blob: ecfcf35ba4e7a289a1074b442c17652e2fdddc18 [file] [log] [blame]
Ben Lindstrom494709d2002-06-11 15:42:53 +0000120020611
2 - (bal) ssh-agent.c RCSD fix (|unexpand already done)
Ben Lindstrom5cac4232002-06-11 15:45:02 +00003 - (bal) OpenBSD CVS Sync
4 - stevesk@cvs.openbsd.org 2002/06/09 22:15:15
5 [ssh.1]
6 update for no setuid root and ssh-keysign; ok deraadt@
Ben Lindstrom18a32a72002-06-11 15:46:34 +00007 - itojun@cvs.openbsd.org 2002/06/09 22:17:21
8 [sshconnect.c]
9 pass salen to sockaddr_ntop so that we are happy on linux/solaris
Ben Lindstrom2779d282002-06-11 15:47:42 +000010 - stevesk@cvs.openbsd.org 2002/06/10 16:53:06
11 [auth-rsa.c ssh-rsa.c]
12 display minimum RSA modulus in error(); ok markus@
Ben Lindstrom11d470d2002-06-11 15:50:13 +000013 - stevesk@cvs.openbsd.org 2002/06/10 16:56:30
14 [ssh-keysign.8]
15 merge in stuff from my man page; ok markus@
Ben Lindstrom1775c9c2002-06-11 15:51:54 +000016 - stevesk@cvs.openbsd.org 2002/06/10 17:36:23
17 [ssh-add.1 ssh-add.c]
18 use convtime() to parse and validate key lifetime. can now
19 use '-t 2h' etc. ok markus@ provos@
Ben Lindstrom2bf82762002-06-11 15:53:05 +000020 - stevesk@cvs.openbsd.org 2002/06/10 17:45:20
21 [readconf.c ssh.1]
22 change RhostsRSAAuthentication and RhostsAuthentication default to no
23 since ssh is no longer setuid root by default; ok markus@
Ben Lindstrom914d0372002-06-11 15:55:01 +000024 - stevesk@cvs.openbsd.org 2002/06/10 21:21:10
25 [ssh_config]
26 update defaults for RhostsRSAAuthentication and RhostsAuthentication
27 here too (all options commented out with default value).
Ben Lindstrom494709d2002-06-11 15:42:53 +000028
Ben Lindstromece42042002-06-09 20:00:09 +00002920020609
30 - (bal) OpenBSD CVS Sync
31 - markus@cvs.openbsd.org 2002/06/08 05:07:56
32 [ssh.c]
33 nuke ptrace comment
Ben Lindstroma2071572002-06-09 20:01:48 +000034 - markus@cvs.openbsd.org 2002/06/08 05:07:09
35 [ssh-keysign.c]
36 only accept 20 byte session ids
Ben Lindstrom4daea862002-06-09 20:04:02 +000037 - markus@cvs.openbsd.org 2002/06/08 05:17:01
38 [readconf.c readconf.h ssh.1 ssh.c]
39 deprecate FallBackToRsh and UseRsh; patch from djm@
Ben Lindstrom1c2bafe2002-06-09 20:04:50 +000040 - markus@cvs.openbsd.org 2002/06/08 05:40:01
41 [readconf.c]
42 just warn about Deprecated options for now
Ben Lindstrom7a7483d2002-06-09 20:05:35 +000043 - markus@cvs.openbsd.org 2002/06/08 05:41:18
44 [ssh_config]
45 remove FallBackToRsh/UseRsh
Ben Lindstromaf0c6d62002-06-09 20:06:29 +000046 - markus@cvs.openbsd.org 2002/06/08 12:36:53
47 [scp.c]
48 remove FallBackToRsh
Ben Lindstrom2e17b082002-06-09 20:13:27 +000049 - markus@cvs.openbsd.org 2002/06/08 12:46:14
50 [readconf.c]
51 silently ignore deprecated options, since FallBackToRsh might be passed
52 by remote scp commands.
Ben Lindstrom159ac2e2002-06-09 20:14:54 +000053 - itojun@cvs.openbsd.org 2002/06/08 21:15:27
54 [sshconnect.c]
55 always use getnameinfo. (diag message only)
Ben Lindstrom2749e1c2002-06-09 20:16:22 +000056 - markus@cvs.openbsd.org 2002/06/09 04:33:27
57 [sshconnect.c]
58 abort() - > fatal()
Ben Lindstrom05efee12002-06-09 20:20:58 +000059 - (bal) RCSID tag updates on channels.c, clientloop.c, nchan.c,
60 sftp-client.c, ssh-agenet.c, ssh-keygen.c and connect.h (we did unexpand
61 independant of them)
Ben Lindstromece42042002-06-09 20:00:09 +000062
Ben Lindstrom35453522002-06-07 14:37:00 +00006320020607
Ben Lindstrom2ab19682002-06-07 16:49:11 +000064 - (bal) Removed --{enable/disable}-suid-ssh
Ben Lindstrom35453522002-06-07 14:37:00 +000065 - (bal) Missed __progname in ssh-keysign.c patch by dtucker@zip.com.au
Ben Lindstrom378a4172002-06-07 14:49:56 +000066 - (bal) use 'LOGIN_PROGRAM' not '/usr/bin/login' in session.c patch by
67 Bertrand.Velle@apogee-com.fr
Ben Lindstrom35453522002-06-07 14:37:00 +000068
Ben Lindstromfb62a692002-06-06 19:47:11 +00006920020606
70 - (bal) OpenBSD CVS Sync
71 - markus@cvs.openbsd.org 2002/05/15 21:56:38
72 [servconf.c sshd.8 sshd_config]
73 re-enable privsep and disable setuid for post-3.2.2
Ben Lindstrom6a246412002-06-06 19:48:16 +000074 - markus@cvs.openbsd.org 2002/05/16 22:02:50
75 [cipher.c kex.h mac.c]
76 fix warnings (openssl 0.9.7 requires const)
Ben Lindstromfac77692002-06-06 19:49:54 +000077 - stevesk@cvs.openbsd.org 2002/05/16 22:09:59
78 [session.c ssh.c]
79 don't limit xauth pathlen on client side and longer print length on
80 server when debug; ok markus@
Ben Lindstrom38ed63d2002-06-06 19:51:06 +000081 - deraadt@cvs.openbsd.org 2002/05/19 20:54:52
82 [log.h]
83 extra commas in enum not 100% portable
Ben Lindstromf666fec2002-06-06 19:51:58 +000084 - deraadt@cvs.openbsd.org 2002/05/22 23:18:25
85 [ssh.c sshd.c]
86 spelling; abishoff@arc.nasa.gov
Ben Lindstrom1bad2562002-06-06 19:57:33 +000087 - markus@cvs.openbsd.org 2002/05/23 19:24:30
88 [authfile.c authfile.h pathnames.h ssh.c sshconnect.c sshconnect.h
89 sshconnect1.c sshconnect2.c ssh-keysign.8 ssh-keysign.c Makefile.in]
90 add /usr/libexec/ssh-keysign: a setuid helper program for hostbased
91 authentication in protocol v2 (needs to access the hostkeys).
Ben Lindstrom9e5bb572002-06-06 19:58:27 +000092 - markus@cvs.openbsd.org 2002/05/23 19:39:34
93 [ssh.c]
94 add comment about ssh-keysign
Ben Lindstrom5206b952002-06-06 19:59:29 +000095 - markus@cvs.openbsd.org 2002/05/24 08:45:14
96 [sshconnect2.c]
97 stat ssh-keysign first, print error if stat fails;
98 some debug->error; fix comment
Ben Lindstrom4887da22002-06-06 20:05:57 +000099 - markus@cvs.openbsd.org 2002/05/25 08:50:39
100 [sshconnect2.c]
101 execlp->execl; from stevesk
Ben Lindstrom855bf3a2002-06-06 20:27:55 +0000102 - markus@cvs.openbsd.org 2002/05/25 18:51:07
103 [auth.h auth2.c auth2-hostbased.c auth2-kbdint.c auth2-none.c
104 auth2-passwd.c auth2-pubkey.c Makefile.in]
105 split auth2.c into one file per method; ok provos@/deraadt@
Ben Lindstrom033a49c2002-06-06 20:30:28 +0000106 - stevesk@cvs.openbsd.org 2002/05/26 20:35:10
107 [ssh.1]
108 sort ChallengeResponseAuthentication; ok markus@
Ben Lindstrom105ccbe2002-06-06 20:33:06 +0000109 - stevesk@cvs.openbsd.org 2002/05/28 16:45:27
110 [monitor_mm.c]
111 print strerror(errno) on mmap/munmap error; ok markus@
Ben Lindstromabff1dd2002-06-06 20:38:49 +0000112 - stevesk@cvs.openbsd.org 2002/05/28 17:28:02
113 [uidswap.c]
114 format spec change/casts and some KNF; ok markus@
Ben Lindstrom10d99362002-06-06 20:44:06 +0000115 - stevesk@cvs.openbsd.org 2002/05/28 21:24:00
116 [uidswap.c]
117 use correct function name in fatal()
Ben Lindstrom20abb752002-06-06 20:45:33 +0000118 - stevesk@cvs.openbsd.org 2002/05/29 03:06:30
119 [ssh.1 sshd.8]
120 spelling
Ben Lindstroma26ea632002-06-06 20:46:25 +0000121 - markus@cvs.openbsd.org 2002/05/29 11:21:57
122 [sshd.c]
123 don't start if privsep is enabled and SSH_PRIVSEP_USER or
124 _PATH_PRIVSEP_CHROOT_DIR are missing; ok deraadt@
Ben Lindstromf088f432002-06-06 20:50:07 +0000125 - markus@cvs.openbsd.org 2002/05/30 08:07:31
126 [cipher.c]
127 use rijndael/aes from libcrypto (openssl >= 0.9.7) instead of
128 our own implementation. allow use of AES hardware via libcrypto,
129 ok deraadt@
Ben Lindstromcec2ea82002-06-06 20:51:04 +0000130 - markus@cvs.openbsd.org 2002/05/31 10:30:33
131 [sshconnect2.c]
132 extent ssh-keysign protocol:
133 pass # of socket-fd to ssh-keysign, keysign verfies locally used
134 ip-address using this socket-fd, restricts fake local hostnames
135 to actual local hostnames; ok stevesk@
Ben Lindstrom511bb242002-06-06 20:52:37 +0000136 - markus@cvs.openbsd.org 2002/05/31 11:35:15
137 [auth.h auth2.c]
138 move Authmethod definitons to per-method file.
