.c
2011-03-31 21:48:35 +02:00
8a77a1dfd5
resolve warnings in port_linux.c
2011-03-31 13:43:13 +02:00
11896aa047
add /etc/sysconfig/sshd
2011-03-29 23:25:53 +02:00
0553df85b0
improve reseeding and seed source (documentation)
2011-03-28 16:40:17 +02:00
91d3b39c03
improve reseeding and seed source (cocumentation)
2011-03-28 16:19:03 +02:00
e6d33e3bc4
improve reseeding and seed source (cocumentation)
2011-03-27 21:50:47 +02:00
39c7b05d62
use /dev/random or /dev/urandom for seeding prng
...
improve periodical reseeding of random generator
2011-03-22 22:05:18 +01:00
3657adf0ba
use /dev/random or /dev/urandom for seeding prng
2011-03-22 19:04:37 +01:00
0f7ccbf444
add periodical reseeding of random generator
...
change selinux contex for internal sftp in do_usercontext
exit(0) after sigterm
2011-03-17 11:31:16 +01:00
8fe15092c3
add periodical reseeding of random generator
...
change selinux contex for internal sftp in do_usercontext
exit(0) after sigterm
2011-03-17 08:18:17 +01:00
f33c99e38b
improove ssh-ldap (documentation)
2011-03-10 21:59:08 +01:00
9992a8e919
improove ssh-ldap (documentation)
2011-03-10 21:48:09 +01:00
9404cdd3e3
improove ssh-ldap (documentation)
2011-03-10 18:26:11 +01:00
a864d61df9
improve session keys audit
2011-03-10 15:52:21 +01:00
ffd063fe18
improve session keys audit
2011-03-09 09:07:16 +01:00
d1fc5c2d41
improve session keys audit
2011-03-09 08:48:51 +01:00
71d3d9c683
CVE-2010-4755
2011-03-07 20:31:52 +01:00
825921b7f3
improove ssk-keycat (documentation)
2011-03-04 15:22:12 +01:00
edc1723011
improve audit of logins and auths
2011-03-03 10:54:47 +01:00
5c54191b0a
improove ssk-keycat
2011-03-02 07:03:38 +01:00
5928f9047b
improove ssk-keycat
2011-03-01 17:10:09 +01:00
1499a28f37
improove ssk-keycat
2011-03-01 07:44:22 +01:00
99f427602c
add ssk-keycat
2011-02-28 16:42:58 +01:00
b934981de5
reenable auth-keys ldap backend
2011-02-25 12:07:01 +01:00
48446f1f1b
another audit improovements
2011-02-25 09:30:56 +01:00
aefa65dfca
another audit improovements
2011-02-24 14:25:14 +01:00
f9ff105e58
another audit improovements
2011-02-24 14:17:34 +01:00
1732b09b93
another audit improovements
2011-02-23 10:23:28 +01:00
842f4397cd
another audit improovements
2011-02-22 15:07:26 +01:00
9cefae06b0
another audit improovements
2011-02-21 19:33:56 +01:00
2c1a4adbdd
improve audit of server ket management
2011-02-17 17:54:23 +01:00
b9127ef973
improve audit of logins and auths
2011-02-16 23:36:59 +01:00
483c73337b
improve audit of logins and auths
2011-02-16 17:30:51 +01:00
003cb0b27f
- bump openssh version to 5.8p1
2011-02-14 15:32:49 +01:00
fa335ee67e
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
2011-02-08 21:31:13 -06:00
cfb0f30feb
- clean the data structures in the non privileged process
...
- clean the data structures when roaming
2011-02-07 20:47:23 +01:00
865391f74f
- clean the data structures when roaming
2011-02-07 09:21:27 +01:00
ee23b09ac6
- clean the data structures in the privileged process
2011-02-02 10:18:01 +01:00
f32d86bd8a
- clean the data structures in the privileged process
2011-02-02 09:28:26 +01:00
6f931660c8
- clean the data structures in the privileged process
2011-01-31 17:04:10 +01:00
f00e4a3ddc
- clean the data structures before exit net process
2011-01-25 14:06:13 +01:00
af8738486c
- make audit compatible with the fips mode
2011-01-16 23:50:01 +01:00
377ba3cfce
- add audit of destruction the server keys
2011-01-14 10:20:53 +01:00
9828ffb5fc
- add audit of destruction the server keys
2011-01-14 10:18:17 +01:00
92eab14042
- add audit of destruction the server keys
2011-01-14 09:45:08 +01:00
5c20fa8d2d
- add audit of destruction the session keys
2011-01-12 11:09:58 +01:00
a7cb7d2954
- reenable run sshd as non root user
...
- renable rekeying
2010-10-28 13:04:45 +02:00
436639ac40
- reapair clientloop crash ( #627332 )
...
- properly restore euid in case connect to the ssh-agent socket fails
2010-11-24 08:24:42 +01:00
bb5eb00d2d
- properly restore euid in case connect to the ssh-agent socket fails
2010-11-24 07:49:04 +01:00
d2ed53bfc6
- striped read permissions from suid and sgid binaries
...
- properly restore euid in case connect to the ssh-agent socket fails
2010-10-10 05:43:12 +02:00
Petr Lautrbach
bach
Tomas Mraz
Jan F. Chadima
JFCH
Jan F. Chadima
Jan F
Jan F
Jan F
Jan F
Dennis Gilmore
Jan F. Chadima