[ol7_latest_archive] openssh-clients-7.4p1-13.el7_4.aarch64

OpenSSH is a free version of SSH (Secure SHell), a program for logging
into and executing commands on a remote machine. This package includes
the clients necessary to make encrypted connections to SSH servers.

Changelog (Show File list) (Show related packages)

• Wed Sep 13 2017 Jakub Jelen <jjelen@redhat.com> - 7.4p1-13 + 0.10.3-1

  - Revert default of GSSAPIStrictAcceptorCheck=no back to yes (#1488982)

• Mon Aug 07 2017 Jakub Jelen <jjelen@redhat.com> - 7.4p1-12 + 0.10.3-1

  - Revert upstream change to UseDNS=no back to yes (#1478175)

• Mon May 22 2017 Jakub Jelen <jjelen@redhat.com> - 7.4p1-11 + 0.10.3-1

  - Compiler warnings (#1341754)

• Mon May 22 2017 Jakub Jelen <jjelen@redhat.com> - 7.4p1-10 + 0.10.3-1

  - Add missing messages in FIPS mode (#1341754)

• Fri May 19 2017 Jakub Jelen <jjelen@redhat.com> - 7.4p1-9 + 0.10.3-1

  - Allow harmless syscalls for s390 crypto modules (#1451809)

• Mon May 15 2017 Jakub Jelen <jjelen@redhat.com> - 7.4p1-8 + 0.10.3-1

  - Fix multilib issue in documentation (#1450361)

• Thu May 04 2017 Jakub Jelen <jjelen@redhat.com> - 7.4p1-6 + 0.10.3-1

  - ControlPath too long should not be a fatal error (#1447561)

• Wed Apr 26 2017 Jakub Jelen <jjelen@redhat.com> - 7.4p1-5 + 0.10.3-1

  - Fix the default key exchange proposal in FIPS mode (#1438414)
  - Remove another wrong coverity chunk to unbreak gsskex (#1438414)

• Mon Apr 24 2017 Jakub Jelen <jjelen@redhat.com> - 7.4p1-4 + 0.10.3-1

  - Update seccomp filter to work on ppc64le (#1443916)

• Wed Apr 05 2017 Jakub Jelen <jjelen@redhat.com> - 7.4p1-3 + 0.10.3-1

  - Do not completely disable SHA-1 key exchange methods in FIPS (#1324493)
  - Remove wrong coverity patches

• Thu Mar 23 2017 Jakub Jelen <jjelen@redhat.com> - 7.4p1-2 + 0.10.3-1

  - Fix coverity scan results
  - Adjust FIPS algorithms list (#1420910)
  - Revert problematic feature for chroot(#1418062)
  - Fix CBC weakness in released OpenSSH 7.5

• Wed Mar 01 2017 Jakub Jelen <jjelen@redhat.com> - 7.4p1-1 + 0.10.3-1

  - Rebase to openssh 7.4 and pam_ssh_agent_auth 0.10.3 (#1341754)
  - detach -cavs subpackage
  - enable seccomp filter for sandboxed child

• Wed Mar 01 2017 Jakub Jelen <jjelen@redhat.com> - 6.6.1p1-35 + 0.9.3-9

  - Do not send SD_NOTIFY from forked childern (#1381997)

• Fri Feb 24 2017 Jakub Jelen <jjelen@redhat.com> - 6.6.1p1-34 + 0.9.3-9

  - Add SD_NOTIFY code to help systemd to track running service (#1381997)

• Mon Dec 19 2016 Jakub Jelen <jjelen@redhat.com> - 6.6.1p1-33 + 0.9.3-9

  - Restore login with large MOTD (#1404018)

• Tue Nov 29 2016 Jakub Jelen <jjelen@redhat.com> - 6.6.1p1-32 + 0.9.3-9

  - Restore funcionality of chrooted envirotments (#1398569)

• Tue Sep 06 2016 Jakub Jelen <jjelen@redhat.com> - 6.6.1p1-31 + 0.9.3-9

  - Do not depend on selinux-policy (#1373297)

• Fri Jul 29 2016 Jakub Jelen <jjelen@redhat.com> - 6.6.1p1-30 + 0.9.3-9

  - Drop dependency on libcap-ng for ssh-keycat (#1357859)

• Thu Jul 28 2016 Jakub Jelen <jjelen@redhat.com> - 6.6.1p1-29 + 0.9.3-9

  - Rework SELinux context handling with chroot using libcap-ng (#1357859)

• Fri Jul 01 2016 Jakub Jelen <jjelen@redhat.com> - 6.6.1p1-28 + 0.9.3-9

  - SFTP force permission collision with umask (#1344614)
  - Make closefrom() ignore FD's to /dev/ devices on s390 (#1318760)
  - Create a default value for AuthenticationMethods any (#1237129)
  - Fix ssh-copy-id with LogLevel=quiet (#1349556)
  - Expose more information to PAM (#1312304)
  - Move MAX_DISPLAYS to a configuration option (#1341302)
  - Add a wildcard option to PermitOpen directive (host) (#1344106)

• Tue May 31 2016 Jakub Jelen <jjelen@redhat.com> - 6.6.1p1-27 + 0.9.3-9

  - Coverity and RPMDiff build issues (#1334326)
  - CVE-2015-8325: privilege escalation via user's PAM environment and UseLogin=yes (#1329191)
  - Check for real location of .k5login file (#1328243)
  - close ControlPersist background process stderr (#1335540)

• Fri Apr 01 2016 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-26 + 0.9.3-9

  - Drop glob patch for sftp client preventing listing many files (#1310303)
  - Fix race condition between audit messages from different processes (#1310684)
  - Make systemd service forking to properly report state (#1291172)
  - Get rid of rpm triggers for openssh-5.x (#1312013)
  - Generate the host keys when the key files are empty (#1266043)
  - pam_ssh_agent_auth: authorized_keys_command option (#1317858)
  - Don't use MD5 digest from pam_ssh_agent_auth in FIPS mode (#1317952)

• Wed Mar 16 2016 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-25 + 0.9.3-9

  - CVE-2016-1908: possible fallback from untrusted to trusted X11 forwarding (#1298741)

• Tue Mar 15 2016 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-24 + 0.9.3-9

  - CVE-2016-3115: missing sanitisation of input for X11 forwarding (#1317819)

• Wed Jan 13 2016 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-23 + 0.9.3-9

  - Disable undocumented feauture Roaming for good (#1298218)
  - prevents CVE-2016-0777 and CVE-2016-0778

• Fri Sep 25 2015 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-22 + 0.9.3-9

  - Use the correct constant for glob limits (#1160377)

• Thu Sep 24 2015 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-21 + 0.9.3-9

  - Extend memory limit for remote glob in sftp acc. to stat limit (#1160377)

• Thu Sep 24 2015 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-20 + 0.9.3-9

  - Fix vulnerabilities published with openssh-7.0 (#1265807)
   - Privilege separation weakness related to PAM support
   - Use-after-free bug related to PAM support

• Thu Sep 24 2015 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-19 + 0.9.3-9

  - Increase limit of files for glob match in sftp to 8192 (#1160377)

• Tue Aug 18 2015 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-18 + 0.9.3-9

  - Add GSSAPIKexAlgorithms option for server and client application (#1253062)

• Wed Jul 29 2015 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-17 + 0.9.3-9

  - Security fixes released with openssh-6.9 (CVE-2015-5352) (#1247864)
   - XSECURITY restrictions bypass under certain conditions in ssh(1) (#1238231)
   - weakness of agent locking (ssh-add -x) to password guessing (#1238238)

• Mon Jul 27 2015 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-16 + 0.9.3-9

  - only query each keyboard-interactive device once (CVE-2015-5600) (#1245971)

• Wed Jul 15 2015 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-15 + 0.9.3-9

  - One more typo in manual page documenting TERM variable (#1162683)
  - Fix race condition with auditing messages answers (#1240613)

• Mon Jun 15 2015 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-14 + 0.9.3-9

  - Fix ldif schema to have correct spacing on newlines (#1184938)
  - Add missing values for sshd test mode (#1187597)
  - ssh-copy-id: tcsh doesnt work with multiline strings (#1201758)
  - Fix memory problems with newkeys and array transfers (#1223218)
  - Enhance AllowGroups documentation in man page (#1150007)

• Mon May 11 2015 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-13 + 0.9.3-9

  - Increase limit of files for glob match in sftp (#1160377)
  - Add pam_reauthorize.so to /etc/pam.d/sshd (#1204233)
  - Show all config values in sshd test mode (#1187597)
  - Document required selinux boolean for working ssh-ldap-helper (#1178116)
  - Consistent usage of pam_namespace in sshd (#1125110)
  - Fix auditing when using combination of ForcedCommand and PTY (#1199112)
  - Add sftp option to force mode of created files (#1197989)
  - Ability to specify an arbitrary LDAP filter in ldap.conf for ssh-ldap-helper (#1201753)
  - Provide documentation line for systemd service and socket (#1181591)
  - Provide LDIF version of LPK schema (#1184938)
  - Document TERM environment variable (#1162683)
  - Fix ssh-copy-id on non-sh remote shells (#1201758)
  - Do not read RSA1 hostkeys for HostBased authentication in FIPS (#1197666)

• Thu Mar 19 2015 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-12 + 0.9.3-9

  - Fix labeling in MLS according to selected sensitivity (#1202843)

• Fri Jan 16 2015 Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-11 + 0.9.3-9

  - fix direction in CRYPTO_SESSION audit message (#1171248)

• Wed Jan 14 2015 Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-10 + 0.9.3-9

  - add new option GSSAPIEnablek5users and disable using ~/.k5users by default CVE-2014-9278
    (#1169843)

• Fri Dec 19 2014 Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-9 + 0.9.3-9

  - log via monitor in chroots without /dev/log (#1083482)

• Mon Dec 15 2014 Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-8 + 0.9.3-9

  - increase size of AUDIT_LOG_SIZE to 256 (#1171163)
  - record pfs= field in CRYPTO_SESSION audit event (#1171248)

• Thu Nov 13 2014 Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-7 + 0.9.3-9

  - fix gsskex patch to correctly handle MONITOR_REQ_GSSSIGN request (#1118005)

• Fri Nov 07 2014 Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-6 + 0.9.3-9

  - correct the calculation of bytes for authctxt->krb5_ccname <ams@corefiling.com> (#1161073)

• Tue Nov 04 2014 Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-5 + 0.9.3-9

  - change audit trail for unknown users (#1158521)

• Sun Oct 26 2014 Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-4 + 0.9.3-9

  - revert the default of KerberosUseKuserok back to yes
  - fix kuserok patch which checked for the existence of .k5login unconditionally
    and hence prevented other mechanisms to be used properly

