![[BACK]](/icons/back.gif){kind=icon}
Up to [local] / src / usr.bin / ssh
Request diff between arbitrary revisions
Default branch: MAIN
Revision 1.387 / (download) - annotate - [select for diffs], Fri May 17 02:39:11 2024 UTC (3 hours, 45 minutes ago) by jsg
Branch: MAIN
CVS Tags: HEAD
Changes since 1.386: +2 -2 lines
Diff to previous 1.386 (colored)
spelling; ok djm@
Revision 1.386 / (download) - annotate - [select for diffs], Mon Mar 4 04:13:18 2024 UTC (2 months, 1 week ago) by djm
Branch: MAIN
CVS Tags: OPENBSD_7_5_BASE,
OPENBSD_7_5
Changes since 1.385: +19 -7 lines
Diff to previous 1.385 (colored)
fix leak of CanonicalizePermittedCNAMEs on error path; spotted by Coverity (CID 438039)
Revision 1.385 / (download) - annotate - [select for diffs], Mon Mar 4 02:16:11 2024 UTC (2 months, 1 week ago) by djm
Branch: MAIN
Changes since 1.384: +86 -61 lines
Diff to previous 1.384 (colored)
Separate parsing of string array options from applying them to the active configuration. This fixes the config parser from erroneously rejecting cases like: AuthenticationMethods password Match User ivy AuthenticationMethods any bz3657 ok markus@
Revision 1.384 / (download) - annotate - [select for diffs], Thu Jan 11 01:45:36 2024 UTC (4 months ago) by djm
Branch: MAIN
Changes since 1.383: +3 -1 lines
Diff to previous 1.383 (colored)
make DSA key support compile-time optional, defaulting to on ok markus@
Revision 1.383 / (download) - annotate - [select for diffs], Thu Oct 12 02:18:18 2023 UTC (7 months ago) by djm
Branch: MAIN
Changes since 1.382: +8 -4 lines
Diff to previous 1.382 (colored)
add %j token that expands to the configured ProxyJump hostname (or the empty string if this option is not being used). bz3610, ok dtucker
Revision 1.382 / (download) - annotate - [select for diffs], Wed Oct 11 22:42:26 2023 UTC (7 months ago) by djm
Branch: MAIN
Changes since 1.381: +45 -2 lines
Diff to previous 1.381 (colored)
add ChannelTimeout support to the client, mirroring the same option in the server. ok markus@
Revision 1.381 / (download) - annotate - [select for diffs], Mon Aug 28 03:31:16 2023 UTC (8 months, 2 weeks ago) by djm
Branch: MAIN
CVS Tags: OPENBSD_7_4_BASE,
OPENBSD_7_4
Changes since 1.380: +62 -2 lines
Diff to previous 1.380 (colored)
Add keystroke timing obfuscation to the client. This attempts to hide inter-keystroke timings by sending interactive traffic at fixed intervals (default: every 20ms) when there is only a small amount of data being sent. It also sends fake "chaff" keystrokes for a random interval after the last real keystroke. These are controlled by a new ssh_config ObscureKeystrokeTiming keyword/ feedback/ok markus@
Revision 1.380 / (download) - annotate - [select for diffs], Mon Jul 17 06:16:33 2023 UTC (10 months ago) by djm
Branch: MAIN
Changes since 1.379: +3 -1 lines
Diff to previous 1.379 (colored)
missing match localnetwork negation check
Revision 1.379 / (download) - annotate - [select for diffs], Mon Jul 17 04:08:31 2023 UTC (10 months ago) by djm
Branch: MAIN
Changes since 1.378: +13 -2 lines
Diff to previous 1.378 (colored)
Add support for configuration tags to ssh(1). This adds a ssh_config(5) "Tag" directive and corresponding "Match tag" predicate that may be used to select blocks of configuration similar to the pf.conf(5) keywords of the same name. ok markus
Revision 1.378 / (download) - annotate - [select for diffs], Mon Jul 17 04:04:36 2023 UTC (10 months ago) by djm
Branch: MAIN
Changes since 1.377: +71 -4 lines
Diff to previous 1.377 (colored)
add a "match localnetwork" predicate. This allows matching on the addresses of available network interfaces and may be used to vary the effective client configuration based on network location (e.g. to use a ProxyJump when not on a particular network). ok markus@
Revision 1.377 / (download) - annotate - [select for diffs], Wed Jun 21 05:10:26 2023 UTC (10 months, 3 weeks ago) by djm
Branch: MAIN
Changes since 1.376: +7 -3 lines
Diff to previous 1.376 (colored)
better validate CASignatureAlgorithms in ssh_config and sshd_config. Previously this directive would accept certificate algorithm names, but these were unusable in practice as OpenSSH does not support CA chains. part of bz3577; ok dtucker@
Revision 1.376 / (download) - annotate - [select for diffs], Fri Mar 31 04:23:02 2023 UTC (13 months, 2 weeks ago) by djm
Branch: MAIN
Changes since 1.375: +2 -1 lines
Diff to previous 1.375 (colored)
don't leak arg2 on parse_pubkey_algos error path; ok dtucker@
Revision 1.375 / (download) - annotate - [select for diffs], Fri Mar 10 02:24:56 2023 UTC (14 months, 1 week ago) by dtucker
Branch: MAIN
CVS Tags: OPENBSD_7_3_BASE,
OPENBSD_7_3
Changes since 1.374: +3 -5 lines
Diff to previous 1.374 (colored)
Remove no-op (int) > INT_MAX checks since they can never be true. From Coverity CID 405031, ok djm@
Revision 1.374 / (download) - annotate - [select for diffs], Thu Mar 9 21:06:24 2023 UTC (14 months, 1 week ago) by jcs
Branch: MAIN
Changes since 1.373: +2 -2 lines
Diff to previous 1.373 (colored)
modify parentheses in conditionals to make it clearer what is being assigned and what is being checked ok djm dtucker
Revision 1.373 / (download) - annotate - [select for diffs], Sun Mar 5 05:34:09 2023 UTC (14 months, 1 week ago) by dtucker
Branch: MAIN
Changes since 1.372: +1 -2 lines
Diff to previous 1.372 (colored)
Remove unused compat.h includes. We've previously removed a lot of the really old compatibility code, and with it went the need to include compat.h in most of the files that have it.
Revision 1.372 / (download) - annotate - [select for diffs], Fri Jan 13 02:58:20 2023 UTC (16 months ago) by dtucker
Branch: MAIN
Changes since 1.371: +3 -1 lines
Diff to previous 1.371 (colored)
Add a "Host" line to the output of ssh -G showing the original host arg. Inspired by patch from vincent at bernat.ch via bz#3343, ok djm@
Revision 1.371 / (download) - annotate - [select for diffs], Mon Jan 2 07:03:30 2023 UTC (16 months, 2 weeks ago) by djm
Branch: MAIN
Changes since 1.370: +33 -29 lines
Diff to previous 1.370 (colored)
fix bug in PermitRemoteOpen which caused it to ignore its first argument unless it was one of the special keywords "any" or "none". Reported by Georges Chaudy in bz3515; ok dtucker@
Revision 1.370 / (download) - annotate - [select for diffs], Mon Nov 28 01:37:36 2022 UTC (17 months, 2 weeks ago) by djm
Branch: MAIN
Changes since 1.369: +11 -1 lines
Diff to previous 1.369 (colored)
New EnableEscapeCommandline ssh_config(5) option This option (default "no") controls whether the ~C escape is available. Turning it off by default means we will soon be able to use a stricter default pledge(2) in the client. feedback deraadt@ dtucker@; tested in snaps for a while
Revision 1.369 / (download) - annotate - [select for diffs], Sat Sep 17 10:33:18 2022 UTC (19 months, 4 weeks ago) by djm
Branch: MAIN
CVS Tags: OPENBSD_7_2_BASE,
OPENBSD_7_2
Changes since 1.368: +11 -2 lines
Diff to previous 1.368 (colored)
add a RequiredRSASize for checking RSA key length in ssh(1). User authentication keys that fall beneath this limit will be ignored. If a host presents a host key beneath this limit then the connection will be terminated (unfortunately there are no fallbacks in the protocol for host authentication). feedback deraadt, Dmitry Belyavskiy; ok markus@
Revision 1.368 / (download) - annotate - [select for diffs], Fri Jun 3 04:30:47 2022 UTC (23 months, 2 weeks ago) by djm
Branch: MAIN
Changes since 1.367: +15 -26 lines
Diff to previous 1.367 (colored)
Make SetEnv directives first-match-wins in both sshd_config and sshd_config; previously if the same name was reused then the last would win (which is the opposite to how the config is supposed to work). While there, make the ssh_config parsing more like sshd_config. bz3438, ok dtucker
Revision 1.367 / (download) - annotate - [select for diffs], Wed Apr 20 15:56:49 2022 UTC (2 years ago) by millert
Branch: MAIN
Changes since 1.366: +3 -7 lines
Diff to previous 1.366 (colored)
Avoid an unnecessary xstrdup in rm_env() when matching patterns. Since match_pattern() doesn't modify its arguments (they are const), there is no need to make an extra copy of the strings in options->send_env. From Martin Vahlensieck
Revision 1.366 / (download) - annotate - [select for diffs], Tue Feb 8 08:59:12 2022 UTC (2 years, 3 months ago) by dtucker
Branch: MAIN
CVS Tags: OPENBSD_7_1_BASE,
OPENBSD_7_1
Changes since 1.365: +4 -5 lines
Diff to previous 1.365 (colored)
Switch hpdelim interface to accept only ":" as delimiter. Historicallly, hpdelim accepted ":" or "/" as a port delimiter between hosts (or addresses) and ports. These days most of the uses for "/" are no longer accepted, so there are several places where it checks the delimiter to disallow it. Make hpdelim accept only ":" and use hpdelim2 in the other cases. ok djm@
Revision 1.365 / (download) - annotate - [select for diffs], Fri Feb 4 02:49:17 2022 UTC (2 years, 3 months ago) by dtucker
Branch: MAIN
Changes since 1.364: +2 -2 lines
Diff to previous 1.364 (colored)
Since they are deprecated, move DSA to the end of the default list of public keys so that they will be tried last. From github PR#295 from "ProBackup-nl", ok djm@
Revision 1.364 / (download) - annotate - [select for diffs], Sun Dec 19 22:14:47 2021 UTC (2 years, 4 months ago) by djm
Branch: MAIN
Changes since 1.363: +15 -3 lines
Diff to previous 1.363 (colored)
PubkeyAuthentication=yes|no|unbound|host-bound Allow control over which pubkey methods are used. Added out of concern that some hardware devices may have difficulty signing the longer pubkey authentication challenges. This provides a way for them to disable the extension. It's also handy for testing. feedback / ok markus@
Revision 1.363 / (download) - annotate - [select for diffs], Thu Sep 16 05:36:03 2021 UTC (2 years, 8 months ago) by djm
Branch: MAIN
CVS Tags: OPENBSD_7_0_BASE,
OPENBSD_7_0
Changes since 1.362: +2 -2 lines
Diff to previous 1.362 (colored)
missing space character in ssh -G output broke the t-sshcfgparse regression test; spotted by anton@
Revision 1.362 / (download) - annotate - [select for diffs], Wed Sep 15 06:56:01 2021 UTC (2 years, 8 months ago) by djm
Branch: MAIN
Changes since 1.361: +47 -11 lines
Diff to previous 1.361 (colored)
allow CanonicalizePermittedCNAMEs=none in ssh_config; ok markus@
Revision 1.361 / (download) - annotate - [select for diffs], Fri Jul 23 04:04:52 2021 UTC (2 years, 9 months ago) by djm
Branch: MAIN
Changes since 1.360: +11 -2 lines
Diff to previous 1.360 (colored)
Add a ForkAfterAuthentication ssh_config(5) counterpart to the ssh(1) -f flag. Last part of GHPR231 from Volker Diels-Grabsch. ok dtucker
Revision 1.360 / (download) - annotate - [select for diffs], Fri Jul 23 04:00:59 2021 UTC (2 years, 9 months ago) by djm
Branch: MAIN
Changes since 1.359: +11 -2 lines
Diff to previous 1.359 (colored)
Add a StdinNull directive to ssh_config(5) that allows the config file to do the same thing as -n does on the ssh(1) commandline. Patch from Volker Diels-Grabsch via GHPR231; ok dtucker
Revision 1.359 / (download) - annotate - [select for diffs], Tue Jul 13 23:48:36 2021 UTC (2 years, 10 months ago) by djm
Branch: MAIN
Changes since 1.358: +21 -2 lines
Diff to previous 1.358 (colored)
add a SessionType directive to ssh_config, allowing the configuration file to offer equivalent control to the -N (no session) and -s (subsystem) command-line flags. Part of GHPR#231 by Volker Diels-Grabsch with some minor tweaks; feedback and ok dtucker@
Revision 1.358 / (download) - annotate - [select for diffs], Fri Jul 2 05:11:21 2021 UTC (2 years, 10 months ago) by dtucker
Branch: MAIN
Changes since 1.357: +5 -13 lines
Diff to previous 1.357 (colored)
Remove references to ChallengeResponseAuthentication in favour of KbdInteractiveAuthentication. The former is what was in SSHv1, the latter is what is in SSHv2 (RFC4256) and they were treated as somewhat but not entirely equivalent. We retain the old name as deprecated alias so config files continue to work and a reference in the man page for people looking for it. Prompted by bz#3303 which pointed out the discrepancy between the two when used with Match. Man page help & ok jmc@, with & ok djm@
Revision 1.357 / (download) - annotate - [select for diffs], Tue Jun 8 22:06:12 2021 UTC (2 years, 11 months ago) by djm
Branch: MAIN
Changes since 1.356: +3 -2 lines
Diff to previous 1.356 (colored)
fix regression in r1.356: for ssh_config options that accepted multiple string arguments, ssh was only recording the first. Reported by Lucas via bugs@
Revision 1.356 / (download) - annotate - [select for diffs], Tue Jun 8 07:07:15 2021 UTC (2 years, 11 months ago) by djm
Branch: MAIN
Changes since 1.355: +266 -150 lines
Diff to previous 1.355 (colored)
Switch ssh_config parsing to use argv_split() This fixes a couple of problems with the previous tokeniser, strdelim() 1. strdelim() is permissive wrt accepting '=' characters. This is intended to allow it to tokenise "Option=value" but because it cannot keep state, it will incorrectly split "Opt=val=val2". 2. strdelim() has rudimentry handling of quoted strings, but it is incomplete and inconsistent. E.g. it doesn't handle escaped quotes inside a quoted string. 3. It has no support for stopping on a (unquoted) comment. Because of this readconf.c r1.343 added chopping of lines at '#', but this caused a regression because these characters may legitimately appear inside quoted strings. The new tokeniser is stricter is a number of cases, including #1 above but previously it was also possible for some directives to appear without arguments. AFAIK these were nonsensical in all cases, and the new tokeniser refuses to accept them. The new code handles quotes much better, permitting quoted space as well as escaped closing quotes. Finally, comment handling should be fixed - the tokeniser will terminate only on unquoted # characters. feedback & ok markus@ tested in snaps for the last five or so days - thanks Theo and those who caught bugs
Revision 1.355 / (download) - annotate - [select for diffs], Tue Jun 8 07:02:46 2021 UTC (2 years, 11 months ago) by dtucker
Branch: MAIN
Changes since 1.354: +3 -3 lines
Diff to previous 1.354 (colored)
Check if IPQoS or TunnelDevice are already set before overriding. Prevents values in config files from overriding values supplied on the command line. bz#3319, ok markus.
Revision 1.354 / (download) - annotate - [select for diffs], Sun May 23 18:22:57 2021 UTC (2 years, 11 months ago) by naddy
Branch: MAIN
Changes since 1.353: +2 -2 lines
Diff to previous 1.353 (colored)
ssh: The client configuration keyword is "hostbasedacceptedalgorithms" This fixes a mistake that slipped in when "HostbasedKeyTypes" was renamed to "HostbasedAcceptedAlgorithms". Bug report by zack@philomathiclife.com
Revision 1.353 / (download) - annotate - [select for diffs], Sat Apr 3 06:18:40 2021 UTC (3 years, 1 month ago) by djm
Branch: MAIN
CVS Tags: OPENBSD_6_9_BASE,
OPENBSD_6_9
Changes since 1.352: +4 -4 lines
Diff to previous 1.352 (colored)
highly polished whitespace, mostly fixing spaces-for-tab and bad indentation on continuation lines. Prompted by GHPR#185
Revision 1.352 / (download) - annotate - [select for diffs], Wed Feb 24 01:18:08 2021 UTC (3 years, 2 months ago) by dtucker
Branch: MAIN
Changes since 1.351: +3 -3 lines
Diff to previous 1.351 (colored)
Put obsolete aliases for hostbasedalgorithms and pubkeyacceptedalgorithms after their current names so that the config-dump mode finds and uses the current names. Spotted by Phil Pennock.
Revision 1.351 / (download) - annotate - [select for diffs], Mon Feb 15 20:43:15 2021 UTC (3 years, 3 months ago) by markus
Branch: MAIN
Changes since 1.350: +60 -3 lines
Diff to previous 1.350 (colored)
ssh: add PermitRemoteOpen for remote dynamic forwarding with SOCKS ok djm@, dtucker@
Revision 1.350 / (download) - annotate - [select for diffs], Tue Jan 26 05:32:21 2021 UTC (3 years, 3 months ago) by dtucker
Branch: MAIN
Changes since 1.349: +10 -9 lines
Diff to previous 1.349 (colored)
Rename HostbasedKeyTypes (ssh) and HostbasedAcceptedKeyTypes (sshd) to HostbasedAcceptedAlgorithms, which more accurately reflects its effect. This matches a previous change to PubkeyAcceptedAlgorithms. The previous names are retained as aliases. ok djm@
Revision 1.349 / (download) - annotate - [select for diffs], Fri Jan 22 02:44:58 2021 UTC (3 years, 3 months ago) by dtucker
Branch: MAIN
Changes since 1.348: +14 -13 lines
Diff to previous 1.348 (colored)
Rename PubkeyAcceptedKeyTypes keyword to PubkeyAcceptedAlgorithms. While the two were originally equivalent, this actually specifies the signature algorithms that are accepted. Some key types (eg RSA) can be used by multiple algorithms (eg ssh-rsa, rsa-sha2-512) so the old name is becoming increasingly misleading. The old name is retained as an alias. Prompted by bz#3253, help & ok djm@, man page help jmc@
Revision 1.348 / (download) - annotate - [select for diffs], Fri Jan 8 04:49:13 2021 UTC (3 years, 4 months ago) by djm
Branch: MAIN
Changes since 1.347: +2 -2 lines
Diff to previous 1.347 (colored)
make CheckHostIP default to 'no'. It doesn't provide any perceptible value and makes it much harder for hosts to change host keys, particularly ones that use IP-based load-balancing. ok dtucker@
Revision 1.347 / (download) - annotate - [select for diffs], Tue Dec 22 03:05:31 2020 UTC (3 years, 4 months ago) by tb
Branch: MAIN
Changes since 1.346: +1 -4 lines
Diff to previous 1.346 (colored)
Remove lines accidentally left behind in the ProxyJump parsing fix r1.345. ok djm
Revision 1.346 / (download) - annotate - [select for diffs], Tue Dec 22 00:15:22 2020 UTC (3 years, 4 months ago) by djm
Branch: MAIN
Changes since 1.345: +10 -2 lines
Diff to previous 1.345 (colored)
add a ssh_config KnownHostsCommand that allows the client to obtain known_hosts data from a command in addition to the usual files. The command accepts bunch of %-expansions, including details of the connection and the offered server host key. Note that the command may be invoked up to three times per connection (see the manpage for details). ok markus@
Revision 1.345 / (download) - annotate - [select for diffs], Mon Dec 21 09:19:53 2020 UTC (3 years, 4 months ago) by djm
Branch: MAIN
Changes since 1.344: +9 -4 lines
Diff to previous 1.344 (colored)
properly fix ProxyJump parsing; Thanks to tb@ for pointing out my error (parse_ssh_uri() can return -1/0/1, that I missed). Reported by Raf Czlonka via bugs@ ok tb@
Revision 1.344 / (download) - annotate - [select for diffs], Thu Dec 17 23:10:27 2020 UTC (3 years, 4 months ago) by djm
Branch: MAIN
Changes since 1.343: +404 -155 lines
Diff to previous 1.343 (colored)
prepare readconf.c for fuzzing; remove fatal calls and fix some (one-off) memory leaks; ok markus@
Revision 1.343 / (download) - annotate - [select for diffs], Mon Nov 30 05:36:39 2020 UTC (3 years, 5 months ago) by dtucker
Branch: MAIN
Changes since 1.342: +9 -2 lines
Diff to previous 1.342 (colored)
Ignore comments at the end of config lines in ssh_config, similar to what we already do for sshd_config. bz#2320, with & ok djm@
Revision 1.342 / (download) - annotate - [select for diffs], Sun Nov 15 22:34:58 2020 UTC (3 years, 6 months ago) by djm
Branch: MAIN
Changes since 1.341: +3 -3 lines
Diff to previous 1.341 (colored)
revert r1.341; it breaks ProxyJump; reported by sthen@
Revision 1.341 / (download) - annotate - [select for diffs], Wed Nov 11 05:22:32 2020 UTC (3 years, 6 months ago) by djm
Branch: MAIN
Changes since 1.340: +3 -3 lines
Diff to previous 1.340 (colored)
fix logic error that broke URI parsing in ProxyJump directives; ok dtucker@
Revision 1.340 / (download) - annotate - [select for diffs], Sun Oct 18 11:32:01 2020 UTC (3 years, 6 months ago) by djm
Branch: MAIN
Changes since 1.339: +11 -12 lines
Diff to previous 1.339 (colored)
use the new variant log macros instead of prepending __func__ and appending ssh_err(r) manually; ok markus@
Revision 1.339 / (download) - annotate - [select for diffs], Fri Oct 16 13:26:13 2020 UTC (3 years, 7 months ago) by djm
Branch: MAIN
Changes since 1.338: +20 -3 lines
Diff to previous 1.338 (colored)
LogVerbose keyword for ssh and sshd Allows forcing maximum debug logging by file/function/line pattern- lists. ok markus@
Revision 1.338 / (download) - annotate - [select for diffs], Wed Oct 7 02:18:45 2020 UTC (3 years, 7 months ago) by djm
Branch: MAIN
Changes since 1.337: +4 -3 lines
Diff to previous 1.337 (colored)
disable UpdateHostkeys by default if VerifyHostKeyDNS is enabled; suggested by Mark D. Baushke
Revision 1.337 / (download) - annotate - [select for diffs], Sat Oct 3 09:22:26 2020 UTC (3 years, 7 months ago) by djm
Branch: MAIN
Changes since 1.336: +4 -15 lines
Diff to previous 1.336 (colored)
There are lots of place where we want to redirect stdin, stdout and/or stderr to /dev/null. Factor all these out to a single stdfd_devnull() function that allows selection of which of these to redirect. ok markus@
Revision 1.336 / (download) - annotate - [select for diffs], Sat Oct 3 08:30:47 2020 UTC (3 years, 7 months ago) by djm
Branch: MAIN
Changes since 1.335: +8 -2 lines
Diff to previous 1.335 (colored)
enable UpdateHostkeys by default when the configuration has not overridden UserKnownHostsFile; ok markus@ "The timing is perfect" deraadt@
Revision 1.335 / (download) - annotate - [select for diffs], Thu Aug 27 02:11:09 2020 UTC (3 years, 8 months ago) by djm
Branch: MAIN
CVS Tags: OPENBSD_6_8_BASE,
OPENBSD_6_8
Changes since 1.334: +1 -13 lines
Diff to previous 1.334 (colored)
remove unreachable code I forgot to delete in r1.334
Revision 1.334 / (download) - annotate - [select for diffs], Tue Aug 11 09:49:57 2020 UTC (3 years, 9 months ago) by djm
Branch: MAIN
Changes since 1.333: +68 -17 lines
Diff to previous 1.333 (colored)
let ssh_config(5)'s AddKeysToAgent keyword accept a time limit for keys in addition to its current flag options. Time-limited keys will automatically be removed from ssh-agent after their expiry time has passed; ok markus@
Revision 1.333 / (download) - annotate - [select for diffs], Fri Jul 17 07:09:24 2020 UTC (3 years, 10 months ago) by dtucker
Branch: MAIN
Changes since 1.332: +5 -2 lines
Diff to previous 1.332 (colored)
Add %k to the TOKENs for Match Exec for consistency with the other keywords that recently got %k.
