Merge openssh from Debian unstable for mantic
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
openssh (Ubuntu) |
Fix Released
|
Undecided
|
Nick Rosbrook |
Bug Description
Scheduled-For: Backlog
Upstream: tbd
Debian: 1:9.2p1-2
Ubuntu: 1:9.0p1-1ubuntu8
The foundations team has maintained this package in the past and may be handling this merge.
If it turns out this needs a sync rather than a merge, please change the tag 'needs-merge' to 'needs-sync', and (optionally) update the title as desired.
### New Debian Changes ###
openssh (1:9.2p1-2) unstable; urgency=medium
* Fix mistakenly-
-- Colin Watson <email address hidden> Wed, 08 Feb 2023 10:43:07 +0000
openssh (1:9.2p1-1) unstable; urgency=medium
* Set 'UsePAM yes' when running regression tests, to match our default
sshd configuration.
* Ignore Lintian error about depending on lsb-base for now, to avoid
problems with partial upgrades on non-default init systems.
* New upstream release (https:/
- [SECURITY] sshd(8): fix a pre-authentication double-free memory fault
introduced in OpenSSH 9.1. This is not believed to be exploitable, and
it occurs in the unprivileged pre-auth process that is subject to
chroot(2) and is further sandboxed on most major platforms.
- [SECURITY] ssh(8): in OpenSSH releases after 8.7, the PermitRemoteOpen
option would ignore its first argument unless it was one of the
special keywords 'any' or 'none', causing the permission list to fail
open if only one permission was specified.
- [SECURITY] ssh(1): if the CanonicalizeHos
Canonical
resolver did not check that names in DNS responses were valid, then
use of these options could allow an attacker with control of DNS to
include invalid characters (possibly including wildcards) in names
added to known_hosts files when they were updated. These names would
still have to match the CanonicalizePer
practical exploitation appears unlikely.
- ssh(1): add a new EnableEscapeCom
controls whether the client-side ~C escape sequence that provides a
command-line is available. Among other things, the ~C command-line
could be used to add additional port-forwards at runtime. This option
defaults to 'no', disabling the ~C command-line that was previously
enabled by default.
- sshd(8): add support for channel inactivity timeouts via a new
sshd_
have not seen traffic in a configurable interval to be automatically
closed. Different timeouts may be applied to session, X11, agent and
TCP forwarding channels.
- sshd(8): add a sshd_config UnusedConnectio
client connections that have no open channels for a length of time.
This complements the ChannelTimeout option above.
- sshd(8): add a -V (version) option to sshd like the ssh client has.
- ssh(1): add a 'Host' line to the output of ssh -G showing the original
hostname argument. bz3343
- scp(1), sftp(1): add a -X option to both scp(1) and sftp(1) to allow
control over some SFTP protocol parameters: the copy buffer length and
the number of in-flight requests, both of which are used during
upload/
This makes them available in both SFTP protocol clients using the same
option character sequence.
- ssh-keyscan(1): allow scanning of complete CIDR address ranges, e.g.
'ssh-keyscan 192.168.0.0/24'. If a CIDR range is passed, then it will
be expanded to all possible addresses in the range including the
all-0s and all-1s addresses.
- ssh(1): support dynamic remote port forwarding in escape
command-
- ssh(1): when restoring non-blocking mode to stdio fds, restore exactly
the flags that ssh started with and don't just clobber them with zero,
as this could also remove the append flag from the set.
- ssh(1): avoid printf('%s', NULL) if using UserKnownHostsF
a hostkey in one of the system known hosts file changes.
- scp(1): switch scp from using pipes to a socket-pair for communication
with its ssh sub-processes, matching how sftp(1) operates.
- sshd(8): clear signal mask early in main(); sshd may have been started
with one or more signals masked (sigprocmask(2) is not cleared on
fork/exec) and this could interfere with various things, e.g. the
login grace timer. Execution environments that fail to clear the
signal mask before running sshd are clearly broken, but apparently
they do exist.
- ssh(1): warn if no host keys for hostbased auth can be loaded.
- sshd(8): Add server debugging for hostbased auth that is queued and
sent to the client after successful authentication, but also logged to
assist in diagnosis of HostbasedAuthen
- ssh(1): document use of the IdentityFile option as being usable to
list public keys as well as private keys.
- sshd(8): check for and disallow MaxStartups values less than or equal
to zero during config parsing, rather than failing later at runtime.
- ssh-keygen(1): fix parsing of hex cert expiry times specified on the
command-line when acting as a CA.
- scp(1): when scp(1) is using the SFTP protocol for transport (the
default), better match scp/rcp's handling of globs that don't match
the globbed characters but do match literally (e.g. trying to transfer
a file named 'foo.[1]'). Previously scp(1) in SFTP mode would not
match these pathnames but legacy scp/rcp mode would.
- ssh-agent(1): document the '-O no-restrict-
option.
- ssh(1): honour user's umask(2) if it is more restrictive then the ssh
default (022).
- sshd(8): allow writev(2) in the Linux seccomp sandbox. This seems to
be used by recent glibcs at least in some configurations during error
conditions.
- sshd(8): simplify handling of SSH_CONNECTION PAM env var, removing
global variable and checking the return value from pam_putenv.