• Mon Sep 29 2014 Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-3 + 0.9.3-9

  - fix parsing empty options in sshd_conf
  - ignore SIGXFSZ in postauth monitor

• Tue Sep 23 2014 Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-2 + 0.9.3-9

  - slightly change systemd units logic - use sshd-keygen.service (#1066615)
  - log when a client requests an interactive session and only sftp is allowed (#1130198)
  - sshd-keygen - don't generate DSA and ED25519 host keys in FIPS mode (#1143867)

• Mon Sep 08 2014 Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-1 + 0.9.3-9

  - new upstream release (#1059667)
  - prevent a server from skipping SSHFP lookup - CVE-2014-2653 (#1081338)
  - make /etc/ssh/moduli file public (#1134448)
  - test existence of /etc/ssh/ssh_host_ecdsa_key in sshd-keygen.service
  - don't clean up gssapi credentials by default (#1134447)
  - ssh-agent - try CLOCK_BOOTTIME with fallback (#1134449)
  - disable the curve25519 KEX when speaking to OpenSSH 6.5 or 6.6
  - add support for ED25519 keys to sshd-keygen and sshd.sysconfig
  - standardise on NI_MAXHOST for gethostname() string lengths (#1097665)
  - set a client's address right after a connection is set (mindrot#2257) (#912792)
  - apply RFC3454 stringprep to banners when possible (mindrot#2058) (#1104662)
  - don't consider a partial success as a failure (mindrot#2270) (#1112972)

• Wed Mar 19 2014 Petr Lautrbach <plautrba@redhat.com> 6.4p1-8 + 0.9.3-8

  - ignore environment variables with embedded '=' or '\0' characters (#1077843)

• Tue Jan 28 2014 Petr Lautrbach <plautrba@redhat.com> 6.4p1-7 + 0.9.3-8

  - log fipscheck verification message into syslog authpriv
  - ssh-keygen - relative-specified certificate expiry time should be relative
    to current time and not the validity start time (#1058234)
  - use the size of security of 3des for DH (#1053107)
  - ssh-copy-id.1 man page fix (#1058792)

• Fri Jan 24 2014 Daniel Mach <dmach@redhat.com> - 6.4p1-6

  - Mass rebuild 2014-01-24

• Mon Jan 20 2014 Petr Lautrbach <plautrba@redhat.com> 6.4p1-5 + 0.9.3-8

  - use tty allocation for a remote scp (#985650)
  - run ssh-copy-id in the legacy mode when SSH_COPY_ID_LEGACY variable is set (#969375)
  - FIPS mode - adjust the key echange DH groups and ssh-keygen according toSP800-131A (#1001748)

• Fri Dec 27 2013 Daniel Mach <dmach@redhat.com> - 6.4p1-4

  - Mass rebuild 2013-12-27

• Wed Dec 11 2013 Petr Lautrbach <plautrba@redhat.com> 6.4p1-3 + 0.9.3-8

  - sshd-keygen - use correct permissions on ecdsa host key (#1023945)
  - use only rsa and ecdsa host keys by default

• Tue Nov 26 2013 Petr Lautrbach <plautrba@redhat.com> 6.4p1-2 + 0.9.3-1

  - fix fatal() cleanup in the audit patch (#1029074)
  - fix parsing logic of ldap.conf file (#1033662)

• Fri Nov 08 2013 Petr Lautrbach <plautrba@redhat.com> 6.4p1-1 + 0.9.3-1

  - new upstream release

• Fri Nov 01 2013 Petr Lautrbach <plautrba@redhat.com> 6.3p1-4 + 0.9.3-7

  - adjust gss kex mechanism to the upstream changes (#1024004)
  - don't use xfree in pam_ssh_agent_auth sources <geertj@gmail.com> (#1024965)

• Thu Oct 24 2013 Petr Lautrbach <plautrba@redhat.com> 6.3p1-3 + 0.9.3-6

  - don't use SSH_FP_MD5 for fingerprints in FIPS mode (#1020948)

• Wed Oct 23 2013 Petr Lautrbach <plautrba@redhat.com> 6.3p1-2 + 0.9.3-6

  - use default_ccache_name from /etc/krb5.conf for a kerberos cache (#991186)
  - increase the size of the Diffie-Hellman groups (#1010607)
  - sshd-keygen to generate ECDSA keys <i.grok@comcast.net> (#1019222)

• Mon Oct 14 2013 Petr Lautrbach <plautrba@redhat.com> 6.3p1-1 + 0.9.3-6

  - new upstream release (#1013635)

• Tue Oct 08 2013 Petr Lautrbach <plautrba@redhat.com> 6.2p2-9 + 0.9.3-5

  - use dracut-fips package to determine if a FIPS module is installed (#1001566)
  - revert -fips subpackages and hmac files suffixes

• Wed Sep 25 2013 Petr Lautrbach <plautrba@redhat.com> 6.2p2-8 + 0.9.3-5

  - sshd-keygen: generate only RSA keys by default (#1010361)
  - use dist tag in suffixes for hmac checksum files

• Wed Sep 11 2013 Petr Lautrbach <plautrba@redhat.com> 6.2p2-7 + 0.9.3-5

  - use hmac_suffix for ssh{,d} hmac checksums
  - bump the minimum value of SSH_USE_STRONG_RNG to 14 according to SP800-131A
  - automatically restart sshd.service on-failure after 42s interval

• Thu Aug 29 2013 Petr Lautrbach <plautrba@redhat.com> 6.2p2-6.1 + 0.9.3-5

  - add -fips subpackages that contains the FIPS module files

• Wed Jul 31 2013 Petr Lautrbach <plautrba@redhat.com> 6.2p2-5 + 0.9.3-5

  - gssapi credentials need to be stored before a pam session opened (#987792)

• Tue Jul 23 2013 Petr Lautrbach <plautrba@redhat.com> 6.2p2-4 + 0.9.3-5

  - don't show Success for EAI_SYSTEM (#985964)
  - make sftp's libedit interface marginally multibyte aware (#841771)

• Mon Jun 17 2013 Petr Lautrbach <plautrba@redhat.com> 6.2p2-3 + 0.9.3-5

  - move default gssapi cache to /run/user/<uid> (#848228)

• Tue May 21 2013 Petr Lautrbach <plautrba@redhat.com> 6.2p2-2 + 0.9.3-5

  - add socket activated sshd units to the package (#963268)
  - fix the example in the HOWTO.ldap-keys

• Mon May 20 2013 Petr Lautrbach <plautrba@redhat.com> 6.2p2-1 + 0.9.3-5

  - new upstream release (#963582)

• Wed Apr 17 2013 Petr Lautrbach <plautrba@redhat.com> 6.2p1-4 + 0.9.3-4

  - don't use export in sysconfig file (#953111)

• Tue Apr 16 2013 Petr Lautrbach <plautrba@redhat.com> 6.2p1-3 + 0.9.3-4

  - sshd.service: use KillMode=process (#890376)
  - add latest config.{sub,guess} to support aarch64 (#926284)

• Tue Apr 09 2013 Petr Lautrbach <plautrba@redhat.com> 6.2p1-2 + 0.9.3-4

  - keep track of which IndentityFile options were manually supplied and
    which were default options, and don't warn if the latter are missing.
    (mindrot#2084)

• Tue Apr 09 2013 Petr Lautrbach <plautrba@redhat.com> 6.2p1-1 + 0.9.3-4

  - new upstream release (#924727)

• Wed Mar 06 2013 Petr Lautrbach <plautrba@redhat.com> 6.1p1-7 + 0.9.3-3

  - use SELinux type sshd_net_t for [net] childs (#915085)

• Thu Feb 14 2013 Petr Lautrbach <plautrba@redhat.com> 6.1p1-6 + 0.9.3-3

  - fix AuthorizedKeysCommand option

• Fri Feb 08 2013 Petr Lautrbach <plautrba@redhat.com> 6.1p1-5 + 0.9.3-3

  - change default value of MaxStartups - CVE-2010-5107 (#908707)

• Mon Dec 03 2012 Petr Lautrbach <plautrba@redhat.com> 6.1p1-4 + 0.9.3-3

  - fix segfault in openssh-5.8p2-force_krb.patch (#882541)

• Mon Dec 03 2012 Petr Lautrbach <plautrba@redhat.com> 6.1p1-3 + 0.9.3-3

  - replace RequiredAuthentications2 with AuthenticationMethods based on upstream
  - obsolete RequiredAuthentications[12] options
  - fix openssh-6.1p1-privsep-selinux.patch

• Fri Oct 26 2012 Petr Lautrbach <plautrba@redhat.com> 6.1p1-2

  - add SELinux comment to /etc/ssh/sshd_config about SELinux command to modify port (#861400)
  - drop required chkconfig (#865498)
  - drop openssh-5.9p1-sftp-chroot.patch (#830237)

• Sat Sep 15 2012 Petr Lautrbach <plautrba@redhat.com> 6.1p1-1 + 0.9.3-3

  - new upstream release (#852651)
  - use DIR: kerberos type cache (#848228)
  - don't use chroot_user_t for chrooted users (#830237)
  - replace scriptlets with systemd macros (#850249)
  - don't use /bin and /sbin paths (#856590)

• Mon Aug 06 2012 Petr Lautrbach <plautrba@redhat.com> 6.0p1-1 + 0.9.3-2

  - new upstream release

• Mon Aug 06 2012 Petr Lautrbach <plautrba@redhat.com> 5.9p1-26 + 0.9.3-1

  - change SELinux context also for root user (#827109)

• Fri Jul 27 2012 Petr Lautrbach <plautrba@redhat.com> 5.9p1-25 + 0.9.3-1

  - fix various issues in openssh-5.9p1-required-authentications.patch

• Tue Jul 17 2012 Tomas Mraz <tmraz@redhat.com> 5.9p1-24 + 0.9.3-1

  - allow sha256 and sha512 hmacs in the FIPS mode

• Fri Jun 22 2012 Tomas Mraz <tmraz@redhat.com> 5.9p1-23 + 0.9.3-1

  - fix segfault in su when pam_ssh_agent_auth is used and the ssh-agent
    is not running, most probably not exploitable
  - update pam_ssh_agent_auth to 0.9.3 upstream version

• Fri Apr 06 2012 Petr Lautrbach <plautrba@redhat.com> 5.9p1-22 + 0.9.2-32

  - don't create RSA1 key in FIPS mode
  - don't install sshd-keygen.service (#810419)

• Fri Mar 30 2012 Petr Lautrbach <plautrba@redhat.com> 5.9p1-21 + 0.9.2-32

  - fix various issues in openssh-5.9p1-required-authentications.patch

• Wed Mar 21 2012 Petr Lautrbach <plautrba@redhat.com> 5.9p1-20 + 0.9.2-32

  - Fix dependencies in systemd units, don't enable sshd-keygen.service (#805338)