Revision 1.332 / (download) - annotate - [select for diffs], Sun Jul 5 23:59:45 2020 UTC (3 years, 10 months ago) by djm
Branch: MAIN
Changes since 1.331: +6 -6 lines
Diff to previous 1.331 (colored)
some language improvements; ok markus
Revision 1.331 / (download) - annotate - [select for diffs], Fri May 29 04:25:40 2020 UTC (3 years, 11 months ago) by dtucker
Branch: MAIN
Changes since 1.330: +16 -4 lines
Diff to previous 1.330 (colored)
Allow some keywords to expand shell-style ${ENV} environment
variables on the client side. The supported keywords are
CertificateFile, ControlPath, IdentityAgent and IdentityFile, plus
LocalForward and RemoteForward when used for Unix domain socket
paths. This would for example allow forwarding of Unix domain
socket paths that change at runtime. bz#3140, ok djm@
Revision 1.330 / (download) - annotate - [select for diffs], Wed May 27 21:25:18 2020 UTC (3 years, 11 months ago) by djm
Branch: MAIN
Changes since 1.329: +7 -2 lines
Diff to previous 1.329 (colored)
fix crash in recallocarray when deleting SendEnv variables; spotted by & ok sthen@
Revision 1.329 / (download) - annotate - [select for diffs], Fri Apr 24 03:33:21 2020 UTC (4 years ago) by dtucker
Branch: MAIN
CVS Tags: OPENBSD_6_7_BASE,
OPENBSD_6_7
Changes since 1.328: +2 -2 lines
Diff to previous 1.328 (colored)
Fix incorrect error message for "too many known hosts files." bz#3149, patch from jjelen at redhat.com.
Revision 1.328 / (download) - annotate - [select for diffs], Fri Apr 3 03:12:11 2020 UTC (4 years, 1 month ago) by dtucker
Branch: MAIN
Changes since 1.327: +2 -2 lines
Diff to previous 1.327 (colored)
%C expansion just added to Match Exec should include remote user not local user.
Revision 1.327 / (download) - annotate - [select for diffs], Fri Apr 3 02:27:12 2020 UTC (4 years, 1 month ago) by dtucker
Branch: MAIN
Changes since 1.326: +25 -1 lines
Diff to previous 1.326 (colored)
Make with config keywords support which percent_expansions more consistent. - %C is moved into its own function and added to Match Exec. - move the common (global) options into a macro. This is ugly but it's the least-ugly way I could come up with. - move IdentityAgent and ForwardAgent percent expansion to before the config dump to make it regression-testable. - document all of the above ok jmc@ for man page bits, "makes things less terrible" djm@ for the rest.
Revision 1.326 / (download) - annotate - [select for diffs], Thu Feb 6 22:46:31 2020 UTC (4 years, 3 months ago) by djm
Branch: MAIN
Changes since 1.325: +15 -3 lines
Diff to previous 1.325 (colored)
expand HostkeyAlgorithms prior to config dump, matching other algorithm lists; ok markus@
Revision 1.325 / (download) - annotate - [select for diffs], Mon Feb 3 23:47:57 2020 UTC (4 years, 3 months ago) by djm
Branch: MAIN
Changes since 1.324: +3 -14 lines
Diff to previous 1.324 (colored)
revert enabling UpdateHostKeys by default - there are still corner cases we need to address; ok markus
Revision 1.324 / (download) - annotate - [select for diffs], Thu Jan 30 22:19:32 2020 UTC (4 years, 3 months ago) by djm
Branch: MAIN
Changes since 1.323: +14 -3 lines
Diff to previous 1.323 (colored)
enable UpdateKnownHosts=yes if the configuration specifies only the default known_hosts files, otherwise select UpdateKnownHosts=ask; ok markus@
Revision 1.323 / (download) - annotate - [select for diffs], Sat Jan 25 00:22:31 2020 UTC (4 years, 3 months ago) by djm
Branch: MAIN
Changes since 1.322: +2 -2 lines
Diff to previous 1.322 (colored)
set UpdateKnownHosts=ask by default; bz#2894; ok markus@
Revision 1.322 / (download) - annotate - [select for diffs], Thu Jan 23 10:24:29 2020 UTC (4 years, 3 months ago) by dtucker
Branch: MAIN
Changes since 1.321: +10 -2 lines
Diff to previous 1.321 (colored)
Make zlib optional. This adds a "ZLIB" build time option that allows building without zlib compression and associated options. With feedback from markus@, ok djm@
Revision 1.321 / (download) - annotate - [select for diffs], Thu Jan 23 07:10:22 2020 UTC (4 years, 3 months ago) by dtucker
Branch: MAIN
Changes since 1.320: +2 -2 lines
Diff to previous 1.320 (colored)
Replace all calls to signal(2) with a wrapper around sigaction(2). This wrapper blocks all other signals during the handler preventing races between handlers, and sets SA_RESTART which should reduce the potential for short read/write operations.
Revision 1.320 / (download) - annotate - [select for diffs], Thu Jan 23 02:46:49 2020 UTC (4 years, 3 months ago) by dtucker
Branch: MAIN
Changes since 1.319: +34 -19 lines
Diff to previous 1.319 (colored)
Remove unsupported algorithms from list of defaults at run time and remove ifdef and distinct settings for OPENSSL=no case. This will make things much simpler for -portable where the exact set of algos depends on the configuration of both OpenSSH and the libcrypto it's linked against (if any). ok djm@
Revision 1.319 / (download) - annotate - [select for diffs], Sat Dec 21 02:19:13 2019 UTC (4 years, 4 months ago) by djm
Branch: MAIN
Changes since 1.318: +37 -6 lines
Diff to previous 1.318 (colored)
Allow forwarding a different agent socket to the path specified by $SSH_AUTH_SOCK, by extending the existing ForwardAgent option to accepting an explicit path or the name of an environment variable in addition to yes/no. Patch by Eric Chiang, manpage by me; ok markus@
Revision 1.318 / (download) - annotate - [select for diffs], Fri Dec 20 02:42:42 2019 UTC (4 years, 4 months ago) by dtucker
Branch: MAIN
Changes since 1.317: +5 -5 lines
Diff to previous 1.317 (colored)
Move always unsupported keywords to be grouped with the other ones. Move oSecurityProvider to match the order in the OpCodes enum. Patch from openbsd@academicsolutions.ch, ok djm@
Revision 1.317 / (download) - annotate - [select for diffs], Fri Dec 20 02:29:21 2019 UTC (4 years, 4 months ago) by dtucker
Branch: MAIN
Changes since 1.316: +6 -6 lines
Diff to previous 1.316 (colored)
Remove obsolete opcodes from the configuation enum. Patch from openbsd@academicsolutions.ch, ok djm@
Revision 1.316 / (download) - annotate - [select for diffs], Fri Dec 20 02:11:38 2019 UTC (4 years, 4 months ago) by dtucker
Branch: MAIN
Changes since 1.315: +1 -3 lines
Diff to previous 1.315 (colored)
Remove now-obsolete config options from example in comment. Patch from openbsd@academicsolutions.ch, ok djm@
Revision 1.315 / (download) - annotate - [select for diffs], Sun Dec 15 18:57:30 2019 UTC (4 years, 5 months ago) by djm
Branch: MAIN
Changes since 1.314: +2 -2 lines
Diff to previous 1.314 (colored)
allow security keys to act as host keys as well as user keys. Previously we didn't do this because we didn't want to expose the attack surface presented by USB and FIDO protocol handling, but now that this is insulated behind ssh-sk-helper there is less risk. ok markus@
Revision 1.314 / (download) - annotate - [select for diffs], Thu Nov 14 21:27:29 2019 UTC (4 years, 6 months ago) by djm
Branch: MAIN
Changes since 1.313: +2 -2 lines
Diff to previous 1.313 (colored)
directly support U2F/FIDO2 security keys in OpenSSH by linking against the (previously external) USB HID middleware. The dlopen() capability still exists for alternate middlewares, e.g. for Bluetooth, NFC and test/debugging.
Revision 1.313 / (download) - annotate - [select for diffs], Wed Nov 13 05:42:26 2019 UTC (4 years, 6 months ago) by deraadt
Branch: MAIN
Changes since 1.312: +3 -3 lines
Diff to previous 1.312 (colored)
remove size_t gl_pathc < 0 test, it is invalid. the return value from glob() is sufficient. discussed with djm
Revision 1.312 / (download) - annotate - [select for diffs], Wed Nov 13 04:47:52 2019 UTC (4 years, 6 months ago) by deraadt
Branch: MAIN
Changes since 1.311: +2 -1 lines
Diff to previous 1.311 (colored)
stdarg.h required more broadly; ok djm
Revision 1.311 / (download) - annotate - [select for diffs], Tue Nov 12 19:33:08 2019 UTC (4 years, 6 months ago) by markus
Branch: MAIN
Changes since 1.310: +3 -1 lines
Diff to previous 1.310 (colored)
enable ed25519 support; ok djm
Revision 1.310 / (download) - annotate - [select for diffs], Thu Oct 31 21:18:28 2019 UTC (4 years, 6 months ago) by djm
Branch: MAIN
Changes since 1.309: +15 -2 lines
Diff to previous 1.309 (colored)
ssh client support for U2F/FIDO keys
Revision 1.309 / (download) - annotate - [select for diffs], Fri Sep 6 14:45:34 2019 UTC (4 years, 8 months ago) by naddy
Branch: MAIN
CVS Tags: OPENBSD_6_6_BASE,
OPENBSD_6_6
Changes since 1.308: +9 -5 lines
Diff to previous 1.308 (colored)
Allow prepending a list of algorithms to the default set by starting the list with the '^' character, e.g. HostKeyAlgorithms ^ssh-ed25519 Ciphers ^aes128-gcm@openssh.com,aes256-gcm@openssh.com ok djm@ dtucker@
Revision 1.308 / (download) - annotate - [select for diffs], Fri Aug 9 05:05:54 2019 UTC (4 years, 9 months ago) by djm
Branch: MAIN
Changes since 1.307: +6 -1 lines
Diff to previous 1.307 (colored)
produce a useful error message if the user's shell is set incorrectly during "match exec" processing. bz#2791 reported by Dario Bertini; ok dtucker
Revision 1.307 / (download) - annotate - [select for diffs], Fri Jun 28 13:35:04 2019 UTC (4 years, 10 months ago) by deraadt
Branch: MAIN
Changes since 1.306: +2 -2 lines
Diff to previous 1.306 (colored)
When system calls indicate an error they return -1, not some arbitrary value < 0. errno is only updated in this case. Change all (most?) callers of syscalls to follow this better, and let's see if this strictness helps us in the future.
Revision 1.306 / (download) - annotate - [select for diffs], Wed Jun 12 11:31:50 2019 UTC (4 years, 11 months ago) by jmc
Branch: MAIN
Changes since 1.305: +6 -6 lines
Diff to previous 1.305 (colored)
Hostname->HostName cleanup; from lauri tirkkonen ok dtucker
Revision 1.305 / (download) - annotate - [select for diffs], Fri Jun 7 14:18:48 2019 UTC (4 years, 11 months ago) by dtucker
Branch: MAIN
Changes since 1.304: +2 -2 lines
Diff to previous 1.304 (colored)
Typo and spelling fixes in comments and error messages. Patch from knweiss at gmail.com via -portable.
Revision 1.304 / (download) - annotate - [select for diffs], Fri Mar 1 02:08:50 2019 UTC (5 years, 2 months ago) by djm
Branch: MAIN
CVS Tags: OPENBSD_6_5_BASE,
OPENBSD_6_5
Changes since 1.303: +3 -2 lines
Diff to previous 1.303 (colored)
let PKCS11Provider=none do what users expect print PKCS11Provider instead of obsolete SmartcardDevice in config dump. bz#2974 ok dtucker@
Revision 1.303 / (download) - annotate - [select for diffs], Sat Feb 23 08:20:43 2019 UTC (5 years, 2 months ago) by djm
Branch: MAIN
Changes since 1.302: +4 -4 lines
Diff to previous 1.302 (colored)
openssh-7.9 accidentally reused the server's algorithm lists in the client for KEX, ciphers and MACs. The ciphers and MACs were identical between the client and server, but the error accidentially disabled the diffie-hellman-group-exchange-sha1 KEX method. This fixes the client code to use the correct method list, but because nobody complained, it also disables the diffie-hellman-group-exchange-sha1 KEX method. Reported by nuxi AT vault24.org via bz#2697; ok dtucker
Revision 1.302 / (download) - annotate - [select for diffs], Fri Nov 23 05:08:07 2018 UTC (5 years, 5 months ago) by djm
Branch: MAIN
Changes since 1.301: +28 -16 lines
Diff to previous 1.301 (colored)
add a ssh_config "Match final" predicate Matches in same pass as "Match canonical" but doesn't require hostname canonicalisation be enabled. bz#2906 ok markus
Revision 1.301 / (download) - annotate - [select for diffs], Fri Nov 16 03:26:01 2018 UTC (5 years, 6 months ago) by djm
Branch: MAIN
Changes since 1.300: +2 -2 lines
Diff to previous 1.300 (colored)
use path_absolute() for pathname checks; from Manoj Ampalam
Revision 1.300 / (download) - annotate - [select for diffs], Fri Oct 5 14:26:09 2018 UTC (5 years, 7 months ago) by naddy
Branch: MAIN
CVS Tags: OPENBSD_6_4_BASE,
OPENBSD_6_4
Changes since 1.299: +15 -6 lines
Diff to previous 1.299 (colored)
Support using service names for port numbers. * Try to resolve a port specification with getservbyname(3) if a numeric conversion fails. * Make the "Port" option in ssh_config handle its argument as a port rather than a plain integer. ok dtucker@ deraadt@
Revision 1.299 / (download) - annotate - [select for diffs], Wed Oct 3 06:38:35 2018 UTC (5 years, 7 months ago) by djm
Branch: MAIN
Changes since 1.298: +13 -2 lines
Diff to previous 1.298 (colored)
Allow ssh_config IdentityAgent directive to accept environment variable names as well as explicit paths. ok dtucker@
Revision 1.298 / (download) - annotate - [select for diffs], Thu Sep 20 03:30:44 2018 UTC (5 years, 7 months ago) by djm
Branch: MAIN
Changes since 1.297: +13 -3 lines
Diff to previous 1.297 (colored)
add CASignatureAlgorithms option for the client, allowing it to specify which signature algorithms may be used by CAs when signing certificates. Useful if you want to ban RSA/SHA1; ok markus@
Revision 1.297 / (download) - annotate - [select for diffs], Sun Aug 12 20:19:13 2018 UTC (5 years, 9 months ago) by djm
Branch: MAIN
Changes since 1.296: +15 -12 lines
Diff to previous 1.296 (colored)
better diagnosics on alg list assembly errors; ok deraadt@ markus@
Revision 1.296 / (download) - annotate - [select for diffs], Fri Jul 27 05:34:42 2018 UTC (5 years, 9 months ago) by dtucker
Branch: MAIN
Changes since 1.295: +1 -3 lines
Diff to previous 1.295 (colored)
Now that ssh can't be setuid, remove the original_real_uid and original_effective_uid globals and replace with calls to plain getuid(). ok djm@
Revision 1.295 / (download) - annotate - [select for diffs], Fri Jul 27 05:13:02 2018 UTC (5 years, 9 months ago) by dtucker
Branch: MAIN
Changes since 1.294: +1 -4 lines
Diff to previous 1.294 (colored)
Remove uid checks from low port binds. Now that ssh cannot be setuid and sshd always has privsep on, we can remove the uid checks for low port binds and just let the system do the check. We leave a sanity check for the !privsep case so long as the code is stil there. with & ok djm@
Revision 1.294 / (download) - annotate - [select for diffs], Thu Jul 19 10:28:47 2018 UTC (5 years, 9 months ago) by dtucker
Branch: MAIN
Changes since 1.293: +2 -10 lines
Diff to previous 1.293 (colored)
Deprecate UsePrivilegedPort now that support for running ssh(1) setuid has been removed, remove supporting code and clean up references to it in the man pages We have not shipped ssh(1) the setuid bit since 2002. If ayone really needs to make connections from a low port number this can be implemented via a small setuid ProxyCommand. ok markus@ jmc@ djm@
Revision 1.293 / (download) - annotate - [select for diffs], Wed Jul 18 11:34:04 2018 UTC (5 years, 10 months ago) by dtucker
Branch: MAIN
Changes since 1.292: +1 -4 lines
Diff to previous 1.292 (colored)
Remove support for running ssh(1) setuid and fatal if attempted. Do not link uidwap.c into ssh any more. Neuters UsePrivilegedPort, which will be marked as deprecated shortly. ok markus@ djm@
Revision 1.292 / (download) - annotate - [select for diffs], Wed Jul 4 13:49:31 2018 UTC (5 years, 10 months ago) by djm
Branch: MAIN
Changes since 1.291: +28 -10 lines
Diff to previous 1.291 (colored)
repair PubkeyAcceptedKeyTypes (and friends) after RSA signature work - returns ability to add/remove/specify algorithms by wildcard. Algorithm lists are now fully expanded when the server/client configs are finalised, so errors are reported early and the config dumps (e.g. "ssh -G ...") now list the actual algorithms selected. Clarify that, while wildcards are accepted in algorithm lists, they aren't full pattern-lists that support negation. (lots of) feedback, ok markus@
Revision 1.291 / (download) - annotate - [select for diffs], Sun Jun 10 23:45:41 2018 UTC (5 years, 11 months ago) by djm
Branch: MAIN
Changes since 1.290: +2 -2 lines
Diff to previous 1.290 (colored)
unbreak SendEnv; patch from tb@
Revision 1.290 / (download) - annotate - [select for diffs], Sat Jun 9 03:01:12 2018 UTC (5 years, 11 months ago) by djm
Branch: MAIN
Changes since 1.289: +31 -3 lines
Diff to previous 1.289 (colored)
add a SetEnv directive to ssh_config that allows setting environment variables for the remote session (subject to the server accepting them) refactor SendEnv to remove the arbitrary limit of variable names. ok markus@
Revision 1.289 / (download) - annotate - [select for diffs], Wed Jun 6 18:29:18 2018 UTC (5 years, 11 months ago) by markus
Branch: MAIN
Changes since 1.288: +5 -5 lines
Diff to previous 1.288 (colored)
switch config file parsing to getline(3) as this avoids static limits noted by gerhard@; ok dtucker@, djm@
Revision 1.288 / (download) - annotate - [select for diffs], Fri Jun 1 03:33:53 2018 UTC (5 years, 11 months ago) by djm
Branch: MAIN
Changes since 1.287: +5 -1 lines
Diff to previous 1.287 (colored)
make UID available as a %-expansion everywhere that the username is available currently. In the client this is via %i, in the server %U (since %i was already used in the client in some places for this, but used for something different in the server); bz#2870, ok dtucker@
Revision 1.287 / (download) - annotate - [select for diffs], Tue May 22 00:13:26 2018 UTC (5 years, 11 months ago) by djm
Branch: MAIN
Changes since 1.286: +22 -9 lines
Diff to previous 1.286 (colored)
support ProxyJump=none to disable ProxyJump functionality; bz#2869 ok dtucker@
Revision 1.286 / (download) - annotate - [select for diffs], Fri Apr 6 13:02:39 2018 UTC (6 years, 1 month ago) by djm
Branch: MAIN
Changes since 1.285: +42 -6 lines
Diff to previous 1.285 (colored)
Allow "SendEnv -PATTERN" to clear environment variables previously labeled for sendind. bz#1285 ok dtucker@
Revision 1.285 / (download) - annotate - [select for diffs], Fri Apr 6 03:51:27 2018 UTC (6 years, 1 month ago) by djm
Branch: MAIN
Changes since 1.284: +9 -1 lines
Diff to previous 1.284 (colored)
add a couple of missed options to the config dump; patch from Jakub Jelen via bz2835
Revision 1.284 / (download) - annotate - [select for diffs], Wed Apr 4 15:12:17 2018 UTC (6 years, 1 month ago) by job
Branch: MAIN
Changes since 1.283: +3 -3 lines
Diff to previous 1.283 (colored)
Update default IPQoS in ssh(1), sshd(8) to DSCP AF21 for interactive and CS1 for bulk
AF21 was selected as this is the highest priority within the low-latency
service class (and it is higher than what we have today). SSH is elastic
and time-sensitive data, where a user is waiting for a response via the
network in order to continue with a task at hand. As such, these flows
should be considered foreground traffic, with delays or drops to such
traffic directly impacting user-productivity.
