kentpeacock / rpms / openssh

Forked from rpms/openssh 2 years ago
Clone
f09e2e
# Do we want SELinux & Audit
f09e2e
%if 0%{?!noselinux:1}
f09e2e
%define WITH_SELINUX 1
f09e2e
%else
f09e2e
%define WITH_SELINUX 0
f09e2e
%endif
f09e2e
f09e2e
# OpenSSH privilege separation requires a user & group ID
f09e2e
%define sshd_uid    74
f09e2e
%define sshd_gid    74
f09e2e
f09e2e
# Do we want to disable building of gnome-askpass? (1=yes 0=no)
f09e2e
%define no_gnome_askpass 0
f09e2e
f09e2e
# Do we want to link against a static libcrypto? (1=yes 0=no)
f09e2e
%define static_libcrypto 0
f09e2e
f09e2e
# Use GTK2 instead of GNOME in gnome-ssh-askpass
f09e2e
%define gtk2 1
f09e2e
f09e2e
# Build position-independent executables (requires toolchain support)?
f09e2e
%define pie 1
f09e2e
f09e2e
# Do we want kerberos5 support (1=yes 0=no)
f09e2e
%define kerberos5 1
f09e2e
f09e2e
# Do we want libedit support
f09e2e
%define libedit 1
f09e2e
f09e2e
# Do we want LDAP support
f09e2e
%define ldap 1
f09e2e
f09e2e
# Whether to build pam_ssh_agent_auth
f09e2e
%if 0%{?!nopam:1}
f09e2e
%define pam_ssh_agent 1
f09e2e
%else
f09e2e
%define pam_ssh_agent 0
f09e2e
%endif
f09e2e
f09e2e
# Reserve options to override askpass settings with:
f09e2e
# rpm -ba|--rebuild --define 'skip_xxx 1'
f09e2e
%{?skip_gnome_askpass:%global no_gnome_askpass 1}
f09e2e
f09e2e
# Add option to build without GTK2 for older platforms with only GTK+.
f09e2e
# Red Hat Linux <= 7.2 and Red Hat Advanced Server 2.1 are examples.
f09e2e
# rpm -ba|--rebuild --define 'no_gtk2 1'
f09e2e
%{?no_gtk2:%global gtk2 0}
f09e2e
f09e2e
# Options for static OpenSSL link:
f09e2e
# rpm -ba|--rebuild --define "static_openssl 1"
f09e2e
%{?static_openssl:%global static_libcrypto 1}
f09e2e
f09e2e
# Is this a build for the rescue CD (without PAM, with MD5)? (1=yes 0=no)
f09e2e
%define rescue 0
f09e2e
%{?build_rescue:%global rescue 1}
f09e2e
%{?build_rescue:%global rescue_rel rescue}
f09e2e
f09e2e
# Turn off some stuff for resuce builds
f09e2e
%if %{rescue}
f09e2e
%define kerberos5 0
f09e2e
%define libedit 0
f09e2e
%define pam_ssh_agent 0
f09e2e
%endif
f09e2e
f09e2e
# Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1
1d31ef
%define openssh_ver 7.4p1
810d56
%define openssh_rel 21
1d31ef
%define pam_ssh_agent_ver 0.10.3
9a9eba
%define pam_ssh_agent_rel 2
f09e2e
f09e2e
Summary: An open source implementation of SSH protocol versions 1 and 2
f09e2e
Name: openssh
f09e2e
Version: %{openssh_ver}
f09e2e
Release: %{openssh_rel}%{?dist}%{?rescue_rel}
f09e2e
URL: http://www.openssh.com/portable.html
f09e2e
#URL1: http://pamsshagentauth.sourceforge.net
1d31ef
Source0: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz
f09e2e
#Source1: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz.asc
f09e2e
Source2: sshd.pam
f09e2e
Source3: sshd.init
f09e2e
Source4: http://prdownloads.sourceforge.net/pamsshagentauth/pam_ssh_agent_auth/pam_ssh_agent_auth-%{pam_ssh_agent_ver}.tar.bz2
f09e2e
Source5: pam_ssh_agent-rmheaders
f09e2e
Source6: ssh-keycat.pam
f09e2e
Source7: sshd.sysconfig
f09e2e
Source9: sshd@.service
f09e2e
Source10: sshd.socket
f09e2e
Source11: sshd.service
f09e2e
Source12: sshd-keygen.service
f09e2e
Source13: sshd-keygen
f09e2e
f09e2e
# Internal debug
f09e2e
Patch0: openssh-5.9p1-wIm.patch
f09e2e
f09e2e
#?
1d31ef
Patch100: openssh-7.4p1-coverity.patch
f09e2e
#https://bugzilla.mindrot.org/show_bug.cgi?id=1889
f09e2e
Patch103: openssh-5.8p1-packet.patch
f09e2e
f09e2e
#https://bugzilla.mindrot.org/show_bug.cgi?id=1402
017ff1
# https://bugzilla.redhat.com/show_bug.cgi?id=1171248
017ff1
# record pfs= field in CRYPTO_SESSION audit event
1d31ef
Patch200: openssh-7.4p1-audit.patch
f8987c
# Do not write to one socket from more processes (#1310684)
f8987c
Patch202: openssh-6.6p1-audit-race-condition.patch
f09e2e
f09e2e
# --- pam_ssh-agent ---
f09e2e
# make it build reusing the openssh sources
1d31ef
Patch300: pam_ssh_agent_auth-0.10.3-build.patch
f09e2e
# check return value of seteuid()
1d31ef
Patch301: pam_ssh_agent_auth-0.10.3-seteuid.patch
f09e2e
# explicitly make pam callbacks visible
f09e2e
Patch302: pam_ssh_agent_auth-0.9.2-visibility.patch
f09e2e
# don't use xfree (#1024965)
1d31ef
Patch303: pam_ssh_agent_auth-0.10.3-no-xfree.patch
1d31ef
# update to current version of agent structure
1d31ef
Patch304: pam_ssh_agent_auth-0.10.3-agent_structure.patch
1d31ef
# do not directly dereference return value of getpwuid()
1d31ef
Patch305: pam_ssh_agent_auth-0.10.3-dereference.patch
1d31ef
# Use hardcoded date -- getting it from file is broken on i386
1d31ef
Patch306: pam_ssh_agent_auth-0.10.3-man-date.patch
f8987c
f09e2e
#https://bugzilla.mindrot.org/show_bug.cgi?id=1641 (WONTFIX)
1d31ef
Patch400: openssh-7.4p1-role-mls.patch
f09e2e
#https://bugzilla.redhat.com/show_bug.cgi?id=781634
017ff1
Patch404: openssh-6.6p1-privsep-selinux.patch
f09e2e
f09e2e
#?-- unwanted child :(
017ff1
Patch501: openssh-6.6p1-ldap.patch
f09e2e
#?
017ff1
Patch502: openssh-6.6p1-keycat.patch
f09e2e
f09e2e
#http6://bugzilla.mindrot.org/show_bug.cgi?id=1644
017ff1
Patch601: openssh-6.6p1-allow-ip-opts.patch
f09e2e
#https://bugzilla.mindrot.org/show_bug.cgi?id=1893
017ff1
Patch604: openssh-6.6p1-keyperm.patch
f09e2e
#https://bugzilla.mindrot.org/show_bug.cgi?id=1925
f09e2e
Patch606: openssh-5.9p1-ipv6man.patch
f09e2e
#?
f09e2e
Patch607: openssh-5.8p2-sigpipe.patch
f09e2e
#https://bugzilla.mindrot.org/show_bug.cgi?id=1789
f09e2e
Patch609: openssh-5.5p1-x11.patch
f09e2e
f09e2e
#?
1d31ef
Patch700: openssh-7.4p1-fips.patch
f09e2e
#?
017ff1
# drop? Patch701: openssh-5.6p1-exit-deadlock.patch
f09e2e
#?
f09e2e
Patch702: openssh-5.1p1-askpass-progress.patch
f09e2e
#?
f09e2e
Patch703: openssh-4.3p2-askpass-grab-info.patch
017ff1
# https://bugzilla.redhat.com/show_bug.cgi?id=205842
017ff1
# drop? Patch704: openssh-5.9p1-edns.patch
f09e2e
#?
017ff1
Patch706: openssh-6.6.1p1-localdomain.patch
f09e2e
#https://bugzilla.mindrot.org/show_bug.cgi?id=1635 (WONTFIX)
017ff1
Patch707: openssh-6.6p1-redhat.patch
f09e2e
#https://bugzilla.mindrot.org/show_bug.cgi?id=1890 (WONTFIX) need integration to prng helper which is discontinued :)
017ff1
Patch708: openssh-6.6p1-entropy.patch
f09e2e
#https://bugzilla.mindrot.org/show_bug.cgi?id=1640 (WONTFIX)
f09e2e
Patch709: openssh-6.2p1-vendor.patch
f09e2e
# warn users for unsupported UsePAM=no (#757545)
017ff1
Patch711: openssh-6.6p1-log-usepam-no.patch
f09e2e
# make aes-ctr ciphers use EVP engines such as AES-NI from OpenSSL
f09e2e
Patch712: openssh-6.3p1-ctr-evp-fast.patch
f09e2e
# add cavs test binary for the aes-ctr
1d31ef
Patch713: openssh-7.4p1-ctr-cavstest.patch
1d31ef
# add SSH KDF CAVS test driver
1d31ef
Patch714: openssh-7.4p1-kdf-cavs.patch
f09e2e
f09e2e
f09e2e
#http://www.sxw.org.uk/computing/patches/openssh.html
f09e2e
#changed cache storage type - #848228
1d31ef
Patch800: openssh-7.4p1-gsskex.patch
f09e2e
#http://www.mail-archive.com/kerberos@mit.edu/msg17591.html
017ff1
Patch801: openssh-6.6p1-force_krb.patch
017ff1
# add new option GSSAPIEnablek5users and disable using ~/.k5users by default (#1169843)
017ff1
# CVE-2014-9278
017ff1
Patch802: openssh-6.6p1-GSSAPIEnablek5users.patch
f8987c
# Respect k5login_directory option in krk5.conf (#1328243)
f8987c
Patch803: openssh-6.6p1-k5login_directory.patch
f09e2e
Patch900: openssh-6.1p1-gssapi-canohost.patch
f09e2e
#https://bugzilla.mindrot.org/show_bug.cgi?id=1780
1d31ef
Patch901: openssh-7.4p1-kuserok.patch
f09e2e
# use default_ccache_name from /etc/krb5.conf (#991186)
f09e2e
Patch902: openssh-6.3p1-krb5-use-default_ccache_name.patch
fc6407
# Change GSSAPIStrictAcceptor to yes as it ever was (#1488982)
fc6407
Patch903: openssh-7.4p1-gss-strict-acceptor.patch
fc6407
770374
# Run ssh-copy-id in the legacy mode when SSH_COPY_ID_LEGACY variable is set (#969375
1d31ef
Patch905: openssh-7.4p1-legacy-ssh-copy-id.patch
770374
# Use tty allocation for a remote scp (#985650)
770374
Patch906: openssh-6.4p1-fromto-remote.patch
017ff1
# log when a client requests an interactive session and only sftp is allowed (#1130198)
017ff1
Patch914: openssh-6.6.1p1-log-sftp-only-connections.patch
017ff1
# log via monitor in chroots without /dev/log (#1083482)
1d31ef
Patch918: openssh-7.4p1-log-in-chroot.patch
11c3be
# MLS labeling according to chosen sensitivity (#1202843)
11c3be
Patch919: openssh-6.6.1p1-mls-fix-labeling.patch
674526
# sshd test mode show all config values (#1187597)
674526
Patch920: openssh-6.6p1-test-mode-all-values.patch
674526
# Add sftp option to force mode of created files (#1191055)
674526
Patch921: openssh-6.6p1-sftp-force-permission.patch
674526
# fix memory problem (#1223218)
674526
Patch924: openssh-6.6p1-memory-problems.patch
674526
# Enhance AllowGroups documentation in man page (#1150007)
674526
Patch925: openssh-6.6p1-allowGroups-documentation.patch
674526
# provide option GssKexAlgorithms to disable vulnerable groun1 kex
1d31ef
Patch928: openssh-7.4p1-gssKexAlgorithms.patch
f8987c
# make s390 use /dev/ crypto devices -- ignore closefrom (#1318760)
f8987c
Patch935: openssh-6.6p1-s390-closefrom.patch
f8987c
# expose more information to PAM (#1312304)
1d31ef
Patch938: openssh-7.4p1-expose-pam.patch
f8987c
# Move MAX_DISPLAYS to a configuration option (#1341302)
f8987c
Patch939: openssh-6.6p1-x11-max-displays.patch
22c9eb
# Add systemd stuff so it can track running service (#1381997)
22c9eb
Patch942: openssh-6.6p1-systemd.patch
1d31ef
# Permit root login to preserve backward compatibility
1d31ef
Patch943: openssh-7.4p1-permit-root-login.patch
1d31ef
# Restore TCP wrappers support
1d31ef
Patch944: openssh-7.4p1-debian-restore-tcp-wrappers.patch
1d31ef
# Set sane whitelist for PKCS#11 modules in ssh-agent
1d31ef
Patch945: openssh-7.4p1-pkcs11-whitelist.patch
1d31ef
# Allow legacy algorithms and formats for key exchange after rebase
1d31ef
Patch946: openssh-7.4p1-legacy-algorithms.patch
1d31ef
# Show more fingerprints
1d31ef
Patch947: openssh-7.4p1-show-more-fingerprints.patch
1d31ef
# Fix newline in the end of server ident banner (upstream 5b9070)
1d31ef
Patch948: openssh-7.4p1-newline-banner.patch
1d31ef
# Do not utilize SHA1 by default for digital signatures (#1322911)
1d31ef
Patch949: openssh-7.4p1-sha2-signatures.patch
1d31ef
# Canonize pkcs11 provider path when removing smartcard (#2682)
1d31ef
Patch950: openssh-7.4p1-canonize-pkcs11-provider.patch
1d31ef
# Do not segfault sshd if it loads RSA1 keys (#2686)
1d31ef
Patch951: openssh-7.4p1-rsa1-segfault.patch
1d31ef
# OpenSSH 7.5 fixes CBC cipher weakness
1d31ef
Patch952: openssh-7.4p1-cbc-weakness.patch
1d31ef
# sandbox-seccomp filter is not denying socketcall() on ppc64le (#1443916)
1d31ef
Patch953: openssh-7.4p1-sandbox-ppc64le.patch
1d31ef
# ControlPath too long should not be fatal (#1447561)
1d31ef
Patch954: openssh-7.4p1-ControlPath_too_long.patch
1d31ef
# sandbox-seccomp for ibmca engine from upstream (#1451809)
1d31ef
Patch955: openssh-7.4p1-sandbox-ibmca.patch
b7cc2d
# Back to UseDNS=yes by default (#1478175)
b7cc2d
Patch956: openssh-7.4p1-usedns-yes.patch
9a9eba
# Clatch between ClientAlive timeouts and rekeying (#1480510)
9a9eba
Patch957: openssh-7.4p1-rekeying-timeouts.patch
9a9eba
# WinSCP 5.10+ compatibility (#1496808)
9a9eba
Patch958: openssh-7.4p1-winscp-compat.patch
9a9eba
# SSH AuthorizedKeysCommand hangs when output is too large (#1496467)
9a9eba
Patch959: openssh-7.4p1-authorized_keys_command.patch
9a9eba
# Fix for CVE-2017-15906 (#1517226)
9a9eba
Patch960: openssh-7.5p1-sftp-empty-files.patch
810d56
# Fix for CVE-2018-15473 (#1619079)
810d56
Patch961: openssh-7.4p1-CVE-2018-15473.patch
810d56
# invalidate supplemental group cache used by temporarily_use_uid() (#1619079)
810d56
Patch962: openssh-7.4p1-uidswap.patch
f09e2e
f09e2e
License: BSD
f09e2e
Group: Applications/Internet
f09e2e
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
f09e2e
Requires: /sbin/nologin
f09e2e
f09e2e
%if ! %{no_gnome_askpass}
f09e2e
%if %{gtk2}
f09e2e
BuildRequires: gtk2-devel
f09e2e
BuildRequires: libX11-devel
f09e2e
%else
f09e2e
BuildRequires: gnome-libs-devel
f09e2e
%endif
f09e2e
%endif
f09e2e
f09e2e
%if %{ldap}
f09e2e
BuildRequires: openldap-devel
f09e2e
%endif
f09e2e
BuildRequires: autoconf, automake, perl, zlib-devel
f09e2e
BuildRequires: audit-libs-devel >= 2.0.5
f09e2e
BuildRequires: util-linux, groff
f09e2e
BuildRequires: pam-devel
f09e2e
BuildRequires: tcp_wrappers-devel
f09e2e
BuildRequires: fipscheck-devel >= 1.3.0
f09e2e
BuildRequires: openssl-devel >= 0.9.8j
f09e2e
BuildRequires: perl-podlators
22c9eb
BuildRequires: systemd-devel
f09e2e
f09e2e
%if %{kerberos5}
f09e2e
BuildRequires: krb5-devel
f09e2e
%endif
f09e2e
f09e2e
%if %{libedit}
f09e2e
BuildRequires: libedit-devel ncurses-devel
f09e2e
%endif
f09e2e
f09e2e
%if %{WITH_SELINUX}
f8987c
Conflicts: selinux-policy < 3.13.1-92
f09e2e
Requires: libselinux >= 1.27.7
f09e2e
BuildRequires: libselinux-devel >= 1.27.7
f09e2e
Requires: audit-libs >= 1.0.8
f09e2e
BuildRequires: audit-libs >= 1.0.8
f09e2e
%endif
f09e2e
f09e2e
BuildRequires: xauth
f09e2e
f09e2e
%package clients
f09e2e
Summary: An open source SSH client applications
f09e2e
Group: Applications/Internet
f09e2e
Requires: openssh = %{version}-%{release}
f09e2e
Requires: fipscheck-lib%{_isa} >= 1.3.0
f09e2e
f09e2e
%package server
f09e2e
Summary: An open source SSH server daemon
f09e2e
Group: System Environment/Daemons
f09e2e
Requires: openssh = %{version}-%{release}
f09e2e
Requires(pre): /usr/sbin/useradd
f09e2e
Requires: pam >= 1.0.1-3
f09e2e
Requires: fipscheck-lib%{_isa} >= 1.3.0
f09e2e
Requires(post): systemd-units
f09e2e
Requires(preun): systemd-units
f09e2e
Requires(postun): systemd-units
f09e2e
f09e2e
%package server-sysvinit
f09e2e
Summary: The SysV initscript to manage the OpenSSH server.
