From whn at lopi.com  Sun Feb  1 23:52:26 2015
From: whn at lopi.com (Bill Nugent)
Date: Sun, 01 Feb 2015 07:52:26 -0500
Subject: Filtering which identities are forwarded by ssh-agent to a given host
Message-ID: <38456115.BgVG85xq9M@psycho-grande>

Howdy,

I'm looking for a way to restrict which ssh keys are forwarded to a 
given remote host because we have several ssh domains.  That is, I have 
two keys which I use throughout the day:
  .ssh/network-a-2014-10-12
  .ssh/network-b-2014-11-22

I need to forward my network A key to the ssh gateway host for Network A
to allow me to log into hosts on the other side of the gateway but I 
can't have the key for Network B to be forwarded.  Similar thing for 
Network B.  Deleting and adding is painful at best.  I've experimented 
with IdentiesOnly=yes and IdentityFiles but on the network A gateway I 
still see all of my loaded keys including Network B.  Is there a way to 
do this already?  If not, would a Buzilla enhancement request be 
welcome?  Perhaps requesting something along the lines of:

Host network-a-gateway.example.com
        ForwardIdentity      .ssh/network-a-2014-10-12
and allow additional ForwardIndenty to allow additional keys.

        Thank you,
        Bill

From alon.barlev at gmail.com  Mon Feb  2 00:05:07 2015
From: alon.barlev at gmail.com (Alon Bar-Lev)
Date: Sun, 1 Feb 2015 15:05:07 +0200
Subject: Filtering which identities are forwarded by ssh-agent to a given
 host
In-Reply-To: <38456115.BgVG85xq9M@psycho-grande>
References: <38456115.BgVG85xq9M@psycho-grande>
Message-ID: <CAOazyz3tC3QpcNu0rZnvbo-RVrfY1BznyFPaGTB11mJcMHbLOQ@mail.gmail.com>

On Sun, Feb 1, 2015 at 2:52 PM, Bill Nugent <whn at lopi.com> wrote:
>
> Howdy,
>
> I'm looking for a way to restrict which ssh keys are forwarded to a
> given remote host because we have several ssh domains.  That is, I have
> two keys which I use throughout the day:
>   .ssh/network-a-2014-10-12
>   .ssh/network-b-2014-11-22

I think best is to run two agents, load keys of each network to each
agent and at that context use ssh.

>
> I need to forward my network A key to the ssh gateway host for Network A
> to allow me to log into hosts on the other side of the gateway but I
> can't have the key for Network B to be forwarded.  Similar thing for
> Network B.  Deleting and adding is painful at best.  I've experimented
> with IdentiesOnly=yes and IdentityFiles but on the network A gateway I
> still see all of my loaded keys including Network B.  Is there a way to
> do this already?  If not, would a Buzilla enhancement request be
> welcome?  Perhaps requesting something along the lines of:
>
> Host network-a-gateway.example.com
>         ForwardIdentity      .ssh/network-a-2014-10-12
> and allow additional ForwardIndenty to allow additional keys.

Maybe a simpler and more secure alternative can be having
AgentEnvironmentKey or something similar to enable ssh to use multiple
agents based on the Host's ssh_config, so you actually refer to agent
and not specific keys that are shared within single agent.

>
>         Thank you,
>         Bill
> _______________________________________________
> openssh-unix-dev mailing list
> openssh-unix-dev at mindrot.org
> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev

From keisial at gmail.com  Mon Feb  2 06:15:01 2015
From: keisial at gmail.com (=?ISO-8859-1?Q?=C1ngel_Gonz=E1lez?=)
Date: Sun, 01 Feb 2015 20:15:01 +0100
Subject: Filtering which identities are forwarded by ssh-agent to a given
 host
In-Reply-To: <38456115.BgVG85xq9M@psycho-grande>
References: <38456115.BgVG85xq9M@psycho-grande>
Message-ID: <54CE7B35.8060805@gmail.com>

On 01/02/15 13:52, Bill Nugent wrote:
> Howdy,
>
> I'm looking for a way to restrict which ssh keys are forwarded to a
> given remote host because we have several ssh domains.  That is, I have
> two keys which I use throughout the day:
>    .ssh/network-a-2014-10-12
>    .ssh/network-b-2014-11-22
>
> I need to forward my network A key to the ssh gateway host for Network A
> to allow me to log into hosts on the other side of the gateway but I
> can't have the key for Network B to be forwarded.  Similar thing for
> Network B.  Deleting and adding is painful at best.  I've experimented
> with IdentiesOnly=yes and IdentityFiles but on the network A gateway I
> still see all of my loaded keys including Network B.  Is there a way to
> do this already?  If not, would a Buzilla enhancement request be
> welcome?  Perhaps requesting something along the lines of:
In addition of using two agents, you can stop forwarding your keys to 
the gateway.
Instead, use a ProxyCommand to locally establish the connection to the 
hosts inside
(you will pass through the gateway, but the ssh process is local, and 
will honor your
IdentityFile setting). The problem was that the IdentityFile was being 
honored by
the ssh at the gateway host, the agent doesn't have that knowledge.

Cheers


From djm at mindrot.org  Mon Feb  2 10:18:54 2015
From: djm at mindrot.org (Damien Miller)
Date: Mon, 2 Feb 2015 10:18:54 +1100 (AEDT)
Subject: Filtering which identities are forwarded by ssh-agent to a given
 host
In-Reply-To: <38456115.BgVG85xq9M@psycho-grande>
References: <38456115.BgVG85xq9M@psycho-grande>
Message-ID: <alpine.BSO.2.11.1502021010020.18678@natsu.mindrot.org>

On Sun, 1 Feb 2015, Bill Nugent wrote:

> Howdy,
> 
> I'm looking for a way to restrict which ssh keys are forwarded to a 
> given remote host because we have several ssh domains.  That is, I have 
> two keys which I use throughout the day:
>   .ssh/network-a-2014-10-12
>   .ssh/network-b-2014-11-22
> 
> I need to forward my network A key to the ssh gateway host for Network A
> to allow me to log into hosts on the other side of the gateway but I 
> can't have the key for Network B to be forwarded.  Similar thing for 
> Network B.  Deleting and adding is painful at best.  I've experimented 
> with IdentiesOnly=yes and IdentityFiles but on the network A gateway I 
> still see all of my loaded keys including Network B.  Is there a way to 
> do this already?  If not, would a Buzilla enhancement request be 
> welcome?  Perhaps requesting something along the lines of:
> 
> Host network-a-gateway.example.com
>         ForwardIdentity      .ssh/network-a-2014-10-12
> and allow additional ForwardIndenty to allow additional keys.

It's not possible to do this unfortunately, but is a feature that I've
wanted for a long time. Implementing it required teaching ssh enough
of the agent protocol to filter requests sent through it, and doing
it exactly right so that users' agents aren't exposed when they connect
to a malicious server - so it's not without risk.

I'd still like to implement it one day, but I'm not likely to get to
it any time soon (I can't speak for the other developers). 

OTOH you could probably write an "agent proxy" pretty easily that
presented it's own SSH_AUTH_SOCK to ssh and massaged the requests
and replies going through it to the real agent. E.g.

agentproxy -i ~/.ssh/id_rsa_xyzzy.pub ssh -tt xyzzy-bastion ssh xyzzy

This way you get to write it in the language of your choice :)

The agent protocol is pretty simple and is documented in the
PROTOCOL.agent file in the OpenSSH distribution, or at
https://anongit.mindrot.org/openssh.git/plain/PROTOCOL.agent

-d

From keisial at gmail.com  Mon Feb  2 10:48:30 2015
From: keisial at gmail.com (=?ISO-8859-1?Q?=C1ngel_Gonz=E1lez?=)
Date: Mon, 02 Feb 2015 00:48:30 +0100
Subject: Filtering which identities are forwarded by ssh-agent to a given
 host
In-Reply-To: <alpine.BSO.2.11.1502021010020.18678@natsu.mindrot.org>
References: <38456115.BgVG85xq9M@psycho-grande>
 <alpine.BSO.2.11.1502021010020.18678@natsu.mindrot.org>
Message-ID: <54CEBB4E.5000009@gmail.com>

On 02/02/15 00:18, Damien Miller wrote:
> On Sun, 1 Feb 2015, Bill Nugent wrote:
>> Host network-a-gateway.example.com
>>          ForwardIdentity      .ssh/network-a-2014-10-12
>> and allow additional ForwardIndenty to allow additional keys.
> It's not possible to do this unfortunately, but is a feature that I've
> wanted for a long time. Implementing it required teaching ssh enough
> of the agent protocol to filter requests sent through it, and doing
> it exactly right so that users' agents aren't exposed when they connect
> to a malicious server - so it's not without risk.
IMHO the way to go is not teach ssh the agent protocol, but modify the 
agent
protocol so that each request gets prepended the hostname requesting it
(forwarded connections would contain the full chain)

Then the agent itself would decide which keys to expose to such host.
"foo is available for any host", "Provide network-a-key only to
ssh.network-a.com and anything that passed through ssh.network-a.com."
"Key bar is shown to all hosts but a confirmation dialog will be shown 
to the user
pointing at the host requesting it.", and so on.

Regards


From djm at mindrot.org  Mon Feb  2 13:53:44 2015
From: djm at mindrot.org (Damien Miller)
Date: Mon, 2 Feb 2015 13:53:44 +1100 (AEDT)
Subject: Filtering which identities are forwarded by ssh-agent to a given
 host
In-Reply-To: <54CEBB4E.5000009@gmail.com>
References: <38456115.BgVG85xq9M@psycho-grande>
 <alpine.BSO.2.11.1502021010020.18678@natsu.mindrot.org>
 <54CEBB4E.5000009@gmail.com>
Message-ID: <alpine.BSO.2.11.1502021349280.18678@natsu.mindrot.org>

On Mon, 2 Feb 2015, ?ngel Gonz?lez wrote:

> IMHO the way to go is not teach ssh the agent protocol, but modify the agent
> protocol so that each request gets prepended the hostname requesting it
> (forwarded connections would contain the full chain)

Then you have to modify all of ssh, sshd and ssh-agent and doesn't
work until they are all upgraded.

Moreover, unless you include signing (by the hostkey) for forwarded hops
and verification of same at the agent side, then you can't trust anything
past the first hop.

That doesn't seem any easier to deploy or to get right (the hostkey
signing would be particularly scary).

-d

From de.techno at gmail.com  Tue Feb  3 01:58:00 2015
From: de.techno at gmail.com (dE)
Date: Mon, 02 Feb 2015 20:28:00 +0530
Subject: Fwd: sftp buggy put command
In-Reply-To: <54CC8632.1010602@gmail.com>
References: <54CC8632.1010602@gmail.com>
Message-ID: <54CF9078.4000007@gmail.com>

Hi!

I was tying out the put command with version 6.7_p1 of OpenSSH.

If I use recursive copying, sftp expects the last directory in the
<source> exists in the destination (on the server), otherwise ?Couldn't
canonicalize: No such file or directory?.

I would've taken this to be the expected behavior, but get command does
not have this problem. It makes the destination directory in the client
like with cp.

So kindly take a look at this.



From kinnalru at gmail.com  Tue Feb  3 04:22:10 2015
From: kinnalru at gmail.com (Yuri Samoilenko)
Date: Mon, 2 Feb 2015 21:22:10 +0400
Subject: pkcs11 C_Login improvements
Message-ID: <CAJTRBLrVa+T3tCKkzEjZWtp=64dxCa1Afe50K-cpMZ=0saO5+Q@mail.gmail.com>

Hello.
I'am using openssh with custom pkcs11 library and I have reach a little
issue in result code handling. C_Login function from pkcs11 specification
can return CKR_USER_ALREADY_LOGGED_IN code which is not an error, but
openssh expects only CKA_OK. There is an patch to fix this.

diff --git a/ssh-pkcs11.c b/ssh-pkcs11.c
index c49cbf4..1b236a6 100644
--- a/ssh-pkcs11.c
+++ b/ssh-pkcs11.c
@@ -263,8 +263,9 @@ pkcs11_rsa_private_encrypt(int flen, const u_char
*from, u_char *to, RSA *rsa,
                pin = read_passphrase(prompt, RP_ALLOW_EOF);
                if (pin == NULL)
                        return (-1);    /* bail out */
-               if ((rv = f->C_Login(si->session, CKU_USER,
-                   (u_char *)pin, strlen(pin))) != CKR_OK) {
+               rv = f->C_Login(si->session, CKU_USER,
+                   (u_char *)pin, strlen(pin));
+               if (rv != CKR_OK && rv != CKR_USER_ALREADY_LOGGED_IN) {
                        free(pin);
                        error("C_Login failed: %lu", rv);
                        return (-1);

From imorgan at nas.nasa.gov  Tue Feb  3 08:13:33 2015
From: imorgan at nas.nasa.gov (Iain Morgan)
Date: Mon, 2 Feb 2015 13:13:33 -0800
Subject: Fwd: sftp buggy put command
In-Reply-To: <54CF9078.4000007@gmail.com>
References: <54CC8632.1010602@gmail.com>
 <54CF9078.4000007@gmail.com>
Message-ID: <20150202211333.GA6608@linux124.nas.nasa.gov>

On Mon, Feb 02, 2015 at 20:28:00 +0530, dE wrote:
> Hi!
> 
> I was tying out the put command with version 6.7_p1 of OpenSSH.
> 
> If I use recursive copying, sftp expects the last directory in the
> <source> exists in the destination (on the server), otherwise ?Couldn't
> canonicalize: No such file or directory?.
> 
> I would've taken this to be the expected behavior, but get command does
> not have this problem. It makes the destination directory in the client
> like with cp.
> 
> So kindly take a look at this.
> 
> 
> _______________________________________________
> openssh-unix-dev mailing list
> openssh-unix-dev at mindrot.org
> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev

This has already been noted as a bug[1][2], but hasn't been addresed
yet. I filed the original bug, but had other priorites, and then forgot
about the issue. I'll take another look at this when I get some time.

[1] https://bugzilla.mindrot.org/show_bug.cgi?id=2150
[2] https://bugzilla.mindrot.org/show_bug.cgi?id=2230

-- 
Iain Morgan

From djm at mindrot.org  Tue Feb  3 09:31:25 2015
From: djm at mindrot.org (Damien Miller)
Date: Tue, 3 Feb 2015 09:31:25 +1100 (AEDT)
Subject: pkcs11 C_Login improvements
In-Reply-To: <CAJTRBLrVa+T3tCKkzEjZWtp=64dxCa1Afe50K-cpMZ=0saO5+Q@mail.gmail.com>
References: <CAJTRBLrVa+T3tCKkzEjZWtp=64dxCa1Afe50K-cpMZ=0saO5+Q@mail.gmail.com>
Message-ID: <alpine.BSO.2.11.1502030930250.15814@natsu.mindrot.org>

On Mon, 2 Feb 2015, Yuri Samoilenko wrote:

> Hello.
> I'am using openssh with custom pkcs11 library and I have reach a little
> issue in result code handling. C_Login function from pkcs11 specification
> can return CKR_USER_ALREADY_LOGGED_IN code which is not an error, but
> openssh expects only CKA_OK. There is an patch to fix this.

Thanks, that looks reasonable. There's actually one more place where
this could conceivably happen:

diff --git a/ssh-pkcs11.c b/ssh-pkcs11.c
index 1d8135d..4ee948f 100644
--- a/ssh-pkcs11.c
+++ b/ssh-pkcs11.c
@@ -254,8 +254,9 @@ pkcs11_rsa_private_encrypt(int flen, const u_char *from, u_char *to, RSA *rsa,
 		pin = read_passphrase(prompt, RP_ALLOW_EOF);
 		if (pin == NULL)
 			return (-1);	/* bail out */
-		if ((rv = f->C_Login(si->session, CKU_USER,
-		    (u_char *)pin, strlen(pin))) != CKR_OK) {
+		rv = f->C_Login(si->session, CKU_USER,
+		    (u_char *)pin, strlen(pin));
+		if (rv != CKR_OK && rv != CKR_USER_ALREADY_LOGGED_IN) {
 			free(pin);
 			error("C_Login failed: %lu", rv);
 			return (-1);
@@ -357,8 +358,9 @@ pkcs11_open_session(struct pkcs11_provider *p, CK_ULONG slotidx, char *pin)
 		return (-1);
 	}
 	if (login_required && pin) {
-		if ((rv = f->C_Login(session, CKU_USER,
-		    (u_char *)pin, strlen(pin))) != CKR_OK) {
+		rv = f->C_Login(session, CKU_USER,
+		    (u_char *)pin, strlen(pin))
+		if (rv != CKR_OK && rv != CKR_USER_ALREADY_LOGGED_IN) {
 			error("C_Login failed: %lu", rv);
 			if ((rv = f->C_CloseSession(session)) != CKR_OK)
 				error("C_CloseSession failed: %lu", rv);

From keisial at gmail.com  Wed Feb  4 09:27:28 2015
From: keisial at gmail.com (=?ISO-8859-1?Q?=C1ngel_Gonz=E1lez?=)
Date: Tue, 03 Feb 2015 23:27:28 +0100
Subject: Filtering which identities are forwarded by ssh-agent to a given
 host
In-Reply-To: <alpine.BSO.2.11.1502021349280.18678@natsu.mindrot.org>
References: <38456115.BgVG85xq9M@psycho-grande>
 <alpine.BSO.2.11.1502021010020.18678@natsu.mindrot.org>
 <54CEBB4E.5000009@gmail.com>
 <alpine.BSO.2.11.1502021349280.18678@natsu.mindrot.org>
Message-ID: <54D14B50.20006@gmail.com>

On 02/02/15 03:53, Damien Miller wrote:
> On Mon, 2 Feb 2015, ?ngel Gonz?lez wrote:
>
>> IMHO the way to go is not teach ssh the agent protocol, but modify the agent
>> protocol so that each request gets prepended the hostname requesting it
>> (forwarded connections would contain the full chain)
> Then you have to modify all of ssh, sshd and ssh-agent and doesn't
> work until they are all upgraded.
Only ssh-agent and ssh (and the change to the former could be trivial)

> Moreover, unless you include signing (by the hostkey) for forwarded hops
> and verification of same at the agent side, then you can't trust anything
> past the first hop.
I wasn't attempting to go that far. Just accountability, similar to how 
Received:
headers work in SMTP. And yes, you can't trust anything past the first 
evil hop.
Still, I see many benefits compared to the current all-or-nothing agent 
trust.
(Of course, to be really sure that nobody intercepts the agent request, 
you MUST
perform the ssh connection locally, with a ProxyCommand. Full Stop)


From brian.carpenter at gmail.com  Wed Feb  4 12:26:58 2015
From: brian.carpenter at gmail.com (Brian Carpenter)
Date: Tue, 3 Feb 2015 19:26:58 -0600
Subject: ssh-pkcs11.c patch
Message-ID: <CANMVOuz1eWMzSLuXcsrgu7xyN+USFkhk0WW4YEJJRqwtJjTVsQ@mail.gmail.com>

Hi, I just cloned the git repo and found a missing ; in ssh-pkcs11.c which
was inhibiting the compilation process. Looks like it was introduced with
https://anongit.mindrot.org/openssh.git/patch/?id=cb3bde373e80902c7d5d0db429f85068d19b2918
and the patch I'm attaching brings back the missing ; and I'm once again
able to compile openssh.

--- ../ssh-pkcs11.c     2015-02-03 19:20:22.445706257 -0600
+++ ssh-pkcs11.c        2015-02-03 19:04:31.861698263 -0600
@@ -368,7 +368,7 @@
        }
        if (login_required && pin) {
                rv = f->C_Login(session, CKU_USER,
-                   (u_char *)pin, strlen(pin))
+                   (u_char *)pin, strlen(pin));
                if (rv != CKR_OK && rv != CKR_USER_ALREADY_LOGGED_IN) {
                        error("C_Login failed: %lu", rv);
                        if ((rv = f->C_CloseSession(session)) != CKR_OK)

Regards,

Brian 'geeknik' Carpenter

From de.techno at gmail.com  Thu Feb  5 13:38:47 2015
From: de.techno at gmail.com (dE)
Date: Thu, 05 Feb 2015 08:08:47 +0530
Subject: Fwd: sftp buggy put command
In-Reply-To: <20150202211333.GA6608@linux124.nas.nasa.gov>
References: <54CC8632.1010602@gmail.com> <54CF9078.4000007@gmail.com>
 <20150202211333.GA6608@linux124.nas.nasa.gov>
Message-ID: <54D2D7B7.50909@gmail.com>

On 02/03/15 02:43, Iain Morgan wrote:
> On Mon, Feb 02, 2015 at 20:28:00 +0530, dE wrote:
>> Hi!
>>
>> I was tying out the put command with version 6.7_p1 of OpenSSH.
>>
>> If I use recursive copying, sftp expects the last directory in the
>> <source> exists in the destination (on the server), otherwise ?Couldn't
>> canonicalize: No such file or directory?.
>>
>> I would've taken this to be the expected behavior, but get command does
>> not have this problem. It makes the destination directory in the client
>> like with cp.
>>
>> So kindly take a look at this.
>>
>>
>> _______________________________________________
>> openssh-unix-dev mailing list
>> openssh-unix-dev at mindrot.org
>> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
> This has already been noted as a bug[1][2], but hasn't been addresed
> yet. I filed the original bug, but had other priorites, and then forgot
> about the issue. I'll take another look at this when I get some time.
>
> [1] https://bugzilla.mindrot.org/show_bug.cgi?id=2150
> [2] https://bugzilla.mindrot.org/show_bug.cgi?id=2230
>

Thanks.

From scott_n at xypro.com  Sat Feb  7 02:41:00 2015
From: scott_n at xypro.com (Scott Neugroschl)
Date: Fri, 6 Feb 2015 15:41:00 +0000
Subject: Make tests on a cross compile?
Message-ID: <D358E5B1511A314F8160ADC6F3754987069F6D60@XYSVEX01.XYPRO-23.LOCAL>

I may have asked this before ... my memory is bad.

Is it possible to run "make tests" on a cross-compile build?

---
Scott Neugroschl | XYPRO Technology Corporation
4100 Guardian Street | Suite 100 |Simi Valley, CA 93063 | Phone 805 583-2874|Fax 805 583-0124 |


From cary.fitzhugh at gmail.com  Sat Feb  7 04:41:38 2015
From: cary.fitzhugh at gmail.com (Cary FitzHugh)
Date: Fri, 6 Feb 2015 12:41:38 -0500
Subject: Creating users "on - the - fly"
Message-ID: <CAPx_VpPauUhvSN38rZtJdM2Zym+dF29Xsn7SN3-cxt=JcMBR6w@mail.gmail.com>

Hi all.

I have a situation that I wonder someone may have run into - or has a
direction I should dig / develop in.

Let's say I have a system with 1M "users".  Their public keys are
stored in a database, and I can access them via a web call.

I have a few servers which should allow those users access.

Some constraints to make it non-crazy.

The users can only reverse tunnel.  They need no state / home
directories, etc.  I've set the command in sshd_config to just echo
"Nyet".  All they do is try to connect with

ssh -R *:0:localhost:<local-port> user at server -N

(while I have you - is there any other way to know what port was
allocated, except for parsing stderr?)

Some great help was in this url:
http://askubuntu.com/questions/48129/how-to-create-a-restricted-ssh-user-for-port-forwarding
(for anyone looking for info about reverse forwarding).

I was planning on just having the AuthorizedKeysCommand take the
username, look up the keys from the webservice, and return them. Easy!

The trouble is that the user isn't created on the machine beforehand.
But I actually don't want the user created, b/c I don't want to litter
all these servers with little user directories.    Users may be
transient as well - so littering the directories of these machines
with tons of data just causes many other problems (running out of
inodes, disk-space, etc).

Any ideas?

Thanks!
Cary

From dkg at fifthhorseman.net  Sat Feb  7 04:52:46 2015
From: dkg at fifthhorseman.net (Daniel Kahn Gillmor)
Date: Fri, 06 Feb 2015 12:52:46 -0500
Subject: Creating users "on - the - fly"
In-Reply-To: <CAPx_VpPauUhvSN38rZtJdM2Zym+dF29Xsn7SN3-cxt=JcMBR6w@mail.gmail.com>
References: <CAPx_VpPauUhvSN38rZtJdM2Zym+dF29Xsn7SN3-cxt=JcMBR6w@mail.gmail.com>
Message-ID: <87386jyljl.fsf@alice.fifthhorseman.net>

On Fri 2015-02-06 12:41:38 -0500, Cary FitzHugh wrote:
> The trouble is that the user isn't created on the machine beforehand.
> But I actually don't want the user created, b/c I don't want to litter
> all these servers with little user directories.    Users may be
> transient as well - so littering the directories of these machines
> with tons of data just causes many other problems (running out of
> inodes, disk-space, etc).

If this is your only concern, most systems don't require that a user
have a unique home directory at all.  You could create a /home/nobody
which is unusable by anyone, and populate the systems's user table with
users (maybe via some sensible nameservice switch module) pointing at
that directory as their homedir.

In other words, i don't think this is an ssh problem, it can be solved
directly in other parts of your OS.

         --dkg

From cary.fitzhugh at gmail.com  Sat Feb  7 05:10:10 2015
From: cary.fitzhugh at gmail.com (Cary FitzHugh)
Date: Fri, 6 Feb 2015 13:10:10 -0500
Subject: Creating users "on - the - fly"
In-Reply-To: <87386jyljl.fsf@alice.fifthhorseman.net>
References: <CAPx_VpPauUhvSN38rZtJdM2Zym+dF29Xsn7SN3-cxt=JcMBR6w@mail.gmail.com>
 <87386jyljl.fsf@alice.fifthhorseman.net>
Message-ID: <CAPx_VpPHw+JarFuYdm1EO4n5B5TQO_mBsfnov0YNnJQOsVCJGA@mail.gmail.com>

I guess I didn't want to litter the users table either - it just seems
"wrong" to be actually adding things to the host when it is really so
transient.  It feels like it should be LDAP-ish.  Just ask the server
for the keys and do a one-off authentication.  But I've seen even LDAP
creates the user directories.

I see that 2.6 kernels can have some 4B users, which should last me a
while.   But it is a bit more work and plumbing to try to keep things
in sync.

I'm a bit / very idealistic though - so I guess I'll keep rooting
around.  I'm ok writing a PAM module if that's what I needed.  But I
have a feeling there's a good bit more to it. And without someone know
"knows " - that can be a very long rabbit trail :)

Hrm....



On Fri, Feb 6, 2015 at 12:52 PM, Daniel Kahn Gillmor
<dkg at fifthhorseman.net> wrote:
> On Fri 2015-02-06 12:41:38 -0500, Cary FitzHugh wrote:
>> The trouble is that the user isn't created on the machine beforehand.
>> But I actually don't want the user created, b/c I don't want to litter
>> all these servers with little user directories.    Users may be
>> transient as well - so littering the directories of these machines
>> with tons of data just causes many other problems (running out of
>> inodes, disk-space, etc).
>
> If this is your only concern, most systems don't require that a user
> have a unique home directory at all.  You could create a /home/nobody
> which is unusable by anyone, and populate the systems's user table with
> users (maybe via some sensible nameservice switch module) pointing at
> that directory as their homedir.
>
> In other words, i don't think this is an ssh problem, it can be solved
> directly in other parts of your OS.
>
>          --dkg

From david-bronder at uiowa.edu  Sat Feb  7 05:21:42 2015
From: david-bronder at uiowa.edu (David Bronder)
Date: Fri, 6 Feb 2015 12:21:42 -0600
Subject: [openssh-unix-dev] Re: Creating users "on - the - fly"
In-Reply-To: <CAPx_VpPHw+JarFuYdm1EO4n5B5TQO_mBsfnov0YNnJQOsVCJGA@mail.gmail.com>
References: <CAPx_VpPauUhvSN38rZtJdM2Zym+dF29Xsn7SN3-cxt=JcMBR6w@mail.gmail.com>
 <87386jyljl.fsf@alice.fifthhorseman.net>
 <CAPx_VpPHw+JarFuYdm1EO4n5B5TQO_mBsfnov0YNnJQOsVCJGA@mail.gmail.com>
Message-ID: <54D50636.9020008@uiowa.edu>

What about doing something like is popular on some git services, where
instead of having actual accounts for each user, all the users log in with a
single account but different keys?  You then govern their access/behavior
based on which key is used to authenticate.

=Dave


On 02/06/2015 12:10 PM, Cary FitzHugh wrote:
> I guess I didn't want to litter the users table either - it just seems
> "wrong" to be actually adding things to the host when it is really so
> transient.  It feels like it should be LDAP-ish.  Just ask the server
> for the keys and do a one-off authentication.  But I've seen even LDAP
> creates the user directories.
> 
> I see that 2.6 kernels can have some 4B users, which should last me a
> while.   But it is a bit more work and plumbing to try to keep things
> in sync.
> 
> I'm a bit / very idealistic though - so I guess I'll keep rooting
> around.  I'm ok writing a PAM module if that's what I needed.  But I
> have a feeling there's a good bit more to it. And without someone know
> "knows " - that can be a very long rabbit trail :)
> 
> Hrm....
> 
> 
> 
> On Fri, Feb 6, 2015 at 12:52 PM, Daniel Kahn Gillmor
> <dkg at fifthhorseman.net> wrote:
>> On Fri 2015-02-06 12:41:38 -0500, Cary FitzHugh wrote:
>>> The trouble is that the user isn't created on the machine beforehand.
>>> But I actually don't want the user created, b/c I don't want to litter
>>> all these servers with little user directories.    Users may be
>>> transient as well - so littering the directories of these machines
>>> with tons of data just causes many other problems (running out of
>>> inodes, disk-space, etc).
>>
>> If this is your only concern, most systems don't require that a user
>> have a unique home directory at all.  You could create a /home/nobody
>> which is unusable by anyone, and populate the systems's user table with
>> users (maybe via some sensible nameservice switch module) pointing at
>> that directory as their homedir.
>>
>> In other words, i don't think this is an ssh problem, it can be solved
>> directly in other parts of your OS.
>>
>>          --dkg
> 

-- 
Hello World.                                David Bronder - Systems Architect
Segmentation Fault                                      ITS-EI, Univ. of Iowa
Core dumped, disk trashed, quota filled, soda warm.   david-bronder at uiowa.edu

From cary.fitzhugh at gmail.com  Sat Feb  7 05:38:29 2015
From: cary.fitzhugh at gmail.com (Cary FitzHugh)
Date: Fri, 6 Feb 2015 13:38:29 -0500
Subject: [openssh-unix-dev] Re: Creating users "on - the - fly"
In-Reply-To: <54D50636.9020008@uiowa.edu>
References: <CAPx_VpPauUhvSN38rZtJdM2Zym+dF29Xsn7SN3-cxt=JcMBR6w@mail.gmail.com>
 <87386jyljl.fsf@alice.fifthhorseman.net>
 <CAPx_VpPHw+JarFuYdm1EO4n5B5TQO_mBsfnov0YNnJQOsVCJGA@mail.gmail.com>
 <54D50636.9020008@uiowa.edu>
Message-ID: <CAPx_VpPnwyO8nm9tvF3=o6JDEUB_DTUAcP5jg22BAgWdYOkZ+Q@mail.gmail.com>

This is a good suggestion - and maybe I'm not totally clear on the
restrictions...

So - in these situations gitolite will actually append things to your
authorized_keys file.  Which can get very long. And after a while - it
gets *very* long. I think I saw comments that it should be limited to
about 20k or so. And around 20k the look up times are in the seconds.
So that wouldn't be enough for me.  I have another service in my
system which uses gitolite, and it works fine - but it doesn't seem to
be able to authenticate a ginormous number of users.

So - I figured that I could use the ssh-keys command to request only a
subset of keys (from a service or something) and that would enable ssh
to auth much faster.

However - as I got into that - I realized that I have no way to "find"
just the keys for a single user.  Since the only argument to that ssh
keys command, is the username.  It's not HTTP so I couldn't point at a
subdomain and use that to look up the information.

Hence my current (potential dead-end) path of trying to let users
access via their username , which then lets me look up their
authorized_keys.  Of course, now I run into the "user doesn't exist"
issue..

:(

On Fri, Feb 6, 2015 at 1:21 PM, David Bronder <david-bronder at uiowa.edu> wrote:
> What about doing something like is popular on some git services, where
> instead of having actual accounts for each user, all the users log in with a
> single account but different keys?  You then govern their access/behavior
> based on which key is used to authenticate.
>
> =Dave
>
>
> On 02/06/2015 12:10 PM, Cary FitzHugh wrote:
>> I guess I didn't want to litter the users table either - it just seems
>> "wrong" to be actually adding things to the host when it is really so
>> transient.  It feels like it should be LDAP-ish.  Just ask the server
>> for the keys and do a one-off authentication.  But I've seen even LDAP
>> creates the user directories.
>>
>> I see that 2.6 kernels can have some 4B users, which should last me a
>> while.   But it is a bit more work and plumbing to try to keep things
>> in sync.
>>
>> I'm a bit / very idealistic though - so I guess I'll keep rooting
>> around.  I'm ok writing a PAM module if that's what I needed.  But I
>> have a feeling there's a good bit more to it. And without someone know
>> "knows " - that can be a very long rabbit trail :)
>>
>> Hrm....
>>
>>
>>
>> On Fri, Feb 6, 2015 at 12:52 PM, Daniel Kahn Gillmor
>> <dkg at fifthhorseman.net> wrote:
>>> On Fri 2015-02-06 12:41:38 -0500, Cary FitzHugh wrote:
>>>> The trouble is that the user isn't created on the machine beforehand.
>>>> But I actually don't want the user created, b/c I don't want to litter
>>>> all these servers with little user directories.    Users may be
>>>> transient as well - so littering the directories of these machines
>>>> with tons of data just causes many other problems (running out of
>>>> inodes, disk-space, etc).
>>>
>>> If this is your only concern, most systems don't require that a user
>>> have a unique home directory at all.  You could create a /home/nobody
>>> which is unusable by anyone, and populate the systems's user table with
>>> users (maybe via some sensible nameservice switch module) pointing at
>>> that directory as their homedir.
>>>
>>> In other words, i don't think this is an ssh problem, it can be solved
>>> directly in other parts of your OS.
>>>
>>>          --dkg
>>
>
> --
> Hello World.                                David Bronder - Systems Architect
> Segmentation Fault                                      ITS-EI, Univ. of Iowa
> Core dumped, disk trashed, quota filled, soda warm.   david-bronder at uiowa.edu

From dkg at fifthhorseman.net  Sat Feb  7 05:47:48 2015
From: dkg at fifthhorseman.net (Daniel Kahn Gillmor)
Date: Fri, 06 Feb 2015 13:47:48 -0500
Subject: Creating users "on - the - fly"
In-Reply-To: <CAPx_VpPHw+JarFuYdm1EO4n5B5TQO_mBsfnov0YNnJQOsVCJGA@mail.gmail.com>
References: <CAPx_VpPauUhvSN38rZtJdM2Zym+dF29Xsn7SN3-cxt=JcMBR6w@mail.gmail.com>
 <87386jyljl.fsf@alice.fifthhorseman.net>
 <CAPx_VpPHw+JarFuYdm1EO4n5B5TQO_mBsfnov0YNnJQOsVCJGA@mail.gmail.com>
Message-ID: <87vbjeyizv.fsf@alice.fifthhorseman.net>

On Fri 2015-02-06 13:10:10 -0500, Cary FitzHugh wrote:
> I guess I didn't want to litter the users table either - it just seems
> "wrong" to be actually adding things to the host when it is really so
> transient.  It feels like it should be LDAP-ish.  Just ask the server
> for the keys and do a one-off authentication.  But I've seen even LDAP
> creates the user directories.

you can use libnss-ldap to have a dynamic user table pulled from LDAP,
if that's what you want.  You don't need to touch any local file on the
host if you just want to look up your users over the network.

Or you can write your own name service switch extension that does the
same.  for GNU systems, see:

https://www.gnu.org/software/libc/manual/html_node/Name-Service-Switch.html

     --dkg

From dkg at fifthhorseman.net  Sat Feb  7 06:01:16 2015
From: dkg at fifthhorseman.net (Daniel Kahn Gillmor)
Date: Fri, 06 Feb 2015 14:01:16 -0500
Subject: [openssh-unix-dev] Re: Creating users "on - the - fly"
In-Reply-To: <CAPx_VpPnwyO8nm9tvF3=o6JDEUB_DTUAcP5jg22BAgWdYOkZ+Q@mail.gmail.com>
References: <CAPx_VpPauUhvSN38rZtJdM2Zym+dF29Xsn7SN3-cxt=JcMBR6w@mail.gmail.com>
 <87386jyljl.fsf@alice.fifthhorseman.net>
 <CAPx_VpPHw+JarFuYdm1EO4n5B5TQO_mBsfnov0YNnJQOsVCJGA@mail.gmail.com>
 <54D50636.9020008@uiowa.edu>
 <CAPx_VpPnwyO8nm9tvF3=o6JDEUB_DTUAcP5jg22BAgWdYOkZ+Q@mail.gmail.com>
Message-ID: <87oap6yidf.fsf@alice.fifthhorseman.net>

On Fri 2015-02-06 13:38:29 -0500, Cary FitzHugh wrote:

> However - as I got into that - I realized that I have no way to "find"
> just the keys for a single user.  Since the only argument to that ssh
> keys command, is the username.  It's not HTTP so I couldn't point at a
> subdomain and use that to look up the information.

You may be interested in the bug report "extend the parameters to the
AuthorizedKeysCommand":

  https://bugzilla.mindrot.org/show_bug.cgi?id=2081

hth,

        --dkg

From scott_n at xypro.com  Sat Feb  7 05:57:13 2015
From: scott_n at xypro.com (Scott Neugroschl)
Date: Fri, 6 Feb 2015 18:57:13 +0000
Subject: Creating users "on - the - fly"
In-Reply-To: <87vbjeyizv.fsf@alice.fifthhorseman.net>
References: <CAPx_VpPauUhvSN38rZtJdM2Zym+dF29Xsn7SN3-cxt=JcMBR6w@mail.gmail.com>
 <87386jyljl.fsf@alice.fifthhorseman.net>
 <CAPx_VpPHw+JarFuYdm1EO4n5B5TQO_mBsfnov0YNnJQOsVCJGA@mail.gmail.com>
 <87vbjeyizv.fsf@alice.fifthhorseman.net>
Message-ID: <D358E5B1511A314F8160ADC6F3754987069F6E10@XYSVEX01.XYPRO-23.LOCAL>

Just jumping in, from following the discussion...

So store the public key as an attribute in the LDAP database?

-----Original Message-----
From: openssh-unix-dev [mailto:openssh-unix-dev-bounces+scott_n=xypro.com at mindrot.org] On Behalf Of Daniel Kahn Gillmor
Sent: Friday, February 06, 2015 10:48 AM
To: Cary FitzHugh
Cc: openssh-unix-dev at mindrot.org
Subject: Re: Creating users "on - the - fly"

On Fri 2015-02-06 13:10:10 -0500, Cary FitzHugh wrote:
> I guess I didn't want to litter the users table either - it just seems 
> "wrong" to be actually adding things to the host when it is really so 
> transient.  It feels like it should be LDAP-ish.  Just ask the server 
> for the keys and do a one-off authentication.  But I've seen even LDAP 
> creates the user directories.

you can use libnss-ldap to have a dynamic user table pulled from LDAP, if that's what you want.  You don't need to touch any local file on the host if you just want to look up your users over the network.

Or you can write your own name service switch extension that does the same.  for GNU systems, see:

https://www.gnu.org/software/libc/manual/html_node/Name-Service-Switch.html

     --dkg
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev at mindrot.org
https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev

From cary.fitzhugh at gmail.com  Sat Feb  7 06:30:13 2015
From: cary.fitzhugh at gmail.com (Cary FitzHugh)
Date: Fri, 6 Feb 2015 14:30:13 -0500
Subject: [openssh-unix-dev] Re: Creating users "on - the - fly"
In-Reply-To: <D358E5B1511A314F8160ADC6F3754987069F6E36@XYSVEX01.XYPRO-23.LOCAL>
References: <CAPx_VpPauUhvSN38rZtJdM2Zym+dF29Xsn7SN3-cxt=JcMBR6w@mail.gmail.com>
 <87386jyljl.fsf@alice.fifthhorseman.net>
 <CAPx_VpPHw+JarFuYdm1EO4n5B5TQO_mBsfnov0YNnJQOsVCJGA@mail.gmail.com>
 <54D50636.9020008@uiowa.edu>
 <CAPx_VpPnwyO8nm9tvF3=o6JDEUB_DTUAcP5jg22BAgWdYOkZ+Q@mail.gmail.com>
 <87oap6yidf.fsf@alice.fifthhorseman.net>
 <D358E5B1511A314F8160ADC6F3754987069F6E36@XYSVEX01.XYPRO-23.LOCAL>
Message-ID: <CAPx_VpNRcOkgYLR-epDVcbmnD383ebQTjNFCcNqLgbYMQhSoFQ@mail.gmail.com>

Thanks for the tip on name service switch extensions -- I shall look..
Maybe adding something that lets you query the users there is all I
need... we'll see.

The AuthorizedKeysCommand could be a script - and figures out
everything - the ssh connection doesn't' get that far when the user
doesn't exist on the system yet :(

Hence  - maybe a NSS User Database extension which looks for the
public keys from a webservice (and then maybe writes them to
/tmp/<username>.

The AuthorzedKeysCommand could then just return the tmp/username information..

Hoping the NSS shows some promise.. Wow , thanks for all the help!

On Fri, Feb 6, 2015 at 2:26 PM, Scott Neugroschl <scott_n at xypro.com> wrote:
>
>>> However - as I got into that - I realized that I have no way to "find"
>>> just the keys for a single user.  Since the only argument to that ssh
>>> keys command, is the username.  It's not HTTP so I couldn't point at a
>>> subdomain and use that to look up the information.
>
>>You may be interested in the bug report "extend the parameters to the
>>AuthorizedKeysCommand":
>
>  > https://bugzilla.mindrot.org/show_bug.cgi?id=2081
>
>
> Why not have the Authorized Keys Command  be a script that figures out  the domain from the username?
>
>

From scott_n at xypro.com  Sat Feb  7 06:26:49 2015
From: scott_n at xypro.com (Scott Neugroschl)
Date: Fri, 6 Feb 2015 19:26:49 +0000
Subject: [openssh-unix-dev] Re: Creating users "on - the - fly"
In-Reply-To: <87oap6yidf.fsf@alice.fifthhorseman.net>
References: <CAPx_VpPauUhvSN38rZtJdM2Zym+dF29Xsn7SN3-cxt=JcMBR6w@mail.gmail.com>
 <87386jyljl.fsf@alice.fifthhorseman.net>
 <CAPx_VpPHw+JarFuYdm1EO4n5B5TQO_mBsfnov0YNnJQOsVCJGA@mail.gmail.com>
 <54D50636.9020008@uiowa.edu>
 <CAPx_VpPnwyO8nm9tvF3=o6JDEUB_DTUAcP5jg22BAgWdYOkZ+Q@mail.gmail.com>
 <87oap6yidf.fsf@alice.fifthhorseman.net>
Message-ID: <D358E5B1511A314F8160ADC6F3754987069F6E36@XYSVEX01.XYPRO-23.LOCAL>


>> However - as I got into that - I realized that I have no way to "find"
>> just the keys for a single user.  Since the only argument to that ssh 
>> keys command, is the username.  It's not HTTP so I couldn't point at a 
>> subdomain and use that to look up the information.

>You may be interested in the bug report "extend the parameters to the
>AuthorizedKeysCommand":

 > https://bugzilla.mindrot.org/show_bug.cgi?id=2081


Why not have the Authorized Keys Command  be a script that figures out  the domain from the username?



From dkg at fifthhorseman.net  Sat Feb  7 07:02:58 2015
From: dkg at fifthhorseman.net (Daniel Kahn Gillmor)
Date: Fri, 06 Feb 2015 15:02:58 -0500
Subject: [openssh-unix-dev] Re: Creating users "on - the - fly"
In-Reply-To: <CAPx_VpNRcOkgYLR-epDVcbmnD383ebQTjNFCcNqLgbYMQhSoFQ@mail.gmail.com>
References: <CAPx_VpPauUhvSN38rZtJdM2Zym+dF29Xsn7SN3-cxt=JcMBR6w@mail.gmail.com>
 <87386jyljl.fsf@alice.fifthhorseman.net>
 <CAPx_VpPHw+JarFuYdm1EO4n5B5TQO_mBsfnov0YNnJQOsVCJGA@mail.gmail.com>
 <54D50636.9020008@uiowa.edu>
 <CAPx_VpPnwyO8nm9tvF3=o6JDEUB_DTUAcP5jg22BAgWdYOkZ+Q@mail.gmail.com>
 <87oap6yidf.fsf@alice.fifthhorseman.net>
 <D358E5B1511A314F8160ADC6F3754987069F6E36@XYSVEX01.XYPRO-23.LOCAL>
 <CAPx_VpNRcOkgYLR-epDVcbmnD383ebQTjNFCcNqLgbYMQhSoFQ@mail.gmail.com>
Message-ID: <87bnl6yfil.fsf@alice.fifthhorseman.net>

On Fri 2015-02-06 14:30:13 -0500, Cary FitzHugh wrote:
> Hence  - maybe a NSS User Database extension which looks for the
> public keys from a webservice (and then maybe writes them to
> /tmp/<username>.

No, i'm suggesting that when you want to look up the user, use NSS to
find the username and map it to a numeric user ID and the other
information that is typically found in /etc/passwd.  this doesn't write
anything to the local disk.

> The AuthorzedKeysCommand could then just return the tmp/username information..

Then the AuthorizedKeysCommand can return the proper key material.

     --dkg

From cary.fitzhugh at gmail.com  Sat Feb  7 06:58:59 2015
From: cary.fitzhugh at gmail.com (Cary FitzHugh)
Date: Fri, 6 Feb 2015 14:58:59 -0500
Subject: [openssh-unix-dev] Re: Creating users "on - the - fly"
In-Reply-To: <CAPx_VpNRcOkgYLR-epDVcbmnD383ebQTjNFCcNqLgbYMQhSoFQ@mail.gmail.com>
References: <CAPx_VpPauUhvSN38rZtJdM2Zym+dF29Xsn7SN3-cxt=JcMBR6w@mail.gmail.com>
 <87386jyljl.fsf@alice.fifthhorseman.net>
 <CAPx_VpPHw+JarFuYdm1EO4n5B5TQO_mBsfnov0YNnJQOsVCJGA@mail.gmail.com>
 <54D50636.9020008@uiowa.edu>
 <CAPx_VpPnwyO8nm9tvF3=o6JDEUB_DTUAcP5jg22BAgWdYOkZ+Q@mail.gmail.com>
 <87oap6yidf.fsf@alice.fifthhorseman.net>
 <D358E5B1511A314F8160ADC6F3754987069F6E36@XYSVEX01.XYPRO-23.LOCAL>
 <CAPx_VpNRcOkgYLR-epDVcbmnD383ebQTjNFCcNqLgbYMQhSoFQ@mail.gmail.com>
Message-ID: <CAPx_VpNDZkYTtOyEvmaEapRt3XuRPwjg9cwPHWnQXUR4t1US+w@mail.gmail.com>

Someone wrote this for NSS - https://github.com/donapieppo/libnss-ato

And this seems to be doing sortof what I'm hoping to do, just doing it
with hosts, not User database stuff.

https://github.com/troxor/libnss_consul

So - maybe a combination of these two things will work!

Thanks again. we'll see how it goes :)
Cary

On Fri, Feb 6, 2015 at 2:30 PM, Cary FitzHugh <cary.fitzhugh at gmail.com> wrote:
> Thanks for the tip on name service switch extensions -- I shall look..
> Maybe adding something that lets you query the users there is all I
> need... we'll see.
>
> The AuthorizedKeysCommand could be a script - and figures out
> everything - the ssh connection doesn't' get that far when the user
> doesn't exist on the system yet :(
>
> Hence  - maybe a NSS User Database extension which looks for the
> public keys from a webservice (and then maybe writes them to
> /tmp/<username>.
>
> The AuthorzedKeysCommand could then just return the tmp/username information..
>
> Hoping the NSS shows some promise.. Wow , thanks for all the help!
>
> On Fri, Feb 6, 2015 at 2:26 PM, Scott Neugroschl <scott_n at xypro.com> wrote:
>>
>>>> However - as I got into that - I realized that I have no way to "find"
>>>> just the keys for a single user.  Since the only argument to that ssh
>>>> keys command, is the username.  It's not HTTP so I couldn't point at a
>>>> subdomain and use that to look up the information.
>>
>>>You may be interested in the bug report "extend the parameters to the
>>>AuthorizedKeysCommand":
>>
>>  > https://bugzilla.mindrot.org/show_bug.cgi?id=2081
>>
>>
>> Why not have the Authorized Keys Command  be a script that figures out  the domain from the username?
>>
>>

From michael at stroeder.com  Sun Feb  8 07:06:44 2015
From: michael at stroeder.com (=?UTF-8?Q?Michael_Str=c3=b6der?=)
Date: Sat, 07 Feb 2015 21:06:44 +0100
Subject: Filtering which identities are forwarded by ssh-agent to
 a given host
In-Reply-To: <alpine.BSO.2.11.1502021349280.18678@natsu.mindrot.org>
References: <38456115.BgVG85xq9M@psycho-grande>
 <alpine.BSO.2.11.1502021010020.18678@natsu.mindrot.org>
 <54CEBB4E.5000009@gmail.com>
 <alpine.BSO.2.11.1502021349280.18678@natsu.mindrot.org>
Message-ID: <54D67054.40108@stroeder.com>

Damien Miller wrote:
> On Mon, 2 Feb 2015, ?ngel Gonz?lez wrote:
> 
>> IMHO the way to go is not teach ssh the agent protocol, but modify the agent
>> protocol so that each request gets prepended the hostname requesting it
>> (forwarded connections would contain the full chain)
> 
> Then you have to modify all of ssh, sshd and ssh-agent and doesn't
> work until they are all upgraded.

Disclaimer:
I don't consider myself to be an expert in this field.

I'm using ssh-add -c to be asked each time the key is requested.
At least it would be helpful if the hostname is displayed for which the key is
requested. Because sometimes things happen concurrently and one cannot decide
anymore for which action the dialogue pops up.

Ciao, Michael.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4252 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20150207/d50d4014/attachment-0001.bin>

From djm at mindrot.org  Mon Feb  9 09:12:25 2015
From: djm at mindrot.org (Damien Miller)
Date: Mon, 9 Feb 2015 09:12:25 +1100 (AEDT)
Subject: Make tests on a cross compile?
In-Reply-To: <D358E5B1511A314F8160ADC6F3754987069F6D60@XYSVEX01.XYPRO-23.LOCAL>
References: <D358E5B1511A314F8160ADC6F3754987069F6D60@XYSVEX01.XYPRO-23.LOCAL>
Message-ID: <alpine.BSO.2.11.1502090911320.23518@natsu.mindrot.org>

On Fri, 6 Feb 2015, Scott Neugroschl wrote:

> I may have asked this before ... my memory is bad.
> 
> Is it possible to run "make tests" on a cross-compile build?

Where would you be running the tests? You couldn't run them on
the host compiler.

They should work fine if you copy the build directory to the
target platform and run them there.

From scott_n at xypro.com  Tue Feb 10 03:31:30 2015
From: scott_n at xypro.com (Scott Neugroschl)
Date: Mon, 9 Feb 2015 16:31:30 +0000
Subject: Make tests on a cross compile?
In-Reply-To: <alpine.BSO.2.11.1502090911320.23518@natsu.mindrot.org>
References: <D358E5B1511A314F8160ADC6F3754987069F6D60@XYSVEX01.XYPRO-23.LOCAL>
 <alpine.BSO.2.11.1502090911320.23518@natsu.mindrot.org>
Message-ID: <D358E5B1511A314F8160ADC6F3754987069F903C@XYSVEX01.XYPRO-23.LOCAL>

Thanks, Damien.

-----Original Message-----
From: Damien Miller [mailto:djm at mindrot.org] 
Sent: Sunday, February 08, 2015 2:12 PM
To: Scott Neugroschl
Cc: OpenSSH Unix Dev Mailing List (openssh-unix-dev at mindrot.org)
Subject: Re: Make tests on a cross compile?

On Fri, 6 Feb 2015, Scott Neugroschl wrote:

> I may have asked this before ... my memory is bad.
> 
> Is it possible to run "make tests" on a cross-compile build?

Where would you be running the tests? You couldn't run them on the host compiler.

They should work fine if you copy the build directory to the target platform and run them there.

From meta at pobox.com  Tue Feb 10 04:09:18 2015
From: meta at pobox.com (mathew)
Date: Mon, 09 Feb 2015 17:09:18 +0000
Subject: Connection stalls at debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
Message-ID: <CAL_EfNwUUByc6gGk-ofW3ycossUaRZuFuyrgeeo4xndhPzh9=Q@mail.gmail.com>

Trying to connect from Fedora 21 to CentOS 6.6, OpenSSH on both ends.
Connection is via a VPN.

Initially the connection seems good, but OpenSSH stalls at
  debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP.

Software version on servers:
openssh-server-5.3p1-104.el6_6.1.x86_64
openssh-5.3p1-104.el6_6.1.x86_64

Software version on client:
openssh-6.6.1p1-11.1.fc21.x86_64
also duplicated problem using local build of openssh-6.7p1.tar.gz

Connections to other CentOS 6 servers with identical SSH versions and
configurations are successful. (Configs are managed by Puppet so I'm
confident they really are identical, and I rebooted the server before the
test below.)

Connections to the problem server using Windows PuTTY SSH are successful!
(Using a Windows VM running on the same Fedora 21 client machine, inside
VirtualBox.)

VPN MTU is 1400. Ping check for packet size:
% ping -M do -s 1372 10.77.16.71
PING 10.77.16.71 (10.77.16.71) 1372(1400) bytes of data.
1380 bytes from 10.77.16.71: icmp_seq=1 ttl=61 time=69.4 ms
Server MTU is 1500, and I've confirmed that 1472-byte packets ping
successfully from other servers to the problem server.

Here's a transcript using ssh -vvv and a build of OpenSSH from
openssh-6.7p1 sources:

% ./ssh -vvv docs.rtp.tecnet
OpenSSH_6.7p1, OpenSSL 1.0.1k-fips 8 Jan 2015
debug1: Reading configuration data /home/meta/.ssh/config
/home/meta/.ssh/config line 1: Unsupported option "gssapiauthentication"
debug2: ssh_connect: needpriv 0
debug1: Connecting to docs.rtp.tecnet [10.77.16.71] port 22.
debug1: Connection established.
debug1: identity file /home/meta/.ssh/id_rsa type 1
debug1: key_load_public: No such file or directory
debug1: identity file /home/meta/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/meta/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/meta/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/meta/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/meta/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/meta/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/meta/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.7
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3
debug1: match: OpenSSH_5.3 pat OpenSSH_5* compat 0x0c000000
debug2: fd 3 setting O_NONBLOCK
debug3: load_hostkeys: loading entries for host "docs.rtp.tecnet" from file
"/home/meta/.ssh/known_hosts"
debug3: load_hostkeys: loaded 0 keys
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: curve25519-sha256 at libssh.org
,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ecdsa-sha2-nistp256-cert-v01 at openssh.com,
ecdsa-sha2-nistp384-cert-v01 at openssh.com,
ecdsa-sha2-nistp521-cert-v01 at openssh.com,ssh-ed25519-cert-v01 at openssh.com,
ssh-rsa-cert-v01 at openssh.com,ssh-dss-cert-v01 at openssh.com,
ssh-rsa-cert-v00 at openssh.com,ssh-dss-cert-v00 at openssh.com
,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,
aes128-gcm at openssh.com,aes256-gcm at openssh.com,chacha20-poly1305 at openssh.com
,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,
rijndael-cbc at lysator.liu.se
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,
aes128-gcm at openssh.com,aes256-gcm at openssh.com,chacha20-poly1305 at openssh.com
,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,
rijndael-cbc at lysator.liu.se
debug2: kex_parse_kexinit: umac-64-etm at openssh.com,umac-128-etm at openssh.com,
hmac-sha2-256-etm at openssh.com,hmac-sha2-512-etm at openssh.com,
hmac-sha1-etm at openssh.com,umac-64 at openssh.com,umac-128 at openssh.com
,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5-etm at openssh.com,
hmac-ripemd160-etm at openssh.com,hmac-sha1-96-etm at openssh.com,
hmac-md5-96-etm at openssh.com,hmac-md5,hmac-ripemd160,
hmac-ripemd160 at openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: umac-64-etm at openssh.com,umac-128-etm at openssh.com,
hmac-sha2-256-etm at openssh.com,hmac-sha2-512-etm at openssh.com,
hmac-sha1-etm at openssh.com,umac-64 at openssh.com,umac-128 at openssh.com
,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5-etm at openssh.com,
hmac-ripemd160-etm at openssh.com,hmac-sha1-96-etm at openssh.com,
hmac-md5-96-etm at openssh.com,hmac-md5,hmac-ripemd160,
hmac-ripemd160 at openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib at openssh.com,zlib
debug2: kex_parse_kexinit: none,zlib at openssh.com,zlib
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: kex_parse_kexinit:
diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
debug2: kex_parse_kexinit:
aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,arcfour
debug2: kex_parse_kexinit:
aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,arcfour
debug2: kex_parse_kexinit: hmac-sha1,hmac-ripemd160
debug2: kex_parse_kexinit: hmac-sha1,hmac-ripemd160
debug2: kex_parse_kexinit: none,zlib at openssh.com
debug2: kex_parse_kexinit: none,zlib at openssh.com
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: mac_setup: setup hmac-sha1
debug1: kex: server->client aes128-ctr hmac-sha1 none
debug2: mac_setup: setup hmac-sha1
debug1: kex: client->server aes128-ctr hmac-sha1 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<7680<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
[hangs]

Here's the config output from building OpenSSH as used above:

OpenSSH has been configured with the following options:
                     User binaries: /usr/local/bin
                   System binaries: /usr/local/sbin
               Configuration files: /usr/local/etc
                   Askpass program: /usr/local/libexec/ssh-askpass
                      Manual pages: /usr/local/share/man/manX
                          PID file: /var/run
  Privilege separation chroot path: /var/empty
            sshd default user PATH:
/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin
                    Manpage format: doc
                       PAM support: no
                   OSF SIA support: no
                 KerberosV support: no
                   SELinux support: no
                 Smartcard support:
                     S/KEY support: no
              MD5 password support: no
                   libedit support: no
  Solaris process contract support: no
           Solaris project support: no
       IP address in $DISPLAY hack: no
           Translate v4 in v6 hack: yes
                  BSD Auth support: no
              Random number source: OpenSSL internal ONLY
             Privsep sandbox style: seccomp_filter

              Host: x86_64-unknown-linux-gnu
          Compiler: gcc
    Compiler flags: -g -O2 -Wall -Wpointer-arith -Wuninitialized
-Wsign-compare -Wformat-security -Wsizeof-pointer-memaccess
-Wno-pointer-sign -Wno-unused-result -fno-strict-aliasing
-D_FORTIFY_SOURCE=2 -ftrapv -fno-builtin-memset -fstack-protector-strong
-fPIE
Preprocessor flags:
      Linker flags:  -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack
-fstack-protector-strong -pie
         Libraries: -lcrypto -ldl -lutil -lz -lnsl  -lcrypt -lresolv

So... Any ideas what I can try next to track down the source of the problem?


mathew

From cary.fitzhugh at gmail.com  Tue Feb 10 04:59:41 2015
From: cary.fitzhugh at gmail.com (Cary FitzHugh)
Date: Mon, 9 Feb 2015 12:59:41 -0500
Subject: [openssh-unix-dev] Re: Creating users "on - the - fly"
In-Reply-To: <87bnl6yfil.fsf@alice.fifthhorseman.net>
References: <CAPx_VpPauUhvSN38rZtJdM2Zym+dF29Xsn7SN3-cxt=JcMBR6w@mail.gmail.com>
 <87386jyljl.fsf@alice.fifthhorseman.net>
 <CAPx_VpPHw+JarFuYdm1EO4n5B5TQO_mBsfnov0YNnJQOsVCJGA@mail.gmail.com>
 <54D50636.9020008@uiowa.edu>
 <CAPx_VpPnwyO8nm9tvF3=o6JDEUB_DTUAcP5jg22BAgWdYOkZ+Q@mail.gmail.com>
 <87oap6yidf.fsf@alice.fifthhorseman.net>
 <D358E5B1511A314F8160ADC6F3754987069F6E36@XYSVEX01.XYPRO-23.LOCAL>
 <CAPx_VpNRcOkgYLR-epDVcbmnD383ebQTjNFCcNqLgbYMQhSoFQ@mail.gmail.com>
 <87bnl6yfil.fsf@alice.fifthhorseman.net>
Message-ID: <CAPx_VpOXu5zkYP96hLiq8WSe3rtHDBVf28KbA++9YkGvaF=77w@mail.gmail.com>

Morning everyone,

I have put into place the lbnns extension https://github.com/hivewing/libnss-ato
It seems to always resolve every username to the same uid, with no password.
I've set the shell to bin/false, and put the home dir to /dev/null as well.

And it actually seems to work!

On a connection request, the AuthorzedKeysCommand script is called
with the right username, letting me look up the username in my
webservice, and return the list of authorized_keys.
Wonderful.

I spent a good bit of time banging my head on the wall, trying to
figure out why I could only get one connection through the sshd server
before it would crash.  It would accept one connection, every other
connection request would be ignored.  And once that one connection was
closed, sshd would exit.

I was running it like so:  /usr/sbin/sshd -D -e -d -d -d

And life was sad. very sad.

I now run it just with /usr/sbin/sshd -D
and it all seems to work.

I'm not sure if anyone cares that it doesn't work with the three '-d's
on there.  but if anyone did care, I could try to help them get a
reproducible case.

Thanks to everyone who helped with suggestions!

Cary

On Fri, Feb 6, 2015 at 3:02 PM, Daniel Kahn Gillmor
<dkg at fifthhorseman.net> wrote:
> On Fri 2015-02-06 14:30:13 -0500, Cary FitzHugh wrote:
>> Hence  - maybe a NSS User Database extension which looks for the
>> public keys from a webservice (and then maybe writes them to
>> /tmp/<username>.
>
> No, i'm suggesting that when you want to look up the user, use NSS to
> find the username and map it to a numeric user ID and the other
> information that is typically found in /etc/passwd.  this doesn't write
> anything to the local disk.
>
>> The AuthorzedKeysCommand could then just return the tmp/username information..
>
> Then the AuthorizedKeysCommand can return the proper key material.
>
>      --dkg

From plautrba at redhat.com  Tue Feb 10 06:23:26 2015
From: plautrba at redhat.com (Petr Lautrbach)
Date: Mon, 09 Feb 2015 20:23:26 +0100
Subject: Connection stalls at debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
In-Reply-To: <CAL_EfNwUUByc6gGk-ofW3ycossUaRZuFuyrgeeo4xndhPzh9=Q@mail.gmail.com>
References: <CAL_EfNwUUByc6gGk-ofW3ycossUaRZuFuyrgeeo4xndhPzh9=Q@mail.gmail.com>
Message-ID: <54D9092E.1060500@redhat.com>

On 02/09/2015 06:09 PM, mathew wrote:
> Trying to connect from Fedora 21 to CentOS 6.6, OpenSSH on both ends.
> Connection is via a VPN.
> 
> Initially the connection seems good, but OpenSSH stalls at
>   debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP.
> 
> Software version on servers:
> openssh-server-5.3p1-104.el6_6.1.x86_64
> openssh-5.3p1-104.el6_6.1.x86_64
> 
> Software version on client:
> openssh-6.6.1p1-11.1.fc21.x86_64
> also duplicated problem using local build of openssh-6.7p1.tar.gz
> 
> Connections to other CentOS 6 servers with identical SSH versions and
> configurations are successful. (Configs are managed by Puppet so I'm
> confident they really are identical, and I rebooted the server before the
> test below.)
> 
> Connections to the problem server using Windows PuTTY SSH are successful!
> (Using a Windows VM running on the same Fedora 21 client machine, inside
> VirtualBox.)
> 
> VPN MTU is 1400. Ping check for packet size:
> % ping -M do -s 1372 10.77.16.71
> PING 10.77.16.71 (10.77.16.71) 1372(1400) bytes of data.
> 1380 bytes from 10.77.16.71: icmp_seq=1 ttl=61 time=69.4 ms
> Server MTU is 1500, and I've confirmed that 1472-byte packets ping
> successfully from other servers to the problem server.

It seems to be the same problem as described and discussed in this [1]
thread.  MTU 1400 is not enough for packet sent by
openssh-6.6.1p1-11.1.fc21 with default settings. The size of one of
initial packets could be even 1968. Your VPN probably makes a
fragmentation but doesn't do the correct defragmentation. As a
workaround you can set shorter lists of MACs used by your client, eg:

$ ssh -m hmac-sha1 ...


[1]
https://lists.mindrot.org/pipermail/openssh-unix-dev/2013-November/031775.html


> 
> Here's a transcript using ssh -vvv and a build of OpenSSH from
> openssh-6.7p1 sources:
> 
> % ./ssh -vvv docs.rtp.tecnet
> OpenSSH_6.7p1, OpenSSL 1.0.1k-fips 8 Jan 2015
> debug1: Reading configuration data /home/meta/.ssh/config
> /home/meta/.ssh/config line 1: Unsupported option "gssapiauthentication"
> debug2: ssh_connect: needpriv 0
> debug1: Connecting to docs.rtp.tecnet [10.77.16.71] port 22.
> debug1: Connection established.
> debug1: identity file /home/meta/.ssh/id_rsa type 1
> debug1: key_load_public: No such file or directory
> debug1: identity file /home/meta/.ssh/id_rsa-cert type -1
> debug1: key_load_public: No such file or directory
> debug1: identity file /home/meta/.ssh/id_dsa type -1
> debug1: key_load_public: No such file or directory
> debug1: identity file /home/meta/.ssh/id_dsa-cert type -1
> debug1: key_load_public: No such file or directory
> debug1: identity file /home/meta/.ssh/id_ecdsa type -1
> debug1: key_load_public: No such file or directory
> debug1: identity file /home/meta/.ssh/id_ecdsa-cert type -1
> debug1: key_load_public: No such file or directory
> debug1: identity file /home/meta/.ssh/id_ed25519 type -1
> debug1: key_load_public: No such file or directory
> debug1: identity file /home/meta/.ssh/id_ed25519-cert type -1
> debug1: Enabling compatibility mode for protocol 2.0
> debug1: Local version string SSH-2.0-OpenSSH_6.7
> debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3
> debug1: match: OpenSSH_5.3 pat OpenSSH_5* compat 0x0c000000
> debug2: fd 3 setting O_NONBLOCK
> debug3: load_hostkeys: loading entries for host "docs.rtp.tecnet" from file
> "/home/meta/.ssh/known_hosts"
> debug3: load_hostkeys: loaded 0 keys
> debug1: SSH2_MSG_KEXINIT sent
> debug1: SSH2_MSG_KEXINIT received
> debug2: kex_parse_kexinit: curve25519-sha256 at libssh.org
> ,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
> debug2: kex_parse_kexinit: ecdsa-sha2-nistp256-cert-v01 at openssh.com,
> ecdsa-sha2-nistp384-cert-v01 at openssh.com,
> ecdsa-sha2-nistp521-cert-v01 at openssh.com,ssh-ed25519-cert-v01 at openssh.com,
> ssh-rsa-cert-v01 at openssh.com,ssh-dss-cert-v01 at openssh.com,
> ssh-rsa-cert-v00 at openssh.com,ssh-dss-cert-v00 at openssh.com
> ,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,ssh-rsa,ssh-dss
> debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,
> aes128-gcm at openssh.com,aes256-gcm at openssh.com,chacha20-poly1305 at openssh.com
> ,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,
> rijndael-cbc at lysator.liu.se
> debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,
> aes128-gcm at openssh.com,aes256-gcm at openssh.com,chacha20-poly1305 at openssh.com
> ,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,
> rijndael-cbc at lysator.liu.se
> debug2: kex_parse_kexinit: umac-64-etm at openssh.com,umac-128-etm at openssh.com,
> hmac-sha2-256-etm at openssh.com,hmac-sha2-512-etm at openssh.com,
> hmac-sha1-etm at openssh.com,umac-64 at openssh.com,umac-128 at openssh.com
> ,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5-etm at openssh.com,
> hmac-ripemd160-etm at openssh.com,hmac-sha1-96-etm at openssh.com,
> hmac-md5-96-etm at openssh.com,hmac-md5,hmac-ripemd160,
> hmac-ripemd160 at openssh.com,hmac-sha1-96,hmac-md5-96
> debug2: kex_parse_kexinit: umac-64-etm at openssh.com,umac-128-etm at openssh.com,
> hmac-sha2-256-etm at openssh.com,hmac-sha2-512-etm at openssh.com,
> hmac-sha1-etm at openssh.com,umac-64 at openssh.com,umac-128 at openssh.com
> ,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5-etm at openssh.com,
> hmac-ripemd160-etm at openssh.com,hmac-sha1-96-etm at openssh.com,
> hmac-md5-96-etm at openssh.com,hmac-md5,hmac-ripemd160,
> hmac-ripemd160 at openssh.com,hmac-sha1-96,hmac-md5-96
> debug2: kex_parse_kexinit: none,zlib at openssh.com,zlib
> debug2: kex_parse_kexinit: none,zlib at openssh.com,zlib
> debug2: kex_parse_kexinit:
> debug2: kex_parse_kexinit:
> debug2: kex_parse_kexinit: first_kex_follows 0
> debug2: kex_parse_kexinit: reserved 0
> debug2: kex_parse_kexinit:
> diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
> debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
> debug2: kex_parse_kexinit:
> aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,arcfour
> debug2: kex_parse_kexinit:
> aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,arcfour
> debug2: kex_parse_kexinit: hmac-sha1,hmac-ripemd160
> debug2: kex_parse_kexinit: hmac-sha1,hmac-ripemd160
> debug2: kex_parse_kexinit: none,zlib at openssh.com
> debug2: kex_parse_kexinit: none,zlib at openssh.com
> debug2: kex_parse_kexinit:
> debug2: kex_parse_kexinit:
> debug2: kex_parse_kexinit: first_kex_follows 0
> debug2: kex_parse_kexinit: reserved 0
> debug2: mac_setup: setup hmac-sha1
> debug1: kex: server->client aes128-ctr hmac-sha1 none
> debug2: mac_setup: setup hmac-sha1
> debug1: kex: client->server aes128-ctr hmac-sha1 none
> debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<7680<8192) sent
> debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
> [hangs]
> 
> Here's the config output from building OpenSSH as used above:
> 
> OpenSSH has been configured with the following options:
>                      User binaries: /usr/local/bin
>                    System binaries: /usr/local/sbin
>                Configuration files: /usr/local/etc
>                    Askpass program: /usr/local/libexec/ssh-askpass
>                       Manual pages: /usr/local/share/man/manX
>                           PID file: /var/run
>   Privilege separation chroot path: /var/empty
>             sshd default user PATH:
> /usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin
>                     Manpage format: doc
>                        PAM support: no
>                    OSF SIA support: no
>                  KerberosV support: no
>                    SELinux support: no
>                  Smartcard support:
>                      S/KEY support: no
>               MD5 password support: no
>                    libedit support: no
>   Solaris process contract support: no
>            Solaris project support: no
>        IP address in $DISPLAY hack: no
>            Translate v4 in v6 hack: yes
>                   BSD Auth support: no
>               Random number source: OpenSSL internal ONLY
>              Privsep sandbox style: seccomp_filter
> 
>               Host: x86_64-unknown-linux-gnu
>           Compiler: gcc
>     Compiler flags: -g -O2 -Wall -Wpointer-arith -Wuninitialized
> -Wsign-compare -Wformat-security -Wsizeof-pointer-memaccess
> -Wno-pointer-sign -Wno-unused-result -fno-strict-aliasing
> -D_FORTIFY_SOURCE=2 -ftrapv -fno-builtin-memset -fstack-protector-strong
> -fPIE
> Preprocessor flags:
>       Linker flags:  -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack
> -fstack-protector-strong -pie
>          Libraries: -lcrypto -ldl -lutil -lz -lnsl  -lcrypt -lresolv
> 
> So... Any ideas what I can try next to track down the source of the problem?
> 
> 
> mathew
> _______________________________________________
> openssh-unix-dev mailing list
> openssh-unix-dev at mindrot.org
> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
> 


-- 
Petr Lautrbach


From dtucker at zip.com.au  Tue Feb 10 06:28:48 2015
From: dtucker at zip.com.au (Darren Tucker)
Date: Mon, 9 Feb 2015 14:28:48 -0500
Subject: Connection stalls at debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
In-Reply-To: <54D9092E.1060500@redhat.com>
References: <CAL_EfNwUUByc6gGk-ofW3ycossUaRZuFuyrgeeo4xndhPzh9=Q@mail.gmail.com>
 <54D9092E.1060500@redhat.com>
Message-ID: <CALDDTe35CPp-NB+GHd=70ObTB6P4cTsLYdRniinuDJazEF=HqQ@mail.gmail.com>

On Mon, Feb 9, 2015 at 2:23 PM, Petr Lautrbach <plautrba at redhat.com> wrote:

> [...]
> It seems to be the same problem as described and discussed in this [1]
> thread.  MTU 1400 is not enough for packet sent by
> openssh-6.6.1p1-11.1.fc21 with default settings. The size of one of
> initial packets could be even 1968. Your VPN probably makes a
> fragmentation but doesn't do the correct defragmentation. As a
> workaround you can set shorter lists of MACs used by your client, eg:
>

I wrote an FAQ entry for this a long time ago:
http://www.snailbook.com/faq/mtu-mismatch.auto.html

I'd add "if you run netstat on both ends and see "SendQ" non-zero and not
decreasing then this is likely your problem.