For bulk SSH traffic, the CS1 "Lower Effort" marker was chosen to enable
networks implementing a scavanger/lower-than-best effort class to
discriminate scp(1) below normal activities, such as web surfing. In
general this type of bulk SSH traffic is a background activity.
An advantage of using "AF21" for interactive SSH and "CS1" for bulk SSH
is that they are recognisable values on all common platforms (IANA
https://www.iana.org/assignments/dscp-registry/dscp-registry.xml), and
for AF21 specifically a definition of the intended behavior exists
https://tools.ietf.org/html/rfc4594#section-4.7 in addition to the definition
of the Assured Forwarding PHB group https://tools.ietf.org/html/rfc2597, and
for CS1 (Lower Effort) there is https://tools.ietf.org/html/rfc3662
The first three bits of "AF21" map to the equivalent IEEEE 802.1D PCP, IEEE
802.11e, MPLS EXP/CoS and IP Precedence value of 2 (also known as "Immediate",
or "AC_BE"), and CS1's first 3 bits map to IEEEE 802.1D PCP, IEEE 802.11e,
MPLS/CoS and IP Precedence value 1 ("Background" or "AC_BK").
OK deraadt@, "no objection" djm@
Revision 1.283 / (download) - annotate - [select for diffs], Fri Feb 23 15:58:37 2018 UTC (6 years, 2 months ago) by markus
Branch: MAIN
CVS Tags: OPENBSD_6_3_BASE,
OPENBSD_6_3
Changes since 1.282: +2 -1 lines
Diff to previous 1.282 (colored)
Add experimental support for PQC XMSS keys (Extended Hash-Based Signatures) The code is not compiled in by default (see WITH_XMSS in Makefile.inc) Joint work with stefan-lukas_gazdag at genua.eu See https://tools.ietf.org/html/draft-irtf-cfrg-xmss-hash-based-signatures-12 ok djm@
Revision 1.282 / (download) - annotate - [select for diffs], Fri Feb 23 02:34:33 2018 UTC (6 years, 2 months ago) by djm
Branch: MAIN
Changes since 1.281: +9 -2 lines
Diff to previous 1.281 (colored)
Add BindInterface ssh_config directive and -B command-line argument to ssh(1) that directs it to bind its outgoing connection to the address of the specified network interface. BindInterface prefers to use addresses that aren't loopback or link- local, but will fall back to those if no other addresses of the required family are available on that interface. Based on patch by Mike Manning in bz#2820, ok dtucker@
Revision 1.281 / (download) - annotate - [select for diffs], Tue Dec 5 23:59:47 2017 UTC (6 years, 5 months ago) by dtucker
Branch: MAIN
Changes since 1.280: +5 -11 lines
Diff to previous 1.280 (colored)
Replace atoi and strtol conversions for integer arguments to config keywords with a checking wrapper around strtonum. This will prevent and flag invalid and negative arguments to these keywords. ok djm@
Revision 1.280 / (download) - annotate - [select for diffs], Sat Oct 21 23:06:24 2017 UTC (6 years, 6 months ago) by millert
Branch: MAIN
Changes since 1.279: +22 -32 lines
Diff to previous 1.279 (colored)
Add URI support to ssh, sftp and scp. For example ssh://user@host or sftp://user@host/path. The connection parameters described in draft-ietf-secsh-scp-sftp-ssh-uri-04 are not implemented since the ssh fingerprint format in the draft uses md5 with no way to specify the hash function type. OK djm@
Revision 1.279 / (download) - annotate - [select for diffs], Thu Sep 21 19:16:53 2017 UTC (6 years, 7 months ago) by markus
Branch: MAIN
CVS Tags: OPENBSD_6_2_BASE,
OPENBSD_6_2
Changes since 1.278: +24 -18 lines
Diff to previous 1.278 (colored)
Add 'reverse' dynamic forwarding which combines dynamic forwarding (-D) with remote forwarding (-R) where the remote-forwarded port expects SOCKS-requests. The SSH server code is unchanged and the parsing happens at the SSH clients side. Thus the full SOCKS-request is sent over the forwarded channel and the client parses c->output. Parsing happens in channel_before_prepare_select(), _before_ the select bitmask is computed in the pre[] handlers, but after network input processing in the post[] handlers. help and ok djm@
Revision 1.278 / (download) - annotate - [select for diffs], Sun Sep 3 23:33:13 2017 UTC (6 years, 8 months ago) by djm
Branch: MAIN
Changes since 1.277: +15 -4 lines
Diff to previous 1.277 (colored)
Expand ssh_config's StrictModes option with two new settings: StrictModes=accept-new will automatically accept hitherto-unseen keys but will refuse connections for changed or invalid hostkeys. StrictModes=off is the same as StrictModes=no Motivation: StrictModes=no combines two behaviours for host key processing: automatically learning new hostkeys and continuing to connect to hosts with invalid/changed hostkeys. The latter behaviour is quite dangerous since it removes most of the protections the SSH protocol is supposed to provide. Quite a few users want to automatically learn hostkeys however, so this makes that feature available with less danger. At some point in the future, StrictModes=no will change to be a synonym for accept-new, with its current behaviour remaining available via StrictModes=off. bz#2400, suggested by Michael Samuel; ok markus
Revision 1.277 / (download) - annotate - [select for diffs], Tue May 30 18:58:37 2017 UTC (6 years, 11 months ago) by bluhm
Branch: MAIN
Changes since 1.276: +11 -2 lines
Diff to previous 1.276 (colored)
Add RemoteCommand option to specify a command in the ssh config file instead of giving it on the client's command line. This command will be executed on the remote host. The feature allows to automate tasks using ssh config. OK markus@
Revision 1.276 / (download) - annotate - [select for diffs], Sat May 20 02:35:47 2017 UTC (6 years, 11 months ago) by djm
Branch: MAIN
Changes since 1.275: +3 -3 lines
Diff to previous 1.275 (colored)
there's no reason to artificially limit the key path here, just check that it fits PATH_MAX; spotted by Matthew Patton
Revision 1.275 / (download) - annotate - [select for diffs], Sun Apr 30 23:18:22 2017 UTC (7 years ago) by djm
Branch: MAIN
Changes since 1.274: +1 -26 lines
Diff to previous 1.274 (colored)
remove SSHv1 configuration options and man pages bits ok markus@
Revision 1.274 / (download) - annotate - [select for diffs], Sun Apr 30 23:15:04 2017 UTC (7 years ago) by djm
Branch: MAIN
Changes since 1.273: +2 -23 lines
Diff to previous 1.273 (colored)
remove SSHv1 ciphers; ok markus@
Revision 1.273 / (download) - annotate - [select for diffs], Sun Apr 30 23:11:45 2017 UTC (7 years ago) by djm
Branch: MAIN
Changes since 1.272: +11 -46 lines
Diff to previous 1.272 (colored)
remove options.protocol and client Protocol configuration knob ok markus@
Revision 1.272 / (download) - annotate - [select for diffs], Sun Apr 30 23:10:43 2017 UTC (7 years ago) by djm
Branch: MAIN
Changes since 1.271: +1 -10 lines
Diff to previous 1.271 (colored)
unifdef WITH_SSH1 ok markus@
Revision 1.271 / (download) - annotate - [select for diffs], Fri Apr 28 03:20:27 2017 UTC (7 years ago) by dtucker
Branch: MAIN
Changes since 1.270: +18 -2 lines
Diff to previous 1.270 (colored)
Add SyslogFacility option to ssh(1) matching the equivalent option in sshd(8). bz#2705, patch from erahn at arista.com, ok djm@
Revision 1.270 / (download) - annotate - [select for diffs], Fri Mar 10 04:27:32 2017 UTC (7 years, 2 months ago) by djm
Branch: MAIN
CVS Tags: OPENBSD_6_1_BASE,
OPENBSD_6_1
Changes since 1.269: +4 -2 lines
Diff to previous 1.269 (colored)
better match sshd config parser behaviour: fatal() if line is overlong, increase line buffer to match sshd's; bz#2651 reported by Don Fong; ok dtucker@
Revision 1.269 / (download) - annotate - [select for diffs], Fri Mar 10 03:24:48 2017 UTC (7 years, 2 months ago) by dtucker
Branch: MAIN
Changes since 1.268: +2 -1 lines
Diff to previous 1.268 (colored)
Plug mem leak on GLOB_NOMATCH case. From jjelen at redhat.com via bz#2687, ok djm@
Revision 1.268 / (download) - annotate - [select for diffs], Fri Feb 3 23:01:19 2017 UTC (7 years, 3 months ago) by djm
Branch: MAIN
Changes since 1.267: +7 -5 lines
Diff to previous 1.267 (colored)
support =- for removing methods from algorithms lists, e.g. Ciphers=-*cbc; suggested by Cristian Ionescu-Idbohrn in bz#2671 "I like it" markus@
Revision 1.267 / (download) - annotate - [select for diffs], Fri Feb 3 05:05:56 2017 UTC (7 years, 3 months ago) by djm
Branch: MAIN
Changes since 1.266: +3 -3 lines
Diff to previous 1.266 (colored)
allow form-feed characters at EOL; bz#2431 ok dtucker@
Revision 1.266 / (download) - annotate - [select for diffs], Mon Jan 30 00:38:50 2017 UTC (7 years, 3 months ago) by djm
Branch: MAIN
Changes since 1.265: +47 -29 lines
Diff to previous 1.265 (colored)
small cleanup post SSHv1 removal: remove SSHv1-isms in commented examples reorder token table to group deprecated and compile-time conditional tokens better fix config dumping code for some compile-time conditional options that weren't being correctly skipped (SSHv1 and PKCS#11)
Revision 1.265 / (download) - annotate - [select for diffs], Mon Jan 30 00:34:01 2017 UTC (7 years, 3 months ago) by djm
Branch: MAIN
Changes since 1.264: +3 -3 lines
Diff to previous 1.264 (colored)
some explicit NULL tests when dumping configured forwardings; from Karsten Weiss
Revision 1.264 / (download) - annotate - [select for diffs], Fri Jan 6 09:27:52 2017 UTC (7 years, 4 months ago) by djm
Branch: MAIN
Changes since 1.263: +2 -2 lines
Diff to previous 1.263 (colored)
fix previous
Revision 1.263 / (download) - annotate - [select for diffs], Fri Jan 6 03:53:58 2017 UTC (7 years, 4 months ago) by djm
Branch: MAIN
Changes since 1.262: +6 -1 lines
Diff to previous 1.262 (colored)
show a useful error message when included config files can't be opened; bz#2653, ok dtucker@
Revision 1.262 / (download) - annotate - [select for diffs], Tue Oct 25 04:08:13 2016 UTC (7 years, 6 months ago) by jsg
Branch: MAIN
Changes since 1.261: +2 -2 lines
Diff to previous 1.261 (colored)
Fix logic in add_local_forward() that inverted a test when code was refactored out into bind_permitted(). This broke ssh port forwarding for non-priv ports as a non root user. ok dtucker@ 'looks good' deraadt@
Revision 1.261 / (download) - annotate - [select for diffs], Sun Oct 23 22:04:05 2016 UTC (7 years, 6 months ago) by dtucker
Branch: MAIN
Changes since 1.260: +2 -2 lines
Diff to previous 1.260 (colored)
Factor out "can bind to low ports" check into its own function. This will make it easier for Portable to support platforms with permissions models other than uid==0 (eg bz#2625). ok djm@, "doesn't offend me too much" deraadt@.
Revision 1.260 / (download) - annotate - [select for diffs], Thu Aug 25 23:56:51 2016 UTC (7 years, 8 months ago) by djm
Branch: MAIN
Changes since 1.259: +1 -2 lines
Diff to previous 1.259 (colored)
remove superfluous NOTREACHED comment
Revision 1.259 / (download) - annotate - [select for diffs], Fri Jul 22 03:35:11 2016 UTC (7 years, 9 months ago) by djm
Branch: MAIN
CVS Tags: OPENBSD_6_0_BASE,
OPENBSD_6_0
Changes since 1.258: +16 -9 lines
Diff to previous 1.258 (colored)
reverse the order in which -J/JumpHost proxies are visited to be more intuitive and document reported by and manpage bits naddy@
Revision 1.258 / (download) - annotate - [select for diffs], Wed Jul 20 10:45:27 2016 UTC (7 years, 9 months ago) by naddy
Branch: MAIN
Changes since 1.257: +15 -12 lines
Diff to previous 1.257 (colored)
Do not clobber the global jump_host variables when parsing an inactive configuration. ok djm@
Revision 1.257 / (download) - annotate - [select for diffs], Fri Jul 15 00:24:30 2016 UTC (7 years, 10 months ago) by djm
Branch: MAIN
Changes since 1.256: +89 -6 lines
Diff to previous 1.256 (colored)
Add a ProxyJump ssh_config(5) option and corresponding -J ssh(1) command-line flag to allow simplified indirection through a SSH bastion or "jump host". These options construct a proxy command that connects to the specified jump host(s) (more than one may be specified) and uses port-forwarding to establish a connection to the next destination. This codifies the safest way of indirecting connections through SSH servers and makes it easy to use. ok markus@
Revision 1.256 / (download) - annotate - [select for diffs], Fri Jun 3 04:09:38 2016 UTC (7 years, 11 months ago) by dtucker
Branch: MAIN
Changes since 1.255: +15 -5 lines
Diff to previous 1.255 (colored)
Allow ExitOnForwardFailure and ClearAllForwardings to be overridden when using ssh -W (but still default to yes in that case). bz#2577, ok djm@.
Revision 1.255 / (download) - annotate - [select for diffs], Fri Jun 3 03:14:41 2016 UTC (7 years, 11 months ago) by dtucker
Branch: MAIN
Changes since 1.254: +3 -1 lines
Diff to previous 1.254 (colored)
Move the host and port used by ssh -W into the Options struct. This will make future changes a bit easier. ok djm@
Revision 1.254 / (download) - annotate - [select for diffs], Wed May 4 14:29:58 2016 UTC (8 years ago) by markus
Branch: MAIN
Changes since 1.253: +2 -1 lines
Diff to previous 1.253 (colored)
allow setting IdentityAgent to SSH_AUTH_SOCK; ok djm@
Revision 1.253 / (download) - annotate - [select for diffs], Wed May 4 12:21:53 2016 UTC (8 years ago) by markus
Branch: MAIN
Changes since 1.252: +9 -2 lines
Diff to previous 1.252 (colored)
IdentityAgent for specifying specific agent sockets; ok djm@
Revision 1.252 / (download) - annotate - [select for diffs], Fri Apr 15 00:30:19 2016 UTC (8 years, 1 month ago) by djm
Branch: MAIN
Changes since 1.251: +101 -11 lines
Diff to previous 1.251 (colored)
Include directive for ssh_config(5); feedback & ok markus@
Revision 1.251 / (download) - annotate - [select for diffs], Wed Apr 6 06:42:17 2016 UTC (8 years, 1 month ago) by djm
Branch: MAIN
Changes since 1.250: +13 -1 lines
Diff to previous 1.250 (colored)
don't record duplicate LocalForward and RemoteForward entries; fixes failure with ExitOnForwardFailure+hostname canonicalisation where the same forwards are added on the second pass through the configuration file. bz#2562; ok dtucker@
Revision 1.250 / (download) - annotate - [select for diffs], Mon Feb 8 23:40:12 2016 UTC (8 years, 3 months ago) by djm
Branch: MAIN
CVS Tags: OPENBSD_5_9_BASE,
OPENBSD_5_9
Changes since 1.249: +6 -3 lines
Diff to previous 1.249 (colored)
don't attempt to percent_expand() already-canonicalised addresses, avoiding unnecessary failures when attempting to connect to scoped IPv6 addresses (that naturally contain '%' characters)
Revision 1.249 / (download) - annotate - [select for diffs], Fri Jan 29 02:54:45 2016 UTC (8 years, 3 months ago) by dtucker
Branch: MAIN
Changes since 1.248: +4 -8 lines
Diff to previous 1.248 (colored)
Allow RekeyLimits in excess of 4G up to 2**63 bits (limited by the return type of scan_scaled). Part of bz#2521, ok djm.