f09e2e
Group: System Environment/Daemons
f09e2e
Requires: %{name}-server%{?_isa} = %{version}-%{release}
f09e2e
f09e2e
%if %{ldap}
f09e2e
%package ldap
f09e2e
Summary: A LDAP support for open source SSH server daemon
f09e2e
Requires: openssh = %{version}-%{release}
f09e2e
Group: System Environment/Daemons
f09e2e
%endif
f09e2e
f09e2e
%package keycat
f09e2e
Summary: A mls keycat backend for openssh
f09e2e
Requires: openssh = %{version}-%{release}
f09e2e
Group: System Environment/Daemons
f09e2e
f09e2e
%package askpass
f09e2e
Summary: A passphrase dialog for OpenSSH and X
f09e2e
Group: Applications/Internet
f09e2e
Requires: openssh = %{version}-%{release}
f09e2e
Obsoletes: openssh-askpass-gnome
f09e2e
Provides: openssh-askpass-gnome
f09e2e
1d31ef
%package cavs
1d31ef
Summary: CAVS tests for FIPS validation
1d31ef
Group: Applications/Internet
1d31ef
Requires: openssh = %{version}-%{release}
1d31ef
f09e2e
%package -n pam_ssh_agent_auth
f09e2e
Summary: PAM module for authentication with ssh-agent
f09e2e
Group: System Environment/Base
f09e2e
Version: %{pam_ssh_agent_ver}
f09e2e
Release: %{pam_ssh_agent_rel}.%{openssh_rel}%{?dist}%{?rescue_rel}
f09e2e
License: BSD
f09e2e
f09e2e
%description
f09e2e
SSH (Secure SHell) is a program for logging into and executing
f09e2e
commands on a remote machine. SSH is intended to replace rlogin and
f09e2e
rsh, and to provide secure encrypted communications between two
f09e2e
untrusted hosts over an insecure network. X11 connections and
f09e2e
arbitrary TCP/IP ports can also be forwarded over the secure channel.
f09e2e
f09e2e
OpenSSH is OpenBSD's version of the last free version of SSH, bringing
f09e2e
it up to date in terms of security and features.
f09e2e
f09e2e
This package includes the core files necessary for both the OpenSSH
f09e2e
client and server. To make this package useful, you should also
f09e2e
install openssh-clients, openssh-server, or both.
f09e2e
f09e2e
%description clients
f09e2e
OpenSSH is a free version of SSH (Secure SHell), a program for logging
f09e2e
into and executing commands on a remote machine. This package includes
f09e2e
the clients necessary to make encrypted connections to SSH servers.
f09e2e
f09e2e
%description server
f09e2e
OpenSSH is a free version of SSH (Secure SHell), a program for logging
f09e2e
into and executing commands on a remote machine. This package contains
f09e2e
the secure shell daemon (sshd). The sshd daemon allows SSH clients to
f09e2e
securely connect to your SSH server.
f09e2e
f09e2e
%description server-sysvinit
f09e2e
OpenSSH is a free version of SSH (Secure SHell), a program for logging
f09e2e
into and executing commands on a remote machine. This package contains
f09e2e
the SysV init script to manage the OpenSSH server when running a legacy
f09e2e
SysV-compatible init system.
f09e2e
f09e2e
It is not required when the init system used is systemd.
f09e2e
f09e2e
%if %{ldap}
f09e2e
%description ldap
f09e2e
OpenSSH LDAP backend is a way how to distribute the authorized tokens
f09e2e
among the servers in the network.
f09e2e
%endif
f09e2e
f09e2e
%description keycat
f09e2e
OpenSSH mls keycat is backend for using the authorized keys in the
f09e2e
openssh in the mls mode.
f09e2e
f09e2e
%description askpass
f09e2e
OpenSSH is a free version of SSH (Secure SHell), a program for logging
f09e2e
into and executing commands on a remote machine. This package contains
f09e2e
an X11 passphrase dialog for OpenSSH.
f09e2e
1d31ef
%description cavs
1d31ef
This package contains test binaries and scripts to make FIPS validation
1d31ef
easier. Now contains CTR and KDF CAVS test driver.
1d31ef
f09e2e
%description -n pam_ssh_agent_auth
f09e2e
This package contains a PAM module which can be used to authenticate
f09e2e
users using ssh keys stored in a ssh-agent. Through the use of the
f09e2e
forwarding of ssh-agent connection it also allows to authenticate with
f09e2e
remote ssh-agent instance.
f09e2e
f09e2e
The module is most useful for su and sudo service stacks.
f09e2e
f09e2e
%prep
1d31ef
%setup -q -a 4
f09e2e
#Do not enable by default
f09e2e
%if 0
f09e2e
%patch0 -p1 -b .wIm
f09e2e
%endif
f09e2e
f09e2e
%patch103 -p1 -b .packet
f09e2e
f09e2e
%if %{pam_ssh_agent}
f09e2e
pushd pam_ssh_agent_auth-%{pam_ssh_agent_ver}
1d31ef
%patch300 -p2 -b .psaa-build
1d31ef
%patch301 -p2 -b .psaa-seteuid
f09e2e
%patch302 -p1 -b .psaa-visibility
1d31ef
%patch303 -p2 -b .psaa-xfree
1d31ef
%patch304 -p2 -b .psaa-agent
1d31ef
%patch305 -p2 -b .psaa-dereference
1d31ef
%patch306 -p2 -b .psaa-pod
f09e2e
# Remove duplicate headers
f09e2e
rm -f $(cat %{SOURCE5})
f09e2e
popd
f09e2e
%endif
f09e2e
f09e2e
%if %{WITH_SELINUX}
f09e2e
%patch400 -p1 -b .role-mls
f09e2e
%patch404 -p1 -b .privsep-selinux
f09e2e
%endif
f09e2e
f09e2e
%if %{ldap}
f09e2e
%patch501 -p1 -b .ldap
f09e2e
%endif
f09e2e
%patch502 -p1 -b .keycat
f09e2e
f09e2e
%patch601 -p1 -b .ip-opts
f09e2e
%patch604 -p1 -b .keyperm
f09e2e
%patch606 -p1 -b .ipv6man
f09e2e
%patch607 -p1 -b .sigpipe
f09e2e
%patch609 -p1 -b .x11
017ff1
# 
017ff1
# drop? %patch701 -p1 -b .exit-deadlock
f09e2e
%patch702 -p1 -b .progress
f09e2e
%patch703 -p1 -b .grab-info
017ff1
# investigate - https://bugzilla.redhat.com/show_bug.cgi?id=205842
017ff1
# probably not needed anymore %patch704 -p1 -b .edns
f09e2e
%patch706 -p1 -b .localdomain
f09e2e
%patch707 -p1 -b .redhat
f09e2e
%patch708 -p1 -b .entropy
f09e2e
%patch709 -p1 -b .vendor
f09e2e
%patch711 -p1 -b .log-usepam-no
f09e2e
%patch712 -p1 -b .evp-ctr
f09e2e
%patch713 -p1 -b .ctr-cavs
1d31ef
%patch714 -p1 -b .kdf-cavs
017ff1
# 
f09e2e
%patch800 -p1 -b .gsskex
f09e2e
%patch801 -p1 -b .force_krb
017ff1
# 
f09e2e
%patch900 -p1 -b .canohost
f09e2e
%patch901 -p1 -b .kuserok
f09e2e
%patch902 -p1 -b .ccache_name
fc6407
%patch903 -p1 -b .gss-strict
fc6407
770374
%patch905 -p1 -b .legacy-ssh-copy-id
770374
%patch906 -p1 -b .fromto-remote
017ff1
%patch914 -p1 -b .log-sftp-only
017ff1
%patch918 -p1 -b .log-in-chroot
11c3be
%patch919 -p1 -b .mls-labels
017ff1
%patch802 -p1 -b .GSSAPIEnablek5users
f8987c
%patch803 -p1 -b .k5login
674526
%patch920 -p1 -b .sshd-t
674526
%patch921 -p1 -b .sftp-force-mode
674526
%patch924 -p1 -b .memory-problems
674526
%patch925 -p1 -b .allowGroups
674526
%patch928 -p1 -b .gsskexalg
f8987c
%patch935 -p1 -b .s390
1d31ef
%patch938 -p1 -b .expose-pam
f8987c
%patch939 -p1 -b .x11max
22c9eb
%patch942 -p1 -b .patch
1d31ef
%patch943 -p1 -b .permit-root
1d31ef
%patch944 -p1 -b .tcp_wrappers
1d31ef
%patch945 -p1 -b .pkcs11-whitelist
1d31ef
%patch946 -p1 -b .legacy
1d31ef
%patch947 -p1 -b .fingerprint
1d31ef
%patch948 -p1 -b .newline-banner
1d31ef
%patch949 -p1 -b .sha2
1d31ef
%patch950 -p1 -b .smartcard
1d31ef
%patch951 -p1 -b .rsa1
1d31ef
%patch952 -p1 -b .cbc
1d31ef
%patch953 -p1 -b .seccomp
1d31ef
%patch954 -p1 -b .ControlPath
1d31ef
%patch955 -p1 -b .ibmca
b7cc2d
%patch956 -p1 -b .usedns
9a9eba
%patch957 -p1 -b .rekey-timeout
9a9eba
%patch958 -p1 -b .winscp
9a9eba
%patch959 -p1 -b .large-command
9a9eba
%patch960 -p1 -b .sftp-empty
810d56
%patch961 -p1 -b .CVE-2018-15473
810d56
%patch962 -p1 -b .uidswap
017ff1
017ff1
%patch200 -p1 -b .audit
f8987c
%patch202 -p1 -b .audit-race
017ff1
%patch700 -p1 -b .fips
017ff1
017ff1
%patch100 -p1 -b .coverity
f09e2e
f09e2e
%if 0
f09e2e
# Nothing here yet
f09e2e
%endif
f09e2e
f09e2e
autoreconf
f09e2e
pushd pam_ssh_agent_auth-%{pam_ssh_agent_ver}
f09e2e
autoreconf
f09e2e
popd
f09e2e
f09e2e
%build
f09e2e
# the -fvisibility=hidden is needed for clean build of the pam_ssh_agent_auth
f09e2e
# and it makes the ssh build more clean and even optimized better
f09e2e
CFLAGS="$RPM_OPT_FLAGS -fvisibility=hidden"; export CFLAGS
f09e2e
%if %{rescue}
f09e2e
CFLAGS="$CFLAGS -Os"
f09e2e
%endif
f09e2e
%if %{pie}
f09e2e
%ifarch s390 s390x sparc sparcv9 sparc64
f09e2e
CFLAGS="$CFLAGS -fPIC"
f09e2e
%else
f09e2e
CFLAGS="$CFLAGS -fpic"
f09e2e
%endif
f09e2e
SAVE_LDFLAGS="$LDFLAGS"
f09e2e
LDFLAGS="$LDFLAGS -pie -z relro -z now"
f09e2e
f09e2e
export CFLAGS
f09e2e
export LDFLAGS
f09e2e
f09e2e
%endif
f09e2e
%if %{kerberos5}
f09e2e
if test -r /etc/profile.d/krb5-devel.sh ; then
f09e2e
        source /etc/profile.d/krb5-devel.sh
f09e2e
fi
f09e2e
krb5_prefix=`krb5-config --prefix`
f09e2e
if test "$krb5_prefix" != "%{_prefix}" ; then
f09e2e
	CPPFLAGS="$CPPFLAGS -I${krb5_prefix}/include -I${krb5_prefix}/include/gssapi"; export CPPFLAGS
f09e2e
	CFLAGS="$CFLAGS -I${krb5_prefix}/include -I${krb5_prefix}/include/gssapi"
f09e2e
	LDFLAGS="$LDFLAGS -L${krb5_prefix}/%{_lib}"; export LDFLAGS
f09e2e
else
f09e2e
	krb5_prefix=
f09e2e
	CPPFLAGS="-I%{_includedir}/gssapi"; export CPPFLAGS
f09e2e
	CFLAGS="$CFLAGS -I%{_includedir}/gssapi"
