|
 |
b58e57 |
# Do we want SELinux & Audit
|
|
|
b58e57 |
%if 0%{?!noselinux:1}
|
|
|
b58e57 |
%define WITH_SELINUX 1
|
|
|
b58e57 |
%else
|
|
|
b58e57 |
%define WITH_SELINUX 0
|
|
|
b58e57 |
%endif
|
|
|
b58e57 |
|
|
|
b58e57 |
# OpenSSH privilege separation requires a user & group ID
|
|
|
b58e57 |
%define sshd_uid 74
|
|
|
b58e57 |
%define sshd_gid 74
|
|
|
b58e57 |
|
|
|
b58e57 |
# Do we want to disable building of gnome-askpass? (1=yes 0=no)
|
|
|
b58e57 |
%define no_gnome_askpass 0
|
|
|
b58e57 |
|
|
|
b58e57 |
# Do we want to link against a static libcrypto? (1=yes 0=no)
|
|
|
b58e57 |
%define static_libcrypto 0
|
|
|
b58e57 |
|
|
|
b58e57 |
# Use GTK2 instead of GNOME in gnome-ssh-askpass
|
|
|
b58e57 |
%define gtk2 1
|
|
|
b58e57 |
|
|
|
b58e57 |
# Build position-independent executables (requires toolchain support)?
|
|
|
b58e57 |
%define pie 1
|
|
|
b58e57 |
|
|
|
b58e57 |
# Do we want kerberos5 support (1=yes 0=no)
|
|
|
b58e57 |
%define kerberos5 1
|
|
|
b58e57 |
|
|
|
b58e57 |
# Do we want libedit support
|
|
|
b58e57 |
%define libedit 1
|
|
|
b58e57 |
|
|
|
b58e57 |
# Do we want LDAP support
|
|
|
b58e57 |
%define ldap 1
|
|
|
b58e57 |
|
|
|
b58e57 |
# Whether to build pam_ssh_agent_auth
|
|
|
b58e57 |
%if 0%{?!nopam:1}
|
|
|
b58e57 |
%define pam_ssh_agent 1
|
|
|
b58e57 |
%else
|
|
|
b58e57 |
%define pam_ssh_agent 0
|
|
|
b58e57 |
%endif
|
|
|
b58e57 |
|
|
|
b58e57 |
# Reserve options to override askpass settings with:
|
|
|
b58e57 |
# rpm -ba|--rebuild --define 'skip_xxx 1'
|
|
|
b58e57 |
%{?skip_gnome_askpass:%global no_gnome_askpass 1}
|
|
|
b58e57 |
|
|
|
b58e57 |
# Add option to build without GTK2 for older platforms with only GTK+.
|
|
|
b58e57 |
# Red Hat Linux <= 7.2 and Red Hat Advanced Server 2.1 are examples.
|
|
|
b58e57 |
# rpm -ba|--rebuild --define 'no_gtk2 1'
|
|
|
b58e57 |
%{?no_gtk2:%global gtk2 0}
|
|
|
b58e57 |
|
|
|
b58e57 |
# Options for static OpenSSL link:
|
|
|
b58e57 |
# rpm -ba|--rebuild --define "static_openssl 1"
|
|
|
b58e57 |
%{?static_openssl:%global static_libcrypto 1}
|
|
|
b58e57 |
|
|
|
b58e57 |
# Is this a build for the rescue CD (without PAM, with MD5)? (1=yes 0=no)
|
|
|
b58e57 |
%define rescue 0
|
|
|
b58e57 |
%{?build_rescue:%global rescue 1}
|
|
|
b58e57 |
%{?build_rescue:%global rescue_rel rescue}
|
|
|
b58e57 |
|
|
|
b58e57 |
# Turn off some stuff for resuce builds
|
|
|
b58e57 |
%if %{rescue}
|
|
|
b58e57 |
%define kerberos5 0
|
|
|
b58e57 |
%define libedit 0
|
|
|
b58e57 |
%define pam_ssh_agent 0
|
|
|
b58e57 |
%endif
|
|
|
b58e57 |
|
|
|
b58e57 |
# Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1
|
|
|
b58e57 |
%define openssh_ver 7.4p1
|
|
|
b58e57 |
%define openssh_rel 21
|
|
|
b58e57 |
%define pam_ssh_agent_ver 0.10.3
|
|
|
b58e57 |
%define pam_ssh_agent_rel 2
|
|
|
b58e57 |
|
|
|
b58e57 |
Summary: An open source implementation of SSH protocol versions 1 and 2
|
|
|
b58e57 |
Name: openssh
|
|
|
b58e57 |
Version: %{openssh_ver}
|
|
|
b58e57 |
Release: %{openssh_rel}%{?dist}%{?rescue_rel}
|
|
|
b58e57 |
URL: http://www.openssh.com/portable.html
|
|
|
b58e57 |
#URL1: http://pamsshagentauth.sourceforge.net
|
|
|
b58e57 |
Source0: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz
|
|
|
b58e57 |
#Source1: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz.asc
|
|
|
b58e57 |
Source2: sshd.pam
|
|
|
b58e57 |
Source3: sshd.init
|
|
|
b58e57 |
Source4: http://prdownloads.sourceforge.net/pamsshagentauth/pam_ssh_agent_auth/pam_ssh_agent_auth-%{pam_ssh_agent_ver}.tar.bz2
|
|
|
b58e57 |
Source5: pam_ssh_agent-rmheaders
|
|
|
b58e57 |
Source6: ssh-keycat.pam
|
|
|
b58e57 |
Source7: sshd.sysconfig
|
|
|
b58e57 |
Source9: sshd@.service
|
|
|
b58e57 |
Source10: sshd.socket
|
|
|
b58e57 |
Source11: sshd.service
|
|
|
b58e57 |
Source12: sshd-keygen.service
|
|
|
b58e57 |
Source13: sshd-keygen
|
|
|
b58e57 |
|
|
|
b58e57 |
# Internal debug
|
|
|
b58e57 |
Patch0: openssh-5.9p1-wIm.patch
|
|
|
b58e57 |
|
|
|
b58e57 |
#?
|
|
|
b58e57 |
Patch100: openssh-7.4p1-coverity.patch
|
|
|
b58e57 |
#https://bugzilla.mindrot.org/show_bug.cgi?id=1889
|
|
|
b58e57 |
Patch103: openssh-5.8p1-packet.patch
|
|
|
b58e57 |
|
|
|
b58e57 |
#https://bugzilla.mindrot.org/show_bug.cgi?id=1402
|
|
|
b58e57 |
# https://bugzilla.redhat.com/show_bug.cgi?id=1171248
|
|
|
b58e57 |
# record pfs= field in CRYPTO_SESSION audit event
|
|
|
b58e57 |
Patch200: openssh-7.4p1-audit.patch
|
|
|
b58e57 |
# Do not write to one socket from more processes (#1310684)
|
|
|
b58e57 |
Patch202: openssh-6.6p1-audit-race-condition.patch
|
|
|
b58e57 |
|
|
|
b58e57 |
# --- pam_ssh-agent ---
|
|
|
b58e57 |
# make it build reusing the openssh sources
|
|
|
b58e57 |
Patch300: pam_ssh_agent_auth-0.10.3-build.patch
|
|
|
b58e57 |
# check return value of seteuid()
|
|
|
b58e57 |
Patch301: pam_ssh_agent_auth-0.10.3-seteuid.patch
|
|
|
b58e57 |
# explicitly make pam callbacks visible
|
|
|
b58e57 |
Patch302: pam_ssh_agent_auth-0.9.2-visibility.patch
|
|
|
b58e57 |
# don't use xfree (#1024965)
|
|
|
b58e57 |
Patch303: pam_ssh_agent_auth-0.10.3-no-xfree.patch
|
|
|
b58e57 |
# update to current version of agent structure
|
|
|
b58e57 |
Patch304: pam_ssh_agent_auth-0.10.3-agent_structure.patch
|
|
|
b58e57 |
# do not directly dereference return value of getpwuid()
|
|
|
b58e57 |
Patch305: pam_ssh_agent_auth-0.10.3-dereference.patch
|
|
|
b58e57 |
# Use hardcoded date -- getting it from file is broken on i386
|
|
|
b58e57 |
Patch306: pam_ssh_agent_auth-0.10.3-man-date.patch
|
|
|
b58e57 |
|
|
|
b58e57 |
#https://bugzilla.mindrot.org/show_bug.cgi?id=1641 (WONTFIX)
|
|
|
b58e57 |
Patch400: openssh-7.4p1-role-mls.patch
|
|
|
b58e57 |
#https://bugzilla.redhat.com/show_bug.cgi?id=781634
|
|
|
b58e57 |
Patch404: openssh-6.6p1-privsep-selinux.patch
|
|
|
b58e57 |
|
|
|
b58e57 |
#?-- unwanted child :(
|
|
|
b58e57 |
Patch501: openssh-6.6p1-ldap.patch
|
|
|
b58e57 |
#?
|
|
|
b58e57 |
Patch502: openssh-6.6p1-keycat.patch
|
|
|
b58e57 |
|
|
|
b58e57 |
#http6://bugzilla.mindrot.org/show_bug.cgi?id=1644
|
|
|
b58e57 |
Patch601: openssh-6.6p1-allow-ip-opts.patch
|
|
|
b58e57 |
#https://bugzilla.mindrot.org/show_bug.cgi?id=1893
|
|
|
b58e57 |
Patch604: openssh-6.6p1-keyperm.patch
|
|
|
b58e57 |
#https://bugzilla.mindrot.org/show_bug.cgi?id=1925
|
|
|
b58e57 |
Patch606: openssh-5.9p1-ipv6man.patch
|
|
|
b58e57 |
#?
|
|
|
b58e57 |
Patch607: openssh-5.8p2-sigpipe.patch
|
|
|
b58e57 |
#https://bugzilla.mindrot.org/show_bug.cgi?id=1789
|
|
|
b58e57 |
Patch609: openssh-5.5p1-x11.patch
|
|
|
b58e57 |
|
|
|
b58e57 |
#?
|
|
|
b58e57 |
Patch700: openssh-7.4p1-fips.patch
|
|
|
b58e57 |
#?
|
|
|
b58e57 |
# drop? Patch701: openssh-5.6p1-exit-deadlock.patch
|
|
|
b58e57 |
#?
|
|
|
b58e57 |
Patch702: openssh-5.1p1-askpass-progress.patch
|
|
|
b58e57 |
#?
|
|
|
b58e57 |
Patch703: openssh-4.3p2-askpass-grab-info.patch
|
|
|
b58e57 |
# https://bugzilla.redhat.com/show_bug.cgi?id=205842
|
|
|
b58e57 |
# drop? Patch704: openssh-5.9p1-edns.patch
|
|
|
b58e57 |
#?
|
|
|
b58e57 |
Patch706: openssh-6.6.1p1-localdomain.patch
|
|
|
b58e57 |
#https://bugzilla.mindrot.org/show_bug.cgi?id=1635 (WONTFIX)
|
|
|
b58e57 |
Patch707: openssh-6.6p1-redhat.patch
|
|
|
b58e57 |
#https://bugzilla.mindrot.org/show_bug.cgi?id=1890 (WONTFIX) need integration to prng helper which is discontinued :)
|
|
|
b58e57 |
Patch708: openssh-6.6p1-entropy.patch
|
|
|
b58e57 |
#https://bugzilla.mindrot.org/show_bug.cgi?id=1640 (WONTFIX)
|
|
|
b58e57 |
Patch709: openssh-6.2p1-vendor.patch
|
|
|
b58e57 |
# warn users for unsupported UsePAM=no (#757545)
|
|
|
b58e57 |
Patch711: openssh-6.6p1-log-usepam-no.patch
|
|
|
b58e57 |
# make aes-ctr ciphers use EVP engines such as AES-NI from OpenSSL
|
|
|
b58e57 |
Patch712: openssh-6.3p1-ctr-evp-fast.patch
|
|
|
b58e57 |
# add cavs test binary for the aes-ctr
|
|
|
b58e57 |
Patch713: openssh-7.4p1-ctr-cavstest.patch
|
|
|
b58e57 |
# add SSH KDF CAVS test driver
|
|
|
b58e57 |
Patch714: openssh-7.4p1-kdf-cavs.patch
|
|
|
b58e57 |
|
|
|
b58e57 |
|
|
|
b58e57 |
#http://www.sxw.org.uk/computing/patches/openssh.html
|
|
|
b58e57 |
#changed cache storage type - #848228
|
|
|
b58e57 |
Patch800: openssh-7.4p1-gsskex.patch
|
|
|
b58e57 |
#http://www.mail-archive.com/kerberos@mit.edu/msg17591.html
|
|
|
b58e57 |
Patch801: openssh-6.6p1-force_krb.patch
|
|
|
b58e57 |
# add new option GSSAPIEnablek5users and disable using ~/.k5users by default (#1169843)
|
|
|
b58e57 |
# CVE-2014-9278
|
|
|
b58e57 |
Patch802: openssh-6.6p1-GSSAPIEnablek5users.patch
|
|
|
b58e57 |
# Respect k5login_directory option in krk5.conf (#1328243)
|
|
|
b58e57 |
Patch803: openssh-6.6p1-k5login_directory.patch
|
|
|
b58e57 |
Patch900: openssh-6.1p1-gssapi-canohost.patch
|
|
|
b58e57 |
#https://bugzilla.mindrot.org/show_bug.cgi?id=1780
|
|
|
b58e57 |
Patch901: openssh-7.4p1-kuserok.patch
|
|
|
b58e57 |
# use default_ccache_name from /etc/krb5.conf (#991186)
|
|
|
b58e57 |
Patch902: openssh-6.3p1-krb5-use-default_ccache_name.patch
|
|
|
b58e57 |
# Change GSSAPIStrictAcceptor to yes as it ever was (#1488982)
|
|
|
b58e57 |
Patch903: openssh-7.4p1-gss-strict-acceptor.patch
|
|
|
b58e57 |
|
|
|
b58e57 |
# Run ssh-copy-id in the legacy mode when SSH_COPY_ID_LEGACY variable is set (#969375
|
|
|
b58e57 |
Patch905: openssh-7.4p1-legacy-ssh-copy-id.patch
|
|
|
b58e57 |
# Use tty allocation for a remote scp (#985650)
|
|
|
b58e57 |
Patch906: openssh-6.4p1-fromto-remote.patch
|
|
|
b58e57 |
# log when a client requests an interactive session and only sftp is allowed (#1130198)
|
|
|
b58e57 |
Patch914: openssh-6.6.1p1-log-sftp-only-connections.patch
|
|
|
b58e57 |
# log via monitor in chroots without /dev/log (#1083482)
|
|
|
b58e57 |
Patch918: openssh-7.4p1-log-in-chroot.patch
|
|
|
b58e57 |
# MLS labeling according to chosen sensitivity (#1202843)
|
|
|
b58e57 |
Patch919: openssh-6.6.1p1-mls-fix-labeling.patch
|
|
|
b58e57 |
# sshd test mode show all config values (#1187597)
|
|
|
b58e57 |
Patch920: openssh-6.6p1-test-mode-all-values.patch
|
|
|
b58e57 |
# Add sftp option to force mode of created files (#1191055)
|
|
|
b58e57 |
Patch921: openssh-6.6p1-sftp-force-permission.patch
|
|
|
b58e57 |
# fix memory problem (#1223218)
|
|
|
b58e57 |
Patch924: openssh-6.6p1-memory-problems.patch
|
|
|
b58e57 |
# Enhance AllowGroups documentation in man page (#1150007)
|
|
|
b58e57 |
Patch925: openssh-6.6p1-allowGroups-documentation.patch
|
|
|
b58e57 |
# provide option GssKexAlgorithms to disable vulnerable groun1 kex
|
|
|
b58e57 |
Patch928: openssh-7.4p1-gssKexAlgorithms.patch
|
|
|
b58e57 |
# make s390 use /dev/ crypto devices -- ignore closefrom (#1318760)
|
|
|
b58e57 |
Patch935: openssh-6.6p1-s390-closefrom.patch
|
|
|
b58e57 |
# expose more information to PAM (#1312304)
|
|
|
b58e57 |
Patch938: openssh-7.4p1-expose-pam.patch
|
|
|
b58e57 |
# Move MAX_DISPLAYS to a configuration option (#1341302)
|
|
|
b58e57 |
Patch939: openssh-6.6p1-x11-max-displays.patch
|
|
|
b58e57 |
# Add systemd stuff so it can track running service (#1381997)
|
|
|
b58e57 |
Patch942: openssh-6.6p1-systemd.patch
|
|
|
b58e57 |
# Permit root login to preserve backward compatibility
|
|
|
b58e57 |
Patch943: openssh-7.4p1-permit-root-login.patch
|
|
|
b58e57 |
# Restore TCP wrappers support
|
|
|
b58e57 |
Patch944: openssh-7.4p1-debian-restore-tcp-wrappers.patch
|
|
|
b58e57 |
# Set sane whitelist for PKCS#11 modules in ssh-agent
|
|
|
b58e57 |
Patch945: openssh-7.4p1-pkcs11-whitelist.patch
|
|
|
b58e57 |
# Allow legacy algorithms and formats for key exchange after rebase
|
|
|
b58e57 |
Patch946: openssh-7.4p1-legacy-algorithms.patch
|
|
|
b58e57 |
# Show more fingerprints
|
|
|
b58e57 |
Patch947: openssh-7.4p1-show-more-fingerprints.patch
|
|
|
b58e57 |
# Fix newline in the end of server ident banner (upstream 5b9070)
|
|
|
b58e57 |
Patch948: openssh-7.4p1-newline-banner.patch
|
|
|
b58e57 |
# Do not utilize SHA1 by default for digital signatures (#1322911)
|
|
|
b58e57 |
Patch949: openssh-7.4p1-sha2-signatures.patch
|
|
|
b58e57 |
# Canonize pkcs11 provider path when removing smartcard (#2682)
|
|
|
b58e57 |
Patch950: openssh-7.4p1-canonize-pkcs11-provider.patch
|
|
|
b58e57 |
# Do not segfault sshd if it loads RSA1 keys (#2686)
|
|
|
b58e57 |
Patch951: openssh-7.4p1-rsa1-segfault.patch
|
|
|
b58e57 |
# OpenSSH 7.5 fixes CBC cipher weakness
|
|
|
b58e57 |
Patch952: openssh-7.4p1-cbc-weakness.patch
|
|
|
b58e57 |
# sandbox-seccomp filter is not denying socketcall() on ppc64le (#1443916)
|
|
|
b58e57 |
Patch953: openssh-7.4p1-sandbox-ppc64le.patch
|
|
|
b58e57 |
# ControlPath too long should not be fatal (#1447561)
|
|
|
b58e57 |
Patch954: openssh-7.4p1-ControlPath_too_long.patch
|
|
|
b58e57 |
# sandbox-seccomp for ibmca engine from upstream (#1451809)
|
|
|
b58e57 |
Patch955: openssh-7.4p1-sandbox-ibmca.patch
|
|
|
b58e57 |
# Back to UseDNS=yes by default (#1478175)
|
|
|
b58e57 |
Patch956: openssh-7.4p1-usedns-yes.patch
|
|
|
b58e57 |
# Clatch between ClientAlive timeouts and rekeying (#1480510)
|
|
|
b58e57 |
Patch957: openssh-7.4p1-rekeying-timeouts.patch
|
|
|
b58e57 |
# WinSCP 5.10+ compatibility (#1496808)
|
|
|
b58e57 |
Patch958: openssh-7.4p1-winscp-compat.patch
|
|
|
b58e57 |
# SSH AuthorizedKeysCommand hangs when output is too large (#1496467)
|
|
|
b58e57 |
Patch959: openssh-7.4p1-authorized_keys_command.patch
|
|
|
b58e57 |
# Fix for CVE-2017-15906 (#1517226)
|
|
|
b58e57 |
Patch960: openssh-7.5p1-sftp-empty-files.patch
|
|
|
b58e57 |
# Fix for CVE-2018-15473 (#1619079)
|
|
|
b58e57 |
Patch961: openssh-7.4p1-CVE-2018-15473.patch
|
|
|
b58e57 |
# invalidate supplemental group cache used by temporarily_use_uid() (#1619079)
|
|
|
b58e57 |
Patch962: openssh-7.4p1-uidswap.patch
|
|
|
b58e57 |
|
|
|
b58e57 |
License: BSD
|
|
|
b58e57 |
Group: Applications/Internet
|
|
|
b58e57 |
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
|
|
|
b58e57 |
Requires: /sbin/nologin
|
|
|
b58e57 |
|
|
|
b58e57 |
%if ! %{no_gnome_askpass}
|
|
|
b58e57 |
%if %{gtk2}
|
|
|
b58e57 |
BuildRequires: gtk2-devel
|
|
|
b58e57 |
BuildRequires: libX11-devel
|
|
|
b58e57 |
%else
|
|
|
b58e57 |
BuildRequires: gnome-libs-devel
|
|
|
b58e57 |
%endif
|
|
|
b58e57 |
%endif
|
|
|
b58e57 |
|
|
|
b58e57 |
%if %{ldap}
|
|
|
b58e57 |
BuildRequires: openldap-devel
|
|
|
b58e57 |
%endif
|
|
|
b58e57 |
BuildRequires: autoconf, automake, perl, zlib-devel
|
|
|
b58e57 |
BuildRequires: audit-libs-devel >= 2.0.5
|
|
|
b58e57 |
BuildRequires: util-linux, groff
|
|
|
b58e57 |
BuildRequires: pam-devel
|
|
|
b58e57 |
BuildRequires: tcp_wrappers-devel
|
|
|
b58e57 |
BuildRequires: fipscheck-devel >= 1.3.0
|
|
|
b58e57 |
BuildRequires: openssl-devel >= 0.9.8j
|
|
|
b58e57 |
BuildRequires: perl-podlators
|
|
|
b58e57 |
BuildRequires: systemd-devel
|
|
|
b58e57 |
|
|
|
b58e57 |
%if %{kerberos5}
|
|
|
b58e57 |
BuildRequires: krb5-devel
|
|
|
b58e57 |
%endif
|
|
|
b58e57 |
|
|
|
b58e57 |
%if %{libedit}
|
|
|
b58e57 |
BuildRequires: libedit-devel ncurses-devel
|
|
|
b58e57 |
%endif
|
|
|
b58e57 |
|
|
|
b58e57 |
%if %{WITH_SELINUX}
|
|
|
b58e57 |
Conflicts: selinux-policy < 3.13.1-92
|
|
|
b58e57 |
Requires: libselinux >= 1.27.7
|
|
|
b58e57 |
BuildRequires: libselinux-devel >= 1.27.7
|
|
|
b58e57 |
Requires: audit-libs >= 1.0.8
|
|
|
b58e57 |
BuildRequires: audit-libs >= 1.0.8
|
|
|
b58e57 |
%endif
|
|
|
b58e57 |
|
|
|
b58e57 |
BuildRequires: xauth
|
|
|
b58e57 |
|
|
|
b58e57 |
%package clients
|
|
|
b58e57 |
Summary: An open source SSH client applications
|
|
|
b58e57 |
Group: Applications/Internet
|
|
|
b58e57 |
Requires: openssh = %{version}-%{release}
|
|
|
b58e57 |
Requires: fipscheck-lib%{_isa} >= 1.3.0
|
|
|
b58e57 |
|
|
|
b58e57 |
%package server
|
|
|
b58e57 |
Summary: An open source SSH server daemon
|
|
|
b58e57 |
Group: System Environment/Daemons
|
|
|
b58e57 |
Requires: openssh = %{version}-%{release}
|
|
|
b58e57 |
Requires(pre): /usr/sbin/useradd
|
|
|
b58e57 |
Requires: pam >= 1.0.1-3
|
|
|
b58e57 |
Requires: fipscheck-lib%{_isa} >= 1.3.0
|
|
|
b58e57 |
Requires(post): systemd-units
|
|
|
b58e57 |
Requires(preun): systemd-units
|
|
|
b58e57 |
Requires(postun): systemd-units
|
|
|
b58e57 |
|
|
|
b58e57 |
%package server-sysvinit
|
|
|
b58e57 |
Summary: The SysV initscript to manage the OpenSSH server.
