From dustincr at hotmail.com Mon Aug 2 22:45:22 2010 From: dustincr at hotmail.com (Dustin Rogers) Date: Mon, 2 Aug 2010 07:45:22 -0500 Subject: Record Failed Passwords Message-ID: Alan Neville wrote: >> Hi OpenSSH'ers, >> >> I am emailing you to ask is it possible to record failed passwords >> attempts and log them to syslog? Are there patches available for this? >> Has anyone managed to do this before? Are there alternitive methods? >> >> Many Thanks, >> >> A >> >Hi Alan, > >use a pam module and put it in common-auth > >auth sufficient pam_unix.so nullok_secure >auth required pam_log_pw.so >auth requisite pam_deny.so > >Use something like (untestet) > > >---- begin pam_log_pw.c ----------- >#define PAM_SM_AUTHENTICATE >#include > >extern int pam_sm_authenticate(pam_handle_t *pamh, >int flags, int argc, const char ** argv) { >const char *user, *pass, *rhost, *ruser; >pam_get_item(pamh, PAM_USER, (const void **) &user); >pam_get_item(pamh, PAM_AUTHTOK, (const void **) &pass); >pam_get_item(pamh, PAM_RHOST, (const void **) &rhost); >pam_get_item(pamh, PAM_RUSER, (const void **) &ruser); > >/* do your logging stuff here*/ >return PAM_AUTH_ERR; >} >----- end ---- > >compile using something like: > >gcc -O2 -fPIC -Wall -pedantic -shared -lpam -o pam_log_pw.so \ >pam_log_pw.c > >Best regards, > >Christian > > >_______________________________________________ >openssh-unix-dev mailing list >openssh-unix-dev [at] mindrot >https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev > >-- >Firma: Siemens Aktiengesellschaft ?sterreich >Rechtsform: Aktiengesellschaft >Firmensitz: Wien, Firmenbuchnummer: FN 60562 m >Firmenbuchgericht: Handelsgericht Wien, DVR: 0001708 > >_______________________________________________ >openssh-unix-dev mailing list >openssh-unix-dev [at] mindrot >https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev Hello Fellow SSHers: I hope I am emailing this correctly. I implemented the shared object above...works pretty nice except AUTHTOK only takes the value of the passwords for legitimate users, is there a way to get the failed passwords for all users. I too am a graduate student, except at St. Cloud State University, looking at Brute-Force SSH attacks. I would also be using this as a honeypot on a non-production public IP address. Therefore, the illegitimate usernames/passwords would be of the most value. Here is the shared object code from Christian as I modified it.... /*---- begin pam_log_pw.c -----------*/ #define PAM_SM_AUTHENTICATE #include #include extern int pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc, const c$ { const char *user, *pass, *rhost, *ruser; FILE *ofp; pam_get_item(pamh, PAM_USER, (const void **) &user); pam_get_item(pamh, PAM_AUTHTOK, (const void **) &pass); pam_get_item(pamh, PAM_RHOST, (const void **) &rhost); pam_get_item(pamh, PAM_RUSER, (const void **) &ruser); /* do your logging stuff here*/ ofp = fopen("/var/log/passwd.log","a"); fprintf(ofp,pass); fclose(ofp); return PAM_AUTH_ERR; } /*----- end ----*/ Please let me know if there is a way to store illegitimate usernames/passwords using a PAM module? Thank you for your time and code! -Dustin Rogers Student Network Admin Computer Network Research Center, SCSU From peter at stuge.se Mon Aug 2 23:22:00 2010 From: peter at stuge.se (Peter Stuge) Date: Mon, 2 Aug 2010 15:22:00 +0200 Subject: Record Failed Passwords In-Reply-To: References: Message-ID: <20100802132200.8353.qmail@stuge.se> Dustin Rogers wrote: > /*---- begin pam_log_pw.c -----------*/ > #define PAM_SM_AUTHENTICATE > #include > #include > extern int pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc, const c$ > { > const char *user, *pass, *rhost, *ruser; > FILE *ofp; > pam_get_item(pamh, PAM_USER, (const void **) &user); > pam_get_item(pamh, PAM_AUTHTOK, (const void **) &pass); > pam_get_item(pamh, PAM_RHOST, (const void **) &rhost); > pam_get_item(pamh, PAM_RUSER, (const void **) &ruser); > /* do your logging stuff here*/ > ofp = fopen("/var/log/passwd.log","a"); > fprintf(ofp,pass); > fclose(ofp); > return PAM_AUTH_ERR; > } > /*----- end ----*/ You must handle concurrency, or the log file will be corrupted. Please also make sure to use fprintf() correctly: fprintf(ofp,"%s\n",pass); How can you be doing security work in C without understanding how to (not) use format strings? > Please let me know if there is a way to store illegitimate > usernames/passwords using a PAM module? I guess you just have to put your module earlier in the PAM stack used by sshd. //Peter From dustincr at hotmail.com Mon Aug 2 23:57:25 2010 From: dustincr at hotmail.com (Dustin Rogers) Date: Mon, 2 Aug 2010 08:57:25 -0500 Subject: Record Failed Passwords In-Reply-To: <20100802132200.8353.qmail@stuge.se> References: , <20100802132200.8353.qmail@stuge.se> Message-ID: > Date: Mon, 2 Aug 2010 15:22:00 +0200 > From: peter at stuge.se > To: openssh-unix-dev at mindrot.org > Subject: Re: Record Failed Passwords > > Dustin Rogers wrote: > > /*---- begin pam_log_pw.c -----------*/ > > #define PAM_SM_AUTHENTICATE > > #include > > #include > > extern int pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc, const c$ > > { > > const char *user, *pass, *rhost, *ruser; > > FILE *ofp; > > pam_get_item(pamh, PAM_USER, (const void **) &user); > > pam_get_item(pamh, PAM_AUTHTOK, (const void **) &pass); > > pam_get_item(pamh, PAM_RHOST, (const void **) &rhost); > > pam_get_item(pamh, PAM_RUSER, (const void **) &ruser); > > /* do your logging stuff here*/ > > ofp = fopen("/var/log/passwd.log","a"); > > fprintf(ofp,pass); > > fclose(ofp); > > return PAM_AUTH_ERR; > > } > > /*----- end ----*/ > > You must handle concurrency, or the log file will be corrupted. > > Please also make sure to use fprintf() correctly: > > fprintf(ofp,"%s\n",pass); > > How can you be doing security work in C without understanding how to > (not) use format strings? > > > > Please let me know if there is a way to store illegitimate > > usernames/passwords using a PAM module? > > I guess you just have to put your module earlier in the PAM stack > used by sshd. > > > //Peter > _______________________________________________ > openssh-unix-dev mailing list > openssh-unix-dev at mindrot.org > https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev Peter: You got me, I'm still working on C, in fact, this is the first time I was using fprintf. I am placing my module in '/etc/pam.d/system.auth' in this location... #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth sufficient pam_fprintd.so auth sufficient pam_unix.so nullok try_first_pass auth required pam_log_pw.so auth requisite pam_succeed_if.so uid >= 500 quiet auth required pam_deny.so Which seems to be the only place I get anything. Above or below I am getting '(null)' for any username. With legitimate usernames I am getting the failed passwords only. With illegitimate usernames I am getting '(Incorrect), or something like that. Thanks again, -Dustin From ray at cyth.net Tue Aug 3 04:23:37 2010 From: ray at cyth.net (Ray) Date: Mon, 2 Aug 2010 11:23:37 -0700 Subject: sftp interrupt hang In-Reply-To: <4C540794.7090701@zip.com.au> References: <4C540794.7090701@zip.com.au> Message-ID: This is on OpenBSD -current. But apparently there's a really long timeout, because after I interrupted for what seemed like 30 minutes, it reported an error and quit. I think it was a pipe error. If a second interrupt is received, perhaps sftp should just quit like ftp. On Saturday, July 31, 2010, Darren Tucker wrote: > On 31/07/10 5:25 PM, Ray Lai wrote: > > When downloading a file and the connection hangs due to crappy wifi, > sftp just says "0.0 KB/s - stalled -". I hit ^C to kill it, but it > just prints "Interrupt" and doesn't do anything, no matter how many > times I hit ^C or how long I wait. Is this expected behavior? Or > am I expected to kill the ssh connection itself with "~."? > > > What version of OpenSSH is this and on what platform? ?It sounds a lot like https://bugzilla.mindrot.org/show_bug.cgi?id=1590 which was fixed in the 5.4 release. > > -- > Darren Tucker (dtucker at zip.com.au) > GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4 ?37C9 C982 80C7 8FF4 FA69 > ? ?Good judgement comes with experience. Unfortunately, the experience > usually comes from bad judgement. > From muks at banu.com Tue Aug 3 02:33:36 2010 From: muks at banu.com (Mukund Sivaraman) Date: Mon, 2 Aug 2010 22:03:36 +0530 Subject: Persistent SSH sessions Message-ID: <20100802163336.GA6097@jurassic> Hi all I have an ADSL modem which reboots when there is a power cut and the inverter (UPS) kicks in. Internet access is down for a duration of 1 to 2 minutes while the modem boots. I have many SSH tunnels and shells active. Due to the default "TCPKeepAlive On" setting, these sessions are terminated almost immediately. I tried the following configuration: sshd_config on server: TCPKeepAlive no ClientAliveInterval 90 ClientAliveCountMax 6 ~/.ssh/config: Host * Protocol 2 Compression yes TCPKeepAlive no ServerAliveInterval 90 ServerAliveCountMax 6 But I guess the ssh client doesn't try to re-establish the session for the ServerAlive messages to work. The shells remain blocked after the modem reboots, and after approximately 90*6 seconds, ssh aborts complaining of timeout with the remote server. I want to know if there is any way I can get ssh to try to renegotiate the active sessions to remote servers, without disconnecting them. Note: Please don't bother suggesting workarounds such as the use of screen, autossh, etc. I am looking for a specific answer about how to keep a session alive, or the impossibility of doing that. For example, autossh restarts ssh. I want existing sessions to continue as if nothing happened, as long as net access is not down for longer than some timeout. FWIW, I'm using OpenSSH_5.4p1, OpenSSL 1.0.0a-fips 1 Jun 2010. Mukund From peter at stuge.se Tue Aug 3 06:04:52 2010 From: peter at stuge.se (Peter Stuge) Date: Mon, 2 Aug 2010 22:04:52 +0200 Subject: Persistent SSH sessions In-Reply-To: <20100802163336.GA6097@jurassic> References: <20100802163336.GA6097@jurassic> Message-ID: <20100802200452.24456.qmail@stuge.se> Mukund Sivaraman wrote: > I have an ADSL modem which reboots .. > I tried the following configuration: > > sshd_config on server: > TCPKeepAlive no > ClientAliveInterval 90 > ClientAliveCountMax 6 > > ~/.ssh/config: > Host * > Protocol 2 > Compression yes > TCPKeepAlive no > ServerAliveInterval 90 > ServerAliveCountMax 6 .. > I want to know if there is any way I can get ssh to try to > renegotiate the active sessions to remote servers, without > disconnecting them. .. > I am looking for a specific answer about how to keep a session > alive, or the impossibility of doing that. I think you need to completely disable the serveralive and possibly also clientalive stuff. That's the only thing that I've found to work well so far. With those disabled on the other hand, and if running over a VPN, I can go disconnected for forever as long as I don't type anything, and a good while even if I do type something by mistake. //Peter From djm at mindrot.org Tue Aug 3 06:52:18 2010 From: djm at mindrot.org (Damien Miller) Date: Tue, 3 Aug 2010 06:52:18 +1000 (EST) Subject: Persistent SSH sessions In-Reply-To: <20100802163336.GA6097@jurassic> References: <20100802163336.GA6097@jurassic> Message-ID: On Mon, 2 Aug 2010, Mukund Sivaraman wrote: > Hi all > > I have an ADSL modem which reboots when there is a power cut and the > inverter (UPS) kicks in. Internet access is down for a duration of 1 > to 2 minutes while the modem boots. > > I have many SSH tunnels and shells active. Due to the default > "TCPKeepAlive On" setting, these sessions are terminated almost > immediately. This is almost certainly not due to TCP keepalives, which are generally send pretty infrequently and don't kill sessions anyway. It is much more likely that your modem is using NAT and loses its NAT state table on reboot and is unable to associate the outside and inside halves of your connections, gives up and sends a TCP RST to each. If this is the case, then no amount of configuration in ssh/sshd will help you unfortunately. -d From imorgan at nas.nasa.gov Tue Aug 3 07:11:12 2010 From: imorgan at nas.nasa.gov (Iain Morgan) Date: Mon, 2 Aug 2010 14:11:12 -0700 Subject: Persistent SSH sessions In-Reply-To: <20100802163336.GA6097@jurassic> References: <20100802163336.GA6097@jurassic> Message-ID: <20100802211112.GA23900@linux55.nas.nasa.gov> On Mon, Aug 02, 2010 at 11:33:36 -0500, Mukund Sivaraman wrote: > Hi all > > I have an ADSL modem which reboots when there is a power cut and the > inverter (UPS) kicks in. Internet access is down for a duration of 1 > to 2 minutes while the modem boots. > > I have many SSH tunnels and shells active. Due to the default > "TCPKeepAlive On" setting, these sessions are terminated almost > immediately. I wouldn't have thought TCPKeepAlive would have been a factor over such a short timespan. The interval at which the TCP keepalives are sent is, admittedly, OS-dependent but tends to be fairly long. In my expreience, it's normally once an hour (or possibly two hours). It seems more likely that when your modem reboots state information (NAT table for example) is lost. It may also be that the IP address for your connection changes. > > I tried the following configuration: > > sshd_config on server: > TCPKeepAlive no > ClientAliveInterval 90 > ClientAliveCountMax 6 > > ~/.ssh/config: > Host * > Protocol 2 > Compression yes > TCPKeepAlive no > ServerAliveInterval 90 > ServerAliveCountMax 6 Setting {Client,Server}Alive* is really intended for detecting unresponsive clients/servers rather than for preserving connections. However, there are cases where network devices might otherwise timeout state information for apparently idle connections. In those cases, enabling these options can be useful since they keep the connection active. > > But I guess the ssh client doesn't try to re-establish the session for > the ServerAlive messages to work. The shells remain blocked after the > modem reboots, and after approximately 90*6 seconds, ssh aborts > complaining of timeout with the remote server. Currently no attempt is made to re-establish a connection once it is broken. If you search the mailing list you will see references to a "roaming" feature which would add that functionality, but it has not yet been committed to a released version of OpenSSH. As it is currently implemented, user interaction is required to re-establish the session, but that may change once the initial code has been committed. > > I want to know if there is any way I can get ssh to try to renegotiate > the active sessions to remote servers, without disconnecting them. The roaming feature will do that, but both the client and server need to support it. -- Iain > > Note: Please don't bother suggesting workarounds such as the use of > screen, autossh, etc. I am looking for a specific answer about how to > keep a session alive, or the impossibility of doing that. For example, > autossh restarts ssh. I want existing sessions to continue as if > nothing happened, as long as net access is not down for longer than > some timeout. > > FWIW, I'm using OpenSSH_5.4p1, OpenSSL 1.0.0a-fips 1 Jun 2010. > > Mukund > _______________________________________________ > openssh-unix-dev mailing list > openssh-unix-dev at mindrot.org > https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev -- Iain Morgan From bin.bai at hp.com Tue Aug 3 12:17:12 2010 From: bin.bai at hp.com (Bai, Bin) Date: Tue, 3 Aug 2010 02:17:12 +0000 Subject: ?"Please enhance SSH so that sftp chrooted user sessions are loged in" Message-ID: Hi All, Could anyone explain what is "enhance SSH so that sftp chrooted user sessions are loged in to syslog"? What is "chrooted user sessions"? I'm sorry for the interruption and the laughable question. Thanks and Regards, Bin.Bai. From christian.pfaffel-janser at siemens.com Tue Aug 3 16:36:22 2010 From: christian.pfaffel-janser at siemens.com (Christian Pfaffel-Janser) Date: Tue, 03 Aug 2010 08:36:22 +0200 Subject: Record Failed Passwords In-Reply-To: References: Message-ID: <4C57B8E6.3090901@siemens.com> > > Hello Fellow SSHers: > > I hope I am emailing this correctly. I implemented the shared object above...works pretty nice except AUTHTOK only takes the value of the passwords for legitimate users, is there a way to get the failed passwords for all users. I too am a graduate student, except at St. Cloud State University, looking at Brute-Force SSH attacks. I would also be using this as a honeypot on a non-production public IP address. Therefore, the illegitimate usernames/passwords would be of the most value. > > Here is the shared object code from Christian as I modified it.... > > /*---- begin pam_log_pw.c -----------*/ > #define PAM_SM_AUTHENTICATE > #include > #include > extern int pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc, const c$ > { > const char *user, *pass, *rhost, *ruser; > FILE *ofp; > pam_get_item(pamh, PAM_USER, (const void **) &user); > pam_get_item(pamh, PAM_AUTHTOK, (const void **) &pass); > pam_get_item(pamh, PAM_RHOST, (const void **) &rhost); > pam_get_item(pamh, PAM_RUSER, (const void **) &ruser); > /* do your logging stuff here*/ > ofp = fopen("/var/log/passwd.log","a"); > fprintf(ofp,pass); > fclose(ofp); > return PAM_AUTH_ERR; > } > /*----- end ----*/ > > > Please let me know if there is a way to store illegitimate usernames/passwords using a PAM module? > > Thank you for your time and code! > -Dustin Rogers > Student Network Admin > Computer Network Research Center, SCSU > > > _______________________________________________ > openssh-unix-dev mailing list > openssh-unix-dev at mindrot.org > https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev > Hi Dustin, You might want to add something like this and call it prior pam_get_item Untested function for getting pw and login follows: ---------------------------------------------------- int get_login_or_pw(pam_handle_t * pamh, int login) { int rc; char *p; struct pam_message msg[1], *pmsg[1]; struct pam_response *resp; struct pam_conv *conv; pmsg[0] = &msg[0]; msg[0].msg_style = login ? PAM_PROMPT_ECHO_ON : PAM_PROMPT_ECHO_OFF; msg[0].msg = login ? "Login: " : "Password: "; resp = NULL; rc = pam_get_item (pamh, PAM_CONV, (CONST_ARG void **) &conv); if (rc == PAM_SUCCESS) rc = conv->conv (1, (CONST_ARG struct pam_message **) pmsg, &resp, conv->appdata_ptr); else return rc; if (resp != NULL) { pam_set_item (pamh, login ? PAM_USER : PAM_AUTHTOK, resp[0].resp); resp[0].resp = NULL; /* watch out: don't free resp, it is stored in pamh */ free (resp); } else { return PAM_CONV_ERR; } return PAM_SUCCESS; } ------------------------------------------------------------------- Hth Christian -- Firma: Siemens Aktiengesellschaft ?sterreich Rechtsform: Aktiengesellschaft Firmensitz: Wien, Firmenbuchnummer: FN 60562 m Firmenbuchgericht: Handelsgericht Wien, DVR: 0001708 From jakob at kirei.se Tue Aug 3 19:53:38 2010 From: jakob at kirei.se (Jakob Schlyter) Date: Tue, 3 Aug 2010 11:53:38 +0200 Subject: Persistent SSH sessions In-Reply-To: References: <20100802163336.GA6097@jurassic> Message-ID: <04B4524A-DBC8-4571-9478-D51A31776E46@kirei.se> On 2 aug 2010, at 22.52, Damien Miller wrote: > If this is the case, then no amount of configuration in ssh/sshd will > help you unfortunately. the new (or perhaps upcoming) roaming code would help, right? jakob From peter at stuge.se Wed Aug 4 00:11:21 2010 From: peter at stuge.se (Peter Stuge) Date: Tue, 3 Aug 2010 16:11:21 +0200 Subject: ?"Please enhance SSH so that sftp chrooted user sessions are loged in" In-Reply-To: References: Message-ID: <20100803141121.3412.qmail@stuge.se> Hi, Bai, Bin wrote: > What is "chrooted user sessions"? I searched for "chroot" at google.com and the two first hits are: http://en.wikipedia.org/wiki/Chroot http://unixwiz.net/techtips/chroot-practices.html //Peter From jeremy at nickurak.ca Wed Aug 4 03:03:17 2010 From: jeremy at nickurak.ca (Jeremy Nickurak) Date: Tue, 3 Aug 2010 11:03:17 -0600 Subject: Persistent SSH sessions In-Reply-To: <04B4524A-DBC8-4571-9478-D51A31776E46@kirei.se> References: <20100802163336.GA6097@jurassic> <04B4524A-DBC8-4571-9478-D51A31776E46@kirei.se> Message-ID: >From the June thread "OpenSSH with "resumable" functionality" ? On Tue, Aug 3, 2010 at 03:53, Jakob Schlyter wrote: > On 2 aug 2010, at 22.52, Damien Miller wrote: > > > If this is the case, then no amount of configuration in ssh/sshd will > > help you unfortunately. > > the new (or perhaps upcoming) roaming code would help, right? > > jakob > > _______________________________________________ > openssh-unix-dev mailing list > openssh-unix-dev at mindrot.org > https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev > -- Jeremy Nickurak -= Email/XMPP: -= jeremy at nickurak.ca =- From jeremy at nickurak.ca Wed Aug 4 03:06:30 2010 From: jeremy at nickurak.ca (Jeremy Nickurak) Date: Tue, 3 Aug 2010 11:06:30 -0600 Subject: OpenSSH with "resumable" functionality In-Reply-To: <20100615183029.GC1950@zzlevo.net> References: <4BCB86FE.3060207@gmail.com> <20100419110836.GA29169@folly> <20100419192343.GA26131@zzlevo.net> <20100609230526.GI19561@linux55.nas.nasa.gov> <20100615180447.GB1950@zzlevo.net> <20100615183029.GC1950@zzlevo.net> Message-ID: This idea got brought up in another thread, so I thought I'd look back. On Tue, Jun 15, 2010 at 12:30, Andreas Gunnarsson wrote: > > However, there may be circumstances when it's better to actively suspend > the connection. For example, if the default route moves to another > interface it could take some time before it is possible to detect that > the TCP session is dead. > > Indeed, when you've got that information, it's great to have, and might reduce latency during the connection renegotiation. When you don't have that information... well you still can recover, just with a little longer period of things backing up. Any updates on things happening here? I never heard anything back from the authors of the paper I discussed at the beginning of the thread, so my expectation is their work won't show up. -- Jeremy Nickurak -= Email/XMPP: -= jeremy at nickurak.ca =- From djm at mindrot.org Wed Aug 4 16:10:30 2010 From: djm at mindrot.org (Damien Miller) Date: Wed, 4 Aug 2010 16:10:30 +1000 (EST) Subject: remote vs local window discrepancy In-Reply-To: References: Message-ID: On Thu, 29 Jul 2010, Damien Miller wrote: > > Just as a quick test I've made the following change in addition to your fix > > and the counts seem to work as I would expect them (although I admit that I > > did not check to see if remote_window was still as I expected). In > > channel_input_data I added an extra 4 bytes to the amount that local_window > > is decremented : > > I think you change breaks window calculation for non-datagram channels, > please try this (on top of the other patch): Did the patch fix your problems? The window for OpenSSH 5.6 is pretty much closed, but I'd like to get this bugfix in if you can confirm it repaired the problem. -d From muks at banu.com Thu Aug 5 01:31:54 2010 From: muks at banu.com (Mukund Sivaraman) Date: Wed, 4 Aug 2010 21:01:54 +0530 Subject: Persistent SSH sessions In-Reply-To: <20100802211112.GA23900@linux55.nas.nasa.gov> References: <20100802163336.GA6097@jurassic> <20100802211112.GA23900@linux55.nas.nasa.gov> Message-ID: <20100804153154.GA22548@jurassic> Hi all Thank you for the replies to my question. On Mon, Aug 02, 2010 at 02:11:12PM -0700, Iain Morgan wrote: > Currently no attempt is made to re-establish a connection once it is > broken. If you search the mailing list you will see references to a > "roaming" feature which would add that functionality, but it has not yet > been committed to a released version of OpenSSH. As it is currently > implemented, user interaction is required to re-establish the session, > but that may change once the initial code has been committed. > > > > > I want to know if there is any way I can get ssh to try to renegotiate > > the active sessions to remote servers, without disconnecting them. > > The roaming feature will do that, but both the client and server need to > support it. I found the patch in the list archives. This is what I need, but I will wait till it is released in a portable release. Mukund From vadud3 at gmail.com Thu Aug 5 01:38:20 2010 From: vadud3 at gmail.com (Asif Iqbal) Date: Wed, 4 Aug 2010 11:38:20 -0400 Subject: Persistent SSH sessions In-Reply-To: <20100804153154.GA22548@jurassic> References: <20100802163336.GA6097@jurassic> <20100802211112.GA23900@linux55.nas.nasa.gov> <20100804153154.GA22548@jurassic> Message-ID: On Wed, Aug 4, 2010 at 11:31 AM, Mukund Sivaraman wrote: > Hi all > > Thank you for the replies to my question. > > On Mon, Aug 02, 2010 at 02:11:12PM -0700, Iain Morgan wrote: >> Currently no attempt is made to re-establish a connection once it is >> broken. If you search the mailing list you will see references to a >> "roaming" feature which would add that functionality, but it has not yet >> been committed to a released version of OpenSSH. As it is currently >> implemented, user interaction is required to re-establish the session, >> but that may change once the initial code has been committed. >> >> > >> > I want to know if there is any way I can get ssh to try to renegotiate >> > the active sessions to remote servers, without disconnecting them. >> >> The roaming feature will do that, but both the client and server need to >> support it. > > I found the patch in the list archives. This is what I need, but I will > wait till it is released in a portable release. I use autossh[1]. so after reboot the connection gets reestablished. also if the connection is broken autossh reconnects. [1] http://www.harding.motd.ca/autossh/ > > ? ? ? ? ? ? ? ?Mukund > _______________________________________________ > openssh-unix-dev mailing list > openssh-unix-dev at mindrot.org > https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev > -- Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu A: Because it messes up the order in which people normally read text. Q: Why is top-posting such a bad thing? From djm at mindrot.org Tue Aug 10 04:22:29 2010 From: djm at mindrot.org (Damien Miller) Date: Tue, 10 Aug 2010 04:22:29 +1000 (EST) Subject: Call for testing: OpenSSH-5.6 Message-ID: Hi, OpenSSH 5.6 is almost ready for release, so we would appreciate testing on as many platforms and systems as possible. This is a moderately large release, with a number of new features and bug fixes. Snapshot releases for portable OpenSSH are available from http://www.mindrot.org/openssh_snap/ The OpenBSD version is available in CVS HEAD: http://www.openbsd.org/anoncvs.html Portable OpenSSH is also available via anonymous CVS using the instructions at http://www.openssh.com/portable.html#cvs Running the regression tests supplied with Portable OpenSSH does not require installation and is a simply: $ ./configure && make tests Live testing on suitable non-production systems is also appreciated. Please send reports of success or failure to openssh-unix-dev at mindrot.org. Below is a summary of changes. More detail may be found in the ChangeLog in the portable OpenSSH tarballs. Thanks to the many people who contributed to this release. ------------------------------- Features: * Added a ControlPersist option to ssh_config(5) that automatically starts a background ssh(1) multiplex master when connecting. This connection can stay alive indefinitely, or can be set to automatically close after a user-specified duration of inactivity. * Hostbased authentication may now use certificate host keys. CA keys must be specified in a known_hosts file using the @cert-authority marker. * ssh-keygen(1) now supports signing certificates using a CA key that has been stored in a PKCS#11 token. * ssh(1) will now log the hostname and address that we connected to at LogLevel=verbose after authentication is successful to mitigate "phishing" attacks by servers with trusted keys that accept authentication silently and automatically before presenting fake password/passphrase prompts. Note that, for such an attack to be successful, the user must have disabled StrictHostKeyChecking (enabled by default) or an attacker must have access to a trusted host key for the destination server. * Expand %h to the hostname in ssh_config Hostname options. While this sounds useless, it is actually handy for working with unqualified hostnames: Host *.* Hostname %h Host * Hostname %h.example.org * Allow ssh-keygen(1) to import (-i) and export (-e) of PEM and PKCS#8 keys in addition to RFC4716 (SSH.COM) encodings via a new -m option (bz#1749) * sshd(8) will now queue debug messages for bad ownership or permissions on the user's keyfiles encountered during authentication. These messages will be sent after the user has successfully authenticated. These messages may be viewed in ssh(1) at LogLevel=debug or higher. * ssh(1) connection multiplexing now supports remote forwarding with dynamic port allocation and can report the allocated port back to the user: LPORT=`ssh -S muxsocket -R0:localhost:25 -O forward somehost` * sshd(8) now supports indirection in matching of principal names listed in certificates. By default, if a certificate has an embedded principals list then the destination username must match one of the names in the list for it to be accepted for authentication. sshd(8) now supports an optional AuthorizedPrincipalsFile to specify a list of names that may be accepted in place of the username when authorizing a certificate trusted via the sshd_config(5) TrustedCAKeys option. Similarly, authentication using a CA trusted in ~/.ssh/authorized_keys now accepts a principals="name1[,name2,...]" to specify a list of permitted names. If either option is absent, the current behaviour of requiring the username to appear in principals continues to apply. These options are useful for role accounts, disjoint account namespaces and "user at realm"-style naming policies in certificates. * Expose some more sshd_config(5) options inside Match blocks: AuthorizedKeysFile AuthorizedPrincipalsFile HostbasedUsesNameFromPacketOnly PermitTunnel * Revised the format of certificate keys. The new format, identified as ssh-{dss,rsa}-cert-v01 at openssh.com includes the following changes: - Addition of a serial number field. This may be specified by the CA at the time of certificate signing. - Moving the nonce field to the beginning of the certificate where it can better protect against chosen-prefix attacks on the signature hash (currently infeasible against the SHA1 hash used) - Renaming of the "constraints" field to "critical options" - Addng of a new non-critical "extensions" field. The "permit-*" options are now extensions, rather than critical options to permit non-OpenSSH implementation of this key format to degrade gracefully when encountering keys with options they do not recognize. The older format is still support for authentication and cert generation (use "ssh-keygen -t v00 -s ca_key ..." to generate a v00 certificate). The older format, introduced in OpenSSH 5.4, will be supported for at least one year from this release, after which it will be deprecated and removed. BugFixes: * The PKCS#11 code now retries a lookup for a private key if there's no matching key with CKA_SIGN attribute enabled; this fixes fixes MuscleCard support (bz#1736) * Unbreak strdelim() skipping past quoted strings, e.g. AllowUsers "blah blah" blah was broken (bz#1757) * sftp(1): fix swapped args in upload_dir_internal(), breaking recursive upload depth checks and causing verbose printing of transfers to always be turned on (bz#1797) * Fix a longstanding problem where if you suspend scp(1) at the password/passphrase prompt the terminal mode is not restored. * Fix PKCS#11 crash on some smartcards by checking the length returned for C_GetAttributValue for != 0 (bz#1773) * sftp(1): unbreak ls in working directories that contain globbing characters in their pathnames (bz#1655) * Print warning for missing home directory when ChrootDirectory=none (bz#1564) * sftp(1): fix memory leak in do_realpath() error path (bz#1771) * ssk-keygen(1): Standardise error messages when attempting to open private key files to include "progname: filename: error reason" (bz#1783) * Replace verbose and overflow-prone Linebuf code with read_keyfile_line() (bz#1565) * Include the user name on "subsystem request for ..." log messages * ssh(1) and sshd(8): remove hardcoded limit of 100 permitopen clauses and port forwards per direction (bz#1327) * sshd(8): ignore stderr output from subsystems to avoid hangs if a subsystem or shell initialisation writes to stderr (bz#1750) * Skip the initial check for access with an empty password when PermitEmptyPasswords=no (bz#1638) * sshd(8): fix logspam when key options (from="..." especially) deny non-matching keys (bz#1765) * ssh-keygen(1): display a more helpful error message when $HOME is inaccessible while trying to create .ssh directory (bz#1740) * ssh(1): fix hang when terminating a mux slave using ~. (bz#1758) * ssh-keygen(1): refuse to generate keys longer than OPENSSL_[RD]SA_MAX_MODULUS_BITS, since we would refuse to use them anyway (bz#1516) * Suppress spurious tty warning when using -O and stdin is not a tty (bz#1746) * Kill channel when pty allocation requests fail. Fixed stuck client if the server refuses pty allocation (bz#1698) Portable OpenSSH Bugfixes: - sshd(8): increase the maximum username length for login recording to 512 characters (bz#1579) * Initialize the values to be returned from PAM to sane values in case the PAM method doesn't write to them. (bz#1795) - Let configure find OpenSSL libraries in a lib64 subdirectory. (bz#1756) Checksums: ========== - SHA1 (openssh-5.5.tar.gz) = XXX - SHA1 (openssh-5.5p1.tar.gz) = XXX Reporting Bugs: =============== - Please read http://www.openssh.com/report.html Security bugs should be reported directly to openssh at openssh.com OpenSSH is brought to you by Markus Friedl, Niels Provos, Theo de Raadt, Kevin Steves, Damien Miller, Darren Tucker, Jason McIntyre, Tim Rice and Ben Lindstrom. From imorgan at nas.nasa.gov Tue Aug 10 06:21:44 2010 From: imorgan at nas.nasa.gov (Iain Morgan) Date: Mon, 9 Aug 2010 13:21:44 -0700 Subject: Call for testing: OpenSSH-5.6 In-Reply-To: References: Message-ID: <20100809202144.GF23900@linux55.nas.nasa.gov> On Mon, Aug 09, 2010 at 13:22:29 -0500, Damien Miller wrote: > Hi, > > OpenSSH 5.6 is almost ready for release, so we would appreciate testing > on as many platforms and systems as possible. This is a moderately large > release, with a number of new features and bug fixes. > > Snapshot releases for portable OpenSSH are available from > http://www.mindrot.org/openssh_snap/ > Hi Damien, In anticipation of this message, I had already begun testing. ;) The current snapshot builds on RHEL 5, but fails regress/login-timeout.sh. I was able to reproduce the problem several times during the process of debugging, but am not able to do so at the moment. The problem was occurring between the test without privilege separation and the one with it. The error indicated that port 4242 was in use, although after the failure there were no stray sshd processes. And netstat showed that the port was in a TIME_WAIT state. I suspect that the issue is the explicit kill in login-timeout.sh. I replaced it with a call to cleanup() and managed to complete the rest of the tests. 13-${SSH} -F $OBJ/ssh_config somehost true 14-if [ $? -ne 0 ]; then 15- fail "ssh connect after login grace timeout failed with privsep" 16-fi 17- 18:$SUDO kill `cat $PIDFILE` 19- 20-trace "test login grace without privsep" 21-echo "UsePrivilegeSeparation no" >> $OBJ/sshd_config 22-start_sshd 23- -- Iain Morgan From luis.mgarc at gmail.com Tue Aug 10 06:59:54 2010 From: luis.mgarc at gmail.com (Luis MartinGarcia.) Date: Mon, 09 Aug 2010 22:59:54 +0200 Subject: Call for testing: OpenSSH-5.6 In-Reply-To: References: Message-ID: <4C606C4A.2070504@gmail.com> On 08/09/2010 08:22 PM, Damien Miller wrote: > Running the regression tests supplied with Portable OpenSSH does not > require installation and is a simply: > > $ ./configure && make tests > > Live testing on suitable non-production systems is also > appreciated. Please send reports of success or failure to > openssh-unix-dev at mindrot.org. > Hi, I gave it a try and I'm happy to report that all tests were passed. This is on Linux 2.6.32 x86_64. Regards Luis MartinGarcia. From wierbows at us.ibm.com Tue Aug 10 09:23:48 2010 From: wierbows at us.ibm.com (David Wierbowski) Date: Mon, 9 Aug 2010 19:23:48 -0400 Subject: remote vs local window discrepancy In-Reply-To: References: Message-ID: Damien, I have verified that your fix works correctly in the tunnel case. I have not verified the non-tunnel case, but the logic looks fine to me. It's actually quite clever how you calculated the local_consumed value. One related question. The following check is in channel_check_window (Channel *c): if (c->type == SSH_CHANNEL_OPEN && !(c->flags & (CHAN_CLOSE_SENT|CHAN_CLOSE_RCVD)) && ((c->local_window_max - c->local_window > c->local_maxpacket*3) || c->local_window < c->local_window_max/2) && c->local_consumed > 0) { I was just curious why c->local_maxpacket*3 was chosen. Is there any significance to this value or was it just deemed to be a significantly large enough value that an adjust should be sent assuming that data has actually been consumed? Thanks for you help. Dave Wierbowski From: Damien Miller To: David Wierbowski/Endicott/IBM at IBMUS Cc: openssh-unix-dev at mindrot.org Date: 07/28/2010 09:43 PM Subject: Re: remote vs local window discrepancy On Wed, 28 Jul 2010, David Wierbowski wrote: > Damien, > > Your latest suggested fix worked exactly the same as your previous fix (at > least in my environment). > > I believe both fixes calculate local_consumed such that it agrees with the > amount the remote side decrements remote_window. I believe both fixes > decrement local_window by a value that is 4 bytes less per packet than the > amount that local_consumed is incremented. > > I believe I should see a pattern of local_consumed being incremented as > follows: 1508, 1508, 1508, 596 and local_window being decremented as > follows: 1508, 1508, 1508, 596. > > What I am seeing is a pattern of local_consumed being incremented as > follows: 1508, 1508, 1508, 596 and local_window being decremented as > follows: 1504, 1504, 1504, 592. > > Just as a quick test I've made the following change in addition to your fix > and the counts seem to work as I would expect them (although I admit that I > did not check to see if remote_window was still as I expected). In > channel_input_data I added an extra 4 bytes to the amount that local_window > is decremented : I think you change breaks window calculation for non-datagram channels, please try this (on top of the other patch): Index: channels.c =================================================================== RCS file: /cvs/src/usr.bin/ssh/channels.c,v retrieving revision 1.308 diff -u -p -r1.308 channels.c --- channels.c 13 Jul 2010 23:13:16 -0000 1.308 +++ channels.c 29 Jul 2010 01:42:02 -0000 @@ -2235,7 +2243,7 @@ channel_input_data(int type, u_int32_t s { int id; char *data; - u_int data_len; + u_int data_len, win_len; Channel *c; /* Get the channel number and verify it. */ @@ -2251,6 +2259,9 @@ channel_input_data(int type, u_int32_t s /* Get the data. */ data = packet_get_string_ptr(&data_len); + win_len = data_len; + if (c->datagram) + win_len += 4; /* string length header */ /* * Ignore data for protocol > 1.3 if output end is no longer open. @@ -2261,23 +2272,23 @@ channel_input_data(int type, u_int32_t s */ if (!compat13 && c->ostate != CHAN_OUTPUT_OPEN) { if (compat20) { - c->local_window -= data_len; - c->local_consumed += data_len; + c->local_window -= win_len; + c->local_consumed += win_len; } return; } if (compat20) { - if (data_len > c->local_maxpacket) { + if (win_len > c->local_maxpacket) { logit("channel %d: rcvd big packet %d, maxpack %d", - c->self, data_len, c-> local_maxpacket); + c->self, win_len, c-> local_maxpacket); } - if (data_len > c->local_window) { + if (win_len > c->local_window) { logit("channel %d: rcvd too much data %d, win %d", - c->self, data_len, c-> local_window); + c->self, win_len, c-> local_window); return; } - c->local_window -= data_len; + c->local_window -= win_len; } if (c->datagram) buffer_put_string(&c->output, data, data_len); From Laatsch at uni-koeln.de Tue Aug 10 09:21:24 2010 From: Laatsch at uni-koeln.de (Rainer Laatsch) Date: Tue, 10 Aug 2010 01:21:24 +0200 (CEST) Subject: Call for testing: OpenSSH-5.6 In-Reply-To: References: Message-ID: The snapshots until current unvariably unpack to openssh Why not add e.g. a timestamp/version-id to the name to inhibit overwriting the directory of (say) yesterday? Some extra precautions could then be avoided. Regards, R. ===================================================================== On Tue, 10 Aug 2010, Damien Miller wrote: > Hi, > > OpenSSH 5.6 is almost ready for release, so we would appreciate testing > on as many platforms and systems as possible. This is a moderately large > release, with a number of new features and bug fixes. > > Snapshot releases for portable OpenSSH are available from > http://www.mindrot.org/openssh_snap/ > > The OpenBSD version is available in CVS HEAD: > http://www.openbsd.org/anoncvs.html > > Portable OpenSSH is also available via anonymous CVS using the > instructions at http://www.openssh.com/portable.html#cvs > > Running the regression tests supplied with Portable OpenSSH does not > require installation and is a simply: > > $ ./configure && make tests > > Live testing on suitable non-production systems is also > appreciated. Please send reports of success or failure to > openssh-unix-dev at mindrot.org. > > Below is a summary of changes. More detail may be found in the ChangeLog > in the portable OpenSSH tarballs. > > Thanks to the many people who contributed to this release. > > ------------------------------- > > Features: > > * Added a ControlPersist option to ssh_config(5) that automatically > starts a background ssh(1) multiplex master when connecting. This > connection can stay alive indefinitely, or can be set to > automatically close after a user-specified duration of inactivity. > > * Hostbased authentication may now use certificate host keys. CA keys > must be specified in a known_hosts file using the @cert-authority > marker. > > * ssh-keygen(1) now supports signing certificates using a CA key that > has been stored in a PKCS#11 token. > > * ssh(1) will now log the hostname and address that we connected to at > LogLevel=verbose after authentication is successful to mitigate > "phishing" attacks by servers with trusted keys that accept > authentication silently and automatically before presenting fake > password/passphrase prompts. > > Note that, for such an attack to be successful, the user must have > disabled StrictHostKeyChecking (enabled by default) or an attacker > must have access to a trusted host key for the destination server. > > * Expand %h to the hostname in ssh_config Hostname options. While this > sounds useless, it is actually handy for working with unqualified > hostnames: > > Host *.