f09e2e
fi
f09e2e
%endif
f09e2e
f09e2e
%configure \
f09e2e
	--sysconfdir=%{_sysconfdir}/ssh \
f09e2e
	--libexecdir=%{_libexecdir}/openssh \
f09e2e
	--datadir=%{_datadir}/openssh \
f09e2e
	--with-tcp-wrappers \
f09e2e
	--with-default-path=/usr/local/bin:/usr/bin \
f09e2e
	--with-superuser-path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin \
f09e2e
	--with-privsep-path=%{_var}/empty/sshd \
017ff1
	--enable-vendor-patchlevel="RHEL7-%{openssh_ver}-%{openssh_rel}" \
f09e2e
	--disable-strip \
f09e2e
	--without-zlib-version-check \
f09e2e
	--with-ssl-engine \
f09e2e
	--with-ipaddr-display \
22c9eb
	--with-systemd \
1d31ef
	--with-ssh1 \
f09e2e
%if %{ldap}
f09e2e
	--with-ldap \
f09e2e
%endif
f09e2e
%if %{rescue}
f09e2e
	--without-pam \
f09e2e
%else
f09e2e
	--with-pam \
f09e2e
%endif
f09e2e
%if %{WITH_SELINUX}
f09e2e
	--with-selinux --with-audit=linux \
1d31ef
%ifnarch ppc
f09e2e
	--with-sandbox=seccomp_filter \
f09e2e
%else
f09e2e
	--with-sandbox=rlimit \
f09e2e
%endif
f09e2e
%endif
f09e2e
%if %{kerberos5}
f09e2e
	--with-kerberos5${krb5_prefix:+=${krb5_prefix}} \
f09e2e
%else
f09e2e
	--without-kerberos5 \
f09e2e
%endif
f09e2e
%if %{libedit}
f09e2e
	--with-libedit
f09e2e
%else
f09e2e
	--without-libedit
f09e2e
%endif
f09e2e
f09e2e
%if %{static_libcrypto}
f09e2e
perl -pi -e "s|-lcrypto|%{_libdir}/libcrypto.a|g" Makefile
f09e2e
%endif
f09e2e
f09e2e
make
f09e2e
f09e2e
# Define a variable to toggle gnome1/gtk2 building.  This is necessary
f09e2e
# because RPM doesn't handle nested %if statements.
f09e2e
%if %{gtk2}
f09e2e
	gtk2=yes
f09e2e
%else
f09e2e
	gtk2=no
f09e2e
%endif
f09e2e
f09e2e
%if ! %{no_gnome_askpass}
f09e2e
pushd contrib
f09e2e
if [ $gtk2 = yes ] ; then
f09e2e
	make gnome-ssh-askpass2
f09e2e
	mv gnome-ssh-askpass2 gnome-ssh-askpass
f09e2e
else
f09e2e
	make gnome-ssh-askpass1
f09e2e
	mv gnome-ssh-askpass1 gnome-ssh-askpass
f09e2e
fi
f09e2e
popd
f09e2e
%endif
f09e2e
f09e2e
%if %{pam_ssh_agent}
f09e2e
pushd pam_ssh_agent_auth-%{pam_ssh_agent_ver}
f09e2e
LDFLAGS="$SAVE_LDFLAGS"
f09e2e
%configure --with-selinux --libexecdir=/%{_libdir}/security --with-mantype=man
f09e2e
make
f09e2e
popd
f09e2e
%endif
f09e2e
f09e2e
# Add generation of HMAC checksums of the final stripped binaries
f09e2e
%define __spec_install_post \
f09e2e
    %{?__debug_package:%{__debug_install_post}} \
f09e2e
    %{__arch_install_post} \
f09e2e
    %{__os_install_post} \
f09e2e
    fipshmac -d $RPM_BUILD_ROOT%{_libdir}/fipscheck $RPM_BUILD_ROOT%{_bindir}/ssh $RPM_BUILD_ROOT%{_sbindir}/sshd \
f09e2e
%{nil}
f09e2e
f09e2e
%check
f09e2e
#to run tests use "--with check"
f09e2e
%if %{?_with_check:1}%{!?_with_check:0}
f09e2e
make tests
f09e2e
%endif
f09e2e
f09e2e
%install
f09e2e
rm -rf $RPM_BUILD_ROOT
f09e2e
mkdir -p -m755 $RPM_BUILD_ROOT%{_sysconfdir}/ssh
f09e2e
mkdir -p -m755 $RPM_BUILD_ROOT%{_libexecdir}/openssh
f09e2e
mkdir -p -m755 $RPM_BUILD_ROOT%{_var}/empty/sshd
f09e2e
make install DESTDIR=$RPM_BUILD_ROOT
f09e2e
rm -f $RPM_BUILD_ROOT%{_sysconfdir}/ssh/ldap.conf
f09e2e
f09e2e
install -d $RPM_BUILD_ROOT/etc/pam.d/
f09e2e
install -d $RPM_BUILD_ROOT/etc/sysconfig/
f09e2e
install -d $RPM_BUILD_ROOT/etc/rc.d/init.d
f09e2e
install -d $RPM_BUILD_ROOT%{_libexecdir}/openssh
f09e2e
install -d $RPM_BUILD_ROOT%{_libdir}/fipscheck
f09e2e
install -m644 %{SOURCE2} $RPM_BUILD_ROOT/etc/pam.d/sshd
f09e2e
install -m644 %{SOURCE6} $RPM_BUILD_ROOT/etc/pam.d/ssh-keycat
f09e2e
install -m755 %{SOURCE3} $RPM_BUILD_ROOT/etc/rc.d/init.d/sshd
f09e2e
install -m644 %{SOURCE7} $RPM_BUILD_ROOT/etc/sysconfig/sshd
f09e2e
install -m755 %{SOURCE13} $RPM_BUILD_ROOT/%{_sbindir}/sshd-keygen
f09e2e
install -d -m755 $RPM_BUILD_ROOT/%{_unitdir}
f09e2e
install -m644 %{SOURCE9} $RPM_BUILD_ROOT/%{_unitdir}/sshd@.service
f09e2e
install -m644 %{SOURCE10} $RPM_BUILD_ROOT/%{_unitdir}/sshd.socket
f09e2e
install -m644 %{SOURCE11} $RPM_BUILD_ROOT/%{_unitdir}/sshd.service
f09e2e
install -m644 %{SOURCE12} $RPM_BUILD_ROOT/%{_unitdir}/sshd-keygen.service
f09e2e
install -m755 contrib/ssh-copy-id $RPM_BUILD_ROOT%{_bindir}/
f09e2e
install contrib/ssh-copy-id.1 $RPM_BUILD_ROOT%{_mandir}/man1/
f09e2e
1d31ef
#restore slogin symlink
1d31ef
pushd $RPM_BUILD_ROOT%{_bindir}
1d31ef
ln -s ./ssh slogin
1d31ef
pushd $RPM_BUILD_ROOT%{_mandir}/man1
1d31ef
ln -s ./ssh.1 slogin.1
1d31ef
popd; popd;
1d31ef
f09e2e
%if ! %{no_gnome_askpass}
f09e2e
install contrib/gnome-ssh-askpass $RPM_BUILD_ROOT%{_libexecdir}/openssh/gnome-ssh-askpass
f09e2e
%endif
f09e2e
f09e2e
%if ! %{no_gnome_askpass}
f09e2e
ln -s gnome-ssh-askpass $RPM_BUILD_ROOT%{_libexecdir}/openssh/ssh-askpass
f09e2e
install -m 755 -d $RPM_BUILD_ROOT%{_sysconfdir}/profile.d/
f09e2e
install -m 755 contrib/redhat/gnome-ssh-askpass.csh $RPM_BUILD_ROOT%{_sysconfdir}/profile.d/
f09e2e
install -m 755 contrib/redhat/gnome-ssh-askpass.sh $RPM_BUILD_ROOT%{_sysconfdir}/profile.d/
f09e2e
%endif
f09e2e
f09e2e
%if %{no_gnome_askpass}
f09e2e
rm -f $RPM_BUILD_ROOT/etc/profile.d/gnome-ssh-askpass.*
f09e2e
%endif
f09e2e
f09e2e
perl -pi -e "s|$RPM_BUILD_ROOT||g" $RPM_BUILD_ROOT%{_mandir}/man*/*
f09e2e
f09e2e
%if %{pam_ssh_agent}
f09e2e
pushd pam_ssh_agent_auth-%{pam_ssh_agent_ver}
f09e2e
make install DESTDIR=$RPM_BUILD_ROOT
f09e2e
popd
f09e2e
%endif
f09e2e
%clean
f09e2e
rm -rf $RPM_BUILD_ROOT
f09e2e
f09e2e
%pre
f09e2e
getent group ssh_keys >/dev/null || groupadd -r ssh_keys || :
f09e2e
f09e2e
%pre server
f09e2e
getent group sshd >/dev/null || groupadd -g %{sshd_uid} -r sshd || :
f09e2e
getent passwd sshd >/dev/null || \
f09e2e
  useradd -c "Privilege-separated SSH" -u %{sshd_uid} -g sshd \
f09e2e
  -s /sbin/nologin -r -d /var/empty/sshd sshd 2> /dev/null || :
f09e2e
f09e2e
%post server
f09e2e
%systemd_post sshd.service sshd.socket
f09e2e
f09e2e
%preun server
f09e2e
%systemd_preun sshd.service sshd.socket
f09e2e
f09e2e
%postun server
f09e2e
%systemd_postun_with_restart sshd.service
f09e2e
f09e2e
%files
f09e2e
%defattr(-,root,root)
017ff1
%{!?_licensedir:%global license %%doc}
017ff1
%license LICENCE
017ff1
%doc CREDITS ChangeLog INSTALL OVERVIEW PROTOCOL* README README.platform README.privsep README.tun README.dns TODO
f09e2e
%attr(0755,root,root) %dir %{_sysconfdir}/ssh
017ff1
%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ssh/moduli
f09e2e
%if ! %{rescue}
f09e2e
%attr(0755,root,root) %{_bindir}/ssh-keygen
f09e2e
%attr(0644,root,root) %{_mandir}/man1/ssh-keygen.1*
f09e2e
%attr(0755,root,root) %dir %{_libexecdir}/openssh
f09e2e
%attr(2111,root,ssh_keys) %{_libexecdir}/openssh/ssh-keysign
f09e2e
%attr(0755,root,root) %{_libexecdir}/openssh/ctr-cavstest
f09e2e
%attr(0644,root,root) %{_mandir}/man8/ssh-keysign.8*
f09e2e
%endif
f09e2e
f09e2e
%files clients
f09e2e
%defattr(-,root,root)
f09e2e
%attr(0755,root,root) %{_bindir}/ssh
f09e2e
%attr(0644,root,root) %{_libdir}/fipscheck/ssh.hmac
f09e2e
%attr(0644,root,root) %{_mandir}/man1/ssh.1*
f09e2e
%attr(0755,root,root) %{_bindir}/scp
f09e2e
%attr(0644,root,root) %{_mandir}/man1/scp.1*
f09e2e
%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ssh/ssh_config
f09e2e
%attr(0755,root,root) %{_bindir}/slogin
f09e2e
%attr(0644,root,root) %{_mandir}/man1/slogin.1*
f09e2e
%attr(0644,root,root) %{_mandir}/man5/ssh_config.5*
f09e2e
%if ! %{rescue}
f09e2e
%attr(2111,root,nobody) %{_bindir}/ssh-agent
f09e2e
%attr(0755,root,root) %{_bindir}/ssh-add
f09e2e
%attr(0755,root,root) %{_bindir}/ssh-keyscan
f09e2e
%attr(0755,root,root) %{_bindir}/sftp
f09e2e
%attr(0755,root,root) %{_bindir}/ssh-copy-id
f09e2e
%attr(0755,root,root) %{_libexecdir}/openssh/ssh-pkcs11-helper
f09e2e
%attr(0644,root,root) %{_mandir}/man1/ssh-agent.1*
f09e2e
%attr(0644,root,root) %{_mandir}/man1/ssh-add.1*
f09e2e
%attr(0644,root,root) %{_mandir}/man1/ssh-keyscan.1*
f09e2e
%attr(0644,root,root) %{_mandir}/man1/sftp.1*
f09e2e
%attr(0644,root,root) %{_mandir}/man1/ssh-copy-id.1*
f09e2e
%attr(0644,root,root) %{_mandir}/man8/ssh-pkcs11-helper.8*
f09e2e
%endif
f09e2e
f09e2e
%if ! %{rescue}
f09e2e
%files server
f09e2e
%defattr(-,root,root)
f09e2e
%dir %attr(0711,root,root) %{_var}/empty/sshd
f09e2e
%attr(0755,root,root) %{_sbindir}/sshd
f09e2e
%attr(0755,root,root) %{_sbindir}/sshd-keygen
f09e2e
%attr(0644,root,root) %{_libdir}/fipscheck/sshd.hmac
f09e2e
%attr(0755,root,root) %{_libexecdir}/openssh/sftp-server
f09e2e
%attr(0644,root,root) %{_mandir}/man5/sshd_config.5*
f09e2e
%attr(0644,root,root) %{_mandir}/man5/moduli.5*
f09e2e
%attr(0644,root,root) %{_mandir}/man8/sshd.8*
f09e2e
%attr(0644,root,root) %{_mandir}/man8/sftp-server.8*
f09e2e
%attr(0600,root,root) %config(noreplace) %{_sysconfdir}/ssh/sshd_config
f09e2e
%attr(0644,root,root) %config(noreplace) /etc/pam.d/sshd
f09e2e
%attr(0640,root,root) %config(noreplace) /etc/sysconfig/sshd
f09e2e
%attr(0644,root,root) %{_unitdir}/sshd.service
f09e2e
%attr(0644,root,root) %{_unitdir}/sshd@.service
f09e2e
%attr(0644,root,root) %{_unitdir}/sshd.socket
f09e2e
%attr(0644,root,root) %{_unitdir}/sshd-keygen.service
f09e2e
f09e2e
%files server-sysvinit
f09e2e
%defattr(-,root,root)
f09e2e
%attr(0755,root,root) /etc/rc.d/init.d/sshd
f09e2e
%endif
f09e2e
f09e2e
%if %{ldap}
f09e2e
%files ldap
f09e2e
%defattr(-,root,root)
f09e2e
%doc HOWTO.ldap-keys openssh-lpk-openldap.schema openssh-lpk-sun.schema ldap.conf
674526
%doc openssh-lpk-openldap.ldif openssh-lpk-sun.ldif
f09e2e
%attr(0755,root,root) %{_libexecdir}/openssh/ssh-ldap-helper
f09e2e
%attr(0755,root,root) %{_libexecdir}/openssh/ssh-ldap-wrapper
f09e2e
%attr(0644,root,root) %{_mandir}/man8/ssh-ldap-helper.8*
f09e2e
%attr(0644,root,root) %{_mandir}/man5/ssh-ldap.conf.5*
f09e2e
%endif
f09e2e
f09e2e
%files keycat
f09e2e
%defattr(-,root,root)
f09e2e
%doc HOWTO.ssh-keycat
f09e2e
%attr(0755,root,root) %{_libexecdir}/openssh/ssh-keycat
f09e2e
%attr(0644,root,root) %config(noreplace) /etc/pam.d/ssh-keycat
f09e2e
f09e2e
%if ! %{no_gnome_askpass}
f09e2e
%files askpass
f09e2e
%defattr(-,root,root)
f09e2e
%attr(0644,root,root) %{_sysconfdir}/profile.d/gnome-ssh-askpass.*
f09e2e
%attr(0755,root,root) %{_libexecdir}/openssh/gnome-ssh-askpass
f09e2e
%attr(0755,root,root) %{_libexecdir}/openssh/ssh-askpass
f09e2e
%endif
f09e2e
1d31ef
%files cavs
1d31ef
%attr(0755,root,root) %{_libexecdir}/openssh/ctr-cavstest
1d31ef
%attr(0755,root,root) %{_libexecdir}/openssh/ssh-cavs
1d31ef
%attr(0755,root,root) %{_libexecdir}/openssh/ssh-cavs_driver.pl
1d31ef
f09e2e
%if %{pam_ssh_agent}
f09e2e
%files -n pam_ssh_agent_auth
f09e2e
%defattr(-,root,root)
017ff1
%{!?_licensedir:%global license %%doc}
017ff1
%license pam_ssh_agent_auth-%{pam_ssh_agent_ver}/OPENSSH_LICENSE
f09e2e
%attr(0755,root,root) %{_libdir}/security/pam_ssh_agent_auth.so
f09e2e
%attr(0644,root,root) %{_mandir}/man8/pam_ssh_agent_auth.8*
f09e2e
%endif
f09e2e
f09e2e
%changelog
810d56
* Tue Jun 25 2019 Jakub Jelen <jjelen@redhat.com> - 7.4p1-21 + 0.10.3-2
810d56
- Avoid double comma in the default cipher list in FIPS mode (#1722446)
810d56
810d56
* Tue May 21 2019 Jakub Jelen <jjelen@redhat.com> - 7.4p1-20 + 0.10.3-2
810d56
- Revert the updating of cached passwd structure (#1712053)
810d56
810d56
* Mon Mar 04 2019 Jakub Jelen <jjelen@redhat.com> - 7.4p1-19 + 0.10.3-2
810d56
- Update cached passwd structure after PAM authentication (#1674541)
810d56
810d56
* Wed Feb 13 2019 Jakub Jelen <jjelen@redhat.com> - 7.4p1-18 + 0.10.3-2
810d56
- invalidate supplemental group cache used by temporarily_use_uid()
810d56
  when the target uid differs (#1583735)
810d56
810d56
* Mon Jan 14 2019 Jakub Jelen <jjelen@redhat.com> - 7.4p1-17 + 0.10.3-2
810d56
- Fix for CVE-2018-15473 (#1619079)
810d56
- Enable GCM mode for AES ciphers in FIPS mode (#1600869)
810d56
9a9eba
* Fri Nov 24 2017 Jakub Jelen <jjelen@redhat.com> - 7.4p1-16 + 0.10.3-2
9a9eba
- Fix for CVE-2017-15906 (#1517226)
9a9eba
9a9eba
* Mon Nov 06 2017 Jakub Jelen <jjelen@redhat.com> - 7.4p1-15 + 0.10.3-2
9a9eba
- Do not hang if SSH AuthorizedKeysCommand output is too large (#1496467)
9a9eba
- Do not segfault pam_ssh_agent_auth if keyfile is missing (#1494268)
9a9eba
- Do not segfault in audit code during cleanup (#1488083)
9a9eba
- Add WinSCP 5.10+ compatibility (#1496808)
9a9eba
- Clatch between ClientAlive and rekeying timeouts (#1480510)
9a9eba
- Exclude dsa and ed25519 from default proposed keys in FIPS mode (#1456853)
9a9eba
- Add enablement for openssl-ibmca and openssl-ibmpkcs11 (#1478035)
9a9eba
9a9eba
* Fri Nov  3 2017 Nikos Mavrogiannopoulos <nmav@redhat.com> - 7.4p1-14 + 0.10.3-2
9a9eba
- Rebuilt for RHEL-7.5
9a9eba
fc6407
* Wed Sep 13 2017 Jakub Jelen <jjelen@redhat.com> - 7.4p1-13 + 0.10.3-1
fc6407
- Revert default of GSSAPIStrictAcceptorCheck=no back to yes (#1488982)
fc6407
b7cc2d
* Mon Aug 07 2017 Jakub Jelen <jjelen@redhat.com> - 7.4p1-12 + 0.10.3-1
b7cc2d
- Revert upstream change to UseDNS=no back to yes (#1478175)
b7cc2d
1d31ef
* Mon May 22 2017 Jakub Jelen <jjelen@redhat.com> - 7.4p1-11 + 0.10.3-1
1d31ef
- Compiler warnings (#1341754)
1d31ef
1d31ef
* Mon May 22 2017 Jakub Jelen <jjelen@redhat.com> - 7.4p1-10 + 0.10.3-1
1d31ef
- Add missing messages in FIPS mode (#1341754)
1d31ef
1d31ef
* Fri May 19 2017 Jakub Jelen <jjelen@redhat.com> - 7.4p1-9 + 0.10.3-1
1d31ef
- Allow harmless syscalls for s390 crypto modules (#1451809)
1d31ef
1d31ef
* Mon May 15 2017 Jakub Jelen <jjelen@redhat.com> - 7.4p1-8 + 0.10.3-1
1d31ef
- Fix multilib issue in documentation (#1450361)
1d31ef
1d31ef
* Thu May 04 2017 Jakub Jelen <jjelen@redhat.com> - 7.4p1-6 + 0.10.3-1
1d31ef
- ControlPath too long should not be a fatal error (#1447561)
1d31ef
1d31ef
* Wed Apr 26 2017 Jakub Jelen <jjelen@redhat.com> - 7.4p1-5 + 0.10.3-1
1d31ef
- Fix the default key exchange proposal in FIPS mode (#1438414)
1d31ef
- Remove another wrong coverity chunk to unbreak gsskex (#1438414)
1d31ef
1d31ef
* Mon Apr 24 2017 Jakub Jelen <jjelen@redhat.com> - 7.4p1-4 + 0.10.3-1
1d31ef
- Update seccomp filter to work on ppc64le (#1443916)
1d31ef
1d31ef
* Wed Apr 05 2017 Jakub Jelen <jjelen@redhat.com> - 7.4p1-3 + 0.10.3-1
1d31ef
- Do not completely disable SHA-1 key exchange methods in FIPS (#1324493)
1d31ef
- Remove wrong coverity patches
1d31ef
1d31ef
* Thu Mar 23 2017 Jakub Jelen <jjelen@redhat.com> - 7.4p1-2 + 0.10.3-1
1d31ef
- Fix coverity scan results
1d31ef
- Adjust FIPS algorithms list (#1420910)
1d31ef
- Revert problematic feature for chroot(#1418062)
1d31ef
- Fix CBC weakness in released OpenSSH 7.5
1d31ef
1d31ef
* Wed Mar 01 2017 Jakub Jelen <jjelen@redhat.com> - 7.4p1-1 + 0.10.3-1
1d31ef
- Rebase to openssh 7.4 and pam_ssh_agent_auth 0.10.3 (#1341754)
1d31ef
- detach -cavs subpackage
1d31ef
- enable seccomp filter for sandboxed child
1d31ef
22c9eb
* Wed Mar 01 2017 Jakub Jelen <jjelen@redhat.com> - 6.6.1p1-35 + 0.9.3-9
22c9eb
- Do not send SD_NOTIFY from forked childern (#1381997)
22c9eb
22c9eb
* Fri Feb 24 2017 Jakub Jelen <jjelen@redhat.com> - 6.6.1p1-34 + 0.9.3-9
22c9eb
- Add SD_NOTIFY code to help systemd to track running service (#1381997)
22c9eb
1bd961
* Mon Dec 19 2016 Jakub Jelen <jjelen@redhat.com> - 6.6.1p1-33 + 0.9.3-9
1bd961
- Restore login with large MOTD (#1404018)
1bd961
1bd961
* Tue Nov 29 2016 Jakub Jelen <jjelen@redhat.com> - 6.6.1p1-32 + 0.9.3-9
1bd961
- Restore funcionality of chrooted envirotments (#1398569)
1bd961
f8987c
* Tue Sep 06 2016 Jakub Jelen <jjelen@redhat.com> - 6.6.1p1-31 + 0.9.3-9
f8987c
- Do not depend on selinux-policy (#1373297)
f8987c
f8987c
* Fri Jul 29 2016 Jakub Jelen <jjelen@redhat.com> - 6.6.1p1-30 + 0.9.3-9
f8987c
- Drop dependency on libcap-ng for ssh-keycat (#1357859)
f8987c
f8987c
* Thu Jul 28 2016 Jakub Jelen <jjelen@redhat.com> - 6.6.1p1-29 + 0.9.3-9
f8987c
- Rework SELinux context handling with chroot using libcap-ng (#1357859)
f8987c
f8987c
* Fri Jul 01 2016 Jakub Jelen <jjelen@redhat.com> - 6.6.1p1-28 + 0.9.3-9
f8987c
- SFTP force permission collision with umask (#1344614)
f8987c
- Make closefrom() ignore FD's to /dev/ devices on s390 (#1318760)
f8987c
- Create a default value for AuthenticationMethods any (#1237129)
f8987c
- Fix ssh-copy-id with LogLevel=quiet (#1349556)
f8987c
- Expose more information to PAM (#1312304)
f8987c
- Move MAX_DISPLAYS to a configuration option (#1341302)
f8987c
- Add a wildcard option to PermitOpen directive (host) (#1344106)
f8987c
f8987c
* Tue May 31 2016 Jakub Jelen <jjelen@redhat.com> - 6.6.1p1-27 + 0.9.3-9
f8987c
- Coverity and RPMDiff build issues (#1334326)
f8987c
- CVE-2015-8325: privilege escalation via user's PAM environment and UseLogin=yes (#1329191)
f8987c
- Check for real location of .k5login file (#1328243)
f8987c
- close ControlPersist background process stderr (#1335540)
f8987c
f8987c
* Fri Apr 01 2016 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-26 + 0.9.3-9
f8987c
- Drop glob patch for sftp client preventing listing many files (#1310303)
f8987c
- Fix race condition between audit messages from different processes (#1310684)
f8987c
- Make systemd service forking to properly report state (#1291172)
f8987c
- Get rid of rpm triggers for openssh-5.x (#1312013)
f8987c
- Generate the host keys when the key files are empty (#1266043)
f8987c
- pam_ssh_agent_auth: authorized_keys_command option (#1317858)
f8987c
- Don't use MD5 digest from pam_ssh_agent_auth in FIPS mode (#1317952)
f8987c
69acbb
* Wed Mar 16 2016 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-25 + 0.9.3-9
69acbb
- CVE-2016-1908: possible fallback from untrusted to trusted X11 forwarding (#1298741)
69acbb
69acbb
* Tue Mar 15 2016 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-24 + 0.9.3-9
f8987c
- CVE-2016-3115: missing sanitisation of input for X11 forwarding (#1317819)
69acbb
1edce7
* Wed Jan 13 2016 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-23 + 0.9.3-9
1edce7
- Disable undocumented feauture Roaming for good (#1298218)
1edce7
- prevents CVE-2016-0777 and CVE-2016-0778
1edce7
674526
* Fri Sep 25 2015 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-22 + 0.9.3-9
674526
- Use the correct constant for glob limits (#1160377)
674526
674526
* Thu Sep 24 2015 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-21 + 0.9.3-9
674526
- Extend memory limit for remote glob in sftp acc. to stat limit (#1160377)
674526
674526
* Thu Sep 24 2015 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-20 + 0.9.3-9
674526
- Fix vulnerabilities published with openssh-7.0 (#1265807)
674526
 - Privilege separation weakness related to PAM support