|
|
|
b58e57 |
Group: System Environment/Daemons
|
|
|
b58e57 |
Requires: %{name}-server%{?_isa} = %{version}-%{release}
|
|
|
b58e57 |
|
|
|
b58e57 |
%if %{ldap}
|
|
|
b58e57 |
%package ldap
|
|
|
b58e57 |
Summary: A LDAP support for open source SSH server daemon
|
|
|
b58e57 |
Requires: openssh = %{version}-%{release}
|
|
|
b58e57 |
Group: System Environment/Daemons
|
|
|
b58e57 |
%endif
|
|
|
b58e57 |
|
|
|
b58e57 |
%package keycat
|
|
|
b58e57 |
Summary: A mls keycat backend for openssh
|
|
|
b58e57 |
Requires: openssh = %{version}-%{release}
|
|
|
b58e57 |
Group: System Environment/Daemons
|
|
|
b58e57 |
|
|
|
b58e57 |
%package askpass
|
|
|
b58e57 |
Summary: A passphrase dialog for OpenSSH and X
|
|
|
b58e57 |
Group: Applications/Internet
|
|
|
b58e57 |
Requires: openssh = %{version}-%{release}
|
|
|
b58e57 |
Obsoletes: openssh-askpass-gnome
|
|
|
b58e57 |
Provides: openssh-askpass-gnome
|
|
|
b58e57 |
|
|
|
b58e57 |
%package cavs
|
|
|
b58e57 |
Summary: CAVS tests for FIPS validation
|
|
|
b58e57 |
Group: Applications/Internet
|
|
|
b58e57 |
Requires: openssh = %{version}-%{release}
|
|
|
b58e57 |
|
|
|
b58e57 |
%package -n pam_ssh_agent_auth
|
|
|
b58e57 |
Summary: PAM module for authentication with ssh-agent
|
|
|
b58e57 |
Group: System Environment/Base
|
|
|
b58e57 |
Version: %{pam_ssh_agent_ver}
|
|
|
b58e57 |
Release: %{pam_ssh_agent_rel}.%{openssh_rel}%{?dist}%{?rescue_rel}
|
|
|
b58e57 |
License: BSD
|
|
|
b58e57 |
|
|
|
b58e57 |
%description
|
|
|
b58e57 |
SSH (Secure SHell) is a program for logging into and executing
|
|
|
b58e57 |
commands on a remote machine. SSH is intended to replace rlogin and
|
|
|
b58e57 |
rsh, and to provide secure encrypted communications between two
|
|
|
b58e57 |
untrusted hosts over an insecure network. X11 connections and
|
|
|
b58e57 |
arbitrary TCP/IP ports can also be forwarded over the secure channel.
|
|
|
b58e57 |
|
|
|
b58e57 |
OpenSSH is OpenBSD's version of the last free version of SSH, bringing
|
|
|
b58e57 |
it up to date in terms of security and features.
|
|
|
b58e57 |
|
|
|
b58e57 |
This package includes the core files necessary for both the OpenSSH
|
|
|
b58e57 |
client and server. To make this package useful, you should also
|
|
|
b58e57 |
install openssh-clients, openssh-server, or both.
|
|
|
b58e57 |
|
|
|
b58e57 |
%description clients
|
|
|
b58e57 |
OpenSSH is a free version of SSH (Secure SHell), a program for logging
|
|
|
b58e57 |
into and executing commands on a remote machine. This package includes
|
|
|
b58e57 |
the clients necessary to make encrypted connections to SSH servers.
|
|
|
b58e57 |
|
|
|
b58e57 |
%description server
|
|
|
b58e57 |
OpenSSH is a free version of SSH (Secure SHell), a program for logging
|
|
|
b58e57 |
into and executing commands on a remote machine. This package contains
|
|
|
b58e57 |
the secure shell daemon (sshd). The sshd daemon allows SSH clients to
|
|
|
b58e57 |
securely connect to your SSH server.
|
|
|
b58e57 |
|
|
|
b58e57 |
%description server-sysvinit
|
|
|
b58e57 |
OpenSSH is a free version of SSH (Secure SHell), a program for logging
|
|
|
b58e57 |
into and executing commands on a remote machine. This package contains
|
|
|
b58e57 |
the SysV init script to manage the OpenSSH server when running a legacy
|
|
|
b58e57 |
SysV-compatible init system.
|
|
|
b58e57 |
|
|
|
b58e57 |
It is not required when the init system used is systemd.
|
|
|
b58e57 |
|
|
|
b58e57 |
%if %{ldap}
|
|
|
b58e57 |
%description ldap
|
|
|
b58e57 |
OpenSSH LDAP backend is a way how to distribute the authorized tokens
|
|
|
b58e57 |
among the servers in the network.
|
|
|
b58e57 |
%endif
|
|
|
b58e57 |
|
|
|
b58e57 |
%description keycat
|
|
|
b58e57 |
OpenSSH mls keycat is backend for using the authorized keys in the
|
|
|
b58e57 |
openssh in the mls mode.
|
|
|
b58e57 |
|
|
|
b58e57 |
%description askpass
|
|
|
b58e57 |
OpenSSH is a free version of SSH (Secure SHell), a program for logging
|
|
|
b58e57 |
into and executing commands on a remote machine. This package contains
|
|
|
b58e57 |
an X11 passphrase dialog for OpenSSH.
|
|
|
b58e57 |
|
|
|
b58e57 |
%description cavs
|
|
|
b58e57 |
This package contains test binaries and scripts to make FIPS validation
|
|
|
b58e57 |
easier. Now contains CTR and KDF CAVS test driver.
|
|
|
b58e57 |
|
|
|
b58e57 |
%description -n pam_ssh_agent_auth
|
|
|
b58e57 |
This package contains a PAM module which can be used to authenticate
|
|
|
b58e57 |
users using ssh keys stored in a ssh-agent. Through the use of the
|
|
|
b58e57 |
forwarding of ssh-agent connection it also allows to authenticate with
|
|
|
b58e57 |
remote ssh-agent instance.
|
|
|
b58e57 |
|
|
|
b58e57 |
The module is most useful for su and sudo service stacks.
|
|
|
b58e57 |
|
|
|
b58e57 |
%prep
|
|
|
b58e57 |
%setup -q -a 4
|
|
|
b58e57 |
#Do not enable by default
|
|
|
b58e57 |
%if 0
|
|
|
b58e57 |
%patch0 -p1 -b .wIm
|
|
|
b58e57 |
%endif
|
|
|
b58e57 |
|
|
|
b58e57 |
%patch103 -p1 -b .packet
|
|
|
b58e57 |
|
|
|
b58e57 |
%if %{pam_ssh_agent}
|
|
|
b58e57 |
pushd pam_ssh_agent_auth-%{pam_ssh_agent_ver}
|
|
|
b58e57 |
%patch300 -p2 -b .psaa-build
|
|
|
b58e57 |
%patch301 -p2 -b .psaa-seteuid
|
|
|
b58e57 |
%patch302 -p1 -b .psaa-visibility
|
|
|
b58e57 |
%patch303 -p2 -b .psaa-xfree
|
|
|
b58e57 |
%patch304 -p2 -b .psaa-agent
|
|
|
b58e57 |
%patch305 -p2 -b .psaa-dereference
|
|
|
b58e57 |
%patch306 -p2 -b .psaa-pod
|
|
|
b58e57 |
# Remove duplicate headers
|
|
|
b58e57 |
rm -f $(cat %{SOURCE5})
|
|
|
b58e57 |
popd
|
|
|
b58e57 |
%endif
|
|
|
b58e57 |
|
|
|
b58e57 |
%if %{WITH_SELINUX}
|
|
|
b58e57 |
%patch400 -p1 -b .role-mls
|
|
|
b58e57 |
%patch404 -p1 -b .privsep-selinux
|
|
|
b58e57 |
%endif
|
|
|
b58e57 |
|
|
|
b58e57 |
%if %{ldap}
|
|
|
b58e57 |
%patch501 -p1 -b .ldap
|
|
|
b58e57 |
%endif
|
|
|
b58e57 |
%patch502 -p1 -b .keycat
|
|
|
b58e57 |
|
|
|
b58e57 |
%patch601 -p1 -b .ip-opts
|
|
|
b58e57 |
%patch604 -p1 -b .keyperm
|
|
|
b58e57 |
%patch606 -p1 -b .ipv6man
|
|
|
b58e57 |
%patch607 -p1 -b .sigpipe
|
|
|
b58e57 |
%patch609 -p1 -b .x11
|
|
|
b58e57 |
#
|
|
|
b58e57 |
# drop? %patch701 -p1 -b .exit-deadlock
|
|
|
b58e57 |
%patch702 -p1 -b .progress
|
|
|
b58e57 |
%patch703 -p1 -b .grab-info
|
|
|
b58e57 |
# investigate - https://bugzilla.redhat.com/show_bug.cgi?id=205842
|
|
|
b58e57 |
# probably not needed anymore %patch704 -p1 -b .edns
|
|
|
b58e57 |
%patch706 -p1 -b .localdomain
|
|
|
b58e57 |
%patch707 -p1 -b .redhat
|
|
|
b58e57 |
%patch708 -p1 -b .entropy
|
|
|
b58e57 |
%patch709 -p1 -b .vendor
|
|
|
b58e57 |
%patch711 -p1 -b .log-usepam-no
|
|
|
b58e57 |
%patch712 -p1 -b .evp-ctr
|
|
|
b58e57 |
%patch713 -p1 -b .ctr-cavs
|
|
|
b58e57 |
%patch714 -p1 -b .kdf-cavs
|
|
|
b58e57 |
#
|
|
|
b58e57 |
%patch800 -p1 -b .gsskex
|
|
|
b58e57 |
%patch801 -p1 -b .force_krb
|
|
|
b58e57 |
#
|
|
|
b58e57 |
%patch900 -p1 -b .canohost
|
|
|
b58e57 |
%patch901 -p1 -b .kuserok
|
|
|
b58e57 |
%patch902 -p1 -b .ccache_name
|
|
|
b58e57 |
%patch903 -p1 -b .gss-strict
|
|
|
b58e57 |
|
|
|
b58e57 |
%patch905 -p1 -b .legacy-ssh-copy-id
|
|
|
b58e57 |
%patch906 -p1 -b .fromto-remote
|
|
|
b58e57 |
%patch914 -p1 -b .log-sftp-only
|
|
|
b58e57 |
%patch918 -p1 -b .log-in-chroot
|
|
|
b58e57 |
%patch919 -p1 -b .mls-labels
|
|
|
b58e57 |
%patch802 -p1 -b .GSSAPIEnablek5users
|
|
|
b58e57 |
%patch803 -p1 -b .k5login
|
|
|
b58e57 |
%patch920 -p1 -b .sshd-t
|
|
|
b58e57 |
%patch921 -p1 -b .sftp-force-mode
|
|
|
b58e57 |
%patch924 -p1 -b .memory-problems
|
|
|
b58e57 |
%patch925 -p1 -b .allowGroups
|
|
|
b58e57 |
%patch928 -p1 -b .gsskexalg
|
|
|
b58e57 |
%patch935 -p1 -b .s390
|
|
|
b58e57 |
%patch938 -p1 -b .expose-pam
|
|
|
b58e57 |
%patch939 -p1 -b .x11max
|
|
|
b58e57 |
%patch942 -p1 -b .patch
|
|
|
b58e57 |
%patch943 -p1 -b .permit-root
|
|
|
b58e57 |
%patch944 -p1 -b .tcp_wrappers
|
|
|
b58e57 |
%patch945 -p1 -b .pkcs11-whitelist
|
|
|
b58e57 |
%patch946 -p1 -b .legacy
|
|
|
b58e57 |
%patch947 -p1 -b .fingerprint
|
|
|
b58e57 |
%patch948 -p1 -b .newline-banner
|
|
|
b58e57 |
%patch949 -p1 -b .sha2
|
|
|
b58e57 |
%patch950 -p1 -b .smartcard
|
|
|
b58e57 |
%patch951 -p1 -b .rsa1
|
|
|
b58e57 |
%patch952 -p1 -b .cbc
|
|
|
b58e57 |
%patch953 -p1 -b .seccomp
|
|
|
b58e57 |
%patch954 -p1 -b .ControlPath
|
|
|
b58e57 |
%patch955 -p1 -b .ibmca
|
|
|
b58e57 |
%patch956 -p1 -b .usedns
|
|
|
b58e57 |
%patch957 -p1 -b .rekey-timeout
|
|
|
b58e57 |
%patch958 -p1 -b .winscp
|
|
|
b58e57 |
%patch959 -p1 -b .large-command
|
|
|
b58e57 |
%patch960 -p1 -b .sftp-empty
|
|
|
b58e57 |
%patch961 -p1 -b .CVE-2018-15473
|
|
|
b58e57 |
%patch962 -p1 -b .uidswap
|
|
|
b58e57 |
|
|
|
b58e57 |
%patch200 -p1 -b .audit
|
|
|
b58e57 |
%patch202 -p1 -b .audit-race
|
|
|
b58e57 |
%patch700 -p1 -b .fips
|
|
|
b58e57 |
|
|
|
b58e57 |
%patch100 -p1 -b .coverity
|
|
|
b58e57 |
|
|
|
b58e57 |
%if 0
|
|
|
b58e57 |
# Nothing here yet
|
|
|
b58e57 |
%endif
|
|
|
b58e57 |
|
|
|
b58e57 |
autoreconf
|
|
|
b58e57 |
pushd pam_ssh_agent_auth-%{pam_ssh_agent_ver}
|
|
|
b58e57 |
autoreconf
|
|
|
b58e57 |
popd
|
|
|
b58e57 |
|
|
|
b58e57 |
%build
|
|
|
b58e57 |
# the -fvisibility=hidden is needed for clean build of the pam_ssh_agent_auth
|
|
|
b58e57 |
# and it makes the ssh build more clean and even optimized better
|
|
|
b58e57 |
CFLAGS="$RPM_OPT_FLAGS -fvisibility=hidden"; export CFLAGS
|
|
|
b58e57 |
%if %{rescue}
|
|
|
b58e57 |
CFLAGS="$CFLAGS -Os"
|
|
|
b58e57 |
%endif
|
|
|
b58e57 |
%if %{pie}
|
|
|
b58e57 |
%ifarch s390 s390x sparc sparcv9 sparc64
|
|
|
b58e57 |
CFLAGS="$CFLAGS -fPIC"
|
|
|
b58e57 |
%else
|
|
|
b58e57 |
CFLAGS="$CFLAGS -fpic"
|
|
|
b58e57 |
%endif
|
|
|
b58e57 |
SAVE_LDFLAGS="$LDFLAGS"
|
|
|
b58e57 |
LDFLAGS="$LDFLAGS -pie -z relro -z now"
|
|
|
b58e57 |
|
|
|
b58e57 |
export CFLAGS
|
|
|
b58e57 |
export LDFLAGS
|
|
|
b58e57 |
|
|
|
b58e57 |
%endif
|
|
|
b58e57 |
%if %{kerberos5}
|
|
|
b58e57 |
if test -r /etc/profile.d/krb5-devel.sh ; then
|
|
|
b58e57 |
source /etc/profile.d/krb5-devel.sh
|
|
|
b58e57 |
fi
|
|
|
b58e57 |
krb5_prefix=`krb5-config --prefix`
|
|
|
b58e57 |
if test "$krb5_prefix" != "%{_prefix}" ; then
|
|
|
b58e57 |
CPPFLAGS="$CPPFLAGS -I${krb5_prefix}/include -I${krb5_prefix}/include/gssapi"; export CPPFLAGS
|
|
|
b58e57 |
CFLAGS="$CFLAGS -I${krb5_prefix}/include -I${krb5_prefix}/include/gssapi"
|
|
|
b58e57 |
LDFLAGS="$LDFLAGS -L${krb5_prefix}/%{_lib}"; export LDFLAGS
|
|
|
b58e57 |
else
|
|
|
b58e57 |
krb5_prefix=
|
|
|
b58e57 |
CPPFLAGS="-I%{_includedir}/gssapi"; export CPPFLAGS
|
|
|
b58e57 |
CFLAGS="$CFLAGS -I%{_includedir}/gssapi"
