summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* - jmc@cvs.openbsd.org 2013/01/04 19:26:38djm2013-01-093-5/+11
| | | | | | | [sftp-server.8 sftp-server.c] sftp-server.8: add argument name to -d sftp-server.c: add -d to usage() ok djm
* - djm@cvs.openbsd.org 2013/01/03 23:22:58djm2013-01-092-6/+25
| | | | | | [ssh-keygen.c] allow fingerprinting of keys hosted in PKCS#11 tokens: ssh-keygen -lD ... ok markus@
* - djm@cvs.openbsd.org 2013/01/03 12:54:49djm2013-01-093-7/+36
| | | | | | [sftp-server.8 sftp-server.c] allow specification of an alternate start directory for sftp-server(8) "I like this" markus@
* - djm@cvs.openbsd.org 2013/01/03 12:49:01djm2013-01-092-3/+7
| | | | | [PROTOCOL] fix description of MAC calculation for EtM modes; ok markus@
* - djm@cvs.openbsd.org 2013/01/03 05:49:36djm2013-01-092-1/+8
| | | | | | | [servconf.h] add a couple of ServerOptions members that should be copied to the privsep child (for consistency, in this case they happen only to be accessed in the monitor); ok dtucker@
* - djm@cvs.openbsd.org 2013/01/02 00:33:49djm2013-01-092-2/+6
| | | | | | [PROTOCOL.agent] correct format description for SSH_AGENTC_ADD_RSA_ID_CONSTRAINED bz#2051 from david AT lechnology.com
* - djm@cvs.openbsd.org 2013/01/02 00:32:07djm2013-01-093-6/+10
| | | | | | [clientloop.c mux.c] channel_setup_local_fwd_listener() returns 0 on failure, not -ve bz#2055 reported by mathieu.lacage AT gmail.com
* - dtucker@cvs.openbsd.org 2012/12/14 05:26:43djm2013-01-092-3/+8
| | | | | [auth.c] use correct string in error message; from rustybsd at gmx.fr
* - (dtucker) [Makefile.in] Add some scaffolding so that the new regressdtucker2012-12-172-1/+8
| | | | tests will work with VPATH directories.
* - (djm) [cipher.c] Fix missing prototype for compat codedjm2012-12-122-0/+2
|
* - (djm) [configure.ac cipher-ctr.c] Adapt EVP AES CTR change to retain ourdjm2012-12-124-9/+47
| | | | compat code for older OpenSSL
* - markus@cvs.openbsd.org 2012/12/12 16:45:52djm2012-12-122-1/+10
| | | | | | | [packet.c] reset incoming_packet buffer for each new packet in EtM-case, too; this happens if packets are parsed only parially (e.g. ignore messages sent when su/sudo turn off echo); noted by sthen/millert
* - (djm) [regress/Makefile] fix t-exec ruledjm2012-12-122-4/+7
|
* - (djm) [regress/integrity.sh] Fix awk quoting, packet length skipdjm2012-12-122-3/+6
|
* - (djm) [regress/Makefile regress/integrity.sh] Make the integrity.sh testdjm2012-12-122-5/+10
| | | | work on platforms without 'jot'
* - (djm) [mac.c] fix merge botchdjm2012-12-122-0/+2
|
* - markus@cvs.openbsd.org 2012/12/11 23:12:13djm2012-12-112-2/+6
| | | | | [try-ciphers.sh] add hmac-ripemd160-etm@openssh.com
* - markus@cvs.openbsd.org 2012/12/11 22:42:11djm2012-12-114-3/+191
| | | | | [regress/Makefile regress/modpipe.c regress/integrity.sh] test the integrity of the packets; with djm@
* - markus@cvs.openbsd.org 2012/12/11 22:32:56djm2012-12-112-3/+10
| | | | | [regress/try-ciphers.sh] add etm modes
* - sthen@cvs.openbsd.org 2012/12/11 22:51:45djm2012-12-112-2/+5
| | | | | [mac.c] fix typo, s/tem/etm in hmac-ripemd160-tem. ok markus@
* - markus@cvs.openbsd.org 2012/12/11 22:31:18djm2012-12-1111-66/+196
| | | | | | | | | | [PROTOCOL authfile.c cipher.c cipher.h kex.h mac.c myproposal.h] [packet.c ssh_config.5 sshd_config.5] add encrypt-then-mac (EtM) modes to openssh by defining new mac algorithms that change the packet format and compute the MAC over the encrypted message (including the packet size) instead of the plaintext data; these EtM modes are considered more secure and used by default. feedback and ok djm@
* - markus@cvs.openbsd.org 2012/12/11 22:16:21djm2012-12-112-5/+12
| | | | | | [monitor.c] drain the log messages after receiving the keystate from the unpriv child. otherwise it might block while sending. ok djm@
