- Update to latest OpenBSD CVS:
   - [auth-rsa.c]
     - fix user/1056, sshd keeps restrictions; dbt@meat.net
   - [sshconnect.c]
     - disable agent fwding for proto 1.3, remove abuse of auth-rsa flags.
     - destroy keys earlier
     - split key exchange (kex) and user authentication (user-auth), ok: provos@
   - [sshd.c]
     - no need for poll.h; from bright@wintelcom.net
     - disable agent fwding for proto 1.3, remove abuse of auth-rsa flags.
     - split key exchange (kex) and user authentication (user-auth), ok: provos@
diff --git a/auth-rsa.c b/auth-rsa.c
index bc53b04..9d9e749 100644
--- a/auth-rsa.c
+++ b/auth-rsa.c
@@ -16,7 +16,7 @@
  */
 
 #include "includes.h"
-RCSID("$Id: auth-rsa.c,v 1.11 1999/12/06 00:47:28 damien Exp $");
+RCSID("$Id: auth-rsa.c,v 1.12 2000/01/20 11:44:09 damien Exp $");
 
 #include "rsa.h"
 #include "packet.h"
@@ -415,7 +415,22 @@
 						packet_send_debug("Your host '%.200s' is not permitted to use this key for login.",
 						get_canonical_hostname());
 						xfree(patterns);
+						/* key invalid for this host, reset flags */
 						authenticated = 0;
+						no_agent_forwarding_flag = 0;
+						no_port_forwarding_flag = 0;
+						no_pty_flag = 0;
+						no_x11_forwarding_flag = 0;
+						while (custom_environment) {
+							struct envstring *ce = custom_environment;
+							custom_environment = ce->next;
+							xfree(ce->s);
+							xfree(ce);
+						}
+						if (forced_command) {
+							xfree(forced_command);
+							forced_command = NULL;
+						}
 						break;
 					}
 					xfree(patterns);