aboutsummaryrefslogtreecommitdiff
path: root/secure/usr.bin
Commit message (Collapse)AuthorAgeFilesLines
* ssh: update to OpenSSH 9.1p1Ed Maste2022-10-311-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Release notes are available at https://www.openssh.com/txt/release-9.1 9.1 contains fixes for three minor memory safety problems; these have lready been merged to the copy of OpenSSH 9.0 that is in the FreeBSD base system. Some highlights copied from the release notes: Potentially-incompatible changes -------------------------------- * ssh(1), sshd(8): SetEnv directives in ssh_config and sshd_config are now first-match-wins to match other directives. Previously if an environment variable was multiply specified the last set value would have been used. bz3438 * ssh-keygen(8): ssh-keygen -A (generate all default host key types) will no longer generate DSA keys, as these are insecure and have not been used by default for some years. New features ------------ * ssh(1), sshd(8): add a RequiredRSASize directive to set a minimum RSA key length. Keys below this length will be ignored for user authentication and for host authentication in sshd(8). * sftp-server(8): add a "users-groups-by-id@openssh.com" extension request that allows the client to obtain user/group names that correspond to a set of uids/gids. * sftp(1): use "users-groups-by-id@openssh.com" sftp-server extension (when available) to fill in user/group names for directory listings. * sftp-server(8): support the "home-directory" extension request defined in draft-ietf-secsh-filexfer-extensions-00. This overlaps a bit with the existing "expand-path@openssh.com", but some other clients support it. * ssh-keygen(1), sshd(8): allow certificate validity intervals, sshsig verification times and authorized_keys expiry-time options to accept dates in the UTC time zone in addition to the default of interpreting them in the system time zone. YYYYMMDD and YYMMDDHHMM[SS] dates/times will be interpreted as UTC if suffixed with a 'Z' character. Also allow certificate validity intervals to be specified in raw seconds-since-epoch as hex value, e.g. -V 0x1234:0x4567890. This is intended for use by regress tests and other tools that call ssh-keygen as part of a CA workflow. bz3468 * sftp(1): allow arguments to the sftp -D option, e.g. sftp -D "/usr/libexec/sftp-server -el debug3" * ssh-keygen(1): allow the existing -U (use agent) flag to work with "-Y sign" operations, where it will be interpreted to require that the private keys is hosted in an agent; bz3429 MFC after: 2 weeks Relnotes: Yes Sponsored by: The FreeBSD Foundation (cherry picked from commit 38a52bd3b5cac3da6f7f6eef3dd050e6aa08ebb3) (cherry picked from commit ac5c465b9fdff74d1a73f63d157820887ff1787f) (cherry picked from commit 4aee71578a60981de9296451b7a995b180ae23db) Approved by: re (gjb)
* OpenSSL: Regen manual pages for OpenSSL 1.1.1qJung-uk Kim2022-07-0549-49/+49
| | | | (cherry picked from commit 25fb2515923796b329329b5c1c17d200ff416e84)
* OpenSSL: Regen manual pages for OpenSSL 1.1.1pJung-uk Kim2022-06-2149-98/+98
|
* OpenSSL: Regen manual pages for OpenSSL 1.1.1oJung-uk Kim2022-05-0349-49/+49
|
* OpenSSL: Merge OpenSSL 1.1.1nJung-uk Kim2022-03-1649-50/+53
| | | | | (cherry picked from commit 5ac766ab8ec23e780f108b7903d46e553d5e39d1) (cherry picked from commit 97fe61d5bfdee2adc4d6ffb9b65a0cfb5bc5d317)
* openssh: update to OpenSSH v8.7p1Ed Maste2022-02-113-3/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some notable changes, from upstream's release notes: - sshd(8): Remove support for obsolete "host/port" syntax. - ssh(1): When prompting whether to record a new host key, accept the key fingerprint as a synonym for "yes". - ssh-keygen(1): when acting as a CA and signing certificates with an RSA key, default to using the rsa-sha2-512 signature algorithm. - ssh(1), sshd(8), ssh-keygen(1): this release removes the "ssh-rsa" (RSA/SHA1) algorithm from those accepted for certificate signatures. - ssh-sk-helper(8): this is a new binary. It is used by the FIDO/U2F support to provide