aboutsummaryrefslogtreecommitdiff
path: root/security/openssh-portable/files
Commit message (Collapse)AuthorAgeFilesLines
* Apply upstream fix for 'HostkeyAlgorithms +' support.Bryan Drewery2015-08-241-0/+51
| | | | Notes: svn path=/head/; revision=395182
* - Update to OpenSSH 7.0p1Bryan Drewery2015-08-183-105/+46
| | | | | | | | | - Update X509 patch to 8.5 Changes: http://www.openssh.com/txt/release-7.0 Notes: svn path=/head/; revision=394608
* Add upstream fix to address CVE-2015-5600 for MaxAuthTries bypass.Bryan Drewery2015-07-271-0/+52
| | | | | | | Security: 5b74a5bc-348f-11e5-ba05-c80aa9043978 Notes: svn path=/head/; revision=393004
* Fix accidental revert of PermitRootLogin default to NO.Bryan Drewery2015-07-271-0/+9
| | | | | | | | | This was due to the patch not being needed in the snapshot version which I based the 6.9 update off of. The default is changed in the upcoming 7.0 release Notes: svn path=/head/; revision=393002
* - Update to 6.9p1Bryan Drewery2015-07-279-180/+46
| | | | | | | | | - Update X509 patch to 8.4 Changes: http://www.openssh.com/txt/release-6.9 Notes: svn path=/head/; revision=392998
* Remove $FreeBSD$ from patches files everywhere.Mathieu Arnold2015-05-221-2/+0
| | | | | | | | With hat: portmgr Sponsored by: Absolight Notes: svn path=/head/; revision=387082
* Avoid a potential read overflow. This was not deemed a security issue byBryan Drewery2015-05-161-0/+17
| | | | | | | | | | | | upstream; it was fixed upstream comprehensively a few weeks ago in 77199d6ec8986d470487e66f8ea8f4cf43d2e20c. PR: 200241 Patch by: Hanno Böck <hanno@hboeck.de> Obtained from: http://www.openwall.com/lists/oss-security/2015/05/16/3 Notes: svn path=/head/; revision=386554
* Fix clients getting 'Bad packet length' and 'Disconnecting: Packet corrupt'Bryan Drewery2015-05-061-7/+10
| | | | | | | | | | | | | | | | | when the NONECIPHER option is selected but not the HPN option. The server banner was improperly sending a NULL byte after the newline causing confusion on the client. This was an error in my own modifications to the HPN patch in r383231. This may have occurred with stale builds as well, such as running 'make configure' then 'portsnap update' and then 'make build'. Pointyhat to: bdrewery Reported by: many PR: 199352 Notes: svn path=/head/; revision=385541
* Replace the TTSH patch from r383618 with the one that upstream took.Bryan Drewery2015-04-141-20/+51
| | | | | | | Obtained from upstream d8f391caef623 Notes: svn path=/head/; revision=384006
* Cleanup some unneeded patches.Bryan Drewery2015-04-092-18/+0
| | | | | | | | | | | | | | | | | | 1. There's no need to patch the xauth(1) location as the OpenSSH build already does so based on the --with-xauth path provided. It also updates manpages. 2. Don't modify manpage for shosts location as it was wrong. The proper LOCALBASE path is now used due to OpenSSH's build already handling it properly. 3. Remove confusing UsePrivilegeSeparation change in sshd_config. The default upstream is to have it disabled by default. The sshd_config line is in upstream to enable it by default in new installations. We always enable it though. So remove the sshd_config change which makes it look like we don't use it; it was not a needed difference with upstream. From discussion with: TJ <tj@mrsk.me> Notes: svn path=/head/; revision=383678
* Limit the TTSSH bug fix in r383618 to only versions that have it.Bryan Drewery2015-04-091-5/+20
| | | | | | | Submitted by: IWAMOTO Kouichi <sue@iwmt.org> Notes: svn path=/head/; revision=383675
* Fix TTSSH (Tera Type/Term) client crash:Bryan Drewery2015-04-092-2/+35
