summaryrefslogtreecommitdiff
path: root/usr.bin/ssh
AgeCommit message (Collapse)Author
2018-08-13revert compat.[ch] section of the following change. It causesDamien Miller
double-free under some circumstances. -- date: 2018/07/31 03:07:24; author: djm; state: Exp; lines: +33 -18; commitid: f7g4UI8eeOXReTPh; fix some memory leaks spotted by Coverity via Jakub Jelen in bz#2366 feedback and ok dtucker@
2018-08-12better diagnosics on alg list assembly errors; ok deraadt@ markus@Damien Miller
2018-08-10improveDamien Miller
2018-08-10Describe pubkey format, prompted by bz#2853Damien Miller
While I'm here, describe and link to the remaining local PROTOCOL.* docs that weren't already mentioned (PROTOCOL.key, PROTOCOL.krl and PROTOCOL.mux)
2018-08-10fix numberingDamien Miller
2018-08-08Use new private key format by default. This format is suported byDamien Miller
OpenSSH >= 6.5 (released January 2014), so it should be supported by most OpenSSH versions in active use. It is possible to convert new-format private keys to the older format using "ssh-keygen -f /path/key -pm PEM". ok deraadt dtucker
2018-08-04invalidate dh->priv_key after freeing it in error path; avoidsDamien Miller
unlikely double-free later. Reported by Viktor Dukhovni via https://github.com/openssh/openssh-portable/pull/96 feedback jsing@ tb@
2018-07-31delay bailout for invalid authenticating user until after the packetDamien Miller
containing the request has been fully parsed. Reported by Dariusz Tytko and Michał Sajdak; ok deraadt
2018-07-31fix some memory leaks spotted by Coverity via Jakub Jelen in bz#2366Damien Miller
feedback and ok dtucker@
2018-07-27avoid expensive channel_open_message() calls; ok djm@Markus Friedl
2018-07-27Now that ssh can't be setuid, remove the original_real_uid andDarren Tucker
original_effective_uid globals and replace with calls to plain getuid(). ok djm@
2018-07-27Remove uid checks from low port binds. Now that ssh cannot beDarren Tucker
setuid and sshd always has privsep on, we can remove the uid checks for low port binds and just let the system do the check. We leave a sanity check for the !privsep case so long as the code is stil there. with & ok djm@
2018-07-27ssh(1) no longer supports being setuid root. Remove reference to crc32Darren Tucker
which went with protocol 1. Pointed out by deraadt@.
2018-07-25Don't redefine Makefile choices which come correct from bsd.*.mkTheo de Raadt
ok markus
2018-07-25fix indent; Clemens GoessnitzerTheo de Raadt
2018-07-25Use the caller provided (copied) pwent struct in load_public_identity_filesBob Beck
instead of calling getpwuid() again and discarding the argument. This prevents a client crash where tilde_expand_filename calls getpwuid() again before the pwent pointer is used. Issue noticed and reported by Pierre-Olivier Martel <pom@apple.com> ok djm@ deraadt@
2018-07-23oops, failed to notice that SEE ALSO got messed up;Jason McIntyre
2018-07-23Point to glob in section 7 for the actual list of special characters insteadkn
the C API in section 3. OK millert jmc nicm, "the right idea" deraadt
2018-07-22Switch authorized_keys example from ssh-dss to ssh-rsa since the formerDarren Tucker
is no longer enabled by default. Pointed out by Daniel A. Maierhofer, ok jmc
2018-07-20slightly-clearer description for AuthenticationMethods - the listsDamien Miller
have comma-separated elements; bz#2663 from Hans Meier
2018-07-20remove unused zlib.hDamien Miller
2018-07-19Fix typo in comment. From Alexandru Iacob via github.Darren Tucker
2018-07-19Deprecate UsePrivilegedPort now that support for running ssh(1)Darren Tucker
setuid has been removed, remove supporting code and clean up references to it in the man pages We have not shipped ssh(1) the setuid bit since 2002. If ayone really needs to make connections from a low port number this can be implemented via a small setuid ProxyCommand. ok markus@ jmc@ djm@
2018-07-18Remove support for running ssh(1) setuid and fatal if attempted.Darren Tucker
Do not link uidwap.c into ssh any more. Neuters UsePrivilegedPort, which will be marked as deprecated shortly. ok markus@ djm@
2018-07-16Slot 0 in the hostbased key array was previously RSA1, but that isDarren Tucker
now gone and the slot is unused so remove it. Remove two now-unused macros, and add an array bounds check to the two remaining ones (array is statically sized, so mostly a safety check on future changes). ok markus@
2018-07-16Remove support for loading HostBasedAuthentication keys directly inDarren Tucker
ssh(1) and always use ssh-keysign. This removes one of the few remaining reasons why ssh(1) might be setuid. ok markus@
2018-07-16keep options.identity_file_userprovided array in sync when we loadDamien Miller
keys, fixing some spurious error messages; ok markus
2018-07-16memleaks; found by valgrindDamien Miller
2018-07-12remove prototype to long-gone functionDamien Miller
2018-07-11treat ssh_packet_write_wait() errors as fatal; ok djm@Markus Friedl
2018-07-11remove legacy key emulation layer; ok djm@Markus Friedl
2018-07-11s/wuth/with/ in commentMartijn van Duren
2018-07-10re-remove some pre-auth compression bitsStefan Fritsch
This time, make sure to not remove things that are necessary for pre-auth compression on the client. Add a comment that pre-auth compression is still supported in the client. ok markus@
2018-07-10kerberos/gssapi fixes for buffer removalDamien Miller
2018-07-10buffer.[ch] and bufaux.c are no moreDamien Miller
2018-07-10one mention of Buffer that almost got away :)Damien Miller
2018-07-09replace cast with call to sshbuf_mutable_ptr(); ok djm@Markus Friedl
2018-07-09remove legacy buffer API emulation layer; ok djm@Markus Friedl
2018-07-09sshd: switch monitor to sshbuf API; lots of help & ok djm@Markus Friedl
2018-07-09sshd: switch GSSAPI to sshbuf API; ok djm@Markus Friedl
2018-07-09sshd: switch authentication to sshbuf API; ok djm@Markus Friedl
2018-07-09sshd: switch config to sshbuf API; ok djm@Markus Friedl
2018-07-09sshd: switch loginmsg to sshbuf API; ok djm@Markus Friedl
2018-07-09ttymodes: switch to sshbuf API; ok djm@Markus Friedl
2018-07-09client: switch mux to sshbuf API; with & ok djm@Markus Friedl
2018-07-09client: switch to sshbuf API; ok djm@Markus Friedl
2018-07-09pkcs11: switch to sshbuf API; ok djm@Markus Friedl
2018-07-09Revert previous two commitsStefan Fritsch
It turns out we still support pre-auth compression on the client. Therefore revert the previous two commits: date: 2018/07/06 09:06:14; author: sf; commitid: yZVYKIRtUZWD9CmE; Rename COMP_DELAYED to COMP_ZLIB Only delayed compression is supported nowadays. ok markus@ date: 2018/07/06 09:05:01; author: sf; commitid: rEGuT5UgI9f6kddP; Remove leftovers from pre-authentication compression Support for this has been removed in 2016. COMP_DELAYED will be renamed in a later commit. ok markus@
2018-07-06Rename COMP_DELAYED to COMP_ZLIBStefan Fritsch
Only delayed compression is supported nowadays. ok markus@
2018-07-06Remove leftovers from pre-authentication compressionStefan Fritsch
Support for this has been removed in 2016. COMP_DELAYED will be renamed in a later commit. ok markus@
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-24 20:38:39 +0000