Ben Lindstrom01fff0c2002-06-06 20:54:07 +0000139 - markus@cvs.openbsd.org 2002/05/31 13:16:48
140 [key.c]
141 add comment:
142 key_verify returns 1 for a correct signature, 0 for an incorrect signature
143 and -1 on error.
Ben Lindstromceae9d12002-06-06 20:55:04 +0000144 - markus@cvs.openbsd.org 2002/05/31 13:20:50
145 [ssh-rsa.c]
146 pad received signature with leading zeros, because RSA_verify expects
147 a signature of RSA_size. the drafts says the signature is transmitted
148 unpadded (e.g. putty does not pad), reported by anakin@pobox.com
Ben Lindstrom2e14bc72002-06-06 20:56:07 +0000149 - deraadt@cvs.openbsd.org 2002/06/03 12:04:07
150 [ssh.h]
151 compatiblity -> compatibility
152 decriptor -> descriptor
153 authentciated -> authenticated
154 transmition -> transmission
Ben Lindstromdcf6bfb2002-06-06 20:57:17 +0000155 - markus@cvs.openbsd.org 2002/06/04 19:42:35
156 [monitor.c]
157 only allow enabled authentication methods; ok provos@
Ben Lindstromf67e0772002-06-06 20:58:19 +0000158 - markus@cvs.openbsd.org 2002/06/04 19:53:40
159 [monitor.c]
160 save the session id (hash) for ssh2 (it will be passed with the
161 initial sign request) and verify that this value is used during
162 authentication; ok provos@
Ben Lindstrom3dca4f52002-06-06 20:59:25 +0000163 - markus@cvs.openbsd.org 2002/06/04 23:02:06
164 [packet.c]
165 remove __FUNCTION__
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +0000166 - markus@cvs.openbsd.org 2002/06/04 23:05:49
167 [cipher.c monitor.c monitor_fdpass.c monitor_mm.c monitor_wrap.c]
168 __FUNCTION__ -> __func__
Ben Lindstrom22fa01c2002-06-06 21:46:07 +0000169 - markus@cvs.openbsd.org 2002/06/05 16:08:07
170 [ssh-agent.1 ssh-agent.c]
171 '-a bind_address' binds the agent to user-specified unix-domain
172 socket instead of /tmp/ssh-XXXXXXXX/agent.<pid>; ok djm@ (some time ago).
Ben Lindstromb7788f32002-06-06 21:46:08 +0000173 - markus@cvs.openbsd.org 2002/06/05 16:08:07
174 [ssh-agent.1 ssh-agent.c]
175 '-a bind_address' binds the agent to user-specified unix-domain
176 socket instead of /tmp/ssh-XXXXXXXX/agent.<pid>; ok djm@ (some time ago).
Ben Lindstrom21d1ed82002-06-06 21:48:57 +0000177 - markus@cvs.openbsd.org 2002/06/05 16:48:54
178 [ssh-agent.c]
179 copy current request into an extra buffer and just flush this
180 request on errors, ok provos@
Ben Lindstrom2f717042002-06-06 21:52:03 +0000181 - markus@cvs.openbsd.org 2002/06/05 19:57:12
182 [authfd.c authfd.h ssh-add.1 ssh-add.c ssh-agent.c]
183 ssh-add -x for lock and -X for unlocking the agent.
184 todo: encrypt private keys with locked...
Ben Lindstrom163f3b82002-06-06 21:53:11 +0000185 - markus@cvs.openbsd.org 2002/06/05 20:56:39
186 [ssh-add.c]
187 add -x/-X to usage
Ben Lindstrom61d328a2002-06-06 21:54:57 +0000188 - markus@cvs.openbsd.org 2002/06/05 21:55:44
189 [authfd.c authfd.h ssh-add.1 ssh-add.c ssh-agent.c]
190 ssh-add -t life, Set lifetime (in seconds) when adding identities;
191 ok provos@
Ben Lindstromd9d6ab62002-06-06 21:57:01 +0000192 - stevesk@cvs.openbsd.org 2002/06/06 01:09:41
193 [monitor.h]
194 no trailing comma in enum; china@thewrittenword.com
Ben Lindstrom2c140472002-06-06 21:57:54 +0000195 - markus@cvs.openbsd.org 2002/06/06 17:12:44
196 [sftp-server.c]
197 discard remaining bytes of current request; ok provos@
Ben Lindstrom937df1d2002-06-06 21:58:35 +0000198 - markus@cvs.openbsd.org 2002/06/06 17:30:11
199 [sftp-server.c]
200 use get_int() macro (hide iqueue)
Ben Lindstroma93f12f2002-06-07 01:51:06 +0000201 - (bal) Missed msg.[ch] in merge. Required for ssh-keysign.
Ben Lindstrom88d26ed2002-06-07 01:53:59 +0000202 - (bal) Forgot to add msg.c Makefile.in.
Ben Lindstrom4eeccc72002-06-07 01:57:25 +0000203 - (bal) monitor_mm.c typos.
Ben Lindstromb85ab302002-06-07 02:05:25 +0000204 - (bal) Refixed auth2.c. It was never fully commited while spliting out
Ben Lindstrom03bab282002-06-07 03:19:35 +0000205 authentication to different files.
Ben Lindstromdb41d232002-06-07 03:11:38 +0000206 - (bal) ssh-keysign should build and install correctly now. Phase two
207 would be to clean out any dead wood and disable ssh setuid on install.
Ben Lindstrom03bab282002-06-07 03:19:35 +0000208 - (bal) Reverse logic, use __func__ first since it's C99
Ben Lindstromca8943e2002-06-06 20:42:04 +0000209
Kevin Stevesdf75dd22002-06-04 20:52:19 +000021020020604
211 - (stevesk) [channels.c] bug #164 patch from YOSHIFUJI Hideaki (changed
212 setsockopt from debug to error for now).
213
Tim Rice28bbb0c2002-05-27 17:37:32 -070021420020527
215 - (tim) [configure.ac.orig monitor_fdpass.c] Enahnce msghdr tests to address
216 build problem on Irix reported by Dave Love <d.love@dl.ac.uk>. Back out
217 last monitor_fdpass.c changes that are no longer needed with new tests.
218 Patch tested on Irix by Jan-Frode Myklebust <janfrode@parallab.uib.no>
219
Damien Miller74cc5bb2002-05-22 11:02:15 +100022020020522
221 - (djm) Fix spelling mistakes, spotted by Solar Designer i
222 <solar@openwall.com>
Damien Miller8ce82962002-05-22 14:24:01 +1000223 - Sync scard/ (not sure when it drifted)
Damien Miller667fb252002-05-22 14:14:00 +1000224 - (djm) OpenBSD CVS Sync:
225 [auth.c]
226 Fix typo/thinko. Pass in as to auth_approval(), not NULL.
227 Closes PR 2659.
228 - Crank version
Damien Miller23dc10d2002-05-22 14:14:54 +1000229 - Crank RPM spec versions
Damien Miller74cc5bb2002-05-22 11:02:15 +1000230
Kevin Stevesc5041ac2002-05-21 17:50:21 +000023120020521
232 - (stevesk) [sshd.c] bug 245; disable setsid() for now
Kevin Stevesbc5bb552002-05-21 17:59:13 +0000233 - (stevesk) [sshd.c] #ifndef HAVE_CYGWIN for setgroups()
Kevin Stevesc5041ac2002-05-21 17:50:21 +0000234
Tim Rice9de793c2002-05-17 08:59:22 -070023520020517
236 - (tim) [configure.ac] remove extra MD5_MSG="no" line.