- sshd(8): disable SANDBOX_
enabled during the OpenSSH 9.1 release cycle.
- sshd(8): defer PRNG seeding until after the initial closefrom(2) call.
PRNG seeding will initialize OpenSSL, and some engine providers (e.g.
Intel's QAT) will open descriptors for their own use that closefrom(2)
### Old Ubuntu Delta ###
openssh (1:9.0p1-1ubuntu8) lunar; urgency=medium
* debian/
is specified (LP: #1993478):
- Strip port before converting hostnames to numerical addresses.
- Only append ports when the ListenAddress does not already specify a
port.
- Revert socket migration on upgrade if a previous version did the
migration when it should not have.
* debian/
when skipping socket migration (LP: #1995294).
-- Nick Rosbrook <email address hidden> Tue, 25 Oct 2022 11:57:43 -0400
openssh (1:9.0p1-1ubuntu7) kinetic; urgency=medium
* Update list of stock sshd_config checksums to include those from
jammy and kinetic.
* Add a workaround for LP: #1990863 (now fixed in livecd-rootfs) to
avoid spurious ucf prompts on upgrade.
* Move /run/sshd creation out of the systemd unit to a tmpfile config
so that sshd can be run manually if necessary without having to create
this directory by hand. LP: #1991283.
[ Nick Rosbrook ]
* debian/
non-default Port is used in /etc/ssh/
-- Steve Langasek <email address hidden> Mon, 26 Sep 2022 21:55:14 +0000
openssh (1:9.0p1-1ubuntu6) kinetic; urgency=medium
* Fix syntax error in postinst :/
-- Steve Langasek <email address hidden> Fri, 23 Sep 2022 19:51:32 +0000
openssh (1:9.0p1-1ubuntu5) kinetic; urgency=medium
* Correctly handle the case of new installs, and correctly apply systemd
unit overrides on upgrade from existing kinetic systems.
-- Steve Langasek <email address hidden> Fri, 23 Sep 2022 19:45:18 +0000
openssh (1:9.0p1-1ubuntu4) kinetic; urgency=medium
* Don't migrate users to socket activation if multiple ListenAddresses
might make sshd unreliable on boot.
* Fix regexp bug that prevented proper migration of IPv6 address settings.
-- Steve Langasek <email address hidden> Fri, 23 Sep 2022 19:35:37 +0000
openssh (1:9.0p1-1ubuntu3) kinetic; urgency=medium
* Document in the default sshd_config file the changes in behavior
triggered by use of socket-based activation.
-- Steve Langasek <email address hidden> Fri, 26 Aug 2022 00:40:11 +0000
openssh (1:9.0p1-1ubuntu2) kinetic; urgency=medium
* Fix manpage to not claim socket-based activation is the default on
Debian!
-- Steve Langasek <email address hidden> Fri, 26 Aug 2022 00:21:42 +0000
openssh (1:9.0p1-1ubuntu1) kinetic; urgency=medium
* debian/
socket activation.
* debian/
activation by default.
* debian/rules: rejigger dh_installsystemd invocations so ssh.service and
ssh.socket don't fight.
* debian/
to systemd socket options on upgrade.
* debian/
* debian/
sshd_config(5) that ListenAddress and Port no longer work.
* debian/
debconf warning about possible service failure with multiple
ListenAddress settings.
-- Steve Langasek <email address hidden> Fri, 19 Aug 2022 20:43:16 +0000
Related branches
- Steve Langasek (community): Approve
-
Diff: 1605 lines (+1016/-107)30 files modifieddebian/README.Debian (+10/-17)
debian/changelog (+133/-0)
debian/control (+2/-1)
debian/openssh-server.postinst (+192/-6)
debian/openssh-server.postrm (+4/-0)
debian/openssh-server.templates (+12/-0)
debian/openssh-server.tmpfile (+2/-0)
debian/openssh-server.ucf-md5sum (+24/-0)
debian/patches/series (+1/-0)
debian/patches/socket-activation-documentation.patch (+50/-0)
debian/patches/systemd-socket-activation.patch (+152/-44)
debian/po/cs.po (+26/-1)
debian/po/da.po (+26/-1)
debian/po/de.po (+26/-1)
debian/po/es.po (+26/-1)
debian/po/fr.po (+26/-1)
debian/po/it.po (+26/-1)
debian/po/ja.po (+26/-1)
debian/po/nl.po (+26/-1)
debian/po/pt.po (+26/-1)
debian/po/pt_BR.po (+26/-1)
debian/po/ru.po (+28/-3)
debian/po/sv.po (+26/-1)
debian/po/templates.pot (+27/-2)
debian/po/tr.po (+27/-2)
debian/rules (+3/-2)
debian/systemd/ssh.service (+0/-2)
debian/tests/control (+6/-0)
debian/tests/systemd-socket-activation (+57/-0)
dev/null (+0/-17)
description: | updated |
Changed in openssh (Ubuntu): | |
assignee: | nobody → Nick Rosbrook (enr0n) |
Changed in openssh (Ubuntu): | |
status: | New → Fix Committed |
Changed in openssh (Ubuntu): | |
milestone: | none → mantic-updates |
I am planning on handling this merge as it came up during the foundations merge party.