I should add this to the openssh.com faq....

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.

From meta at pobox.com  Tue Feb 10 08:50:56 2015
From: meta at pobox.com (mathew)
Date: Mon, 09 Feb 2015 21:50:56 +0000
Subject: Connection stalls at debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
References: <CAL_EfNwUUByc6gGk-ofW3ycossUaRZuFuyrgeeo4xndhPzh9=Q@mail.gmail.com>
 <54D9092E.1060500@redhat.com>
Message-ID: <CAL_EfNyb=R4BqWt+b0uNJKFetW+v_7q24V0AqnJWTA36B7hFyg@mail.gmail.com>

On Mon Feb 09 2015 at 1:23:37 PM Petr Lautrbach <plautrba at redhat.com> wrote:

> It seems to be the same problem as described and discussed in this
> [1] thread.  MTU 1400 is not enough for packet sent by
> openssh-6.6.1p1-11.1.fc21 with default settings. The size of one
> of initial packets could be even 1968. Your VPN probably makes
> a fragmentation but doesn't do the correct defragmentation.


Connections to other servers across the same VPN, using the same OpenSSH
versions, succeed.

However, I've located a second server on the same subnet that's running
OpenSSH 5.9p1 -- would you expect the same problem with that version?

Seems like everything on that particular subnet/at that particular site is
affected.


> As a workaround you can set shorter lists of MACs used by your client, eg:
>
> $ ssh -m hmac-sha1 ...
>

I already checked the FAQ and tried that, but it doesn't seem to help.

% ./ssh -vvv -m hmac-sha1 docs.rtp.tecnet
OpenSSH_6.7p1, OpenSSL 1.0.1k-fips 8 Jan 2015
debug1: Reading configuration data /home/meta/.ssh/config
[...]
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<7680<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP

On Mon Feb 09 2015 at 1:29:17 PM Darren Tucker <dtucker at zip.com.au> wrote:

> I'd add "if you run netstat on both ends and see "SendQ" non-zero and not
> decreasing then this is likely your problem.
>

With the -m parameter as above, running ss on the client, I see Send-Q go
to 1208 and then sit there until I Ctrl-C out the client, when it increases
by 1. On the server side, I see nothing. Is that plausible, that the client
would proceed all the way through to DH_GEX_GROUP without seeing any data?

Without the -m parameter Send-Q goes to 1992.

1208 bytes shouldn't need any fragmentation; I can definitely ping
unfragmented packets that large.

So I'm thinking firewall problem now, but I'm at a loss as to why OpenSSH
is triggering the problem but PuTTY isn't, given that reducing packet size
below the MTU limit doesn't seem to help. Any ideas?

Thanks,


mathew

From dtucker at zip.com.au  Tue Feb 10 09:11:20 2015
From: dtucker at zip.com.au (Darren Tucker)
Date: Mon, 9 Feb 2015 17:11:20 -0500
Subject: Connection stalls at debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
In-Reply-To: <CAL_EfNyb=R4BqWt+b0uNJKFetW+v_7q24V0AqnJWTA36B7hFyg@mail.gmail.com>
References: <CAL_EfNwUUByc6gGk-ofW3ycossUaRZuFuyrgeeo4xndhPzh9=Q@mail.gmail.com>
 <54D9092E.1060500@redhat.com>
 <CAL_EfNyb=R4BqWt+b0uNJKFetW+v_7q24V0AqnJWTA36B7hFyg@mail.gmail.com>
Message-ID: <CALDDTe01pJEf54xgdwocwsNJGLcWyapLJAoU4K-s_TWgkn=etA@mail.gmail.com>

On Mon, Feb 9, 2015 at 4:50 PM, mathew <meta at pobox.com> wrote:
[...]
>
> Connections to other servers across the same VPN, using the same OpenSSH
> versions, succeed.
>

The ciphers offered by a given version of OpenSSH can also vary based on
the version of OpenSSL they were compiled against.


> However, I've located a second server on the same subnet that's running
> OpenSSH 5.9p1 -- would you expect the same problem with that version?
>

It depends.


> With the -m parameter as above, running ss on the client, I see Send-Q go
> to 1208 and then sit there until I Ctrl-C out the client, when it increases
> by 1. On the server side, I see nothing. Is that plausible, that the client
> would proceed all the way through to DH_GEX_GROUP without seeing any data?
>

No, but the size of the packets sent before that point can be small enough
to not trigger MTU problems.

Without the -m parameter Send-Q goes to 1992.
>

What's -m?  my netstat doesn't have it.


> 1208 bytes shouldn't need any fragmentation; I can definitely ping
> unfragmented packets that large.
>
> So I'm thinking firewall problem now, but I'm at a loss as to why OpenSSH
> is triggering the problem but PuTTY isn't, given that reducing packet size
> below the MTU limit doesn't seem to help. Any ideas?
>

There's 3 things that get negotiated: key exchange algorithms
(KexAlgorithms), message authentication codes (MACs) and encryption ciphers
(Cipers).  These vary by SSH implementation and version (and in the case of
OpenSSH, the version of libcrypto too).  In OpenSSH, the cipher selected
also influences the size of the Diffie-Hellman group requested (this is
controlled by the client, and was increased in a recent OpenSSH release)

Try:

ssh -vvv -o KexAlgorithms=diffie-hellman-group14-sha1 yoursever
ssh -vvv -o Ciphers=aes128-ctr yoursever

In particular, make a note of this line in the debug output:

debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<3072<8192) sent

This is the lower, preferred and upper sizes requested.  Exactly which size
gets sent will depend on the content of the servers "moduli" file.

debug2: bits set: 1531/3072

The 2nd number is the size the server actually sent (you'll probably need
to either run the server in debug mode or kick its loglevel to debug2 to
see this for the failure case, though, since it's not making it through).

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.

From meta at pobox.com  Tue Feb 10 09:42:26 2015
From: meta at pobox.com (mathew)
Date: Mon, 09 Feb 2015 22:42:26 +0000
Subject: Connection stalls at debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
References: <CAL_EfNwUUByc6gGk-ofW3ycossUaRZuFuyrgeeo4xndhPzh9=Q@mail.gmail.com>
 <54D9092E.1060500@redhat.com>
 <CAL_EfNyb=R4BqWt+b0uNJKFetW+v_7q24V0AqnJWTA36B7hFyg@mail.gmail.com>
Message-ID: <CAL_EfNwT61HaG1FWDM9D4fyO76dvYodoQEMkgA+SWVtmWneejw@mail.gmail.com>

More info: We've checked firewall logs, and it seems to be a firewall rule
designed to prevent sessions which are subject to the bug detailed at <
http://archives.neohapsis.com/archives/bugtraq/2002-06/0294.html>.

I've tried explicitly setting PAMAuthenticationViaKBDInt no,
KbdInteractiveAuthentication no and UsePrivilegeSeparation yes in
sshd_config, but the problem still occurs, so I think the firewall rule is
buggy.

So, doesn't seem to be an OpenSSH problem per se, but I'll follow up with
anything more I discover in case other people encounter the issue -- it's
possible that the rule in question is deployed quite widely.


mathew

From sshuserga at gmail.com  Tue Feb 10 20:02:44 2015
From: sshuserga at gmail.com (sshuser GA)
Date: Tue, 10 Feb 2015 14:32:44 +0530
Subject: Why there is a difference in MaxAuthTries behavior ?
Message-ID: <CAN8ndJJAxxu_XSrxQOXt6aEun5Kue0N3HTRe5SEvkmUHKVo89A@mail.gmail.com>

Hi,

  I understand MaxAuthTries is a parameter used to restrict the maximum
number of authentication attempts. But I notice a difference in behavior
when run from different client  versions.
  The MaxAuthTries at the server side is 6.  The server side is running
OpenSSH 6.6 version.
  When  wrong password is given from an openssh client 6.1 version, it
disconnects after 3 attempts.
  When  wrong password is given from an openssh client 6.6 version, it
disconnects after 5 attempts.

  What is the reason for this difference ?  Shouldn't the behavior be the
same, across both the clients, since MaxAuthTries is a server side
parameter?

  Regards
  Opensshuser

From jjelen at redhat.com  Tue Feb 10 23:29:07 2015
From: jjelen at redhat.com (Jakub Jelen)
Date: Tue, 10 Feb 2015 13:29:07 +0100
Subject: [openssh-unix-dev] Re: Creating users "on - the - fly"
In-Reply-To: <CAPx_VpOXu5zkYP96hLiq8WSe3rtHDBVf28KbA++9YkGvaF=77w@mail.gmail.com>
References: <CAPx_VpPauUhvSN38rZtJdM2Zym+dF29Xsn7SN3-cxt=JcMBR6w@mail.gmail.com>
 <87386jyljl.fsf@alice.fifthhorseman.net>
 <CAPx_VpPHw+JarFuYdm1EO4n5B5TQO_mBsfnov0YNnJQOsVCJGA@mail.gmail.com>
 <54D50636.9020008@uiowa.edu>
 <CAPx_VpPnwyO8nm9tvF3=o6JDEUB_DTUAcP5jg22BAgWdYOkZ+Q@mail.gmail.com>
 <87oap6yidf.fsf@alice.fifthhorseman.net>
 <D358E5B1511A314F8160ADC6F3754987069F6E36@XYSVEX01.XYPRO-23.LOCAL>
 <CAPx_VpNRcOkgYLR-epDVcbmnD383ebQTjNFCcNqLgbYMQhSoFQ@mail.gmail.com>
 <87bnl6yfil.fsf@alice.fifthhorseman.net>
 <CAPx_VpOXu5zkYP96hLiq8WSe3rtHDBVf28KbA++9YkGvaF=77w@mail.gmail.com>
Message-ID: <54D9F993.10001@redhat.com>

Hello Cary,
just for your information to the topic of problem you wanted to describe:
When you run sshd with -d argument, it will accept only one connection 
and exists, as you can read in man pages (man sshd):

      -d      Debug mode.  The server sends verbose debug output to standard
              error, and does not put itself in the background.  The server
              also will not fork and will only process one connection.  This
              option is only intended for debugging for the server. Multiple
              -d options increase the debugging level.  Maximum is 3.

It is not a bug. It is feature

Best Regards,
Jakub Jelen

On 02/09/2015 06:59 PM, Cary FitzHugh wrote:
> Morning everyone,
>
> I have put into place the lbnns extension https://github.com/hivewing/libnss-ato
> It seems to always resolve every username to the same uid, with no password.
> I've set the shell to bin/false, and put the home dir to /dev/null as well.
>
> And it actually seems to work!
>
> On a connection request, the AuthorzedKeysCommand script is called
> with the right username, letting me look up the username in my
> webservice, and return the list of authorized_keys.
> Wonderful.
>
> I spent a good bit of time banging my head on the wall, trying to
> figure out why I could only get one connection through the sshd server
> before it would crash.  It would accept one connection, every other
> connection request would be ignored.  And once that one connection was
> closed, sshd would exit.
>
> I was running it like so:  /usr/sbin/sshd -D -e -d -d -d
>
> And life was sad. very sad.
>
> I now run it just with /usr/sbin/sshd -D
> and it all seems to work.
>
> I'm not sure if anyone cares that it doesn't work with the three '-d's
> on there.  but if anyone did care, I could try to help them get a
> reproducible case.
>
> Thanks to everyone who helped with suggestions!
>
> Cary
>
> On Fri, Feb 6, 2015 at 3:02 PM, Daniel Kahn Gillmor
> <dkg at fifthhorseman.net> wrote:
>> On Fri 2015-02-06 14:30:13 -0500, Cary FitzHugh wrote:
>>> Hence  - maybe a NSS User Database extension which looks for the
>>> public keys from a webservice (and then maybe writes them to
>>> /tmp/<username>.
>> No, i'm suggesting that when you want to look up the user, use NSS to
>> find the username and map it to a numeric user ID and the other
>> information that is typically found in /etc/passwd.  this doesn't write
>> anything to the local disk.
>>
>>> The AuthorzedKeysCommand could then just return the tmp/username information..
>> Then the AuthorizedKeysCommand can return the proper key material.
>>
>>       --dkg
> _______________________________________________
> openssh-unix-dev mailing list
> openssh-unix-dev at mindrot.org
> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev


From crrodriguez at opensuse.org  Thu Feb 12 04:46:50 2015
From: crrodriguez at opensuse.org (=?UTF-8?q?Cristian=20Rodr=C3=ADguez?=)
Date: Wed, 11 Feb 2015 14:46:50 -0300
Subject: [PATCH] seccomp: allow the getrandom system call.
Message-ID: <1423676810-21460-1-git-send-email-crrodriguez@opensuse.org>

*SSL libraries or the C library may/will require it.
---
 sandbox-seccomp-filter.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
index b6f6258..846bc08 100644
--- a/sandbox-seccomp-filter.c
+++ b/sandbox-seccomp-filter.c
@@ -129,6 +129,9 @@ static const struct sock_filter preauth_insns[] = {
 #else
 	SC_ALLOW(sigprocmask),
 #endif
+#ifdef __NR_getrandom
+	SC_ALLOW(getrandom),
+#endif
 	BPF_STMT(BPF_RET+BPF_K, SECCOMP_FILTER_FAIL),
 };
 
-- 
2.2.2


From crrodriguez at opensuse.org  Thu Feb 12 04:51:23 2015
From: crrodriguez at opensuse.org (=?UTF-8?q?Cristian=20Rodr=C3=ADguez?=)
Date: Wed, 11 Feb 2015 14:51:23 -0300
Subject: [PATCH] configure: Fix b64_ntop, b64_pton detection on linux systems
Message-ID: <1423677083-21671-1-git-send-email-crrodriguez@opensuse.org>

These functions are available in libresolv and the public
declarations are macros.
---
 configure.ac | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/configure.ac b/configure.ac
index cb66f54..818b652 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1605,6 +1605,10 @@ if test "x$use_pie" != "xno"; then
 	fi
 fi
 
+AC_CHECK_DECLS([b64_ntop, b64_pton], [], [], [#include <resolv.h>])
+AC_SEARCH_LIBS([__b64_ntop], [resolv])
+AC_SEARCH_LIBS([__b64_pton], [resolv])
+
 dnl    Checks for library functions. Please keep in alphabetical order
 AC_CHECK_FUNCS([ \
 	Blowfish_initstate \
-- 
2.2.2


From imorgan at nas.nasa.gov  Thu Feb 12 05:59:44 2015
From: imorgan at nas.nasa.gov (Iain Morgan)
Date: Wed, 11 Feb 2015 10:59:44 -0800
Subject: Why there is a difference in MaxAuthTries behavior ?
In-Reply-To: <CAN8ndJJAxxu_XSrxQOXt6aEun5Kue0N3HTRe5SEvkmUHKVo89A@mail.gmail.com>
References: <CAN8ndJJAxxu_XSrxQOXt6aEun5Kue0N3HTRe5SEvkmUHKVo89A@mail.gmail.com>
Message-ID: <20150211185944.GB6608@linux124.nas.nasa.gov>

On Tue, Feb 10, 2015 at 14:32:44 +0530, sshuser GA wrote:
> Hi,
> 
>   I understand MaxAuthTries is a parameter used to restrict the maximum
> number of authentication attempts. But I notice a difference in behavior
> when run from different client  versions.
>   The MaxAuthTries at the server side is 6.  The server side is running
> OpenSSH 6.6 version.
>   When  wrong password is given from an openssh client 6.1 version, it
> disconnects after 3 attempts.
>   When  wrong password is given from an openssh client 6.6 version, it
> disconnects after 5 attempts.
> 
>   What is the reason for this difference ?  Shouldn't the behavior be the
> same, across both the clients, since MaxAuthTries is a server side
> parameter?
> 

Keep in mind that MaxAuthTries is applied against _all_ authentication
methods -- not just password authentication. If you use ssh -v, I expect
that you will see that the apparent discrepancy is due to public-key or
hostbased authentication attempts.

Also, it may be that your clients have NumberOfPasswordPrompts set
inconsistently.

-- 
Iain Morgan

From ldv at altlinux.org  Thu Feb 12 06:08:12 2015
From: ldv at altlinux.org (Dmitry V. Levin)
Date: Wed, 11 Feb 2015 22:08:12 +0300
Subject: [PATCH] seccomp: allow the getrandom system call.
In-Reply-To: <1423676810-21460-1-git-send-email-crrodriguez@opensuse.org>
References: <1423676810-21460-1-git-send-email-crrodriguez@opensuse.org>
Message-ID: <20150211190812.GA28660@altlinux.org>

On Wed, Feb 11, 2015 at 02:46:50PM -0300, Cristian Rodr?guez wrote:
> *SSL libraries or the C library may/will require it.

In what circumstances do they need it?
Do they need it with GRND_RANDOM bit set?

Note that this system call equivalents to opening (with subsequent
reading) of /dev/random and /dev/urandom, which is not allowed by this
seccomp filter.

> --- a/sandbox-seccomp-filter.c
> +++ b/sandbox-seccomp-filter.c
> @@ -129,6 +129,9 @@ static const struct sock_filter preauth_insns[] = {
>  #else
>  	SC_ALLOW(sigprocmask),
>  #endif
> +#ifdef __NR_getrandom
> +	SC_ALLOW(getrandom),
> +#endif
>  	BPF_STMT(BPF_RET+BPF_K, SECCOMP_FILTER_FAIL),
>  };
>  

-- 
ldv
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 181 bytes
Desc: not available
URL: <http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20150211/422353d8/attachment.bin>

From djm at mindrot.org  Thu Feb 12 08:47:42 2015
From: djm at mindrot.org (Damien Miller)
Date: Thu, 12 Feb 2015 08:47:42 +1100 (AEDT)
Subject: Why there is a difference in MaxAuthTries behavior ?
In-Reply-To: <20150211185944.GB6608@linux124.nas.nasa.gov>
References: <CAN8ndJJAxxu_XSrxQOXt6aEun5Kue0N3HTRe5SEvkmUHKVo89A@mail.gmail.com>
 <20150211185944.GB6608@linux124.nas.nasa.gov>
Message-ID: <alpine.BSO.2.11.1502120847100.29759@natsu.mindrot.org>

On Wed, 11 Feb 2015, Iain Morgan wrote:

> On Tue, Feb 10, 2015 at 14:32:44 +0530, sshuser GA wrote:
> > Hi,
> > 
> >   I understand MaxAuthTries is a parameter used to restrict the maximum
> > number of authentication attempts. But I notice a difference in behavior
> > when run from different client  versions.
> >   The MaxAuthTries at the server side is 6.  The server side is running
> > OpenSSH 6.6 version.
> >   When  wrong password is given from an openssh client 6.1 version, it
> > disconnects after 3 attempts.
> >   When  wrong password is given from an openssh client 6.6 version, it
> > disconnects after 5 attempts.
> > 
> >   What is the reason for this difference ?  Shouldn't the behavior be the
> > same, across both the clients, since MaxAuthTries is a server side
> > parameter?
> > 
> 
> Keep in mind that MaxAuthTries is applied against _all_ authentication
> methods -- not just password authentication. If you use ssh -v, I expect
> that you will see that the apparent discrepancy is due to public-key or
> hostbased authentication attempts.
> 
> Also, it may be that your clients have NumberOfPasswordPrompts set
> inconsistently.

Or your server was patched to ignore public key queries (also in HEAD).

From djm at mindrot.org  Thu Feb 12 21:45:21 2015
From: djm at mindrot.org (Damien Miller)
Date: Thu, 12 Feb 2015 21:45:21 +1100 (AEDT)
Subject: [PATCH] seccomp: allow the getrandom system call.
In-Reply-To: <20150211190812.GA28660@altlinux.org>
References: <1423676810-21460-1-git-send-email-crrodriguez@opensuse.org>
 <20150211190812.GA28660@altlinux.org>
Message-ID: <alpine.BSO.2.11.1502122143570.4850@natsu.mindrot.org>

On Wed, 11 Feb 2015, Dmitry V. Levin wrote:

> On Wed, Feb 11, 2015 at 02:46:50PM -0300, Cristian Rodr?guez wrote:
> > *SSL libraries or the C library may/will require it.
> 
> In what circumstances do they need it?
> Do they need it with GRND_RANDOM bit set?
> 
> Note that this system call equivalents to opening (with subsequent
> reading) of /dev/random and /dev/urandom, which is not allowed by this
> seccomp filter.

IMO they shouldn't need it - we take care to prime both the arc4random
and libcrypto pools before sandboxing.

I don't mind adding it though, and don't think it hurts.

-d

From shinose at gmail.com  Thu Feb 12 23:42:24 2015
From: shinose at gmail.com (Shinose)
Date: Thu, 12 Feb 2015 18:12:24 +0530
Subject: SSH_MSG_SERVICE_ACCEPT is not received at the sftp client
Message-ID: <CABc3zkiWJ7K3zcQ1r5g=vmPMbVv2yaDEVcUwTXdVkzEbPHaJQA@mail.gmail.com>

Hi All,

I am currently trying to port sshd and sftpserver to an embedded OS
which is having a Single Monolith Process Space.

Hence I have converted the whole openssh code re-entrant for the RTOS tasks.

The re-entrant code is tested and is working under Linux.

But once I started the sshd running on the target, it looks like the
sshd sends the SSH_MSG_SERVICE_ACCEPT but is NOT received by the sftp
client.

Hence the client infinitely waits after sending
SSH2_MSG_SERVICE_REQUEST and no further communication is happening.

The sshd is in the select() loop as normal after sending the
SSH_MSG_SERVICE_ACCEPT packet.

It would be highly helpful if you could put some pointers to overcome
this issue.

Following is the client and server logs.

sftp client log (Ubuntu) : http://pastebin.com/9697H7Y7
...
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent

sshd log (RTOS) : http://pastebin.com/3U3Mw2d9
...
I/O: debug2: set_newkeys: mode 1
I/O: debug2: cipher_init_context: 1
I/O: debug2: packet_send done
I/O: debug2: SSH2_MSG_NEWKEYS sent
I/O: debug2: expecting SSH2_MSG_NEWKEYS
I/O: debug2: packet_read()
I/O: debug2: input: packet len 16
I/O: debug2: partial packet: block 8, need 8, maclen 0, authlen 0, aadlen 0
I/O: read_poll enc/full: 0000 0000 0000 0000
I/O: debug2: input: padlen 10
I/O: debug2: input: len before de-compress 1
I/O: debug2: set_newkeys: mode 0
I/O: debug2: cipher_init_context: 0
I/O: read/plain[21]:
I/O:
I/O: debug2: received packet type 21
I/O: debug2: SSH2_MSG_NEWKEYS received
I/O: debug2: KEX done
I/O: debug2: packet_read()
I/O: debug2: input: packet len 32
I/O: debug2: partial packet: block 16, need 16, maclen 16, authlen 0, aadlen 0
I/O: read_poll enc/full: 80e5 0ff5 e0c5 6f48 62cb 4383 6c43 2e98
I/O: b28a 3677 5765 5d81 fc18 b389 9f5d e203
I/O:
I/O: debug2: MAC #4 ok
I/O: debug2: input: padlen 10
I/O: debug2: input: len before de-compress 17
I/O: read/plain[5]:
I/O: 0000 000c 7373 682d 7573 6572 6175 7468
I/O:
I/O: debug2: received packet type 5
I/O: debug2: packet_start[6]
I/O: plain:     0000 0000 0006 0000 000c 7373 682d 7573
I/O: 6572 6175 7468
I/O: debug2: send: len 32 (includes padlen 10, aadlen 0)
I/O: debug2: done calc MAC out #4
I/O: encrypted: 77c1 c72a 976c 4e1e 0461 8a11 5391 9d0d
I/O: d85d db30 73f1 0286 11a4 add3 8e07 4b5b
I/O:
I/O: debug2: packet_send done
I/O: debug2: packet_read()


Thanks,
Shinose.

From ldv at altlinux.org  Fri Feb 13 05:40:58 2015
From: ldv at altlinux.org (Dmitry V. Levin)
Date: Thu, 12 Feb 2015 21:40:58 +0300
Subject: [PATCH] seccomp: allow the getrandom system call.
In-Reply-To: <alpine.BSO.2.11.1502122143570.4850@natsu.mindrot.org>
References: <1423676810-21460-1-git-send-email-crrodriguez@opensuse.org>
 <20150211190812.GA28660@altlinux.org>
 <alpine.BSO.2.11.1502122143570.4850@natsu.mindrot.org>
Message-ID: <20150212184058.GA1530@altlinux.org>

On Thu, Feb 12, 2015 at 09:45:21PM +1100, Damien Miller wrote:
> On Wed, 11 Feb 2015, Dmitry V. Levin wrote:
> > On Wed, Feb 11, 2015 at 02:46:50PM -0300, Cristian Rodr?guez wrote:
> > > *SSL libraries or the C library may/will require it.
> > 
> > In what circumstances do they need it?
> > Do they need it with GRND_RANDOM bit set?
> > 
> > Note that this system call equivalents to opening (with subsequent
> > reading) of /dev/random and /dev/urandom, which is not allowed by this
> > seccomp filter.
> 
> IMO they shouldn't need it - we take care to prime both the arc4random
> and libcrypto pools before sandboxing.

They definitely don't need it now as neither /dev/random nor /dev/urandom
is available in _PATH_PRIVSEP_CHROOT_DIR.

> I don't mind adding it though, and don't think it hurts.

Unlimited access to /dev/random could be used to cause system entropy
starvation, so please don't add it.


-- 
ldv
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 181 bytes
Desc: not available
URL: <http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20150212/d3f86fb4/attachment.bin>

From meta at pobox.com  Sat Feb 14 05:35:47 2015
From: meta at pobox.com (mathew)
Date: Fri, 13 Feb 2015 18:35:47 +0000
Subject: Connection stalls at debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
References: <CAL_EfNwUUByc6gGk-ofW3ycossUaRZuFuyrgeeo4xndhPzh9=Q@mail.gmail.com>
 <54D9092E.1060500@redhat.com>
 <CAL_EfNyb=R4BqWt+b0uNJKFetW+v_7q24V0AqnJWTA36B7hFyg@mail.gmail.com>
 <CAL_EfNwT61HaG1FWDM9D4fyO76dvYodoQEMkgA+SWVtmWneejw@mail.gmail.com>
Message-ID: <CAL_EfNy9o+Lt11beNAtWmRvSFaKOX2HGJgNjvAFt6=GyROV91A@mail.gmail.com>

Root cause established: A firewall appliance was replaced, and an error
installing the replacement meant it wasn't receiving rule updates. So, no
action at all needed by OpenSSH. Thanks, and sorry for the false alarm.


mathew

On Mon Feb 09 2015 at 4:42:25 PM mathew <meta at pobox.com> wrote:

> More info: We've checked firewall logs, and it seems to be a firewall rule
> designed to prevent sessions which are subject to the bug detailed at <
> http://archives.neohapsis.com/archives/bugtraq/2002-06/0294.html>.
>
> I've tried explicitly setting PAMAuthenticationViaKBDInt no,
> KbdInteractiveAuthentication no and UsePrivilegeSeparation yes in
> sshd_config, but the problem still occurs, so I think the firewall rule is
> buggy.
>
> So, doesn't seem to be an OpenSSH problem per se, but I'll follow up with
> anything more I discover in case other people encounter the issue -- it's
> possible that the rule in question is deployed quite widely.
>
>
> mathew
>

From johandewolff at outlook.com  Sun Feb 15 06:27:05 2015
From: johandewolff at outlook.com (Johan De Wolff)
Date: Sat, 14 Feb 2015 20:27:05 +0100
Subject: Logging input
Message-ID: <BAY179-W7F97665F48235634F00A1CB200@phx.gbl>

Hey,

I'm currently trying to add some extra logging functionalities to OpenSSH. However, I'd like to log all commands the client sends to the server.

But I'm unable to find where exactly this happens in the OpenSSH source. 
I've tried the do_child() function but that did not work. 

Am I forgetting something?


Thank you,
Johan.
 		 	   		  

From peter at stuge.se  Sun Feb 15 06:38:03 2015
From: peter at stuge.se (Peter Stuge)
Date: Sat, 14 Feb 2015 20:38:03 +0100
Subject: Logging input
In-Reply-To: <BAY179-W7F97665F48235634F00A1CB200@phx.gbl>
References: <BAY179-W7F97665F48235634F00A1CB200@phx.gbl>
Message-ID: <20150214193803.4176.qmail@stuge.se>

Johan De Wolff wrote:
> I'm currently trying to add some extra logging functionalities to OpenSSH.
> However, I'd like to log all commands the client sends to the server.
> 
> But I'm unable to find where exactly this happens in the OpenSSH source. 

OpenSSH is not really involved in commands that the client's terminal
emulator sends to the shell running on the server.


//Peter

From jbasney at illinois.edu  Tue Feb 17 03:12:50 2015
From: jbasney at illinois.edu (Basney, Jim)
Date: Mon, 16 Feb 2015 16:12:50 +0000
Subject: Logging input
In-Reply-To: <BAY179-W7F97665F48235634F00A1CB200@phx.gbl>
References: <BAY179-W7F97665F48235634F00A1CB200@phx.gbl>
Message-ID: <D1077297.11D5F1%jbasney@illinois.edu>

On 2/14/15, 2:27 PM, Johan De Wolff wrote:
>I'm currently trying to add some extra logging functionalities to
>OpenSSH. However, I'd like to log all commands the client sends to the
>server.
>
>But I'm unable to find where exactly this happens in the OpenSSH source.
>I've tried the do_child() function but that did not work.

https://code.google.com/p/auditing-sshd/ may provide a helpful example.

-Jim


From igor at mir2.org  Tue Feb 17 17:51:27 2015
From: igor at mir2.org (Igor Bukanov)
Date: Tue, 17 Feb 2015 07:51:27 +0100
Subject: matching on client public key
Message-ID: <CADd11yUM_Le7Y0iEONHwjcFY=81U6OSU2QKAvS8xTt6OzbMwhQ@mail.gmail.com>

As I understand currently there is no way in sshd_config to match
based on the client public key so different configuration for the same
username can be applied depending on the key, right?

My case is a backup login that needs to run as a root to access all
the files and where I want to use ForceCommand to allow the login only
to execute a particular command and yet still allow normal root
logins. As a workaround currently I have a dummy account with
ForceCommand that executes a setuid wrapper for the backup where the
wrapper can only run from that account. It works, but it would be nice
to avoid this error-prone extra-account+setuid combination and allow
in sshd_config either to match based on public keys or to support
custom mapping of ssh accounts into system ones.

From gert at greenie.muc.de  Tue Feb 17 20:01:44 2015
From: gert at greenie.muc.de (Gert Doering)
Date: Tue, 17 Feb 2015 10:01:44 +0100
Subject: matching on client public key
In-Reply-To: <CADd11yUM_Le7Y0iEONHwjcFY=81U6OSU2QKAvS8xTt6OzbMwhQ@mail.gmail.com>
References: <CADd11yUM_Le7Y0iEONHwjcFY=81U6OSU2QKAvS8xTt6OzbMwhQ@mail.gmail.com>
Message-ID: <20150217090144.GD8134@greenie.muc.de>

Hi,

On Tue, Feb 17, 2015 at 07:51:27AM +0100, Igor Bukanov wrote:
> My case is a backup login that needs to run as a root to access all
> the files and where I want to use ForceCommand to allow the login only
> to execute a particular command and yet still allow normal root
> logins. 

You can put command="..." in $HOME/.ssh/authorized_keys

gert
-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de

From igor at mir2.org  Tue Feb 17 21:06:17 2015
From: igor at mir2.org (Igor Bukanov)
Date: Tue, 17 Feb 2015 11:06:17 +0100
Subject: matching on client public key
In-Reply-To: <20150217090144.GD8134@greenie.muc.de>
References: <CADd11yUM_Le7Y0iEONHwjcFY=81U6OSU2QKAvS8xTt6OzbMwhQ@mail.gmail.com>
 <20150217090144.GD8134@greenie.muc.de>
Message-ID: <CADd11yXFjV85=Ny9fAGqfF+37uv_ycK7xaqkkHOokb60_LCASw@mail.gmail.com>

Thanks, I missed that authorized_keys can contain all the configuration I need.

On 17 February 2015 at 10:01, Gert Doering <gert at greenie.muc.de> wrote:
> Hi,
>
> On Tue, Feb 17, 2015 at 07:51:27AM +0100, Igor Bukanov wrote:
>> My case is a backup login that needs to run as a root to access all
>> the files and where I want to use ForceCommand to allow the login only
>> to execute a particular command and yet still allow normal root
>> logins.
>
> You can put command="..." in $HOME/.ssh/authorized_keys
>
> gert
> --
> USENET is *not* the non-clickable part of WWW!
>                                                            //www.muc.de/~gert/
> Gert Doering - Munich, Germany                             gert at greenie.muc.de
> fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de

From mthode at mthode.org  Wed Feb 18 12:38:50 2015
From: mthode at mthode.org (Matthew Thode)
Date: Tue, 17 Feb 2015 19:38:50 -0600
Subject: should openssh close sockets when closing a socket forwarded
 connection?
Message-ID: <54E3ED2A.40505@mthode.org>

Openssh doesn't seem to close sockets on disconnect when forwarding
sockets.  Should openssh handle the close of the remote side of the
forwarded socket?  Openssh also does not overwrite a socket file if
forwarding.  This makes forwarding sockets a bit hard.

-- 
Matthew Thode

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 801 bytes
Desc: OpenPGP digital signature
URL: <http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20150217/b639dda9/attachment.bin>

From hvjunk at gmail.com  Thu Feb 19 04:07:57 2015
From: hvjunk at gmail.com (Hendrik Visage)
Date: Wed, 18 Feb 2015 19:07:57 +0200
Subject: ssh_config "database"/"sort"able format?
Message-ID: <CADtGFvneKuBc=8J+-LPqadd=qtzarNvDnTFTbMwJnRSFQg=aBA@mail.gmail.com>

Hi there,

 I'm in a situation where some of my clients have all these obscurity
things with ssh, like putting it on a different port, or a different
user to login for this specific host not mention several don't have
proper DNS names and and and. Life is to short to debate it with the
client so rather get in line, use ssh_config, and continue to serve
the client.

 However, now I have the case that the ssh_config file on the desktop,
is out of sync with the laptop, is out of sync with the jump is out of
sync with the helping hand and generally it's out of sync. Yes,
considering git/etc. but still, I'm stuck with some specific other
settings that's different from the laptop from the desktop etc.

Now my first solution would be: sort < ssh_config > laptop.conf; diff
latop.conf desktop.conf, but the file layout just doesn't work with
that :(

Questions:
- Is there anybody that see a value in a format/parser/matcher for
ssh_config files to be able to merge/"diff"/sort these files?
- Any other ideas/solutions I could consider to manage these ssh_config files?

From ag4ve.us at gmail.com  Thu Feb 19 09:11:38 2015
From: ag4ve.us at gmail.com (shawn wilson)
Date: Wed, 18 Feb 2015 17:11:38 -0500
Subject: ssh_config "database"/"sort"able format?
In-Reply-To: <CADtGFvneKuBc=8J+-LPqadd=qtzarNvDnTFTbMwJnRSFQg=aBA@mail.gmail.com>
References: <CADtGFvneKuBc=8J+-LPqadd=qtzarNvDnTFTbMwJnRSFQg=aBA@mail.gmail.com>
Message-ID: <CAH_OBifsG8E16E0EYOF0ZLbADa+MPBxnaTfqheXP8B5QY5tgWw@mail.gmail.com>

On Feb 18, 2015 2:53 PM, "Hendrik Visage" <hvjunk at gmail.com> wrote:
>

>
> Questions:
> - Is there anybody that see a value in a format/parser/matcher for
> ssh_config files to be able to merge/"diff"/sort these files?

I've started on a perl module to go through an ssh config and compile what
ssh should do for a given host (mainly to only ssh-add a key when a host is
configured to use it). I would prefer an abstract config backend though.

> - Any other ideas/solutions I could consider to manage these ssh_config
files?
>

You can make a compile script that takes ordered parts of a config and
builds an ssh_config and then you're only checking in and/or comparing
project specific bits.

From ismail at donmez.ws  Fri Feb 20 00:24:08 2015
From: ismail at donmez.ws (=?UTF-8?B?xLBzbWFpbCBEw7ZubWV6?=)
Date: Thu, 19 Feb 2015 15:24:08 +0200
Subject: [PATCH] Unbreak compilation with --without-ssh1
Message-ID: <CAJ1KOAjw-EiQ3N6y9j6xHWjLDJP2ZZuJJ2T0VPLddDp83TVT2Q@mail.gmail.com>

Hi,

Patch attached for $SUBJECT.

ismail

From charles at dyfis.net  Fri Feb 20 05:37:03 2015
From: charles at dyfis.net (Charles Duffy)
Date: Thu, 19 Feb 2015 12:37:03 -0600
Subject: Proposal: Allow HostKeyAlias to be used in hostname check against
 certificate principal.
Message-ID: <CAEHm_sgxDoG2yrkjo7POn97eKMYvWz0p1ymeypd_NaaX55Y9mw@mail.gmail.com>

Howdy --

I have a number of servers with host keys validated by certificates.
These systems are behind a load-balanced frontend, and the
certificates are signed as valid for the DNS name used by that common
frontend address.

This works well for the primary use case of the systems; however, when
wishing to address only a single unit within the pool, the certificate
cannot be used to validate that host's legitimacy, as the individual
address of that host does not match against the name listed in the
principal.

>From the perspective of the end user, wishing to connect against a
specific address (as specified in the HostName option), but perform
validation against a user-specified name that differs from that
address seems a legitimate request -- one may also have a situation
where name resolution is not available, for instance, and wish to
connect to a system whose name is known by IP without the situation
posited above.

I'd like to propose that if HostKeyAlias is set, this be used as a
second name against which a certificate may be considered valid,
should it match.


A trivial patch implementing this behavior is attached.

From scott_n at xypro.com  Fri Feb 20 06:13:46 2015
From: scott_n at xypro.com (Scott Neugroschl)
Date: Thu, 19 Feb 2015 19:13:46 +0000
Subject: Make tests on a cross compile?
In-Reply-To: <alpine.BSO.2.11.1502090911320.23518@natsu.mindrot.org>
References: <D358E5B1511A314F8160ADC6F3754987069F6D60@XYSVEX01.XYPRO-23.LOCAL>
 <alpine.BSO.2.11.1502090911320.23518@natsu.mindrot.org>
Message-ID: <D358E5B1511A314F8160ADC6F3754987069FA75E@XYSVEX01.XYPRO-23.LOCAL>

On Sunday, February 08, 2015, Damien wrote: 
>On Fri, 6 Feb 2015, Scott Neugroschl wrote:

>> I may have asked this before ... my memory is bad.
>> 
>> Is it possible to run "make tests" on a cross-compile build?
>Where would you be running the tests? You couldn't run them on the host compiler.
>They should work fine if you copy the build directory to the target platform and run them there.

With some minor tweaks -- bulding modpipe and disabling some dependencies in the
makefile --transferring the build directory did in fact work.

Thanks again, Damien!

From dtucker at zip.com.au  Fri Feb 20 08:05:38 2015
From: dtucker at zip.com.au (Darren Tucker)
Date: Thu, 19 Feb 2015 16:05:38 -0500
Subject: [PATCH] Unbreak compilation with --without-ssh1
In-Reply-To: <CAJ1KOAjw-EiQ3N6y9j6xHWjLDJP2ZZuJJ2T0VPLddDp83TVT2Q@mail.gmail.com>
References: <CAJ1KOAjw-EiQ3N6y9j6xHWjLDJP2ZZuJJ2T0VPLddDp83TVT2Q@mail.gmail.com>
Message-ID: <CALDDTe0TFNbefaT05pha-07xZrudsepZh7d6cTEm7J_NS5X0MA@mail.gmail.com>

Unfortunately the patch didn't make it (the list server strips out all
attachments that are not text/plain).  Could you please resend either
inline or as text/plain?  If not, the other alternative is to attach it to
a bug at https://bugzilla.mindrot.org.

Thanks.

On Thu, Feb 19, 2015 at 8:24 AM, ?smail D?nmez <ismail at donmez.ws> wrote:

> Hi,
>
> Patch attached for $SUBJECT.
>
> ismail
> _______________________________________________
> openssh-unix-dev mailing list
> openssh-unix-dev at mindrot.org
> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
>



-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.

From keisial at gmail.com  Fri Feb 20 08:30:24 2015
From: keisial at gmail.com (=?UTF-8?B?w4FuZ2VsIEdvbnrDoWxleg==?=)
Date: Thu, 19 Feb 2015 22:30:24 +0100
Subject: [PATCH] Unbreak compilation with --without-ssh1
In-Reply-To: <CAJ1KOAjw-EiQ3N6y9j6xHWjLDJP2ZZuJJ2T0VPLddDp83TVT2Q@mail.gmail.com>
References: <CAJ1KOAjw-EiQ3N6y9j6xHWjLDJP2ZZuJJ2T0VPLddDp83TVT2Q@mail.gmail.com>
Message-ID: <54E655F0.8000002@gmail.com>

On 19/02/15 14:24, ?smail D?nmez wrote:
> Hi,
>
> Patch attached for $SUBJECT.
>
> ismail

SSH/2.0 404 Patch not found

X-Content-Filtered-By: Mailman/MimeDel 2.1.17



From keisial at gmail.com  Fri Feb 20 08:32:01 2015
From: keisial at gmail.com (=?ISO-8859-1?Q?=C1ngel_Gonz=E1lez?=)
Date: Thu, 19 Feb 2015 22:32:01 +0100
Subject: Proposal: Allow HostKeyAlias to be used in hostname check against
 certificate principal.
In-Reply-To: <CAEHm_sgxDoG2yrkjo7POn97eKMYvWz0p1ymeypd_NaaX55Y9mw@mail.gmail.com>
References: <CAEHm_sgxDoG2yrkjo7POn97eKMYvWz0p1ymeypd_NaaX55Y9mw@mail.gmail.com>
Message-ID: <54E65651.4040807@gmail.com>

On 19/02/15 19:37, Charles Duffy wrote:
> A trivial patch implementing this behavior is attached.
Also stripped by the mailing list. Make sure you are attaching it with 
the proper mime type.


PS: That seems a good idea.




From charles at dyfis.net  Fri Feb 20 08:39:28 2015
From: charles at dyfis.net (Charles Duffy)
Date: Thu, 19 Feb 2015 15:39:28 -0600
Subject: Proposal: Allow HostKeyAlias to be used in hostname check against
 certificate principal.
In-Reply-To: <54E65651.4040807@gmail.com>
References: <CAEHm_sgxDoG2yrkjo7POn97eKMYvWz0p1ymeypd_NaaX55Y9mw@mail.gmail.com>
 <54E65651.4040807@gmail.com>
Message-ID: <CAEHm_shCFUN5kDczn50jaKXYFafHHZbLB+7uLaCNZNpirNxgYw@mail.gmail.com>

The note is appreciated. This patch is now available from github, as
https://github.com/charles-dyfis-net/openssh-portable/compare/openssh:773dda2...charles-dyfis-net:host-key-alias-cert-check
and as inline plaintext below.


>From 367fd8323d864daaf486047850f93c2167c66f37 Mon Sep 17 00:00:00 2001
From: Charles Duffy <charles at threatgrid.com>
Date: Tue, 17 Feb 2015 09:49:32 -0600
Subject: [PATCH] Allow HostKeyAlias to match a host certificate principal if
 HostName does not

---
 sshconnect.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/sshconnect.c b/sshconnect.c
index df921be..666c3ff 100644
--- a/sshconnect.c
+++ b/sshconnect.c
@@ -902,7 +902,8 @@ check_host_key(char *hostname, struct sockaddr
*hostaddr, u_short port,
                debug("Found %s in %s:%lu", want_cert ? "CA key" : "key",
                    host_found->file, host_found->line);
                if (want_cert && !check_host_cert(hostname, host_key))
-                       goto fail;
+                       if (options.host_key_alias == NULL ||
!check_host_cert(options.host_key_alias, host_key))
+                               goto fail;
                if (options.check_host_ip && ip_status == HOST_NEW) {
                        if (readonly || want_cert)
                                logit("%s host key for IP address "
--
2.0.0

On Thu, Feb 19, 2015 at 3:32 PM, ?ngel Gonz?lez <keisial at gmail.com> wrote:
> On 19/02/15 19:37, Charles Duffy wrote:
>>
>> A trivial patch implementing this behavior is attached.
>
> Also stripped by the mailing list. Make sure you are attaching it with the
> proper mime type.
>
>
> PS: That seems a good idea.
>
>
>

From scott_n at xypro.com  Fri Feb 20 09:01:29 2015
From: scott_n at xypro.com (Scott Neugroschl)
Date: Thu, 19 Feb 2015 22:01:29 +0000
Subject: Privsep question
Message-ID: <D358E5B1511A314F8160ADC6F3754987069FA801@XYSVEX01.XYPRO-23.LOCAL>

Is there a reason that the Privsep user is defined at compile time instead of in sshd_config?

---
Scott Neugroschl | XYPRO Technology Corporation
4100 Guardian Street | Suite 100 |Simi Valley, CA 93063 | Phone 805 583-2874|Fax 805 583-0124 |


From djm at mindrot.org  Fri Feb 20 09:21:10 2015
From: djm at mindrot.org (Damien Miller)
Date: Fri, 20 Feb 2015 09:21:10 +1100 (AEDT)
Subject: Call for testing: OpenSSH 6.8
Message-ID: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>

Hi,

OpenSSH 6.8 is almost ready for release, so we would appreciate testing
on as many platforms and systems as possible. This release contains
some substantial new features and a number of bugfixes.

Snapshot releases for portable OpenSSH are available from
http://www.mindrot.org/openssh_snap/

The OpenBSD version is available in CVS HEAD:
http://www.openbsd.org/anoncvs.html

Portable OpenSSH is also available via anonymous CVS using the
instructions at http://www.openssh.com/portable.html#cvs or
via Git at https://anongit.mindrot.org/openssh.git/

Running the regression tests supplied with Portable OpenSSH does not
require installation and is a simply:

$ ./configure && make tests

Live testing on suitable non-production systems is also
appreciated. Please send reports of success or failure to
openssh-unix-dev at mindrot.org.

Below is a summary of changes. More detail may be found in the ChangeLog
in the portable OpenSSH tarballs.

Thanks to the many people who contributed to this release.

Changes since OpenSSH 6.7
=========================

This is a major release, containing a number of new features as
well as a large internal re-factoring.

Potentially-incompatible changes
--------------------------------

 * sshd(8): UseDNS now defaults to 'no'. Configurations that match
   against the client host name (via sshd_config or authorized_keys)
   may need to re-enable it or convert to matching against addresses.

New Features
------------

 * Much of OpenSSH's internal code has been re-factored to be more
   library-like. These changes are mostly not user-visible, but
   have greatly improved OpenSSH's testability and internal layout.

 * Add FingerprintHash option to ssh(1) and sshd(8), and equivalent
   command-line flags to the other tools to control algorithm used
   for key fingerprints. The default changes from MD5 to SHA256 and
   format from hex to base64.

   Fingerprints now have the hash algorithm prepended. An example of
   the new format: SHA256:mVPwvezndPv/ARoIadVY98vAC0g+P/5633yTC4d/wXE
   Please note that visual host keys will also be different.

 * ssh(1), sshd(8): Host key rotation support. Add a protocol
   extension for a server to inform a client of all its available
   host keys after authentication has completed. The client may
   record the keys in known_hosts, allowing it to upgrade to better
   host key algorithms and a server to gracefully rotate its keys.

   The client side of this is controlled by a UpdateHostkeys config
   option (default on).

 * ssh(1): Add a ssh_config HostbasedKeyType option to control which
   host public key types are tried during host-based authentication.

 * ssh(1), sshd(8): fix connection-killing host key mismatch errors
   when sshd offers multiple ECDSA keys of different lengths.

 * ssh(1): when host name canonicalisation is enabled, try to
   parse host names as addresses before looking them up for
   canonicalisation. fixes bz#2074 and avoiding needless DNS
   lookups in some cases.

 * ssh-keygen(1), sshd(8): Key Revocation Lists (KRLs) no longer
   require OpenSSH to be compiled with OpenSSL support.

 * ssh(1), ssh-keysign(8): Make ed25519 keys work for host based
   authentication.

 * sshd(8): SSH protocol v.1 workaround for the Meyer, et al,
   Bleichenbacher Side Channel Attack. Fake up a bignum key before
   RSA decryption.

 * sshd(8): Remember which public keys have been used for
   authentication and refuse to accept previously-used keys.
   This allows AuthenticationMethods=publickey,publickey to require
   that users authenticate using two _different_ public keys.

 * sshd(8): add sshd_config HostbasedAcceptedKeyTypes and
   PubkeyAcceptedKeyTypes options to allow sshd to control what
   public key types will be accepted. Currently defaults to all.

 * sshd(8): Don't count partial authentication success as a failure
   against MaxAuthTries.

 * ssh(1): Add RevokedHostKeys option for the client to allow
   text-file or KRL-based revocation of host keys.

 * ssh-keygen(1), sshd(8): Permit KRLs that revoke certificates by
   serial number or key ID without scoping to a particular CA.

 * ssh(1): Add a "Match canonical" criteria that allows ssh_config
   Match blocks to trigger only in the second config pass.

 * ssh(1): Add a -G option to ssh that causes it to parse its
   configuration and dump the result to stdout, similar to "sshd -T".

 * ssh(1): Allow Match criteria to be negated. E.g. "Match !host".

 * The regression test suite has been extended to cover more OpenSSH
   features. The unit tests have been expanded and now cover key
   exchange.

Bugfixes
--------

 * ssh-keyscan(1): ssh-keyscan has been made much more robust again
   servers that hang or violate the SSH protocol.

 * ssh(1), ssh-keygen(1): Fix regression bz#2306: Key path names were
   being lost as comment fields.

 * ssh(1): Allow ssh_config Port options set in the second config
   parse phase to be applied (they were being ignored). bz#2286

 * ssh(1): Tweak config re-parsing with host canonicalisation - make
   the second pass through the config files always run when host name
   canonicalisation is enabled (and not whenever the host name
   changes) bz#2267

 * ssh(1): Fix passing of wildcard forward bind addresses when
   connection multiplexing is in use; bz#2324;

 * ssh-keygen(1): Fix broken private key conversion from non-OpenSSH
   formats; bz#2345.

 * ssh-keygen(1): Fix KRL generation bug when multiple CAs are in
   use.

 * Various fixed to manual pages: bz#2288, bz#2316, bz#2273

Portable OpenSSH
----------------

 * Support --without-openssl at configure time

   Disables and removes dependency on OpenSSL. Many features,
   including SSH protocol 1 are not supported and the set of crypto
   options is greatly restricted. This will only work on system with
   native arc4random or /dev/urandom.

   Considered highly experimental for now.

 * Support --without-ssh1 option at configure time

   Allows disabling support for SSH protocol 1.

   Still experimental - not all regression and unit tests have been
   been adapted for the absence of SSH protocol 1.

 * sshd(8): Fix compilation on systems with IPv6 support in utmpx; bz#2296

 * Allow custom service name for sshd on Cygwin. Permits the use of
   multiple sshd running with different service names.

Reporting Bugs:
===============

- Please read http://www.openssh.com/report.html
  Security bugs should be reported directly to openssh at openssh.com

OpenSSH is brought to you by Markus Friedl, Niels Provos, Theo de Raadt,
Kevin Steves, Damien Miller, Darren Tucker, Jason McIntyre, Tim Rice and
Ben Lindstrom.


From djm at mindrot.org  Fri Feb 20 09:45:59 2015
From: djm at mindrot.org (Damien Miller)
Date: Fri, 20 Feb 2015 09:45:59 +1100 (AEDT)
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
Message-ID: <alpine.BSO.2.11.1502200945050.4850@natsu.mindrot.org>

On Fri, 20 Feb 2015, Damien Miller wrote:

> Hi,
> 
> OpenSSH 6.8 is almost ready for release, so we would appreciate testing
> on as many platforms and systems as possible. This release contains
> some substantial new features and a number of bugfixes.

...

>  * ssh(1), sshd(8): Host key rotation support. Add a protocol
>    extension for a server to inform a client of all its available
>    host keys after authentication has completed. The client may
>    record the keys in known_hosts, allowing it to upgrade to better
>    host key algorithms and a server to gracefully rotate its keys.
> 
>    The client side of this is controlled by a UpdateHostkeys config
>    option (default on).

Actually, the default is off. You can enable it using UpdateHostKeys=yes
or UpdateHostKeys=ask

-d

From Herb.Goldman at ssh.com  Fri Feb 20 12:38:32 2015
From: Herb.Goldman at ssh.com (Herb.Goldman at ssh.com)
Date: Fri, 20 Feb 2015 01:38:32 +0000
Subject: SUCCESS: OpenSSH_6.7p1-snap20150220
Message-ID: <ce5caee5babc4de8921b7ff3ade8797d@SSHEX01.ad.ssh.com>

Compiled OK, and operating nicely on CentOS 6.6, both 32/64 bit.
Really appreciate the UpdateHostkeys feature!
One issue I noticed, the screen output gets garbled if the user has been "asked" to "Accept" the new hostkeys.
Looks like the screen output is missing the CR's, and only LF's get presented.

[root at be2 .ssh]# ssh be1 ls -l
Warning: Permanently added 'be1,fec0::ffff:0:1:c0a8:415' (ECDSA) to the list of known hosts.
total 12
-rw-r--r-- 1 root root 1829 Jan 23 17:43 authorized_keys
-rw-r--r-- 1 root root  575 Jan 21 17:24 sshd.pam
drwxr-xr-x 2 root root 4096 Feb  9 14:17 tmp

[root at be2 .ssh]# ssh -o UpdateHostkeys=yes be1 ls -l
Learned new hostkey: RSA SHA256:Alc84pvwkLVLIyRC7Z5HUpYeySwK+aMykv9cw6LCark
Learned new hostkey: DSA SHA256:4RFtn0pMD4/AiKANWn6K3ODT66Jw8CE4SXOnAbOBXgQ
Learned new hostkey: ED25519 SHA256:OzKAhPkHQDfk7GTvSZRKIHIv+25inWKy2n0PF8HbIhY
Learned new hostkey: RSA SHA256:ZaHa2K0aOv6zzVTNviT08xk/ZY8xeML9uz62OiHAxOM
Learned new hostkey: DSA SHA256:yYtO6dUL0cATSEBAyOyQApxehlhliWY5t5Z0p1CplpY
Learned new hostkey: ECDSA SHA256:70rXiF+VgchFSvKmBQ/sXw+iANmwVTnmzQzlytaBpx4
Learned new hostkey: ED25519 SHA256:n/qAw/sTr+4KnQ1okNg/s3tgV9wRjXULbP/a9Jy++oA
Accept updated hostkeys? (yes/no): yes
total 12
        -rw-r--r-- 1 root root 1829 Jan 23 17:43 authorized_keys
                                                                -rw-r--r-- 1 root root  575 Jan 21 17:24 sshd.pam
  drwxr-xr-x 2 root root 4096 Feb  9 14:17 tmp
                                              [root at be2 .ssh]#




Herb Goldman
Customer Advocate
SSH Communications Security
Takomotie 8, 00380 Helsinki, Finland
+1 302 690-7607 | +358 9 2316-7168 
herb.goldman at ssh.com  | Skype: "sshherb"


From calestyo at scientia.net  Fri Feb 20 12:51:29 2015
From: calestyo at scientia.net (Christoph Anton Mitterer)
Date: Fri, 20 Feb 2015 02:51:29 +0100
Subject: which are the exact effects of MaxSessions
Message-ID: <1424397089.4564.82.camel@scientia.net>

Hey.

I wondered a bit which the exact effects of MaxSessions are.

The documentation says:
        Specifies the maximum number of open sessions permitted per net?
        work connection.  The default is 10.


And it apparently seems that setting e.g. the following in sshd_config:
  MaxSessions 0
     => no logins possible at all

  MaxSessions 1
     => control channel muxing basically forbidden from the server side

  MaxSessions n
     => at most n sessions may use a mux, including the one which
        initiated it
        but further muxes (with again n session) may be created by that
        client


Is it just that? Or are there any other side effects which I can't see?


Thanks,
Chris.

btw: Would be nice if something like the above could be added to the
manpage for clraification :)



-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 5313 bytes
Desc: not available
URL: <http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20150220/9aeb08ce/attachment.bin>

From jjelen at redhat.com  Fri Feb 20 18:09:27 2015
From: jjelen at redhat.com (Jakub Jelen)
Date: Fri, 20 Feb 2015 08:09:27 +0100
Subject: which are the exact effects of MaxSessions
In-Reply-To: <1424397089.4564.82.camel@scientia.net>
References: <1424397089.4564.82.camel@scientia.net>
Message-ID: <54E6DDA7.4010903@redhat.com>

Hello,
According my observation, MaxSessions 1 works for opening only one 
session through multiplexed channel, which degrades multiplexed 
connection back to only one session. MaxSessions 0 doesn't make much sense.

I don't know if you use openssh from some distribution, but in RHEL we 
had recently one bug in audit which looks similar like your issue -- 
with MaxSessions 1 sshd was preventing to log you in.

On 02/20/2015 02:51 AM, Christoph Anton Mitterer wrote:
> Hey.
>
> I wondered a bit which the exact effects of MaxSessions are.
>
> The documentation says:
>          Specifies the maximum number of open sessions permitted per net?
>          work connection.  The default is 10.
>
>
> And it apparently seems that setting e.g. the following in sshd_config:
>    MaxSessions 0
>       => no logins possible at all
>
>    MaxSessions 1
>       => control channel muxing basically forbidden from the server side
>
>    MaxSessions n
>       => at most n sessions may use a mux, including the one which
>          initiated it
>          but further muxes (with again n session) may be created by that
>          client
>
>
> Is it just that? Or are there any other side effects which I can't see?
Yes, it should be like this. Basically it is meant to have max N 
interactive sessions in that connection initiated by mux. If you try to 
connect using "ssh -T", pty is not allocated and this doesn't count as a 
session (not sure if it is bug or feature -- reproducible with vanilla 
sources). Damien?

Greetings,
Jakub
>
>
> Thanks,
> Chris.
>
> btw: Would be nice if something like the above could be added to the
> manpage for clraification :)
>
>
>
>
>
> _______________________________________________
> openssh-unix-dev mailing list
> openssh-unix-dev at mindrot.org
> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev


From ismail at donmez.ws  Fri Feb 20 18:20:45 2015
From: ismail at donmez.ws (=?UTF-8?B?xLBzbWFpbCBEw7ZubWV6?=)
Date: Fri, 20 Feb 2015 09:20:45 +0200
Subject: [PATCH] Unbreak compilation with --without-ssh1
In-Reply-To: <CALDDTe0TFNbefaT05pha-07xZrudsepZh7d6cTEm7J_NS5X0MA@mail.gmail.com>
References: <CAJ1KOAjw-EiQ3N6y9j6xHWjLDJP2ZZuJJ2T0VPLddDp83TVT2Q@mail.gmail.com>
 <CALDDTe0TFNbefaT05pha-07xZrudsepZh7d6cTEm7J_NS5X0MA@mail.gmail.com>
Message-ID: <CAJ1KOAi++kPe-yVBLerV=JxjqCzV9F-_AdsHyj_BRzY-t65t8g@mail.gmail.com>

Oh sorry for that! Hope this works better.

diff --git a/opacket.c b/opacket.c
index 7618eae..17eb889 100644
--- a/opacket.c
+++ b/opacket.c
@@ -75,6 +75,7 @@ ssh_packet_put_raw(struct ssh *ssh, const void *buf,
u_int len)
 }

 #ifdef WITH_OPENSSL
+#ifdef WITH_SSH1
 void
 ssh_packet_put_bignum(struct ssh *ssh, BIGNUM * value)
 {
@@ -83,6 +84,7 @@ ssh_packet_put_bignum(struct ssh *ssh, BIGNUM * value)
        if ((r = sshpkt_put_bignum1(ssh, value)) != 0)
                fatal("%s: %s", __func__, ssh_err(r));
 }
+#endif

 void
 ssh_packet_put_bignum2(struct ssh *ssh, BIGNUM * value)
@@ -147,6 +149,7 @@ ssh_packet_get_int64(struct ssh *ssh)
 }

 #ifdef WITH_OPENSSL
+#ifdef WITH_SSH1
 void
 ssh_packet_get_bignum(struct ssh *ssh, BIGNUM * value)
 {
@@ -155,6 +158,7 @@ ssh_packet_get_bignum(struct ssh *ssh, BIGNUM * value)
        if ((r = sshpkt_get_bignum1(ssh, value)) != 0)
                fatal("%s: %s", __func__, ssh_err(r));
 }
+#endif

 void
 ssh_packet_get_bignum2(struct ssh *ssh, BIGNUM * value)


On Thu, Feb 19, 2015 at 11:05 PM, Darren Tucker <dtucker at zip.com.au> wrote:
> Unfortunately the patch didn't make it (the list server strips out all
> attachments that are not text/plain).  Could you please resend either inline
> or as text/plain?  If not, the other alternative is to attach it to a bug at
> https://bugzilla.mindrot.org.
>
> Thanks.
>
> On Thu, Feb 19, 2015 at 8:24 AM, ?smail D?nmez <ismail at donmez.ws> wrote:
>>
>> Hi,
>>
>> Patch attached for $SUBJECT.
>>
>> ismail
>> _______________________________________________
>> openssh-unix-dev mailing list
>> openssh-unix-dev at mindrot.org
>> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
>
>
>
>
> --
> Darren Tucker (dtucker at zip.com.au)
> GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
>     Good judgement comes with experience. Unfortunately, the experience
> usually comes from bad judgement.

From ismail at donmez.ws  Fri Feb 20 20:25:01 2015
From: ismail at donmez.ws (=?UTF-8?B?xLBzbWFpbCBEw7ZubWV6?=)
Date: Fri, 20 Feb 2015 11:25:01 +0200
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
Message-ID: <CAJ1KOAhZWSThd7pEg5eKzZj9ZNoz_f772DUPDuVM+tt0YXWvHA@mail.gmail.com>

Hi,

On Fri, Feb 20, 2015 at 12:21 AM, Damien Miller <djm at mindrot.org> wrote:
> Hi,
>
> OpenSSH 6.8 is almost ready for release, so we would appreciate testing
> on as many platforms and systems as possible. This release contains
> some substantial new features and a number of bugfixes.

All tests pass on my Linux box. But
https://bugzilla.mindrot.org/show_bug.cgi?id=2342 is a notable
regression.

Regards,
ismail

From roshanr.nair at gmail.com  Fri Feb 20 23:16:42 2015
From: roshanr.nair at gmail.com (Roshan Nair)
Date: Fri, 20 Feb 2015 17:46:42 +0530
Subject: SCP fails with read failure on openssh6.5.
Message-ID: <CAC5w=j-SKN=8g4RxhzsM773tKOyhcv-5tyXqehBgFenyKAN1mA@mail.gmail.com>

Hi,

Wanted to know if there is a work around or a fix available for the scp
failure issue we are seeing in atomicio6 func ? SCP code transfer starts
but in between gets stuck with read failure.

The linux version we have on our system is Linux (none) 2.6.34.6  and open
ssh version is OpenSSH_6.5p1, OpenSSL 1.0.1j.
Since its not possible for us to move to the latest linux kernel I am
trying to find a way for a fix.

The code flow is as below :



main() -> ..->sink()->atomicio6()->read()


In func atomicio6() returns response -1 with error number EAGAIN during the
course of the transfer.

Error number EAGAIN leads to a poll() being called which I believe never
returns and hence the scp transfer hangs.

I have tried enabling the macro BROKEN_READ_COMPARISION but no help.

I tried a solution mentioned in the thread below but that too didnt quiet
help.

https://lists.mindrot.org/pipermail/openssh-unix-dev/2014-January/032080.html

Anything else I can try to fix this or any workaround anyone can suggest ?

-- 
---------------------------------------------------------------------------------
Roshan Nair

--whatever you end up doing ... love it!
---------------------------------------------------------------------------------

From roshanr.nair at gmail.com  Fri Feb 20 23:16:42 2015
From: roshanr.nair at gmail.com (Roshan Nair)
Date: Fri, 20 Feb 2015 17:46:42 +0530
Subject: SCP fails with read failure on openssh6.5.
Message-ID: <CAC5w=j-SKN=8g4RxhzsM773tKOyhcv-5tyXqehBgFenyKAN1mA@mail.gmail.com>

Hi,

Wanted to know if there is a work around or a fix available for the scp
failure issue we are seeing in atomicio6 func ? SCP code transfer starts
but in between gets stuck with read failure.

The linux version we have on our system is Linux (none) 2.6.34.6  and open
ssh version is OpenSSH_6.5p1, OpenSSL 1.0.1j.
Since its not possible for us to move to the latest linux kernel I am
trying to find a way for a fix.

The code flow is as below :



main() -> ..->sink()->atomicio6()->read()


In func atomicio6() returns response -1 with error number EAGAIN during the
course of the transfer.

Error number EAGAIN leads to a poll() being called which I believe never
returns and hence the scp transfer hangs.

I have tried enabling the macro BROKEN_READ_COMPARISION but no help.

I tried a solution mentioned in the thread below but that too didnt quiet
help.

https://lists.mindrot.org/pipermail/openssh-unix-dev/2014-January/032080.html

Anything else I can try to fix this or any workaround anyone can suggest ?

-- 
---------------------------------------------------------------------------------
Roshan Nair

--whatever you end up doing ... love it!
---------------------------------------------------------------------------------

From nkadel at gmail.com  Sat Feb 21 02:11:36 2015
From: nkadel at gmail.com (Nico Kadel-Garcia)
Date: Fri, 20 Feb 2015 10:11:36 -0500
Subject: ssh_config "database"/"sort"able format?
In-Reply-To: <CAH_OBifsG8E16E0EYOF0ZLbADa+MPBxnaTfqheXP8B5QY5tgWw@mail.gmail.com>
References: <CADtGFvneKuBc=8J+-LPqadd=qtzarNvDnTFTbMwJnRSFQg=aBA@mail.gmail.com>
 <CAH_OBifsG8E16E0EYOF0ZLbADa+MPBxnaTfqheXP8B5QY5tgWw@mail.gmail.com>
Message-ID: <EE8E70E0-4D7A-46F9-8FFC-DB727E0DF8CA@gmail.com>

This approach works well, and can scale. A critical part is to sanity check the result for compatibility.

Nico Kadel-Garcia
Email: nkadel at gmail.com
Sent from iPhone

> On Feb 18, 2015, at 17:11, shawn wilson <ag4ve.us at gmail.com> wrote:
> 
>> On Feb 18, 2015 2:53 PM, "Hendrik Visage" <hvjunk at gmail.com> wrote:
> 
>> 
>> Questions:
>> - Is there anybody that see a value in a format/parser/matcher for
>> ssh_config files to be able to merge/"diff"/sort these files?
> 
> I've started on a perl module to go through an ssh config and compile what
> ssh should do for a given host (mainly to only ssh-add a key when a host is
> configured to use it). I would prefer an abstract config backend though.
> 
>> - Any other ideas/solutions I could consider to manage these ssh_config
> files?
> 
> You can make a compile script that takes ordered parts of a config and
> builds an ssh_config and then you're only checking in and/or comparing
> project specific bits.
> _______________________________________________
> openssh-unix-dev mailing list
> openssh-unix-dev at mindrot.org
> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev

From nkadel at gmail.com  Sat Feb 21 02:09:00 2015
From: nkadel at gmail.com (Nico Kadel-Garcia)
Date: Fri, 20 Feb 2015 10:09:00 -0500
Subject: SCP fails with read failure on openssh6.5.
In-Reply-To: <CAC5w=j-SKN=8g4RxhzsM773tKOyhcv-5tyXqehBgFenyKAN1mA@mail.gmail.com>
References: <CAC5w=j-SKN=8g4RxhzsM773tKOyhcv-5tyXqehBgFenyKAN1mA@mail.gmail.com>
Message-ID: <83529F30-1468-4100-A35E-1E86BE601FD0@gmail.com>

Use rsync instead of scp?

Nico Kadel-Garcia
Email: nkadel at gmail.com
Sent from iPhone

> On Feb 20, 2015, at 7:16, Roshan Nair <roshanr.nair at gmail.com> wrote:
> 
> Hi,
> 
> Wanted to know if there is a work around or a fix available for the scp
> failure issue we are seeing in atomicio6 func ? SCP code transfer starts
> but in between gets stuck with read failure.
> 
> The linux version we have on our system is Linux (none) 2.6.34.6  and open
> ssh version is OpenSSH_6.5p1, OpenSSL 1.0.1j.
> Since its not possible for us to move to the latest linux kernel I am
> trying to find a way for a fix.
> 
> The code flow is as below :
> 
> 
> 
> main() -> ..->sink()->atomicio6()->read()
> 
> 
> In func atomicio6() returns response -1 with error number EAGAIN during the
> course of the transfer.
> 
> Error number EAGAIN leads to a poll() being called which I believe never
> returns and hence the scp transfer hangs.
> 
> I have tried enabling the macro BROKEN_READ_COMPARISION but no help.
> 
> I tried a solution mentioned in the thread below but that too didnt quiet
> help.
> 
> https://lists.mindrot.org/pipermail/openssh-unix-dev/2014-January/032080.html
> 
> Anything else I can try to fix this or any workaround anyone can suggest ?
> 
> -- 
> ---------------------------------------------------------------------------------
> Roshan Nair
> 
> --whatever you end up doing ... love it!
> ---------------------------------------------------------------------------------
> _______________________________________________
> openssh-unix-dev mailing list
> openssh-unix-dev at mindrot.org
> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev

From djm at mindrot.org  Sat Feb 21 08:57:43 2015
From: djm at mindrot.org (Damien Miller)
Date: Sat, 21 Feb 2015 08:57:43 +1100 (AEDT)
Subject: SUCCESS: OpenSSH_6.7p1-snap20150220
In-Reply-To: <ce5caee5babc4de8921b7ff3ade8797d@SSHEX01.ad.ssh.com>
References: <ce5caee5babc4de8921b7ff3ade8797d@SSHEX01.ad.ssh.com>
Message-ID: <alpine.BSO.2.11.1502210856080.6107@natsu.mindrot.org>

On Fri, 20 Feb 2015, Herb.Goldman at ssh.com wrote:

> Compiled OK, and operating nicely on CentOS 6.6, both 32/64 bit.
> Really appreciate the UpdateHostkeys feature!
> One issue I noticed, the screen output gets garbled if the user has been "asked" to "Accept" the new hostkeys.
> Looks like the screen output is missing the CR's, and only LF's get presented.
> 
> [root at be2 .ssh]# ssh be1 ls -l
> Warning: Permanently added 'be1,fec0::ffff:0:1:c0a8:415' (ECDSA) to the list of known hosts.
> total 12
> -rw-r--r-- 1 root root 1829 Jan 23 17:43 authorized_keys
> -rw-r--r-- 1 root root  575 Jan 21 17:24 sshd.pam
> drwxr-xr-x 2 root root 4096 Feb  9 14:17 tmp
> 
> [root at be2 .ssh]# ssh -o UpdateHostkeys=yes be1 ls -l
> Learned new hostkey: RSA SHA256:Alc84pvwkLVLIyRC7Z5HUpYeySwK+aMykv9cw6LCark
> Learned new hostkey: DSA SHA256:4RFtn0pMD4/AiKANWn6K3ODT66Jw8CE4SXOnAbOBXgQ
> Learned new hostkey: ED25519 SHA256:OzKAhPkHQDfk7GTvSZRKIHIv+25inWKy2n0PF8HbIhY
> Learned new hostkey: RSA SHA256:ZaHa2K0aOv6zzVTNviT08xk/ZY8xeML9uz62OiHAxOM
> Learned new hostkey: DSA SHA256:yYtO6dUL0cATSEBAyOyQApxehlhliWY5t5Z0p1CplpY
> Learned new hostkey: ECDSA SHA256:70rXiF+VgchFSvKmBQ/sXw+iANmwVTnmzQzlytaBpx4
> Learned new hostkey: ED25519 SHA256:n/qAw/sTr+4KnQ1okNg/s3tgV9wRjXULbP/a9Jy++oA
> Accept updated hostkeys? (yes/no): yes

That's strange - your commandline doesn't indicate you are using 'ask'.