* - dtucker@cvs.openbsd.org 2012/12/07 01:51:35dtucker2012-12-072-3/+7
| | | | | | [serverloop.c] Cast signal to int for logging. A no-op on openbsd (they're always ints) but will prevent warnings in portable. ok djm@
* - markus@cvs.openbsd.org 2012/12/05 15:42:52dtucker2012-12-072-1/+5
| | | | | [ssh-add.c] prevent double-free of comment; ok djm@
* - jmc@cvs.openbsd.org 2012/12/03 08:33:03dtucker2012-12-073-6/+10
| | | | | [ssh-add.1 sshd_config.5] tweak previous;
* - dtucker@cvs.openbsd.org 2012/12/06 06:06:54dtucker2012-12-072-5/+23
| | | | | | | | | | | [regress/keys-command.sh] Fix some problems with the keys-command test: - use string comparison rather than numeric comparison - check for existing KEY_COMMAND file and don't clobber if it exists - clean up KEY_COMMAND file if we do create it. - check that KEY_COMMAND is executable (which it won't be if eg /var/run is mounted noexec). ok djm.
* 20121205tim2012-12-042-1/+8
| | | | - (tim) [defines.h] Some platforms are missing ULLONG_MAX. Feedback djm@.
* - (djm) [configure.ac] Revert previous. configure.ac already does thisdjm2012-12-032-3/+4
| | | | for us.
* - (djm) [configure.ac] Turn on -g for gcc compilers. Helps pre-installationdjm2012-12-032-2/+5
| | | | debugging. ok dtucker@
* - djm@cvs.openbsd.org 2012/12/03 00:14:06djm2012-12-033-4/+8
| | | | | [auth2-chall.c ssh-keygen.c] Fix compilation with -Wall -Werror (trivial type fixes)
* - djm@cvs.openbsd.org 2012/12/02 20:47:48djm2012-12-023-3/+177
| | | | | [Makefile regress/forward-control.sh] regress for AllowTcpForwarding local/remote; ok markus@
* - djm@cvs.openbsd.org 2012/11/22 22:49:30djm2012-12-023-2/+39
| | | | | [regress/Makefile regress/keys-command.sh] regress for AuthorizedKeysCommand; hints from markus@
* - djm@cvs.openbsd.org 2012/10/19 05:10:42djm2012-12-022-4/+6
| | | | | [regress/cert-userkey.sh] include a serial number when generating certs
* - dtucker@cvs.openbsd.org 2012/10/05 02:20:48djm2012-12-023-4/+9
| | | | | [regress/cipher-speed.sh regress/try-ciphers.sh] Add umac-128@openssh.com to the list of MACs to be tested
* - dtucker@cvs.openbsd.org 2012/10/05 02:05:30djm2012-12-022-3/+6
| | | | | [regress/multiplex.sh] Use 'kill -0' to test for the presence of a pid since it's more portable
* - djm@cvs.openbsd.org 2012/12/02 20:34:10djm2012-12-0210-87/+123
| | | | | | | | | | | | | | | | [auth.c auth.h auth1.c auth2-chall.c auth2-gss.c auth2-jpake.c auth2.c] [monitor.c monitor.h] Fixes logging of partial authentication when privsep is enabled Previously, we recorded "Failed xxx" since we reset authenticated before calling auth_log() in auth2.c. This adds an explcit "Partial" state. Add a "submethod" to auth_log() to report which submethod is used for keyboard-interactive. Fix multiple authentication when one of the methods is keyboard-interactive. ok markus@
* - djm@cvs.openbsd.org 2012/12/02 20:46:11djm2012-12-028-26/+68
| | | | | | | | [auth-options.c channels.c servconf.c servconf.h serverloop.c session.c] [sshd_config.5] make AllowTcpForwarding accept "local" and "remote" in addition to its current "yes"/"no" to allow the server to specify whether just local or remote TCP forwarding is enabled. ok markus@
* - djm@cvs.openbsd.org 2012/12/02 20:42:15djm2012-12-023-14/+43
| | | | | | | [ssh-add.1 ssh-add.c] make deleting explicit keys "ssh-add -d" symmetric with adding keys - try to delete the corresponding certificate too and respect the -k option to allow deleting of the key only; feedback and ok markus@
* - djm@cvs.openbsd.org 2012/12/02 20:26:11djm2012-12-023-5/+36
| | | | | | | [ssh_config.5 sshconnect2.c] Make IdentitiesOnly apply to keys obtained from a PKCS11Provider. This allows control of which keys are offered from tokens using IdentityFile. ok markus@
* - (djm) [openbsd-compat/sys-queue.h] Sync with OpenBSD to getdjm2012-12-022-6/+51
| | | | TAILQ_FOREACH_SAFE needed for upcoming changes.