674526
 - Use-after-free bug related to PAM support
674526
674526
* Thu Sep 24 2015 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-19 + 0.9.3-9
674526
- Increase limit of files for glob match in sftp to 8192 (#1160377)
674526
674526
* Tue Aug 18 2015 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-18 + 0.9.3-9
674526
- Add GSSAPIKexAlgorithms option for server and client application (#1253062)
674526
674526
* Wed Jul 29 2015 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-17 + 0.9.3-9
674526
- Security fixes released with openssh-6.9 (CVE-2015-5352) (#1247864)
674526
 - XSECURITY restrictions bypass under certain conditions in ssh(1) (#1238231)
674526
 - weakness of agent locking (ssh-add -x) to password guessing (#1238238)
674526
674526
* Mon Jul 27 2015 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-16 + 0.9.3-9
674526
- only query each keyboard-interactive device once (CVE-2015-5600) (#1245971)
674526
674526
* Wed Jul 15 2015 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-15 + 0.9.3-9
674526
- One more typo in manual page documenting TERM variable (#1162683)
674526
- Fix race condition with auditing messages answers (#1240613)
674526
674526
* Mon Jun 15 2015 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-14 + 0.9.3-9
674526
- Fix ldif schema to have correct spacing on newlines (#1184938)
674526
- Add missing values for sshd test mode (#1187597)
674526
- ssh-copy-id: tcsh doesnt work with multiline strings (#1201758)
674526
- Fix memory problems with newkeys and array transfers (#1223218)
674526
- Enhance AllowGroups documentation in man page (#1150007)
674526
674526
* Mon May 11 2015 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-13 + 0.9.3-9
674526
- Increase limit of files for glob match in sftp (#1160377)
674526
- Add pam_reauthorize.so to /etc/pam.d/sshd (#1204233)
674526
- Show all config values in sshd test mode (#1187597)
674526
- Document required selinux boolean for working ssh-ldap-helper (#1178116)
674526
- Consistent usage of pam_namespace in sshd (#1125110)
674526
- Fix auditing when using combination of ForcedCommand and PTY (#1199112)
674526
- Add sftp option to force mode of created files (#1197989)
674526
- Ability to specify an arbitrary LDAP filter in ldap.conf for ssh-ldap-helper (#1201753)
674526
- Provide documentation line for systemd service and socket (#1181591)
674526
- Provide LDIF version of LPK schema (#1184938)
674526
- Document TERM environment variable (#1162683)
674526
- Fix ssh-copy-id on non-sh remote shells (#1201758)
674526
- Do not read RSA1 hostkeys for HostBased authentication in FIPS (#1197666)
674526
11c3be
* Thu Mar 19 2015 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-12 + 0.9.3-9
11c3be
- Fix labeling in MLS according to selected sensitivity (#1202843)
11c3be
017ff1
* Fri Jan 16 2015 Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-11 + 0.9.3-9
017ff1
- fix direction in CRYPTO_SESSION audit message (#1171248)
017ff1
017ff1
* Wed Jan 14 2015 Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-10 + 0.9.3-9
017ff1
- add new option GSSAPIEnablek5users and disable using ~/.k5users by default CVE-2014-9278
017ff1
  (#1169843)
017ff1
017ff1
* Fri Dec 19 2014 Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-9 + 0.9.3-9
017ff1
- log via monitor in chroots without /dev/log (#1083482)
017ff1
017ff1
* Mon Dec 15 2014 Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-8 + 0.9.3-9
017ff1
- increase size of AUDIT_LOG_SIZE to 256 (#1171163)
017ff1
- record pfs= field in CRYPTO_SESSION audit event (#1171248)
017ff1
017ff1
* Thu Nov 13 2014 Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-7 + 0.9.3-9
017ff1
- fix gsskex patch to correctly handle MONITOR_REQ_GSSSIGN request (#1118005)
017ff1
017ff1
* Fri Nov 07 2014 Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-6 + 0.9.3-9
017ff1
- correct the calculation of bytes for authctxt->krb5_ccname <ams@corefiling.com> (#1161073)
017ff1
017ff1
* Tue Nov 04 2014 Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-5 + 0.9.3-9
017ff1
- change audit trail for unknown users (#1158521)
017ff1
017ff1
* Sun Oct 26 2014 Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-4 + 0.9.3-9
017ff1
- revert the default of KerberosUseKuserok back to yes
017ff1
- fix kuserok patch which checked for the existence of .k5login unconditionally
017ff1
  and hence prevented other mechanisms to be used properly
017ff1
017ff1
* Mon Sep 29 2014 Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-3 + 0.9.3-9
017ff1
- fix parsing empty options in sshd_conf
017ff1
- ignore SIGXFSZ in postauth monitor
017ff1
017ff1
* Tue Sep 23 2014 Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-2 + 0.9.3-9
017ff1
- slightly change systemd units logic - use sshd-keygen.service (#1066615)
017ff1
- log when a client requests an interactive session and only sftp is allowed (#1130198)
017ff1
- sshd-keygen - don't generate DSA and ED25519 host keys in FIPS mode (#1143867)
017ff1
017ff1
* Mon Sep 08 2014 Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-1 + 0.9.3-9
017ff1
- new upstream release (#1059667)
017ff1
- prevent a server from skipping SSHFP lookup - CVE-2014-2653 (#1081338)
017ff1
- make /etc/ssh/moduli file public (#1134448)
017ff1
- test existence of /etc/ssh/ssh_host_ecdsa_key in sshd-keygen.service
017ff1
- don't clean up gssapi credentials by default (#1134447)
017ff1
- ssh-agent - try CLOCK_BOOTTIME with fallback (#1134449)
017ff1
- disable the curve25519 KEX when speaking to OpenSSH 6.5 or 6.6
017ff1
- add support for ED25519 keys to sshd-keygen and sshd.sysconfig
017ff1
- standardise on NI_MAXHOST for gethostname() string lengths (#1097665)
017ff1
- set a client's address right after a connection is set (mindrot#2257) (#912792)
017ff1
- apply RFC3454 stringprep to banners when possible (mindrot#2058) (#1104662)
017ff1
- don't consider a partial success as a failure (mindrot#2270) (#1112972)
017ff1
770374
* Wed Mar 19 2014 Petr Lautrbach <plautrba@redhat.com> 6.4p1-8 + 0.9.3-8
770374
- ignore environment variables with embedded '=' or '\0' characters (#1077843)
770374
770374
* Tue Jan 28 2014 Petr Lautrbach <plautrba@redhat.com> 6.4p1-7 + 0.9.3-8
770374
- log fipscheck verification message into syslog authpriv
770374
- ssh-keygen - relative-specified certificate expiry time should be relative
770374
  to current time and not the validity start time (#1058234)
770374
- use the size of security of 3des for DH (#1053107)
770374
- ssh-copy-id.1 man page fix (#1058792)
770374
770374
* Fri Jan 24 2014 Daniel Mach <dmach@redhat.com> - 6.4p1-6
770374
- Mass rebuild 2014-01-24
770374
770374
* Mon Jan 20 2014 Petr Lautrbach <plautrba@redhat.com> 6.4p1-5 + 0.9.3-8
770374
- use tty allocation for a remote scp (#985650)
770374
- run ssh-copy-id in the legacy mode when SSH_COPY_ID_LEGACY variable is set (#969375)
770374
- FIPS mode - adjust the key echange DH groups and ssh-keygen according toSP800-131A (#1001748)
770374
770374
* Fri Dec 27 2013 Daniel Mach <dmach@redhat.com> - 6.4p1-4
770374
- Mass rebuild 2013-12-27
770374
770374
* Wed Dec 11 2013 Petr Lautrbach <plautrba@redhat.com> 6.4p1-3 + 0.9.3-8
770374
- sshd-keygen - use correct permissions on ecdsa host key (#1023945)
770374
- use only rsa and ecdsa host keys by default
770374
770374
* Tue Nov 26 2013 Petr Lautrbach <plautrba@redhat.com> 6.4p1-2 + 0.9.3-1
770374
- fix fatal() cleanup in the audit patch (#1029074)
770374
- fix parsing logic of ldap.conf file (#1033662)
770374
f09e2e
* Fri Nov 08 2013 Petr Lautrbach <plautrba@redhat.com> 6.4p1-1 + 0.9.3-1
f09e2e
- new upstream release
f09e2e
f09e2e
* Fri Nov 01 2013 Petr Lautrbach <plautrba@redhat.com> 6.3p1-4 + 0.9.3-7
f09e2e
- adjust gss kex mechanism to the upstream changes (#1024004)
f09e2e
- don't use xfree in pam_ssh_agent_auth sources <geertj@gmail.com> (#1024965)
f09e2e
f09e2e
* Thu Oct 24 2013 Petr Lautrbach <plautrba@redhat.com> 6.3p1-3 + 0.9.3-6
f09e2e
- don't use SSH_FP_MD5 for fingerprints in FIPS mode (#1020948)
f09e2e
f09e2e
* Wed Oct 23 2013 Petr Lautrbach <plautrba@redhat.com> 6.3p1-2 + 0.9.3-6
f09e2e
- use default_ccache_name from /etc/krb5.conf for a kerberos cache (#991186)
f09e2e
- increase the size of the Diffie-Hellman groups (#1010607)
f09e2e
- sshd-keygen to generate ECDSA keys <i.grok@comcast.net> (#1019222)
f09e2e
f09e2e
* Mon Oct 14 2013 Petr Lautrbach <plautrba@redhat.com> 6.3p1-1 + 0.9.3-6
f09e2e
- new upstream release (#1013635)
f09e2e
f09e2e
* Tue Oct 08 2013 Petr Lautrbach <plautrba@redhat.com> 6.2p2-9 + 0.9.3-5
f09e2e
- use dracut-fips package to determine if a FIPS module is installed (#1001566)
f09e2e
- revert -fips subpackages and hmac files suffixes
f09e2e
f09e2e
* Wed Sep 25 2013 Petr Lautrbach <plautrba@redhat.com> 6.2p2-8 + 0.9.3-5
f09e2e
- sshd-keygen: generate only RSA keys by default (#1010361)
f09e2e
- use dist tag in suffixes for hmac checksum files
f09e2e
f09e2e
* Wed Sep 11 2013 Petr Lautrbach <plautrba@redhat.com> 6.2p2-7 + 0.9.3-5
f09e2e
- use hmac_suffix for ssh{,d} hmac checksums
f09e2e
- bump the minimum value of SSH_USE_STRONG_RNG to 14 according to SP800-131A
f09e2e
- automatically restart sshd.service on-failure after 42s interval
f09e2e
f09e2e
* Thu Aug 29 2013 Petr Lautrbach <plautrba@redhat.com> 6.2p2-6.1 + 0.9.3-5
f09e2e
- add -fips subpackages that contains the FIPS module files
f09e2e
f09e2e
* Wed Jul 31 2013 Petr Lautrbach <plautrba@redhat.com> 6.2p2-5 + 0.9.3-5
f09e2e
- gssapi credentials need to be stored before a pam session opened (#987792)
f09e2e
f09e2e
* Tue Jul 23 2013 Petr Lautrbach <plautrba@redhat.com> 6.2p2-4 + 0.9.3-5
f09e2e
- don't show Success for EAI_SYSTEM (#985964)
f09e2e
- make sftp's libedit interface marginally multibyte aware (#841771)
f09e2e
f09e2e
* Mon Jun 17 2013 Petr Lautrbach <plautrba@redhat.com> 6.2p2-3 + 0.9.3-5
f09e2e
- move default gssapi cache to /run/user/<uid> (#848228)
f09e2e
f09e2e
* Tue May 21 2013 Petr Lautrbach <plautrba@redhat.com> 6.2p2-2 + 0.9.3-5
f09e2e
- add socket activated sshd units to the package (#963268)
f09e2e
- fix the example in the HOWTO.ldap-keys
f09e2e
f09e2e
* Mon May 20 2013 Petr Lautrbach <plautrba@redhat.com> 6.2p2-1 + 0.9.3-5
f09e2e
- new upstream release (#963582)
f09e2e
f09e2e
* Wed Apr 17 2013 Petr Lautrbach <plautrba@redhat.com> 6.2p1-4 + 0.9.3-4
f09e2e
- don't use export in sysconfig file (#953111)
f09e2e
f09e2e
* Tue Apr 16 2013 Petr Lautrbach <plautrba@redhat.com> 6.2p1-3 + 0.9.3-4
f09e2e
- sshd.service: use KillMode=process (#890376)
f09e2e
- add latest config.{sub,guess} to support aarch64 (#926284)
f09e2e
f09e2e
* Tue Apr 09 2013 Petr Lautrbach <plautrba@redhat.com> 6.2p1-2 + 0.9.3-4
f09e2e
- keep track of which IndentityFile options were manually supplied and
f09e2e
  which were default options, and don't warn if the latter are missing.
f09e2e
  (mindrot#2084)
f09e2e
f09e2e
* Tue Apr 09 2013 Petr Lautrbach <plautrba@redhat.com> 6.2p1-1 + 0.9.3-4
f09e2e
- new upstream release (#924727)
f09e2e
f09e2e
* Wed Mar 06 2013 Petr Lautrbach <plautrba@redhat.com> 6.1p1-7 + 0.9.3-3
f09e2e
- use SELinux type sshd_net_t for [net] childs (#915085)
f09e2e
f09e2e
* Thu Feb 14 2013 Petr Lautrbach <plautrba@redhat.com> 6.1p1-6 + 0.9.3-3
f09e2e
- fix AuthorizedKeysCommand option
f09e2e
f09e2e
* Fri Feb 08 2013 Petr Lautrbach <plautrba@redhat.com> 6.1p1-5 + 0.9.3-3
f09e2e
- change default value of MaxStartups - CVE-2010-5107 (#908707)
f09e2e
f09e2e
* Mon Dec 03 2012 Petr Lautrbach <plautrba@redhat.com> 6.1p1-4 + 0.9.3-3
f09e2e
- fix segfault in openssh-5.8p2-force_krb.patch (#882541)
f09e2e
f09e2e
* Mon Dec 03 2012 Petr Lautrbach <plautrba@redhat.com> 6.1p1-3 + 0.9.3-3
f09e2e
- replace RequiredAuthentications2 with AuthenticationMethods based on upstream
f09e2e
- obsolete RequiredAuthentications[12] options
f09e2e
- fix openssh-6.1p1-privsep-selinux.patch
f09e2e
f09e2e
* Fri Oct 26 2012 Petr Lautrbach <plautrba@redhat.com> 6.1p1-2
f09e2e
- add SELinux comment to /etc/ssh/sshd_config about SELinux command to modify port (#861400)
f09e2e
- drop required chkconfig (#865498)
f09e2e
- drop openssh-5.9p1-sftp-chroot.patch (#830237)
f09e2e
f09e2e
* Sat Sep 15 2012 Petr Lautrbach <plautrba@redhat.com> 6.1p1-1 + 0.9.3-3
f09e2e
- new upstream release (#852651)
f09e2e
- use DIR: kerberos type cache (#848228)
f09e2e
- don't use chroot_user_t for chrooted users (#830237)
f09e2e
- replace scriptlets with systemd macros (#850249)
f09e2e
- don't use /bin and /sbin paths (#856590)
f09e2e
f09e2e
* Mon Aug 06 2012 Petr Lautrbach <plautrba@redhat.com> 6.0p1-1 + 0.9.3-2
f09e2e
- new upstream release
f09e2e
f09e2e
* Mon Aug 06 2012 Petr Lautrbach <plautrba@redhat.com> 5.9p1-26 + 0.9.3-1
f09e2e
- change SELinux context also for root user (#827109)
f09e2e
f09e2e
* Fri Jul 27 2012 Petr Lautrbach <plautrba@redhat.com> 5.9p1-25 + 0.9.3-1
f09e2e
- fix various issues in openssh-5.9p1-required-authentications.patch
f09e2e
f09e2e
* Tue Jul 17 2012 Tomas Mraz <tmraz@redhat.com> 5.9p1-24 + 0.9.3-1
f09e2e
- allow sha256 and sha512 hmacs in the FIPS mode
f09e2e
f09e2e
* Fri Jun 22 2012 Tomas Mraz <tmraz@redhat.com> 5.9p1-23 + 0.9.3-1
f09e2e
- fix segfault in su when pam_ssh_agent_auth is used and the ssh-agent
f09e2e
  is not running, most probably not exploitable
f09e2e
- update pam_ssh_agent_auth to 0.9.3 upstream version
f09e2e
f09e2e
* Fri Apr 06 2012 Petr Lautrbach <plautrba@redhat.com> 5.9p1-22 + 0.9.2-32
f09e2e
- don't create RSA1 key in FIPS mode
f09e2e
- don't install sshd-keygen.service (#810419)
f09e2e
f09e2e
* Fri Mar 30 2012 Petr Lautrbach <plautrba@redhat.com> 5.9p1-21 + 0.9.2-32
f09e2e
- fix various issues in openssh-5.9p1-required-authentications.patch
f09e2e
f09e2e
* Wed Mar 21 2012 Petr Lautrbach <plautrba@redhat.com> 5.9p1-20 + 0.9.2-32
f09e2e
- Fix dependencies in systemd units, don't enable sshd-keygen.service (#805338)
f09e2e
f09e2e
* Wed Feb 22 2012 Petr Lautrbach <plautrba@redhat.com> 5.9p1-19 + 0.9.2-32
f09e2e
- Look for x11 forward sockets with AI_ADDRCONFIG flag getaddrinfo (#735889)
f09e2e
f09e2e
* Mon Feb 06 2012 Petr Lautrbach <plautrba@redhat.com> 5.9p1-18 + 0.9.2-32
f09e2e
- replace TwoFactorAuth with RequiredAuthentications[12]
f09e2e
  https://bugzilla.mindrot.org/show_bug.cgi?id=983
f09e2e
f09e2e
* Tue Jan 31 2012 Petr Lautrbach <plautrba@redhat.com> 5.9p1-17 + 0.9.2-32
f09e2e
- run privsep slave process as the users SELinux context (#781634)
f09e2e
f09e2e
* Tue Dec 13 2011 Tomas Mraz <tmraz@redhat.com> 5.9p1-16 + 0.9.2-32
f09e2e
- add CAVS test driver for the aes-ctr ciphers
f09e2e
f09e2e
* Sun Dec 11 2011 Tomas Mraz <tmraz@redhat.com> 5.9p1-15 + 0.9.2-32
f09e2e
- enable aes-ctr ciphers use the EVP engines from OpenSSL such as the AES-NI
f09e2e
f09e2e
* Tue Dec 06 2011 Petr Lautrbach <plautrba@redhat.com> 5.9p1-14 + 0.9.2-32
f09e2e
- warn about unsupported option UsePAM=no (#757545)
f09e2e
f09e2e
* Mon Nov 21 2011 Tomas Mraz <tmraz@redhat.com> - 5.9p1-13 + 0.9.2-32
f09e2e
- add back the restorecon call to ssh-copy-id - it might be needed on older
f09e2e
  distributions (#739989)
f09e2e
f09e2e
* Fri Nov 18 2011 Tomas Mraz <tmraz@redhat.com> - 5.9p1-12 + 0.9.2-32
f09e2e
- still support /etc/sysconfig/sshd loading in sshd service (#754732)
f09e2e
- fix incorrect key permissions generated by sshd-keygen script (#754779)
f09e2e
f09e2e
* Fri Oct 14 2011 Tomas Mraz <tmraz@redhat.com> - 5.9p1-11 + 0.9.2-32
f09e2e
- remove unnecessary requires on initscripts
f09e2e
- set VerifyHostKeyDNS to ask in the default configuration (#739856)
f09e2e
f09e2e
* Mon Sep 19 2011 Jan F. Chadima <jchadima@redhat.com> - 5.9p1-10 + 0.9.2-32
f09e2e
- selinux sandbox rewrite
f09e2e
- two factor authentication tweaking
f09e2e
f09e2e
* Wed Sep 14 2011 Jan F. Chadima <jchadima@redhat.com> - 5.9p1-9 + 0.9.2-32
f09e2e
- coverity upgrade
f09e2e
- wipe off nonfunctional nss
f09e2e
- selinux sandbox tweaking
f09e2e
f09e2e
* Tue Sep 13 2011 Jan F. Chadima <jchadima@redhat.com> - 5.9p1-8 + 0.9.2-32
f09e2e
- coverity upgrade
f09e2e
- experimental selinux sandbox
f09e2e
f09e2e
* Tue Sep 13 2011 Jan F. Chadima <jchadima@redhat.com> - 5.9p1-7 + 0.9.2-32
f09e2e
- fully reanable auditing
f09e2e
f09e2e
* Mon Sep 12 2011 Jan F. Chadima <jchadima@redhat.com> - 5.9p1-6 + 0.9.2-32
f09e2e
- repair signedness in akc patch
f09e2e
f09e2e
* Mon Sep 12 2011 Jan F. Chadima <jchadima@redhat.com> - 5.9p1-5 + 0.9.2-32
f09e2e
- temporarily disable part of audit4 patch
f09e2e
f09e2e
* Fri Sep  9 2011 Jan F. Chadima <jchadima@redhat.com> - 5.9p1-3 + 0.9.2-32
f09e2e
- Coverity second pass
f09e2e
- Reenable akc patch
f09e2e
f09e2e
* Thu Sep  8 2011 Jan F. Chadima <jchadima@redhat.com> - 5.9p1-2 + 0.9.2-32
f09e2e
- Coverity first pass
f09e2e
f09e2e
* Wed Sep  7 2011 Jan F. Chadima <jchadima@redhat.com> - 5.9p1-1 + 0.9.2-32
f09e2e
- Rebase to 5.9p1
f09e2e
- Add chroot sftp patch
f09e2e
- Add two factor auth patch
f09e2e
f09e2e
* Tue Aug 23 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-21 + 0.9.2-31
f09e2e
- ignore SIGPIPE in ssh keyscan
f09e2e
f09e2e
* Tue Aug  9 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-20 + 0.9.2-31
f09e2e
- save ssh-askpass's debuginfo
f09e2e
f09e2e
* Mon Aug  8 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-19 + 0.9.2-31
f09e2e
- compile ssh-askpass with corect CFLAGS
f09e2e
f09e2e
* Mon Aug  8 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-18 + 0.9.2-31
f09e2e
- improve selinux's change context log 
f09e2e
f09e2e
* Mon Aug  8 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-17 + 0.9.2-31
f09e2e
- repair broken man pages
f09e2e
f09e2e
* Mon Jul 25 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-16 + 0.9.2-31
f09e2e
- rebuild due to broken rpmbiild
f09e2e
f09e2e
* Thu Jul 21 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-15 + 0.9.2-31
f09e2e
- Do not change context when run under unconfined_t
f09e2e
f09e2e
* Thu Jul 14 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-14 + 0.9.2-31
f09e2e
- Add postlogin to pam. (#718807)
f09e2e
f09e2e
* Tue Jun 28 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-12 + 0.9.2-31
f09e2e
- Systemd compatibility according to Mathieu Bridon <bochecha@fedoraproject.org>
f09e2e
- Split out the host keygen into their own command, to ease future migration
f09e2e
  to systemd. Compatitbility with the init script was kept.