237
Ben Lindstrombeecf742002-05-15 15:59:17 +000023820020515
239 - (bal) CVS ID fix up on auth-passwd.c
Ben Lindstrom1650ba32002-05-15 16:07:11 +0000240 - (bal) OpenBSD CVS Sync
241 - deraadt@cvs.openbsd.org 2002/05/07 19:54:36
242 [ssh.h]
243 use ssh uid
Ben Lindstrom973be002002-05-15 16:08:48 +0000244 - deraadt@cvs.openbsd.org 2002/05/08 21:06:34
245 [ssh.h]
246 move to sshd.sshd instead
Ben Lindstrom966bfda2002-05-15 16:09:57 +0000247 - stevesk@cvs.openbsd.org 2002/05/11 20:24:48
248 [ssh.h]
249 typo in comment
Ben Lindstrom58d4daf2002-05-15 16:14:36 +0000250 - itojun@cvs.openbsd.org 2002/05/13 02:37:39
251 [auth-skey.c auth2.c]
252 less warnings. skey_{respond,query} are public (in auth.h)
Ben Lindstroma574cda2002-05-15 16:16:14 +0000253 - markus@cvs.openbsd.org 2002/05/13 20:44:58
254 [auth-options.c auth.c auth.h]
255 move the packet_send_debug handling from auth-options.c to auth.c;
256 ok provos@
Ben Lindstrom17401b62002-05-15 16:17:56 +0000257 - millert@cvs.openbsd.org 2002/05/13 15:53:19
258 [sshd.c]
259 Call setsid() in the child after sshd accepts the connection and forks.
260 This is needed for privsep which calls setlogin() when it changes uids.
261 Without this, there is a race where the login name of an existing
262 connection, as returned by getlogin(), may be changed to the privsep
263 user (sshd). markus@ OK
Ben Lindstrombdde3302002-05-15 16:19:37 +0000264 - markus@cvs.openbsd.org 2002/05/13 21:26:49
265 [auth-rhosts.c]
266 handle debug messages during rhosts-rsa and hostbased authentication;
267 ok provos@
Ben Lindstrom7339b2a2002-05-15 16:25:01 +0000268 - mouring@cvs.openbsd.org 2002/05/15 15:47:49
269 [kex.c monitor.c monitor_wrap.c sshd.c]
270 'monitor' variable clashes with at least one lame platform (NeXT). i
271 Renamed to 'pmonitor'. provos@
Ben Lindstrombb2ce362002-05-15 21:35:43 +0000272 - deraadt@cvs.openbsd.org 2002/05/04 02:39:35
273 [servconf.c sshd.8 sshd_config]
274 enable privsep by default; provos ok
Ben Lindstromc57bbf12002-05-15 21:36:45 +0000275 - millert@cvs.openbsd.org 2002/05/06 23:34:33
276 [ssh.1 sshd.8]
277 Kill/adjust r(login|exec)d? references now that those are no longer in
278 the tree.
Ben Lindstromc5c15dd2002-05-15 21:37:34 +0000279 - markus@cvs.openbsd.org 2002/05/15 21:02:53
280 [servconf.c sshd.8 sshd_config]
281 disable privsep and enable setuid for the 3.2.2 release
Ben Lindstrom7339b2a2002-05-15 16:25:01 +0000282 - (bal) Fixed up PAM case. I think.
Ben Lindstrom2b70e562002-05-15 16:39:51 +0000283 - (bal) Clarified openbsd-compat/*-cray.* Licence provided by Wendy
Ben Lindstrom4e67d382002-05-15 21:50:14 +0000284 - (bal) OpenBSD CVS Sync
285 - markus@cvs.openbsd.org 2002/05/15 21:05:29
286 [version.h]
287 enter OpenSSH_3.2.2
288 - (bal) Caldara, Suse, and Redhat openssh.specs updated.
Ben Lindstrombeecf742002-05-15 15:59:17 +0000289
Kevin Stevesf8defa22002-05-13 23:31:09 +000029020020514
291 - (stevesk) [README.privsep] PAM+privsep works with Solaris 8.
Tim Rice1e28c9e2002-05-13 17:07:18 -0700292 - (tim) [sshpty.c] set tty modes when allocating old style bsd ptys to
293 match what newer style ptys have when allocated. Based on a patch by
294 Roger Cornelius <rac@tenzing.org>
Tim Ricefd6fd242002-05-13 20:50:38 -0700295 - (tim) [README.privsep] UnixWare 7 and OpenUNIX 8 work.
296 - (tim) [README.privsep] remove reference to UnixWare 7 and OpenUNIX 8
297 from PAM-enabled pragraph. UnixWare has no PAM.
Tim Rice8dd6feb2002-05-14 09:03:46 -0700298 - (tim) [contrib/caldera/openssh.spec] update version.
Kevin Stevesf8defa22002-05-13 23:31:09 +0000299
Damien Millera18bbd32002-05-13 10:48:57 +100030020020513
Kevin Steves02281552002-05-13 03:57:04 +0000301 - (stevesk) add initial README.privsep
Kevin Stevesc81e1292002-05-13 03:51:40 +0000302 - (stevesk) [configure.ac] nicer message: --with-privsep-user=user
Damien Miller860e9292002-05-15 10:12:29 +1000303 - (djm) Add --with-superuser-path=xxx configure option to specify
304 what $PATH the superuser receives.
Damien Miller5ad9fd92002-05-13 11:07:41 +1000305 - (djm) Bug #231: UsePrivilegeSeparation turns off Banner.
Damien Millerf58c6722002-05-13 13:15:42 +1000306 - (djm) Add --with-privsep-path configure option
Damien Millerb7cb9692002-05-13 13:26:57 +1000307 - (djm) Update RPM spec file: different superuser path, use
308 /var/empty/sshd for privsep
Damien Millerf71d2a52002-05-13 15:14:08 +1000309 - (djm) Bug #234: missing readpassphrase declaration and defines
Damien Miller860e9292002-05-15 10:12:29 +1000310 - (djm) Add INSTALL warning about SSH protocol 1 blowfish w/
311 OpenSSL < 0.9.6
Damien Millera18bbd32002-05-13 10:48:57 +1000312
Tim Riceaef73712002-05-11 13:17:42 -070031320020511
314 - (tim) [configure.ac] applied a rework of djm's OpenSSL search cleanup patch.
315 Now only searches system and /usr/local/ssl (OpenSSL's default install path)
316 Others must use --with-ssl-dir=....
Tim Rice802b9562002-05-11 15:30:04 -0700317 - (tim) [monitor_fdpass.c] fix for systems that have both
Damien Miller860e9292002-05-15 10:12:29 +1000318 HAVE_ACCRIGHTS_IN_MSGHDR and HAVE_CONTROL_IN_MSGHDR. Ie. sys/socket.h
319 has #define msg_accrights msg_control
Tim Riceaef73712002-05-11 13:17:42 -0700320
Damien Millercfe4a892002-05-10 12:19:23 +100032120020510
Kevin Stevesf98fb722002-05-10 15:48:52 +0000322 - (stevesk) [auth.c] Shadow account and expiration cleanup. Now
323 check for root forced expire. Still don't check for inactive.
Damien Millercfe4a892002-05-10 12:19:23 +1000324 - (djm) Rework RedHat RPM files. Based on spec from Nalin
325 Dahyabhai <nalin@redhat.com> and patches from
326 Pekka Savola <pekkas@netcore.fi>
Damien Miller87aea252002-05-10 12:20:24 +1000327 - (djm) Try to drop supplemental groups at daemon startup. Patch from
328 RedHat
Ben Lindstrom0b478142002-05-10 02:40:15 +0000329 - (bal) Back all the way out of auth-passwd.c changes. Breaks too many
330 things that don't set pw->pw_passwd.