Revision 1.248 / (download) - annotate - [select for diffs], Thu Jan 14 16:17:40 2016 UTC (8 years, 4 months ago) by markus
Branch: MAIN
Changes since 1.247: +3 -9 lines
Diff to previous 1.247 (colored)
remove roaming support; ok djm@
Revision 1.232.2.1 / (download) - annotate - [select for diffs], Thu Jan 14 14:48:36 2016 UTC (8 years, 4 months ago) by sthen
Branch: OPENBSD_5_7
Changes since 1.232: +3 -4 lines
Diff to previous 1.232 (colored) next main 1.233 (colored)
MFC changes by: deraadt@cvs.openbsd.org 2016/01/14 07:34:34 Disable experimental client-side roaming support. Server side was disabled/gutted for years already, but this aspect was surprisingly forgotten. Thanks for report from Qualys
Revision 1.239.2.1 / (download) - annotate - [select for diffs], Thu Jan 14 14:48:18 2016 UTC (8 years, 4 months ago) by sthen
Branch: OPENBSD_5_8
Changes since 1.239: +3 -4 lines
Diff to previous 1.239 (colored) next main 1.240 (colored)
MFC changes by: deraadt@cvs.openbsd.org 2016/01/14 07:34:34 Disable experimental client-side roaming support. Server side was disabled/gutted for years already, but this aspect was surprisingly forgotten. Thanks for report from Qualys
Revision 1.247 / (download) - annotate - [select for diffs], Thu Jan 14 14:34:34 2016 UTC (8 years, 4 months ago) by deraadt
Branch: MAIN
Changes since 1.246: +3 -4 lines
Diff to previous 1.246 (colored)
Disable experimental client-side roaming support. Server side was disabled/gutted for years already, but this aspect was surprisingly forgotten. Thanks for report from Qualys
Revision 1.246 / (download) - annotate - [select for diffs], Sun Nov 15 22:26:49 2015 UTC (8 years, 6 months ago) by jcs
Branch: MAIN
Changes since 1.245: +20 -2 lines
Diff to previous 1.245 (colored)
Add an AddKeysToAgent client option which can be set to 'yes', 'no', 'ask', or 'confirm', and defaults to 'no'. When enabled, a private key that is used during authentication will be added to ssh-agent if it is running (with confirmation enabled if set to 'confirm'). Initial version from Joachim Schipper many years ago. ok markus@
Revision 1.245 / (download) - annotate - [select for diffs], Tue Oct 27 08:54:52 2015 UTC (8 years, 6 months ago) by djm
Branch: MAIN
Changes since 1.244: +6 -1 lines
Diff to previous 1.244 (colored)
fix execv arguments in a way less likely to cause grief for -portable; ok dtucker@
Revision 1.244 / (download) - annotate - [select for diffs], Tue Oct 27 00:49:53 2015 UTC (8 years, 6 months ago) by djm
Branch: MAIN
Changes since 1.243: +2 -7 lines
Diff to previous 1.243 (colored)
avoid de-const warning & shrink; ok dtucker@
Revision 1.243 / (download) - annotate - [select for diffs], Sun Oct 25 23:14:03 2015 UTC (8 years, 6 months ago) by dtucker
Branch: MAIN
Changes since 1.242: +3 -10 lines
Diff to previous 1.242 (colored)
Do not prepend "exec" to the shell command run by "Match exec" in a config file. It's an unnecessary optimization from repurposed ProxyCommand code and prevents some things working with some shells. bz#2471, pointed out by res at qoxp.net. ok markus@
Revision 1.242 / (download) - annotate - [select for diffs], Wed Oct 7 15:59:12 2015 UTC (8 years, 7 months ago) by djm
Branch: MAIN
Changes since 1.241: +2 -1 lines
Diff to previous 1.241 (colored)
include PubkeyAcceptedKeyTypes in ssh -G config dump
Revision 1.241 / (download) - annotate - [select for diffs], Thu Sep 24 06:15:11 2015 UTC (8 years, 7 months ago) by djm
Branch: MAIN
Changes since 1.240: +46 -1 lines
Diff to previous 1.240 (colored)
add ssh_config CertificateFile option to explicitly list a certificate; patch from Meghana Bhat on bz#2436; ok markus@
Revision 1.240 / (download) - annotate - [select for diffs], Fri Aug 21 23:53:08 2015 UTC (8 years, 8 months ago) by djm
Branch: MAIN
Changes since 1.239: +6 -2 lines
Diff to previous 1.239 (colored)
Fix printing (ssh -G ...) of HostKeyAlgorithms=+... Reported by Bryan Drewery
Revision 1.239 / (download) - annotate - [select for diffs], Thu Jul 30 00:01:34 2015 UTC (8 years, 9 months ago) by djm
Branch: MAIN
CVS Tags: OPENBSD_5_8_BASE
Branch point for: OPENBSD_5_8
Changes since 1.238: +13 -12 lines
Diff to previous 1.238 (colored)
Allow ssh_config and sshd_config kex parameters options be prefixed by a '+' to indicate that the specified items be appended to the default rather than replacing it. approach suggested by dtucker@, feedback dlg@, ok markus@
Revision 1.238 / (download) - annotate - [select for diffs], Fri Jul 10 06:21:53 2015 UTC (8 years, 10 months ago) by markus
Branch: MAIN
Changes since 1.237: +20 -17 lines
Diff to previous 1.237 (colored)
Turn off DSA by default; add HostKeyAlgorithms to the server and PubkeyAcceptedKeyTypes to the client side, so it still can be tested or turned back on; feedback and ok djm@
Revision 1.237 / (download) - annotate - [select for diffs], Fri Jun 26 05:13:20 2015 UTC (8 years, 10 months ago) by djm
Branch: MAIN
Changes since 1.236: +3 -2 lines
Diff to previous 1.236 (colored)
Fix \-escaping bug that caused forward path parsing to skip two characters and skip past the end of the string. Based on patch by Salvador Fandino; ok dtucker@
Revision 1.236 / (download) - annotate - [select for diffs], Fri May 22 04:45:52 2015 UTC (8 years, 11 months ago) by djm
Branch: MAIN
Changes since 1.235: +6 -6 lines
Diff to previous 1.235 (colored)
Reorder EscapeChar option parsing to avoid a single-byte out- of-bounds read. bz#2396 from Jaak Ristioja; ok dtucker@
Revision 1.235 / (download) - annotate - [select for diffs], Mon May 4 06:10:48 2015 UTC (9 years ago) by djm
Branch: MAIN
Changes since 1.234: +7 -9 lines
Diff to previous 1.234 (colored)
Remove pattern length argument from match_pattern_list(), we only ever use it for strlen(pattern). Prompted by hanno AT hboeck.de pointing an out-of-bound read error caused by an incorrect pattern length found using AFL and his own tools. ok markus@
Revision 1.234 / (download) - annotate - [select for diffs], Fri Apr 24 01:36:00 2015 UTC (9 years ago) by deraadt
Branch: MAIN
Changes since 1.233: +3 -3 lines
Diff to previous 1.233 (colored)
rename xrealloc() to xreallocarray() since it follows that form. ok djm
Revision 1.233 / (download) - annotate - [select for diffs], Mon Mar 30 00:00:29 2015 UTC (9 years, 1 month ago) by djm
Branch: MAIN
Changes since 1.232: +4 -2 lines
Diff to previous 1.232 (colored)
fix uninitialised memory read when parsing a config file consisting of a single nul byte. Found by hanno AT hboeck.de using AFL; ok dtucker
Revision 1.232 / (download) - annotate - [select for diffs], Mon Feb 16 22:13:32 2015 UTC (9 years, 3 months ago) by djm
Branch: MAIN
CVS Tags: OPENBSD_5_7_BASE
Branch point for: OPENBSD_5_7
Changes since 1.231: +4 -2 lines
Diff to previous 1.231 (colored)
Revise hostkeys@openssh.com hostkey learning extension. The client will not ask the server to prove ownership of the private halves of any hitherto-unseen hostkeys it offers to the client. Allow UpdateHostKeys option to take an 'ask' argument to let the user manually review keys offered. ok markus@
Revision 1.231 / (download) - annotate - [select for diffs], Mon Feb 2 07:41:40 2015 UTC (9 years, 3 months ago) by djm
Branch: MAIN
Changes since 1.230: +2 -2 lines
Diff to previous 1.230 (colored)
turn UpdateHostkeys off by default until I figure out mlarkin@'s warning message; requested by deraadt@
Revision 1.230 / (download) - annotate - [select for diffs], Fri Jan 30 11:43:14 2015 UTC (9 years, 3 months ago) by djm
Branch: MAIN
Changes since 1.229: +22 -3 lines
Diff to previous 1.229 (colored)
Add a ssh_config HostbasedKeyType option to control which host public key types are tried during hostbased authentication. This may be used to prevent too many keys being sent to the server, and blowing past its MaxAuthTries limit. bz#2211 based on patch by Iain Morgan; ok markus@
Revision 1.229 / (download) - annotate - [select for diffs], Mon Jan 26 03:04:45 2015 UTC (9 years, 3 months ago) by djm
Branch: MAIN
Changes since 1.228: +11 -2 lines
Diff to previous 1.228 (colored)
Host key rotation support. Add a hostkeys@openssh.com protocol extension (global request) for a server to inform a client of all its available host key after authentication has completed. The client may record the keys in known_hosts, allowing it to upgrade to better host key algorithms and a server to gracefully rotate its keys. The client side of this is controlled by a UpdateHostkeys config option (default on). ok markus@
Revision 1.228 / (download) - annotate - [select for diffs], Fri Jan 16 06:40:12 2015 UTC (9 years, 4 months ago) by deraadt
Branch: MAIN
Changes since 1.227: +2 -1 lines
Diff to previous 1.227 (colored)
Replace <sys/param.h> with <limits.h> and other less dirty headers where possible. Annotate <sys/param.h> lines with their current reasons. Switch to PATH_MAX, NGROUPS_MAX, HOST_NAME_MAX+1, LOGIN_NAME_MAX, etc. Change MIN() and MAX() to local definitions of MINIMUM() and MAXIMUM() where sensible to avoid pulling in the pollution. These are the files confirmed through binary verification. ok guenther, millert, doug (helped with the verification protocol)
Revision 1.227 / (download) - annotate - [select for diffs], Thu Jan 15 09:40:00 2015 UTC (9 years, 4 months ago) by djm
Branch: MAIN
Changes since 1.226: +2 -3 lines
Diff to previous 1.226 (colored)
sync ssh-keysign, ssh-keygen and some dependencies to the new buffer/key API; mostly mechanical, ok markus@
Revision 1.226 / (download) - annotate - [select for diffs], Tue Jan 13 07:39:19 2015 UTC (9 years, 4 months ago) by djm
Branch: MAIN
Changes since 1.225: +2 -2 lines
Diff to previous 1.225 (colored)
add sshd_config HostbasedAcceptedKeyTypes and PubkeyAcceptedKeyTypes options to allow sshd to control what public key types will be accepted. Currently defaults to all. Feedback & ok markus@
Revision 1.225 / (download) - annotate - [select for diffs], Thu Jan 8 13:44:36 2015 UTC (9 years, 4 months ago) by djm
Branch: MAIN
Changes since 1.224: +4 -3 lines
Diff to previous 1.224 (colored)
fix ssh_config FingerprintHash evaluation order; from Petr Lautrbach
Revision 1.224 / (download) - annotate - [select for diffs], Sun Dec 21 22:27:56 2014 UTC (9 years, 4 months ago) by djm
Branch: MAIN
Changes since 1.223: +23 -1 lines
Diff to previous 1.223 (colored)
Add FingerprintHash option to control algorithm used for key fingerprints. Default changes from MD5 to SHA256 and format from hex to base64. Feedback and ok naddy@ markus@
Revision 1.223 / (download) - annotate - [select for diffs], Thu Dec 4 02:24:32 2014 UTC (9 years, 5 months ago) by djm
Branch: MAIN
Changes since 1.222: +10 -2 lines
Diff to previous 1.222 (colored)
add RevokedHostKeys option for the client Allow textfile or KRL-based revocation of hostkeys.
Revision 1.222 / (download) - annotate - [select for diffs], Fri Oct 24 02:01:20 2014 UTC (9 years, 6 months ago) by lteo
Branch: MAIN
Changes since 1.221: +1 -2 lines
Diff to previous 1.221 (colored)
Remove unnecessary include: netinet/in_systm.h is not needed by these programs. ok deraadt@ millert@
Revision 1.221 / (download) - annotate - [select for diffs], Wed Oct 8 22:20:25 2014 UTC (9 years, 7 months ago) by djm
Branch: MAIN
Changes since 1.220: +380 -68 lines
Diff to previous 1.220 (colored)
Tweak config reparsing with host canonicalisation Make the second pass through the config files always run when hostname canonicalisation is enabled. Add a "Match canonical" criteria that allows ssh_config Match blocks to trigger only in the second config pass. Add a -G option to ssh that causes it to parse its configuration and dump the result to stdout, similar to "sshd -T" Allow ssh_config Port options set in the second config parse phase to be applied (they were being ignored). bz#2267 bz#2286; ok markus
Revision 1.220 / (download) - annotate - [select for diffs], Tue Jul 15 15:54:14 2014 UTC (9 years, 10 months ago) by millert
Branch: MAIN
CVS Tags: OPENBSD_5_6_BASE,
OPENBSD_5_6
Changes since 1.219: +186 -38 lines
Diff to previous 1.219 (colored)
Add support for Unix domain socket forwarding. A remote TCP port
may be forwarded to a local Unix domain socket and vice versa or
both ends may be a Unix domain socket. This is a reimplementation
of the streamlocal patches by William Ahern from:
http://www.25thandclement.com/~william/projects/streamlocal.html
OK djm@ markus@
Revision 1.219 / (download) - annotate - [select for diffs], Wed Apr 23 12:42:34 2014 UTC (10 years ago) by djm
Branch: MAIN
Changes since 1.218: +12 -1 lines
Diff to previous 1.218 (colored)
don't record duplicate IdentityFiles
Revision 1.218 / (download) - annotate - [select for diffs], Sun Feb 23 20:11:36 2014 UTC (10 years, 2 months ago) by djm
Branch: MAIN
CVS Tags: OPENBSD_5_5_BASE,
OPENBSD_5_5
Changes since 1.217: +24 -3 lines
Diff to previous 1.217 (colored)
reparse ssh_config and ~/.ssh/config if hostname canonicalisation changes
the hostname. This allows users to write configurations that always
refer to canonical hostnames, e.g.
CanonicalizeHostname yes
CanonicalDomains int.example.org example.org
CanonicalizeFallbackLocal no
Host *.int.example.org
Compression off
Host *.example.org
User djm
ok markus@
Revision 1.217 / (download) - annotate - [select for diffs], Sat Feb 22 01:32:19 2014 UTC (10 years, 2 months ago) by djm
Branch: MAIN
Changes since 1.216: +21 -10 lines
Diff to previous 1.216 (colored)
when processing Match blocks, skip 'exec' clauses if previous predicates failed to match; ok markus@
Revision 1.216 / (download) - annotate - [select for diffs], Wed Jan 29 06:18:35 2014 UTC (10 years, 3 months ago) by djm
Branch: MAIN
Changes since 1.215: +2 -15 lines
Diff to previous 1.215 (colored)
remove experimental, never-enabled JPAKE code; ok markus@
Revision 1.215 / (download) - annotate - [select for diffs], Fri Dec 6 13:39:49 2013 UTC (10 years, 5 months ago) by markus
Branch: MAIN
Changes since 1.214: +3 -1 lines
Diff to previous 1.214 (colored)
support ed25519 keys (hostkeys and user identities) using the public domain ed25519 reference code from SUPERCOP, see http://ed25519.cr.yp.to/software.html feedback, help & ok djm@
Revision 1.214 / (download) - annotate - [select for diffs], Wed Nov 20 20:54:10 2013 UTC (10 years, 5 months ago) by deraadt
Branch: MAIN
Changes since 1.213: +2 -2 lines
Diff to previous 1.213 (colored)
unsigned casts for ctype macros where neccessary ok guenther millert markus
Revision 1.213 / (download) - annotate - [select for diffs], Thu Oct 24 00:51:48 2013 UTC (10 years, 6 months ago) by dtucker
Branch: MAIN
Changes since 1.212: +20 -2 lines
Diff to previous 1.212 (colored)
Disallow empty Match statements and add "Match all" which matches everything. ok djm, man page help jmc@
Revision 1.212 / (download) - annotate - [select for diffs], Wed Oct 23 03:05:19 2013 UTC (10 years, 6 months ago) by djm
Branch: MAIN
Changes since 1.211: +2 -1 lines
Diff to previous 1.211 (colored)
comment
Revision 1.211 / (download) - annotate - [select for diffs], Wed Oct 23 03:03:07 2013 UTC (10 years, 6 months ago) by djm
Branch: MAIN
Changes since 1.210: +14 -6 lines
Diff to previous 1.210 (colored)
Hostname may have %h sequences that should be expanded prior to Match evaluation; spotted by Iain Morgan
Revision 1.210 / (download) - annotate - [select for diffs], Sun Oct 20 06:19:27 2013 UTC (10 years, 6 months ago) by djm
Branch: MAIN
Changes since 1.209: +4 -4 lines
Diff to previous 1.209 (colored)
rename "command" subclause of the recently-added "Match" keyword to "exec"; it's shorter, clearer in intent and we might want to add the ability to match against the command being executed at the remote end in the future.
Revision 1.209 / (download) - annotate - [select for diffs], Wed Oct 16 22:49:38 2013 UTC (10 years, 7 months ago) by djm
Branch: MAIN
Changes since 1.208: +25 -25 lines
Diff to previous 1.208 (colored)
s/canonicalise/canonicalize/ for consistency with existing spelling, e.g. authorized_keys; pointed out by naddy@
Revision 1.208 / (download) - annotate - [select for diffs], Wed Oct 16 02:31:45 2013 UTC (10 years, 7 months ago) by djm
Branch: MAIN
Changes since 1.207: +112 -1 lines
Diff to previous 1.207 (colored)
Implement client-side hostname canonicalisation to allow an explicit search path of domain suffixes to use to convert unqualified host names to fully-qualified ones for host key matching. This is particularly useful for host certificates, which would otherwise need to list unqualified names alongside fully-qualified ones (and this causes a number of problems). "looks fine" markus@
Revision 1.207 / (download) - annotate - [select for diffs], Mon Oct 14 23:28:23 2013 UTC (10 years, 7 months ago) by djm
Branch: MAIN
Changes since 1.206: +95 -104 lines
Diff to previous 1.206 (colored)
refactor client config code a little: add multistate option partsing to readconf.c, similar to servconf.c's existing code. move checking of options that accept "none" as an argument to readconf.c add a lowercase() function and use it instead of explicit tolower() in loops part of a larger diff that was ok markus@
Revision 1.206 / (download) - annotate - [select for diffs], Mon Oct 14 22:22:02 2013 UTC (10 years, 7 months ago) by djm
Branch: MAIN
Changes since 1.205: +215 -12 lines
Diff to previous 1.205 (colored)
add a "Match" keyword to ssh_config that allows matching on hostname, user and result of arbitrary commands. "nice work" markus@
Revision 1.205 / (download) - annotate - [select for diffs], Tue Aug 20 00:11:37 2013 UTC (10 years, 8 months ago) by djm
Branch: MAIN
Changes since 1.204: +10 -2 lines
Diff to previous 1.204 (colored)
Add a ssh_config ProxyUseFDPass option that supports the use of ProxyCommands that establish a connection and then pass a connected file descriptor back to ssh(1). This allows the ProxyCommand to exit rather than have to shuffle data back and forth and enables ssh to use getpeername, etc. to obtain address information just like it does with regular directly-connected sockets. ok markus@
Revision 1.204 / (download) - annotate - [select for diffs], Mon Jun 10 19:19:44 2013 UTC (10 years, 11 months ago) by dtucker
Branch: MAIN
CVS Tags: OPENBSD_5_4_BASE,
OPENBSD_5_4
Changes since 1.203: +0 -2 lines
Diff to previous 1.203 (colored)
revert 1.203 while we investigate crashes reported by okan@
Revision 1.203 / (download) - annotate - [select for diffs], Wed Jun 5 22:00:28 2013 UTC (10 years, 11 months ago) by dtucker
Branch: MAIN
Changes since 1.202: +3 -1 lines
Diff to previous 1.202 (colored)
plug another memleak. bz#1967, from Zhenbo Xu, detected by Melton, ok djm
Revision 1.202 / (download) - annotate - [select for diffs], Fri May 17 00:13:14 2013 UTC (11 years ago) by djm
Branch: MAIN
Changes since 1.201: +12 -18 lines
Diff to previous 1.201 (colored)
bye, bye xfree(); ok markus@
Revision 1.201 / (download) - annotate - [select for diffs], Thu May 16 10:43:34 2013 UTC (11 years ago) by dtucker
Branch: MAIN
Changes since 1.200: +3 -3 lines
Diff to previous 1.200 (colored)
remove now-unused variables
Revision 1.200 / (download) - annotate - [select for diffs], Thu May 16 09:12:31 2013 UTC (11 years ago) by dtucker
Branch: MAIN
Changes since 1.199: +7 -28 lines
Diff to previous 1.199 (colored)
switch RekeyLimit traffic volume parsing to scan_scaled. ok djm@
Revision 1.199 / (download) - annotate - [select for diffs], Thu May 16 04:27:50 2013 UTC (11 years ago) by djm
Branch: MAIN
Changes since 1.198: +26 -9 lines
Diff to previous 1.198 (colored)
add the ability to ignore specific unrecognised ssh_config options; bz#866; ok markus@
Revision 1.198 / (download) - annotate - [select for diffs], Thu May 16 02:00:34 2013 UTC (11 years ago) by dtucker
Branch: MAIN
Changes since 1.197: +49 -31 lines
Diff to previous 1.197 (colored)
Add an optional second argument to RekeyLimit in the client to allow rekeying based on elapsed time in addition to amount of traffic. with djm@ jmc@, ok djm
Revision 1.197 / (download) - annotate - [select for diffs], Wed Mar 6 23:36:53 2013 UTC (11 years, 2 months ago) by djm
Branch: MAIN
Changes since 1.196: +1 -3 lines
Diff to previous 1.196 (colored)
g/c unused variable (-Wunused)
Revision 1.196 / (download) - annotate - [select for diffs], Fri Feb 22 04:45:08 2013 UTC (11 years, 2 months ago) by dtucker
Branch: MAIN
CVS Tags: OPENBSD_5_3_BASE,
OPENBSD_5_3
Changes since 1.195: +7 -6 lines
Diff to previous 1.195 (colored)
Don't complain if IdentityFiles specified in system-wide configs are missing. ok djm, deraadt.
