don't include port number in tcpip-forward replies for
requests that don't allocate a port; bz#2509 diagnosed by Ron Frederick ok
markus
Upstream-ID: 77efad818addb61ec638b5a2362f1554e21a970a
ban ConnectionAttempts=0, it makes no sense and would cause
ssh_connect_direct() to print an uninitialised stack variable; bz#2500
reported by dvw AT phas.ubc.ca
Upstream-ID: 32b5134c608270583a90b93a07b3feb3cbd5f7d5
Allow fingerprinting from standard input "ssh-keygen -lf
-"
Support fingerprinting multiple plain keys in a file and authorized_keys
files too (bz#1319)
ok markus@
Upstream-ID: 903f8b4502929d6ccf53509e4e07eae084574b77
always call privsep_preauth_child() regardless of whether
sshd was started by root; it does important priming before sandboxing and
failing to call it could result in sandbox violations later; ok markus@
Upstream-ID: c8a6d0d56c42f3faab38460dc917ca0d1705d383
1) Use xcalloc() instead of xmalloc() to check for
potential overflow. (Feedback from both mmcc@ and djm@) 2) move set_size
just before the for loop. (suggested by djm@)
OK djm@
Upstream-ID: 013534c308187284756c3141f11d2c0f33c47213
Add a new authorized_keys option "restrict" that
includes all current and future key restrictions (no-*-forwarding, etc). Also
add permissive versions of the existing restrictions, e.g. "no-pty" -> "pty".
This simplifies the task of setting up restricted keys and ensures they are
maximally-restricted, regardless of any permissions we might implement in the
future.
Example:
restrict,pty,command="nethack" ssh-ed25519 AAAAC3NzaC1lZDI1...
Idea from Jann Horn; ok markus@
Upstream-ID: 04ceb9d448e46e67e13887a7ae5ea45b4f1719d0
Add an AddKeysToAgent client option which can be set to
'yes', 'no', 'ask', or 'confirm', and defaults to 'no'. When enabled, a
private key that is used during authentication will be added to ssh-agent if
it is running (with confirmation enabled if set to 'confirm').
Initial version from Joachim Schipper many years ago.
ok markus@
Upstream-ID: a680db2248e8064ec55f8be72d539458c987d5f4
Support "none" as an argument for sshd_config
ForceCommand and ChrootDirectory. Useful inside Match blocks to override a
global default. bz#2486 ok dtucker@
Upstream-ID: 7ef478d6592bc7db5c7376fc33b4443e63dccfa5
support multiple certificates (one per line) and
reading from standard input (using "-f -") for "ssh-keygen -L"; ok dtucker@
Upstream-ID: ecbadeeef3926e5be6281689b7250a32a80e88db
fix OOB read in packet code caused by missing return
statement found by Ben Hawkes; ok markus@ deraadt@
Upstream-ID: a3e3a85434ebfa0690d4879091959591f30efc62
1. rlogin and rsh are long gone 2. protocol version isn't
of core relevance here, and v1 is going away
ok markus@, deraadt@
Upstream-ID: 8b46bc94cf1ca7c8c1a75b1c958b2bb38d7579c8
"commandline" -> "command line", since there are so few
examples of the former in the pages, so many of the latter, and in some of
these pages we had multiple spellings;
prompted by tj
Upstream-ID: 78459d59bff74223f8139d9001ccd56fc4310659
Fix typo certopt->certopts in shell variable. This would
cause the test to hang at a host key prompt if you have an A or CNAME for
"proxy" in your local domain.
Upstream-Regress-ID: 6ea03bcd39443a83c89e2c5606392ceb9585836a
log certificate serial in verbose() messages to match the
main auth success/fail message; ok dtucker@
Upstream-ID: dfc48b417c320b97c36ff351d303c142f2186288
Expand tildes in filenames passed to -i before checking
whether or not the identity file exists. This means that if the shell
doesn't do the expansion (eg because the option and filename were given as a
single argument) then we'll still add the key. bz#2481, ok markus@
Upstream-ID: db1757178a14ac519e9a3e1a2dbd21113cb3bfc6
Do not prepend "exec" to the shell command run by "Match
exec" in a config file. It's an unnecessary optimization from repurposed
ProxyCommand code and prevents some things working with some shells.
bz#2471, pointed out by res at qoxp.net. ok markus@
Upstream-ID: a1ead25ae336bfa15fb58d8c6b5589f85b4c33a3
Move glob.h from includes.h to the only caller (sftp) and override the
names for the symbols. This prevents name collisions with the system glob
in the case where something other than ssh uses it (eg kerberos). With
jjelen at redhat.com, ok djm@