Damien Millercfe4a892002-05-10 12:19:23 +1000331
Tim Ricea7a5d6d2002-05-09 07:05:59 -070033220020509
333 - (tim) [Makefile.in] Unbreak make -f Makefile.in distprep
Damien Millerffc868f2002-05-09 15:59:13 +1000334
Tim Ricea7a5d6d2002-05-09 07:05:59 -070033520020508
Tim Rice63cf8412002-05-08 15:57:18 -0700336 - (tim) [openbsd-compat/bsd-arc4random.c] fix logic on when seed_rng() is
337 called. Report by Chris Maxwell <maxwell@cs.dal.ca>
Tim Rice0502a472002-05-08 16:04:14 -0700338 - (tim) [Makefile.in configure.ac] set SHELL variable in Makefile
Tim Ricea7a5d6d2002-05-09 07:05:59 -0700339 - (djm) Disable PAM kbd-int auth if privsep is turned on (it doesn't work)
Tim Rice63cf8412002-05-08 15:57:18 -0700340
34120020507
Tim Rice4bd2a192002-05-07 19:51:31 -0700342 - (tim) [configure.ac openbsd-compat/bsd-misc.c openbsd-compat/bsd-misc.h]
343 Add truncate() emulation to address Bug 208
344
Ben Lindstrom532bbdb2002-05-06 23:06:08 +000034520020506
Damien Miller52910dd2002-05-08 12:18:26 +1000346 - (djm) Unbreak auth-passwd.c for PAM and SIA
Damien Millera33501b2002-05-08 12:24:42 +1000347 - (djm) Unbreak PAM auth for protocol 1. Report from Pekka Savola
348 <pekkas@netcore.fi>
Damien Millerf762a4b2002-05-08 12:27:55 +1000349 - (djm) Don't reinitialise PAM credentials before we have started PAM.
350 Report from Pekka Savola <pekkas@netcore.fi>
351
Damien Miller52910dd2002-05-08 12:18:26 +100035220020506
Ben Lindstrom532bbdb2002-05-06 23:06:08 +0000353 - (bal) Fixed auth-passwd.c to resolve PermitEmptyPassword issue
354
Damien Miller38cd4352002-05-01 13:17:33 +100035520020501
356 - (djm) Import OpenBSD regression tests. Requires BSD make to run
Damien Miller804357a2002-05-01 22:00:22 +1000357 - (djm) Fix readpassphase compilation for systems which have it
Damien Miller38cd4352002-05-01 13:17:33 +1000358
Tim Rice2f092892002-04-29 20:53:12 -070035920020429
360 - (tim) [contrib/caldera/openssh.spec] update fixUP to reflect changes in
361 sshd_config.
362 - (tim) [contrib/cygwin/README] remove reference to regex.
363 patch from Corinna Vinschen <vinschen@redhat.com>
364
Damien Miller13ce9222002-04-26 11:25:40 +100036520020426
366 - (djm) Bug #137, #209: fix make problems for scard/Ssh.bin, do uudecode
367 during distprep only
Damien Miller860e9292002-05-15 10:12:29 +1000368 - (djm) Disable PAM password expiry until a complete fix for bug #188
369 exists
Damien Milleraa100c52002-04-26 16:54:34 +1000370 - (djm) Bug #180: Set ToS bits on IPv4-in-IPv6 mapped addresses. Based on
371 patch from openssh@misc.tecq.org
Damien Miller13ce9222002-04-26 11:25:40 +1000372
Kevin Steves30e494f2002-04-25 17:56:07 +000037320020425
374 - (stevesk) [defines.h] remove USE_TIMEVAL; unused
Kevin Steves0ea1d9d2002-04-25 18:17:04 +0000375 - (stevesk) [acconfig.h auth-passwd.c configure.ac sshd.c] HP-UX 10.26
376 support. bug #184. most from dcole@keysoftsys.com.
Kevin Steves30e494f2002-04-25 17:56:07 +0000377
Damien Miller11ec2812002-04-24 09:48:14 +100037820020424
379 - (djm) OpenBSD CVS Sync
380 - markus@cvs.openbsd.org 2002/04/23 12:54:10
381 [version.h]
382 3.2.1
Damien Miller0150c652002-04-24 09:49:09 +1000383 - djm@cvs.openbsd.org 2002/04/23 22:16:29
384 [sshd.c]
385 Improve error message; ok markus@ stevesk@
Damien Miller11ec2812002-04-24 09:48:14 +1000386
Damien Miller594a71b2002-04-23 20:22:59 +100038720020423
Kevin Steves5feaaef2002-04-23 20:45:55 +0000388 - (stevesk) [acconfig.h configure.ac session.c] LOGIN_NO_ENDOPT for HP-UX
Kevin Steves03df6cd2002-04-23 20:11:13 +0000389 - (stevesk) [acconfig.h] NEED_IN_SYSTM_H unused
Markus Friedl78cf8c32002-04-23 16:41:12 +0200390 - (markus) OpenBSD CVS Sync
391 - markus@cvs.openbsd.org 2002/04/23 12:58:26
392 [radix.c]
393 send complete ticket; semerad@ss1000.ms.mff.cuni.cz
Damien Milleref7c11d2002-04-23 21:13:32 +1000394 - (djm) Trim ChangeLog to include only post-3.1 changes
Damien Miller0b3894d2002-04-23 21:15:31 +1000395 - (djm) Update RPM spec file versions
Damien Miller654a4ef2002-04-23 21:17:17 +1000396 - (djm) Redhat spec enables KrbV by default
Damien Millerf5fea442002-04-23 22:52:45 +1000397 - (djm) Applied OpenSC smartcard updates from Markus &
398 Antti Tapaninen <aet@cc.hut.fi>
399 - (djm) Define BROKEN_REALPATH for AIX, patch from
400 Antti Tapaninen <aet@cc.hut.fi>
Damien Millerf1b9d112002-04-23 23:09:19 +1000401 - (djm) Bug #214: Fix utmp for Irix (don't strip "tty"). Patch from
402 Kevin Taylor <no@nowhere.org> (??) via Philipp Grau
403 <phgrau@zedat.fu-berlin.de>
Damien Millerd77facd2002-04-23 22:59:51 +1000404 - (djm) Bug #213: Simplify CMSG_ALIGN macros to avoid symbol clashes.
405 Reported by Doug Manton <dmanton@emea.att.com>
Damien Miller594a71b2002-04-23 20:22:59 +1000406 - (djm) Bug #222: Fix tests for getaddrinfo on OSF/1. Spotted by
407 Robert Urban <urban@spielwiese.de>
Damien Millerfa2bb692002-04-23 23:22:25 +1000408 - (djm) Bug #206 - blibpath isn't always needed for AIX ld, avoid
409 sizeof(long long int) == 4 breakage. Patch from Matthew Clarke
410 <Matthew_Clarke@mindlink.bc.ca>
Damien Miller79418552002-04-23 20:28:48 +1000411 - (djm) Make privsep work with PAM (still experimental)
Damien Miller3b235662002-04-23 20:42:36 +1000412 - (djm) OpenBSD CVS Sync
413 - deraadt@cvs.openbsd.org 2002/04/20 09:02:03
414 [servconf.c]
415 No, afs requires explicit enabling
416 - markus@cvs.openbsd.org 2002/04/20 09:14:58
417 [bufaux.c bufaux.h]
418 add buffer_{get,put}_short
Damien Millerbad0e012002-04-23 20:46:56 +1000419 - markus@cvs.openbsd.org 2002/04/20 09:17:19
420 [radix.c]
421 rewrite using the buffer_* API, fixes overflow; ok deraadt@
Damien Miller7a8558d2002-04-23 20:51:15 +1000422 - stevesk@cvs.openbsd.org 2002/04/21 16:19:27
423 [sshd.8 sshd_config]
424 document default AFSTokenPassing no; ok deraadt@
Damien Millerf61c0152002-04-23 20:56:02 +1000425 - stevesk@cvs.openbsd.org 2002/04/21 16:25:06
426 [sshconnect1.c]
427 spelling in error message; ok markus@
Damien Miller635fe982002-04-23 21:00:33 +1000428 - markus@cvs.openbsd.org 2002/04/22 06:15:47
429 [radix.c]
430 fix check for overflow
Damien Millerd7de14b2002-04-23 21:04:51 +1000431 - markus@cvs.openbsd.org 2002/04/22 16:16:53
432 [servconf.c sshd.8 sshd_config]
433 do not auto-enable KerberosAuthentication; ok djm@, provos@, deraadt@
Damien Miller2797f7f2002-04-23 21:09:44 +1000434 - markus@cvs.openbsd.org 2002/04/22 21:04:52
435 [channels.c clientloop.c clientloop.h ssh.c]
436 request reply (success/failure) for -R style fwd in protocol v2,
437 depends on ordered replies.
438 fixes http://bugzilla.mindrot.org/show_bug.cgi?id=215; ok provos@
Damien Miller594a71b2002-04-23 20:22:59 +1000439
Tim Ricef02dccc2002-04-21 11:26:10 -070044020020421
441 - (tim) [entropy.c.] Portability fix for SCO Unix 3.2v4.x (SCO OSR 3.0).