| | | | | | | | | | | | | Unexpected SSH2 message(80) on current stage(6) This patch was submitted upstream. The client has fixed it in their SVN [1][2] but not yet released a fixed build. [1] http://en.sourceforge.jp/ticket/browse.php?group_id=1412&tid=35010 [2] http://en.sourceforge.jp/projects/ttssh2/scm/svn/commits/5829 Notes: svn path=/head/; revision=383618
* Remove debugging leftover in release.Bryan Drewery2015-04-091-0/+16
| | | | | | | | | error: mm_request_receive: socket closed Obtained from: Upstream c7fe79ed7db427f1474e72b9f8b465901d61d3f6 Notes: svn path=/head/; revision=383616
* - Update to 6.8p1Bryan Drewery2015-04-0410-258/+1359
| | | | | | | | | | | | | | | | | | | | | | | | | | - Fix 'make test' - HPN: - NONECIPHER is no longer default. This is not default in base and should not be default here as it introduces security holes. - HPN: I've audited the patch and included it in the port directory for transparency. I identified several bugs and submitted them to the new upstream: https://github.com/rapier1/openssh-portable/pull/2 - HPN: The entire patch is now ifdef'd to ensure various bits are properly removed depending on the OPTIONS selected. - AES_THREADED is removed. It has questionable benefit on modern HW and is not stable. - The "enhanced logging" was removed from the patch as it is too intrusive and difficult to maintain in the port. - The progress meter "peak throughput" patch was removed. - Fixed HPN version showing in client/server version string when HPN was disabled in the config. - KERB_GSSAPI is currently BROKEN as it does not apply. - Update X509 to 8.3 Changelog: http://www.openssh.com/txt/release-6.8 Notes: svn path=/head/; revision=383231
* Make the VersionAddendum fix use the proper default.Bryan Drewery2015-03-291-0/+5
| | | | | | | | | | Once I ran into the X509 issue previously I failed to retest that the patch worked. PR: 193127 Notes: svn path=/head/; revision=382566
* Stop forcing the port version string into the server banner.Bryan Drewery2015-03-232-16/+36
| | | | | | | | | | | | | | | | The port now uses VersionAddendum in the sshd_config to allow overriding this value. Using "none" allows disabling the default of the port version string. The default is kept to show the port version string to remain close to the base version. Support for the client VersionAddendum may be added soon as well to better match base and not give surprises when switching from base to the port. PR: 193127 Requested by: many, including myself when this was broken years ago. Notes: svn path=/head/; revision=381981
* Fix incorrect reference to ETCSSH from r381709Bryan Drewery2015-03-211-23/+23
| | | | Notes: svn path=/head/; revision=381823
* - Fix HPN patches for 6.7p1Bryan Drewery2014-12-171-3/+3
| | | | | | | | - Add back HPN and NONECIPHER for the default options and bump PORTREVISION due to this. Notes: svn path=/head/; revision=374833
* - Update to 6.7p1.Bryan Drewery2014-11-175-198/+215
| | | | | | | | | | Several patches do not currently apply. Use security/openssh-portable66 for: HPN, NONECIPHER, KERB_GSSAPI, X509. - Add a TCP_WRAPPER patch to re-enable support after it was removed upstream. Notes: svn path=/head/; revision=372676
* Support multiple ListenAddress portsBryan Drewery2014-10-031-3/+8
| | | | | | | Reported by: rustamabd@gmail.com Notes: svn path=/head/; revision=369931
* - Update to "6.6.1" [1]Bryan Drewery2014-04-241-0/+162
