summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* - djm@cvs.openbsd.org 2010/03/08 00:28:55V_5_4_P1V_5_4Damien Miller2010-03-080-0/+0
| | | | | | [ssh-keygen.1] document permit-agent-forwarding certificate constraint; patch from stevesk@
* - djm@cvs.openbsd.org 2010/03/08 00:28:55Damien Miller2010-03-082-2/+10
| | | | | | [ssh-keygen.1] document permit-agent-forwarding certificate constraint; patch from stevesk@
* - (djm) Release OpenSSH-5.4p1Damien Miller2010-03-081-1/+1
|
* - (djm) [README contrib/caldera/openssh.spec contrib/redhat/openssh.spec]Damien Miller2010-03-084-6/+9
| | | | crank version numbers
* - djm@cvs.openbsd.org 2010/03/07 22:16:01Damien Miller2010-03-082-5/+9
| | | | | | [ssh-keygen.c] make internal strptime string match strftime format; suggested by vinschen AT redhat.com and markus@
* - (djm) OpenBSD CVS SyncDamien Miller2010-03-082-2/+8
| | | | | | - djm@cvs.openbsd.org 2010/03/07 22:01:32 [version.h] openssh-5.4
* - dtucker@cvs.openbsd.org 2010/03/07 11:57:13Darren Tucker2010-03-077-52/+16
| | | | | | | [auth-rhosts.c monitor.c monitor_wrap.c session.c auth-options.c sshd.c] Hold authentication debug messages until after successful authentication. Fixes an info leak of environment variables specified in authorized_keys, reported by Jacob Appelbaum. ok djm@
* - (dtucker) [session.c] Also initialize creds to NULL for handing toDarren Tucker2010-03-072-1/+3
| | | | setpcred.
* - (dtucker) [session.c] Bug #1567: move setpcred call to before chroot andDarren Tucker2010-03-072-4/+21
| | | | | do not set real uid, since that's needed for the chroot, and will be set by permanently_set_uid.
* - (dtucker) [auth.c] Bug #1710: call setauthdb on AIX before getpwuid so thatDarren Tucker2010-03-072-0/+13
| | | | | it gets the passwd struct from the LAM that knows about the user which is not necessarily the default. Patch from Alexandre Letourneau.
* - djm@cvs.openbsd.org 2010/03/05 10:28:21Damien Miller2010-03-054-5/+27
| | | | | | [ssh-add.1 ssh.1 ssh_config.5] mention loading of certificate files from [private]-cert.pub when they are present; feedback and ok jmc@
* - jmc@cvs.openbsd.org 2010/03/05 08:31:20Damien Miller2010-03-052-3/+18
| | | | | [ssh.1] document certificate authentication; help/ok djm
* - jmc@cvs.openbsd.org 2010/03/05 06:50:35Damien Miller2010-03-053-6/+8
| | | | | [ssh.1 sshd.8] tweak previous;
* - (djm) [configure.ac] set -fno-strict-aliasing for gcc4; ok dtucker@Damien Miller2010-03-052-3/+4
|
* - djm@cvs.openbsd.org 2010/03/05 02:58:11Damien Miller2010-03-052-2/+6
| | | | | [auth.c] make the warning for a revoked key louder and more noticable
* - (djm) [ssh-rand-helper.c] declare optind, avoiding compilation failureDamien Miller2010-03-052-0/+3
| | | | on some platforms
* - djm@cvs.openbsd.org 2010/03/04 23:27:25Damien Miller2010-03-053-4/+8
| | | | | | [auth-options.c ssh-keygen.c] "force-command" is not spelled "forced-command"; spotted by imorgan AT nas.nasa.gov
* - djm@cvs.openbsd.org 2010/03/04 23:19:29Damien Miller2010-03-053-41/+48
| | | | | | [ssh.1 sshd.8] move section on CA and revoked keys from ssh.1 to sshd.8's known hosts format section and rework it a bit; requested by jmc@
* - djm@cvs.openbsd.org 2010/03/04 23:17:25Damien Miller2010-03-052-2/+5
| | | | | [sshd_config.5] missing word; spotted by jmc@
* - jmc@cvs.openbsd.org 2010/03/04 22:52:40Damien Miller2010-03-052-4/+4
