Track upstream project rename in contrib/blocklistdUpstream is now https://github.com/zoulasc/blocklist/. Rename thecontrib directory and update Makefiles to match, in advance of the nextvendor
Track upstream project rename in contrib/blocklistdUpstream is now https://github.com/zoulasc/blocklist/. Rename thecontrib directory and update Makefiles to match, in advance of the nextvendor branch update.Sponsored by: The FreeBSD Foundation(cherry picked from commit 5f4c09dd85bff675e0ca63c55ea3c517e0fddfcc)
show more ...
Remove $FreeBSD$: one-line sh patternRemove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/
Update/fix Makefile.depend for userland
ssh: update to OpenSSH 9.1p1Release notes are available at https://www.openssh.com/txt/release-9.19.1 contains fixes for three minor memory safety problems; these havelready been merged to the c
ssh: update to OpenSSH 9.1p1Release notes are available at https://www.openssh.com/txt/release-9.19.1 contains fixes for three minor memory safety problems; these havelready been merged to the copy of OpenSSH 9.0 that is in the FreeBSD basesystem.Some highlights copied from the release notes:Potentially-incompatible changes-------------------------------- * ssh(1), sshd(8): SetEnv directives in ssh_config and sshd_config are now first-match-wins to match other directives. Previously if an environment variable was multiply specified the last set value would have been used. bz3438 * ssh-keygen(8): ssh-keygen -A (generate all default host key types) will no longer generate DSA keys, as these are insecure and have not been used by default for some years.New features------------ * ssh(1), sshd(8): add a RequiredRSASize directive to set a minimum RSA key length. Keys below this length will be ignored for user authentication and for host authentication in sshd(8). * sftp-server(8): add a "[email protected]" extension request that allows the client to obtain user/group names that correspond to a set of uids/gids. * sftp(1): use "[email protected]" sftp-server extension (when available) to fill in user/group names for directory listings. * sftp-server(8): support the "home-directory" extension request defined in draft-ietf-secsh-filexfer-extensions-00. This overlaps a bit with the existing "[email protected]", but some other clients support it. * ssh-keygen(1), sshd(8): allow certificate validity intervals, sshsig verification times and authorized_keys expiry-time options to accept dates in the UTC time zone in addition to the default of interpreting them in the system time zone. YYYYMMDD and YYMMDDHHMM[SS] dates/times will be interpreted as UTC if suffixed with a 'Z' character. Also allow certificate validity intervals to be specified in raw seconds-since-epoch as hex value, e.g. -V 0x1234:0x4567890. This is intended for use by regress tests and other tools that call ssh-keygen as part of a CA workflow. bz3468 * sftp(1): allow arguments to the sftp -D option, e.g. sftp -D "/usr/libexec/sftp-server -el debug3" * ssh-keygen(1): allow the existing -U (use agent) flag to work with "-Y sign" operations, where it will be interpreted to require that the private keys is hosted in an agent; bz3429MFC after: 2 weeksRelnotes: YesSponsored by: The FreeBSD Foundation
ssh: update to OpenSSH v8.9p1Release notes are available at https://www.openssh.com/txt/release-8.9Some highlights: * ssh(1), sshd(8), ssh-add(1), ssh-agent(1): add a system for restricting
ssh: update to OpenSSH v8.9p1Release notes are available at https://www.openssh.com/txt/release-8.9Some highlights: * ssh(1), sshd(8), ssh-add(1), ssh-agent(1): add a system for restricting forwarding and use of keys added to ssh-agent(1) * ssh(1), sshd(8): add the [email protected] hybrid ECDH/x25519 + Streamlined NTRU Prime post-quantum KEX to the default KEXAlgorithms list (after the ECDH methods but before the prime-group DH ones). The next release of OpenSSH is likely to make this key exchange the default method. * sshd(8), portable OpenSSH only: this release removes in-built support for MD5-hashed passwords. If you require these on your system then we recommend linking against libxcrypt or similar.Future deprecation notice=========================A near-future release of OpenSSH will switch scp(1) from using thelegacy scp/rcp protocol to using SFTP by default.Legacy scp/rcp performs wildcard expansion of remote filenames (e.g."scp host:* .") through the remote shell. This has the side effect ofrequiring double quoting of shell meta-characters in file namesincluded on scp(1) command-lines, otherwise they could be interpretedas shell commands on the remote side.MFC after: 1 monthRelnotes: YesSponsored by: The FreeBSD Foundation