* > Hostname %h > Host * > Hostname %h.example.org > > * Allow ssh-keygen(1) to import (-i) and export (-e) of PEM and PKCS#8 > keys in addition to RFC4716 (SSH.COM) encodings via a new -m option > (bz#1749) > > * sshd(8) will now queue debug messages for bad ownership or > permissions on the user's keyfiles encountered during authentication. > These messages will be sent after the user has successfully > authenticated. These messages may be viewed in ssh(1) at > LogLevel=debug or higher. > > * ssh(1) connection multiplexing now supports remote forwarding with > dynamic port allocation and can report the allocated port back to > the user: > > LPORT=`ssh -S muxsocket -R0:localhost:25 -O forward somehost` > > * sshd(8) now supports indirection in matching of principal names > listed in certificates. By default, if a certificate has an > embedded principals list then the destination username must match > one of the names in the list for it to be accepted for > authentication. > > sshd(8) now supports an optional AuthorizedPrincipalsFile to specify > a list of names that may be accepted in place of the username when > authorizing a certificate trusted via the sshd_config(5) > TrustedCAKeys option. Similarly, authentication using a CA trusted > in ~/.ssh/authorized_keys now accepts a principals="name1[,name2,...]" > to specify a list of permitted names. > > If either option is absent, the current behaviour of requiring the > username to appear in principals continues to apply. These options > are useful for role accounts, disjoint account namespaces and > "user at realm"-style naming policies in certificates. > > * Expose some more sshd_config(5) options inside Match blocks: > > AuthorizedKeysFile > AuthorizedPrincipalsFile > HostbasedUsesNameFromPacketOnly > PermitTunnel > > * Revised the format of certificate keys. The new format, identified as > ssh-{dss,rsa}-cert-v01 at openssh.com includes the following changes: > > - Addition of a serial number field. This may be specified by the CA > at the time of certificate signing. > > - Moving the nonce field to the beginning of the certificate where > it can better protect against chosen-prefix attacks on the > signature hash (currently infeasible against the SHA1 hash used) > > - Renaming of the "constraints" field to "critical options" > > - Addng of a new non-critical "extensions" field. The "permit-*" > options are now extensions, rather than critical options to > permit non-OpenSSH implementation of this key format to degrade > gracefully when encountering keys with options they do not > recognize. > > The older format is still support for authentication and cert generation > (use "ssh-keygen -t v00 -s ca_key ..." to generate a v00 certificate). > The older format, introduced in OpenSSH 5.4, will be supported for at > least one year from this release, after which it will be deprecated and > removed. > > BugFixes: > > * The PKCS#11 code now retries a lookup for a private key if there's > no matching key with CKA_SIGN attribute enabled; this fixes fixes > MuscleCard support (bz#1736) > > * Unbreak strdelim() skipping past quoted strings, e.g. > > AllowUsers "blah blah" blah > > was broken (bz#1757) > > * sftp(1): fix swapped args in upload_dir_internal(), breaking > recursive upload depth checks and causing verbose printing of > transfers to always be turned on (bz#1797) > > * Fix a longstanding problem where if you suspend scp(1) at the > password/passphrase prompt the terminal mode is not restored. > > * Fix PKCS#11 crash on some smartcards by checking the length > returned for C_GetAttributValue for != 0 (bz#1773) > > * sftp(1): unbreak ls in working directories that contain globbing > characters in their pathnames (bz#1655) > > * Print warning for missing home directory when ChrootDirectory=none > (bz#1564) > > * sftp(1): fix memory leak in do_realpath() error path (bz#1771) > > * ssk-keygen(1): Standardise error messages when attempting to open > private key files to include "progname: filename: error reason" > (bz#1783) > > * Replace verbose and overflow-prone Linebuf code with > read_keyfile_line() (bz#1565) > > * Include the user name on "subsystem request for ..." log messages > > * ssh(1) and sshd(8): remove hardcoded limit of 100 permitopen clauses > and port forwards per direction (bz#1327) > > * sshd(8): ignore stderr output from subsystems to avoid hangs if a > subsystem or shell initialisation writes to stderr (bz#1750) > > * Skip the initial check for access with an empty password when > PermitEmptyPasswords=no (bz#1638) > > * sshd(8): fix logspam when key options (from="..." especially) deny > non-matching keys (bz#1765) > > * ssh-keygen(1): display a more helpful error message when $HOME is > inaccessible while trying to create .ssh directory (bz#1740) > > * ssh(1): fix hang when terminating a mux slave using ~. (bz#1758) > > * ssh-keygen(1): refuse to generate keys longer than > OPENSSL_[RD]SA_MAX_MODULUS_BITS, since we would refuse to use > them anyway (bz#1516) > > * Suppress spurious tty warning when using -O and stdin is not a tty > (bz#1746) > > * Kill channel when pty allocation requests fail. Fixed stuck client > if the server refuses pty allocation (bz#1698) > > Portable OpenSSH Bugfixes: > > - sshd(8): increase the maximum username length for login recording > to 512 characters (bz#1579) > > * Initialize the values to be returned from PAM to sane values in case > the PAM method doesn't write to them. (bz#1795) > > - Let configure find OpenSSL libraries in a lib64 subdirectory. (bz#1756) > > Checksums: > ========== > > - SHA1 (openssh-5.5.tar.gz) = XXX > - SHA1 (openssh-5.5p1.tar.gz) = XXX > > Reporting Bugs: > =============== > > - Please read http://www.openssh.com/report.html > Security bugs should be reported directly to openssh at openssh.com > > OpenSSH is brought to you by Markus Friedl, Niels Provos, Theo de Raadt, > Kevin Steves, Damien Miller, Darren Tucker, Jason McIntyre, Tim Rice and > Ben Lindstrom. > > _______________________________________________ > openssh-unix-dev mailing list > openssh-unix-dev at mindrot.org > https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev > From Laatsch at uni-koeln.de Tue Aug 10 15:21:54 2010 From: Laatsch at uni-koeln.de (Rainer Laatsch) Date: Tue, 10 Aug 2010 07:21:54 +0200 (CEST) Subject: Test OK openssh-SNAP-20100810 Message-ID: All tests passed on Scientific Linux SL release 5.3 (Boron) Kernel: 2.6.18-164.15.1.el5 #1 SMP Tue Mar 16 18:53:13 EDT 2010 i686 i686 i386 GNU/Linux Only 2 remarks about 'SUDO not set'. Many thanks to the developers! Best regards R. From bostjan at a2o.si Tue Aug 10 16:26:35 2010 From: bostjan at a2o.si (Bostjan Skufca) Date: Tue, 10 Aug 2010 08:26:35 +0200 Subject: Call for testing: OpenSSH-5.6 In-Reply-To: References: Message-ID: +1 for parent poster's suggestion about dir, should be the same as tar file, i.e.: ---> openssh-SNAP-20100810.tar.gz should unpack to ---> openssh-SNAP-20100810 (of course this is from user's perspective, not from developer's) Anyway, all tests passed on slackware64 13.0. b. On 10 August 2010 01:21, Rainer Laatsch wrote: > The snapshots until current unvariably unpack to > openssh > Why not add e.g. a timestamp/version-id to the name to inhibit overwriting > the directory of (say) yesterday? Some extra precautions could then be > avoided. > > Regards, > R. > > ===================================================================== > > > On Tue, 10 Aug 2010, Damien Miller wrote: > > Hi, >> >> OpenSSH 5.6 is almost ready for release, so we would appreciate testing >> on as many platforms and systems as possible. This is a moderately large >> release, with a number of new features and bug fixes. >> >> Snapshot releases for portable OpenSSH are available from >> http://www.mindrot.org/openssh_snap/ >> >> The OpenBSD version is available in CVS HEAD: >> http://www.openbsd.org/anoncvs.html >> >> Portable OpenSSH is also available via anonymous CVS using the >> instructions at http://www.openssh.com/portable.html#cvs >> >> Running the regression tests supplied with Portable OpenSSH does not >> require installation and is a simply: >> >> $ ./configure && make tests >> >> Live testing on suitable non-production systems is also >> appreciated. Please send reports of success or failure to >> openssh-unix-dev at mindrot.org. >> >> Below is a summary of changes. More detail may be found in the ChangeLog >> in the portable OpenSSH tarballs. >> >> Thanks to the many people who contributed to this release. >> >> ------------------------------- >> >> Features: >> >> * Added a ControlPersist option to ssh_config(5) that automatically >> starts a background ssh(1) multiplex master when connecting. This >> connection can stay alive indefinitely, or can be set to >> automatically close after a user-specified duration of inactivity. >> >> * Hostbased authentication may now use certificate host keys. CA keys >> must be specified in a known_hosts file using the @cert-authority >> marker. >> >> * ssh-keygen(1) now supports signing certificates using a CA key that >> has been stored in a PKCS#11 token. >> >> * ssh(1) will now log the hostname and address that we connected to at >> LogLevel=verbose after authentication is successful to mitigate >> "phishing" attacks by servers with trusted keys that accept >> authentication silently and automatically before presenting fake >> password/passphrase prompts. >> >> Note that, for such an attack to be successful, the user must have >> disabled StrictHostKeyChecking (enabled by default) or an attacker >> must have access to a trusted host key for the destination server. >> >> * Expand %h to the hostname in ssh_config Hostname options. While this >> sounds useless, it is actually handy for working with unqualified >> hostnames: >> >> Host *.* >> Hostname %h >> Host * >> Hostname %h.example.org >> >> * Allow ssh-keygen(1) to import (-i) and export (-e) of PEM and PKCS#8 >> keys in addition to RFC4716 (SSH.COM) encodings via a new -m option >> (bz#1749) >> >> * sshd(8) will now queue debug messages for bad ownership or >> permissions on the user's keyfiles encountered during authentication. >> These messages will be sent after the user has successfully >> authenticated. These messages may be viewed in ssh(1) at >> LogLevel=debug or higher. >> >> * ssh(1) connection multiplexing now supports remote forwarding with >> dynamic port allocation and can report the allocated port back to >> the user: >> >> LPORT=`ssh -S muxsocket -R0:localhost:25 -O forward somehost` >> >> * sshd(8) now supports indirection in matching of principal names >> listed in certificates. By default, if a certificate has an >> embedded principals list then the destination username must match >> one of the names in the list for it to be accepted for >> authentication. >> >> sshd(8) now supports an optional AuthorizedPrincipalsFile to specify >> a list of names that may be accepted in place of the username when >> authorizing a certificate trusted via the sshd_config(5) >> TrustedCAKeys option. Similarly, authentication using a CA trusted >> in ~/.ssh/authorized_keys now accepts a principals="name1[,name2,...]" >> to specify a list of permitted names. >> >> If either option is absent, the current behaviour of requiring the >> username to appear in principals continues to apply. These options >> are useful for role accounts, disjoint account namespaces and >> "user at realm"-style naming policies in certificates. >> >> * Expose some more sshd_config(5) options inside Match blocks: >> >> AuthorizedKeysFile >> AuthorizedPrincipalsFile >> HostbasedUsesNameFromPacketOnly >> PermitTunnel >> >> * Revised the format of certificate keys. The new format, identified as >> ssh-{dss,rsa}-cert-v01 at openssh.com includes the following changes: >> >> - Addition of a serial number field. This may be specified by the CA >> at the time of certificate signing. >> >> - Moving the nonce field to the beginning of the certificate where >> it can better protect against chosen-prefix attacks on the >> signature hash (currently infeasible against the SHA1 hash used) >> >> - Renaming of the "constraints" field to "critical options" >> >> - Addng of a new non-critical "extensions" field. The "permit-*" >> options are now extensions, rather than critical options to >> permit non-OpenSSH implementation of this key format to degrade >> gracefully when encountering keys with options they do not >> recognize. >> >> The older format is still support for authentication and cert generation >> (use "ssh-keygen -t v00 -s ca_key ..." to generate a v00 certificate). >> The older format, introduced in OpenSSH 5.4, will be supported for at >> least one year from this release, after which it will be deprecated and >> removed. >> >> BugFixes: >> >> * The PKCS#11 code now retries a lookup for a private key if there's >> no matching key with CKA_SIGN attribute enabled; this fixes fixes >> MuscleCard support (bz#1736) >> >> * Unbreak strdelim() skipping past quoted strings, e.g. >> >> AllowUsers "blah blah" blah >> >> was broken (bz#1757) >> >> * sftp(1): fix swapped args in upload_dir_internal(), breaking >> recursive upload depth checks and causing verbose printing of >> transfers to always be turned on (bz#1797) >> >> * Fix a longstanding problem where if you suspend scp(1) at the >> password/passphrase prompt the terminal mode is not restored. >> >> * Fix PKCS#11 crash on some smartcards by checking the length >> returned for C_GetAttributValue for != 0 (bz#1773) >> >> * sftp(1): unbreak ls in working directories that contain globbing >> characters in their pathnames (bz#1655) >> >> * Print warning for missing home directory when ChrootDirectory=none >> (bz#1564) >> >> * sftp(1): fix memory leak in do_realpath() error path (bz#1771) >> >> * ssk-keygen(1): Standardise error messages when attempting to open >> private key files to include "progname: filename: error reason" >> (bz#1783) >> >> * Replace verbose and overflow-prone Linebuf code with >> read_keyfile_line() (bz#1565) >> >> * Include the user name on "subsystem request for ..." log messages >> >> * ssh(1) and sshd(8): remove hardcoded limit of 100 permitopen clauses >> and port forwards per direction (bz#1327) >> >> * sshd(8): ignore stderr output from subsystems to avoid hangs if a >> subsystem or shell initialisation writes to stderr (bz#1750) >> >> * Skip the initial check for access with an empty password when >> PermitEmptyPasswords=no (bz#1638) >> >> * sshd(8): fix logspam when key options (from="..." especially) deny >> non-matching keys (bz#1765) >> >> * ssh-keygen(1): display a more helpful error message when $HOME is >> inaccessible while trying to create .ssh directory (bz#1740) >> >> * ssh(1): fix hang when terminating a mux slave using ~. (bz#1758) >> >> * ssh-keygen(1): refuse to generate keys longer than >> OPENSSL_[RD]SA_MAX_MODULUS_BITS, since we would refuse to use >> them anyway (bz#1516) >> >> * Suppress spurious tty warning when using -O and stdin is not a tty >> (bz#1746) >> >> * Kill channel when pty allocation requests fail. Fixed stuck client >> if the server refuses pty allocation (bz#1698) >> >> Portable OpenSSH Bugfixes: >> >> - sshd(8): increase the maximum username length for login recording >> to 512 characters (bz#1579) >> >> * Initialize the values to be returned from PAM to sane values in case >> the PAM method doesn't write to them. (bz#1795) >> >> - Let configure find OpenSSL libraries in a lib64 subdirectory. (bz#1756) >> >> Checksums: >> ========== >> >> - SHA1 (openssh-5.5.tar.gz) = XXX >> - SHA1 (openssh-5.5p1.tar.gz) = XXX >> >> Reporting Bugs: >> =============== >> >> - Please read http://www.openssh.com/report.html >> Security bugs should be reported directly to openssh at openssh.com >> >> OpenSSH is brought to you by Markus Friedl, Niels Provos, Theo de Raadt, >> Kevin Steves, Damien Miller, Darren Tucker, Jason McIntyre, Tim Rice and >> Ben Lindstrom. >> >> _______________________________________________ >> openssh-unix-dev mailing list >> openssh-unix-dev at mindrot.org >> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev >> >> _______________________________________________ > openssh-unix-dev mailing list > openssh-unix-dev at mindrot.org > https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev > From vinschen at redhat.com Tue Aug 10 21:48:09 2010 From: vinschen at redhat.com (Corinna Vinschen) Date: Tue, 10 Aug 2010 13:48:09 +0200 Subject: Call for testing: OpenSSH-5.6 In-Reply-To: References: Message-ID: <20100810114809.GN17925@calimero.vinschen.de> On Aug 10 04:22, Damien Miller wrote: > Hi, > > OpenSSH 5.6 is almost ready for release, so we would appreciate testing > on as many platforms and systems as possible. This is a moderately large > release, with a number of new features and bug fixes. Builds OOTB on Cygwin. All tests pass except for the expected problems in sftp-glob due to Win32/POSIX path weirdness. Corinna -- Corinna Vinschen Cygwin Project Co-Leader Red Hat From imorgan at nas.nasa.gov Wed Aug 11 04:32:40 2010 From: imorgan at nas.nasa.gov (Iain Morgan) Date: Tue, 10 Aug 2010 11:32:40 -0700 Subject: Call for testing: OpenSSH-5.6 In-Reply-To: References: Message-ID: <20100810183240.GG23900@linux55.nas.nasa.gov> On Mon, Aug 09, 2010 at 13:22:29 -0500, Damien Miller wrote: > Hi, > > OpenSSH 5.6 is almost ready for release, so we would appreciate testing > on as many platforms and systems as possible. This is a moderately large > release, with a number of new features and bug fixes. > All tests passed with the 20100811 snapshot on the following platforms: RHEL 5/x86_64 SLES 10/x86_64 SLES 10/Itanium Solaris 9/SPARC Mac OS X 10.5.8/Intel -- Iain Morgan From andyb1 at andy-t.org Wed Aug 11 06:53:55 2010 From: andyb1 at andy-t.org (Andy Tsouladze) Date: Tue, 10 Aug 2010 15:53:55 -0500 (CDT) Subject: Call for testing: OpenSSH-5.6 In-Reply-To: References: Message-ID: Hi there, All tests passed on slackware-13.0 32-bit. On slackware-12.0, there were problems. make works fine, but `make tests' fails. Attached is the output (stdout and stderr) from `make tests'. From the affected machine: andyt at majesty: openssh> cat /etc/slackware-version Slackware 12.0.0 andyt at majesty: openssh> gcc -v Reading specs from /usr/lib/gcc/i486-slackware-linux/4.1.2/specs Target: i486-slackware-linux Configured with: ../gcc-4.1.2/configure --prefix=/usr --enable-shared --enable-languages=ada,c,c++,fortran,java,objc --enable-threads=posix --enable-__cxa_atexit --disable-checking --with-gnu-ld --verbose --with-arch=i486 --target=i486-slackware-linux --host=i486-slackware-linux Thread model: posix gcc version 4.1.2 Anything I need to do/re-run to help? Regards, Andy On Tue, 10 Aug 2010, Damien Miller wrote: > Hi, > > OpenSSH 5.6 is almost ready for release, so we would appreciate testing > on as many platforms and systems as possible. This is a moderately large > release, with a number of new features and bug fixes. > > Snapshot releases for portable OpenSSH are available from > http://www.mindrot.org/openssh_snap/ > > The OpenBSD version is available in CVS HEAD: > http://www.openbsd.org/anoncvs.html > > Portable OpenSSH is also available via anonymous CVS using the > instructions at http://www.openssh.com/portable.html#cvs > > Running the regression tests supplied with Portable OpenSSH does not > require installation and is a simply: > > $ ./configure && make tests > > Live testing on suitable non-production systems is also > appreciated. Please send reports of success or failure to > openssh-unix-dev at mindrot.org. > > Below is a summary of changes. More detail may be found in the ChangeLog > in the portable OpenSSH tarballs. > > Thanks to the many people who contributed to this release. > > ------------------------------- > > Features: > > * Added a ControlPersist option to ssh_config(5) that automatically > starts a background ssh(1) multiplex master when connecting. This > connection can stay alive indefinitely, or can be set to > automatically close after a user-specified duration of inactivity. > > * Hostbased authentication may now use certificate host keys. CA keys > must be specified in a known_hosts file using the @cert-authority > marker. > > * ssh-keygen(1) now supports signing certificates using a CA key that > has been stored in a PKCS#11 token. > > * ssh(1) will now log the hostname and address that we connected to at > LogLevel=verbose after authentication is successful to mitigate > "phishing" attacks by servers with trusted keys that accept > authentication silently and automatically before presenting fake > password/passphrase prompts. > > Note that, for such an attack to be successful, the user must have > disabled StrictHostKeyChecking (enabled by default) or an attacker > must have access to a trusted host key for the destination server. > > * Expand %h to the hostname in ssh_config Hostname options. While this > sounds useless, it is actually handy for working with unqualified > hostnames: > > Host *.* > Hostname %h > Host * > Hostname %h.example.org > > * Allow ssh-keygen(1) to import (-i) and export (-e) of PEM and PKCS#8 > keys in addition to RFC4716 (SSH.COM) encodings via a new -m option > (bz#1749) > > * sshd(8) will now queue debug messages for bad ownership or > permissions on the user's keyfiles encountered during authentication. > These messages will be sent after the user has successfully > authenticated. These messages may be viewed in ssh(1) at > LogLevel=debug or higher. > > * ssh(1) connection multiplexing now supports remote forwarding with > dynamic port allocation and can report the allocated port back to > the user: > > LPORT=`ssh -S muxsocket -R0:localhost:25 -O forward somehost` > > * sshd(8) now supports indirection in matching of principal names > listed in certificates. By default, if a certificate has an > embedded principals list then the destination username must match > one of the names in the list for it to be accepted for > authentication. > > sshd(8) now supports an optional AuthorizedPrincipalsFile to specify > a list of names that may be accepted in place of the username when > authorizing a certificate trusted via the sshd_config(5) > TrustedCAKeys option. Similarly, authentication using a CA trusted > in ~/.ssh/authorized_keys now accepts a principals="name1[,name2,...]" > to specify a list of permitted names. > > If either option is absent, the current behaviour of requiring the > username to appear in principals continues to apply. These options > are useful for role accounts, disjoint account namespaces and > "user at realm"-style naming policies in certificates. > > * Expose some more sshd_config(5) options inside Match blocks: > > AuthorizedKeysFile > AuthorizedPrincipalsFile > HostbasedUsesNameFromPacketOnly > PermitTunnel > > * Revised the format of certificate keys. The new format, identified as > ssh-{dss,rsa}-cert-v01 at openssh.com includes the following changes: > > - Addition of a serial number field. This may be specified by the CA > at the time of certificate signing. > > - Moving the nonce field to the beginning of the certificate where > it can better protect against chosen-prefix attacks on the > signature hash (currently infeasible against the SHA1 hash used) > > - Renaming of the "constraints" field to "critical options" > > - Addng of a new non-critical "extensions" field. The "permit-*" > options are now extensions, rather than critical options to > permit non-OpenSSH implementation of this key format to degrade > gracefully when encountering keys with options they do not > recognize. > > The older format is still support for authentication and cert generation > (use "ssh-keygen -t v00 -s ca_key ..." to generate a v00 certificate). > The older format, introduced in OpenSSH 5.4, will be supported for at > least one year from this release, after which it will be deprecated and > removed. > > BugFixes: > > * The PKCS#11 code now retries a lookup for a private key if there's > no matching key with CKA_SIGN attribute enabled; this fixes fixes > MuscleCard support (bz#1736) > > * Unbreak strdelim() skipping past quoted strings, e.g. > > AllowUsers "blah blah" blah > > was broken (bz#1757) > > * sftp(1): fix swapped args in upload_dir_internal(), breaking > recursive upload depth checks and causing verbose printing of > transfers to always be turned on (bz#1797) > > * Fix a longstanding problem where if you suspend scp(1) at the > password/passphrase prompt the terminal mode is not restored. > > * Fix PKCS#11 crash on some smartcards by checking the length > returned for C_GetAttributValue for != 0 (bz#1773) > > * sftp(1): unbreak ls in working directories that contain globbing > characters in their pathnames (bz#1655) > > * Print warning for missing home directory when ChrootDirectory=none > (bz#1564) > > * sftp(1): fix memory leak in do_realpath() error path (bz#1771) > > * ssk-keygen(1): Standardise error messages when attempting to open > private key files to include "progname: filename: error reason" > (bz#1783) > > * Replace verbose and overflow-prone Linebuf code with > read_keyfile_line() (bz#1565) > > * Include the user name on "subsystem request for ..." log messages > > * ssh(1) and sshd(8): remove hardcoded limit of 100 permitopen clauses > and port forwards per direction (bz#1327) > > * sshd(8): ignore stderr output from subsystems to avoid hangs if a > subsystem or shell initialisation writes to stderr (bz#1750) > > * Skip the initial check for access with an empty password when > PermitEmptyPasswords=no (bz#1638) > > * sshd(8): fix logspam when key options (from="..." especially) deny > non-matching keys (bz#1765) > > * ssh-keygen(1): display a more helpful error message when $HOME is > inaccessible while trying to create .ssh directory (bz#1740) > > * ssh(1): fix hang when terminating a mux slave using ~. (bz#1758) > > * ssh-keygen(1): refuse to generate keys longer than > OPENSSL_[RD]SA_MAX_MODULUS_BITS, since we would refuse to use > them anyway (bz#1516) > > * Suppress spurious tty warning when using -O and stdin is not a tty > (bz#1746) > > * Kill channel when pty allocation requests fail. Fixed stuck client > if the server refuses pty allocation (bz#1698) > > Portable OpenSSH Bugfixes: > > - sshd(8): increase the maximum username length for login recording > to 512 characters (bz#1579) > > * Initialize the values to be returned from PAM to sane values in case > the PAM method doesn't write to them. (bz#1795) > > - Let configure find OpenSSL libraries in a lib64 subdirectory. (bz#1756) > > Checksums: > ========== > > - SHA1 (openssh-5.5.tar.gz) = XXX > - SHA1 (openssh-5.5p1.tar.gz) = XXX > > Reporting Bugs: > =============== > > - Please read http://www.openssh.com/report.html > Security bugs should be reported directly to openssh at openssh.com > > OpenSSH is brought to you by Markus Friedl, Niels Provos, Theo de Raadt, > Kevin Steves, Damien Miller, Darren Tucker, Jason McIntyre, Tim Rice and > Ben Lindstrom. > > _______________________________________________ > openssh-unix-dev mailing list > openssh-unix-dev at mindrot.org > https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev > Dr Andy Tsouladze Sr Unix/Storage SysAdmin From apb at cequrux.com Thu Aug 12 08:22:30 2010 From: apb at cequrux.com (Alan Barrett) Date: Thu, 12 Aug 2010 00:22:30 +0200 Subject: Call for testing: OpenSSH-5.6 In-Reply-To: References: Message-ID: <20100811222230.GA803@apb-laptoy.apb.alt.za> On Tue, 10 Aug 2010, Damien Miller wrote: > OpenSSH 5.6 is almost ready for release, so we would appreciate testing > on as many platforms and systems as possible. This is a moderately large > release, with a number of new features and bug fixes. I attach two patches relative to the 20100810 snapshot. 