| | | | | [ssh-keygen.1] fix Bk/Ek;
* - (tim) [ssh-pkcs11.c] Fix "non-constant initializer" errors in olderTim Rice2010-03-042-3/+14
| | | | compilers. OK djm@
* - djm@cvs.openbsd.org 2010/03/04 20:35:08Damien Miller2010-03-053-14/+114
| | | | | [ssh-keygen.1 ssh-keygen.c] Add a -L flag to print the contents of a certificate; ok markus@
* - jmc@cvs.openbsd.org 2010/03/04 12:51:25Damien Miller2010-03-053-7/+13
| | | | | [ssh.1 sshd_config.5] tweak previous;
* - djm@cvs.openbsd.org 2010/03/04 10:38:23Damien Miller2010-03-043-45/+183
| | | | | [regress/cert-hostkey.sh regress/cert-userkey.sh] additional regression tests for revoked keys and TrustedUserCAKeys
* - djm@cvs.openbsd.org 2010/03/03 00:47:23Damien Miller2010-03-043-3/+48
| | | | | | [regress/cert-hostkey.sh regress/cert-userkey.sh] add an extra test to ensure that authentication with the wrong certificate fails as it should (and it does)
* - djm@cvs.openbsd.org 2010/03/04 10:36:03Damien Miller2010-03-0417-40/+343
| | | | | | | | | | | | | | | [auth-rh-rsa.c auth-rsa.c auth.c auth.h auth2-hostbased.c auth2-pubkey.c] [authfile.c authfile.h hostfile.c hostfile.h servconf.c servconf.h] [ssh-keygen.c ssh.1 sshconnect.c sshd_config.5] Add a TrustedUserCAKeys option to sshd_config to specify CA keys that are trusted to authenticate users (in addition than doing it per-user in authorized_keys). Add a RevokedKeys option to sshd_config and a @revoked marker to known_hosts to allow keys to me revoked and banned for user or host authentication. feedback and ok markus@
* - djm@cvs.openbsd.org 2010/03/04 01:44:57Damien Miller2010-03-042-3/+7
| | | | | | [key.c] use buffer_get_string_ptr_ret() where we are checking the return value explicitly instead of the fatal()-causing buffer_get_string_ptr()
* - djm@cvs.openbsd.org 2010/03/03 22:50:40Damien Miller2010-03-042-2/+5
| | | | | [PROTOCOL.certkeys] s/similar same/similar/; from imorgan AT nas.nasa.gov
* - djm@cvs.openbsd.org 2010/03/03 22:49:50Damien Miller2010-03-042-3/+7
| | | | | | [sshd.8] the authorized_keys option for CA keys is "cert-authority", not "from=cert-authority". spotted by imorgan AT nas.nasa.gov
* - OpenBSD CVS SyncDamien Miller2010-03-043-21/+48
| | | | | | | - djm@cvs.openbsd.org 2010/03/03 01:44:36 [auth-options.c key.c] reject strings with embedded ASCII nul chars in certificate key IDs, principal names and constraints
* - (djm) [regress/Makefile] Cleanup sshd_proxy_origDamien Miller2010-03-042-1/+2
|
* - (djm) [.cvsignore] Ignore ssh-pkcs11-helperDamien Miller2010-03-042-0/+2
|
* - (djm) [contrib/redhat/openssh.spec] Replace obsolete BuildPreReqDamien Miller2010-03-042-1/+4
| | | | | on XFree86-devel with neutral /usr/include/X11/Xlib.h; imorgan AT nas.nasa.gov in bz#1731
* - (djm) [ssh-keygen.c] Use correct local variable, instead ofDamien Miller2010-03-042-1/+5
| | | | maybe-undefined global "optarg"
* - (djm) [regress/cert-userkey.sh] s/echo -n/echon/ here tooDamien Miller2010-03-032-1/+2
|
* - djm@cvs.openbsd.org 2010/03/02 23:20:57Damien Miller2010-03-031-4/+20
| | | | | | [ssh-keygen.c] POSIX strptime is stricter than OpenBSD's so do a little dance to appease it.
* - djm@cvs.openbsd.org 2010/03/02 23:20:57Damien Miller2010-03-031-0/+4
| | | | | | [ssh-keygen.c] POSIX strptime is stricter than OpenBSD's so do a little dance to appease it.