Revision 1.195 / (download) - annotate - [select for diffs], Sun Feb 17 23:16:57 2013 UTC (11 years, 3 months ago) by dtucker
Branch: MAIN
Changes since 1.194: +30 -26 lines
Diff to previous 1.194 (colored)
Keep track of which IndentityFile options were manually supplied and which were default options, and don't warn if the latter are missing. ok markus@
Revision 1.194 / (download) - annotate - [select for diffs], Fri Sep 23 07:45:05 2011 UTC (12 years, 7 months ago) by markus
Branch: MAIN
CVS Tags: OPENBSD_5_2_BASE,
OPENBSD_5_2,
OPENBSD_5_1_BASE,
OPENBSD_5_1
Changes since 1.193: +2 -1 lines
Diff to previous 1.193 (colored)
unbreak remote portforwarding with dynamic allocated listen ports: 1) send the actual listen port in the open message (instead of 0). this allows multiple forwardings with a dynamic listen port 2) update the matching permit-open entry, so we can identify where to connect to report: den at skbkontur.ru and P. Szczygielski feedback and ok djm@
Revision 1.193 / (download) - annotate - [select for diffs], Tue May 24 07:15:47 2011 UTC (12 years, 11 months ago) by djm
Branch: MAIN
CVS Tags: OPENBSD_5_0_BASE,
OPENBSD_5_0
Changes since 1.192: +40 -29 lines
Diff to previous 1.192 (colored)
Remove undocumented legacy options UserKnownHostsFile2 and GlobalKnownHostsFile2 by making UserKnownHostsFile/GlobalKnownHostsFile accept multiple paths per line and making their defaults include known_hosts2; ok markus
Revision 1.192 / (download) - annotate - [select for diffs], Fri May 6 21:34:32 2011 UTC (13 years ago) by djm
Branch: MAIN
Changes since 1.191: +26 -2 lines
Diff to previous 1.191 (colored)
Add a RequestTTY ssh_config option to allow configuration-based control over tty allocation (like -t/-T); ok markus@
Revision 1.191 / (download) - annotate - [select for diffs], Fri May 6 21:31:38 2011 UTC (13 years ago) by djm
Branch: MAIN
Changes since 1.190: +21 -5 lines
Diff to previous 1.190 (colored)
support negated Host matching, e.g. Host *.example.org !c.example.org User mekmitasdigoat Will match "a.example.org", "b.example.org", but not "c.example.org" ok markus@
Revision 1.190 / (download) - annotate - [select for diffs], Sat Nov 13 23:27:50 2010 UTC (13 years, 6 months ago) by djm
Branch: MAIN
CVS Tags: OPENBSD_4_9_BASE,
OPENBSD_4_9
Changes since 1.189: +28 -2 lines
Diff to previous 1.189 (colored)
allow ssh and sshd to set arbitrary TOS/DSCP/QoS values instead of hardcoding lowdelay/throughput. bz#1733 patch from philipp AT redfish-solutions.com; ok markus@ deraadt@
Revision 1.189 / (download) - annotate - [select for diffs], Wed Sep 22 05:01:29 2010 UTC (13 years, 7 months ago) by djm
Branch: MAIN
Changes since 1.188: +17 -1 lines
Diff to previous 1.188 (colored)
add a KexAlgorithms knob to the client and server configuration to allow selection of which key exchange methods are used by ssh(1) and sshd(8) and their order of preference. ok markus@
Revision 1.188 / (download) - annotate - [select for diffs], Tue Aug 31 11:54:45 2010 UTC (13 years, 8 months ago) by djm
Branch: MAIN
Changes since 1.187: +7 -1 lines
Diff to previous 1.187 (colored)
Implement Elliptic Curve Cryptography modes for key exchange (ECDH) and host/user keys (ECDSA) as specified by RFC5656. ECDH and ECDSA offer better performance than plain DH and DSA at the same equivalent symmetric key length, as well as much shorter keys. Only the mandatory sections of RFC5656 are implemented, specifically the three REQUIRED curves nistp256, nistp384 and nistp521 and only ECDH and ECDSA. Point compression (optional in RFC5656 is NOT implemented). Certificate host and user keys using the new ECDSA key types are supported. Note that this code has not been tested for interoperability and may be subject to change. feedback and ok markus@
Revision 1.187 / (download) - annotate - [select for diffs], Mon Jul 19 09:15:12 2010 UTC (13 years, 10 months ago) by djm
Branch: MAIN
CVS Tags: OPENBSD_4_8_BASE,
OPENBSD_4_8
Changes since 1.186: +34 -2 lines
Diff to previous 1.186 (colored)
add a "ControlPersist" option that automatically starts a background ssh(1) multiplex master when connecting. This connection can stay alive indefinitely, or can be set to automatically close after a user-specified duration of inactivity. bz#1330 - patch by dwmw2 AT infradead.org, but further hacked on by wmertens AT cisco.com, apb AT cequrux.com, martin-mindrot-bugzilla AT earth.li and myself; "looks ok" markus@
Revision 1.186 / (download) - annotate - [select for diffs], Fri Jun 25 23:15:36 2010 UTC (13 years, 10 months ago) by djm
Branch: MAIN
Changes since 1.185: +11 -3 lines
Diff to previous 1.185 (colored)
Add X11ForwardTimeout option to specify timeout for untrusted X11 authentication cookies to avoid fallback in X11 code to fully-trusted implicit authentication using SO_PEERCRED described at: http://lists.x.org/archives/xorg-devel/2010-May/008636.html After the X11ForwardTimeout has expired the client will now refuse incoming X11 channel opens. based on patch from Tavis Ormandy; "nice" markus@
Revision 1.185 / (download) - annotate - [select for diffs], Fri Jun 25 07:14:46 2010 UTC (13 years, 10 months ago) by djm
Branch: MAIN
Changes since 1.184: +19 -6 lines
Diff to previous 1.184 (colored)
bz#1327: remove hardcoded limit of 100 permitopen clauses and port forwards per direction; ok markus@ stevesk@
Revision 1.184 / (download) - annotate - [select for diffs], Sun May 16 12:55:51 2010 UTC (14 years ago) by markus
Branch: MAIN
Changes since 1.183: +2 -1 lines
Diff to previous 1.183 (colored)
mux support for remote forwarding with dynamic port allocation, use with LPORT=`ssh -S muxsocket -R0:localhost:25 -O forward somehost` feedback and ok djm@
Revision 1.183 / (download) - annotate - [select for diffs], Mon Feb 8 10:50:20 2010 UTC (14 years, 3 months ago) by markus
Branch: MAIN
CVS Tags: OPENBSD_4_7_BASE,
OPENBSD_4_7
Changes since 1.182: +9 -7 lines
Diff to previous 1.182 (colored)
replace our obsolete smartcard code with PKCS#11. ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-11/v2-20/pkcs-11v2-20.pdf ssh(1) and ssh-keygen(1) use dlopen(3) directly to talk to a PKCS#11 provider (shared library) while ssh-agent(1) delegates PKCS#11 to a forked a ssh-pkcs11-helper process. PKCS#11 is currently a compile time option. feedback and ok djm@; inspired by patches from Alon Bar-Lev
Revision 1.182 / (download) - annotate - [select for diffs], Sat Jan 9 23:04:13 2010 UTC (14 years, 4 months ago) by dtucker
Branch: MAIN
Changes since 1.181: +3 -19 lines
Diff to previous 1.181 (colored)
Remove RoutingDomain from ssh since it's now not needed. It can be replaced with "route exec" or "nc -V" as a proxycommand. "route exec" also ensures that trafic such as DNS lookups stays withing the specified routingdomain. For example (from reyk): # route -T 2 exec /usr/sbin/sshd or inherited from the parent process $ route -T 2 exec sh $ ssh 10.1.2.3 ok deraadt@ markus@ stevesk@ reyk@
Revision 1.181 / (download) - annotate - [select for diffs], Tue Dec 29 16:38:41 2009 UTC (14 years, 4 months ago) by stevesk
Branch: MAIN
Changes since 1.180: +2 -2 lines
Diff to previous 1.180 (colored)
Rename RDomain config option to RoutingDomain to be more clear and consistent with other options. NOTE: if you currently use RDomain in the ssh client or server config, or ssh/sshd -o, you must update to use RoutingDomain. ok markus@ djm@
Revision 1.180 / (download) - annotate - [select for diffs], Fri Dec 25 19:40:21 2009 UTC (14 years, 4 months ago) by stevesk
Branch: MAIN
Changes since 1.179: +2 -2 lines
Diff to previous 1.179 (colored)
validate routing domain is in range 0-RT_TABLEID_MAX. 'Looks right' deraadt@
Revision 1.179 / (download) - annotate - [select for diffs], Wed Oct 28 16:38:18 2009 UTC (14 years, 6 months ago) by reyk
Branch: MAIN
Changes since 1.178: +19 -3 lines
Diff to previous 1.178 (colored)
Allow to set the rdomain in ssh/sftp/scp/sshd and ssh-keyscan. ok markus@
Revision 1.178 / (download) - annotate - [select for diffs], Thu Oct 8 14:03:41 2009 UTC (14 years, 7 months ago) by markus
Branch: MAIN
Changes since 1.177: +2 -2 lines
Diff to previous 1.177 (colored)
disable protocol 1 by default (after a transition period of about 10 years) ok deraadt
Revision 1.177 / (download) - annotate - [select for diffs], Sat Jun 27 09:35:06 2009 UTC (14 years, 10 months ago) by andreas
Branch: MAIN
CVS Tags: OPENBSD_4_6_BASE,
OPENBSD_4_6
Changes since 1.176: +10 -2 lines
Diff to previous 1.176 (colored)
Add client option UseRoaming. It doesn't do anything yet but will control whether the client tries to use roaming if enabled on the server. From Martin Forssen. ok markus@
Revision 1.176 / (download) - annotate - [select for diffs], Thu Feb 12 03:00:56 2009 UTC (15 years, 3 months ago) by djm
Branch: MAIN
CVS Tags: OPENBSD_4_5_BASE,
OPENBSD_4_5
Changes since 1.175: +9 -4 lines
Diff to previous 1.175 (colored)
support remote port forwarding with a zero listen port (-R0:...) to dyamically allocate a listen port at runtime (this is actually specified in rfc4254); bz#1003 ok markus@
Revision 1.175 / (download) - annotate - [select for diffs], Thu Jan 22 10:02:34 2009 UTC (15 years, 3 months ago) by djm
Branch: MAIN
Changes since 1.174: +3 -3 lines
Diff to previous 1.174 (colored)
make a2port() return -1 when it encounters an invalid port number rather than 0, which it will now treat as valid (needed for future work) adjust current consumers of a2port() to check its return value is <= 0, which in turn required some things to be converted from u_short => int make use of int vs. u_short consistent in some other places too feedback & ok markus@
Revision 1.174 / (download) - annotate - [select for diffs], Thu Jan 15 17:38:43 2009 UTC (15 years, 4 months ago) by stevesk
Branch: MAIN
Changes since 1.173: +4 -4 lines
Diff to previous 1.173 (colored)
1) use obsolete instead of alias for consistency 2) oUserKnownHostsFile not obsolete but oGlobalKnownHostsFile2 is so move the comment. 3) reorder so like options are together ok djm@
Revision 1.173 / (download) - annotate - [select for diffs], Tue Dec 9 02:58:16 2008 UTC (15 years, 5 months ago) by djm
Branch: MAIN
Changes since 1.172: +7 -3 lines
Diff to previous 1.172 (colored)
don't leave junk (free'd) pointers around in Forward *fwd argument on failure; avoids double-free in ~C -L handler when given an invalid forwarding specification; bz#1539 report from adejong AT debian.org via Colin Watson; ok markus@ dtucker@
Revision 1.172 / (download) - annotate - [select for diffs], Tue Nov 4 19:18:00 2008 UTC (15 years, 6 months ago) by stevesk
Branch: MAIN
Changes since 1.171: +5 -7 lines
Diff to previous 1.171 (colored)
because parse_forward() is now used to parse all forward types (DLR), and it malloc's space for host variables, we don't need to malloc here. fixes small memory leaks. previously dynamic forwards were not parsed in parse_forward() and space was not malloc'd in that case. ok djm@
Revision 1.171 / (download) - annotate - [select for diffs], Tue Nov 4 08:22:13 2008 UTC (15 years, 6 months ago) by djm
Branch: MAIN
Changes since 1.170: +16 -2 lines
Diff to previous 1.170 (colored)
Add support for an experimental zero-knowledge password authentication method using the J-PAKE protocol described in F. Hao, P. Ryan, "Password Authenticated Key Exchange by Juggling", 16th Workshop on Security Protocols, Cambridge, April 2008. This method allows password-based authentication without exposing the password to the server. Instead, the client and server exchange cryptographic proofs to demonstrate of knowledge of the password while revealing nothing useful to an attacker or compromised endpoint. This is experimental, work-in-progress code and is presently compiled-time disabled (turn on -DJPAKE in Makefile.inc). "just commit it. It isn't too intrusive." deraadt@
Revision 1.170 / (download) - annotate - [select for diffs], Mon Nov 3 02:44:41 2008 UTC (15 years, 6 months ago) by stevesk
Branch: MAIN
Changes since 1.169: +2 -2 lines
Diff to previous 1.169 (colored)
fix comment
Revision 1.169 / (download) - annotate - [select for diffs], Mon Nov 3 01:07:02 2008 UTC (15 years, 6 months ago) by stevesk
Branch: MAIN
Changes since 1.168: +1 -2 lines
Diff to previous 1.168 (colored)
remove valueless comment
Revision 1.168 / (download) - annotate - [select for diffs], Sat Nov 1 17:40:33 2008 UTC (15 years, 6 months ago) by stevesk
Branch: MAIN
Changes since 1.167: +45 -37 lines
Diff to previous 1.167 (colored)
merge dynamic forward parsing into parse_forward(); 'i think this is OK' djm@
Revision 1.167 / (download) - annotate - [select for diffs], Thu Jun 26 11:46:31 2008 UTC (15 years, 10 months ago) by grunk
Branch: MAIN
CVS Tags: OPENBSD_4_4_BASE,
OPENBSD_4_4
Changes since 1.166: +10 -17 lines
Diff to previous 1.166 (colored)
Move SSH Fingerprint Visualization away from sharing the config option CheckHostIP to an own config option named VisualHostKey. While there, fix the behaviour that ssh would draw a random art picture on every newly seen host even when the option was not enabled. prodded by deraadt@, discussions, help and ok markus@ djm@ dtucker@
Revision 1.166 / (download) - annotate - [select for diffs], Wed Jun 11 21:01:35 2008 UTC (15 years, 11 months ago) by grunk
Branch: MAIN
Changes since 1.165: +18 -2 lines
Diff to previous 1.165 (colored)
Introduce SSH Fingerprint ASCII Visualization, a technique inspired by the graphical hash visualization schemes known as "random art", and by Dan Kaminsky's musings on the subject during a BlackOp talk at the 23C3 in Berlin. Scientific publication (original paper): "Hash Visualization: a New Technique to improve Real-World Security", Perrig A. and Song D., 1999, International Workshop on Cryptographic Techniques and E-Commerce (CrypTEC '99) http://sparrow.ece.cmu.edu/~adrian/projects/validation/validation.pdf The algorithm used here is a worm crawling over a discrete plane, leaving a trace (augmenting the field) everywhere it goes. Movement is taken from dgst_raw 2bit-wise. Bumping into walls makes the respective movement vector be ignored for this turn, thus switching to the other color of the chessboard. Graphs are not unambiguous for now, because circles in graphs can be walked in either direction. discussions with several people, help, corrections and ok markus@ djm@
Revision 1.165 / (download) - annotate - [select for diffs], Sat Jan 19 23:09:49 2008 UTC (16 years, 4 months ago) by djm
Branch: MAIN
CVS Tags: OPENBSD_4_3_BASE,
OPENBSD_4_3
Changes since 1.164: +4 -5 lines
Diff to previous 1.164 (colored)
promote rekeylimit to a int64 so it can hold the maximum useful limit of 2^32; report and patch from Jan.Pechanec AT Sun.COM, ok dtucker@
Revision 1.164 / (download) - annotate - [select for diffs], Mon Dec 31 10:41:31 2007 UTC (16 years, 4 months ago) by dtucker
Branch: MAIN
Changes since 1.163: +5 -4 lines
Diff to previous 1.163 (colored)
Prevent strict-aliasing warnings on newer gcc versions. bz #1355, patch from Dmitry V. Levin, ok djm@
Revision 1.163 / (download) - annotate - [select for diffs], Mon Oct 22 19:10:24 2007 UTC (16 years, 6 months ago) by markus
Branch: MAIN
Changes since 1.162: +2 -2 lines
Diff to previous 1.162 (colored)
make sure that both the local and remote port are correct when parsing -L; Jan Pechanec (bz #1378)
Revision 1.162 / (download) - annotate - [select for diffs], Tue Mar 20 03:56:12 2007 UTC (17 years, 2 months ago) by tedu
Branch: MAIN
CVS Tags: OPENBSD_4_2_BASE,
OPENBSD_4_2
Changes since 1.161: +2 -2 lines
Diff to previous 1.161 (colored)
remove some bogus *p tests from charles longeau ok deraadt millert
Revision 1.161 / (download) - annotate - [select for diffs], Sun Jan 21 01:45:35 2007 UTC (17 years, 3 months ago) by stevesk
Branch: MAIN
CVS Tags: OPENBSD_4_1_BASE,
OPENBSD_4_1
Changes since 1.160: +2 -2 lines
Diff to previous 1.160 (colored)
spaces
Revision 1.160 / (download) - annotate - [select for diffs], Wed Jan 17 23:22:52 2007 UTC (17 years, 4 months ago) by dtucker
Branch: MAIN
Changes since 1.159: +2 -2 lines
Diff to previous 1.159 (colored)
Honour activep for times (eg ServerAliveInterval) while parsing ssh_config and ~/.ssh/config so they work properly with Host directives. From mario.lorenz@wincor-nixdorf.com via bz #1275. ok markus@
Revision 1.143.2.2 / (download) - annotate - [select for diffs], Fri Oct 6 03:19:33 2006 UTC (17 years, 7 months ago) by brad
Branch: OPENBSD_3_8
Changes since 1.143.2.1: +49 -10 lines
Diff to previous 1.143.2.1 (colored) to branchpoint 1.143 (colored) next main 1.144 (colored)
upgrade to OpenSSH 4.4
Revision 1.148.2.1 / (download) - annotate - [select for diffs], Sat Sep 30 04:06:51 2006 UTC (17 years, 7 months ago) by brad
Branch: OPENBSD_3_9
Changes since 1.148: +24 -5 lines
Diff to previous 1.148 (colored) next main 1.149 (colored)
upgrade to OpenSSH 4.4
Revision 1.159 / (download) - annotate - [select for diffs], Thu Aug 3 03:34:42 2006 UTC (17 years, 9 months ago) by deraadt
Branch: MAIN
CVS Tags: OPENBSD_4_0_BASE,
OPENBSD_4_0
Changes since 1.158: +5 -4 lines
Diff to previous 1.158 (colored)
almost entirely get rid of the culture of ".h files that include .h files" ok djm, sort of ok stevesk makes the pain stop in one easy step
Revision 1.158 / (download) - annotate - [select for diffs], Tue Aug 1 23:22:47 2006 UTC (17 years, 9 months ago) by stevesk
Branch: MAIN
Changes since 1.157: +2 -1 lines
Diff to previous 1.157 (colored)
move #include <stdio.h> out of includes.h
Revision 1.157 / (download) - annotate - [select for diffs], Sat Jul 22 20:48:23 2006 UTC (17 years, 9 months ago) by stevesk
Branch: MAIN
Changes since 1.156: +2 -1 lines
Diff to previous 1.156 (colored)
move #include <string.h> out of includes.h
Revision 1.156 / (download) - annotate - [select for diffs], Mon Jul 17 01:31:09 2006 UTC (17 years, 10 months ago) by stevesk
Branch: MAIN
Changes since 1.155: +2 -1 lines
Diff to previous 1.155 (colored)
move #include <unistd.h> out of includes.h
Revision 1.155 / (download) - annotate - [select for diffs], Wed Jul 12 22:28:52 2006 UTC (17 years, 10 months ago) by stevesk
Branch: MAIN
Changes since 1.154: +2 -1 lines
Diff to previous 1.154 (colored)
move #include <netdb.h> out of includes.h; ok djm@
Revision 1.154 / (download) - annotate - [select for diffs], Tue Jul 11 20:07:25 2006 UTC (17 years, 10 months ago) by stevesk
Branch: MAIN
Changes since 1.153: +2 -1 lines
Diff to previous 1.153 (colored)
move #include <errno.h> out of includes.h; ok markus@
Revision 1.153 / (download) - annotate - [select for diffs], Tue Jul 11 18:50:48 2006 UTC (17 years, 10 months ago) by markus
Branch: MAIN
Changes since 1.152: +10 -1 lines
Diff to previous 1.152 (colored)
add ExitOnForwardFailure: terminate the connection if ssh(1) cannot set up all requested dynamic, local, and remote port forwardings. ok djm, dtucker, stevesk, jmc
Revision 1.152 / (download) - annotate - [select for diffs], Wed Jul 5 02:42:09 2006 UTC (17 years, 10 months ago) by stevesk
Branch: MAIN
Changes since 1.151: +4 -1 lines
Diff to previous 1.151 (colored)
move #include <netinet/in.h> out of includes.h; ok deraadt@
Revision 1.151 / (download) - annotate - [select for diffs], Sat Mar 25 13:17:02 2006 UTC (18 years, 1 month ago) by djm
Branch: MAIN
Changes since 1.150: +1 -0 lines
Diff to previous 1.150 (colored)
Put $OpenBSD$ tags back (as comments) to replace the RCSID()s that Theo nuked - our scripts to sync -portable need them in the files