• Wed Feb 22 2012 Petr Lautrbach <plautrba@redhat.com> 5.9p1-19 + 0.9.2-32

  - Look for x11 forward sockets with AI_ADDRCONFIG flag getaddrinfo (#735889)

• Mon Feb 06 2012 Petr Lautrbach <plautrba@redhat.com> 5.9p1-18 + 0.9.2-32

  - replace TwoFactorAuth with RequiredAuthentications[12]
    https://bugzilla.mindrot.org/show_bug.cgi?id=983

• Tue Jan 31 2012 Petr Lautrbach <plautrba@redhat.com> 5.9p1-17 + 0.9.2-32

  - run privsep slave process as the users SELinux context (#781634)

• Tue Dec 13 2011 Tomas Mraz <tmraz@redhat.com> 5.9p1-16 + 0.9.2-32

  - add CAVS test driver for the aes-ctr ciphers

• Sun Dec 11 2011 Tomas Mraz <tmraz@redhat.com> 5.9p1-15 + 0.9.2-32

  - enable aes-ctr ciphers use the EVP engines from OpenSSL such as the AES-NI

• Tue Dec 06 2011 Petr Lautrbach <plautrba@redhat.com> 5.9p1-14 + 0.9.2-32

  - warn about unsupported option UsePAM=no (#757545)

• Mon Nov 21 2011 Tomas Mraz <tmraz@redhat.com> - 5.9p1-13 + 0.9.2-32

  - add back the restorecon call to ssh-copy-id - it might be needed on older
    distributions (#739989)

• Fri Nov 18 2011 Tomas Mraz <tmraz@redhat.com> - 5.9p1-12 + 0.9.2-32

  - still support /etc/sysconfig/sshd loading in sshd service (#754732)
  - fix incorrect key permissions generated by sshd-keygen script (#754779)

• Fri Oct 14 2011 Tomas Mraz <tmraz@redhat.com> - 5.9p1-11 + 0.9.2-32

  - remove unnecessary requires on initscripts
  - set VerifyHostKeyDNS to ask in the default configuration (#739856)

• Mon Sep 19 2011 Jan F. Chadima <jchadima@redhat.com> - 5.9p1-10 + 0.9.2-32

  - selinux sandbox rewrite
  - two factor authentication tweaking

• Wed Sep 14 2011 Jan F. Chadima <jchadima@redhat.com> - 5.9p1-9 + 0.9.2-32

  - coverity upgrade
  - wipe off nonfunctional nss
  - selinux sandbox tweaking

• Tue Sep 13 2011 Jan F. Chadima <jchadima@redhat.com> - 5.9p1-8 + 0.9.2-32

  - coverity upgrade
  - experimental selinux sandbox

• Tue Sep 13 2011 Jan F. Chadima <jchadima@redhat.com> - 5.9p1-7 + 0.9.2-32

  - fully reanable auditing

• Mon Sep 12 2011 Jan F. Chadima <jchadima@redhat.com> - 5.9p1-6 + 0.9.2-32

  - repair signedness in akc patch

• Mon Sep 12 2011 Jan F. Chadima <jchadima@redhat.com> - 5.9p1-5 + 0.9.2-32

  - temporarily disable part of audit4 patch

• Fri Sep 09 2011 Jan F. Chadima <jchadima@redhat.com> - 5.9p1-3 + 0.9.2-32

  - Coverity second pass
  - Reenable akc patch

• Thu Sep 08 2011 Jan F. Chadima <jchadima@redhat.com> - 5.9p1-2 + 0.9.2-32

  - Coverity first pass

• Wed Sep 07 2011 Jan F. Chadima <jchadima@redhat.com> - 5.9p1-1 + 0.9.2-32

  - Rebase to 5.9p1
  - Add chroot sftp patch
  - Add two factor auth patch

• Tue Aug 23 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-21 + 0.9.2-31

  - ignore SIGPIPE in ssh keyscan

• Tue Aug 09 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-20 + 0.9.2-31

  - save ssh-askpass's debuginfo

• Mon Aug 08 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-19 + 0.9.2-31

  - compile ssh-askpass with corect CFLAGS

• Mon Aug 08 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-18 + 0.9.2-31

  - improve selinux's change context log

• Mon Aug 08 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-17 + 0.9.2-31

  - repair broken man pages

• Mon Jul 25 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-16 + 0.9.2-31

  - rebuild due to broken rpmbiild

• Thu Jul 21 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-15 + 0.9.2-31

  - Do not change context when run under unconfined_t

• Thu Jul 14 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-14 + 0.9.2-31

  - Add postlogin to pam. (#718807)

• Tue Jun 28 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-12 + 0.9.2-31

  - Systemd compatibility according to Mathieu Bridon <bochecha@fedoraproject.org>
  - Split out the host keygen into their own command, to ease future migration
    to systemd. Compatitbility with the init script was kept.
  - Migrate the package to full native systemd unit files, according to the Fedora
    packaging guidelines.
  - Prepate the unit files for running an ondemand server. (do not add it actually)

• Tue Jun 21 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-10 + 0.9.2-31

  - Mention IPv6 usage in man pages

• Mon Jun 20 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-9 + 0.9.2-31

  - Improve init script

• Thu Jun 16 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-7 + 0.9.2-31

  - Add possibility to compile openssh without downstream patches

• Thu Jun 09 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-6 + 0.9.2-31

  - remove stale control sockets (#706396)

• Tue May 31 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-5 + 0.9.2-31

  - improove entropy manuals

• Fri May 27 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-4 + 0.9.2-31

  - improove entropy handling
  - concat ldap patches

• Tue May 24 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-3 + 0.9.2-31

  - improove ldap manuals

• Mon May 23 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-2 + 0.9.2-31

  - add gssapi forced command

• Tue May 03 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p2-1 + 0.9.2-31

  - update the openssh version

• Thu Apr 28 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-34 + 0.9.2-30

  - temporarily disabling systemd units

• Wed Apr 27 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-33 + 0.9.2-30

  - add flags AI_V4MAPPED and AI_ADDRCONFIG to getaddrinfo

• Tue Apr 26 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-32 + 0.9.2-30

  - update scriptlets

• Fri Apr 22 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-30 + 0.9.2-30

  - add systemd units

• Fri Apr 22 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-28 + 0.9.2-30

  - improving sshd -> passwd transation
  - add template for .local domain to sshd_config

• Thu Apr 21 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-27 + 0.9.2-30

  - the private keys may be 640 root:ssh_keys ssh_keysign is sgid

• Wed Apr 20 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-26 + 0.9.2-30

  - improving sshd -> passwd transation

• Tue Apr 05 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-25 + 0.9.2-30

  - the intermediate context is set to sshd_sftpd_t
  - do not crash in packet.c if no connection

• Thu Mar 31 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-24 + 0.9.2-30

  - resolve warnings in port_linux.c

• Tue Mar 29 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-23 + 0.9.2-30

  - add /etc/sysconfig/sshd

• Mon Mar 28 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-22 + 0.9.2-30

  - improve reseeding and seed source (documentation)

• Tue Mar 22 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-20 + 0.9.2-30

  - use /dev/random or /dev/urandom for seeding prng
  - improve periodical reseeding of random generator

• Thu Mar 17 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-18 + 0.9.2-30

  - add periodical reseeding of random generator 
  - change selinux contex for internal sftp in do_usercontext
  - exit(0) after sigterm

• Thu Mar 10 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-17 + 0.9.2-30

  - improove ssh-ldap (documentation)

• Tue Mar 08 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-16 + 0.9.2-30

  - improve session keys audit

• Mon Mar 07 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-15 + 0.9.2-30

  - CVE-2010-4755

• Fri Mar 04 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-14 + 0.9.2-30

  - improove ssh-keycat (documentation)

• Thu Mar 03 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-13 + 0.9.2-30

  - improve audit of logins and auths

• Tue Mar 01 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-12 + 0.9.2-30

  - improove ssk-keycat

• Mon Feb 28 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-11 + 0.9.2-30

  - add ssk-keycat

• Fri Feb 25 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-10 + 0.9.2-30

  - reenable auth-keys ldap backend

• Fri Feb 25 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-9 + 0.9.2-30

  - another audit improovements

• Thu Feb 24 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-8 + 0.9.2-30

  - another audit improovements
  - switchable fingerprint mode

• Thu Feb 17 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-4 + 0.9.2-30

  - improve audit of server key management

• Wed Feb 16 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-3 + 0.9.2-30

  - improve audit of logins and auths

• Mon Feb 14 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-1 + 0.9.2-30

  - bump openssh version to 5.8p1

• Tue Feb 08 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 5.6p1-30.1

  - Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild

• Mon Feb 07 2011 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-30 + 0.9.2-29

  - clean the data structures in the non privileged process
  - clean the data structures when roaming

• Wed Feb 02 2011 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-28 + 0.9.2-29

  - clean the data structures in the privileged process

• Tue Jan 25 2011 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-25 + 0.9.2-29

  - clean the data structures before exit net process

• Mon Jan 17 2011 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-24 + 0.9.2-29

  - make audit compatible with the fips mode

• Fri Jan 14 2011 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-23 + 0.9.2-29

  - add audit of destruction the server keys

• Wed Jan 12 2011 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-22 + 0.9.2-29

  - add audit of destruction the session keys

• Fri Dec 10 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-21 + 0.9.2-29

  - reenable run sshd as non root user
  - renable rekeying

• Wed Nov 24 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-20 + 0.9.2-29

  - reapair clientloop crash (#627332)
  - properly restore euid in case connect to the ssh-agent socket fails

• Mon Nov 22 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-19 + 0.9.2-28

  - striped read permissions from suid and sgid binaries

• Mon Nov 15 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-18 + 0.9.2-27

  - used upstream version of the biguid patch

• Mon Nov 15 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-17 + 0.9.2-27

  - improoved kuserok patch

• Fri Nov 05 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-16 + 0.9.2-27

  - add auditing the host based key ussage
  - repait X11 abstract layer socket (#648896)

• Wed Nov 03 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-15 + 0.9.2-27

  - add auditing the kex result

• Tue Nov 02 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-14 + 0.9.2-27

  - add auditing the key ussage

• Wed Oct 20 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-12 + 0.9.2-27

  - update gsskex patch (#645389)