ssh: move common Makefile boilerplate to a new ssh.mkThis moves SSHDIR and ssh_namespace.h handling to a common location,and will simplify future work such as adding U2F support (D32509).Reviewe
ssh: move common Makefile boilerplate to a new ssh.mkThis moves SSHDIR and ssh_namespace.h handling to a common location,and will simplify future work such as adding U2F support (D32509).Reviewed by: kevansMFC after: 1 weekSponsored by: The FreeBSD FoundationDifferential Revision: https://reviews.freebsd.org/D32808
openssh: update to OpenSSH v8.7p1Some notable changes, from upstream's release notes:- sshd(8): Remove support for obsolete "host/port" syntax.- ssh(1): When prompting whether to record a new ho
openssh: update to OpenSSH v8.7p1Some notable changes, from upstream's release notes:- sshd(8): Remove support for obsolete "host/port" syntax.- ssh(1): When prompting whether to record a new host key, accept the key fingerprint as a synonym for "yes".- ssh-keygen(1): when acting as a CA and signing certificates with an RSA key, default to using the rsa-sha2-512 signature algorithm.- ssh(1), sshd(8), ssh-keygen(1): this release removes the "ssh-rsa" (RSA/SHA1) algorithm from those accepted for certificate signatures.- ssh-sk-helper(8): this is a new binary. It is used by the FIDO/U2F support to provide address-space isolation for token middleware libraries (including the internal one).- ssh(1): this release enables UpdateHostkeys by default subject to some conservative preconditions.- scp(1): this release changes the behaviour of remote to remote copies (e.g. "scp host-a:/path host-b:") to transfer through the local host by default.- scp(1): experimental support for transfers using the SFTP protocol as a replacement for the venerable SCP/RCP protocol that it has traditionally used.Additional integration work is needed to support FIDO/U2F in the basesystem.Deprecation Notice------------------OpenSSH will disable the ssh-rsa signature scheme by default in thenext release.Reviewed by: impMFC after: 1 monthRelnotes: YesSponsored by: The FreeBSD FoundationDifferential Revision: https://reviews.freebsd.org/D29985
Update Makefile.depend filesUpdate a bunch of Makefile.depend files asa result of adding Makefile.depend.options filesReviewed by: bdreweryMFC after: 1 weekSponsored by: Juniper NetworksDi
Update Makefile.depend filesUpdate a bunch of Makefile.depend files asa result of adding Makefile.depend.options filesReviewed by: bdreweryMFC after: 1 weekSponsored by: Juniper NetworksDifferential Revision: https://reviews.freebsd.org/D22494
Add Makefile.depend.optionsLeaf directories that have dependencies impactedby options need a Makefile.depend.options fileto avoid churn in Makefile.dependDIRDEPS for cases such as OPENSSL, TCP_
Add Makefile.depend.optionsLeaf directories that have dependencies impactedby options need a Makefile.depend.options fileto avoid churn in Makefile.dependDIRDEPS for cases such as OPENSSL, TCP_WRAPPERS etccan be set in local.dirdeps-options.mkwhich can add to those set in Makefile.depend.optionsSee share/mk/dirdeps-options.mkReviewed by: bdreweryMFC after: 1 weekSponsored by: Juniper NetworksDifferential Revision: https://reviews.freebsd.org/D22469
Upgrade to OpenSSH 7.8p1.Approved by: re (kib@)
Fix build after r337852: Don't rebuild moduli based on unrelated moduli.cReported by: many, delphij (moduli.c issue)
Move ssh config file handling into the ssh Makefiles.This helps with pkgbase by using CONFS and tagging these as config files.Approved by: allanjude (mentor), desDifferential Revision: https://r
Move ssh config file handling into the ssh Makefiles.This helps with pkgbase by using CONFS and tagging these as config files.Approved by: allanjude (mentor), desDifferential Revision: https://reviews.freebsd.org/D16678
DIRDEPS_BUILD: Update dependencies.Sponsored by: Dell EMC Isilon
Upgrade to OpenSSH 7.4p1.