Are you using ControlPersist? I'm just fixing a bug between ControlPersist
and UpdateHostkeys=ask

-d

From djm at mindrot.org  Sat Feb 21 09:01:52 2015
From: djm at mindrot.org (Damien Miller)
Date: Sat, 21 Feb 2015 09:01:52 +1100 (AEDT)
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <CAJ1KOAhZWSThd7pEg5eKzZj9ZNoz_f772DUPDuVM+tt0YXWvHA@mail.gmail.com>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <CAJ1KOAhZWSThd7pEg5eKzZj9ZNoz_f772DUPDuVM+tt0YXWvHA@mail.gmail.com>
Message-ID: <alpine.BSO.2.11.1502210901100.6107@natsu.mindrot.org>

On Fri, 20 Feb 2015, ?smail D?nmez wrote:

> Hi,
> 
> On Fri, Feb 20, 2015 at 12:21 AM, Damien Miller <djm at mindrot.org> wrote:
> > Hi,
> >
> > OpenSSH 6.8 is almost ready for release, so we would appreciate testing
> > on as many platforms and systems as possible. This release contains
> > some substantial new features and a number of bugfixes.
> 
> All tests pass on my Linux box. But
> https://bugzilla.mindrot.org/show_bug.cgi?id=2342 is a notable
> regression.

hm, I can't replicate this problem:

[djm at fuyu openssh]$ mkdir x
[djm at fuyu openssh]$ cd x
[djm at fuyu x]$ ../ssh-keygen -t ed25519 -f key -N '' -q
[djm at fuyu x]$ ../ssh-keygen -lf ^C
[djm at fuyu x]$ rm key ; mv key.pub key
[djm at fuyu x]$ ../ssh-keygen -lf key
256 SHA256:0UH+G0Bw+ZP3rqTwxsio5CUTrKkS/kcJ26RwV3Twbyw djm at fuyu (ED25519)

-d

From calestyo at scientia.net  Sat Feb 21 10:42:50 2015
From: calestyo at scientia.net (Christoph Anton Mitterer)
Date: Sat, 21 Feb 2015 00:42:50 +0100
Subject: which are the exact effects of MaxSessions
In-Reply-To: <54E6DDA7.4010903@redhat.com>
References: <1424397089.4564.82.camel@scientia.net>
 <54E6DDA7.4010903@redhat.com>
Message-ID: <1424475770.4823.64.camel@scientia.net>

On Fri, 2015-02-20 at 08:09 +0100, Jakub Jelen wrote: 
> According my observation, MaxSessions 1 works for opening only one 
> session through multiplexed channel, which degrades multiplexed 
> connection back to only one session.
Well one get's still a mux process and also the messages (when debugging
is on) on the "master sesssion" that others try to re-use it... but then
they're blocked.

> I don't know if you use openssh from some distribution
Debian.

> , but in RHEL we 
> had recently one bug in audit which looks similar like your issue -- 
> with MaxSessions 1 sshd was preventing to log you in.
Well I don't really think I have any issues... I just wondered whether
there are any other side-effects than having influence on the channel
muxing ... perhaps something like "only accept 1 session from the same
IP, even when not muxing".

What is the issue you guys found?


Cheers,
Chris.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 5313 bytes
Desc: not available
URL: <http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20150221/e64c9ee3/attachment.bin>

From igor at mir2.org  Sat Feb 21 10:55:28 2015
From: igor at mir2.org (Igor Bukanov)
Date: Sat, 21 Feb 2015 00:55:28 +0100
Subject: curve25519-sha256 key exchange at lest 50% times slower than DHE
Message-ID: <CADd11yV4GJqQzVSzw6mBLj1=PLoRhUhSWGHnVEMUN5Q=r-DQzw@mail.gmail.com>

Hello,

I tried to optimize ssh server and client config to minimize the ssh
connection time while keeping things resonably secure. I observed that
timing of `ssh vm true`  when running against a VM on my laptop was at
least 50% times slower when using curve25519-sha256 compared with
diffie-hellman-group-exchange-sha256. With openssh 6.6p1 on both a
client and server the best timing when running

ssh -o Ciphers=aes128-gcm at openssh.com -o
KexAlgorithms=diffie-hellman-group-exchange-sha256 vm-name true

was 95ms while the best result for

ssh -o Ciphers=aes128-gcm at openssh.com -o
KexAlgorithms=curve25519-sha256 at libssh.org vm-name true

was 140ms with much greater deviation among results so on average it
run 2 times slower.

Is it just an artifact of less optimized implementation or is this
inherited in 25519 design?

Also, could rather significant variation in results be used to learn
how busy the box is or this is normal as key exchange timing is
variable by design?

From calestyo at scientia.net  Sat Feb 21 13:09:14 2015
From: calestyo at scientia.net (calestyo at scientia.net)
Date: Sat, 21 Feb 2015 03:09:14 +0100
Subject: [PATCH] document evaluation of {Allow|Deny}{Users|Groups}
Message-ID: <1424484554-31968-1-git-send-email-calestyo@scientia.net>

From: Christoph Anton Mitterer <mail at christoph.anton.mitterer.name>

? Document what the evaluation order of AllowUsers, DenyUsers, AllowGroups and
  DenyGroups actually means.
  Fixes bug #2292.

Signed-off-by: Christoph Anton Mitterer <mail at christoph.anton.mitterer.name>
---
 sshd_config.5 | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/sshd_config.5 b/sshd_config.5
index fd44abe..a10b113 100644
--- a/sshd_config.5
+++ b/sshd_config.5
@@ -116,6 +116,8 @@ The allow/deny directives are processed in the following order:
 .Cm DenyGroups ,
 and finally
 .Cm AllowGroups .
+The first one that matches determines whether the login is allowed or
+denied, with the later processed directives being ignored.
 .Pp
 See PATTERNS in
 .Xr ssh_config 5
@@ -176,6 +178,8 @@ The allow/deny directives are processed in the following order:
 .Cm DenyGroups ,
 and finally
 .Cm AllowGroups .
+The first one that matches determines whether the login is allowed or
+denied, with the later processed directives being ignored.
 .Pp
 See PATTERNS in
 .Xr ssh_config 5
@@ -460,6 +464,8 @@ The allow/deny directives are processed in the following order:
 .Cm DenyGroups ,
 and finally
 .Cm AllowGroups .
+The first one that matches determines whether the login is allowed or
+denied, with the later processed directives being ignored.
 .Pp
 See PATTERNS in
 .Xr ssh_config 5
@@ -479,6 +485,8 @@ The allow/deny directives are processed in the following order:
 .Cm DenyGroups ,
 and finally
 .Cm AllowGroups .
+The first one that matches determines whether the login is allowed or
+denied, with the later processed directives being ignored.
 .Pp
 See PATTERNS in
 .Xr ssh_config 5
-- 
2.1.4


From calestyo at scientia.net  Sat Feb 21 13:53:04 2015
From: calestyo at scientia.net (calestyo at scientia.net)
Date: Sat, 21 Feb 2015 03:53:04 +0100
Subject: [PATCH] mention ClientAlive as alternative at TCPKeepAlive
Message-ID: <1424487184-2068-1-git-send-email-calestyo@scientia.net>

From: Christoph Anton Mitterer <mail at christoph.anton.mitterer.name>

? Mention the ClientAliveInterval and ClientAliveCountMax at the description of
  the TCPKeepAlive directive in sshd_config(5) as an alternative to reach
  similar effects.

Signed-off-by: Christoph Anton Mitterer <mail at christoph.anton.mitterer.name>
---
 sshd_config.5 | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/sshd_config.5 b/sshd_config.5
index fd44abe..d13dd96 100644
--- a/sshd_config.5
+++ b/sshd_config.5
@@ -1271,6 +1271,12 @@ sessions may hang indefinitely on the server, leaving
 .Dq ghost
 users and consuming server resources.
 .Pp
+Alternatively (or additionally) client alive messages can be used by
+setting
+.Cm ClientAliveInterval
+and
+.Cm ClientAliveCountMax .
+.Pp
 The default is
 .Dq yes
 (to send TCP keepalive messages), and the server will notice
-- 
2.1.4


From calestyo at scientia.net  Sat Feb 21 13:54:18 2015
From: calestyo at scientia.net (calestyo at scientia.net)
Date: Sat, 21 Feb 2015 03:54:18 +0100
Subject: [PATCH] improve documentation of ForwardX11 options
Message-ID: <1424487258-2200-1-git-send-email-calestyo@scientia.net>

From: Christoph Anton Mitterer <mail at christoph.anton.mitterer.name>

? Improve the documentation of the X11 forwarding options in ssh_config(5):
   ? Document that another timeout than 20m will be used if the
     ForwardX11Timeout directive has been set.
   ? Minor spelling mistakes and improvements.

Signed-off-by: Christoph Anton Mitterer <mail at christoph.anton.mitterer.name>
---
 ssh_config.5 | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/ssh_config.5 b/ssh_config.5
index b702e32..11c1fd5 100644
--- a/ssh_config.5
+++ b/ssh_config.5
@@ -673,14 +673,14 @@ if the
 .Cm ForwardX11Trusted
 option is also enabled.
 .It Cm ForwardX11Timeout
-Specify a timeout for untrusted X11 forwarding
+Specifies a timeout for untrusted X11 forwarding
 using the format described in the
 TIME FORMATS section of
 .Xr sshd_config 5 .
 X11 connections received by
 .Xr ssh 1
 after this time will be refused.
-The default is to disable untrusted X11 forwarding after twenty minutes has
+The default is to disable untrusted X11 forwarding after twenty minutes have
 elapsed.
 .It Cm ForwardX11Trusted
 If this option is set to
@@ -694,8 +694,10 @@ from stealing or tampering with data belonging to trusted X11
 clients.
 Furthermore, the
 .Xr xauth 1
-token used for the session will be set to expire after 20 minutes.
-Remote clients will be refused access after this time.
+token used for the session will be set to expire after
+20 minutes (unless something else has been set via
+.Cm ForwardX11Timeout )
+and remote clients will be refused access after this time.
 .Pp
 The default is
 .Dq no .
-- 
2.1.4


From calestyo at scientia.net  Sat Feb 21 13:51:02 2015
From: calestyo at scientia.net (calestyo at scientia.net)
Date: Sat, 21 Feb 2015 03:51:02 +0100
Subject: [PATCH] clarify how IgnoreUserKnownHosts works
Message-ID: <1424487062-1822-1-git-send-email-calestyo@scientia.net>

From: Christoph Anton Mitterer <mail at christoph.anton.mitterer.name>

Based on the previous documentation of the IgnoreUserKnownHosts directive, the
average user could easily think that the default value ?no? is the more secure
choice (in the sense of ?do not even check in ~/.ssh/known_hosts?).

? Clarify in sshd_config(5), that a value of ?yes? in the IgnoreUserKnownHosts
  directive, makes sshd(8) only trust the global known hosts list (/etc/ssh/
  ssh_known_hosts).

Signed-off-by: Christoph Anton Mitterer <mail at christoph.anton.mitterer.name>
---
 sshd_config.5 | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sshd_config.5 b/sshd_config.5
index 43cc826..4ed3afc 100644
--- a/sshd_config.5
+++ b/sshd_config.5
@@ -627,7 +627,9 @@ should ignore the user's
 during
 .Cm RhostsRSAAuthentication
 or
-.Cm HostbasedAuthentication .
+.Cm HostbasedAuthentication
+and instead only trust the systemwide
+.Pa /etc/ssh/ssh_known_hosts .
 The default is
 .Dq no .
 .It Cm IPQoS
-- 
2.1.4


From calestyo at scientia.net  Sat Feb 21 14:03:21 2015
From: calestyo at scientia.net (calestyo at scientia.net)
Date: Sat, 21 Feb 2015 04:03:21 +0100
Subject: [PATCH] clarify doc of NoHostAuthenticationForLocalhost
Message-ID: <1424487801-13254-1-git-send-email-calestyo@scientia.net>

From: Christoph Anton Mitterer <mail at christoph.anton.mitterer.name>

Clarify the documentation of the NoHostAuthenticationForLocalhost directive in
ssh_config(5):

? Document, that it works on any hostname that resolves to the loopback device.
? Demote the ?use case? to being just one example of how it can be used.

Fixes bug #2293.

Signed-off-by: Christoph Anton Mitterer <mail at christoph.anton.mitterer.name>
---
 ssh_config.5 | 22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/ssh_config.5 b/ssh_config.5
index b702e32..f79a17d 100644
--- a/ssh_config.5
+++ b/ssh_config.5
@@ -1041,15 +1041,19 @@ hmac-md5,hmac-sha1,hmac-ripemd160,
 hmac-sha1-96,hmac-md5-96
 .Ed
 .It Cm NoHostAuthenticationForLocalhost
-This option can be used if the home directory is shared across machines.
-In this case localhost will refer to a different machine on each of
-the machines and the user will get many warnings about changed host keys.
-However, this option disables host authentication for localhost.
-The argument to this keyword must be
-.Dq yes
-or
-.Dq no .
-The default is to check the host key for localhost.
+If set to
+.Dq yes ,
+then no host authentication will be performed for any target
+.Ar hostname
+(for example localhost or ip6-localhost) that resolves to a
+loopback network interface (that is addresses 127.0.0.0/8 for IPv4
+respectively ::1/128 for IPv6). The default of
+.Dq no
+is to always check the host key of all SSH servers.
+.Pp
+This option can for example be used when the home directory is shared across
+machines. In this case the name localhost will refer to a different machine
+on each of the machines and the user will get many warnings about changed host keys.
 .It Cm NumberOfPasswordPrompts
 Specifies the number of password prompts before giving up.
 The argument to this keyword must be an integer.
-- 
2.1.4


From calestyo at scientia.net  Sat Feb 21 14:15:58 2015
From: calestyo at scientia.net (calestyo at scientia.net)
Date: Sat, 21 Feb 2015 04:15:58 +0100
Subject: [PATCH] remove unused symbols
Message-ID: <1424488558-14425-1-git-send-email-calestyo@scientia.net>

From: Christoph Anton Mitterer <mail at christoph.anton.mitterer.name>

? Removed the no longer used symbol ?sKerberosTgtPassing?.

Signed-off-by: Christoph Anton Mitterer <mail at christoph.anton.mitterer.name>
---
 servconf.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/servconf.c b/servconf.c
index 3185462..b59b657 100644
--- a/servconf.c
+++ b/servconf.c
@@ -376,8 +376,7 @@ typedef enum {
 	sKeyRegenerationTime, sPermitRootLogin, sLogFacility, sLogLevel,
 	sRhostsRSAAuthentication, sRSAAuthentication,
 	sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup,
-	sKerberosGetAFSToken,
-	sKerberosTgtPassing, sChallengeResponseAuthentication,
+	sKerberosGetAFSToken, sChallengeResponseAuthentication,
 	sPasswordAuthentication, sKbdInteractiveAuthentication,
 	sListenAddress, sAddressFamily,
 	sPrintMotd, sPrintLastLog, sIgnoreRhosts,
-- 
2.1.4


From calestyo at scientia.net  Sat Feb 21 14:29:33 2015
From: calestyo at scientia.net (calestyo at scientia.net)
Date: Sat, 21 Feb 2015 04:29:33 +0100
Subject: [PATCH] improve documentation of control channel options
Message-ID: <1424489373-15893-1-git-send-email-calestyo@scientia.net>

From: Christoph Anton Mitterer <mail at christoph.anton.mitterer.name>

? Improve the documentation of the control channel options in ssh_config(5):
  ? Clarify what happens at ControlMaster=ask, when the connection trial of
    another ssh(1) is rejected.
  ? Document that a non-backgrounded master control channel process will remain
    open until the last connection has been closed, even after its session has
    ended. And also that in the meantime new clients can start using the master
    control channel.
  ? Document the default values of the ControlPath and ControlPersist
    directives.
  ? Minor spelling mistakes and improvements.

Signed-off-by: Christoph Anton Mitterer <mail at christoph.anton.mitterer.name>
---
 ssh_config.5 | 49 +++++++++++++++++++++++++++++++++----------------
 1 file changed, 33 insertions(+), 16 deletions(-)

diff --git a/ssh_config.5 b/ssh_config.5
index b702e32..30a4a47 100644
--- a/ssh_config.5
+++ b/ssh_config.5
@@ -487,10 +487,10 @@ to listen for control connections, but require confirmation using the
 program before they are accepted (see
 .Xr ssh-add 1
 for details).
-If the
-.Cm ControlPath
-cannot be opened,
-ssh will continue without connecting to a master instance.
+If another 
+.Xr ssh 1
+is rejected to use the master instance, it will continue normally without
+using it.
 .Pp
 X11 and
 .Xr ssh-agent 1
@@ -508,25 +508,32 @@ and
 The latter requires confirmation like the
 .Dq ask
 option.
+.Pp
+Unless
+.Cm ControlPersist
+is set to have the master connection backrounded, it will remain open (and thus
+the master
+.Xr ssh 1
+process will not terminate even after its session has ended) until all other
+instances using it have been closed.
 .It Cm ControlPath
-Specify the path to the control socket used for connection sharing as described
+Specifies the path to the control socket used for connection sharing as described
 in the
 .Cm ControlMaster
 section above or the string
 .Dq none
-to disable connection sharing.
+(the default) to disable connection sharing.
 In the path,
 .Ql %L
 will be substituted by the first component of the local host name,
 .Ql %l
-will be substituted by the local host name (including any domain name),
+by the local host name (including any domain name),
 .Ql %h
-will be substituted by the target host name,
+by the target host name,
 .Ql %n
-will be substituted by the original target host name
-specified on the command line,
+by the original target host name specified on the command line,
 .Ql %p
-the destination port,
+by the destination port,
 .Ql %r
 by the remote login username,
 .Ql %u
@@ -536,19 +543,28 @@ by the username of the user running
 by a hash of the concatenation: %l%h%p%r.
 It is recommended that any
 .Cm ControlPath
-used for opportunistic connection sharing include
+used for opportunistic connection sharing includes
 at least %h, %p, and %r (or alternatively %C).
 This ensures that shared connections are uniquely identified.
 .It Cm ControlPersist
 When used in conjunction with
 .Cm ControlMaster ,
-specifies that the master connection should remain open
+specifies whether and how the master connection should remain open
 in the background (waiting for future client connections)
 after the initial client connection has been closed.
+.Pp
 If set to
-.Dq no ,
-then the master connection will not be placed into the background,
-and will close as soon as the initial client connection is closed.
+.Dq no 
+(the default), then the master connection will not be placed into the
+background and will close as soon as it is no longer used by any client
+connection (both, the initial or later ones). Thus the master
+.Xr ssh 1
+process will not terminate (even after its session has ended) until all other
+instances using it have been closed. Even after the master
+.Xr ssh 1
+process? session has ended, new clients can still connect to the master
+connection as long as it is open.
+.Pp
 If set to
 .Dq yes ,
 then the master connection will remain in the background indefinitely
@@ -556,6 +572,7 @@ then the master connection will remain in the background indefinitely
 .Xr ssh 1
 .Dq Fl O No exit
 option).
+.Pp
 If set to a time in seconds, or a time in any of the formats documented in
 .Xr sshd_config 5 ,
 then the backgrounded master connection will automatically terminate
-- 
2.1.4


From calestyo at scientia.net  Sat Feb 21 14:52:20 2015
From: calestyo at scientia.net (calestyo at scientia.net)
Date: Sat, 21 Feb 2015 04:52:20 +0100
Subject: [PATCH 2/2] mention the other argument of ssh -Q
In-Reply-To: <1424490740-19020-1-git-send-email-calestyo@scientia.net>
References: <1424490740-19020-1-git-send-email-calestyo@scientia.net>
Message-ID: <1424490740-19020-2-git-send-email-calestyo@scientia.net>

From: Christoph Anton Mitterer <mail at christoph.anton.mitterer.name>

---
 sshd_config.5 | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/sshd_config.5 b/sshd_config.5
index 8033c01..dd8f46f 100644
--- a/sshd_config.5
+++ b/sshd_config.5
@@ -430,8 +430,10 @@ The list of available ciphers may also be obtained using the
 .Fl Q
 option of
 .Xr ssh 1
-with an argument of
-.Dq cipher .
+with an argument of either
+.Dq cipher
+or
+.Dq cipher-auth .
 .It Cm ClientAliveCountMax
 Sets the number of client alive messages (see below) which may be
 sent without
-- 
2.1.4


From calestyo at scientia.net  Sat Feb 21 14:52:19 2015
From: calestyo at scientia.net (calestyo at scientia.net)
Date: Sat, 21 Feb 2015 04:52:19 +0100
Subject: [PATCH 1/2] add missing algorithms to manpages
Message-ID: <1424490740-19020-1-git-send-email-calestyo@scientia.net>

From: Christoph Anton Mitterer <mail at christoph.anton.mitterer.name>

? Add ?rijndael-cbc at lysator.liu.se? to list of algorithms in the description of
  the Cipher directive within sshd_config(5).
  Partially fixes bug #2290.
? Add ?hmac-ripemd160 at openssh.com? to list of algorithms in the description of
  the MACs directive within sshd_config(5).
  Partially fixes bug #2290.

Signed-off-by: Christoph Anton Mitterer <mail at christoph.anton.mitterer.name>
---
 sshd_config.5 | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/sshd_config.5 b/sshd_config.5
index 5cf72f1..8033c01 100644
--- a/sshd_config.5
+++ b/sshd_config.5
@@ -415,6 +415,8 @@ blowfish-cbc
 cast128-cbc
 .It
 chacha20-poly1305 at openssh.com
+.It
+rijndael-cbc at lysator.liu.se
 .El
 .Pp
 The default is:
@@ -877,6 +879,8 @@ hmac-sha2-256
 .It
 hmac-sha2-512
 .It
+hmac-ripemd160 at openssh.com
+.It
 umac-64 at openssh.com
 .It
 umac-128 at openssh.com
-- 
2.1.4


From vinschen at redhat.com  Sat Feb 21 23:09:55 2015
From: vinschen at redhat.com (Corinna Vinschen)
Date: Sat, 21 Feb 2015 13:09:55 +0100
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
Message-ID: <20150221120955.GA24328@calimero.vinschen.de>

Hi Damien,

On Feb 20 09:21, Damien Miller wrote:
> Hi,
> 
> OpenSSH 6.8 is almost ready for release, so we would appreciate testing
> on as many platforms and systems as possible. This release contains
> some substantial new features and a number of bugfixes.
> 
> Snapshot releases for portable OpenSSH are available from
> http://www.mindrot.org/openssh_snap/
> 
> The OpenBSD version is available in CVS HEAD:
> http://www.openbsd.org/anoncvs.html
> 
> Portable OpenSSH is also available via anonymous CVS using the
> instructions at http://www.openssh.com/portable.html#cvs or
> via Git at https://anongit.mindrot.org/openssh.git/
> 
> Running the regression tests supplied with Portable OpenSSH does not
> require installation and is a simply:
> 
> $ ./configure && make tests

Building on 64 bit Cygwin works out of the box.  However, I have trouble
with the testsuite.  As usual, I'm building outside the source tree:

- Building the testsuite fails:

  Assembler messages:
  Fatal error: can't create regress/unittests/bitmap/tests.o: No such file or directory
  Makefile:152: recipe for target 'regress/unittests/bitmap/tests.o' failed

  The testsuite apparently misses creating the regress/unittests/bitmap
  subdir prior to running the test.  Same for the "hostkeys" and "kex"
  subdirs.  If I create these dirs by hand, the build succeeds.  Some
  mkdir -p calls for these three dirs would probably help.


- The failing last loop in the "forwarding" script as reported back
  during 6.7 testing is still failing for me more often than not.  It's
  always the same reason, the script tries to use in-use port numbers.
  Reducing the forwarding script to only this last test loop succeeds
  every time, but is quite a hack for testing.


- Last but not least, all tests in hostkey-agent.sh fail and I don't
  understand what's the problem here.  I attached the log files for this
  problem to this mail.  Maybe you see what's going wrong?


Thanks,
Corinna

-- 
Corinna Vinschen
Cygwin Maintainer
Red Hat
-------------- next part --------------
A non-text attachment was scrubbed...
Name: hostkey-agent-logs.tgz
Type: application/gzip
Size: 5476 bytes
Desc: not available
URL: <http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20150221/fc657bfa/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 819 bytes
Desc: not available
URL: <http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20150221/fc657bfa/attachment-0001.bin>

From htodd at twofifty.com  Sun Feb 22 04:26:23 2015
From: htodd at twofifty.com (Hisashi T Fujinaka)
Date: Sat, 21 Feb 2015 09:26:23 -0800 (PST)
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
Message-ID: <alpine.NEB.2.11.1502210924420.850@chris.i8u.org>

On Fri, 20 Feb 2015, Damien Miller wrote:

> OpenSSH 6.8 is almost ready for release, so we would appreciate testing
> on as many platforms and systems as possible. This release contains
> some substantial new features and a number of bugfixes.
>
> $ ./configure && make tests

NetBSD-current on amd64, NetBSD-7 on amd64 and i386 seem to work fine.

MacOS X Yosemite required "--without-openssl-header-check".

-- 
Hisashi T Fujinaka - htodd at twofifty.com
BSEE + BSChem + BAEnglish + MSCS + $2.50 = coffee

From openssh at roumenpetrov.info  Sun Feb 22 05:44:57 2015
From: openssh at roumenpetrov.info (Roumen Petrov)
Date: Sat, 21 Feb 2015 20:44:57 +0200
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <20150221120955.GA24328@calimero.vinschen.de>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <20150221120955.GA24328@calimero.vinschen.de>
Message-ID: <54E8D229.6030709@roumenpetrov.info>

Corinna Vinschen wrote:
> [SNIP]
> - Last but not least, all tests in hostkey-agent.sh fail and I don't
>    understand what's the problem here.  I attached the log files for this
>    problem to this mail.  Maybe you see what's going wrong?

Test cannot load host keys .... please see attached file

Roumen

-- 
Get SSH with X.509 certificate support
http://roumenpetrov.info/openssh/

-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0004-test-regress-hostkey-agent.sh-outside-source-tree.patch
Type: text/x-diff
Size: 923 bytes
Desc: not available
URL: <http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20150221/14d4aebc/attachment.bin>

From tot-to at tot-to.com  Sun Feb 22 07:39:35 2015
From: tot-to at tot-to.com (tot-to)
Date: Sat, 21 Feb 2015 21:39:35 +0100
Subject: "PermitRootLogin no" should not proceed with root login
Message-ID: <20150221213935.4e0696f1@localhost>

Steps to reproduce:
1) PermitRootLogin no in sshd_config
2) login with "root" user from other host

Present behaviour:
1) it asks for password 3 times and only then close the connection.
2) cpu consumption during bruteforce "attacks".

Expected behaviour:
Immediate disconnect/login fail

Workaround is to change ssh port, or ban IP after some login fails, or
limit IP that can connect to this port or number of connections per IP
per unit of time using firewall. All of them have disadvantages.

I use patched version 6.7_p1-r3 from Gentoo portage. But I guess it's
unlikely that this behaviour is affected by patches.

From djm at mindrot.org  Sun Feb 22 07:54:05 2015
From: djm at mindrot.org (Damien Miller)
Date: Sun, 22 Feb 2015 07:54:05 +1100 (AEDT)
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <54E8D229.6030709@roumenpetrov.info>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <20150221120955.GA24328@calimero.vinschen.de>
 <54E8D229.6030709@roumenpetrov.info>
Message-ID: <alpine.BSO.2.11.1502220749380.4500@natsu.mindrot.org>

On Sat, 21 Feb 2015, Roumen Petrov wrote:

> Corinna Vinschen wrote:
> > [SNIP]
> > - Last but not least, all tests in hostkey-agent.sh fail and I don't
> >    understand what's the problem here.  I attached the log files for this
> >    problem to this mail.  Maybe you see what's going wrong?
> 
> Test cannot load host keys .... please see attached file

Thanks - applied.

From djm at mindrot.org  Sun Feb 22 07:59:40 2015
From: djm at mindrot.org (Damien Miller)
Date: Sun, 22 Feb 2015 07:59:40 +1100 (AEDT)
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <20150221120955.GA24328@calimero.vinschen.de>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <20150221120955.GA24328@calimero.vinschen.de>
Message-ID: <alpine.BSO.2.11.1502220757580.4500@natsu.mindrot.org>

On Sat, 21 Feb 2015, Corinna Vinschen wrote:

> Building on 64 bit Cygwin works out of the box.  However, I have trouble
> with the testsuite.  As usual, I'm building outside the source tree:
> 
> - Building the testsuite fails:
> 
>   Assembler messages:
>   Fatal error: can't create regress/unittests/bitmap/tests.o: No such file or directory
>   Makefile:152: recipe for target 'regress/unittests/bitmap/tests.o' failed
> 
>   The testsuite apparently misses creating the regress/unittests/bitmap
>   subdir prior to running the test.  Same for the "hostkeys" and "kex"
>   subdirs.  If I create these dirs by hand, the build succeeds.  Some
>   mkdir -p calls for these three dirs would probably help.

Done - thanks.

> - The failing last loop in the "forwarding" script as reported back
>   during 6.7 testing is still failing for me more often than not.  It's
>   always the same reason, the script tries to use in-use port numbers.
>   Reducing the forwarding script to only this last test loop succeeds
>   every time, but is quite a hack for testing.

Is it colliding with itself or with other services running on your
test host? (especially with ones windows starts itself)

> - Last but not least, all tests in hostkey-agent.sh fail and I don't
>   understand what's the problem here.  I attached the log files for this
>   problem to this mail.  Maybe you see what's going wrong?

Did Roumen's config fix (applied to HEAD already) unbreak this?

-d

From djm at mindrot.org  Sun Feb 22 08:02:11 2015
From: djm at mindrot.org (Damien Miller)
Date: Sun, 22 Feb 2015 08:02:11 +1100 (AEDT)
Subject: "PermitRootLogin no" should not proceed with root login
In-Reply-To: <20150221213935.4e0696f1@localhost>
References: <20150221213935.4e0696f1@localhost>
Message-ID: <alpine.BSO.2.11.1502220800020.4500@natsu.mindrot.org>

On Sat, 21 Feb 2015, tot-to wrote:

> Steps to reproduce:
> 1) PermitRootLogin no in sshd_config
> 2) login with "root" user from other host
> 
> Present behaviour:
> 1) it asks for password 3 times and only then close the connection.
> 2) cpu consumption during bruteforce "attacks".

This is intentional behaviour. The intention is to not give clues as
to which accounts may be valid for login.

> Expected behaviour:
> Immediate disconnect/login fail

If you want this, then use:

Match user root
	MaxAuthTries 0

From tot-to at tot-to.com  Sun Feb 22 08:21:50 2015
From: tot-to at tot-to.com (tot-to)
Date: Sat, 21 Feb 2015 22:21:50 +0100
Subject: "PermitRootLogin no" should not proceed with root login
In-Reply-To: <alpine.BSO.2.11.1502220800020.4500@natsu.mindrot.org>
References: <20150221213935.4e0696f1@localhost>
 <alpine.BSO.2.11.1502220800020.4500@natsu.mindrot.org>
Message-ID: <20150221222150.499ce173@localhost>

Hi Damien,

Thank you for the explanation and suggesting the option that does
exactly what I want.

The intention looks reasonable to me.

I aclually have a related question about the reasoning:
Why "PermitRootLogin no" is not a default option?
That would be much secure and would make such kind of bruteforce attacks
useless or at least much less effective for most of the users.

On Sun, 22 Feb 2015 08:02:11 +1100 (AEDT)
Damien Miller <djm at mindrot.org> wrote:

> On Sat, 21 Feb 2015, tot-to wrote:
> 
> > Steps to reproduce:
> > 1) PermitRootLogin no in sshd_config
> > 2) login with "root" user from other host
> > 
> > Present behaviour:
> > 1) it asks for password 3 times and only then close the connection.
> > 2) cpu consumption during bruteforce "attacks".
> 
> This is intentional behaviour. The intention is to not give clues as
> to which accounts may be valid for login.
> 
> > Expected behaviour:
> > Immediate disconnect/login fail
> 
> If you want this, then use:
> 
> Match user root
> 	MaxAuthTries 0
> 


From phil at hands.com  Sun Feb 22 10:36:10 2015
From: phil at hands.com (Philip Hands)
Date: Sat, 21 Feb 2015 23:36:10 +0000
Subject: PermitRootLogin default (was: "PermitRootLogin no" should not proceed
 with root login)
In-Reply-To: <20150221222150.499ce173@localhost>
References: <20150221213935.4e0696f1@localhost>
 <alpine.BSO.2.11.1502220800020.4500@natsu.mindrot.org>
 <20150221222150.499ce173@localhost>
Message-ID: <87ioeuet1x.fsf@hands.com>

tot-to <tot-to at tot-to.com> writes:

...
> I aclually have a related question about the reasoning:
> Why "PermitRootLogin no" is not a default option?

"without-password" is the right default IMO, as suggested some time ago:

  https://bugzilla.mindrot.org/show_bug.cgi?id=2164

(and considerably earlier in Debian circles ;-) )

I'm glad to say that the default for the Debian package has finally
switched to "without-pasword" for new installs in our upcoming release.

I'd suggest it is pretty irresponsible allowing the default to remain as
"yes" here upstream, especially given how popular brute-force attacks
are these days.

Given that nobody came up with any argument to maintain "Yes" as the
default in response to that bug it seems a bit of a shame that inertia
is apparently the controlling factor here.

Cheers, Phil.
-- 
|)|  Philip Hands  [+44 (0)20 8530 9560]  HANDS.COM Ltd.
|-|  http://www.hands.com/    http://ftp.uk.debian.org/
|(|  Hugo-Klemm-Strasse 34,   21075 Hamburg,    GERMANY
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 818 bytes
Desc: not available
URL: <http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20150221/c9bb358f/attachment.bin>

From calestyo at scientia.net  Sun Feb 22 10:53:24 2015
From: calestyo at scientia.net (Christoph Anton Mitterer)
Date: Sun, 22 Feb 2015 00:53:24 +0100
Subject: PermitRootLogin default (was: "PermitRootLogin no" should not
 proceed with root login)
In-Reply-To: <87ioeuet1x.fsf@hands.com>
References: <20150221213935.4e0696f1@localhost>
 <alpine.BSO.2.11.1502220800020.4500@natsu.mindrot.org>
 <20150221222150.499ce173@localhost> <87ioeuet1x.fsf@hands.com>
Message-ID: <1424562804.15539.68.camel@scientia.net>

On Sat, 2015-02-21 at 23:36 +0000, Philip Hands wrote: 
> I'm glad to say that the default for the Debian package
Unfortunately, Debian overdid it quite a lot and also set a number of
not so smart (respectively security-critical) defaults:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=765632

So it's like 1:1 ;-)


Cheers,
Chris.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 5313 bytes
Desc: not available
URL: <http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20150222/00b458e6/attachment.bin>

From jjelen at redhat.com  Sun Feb 22 23:50:06 2015
From: jjelen at redhat.com (Jakub Jelen)
Date: Sun, 22 Feb 2015 13:50:06 +0100
Subject: which are the exact effects of MaxSessions
In-Reply-To: <1424475770.4823.64.camel@scientia.net>
References: <1424397089.4564.82.camel@scientia.net>
 <54E6DDA7.4010903@redhat.com> <1424475770.4823.64.camel@scientia.net>
Message-ID: <54E9D07E.9060904@redhat.com>


On 02/21/2015 12:42 AM, Christoph Anton Mitterer wrote:
> On Fri, 2015-02-20 at 08:09 +0100, Jakub Jelen wrote:
>> According my observation, MaxSessions 1 works for opening only one
>> session through multiplexed channel, which degrades multiplexed
>> connection back to only one session.
> Well one get's still a mux process and also the messages (when debugging
> is on) on the "master sesssion" that others try to re-use it... but then
> they're blocked.
Yes, the debugging is quite tricky, if you use -ddd you see more 
temporary sessions allocated and cleaned (to make sure there will be 
place to accommodate and to store some ongoing data?), but they do not 
persist through all your connection.
>
>> I don't know if you use openssh from some distribution
> Debian.
>
>> , but in RHEL we
>> had recently one bug in audit which looks similar like your issue --
>> with MaxSessions 1 sshd was preventing to log you in.
> Well I don't really think I have any issues... I just wondered whether
> there are any other side-effects than having influence on the channel
> muxing ... perhaps something like "only accept 1 session from the same
> IP, even when not muxing".
It should be only for mux (if I'm wrong, correct me). From  man:
 >> ... sessions permitted per network connection
which is use case of multiplexed connection.
>
> What is the issue you guys found?
It was combination of (forced)command, pty and auditing. This 
combination was using 2 sessions instead of one and if there was 
MaxSessions 2, second connection took down even the first one.

Best regards,
Jakub
>
>
> Cheers,
> Chris.
>
>
> _______________________________________________
> openssh-unix-dev mailing list
> openssh-unix-dev at mindrot.org
> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev


From jjelen at redhat.com  Sun Feb 22 23:55:35 2015
From: jjelen at redhat.com (Jakub Jelen)
Date: Sun, 22 Feb 2015 13:55:35 +0100
Subject: [PATCH] document evaluation of {Allow|Deny}{Users|Groups}
In-Reply-To: <1424484554-31968-1-git-send-email-calestyo@scientia.net>
References: <1424484554-31968-1-git-send-email-calestyo@scientia.net>
Message-ID: <54E9D1C7.6070304@redhat.com>


On 02/21/2015 03:09 AM, calestyo at scientia.net wrote:
> +The first one that matches determines whether the login is allowed or
> +denied, with the later processed directives being ignored.
This is actually not true. You can specify {Allow|Deny}{Users|Groups} 
multiple times and all of the rows are applied.


Greetings,
Jakub

From alon.barlev at gmail.com  Mon Feb 23 08:56:21 2015
From: alon.barlev at gmail.com (Alon Bar-Lev)
Date: Sun, 22 Feb 2015 23:56:21 +0200
Subject: PKI host based principal
Message-ID: <CAOazyz26gfnJgd_8k2+f8zu6k7KXSwO_q6n3kH4mgkorbH=u_w@mail.gmail.com>

Hello,

Maybe I did not understand correctly the PKI trust, so forgive me if I am wrong.

For example, I have multiple hosts that all serves as monitoring
server, I would like to trust only these hosts, so I enrol a
certificate for these using "monitoring" principal, so I can connect
only to these.

At first I thought we can do Match statement at ssh_config, however,
the Match is being evaluated before connection, so remove principal
name is not available at this stage.

>From what I do understand the known_hosts format enables CA key and
DNS mask of matched hosts.

There is no way to match against the certificate principal name.

I thought about something like:

@cert-authority
*.mydomain.org,*.mydomain.com,principal=xxx,principal=yyy <CA_KEY>

If the above cannot be done, do you think it will be helpful?

BTW: It would also be handy to allow specify CA key within separate
file, something like the following:

@cert-authority-file *.mydomain.org,*.mydomain.com,principal=xxx /etc/.../ca.pub

Regards,
Alon Bar-Lev.

From phil at hands.com  Mon Feb 23 09:33:31 2015
From: phil at hands.com (Philip Hands)
Date: Sun, 22 Feb 2015 22:33:31 +0000
Subject: PermitRootLogin default (was: "PermitRootLogin no" should not
 proceed with root login)
In-Reply-To: <1424562804.15539.68.camel@scientia.net>
References: <20150221213935.4e0696f1@localhost>
 <alpine.BSO.2.11.1502220800020.4500@natsu.mindrot.org>
 <20150221222150.499ce173@localhost> <87ioeuet1x.fsf@hands.com>
 <1424562804.15539.68.camel@scientia.net>
Message-ID: <87d251efus.fsf@hands.com>

Christoph Anton Mitterer <calestyo at scientia.net> writes:

> On Sat, 2015-02-21 at 23:36 +0000, Philip Hands wrote: 
>> I'm glad to say that the default for the Debian package
> Unfortunately, Debian overdid it quite a lot and also set a number of
> not so smart (respectively security-critical) defaults:
> https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=765632
>
> So it's like 1:1 ;-)

Having looked at the bug you mention, I have to agree that the
ForwardX11Trusted seems to have been misguided at the time it was
applied, and now (over a decade later) seems just plain wrong.

I've followed up on the bug to that effect, Cc-ing you, so you should
have seen that.

Cheers, Phil.

P.S. I take it that you were not trying to say that there's anything you
object to about the proposal to use "without-password" as the default?
-- 
|)|  Philip Hands  [+44 (0)20 8530 9560]  HANDS.COM Ltd.
|-|  http://www.hands.com/    http://ftp.uk.debian.org/
|(|  Hugo-Klemm-Strasse 34,   21075 Hamburg,    GERMANY
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 818 bytes
Desc: not available
URL: <http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20150222/95cf9264/attachment.bin>

From calestyo at scientia.net  Mon Feb 23 09:53:36 2015
From: calestyo at scientia.net (Christoph Anton Mitterer)
Date: Sun, 22 Feb 2015 23:53:36 +0100
Subject: PermitRootLogin default (was: "PermitRootLogin no" should not
 proceed with root login)
In-Reply-To: <87d251efus.fsf@hands.com>
References: <20150221213935.4e0696f1@localhost>
 <alpine.BSO.2.11.1502220800020.4500@natsu.mindrot.org>
 <20150221222150.499ce173@localhost> <87ioeuet1x.fsf@hands.com>
 <1424562804.15539.68.camel@scientia.net> <87d251efus.fsf@hands.com>
Message-ID: <1424645616.7188.17.camel@scientia.net>

On Sun, 2015-02-22 at 22:33 +0000, Philip Hands wrote: 
> P.S. I take it that you were not trying to say that there's anything you
> object to about the proposal to use "without-password" as the default?
Yes,... the upstream default should be either without-password or simply
no, actually, for security reasons I'd even prefer the later.

In the days of fully automated installation, puppet and Co. it can't be
so hard for sysadmins to change that value to something != no when this
is what they really want.


Distros, IMHO, can overwrite the defaults (if there's really good
reason),... but only in the config files, where everyone sees this.
Really changing the defaults in code is basically in most if not all
cases plain wrong (the only exceptions I could think of is, when
upstream would really set defaults which are horribly security critical
or may cause data corruption or things like that).


Cheers,
Chris.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 5313 bytes
Desc: not available
URL: <http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20150222/05ca1339/attachment.bin>

From alon.barlev at gmail.com  Mon Feb 23 11:08:16 2015
From: alon.barlev at gmail.com (Alon Bar-Lev)
Date: Mon, 23 Feb 2015 02:08:16 +0200
Subject: PKI host based principal
In-Reply-To: <CAOazyz26gfnJgd_8k2+f8zu6k7KXSwO_q6n3kH4mgkorbH=u_w@mail.gmail.com>
References: <CAOazyz26gfnJgd_8k2+f8zu6k7KXSwO_q6n3kH4mgkorbH=u_w@mail.gmail.com>
Message-ID: <CAOazyz01paCNtR3Yxd_KZVXxnyigo1J6SuyE8TtX9M4uhS=MqA@mail.gmail.com>

I guess [1] is the answer, and it is not merged yet.

[1] http://serverfault.com/questions/669718/connecting-to-a-pool-member-over-ssh-w-a-host-certificate-good-for-the-pool-nam

On Sun, Feb 22, 2015 at 11:56 PM, Alon Bar-Lev <alon.barlev at gmail.com> wrote:
> Hello,
>
> Maybe I did not understand correctly the PKI trust, so forgive me if I am wrong.
>
> For example, I have multiple hosts that all serves as monitoring
> server, I would like to trust only these hosts, so I enrol a
> certificate for these using "monitoring" principal, so I can connect
> only to these.
>
> At first I thought we can do Match statement at ssh_config, however,
> the Match is being evaluated before connection, so remove principal
> name is not available at this stage.
>
> From what I do understand the known_hosts format enables CA key and
> DNS mask of matched hosts.
>
> There is no way to match against the certificate principal name.
>
> I thought about something like:
>
> @cert-authority
> *.mydomain.org,*.mydomain.com,principal=xxx,principal=yyy <CA_KEY>
>
> If the above cannot be done, do you think it will be helpful?
>
> BTW: It would also be handy to allow specify CA key within separate
> file, something like the following:
>
> @cert-authority-file *.mydomain.org,*.mydomain.com,principal=xxx /etc/.../ca.pub
>
> Regards,
> Alon Bar-Lev.

From djm at mindrot.org  Mon Feb 23 18:27:14 2015
From: djm at mindrot.org (Damien Miller)
Date: Mon, 23 Feb 2015 18:27:14 +1100 (AEDT)
Subject: SUCCESS: OpenSSH_6.7p1-snap20150220
In-Reply-To: <ce5caee5babc4de8921b7ff3ade8797d@SSHEX01.ad.ssh.com>
References: <ce5caee5babc4de8921b7ff3ade8797d@SSHEX01.ad.ssh.com>
Message-ID: <alpine.BSO.2.11.1502231825460.31291@natsu.mindrot.org>

On Fri, 20 Feb 2015, Herb.Goldman at ssh.com wrote:

> Compiled OK, and operating nicely on CentOS 6.6, both 32/64 bit.
> Really appreciate the UpdateHostkeys feature!
> One issue I noticed, the screen output gets garbled if the user has been "asked" to "Accept" the new hostkeys.
> Looks like the screen output is missing the CR's, and only LF's get presented.
> 
> [root at be2 .ssh]# ssh be1 ls -l
> Warning: Permanently added 'be1,fec0::ffff:0:1:c0a8:415' (ECDSA) to the list of known hosts.
> total 12
> -rw-r--r-- 1 root root 1829 Jan 23 17:43 authorized_keys
> -rw-r--r-- 1 root root  575 Jan 21 17:24 sshd.pam
> drwxr-xr-x 2 root root 4096 Feb  9 14:17 tmp
> 
> [root at be2 .ssh]# ssh -o UpdateHostkeys=yes be1 ls -l
> Learned new hostkey: RSA SHA256:Alc84pvwkLVLIyRC7Z5HUpYeySwK+aMykv9cw6LCark
> Learned new hostkey: DSA SHA256:4RFtn0pMD4/AiKANWn6K3ODT66Jw8CE4SXOnAbOBXgQ
> Learned new hostkey: ED25519 SHA256:OzKAhPkHQDfk7GTvSZRKIHIv+25inWKy2n0PF8HbIhY
> Learned new hostkey: RSA SHA256:ZaHa2K0aOv6zzVTNviT08xk/ZY8xeML9uz62OiHAxOM
> Learned new hostkey: DSA SHA256:yYtO6dUL0cATSEBAyOyQApxehlhliWY5t5Z0p1CplpY
> Learned new hostkey: ECDSA SHA256:70rXiF+VgchFSvKmBQ/sXw+iANmwVTnmzQzlytaBpx4
> Learned new hostkey: ED25519 SHA256:n/qAw/sTr+4KnQ1okNg/s3tgV9wRjXULbP/a9Jy++oA
> Accept updated hostkeys? (yes/no): yes
> total 12
>         -rw-r--r-- 1 root root 1829 Jan 23 17:43 authorized_keys
>                                                                 -rw-r--r-- 1 root root  575 Jan 21 17:24 sshd.pam
>   drwxr-xr-x 2 root root 4096 Feb  9 14:17 tmp
>                                               [root at be2 .ssh]#

I think this patch should solve this problem - can you confirm?

diff --git a/clientloop.c b/clientloop.c
index 644a1f2..0a58db7 100644
--- a/clientloop.c
+++ b/clientloop.c
@@ -2176,7 +2176,8 @@ update_known_hosts(struct hostkeys_update_ctx *ctx)
 		free(fp);
 	}
 	if (options.update_hostkeys == SSH_UPDATE_HOSTKEYS_ASK) {
-		leave_raw_mode(options.request_tty == REQUEST_TTY_FORCE);
+		if (have_pty)
+			leave_raw_mode(options.request_tty == REQUEST_TTY_FORCE);
 		response = NULL;
 		for (i = 0; !quit_pending && i < 3; i++) {
 			free(response);
@@ -2196,7 +2197,8 @@ update_known_hosts(struct hostkeys_update_ctx *ctx)
 		if (quit_pending || i >= 3 || response == NULL)
 			options.update_hostkeys = 0;
 		free(response);
-		enter_raw_mode(options.request_tty == REQUEST_TTY_FORCE);
+		if (have_pty)
+			enter_raw_mode(options.request_tty == REQUEST_TTY_FORCE);
 	}
 
 	/*


From vinschen at redhat.com  Mon Feb 23 20:13:48 2015
From: vinschen at redhat.com (Corinna Vinschen)
Date: Mon, 23 Feb 2015 10:13:48 +0100
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <54E8D229.6030709@roumenpetrov.info>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <20150221120955.GA24328@calimero.vinschen.de>
 <54E8D229.6030709@roumenpetrov.info>
Message-ID: <20150223091348.GC437@calimero.vinschen.de>

Hi Roumen,

On Feb 21 20:44, Roumen Petrov wrote:
> Corinna Vinschen wrote:
> >[SNIP]
> >- Last but not least, all tests in hostkey-agent.sh fail and I don't
> >   understand what's the problem here.  I attached the log files for this
> >   problem to this mail.  Maybe you see what's going wrong?
> 
> Test cannot load host keys .... please see attached file
> [...]
> @@ -22,7 +22,7 @@ for k in `${SSH} -Q key-plain | grep -v "^x509v3-"` ; do
>  	) >> $OBJ/known_hosts.orig
>  	${SSHADD} $OBJ/agent-key.$k >/dev/null 2>&1 || \
>  		fatal "couldn't load key $OBJ/agent-key.$k"
> -	echo "Hostkey $OBJ/agent-key.${k}" >> sshd_proxy.orig
> +	echo "Hostkey $OBJ/agent-key.${k}" >> $OBJ/sshd_proxy.orig

Oh, wow, I missed that.  With this patch the testcase works nicely.
Thanks!


Corinna

-- 
Corinna Vinschen
Cygwin Maintainer
Red Hat
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 819 bytes
Desc: not available
URL: <http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20150223/c7617825/attachment.bin>

From vinschen at redhat.com  Mon Feb 23 20:28:51 2015
From: vinschen at redhat.com (Corinna Vinschen)
Date: Mon, 23 Feb 2015 10:28:51 +0100
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <alpine.BSO.2.11.1502220757580.4500@natsu.mindrot.org>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <20150221120955.GA24328@calimero.vinschen.de>
 <alpine.BSO.2.11.1502220757580.4500@natsu.mindrot.org>
Message-ID: <20150223092851.GD437@calimero.vinschen.de>

Hi Damien,

On Feb 22 07:59, Damien Miller wrote:
> On Sat, 21 Feb 2015, Corinna Vinschen wrote:
> 
> > Building on 64 bit Cygwin works out of the box.  However, I have trouble
> > with the testsuite.  As usual, I'm building outside the source tree:
> > 
> > - Building the testsuite fails:
> > 
> >   Assembler messages:
> >   Fatal error: can't create regress/unittests/bitmap/tests.o: No such file or directory
> >   Makefile:152: recipe for target 'regress/unittests/bitmap/tests.o' failed
> > 
> >   The testsuite apparently misses creating the regress/unittests/bitmap
> >   subdir prior to running the test.  Same for the "hostkeys" and "kex"
> >   subdirs.  If I create these dirs by hand, the build succeeds.  Some
> >   mkdir -p calls for these three dirs would probably help.
> 
> Done - thanks.
> 
> > - The failing last loop in the "forwarding" script as reported back
> >   during 6.7 testing is still failing for me more often than not.  It's
> >   always the same reason, the script tries to use in-use port numbers.
> >   Reducing the forwarding script to only this last test loop succeeds
> >   every time, but is quite a hack for testing.
> 
> Is it colliding with itself or with other services running on your
> test host? (especially with ones windows starts itself)

It's colliding with itself, afaics.  It tries to use ports 3301/3302
again after it already used it in a former test in the script, and with
a high probability they are still taken.  The same ports are used for
earlier tests in the same script.  On the testmachine, only very few
ports are taken by Windows processes and only one of them (RDP, port
3389) in the range used by the tests.

Note that this is still the same as described in
http://lists.mindrot.org/pipermail/openssh-unix-dev/2014-August/032842.html

See also
http://lists.mindrot.org/pipermail/openssh-unix-dev/2014-August/032854.html

And this workaround still lets the test succeed:
http://lists.mindrot.org/pipermail/openssh-unix-dev/2014-August/032862.html

> > - Last but not least, all tests in hostkey-agent.sh fail and I don't
> >   understand what's the problem here.  I attached the log files for this
> >   problem to this mail.  Maybe you see what's going wrong?
> 
> Did Roumen's config fix (applied to HEAD already) unbreak this?

Yes it did.


Thanks,
Corinna

-- 
Corinna Vinschen
Cygwin Maintainer
Red Hat
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 819 bytes
Desc: not available
URL: <http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20150223/de617c4a/attachment.bin>

From ismail at donmez.ws  Mon Feb 23 21:06:29 2015
From: ismail at donmez.ws (=?UTF-8?B?xLBzbWFpbCBEw7ZubWV6?=)
Date: Mon, 23 Feb 2015 12:06:29 +0200
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <alpine.BSO.2.11.1502210901100.6107@natsu.mindrot.org>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <CAJ1KOAhZWSThd7pEg5eKzZj9ZNoz_f772DUPDuVM+tt0YXWvHA@mail.gmail.com>
 <alpine.BSO.2.11.1502210901100.6107@natsu.mindrot.org>
Message-ID: <CAJ1KOAiNUvApmOWmvg96o1UMyaY3YNrLC00K4XURk6iC1QP_eg@mail.gmail.com>

Hi,

On Sat, Feb 21, 2015 at 12:01 AM, Damien Miller <djm at mindrot.org> wrote:
> On Fri, 20 Feb 2015, ?smail D?nmez wrote:
>
>> Hi,
>>
>> On Fri, Feb 20, 2015 at 12:21 AM, Damien Miller <djm at mindrot.org> wrote:
>> > Hi,
>> >
>> > OpenSSH 6.8 is almost ready for release, so we would appreciate testing
>> > on as many platforms and systems as possible. This release contains
>> > some substantial new features and a number of bugfixes.
>>
>> All tests pass on my Linux box. But
>> https://bugzilla.mindrot.org/show_bug.cgi?id=2342 is a notable
>> regression.
>
> hm, I can't replicate this problem:
>
> [djm at fuyu openssh]$ mkdir x
> [djm at fuyu openssh]$ cd x
> [djm at fuyu x]$ ../ssh-keygen -t ed25519 -f key -N '' -q
> [djm at fuyu x]$ ../ssh-keygen -lf ^C
> [djm at fuyu x]$ rm key ; mv key.pub key
> [djm at fuyu x]$ ../ssh-keygen -lf key
> 256 SHA256:0UH+G0Bw+ZP3rqTwxsio5CUTrKkS/kcJ26RwV3Twbyw djm at fuyu (ED25519)

Please see my followup comment.

From vinschen at redhat.com  Mon Feb 23 21:33:44 2015
From: vinschen at redhat.com (Corinna Vinschen)
Date: Mon, 23 Feb 2015 11:33:44 +0100
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <20150223092851.GD437@calimero.vinschen.de>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <20150221120955.GA24328@calimero.vinschen.de>
 <alpine.BSO.2.11.1502220757580.4500@natsu.mindrot.org>
 <20150223092851.GD437@calimero.vinschen.de>
Message-ID: <20150223103344.GA5204@calimero.vinschen.de>

Hi Damien,

On Feb 23 10:28, Corinna Vinschen wrote:
> On Feb 22 07:59, Damien Miller wrote:
> > On Sat, 21 Feb 2015, Corinna Vinschen wrote:
> > > - The failing last loop in the "forwarding" script as reported back
> > >   during 6.7 testing is still failing for me more often than not.  It's
> > >   always the same reason, the script tries to use in-use port numbers.
> > >   Reducing the forwarding script to only this last test loop succeeds
> > >   every time, but is quite a hack for testing.
> > 
> > Is it colliding with itself or with other services running on your
> > test host? (especially with ones windows starts itself)
> 
> It's colliding with itself, afaics.  It tries to use ports 3301/3302
> again after it already used it in a former test in the script, and with
> a high probability they are still taken.  The same ports are used for
> earlier tests in the same script.  On the testmachine, only very few
> ports are taken by Windows processes and only one of them (RDP, port
> 3389) in the range used by the tests.
> 
> Note that this is still the same as described in
> http://lists.mindrot.org/pipermail/openssh-unix-dev/2014-August/032842.html
> 
> See also
> http://lists.mindrot.org/pipermail/openssh-unix-dev/2014-August/032854.html
> 
> And this workaround still lets the test succeed:
> http://lists.mindrot.org/pipermail/openssh-unix-dev/2014-August/032862.html

I think I'm a step closer to a solution.

I just added debug output to the forwarding.sh script and it turns out
that the test prior to the "transfer over chained unix domain socket
forwards ..." test, namely

  echo "LocalForward ${base}01 127.0.0.1:$PORT" >> $OBJ/ssh_config
  echo "RemoteForward ${base}02 127.0.0.1:${base}01" >> $OBJ/ssh_config
  for p in 1 2; do
	  trace "config file: start forwarding, fork to background"
	  ${SSH} -$p -F $OBJ/ssh_config -f somehost sleep 10

	  trace "config file: transfer over forwarded channels and check result"
	  ${SSH} -F $OBJ/ssh_config -p${base}02 -o 'ConnectionAttempts=4' \
		  somehost cat ${DATA} > ${COPY}
	  test -s ${COPY}         || fail "failed copy of ${DATA}"
	  cmp ${DATA} ${COPY}     || fail "corrupted copy of ${DATA}"

	  wait
  done

leaves the ports 3301/3302 in TIME_WAIT state (as is 4242 from some
earlier test).  Here are the relevant excerpts from ps -e and (Windows)
netstat output.  The first group is the output prior to the above test:

      PID    PPID    PGID     WINPID   TTY     UID    STIME COMMAND
     1320    3632    1320       3964  ?       1049577 11:19:26 /home/corinna/sshbuild/bin/sshd
     3512    3632    3512       3444  ?       1049577 11:19:27 /home/corinna/sshbuild/bin/sshd
     3632       1    3632       3632  ?       1049577 11:17:49 /home/corinna/sshbuild/bin/sshd

Active Connections

  Proto  Local Address          Foreign Address        State           PID
  TCP    127.0.0.1:4242         0.0.0.0:0              LISTENING       3632
  TCP    127.0.0.1:61665        127.0.0.1:4242         TIME_WAIT       0
  TCP    127.0.0.1:61666        127.0.0.1:61667        TIME_WAIT       0
  TCP    127.0.0.1:61668        127.0.0.1:61669        TIME_WAIT       0
  TCP    127.0.0.1:61673        127.0.0.1:4242         TIME_WAIT       0
  TCP    127.0.0.1:61674        127.0.0.1:61675        TIME_WAIT       0
  TCP    127.0.0.1:61676        127.0.0.1:61677        TIME_WAIT       0
  TCP    127.0.0.1:61679        127.0.0.1:4242         TIME_WAIT       0
  TCP    127.0.0.1:61680        127.0.0.1:61681        TIME_WAIT       0
  TCP    127.0.0.1:61682        127.0.0.1:61683        TIME_WAIT       0
  TCP    127.0.0.1:61686        127.0.0.1:4242         TIME_WAIT       0
  TCP    127.0.0.1:61687        127.0.0.1:61688        TIME_WAIT       0
  TCP    127.0.0.1:61689        127.0.0.1:61690        TIME_WAIT       0
  TCP    127.0.0.1:61691        127.0.0.1:4242         TIME_WAIT       0
  TCP    127.0.0.1:61692        127.0.0.1:61693        TIME_WAIT       0
  TCP    127.0.0.1:61694        127.0.0.1:61695        TIME_WAIT       0

the second group is the output from right between the above test and the
"transfer over chained unix domain socket forwards..."

      PID    PPID    PGID     WINPID   TTY     UID    STIME COMMAND
     3112     376     376       3212  ?       1049577 11:19:29 /usr/bin/sleep
     3520     388     388       3716  ?       1049577 11:19:32 /usr/bin/sleep
     3056    3632    3056       2100  ?       1049577 11:19:31 /home/corinna/sshbuild/bin/sshd
     4048       1    4048       4048  ?       1049577 11:19:31 /home/corinna/sshbuild/bin/ssh
     2372    3632    2372       4024  ?       1049577 11:19:33 /home/corinna/sshbuild/bin/sshd
     2728       1    2728       2728  ?       1049577 11:19:28 /home/corinna/sshbuild/bin/ssh
     2908    3632    2908        328  ?       1049577 11:19:28 /home/corinna/sshbuild/bin/sshd
     3632       1    3632       3632  ?       1049577 11:17:49 /home/corinna/sshbuild/bin/sshd

Active Connections

  Proto  Local Address          Foreign Address        State           PID
  TCP    127.0.0.1:3301         0.0.0.0:0              LISTENING       2640
  TCP    127.0.0.1:3301         127.0.0.1:61714        CLOSE_WAIT      2640
  TCP    127.0.0.1:3302         0.0.0.0:0              LISTENING       328
  TCP    127.0.0.1:3302         127.0.0.1:61713        CLOSE_WAIT      328
  TCP    127.0.0.1:4242         0.0.0.0:0              LISTENING       3632
  TCP    127.0.0.1:4242         127.0.0.1:61696        ESTABLISHED     3632
  TCP    127.0.0.1:4242         127.0.0.1:61708        ESTABLISHED     3632
  TCP    127.0.0.1:4242         127.0.0.1:61715        CLOSE_WAIT      3632
  TCP    127.0.0.1:61673        127.0.0.1:4242         TIME_WAIT       0
  TCP    127.0.0.1:61679        127.0.0.1:4242         TIME_WAIT       0
  TCP    127.0.0.1:61680        127.0.0.1:61681        TIME_WAIT       0
  TCP    127.0.0.1:61682        127.0.0.1:61683        TIME_WAIT       0
  TCP    127.0.0.1:61686        127.0.0.1:4242         TIME_WAIT       0
  TCP    127.0.0.1:61687        127.0.0.1:61688        TIME_WAIT       0
  TCP    127.0.0.1:61689        127.0.0.1:61690        TIME_WAIT       0
  TCP    127.0.0.1:61691        127.0.0.1:4242         TIME_WAIT       0
  TCP    127.0.0.1:61692        127.0.0.1:61693        TIME_WAIT       0
  TCP    127.0.0.1:61694        127.0.0.1:61695        TIME_WAIT       0
  TCP    127.0.0.1:61696        127.0.0.1:4242         ESTABLISHED     2640
  TCP    127.0.0.1:61697        127.0.0.1:61698        TIME_WAIT       0
  TCP    127.0.0.1:61699        127.0.0.1:61700        TIME_WAIT       0
  TCP    127.0.0.1:61701        127.0.0.1:3302         TIME_WAIT       0
  TCP    127.0.0.1:61702        127.0.0.1:3301         TIME_WAIT       0
  TCP    127.0.0.1:61703        127.0.0.1:4242         TIME_WAIT       0
  TCP    127.0.0.1:61704        127.0.0.1:61705        TIME_WAIT       0
  TCP    127.0.0.1:61706        127.0.0.1:61707        TIME_WAIT       0
  TCP    127.0.0.1:61708        127.0.0.1:4242         ESTABLISHED     2988
  TCP    127.0.0.1:61709        127.0.0.1:61710        TIME_WAIT       0
  TCP    127.0.0.1:61711        127.0.0.1:61712        TIME_WAIT       0
  TCP    127.0.0.1:61713        127.0.0.1:3302         FIN_WAIT_2      3380
  TCP    127.0.0.1:61714        127.0.0.1:3301         FIN_WAIT_2      2728
  TCP    127.0.0.1:61715        127.0.0.1:4242         FIN_WAIT_2      328
  TCP    127.0.0.1:61716        127.0.0.1:61717        TIME_WAIT       0
  TCP    127.0.0.1:61718        127.0.0.1:61719        TIME_WAIT       0

This may well be a problem local to Windows.  Btw., the large number of
AF_INET sockets is a result of the way how Cygwin implements AF_LOCAL
sockets:  They are emulated by local AF_INET sockets since WIndows
doesn't know the concept of AF_LOCAL sockets.

Note that there are still sleep processes running.  So on a hunch I just
added a `sleep 30' between the two tests and, lo and behold, the
forwarding.sh test completes successfully every time:

diff --git a/regress/forwarding.sh b/regress/forwarding.sh
index f799d49..1489407 100644
--- a/regress/forwarding.sh
+++ b/regress/forwarding.sh
@@ -120,6 +120,8 @@ for p in 1 2; do
 	wait
 done
 
+sleep 30
+
 for p in 2; do
 	trace "transfer over chained unix domain socket forwards and check result"
 	rm -f $OBJ/unix-[123].fwd


Thanks,
Corinna


-- 
Corinna Vinschen
Cygwin Maintainer
Red Hat
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 819 bytes
Desc: not available
URL: <http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20150223/ba968482/attachment-0001.bin>

From djm at mindrot.org  Tue Feb 24 03:47:53 2015
From: djm at mindrot.org (Damien Miller)
Date: Tue, 24 Feb 2015 03:47:53 +1100 (AEDT)
Subject: SUCCESS: OpenSSH_6.7p1-snap20150220
In-Reply-To: <alpine.BSO.2.11.1502231825460.31291@natsu.mindrot.org>
References: <ce5caee5babc4de8921b7ff3ade8797d@SSHEX01.ad.ssh.com>
 <alpine.BSO.2.11.1502231825460.31291@natsu.mindrot.org>
Message-ID: <alpine.BSO.2.11.1502240347020.4503@natsu.mindrot.org>

On Mon, 23 Feb 2015, Damien Miller wrote:

> I think this patch should solve this problem - can you confirm?

I managed to reproduce the problem (which was incorrectly setting
TTY "raw" mode) and have committed a fix.

-d

From djm at mindrot.org  Tue Feb 24 03:59:32 2015
From: djm at mindrot.org (Damien Miller)
Date: Tue, 24 Feb 2015 03:59:32 +1100 (AEDT)
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <CAJ1KOAiNUvApmOWmvg96o1UMyaY3YNrLC00K4XURk6iC1QP_eg@mail.gmail.com>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <CAJ1KOAhZWSThd7pEg5eKzZj9ZNoz_f772DUPDuVM+tt0YXWvHA@mail.gmail.com>
 <alpine.BSO.2.11.1502210901100.6107@natsu.mindrot.org>
 <CAJ1KOAiNUvApmOWmvg96o1UMyaY3YNrLC00K4XURk6iC1QP_eg@mail.gmail.com>
Message-ID: <alpine.BSO.2.11.1502240357260.4503@natsu.mindrot.org>

On Mon, 23 Feb 2015, ?smail D?nmez wrote:

> > On Fri, 20 Feb 2015, ?smail D?nmez wrote:
> >
> >> Hi,
> >>
> >> On Fri, Feb 20, 2015 at 12:21 AM, Damien Miller <djm at mindrot.org> wrote:
> >> > Hi,
> >> >
> >> > OpenSSH 6.8 is almost ready for release, so we would appreciate testing
> >> > on as many platforms and systems as possible. This release contains
> >> > some substantial new features and a number of bugfixes.
> >>
> >> All tests pass on my Linux box. But
> >> https://bugzilla.mindrot.org/show_bug.cgi?id=2342 is a notable
> >> regression.
> >
> > hm, I can't replicate this problem:
> >
> > [djm at fuyu openssh]$ mkdir x
> > [djm at fuyu openssh]$ cd x
> > [djm at fuyu x]$ ../ssh-keygen -t ed25519 -f key -N '' -q
> > [djm at fuyu x]$ ../ssh-keygen -lf ^C
> > [djm at fuyu x]$ rm key ; mv key.pub key
> > [djm at fuyu x]$ ../ssh-keygen -lf key
> > 256 SHA256:0UH+G0Bw+ZP3rqTwxsio5CUTrKkS/kcJ26RwV3Twbyw djm at fuyu (ED25519)
> 
> Please see my followup comment.

Thanks - that helped me figure it out. I've committed a fix.

-d

From djm at mindrot.org  Tue Feb 24 04:26:37 2015
From: djm at mindrot.org (Damien Miller)
Date: Tue, 24 Feb 2015 04:26:37 +1100 (AEDT)
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <20150223103344.GA5204@calimero.vinschen.de>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <20150221120955.GA24328@calimero.vinschen.de>
 <alpine.BSO.2.11.1502220757580.4500@natsu.mindrot.org>
 <20150223092851.GD437@calimero.vinschen.de>
 <20150223103344.GA5204@calimero.vinschen.de>
Message-ID: <alpine.BSO.2.11.1502240401390.4503@natsu.mindrot.org>

On Mon, 23 Feb 2015, Corinna Vinschen wrote:

> leaves the ports 3301/3302 in TIME_WAIT state (as is 4242 from some
> earlier test).  Here are the relevant excerpts from ps -e and (Windows)
> netstat output.  The first group is the output prior to the above test:

[snip]

> This may well be a problem local to Windows.  Btw., the large number of
> AF_INET sockets is a result of the way how Cygwin implements AF_LOCAL
> sockets:  They are emulated by local AF_INET sockets since WIndows
> doesn't know the concept of AF_LOCAL sockets.

Does CYGWIN implement setsockopt(s, SOL_SOCKET, SO_REUSEADDR, ...)?
We set this for (AFAIK) all forwarding listeners to prevent TIME_WAIT
collisions.

> Note that there are still sleep processes running.  So on a hunch I just
> added a `sleep 30' between the two tests and, lo and behold, the
> forwarding.sh test completes successfully every time:

IMO it's probably a simple race condition rather than a TCP thing, and
the test before the "transfer over chained unix domain socket" one does
look like it fails to wait for the backgrounded ssh to finish (the wait
doesn't wait for the background ssh, but the one following it).

Does the following help?

Index: forwarding.sh
===================================================================
RCS file: /cvs/src/regress/usr.bin/ssh/forwarding.sh,v
retrieving revision 1.13
diff -u -p -r1.13 forwarding.sh
--- forwarding.sh	21 Feb 2015 20:51:02 -0000	1.13
+++ forwarding.sh	23 Feb 2015 17:25:40 -0000
@@ -8,6 +8,9 @@ start_sshd
 base=33
 last=$PORT
 fwd=""
+CTL=$OBJ/ctl-sock
+rm -f $CTL
+
 for j in 0 1 2; do
 	for i in 0 1 2; do
 		a=$base$j$i
@@ -107,7 +110,7 @@ echo "LocalForward ${base}01 127.0.0.1:$
 echo "RemoteForward ${base}02 127.0.0.1:${base}01" >> $OBJ/ssh_config
 for p in 1 2; do
 	trace "config file: start forwarding, fork to background"
-	${SSH} -$p -F $OBJ/ssh_config -f somehost sleep 10
+	${SSH} -S $CTL -M -$p -F $OBJ/ssh_config -f somehost sleep 10
 
 	trace "config file: transfer over forwarded channels and check result"
 	${SSH} -F $OBJ/ssh_config -p${base}02 -o 'ConnectionAttempts=4' \
@@ -115,7 +118,7 @@ for p in 1 2; do
 	test -s ${COPY}		|| fail "failed copy of ${DATA}"
 	cmp ${DATA} ${COPY}	|| fail "corrupted copy of ${DATA}"
 
-	wait
+	${SSH} -S $CTL -O exit somehost
 done
 
 for p in 2; do

From djm at mindrot.org  Tue Feb 24 04:35:44 2015
From: djm at mindrot.org (Damien Miller)
Date: Tue, 24 Feb 2015 04:35:44 +1100 (AEDT)
Subject: PKI host based principal
In-Reply-To: <CAOazyz26gfnJgd_8k2+f8zu6k7KXSwO_q6n3kH4mgkorbH=u_w@mail.gmail.com>
References: <CAOazyz26gfnJgd_8k2+f8zu6k7KXSwO_q6n3kH4mgkorbH=u_w@mail.gmail.com>
Message-ID: <alpine.BSO.2.11.1502240428020.4503@natsu.mindrot.org>

On Sun, 22 Feb 2015, Alon Bar-Lev wrote:

> Hello,
>
> Maybe I did not understand correctly the PKI trust, so forgive me if I
> am wrong.
>
> For example, I have multiple hosts that all serves as monitoring
> server, I would like to trust only these hosts, so I enrol a
> certificate for these using "monitoring" principal, so I can connect
> only to these.
>
> At first I thought we can do Match statement at ssh_config, however,
> the Match is being evaluated before connection, so remove principal
> name is not available at this stage.
>
> From what I do understand the known_hosts format enables CA key and
> DNS mask of matched hosts.
>
> There is no way to match against the certificate principal name.
>
> I thought about something like:
>
> @cert-authority
> *.mydomain.org,*.mydomain.com,principal=xxx,principal=yyy <CA_KEY>

I don't think I wasnt to add more indirection to known_hosts; the file
is already a mess of tangled, overlapping features and I'm terrified to
add more :/

Someone sent me a patch to allow certificate hostname principal matching
against HostkeyAlias if matching against the exact hostname failed. 
This  might be an alternative way for you to achieve what you want.
What do you think?