1) ctype(3) functions should not be called with char arguments; they should be called with unsigned char arguments. 2) in sftp-common.c, strmode() requires #include , and the results of user_from_uid() and group_from_gid() are pointers to const char, not pointers to plain char I also attach the semantic patch that generated patch 1. Use "spatch -inplace -sp_file ctype.spatch -dir .". The result compiles successfully with "-Werror" appended to CFLAGS, and passes all tests on NetBSD-5.99.27/i386. --apb (Alan Barrett) -------------- next part -------------- diff --git a/canohost.c b/canohost.c index ef94d91..8cf7005 100644 --- a/canohost.c +++ b/canohost.c @@ -104,8 +104,8 @@ get_remote_hostname(int sock, int use_dns) * of this software). */ for (i = 0; name[i]; i++) - if (isupper(name[i])) - name[i] = (char)tolower(name[i]); + if (isupper((unsigned char)name[i])) + name[i] = (char)tolower((unsigned char)name[i]); /* * Map it back to an IP address and check that the given * address actually is an address of this host. This is diff --git a/clientloop.c b/clientloop.c index de79793..10bda5f 100644 --- a/clientloop.c +++ b/clientloop.c @@ -831,7 +831,7 @@ process_cmdline(void) cmd = s = read_passphrase("\r\nssh> ", RP_ECHO); if (s == NULL) goto out; - while (isspace(*s)) + while (isspace((unsigned char)*s)) s++; if (*s == '-') s++; /* Skip cmdline '-', if any */ @@ -885,7 +885,7 @@ process_cmdline(void) goto out; } - while (isspace(*++s)) + while (isspace((unsigned char)*++s)) ; /* XXX update list of forwards in options */ diff --git a/match.c b/match.c index 2389477..d36134c 100644 --- a/match.c +++ b/match.c @@ -140,8 +140,8 @@ match_pattern_list(const char *string, const char *pattern, u_int len, for (subi = 0; i < len && subi < sizeof(sub) - 1 && pattern[i] != ','; subi++, i++) - sub[subi] = dolower && isupper(pattern[i]) ? - (char)tolower(pattern[i]) : pattern[i]; + sub[subi] = dolower && isupper((unsigned char)pattern[i]) ? + (char)tolower((unsigned char)pattern[i]) : pattern[i]; /* If subpattern too long, return failure (no match). */ if (subi >= sizeof(sub) - 1) return 0; diff --git a/openbsd-compat/fmt_scaled.c b/openbsd-compat/fmt_scaled.c index edd682a..709db6f 100644 --- a/openbsd-compat/fmt_scaled.c +++ b/openbsd-compat/fmt_scaled.c @@ -81,7 +81,7 @@ scan_scaled(char *scaled, long long *result) long long scale_fact = 1, whole = 0, fpart = 0; /* Skip leading whitespace */ - while (isascii(*p) && isspace(*p)) + while (isascii(*p) && isspace((unsigned char)*p)) ++p; /* Then at most one leading + or - */ @@ -108,7 +108,7 @@ scan_scaled(char *scaled, long long *result) * (but note that E for Exa might look like e to some!). * Advance 'p' to end, to get scale factor. */ - for (; isascii(*p) && (isdigit(*p) || *p=='.'); ++p) { + for (; isascii(*p) && (isdigit((unsigned char)*p) || *p=='.'); ++p) { if (*p == '.') { if (fract_digits > 0) { /* oops, more than one '.' */ errno = EINVAL; @@ -152,10 +152,10 @@ scan_scaled(char *scaled, long long *result) /** Are we there yet? */ if (*p == scale_chars[i] || - *p == tolower(scale_chars[i])) { + *p == tolower((unsigned char)scale_chars[i])) { /* If it ends with alphanumerics after the scale char, bad. */ - if (isalnum(*(p+1))) { + if (isalnum((unsigned char)*(p + 1))) { errno = EINVAL; return -1; } diff --git a/openbsd-compat/inet_aton.c b/openbsd-compat/inet_aton.c index 130597e..7247c8b 100644 --- a/openbsd-compat/inet_aton.c +++ b/openbsd-compat/inet_aton.c @@ -100,7 +100,7 @@ inet_aton(const char *cp, struct in_addr *addr) * Values are specified as for C: * 0x=hex, 0=octal, isdigit=decimal. */ - if (!isdigit(c)) + if (!isdigit((unsigned char)c)) return (0); val = 0; base = 10; if (c == '0') { @@ -111,12 +111,12 @@ inet_aton(const char *cp, struct in_addr *addr) base = 8; } for (;;) { - if (isascii(c) && isdigit(c)) { + if (isascii(c) && isdigit((unsigned char)c)) { val = (val * base) + (c - '0'); c = *++cp; - } else if (base == 16 && isascii(c) && isxdigit(c)) { + } else if (base == 16 && isascii(c) && isxdigit((unsigned char)c)) { val = (val << 4) | - (c + 10 - (islower(c) ? 'a' : 'A')); + (c + 10 - (islower((unsigned char)c) ? 'a' : 'A')); c = *++cp; } else break; @@ -138,7 +138,7 @@ inet_aton(const char *cp, struct in_addr *addr) /* * Check for trailing characters. */ - if (c != '\0' && (!isascii(c) || !isspace(c))) + if (c != '\0' && (!isascii(c) || !isspace((unsigned char)c))) return (0); /* * Concoct the address according to diff --git a/openbsd-compat/mktemp.c b/openbsd-compat/mktemp.c index 2285c84..38f0153 100644 --- a/openbsd-compat/mktemp.c +++ b/openbsd-compat/mktemp.c @@ -159,7 +159,7 @@ _gettemp(path, doopen, domkdir, slen) return (0); *trv++ = 'a'; } else { - if (isdigit(*trv)) + if (isdigit((unsigned char)*trv)) *trv = 'a'; else if (*trv == 'z') /* inc from z to A */ *trv = 'A'; diff --git a/openbsd-compat/readpassphrase.c b/openbsd-compat/readpassphrase.c index 62b6d0d..e4dd1c9 100644 --- a/openbsd-compat/readpassphrase.c +++ b/openbsd-compat/readpassphrase.c @@ -131,11 +131,11 @@ restart: if (p < end) { if ((flags & RPP_SEVENBIT)) ch &= 0x7f; - if (isalpha(ch)) { + if (isalpha((unsigned char)ch)) { if ((flags & RPP_FORCELOWER)) - ch = (char)tolower(ch); + ch = (char)tolower((unsigned char)ch); if ((flags & RPP_FORCEUPPER)) - ch = (char)toupper(ch); + ch = (char)toupper((unsigned char)ch); } *p++ = ch; } diff --git a/readconf.c b/readconf.c index 0296590..3927204 100644 --- a/readconf.c +++ b/readconf.c @@ -539,7 +539,7 @@ parse_yesnoask: orig = val64 = strtoll(arg, &endofnumber, 10); if (arg == endofnumber) fatal("%.200s line %d: Bad number.", filename, linenum); - switch (toupper(*endofnumber)) { + switch (toupper((unsigned char)*endofnumber)) { case '\0': scale = 1; break; @@ -1294,7 +1294,7 @@ parse_forward(Forward *fwd, const char *fwdspec, int dynamicfwd, int remotefwd) cp = p = xstrdup(fwdspec); /* skip leading spaces */ - while (isspace(*cp)) + while (isspace((unsigned char)*cp)) cp++; for (i = 0; i < 4; ++i) diff --git a/scp.c b/scp.c index e07de42..57c1490 100644 --- a/scp.c +++ b/scp.c @@ -988,7 +988,7 @@ sink(int argc, char **argv) if (*cp++ != ' ') SCREWUP("mode not delimited"); - for (size = 0; isdigit(*cp);) + for (size = 0; isdigit((unsigned char)*cp);) size = size * 10 + (*cp++ - '0'); if (*cp++ != ' ') SCREWUP("size not delimited"); diff --git a/sftp.c b/sftp.c index 229f129..ff0cb7f 100644 --- a/sftp.c +++ b/sftp.c @@ -986,7 +986,7 @@ makeargv(const char *arg, int *argcp, int sloppy, char *lastquote, state = MA_START; i = j = 0; for (;;) { - if (isspace(arg[i])) { + if (isspace((unsigned char)arg[i])) { if (state == MA_UNQUOTED) { /* Terminate current argument */ argvs[j++] = '\0'; diff --git a/ssh.c b/ssh.c index ab37c20..60b2284 100644 --- a/ssh.c +++ b/ssh.c @@ -711,8 +711,8 @@ main(int ac, char **av) /* force lowercase for hostkey matching */ if (options.host_key_alias != NULL) { for (p = options.host_key_alias; *p; p++) - if (isupper(*p)) - *p = (char)tolower(*p); + if (isupper((unsigned char)*p)) + *p = (char)tolower((unsigned char)*p); } if (options.proxy_command != NULL && diff --git a/sshconnect.c b/sshconnect.c index f55beff..7d1110f 100644 --- a/sshconnect.c +++ b/sshconnect.c @@ -1106,8 +1106,8 @@ ssh_login(Sensitive *sensitive, const char *orighost, /* Convert the user-supplied hostname into all lowercase. */ host = xstrdup(orighost); for (cp = host; *cp; cp++) - if (isupper(*cp)) - *cp = (char)tolower(*cp); + if (isupper((unsigned char)*cp)) + *cp = (char)tolower((unsigned char)*cp); /* Exchange protocol version identification strings with the server. */ ssh_exchange_identification(timeout_ms); -------------- next part -------------- diff --git a/sftp-common.c b/sftp-common.c index a042875..d0d7de7 100644 --- a/sftp-common.c +++ b/sftp-common.c @@ -36,6 +36,7 @@ #include #include #include +#include #ifdef HAVE_UTIL_H #include #endif @@ -191,7 +192,7 @@ ls_file(const char *name, const struct stat *st, int remote, int si_units) { int ulen, glen, sz = 0; struct tm *ltime = localtime(&st->st_mtime); - char *user, *group; + const char *user, *group; char buf[1024], mode[11+1], tbuf[12+1], ubuf[11+1], gbuf[11+1]; char sbuf[FMT_SCALED_STRSIZE]; -------------- next part -------------- // cast to (unsigned char) where ctype(3) functions are called // with char args. // // Note that isascii is not included in the list of functions to modify, // because it is well-defined on the entire range of integers. // @ bad_ctype expression @ char X; @@ ( isalpha | isupper | islower | isdigit | isxdigit | isalnum | isspace | isalnum | isspace | ispunct | isprint | isgraph | iscntrl | isblank | toupper | tolower ) -(X) +((unsigned char)X) From djm at mindrot.org Fri Aug 13 23:50:53 2010 From: djm at mindrot.org (Damien Miller) Date: Fri, 13 Aug 2010 23:50:53 +1000 (EST) Subject: Call for testing: OpenSSH-5.6 In-Reply-To: References: Message-ID: On Tue, 10 Aug 2010, Andy Tsouladze wrote: > Hi there, > > All tests passed on slackware-13.0 32-bit. > > On slackware-12.0, there were problems. > make works fine, but `make tests' fails. > > Attached is the output (stdout and stderr) from `make tests'. It looks like the list spam mitigation has eaten your attachment - could you paste it inline, attach it as text/plain or whack it on a website somewhere? Thanks, Damien From andyb1 at andy-t.org Sat Aug 14 13:46:58 2010 From: andyb1 at andy-t.org (Andy Tsouladze) Date: Fri, 13 Aug 2010 22:46:58 -0500 (CDT) Subject: Call for testing: OpenSSH-5.6 In-Reply-To: References: Message-ID: Damien, I no longer have the original output, so I tried to compile the latest, openssh-SNAP-20100814.tar.gz, with the same result. New output is attached as a text file. If it gets lost again, you can get a copy from http://www.andy-t.org/openssh/tests.out.txt Thanks, Andy On Fri, 13 Aug 2010, Damien Miller wrote: > On Tue, 10 Aug 2010, Andy Tsouladze wrote: > >> Hi there, >> >> All tests passed on slackware-13.0 32-bit. >> >> On slackware-12.0, there were problems. >> make works fine, but `make tests' fails. >> >> Attached is the output (stdout and stderr) from `make tests'. > > It looks like the list spam mitigation has eaten your attachment - could > you paste it inline, attach it as text/plain or whack it on a website > somewhere? > > Thanks, > Damien > Dr Andy Tsouladze Sr Unix/Storage SysAdmin -------------- next part -------------- An embedded and charset-unspecified text was scrubbed... Name: tests.out.txt URL: From jonathan88 at gmail.com Sun Aug 15 00:45:18 2010 From: jonathan88 at gmail.com (Jon) Date: Sat, 14 Aug 2010 10:45:18 -0400 Subject: bind_address ignored? as in "ssh -R [bind_address]:12491:127.0.0.1:500" Message-ID: No answers on secureshell at securityfocus.com I must be doing something wrong or the server seems to ignore my bind request. Port forwarding is working it just bind to all ips and ignores my bind request. I've also tried this with an rfc1918 address opposed to a loopback and had the same results. Google and the archive haven't helped. Thanks in advance for your time and consideration. -server- uname -a Linux example.com 2.6.18-128.7.1.el5xen #1 SMP Mon Aug 24 10:08:55 EDT 2009 i686 i686 i386 GNU/Linux OpenSSH_4.3p2, OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 -sshd_config- AllowTcpForwarding yes GatewayPorts yes -from other system- ssh -R 127.0.0.10:12491:127.0.0.1:5000 foo at example.com -messages- Aug 12 16:22:45 xxx sshd[1440]: debug1: server_input_global_request: tcpip-forward listen 127.0.0.10 port 12491 Aug 12 16:22:45 xxx sshd[1440]: debug1: Local forwarding listening on :: port 12491. Aug 12 16:22:45 xxx sshd[1440]: debug1: channel 0: new [port listener] Aug 12 16:22:45 xxx sshd[1440]: debug1: Local forwarding listening on 0.0.0.0 port 12491. Aug 12 16:22:45 xxx sshd[1440]: error: bind: Address already in use -check- netstat -an | grep 12491 tcp ? ? ? ?0 ? ? ?0 :::12491 ? ? ? ? ? ? ? ? ? ?:::* ? ? LISTEN okay that didn't work lets see if "GatewayPorts" is related -sshd_config- AllowTcpForwarding yes GatewayPorts no -from other system- ssh -R 127.0.0.10:12491:127.0.0.1:5000 foo at example.com -messages- Aug 12 16:25:26 xxx sshd[1578]: debug1: Local forwarding listening on 127.0.0.1 port 12491. Aug 12 16:25:26 xxx sshd[1578]: debug1: channel 0: new [port listener] Aug 12 16:25:26 xxx sshd[1578]: debug1: Local forwarding listening on ::1 port 12491. -check- netstat -an | grep 12491 tcp ? ? ? ?0 ? ? ?0 127.0.0.1:12491 ? ? ? ? ? ? 0.0.0.0:* ? ? LISTEN tcp ? ? ? ?0 ? ? ?0 ::1:12491 ? ? ? ? ? ? ? ? ? :::* ? ? LISTEN -networking- eth0 ? ? ?Link encap:Ethernet ?HWaddr xx:xx:xx:xx:xx:xx ? ? ? ? ?inet addr:xxx.xxx.xxx.xxx ?Bcast:xxx.xxx.xxx.xxx ?Mask:255.255.252.0 ? ? ? ? ?inet6 addr: fe80::216:3eff:fe6b:1e1d/64 Scope:Link ? ? ? ? ?UP BROADCAST RUNNING MULTICAST ?MTU:1500 ?Metric:1 ? ? ? ? ?RX packets:33160 errors:0 dropped:0 overruns:0 frame:0 ? ? ? ? ?TX packets:1240 errors:0 dropped:0 overruns:0 carrier:0 ? ? ? ? ?collisions:0 txqueuelen:1000 ? ? ? ? ?RX bytes:2158440 (2.0 MiB) ?TX bytes:228786 (223.4 KiB) lo ? ? ? ?Link encap:Local Loopback ? ? ? ? ?inet addr:127.0.0.1 ?Mask:255.0.0.0 ? ? ? ? ?inet6 addr: ::1/128 Scope:Host ? ? ? ? ?UP LOOPBACK RUNNING ?MTU:16436 ?Metric:1 ? ? ? ? ?RX packets:124 errors:0 dropped:0 overruns:0 frame:0 ? ? ? ? ?TX packets:124 errors:0 dropped:0 overruns:0 carrier:0 ? ? ? ? ?collisions:0 txqueuelen:0 ? ? ? ? ?RX bytes:11631 (11.3 KiB) ?TX bytes:11631 (11.3 KiB) lo:1 ? ? ?Link encap:Local Loopback ? ? ? ? ?inet addr:127.0.0.10 ?Mask:255.0.0.0 ? ? ? ? ?UP LOOPBACK RUNNING ?MTU:16436 ?Metric:1 -check- ping 127.0.0.10 PING 127.0.0.10 (127.0.0.10) 56(84) bytes of data. 64 bytes from 127.0.0.10: icmp_seq=1 ttl=64 time=0.025 ms -check- ping 127.0.0.1 PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data. 64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.024 ms -from man- GatewayPorts ? ? ? ? ? ? Specifies whether remote hosts are allowed to connect to ports forwarded for the client. ?By default, sshd binds remote port for- ? ? ? ? ? ? wardings to the loopback address. ?This prevents other remote hosts from connecting to forwarded ports. ?GatewayPorts can be used ? ? ? ? ? ? to specify that sshd should allow remote port forwardings to bind to non-loopback addresses, thus allowing other hosts to con- ? ? ? ? ? ? nect. ?The argument may be "no" to force remote port forwardings to be available to the local host only, "yes" to force remote ? ? ? ? ? ? port forwardings to bind to the wildcard address, or "clientspecified" to allow the client to select the address to which the ? ? ? ? ? ? forwarding is bound. ?The default is "no". From tgc at jupiterrise.com Sun Aug 15 05:11:30 2010 From: tgc at jupiterrise.com (Tom Christensen) Date: Sat, 14 Aug 2010 21:11:30 +0200 Subject: Call for testing: OpenSSH-5.6 In-Reply-To: References: Message-ID: <4C66EA62.2050503@jupiterrise.com> Damien Miller wrote: > Hi, > > OpenSSH 5.6 is almost ready for release, so we would appreciate testing > on as many platforms and systems as possible. This is a moderately large > release, with a number of new features and bug fixes. > > Snapshot releases for portable OpenSSH are available from > http://www.mindrot.org/openssh_snap/ > > Running the regression tests supplied with Portable OpenSSH does not > require installation and is a simply: > > $ ./configure && make tests > I tried building openssh-SNAP-20100815 on IRIX 5.3 but it fails because this platform lacks strptime: gcc -g -O2 -Wall -Wpointer-arith -Wuninitialized -Wsign-compare -Wformat-security -fno-builtin-memset -std=gnu99 -I. -I. -I/usr/tgcware/include/openssl -I/usr/tgcware/include -DSSHDIR=\"/usr/tgcware/etc/ssh\" -D_PATH_SSH_PROGRAM=\"/usr/tgcware/bin/ssh\" -D_PATH_SSH_ASKPASS_DEFAULT=\"/usr/tgcware/libexec/ssh-askpass\" -D_PATH_SFTP_SERVER=\"/usr/tgcware/libexec/sftp-server\" -D_PATH_SSH_KEY_SIGN=\"/usr/tgcware/libexec/ssh-keysign\" -D_PATH_SSH_PKCS11_HELPER=\"/usr/tgcware/libexec/ssh-pkcs11-helper\" -D_PATH_SSH_PIDDIR=\"/var/run\" -D_PATH_PRIVSEP_CHROOT_DIR=\"/var/empty/sshd\" -DSSH_RAND_HELPER=\"/usr/tgcware/libexec/ssh-rand-helper\" -DHAVE_CONFIG_H -c ssh-keygen.c ssh-keygen.c: In function `parse_absolute_time': ssh-keygen.c:1507: warning: implicit declaration of function `strptime' ssh-keygen.c:1507: warning: comparison between pointer and integer gcc -o ssh-keygen ssh-keygen.o -L. -Lopenbsd-compat/ -Wl,-rpath,/usr/tgcware/lib -L/usr/tgcware/lib -Wl,-no_rqs -lssh -lopenbsd-compat -lcrypto -lz -lgen ld: WARNING 84: /usr/lib/libgen.so is not used for resolving any symbol. ld: ERROR 33: Unresolved text symbol "strptime" -- 1st referenced by ssh-keygen.o. ld: INFO 60: Output file removed because of error. collect2: ld returned 1 exit status make: *** [ssh-keygen] Error 1 This is a regression from 5.3p1 which built fine. Full buildlog + config.log available here: http://jupiterrise.com/tmp -tgc From djm at mindrot.org Sun Aug 15 06:55:18 2010 From: djm at mindrot.org (Damien Miller) Date: Sun, 15 Aug 2010 06:55:18 +1000 (EST) Subject: bind_address ignored? as in "ssh -R [bind_address]:12491:127.0.0.1:500" In-Reply-To: References: Message-ID: you want GatewayPorts=clientspecified on the server. On Sat, 14 Aug 2010, Jon wrote: > No answers on secureshell at securityfocus.com > > I must be doing something wrong or the server seems to ignore my bind request. > > Port forwarding is working it just bind to all ips and ignores my bind > request. I've also tried this with an rfc1918 address opposed to a > loopback and had the same results. > > Google and the archive haven't helped. > > Thanks in advance for your time and consideration. > > -server- > uname -a > Linux example.com 2.6.18-128.7.1.el5xen #1 SMP Mon Aug 24 10:08:55 EDT > 2009 i686 i686 i386 GNU/Linux > OpenSSH_4.3p2, OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 > > -sshd_config- > AllowTcpForwarding yes > GatewayPorts yes > > -from other system- > ssh -R 127.0.0.10:12491:127.0.0.1:5000 foo at example.com > > -messages- > Aug 12 16:22:45 xxx sshd[1440]: debug1: server_input_global_request: > tcpip-forward listen 127.0.0.10 port 12491 > Aug 12 16:22:45 xxx sshd[1440]: debug1: Local forwarding listening on > :: port 12491. > Aug 12 16:22:45 xxx sshd[1440]: debug1: channel 0: new [port listener] > Aug 12 16:22:45 xxx sshd[1440]: debug1: Local forwarding listening on > 0.0.0.0 port 12491. > Aug 12 16:22:45 xxx sshd[1440]: error: bind: Address already in use > > -check- > netstat -an | grep 12491 > tcp 0 0 :::12491 :::* > LISTEN > > okay that didn't work lets see if "GatewayPorts" is related > > -sshd_config- > AllowTcpForwarding yes > GatewayPorts no > > -from other system- > ssh -R 127.0.0.10:12491:127.0.0.1:5000 foo at example.com > > -messages- > Aug 12 16:25:26 xxx sshd[1578]: debug1: Local forwarding listening on > 127.0.0.1 port 12491. > Aug 12 16:25:26 xxx sshd[1578]: debug1: channel 0: new [port listener] > Aug 12 16:25:26 xxx sshd[1578]: debug1: Local forwarding listening on > ::1 port 12491. > > -check- > netstat -an | grep 12491 > tcp 0 0 127.0.0.1:12491 0.0.0.0:* > LISTEN > tcp 0 0 ::1:12491 :::* > LISTEN > > -networking- > eth0 Link encap:Ethernet HWaddr xx:xx:xx:xx:xx:xx > inet addr:xxx.xxx.xxx.xxx Bcast:xxx.xxx.xxx.xxx Mask:255.255.252.0 > inet6 addr: fe80::216:3eff:fe6b:1e1d/64 Scope:Link > UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 > RX packets:33160 errors:0 dropped:0 overruns:0 frame:0 > TX packets:1240 errors:0 dropped:0 overruns:0 carrier:0 > collisions:0 txqueuelen:1000 > RX bytes:2158440 (2.0 MiB) TX bytes:228786 (223.4 KiB) > > lo Link encap:Local Loopback > inet addr:127.0.0.1 Mask:255.0.0.0 > inet6 addr: ::1/128 Scope:Host > UP LOOPBACK RUNNING MTU:16436 Metric:1 > RX packets:124 errors:0 dropped:0 overruns:0 frame:0 > TX packets:124 errors:0 dropped:0 overruns:0 carrier:0 > collisions:0 txqueuelen:0 > RX bytes:11631 (11.3 KiB) TX bytes:11631 (11.3 KiB) > > lo:1 Link encap:Local Loopback > inet addr:127.0.0.10 Mask:255.0.0.0 > UP LOOPBACK RUNNING MTU:16436 Metric:1 > > -check- > ping 127.0.0.10 > PING 127.0.0.10 (127.0.0.10) 56(84) bytes of data. > 64 bytes from 127.0.0.10: icmp_seq=1 ttl=64 time=0.025 ms > > -check- > ping 127.0.0.1 > PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data. > 64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.024 ms > > -from man- > GatewayPorts > Specifies whether remote hosts are allowed to connect to > ports forwarded for the client. By default, sshd binds remote port > for- > wardings to the loopback address. This prevents other > remote hosts from connecting to forwarded ports. GatewayPorts can be > used > to specify that sshd should allow remote port forwardings > to bind to non-loopback addresses, thus allowing other hosts to con- > nect. The argument may be "no" to force remote port > forwardings to be available to the local host only, "yes" to force > remote > port forwardings to bind to the wildcard address, or > "clientspecified" to allow the client to select the address to which > the > forwarding is bound. The default is "no". > _______________________________________________ > openssh-unix-dev mailing list > openssh-unix-dev at mindrot.org > https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev > From dtucker at zip.com.au Sun Aug 15 11:51:40 2010 From: dtucker at zip.com.au (Darren Tucker) Date: Sun, 15 Aug 2010 11:51:40 +1000 Subject: Call for testing: OpenSSH-5.6 In-Reply-To: <4C66EA62.2050503@jupiterrise.com> References: <4C66EA62.2050503@jupiterrise.com> Message-ID: <20100815015140.GA13340@gate.dtucker.net> On Sat, Aug 14, 2010 at 09:11:30PM +0200, Tom Christensen wrote: > Damien Miller wrote: > >Hi, > > > >OpenSSH 5.6 is almost ready for release, so we would appreciate testing > >on as many platforms and systems as possible. This is a moderately large > >release, with a number of new features and bug fixes. > > > >Snapshot releases for portable OpenSSH are available from > >http://www.mindrot.org/openssh_snap/ > > > >Running the regression tests supplied with Portable OpenSSH does not > >require installation and is a simply: > > > >$ ./configure && make tests > > > I tried building openssh-SNAP-20100815 on IRIX 5.3 but it fails > because this platform lacks strptime: It's only used when generating time-based certificates, so the quick and dirty hack is to just disable that on platforms that don't have strptime. (I looked at pulling in support from openbsd but it's a tangled web of