Revision 1.150 / (download) - annotate - [select for diffs], Sun Mar 19 18:51:18 2006 UTC (18 years, 2 months ago) by deraadt
Branch: MAIN
Changes since 1.149: +0 -1 lines
Diff to previous 1.149 (colored)
RCSID() can die
Revision 1.149 / (download) - annotate - [select for diffs], Sun Mar 19 02:24:05 2006 UTC (18 years, 2 months ago) by djm
Branch: MAIN
Changes since 1.148: +3 -2 lines
Diff to previous 1.148 (colored)
potential NULL pointer dereferences detected by Coverity via elad AT netbsd.org; ok deraadt@
Revision 1.148 / (download) - annotate - [select for diffs], Wed Feb 22 00:04:44 2006 UTC (18 years, 2 months ago) by stevesk
Branch: MAIN
CVS Tags: OPENBSD_3_9_BASE
Branch point for: OPENBSD_3_9
Changes since 1.147: +3 -1 lines
Diff to previous 1.147 (colored)
move #include <ctype.h> out of includes.h; ok djm@
Revision 1.147 / (download) - annotate - [select for diffs], Mon Feb 20 17:19:54 2006 UTC (18 years, 2 months ago) by stevesk
Branch: MAIN
Changes since 1.146: +4 -1 lines
Diff to previous 1.146 (colored)
move #include <sys/stat.h> out of includes.h; ok markus@
Revision 1.146 / (download) - annotate - [select for diffs], Sun Feb 12 10:44:18 2006 UTC (18 years, 3 months ago) by djm
Branch: MAIN
Changes since 1.145: +22 -7 lines
Diff to previous 1.145 (colored)
raise error when the user specifies a RekeyLimit that is smaller than 16 (the smallest of our cipher's blocksize) or big enough to cause integer wraparound; ok & feedback dtucker@
Revision 1.143.2.1 / (download) - annotate - [select for diffs], Fri Feb 3 03:01:56 2006 UTC (18 years, 3 months ago) by brad
Branch: OPENBSD_3_8
Changes since 1.143: +71 -3 lines
Diff to previous 1.143 (colored)
upgrade to OpenSSH 4.3
Revision 1.139.2.2 / (download) - annotate - [select for diffs], Fri Feb 3 02:53:44 2006 UTC (18 years, 3 months ago) by brad
Branch: OPENBSD_3_7
Changes since 1.139.2.1: +71 -3 lines
Diff to previous 1.139.2.1 (colored) to branchpoint 1.139 (colored) next main 1.140 (colored)
upgrade to OpenSSH 4.3
Revision 1.145 / (download) - annotate - [select for diffs], Thu Dec 8 18:34:11 2005 UTC (18 years, 5 months ago) by reyk
Branch: MAIN
Changes since 1.144: +27 -5 lines
Diff to previous 1.144 (colored)
two changes to the new ssh tunnel support. this breaks compatibility with the initial commit but is required for a portable approach. - make the tunnel id u_int and platform friendly, use predefined types. - support configuration of layer 2 (ethernet) or layer 3 (point-to-point, default) modes. configuration is done using the Tunnel (yes|point-to-point|ethernet|no) option is ssh_config(5) and restricted by the PermitTunnel (yes|point-to-point|ethernet|no) option in sshd_config(5). ok djm@, man page bits by jmc@
Revision 1.144 / (download) - annotate - [select for diffs], Tue Dec 6 22:38:27 2005 UTC (18 years, 5 months ago) by reyk
Branch: MAIN
Changes since 1.143: +49 -3 lines
Diff to previous 1.143 (colored)
Add support for tun(4) forwarding over OpenSSH, based on an idea and initial channel code bits by markus@. This is a simple and easy way to use OpenSSH for ad hoc virtual private network connections, e.g. administrative tunnels or secure wireless access. It's based on a new ssh channel and works similar to the existing TCP forwarding support, except that it depends on the tun(4) network interface on both ends of the connection for layer 2 or layer 3 tunneling. This diff also adds support for LocalCommand in the ssh(1) client. ok djm@, markus@, jmc@ (manpages), tested and discussed with others
Revision 1.139.2.1 / (download) - annotate - [select for diffs], Sun Sep 4 18:40:02 2005 UTC (18 years, 8 months ago) by brad
Branch: OPENBSD_3_7
Changes since 1.139: +27 -4 lines
Diff to previous 1.139 (colored)
upgrade to OpenSSH 4.2
Revision 1.134.2.3 / (download) - annotate - [select for diffs], Fri Sep 2 03:45:00 2005 UTC (18 years, 8 months ago) by brad
Branch: OPENBSD_3_6
Changes since 1.134.2.2: +27 -4 lines
Diff to previous 1.134.2.2 (colored) to branchpoint 1.134 (colored) next main 1.135 (colored)
upgrade to OpenSSH 4.2
Revision 1.143 / (download) - annotate - [select for diffs], Sat Jul 30 02:03:47 2005 UTC (18 years, 9 months ago) by djm
Branch: MAIN
CVS Tags: OPENBSD_3_8_BASE
Branch point for: OPENBSD_3_8
Changes since 1.142: +2 -2 lines
Diff to previous 1.142 (colored)
listen_hosts initialisation here too; spotted greg AT y2005.nest.cx
Revision 1.142 / (download) - annotate - [select for diffs], Sun Jul 17 07:17:55 2005 UTC (18 years, 10 months ago) by djm
Branch: MAIN
Changes since 1.141: +2 -2 lines
Diff to previous 1.141 (colored)
knf says that a 2nd level indent is four (not three or five) spaces
Revision 1.141 / (download) - annotate - [select for diffs], Wed Jun 8 11:25:09 2005 UTC (18 years, 11 months ago) by djm
Branch: MAIN
Changes since 1.140: +22 -2 lines
Diff to previous 1.140 (colored)
add ControlMaster=auto/autoask options to support opportunistic multiplexing; tested avsm@ and jakob@, ok markus@
Revision 1.134.2.2 / (download) - annotate - [select for diffs], Sun Jun 5 02:22:39 2005 UTC (18 years, 11 months ago) by brad
Branch: OPENBSD_3_6
Changes since 1.134.2.1: +2 -2 lines
Diff to previous 1.134.2.1 (colored) to branchpoint 1.134 (colored)
upgrade to OpenSSH 4.1
Revision 1.140 / (download) - annotate - [select for diffs], Mon May 16 15:30:51 2005 UTC (19 years ago) by markus
Branch: MAIN
Changes since 1.139: +4 -1 lines
Diff to previous 1.139 (colored)
check return value from strdelim() for NULL (AddressFamily); mpech
Revision 1.139 / (download) - annotate - [select for diffs], Thu Mar 10 22:01:05 2005 UTC (19 years, 2 months ago) by deraadt
Branch: MAIN
CVS Tags: OPENBSD_3_7_BASE
Branch point for: OPENBSD_3_7
Changes since 1.138: +2 -2 lines
Diff to previous 1.138 (colored)
spacing
Revision 1.128.2.2 / (download) - annotate - [select for diffs], Thu Mar 10 17:15:04 2005 UTC (19 years, 2 months ago) by brad
Branch: OPENBSD_3_5
Changes since 1.128.2.1: +132 -39 lines
Diff to previous 1.128.2.1 (colored) to branchpoint 1.128 (colored) next main 1.129 (colored)
upgrade to OpenSSH 4.0
Revision 1.134.2.1 / (download) - annotate - [select for diffs], Thu Mar 10 16:28:27 2005 UTC (19 years, 2 months ago) by brad
Branch: OPENBSD_3_6
Changes since 1.134: +132 -39 lines
Diff to previous 1.134 (colored)
upgrade to OpenSSH 4.0
Revision 1.138 / (download) - annotate - [select for diffs], Thu Mar 10 10:15:02 2005 UTC (19 years, 2 months ago) by dtucker
Branch: MAIN
Changes since 1.137: +5 -3 lines
Diff to previous 1.137 (colored)
Check listen addresses for null, prevents xfree from dying during ClearAllForwardings (bz #996). From Craig Leres, ok markus@
Revision 1.137 / (download) - annotate - [select for diffs], Fri Mar 4 08:48:06 2005 UTC (19 years, 2 months ago) by djm
Branch: MAIN
Changes since 1.136: +3 -1 lines
Diff to previous 1.136 (colored)
fix SendEnv config parsing bug found by Roumen Petrov; ok dtucker@
Revision 1.136 / (download) - annotate - [select for diffs], Tue Mar 1 10:40:26 2005 UTC (19 years, 2 months ago) by djm
Branch: MAIN
Changes since 1.135: +10 -2 lines
Diff to previous 1.135 (colored)
add support for hashing host names and addresses added to known_hosts files, to improve privacy of which hosts user have been visiting; ok markus@ deraadt@
Revision 1.135 / (download) - annotate - [select for diffs], Tue Mar 1 10:09:52 2005 UTC (19 years, 2 months ago) by djm
Branch: MAIN
Changes since 1.134: +119 -38 lines
Diff to previous 1.134 (colored)
bz#413: allow optional specification of bind address for port forwardings. Patch originally by Dan Astorian, but worked on by several people Adds GatewayPorts=clientspecified option on server to allow remote forwards to bind to client-specified ports. ok markus@
Revision 1.121.2.2 / (download) - annotate - [select for diffs], Thu Aug 19 22:37:31 2004 UTC (19 years, 9 months ago) by brad
Branch: OPENBSD_3_4
Changes since 1.121.2.1: +53 -5 lines
Diff to previous 1.121.2.1 (colored) to branchpoint 1.121 (colored) next main 1.122 (colored)
upgrade to OpenSSH 3.9
Revision 1.128.2.1 / (download) - annotate - [select for diffs], Thu Aug 19 04:13:26 2004 UTC (19 years, 9 months ago) by brad
Branch: OPENBSD_3_5
Changes since 1.128: +44 -4 lines
Diff to previous 1.128 (colored)
upgrade to OpenSSH 3.9
Revision 1.134 / (download) - annotate - [select for diffs], Sun Jul 11 17:48:47 2004 UTC (19 years, 10 months ago) by deraadt
Branch: MAIN
CVS Tags: OPENBSD_3_6_BASE
Branch point for: OPENBSD_3_6
Changes since 1.133: +3 -3 lines
Diff to previous 1.133 (colored)
spaces
Revision 1.133 / (download) - annotate - [select for diffs], Thu Jun 17 15:10:14 2004 UTC (19 years, 11 months ago) by djm
Branch: MAIN
Changes since 1.132: +2 -2 lines
Diff to previous 1.132 (colored)
Add option for confirmation (ControlMaster=ask) via ssh-askpass before opening shared connections; ok markus@
Revision 1.132 / (download) - annotate - [select for diffs], Sun Jun 13 15:03:02 2004 UTC (19 years, 11 months ago) by djm
Branch: MAIN
Changes since 1.131: +16 -2 lines
Diff to previous 1.131 (colored)
implement session multiplexing in the client (the server has supported this since 2.0); ok markus@
Revision 1.131 / (download) - annotate - [select for diffs], Thu May 27 00:50:13 2004 UTC (19 years, 11 months ago) by dtucker
Branch: MAIN
Changes since 1.130: +3 -8 lines
Diff to previous 1.130 (colored)
Kill dead code after fatal(); ok djm@
Revision 1.130 / (download) - annotate - [select for diffs], Tue Apr 27 09:46:36 2004 UTC (20 years ago) by djm
Branch: MAIN
Changes since 1.129: +17 -1 lines
Diff to previous 1.129 (colored)
bz #815: implement ability to pass specified environment variables from the client to the server; ok markus@
Revision 1.129 / (download) - annotate - [select for diffs], Sun Apr 18 23:10:26 2004 UTC (20 years, 1 month ago) by djm
Branch: MAIN
Changes since 1.128: +19 -4 lines
Diff to previous 1.128 (colored)
perform strict ownership and modes checks for ~/.ssh/config files, as these can be used to execute arbitrary programs; ok markus@ NB. ssh will now exit when it detects a config with poor permissions
Revision 1.128 / (download) - annotate - [select for diffs], Fri Mar 5 10:53:58 2004 UTC (20 years, 2 months ago) by markus
Branch: MAIN
CVS Tags: OPENBSD_3_5_BASE
Branch point for: OPENBSD_3_5
Changes since 1.127: +10 -2 lines
Diff to previous 1.127 (colored)
add IdentitiesOnly; ok djm@, pb@
Revision 1.102.2.2 / (download) - annotate - [select for diffs], Thu Mar 4 18:18:16 2004 UTC (20 years, 2 months ago) by brad
Branch: OPENBSD_3_3
Changes since 1.102.2.1: +40 -17 lines
Diff to previous 1.102.2.1 (colored) to branchpoint 1.102 (colored) next main 1.103 (colored)
upgrade to OpenSSH 3.8upgrade to OpenSSH 3.8upgrade to OpenSSH 3.8
Revision 1.121.2.1 / (download) - annotate - [select for diffs], Sat Feb 28 03:51:33 2004 UTC (20 years, 2 months ago) by brad
Branch: OPENBSD_3_4
Changes since 1.121: +40 -17 lines
Diff to previous 1.121 (colored)
upgrade to OpenSSH 3.8
Revision 1.127 / (download) - annotate - [select for diffs], Tue Dec 16 15:49:51 2003 UTC (20 years, 5 months ago) by markus
Branch: MAIN
Changes since 1.126: +19 -2 lines
Diff to previous 1.126 (colored)
application layer keep alive (ServerAliveInterval ServerAliveCountMax) for ssh(1), similar to the sshd(8) option; ok beck@; with help from jmc and dtucker@
Revision 1.126 / (download) - annotate - [select for diffs], Tue Dec 9 21:53:36 2003 UTC (20 years, 5 months ago) by markus
Branch: MAIN
Changes since 1.125: +10 -9 lines
Diff to previous 1.125 (colored)
rename keepalive to tcpkeepalive; the old name causes too much confusion; ok djm, dtucker; with help from jmc@
Revision 1.125 / (download) - annotate - [select for diffs], Wed Nov 12 16:39:58 2003 UTC (20 years, 6 months ago) by jakob
Branch: MAIN
Changes since 1.124: +3 -2 lines
Diff to previous 1.124 (colored)
update SSHFP validation. ok markus@
Revision 1.124 / (download) - annotate - [select for diffs], Tue Oct 14 19:42:10 2003 UTC (20 years, 7 months ago) by jakob
Branch: MAIN
Changes since 1.123: +1 -5 lines
Diff to previous 1.123 (colored)
include SSHFP lookup code (not enabled by default). ok markus@
Revision 1.123 / (download) - annotate - [select for diffs], Sat Oct 11 08:24:07 2003 UTC (20 years, 7 months ago) by markus
Branch: MAIN
Changes since 1.122: +10 -2 lines
Diff to previous 1.122 (colored)
remote x11 clients are now untrusted by default, uses xauth(8) to generate untrusted cookies; ForwardX11Trusted=yes restores old behaviour. ok deraadt; feedback and ok djm/fries
Revision 1.122 / (download) - annotate - [select for diffs], Wed Oct 8 15:21:24 2003 UTC (20 years, 7 months ago) by markus
Branch: MAIN
Changes since 1.121: +2 -2 lines
Diff to previous 1.121 (colored)
default GSS API to no in client, too; ok jakob, deraadt@
Revision 1.100.2.2 / (download) - annotate - [select for diffs], Tue Sep 16 21:20:26 2003 UTC (20 years, 8 months ago) by brad
Branch: OPENBSD_3_2
Changes since 1.100.2.1: +123 -66 lines
Diff to previous 1.100.2.1 (colored) to branchpoint 1.100 (colored) next main 1.101 (colored)
upgrade to OpenSSH 3.7
Revision 1.102.2.1 / (download) - annotate - [select for diffs], Tue Sep 16 20:50:43 2003 UTC (20 years, 8 months ago) by brad
Branch: OPENBSD_3_3
Changes since 1.102: +123 -66 lines
Diff to previous 1.102 (colored)
upgrade to OpenSSH 3.7
Revision 1.121 / (download) - annotate - [select for diffs], Mon Sep 1 18:15:50 2003 UTC (20 years, 8 months ago) by markus
Branch: MAIN
CVS Tags: OPENBSD_3_4_BASE
Branch point for: OPENBSD_3_4
Changes since 1.120: +1 -16 lines
Diff to previous 1.120 (colored)
remove unused kerberos code; ok henning@
Revision 1.120 / (download) - annotate - [select for diffs], Mon Sep 1 12:50:46 2003 UTC (20 years, 8 months ago) by markus
Branch: MAIN
Changes since 1.119: +1 -2 lines
Diff to previous 1.119 (colored)
rm gssapidelegatecreds alias; never supported before
Revision 1.119 / (download) - annotate - [select for diffs], Thu Aug 28 12:54:34 2003 UTC (20 years, 8 months ago) by markus
Branch: MAIN
Changes since 1.118: +1 -6 lines
Diff to previous 1.118 (colored)
remove kerberos support from ssh1, since it has been replaced with GSSAPI; but keep kerberos passwd auth for ssh1 and 2; ok djm, hin, henning, ...
Revision 1.118 / (download) - annotate - [select for diffs], Fri Aug 22 10:56:09 2003 UTC (20 years, 9 months ago) by markus
Branch: MAIN
Changes since 1.117: +24 -2 lines
Diff to previous 1.117 (colored)
support GSS API user authentication; patches from Simon Wilkinson, stripped down and tested by Jakob and myself.
Revision 1.117 / (download) - annotate - [select for diffs], Wed Aug 13 09:07:09 2003 UTC (20 years, 9 months ago) by markus
Branch: MAIN
Changes since 1.116: +2 -2 lines
Diff to previous 1.116 (colored)
socks4->socks, since with support both 4 and 5; dtucker@zip.com.au
Revision 1.116 / (download) - annotate - [select for diffs], Wed Aug 13 08:46:30 2003 UTC (20 years, 9 months ago) by markus
Branch: MAIN
Changes since 1.115: +3 -12 lines
Diff to previous 1.115 (colored)
remove RhostsAuthentication; suggested by djm@ before; ok djm@, deraadt@, fgsch@, miod@, henning@, jakob@ and others
Revision 1.115 / (download) - annotate - [select for diffs], Tue Jul 22 13:35:22 2003 UTC (20 years, 10 months ago) by markus
Branch: MAIN
Changes since 1.114: +3 -14 lines
Diff to previous 1.114 (colored)
remove (already disabled) KRB4/AFS support, re-enable -k in ssh(1); test+ok henning@
Revision 1.114 / (download) - annotate - [select for diffs], Thu Jul 3 08:09:05 2003 UTC (20 years, 10 months ago) by djm
Branch: MAIN
Changes since 1.113: +10 -5 lines
Diff to previous 1.113 (colored)
fix AddressFamily option in config file, from brent@graveland.net; ok markus@
Revision 1.113 / (download) - annotate - [select for diffs], Thu Jun 26 20:08:33 2003 UTC (20 years, 10 months ago) by markus
Branch: MAIN
Changes since 1.112: +3 -1 lines
Diff to previous 1.112 (colored)
do not dump core for 'ssh -o proxycommand host'; ok deraadt@
Revision 1.112 / (download) - annotate - [select for diffs], Fri May 16 03:27:12 2003 UTC (21 years ago) by djm
Branch: MAIN
Changes since 1.111: +16 -1 lines
Diff to previous 1.111 (colored)
add AddressFamily option to ssh_config (like -4, -6 on commandline). Portable bug #534; ok markus@
Revision 1.111 / (download) - annotate - [select for diffs], Thu May 15 14:55:25 2003 UTC (21 years ago) by djm
Branch: MAIN
Changes since 1.110: +18 -2 lines
Diff to previous 1.110 (colored)
add a ConnectTimeout option to ssh, based on patch from Jean-Charles Longuet (jclonguet at free.fr); portable #207 ok markus@
Revision 1.110 / (download) - annotate - [select for diffs], Thu May 15 14:02:47 2003 UTC (21 years ago) by jakob
Branch: MAIN
Changes since 1.109: +24 -14 lines
Diff to previous 1.109 (colored)
warn for unsupported config option. ok markus@
Revision 1.109 / (download) - annotate - [select for diffs], Thu May 15 04:08:44 2003 UTC (21 years ago) by jakob
Branch: MAIN
Changes since 1.108: +13 -1 lines
Diff to previous 1.108 (colored)
disable kerberos when not supported. ok markus@
Revision 1.108 / (download) - annotate - [select for diffs], Thu May 15 01:48:10 2003 UTC (21 years ago) by jakob
Branch: MAIN
Changes since 1.107: +6 -34 lines
Diff to previous 1.107 (colored)
always parse kerberos options. ok djm@ markus@
Revision 1.107 / (download) - annotate - [select for diffs], Wed May 14 18:16:20 2003 UTC (21 years ago) by jakob
Branch: MAIN
Changes since 1.106: +10 -2 lines
Diff to previous 1.106 (colored)
add experimental support for verifying hos keys using DNS as described in draft-ietf-secsh-dns-xx.txt. more information in README.dns. ok markus@ and henning@
Revision 1.106 / (download) - annotate - [select for diffs], Wed Apr 9 12:00:37 2003 UTC (21 years, 1 month ago) by djm
Branch: MAIN
Changes since 1.105: +8 -1 lines
Diff to previous 1.105 (colored)
strip trailing whitespace from config lines before parsing. Fixes bz 528; ok markus@
Revision 1.95.2.2 / (download) - annotate - [select for diffs], Thu Apr 3 22:35:17 2003 UTC (21 years, 1 month ago) by miod
Branch: OPENBSD_3_1
Changes since 1.95.2.1: +15 -11 lines
Diff to previous 1.95.2.1 (colored) to branchpoint 1.95 (colored) next main 1.96 (colored)
Merge OpenSSH 3.6.1
Revision 1.105 / (download) - annotate - [select for diffs], Wed Apr 2 09:48:07 2003 UTC (21 years, 1 month ago) by markus
Branch: MAIN
Changes since 1.104: +31 -2 lines
Diff to previous 1.104 (colored)
reapply rekeying chage, tested by henning@, ok djm@
Revision 1.104 / (download) - annotate - [select for diffs], Tue Apr 1 10:22:21 2003 UTC (21 years, 1 month ago) by markus
Branch: MAIN
Changes since 1.103: +2 -31 lines
Diff to previous 1.103 (colored)
backout rekeying changes (for 3.6.1)
Revision 1.103 / (download) - annotate - [select for diffs], Tue Apr 1 10:10:23 2003 UTC (21 years, 1 month ago) by markus
Branch: MAIN
Changes since 1.102: +31 -2 lines
Diff to previous 1.102 (colored)
rekeying bugfixes and automatic rekeying:
* both client and server rekey _automatically_
(a) after 2^31 packets, because after 2^32 packets
the sequence number for packets wraps
(b) after 2^(blocksize_in_bits/4) blocks
(see: http://www.ietf.org/internet-drafts/draft-ietf-secsh-newmodes-00.txt)
(a) and (b) are _enabled_ by default, and only disabled for known
openssh versions, that don't support rekeying properly.
