Makefile.in | 8 4 + 4 - 0 !
README.md | 36 36 + 0 - 0 !
auth.c | 3 2 + 1 - 0 !
auth2-gss.c | 54 51 + 3 - 0 !
auth2-methods.c | 6 6 + 0 - 0 !
auth2.c | 2 2 + 0 - 0 !
clientloop.c | 13 13 + 0 - 0 !
configure.ac | 24 24 + 0 - 0 !
gss-genr.c | 297 293 + 4 - 0 !
gss-serv-krb5.c | 87 80 + 7 - 0 !
gss-serv.c | 202 181 + 21 - 0 !
kex-names.c | 62 59 + 3 - 0 !
kex.c | 4 4 + 0 - 0 !
kex.h | 29 29 + 0 - 0 !
kexdh.c | 10 10 + 0 - 0 !
kexgen.c | 2 1 + 1 - 0 !
kexgssc.c | 602 602 + 0 - 0 !
kexgsss.c | 478 478 + 0 - 0 !
monitor.c | 139 127 + 12 - 0 !
monitor.h | 2 2 + 0 - 0 !
monitor_wrap.c | 57 56 + 1 - 0 !
monitor_wrap.h | 4 3 + 1 - 0 !
readconf.c | 74 74 + 0 - 0 !
readconf.h | 6 6 + 0 - 0 !
servconf.c | 46 46 + 0 - 0 !
servconf.h | 3 3 + 0 - 0 !
session.c | 10 8 + 2 - 0 !
ssh-gss.h | 54 50 + 4 - 0 !
ssh-null.c | 108 108 + 0 - 0 !
ssh.1 | 8 8 + 0 - 0 !
ssh.c | 6 4 + 2 - 0 !
ssh_config | 2 2 + 0 - 0 !
ssh_config.5 | 57 57 + 0 - 0 !
sshconnect2.c | 148 144 + 4 - 0 !
sshd-auth.c | 53 53 + 0 - 0 !
sshd-session.c | 4 2 + 2 - 0 !
sshd.c | 3 2 + 1 - 0 !
sshd_config | 2 2 + 0 - 0 !
sshd_config.5 | 30 30 + 0 - 0 !
sshkey.c | 8 7 + 1 - 0 !
sshkey.h | 1 1 + 0 - 0 !
41 files changed, 2670 insertions(+), 74 deletions(-)

 gssapi key exchange support

This patch has been rejected upstream: "None of the OpenSSH developers are
in favour of adding this, and this situation has not changed for several
years.  This is not a slight on Simon's patch, which is of fine quality, but
just that a) we don't trust GSSAPI implementations that much and b) we don't
like adding new KEX since they are pre-auth attack surface.  This one is
particularly scary, since it requires hooks out to typically root-owned
system resources."

However, quite a lot of people rely on this in Debian, and it's better to
have it merged into the main openssh package rather than having separate
-krb5 packages (as we used to have).  It seems to have a generally good
security history.

configure.ac | 57 57 + 0 - 0 !
sshd-session.c | 25 25 + 0 - 0 !
sshd.8 | 7 7 + 0 - 0 !
3 files changed, 89 insertions(+)

 restore tcp wrappers support

Support for TCP wrappers was dropped in OpenSSH 6.7.  See this message
and thread:

  https://lists.mindrot.org/pipermail/openssh-unix-dev/2014-April/032497.html

It is true that this reduces preauth attack surface in sshd.  On the
other hand, this support seems to be quite widely used, and abruptly
dropping it (from the perspective of users who don't read
openssh-unix-dev) could easily cause more serious problems in practice.

It's not entirely clear what the right long-term answer for Debian is,
but it at least probably doesn't involve dropping this feature shortly
before a freeze.

auth.h | 1 1 + 0 - 0 !
auth2.c | 10 8 + 2 - 0 !
monitor.c | 36 33 + 3 - 0 !
monitor.h | 2 2 + 0 - 0 !
monitor_wrap.c | 27 24 + 3 - 0 !
monitor_wrap.h | 3 2 + 1 - 0 !
openbsd-compat/port-linux.c | 21 14 + 7 - 0 !
openbsd-compat/port-linux.h | 4 2 + 2 - 0 !
platform.c | 4 2 + 2 - 0 !
platform.h | 2 1 + 1 - 0 !
session.c | 8 4 + 4 - 0 !
session.h | 2 1 + 1 - 0 !
sshd-session.c | 2 1 + 1 - 0 !
sshpty.c | 4 2 + 2 - 0 !
sshpty.h | 2 1 + 1 - 0 !
15 files changed, 98 insertions(+), 30 deletions(-)

 handle selinux authorisation roles

Rejected upstream due to discomfort with magic usernames; a better approach
will need an SSH protocol change.  In the meantime, this came from Debian's
SELinux maintainer, so we'll keep it until we have something better.

Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1641
Bug-Debian: http://bugs.debian.org/394795

readconf.c | 1 1 + 0 - 0 !
servconf.c | 1 1 + 0 - 0 !
2 files changed, 2 insertions(+)

 accept obsolete ssh-vulnkey configuration options

These options were used as part of Debian's response to CVE-2008-0166.
Nearly six years later, we no longer need to continue carrying the bulk
of that patch, but we do need to avoid failing when the associated
configuration options are still present.

readconf.c | 14 12 + 2 - 0 !
ssh_config.5 | 21 19 + 2 - 0 !
sshd_config.5 | 3 3 + 0 - 0 !
3 files changed, 34 insertions(+), 4 deletions(-)

 various keepalive extensions

Add compatibility aliases for ProtocolKeepAlives and SetupTimeOut, supported
in previous versions of Debian's OpenSSH package but since superseded by
ServerAliveInterval.  (We're probably stuck with this bit for
compatibility.)

In batch mode, default ServerAliveInterval to five minutes.

Adjust documentation to match and to give some more advice on use of
keepalives.

log.c | 1 1 + 0 - 0 !
ssh.c | 2 1 + 1 - 0 !
2 files changed, 2 insertions(+), 1 deletion(-)

 "loglevel silent" compatibility

"LogLevel SILENT" (-qq) was introduced in Debian openssh 1:3.0.1p1-1 to
match the behaviour of non-free SSH, in which -q does not suppress fatal
errors.  However, this was unintentionally broken in 1:4.6p1-2 and nobody
complained, so we've dropped most of it.  The parts that remain are basic
configuration file compatibility, and an adjustment to "Pseudo-terminal will
not be allocated ..." which should be split out into a separate patch.

auth-rhosts.c | 6 2 + 4 - 0 !
auth.c | 3 1 + 2 - 0 !
misc.c | 55 51 + 4 - 0 !
misc.h | 2 2 + 0 - 0 !
readconf.c | 3 1 + 2 - 0 !
ssh.1 | 2 2 + 0 - 0 !
ssh_config.5 | 2 2 + 0 - 0 !
7 files changed, 61 insertions(+), 12 deletions(-)

 allow harmless group-writability

Allow secure files (~/.ssh/config, ~/.ssh/authorized_keys, etc.) to be
group-writable, provided that the group in question contains only the file's
owner.  Rejected upstream for IMO incorrect reasons (e.g. a misunderstanding
about the contents of gr->gr_mem).  Given that per-user groups and umask 002
are the default setup in Debian (for good reasons - this makes operating in
setgid directories with other groups much easier), we need to permit this by
default.

Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1060
Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=314347

scp.c | 12 10 + 2 - 0 !
1 file changed, 10 insertions(+), 2 deletions(-)

 adjust scp quoting in verbose mode

Tweak scp's reporting of filenames in verbose mode to be a bit less
confusing with spaces.

This should be revised to mimic real shell quoting.

Bug-Ubuntu: https://bugs.launchpad.net/bugs/89945

sshconnect.c | 4 2 + 2 - 0 !
1 file changed, 2 insertions(+), 2 deletions(-)

 look for $shell on the path for proxycommand/localcommand

There's some debate on the upstream bug about whether POSIX requires this.
I (Colin Watson) agree with Vincent and think it does.

Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1494
Bug-Debian: http://bugs.debian.org/492728

dns.c | 14 13 + 1 - 0 !
openbsd-compat/getrrsetbyname.c | 10 5 + 5 - 0 !
openbsd-compat/getrrsetbyname.h | 3 3 + 0 - 0 !
3 files changed, 21 insertions(+), 6 deletions(-)

 force use of dnssec even if "options edns0" isn't in resolv.conf

This allows SSHFP DNS records to be verified if glibc 2.11 is installed.

sshconnect.c | 9 8 + 1 - 0 !
1 file changed, 8 insertions(+), 1 deletion(-)

 mention ssh-keygen in ssh fingerprint changed warning

kex.c | 2 1 + 1 - 0 !
version.h | 7 6 + 1 - 0 !
2 files changed, 7 insertions(+), 2 deletions(-)

 include the debian version in our identification

This makes it easier to audit networks for versions patched against security
vulnerabilities.  It has little detrimental effect, as attackers will
generally just try attacks rather than bothering to scan for
vulnerable-looking version strings.  (However, see debian-banner.patch.)

kex.c | 5 3 + 2 - 0 !
kex.h | 2 1 + 1 - 0 !
servconf.c | 10 10 + 0 - 0 !
servconf.h | 2 2 + 0 - 0 !
sshconnect.c | 2 1 + 1 - 0 !
sshd-session.c | 2 1 + 1 - 0 !
sshd_config.5 | 5 5 + 0 - 0 !
7 files changed, 23 insertions(+), 5 deletions(-)

 add debianbanner server configuration option

Setting this to "no" causes sshd to omit the Debian revision from its
initial protocol handshake, for those scared by package-versioning.patch.