* - djm@cvs.openbsd.org 2012/11/14 02:32:15djm2012-11-142-6/+10
| | | | | [ssh-keygen.c] allow the full range of unsigned serial numbers; 'fine' deraadt@
* - djm@cvs.openbsd.org 2012/11/14 02:24:27djm2012-11-142-14/+27
| | | | | | | | [auth2-pubkey.c] fix username passed to helper program prepare stdio fds before closefrom() spotted by landry@
* - jmc@cvs.openbsd.org 2012/09/26 17:34:38djm2012-11-062-3/+12
| | | | | | [moduli.5] last stage of rfc changes, using consistent Rs/Re blocks, and moving the references into a STANDARDS section;
* - eric@cvs.openbsd.org 2011/11/28 08:46:27djm2012-11-062-3/+10
| | | | | | [moduli.5] fix formula ok djm@
* - (dtucker) [auth2-pubkey.c] wrap paths.h in an ifdef for platforms thatdtucker2012-11-052-1/+5
| | | | don't have it. Spotted by tim@.
* - (dtucker) [uidswap.c openbsd-compat/Makefile.indtucker2012-11-056-37/+134
| | | | | | | openbsd-compat/bsd-setres_id.c openbsd-compat/bsd-setres_id.h openbsd-compat/openbsd-compat.h] Move the fallback code for setting uids and gids from uidswap.c to the compat library, which allows it to work with the new setresuid calls in auth2-pubkey. with tim@, ok djm@
* - djm@cvs.openbsd.org 2012/11/04 11:09:15djm2012-11-049-28/+328
| | | | | | | | | | [auth.h auth1.c auth2.c monitor.c servconf.c servconf.h sshd.c] [sshd_config.5] Support multiple required authentication via an AuthenticationMethods option. This option lists one or more comma-separated lists of authentication method names. Successful completion of all the methods in any list is required for authentication to complete; feedback and ok markus@
* - djm@cvs.openbsd.org 2012/11/04 10:38:43djm2012-11-044-17/+31
| | | | | | [auth2-pubkey.c sshd.c sshd_config.5] Remove default of AuthorizedCommandUser. Administrators are now expected to explicitly specify a user. feedback and ok markus@
* - OpenBSD CVS Syncdjm2012-11-042-6/+14
| | | | | | - jmc@cvs.openbsd.org 2012/10/31 08:04:50 [sshd_config.5] tweak previous;
* - djm@cvs.openbsd.org 2012/10/30 21:29:55djm2012-10-3010-43/+308
| | | | | | | | | | | | [auth-rsa.c auth.c auth.h auth2-pubkey.c servconf.c servconf.h] [sshd.c sshd_config sshd_config.5] new sshd_config option AuthorizedKeysCommand to support fetching authorized_keys from a command in addition to (or instead of) from the filesystem. The command is run as the target server user unless another specified via a new AuthorizedKeysCommandUser option. patch originally by jchadima AT redhat.com, reworked by me; feedback and ok markus@
View Lorry Controller Status