|
|
|
b58e57 |
fi
|
|
|
b58e57 |
%endif
|
|
|
b58e57 |
|
|
|
b58e57 |
%configure \
|
|
|
b58e57 |
--sysconfdir=%{_sysconfdir}/ssh \
|
|
|
b58e57 |
--libexecdir=%{_libexecdir}/openssh \
|
|
|
b58e57 |
--datadir=%{_datadir}/openssh \
|
|
|
b58e57 |
--with-tcp-wrappers \
|
|
|
b58e57 |
--with-default-path=/usr/local/bin:/usr/bin \
|
|
|
b58e57 |
--with-superuser-path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin \
|
|
|
b58e57 |
--with-privsep-path=%{_var}/empty/sshd \
|
|
|
b58e57 |
--enable-vendor-patchlevel="RHEL7-%{openssh_ver}-%{openssh_rel}" \
|
|
|
b58e57 |
--disable-strip \
|
|
|
b58e57 |
--without-zlib-version-check \
|
|
|
b58e57 |
--with-ssl-engine \
|
|
|
b58e57 |
--with-ipaddr-display \
|
|
|
b58e57 |
--with-systemd \
|
|
|
b58e57 |
--with-ssh1 \
|
|
|
b58e57 |
%if %{ldap}
|
|
|
b58e57 |
--with-ldap \
|
|
|
b58e57 |
%endif
|
|
|
b58e57 |
%if %{rescue}
|
|
|
b58e57 |
--without-pam \
|
|
|
b58e57 |
%else
|
|
|
b58e57 |
--with-pam \
|
|
|
b58e57 |
%endif
|
|
|
b58e57 |
%if %{WITH_SELINUX}
|
|
|
b58e57 |
--with-selinux --with-audit=linux \
|
|
|
b58e57 |
%ifnarch ppc
|
|
|
b58e57 |
--with-sandbox=seccomp_filter \
|
|
|
b58e57 |
%else
|
|
|
b58e57 |
--with-sandbox=rlimit \
|
|
|
b58e57 |
%endif
|
|
|
b58e57 |
%endif
|
|
|
b58e57 |
%if %{kerberos5}
|
|
|
b58e57 |
--with-kerberos5${krb5_prefix:+=${krb5_prefix}} \
|
|
|
b58e57 |
%else
|
|
|
b58e57 |
--without-kerberos5 \
|
|
|
b58e57 |
%endif
|
|
|
b58e57 |
%if %{libedit}
|
|
|
b58e57 |
--with-libedit
|
|
|
b58e57 |
%else
|
|
|
b58e57 |
--without-libedit
|
|
|
b58e57 |
%endif
|
|
|
b58e57 |
|
|
|
b58e57 |
%if %{static_libcrypto}
|
|
|
b58e57 |
perl -pi -e "s|-lcrypto|%{_libdir}/libcrypto.a|g" Makefile
|
|
|
b58e57 |
%endif
|
|
|
b58e57 |
|
|
|
b58e57 |
make
|
|
|
b58e57 |
|
|
|
b58e57 |
# Define a variable to toggle gnome1/gtk2 building. This is necessary
|
|
|
b58e57 |
# because RPM doesn't handle nested %if statements.
|
|
|
b58e57 |
%if %{gtk2}
|
|
|
b58e57 |
gtk2=yes
|
|
|
b58e57 |
%else
|
|
|
b58e57 |
gtk2=no
|
|
|
b58e57 |
%endif
|
|
|
b58e57 |
|
|
|
b58e57 |
%if ! %{no_gnome_askpass}
|
|
|
b58e57 |
pushd contrib
|
|
|
b58e57 |
if [ $gtk2 = yes ] ; then
|
|
|
b58e57 |
make gnome-ssh-askpass2
|
|
|
b58e57 |
mv gnome-ssh-askpass2 gnome-ssh-askpass
|
|
|
b58e57 |
else
|
|
|
b58e57 |
make gnome-ssh-askpass1
|
|
|
b58e57 |
mv gnome-ssh-askpass1 gnome-ssh-askpass
|
|
|
b58e57 |
fi
|
|
|
b58e57 |
popd
|
|
|
b58e57 |
%endif
|
|
|
b58e57 |
|
|
|
b58e57 |
%if %{pam_ssh_agent}
|
|
|
b58e57 |
pushd pam_ssh_agent_auth-%{pam_ssh_agent_ver}
|
|
|
b58e57 |
LDFLAGS="$SAVE_LDFLAGS"
|
|
|
b58e57 |
%configure --with-selinux --libexecdir=/%{_libdir}/security --with-mantype=man
|
|
|
b58e57 |
make
|
|
|
b58e57 |
popd
|
|
|
b58e57 |
%endif
|
|
|
b58e57 |
|
|
|
b58e57 |
# Add generation of HMAC checksums of the final stripped binaries
|
|
|
b58e57 |
%define __spec_install_post \
|
|
|
b58e57 |
%{?__debug_package:%{__debug_install_post}} \
|
|
|
b58e57 |
%{__arch_install_post} \
|
|
|
b58e57 |
%{__os_install_post} \
|
|
|
b58e57 |
fipshmac -d $RPM_BUILD_ROOT%{_libdir}/fipscheck $RPM_BUILD_ROOT%{_bindir}/ssh $RPM_BUILD_ROOT%{_sbindir}/sshd \
|
|
|
b58e57 |
%{nil}
|
|
|
b58e57 |
|
|
|
b58e57 |
%check
|
|
|
b58e57 |
#to run tests use "--with check"
|
|
|
b58e57 |
%if %{?_with_check:1}%{!?_with_check:0}
|
|
|
b58e57 |
make tests
|
|
|
b58e57 |
%endif
|
|
|
b58e57 |
|
|
|
b58e57 |
%install
|
|
|
b58e57 |
rm -rf $RPM_BUILD_ROOT
|
|
|
b58e57 |
mkdir -p -m755 $RPM_BUILD_ROOT%{_sysconfdir}/ssh
|
|
|
b58e57 |
mkdir -p -m755 $RPM_BUILD_ROOT%{_libexecdir}/openssh
|
|
|
b58e57 |
mkdir -p -m755 $RPM_BUILD_ROOT%{_var}/empty/sshd
|
|
|
b58e57 |
make install DESTDIR=$RPM_BUILD_ROOT
|
|
|
b58e57 |
rm -f $RPM_BUILD_ROOT%{_sysconfdir}/ssh/ldap.conf
|
|
|
b58e57 |
|
|
|
b58e57 |
install -d $RPM_BUILD_ROOT/etc/pam.d/
|
|
|
b58e57 |
install -d $RPM_BUILD_ROOT/etc/sysconfig/
|
|
|
b58e57 |
install -d $RPM_BUILD_ROOT/etc/rc.d/init.d
|
|
|
b58e57 |
install -d $RPM_BUILD_ROOT%{_libexecdir}/openssh
|
|
|
b58e57 |
install -d $RPM_BUILD_ROOT%{_libdir}/fipscheck
|
|
|
b58e57 |
install -m644 %{SOURCE2} $RPM_BUILD_ROOT/etc/pam.d/sshd
|
|
|
b58e57 |
install -m644 %{SOURCE6} $RPM_BUILD_ROOT/etc/pam.d/ssh-keycat
|
|
|
b58e57 |
install -m755 %{SOURCE3} $RPM_BUILD_ROOT/etc/rc.d/init.d/sshd
|
|
|
b58e57 |
install -m644 %{SOURCE7} $RPM_BUILD_ROOT/etc/sysconfig/sshd
|
|
|
b58e57 |
install -m755 %{SOURCE13} $RPM_BUILD_ROOT/%{_sbindir}/sshd-keygen
|
|
|
b58e57 |
install -d -m755 $RPM_BUILD_ROOT/%{_unitdir}
|
|
|
b58e57 |
install -m644 %{SOURCE9} $RPM_BUILD_ROOT/%{_unitdir}/sshd@.service
|
|
|
b58e57 |
install -m644 %{SOURCE10} $RPM_BUILD_ROOT/%{_unitdir}/sshd.socket
|
|
|
b58e57 |
install -m644 %{SOURCE11} $RPM_BUILD_ROOT/%{_unitdir}/sshd.service
|
|
|
b58e57 |
install -m644 %{SOURCE12} $RPM_BUILD_ROOT/%{_unitdir}/sshd-keygen.service
|
|
|
b58e57 |
install -m755 contrib/ssh-copy-id $RPM_BUILD_ROOT%{_bindir}/
|
|
|
b58e57 |
install contrib/ssh-copy-id.1 $RPM_BUILD_ROOT%{_mandir}/man1/
|
|
|
b58e57 |
|
|
|
b58e57 |
#restore slogin symlink
|
|
|
b58e57 |
pushd $RPM_BUILD_ROOT%{_bindir}
|
|
|
b58e57 |
ln -s ./ssh slogin
|
|
|
b58e57 |
pushd $RPM_BUILD_ROOT%{_mandir}/man1
|
|
|
b58e57 |
ln -s ./ssh.1 slogin.1
|
|
|
b58e57 |
popd; popd;
|
|
|
b58e57 |
|
|
|
b58e57 |
%if ! %{no_gnome_askpass}
|
|
|
b58e57 |
install contrib/gnome-ssh-askpass $RPM_BUILD_ROOT%{_libexecdir}/openssh/gnome-ssh-askpass
|
|
|
b58e57 |
%endif
|
|
|
b58e57 |
|
|
|
b58e57 |
%if ! %{no_gnome_askpass}
|
|
|
b58e57 |
ln -s gnome-ssh-askpass $RPM_BUILD_ROOT%{_libexecdir}/openssh/ssh-askpass
|
|
|
b58e57 |
install -m 755 -d $RPM_BUILD_ROOT%{_sysconfdir}/profile.d/
|
|
|
b58e57 |
install -m 755 contrib/redhat/gnome-ssh-askpass.csh $RPM_BUILD_ROOT%{_sysconfdir}/profile.d/
|
|
|
b58e57 |
install -m 755 contrib/redhat/gnome-ssh-askpass.sh $RPM_BUILD_ROOT%{_sysconfdir}/profile.d/
|
|
|
b58e57 |
%endif
|
|
|
b58e57 |
|
|
|
b58e57 |
%if %{no_gnome_askpass}
|
|
|
b58e57 |
rm -f $RPM_BUILD_ROOT/etc/profile.d/gnome-ssh-askpass.*
|
|
|
b58e57 |
%endif
|
|
|
b58e57 |
|
|
|
b58e57 |
perl -pi -e "s|$RPM_BUILD_ROOT||g" $RPM_BUILD_ROOT%{_mandir}/man*/*
|
|
|
b58e57 |
|
|
|
b58e57 |
%if %{pam_ssh_agent}
|
|
|
b58e57 |
pushd pam_ssh_agent_auth-%{pam_ssh_agent_ver}
|
|
|
b58e57 |
make install DESTDIR=$RPM_BUILD_ROOT
|
|
|
b58e57 |
popd
|
|
|
b58e57 |
%endif
|
|
|
b58e57 |
%clean
|
|
|
b58e57 |
rm -rf $RPM_BUILD_ROOT
|
|
|
b58e57 |
|
|
|
b58e57 |
%pre
|
|
|
b58e57 |
getent group ssh_keys >/dev/null || groupadd -r ssh_keys || :
|
|
|
b58e57 |
|
|
|
b58e57 |
%pre server
|
|
|
b58e57 |
getent group sshd >/dev/null || groupadd -g %{sshd_uid} -r sshd || :
|
|
|
b58e57 |
getent passwd sshd >/dev/null || \
|
|
|
b58e57 |
useradd -c "Privilege-separated SSH" -u %{sshd_uid} -g sshd \
|
|
|
b58e57 |
-s /sbin/nologin -r -d /var/empty/sshd sshd 2> /dev/null || :
|
|
|
b58e57 |
|
|
|
b58e57 |
%post server
|
|
|
b58e57 |
%systemd_post sshd.service sshd.socket
|
|
|
b58e57 |
|
|
|
b58e57 |
%preun server
|
|
|
b58e57 |
%systemd_preun sshd.service sshd.socket
|
|
|
b58e57 |
|
|
|
b58e57 |
%postun server
|
|
|
b58e57 |
%systemd_postun_with_restart sshd.service
|
|
|
b58e57 |
|
|
|
b58e57 |
%files
|
|
|
b58e57 |
%defattr(-,root,root)
|
|
|
b58e57 |
%{!?_licensedir:%global license %%doc}
|
|
|
b58e57 |
%license LICENCE
|
|
|
b58e57 |
%doc CREDITS ChangeLog INSTALL OVERVIEW PROTOCOL* README README.platform README.privsep README.tun README.dns TODO
|
|
|
b58e57 |
%attr(0755,root,root) %dir %{_sysconfdir}/ssh
|
|
|
b58e57 |
%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ssh/moduli
|
|
|
b58e57 |
%if ! %{rescue}
|
|
|
b58e57 |
%attr(0755,root,root) %{_bindir}/ssh-keygen
|
|
|
b58e57 |
%attr(0644,root,root) %{_mandir}/man1/ssh-keygen.1*
|
|
|
b58e57 |
%attr(0755,root,root) %dir %{_libexecdir}/openssh
|
|
|
b58e57 |
%attr(2111,root,ssh_keys) %{_libexecdir}/openssh/ssh-keysign
|
|
|
b58e57 |
%attr(0755,root,root) %{_libexecdir}/openssh/ctr-cavstest
|
|
|
b58e57 |
%attr(0644,root,root) %{_mandir}/man8/ssh-keysign.8*
|
|
|
b58e57 |
%endif
|
|
|
b58e57 |
|
|
|
b58e57 |
%files clients
|
|
|
b58e57 |
%defattr(-,root,root)
|
|
|
b58e57 |
%attr(0755,root,root) %{_bindir}/ssh
|
|
|
b58e57 |
%attr(0644,root,root) %{_libdir}/fipscheck/ssh.hmac
|
|
|
b58e57 |
%attr(0644,root,root) %{_mandir}/man1/ssh.1*
|
|
|
b58e57 |
%attr(0755,root,root) %{_bindir}/scp
|
|
|
b58e57 |
%attr(0644,root,root) %{_mandir}/man1/scp.1*
|
|
|
b58e57 |
%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ssh/ssh_config
|
|
|
b58e57 |
%attr(0755,root,root) %{_bindir}/slogin
|
|
|
b58e57 |
%attr(0644,root,root) %{_mandir}/man1/slogin.1*
|
|
|
b58e57 |
%attr(0644,root,root) %{_mandir}/man5/ssh_config.5*
|
|
|
b58e57 |
%if ! %{rescue}
|
|
|
b58e57 |
%attr(2111,root,nobody) %{_bindir}/ssh-agent
|
|
|
b58e57 |
%attr(0755,root,root) %{_bindir}/ssh-add
|
|
|
b58e57 |
%attr(0755,root,root) %{_bindir}/ssh-keyscan
|
|
|
b58e57 |
%attr(0755,root,root) %{_bindir}/sftp
|
|
|
b58e57 |
%attr(0755,root,root) %{_bindir}/ssh-copy-id
|
|
|
b58e57 |
%attr(0755,root,root) %{_libexecdir}/openssh/ssh-pkcs11-helper
|
|
|
b58e57 |
%attr(0644,root,root) %{_mandir}/man1/ssh-agent.1*
|
|
|
b58e57 |
%attr(0644,root,root) %{_mandir}/man1/ssh-add.1*
|
|
|
b58e57 |
%attr(0644,root,root) %{_mandir}/man1/ssh-keyscan.1*
|
|
|
b58e57 |
%attr(0644,root,root) %{_mandir}/man1/sftp.1*
|
|
|
b58e57 |
%attr(0644,root,root) %{_mandir}/man1/ssh-copy-id.1*
|
|
|
b58e57 |
%attr(0644,root,root) %{_mandir}/man8/ssh-pkcs11-helper.8*
|
|
|
b58e57 |
%endif
|
|
|
b58e57 |
|
|
|
b58e57 |
%if ! %{rescue}
|
|
|
b58e57 |
%files server
|
|
|
b58e57 |
%defattr(-,root,root)
|
|
|
b58e57 |
%dir %attr(0711,root,root) %{_var}/empty/sshd
|
|
|
b58e57 |
%attr(0755,root,root) %{_sbindir}/sshd
|
|
|
b58e57 |
%attr(0755,root,root) %{_sbindir}/sshd-keygen
|
|
|
b58e57 |
%attr(0644,root,root) %{_libdir}/fipscheck/sshd.hmac
|
|
|
b58e57 |
%attr(0755,root,root) %{_libexecdir}/openssh/sftp-server
|
|
|
b58e57 |
%attr(0644,root,root) %{_mandir}/man5/sshd_config.5*
|
|
|
b58e57 |
%attr(0644,root,root) %{_mandir}/man5/moduli.5*
|
|
|
b58e57 |
%attr(0644,root,root) %{_mandir}/man8/sshd.8*
|
|
|
b58e57 |
%attr(0644,root,root) %{_mandir}/man8/sftp-server.8*
|
|
|
b58e57 |
%attr(0600,root,root) %config(noreplace) %{_sysconfdir}/ssh/sshd_config
|
|
|
b58e57 |
%attr(0644,root,root) %config(noreplace) /etc/pam.d/sshd
|
|
|
b58e57 |
%attr(0640,root,root) %config(noreplace) /etc/sysconfig/sshd
|
|
|
b58e57 |
%attr(0644,root,root) %{_unitdir}/sshd.service
|
|
|
b58e57 |
%attr(0644,root,root) %{_unitdir}/sshd@.service
|
|
|
b58e57 |
%attr(0644,root,root) %{_unitdir}/sshd.socket
|
|
|
b58e57 |
%attr(0644,root,root) %{_unitdir}/sshd-keygen.service
|
|
|
b58e57 |
|
|
|
b58e57 |
%files server-sysvinit
|
|
|
b58e57 |
%defattr(-,root,root)
|
|
|
b58e57 |
%attr(0755,root,root) /etc/rc.d/init.d/sshd
|
|
|
b58e57 |
%endif
|
|
|
b58e57 |
|
|
|
b58e57 |
%if %{ldap}
|
|
|
b58e57 |
%files ldap
|
|
|
b58e57 |
%defattr(-,root,root)
|
|
|
b58e57 |
%doc HOWTO.ldap-keys openssh-lpk-openldap.schema openssh-lpk-sun.schema ldap.conf
|
|
|
b58e57 |
%doc openssh-lpk-openldap.ldif openssh-lpk-sun.ldif
|
|
|
b58e57 |
%attr(0755,root,root) %{_libexecdir}/openssh/ssh-ldap-helper
|
|
|
b58e57 |
%attr(0755,root,root) %{_libexecdir}/openssh/ssh-ldap-wrapper
|
|
|
b58e57 |
%attr(0644,root,root) %{_mandir}/man8/ssh-ldap-helper.8*
|
|
|
b58e57 |
%attr(0644,root,root) %{_mandir}/man5/ssh-ldap.conf.5*
|
|
|
b58e57 |
%endif
|
|
|
b58e57 |
|
|
|
b58e57 |
%files keycat
|
|
|
b58e57 |
%defattr(-,root,root)
|
|
|
b58e57 |
%doc HOWTO.ssh-keycat
|
|
|
b58e57 |
%attr(0755,root,root) %{_libexecdir}/openssh/ssh-keycat
|
|
|
b58e57 |
%attr(0644,root,root) %config(noreplace) /etc/pam.d/ssh-keycat
|
|
|
b58e57 |
|
|
|
b58e57 |
%if ! %{no_gnome_askpass}
|
|
|
b58e57 |
%files askpass
|
|
|
b58e57 |
%defattr(-,root,root)
|
|
|
b58e57 |
%attr(0644,root,root) %{_sysconfdir}/profile.d/gnome-ssh-askpass.*
|
|
|
b58e57 |
%attr(0755,root,root) %{_libexecdir}/openssh/gnome-ssh-askpass
|
|
|
b58e57 |
%attr(0755,root,root) %{_libexecdir}/openssh/ssh-askpass
|
|
|
b58e57 |
%endif
|
|
|
b58e57 |
|
|
|
b58e57 |
%files cavs
|
|
|
b58e57 |
%attr(0755,root,root) %{_libexecdir}/openssh/ctr-cavstest
|
|
|
b58e57 |
%attr(0755,root,root) %{_libexecdir}/openssh/ssh-cavs
|
|
|
b58e57 |
%attr(0755,root,root) %{_libexecdir}/openssh/ssh-cavs_driver.pl
|
|
|
b58e57 |
|
|
|
b58e57 |
%if %{pam_ssh_agent}
|
|
|
b58e57 |
%files -n pam_ssh_agent_auth
|
|
|
b58e57 |
%defattr(-,root,root)
|
|
|
b58e57 |
%{!?_licensedir:%global license %%doc}
|
|
|
b58e57 |
%license pam_ssh_agent_auth-%{pam_ssh_agent_ver}/OPENSSH_LICENSE
|
|
|
b58e57 |
%attr(0755,root,root) %{_libdir}/security/pam_ssh_agent_auth.so
|
|
|
b58e57 |
%attr(0644,root,root) %{_mandir}/man8/pam_ssh_agent_auth.8*
|
|
|
b58e57 |
%endif
|
|
|
b58e57 |
|
|
|
b58e57 |
%changelog
|
|
|
b58e57 |
* Tue Jun 25 2019 Jakub Jelen <jjelen@redhat.com> - 7.4p1-21 + 0.10.3-2
|
|
|
b58e57 |
- Avoid double comma in the default cipher list in FIPS mode (#1722446)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue May 21 2019 Jakub Jelen <jjelen@redhat.com> - 7.4p1-20 + 0.10.3-2
|
|
|
b58e57 |
- Revert the updating of cached passwd structure (#1712053)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Mar 04 2019 Jakub Jelen <jjelen@redhat.com> - 7.4p1-19 + 0.10.3-2
|
|
|
b58e57 |
- Update cached passwd structure after PAM authentication (#1674541)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Feb 13 2019 Jakub Jelen <jjelen@redhat.com> - 7.4p1-18 + 0.10.3-2
|
|
|
b58e57 |
- invalidate supplemental group cache used by temporarily_use_uid()
|
|
|
b58e57 |
when the target uid differs (#1583735)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Jan 14 2019 Jakub Jelen <jjelen@redhat.com> - 7.4p1-17 + 0.10.3-2
|
|
|
b58e57 |
- Fix for CVE-2018-15473 (#1619079)
|
|
|
b58e57 |
- Enable GCM mode for AES ciphers in FIPS mode (#1600869)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Nov 24 2017 Jakub Jelen <jjelen@redhat.com> - 7.4p1-16 + 0.10.3-2
|
|
|
b58e57 |
- Fix for CVE-2017-15906 (#1517226)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Nov 06 2017 Jakub Jelen <jjelen@redhat.com> - 7.4p1-15 + 0.10.3-2
|
|
|
b58e57 |
- Do not hang if SSH AuthorizedKeysCommand output is too large (#1496467)
|
|
|
b58e57 |
- Do not segfault pam_ssh_agent_auth if keyfile is missing (#1494268)
|
|
|
b58e57 |
- Do not segfault in audit code during cleanup (#1488083)
|
|
|
b58e57 |
- Add WinSCP 5.10+ compatibility (#1496808)
|
|
|
b58e57 |
- Clatch between ClientAlive and rekeying timeouts (#1480510)
|
|
|
b58e57 |
- Exclude dsa and ed25519 from default proposed keys in FIPS mode (#1456853)
|
|
|
b58e57 |
- Add enablement for openssl-ibmca and openssl-ibmpkcs11 (#1478035)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Nov 3 2017 Nikos Mavrogiannopoulos <nmav@redhat.com> - 7.4p1-14 + 0.10.3-2
|
|
|
b58e57 |
- Rebuilt for RHEL-7.5
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Sep 13 2017 Jakub Jelen <jjelen@redhat.com> - 7.4p1-13 + 0.10.3-1
|
|
|
b58e57 |
- Revert default of GSSAPIStrictAcceptorCheck=no back to yes (#1488982)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Aug 07 2017 Jakub Jelen <jjelen@redhat.com> - 7.4p1-12 + 0.10.3-1
|
|
|
b58e57 |
- Revert upstream change to UseDNS=no back to yes (#1478175)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon May 22 2017 Jakub Jelen <jjelen@redhat.com> - 7.4p1-11 + 0.10.3-1
|
|
|
b58e57 |
- Compiler warnings (#1341754)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon May 22 2017 Jakub Jelen <jjelen@redhat.com> - 7.4p1-10 + 0.10.3-1
|
|
|
b58e57 |
- Add missing messages in FIPS mode (#1341754)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri May 19 2017 Jakub Jelen <jjelen@redhat.com> - 7.4p1-9 + 0.10.3-1
|
|
|
b58e57 |
- Allow harmless syscalls for s390 crypto modules (#1451809)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon May 15 2017 Jakub Jelen <jjelen@redhat.com> - 7.4p1-8 + 0.10.3-1
|
|
|
b58e57 |
- Fix multilib issue in documentation (#1450361)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu May 04 2017 Jakub Jelen <jjelen@redhat.com> - 7.4p1-6 + 0.10.3-1
|
|
|
b58e57 |
- ControlPath too long should not be a fatal error (#1447561)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Apr 26 2017 Jakub Jelen <jjelen@redhat.com> - 7.4p1-5 + 0.10.3-1
|
|
|
b58e57 |
- Fix the default key exchange proposal in FIPS mode (#1438414)
|
|
|
b58e57 |
- Remove another wrong coverity chunk to unbreak gsskex (#1438414)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Apr 24 2017 Jakub Jelen <jjelen@redhat.com> - 7.4p1-4 + 0.10.3-1
|
|
|
b58e57 |
- Update seccomp filter to work on ppc64le (#1443916)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Apr 05 2017 Jakub Jelen <jjelen@redhat.com> - 7.4p1-3 + 0.10.3-1
|
|
|
b58e57 |
- Do not completely disable SHA-1 key exchange methods in FIPS (#1324493)
|
|
|
b58e57 |
- Remove wrong coverity patches
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Mar 23 2017 Jakub Jelen <jjelen@redhat.com> - 7.4p1-2 + 0.10.3-1
|
|
|
b58e57 |
- Fix coverity scan results
|
|
|
b58e57 |
- Adjust FIPS algorithms list (#1420910)
|
|
|
b58e57 |
- Revert problematic feature for chroot(#1418062)
|
|
|
b58e57 |
- Fix CBC weakness in released OpenSSH 7.5
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Mar 01 2017 Jakub Jelen <jjelen@redhat.com> - 7.4p1-1 + 0.10.3-1
|
|
|
b58e57 |
- Rebase to openssh 7.4 and pam_ssh_agent_auth 0.10.3 (#1341754)
|
|
|
b58e57 |
- detach -cavs subpackage
|
|
|
b58e57 |
- enable seccomp filter for sandboxed child