• Wed Oct 20 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-11 + 0.9.2-27

  - rebase linux audit according to upstream

• Fri Oct 01 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-10 + 0.9.2-27

  - add missing headers to linux audit

• Wed Sep 29 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-9 + 0.9.2-27

  - audit module now uses openssh audit framevork

• Wed Sep 15 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-8 + 0.9.2-27

  - Add the GSSAPI kuserok switch to the kuserok patch

• Wed Sep 15 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-7 + 0.9.2-27

  - Repaired the kuserok patch

• Mon Sep 13 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-6 + 0.9.2-27

  - Repaired the problem with puting entries with very big uid into lastlog

• Mon Sep 13 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-5 + 0.9.2-27

  - Merging selabel patch with the upstream version. (#632914)

• Mon Sep 13 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-4 + 0.9.2-27

  - Tweaking selabel patch to work properly without selinux rules loaded. (#632914)

• Wed Sep 08 2010 Tomas Mraz <tmraz@redhat.com> - 5.6p1-3 + 0.9.2-27

  - Make fipscheck hmacs compliant with FHS - requires new fipscheck

• Fri Sep 03 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-2 + 0.9.2-27

  - Added -z relro -z now to LDFLAGS

• Fri Sep 03 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-1 + 0.9.2-27

  - Rebased to openssh5.6p1

• Wed Jul 07 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-18 + 0.9.2-26

  - merged with newer bugzilla's version of authorized keys command patch

• Wed Jun 30 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-17 + 0.9.2-26

  - improved the x11 patch according to upstream (#598671)

• Fri Jun 25 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-16 + 0.9.2-26

  - improved the x11 patch (#598671)

• Thu Jun 24 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-15 + 0.9.2-26

  - changed _PATH_UNIX_X to unexistent file name (#598671)

• Wed Jun 23 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-14 + 0.9.2-26

  - sftp works in deviceless chroot again (broken from 5.5p1-3)

• Tue Jun 08 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-13 + 0.9.2-26

  - add option to switch out krb5_kuserok

• Fri May 21 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-12 + 0.9.2-26

  - synchronize uid and gid for the user sshd

• Thu May 20 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-11 + 0.9.2-26

  - Typo in ssh-ldap.conf(5) and ssh-ladap-helper(8)

• Fri May 14 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-10 + 0.9.2-26

  - Repair the reference in man ssh-ldap-helper(8)
  - Repair the PubkeyAgent section in sshd_config(5)
  - Provide example ldap.conf

• Thu May 13 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-9 + 0.9.2-26

  - Make the Ldap configuration widely compatible
  - create the aditional docs for LDAP support.

• Thu May 06 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-8 + 0.9.2-26

  - Make LDAP config elements TLS_CACERT and TLS_REQCERT compatiple with pam_ldap (#589360)

• Thu May 06 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-7 + 0.9.2-26

  - Make LDAP config element tls_checkpeer compatiple with nss_ldap (#589360)

• Tue May 04 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-6 + 0.9.2-26

  - Comment spec.file
  - Sync patches from upstream

• Mon May 03 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-5 + 0.9.2-26

  - Create separate ldap package
  - Tweak the ldap patch
  - Rename stderr patch properly

• Thu Apr 29 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-4 + 0.9.2-26

  - Added LDAP support

• Mon Apr 26 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-3 + 0.9.2-26

  - Ignore .bashrc output to stderr in the subsystems

• Tue Apr 20 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-2 + 0.9.2-26

  - Drop dependency on man

• Fri Apr 16 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-1 + 0.9.2-26

  - Update to 5.5p1

• Fri Mar 12 2010 Jan F. Chadima <jchadima@redhat.com> - 5.4p1-3 + 0.9.2-25

  - repair configure script of pam_ssh_agent
  - repair error mesage in ssh-keygen

• Fri Mar 12 2010 Jan F. Chadima <jchadima@redhat.com> - 5.4p1-2

  - source krb5-devel profile script only if exists

• Tue Mar 09 2010 Jan F. Chadima <jchadima@redhat.com> - 5.4p1-1

  - Update to 5.4p1
  - discontinued support for nss-keys
  - discontinued support for scard

• Wed Mar 03 2010 Jan F. Chadima <jchadima@redhat.com> - 5.4p1-0.snap20100302.1

  - Prepare update to 5.4p1

• Mon Feb 15 2010 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-22

  - ImplicitDSOLinking (#564824)

• Fri Jan 29 2010 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-21

  - Allow to use hardware crypto if awailable (#559555)

• Mon Jan 25 2010 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-20

  - optimized FD_CLOEXEC on accept socket (#541809)

• Mon Jan 25 2010 Tomas Mraz <tmraz@redhat.com> - 5.3p1-19

  - updated pam_ssh_agent_auth to new version from upstream (just
    a licence change)

• Thu Jan 21 2010 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-18

  - optimized RAND_cleanup patch (#557166)

• Wed Jan 20 2010 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-17

  - add RAND_cleanup at the exit of each program using RAND (#557166)

• Tue Jan 19 2010 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-16

  - set FD_CLOEXEC on accepted socket (#541809)

• Fri Jan 08 2010 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-15

  - replaced define by global in macros

• Tue Jan 05 2010 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-14

  - Update the pka patch

• Mon Dec 21 2009 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-13

  - Update the audit patch

• Fri Dec 04 2009 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-12

  - Add possibility to autocreate only RSA key into initscript (#533339)

• Fri Nov 27 2009 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-11

  - Prepare NSS key patch for future SEC_ERROR_LOCKED_PASSWORD (#537411)

• Tue Nov 24 2009 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-10

  - Update NSS key patch (#537411, #356451)

• Fri Nov 20 2009 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-9

  - Add gssapi key exchange patch (#455351)

• Fri Nov 20 2009 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-8

  - Add public key agent patch (#455350)

• Mon Nov 02 2009 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-7

  - Repair canohost patch to allow gssapi to work when host is acessed via pipe proxy (#531849)

• Thu Oct 29 2009 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-6

  - Modify the init script to prevent it to hang during generating the keys (#515145)

• Tue Oct 27 2009 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-5

  - Add README.nss

• Mon Oct 19 2009 Tomas Mraz <tmraz@redhat.com> - 5.3p1-4

  - Add pam_ssh_agent_auth module to a subpackage.

• Fri Oct 16 2009 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-3

  - Reenable audit.

• Fri Oct 02 2009 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-2

  - Upgrade to new wersion 5.3p1

• Tue Sep 29 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-29

  - Resolve locking in ssh-add (#491312)

• Thu Sep 24 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-28

  - Repair initscript to be acord to guidelines (#521860)
  - Add bugzilla# to application of edns and xmodifiers patch

• Wed Sep 16 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-26

  - Changed pam stack to password-auth

• Fri Sep 11 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-25

  - Dropped homechroot patch

• Mon Sep 07 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-24

  - Add check for nosuid, nodev in homechroot

• Tue Sep 01 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-23

  - add correct patch for ip-opts

• Tue Sep 01 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-22

  - replace ip-opts patch by an upstream candidate version

• Mon Aug 31 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-21

  - rearange selinux patch to be acceptable for upstream
  - replace seftp patch by an upstream version

• Fri Aug 28 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-20

  - merged xmodifiers to redhat patch
  - merged gssapi-role to selinux patch
  - merged cve-2007_3102 to audit patch
  - sesftp patch only with WITH_SELINUX flag
  - rearange sesftp patch according to upstream request

• Wed Aug 26 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-19

  - minor change in sesftp patch

• Fri Aug 21 2009 Tomas Mraz <tmraz@redhat.com> - 5.2p1-18

  - rebuilt with new openssl

• Thu Jul 30 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-17

  - Added dnssec support. (#205842)

• Sat Jul 25 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 5.2p1-16

  - Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild

• Fri Jul 24 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-15

  - only INTERNAL_SFTP can be home-chrooted
  - save _u and _r parts of context changing to sftpd_t

• Fri Jul 17 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-14

  - changed internal-sftp context to sftpd_t

• Fri Jul 03 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-13

  - changed home length path patch to upstream version

• Tue Jun 30 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-12

  - create '~/.ssh/known_hosts' within proper context

• Mon Jun 29 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-11

  - length of home path in ssh now limited by PATH_MAX
  - correct timezone with daylight processing

• Sat Jun 27 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-10

  - final version chroot %h (sftp only)

• Tue Jun 23 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-9

  - repair broken ls in chroot %h

• Fri Jun 12 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-8

  - add XMODIFIERS to exported environment (#495690)

• Fri May 15 2009 Tomas Mraz <tmraz@redhat.com> - 5.2p1-6

  - allow only protocol 2 in the FIPS mode

• Thu Apr 30 2009 Tomas Mraz <tmraz@redhat.com> - 5.2p1-5

  - do integrity verification only on binaries which are part
    of the OpenSSH FIPS modules

• Mon Apr 20 2009 Tomas Mraz <tmraz@redhat.com> - 5.2p1-4

  - log if FIPS mode is initialized
  - make aes-ctr cipher modes work in the FIPS mode

• Fri Apr 03 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-3

  - fix logging after chroot
  - enable non root users to use chroot %h in internal-sftp

• Fri Mar 13 2009 Tomas Mraz <tmraz@redhat.com> - 5.2p1-2

  - add AES-CTR ciphers to the FIPS mode proposal

• Mon Mar 09 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-1

  - upgrade to new upstream release

• Thu Feb 26 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 5.1p1-8

  - Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild

• Thu Feb 12 2009 Tomas Mraz <tmraz@redhat.com> - 5.1p1-7

  - drop obsolete triggers
  - add testing FIPS mode support
  - LSBize the initscript (#247014)

• Fri Jan 30 2009 Tomas Mraz <tmraz@redhat.com> - 5.1p1-6

  - enable use of ssl engines (#481100)

• Thu Jan 15 2009 Tomas Mraz <tmraz@redhat.com> - 5.1p1-5

  - remove obsolete --with-rsh (#478298)
  - add pam_sepermit to allow blocking confined users in permissive mode
    (#471746)
  - move system-auth after pam_selinux in the session stack

• Thu Dec 11 2008 Tomas Mraz <tmraz@redhat.com> - 5.1p1-4

  - set FD_CLOEXEC on channel sockets (#475866)
  - adjust summary
  - adjust nss-keys patch so it is applicable without selinux patches (#470859)

• Fri Oct 17 2008 Tomas Mraz <tmraz@redhat.com> - 5.1p1-3

  - fix compatibility with some servers (#466818)

• Thu Jul 31 2008 Tomas Mraz <tmraz@redhat.com> - 5.1p1-2

  - fixed zero length banner problem (#457326)

• Wed Jul 23 2008 Tomas Mraz <tmraz@redhat.com> - 5.1p1-1

  - upgrade to new upstream release
  - fixed a problem with public key authentication and explicitely
    specified SELinux role

• Wed May 21 2008 Tomas Mraz <tmraz@redhat.com> - 5.0p1-3

  - pass the connection socket to ssh-keysign (#447680)