locale stuff). Please try this patch (you will need to run "autoreconf" to rebuild configure). Index: configure.ac =================================================================== RCS file: /usr/local/src/security/openssh/cvs/openssh/configure.ac,v retrieving revision 1.450 diff -u -p -r1.450 configure.ac --- configure.ac 23 Apr 2010 01:12:06 -0000 1.450 +++ configure.ac 15 Aug 2010 01:45:50 -0000 @@ -1427,6 +1427,7 @@ AC_CHECK_FUNCS( \ strlcpy \ strmode \ strnvis \ + strptime \ strtonum \ strtoll \ strtoul \ Index: ssh-keygen.c =================================================================== RCS file: /usr/local/src/security/openssh/cvs/openssh/ssh-keygen.c,v retrieving revision 1.211 diff -u -p -r1.211 ssh-keygen.c --- ssh-keygen.c 5 Aug 2010 03:05:32 -0000 1.211 +++ ssh-keygen.c 15 Aug 2010 01:47:08 -0000 @@ -1480,6 +1480,7 @@ parse_relative_time(const char *s, time_ static u_int64_t parse_absolute_time(const char *s) { +#ifdef HAVE_STRPTIME struct tm tm; time_t tt; char buf[32], *fmt; @@ -1509,6 +1510,9 @@ parse_absolute_time(const char *s) if ((tt = mktime(&tm)) < 0) fatal("Certificate time %s cannot be represented", s); return (u_int64_t)tt; +#else + fatal("Time-based certificates not supported on this platform"); +#endif } static void -- Darren Tucker (dtucker at zip.com.au) GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4 37C9 C982 80C7 8FF4 FA69 Good judgement comes with experience. Unfortunately, the experience usually comes from bad judgement. From djm at mindrot.org Sun Aug 15 12:14:28 2010 From: djm at mindrot.org (Damien Miller) Date: Sun, 15 Aug 2010 12:14:28 +1000 (EST) Subject: Call for testing: OpenSSH-5.6 In-Reply-To: <20100815015140.GA13340@gate.dtucker.net> References: <4C66EA62.2050503@jupiterrise.com> <20100815015140.GA13340@gate.dtucker.net> Message-ID: On Sun, 15 Aug 2010, Darren Tucker wrote: > On Sat, Aug 14, 2010 at 09:11:30PM +0200, Tom Christensen wrote: > > Damien Miller wrote: > > >Hi, > > > > > >OpenSSH 5.6 is almost ready for release, so we would appreciate testing > > >on as many platforms and systems as possible. This is a moderately large > > >release, with a number of new features and bug fixes. > > > > > >Snapshot releases for portable OpenSSH are available from > > >http://www.mindrot.org/openssh_snap/ > > > > > >Running the regression tests supplied with Portable OpenSSH does not > > >require installation and is a simply: > > > > > >$ ./configure && make tests > > > > > I tried building openssh-SNAP-20100815 on IRIX 5.3 but it fails > > because this platform lacks strptime: > > It's only used when generating time-based certificates, so the quick and > dirty hack is to just disable that on platforms that don't have > strptime. (I looked at pulling in support from openbsd but it's a > tangled web of locale stuff). > > Please try this patch (you will need to run "autoreconf" to rebuild > configure). I think this is a reasonable thingto do for release. Note that you will still be able to use time-based certificates if you want to use them, but you will need to specify the start and end times using the relative time format. -d From dtucker at zip.com.au Sun Aug 15 13:21:21 2010 From: dtucker at zip.com.au (Darren Tucker) Date: Sun, 15 Aug 2010 13:21:21 +1000 Subject: Call for testing: OpenSSH-5.6 In-Reply-To: References: <4C66EA62.2050503@jupiterrise.com> <20100815015140.GA13340@gate.dtucker.net> Message-ID: <20100815032120.GA14663@gate.dtucker.net> On Sun, Aug 15, 2010 at 12:14:28PM +1000, Damien Miller wrote: > On Sun, 15 Aug 2010, Darren Tucker wrote: [...] > > It's only used when generating time-based certificates, so the quick and > > dirty hack is to just disable that on platforms that don't have > > strptime. (I looked at pulling in support from openbsd but it's a > > tangled web of locale stuff). > > > > Please try this patch (you will need to run "autoreconf" to rebuild > > configure). > > I think this is a reasonable thingto do for release. Note that you > will still be able to use time-based certificates if you want to use > them, but you will need to specify the start and end times using the > relative time format. I think a better way of doing this longer term is to have a dummy strptime implementation in the compat library, but that can wait until after the release since it risks linking problems elsewhere. Also we need to skip the relevant tests on platforms without strptime. Index: regress/cert-userkey.sh =================================================================== RCS file: /usr/local/src/security/openssh/cvs/openssh/regress/cert-userkey.sh,v retrieving revision 1.7 diff -u -p -r1.7 cert-userkey.sh --- regress/cert-userkey.sh 2 Jul 2010 03:42:20 -0000 1.7 +++ regress/cert-userkey.sh 15 Aug 2010 03:05:12 -0000 @@ -272,8 +272,11 @@ test_one() { test_one "correct principal" success "-n ${USER}" test_one "host-certificate" failure "-n ${USER} -h" test_one "wrong principals" failure "-n foo" +if grep "#define.*HAVE_STRPTIME" ${BUILDDIR}/config.h >/dev/null 2>&1 +then test_one "cert not yet valid" failure "-n ${USER} -V20200101:20300101" test_one "cert expired" failure "-n ${USER} -V19800101:19900101" +fi test_one "cert valid interval" success "-n ${USER} -V-1w:+2w" test_one "wrong source-address" failure "-n ${USER} -Osource-address=10.0.0.0/8" test_one "force-command" failure "-n ${USER} -Oforce-command=false" -- Darren Tucker (dtucker at zip.com.au) GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4 37C9 C982 80C7 8FF4 FA69 Good judgement comes with experience. Unfortunately, the experience usually comes from bad judgement. From djm at mindrot.org Sun Aug 15 14:11:01 2010 From: djm at mindrot.org (Damien Miller) Date: Sun, 15 Aug 2010 14:11:01 +1000 (EST) Subject: Call for testing: OpenSSH-5.6 In-Reply-To: <20100815032120.GA14663@gate.dtucker.net> References: <4C66EA62.2050503@jupiterrise.com> <20100815015140.GA13340@gate.dtucker.net> <20100815032120.GA14663@gate.dtucker.net> Message-ID: On Sun, 15 Aug 2010, Darren Tucker wrote: > On Sun, Aug 15, 2010 at 12:14:28PM +1000, Damien Miller wrote: > > On Sun, 15 Aug 2010, Darren Tucker wrote: > [...] > > > It's only used when generating time-based certificates, so the quick and > > > dirty hack is to just disable that on platforms that don't have > > > strptime. (I looked at pulling in support from openbsd but it's a > > > tangled web of locale stuff). > > > > > > Please try this patch (you will need to run "autoreconf" to rebuild > > > configure). > > > > I think this is a reasonable thingto do for release. Note that you > > will still be able to use time-based certificates if you want to use > > them, but you will need to specify the start and end times using the > > relative time format. > > I think a better way of doing this longer term is to have a dummy > strptime implementation in the compat library, but that can wait until > after the release since it risks linking problems elsewhere. Actually, OpenBSD's strptime isn't too tangled if you chop out the locale stuff. We don't actually use any of that anyway, just the numeric converters. Here is a stab at a port, but it is late here and I'm too tired to test it (it assumes you have the configure bits done already). diff -u -r1.44 Makefile.in --- openbsd-compat/Makefile.in 15 Jan 2010 01:38:30 -0000 1.44 +++ openbsd-compat/Makefile.in 15 Aug 2010 04:09:37 -0000 @@ -16,7 +16,7 @@ INSTALL=@INSTALL@ LDFLAGS=-L. @LDFLAGS@ -OPENBSD=base64.o basename.o bindresvport.o daemon.o dirname.o fmt_scaled.o getcwd.o getgrouplist.o getopt.o getrrsetbyname.o glob.o inet_aton.o inet_ntoa.o inet_ntop.o mktemp.o pwcache.o readpassphrase.o realpath.o rresvport.o setenv.o setproctitle.o sha2.o sigact.o strlcat.o strlcpy.o strmode.o strsep.o strtonum.o strtoll.o strtoul.o vis.o +OPENBSD=base64.o basename.o bindresvport.o daemon.o dirname.o fmt_scaled.o getcwd.o getgrouplist.o getopt.o getrrsetbyname.o glob.o inet_aton.o inet_ntoa.o inet_ntop.o mktemp.o pwcache.o readpassphrase.o realpath.o rresvport.o setenv.o setproctitle.o sha2.o sigact.o strlcat.o strlcpy.o strmode.o strptime.o strsep.o strtonum.o strtoll.o strtoul.o vis.o COMPAT=bsd-arc4random.o bsd-asprintf.o bsd-closefrom.o bsd-cray.o bsd-cygwin_util.o bsd-getpeereid.o bsd-misc.o bsd-nextstep.o bsd-openpty.o bsd-poll.o bsd-snprintf.o bsd-statvfs.o bsd-waitpid.o fake-rfc2553.o openssl-compat.o xmmap.o xcrypt.o Index: openbsd-compat/openbsd-compat.h =================================================================== RCS file: /var/cvs/openssh/openbsd-compat/openbsd-compat.h,v retrieving revision 1.49 diff -u -r1.49 openbsd-compat.h --- openbsd-compat/openbsd-compat.h 16 Jan 2010 12:58:37 -0000 1.49 +++ openbsd-compat/openbsd-compat.h 15 Aug 2010 04:09:37 -0000 @@ -87,6 +87,10 @@ void strmode(int mode, char *p); #endif +#ifndef HAVE_STRPTIME +char *strptime(const char *buf, const char *fmt, struct tm *tm); +#endif + #if !defined(HAVE_MKDTEMP) || defined(HAVE_STRICT_MKSTEMP) int mkstemps(char *path, int slen); int mkstemp(char *path); Index: openbsd-compat/strptime.c =================================================================== RCS file: openbsd-compat/strptime.c diff -N openbsd-compat/strptime.c --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ openbsd-compat/strptime.c 15 Aug 2010 04:09:38 -0000 @@ -0,0 +1,400 @@ +/* $OpenBSD: strptime.c,v 1.12 2008/06/26 05:42:05 ray Exp $ */ +/* $NetBSD: strptime.c,v 1.12 1998/01/20 21:39:40 mycroft Exp $ */ + +/*- + * Copyright (c) 1997, 1998 The NetBSD Foundation, Inc. + * All rights reserved. + * + * This code was contributed to The NetBSD Foundation by Klaus Klein. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS + * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED + * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS + * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +/* OPENBSD ORIGINAL: lib/libc/time/strptime.c */ + +#include "includes.h" + +#ifndef HAVE_STRPTIME + +#include +#include +#include +#include +#include + +/* #define _ctloc(x) (_CurrentTimeLocale->x) */ + +/* + * We do not implement alternate representations. However, we always + * check whether a given modifier is allowed for a certain conversion. + */ +#define _ALT_E 0x01 +#define _ALT_O 0x02 +#define _LEGAL_ALT(x) { if (alt_format & ~(x)) return (0); } + + +static int _conv_num(const unsigned char **, int *, int, int); +static char *_strptime(const char *, const char *, struct tm *, int); + + +char * +strptime(const char *buf, const char *fmt, struct tm *tm) +{ + return(_strptime(buf, fmt, tm, 1)); +} + +static char * +_strptime(const char *buf, const char *fmt, struct tm *tm, int initialize) +{ + unsigned char c; + const unsigned char *bp; + size_t len; + int alt_format, i; + static int century, relyear; + + if (initialize) { + century = TM_YEAR_BASE; + relyear = -1; + } + + bp = (unsigned char *)buf; + while ((c = *fmt) != '\0') { + /* Clear `alternate' modifier prior to new conversion. */ + alt_format = 0; + + /* Eat up white-space. */ + if (isspace(c)) { + while (isspace(*bp)) + bp++; + + fmt++; + continue; + } + + if ((c = *fmt++) != '%') + goto literal; + + +again: switch (c = *fmt++) { + case '%': /* "%%" is converted to "%". */ +literal: + if (c != *bp++) + return (NULL); + + break; + + /* + * "Alternative" modifiers. Just set the appropriate flag + * and start over again. + */ + case 'E': /* "%E?" alternative conversion modifier. */ + _LEGAL_ALT(0); + alt_format |= _ALT_E; + goto again; + + case 'O': /* "%O?" alternative conversion modifier. */ + _LEGAL_ALT(0); + alt_format |= _ALT_O; + goto again; + + /* + * "Complex" conversion rules, implemented through recursion. + */ +#if 0 + case 'c': /* Date and time, using the locale's format. */ + _LEGAL_ALT(_ALT_E); + if (!(bp = _strptime(bp, _ctloc(d_t_fmt), tm, 0))) + return (NULL); + break; +#endif + case 'D': /* The date as "%m/%d/%y". */ + _LEGAL_ALT(0); + if (!(bp = _strptime(bp, "%m/%d/%y", tm, 0))) + return (NULL); + break; + + case 'R': /* The time as "%H:%M". */ + _LEGAL_ALT(0); + if (!(bp = _strptime(bp, "%H:%M", tm, 0))) + return (NULL); + break; + + case 'r': /* The time as "%I:%M:%S %p". */ + _LEGAL_ALT(0); + if (!(bp = _strptime(bp, "%I:%M:%S %p", tm, 0))) + return (NULL); + break; + + case 'T': /* The time as "%H:%M:%S". */ + _LEGAL_ALT(0); + if (!(bp = _strptime(bp, "%H:%M:%S", tm, 0))) + return (NULL); + break; +#if 0 + case 'X': /* The time, using the locale's format. */ + _LEGAL_ALT(_ALT_E); + if (!(bp = _strptime(bp, _ctloc(t_fmt), tm, 0))) + return (NULL); + break; + + case 'x': /* The date, using the locale's format. */ + _LEGAL_ALT(_ALT_E); + if (!(bp = _strptime(bp, _ctloc(d_fmt), tm, 0))) + return (NULL); + break; +#endif + /* + * "Elementary" conversion rules. + */ +#if 0 + case 'A': /* The day of week, using the locale's form. */ + case 'a': + _LEGAL_ALT(0); + for (i = 0; i < 7; i++) { + /* Full name. */ + len = strlen(_ctloc(day[i])); + if (strncasecmp(_ctloc(day[i]), bp, len) == 0) + break; + + /* Abbreviated name. */ + len = strlen(_ctloc(abday[i])); + if (strncasecmp(_ctloc(abday[i]), bp, len) == 0) + break; + } + + /* Nothing matched. */ + if (i == 7) + return (NULL); + + tm->tm_wday = i; + bp += len; + break; + + case 'B': /* The month, using the locale's form. */ + case 'b': + case 'h': + _LEGAL_ALT(0); + for (i = 0; i < 12; i++) { + /* Full name. */ + len = strlen(_ctloc(mon[i])); + if (strncasecmp(_ctloc(mon[i]), bp, len) == 0) + break; + + /* Abbreviated name. */ + len = strlen(_ctloc(abmon[i])); + if (strncasecmp(_ctloc(abmon[i]), bp, len) == 0) + break; + } + + /* Nothing matched. */ + if (i == 12) + return (NULL); + + tm->tm_mon = i; + bp += len; + break; +#endif + + case 'C': /* The century number. */ + _LEGAL_ALT(_ALT_E); + if (!(_conv_num(&bp, &i, 0, 99))) + return (NULL); + + century = i * 100; + break; + + case 'd': /* The day of month. */ + case 'e': + _LEGAL_ALT(_ALT_O); + if (!(_conv_num(&bp, &tm->tm_mday, 1, 31))) + return (NULL); + break; + + case 'k': /* The hour (24-hour clock representation). */ + _LEGAL_ALT(0); + /* FALLTHROUGH */ + case 'H': + _LEGAL_ALT(_ALT_O); + if (!(_conv_num(&bp, &tm->tm_hour, 0, 23))) + return (NULL); + break; + + case 'l': /* The hour (12-hour clock representation). */ + _LEGAL_ALT(0); + /* FALLTHROUGH */ + case 'I': + _LEGAL_ALT(_ALT_O); + if (!(_conv_num(&bp, &tm->tm_hour, 1, 12))) + return (NULL); + break; + + case 'j': /* The day of year. */ + _LEGAL_ALT(0); + if (!(_conv_num(&bp, &tm->tm_yday, 1, 366))) + return (NULL); + tm->tm_yday--; + break; + + case 'M': /* The minute. */ + _LEGAL_ALT(_ALT_O); + if (!(_conv_num(&bp, &tm->tm_min, 0, 59))) + return (NULL); + break; + + case 'm': /* The month. */ + _LEGAL_ALT(_ALT_O); + if (!(_conv_num(&bp, &tm->tm_mon, 1, 12))) + return (NULL); + tm->tm_mon--; + break; + +#if 0 + case 'p': /* The locale's equivalent of AM/PM. */ + _LEGAL_ALT(0); + /* AM? */ + len = strlen(_ctloc(am_pm[0])); + if (strncasecmp(_ctloc(am_pm[0]), bp, len) == 0) { + if (tm->tm_hour > 12) /* i.e., 13:00 AM ?! */ + return (NULL); + else if (tm->tm_hour == 12) + tm->tm_hour = 0; + + bp += len; + break; + } + /* PM? */ + len = strlen(_ctloc(am_pm[1])); + if (strncasecmp(_ctloc(am_pm[1]), bp, len) == 0) { + if (tm->tm_hour > 12) /* i.e., 13:00 PM ?! */ + return (NULL); + else if (tm->tm_hour < 12) + tm->tm_hour += 12; + + bp += len; + break; + } + + /* Nothing matched. */ + return (NULL); +#endif + case 'S': /* The seconds. */ + _LEGAL_ALT(_ALT_O); + if (!(_conv_num(&bp, &tm->tm_sec, 0, 61))) + return (NULL); + break; + + case 'U': /* The week of year, beginning on sunday. */ + case 'W': /* The week of year, beginning on monday. */ + _LEGAL_ALT(_ALT_O); + /* + * XXX This is bogus, as we can not assume any valid + * information present in the tm structure at this + * point to calculate a real value, so just check the + * range for now. + */ + if (!(_conv_num(&bp, &i, 0, 53))) + return (NULL); + break; + + case 'w': /* The day of week, beginning on sunday. */ + _LEGAL_ALT(_ALT_O); + if (!(_conv_num(&bp, &tm->tm_wday, 0, 6))) + return (NULL); + break; + + case 'Y': /* The year. */ + _LEGAL_ALT(_ALT_E); + if (!(_conv_num(&bp, &i, 0, 9999))) + return (NULL); + + relyear = -1; + tm->tm_year = i - TM_YEAR_BASE; + break; + + case 'y': /* The year within the century (2 digits). */ + _LEGAL_ALT(_ALT_E | _ALT_O); + if (!(_conv_num(&bp, &relyear, 0, 99))) + return (NULL); + break; + + /* + * Miscellaneous conversions. + */ + case 'n': /* Any kind of white-space. */ + case 't': + _LEGAL_ALT(0); + while (isspace(*bp)) + bp++; + break; + + + default: /* Unknown/unsupported conversion. */ + return (NULL); + } + + + } + + /* + * We need to evaluate the two digit year spec (%y) + * last as we can get a century spec (%C) at any time. + */ + if (relyear != -1) { + if (century == TM_YEAR_BASE) { + if (relyear <= 68) + tm->tm_year = relyear + 2000 - TM_YEAR_BASE; + else + tm->tm_year = relyear + 1900 - TM_YEAR_BASE; + } else { + tm->tm_year = relyear + century - TM_YEAR_BASE; + } + } + + return ((char *)bp); +} + + +static int +_conv_num(const unsigned char **buf, int *dest, int llim, int ulim) +{ + int result = 0; + int rulim = ulim; + + if (**buf < '0' || **buf > '9') + return (0); + + /* we use rulim to break out of the loop when we run out of digits */ + do { + result *= 10; + result += *(*buf)++ - '0'; + rulim /= 10; + } while ((result * 10 <= ulim) && rulim && **buf >= '0' && **buf <= '9'); + + if (result < llim || result > ulim) + return (0); + + *dest = result; + return (1); +} + +#endif /* HAVE_STRPTIME */ + From dtucker at zip.com.au Sun Aug 15 15:32:19 2010 From: dtucker at zip.com.au (Darren Tucker) Date: Sun, 15 Aug 2010 15:32:19 +1000 Subject: Call for testing: OpenSSH-5.6 In-Reply-To: References: <4C66EA62.2050503@jupiterrise.com> <20100815015140.GA13340@gate.dtucker.net> <20100815032120.GA14663@gate.dtucker.net> Message-ID: <20100815053218.GA1329@gate.dtucker.net> On Sun, Aug 15, 2010 at 02:11:01PM +1000, Damien Miller wrote: > On Sun, 15 Aug 2010, Darren Tucker wrote: [...] > > I think a better way of doing this longer term is to have a dummy > > strptime implementation in the compat library, but that can wait until > > after the release since it risks linking problems elsewhere. > > Actually, OpenBSD's strptime isn't too tangled if you chop out the > locale stuff. We don't actually use any of that anyway, just the numeric > converters. Here is a stab at a port, but it is late here and I'm > too tired to test it (it assumes you have the configure bits done already). Here's an update with the configure bits done, and some compile errors fixed. I also put up a complete tarball at http://www.zipworld.com.au/~dtucker/tmp/openssh-strptime.tar.gz Index: configure.ac =================================================================== RCS file: /usr/local/src/security/openssh/cvs/openssh/configure.ac,v retrieving revision 1.450 diff -u -p -r1.450 configure.ac --- configure.ac 23 Apr 2010 01:12:06 -0000 1.450 +++ configure.ac 15 Aug 2010 01:45:50 -0000 @@ -1427,6 +1427,7 @@ AC_CHECK_FUNCS( \ strlcpy \ strmode \ strnvis \ + strptime \ strtonum \ strtoll \ strtoul \ Index: openbsd-compat/Makefile.in =================================================================== RCS file: /usr/local/src/security/openssh/cvs/openssh/openbsd-compat/Makefile.in,v retrieving revision 1.44 diff -u -p -r1.44 Makefile.in --- openbsd-compat/Makefile.in 15 Jan 2010 01:38:30 -0000 1.44 +++ openbsd-compat/Makefile.in 15 Aug 2010 05:04:54 -0000 @@ -16,7 +16,7 @@ RANLIB=@RANLIB@ INSTALL=@INSTALL@ LDFLAGS=-L. @LDFLAGS@ -OPENBSD=base64.o basename.o bindresvport.o daemon.o dirname.o fmt_scaled.o getcwd.o getgrouplist.o getopt.o getrrsetbyname.o glob.o inet_aton.o inet_ntoa.o inet_ntop.o mktemp.o pwcache.o readpassphrase.o realpath.o rresvport.o setenv.o setproctitle.o sha2.o sigact.o strlcat.o strlcpy.o strmode.o strsep.o strtonum.o strtoll.o strtoul.o vis.o +OPENBSD=base64.o basename.o bindresvport.o daemon.o dirname.o fmt_scaled.o getcwd.o getgrouplist.o getopt.o getrrsetbyname.o glob.o inet_aton.o inet_ntoa.o inet_ntop.o mktemp.o pwcache.o readpassphrase.o realpath.o rresvport.o setenv.o setproctitle.o sha2.o sigact.o strlcat.o strlcpy.o strmode.o strptime.o strsep.o strtonum.o strtoll.o strtoul.o vis.o COMPAT=bsd-arc4random.o bsd-asprintf.o bsd-closefrom.o bsd-cray.o bsd-cygwin_util.o bsd-getpeereid.o bsd-misc.o bsd-nextstep.o bsd-openpty.o bsd-poll.o bsd-snprintf.o bsd-statvfs.o bsd-waitpid.o fake-rfc2553.o openssl-compat.o xmmap.o xcrypt.o Index: openbsd-compat/openbsd-compat.h =================================================================== RCS file: /usr/local/src/security/openssh/cvs/openssh/openbsd-compat/openbsd-compat.h,v retrieving revision 1.49 diff -u -p -r1.49 openbsd-compat.h --- openbsd-compat/openbsd-compat.h 16 Jan 2010 12:58:37 -0000 1.49 +++ openbsd-compat/openbsd-compat.h 15 Aug 2010 05:11:33 -0000 @@ -87,6 +87,11 @@ int setenv(register const char *name, re void strmode(int mode, char *p); #endif +#ifndef HAVE_STRPTIME +#include +char *strptime(const char *buf, const char *fmt, struct tm *tm); +#endif + #if !defined(HAVE_MKDTEMP) || defined(HAVE_STRICT_MKSTEMP) int mkstemps(char *path, int slen); int mkstemp(char *path); Index: openbsd-compat/strptime.c =================================================================== RCS file: openbsd-compat/strptime.c diff -N openbsd-compat/strptime.c --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ openbsd-compat/strptime.c 15 Aug 2010 05:14:26 -0000 @@ -0,0 +1,401 @@ +/* $OpenBSD: strptime.c,v 1.12 2008/06/26 05:42:05 ray Exp $ */ +/* $NetBSD: strptime.c,v 1.12 1998/01/20 21:39:40 mycroft Exp $ */ + +/*- + * Copyright (c) 1997, 1998 The NetBSD Foundation, Inc. + * All rights reserved. + * + * This code was contributed to The NetBSD Foundation by Klaus Klein. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS + * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED + * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS + * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +/* OPENBSD ORIGINAL: lib/libc/time/strptime.c */ + +#include "includes.h" + +#ifndef HAVE_STRPTIME + +#define TM_YEAR_BASE 1900 /* from tzfile.h */ + +#include +#include +#include +#include + +/* #define _ctloc(x) (_CurrentTimeLocale->x) */ + +/* + * We do not implement alternate representations. However, we always + * check whether a given modifier is allowed for a certain conversion. + */ +#define _ALT_E 0x01 +#define _ALT_O 0x02 +#define _LEGAL_ALT(x) { if (alt_format & ~(x)) return (0); } + + +static int _conv_num(const unsigned char **, int *, int, int); +static char *_strptime(const char *, const char *, struct tm *, int); + + +char * +strptime(const char *buf, const char *fmt, struct tm *tm) +{ + return(_strptime(buf, fmt, tm, 1)); +} + +static char * +_strptime(const char *buf, const char *fmt, struct tm *tm, int initialize) +{ + unsigned char c; + const unsigned char *bp; + size_t len; + int alt_format, i; + static int century, relyear; + + if (initialize) { + century = TM_YEAR_BASE; + relyear = -1; + } + + bp = (unsigned char *)buf; + while ((c = *fmt) != '\0') { + /* Clear `alternate' modifier prior to new conversion. */ + alt_format = 0; + + /* Eat up white-space. */ + if (isspace(c)) { + while (isspace(*bp)) + bp++; + + fmt++; + continue; + } + + if ((c = *fmt++) != '%') + goto literal; + + +again: switch (c = *fmt++) { + case '%': /* "%%" is converted to "%". */ +literal: + if (c != *bp++) + return (NULL); + + break; + + /* + * "Alternative" modifiers. Just set the appropriate flag + * and start over again. + */ + case 'E': /* "%E?" alternative conversion modifier. */ + _LEGAL_ALT(0); + alt_format |= _ALT_E; + goto again; + + case 'O': /* "%O?" alternative conversion modifier. */ + _LEGAL_ALT(0); + alt_format |= _ALT_O; + goto again; + + /* + * "Complex" conversion rules, implemented through recursion. + */ +#if 0 + case 'c': /* Date and time, using the locale's format. */ + _LEGAL_ALT(_ALT_E); + if (!