* - otto@cvs.openbsd.org 2010/03/01 11:07:06Damien Miller2010-03-032-3/+5
| | | | | [ssh-add.c] zap what seems to be a left-over debug message; ok markus@
* - jmc@cvs.openbsd.org 2010/02/26 22:09:28Damien Miller2010-03-034-21/+27
| | | | | [ssh-keygen.1 ssh.1 sshd.8] tweak previous;
* - (djm) [PROTOCOL.certkeys] Add RCS IdentDamien Miller2010-03-032-0/+5
|
* - (tim) [config.guess config.sub] Bug 1722: Update to latest versions fromTim Rice2010-03-013-151/+173
| | | | | http://git.savannah.gnu.org/gitweb/ (2009-12-30 and 2010-01-22 respectively).
* - (dtucker) [openbsd-compat/port-linux.c] Make failure to write to the OOMDarren Tucker2010-03-012-4/+7
| | | | | adjust log at verbose only, since according to cjwatson in bug #1470 some virtualization platforms don't allow writes.
* - (dtucker) [regress/{cert-hostkey,cfgmatch,cipher-speed}.sh} ReplaceDarren Tucker2010-03-014-7/+11
| | | | "echo -n" with "echon" for portability.
* - (tim) [ssh-pkcs11-helper.c] Move declarations before calling functionsTim Rice2010-02-282-3/+5
| | | | to make older compilers (gcc 2.95) happy.
* - (djm) [auth.c] On Cygwin, refuse usernames that have differences inDamien Miller2010-03-012-0/+20
| | | | | | | case from that matched in the system password database. On this platform, passwords are stored case-insensitively, but sshd requires exact case matching for Match blocks in sshd_config(5). Based on a patch from vinschen AT redhat.com.
* - (djm) [openbsd-compat/bsd-cygwin_util.c] Reduce the set of environmentDamien Miller2010-02-282-10/+3
| | | | variables copied into sshd child processes. From vinschen AT redhat.com
* - (djm) [ssh-pkcs11-helper.c ] Ensure RNG is initialised and seededDamien Miller2010-02-282-0/+5
|
* - djm@cvs.openbsd.org 2010/02/26 20:33:21Damien Miller2010-02-274-2/+219
| | | | | [Makefile regress/cert-hostkey.sh regress/cert-userkey.sh] regression tests for certified keys
* - OpenBSD CVS SyncDamien Miller2010-02-2738-188/+2164
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - djm@cvs.openbsd.org 2010/02/26 20:29:54 [PROTOCOL PROTOCOL.agent PROTOCOL.certkeys addrmatch.c auth-options.c] [auth-options.h auth.h auth2-pubkey.c authfd.c dns.c dns.h hostfile.c] [hostfile.h kex.h kexdhs.c kexgexs.c key.c key.h match.h monitor.c] [myproposal.h servconf.c servconf.h ssh-add.c ssh-agent.c ssh-dss.c] [ssh-keygen.1 ssh-keygen.c ssh-rsa.c ssh.1 ssh.c ssh2.h sshconnect.c] [sshconnect2.c sshd.8 sshd.c sshd_config.5] Add support for certificate key types for users and hosts. OpenSSH certificate key types are not X.509 certificates, but a much simpler format that encodes a public key, identity information and some validity constraints and signs it with a CA key. CA keys are regular SSH keys. This certificate style avoids the attack surface of X.509 certificates and is very easy to deploy. Certified host keys allow automatic acceptance of new host keys when a CA certificate is marked as sh/known_hosts. see VERIFYING HOST KEYS in ssh(1) for details. Certified user keys allow authentication of users when the signing CA key is marked as trusted in authorized_keys. See "AUTHORIZED_KEYS FILE FORMAT" in sshd(8) for details. Certificates are minted using ssh-keygen(1), documentation is in the "CERTIFICATES" section of that manpage. Documentation on the format of certificates is in the file PROTOCOL.certkeys feedback and ok markus@
* contrib/caldera/openssh.specDamien Miller2010-02-244-1/+9
| | | | | contrib/redhat/openssh.spec contrib/suse/openssh.spec
View Lorry Controller Status