f09e2e
- Migrate the package to full native systemd unit files, according to the Fedora
f09e2e
  packaging guidelines.
f09e2e
- Prepate the unit files for running an ondemand server. (do not add it actually)
f09e2e
f09e2e
* Tue Jun 21 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-10 + 0.9.2-31
f09e2e
- Mention IPv6 usage in man pages
f09e2e
f09e2e
* Mon Jun 20 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-9 + 0.9.2-31
f09e2e
- Improve init script
f09e2e
f09e2e
* Thu Jun 16 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-7 + 0.9.2-31
f09e2e
- Add possibility to compile openssh without downstream patches
f09e2e
f09e2e
* Thu Jun  9 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-6 + 0.9.2-31
f09e2e
- remove stale control sockets (#706396)
f09e2e
f09e2e
* Tue May 31 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-5 + 0.9.2-31
f09e2e
- improove entropy manuals
f09e2e
f09e2e
* Fri May 27 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-4 + 0.9.2-31
f09e2e
- improove entropy handling
f09e2e
- concat ldap patches
f09e2e
f09e2e
* Tue May 24 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-3 + 0.9.2-31
f09e2e
- improove ldap manuals
f09e2e
f09e2e
* Mon May 23 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-2 + 0.9.2-31
f09e2e
- add gssapi forced command
f09e2e
f09e2e
* Tue May  3 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-1 + 0.9.2-31
f09e2e
- update the openssh version
f09e2e
f09e2e
* Thu Apr 28 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-34 + 0.9.2-30
f09e2e
- temporarily disabling systemd units
f09e2e
f09e2e
* Wed Apr 27 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-33 + 0.9.2-30
f09e2e
- add flags AI_V4MAPPED and AI_ADDRCONFIG to getaddrinfo
f09e2e
f09e2e
* Tue Apr 26 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-32 + 0.9.2-30
f09e2e
- update scriptlets
f09e2e
f09e2e
* Fri Apr 22 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-30 + 0.9.2-30
f09e2e
- add systemd units
f09e2e
f09e2e
* Fri Apr 22 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-28 + 0.9.2-30
f09e2e
- improving sshd -> passwd transation
f09e2e
- add template for .local domain to sshd_config
f09e2e
f09e2e
* Thu Apr 21 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-27 + 0.9.2-30
f09e2e
- the private keys may be 640 root:ssh_keys ssh_keysign is sgid
f09e2e
f09e2e
* Wed Apr 20 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-26 + 0.9.2-30
f09e2e
- improving sshd -> passwd transation
f09e2e
f09e2e
* Tue Apr  5 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-25 + 0.9.2-30
f09e2e
- the intermediate context is set to sshd_sftpd_t
f09e2e
- do not crash in packet.c if no connection
f09e2e
f09e2e
* Thu Mar 31 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-24 + 0.9.2-30
f09e2e
- resolve warnings in port_linux.c
f09e2e
f09e2e
* Tue Mar 29 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-23 + 0.9.2-30
f09e2e
- add /etc/sysconfig/sshd
f09e2e
f09e2e
* Mon Mar 28 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-22 + 0.9.2-30
f09e2e
- improve reseeding and seed source (documentation)
f09e2e
f09e2e
* Tue Mar 22 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-20 + 0.9.2-30
f09e2e
- use /dev/random or /dev/urandom for seeding prng
f09e2e
- improve periodical reseeding of random generator
f09e2e
f09e2e
* Thu Mar 17 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-18 + 0.9.2-30
f09e2e
- add periodical reseeding of random generator 
f09e2e
- change selinux contex for internal sftp in do_usercontext
f09e2e
- exit(0) after sigterm
f09e2e
f09e2e
* Thu Mar 10 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-17 + 0.9.2-30
f09e2e
- improove ssh-ldap (documentation)
f09e2e
f09e2e
* Tue Mar  8 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-16 + 0.9.2-30
f09e2e
- improve session keys audit
f09e2e
f09e2e
* Mon Mar  7 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-15 + 0.9.2-30
f09e2e
- CVE-2010-4755
f09e2e
f09e2e
* Fri Mar  4 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-14 + 0.9.2-30
f09e2e
- improove ssh-keycat (documentation)
f09e2e
f09e2e
* Thu Mar  3 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-13 + 0.9.2-30
f09e2e
- improve audit of logins and auths
f09e2e
f09e2e
* Tue Mar  1 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-12 + 0.9.2-30
f09e2e
- improove ssk-keycat
f09e2e
f09e2e
* Mon Feb 28 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-11 + 0.9.2-30
f09e2e
- add ssk-keycat
f09e2e
f09e2e
* Fri Feb 25 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-10 + 0.9.2-30
f09e2e
- reenable auth-keys ldap backend
f09e2e
f09e2e
* Fri Feb 25 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-9 + 0.9.2-30
f09e2e
- another audit improovements
f09e2e
f09e2e
* Thu Feb 24 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-8 + 0.9.2-30
f09e2e
- another audit improovements
f09e2e
- switchable fingerprint mode
f09e2e
f09e2e
* Thu Feb 17 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-4 + 0.9.2-30
f09e2e
- improve audit of server key management
f09e2e
f09e2e
* Wed Feb 16 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-3 + 0.9.2-30
f09e2e
- improve audit of logins and auths
f09e2e
f09e2e
* Mon Feb 14 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-1 + 0.9.2-30
f09e2e
- bump openssh version to 5.8p1
f09e2e
f09e2e
* Tue Feb 08 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 5.6p1-30.1
f09e2e
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
f09e2e
f09e2e
* Mon Feb  7 2011 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-30 + 0.9.2-29
f09e2e
- clean the data structures in the non privileged process
f09e2e
- clean the data structures when roaming
f09e2e
f09e2e
* Wed Feb  2 2011 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-28 + 0.9.2-29
f09e2e
- clean the data structures in the privileged process
f09e2e
f09e2e
* Tue Jan 25 2011 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-25 + 0.9.2-29
f09e2e
- clean the data structures before exit net process
f09e2e
f09e2e
* Mon Jan 17 2011 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-24 + 0.9.2-29
f09e2e
- make audit compatible with the fips mode
f09e2e
f09e2e
* Fri Jan 14 2011 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-23 + 0.9.2-29
f09e2e
- add audit of destruction the server keys
f09e2e
f09e2e
* Wed Jan 12 2011 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-22 + 0.9.2-29
f09e2e
- add audit of destruction the session keys
f09e2e
f09e2e
* Fri Dec 10 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-21 + 0.9.2-29
f09e2e
- reenable run sshd as non root user
f09e2e
- renable rekeying
f09e2e
f09e2e
* Wed Nov 24 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-20 + 0.9.2-29
f09e2e
- reapair clientloop crash (#627332)
f09e2e
- properly restore euid in case connect to the ssh-agent socket fails
f09e2e
f09e2e
* Mon Nov 22 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-19 + 0.9.2-28
f09e2e
- striped read permissions from suid and sgid binaries
f09e2e
f09e2e
* Mon Nov 15 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-18 + 0.9.2-27
f09e2e
- used upstream version of the biguid patch
f09e2e
f09e2e
* Mon Nov 15 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-17 + 0.9.2-27
f09e2e
- improoved kuserok patch
f09e2e
f09e2e
* Fri Nov  5 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-16 + 0.9.2-27
f09e2e
- add auditing the host based key ussage
f09e2e
- repait X11 abstract layer socket (#648896)
f09e2e
f09e2e
* Wed Nov  3 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-15 + 0.9.2-27
f09e2e
- add auditing the kex result
f09e2e
f09e2e
* Tue Nov  2 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-14 + 0.9.2-27
f09e2e
- add auditing the key ussage
f09e2e
f09e2e
* Wed Oct 20 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-12 + 0.9.2-27
f09e2e
- update gsskex patch (#645389)
f09e2e
f09e2e
* Wed Oct 20 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-11 + 0.9.2-27
f09e2e
- rebase linux audit according to upstream
f09e2e
f09e2e
* Fri Oct  1 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-10 + 0.9.2-27
f09e2e
- add missing headers to linux audit
f09e2e
f09e2e
* Wed Sep 29 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-9 + 0.9.2-27
f09e2e
- audit module now uses openssh audit framevork
f09e2e
f09e2e
* Wed Sep 15 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-8 + 0.9.2-27
f09e2e
- Add the GSSAPI kuserok switch to the kuserok patch
f09e2e
f09e2e
* Wed Sep 15 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-7 + 0.9.2-27
f09e2e
- Repaired the kuserok patch
f09e2e
f09e2e
* Mon Sep 13 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-6 + 0.9.2-27
f09e2e
- Repaired the problem with puting entries with very big uid into lastlog
f09e2e
f09e2e
* Mon Sep 13 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-5 + 0.9.2-27
f09e2e
- Merging selabel patch with the upstream version. (#632914)
f09e2e
f09e2e
* Mon Sep 13 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-4 + 0.9.2-27
f09e2e
- Tweaking selabel patch to work properly without selinux rules loaded. (#632914)
f09e2e
f09e2e
* Wed Sep  8 2010 Tomas Mraz <tmraz@redhat.com> - 5.6p1-3 + 0.9.2-27
f09e2e
- Make fipscheck hmacs compliant with FHS - requires new fipscheck
f09e2e
f09e2e
* Fri Sep  3 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-2 + 0.9.2-27
f09e2e
- Added -z relro -z now to LDFLAGS
f09e2e
f09e2e
* Fri Sep  3 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-1 + 0.9.2-27
f09e2e
- Rebased to openssh5.6p1
f09e2e
f09e2e
* Wed Jul  7 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-18 + 0.9.2-26
f09e2e
- merged with newer bugzilla's version of authorized keys command patch
f09e2e
f09e2e
* Wed Jun 30 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-17 + 0.9.2-26
f09e2e
- improved the x11 patch according to upstream (#598671)
f09e2e
f09e2e
* Fri Jun 25 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-16 + 0.9.2-26
f09e2e
- improved the x11 patch (#598671)
f09e2e
f09e2e
* Thu Jun 24 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-15 + 0.9.2-26
f09e2e
- changed _PATH_UNIX_X to unexistent file name (#598671)
f09e2e
f09e2e
* Wed Jun 23 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-14 + 0.9.2-26
f09e2e
- sftp works in deviceless chroot again (broken from 5.5p1-3)
f09e2e
f09e2e
* Tue Jun  8 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-13 + 0.9.2-26
f09e2e
- add option to switch out krb5_kuserok
f09e2e
f09e2e
* Fri May 21 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-12 + 0.9.2-26
f09e2e
- synchronize uid and gid for the user sshd
f09e2e
f09e2e
* Thu May 20 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-11 + 0.9.2-26
f09e2e
- Typo in ssh-ldap.conf(5) and ssh-ladap-helper(8)
f09e2e
f09e2e
* Fri May 14 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-10 + 0.9.2-26
f09e2e
- Repair the reference in man ssh-ldap-helper(8)
f09e2e
- Repair the PubkeyAgent section in sshd_config(5)
f09e2e
- Provide example ldap.conf
f09e2e
f09e2e
* Thu May 13 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-9 + 0.9.2-26
f09e2e
- Make the Ldap configuration widely compatible
f09e2e
- create the aditional docs for LDAP support.
f09e2e
f09e2e
* Thu May  6 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-8 + 0.9.2-26
f09e2e
- Make LDAP config elements TLS_CACERT and TLS_REQCERT compatiple with pam_ldap (#589360)
f09e2e
f09e2e
* Thu May  6 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-7 + 0.9.2-26
f09e2e
- Make LDAP config element tls_checkpeer compatiple with nss_ldap (#589360)
f09e2e
f09e2e
* Tue May  4 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-6 + 0.9.2-26
f09e2e
- Comment spec.file
f09e2e
- Sync patches from upstream
f09e2e
f09e2e
* Mon May  3 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-5 + 0.9.2-26
f09e2e
- Create separate ldap package
f09e2e
- Tweak the ldap patch
f09e2e
- Rename stderr patch properly
f09e2e
f09e2e
* Thu Apr 29 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-4 + 0.9.2-26
f09e2e
- Added LDAP support
f09e2e
f09e2e
* Mon Apr 26 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-3 + 0.9.2-26
f09e2e
- Ignore .bashrc output to stderr in the subsystems
f09e2e
f09e2e
* Tue Apr 20 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-2 + 0.9.2-26
f09e2e
- Drop dependency on man
f09e2e
f09e2e
* Fri Apr 16 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-1 + 0.9.2-26
f09e2e
- Update to 5.5p1
f09e2e
f09e2e
* Fri Mar 12 2010 Jan F. Chadima <jchadima@redhat.com> - 5.4p1-3 + 0.9.2-25
f09e2e
- repair configure script of pam_ssh_agent
f09e2e
- repair error mesage in ssh-keygen
f09e2e
f09e2e
* Fri Mar 12 2010 Jan F. Chadima <jchadima@redhat.com> - 5.4p1-2
f09e2e
- source krb5-devel profile script only if exists
f09e2e
f09e2e
* Tue Mar  9 2010 Jan F. Chadima <jchadima@redhat.com> - 5.4p1-1
f09e2e
- Update to 5.4p1
f09e2e
- discontinued support for nss-keys
f09e2e
- discontinued support for scard
f09e2e
f09e2e
* Wed Mar  3 2010 Jan F. Chadima <jchadima@redhat.com> - 5.4p1-0.snap20100302.1
f09e2e
- Prepare update to 5.4p1
f09e2e
f09e2e
* Mon Feb 15 2010 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-22
f09e2e
- ImplicitDSOLinking (#564824)
f09e2e
f09e2e
* Fri Jan 29 2010 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-21
f09e2e
- Allow to use hardware crypto if awailable (#559555)
f09e2e
f09e2e
* Mon Jan 25 2010 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-20
f09e2e
- optimized FD_CLOEXEC on accept socket (#541809)
f09e2e
f09e2e
* Mon Jan 25 2010 Tomas Mraz <tmraz@redhat.com> - 5.3p1-19
f09e2e
- updated pam_ssh_agent_auth to new version from upstream (just
f09e2e
  a licence change)
f09e2e
f09e2e
* Thu Jan 21 2010 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-18
f09e2e
- optimized RAND_cleanup patch (#557166)
f09e2e
f09e2e
* Wed Jan 20 2010 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-17
f09e2e
- add RAND_cleanup at the exit of each program using RAND (#557166)
f09e2e
f09e2e
* Tue Jan 19 2010 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-16
f09e2e
- set FD_CLOEXEC on accepted socket (#541809)
f09e2e
f09e2e
* Fri Jan  8 2010 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-15
f09e2e
- replaced define by global in macros
f09e2e
f09e2e
* Tue Jan  5 2010 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-14
f09e2e
- Update the pka patch
f09e2e
f09e2e
* Mon Dec 21 2009 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-13
f09e2e
- Update the audit patch
f09e2e
f09e2e
* Fri Dec  4 2009 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-12
f09e2e
- Add possibility to autocreate only RSA key into initscript (#533339)
f09e2e
f09e2e
* Fri Nov 27 2009 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-11
f09e2e
- Prepare NSS key patch for future SEC_ERROR_LOCKED_PASSWORD (#537411)
f09e2e
f09e2e
* Tue Nov 24 2009 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-10
f09e2e
- Update NSS key patch (#537411, #356451)
f09e2e
f09e2e
* Fri Nov 20 2009 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-9
f09e2e
- Add gssapi key exchange patch (#455351)
f09e2e
f09e2e
* Fri Nov 20 2009 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-8
f09e2e
- Add public key agent patch (#455350)
f09e2e
f09e2e
* Mon Nov  2 2009 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-7
f09e2e
- Repair canohost patch to allow gssapi to work when host is acessed via pipe proxy (#531849)
f09e2e
f09e2e
* Thu Oct 29 2009 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-6
f09e2e
- Modify the init script to prevent it to hang during generating the keys (#515145)
f09e2e
f09e2e
* Tue Oct 27 2009 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-5
f09e2e
- Add README.nss
f09e2e
f09e2e
* Mon Oct 19 2009 Tomas Mraz <tmraz@redhat.com> - 5.3p1-4
f09e2e
- Add pam_ssh_agent_auth module to a subpackage.