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Mar 01 2017 Jakub Jelen <jjelen@redhat.com> - 6.6.1p1-35 + 0.9.3-9
|
|
|
b58e57 |
- Do not send SD_NOTIFY from forked childern (#1381997)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Feb 24 2017 Jakub Jelen <jjelen@redhat.com> - 6.6.1p1-34 + 0.9.3-9
|
|
|
b58e57 |
- Add SD_NOTIFY code to help systemd to track running service (#1381997)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Dec 19 2016 Jakub Jelen <jjelen@redhat.com> - 6.6.1p1-33 + 0.9.3-9
|
|
|
b58e57 |
- Restore login with large MOTD (#1404018)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Nov 29 2016 Jakub Jelen <jjelen@redhat.com> - 6.6.1p1-32 + 0.9.3-9
|
|
|
b58e57 |
- Restore funcionality of chrooted envirotments (#1398569)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Sep 06 2016 Jakub Jelen <jjelen@redhat.com> - 6.6.1p1-31 + 0.9.3-9
|
|
|
b58e57 |
- Do not depend on selinux-policy (#1373297)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Jul 29 2016 Jakub Jelen <jjelen@redhat.com> - 6.6.1p1-30 + 0.9.3-9
|
|
|
b58e57 |
- Drop dependency on libcap-ng for ssh-keycat (#1357859)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Jul 28 2016 Jakub Jelen <jjelen@redhat.com> - 6.6.1p1-29 + 0.9.3-9
|
|
|
b58e57 |
- Rework SELinux context handling with chroot using libcap-ng (#1357859)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Jul 01 2016 Jakub Jelen <jjelen@redhat.com> - 6.6.1p1-28 + 0.9.3-9
|
|
|
b58e57 |
- SFTP force permission collision with umask (#1344614)
|
|
|
b58e57 |
- Make closefrom() ignore FD's to /dev/ devices on s390 (#1318760)
|
|
|
b58e57 |
- Create a default value for AuthenticationMethods any (#1237129)
|
|
|
b58e57 |
- Fix ssh-copy-id with LogLevel=quiet (#1349556)
|
|
|
b58e57 |
- Expose more information to PAM (#1312304)
|
|
|
b58e57 |
- Move MAX_DISPLAYS to a configuration option (#1341302)
|
|
|
b58e57 |
- Add a wildcard option to PermitOpen directive (host) (#1344106)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue May 31 2016 Jakub Jelen <jjelen@redhat.com> - 6.6.1p1-27 + 0.9.3-9
|
|
|
b58e57 |
- Coverity and RPMDiff build issues (#1334326)
|
|
|
b58e57 |
- CVE-2015-8325: privilege escalation via user's PAM environment and UseLogin=yes (#1329191)
|
|
|
b58e57 |
- Check for real location of .k5login file (#1328243)
|
|
|
b58e57 |
- close ControlPersist background process stderr (#1335540)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Apr 01 2016 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-26 + 0.9.3-9
|
|
|
b58e57 |
- Drop glob patch for sftp client preventing listing many files (#1310303)
|
|
|
b58e57 |
- Fix race condition between audit messages from different processes (#1310684)
|
|
|
b58e57 |
- Make systemd service forking to properly report state (#1291172)
|
|
|
b58e57 |
- Get rid of rpm triggers for openssh-5.x (#1312013)
|
|
|
b58e57 |
- Generate the host keys when the key files are empty (#1266043)
|
|
|
b58e57 |
- pam_ssh_agent_auth: authorized_keys_command option (#1317858)
|
|
|
b58e57 |
- Don't use MD5 digest from pam_ssh_agent_auth in FIPS mode (#1317952)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Mar 16 2016 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-25 + 0.9.3-9
|
|
|
b58e57 |
- CVE-2016-1908: possible fallback from untrusted to trusted X11 forwarding (#1298741)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Mar 15 2016 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-24 + 0.9.3-9
|
|
|
b58e57 |
- CVE-2016-3115: missing sanitisation of input for X11 forwarding (#1317819)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Jan 13 2016 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-23 + 0.9.3-9
|
|
|
b58e57 |
- Disable undocumented feauture Roaming for good (#1298218)
|
|
|
b58e57 |
- prevents CVE-2016-0777 and CVE-2016-0778
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Sep 25 2015 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-22 + 0.9.3-9
|
|
|
b58e57 |
- Use the correct constant for glob limits (#1160377)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Sep 24 2015 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-21 + 0.9.3-9
|
|
|
b58e57 |
- Extend memory limit for remote glob in sftp acc. to stat limit (#1160377)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Sep 24 2015 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-20 + 0.9.3-9
|
|
|
b58e57 |
- Fix vulnerabilities published with openssh-7.0 (#1265807)
|
|
|
b58e57 |
- Privilege separation weakness related to PAM support
|
|
|
b58e57 |
- Use-after-free bug related to PAM support
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Sep 24 2015 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-19 + 0.9.3-9
|
|
|
b58e57 |
- Increase limit of files for glob match in sftp to 8192 (#1160377)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Aug 18 2015 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-18 + 0.9.3-9
|
|
|
b58e57 |
- Add GSSAPIKexAlgorithms option for server and client application (#1253062)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Jul 29 2015 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-17 + 0.9.3-9
|
|
|
b58e57 |
- Security fixes released with openssh-6.9 (CVE-2015-5352) (#1247864)
|
|
|
b58e57 |
- XSECURITY restrictions bypass under certain conditions in ssh(1) (#1238231)
|
|
|
b58e57 |
- weakness of agent locking (ssh-add -x) to password guessing (#1238238)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Jul 27 2015 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-16 + 0.9.3-9
|
|
|
b58e57 |
- only query each keyboard-interactive device once (CVE-2015-5600) (#1245971)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Jul 15 2015 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-15 + 0.9.3-9
|
|
|
b58e57 |
- One more typo in manual page documenting TERM variable (#1162683)
|
|
|
b58e57 |
- Fix race condition with auditing messages answers (#1240613)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Jun 15 2015 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-14 + 0.9.3-9
|
|
|
b58e57 |
- Fix ldif schema to have correct spacing on newlines (#1184938)
|
|
|
b58e57 |
- Add missing values for sshd test mode (#1187597)
|
|
|
b58e57 |
- ssh-copy-id: tcsh doesnt work with multiline strings (#1201758)
|
|
|
b58e57 |
- Fix memory problems with newkeys and array transfers (#1223218)
|
|
|
b58e57 |
- Enhance AllowGroups documentation in man page (#1150007)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon May 11 2015 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-13 + 0.9.3-9
|
|
|
b58e57 |
- Increase limit of files for glob match in sftp (#1160377)
|
|
|
b58e57 |
- Add pam_reauthorize.so to /etc/pam.d/sshd (#1204233)
|
|
|
b58e57 |
- Show all config values in sshd test mode (#1187597)
|
|
|
b58e57 |
- Document required selinux boolean for working ssh-ldap-helper (#1178116)
|
|
|
b58e57 |
- Consistent usage of pam_namespace in sshd (#1125110)
|
|
|
b58e57 |
- Fix auditing when using combination of ForcedCommand and PTY (#1199112)
|
|
|
b58e57 |
- Add sftp option to force mode of created files (#1197989)
|
|
|
b58e57 |
- Ability to specify an arbitrary LDAP filter in ldap.conf for ssh-ldap-helper (#1201753)
|
|
|
b58e57 |
- Provide documentation line for systemd service and socket (#1181591)
|
|
|
b58e57 |
- Provide LDIF version of LPK schema (#1184938)
|
|
|
b58e57 |
- Document TERM environment variable (#1162683)
|
|
|
b58e57 |
- Fix ssh-copy-id on non-sh remote shells (#1201758)
|
|
|
b58e57 |
- Do not read RSA1 hostkeys for HostBased authentication in FIPS (#1197666)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Mar 19 2015 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-12 + 0.9.3-9
|
|
|
b58e57 |
- Fix labeling in MLS according to selected sensitivity (#1202843)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Jan 16 2015 Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-11 + 0.9.3-9
|
|
|
b58e57 |
- fix direction in CRYPTO_SESSION audit message (#1171248)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Jan 14 2015 Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-10 + 0.9.3-9
|
|
|
b58e57 |
- add new option GSSAPIEnablek5users and disable using ~/.k5users by default CVE-2014-9278
|
|
|
b58e57 |
(#1169843)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Dec 19 2014 Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-9 + 0.9.3-9
|
|
|
b58e57 |
- log via monitor in chroots without /dev/log (#1083482)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Dec 15 2014 Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-8 + 0.9.3-9
|
|
|
b58e57 |
- increase size of AUDIT_LOG_SIZE to 256 (#1171163)
|
|
|
b58e57 |
- record pfs= field in CRYPTO_SESSION audit event (#1171248)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Nov 13 2014 Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-7 + 0.9.3-9
|
|
|
b58e57 |
- fix gsskex patch to correctly handle MONITOR_REQ_GSSSIGN request (#1118005)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Nov 07 2014 Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-6 + 0.9.3-9
|
|
|
b58e57 |
- correct the calculation of bytes for authctxt->krb5_ccname <ams@corefiling.com> (#1161073)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Nov 04 2014 Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-5 + 0.9.3-9
|
|
|
b58e57 |
- change audit trail for unknown users (#1158521)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Sun Oct 26 2014 Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-4 + 0.9.3-9
|
|
|
b58e57 |
- revert the default of KerberosUseKuserok back to yes
|
|
|
b58e57 |
- fix kuserok patch which checked for the existence of .k5login unconditionally
|
|
|
b58e57 |
and hence prevented other mechanisms to be used properly
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Sep 29 2014 Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-3 + 0.9.3-9
|
|
|
b58e57 |
- fix parsing empty options in sshd_conf
|
|
|
b58e57 |
- ignore SIGXFSZ in postauth monitor
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Sep 23 2014 Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-2 + 0.9.3-9
|
|
|
b58e57 |
- slightly change systemd units logic - use sshd-keygen.service (#1066615)
|
|
|
b58e57 |
- log when a client requests an interactive session and only sftp is allowed (#1130198)
|
|
|
b58e57 |
- sshd-keygen - don't generate DSA and ED25519 host keys in FIPS mode (#1143867)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Sep 08 2014 Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-1 + 0.9.3-9
|
|
|
b58e57 |
- new upstream release (#1059667)
|
|
|
b58e57 |
- prevent a server from skipping SSHFP lookup - CVE-2014-2653 (#1081338)
|
|
|
b58e57 |
- make /etc/ssh/moduli file public (#1134448)
|
|
|
b58e57 |
- test existence of /etc/ssh/ssh_host_ecdsa_key in sshd-keygen.service
|
|
|
b58e57 |
- don't clean up gssapi credentials by default (#1134447)
|
|
|
b58e57 |
- ssh-agent - try CLOCK_BOOTTIME with fallback (#1134449)
|
|
|
b58e57 |
- disable the curve25519 KEX when speaking to OpenSSH 6.5 or 6.6
|
|
|
b58e57 |
- add support for ED25519 keys to sshd-keygen and sshd.sysconfig
|
|
|
b58e57 |
- standardise on NI_MAXHOST for gethostname() string lengths (#1097665)
|
|
|
b58e57 |
- set a client's address right after a connection is set (mindrot#2257) (#912792)
|
|
|
b58e57 |
- apply RFC3454 stringprep to banners when possible (mindrot#2058) (#1104662)
|
|
|
b58e57 |
- don't consider a partial success as a failure (mindrot#2270) (#1112972)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Mar 19 2014 Petr Lautrbach <plautrba@redhat.com> 6.4p1-8 + 0.9.3-8
|
|
|
b58e57 |
- ignore environment variables with embedded '=' or '\0' characters (#1077843)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Jan 28 2014 Petr Lautrbach <plautrba@redhat.com> 6.4p1-7 + 0.9.3-8
|
|
|
b58e57 |
- log fipscheck verification message into syslog authpriv
|
|
|
b58e57 |
- ssh-keygen - relative-specified certificate expiry time should be relative
|
|
|
b58e57 |
to current time and not the validity start time (#1058234)
|
|
|
b58e57 |
- use the size of security of 3des for DH (#1053107)
|
|
|
b58e57 |
- ssh-copy-id.1 man page fix (#1058792)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Jan 24 2014 Daniel Mach <dmach@redhat.com> - 6.4p1-6
|
|
|
b58e57 |
- Mass rebuild 2014-01-24
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Jan 20 2014 Petr Lautrbach <plautrba@redhat.com> 6.4p1-5 + 0.9.3-8
|
|
|
b58e57 |
- use tty allocation for a remote scp (#985650)
|
|
|
b58e57 |
- run ssh-copy-id in the legacy mode when SSH_COPY_ID_LEGACY variable is set (#969375)
|
|
|
b58e57 |
- FIPS mode - adjust the key echange DH groups and ssh-keygen according toSP800-131A (#1001748)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Dec 27 2013 Daniel Mach <dmach@redhat.com> - 6.4p1-4
|
|
|
b58e57 |
- Mass rebuild 2013-12-27
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Dec 11 2013 Petr Lautrbach <plautrba@redhat.com> 6.4p1-3 + 0.9.3-8
|
|
|
b58e57 |
- sshd-keygen - use correct permissions on ecdsa host key (#1023945)
|
|
|
b58e57 |
- use only rsa and ecdsa host keys by default
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Nov 26 2013 Petr Lautrbach <plautrba@redhat.com> 6.4p1-2 + 0.9.3-1
|
|
|
b58e57 |
- fix fatal() cleanup in the audit patch (#1029074)
|
|
|
b58e57 |
- fix parsing logic of ldap.conf file (#1033662)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Nov 08 2013 Petr Lautrbach <plautrba@redhat.com> 6.4p1-1 + 0.9.3-1
|
|
|
b58e57 |
- new upstream release
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Nov 01 2013 Petr Lautrbach <plautrba@redhat.com> 6.3p1-4 + 0.9.3-7
|
|
|
b58e57 |
- adjust gss kex mechanism to the upstream changes (#1024004)
|
|
|
b58e57 |
- don't use xfree in pam_ssh_agent_auth sources <geertj@gmail.com> (#1024965)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Oct 24 2013 Petr Lautrbach <plautrba@redhat.com> 6.3p1-3 + 0.9.3-6
|
|
|
b58e57 |
- don't use SSH_FP_MD5 for fingerprints in FIPS mode (#1020948)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Oct 23 2013 Petr Lautrbach <plautrba@redhat.com> 6.3p1-2 + 0.9.3-6
|
|
|
b58e57 |
- use default_ccache_name from /etc/krb5.conf for a kerberos cache (#991186)
|
|
|
b58e57 |
- increase the size of the Diffie-Hellman groups (#1010607)
|
|
|
b58e57 |
- sshd-keygen to generate ECDSA keys <i.grok@comcast.net> (#1019222)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Oct 14 2013 Petr Lautrbach <plautrba@redhat.com> 6.3p1-1 + 0.9.3-6
|
|
|
b58e57 |
- new upstream release (#1013635)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Oct 08 2013 Petr Lautrbach <plautrba@redhat.com> 6.2p2-9 + 0.9.3-5
|
|
|
b58e57 |
- use dracut-fips package to determine if a FIPS module is installed (#1001566)
|
|
|
b58e57 |
- revert -fips subpackages and hmac files suffixes
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Sep 25 2013 Petr Lautrbach <plautrba@redhat.com> 6.2p2-8 + 0.9.3-5
|
|
|
b58e57 |
- sshd-keygen: generate only RSA keys by default (#1010361)
|
|
|
b58e57 |
- use dist tag in suffixes for hmac checksum files
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Sep 11 2013 Petr Lautrbach <plautrba@redhat.com> 6.2p2-7 + 0.9.3-5
|
|
|
b58e57 |
- use hmac_suffix for ssh{,d} hmac checksums
|
|
|
b58e57 |
- bump the minimum value of SSH_USE_STRONG_RNG to 14 according to SP800-131A
|
|
|
b58e57 |
- automatically restart sshd.service on-failure after 42s interval
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Aug 29 2013 Petr Lautrbach <plautrba@redhat.com> 6.2p2-6.1 + 0.9.3-5
|
|
|
b58e57 |
- add -fips subpackages that contains the FIPS module files
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Jul 31 2013 Petr Lautrbach <plautrba@redhat.com> 6.2p2-5 + 0.9.3-5
|
|
|
b58e57 |
- gssapi credentials need to be stored before a pam session opened (#987792)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Jul 23 2013 Petr Lautrbach <plautrba@redhat.com> 6.2p2-4 + 0.9.3-5
|
|
|
b58e57 |
- don't show Success for EAI_SYSTEM (#985964)
|
|
|
b58e57 |
- make sftp's libedit interface marginally multibyte aware (#841771)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Jun 17 2013 Petr Lautrbach <plautrba@redhat.com> 6.2p2-3 + 0.9.3-5
|
|
|
b58e57 |
- move default gssapi cache to /run/user/<uid> (#848228)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue May 21 2013 Petr Lautrbach <plautrba@redhat.com> 6.2p2-2 + 0.9.3-5
|
|
|
b58e57 |
- add socket activated sshd units to the package (#963268)
|
|
|
b58e57 |
- fix the example in the HOWTO.ldap-keys
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon May 20 2013 Petr Lautrbach <plautrba@redhat.com> 6.2p2-1 + 0.9.3-5
|
|
|
b58e57 |
- new upstream release (#963582)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Apr 17 2013 Petr Lautrbach <plautrba@redhat.com> 6.2p1-4 + 0.9.3-4
|
|
|
b58e57 |
- don't use export in sysconfig file (#953111)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Apr 16 2013 Petr Lautrbach <plautrba@redhat.com> 6.2p1-3 + 0.9.3-4
|
|
|
b58e57 |
- sshd.service: use KillMode=process (#890376)
|
|
|
b58e57 |
- add latest config.{sub,guess} to support aarch64 (#926284)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Apr 09 2013 Petr Lautrbach <plautrba@redhat.com> 6.2p1-2 + 0.9.3-4
|
|
|
b58e57 |
- keep track of which IndentityFile options were manually supplied and
|
|
|
b58e57 |
which were default options, and don't warn if the latter are missing.