• Mon May 19 2008 Tomas Mraz <tmraz@redhat.com> - 5.0p1-2

  - add LANGUAGE to accepted/sent environment variables (#443231)
  - use pam_selinux to obtain the user context instead of doing it itself
  - unbreak server keep alive settings (patch from upstream)
  - small addition to scp manpage

• Mon Apr 07 2008 Tomas Mraz <tmraz@redhat.com> - 5.0p1-1

  - upgrade to new upstream (#441066)
  - prevent initscript from killing itself on halt with upstart (#438449)
  - initscript status should show that the daemon is running
    only when the main daemon is still alive (#430882)

• Thu Mar 06 2008 Tomas Mraz <tmraz@redhat.com> - 4.7p1-10

  - fix race on control master and cleanup stale control socket (#436311)
    patches by David Woodhouse

• Fri Feb 29 2008 Tomas Mraz <tmraz@redhat.com> - 4.7p1-9

  - set FD_CLOEXEC on client socket
  - apply real fix for window size problem (#286181) from upstream
  - apply fix for the spurious failed bind from upstream
  - apply open handle leak in sftp fix from upstream

• Tue Feb 12 2008 Dennis Gilmore <dennis@ausil.us> - 4.7p1-8

  - we build for sparcv9 now  and it needs -fPIE

• Thu Jan 03 2008 Tomas Mraz <tmraz@redhat.com> - 4.7p1-7

  - fix gssapi auth with explicit selinux role requested (#427303) - patch
    by Nalin Dahyabhai

• Tue Dec 04 2007 Tomas Mraz <tmraz@redhat.com> - 4.7p1-6

  - explicitly source krb5-devel profile script

• Tue Dec 04 2007 Release Engineering <rel-eng at fedoraproject dot org> - 4.7p1-5

  - Rebuild for openssl bump

• Tue Nov 20 2007 Tomas Mraz <tmraz@redhat.com> - 4.7p1-4

  - do not copy /etc/localtime into the chroot as it is not
    necessary anymore (#193184)
  - call setkeycreatecon when selinux context is established
  - test for NULL privk when freeing key (#391871) - patch by
    Pierre Ossman

• Mon Sep 17 2007 Tomas Mraz <tmraz@redhat.com> - 4.7p1-2

  - revert default window size adjustments (#286181)

• Thu Sep 06 2007 Tomas Mraz <tmraz@redhat.com> - 4.7p1-1

  - upgrade to latest upstream
  - use libedit in sftp (#203009)
  - fixed audit log injection problem (CVE-2007-3102)

• Thu Aug 09 2007 Tomas Mraz <tmraz@redhat.com> - 4.5p1-8

  - fix sftp client problems on write error (#247802)
  - allow disabling autocreation of server keys (#235466)

• Wed Jun 20 2007 Tomas Mraz <tmraz@redhat.com> - 4.5p1-7

  - experimental NSS keys support
  - correctly setup context when empty level requested (#234951)

• Tue Mar 20 2007 Tomas Mraz <tmraz@redhat.com> - 4.5p1-6

  - mls level check must be done with default role same as requested

• Mon Mar 19 2007 Tomas Mraz <tmraz@redhat.com> - 4.5p1-5

  - make profile.d/gnome-ssh-askpass.* regular files (#226218)

• Tue Feb 27 2007 Tomas Mraz <tmraz@redhat.com> - 4.5p1-4

  - reject connection if requested mls range is not obtained (#229278)

• Thu Feb 22 2007 Tomas Mraz <tmraz@redhat.com> - 4.5p1-3

  - improve Buildroot
  - remove duplicate /etc/ssh from files

• Tue Jan 16 2007 Tomas Mraz <tmraz@redhat.com> - 4.5p1-2

  - support mls on labeled networks (#220487)
  - support mls level selection on unlabeled networks
  - allow / in usernames in scp (only beginning /, ./, and ../ is special)

• Thu Dec 21 2006 Tomas Mraz <tmraz@redhat.com> - 4.5p1-1

  - update to 4.5p1 (#212606)

• Thu Nov 30 2006 Tomas Mraz <tmraz@redhat.com> - 4.3p2-14

  - fix gssapi with DNS loadbalanced clusters (#216857)

• Tue Nov 28 2006 Tomas Mraz <tmraz@redhat.com> - 4.3p2-13

  - improved pam_session patch so it doesn't regress, the patch is necessary
    for the pam_session_close to be called correctly as uid 0

• Fri Nov 10 2006 Tomas Mraz <tmraz@redhat.com> - 4.3p2-12

  - CVE-2006-5794 - properly detect failed key verify in monitor (#214641)

• Thu Nov 02 2006 Tomas Mraz <tmraz@redhat.com> - 4.3p2-11

  - merge sshd initscript patches
  - kill all ssh sessions when stop is called in halt or reboot runlevel
  - remove -TERM option from killproc so we don't race on sshd restart

• Mon Oct 02 2006 Tomas Mraz <tmraz@redhat.com> - 4.3p2-10

  - improve gssapi-no-spnego patch (#208102)
  - CVE-2006-4924 - prevent DoS on deattack detector (#207957)
  - CVE-2006-5051 - don't call cleanups from signal handler (#208459)

• Wed Aug 23 2006 Tomas Mraz <tmraz@redhat.com> - 4.3p2-9

  - don't report duplicate syslog messages, use correct local time (#189158)
  - don't allow spnego as gssapi mechanism (from upstream)
  - fixed memleaks found by Coverity (from upstream)
  - allow ip options except source routing (#202856) (patch by HP)

• Tue Aug 08 2006 Tomas Mraz <tmraz@redhat.com> - 4.3p2-8

  - drop the pam-session patch from the previous build (#201341)
  - don't set IPV6_V6ONLY sock opt when listening on wildcard addr (#201594)

• Thu Jul 20 2006 Tomas Mraz <tmraz@redhat.com> - 4.3p2-7

  - dropped old ssh obsoletes
  - call the pam_session_open/close from the monitor when privsep is
    enabled so it is always called as root (patch by Darren Tucker)

• Mon Jul 17 2006 Tomas Mraz <tmraz@redhat.com> - 4.3p2-6

  - improve selinux patch (by Jan Kiszka)
  - upstream patch for buffer append space error (#191940)
  - fixed typo in configure.ac (#198986)
  - added pam_keyinit to pam configuration (#198628)
  - improved error message when askpass dialog cannot grab
    keyboard input (#198332)
  - buildrequires xauth instead of xorg-x11-xauth
  - fixed a few rpmlint warnings

• Wed Jul 12 2006 Jesse Keating <jkeating@redhat.com> - 4.3p2-5.1

  - rebuild

• Fri Apr 14 2006 Tomas Mraz <tmraz@redhat.com> - 4.3p2-5

  - don't request pseudoterminal allocation if stdin is not tty (#188983)

• Thu Mar 02 2006 Tomas Mraz <tmraz@redhat.com> - 4.3p2-4

  - allow access if audit is not compiled in kernel (#183243)

• Fri Feb 24 2006 Tomas Mraz <tmraz@redhat.com> - 4.3p2-3

  - enable the subprocess in chroot to send messages to system log
  - sshd should prevent login if audit call fails

• Tue Feb 21 2006 Tomas Mraz <tmraz@redhat.com> - 4.3p2-2

  - print error from scp if not remote (patch by Bjorn Augustsson #178923)

• Mon Feb 13 2006 Tomas Mraz <tmraz@redhat.com> - 4.3p2-1

  - new version

• Fri Feb 10 2006 Jesse Keating <jkeating@redhat.com> - 4.3p1-2.1

  - bump again for double-long bug on ppc(64)

• Mon Feb 06 2006 Tomas Mraz <tmraz@redhat.com> - 4.3p1-2

  - fixed another place where syslog was called in signal handler
  - pass locale environment variables to server, accept them there (#179851)

• Wed Feb 01 2006 Tomas Mraz <tmraz@redhat.com> - 4.3p1-1

  - new version, dropped obsolete patches

• Tue Dec 20 2005 Tomas Mraz <tmraz@redhat.com> - 4.2p1-10

  - hopefully make the askpass dialog less confusing (#174765)

• Fri Dec 09 2005 Jesse Keating <jkeating@redhat.com>

  - rebuilt

• Tue Nov 22 2005 Tomas Mraz <tmraz@redhat.com> - 4.2p1-9

  - drop x11-ssh-askpass from the package
  - drop old build_6x ifs from spec file
  - improve gnome-ssh-askpass so it doesn't reveal number of passphrase 
    characters to person looking at the display
  - less hackish fix for the __USE_GNU problem

• Fri Nov 18 2005 Nalin Dahyabhai <nalin@redhat.com> - 4.2p1-8

  - work around missing gccmakedep by wrapping makedepend in a local script
  - remove now-obsolete build dependency on "xauth"

• Thu Nov 17 2005 Warren Togami <wtogami@redhat.com> - 4.2p1-7

  - xorg-x11-devel -> libXt-devel
  - rebuild for new xauth location so X forwarding works
  - buildreq audit-libs-devel
  - buildreq automake for aclocal
  - buildreq imake for xmkmf
  -  -D_GNU_SOURCE in flags in order to get it to build
     Ugly hack to workaround openssh defining __USE_GNU which is
     not allowed and causes problems according to Ulrich Drepper
     fix this the correct way after FC5test1

• Wed Nov 09 2005 Jeremy Katz <katzj@redhat.com> - 4.2p1-6

  - rebuild against new openssl

• Fri Oct 28 2005 Tomas Mraz <tmraz@redhat.com> 4.2p1-5

  - put back the possibility to skip SELinux patch
  - add patch for user login auditing by Steve Grubb

• Tue Oct 18 2005 Dan Walsh <dwalsh@redhat.com> 4.2p1-4

  - Change selinux patch to use get_default_context_with_rolelevel in libselinux.