f09e2e
f09e2e
* Fri Oct 16 2009 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-3
f09e2e
- Reenable audit.
f09e2e
f09e2e
* Fri Oct  2 2009 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-2
f09e2e
- Upgrade to new wersion 5.3p1
f09e2e
f09e2e
* Tue Sep 29 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-29
f09e2e
- Resolve locking in ssh-add (#491312)
f09e2e
f09e2e
* Thu Sep 24 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-28
f09e2e
- Repair initscript to be acord to guidelines (#521860)
f09e2e
- Add bugzilla# to application of edns and xmodifiers patch
f09e2e
f09e2e
* Wed Sep 16 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-26
f09e2e
- Changed pam stack to password-auth
f09e2e
f09e2e
* Fri Sep 11 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-25
f09e2e
- Dropped homechroot patch
f09e2e
f09e2e
* Mon Sep  7 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-24
f09e2e
- Add check for nosuid, nodev in homechroot
f09e2e
f09e2e
* Tue Sep  1 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-23
f09e2e
- add correct patch for ip-opts
f09e2e
f09e2e
* Tue Sep  1 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-22
f09e2e
- replace ip-opts patch by an upstream candidate version
f09e2e
f09e2e
* Mon Aug 31 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-21
f09e2e
- rearange selinux patch to be acceptable for upstream
f09e2e
- replace seftp patch by an upstream version
f09e2e
f09e2e
* Fri Aug 28 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-20
f09e2e
- merged xmodifiers to redhat patch
f09e2e
- merged gssapi-role to selinux patch
f09e2e
- merged cve-2007_3102 to audit patch
f09e2e
- sesftp patch only with WITH_SELINUX flag
f09e2e
- rearange sesftp patch according to upstream request
f09e2e
f09e2e
* Wed Aug 26 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-19
f09e2e
- minor change in sesftp patch
f09e2e
f09e2e
* Fri Aug 21 2009 Tomas Mraz <tmraz@redhat.com> - 5.2p1-18
f09e2e
- rebuilt with new openssl
f09e2e
f09e2e
* Thu Jul 30 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-17
f09e2e
- Added dnssec support. (#205842)
f09e2e
f09e2e
* Sat Jul 25 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 5.2p1-16
f09e2e
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
f09e2e
f09e2e
* Fri Jul 24 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-15
f09e2e
- only INTERNAL_SFTP can be home-chrooted
f09e2e
- save _u and _r parts of context changing to sftpd_t
f09e2e
f09e2e
* Fri Jul 17 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-14
f09e2e
- changed internal-sftp context to sftpd_t
f09e2e
f09e2e
* Fri Jul  3 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-13
f09e2e
- changed home length path patch to upstream version
f09e2e
f09e2e
* Tue Jun 30 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-12
f09e2e
- create '~/.ssh/known_hosts' within proper context
f09e2e
f09e2e
* Mon Jun 29 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-11
f09e2e
- length of home path in ssh now limited by PATH_MAX
f09e2e
- correct timezone with daylight processing
f09e2e
f09e2e
* Sat Jun 27 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-10
f09e2e
- final version chroot %%h (sftp only)
f09e2e
f09e2e
* Tue Jun 23 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-9
f09e2e
- repair broken ls in chroot %%h
f09e2e
f09e2e
* Fri Jun 12 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-8
f09e2e
- add XMODIFIERS to exported environment (#495690)
f09e2e
f09e2e
* Fri May 15 2009 Tomas Mraz <tmraz@redhat.com> - 5.2p1-6
f09e2e
- allow only protocol 2 in the FIPS mode
f09e2e
f09e2e
* Thu Apr 30 2009 Tomas Mraz <tmraz@redhat.com> - 5.2p1-5
f09e2e
- do integrity verification only on binaries which are part
f09e2e
  of the OpenSSH FIPS modules
f09e2e
f09e2e
* Mon Apr 20 2009 Tomas Mraz <tmraz@redhat.com> - 5.2p1-4
f09e2e
- log if FIPS mode is initialized
f09e2e
- make aes-ctr cipher modes work in the FIPS mode
f09e2e
f09e2e
* Fri Apr  3 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-3
f09e2e
- fix logging after chroot
f09e2e
- enable non root users to use chroot %%h in internal-sftp
f09e2e
f09e2e
* Fri Mar 13 2009 Tomas Mraz <tmraz@redhat.com> - 5.2p1-2
f09e2e
- add AES-CTR ciphers to the FIPS mode proposal
f09e2e
f09e2e
* Mon Mar  9 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-1
f09e2e
- upgrade to new upstream release
f09e2e
f09e2e
* Thu Feb 26 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 5.1p1-8
f09e2e
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
f09e2e
f09e2e
* Thu Feb 12 2009 Tomas Mraz <tmraz@redhat.com> - 5.1p1-7
f09e2e
- drop obsolete triggers
f09e2e
- add testing FIPS mode support
f09e2e
- LSBize the initscript (#247014)
f09e2e
f09e2e
* Fri Jan 30 2009 Tomas Mraz <tmraz@redhat.com> - 5.1p1-6
f09e2e
- enable use of ssl engines (#481100)
f09e2e
f09e2e
* Thu Jan 15 2009 Tomas Mraz <tmraz@redhat.com> - 5.1p1-5
f09e2e
- remove obsolete --with-rsh (#478298)
f09e2e
- add pam_sepermit to allow blocking confined users in permissive mode
f09e2e
  (#471746)
f09e2e
- move system-auth after pam_selinux in the session stack
f09e2e
f09e2e
* Thu Dec 11 2008 Tomas Mraz <tmraz@redhat.com> - 5.1p1-4
f09e2e
- set FD_CLOEXEC on channel sockets (#475866)
f09e2e
- adjust summary
f09e2e
- adjust nss-keys patch so it is applicable without selinux patches (#470859)
f09e2e
f09e2e
* Fri Oct 17 2008 Tomas Mraz <tmraz@redhat.com> - 5.1p1-3
f09e2e
- fix compatibility with some servers (#466818)
f09e2e
f09e2e
* Thu Jul 31 2008 Tomas Mraz <tmraz@redhat.com> - 5.1p1-2
f09e2e
- fixed zero length banner problem (#457326)
f09e2e
f09e2e
* Wed Jul 23 2008 Tomas Mraz <tmraz@redhat.com> - 5.1p1-1
f09e2e
- upgrade to new upstream release
f09e2e
- fixed a problem with public key authentication and explicitely
f09e2e
  specified SELinux role
f09e2e
f09e2e
* Wed May 21 2008 Tomas Mraz <tmraz@redhat.com> - 5.0p1-3
f09e2e
- pass the connection socket to ssh-keysign (#447680)
f09e2e
f09e2e
* Mon May 19 2008 Tomas Mraz <tmraz@redhat.com> - 5.0p1-2
f09e2e
- add LANGUAGE to accepted/sent environment variables (#443231)
f09e2e
- use pam_selinux to obtain the user context instead of doing it itself
f09e2e
- unbreak server keep alive settings (patch from upstream)
f09e2e
- small addition to scp manpage
f09e2e
f09e2e
* Mon Apr  7 2008 Tomas Mraz <tmraz@redhat.com> - 5.0p1-1
f09e2e
- upgrade to new upstream (#441066)
f09e2e
- prevent initscript from killing itself on halt with upstart (#438449)
f09e2e
- initscript status should show that the daemon is running
f09e2e
  only when the main daemon is still alive (#430882)
f09e2e
f09e2e
* Thu Mar  6 2008 Tomas Mraz <tmraz@redhat.com> - 4.7p1-10
f09e2e
- fix race on control master and cleanup stale control socket (#436311)
f09e2e
  patches by David Woodhouse
f09e2e
f09e2e
* Fri Feb 29 2008 Tomas Mraz <tmraz@redhat.com> - 4.7p1-9
f09e2e
- set FD_CLOEXEC on client socket
f09e2e
- apply real fix for window size problem (#286181) from upstream
f09e2e
- apply fix for the spurious failed bind from upstream
f09e2e
- apply open handle leak in sftp fix from upstream
f09e2e
f09e2e
* Tue Feb 12 2008 Dennis Gilmore <dennis@ausil.us> - 4.7p1-8
f09e2e
- we build for sparcv9 now  and it needs -fPIE
f09e2e
f09e2e
* Thu Jan  3 2008 Tomas Mraz <tmraz@redhat.com> - 4.7p1-7
f09e2e
- fix gssapi auth with explicit selinux role requested (#427303) - patch
f09e2e
  by Nalin Dahyabhai
f09e2e
f09e2e
* Tue Dec  4 2007 Tomas Mraz <tmraz@redhat.com> - 4.7p1-6
f09e2e
- explicitly source krb5-devel profile script
f09e2e
f09e2e
* Tue Dec 04 2007 Release Engineering <rel-eng at fedoraproject dot org> - 4.7p1-5
f09e2e
- Rebuild for openssl bump
f09e2e
f09e2e
* Tue Nov 20 2007 Tomas Mraz <tmraz@redhat.com> - 4.7p1-4
f09e2e
- do not copy /etc/localtime into the chroot as it is not
f09e2e
  necessary anymore (#193184)
f09e2e
- call setkeycreatecon when selinux context is established
f09e2e
- test for NULL privk when freeing key (#391871) - patch by
f09e2e
  Pierre Ossman
f09e2e
f09e2e
* Mon Sep 17 2007 Tomas Mraz <tmraz@redhat.com> - 4.7p1-2
f09e2e
- revert default window size adjustments (#286181)
f09e2e
f09e2e
* Thu Sep  6 2007 Tomas Mraz <tmraz@redhat.com> - 4.7p1-1
f09e2e
- upgrade to latest upstream
f09e2e
- use libedit in sftp (#203009)
f09e2e
- fixed audit log injection problem (CVE-2007-3102)
f09e2e
f09e2e
* Thu Aug  9 2007 Tomas Mraz <tmraz@redhat.com> - 4.5p1-8
f09e2e
- fix sftp client problems on write error (#247802)
f09e2e
- allow disabling autocreation of server keys (#235466)
f09e2e
f09e2e
* Wed Jun 20 2007 Tomas Mraz <tmraz@redhat.com> - 4.5p1-7
f09e2e
- experimental NSS keys support
f09e2e
- correctly setup context when empty level requested (#234951)
f09e2e
f09e2e
* Tue Mar 20 2007 Tomas Mraz <tmraz@redhat.com> - 4.5p1-6
f09e2e
- mls level check must be done with default role same as requested
f09e2e
f09e2e
* Mon Mar 19 2007 Tomas Mraz <tmraz@redhat.com> - 4.5p1-5
f09e2e
- make profile.d/gnome-ssh-askpass.* regular files (#226218)
f09e2e
f09e2e
* Tue Feb 27 2007 Tomas Mraz <tmraz@redhat.com> - 4.5p1-4
f09e2e
- reject connection if requested mls range is not obtained (#229278)
f09e2e
f09e2e
* Thu Feb 22 2007 Tomas Mraz <tmraz@redhat.com> - 4.5p1-3
f09e2e
- improve Buildroot
f09e2e
- remove duplicate /etc/ssh from files
f09e2e
f09e2e
* Tue Jan 16 2007 Tomas Mraz <tmraz@redhat.com> - 4.5p1-2
f09e2e
- support mls on labeled networks (#220487)
f09e2e
- support mls level selection on unlabeled networks
f09e2e
- allow / in usernames in scp (only beginning /, ./, and ../ is special) 
f09e2e
f09e2e
* Thu Dec 21 2006 Tomas Mraz <tmraz@redhat.com> - 4.5p1-1
f09e2e
- update to 4.5p1 (#212606)
f09e2e
f09e2e
* Thu Nov 30 2006 Tomas Mraz <tmraz@redhat.com> - 4.3p2-14
f09e2e
- fix gssapi with DNS loadbalanced clusters (#216857)
f09e2e
f09e2e
* Tue Nov 28 2006 Tomas Mraz <tmraz@redhat.com> - 4.3p2-13
f09e2e
- improved pam_session patch so it doesn't regress, the patch is necessary
f09e2e
  for the pam_session_close to be called correctly as uid 0
f09e2e
f09e2e
* Fri Nov 10 2006 Tomas Mraz <tmraz@redhat.com> - 4.3p2-12
f09e2e
- CVE-2006-5794 - properly detect failed key verify in monitor (#214641)
f09e2e
f09e2e
* Thu Nov  2 2006 Tomas Mraz <tmraz@redhat.com> - 4.3p2-11
f09e2e
- merge sshd initscript patches
f09e2e
- kill all ssh sessions when stop is called in halt or reboot runlevel
f09e2e
- remove -TERM option from killproc so we don't race on sshd restart
f09e2e
f09e2e
* Mon Oct  2 2006 Tomas Mraz <tmraz@redhat.com> - 4.3p2-10
f09e2e
- improve gssapi-no-spnego patch (#208102)
f09e2e
- CVE-2006-4924 - prevent DoS on deattack detector (#207957)
f09e2e
- CVE-2006-5051 - don't call cleanups from signal handler (#208459)
f09e2e
f09e2e
* Wed Aug 23 2006 Tomas Mraz <tmraz@redhat.com> - 4.3p2-9
f09e2e
- don't report duplicate syslog messages, use correct local time (#189158)
f09e2e
- don't allow spnego as gssapi mechanism (from upstream)
f09e2e
- fixed memleaks found by Coverity (from upstream)
f09e2e
- allow ip options except source routing (#202856) (patch by HP)
f09e2e
f09e2e
* Tue Aug  8 2006 Tomas Mraz <tmraz@redhat.com> - 4.3p2-8
f09e2e
- drop the pam-session patch from the previous build (#201341)
f09e2e
- don't set IPV6_V6ONLY sock opt when listening on wildcard addr (#201594)
f09e2e
f09e2e
* Thu Jul 20 2006 Tomas Mraz <tmraz@redhat.com> - 4.3p2-7
f09e2e
- dropped old ssh obsoletes
f09e2e
- call the pam_session_open/close from the monitor when privsep is
f09e2e
  enabled so it is always called as root (patch by Darren Tucker)
f09e2e
f09e2e
* Mon Jul 17 2006 Tomas Mraz <tmraz@redhat.com> - 4.3p2-6
f09e2e
- improve selinux patch (by Jan Kiszka)
f09e2e
- upstream patch for buffer append space error (#191940)
f09e2e
- fixed typo in configure.ac (#198986)
f09e2e
- added pam_keyinit to pam configuration (#198628)
f09e2e
- improved error message when askpass dialog cannot grab
f09e2e
  keyboard input (#198332)
f09e2e
- buildrequires xauth instead of xorg-x11-xauth
f09e2e
- fixed a few rpmlint warnings
f09e2e
f09e2e
* Wed Jul 12 2006 Jesse Keating <jkeating@redhat.com> - 4.3p2-5.1
f09e2e
- rebuild
f09e2e
f09e2e
* Fri Apr 14 2006 Tomas Mraz <tmraz@redhat.com> - 4.3p2-5
f09e2e
- don't request pseudoterminal allocation if stdin is not tty (#188983)
f09e2e
f09e2e
* Thu Mar  2 2006 Tomas Mraz <tmraz@redhat.com> - 4.3p2-4
f09e2e
- allow access if audit is not compiled in kernel (#183243)
f09e2e
f09e2e
* Fri Feb 24 2006 Tomas Mraz <tmraz@redhat.com> - 4.3p2-3
f09e2e
- enable the subprocess in chroot to send messages to system log
f09e2e
- sshd should prevent login if audit call fails
f09e2e
f09e2e
* Tue Feb 21 2006 Tomas Mraz <tmraz@redhat.com> - 4.3p2-2
f09e2e
- print error from scp if not remote (patch by Bjorn Augustsson #178923)
f09e2e
f09e2e
* Mon Feb 13 2006 Tomas Mraz <tmraz@redhat.com> - 4.3p2-1
f09e2e
- new version
f09e2e
f09e2e
* Fri Feb 10 2006 Jesse Keating <jkeating@redhat.com> - 4.3p1-2.1
f09e2e
- bump again for double-long bug on ppc(64)
f09e2e
f09e2e
* Mon Feb  6 2006 Tomas Mraz <tmraz@redhat.com> - 4.3p1-2
f09e2e
- fixed another place where syslog was called in signal handler
f09e2e
- pass locale environment variables to server, accept them there (#179851)
f09e2e
f09e2e
* Wed Feb  1 2006 Tomas Mraz <tmraz@redhat.com> - 4.3p1-1
f09e2e
- new version, dropped obsolete patches
f09e2e
f09e2e
* Tue Dec 20 2005 Tomas Mraz <tmraz@redhat.com> - 4.2p1-10
f09e2e
- hopefully make the askpass dialog less confusing (#174765)
f09e2e
f09e2e
* Fri Dec 09 2005 Jesse Keating <jkeating@redhat.com>
f09e2e
- rebuilt
f09e2e
f09e2e
* Tue Nov 22 2005 Tomas Mraz <tmraz@redhat.com> - 4.2p1-9
f09e2e
- drop x11-ssh-askpass from the package
f09e2e
- drop old build_6x ifs from spec file
f09e2e
- improve gnome-ssh-askpass so it doesn't reveal number of passphrase 
f09e2e
  characters to person looking at the display
f09e2e
- less hackish fix for the __USE_GNU problem
f09e2e
f09e2e
* Fri Nov 18 2005 Nalin Dahyabhai <nalin@redhat.com> - 4.2p1-8
f09e2e
- work around missing gccmakedep by wrapping makedepend in a local script
f09e2e
- remove now-obsolete build dependency on "xauth"
f09e2e
f09e2e
* Thu Nov 17 2005 Warren Togami <wtogami@redhat.com> - 4.2p1-7
f09e2e
- xorg-x11-devel -> libXt-devel
f09e2e
- rebuild for new xauth location so X forwarding works
f09e2e
- buildreq audit-libs-devel
f09e2e
- buildreq automake for aclocal
f09e2e
- buildreq imake for xmkmf
f09e2e
-  -D_GNU_SOURCE in flags in order to get it to build
f09e2e
   Ugly hack to workaround openssh defining __USE_GNU which is
f09e2e
   not allowed and causes problems according to Ulrich Drepper
f09e2e
   fix this the correct way after FC5test1
f09e2e
f09e2e
* Wed Nov  9 2005 Jeremy Katz <katzj@redhat.com> - 4.2p1-6
f09e2e
- rebuild against new openssl
f09e2e
f09e2e
* Fri Oct 28 2005 Tomas Mraz <tmraz@redhat.com> 4.2p1-5
f09e2e
- put back the possibility to skip SELinux patch
f09e2e
- add patch for user login auditing by Steve Grubb
f09e2e
f09e2e
* Tue Oct 18 2005 Dan Walsh <dwalsh@redhat.com> 4.2p1-4
f09e2e
- Change selinux patch to use get_default_context_with_rolelevel in libselinux.