address-space isolation for token middleware libraries (including the internal one). - ssh(1): this release enables UpdateHostkeys by default subject to some conservative preconditions. - scp(1): this release changes the behaviour of remote to remote copies (e.g. "scp host-a:/path host-b:") to transfer through the local host by default. - scp(1): experimental support for transfers using the SFTP protocol as a replacement for the venerable SCP/RCP protocol that it has traditionally used. Additional integration work is needed to support FIDO/U2F in the base system. Deprecation Notice ------------------ OpenSSH will disable the ssh-rsa signature scheme by default in the next release. Reviewed by: imp MFC after: 1 month Relnotes: Yes Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D29985 (cherry picked from commit 19261079b74319502c6ffa1249920079f0f69a72) (cherry picked from commit f448c3ed4ae1281861913a56377f9d93d49f8e8e) (cherry picked from commit 1f290c707a19d1695c303e6c8ead9cc414ccc6dc) (cherry picked from commit 0f9bafdfc325779e4ecc5154d5bb06c752297138) (cherry picked from commit adb56e58e8db84d8087ebe3d3e7def0074cb5a90) (cherry picked from commit 576b58108c1723c85e4dd00355e29bfe301dab11) (cherry picked from commit 1c99af1ebe61cbaf633792941640dcd254acf921) (cherry picked from commit 87152f34054921632016bc5eb4ab9f836fbaa522) (cherry picked from commit 172fa4aa7577915bf5ace5783251821d3774dc05) (cherry picked from commit 317a38ab65334cbd24bd020b20b11041423d142f)
* OpenSSL: Merge OpenSSL 1.1.1mJung-uk Kim2021-12-1449-52/+61
|
* Revert "Add workaround for a QoS-related bug in VMWare Workstation."Ed Maste2021-12-121-3/+0
| | | | | | | | | | | | | | | | | | This reverts commit 77c2fe20df6a9a7c1a353e1a4ab2ba80fefab881. The VMware Workstation issue was fixed in 2019[1], and we'd rather not carry unnecessary local changes in OpenSSH. [1] https://communities.vmware.com/t5/VMware-Workstation-Pro/Regression-ssh-results-in-broken-pipe-upon-connecting-in-Vmware/m-p/486105/highlight/true#M25470 PR: 234426 Discussed with: yuripv Approved by: des MFC after: 2 weeks Sponsored by: The FreeBSD Foundation (cherry picked from commit d55bf492f8f587e4a99f4dcb39a96159b4431782) (cherry picked from commit 6fd4891545c2a6d06dbc1927b2e0b375cd2b0b17)
* ssh: move common Makefile boilerplate to a new ssh.mkEd Maste2021-11-087-15/+7
| | | | | | | | | | | | This moves SSHDIR and ssh_namespace.h handling to a common location, and will simplify future work such as adding U2F support (D32509). Reviewed by: kevans MFC after: 1 week Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D32808 (cherry picked from commit 9d63429fa16352f58037ac2aa6ddc734b25e8331)
* OpenSSL: Regen manual pages for 1.1.1lJung-uk Kim2021-09-0349-102/+102
|
* OpenSSL: Regen manual pages for 1.1.1kJung-uk Kim2021-03-2549-49/+49
| | | | (cherry picked from commit 7595394130a163b7ff53d9ef3f28fcb87f629d17)
* OpenSSL: Regen assembly files and manual pages for OpenSSL 1.1.1jJung-uk Kim2021-02-1750-155/+155
|
* Merge OpenSSL 1.1.1i.Jung-uk Kim2020-12-1447-98/+102
| | | | | | | | Note this is a direct commit because assembly code was moved to a new place on head. Notes: svn path=/stable/12/; revision=368639
* MFC: r366004Jung-uk Kim2020-09-2549-195/+197
| | | | | | | Merge OpenSSL 1.1.1h. Notes: svn path=/stable/12/; revision=366176
* MFC: r360175Jung-uk Kim2020-04-2449-51/+51
| | | | | | | Merge OpenSSL 1.1.1g. Notes: svn path=/stable/12/; revision=360278
* MFC: r359486Jung-uk Kim2020-04-0349-49/+49
| | | | | | | | | Merge OpenSSL 1.1.1f. PR: 245073 Notes: svn path=/stable/12/; revision=359607
* MFC: r359060, r359061, r359066Jung-uk Kim2020-03-2049-121/+167
| | | | | | | Merge OpenSSL 1.1.1e. Notes: svn path=/stable/12/; revision=359186
* MFC r345579 by des: Add workaround for a QoS-related bug in VMWare WorkstationEd Maste2020-03-081-0/+3
| | | | | | | Submitted by: yuripv Notes: svn path=/stable/12/; revision=358773
* Add Makefile.depend.optionsSimon J. Gerraty2019-12-192-2/+8