• Thu Oct 13 2005 Tomas Mraz <tmraz@redhat.com> 4.2p1-3

  - Update selinux patch to use getseuserbyname

• Fri Oct 07 2005 Tomas Mraz <tmraz@redhat.com> 4.2p1-2

  - use include instead of pam_stack in pam config
  - use fork+exec instead of system in scp - CVE-2006-0225 (#168167)
  - upstream patch for displaying authentication errors

• Tue Sep 06 2005 Tomas Mraz <tmraz@redhat.com> 4.2p1-1

  - upgrade to a new upstream version

• Tue Aug 16 2005 Tomas Mraz <tmraz@redhat.com> 4.1p1-5

  - use x11-ssh-askpass if openssh-askpass-gnome is not installed (#165207)
  - install ssh-copy-id from contrib (#88707)

• Wed Jul 27 2005 Tomas Mraz <tmraz@redhat.com> 4.1p1-4

  - don't deadlock on exit with multiple X forwarded channels (#152432)
  - don't use X11 port which can't be bound on all IP families (#163732)

• Wed Jun 29 2005 Tomas Mraz <tmraz@redhat.com> 4.1p1-3

  - fix small regression caused by the nologin patch (#161956)
  - fix race in getpeername error checking (mindrot #1054)

• Thu Jun 09 2005 Tomas Mraz <tmraz@redhat.com> 4.1p1-2

  - use only pam_nologin for nologin testing

• Mon Jun 06 2005 Tomas Mraz <tmraz@redhat.com> 4.1p1-1

  - upgrade to a new upstream version
  - call pam_loginuid as a pam session module

• Mon May 16 2005 Tomas Mraz <tmraz@redhat.com> 4.0p1-3

  - link libselinux only to sshd (#157678)

• Mon Apr 04 2005 Tomas Mraz <tmraz@redhat.com> 4.0p1-2

  - fixed Local/RemoteForward in ssh_config.5 manpage
  - fix fatal when Local/RemoteForward is used and scp run (#153258)
  - don't leak user validity when using krb5 authentication

• Thu Mar 24 2005 Tomas Mraz <tmraz@redhat.com> 4.0p1-1

  - upgrade to 4.0p1
  - remove obsolete groups patch

• Wed Mar 16 2005 Elliot Lee <sopwith@redhat.com>

  - rebuilt

• Mon Feb 28 2005 Nalin Dahyabhai <nalin@redhat.com> 3.9p1-12

  - rebuild so that configure can detect that krb5_init_ets is gone now

• Mon Feb 21 2005 Tomas Mraz <tmraz@redhat.com> 3.9p1-11

  - don't call syslog in signal handler
  - allow password authentication when copying from remote
    to remote machine (#103364)

• Wed Feb 09 2005 Tomas Mraz <tmraz@redhat.com>

  - add spaces to messages in initscript (#138508)

• Tue Feb 08 2005 Tomas Mraz <tmraz@redhat.com> 3.9p1-10

  - enable trusted forwarding by default if X11 forwarding is 
    required by user (#137685 and duplicates)
  - disable protocol 1 support by default in sshd server config (#88329)
  - keep the gnome-askpass dialog above others (#69131)

• Fri Feb 04 2005 Tomas Mraz <tmraz@redhat.com>

  - change permissions on pam.d/sshd to 0644 (#64697)
  - patch initscript so it doesn't kill opened sessions if
    the sshd daemon isn't running anymore (#67624)

• Mon Jan 03 2005 Bill Nottingham <notting@redhat.com> 3.9p1-9

  - don't use initlog

• Mon Nov 29 2004 Thomas Woerner <twoerner@redhat.com> 3.9p1-8.1

  - fixed PIE build for all architectures

• Mon Oct 04 2004 Nalin Dahyabhai <nalin@redhat.com> 3.9p1-8

  - add a --enable-vendor-patchlevel option which allows a ShowPatchLevel option
    to enable display of a vendor patch level during version exchange (#120285)
  - configure with --disable-strip to build useful debuginfo subpackages

• Mon Sep 20 2004 Bill Nottingham <notting@redhat.com> 3.9p1-7

  - when using gtk2 for askpass, don't buildprereq gnome-libs-devel

• Tue Sep 14 2004 Nalin Dahyabhai <nalin@redhat.com> 3.9p1-6

  - build

• Mon Sep 13 2004 Nalin Dahyabhai <nalin@redhat.com>

  - disable ACSS support

• Thu Sep 02 2004 Daniel Walsh <dwalsh@redhat.com> 3.9p1-5

  - Change selinux patch to use get_default_context_with_role in libselinux.

• Thu Sep 02 2004 Daniel Walsh <dwalsh@redhat.com> 3.9p1-4

  - Fix patch
  	* Bad debug statement.
  	* Handle root/sysadm_r:kerberos

• Thu Sep 02 2004 Daniel Walsh <dwalsh@redhat.com> 3.9p1-3

  - Modify Colin Walter's patch to allow specifying rule during connection

• Tue Aug 31 2004 Daniel Walsh <dwalsh@redhat.com> 3.9p1-2

  - Fix TTY handling for SELinux

• Tue Aug 24 2004 Daniel Walsh <dwalsh@redhat.com> 3.9p1-1

  - Update to upstream

• Sun Aug 01 2004 Alan Cox <alan@redhat.com> 3.8.1p1-5

  - Apply buildreq fixup patch (#125296)

• Tue Jun 15 2004 Daniel Walsh <dwalsh@redhat.com> 3.8.1p1-4

  - Clean up patch for upstream submission.

• Tue Jun 15 2004 Elliot Lee <sopwith@redhat.com>

  - rebuilt

• Wed Jun 09 2004 Daniel Walsh <dwalsh@redhat.com> 3.8.1p1-2

  - Remove use of pam_selinux and patch selinux in directly.

• Mon Jun 07 2004 Nalin Dahyabhai <nalin@redhat.com> 3.8.1p1-1

  - request gssapi-with-mic by default but not delegation (flag day for anyone
    who used previous gssapi patches)
  - no longer request x11 forwarding by default

• Thu Jun 03 2004 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-36

  - Change pam file to use open and close with pam_selinux

• Tue Jun 01 2004 Nalin Dahyabhai <nalin@redhat.com> 3.8.1p1-0

  - update to 3.8.1p1
  - add workaround from CVS to reintroduce passwordauth using pam

• Tue Jun 01 2004 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-35

  - Remove CLOSEXEC on STDERR

• Tue Mar 16 2004 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-34

  * Wed Mar 03 2004 Phil Knirsch <pknirsch@redhat.com> 3.6.1p2-33.30.1
  - Built RHLE3 U2 update package.

• Wed Mar 03 2004 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-33

  - Close file descriptors on exec

• Mon Mar 01 2004 Thomas Woerner <twoerner@redhat.com> 3.6.1p2-32

  - fixed pie build

• Thu Feb 26 2004 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-31

  - Add restorecon to startup scripts

• Thu Feb 26 2004 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-30

  - Add multiple qualified to openssh

• Mon Feb 23 2004 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-29

  - Eliminate selinux code and use pam_selinux

• Fri Feb 13 2004 Elliot Lee <sopwith@redhat.com>

  - rebuilt

• Mon Jan 26 2004 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-27

  - turn off pie on ppc

• Mon Jan 26 2004 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-26

  - fix is_selinux_enabled

• Wed Jan 14 2004 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-25

  - Rebuild to grab shared libselinux

• Wed Dec 03 2003 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-24

  - turn on selinux

• Tue Nov 18 2003 Nalin Dahyabhai <nalin@redhat.com>

  - un#ifdef out code for reporting password expiration in non-privsep
    mode (#83585)

• Mon Nov 10 2003 Nalin Dahyabhai <nalin@redhat.com>

  - add machinery to build with/without -fpie/-pie, default to doing so

• Thu Nov 06 2003 David Woodhouse <dwmw2@redhat.com> 3.6.1p2-23

  - Don't whinge about getsockopt failing (#109161)

• Fri Oct 24 2003 Nalin Dahyabhai <nalin@redhat.com>

  - add missing buildprereq on zlib-devel (#104558)

• Mon Oct 13 2003 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-22

  - turn selinux off

• Mon Oct 13 2003 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-21.sel

  - turn selinux on

• Fri Sep 19 2003 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-21

  - turn selinux off

• Fri Sep 19 2003 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-20.sel

  - turn selinux on

• Fri Sep 19 2003 Nalin Dahyabhai <nalin@redhat.com>

  - additional fix for apparently-never-happens double-free in buffer_free()
  - extend fix for #103998 to cover SSH1

• Wed Sep 17 2003 Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-19

  - rebuild

• Wed Sep 17 2003 Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-18

  - additional buffer manipulation cleanups from Solar Designer

• Wed Sep 17 2003 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-17

  - turn selinux off

• Wed Sep 17 2003 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-16.sel

  - turn selinux on

• Tue Sep 16 2003 Bill Nottingham <notting@redhat.com> 3.6.1p2-15

  - rebuild

• Tue Sep 16 2003 Bill Nottingham <notting@redhat.com> 3.6.1p2-14

  - additional buffer manipulation fixes (CAN-2003-0695)

• Tue Sep 16 2003 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-13.sel

  - turn selinux on

• Tue Sep 16 2003 Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-12

  - rebuild

• Tue Sep 16 2003 Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-11

  - apply patch to store the correct buffer size in allocated buffers
    (CAN-2003-0693)
  - skip the initial PAM authentication attempt with an empty password if
    empty passwords are not permitted in our configuration (#103998)

• Fri Sep 05 2003 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-10

  - turn selinux off

• Fri Sep 05 2003 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-9.sel

  - turn selinux on

• Tue Aug 26 2003 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-8

  - Add BuildPreReq gtk2-devel if gtk2

• Tue Aug 12 2003 Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-7

  - rebuild

• Tue Aug 12 2003 Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-6

  - modify patch which clears the supplemental group list at startup to only
    complain if setgroups() fails if sshd has euid == 0
  - handle krb5 installed in %{_prefix} or elsewhere by using krb5-config

• Mon Jul 28 2003 Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-5

  - Add SELinux patch

• Tue Jul 22 2003 Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-4

  - rebuild

• Wed Jul 16 2003 Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-3

  - rebuild

• Wed Jul 16 2003 Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-2

  - rebuild

• Thu Jun 05 2003 Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-1

  - update to 3.6.1p2

• Wed Jun 04 2003 Elliot Lee <sopwith@redhat.com>

  6 rebuilt

• Mon Mar 24 2003 Florian La Roche <Florian.LaRoche@redhat.de>

  - add patch for getsockopt() call to work on bigendian 64bit archs

• Fri Feb 14 2003 Nalin Dahyabhai <nalin@redhat.com> 3.5p1-6

  - move scp to the -clients subpackage, because it directly depends on ssh
    which is also in -clients (#84329)

• Mon Feb 10 2003 Nalin Dahyabhai <nalin@redhat.com> 3.5p1-5

  - rebuild

• Wed Jan 22 2003 Tim Powers <timp@redhat.com>

  - rebuilt

• Tue Jan 07 2003 Nalin Dahyabhai <nalin@redhat.com> 3.5p1-3

  - rebuild

• Tue Nov 12 2002 Nalin Dahyabhai <nalin@redhat.com> 3.5p1-2

  - patch PAM configuration to use relative path names for the modules, allowing
    us to not worry about which arch the modules are built for on multilib systems