| | | | | | | | | | | | | | | | | | | | - Switch to using @sample keyword, fixing orphans. Upstream note on "6.6.1" [1]: OpenSSH 6.5 and 6.6 sometimes encode a value used in the curve25519 key exchange incorrectly, causing connection failures about 0.2% of the time when this method is used against a peer that implements the method properly. Fix the problem and disable the curve25519 KEX when speaking to OpenSSH 6.5 or 6.6. This version will identify itself as 6.6.1 to enable the compatability code. [1] https://lists.mindrot.org/pipermail/openssh-unix-dev/2014-April/032494.html Notes: svn path=/head/; revision=351982
* - Update to 6.6Bryan Drewery2014-03-162-20/+3
| | | | | | | | | | - Capsicum patch no longer needed - Update X509 patch to 7.9 Changelog: http://www.openssh.org/txt/release-6.6 Notes: svn path=/head/; revision=348420
* - Fix RC scriptBryan Drewery2014-02-051-1/+1
| | | | | | | | Pointyhat to: bdrewery Reported by: Kenta S. <kentas@hush.com> Notes: svn path=/head/; revision=342628
* - Update to 6.5Bryan Drewery2014-02-057-28/+65
| | | | | | | | | | | | | | | | | | | | ChangeLog: http://www.openssh.org/txt/release-6.5 - Update X509 patch to 7.8 - Update LIB_DEPENDS to new format - Revert r328706 and re-enable privilege separation sandboxing by default as the issue causing crashes has been fixed upstream - capsicum(4) is now enabled upstream. A local patch is added to fix an issue with it [1] - KERB_GSSAPI is marked BROKEN. It does not build. This patch lacks an upstream and I have no way to test it. It needs a non-trivial amount of refactoring for 6.5 as the key handling API has changed quite a bit. Submitted by: pjd@ [1] Notes: svn path=/head/; revision=342618
* - Update to 6.3p1Bryan Drewery2013-10-135-12/+227
| | | | | | | | | | | | | | | | | | | | | Changelog: http://www.openssh.org/txt/release-6.3 - Use options helpers where possible - Use upstream patch mirror for x509 and HPN - Update HPN patch to v14 and use upstream version - Add option NONECIPHER to allow disabling NONE in HPN patch - Update x509 patch from 7.4.1 to 7.6 - Add support for LDNS and enable by it and VerifyHostKeyDNS/SSHFP by default. See http://lists.freebsd.org/pipermail/freebsd-security/2013-September/007180.html which describes this change, but is supported on releases before 10 as well with LDNS option. - Update SCTP to patchlevel 2329 - Update recommendation on secure usage of SSH - Add pkg-message warning about ECDSA key possibly being incorrect due to previously being written as DSA by the rc script and fixed in r299902 in 2012 Notes: svn path=/head/; revision=330200
* Cleanup patch-readconf.c to only have 1 diffBryan Drewery2013-10-031-17/+17
| | | | Notes: svn path=/head/; revision=329185
* - Copy base r251088 over (which removes a patch) and disable default sandboxBryan Drewery2013-09-293-19/+1
| | | | | | | | | | | privilege separation as it causes crashes when using AES crypto devices. This now uses 'yes' for UsePrivilegeSeparation instead of 'sandbox' by default Reminded by: Garrett Wollman Notes: svn path=/head/; revision=328706
* - In rc script, be consistent in reload and check for and generate keysBryan Drewery2013-06-221-1/+1
| | | | | | | | | if needed, as well as checking for port collision with base sshd. Reported by: delphij Notes: svn path=/head/; revision=321578
* - Fix sshd crash when not using HPNBryan Drewery2013-05-231-4/+12
| | | | | | | | | | | | | | This was due to not including the canohost.h header for our base customization to respect class login restrictions. I had missed this as I was only tested with the default (HPN enabled) which already was including this header. Reported by: runelind in ##freenode Tested by: runelind, myself Reported by: Krzysztof Stryjek Notes: svn path=/head/; revision=318808
* - Update to 6.2p2Bryan Drewery2013-05-1713-231/+331