Damien Miller860e9292002-05-15 10:12:29 +1000442 entropy.c needs seteuid(getuid()) for the setuid(original_uid) to
443 succeed. Patch by gert@greenie.muc.de. This fixes one part of Bug 208
Tim Ricef02dccc2002-04-21 11:26:10 -0700444
Damien Millera370f4d2002-04-18 22:53:22 +100044520020418
446 - (djm) Avoid SIGCHLD breakage when run from rsync. Fix from
447 Sturle Sunde <sturle.sunde@usit.uio.no>
448
Damien Millerbd638742002-04-17 12:22:58 +100044920020417
Damien Miller860e9292002-05-15 10:12:29 +1000450 - (djm) Tell users to configure /dev/random support into OpenSSL in
451 INSTALL
Damien Miller5efd7102002-04-17 12:30:45 +1000452 - (djm) Fix .Nm in mdoc2man.pl from pspencer@fields.utoronto.ca
Tim Rice43a1c132002-04-17 21:19:14 -0700453 - (tim) [configure.ac] Issue warning on --with-default-path=/some_path
454 if LOGIN_CAP is enabled. Report & testing by Tuc <tuc@ttsg.com>
Damien Millerbd638742002-04-17 12:22:58 +1000455
Damien Miller8be24f32002-04-15 13:23:59 +100045620020415
Damien Miller860e9292002-05-15 10:12:29 +1000457 - (djm) Unbreak "make install". Fix from Darren Tucker
458 <dtucker@zip.com.au>
Kevin Steveseb363022002-04-15 22:00:51 +0000459 - (stevesk) bsd-cygwin_util.[ch] BSD license from Corinna Vinschen
Tim Rice66480f12002-04-15 21:10:09 -0700460 - (tim) [configure.ac] add tests for recvmsg and sendmsg.
461 [monitor_fdpass.c] add checks for HAVE_SENDMSG and HAVE_RECVMSG for
462 systems that HAVE_ACCRIGHTS_IN_MSGHDR but no recvmsg or sendmsg.
Damien Miller8be24f32002-04-15 13:23:59 +1000463
Damien Miller32e48182002-04-14 19:27:12 +100046420020414
465 - (djm) ssh-rand-helper improvements
466 - Add commandline debugging options
467 - Don't write binary data if stdout is a tty (use hex instead)
468 - Give it a manpage
Damien Miller49411ff2002-04-14 23:16:04 +1000469 - (djm) Random number collection doc fixes from Ben
Damien Miller32e48182002-04-14 19:27:12 +1000470
Damien Millerfd4c9ee2002-04-13 11:04:40 +100047120020413
472 - (djm) Add KrbV support patch from Simon Wilkinson <simon@sxw.org.uk>
473
Kevin Steves19fa9b52002-04-12 15:36:07 +000047420020412
475 - (stevesk) [auth-sia.[ch]] add BSD license from Chris Adams
Tim Riceae49fe62002-04-12 10:26:21 -0700476 - (tim) [configure.ac] add <sys/types.h> to msghdr tests. Change -L
477 to -h on testing for /bin being symbolic link
Ben Lindstromc42f7cf2002-04-12 17:44:13 +0000478 - (bal) Mistaken in Cygwin scripts for ssh starting. Patch by
479 Corinna Vinschen <vinschen@redhat.com>
Ben Lindstrom927dfd22002-04-12 18:51:22 +0000480 - (bal) disable privsep if no MAP_ANON. We can re-enable it
481 after the release when we can do more testing.
Kevin Steves19fa9b52002-04-12 15:36:07 +0000482
Kevin Steves0c283d82002-04-11 20:39:40 +000048320020411
484 - (stevesk) [auth-sia.c] cleanup
Tim Rice813f0452002-04-11 20:35:39 -0700485 - (tim) [acconfig.h defines.h includes.h] put includes in includes.h and
486 defines in defines.h [rijndael.c openbsd-compat/fake-socket.h
487 openbsd-compat/inet_aton.c] include "includes.h" instead of "config.h"
488 ok stevesk@
Kevin Steves0c283d82002-04-11 20:39:40 +0000489
Kevin Steves6939b232002-04-10 16:09:51 +000049020020410
Kevin Stevesfe6ca542002-04-10 22:04:54 +0000491 - (stevesk) [configure.ac monitor.c] HAVE_SOCKETPAIR
Kevin Steves6939b232002-04-10 16:09:51 +0000492 - (stevesk) [auth-sia.c] compile fix Chris Adams <cmadams@hiwaay.net>
Ben Lindstromb5115ea2002-04-10 16:17:34 +0000493 - (bal) OpenBSD CVS Sync
494 - markus@cvs.openbsd.org 2002/04/10 08:21:47
495 [auth1.c compat.c compat.h]
Damien Miller860e9292002-05-15 10:12:29 +1000496 strip '@' from username only for KerbV and known broken clients,
497 bug #204
Ben Lindstrom027e4de2002-04-10 16:26:20 +0000498 - markus@cvs.openbsd.org 2002/04/10 08:56:01
499 [version.h]
500 OpenSSH_3.2
501 - Added p1 to idenify Portable release version.
Kevin Steves6939b232002-04-10 16:09:51 +0000502
Ben Lindstrom34b73202002-04-08 18:37:07 +000050320020408
504 - (bal) Minor OpenSC updates. Fix up header locations and update
505 README.smartcard provided by Juha Yrjölä <jyrjola@cc.hut.fi>
506
Kevin Stevesa44e0352002-04-07 16:18:03 +000050720020407
508 - (stevesk) HAVE_CONTROL_IN_MSGHDR; not used right now.
509 Future: we may want to test if fd passing works correctly.
Kevin Stevesc3c82552002-04-07 16:39:12 +0000510 - (stevesk) [monitor_fdpass.c] fatal() for UsePrivilegeSeparation=yes
511 and no fd passing support.
Kevin Steves86b9fe62002-04-07 17:08:53 +0000512 - (stevesk) HAVE_MMAP and HAVE_SYS_MMAN_H and use them in
513 monitor_mm.c
Kevin Stevesb1184bb2002-04-07 18:12:03 +0000514 - (stevesk) remove configure support for poll.h; it was removed
515 from sshd.c a long time ago.
Kevin Steves7ff91122002-04-07 19:22:54 +0000516 - (stevesk) --with-privsep-user; default sshd
Kevin Steves265c9d02002-04-07 22:36:49 +0000517 - (stevesk) wrap munmap() with HAVE_MMAP also.
Kevin Stevesa44e0352002-04-07 16:18:03 +0000518
Damien Miller12db56b2002-04-06 11:12:52 +100051920020406
520 - (djm) Typo in Suse SPEC file. Fix from Carsten Grohmann
521 <carsten.grohmann@dr-baldeweg.de>
Ben Lindstromdc0594c2002-04-06 04:11:28 +0000522 - (bal) Added MAP_FAILED to allow AIX and Trusted HP to compile.
Ben Lindstrom06e95152002-04-06 04:16:45 +0000523 - (bal) OpenBSD CVS Sync
524 - djm@cvs.openbsd.org 2002/04/06 00:30:08
525 [sftp-client.c]
Damien Millerf75fcc62002-04-23 23:32:38 +1000526 Fix occasional corruption on upload due to bad reuse of request
527 id, spotted by chombier@mac.com; ok markus@
Ben Lindstromde3895d2002-04-06 18:29:59 +0000528 - mouring@cvs.openbsd.org 2002/04/06 18:24:09
529 [scp.c]
530 Fixes potental double // within path.
531 http://bugzilla.mindrot.org/show_bug.cgi?id=76
Ben Lindstrom8d601752002-04-06 18:19:38 +0000532 - (bal) Slight update to OpenSC support. Better version checking. patch
533 by Juha Yrjölä <jyrjola@cc.hut.fi>
Ben Lindstrom8ff2a8d2002-04-06 18:58:31 +0000534 - (bal) Revered out of runtime IRIX detection of joblimits. Code is
535 incomplete.
Ben Lindstrom03188012002-04-06 20:30:07 +0000536 - (bal) Quiet down configure.ac if /bin/test does not exist.
Ben Lindstromfdee8ef2002-04-06 23:52:02 +0000537 - (bal) We no longer use atexit()/xatexit()/on_exit()
Damien Miller12db56b2002-04-06 11:12:52 +1000538
Ben Lindstroma42694f2002-04-05 16:11:45 +000053920020405
540 - (bal) Patch for OpenSC SmartCard library; ok markus@; patch by
541 Juha Yrjölä <jyrjola@cc.hut.fi>
542 - (bal) Minor documentation update to reflect smartcard library
543 support changes.
Ben Lindstrom924144e2002-04-05 20:23:35 +0000544 - (bal) Too many <sys/queue.h> issues. Remove all workarounds and
545 using internal version only.
Ben Lindstroma11e2702002-04-05 22:18:48 +0000546 - (bal) OpenBSD CVS Sync
547 - stevesk@cvs.openbsd.org 2002/04/05 20:56:21
548 [sshd.8]
549 clarify sshrc some and handle X11UseLocalhost=yes; ok markus@
Ben Lindstroma42694f2002-04-05 16:11:45 +0000550
Kevin Stevese683e762002-04-04 19:02:28 +000055120020404
552 - (stevesk) [auth-pam.c auth-pam.h auth-passwd.c auth-sia.c auth-sia.h
553 auth1.c auth2.c] PAM, OSF_SIA password auth cleanup; from djm.