|
|
|
b58e57 |
(mindrot#2084)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Apr 09 2013 Petr Lautrbach <plautrba@redhat.com> 6.2p1-1 + 0.9.3-4
|
|
|
b58e57 |
- new upstream release (#924727)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Mar 06 2013 Petr Lautrbach <plautrba@redhat.com> 6.1p1-7 + 0.9.3-3
|
|
|
b58e57 |
- use SELinux type sshd_net_t for [net] childs (#915085)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Feb 14 2013 Petr Lautrbach <plautrba@redhat.com> 6.1p1-6 + 0.9.3-3
|
|
|
b58e57 |
- fix AuthorizedKeysCommand option
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Feb 08 2013 Petr Lautrbach <plautrba@redhat.com> 6.1p1-5 + 0.9.3-3
|
|
|
b58e57 |
- change default value of MaxStartups - CVE-2010-5107 (#908707)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Dec 03 2012 Petr Lautrbach <plautrba@redhat.com> 6.1p1-4 + 0.9.3-3
|
|
|
b58e57 |
- fix segfault in openssh-5.8p2-force_krb.patch (#882541)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Dec 03 2012 Petr Lautrbach <plautrba@redhat.com> 6.1p1-3 + 0.9.3-3
|
|
|
b58e57 |
- replace RequiredAuthentications2 with AuthenticationMethods based on upstream
|
|
|
b58e57 |
- obsolete RequiredAuthentications[12] options
|
|
|
b58e57 |
- fix openssh-6.1p1-privsep-selinux.patch
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Oct 26 2012 Petr Lautrbach <plautrba@redhat.com> 6.1p1-2
|
|
|
b58e57 |
- add SELinux comment to /etc/ssh/sshd_config about SELinux command to modify port (#861400)
|
|
|
b58e57 |
- drop required chkconfig (#865498)
|
|
|
b58e57 |
- drop openssh-5.9p1-sftp-chroot.patch (#830237)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Sat Sep 15 2012 Petr Lautrbach <plautrba@redhat.com> 6.1p1-1 + 0.9.3-3
|
|
|
b58e57 |
- new upstream release (#852651)
|
|
|
b58e57 |
- use DIR: kerberos type cache (#848228)
|
|
|
b58e57 |
- don't use chroot_user_t for chrooted users (#830237)
|
|
|
b58e57 |
- replace scriptlets with systemd macros (#850249)
|
|
|
b58e57 |
- don't use /bin and /sbin paths (#856590)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Aug 06 2012 Petr Lautrbach <plautrba@redhat.com> 6.0p1-1 + 0.9.3-2
|
|
|
b58e57 |
- new upstream release
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Aug 06 2012 Petr Lautrbach <plautrba@redhat.com> 5.9p1-26 + 0.9.3-1
|
|
|
b58e57 |
- change SELinux context also for root user (#827109)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Jul 27 2012 Petr Lautrbach <plautrba@redhat.com> 5.9p1-25 + 0.9.3-1
|
|
|
b58e57 |
- fix various issues in openssh-5.9p1-required-authentications.patch
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Jul 17 2012 Tomas Mraz <tmraz@redhat.com> 5.9p1-24 + 0.9.3-1
|
|
|
b58e57 |
- allow sha256 and sha512 hmacs in the FIPS mode
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Jun 22 2012 Tomas Mraz <tmraz@redhat.com> 5.9p1-23 + 0.9.3-1
|
|
|
b58e57 |
- fix segfault in su when pam_ssh_agent_auth is used and the ssh-agent
|
|
|
b58e57 |
is not running, most probably not exploitable
|
|
|
b58e57 |
- update pam_ssh_agent_auth to 0.9.3 upstream version
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Apr 06 2012 Petr Lautrbach <plautrba@redhat.com> 5.9p1-22 + 0.9.2-32
|
|
|
b58e57 |
- don't create RSA1 key in FIPS mode
|
|
|
b58e57 |
- don't install sshd-keygen.service (#810419)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Mar 30 2012 Petr Lautrbach <plautrba@redhat.com> 5.9p1-21 + 0.9.2-32
|
|
|
b58e57 |
- fix various issues in openssh-5.9p1-required-authentications.patch
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Mar 21 2012 Petr Lautrbach <plautrba@redhat.com> 5.9p1-20 + 0.9.2-32
|
|
|
b58e57 |
- Fix dependencies in systemd units, don't enable sshd-keygen.service (#805338)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Feb 22 2012 Petr Lautrbach <plautrba@redhat.com> 5.9p1-19 + 0.9.2-32
|
|
|
b58e57 |
- Look for x11 forward sockets with AI_ADDRCONFIG flag getaddrinfo (#735889)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Feb 06 2012 Petr Lautrbach <plautrba@redhat.com> 5.9p1-18 + 0.9.2-32
|
|
|
b58e57 |
- replace TwoFactorAuth with RequiredAuthentications[12]
|
|
|
b58e57 |
https://bugzilla.mindrot.org/show_bug.cgi?id=983
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Jan 31 2012 Petr Lautrbach <plautrba@redhat.com> 5.9p1-17 + 0.9.2-32
|
|
|
b58e57 |
- run privsep slave process as the users SELinux context (#781634)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Dec 13 2011 Tomas Mraz <tmraz@redhat.com> 5.9p1-16 + 0.9.2-32
|
|
|
b58e57 |
- add CAVS test driver for the aes-ctr ciphers
|
|
|
b58e57 |
|
|
|
b58e57 |
* Sun Dec 11 2011 Tomas Mraz <tmraz@redhat.com> 5.9p1-15 + 0.9.2-32
|
|
|
b58e57 |
- enable aes-ctr ciphers use the EVP engines from OpenSSL such as the AES-NI
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Dec 06 2011 Petr Lautrbach <plautrba@redhat.com> 5.9p1-14 + 0.9.2-32
|
|
|
b58e57 |
- warn about unsupported option UsePAM=no (#757545)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Nov 21 2011 Tomas Mraz <tmraz@redhat.com> - 5.9p1-13 + 0.9.2-32
|
|
|
b58e57 |
- add back the restorecon call to ssh-copy-id - it might be needed on older
|
|
|
b58e57 |
distributions (#739989)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Nov 18 2011 Tomas Mraz <tmraz@redhat.com> - 5.9p1-12 + 0.9.2-32
|
|
|
b58e57 |
- still support /etc/sysconfig/sshd loading in sshd service (#754732)
|
|
|
b58e57 |
- fix incorrect key permissions generated by sshd-keygen script (#754779)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Oct 14 2011 Tomas Mraz <tmraz@redhat.com> - 5.9p1-11 + 0.9.2-32
|
|
|
b58e57 |
- remove unnecessary requires on initscripts
|
|
|
b58e57 |
- set VerifyHostKeyDNS to ask in the default configuration (#739856)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Sep 19 2011 Jan F. Chadima <jchadima@redhat.com> - 5.9p1-10 + 0.9.2-32
|
|
|
b58e57 |
- selinux sandbox rewrite
|
|
|
b58e57 |
- two factor authentication tweaking
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Sep 14 2011 Jan F. Chadima <jchadima@redhat.com> - 5.9p1-9 + 0.9.2-32
|
|
|
b58e57 |
- coverity upgrade
|
|
|
b58e57 |
- wipe off nonfunctional nss
|
|
|
b58e57 |
- selinux sandbox tweaking
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Sep 13 2011 Jan F. Chadima <jchadima@redhat.com> - 5.9p1-8 + 0.9.2-32
|
|
|
b58e57 |
- coverity upgrade
|
|
|
b58e57 |
- experimental selinux sandbox
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Sep 13 2011 Jan F. Chadima <jchadima@redhat.com> - 5.9p1-7 + 0.9.2-32
|
|
|
b58e57 |
- fully reanable auditing
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Sep 12 2011 Jan F. Chadima <jchadima@redhat.com> - 5.9p1-6 + 0.9.2-32
|
|
|
b58e57 |
- repair signedness in akc patch
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Sep 12 2011 Jan F. Chadima <jchadima@redhat.com> - 5.9p1-5 + 0.9.2-32
|
|
|
b58e57 |
- temporarily disable part of audit4 patch
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Sep 9 2011 Jan F. Chadima <jchadima@redhat.com> - 5.9p1-3 + 0.9.2-32
|
|
|
b58e57 |
- Coverity second pass
|
|
|
b58e57 |
- Reenable akc patch
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Sep 8 2011 Jan F. Chadima <jchadima@redhat.com> - 5.9p1-2 + 0.9.2-32
|
|
|
b58e57 |
- Coverity first pass
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Sep 7 2011 Jan F. Chadima <jchadima@redhat.com> - 5.9p1-1 + 0.9.2-32
|
|
|
b58e57 |
- Rebase to 5.9p1
|
|
|
b58e57 |
- Add chroot sftp patch
|
|
|
b58e57 |
- Add two factor auth patch
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Aug 23 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-21 + 0.9.2-31
|
|
|
b58e57 |
- ignore SIGPIPE in ssh keyscan
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Aug 9 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-20 + 0.9.2-31
|
|
|
b58e57 |
- save ssh-askpass's debuginfo
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Aug 8 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-19 + 0.9.2-31
|
|
|
b58e57 |
- compile ssh-askpass with corect CFLAGS
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Aug 8 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-18 + 0.9.2-31
|
|
|
b58e57 |
- improve selinux's change context log
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Aug 8 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-17 + 0.9.2-31
|
|
|
b58e57 |
- repair broken man pages
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Jul 25 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-16 + 0.9.2-31
|
|
|
b58e57 |
- rebuild due to broken rpmbiild
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Jul 21 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-15 + 0.9.2-31
|
|
|
b58e57 |
- Do not change context when run under unconfined_t
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Jul 14 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-14 + 0.9.2-31
|
|
|
b58e57 |
- Add postlogin to pam. (#718807)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Jun 28 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-12 + 0.9.2-31
|
|
|
b58e57 |
- Systemd compatibility according to Mathieu Bridon <bochecha@fedoraproject.org>
|
|
|
b58e57 |
- Split out the host keygen into their own command, to ease future migration
|
|
|
b58e57 |
to systemd. Compatitbility with the init script was kept.
|
|
|
b58e57 |
- Migrate the package to full native systemd unit files, according to the Fedora
|
|
|
b58e57 |
packaging guidelines.
|
|
|
b58e57 |
- Prepate the unit files for running an ondemand server. (do not add it actually)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Jun 21 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-10 + 0.9.2-31
|
|
|
b58e57 |
- Mention IPv6 usage in man pages
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Jun 20 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-9 + 0.9.2-31
|
|
|
b58e57 |
- Improve init script
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Jun 16 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-7 + 0.9.2-31
|
|
|
b58e57 |
- Add possibility to compile openssh without downstream patches
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Jun 9 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-6 + 0.9.2-31
|
|
|
b58e57 |
- remove stale control sockets (#706396)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue May 31 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-5 + 0.9.2-31
|
|
|
b58e57 |
- improove entropy manuals
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri May 27 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-4 + 0.9.2-31
|
|
|
b58e57 |
- improove entropy handling
|
|
|
b58e57 |
- concat ldap patches
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue May 24 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-3 + 0.9.2-31
|
|
|
b58e57 |
- improove ldap manuals
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon May 23 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-2 + 0.9.2-31
|
|
|
b58e57 |
- add gssapi forced command
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue May 3 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-1 + 0.9.2-31
|
|
|
b58e57 |
- update the openssh version
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Apr 28 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-34 + 0.9.2-30
|
|
|
b58e57 |
- temporarily disabling systemd units
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Apr 27 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-33 + 0.9.2-30
|
|
|
b58e57 |
- add flags AI_V4MAPPED and AI_ADDRCONFIG to getaddrinfo
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Apr 26 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-32 + 0.9.2-30
|
|
|
b58e57 |
- update scriptlets
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Apr 22 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-30 + 0.9.2-30
|
|
|
b58e57 |
- add systemd units
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Apr 22 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-28 + 0.9.2-30
|
|
|
b58e57 |
- improving sshd -> passwd transation
|
|
|
b58e57 |
- add template for .local domain to sshd_config
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Apr 21 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-27 + 0.9.2-30
|
|
|
b58e57 |
- the private keys may be 640 root:ssh_keys ssh_keysign is sgid
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Apr 20 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-26 + 0.9.2-30
|
|
|
b58e57 |
- improving sshd -> passwd transation
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Apr 5 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-25 + 0.9.2-30
|
|
|
b58e57 |
- the intermediate context is set to sshd_sftpd_t
|
|
|
b58e57 |
- do not crash in packet.c if no connection
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Mar 31 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-24 + 0.9.2-30
|
|
|
b58e57 |
- resolve warnings in port_linux.c
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Mar 29 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-23 + 0.9.2-30
|
|
|
b58e57 |
- add /etc/sysconfig/sshd
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Mar 28 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-22 + 0.9.2-30
|
|
|
b58e57 |
- improve reseeding and seed source (documentation)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Mar 22 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-20 + 0.9.2-30
|
|
|
b58e57 |
- use /dev/random or /dev/urandom for seeding prng
|
|
|
b58e57 |
- improve periodical reseeding of random generator
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Mar 17 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-18 + 0.9.2-30
|
|
|
b58e57 |
- add periodical reseeding of random generator
|
|
|
b58e57 |
- change selinux contex for internal sftp in do_usercontext
|
|
|
b58e57 |
- exit(0) after sigterm
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Mar 10 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-17 + 0.9.2-30
|
|
|
b58e57 |
- improove ssh-ldap (documentation)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Mar 8 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-16 + 0.9.2-30
|
|
|
b58e57 |
- improve session keys audit
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Mar 7 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-15 + 0.9.2-30
|
|
|
b58e57 |
- CVE-2010-4755
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Mar 4 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-14 + 0.9.2-30
|
|
|
b58e57 |
- improove ssh-keycat (documentation)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Mar 3 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-13 + 0.9.2-30
|
|
|
b58e57 |
- improve audit of logins and auths
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Mar 1 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-12 + 0.9.2-30
|
|
|
b58e57 |
- improove ssk-keycat
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Feb 28 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-11 + 0.9.2-30
|
|
|
b58e57 |
- add ssk-keycat
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Feb 25 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-10 + 0.9.2-30
|
|
|
b58e57 |
- reenable auth-keys ldap backend
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Feb 25 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-9 + 0.9.2-30
|
|
|
b58e57 |
- another audit improovements
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Feb 24 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-8 + 0.9.2-30
|
|
|
b58e57 |
- another audit improovements
|
|
|
b58e57 |
- switchable fingerprint mode
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Feb 17 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-4 + 0.9.2-30
|
|
|
b58e57 |
- improve audit of server key management
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Feb 16 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-3 + 0.9.2-30
|
|
|
b58e57 |
- improve audit of logins and auths
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Feb 14 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-1 + 0.9.2-30
|
|
|
b58e57 |
- bump openssh version to 5.8p1
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Feb 08 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 5.6p1-30.1
|
|
|
b58e57 |
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Feb 7 2011 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-30 + 0.9.2-29
|
|
|
b58e57 |
- clean the data structures in the non privileged process
|
|
|
b58e57 |
- clean the data structures when roaming
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Feb 2 2011 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-28 + 0.9.2-29
|
|
|
b58e57 |
- clean the data structures in the privileged process
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Jan 25 2011 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-25 + 0.9.2-29
|
|
|
b58e57 |
- clean the data structures before exit net process
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Jan 17 2011 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-24 + 0.9.2-29
|
|
|
b58e57 |
- make audit compatible with the fips mode
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Jan 14 2011 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-23 + 0.9.2-29
|
|
|
b58e57 |
- add audit of destruction the server keys
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Jan 12 2011 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-22 + 0.9.2-29
|
|
|
b58e57 |
- add audit of destruction the session keys
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Dec 10 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-21 + 0.9.2-29
|
|
|
b58e57 |
- reenable run sshd as non root user
|
|
|
b58e57 |
- renable rekeying
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Nov 24 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-20 + 0.9.2-29
|
|
|
b58e57 |
- reapair clientloop crash (#627332)
|
|
|
b58e57 |
- properly restore euid in case connect to the ssh-agent socket fails
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Nov 22 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-19 + 0.9.2-28
|
|
|
b58e57 |
- striped read permissions from suid and sgid binaries
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Nov 15 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-18 + 0.9.2-27
|
|
|
b58e57 |
- used upstream version of the biguid patch
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Nov 15 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-17 + 0.9.2-27
|
|
|
b58e57 |
- improoved kuserok patch
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Nov 5 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-16 + 0.9.2-27
|
|
|
b58e57 |
- add auditing the host based key ussage
|
|
|
b58e57 |
- repait X11 abstract layer socket (#648896)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Nov 3 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-15 + 0.9.2-27
|
|
|
b58e57 |
- add auditing the kex result
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Nov 2 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-14 + 0.9.2-27
|
|
|
b58e57 |
- add auditing the key ussage
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Oct 20 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-12 + 0.9.2-27
|
|
|
b58e57 |
- update gsskex patch (#645389)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Oct 20 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-11 + 0.9.2-27
|
|
|
b58e57 |
- rebase linux audit according to upstream
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Oct 1 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-10 + 0.9.2-27
|
|
|
b58e57 |
- add missing headers to linux audit
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Sep 29 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-9 + 0.9.2-27
|
|
|
b58e57 |
- audit module now uses openssh audit framevork
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Sep 15 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-8 + 0.9.2-27
|
|
|
b58e57 |
- Add the GSSAPI kuserok switch to the kuserok patch
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Sep 15 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-7 + 0.9.2-27
|
|
|
b58e57 |
- Repaired the kuserok patch
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Sep 13 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-6 + 0.9.2-27
|
|
|
b58e57 |
- Repaired the problem with puting entries with very big uid into lastlog
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Sep 13 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-5 + 0.9.2-27
|
|
|
b58e57 |
- Merging selabel patch with the upstream version. (#632914)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Sep 13 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-4 + 0.9.2-27
|
|
|
b58e57 |
- Tweaking selabel patch to work properly without selinux rules loaded. (#632914)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Sep 8 2010 Tomas Mraz <tmraz@redhat.com> - 5.6p1-3 + 0.9.2-27
|
|
|
b58e57 |
- Make fipscheck hmacs compliant with FHS - requires new fipscheck
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Sep 3 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-2 + 0.9.2-27
|
|
|
b58e57 |
- Added -z relro -z now to LDFLAGS
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Sep 3 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-1 + 0.9.2-27
|
|
|
b58e57 |
- Rebased to openssh5.6p1
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Jul 7 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-18 + 0.9.2-26
|
|
|
b58e57 |
- merged with newer bugzilla's version of authorized keys command patch
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Jun 30 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-17 + 0.9.2-26
|
|
|
b58e57 |
- improved the x11 patch according to upstream (#598671)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Jun 25 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-16 + 0.9.2-26
|
|
|
b58e57 |
- improved the x11 patch (#598671)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Jun 24 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-15 + 0.9.2-26
|
|
|
b58e57 |
- changed _PATH_UNIX_X to unexistent file name (#598671)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Jun 23 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-14 + 0.9.2-26
|
|
|
b58e57 |
- sftp works in deviceless chroot again (broken from 5.5p1-3)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Jun 8 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-13 + 0.9.2-26
|
|
|
b58e57 |
- add option to switch out krb5_kuserok
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri May 21 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-12 + 0.9.2-26
|
|
|
b58e57 |
- synchronize uid and gid for the user sshd
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu May 20 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-11 + 0.9.2-26
|
|
|
b58e57 |
- Typo in ssh-ldap.conf(5) and ssh-ladap-helper(8)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri May 14 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-10 + 0.9.2-26
|
|
|
b58e57 |
- Repair the reference in man ssh-ldap-helper(8)
|
|
|
b58e57 |
- Repair the PubkeyAgent section in sshd_config(5)
|
|
|
b58e57 |
- Provide example ldap.conf
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu May 13 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-9 + 0.9.2-26
|
|
|
b58e57 |
- Make the Ldap configuration widely compatible
|
|
|
b58e57 |
- create the aditional docs for LDAP support.