• Tue Oct 15 2002 Nalin Dahyabhai <nalin@redhat.com> 3.5p1-1

  - update to 3.5p1, merging in filelist/perm changes from the upstream spec

• Fri Oct 04 2002 Nalin Dahyabhai <nalin@redhat.com> 3.4p1-3

  - merge

• Thu Sep 12 2002 Than Ngo <than@redhat.com> 3.4p1-2.1

  - fix to build on multilib systems

• Thu Aug 29 2002 Curtis Zinzilieta <curtisz@redhat.com> 3.4p1-2gss

  - added gssapi patches and uncommented patch here

• Wed Aug 14 2002 Nalin Dahyabhai <nalin@redhat.com> 3.4p1-2

  - pull patch from CVS to fix too-early free in ssh-keysign (#70009)

• Thu Jun 27 2002 Nalin Dahyabhai <nalin@redhat.com> 3.4p1-1

  - 3.4p1
  - drop anon mmap patch

• Tue Jun 25 2002 Nalin Dahyabhai <nalin@redhat.com> 3.3p1-2

  - rework the close-on-exit docs
  - include configuration file man pages
  - make use of nologin as the privsep shell optional

• Mon Jun 24 2002 Nalin Dahyabhai <nalin@redhat.com> 3.3p1-1

  - update to 3.3p1
  - merge in spec file changes from upstream (remove setuid from ssh, ssh-keysign)
  - disable gtk2 askpass
  - require pam-devel by filename rather than by package for erratum
  - include patch from Solar Designer to work around anonymous mmap failures

• Fri Jun 21 2002 Tim Powers <timp@redhat.com>

  - automated rebuild

• Fri Jun 07 2002 Nalin Dahyabhai <nalin@redhat.com> 3.2.3p1-3

  - don't require autoconf any more

• Fri May 31 2002 Nalin Dahyabhai <nalin@redhat.com> 3.2.3p1-2

  - build gnome-ssh-askpass with gtk2

• Tue May 28 2002 Nalin Dahyabhai <nalin@redhat.com> 3.2.3p1-1

  - update to 3.2.3p1
  - merge in spec file changes from upstream

• Fri May 17 2002 Nalin Dahyabhai <nalin@redhat.com> 3.2.2p1-1

  - update to 3.2.2p1

• Fri May 17 2002 Nalin Dahyabhai <nalin@redhat.com> 3.1p1-4

  - drop buildreq on db1-devel
  - require pam-devel by package name
  - require autoconf instead of autoconf253 again

• Tue Apr 02 2002 Nalin Dahyabhai <nalin@redhat.com> 3.1p1-3

  - pull patch from CVS to avoid printing error messages when some of the
    default keys aren't available when running ssh-add
  - refresh to current revisions of Simon's patches

• Thu Mar 21 2002 Nalin Dahyabhai <nalin@redhat.com> 3.1p1-2gss

  - reintroduce Simon's gssapi patches
  - add buildprereq for autoconf253, which is needed to regenerate configure
    after applying the gssapi patches
  - refresh to the latest version of Markus's patch to build properly with
    older versions of OpenSSL

• Thu Mar 07 2002 Nalin Dahyabhai <nalin@redhat.com> 3.1p1-2

  - bump and grind (through the build system)

• Thu Mar 07 2002 Nalin Dahyabhai <nalin@redhat.com> 3.1p1-1

  - require sharutils for building (mindrot #137)
  - require db1-devel only when building for 6.x (#55105), which probably won't
    work anyway (3.1 requires OpenSSL 0.9.6 to build), but what the heck
  - require pam-devel by file (not by package name) again
  - add Markus's patch to compile with OpenSSL 0.9.5a (from
    http://bugzilla.mindrot.org/show_bug.cgi?id=141) and apply it if we're
    building for 6.x

• Thu Mar 07 2002 Nalin Dahyabhai <nalin@redhat.com> 3.1p1-0

  - update to 3.1p1

• Tue Mar 05 2002 Nalin Dahyabhai <nalin@redhat.com> SNAP-20020305

  - update to SNAP-20020305
  - drop debug patch, fixed upstream

• Wed Feb 20 2002 Nalin Dahyabhai <nalin@redhat.com> SNAP-20020220

  - update to SNAP-20020220 for testing purposes (you've been warned, if there's
    anything to be warned about, gss patches won't apply, I don't mind)

• Wed Feb 13 2002 Nalin Dahyabhai <nalin@redhat.com> 3.0.2p1-3

  - add patches from Simon Wilkinson and Nicolas Williams for GSSAPI key
    exchange, authentication, and named key support

• Wed Jan 23 2002 Nalin Dahyabhai <nalin@redhat.com> 3.0.2p1-2

  - remove dependency on db1-devel, which has just been swallowed up whole
    by gnome-libs-devel

• Sat Dec 29 2001 Nalin Dahyabhai <nalin@redhat.com>

  - adjust build dependencies so that build6x actually works right (fix
    from Hugo van der Kooij)

• Tue Dec 04 2001 Nalin Dahyabhai <nalin@redhat.com> 3.0.2p1-1

  - update to 3.0.2p1

• Fri Nov 16 2001 Nalin Dahyabhai <nalin@redhat.com> 3.0.1p1-1

  - update to 3.0.1p1

• Tue Nov 13 2001 Nalin Dahyabhai <nalin@redhat.com>

  - update to current CVS (not for use in distribution)

• Thu Nov 08 2001 Nalin Dahyabhai <nalin@redhat.com> 3.0p1-1

  - merge some of Damien Miller <djm@mindrot.org> changes from the upstream
    3.0p1 spec file and init script

• Wed Nov 07 2001 Nalin Dahyabhai <nalin@redhat.com>

  - update to 3.0p1
  - update to x11-ssh-askpass 1.2.4.1
  - change build dependency on a file from pam-devel to the pam-devel package
  - replace primes with moduli

• Thu Sep 27 2001 Nalin Dahyabhai <nalin@redhat.com> 2.9p2-9

  - incorporate fix from Markus Friedl's advisory for IP-based authorization bugs

• Thu Sep 13 2001 Bernhard Rosenkraenzer <bero@redhat.com> 2.9p2-8

  - Merge changes to rescue build from current sysadmin survival cd

• Thu Sep 06 2001 Nalin Dahyabhai <nalin@redhat.com> 2.9p2-7

  - fix scp's server's reporting of file sizes, and build with the proper
    preprocessor define to get large-file capable open(), stat(), etc.
    (sftp has been doing this correctly all along) (#51827)
  - configure without --with-ipv4-default on RHL 7.x and newer (#45987,#52247)
  - pull cvs patch to fix support for /etc/nologin for non-PAM logins (#47298)
  - mark profile.d scriptlets as config files (#42337)
  - refer to Jason Stone's mail for zsh workaround for exit-hanging quasi-bug
  - change a couple of log() statements to debug() statements (#50751)
  - pull cvs patch to add -t flag to sshd (#28611)
  - clear fd_sets correctly (one bit per FD, not one byte per FD) (#43221)

• Mon Aug 20 2001 Nalin Dahyabhai <nalin@redhat.com> 2.9p2-6

  - add db1-devel as a BuildPrerequisite (noted by Hans Ecke)

• Thu Aug 16 2001 Nalin Dahyabhai <nalin@redhat.com>

  - pull cvs patch to fix remote port forwarding with protocol 2

• Thu Aug 09 2001 Nalin Dahyabhai <nalin@redhat.com>

  - pull cvs patch to add session initialization to no-pty sessions
  - pull cvs patch to not cut off challengeresponse auth needlessly
  - refuse to do X11 forwarding if xauth isn't there, handy if you enable
    it by default on a system that doesn't have X installed (#49263)

• Wed Aug 08 2001 Nalin Dahyabhai <nalin@redhat.com>

  - don't apply patches to code we don't intend to build (spotted by Matt Galgoci)

• Mon Aug 06 2001 Nalin Dahyabhai <nalin@redhat.com>

  - pass OPTIONS correctly to initlog (#50151)

• Wed Jul 25 2001 Nalin Dahyabhai <nalin@redhat.com>

  - switch to x11-ssh-askpass 1.2.2

• Wed Jul 11 2001 Nalin Dahyabhai <nalin@redhat.com>

  - rebuild in new environment

• Mon Jun 25 2001 Nalin Dahyabhai <nalin@redhat.com>

  - disable the gssapi patch

• Mon Jun 18 2001 Nalin Dahyabhai <nalin@redhat.com>

  - update to 2.9p2
  - refresh to a new version of the gssapi patch

• Thu Jun 07 2001 Nalin Dahyabhai <nalin@redhat.com>

  - change Copyright: BSD to License: BSD
  - add Markus Friedl's unverified patch for the cookie file deletion problem
    so that we can verify it
  - drop patch to check if xauth is present (was folded into cookie patch)
  - don't apply gssapi patches for the errata candidate
  - clear supplemental groups list at startup

• Fri May 25 2001 Nalin Dahyabhai <nalin@redhat.com>

  - fix an error parsing the new default sshd_config
  - add a fix from Markus Friedl (via openssh-unix-dev) for ssh-keygen not
    dealing with comments right

• Thu May 24 2001 Nalin Dahyabhai <nalin@redhat.com>

  - add in Simon Wilkinson's GSSAPI patch to give it some testing in-house,
    to be removed before the next beta cycle because it's a big departure
    from the upstream version

• Thu May 03 2001 Nalin Dahyabhai <nalin@redhat.com>

  - finish marking strings in the init script for translation
  - modify init script to source /etc/sysconfig/sshd and pass $OPTIONS to sshd
    at startup (change merged from openssh.com init script, originally by
    Pekka Savola)
  - refuse to do X11 forwarding if xauth isn't there, handy if you enable
    it by default on a system that doesn't have X installed

• Wed May 02 2001 Nalin Dahyabhai <nalin@redhat.com>

  - update to 2.9
  - drop various patches that came from or went upstream or to or from CVS

• Wed Apr 18 2001 Nalin Dahyabhai <nalin@redhat.com>

  - only require initscripts 5.00 on 6.2 (reported by Peter Bieringer)

• Sun Apr 08 2001 Preston Brown <pbrown@redhat.com>

  - remove explicit openssl requirement, fixes builddistro issue
  - make initscript stop() function wait until sshd really dead to avoid 
    races in condrestart

• Mon Apr 02 2001 Nalin Dahyabhai <nalin@redhat.com>

  - mention that challengereponse supports PAM, so disabling password doesn't
    limit users to pubkey and rsa auth (#34378)
  - bypass the daemon() function in the init script and call initlog directly,
    because daemon() won't start a daemon it detects is already running (like
    open connections)
  - require the version of openssl we had when we were built

• Fri Mar 23 2001 Nalin Dahyabhai <nalin@redhat.com>

  - make do_pam_setcred() smart enough to know when to establish creds and
    when to reinitialize them
  - add in a couple of other fixes from Damien for inclusion in the errata

• Thu Mar 22 2001 Nalin Dahyabhai <nalin@redhat.com>

  - update to 2.5.2p2
  - call setcred() again after initgroups, because the "creds" could actually
    be group memberships

• Tue Mar 20 2001 Nalin Dahyabhai <nalin@redhat.com>

  - update to 2.5.2p1 (includes endianness fixes in the rijndael implementation)
  - don't enable challenge-response by default until we find a way to not
    have too many userauth requests (we may make up to six pubkey and up to
    three password attempts as it is)
  - remove build dependency on rsh to match openssh.com's packages more closely

• Sat Mar 03 2001 Nalin Dahyabhai <nalin@redhat.com>

  - remove dependency on openssl -- would need to be too precise

• Fri Mar 02 2001 Nalin Dahyabhai <nalin@redhat.com>

  - rebuild in new environment

• Mon Feb 26 2001 Nalin Dahyabhai <nalin@redhat.com>

  - Revert the patch to move pam_open_session.
  - Init script and spec file changes from Pekka Savola. (#28750)
  - Patch sftp to recognize '-o protocol' arguments. (#29540)

• Thu Feb 22 2001 Nalin Dahyabhai <nalin@redhat.com>

  - Chuck the closing patch.
  - Add a trigger to add host keys for protocol 2 to the config file, now that
    configuration file syntax requires us to specify it with HostKey if we
    specify any other HostKey values, which we do.