Ben Lindstrom8a725a82002-04-04 22:10:38 +0000554 - (bal) OpenBSD CVS Sync
555 - markus@cvs.openbsd.org 2002/04/03 09:26:11
556 [cipher.c myproposal.h]
557 re-add rijndael-cbc@lysator.liu.se for MacSSH; ash@lab.poc.net
Kevin Stevese683e762002-04-04 19:02:28 +0000558
Ben Lindstromcdb66e02002-04-02 20:17:43 +000055920020402
560 - (bal) Hand Sync of scp.c (reverted to upstream code)
561 - deraadt@cvs.openbsd.org 2002/03/30 17:45:46
562 [scp.c]
563 stretch banners
Ben Lindstrom1e259bb2002-04-02 20:53:39 +0000564 - (bal) CVS ID sync of uidswap.c
Ben Lindstrom155b9812002-04-02 20:26:26 +0000565 - (bal) OpenBSD CVS Sync (now for the real sync)
566 - markus@cvs.openbsd.org 2002/03/27 22:21:45
567 [ssh-keygen.c]
Damien Miller860e9292002-05-15 10:12:29 +1000568 try to import keys with extra trailing === (seen with ssh.com <
569 2.0.12)
Ben Lindstrom2bf56e22002-04-02 20:32:46 +0000570 - markus@cvs.openbsd.org 2002/03/28 15:34:51
571 [session.c]
572 do not call record_login twice (for use_privsep)
Ben Lindstromc447fee2002-04-02 20:35:35 +0000573 - markus@cvs.openbsd.org 2002/03/29 18:59:32
574 [session.c session.h]
Damien Miller860e9292002-05-15 10:12:29 +1000575 retrieve last login time before the pty is allocated, store per
576 session
Ben Lindstrom0d0be022002-04-02 20:39:29 +0000577 - stevesk@cvs.openbsd.org 2002/03/29 19:16:22
578 [sshd.8]
579 RSA key modulus size minimum 768; ok markus@
Ben Lindstrom03f39322002-04-02 20:43:11 +0000580 - stevesk@cvs.openbsd.org 2002/03/29 19:18:33
581 [auth-rsa.c ssh-rsa.c ssh.h]
582 make RSA modulus minimum #define; ok markus@
Ben Lindstrom47fd8112002-04-02 20:48:19 +0000583 - markus@cvs.openbsd.org 2002/03/30 18:51:15
584 [monitor.c serverloop.c sftp-int.c sftp.c sshd.c]
585 check waitpid for EINTR; based on patch from peter@ifm.liu.se
Ben Lindstroma1d81142002-04-02 20:58:11 +0000586 - markus@cvs.openbsd.org 2002/04/01 22:02:16
587 [sftp-client.c]
588 20480 is an upper limit for older server
Ben Lindstromf26ff5b2002-04-02 21:00:31 +0000589 - markus@cvs.openbsd.org 2002/04/01 22:07:17
590 [sftp-client.c]
591 fallback to stat if server does not support lstat
Ben Lindstromeecdf232002-04-02 21:03:51 +0000592 - markus@cvs.openbsd.org 2002/04/02 11:49:39
593 [ssh-agent.c]
594 check $SHELL for -k and -d, too;
595 http://bugzilla.mindrot.org/show_bug.cgi?id=199
Ben Lindstrom2f3d52a2002-04-02 21:06:18 +0000596 - markus@cvs.openbsd.org 2002/04/02 17:37:48
597 [sftp.c]
598 always call log_init()
Ben Lindstrom07739fe2002-04-03 03:03:04 +0000599 - markus@cvs.openbsd.org 2002/04/02 20:11:38
600 [ssh-rsa.c]
601 ignore SSH_BUG_SIGBLOB for ssh-rsa; #187
Ben Lindstromaf40bc62002-04-03 03:36:54 +0000602 - (bal) mispelling in uidswap.c (portable only)
Ben Lindstromcdb66e02002-04-02 20:17:43 +0000603
Kevin Stevesbd1901b2002-04-01 18:04:35 +000060420020401
605 - (stevesk) [monitor.c] PAM should work again; will *not* work with
606 UsePrivilegeSeparation=yes.
Kevin Steves38c4a282002-04-02 03:24:56 +0000607 - (stevesk) [auth1.c] fix password auth for protocol 1 when
608 !USE_PAM && !HAVE_OSF_SIA; merge issue.
Kevin Stevesbd1901b2002-04-01 18:04:35 +0000609
Tim Rice49e457c2002-03-31 11:23:06 -080061020020331
611 - (tim) [configure.ac] use /bin/test -L to work around broken builtin on
612 Solaris 8
Tim Ricec8549622002-03-31 12:49:38 -0800613 - (tim) [sshconnect2.c] change uint32_t to u_int32_t
Tim Rice49e457c2002-03-31 11:23:06 -0800614
Kevin Steves117b06d2002-03-30 17:55:21 +000061520020330
616 - (stevesk) [configure.ac] remove header check for sys/ttcompat.h
617 bug 167
618
Ben Lindstrom53f18302002-03-27 16:50:03 +000061920020327
620 - (bal) 'pw' should be 'authctxt->pw' in auth1.c spotted by
621 kent@lysator.liu.se
Ben Lindstromf1813842002-03-27 17:18:31 +0000622 - (bal) OpenBSD CVS Sync
623 - markus@cvs.openbsd.org 2002/03/26 11:34:49
624 [ssh.1 sshd.8]
625 update to recent drafts
Ben Lindstromeb041dc2002-03-27 17:20:38 +0000626 - markus@cvs.openbsd.org 2002/03/26 11:37:05
627 [ssh.c]
628 update Copyright
Ben Lindstromcd8bbce2002-03-27 17:23:44 +0000629 - markus@cvs.openbsd.org 2002/03/26 15:23:40
630 [bufaux.c]
631 do not talk about packets in bufaux
Ben Lindstrom43a5e2f2002-03-27 17:33:17 +0000632 - rees@cvs.openbsd.org 2002/03/26 18:46:59
633 [scard.c]
Damien Miller860e9292002-05-15 10:12:29 +1000634 try_AUT0 in read_pubkey too, for those paranoid few who want to
635 acl 'sh'
Ben Lindstrom57686a82002-03-27 17:36:41 +0000636 - markus@cvs.openbsd.org 2002/03/26 22:50:39
637 [channels.h]
638 CHANNEL_EFD_OUTPUT_ACTIVE is false for CHAN_CLOSE_RCVD, too
Ben Lindstrome1f9e322002-03-27 17:38:43 +0000639 - markus@cvs.openbsd.org 2002/03/26 23:13:03
640 [auth-rsa.c]
641 disallow RSA keys < 768 for protocol 1, too (rhosts-rsa and rsa auth)
Ben Lindstrom59971722002-03-27 17:42:57 +0000642 - markus@cvs.openbsd.org 2002/03/26 23:14:51
643 [kex.c]
644 generate a new cookie for each SSH2_MSG_KEXINIT message we send out
Ben Lindstromb57a4bf2002-03-27 18:00:59 +0000645 - mouring@cvs.openbsd.org 2002/03/27 11:45:42
646 [monitor.c]
647 monitor_allowed_key() returns int instead of pointer. ok markus@
648
Kevin Steves6205a182002-03-26 00:12:49 +000064920020325
650 - (stevesk) import OpenBSD <sys/tree.h> as "openbsd-compat/tree.h"
Ben Lindstromf90f58d2002-03-26 01:53:03 +0000651 - (bal) OpenBSD CVS Sync
652 - stevesk@cvs.openbsd.org 2002/03/23 20:57:26
653 [sshd.c]
654 setproctitle() after preauth child; ok markus@
Ben Lindstrom3dc40f92002-03-26 02:01:30 +0000655 - markus@cvs.openbsd.org 2002/03/24 16:00:27
656 [serverloop.c]
657 remove unused debug
Ben Lindstrom8b08d812002-03-26 02:09:41 +0000658 - markus@cvs.openbsd.org 2002/03/24 16:01:13
659 [packet.c]
660 debug->debug3 for extra padding
Ben Lindstromfcad1c92002-03-26 02:20:06 +0000661 - stevesk@cvs.openbsd.org 2002/03/24 17:27:03
662 [kexgex.c]
663 typo; ok markus@
Ben Lindstrom31ee7ae2002-03-26 02:36:29 +0000664 - stevesk@cvs.openbsd.org 2002/03/24 17:53:16
665 [monitor_fdpass.c]
666 minor cleanup and more error checking; ok markus@
Ben Lindstromc2c6cbc2002-03-26 02:44:44 +0000667 - markus@cvs.openbsd.org 2002/03/24 18:05:29
668 [scard.c]
669 we need to figure out AUT0 for sc_private_encrypt, too
Ben Lindstrom2e9d8662002-03-26 02:49:34 +0000670 - stevesk@cvs.openbsd.org 2002/03/24 23:20:00
671 [monitor.c]
672 remove "\n" from fatal()
Ben Lindstromf6d367b2002-03-26 02:59:31 +0000673 - markus@cvs.openbsd.org 2002/03/25 09:21:13
674 [auth-rsa.c]
675 return 0 (not NULL); tomh@po.crl.go.jp
Ben Lindstrom5facb2b2002-03-26 03:08:47 +0000676 - markus@cvs.openbsd.org 2002/03/25 09:25:06
677 [auth-rh-rsa.c]
678 rm bogus comment
Ben Lindstrom0936a5b2002-03-26 03:17:42 +0000679 - markus@cvs.openbsd.org 2002/03/25 17:34:27
680 [scard.c scard.h ssh-agent.c ssh-keygen.c ssh.c]
681 change sc_get_key to sc_get_keys and hide smartcard details in scard.c
Ben Lindstromc8615472002-03-26 03:20:45 +0000682 - stevesk@cvs.openbsd.org 2002/03/25 20:12:10
683 [monitor_mm.c monitor_wrap.c]
684 ssize_t args use "%ld" and cast to (long)
685 size_t args use "%lu" and cast to (u_long)
686 ok markus@ and thanks millert@
Ben Lindstrom4f054602002-03-26 03:23:00 +0000687 - markus@cvs.openbsd.org 2002/03/25 21:04:02
688 [ssh.c]
689 simplify num_identity_files handling
Ben Lindstromcf159442002-03-26 03:26:24 +0000690 - markus@cvs.openbsd.org 2002/03/25 21:13:51
691 [channels.c channels.h compat.c compat.h nchan.c]
Damien Miller860e9292002-05-15 10:12:29 +1000692 don't send stderr data after EOF, accept this from older known
693 (broken) sshd servers only, fixes
694 http://bugzilla.mindrot.org/show_bug.cgi?id=179
Ben Lindstrom28364ec2002-03-26 03:42:20 +0000695 - stevesk@cvs.openbsd.org 2002/03/26 03:24:01
696 [monitor.h monitor_fdpass.h monitor_mm.h monitor_wrap.h]
697 $OpenBSD$
Kevin Steves6205a182002-03-26 00:12:49 +0000698
Kevin Stevesb4799a32002-03-24 23:19:54 +000069920020324
700 - (stevesk) [session.c] disable LOGIN_NEEDS_TERM until we are sure
701 it can be removed. only used on solaris. will no longer compile with
702 privsep shuffling.