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu May 6 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-8 + 0.9.2-26
|
|
|
b58e57 |
- Make LDAP config elements TLS_CACERT and TLS_REQCERT compatiple with pam_ldap (#589360)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu May 6 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-7 + 0.9.2-26
|
|
|
b58e57 |
- Make LDAP config element tls_checkpeer compatiple with nss_ldap (#589360)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue May 4 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-6 + 0.9.2-26
|
|
|
b58e57 |
- Comment spec.file
|
|
|
b58e57 |
- Sync patches from upstream
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon May 3 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-5 + 0.9.2-26
|
|
|
b58e57 |
- Create separate ldap package
|
|
|
b58e57 |
- Tweak the ldap patch
|
|
|
b58e57 |
- Rename stderr patch properly
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Apr 29 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-4 + 0.9.2-26
|
|
|
b58e57 |
- Added LDAP support
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Apr 26 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-3 + 0.9.2-26
|
|
|
b58e57 |
- Ignore .bashrc output to stderr in the subsystems
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Apr 20 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-2 + 0.9.2-26
|
|
|
b58e57 |
- Drop dependency on man
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Apr 16 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-1 + 0.9.2-26
|
|
|
b58e57 |
- Update to 5.5p1
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Mar 12 2010 Jan F. Chadima <jchadima@redhat.com> - 5.4p1-3 + 0.9.2-25
|
|
|
b58e57 |
- repair configure script of pam_ssh_agent
|
|
|
b58e57 |
- repair error mesage in ssh-keygen
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Mar 12 2010 Jan F. Chadima <jchadima@redhat.com> - 5.4p1-2
|
|
|
b58e57 |
- source krb5-devel profile script only if exists
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Mar 9 2010 Jan F. Chadima <jchadima@redhat.com> - 5.4p1-1
|
|
|
b58e57 |
- Update to 5.4p1
|
|
|
b58e57 |
- discontinued support for nss-keys
|
|
|
b58e57 |
- discontinued support for scard
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Mar 3 2010 Jan F. Chadima <jchadima@redhat.com> - 5.4p1-0.snap20100302.1
|
|
|
b58e57 |
- Prepare update to 5.4p1
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Feb 15 2010 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-22
|
|
|
b58e57 |
- ImplicitDSOLinking (#564824)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Jan 29 2010 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-21
|
|
|
b58e57 |
- Allow to use hardware crypto if awailable (#559555)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Jan 25 2010 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-20
|
|
|
b58e57 |
- optimized FD_CLOEXEC on accept socket (#541809)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Jan 25 2010 Tomas Mraz <tmraz@redhat.com> - 5.3p1-19
|
|
|
b58e57 |
- updated pam_ssh_agent_auth to new version from upstream (just
|
|
|
b58e57 |
a licence change)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Jan 21 2010 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-18
|
|
|
b58e57 |
- optimized RAND_cleanup patch (#557166)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Jan 20 2010 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-17
|
|
|
b58e57 |
- add RAND_cleanup at the exit of each program using RAND (#557166)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Jan 19 2010 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-16
|
|
|
b58e57 |
- set FD_CLOEXEC on accepted socket (#541809)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Jan 8 2010 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-15
|
|
|
b58e57 |
- replaced define by global in macros
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Jan 5 2010 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-14
|
|
|
b58e57 |
- Update the pka patch
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Dec 21 2009 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-13
|
|
|
b58e57 |
- Update the audit patch
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Dec 4 2009 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-12
|
|
|
b58e57 |
- Add possibility to autocreate only RSA key into initscript (#533339)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Nov 27 2009 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-11
|
|
|
b58e57 |
- Prepare NSS key patch for future SEC_ERROR_LOCKED_PASSWORD (#537411)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Nov 24 2009 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-10
|
|
|
b58e57 |
- Update NSS key patch (#537411, #356451)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Nov 20 2009 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-9
|
|
|
b58e57 |
- Add gssapi key exchange patch (#455351)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Nov 20 2009 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-8
|
|
|
b58e57 |
- Add public key agent patch (#455350)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Nov 2 2009 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-7
|
|
|
b58e57 |
- Repair canohost patch to allow gssapi to work when host is acessed via pipe proxy (#531849)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Oct 29 2009 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-6
|
|
|
b58e57 |
- Modify the init script to prevent it to hang during generating the keys (#515145)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Oct 27 2009 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-5
|
|
|
b58e57 |
- Add README.nss
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Oct 19 2009 Tomas Mraz <tmraz@redhat.com> - 5.3p1-4
|
|
|
b58e57 |
- Add pam_ssh_agent_auth module to a subpackage.
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Oct 16 2009 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-3
|
|
|
b58e57 |
- Reenable audit.
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Oct 2 2009 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-2
|
|
|
b58e57 |
- Upgrade to new wersion 5.3p1
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Sep 29 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-29
|
|
|
b58e57 |
- Resolve locking in ssh-add (#491312)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Sep 24 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-28
|
|
|
b58e57 |
- Repair initscript to be acord to guidelines (#521860)
|
|
|
b58e57 |
- Add bugzilla# to application of edns and xmodifiers patch
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Sep 16 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-26
|
|
|
b58e57 |
- Changed pam stack to password-auth
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Sep 11 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-25
|
|
|
b58e57 |
- Dropped homechroot patch
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Sep 7 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-24
|
|
|
b58e57 |
- Add check for nosuid, nodev in homechroot
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Sep 1 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-23
|
|
|
b58e57 |
- add correct patch for ip-opts
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Sep 1 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-22
|
|
|
b58e57 |
- replace ip-opts patch by an upstream candidate version
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Aug 31 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-21
|
|
|
b58e57 |
- rearange selinux patch to be acceptable for upstream
|
|
|
b58e57 |
- replace seftp patch by an upstream version
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Aug 28 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-20
|
|
|
b58e57 |
- merged xmodifiers to redhat patch
|
|
|
b58e57 |
- merged gssapi-role to selinux patch
|
|
|
b58e57 |
- merged cve-2007_3102 to audit patch
|
|
|
b58e57 |
- sesftp patch only with WITH_SELINUX flag
|
|
|
b58e57 |
- rearange sesftp patch according to upstream request
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Aug 26 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-19
|
|
|
b58e57 |
- minor change in sesftp patch
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Aug 21 2009 Tomas Mraz <tmraz@redhat.com> - 5.2p1-18
|
|
|
b58e57 |
- rebuilt with new openssl
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Jul 30 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-17
|
|
|
b58e57 |
- Added dnssec support. (#205842)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Sat Jul 25 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 5.2p1-16
|
|
|
b58e57 |
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Jul 24 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-15
|
|
|
b58e57 |
- only INTERNAL_SFTP can be home-chrooted
|
|
|
b58e57 |
- save _u and _r parts of context changing to sftpd_t
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Jul 17 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-14
|
|
|
b58e57 |
- changed internal-sftp context to sftpd_t
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Jul 3 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-13
|
|
|
b58e57 |
- changed home length path patch to upstream version
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Jun 30 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-12
|
|
|
b58e57 |
- create '~/.ssh/known_hosts' within proper context
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Jun 29 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-11
|
|
|
b58e57 |
- length of home path in ssh now limited by PATH_MAX
|
|
|
b58e57 |
- correct timezone with daylight processing
|
|
|
b58e57 |
|
|
|
b58e57 |
* Sat Jun 27 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-10
|
|
|
b58e57 |
- final version chroot %%h (sftp only)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Jun 23 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-9
|
|
|
b58e57 |
- repair broken ls in chroot %%h
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Jun 12 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-8
|
|
|
b58e57 |
- add XMODIFIERS to exported environment (#495690)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri May 15 2009 Tomas Mraz <tmraz@redhat.com> - 5.2p1-6
|
|
|
b58e57 |
- allow only protocol 2 in the FIPS mode
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Apr 30 2009 Tomas Mraz <tmraz@redhat.com> - 5.2p1-5
|
|
|
b58e57 |
- do integrity verification only on binaries which are part
|
|
|
b58e57 |
of the OpenSSH FIPS modules
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Apr 20 2009 Tomas Mraz <tmraz@redhat.com> - 5.2p1-4
|
|
|
b58e57 |
- log if FIPS mode is initialized
|
|
|
b58e57 |
- make aes-ctr cipher modes work in the FIPS mode
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Apr 3 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-3
|
|
|
b58e57 |
- fix logging after chroot
|
|
|
b58e57 |
- enable non root users to use chroot %%h in internal-sftp
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Mar 13 2009 Tomas Mraz <tmraz@redhat.com> - 5.2p1-2
|
|
|
b58e57 |
- add AES-CTR ciphers to the FIPS mode proposal
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Mar 9 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-1
|
|
|
b58e57 |
- upgrade to new upstream release
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Feb 26 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 5.1p1-8
|
|
|
b58e57 |
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Feb 12 2009 Tomas Mraz <tmraz@redhat.com> - 5.1p1-7
|
|
|
b58e57 |
- drop obsolete triggers
|
|
|
b58e57 |
- add testing FIPS mode support
|
|
|
b58e57 |
- LSBize the initscript (#247014)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Jan 30 2009 Tomas Mraz <tmraz@redhat.com> - 5.1p1-6
|
|
|
b58e57 |
- enable use of ssl engines (#481100)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Jan 15 2009 Tomas Mraz <tmraz@redhat.com> - 5.1p1-5
|
|
|
b58e57 |
- remove obsolete --with-rsh (#478298)
|
|
|
b58e57 |
- add pam_sepermit to allow blocking confined users in permissive mode
|
|
|
b58e57 |
(#471746)
|
|
|
b58e57 |
- move system-auth after pam_selinux in the session stack
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Dec 11 2008 Tomas Mraz <tmraz@redhat.com> - 5.1p1-4
|
|
|
b58e57 |
- set FD_CLOEXEC on channel sockets (#475866)
|
|
|
b58e57 |
- adjust summary
|
|
|
b58e57 |
- adjust nss-keys patch so it is applicable without selinux patches (#470859)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Oct 17 2008 Tomas Mraz <tmraz@redhat.com> - 5.1p1-3
|
|
|
b58e57 |
- fix compatibility with some servers (#466818)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Jul 31 2008 Tomas Mraz <tmraz@redhat.com> - 5.1p1-2
|
|
|
b58e57 |
- fixed zero length banner problem (#457326)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Jul 23 2008 Tomas Mraz <tmraz@redhat.com> - 5.1p1-1
|
|
|
b58e57 |
- upgrade to new upstream release
|
|
|
b58e57 |
- fixed a problem with public key authentication and explicitely
|
|
|
b58e57 |
specified SELinux role
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed May 21 2008 Tomas Mraz <tmraz@redhat.com> - 5.0p1-3
|
|
|
b58e57 |
- pass the connection socket to ssh-keysign (#447680)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon May 19 2008 Tomas Mraz <tmraz@redhat.com> - 5.0p1-2
|
|
|
b58e57 |
- add LANGUAGE to accepted/sent environment variables (#443231)
|
|
|
b58e57 |
- use pam_selinux to obtain the user context instead of doing it itself
|
|
|
b58e57 |
- unbreak server keep alive settings (patch from upstream)
|
|
|
b58e57 |
- small addition to scp manpage
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Apr 7 2008 Tomas Mraz <tmraz@redhat.com> - 5.0p1-1
|
|
|
b58e57 |
- upgrade to new upstream (#441066)
|
|
|
b58e57 |
- prevent initscript from killing itself on halt with upstart (#438449)
|
|
|
b58e57 |
- initscript status should show that the daemon is running
|
|
|
b58e57 |
only when the main daemon is still alive (#430882)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Mar 6 2008 Tomas Mraz <tmraz@redhat.com> - 4.7p1-10
|
|
|
b58e57 |
- fix race on control master and cleanup stale control socket (#436311)
|
|
|
b58e57 |
patches by David Woodhouse
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Feb 29 2008 Tomas Mraz <tmraz@redhat.com> - 4.7p1-9
|
|
|
b58e57 |
- set FD_CLOEXEC on client socket
|
|
|
b58e57 |
- apply real fix for window size problem (#286181) from upstream
|
|
|
b58e57 |
- apply fix for the spurious failed bind from upstream
|
|
|
b58e57 |
- apply open handle leak in sftp fix from upstream
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Feb 12 2008 Dennis Gilmore <dennis@ausil.us> - 4.7p1-8
|
|
|
b58e57 |
- we build for sparcv9 now and it needs -fPIE
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Jan 3 2008 Tomas Mraz <tmraz@redhat.com> - 4.7p1-7
|
|
|
b58e57 |
- fix gssapi auth with explicit selinux role requested (#427303) - patch
|
|
|
b58e57 |
by Nalin Dahyabhai
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Dec 4 2007 Tomas Mraz <tmraz@redhat.com> - 4.7p1-6
|
|
|
b58e57 |
- explicitly source krb5-devel profile script
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Dec 04 2007 Release Engineering <rel-eng at fedoraproject dot org> - 4.7p1-5
|
|
|
b58e57 |
- Rebuild for openssl bump
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Nov 20 2007 Tomas Mraz <tmraz@redhat.com> - 4.7p1-4
|
|
|
b58e57 |
- do not copy /etc/localtime into the chroot as it is not
|
|
|
b58e57 |
necessary anymore (#193184)
|
|
|
b58e57 |
- call setkeycreatecon when selinux context is established
|
|
|
b58e57 |
- test for NULL privk when freeing key (#391871) - patch by
|
|
|
b58e57 |
Pierre Ossman
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Sep 17 2007 Tomas Mraz <tmraz@redhat.com> - 4.7p1-2
|
|
|
b58e57 |
- revert default window size adjustments (#286181)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Sep 6 2007 Tomas Mraz <tmraz@redhat.com> - 4.7p1-1
|
|
|
b58e57 |
- upgrade to latest upstream
|
|
|
b58e57 |
- use libedit in sftp (#203009)
|
|
|
b58e57 |
- fixed audit log injection problem (CVE-2007-3102)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Aug 9 2007 Tomas Mraz <tmraz@redhat.com> - 4.5p1-8
|
|
|
b58e57 |
- fix sftp client problems on write error (#247802)
|
|
|
b58e57 |
- allow disabling autocreation of server keys (#235466)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Jun 20 2007 Tomas Mraz <tmraz@redhat.com> - 4.5p1-7
|
|
|
b58e57 |
- experimental NSS keys support
|
|
|
b58e57 |
- correctly setup context when empty level requested (#234951)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Mar 20 2007 Tomas Mraz <tmraz@redhat.com> - 4.5p1-6
|
|
|
b58e57 |
- mls level check must be done with default role same as requested
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Mar 19 2007 Tomas Mraz <tmraz@redhat.com> - 4.5p1-5
|
|
|
b58e57 |
- make profile.d/gnome-ssh-askpass.* regular files (#226218)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Feb 27 2007 Tomas Mraz <tmraz@redhat.com> - 4.5p1-4
|
|
|
b58e57 |
- reject connection if requested mls range is not obtained (#229278)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Feb 22 2007 Tomas Mraz <tmraz@redhat.com> - 4.5p1-3
|
|
|
b58e57 |
- improve Buildroot
|
|
|
b58e57 |
- remove duplicate /etc/ssh from files
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Jan 16 2007 Tomas Mraz <tmraz@redhat.com> - 4.5p1-2
|
|
|
b58e57 |
- support mls on labeled networks (#220487)
|
|
|
b58e57 |
- support mls level selection on unlabeled networks
|
|
|
b58e57 |
- allow / in usernames in scp (only beginning /, ./, and ../ is special)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Dec 21 2006 Tomas Mraz <tmraz@redhat.com> - 4.5p1-1
|
|
|
b58e57 |
- update to 4.5p1 (#212606)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Nov 30 2006 Tomas Mraz <tmraz@redhat.com> - 4.3p2-14
|
|
|
b58e57 |
- fix gssapi with DNS loadbalanced clusters (#216857)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Nov 28 2006 Tomas Mraz <tmraz@redhat.com> - 4.3p2-13
|
|
|
b58e57 |
- improved pam_session patch so it doesn't regress, the patch is necessary
|
|
|
b58e57 |
for the pam_session_close to be called correctly as uid 0
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Nov 10 2006 Tomas Mraz <tmraz@redhat.com> - 4.3p2-12
|
|
|
b58e57 |
- CVE-2006-5794 - properly detect failed key verify in monitor (#214641)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Nov 2 2006 Tomas Mraz <tmraz@redhat.com> - 4.3p2-11
|
|
|
b58e57 |
- merge sshd initscript patches
|
|
|
b58e57 |
- kill all ssh sessions when stop is called in halt or reboot runlevel
|
|
|
b58e57 |
- remove -TERM option from killproc so we don't race on sshd restart
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Oct 2 2006 Tomas Mraz <tmraz@redhat.com> - 4.3p2-10
|
|
|
b58e57 |
- improve gssapi-no-spnego patch (#208102)
|
|
|
b58e57 |
- CVE-2006-4924 - prevent DoS on deattack detector (#207957)
|
|
|
b58e57 |
- CVE-2006-5051 - don't call cleanups from signal handler (#208459)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Aug 23 2006 Tomas Mraz <tmraz@redhat.com> - 4.3p2-9
|
|
|
b58e57 |
- don't report duplicate syslog messages, use correct local time (#189158)
|
|
|
b58e57 |
- don't allow spnego as gssapi mechanism (from upstream)
|
|
|
b58e57 |
- fixed memleaks found by Coverity (from upstream)
|
|
|
b58e57 |
- allow ip options except source routing (#202856) (patch by HP)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Aug 8 2006 Tomas Mraz <tmraz@redhat.com> - 4.3p2-8
|
|
|
b58e57 |
- drop the pam-session patch from the previous build (#201341)
|
|
|
b58e57 |
- don't set IPV6_V6ONLY sock opt when listening on wildcard addr (#201594)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Jul 20 2006 Tomas Mraz <tmraz@redhat.com> - 4.3p2-7
|
|
|
b58e57 |
- dropped old ssh obsoletes
|
|
|
b58e57 |
- call the pam_session_open/close from the monitor when privsep is
|
|
|
b58e57 |
enabled so it is always called as root (patch by Darren Tucker)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Jul 17 2006 Tomas Mraz <tmraz@redhat.com> - 4.3p2-6
|
|
|
b58e57 |
- improve selinux patch (by Jan Kiszka)
|
|
|
b58e57 |
- upstream patch for buffer append space error (#191940)
|
|
|
b58e57 |
- fixed typo in configure.ac (#198986)
|
|
|
b58e57 |
- added pam_keyinit to pam configuration (#198628)
|
|
|
b58e57 |
- improved error message when askpass dialog cannot grab
|
|
|
b58e57 |
keyboard input (#198332)
|
|
|
b58e57 |
- buildrequires xauth instead of xorg-x11-xauth
|
|
|
b58e57 |
- fixed a few rpmlint warnings
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Jul 12 2006 Jesse Keating <jkeating@redhat.com> - 4.3p2-5.1
|
|
|
b58e57 |
- rebuild
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Apr 14 2006 Tomas Mraz <tmraz@redhat.com> - 4.3p2-5
|
|
|
b58e57 |
- don't request pseudoterminal allocation if stdin is not tty (#188983)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Mar 2 2006 Tomas Mraz <tmraz@redhat.com> - 4.3p2-4
|
|
|
b58e57 |
- allow access if audit is not compiled in kernel (#183243)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Feb 24 2006 Tomas Mraz <tmraz@redhat.com> - 4.3p2-3
|
|
|
b58e57 |
- enable the subprocess in chroot to send messages to system log
|
|
|
b58e57 |
- sshd should prevent login if audit call fails
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Feb 21 2006 Tomas Mraz <tmraz@redhat.com> - 4.3p2-2
|
|
|
b58e57 |
- print error from scp if not remote (patch by Bjorn Augustsson #178923)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Feb 13 2006 Tomas Mraz <tmraz@redhat.com> - 4.3p2-1
|
|
|
b58e57 |
- new version
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Feb 10 2006 Jesse Keating <jkeating@redhat.com> - 4.3p1-2.1
|
|
|
b58e57 |
- bump again for double-long bug on ppc(64)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Feb 6 2006 Tomas Mraz <tmraz@redhat.com> - 4.3p1-2
|
|
|
b58e57 |
- fixed another place where syslog was called in signal handler
|
|
|
b58e57 |
- pass locale environment variables to server, accept them there (#179851)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Feb 1 2006 Tomas Mraz <tmraz@redhat.com> - 4.3p1-1
|
|
|
b58e57 |
- new version, dropped obsolete patches
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Dec 20 2005 Tomas Mraz <tmraz@redhat.com> - 4.2p1-10
|
|
|
b58e57 |
- hopefully make the askpass dialog less confusing (#174765)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Dec 09 2005 Jesse Keating <jkeating@redhat.com>
|
|
|
b58e57 |
- rebuilt
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Nov 22 2005 Tomas Mraz <tmraz@redhat.com> - 4.2p1-9
|
|
|
b58e57 |
- drop x11-ssh-askpass from the package
|
|
|
b58e57 |
- drop old build_6x ifs from spec file
|
|
|
b58e57 |
- improve gnome-ssh-askpass so it doesn't reveal number of passphrase
|
|
|
b58e57 |
characters to person looking at the display
|
|
|
b58e57 |
- less hackish fix for the __USE_GNU problem
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Nov 18 2005 Nalin Dahyabhai <nalin@redhat.com> - 4.2p1-8
|
|
|
b58e57 |
- work around missing gccmakedep by wrapping makedepend in a local script
|
|
|
b58e57 |
- remove now-obsolete build dependency on "xauth"
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Nov 17 2005 Warren Togami <wtogami@redhat.com> - 4.2p1-7
|
|
|
b58e57 |
- xorg-x11-devel -> libXt-devel
|
|
|
b58e57 |
- rebuild for new xauth location so X forwarding works
|
|
|
b58e57 |
- buildreq audit-libs-devel
|
|
|
b58e57 |
- buildreq automake for aclocal
|
|
|
b58e57 |
- buildreq imake for xmkmf
|
|
|
b58e57 |
- -D_GNU_SOURCE in flags in order to get it to build
|
|
|
b58e57 |
Ugly hack to workaround openssh defining __USE_GNU which is
|
|
|
b58e57 |
not allowed and causes problems according to Ulrich Drepper
|
|
|
b58e57 |
fix this the correct way after FC5test1
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Nov 9 2005 Jeremy Katz <katzj@redhat.com> - 4.2p1-6
|
|
|
b58e57 |
- rebuild against new openssl
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Oct 28 2005 Tomas Mraz <tmraz@redhat.com> 4.2p1-5
|
|
|
b58e57 |
- put back the possibility to skip SELinux patch
|
|
|
b58e57 |
- add patch for user login auditing by Steve Grubb
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Oct 18 2005 Dan Walsh <dwalsh@redhat.com> 4.2p1-4
|
|
|
b58e57 |
- Change selinux patch to use get_default_context_with_rolelevel in libselinux.
