summaryrefslogtreecommitdiff
path: root/usr.bin/ssh
AgeCommit message (Collapse)Author
2010-03-27tweak previous; ok dtuckerJason McIntyre
2010-03-26tweak previous;Jason McIntyre
2010-03-26allow buffer_get_int_ret/buffer_get_int64_ret to take a NULL pointerDamien Miller
argument to allow skipping past values in a buffer
2010-03-26Reformat default value of PreferredAuthentications entry (current formattingDarren Tucker
implies ", " is acceptable as a separator, which it's not. ok djm@
2010-03-26mention that -S none disables connection sharing; from Colin WatsonDamien Miller
2010-03-25from portable: getcwd(NULL, 0) doesn't work on all platforms, soDamien Miller
use a stack buffer; ok dtucker@
2010-03-16crank version to openssh-5.5 since we have a few fixes since 5.4;Damien Miller
requested deraadt@ kettenis@
2010-03-16spelling in error message. ok djm kettenisKevin Steves
2010-03-15also print certificate type (user or host) for ssh-keygen -LKevin Steves
ok djm kettenis
2010-03-13fix a formatting error (args need quoted); noted by steveskJason McIntyre
2010-03-13Certificates are named *-cert.pub, not *_cert.pub; committing a diffDamien Miller
from stevesk@ ok me
2010-03-13protocol conformance fix: send language tag when disconnecting normally;Damien Miller
spotted by 1.41421 AT gmail.com, ok markus@ deraadt@
2010-03-12do not prepend AuthorizedKeysFile with getcwd(), unbreaks relative pathsMarkus Friedl
free() (not xfree()) the buffer returned by getcwd()
2010-03-12unbreak AuthorizedKeys option with a $HOME-relative path; reported byDamien Miller
vinschen AT redhat.com, ok dtucker@
2010-03-10correct certificate logging and make it more consistent betweenDamien Miller
authorized_keys and TrustedCAKeys; ok markus@
2010-03-10typos; from Ross RichardsonJason McIntyre
closes prs 6334 and 6335
2010-03-08sort the list of constraints (to -O); ok djmJason McIntyre
2010-03-08document permit-agent-forwarding certificate constraint; patch fromDamien Miller
stevesk@
2010-03-07make internal strptime string match strftime format;Damien Miller
suggested by vinschen AT redhat.com and markus@
2010-03-07openssh-5.4Damien Miller
2010-03-07Hold authentication debug messages until after successful authentication.Darren Tucker
Fixes an info leak of environment variables specified in authorized_keys, reported by Jacob Appelbaum. ok djm@
2010-03-05mention loading of certificate files from [private]-cert.pub whenDamien Miller
they are present; feedback and ok jmc@
2010-03-05document certificate authentication; help/ok djmJason McIntyre
2010-03-05tweak previous;Jason McIntyre
2010-03-05make the warning for a revoked key louder and more noticableDamien Miller
2010-03-04"force-command" is not spelled "forced-command"; spotted byDamien Miller
imorgan AT nas.nasa.gov
2010-03-04move section on CA and revoked keys from ssh.1 to sshd.8's known hostsDamien Miller
format section and rework it a bit; requested by jmc@
2010-03-04missing word; spotted by jmc@Damien Miller
2010-03-04fix Bk/Ek;Jason McIntyre
2010-03-04Add a -L flag to print the contents of a certificate; ok markus@Damien Miller
2010-03-04tweak previous;Jason McIntyre
2010-03-04Add a TrustedUserCAKeys option to sshd_config to specify CA keys thatDamien Miller
are trusted to authenticate users (in addition than doing it per-user in authorized_keys). Add a RevokedKeys option to sshd_config and a @revoked marker to known_hosts to allow keys to me revoked and banned for user or host authentication. feedback and ok markus@
2010-03-04use buffer_get_string_ptr_ret() where we are checking the returnDamien Miller
value explicitly instead of the fatal()-causing buffer_get_string_ptr()
2010-03-03s/similar same/similar/; from imorgan AT nas.nasa.govDamien Miller
2010-03-03the authorized_keys option for CA keys is "cert-authority", notDamien Miller
"from=cert-authority". spotted by imorgan AT nas.nasa.gov
2010-03-03reject strings with embedded ASCII nul chars in certificate key IDs,Damien Miller
principal names and constraints
2010-03-02Add RCS IdentDamien Miller
2010-03-02POSIX strptime is stricter than OpenBSD's so do a little dance toDamien Miller
appease it.
2010-03-01zap what seems to be a left-over debug message; ok markus@Otto Moerbeek
2010-02-26tweak previous;Jason McIntyre
2010-02-26Add support for certificate key types for users and hosts.Damien Miller
OpenSSH certificate key types are not X.509 certificates, but a much simpler format that encodes a public key, identity information and some validity constraints and signs it with a CA key. CA keys are regular SSH keys. This certificate style avoids the attack surface of X.509 certificates and is very easy to deploy. Certified host keys allow automatic acceptance of new host keys when a CA certificate is marked as trusted in ~/.ssh/known_hosts. see VERIFYING HOST KEYS in ssh(1) for details. Certified user keys allow authentication of users when the signing CA key is marked as trusted in authorized_keys. See "AUTHORIZED_KEYS FILE FORMAT" in sshd(8) for details. Certificates are minted using ssh-keygen(1), documentation is in the "CERTIFICATES" section of that manpage. Documentation on the format of certificates is in the file PROTOCOL.certkeys feedback and ok markus@
2010-02-24Add $OpenBSD$ tags in comments, our portable-syncing scripts use theseDamien Miller
2010-02-21dlclose() call should also be #ifdef HAVE_DLOPENTheo de Raadt
2010-02-20unbreak build for NOPIC systems; noticed, help and ok deraadt@Markus Friedl
2010-02-19gcc2 requires decls before codeTheo de Raadt
2010-02-11correct commentDamien Miller
2010-02-11libarary -> library;Jason McIntyre
2010-02-10pkcs#11 is no longer optional; improve wording; ok jmc@Markus Friedl
2010-02-09enable PKCS#11 code; ok djmMarkus Friedl
2010-02-09fix whitespace; from jmc@Markus Friedl
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-29 08:04:09 +0000