> If the above cannot be done, do you think it will be helpful?
> 
> BTW: It would also be handy to allow specify CA key within separate
> file, something like the following:
> 
> @cert-authority-file *.mydomain.org,*.mydomain.com,principal=xxx /etc/.../ca.pub

I'm not sure it's worth the extra complexity in known_hosts parsing,
given that it's already possible to specify multiple user/system
known_hosts files.

E.g. you could do:

UserKnownHostsFile ~/.ssh/known_hosts ~/.ssh/known_hosts_mydomain

with the latter listing the CA keys.

-d

From alon.barlev at gmail.com  Tue Feb 24 04:42:39 2015
From: alon.barlev at gmail.com (Alon Bar-Lev)
Date: Mon, 23 Feb 2015 19:42:39 +0200
Subject: PKI host based principal
In-Reply-To: <alpine.BSO.2.11.1502240428020.4503@natsu.mindrot.org>
References: <CAOazyz26gfnJgd_8k2+f8zu6k7KXSwO_q6n3kH4mgkorbH=u_w@mail.gmail.com>
 <alpine.BSO.2.11.1502240428020.4503@natsu.mindrot.org>
Message-ID: <CAOazyz053Fqx7Gy+Hn-hQ_RfkHbakJhsstmqM2yfM2RSZvhknA@mail.gmail.com>

On Mon, Feb 23, 2015 at 7:35 PM, Damien Miller <djm at mindrot.org> wrote:
>
> On Sun, 22 Feb 2015, Alon Bar-Lev wrote:
>
> > Hello,
> >
> > Maybe I did not understand correctly the PKI trust, so forgive me if I
> > am wrong.
> >
> > For example, I have multiple hosts that all serves as monitoring
> > server, I would like to trust only these hosts, so I enrol a
> > certificate for these using "monitoring" principal, so I can connect
> > only to these.
> >
> > At first I thought we can do Match statement at ssh_config, however,
> > the Match is being evaluated before connection, so remove principal
> > name is not available at this stage.
> >
> > From what I do understand the known_hosts format enables CA key and
> > DNS mask of matched hosts.
> >
> > There is no way to match against the certificate principal name.
> >
> > I thought about something like:
> >
> > @cert-authority
> > *.mydomain.org,*.mydomain.com,principal=xxx,principal=yyy <CA_KEY>
>
> I don't think I wasnt to add more indirection to known_hosts; the file
> is already a mess of tangled, overlapping features and I'm terrified to
> add more :/
>
> Someone sent me a patch to allow certificate hostname principal matching
> against HostkeyAlias if matching against the exact hostname failed.
> This  might be an alternative way for you to achieve what you want.
> What do you think?

yes, I found this patch after I posted this :)
it would be a solution.

>
> > If the above cannot be done, do you think it will be helpful?
> >
> > BTW: It would also be handy to allow specify CA key within separate
> > file, something like the following:
> >
> > @cert-authority-file *.mydomain.org,*.mydomain.com,principal=xxx /etc/.../ca.pub
>
> I'm not sure it's worth the extra complexity in known_hosts parsing,
> given that it's already possible to specify multiple user/system
> known_hosts files.
>
> E.g. you could do:
>
> UserKnownHostsFile ~/.ssh/known_hosts ~/.ssh/known_hosts_mydomain
>
> with the latter listing the CA keys.

I am thinking of avoiding specify the ca key over and over within the file.

I mean, instead of having one large selection of valid principal
enable principal per line, while simplify the ca key.

Another issue is that unlike the sshd_config which can point to a
file, I cannot have static configuration for the ssh client side
because I must generate the known_hosts based on the CA key that I
receive during setup.

Not critical, for this I have a solution.

Thanks!
Alon

From mikep at noc.utoronto.ca  Tue Feb 24 04:41:08 2015
From: mikep at noc.utoronto.ca (mikep at noc.utoronto.ca)
Date: Mon, 23 Feb 2015 12:41:08 -0500 (EST)
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
Message-ID: <Pine.GSO.4.64.1502231222540.23544@kraken.noc.utoronto.ca>

openssh-SNAP-20150224, Solaris 10, GCC

Configure command line:

./configure CC=gcc --prefix=/opt/local --sysconfdir=/etc/ssh 
--with-prngd-socket=/var/run/egd-pool --with-zlib=/opt/local --with-rpath

Have to manually edit 'config.h':

diff config.h.orig config.h
783c783
< #define HAVE_MKDTEMP 1
---
> /* #undef HAVE_MKDTEMP */

as Solaris does not have 'mkdtemp'.

Compile fails at:

gcc -g -O2 -Wall -Wpointer-arith -Wuninitialized -Wsign-compare 
-Wformat-security -fno-strict-aliasing -D_FORTIFY_SOURCE=2 -ftrapv 
-fno-builtin-memset  -I. -I. -I/opt/local/include  -DSSHDIR=\"/etc/ssh\" 
-D_PATH_SSH_PROGRAM=\"/opt/local/bin/ssh\" 
-D_PATH_SSH_ASKPASS_DEFAULT=\"/opt/local/libexec/ssh-askpass\" 
-D_PATH_SFTP_SERVER=\"/opt/local/libexec/sftp-server\" 
-D_PATH_SSH_KEY_SIGN=\"/opt/local/libexec/ssh-keysign\" 
-D_PATH_SSH_PKCS11_HELPER=\"/opt/local/libexec/ssh-pkcs11-helper\" 
-D_PATH_SSH_PIDDIR=\"/var/run\" -D_PATH_PRIVSEP_CHROOT_DIR=\"/var/empty\" 
-DHAVE_CONFIG_H -c canohost.c -o canohost.o
In file included from packet.h:45,
                  from canohost.c:33:
dispatch.h:46: warning: type defaults to `int' in declaration of 
`sig_atomic_t'
dispatch.h:46: error: syntax error before '*' token
dispatch.h:47: warning: type defaults to `int' in declaration of 
`sig_atomic_t'
dispatch.h:47: error: syntax error before '*' token
make: *** [canohost.o] Error 1



Mike
--
Mike Peterson                            Information Security Analyst - Audit
E-mail: mikep at noc.utoronto.ca                WWW: http://www.noc.utoronto.ca/
Tel: 416-978-5230                                           Fax: 416-978-6620

From djm at mindrot.org  Tue Feb 24 05:00:43 2015
From: djm at mindrot.org (Damien Miller)
Date: Tue, 24 Feb 2015 05:00:43 +1100 (AEDT)
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <Pine.GSO.4.64.1502231222540.23544@kraken.noc.utoronto.ca>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <Pine.GSO.4.64.1502231222540.23544@kraken.noc.utoronto.ca>
Message-ID: <alpine.BSO.2.11.1502240459330.4503@natsu.mindrot.org>

On Mon, 23 Feb 2015, mikep at noc.utoronto.ca wrote:

> openssh-SNAP-20150224, Solaris 10, GCC

Thanks for testing.

> Configure command line:
> 
> ./configure CC=gcc --prefix=/opt/local --sysconfdir=/etc/ssh
> --with-prngd-socket=/var/run/egd-pool --with-zlib=/opt/local --with-rpath
> 
> Have to manually edit 'config.h':
> 
> diff config.h.orig config.h
> 783c783
> < #define HAVE_MKDTEMP 1
> ---
> > /* #undef HAVE_MKDTEMP */
> 
> as Solaris does not have 'mkdtemp'.

That's strange - it's finding it somewhere. Could I ask you to rummage
through config.log to see what it is detecting?

> Compile fails at:
> 
> gcc -g -O2 -Wall -Wpointer-arith -Wuninitialized -Wsign-compare
> -Wformat-security -fno-strict-aliasing -D_FORTIFY_SOURCE=2 -ftrapv
> -fno-builtin-memset  -I. -I. -I/opt/local/include  -DSSHDIR=\"/etc/ssh\"
> -D_PATH_SSH_PROGRAM=\"/opt/local/bin/ssh\"
> -D_PATH_SSH_ASKPASS_DEFAULT=\"/opt/local/libexec/ssh-askpass\"
> -D_PATH_SFTP_SERVER=\"/opt/local/libexec/sftp-server\"
> -D_PATH_SSH_KEY_SIGN=\"/opt/local/libexec/ssh-keysign\"
> -D_PATH_SSH_PKCS11_HELPER=\"/opt/local/libexec/ssh-pkcs11-helper\"
> -D_PATH_SSH_PIDDIR=\"/var/run\" -D_PATH_PRIVSEP_CHROOT_DIR=\"/var/empty\"
> -DHAVE_CONFIG_H -c canohost.c -o canohost.o
> In file included from packet.h:45,
>                  from canohost.c:33:
> dispatch.h:46: warning: type defaults to `int' in declaration of
> `sig_atomic_t'
> dispatch.h:46: error: syntax error before '*' token
> dispatch.h:47: warning: type defaults to `int' in declaration of
> `sig_atomic_t'
> dispatch.h:47: error: syntax error before '*' token
> make: *** [canohost.o] Error 1

Does this help?

diff --git a/dispatch.h b/dispatch.h
index cd51dbc..2bcdc91 100644
--- a/dispatch.h
+++ b/dispatch.h
@@ -27,6 +27,8 @@
 #ifndef DISPATCH_H
 #define DISPATCH_H
 
+#include <signal.h> /* for sig_atomic_t */
+
 #define DISPATCH_MAX	255
 
 enum {

From tgc at jupiterrise.com  Tue Feb 24 06:21:50 2015
From: tgc at jupiterrise.com (Tom G. Christensen)
Date: Mon, 23 Feb 2015 20:21:50 +0100
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
Message-ID: <54EB7DCE.5080708@jupiterrise.com>

On 19/02/15 23:21, Damien Miller wrote:
> Snapshot releases for portable OpenSSH are available from
> http://www.mindrot.org/openssh_snap/
>

I tried building openssh-SNAP-20150224.tar.gz on Solaris 2.6, 7, 8 and 9.
All failed because they do not have <sys/queue.h>.
Here's how it looks on Solaris 9/SPARC with gcc 4.9.2:
...
In file included from ssh_api.c:21:0:
ssh_api.h:21:23: fatal error: sys/queue.h: No such file or directory
  #include <sys/queue.h>
                        ^
compilation terminated.
gmake: *** [ssh_api.o] Error 1

-tgc

From djm at mindrot.org  Tue Feb 24 06:31:17 2015
From: djm at mindrot.org (Damien Miller)
Date: Tue, 24 Feb 2015 06:31:17 +1100 (AEDT)
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <54EB7DCE.5080708@jupiterrise.com>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <54EB7DCE.5080708@jupiterrise.com>
Message-ID: <alpine.BSO.2.11.1502240630420.4503@natsu.mindrot.org>

On Mon, 23 Feb 2015, Tom G. Christensen wrote:

> On 19/02/15 23:21, Damien Miller wrote:
> > Snapshot releases for portable OpenSSH are available from
> > http://www.mindrot.org/openssh_snap/
> > 
> 
> I tried building openssh-SNAP-20150224.tar.gz on Solaris 2.6, 7, 8 and 9.
> All failed because they do not have <sys/queue.h>.
> Here's how it looks on Solaris 9/SPARC with gcc 4.9.2:
> ...
> In file included from ssh_api.c:21:0:
> ssh_api.h:21:23: fatal error: sys/queue.h: No such file or directory
>  #include <sys/queue.h>

Thanks - I just committed a fix:

diff --git a/ssh_api.h b/ssh_api.h
index a7e14e0..642acd5 100644
--- a/ssh_api.h
+++ b/ssh_api.h
@@ -18,10 +18,11 @@
 #ifndef API_H
 #define API_H
 
-#include <sys/queue.h>
 #include <sys/types.h>
 #include <signal.h>
 
+#include "openbsd-compat/sys-queue.h"
+
 #include "cipher.h"
 #include "sshkey.h"
 #include "kex.h"


From mail at ojkastl.de  Tue Feb 24 06:45:46 2015
From: mail at ojkastl.de (Johannes Kastl)
Date: Mon, 23 Feb 2015 20:45:46 +0100
Subject: Using confirmation of key usage per-host?
Message-ID: <mcg01a$a32$1@ger.gmane.org>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Dear all,

bear with me, I know the SUBJECT sounds pretty unclear. I'll clarify
in a minute. And please excuse that due to the keywords being unclear
no usable help was found on google & Co...

Assume there is a workstation, which connects to multiple machines,
one of which is considered potentially unsafe. So, it would be nice to
have agent forwarding to that machine combined with the confirmation
option of ssh-add (-c). If the 'forwarded key' is used on this
machine, the user is prompted on the workstation. An intruder cannot
use the authentication information without the user knowing (at least
that is how I understood the idea of agent confirmation).

Using ssh-add -c on the workstation together with setting
'ForwardAgent=yes' in the .ssh/config achieves the desired behaviour.

Unfortunately, this means the user is asked for confirmation, each
time the keys is used. Even if it is just to connect to a safe machine
or without agent forwarding.

Question:
Is it possible to just get asked for confirmation, when the key is
used on a machine, to which agent forwarding is used? Can this be set
on a per-host-basis, like enabling/disabling agent forwarding in
.ssh/config?

One workaround I could think if would be to use a separate ssh key
just for that machine, and just add that one with the ssh-add -c option.

Any hints?

Thanks in advance,
Johannes
- -- 
`Voldemort himself created his worst enemy, just as tyrants everywhere
do! Have you any idea how much tyrants fear the people they oppress?
All of them realise that, one day [...]there is sure to be one who
rises against them and strikes back.? (Harry Potter 6)
-----BEGIN PGP SIGNATURE-----
Comment: Using GnuPG with SeaMonkey - http://www.enigmail.net/

iEYEARECAAYFAlTrg2MACgkQzi3gQ/xETbLqQACdG0fpMXJQPku9yiTj1tVnDMfY
BpEAn1hIqIPsuWKSbgXwCd8djmITATMH
=esSH
-----END PGP SIGNATURE-----


From djm at mindrot.org  Tue Feb 24 06:56:36 2015
From: djm at mindrot.org (Damien Miller)
Date: Tue, 24 Feb 2015 06:56:36 +1100 (AEDT)
Subject: Using confirmation of key usage per-host?
In-Reply-To: <mcg01a$a32$1@ger.gmane.org>
References: <mcg01a$a32$1@ger.gmane.org>
Message-ID: <alpine.BSO.2.11.1502240655410.4503@natsu.mindrot.org>

On Mon, 23 Feb 2015, Johannes Kastl wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Dear all,
> 
> bear with me, I know the SUBJECT sounds pretty unclear. I'll clarify
> in a minute. And please excuse that due to the keywords being unclear
> no usable help was found on google & Co...
> 
> Assume there is a workstation, which connects to multiple machines,
> one of which is considered potentially unsafe. So, it would be nice to
> have agent forwarding to that machine combined with the confirmation
> option of ssh-add (-c). If the 'forwarded key' is used on this
> machine, the user is prompted on the workstation. An intruder cannot
> use the authentication information without the user knowing (at least
> that is how I understood the idea of agent confirmation).
> 
> Using ssh-add -c on the workstation together with setting
> 'ForwardAgent=yes' in the .ssh/config achieves the desired behaviour.
> 
> Unfortunately, this means the user is asked for confirmation, each
> time the keys is used. Even if it is just to connect to a safe machine
> or without agent forwarding.
> 
> Question:
> Is it possible to just get asked for confirmation, when the key is
> used on a machine, to which agent forwarding is used? Can this be set
> on a per-host-basis, like enabling/disabling agent forwarding in
> .ssh/config?

No and no.

You might want to check the mailing list archive for the thread
"Filtering which identities are forwarded by ssh-agent to a given host"
a couple of weeks ago for a related discussion.

-d

From carson at taltos.org  Tue Feb 24 07:02:47 2015
From: carson at taltos.org (Carson Gaspar)
Date: Mon, 23 Feb 2015 12:02:47 -0800
Subject: Using confirmation of key usage per-host?
In-Reply-To: <mcg01a$a32$1@ger.gmane.org>
References: <mcg01a$a32$1@ger.gmane.org>
Message-ID: <54EB8767.2000601@taltos.org>

On 2/23/15 11:45 AM, Johannes Kastl wrote:
> Assume there is a workstation, which connects to multiple machines,
> one of which is considered potentially unsafe. So, it would be nice to
> have agent forwarding to that machine combined with the confirmation
> option of ssh-add (-c). If the 'forwarded key' is used on this
> machine, the user is prompted on the workstation. An intruder cannot
> use the authentication information without the user knowing (at least
> that is how I understood the idea of agent confirmation).
>
> Using ssh-add -c on the workstation together with setting
> 'ForwardAgent=yes' in the .ssh/config achieves the desired behaviour.
>
> Unfortunately, this means the user is asked for confirmation, each
> time the keys is used. Even if it is just to connect to a safe machine
> or without agent forwarding.
>
> Question:
> Is it possible to just get asked for confirmation, when the key is
> used on a machine, to which agent forwarding is used? Can this be set
> on a per-host-basis, like enabling/disabling agent forwarding in
> .ssh/config?

You'll need to run 2 agents if you want different agent behaviour. Sadly 
I don't know of any way to select which agent gets used in ssh_config - 
you'd also have to wrap ssh to flip the SSH_AUTH_SOCK env var.

-- 
Carson



From dtucker at zip.com.au  Tue Feb 24 07:16:39 2015
From: dtucker at zip.com.au (Darren Tucker)
Date: Mon, 23 Feb 2015 15:16:39 -0500
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
Message-ID: <CALDDTe3jsFfSsxSZT+UM1vkzKESjWmxD=2QWb_pCo=hKOK8a6w@mail.gmail.com>

I've found the following problem with really old gccs (definitely 2.7.2.1
and 2.95.3 but possibly others).  I believe it's due to variadic macros
when given only 1 arg.

channels.c: In function `channel_input_port_forward_request?:
channels.c:3442: parse error before `;?

The line is pretty simple:

        if (fwd.connect_port == 0)
                packet_disconnect("Dynamic forwarding denied.");

As part of the new API, packet_disconnect() became a macro:

#define packet_disconnect(fmt, args...) \
        ssh_packet_disconnect(active_state, (fmt), ##args)

If I do -save-temps, the preprocessed source is (note unbalanced parens):

        if (fwd.connect_port == 0)
                ssh_packet_disconnect(active_state, ( "Dynamic forwarding
denied."  ) ;


If I change the source to:

        if (fwd.connect_port == 0)
                packet_disconnect("%s", "Dynamic forwarding denied.");

then it'll work.

Question is: what to do?
a) nothing.  I'll either retire the affected test platforms or upgrade the
compiler depending on how enthusiastic I get.
b) add the "%s"
c) make packet_disconnect a real function.
d) ???

Comments?


On Thu, Feb 19, 2015 at 5:21 PM, Damien Miller <djm at mindrot.org> wrote:

> Hi,
>
> OpenSSH 6.8 is almost ready for release, so we would appreciate testing
> on as many platforms and systems as possible. This release contains
> some substantial new features and a number of bugfixes.
>
> Snapshot releases for portable OpenSSH are available from
> http://www.mindrot.org/openssh_snap/
>
> The OpenBSD version is available in CVS HEAD:
> http://www.openbsd.org/anoncvs.html
>
> Portable OpenSSH is also available via anonymous CVS using the
> instructions at http://www.openssh.com/portable.html#cvs or
> via Git at https://anongit.mindrot.org/openssh.git/
>
> Running the regression tests supplied with Portable OpenSSH does not
> require installation and is a simply:
>
> $ ./configure && make tests
>
> Live testing on suitable non-production systems is also
> appreciated. Please send reports of success or failure to
> openssh-unix-dev at mindrot.org.
>
> Below is a summary of changes. More detail may be found in the ChangeLog
> in the portable OpenSSH tarballs.
>
> Thanks to the many people who contributed to this release.
>
> Changes since OpenSSH 6.7
> =========================
>
> This is a major release, containing a number of new features as
> well as a large internal re-factoring.
>
> Potentially-incompatible changes
> --------------------------------
>
>  * sshd(8): UseDNS now defaults to 'no'. Configurations that match
>    against the client host name (via sshd_config or authorized_keys)
>    may need to re-enable it or convert to matching against addresses.
>
> New Features
> ------------
>
>  * Much of OpenSSH's internal code has been re-factored to be more
>    library-like. These changes are mostly not user-visible, but
>    have greatly improved OpenSSH's testability and internal layout.
>
>  * Add FingerprintHash option to ssh(1) and sshd(8), and equivalent
>    command-line flags to the other tools to control algorithm used
>    for key fingerprints. The default changes from MD5 to SHA256 and
>    format from hex to base64.
>
>    Fingerprints now have the hash algorithm prepended. An example of
>    the new format: SHA256:mVPwvezndPv/ARoIadVY98vAC0g+P/5633yTC4d/wXE
>    Please note that visual host keys will also be different.
>
>  * ssh(1), sshd(8): Host key rotation support. Add a protocol
>    extension for a server to inform a client of all its available
>    host keys after authentication has completed. The client may
>    record the keys in known_hosts, allowing it to upgrade to better
>    host key algorithms and a server to gracefully rotate its keys.
>
>    The client side of this is controlled by a UpdateHostkeys config
>    option (default on).
>
>  * ssh(1): Add a ssh_config HostbasedKeyType option to control which
>    host public key types are tried during host-based authentication.
>
>  * ssh(1), sshd(8): fix connection-killing host key mismatch errors
>    when sshd offers multiple ECDSA keys of different lengths.
>
>  * ssh(1): when host name canonicalisation is enabled, try to
>    parse host names as addresses before looking them up for
>    canonicalisation. fixes bz#2074 and avoiding needless DNS
>    lookups in some cases.
>
>  * ssh-keygen(1), sshd(8): Key Revocation Lists (KRLs) no longer
>    require OpenSSH to be compiled with OpenSSL support.
>
>  * ssh(1), ssh-keysign(8): Make ed25519 keys work for host based
>    authentication.
>
>  * sshd(8): SSH protocol v.1 workaround for the Meyer, et al,
>    Bleichenbacher Side Channel Attack. Fake up a bignum key before
>    RSA decryption.
>
>  * sshd(8): Remember which public keys have been used for
>    authentication and refuse to accept previously-used keys.
>    This allows AuthenticationMethods=publickey,publickey to require
>    that users authenticate using two _different_ public keys.
>
>  * sshd(8): add sshd_config HostbasedAcceptedKeyTypes and
>    PubkeyAcceptedKeyTypes options to allow sshd to control what
>    public key types will be accepted. Currently defaults to all.
>
>  * sshd(8): Don't count partial authentication success as a failure
>    against MaxAuthTries.
>
>  * ssh(1): Add RevokedHostKeys option for the client to allow
>    text-file or KRL-based revocation of host keys.
>
>  * ssh-keygen(1), sshd(8): Permit KRLs that revoke certificates by
>    serial number or key ID without scoping to a particular CA.
>
>  * ssh(1): Add a "Match canonical" criteria that allows ssh_config
>    Match blocks to trigger only in the second config pass.
>
>  * ssh(1): Add a -G option to ssh that causes it to parse its
>    configuration and dump the result to stdout, similar to "sshd -T".
>
>  * ssh(1): Allow Match criteria to be negated. E.g. "Match !host".
>
>  * The regression test suite has been extended to cover more OpenSSH
>    features. The unit tests have been expanded and now cover key
>    exchange.
>
> Bugfixes
> --------
>
>  * ssh-keyscan(1): ssh-keyscan has been made much more robust again
>    servers that hang or violate the SSH protocol.
>
>  * ssh(1), ssh-keygen(1): Fix regression bz#2306: Key path names were
>    being lost as comment fields.
>
>  * ssh(1): Allow ssh_config Port options set in the second config
>    parse phase to be applied (they were being ignored). bz#2286
>
>  * ssh(1): Tweak config re-parsing with host canonicalisation - make
>    the second pass through the config files always run when host name
>    canonicalisation is enabled (and not whenever the host name
>    changes) bz#2267
>
>  * ssh(1): Fix passing of wildcard forward bind addresses when
>    connection multiplexing is in use; bz#2324;
>
>  * ssh-keygen(1): Fix broken private key conversion from non-OpenSSH
>    formats; bz#2345.
>
>  * ssh-keygen(1): Fix KRL generation bug when multiple CAs are in
>    use.
>
>  * Various fixed to manual pages: bz#2288, bz#2316, bz#2273
>
> Portable OpenSSH
> ----------------
>
>  * Support --without-openssl at configure time
>
>    Disables and removes dependency on OpenSSL. Many features,
>    including SSH protocol 1 are not supported and the set of crypto
>    options is greatly restricted. This will only work on system with
>    native arc4random or /dev/urandom.
>
>    Considered highly experimental for now.
>
>  * Support --without-ssh1 option at configure time
>
>    Allows disabling support for SSH protocol 1.
>
>    Still experimental - not all regression and unit tests have been
>    been adapted for the absence of SSH protocol 1.
>
>  * sshd(8): Fix compilation on systems with IPv6 support in utmpx; bz#2296
>
>  * Allow custom service name for sshd on Cygwin. Permits the use of
>    multiple sshd running with different service names.
>
> Reporting Bugs:
> ===============
>
> - Please read http://www.openssh.com/report.html
>   Security bugs should be reported directly to openssh at openssh.com
>
> OpenSSH is brought to you by Markus Friedl, Niels Provos, Theo de Raadt,
> Kevin Steves, Damien Miller, Darren Tucker, Jason McIntyre, Tim Rice and
> Ben Lindstrom.
>
>


-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.

From mikep at noc.utoronto.ca  Tue Feb 24 07:18:11 2015
From: mikep at noc.utoronto.ca (mikep at noc.utoronto.ca)
Date: Mon, 23 Feb 2015 15:18:11 -0500 (EST)
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <alpine.BSO.2.11.1502240459330.4503@natsu.mindrot.org>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <Pine.GSO.4.64.1502231222540.23544@kraken.noc.utoronto.ca>
 <alpine.BSO.2.11.1502240459330.4503@natsu.mindrot.org>
Message-ID: <Pine.GSO.4.64.1502231419330.23544@kraken.noc.utoronto.ca>

On Tue, 24 Feb 2015, Damien Miller wrote:

> On Mon, 23 Feb 2015, mikep at noc.utoronto.ca wrote:
>
>> openssh-SNAP-20150224, Solaris 10, GCC
>
> Thanks for testing.
>
>> Configure command line:
>>
>> ./configure CC=gcc --prefix=/opt/local --sysconfdir=/etc/ssh
>> --with-prngd-socket=/var/run/egd-pool --with-zlib=/opt/local --with-rpath
>>
>> Have to manually edit 'config.h':
>>
>> diff config.h.orig config.h
>> 783c783
>> < #define HAVE_MKDTEMP 1
>> ---
>>> /* #undef HAVE_MKDTEMP */
>>
>> as Solaris does not have 'mkdtemp'.
>
> That's strange - it's finding it somewhere. Could I ask you to rummage
> through config.log to see what it is detecting?

All I see is:

configure:10439: checking for mkdtemp
configure:10439: gcc -o conftest -g -O2 -Wall -Wpointer-arith 
-Wuninitialized -Wsign-compare -Wformat-security -fno-strict-aliasing
-D_FORTIFY_SOURCE=2 -ftrapv -fno-builtin-memset -I/opt/local/include
-L/opt/local/lib -R/opt/local/lib  -Wl,-z,now conftest.c -lz -lsocket -lnsl  >&5
configure:10439: $? = 0
configure:10439: result: yes

I've done some testing, and while there is no 'man' page, the function 
does seem to exist, and works as expected in a small test program. I've 
had to make this manual change since at least OpenSSH 6.6 (can't remember 
what failed but must have been 'make tests' somewhere). Re-running build 
with '#define HAVE_MKDTEMP 1'.

>> Compile fails at:
>>
>> gcc -g -O2 -Wall -Wpointer-arith -Wuninitialized -Wsign-compare
>> -Wformat-security -fno-strict-aliasing -D_FORTIFY_SOURCE=2 -ftrapv
>> -fno-builtin-memset  -I. -I. -I/opt/local/include  -DSSHDIR=\"/etc/ssh\"
>> -D_PATH_SSH_PROGRAM=\"/opt/local/bin/ssh\"
>> -D_PATH_SSH_ASKPASS_DEFAULT=\"/opt/local/libexec/ssh-askpass\"
>> -D_PATH_SFTP_SERVER=\"/opt/local/libexec/sftp-server\"
>> -D_PATH_SSH_KEY_SIGN=\"/opt/local/libexec/ssh-keysign\"
>> -D_PATH_SSH_PKCS11_HELPER=\"/opt/local/libexec/ssh-pkcs11-helper\"
>> -D_PATH_SSH_PIDDIR=\"/var/run\" -D_PATH_PRIVSEP_CHROOT_DIR=\"/var/empty\"
>> -DHAVE_CONFIG_H -c canohost.c -o canohost.o
>> In file included from packet.h:45,
>>                  from canohost.c:33:
>> dispatch.h:46: warning: type defaults to `int' in declaration of
>> `sig_atomic_t'
>> dispatch.h:46: error: syntax error before '*' token
>> dispatch.h:47: warning: type defaults to `int' in declaration of
>> `sig_atomic_t'
>> dispatch.h:47: error: syntax error before '*' token
>> make: *** [canohost.o] Error 1
>
> Does this help?
>
> diff --git a/dispatch.h b/dispatch.h
> index cd51dbc..2bcdc91 100644
> --- a/dispatch.h
> +++ b/dispatch.h
> @@ -27,6 +27,8 @@
> #ifndef DISPATCH_H
> #define DISPATCH_H
>
> +#include <signal.h> /* for sig_atomic_t */
> +
> #define DISPATCH_MAX	255
>
> enum {

That's got it - build now completes.

'make tests' fails at:

gcc -g -O2 -Wall -Wpointer-arith -Wuninitialized -Wsign-compare -Wformat-security -fno-strict-aliasing -D_FORTIFY_SOURCE=2 -ftrapv -fno-builtin-memset  -I. -I. -I/opt/local/include  -DSSHDIR=\"/etc/ssh\" -D_PATH_SSH_PROGRAM=\"/opt/local/bin/ssh\" -D_PATH_SSH_ASKPASS_DEFAULT=\"/opt/local/libexec/ssh-askpass\" -D_PATH_SFTP_SERVER=\"/opt/local/libexec/sftp-server\" -D_PATH_SSH_KEY_SIGN=\"/opt/local/libexec/ssh-keysign\" -D_PATH_SSH_PKCS11_HELPER=\"/opt/local/libexec/ssh-pkcs11-helper\" -D_PATH_SSH_PIDDIR=\"/var/run\" -D_PATH_PRIVSEP_CHROOT_DIR=\"/var/empty\" -DHAVE_CONFIG_H -o regress/netcat regress/netcat.c \
-L. -Lopenbsd-compat/ -L/opt/local/lib -R/opt/local/lib  -Wl,-z,now -lssh -lopenbsd-compat -lssh -lopenbsd-compat -lresolv -lcrypto -lrt -lz -lsocket -lnsl 
regress/netcat.c:47:17: err.h: No such file or directory
regress/netcat.c: In function `main':
regress/netcat.c:166: warning: implicit declaration of function `errx'
regress/netcat.c:232: warning: implicit declaration of function `err'
regress/netcat.c: In function `unix_bind':
regress/netcat.c:503: error: syntax error before numeric constant
regress/netcat.c:511: error: invalid lvalue in unary `&'
regress/netcat.c:512: error: request for member `sun_family' in something not a structure or union
regress/netcat.c:514: error: request for member `sun_path' in something not a structure or union
regress/netcat.c:514: error: request for member `sun_path' in something not a structure or union
regress/netcat.c:515: error: request for member `sun_path' in something not a structure or union
regress/netcat.c:521: error: invalid lvalue in unary `&'
regress/netcat.c:521: error: invalid lvalue in unary `&'
regress/netcat.c:521: error: invalid lvalue in unary `&'
regress/netcat.c:521: error: invalid lvalue in unary `&'
regress/netcat.c: In function `unix_connect':
regress/netcat.c:535: error: syntax error before numeric constant
regress/netcat.c:547: error: invalid lvalue in unary `&'
regress/netcat.c:548: error: request for member `sun_family' in something not a structure or union
regress/netcat.c:550: error: request for member `sun_path' in something not a structure or union
regress/netcat.c:550: error: request for member `sun_path' in something not a structure or union
regress/netcat.c:551: error: request for member `sun_path' in something not a structure or union
regress/netcat.c:556: error: invalid lvalue in unary `&'
regress/netcat.c:556: error: invalid lvalue in unary `&'
regress/netcat.c:556: error: invalid lvalue in unary `&'
regress/netcat.c:556: error: invalid lvalue in unary `&'
regress/netcat.c: In function `remote_connect':
regress/netcat.c:637: warning: implicit declaration of function `warn'
regress/netcat.c: In function `local_listen':
regress/netcat.c:695: warning: unused variable `ret'
regress/netcat.c:695: warning: unused variable `x'
regress/netcat.c: In function `fdpass':
regress/netcat.c:997: error: structure has no member named `msg_control'
regress/netcat.c:998: error: structure has no member named `msg_controllen'
regress/netcat.c:999: error: structure has no member named `msg_controllen'
regress/netcat.c:999: error: structure has no member named `msg_control'
make: *** [regress/netcat] Error 1

The only 'err.h' include file on the system is
'/usr/local/include/openssl/err.h'.

Mike
--
Mike Peterson                            Information Security Analyst - Audit
E-mail: mikep at noc.utoronto.ca                WWW: http://www.noc.utoronto.ca/
Tel: 416-978-5230                                           Fax: 416-978-6620

From mail at ojkastl.de  Tue Feb 24 07:26:04 2015
From: mail at ojkastl.de (Johannes Kastl)
Date: Mon, 23 Feb 2015 21:26:04 +0100
Subject: Using confirmation of key usage per-host?
In-Reply-To: <alpine.BSO.2.11.1502240655410.4503@natsu.mindrot.org>
References: <mcg01a$a32$1@ger.gmane.org>
 <alpine.BSO.2.11.1502240655410.4503@natsu.mindrot.org>
Message-ID: <2E3EECE2-184B-4195-A2CA-70E5376E53D6@ojkastl.de>

Hi Damien, 

Am 23. Februar 2015 20:56:36 MEZ, schrieb Damien Miller <djm at mindrot.org>:
>
>
>No and no.
>
>You might want to check the mailing list archive for the thread
>"Filtering which identities are forwarded by ssh-agent to a given host"
>a couple of weeks ago for a related discussion.
>
>-d

Thanks for the quick answer. I'll have a look at this thread.

So only the different key workaround might help, right? 

Regards,
Johannes
-- 
This mail has been sent from my mobile phone. Please excuse the briefness.
This mail is not signed cryptographically.

From vinschen at redhat.com  Tue Feb 24 07:23:02 2015
From: vinschen at redhat.com (Corinna Vinschen)
Date: Mon, 23 Feb 2015 21:23:02 +0100
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <alpine.BSO.2.11.1502240401390.4503@natsu.mindrot.org>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <20150221120955.GA24328@calimero.vinschen.de>
 <alpine.BSO.2.11.1502220757580.4500@natsu.mindrot.org>
 <20150223092851.GD437@calimero.vinschen.de>
 <20150223103344.GA5204@calimero.vinschen.de>
 <alpine.BSO.2.11.1502240401390.4503@natsu.mindrot.org>
Message-ID: <20150223202302.GA6750@calimero.vinschen.de>

Hi Damien,

On Feb 24 04:26, Damien Miller wrote:
> On Mon, 23 Feb 2015, Corinna Vinschen wrote:
> 
> > leaves the ports 3301/3302 in TIME_WAIT state (as is 4242 from some
> > earlier test).  Here are the relevant excerpts from ps -e and (Windows)
> > netstat output.  The first group is the output prior to the above test:
> 
> [snip]
> 
> > This may well be a problem local to Windows.  Btw., the large number of
> > AF_INET sockets is a result of the way how Cygwin implements AF_LOCAL
> > sockets:  They are emulated by local AF_INET sockets since WIndows
> > doesn't know the concept of AF_LOCAL sockets.
> 
> Does CYGWIN implement setsockopt(s, SOL_SOCKET, SO_REUSEADDR, ...)?
> We set this for (AFAIK) all forwarding listeners to prevent TIME_WAIT
> collisions.

Yes, it does.  But given how screwed up this part of the Windows sockets
implementation is, I'm not at all sure this works 100% reliable.

> > Note that there are still sleep processes running.  So on a hunch I just
> > added a `sleep 30' between the two tests and, lo and behold, the
> > forwarding.sh test completes successfully every time:
> 
> IMO it's probably a simple race condition rather than a TCP thing, and
> the test before the "transfer over chained unix domain socket" one does
> look like it fails to wait for the backgrounded ssh to finish (the wait
> doesn't wait for the background ssh, but the one following it).
> 
> Does the following help?

It does!  Thanks, that looks much neater than a 30 seconds sleep :)


Corinna

-- 
Corinna Vinschen
Cygwin Maintainer
Red Hat
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 819 bytes
Desc: not available
URL: <http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20150223/1a6905b2/attachment.bin>

From djm at mindrot.org  Tue Feb 24 07:32:56 2015
From: djm at mindrot.org (Damien Miller)
Date: Tue, 24 Feb 2015 07:32:56 +1100 (AEDT)
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <20150223202302.GA6750@calimero.vinschen.de>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <20150221120955.GA24328@calimero.vinschen.de>
 <alpine.BSO.2.11.1502220757580.4500@natsu.mindrot.org>
 <20150223092851.GD437@calimero.vinschen.de>
 <20150223103344.GA5204@calimero.vinschen.de>
 <alpine.BSO.2.11.1502240401390.4503@natsu.mindrot.org>
 <20150223202302.GA6750@calimero.vinschen.de>
Message-ID: <alpine.BSO.2.11.1502240732430.4503@natsu.mindrot.org>

On Mon, 23 Feb 2015, Corinna Vinschen wrote:

> > IMO it's probably a simple race condition rather than a TCP thing, and
> > the test before the "transfer over chained unix domain socket" one does
> > look like it fails to wait for the backgrounded ssh to finish (the wait
> > doesn't wait for the background ssh, but the one following it).
> > 
> > Does the following help?
> 
> It does!  Thanks, that looks much neater than a 30 seconds sleep :)

Committed - thanks.

-d

From peter at stuge.se  Tue Feb 24 07:36:15 2015
From: peter at stuge.se (Peter Stuge)
Date: Mon, 23 Feb 2015 21:36:15 +0100
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <CALDDTe3jsFfSsxSZT+UM1vkzKESjWmxD=2QWb_pCo=hKOK8a6w@mail.gmail.com>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <CALDDTe3jsFfSsxSZT+UM1vkzKESjWmxD=2QWb_pCo=hKOK8a6w@mail.gmail.com>
Message-ID: <20150223203615.28784.qmail@stuge.se>

Darren Tucker wrote:
> Question is: what to do?
> c) make packet_disconnect a real function.

I say c.


//Peter

From djm at mindrot.org  Tue Feb 24 07:44:23 2015
From: djm at mindrot.org (Damien Miller)
Date: Tue, 24 Feb 2015 07:44:23 +1100 (AEDT)
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <20150223203615.28784.qmail@stuge.se>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <CALDDTe3jsFfSsxSZT+UM1vkzKESjWmxD=2QWb_pCo=hKOK8a6w@mail.gmail.com>
 <20150223203615.28784.qmail@stuge.se>
Message-ID: <alpine.BSO.2.11.1502240744060.4503@natsu.mindrot.org>

On Mon, 23 Feb 2015, Peter Stuge wrote:

> Darren Tucker wrote:
> > Question is: what to do?
> > c) make packet_disconnect a real function.
> 
> I say c.

yeah, stick it in opacket.c

From tgc at jupiterrise.com  Tue Feb 24 08:22:40 2015
From: tgc at jupiterrise.com (Tom G. Christensen)
Date: Mon, 23 Feb 2015 22:22:40 +0100
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <alpine.BSO.2.11.1502240630420.4503@natsu.mindrot.org>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <54EB7DCE.5080708@jupiterrise.com>
 <alpine.BSO.2.11.1502240630420.4503@natsu.mindrot.org>
Message-ID: <54EB9A20.4080102@jupiterrise.com>

On 23/02/15 20:31, Damien Miller wrote:
> Thanks - I just committed a fix:
>
<snip patch>

Thanks, unfortunately you missed the one in packet.h.

In file included from ssh_api.h:31:0,
                  from ssh_api.c:21:
packet.h:38:23: fatal error: sys/queue.h: No such file or directory
  #include <sys/queue.h>
                        ^
compilation terminated.
gmake: *** [ssh_api.o] Error 1

Fixing that I run into the missing sig_atomic_t that I see you posted a 
patch for earlier.

Next issue is unconditional include of <stdint.h> in xmalloc.c:
xmalloc.c:19:20: error: stdint.h: No such file or directory

Solaris < 10 does not have stdint.h, it actually only fails on Solaris 
2.6 because it is limited to gcc 4.3.6 which does not provide a stdint.h 
replacement (this was introduced with gcc 4.4).

-tgc


From kevin.brott at gmail.com  Tue Feb 24 08:28:54 2015
From: kevin.brott at gmail.com (Kevin Brott)
Date: Mon, 23 Feb 2015 13:28:54 -0800
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
Message-ID: <CAMv58rbsbqi09fHygx6miXm0Ub9r_R=K1iMM3GbXMtEWOKq2QQ@mail.gmail.com>

Stock - Debian GNU/Linux 7.8 (wheezy) - all tests passed


build failure on:
 * AIX 6.1 (6100-09-03-1415) IBM XL C/C++ Compiler (11.1.0.16)
 * AIX 7.1 (7100-03-04-1441) IBM XL C/C++ Compiler (12.1.0.6)

./configure && make tests

...

xlc_r -g  -I. -I.  -DSSHDIR=\"/usr/local/etc\"
 -D_PATH_SSH_PROGRAM=\"/usr/local/bin/ssh\"
 -D_PATH_SSH_ASKPASS_DEFAULT=\"/usr/local/libexec/ssh-askpass\"
 -D_PATH_SFTP_SERVER=\"/usr/local/libexec/sftp-server\"
 -D_PATH_SSH_KEY_SIGN=\"/usr/local/libexec/ssh-keysign\"
 -D_PATH_SSH_PKCS11_HELPER=\"/usr/local/libexec/ssh-pkcs11-helper\"
 -D_PATH_SSH_PIDDIR=\"/var/run\"  -D_PATH_PRIVSEP_CHROOT_DIR=\"/var/empty\"
-DHAVE_CONFIG_H -c ssh_api.c -o ssh_api.o
"ssh_api.c", line 143.19: 1506-068 (W) Operation between types "struct
key_entry*" and "int" is not allowed.
"ssh_api.c", line 149.19: 1506-068 (W) Operation between types "struct
key_entry*" and "int" is not allowed.
"ssh_api.c", line 440.45: 1506-045 (S) Undeclared identifier next.
"ssh_api.c", line 440.51: 1506-277 (S) Syntax error: possible missing ';'
or ','?
"ssh_api.c", line 455.46: 1506-045 (S) Undeclared identifier next.
"ssh_api.c", line 455.52: 1506-277 (S) Syntax error: possible missing ';'
or ','?
"ssh_api.c", line 470.45: 1506-045 (S) Undeclared identifier next.
"ssh_api.c", line 470.51: 1506-277 (S) Syntax error: possible missing ';'
or ','?
"ssh_api.c", line 505.53: 1506-045 (S) Undeclared identifier next.
"ssh_api.c", line 505.59: 1506-277 (S) Syntax error: possible missing ';'
or ','?
make: 1254-004 The error code from the last command is 1.




On Thu, Feb 19, 2015 at 2:21 PM, Damien Miller <djm at mindrot.org> wrote:

> Hi,
>
> OpenSSH 6.8 is almost ready for release, so we would appreciate testing
> on as many platforms and systems as possible. This release contains
> some substantial new features and a number of bugfixes.
>
> Snapshot releases for portable OpenSSH are available from
> http://www.mindrot.org/openssh_snap/
>
> The OpenBSD version is available in CVS HEAD:
> http://www.openbsd.org/anoncvs.html
>
> Portable OpenSSH is also available via anonymous CVS using the
> instructions at http://www.openssh.com/portable.html#cvs or
> via Git at https://anongit.mindrot.org/openssh.git/
>
> Running the regression tests supplied with Portable OpenSSH does not
> require installation and is a simply:
>
> $ ./configure && make tests
>
> Live testing on suitable non-production systems is also
> appreciated. Please send reports of success or failure to
> openssh-unix-dev at mindrot.org.
>
> Below is a summary of changes. More detail may be found in the ChangeLog
> in the portable OpenSSH tarballs.
>
> Thanks to the many people who contributed to this release.
>
> Changes since OpenSSH 6.7
> =========================
>
> This is a major release, containing a number of new features as
> well as a large internal re-factoring.
>
> Potentially-incompatible changes
> --------------------------------
>
>  * sshd(8): UseDNS now defaults to 'no'. Configurations that match
>    against the client host name (via sshd_config or authorized_keys)
>    may need to re-enable it or convert to matching against addresses.
>
> New Features
> ------------
>
>  * Much of OpenSSH's internal code has been re-factored to be more
>    library-like. These changes are mostly not user-visible, but
>    have greatly improved OpenSSH's testability and internal layout.
>
>  * Add FingerprintHash option to ssh(1) and sshd(8), and equivalent
>    command-line flags to the other tools to control algorithm used
>    for key fingerprints. The default changes from MD5 to SHA256 and
>    format from hex to base64.
>
>    Fingerprints now have the hash algorithm prepended. An example of
>    the new format: SHA256:mVPwvezndPv/ARoIadVY98vAC0g+P/5633yTC4d/wXE
>    Please note that visual host keys will also be different.
>
>  * ssh(1), sshd(8): Host key rotation support. Add a protocol
>    extension for a server to inform a client of all its available
>    host keys after authentication has completed. The client may
>    record the keys in known_hosts, allowing it to upgrade to better
>    host key algorithms and a server to gracefully rotate its keys.
>
>    The client side of this is controlled by a UpdateHostkeys config
>    option (default on).
>
>  * ssh(1): Add a ssh_config HostbasedKeyType option to control which
>    host public key types are tried during host-based authentication.
>
>  * ssh(1), sshd(8): fix connection-killing host key mismatch errors
>    when sshd offers multiple ECDSA keys of different lengths.
>
>  * ssh(1): when host name canonicalisation is enabled, try to
>    parse host names as addresses before looking them up for
>    canonicalisation. fixes bz#2074 and avoiding needless DNS
>    lookups in some cases.
>
>  * ssh-keygen(1), sshd(8): Key Revocation Lists (KRLs) no longer
>    require OpenSSH to be compiled with OpenSSL support.
>
>  * ssh(1), ssh-keysign(8): Make ed25519 keys work for host based
>    authentication.
>
>  * sshd(8): SSH protocol v.1 workaround for the Meyer, et al,
>    Bleichenbacher Side Channel Attack. Fake up a bignum key before
>    RSA decryption.
>
>  * sshd(8): Remember which public keys have been used for
>    authentication and refuse to accept previously-used keys.
>    This allows AuthenticationMethods=publickey,publickey to require
>    that users authenticate using two _different_ public keys.
>
>  * sshd(8): add sshd_config HostbasedAcceptedKeyTypes and
>    PubkeyAcceptedKeyTypes options to allow sshd to control what
>    public key types will be accepted. Currently defaults to all.
>
>  * sshd(8): Don't count partial authentication success as a failure
>    against MaxAuthTries.
>
>  * ssh(1): Add RevokedHostKeys option for the client to allow
>    text-file or KRL-based revocation of host keys.
>
>  * ssh-keygen(1), sshd(8): Permit KRLs that revoke certificates by
>    serial number or key ID without scoping to a particular CA.
>
>  * ssh(1): Add a "Match canonical" criteria that allows ssh_config
>    Match blocks to trigger only in the second config pass.
>
>  * ssh(1): Add a -G option to ssh that causes it to parse its
>    configuration and dump the result to stdout, similar to "sshd -T".
>
>  * ssh(1): Allow Match criteria to be negated. E.g. "Match !host".
>
>  * The regression test suite has been extended to cover more OpenSSH
>    features. The unit tests have been expanded and now cover key
>    exchange.
>
> Bugfixes
> --------
>
>  * ssh-keyscan(1): ssh-keyscan has been made much more robust again
>    servers that hang or violate the SSH protocol.
>
>  * ssh(1), ssh-keygen(1): Fix regression bz#2306: Key path names were
>    being lost as comment fields.
>
>  * ssh(1): Allow ssh_config Port options set in the second config
>    parse phase to be applied (they were being ignored). bz#2286
>
>  * ssh(1): Tweak config re-parsing with host canonicalisation - make
>    the second pass through the config files always run when host name
>    canonicalisation is enabled (and not whenever the host name
>    changes) bz#2267
>
>  * ssh(1): Fix passing of wildcard forward bind addresses when
>    connection multiplexing is in use; bz#2324;
>
>  * ssh-keygen(1): Fix broken private key conversion from non-OpenSSH
>    formats; bz#2345.
>
>  * ssh-keygen(1): Fix KRL generation bug when multiple CAs are in
>    use.
>
>  * Various fixed to manual pages: bz#2288, bz#2316, bz#2273
>
> Portable OpenSSH
> ----------------
>
>  * Support --without-openssl at configure time
>
>    Disables and removes dependency on OpenSSL. Many features,
>    including SSH protocol 1 are not supported and the set of crypto
>    options is greatly restricted. This will only work on system with
>    native arc4random or /dev/urandom.
>
>    Considered highly experimental for now.
>
>  * Support --without-ssh1 option at configure time
>
>    Allows disabling support for SSH protocol 1.
>
>    Still experimental - not all regression and unit tests have been
>    been adapted for the absence of SSH protocol 1.
>
>  * sshd(8): Fix compilation on systems with IPv6 support in utmpx; bz#2296
>
>  * Allow custom service name for sshd on Cygwin. Permits the use of
>    multiple sshd running with different service names.
>
> Reporting Bugs:
> ===============
>
> - Please read http://www.openssh.com/report.html
>   Security bugs should be reported directly to openssh at openssh.com
>
> OpenSSH is brought to you by Markus Friedl, Niels Provos, Theo de Raadt,
> Kevin Steves, Damien Miller, Darren Tucker, Jason McIntyre, Tim Rice and
> Ben Lindstrom.
>
> _______________________________________________
> openssh-unix-dev mailing list
> openssh-unix-dev at mindrot.org
> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
>



-- 
# include <stddisclaimer.h>
/* Kevin  Brott <Kevin.Brott at gmail.com> */

From kevin.brott at gmail.com  Tue Feb 24 08:31:26 2015
From: kevin.brott at gmail.com (Kevin Brott)
Date: Mon, 23 Feb 2015 13:31:26 -0800
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <CAMv58rbsbqi09fHygx6miXm0Ub9r_R=K1iMM3GbXMtEWOKq2QQ@mail.gmail.com>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <CAMv58rbsbqi09fHygx6miXm0Ub9r_R=K1iMM3GbXMtEWOKq2QQ@mail.gmail.com>
Message-ID: <CAMv58razrSRhNn2=TfXRLnd3z++qwWZoiusiRi3EbGZHOrKEYQ@mail.gmail.com>

Neglected to mention - this is using openssh-SNAP-20150224.tar.gz

On Mon, Feb 23, 2015 at 1:28 PM, Kevin Brott <kevin.brott at gmail.com> wrote:

> Stock - Debian GNU/Linux 7.8 (wheezy) - all tests passed
>
>
> build failure on:
>  * AIX 6.1 (6100-09-03-1415) IBM XL C/C++ Compiler (11.1.0.16)
>  * AIX 7.1 (7100-03-04-1441) IBM XL C/C++ Compiler (12.1.0.6)
>
> ./configure && make tests
>
> ...
>
> xlc_r -g  -I. -I.  -DSSHDIR=\"/usr/local/etc\"
>  -D_PATH_SSH_PROGRAM=\"/usr/local/bin/ssh\"
>  -D_PATH_SSH_ASKPASS_DEFAULT=\"/usr/local/libexec/ssh-askpass\"
>  -D_PATH_SFTP_SERVER=\"/usr/local/libexec/sftp-server\"
>  -D_PATH_SSH_KEY_SIGN=\"/usr/local/libexec/ssh-keysign\"
>  -D_PATH_SSH_PKCS11_HELPER=\"/usr/local/libexec/ssh-pkcs11-helper\"
>  -D_PATH_SSH_PIDDIR=\"/var/run\"  -D_PATH_PRIVSEP_CHROOT_DIR=\"/var/empty\"
> -DHAVE_CONFIG_H -c ssh_api.c -o ssh_api.o
> "ssh_api.c", line 143.19: 1506-068 (W) Operation between types "struct
> key_entry*" and "int" is not allowed.
> "ssh_api.c", line 149.19: 1506-068 (W) Operation between types "struct
> key_entry*" and "int" is not allowed.
> "ssh_api.c", line 440.45: 1506-045 (S) Undeclared identifier next.
> "ssh_api.c", line 440.51: 1506-277 (S) Syntax error: possible missing ';'
> or ','?
> "ssh_api.c", line 455.46: 1506-045 (S) Undeclared identifier next.
> "ssh_api.c", line 455.52: 1506-277 (S) Syntax error: possible missing ';'
> or ','?
> "ssh_api.c", line 470.45: 1506-045 (S) Undeclared identifier next.
> "ssh_api.c", line 470.51: 1506-277 (S) Syntax error: possible missing ';'
> or ','?
> "ssh_api.c", line 505.53: 1506-045 (S) Undeclared identifier next.
> "ssh_api.c", line 505.59: 1506-277 (S) Syntax error: possible missing ';'
> or ','?
> make: 1254-004 The error code from the last command is 1.
>
>
>
> On Thu, Feb 19, 2015 at 2:21 PM, Damien Miller <djm at mindrot.org> wrote:
>
>> Hi,
>>
>> OpenSSH 6.8 is almost ready for release, so we would appreciate testing
>> on as many platforms and systems as possible. This release contains
>> some substantial new features and a number of bugfixes.
>>
>> Snapshot releases for portable OpenSSH are available from
>> http://www.mindrot.org/openssh_snap/
>>
>> The OpenBSD version is available in CVS HEAD:
>> http://www.openbsd.org/anoncvs.html
>>
>> Portable OpenSSH is also available via anonymous CVS using the
>> instructions at http://www.openssh.com/portable.html#cvs or
>> via Git at https://anongit.mindrot.org/openssh.git/
>>
>> Running the regression tests supplied with Portable OpenSSH does not
>> require installation and is a simply:
>>
>> $ ./configure && make tests
>>
>> Live testing on suitable non-production systems is also
>> appreciated. Please send reports of success or failure to
>> openssh-unix-dev at mindrot.org.
>>
>> Below is a summary of changes. More detail may be found in the ChangeLog
>> in the portable OpenSSH tarballs.
>>
>> Thanks to the many people who contributed to this release.
>>
>> Changes since OpenSSH 6.7
>> =========================
>>
>> This is a major release, containing a number of new features as
>> well as a large internal re-factoring.
>>
>> Potentially-incompatible changes
>> --------------------------------
>>
>>  * sshd(8): UseDNS now defaults to 'no'. Configurations that match
>>    against the client host name (via sshd_config or authorized_keys)
>>    may need to re-enable it or convert to matching against addresses.
>>
>> New Features
>> ------------
>>
>>  * Much of OpenSSH's internal code has been re-factored to be more
>>    library-like. These changes are mostly not user-visible, but
>>    have greatly improved OpenSSH's testability and internal layout.
>>
>>  * Add FingerprintHash option to ssh(1) and sshd(8), and equivalent
>>    command-line flags to the other tools to control algorithm used
>>    for key fingerprints. The default changes from MD5 to SHA256 and
>>    format from hex to base64.
>>
>>    Fingerprints now have the hash algorithm prepended. An example of
>>    the new format: SHA256:mVPwvezndPv/ARoIadVY98vAC0g+P/5633yTC4d/wXE
>>    Please note that visual host keys will also be different.
>>
>>  * ssh(1), sshd(8): Host key rotation support. Add a protocol
>>    extension for a server to inform a client of all its available
>>    host keys after authentication has completed. The client may
>>    record the keys in known_hosts, allowing it to upgrade to better
>>    host key algorithms and a server to gracefully rotate its keys.
>>
>>    The client side of this is controlled by a UpdateHostkeys config
>>    option (default on).
>>
>>  * ssh(1): Add a ssh_config HostbasedKeyType option to control which
>>    host public key types are tried during host-based authentication.
>>
>>  * ssh(1), sshd(8): fix connection-killing host key mismatch errors
>>    when sshd offers multiple ECDSA keys of different lengths.
>>
>>  * ssh(1): when host name canonicalisation is enabled, try to
>>    parse host names as addresses before looking them up for
>>    canonicalisation. fixes bz#2074 and avoiding needless DNS
>>    lookups in some cases.
>>
>>  * ssh-keygen(1), sshd(8): Key Revocation Lists (KRLs) no longer
>>    require OpenSSH to be compiled with OpenSSL support.
>>
>>  * ssh(1), ssh-keysign(8): Make ed25519 keys work for host based
>>    authentication.
>>
>>  * sshd(8): SSH protocol v.1 workaround for the Meyer, et al,
>>    Bleichenbacher Side Channel Attack. Fake up a bignum key before
>>    RSA decryption.
>>
>>  * sshd(8): Remember which public keys have been used for
>>    authentication and refuse to accept previously-used keys.
>>    This allows AuthenticationMethods=publickey,publickey to require
>>    that users authenticate using two _different_ public keys.
>>
>>  * sshd(8): add sshd_config HostbasedAcceptedKeyTypes and
>>    PubkeyAcceptedKeyTypes options to allow sshd to control what
>>    public key types will be accepted. Currently defaults to all.
>>
>>  * sshd(8): Don't count partial authentication success as a failure
>>    against MaxAuthTries.
>>
>>  * ssh(1): Add RevokedHostKeys option for the client to allow
>>    text-file or KRL-based revocation of host keys.
>>
>>  * ssh-keygen(1), sshd(8): Permit KRLs that revoke certificates by
>>    serial number or key ID without scoping to a particular CA.
>>
>>  * ssh(1): Add a "Match canonical" criteria that allows ssh_config
>>    Match blocks to trigger only in the second config pass.
>>
>>  * ssh(1): Add a -G option to ssh that causes it to parse its
>>    configuration and dump the result to stdout, similar to "sshd -T".
>>
>>  * ssh(1): Allow Match criteria to be negated. E.g. "Match !host".
>>
>>  * The regression test suite has been extended to cover more OpenSSH
>>    features. The unit tests have been expanded and now cover key
>>    exchange.
>>
>> Bugfixes
>> --------
>>
>>  * ssh-keyscan(1): ssh-keyscan has been made much more robust again
>>    servers that hang or violate the SSH protocol.
>>
>>  * ssh(1), ssh-keygen(1): Fix regression bz#2306: Key path names were
>>    being lost as comment fields.
>>
>>  * ssh(1): Allow ssh_config Port options set in the second config
>>    parse phase to be applied (they were being ignored). bz#2286
>>
>>  * ssh(1): Tweak config re-parsing with host canonicalisation - make
>>    the second pass through the config files always run when host name
>>    canonicalisation is enabled (and not whenever the host name
>>    changes) bz#2267
>>
>>  * ssh(1): Fix passing of wildcard forward bind addresses when
>>    connection multiplexing is in use; bz#2324;
>>
>>  * ssh-keygen(1): Fix broken private key conversion from non-OpenSSH
>>    formats; bz#2345.
>>
>>  * ssh-keygen(1): Fix KRL generation bug when multiple CAs are in
>>    use.
>>
>>  * Various fixed to manual pages: bz#2288, bz#2316, bz#2273
>>
>> Portable OpenSSH
>> ----------------
>>
>>  * Support --without-openssl at configure time
>>
>>    Disables and removes dependency on OpenSSL. Many features,
>>    including SSH protocol 1 are not supported and the set of crypto
>>    options is greatly restricted. This will only work on system with
>>    native arc4random or /dev/urandom.
>>
>>    Considered highly experimental for now.
>>
>>  * Support --without-ssh1 option at configure time
>>
>>    Allows disabling support for SSH protocol 1.
>>
>>    Still experimental - not all regression and unit tests have been
>>    been adapted for the absence of SSH protocol 1.
>>
>>  * sshd(8): Fix compilation on systems with IPv6 support in utmpx; bz#2296
>>
>>  * Allow custom service name for sshd on Cygwin. Permits the use of
>>    multiple sshd running with different service names.
>>
>> Reporting Bugs:
>> ===============
>>
>> - Please read http://www.openssh.com/report.html
>>   Security bugs should be reported directly to openssh at openssh.com
>>
>> OpenSSH is brought to you by Markus Friedl, Niels Provos, Theo de Raadt,
>> Kevin Steves, Damien Miller, Darren Tucker, Jason McIntyre, Tim Rice and
>> Ben Lindstrom.
>>
>> _______________________________________________
>> openssh-unix-dev mailing list
>> openssh-unix-dev at mindrot.org
>> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
>>
>
>
>
> --
> # include <stddisclaimer.h>
> /* Kevin  Brott <Kevin.Brott at gmail.com> */
>
>


-- 
# include <stddisclaimer.h>
/* Kevin  Brott <Kevin.Brott at gmail.com> */

From djm at mindrot.org  Tue Feb 24 09:05:37 2015
From: djm at mindrot.org (Damien Miller)
Date: Tue, 24 Feb 2015 09:05:37 +1100 (AEDT)
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <54EB9A20.4080102@jupiterrise.com>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <54EB7DCE.5080708@jupiterrise.com>
 <alpine.BSO.2.11.1502240630420.4503@natsu.mindrot.org>
 <54EB9A20.4080102@jupiterrise.com>
Message-ID: <alpine.BSO.2.11.1502240905040.4503@natsu.mindrot.org>



On Mon, 23 Feb 2015, Tom G. Christensen wrote:

> On 23/02/15 20:31, Damien Miller wrote:
> > Thanks - I just committed a fix:
> > 
> <snip patch>
> 
> Thanks, unfortunately you missed the one in packet.h.
> 
> In file included from ssh_api.h:31:0,
>                  from ssh_api.c:21:
> packet.h:38:23: fatal error: sys/queue.h: No such file or directory
>  #include <sys/queue.h>
>                        ^
> compilation terminated.
> gmake: *** [ssh_api.o] Error 1
> 
> Fixing that I run into the missing sig_atomic_t that I see you posted a patch
> for earlier.
> 
> Next issue is unconditional include of <stdint.h> in xmalloc.c:
> xmalloc.c:19:20: error: stdint.h: No such file or directory
> 
> Solaris < 10 does not have stdint.h, it actually only fails on Solaris 2.6
> because it is limited to gcc 4.3.6 which does not provide a stdint.h
> replacement (this was introduced with gcc 4.4).

Thanks - I just committed fixes for both of these

-d

From djm at mindrot.org  Tue Feb 24 09:07:01 2015
From: djm at mindrot.org (Damien Miller)
Date: Tue, 24 Feb 2015 09:07:01 +1100 (AEDT)
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <CAMv58rbsbqi09fHygx6miXm0Ub9r_R=K1iMM3GbXMtEWOKq2QQ@mail.gmail.com>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <CAMv58rbsbqi09fHygx6miXm0Ub9r_R=K1iMM3GbXMtEWOKq2QQ@mail.gmail.com>
Message-ID: <alpine.BSO.2.11.1502240906180.4503@natsu.mindrot.org>

On Mon, 23 Feb 2015, Kevin Brott wrote:

> Stock - Debian GNU/Linux 7.8 (wheezy) - all tests passed
> 
> 
> build failure on:
>  * AIX 6.1 (6100-09-03-1415) IBM XL C/C++ Compiler (11.1.0.16)
>  * AIX 7.1 (7100-03-04-1441) IBM XL C/C++ Compiler (12.1.0.6)
> 
> ./configure && make tests
> 
> -DHAVE_CONFIG_H -c ssh_api.c -o ssh_api.o
> "ssh_api.c", line 143.19: 1506-068 (W) Operation between types "struct

The last lot of include fixes (sys/queue.h -> local sys-queue.h) should
fix this.

Thanks

-d

From kevin.brott at gmail.com  Tue Feb 24 09:27:52 2015
From: kevin.brott at gmail.com (Kevin Brott)
Date: Mon, 23 Feb 2015 14:27:52 -0800
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <alpine.BSO.2.11.1502240906180.4503@natsu.mindrot.org>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <CAMv58rbsbqi09fHygx6miXm0Ub9r_R=K1iMM3GbXMtEWOKq2QQ@mail.gmail.com>
 <alpine.BSO.2.11.1502240906180.4503@natsu.mindrot.org>
Message-ID: <CAMv58rbpyJ4B-Ekf-i4ChEaJNjGS21yQjE2XoOHUTKKEO_LtYg@mail.gmail.com>

Just as an FYI - the whole sys/queue.h issue is impacting HP-UX 11.23 and
11.31 as well - so we'll see how the latest fixes flush out.

And, not to play the fool overmuch - but is there a quick howto on how
you're expecting we get the git clone pulls into a buildable state?  When I
do my usual ...

$ aclocal && automake --gnu --add-missing && autoconf

I get this:

configure.ac: no proper invocation of AM_INIT_AUTOMAKE was found.
configure.ac: You should verify that configure.ac invokes AM_INIT_AUTOMAKE,
configure.ac: that aclocal.m4 is present in the top-level directory,
configure.ac: and that aclocal.m4 was recently regenerated (using aclocal).
automake: no `Makefile.am' found for any configure output


On Mon, Feb 23, 2015 at 2:07 PM, Damien Miller <djm at mindrot.org> wrote:

> On Mon, 23 Feb 2015, Kevin Brott wrote:
>
> > Stock - Debian GNU/Linux 7.8 (wheezy) - all tests passed
> >
> >
> > build failure on:
> >  * AIX 6.1 (6100-09-03-1415) IBM XL C/C++ Compiler (11.1.0.16)
> >  * AIX 7.1 (7100-03-04-1441) IBM XL C/C++ Compiler (12.1.0.6)
> >
> > ./configure && make tests
> >
> > -DHAVE_CONFIG_H -c ssh_api.c -o ssh_api.o
> > "ssh_api.c", line 143.19: 1506-068 (W) Operation between types "struct
>
> The last lot of include fixes (sys/queue.h -> local sys-queue.h) should
> fix this.
>
> Thanks
>
> -d
>



-- 
# include <stddisclaimer.h>
/* Kevin  Brott <Kevin.Brott at gmail.com> */

From djm at mindrot.org  Tue Feb 24 09:33:31 2015
From: djm at mindrot.org (Damien Miller)
Date: Tue, 24 Feb 2015 09:33:31 +1100 (AEDT)
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <CAMv58rbpyJ4B-Ekf-i4ChEaJNjGS21yQjE2XoOHUTKKEO_LtYg@mail.gmail.com>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <CAMv58rbsbqi09fHygx6miXm0Ub9r_R=K1iMM3GbXMtEWOKq2QQ@mail.gmail.com>
 <alpine.BSO.2.11.1502240906180.4503@natsu.mindrot.org>
 <CAMv58rbpyJ4B-Ekf-i4ChEaJNjGS21yQjE2XoOHUTKKEO_LtYg@mail.gmail.com>
Message-ID: <alpine.BSO.2.11.1502240933060.4503@natsu.mindrot.org>

On Mon, 23 Feb 2015, Kevin Brott wrote:

> 
> Just as an FYI - the whole sys/queue.h issue is impacting HP-UX 11.23 and
> 11.31 as well - so we'll see how the latest fixes flush out.
> 
> And, not to play the fool overmuch - but is there a quick howto on how
> you're expecting we get the git clone pulls into a buildable state?  When I
> do my usual ...
> 
> $ aclocal && automake --gnu --add-missing && autoconf

we don't use automake - I just run "autoreconf"

From dtucker at zip.com.au  Tue Feb 24 09:32:18 2015
From: dtucker at zip.com.au (Darren Tucker)
Date: Mon, 23 Feb 2015 17:32:18 -0500
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <CAMv58rbpyJ4B-Ekf-i4ChEaJNjGS21yQjE2XoOHUTKKEO_LtYg@mail.gmail.com>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <CAMv58rbsbqi09fHygx6miXm0Ub9r_R=K1iMM3GbXMtEWOKq2QQ@mail.gmail.com>
 <alpine.BSO.2.11.1502240906180.4503@natsu.mindrot.org>
 <CAMv58rbpyJ4B-Ekf-i4ChEaJNjGS21yQjE2XoOHUTKKEO_LtYg@mail.gmail.com>
Message-ID: <CALDDTe3nKxQo0Y+i0BTiJgQZnA7-4j1-yj=MpF0hgsGPkVZpZw@mail.gmail.com>

On Mon, Feb 23, 2015 at 5:27 PM, Kevin Brott <kevin.brott at gmail.com> wrote:

> Just as an FYI - the whole sys/queue.h issue is impacting HP-UX 11.23 and
> 11.31 as well - so we'll see how the latest fixes flush out.
>
> And, not to play the fool overmuch - but is there a quick howto on how
> you're expecting we get the git clone pulls into a buildable state?  When I
> do my usual ...
>
> $ aclocal && automake --gnu --add-missing && autoconf
>

All I normally do is "autoreconf".

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.

From tim at multitalents.net  Tue Feb 24 09:41:33 2015
From: tim at multitalents.net (Tim Rice)
Date: Mon, 23 Feb 2015 14:41:33 -0800 (PST)
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <alpine.BSO.2.11.1502240459330.4503@natsu.mindrot.org>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <Pine.GSO.4.64.1502231222540.23544@kraken.noc.utoronto.ca>
 <alpine.BSO.2.11.1502240459330.4503@natsu.mindrot.org>
Message-ID: <alpine.UW2.2.11.1502231439100.6216@server01.int.multitalents.net>

On Tue, 24 Feb 2015, Damien Miller wrote:

> > Have to manually edit 'config.h':
> > 
> > diff config.h.orig config.h
> > 783c783
> > < #define HAVE_MKDTEMP 1
> > ---
> > > /* #undef HAVE_MKDTEMP */
> > 
> > as Solaris does not have 'mkdtemp'.
> 
> That's strange - it's finding it somewhere. Could I ask you to rummage
> through config.log to see what it is detecting?

Actually it does have mkdtemp, it's in libc.
.....
tim(trr)@boomerang 1% who_defines mkdtemp
Searching /usr/lib/ld.so                                    nm: /usr/lib/ld.so:
invalid file type
/usr/lib/libc.so:       mkdtemp
/usr/lib/libc.so.1:     linked to /usr/lib/libc.so
/opt/lib/libgettextlib-0.17.so: mkdtemp
tim(trr)@boomerang 2% uname -a                              1
SunOS boomerang 5.10 Generic_148888-03 sun4u sparc SUNW,UltraAX-i2
tim(trr)@boomerang 3%
.....


-- 
Tim Rice				Multitalents
tim at multitalents.net



From kevin.brott at gmail.com  Tue Feb 24 09:54:22 2015
From: kevin.brott at gmail.com (Kevin Brott)
Date: Mon, 23 Feb 2015 14:54:22 -0800
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <CALDDTe3nKxQo0Y+i0BTiJgQZnA7-4j1-yj=MpF0hgsGPkVZpZw@mail.gmail.com>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <CAMv58rbsbqi09fHygx6miXm0Ub9r_R=K1iMM3GbXMtEWOKq2QQ@mail.gmail.com>
 <alpine.BSO.2.11.1502240906180.4503@natsu.mindrot.org>
 <CAMv58rbpyJ4B-Ekf-i4ChEaJNjGS21yQjE2XoOHUTKKEO_LtYg@mail.gmail.com>
 <CALDDTe3nKxQo0Y+i0BTiJgQZnA7-4j1-yj=MpF0hgsGPkVZpZw@mail.gmail.com>
Message-ID: <CAMv58rY8zCFCsyHkVWGObcgBOs=GFZewxfJ76bNgqJutAHmZ7w@mail.gmail.com>

Hrm - I'll have to run this on one of my linux boxxen and then schlep the
source over - the AIX/HP-UX boxenn have an older version of the autoconf
tools and autoreconf is broken/missing ...  and that seems to work.