Conditionalize building libwrap support into sshdOnly build libwrap support into sshd if MK_TCP_WRAPPERS != noThis will unbreak the build if libwrap has been removed from the systemMFC after: 2
Conditionalize building libwrap support into sshdOnly build libwrap support into sshd if MK_TCP_WRAPPERS != noThis will unbreak the build if libwrap has been removed from the systemMFC after: 2 weeksPR: 210141Submitted by: [email protected]Differential Revision: D9049
Only bake krb5_config.h support in to ssh(3), etc if both MK_GSSAPI andMK_KERBEROS_SUPPORT != noThis fixes the odd case where someone specified MK_GSSAPI=no andMK_KERBEROS_SUPPORT=yes (which admi
Only bake krb5_config.h support in to ssh(3), etc if both MK_GSSAPI andMK_KERBEROS_SUPPORT != noThis fixes the odd case where someone specified MK_GSSAPI=no andMK_KERBEROS_SUPPORT=yes (which admittedly, probably doesn't make sense,but the build system doesn't prevent this case today, and it didn't whenI filed the bug back in 2011 either).MFC after: 2 weeksPR: 159745
Add refactored blacklist support to sshdChange the calls to of blacklist_init() and blacklist_notify to bemacros defined in the blacklist_client.h file. This avoidsthe need for #ifdef USE_BLACKL
Add refactored blacklist support to sshdChange the calls to of blacklist_init() and blacklist_notify to bemacros defined in the blacklist_client.h file. This avoidsthe need for #ifdef USE_BLACKLIST / #endif except in theblacklist.c file.Remove redundent initialization attempts from withinblacklist_notify - everything always goes throughblacklistd_init().Added UseBlacklist option to sshd, which defaults to off.To enable the functionality, use '-o UseBlacklist=yes' onthe command line, or uncomment in the sshd_config file.Reviewed by: desApproved by: desMFC after: 1 weekSponsored by: The FreeBSD FoundationDifferential Revision: https://reviews.freebsd.org/D7051
Revert r301551, which added blacklistd(8) to sshd(8).This change has functional impact, and other concerns raisedby the OpenSSH maintainer.Requested by: desPR: 210479 (related)Approved by: re
Revert r301551, which added blacklistd(8) to sshd(8).This change has functional impact, and other concerns raisedby the OpenSSH maintainer.Requested by: desPR: 210479 (related)Approved by: re (marius)Sponsored by: The FreeBSD Foundation
DIRDEPS_BUILD: Update dependenciesApproved by: re (gjb)Sponsored by: EMC / Isilon Storage Division
Add blacklist support to sshdReviewed by: rpauloApproved by: rpaulo (earlier version of changes)Relnotes: YESSponsored by: The FreeBSD FoundationDifferential Revision: https://reviews.freebsd.o
Add blacklist support to sshdReviewed by: rpauloApproved by: rpaulo (earlier version of changes)Relnotes: YESSponsored by: The FreeBSD FoundationDifferential Revision: https://reviews.freebsd.org/D5915
Upgrade to OpenSSH 7.2p2.
Upgrade to OpenSSH 6.8p1.
Replace unneeded manual dependency on header by adding it to SRCS.bsd.lib.mk and bsd.prog.mk already depend all objs on headers in SRCS ifthere is not yet a depend file. The headers in SRCS are n
Replace unneeded manual dependency on header by adding it to SRCS.bsd.lib.mk and bsd.prog.mk already depend all objs on headers in SRCS ifthere is not yet a depend file. The headers in SRCS are never built orinstalled. After 'make depend' the header was already added as a properdependency on the objects where needed.MFC after: 2 weeksSponsored by: EMC / Isilon Storage Division
Retire the NONE cipher option.
Remove remnant from USEPRIVATELIB removalSponsored by: gandi.net
12345