* client option 'RekeyLimit'
* do not reply to requests during rekeying
Revision 1.100.2.1 / (download) - annotate - [select for diffs], Tue Apr 1 00:12:14 2003 UTC (21 years, 1 month ago) by margarida
Branch: OPENBSD_3_2
Changes since 1.100: +15 -11 lines
Diff to previous 1.100 (colored)
Update to OpenSSH 3.6
Revision 1.102 / (download) - annotate - [select for diffs], Wed Feb 5 09:02:28 2003 UTC (21 years, 3 months ago) by markus
Branch: MAIN
CVS Tags: OPENBSD_3_3_BASE
Branch point for: OPENBSD_3_3
Changes since 1.101: +6 -11 lines
Diff to previous 1.101 (colored)
simplify ProxyCommand parsing, remove strcat/xrealloc; ok henning@, djm@
Revision 1.101 / (download) - annotate - [select for diffs], Thu Nov 7 22:08:07 2002 UTC (21 years, 6 months ago) by markus
Branch: MAIN
Changes since 1.100: +10 -1 lines
Diff to previous 1.100 (colored)
we cannot use HostbasedAuthentication for enabling ssh-keysign(8), because HostbasedAuthentication might be enabled based on the target host and ssh-keysign(8) does not know the remote hostname and not trust ssh(1) about the hostname, so we add a new option EnableSSHKeysign; ok djm@, report from zierke@informatik.uni-hamburg.de
Revision 1.95.2.1 / (download) - annotate - [select for diffs], Wed Jun 26 15:30:38 2002 UTC (21 years, 10 months ago) by jason
Branch: OPENBSD_3_1
Changes since 1.95: +15 -25 lines
Diff to previous 1.95 (colored)
Pull in OpenSSH-3.4
Revision 1.91.2.2 / (download) - annotate - [select for diffs], Sat Jun 22 07:23:17 2002 UTC (21 years, 11 months ago) by miod
Branch: OPENBSD_3_0
Changes since 1.91.2.1: +15 -25 lines
Diff to previous 1.91.2.1 (colored) to branchpoint 1.91 (colored) next main 1.92 (colored)
Update OpenSSH to version 3.3 (with local changes, configuration files still living in /etc and privsep user being nobody).
Revision 1.100 / (download) - annotate - [select for diffs], Wed Jun 19 00:27:55 2002 UTC (21 years, 11 months ago) by deraadt
Branch: MAIN
CVS Tags: OPENBSD_3_2_BASE
Branch point for: OPENBSD_3_2
Changes since 1.99: +2 -2 lines
Diff to previous 1.99 (colored)
KNF done automatically while reading....
Revision 1.99 / (download) - annotate - [select for diffs], Mon Jun 10 17:45:20 2002 UTC (21 years, 11 months ago) by stevesk
Branch: MAIN
Changes since 1.98: +3 -3 lines
Diff to previous 1.98 (colored)
change RhostsRSAAuthentication and RhostsAuthentication default to no since ssh is no longer setuid root by default; ok markus@
Revision 1.98 / (download) - annotate - [select for diffs], Sat Jun 8 12:46:14 2002 UTC (21 years, 11 months ago) by markus
Branch: MAIN
Changes since 1.97: +3 -3 lines
Diff to previous 1.97 (colored)
silently ignore deprecated options, since FallBackToRsh might be passed by remote scp commands.
Revision 1.97 / (download) - annotate - [select for diffs], Sat Jun 8 05:40:01 2002 UTC (21 years, 11 months ago) by markus
Branch: MAIN
Changes since 1.96: +2 -2 lines
Diff to previous 1.96 (colored)
just warn about Deprecated options for now
Revision 1.96 / (download) - annotate - [select for diffs], Sat Jun 8 05:17:01 2002 UTC (21 years, 11 months ago) by markus
Branch: MAIN
Changes since 1.95: +13 -23 lines
Diff to previous 1.95 (colored)
deprecate FallBackToRsh and UseRsh; patch from djm@
Revision 1.76.2.3 / (download) - annotate - [select for diffs], Sat Mar 9 00:20:44 2002 UTC (22 years, 2 months ago) by miod
Branch: OPENBSD_2_9
Changes since 1.76.2.2: +21 -23 lines
Diff to previous 1.76.2.2 (colored) to branchpoint 1.76 (colored) next main 1.77 (colored)
Merge OpenSSH 3.1, keeping /etc as configuration files directory. (i.e. OpenSSH 3.1 + openbsd29_3.1.patch)
Revision 1.49.2.7 / (download) - annotate - [select for diffs], Fri Mar 8 17:04:42 2002 UTC (22 years, 2 months ago) by brad
Branch: OPENBSD_2_8
Changes since 1.49.2.6: +21 -23 lines
Diff to previous 1.49.2.6 (colored) to branchpoint 1.49 (colored) next main 1.50 (colored)
Merge OpenSSH 3.1.
Revision 1.91.2.1 / (download) - annotate - [select for diffs], Thu Mar 7 17:37:47 2002 UTC (22 years, 2 months ago) by jason
Branch: OPENBSD_3_0
Changes since 1.91: +21 -23 lines
Diff to previous 1.91 (colored)
Update to OpenSSH-3.1 on 3.0-stable branch
Revision 1.95 / (download) - annotate - [select for diffs], Mon Feb 4 12:15:25 2002 UTC (22 years, 3 months ago) by markus
Branch: MAIN
CVS Tags: OPENBSD_3_1_BASE
Branch point for: OPENBSD_3_1
Changes since 1.94: +5 -5 lines
Diff to previous 1.94 (colored)
add SYSLOG_FACILITY_NOT_SET = -1, SYSLOG_LEVEL_NOT_SET = -1, fixes arm/netbsd; based on patch from bjh21@netbsd.org; ok djm@
Revision 1.94 / (download) - annotate - [select for diffs], Fri Jan 4 17:59:17 2002 UTC (22 years, 4 months ago) by stevesk
Branch: MAIN
Changes since 1.93: +1 -3 lines
Diff to previous 1.93 (colored)
remove #ifdef _PATH_XAUTH/#endif; ok markus@
Revision 1.93 / (download) - annotate - [select for diffs], Wed Dec 19 07:18:56 2001 UTC (22 years, 5 months ago) by deraadt
Branch: MAIN
Changes since 1.92: +16 -16 lines
Diff to previous 1.92 (colored)
basic KNF done while i was looking for something else
Revision 1.92 / (download) - annotate - [select for diffs], Sat Nov 17 19:14:34 2001 UTC (22 years, 6 months ago) by stevesk
Branch: MAIN
Changes since 1.91: +2 -2 lines
Diff to previous 1.91 (colored)
enum/int type cleanup where it made sense to do so; ok markus@
Revision 1.76.2.2 / (download) - annotate - [select for diffs], Thu Nov 15 00:15:19 2001 UTC (22 years, 6 months ago) by miod
Branch: OPENBSD_2_9
Changes since 1.76.2.1: +10 -2 lines
Diff to previous 1.76.2.1 (colored) to branchpoint 1.76 (colored)
Merge OpenSSH 3.0
Revision 1.49.2.6 / (download) - annotate - [select for diffs], Thu Nov 15 00:14:59 2001 UTC (22 years, 6 months ago) by miod
Branch: OPENBSD_2_8
Changes since 1.49.2.5: +10 -2 lines
Diff to previous 1.49.2.5 (colored) to branchpoint 1.49 (colored)
Merge OpenSSH 3.0
Revision 1.91 / (download) - annotate - [select for diffs], Mon Oct 1 21:51:16 2001 UTC (22 years, 7 months ago) by markus
Branch: MAIN
CVS Tags: OPENBSD_3_0_BASE
Branch point for: OPENBSD_3_0
Changes since 1.90: +10 -2 lines
Diff to previous 1.90 (colored)
add NoHostAuthenticationForLocalhost; note that the hostkey is now check for localhost, too.
Revision 1.76.2.1 / (download) - annotate - [select for diffs], Thu Sep 27 19:03:54 2001 UTC (22 years, 7 months ago) by jason
Branch: OPENBSD_2_9
Changes since 1.76: +102 -66 lines
Diff to previous 1.76 (colored)
Pull in OpenSSH-2.9.9
Revision 1.49.2.5 / (download) - annotate - [select for diffs], Thu Sep 27 00:15:42 2001 UTC (22 years, 7 months ago) by miod
Branch: OPENBSD_2_8
Changes since 1.49.2.4: +102 -66 lines
Diff to previous 1.49.2.4 (colored) to branchpoint 1.49 (colored)
Pull in OpenSSH 2.9.9 to the 2.8 branch.
Revision 1.90 / (download) - annotate - [select for diffs], Wed Sep 19 19:24:18 2001 UTC (22 years, 8 months ago) by stevesk
Branch: MAIN
Changes since 1.89: +24 -2 lines
Diff to previous 1.89 (colored)
add ClearAllForwardings ssh option and set it in scp and sftp; ok markus@
Revision 1.89 / (download) - annotate - [select for diffs], Mon Sep 3 20:58:33 2001 UTC (22 years, 8 months ago) by stevesk
Branch: MAIN
Changes since 1.88: +5 -4 lines
Diff to previous 1.88 (colored)
fatal() for nonexistent -Fssh_config. ok markus@
Revision 1.88 / (download) - annotate - [select for diffs], Thu Aug 30 16:04:35 2001 UTC (22 years, 8 months ago) by stevesk
Branch: MAIN
Changes since 1.87: +24 -31 lines
Diff to previous 1.87 (colored)
validate ports for LocalForward/RemoteForward. add host/port alternative syntax for IPv6 (like -L/-R). ok markus@
Revision 1.87 / (download) - annotate - [select for diffs], Tue Aug 28 09:51:26 2001 UTC (22 years, 8 months ago) by markus
Branch: MAIN
Changes since 1.86: +3 -2 lines
Diff to previous 1.86 (colored)
don't set DynamicForward unless Host matches
Revision 1.86 / (download) - annotate - [select for diffs], Wed Aug 1 22:03:33 2001 UTC (22 years, 9 months ago) by markus
Branch: MAIN
Changes since 1.85: +4 -4 lines
Diff to previous 1.85 (colored)
use strings instead of ints for smartcard reader ids
Revision 1.85 / (download) - annotate - [select for diffs], Tue Jul 31 09:28:44 2001 UTC (22 years, 9 months ago) by jakob
Branch: MAIN
Changes since 1.84: +8 -2 lines
Diff to previous 1.84 (colored)
add 'SmartcardDevice' client option to specify which smartcard device is used to access a smartcard used for storing the user's private RSA key. ok markus@.
Revision 1.84 / (download) - annotate - [select for diffs], Wed Jul 25 14:35:18 2001 UTC (22 years, 9 months ago) by markus
Branch: MAIN
Changes since 1.83: +2 -2 lines
Diff to previous 1.83 (colored)
cleanup connect(); connection_attempts 4 -> 1; from eivind@freebsd.org
Revision 1.83 / (download) - annotate - [select for diffs], Sun Jul 22 22:04:19 2001 UTC (22 years, 10 months ago) by markus
Branch: MAIN
Changes since 1.82: +2 -2 lines
Diff to previous 1.82 (colored)
enable challenge-response auth by default; ok millert@
Revision 1.82 / (download) - annotate - [select for diffs], Tue Jun 26 16:15:23 2001 UTC (22 years, 10 months ago) by dugsong
Branch: MAIN
Changes since 1.81: +27 -20 lines
Diff to previous 1.81 (colored)
Kerberos v5 support for SSH1, mostly from Assar Westerlund <assar@freebsd.org> and Bjorn Gronvall <bg@sics.se>. markus@ ok
Revision 1.81 / (download) - annotate - [select for diffs], Sat Jun 23 02:34:30 2001 UTC (22 years, 10 months ago) by markus
Branch: MAIN
Changes since 1.80: +3 -3 lines
Diff to previous 1.80 (colored)
get rid of known_hosts2, use it for hostkey lookup, but do not modify.
Revision 1.80 / (download) - annotate - [select for diffs], Fri Jun 8 15:25:40 2001 UTC (22 years, 11 months ago) by markus
Branch: MAIN
Changes since 1.79: +4 -4 lines
Diff to previous 1.79 (colored)
move the path for xauth to pathnames.h
Revision 1.79 / (download) - annotate - [select for diffs], Thu May 24 18:57:53 2001 UTC (22 years, 11 months ago) by stevesk
Branch: MAIN
Changes since 1.78: +2 -2 lines
Diff to previous 1.78 (colored)
don't perform escape processing when ``EscapeChar none''; ok markus@
Revision 1.78 / (download) - annotate - [select for diffs], Fri May 18 14:13:28 2001 UTC (23 years ago) by markus
Branch: MAIN
Changes since 1.77: +5 -5 lines
Diff to previous 1.77 (colored)
improved kbd-interactive support. work by per@appgate.com and me
Revision 1.49.2.4 / (download) - annotate - [select for diffs], Mon May 7 21:09:32 2001 UTC (23 years ago) by jason
Branch: OPENBSD_2_8
Changes since 1.49.2.3: +47 -12 lines
Diff to previous 1.49.2.3 (colored) to branchpoint 1.49 (colored)
Pull in OpenSSH-2.9 to 2.8 branch.
Revision 1.77 / (download) - annotate - [select for diffs], Mon Apr 30 11:18:51 2001 UTC (23 years ago) by markus
Branch: MAIN
Changes since 1.76: +8 -2 lines
Diff to previous 1.76 (colored)
implement 'ssh -b bind_address' like 'telnet -b'
Revision 1.76 / (download) - annotate - [select for diffs], Tue Apr 17 10:53:25 2001 UTC (23 years, 1 month ago) by markus
Branch: MAIN
CVS Tags: OPENBSD_2_9_BASE
Branch point for: OPENBSD_2_9
Changes since 1.75: +17 -2 lines
Diff to previous 1.75 (colored)
add HostKeyAlgorithms; based on patch from res@shore.net; ok provos@
Revision 1.75 / (download) - annotate - [select for diffs], Sun Apr 15 21:28:35 2001 UTC (23 years, 1 month ago) by stevesk
Branch: MAIN
Changes since 1.74: +3 -3 lines
Diff to previous 1.74 (colored)
use fatal() or error() vs. fprintf(); ok markus@
Revision 1.74 / (download) - annotate - [select for diffs], Thu Apr 12 20:09:37 2001 UTC (23 years, 1 month ago) by stevesk
Branch: MAIN
Changes since 1.73: +7 -7 lines
Diff to previous 1.73 (colored)
robust port validation; ok markus@ jakob@
Revision 1.73 / (download) - annotate - [select for diffs], Thu Apr 12 19:39:27 2001 UTC (23 years, 1 month ago) by markus
Branch: MAIN
Changes since 1.72: +2 -2 lines
Diff to previous 1.72 (colored)
typo
Revision 1.72 / (download) - annotate - [select for diffs], Thu Apr 12 19:15:25 2001 UTC (23 years, 1 month ago) by markus
Branch: MAIN
Changes since 1.71: +12 -4 lines
Diff to previous 1.71 (colored)
implement HostbasedAuthentication (= RhostRSAAuthentication for ssh v2) similar to RhostRSAAuthentication unless you enable (the experimental) HostbasedUsesNameFromPacketOnly option. please test. :)
Revision 1.71 / (download) - annotate - [select for diffs], Sat Apr 7 08:55:17 2001 UTC (23 years, 1 month ago) by markus
Branch: MAIN
Changes since 1.70: +15 -2 lines
Diff to previous 1.70 (colored)
allow the ssh client act as a SOCKS4 proxy (dynamic local portforwarding). work by Dan Kaminsky <dankamin@cisco.com> and me. thanks to Dan for this great patch: use 'ssh -D 1080 host' and make netscape use localhost:1080 as a socks proxy.
Revision 1.70 / (download) - annotate - [select for diffs], Mon Apr 2 14:20:23 2001 UTC (23 years, 1 month ago) by stevesk
Branch: MAIN
Changes since 1.69: +2 -3 lines
Diff to previous 1.69 (colored)
correct comment; ok markus@
Revision 1.49.2.3 / (download) - annotate - [select for diffs], Wed Mar 21 19:46:27 2001 UTC (23 years, 2 months ago) by jason
Branch: OPENBSD_2_8
Changes since 1.49.2.2: +20 -6 lines
Diff to previous 1.49.2.2 (colored) to branchpoint 1.49 (colored)
Pull in OpenSSH-2.5.2 for 2.8 branch.
Revision 1.31.2.5 / (download) - annotate - [select for diffs], Wed Mar 21 18:52:57 2001 UTC (23 years, 2 months ago) by jason
Branch: OPENBSD_2_7
Changes since 1.31.2.4: +20 -6 lines
Diff to previous 1.31.2.4 (colored) to branchpoint 1.31 (colored) next main 1.32 (colored)
Pull in OpenSSH-2.5.2 for 2.7 branch.
Revision 1.69 / (download) - annotate - [select for diffs], Tue Mar 20 19:10:16 2001 UTC (23 years, 2 months ago) by markus
Branch: MAIN
Changes since 1.68: +1 -1 lines
Diff to previous 1.68 (colored)
default to SSH protocol version 2
Revision 1.68 / (download) - annotate - [select for diffs], Mon Mar 19 17:07:23 2001 UTC (23 years, 2 months ago) by markus
Branch: MAIN
Changes since 1.67: +2 -2 lines
Diff to previous 1.67 (colored)
undo /etc/shell and proto 2,1 change for openssh-2.5.2
Revision 1.31.2.4 / (download) - annotate - [select for diffs], Mon Mar 12 15:44:13 2001 UTC (23 years, 2 months ago) by jason
Branch: OPENBSD_2_7
Changes since 1.31.2.3: +82 -56 lines
Diff to previous 1.31.2.3 (colored) to branchpoint 1.31 (colored)
OpenSSH-2.5.1 for 2.7 patch branch
Revision 1.67 / (download) - annotate - [select for diffs], Sat Mar 10 17:51:04 2001 UTC (23 years, 2 months ago) by markus
Branch: MAIN
Changes since 1.66: +10 -2 lines
Diff to previous 1.66 (colored)
add PreferredAuthentications
Revision 1.66 / (download) - annotate - [select for diffs], Sat Mar 10 12:53:52 2001 UTC (23 years, 2 months ago) by deraadt
Branch: MAIN
Changes since 1.65: +2 -2 lines
Diff to previous 1.65 (colored)
default to SSH2, now that m68k runs fast
Revision 1.65 / (download) - annotate - [select for diffs], Thu Mar 8 00:15:47 2001 UTC (23 years, 2 months ago) by markus
Branch: MAIN
Changes since 1.64: +2 -2 lines
Diff to previous 1.64 (colored)
turn off useprivilegedports by default. only rhost-auth needs this. older sshd's may need this, too.
Revision 1.64 / (download) - annotate - [select for diffs], Sun Mar 4 17:42:28 2001 UTC (23 years, 2 months ago) by millert
Branch: MAIN
Changes since 1.63: +4 -4 lines
Diff to previous 1.63 (colored)
log functions should not be passed strings that end in newline as they get passed on to syslog() and when logging to stderr, do_log() appends its own newline.
Revision 1.63 / (download) - annotate - [select for diffs], Sat Feb 24 10:37:55 2001 UTC (23 years, 2 months ago) by deraadt
Branch: MAIN
Changes since 1.62: +7 -1 lines
Diff to previous 1.62 (colored)
look for id_rsa by default, before id_dsa
Revision 1.49.2.2 / (download) - annotate - [select for diffs], Mon Feb 19 17:19:12 2001 UTC (23 years, 3 months ago) by jason
Branch: OPENBSD_2_8
Changes since 1.49.2.1: +0 -0 lines
Diff to previous 1.49.2.1 (colored) to branchpoint 1.49 (colored)
Pull in OpenSSH-2.5.1
Revision 1.49.2.1 / (download) - annotate - [select for diffs], Fri Feb 16 20:13:10 2001 UTC (23 years, 3 months ago) by jason
Branch: OPENBSD_2_8
Changes since 1.49: +82 -56 lines
Diff to previous 1.49 (colored)
Pull in OpenSSH 2.5.0
Revision 1.62 / (download) - annotate - [select for diffs], Sun Feb 11 12:59:25 2001 UTC (23 years, 3 months ago) by markus
Branch: MAIN
Changes since 1.61: +18 -2 lines
Diff to previous 1.61 (colored)
1) clean up the MAC support for SSH-2
2) allow you to specify the MAC with 'ssh -m'
3) or the 'MACs' keyword in ssh(d)_config
4) add hmac-{md5,sha1}-96
ok stevesk@, provos@
Revision 1.61 / (download) - annotate - [select for diffs], Thu Feb 8 14:39:36 2001 UTC (23 years, 3 months ago) by deraadt
Branch: MAIN
Changes since 1.60: +11 -7 lines
Diff to previous 1.60 (colored)
snprintf
Revision 1.60 / (download) - annotate - [select for diffs], Sun Jan 28 20:36:16 2001 UTC (23 years, 3 months ago) by stevesk
Branch: MAIN
Changes since 1.59: +2 -2 lines
Diff to previous 1.59 (colored)
``StrictHostKeyChecking ask'' documentation and small cleanup. ok markus@
Revision 1.59 / (download) - annotate - [select for diffs], Mon Jan 22 23:06:39 2001 UTC (23 years, 3 months ago) by markus
Branch: MAIN
Changes since 1.58: +13 -14 lines
Diff to previous 1.58 (colored)
rename skey -> challenge response. auto-enable kbd-interactive for ssh2 if challenge-reponse is enabled.