Now the build fails here on AIX 6.1/7.1 ...

xlc_r -O2 -qarch=ppc -qalloca -I/usr/include -I/opt/freeware/include  -I.
-I. -O2 -qarch=ppc -qalloca -I/usr/include -I/opt/freeware/include
-DSSHDIR=\"/usr/local/etc\"  -D_PATH_SSH_PROGRAM=\"/usr/local/bin/ssh\"
 -D_PATH_SSH_ASKPASS_DEFAULT=\"/usr/local/libexec/ssh-askpass\"
 -D_PATH_SFTP_SERVER=\"/usr/local/libexec/sftp-server\"
 -D_PATH_SSH_KEY_SIGN=\"/usr/local/libexec/ssh-keysign\"
 -D_PATH_SSH_PKCS11_HELPER=\"/usr/local/libexec/ssh-pkcs11-helper\"
 -D_PATH_SSH_PIDDIR=\"/var/run\"  -D_PATH_PRIVSEP_CHROOT_DIR=\"/var/empty\"
-DHAVE_CONFIG_H -c nchan.c -o nchan.o
"/usr/include/sys/queue.h", line 103.9: 1506-236 (W) Macro name LIST_INIT
has been redefined.
"/usr/include/sys/queue.h", line 103.9: 1506-358 (I) "LIST_INIT" is defined
on line 287 of openbsd-compat/sys-queue.h.
"/usr/include/sys/queue.h", line 107.9: 1506-236 (W) Macro name
LIST_INSERT_AFTER has been redefined.
"/usr/include/sys/queue.h", line 107.9: 1506-358 (I) "LIST_INSERT_AFTER" is
defined on line 291 of openbsd-compat/sys-queue.h.
"/usr/include/sys/queue.h", line 115.9: 1506-236 (W) Macro name
LIST_INSERT_HEAD has been redefined.
"/usr/include/sys/queue.h", line 115.9: 1506-358 (I) "LIST_INSERT_HEAD" is
defined on line 306 of openbsd-compat/sys-queue.h.
"/usr/include/sys/queue.h", line 122.9: 1506-236 (W) Macro name LIST_REMOVE
has been redefined.
"/usr/include/sys/queue.h", line 122.9: 1506-358 (I) "LIST_REMOVE" is
defined on line 313 of openbsd-compat/sys-queue.h.
"/usr/include/sys/queue.h", line 147.9: 1506-236 (W) Macro name TAILQ_INIT
has been redefined.
"/usr/include/sys/queue.h", line 147.9: 1506-358 (I) "TAILQ_INIT" is
defined on line 462 of openbsd-compat/sys-queue.h.
"/usr/include/sys/queue.h", line 152.9: 1506-236 (W) Macro name
TAILQ_INSERT_HEAD has been redefined.
"/usr/include/sys/queue.h", line 152.9: 1506-358 (I) "TAILQ_INSERT_HEAD" is
defined on line 467 of openbsd-compat/sys-queue.h.
"/usr/include/sys/queue.h", line 162.9: 1506-236 (W) Macro name
TAILQ_INSERT_TAIL has been redefined.
"/usr/include/sys/queue.h", line 162.9: 1506-358 (I) "TAILQ_INSERT_TAIL" is
defined on line 477 of openbsd-compat/sys-queue.h.
"/usr/include/sys/queue.h", line 169.9: 1506-236 (W) Macro name
TAILQ_INSERT_AFTER has been redefined.
"/usr/include/sys/queue.h", line 169.9: 1506-358 (I) "TAILQ_INSERT_AFTER"
is defined on line 484 of openbsd-compat/sys-queue.h.
"/usr/include/sys/queue.h", line 179.9: 1506-236 (W) Macro name
TAILQ_INSERT_BEFORE has been redefined.
"/usr/include/sys/queue.h", line 179.9: 1506-358 (I) "TAILQ_INSERT_BEFORE"
is defined on line 494 of openbsd-compat/sys-queue.h.
"/usr/include/sys/queue.h", line 186.9: 1506-236 (W) Macro name
TAILQ_REMOVE has been redefined.
"/usr/include/sys/queue.h", line 186.9: 1506-358 (I) "TAILQ_REMOVE" is
defined on line 501 of openbsd-compat/sys-queue.h.
"/usr/include/sys/queue.h", line 213.9: 1506-236 (W) Macro name
CIRCLEQ_INIT has been redefined.
"/usr/include/sys/queue.h", line 213.9: 1506-358 (I) "CIRCLEQ_INIT" is
defined on line 578 of openbsd-compat/sys-queue.h.
"/usr/include/sys/queue.h", line 218.9: 1506-236 (W) Macro name
CIRCLEQ_INSERT_AFTER has been redefined.
"/usr/include/sys/queue.h", line 218.9: 1506-358 (I) "CIRCLEQ_INSERT_AFTER"
is defined on line 583 of openbsd-compat/sys-queue.h.
"/usr/include/sys/queue.h", line 228.9: 1506-236 (W) Macro name
CIRCLEQ_INSERT_BEFORE has been redefined.
"/usr/include/sys/queue.h", line 228.9: 1506-358 (I)
"CIRCLEQ_INSERT_BEFORE" is defined on line 593 of
openbsd-compat/sys-queue.h.
"/usr/include/sys/queue.h", line 238.9: 1506-236 (W) Macro name
CIRCLEQ_INSERT_HEAD has been redefined.
"/usr/include/sys/queue.h", line 238.9: 1506-358 (I) "CIRCLEQ_INSERT_HEAD"
is defined on line 603 of openbsd-compat/sys-queue.h.
"/usr/include/sys/queue.h", line 248.9: 1506-236 (W) Macro name
CIRCLEQ_INSERT_TAIL has been redefined.
"/usr/include/sys/queue.h", line 248.9: 1506-358 (I) "CIRCLEQ_INSERT_TAIL"
is defined on line 613 of openbsd-compat/sys-queue.h.
"/usr/include/sys/queue.h", line 258.9: 1506-236 (W) Macro name
CIRCLEQ_REMOVE has been redefined.
"/usr/include/sys/queue.h", line 258.9: 1506-358 (I) "CIRCLEQ_REMOVE" is
defined on line 623 of openbsd-compat/sys-queue.h.
        xlc_r -O2 -qarch=ppc -qalloca -I/usr/include
-I/opt/freeware/include  -I. -I. -O2 -qarch=ppc -qalloca -I/usr/include
-I/opt/freeware/include -DSSHDIR=\"/usr/local/etc\"
 -D_PATH_SSH_PROGRAM=\"/usr/local/bin/ssh\"
 -D_PATH_SSH_ASKPASS_DEFAULT=\"/usr/local/libexec/ssh-askpass\"
 -D_PATH_SFTP_SERVER=\"/usr/local/libexec/sftp-server\"
 -D_PATH_SSH_KEY_SIGN=\"/usr/local/libexec/ssh-keysign\"
 -D_PATH_SSH_PKCS11_HELPER=\"/usr/local/libexec/ssh-pkcs11-helper\"
 -D_PATH_SSH_PIDDIR=\"/var/run\"  -D_PATH_PRIVSEP_CHROOT_DIR=\"/var/empty\"
-DHAVE_CONFIG_H -c packet.c -o packet.o
"/usr/include/openssl/objects.h", line 1009.31: 1506-275 (S) Unexpected
text free_func encountered.
"/usr/include/sys/queue.h", line 103.9: 1506-236 (W) Macro name LIST_INIT
has been redefined.
"/usr/include/sys/queue.h", line 103.9: 1506-358 (I) "LIST_INIT" is defined
on line 287 of openbsd-compat/sys-queue.h.
"/usr/include/sys/queue.h", line 107.9: 1506-236 (W) Macro name
LIST_INSERT_AFTER has been redefined.
"/usr/include/sys/queue.h", line 107.9: 1506-358 (I) "LIST_INSERT_AFTER" is
defined on line 291 of openbsd-compat/sys-queue.h.
"/usr/include/sys/queue.h", line 115.9: 1506-236 (W) Macro name
LIST_INSERT_HEAD has been redefined.
"/usr/include/sys/queue.h", line 115.9: 1506-358 (I) "LIST_INSERT_HEAD" is
defined on line 306 of openbsd-compat/sys-queue.h.
"/usr/include/sys/queue.h", line 122.9: 1506-236 (W) Macro name LIST_REMOVE
has been redefined.
"/usr/include/sys/queue.h", line 122.9: 1506-358 (I) "LIST_REMOVE" is
defined on line 313 of openbsd-compat/sys-queue.h.
"/usr/include/sys/queue.h", line 147.9: 1506-236 (W) Macro name TAILQ_INIT
has been redefined.
"/usr/include/sys/queue.h", line 147.9: 1506-358 (I) "TAILQ_INIT" is
defined on line 462 of openbsd-compat/sys-queue.h.
"/usr/include/sys/queue.h", line 152.9: 1506-236 (W) Macro name
TAILQ_INSERT_HEAD has been redefined.
"/usr/include/sys/queue.h", line 152.9: 1506-358 (I) "TAILQ_INSERT_HEAD" is
defined on line 467 of openbsd-compat/sys-queue.h.
"/usr/include/sys/queue.h", line 162.9: 1506-236 (W) Macro name
TAILQ_INSERT_TAIL has been redefined.
"/usr/include/sys/queue.h", line 162.9: 1506-358 (I) "TAILQ_INSERT_TAIL" is
defined on line 477 of openbsd-compat/sys-queue.h.
"/usr/include/sys/queue.h", line 169.9: 1506-236 (W) Macro name
TAILQ_INSERT_AFTER has been redefined.
"/usr/include/sys/queue.h", line 169.9: 1506-358 (I) "TAILQ_INSERT_AFTER"
is defined on line 484 of openbsd-compat/sys-queue.h.
"/usr/include/sys/queue.h", line 179.9: 1506-236 (W) Macro name
TAILQ_INSERT_BEFORE has been redefined.
"/usr/include/sys/queue.h", line 179.9: 1506-358 (I) "TAILQ_INSERT_BEFORE"
is defined on line 494 of openbsd-compat/sys-queue.h.
"/usr/include/sys/queue.h", line 186.9: 1506-236 (W) Macro name
TAILQ_REMOVE has been redefined.
"/usr/include/sys/queue.h", line 186.9: 1506-358 (I) "TAILQ_REMOVE" is
defined on line 501 of openbsd-compat/sys-queue.h.
"/usr/include/sys/queue.h", line 213.9: 1506-236 (W) Macro name
CIRCLEQ_INIT has been redefined.
"/usr/include/sys/queue.h", line 213.9: 1506-358 (I) "CIRCLEQ_INIT" is
defined on line 578 of openbsd-compat/sys-queue.h.
"/usr/include/sys/queue.h", line 218.9: 1506-236 (W) Macro name
CIRCLEQ_INSERT_AFTER has been redefined.
"/usr/include/sys/queue.h", line 218.9: 1506-358 (I) "CIRCLEQ_INSERT_AFTER"
is defined on line 583 of openbsd-compat/sys-queue.h.
"/usr/include/sys/queue.h", line 228.9: 1506-236 (W) Macro name
CIRCLEQ_INSERT_BEFORE has been redefined.
"/usr/include/sys/queue.h", line 228.9: 1506-358 (I)
"CIRCLEQ_INSERT_BEFORE" is defined on line 593 of
openbsd-compat/sys-queue.h.
"/usr/include/sys/queue.h", line 238.9: 1506-236 (W) Macro name
CIRCLEQ_INSERT_HEAD has been redefined.
"/usr/include/sys/queue.h", line 238.9: 1506-358 (I) "CIRCLEQ_INSERT_HEAD"
is defined on line 603 of openbsd-compat/sys-queue.h.
"/usr/include/sys/queue.h", line 248.9: 1506-236 (W) Macro name
CIRCLEQ_INSERT_TAIL has been redefined.
"/usr/include/sys/queue.h", line 248.9: 1506-358 (I) "CIRCLEQ_INSERT_TAIL"
is defined on line 613 of openbsd-compat/sys-queue.h.
"/usr/include/sys/queue.h", line 258.9: 1506-236 (W) Macro name
CIRCLEQ_REMOVE has been redefined.
"/usr/include/sys/queue.h", line 258.9: 1506-358 (I) "CIRCLEQ_REMOVE" is
defined on line 623 of openbsd-compat/sys-queue.h.
make: 1254-004 The error code from the last command is 1.

On HP-UX 11.23 and 11.31 it fail here still:
...
        cc -O2 -Ae   -I. -I. -I/opt/phs/include -I/usr/include
-D_HPUX_SOURCE -D_XOPEN_SOURCE -D_XOPEN_SOURCE_EXTENDED=1
-DSSHDIR=\"/usr/local/etc\"  -D_PATH_SSH_PROGRAM=\"/usr/local/bin/ssh\"
 -D_PATH_SSH_ASKPASS_DEFAULT=\"/usr/local/libexec/ssh-askpass\"
 -D_PATH_SFTP_SERVER=\"/usr/local/libexec/sftp-server\"
 -D_PATH_SSH_KEY_SIGN=\"/usr/local/libexec/ssh-keysign\"
 -D_PATH_SSH_PKCS11_HELPER=\"/usr/local/libexec/ssh-pkcs11-helper\"
 -D_PATH_SSH_PIDDIR=\"/var/run\"  -D_PATH_PRIVSEP_CHROOT_DIR=\"/var/empty\"
-DHAVE_CONFIG_H -c ssh_api.c -o ssh_api.o
"packet.h", line 38: error #3696-D: cannot open source file "sys/queue.h"
  #include <sys/queue.h>
                       ^

1 error detected in the compilation of "ssh_api.c".
*** Error exit code 2



On Mon, Feb 23, 2015 at 2:32 PM, Darren Tucker <dtucker at zip.com.au> wrote:

> On Mon, Feb 23, 2015 at 5:27 PM, Kevin Brott <kevin.brott at gmail.com>
> wrote:
>
>> Just as an FYI - the whole sys/queue.h issue is impacting HP-UX 11.23 and
>> 11.31 as well - so we'll see how the latest fixes flush out.
>>
>> And, not to play the fool overmuch - but is there a quick howto on how
>> you're expecting we get the git clone pulls into a buildable state?  When
>> I
>> do my usual ...
>>
>> $ aclocal && automake --gnu --add-missing && autoconf
>>
>
> All I normally do is "autoreconf".
>
> --
> Darren Tucker (dtucker at zip.com.au)
> GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
>     Good judgement comes with experience. Unfortunately, the experience
> usually comes from bad judgement.
>



-- 
# include <stddisclaimer.h>
/* Kevin  Brott <Kevin.Brott at gmail.com> */

From calestyo at scientia.net  Tue Feb 24 10:02:10 2015
From: calestyo at scientia.net (Christoph Anton Mitterer)
Date: Tue, 24 Feb 2015 00:02:10 +0100
Subject: help with negative patterns in Match
Message-ID: <1424732530.4662.40.camel@scientia.net>

Hey.

Perhaps someone can help me with the following (OpenSSH 6.7):

I have a host reachable via miscellaneous interfaces (and network
addresses) running SSH.

Some specific users should be only reachable from the inside, so e.g.
though something like this would do the job in sshd_config:

#general config
#...

Match User foo LocalAddress 10.0.0.1,fe80:abba::0
        PasswordAuthentication          no
        KbdInteractiveAuthentication    no
        RhostsRSAAuthentication         no
        HostbasedAuthentication         no
        KerberosAuthentication          no
        GSSAPIAuthentication            no
        RSAAuthentication               no
        PubkeyAuthentication            yes

Match User foo LocalAddress !10.0.0.1,!fe80:abba::0
        PasswordAuthentication          no
        KbdInteractiveAuthentication    no
        RhostsRSAAuthentication         no
        HostbasedAuthentication         no
        KerberosAuthentication          no
        GSSAPIAuthentication            no
        RSAAuthentication               no
        PubkeyAuthentication            no


But apparently it never goes into the negative matching block :-(

Also, it seems that hostnames can generally not be used with
LocalAddress,.. is this expected? Cause that would be kinda nice.


Thanks,
Chris.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 5313 bytes
Desc: not available
URL: <http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20150224/ec0e9a19/attachment.bin>

From djm at mindrot.org  Tue Feb 24 10:12:22 2015
From: djm at mindrot.org (Damien Miller)
Date: Tue, 24 Feb 2015 10:12:22 +1100 (AEDT)
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <CAMv58rY8zCFCsyHkVWGObcgBOs=GFZewxfJ76bNgqJutAHmZ7w@mail.gmail.com>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <CAMv58rbsbqi09fHygx6miXm0Ub9r_R=K1iMM3GbXMtEWOKq2QQ@mail.gmail.com>
 <alpine.BSO.2.11.1502240906180.4503@natsu.mindrot.org>
 <CAMv58rbpyJ4B-Ekf-i4ChEaJNjGS21yQjE2XoOHUTKKEO_LtYg@mail.gmail.com>
 <CALDDTe3nKxQo0Y+i0BTiJgQZnA7-4j1-yj=MpF0hgsGPkVZpZw@mail.gmail.com>
 <CAMv58rY8zCFCsyHkVWGObcgBOs=GFZewxfJ76bNgqJutAHmZ7w@mail.gmail.com>
Message-ID: <alpine.BSO.2.11.1502241011030.4503@natsu.mindrot.org>

On Mon, 23 Feb 2015, Kevin Brott wrote:

> Hrm - I'll have to run this on one of my linux boxxen and then schlep the
> source over - the AIX/HP-UX boxenn have an older version of the autoconf
> tools and autoreconf is broken/missing ...  and that seems to work.
> 
> Now the build fails here on AIX 6.1/7.1 ...
> 
> xlc_r -O2 -qarch=ppc -qalloca -I/usr/include -I/opt/freeware/include  -I.
> -I. -O2 -qarch=ppc -qalloca -I/usr/include -I/opt/freeware/include
> -DSSHDIR=\"/usr/local/etc\"  -D_PATH_SSH_PROGRAM=\"/usr/local/bin/ssh\"
>  -D_PATH_SSH_ASKPASS_DEFAULT=\"/usr/local/libexec/ssh-askpass\"
>  -D_PATH_SFTP_SERVER=\"/usr/local/libexec/sftp-server\"
>  -D_PATH_SSH_KEY_SIGN=\"/usr/local/libexec/ssh-keysign\"
>  -D_PATH_SSH_PKCS11_HELPER=\"/usr/local/libexec/ssh-pkcs11-helper\"
>  -D_PATH_SSH_PIDDIR=\"/var/run\"  -D_PATH_PRIVSEP_CHROOT_DIR=\"/var/empty\"
> -DHAVE_CONFIG_H -c nchan.c -o nchan.o
> "/usr/include/sys/queue.h", line 103.9: 1506-236 (W) Macro name LIST_INIT
> has been redefined.
> "/usr/include/sys/queue.h", line 103.9: 1506-358 (I) "LIST_INIT" is defined
> on line 287 of openbsd-compat/sys-queue.h.

hm, are you sure you have pulled the latest source? AFAIK I have
fixed all the sys/queue.h inclusions. Maybe some system header is
pulling it too (if so, which?)

From djm at mindrot.org  Tue Feb 24 10:15:01 2015
From: djm at mindrot.org (Damien Miller)
Date: Tue, 24 Feb 2015 10:15:01 +1100 (AEDT)
Subject: help with negative patterns in Match
In-Reply-To: <1424732530.4662.40.camel@scientia.net>
References: <1424732530.4662.40.camel@scientia.net>
Message-ID: <alpine.BSO.2.11.1502241013070.4503@natsu.mindrot.org>

On Tue, 24 Feb 2015, Christoph Anton Mitterer wrote:

> Hey.
> 
> Perhaps someone can help me with the following (OpenSSH 6.7):
> 
> I have a host reachable via miscellaneous interfaces (and network
> addresses) running SSH.
> 
> Some specific users should be only reachable from the inside, so e.g.
> though something like this would do the job in sshd_config:
> 
> #general config
> #...
> 
> Match User foo LocalAddress 10.0.0.1,fe80:abba::0
>         PasswordAuthentication          no
>         KbdInteractiveAuthentication    no
>         RhostsRSAAuthentication         no
>         HostbasedAuthentication         no
>         KerberosAuthentication          no
>         GSSAPIAuthentication            no
>         RSAAuthentication               no
>         PubkeyAuthentication            yes
> 
> Match User foo LocalAddress !10.0.0.1,!fe80:abba::0

with HEAD you can do:

Match user foo !localaddress 10.0.0.1...

otherwise you need to have at least one matching term in the predicate, e.g.

Match User foo LocalAddress *,!10.0.0.1,!fe80:abba::0

> But apparently it never goes into the negative matching block :-(
> 
> Also, it seems that hostnames can generally not be used with
> LocalAddress,.. is this expected? Cause that would be kinda nice.

Yes, it's expected - we don't do DNS lookups there. I don't think we
want to either.

-d

From jamie.beverly at yahoo.com  Tue Feb 24 10:13:52 2015
From: jamie.beverly at yahoo.com (Jamie Beverly)
Date: Mon, 23 Feb 2015 23:13:52 +0000 (UTC)
Subject: Using confirmation of key usage per-host?
In-Reply-To: <54EB8767.2000601@taltos.org>
References: <54EB8767.2000601@taltos.org>
Message-ID: <1462457475.4790432.1424733232022.JavaMail.yahoo@mail.yahoo.com>

I have a script I've used over the years for precisely this kind of wizardry.?https://github.com/jbeverly/ssh_client_cmdline

The one example in bin does what CanonicalizeHostname basically does now; I don't have the agent flipping one up in git (perhaps I'll push it when I get home)
Figured I'd mention it in case it turned out to be handy.

 

     On Monday, February 23, 2015 12:50 PM, Carson Gaspar <carson at taltos.org> wrote:
   
 

 On 2/23/15 11:45 AM, Johannes Kastl wrote:
> Assume there is a workstation, which connects to multiple machines,
> one of which is considered potentially unsafe. So, it would be nice to
> have agent forwarding to that machine combined with the confirmation
> option of ssh-add (-c). If the 'forwarded key' is used on this
> machine, the user is prompted on the workstation. An intruder cannot
> use the authentication information without the user knowing (at least
> that is how I understood the idea of agent confirmation).
>
> Using ssh-add -c on the workstation together with setting
> 'ForwardAgent=yes' in the .ssh/config achieves the desired behaviour.
>
> Unfortunately, this means the user is asked for confirmation, each
> time the keys is used. Even if it is just to connect to a safe machine
> or without agent forwarding.
>
> Question:
> Is it possible to just get asked for confirmation, when the key is
> used on a machine, to which agent forwarding is used? Can this be set
> on a per-host-basis, like enabling/disabling agent forwarding in
> .ssh/config?

You'll need to run 2 agents if you want different agent behaviour. Sadly 
I don't know of any way to select which agent gets used in ssh_config - 
you'd also have to wrap ssh to flip the SSH_AUTH_SOCK env var.

-- 
Carson


_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev at mindrot.org
https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev


 
   

From kevin.brott at gmail.com  Tue Feb 24 11:17:37 2015
From: kevin.brott at gmail.com (Kevin Brott)
Date: Mon, 23 Feb 2015 16:17:37 -0800
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <alpine.BSO.2.11.1502241011030.4503@natsu.mindrot.org>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <CAMv58rbsbqi09fHygx6miXm0Ub9r_R=K1iMM3GbXMtEWOKq2QQ@mail.gmail.com>
 <alpine.BSO.2.11.1502240906180.4503@natsu.mindrot.org>
 <CAMv58rbpyJ4B-Ekf-i4ChEaJNjGS21yQjE2XoOHUTKKEO_LtYg@mail.gmail.com>
 <CALDDTe3nKxQo0Y+i0BTiJgQZnA7-4j1-yj=MpF0hgsGPkVZpZw@mail.gmail.com>
 <CAMv58rY8zCFCsyHkVWGObcgBOs=GFZewxfJ76bNgqJutAHmZ7w@mail.gmail.com>
 <alpine.BSO.2.11.1502241011030.4503@natsu.mindrot.org>
Message-ID: <CAMv58rboDB6hQ+E7T3ywVdT6aJ5WatF6Vfm66h+BfBvuP3jjdQ@mail.gmail.com>

Hrm - must have been a timing issue or my user error.  In any case, just
pulled the latest commits ...

*AIX 6.1/7.1 now fails here:*
*...*
        xlc_r -O2 -qarch=ppc -qalloca -I/usr/include
-I/opt/freeware/include  -I. -I. -O2 -qarch=ppc -qalloca -I/usr/include
-I/opt/freeware/include -DSSHDIR=\"/usr/local/etc\"
 -D_PATH_SSH_PROGRAM=\"/usr/local/bin/ssh\"
 -D_PATH_SSH_ASKPASS_DEFAULT=\"/usr/local/libexec/ssh-askpass\"
 -D_PATH_SFTP_SERVER=\"/usr/local/libexec/sftp-server\"
 -D_PATH_SSH_KEY_SIGN=\"/usr/local/libexec/ssh-keysign\"
 -D_PATH_SSH_PKCS11_HELPER=\"/usr/local/libexec/ssh-pkcs11-helper\"
 -D_PATH_SSH_PIDDIR=\"/var/run\"  -D_PATH_PRIVSEP_CHROOT_DIR=\"/var/empty\"
-DHAVE_CONFIG_H -c packet.c -o packet.o
"/usr/include/openssl/objects.h", line 1009.31: 1506-275 (S) Unexpected
text free_func encountered.
make: 1254-004 The error code from the last command is 1.

*HP-UX 11.23/11.31 fail here:*
*...*
cc -O2 -Ae   -I. -I. -I/opt/phs/include -I/opt/gnome/include -I/usr/include
-I/opt/gtk2.6/include -D_HPUX_SOURCE -D_XOPEN_SOURCE
-D_XOPEN_SOURCE_EXTENDED=1 -DSSHDIR=\"/usr/local/etc\"
-D_PATH_SSH_PROGRAM=\"/usr/local/bin/ssh\"
-D_PATH_SSH_ASKPASS_DEFAULT=\"/usr/local/libexec/ssh-askpass\"
-D_PATH_SFTP_SERVER=\"/usr/local/libexec/sftp-server\"
-D_PATH_SSH_KEY_SIGN=\"/usr/local/libexec/ssh-keysign\"
-D_PATH_SSH_PKCS11_HELPER=\"/usr/local/libexec/ssh-pkcs11-helper\"
-D_PATH_SSH_PIDDIR=\"/var/run\" -D_PATH_PRIVSEP_CHROOT_DIR=\"/var/empty\"
-DHAVE_CONFIG_H -c cipher-aesctr.c -o cipher-aesctr.o
"cipher-aesctr.c", line 30: warning #2260-D: explicit type is missing ("int"
          assumed)
  static __inline__ void
         ^

"cipher-aesctr.c", line 30: error #2065: expected a ";"
  static __inline__ void
                    ^

At end of source: warning #2012-D: parsing restarts here after previous
syntax
          error

1 error detected in the compilation of "cipher-aesctr.c".
make: *** [cipher-aesctr.o] Error 2


On Mon, Feb 23, 2015 at 3:12 PM, Damien Miller <djm at mindrot.org> wrote:

> On Mon, 23 Feb 2015, Kevin Brott wrote:
>
> > Hrm - I'll have to run this on one of my linux boxxen and then schlep the
> > source over - the AIX/HP-UX boxenn have an older version of the autoconf
> > tools and autoreconf is broken/missing ...  and that seems to work.
> >
> > Now the build fails here on AIX 6.1/7.1 ...
> >
> > xlc_r -O2 -qarch=ppc -qalloca -I/usr/include -I/opt/freeware/include  -I.
> > -I. -O2 -qarch=ppc -qalloca -I/usr/include -I/opt/freeware/include
> > -DSSHDIR=\"/usr/local/etc\"  -D_PATH_SSH_PROGRAM=\"/usr/local/bin/ssh\"
> >  -D_PATH_SSH_ASKPASS_DEFAULT=\"/usr/local/libexec/ssh-askpass\"
> >  -D_PATH_SFTP_SERVER=\"/usr/local/libexec/sftp-server\"
> >  -D_PATH_SSH_KEY_SIGN=\"/usr/local/libexec/ssh-keysign\"
> >  -D_PATH_SSH_PKCS11_HELPER=\"/usr/local/libexec/ssh-pkcs11-helper\"
> >  -D_PATH_SSH_PIDDIR=\"/var/run\"
> -D_PATH_PRIVSEP_CHROOT_DIR=\"/var/empty\"
> > -DHAVE_CONFIG_H -c nchan.c -o nchan.o
> > "/usr/include/sys/queue.h", line 103.9: 1506-236 (W) Macro name LIST_INIT
> > has been redefined.
> > "/usr/include/sys/queue.h", line 103.9: 1506-358 (I) "LIST_INIT" is
> defined
> > on line 287 of openbsd-compat/sys-queue.h.
>
> hm, are you sure you have pulled the latest source? AFAIK I have
> fixed all the sys/queue.h inclusions. Maybe some system header is
> pulling it too (if so, which?)
>



-- 
# include <stddisclaimer.h>
/* Kevin  Brott <Kevin.Brott at gmail.com> */

From dtucker at zip.com.au  Tue Feb 24 11:28:51 2015
From: dtucker at zip.com.au (Darren Tucker)
Date: Tue, 24 Feb 2015 11:28:51 +1100
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <CAMv58rboDB6hQ+E7T3ywVdT6aJ5WatF6Vfm66h+BfBvuP3jjdQ@mail.gmail.com>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <CAMv58rbsbqi09fHygx6miXm0Ub9r_R=K1iMM3GbXMtEWOKq2QQ@mail.gmail.com>
 <alpine.BSO.2.11.1502240906180.4503@natsu.mindrot.org>
 <CAMv58rbpyJ4B-Ekf-i4ChEaJNjGS21yQjE2XoOHUTKKEO_LtYg@mail.gmail.com>
 <CALDDTe3nKxQo0Y+i0BTiJgQZnA7-4j1-yj=MpF0hgsGPkVZpZw@mail.gmail.com>
 <CAMv58rY8zCFCsyHkVWGObcgBOs=GFZewxfJ76bNgqJutAHmZ7w@mail.gmail.com>
 <alpine.BSO.2.11.1502241011030.4503@natsu.mindrot.org>
 <CAMv58rboDB6hQ+E7T3ywVdT6aJ5WatF6Vfm66h+BfBvuP3jjdQ@mail.gmail.com>
Message-ID: <20150224002851.GA30328@gate.dtucker.net>

On Mon, Feb 23, 2015 at 04:17:37PM -0800, Kevin Brott wrote:
> Hrm - must have been a timing issue or my user error.  In any case, just
> pulled the latest commits ...
> 
> *AIX 6.1/7.1 now fails here:*
> *...*
>         xlc_r -O2 -qarch=ppc -qalloca -I/usr/include
> -I/opt/freeware/include  -I. -I. -O2 -qarch=ppc -qalloca -I/usr/include
> -I/opt/freeware/include -DSSHDIR=\"/usr/local/etc\"
>  -D_PATH_SSH_PROGRAM=\"/usr/local/bin/ssh\"
>  -D_PATH_SSH_ASKPASS_DEFAULT=\"/usr/local/libexec/ssh-askpass\"
>  -D_PATH_SFTP_SERVER=\"/usr/local/libexec/sftp-server\"
>  -D_PATH_SSH_KEY_SIGN=\"/usr/local/libexec/ssh-keysign\"
>  -D_PATH_SSH_PKCS11_HELPER=\"/usr/local/libexec/ssh-pkcs11-helper\"
>  -D_PATH_SSH_PIDDIR=\"/var/run\"  -D_PATH_PRIVSEP_CHROOT_DIR=\"/var/empty\"
> -DHAVE_CONFIG_H -c packet.c -o packet.o
> "/usr/include/openssl/objects.h", line 1009.31: 1506-275 (S) Unexpected
> text free_func encountered.
> make: 1254-004 The error code from the last command is 1.

I also ran into this on old GCCs.  It seems to be related to include
orders although I don't understand why.  On a hunch I tried this which
seems to fix it for me, but again I don't understand why...

Does it also help for you?

diff --git a/packet.c b/packet.c
index b1219c8..b15f02f 100644
--- a/packet.c
+++ b/packet.c
@@ -51,6 +51,8 @@
 #include <netinet/ip.h>
 #include <arpa/inet.h>
 
+#include <openssl/objects.h>
+
 #include <errno.h>
 #include <stdarg.h>
 #include <stdio.h>

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.

From tim at multitalents.net  Tue Feb 24 11:33:53 2015
From: tim at multitalents.net (Tim Rice)
Date: Mon, 23 Feb 2015 16:33:53 -0800 (PST)
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <alpine.BSO.2.11.1502240744060.4503@natsu.mindrot.org>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <CALDDTe3jsFfSsxSZT+UM1vkzKESjWmxD=2QWb_pCo=hKOK8a6w@mail.gmail.com>
 <20150223203615.28784.qmail@stuge.se>
 <alpine.BSO.2.11.1502240744060.4503@natsu.mindrot.org>
Message-ID: <alpine.UW2.2.11.1502231631350.6216@server01.int.multitalents.net>

On Tue, 24 Feb 2015, Damien Miller wrote:

> On Mon, 23 Feb 2015, Peter Stuge wrote:
> 
> > Darren Tucker wrote:
> > > Question is: what to do?
> > > c) make packet_disconnect a real function.
> > 
> > I say c.
> 
> yeah, stick it in opacket.c

packet_send_debug too.
.....
UX:acomp: ERROR: "/opt/src/networking/openssh/openssh/openbsd-compat/../opacket.
h", line 105: syntax error in macro parameters
UX:acomp: ERROR: "/opt/src/networking/openssh/openssh/openbsd-compat/../opacket.
h", line 107: syntax error in macro parameters
.....


-- 
Tim Rice				Multitalents
tim at multitalents.net



From kevin.brott at gmail.com  Tue Feb 24 11:41:33 2015
From: kevin.brott at gmail.com (Kevin Brott)
Date: Mon, 23 Feb 2015 16:41:33 -0800
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <20150224002851.GA30328@gate.dtucker.net>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <CAMv58rbsbqi09fHygx6miXm0Ub9r_R=K1iMM3GbXMtEWOKq2QQ@mail.gmail.com>
 <alpine.BSO.2.11.1502240906180.4503@natsu.mindrot.org>
 <CAMv58rbpyJ4B-Ekf-i4ChEaJNjGS21yQjE2XoOHUTKKEO_LtYg@mail.gmail.com>
 <CALDDTe3nKxQo0Y+i0BTiJgQZnA7-4j1-yj=MpF0hgsGPkVZpZw@mail.gmail.com>
 <CAMv58rY8zCFCsyHkVWGObcgBOs=GFZewxfJ76bNgqJutAHmZ7w@mail.gmail.com>
 <alpine.BSO.2.11.1502241011030.4503@natsu.mindrot.org>
 <CAMv58rboDB6hQ+E7T3ywVdT6aJ5WatF6Vfm66h+BfBvuP3jjdQ@mail.gmail.com>
 <20150224002851.GA30328@gate.dtucker.net>
Message-ID: <CAMv58rZX7W-+OL4PjN1bBH3ayeN8CiFBt=htwdWBK8ytc8vYHQ@mail.gmail.com>

Yup - that cleared that hurdle ... now it dies here on AIX:

        xlc_r -O2 -qarch=ppc -qalloca -I/usr/include
-I/opt/freeware/include  -I. -I. -O2 -qarch=ppc -qalloca -I/usr/include
-I/opt/freeware/include -DSSHDIR=\"/usr/local/etc\"
 -D_PATH_SSH_PROGRAM=\"/usr/local/bin/ssh\"
 -D_PATH_SSH_ASKPASS_DEFAULT=\"/usr/local/libexec/ssh-askpass\"
 -D_PATH_SFTP_SERVER=\"/usr/local/libexec/sftp-server\"
 -D_PATH_SSH_KEY_SIGN=\"/usr/local/libexec/ssh-keysign\"
 -D_PATH_SSH_PKCS11_HELPER=\"/usr/local/libexec/ssh-pkcs11-helper\"
 -D_PATH_SSH_PIDDIR=\"/var/run\"  -D_PATH_PRIVSEP_CHROOT_DIR=\"/var/empty\"
-DHAVE_CONFIG_H -o regress/netcat ./regress/netcat.c  -L. -Lopenbsd-compat/
-L/usr/lib -L/usr/ccs/lib -blibpath:/usr/lib:/lib -lssh -lopenbsd-compat
-lssh -lopenbsd-compat -lcrypto -lz -lpthread
"./regress/netcat.c", line 47.10: 1506-296 (S) #include file <err.h> not
found.
"./regress/netcat.c", line 1334.10: 1506-296 (S) #include file <err.h> not
found.
make: 1254-004 The error code from the last command is 1.

Is this looking for openssl's err.h or something else? if the former,
shouldn't this be <openssl/err.h>, if the latter - not on this OS.


On Mon, Feb 23, 2015 at 4:28 PM, Darren Tucker <dtucker at zip.com.au> wrote:

> On Mon, Feb 23, 2015 at 04:17:37PM -0800, Kevin Brott wrote:
> > Hrm - must have been a timing issue or my user error.  In any case, just
> > pulled the latest commits ...
> >
> > *AIX 6.1/7.1 now fails here:*
> > *...*
> >         xlc_r -O2 -qarch=ppc -qalloca -I/usr/include
> > -I/opt/freeware/include  -I. -I. -O2 -qarch=ppc -qalloca -I/usr/include
> > -I/opt/freeware/include -DSSHDIR=\"/usr/local/etc\"
> >  -D_PATH_SSH_PROGRAM=\"/usr/local/bin/ssh\"
> >  -D_PATH_SSH_ASKPASS_DEFAULT=\"/usr/local/libexec/ssh-askpass\"
> >  -D_PATH_SFTP_SERVER=\"/usr/local/libexec/sftp-server\"
> >  -D_PATH_SSH_KEY_SIGN=\"/usr/local/libexec/ssh-keysign\"
> >  -D_PATH_SSH_PKCS11_HELPER=\"/usr/local/libexec/ssh-pkcs11-helper\"
> >  -D_PATH_SSH_PIDDIR=\"/var/run\"
> -D_PATH_PRIVSEP_CHROOT_DIR=\"/var/empty\"
> > -DHAVE_CONFIG_H -c packet.c -o packet.o
> > "/usr/include/openssl/objects.h", line 1009.31: 1506-275 (S) Unexpected
> > text free_func encountered.
> > make: 1254-004 The error code from the last command is 1.
>
> I also ran into this on old GCCs.  It seems to be related to include
> orders although I don't understand why.  On a hunch I tried this which
> seems to fix it for me, but again I don't understand why...
>
> Does it also help for you?
>
> diff --git a/packet.c b/packet.c
> index b1219c8..b15f02f 100644
> --- a/packet.c
> +++ b/packet.c
> @@ -51,6 +51,8 @@
>  #include <netinet/ip.h>
>  #include <arpa/inet.h>
>
> +#include <openssl/objects.h>
> +
>  #include <errno.h>
>  #include <stdarg.h>
>  #include <stdio.h>
>
> --
> Darren Tucker (dtucker at zip.com.au)
> GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
>     Good judgement comes with experience. Unfortunately, the experience
> usually comes from bad judgement.
>



-- 
# include <stddisclaimer.h>
/* Kevin  Brott <Kevin.Brott at gmail.com> */

From djm at mindrot.org  Tue Feb 24 11:53:01 2015
From: djm at mindrot.org (Damien Miller)
Date: Tue, 24 Feb 2015 11:53:01 +1100 (AEDT)
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <CAMv58rZX7W-+OL4PjN1bBH3ayeN8CiFBt=htwdWBK8ytc8vYHQ@mail.gmail.com>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <CAMv58rbsbqi09fHygx6miXm0Ub9r_R=K1iMM3GbXMtEWOKq2QQ@mail.gmail.com>
 <alpine.BSO.2.11.1502240906180.4503@natsu.mindrot.org>
 <CAMv58rbpyJ4B-Ekf-i4ChEaJNjGS21yQjE2XoOHUTKKEO_LtYg@mail.gmail.com>
 <CALDDTe3nKxQo0Y+i0BTiJgQZnA7-4j1-yj=MpF0hgsGPkVZpZw@mail.gmail.com>
 <CAMv58rY8zCFCsyHkVWGObcgBOs=GFZewxfJ76bNgqJutAHmZ7w@mail.gmail.com>
 <alpine.BSO.2.11.1502241011030.4503@natsu.mindrot.org>
 <CAMv58rboDB6hQ+E7T3ywVdT6aJ5WatF6Vfm66h+BfBvuP3jjdQ@mail.gmail.com>
 <20150224002851.GA30328@gate.dtucker.net>
 <CAMv58rZX7W-+OL4PjN1bBH3ayeN8CiFBt=htwdWBK8ytc8vYHQ@mail.gmail.com>
Message-ID: <alpine.BSO.2.11.1502241142430.4503@natsu.mindrot.org>

On Mon, 23 Feb 2015, Kevin Brott wrote:

> 
> Yup - that cleared that hurdle ... now it dies here on AIX:
> 
>         xlc_r -O2 -qarch=ppc -qalloca -I/usr/include -I/opt/freeware/include
>  -I. -I. -O2 -qarch=ppc -qalloca -I/usr/include -I/opt/freeware/include
> -DSSHDIR=\"/usr/local/etc\"  -D_PATH_SSH_PROGRAM=\"/usr/local/bin/ssh\"
>  -D_PATH_SSH_ASKPASS_DEFAULT=\"/usr/local/libexec/ssh-askpass\"
>  -D_PATH_SFTP_SERVER=\"/usr/local/libexec/sftp-server\"
>  -D_PATH_SSH_KEY_SIGN=\"/usr/local/libexec/ssh-keysign\"
>  -D_PATH_SSH_PKCS11_HELPER=\"/usr/local/libexec/ssh-pkcs11-helper\"
>  -D_PATH_SSH_PIDDIR=\"/var/run\"  -D_PATH_PRIVSEP_CHROOT_DIR=\"/var/empty\"
> -DHAVE_CONFIG_H -o regress/netcat ./regress/netcat.c  -L. -Lopenbsd-compat/
> -L/usr/lib -L/usr/ccs/lib -blibpath:/usr/lib:/lib -lssh -lopenbsd-compat
> -lssh -lopenbsd-compat -lcrypto -lz -lpthread
> "./regress/netcat.c", line 47.10: 1506-296 (S) #include file <err.h> not
> found.
> "./regress/netcat.c", line 1334.10: 1506-296 (S) #include file <err.h> not
> found.
> make: 1254-004 The error code from the last command is 1.
> 
> Is this looking for openssl's err.h or something else? if the former,
> shouldn't this be <openssl/err.h>, if the latter - not on this OS.

This should fix it:

diff --git a/regress/netcat.c b/regress/netcat.c
index 84efe11..4b8c51c 100644
--- a/regress/netcat.c
+++ b/regress/netcat.c
@@ -44,7 +44,6 @@
 #include <netinet/ip.h>
 #include <arpa/telnet.h>
 
-#include <err.h>
 #include <errno.h>
 #include <netdb.h>
 #include <poll.h>
@@ -122,6 +121,47 @@ void	usage(int);
 ssize_t drainbuf(int, unsigned char *, size_t *);
 ssize_t fillbuf(int, unsigned char *, size_t *);
 
+static void err(int, const char *, ...) __attribute__((format(printf, 2, 3)));
+static void errx(int, const char *, ...) __attribute__((format(printf, 2, 3)));
+static void warn(const char *, ...) __attribute__((format(printf, 1, 2)));
+
+static void
+err(int r, const char *fmt, ...)
+{
+	va_list args;
+
+	va_start(args, fmt);
+	fprintf(stderr, "%s: ", strerror(errno));
+	vfprintf(stderr, fmt, args);
+	fputc('\n', stderr);
+	va_end(args);
+	exit(r);
+}
+
+static void
+errx(int r, const char *fmt, ...)
+{
+	va_list args;
+
+	va_start(args, fmt);
+	vfprintf(stderr, fmt, args);
+	fputc('\n', stderr);
+	va_end(args);
+	exit(r);
+}
+
+static void
+warn(const char *fmt, ...)
+{
+	va_list args;
+
+	va_start(args, fmt);
+	fprintf(stderr, "%s: ", strerror(errno));
+	vfprintf(stderr, fmt, args);
+	fputc('\n', stderr);
+	va_end(args);
+}
+
 int
 main(int argc, char *argv[])
 {


From dtucker at zip.com.au  Tue Feb 24 12:09:53 2015
From: dtucker at zip.com.au (Darren Tucker)
Date: Tue, 24 Feb 2015 12:09:53 +1100
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <alpine.UW2.2.11.1502231631350.6216@server01.int.multitalents.net>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <CALDDTe3jsFfSsxSZT+UM1vkzKESjWmxD=2QWb_pCo=hKOK8a6w@mail.gmail.com>
 <20150223203615.28784.qmail@stuge.se>
 <alpine.BSO.2.11.1502240744060.4503@natsu.mindrot.org>
 <alpine.UW2.2.11.1502231631350.6216@server01.int.multitalents.net>
Message-ID: <20150224010953.GB30328@gate.dtucker.net>

On Mon, Feb 23, 2015 at 04:33:53PM -0800, Tim Rice wrote:
> On Tue, 24 Feb 2015, Damien Miller wrote:
> 
> > On Mon, 23 Feb 2015, Peter Stuge wrote:
> > 
> > > Darren Tucker wrote:
> > > > Question is: what to do?
> > > > c) make packet_disconnect a real function.
> > > 
> > > I say c.
> > 
> > yeah, stick it in opacket.c
> 
> packet_send_debug too.

Yeah, ran in to that too.  OKs?

diff --git a/opacket.c b/opacket.c
index dd443c3..ba10085 100644
--- a/opacket.c
+++ b/opacket.c
@@ -319,3 +319,27 @@ packet_read_expect(int expected_type)
 	if ((r = ssh_packet_read_expect(active_state, expected_type)) != 0)
 		sshpkt_fatal(active_state, __func__, r);
 }
+
+void
+packet_disconnect(const char *fmt, ...)
+{
+	char buf[1024];
+	va_list args;
+
+	va_start(args, fmt);
+	vsnprintf(buf, sizeof(buf), fmt, args);
+	va_end(args);
+	ssh_packet_disconnect(active_state, "%s", buf);
+}
+
+void
+packet_send_debug(const char *fmt,...)
+{
+	char buf[1024];
+	va_list args;
+
+	va_start(args, fmt);
+	vsnprintf(buf, sizeof(buf), fmt, args);
+	va_end(args);
+	ssh_packet_send_debug(active_state, "%s", buf);
+}
diff --git a/opacket.h b/opacket.h
index 16fcb9e..3e4d75e 100644
--- a/opacket.h
+++ b/opacket.h
@@ -102,10 +102,12 @@ void	 packet_read_expect(int expected_type);
 	ssh_packet_get_string_ptr(active_state, (length_ptr))
 #define packet_get_cstring(length_ptr) \
 	ssh_packet_get_cstring(active_state, (length_ptr))
-#define packet_send_debug(fmt, args...) \
-	ssh_packet_send_debug(active_state, (fmt), ##args)
-#define packet_disconnect(fmt, args...) \
-	ssh_packet_disconnect(active_state, (fmt), ##args)
+void    packet_send_debug(const char *, ...)
+        __attribute__((format(printf, 1, 2)))
+        __attribute__((noreturn));
+void    packet_disconnect(const char *, ...)
+        __attribute__((format(printf, 1, 2)))
+        __attribute__((noreturn));
 #define packet_have_data_to_write() \
 	ssh_packet_have_data_to_write(active_state)
 #define packet_not_very_much_data_to_write() \

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.

From calestyo at scientia.net  Tue Feb 24 12:28:25 2015
From: calestyo at scientia.net (Christoph Anton Mitterer)
Date: Tue, 24 Feb 2015 02:28:25 +0100
Subject: help with negative patterns in Match
In-Reply-To: <alpine.BSO.2.11.1502241013070.4503@natsu.mindrot.org>
References: <1424732530.4662.40.camel@scientia.net>
 <alpine.BSO.2.11.1502241013070.4503@natsu.mindrot.org>
Message-ID: <1424741305.4662.46.camel@scientia.net>

On Tue, 2015-02-24 at 10:15 +1100, Damien Miller wrote: 
> otherwise you need to have at least one matching term in the predicate, e.g.
> Match User foo LocalAddress *,!10.0.0.1,!fe80:abba::0
Ah,.. great :) Thanks a lot, that did the trick.


> > Also, it seems that hostnames can generally not be used with
> > LocalAddress,.. is this expected? Cause that would be kinda nice.
Well the nice part about that would be that one can use a hostname,
which is e.g. set in /etc/hosts something like:
1.2.3.4  eth0.localhost
and use that in the ListenAddress and e.g. Match patterns.

Now when the host moves to another address, all one has to do is
exchange one entry in /etc/hosts, instead of many in other places =)


Cheers,
Chris. 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 5313 bytes
Desc: not available
URL: <http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20150224/b861ef79/attachment-0001.bin>

From dtucker at zip.com.au  Tue Feb 24 13:23:59 2015
From: dtucker at zip.com.au (Darren Tucker)
Date: Tue, 24 Feb 2015 13:23:59 +1100
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
Message-ID: <20150224022359.GA1419@gate.dtucker.net>

Next thing I ran into: fake-rfc2553 doesn't have AI_NUMERICSERV.

By my read it never attempts to return a non-numeric service so I think
all that's need is this.  OK?

diff --git a/openbsd-compat/fake-rfc2553.h b/openbsd-compat/fake-rfc2553.h
index 3e9090f..6426f7b 100644
--- a/openbsd-compat/fake-rfc2553.h
+++ b/openbsd-compat/fake-rfc2553.h
@@ -109,6 +109,9 @@ struct sockaddr_in6 {
 #ifndef AI_NUMERICHOST
 # define AI_NUMERICHOST		(1<<2)
 #endif
+#ifndef AI_NUMERICSERV
+# define AI_NUMERICSERV		(1<<3)
+#endif
 
 #ifndef NI_MAXSERV
 # define NI_MAXSERV 32

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.

From djm at mindrot.org  Tue Feb 24 13:39:49 2015
From: djm at mindrot.org (Damien Miller)
Date: Tue, 24 Feb 2015 13:39:49 +1100 (AEDT)
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <20150224022359.GA1419@gate.dtucker.net>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <20150224022359.GA1419@gate.dtucker.net>
Message-ID: <alpine.BSO.2.11.1502241338280.4503@natsu.mindrot.org>



On Tue, 24 Feb 2015, Darren Tucker wrote:

> Next thing I ran into: fake-rfc2553 doesn't have AI_NUMERICSERV.
> 
> By my read it never attempts to return a non-numeric service so I think
> all that's need is this.  OK?

well, getnameinfo always returns a numeric service name but AI_NUMERICSERV
is for getaddrinfo.

fortunately, we deal with this case too; getaddrinfo tries to parse the
port numerically before getservbyname

ok djm

> diff --git a/openbsd-compat/fake-rfc2553.h b/openbsd-compat/fake-rfc2553.h
> index 3e9090f..6426f7b 100644
> --- a/openbsd-compat/fake-rfc2553.h
> +++ b/openbsd-compat/fake-rfc2553.h
> @@ -109,6 +109,9 @@ struct sockaddr_in6 {
>  #ifndef AI_NUMERICHOST
>  # define AI_NUMERICHOST		(1<<2)
>  #endif
> +#ifndef AI_NUMERICSERV
> +# define AI_NUMERICSERV		(1<<3)
> +#endif
>  
>  #ifndef NI_MAXSERV
>  # define NI_MAXSERV 32
> 
> -- 
> Darren Tucker (dtucker at zip.com.au)
> GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
>     Good judgement comes with experience. Unfortunately, the experience
> usually comes from bad judgement.
> 

From tim at multitalents.net  Tue Feb 24 17:52:46 2015
From: tim at multitalents.net (Tim Rice)
Date: Mon, 23 Feb 2015 22:52:46 -0800 (PST)
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <alpine.BSO.2.11.1502241142430.4503@natsu.mindrot.org>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <CAMv58rbsbqi09fHygx6miXm0Ub9r_R=K1iMM3GbXMtEWOKq2QQ@mail.gmail.com>
 <alpine.BSO.2.11.1502240906180.4503@natsu.mindrot.org>
 <CAMv58rbpyJ4B-Ekf-i4ChEaJNjGS21yQjE2XoOHUTKKEO_LtYg@mail.gmail.com>
 <CALDDTe3nKxQo0Y+i0BTiJgQZnA7-4j1-yj=MpF0hgsGPkVZpZw@mail.gmail.com>
 <CAMv58rY8zCFCsyHkVWGObcgBOs=GFZewxfJ76bNgqJutAHmZ7w@mail.gmail.com>
 <alpine.BSO.2.11.1502241011030.4503@natsu.mindrot.org>
 <CAMv58rboDB6hQ+E7T3ywVdT6aJ5WatF6Vfm66h+BfBvuP3jjdQ@mail.gmail.com>
 <20150224002851.GA30328@gate.dtucker.net>
 <CAMv58rZX7W-+OL4PjN1bBH3ayeN8CiFBt=htwdWBK8ytc8vYHQ@mail.gmail.com>
 <alpine.BSO.2.11.1502241142430.4503@natsu.mindrot.org>
Message-ID: <alpine.UW2.2.11.1502232246010.2321@server01.int.multitalents.net>

On Tue, 24 Feb 2015, Damien Miller wrote:

| On Mon, 23 Feb 2015, Kevin Brott wrote:
| 
| > 
| > Yup - that cleared that hurdle ... now it dies here on AIX:
| > 
| >         xlc_r -O2 -qarch=ppc -qalloca -I/usr/include -I/opt/freeware/include
| >  -I. -I. -O2 -qarch=ppc -qalloca -I/usr/include -I/opt/freeware/include
| > -DSSHDIR=\"/usr/local/etc\"  -D_PATH_SSH_PROGRAM=\"/usr/local/bin/ssh\"
| >  -D_PATH_SSH_ASKPASS_DEFAULT=\"/usr/local/libexec/ssh-askpass\"
| >  -D_PATH_SFTP_SERVER=\"/usr/local/libexec/sftp-server\"
| >  -D_PATH_SSH_KEY_SIGN=\"/usr/local/libexec/ssh-keysign\"
| >  -D_PATH_SSH_PKCS11_HELPER=\"/usr/local/libexec/ssh-pkcs11-helper\"
| >  -D_PATH_SSH_PIDDIR=\"/var/run\"  -D_PATH_PRIVSEP_CHROOT_DIR=\"/var/empty\"
| > -DHAVE_CONFIG_H -o regress/netcat ./regress/netcat.c  -L. -Lopenbsd-compat/
| > -L/usr/lib -L/usr/ccs/lib -blibpath:/usr/lib:/lib -lssh -lopenbsd-compat
| > -lssh -lopenbsd-compat -lcrypto -lz -lpthread
| > "./regress/netcat.c", line 47.10: 1506-296 (S) #include file <err.h> not
| > found.
| > "./regress/netcat.c", line 1334.10: 1506-296 (S) #include file <err.h> not
| > found.
| > make: 1254-004 The error code from the last command is 1.
| > 
| > Is this looking for openssl's err.h or something else? if the former,
| > shouldn't this be <openssl/err.h>, if the latter - not on this OS.
| 
| This should fix it:
| 
| diff --git a/regress/netcat.c b/regress/netcat.c
[snip patch]

A good start. There was a err.h further down. And Solaris 10 had
a name space clash. This gets us closer but we still need to deal with
SVR4 msghdr structure differences. That needs more time than I have tonight.

........
--- regress/netcat.c.old	2015-02-20 08:54:09.406208844 -0800
+++ regress/netcat.c	2015-02-23 22:35:38.154211574 -0800
@@ -44,7 +44,6 @@
 #include <netinet/ip.h>
 #include <arpa/telnet.h>
 
-#include <err.h>
 #include <errno.h>
 #include <netdb.h>
 #include <poll.h>
@@ -122,6 +121,47 @@
 ssize_t drainbuf(int, unsigned char *, size_t *);
 ssize_t fillbuf(int, unsigned char *, size_t *);
 
+static void err(int, const char *, ...) __attribute__((format(printf, 2, 3)));
+static void errx(int, const char *, ...) __attribute__((format(printf, 2, 3)));
+static void warn(const char *, ...) __attribute__((format(printf, 1, 2)));
+
+static void
+err(int r, const char *fmt, ...)
+{
+	va_list args;
+
+	va_start(args, fmt);
+	fprintf(stderr, "%s: ", strerror(errno));
+	vfprintf(stderr, fmt, args);
+	fputc('\n', stderr);
+	va_end(args);
+	exit(r);
+}
+
+static void
+errx(int r, const char *fmt, ...)
+{
+	va_list args;
+
+	va_start(args, fmt);
+	vfprintf(stderr, fmt, args);
+	fputc('\n', stderr);
+	va_end(args);
+	exit(r);
+}
+
+static void
+warn(const char *fmt, ...)
+{
+	va_list args;
+
+	va_start(args, fmt);
+	fprintf(stderr, "%s: ", strerror(errno));
+	vfprintf(stderr, fmt, args);
+	fputc('\n', stderr);
+	va_end(args);
+}
+
 int
 main(int argc, char *argv[])
 {
@@ -500,7 +540,7 @@
 int
 unix_bind(char *path)
 {
-	struct sockaddr_un sun;
+	struct sockaddr_un sun_sa;
 	int s;
 
 	/* Create unix domain socket. */
@@ -508,17 +548,17 @@
 	     0)) < 0)
 		return (-1);
 
-	memset(&sun, 0, sizeof(struct sockaddr_un));
-	sun.sun_family = AF_UNIX;
+	memset(&sun_sa, 0, sizeof(struct sockaddr_un));
+	sun_sa.sun_family = AF_UNIX;
 
-	if (strlcpy(sun.sun_path, path, sizeof(sun.sun_path)) >=
-	    sizeof(sun.sun_path)) {
+	if (strlcpy(sun_sa.sun_path, path, sizeof(sun_sa.sun_path)) >=
+	    sizeof(sun_sa.sun_path)) {
 		close(s);
 		errno = ENAMETOOLONG;
 		return (-1);
 	}
 
-	if (bind(s, (struct sockaddr *)&sun, SUN_LEN(&sun)) < 0) {
+	if (bind(s, (struct sockaddr *)&sun_sa, SUN_LEN(&sun_sa)) < 0) {
 		close(s);
 		return (-1);
 	}
@@ -532,7 +572,7 @@
 int
 unix_connect(char *path)
 {
-	struct sockaddr_un sun;
+	struct sockaddr_un sun_sa;
 	int s;
 
 	if (uflag) {
@@ -544,16 +584,16 @@
 	}
 	(void)fcntl(s, F_SETFD, FD_CLOEXEC);
 
-	memset(&sun, 0, sizeof(struct sockaddr_un));
-	sun.sun_family = AF_UNIX;
+	memset(&sun_sa, 0, sizeof(struct sockaddr_un));
+	sun_sa.sun_family = AF_UNIX;
 
-	if (strlcpy(sun.sun_path, path, sizeof(sun.sun_path)) >=
-	    sizeof(sun.sun_path)) {
+	if (strlcpy(sun_sa.sun_path, path, sizeof(sun_sa.sun_path)) >=
+	    sizeof(sun_sa.sun_path)) {
 		close(s);
 		errno = ENAMETOOLONG;
 		return (-1);
 	}
-	if (connect(s, (struct sockaddr *)&sun, SUN_LEN(&sun)) < 0) {
+	if (connect(s, (struct sockaddr *)&sun_sa, SUN_LEN(&sun_sa)) < 0) {
 		close(s);
 		return (-1);
 	}
@@ -1331,7 +1371,6 @@
 #include <netinet/in.h>
 #include <arpa/inet.h>
 
-#include <err.h>
 #include <errno.h>
 #include <netdb.h>
 #include <stdio.h>
........
 

-- 
Tim Rice				Multitalents
tim at multitalents.net



From jjelen at redhat.com  Tue Feb 24 23:16:34 2015
From: jjelen at redhat.com (Jakub Jelen)
Date: Tue, 24 Feb 2015 13:16:34 +0100
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
Message-ID: <54EC6BA2.80902@redhat.com>


On 02/19/2015 11:21 PM, Damien Miller wrote:
> Hi,
>
> OpenSSH 6.8 is almost ready for release, so we would appreciate testing
> on as many platforms and systems as possible. This release contains
> some substantial new features and a number of bugfixes.
Tested openssh-SNAP-20150224 on current Fedora with GCC5 on x86_64. 
Builds fine, test passes.
Also tested on Fedora on aarch64 with same results.

Jakub

From djm at mindrot.org  Wed Feb 25 01:10:29 2015
From: djm at mindrot.org (Damien Miller)
Date: Wed, 25 Feb 2015 01:10:29 +1100 (AEDT)
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <alpine.UW2.2.11.1502232246010.2321@server01.int.multitalents.net>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <CAMv58rbsbqi09fHygx6miXm0Ub9r_R=K1iMM3GbXMtEWOKq2QQ@mail.gmail.com>
 <alpine.BSO.2.11.1502240906180.4503@natsu.mindrot.org>
 <CAMv58rbpyJ4B-Ekf-i4ChEaJNjGS21yQjE2XoOHUTKKEO_LtYg@mail.gmail.com>
 <CALDDTe3nKxQo0Y+i0BTiJgQZnA7-4j1-yj=MpF0hgsGPkVZpZw@mail.gmail.com>
 <CAMv58rY8zCFCsyHkVWGObcgBOs=GFZewxfJ76bNgqJutAHmZ7w@mail.gmail.com>
 <alpine.BSO.2.11.1502241011030.4503@natsu.mindrot.org>
 <CAMv58rboDB6hQ+E7T3ywVdT6aJ5WatF6Vfm66h+BfBvuP3jjdQ@mail.gmail.com>
 <20150224002851.GA30328@gate.dtucker.net>
 <CAMv58rZX7W-+OL4PjN1bBH3ayeN8CiFBt=htwdWBK8ytc8vYHQ@mail.gmail.com>
 <alpine.BSO.2.11.1502241142430.4503@natsu.mindrot.org>
 <alpine.UW2.2.11.1502232246010.2321@server01.int.multitalents.net>
Message-ID: <alpine.BSO.2.11.1502250110040.8118@natsu.mindrot.org>

On Mon, 23 Feb 2015, Tim Rice wrote:

> | This should fix it:
> | 
> | diff --git a/regress/netcat.c b/regress/netcat.c
> [snip patch]
> 
> A good start. There was a err.h further down. And Solaris 10 had
> a name space clash. This gets us closer but we still need to deal with
> SVR4 msghdr structure differences. That needs more time than I have tonight.
> 
> ........
> --- regress/netcat.c.old	2015-02-20 08:54:09.406208844 -0800
> +++ regress/netcat.c	2015-02-23 22:35:38.154211574 -0800
[...]

ok djm

From kevin.brott at gmail.com  Wed Feb 25 03:16:16 2015
From: kevin.brott at gmail.com (Kevin Brott)
Date: Tue, 24 Feb 2015 08:16:16 -0800
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <alpine.BSO.2.11.1502241142430.4503@natsu.mindrot.org>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <CAMv58rbsbqi09fHygx6miXm0Ub9r_R=K1iMM3GbXMtEWOKq2QQ@mail.gmail.com>
 <alpine.BSO.2.11.1502240906180.4503@natsu.mindrot.org>
 <CAMv58rbpyJ4B-Ekf-i4ChEaJNjGS21yQjE2XoOHUTKKEO_LtYg@mail.gmail.com>
 <CALDDTe3nKxQo0Y+i0BTiJgQZnA7-4j1-yj=MpF0hgsGPkVZpZw@mail.gmail.com>
 <CAMv58rY8zCFCsyHkVWGObcgBOs=GFZewxfJ76bNgqJutAHmZ7w@mail.gmail.com>
 <alpine.BSO.2.11.1502241011030.4503@natsu.mindrot.org>
 <CAMv58rboDB6hQ+E7T3ywVdT6aJ5WatF6Vfm66h+BfBvuP3jjdQ@mail.gmail.com>
 <20150224002851.GA30328@gate.dtucker.net>
 <CAMv58rZX7W-+OL4PjN1bBH3ayeN8CiFBt=htwdWBK8ytc8vYHQ@mail.gmail.com>
 <alpine.BSO.2.11.1502241142430.4503@natsu.mindrot.org>
Message-ID: <CAMv58raAhECLVz0qMEJ9J7XRkL6nZYiv2ynQD+Mx9CSrv5jgJw@mail.gmail.com>

On Mon, Feb 23, 2015 at 4:53 PM, Damien Miller <djm at mindrot.org> wrote:

>
> This should fix it:
>
> diff --git a/regress/netcat.c b/regress/netcat.c
> index 84efe11..4b8c51c 100644
> --- a/regress/netcat.c
> +++ b/regress/netcat.c
> [
> sniip]
>
>

This patch applies cleanly against 
openssh-SNAP-20150225.tar.gz
 and once I remove the other err.h refreence as noted later (that patch
doesn't apply more than the first two chunks), the build on AIX gets to
here before it explodes:


xlc_r -O2 -qarch=ppc -qalloca -I/usr/include -I/opt/freeware/include  -I.
-I. -O2 -qarch=ppc -qalloca -I/usr/include -I/opt/freeware/include
-DSSHDIR=\"/usr/local/etc\"  -D_PATH_SSH_PROGRAM=\"/usr/local/bin/ssh\"
-D_PATH_SSH_ASKPASS_DEFAULT=\"/usr/local/libexec/ssh-askpass\"
-D_PATH_SFTP_SERVER=\"/usr/local/libexec/sftp-server\"
-D_PATH_SSH_KEY_SIGN=\"/usr/local/libexec/ssh-keysign\"
-D_PATH_SSH_PKCS11_HELPER=\"/usr/local/libexec/ssh-pkcs11-helper\"
-D_PATH_SSH_PIDDIR=\"/var/run\"  -D_PATH_PRIVSEP_CHROOT_DIR=\"/var/empty\"
-DHAVE_CONFIG_H -c regress/unittests/bitmap/tests.c -o
regress/unittests/bitmap/tests.o
"/usr/include/sys/mman.h", line 148.25: 1506-343 (S) Redeclaration of
mmap64 differs from previous declaration on line 143 of
"/usr/include/sys/mman.h".
"/usr/include/sys/mman.h", line 148.25: 1506-377 (I) The type "long long"
of parameter 6 differs from the previous type "long".
make: 1254-004 The error code from the last command is 1.

From tgc at jupiterrise.com  Wed Feb 25 03:44:04 2015
From: tgc at jupiterrise.com (Tom G. Christensen)
Date: Tue, 24 Feb 2015 17:44:04 +0100
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <alpine.BSO.2.11.1502240905040.4503@natsu.mindrot.org>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <54EB7DCE.5080708@jupiterrise.com>
 <alpine.BSO.2.11.1502240630420.4503@natsu.mindrot.org>
 <54EB9A20.4080102@jupiterrise.com>
 <alpine.BSO.2.11.1502240905040.4503@natsu.mindrot.org>
Message-ID: <54ECAA54.7020504@jupiterrise.com>

On 23/02/15 23:05, Damien Miller wrote:
> Thanks - I just committed fixes for both of these
>

Thank you.

I've switched to HEAD in the git repo and it now builds on Solaris 2.6, 
7, 8 and 9 but the testsuite still cannot be built due to the missing 
<err.h>.

I noticed one of the changes was about HOST_NAME_MAX but I don't think 
that change addresses the real issue on at least these old Solaris systems.
It looks to me like the fall back in defines.h was not activated because 
Solaris has MAXHOSTNAMELEN in <netdb.h> which has not been included when 
defines.h tries to find a fall back HOST_NAME_MAX.
Looking at sshd.c with gcc -dD -E confirms it as defines.h now set 
HOST_NAME_MAX to 255 and later <netdb.h> is included which then defines 
MAXHOSTNAMELEN to 256.
I don't know if it would be reasonable to include <netdb.h> from 
includes.h but that would make HOST_NAME_MAX fall back to MAXHOSTNAMELEN 
on at least Solaris < 10.

-tgc


From djm at mindrot.org  Wed Feb 25 03:50:07 2015
From: djm at mindrot.org (Damien Miller)
Date: Wed, 25 Feb 2015 03:50:07 +1100 (AEDT)
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <CAMv58raAhECLVz0qMEJ9J7XRkL6nZYiv2ynQD+Mx9CSrv5jgJw@mail.gmail.com>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <CAMv58rbsbqi09fHygx6miXm0Ub9r_R=K1iMM3GbXMtEWOKq2QQ@mail.gmail.com>
 <alpine.BSO.2.11.1502240906180.4503@natsu.mindrot.org>
 <CAMv58rbpyJ4B-Ekf-i4ChEaJNjGS21yQjE2XoOHUTKKEO_LtYg@mail.gmail.com>
 <CALDDTe3nKxQo0Y+i0BTiJgQZnA7-4j1-yj=MpF0hgsGPkVZpZw@mail.gmail.com>
 <CAMv58rY8zCFCsyHkVWGObcgBOs=GFZewxfJ76bNgqJutAHmZ7w@mail.gmail.com>
 <alpine.BSO.2.11.1502241011030.4503@natsu.mindrot.org>
 <CAMv58rboDB6hQ+E7T3ywVdT6aJ5WatF6Vfm66h+BfBvuP3jjdQ@mail.gmail.com>
 <20150224002851.GA30328@gate.dtucker.net>
 <CAMv58rZX7W-+OL4PjN1bBH3ayeN8CiFBt=htwdWBK8ytc8vYHQ@mail.gmail.com>
 <alpine.BSO.2.11.1502241142430.4503@natsu.mindrot.org>
 <CAMv58raAhECLVz0qMEJ9J7XRkL6nZYiv2ynQD+Mx9CSrv5jgJw@mail.gmail.com>
Message-ID: <alpine.BSO.2.11.1502250349420.19907@natsu.mindrot.org>

On Tue, 24 Feb 2015, Kevin Brott wrote:

> 
> On Mon, Feb 23, 2015 at 4:53 PM, Damien Miller <djm at mindrot.org> wrote:
> 
>       This should fix it:
> 
>       diff --git a/regress/netcat.c b/regress/netcat.c
>       index 84efe11..4b8c51c 100644
>       --- a/regress/netcat.c
>       +++ b/regress/netcat.c
>       [sniip]
> 
> 
> 
> This patch applies cleanly against
> openssh-SNAP-20150225.tar.gz and once I remove the other err.h refreence as
> noted later (that patch doesn't apply more than the first two chunks), the
> build on AIX gets to here before it explodes:
> 
> xlc_r -O2 -qarch=ppc -qalloca -I/usr/include -I/opt/freeware/include  -I.
> -I. -O2 -qarch=ppc -qalloca -I/usr/include -I/opt/freeware/include
> -DSSHDIR=\"/usr/local/etc\"  -D_PATH_SSH_PROGRAM=\"/usr/local/bin/ssh\" 
> -D_PATH_SSH_ASKPASS_DEFAULT=\"/usr/local/libexec/ssh-askpass\" 
> -D_PATH_SFTP_SERVER=\"/usr/local/libexec/sftp-server\" 
> -D_PATH_SSH_KEY_SIGN=\"/usr/local/libexec/ssh-keysign\" 
> -D_PATH_SSH_PKCS11_HELPER=\"/usr/local/libexec/ssh-pkcs11-helper\" 
> -D_PATH_SSH_PIDDIR=\"/var/run\"  -D_PATH_PRIVSEP_CHROOT_DIR=\"/var/empty\"
> -DHAVE_CONFIG_H -c regress/unittests/bitmap/tests.c -o
> regress/unittests/bitmap/tests.o
> "/usr/include/sys/mman.h", line 148.25: 1506-343 (S) Redeclaration of mmap64
> differs from previous declaration on line 143 of "/usr/include/sys/mman.h".
> "/usr/include/sys/mman.h", line 148.25: 1506-377 (I) The type "long long" of
> parameter 6 differs from the previous type "long".
> make: 1254-004 The error code from the last command is 1.