Bug-Debian: http://bugs.debian.org/562048

Makefile.in | 1 1 + 0 - 0 !
1 file changed, 1 insertion(+)

 install authorized_keys(5) as a symlink to sshd(8)

Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1720
Bug-Debian: http://bugs.debian.org/441817

moduli.5 | 4 2 + 2 - 0 !
ssh-keygen.1 | 12 4 + 8 - 0 !
sshd.8 | 5 2 + 3 - 0 !
sshd_config.5 | 27 6 + 21 - 0 !
4 files changed, 14 insertions(+), 34 deletions(-)

 adjust various openbsd-specific references in manual pages

No single bug reference for this patch, but history includes:
 https://bugs.debian.org/154434 (login.conf(5))
 https://bugs.debian.org/513417 (/etc/rc)
 https://bugs.debian.org/998069, https://bugs.debian.org/1095686 (rdomain(4))

ssh.1 | 1 1 + 0 - 0 !
1 file changed, 1 insertion(+)

 ssh(1): refer to ssh-argv0(1)

Old versions of OpenSSH (up to 2.5 or thereabouts) allowed creating symlinks
to ssh with the name of the host you want to connect to.  Debian ships an
ssh-argv0 script restoring this feature; this patch refers to its manual
page from ssh(1).

Bug-Debian: http://bugs.debian.org/111341

ssh_config.5 | 3 3 + 0 - 0 !
1 file changed, 3 insertions(+)

 document that hashknownhosts may break tab-completion

Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1727
Bug-Debian: http://bugs.debian.org/430154

ssh-agent.1 | 15 15 + 0 - 0 !
1 file changed, 15 insertions(+)

 document consequences of ssh-agent being setgid in ssh-agent(1)

Bug-Debian: http://bugs.debian.org/711623

contrib/gnome-ssh-askpass2.c | 2 2 + 0 - 0 !
1 file changed, 2 insertions(+)

 give the ssh-askpass-gnome window a default icon

Bug-Ubuntu: https://bugs.launchpad.net/bugs/27152

readconf.c | 2 1 + 1 - 0 !
regress/test-exec.sh | 1 1 + 0 - 0 !
ssh.1 | 24 24 + 0 - 0 !
ssh_config | 8 7 + 1 - 0 !
ssh_config.5 | 26 25 + 1 - 0 !
sshd_config | 18 12 + 6 - 0 !
sshd_config.5 | 33 31 + 2 - 0 !
7 files changed, 101 insertions(+), 11 deletions(-)

 various debian-specific configuration changes

ssh: Enable ForwardX11Trusted, returning to earlier semantics which cause
fewer problems with existing setups (http://bugs.debian.org/237021).

ssh: Set 'SendEnv LANG LC_* COLORTERM NO_COLOR' by default
(http://bugs.debian.org/264024).

ssh: Enable HashKnownHosts by default to try to limit the spread of ssh
worms.

ssh: Enable GSSAPIAuthentication by default.

ssh: Include /etc/ssh/ssh_config.d/*.conf.

sshd: Enable PAM, disable KbdInteractiveAuthentication, and disable
PrintMotd.

sshd: Enable X11Forwarding.

sshd: Set 'AcceptEnv LANG LC_* COLORTERM NO_COLOR' by default.

sshd: Change sftp subsystem path to /usr/lib/openssh/sftp-server.

sshd: Include /etc/ssh/sshd_config.d/*.conf.

sshd: Document Debian's defaults for SshdAuthPath and SshdSessionPath.

regress: Run tests with 'UsePAM yes', to match sshd_config.

Document all of this.

sshd_config | 5 2 + 3 - 0 !
1 file changed, 2 insertions(+), 3 deletions(-)

 restore reading authorized_keys2 by default

Upstream seems to intend to gradually phase this out, so don't assume
that this will remain the default forever.  However, we were late in
adopting the upstream sshd_config changes, so it makes sense to extend
the grace period.

Bug-Debian: https://bugs.debian.org/852320

configure.ac | 1 1 + 0 - 0 !
sshd.c | 131 117 + 14 - 0 !
2 files changed, 118 insertions(+), 14 deletions(-)

 support systemd socket activation

Unlike inetd socket activation, with systemd socket activation the
supervisor passes the listened-on socket to the child process and lets
the child process handle the accept().  This lets us do delayed start
of the sshd daemon without becoming incompatible with config options
like ClientAliveCountMax.

openbsd-compat/regress/utimensattest.c | 17 17 + 0 - 0 !
1 file changed, 17 insertions(+)

 skip utimensat test on zfs

On ZFS (which may be used by e.g. `autopkgtest-virt-incus`), `utimensat`
seems to leave the access time set to 0.  It's not clear why.

regress/conch-ciphers.sh | 6 1 + 5 - 0 !
1 file changed, 1 insertion(+), 5 deletions(-)

 regress: redirect conch stdin from /dev/zero

This is more convenient than requiring a controlling terminal.

ssh-pkcs11.c | 6 3 + 3 - 0 !
1 file changed, 3 insertions(+), 3 deletions(-)

 upstream: downgrade a useless error() -> debug()

OpenBSD-Commit-ID: 5b0c9bcddb324f8bed2c8e8ffe9c92d263adc2d9

Makefile.in | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 link ssh against ssh-pkcs11.o

Should fix PIN entry for direct use of PKCS11Provider in ssh(1)
bz3879