1.2.3-1 package for Debian GNU/Linux released

[Philip Hands]

Damien Miller <djm at mindrot.org> writes:

> On 14 Apr 2000, Philip Hands wrote:
> 
> > Hi,
> > 
> > I just got round to releasing 1.2.3 Debian package (which should
> > hopefully make it into the freeze for Debian 2.2, aka potato)
> > 
> > It should hit the Debian non-US mirrors soon, but if you cannot wait,
> > it's also here:
> > 
> >   http://www.hands.com/~phil/debian/openssh/
> > 
> > [ Damien, you might want to check out the patch, its got a few things
> >   that should probably go upstream.  I'll annotate it if you need me
> >   to, so just ask.                                                    ]
> 
> Got it - a couple of questions / comments:
> 
> 1. I evidently don't speak Makefile jive as well as some - what does
> the following change do?
> 
> -all: $(TARGETS) $(MANPAGES) $(CONFIGFILES)
> +all: $(TARGETS) $(MANPAGES:%=%.out) $(CONFIGFILES:%=%.out)

This means tack .out on the end of all the individual file names, so
if $(MANPAGES) is ``ssh.1 sshd.8'' then $(MANPAGES:%=%.out) is
``ssh.1.out sshd.8.out''

This means that when they are later generated, it's the target file
that you're depending upon, not the source, which makes the
dependencies work properly (or that's the way i remember it, it's a
while since I wrote it).

> 2. Why the vhangup() in pty.c? What does this fix?

http://cgi.debian.org/cgi-bin/bugreport.cgi?archive=no&bug=55379

> 3. Why the excision of the BUF code in scp.c?

http://cgi.debian.org/cgi-bin/bugreport.cgi?archive=no&bug=53697
and
http://cgi.debian.org/cgi-bin/bugreport.cgi?archive=no&bug=52071

> 4. I would prefer the shadow password checking to occur during
> password auth - I consider the other forms of auth to be totally
> seperate, but I can see your reasoning.

Yeah, it's a shame that we need to mix them up, but without this you
don't get account expiry, locked accounts etc. which leaves ssh as a
loophole.

> If you move this code to a seperate function in auth-passwd.c which
> could be called before or during password auth I will include it.

OK.

BTW you might want to quickly scan the (embarrassingly vast) list of
bugs reported against Debian ssh:

  http://www.debian.org/Bugs/db/pa/lssh.html

I've been rather busy with the day job lately, so have not been doing
much about these.  At first glance, many of them are pretty valid
upstream problems, so if you want to deal with some of them direct,
mail me the numbers and I'll mark them as forwarded (so we don't end
up duplicating effort).

Cheers, Phil.
-- 
Mind-numbingly stupid UK law alert!
Act now to stop it http://www.stand.org.uk/