f09e2e
f09e2e
* Thu Oct 13 2005 Tomas Mraz <tmraz@redhat.com> 4.2p1-3
f09e2e
- Update selinux patch to use getseuserbyname
f09e2e
f09e2e
* Fri Oct  7 2005 Tomas Mraz <tmraz@redhat.com> 4.2p1-2
f09e2e
- use include instead of pam_stack in pam config
f09e2e
- use fork+exec instead of system in scp - CVE-2006-0225 (#168167)
f09e2e
- upstream patch for displaying authentication errors
f09e2e
f09e2e
* Tue Sep 06 2005 Tomas Mraz <tmraz@redhat.com> 4.2p1-1
f09e2e
- upgrade to a new upstream version
f09e2e
f09e2e
* Tue Aug 16 2005 Tomas Mraz <tmraz@redhat.com> 4.1p1-5
f09e2e
- use x11-ssh-askpass if openssh-askpass-gnome is not installed (#165207)
f09e2e
- install ssh-copy-id from contrib (#88707)
f09e2e
f09e2e
* Wed Jul 27 2005 Tomas Mraz <tmraz@redhat.com> 4.1p1-4
f09e2e
- don't deadlock on exit with multiple X forwarded channels (#152432)
f09e2e
- don't use X11 port which can't be bound on all IP families (#163732)
f09e2e
f09e2e
* Wed Jun 29 2005 Tomas Mraz <tmraz@redhat.com> 4.1p1-3
f09e2e
- fix small regression caused by the nologin patch (#161956)
f09e2e
- fix race in getpeername error checking (mindrot #1054)
f09e2e
f09e2e
* Thu Jun  9 2005 Tomas Mraz <tmraz@redhat.com> 4.1p1-2
f09e2e
- use only pam_nologin for nologin testing
f09e2e
f09e2e
* Mon Jun  6 2005 Tomas Mraz <tmraz@redhat.com> 4.1p1-1
f09e2e
- upgrade to a new upstream version
f09e2e
- call pam_loginuid as a pam session module
f09e2e
f09e2e
* Mon May 16 2005 Tomas Mraz <tmraz@redhat.com> 4.0p1-3
f09e2e
- link libselinux only to sshd (#157678)
f09e2e
f09e2e
* Mon Apr  4 2005 Tomas Mraz <tmraz@redhat.com> 4.0p1-2
f09e2e
- fixed Local/RemoteForward in ssh_config.5 manpage
f09e2e
- fix fatal when Local/RemoteForward is used and scp run (#153258)
f09e2e
- don't leak user validity when using krb5 authentication
f09e2e
f09e2e
* Thu Mar 24 2005 Tomas Mraz <tmraz@redhat.com> 4.0p1-1
f09e2e
- upgrade to 4.0p1
f09e2e
- remove obsolete groups patch
f09e2e
f09e2e
* Wed Mar 16 2005 Elliot Lee <sopwith@redhat.com>
f09e2e
- rebuilt
f09e2e
f09e2e
* Mon Feb 28 2005 Nalin Dahyabhai <nalin@redhat.com> 3.9p1-12
f09e2e
- rebuild so that configure can detect that krb5_init_ets is gone now
f09e2e
f09e2e
* Mon Feb 21 2005 Tomas Mraz <tmraz@redhat.com> 3.9p1-11
f09e2e
- don't call syslog in signal handler
f09e2e
- allow password authentication when copying from remote
f09e2e
  to remote machine (#103364)
f09e2e
f09e2e
* Wed Feb  9 2005 Tomas Mraz <tmraz@redhat.com>
f09e2e
- add spaces to messages in initscript (#138508)
f09e2e
f09e2e
* Tue Feb  8 2005 Tomas Mraz <tmraz@redhat.com> 3.9p1-10
f09e2e
- enable trusted forwarding by default if X11 forwarding is 
f09e2e
  required by user (#137685 and duplicates)
f09e2e
- disable protocol 1 support by default in sshd server config (#88329)
f09e2e
- keep the gnome-askpass dialog above others (#69131)
f09e2e
f09e2e
* Fri Feb  4 2005 Tomas Mraz <tmraz@redhat.com>
f09e2e
- change permissions on pam.d/sshd to 0644 (#64697)
f09e2e
- patch initscript so it doesn't kill opened sessions if
f09e2e
  the sshd daemon isn't running anymore (#67624)
f09e2e
f09e2e
* Mon Jan  3 2005 Bill Nottingham <notting@redhat.com> 3.9p1-9
f09e2e
- don't use initlog
f09e2e
f09e2e
* Mon Nov 29 2004 Thomas Woerner <twoerner@redhat.com> 3.9p1-8.1
f09e2e
- fixed PIE build for all architectures
f09e2e
f09e2e
* Mon Oct  4 2004 Nalin Dahyabhai <nalin@redhat.com> 3.9p1-8
f09e2e
- add a --enable-vendor-patchlevel option which allows a ShowPatchLevel option
f09e2e
  to enable display of a vendor patch level during version exchange (#120285)
f09e2e
- configure with --disable-strip to build useful debuginfo subpackages
f09e2e
f09e2e
* Mon Sep 20 2004 Bill Nottingham <notting@redhat.com> 3.9p1-7
f09e2e
- when using gtk2 for askpass, don't buildprereq gnome-libs-devel
f09e2e
f09e2e
* Tue Sep 14 2004 Nalin Dahyabhai <nalin@redhat.com> 3.9p1-6
f09e2e
- build
f09e2e
f09e2e
* Mon Sep 13 2004 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- disable ACSS support
f09e2e
f09e2e
* Thu Sep 2 2004 Daniel Walsh <dwalsh@redhat.com> 3.9p1-5
f09e2e
- Change selinux patch to use get_default_context_with_role in libselinux.
f09e2e
f09e2e
* Thu Sep 2 2004 Daniel Walsh <dwalsh@redhat.com> 3.9p1-4
f09e2e
- Fix patch
f09e2e
	* Bad debug statement.
f09e2e
	* Handle root/sysadm_r:kerberos
f09e2e
f09e2e
* Thu Sep 2 2004 Daniel Walsh <dwalsh@redhat.com> 3.9p1-3
f09e2e
- Modify Colin Walter's patch to allow specifying rule during connection
f09e2e
f09e2e
* Tue Aug 31 2004 Daniel Walsh <dwalsh@redhat.com> 3.9p1-2
f09e2e
- Fix TTY handling for SELinux
f09e2e
f09e2e
* Tue Aug 24 2004 Daniel Walsh <dwalsh@redhat.com> 3.9p1-1
f09e2e
- Update to upstream
f09e2e
f09e2e
* Sun Aug 1 2004 Alan Cox <alan@redhat.com> 3.8.1p1-5
f09e2e
- Apply buildreq fixup patch (#125296)
f09e2e
f09e2e
* Tue Jun 15 2004 Daniel Walsh <dwalsh@redhat.com> 3.8.1p1-4
f09e2e
- Clean up patch for upstream submission.
f09e2e
f09e2e
* Tue Jun 15 2004 Elliot Lee <sopwith@redhat.com>
f09e2e
- rebuilt
f09e2e
f09e2e
* Wed Jun 9 2004 Daniel Walsh <dwalsh@redhat.com> 3.8.1p1-2
f09e2e
- Remove use of pam_selinux and patch selinux in directly.  
f09e2e
f09e2e
* Mon Jun  7 2004 Nalin Dahyabhai <nalin@redhat.com> 3.8.1p1-1
f09e2e
- request gssapi-with-mic by default but not delegation (flag day for anyone
f09e2e
  who used previous gssapi patches)
f09e2e
- no longer request x11 forwarding by default
f09e2e
f09e2e
* Thu Jun 3 2004 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-36
f09e2e
- Change pam file to use open and close with pam_selinux
f09e2e
f09e2e
* Tue Jun  1 2004 Nalin Dahyabhai <nalin@redhat.com> 3.8.1p1-0
f09e2e
- update to 3.8.1p1
f09e2e
- add workaround from CVS to reintroduce passwordauth using pam
f09e2e
f09e2e
* Tue Jun 1 2004 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-35
f09e2e
- Remove CLOSEXEC on STDERR
f09e2e
f09e2e
* Tue Mar 16 2004 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-34
f09e2e
f09e2e
* Wed Mar 03 2004 Phil Knirsch <pknirsch@redhat.com> 3.6.1p2-33.30.1
f09e2e
- Built RHLE3 U2 update package.
f09e2e
f09e2e
* Wed Mar 3 2004 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-33
f09e2e
- Close file descriptors on exec 
f09e2e
f09e2e
* Mon Mar  1 2004 Thomas Woerner <twoerner@redhat.com> 3.6.1p2-32
f09e2e
- fixed pie build
f09e2e
f09e2e
* Thu Feb 26 2004 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-31
f09e2e
- Add restorecon to startup scripts
f09e2e
f09e2e
* Thu Feb 26 2004 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-30
f09e2e
- Add multiple qualified to openssh
f09e2e
f09e2e
* Mon Feb 23 2004 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-29
f09e2e
- Eliminate selinux code and use pam_selinux
f09e2e
f09e2e
* Fri Feb 13 2004 Elliot Lee <sopwith@redhat.com>
f09e2e
- rebuilt
f09e2e
f09e2e
* Mon Jan 26 2004 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-27
f09e2e
- turn off pie on ppc
f09e2e
f09e2e
* Mon Jan 26 2004 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-26
f09e2e
- fix is_selinux_enabled
f09e2e
f09e2e
* Wed Jan 14 2004 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-25
f09e2e
- Rebuild to grab shared libselinux
f09e2e
f09e2e
* Wed Dec 3 2003 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-24
f09e2e
- turn on selinux
f09e2e
f09e2e
* Tue Nov 18 2003 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- un#ifdef out code for reporting password expiration in non-privsep
f09e2e
  mode (#83585)
f09e2e
f09e2e
* Mon Nov 10 2003 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- add machinery to build with/without -fpie/-pie, default to doing so
f09e2e
f09e2e
* Thu Nov 06 2003 David Woodhouse <dwmw2@redhat.com> 3.6.1p2-23
f09e2e
- Don't whinge about getsockopt failing (#109161)
f09e2e
f09e2e
* Fri Oct 24 2003 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- add missing buildprereq on zlib-devel (#104558)
f09e2e
f09e2e
* Mon Oct 13 2003 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-22
f09e2e
- turn selinux off
f09e2e
f09e2e
* Mon Oct 13 2003 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-21.sel
f09e2e
- turn selinux on
f09e2e
f09e2e
* Fri Sep 19 2003 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-21
f09e2e
- turn selinux off
f09e2e
f09e2e
* Fri Sep 19 2003 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-20.sel
f09e2e
- turn selinux on
f09e2e
f09e2e
* Fri Sep 19 2003 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- additional fix for apparently-never-happens double-free in buffer_free()
f09e2e
- extend fix for #103998 to cover SSH1
f09e2e
f09e2e
* Wed Sep 17 2003 Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-19
f09e2e
- rebuild
f09e2e
f09e2e
* Wed Sep 17 2003 Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-18
f09e2e
- additional buffer manipulation cleanups from Solar Designer
f09e2e
f09e2e
* Wed Sep 17 2003 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-17
f09e2e
- turn selinux off
f09e2e
f09e2e
* Wed Sep 17 2003 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-16.sel
f09e2e
- turn selinux on
f09e2e
f09e2e
* Tue Sep 16 2003 Bill Nottingham <notting@redhat.com> 3.6.1p2-15
f09e2e
- rebuild
f09e2e
f09e2e
* Tue Sep 16 2003 Bill Nottingham <notting@redhat.com> 3.6.1p2-14
f09e2e
- additional buffer manipulation fixes (CAN-2003-0695)
f09e2e
f09e2e
* Tue Sep 16 2003 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-13.sel
f09e2e
- turn selinux on
f09e2e
f09e2e
* Tue Sep 16 2003 Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-12
f09e2e
- rebuild
f09e2e
f09e2e
* Tue Sep 16 2003 Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-11
f09e2e
- apply patch to store the correct buffer size in allocated buffers
f09e2e
  (CAN-2003-0693)
f09e2e
- skip the initial PAM authentication attempt with an empty password if
f09e2e
  empty passwords are not permitted in our configuration (#103998)
f09e2e
f09e2e
* Fri Sep 5 2003 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-10
f09e2e
- turn selinux off
f09e2e
f09e2e
* Fri Sep 5 2003 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-9.sel
f09e2e
- turn selinux on
f09e2e
f09e2e
* Tue Aug 26 2003 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-8
f09e2e
- Add BuildPreReq gtk2-devel if gtk2
f09e2e
f09e2e
* Tue Aug 12 2003 Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-7
f09e2e
- rebuild
f09e2e
f09e2e
* Tue Aug 12 2003 Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-6
f09e2e
- modify patch which clears the supplemental group list at startup to only
f09e2e
  complain if setgroups() fails if sshd has euid == 0
f09e2e
- handle krb5 installed in %%{_prefix} or elsewhere by using krb5-config
f09e2e
f09e2e
* Mon Jul 28 2003 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-5
f09e2e
- Add SELinux patch
f09e2e
f09e2e
* Tue Jul 22 2003 Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-4
f09e2e
- rebuild
f09e2e
f09e2e
* Wed Jul 16 2003 Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-3
f09e2e
- rebuild
f09e2e
f09e2e
* Wed Jul 16 2003 Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-2
f09e2e
- rebuild
f09e2e
f09e2e
* Thu Jun  5 2003 Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-1
f09e2e
- update to 3.6.1p2
f09e2e
f09e2e
* Wed Jun 04 2003 Elliot Lee <sopwith@redhat.com>
f09e2e
6 rebuilt
f09e2e
f09e2e
* Mon Mar 24 2003 Florian La Roche <Florian.LaRoche@redhat.de>
f09e2e
- add patch for getsockopt() call to work on bigendian 64bit archs
f09e2e
f09e2e
* Fri Feb 14 2003 Nalin Dahyabhai <nalin@redhat.com> 3.5p1-6
f09e2e
- move scp to the -clients subpackage, because it directly depends on ssh
f09e2e
  which is also in -clients (#84329)
f09e2e
f09e2e
* Mon Feb 10 2003 Nalin Dahyabhai <nalin@redhat.com> 3.5p1-5
f09e2e
- rebuild
f09e2e
f09e2e
* Wed Jan 22 2003 Tim Powers <timp@redhat.com>
f09e2e
- rebuilt
f09e2e
f09e2e
* Tue Jan  7 2003 Nalin Dahyabhai <nalin@redhat.com> 3.5p1-3
f09e2e
- rebuild
f09e2e
f09e2e
* Tue Nov 12 2002 Nalin Dahyabhai <nalin@redhat.com> 3.5p1-2
f09e2e
- patch PAM configuration to use relative path names for the modules, allowing
f09e2e
  us to not worry about which arch the modules are built for on multilib systems
f09e2e
f09e2e
* Tue Oct 15 2002 Nalin Dahyabhai <nalin@redhat.com> 3.5p1-1
f09e2e
- update to 3.5p1, merging in filelist/perm changes from the upstream spec
f09e2e
f09e2e
* Fri Oct  4 2002 Nalin Dahyabhai <nalin@redhat.com> 3.4p1-3
f09e2e
- merge
f09e2e
f09e2e
* Thu Sep 12 2002  Than Ngo <than@redhat.com> 3.4p1-2.1
f09e2e
- fix to build on multilib systems
f09e2e
f09e2e
* Thu Aug 29 2002 Curtis Zinzilieta <curtisz@redhat.com> 3.4p1-2gss
f09e2e
- added gssapi patches and uncommented patch here
f09e2e
f09e2e
* Wed Aug 14 2002 Nalin Dahyabhai <nalin@redhat.com> 3.4p1-2
f09e2e
- pull patch from CVS to fix too-early free in ssh-keysign (#70009)
f09e2e
f09e2e
* Thu Jun 27 2002 Nalin Dahyabhai <nalin@redhat.com> 3.4p1-1
f09e2e
- 3.4p1
f09e2e
- drop anon mmap patch
f09e2e
f09e2e
* Tue Jun 25 2002 Nalin Dahyabhai <nalin@redhat.com> 3.3p1-2
f09e2e
- rework the close-on-exit docs
f09e2e
- include configuration file man pages
f09e2e
- make use of nologin as the privsep shell optional
f09e2e
f09e2e
* Mon Jun 24 2002 Nalin Dahyabhai <nalin@redhat.com> 3.3p1-1
f09e2e
- update to 3.3p1
f09e2e
- merge in spec file changes from upstream (remove setuid from ssh, ssh-keysign)
f09e2e
- disable gtk2 askpass
f09e2e
- require pam-devel by filename rather than by package for erratum
f09e2e
- include patch from Solar Designer to work around anonymous mmap failures
f09e2e
f09e2e
* Fri Jun 21 2002 Tim Powers <timp@redhat.com>
f09e2e
- automated rebuild
f09e2e
f09e2e
* Fri Jun  7 2002 Nalin Dahyabhai <nalin@redhat.com> 3.2.3p1-3
f09e2e
- don't require autoconf any more
f09e2e
f09e2e
* Fri May 31 2002 Nalin Dahyabhai <nalin@redhat.com> 3.2.3p1-2
f09e2e
- build gnome-ssh-askpass with gtk2
f09e2e
f09e2e
* Tue May 28 2002 Nalin Dahyabhai <nalin@redhat.com> 3.2.3p1-1
f09e2e
- update to 3.2.3p1
f09e2e
- merge in spec file changes from upstream
f09e2e
f09e2e
* Fri May 17 2002 Nalin Dahyabhai <nalin@redhat.com> 3.2.2p1-1
f09e2e
- update to 3.2.2p1
f09e2e
f09e2e
* Fri May 17 2002 Nalin Dahyabhai <nalin@redhat.com> 3.1p1-4
f09e2e
- drop buildreq on db1-devel
f09e2e
- require pam-devel by package name
f09e2e
- require autoconf instead of autoconf253 again
f09e2e
f09e2e
* Tue Apr  2 2002 Nalin Dahyabhai <nalin@redhat.com> 3.1p1-3
f09e2e
- pull patch from CVS to avoid printing error messages when some of the
f09e2e
  default keys aren't available when running ssh-add
f09e2e
- refresh to current revisions of Simon's patches
f09e2e
 
f09e2e
* Thu Mar 21 2002 Nalin Dahyabhai <nalin@redhat.com> 3.1p1-2gss
f09e2e
- reintroduce Simon's gssapi patches
f09e2e
- add buildprereq for autoconf253, which is needed to regenerate configure
f09e2e
  after applying the gssapi patches
f09e2e
- refresh to the latest version of Markus's patch to build properly with
f09e2e
  older versions of OpenSSL
f09e2e
f09e2e
* Thu Mar  7 2002 Nalin Dahyabhai <nalin@redhat.com> 3.1p1-2
f09e2e
- bump and grind (through the build system)
f09e2e
f09e2e
* Thu Mar  7 2002 Nalin Dahyabhai <nalin@redhat.com> 3.1p1-1
f09e2e
- require sharutils for building (mindrot #137)
f09e2e
- require db1-devel only when building for 6.x (#55105), which probably won't
f09e2e
  work anyway (3.1 requires OpenSSL 0.9.6 to build), but what the heck
f09e2e
- require pam-devel by file (not by package name) again
f09e2e
- add Markus's patch to compile with OpenSSL 0.9.5a (from
f09e2e
  http://bugzilla.mindrot.org/show_bug.cgi?id=141) and apply it if we're
f09e2e
  building for 6.x
f09e2e
f09e2e
* Thu Mar  7 2002 Nalin Dahyabhai <nalin@redhat.com> 3.1p1-0
f09e2e
- update to 3.1p1
f09e2e
f09e2e
* Tue Mar  5 2002 Nalin Dahyabhai <nalin@redhat.com> SNAP-20020305
f09e2e
- update to SNAP-20020305
f09e2e
- drop debug patch, fixed upstream
f09e2e
f09e2e
* Wed Feb 20 2002 Nalin Dahyabhai <nalin@redhat.com> SNAP-20020220
f09e2e
- update to SNAP-20020220 for testing purposes (you've been warned, if there's
f09e2e
  anything to be warned about, gss patches won't apply, I don't mind)
f09e2e
f09e2e
* Wed Feb 13 2002 Nalin Dahyabhai <nalin@redhat.com> 3.0.2p1-3
f09e2e
- add patches from Simon Wilkinson and Nicolas Williams for GSSAPI key
f09e2e
  exchange, authentication, and named key support
f09e2e
f09e2e
* Wed Jan 23 2002 Nalin Dahyabhai <nalin@redhat.com> 3.0.2p1-2
f09e2e
- remove dependency on db1-devel, which has just been swallowed up whole
f09e2e
  by gnome-libs-devel
f09e2e
f09e2e
* Sat Dec 29 2001 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- adjust build dependencies so that build6x actually works right (fix
f09e2e
  from Hugo van der Kooij)
f09e2e
f09e2e
* Tue Dec  4 2001 Nalin Dahyabhai <nalin@redhat.com> 3.0.2p1-1
f09e2e
- update to 3.0.2p1
f09e2e
f09e2e
* Fri Nov 16 2001 Nalin Dahyabhai <nalin@redhat.com> 3.0.1p1-1
f09e2e
- update to 3.0.1p1
f09e2e
f09e2e
* Tue Nov 13 2001 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- update to current CVS (not for use in distribution)
f09e2e
f09e2e
* Thu Nov  8 2001 Nalin Dahyabhai <nalin@redhat.com> 3.0p1-1
f09e2e
- merge some of Damien Miller <djm@mindrot.org> changes from the upstream
f09e2e
  3.0p1 spec file and init script
f09e2e
f09e2e
* Wed Nov  7 2001 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- update to 3.0p1
f09e2e
- update to x11-ssh-askpass 1.2.4.1
f09e2e
- change build dependency on a file from pam-devel to the pam-devel package
f09e2e
- replace primes with moduli
f09e2e
f09e2e
* Thu Sep 27 2001 Nalin Dahyabhai <nalin@redhat.com> 2.9p2-9
f09e2e
- incorporate fix from Markus Friedl's advisory for IP-based authorization bugs
f09e2e
f09e2e
* Thu Sep 13 2001 Bernhard Rosenkraenzer <bero@redhat.com> 2.9p2-8
f09e2e
- Merge changes to rescue build from current sysadmin survival cd
f09e2e
f09e2e
* Thu Sep  6 2001 Nalin Dahyabhai <nalin@redhat.com> 2.9p2-7
f09e2e
- fix scp's server's reporting of file sizes, and build with the proper
f09e2e
  preprocessor define to get large-file capable open(), stat(), etc.