• Tue Feb 20 2001 Nalin Dahyabhai <nalin@redhat.com>

  - Redo patch to move pam_open_session after the server setuid()s to the user.
  - Rework the nopam patch to use be picked up by autoconf.

• Mon Feb 19 2001 Nalin Dahyabhai <nalin@redhat.com>

  - Update for 2.5.1p1.
  - Add init script mods from Pekka Savola.
  - Tweak the init script to match the CVS contrib script more closely.
  - Redo patch to ssh-add to try to adding both identity and id_dsa to also try
    adding id_rsa.

• Fri Feb 16 2001 Nalin Dahyabhai <nalin@redhat.com>

  - Update for 2.5.0p1.
  - Use $RPM_OPT_FLAGS instead of -O when building gnome-ssh-askpass
  - Resync with parts of Damien Miller's openssh.spec from CVS, including
    update of x11 askpass to 1.2.0.
  - Only require openssl (don't prereq) because we generate keys in the init
    script now.

• Tue Feb 13 2001 Nalin Dahyabhai <nalin@redhat.com>

  - Don't open a PAM session until we've forked and become the user (#25690).
  - Apply Andrew Bartlett's patch for letting pam_authenticate() know which
    host the user is attempting a login from.
  - Resync with parts of Damien Miller's openssh.spec from CVS.
  - Don't expose KbdInt responses in debug messages (from CVS).
  - Detect and handle errors in rsa_{public,private}_decrypt (from CVS).

• Wed Feb 07 2001 Trond Eivind Glomsrxd <teg@redhat.com>

  - i18n-tweak to initscript.

• Tue Jan 23 2001 Nalin Dahyabhai <nalin@redhat.com>

  - More gettextizing.
  - Close all files after going into daemon mode (needs more testing).
  - Extract patch from CVS to handle auth banners (in the client).
  - Extract patch from CVS to handle compat weirdness.

• Fri Jan 19 2001 Nalin Dahyabhai <nalin@redhat.com>

  - Finish with the gettextizing.

• Thu Jan 18 2001 Nalin Dahyabhai <nalin@redhat.com>

  - Fix a bug in auth2-pam.c (#23877)
  - Gettextize the init script.

• Wed Dec 20 2000 Nalin Dahyabhai <nalin@redhat.com>

  - Incorporate a switch for using PAM configs for 6.x, just in case.

• Tue Dec 05 2000 Nalin Dahyabhai <nalin@redhat.com>

  - Incorporate Bero's changes for a build specifically for rescue CDs.

• Wed Nov 29 2000 Nalin Dahyabhai <nalin@redhat.com>

  - Don't treat pam_setcred() failure as fatal unless pam_authenticate() has
    succeeded, to allow public-key authentication after a failure with "none"
    authentication.  (#21268)

• Tue Nov 28 2000 Nalin Dahyabhai <nalin@redhat.com>

  - Update to x11-askpass 1.1.1. (#21301)
  - Don't second-guess fixpaths, which causes paths to get fixed twice. (#21290)

• Mon Nov 27 2000 Nalin Dahyabhai <nalin@redhat.com>

  - Merge multiple PAM text messages into subsequent prompts when possible when
    doing keyboard-interactive authentication.

• Sun Nov 26 2000 Nalin Dahyabhai <nalin@redhat.com>

  - Disable the built-in MD5 password support.  We're using PAM.
  - Take a crack at doing keyboard-interactive authentication with PAM, and
    enable use of it in the default client configuration so that the client
    will try it when the server disallows password authentication.
  - Build with debugging flags.  Build root policies strip all binaries anyway.

• Tue Nov 21 2000 Nalin Dahyabhai <nalin@redhat.com>

  - Use DESTDIR instead of %makeinstall.
  - Remove /usr/X11R6/bin from the path-fixing patch.

• Mon Nov 20 2000 Nalin Dahyabhai <nalin@redhat.com>

  - Add the primes file from the latest snapshot to the main package (#20884).
  - Add the dev package to the prereq list (#19984).
  - Remove the default path and mimic login's behavior in the server itself.

• Fri Nov 17 2000 Nalin Dahyabhai <nalin@redhat.com>

  - Resync with conditional options in Damien Miller's .spec file for an errata.
  - Change libexecdir from %{_libexecdir}/ssh to %{_libexecdir}/openssh.

• Tue Nov 07 2000 Nalin Dahyabhai <nalin@redhat.com>

  - Update to OpenSSH 2.3.0p1.
  - Update to x11-askpass 1.1.0.
  - Enable keyboard-interactive authentication.

• Mon Oct 30 2000 Nalin Dahyabhai <nalin@redhat.com>

  - Update to ssh-askpass-x11 1.0.3.
  - Change authentication related messages to be private (#19966).

• Tue Oct 10 2000 Nalin Dahyabhai <nalin@redhat.com>

  - Patch ssh-keygen to be able to list signatures for DSA public key files
    it generates.

• Thu Oct 05 2000 Nalin Dahyabhai <nalin@redhat.com>

  - Add BuildPreReq on /usr/include/security/pam_appl.h to be sure we always
    build PAM authentication in.
  - Try setting SSH_ASKPASS if gnome-ssh-askpass is installed.
  - Clean out no-longer-used patches.
  - Patch ssh-add to try to add both identity and id_dsa, and to error only
    when neither exists.

• Mon Oct 02 2000 Nalin Dahyabhai <nalin@redhat.com>

  - Update x11-askpass to 1.0.2. (#17835)
  - Add BuildPreReqs for /bin/login and /usr/bin/rsh so that configure will
    always find them in the right place. (#17909)
  - Set the default path to be the same as the one supplied by /bin/login, but
    add /usr/X11R6/bin. (#17909)
  - Try to handle obsoletion of ssh-server more cleanly.  Package names
    are different, but init script name isn't. (#17865)

• Wed Sep 06 2000 Nalin Dahyabhai <nalin@redhat.com>

  - Update to 2.2.0p1. (#17835)
  - Tweak the init script to allow proper restarting. (#18023)

• Wed Aug 23 2000 Nalin Dahyabhai <nalin@redhat.com>

  - Update to 20000823 snapshot.
  - Change subpackage requirements from %{version} to %{version}-%{release}
  - Back out the pipe patch.

• Mon Jul 17 2000 Nalin Dahyabhai <nalin@redhat.com>

  - Update to 2.1.1p4, which includes fixes for config file parsing problems.
  - Move the init script back.
  - Add Damien's quick fix for wackiness.

• Wed Jul 12 2000 Nalin Dahyabhai <nalin@redhat.com>

  - Update to 2.1.1p3, which includes fixes for X11 forwarding and strtok().

• Thu Jul 06 2000 Nalin Dahyabhai <nalin@redhat.com>

  - Move condrestart to server postun.
  - Move key generation to init script.
  - Actually use the right patch for moving the key generation to the init script.
  - Clean up the init script a bit.

• Wed Jul 05 2000 Nalin Dahyabhai <nalin@redhat.com>

  - Fix X11 forwarding, from mail post by Chan Shih-Ping Richard.

• Sun Jul 02 2000 Nalin Dahyabhai <nalin@redhat.com>

  - Update to 2.1.1p2.
  - Use of strtok() considered harmful.

• Sat Jul 01 2000 Nalin Dahyabhai <nalin@redhat.com>

  - Get the build root out of the man pages.

• Thu Jun 29 2000 Nalin Dahyabhai <nalin@redhat.com>

  - Add and use condrestart support in the init script.
  - Add newer initscripts as a prereq.

• Tue Jun 27 2000 Nalin Dahyabhai <nalin@redhat.com>

  - Build in new environment (release 2)
  - Move -clients subpackage to Applications/Internet group

• Fri Jun 09 2000 Nalin Dahyabhai <nalin@redhat.com>

  - Update to 2.2.1p1

• Sat Jun 03 2000 Nalin Dahyabhai <nalin@redhat.com>

  - Patch to build with neither RSA nor RSAref.
  - Miscellaneous FHS-compliance tweaks.
  - Fix for possibly-compressed man pages.

• Wed Mar 15 2000 Damien Miller <djm@ibs.com.au>

  - Updated for new location
  - Updated for new gnome-ssh-askpass build

• Sun Dec 26 1999 Damien Miller <djm@mindrot.org>

  - Added Jim Knoble's <jmknoble@pobox.com> askpass

• Mon Nov 15 1999 Damien Miller <djm@mindrot.org>

  - Split subpackages further based on patch from jim knoble <jmknoble@pobox.com>

• Sat Nov 13 1999 Damien Miller <djm@mindrot.org>

  - Added 'Obsoletes' directives

• Tue Nov 09 1999 Damien Miller <djm@ibs.com.au>

  - Use make install
  - Subpackages

• Mon Nov 08 1999 Damien Miller <djm@ibs.com.au>

  - Added links for slogin
  - Fixed perms on manpages

• Sat Oct 30 1999 Damien Miller <djm@ibs.com.au>

  - Renamed init script

• Fri Oct 29 1999 Damien Miller <djm@ibs.com.au>

  - Back to old binary names

• Thu Oct 28 1999 Damien Miller <djm@ibs.com.au>

  - Use autoconf
  - New binary names

• Wed Oct 27 1999 Damien Miller <djm@ibs.com.au>

  - Initial RPMification, based on Jan "Yenya" Kasprzak's <kas@fi.muni.cz> spec.