(bp = _strptime(bp, _ctloc(d_t_fmt), tm, 0))) + return (NULL); + break; +#endif + case 'D': /* The date as "%m/%d/%y". */ + _LEGAL_ALT(0); + if (!(bp = _strptime(bp, "%m/%d/%y", tm, 0))) + return (NULL); + break; + + case 'R': /* The time as "%H:%M". */ + _LEGAL_ALT(0); + if (!(bp = _strptime(bp, "%H:%M", tm, 0))) + return (NULL); + break; + + case 'r': /* The time as "%I:%M:%S %p". */ + _LEGAL_ALT(0); + if (!(bp = _strptime(bp, "%I:%M:%S %p", tm, 0))) + return (NULL); + break; + + case 'T': /* The time as "%H:%M:%S". */ + _LEGAL_ALT(0); + if (!(bp = _strptime(bp, "%H:%M:%S", tm, 0))) + return (NULL); + break; +#if 0 + case 'X': /* The time, using the locale's format. */ + _LEGAL_ALT(_ALT_E); + if (!(bp = _strptime(bp, _ctloc(t_fmt), tm, 0))) + return (NULL); + break; + + case 'x': /* The date, using the locale's format. */ + _LEGAL_ALT(_ALT_E); + if (!(bp = _strptime(bp, _ctloc(d_fmt), tm, 0))) + return (NULL); + break; +#endif + /* + * "Elementary" conversion rules. + */ +#if 0 + case 'A': /* The day of week, using the locale's form. */ + case 'a': + _LEGAL_ALT(0); + for (i = 0; i < 7; i++) { + /* Full name. */ + len = strlen(_ctloc(day[i])); + if (strncasecmp(_ctloc(day[i]), bp, len) == 0) + break; + + /* Abbreviated name. */ + len = strlen(_ctloc(abday[i])); + if (strncasecmp(_ctloc(abday[i]), bp, len) == 0) + break; + } + + /* Nothing matched. */ + if (i == 7) + return (NULL); + + tm->tm_wday = i; + bp += len; + break; + + case 'B': /* The month, using the locale's form. */ + case 'b': + case 'h': + _LEGAL_ALT(0); + for (i = 0; i < 12; i++) { + /* Full name. */ + len = strlen(_ctloc(mon[i])); + if (strncasecmp(_ctloc(mon[i]), bp, len) == 0) + break; + + /* Abbreviated name. */ + len = strlen(_ctloc(abmon[i])); + if (strncasecmp(_ctloc(abmon[i]), bp, len) == 0) + break; + } + + /* Nothing matched. */ + if (i == 12) + return (NULL); + + tm->tm_mon = i; + bp += len; + break; +#endif + + case 'C': /* The century number. */ + _LEGAL_ALT(_ALT_E); + if (!(_conv_num(&bp, &i, 0, 99))) + return (NULL); + + century = i * 100; + break; + + case 'd': /* The day of month. */ + case 'e': + _LEGAL_ALT(_ALT_O); + if (!(_conv_num(&bp, &tm->tm_mday, 1, 31))) + return (NULL); + break; + + case 'k': /* The hour (24-hour clock representation). */ + _LEGAL_ALT(0); + /* FALLTHROUGH */ + case 'H': + _LEGAL_ALT(_ALT_O); + if (!(_conv_num(&bp, &tm->tm_hour, 0, 23))) + return (NULL); + break; + + case 'l': /* The hour (12-hour clock representation). */ + _LEGAL_ALT(0); + /* FALLTHROUGH */ + case 'I': + _LEGAL_ALT(_ALT_O); + if (!(_conv_num(&bp, &tm->tm_hour, 1, 12))) + return (NULL); + break; + + case 'j': /* The day of year. */ + _LEGAL_ALT(0); + if (!(_conv_num(&bp, &tm->tm_yday, 1, 366))) + return (NULL); + tm->tm_yday--; + break; + + case 'M': /* The minute. */ + _LEGAL_ALT(_ALT_O); + if (!(_conv_num(&bp, &tm->tm_min, 0, 59))) + return (NULL); + break; + + case 'm': /* The month. */ + _LEGAL_ALT(_ALT_O); + if (!(_conv_num(&bp, &tm->tm_mon, 1, 12))) + return (NULL); + tm->tm_mon--; + break; + +#if 0 + case 'p': /* The locale's equivalent of AM/PM. */ + _LEGAL_ALT(0); + /* AM? */ + len = strlen(_ctloc(am_pm[0])); + if (strncasecmp(_ctloc(am_pm[0]), bp, len) == 0) { + if (tm->tm_hour > 12) /* i.e., 13:00 AM ?! */ + return (NULL); + else if (tm->tm_hour == 12) + tm->tm_hour = 0; + + bp += len; + break; + } + /* PM? */ + len = strlen(_ctloc(am_pm[1])); + if (strncasecmp(_ctloc(am_pm[1]), bp, len) == 0) { + if (tm->tm_hour > 12) /* i.e., 13:00 PM ?! */ + return (NULL); + else if (tm->tm_hour < 12) + tm->tm_hour += 12; + + bp += len; + break; + } + + /* Nothing matched. */ + return (NULL); +#endif + case 'S': /* The seconds. */ + _LEGAL_ALT(_ALT_O); + if (!(_conv_num(&bp, &tm->tm_sec, 0, 61))) + return (NULL); + break; + + case 'U': /* The week of year, beginning on sunday. */ + case 'W': /* The week of year, beginning on monday. */ + _LEGAL_ALT(_ALT_O); + /* + * XXX This is bogus, as we can not assume any valid + * information present in the tm structure at this + * point to calculate a real value, so just check the + * range for now. + */ + if (!(_conv_num(&bp, &i, 0, 53))) + return (NULL); + break; + + case 'w': /* The day of week, beginning on sunday. */ + _LEGAL_ALT(_ALT_O); + if (!(_conv_num(&bp, &tm->tm_wday, 0, 6))) + return (NULL); + break; + + case 'Y': /* The year. */ + _LEGAL_ALT(_ALT_E); + if (!(_conv_num(&bp, &i, 0, 9999))) + return (NULL); + + relyear = -1; + tm->tm_year = i - TM_YEAR_BASE; + break; + + case 'y': /* The year within the century (2 digits). */ + _LEGAL_ALT(_ALT_E | _ALT_O); + if (!(_conv_num(&bp, &relyear, 0, 99))) + return (NULL); + break; + + /* + * Miscellaneous conversions. + */ + case 'n': /* Any kind of white-space. */ + case 't': + _LEGAL_ALT(0); + while (isspace(*bp)) + bp++; + break; + + + default: /* Unknown/unsupported conversion. */ + return (NULL); + } + + + } + + /* + * We need to evaluate the two digit year spec (%y) + * last as we can get a century spec (%C) at any time. + */ + if (relyear != -1) { + if (century == TM_YEAR_BASE) { + if (relyear <= 68) + tm->tm_year = relyear + 2000 - TM_YEAR_BASE; + else + tm->tm_year = relyear + 1900 - TM_YEAR_BASE; + } else { + tm->tm_year = relyear + century - TM_YEAR_BASE; + } + } + + return ((char *)bp); +} + + +static int +_conv_num(const unsigned char **buf, int *dest, int llim, int ulim) +{ + int result = 0; + int rulim = ulim; + + if (**buf < '0' || **buf > '9') + return (0); + + /* we use rulim to break out of the loop when we run out of digits */ + do { + result *= 10; + result += *(*buf)++ - '0'; + rulim /= 10; + } while ((result * 10 <= ulim) && rulim && **buf >= '0' && **buf <= '9'); + + if (result < llim || result > ulim) + return (0); + + *dest = result; + return (1); +} + +#endif /* HAVE_STRPTIME */ + -- Darren Tucker (dtucker at zip.com.au) GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4 37C9 C982 80C7 8FF4 FA69 Good judgement comes with experience. Unfortunately, the experience usually comes from bad judgement. From tgc at jupiterrise.com Mon Aug 16 06:34:22 2010 From: tgc at jupiterrise.com (Tom Christensen) Date: Sun, 15 Aug 2010 22:34:22 +0200 Subject: Call for testing: OpenSSH-5.6 In-Reply-To: <20100815053218.GA1329@gate.dtucker.net> References: <4C66EA62.2050503@jupiterrise.com> <20100815015140.GA13340@gate.dtucker.net> <20100815032120.GA14663@gate.dtucker.net> <20100815053218.GA1329@gate.dtucker.net> Message-ID: <20100815203422.GA5710@ares.tgcnet> On Sun, Aug 15, 2010 at 03:32:19PM +1000, Darren Tucker wrote: > On Sun, Aug 15, 2010 at 02:11:01PM +1000, Damien Miller wrote: > > On Sun, 15 Aug 2010, Darren Tucker wrote: > [...] > > > I think a better way of doing this longer term is to have a dummy > > > strptime implementation in the compat library, but that can wait until > > > after the release since it risks linking problems elsewhere. > > > > Actually, OpenBSD's strptime isn't too tangled if you chop out the > > locale stuff. We don't actually use any of that anyway, just the numeric > > converters. Here is a stab at a port, but it is late here and I'm > > too tired to test it (it assumes you have the configure bits done already). > > Here's an update with the configure bits done, and some compile errors > fixed. I also put up a complete tarball at > http://www.zipworld.com.au/~dtucker/tmp/openssh-strptime.tar.gz > The build completes and basic functionality is working. Thanks! There are some hangs in the regression tests but I don't presently have results from previous versions to compare against so I can't tell if this is a new problem. -tgc From dtucker at zip.com.au Mon Aug 16 13:25:12 2010 From: dtucker at zip.com.au (Darren Tucker) Date: Mon, 16 Aug 2010 13:25:12 +1000 Subject: Call for testing: OpenSSH-5.6 In-Reply-To: <20100815203422.GA5710@ares.tgcnet> References: <4C66EA62.2050503@jupiterrise.com> <20100815015140.GA13340@gate.dtucker.net> <20100815032120.GA14663@gate.dtucker.net> <20100815053218.GA1329@gate.dtucker.net> <20100815203422.GA5710@ares.tgcnet> Message-ID: <20100816032512.GA6442@gate.dtucker.net> On Sun, Aug 15, 2010 at 10:34:22PM +0200, Tom Christensen wrote: > The build completes and basic functionality is working. > Thanks! Thanks for testing, the patch has been committed and will be in the next snapshot and the 5.6p1 release. -- Darren Tucker (dtucker at zip.com.au) GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4 37C9 C982 80C7 8FF4 FA69 Good judgement comes with experience. Unfortunately, the experience usually comes from bad judgement. From djm at mindrot.org Tue Aug 17 02:08:13 2010 From: djm at mindrot.org (Damien Miller) Date: Tue, 17 Aug 2010 02:08:13 +1000 (EST) Subject: Final(?) changes committed Message-ID: Hi, In addition to the strptime change that Darren has just committed to fix Irix, I have committed a change to ssh(1) that affects all platforms: > - djm at cvs.openbsd.org 2010/08/12 21:49:44 > [ssh.c] > close any extra file descriptors inherited from parent at start and > reopen stdin/stdout to /dev/null when forking for ControlPersist. > > prevents tools that fork and run a captive ssh for communication from > failing to exit when the ssh completes while they wait for these fds to > close. The inherited fds may persist arbitrarily long if a background > mux master has been started by ControlPersist. cvs and scp were effected > by this. The problem that this fixed was tools like cvs(1) and scp(1) hanging if they were the first connection to a server with ControlPersist active. They would start a background ssh(1) to act as a mux master, and the grandparent process (cvs or scp) would hang after the original parent ssh(1) process had exited, waiting for the mux master process to close its fds. This is a low-risk change in my opinion, but I'd appreciate any tests that you are willing to run. A snapshot with the strptime and ssh(1) change is available at: http://www.mindrot.org/openssh_snap/openssh-SNAP-20100817.tar.gz Thanks, Damien From imorgan at nas.nasa.gov Tue Aug 17 06:54:10 2010 From: imorgan at nas.nasa.gov (Iain Morgan) Date: Mon, 16 Aug 2010 13:54:10 -0700 Subject: Final(?) changes committed In-Reply-To: References: Message-ID: <20100816205410.GH23900@linux55.nas.nasa.gov> On Mon, Aug 16, 2010 at 11:08:13 -0500, Damien Miller wrote: > Hi, > > In addition to the strptime change that Darren has just committed to > fix Irix, I have committed a change to ssh(1) that affects all platforms: > > > - djm at cvs.openbsd.org 2010/08/12 21:49:44 > > [ssh.c] > > close any extra file descriptors inherited from parent at start and > > reopen stdin/stdout to /dev/null when forking for ControlPersist. > > > > prevents tools that fork and run a captive ssh for communication from > > failing to exit when the ssh completes while they wait for these fds to > > close. The inherited fds may persist arbitrarily long if a background > > mux master has been started by ControlPersist. cvs and scp were effected > > by this. > > The problem that this fixed was tools like cvs(1) and scp(1) hanging > if they were the first connection to a server with ControlPersist active. > They would start a background ssh(1) to act as a mux master, and the > grandparent process (cvs or scp) would hang after the original parent > ssh(1) process had exited, waiting for the mux master process to close > its fds. > > This is a low-risk change in my opinion, but I'd appreciate any tests that > you are willing to run. A snapshot with the strptime and ssh(1) change is > available at: > > http://www.mindrot.org/openssh_snap/openssh-SNAP-20100817.tar.gz > > Thanks, > Damien > _______________________________________________ The 20100817 snapshot builds and tests OK on the following platforms: RHEL 5/x86_64 SLES 10/x86_64 SLES 10/Itanium Solaris 9/SPARC Mac OS X 10.5.8/Intel As before I had to modify regress/login-timeout.sh on the RHEL 5 system. It seems to tickle a race condition most of the time. As before, replacing "$SUDO kill `$SUDO cat $PIDFILE`" with "cleanup" seems to fix the issue. (Thus far, I haven't needed to modify regress/reexec.sh, but in principle it could suffer from the same race condition.) I should also note some typos in regress/README.regress. The file refers to TEST_SSH_SSH_CONFOTPS and TEST_SSH_SSHD_CONFOTPS, whereas the scripts use TEST_SSH_SSH{,D}_CONFOPTS. -- Iain Morgan From andyb1 at andy-t.org Tue Aug 17 14:18:50 2010 From: andyb1 at andy-t.org (Andy Tsouladze) Date: Mon, 16 Aug 2010 23:18:50 -0500 (CDT) Subject: Slackware-12 still fails three tests In-Reply-To: References: Message-ID: I have re-run builds of openssh-SNAP-20100817.tar.gz on slackware-12.0 and slackware-13.0. On 13.0, there both build and all tests run fine. On slackware-12.0, openssh is built successfully, but three tests fail. I had to test them individually (by removing successful ones from .../regress/Makefile). I also put `set -x' as the first line of every problematic test file (banner.sh, stderr-data.sh, and stderr-after-eof.sh) Any chance this can be addressed before the release? Below, I include the output from the three failed tests, run separately. Output from running only banner test ------------------------------------ (cd openbsd-compat && make) make[1]: Entering directory `/home/src/openssh/openbsd-compat' make[1]: Nothing to be done for `all'. make[1]: Leaving directory `/home/src/openssh/openbsd-compat' BUILDDIR=`pwd`; \ [ -d `pwd`/regress ] || mkdir -p `pwd`/regress; \ [ -f `pwd`/regress/Makefile ] || \ ln -s `cd . && pwd`/regress/Makefile `pwd`/regress/Makefile ; \ TEST_SHELL="sh"; \ TEST_SSH_SSH="${BUILDDIR}/ssh"; \ TEST_SSH_SSHD="${BUILDDIR}/sshd"; \ TEST_SSH_SSHAGENT="${BUILDDIR}/ssh-agent"; \ TEST_SSH_SSHADD="${BUILDDIR}/ssh-add"; \ TEST_SSH_SSHKEYGEN="${BUILDDIR}/ssh-keygen"; \ TEST_SSH_SSHPKCS11HELPER="${BUILDDIR}/ssh-pkcs11-helper"; \ TEST_SSH_SSHKEYSCAN="${BUILDDIR}/ssh-keyscan"; \ TEST_SSH_SFTP="${BUILDDIR}/sftp"; \ TEST_SSH_SFTPSERVER="${BUILDDIR}/sftp-server"; \ TEST_SSH_PLINK="plink"; \ TEST_SSH_PUTTYGEN="puttygen"; \ TEST_SSH_CONCH="conch"; \ TEST_SSH_IPV6="yes" ; \ cd ./regress || exit $?; \ make \ .OBJDIR="${BUILDDIR}/regress" \ .CURDIR="`pwd`" \ BUILDDIR="${BUILDDIR}" \ OBJ="${BUILDDIR}/regress/" \ PATH="${BUILDDIR}:${PATH}" \ TEST_SHELL="${TEST_SHELL}" \ TEST_SSH_SSH="${TEST_SSH_SSH}" \ TEST_SSH_SSHD="${TEST_SSH_SSHD}" \ TEST_SSH_SSHAGENT="${TEST_SSH_SSHAGENT}" \ TEST_SSH_SSHADD="${TEST_SSH_SSHADD}" \ TEST_SSH_SSHKEYGEN="${TEST_SSH_SSHKEYGEN}" \ TEST_SSH_SSHPKCS11HELPER="${TEST_SSH_SSHPKCS11HELPER}" \ TEST_SSH_SSHKEYSCAN="${TEST_SSH_SSHKEYSCAN}" \ TEST_SSH_SFTP="${TEST_SSH_SFTP}" \ TEST_SSH_SFTPSERVER="${TEST_SSH_SFTPSERVER}" \ TEST_SSH_PLINK="${TEST_SSH_PLINK}" \ TEST_SSH_PUTTYGEN="${TEST_SSH_PUTTYGEN}" \ TEST_SSH_CONCH="${TEST_SSH_CONCH}" \ TEST_SSH_IPV6="yes" \ EXEEXT="" \ tests && echo all tests passed make[1]: Entering directory `/home/src/openssh/regress' ssh-keygen -if /src/openssh/regress/rsa_ssh2.prv | diff - /src/openssh/regress/rsa_openssh.prv cat /src/openssh/regress/rsa_openssh.prv > /src/openssh/regress//t2.out chmod 600 /src/openssh/regress//t2.out ssh-keygen -yf /src/openssh/regress//t2.out | diff - /src/openssh/regress/rsa_openssh.pub ssh-keygen -ef /src/openssh/regress/rsa_openssh.pub >/src/openssh/regress//rsa_secsh.pub ssh-keygen -if /src/openssh/regress//rsa_secsh.pub | diff - /src/openssh/regress/rsa_openssh.pub rm -f /src/openssh/regress/rsa_secsh.pub ssh-keygen -lf /src/openssh/regress/rsa_openssh.pub |\ awk '{print $2}' | diff - /src/openssh/regress/t4.ok ssh-keygen -Bf /src/openssh/regress/rsa_openssh.pub |\ awk '{print $2}' | diff - /src/openssh/regress/t5.ok ssh-keygen -if /src/openssh/regress/dsa_ssh2.prv > /src/openssh/regress//t6.out1 ssh-keygen -if /src/openssh/regress/dsa_ssh2.pub > /src/openssh/regress//t6.out2 chmod 600 /src/openssh/regress//t6.out1 ssh-keygen -yf /src/openssh/regress//t6.out1 | diff - /src/openssh/regress//t6.out2 ssh-keygen -lf /src/openssh/regress//t7.out > /dev/null ssh-keygen -Bf /src/openssh/regress//t7.out > /dev/null run test banner.sh ... ++ tid=banner ++ echo 'Banner /src/openssh/regress/banner.in' ++ rm -f /src/openssh/regress/banner.out /src/openssh/regress/banner.in /src/openssh/regress/empty.in ++ touch /src/openssh/regress/empty.in ++ trace 'test missing banner file' ++ echo 'trace: test missing banner file' ++ '[' X = Xyes ']' ++ verbose 'test banner: missing banner file' ++ echo 'verbose: test banner: missing banner file' ++ '[' X '!=' Xyes ']' ++ echo 'test banner: missing banner file' test banner: missing banner file ++ /src/openssh/ssh -2 -F /src/openssh/regress/ssh_proxy otherhost true ++ cmp /src/openssh/regress/empty.in /src/openssh/regress/banner.out cmp: EOF on /src/openssh/regress/empty.in ++ fail 'missing banner file' ++ echo 'FAIL: missing banner file' ++ RESULT=1 ++ echo 'missing banner file' missing banner file ++ for s in 0 10 100 1000 10000 100000 ++ '[' 0 = 0 ']' ++ touch /src/openssh/regress/banner.in ++ trace 'test banner size 0' ++ echo 'trace: test banner size 0' ++ '[' X = Xyes ']' ++ verbose 'test banner: size 0' ++ echo 'verbose: test banner: size 0' ++ '[' X '!=' Xyes ']' ++ echo 'test banner: size 0' test banner: size 0 ++ /src/openssh/ssh -2 -F /src/openssh/regress/ssh_proxy otherhost true ++ cmp /src/openssh/regress/banner.in /src/openssh/regress/banner.out cmp: EOF on /src/openssh/regress/banner.in ++ fail 'banner size 0 mismatch' ++ echo 'FAIL: banner size 0 mismatch' ++ RESULT=1 ++ echo 'banner size 0 mismatch' banner size 0 mismatch ++ for s in 0 10 100 1000 10000 100000 ++ '[' 10 = 0 ']' ++ '[' 10 = 10 ']' ++ echo abcdefghi ++ trace 'test banner size 10' ++ echo 'trace: test banner size 10' ++ '[' X = Xyes ']' ++ verbose 'test banner: size 10' ++ echo 'verbose: test banner: size 10' ++ '[' X '!=' Xyes ']' ++ echo 'test banner: size 10' test banner: size 10 ++ /src/openssh/ssh -2 -F /src/openssh/regress/ssh_proxy otherhost true ++ cmp /src/openssh/regress/banner.in /src/openssh/regress/banner.out /src/openssh/regress/banner.in /src/openssh/regress/banner.out differ: char 1, line 1 ++ fail 'banner size 10 mismatch' ++ echo 'FAIL: banner size 10 mismatch' ++ RESULT=1 ++ echo 'banner size 10 mismatch' banner size 10 mismatch ++ for s in 0 10 100 1000 10000 100000 ++ '[' 100 = 0 ']' ++ '[' 100 = 10 ']' ++ cp /src/openssh/regress/banner.in /src/openssh/regress/banner.out ++ for i in 0 1 2 3 4 5 6 7 8 ++ cat /src/openssh/regress/banner.out ++ for i in 0 1 2 3 4 5 6 7 8 ++ cat /src/openssh/regress/banner.out ++ for i in 0 1 2 3 4 5 6 7 8 ++ cat /src/openssh/regress/banner.out ++ for i in 0 1 2 3 4 5 6 7 8 ++ cat /src/openssh/regress/banner.out ++ for i in 0 1 2 3 4 5 6 7 8 ++ cat /src/openssh/regress/banner.out ++ for i in 0 1 2 3 4 5 6 7 8 ++ cat /src/openssh/regress/banner.out ++ for i in 0 1 2 3 4 5 6 7 8 ++ cat /src/openssh/regress/banner.out ++ for i in 0 1 2 3 4 5 6 7 8 ++ cat /src/openssh/regress/banner.out ++ for i in 0 1 2 3 4 5 6 7 8 ++ cat /src/openssh/regress/banner.out ++ trace 'test banner size 100' ++ echo 'trace: test banner size 100' ++ '[' X = Xyes ']' ++ verbose 'test banner: size 100' ++ echo 'verbose: test banner: size 100' ++ '[' X '!=' Xyes ']' ++ echo 'test banner: size 100' test banner: size 100 ++ /src/openssh/ssh -2 -F /src/openssh/regress/ssh_proxy otherhost true ++ cmp /src/openssh/regress/banner.in /src/openssh/regress/banner.out /src/openssh/regress/banner.in /src/openssh/regress/banner.out differ: char 1, line 1 ++ fail 'banner size 100 mismatch' ++ echo 'FAIL: banner size 100 mismatch' ++ RESULT=1 ++ echo 'banner size 100 mismatch' banner size 100 mismatch ++ for s in 0 10 100 1000 10000 100000 ++ '[' 1000 = 0 ']' ++ '[' 1000 = 10 ']' ++ cp /src/openssh/regress/banner.in /src/openssh/regress/banner.out ++ for i in 0 1 2 3 4 5 6 7 8 ++ cat /src/openssh/regress/banner.out ++ for i in 0 1 2 3 4 5 6 7 8 ++ cat /src/openssh/regress/banner.out ++ for i in 0 1 2 3 4 5 6 7 8 ++ cat /src/openssh/regress/banner.out ++ for i in 0 1 2 3 4 5 6 7 8 ++ cat /src/openssh/regress/banner.out ++ for i in 0 1 2 3 4 5 6 7 8 ++ cat /src/openssh/regress/banner.out ++ for i in 0 1 2 3 4 5 6 7 8 ++ cat /src/openssh/regress/banner.out ++ for i in 0 1 2 3 4 5 6 7 8 ++ cat /src/openssh/regress/banner.out ++ for i in 0 1 2 3 4 5 6 7 8 ++ cat /src/openssh/regress/banner.out ++ for i in 0 1 2 3 4 5 6 7 8 ++ cat /src/openssh/regress/banner.out ++ trace 'test banner size 1000' ++ echo 'trace: test banner size 1000' ++ '[' X = Xyes ']' ++ verbose 'test banner: size 1000' ++ echo 'verbose: test banner: size 1000' ++ '[' X '!=' Xyes ']' ++ echo 'test banner: size 1000' test banner: size 1000 ++ /src/openssh/ssh -2 -F /src/openssh/regress/ssh_proxy otherhost true ++ cmp /src/openssh/regress/banner.in /src/openssh/regress/banner.out /src/openssh/regress/banner.in /src/openssh/regress/banner.out differ: char 1, line 1 ++ fail 'banner size 1000 mismatch' ++ echo 'FAIL: banner size 1000 mismatch' ++ RESULT=1 ++ echo 'banner size 1000 mismatch' banner size 1000 mismatch ++ for s in 0 10 100 1000 10000 100000 ++ '[' 10000 = 0 ']' ++ '[' 10000 = 10 ']' ++ cp /src/openssh/regress/banner.in /src/openssh/regress/banner.out ++ for i in 0 1 2 3 4 5 6 7 8 ++ cat /src/openssh/regress/banner.out ++ for i in 0 1 2 3 4 5 6 7 8 ++ cat /src/openssh/regress/banner.out ++ for i in 0 1 2 3 4 5 6 7 8 ++ cat /src/openssh/regress/banner.out ++ for i in 0 1 2 3 4 5 6 7 8 ++ cat /src/openssh/regress/banner.out ++ for i in 0 1 2 3 4 5 6 7 8 ++ cat /src/openssh/regress/banner.out ++ for i in 0 1 2 3 4 5 6 7 8 ++ cat /src/openssh/regress/banner.out ++ for i in 0 1 2 3 4 5 6 7 8 ++ cat /src/openssh/regress/banner.out ++ for i in 0 1 2 3 4 5 6 7 8 ++ cat /src/openssh/regress/banner.out ++ for i in 0 1 2 3 4 5 6 7 8 ++ cat /src/openssh/regress/banner.out ++ trace 'test banner size 10000' ++ echo 'trace: test banner size 10000' ++ '[' X = Xyes ']' ++ verbose 'test banner: size 10000' ++ echo 'verbose: test banner: size 10000' ++ '[' X '!=' Xyes ']' ++ echo 'test banner: size 10000' test banner: size 10000 ++ /src/openssh/ssh -2 -F /src/openssh/regress/ssh_proxy otherhost true ++ cmp /src/openssh/regress/banner.in /src/openssh/regress/banner.out /src/openssh/regress/banner.in /src/openssh/regress/banner.out differ: char 1, line 1 ++ fail 'banner size 10000 mismatch' ++ echo 'FAIL: banner size 10000 mismatch' ++ RESULT=1 ++ echo 'banner size 10000 mismatch' banner size 10000 mismatch ++ for s in 0 10 100 1000 10000 100000 ++ '[' 100000 = 0 ']' ++ '[' 100000 = 10 ']' ++ cp /src/openssh/regress/banner.in /src/openssh/regress/banner.out ++ for i in 0 1 2 3 4 5 6 7 8 ++ cat /src/openssh/regress/banner.out ++ for i in 0 1 2 3 4 5 6 7 8 ++ cat /src/openssh/regress/banner.out ++ for i in 0 1 2 3 4 5 6 7 8 ++ cat /src/openssh/regress/banner.out ++ for i in 0 1 2 3 4 5 6 7 8 ++ cat /src/openssh/regress/banner.out ++ for i in 0 1 2 3 4 5 6 7 8 ++ cat /src/openssh/regress/banner.out ++ for i in 0 1 2 3 4 5 6 7 8 ++ cat /src/openssh/regress/banner.out ++ for i in 0 1 2 3 4 5 6 7 8 ++ cat /src/openssh/regress/banner.out ++ for i in 0 1 2 3 4 5 6 7 8 ++ cat /src/openssh/regress/banner.out ++ for i in 0 1 2 3 4 5 6 7 8 ++ cat /src/openssh/regress/banner.out ++ trace 'test banner size 100000' ++ echo 'trace: test banner size 100000' ++ '[' X = Xyes ']' ++ verbose 'test banner: size 100000' ++ echo 'verbose: test banner: size 100000' ++ '[' X '!