f09e2e
  (sftp has been doing this correctly all along) (#51827)
f09e2e
- configure without --with-ipv4-default on RHL 7.x and newer (#45987,#52247)
f09e2e
- pull cvs patch to fix support for /etc/nologin for non-PAM logins (#47298)
f09e2e
- mark profile.d scriptlets as config files (#42337)
f09e2e
- refer to Jason Stone's mail for zsh workaround for exit-hanging quasi-bug
f09e2e
- change a couple of log() statements to debug() statements (#50751)
f09e2e
- pull cvs patch to add -t flag to sshd (#28611)
f09e2e
- clear fd_sets correctly (one bit per FD, not one byte per FD) (#43221)
f09e2e
f09e2e
* Mon Aug 20 2001 Nalin Dahyabhai <nalin@redhat.com> 2.9p2-6
f09e2e
- add db1-devel as a BuildPrerequisite (noted by Hans Ecke)
f09e2e
f09e2e
* Thu Aug 16 2001 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- pull cvs patch to fix remote port forwarding with protocol 2
f09e2e
f09e2e
* Thu Aug  9 2001 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- pull cvs patch to add session initialization to no-pty sessions
f09e2e
- pull cvs patch to not cut off challengeresponse auth needlessly
f09e2e
- refuse to do X11 forwarding if xauth isn't there, handy if you enable
f09e2e
  it by default on a system that doesn't have X installed (#49263)
f09e2e
f09e2e
* Wed Aug  8 2001 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- don't apply patches to code we don't intend to build (spotted by Matt Galgoci)
f09e2e
f09e2e
* Mon Aug  6 2001 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- pass OPTIONS correctly to initlog (#50151)
f09e2e
f09e2e
* Wed Jul 25 2001 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- switch to x11-ssh-askpass 1.2.2
f09e2e
f09e2e
* Wed Jul 11 2001 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- rebuild in new environment
f09e2e
f09e2e
* Mon Jun 25 2001 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- disable the gssapi patch
f09e2e
f09e2e
* Mon Jun 18 2001 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- update to 2.9p2
f09e2e
- refresh to a new version of the gssapi patch
f09e2e
f09e2e
* Thu Jun  7 2001 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- change Copyright: BSD to License: BSD
f09e2e
- add Markus Friedl's unverified patch for the cookie file deletion problem
f09e2e
  so that we can verify it
f09e2e
- drop patch to check if xauth is present (was folded into cookie patch)
f09e2e
- don't apply gssapi patches for the errata candidate
f09e2e
- clear supplemental groups list at startup
f09e2e
f09e2e
* Fri May 25 2001 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- fix an error parsing the new default sshd_config
f09e2e
- add a fix from Markus Friedl (via openssh-unix-dev) for ssh-keygen not
f09e2e
  dealing with comments right
f09e2e
f09e2e
* Thu May 24 2001 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- add in Simon Wilkinson's GSSAPI patch to give it some testing in-house,
f09e2e
  to be removed before the next beta cycle because it's a big departure
f09e2e
  from the upstream version
f09e2e
f09e2e
* Thu May  3 2001 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- finish marking strings in the init script for translation
f09e2e
- modify init script to source /etc/sysconfig/sshd and pass $OPTIONS to sshd
f09e2e
  at startup (change merged from openssh.com init script, originally by
f09e2e
  Pekka Savola)
f09e2e
- refuse to do X11 forwarding if xauth isn't there, handy if you enable
f09e2e
  it by default on a system that doesn't have X installed
f09e2e
f09e2e
* Wed May  2 2001 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- update to 2.9
f09e2e
- drop various patches that came from or went upstream or to or from CVS
f09e2e
f09e2e
* Wed Apr 18 2001 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- only require initscripts 5.00 on 6.2 (reported by Peter Bieringer)
f09e2e
f09e2e
* Sun Apr  8 2001 Preston Brown <pbrown@redhat.com>
f09e2e
- remove explicit openssl requirement, fixes builddistro issue
f09e2e
- make initscript stop() function wait until sshd really dead to avoid 
f09e2e
  races in condrestart
f09e2e
f09e2e
* Mon Apr  2 2001 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- mention that challengereponse supports PAM, so disabling password doesn't
f09e2e
  limit users to pubkey and rsa auth (#34378)
f09e2e
- bypass the daemon() function in the init script and call initlog directly,
f09e2e
  because daemon() won't start a daemon it detects is already running (like
f09e2e
  open connections)
f09e2e
- require the version of openssl we had when we were built
f09e2e
f09e2e
* Fri Mar 23 2001 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- make do_pam_setcred() smart enough to know when to establish creds and
f09e2e
  when to reinitialize them
f09e2e
- add in a couple of other fixes from Damien for inclusion in the errata
f09e2e
f09e2e
* Thu Mar 22 2001 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- update to 2.5.2p2
f09e2e
- call setcred() again after initgroups, because the "creds" could actually
f09e2e
  be group memberships
f09e2e
f09e2e
* Tue Mar 20 2001 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- update to 2.5.2p1 (includes endianness fixes in the rijndael implementation)
f09e2e
- don't enable challenge-response by default until we find a way to not
f09e2e
  have too many userauth requests (we may make up to six pubkey and up to
f09e2e
  three password attempts as it is)
f09e2e
- remove build dependency on rsh to match openssh.com's packages more closely
f09e2e
f09e2e
* Sat Mar  3 2001 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- remove dependency on openssl -- would need to be too precise
f09e2e
f09e2e
* Fri Mar  2 2001 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- rebuild in new environment
f09e2e
f09e2e
* Mon Feb 26 2001 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- Revert the patch to move pam_open_session.
f09e2e
- Init script and spec file changes from Pekka Savola. (#28750)
f09e2e
- Patch sftp to recognize '-o protocol' arguments. (#29540)
f09e2e
f09e2e
* Thu Feb 22 2001 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- Chuck the closing patch.
f09e2e
- Add a trigger to add host keys for protocol 2 to the config file, now that
f09e2e
  configuration file syntax requires us to specify it with HostKey if we
f09e2e
  specify any other HostKey values, which we do.
f09e2e
f09e2e
* Tue Feb 20 2001 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- Redo patch to move pam_open_session after the server setuid()s to the user.
f09e2e
- Rework the nopam patch to use be picked up by autoconf.
f09e2e
f09e2e
* Mon Feb 19 2001 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- Update for 2.5.1p1.
f09e2e
- Add init script mods from Pekka Savola.
f09e2e
- Tweak the init script to match the CVS contrib script more closely.
f09e2e
- Redo patch to ssh-add to try to adding both identity and id_dsa to also try
f09e2e
  adding id_rsa.
f09e2e
f09e2e
* Fri Feb 16 2001 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- Update for 2.5.0p1.
f09e2e
- Use $RPM_OPT_FLAGS instead of -O when building gnome-ssh-askpass
f09e2e
- Resync with parts of Damien Miller's openssh.spec from CVS, including
f09e2e
  update of x11 askpass to 1.2.0.
f09e2e
- Only require openssl (don't prereq) because we generate keys in the init
f09e2e
  script now.
f09e2e
f09e2e
* Tue Feb 13 2001 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- Don't open a PAM session until we've forked and become the user (#25690).
f09e2e
- Apply Andrew Bartlett's patch for letting pam_authenticate() know which
f09e2e
  host the user is attempting a login from.
f09e2e
- Resync with parts of Damien Miller's openssh.spec from CVS.
f09e2e
- Don't expose KbdInt responses in debug messages (from CVS).
f09e2e
- Detect and handle errors in rsa_{public,private}_decrypt (from CVS).
f09e2e
f09e2e
* Wed Feb  7 2001 Trond Eivind Glomsrxd <teg@redhat.com>
f09e2e
- i18n-tweak to initscript.
f09e2e
f09e2e
* Tue Jan 23 2001 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- More gettextizing.
f09e2e
- Close all files after going into daemon mode (needs more testing).
f09e2e
- Extract patch from CVS to handle auth banners (in the client).
f09e2e
- Extract patch from CVS to handle compat weirdness.
f09e2e
f09e2e
* Fri Jan 19 2001 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- Finish with the gettextizing.
f09e2e
f09e2e
* Thu Jan 18 2001 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- Fix a bug in auth2-pam.c (#23877)
f09e2e
- Gettextize the init script.
f09e2e
f09e2e
* Wed Dec 20 2000 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- Incorporate a switch for using PAM configs for 6.x, just in case.
f09e2e
f09e2e
* Tue Dec  5 2000 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- Incorporate Bero's changes for a build specifically for rescue CDs.
f09e2e
f09e2e
* Wed Nov 29 2000 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- Don't treat pam_setcred() failure as fatal unless pam_authenticate() has
f09e2e
  succeeded, to allow public-key authentication after a failure with "none"
f09e2e
  authentication.  (#21268)
f09e2e
f09e2e
* Tue Nov 28 2000 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- Update to x11-askpass 1.1.1. (#21301)
f09e2e
- Don't second-guess fixpaths, which causes paths to get fixed twice. (#21290)
f09e2e
f09e2e
* Mon Nov 27 2000 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- Merge multiple PAM text messages into subsequent prompts when possible when
f09e2e
  doing keyboard-interactive authentication.
f09e2e
f09e2e
* Sun Nov 26 2000 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- Disable the built-in MD5 password support.  We're using PAM.
f09e2e
- Take a crack at doing keyboard-interactive authentication with PAM, and
f09e2e
  enable use of it in the default client configuration so that the client
f09e2e
  will try it when the server disallows password authentication.
f09e2e
- Build with debugging flags.  Build root policies strip all binaries anyway.
f09e2e
f09e2e
* Tue Nov 21 2000 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- Use DESTDIR instead of %%makeinstall.
f09e2e
- Remove /usr/X11R6/bin from the path-fixing patch.
f09e2e
f09e2e
* Mon Nov 20 2000 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- Add the primes file from the latest snapshot to the main package (#20884).
f09e2e
- Add the dev package to the prereq list (#19984).
f09e2e
- Remove the default path and mimic login's behavior in the server itself.
f09e2e
f09e2e
* Fri Nov 17 2000 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- Resync with conditional options in Damien Miller's .spec file for an errata.
f09e2e
- Change libexecdir from %%{_libexecdir}/ssh to %%{_libexecdir}/openssh.
f09e2e
f09e2e
* Tue Nov  7 2000 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- Update to OpenSSH 2.3.0p1.
f09e2e
- Update to x11-askpass 1.1.0.
f09e2e
- Enable keyboard-interactive authentication.
f09e2e
f09e2e
* Mon Oct 30 2000 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- Update to ssh-askpass-x11 1.0.3.
f09e2e
- Change authentication related messages to be private (#19966).
f09e2e
f09e2e
* Tue Oct 10 2000 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- Patch ssh-keygen to be able to list signatures for DSA public key files
f09e2e
  it generates.
f09e2e
f09e2e
* Thu Oct  5 2000 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- Add BuildPreReq on /usr/include/security/pam_appl.h to be sure we always
f09e2e
  build PAM authentication in.
f09e2e
- Try setting SSH_ASKPASS if gnome-ssh-askpass is installed.
f09e2e
- Clean out no-longer-used patches.
f09e2e
- Patch ssh-add to try to add both identity and id_dsa, and to error only
f09e2e
  when neither exists.
f09e2e
f09e2e
* Mon Oct  2 2000 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- Update x11-askpass to 1.0.2. (#17835)
f09e2e
- Add BuildPreReqs for /bin/login and /usr/bin/rsh so that configure will
f09e2e
  always find them in the right place. (#17909)
f09e2e
- Set the default path to be the same as the one supplied by /bin/login, but
f09e2e
  add /usr/X11R6/bin. (#17909)
f09e2e
- Try to handle obsoletion of ssh-server more cleanly.  Package names
f09e2e
  are different, but init script name isn't. (#17865)
f09e2e
f09e2e
* Wed Sep  6 2000 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- Update to 2.2.0p1. (#17835)
f09e2e
- Tweak the init script to allow proper restarting. (#18023)
f09e2e
f09e2e
* Wed Aug 23 2000 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- Update to 20000823 snapshot.
f09e2e
- Change subpackage requirements from %%{version} to %%{version}-%%{release}
f09e2e
- Back out the pipe patch.
f09e2e
f09e2e
* Mon Jul 17 2000 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- Update to 2.1.1p4, which includes fixes for config file parsing problems.
f09e2e
- Move the init script back.
f09e2e
- Add Damien's quick fix for wackiness.
f09e2e
f09e2e
* Wed Jul 12 2000 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- Update to 2.1.1p3, which includes fixes for X11 forwarding and strtok().
f09e2e
f09e2e
* Thu Jul  6 2000 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- Move condrestart to server postun.
f09e2e
- Move key generation to init script.
f09e2e
- Actually use the right patch for moving the key generation to the init script.
f09e2e
- Clean up the init script a bit.
f09e2e
f09e2e
* Wed Jul  5 2000 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- Fix X11 forwarding, from mail post by Chan Shih-Ping Richard.
f09e2e
f09e2e
* Sun Jul  2 2000 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- Update to 2.1.1p2.
f09e2e
- Use of strtok() considered harmful.
f09e2e
f09e2e
* Sat Jul  1 2000 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- Get the build root out of the man pages.
f09e2e
f09e2e
* Thu Jun 29 2000 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- Add and use condrestart support in the init script.
f09e2e
- Add newer initscripts as a prereq.
f09e2e
f09e2e
* Tue Jun 27 2000 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- Build in new environment (release 2)
f09e2e
- Move -clients subpackage to Applications/Internet group
f09e2e
f09e2e
* Fri Jun  9 2000 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- Update to 2.2.1p1
f09e2e
f09e2e
* Sat Jun  3 2000 Nalin Dahyabhai <nalin@redhat.com>
f09e2e
- Patch to build with neither RSA nor RSAref.
f09e2e
- Miscellaneous FHS-compliance tweaks.
f09e2e
- Fix for possibly-compressed man pages.
f09e2e
f09e2e
* Wed Mar 15 2000 Damien Miller <djm@ibs.com.au>
f09e2e
- Updated for new location
f09e2e
- Updated for new gnome-ssh-askpass build
f09e2e
f09e2e
* Sun Dec 26 1999 Damien Miller <djm@mindrot.org>
f09e2e
- Added Jim Knoble's <jmknoble@pobox.com> askpass
f09e2e
f09e2e
* Mon Nov 15 1999 Damien Miller <djm@mindrot.org>
f09e2e
- Split subpackages further based on patch from jim knoble <jmknoble@pobox.com>
f09e2e
f09e2e
* Sat Nov 13 1999 Damien Miller <djm@mindrot.org>
f09e2e
- Added 'Obsoletes' directives
f09e2e
f09e2e
* Tue Nov 09 1999 Damien Miller <djm@ibs.com.au>
f09e2e
- Use make install
f09e2e
- Subpackages
f09e2e
f09e2e
* Mon Nov 08 1999 Damien Miller <djm@ibs.com.au>
f09e2e
- Added links for slogin
f09e2e
- Fixed perms on manpages
f09e2e
f09e2e
* Sat Oct 30 1999 Damien Miller <djm@ibs.com.au>
f09e2e
- Renamed init script
f09e2e
f09e2e
* Fri Oct 29 1999 Damien Miller <djm@ibs.com.au>
f09e2e
- Back to old binary names
f09e2e
f09e2e
* Thu Oct 28 1999 Damien Miller <djm@ibs.com.au>
f09e2e
- Use autoconf
f09e2e
- New binary names
f09e2e
f09e2e
* Wed Oct 27 1999 Damien Miller <djm@ibs.com.au>
f09e2e
- Initial RPMification, based on Jan "Yenya" Kasprzak's <kas@fi.muni.cz> spec.