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Oct 13 2005 Tomas Mraz <tmraz@redhat.com> 4.2p1-3
|
|
|
b58e57 |
- Update selinux patch to use getseuserbyname
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Oct 7 2005 Tomas Mraz <tmraz@redhat.com> 4.2p1-2
|
|
|
b58e57 |
- use include instead of pam_stack in pam config
|
|
|
b58e57 |
- use fork+exec instead of system in scp - CVE-2006-0225 (#168167)
|
|
|
b58e57 |
- upstream patch for displaying authentication errors
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Sep 06 2005 Tomas Mraz <tmraz@redhat.com> 4.2p1-1
|
|
|
b58e57 |
- upgrade to a new upstream version
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Aug 16 2005 Tomas Mraz <tmraz@redhat.com> 4.1p1-5
|
|
|
b58e57 |
- use x11-ssh-askpass if openssh-askpass-gnome is not installed (#165207)
|
|
|
b58e57 |
- install ssh-copy-id from contrib (#88707)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Jul 27 2005 Tomas Mraz <tmraz@redhat.com> 4.1p1-4
|
|
|
b58e57 |
- don't deadlock on exit with multiple X forwarded channels (#152432)
|
|
|
b58e57 |
- don't use X11 port which can't be bound on all IP families (#163732)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Jun 29 2005 Tomas Mraz <tmraz@redhat.com> 4.1p1-3
|
|
|
b58e57 |
- fix small regression caused by the nologin patch (#161956)
|
|
|
b58e57 |
- fix race in getpeername error checking (mindrot #1054)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Jun 9 2005 Tomas Mraz <tmraz@redhat.com> 4.1p1-2
|
|
|
b58e57 |
- use only pam_nologin for nologin testing
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Jun 6 2005 Tomas Mraz <tmraz@redhat.com> 4.1p1-1
|
|
|
b58e57 |
- upgrade to a new upstream version
|
|
|
b58e57 |
- call pam_loginuid as a pam session module
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon May 16 2005 Tomas Mraz <tmraz@redhat.com> 4.0p1-3
|
|
|
b58e57 |
- link libselinux only to sshd (#157678)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Apr 4 2005 Tomas Mraz <tmraz@redhat.com> 4.0p1-2
|
|
|
b58e57 |
- fixed Local/RemoteForward in ssh_config.5 manpage
|
|
|
b58e57 |
- fix fatal when Local/RemoteForward is used and scp run (#153258)
|
|
|
b58e57 |
- don't leak user validity when using krb5 authentication
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Mar 24 2005 Tomas Mraz <tmraz@redhat.com> 4.0p1-1
|
|
|
b58e57 |
- upgrade to 4.0p1
|
|
|
b58e57 |
- remove obsolete groups patch
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Mar 16 2005 Elliot Lee <sopwith@redhat.com>
|
|
|
b58e57 |
- rebuilt
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Feb 28 2005 Nalin Dahyabhai <nalin@redhat.com> 3.9p1-12
|
|
|
b58e57 |
- rebuild so that configure can detect that krb5_init_ets is gone now
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Feb 21 2005 Tomas Mraz <tmraz@redhat.com> 3.9p1-11
|
|
|
b58e57 |
- don't call syslog in signal handler
|
|
|
b58e57 |
- allow password authentication when copying from remote
|
|
|
b58e57 |
to remote machine (#103364)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Feb 9 2005 Tomas Mraz <tmraz@redhat.com>
|
|
|
b58e57 |
- add spaces to messages in initscript (#138508)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Feb 8 2005 Tomas Mraz <tmraz@redhat.com> 3.9p1-10
|
|
|
b58e57 |
- enable trusted forwarding by default if X11 forwarding is
|
|
|
b58e57 |
required by user (#137685 and duplicates)
|
|
|
b58e57 |
- disable protocol 1 support by default in sshd server config (#88329)
|
|
|
b58e57 |
- keep the gnome-askpass dialog above others (#69131)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Feb 4 2005 Tomas Mraz <tmraz@redhat.com>
|
|
|
b58e57 |
- change permissions on pam.d/sshd to 0644 (#64697)
|
|
|
b58e57 |
- patch initscript so it doesn't kill opened sessions if
|
|
|
b58e57 |
the sshd daemon isn't running anymore (#67624)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Jan 3 2005 Bill Nottingham <notting@redhat.com> 3.9p1-9
|
|
|
b58e57 |
- don't use initlog
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Nov 29 2004 Thomas Woerner <twoerner@redhat.com> 3.9p1-8.1
|
|
|
b58e57 |
- fixed PIE build for all architectures
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Oct 4 2004 Nalin Dahyabhai <nalin@redhat.com> 3.9p1-8
|
|
|
b58e57 |
- add a --enable-vendor-patchlevel option which allows a ShowPatchLevel option
|
|
|
b58e57 |
to enable display of a vendor patch level during version exchange (#120285)
|
|
|
b58e57 |
- configure with --disable-strip to build useful debuginfo subpackages
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Sep 20 2004 Bill Nottingham <notting@redhat.com> 3.9p1-7
|
|
|
b58e57 |
- when using gtk2 for askpass, don't buildprereq gnome-libs-devel
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Sep 14 2004 Nalin Dahyabhai <nalin@redhat.com> 3.9p1-6
|
|
|
b58e57 |
- build
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Sep 13 2004 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- disable ACSS support
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Sep 2 2004 Daniel Walsh <dwalsh@redhat.com> 3.9p1-5
|
|
|
b58e57 |
- Change selinux patch to use get_default_context_with_role in libselinux.
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Sep 2 2004 Daniel Walsh <dwalsh@redhat.com> 3.9p1-4
|
|
|
b58e57 |
- Fix patch
|
|
|
b58e57 |
* Bad debug statement.
|
|
|
b58e57 |
* Handle root/sysadm_r:kerberos
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Sep 2 2004 Daniel Walsh <dwalsh@redhat.com> 3.9p1-3
|
|
|
b58e57 |
- Modify Colin Walter's patch to allow specifying rule during connection
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Aug 31 2004 Daniel Walsh <dwalsh@redhat.com> 3.9p1-2
|
|
|
b58e57 |
- Fix TTY handling for SELinux
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Aug 24 2004 Daniel Walsh <dwalsh@redhat.com> 3.9p1-1
|
|
|
b58e57 |
- Update to upstream
|
|
|
b58e57 |
|
|
|
b58e57 |
* Sun Aug 1 2004 Alan Cox <alan@redhat.com> 3.8.1p1-5
|
|
|
b58e57 |
- Apply buildreq fixup patch (#125296)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Jun 15 2004 Daniel Walsh <dwalsh@redhat.com> 3.8.1p1-4
|
|
|
b58e57 |
- Clean up patch for upstream submission.
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Jun 15 2004 Elliot Lee <sopwith@redhat.com>
|
|
|
b58e57 |
- rebuilt
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Jun 9 2004 Daniel Walsh <dwalsh@redhat.com> 3.8.1p1-2
|
|
|
b58e57 |
- Remove use of pam_selinux and patch selinux in directly.
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Jun 7 2004 Nalin Dahyabhai <nalin@redhat.com> 3.8.1p1-1
|
|
|
b58e57 |
- request gssapi-with-mic by default but not delegation (flag day for anyone
|
|
|
b58e57 |
who used previous gssapi patches)
|
|
|
b58e57 |
- no longer request x11 forwarding by default
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Jun 3 2004 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-36
|
|
|
b58e57 |
- Change pam file to use open and close with pam_selinux
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Jun 1 2004 Nalin Dahyabhai <nalin@redhat.com> 3.8.1p1-0
|
|
|
b58e57 |
- update to 3.8.1p1
|
|
|
b58e57 |
- add workaround from CVS to reintroduce passwordauth using pam
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Jun 1 2004 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-35
|
|
|
b58e57 |
- Remove CLOSEXEC on STDERR
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Mar 16 2004 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-34
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Mar 03 2004 Phil Knirsch <pknirsch@redhat.com> 3.6.1p2-33.30.1
|
|
|
b58e57 |
- Built RHLE3 U2 update package.
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Mar 3 2004 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-33
|
|
|
b58e57 |
- Close file descriptors on exec
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Mar 1 2004 Thomas Woerner <twoerner@redhat.com> 3.6.1p2-32
|
|
|
b58e57 |
- fixed pie build
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Feb 26 2004 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-31
|
|
|
b58e57 |
- Add restorecon to startup scripts
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Feb 26 2004 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-30
|
|
|
b58e57 |
- Add multiple qualified to openssh
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Feb 23 2004 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-29
|
|
|
b58e57 |
- Eliminate selinux code and use pam_selinux
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Feb 13 2004 Elliot Lee <sopwith@redhat.com>
|
|
|
b58e57 |
- rebuilt
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Jan 26 2004 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-27
|
|
|
b58e57 |
- turn off pie on ppc
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Jan 26 2004 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-26
|
|
|
b58e57 |
- fix is_selinux_enabled
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Jan 14 2004 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-25
|
|
|
b58e57 |
- Rebuild to grab shared libselinux
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Dec 3 2003 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-24
|
|
|
b58e57 |
- turn on selinux
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Nov 18 2003 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- un#ifdef out code for reporting password expiration in non-privsep
|
|
|
b58e57 |
mode (#83585)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Nov 10 2003 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- add machinery to build with/without -fpie/-pie, default to doing so
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Nov 06 2003 David Woodhouse <dwmw2@redhat.com> 3.6.1p2-23
|
|
|
b58e57 |
- Don't whinge about getsockopt failing (#109161)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Oct 24 2003 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- add missing buildprereq on zlib-devel (#104558)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Oct 13 2003 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-22
|
|
|
b58e57 |
- turn selinux off
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Oct 13 2003 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-21.sel
|
|
|
b58e57 |
- turn selinux on
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Sep 19 2003 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-21
|
|
|
b58e57 |
- turn selinux off
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Sep 19 2003 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-20.sel
|
|
|
b58e57 |
- turn selinux on
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Sep 19 2003 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- additional fix for apparently-never-happens double-free in buffer_free()
|
|
|
b58e57 |
- extend fix for #103998 to cover SSH1
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Sep 17 2003 Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-19
|
|
|
b58e57 |
- rebuild
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Sep 17 2003 Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-18
|
|
|
b58e57 |
- additional buffer manipulation cleanups from Solar Designer
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Sep 17 2003 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-17
|
|
|
b58e57 |
- turn selinux off
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Sep 17 2003 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-16.sel
|
|
|
b58e57 |
- turn selinux on
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Sep 16 2003 Bill Nottingham <notting@redhat.com> 3.6.1p2-15
|
|
|
b58e57 |
- rebuild
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Sep 16 2003 Bill Nottingham <notting@redhat.com> 3.6.1p2-14
|
|
|
b58e57 |
- additional buffer manipulation fixes (CAN-2003-0695)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Sep 16 2003 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-13.sel
|
|
|
b58e57 |
- turn selinux on
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Sep 16 2003 Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-12
|
|
|
b58e57 |
- rebuild
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Sep 16 2003 Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-11
|
|
|
b58e57 |
- apply patch to store the correct buffer size in allocated buffers
|
|
|
b58e57 |
(CAN-2003-0693)
|
|
|
b58e57 |
- skip the initial PAM authentication attempt with an empty password if
|
|
|
b58e57 |
empty passwords are not permitted in our configuration (#103998)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Sep 5 2003 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-10
|
|
|
b58e57 |
- turn selinux off
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Sep 5 2003 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-9.sel
|
|
|
b58e57 |
- turn selinux on
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Aug 26 2003 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-8
|
|
|
b58e57 |
- Add BuildPreReq gtk2-devel if gtk2
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Aug 12 2003 Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-7
|
|
|
b58e57 |
- rebuild
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Aug 12 2003 Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-6
|
|
|
b58e57 |
- modify patch which clears the supplemental group list at startup to only
|
|
|
b58e57 |
complain if setgroups() fails if sshd has euid == 0
|
|
|
b58e57 |
- handle krb5 installed in %%{_prefix} or elsewhere by using krb5-config
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Jul 28 2003 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-5
|
|
|
b58e57 |
- Add SELinux patch
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Jul 22 2003 Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-4
|
|
|
b58e57 |
- rebuild
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Jul 16 2003 Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-3
|
|
|
b58e57 |
- rebuild
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Jul 16 2003 Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-2
|
|
|
b58e57 |
- rebuild
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Jun 5 2003 Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-1
|
|
|
b58e57 |
- update to 3.6.1p2
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Jun 04 2003 Elliot Lee <sopwith@redhat.com>
|
|
|
b58e57 |
6 rebuilt
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Mar 24 2003 Florian La Roche <Florian.LaRoche@redhat.de>
|
|
|
b58e57 |
- add patch for getsockopt() call to work on bigendian 64bit archs
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Feb 14 2003 Nalin Dahyabhai <nalin@redhat.com> 3.5p1-6
|
|
|
b58e57 |
- move scp to the -clients subpackage, because it directly depends on ssh
|
|
|
b58e57 |
which is also in -clients (#84329)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Feb 10 2003 Nalin Dahyabhai <nalin@redhat.com> 3.5p1-5
|
|
|
b58e57 |
- rebuild
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Jan 22 2003 Tim Powers <timp@redhat.com>
|
|
|
b58e57 |
- rebuilt
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Jan 7 2003 Nalin Dahyabhai <nalin@redhat.com> 3.5p1-3
|
|
|
b58e57 |
- rebuild
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Nov 12 2002 Nalin Dahyabhai <nalin@redhat.com> 3.5p1-2
|
|
|
b58e57 |
- patch PAM configuration to use relative path names for the modules, allowing
|
|
|
b58e57 |
us to not worry about which arch the modules are built for on multilib systems
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Oct 15 2002 Nalin Dahyabhai <nalin@redhat.com> 3.5p1-1
|
|
|
b58e57 |
- update to 3.5p1, merging in filelist/perm changes from the upstream spec
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Oct 4 2002 Nalin Dahyabhai <nalin@redhat.com> 3.4p1-3
|
|
|
b58e57 |
- merge
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Sep 12 2002 Than Ngo <than@redhat.com> 3.4p1-2.1
|
|
|
b58e57 |
- fix to build on multilib systems
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Aug 29 2002 Curtis Zinzilieta <curtisz@redhat.com> 3.4p1-2gss
|
|
|
b58e57 |
- added gssapi patches and uncommented patch here
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Aug 14 2002 Nalin Dahyabhai <nalin@redhat.com> 3.4p1-2
|
|
|
b58e57 |
- pull patch from CVS to fix too-early free in ssh-keysign (#70009)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Jun 27 2002 Nalin Dahyabhai <nalin@redhat.com> 3.4p1-1
|
|
|
b58e57 |
- 3.4p1
|
|
|
b58e57 |
- drop anon mmap patch
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Jun 25 2002 Nalin Dahyabhai <nalin@redhat.com> 3.3p1-2
|
|
|
b58e57 |
- rework the close-on-exit docs
|
|
|
b58e57 |
- include configuration file man pages
|
|
|
b58e57 |
- make use of nologin as the privsep shell optional
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Jun 24 2002 Nalin Dahyabhai <nalin@redhat.com> 3.3p1-1
|
|
|
b58e57 |
- update to 3.3p1
|
|
|
b58e57 |
- merge in spec file changes from upstream (remove setuid from ssh, ssh-keysign)
|
|
|
b58e57 |
- disable gtk2 askpass
|
|
|
b58e57 |
- require pam-devel by filename rather than by package for erratum
|
|
|
b58e57 |
- include patch from Solar Designer to work around anonymous mmap failures
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Jun 21 2002 Tim Powers <timp@redhat.com>
|
|
|
b58e57 |
- automated rebuild
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Jun 7 2002 Nalin Dahyabhai <nalin@redhat.com> 3.2.3p1-3
|
|
|
b58e57 |
- don't require autoconf any more
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri May 31 2002 Nalin Dahyabhai <nalin@redhat.com> 3.2.3p1-2
|
|
|
b58e57 |
- build gnome-ssh-askpass with gtk2
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue May 28 2002 Nalin Dahyabhai <nalin@redhat.com> 3.2.3p1-1
|
|
|
b58e57 |
- update to 3.2.3p1
|
|
|
b58e57 |
- merge in spec file changes from upstream
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri May 17 2002 Nalin Dahyabhai <nalin@redhat.com> 3.2.2p1-1
|
|
|
b58e57 |
- update to 3.2.2p1
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri May 17 2002 Nalin Dahyabhai <nalin@redhat.com> 3.1p1-4
|
|
|
b58e57 |
- drop buildreq on db1-devel
|
|
|
b58e57 |
- require pam-devel by package name
|
|
|
b58e57 |
- require autoconf instead of autoconf253 again
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Apr 2 2002 Nalin Dahyabhai <nalin@redhat.com> 3.1p1-3
|
|
|
b58e57 |
- pull patch from CVS to avoid printing error messages when some of the
|
|
|
b58e57 |
default keys aren't available when running ssh-add
|
|
|
b58e57 |
- refresh to current revisions of Simon's patches
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Mar 21 2002 Nalin Dahyabhai <nalin@redhat.com> 3.1p1-2gss
|
|
|
b58e57 |
- reintroduce Simon's gssapi patches
|
|
|
b58e57 |
- add buildprereq for autoconf253, which is needed to regenerate configure
|
|
|
b58e57 |
after applying the gssapi patches
|
|
|
b58e57 |
- refresh to the latest version of Markus's patch to build properly with
|
|
|
b58e57 |
older versions of OpenSSL
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Mar 7 2002 Nalin Dahyabhai <nalin@redhat.com> 3.1p1-2
|
|
|
b58e57 |
- bump and grind (through the build system)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Mar 7 2002 Nalin Dahyabhai <nalin@redhat.com> 3.1p1-1
|
|
|
b58e57 |
- require sharutils for building (mindrot #137)
|
|
|
b58e57 |
- require db1-devel only when building for 6.x (#55105), which probably won't
|
|
|
b58e57 |
work anyway (3.1 requires OpenSSL 0.9.6 to build), but what the heck
|
|
|
b58e57 |
- require pam-devel by file (not by package name) again
|
|
|
b58e57 |
- add Markus's patch to compile with OpenSSL 0.9.5a (from
|
|
|
b58e57 |
http://bugzilla.mindrot.org/show_bug.cgi?id=141) and apply it if we're
|
|
|
b58e57 |
building for 6.x
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Mar 7 2002 Nalin Dahyabhai <nalin@redhat.com> 3.1p1-0
|
|
|
b58e57 |
- update to 3.1p1
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Mar 5 2002 Nalin Dahyabhai <nalin@redhat.com> SNAP-20020305
|
|
|
b58e57 |
- update to SNAP-20020305
|
|
|
b58e57 |
- drop debug patch, fixed upstream
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Feb 20 2002 Nalin Dahyabhai <nalin@redhat.com> SNAP-20020220
|
|
|
b58e57 |
- update to SNAP-20020220 for testing purposes (you've been warned, if there's
|
|
|
b58e57 |
anything to be warned about, gss patches won't apply, I don't mind)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Feb 13 2002 Nalin Dahyabhai <nalin@redhat.com> 3.0.2p1-3
|
|
|
b58e57 |
- add patches from Simon Wilkinson and Nicolas Williams for GSSAPI key
|
|
|
b58e57 |
exchange, authentication, and named key support
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Jan 23 2002 Nalin Dahyabhai <nalin@redhat.com> 3.0.2p1-2
|
|
|
b58e57 |
- remove dependency on db1-devel, which has just been swallowed up whole
|
|
|
b58e57 |
by gnome-libs-devel
|
|
|
b58e57 |
|
|
|
b58e57 |
* Sat Dec 29 2001 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- adjust build dependencies so that build6x actually works right (fix
|
|
|
b58e57 |
from Hugo van der Kooij)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Dec 4 2001 Nalin Dahyabhai <nalin@redhat.com> 3.0.2p1-1
|
|
|
b58e57 |
- update to 3.0.2p1
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Nov 16 2001 Nalin Dahyabhai <nalin@redhat.com> 3.0.1p1-1
|
|
|
b58e57 |
- update to 3.0.1p1
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Nov 13 2001 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- update to current CVS (not for use in distribution)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Nov 8 2001 Nalin Dahyabhai <nalin@redhat.com> 3.0p1-1
|
|
|
b58e57 |
- merge some of Damien Miller <djm@mindrot.org> changes from the upstream
|
|
|
b58e57 |
3.0p1 spec file and init script
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Nov 7 2001 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- update to 3.0p1
|
|
|
b58e57 |
- update to x11-ssh-askpass 1.2.4.1
|
|
|
b58e57 |
- change build dependency on a file from pam-devel to the pam-devel package
|
|
|
b58e57 |
- replace primes with moduli
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Sep 27 2001 Nalin Dahyabhai <nalin@redhat.com> 2.9p2-9
|
|
|
b58e57 |
- incorporate fix from Markus Friedl's advisory for IP-based authorization bugs
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Sep 13 2001 Bernhard Rosenkraenzer <bero@redhat.com> 2.9p2-8
|
|
|
b58e57 |
- Merge changes to rescue build from current sysadmin survival cd
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Sep 6 2001 Nalin Dahyabhai <nalin@redhat.com> 2.9p2-7
|
|
|
b58e57 |
- fix scp's server's reporting of file sizes, and build with the proper
|
|
|
b58e57 |
preprocessor define to get large-file capable open(), stat(), etc.