Thanks for persisting :)

Does this help?

diff --git regress/unittests/bitmap/tests.c regress/unittests/bitmap/tests.c
index 5e02ca1..06c779d 100644
--- regress/unittests/bitmap/tests.c
+++ regress/unittests/bitmap/tests.c
@@ -5,6 +5,8 @@
  * Placed in the public domain
  */
 
+#include "includes.h"
+
 #include <sys/types.h>
 #include <sys/param.h>
 #include <stdio.h>

From kevin.brott at gmail.com  Wed Feb 25 04:07:58 2015
From: kevin.brott at gmail.com (Kevin Brott)
Date: Tue, 24 Feb 2015 09:07:58 -0800
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <alpine.BSO.2.11.1502250349420.19907@natsu.mindrot.org>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <CAMv58rbsbqi09fHygx6miXm0Ub9r_R=K1iMM3GbXMtEWOKq2QQ@mail.gmail.com>
 <alpine.BSO.2.11.1502240906180.4503@natsu.mindrot.org>
 <CAMv58rbpyJ4B-Ekf-i4ChEaJNjGS21yQjE2XoOHUTKKEO_LtYg@mail.gmail.com>
 <CALDDTe3nKxQo0Y+i0BTiJgQZnA7-4j1-yj=MpF0hgsGPkVZpZw@mail.gmail.com>
 <CAMv58rY8zCFCsyHkVWGObcgBOs=GFZewxfJ76bNgqJutAHmZ7w@mail.gmail.com>
 <alpine.BSO.2.11.1502241011030.4503@natsu.mindrot.org>
 <CAMv58rboDB6hQ+E7T3ywVdT6aJ5WatF6Vfm66h+BfBvuP3jjdQ@mail.gmail.com>
 <20150224002851.GA30328@gate.dtucker.net>
 <CAMv58rZX7W-+OL4PjN1bBH3ayeN8CiFBt=htwdWBK8ytc8vYHQ@mail.gmail.com>
 <alpine.BSO.2.11.1502241142430.4503@natsu.mindrot.org>
 <CAMv58raAhECLVz0qMEJ9J7XRkL6nZYiv2ynQD+Mx9CSrv5jgJw@mail.gmail.com>
 <alpine.BSO.2.11.1502250349420.19907@natsu.mindrot.org>
Message-ID: <CAMv58ranpA+Th285YL7cF_R7SPwh=qRkiYy+9rB+9NOpb4qL_g@mail.gmail.com>

On Tue, Feb 24, 2015 at 8:50 AM, Damien Miller <djm at mindrot.org> wrote:

> Thanks for persisting :)
>
> Does this help?
>
> diff --git regress/unittests/bitmap/tests.c
> regress/unittests/bitmap/tests.c
> index 5e02ca1..06c779d 100644
> --- regress/unittests/bitmap/tests.c
> +++ regress/unittests/bitmap/tests.c
> @@ -5,6 +5,8 @@
>   * Placed in the public domain
>   */
>
> +#include "includes.h"
> +
>  #include <sys/types.h>
>  #include <sys/param.h>
>  #include <stdio.h>
>

If I apply the same fix to these files - then I actually get past the
build and into the tests ...
  regress/unittests/hostkeys/test_iterate.c
  regress/unittests/kex/test_kex.c

Will report back once the tests have finished.  Will be starting a new
thread in a bit, against the patched source, on the HP-UX build failures.

-- 
# include <stddisclaimer.h>
/* Kevin  Brott <Kevin.Brott at gmail.com> */

From djm at mindrot.org  Wed Feb 25 04:24:03 2015
From: djm at mindrot.org (Damien Miller)
Date: Wed, 25 Feb 2015 04:24:03 +1100 (AEDT)
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <CAMv58ranpA+Th285YL7cF_R7SPwh=qRkiYy+9rB+9NOpb4qL_g@mail.gmail.com>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <CAMv58rbsbqi09fHygx6miXm0Ub9r_R=K1iMM3GbXMtEWOKq2QQ@mail.gmail.com>
 <alpine.BSO.2.11.1502240906180.4503@natsu.mindrot.org>
 <CAMv58rbpyJ4B-Ekf-i4ChEaJNjGS21yQjE2XoOHUTKKEO_LtYg@mail.gmail.com>
 <CALDDTe3nKxQo0Y+i0BTiJgQZnA7-4j1-yj=MpF0hgsGPkVZpZw@mail.gmail.com>
 <CAMv58rY8zCFCsyHkVWGObcgBOs=GFZewxfJ76bNgqJutAHmZ7w@mail.gmail.com>
 <alpine.BSO.2.11.1502241011030.4503@natsu.mindrot.org>
 <CAMv58rboDB6hQ+E7T3ywVdT6aJ5WatF6Vfm66h+BfBvuP3jjdQ@mail.gmail.com>
 <20150224002851.GA30328@gate.dtucker.net>
 <CAMv58rZX7W-+OL4PjN1bBH3ayeN8CiFBt=htwdWBK8ytc8vYHQ@mail.gmail.com>
 <alpine.BSO.2.11.1502241142430.4503@natsu.mindrot.org>
 <CAMv58raAhECLVz0qMEJ9J7XRkL6nZYiv2ynQD+Mx9CSrv5jgJw@mail.gmail.com>
 <alpine.BSO.2.11.1502250349420.19907@natsu.mindrot.org>
 <CAMv58ranpA+Th285YL7cF_R7SPwh=qRkiYy+9rB+9NOpb4qL_g@mail.gmail.com>
Message-ID: <alpine.BSO.2.11.1502250423510.19907@natsu.mindrot.org>

On Tue, 24 Feb 2015, Kevin Brott wrote:

> If I apply the same fix to these files - then I actually get past the
> build and into the tests ...
>   regress/unittests/hostkeys/test_iterate.c
>   regress/unittests/kex/test_kex.c
> 
> Will report back once the tests have finished.  Will be starting a new
> thread in a bit, against the patched source, on the HP-UX build failures.

Applied - thanks.

-d

From kevin.brott at gmail.com  Wed Feb 25 06:00:34 2015
From: kevin.brott at gmail.com (Kevin Brott)
Date: Tue, 24 Feb 2015 11:00:34 -0800
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <alpine.BSO.2.11.1502250423510.19907@natsu.mindrot.org>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <CAMv58rbsbqi09fHygx6miXm0Ub9r_R=K1iMM3GbXMtEWOKq2QQ@mail.gmail.com>
 <alpine.BSO.2.11.1502240906180.4503@natsu.mindrot.org>
 <CAMv58rbpyJ4B-Ekf-i4ChEaJNjGS21yQjE2XoOHUTKKEO_LtYg@mail.gmail.com>
 <CALDDTe3nKxQo0Y+i0BTiJgQZnA7-4j1-yj=MpF0hgsGPkVZpZw@mail.gmail.com>
 <CAMv58rY8zCFCsyHkVWGObcgBOs=GFZewxfJ76bNgqJutAHmZ7w@mail.gmail.com>
 <alpine.BSO.2.11.1502241011030.4503@natsu.mindrot.org>
 <CAMv58rboDB6hQ+E7T3ywVdT6aJ5WatF6Vfm66h+BfBvuP3jjdQ@mail.gmail.com>
 <20150224002851.GA30328@gate.dtucker.net>
 <CAMv58rZX7W-+OL4PjN1bBH3ayeN8CiFBt=htwdWBK8ytc8vYHQ@mail.gmail.com>
 <alpine.BSO.2.11.1502241142430.4503@natsu.mindrot.org>
 <CAMv58raAhECLVz0qMEJ9J7XRkL6nZYiv2ynQD+Mx9CSrv5jgJw@mail.gmail.com>
 <alpine.BSO.2.11.1502250349420.19907@natsu.mindrot.org>
 <CAMv58ranpA+Th285YL7cF_R7SPwh=qRkiYy+9rB+9NOpb4qL_g@mail.gmail.com>
 <alpine.BSO.2.11.1502250423510.19907@natsu.mindrot.org>
Message-ID: <CAMv58rawtJ_e6RP0-0NMDkgGvhwsXBi1U3bX7q4Gou+ikBOO4w@mail.gmail.com>

On Tue, Feb 24, 2015 at 9:24 AM, Damien Miller <djm at mindrot.org> wrote:

>
> Applied - thanks.
>
> -d
>

Finally - success ...

Tested both the patched openssh-SNAP-20150225.tar.gz and a git clone from
09:30 PST today. Both AIX 6.1/7.1 using gcc and IBM's compiler - code
builds and passes all tests.

OS              Build_Target                CC
OpenSSL       BUILD    TEST
==============  =========================== ================
============= ======   =================
AIX 6100-09-03  powerpc-ibm-aix6.1.0.0      xlc 11.1.0.6
1.0.1e        OK    all tests passed
AIX 6100-09-03  powerpc-ibm-aix6.1.0.0      gcc 4.2.0
1.0.1e        OK    all tests passed
AIX 7100-03-04  powerpc-ibm-aix7.1.0.0      xlc 12.1.0.6
1.0.1e        OK    all tests passed
AIX 7100-03-04  powerpc-ibm-aix7.1.0.0      gcc 4.4.7
1.0.1e        OK    all tests passed

Now I can move on to the other systems. :q


-- 
# include <stddisclaimer.h>
/* Kevin  Brott <Kevin.Brott at gmail.com> */

From djm at mindrot.org  Wed Feb 25 06:20:04 2015
From: djm at mindrot.org (Damien Miller)
Date: Wed, 25 Feb 2015 06:20:04 +1100 (AEDT)
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <54ECAA54.7020504@jupiterrise.com>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <54EB7DCE.5080708@jupiterrise.com>
 <alpine.BSO.2.11.1502240630420.4503@natsu.mindrot.org>
 <54EB9A20.4080102@jupiterrise.com>
 <alpine.BSO.2.11.1502240905040.4503@natsu.mindrot.org>
 <54ECAA54.7020504@jupiterrise.com>
Message-ID: <alpine.BSO.2.11.1502250619180.19907@natsu.mindrot.org>

On Tue, 24 Feb 2015, Tom G. Christensen wrote:

> I've switched to HEAD in the git repo and it now builds on Solaris
> 2.6, 7, 8 and 9 but the testsuite still cannot be built due to the
> missing <err.h>.
>
> I noticed one of the changes was about HOST_NAME_MAX but I don't
> think that change addresses the real issue on at least these old
> Solaris systems. It looks to me like the fall back in defines.h
> was not activated because Solaris has MAXHOSTNAMELEN in <netdb.h>
> which has not been included when defines.h tries to find a fall back
> HOST_NAME_MAX.
>
> Looking at sshd.c with gcc -dD -E confirms it as defines.h now set
> HOST_NAME_MAX to 255 and later <netdb.h> is included which then
> defines MAXHOSTNAMELEN to 256.
>
> I don't know if it would be reasonable to include <netdb.h>
> from includes.h but that would make HOST_NAME_MAX fall back to
> MAXHOSTNAMELEN on at least Solaris < 10.

I guess we could do this:

diff --git includes.h includes.h
index c3034e3..ec74998 100644
--- includes.h
+++ includes.h
@@ -171,6 +171,8 @@
 #include <openssl/opensslv.h> /* For OPENSSL_VERSION_NUMBER */
 #endif
 
+#include <netdb.h> /* For MAXHOSTNAMELEN */
+
 #include "defines.h"
 
 #include "platform.h"

From kevin.brott at gmail.com  Wed Feb 25 07:11:16 2015
From: kevin.brott at gmail.com (Kevin Brott)
Date: Tue, 24 Feb 2015 12:11:16 -0800
Subject: Current 6.8 git build issues on HP-UX
Message-ID: <CAMv58rbQ5+Lr+H+dnQ9EEMafj65BDmCCq_4=Lz7bb5Z8cqV5Eg@mail.gmail.com>

HP-UX 11.23/11.31  build failures

OS              Build_Target                CC
OpenSSL       BUILD    TEST
==============  =========================== ================
============= ======   =================
HP-UX 11.23     ia64-hp-hpux11.23           C/aC++ C.11.23.12
0.9.8zb       *F1
HP-UX 11.23     ia64-hp-hpux11.23           gcc 4.3.1
0.9.8zb       *F2
HP-UX 11.31     ia64-hp-hpux11.31           C/aC++ C.11.31.05
0.9.8zb       *F1
HP-UX 11.31     ia64-hp-hpux11.31           gcc 4.6.2
0.9.8zb       *F2

*F1
cc 
Build fails here:

   cc -O2 -Ae   -I. -I. -I/opt/phs/include -I/opt/gnome/include
-I/usr/include -I/opt/gtk2.6/include -D_HPUX_SOURCE -D_XOPEN_SOURCE
-D_XOPEN_SOURCE_EXTENDED=1 -DSSHDIR=\"/usr/local/etc\"
-D_PATH_SSH_PROGRAM=\"/usr/local/bin/ssh\"
-D_PATH_SSH_ASKPASS_DEFAULT=\"/usr/local/libexec/ssh-askpass\"
-D_PATH_SFTP_SERVER=\"/usr/local/libexec/sftp-server\"
-D_PATH_SSH_KEY_SIGN=\"/usr/local/libexec/ssh-keysign\"
-D_PATH_SSH_PKCS11_HELPER=\"/usr/local/libexec/ssh-pkcs11-helper\"
-D_PATH_SSH_PIDDIR=\"/var/run\" -D_PATH_PRIVSEP_CHROOT_DIR=\"/var/empty\"
-DHAVE_CONFIG_H -c cipher-aesctr.c -o cipher-aesctr.o
   "cipher-aesctr.c", line 30: warning #2260-D: explicit type is missing
("int" assumed)
       static inline void
                     ^
   "cipher-aesctr.c", line 30: error #2065: expected a ";"
       static inline void
                      ^

   At end of source: warning #2012-D: parsing restarts here after previous
syntax error

   1 error detected in the compilation of "cipher-aesctr.
   make: *** [cipher-aesctr.o] Error 2

*F2
gcc 
Build fails here:
 gcc -O2 -mtune=itanium2 -pipe -Wall -Wpointer-arith -Wuninitialized
-Wsign-compare -Wformat-security -Wno-pointer-sign -fno-strict-aliasing
-D_FORTIFY_SOURCE=2 -ftrapv -fno-builtin-memset -std=gnu99  -I. -I. -O2
-mtune=itanium2 -pipe -I/opt/phs/include -I/usr/local/include
-I/opt/hp-gcc/include -I/opt/gtk2.6/include -D_HPUX_SOURCE -D_XOPEN_SOURCE
-D_XOPEN_SOURCE_EXTENDED=1 -DSSHDIR=\"/usr/local/etc\"
-D_PATH_SSH_PROGRAM=\"/usr/local/bin/ssh\"
-D_PATH_SSH_ASKPASS_DEFAULT=\"/usr/local/libexec/ssh-askpass\"
-D_PATH_SFTP_SERVER=\"/usr/local/libexec/sftp-server\"
-D_PATH_SSH_KEY_SIGN=\"/usr/local/libexec/ssh-keysign\"
-D_PATH_SSH_PKCS11_HELPER=\"/usr/local/libexec/ssh-pkcs11-helper\"
-D_PATH_SSH_PIDDIR=\"/var/run\" -D_PATH_PRIVSEP_CHROOT_DIR=\"/var/empty\"
-DHAVE_CONFIG_H -o regress/netcat regress/netcat.c \
nbsd-compat/ -L/opt/phs/lib -L/usr/local/lib -L/opt/hp-gcc/lib
-L/usr/lib/hpux32 -L/opt/gtk2.6/lib -lssh -lopenbsd-compat -lssh
-lopenbsd-compat -lcrypto -lz -lnsl -lxnet  -lsec
 regress/netcat.c: In function 'socks_connect':
 regress/netcat.c:1470: warning: 'wlen' may be used uninitialized in this
function
 ld: Unsatisfied symbol "xstrdup" in file
openbsd-compat//libopenbsd-compat.a[bsd-misc.o]
 1 errors.
 collect2: ld returned 1 exit status
 make: *** [regress/netcat] Error 1


-- 
# include <stddisclaimer.h>
/* Kevin  Brott <Kevin.Brott at gmail.com> */

From tgc at jupiterrise.com  Wed Feb 25 07:50:54 2015
From: tgc at jupiterrise.com (Tom G. Christensen)
Date: Tue, 24 Feb 2015 21:50:54 +0100
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <alpine.BSO.2.11.1502250619180.19907@natsu.mindrot.org>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <54EB7DCE.5080708@jupiterrise.com>
 <alpine.BSO.2.11.1502240630420.4503@natsu.mindrot.org>
 <54EB9A20.4080102@jupiterrise.com>
 <alpine.BSO.2.11.1502240905040.4503@natsu.mindrot.org>
 <54ECAA54.7020504@jupiterrise.com>
 <alpine.BSO.2.11.1502250619180.19907@natsu.mindrot.org>
Message-ID: <54ECE42E.50601@jupiterrise.com>

On 24/02/15 20:20, Damien Miller wrote:
> On Tue, 24 Feb 2015, Tom G. Christensen wrote:
>> I don't know if it would be reasonable to include <netdb.h>
>> from includes.h but that would make HOST_NAME_MAX fall back to
>> MAXHOSTNAMELEN on at least Solaris < 10.
>
> I guess we could do this:
>
> diff --git includes.h includes.h
> index c3034e3..ec74998 100644
> --- includes.h
> +++ includes.h
> @@ -171,6 +171,8 @@
>   #include <openssl/opensslv.h> /* For OPENSSL_VERSION_NUMBER */
>   #endif
>
> +#include <netdb.h> /* For MAXHOSTNAMELEN */
> +
>   #include "defines.h"
>
>   #include "platform.h"
>

Exactly.
I tested such a change on Solaris 2.6 and it builds and HOST_NAME_MAX 
falls back to MAXHOSTNAMELEN.

I also had a quick look at a Solaris 10 host and it has 
_POSIX_HOST_NAME_MAX in <limits.h> which is already included.

-tgc

From tim at multitalents.net  Wed Feb 25 07:56:55 2015
From: tim at multitalents.net (Tim Rice)
Date: Tue, 24 Feb 2015 12:56:55 -0800 (PST)
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <alpine.BSO.2.11.1502250619180.19907@natsu.mindrot.org>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <54EB7DCE.5080708@jupiterrise.com>
 <alpine.BSO.2.11.1502240630420.4503@natsu.mindrot.org>
 <54EB9A20.4080102@jupiterrise.com>
 <alpine.BSO.2.11.1502240905040.4503@natsu.mindrot.org>
 <54ECAA54.7020504@jupiterrise.com>
 <alpine.BSO.2.11.1502250619180.19907@natsu.mindrot.org>
Message-ID: <alpine.UW2.2.11.1502241251440.295@server01.int.multitalents.net>

On Wed, 25 Feb 2015, Damien Miller wrote:

| On Tue, 24 Feb 2015, Tom G. Christensen wrote:
| 
| > I've switched to HEAD in the git repo and it now builds on Solaris
| > 2.6, 7, 8 and 9 but the testsuite still cannot be built due to the
| > missing <err.h>.

The err.h issue is fixes but there still msghdr structure differences
to deal with.

[more below]
| > I noticed one of the changes was about HOST_NAME_MAX but I don't
| > think that change addresses the real issue on at least these old
| > Solaris systems. It looks to me like the fall back in defines.h
| > was not activated because Solaris has MAXHOSTNAMELEN in <netdb.h>
| > which has not been included when defines.h tries to find a fall back
| > HOST_NAME_MAX.
| >
| > Looking at sshd.c with gcc -dD -E confirms it as defines.h now set
| > HOST_NAME_MAX to 255 and later <netdb.h> is included which then
| > defines MAXHOSTNAMELEN to 256.
| >
| > I don't know if it would be reasonable to include <netdb.h>
| > from includes.h but that would make HOST_NAME_MAX fall back to
| > MAXHOSTNAMELEN on at least Solaris < 10.
| 
| I guess we could do this:
| 
| diff --git includes.h includes.h
| index c3034e3..ec74998 100644
| --- includes.h
| +++ includes.h
| @@ -171,6 +171,8 @@
|  #include <openssl/opensslv.h> /* For OPENSSL_VERSION_NUMBER */
|  #endif
|  
| +#include <netdb.h> /* For MAXHOSTNAMELEN */
| +
|  #include "defines.h"
|  
|  #include "platform.h"
| _______________________________________________

I should have spotted that netdb.h was not included yet
Perhaps
.....
--- defines.h.old	2015-02-23 21:35:19.098756406 -0800
+++ defines.h	2015-02-24 12:22:24.916077846 -0800
@@ -108,10 +108,9 @@
 #ifndef HOST_NAME_MAX
 # if defined(_POSIX_HOST_NAME_MAX)
 #  define HOST_NAME_MAX _POSIX_HOST_NAME_MAX
-# elif defined(MAXHOSTNAMELEN)
+# elif defined(HAVE_NETDB_H)
+#  include <netdb.h>
 #  define HOST_NAME_MAX MAXHOSTNAMELEN
-# else
-#  define HOST_NAME_MAX	255
 # endif
 #endif /* HOST_NAME_MAX */
 
.....

-- 
Tim Rice				Multitalents	(707) 456-1146
tim at multitalents.net



From dtucker at zip.com.au  Wed Feb 25 08:43:47 2015
From: dtucker at zip.com.au (Darren Tucker)
Date: Tue, 24 Feb 2015 16:43:47 -0500
Subject: Current 6.8 git build issues on HP-UX
In-Reply-To: <CAMv58rbQ5+Lr+H+dnQ9EEMafj65BDmCCq_4=Lz7bb5Z8cqV5Eg@mail.gmail.com>
References: <CAMv58rbQ5+Lr+H+dnQ9EEMafj65BDmCCq_4=Lz7bb5Z8cqV5Eg@mail.gmail.com>
Message-ID: <CALDDTe0udz-ZA8uWufecSSHBzAUDOda9g_RGi5LJ+e=GGG-7ow@mail.gmail.com>

On Tue, Feb 24, 2015 at 3:11 PM, Kevin Brott <kevin.brott at gmail.com> wrote:

> [...]
>    "cipher-aesctr.c", line 30: warning #2260-D: explicit type is missing
> ("int" assumed)
>        static inline void
>

does replacing "inline" with "__inline__" work?  Failing that, removing
inline entirely?

 ld: Unsatisfied symbol "xstrdup" in file
> openbsd-compat//libopenbsd-compat.a[bsd-misc.o]
>  1 errors.
>

That one looks like a link order problem.  Unfortunately, given that it
already has "-lssh -lopenbsd-compat -lssh -lopenbsd-compat" we seem to just
be digging the hole deeper...

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.

From dtucker at zip.com.au  Wed Feb 25 09:04:57 2015
From: dtucker at zip.com.au (Darren Tucker)
Date: Wed, 25 Feb 2015 09:04:57 +1100
Subject: Current 6.8 git build issues on HP-UX
In-Reply-To: <CAMv58rbQ5+Lr+H+dnQ9EEMafj65BDmCCq_4=Lz7bb5Z8cqV5Eg@mail.gmail.com>
References: <CAMv58rbQ5+Lr+H+dnQ9EEMafj65BDmCCq_4=Lz7bb5Z8cqV5Eg@mail.gmail.com>
Message-ID: <20150224220457.GA10067@gate.dtucker.net>

On Tue, Feb 24, 2015 at 12:11:16PM -0800, Kevin Brott wrote:
>  ld: Unsatisfied symbol "xstrdup" in file
> openbsd-compat//libopenbsd-compat.a[bsd-misc.o]

How about removing the dependency on xmalloc?  eg (untested):

diff --git a/openbsd-compat/bsd-misc.c b/openbsd-compat/bsd-misc.c
index 65e8003..40efc87 100644
--- a/openbsd-compat/bsd-misc.c
+++ b/openbsd-compat/bsd-misc.c
@@ -31,8 +31,6 @@
 #include <time.h>
 #include <unistd.h>
 
-#include "xmalloc.h"
-
 #ifndef HAVE___PROGNAME
 char *__progname;
 #endif
@@ -43,13 +41,12 @@ char *__progname;
  */
 char *ssh_get_progname(char *argv0)
 {
+	char *p, *q;
 #ifdef HAVE___PROGNAME
 	extern char *__progname;
 
-	return xstrdup(__progname);
+	p = progname;
 #else
-	char *p;
-
 	if (argv0 == NULL)
 		return ("unknown");	/* XXX */
 	p = strrchr(argv0, '/');
@@ -57,9 +54,12 @@ char *ssh_get_progname(char *argv0)
 		p = argv0;
 	else
 		p++;
-
-	return (xstrdup(p));
 #endif
+	if ((q = strdup(p)) == NULL) {
+		perror("strdup");
+		exit(1);
+	}
+	return q;
 }
 
 #ifndef HAVE_SETLOGIN

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.

From djm at mindrot.org  Wed Feb 25 09:08:28 2015
From: djm at mindrot.org (Damien Miller)
Date: Wed, 25 Feb 2015 09:08:28 +1100 (AEDT)
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <alpine.UW2.2.11.1502241251440.295@server01.int.multitalents.net>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <54EB7DCE.5080708@jupiterrise.com>
 <alpine.BSO.2.11.1502240630420.4503@natsu.mindrot.org>
 <54EB9A20.4080102@jupiterrise.com>
 <alpine.BSO.2.11.1502240905040.4503@natsu.mindrot.org>
 <54ECAA54.7020504@jupiterrise.com>
 <alpine.BSO.2.11.1502250619180.19907@natsu.mindrot.org>
 <alpine.UW2.2.11.1502241251440.295@server01.int.multitalents.net>
Message-ID: <alpine.BSO.2.11.1502250902020.19907@natsu.mindrot.org>

On Tue, 24 Feb 2015, Tim Rice wrote:

> I should have spotted that netdb.h was not included yet
> Perhaps
> .....
> --- defines.h.old	2015-02-23 21:35:19.098756406 -0800
> +++ defines.h	2015-02-24 12:22:24.916077846 -0800
> @@ -108,10 +108,9 @@
>  #ifndef HOST_NAME_MAX
>  # if defined(_POSIX_HOST_NAME_MAX)
>  #  define HOST_NAME_MAX _POSIX_HOST_NAME_MAX
> -# elif defined(MAXHOSTNAMELEN)
> +# elif defined(HAVE_NETDB_H)
> +#  include <netdb.h>

I don't think there is any need for "elif defined(HAVE_NETDB_H)" since
we unconditionally include netdb.h in a few places already.

diff --git defines.h defines.h
index d99ef68..b7dd1d9 100644
--- defines.h
+++ defines.h
@@ -106,6 +106,7 @@ enum
 #endif /* MAXPATHLEN */
 
 #ifndef HOST_NAME_MAX
+# include "netdb.h" /* for MAXHOSTNAMELEN */
 # if defined(_POSIX_HOST_NAME_MAX)
 #  define HOST_NAME_MAX _POSIX_HOST_NAME_MAX
 # elif defined(MAXHOSTNAMELEN)
diff --git includes.h includes.h
index c3034e3..2893a54 100644
--- includes.h
+++ includes.h
@@ -27,7 +27,7 @@
 #include <sys/socket.h> /* For CMSG_* */
 
 #ifdef HAVE_LIMITS_H
-# include <limits.h> /* For PATH_MAX */
+# include <limits.h> /* For PATH_MAX, _POSIX_HOST_NAME_MAX */
 #endif
 #ifdef HAVE_BSTRING_H
 # include <bstring.h>

From djm at mindrot.org  Wed Feb 25 09:09:25 2015
From: djm at mindrot.org (Damien Miller)
Date: Wed, 25 Feb 2015 09:09:25 +1100 (AEDT)
Subject: Current 6.8 git build issues on HP-UX
In-Reply-To: <20150224220457.GA10067@gate.dtucker.net>
References: <CAMv58rbQ5+Lr+H+dnQ9EEMafj65BDmCCq_4=Lz7bb5Z8cqV5Eg@mail.gmail.com>
 <20150224220457.GA10067@gate.dtucker.net>
Message-ID: <alpine.BSO.2.11.1502250909180.19907@natsu.mindrot.org>



On Wed, 25 Feb 2015, Darren Tucker wrote:

> On Tue, Feb 24, 2015 at 12:11:16PM -0800, Kevin Brott wrote:
> >  ld: Unsatisfied symbol "xstrdup" in file
> > openbsd-compat//libopenbsd-compat.a[bsd-misc.o]
> 
> How about removing the dependency on xmalloc?  eg (untested):

fine by me

From dtucker at zip.com.au  Wed Feb 25 09:13:22 2015
From: dtucker at zip.com.au (Darren Tucker)
Date: Wed, 25 Feb 2015 09:13:22 +1100
Subject: Current 6.8 git build issues on HP-UX
In-Reply-To: <20150224220457.GA10067@gate.dtucker.net>
References: <CAMv58rbQ5+Lr+H+dnQ9EEMafj65BDmCCq_4=Lz7bb5Z8cqV5Eg@mail.gmail.com>
 <20150224220457.GA10067@gate.dtucker.net>
Message-ID: <20150224221322.GA13006@gate.dtucker.net>

On Wed, Feb 25, 2015 at 09:04:57AM +1100, Darren Tucker wrote:
> On Tue, Feb 24, 2015 at 12:11:16PM -0800, Kevin Brott wrote:
> >  ld: Unsatisfied symbol "xstrdup" in file
> > openbsd-compat//libopenbsd-compat.a[bsd-misc.o]
> 
> How about removing the dependency on xmalloc?  eg (untested):

Shoulda tested it.  Now one that will compile:

diff --git a/openbsd-compat/bsd-misc.c b/openbsd-compat/bsd-misc.c
index 65e8003..40efc87 100644
--- a/openbsd-compat/bsd-misc.c
+++ b/openbsd-compat/bsd-misc.c
@@ -31,8 +31,6 @@
 #include <time.h>
 #include <unistd.h>
 
-#include "xmalloc.h"
-
 #ifndef HAVE___PROGNAME
 char *__progname;
 #endif
@@ -43,13 +41,12 @@ char *__progname;
  */
 char *ssh_get_progname(char *argv0)
 {
+	char *p, *q;
 #ifdef HAVE___PROGNAME
 	extern char *__progname;
 
-	return xstrdup(__progname);
+	p = progname;
 #else
-	char *p;
-
 	if (argv0 == NULL)
 		return ("unknown");	/* XXX */
 	p = strrchr(argv0, '/');
@@ -57,9 +54,12 @@ char *ssh_get_progname(char *argv0)
 		p = argv0;
 	else
 		p++;
-
-	return (xstrdup(p));
 #endif
+	if ((q = strdup(p)) == NULL) {
+		perror("strdup");
+		exit(1);
+	}
+	return q;
 }
 
 #ifndef HAVE_SETLOGIN

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.

From djm at mindrot.org  Wed Feb 25 09:16:15 2015
From: djm at mindrot.org (Damien Miller)
Date: Wed, 25 Feb 2015 09:16:15 +1100 (AEDT)
Subject: Current 6.8 git build issues on HP-UX
In-Reply-To: <20150224221322.GA13006@gate.dtucker.net>
References: <CAMv58rbQ5+Lr+H+dnQ9EEMafj65BDmCCq_4=Lz7bb5Z8cqV5Eg@mail.gmail.com>
 <20150224220457.GA10067@gate.dtucker.net>
 <20150224221322.GA13006@gate.dtucker.net>
Message-ID: <alpine.BSO.2.11.1502250916050.19907@natsu.mindrot.org>



On Wed, 25 Feb 2015, Darren Tucker wrote:

> On Wed, Feb 25, 2015 at 09:04:57AM +1100, Darren Tucker wrote:
> > On Tue, Feb 24, 2015 at 12:11:16PM -0800, Kevin Brott wrote:
> > >  ld: Unsatisfied symbol "xstrdup" in file
> > > openbsd-compat//libopenbsd-compat.a[bsd-misc.o]
> > 
> > How about removing the dependency on xmalloc?  eg (untested):
> 
> Shoulda tested it.  Now one that will compile:

even finer by me

From dtucker at zip.com.au  Wed Feb 25 09:20:01 2015
From: dtucker at zip.com.au (Darren Tucker)
Date: Wed, 25 Feb 2015 09:20:01 +1100
Subject: Current 6.8 git build issues on HP-UX
In-Reply-To: <20150224221322.GA13006@gate.dtucker.net>
References: <CAMv58rbQ5+Lr+H+dnQ9EEMafj65BDmCCq_4=Lz7bb5Z8cqV5Eg@mail.gmail.com>
 <20150224220457.GA10067@gate.dtucker.net>
 <20150224221322.GA13006@gate.dtucker.net>
Message-ID: <20150224222001.GB13006@gate.dtucker.net>

On Wed, Feb 25, 2015 at 09:13:22AM +1100, Darren Tucker wrote:
> On Wed, Feb 25, 2015 at 09:04:57AM +1100, Darren Tucker wrote:
> > On Tue, Feb 24, 2015 at 12:11:16PM -0800, Kevin Brott wrote:
> > >  ld: Unsatisfied symbol "xstrdup" in file
> > > openbsd-compat//libopenbsd-compat.a[bsd-misc.o]
> > 
> > How about removing the dependency on xmalloc?  eg (untested):
> 
> Shoulda tested it.  Now one that will compile:

Sigh.  And now the right patch from the tree that compiled.
(djm: I get the idea :-)

diff --git a/openbsd-compat/bsd-misc.c b/openbsd-compat/bsd-misc.c
index 65e8003..f7be415 100644
--- a/openbsd-compat/bsd-misc.c
+++ b/openbsd-compat/bsd-misc.c
@@ -31,8 +31,6 @@
 #include <time.h>
 #include <unistd.h>
 
-#include "xmalloc.h"
-
 #ifndef HAVE___PROGNAME
 char *__progname;
 #endif
@@ -43,13 +41,12 @@ char *__progname;
  */
 char *ssh_get_progname(char *argv0)
 {
+	char *p, *q;
 #ifdef HAVE___PROGNAME
 	extern char *__progname;
 
-	return xstrdup(__progname);
+	p = __progname;
 #else
-	char *p;
-
 	if (argv0 == NULL)
 		return ("unknown");	/* XXX */
 	p = strrchr(argv0, '/');
@@ -57,9 +54,12 @@ char *ssh_get_progname(char *argv0)
 		p = argv0;
 	else
 		p++;
-
-	return (xstrdup(p));
 #endif
+	if ((q = strdup(p)) == NULL) {
+		perror("strdup");
+		exit(1);
+	}
+	return q;
 }
 
 #ifndef HAVE_SETLOGIN

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.

From kevin.brott at gmail.com  Wed Feb 25 09:21:31 2015
From: kevin.brott at gmail.com (Kevin Brott)
Date: Tue, 24 Feb 2015 14:21:31 -0800
Subject: Current 6.8 git build issues on HP-UX
In-Reply-To: <CALDDTe0udz-ZA8uWufecSSHBzAUDOda9g_RGi5LJ+e=GGG-7ow@mail.gmail.com>
References: <CAMv58rbQ5+Lr+H+dnQ9EEMafj65BDmCCq_4=Lz7bb5Z8cqV5Eg@mail.gmail.com>
 <CALDDTe0udz-ZA8uWufecSSHBzAUDOda9g_RGi5LJ+e=GGG-7ow@mail.gmail.com>
Message-ID: <CAMv58rbJhkVtOnPOuDtVMWUodejyqR1xs=sFG5iAELKeng46HQ@mail.gmail.com>

On Tue, Feb 24, 2015 at 1:43 PM, Darren Tucker <dtucker at zip.com.au> wrote:

> On Tue, Feb 24, 2015 at 3:11 PM, Kevin Brott <kevin.brott at gmail.com>
> wrote:
>
>> [...]
>>    "cipher-aesctr.c", line 30: warning #2260-D: explicit type is missing
>> ("int" assumed)
>>        static inline void
>>
>
> does replacing "inline" with "__inline__" work?  Failing that, removing
> inline entirely?
>

Using __inline__ fails the same way, but removing it entirely moves on past
that to this:

cc -O2 -Ae   -I. -I. -I/opt/phs/include -I/opt/gnome/include -I/usr/include
-I/opt/gtk2.6/include -D_HPUX_SOURCE -D_XOPEN_SOURCE
-D_XOPEN_SOURCE_EXTENDED=1 -DSSHDIR=\"/usr/local/etc\"
-D_PATH_SSH_PROGRAM=\"/usr/local/bin/ssh\"
-D_PATH_SSH_ASKPASS_DEFAULT=\"/usr/local/libexec/ssh-askpass\"
-D_PATH_SFTP_SERVER=\"/usr/local/libexec/sftp-server\"
-D_PATH_SSH_KEY_SIGN=\"/usr/local/libexec/ssh-keysign\"
-D_PATH_SSH_PKCS11_HELPER=\"/usr/local/libexec/ssh-pkcs11-helper\"
-D_PATH_SSH_PIDDIR=\"/var/run\" -D_PATH_PRIVSEP_CHROOT_DIR=\"/var/empty\"
-DHAVE_CONFIG_H -o regress/netcat regress/netcat.c \
        -L. -Lopenbsd-compat/ -L/opt/phs/lib -L/opt/phs/lib/hpux32
-L/opt/gnome/lib -L/usr/lib -L/usr/lib/hpux32 -L/opt/gtk2.6/lib -lssh
-lopenbsd-compat -lssh -lopenbsd-compat -lcrypto -lz -lnsl -lxnet  -lsec
"/usr/include/sys/signal.h", line 465: warning #2047-D: incompatible
          redefinition of macro "_NSIG" (declared at line 828 of
"./defines.h")
  #    define _NSIG       45
              ^

"regress/netcat.c", line 1613: warning #4212-D: mismatch between character
          pointer types "unsigned char *" and "char *"
                        r = snprintf(buf, sizeof(buf),
                                     ^

"regress/netcat.c", line 1617: warning #4212-D: mismatch between character
          pointer types "unsigned char *" and "char *"
                        r = snprintf(buf, sizeof(buf),
                                     ^

"regress/netcat.c", line 1623: warning #4212-D: mismatch between character
          pointer types "unsigned char *" and "const char *"
                r = strlen(buf);
                           ^

"regress/netcat.c", line 1633: warning #4212-D: mismatch between character
          pointer types "unsigned char *" and "char *"
                        r = snprintf(buf, sizeof(buf), "%s:%s",
                                     ^

"regress/netcat.c", line 1636: warning #4212-D: mismatch between character
          pointer types "unsigned char *" and "const char *"
                            b64_ntop(buf, strlen(buf), resp,
                                                 ^

"regress/netcat.c", line 1639: warning #4212-D: mismatch between character
          pointer types "unsigned char *" and "char *"
                        r = snprintf(buf, sizeof(buf),
"Proxy-Authorization: "
                                     ^

"regress/netcat.c", line 1643: warning #4212-D: mismatch between character
          pointer types "unsigned char *" and "const char *"
                        r = strlen(buf);
                                   ^

"regress/netcat.c", line 1653: warning #4212-D: mismatch between character
          pointer types "unsigned char *" and "char *"
                proxy_read_line(proxyfd, buf, sizeof(buf));
                                         ^

"regress/netcat.c", line 1655: warning #4212-D: mismatch between character
          pointer types "unsigned char *" and "const char *"
                    strncmp(buf, "HTTP/1.0 407 ", 12) == 0) {
                            ^

"regress/netcat.c", line 1662: warning #4212-D: mismatch between character
          pointer types "unsigned char *" and "const char *"
                } else if (strncmp(buf, "HTTP/1.0 200 ", 12) != 0 &&
                                   ^

"regress/netcat.c", line 1663: warning #4212-D: mismatch between character
          pointer types "unsigned char *" and "const char *"
                    strncmp(buf, "HTTP/1.1 200 ", 12) != 0)
                            ^

"regress/netcat.c", line 1668: warning #4212-D: mismatch between character
          pointer types "unsigned char *" and "char *"
                        proxy_read_line(proxyfd, buf, sizeof(buf));
                                                 ^

ld: Unsatisfied symbol "ntohs" in file netcat.o
ld: Unsatisfied symbol "xstrdup" in file
openbsd-compat//libopenbsd-compat.a[bsd-misc.o]
2 errors.
make: *** [regress/netcat] Error 1

-- 
# include <stddisclaimer.h>
/* Kevin  Brott <Kevin.Brott at gmail.com> */

From dtucker at zip.com.au  Wed Feb 25 09:29:01 2015
From: dtucker at zip.com.au (Darren Tucker)
Date: Wed, 25 Feb 2015 09:29:01 +1100
Subject: Current 6.8 git build issues on HP-UX
In-Reply-To: <20150224222001.GB13006@gate.dtucker.net>
References: <CAMv58rbQ5+Lr+H+dnQ9EEMafj65BDmCCq_4=Lz7bb5Z8cqV5Eg@mail.gmail.com>
 <20150224220457.GA10067@gate.dtucker.net>
 <20150224221322.GA13006@gate.dtucker.net>
 <20150224222001.GB13006@gate.dtucker.net>
Message-ID: <20150224222901.GC13006@gate.dtucker.net>

On Wed, Feb 25, 2015 at 09:20:01AM +1100, Darren Tucker wrote:
[...]
> Sigh.  And now the right patch from the tree that compiled.
> (djm: I get the idea :-)

Tim: is this sufficient to back out the "Work around finicky USL linker"
change?

https://anongit.mindrot.org/openssh.git/commit/?id=d1db656021d0cd8c001a6692f772f1de29b67c8b

> diff --git a/openbsd-compat/bsd-misc.c b/openbsd-compat/bsd-misc.c
> index 65e8003..f7be415 100644
> --- a/openbsd-compat/bsd-misc.c
> +++ b/openbsd-compat/bsd-misc.c
> @@ -31,8 +31,6 @@
>  #include <time.h>
>  #include <unistd.h>
>  
> -#include "xmalloc.h"
> -
>  #ifndef HAVE___PROGNAME
>  char *__progname;
>  #endif
> @@ -43,13 +41,12 @@ char *__progname;
>   */
>  char *ssh_get_progname(char *argv0)
>  {
> +	char *p, *q;
>  #ifdef HAVE___PROGNAME
>  	extern char *__progname;
>  
> -	return xstrdup(__progname);
> +	p = __progname;
>  #else
> -	char *p;
> -
>  	if (argv0 == NULL)
>  		return ("unknown");	/* XXX */
>  	p = strrchr(argv0, '/');
> @@ -57,9 +54,12 @@ char *ssh_get_progname(char *argv0)
>  		p = argv0;
>  	else
>  		p++;
> -
> -	return (xstrdup(p));
>  #endif
> +	if ((q = strdup(p)) == NULL) {
> +		perror("strdup");
> +		exit(1);
> +	}
> +	return q;
>  }
>  
>  #ifndef HAVE_SETLOGIN

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.

From kevin.brott at gmail.com  Wed Feb 25 09:33:07 2015
From: kevin.brott at gmail.com (Kevin Brott)
Date: Tue, 24 Feb 2015 14:33:07 -0800
Subject: Current 6.8 git build issues on HP-UX
In-Reply-To: <20150224222001.GB13006@gate.dtucker.net>
References: <CAMv58rbQ5+Lr+H+dnQ9EEMafj65BDmCCq_4=Lz7bb5Z8cqV5Eg@mail.gmail.com>
 <20150224220457.GA10067@gate.dtucker.net>
 <20150224221322.GA13006@gate.dtucker.net>
 <20150224222001.GB13006@gate.dtucker.net>
Message-ID: <CAMv58rYkEtAxLj0Ae1KcHtEnZsOWRNqennromb5GjWK9_kU1dQ@mail.gmail.com>

On Tue, Feb 24, 2015 at 2:20 PM, Darren Tucker <dtucker at zip.com.au> wrote:

> On Wed, Feb 25, 2015 at 09:13:22AM +1100, Darren Tucker wrote:
> > On Wed, Feb 25, 2015 at 09:04:57AM +1100, Darren Tucker wrote:
> > > On Tue, Feb 24, 2015 at 12:11:16PM -0800, Kevin Brott wrote:
> > > >  ld: Unsatisfied symbol "xstrdup" in file
> > > > openbsd-compat//libopenbsd-compat.a[bsd-misc.o]
> > >
> > > How about removing the dependency on xmalloc?  eg (untested):
> >
> > Shoulda tested it.  Now one that will compile:
>
> Sigh.  And now the right patch from the tree that compiled.
> (djm: I get the idea :-)
>
> diff --git a/openbsd-compat/bsd-misc.c b/openbsd-compat/bsd-misc.c
> index 65e8003..f7be415 100644
>
>
Applying this patch against the git clone from this morning, the patched
openssh-SNAP-20150225.tar.gz that worked finally for AIX and the git clone
I just pulled gives me:

patching file openbsd-compat/bsd-misc.c
Hunk #2 FAILED at 41.
Hunk #3 FAILED at 54.
2 out of 3 hunks FAILED -- saving rejects to file
openbsd-compat/bsd-misc.c.rej

Suggestions?

From dtucker at zip.com.au  Wed Feb 25 11:16:50 2015
From: dtucker at zip.com.au (Darren Tucker)
Date: Tue, 24 Feb 2015 19:16:50 -0500
Subject: Current 6.8 git build issues on HP-UX
In-Reply-To: <CAMv58rYkEtAxLj0Ae1KcHtEnZsOWRNqennromb5GjWK9_kU1dQ@mail.gmail.com>
References: <CAMv58rbQ5+Lr+H+dnQ9EEMafj65BDmCCq_4=Lz7bb5Z8cqV5Eg@mail.gmail.com>
 <20150224220457.GA10067@gate.dtucker.net>
 <20150224221322.GA13006@gate.dtucker.net>
 <20150224222001.GB13006@gate.dtucker.net>
 <CAMv58rYkEtAxLj0Ae1KcHtEnZsOWRNqennromb5GjWK9_kU1dQ@mail.gmail.com>
Message-ID: <CALDDTe3LbnBrDduJWAMFMvLKVLbTTFC86KPhdRLQqjnepS8Ycw@mail.gmail.com>

On Tue, Feb 24, 2015 at 5:33 PM, Kevin Brott <kevin.brott at gmail.com> wrote:
>
> patching file openbsd-compat/bsd-misc.c
> Hunk #2 FAILED at 41.
> Hunk #3 FAILED at 54.
> 2 out of 3 hunks FAILED -- saving rejects to file
> openbsd-compat/bsd-misc.c.rej
>
> Suggestions?
>

Whitespace mangled in the mail?

I put up a copy here:
http://www.dtucker.net/~dtucker/tmp/openssh-progname.patch

failing that, try patch -l ?

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.

From tim at multitalents.net  Wed Feb 25 11:37:41 2015
From: tim at multitalents.net (Tim Rice)
Date: Tue, 24 Feb 2015 16:37:41 -0800 (PST)
Subject: Current 6.8 git build issues on HP-UX
In-Reply-To: <CALDDTe0udz-ZA8uWufecSSHBzAUDOda9g_RGi5LJ+e=GGG-7ow@mail.gmail.com>
References: <CAMv58rbQ5+Lr+H+dnQ9EEMafj65BDmCCq_4=Lz7bb5Z8cqV5Eg@mail.gmail.com>
 <CALDDTe0udz-ZA8uWufecSSHBzAUDOda9g_RGi5LJ+e=GGG-7ow@mail.gmail.com>
Message-ID: <alpine.UW2.2.11.1502241627060.295@server01.int.multitalents.net>

On Tue, 24 Feb 2015, Darren Tucker wrote:

| On Tue, Feb 24, 2015 at 3:11 PM, Kevin Brott <kevin.brott at gmail.com> wrote:
| 
| > [...]
| >    "cipher-aesctr.c", line 30: warning #2260-D: explicit type is missing
| > ("int" assumed)
| >        static inline void
| >
| 
| does replacing "inline" with "__inline__" work?  Failing that, removing
| inline entirely?

I just changed __inline__ to inline so we don't want to go that direction.
We already use "static inline void" in openbsd-compat/arc4random.c.
Puzzling.

|  ld: Unsatisfied symbol "xstrdup" in file
| > openbsd-compat//libopenbsd-compat.a[bsd-misc.o]
| >  1 errors.
| >
| 
| That one looks like a link order problem.  Unfortunately, given that it
| already has "-lssh -lopenbsd-compat -lssh -lopenbsd-compat" we seem to just
| be digging the hole deeper...

Makfile.in has been updated for this.
Kevin, add another -lssh after the last -lopenbsd-compat in
your Makefile for the netcat rule.


-- 
Tim Rice				Multitalents
tim at multitalents.net



From tim at multitalents.net  Wed Feb 25 11:47:20 2015
From: tim at multitalents.net (Tim Rice)
Date: Tue, 24 Feb 2015 16:47:20 -0800 (PST)
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <alpine.BSO.2.11.1502250902020.19907@natsu.mindrot.org>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <54EB7DCE.5080708@jupiterrise.com>
 <alpine.BSO.2.11.1502240630420.4503@natsu.mindrot.org>
 <54EB9A20.4080102@jupiterrise.com>
 <alpine.BSO.2.11.1502240905040.4503@natsu.mindrot.org>
 <54ECAA54.7020504@jupiterrise.com>
 <alpine.BSO.2.11.1502250619180.19907@natsu.mindrot.org>
 <alpine.UW2.2.11.1502241251440.295@server01.int.multitalents.net>
 <alpine.BSO.2.11.1502250902020.19907@natsu.mindrot.org>
Message-ID: <alpine.UW2.2.11.1502241644260.295@server01.int.multitalents.net>

On Wed, 25 Feb 2015, Damien Miller wrote:

> I don't think there is any need for "elif defined(HAVE_NETDB_H)" since
> we unconditionally include netdb.h in a few places already.
> 
> diff --git defines.h defines.h
> index d99ef68..b7dd1d9 100644
> --- defines.h
> +++ defines.h
> @@ -106,6 +106,7 @@ enum
>  #endif /* MAXPATHLEN */
>  
>  #ifndef HOST_NAME_MAX
> +# include "netdb.h" /* for MAXHOSTNAMELEN */
>  # if defined(_POSIX_HOST_NAME_MAX)
>  #  define HOST_NAME_MAX _POSIX_HOST_NAME_MAX
>  # elif defined(MAXHOSTNAMELEN)
> diff --git includes.h includes.h
> index c3034e3..2893a54 100644
> --- includes.h
> +++ includes.h
> @@ -27,7 +27,7 @@
>  #include <sys/socket.h> /* For CMSG_* */
>  
>  #ifdef HAVE_LIMITS_H
> -# include <limits.h> /* For PATH_MAX */
> +# include <limits.h> /* For PATH_MAX, _POSIX_HOST_NAME_MAX */
>  #endif
>  #ifdef HAVE_BSTRING_H
>  # include <bstring.h>

ok tim


-- 
Tim Rice				Multitalents
tim at multitalents.net



From tim at multitalents.net  Wed Feb 25 11:58:47 2015
From: tim at multitalents.net (Tim Rice)
Date: Tue, 24 Feb 2015 16:58:47 -0800 (PST)
Subject: Current 6.8 git build issues on HP-UX
In-Reply-To: <20150224222901.GC13006@gate.dtucker.net>
References: <CAMv58rbQ5+Lr+H+dnQ9EEMafj65BDmCCq_4=Lz7bb5Z8cqV5Eg@mail.gmail.com>
 <20150224220457.GA10067@gate.dtucker.net>
 <20150224221322.GA13006@gate.dtucker.net>
 <20150224222001.GB13006@gate.dtucker.net>
 <20150224222901.GC13006@gate.dtucker.net>
Message-ID: <alpine.UW2.2.11.1502241655060.295@server01.int.multitalents.net>

On Wed, 25 Feb 2015, Darren Tucker wrote:

| On Wed, Feb 25, 2015 at 09:20:01AM +1100, Darren Tucker wrote:

| Tim: is this sufficient to back out the "Work around finicky USL linker"
| change?
| 
| https://anongit.mindrot.org/openssh.git/commit/?id=d1db656021d0cd8c001a6692f772f1de29b67c8b
| 
| > diff --git a/openbsd-compat/bsd-misc.c b/openbsd-compat/bsd-misc.c
| > index 65e8003..f7be415 100644
| > --- a/openbsd-compat/bsd-misc.c
[patch snipped]

netcat still builds with your patch and backing out the Makfile.in commit.

-- 
Tim Rice				Multitalents
tim at multitalents.net



From kevin.brott at gmail.com  Wed Feb 25 12:27:44 2015
From: kevin.brott at gmail.com (Kevin Brott)
Date: Tue, 24 Feb 2015 17:27:44 -0800
Subject: Current 6.8 git build issues on HP-UX
In-Reply-To: <CALDDTe3LbnBrDduJWAMFMvLKVLbTTFC86KPhdRLQqjnepS8Ycw@mail.gmail.com>
References: <CAMv58rbQ5+Lr+H+dnQ9EEMafj65BDmCCq_4=Lz7bb5Z8cqV5Eg@mail.gmail.com>
 <20150224220457.GA10067@gate.dtucker.net>
 <20150224221322.GA13006@gate.dtucker.net>
 <20150224222001.GB13006@gate.dtucker.net>
 <CAMv58rYkEtAxLj0Ae1KcHtEnZsOWRNqennromb5GjWK9_kU1dQ@mail.gmail.com>
 <CALDDTe3LbnBrDduJWAMFMvLKVLbTTFC86KPhdRLQqjnepS8Ycw@mail.gmail.com>
Message-ID: <CAMv58rbKb+fvjZDdF=nRbv5dfSdWn+7ir9xWcPW2DMZeK0x3iA@mail.gmail.com>

On Tue, Feb 24, 2015 at 4:16 PM, Darren Tucker <dtucker at zip.com.au> wrote:

>
> Whitespace mangled in the mail?
>
> I put up a copy here:
> http://www.dtucker.net/~dtucker/tmp/openssh-progname.patch
>
> failing that, try patch -l ?
>

That patch applies to the git clone I just pulled -
so - guessing some ramdom whitespace, although I usually have no trouble
grabbing patches from the raw email. 
I'll push it over and run the compile later, as I'm taking the wife to the
Alton
B
rown show in
just a bit.


-- 
# include <stddisclaimer.h>
/* Kevin  Brott <Kevin.Brott at gmail.com> */

From dtucker at zip.com.au  Wed Feb 25 12:34:25 2015
From: dtucker at zip.com.au (Darren Tucker)
Date: Tue, 24 Feb 2015 20:34:25 -0500
Subject: Current 6.8 git build issues on HP-UX
In-Reply-To: <alpine.UW2.2.11.1502241627060.295@server01.int.multitalents.net>
References: <CAMv58rbQ5+Lr+H+dnQ9EEMafj65BDmCCq_4=Lz7bb5Z8cqV5Eg@mail.gmail.com>
 <CALDDTe0udz-ZA8uWufecSSHBzAUDOda9g_RGi5LJ+e=GGG-7ow@mail.gmail.com>
 <alpine.UW2.2.11.1502241627060.295@server01.int.multitalents.net>
Message-ID: <CALDDTe0fp_WtC4hU6jY6G5ajXnMiU8PEAVrZp8g53mX6ZAgQ+Q@mail.gmail.com>

On Tue, Feb 24, 2015 at 7:37 PM, Tim Rice <tim at multitalents.net> wrote:
>
> | does replacing "inline" with "__inline__" work?  Failing that, removing
> | inline entirely?
>
> I just changed __inline__ to inline so we don't want to go that direction.


yeah but if it worked we could have done #ifdef whatever #define __inline__
inline ... so they both worked


> We already use "static inline void" in openbsd-compat/arc4random.c.
> Puzzling.
>

Now that's weird.  Also "static inline int" in sshbuf.c and addrmatch.c.

Oh!  The ones that work #include "includes.h" and cipher-aesctr,c doesn't.
 "inline" must be defined in the headers somewhere (the system ones, it's
not in ours).

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.

From dtucker at zip.com.au  Wed Feb 25 13:28:32 2015
From: dtucker at zip.com.au (Darren Tucker)
Date: Tue, 24 Feb 2015 21:28:32 -0500
Subject: Current 6.8 git build issues on HP-UX
In-Reply-To: <CALDDTe0fp_WtC4hU6jY6G5ajXnMiU8PEAVrZp8g53mX6ZAgQ+Q@mail.gmail.com>
References: <CAMv58rbQ5+Lr+H+dnQ9EEMafj65BDmCCq_4=Lz7bb5Z8cqV5Eg@mail.gmail.com>
 <CALDDTe0udz-ZA8uWufecSSHBzAUDOda9g_RGi5LJ+e=GGG-7ow@mail.gmail.com>
 <alpine.UW2.2.11.1502241627060.295@server01.int.multitalents.net>
 <CALDDTe0fp_WtC4hU6jY6G5ajXnMiU8PEAVrZp8g53mX6ZAgQ+Q@mail.gmail.com>
Message-ID: <CALDDTe0XYZqY5TZ7NWJkD6X44mfe4JdY+Yv5sy6kLGwTn7cGLQ@mail.gmail.com>

On Tue, Feb 24, 2015 at 8:34 PM, Darren Tucker <dtucker at zip.com.au> wrote:

> Oh!  The ones that work #include "includes.h" and cipher-aesctr,c doesn't.
>

Also, cipher-aesctr.c starts like this:

#include <sys/types.h>
#include <string.h>

#ifndef WITH_OPENSSL
[rest of file]

so there was no way for WITH_OPENSSL to get set since configure puts it in
config.h so we were always compiling this file where it was needed or not.
I've just committed the change to add includes.h.

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.

From tim at multitalents.net  Wed Feb 25 17:34:47 2015
From: tim at multitalents.net (Tim Rice)
Date: Tue, 24 Feb 2015 22:34:47 -0800 (PST)
Subject: Current 6.8 git build issues on HP-UX
In-Reply-To: <CALDDTe0fp_WtC4hU6jY6G5ajXnMiU8PEAVrZp8g53mX6ZAgQ+Q@mail.gmail.com>
References: <CAMv58rbQ5+Lr+H+dnQ9EEMafj65BDmCCq_4=Lz7bb5Z8cqV5Eg@mail.gmail.com>
 <CALDDTe0udz-ZA8uWufecSSHBzAUDOda9g_RGi5LJ+e=GGG-7ow@mail.gmail.com>
 <alpine.UW2.2.11.1502241627060.295@server01.int.multitalents.net>
 <CALDDTe0fp_WtC4hU6jY6G5ajXnMiU8PEAVrZp8g53mX6ZAgQ+Q@mail.gmail.com>
Message-ID: <alpine.UW2.2.11.1502242230090.15332@server01.int.multitalents.net>

On Tue, 24 Feb 2015, Darren Tucker wrote:

| On Tue, Feb 24, 2015 at 7:37 PM, Tim Rice <tim at multitalents.net> wrote:
| 
| > We already use "static inline void" in openbsd-compat/arc4random.c.
| > Puzzling.
| >
| 
| Now that's weird.  Also "static inline int" in sshbuf.c and addrmatch.c.
| 
| Oh!  The ones that work #include "includes.h" and cipher-aesctr,c doesn't.
|  "inline" must be defined in the headers somewhere (the system ones, it's
| not in ours).

Maybe some compilers handle "static inline int" but not "static inline void".
Looking again at openbsd-compat/arc4random.c I see inline defined to nothing
for the non GCC case.

-- 
Tim Rice				Multitalents
tim at multitalents.net



From hexumg at gmail.com  Wed Feb 25 23:12:39 2015
From: hexumg at gmail.com (Eugene Bright)
Date: Wed, 25 Feb 2015 16:12:39 +0400
Subject: Does ssh-keygen really allow 521 bit ECDSA key generation?
Message-ID: <CAMEXTZraO6itjrWy9rHi6d8gSZXYRpkSjRuNwmvV3bSnG9nX9Q@mail.gmail.com>

Hello!

I found strange sentence in ssh-keygen man page. There is may be a misprint.

*-b* *bits*Specifies the number of bits in the key to create. For RSA keys,
the minimum size is 768 bits and the default is 2048 bits. Generally, 2048
bits is considered sufficient. DSA keys must be exactly 1024 bits as
specified by FIPS 186-2. For ECDSA keys, the *-b* flag determines the key
length by selecting from one of three elliptic curve sizes: 256, 384 or 521
bits. Attempting to use bit lengths other than these three values for ECDSA
keys will fail. Ed25519 keys have a fixed length and the *-b* flag will be
ignored.

Regards,
Eugene Bright.

From list at eworm.de  Wed Feb 25 23:56:17 2015
From: list at eworm.de (Christian Hesse)
Date: Wed, 25 Feb 2015 13:56:17 +0100
Subject: Does ssh-keygen really allow 521 bit ECDSA key generation?
In-Reply-To: <CAMEXTZraO6itjrWy9rHi6d8gSZXYRpkSjRuNwmvV3bSnG9nX9Q@mail.gmail.com>
References: <CAMEXTZraO6itjrWy9rHi6d8gSZXYRpkSjRuNwmvV3bSnG9nX9Q@mail.gmail.com>
Message-ID: <20150225135617.4d4af637@leda.localdomain>

Eugene Bright <hexumg at gmail.com> on Wed, 2015/02/25 16:12:
> Hello!
> 
> I found strange sentence in ssh-keygen man page. There is may be a misprint.

You are referring the fact that 521 is not the power of base 2?
Looks like this is valid nevertheless.

% ssh-keygen -t ecdsa -b 512
Invalid ECDSA key length - valid lengths are 256, 384 or 521 bits
% ssh-keygen -t ecdsa -b 521
Generating public/private ecdsa key pair.
[...]

Wikipedia adds a note about this as well:

http://en.wikipedia.org/wiki/Elliptic_curve_cryptography#cite_note-25
-- 
main(a){char*c=/*    Schoene Gruesse                         */"B?IJj;MEH"
"CX:;",b;for(a/*    Chris           get my mail address:    */=0;b=c[a++];)
putchar(b-1/(/*               gcc -o sig sig.c && ./sig    */b/42*2-3)*42);}
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 473 bytes
Desc: OpenPGP digital signature
URL: <http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20150225/24b83358/attachment.bin>

From clabbe.montjoie at gmail.com  Thu Feb 26 00:09:18 2015
From: clabbe.montjoie at gmail.com (LABBE Corentin)
Date: Wed, 25 Feb 2015 14:09:18 +0100
Subject: [openssh with openssl cryptodev engine] sshd killed by seccomp filter
Message-ID: <20150225130918.GA21519@Red>

Hello

I have a server with an hardware crypto accelator.
For giving userspace access to it I use the cryptodev module (http://cryptodev-linux.org/)
I have also the cryptodev engine compiled in openssl.

When I modprobe the cryptodev module, I cannot login with ssh on the server.

The symptom can be found with dmesg:
audit: type=1326 audit(1424784807.257:3): auid=4294967295 uid=22 gid=22 ses=4294967295 pid=17725 comm="sshd" exe="/usr/sbin/sshd" sig=31 arch=40000028 syscall=54 compat=0 ip=0xb6be809c code=0x0

sshd is killed by SIGSYS, because it try to use the ioctl call which is forbiden by the seccomp filter.
If you check the openssl engine code, it use ioctl on /dev/crypto.

The following patch solve the issue:
--- sandbox-seccomp-filter.c.old	2015-02-24 14:52:01.000000000 +0100
+++ sandbox-seccomp-filter.c	2015-02-24 15:45:08.000000000 +0100
@@ -98,6 +98,7 @@
 #ifdef __NR_time /* not defined on EABI ARM */
 	SC_ALLOW(time),
 #endif
+	SC_ALLOW(ioctl),
 	SC_ALLOW(read),
 	SC_ALLOW(write),
 	SC_ALLOW(close),


Thanks


From cloos at jhcloos.com  Thu Feb 26 00:49:56 2015
From: cloos at jhcloos.com (James Cloos)
Date: Wed, 25 Feb 2015 08:49:56 -0500
Subject: Does ssh-keygen really allow 521 bit ECDSA key generation?
In-Reply-To: <CAMEXTZraO6itjrWy9rHi6d8gSZXYRpkSjRuNwmvV3bSnG9nX9Q@mail.gmail.com>
 (Eugene Bright's message of "Wed, 25 Feb 2015 16:12:39 +0400")
References: <CAMEXTZraO6itjrWy9rHi6d8gSZXYRpkSjRuNwmvV3bSnG9nX9Q@mail.gmail.com>
Message-ID: <m3oaoi3xtn.fsf@carbon.jhcloos.org>

>>>>> "EB" == Eugene Bright <hexumg at gmail.com> writes:

EB> I found strange sentence in ssh-keygen man page. There is may be a misprint.

No, that is correct.

They couldn't find a good prime slightly under 512 bits, so chose the
Mersenne prime 2^521 - 1.

-JimC
-- 
James Cloos <cloos at jhcloos.com>         OpenPGP: 0x997A9F17ED7DAEA6

From kevin.brott at gmail.com  Thu Feb 26 03:50:12 2015
From: kevin.brott at gmail.com (Kevin Brott)
Date: Wed, 25 Feb 2015 08:50:12 -0800
Subject: Current 6.8 git build issues on HP-UX
In-Reply-To: <CAMv58rbxj6o7QSCVxDhWQ_4oOX6eoOacW5vq6Obb6Ri==GmcsQ@mail.gmail.com>
References: <CAMv58rbQ5+Lr+H+dnQ9EEMafj65BDmCCq_4=Lz7bb5Z8cqV5Eg@mail.gmail.com>
 <CALDDTe0udz-ZA8uWufecSSHBzAUDOda9g_RGi5LJ+e=GGG-7ow@mail.gmail.com>
 <alpine.UW2.2.11.1502241627060.295@server01.int.multitalents.net>
 <CALDDTe0fp_WtC4hU6jY6G5ajXnMiU8PEAVrZp8g53mX6ZAgQ+Q@mail.gmail.com>
 <CAMv58rbgcA-DZpxDtnosO_5ZcmNXsZWVXQC2qX++Z3XoXb8OwQ@mail.gmail.com>
 <CALDDTe3TTXHCdqDxP8n3=hQ8pWZ_YtouLwKtzUR0sxYvcj1AEA@mail.gmail.com>
 <CAMv58rbxj6o7QSCVxDhWQ_4oOX6eoOacW5vq6Obb6Ri==GmcsQ@mail.gmail.com>
Message-ID: <CAMv58rYexUk_upNOOtd7ZoL_EsDF8M1qiF9SRk0G04oSf+xT6w@mail.gmail.com>

Interestingly enough if I re-run 'make tests' using HP-UX cc it continues
into the tests because it actuall did build regress netcat! (not executable
- but it's there) ...

run test connect.sh ...
ssh connect with protocol 1 failed
ssh connect with protocol 2 failed
failed simple connect

Which is exactly where the gcc build fails - it just doesn't die at the
netcat build.

=====

On Wed, Feb 25, 2015 at 8:34 AM, Kevin Brott <kevin.brott at gmail.com> wrote:

> On Tue, Feb 24, 2015 at 6:48 PM, Darren Tucker <dtucker at zip.com.au> wrote:
>
>> On Tue, Feb 24, 2015 at 9:08 PM, Kevin Brott <kevin.brott at gmail.com>
>> wrote:
>>>
>>> The __inline__ substitution did not work - but removing 'inline' did
>>> in getting past that failure
>>> .  Had to do it again on the just-patched clone to get past that failure
>>>
>>
>> I think I've just commited a fix for this.
>>
>>
>>> Patch almost worked ... still complains about ntohs.
>>>
>>
>> That should be a macro.  On Linux and OpenBSD it's in <arpa/inet.h>.  My
>> guess is it's somewhere different on HPUX.  Can you check the man page
>> and/or grep /usr/include ?
>>
>>
> ntohs shows up in
>   /usr/include/arpa/inet.h
>   /usr/include/netinet/in.h
>   /usr/include/sys/byteorder.h
>
> The byteorder(3N) manpage says this:
> SYNOPSIS
>       #include <netinet/in.h>
>       _XOPEN_SOURCE_EXTENDED only
>       #include <arpa/inet.h>
>       unsigned long htonl(unsigned long hostlong);
>       unsigned short htons(unsigned short hostshort);
>       unsigned long ntohl(unsigned long netlong);
>       unsigned short ntohs(unsigned short netshort);
>
>  DESCRIPTION
>       These routines convert 16- and 32-bit quantities between network
> byte order and host byte order.  On HP-UX systems, network and host byte
> orders are identical, so these routines are defined as null macros in
> the include file <netinet/in.h>.  If _XOPEN_SOURCE_EXTENDED is defined
> then these routines are defined in the include file <arpa/inet.h>.
>
> N
> ot sure what to think of that - my include-fu is weak.
>
>>
>>           redefinition of macro "_NSIG" (declared at line 829 of
>>> "./defines.h")
>>>   #    define _NSIG       45
>>>
>>
>> I think I've fixed that too.  You should be able to "git pull" to pick up
>> both changes.
>>
>>
>
> Yup - fixed in the snapshot and the latest git pull - however HP cc is
> still puking on ntohs missing during the linking of netcat.
>
> BTW on that last gcc ruin - the tests failed on simple connect - going to
> retry here in a bit and see if the latest tree is still puking.
>
> --
> # include <stddisclaimer.h>
> /* Kevin  Brott <Kevin.Brott at gmail.com> */
>
>


-- 
# include <stddisclaimer.h>
/* Kevin  Brott <Kevin.Brott at gmail.com> */

From dtucker at zip.com.au  Thu Feb 26 04:09:54 2015
From: dtucker at zip.com.au (Darren Tucker)
Date: Wed, 25 Feb 2015 12:09:54 -0500
Subject: Current 6.8 git build issues on HP-UX
In-Reply-To: <CAMv58rYexUk_upNOOtd7ZoL_EsDF8M1qiF9SRk0G04oSf+xT6w@mail.gmail.com>
References: <CAMv58rbQ5+Lr+H+dnQ9EEMafj65BDmCCq_4=Lz7bb5Z8cqV5Eg@mail.gmail.com>
 <CALDDTe0udz-ZA8uWufecSSHBzAUDOda9g_RGi5LJ+e=GGG-7ow@mail.gmail.com>
 <alpine.UW2.2.11.1502241627060.295@server01.int.multitalents.net>
 <CALDDTe0fp_WtC4hU6jY6G5ajXnMiU8PEAVrZp8g53mX6ZAgQ+Q@mail.gmail.com>
 <CAMv58rbgcA-DZpxDtnosO_5ZcmNXsZWVXQC2qX++Z3XoXb8OwQ@mail.gmail.com>
 <CALDDTe3TTXHCdqDxP8n3=hQ8pWZ_YtouLwKtzUR0sxYvcj1AEA@mail.gmail.com>
 <CAMv58rbxj6o7QSCVxDhWQ_4oOX6eoOacW5vq6Obb6Ri==GmcsQ@mail.gmail.com>
 <CAMv58rYexUk_upNOOtd7ZoL_EsDF8M1qiF9SRk0G04oSf+xT6w@mail.gmail.com>
Message-ID: <CALDDTe2_oxvkCmyE2Fjw=HwR0YU_8JSN_Cj=y-0XyaHNgK17dQ@mail.gmail.com>

On Wed, Feb 25, 2015 at 11:50 AM, Kevin Brott <kevin.brott at gmail.com> wrote:

>
> Interestingly enough if I re-run 'make tests' using HP-UX cc it continues
> into the tests because it actuall did build regress netcat! (not executable
> - but it's there) ...
>
> run test connect.sh ...
> ssh connect with protocol 1 failed
> ssh connect with protocol 2 failed
> failed simple connect
>

The files failed-ssh.log and failed-sshd.log in the regress directory
should give some clues about why it failed.  Could you please post them?

Thanks.

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.

From dtucker at zip.com.au  Thu Feb 26 04:16:45 2015
From: dtucker at zip.com.au (Darren Tucker)
Date: Wed, 25 Feb 2015 12:16:45 -0500
Subject: Current 6.8 git build issues on HP-UX
In-Reply-To: <alpine.UW2.2.11.1502241655060.295@server01.int.multitalents.net>
References: <CAMv58rbQ5+Lr+H+dnQ9EEMafj65BDmCCq_4=Lz7bb5Z8cqV5Eg@mail.gmail.com>
 <20150224220457.GA10067@gate.dtucker.net>
 <20150224221322.GA13006@gate.dtucker.net>
 <20150224222001.GB13006@gate.dtucker.net>
 <20150224222901.GC13006@gate.dtucker.net>
 <alpine.UW2.2.11.1502241655060.295@server01.int.multitalents.net>
Message-ID: <CALDDTe0TYK-fuCk4itXqF-YVPyTjw5hUjW3SCQxxuS=YVGSLkQ@mail.gmail.com>

On Tue, Feb 24, 2015 at 7:58 PM, Tim Rice <tim at multitalents.net> wrote:

> On Wed, 25 Feb 2015, Darren Tucker wrote:
> | On Wed, Feb 25, 2015 at 09:20:01AM +1100, Darren Tucker wrote:
> | Tim: is this sufficient to back out the "Work around finicky USL linker"
> | change?

[...]

> netcat still builds with your patch and backing out the Makfile.in commit.


I've commited the ssh_get_progname change.  Would you like to remove USL
linker workaround?

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.