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - The LPK patch has been updated but is obsolete, deprecated and untested. It has been replaced by AuthorizedKeysCommand - The upstream HPN's last update was for 6.1 and is mostly abandoned. The patch has had bugs since 5.9. I have reworked it and split into into HPN and AES_THREADED options. The debugging/logging part of the patch is incomplete. I may change the patch to more closely match our base version eventually. - The KERB_GSSAPI option has been removed as the patch has not been updated by upstream since 5.7 - sshd VersionAddendum is currently not working as intended; it will be fixed later to allow removing the port/pkg version. - Update our patchset to match latest base version - Bring in ssh-agent -x support from base - I incrementally updated the port from 5.8 up to 6.2p2 along with patches. You can find all of the versions at https://github.com/bdrewery/openssh Changes: http://www.openssh.com/txt/release-5.9 http://www.openssh.org/txt/release-6.0 http://www.openssh.org/txt/release-6.1 http://www.openssh.org/txt/release-6.2 http://www.openssh.org/txt/release-6.2p2 Notes: svn path=/head/; revision=318400
* - Bring in r199804 and r206397 from base to avoid killing sshd inBryan Drewery2013-05-171-0/+43
| | | | | | | high-pressure swapping environments Notes: svn path=/head/; revision=318392
* - Remove copyright as it was a base customization that was removed inBryan Drewery2013-05-171-25/+0
| | | | | | | base r213250 Notes: svn path=/head/; revision=318390
* - Remove CHROOT option and patch. ChrootDirectory was added in 5.0Bryan Drewery2013-05-171-29/+3
| | | | | | | to achieve the same thing. Notes: svn path=/head/; revision=318386
* - Remove compatibiliy for FreeBSD <4.xBryan Drewery2013-04-1719-1922/+146
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | * /var/empty has been in hier(7) since 4.x * User sshd has been in base since 4.x * Simplify a patch for realhostname_sa(3) usage - Remove SUID_SSH - It was removed from ssh in 2002 - Fix 'make test' - Add some hints into the patches on where they came from - Mirror all patches - Move LPK patch out of files/ - Remove the need for 2 patches * Removal of 'host-key check-config' in install phase * Adding -lutil - Add SCTP support [1] - Remove FILECONTROL as it has not been supported since the 5.8 update - Replace tab with space pkg-descr - Remove default WRKSRC - Add 'configtest' command to rc script - Mark X509 broken with other patches due to PATCH_DIST_STRIP=-p1 PR: ports/174570 [1] Submitted by: oleg <proler@gmail.com> [1] Obtained from: https://bugzilla.mindrot.org/show_bug.cgi?id=2016 (upstream) [1] Feature safe: yes Notes: svn path=/head/; revision=315920
* - Fix all cases of 'No newline at end of file' in ports treeAlex Kozlov2013-02-011-1/+1
| | | | | | | Approved by: portmgr (bapt) Notes: svn path=/head/; revision=311381
* Add KEYWORD: shutdownDoug Barton2012-06-241-58/+53
| | | | | | | | Simplify some code Fix an error message Notes: svn path=/head/; revision=299909
* - Fix ECDSA key generation in openssh rc.d scriptSunpoet Po-Chuan Hsieh2012-06-241-1/+1
| | | | | | | | | - Bump PORTREVISION for package change Submitted by: J. Hellenthal <jhellenthal@dataix.net> Notes: svn path=/head/; revision=299902
* In the rc.d scripts, change assignments to rcvar to use theDoug Barton2012-01-141-1/+1
| | | | | | | | | | | | | | literal name_enable wherever possible, and ${name}_enable when it's not, to prepare for the demise of set_rcvar(). In cases where I had to hand-edit unusual instances also modify formatting slightly to be more uniform (and in some cases, correct). This includes adding some $FreeBSD$ tags, and most importantly moving rcvar= to right after name= so it's clear that one is derived from the other. Notes: svn path=/head/; revision=289156