703
Kevin Steves939c9db2002-03-22 17:23:25 +000070420020322
705 - (stevesk) HAVE_ACCRIGHTS_IN_MSGHDR configure support
Kevin Steves7e147602002-03-22 18:07:17 +0000706 - (stevesk) [monitor.c monitor_wrap.c] #ifdef HAVE_PW_CLASS_IN_PASSWD
Kevin Steves4846f4a2002-03-22 18:19:53 +0000707 - (stevesk) configure and cpp __FUNCTION__ gymnastics to handle nielsisms
Kevin Steves1adb1202002-03-22 19:32:53 +0000708 - (stevesk) [monitor_fdpass.c] support for access rights style file
709 descriptor passing
Kevin Steves205cc1e2002-03-22 20:43:05 +0000710 - (stevesk) [auth2.c] merge cleanup/sync
Kevin Steves219bef12002-03-22 20:53:32 +0000711 - (stevesk) [defines.h] hp-ux 11 has ancillary data style fd passing, but
712 is missing CMSG_LEN() and CMSG_SPACE() macros.
Kevin Steves4435a552002-03-22 21:08:03 +0000713 - (stevesk) [defines.h] #define MAP_ANON MAP_ANONYMOUS for HP-UX; other
714 platforms may need this--I'm not sure. mmap() issues will need to be
715 addressed further.
Tim Ricef29a6532002-03-22 13:27:40 -0800716 - (tim) [cipher.c] fix problem with OpenBSD sync
Kevin Steves4408c202002-03-23 02:20:07 +0000717 - (stevesk) [LICENCE] OpenBSD sync
Kevin Steves939c9db2002-03-22 17:23:25 +0000718
Ben Lindstromd45f28c2002-03-22 01:00:57 +000071920020321
720 - (bal) OpenBSD CVS Sync
721 - itojun@cvs.openbsd.org 2002/03/08 06:10:16
722 [sftp-client.c]
723 printf type mismatch
Ben Lindstromeb505452002-03-22 01:03:15 +0000724 - itojun@cvs.openbsd.org 2002/03/11 03:18:49
725 [sftp-client.c]
726 correct type mismatches (u_int64_t != unsigned long long)
Ben Lindstrom83b79e42002-03-22 01:05:27 +0000727 - itojun@cvs.openbsd.org 2002/03/11 03:19:53
728 [sftp-client.c]
729 indent
Ben Lindstrom5c159582002-03-22 01:08:07 +0000730 - markus@cvs.openbsd.org 2002/03/14 15:24:27
731 [sshconnect1.c]
Damien Miller860e9292002-05-15 10:12:29 +1000732 don't trust size sent by (rogue) server; noted by
733 s.esser@e-matters.de
Ben Lindstromabcb1452002-03-22 01:10:21 +0000734 - markus@cvs.openbsd.org 2002/03/14 16:38:26
735 [sshd.c]
736 split out ssh1 session key decryption; ok provos@
Ben Lindstrom9c8aefe2002-03-22 01:12:58 +0000737 - markus@cvs.openbsd.org 2002/03/14 16:56:33
738 [auth-rh-rsa.c auth-rsa.c auth.h]
739 split auth_rsa() for better readability and privsep; ok provos@
Ben Lindstromb61e6df2002-03-22 01:15:33 +0000740 - itojun@cvs.openbsd.org 2002/03/15 11:00:38
741 [auth.c]
742 fix file type checking (use S_ISREG). ok by markus
Ben Lindstromce398b22002-03-22 01:17:52 +0000743 - markus@cvs.openbsd.org 2002/03/16 11:24:53
744 [compress.c]
745 skip inflateEnd if inflate fails; ok provos@
Ben Lindstrom186b7da2002-03-22 01:20:32 +0000746 - markus@cvs.openbsd.org 2002/03/16 17:22:09
747 [auth-rh-rsa.c auth.h]
748 split auth_rhosts_rsa(), ok provos@
Ben Lindstromeacc71b2002-03-22 01:22:27 +0000749 - stevesk@cvs.openbsd.org 2002/03/16 17:41:25
750 [auth-krb5.c]
751 BSD license. from Daniel Kouril via Dug Song. ok markus@
Ben Lindstrom2ae18f42002-03-22 01:24:38 +0000752 - provos@cvs.openbsd.org 2002/03/17 20:25:56
753 [auth.c auth.h auth1.c auth2.c]
Damien Miller860e9292002-05-15 10:12:29 +1000754 getpwnamallow returns struct passwd * only if user valid;
755 okay markus@
Ben Lindstrom73ab9ba2002-03-22 01:27:35 +0000756 - provos@cvs.openbsd.org 2002/03/18 01:12:14
757 [auth.h auth1.c auth2.c sshd.c]
758 have the authentication functions return the authentication context
759 and then do_authenticated; okay millert@
Ben Lindstromabf31442002-03-22 01:30:40 +0000760 - dugsong@cvs.openbsd.org 2002/03/18 01:30:10
761 [auth-krb4.c]
762 set client to NULL after xfree(), from Rolf Braun
763 <rbraun+ssh@andrew.cmu.edu>
Ben Lindstromb481e132002-03-22 01:35:47 +0000764 - provos@cvs.openbsd.org 2002/03/18 03:41:08
765 [auth.c session.c]
766 move auth_approval into getpwnamallow with help from millert@
Ben Lindstrom212faca2002-03-22 01:39:44 +0000767 - markus@cvs.openbsd.org 2002/03/18 17:13:15
768 [cipher.c cipher.h]
769 export/import cipher states; needed by ssh-privsep
Ben Lindstromf6027d32002-03-22 01:42:04 +0000770 - markus@cvs.openbsd.org 2002/03/18 17:16:38
771 [packet.c packet.h]
772 export/import cipher state, iv and ssh2 seqnr; needed by ssh-privsep
Ben Lindstroma674e8d2002-03-22 01:45:53 +0000773 - markus@cvs.openbsd.org 2002/03/18 17:23:31
774 [key.c key.h]
775 add key_demote() for ssh-privsep
Ben Lindstrom88aa1b42002-03-22 01:47:52 +0000776 - provos@cvs.openbsd.org 2002/03/18 17:25:29
777 [bufaux.c bufaux.h]
778 buffer_skip_string and extra sanity checking; needed by ssh-privsep
Ben Lindstrom0f345f52002-03-22 01:51:24 +0000779 - provos@cvs.openbsd.org 2002/03/18 17:31:54
780 [compress.c]
781 export compression streams for ssh-privsep
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000782 - provos@cvs.openbsd.org 2002/03/18 17:50:31
Damien Milleree5e3b22002-05-15 10:08:17 +1000783 [auth-bsdauth.c auth-options.c auth-rh-rsa.c auth-rsa.c]
784 [auth-skey.c auth.h auth1.c auth2-chall.c auth2.c kex.c kex.h kexdh.c]
785 [kexgex.c servconf.c]
786 [session.h servconf.h serverloop.c session.c sshd.c]
787 integrate privilege separated openssh; its turned off by default
788 for now. work done by me and markus@
Ben Lindstrom000dda52002-03-22 02:33:12 +0000789 - provos@cvs.openbsd.org 2002/03/18 17:53:08
790 [sshd.8]
791 credits for privsep
Ben Lindstrom191c8e52002-03-22 02:37:50 +0000792 - provos@cvs.openbsd.org 2002/03/18 17:59:09
793 [sshd.8]
794 document UsePrivilegeSeparation
Ben Lindstrom01426a62002-03-22 02:40:03 +0000795 - stevesk@cvs.openbsd.org 2002/03/18 23:52:51
796 [servconf.c]
797 UnprivUser/UnprivGroup usable now--specify numeric user/group; ok
798 provos@
Ben Lindstrom7a7edf72002-03-22 02:42:37 +0000799 - stevesk@cvs.openbsd.org 2002/03/19 03:03:43
800 [pathnames.h servconf.c servconf.h sshd.c]
801 _PATH_PRIVSEP_CHROOT_DIR; ok provos@
Ben Lindstrom85520a62002-03-22 02:44:40 +0000802 - stevesk@cvs.openbsd.org 2002/03/19 05:23:08
803 [sshd.8]