From djm at mindrot.org  Thu Feb 26 04:21:03 2015
From: djm at mindrot.org (Damien Miller)
Date: Thu, 26 Feb 2015 04:21:03 +1100 (AEDT)
Subject: [openssh with openssl cryptodev engine] sshd killed by seccomp
 filter
In-Reply-To: <20150225130918.GA21519@Red>
References: <20150225130918.GA21519@Red>
Message-ID: <alpine.BSO.2.11.1502260419500.5972@natsu.mindrot.org>

On Wed, 25 Feb 2015, LABBE Corentin wrote:

> Hello
> 
> I have a server with an hardware crypto accelator.
> For giving userspace access to it I use the cryptodev module (http://cryptodev-linux.org/)
> I have also the cryptodev engine compiled in openssl.
> 
> When I modprobe the cryptodev module, I cannot login with ssh on the server.
> 
> The symptom can be found with dmesg:
> audit: type=1326 audit(1424784807.257:3): auid=4294967295 uid=22 gid=22 ses=4294967295 pid=17725 comm="sshd" exe="/usr/sbin/sshd" sig=31 arch=40000028 syscall=54 compat=0 ip=0xb6be809c code=0x0
[snip]
> +	SC_ALLOW(ioctl),

no, sorry. ioctl is too much attack kernel surface and would defeat the
usefulness of the sandbox.

-d

From kevin.brott at gmail.com  Thu Feb 26 04:51:34 2015
From: kevin.brott at gmail.com (Kevin Brott)
Date: Wed, 25 Feb 2015 09:51:34 -0800
Subject: Current 6.8 git build issues on HP-UX
In-Reply-To: <CALDDTe2_oxvkCmyE2Fjw=HwR0YU_8JSN_Cj=y-0XyaHNgK17dQ@mail.gmail.com>
References: <CAMv58rbQ5+Lr+H+dnQ9EEMafj65BDmCCq_4=Lz7bb5Z8cqV5Eg@mail.gmail.com>
 <CALDDTe0udz-ZA8uWufecSSHBzAUDOda9g_RGi5LJ+e=GGG-7ow@mail.gmail.com>
 <alpine.UW2.2.11.1502241627060.295@server01.int.multitalents.net>
 <CALDDTe0fp_WtC4hU6jY6G5ajXnMiU8PEAVrZp8g53mX6ZAgQ+Q@mail.gmail.com>
 <CAMv58rbgcA-DZpxDtnosO_5ZcmNXsZWVXQC2qX++Z3XoXb8OwQ@mail.gmail.com>
 <CALDDTe3TTXHCdqDxP8n3=hQ8pWZ_YtouLwKtzUR0sxYvcj1AEA@mail.gmail.com>
 <CAMv58rbxj6o7QSCVxDhWQ_4oOX6eoOacW5vq6Obb6Ri==GmcsQ@mail.gmail.com>
 <CAMv58rYexUk_upNOOtd7ZoL_EsDF8M1qiF9SRk0G04oSf+xT6w@mail.gmail.com>
 <CALDDTe2_oxvkCmyE2Fjw=HwR0YU_8JSN_Cj=y-0XyaHNgK17dQ@mail.gmail.com>
Message-ID: <CAMv58rZhh8BHJ=jHUNQ6rt3QFs9DnYWxM2vtAyg9R_WW3R6yOg@mail.gmail.com>

On Wed, Feb 25, 2015 at 9:09 AM, Darren Tucker <dtucker at zip.com.au> wrote:

> The files failed-ssh.log and failed-sshd.log in the regress directory
> should give some clues about why it failed.  Could you please post them?
>
>
>
Here goes ... If the list pukes on these I'll crunch them and post them
somewhere.

-- 
# include <stddisclaimer.h>
/* Kevin  Brott <Kevin.Brott at gmail.com> */
-------------- next part --------------
A non-text attachment was scrubbed...
Name: failed-regress.log
Type: text/x-log
Size: 167 bytes
Desc: not available
URL: <http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20150225/0d4097d6/attachment-0003.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: failed-ssh.log
Type: text/x-log
Size: 11690 bytes
Desc: not available
URL: <http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20150225/0d4097d6/attachment-0004.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: failed-sshd.log
Type: text/x-log
Size: 12357 bytes
Desc: not available
URL: <http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20150225/0d4097d6/attachment-0005.bin>

From tim at multitalents.net  Thu Feb 26 05:00:42 2015
From: tim at multitalents.net (Tim Rice)
Date: Wed, 25 Feb 2015 10:00:42 -0800 (PST)
Subject: Current 6.8 git build issues on HP-UX
In-Reply-To: <CALDDTe0TYK-fuCk4itXqF-YVPyTjw5hUjW3SCQxxuS=YVGSLkQ@mail.gmail.com>
References: <CAMv58rbQ5+Lr+H+dnQ9EEMafj65BDmCCq_4=Lz7bb5Z8cqV5Eg@mail.gmail.com>
 <20150224220457.GA10067@gate.dtucker.net>
 <20150224221322.GA13006@gate.dtucker.net>
 <20150224222001.GB13006@gate.dtucker.net>
 <20150224222901.GC13006@gate.dtucker.net>
 <alpine.UW2.2.11.1502241655060.295@server01.int.multitalents.net>
 <CALDDTe0TYK-fuCk4itXqF-YVPyTjw5hUjW3SCQxxuS=YVGSLkQ@mail.gmail.com>
Message-ID: <alpine.UW2.2.11.1502250959520.28142@server01.int.multitalents.net>

On Wed, 25 Feb 2015, Darren Tucker wrote:

> On Tue, Feb 24, 2015 at 7:58 PM, Tim Rice <tim at multitalents.net> wrote:
> 
[...]
> > netcat still builds with your patch and backing out the Makfile.in commit.
> 
> 
> I've commited the ssh_get_progname change.  Would you like to remove USL
> linker workaround?

Done.

-- 
Tim Rice				Multitalents
tim at multitalents.net



From dtucker at zip.com.au  Thu Feb 26 05:42:37 2015
From: dtucker at zip.com.au (Darren Tucker)
Date: Wed, 25 Feb 2015 13:42:37 -0500
Subject: Current 6.8 git build issues on HP-UX
In-Reply-To: <CAMv58rZhh8BHJ=jHUNQ6rt3QFs9DnYWxM2vtAyg9R_WW3R6yOg@mail.gmail.com>
References: <CAMv58rbQ5+Lr+H+dnQ9EEMafj65BDmCCq_4=Lz7bb5Z8cqV5Eg@mail.gmail.com>
 <CALDDTe0udz-ZA8uWufecSSHBzAUDOda9g_RGi5LJ+e=GGG-7ow@mail.gmail.com>
 <alpine.UW2.2.11.1502241627060.295@server01.int.multitalents.net>
 <CALDDTe0fp_WtC4hU6jY6G5ajXnMiU8PEAVrZp8g53mX6ZAgQ+Q@mail.gmail.com>
 <CAMv58rbgcA-DZpxDtnosO_5ZcmNXsZWVXQC2qX++Z3XoXb8OwQ@mail.gmail.com>
 <CALDDTe3TTXHCdqDxP8n3=hQ8pWZ_YtouLwKtzUR0sxYvcj1AEA@mail.gmail.com>
 <CAMv58rbxj6o7QSCVxDhWQ_4oOX6eoOacW5vq6Obb6Ri==GmcsQ@mail.gmail.com>
 <CAMv58rYexUk_upNOOtd7ZoL_EsDF8M1qiF9SRk0G04oSf+xT6w@mail.gmail.com>
 <CALDDTe2_oxvkCmyE2Fjw=HwR0YU_8JSN_Cj=y-0XyaHNgK17dQ@mail.gmail.com>
 <CAMv58rZhh8BHJ=jHUNQ6rt3QFs9DnYWxM2vtAyg9R_WW3R6yOg@mail.gmail.com>
Message-ID: <CALDDTe0NAXLa3EamrqLV9rcgzUB_Qiq6QxRsW79K-BW3vxi7Hw@mail.gmail.com>

On Wed, Feb 25, 2015 at 12:51 PM, Kevin Brott <kevin.brott at gmail.com> wrote:

>
> On Wed, Feb 25, 2015 at 9:09 AM, Darren Tucker <dtucker at zip.com.au> wrote:
>
>> The files failed-ssh.log and failed-sshd.log in the regress directory
>> should give some clues about why it failed.  Could you please post them?
>>
>>
>>
> Here goes ... If the list pukes on these I'll crunch them and post them
> somewhere.
>

Dunno if they made the list, but I got them.  The problem is in the sshd
log:

debug3: mm_answer_pwnamallow
debug2: parse_server_config: config reprocess config len 450
User compile not allowed because account is locked

so sshd thinks the account is "locked', which configure defines for HPUX as:

AC_DEFINE([LOCKED_PASSWD_STRING], ["*"],

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.

From tgc at jupiterrise.com  Thu Feb 26 08:55:59 2015
From: tgc at jupiterrise.com (Tom G. Christensen)
Date: Wed, 25 Feb 2015 22:55:59 +0100
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <alpine.UW2.2.11.1502241251440.295@server01.int.multitalents.net>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <54EB7DCE.5080708@jupiterrise.com>
 <alpine.BSO.2.11.1502240630420.4503@natsu.mindrot.org>
 <54EB9A20.4080102@jupiterrise.com>
 <alpine.BSO.2.11.1502240905040.4503@natsu.mindrot.org>
 <54ECAA54.7020504@jupiterrise.com>
 <alpine.BSO.2.11.1502250619180.19907@natsu.mindrot.org>
 <alpine.UW2.2.11.1502241251440.295@server01.int.multitalents.net>
Message-ID: <54EE44EF.7050803@jupiterrise.com>

On 24/02/15 21:56, Tim Rice wrote:
> On Wed, 25 Feb 2015, Damien Miller wrote:
>
> | On Tue, 24 Feb 2015, Tom G. Christensen wrote:
> |
> | > I've switched to HEAD in the git repo and it now builds on Solaris
> | > 2.6, 7, 8 and 9 but the testsuite still cannot be built due to the
> | > missing <err.h>.
>
> The err.h issue is fixes but there still msghdr structure differences
> to deal with.
>

Yes I saw that later.

The testsuite build fails on Solaris 2.6 thusly:
regress/netcat.c: In function 'timeout_connect':
regress/netcat.c:703: warning: passing argument 2 of 'connect' discards 
qualifiers from pointer target type
regress/netcat.c:709: warning: passing argument 4 of 'getsockopt' from 
incompatible pointer type
regress/netcat.c: In function 'local_listen':
regress/netcat.c:735: warning: unused variable 'x'
regress/netcat.c:735: warning: unused variable 'ret'
regress/netcat.c: In function 'fdpass':
regress/netcat.c:1037: error: 'struct msghdr' has no member named 
'msg_control'
regress/netcat.c:1038: error: 'struct msghdr' has no member named 
'msg_controllen'
regress/netcat.c:1039: error: 'struct msghdr' has no member named 
'msg_controllen'
regress/netcat.c:1039: error: 'struct msghdr' has no member named 
'msg_control'
regress/netcat.c: In function 'set_common_sockopts':
regress/netcat.c:1196: warning: passing argument 4 of 'setsockopt' from 
incompatible pointer type
regress/netcat.c:1201: warning: passing argument 4 of 'setsockopt' from 
incompatible pointer type
regress/netcat.c:1206: warning: passing argument 4 of 'setsockopt' from 
incompatible pointer type
regress/netcat.c:1211: warning: passing argument 4 of 'setsockopt' from 
incompatible pointer type
regress/netcat.c: In function 'decode_addrport':
regress/netcat.c:1419: warning: comparison between signed and unsigned
make: *** [regress/netcat] Error 1

I guess that is what you meant about structure differences.
It looks like on Solaris I can choose between msg_accrights* or 
msg_control*/msg_flags in struct msghdr.
The latter requires _XOPEN_SOURCE and _XOPEN_SOURCE_EXTENDED which will 
also require __EXTENSIONS__ or other useful things suddenly go away.

Building openssh with CC="gcc -D__EXTENSIONS__ -D_XOPEN_SOURCE 
-D_XOPEN_SOURCE_EXTENDED" is possible (tested only on Solaris 9 so far).
Unfortunately now that I can finally run the testsuite I see ssh-keygen 
dumps core in keygen-change.sh but all tests before that passes.

$ gdb ssh-keygen
GNU gdb (GDB) 7.8
...
Reading symbols from ssh-keygen...done.
(gdb) core regress/core
[New LWP 1]
Core was generated by 
`/export/home/tgc/buildpkg/openssh/src/openssh-git/ssh-keygen -p -P 
secret1 -N 2'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0xfedb4b14 in strlen () from /usr/lib/libc.so.1
(gdb) bt
#0  0xfedb4b14 in strlen () from /usr/lib/libc.so.1
#1  0xfee07a20 in _doprnt () from /usr/lib/libc.so.1
#2  0xfee095e0 in printf () from /usr/lib/libc.so.1
#3  0x000546b0 in do_change_passphrase (pw=pw at entry=0x92954) at 
ssh-keygen.c:1279
#4  0x00059420 in main (argc=0, argv=0xffbfe664) at ssh-keygen.c:2530
(gdb) fram 3
#3  0x000546b0 in do_change_passphrase (pw=pw at entry=0x92954) at 
ssh-keygen.c:1279
1279            printf("Key has comment '%s'\n", comment);
(gdb) print comment
$1 = 0x0
(gdb)

I've not had time to look into this further and also I've not verified 
if this happens without setting CC.

-tgc

From keisial at gmail.com  Thu Feb 26 09:07:38 2015
From: keisial at gmail.com (=?ISO-8859-1?Q?=C1ngel_Gonz=E1lez?=)
Date: Wed, 25 Feb 2015 23:07:38 +0100
Subject: [openssh with openssl cryptodev engine] sshd killed by seccomp
 filter
In-Reply-To: <alpine.BSO.2.11.1502260419500.5972@natsu.mindrot.org>
References: <20150225130918.GA21519@Red>
 <alpine.BSO.2.11.1502260419500.5972@natsu.mindrot.org>
Message-ID: <54EE47AA.1050209@gmail.com>

On 25/02/15 18:21, Damien Miller wrote:
> On Wed, 25 Feb 2015, LABBE Corentin wrote:
>> +	SC_ALLOW(ioctl),
> no, sorry. ioctl is too much attack kernel surface and would defeat the
> usefulness of the sandbox.
>
> -d
Labbe, which ioctl is being issued?


From djm at mindrot.org  Thu Feb 26 09:28:52 2015
From: djm at mindrot.org (Damien Miller)
Date: Thu, 26 Feb 2015 09:28:52 +1100 (AEDT)
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <54EE44EF.7050803@jupiterrise.com>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <54EB7DCE.5080708@jupiterrise.com>
 <alpine.BSO.2.11.1502240630420.4503@natsu.mindrot.org>
 <54EB9A20.4080102@jupiterrise.com>
 <alpine.BSO.2.11.1502240905040.4503@natsu.mindrot.org>
 <54ECAA54.7020504@jupiterrise.com>
 <alpine.BSO.2.11.1502250619180.19907@natsu.mindrot.org>
 <alpine.UW2.2.11.1502241251440.295@server01.int.multitalents.net>
 <54EE44EF.7050803@jupiterrise.com>
Message-ID: <alpine.BSO.2.11.1502260928240.5972@natsu.mindrot.org>

On Wed, 25 Feb 2015, Tom G. Christensen wrote:

> On 24/02/15 21:56, Tim Rice wrote:
> > On Wed, 25 Feb 2015, Damien Miller wrote:
> > 
> > | On Tue, 24 Feb 2015, Tom G. Christensen wrote:
> > |
> > | > I've switched to HEAD in the git repo and it now builds on Solaris
> > | > 2.6, 7, 8 and 9 but the testsuite still cannot be built due to the
> > | > missing <err.h>.
> > 
> > The err.h issue is fixes but there still msghdr structure differences
> > to deal with.
> > 
> 
> Yes I saw that later.
> 
> The testsuite build fails on Solaris 2.6 thusly:
[...]
> regress/netcat.c:1037: error: 'struct msghdr' has no member named
> 'msg_control'

ah, looks like we need to copy some bits from monitor_fdpass.c

-d

From djm at mindrot.org  Thu Feb 26 11:27:29 2015
From: djm at mindrot.org (Damien Miller)
Date: Thu, 26 Feb 2015 11:27:29 +1100 (AEDT)
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <alpine.BSO.2.11.1502260928240.5972@natsu.mindrot.org>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <54EB7DCE.5080708@jupiterrise.com>
 <alpine.BSO.2.11.1502240630420.4503@natsu.mindrot.org>
 <54EB9A20.4080102@jupiterrise.com>
 <alpine.BSO.2.11.1502240905040.4503@natsu.mindrot.org>
 <54ECAA54.7020504@jupiterrise.com>
 <alpine.BSO.2.11.1502250619180.19907@natsu.mindrot.org>
 <alpine.UW2.2.11.1502241251440.295@server01.int.multitalents.net>
 <54EE44EF.7050803@jupiterrise.com>
 <alpine.BSO.2.11.1502260928240.5972@natsu.mindrot.org>
Message-ID: <alpine.BSO.2.11.1502261127040.5972@natsu.mindrot.org>

On Thu, 26 Feb 2015, Damien Miller wrote:

> > Yes I saw that later.
> > 
> > The testsuite build fails on Solaris 2.6 thusly:
> [...]
> > regress/netcat.c:1037: error: 'struct msghdr' has no member named
> > 'msg_control'
> 
> ah, looks like we need to copy some bits from monitor_fdpass.c

Perhaps like this:

diff --git regress/netcat.c regress/netcat.c
index 3f100bd..29e85bf 100644
--- regress/netcat.c
+++ regress/netcat.c
@@ -1014,43 +1014,44 @@ fillbuf(int fd, unsigned char *buf, size_t *bufpos)
 void
 fdpass(int nfd)
 {
-	struct msghdr mh;
+#if defined(HAVE_SENDMSG) && (defined(HAVE_ACCRIGHTS_IN_MSGHDR) || defined(HAVE_CONTROL_IN_MSGHDR))
+	struct msghdr msg;
+#ifndef HAVE_ACCRIGHTS_IN_MSGHDR
 	union {
 		struct cmsghdr hdr;
 		char buf[CMSG_SPACE(sizeof(int))];
 	} cmsgbuf;
 	struct cmsghdr *cmsg;
-	struct iovec iov;
-	char c = '\0';
-	ssize_t r;
+#endif
+	struct iovec vec;
+	char ch = '\0';
 	struct pollfd pfd;
+	ssize_t r;
 
-	/* Avoid obvious stupidity */
-	if (isatty(STDOUT_FILENO))
-		errx(1, "Cannot pass file descriptor to tty");
-
-	bzero(&mh, sizeof(mh));
-	bzero(&cmsgbuf, sizeof(cmsgbuf));
-	bzero(&iov, sizeof(iov));
-	bzero(&pfd, sizeof(pfd));
-
-	mh.msg_control = (caddr_t)&cmsgbuf.buf;
-	mh.msg_controllen = sizeof(cmsgbuf.buf);
-	cmsg = CMSG_FIRSTHDR(&mh);
+	memset(&msg, 0, sizeof(msg));
+#ifdef HAVE_ACCRIGHTS_IN_MSGHDR
+	msg.msg_accrights = (caddr_t)&nfd;
+	msg.msg_accrightslen = sizeof(nfd);
+#else
+	memset(&cmsgbuf, 0, sizeof(cmsgbuf));
+	msg.msg_control = (caddr_t)&cmsgbuf.buf;
+	msg.msg_controllen = sizeof(cmsgbuf.buf);
+	cmsg = CMSG_FIRSTHDR(&msg);
 	cmsg->cmsg_len = CMSG_LEN(sizeof(int));
 	cmsg->cmsg_level = SOL_SOCKET;
 	cmsg->cmsg_type = SCM_RIGHTS;
 	*(int *)CMSG_DATA(cmsg) = nfd;
+#endif
 
-	iov.iov_base = &c;
-	iov.iov_len = 1;
-	mh.msg_iov = &iov;
-	mh.msg_iovlen = 1;
+	vec.iov_base = &ch;
+	vec.iov_len = 1;
+	msg.msg_iov = &vec;
+	msg.msg_iovlen = 1;
 
 	bzero(&pfd, sizeof(pfd));
 	pfd.fd = STDOUT_FILENO;
 	for (;;) {
-		r = sendmsg(STDOUT_FILENO, &mh, 0);
+		r = sendmsg(STDOUT_FILENO, &msg, 0);
 		if (r == -1) {
 			if (errno == EAGAIN || errno == EINTR) {
 				pfd.events = POLLOUT;
@@ -1065,6 +1066,9 @@ fdpass(int nfd)
 			break;
 	}
 	exit(0);
+#else
+	errx(1, "%s: file descriptor passing not supported", __func__);
+#endif
 }
 
 /* Deal with RFC 854 WILL/WONT DO/DONT negotiation. */

From stapelberg+openssh at google.com  Fri Feb 27 02:07:22 2015
From: stapelberg+openssh at google.com (Michael Stapelberg)
Date: Thu, 26 Feb 2015 07:07:22 -0800
Subject: [PATCH] U2F support in OpenSSH
In-Reply-To: <CA+kHd+fDaxT3g7oMeOVy+xsXUWv=+mjZfdPmrF0ytAbSjrSP8g@mail.gmail.com>
References: <CAH9Oa-awx3T-h=+X-RWjJhxoZYu8KpTZB1vywhQEfACXN-OV6A@mail.gmail.com>
 <CA+kHd+fDaxT3g7oMeOVy+xsXUWv=+mjZfdPmrF0ytAbSjrSP8g@mail.gmail.com>
Message-ID: <CAH9Oa-beZU=utOu0QYOy-BVKnY3gk5VF2XyvcuGbG9diQu8HRA@mail.gmail.com>

At this point it should be obvious, but let me state that I don?t have
motivation/time to spend on this right now, given that upstream shows 0
interest in this at all :(.

Hence, any help on this is welcome.

On Sat, Dec 27, 2014 at 1:53 AM, Thomas Habets <thomas at habets.se> wrote:

> On 24 December 2014 at 18:57, Michael Stapelberg
> <stapelberg+openssh at google.com> wrote:
> > In case you?re interested, please feel free to try the patch. I?m happy
> for
> > any feedback. All you need is libu2f-host installed and a clean copy of
> > OpenSSH 6.7p1. Apply the attached patch, delete configure, use autoreconf
> > -i to regenerate it, then run ./configure --with-u2f and compile OpenSSH.
>
> Transferring my notes from the other thread:
>
> 1) PAM doesn't work (--with-pam, then UsePAM yes and
> ChallengeResponseAuthentication yes)
> Fix: detect loops in ssh2connect:userauth_u2f in some other way, such
> as a dedicated variable in authctxt. (but also see point 5)
>
> 2) origin doesn't seem to be respected by YubiKeys (if I understand
> the spec correctly)
> Is AppID a better choice for this reason?
>
> 3) Include paths (probably bug in libu2f-host)
> This is https://github.com/Yubico/libu2f-host/issues/13 that you filed.
>
> 4) What happened to 51?
>         MONITOR_REQ_TERM = 50,
> +       MONITOR_REQ_READUSERU2FKEY = 52, MONITOR_ANS_READUSERU2FKEY = 53,
>
> 5) Why does registration connect to the server anyway, if the server
> doesn't keep state and origin is not tied to the server pubkey?
> Indeed, without AuthenticationMethods registration returns the blob before
> password prompt is shown.
> Registration only makes sense if server writes the key handle to
> ~/.ssh/authorized_keys, right?
> Hmm, unless authorized_keys is signed by the server, the registration
> process will never be "online" asyway, as U2F intends, so it may as
> well be generated on the client and copy-pasted into the server's
> authorized_keys. Enforced origin (but point 2) should prevent
> accidentally pasting the same blob to multiple servers).
>
> Tested on:
> Ubunty Trusty
> OpenSSH 6.7p1
> Yubikey Security key
>
>
> --
> typedef struct me_s {
>  char name[]      = { "Thomas Habets" };
>  char email[]     = { "thomas at habets.pp.se" };
>  char kernel[]    = { "Linux" };
>  char *pgpKey[]   = { "http://www.habets.pp.se/pubkey.txt" };
>  char pgp[] = { "A8A3 D1DD 4AE0 8467 7FDE  0945 286A E90A AD48 E854" };
>  char coolcmd[]   = { "echo '. ./_&. ./_'>_;. ./_" };
> } me_t;
>

From peter at stuge.se  Fri Feb 27 02:33:26 2015
From: peter at stuge.se (Peter Stuge)
Date: Thu, 26 Feb 2015 16:33:26 +0100
Subject: [PATCH] U2F support in OpenSSH
In-Reply-To: <CAH9Oa-beZU=utOu0QYOy-BVKnY3gk5VF2XyvcuGbG9diQu8HRA@mail.gmail.com>
References: <CAH9Oa-awx3T-h=+X-RWjJhxoZYu8KpTZB1vywhQEfACXN-OV6A@mail.gmail.com>
 <CA+kHd+fDaxT3g7oMeOVy+xsXUWv=+mjZfdPmrF0ytAbSjrSP8g@mail.gmail.com>
 <CAH9Oa-beZU=utOu0QYOy-BVKnY3gk5VF2XyvcuGbG9diQu8HRA@mail.gmail.com>
Message-ID: <20150226153326.14042.qmail@stuge.se>

Michael Stapelberg wrote:
> At this point it should be obvious, but let me state that I don?t have
> motivation/time to spend on this right now, given that upstream shows 0
> interest in this at all :(

What do you expect? It's a significant change, a seemingly convoluted
specification and there was no discussion with upstream before
embarking on the project.


> Hence, any help on this is welcome.

FWIW, if u2f must not be the sole authentication then that should of
course be checked by the code.


//Peter

From stapelberg+openssh at google.com  Fri Feb 27 02:53:43 2015
From: stapelberg+openssh at google.com (Michael Stapelberg)
Date: Thu, 26 Feb 2015 07:53:43 -0800
Subject: [PATCH] U2F support in OpenSSH
In-Reply-To: <20150226153326.14042.qmail@stuge.se>
References: <CAH9Oa-awx3T-h=+X-RWjJhxoZYu8KpTZB1vywhQEfACXN-OV6A@mail.gmail.com>
 <CA+kHd+fDaxT3g7oMeOVy+xsXUWv=+mjZfdPmrF0ytAbSjrSP8g@mail.gmail.com>
 <CAH9Oa-beZU=utOu0QYOy-BVKnY3gk5VF2XyvcuGbG9diQu8HRA@mail.gmail.com>
 <20150226153326.14042.qmail@stuge.se>
Message-ID: <CAH9Oa-ZW-BQb_emdTPqr7x0Rno-5VqXt1Zm6pcCVJruWd_izOQ@mail.gmail.com>

On Thu, Feb 26, 2015 at 7:33 AM, Peter Stuge <peter at stuge.se> wrote:

> Michael Stapelberg wrote:
> > At this point it should be obvious, but let me state that I don?t have
> > motivation/time to spend on this right now, given that upstream shows 0
> > interest in this at all :(
>
> What do you expect? It's a significant change, a seemingly convoluted
> specification and there was no discussion with upstream before
> embarking on the project.
>

I agree that it?s a significant change.

With regards to discussion with upstream: before my first post, I looked
for any sort of contributor guidelines on the openssh.org website and
couldn?t find anything. Without any guidelines to go on, my default
approach is to contact upstream by sending a patch, demonstrating the
feasibility of what I?m suggesting.

If this is not the way OpenSSH works, it?s worth documenting that somewhere
prominent, so that new contributors are made aware of that. GitHub for
example promotes a special file called CONTRIBUTING.md:
https://github.com/blog/1184-contributing-guidelines

With regards to what I expect: regardless of how I initially contacted
upstream, I still think that not even getting as much as ?Oh, I can imagine
we would like to eventually merge this, please give me a month to get back
to you? from upstream is very discouraging. I also want to point out that I
have sent my first initial request for comments on 2014-11-05, which by now
is almost 4 months ago. I do understand and acknowledge that we are all
busy people with little time, but from what I can tell upstream?s opinion
might as well be ?this will never get in?, and then I?d just be wasting my
time.

I hope what I just wrote makes some sense (if not, please ask for
clarifications!) and doesn?t offend any of the project members. I wrote it
with the best of intentions, and I really think that the OpenSSH project
should improve in such a situation as the one we?re talking about.


>
>
> > Hence, any help on this is welcome.
>
> FWIW, if u2f must not be the sole authentication then that should of
> course be checked by the code.
>
>
> //Peter
> _______________________________________________
> openssh-unix-dev mailing list
> openssh-unix-dev at mindrot.org
> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
>

From peter at stuge.se  Fri Feb 27 03:20:46 2015
From: peter at stuge.se (Peter Stuge)
Date: Thu, 26 Feb 2015 17:20:46 +0100
Subject: [PATCH] U2F support in OpenSSH
In-Reply-To: <CAH9Oa-ZW-BQb_emdTPqr7x0Rno-5VqXt1Zm6pcCVJruWd_izOQ@mail.gmail.com>
References: <CAH9Oa-awx3T-h=+X-RWjJhxoZYu8KpTZB1vywhQEfACXN-OV6A@mail.gmail.com>
 <CA+kHd+fDaxT3g7oMeOVy+xsXUWv=+mjZfdPmrF0ytAbSjrSP8g@mail.gmail.com>
 <CAH9Oa-beZU=utOu0QYOy-BVKnY3gk5VF2XyvcuGbG9diQu8HRA@mail.gmail.com>
 <20150226153326.14042.qmail@stuge.se>
 <CAH9Oa-ZW-BQb_emdTPqr7x0Rno-5VqXt1Zm6pcCVJruWd_izOQ@mail.gmail.com>
Message-ID: <20150226162046.17911.qmail@stuge.se>

Michael Stapelberg wrote:
> With regards to discussion with upstream: before my first post, I
> looked for any sort of contributor guidelines on the openssh.org
> website and couldn?t find anything. Without any guidelines to go
> on, my default approach is to contact upstream by sending a patch,
> demonstrating the feasibility of what I?m suggesting.

I'd like to suggest that you consider a different default approach
for the future: Communicate with people before investing time in code.

That way you will get to know the project and the project will get to
know you.


> With regards to what I expect: regardless of how I initially contacted
> upstream, I still think that not even getting as much as ?Oh, I can
> imagine we would like to eventually merge this, please give me a
> month to get back to you? from upstream is very discouraging.

Sorry, but there are literally no promises. (See the license, right.)

You can't expect that anyone has time to react to a patch, there is a
universal shortage of developers, and everyone will have priorities
different to yours. :)

Something like u2f might take years or a decade rather than months.
Be patient.

You can of course help free time within the project by observing what
needs doing and then digging in with significant contributions there.


> from what I can tell upstream?s opinion might as well be ?this will
> never get in?, and then I?d just be wasting my time.

Speculation. You (and I) can't tell, there is no expressed opinion.


> I hope what I just wrote makes some sense (if not, please ask for
> clarifications!) and doesn?t offend any of the project members.

FWIW I don't think anyone is offended, but reality in this project is
that random new changes can need a long time. The best thing to do
with your patch right now might be to attach it to a bugzilla bug (if
you haven't already) so that it doesn't get lost in the endless sea
of email.


> really think that the OpenSSH project should improve in such a
> situation as the one we?re talking about.

That happens if and when someone makes it happen. I actually prefer
developers to keep developing. It's a tricky question.


Kind regards

//Peter

From djm at mindrot.org  Fri Feb 27 03:44:00 2015
From: djm at mindrot.org (Damien Miller)
Date: Fri, 27 Feb 2015 03:44:00 +1100 (AEDT)
Subject: [PATCH] U2F support in OpenSSH
In-Reply-To: <CAH9Oa-beZU=utOu0QYOy-BVKnY3gk5VF2XyvcuGbG9diQu8HRA@mail.gmail.com>
References: <CAH9Oa-awx3T-h=+X-RWjJhxoZYu8KpTZB1vywhQEfACXN-OV6A@mail.gmail.com>
 <CA+kHd+fDaxT3g7oMeOVy+xsXUWv=+mjZfdPmrF0ytAbSjrSP8g@mail.gmail.com>
 <CAH9Oa-beZU=utOu0QYOy-BVKnY3gk5VF2XyvcuGbG9diQu8HRA@mail.gmail.com>
Message-ID: <alpine.BSO.2.11.1502270326550.29031@natsu.mindrot.org>

On Thu, 26 Feb 2015, Michael Stapelberg wrote:

> At this point it should be obvious, but let me state that I don?t have
> motivation/time to spend on this right now, given that upstream shows
> 0 interest in this at all :(.

That's not how I recall it. When you approached me last year, I told
you then that I wouldn't have time to properly look at it for months -
I have limited time to work on OpenSSH so I have to chose my priorities
carefully. A new authentication mode for a nascent hardware standard
unfortunately had to take a back seat to a big refactoring that has been
almost-finished for two years.

When you posted your patches to bugzilla, I it took a while for you to
come up with a protocol spec to review which really should have been
starting point before diving in to write code.

Now it's great that the protocol spec is there to look at, but it still
requires more familiarity with the rest of U2F than I have at present.
The code as it stands also AFAIK requires an incompatibly-licensed
helper library. Neither of these problems are insumountable, but they do
make it harder to start.

-d

From stapelberg+openssh at google.com  Fri Feb 27 03:55:58 2015
From: stapelberg+openssh at google.com (Michael Stapelberg)
Date: Thu, 26 Feb 2015 08:55:58 -0800
Subject: [PATCH] U2F support in OpenSSH
In-Reply-To: <alpine.BSO.2.11.1502270326550.29031@natsu.mindrot.org>
References: <CAH9Oa-awx3T-h=+X-RWjJhxoZYu8KpTZB1vywhQEfACXN-OV6A@mail.gmail.com>
 <CA+kHd+fDaxT3g7oMeOVy+xsXUWv=+mjZfdPmrF0ytAbSjrSP8g@mail.gmail.com>
 <CAH9Oa-beZU=utOu0QYOy-BVKnY3gk5VF2XyvcuGbG9diQu8HRA@mail.gmail.com>
 <alpine.BSO.2.11.1502270326550.29031@natsu.mindrot.org>
Message-ID: <CAH9Oa-bY+9sSpQqg2E51J3GpQvrdc=Qi1HbvK-HUqE95mkcM6g@mail.gmail.com>

On Thu, Feb 26, 2015 at 8:44 AM, Damien Miller <djm at mindrot.org> wrote:

> On Thu, 26 Feb 2015, Michael Stapelberg wrote:
>
> > At this point it should be obvious, but let me state that I don?t have
> > motivation/time to spend on this right now, given that upstream shows
> > 0 interest in this at all :(.
>
> That's not how I recall it. When you approached me last year, I told
> you then that I wouldn't have time to properly look at it for months -
>

This didn?t come across well, but it could be that I just misunderstood
what you were saying.


> I have limited time to work on OpenSSH so I have to chose my priorities
> carefully. A new authentication mode for a nascent hardware standard
> unfortunately had to take a back seat to a big refactoring that has been
> almost-finished for two years.
>

That?s definitely fair.


>
> When you posted your patches to bugzilla, I it took a while for you to
> come up with a protocol spec to review which really should have been
> starting point before diving in to write code.
>

Different people have different approaches :).


>
> Now it's great that the protocol spec is there to look at, but it still
> requires more familiarity with the rest of U2F than I have at present.
> The code as it stands also AFAIK requires an incompatibly-licensed
> helper library. Neither of these problems are insumountable, but they do
> make it harder to start.


Agreed. I want to point out that you still haven?t clarified the (to me)
crucial question, so let me ask you directly:

Do you think, right now, based only on the information you have so far,
that you?ll eventually merge a patch adding U2F to OpenSSH? It?s okay to
reverse your decision later and I?m not taking this as a promise, but what
I do want to know is the upstream sentimen, i.e. if you?re rather adverse
to having U2F support in OpenSSH at all.

From djm at mindrot.org  Fri Feb 27 05:57:08 2015
From: djm at mindrot.org (Damien Miller)
Date: Fri, 27 Feb 2015 05:57:08 +1100 (AEDT)
Subject: [PATCH] U2F support in OpenSSH
In-Reply-To: <CAH9Oa-bY+9sSpQqg2E51J3GpQvrdc=Qi1HbvK-HUqE95mkcM6g@mail.gmail.com>
References: <CAH9Oa-awx3T-h=+X-RWjJhxoZYu8KpTZB1vywhQEfACXN-OV6A@mail.gmail.com>
 <CA+kHd+fDaxT3g7oMeOVy+xsXUWv=+mjZfdPmrF0ytAbSjrSP8g@mail.gmail.com>
 <CAH9Oa-beZU=utOu0QYOy-BVKnY3gk5VF2XyvcuGbG9diQu8HRA@mail.gmail.com>
 <alpine.BSO.2.11.1502270326550.29031@natsu.mindrot.org>
 <CAH9Oa-bY+9sSpQqg2E51J3GpQvrdc=Qi1HbvK-HUqE95mkcM6g@mail.gmail.com>
Message-ID: <alpine.BSO.2.11.1502270548280.29031@natsu.mindrot.org>

On Thu, 26 Feb 2015, Michael Stapelberg wrote:

>       Now it's great that the protocol spec is there to look at, but
>       it still
>       requires more familiarity with the rest of U2F than I have at
>       present.
>       The code as it stands also AFAIK requires an
>       incompatibly-licensed
>       helper library. Neither of these problems are insumountable, but
>       they do
>       make it harder to start.
>
>
> Agreed. I want to point out that you still haven?t clarified the (to
> me) crucial question, so let me ask you directly:
>
> Do you think, right now, based only on the information you have so
> far, that you?ll eventually merge a patch adding U2F to OpenSSH? It?s
> okay to reverse your decision later and I?m not taking this as a
> promise, but what I do want to know is the upstream sentimen, i.e. if
> you?re rather adverse to having U2F support in OpenSSH at all.

I'm not opposed to it, but U2F is pretty new and I'd probably like to
see how it pans out for a bit first, both in terms of changes made to
the upstream protocol and in how widely adopted it becomes.

New auth/crypto protocols frequently get revised after some contact with
the wider world so there is a cost for early adopters who frequently
have to maintain both revised and legacy versions.

New protocols also often fail in the market (admittedly less likely
in this case, given the industry support), in which case we're doubly
burdened with the hassle of implementing/merging as well as maintaining
or pissing off users if we deprecate. On the flip side, if there is
wide adoption and consequent demand then that can certainly focus my
attention :)

Of course, I'm speaking only for myself and my own priorities. One of
the other developers might feel differently.

-d

From openssh at roumenpetrov.info  Fri Feb 27 07:14:18 2015
From: openssh at roumenpetrov.info (Roumen Petrov)
Date: Thu, 26 Feb 2015 22:14:18 +0200
Subject: Current 6.8 git build issues on HP-UX
In-Reply-To: <CALDDTe0fp_WtC4hU6jY6G5ajXnMiU8PEAVrZp8g53mX6ZAgQ+Q@mail.gmail.com>
References: <CAMv58rbQ5+Lr+H+dnQ9EEMafj65BDmCCq_4=Lz7bb5Z8cqV5Eg@mail.gmail.com>
 <CALDDTe0udz-ZA8uWufecSSHBzAUDOda9g_RGi5LJ+e=GGG-7ow@mail.gmail.com>
 <alpine.UW2.2.11.1502241627060.295@server01.int.multitalents.net>
 <CALDDTe0fp_WtC4hU6jY6G5ajXnMiU8PEAVrZp8g53mX6ZAgQ+Q@mail.gmail.com>
Message-ID: <54EF7E9A.3050908@roumenpetrov.info>

Darren Tucker wrote:
> On Tue, Feb 24, 2015 at 7:37 PM, Tim Rice <tim at multitalents.net> wrote:
>> | does replacing "inline" with "__inline__" work?  Failing that, removing
>> | inline entirely?
>>
>> I just changed __inline__ to inline so we don't want to go that direction.
>
> yeah but if it worked we could have done #ifdef whatever #define __inline__
> inline ... so they both worked
>
>
>> We already use "static inline void" in openbsd-compat/arc4random.c.
>> Puzzling.
>>
> Now that's weird.  Also "static inline int" in sshbuf.c and addrmatch.c.
>
> Oh!  The ones that work #include "includes.h" and cipher-aesctr,c doesn't.
>   "inline" must be defined in the headers somewhere (the system ones, it's
> not in ours).

AC_C_INLINE is configure macro that deal with inline.
Then ensure that config.h is included into C code.
indirectly it is from "includes.h"


Regards,
Roumen

-- 
Get SSH with X.509 certificate support
http://roumenpetrov.info/openssh/


From tgc at jupiterrise.com  Fri Feb 27 07:33:34 2015
From: tgc at jupiterrise.com (Tom G. Christensen)
Date: Thu, 26 Feb 2015 21:33:34 +0100
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <alpine.BSO.2.11.1502261127040.5972@natsu.mindrot.org>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <54EB7DCE.5080708@jupiterrise.com>
 <alpine.BSO.2.11.1502240630420.4503@natsu.mindrot.org>
 <54EB9A20.4080102@jupiterrise.com>
 <alpine.BSO.2.11.1502240905040.4503@natsu.mindrot.org>
 <54ECAA54.7020504@jupiterrise.com>
 <alpine.BSO.2.11.1502250619180.19907@natsu.mindrot.org>
 <alpine.UW2.2.11.1502241251440.295@server01.int.multitalents.net>
 <54EE44EF.7050803@jupiterrise.com>
 <alpine.BSO.2.11.1502260928240.5972@natsu.mindrot.org>
 <alpine.BSO.2.11.1502261127040.5972@natsu.mindrot.org>
Message-ID: <54EF831E.6010201@jupiterrise.com>

On 26/02/15 01:27, Damien Miller wrote:
> On Thu, 26 Feb 2015, Damien Miller wrote:
>
>>> Yes I saw that later.
>>>
>>> The testsuite build fails on Solaris 2.6 thusly:
>> [...]
>>> regress/netcat.c:1037: error: 'struct msghdr' has no member named
>>> 'msg_control'
>>
>> ah, looks like we need to copy some bits from monitor_fdpass.c
>
> Perhaps like this:
>
<snip>

Seems to work. Tested it with Solaris 2.6 and 9.

ssh-keygen still segfaults in keygen-change.sh.
It works for ssh-ed25519 but the other types segfault.

ssh-keygen -p failed for ssh-rsa-key
ssh-keygen -p failed for ssh-dss-key
ssh-keygen -p failed for ecdsa-sha2-nistp256-key
ssh-keygen -p failed for ecdsa-sha2-nistp384-key
ssh-keygen -p failed for ecdsa-sha2-nistp521-key

Example:
Core was generated by 
`/export/home/tgc/buildpkg/openssh/src/openssh-git/ssh-keygen -p -P 
secret1 -N 2'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0xfedb4b14 in strlen () from /usr/lib/libc.so.1
(gdb) bt
#0  0xfedb4b14 in strlen () from /usr/lib/libc.so.1
#1  0xfee07a20 in _doprnt () from /usr/lib/libc.so.1
#2  0xfee095e0 in printf () from /usr/lib/libc.so.1
#3  0x00054650 in do_change_passphrase (pw=pw at entry=0x92b04) at 
ssh-keygen.c:1279
#4  0x000593c0 in main (argc=0, argv=0xffbfe6ac) at ssh-keygen.c:2530
(gdb) fram 3
#3  0x00054650 in do_change_passphrase (pw=pw at entry=0x92b04) at 
ssh-keygen.c:1279
1279            printf("Key has comment '%s'\n", comment);
(gdb) print comment
$1 = 0x0
(gdb)

$ ./ssh-keygen -q -N secret1 -t ssh-rsa -f /tmp/sshkey
$ ./ssh-keygen -p -P secret1 -N 2secret -f /tmp/sshkey
Segmentation Fault (core dumped)
$

They key seems to be fine though, ssh-keygen from 6.7p1 has no problems 
with it:
$ ssh-keygen -p -P secret1 -N 2secret -f /tmp/sshkey
Key has comment 'rsa w/o comment'
Your identification has been saved with the new passphrase.
$

-tgc

From djm at mindrot.org  Fri Feb 27 07:47:38 2015
From: djm at mindrot.org (Damien Miller)
Date: Fri, 27 Feb 2015 07:47:38 +1100 (AEDT)
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <54EF831E.6010201@jupiterrise.com>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <54EB7DCE.5080708@jupiterrise.com>
 <alpine.BSO.2.11.1502240630420.4503@natsu.mindrot.org>
 <54EB9A20.4080102@jupiterrise.com>
 <alpine.BSO.2.11.1502240905040.4503@natsu.mindrot.org>
 <54ECAA54.7020504@jupiterrise.com>
 <alpine.BSO.2.11.1502250619180.19907@natsu.mindrot.org>
 <alpine.UW2.2.11.1502241251440.295@server01.int.multitalents.net>
 <54EE44EF.7050803@jupiterrise.com>
 <alpine.BSO.2.11.1502260928240.5972@natsu.mindrot.org>
 <alpine.BSO.2.11.1502261127040.5972@natsu.mindrot.org>
 <54EF831E.6010201@jupiterrise.com>
Message-ID: <alpine.BSO.2.11.1502270746390.29031@natsu.mindrot.org>

On Thu, 26 Feb 2015, Tom G. Christensen wrote:

> Seems to work. Tested it with Solaris 2.6 and 9.
> 
> ssh-keygen still segfaults in keygen-change.sh.
> It works for ssh-ed25519 but the other types segfault.

Thanks for the backtrace:

> #3  0x00054650 in do_change_passphrase (pw=pw at entry=0x92b04) at
> ssh-keygen.c:1279

I've commited this fix:

diff --git ssh-keygen.c ssh-keygen.c
index 4a5c402..facee42 100644
--- ssh-keygen.c
+++ ssh-keygen.c
@@ -1276,7 +1276,8 @@ do_change_passphrase(struct passwd *pw)
 		    identity_file, ssh_err(r));
 		exit(1);
 	}
-	printf("Key has comment '%s'\n", comment);
+	if (comment)
+		printf("Key has comment '%s'\n", comment);
 
 	/* Ask the new passphrase (twice). */
 	if (identity_new_passphrase) {

From openssh at contactdaniel.net  Fri Feb 27 08:21:31 2015
From: openssh at contactdaniel.net (Daniel Dent)
Date: Thu, 26 Feb 2015 13:21:31 -0800
Subject: [PATCH] U2F support in OpenSSH
In-Reply-To: <alpine.BSO.2.11.1502270548280.29031@natsu.mindrot.org>
References: <CAH9Oa-awx3T-h=+X-RWjJhxoZYu8KpTZB1vywhQEfACXN-OV6A@mail.gmail.com>
 <CA+kHd+fDaxT3g7oMeOVy+xsXUWv=+mjZfdPmrF0ytAbSjrSP8g@mail.gmail.com>
 <CAH9Oa-beZU=utOu0QYOy-BVKnY3gk5VF2XyvcuGbG9diQu8HRA@mail.gmail.com>
 <alpine.BSO.2.11.1502270326550.29031@natsu.mindrot.org>
 <CAH9Oa-bY+9sSpQqg2E51J3GpQvrdc=Qi1HbvK-HUqE95mkcM6g@mail.gmail.com>
 <alpine.BSO.2.11.1502270548280.29031@natsu.mindrot.org>
Message-ID: <985E9A46-2EAF-4BC5-A7E8-B2EC3ECC1833@contactdaniel.net>


> On Feb 26, 2015, at 10:57 AM, Damien Miller <djm at mindrot.org> wrote:
> On Thu, 26 Feb 2015, Michael Stapelberg wrote:
>> 
>> Do you think, right now, based only on the information you have so
>> far, that you?ll eventually merge a patch adding U2F to OpenSSH? It?s
>> okay to reverse your decision later and I?m not taking this as a
>> promise, but what I do want to know is the upstream sentimen, i.e. if
>> you?re rather adverse to having U2F support in OpenSSH at all.
> 
> I'm not opposed to it, but U2F is pretty new and I'd probably like to
> see how it pans out for a bit first, both in terms of changes made to
> the upstream protocol and in how widely adopted it becomes.

Michael,

I've read through the draft and published versions of the U2F spec and I think there are lots of things to figure out.

The U2F standards really only describe integration with websites and mobile applications. I think the following mental mappings from the standard may be appropriate:

   * Relying Party: The OpenSSH Server
   * U2F Client: The OpenSSH Client
   * Origin: A specific SSH server
   * Registration step: Provides data similar in nature to the public portions of key files which are placed in authorized_keys files. To ease the creation of inexpensive authentication U2F devices, the relying party is responsible for storing this data and providing it during the authentication process.  This allows nearly stateless authentication dongles.
   * Authentication step: Provides evidence of possession of the same device which was used during the registration step.
   * Application ID: This is where things get messy. Applications can have multiple "facets". For example, paypal.com and the PayPal Android/iOS application can both share an application ID, allowing a single enrolment to be re-used for each of these facets of the application. In earlier drafts of the U2F, it was proposed that "paypal.com" and "ebay-payments.com" could choose to share an application ID. In the final draft, the rules around which websites sharing a single application ID appear to have been tightened.  I believe the intention is to improve user privacy (although I'm unclear why mobile applications get an exemption from these concerns).

Unlike Kerberos/GSS, U2F is designed so that one or more users can use the same device with multiple applications while having a distinct identity with each application. That promise relies on the U2F Client (the OpenSSH server) following certain constraints which protect the user.

Origins must only be allowed to request authentication for the application ID with which they are associated. One simple implementation would be to simply have an SSH configuration option specifying which application ID to use.

In the web implementation of U2F there is a list of acceptable facets for an application which is provided at a public HTTPS URL with restrictions designed to allow anonymous access of that URL (no per-user personalization of that URL is allowed). OpenSSH config options could specify how to retrieve the facet list from a file and/or URL (perhaps with a caching mechanism). Facets could be considered as server fingerprints, IP/Port pairs, etc.

U2F also has group device attestation certificates (the same public/private keypair is supposed to be used for an entire manufacturing run). The process for choosing which U2F device manufacturers have a design which adequately protects private keys is a concern which is currently left to implementers. In any event, there needs to be a way to specify which certificates are acceptable (or simply allow users to use any device).

I was not involved in the U2F standardization process so the above is just my personal interpretation of the documents that have been published.

I'm excited at the prospect of U2F authentication for SSH and would be happy to offer additional feedback if it would be helpful.

Regards,

Daniel

---
Daniel Dent
https://www.danieldent.com/
https://twitter.com/DanielDent
https://www.linkedin.com/in/danieldent




From dtucker at zip.com.au  Fri Feb 27 08:27:18 2015
From: dtucker at zip.com.au (Darren Tucker)
Date: Thu, 26 Feb 2015 16:27:18 -0500
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
Message-ID: <CALDDTe0FtdGCBDAAyArZQ6MDXiwDqDi18pLgXB3aV3L-h1+72A@mail.gmail.com>

I noticed this error log spam on the tinderbox when looking at one of the
failures.  It happens with Unix domain socket forwarding is requested:

debug1: channel 1: new [forwarded-streamlocal at openssh.com]
get_socket_address: getnameinfo 1 failed: ai_family not supported
get_sock_port: getnameinfo NI_NUMERICSERV failed: ai_family not supported

I don't think it's contributing to the problem I'm looking at, but I
imagine it'd be pretty annoying for anyone who uses socket forwarding in
anger.  I haven't had time to look at what could reasonably be done to
mitigate it.

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.

From openssh at contactdaniel.net  Fri Feb 27 08:25:34 2015
From: openssh at contactdaniel.net (Daniel Dent)
Date: Thu, 26 Feb 2015 13:25:34 -0800
Subject: [PATCH] U2F support in OpenSSH
In-Reply-To: <985E9A46-2EAF-4BC5-A7E8-B2EC3ECC1833@contactdaniel.net>
References: <CAH9Oa-awx3T-h=+X-RWjJhxoZYu8KpTZB1vywhQEfACXN-OV6A@mail.gmail.com>
 <CA+kHd+fDaxT3g7oMeOVy+xsXUWv=+mjZfdPmrF0ytAbSjrSP8g@mail.gmail.com>
 <CAH9Oa-beZU=utOu0QYOy-BVKnY3gk5VF2XyvcuGbG9diQu8HRA@mail.gmail.com>
 <alpine.BSO.2.11.1502270326550.29031@natsu.mindrot.org>
 <CAH9Oa-bY+9sSpQqg2E51J3GpQvrdc=Qi1HbvK-HUqE95mkcM6g@mail.gmail.com>
 <alpine.BSO.2.11.1502270548280.29031@natsu.mindrot.org>
 <985E9A46-2EAF-4BC5-A7E8-B2EC3ECC1833@contactdaniel.net>
Message-ID: <31150953-08AD-48A3-8E93-4DBB6B738455@contactdaniel.net>


> On Feb 26, 2015, at 1:21 PM, Daniel Dent <openssh at contactdaniel.net> wrote:
> Unlike Kerberos/GSS, U2F is designed so that one or more users can use the same device with multiple applications while having a distinct identity with each application. That promise relies on the U2F Client (the OpenSSH server) following certain constraints which protect the user.
Sorry that should have read "OpenSSH Client".

---
Daniel Dent
https://www.danieldent.com/
https://twitter.com/DanielDent
https://www.linkedin.com/in/danieldent




From djm at mindrot.org  Fri Feb 27 08:34:41 2015
From: djm at mindrot.org (Damien Miller)
Date: Fri, 27 Feb 2015 08:34:41 +1100 (AEDT)
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <CALDDTe0FtdGCBDAAyArZQ6MDXiwDqDi18pLgXB3aV3L-h1+72A@mail.gmail.com>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <CALDDTe0FtdGCBDAAyArZQ6MDXiwDqDi18pLgXB3aV3L-h1+72A@mail.gmail.com>
Message-ID: <alpine.BSO.2.11.1502270833450.29031@natsu.mindrot.org>



On Thu, 26 Feb 2015, Darren Tucker wrote:

> I noticed this error log spam on the tinderbox when looking at one of the
> failures.  It happens with Unix domain socket forwarding is requested:
> 
> debug1: channel 1: new [forwarded-streamlocal at openssh.com]
> get_socket_address: getnameinfo 1 failed: ai_family not supported
> get_sock_port: getnameinfo NI_NUMERICSERV failed: ai_family not supported

That's strange, because we do:

        if (addr.ss_family == AF_UNIX) {
                /* Get the Unix domain socket path. */
                return xstrdup(((struct sockaddr_un *)&addr)->sun_path);
        }

so AF_UNIX should never get to getnameinfo...

From tgc at jupiterrise.com  Fri Feb 27 08:37:10 2015
From: tgc at jupiterrise.com (Tom G. Christensen)
Date: Thu, 26 Feb 2015 22:37:10 +0100
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <alpine.BSO.2.11.1502270746390.29031@natsu.mindrot.org>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <54EB7DCE.5080708@jupiterrise.com>
 <alpine.BSO.2.11.1502240630420.4503@natsu.mindrot.org>
 <54EB9A20.4080102@jupiterrise.com>
 <alpine.BSO.2.11.1502240905040.4503@natsu.mindrot.org>
 <54ECAA54.7020504@jupiterrise.com>
 <alpine.BSO.2.11.1502250619180.19907@natsu.mindrot.org>
 <alpine.UW2.2.11.1502241251440.295@server01.int.multitalents.net>
 <54EE44EF.7050803@jupiterrise.com>
 <alpine.BSO.2.11.1502260928240.5972@natsu.mindrot.org>
 <alpine.BSO.2.11.1502261127040.5972@natsu.mindrot.org>
 <54EF831E.6010201@jupiterrise.com>
 <alpine.BSO.2.11.1502270746390.29031@natsu.mindrot.org>
Message-ID: <54EF9206.4050503@jupiterrise.com>

On 26/02/15 21:47, Damien Miller wrote:
> On Thu, 26 Feb 2015, Tom G. Christensen wrote:
>> ssh-keygen still segfaults in keygen-change.sh.
>> It works for ssh-ed25519 but the other types segfault.
>
> Thanks for the backtrace:
>
>> #3  0x00054650 in do_change_passphrase (pw=pw at entry=0x92b04) at
>> ssh-keygen.c:1279
>
> I've commited this fix:
>

Thanks, keygen-change.sh now passes.

-tgc

From djm at mindrot.org  Fri Feb 27 10:08:07 2015
From: djm at mindrot.org (Damien Miller)
Date: Fri, 27 Feb 2015 10:08:07 +1100 (AEDT)
Subject: valgrind support
Message-ID: <alpine.BSO.2.11.1502270957020.29031@natsu.mindrot.org>

Hi,

I just pushed valgrind support for the regression and unit tests. If you
run "make tests USE_VALGRIND=1" then almost all the tests will be run
under valgrind.

The valgrind output is dumped in regress/valgrind-out with a file per
{ test, binary, PID }. There is no analysis or summarisation yet (want
to help? write a summarisation script)

Some warnings:

First, it's slow. My relatively recent laptop takes a couple of hours to
complete a test run.

Second and related to the first, any test that is borderline flaky because
of timeout-sensitiveity will be more broken with valgrind enabled.

Thirdly, there are some (AFAIK) small memory leaks. Many of these
seem to be things allocated in main() that we don't bother to clean
up (though maybe we will in the future). If you spot something 1) not
allocated in main() and 2) that isn't expected to be needed for the
life of the process then let us know - these are more important and
we'll try to fix them sooner.

Fourthly, if you are running on a CPU for which OpenSSL enables AES-NI
then expect a gazillion spurious memory fault errors. The gory details
of this are documented here[1], but TLDR you can avoid the spam by
telling OpenSSL not to use AES-NI:

OPENSSL_ia32cap="~0x200000000000000" make tests USE_VALGRIND=1

Finally, and most importantly. If you see any valgrind errors about
use of uninitialised memory, use-after-free or other memory faults
then please tell us and we'll fix them immediately.

Either way, if your OS is supported by valgrind then please give it a
try and report back.

-d

[1] http://rt.openssl.org/Ticket/Display.html?id=2862&user=guest&pass=guest

From dtucker at zip.com.au  Fri Feb 27 11:37:43 2015
From: dtucker at zip.com.au (Darren Tucker)
Date: Thu, 26 Feb 2015 19:37:43 -0500
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <alpine.BSO.2.11.1502270833450.29031@natsu.mindrot.org>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <CALDDTe0FtdGCBDAAyArZQ6MDXiwDqDi18pLgXB3aV3L-h1+72A@mail.gmail.com>
 <alpine.BSO.2.11.1502270833450.29031@natsu.mindrot.org>
Message-ID: <CALDDTe1DaVC2QY=LoYC+fhe1=mt4X+R6Z_+khtk_+U96PyEhAg@mail.gmail.com>

On Thu, Feb 26, 2015 at 4:34 PM, Damien Miller <djm at mindrot.org> wrote:

>
>
> On Thu, 26 Feb 2015, Darren Tucker wrote:
>
> > I noticed this error log spam on the tinderbox when looking at one of the
> > failures.  It happens with Unix domain socket forwarding is requested:
> >
> > debug1: channel 1: new [forwarded-streamlocal at openssh.com]
> > get_socket_address: getnameinfo 1 failed: ai_family not supported
> > get_sock_port: getnameinfo NI_NUMERICSERV failed: ai_family not supported
>
> That's strange, because we do:
>
>         if (addr.ss_family == AF_UNIX) {
>                 /* Get the Unix domain socket path. */
>                 return xstrdup(((struct sockaddr_un *)&addr)->sun_path);
>         }
>
> so AF_UNIX should never get to getnameinfo...
>

I added an error() call just before that check and here's what it gave:

debug1: channel 1: new [forwarded-streamlocal at openssh.com]^M
DAZ: fd 10 ss_family 1 expect AF_UNIX 1^M
DAZ: fd 10 ss_family 0 expect AF_UNIX 1^M
get_socket_address: getnameinfo 1 failed: ai_family not supported^M
get_sock_port: getnameinfo NI_NUMERICSERV failed: ai_family not supported^M

looks like something is clearing ss_family?

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.

From djm at mindrot.org  Fri Feb 27 11:46:23 2015
From: djm at mindrot.org (Damien Miller)
Date: Fri, 27 Feb 2015 11:46:23 +1100 (AEDT)
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <CALDDTe1DaVC2QY=LoYC+fhe1=mt4X+R6Z_+khtk_+U96PyEhAg@mail.gmail.com>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <CALDDTe0FtdGCBDAAyArZQ6MDXiwDqDi18pLgXB3aV3L-h1+72A@mail.gmail.com>
 <alpine.BSO.2.11.1502270833450.29031@natsu.mindrot.org>
 <CALDDTe1DaVC2QY=LoYC+fhe1=mt4X+R6Z_+khtk_+U96PyEhAg@mail.gmail.com>
Message-ID: <alpine.BSO.2.11.1502271143220.29031@natsu.mindrot.org>

On Thu, 26 Feb 2015, Darren Tucker wrote:

> I added an error() call just before that check and here's what it gave:
> 
> debug1: channel 1: new [forwarded-streamlocal at openssh.com]^M
> DAZ: fd 10 ss_family 1 expect AF_UNIX 1^M
> DAZ: fd 10 ss_family 0 expect AF_UNIX 1^M
> get_socket_address: getnameinfo 1 failed: ai_family not supported^M
> get_sock_port: getnameinfo NI_NUMERICSERV failed: ai_family not supported^M
> 
> looks like something is clearing ss_family?

Could these be closed sockets? (Though I couldn't see how getsockname/
getpeername could succeed in this case).

Otherwise, is ipv64_normalise_mapped screwing it up?

From dtucker at zip.com.au  Fri Feb 27 12:00:22 2015
From: dtucker at zip.com.au (Darren Tucker)
Date: Thu, 26 Feb 2015 20:00:22 -0500
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <alpine.BSO.2.11.1502271143220.29031@natsu.mindrot.org>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <CALDDTe0FtdGCBDAAyArZQ6MDXiwDqDi18pLgXB3aV3L-h1+72A@mail.gmail.com>
 <alpine.BSO.2.11.1502270833450.29031@natsu.mindrot.org>
 <CALDDTe1DaVC2QY=LoYC+fhe1=mt4X+R6Z_+khtk_+U96PyEhAg@mail.gmail.com>
 <alpine.BSO.2.11.1502271143220.29031@natsu.mindrot.org>
Message-ID: <CALDDTe3CtAgyGxTjeSND-MoHufh72Q6HZt_dO+c78PnXury2PA@mail.gmail.com>

On Thu, Feb 26, 2015 at 7:46 PM, Damien Miller <djm at mindrot.org> wrote:

> On Thu, 26 Feb 2015, Darren Tucker wrote:
>
> > I added an error() call just before that check and here's what it gave:
> >
> > debug1: channel 1: new [forwarded-streamlocal at openssh.com]^M
> > DAZ: fd 10 ss_family 1 expect AF_UNIX 1^M
> > DAZ: fd 10 ss_family 0 expect AF_UNIX 1^M
> > get_socket_address: getnameinfo 1 failed: ai_family not supported^M
> > get_sock_port: getnameinfo NI_NUMERICSERV failed: ai_family not
> supported^M
> >
> > looks like something is clearing ss_family?
>
> Could these be closed sockets? (Though I couldn't see how getsockname/
> getpeername could succeed in this case).
>

possibly, although I don't understand why it gets called twice


> Otherwise, is ipv64_normalise_mapped screwing it up?
>

I think we can rule that out: it returns early for non-ipv6 sockets and if
that was the reason it would have shown up in the log:

       if (addr->ss_family != AF_INET6 ||
            !IN6_IS_ADDR_V4MAPPED(&a6->sin6_addr))
                return;
        debug3("Normalising mapped IPv4 in IPv6 address");

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.

From carson at taltos.org  Fri Feb 27 12:31:26 2015
From: carson at taltos.org (Carson Gaspar)
Date: Thu, 26 Feb 2015 17:31:26 -0800
Subject: valgrind support
In-Reply-To: <alpine.BSO.2.11.1502270957020.29031@natsu.mindrot.org>
References: <alpine.BSO.2.11.1502270957020.29031@natsu.mindrot.org>
Message-ID: <54EFC8EE.7010500@taltos.org>

valgrind: can't create log file 
'/export/data/build/openssh-git/regress//valgrind-out/test_sshbuf.24891': No 
such file or directory

Manually creating the directory allows the tests to move forward.


From carson at taltos.org  Fri Feb 27 12:29:33 2015
From: carson at taltos.org (Carson Gaspar)
Date: Thu, 26 Feb 2015 17:29:33 -0800
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
Message-ID: <54EFC87D.3040000@taltos.org>

I see some issues on Solaris 11.2 (fresh git pull from master, commit 
bd58853102cee739f0e115e6d4b5334332ab1442):

First, linking fails as the system version of OpenSSL does not have 
EC_KEY_free (it's oddly only in the FIPS version...):

cc -m64 -xO5 -xtarget=ivybridge -xarch=sse4_2 -xarch=avx_i -xarch=aes 
-I. -I.  -DSSHDIR=\"/usr/local/etc\" 
-D_PATH_SSH_PROGRAM=\"/usr/local/bin/ssh\" 
-D_PATH_SSH_ASKPASS_DEFAULT=\"/usr/local/libexec/ssh-askpass\" 
-D_PATH_SFTP_SERVER=\"/usr/local/libexec/sftp-server\" 
-D_PATH_SSH_KEY_SIGN=\"/usr/local/libexec/ssh-keysign\" 
-D_PATH_SSH_PKCS11_HELPER=\"/usr/local/libexec/ssh-pkcs11-helper\" 
-D_PATH_SSH_PIDDIR=\"/var/run\" 
-D_PATH_PRIVSEP_CHROOT_DIR=\"/var/empty\" -DHAVE_CONFIG_H -c kex.c -o kex.o
"kex.c", line 98: warning: initializer will be sign-extended: -1
"kex.c", line 436: warning: implicit function declaration: EC_KEY_free

...

cc -o ssh ssh.o readconf.o clientloop.o sshtty.o sshconnect.o 
sshconnect1.o sshconnect2.o mux.o roaming_common.o roaming_client.o -L. 
-Lopenbsd-compat/ -m64 -xO5 -xtarget=ivybridge -xarch=sse4_2 
-xarch=avx_i -xarch=aes -lssh -lopenbsd-compat  -lresolv -lcrypto -lz 
-lsocket -lnsl
ld: warning: symbol 'umac_ctx' has differing sizes:
         (file ./libssh.a(umac.o) value=0x5f8; file 
./libssh.a(umac128.o) value=0x690);
         ./libssh.a(umac128.o) definition taken
Undefined                       first referenced
  symbol                             in file
EC_KEY_free                         ./libssh.a(kex.o)

If I force the usage of a clean openssl-1.0.1k, it builds, but I still see:

ld: warning: symbol 'umac_ctx' has differing sizes:
         (file ./libssh.a(umac.o) value=0x5f8; file 
./libssh.a(umac128.o) value=0x690);
         ./libssh.a(umac128.o) definition taken

which worries me...

Forcing netcat.c to compile by adding -D_XPG4_2 -D__EXTENSIONS__ (as it 
seems the msghdr fixes haven't been commited yet) allows the tests to run.

All tests pass except for hostkey-rotate, which triggers grep errors:

run test hostkey-rotate.sh ...
learn hostkey with StrictHostKeyChecking=no
learn additional hostkeys
learn additional hostkeys, type=ssh-ed25519
learn additional hostkeys, type=ssh-rsa
learn additional hostkeys, type=ssh-dss
learn additional hostkeys, type=ecdsa-sha2-nistp256
learn additional hostkeys, type=ecdsa-sha2-nistp384
learn additional hostkeys, type=ecdsa-sha2-nistp521
learn changed non-primary hostkey
learn new primary hostkey
grep: RE error 41: No remembered search string.
current key missing
grep: RE error 41: No remembered search string.
new key missing
rotate primary hostkey
check rotate primary hostkey
failed hostkey rotate
gmake[1]: *** [t-exec] Error 1

Forcing GNU grep first in PATH allows it to succeed. Switching to the 
Solaris fgrep also allows it to succeed.

diff --git a/regress/hostkey-rotate.sh b/regress/hostkey-rotate.sh
index d964b35..10ea1e9 100644
--- a/regress/hostkey-rotate.sh
+++ b/regress/hostkey-rotate.sh
@@ -42,7 +42,7 @@ check_key_present() {
         test "x$_kfile" = "x" && _kfile="$OBJ/hkr.${_type}.pub"
         _ktext=`awk "/ $_type / { $_prog }" < $OBJ/known_hosts` || \
                 fatal "awk failed"
-       grep -q "$_ktext" $_kfile
+       fgrep "$_ktext" $_kfile >/dev/null
  }

  cp $OBJ/sshd_proxy.orig $OBJ/sshd_proxy




From tim at multitalents.net  Fri Feb 27 12:45:19 2015
From: tim at multitalents.net (Tim Rice)
Date: Thu, 26 Feb 2015 17:45:19 -0800 (PST)
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <alpine.BSO.2.11.1502261127040.5972@natsu.mindrot.org>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <54EB7DCE.5080708@jupiterrise.com>
 <alpine.BSO.2.11.1502240630420.4503@natsu.mindrot.org>
 <54EB9A20.4080102@jupiterrise.com>
 <alpine.BSO.2.11.1502240905040.4503@natsu.mindrot.org>
 <54ECAA54.7020504@jupiterrise.com>
 <alpine.BSO.2.11.1502250619180.19907@natsu.mindrot.org>
 <alpine.UW2.2.11.1502241251440.295@server01.int.multitalents.net>
 <54EE44EF.7050803@jupiterrise.com>
 <alpine.BSO.2.11.1502260928240.5972@natsu.mindrot.org>
 <alpine.BSO.2.11.1502261127040.5972@natsu.mindrot.org>
Message-ID: <alpine.UW2.2.11.1502261239020.17036@server01.int.multitalents.net>

On Thu, 26 Feb 2015, Damien Miller wrote:

| On Thu, 26 Feb 2015, Damien Miller wrote:
| 
| > > Yes I saw that later.
| > > 
| > > The testsuite build fails on Solaris 2.6 thusly:
| > [...]
| > > regress/netcat.c:1037: error: 'struct msghdr' has no member named
| > > 'msg_control'
| > 
| > ah, looks like we need to copy some bits from monitor_fdpass.c
| 
| Perhaps like this:
| 
| diff --git regress/netcat.c regress/netcat.c
[snip]

Netcat now builds on OmniOS and Solaris Express Community Edition.
I'll try it on my Solaris 10 machine the next time I power it up.


-- 
Tim Rice				Multitalents	(707) 456-1146
tim at multitalents.net



From djm at mindrot.org  Fri Feb 27 15:34:23 2015
From: djm at mindrot.org (Damien Miller)
Date: Fri, 27 Feb 2015 15:34:23 +1100 (AEDT)
Subject: valgrind support
In-Reply-To: <54EFC8EE.7010500@taltos.org>
References: <alpine.BSO.2.11.1502270957020.29031@natsu.mindrot.org>
 <54EFC8EE.7010500@taltos.org>
Message-ID: <alpine.BSO.2.11.1502271534040.29031@natsu.mindrot.org>

On Thu, 26 Feb 2015, Carson Gaspar wrote:

> valgrind: can't create log file
> '/export/data/build/openssh-git/regress//valgrind-out/test_sshbuf.24891': No
> such file or directory
> 
> Manually creating the directory allows the tests to move forward.

Thanks, I've pushed a fix

From djm at mindrot.org  Fri Feb 27 15:36:03 2015
From: djm at mindrot.org (Damien Miller)
Date: Fri, 27 Feb 2015 15:36:03 +1100 (AEDT)
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <alpine.UW2.2.11.1502261239020.17036@server01.int.multitalents.net>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <54EB7DCE.5080708@jupiterrise.com>
 <alpine.BSO.2.11.1502240630420.4503@natsu.mindrot.org>
 <54EB9A20.4080102@jupiterrise.com>
 <alpine.BSO.2.11.1502240905040.4503@natsu.mindrot.org>
 <54ECAA54.7020504@jupiterrise.com>
 <alpine.BSO.2.11.1502250619180.19907@natsu.mindrot.org>
 <alpine.UW2.2.11.1502241251440.295@server01.int.multitalents.net>
 <54EE44EF.7050803@jupiterrise.com>
 <alpine.BSO.2.11.1502260928240.5972@natsu.mindrot.org>
 <alpine.BSO.2.11.1502261127040.5972@natsu.mindrot.org>
 <alpine.UW2.2.11.1502261239020.17036@server01.int.multitalents.net>
Message-ID: <alpine.BSO.2.11.1502271535380.29031@natsu.mindrot.org>

On Thu, 26 Feb 2015, Tim Rice wrote:

> Netcat now builds on OmniOS and Solaris Express Community Edition.
> I'll try it on my Solaris 10 machine the next time I power it up.

Thanks - it's not worse at least, so I've committed and pushed it.

