- merged 7.0p1 from PLD

diff --git a/openssh-chroot.patch b/openssh-chroot.patch
index 3c93ac0d5dc028f0d7575ab70f111aef800777b4..3bef76239fd0694f6aa0bbe3d344c4e109c63f50 100644 (file)
--- a/openssh-chroot.patch
+++ b/openssh-chroot.patch
@@ -116,9 +116,9 @@
  # http://securitytracker.com/alerts/2004/Sep/1011143.html
 --- openssh-4.4p1/sshd_config.0.orig   2006-09-26 13:03:48.000000000 +0200
 +++ openssh-4.4p1/sshd_config.0        2006-10-05 10:11:41.615971000 +0200
-@@ -451,6 +451,16 @@
-              To disable TCP keepalive messages, the value should be set to
-              ``no''.
+@@ -921,6 +921,16 @@ DESCRIPTION
+              TrustedUserCAKeys.  For more details on certificates, see the
+              CERTIFICATES section in ssh-keygen(1).
  
 +     UseChroot
 +             Specifies whether to use chroot-jail environment with ssh/sftp,
@@ -130,9 +130,9 @@
 +             For this to work properly you have to create special chroot-jail
 +             environment in a /path/to/chroot directory.
 +
-      UseDNS  Specifies whether sshd(8) should look up the remote host name and
-              check that the resolved host name for the remote IP address maps
-              back to the very same IP address.  The default is ``yes''.
+      UseDNS  Specifies whether sshd(8) should look up the remote host name,
+              and to check that the resolved host name for the remote IP
+              address maps back to the very same IP address.
 --- openssh-3.8p1/sshd_config.5.orig   2004-02-18 04:31:24.000000000 +0100
 +++ openssh-3.8p1/sshd_config.5        2004-02-25 21:17:23.000000000 +0100
 @@ -552,6 +552,16 @@

diff --git a/openssh-config.patch b/openssh-config.patch
index f82be4fd7e3276acb20a2bc02f51dd460334bc39..51c9878107bb0317ec9cab04c68e6b500f81ee76 100644 (file)
--- a/openssh-config.patch
+++ b/openssh-config.patch
@@ -4,7 +4,7 @@
  # Authentication:
  
  #LoginGraceTime 2m
--#PermitRootLogin no
+-#PermitRootLogin prohibit-password
 +PermitRootLogin no
  #StrictModes yes
  #MaxAuthTries 6

diff --git a/openssh-sigpipe.patch b/openssh-sigpipe.patch
index 78d72b7f9d1adf9fa4402f235278890c2e2eba1d..11969ddfee69599bd61c7bf02b65588926639a47 100644 (file)
--- a/openssh-sigpipe.patch
+++ b/openssh-sigpipe.patch
@@ -42,17 +42,18 @@ diff -urN openssh-3.9p1.org/ssh.0 openssh-3.9p1/ssh.0
  .Op Fl b Ar bind_address
  .Op Fl c Ar cipher_spec
  .Op Fl D Oo Ar bind_address : Oc Ns Ar port
-@@ -425,6 +425,10 @@
- on the local machine as the source address
+@@ -138,6 +138,11 @@ on the local machine as the source addre
  of the connection.
  Only useful on systems with more than one address.
+ .Pp
 +.It Fl B
 +Enables processing of SIGPIPE. Useful when using ssh output as input for
 +another process, for example in a shell script. Be careful - it may break
 +port/X11 forwarding when used.
++.Pp
  .It Fl C
  Requests compression of all data (including stdin, stdout, stderr, and
- data for forwarded X11 and TCP/IP connections).
+ data for forwarded X11, TCP and
 --- openssh-4.0p1/ssh.c.orig   2005-03-02 02:04:33.000000000 +0100
 +++ openssh-4.0p1/ssh.c        2005-03-10 15:11:10.000000000 +0100
 @@ -135,6 +135,9 @@

diff --git a/openssh.spec b/openssh.spec
index bb49f475f9eda8849633235ca7306ea72faeb0f6..0fe48544e5942e5d1de7a38df143be3d4cc9aae7 100644 (file)
--- a/openssh.spec
+++ b/openssh.spec
@@ -41,13 +41,13 @@ Summary(pt_BR.UTF-8):       Implementação livre do SSH
 Summary(ru.UTF-8):     OpenSSH - свободная реализация протокола Secure Shell (SSH)
 Summary(uk.UTF-8):     OpenSSH - вільна реалізація протоколу Secure Shell (SSH)
 Name:          openssh
-Version:       6.9p1
-Release:       3
+Version:       7.0p1
+Release:       2
 Epoch:         2
 License:       BSD
 Group:         Applications/Networking
 Source0:       ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/%{name}-%{version}.tar.gz
-# Source0-md5: 0b161c44fc31fbc6b76a6f8ae639f16f
+# Source0-md5: 831883f251ac34f0ab9c812acc24ee69
 Source1:       http://www.mif.pg.gda.pl/homepages/ankry/man-PLD/%{name}-non-english-man-pages.tar.bz2
 # Source1-md5: 66943d481cc422512b537bcc2c7400d1
 Source2:       %{name}d.init
@@ -683,6 +683,16 @@ if [ "$1" = "0" ]; then
        %userremove sshd
 fi
 
+%triggerpostun server -- %{name}-server < %{epoch}:7.0p1-2
+%banner %{name}-server -e << EOF
+!!!!!!!!!!!!!!!!!!!!! WARNING !!!!!!!!!!!!!!!!!!!!!
+! Starting from openssh 7.0 DSA keys are disabled !
+! on server and client side. You will NOT be able !
+! to use DSA keys for authentication. Please read !
+! about PubkeyAcceptedKeyTypes in man ssh_config. !
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+EOF
+
 %triggerpostun server -- %{name}-server < 6.2p1-1
 cp -f %{_sysconfdir}/sshd_config{,.rpmorig}
 sed -i -e 's#AuthorizedKeysCommandRunAs#AuthorizedKeysCommandUser##g' %{_sysconfdir}/sshd_config