804 Banner has no default.
Ben Lindstromcb1f60e2002-03-22 02:47:28 +0000805 - mpech@cvs.openbsd.org 2002/03/19 06:32:56
806 [sftp-int.c]
807 use xfree() after xstrdup().
808
809 markus@ ok
Ben Lindstrom08105192002-03-22 02:50:06 +0000810 - markus@cvs.openbsd.org 2002/03/19 10:35:39
811 [auth-options.c auth.h session.c session.h sshd.c]
812 clean up prototypes
Ben Lindstrom6328ab32002-03-22 02:54:23 +0000813 - markus@cvs.openbsd.org 2002/03/19 10:49:35
Damien Milleree5e3b22002-05-15 10:08:17 +1000814 [auth-krb5.c auth-rh-rsa.c auth.c cipher.c key.c misc.h]
815 [packet.c session.c sftp-client.c sftp-glob.h sftp.c ssh-add.c ssh.c]
816 [sshconnect2.c sshd.c ttymodes.c]
Ben Lindstrom6328ab32002-03-22 02:54:23 +0000817 KNF whitespace
Ben Lindstrom7ebb6352002-03-22 03:04:08 +0000818 - markus@cvs.openbsd.org 2002/03/19 14:27:39
819 [auth.c auth1.c auth2.c]
820 make getpwnamallow() allways call pwcopy()
Ben Lindstromf34e4eb2002-03-22 03:08:30 +0000821 - markus@cvs.openbsd.org 2002/03/19 15:31:47
822 [auth.c]
823 check for NULL; from provos@
Ben Lindstromc7431342002-03-22 03:11:49 +0000824 - stevesk@cvs.openbsd.org 2002/03/20 19:12:25
825 [servconf.c servconf.h ssh.h sshd.c]
826 for unprivileged user, group do:
827 pw=getpwnam(SSH_PRIVSEP_USER); do_setusercontext(pw). ok provos@
Ben Lindstrom58b391b2002-03-22 03:21:16 +0000828 - stevesk@cvs.openbsd.org 2002/03/20 21:08:08
829 [sshd.c]
830 strerror() on chdir() fail; ok provos@
Ben Lindstrom1ee9ec32002-03-22 03:14:45 +0000831 - markus@cvs.openbsd.org 2002/03/21 10:21:20
832 [ssh-add.c]
833 ignore errors for nonexisting default keys in ssh-add,
834 fixes http://bugzilla.mindrot.org/show_bug.cgi?id=158
Ben Lindstrom5589f4b2002-03-22 03:24:32 +0000835 - jakob@cvs.openbsd.org 2002/03/21 15:17:26
836 [clientloop.c ssh.1]
837 add built-in command line for adding new port forwardings on the fly.
838 based on a patch from brian wellington. ok markus@.
Ben Lindstrom0b675b12002-03-22 03:28:11 +0000839 - markus@cvs.openbsd.org 2002/03/21 16:38:06
840 [scard.c]
841 make compile w/ openssl 0.9.7
Ben Lindstrom70e3ad82002-03-22 03:33:43 +0000842 - markus@cvs.openbsd.org 2002/03/21 16:54:53
843 [scard.c scard.h ssh-keygen.c]
844 move key upload to scard.[ch]
845 - markus@cvs.openbsd.org 2002/03/21 16:57:15
846 [scard.c]
847 remove const
Ben Lindstromeda98a72002-03-22 03:35:48 +0000848 - markus@cvs.openbsd.org 2002/03/21 16:58:13
849 [clientloop.c]
850 remove unused
Ben Lindstrom818659a2002-03-22 03:38:35 +0000851 - rees@cvs.openbsd.org 2002/03/21 18:08:15
852 [scard.c]
853 In sc_put_key(), sc_reader_id should be id.
Ben Lindstromfa1336f2002-03-22 03:40:58 +0000854 - markus@cvs.openbsd.org 2002/03/21 20:51:12
855 [sshd_config]
856 add privsep (off)
Ben Lindstrom943481c2002-03-22 03:43:46 +0000857 - markus@cvs.openbsd.org 2002/03/21 21:23:34
858 [sshd.c]
859 add privsep_preauth() and remove 1 goto; ok provos@
Ben Lindstrom266ec632002-03-22 03:47:38 +0000860 - rees@cvs.openbsd.org 2002/03/21 21:54:34
861 [scard.c scard.h ssh-keygen.c]
862 Add PIN-protection for secret key.
Ben Lindstromba72d302002-03-22 03:51:06 +0000863 - rees@cvs.openbsd.org 2002/03/21 22:44:05
864 [authfd.c authfd.h ssh-add.c ssh-agent.c ssh.c]
865 Add PIN-protection for secret key.
Ben Lindstrom681d9322002-03-22 03:53:00 +0000866 - markus@cvs.openbsd.org 2002/03/21 23:07:37
867 [clientloop.c]
868 remove unused, sync w/ cmdline patch in my tree.
Ben Lindstromfa1336f2002-03-22 03:40:58 +0000869
Tim Rice88f2ab52002-03-17 12:17:34 -080087020020317
Damien Miller860e9292002-05-15 10:12:29 +1000871 - (tim) [configure.ac] Assume path given with --with-pid-dir=PATH is
872 wanted, warn if directory does not exist. Put system directories in
873 front of PATH for finding entorpy commands.
Tim Rice3a423462002-03-17 14:05:24 -0800874 - (tim) [contrib/aix/buildbff.sh contrib/aix/inventory.sh] AIX package
875 build fixes. Patch by Darren Tucker <dtucker@zip.com.au>
876 [contrib/solaris/buildpkg.sh] add missing dirs to SYSTEM_DIR. Have
877 postinstall check for $piddir and add if necessary.
Tim Rice88f2ab52002-03-17 12:17:34 -0800878
Tim Rice29bdd2c2002-03-11 20:55:53 -080087920020311
880 - (tim) [contrib/solaris/buildpkg.sh, contrib/solaris/README] Updated to
881 build on all platforms that support SVR4 style package tools. Now runs
882 from build dir. Parts are based on patches from Antonio Navarro, and
883 Darren Tucker.
884
Damien Millerff8f94c2002-03-11 10:48:53 +110088520020308
Damien Millerc7375ac2002-03-11 10:51:17 +1100886 - (djm) Revert bits of Markus' OpenSSL compat patch which was
887 accidentally committed.
888 - (djm) Add Markus' patch for compat wih OpenSSL < 0.9.6.
889 Known issue: Blowfish for SSH1 does not work
Kevin Steves58193072002-03-11 00:16:34 +0000890 - (stevesk) entropy.c: typo in debug message
Damien Miller4a10d2e2002-03-11 22:53:29 +1100891 - (djm) ssh-keygen -i needs seeded RNG; report from markus@
Damien Millerff8f94c2002-03-11 10:48:53 +1100892
Ben Lindstrom914d0372002-06-11 15:55:01 +0000893$Id: ChangeLog,v 1.2206 2002/06/11 15:55:01 mouring Exp $