Revision 1.58 / (download) - annotate - [select for diffs], Sun Jan 21 19:05:53 2001 UTC (23 years, 3 months ago) by markus
Branch: MAIN
Changes since 1.57: +6 -3 lines
Diff to previous 1.57 (colored)
split ssh.h and try to cleanup the #include mess. remove unnecessary #includes. rename util.[ch] -> misc.[ch]
Revision 1.57 / (download) - annotate - [select for diffs], Sat Jan 20 23:02:07 2001 UTC (23 years, 4 months ago) by djm
Branch: MAIN
Changes since 1.56: +2 -3 lines
Diff to previous 1.56 (colored)
KNF; ok markus
Revision 1.56 / (download) - annotate - [select for diffs], Sat Jan 20 17:59:40 2001 UTC (23 years, 4 months ago) by deraadt
Branch: MAIN
Changes since 1.55: +2 -2 lines
Diff to previous 1.55 (colored)
fix SIGSEGV from -o ""; problem noted by jehsom@togetherweb.com
Revision 1.55 / (download) - annotate - [select for diffs], Fri Jan 19 15:55:11 2001 UTC (23 years, 4 months ago) by markus
Branch: MAIN
Changes since 1.54: +10 -9 lines
Diff to previous 1.54 (colored)
move ssh1 definitions to ssh1.h, pathnames to pathnames.h
Revision 1.54 / (download) - annotate - [select for diffs], Thu Jan 18 16:20:22 2001 UTC (23 years, 4 months ago) by markus
Branch: MAIN
Changes since 1.53: +2 -2 lines
Diff to previous 1.53 (colored)
log() is at pri=LOG_INFO, since LOG_NOTICE goes to /dev/console on many systems
Revision 1.53 / (download) - annotate - [select for diffs], Sun Jan 7 11:28:05 2001 UTC (23 years, 4 months ago) by markus
Branch: MAIN
Changes since 1.52: +2 -2 lines
Diff to previous 1.52 (colored)
rename SYSLOG_LEVEL_INFO->SYSLOG_LEVEL_NOTICE syslog priority changes: fatal() LOG_ERR -> LOG_CRIT log() LOG_INFO -> LOG_NOTICE
Revision 1.52 / (download) - annotate - [select for diffs], Wed Dec 27 12:30:19 2000 UTC (23 years, 4 months ago) by markus
Branch: MAIN
Changes since 1.51: +9 -2 lines
Diff to previous 1.51 (colored)
new option: HostKeyAlias: allows the user to record the host key under a different name. This is useful for ssh tunneling over forwarded connections or if you run multiple sshd's on different ports on the same machine.
Revision 1.51 / (download) - annotate - [select for diffs], Tue Dec 19 23:17:57 2000 UTC (23 years, 5 months ago) by markus
Branch: MAIN
Changes since 1.50: +5 -5 lines
Diff to previous 1.50 (colored)
replace 'unsigned bla' with 'u_bla' everywhere. also, replace 'char unsigned' with u_char.
Revision 1.50 / (download) - annotate - [select for diffs], Sun Nov 12 19:50:37 2000 UTC (23 years, 6 months ago) by markus
Branch: MAIN
Changes since 1.49: +26 -29 lines
Diff to previous 1.49 (colored)
add support for RSA to SSH2. please test. there are now 3 types of keys: RSA1 is used by ssh-1 only, RSA and DSA are used by SSH2. you can use 'ssh-keygen -t rsa -f ssh2_rsa_file' to generate RSA keys for SSH2 and use the RSA keys for hostkeys or for user keys. SSH2 RSA or DSA keys are added to .ssh/authorised_keys2 as before. IdentityFile2, HostDsaKey and DSAAuthentication are obsolete. you can use multiple IdentityFile and HostKey for all types of keys. the option DSAAuthentication is replaced by PubkeyAuthetication.
Revision 1.31.2.3 / (download) - annotate - [select for diffs], Wed Nov 8 21:31:07 2000 UTC (23 years, 6 months ago) by jason
Branch: OPENBSD_2_7
Changes since 1.31.2.2: +22 -10 lines
Diff to previous 1.31.2.2 (colored) to branchpoint 1.31 (colored)
openssh-2.3.0 (again) for 2.7 branch
Revision 1.49 / (download) - annotate - [select for diffs], Wed Oct 11 20:27:23 2000 UTC (23 years, 7 months ago) by markus
Branch: MAIN
CVS Tags: OPENBSD_2_8_BASE
Branch point for: OPENBSD_2_8
Changes since 1.48: +1 -2 lines
Diff to previous 1.48 (colored)
new cipher framework
Revision 1.48 / (download) - annotate - [select for diffs], Wed Oct 11 20:14:39 2000 UTC (23 years, 7 months ago) by markus
Branch: MAIN
Changes since 1.47: +17 -2 lines
Diff to previous 1.47 (colored)
add support for s/key (kbd-interactive) to ssh2, based on work by mkiernan@avantgo.com and me
Revision 1.47 / (download) - annotate - [select for diffs], Thu Sep 7 21:13:37 2000 UTC (23 years, 8 months ago) by markus
Branch: MAIN
Changes since 1.46: +1 -24 lines
Diff to previous 1.46 (colored)
some more Copyright fixes
Revision 1.46 / (download) - annotate - [select for diffs], Thu Sep 7 20:27:53 2000 UTC (23 years, 8 months ago) by deraadt
Branch: MAIN
Changes since 1.45: +29 -8 lines
Diff to previous 1.45 (colored)
cleanup copyright notices on all files. I have attempted to be accurate with the details. everything is now under Tatu's licence (which I copied from his readme), and/or the core-sdi bsd-ish thing for deattack, or various openbsd developers under a 2-term bsd licence. We're not changing any rules, just being accurate.
Revision 1.31.2.2 / (download) - annotate - [select for diffs], Fri Sep 1 18:23:21 2000 UTC (23 years, 8 months ago) by jason
Branch: OPENBSD_2_7
Changes since 1.31.2.1: +81 -81 lines
Diff to previous 1.31.2.1 (colored) to branchpoint 1.31 (colored)
Pull in the rest of openssh-2.2.0 to 2.7 branch (luvin' cvs...)
Revision 1.45 / (download) - annotate - [select for diffs], Wed Aug 2 17:27:04 2000 UTC (23 years, 9 months ago) by provos
Branch: MAIN
Changes since 1.44: +2 -2 lines
Diff to previous 1.44 (colored)
disallow kerberos authentication if we can't verify the TGT; from dugsong@ kerberos authentication is on by default only if you have a srvtab.
Revision 1.44 / (download) - annotate - [select for diffs], Wed Aug 2 16:27:16 2000 UTC (23 years, 9 months ago) by provos
Branch: MAIN
Changes since 1.43: +2 -2 lines
Diff to previous 1.43 (colored)
disable kerberos authentication by default
Revision 1.43 / (download) - annotate - [select for diffs], Fri Jul 14 22:59:46 2000 UTC (23 years, 10 months ago) by markus
Branch: MAIN
Changes since 1.42: +2 -2 lines
Diff to previous 1.42 (colored)
allow leading whitespace. ok niels
Revision 1.42 / (download) - annotate - [select for diffs], Thu Jul 13 22:53:21 2000 UTC (23 years, 10 months ago) by provos
Branch: MAIN
Changes since 1.41: +26 -28 lines
Diff to previous 1.41 (colored)
allow multiple whitespace but only one '=' between tokens, bug report from Ralf S. Engelschall <rse@engelschall.com> but different fix. okay deraadt@
Revision 1.41 / (download) - annotate - [select for diffs], Tue Jul 11 19:17:44 2000 UTC (23 years, 10 months ago) by deraadt
Branch: MAIN
Changes since 1.40: +2 -2 lines
Diff to previous 1.40 (colored)
disable FallBackToRsh by default
Revision 1.40 / (download) - annotate - [select for diffs], Mon Jul 10 16:27:05 2000 UTC (23 years, 10 months ago) by ho
Branch: MAIN
Changes since 1.39: +17 -17 lines
Diff to previous 1.39 (colored)
Get the correct message on errors. (niels@ ok)
Revision 1.39 / (download) - annotate - [select for diffs], Sun Jul 9 01:27:33 2000 UTC (23 years, 10 months ago) by ho
Branch: MAIN
Changes since 1.38: +6 -4 lines
Diff to previous 1.38 (colored)
Better conditions for strsep() ending.
Revision 1.38 / (download) - annotate - [select for diffs], Sat Jul 8 23:17:31 2000 UTC (23 years, 10 months ago) by provos
Branch: MAIN
Changes since 1.37: +73 -73 lines
Diff to previous 1.37 (colored)
replace strtok with strsep; from David Young <dyoung@onthejob.net>
Revision 1.37 / (download) - annotate - [select for diffs], Tue Jun 20 01:39:43 2000 UTC (23 years, 11 months ago) by markus
Branch: MAIN
Changes since 1.36: +1 -1 lines
Diff to previous 1.36 (colored)
OpenBSD tag
Revision 1.36 / (download) - annotate - [select for diffs], Sun Jun 18 00:57:48 2000 UTC (23 years, 11 months ago) by deraadt
Branch: MAIN
Changes since 1.35: +2 -2 lines
Diff to previous 1.35 (colored)
include = in WHITESPACE; markus ok
Revision 1.31.2.1 / (download) - annotate - [select for diffs], Mon Jun 12 02:37:34 2000 UTC (23 years, 11 months ago) by jason
Branch: OPENBSD_2_7
Changes since 1.31: +19 -3 lines
Diff to previous 1.31 (colored)
lovin' CVS... update patch branch to OpenSSH-2.1.1
Revision 1.35 / (download) - annotate - [select for diffs], Wed May 31 09:20:38 2000 UTC (23 years, 11 months ago) by markus
Branch: MAIN
Changes since 1.34: +2 -2 lines
Diff to previous 1.34 (colored)
typo, unused
Revision 1.34 / (download) - annotate - [select for diffs], Wed May 31 06:36:40 2000 UTC (23 years, 11 months ago) by markus
Branch: MAIN
Changes since 1.33: +12 -2 lines
Diff to previous 1.33 (colored)
xauth_location support; pr 1234
Revision 1.33 / (download) - annotate - [select for diffs], Mon May 29 20:20:46 2000 UTC (23 years, 11 months ago) by markus
Branch: MAIN
Changes since 1.32: +2 -2 lines
Diff to previous 1.32 (colored)
forwardagent defaults to no, add ssh -A
Revision 1.32 / (download) - annotate - [select for diffs], Mon May 22 18:42:01 2000 UTC (24 years ago) by markus
Branch: MAIN
Changes since 1.31: +7 -1 lines
Diff to previous 1.31 (colored)
check strtok() != NULL; ok niels@
Revision 1.31 / (download) - annotate - [select for diffs], Mon May 8 17:12:15 2000 UTC (24 years ago) by markus
Branch: MAIN
CVS Tags: OPENBSD_2_7_BASE
Branch point for: OPENBSD_2_7
Changes since 1.30: +3 -2 lines
Diff to previous 1.30 (colored)
complain about invalid ciphers in SSH1 (e.g. arcfour is SSH2 only)
Revision 1.30 / (download) - annotate - [select for diffs], Sat May 6 17:45:36 2000 UTC (24 years ago) by markus
Branch: MAIN
Changes since 1.29: +10 -2 lines
Diff to previous 1.29 (colored)
add DSAAuthetication option to ssh/sshd, document SSH2 in sshd.8
Revision 1.29 / (download) - annotate - [select for diffs], Tue May 2 22:18:04 2000 UTC (24 years ago) by markus
Branch: MAIN
Changes since 1.28: +3 -5 lines
Diff to previous 1.28 (colored)
default DSA key file ~/.ssh/id_dsa
Revision 1.28 / (download) - annotate - [select for diffs], Wed Apr 26 22:43:14 2000 UTC (24 years ago) by markus
Branch: MAIN
Changes since 1.27: +2 -2 lines
Diff to previous 1.27 (colored)
ssh/sshd default to proto 1 and 2
Revision 1.27 / (download) - annotate - [select for diffs], Wed Apr 26 20:56:29 2000 UTC (24 years ago) by markus
Branch: MAIN
Changes since 1.26: +39 -4 lines
Diff to previous 1.26 (colored)
add DSA pubkey auth and other SSH2 fixes. use ssh-keygen -[xX] for trading keys with the real and the original SSH, directly from the people who invented the SSH protocol.
Revision 1.26 / (download) - annotate - [select for diffs], Fri Apr 14 10:30:32 2000 UTC (24 years, 1 month ago) by markus
Branch: MAIN
Changes since 1.25: +13 -13 lines
Diff to previous 1.25 (colored)
whitespace cleanup
Revision 1.25 / (download) - annotate - [select for diffs], Wed Apr 12 07:45:44 2000 UTC (24 years, 1 month ago) by markus
Branch: MAIN
Changes since 1.24: +29 -2 lines
Diff to previous 1.24 (colored)
add Cipher and Protocol options to ssh/sshd, e.g.: ssh -o 'Protocol 1,2' if you prefer proto 1, ssh -o 'Ciphers arcfour,3des-cbc'
Revision 1.24 / (download) - annotate - [select for diffs], Tue Mar 28 20:31:28 2000 UTC (24 years, 1 month ago) by markus
Branch: MAIN
Changes since 1.23: +2 -1 lines
Diff to previous 1.23 (colored)
replace big switch() with function tables (prepare for ssh2)
Revision 1.23 / (download) - annotate - [select for diffs], Mon Feb 28 19:51:58 2000 UTC (24 years, 2 months ago) by markus
Branch: MAIN
Changes since 1.22: +2 -2 lines
Diff to previous 1.22 (colored)
turn off x11-fwd for the client, too.
Revision 1.22 / (download) - annotate - [select for diffs], Wed Dec 1 13:59:15 1999 UTC (24 years, 5 months ago) by markus
Branch: MAIN
Changes since 1.21: +9 -10 lines
Diff to previous 1.21 (colored)
ports are u_short
Revision 1.21 / (download) - annotate - [select for diffs], Wed Nov 24 20:24:09 1999 UTC (24 years, 5 months ago) by markus
Branch: MAIN
Changes since 1.20: +7 -13 lines
Diff to previous 1.20 (colored)
remove dead #ifdef-0-code
Revision 1.20 / (download) - annotate - [select for diffs], Wed Nov 24 20:19:37 1999 UTC (24 years, 5 months ago) by markus
Branch: MAIN
Changes since 1.19: +2 -9 lines
Diff to previous 1.19 (colored)
strcasecmp instead of tolower
Revision 1.19 / (download) - annotate - [select for diffs], Wed Nov 24 19:53:49 1999 UTC (24 years, 5 months ago) by markus
Branch: MAIN
Changes since 1.18: +42 -27 lines
Diff to previous 1.18 (colored)
KNF, final part 3
Revision 1.18 / (download) - annotate - [select for diffs], Wed Nov 24 00:26:02 1999 UTC (24 years, 5 months ago) by deraadt
Branch: MAIN
Changes since 1.17: +14 -14 lines
Diff to previous 1.17 (colored)
much more KNF
Revision 1.17 / (download) - annotate - [select for diffs], Tue Nov 23 22:25:54 1999 UTC (24 years, 5 months ago) by markus
Branch: MAIN
Changes since 1.16: +536 -539 lines
Diff to previous 1.16 (colored)
KNF part 1
Revision 1.16 / (download) - annotate - [select for diffs], Mon Nov 22 21:52:41 1999 UTC (24 years, 5 months ago) by markus
Branch: MAIN
Changes since 1.15: +12 -10 lines
Diff to previous 1.15 (colored)
tranfer s/key challenge/response data in SSH_SMSG_AUTH_TIS_CHALLENGE messages. allows use of s/key in windows (ttssh, securecrt) and ssh-1.2.27 clients without 'ssh -v', ok: niels@
Revision 1.15 / (download) - annotate - [select for diffs], Fri Nov 19 16:04:17 1999 UTC (24 years, 6 months ago) by markus
Branch: MAIN
Changes since 1.14: +11 -37 lines
Diff to previous 1.14 (colored)
bugfix: loglevels are per host in clientconfig, factor out common log-level parsing code.
Revision 1.14 / (download) - annotate - [select for diffs], Sun Nov 14 21:45:07 1999 UTC (24 years, 6 months ago) by markus
Branch: MAIN
Changes since 1.13: +21 -13 lines
Diff to previous 1.13 (colored)
print _all_ bad config-options in ssh(1), too
Revision 1.13 / (download) - annotate - [select for diffs], Wed Nov 10 23:36:44 1999 UTC (24 years, 6 months ago) by markus
Branch: MAIN
Changes since 1.12: +45 -3 lines
Diff to previous 1.12 (colored)
add LogLevel {QUIET, FATAL, ERROR, INFO, CHAT, DEBUG} to ssh/sshd,
obsoletes QuietMode and FascistLogging in sshd.
Revision 1.12 / (download) - annotate - [select for diffs], Fri Oct 15 21:39:02 1999 UTC (24 years, 7 months ago) by markus
Branch: MAIN
CVS Tags: OPENBSD_2_6_BASE,
OPENBSD_2_6
Changes since 1.11: +2 -2 lines
Diff to previous 1.11 (colored)
typo: s/UsePrivilegedPorts/UsePrivilegedPort/
Revision 1.11 / (download) - annotate - [select for diffs], Tue Oct 12 21:04:21 1999 UTC (24 years, 7 months ago) by markus
Branch: MAIN
Changes since 1.10: +11 -2 lines
Diff to previous 1.10 (colored)
-P/UsePrivilegedPort from 1.2.27, it turns of allocation of priv. port and disabled rhosts/rhosts-rsa, ok deraadt@
Revision 1.10 / (download) - annotate - [select for diffs], Wed Oct 6 20:07:42 1999 UTC (24 years, 7 months ago) by dugsong
Branch: MAIN
Changes since 1.9: +10 -2 lines
Diff to previous 1.9 (colored)
implement client NumberOfPasswordPrompts option
Revision 1.9 / (download) - annotate - [select for diffs], Sun Oct 3 22:01:39 1999 UTC (24 years, 7 months ago) by provos
Branch: MAIN
Changes since 1.8: +5 -1 lines
Diff to previous 1.8 (colored)
fix last commit.
Revision 1.8 / (download) - annotate - [select for diffs], Sun Oct 3 21:50:03 1999 UTC (24 years, 7 months ago) by provos
Branch: MAIN
Changes since 1.7: +7 -3 lines
Diff to previous 1.7 (colored)
add code to detect DNS spoofing: the main idea is to not only store the host key for the hostname but also for the according IP address. When we check the host key in the known_hosts file, we also check the key against the according IP address. When the server key changes, host_status = HOST_CHANGED. If check_host_in_hostfile() returns differing status for the IP address that means that either DNS was spoofed or that the IP address for the host and the host key changed at the same time.
Revision 1.7 / (download) - annotate - [select for diffs], Thu Sep 30 08:03:39 1999 UTC (24 years, 7 months ago) by deraadt
Branch: MAIN
Changes since 1.6: +2 -2 lines
Diff to previous 1.6 (colored)
IPPORT_RESERVED
Revision 1.6 / (download) - annotate - [select for diffs], Thu Sep 30 05:03:05 1999 UTC (24 years, 7 months ago) by deraadt
Branch: MAIN
Changes since 1.5: +1 -13 lines
Diff to previous 1.5 (colored)
cull more ancient garbage from pre-POSIX days
Revision 1.5 / (download) - annotate - [select for diffs], Wed Sep 29 18:16:19 1999 UTC (24 years, 7 months ago) by dugsong
Branch: MAIN
Changes since 1.4: +8 -19 lines
Diff to previous 1.4 (colored)
update krb4/AFS support to ssh-1.2.27-afs-kerberos-pl1 level, clean up unused variables, update manpages
Revision 1.4 / (download) - annotate - [select for diffs], Wed Sep 29 17:52:12 1999 UTC (24 years, 7 months ago) by deraadt
Branch: MAIN
Changes since 1.3: +6 -1 lines
Diff to previous 1.3 (colored)
disable portforwarding for reserved/bad ports; Markus.Friedl@informatik.uni-erlangen.de
Revision 1.3 / (download) - annotate - [select for diffs], Wed Sep 29 00:10:16 1999 UTC (24 years, 7 months ago) by deraadt
Branch: MAIN
Changes since 1.2: +10 -2 lines
Diff to previous 1.2 (colored)
GatewayPorts and ssh -g; markus.friedl@informatik.uni-erlangen.de
Revision 1.2 / (download) - annotate - [select for diffs], Tue Sep 28 04:45:36 1999 UTC (24 years, 7 months ago) by provos
Branch: MAIN
Changes since 1.1: +1 -2 lines
Diff to previous 1.1 (colored)
convert all uses of gmp to SSL bignum convert all used of rsa to SSL rsa functions remove all use of randomstate to OpenBSD arc4random() and arc4_stir() all this done at a long long night in Canada.
Revision 1.1 / (download) - annotate - [select for diffs], Sun Sep 26 20:53:37 1999 UTC (24 years, 7 months ago) by deraadt
Branch: MAIN
i bet a lot of people didn't know what ssh 1.2.16 had a nice license. well, except for the patent issues. someone in sweden (forget their name at the moment) cleaned out most of the patented code, and now this code removes rsa code. when this is done, it will link against libssl, but the work isn't completely done yet. then we need to bring this up to modern days, featurewise.