=' Xyes ']' ++ echo 'test banner: size 100000' test banner: size 100000 ++ /src/openssh/ssh -2 -F /src/openssh/regress/ssh_proxy otherhost true ++ cmp /src/openssh/regress/banner.in /src/openssh/regress/banner.out /src/openssh/regress/banner.in /src/openssh/regress/banner.out differ: char 1, line 1 ++ fail 'banner size 100000 mismatch' ++ echo 'FAIL: banner size 100000 mismatch' ++ RESULT=1 ++ echo 'banner size 100000 mismatch' banner size 100000 mismatch ++ trace 'test suppress banner (-q)' ++ echo 'trace: test suppress banner (-q)' ++ '[' X = Xyes ']' ++ verbose 'test banner: suppress banner (-q)' ++ echo 'verbose: test banner: suppress banner (-q)' ++ '[' X '!=' Xyes ']' ++ echo 'test banner: suppress banner (-q)' test banner: suppress banner (-q) ++ /src/openssh/ssh -q -2 -F /src/openssh/regress/ssh_proxy otherhost true ++ cmp /src/openssh/regress/empty.in /src/openssh/regress/banner.out cmp: EOF on /src/openssh/regress/empty.in ++ fail 'suppress banner (-q)' ++ echo 'FAIL: suppress banner (-q)' ++ RESULT=1 ++ echo 'suppress banner (-q)' suppress banner (-q) ++ rm -f /src/openssh/regress/banner.out /src/openssh/regress/banner.in /src/openssh/regress/empty.in + cleanup + '[' -f /src/openssh/regress/pidfile ']' + '[' 1 -eq 0 ']' + echo failed banner failed banner + exit 1 make[1]: *** [t-exec] Error 1 make[1]: Leaving directory `/home/src/openssh/regress' make: *** [tests] Error 2 ----------------------------------------- Output from running only stderr-data test ----------------------------------------- (cd openbsd-compat && make) make[1]: Entering directory `/home/src/openssh/openbsd-compat' make[1]: Nothing to be done for `all'. make[1]: Leaving directory `/home/src/openssh/openbsd-compat' BUILDDIR=`pwd`; \ [ -d `pwd`/regress ] || mkdir -p `pwd`/regress; \ [ -f `pwd`/regress/Makefile ] || \ ln -s `cd . && pwd`/regress/Makefile `pwd`/regress/Makefile ; \ TEST_SHELL="sh"; \ TEST_SSH_SSH="${BUILDDIR}/ssh"; \ TEST_SSH_SSHD="${BUILDDIR}/sshd"; \ TEST_SSH_SSHAGENT="${BUILDDIR}/ssh-agent"; \ TEST_SSH_SSHADD="${BUILDDIR}/ssh-add"; \ TEST_SSH_SSHKEYGEN="${BUILDDIR}/ssh-keygen"; \ TEST_SSH_SSHPKCS11HELPER="${BUILDDIR}/ssh-pkcs11-helper"; \ TEST_SSH_SSHKEYSCAN="${BUILDDIR}/ssh-keyscan"; \ TEST_SSH_SFTP="${BUILDDIR}/sftp"; \ TEST_SSH_SFTPSERVER="${BUILDDIR}/sftp-server"; \ TEST_SSH_PLINK="plink"; \ TEST_SSH_PUTTYGEN="puttygen"; \ TEST_SSH_CONCH="conch"; \ TEST_SSH_IPV6="yes" ; \ cd ./regress || exit $?; \ make \ .OBJDIR="${BUILDDIR}/regress" \ .CURDIR="`pwd`" \ BUILDDIR="${BUILDDIR}" \ OBJ="${BUILDDIR}/regress/" \ PATH="${BUILDDIR}:${PATH}" \ TEST_SHELL="${TEST_SHELL}" \ TEST_SSH_SSH="${TEST_SSH_SSH}" \ TEST_SSH_SSHD="${TEST_SSH_SSHD}" \ TEST_SSH_SSHAGENT="${TEST_SSH_SSHAGENT}" \ TEST_SSH_SSHADD="${TEST_SSH_SSHADD}" \ TEST_SSH_SSHKEYGEN="${TEST_SSH_SSHKEYGEN}" \ TEST_SSH_SSHPKCS11HELPER="${TEST_SSH_SSHPKCS11HELPER}" \ TEST_SSH_SSHKEYSCAN="${TEST_SSH_SSHKEYSCAN}" \ TEST_SSH_SFTP="${TEST_SSH_SFTP}" \ TEST_SSH_SFTPSERVER="${TEST_SSH_SFTPSERVER}" \ TEST_SSH_PLINK="${TEST_SSH_PLINK}" \ TEST_SSH_PUTTYGEN="${TEST_SSH_PUTTYGEN}" \ TEST_SSH_CONCH="${TEST_SSH_CONCH}" \ TEST_SSH_IPV6="yes" \ EXEEXT="" \ tests && echo all tests passed make[1]: Entering directory `/home/src/openssh/regress' ssh-keygen -if /src/openssh/regress/rsa_ssh2.prv | diff - /src/openssh/regress/rsa_openssh.prv cat /src/openssh/regress/rsa_openssh.prv > /src/openssh/regress//t2.out chmod 600 /src/openssh/regress//t2.out ssh-keygen -yf /src/openssh/regress//t2.out | diff - /src/openssh/regress/rsa_openssh.pub ssh-keygen -ef /src/openssh/regress/rsa_openssh.pub >/src/openssh/regress//rsa_secsh.pub ssh-keygen -if /src/openssh/regress//rsa_secsh.pub | diff - /src/openssh/regress/rsa_openssh.pub rm -f /src/openssh/regress/rsa_secsh.pub ssh-keygen -lf /src/openssh/regress/rsa_openssh.pub |\ awk '{print $2}' | diff - /src/openssh/regress/t4.ok ssh-keygen -Bf /src/openssh/regress/rsa_openssh.pub |\ awk '{print $2}' | diff - /src/openssh/regress/t5.ok ssh-keygen -if /src/openssh/regress/dsa_ssh2.prv > /src/openssh/regress//t6.out1 ssh-keygen -if /src/openssh/regress/dsa_ssh2.pub > /src/openssh/regress//t6.out2 chmod 600 /src/openssh/regress//t6.out1 ssh-keygen -yf /src/openssh/regress//t6.out1 | diff - /src/openssh/regress//t6.out2 ssh-keygen -lf /src/openssh/regress//t7.out > /dev/null ssh-keygen -Bf /src/openssh/regress//t7.out > /dev/null run test stderr-data.sh ... ++ tid='stderr data transfer' ++ DATA=/bin/ls ++ COPY=/src/openssh/regress/copy ++ rm -f /src/openssh/regress/copy ++ for n in ''\'''\''' -n ++ for p in 1 2 ++ verbose 'test stderr data transfer: proto 1 ()' ++ echo 'verbose: test stderr data transfer: proto 1 ()' ++ '[' X '!=' Xyes ']' ++ echo 'test stderr data transfer: proto 1 ()' test stderr data transfer: proto 1 () ++ /src/openssh/ssh -1 -F /src/openssh/regress/ssh_proxy otherhost exec sh -c ''\''exec > /dev/null; sleep 3; cat /bin/ls 1>&2 '\''' ++ r=0 ++ '[' 0 -ne 0 ']' ++ cmp /bin/ls /src/openssh/regress/copy /bin/ls /src/openssh/regress/copy differ: char 1, line 1 ++ fail 'stderr corrupt' ++ echo 'FAIL: stderr corrupt' ++ RESULT=1 ++ echo 'stderr corrupt' stderr corrupt ++ rm -f /src/openssh/regress/copy ++ /src/openssh/ssh -1 -F /src/openssh/regress/ssh_proxy otherhost exec sh -c ''\''echo a; exec > /dev/null; sleep 3; cat /bin/ls 1>&2 '\''' ++ r=0 ++ '[' 0 -ne 0 ']' ++ cmp /bin/ls /src/openssh/regress/copy /bin/ls /src/openssh/regress/copy differ: char 1, line 1 ++ fail 'stderr corrupt' ++ echo 'FAIL: stderr corrupt' ++ RESULT=1 ++ echo 'stderr corrupt' stderr corrupt ++ rm -f /src/openssh/regress/copy ++ for p in 1 2 ++ verbose 'test stderr data transfer: proto 2 ()' ++ echo 'verbose: test stderr data transfer: proto 2 ()' ++ '[' X '!=' Xyes ']' ++ echo 'test stderr data transfer: proto 2 ()' test stderr data transfer: proto 2 () ++ /src/openssh/ssh -2 -F /src/openssh/regress/ssh_proxy otherhost exec sh -c ''\''exec > /dev/null; sleep 3; cat /bin/ls 1>&2 '\''' ++ r=0 ++ '[' 0 -ne 0 ']' ++ cmp /bin/ls /src/openssh/regress/copy /bin/ls /src/openssh/regress/copy differ: char 1, line 1 ++ fail 'stderr corrupt' ++ echo 'FAIL: stderr corrupt' ++ RESULT=1 ++ echo 'stderr corrupt' stderr corrupt ++ rm -f /src/openssh/regress/copy ++ /src/openssh/ssh -2 -F /src/openssh/regress/ssh_proxy otherhost exec sh -c ''\''echo a; exec > /dev/null; sleep 3; cat /bin/ls 1>&2 '\''' ++ r=0 ++ '[' 0 -ne 0 ']' ++ cmp /bin/ls /src/openssh/regress/copy /bin/ls /src/openssh/regress/copy differ: char 1, line 1 ++ fail 'stderr corrupt' ++ echo 'FAIL: stderr corrupt' ++ RESULT=1 ++ echo 'stderr corrupt' stderr corrupt ++ rm -f /src/openssh/regress/copy ++ for n in ''\'''\''' -n ++ for p in 1 2 ++ verbose 'test stderr data transfer: proto 1 (-n)' ++ echo 'verbose: test stderr data transfer: proto 1 (-n)' ++ '[' X '!=' Xyes ']' ++ echo 'test stderr data transfer: proto 1 (-n)' test stderr data transfer: proto 1 (-n) ++ /src/openssh/ssh -n -1 -F /src/openssh/regress/ssh_proxy otherhost exec sh -c ''\''exec > /dev/null; sleep 3; cat /bin/ls 1>&2 '\''' ++ r=0 ++ '[' 0 -ne 0 ']' ++ cmp /bin/ls /src/openssh/regress/copy /bin/ls /src/openssh/regress/copy differ: char 1, line 1 ++ fail 'stderr corrupt' ++ echo 'FAIL: stderr corrupt' ++ RESULT=1 ++ echo 'stderr corrupt' stderr corrupt ++ rm -f /src/openssh/regress/copy ++ /src/openssh/ssh -n -1 -F /src/openssh/regress/ssh_proxy otherhost exec sh -c ''\''echo a; exec > /dev/null; sleep 3; cat /bin/ls 1>&2 '\''' ++ r=0 ++ '[' 0 -ne 0 ']' ++ cmp /bin/ls /src/openssh/regress/copy /bin/ls /src/openssh/regress/copy differ: char 1, line 1 ++ fail 'stderr corrupt' ++ echo 'FAIL: stderr corrupt' ++ RESULT=1 ++ echo 'stderr corrupt' stderr corrupt ++ rm -f /src/openssh/regress/copy ++ for p in 1 2 ++ verbose 'test stderr data transfer: proto 2 (-n)' ++ echo 'verbose: test stderr data transfer: proto 2 (-n)' ++ '[' X '!=' Xyes ']' ++ echo 'test stderr data transfer: proto 2 (-n)' test stderr data transfer: proto 2 (-n) ++ /src/openssh/ssh -n -2 -F /src/openssh/regress/ssh_proxy otherhost exec sh -c ''\''exec > /dev/null; sleep 3; cat /bin/ls 1>&2 '\''' ++ r=0 ++ '[' 0 -ne 0 ']' ++ cmp /bin/ls /src/openssh/regress/copy /bin/ls /src/openssh/regress/copy differ: char 1, line 1 ++ fail 'stderr corrupt' ++ echo 'FAIL: stderr corrupt' ++ RESULT=1 ++ echo 'stderr corrupt' stderr corrupt ++ rm -f /src/openssh/regress/copy ++ /src/openssh/ssh -n -2 -F /src/openssh/regress/ssh_proxy otherhost exec sh -c ''\''echo a; exec > /dev/null; sleep 3; cat /bin/ls 1>&2 '\''' ++ r=0 ++ '[' 0 -ne 0 ']' ++ cmp /bin/ls /src/openssh/regress/copy /bin/ls /src/openssh/regress/copy differ: char 1, line 1 ++ fail 'stderr corrupt' ++ echo 'FAIL: stderr corrupt' ++ RESULT=1 ++ echo 'stderr corrupt' stderr corrupt ++ rm -f /src/openssh/regress/copy + cleanup + '[' -f /src/openssh/regress/pidfile ']' + '[' 1 -eq 0 ']' + echo failed stderr data transfer failed stderr data transfer + exit 1 make[1]: *** [t-exec] Error 1 make[1]: Leaving directory `/home/src/openssh/regress' make: *** [tests] Error 2 ----------------------------------------- Output from running only stderr-after-eof test ----------------------------------------- (cd openbsd-compat && make) make[1]: Entering directory `/home/src/openssh/openbsd-compat' make[1]: Nothing to be done for `all'. make[1]: Leaving directory `/home/src/openssh/openbsd-compat' BUILDDIR=`pwd`; \ [ -d `pwd`/regress ] || mkdir -p `pwd`/regress; \ [ -f `pwd`/regress/Makefile ] || \ ln -s `cd . && pwd`/regress/Makefile `pwd`/regress/Makefile ; \ TEST_SHELL="sh"; \ TEST_SSH_SSH="${BUILDDIR}/ssh"; \ TEST_SSH_SSHD="${BUILDDIR}/sshd"; \ TEST_SSH_SSHAGENT="${BUILDDIR}/ssh-agent"; \ TEST_SSH_SSHADD="${BUILDDIR}/ssh-add"; \ TEST_SSH_SSHKEYGEN="${BUILDDIR}/ssh-keygen"; \ TEST_SSH_SSHPKCS11HELPER="${BUILDDIR}/ssh-pkcs11-helper"; \ TEST_SSH_SSHKEYSCAN="${BUILDDIR}/ssh-keyscan"; \ TEST_SSH_SFTP="${BUILDDIR}/sftp"; \ TEST_SSH_SFTPSERVER="${BUILDDIR}/sftp-server"; \ TEST_SSH_PLINK="plink"; \ TEST_SSH_PUTTYGEN="puttygen"; \ TEST_SSH_CONCH="conch"; \ TEST_SSH_IPV6="yes" ; \ cd ./regress || exit $?; \ make \ .OBJDIR="${BUILDDIR}/regress" \ .CURDIR="`pwd`" \ BUILDDIR="${BUILDDIR}" \ OBJ="${BUILDDIR}/regress/" \ PATH="${BUILDDIR}:${PATH}" \ TEST_SHELL="${TEST_SHELL}" \ TEST_SSH_SSH="${TEST_SSH_SSH}" \ TEST_SSH_SSHD="${TEST_SSH_SSHD}" \ TEST_SSH_SSHAGENT="${TEST_SSH_SSHAGENT}" \ TEST_SSH_SSHADD="${TEST_SSH_SSHADD}" \ TEST_SSH_SSHKEYGEN="${TEST_SSH_SSHKEYGEN}" \ TEST_SSH_SSHPKCS11HELPER="${TEST_SSH_SSHPKCS11HELPER}" \ TEST_SSH_SSHKEYSCAN="${TEST_SSH_SSHKEYSCAN}" \ TEST_SSH_SFTP="${TEST_SSH_SFTP}" \ TEST_SSH_SFTPSERVER="${TEST_SSH_SFTPSERVER}" \ TEST_SSH_PLINK="${TEST_SSH_PLINK}" \ TEST_SSH_PUTTYGEN="${TEST_SSH_PUTTYGEN}" \ TEST_SSH_CONCH="${TEST_SSH_CONCH}" \ TEST_SSH_IPV6="yes" \ EXEEXT="" \ tests && echo all tests passed make[1]: Entering directory `/home/src/openssh/regress' ssh-keygen -if /src/openssh/regress/rsa_ssh2.prv | diff - /src/openssh/regress/rsa_openssh.prv cat /src/openssh/regress/rsa_openssh.prv > /src/openssh/regress//t2.out chmod 600 /src/openssh/regress//t2.out ssh-keygen -yf /src/openssh/regress//t2.out | diff - /src/openssh/regress/rsa_openssh.pub ssh-keygen -ef /src/openssh/regress/rsa_openssh.pub >/src/openssh/regress//rsa_secsh.pub ssh-keygen -if /src/openssh/regress//rsa_secsh.pub | diff - /src/openssh/regress/rsa_openssh.pub rm -f /src/openssh/regress/rsa_secsh.pub ssh-keygen -lf /src/openssh/regress/rsa_openssh.pub |\ awk '{print $2}' | diff - /src/openssh/regress/t4.ok ssh-keygen -Bf /src/openssh/regress/rsa_openssh.pub |\ awk '{print $2}' | diff - /src/openssh/regress/t5.ok ssh-keygen -if /src/openssh/regress/dsa_ssh2.prv > /src/openssh/regress//t6.out1 ssh-keygen -if /src/openssh/regress/dsa_ssh2.pub > /src/openssh/regress//t6.out2 chmod 600 /src/openssh/regress//t6.out1 ssh-keygen -yf /src/openssh/regress//t6.out1 | diff - /src/openssh/regress//t6.out2 ssh-keygen -lf /src/openssh/regress//t7.out > /dev/null ssh-keygen -Bf /src/openssh/regress//t7.out > /dev/null run test stderr-after-eof.sh ... ++ tid='stderr data after eof' ++ DATA=/etc/motd ++ DATA=/src/openssh/regress/data ++ COPY=/src/openssh/regress/copy ++ have_prog md5sum ++ saved_IFS=' ' ++ IFS=: ++ for i in '$PATH' ++ '[' -x /src/openssh/md5sum ']' ++ for i in '$PATH' ++ '[' -x /usr/local/bin/md5sum ']' ++ for i in '$PATH' ++ '[' -x /opt/kde/bin/md5sum ']' ++ for i in '$PATH' ++ '[' -x /bin/md5sum ']' ++ IFS=' ' ++ return 0 ++ CHECKSUM=md5sum ++ rm -f /src/openssh/regress/data /src/openssh/regress/copy ++ cp /dev/null /src/openssh/regress/data ++ for i in 1 2 3 4 5 6 ++ date ++ md5sum ++ echo 1 ++ for i in 1 2 3 4 5 6 ++ date ++ echo 2 ++ md5sum ++ for i in 1 2 3 4 5 6 ++ date ++ md5sum ++ echo 3 ++ for i in 1 2 3 4 5 6 ++ date ++ md5sum ++ echo 4 ++ for i in 1 2 3 4 5 6 ++ date ++ md5sum ++ echo 5 ++ for i in 1 2 3 4 5 6 ++ date ++ md5sum ++ echo 6 ++ /src/openssh/ssh -2 -F /src/openssh/regress/ssh_proxy otherhost exec sh -c ''\''exec > /dev/null; sleep 2; cat /src/openssh/regress/data 1>&2 '\''' ++ r=0 ++ '[' 0 -ne 0 ']' ++ egrep 'Disconnecting: Received extended_data after EOF' /src/openssh/regress/copy ++ cmp /src/openssh/regress/data /src/openssh/regress/copy /src/openssh/regress/data /src/openssh/regress/copy differ: char 1, line 1 ++ fail 'stderr corrupt' ++ echo 'FAIL: stderr corrupt' ++ RESULT=1 ++ echo 'stderr corrupt' stderr corrupt ++ rm -f /src/openssh/regress/data /src/openssh/regress/copy + cleanup + '[' -f /src/openssh/regress/pidfile ']' + '[' 1 -eq 0 ']' + echo failed stderr data after eof failed stderr data after eof + exit 1 make[1]: *** [t-exec] Error 1 make[1]: Leaving directory `/home/src/openssh/regress' make: *** [tests] Error 2 ---------------------------------------- Thanks, Andy Dr Andy Tsouladze Sr Unix/Storage SysAdmin From vinschen at redhat.com Tue Aug 17 17:26:43 2010 From: vinschen at redhat.com (Corinna Vinschen) Date: Tue, 17 Aug 2010 09:26:43 +0200 Subject: Final(?) changes committed In-Reply-To: References: Message-ID: <20100817072643.GA15313@calimero.vinschen.de> On Aug 17 02:08, Damien Miller wrote: > Hi, > > In addition to the strptime change that Darren has just committed to > fix Irix, I have committed a change to ssh(1) that affects all platforms: > > > - djm at cvs.openbsd.org 2010/08/12 21:49:44 > > [ssh.c] > > close any extra file descriptors inherited from parent at start and > > reopen stdin/stdout to /dev/null when forking for ControlPersist. > > > > prevents tools that fork and run a captive ssh for communication from > > failing to exit when the ssh completes while they wait for these fds to > > close. The inherited fds may persist arbitrarily long if a background > > mux master has been started by ControlPersist. cvs and scp were effected > > by this. > > The problem that this fixed was tools like cvs(1) and scp(1) hanging > if they were the first connection to a server with ControlPersist active. > They would start a background ssh(1) to act as a mux master, and the > grandparent process (cvs or scp) would hang after the original parent > ssh(1) process had exited, waiting for the mux master process to close > its fds. > > This is a low-risk change in my opinion, but I'd appreciate any tests that > you are willing to run. A snapshot with the strptime and ssh(1) change is > available at: > > http://www.mindrot.org/openssh_snap/openssh-SNAP-20100817.tar.gz Builds and tests fine on Cygwin, with the usual sftp-glob exception. Corinna -- Corinna Vinschen Cygwin Project Co-Leader Red Hat From imorgan at nas.nasa.gov Wed Aug 18 02:37:54 2010 From: imorgan at nas.nasa.gov (Iain Morgan) Date: Tue, 17 Aug 2010 09:37:54 -0700 Subject: Slackware-12 still fails three tests In-Reply-To: References: Message-ID: <20100817163754.GJ23900@linux55.nas.nasa.gov> On Mon, Aug 16, 2010 at 23:18:50 -0500, Andy Tsouladze wrote: > I have re-run builds of openssh-SNAP-20100817.tar.gz on slackware-12.0 and > slackware-13.0. On 13.0, there both build and all tests run fine. > > > On slackware-12.0, openssh is built successfully, but three tests fail. I > had to test them individually (by removing successful ones from > .../regress/Makefile). I also put `set -x' as the first line of every > problematic test file (banner.sh, stderr-data.sh, and stderr-after-eof.sh) > Any chance this can be addressed before the release? > The output in your previous email, particularly the numberous complaints from stty, makes me suspect that this is a user environment issue. Have you tried, for example, renaming your ~/.bashrc prior to running "make tests?" -- Iain Morgan From andyb1 at andy-t.org Wed Aug 18 03:06:38 2010 From: andyb1 at andy-t.org (Andy Tsouladze) Date: Tue, 17 Aug 2010 12:06:38 -0500 (CDT) Subject: Slackware-12 still fails three tests In-Reply-To: <20100817163754.GJ23900@linux55.nas.nasa.gov> References: <20100817163754.GJ23900@linux55.nas.nasa.gov> Message-ID: On Tue, 17 Aug 2010, Iain Morgan wrote: > On Mon, Aug 16, 2010 at 23:18:50 -0500, Andy Tsouladze wrote: >> I have re-run builds of openssh-SNAP-20100817.tar.gz on slackware-12.0 and >> slackware-13.0. On 13.0, there both build and all tests run fine. >> >> >> On slackware-12.0, openssh is built successfully, but three tests fail. I >> had to test them individually (by removing successful ones from >> .../regress/Makefile). I also put `set -x' as the first line of every >> problematic test file (banner.sh, stderr-data.sh, and stderr-after-eof.sh) >> Any chance this can be addressed before the release? >> > > The output in your previous email, particularly the numberous complaints > from stty, makes me suspect that this is a user environment issue. Have > you tried, for example, renaming your ~/.bashrc prior to running "make > tests?" I use tcsh, so .bashrc does not exist. I have removed a few stty settings from my .cshrc, and - you were correct - all tests passed. So that's a good thing. As a side note, maybe tests should be made more independent of a user environment. Thanks, Andy Dr Andy Tsouladze Sr Unix/Storage SysAdmin From chrivers at iversen-net.dk Wed Aug 18 03:30:59 2010 From: chrivers at iversen-net.dk (Christian Iversen) Date: Tue, 17 Aug 2010 19:30:59 +0200 Subject: Slackware-12 still fails three tests In-Reply-To: References: <20100817163754.GJ23900@linux55.nas.nasa.gov> Message-ID: <4C6AC753.1030204@iversen-net.dk> On 2010-08-17 19:06, Andy Tsouladze wrote: > On Tue, 17 Aug 2010, Iain Morgan wrote: > >> On Mon, Aug 16, 2010 at 23:18:50 -0500, Andy Tsouladze wrote: >>> I have re-run builds of openssh-SNAP-20100817.tar.gz on >>> slackware-12.0 and >>> slackware-13.0. On 13.0, there both build and all tests run fine. >>> >>> >>> On slackware-12.0, openssh is built successfully, but three tests >>> fail. I >>> had to test them individually (by removing successful ones from >>> .../regress/Makefile). I also put `set -x' as the first line of every >>> problematic test file (banner.sh, stderr-data.sh, and >>> stderr-after-eof.sh) >>> Any chance this can be addressed before the release? >>> >> >> The output in your previous email, particularly the numberous complaints >> from stty, makes me suspect that this is a user environment issue. Have >> you tried, for example, renaming your ~/.bashrc prior to running "make >> tests?" > > I use tcsh, so .bashrc does not exist. I have removed a few stty > settings from my .cshrc, and - you were correct - all tests passed. So > that's a good thing. As a side note, maybe tests should be made more > independent of a user environment. Maybe they could be run with "env -i" and some standard env defines? -- Med venlig hilsen Christian Iversen From imorgan at nas.nasa.gov Wed Aug 18 03:53:53 2010 From: imorgan at nas.nasa.gov (Iain Morgan) Date: Tue, 17 Aug 2010 10:53:53 -0700 Subject: Slackware-12 still fails three tests In-Reply-To: References: <20100817163754.GJ23900@linux55.nas.nasa.gov> Message-ID: <20100817175353.GK23900@linux55.nas.nasa.gov> On Tue, Aug 17, 2010 at 12:06:38 -0500, Andy Tsouladze wrote: > On Tue, 17 Aug 2010, Iain Morgan wrote: > > > On Mon, Aug 16, 2010 at 23:18:50 -0500, Andy Tsouladze wrote: > >> I have re-run builds of openssh-SNAP-20100817.tar.gz on slackware-12.0 and > >> slackware-13.0. On 13.0, there both build and all tests run fine. > >> > >> > >> On slackware-12.0, openssh is built successfully, but three tests fail. I > >> had to test them individually (by removing successful ones from > >> .../regress/Makefile). I also put `set -x' as the first line of every > >> problematic test file (banner.sh, stderr-data.sh, and stderr-after-eof.sh) > >> Any chance this can be addressed before the release? > >> > > > > The output in your previous email, particularly the numberous complaints > > from stty, makes me suspect that this is a user environment issue. Have > > you tried, for example, renaming your ~/.bashrc prior to running "make > > tests?" > > I use tcsh, so .bashrc does not exist. I have removed a few stty settings > from my .cshrc, and - you were correct - all tests passed. So that's a > good thing. As a side note, maybe tests should be made more independent > of a user environment. > > Thanks, > > Andy > > Dr Andy Tsouladze > Sr Unix/Storage SysAdmin > _______________________________________________ > openssh-unix-dev mailing list > openssh-unix-dev at mindrot.org > https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev That's easier said than done. The issue is that sshd invokes remote commands via the user's shell. Thus any problems with a .cshrc or (possibly) a .bashrc can break tthe tests in unexpected ways. I suppose a test for broken dot-files could be done at the beginning of the regression tests. For example, if $SHELL -c true yields any output to stderr or stdout, an appropriate error could be reported. -- Iain Morgan From kevin.brott at gmail.com Wed Aug 18 05:24:36 2010 From: kevin.brott at gmail.com (Kevin Brott) Date: Tue, 17 Aug 2010 12:24:36 -0700 Subject: Final(?) changes committed In-Reply-To: References: Message-ID: Using openssh-SNAP-20100817.tar.gz ./configure && make tests OS Build_Target CC OpenSSL BUILDS TESTS ============== ======================== ================ ======= ====== =========================== Ubuntu 6.06.2 i686-pc-linux-gnu gcc 4.0.3 0.9.8a YES all tests passed Ubuntu 7.10 i686-pc-linux-gnu gcc 4.1.3 0.9.8n YES all tests passed Ubuntu 10.04.1 x86_64-unknown-linux-gnu gcc 4.4.3 0.9.8k YES all tests passed AIX 5.2 sp10 powerpc-ibm-aix5.2.0.0 gcc 3.3.2 0.9.8f YES all tests passed AIX 5.3 sp7 powerpc-ibm-aix5.3.0.0 gcc 4.2.0 0.9.8k YES all tests passed AIX 6.1 sp4 powerpc-ibm-aix6.1.0.0 gcc 4.2.0 0.9.8k YES all tests passed HP-UX 11.11 hppa2.0w-hp-hpux11.11 gcc 3.4.3 0.9.7m YES all tests passed HP-UX 11.23 ia64-hp-hpux11.23 gcc 4.1.1 0.9.7m *1* all tests passed HP-UX 11.31 ia64-hp-hpux11.31 gcc 4.3.3 0.9.8l YES all tests passed HP-UX 11.31 ia64-hp-hpux11.31 HP C/aC++ A.06.20 0.9.8l YES all tests passed RH 6.2 i686-pc-linux-gnu egcs-2.91.66 0.9.8j YES all tests