| | | | | | | | | | | | | | | | | | | | | | | Leaf directories that have dependencies impacted by options need a Makefile.depend.options file to avoid churn in Makefile.depend DIRDEPS for cases such as OPENSSL, TCP_WRAPPERS etc can be set in local.dirdeps-options.mk which can add to those set in Makefile.depend.options See share/mk/dirdeps-options.mk Also update affected Makefile.depend files. MFC of r355616 and r355617 Reviewed by: bdrewery Sponsored by: Juniper Networks Differential Revision: https://reviews.freebsd.org/D22469 Notes: svn path=/stable/12/; revision=355906
* MFC: r352191Jung-uk Kim2019-09-1049-110/+111
| | | | | | | Merge OpenSSL 1.1.1d. Notes: svn path=/stable/12/; revision=352192
* MFC: r348340Jung-uk Kim2019-05-2849-69/+69
| | | | | | | Merge OpenSSL 1.1.1c. Notes: svn path=/stable/12/; revision=348341
* MFC: r344602Jung-uk Kim2019-02-2649-678/+898
| | | | | | | Merge OpenSSL 1.1.1b. Notes: svn path=/stable/12/; revision=344603
* MFC: r340703Jung-uk Kim2018-11-2049-106/+167
| | | | | | | Merge OpenSSL 1.1.1a. Notes: svn path=/stable/12/; revision=340705
* MFH r338661 through r339200.Glen Barber2018-10-051-0/+2
|\ | | | | | | | | | | | | Sponsored by: The FreeBSD Foundation Notes: svn path=/projects/openssl111/; revision=339201
| * Move the openssl.cnf install to secure/usr.bin/openssl/Brad Davis2018-09-201-0/+2
| | | | | | | | | | | | | | | | | | | | This leverages CONFS to do the install Approved by: re (pkgbase, blanket), bapt (mentor) Differential Revision: https://reviews.freebsd.org/D17245 Notes: svn path=/head/; revision=338825
* | Remove MD dirdeps from Makefile.depend.Jung-uk Kim2018-09-251-1/+0
| | | | | | | | | | | | | | It can't be right. :-( Notes: svn path=/projects/openssl111/; revision=338936
* | Regen Makefile.depend.Jung-uk Kim2018-09-251-0/+1
| | | | | | | | Notes: svn path=/projects/openssl111/; revision=338933
* | Remove pthread from LIBADD for openssl(1).Jung-uk Kim2018-09-201-1/+1
| | | | | | | | | | | | | | libcrypto is linked with pthread since r338816. Notes: svn path=/projects/openssl111/; revision=338848
* | Build openssl(1).Jung-uk Kim2018-09-191-9/+10
| | | | | | | | Notes: svn path=/projects/openssl111/; revision=338768
* | Regen manual pages.Jung-uk Kim2018-09-1351-3100/+5820
|/ | | | | | | Note the manual pages are not automatically generated for now. Notes: svn path=/projects/openssl111/; revision=338671
* Move ssh config file handling into the ssh Makefiles.Brad Davis2018-08-151-0/+2
| | | | | | | | | | This helps with pkgbase by using CONFS and tagging these as config files. Approved by: allanjude (mentor), des Differential Revision: https://reviews.freebsd.org/D16678 Notes: svn path=/head/; revision=337852
* Merge OpenSSL 1.0.2p.Jung-uk Kim2018-08-1445-185/+256
| | | | Notes: svn path=/head/; revision=337791
* Upgrade to OpenSSH 7.6p1. This will be followed shortly by 7.7p1.Dag-Erling Smørgrav2018-05-081-1/+1
| | | | | | | | | This completely removes client-side support for the SSH 1 protocol, which was already disabled in 12 but is still enabled in 11. For that reason, we will not be able to merge 7.6p1 or newer back to 11. Notes: svn path=/head/; revision=333389
* Merge OpenSSL 1.0.2o.Jung-uk Kim2018-03-2745-66/+60
| | | | Notes: svn path=/head/; revision=331627
* Remove c_rehash(1) to not confuse users. We do not install the Perl script.Jung-uk Kim2018-02-082-230/+0
| | | | | | | MFC after: 3 days Notes: svn path=/head/; revision=329024
* Merge OpenSSL 1.0.2n.Jung-uk Kim2017-12-0746-46/+46
| | | | Notes: svn path=/head/; revision=326662
* Merge OpenSSL 1.0.2m.Jung-uk Kim2017-11-0247-51/+134
| | | | Notes: svn path=/head/; revision=325328
* DIRDEPS_BUILD: Update dependencies.Bryan Drewery2017-10-318-8/+0
| | | | | | | Sponsored by: Dell EMC Isilon Notes: svn path=/head/; revision=325188
* Convert traditional ${MK_TESTS} conditional idiom for including testEnji Cooper2017-08-021-3/+1
| | | | | | | | | | | | | | directories to SUBDIR.${MK_TESTS} idiom This is being done to pave the way for future work (and homogenity) in ^/projects/make-check-sandbox . No functional change intended. MFC after: 1 weeks Notes: svn path=/head/; revision=321912