From aixtools at gmail.com  Fri Feb 27 23:13:20 2015
From: aixtools at gmail.com (Michael Felt)
Date: Fri, 27 Feb 2015 13:13:20 +0100
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
Message-ID: <CANvxniWkoRH7dadESnsSQ08fFySGOzjqvOqJ=xDvyJbkJw3N9A@mail.gmail.com>

p.s. test was from openssh-SNAP-20150227.tar.gz

On Thu, Feb 19, 2015 at 11:21 PM, Damien Miller <djm at mindrot.org> wrote:

> Hi,
>
> OpenSSH 6.8 is almost ready for release, so we would appreciate testing
> on as many platforms and systems as possible. This release contains
> some substantial new features and a number of bugfixes.
>
> Snapshot releases for portable OpenSSH are available from
> http://www.mindrot.org/openssh_snap/
>
> The OpenBSD version is available in CVS HEAD:
> http://www.openbsd.org/anoncvs.html
>
> Portable OpenSSH is also available via anonymous CVS using the
> instructions at http://www.openssh.com/portable.html#cvs or
> via Git at https://anongit.mindrot.org/openssh.git/
>
> Running the regression tests supplied with Portable OpenSSH does not
> require installation and is a simply:
>
> $ ./configure && make tests
>
> Live testing on suitable non-production systems is also
> appreciated. Please send reports of success or failure to
> openssh-unix-dev at mindrot.org.
>
> Below is a summary of changes. More detail may be found in the ChangeLog
> in the portable OpenSSH tarballs.
>
> Thanks to the many people who contributed to this release.
>
> Changes since OpenSSH 6.7
> =========================
>
> This is a major release, containing a number of new features as
> well as a large internal re-factoring.
>
> Potentially-incompatible changes
> --------------------------------
>
>  * sshd(8): UseDNS now defaults to 'no'. Configurations that match
>    against the client host name (via sshd_config or authorized_keys)
>    may need to re-enable it or convert to matching against addresses.
>
> New Features
> ------------
>
>  * Much of OpenSSH's internal code has been re-factored to be more
>    library-like. These changes are mostly not user-visible, but
>    have greatly improved OpenSSH's testability and internal layout.
>
>  * Add FingerprintHash option to ssh(1) and sshd(8), and equivalent
>    command-line flags to the other tools to control algorithm used
>    for key fingerprints. The default changes from MD5 to SHA256 and
>    format from hex to base64.
>
>    Fingerprints now have the hash algorithm prepended. An example of
>    the new format: SHA256:mVPwvezndPv/ARoIadVY98vAC0g+P/5633yTC4d/wXE
>    Please note that visual host keys will also be different.
>
>  * ssh(1), sshd(8): Host key rotation support. Add a protocol
>    extension for a server to inform a client of all its available
>    host keys after authentication has completed. The client may
>    record the keys in known_hosts, allowing it to upgrade to better
>    host key algorithms and a server to gracefully rotate its keys.
>
>    The client side of this is controlled by a UpdateHostkeys config
>    option (default on).
>
>  * ssh(1): Add a ssh_config HostbasedKeyType option to control which
>    host public key types are tried during host-based authentication.
>
>  * ssh(1), sshd(8): fix connection-killing host key mismatch errors
>    when sshd offers multiple ECDSA keys of different lengths.
>
>  * ssh(1): when host name canonicalisation is enabled, try to
>    parse host names as addresses before looking them up for
>    canonicalisation. fixes bz#2074 and avoiding needless DNS
>    lookups in some cases.
>
>  * ssh-keygen(1), sshd(8): Key Revocation Lists (KRLs) no longer
>    require OpenSSH to be compiled with OpenSSL support.
>
>  * ssh(1), ssh-keysign(8): Make ed25519 keys work for host based
>    authentication.
>
>  * sshd(8): SSH protocol v.1 workaround for the Meyer, et al,
>    Bleichenbacher Side Channel Attack. Fake up a bignum key before
>    RSA decryption.
>
>  * sshd(8): Remember which public keys have been used for
>    authentication and refuse to accept previously-used keys.
>    This allows AuthenticationMethods=publickey,publickey to require
>    that users authenticate using two _different_ public keys.
>
>  * sshd(8): add sshd_config HostbasedAcceptedKeyTypes and
>    PubkeyAcceptedKeyTypes options to allow sshd to control what
>    public key types will be accepted. Currently defaults to all.
>
>  * sshd(8): Don't count partial authentication success as a failure
>    against MaxAuthTries.
>
>  * ssh(1): Add RevokedHostKeys option for the client to allow
>    text-file or KRL-based revocation of host keys.
>
>  * ssh-keygen(1), sshd(8): Permit KRLs that revoke certificates by
>    serial number or key ID without scoping to a particular CA.
>
>  * ssh(1): Add a "Match canonical" criteria that allows ssh_config
>    Match blocks to trigger only in the second config pass.
>
>  * ssh(1): Add a -G option to ssh that causes it to parse its
>    configuration and dump the result to stdout, similar to "sshd -T".
>
>  * ssh(1): Allow Match criteria to be negated. E.g. "Match !host".
>
>  * The regression test suite has been extended to cover more OpenSSH
>    features. The unit tests have been expanded and now cover key
>    exchange.
>
> Bugfixes
> --------
>
>  * ssh-keyscan(1): ssh-keyscan has been made much more robust again
>    servers that hang or violate the SSH protocol.
>
>  * ssh(1), ssh-keygen(1): Fix regression bz#2306: Key path names were
>    being lost as comment fields.
>
>  * ssh(1): Allow ssh_config Port options set in the second config
>    parse phase to be applied (they were being ignored). bz#2286
>
>  * ssh(1): Tweak config re-parsing with host canonicalisation - make
>    the second pass through the config files always run when host name
>    canonicalisation is enabled (and not whenever the host name
>    changes) bz#2267
>
>  * ssh(1): Fix passing of wildcard forward bind addresses when
>    connection multiplexing is in use; bz#2324;
>
>  * ssh-keygen(1): Fix broken private key conversion from non-OpenSSH
>    formats; bz#2345.
>
>  * ssh-keygen(1): Fix KRL generation bug when multiple CAs are in
>    use.
>
>  * Various fixed to manual pages: bz#2288, bz#2316, bz#2273
>
> Portable OpenSSH
> ----------------
>
>  * Support --without-openssl at configure time
>
>    Disables and removes dependency on OpenSSL. Many features,
>    including SSH protocol 1 are not supported and the set of crypto
>    options is greatly restricted. This will only work on system with
>    native arc4random or /dev/urandom.
>
>    Considered highly experimental for now.
>
>  * Support --without-ssh1 option at configure time
>
>    Allows disabling support for SSH protocol 1.
>
>    Still experimental - not all regression and unit tests have been
>    been adapted for the absence of SSH protocol 1.
>
>  * sshd(8): Fix compilation on systems with IPv6 support in utmpx; bz#2296
>
>  * Allow custom service name for sshd on Cygwin. Permits the use of
>    multiple sshd running with different service names.
>
> Reporting Bugs:
> ===============
>
> - Please read http://www.openssh.com/report.html
>   Security bugs should be reported directly to openssh at openssh.com
>
> OpenSSH is brought to you by Markus Friedl, Niels Provos, Theo de Raadt,
> Kevin Steves, Damien Miller, Darren Tucker, Jason McIntyre, Tim Rice and
> Ben Lindstrom.
>
> _______________________________________________
> openssh-unix-dev mailing list
> openssh-unix-dev at mindrot.org
> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
>

From aixtools at gmail.com  Fri Feb 27 23:12:22 2015
From: aixtools at gmail.com (Michael Felt)
Date: Fri, 27 Feb 2015 13:12:22 +0100
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
Message-ID: <CANvxniXjV3kkN8L1Pddz_7fVKK7dp7-+zerRpVutcBR0brbiqg@mail.gmail.com>

OpenSSH has been configured with the following options:
                     User binaries: /opt/bin
                   System binaries: /opt/sbin
               Configuration files: /opt/etc
                   Askpass program: /opt/libexec/ssh-askpass
                      Manual pages: /opt/share/man/manX
                          PID file: /opt/etc
  Privilege separation chroot path: /var/empty
            sshd default user PATH: /usr/bin:/bin:/usr/sbin:/sbin:/opt/bin
                    Manpage format: man
                       PAM support: no
                   OSF SIA support: no
                 KerberosV support: no
                   SELinux support: no
                 Smartcard support:
                     S/KEY support: no
              MD5 password support: no
                   libedit support: no
  Solaris process contract support: no
           Solaris project support: no
       IP address in $DISPLAY hack: no
           Translate v4 in v6 hack: no
                  BSD Auth support: no
              Random number source: OpenSSL internal ONLY
             Privsep sandbox style: rlimit

              Host: powerpc-ibm-aix5.3.0.0
          Compiler: cc -qlanglvl=extc89
    Compiler flags: -g
Preprocessor flags:
      Linker flags:  -blibpath:/usr/lib:/lib
         Libraries: -lcrypto -lz
Just one example - they are all like this:
cc -qlanglvl=extc89 -g  -I. -I.  -DSSHDIR=\"/opt/etc\"
-D_PATH_SSH_PROGRAM=\"/opt/bin/ssh\"
-D_PATH_SSH_ASKPASS_DEFAULT=\"/opt/libexec/ssh-askpass\"
-D_PATH_SFTP_SERVER=\"/opt/libexec/sftp-server\"
-D_PATH_SSH_KEY_SIGN=\"/opt/libexec/ssh-keysign\"
-D_PATH_SSH_PKCS11_HELPER=\"/opt/libexec/ssh-pkcs11-helper\"
-D_PATH_SSH_PIDDIR=\"/opt/etc\" -D_PATH_PRIVSEP_CHROOT_DIR=\"/var/empty\"
-DHAVE_CONFIG_H -c dns.c -o dns.o
"/usr/include/stdarg.h", line 89.9: 1506-236 (W) Macro name va_copy has
been redefined.
"/usr/include/stdarg.h", line 89.9: 1506-358 (I) "va_copy" is defined on
line 838 of defines.h.

...
ranlib libssh.a
cc -qlanglvl=extc89 -o ssh ssh.o readconf.o clientloop.o sshtty.o
sshconnect.o sshconnect1.o sshconnect2.o mux.o roaming_common.o
roaming_client.o -L. -Lopenbsd-compat/  -blibpath:/usr/lib:/lib -lssh
-lopenbsd-compat  -lcrypto -lz
ld: 0711-317 ERROR: Undefined symbol: .va_copy
ld: 0711-317 ERROR: Undefined symbol: .EC_KEY_free
ld: 0711-345 Use the -bloadmap or -bnoquiet option to obtain more
information.

The error above is a bit unusual.
1) It has been seen before that with -qlanglvl=extc89 that va_copy is not
found. This is clear, I think, from the stdarg.h file:

   +88  #ifdef _ISOC99_SOURCE
   +89  #define va_copy(__list1,__list2) ((void)(__list1 = __list2))
   +90  #endif
   +91
   +92  #endif /* _ANSI_C_SOURCE */

I would think that _ISOC99_SOURCE would not be defined with
-qlanglvl=extc89.

2) Simple test:
cat c89.c
#include <stdarg.h>

/*
 * test what gets defined with flag -qlanglvl=extc89 and -qlanglvl=extc99
 */

c89(void *a, void *b)
{

#ifdef _ANSI_C_SOURCE
#ifdef _ISOC99_SOURCE
        va_copy(a,b);
#else
        fake_ansi_copy(a,b);
#endif
#endif
#ifndef _ANSI_C_SOURCE
        fake_noansi_copy(a,b);
#endif
}

main()
{
        char a[4], b[4];
        c89(a,b);
}


root at x064:[/data/prj/openbsd/openssh/openssh]cc -qlanglvl=extc89 -E c89.c
#line 62 "/usr/include/va_list.h"
typedef char *va_list;
#line 7 "c89.c"
c89(void *a, void *b)
{
#line 12
        va_copy(a,b);
#line 20
}

main()
{
        char a[4], b[4];
        c89(a,b);
#line 29
}
root at x064:[/data/prj/openbsd/openssh/openssh]cc -qlanglvl=extc89 c89.c
ld: 0711-317 ERROR: Undefined symbol: .va_copy
ld: 0711-345 Use the -bloadmap or -bnoquiet option to obtain more
information.
root at x064:[/data/prj/openbsd/openssh/openssh]cc -qlanglvl=extc99 -E c89.c
#line 62 "/usr/include/va_list.h"
typedef char *va_list;
#line 7 "c89.c"
c89(void *a, void *b)
{
#line 12
        __builtin_va_copy(a,b);
#line 20
}

main()
{
        char a[4], b[4];
        c89(a,b);
#line 29
}

3) Repeating above steps - prefixed with
CC=xlc
export CC
configure: creating ./config.status
config.status: creating Makefile
config.status: creating buildpkg.sh
config.status: creating opensshd.init
config.status: creating openssh.xml
config.status: creating openbsd-compat/Makefile
config.status: creating openbsd-compat/regress/Makefile
config.status: creating survey.sh
config.status: creating config.h
config.status: config.h is unchanged

OpenSSH has been configured with the following options:
                     User binaries: /opt/bin
                   System binaries: /opt/sbin
               Configuration files: /opt/etc
                   Askpass program: /opt/libexec/ssh-askpass
                      Manual pages: /opt/share/man/manX
                          PID file: /opt/etc
  Privilege separation chroot path: /var/empty
            sshd default user PATH: /usr/bin:/bin:/usr/sbin:/sbin:/opt/bin
                    Manpage format: man
                       PAM support: no
                   OSF SIA support: no
                 KerberosV support: no
                   SELinux support: no
                 Smartcard support:
                     S/KEY support: no
              MD5 password support: no
                   libedit support: no
  Solaris process contract support: no
           Solaris project support: no
       IP address in $DISPLAY hack: no
           Translate v4 in v6 hack: no
                  BSD Auth support: no
              Random number source: OpenSSL internal ONLY
             Privsep sandbox style: rlimit

              Host: powerpc-ibm-aix5.3.0.0
          Compiler: xlc
    Compiler flags: -g
Preprocessor flags:
      Linker flags:  -blibpath:/usr/lib:/lib
         Libraries: -lcrypto -lz


gets rid of all the complaints about va_copy being redefined - but still
end missing
.EC_KEY_free

xlc -o ssh ssh.o readconf.o clientloop.o sshtty.o sshconnect.o
sshconnect1.o sshconnect2.o mux.o roaming_common.o roaming_client.o -L.
-Lopenbsd-compat/  -blibpath:/usr/lib:/lib -lssh -lopenbsd-compat  -lcrypto
-lz
ld: 0711-317 ERROR: Undefined symbol: .EC_KEY_free
ld: 0711-345 Use the -bloadmap or -bnoquiet option to obtain more
information.
make: *** [ssh] Error 8

No idea where this should be coming from (the check in configure is for
0.9.8k as minimum, and that is the level installed)


root at x064:[/data/prj/openbsd/openssh/openssh]lslpp -L | grep openssl
  openssl.base            0.9.8.1101    C     F    Open Secure Socket Layer
  openssl.license         0.9.8.1101    C     F    Open Secure Socket
License
 So this would be building against openssl-0.9.8k (because k is 11th letter)

Conclusion:
regarding CC value: when using IBM C - force to xlc when CC seems to be cc

No idea re: EC_KEY_free (newer openssl needed?)

On Thu, Feb 19, 2015 at 11:21 PM, Damien Miller <djm at mindrot.org> wrote:

> Hi,
>
> OpenSSH 6.8 is almost ready for release, so we would appreciate testing
> on as many platforms and systems as possible. This release contains
> some substantial new features and a number of bugfixes.
>
> Snapshot releases for portable OpenSSH are available from
> http://www.mindrot.org/openssh_snap/
>
> The OpenBSD version is available in CVS HEAD:
> http://www.openbsd.org/anoncvs.html
>
> Portable OpenSSH is also available via anonymous CVS using the
> instructions at http://www.openssh.com/portable.html#cvs or
> via Git at https://anongit.mindrot.org/openssh.git/
>
> Running the regression tests supplied with Portable OpenSSH does not
> require installation and is a simply:
>
> $ ./configure && make tests
>
> Live testing on suitable non-production systems is also
> appreciated. Please send reports of success or failure to
> openssh-unix-dev at mindrot.org.
>
> Below is a summary of changes. More detail may be found in the ChangeLog
> in the portable OpenSSH tarballs.
>
> Thanks to the many people who contributed to this release.
>
> Changes since OpenSSH 6.7
> =========================
>
> This is a major release, containing a number of new features as
> well as a large internal re-factoring.
>
> Potentially-incompatible changes
> --------------------------------
>
>  * sshd(8): UseDNS now defaults to 'no'. Configurations that match
>    against the client host name (via sshd_config or authorized_keys)
>    may need to re-enable it or convert to matching against addresses.
>
> New Features
> ------------
>
>  * Much of OpenSSH's internal code has been re-factored to be more
>    library-like. These changes are mostly not user-visible, but
>    have greatly improved OpenSSH's testability and internal layout.
>
>  * Add FingerprintHash option to ssh(1) and sshd(8), and equivalent
>    command-line flags to the other tools to control algorithm used
>    for key fingerprints. The default changes from MD5 to SHA256 and
>    format from hex to base64.
>
>    Fingerprints now have the hash algorithm prepended. An example of
>    the new format: SHA256:mVPwvezndPv/ARoIadVY98vAC0g+P/5633yTC4d/wXE
>    Please note that visual host keys will also be different.
>
>  * ssh(1), sshd(8): Host key rotation support. Add a protocol
>    extension for a server to inform a client of all its available
>    host keys after authentication has completed. The client may
>    record the keys in known_hosts, allowing it to upgrade to better
>    host key algorithms and a server to gracefully rotate its keys.
>
>    The client side of this is controlled by a UpdateHostkeys config
>    option (default on).
>
>  * ssh(1): Add a ssh_config HostbasedKeyType option to control which
>    host public key types are tried during host-based authentication.
>
>  * ssh(1), sshd(8): fix connection-killing host key mismatch errors
>    when sshd offers multiple ECDSA keys of different lengths.
>
>  * ssh(1): when host name canonicalisation is enabled, try to
>    parse host names as addresses before looking them up for
>    canonicalisation. fixes bz#2074 and avoiding needless DNS
>    lookups in some cases.
>
>  * ssh-keygen(1), sshd(8): Key Revocation Lists (KRLs) no longer
>    require OpenSSH to be compiled with OpenSSL support.
>
>  * ssh(1), ssh-keysign(8): Make ed25519 keys work for host based
>    authentication.
>
>  * sshd(8): SSH protocol v.1 workaround for the Meyer, et al,
>    Bleichenbacher Side Channel Attack. Fake up a bignum key before
>    RSA decryption.
>
>  * sshd(8): Remember which public keys have been used for
>    authentication and refuse to accept previously-used keys.
>    This allows AuthenticationMethods=publickey,publickey to require
>    that users authenticate using two _different_ public keys.
>
>  * sshd(8): add sshd_config HostbasedAcceptedKeyTypes and
>    PubkeyAcceptedKeyTypes options to allow sshd to control what
>    public key types will be accepted. Currently defaults to all.
>
>  * sshd(8): Don't count partial authentication success as a failure
>    against MaxAuthTries.
>
>  * ssh(1): Add RevokedHostKeys option for the client to allow
>    text-file or KRL-based revocation of host keys.
>
>  * ssh-keygen(1), sshd(8): Permit KRLs that revoke certificates by
>    serial number or key ID without scoping to a particular CA.
>
>  * ssh(1): Add a "Match canonical" criteria that allows ssh_config
>    Match blocks to trigger only in the second config pass.
>
>  * ssh(1): Add a -G option to ssh that causes it to parse its
>    configuration and dump the result to stdout, similar to "sshd -T".
>
>  * ssh(1): Allow Match criteria to be negated. E.g. "Match !host".
>
>  * The regression test suite has been extended to cover more OpenSSH
>    features. The unit tests have been expanded and now cover key
>    exchange.
>
> Bugfixes
> --------
>
>  * ssh-keyscan(1): ssh-keyscan has been made much more robust again
>    servers that hang or violate the SSH protocol.
>
>  * ssh(1), ssh-keygen(1): Fix regression bz#2306: Key path names were
>    being lost as comment fields.
>
>  * ssh(1): Allow ssh_config Port options set in the second config
>    parse phase to be applied (they were being ignored). bz#2286
>
>  * ssh(1): Tweak config re-parsing with host canonicalisation - make
>    the second pass through the config files always run when host name
>    canonicalisation is enabled (and not whenever the host name
>    changes) bz#2267
>
>  * ssh(1): Fix passing of wildcard forward bind addresses when
>    connection multiplexing is in use; bz#2324;
>
>  * ssh-keygen(1): Fix broken private key conversion from non-OpenSSH
>    formats; bz#2345.
>
>  * ssh-keygen(1): Fix KRL generation bug when multiple CAs are in
>    use.
>
>  * Various fixed to manual pages: bz#2288, bz#2316, bz#2273
>
> Portable OpenSSH
> ----------------
>
>  * Support --without-openssl at configure time
>
>    Disables and removes dependency on OpenSSL. Many features,
>    including SSH protocol 1 are not supported and the set of crypto
>    options is greatly restricted. This will only work on system with
>    native arc4random or /dev/urandom.
>
>    Considered highly experimental for now.
>
>  * Support --without-ssh1 option at configure time
>
>    Allows disabling support for SSH protocol 1.
>
>    Still experimental - not all regression and unit tests have been
>    been adapted for the absence of SSH protocol 1.
>
>  * sshd(8): Fix compilation on systems with IPv6 support in utmpx; bz#2296
>
>  * Allow custom service name for sshd on Cygwin. Permits the use of
>    multiple sshd running with different service names.
>
> Reporting Bugs:
> ===============
>
> - Please read http://www.openssh.com/report.html
>   Security bugs should be reported directly to openssh at openssh.com
>
> OpenSSH is brought to you by Markus Friedl, Niels Provos, Theo de Raadt,
> Kevin Steves, Damien Miller, Darren Tucker, Jason McIntyre, Tim Rice and
> Ben Lindstrom.
>
> _______________________________________________
> openssh-unix-dev mailing list
> openssh-unix-dev at mindrot.org
> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
>

From aixtools at gmail.com  Sat Feb 28 00:07:11 2015
From: aixtools at gmail.com (Michael Felt)
Date: Fri, 27 Feb 2015 14:07:11 +0100
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <alpine.BSO.2.11.1502200945050.4850@natsu.mindrot.org>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <alpine.BSO.2.11.1502200945050.4850@natsu.mindrot.org>
Message-ID: <CANvxniW13J+3UREHECtbwZd8sLBt+Q3EYT+Z5FKzy7mQGC_tDA@mail.gmail.com>

Update - for AIX 6.1 TL9 -
configure: creating ./config.status
config.status: creating Makefile
config.status: creating buildpkg.sh
config.status: creating opensshd.init
config.status: creating openssh.xml
config.status: creating openbsd-compat/Makefile
config.status: creating openbsd-compat/regress/Makefile
config.status: creating survey.sh
config.status: creating config.h

OpenSSH has been configured with the following options:
                     User binaries: /opt/bin
                   System binaries: /opt/sbin
               Configuration files: /opt/etc
                   Askpass program: /opt/libexec/ssh-askpass
                      Manual pages: /opt/share/man/manX
                          PID file: /var/run
  Privilege separation chroot path: /var/empty
            sshd default user PATH: /usr/bin:/bin:/usr/sbin:/sbin:/opt/bin
                    Manpage format: man
                       PAM support: no
                   OSF SIA support: no
                 KerberosV support: no
                   SELinux support: no
                 Smartcard support:
                     S/KEY support: no
              MD5 password support: no
                   libedit support: no
  Solaris process contract support: no
           Solaris project support: no
       IP address in $DISPLAY hack: no
           Translate v4 in v6 hack: no
                  BSD Auth support: no
              Random number source: OpenSSL internal ONLY
             Privsep sandbox style: rlimit

              Host: powerpc-ibm-aix6.1.0.0
          Compiler: xlc
    Compiler flags: -g
Preprocessor flags:
      Linker flags:  -blibpath:/usr/lib:/lib
         Libraries: -lcrypto -lz

michael at x071:[/home/michael]lslpp -L | grep ssl
  openssl.base             1.0.1.510    C     F    Open Secure Socket Layer
  openssl.man.en_US        1.0.1.510    C     F    Open Secure Socket Layer

...
        tests && echo all tests passed
make[1]: Entering directory `/data/prj/openbsd/openssh/openssh/regress'
set -e ; if test -z "" ; then \

/data/prj/openbsd/openssh/openssh/regress/unittests/sshbuf/test_sshbuf ; \

/data/prj/openbsd/openssh/openssh/regress/unittests/sshkey/test_sshkey \
                -d
/data/prj/openbsd/openssh/openssh/regress/unittests/sshkey/testdata ; \

/data/prj/openbsd/openssh/openssh/regress/unittests/bitmap/test_bitmap ; \
        /data/prj/openbsd/openssh/openssh/regress/unittests/kex/test_kex ; \

/data/prj/openbsd/openssh/openssh/regress/unittests/hostkeys/test_hostkeys \
                -d
/data/prj/openbsd/openssh/openssh/regress/unittests/hostkeys/testdata ; \
fi
test_sshbuf:
...................................................................................................
100 tests ok
test_sshkey:
.............................................................................................

...
many minutes later ...
...
learn new primary hostkey
rotate primary hostkey
check rotate primary hostkey
ok hostkey rotate
make[1]: Leaving directory `/data/prj/openbsd/openssh/openssh/regress'
all tests passed



On Thu, Feb 19, 2015 at 11:45 PM, Damien Miller <djm at mindrot.org> wrote:

> On Fri, 20 Feb 2015, Damien Miller wrote:
>
> > Hi,
> >
> > OpenSSH 6.8 is almost ready for release, so we would appreciate testing
> > on as many platforms and systems as possible. This release contains
> > some substantial new features and a number of bugfixes.
>
> ...
>
> >  * ssh(1), sshd(8): Host key rotation support. Add a protocol
> >    extension for a server to inform a client of all its available
> >    host keys after authentication has completed. The client may
> >    record the keys in known_hosts, allowing it to upgrade to better
> >    host key algorithms and a server to gracefully rotate its keys.
> >
> >    The client side of this is controlled by a UpdateHostkeys config
> >    option (default on).
>
> Actually, the default is off. You can enable it using UpdateHostKeys=yes
> or UpdateHostKeys=ask
>
> -d
> _______________________________________________
> openssh-unix-dev mailing list
> openssh-unix-dev at mindrot.org
> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
>

From aixtools at gmail.com  Sat Feb 28 01:19:03 2015
From: aixtools at gmail.com (Michael Felt)
Date: Fri, 27 Feb 2015 15:19:03 +0100
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <CANvxniW13J+3UREHECtbwZd8sLBt+Q3EYT+Z5FKzy7mQGC_tDA@mail.gmail.com>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <alpine.BSO.2.11.1502200945050.4850@natsu.mindrot.org>
 <CANvxniW13J+3UREHECtbwZd8sLBt+Q3EYT+Z5FKzy7mQGC_tDA@mail.gmail.com>
Message-ID: <CANvxniVGvPjvZgOvsS6YXyLm5r=an1-OvzcnH6Lxu3GfKSXCnw@mail.gmail.com>

New test - using AIX 5.3 TL7 - but against libressl-2.1.4

configure: creating ./config.status
config.status: creating Makefile
config.status: creating buildpkg.sh
config.status: creating opensshd.init
config.status: creating openssh.xml
config.status: creating openbsd-compat/Makefile
config.status: creating openbsd-compat/regress/Makefile
config.status: creating survey.sh
config.status: creating config.h
config.status: config.h is unchanged

OpenSSH has been configured with the following options:
                     User binaries: /opt/bin
                   System binaries: /opt/sbin
               Configuration files: /opt/etc
                   Askpass program: /opt/libexec/ssh-askpass
                      Manual pages: /opt/share/man/manX
                          PID file: /opt/etc
  Privilege separation chroot path: /var/empty
            sshd default user PATH: /usr/bin:/bin:/usr/sbin:/sbin:/opt/bin
                    Manpage format: man
                       PAM support: no
                   OSF SIA support: no
                 KerberosV support: no
                   SELinux support: no
                 Smartcard support:
                     S/KEY support: no
              MD5 password support: no
                   libedit support: no
  Solaris process contract support: no
           Solaris project support: no
       IP address in $DISPLAY hack: no
           Translate v4 in v6 hack: no
                  BSD Auth support: no
              Random number source: OpenSSL internal ONLY
             Privsep sandbox style: rlimit

              Host: powerpc-ibm-aix5.3.0.0
          Compiler: xlc
    Compiler flags: -g
Preprocessor flags: -I/opt/libressl/include
      Linker flags: -L/opt/libressl/lib  -blibpath:/usr/lib:/lib
         Libraries: -lcrypto -lz

One problem coming directly is that the -L flag (-L/opt/libressl/lib is not
being included in the -blibpath so the programs link, but do not run.
I am sure there is a way for me to modify the blibpath - BUT - I ask you do
consider inserting an openssl-dir path when it is not
already in the blibpath variable.

rm ssh
make
xlc -o ssh ssh.o readconf.o clientloop.o sshtty.o sshconnect.o
sshconnect1.o sshconnect2.o mux.o roaming_common.o roaming_client.o -L.
-Lopenbsd-compat/ -L/opt/libressl/lib  -blibpath:/usr/lib:/lib -lssh
-lopenbsd-compat  -lcrypto -lz

root at x064:[/data/prj/openbsd/openssh/openssh]dump -H ssh

ssh:

                        ***Loader Section***
                      Loader Header Information
VERSION#         #SYMtableENT     #RELOCent        LENidSTR
0x00000001       0x0000014a       0x0000075a       0x0000003b

#IMPfilID        OFFidSTR         LENstrTBL        OFFstrTBL
0x00000003       0x00007748       0x00000c6d       0x00007783


                        ***Import File Strings***
INDEX  PATH                          BASE
MEMBER
0
/usr/lib:/lib
1                                    libc.a
shr.o
2                                    libcrypto.a
libcrypto.so.32
root at x064:[/data/prj/openbsd/openssh/openssh]ldd ssh
ssh needs:
         /usr/lib/libc.a(shr.o)
         /usr/lib/libcrypto.a(libcrypto.so.32)
ar: 0707-109 Member name libcrypto.so.32 does not exist.
dump: /tmp/tmpdir733264/extract/libcrypto.so.32: 0654-106 Cannot open the
specified file.
         /unix
         /usr/lib/libcrypt.a(shr.o)

Modified blibpath:

xlc -o ssh ssh.o readconf.o clientloop.o sshtty.o sshconnect.o
sshconnect1.o sshconnect2.o mux.o roaming_common.o roaming_client.o -L.
-Lopenbsd-compat/ -L/opt/libressl/lib  -blibpath:/opt/libressl/
lib:/usr/lib:/lib -lssh -lopenbsd-compat  -lcrypto -lz

root at x064:[/data/prj/openbsd/openssh/openssh]ldd ssh
ssh needs:
         /usr/lib/libc.a(shr.o)
         /opt/libressl/lib/libcrypto.a(libcrypto.so.32)
         /unix
         /usr/lib/libcrypt.a(shr.o)
         /usr/lib/libperfstat.a(shr.o)
         /usr/lib/libpthread.a(shr_xpg5.o)
         /usr/lib/libpthreads.a(shr_xpg5.o)
         /usr/lib/libcfg.a(shr.o)
         /usr/lib/libodm.a(shr.o)
         /usr/lib/liblvm.a(shr.o)
         /usr/lib/libpthreads.a(shr_comm.o)

This can be corrected with LIBPATH

root at x064:[/data/prj/openbsd/openssh/openssh]ldd
ssh
ssh needs:
         /usr/lib/libc.a(shr.o)
         /usr/lib/libcrypto.a(libcrypto.so.32)
ar: 0707-109 Member name libcrypto.so.32 does not exist.
dump: /tmp/tmpdir733294/extract/libcrypto.so.32: 0654-106 Cannot open the
specified file.
         /unix
         /usr/lib/libcrypt.a(shr.o)

root at x064:[/data/prj/openbsd/openssh/openssh]LIBPATH=/opt/libressl/lib ldd
ssh
ssh needs:
         /usr/lib/libc.a(shr.o)
         /opt/libressl/lib/libcrypto.a(libcrypto.so.32)
         /unix
         /usr/lib/libcrypt.a(shr.o)
         /usr/lib/libperfstat.a(shr.o)
         /usr/lib/libpthread.a(shr_xpg5.o)
         /usr/lib/libpthreads.a(shr_xpg5.o)
         /usr/lib/libcfg.a(shr.o)
         /usr/lib/libodm.a(shr.o)
         /usr/lib/liblvm.a(shr.o)
         /usr/lib/libpthreads.a(shr_comm.o)


I shall use LIBPATH - and post - I expect all test successful - later.

On Fri, Feb 27, 2015 at 2:07 PM, Michael Felt <aixtools at gmail.com> wrote:

> Update - for AIX 6.1 TL9 -
> configure: creating ./config.status
> config.status: creating Makefile
> config.status: creating buildpkg.sh
> config.status: creating opensshd.init
> config.status: creating openssh.xml
> config.status: creating openbsd-compat/Makefile
> config.status: creating openbsd-compat/regress/Makefile
> config.status: creating survey.sh
> config.status: creating config.h
>
> OpenSSH has been configured with the following options:
>                      User binaries: /opt/bin
>                    System binaries: /opt/sbin
>                Configuration files: /opt/etc
>                    Askpass program: /opt/libexec/ssh-askpass
>                       Manual pages: /opt/share/man/manX
>                           PID file: /var/run
>   Privilege separation chroot path: /var/empty
>             sshd default user PATH: /usr/bin:/bin:/usr/sbin:/sbin:/opt/bin
>                     Manpage format: man
>                        PAM support: no
>                    OSF SIA support: no
>                  KerberosV support: no
>                    SELinux support: no
>                  Smartcard support:
>                      S/KEY support: no
>               MD5 password support: no
>                    libedit support: no
>   Solaris process contract support: no
>            Solaris project support: no
>        IP address in $DISPLAY hack: no
>            Translate v4 in v6 hack: no
>                   BSD Auth support: no
>               Random number source: OpenSSL internal ONLY
>              Privsep sandbox style: rlimit
>
>               Host: powerpc-ibm-aix6.1.0.0
>           Compiler: xlc
>     Compiler flags: -g
> Preprocessor flags:
>       Linker flags:  -blibpath:/usr/lib:/lib
>          Libraries: -lcrypto -lz
>
> michael at x071:[/home/michael]lslpp -L | grep ssl
>   openssl.base             1.0.1.510    C     F    Open Secure Socket Layer
>   openssl.man.en_US        1.0.1.510    C     F    Open Secure Socket Layer
>
> ...
>         tests && echo all tests passed
> make[1]: Entering directory `/data/prj/openbsd/openssh/openssh/regress'
> set -e ; if test -z "" ; then \
>
> /data/prj/openbsd/openssh/openssh/regress/unittests/sshbuf/test_sshbuf ; \
>
> /data/prj/openbsd/openssh/openssh/regress/unittests/sshkey/test_sshkey \
>                 -d
> /data/prj/openbsd/openssh/openssh/regress/unittests/sshkey/testdata ; \
>
> /data/prj/openbsd/openssh/openssh/regress/unittests/bitmap/test_bitmap ; \
>         /data/prj/openbsd/openssh/openssh/regress/unittests/kex/test_kex ;
> \
>
> /data/prj/openbsd/openssh/openssh/regress/unittests/hostkeys/test_hostkeys \
>                 -d
> /data/prj/openbsd/openssh/openssh/regress/unittests/hostkeys/testdata ; \
> fi
> test_sshbuf:
> ...................................................................................................
> 100 tests ok
> test_sshkey:
> .............................................................................................
>
> ...
> many minutes later ...
> ...
> learn new primary hostkey
> rotate primary hostkey
> check rotate primary hostkey
> ok hostkey rotate
> make[1]: Leaving directory `/data/prj/openbsd/openssh/openssh/regress'
> all tests passed
>
>
>
> On Thu, Feb 19, 2015 at 11:45 PM, Damien Miller <djm at mindrot.org> wrote:
>
>> On Fri, 20 Feb 2015, Damien Miller wrote:
>>
>> > Hi,
>> >
>> > OpenSSH 6.8 is almost ready for release, so we would appreciate testing
>> > on as many platforms and systems as possible. This release contains
>> > some substantial new features and a number of bugfixes.
>>
>> ...
>>
>> >  * ssh(1), sshd(8): Host key rotation support. Add a protocol
>> >    extension for a server to inform a client of all its available
>> >    host keys after authentication has completed. The client may
>> >    record the keys in known_hosts, allowing it to upgrade to better
>> >    host key algorithms and a server to gracefully rotate its keys.
>> >
>> >    The client side of this is controlled by a UpdateHostkeys config
>> >    option (default on).
>>
>> Actually, the default is off. You can enable it using UpdateHostKeys=yes
>> or UpdateHostKeys=ask
>>
>> -d
>> _______________________________________________
>> openssh-unix-dev mailing list
>> openssh-unix-dev at mindrot.org
>> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
>>
>
>

From scott_n at xypro.com  Sat Feb 28 04:38:53 2015
From: scott_n at xypro.com (Scott Neugroschl)
Date: Fri, 27 Feb 2015 17:38:53 +0000
Subject: remote-remote scp
Message-ID: <D358E5B1511A314F8160ADC6F3754987069FB726@XYSVEX01.XYPRO-23.LOCAL>

Hi everyone,

I know scp is kind of the red-headed stepchild of the suite, but I'd like to propose an extension to the syntax for remote-remote passthrough using the "-3" option.

Currently the syntax is essentially

scp -3 [ -P port ] [user@]host1:file [user@]host2:file

This is great, as long as both remotes are on the same port.   It causes difficulties if host1 and host2 are not on the same port.
I'd like to propose the syntax extenision:   [user@]host[,port]:file

This allows the two remotes to be on separate ports.
---
Scott Neugroschl | XYPRO Technology Corporation
4100 Guardian Street | Suite 100 |Simi Valley, CA 93063 | Phone 805 583-2874|Fax 805 583-0124 |


From scott_n at xypro.com  Sat Feb 28 04:59:07 2015
From: scott_n at xypro.com (Scott Neugroschl)
Date: Fri, 27 Feb 2015 17:59:07 +0000
Subject: remote-remote scp
In-Reply-To: <CALDDTe0+6R-v0jYC7+j8W+rKUmVb=Scyk962PbtCwXF=6CMiyw@mail.gmail.com>
References: <D358E5B1511A314F8160ADC6F3754987069FB726@XYSVEX01.XYPRO-23.LOCAL>
 <CALDDTe0+6R-v0jYC7+j8W+rKUmVb=Scyk962PbtCwXF=6CMiyw@mail.gmail.com>
Message-ID: <D358E5B1511A314F8160ADC6F3754987069FB746@XYSVEX01.XYPRO-23.LOCAL>

Ah.  Good point.  Hadn?t thought of that one!  Thanks.  I withdraw the suggestion.

From: dtucker at dtucker.net [mailto:dtucker at dtucker.net] On Behalf Of Darren Tucker
Sent: Friday, February 27, 2015 9:55 AM
To: Scott Neugroschl
Cc: OpenSSH Unix Dev Mailing List (openssh-unix-dev at mindrot.org)
Subject: Re: remote-remote scp

On Fri, Feb 27, 2015 at 12:38 PM, Scott Neugroschl <scott_n at xypro.com<mailto:scott_n at xypro.com>> wrote:
This allows the two remotes to be on separate ports.

You could also put "Port 1234" into ~/.ssh/config or ssh_config for one or both of the hosts.

--
Darren Tucker (dtucker at zip.com.au<http://zip.com.au>)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.

From dtucker at zip.com.au  Sat Feb 28 04:55:01 2015
From: dtucker at zip.com.au (Darren Tucker)
Date: Fri, 27 Feb 2015 12:55:01 -0500
Subject: remote-remote scp
In-Reply-To: <D358E5B1511A314F8160ADC6F3754987069FB726@XYSVEX01.XYPRO-23.LOCAL>
References: <D358E5B1511A314F8160ADC6F3754987069FB726@XYSVEX01.XYPRO-23.LOCAL>
Message-ID: <CALDDTe0+6R-v0jYC7+j8W+rKUmVb=Scyk962PbtCwXF=6CMiyw@mail.gmail.com>

On Fri, Feb 27, 2015 at 12:38 PM, Scott Neugroschl <scott_n at xypro.com>
wrote:
>
> This allows the two remotes to be on separate ports.


You could also put "Port 1234" into ~/.ssh/config or ssh_config for one or
both of the hosts.

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.

From dtucker at zip.com.au  Sat Feb 28 05:04:20 2015
From: dtucker at zip.com.au (Darren Tucker)
Date: Fri, 27 Feb 2015 13:04:20 -0500
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <CANvxniVGvPjvZgOvsS6YXyLm5r=an1-OvzcnH6Lxu3GfKSXCnw@mail.gmail.com>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <alpine.BSO.2.11.1502200945050.4850@natsu.mindrot.org>
 <CANvxniW13J+3UREHECtbwZd8sLBt+Q3EYT+Z5FKzy7mQGC_tDA@mail.gmail.com>
 <CANvxniVGvPjvZgOvsS6YXyLm5r=an1-OvzcnH6Lxu3GfKSXCnw@mail.gmail.com>
Message-ID: <CALDDTe0bbpkS+27FJGZovM-Tq07ZYaqCn_88-Kq1aMeCMEuxxQ@mail.gmail.com>

On Fri, Feb 27, 2015 at 9:19 AM, Michael Felt <aixtools at gmail.com> wrote:
>
> One problem coming directly is that the -L flag (-L/opt/libressl/lib is not
> being included in the -blibpath so the programs link, but do not run.
> I am sure there is a way for me to modify the blibpath - BUT - I ask you do
> consider inserting an openssl-dir path when it is not
> already in the blibpath variable.
>

There's a reason why it isn't: where that directory is writeable by a
non-root user it becomes a vector for local privilege escalation via
OpenSSH's setuid binaries.
http://lists.mindrot.org/pipermail/openssh-unix-dev/2003-April/017768.html

Now that decision was made back in the day when OpenSSL's shared library
support was still considered experimental.  Maybe we could check that the
path is a) absolute and b) system-owned all the way down and add it to
blibpath if both are true.

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.

From dtucker at zip.com.au  Sat Feb 28 05:12:28 2015
From: dtucker at zip.com.au (Darren Tucker)
Date: Fri, 27 Feb 2015 13:12:28 -0500
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <CANvxniXjV3kkN8L1Pddz_7fVKK7dp7-+zerRpVutcBR0brbiqg@mail.gmail.com>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <CANvxniXjV3kkN8L1Pddz_7fVKK7dp7-+zerRpVutcBR0brbiqg@mail.gmail.com>
Message-ID: <CALDDTe3v8mfdSK11RF+-fu52TnSzsSG=7YsS2cQLh4DES5AyhQ@mail.gmail.com>

On Fri, Feb 27, 2015 at 7:12 AM, Michael Felt <aixtools at gmail.com> wrote:
>
> ld: 0711-317 ERROR: Undefined symbol: .va_copy
> ld: 0711-317 ERROR: Undefined symbol: .EC_KEY_free
>

Which object files contain references to those symbols?  (running each
through "nm" should show you).


> ld: 0711-345 Use the -bloadmap or -bnoquiet option to obtain more
> information.
>
> The error above is a bit unusual.
> 1) It has been seen before that with -qlanglvl=extc89 that va_copy is not
> found. This is clear, I think, from the stdarg.h file:
>
>    +88  #ifdef _ISOC99_SOURCE
>    +89  #define va_copy(__list1,__list2) ((void)(__list1 = __list2))
>    +90  #endif
>    +91
>    +92  #endif /* _ANSI_C_SOURCE */
>

There's a definition of va_copy in defines.h which should be activated when
the platform doesn't have it:

#ifndef HAVE_VA_COPY
# ifdef HAVE___VA_COPY
#  define va_copy(dest, src) __va_copy(dest, src)
# else
#  define va_copy(dest, src) (dest) = (src)
# endif
#endif

I suspect there's a file which should have includes.h at the top but
doesn't.

I think the EC_KEY_free should be fixed by this:

diff --git a/kex.c b/kex.c
index 2618e22..cf04574 100644
--- a/kex.c
+++ b/kex.c
@@ -432,8 +432,10 @@ kex_free(struct kex *kex)
 #ifdef WITH_OPENSSL
        if (kex->dh)
                DH_free(kex->dh);
+# ifdef OPENSSL_HAS_ECC
        if (kex->ec_client_key)
                EC_KEY_free(kex->ec_client_key);

I should be able to reproduce the problem by building against the exact
openssl version you have.

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.

From Todd.Miller at courtesan.com  Sat Feb 28 05:19:22 2015
From: Todd.Miller at courtesan.com (Todd C. Miller)
Date: Fri, 27 Feb 2015 11:19:22 -0700
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: Your message of "Thu, 26 Feb 2015 19:37:43 -0500."
 <CALDDTe1DaVC2QY=LoYC+fhe1=mt4X+R6Z_+khtk_+U96PyEhAg@mail.gmail.com>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <CALDDTe0FtdGCBDAAyArZQ6MDXiwDqDi18pLgXB3aV3L-h1+72A@mail.gmail.com>
 <alpine.BSO.2.11.1502270833450.29031@natsu.mindrot.org><CALDDTe1DaVC2QY=LoYC+fhe1=mt4X+R6Z_+khtk_+U96PyEhAg@mail.gmail.com>
Message-ID: <201502271819.t1RIJQWi002750@newmailhub.uq.edu.au>

On Thu, 26 Feb 2015 19:37:43 -0500, Darren Tucker wrote:

> debug1: channel 1: new [forwarded-streamlocal at openssh.com]^M
> DAZ: fd 10 ss_family 1 expect AF_UNIX 1^M
> DAZ: fd 10 ss_family 0 expect AF_UNIX 1^M
> get_socket_address: getnameinfo 1 failed: ai_family not supported^M
> get_sock_port: getnameinfo NI_NUMERICSERV failed: ai_family not supported^M
> 
> looks like something is clearing ss_family?

What OS is this?  ISTR that getpeername() or getsockname() on some
systems may not support AF_UNIX.

 - todd

From Todd.Miller at courtesan.com  Sat Feb 28 05:22:17 2015
From: Todd.Miller at courtesan.com (Todd C. Miller)
Date: Fri, 27 Feb 2015 11:22:17 -0700
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: Your message of "Fri, 27 Feb 2015 11:19:22 -0700."
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <CALDDTe0FtdGCBDAAyArZQ6MDXiwDqDi18pLgXB3aV3L-h1+72A@mail.gmail.com>
 <alpine.BSO.2.11.1502270833450.29031@natsu.mindrot.org><CALDDTe1DaVC2QY=LoYC+fhe1=mt4X+R6Z_+khtk_+U96PyEhAg@mail.gmail.com>
Message-ID: <201502271822.t1RIMK7S029409@newmailhub.uq.edu.au>

On Fri, 27 Feb 2015 11:19:22 -0700, "Todd C. Miller" wrote:

> What OS is this?  ISTR that getpeername() or getsockname() on some
> systems may not support AF_UNIX.

This is probably due to getpeername().  We can probably change:

        /* Unix domain sockets don't have a port number. */
        if (from.ss_family == AF_UNIX)
                return 0;

To:

        /* Non-inet sockets don't have a port number. */
        if (from.ss_family != AF_INET && from.ss_family != AF_INET6)
                return 0;

 - todd

From tgc at jupiterrise.com  Sat Feb 28 10:16:24 2015
From: tgc at jupiterrise.com (Tom G. Christensen)
Date: Sat, 28 Feb 2015 00:16:24 +0100
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
Message-ID: <54F0FAC8.3060806@jupiterrise.com>

On 19/02/15 23:21, Damien Miller wrote:
> OpenSSH 6.8 is almost ready for release, so we would appreciate testing
> on as many platforms and systems as possible.
>

I've now tested using revision 1ad3a77 and it passes the testsuite on 
Solaris 2.6, 7, 8 and 9 (using gcc and openssl 1.0.1k).

Only one little nit prevents 'all tests passed':
gmake[1]: Entering directory 
`/export/home/tgc/buildpkg/openssh/src/openssh-git/regress'
test "x" != "x" && mkdir -p 
/export/home/tgc/buildpkg/openssh/src/openssh-git/regress//valgrind-out
gmake[1]: *** [prep] Error 1

Reversing the test to = and || instead will fix it.

-tgc


From djm at mindrot.org  Sat Feb 28 10:53:36 2015
From: djm at mindrot.org (Damien Miller)
Date: Sat, 28 Feb 2015 10:53:36 +1100 (AEDT)
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <54F0FAC8.3060806@jupiterrise.com>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <54F0FAC8.3060806@jupiterrise.com>
Message-ID: <alpine.BSO.2.11.1502281053030.11205@natsu.mindrot.org>

On Sat, 28 Feb 2015, Tom G. Christensen wrote:

> On 19/02/15 23:21, Damien Miller wrote:
> > OpenSSH 6.8 is almost ready for release, so we would appreciate testing
> > on as many platforms and systems as possible.
> > 
> 
> I've now tested using revision 1ad3a77 and it passes the testsuite on Solaris
> 2.6, 7, 8 and 9 (using gcc and openssl 1.0.1k).
> 
> Only one little nit prevents 'all tests passed':
> gmake[1]: Entering directory
> `/export/home/tgc/buildpkg/openssh/src/openssh-git/regress'
> test "x" != "x" && mkdir -p
> /export/home/tgc/buildpkg/openssh/src/openssh-git/regress//valgrind-out
> gmake[1]: *** [prep] Error 1
> 
> Reversing the test to = and || instead will fix it.

committed - thanks for persisting with the tests.

-d

From calestyo at scientia.net  Sat Feb 28 16:03:53 2015
From: calestyo at scientia.net (Christoph Anton Mitterer)
Date: Sat, 28 Feb 2015 06:03:53 +0100
Subject: [PATCH v1] pass-key-fingerprint-to-authorized-keys-command
Message-ID: <1425099833.5204.129.camel@scientia.net>

Hi.

The attached patch[0] (which I've admittedly haven't had time just now
to check whether it actually works - but it should at least serve as a
discussion base) would make sshd pass a 2nd argument to the authorized
keys command.

The idea is, as the commit message says, that programs like Gitolite,
which my have many (up to the range of thousands) keys per single
username (for example ?git?) can use that fingerprint in order to
efficiently retrieve that matching key(s) from a database (or something
like that).
Right now, such programs suffer quite a lot, when sshd linearly parses
an authorized_keys file with a gazillion of entries.


Most likely, legacy authorized keys commands shouldn?t be affected by
this, at least unless they check for a maximum number for command
arguments.


Right now I'm just a bit worried about two issues:
- using MD5,... which may be appropriate for the idea from above, but
  people might also use the whole thing in a different (security
  related) way... and there MD5 should be a no-go.
- not encoding the presented hash alog (which makes the whole thing
  unchangeable forever
  i.e. perhaps one should rather use pass arguments like
  johndoe -md5=e702125c0dfcb8801a07ddd8ef719ab8
  or
  johndoe md5 e702125c0dfcb8801a07ddd8ef719ab8
  (even though I'd probably tend to the former)


What do you guys think?

Cheers,
Chris.


[0] Based on an idea by Sitaram Chamarty and a patch from Jason A.
Donenfeld.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-pass-key-fingerprint-to-authorized-keys-command.patch
Type: text/x-patch
Size: 2455 bytes
Desc: not available
URL: <http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20150228/6f4de89b/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 5313 bytes
Desc: not available
URL: <http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20150228/6f4de89b/attachment-0001.bin>

From djm at mindrot.org  Sat Feb 28 19:57:33 2015
From: djm at mindrot.org (Damien Miller)
Date: Sat, 28 Feb 2015 19:57:33 +1100 (AEDT)
Subject: [PATCH v1] pass-key-fingerprint-to-authorized-keys-command
In-Reply-To: <1425099833.5204.129.camel@scientia.net>
References: <1425099833.5204.129.camel@scientia.net>
Message-ID: <alpine.BSO.2.11.1502281956430.23240@natsu.mindrot.org>

On Sat, 28 Feb 2015, Christoph Anton Mitterer wrote:

> Hi.
> 
> The attached patch[0] (which I've admittedly haven't had time just now
> to check whether it actually works - but it should at least serve as a
> discussion base) would make sshd pass a 2nd argument to the authorized
> keys command.

There is a patch out for review at
https://bugzilla.mindrot.org/show_bug.cgi?id=2081 already

-d



From aixtools at gmail.com  Sat Feb 28 21:53:12 2015
From: aixtools at gmail.com (Michael Felt)
Date: Sat, 28 Feb 2015 11:53:12 +0100
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <alpine.BSO.2.11.1502281053030.11205@natsu.mindrot.org>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <54F0FAC8.3060806@jupiterrise.com>
 <alpine.BSO.2.11.1502281053030.11205@natsu.mindrot.org>
Message-ID: <CANvxniU6LhxzfY8wLHU0ot-DSaZHFyKajz_U=mScUmS3ysJg1g@mail.gmail.com>

Had this running yesterday - will answer your questions above in a moment:

short version: all tests passed when blibpath includes an alturnate
directory for libressl - in order to override openssl (still) needed for
other applications looking for something-0.9.8 or something-1.0.0, etc..

===
Long version:
Added
LDFLAGS=-blibpath:/opt/libressl/ssl:/usr/lib:/lib

Summary has -blibpath listed twice

configure: creating ./config.status
config.status: creating Makefile
config.status: creating buildpkg.sh
config.status: creating opensshd.init
config.status: creating openssh.xml
config.status: creating openbsd-compat/Makefile
config.status: creating openbsd-compat/regress/Makefile
config.status: creating survey.sh
config.status: creating config.h

OpenSSH has been configured with the following options:
                     User binaries: /opt/bin
                   System binaries: /opt/sbin
               Configuration files: /opt/etc
                   Askpass program: /opt/libexec/ssh-askpass
                      Manual pages: /opt/share/man/manX
                          PID file: /opt/etc
  Privilege separation chroot path: /var/empty
            sshd default user PATH: /usr/bin:/bin:/usr/sbin:/sbin:/opt/bin
                    Manpage format: man
                       PAM support: no
                   OSF SIA support: no
                 KerberosV support: no
                   SELinux support: no
                 Smartcard support:
                     S/KEY support: no
              MD5 password support: no
                   libedit support: no
  Solaris process contract support: no
           Solaris project support: no
       IP address in $DISPLAY hack: no
           Translate v4 in v6 hack: no
                  BSD Auth support: no
              Random number source: OpenSSL internal ONLY
             Privsep sandbox style: rlimit

              Host: powerpc-ibm-aix5.3.0.0
          Compiler: xlc
    Compiler flags: -g
Preprocessor flags: -I/opt/libressl/include
      Linker flags: -L/opt/libressl/lib
-blibpath:/opt/libressl/lib:/usr/lib:/lib -blibpath:/usr/lib:/lib
         Libraries: -lcrypto -lz


root at x064:[/data/prj/openbsd/openssh/openssh]grep LDFLAGS= Makefile
LDFLAGS=-L. -Lopenbsd-compat/ -L/opt/libressl/lib
-blibpath:/opt/libressl/lib:/usr/lib:/lib -blibpath:/usr/lib:/lib

Editting Makefile to bring it back to only one - last one wins as I recall!


Looking good - not sure about this though:


ok try ciphers
run test yes-head.sh ...
sh: There is no process to read data written to a pipe.
sh: There is no process to read data written to a pipe.
ok yes pipe head
run test login-timeout.sh ...

also, do not have SUDO loaded

skipped: need SUDO to switch to uid nobody

... wait some more ...

learn additional hostkeys, type=ecdsa-sha2-nistp384
learn additional hostkeys, type=ecdsa-sha2-nistp521
learn changed non-primary hostkey
learn new primary hostkey
rotate primary hostkey
check rotate primary hostkey
ok hostkey rotate
make[1]: Leaving directory `/data/prj/openbsd/openssh/openssh/regress'
all tests passed




On Sat, Feb 28, 2015 at 12:53 AM, Damien Miller <djm at mindrot.org> wrote:

> On Sat, 28 Feb 2015, Tom G. Christensen wrote:
>
> > On 19/02/15 23:21, Damien Miller wrote:
> > > OpenSSH 6.8 is almost ready for release, so we would appreciate testing
> > > on as many platforms and systems as possible.
> > >
> >
> > I've now tested using revision 1ad3a77 and it passes the testsuite on
> Solaris
> > 2.6, 7, 8 and 9 (using gcc and openssl 1.0.1k).
> >
> > Only one little nit prevents 'all tests passed':
> > gmake[1]: Entering directory
> > `/export/home/tgc/buildpkg/openssh/src/openssh-git/regress'
> > test "x" != "x" && mkdir -p
> > /export/home/tgc/buildpkg/openssh/src/openssh-git/regress//valgrind-out
> > gmake[1]: *** [prep] Error 1
> >
> > Reversing the test to = and || instead will fix it.
>
> committed - thanks for persisting with the tests.
>
> -d
> _______________________________________________
> openssh-unix-dev mailing list
> openssh-unix-dev at mindrot.org
> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
>

From aixtools at gmail.com  Sat Feb 28 22:40:08 2015
From: aixtools at gmail.com (Michael Felt)
Date: Sat, 28 Feb 2015 12:40:08 +0100
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <CALDDTe0bbpkS+27FJGZovM-Tq07ZYaqCn_88-Kq1aMeCMEuxxQ@mail.gmail.com>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <alpine.BSO.2.11.1502200945050.4850@natsu.mindrot.org>
 <CANvxniW13J+3UREHECtbwZd8sLBt+Q3EYT+Z5FKzy7mQGC_tDA@mail.gmail.com>
 <CANvxniVGvPjvZgOvsS6YXyLm5r=an1-OvzcnH6Lxu3GfKSXCnw@mail.gmail.com>
 <CALDDTe0bbpkS+27FJGZovM-Tq07ZYaqCn_88-Kq1aMeCMEuxxQ@mail.gmail.com>
Message-ID: <CANvxniXQLc6r8GoKRZyLVt0ycXVjxe+6UPhWZTuxdutwREUfEg@mail.gmail.com>

The 'user' way to address this is to modify LIBPATH variable - as I did
above, and that will work for a long time.

Starting with AIX 6.1 - this can be disabled by setting a security policy -
so that only programs and/or libraries can be executed from trusted
locations.

>From trustchk man page - three of the options for the -p (policy) flag

       TE
            Enables or disables Trusted Execution. Policies can only be
            activated when the TE option is set to ON.
       TEP
            Sets the value of Trusted Execution path, and enables or
disables
            it. The Trusted Execution path consists of a list of
colon-separated
            absolute paths, for example, the /usr/bin:/usr/sbin. When this
            policy is enabled, the files belonging to only these directory
paths
            are allowed to be started. If an executable program that does
not
            belong to the TEP is to be loaded, the program is blocked.
       TLP
            Sets the value of Trusted Library path, and enables or disables
it.
            The Trusted Library Path consists of a list of colon-separated
            absolute paths, for example, the /usr/lib:/usr/ccs/lib. When
this
            policy is enabled, the libraries belonging to only these
directory
            paths can be loaded. If a program tries to load a library that
does
            not belong to the TLP, the program is blocked.


As an example - default settings (TE=off, so all are ignored)
michael at x071:[/data/prj/openbsd/openssh/openssh]trustchk -p TE TEP TLP
TE=OFF
TEP=OFF
TEP=/usr/bin:/usr/sbin:/etc:/bin:/sbin:/sbin/helpers/jfs2:/usr/lib/instl:/usr/ccs/bin:/usr/lib:/usr/lib/security:/usr/lib:/usr/lib/security:/etc/security
TLP=OFF
TLP=/usr/lib:/usr/ccs/lib:/lib:/var/lib:/usr/lib/drivers

re: the 'undesired behavior' of the AIX ld program. I would say it is
'still' there - and I agree with the premise that the default library
search path gets very messy. This is actually one of the reasons why I
started packaging tools myself (I did not like the state, nor the extra
libraries I needed to load, or overwrite 'AIX' ones (which broke other
things).

To underline this issue - without any -blibpath variable the default (in
the binary LIBPATH would be:
                        ***Import File Strings***
INDEX  PATH                          BASE
MEMBER
0
.:openbsd-compat/:/opt/libressl/lib:/usr/vac/lib:/usr/lib:/lib

1                                    libc.a
shr.o
2                                    libcrypto.a
libcrypto.so.32

Coming from - what ld already has a default plus these arguments:
-L. -Lopenbsd-compat/ -L/opt/libressl/lib

I am guessing that this is the behavior of 'other' linkers when -R is used.

As a packager - I would like the option to be able to specify the -blibpath
- especially because I want to be able to package 'aixtools' as a
replacement package that can co-exist - because I do not expect to resolve
all possible dependencies of existing programs. Additionally, if I used a
position 'owned' by another package - an update of that package may
overwrite what I have done.

The is the reason for /opt and/or /opt/package as prefix - older default is
/usr/local; IBM AIX toolkit and others use /opt/freeware/*

>From my perspective - when using a different version of 'openSSL API' - for
it to work I will need a different blibpath so it gets found. That is much
better than that I would add libcrypto.so.32 as a MEMBER to
/usr/lib/libcrypto.a

FYI: This is the IBM version on AIX 6.1
michael at x071:[/data/prj/openbsd/openssh/openssh]ar tv /usr/lib/libcrypto.a
rwxrwxr-x 435159/781431 2965832 May 01 06:57 2014 libcrypto.so.1.0.0
rwxrwxr-x 435159/781431 2253655 May 01 06:58 2014 libcrypto.so.0.9.8

I see not the most recent one - but the dual support, via dual members is
how that is working.
  openssl.base             1.0.1.510    C     F    Open Secure Socket Layer

POSSIBILITIES:
just as you give a warning message for no use of compiler stack execution
protection - you could give a warning that a modified blibpath is being
used.

re: stack execution protection, AIX has a hardware based mechanism that can
be set system-wide and/or at application level. See
http://www-01.ibm.com/support/knowledgecenter/ssw_aix_71/com.ibm.aix.security/stack_exec_disable.htm.
This has it's start back in 2004/2005 with POWER4 iirc.

I shall address va_copy in a second note.



On Fri, Feb 27, 2015 at 7:04 PM, Darren Tucker <dtucker at zip.com.au> wrote:

> On Fri, Feb 27, 2015 at 9:19 AM, Michael Felt <aixtools at gmail.com> wrote:
>>
>> One problem coming directly is that the -L flag (-L/opt/libressl/lib is
>> not
>> being included in the -blibpath so the programs link, but do not run.
>> I am sure there is a way for me to modify the blibpath - BUT - I ask you
>> do
>> consider inserting an openssl-dir path when it is not
>> already in the blibpath variable.
>>
>
> There's a reason why it isn't: where that directory is writeable by a
> non-root user it becomes a vector for local privilege escalation via
> OpenSSH's setuid binaries.
> http://lists.mindrot.org/pipermail/openssh-unix-dev/2003-April/017768.html
>
> Now that decision was made back in the day when OpenSSL's shared library
> support was still considered experimental.  Maybe we could check that the
> path is a) absolute and b) system-owned all the way down and add it to
> blibpath if both are true.
>
> --
> Darren Tucker (dtucker at zip.com.au)
> GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
>     Good judgement comes with experience. Unfortunately, the experience
> usually comes from bad judgement.
>

From tgc at jupiterrise.com  Sat Feb 28 22:53:52 2015
From: tgc at jupiterrise.com (Tom G. Christensen)
Date: Sat, 28 Feb 2015 12:53:52 +0100
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <alpine.BSO.2.11.1502281053030.11205@natsu.mindrot.org>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <54F0FAC8.3060806@jupiterrise.com>
 <alpine.BSO.2.11.1502281053030.11205@natsu.mindrot.org>
Message-ID: <54F1AC50.7040906@jupiterrise.com>

On 28/02/15 00:53, Damien Miller wrote:
> On Sat, 28 Feb 2015, Tom G. Christensen wrote:
>> Only one little nit prevents 'all tests passed':
>> gmake[1]: Entering directory
>> `/export/home/tgc/buildpkg/openssh/src/openssh-git/regress'
>> test "x" != "x" && mkdir -p
>> /export/home/tgc/buildpkg/openssh/src/openssh-git/regress//valgrind-out
>> gmake[1]: *** [prep] Error 1
>>
>> Reversing the test to = and || instead will fix it.
>
> committed - thanks for persisting with the tests.
>

Perhaps I should have been more clear but the above error is from the 
'prep' target while it looks like you changed the 'unit' target instead.

I propose this patch to avoid the error:

diff --git a/regress/Makefile b/regress/Makefile
index 860c53f..1eef340 100644
--- a/regress/Makefile
+++ b/regress/Makefile
@@ -7,7 +7,7 @@ tests:          prep $(REGRESS_TARGETS)
  interop interop-tests: t-exec-interop

  prep:
-       test "x${USE_VALGRIND}" != "x" && mkdir -p $(OBJ)/valgrind-out
+       test "x${USE_VALGRIND}" = "x" || mkdir -p $(OBJ)/valgrind-out

  clean:
         for F in $(CLEANFILES); do rm -f $(OBJ)$$F; done


-tgc


From aixtools at gmail.com  Sat Feb 28 22:55:48 2015
From: aixtools at gmail.com (Michael Felt)
Date: Sat, 28 Feb 2015 12:55:48 +0100
Subject: Call for testing: OpenSSH 6.8
In-Reply-To: <CALDDTe3v8mfdSK11RF+-fu52TnSzsSG=7YsS2cQLh4DES5AyhQ@mail.gmail.com>
References: <alpine.BSO.2.11.1502200909220.4850@natsu.mindrot.org>
 <CANvxniXjV3kkN8L1Pddz_7fVKK7dp7-+zerRpVutcBR0brbiqg@mail.gmail.com>
 <CALDDTe3v8mfdSK11RF+-fu52TnSzsSG=7YsS2cQLh4DES5AyhQ@mail.gmail.com>
Message-ID: <CANvxniW3K2h5ox4zpc4-gy4v9a=OKf_30R0H+=J3rFmeuwRE1w@mail.gmail.com>

As far as va_copy is concerned - I believe the default compiler should be
xlc rather than cc.

These are the default settings from the vac.cfg.53 file
* -qlanglvl=extc99 C compiler with common extensions, UNIX headers
xlc:    use        = DEFLT_C
        crt        = /lib/crt0.o
        mcrt       = /lib/mcrt0.o
        gcrt       = /lib/gcrt0.o
        libraries  = -L/usr/vac/lib,-lxlopt,-lxlipa,-lxl,-lc
        proflibs   = -L/lib/profiled,-L/usr/lib/profiled
        options    =
-qlanglvl=extc99,-qcpluscmt,-qkeyword=inline,-qalias=ansi

* ANSI C compiler, UNIX header files (V6 compatibility version)
xlc_v6: use        = DEFLT_C
        crt        = /lib/crt0.o
        mcrt       = /lib/mcrt0.o
        gcrt       = /lib/gcrt0.o
        libraries  = -L/usr/vac/lib,-lxlopt,-lxlipa,-lxl,-lc
        proflibs   = -L/lib/profiled,-L/usr/lib/profiled
        options    = -qalias=ansi

* C compiler, extended mode
cc:     use        = DEFLT_C
        crt        = /lib/crt0.o
        mcrt       = /lib/mcrt0.o
        gcrt       = /lib/gcrt0.o
        libraries  = -L/usr/vac/lib,-lxlopt,-lxlipa,-lxl,-lc
        proflibs   = -L/lib/profiled,-L/usr/lib/profiled
        options    = -qlanglvl=extended,-qnoro,-qnoroconst

* Strict ANSI compiler, ANSI headers
c89:    use        = DEFLT_C
        crt        = /lib/crt0.o
        mcrt       = /lib/mcrt0.o
        gcrt       = /lib/gcrt0.o
        libraries  = -L/usr/vac/lib,-lxlopt,-lxlipa,-lxl,-lc
        proflibs   = -L/lib/profiled,-L/usr/lib/profiled
        options    =
-D_ANSI_C_SOURCE,-qalias=ansi,-qnolonglong,-qstrict_induction

* Strict ANSI compiler, ANSI headers
c99:    use        = DEFLT_C
        crt        = /lib/crt0.o
        mcrt       = /lib/mcrt0.o
        gcrt       = /lib/gcrt0.o
        libraries  = -L/usr/vac/lib,-lxlopt,-lxlipa,-lxl,-lc
        proflibs   = -L/lib/profiled,-L/usr/lib/profiled
        options    =
-qlanglvl=stdc99,-D_ANSI_C_SOURCE,-D_ISOC99_SOURCE,-qalias=ansi,-qstrict_induction

If you look at my example above you will see that when -qlanglvl=extc99
va_copy gets 'transferred' to the _builtin_va_copy. I do not recall finding
va_copy in one of the libraries.

My question would be - are you still building against c89 standard (I
assume not). And as far as IBM C compatibility with gcc - xlc comes much
closer - with
* C++ compiler
xlc++:  use        = DEFLT_CPP
        crt        = /lib/crt0.o
        mcrt       = /lib/mcrt0.o
        gcrt       = /lib/gcrt0.o
        xlC        = /usr/vacpp/bin/xlC
        libraries2 =
-L/usr/vac/lib,-lxlopt,-lxlipa,-lxl,-L/usr/vacpp/lib,-lC,-lm,-lc
        proflibs   =
-L/usr/vacpp/lib/profiled,-L/lib/profiled,-L/usr/lib/profiled
        hdlibs     = -L/usr/vac/lib,-lhC,-lhmd
        options    = -qalias=ansi

* C++ compiler
xlC:    use        = DEFLT_CPP
        crt        = /lib/crt0.o
        mcrt       = /lib/mcrt0.o
        gcrt       = /lib/gcrt0.o
        xlC        = /usr/vacpp/bin/xlC
        libraries2 =
-L/usr/vac/lib,-lxlopt,-lxlipa,-lxl,-L/usr/vacpp/lib,-lC,-lm,-lc
        proflibs   =
-L/usr/vacpp/lib/profiled,-L/lib/profiled,-L/usr/lib/profiled
        hdlibs     = -L/usr/vac/lib,-lhC,-lhmd
        options    = -qalias=ansi
 being the 'natural' C++ co-compilers.

As a packager - I can resolve this myself by setting CC=xlc. So, please do
not see this as a bug or an error in the package - just as a FYI - where
you could provide a warning when plain "cc" is being used (e.g., I really
dislike the -qnoro option).

All in all - I am quite happy with how it is working - all tests seem to be
passing - and I shall be working on my next blog (google SecuringAIX should
find it - I dare not give the URL as being too pushy).

On Fri, Feb 27, 2015 at 7:12 PM, Darren Tucker <dtucker at zip.com.au> wrote:

> On Fri, Feb 27, 2015 at 7:12 AM, Michael Felt <aixtools at gmail.com> wrote:
>>
>> ld: 0711-317 ERROR: Undefined symbol: .va_copy
>> ld: 0711-317 ERROR: Undefined symbol: .EC_KEY_free
>>
>
> Which object files contain references to those symbols?  (running each
> through "nm" should show you).
>
>
>> ld: 0711-345 Use the -bloadmap or -bnoquiet option to obtain more
>> information.
>>
>> The error above is a bit unusual.
>> 1) It has been seen before that with -qlanglvl=extc89 that va_copy is not
>> found. This is clear, I think, from the stdarg.h file:
>>
>>    +88  #ifdef _ISOC99_SOURCE
>>    +89  #define va_copy(__list1,__list2) ((void)(__list1 = __list2))
>>    +90  #endif
>>    +91
>>    +92  #endif /* _ANSI_C_SOURCE */
>>
>
> There's a definition of va_copy in defines.h which should be activated
> when the platform doesn't have it:
>
> #ifndef HAVE_VA_COPY
> # ifdef HAVE___VA_COPY
> #  define va_copy(dest, src) __va_copy(dest, src)
> # else
> #  define va_copy(dest, src) (dest) = (src)
> # endif
> #endif
>
> I suspect there's a file which should have includes.h at the top but
> doesn't.
>
> I think the EC_KEY_free should be fixed by this:
>
> diff --git a/kex.c b/kex.c
> index 2618e22..cf04574 100644
> --- a/kex.c
> +++ b/kex.c
> @@ -432,8 +432,10 @@ kex_free(struct kex *kex)
>  #ifdef WITH_OPENSSL
>         if (kex->dh)
>                 DH_free(kex->dh);
> +# ifdef OPENSSL_HAS_ECC
>         if (kex->ec_client_key)
>                 EC_KEY_free(kex->ec_client_key);
>
> I should be able to reproduce the problem by building against the exact
> openssl version you have.
>
> --
> Darren Tucker (dtucker at zip.com.au)
> GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
>     Good judgement comes with experience. Unfortunately, the experience
> usually comes from bad judgement.
>