|
|
|
b58e57 |
(sftp has been doing this correctly all along) (#51827)
|
|
|
b58e57 |
- configure without --with-ipv4-default on RHL 7.x and newer (#45987,#52247)
|
|
|
b58e57 |
- pull cvs patch to fix support for /etc/nologin for non-PAM logins (#47298)
|
|
|
b58e57 |
- mark profile.d scriptlets as config files (#42337)
|
|
|
b58e57 |
- refer to Jason Stone's mail for zsh workaround for exit-hanging quasi-bug
|
|
|
b58e57 |
- change a couple of log() statements to debug() statements (#50751)
|
|
|
b58e57 |
- pull cvs patch to add -t flag to sshd (#28611)
|
|
|
b58e57 |
- clear fd_sets correctly (one bit per FD, not one byte per FD) (#43221)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Aug 20 2001 Nalin Dahyabhai <nalin@redhat.com> 2.9p2-6
|
|
|
b58e57 |
- add db1-devel as a BuildPrerequisite (noted by Hans Ecke)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Aug 16 2001 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- pull cvs patch to fix remote port forwarding with protocol 2
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Aug 9 2001 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- pull cvs patch to add session initialization to no-pty sessions
|
|
|
b58e57 |
- pull cvs patch to not cut off challengeresponse auth needlessly
|
|
|
b58e57 |
- refuse to do X11 forwarding if xauth isn't there, handy if you enable
|
|
|
b58e57 |
it by default on a system that doesn't have X installed (#49263)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Aug 8 2001 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- don't apply patches to code we don't intend to build (spotted by Matt Galgoci)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Aug 6 2001 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- pass OPTIONS correctly to initlog (#50151)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Jul 25 2001 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- switch to x11-ssh-askpass 1.2.2
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Jul 11 2001 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- rebuild in new environment
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Jun 25 2001 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- disable the gssapi patch
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Jun 18 2001 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- update to 2.9p2
|
|
|
b58e57 |
- refresh to a new version of the gssapi patch
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Jun 7 2001 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- change Copyright: BSD to License: BSD
|
|
|
b58e57 |
- add Markus Friedl's unverified patch for the cookie file deletion problem
|
|
|
b58e57 |
so that we can verify it
|
|
|
b58e57 |
- drop patch to check if xauth is present (was folded into cookie patch)
|
|
|
b58e57 |
- don't apply gssapi patches for the errata candidate
|
|
|
b58e57 |
- clear supplemental groups list at startup
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri May 25 2001 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- fix an error parsing the new default sshd_config
|
|
|
b58e57 |
- add a fix from Markus Friedl (via openssh-unix-dev) for ssh-keygen not
|
|
|
b58e57 |
dealing with comments right
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu May 24 2001 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- add in Simon Wilkinson's GSSAPI patch to give it some testing in-house,
|
|
|
b58e57 |
to be removed before the next beta cycle because it's a big departure
|
|
|
b58e57 |
from the upstream version
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu May 3 2001 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- finish marking strings in the init script for translation
|
|
|
b58e57 |
- modify init script to source /etc/sysconfig/sshd and pass $OPTIONS to sshd
|
|
|
b58e57 |
at startup (change merged from openssh.com init script, originally by
|
|
|
b58e57 |
Pekka Savola)
|
|
|
b58e57 |
- refuse to do X11 forwarding if xauth isn't there, handy if you enable
|
|
|
b58e57 |
it by default on a system that doesn't have X installed
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed May 2 2001 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- update to 2.9
|
|
|
b58e57 |
- drop various patches that came from or went upstream or to or from CVS
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Apr 18 2001 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- only require initscripts 5.00 on 6.2 (reported by Peter Bieringer)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Sun Apr 8 2001 Preston Brown <pbrown@redhat.com>
|
|
|
b58e57 |
- remove explicit openssl requirement, fixes builddistro issue
|
|
|
b58e57 |
- make initscript stop() function wait until sshd really dead to avoid
|
|
|
b58e57 |
races in condrestart
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Apr 2 2001 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- mention that challengereponse supports PAM, so disabling password doesn't
|
|
|
b58e57 |
limit users to pubkey and rsa auth (#34378)
|
|
|
b58e57 |
- bypass the daemon() function in the init script and call initlog directly,
|
|
|
b58e57 |
because daemon() won't start a daemon it detects is already running (like
|
|
|
b58e57 |
open connections)
|
|
|
b58e57 |
- require the version of openssl we had when we were built
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Mar 23 2001 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- make do_pam_setcred() smart enough to know when to establish creds and
|
|
|
b58e57 |
when to reinitialize them
|
|
|
b58e57 |
- add in a couple of other fixes from Damien for inclusion in the errata
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Mar 22 2001 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- update to 2.5.2p2
|
|
|
b58e57 |
- call setcred() again after initgroups, because the "creds" could actually
|
|
|
b58e57 |
be group memberships
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Mar 20 2001 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- update to 2.5.2p1 (includes endianness fixes in the rijndael implementation)
|
|
|
b58e57 |
- don't enable challenge-response by default until we find a way to not
|
|
|
b58e57 |
have too many userauth requests (we may make up to six pubkey and up to
|
|
|
b58e57 |
three password attempts as it is)
|
|
|
b58e57 |
- remove build dependency on rsh to match openssh.com's packages more closely
|
|
|
b58e57 |
|
|
|
b58e57 |
* Sat Mar 3 2001 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- remove dependency on openssl -- would need to be too precise
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Mar 2 2001 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- rebuild in new environment
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Feb 26 2001 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- Revert the patch to move pam_open_session.
|
|
|
b58e57 |
- Init script and spec file changes from Pekka Savola. (#28750)
|
|
|
b58e57 |
- Patch sftp to recognize '-o protocol' arguments. (#29540)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Feb 22 2001 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- Chuck the closing patch.
|
|
|
b58e57 |
- Add a trigger to add host keys for protocol 2 to the config file, now that
|
|
|
b58e57 |
configuration file syntax requires us to specify it with HostKey if we
|
|
|
b58e57 |
specify any other HostKey values, which we do.
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Feb 20 2001 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- Redo patch to move pam_open_session after the server setuid()s to the user.
|
|
|
b58e57 |
- Rework the nopam patch to use be picked up by autoconf.
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Feb 19 2001 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- Update for 2.5.1p1.
|
|
|
b58e57 |
- Add init script mods from Pekka Savola.
|
|
|
b58e57 |
- Tweak the init script to match the CVS contrib script more closely.
|
|
|
b58e57 |
- Redo patch to ssh-add to try to adding both identity and id_dsa to also try
|
|
|
b58e57 |
adding id_rsa.
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Feb 16 2001 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- Update for 2.5.0p1.
|
|
|
b58e57 |
- Use $RPM_OPT_FLAGS instead of -O when building gnome-ssh-askpass
|
|
|
b58e57 |
- Resync with parts of Damien Miller's openssh.spec from CVS, including
|
|
|
b58e57 |
update of x11 askpass to 1.2.0.
|
|
|
b58e57 |
- Only require openssl (don't prereq) because we generate keys in the init
|
|
|
b58e57 |
script now.
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Feb 13 2001 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- Don't open a PAM session until we've forked and become the user (#25690).
|
|
|
b58e57 |
- Apply Andrew Bartlett's patch for letting pam_authenticate() know which
|
|
|
b58e57 |
host the user is attempting a login from.
|
|
|
b58e57 |
- Resync with parts of Damien Miller's openssh.spec from CVS.
|
|
|
b58e57 |
- Don't expose KbdInt responses in debug messages (from CVS).
|
|
|
b58e57 |
- Detect and handle errors in rsa_{public,private}_decrypt (from CVS).
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Feb 7 2001 Trond Eivind Glomsrxd <teg@redhat.com>
|
|
|
b58e57 |
- i18n-tweak to initscript.
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Jan 23 2001 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- More gettextizing.
|
|
|
b58e57 |
- Close all files after going into daemon mode (needs more testing).
|
|
|
b58e57 |
- Extract patch from CVS to handle auth banners (in the client).
|
|
|
b58e57 |
- Extract patch from CVS to handle compat weirdness.
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Jan 19 2001 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- Finish with the gettextizing.
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Jan 18 2001 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- Fix a bug in auth2-pam.c (#23877)
|
|
|
b58e57 |
- Gettextize the init script.
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Dec 20 2000 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- Incorporate a switch for using PAM configs for 6.x, just in case.
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Dec 5 2000 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- Incorporate Bero's changes for a build specifically for rescue CDs.
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Nov 29 2000 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- Don't treat pam_setcred() failure as fatal unless pam_authenticate() has
|
|
|
b58e57 |
succeeded, to allow public-key authentication after a failure with "none"
|
|
|
b58e57 |
authentication. (#21268)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Nov 28 2000 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- Update to x11-askpass 1.1.1. (#21301)
|
|
|
b58e57 |
- Don't second-guess fixpaths, which causes paths to get fixed twice. (#21290)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Nov 27 2000 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- Merge multiple PAM text messages into subsequent prompts when possible when
|
|
|
b58e57 |
doing keyboard-interactive authentication.
|
|
|
b58e57 |
|
|
|
b58e57 |
* Sun Nov 26 2000 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- Disable the built-in MD5 password support. We're using PAM.
|
|
|
b58e57 |
- Take a crack at doing keyboard-interactive authentication with PAM, and
|
|
|
b58e57 |
enable use of it in the default client configuration so that the client
|
|
|
b58e57 |
will try it when the server disallows password authentication.
|
|
|
b58e57 |
- Build with debugging flags. Build root policies strip all binaries anyway.
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Nov 21 2000 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- Use DESTDIR instead of %%makeinstall.
|
|
|
b58e57 |
- Remove /usr/X11R6/bin from the path-fixing patch.
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Nov 20 2000 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- Add the primes file from the latest snapshot to the main package (#20884).
|
|
|
b58e57 |
- Add the dev package to the prereq list (#19984).
|
|
|
b58e57 |
- Remove the default path and mimic login's behavior in the server itself.
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Nov 17 2000 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- Resync with conditional options in Damien Miller's .spec file for an errata.
|
|
|
b58e57 |
- Change libexecdir from %%{_libexecdir}/ssh to %%{_libexecdir}/openssh.
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Nov 7 2000 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- Update to OpenSSH 2.3.0p1.
|
|
|
b58e57 |
- Update to x11-askpass 1.1.0.
|
|
|
b58e57 |
- Enable keyboard-interactive authentication.
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Oct 30 2000 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- Update to ssh-askpass-x11 1.0.3.
|
|
|
b58e57 |
- Change authentication related messages to be private (#19966).
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Oct 10 2000 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- Patch ssh-keygen to be able to list signatures for DSA public key files
|
|
|
b58e57 |
it generates.
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Oct 5 2000 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- Add BuildPreReq on /usr/include/security/pam_appl.h to be sure we always
|
|
|
b58e57 |
build PAM authentication in.
|
|
|
b58e57 |
- Try setting SSH_ASKPASS if gnome-ssh-askpass is installed.
|
|
|
b58e57 |
- Clean out no-longer-used patches.
|
|
|
b58e57 |
- Patch ssh-add to try to add both identity and id_dsa, and to error only
|
|
|
b58e57 |
when neither exists.
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Oct 2 2000 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- Update x11-askpass to 1.0.2. (#17835)
|
|
|
b58e57 |
- Add BuildPreReqs for /bin/login and /usr/bin/rsh so that configure will
|
|
|
b58e57 |
always find them in the right place. (#17909)
|
|
|
b58e57 |
- Set the default path to be the same as the one supplied by /bin/login, but
|
|
|
b58e57 |
add /usr/X11R6/bin. (#17909)
|
|
|
b58e57 |
- Try to handle obsoletion of ssh-server more cleanly. Package names
|
|
|
b58e57 |
are different, but init script name isn't. (#17865)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Sep 6 2000 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- Update to 2.2.0p1. (#17835)
|
|
|
b58e57 |
- Tweak the init script to allow proper restarting. (#18023)
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Aug 23 2000 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- Update to 20000823 snapshot.
|
|
|
b58e57 |
- Change subpackage requirements from %%{version} to %%{version}-%%{release}
|
|
|
b58e57 |
- Back out the pipe patch.
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Jul 17 2000 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- Update to 2.1.1p4, which includes fixes for config file parsing problems.
|
|
|
b58e57 |
- Move the init script back.
|
|
|
b58e57 |
- Add Damien's quick fix for wackiness.
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Jul 12 2000 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- Update to 2.1.1p3, which includes fixes for X11 forwarding and strtok().
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Jul 6 2000 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- Move condrestart to server postun.
|
|
|
b58e57 |
- Move key generation to init script.
|
|
|
b58e57 |
- Actually use the right patch for moving the key generation to the init script.
|
|
|
b58e57 |
- Clean up the init script a bit.
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Jul 5 2000 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- Fix X11 forwarding, from mail post by Chan Shih-Ping Richard.
|
|
|
b58e57 |
|
|
|
b58e57 |
* Sun Jul 2 2000 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- Update to 2.1.1p2.
|
|
|
b58e57 |
- Use of strtok() considered harmful.
|
|
|
b58e57 |
|
|
|
b58e57 |
* Sat Jul 1 2000 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- Get the build root out of the man pages.
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Jun 29 2000 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- Add and use condrestart support in the init script.
|
|
|
b58e57 |
- Add newer initscripts as a prereq.
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Jun 27 2000 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- Build in new environment (release 2)
|
|
|
b58e57 |
- Move -clients subpackage to Applications/Internet group
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Jun 9 2000 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- Update to 2.2.1p1
|
|
|
b58e57 |
|
|
|
b58e57 |
* Sat Jun 3 2000 Nalin Dahyabhai <nalin@redhat.com>
|
|
|
b58e57 |
- Patch to build with neither RSA nor RSAref.
|
|
|
b58e57 |
- Miscellaneous FHS-compliance tweaks.
|
|
|
b58e57 |
- Fix for possibly-compressed man pages.
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Mar 15 2000 Damien Miller <djm@ibs.com.au>
|
|
|
b58e57 |
- Updated for new location
|
|
|
b58e57 |
- Updated for new gnome-ssh-askpass build
|
|
|
b58e57 |
|
|
|
b58e57 |
* Sun Dec 26 1999 Damien Miller <djm@mindrot.org>
|
|
|
b58e57 |
- Added Jim Knoble's <jmknoble@pobox.com> askpass
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Nov 15 1999 Damien Miller <djm@mindrot.org>
|
|
|
b58e57 |
- Split subpackages further based on patch from jim knoble <jmknoble@pobox.com>
|
|
|
b58e57 |
|
|
|
b58e57 |
* Sat Nov 13 1999 Damien Miller <djm@mindrot.org>
|
|
|
b58e57 |
- Added 'Obsoletes' directives
|
|
|
b58e57 |
|
|
|
b58e57 |
* Tue Nov 09 1999 Damien Miller <djm@ibs.com.au>
|
|
|
b58e57 |
- Use make install
|
|
|
b58e57 |
- Subpackages
|
|
|
b58e57 |
|
|
|
b58e57 |
* Mon Nov 08 1999 Damien Miller <djm@ibs.com.au>
|
|
|
b58e57 |
- Added links for slogin
|
|
|
b58e57 |
- Fixed perms on manpages
|
|
|
b58e57 |
|
|
|
b58e57 |
* Sat Oct 30 1999 Damien Miller <djm@ibs.com.au>
|
|
|
b58e57 |
- Renamed init script
|
|
|
b58e57 |
|
|
|
b58e57 |
* Fri Oct 29 1999 Damien Miller <djm@ibs.com.au>
|
|
|
b58e57 |
- Back to old binary names
|
|
|
b58e57 |
|
|
|
b58e57 |
* Thu Oct 28 1999 Damien Miller <djm@ibs.com.au>
|
|
|
b58e57 |
- Use autoconf
|
|
|
b58e57 |
- New binary names
|
|
|
b58e57 |
|
|
|
b58e57 |
* Wed Oct 27 1999 Damien Miller <djm@ibs.com.au>
|
|
|
b58e57 |
- Initial RPMification, based on Jan "Yenya" Kasprzak's <kas@fi.muni.cz> spec.
|