* Merge OpenSSL 1.0.2l.Jung-uk Kim2017-05-2547-59/+107
| | | | Notes: svn path=/head/; revision=318899
* Remove bdes(1)Allan Jude2017-02-066-4371/+1
| | | | | | | | | | | | | | | | | | The use of DES for anything is discouraged, especially with a static IV of 0 If you still need bdes(1) to decrypt Kirk's video lectures, see security/bdes in ports. This commit brought to you by the FOSDEM DevSummit and the "remove unneeded dependancies on openssl in base" working group Reviewed by: bapt, brnrd Relnotes: yes Sponsored by: FOSDEM DevSummit Differential Revision: https://reviews.freebsd.org/D9424 Notes: svn path=/head/; revision=313329
* Merge OpenSSL 1.0.2k.Jung-uk Kim2017-01-2646-644/+468
| | | | Notes: svn path=/head/; revision=312825
* Only bake krb5_config.h support in to ssh(3), etc if both MK_GSSAPI andEnji Cooper2017-01-021-1/+1
| | | | | | | | | | | | | | | MK_KERBEROS_SUPPORT != no This fixes the odd case where someone specified MK_GSSAPI=no and MK_KERBEROS_SUPPORT=yes (which admittedly, probably doesn't make sense, but the build system doesn't prevent this case today, and it didn't when I filed the bug back in 2011 either). MFC after: 2 weeks PR: 159745 Notes: svn path=/head/; revision=311140
* Merge OpenSSL 1.0.2j.Jung-uk Kim2016-09-2646-46/+46
| | | | Notes: svn path=/head/; revision=306342
* Merge OpenSSL 1.0.2i.Jung-uk Kim2016-09-2246-101/+121
| | | | Notes: svn path=/head/; revision=306193
* DIRDEPS_BUILD: Update dependencies.Bryan Drewery2016-08-311-2/+0
| | | | | | | Sponsored by: EMC / Isilon Storage Division Notes: svn path=/head/; revision=305146
* Merge ^/user/ngie/release-pkg-fix-tests to unbreak how test files are installedEnji Cooper2016-05-041-8/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | after r298107 Summary of changes: - Replace all instances of FILES/TESTS with ${PACKAGE}FILES. This ensures that namespacing is kept with FILES appropriately, and that this shouldn't need to be repeated if the namespace changes -- only the definition of PACKAGE needs to be changed - Allow PACKAGE to be overridden by callers instead of forcing it to always be `tests`. In the event we get to the point where things can be split up enough in the base system, it would make more sense to group the tests with the blocks they're a part of, e.g. byacc with byacc-tests, etc - Remove PACKAGE definitions where possible, i.e. where FILES wasn't used previously. - Remove unnecessary TESTSPACKAGE definitions; this has been elided into bsd.tests.mk - Remove unnecessary BINDIRs used previously with ${PACKAGE}FILES; ${PACKAGE}FILESDIR is now automatically defined in bsd.test.mk. - Fix installation of files under data/ subdirectories in lib/libc/tests/hash and lib/libc/tests/net/getaddrinfo - Remove unnecessary .include <bsd.own.mk>s (some opportunistic cleanup) Document the proposed changes in share/examples/tests/tests/... via examples so it's clear that ${PACKAGES}FILES is the suggested way forward in terms of replacing FILES. share/mk/bsd.README didn't seem like the appropriate method of communicating that info. MFC after: never probably X-MFC with: r298107 PR: 209114 Relnotes: yes Tested with: buildworld, installworld, checkworld; buildworld, packageworld Sponsored by: EMC / Isilon Storage Division Notes: svn path=/head/; revision=299094
* Merge OpenSSL 1.0.2h.Jung-uk Kim2016-05-0346-48/+48
| | | | | | | Relnotes: yes Notes: svn path=/head/; revision=298998
* Fix including Kyuafile in packaged base system.Glen Barber2016-04-291-1/+2
| | | | | | | | | | | | | | | Fix a related typo while here. Note, this change results in the Kyuafile inclusion in the runtime package, which needs to be fixed, however addresses the PR as far as I can tell in my tests. PR: 209114 Submitted by: ngie Sponsored by: The FreeBSD Foundation Notes: svn path=/head/; revision=298768
* MFHGlen Barber2016-03-147-28/+2
|\ | | | | | | | | | | | | Sponsored by: The FreeBSD Foundation Notes: svn path=/projects/release-pkg/; revision=296869
generated by cgit v1.3 (git 2.53.0) at 2026-04-17 22:48:59 +0000