* - update to 5.8p2 [1]Florian Smeets2011-10-2131-5542/+787
| | | | | | | | | | | | | | | | | | | - fix Kerberos knob [2] - fix build on 9.0 [3] - fix deinstall with various knobs [4] - fix LPK knob [5] PR: ports/161818 [1], ports/144597 [2], ports/160389 [3] ports/150493, ports/156926 [4], ports/155456 [5] Submitted by: "Grzegorz Blach" <magik@roorback.net> [1], [2], [4], [5] pluknet [3] Reported by: Jonathan <lordsith49@hotmail.com> [2] Kevin Thompson <antiduh@csh.rit.edu> [4] Alexey Remizov <alexey@remizov.org> [5] Notes: svn path=/head/; revision=284070
* - Add VersionAddendum support.Stephen Montgomery-Smith2011-07-1311-30/+233
| | | | | | | | | | | - Bump portrevision. PR: ports/142824 Submitted by: Scot Hetzel <swhetzel@gmail.com> Approved by: gabor (mentor) Notes: svn path=/head/; revision=277657
* Remove OpenSC support. This port should be updated to support PKCS#11.Alex Dupre2010-12-271-134/+0
| | | | Notes: svn path=/head/; revision=266965
* Add the sftpfilecontrol patch as an OPTION (WITH_FILECONTROL)Philip M. Gollucci2010-08-311-0/+488
| | | | | | | | | | See http://sftpfilecontrol.sourceforge.net/ for details. PR: ports/146338 Submitted by: Steve Wills <steve@mouf.net> Notes: svn path=/head/; revision=260249
* Begin the process of deprecating sysutils/rc_subr byDoug Barton2010-03-271-1/+1
| | | | | | | s#. %%RC_SUBR%%#. /etc/rc.subr# Notes: svn path=/head/; revision=251553
* - Unbreak KERBEROS optionPav Lucistnik2009-09-181-1/+61
| | | | | | | | | | | | - Add option for OpenBSD support - Fix crash in sftp listing PR: ports/138409 (cumulative patch) Submitted by: Denis Barov <dindin@dindin.ru> (maintainer) Feature safe: yes Notes: svn path=/head/; revision=241653
* - security/openssh-portable: update HPN and LPK patches to newer versionsPhilip M. Gollucci2009-06-217-1132/+2684
| | | | | | | | | | - still broken on -CURRENT PR: ports/135407 Submitted by: Denis Barov <dindin@dindin.ru> (maintainer) Notes: svn path=/head/; revision=236442
* Fix HPN crash issue by using aes128-ctr, aes192-ctr and aes256-ctr.Norikatsu Shigemura2009-05-171-3/+3
| | | | | | | Approved by: pav Notes: svn path=/head/; revision=234048
* - Update to 5.2p1Pav Lucistnik2009-05-155-236/+2713
| | | | | | | | | | - Assign maintainership to the submitter PR: ports/134160 Submitted by: Denis Barov <dindin@dindin.ru> Notes: svn path=/head/; revision=233924
* - Add vendor patch for lpk patch that fixes runtime on amd64Pav Lucistnik2009-03-241-0/+44
| | | | | | | | | PR: ports/129092 Submitted by: Jui-Nan Lin <jnlin@csie.nctu.edu.tw> Approved by: maintainer timeout (mnag; 4 months) Notes: svn path=/head/; revision=230883
* - Update to 5.1p1Pav Lucistnik2009-03-242-37/+29
| | | | | | | | | PR: ports/128679 Submitted by: Sunpoet Po-Chuan Hsieh <sunpoet@sunpoet.net> Approved by: maintainer timeout (mnag; 4 months) Notes: svn path=/head/; revision=230882
* - Update to 5.0p1Marcus Alves Grando2008-04-193-31/+1894
| | | | | | | | | | | | | | | | | - Port LPK patch to 5.0p1 and add to files dir - Remove USE_PERL_BUILD since doesn't need [1] - Update KERB_GSSAPI to 5.0p1 - Update HPN patch to 5.0p1 13v3 - Respect LOCALBASE on configure_args of LPK [2] - Change MASTER_SITE of snapshot - portlint(1) PR: 121826 [2] Submitted by: Andrew Kolchoogin <andrew___rinet.ru> [2] Reported by: Björn König <bkoenig___alpha-tierchen.d [1] Notes: svn path=/head/; revision=211576
generated by cgit v1.2.3 (git 2.25.1) at 2025-02-26 22:35:45 +0000