passed RH 8.0 i686-pc-linux-gnu gcc 3.2.2 0.9.7a YES all tests passed RHEL 2.1 i686-pc-linux-gnu gcc 2.9.6 0.9.8n *2*3* all tests passed RHEL 3.0 tu6 i686-pc-linux-gnu gcc 3.2.3 0.9.7a YES all tests passed RHEL 4.0 nu5 i686-pc-linux-gnu gcc 3.4.6 0.9.7a *3* all tests passed RHEL 5.4 x86_64-redhat-linux gcc 4.1.2 0.9.8e YES all tests passed FedoraCore r2 i686-pc-linux-gnu gcc 3.3.3 0.9.7a *3* all tests passed *1* HP-UX 11.23 on ia64 required --disable-utmpx to build *2* OS shipped with openssl 0.9.6b & openssh 5.6 will not configure/build \ however, building against 0.9.8n installed in local/tmp directory works *3* OS shipped with an old version of zlib - openssh will build/compile/run \ using --without-zlib-version-check ===== On Mon, Aug 16, 2010 at 09:08, Damien Miller wrote: > Hi, > > In addition to the strptime change that Darren has just committed to > fix Irix, I have committed a change to ssh(1) that affects all platforms: > > > - djm at cvs.openbsd.org 2010/08/12 21:49:44 > > [ssh.c] > > close any extra file descriptors inherited from parent at start and > > reopen stdin/stdout to /dev/null when forking for ControlPersist. > > > > prevents tools that fork and run a captive ssh for communication from > > failing to exit when the ssh completes while they wait for these fds to > > close. The inherited fds may persist arbitrarily long if a background > > mux master has been started by ControlPersist. cvs and scp were > effected > > by this. > > The problem that this fixed was tools like cvs(1) and scp(1) hanging > if they were the first connection to a server with ControlPersist active. > They would start a background ssh(1) to act as a mux master, and the > grandparent process (cvs or scp) would hang after the original parent > ssh(1) process had exited, waiting for the mux master process to close > its fds. > > This is a low-risk change in my opinion, but I'd appreciate any tests that > you are willing to run. A snapshot with the strptime and ssh(1) change is > available at: > > http://www.mindrot.org/openssh_snap/openssh-SNAP-20100817.tar.gz > > Thanks, > Damien > _______________________________________________ > openssh-unix-dev mailing list > openssh-unix-dev at mindrot.org > https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev > -- # include /* Kevin Brott */ From hyc at symas.com Thu Aug 19 18:55:53 2010 From: hyc at symas.com (Howard Chu) Date: Thu, 19 Aug 2010 01:55:53 -0700 Subject: Linemode again Message-ID: <4C6CF199.2020006@symas.com> My Linux kernel patches for linemode support have been pulled into the 2.6.36 release stream, so I figure it's time to finish up the work on openssh, bash, tcsh, readline, libedit, and anything else that comes along. As I last wrote here http://wiki.github.com/hyc/OpenSSH-LINEMODE/ I've got a few open issues remaining... First, I re-organized muxed session handling such that all terminal input is handled by each ssh process, instead of being handled by the single connection manager process. This was the cleanest way to divide the labor since the various readline/edit libraries all assume global state and don't lend themselves to having their input multiplexed. I still left terminal output to be written directly to each pty by the manager process. I figure this is still better from a performance perspective; terminal input will generally be very low bandwidth but terminal output may be higher volume and always relaying it back to the mux client first might become a bottleneck. But... this approach is making it harder to handle command-line completion. The idea is that the ssh client will know it should perform completion if the client and server both support linemode, linemode is active, and the remote tty has a VEOL character set to TAB. In that case, when the user types a completion character, the current line plus the tab will be sent to the remote, and the remote editor library will send back the list of possible completions. Then the local client's line editor library will take care of displaying these completions in whatever fashion it normally does. The problem is, that then means for muxed clients I need the session output to be parsed by the mux client, instead of being dumped directly to its pty. Alternatively, I could introduce new channel commands for completion-request and completion-reply, so that these events can be treated specially regardless of the mux architecture. Any suggestions? And has anyone reviewed the code I've committed to this git repo so far, and got any comments on that? -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/ From dtucker at zip.com.au Fri Aug 20 19:40:23 2010 From: dtucker at zip.com.au (Darren Tucker) Date: Fri, 20 Aug 2010 19:40:23 +1000 Subject: Slackware-12 still fails three tests In-Reply-To: References: <20100817163754.GJ23900@linux55.nas.nasa.gov> Message-ID: <4C6E4D87.4000202@zip.com.au> On 18/08/10 3:06 AM, Andy Tsouladze wrote: [...] > I use tcsh, so .bashrc does not exist. I have removed a few stty > settings from my .cshrc, and - you were correct - all tests passed. So > that's a good thing. As a side note, maybe tests should be made more > independent of a user environment. It can't be independent of the user's environment because sshd uses the user's shell (as retrieved by getpwnam) to execute commands. What we maybe could do is a simple test to see if the shell is in fact clean, something like: if [[ `$SHELL -c true 2>&1` != "" ]]; then echo fix yer shell exit 1 fi The trick with that is finding out the user's shell in a portable fashion. Maybe even get configure to run a little program that just does getpwuid(getuid()). -- Darren Tucker (dtucker at zip.com.au) GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4 37C9 C982 80C7 8FF4 FA69 Good judgement comes with experience. Unfortunately, the experience usually comes from bad judgement. From aleksey.valov at gmail.com Fri Aug 20 20:10:31 2010 From: aleksey.valov at gmail.com (Aleksey Valov) Date: Fri, 20 Aug 2010 13:10:31 +0300 Subject: SSH Sequence diagrams Message-ID: Hello, Dear SSH developers. I'm currently studying Business Information Technologies at the University of Applied Sciences in Oulu, Finland. I'm about to start my own online computer security related magazine. I would like to make an article about the helpful ssh protocol for security professionals. I have made sequence diagrams on how the SSH 2.0 protocol works, however i'm not sure weather they are 100% correct, because i gathered all the material from RFCs and composed them on my own. If possible can anyone from ssh developers prove the correctness that i would put it in the 1st issue of the magazine. If yes, please tell me where should i send the diagrams. Thank you for your hard and determined work! Regards, Aleksey Valov P.S. The link to the diagrams is http://linuxnow.ru/view.php?id=84 From mh+openssh-unix-dev at zugschlus.de Fri Aug 20 20:26:12 2010 From: mh+openssh-unix-dev at zugschlus.de (Marc Haber) Date: Fri, 20 Aug 2010 12:26:12 +0200 Subject: [Feature Request] delete defined line in known_hosts file Message-ID: <20100820102612.GA4285@torres.zugschlus.de> Hi, for a test lab, I'm trying to write a small shell script that will eradicate all information regarding a special host from the known_hosts file. Unfortunately, it is quite non-trivial to find out what ssh doesn't like with a host. ssh says which line in known_hosts has the offending key, but ssh-keygen -R doesn't take a line number. Am I using an undocumented interface when I simply use sed to delete the appopriate line? If so, it would be good if ssh-keygen -R would also take a line number to delete from the known_hosts file. Greetings Marc -- ----------------------------------------------------------------------------- Marc Haber | "I don't trust Computers. They | Mailadresse im Header Mannheim, Germany | lose things." Winona Ryder | Fon: *49 621 72739834 Nordisch by Nature | How to make an American Quilt | Fax: *49 3221 2323190 From aris.adamantiadis at belnet.be Fri Aug 20 21:40:11 2010 From: aris.adamantiadis at belnet.be (Aris Adamantiadis) Date: Fri, 20 Aug 2010 13:40:11 +0200 Subject: SSH Sequence diagrams In-Reply-To: References: Message-ID: <4C6E699B.1090400@belnet.be> Hi Aleksey, I'll be pleased to read them in details. My first comment would be that you shouldn't mix TCP low-level stuff with SSH_TRANS and others. We know that SSH2 runs on TCP, removing that layer would simplify your diagrams. I'll give you more information on this later. Kr, Aris Le 20/08/10 12:10, Aleksey Valov a ?crit : > Hello, Dear SSH developers. I'm currently studying Business Information > Technologies at the University of Applied Sciences in Oulu, Finland. I'm > about to start my own online computer security related magazine. I would > like to make an article about the helpful ssh protocol for security > professionals. I have made sequence diagrams on how the SSH 2.0 protocol > works, however i'm not sure weather they are 100% correct, because i > gathered all the material from RFCs and composed them on my own. If possible > can anyone from ssh developers prove the correctness that i would put it in > the 1st issue of the magazine. If yes, please tell me where should i send > the diagrams. Thank you for your hard and determined work! > Regards, > Aleksey Valov > P.S. The link to the diagrams is http://linuxnow.ru/view.php?id=84 > _______________________________________________ > openssh-unix-dev mailing list > openssh-unix-dev at mindrot.org > https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev > -- Aris Adamantiadis BELNET, Customer Relations Technical Advisor t: +32 2 790 33 33 Dept: customer at belnet.be Contact: http://www.belnet.be/fr/content/contact -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/pkcs7-signature Size: 5610 bytes Desc: S/MIME Cryptographic Signature URL: From cristian.ionescu-idbohrn at axis.com Fri Aug 20 21:04:27 2010 From: cristian.ionescu-idbohrn at axis.com (Cristian Ionescu-Idbohrn) Date: Fri, 20 Aug 2010 13:04:27 +0200 (CEST) Subject: Slackware-12 still fails three tests In-Reply-To: <4C6E4D87.4000202@zip.com.au> References: <20100817163754.GJ23900@linux55.nas.nasa.gov> <4C6E4D87.4000202@zip.com.au> Message-ID: <1008201255240.5913@somehost> On Fri, 20 Aug 2010, Darren Tucker wrote: > It can't be independent of the user's environment because sshd uses > the user's shell (as retrieved by getpwnam) to execute commands. > What we maybe could do is a simple test to see if the shell is in > fact clean, something like: > > if [[ `$SHELL -c true 2>&1` != "" ]]; then > echo fix yer shell > exit 1 > fi > > The trick with that is finding out the user's shell in a portable fashion. > Maybe even get configure to run a little program that just does > getpwuid(getuid()). Or maybe even: if [ "$($SHELL -c : 2>&1)" ]; then echo fix yer shell exit 1 fi Not all shells set a SHELL env variable, and in some more complex circumstances SHELL may not even reflect reality. Cheers, -- Cristian From wmertens at cisco.com Sat Aug 21 00:09:31 2010 From: wmertens at cisco.com (Wout Mertens) Date: Fri, 20 Aug 2010 16:09:31 +0200 Subject: Disabling remote commands, provide shell only Message-ID: Hi all, If you specify this perl script as a ForceCommand, users will not be able to run commands (or scp) remotely, only login. Probably no-one will have a use for this but I thought I'd share because it shows how to run a shell as a login shell from a ForceCommand. Wout. #!/usr/bin/perl use strict; # Give the user a shell if that was their intention if (exists $ENV{SSH_TTY} && not exists $ENV{SSH_ORIGINAL_COMMAND}) { # Find out what their shell is my @pw = getpwuid($<); my $shell = $pw[8] || '/bin/sh'; # Run it as a login shell exec { $shell } '-sh' ; } else { print STDERR "Remote commands disabled, please login instead.\n"; } From djm at mindrot.org Sat Aug 21 00:48:25 2010 From: djm at mindrot.org (Damien Miller) Date: Sat, 21 Aug 2010 00:48:25 +1000 (EST) Subject: [Feature Request] delete defined line in known_hosts file In-Reply-To: <20100820102612.GA4285@torres.zugschlus.de> References: <20100820102612.GA4285@torres.zugschlus.de> Message-ID: On Fri, 20 Aug 2010, Marc Haber wrote: > Hi, > > for a test lab, I'm trying to write a small shell script that will > eradicate all information regarding a special host from the > known_hosts file. Unfortunately, it is quite non-trivial to find out > what ssh doesn't like with a host. > > ssh says which line in known_hosts has the offending key, but > ssh-keygen -R doesn't take a line number. Am I using an undocumented > interface when I simply use sed to delete the appopriate line? not at all, the known_hosts is defined to be a file containing one key per line. > If so, it would be good if ssh-keygen -R would also take a line number > to delete from the known_hosts file. There is no need, other tools exist that do this job file. -d From peter at stuge.se Sat Aug 21 04:09:06 2010 From: peter at stuge.se (Peter Stuge) Date: Fri, 20 Aug 2010 20:09:06 +0200 Subject: SSH Sequence diagrams In-Reply-To: References: Message-ID: <20100820180906.3779.qmail@stuge.se> Aleksey Valov wrote: > The link to the diagrams is http://linuxnow.ru/view.php?id=84 I believe the shell or command is always executed by the server when a channel is opened, not the first time some data is sent through. //Peter From wahjava.ml at gmail.com Sat Aug 21 13:01:38 2010 From: wahjava.ml at gmail.com (Ashish SHUKLA) Date: Sat, 21 Aug 2010 08:31:38 +0530 Subject: [Feature Request] Allow options in Host block to override global options in ssh Message-ID: <86fwy8bre5.fsf@chateau.d.if> Hi everyone, For ssh(1) to override global options with the options in "Host" block, the attached diff (w.r.t. the openssh code in FreeBSD 8.1-R) contains the code to do so while parsing ssh configuration file. This is useful for case like following where {d,proj,p,n}cvs.FreeBSD.org is an alias to ncvs.FreeBSD.org hostname, thus connecting to {d,proj,p,n}cvs.FreeBSD.org should utilize the existing connection. #v+ ControlMaster auto ControlPath /tmp/%r@%h:%p Host dcvs Hostname dcvs.FreeBSD.org ControlPath /home/abbe/.ssh/cvs.cpath Host projcvs Hostname projcvs.FreeBSD.org ControlPath /home/abbe/.ssh/cvs.cpath Host pcvs Hostname pcvs.FreeBSD.org ControlPath /home/abbe/.ssh/cvs.cpath Host ncvs Hostname ncvs.FreeBSD.org ControlPath /home/abbe/.ssh/cvs.cpath #v- Thanks -- Ashish SHUKLA | GPG: F682 CDCC 39DC 0FEA E116 20B6 C746 CFA9 E74F A4B0 freebsd.org!ashish | http://people.freebsd.org/~ashish/ ?Well, I guess cyborgs like myself have a tendency to be paranoid about our origins.? (Motoko Kusanagi in movie "Ghost in the Shell") -------------- next part -------------- An embedded and charset-unspecified text was scrubbed... Name: readconf.c.diff URL: From djm at mindrot.org Sat Aug 21 16:42:52 2010 From: djm at mindrot.org (Damien Miller) Date: Sat, 21 Aug 2010 16:42:52 +1000 (EST) Subject: [Feature Request] Allow options in Host block to override global options in ssh In-Reply-To: <86fwy8bre5.fsf@chateau.d.if> References: <86fwy8bre5.fsf@chateau.d.if> Message-ID: On Sat, 21 Aug 2010, Ashish SHUKLA wrote: > Hi everyone, > > For ssh(1) to override global options with the options in "Host" block, the > attached diff (w.r.t. the openssh code in FreeBSD 8.1-R) contains the code to > do so while parsing ssh configuration file. This isn't necessary, just put the global options in a "Host *" section at the end of the file. From wahjava.ml at gmail.com Sat Aug 21 17:41:02 2010 From: wahjava.ml at gmail.com (Ashish SHUKLA) Date: Sat, 21 Aug 2010 13:11:02 +0530 Subject: [Feature Request] Allow options in Host block to override global options in ssh In-Reply-To: (Damien Miller's message of "Sat, 21 Aug 2010 16:42:52 +1000 (EST)") References: <86fwy8bre5.fsf@chateau.d.if> Message-ID: <8662z45s6p.fsf@chateau.d.if> Damien Miller writes: > On Sat, 21 Aug 2010, Ashish SHUKLA wrote: >> Hi everyone, >> >> For ssh(1) to override global options with the options in "Host" block, the >> attached diff (w.r.t. the openssh code in FreeBSD 8.1-R) contains the code to >> do so while parsing ssh configuration file. > This isn't necessary, just put the global options in a "Host *" section > at the end of the file. That works, thanks. -- Ashish SHUKLA ?Don't dream it? be it!? (The Rocky Horror Picture Show) From danm at prime.gushi.org Sat Aug 21 18:32:43 2010 From: danm at prime.gushi.org (Dan Mahoney, System Admin) Date: Sat, 21 Aug 2010 04:32:43 -0400 (EDT) Subject: What's the point of UseDNS? Message-ID: According to the manpage: UseDNS Specifies whether sshd should look up the remote host name and check that the resolved host name for the remote IP address maps back to the very same IP address. The default is ``yes''. Thing is, while sshd *checks*, this doesn't actually control whether or not the client is allowed to connect, it seems at most to be an option that causes additional logging. Is there some option that actually lets me control connection based on this? Perhaps display a message to the connecting host as to the problem? -Dan -- --------Dan Mahoney-------- Techie, Sysadmin, WebGeek Gushi on efnet/undernet IRC ICQ: 13735144 AIM: LarpGM Site: http://www.gushi.org --------------------------- From peter at stuge.se Sun Aug 22 00:13:11 2010 From: peter at stuge.se (Peter Stuge) Date: Sat, 21 Aug 2010 16:13:11 +0200 Subject: Slackware-12 still fails three tests In-Reply-To: <1008201255240.5913@somehost> References: <20100817163754.GJ23900@linux55.nas.nasa.gov> <4C6E4D87.4000202@zip.com.au> <1008201255240.5913@somehost> Message-ID: <20100821141311.7113.qmail@stuge.se> Cristian Ionescu-Idbohrn wrote: > > if [[ `$SHELL -c true 2>&1` != "" ]]; then > > Or maybe even: > > if [ "$($SHELL -c : 2>&1)" ]; then I believe backtick is more compatible than $() even though I do prefer the latter. I'm spoilt with bash everywhere though. //Peter From ailiop at lsu.edu Sun Aug 22 00:40:14 2010 From: ailiop at lsu.edu (Anthony Iliopoulos) Date: Sat, 21 Aug 2010 09:40:14 -0500 Subject: What's the point of UseDNS? In-Reply-To: References: Message-ID: <20100821144014.GM22159@lsu.edu> On Sat, Aug 21, 2010 at 04:32:43AM -0400, Dan Mahoney, System Admin wrote: > According to the manpage: > > UseDNS Specifies whether sshd should look up the remote host name > and check that the resolved host name for the remote IP address maps > back to the very same IP address. The default is ``yes''. > > Thing is, while sshd *checks*, this doesn't actually control whether > or not the client is allowed to connect, it seems at most to be an > option that causes additional logging. It is leveraged by hostbased-authentication, and rhosts-based authentication methods. See auth-rhosts.c:auth_rhosts2_raw() and auth2-hostbased.c:hostbased_key_allowed. > Is there some option that actually lets me control connection based > on this? Perhaps display a message to the connecting host as to the > problem? No, not really, and there is no need not rely on dns-based security checks, unless you are on an environment with the requirement to use any of the aforementioned authentication methods. You might be thinking DNSSEC assurance here, but still that would be superfluous on other kinds of authentication methods except rhosts-based ones. For all other cases, I believe it can be safely turned off, logging should be based on IP and and not DNS names, that can be later post-processed if name resolution is required. Regards, Anthony From mh+openssh-unix-dev at zugschlus.de Sun Aug 22 19:58:00 2010 From: mh+openssh-unix-dev at zugschlus.de (Marc Haber) Date: Sun, 22 Aug 2010 11:58:00 +0200 Subject: [Feature Request] delete defined line in known_hosts file In-Reply-To: References: <20100820102612.GA4285@torres.zugschlus.de> Message-ID: <20100822095800.GK25973@torres.zugschlus.de> Hi, On Sat, Aug 21, 2010 at 12:48:25AM +1000, Damien Miller wrote: > On Fri, 20 Aug 2010, Marc Haber wrote: > > for a test lab, I'm trying to write a small shell script that will > > eradicate all information regarding a special host from the > > known_hosts file. Unfortunately, it is quite non-trivial to find out > > what ssh doesn't like with a host. > > > > ssh says which line in known_hosts has the offending key, but > > ssh-keygen -R doesn't take a line number. Am I using an undocumented > > interface when I simply use sed to delete the appopriate line? > > not at all, the known_hosts is defined to be a file containing one > key per line. Thanks for that clarification, I'll use sed -i "${LINE}d" $FILE Greetings Marc -- ----------------------------------------------------------------------------- Marc Haber | "I don't trust Computers. They | Mailadresse im Header Mannheim, Germany | lose things." Winona Ryder | Fon: *49 621 72739834 Nordisch by Nature | How to make an American Quilt | Fax: *49 3221 2323190 From Jefferson.Ogata at noaa.gov Mon Aug 23 04:13:20 2010 From: Jefferson.Ogata at noaa.gov (Jefferson Ogata) Date: Sun, 22 Aug 2010 18:13:20 +0000 Subject: What's the point of UseDNS? In-Reply-To: References: Message-ID: <4C7168C0.80204@noaa.gov> On 2010-08-21 08:32, Dan Mahoney, System Admin wrote: > Is there some option that actually lets me control connection based on > this? Perhaps display a message to the connecting host as to the problem? You can use PARANOID in your /etc/hosts.allow to do both of these. -- Jefferson Ogata National Oceanographic Data Center You can't step into the same river twice. -- Herakleitos From djm at cvs.openbsd.org Mon Aug 23 21:32:25 2010 From: djm at cvs.openbsd.org (Damien Miller) Date: Mon, 23 Aug 2010 05:32:25 -0600 (MDT) Subject: Announce: OpenSSH 5.6 released Message-ID: <201008231132.o7NBWPLa009096@cvs.openbsd.org> OpenSSH 5.6 has just been released. It will be available from the mirrors listed at http://www.openssh.com/ shortly. OpenSSH is a 100% complete SSH protocol version 1.3, 1.5 and 2.0 implementation and includes sftp client and server support. Once again, we would like to thank the OpenSSH community for their continued support of the project, especially those who contributed code or patches, reported bugs, tested snapshots or donated to the project. More information on donations may be found at: http://www.openssh.com/donations.html Changes since OpenSSH 5.5 ========================= Features: * Added a ControlPersist option to ssh_config(5) that automatically starts a background ssh(1) multiplex master when connecting. This connection can stay alive indefinitely, or can be set to automatically close after a user-specified duration of inactivity. * Hostbased authentication may now use certificate host keys. CA keys must be specified in a known_hosts file using the @cert-authority marker as described in sshd(8). * ssh-keygen(1) now supports signing certificate using a CA key that has been stored in a PKCS#11 token. * ssh(1) will now log the hostname and address that we connected to at LogLevel=verbose after authentication is successful to mitigate "phishing" attacks by servers with trusted keys that accept authentication silently and automatically before presenting fake password/passphrase prompts. Note that, for such an attack to be successful, the user must have disabled StrictHostKeyChecking (enabled by default) or an attacker must have access to a trusted host key for the destination server. * Expand %h to the hostname in ssh_config Hostname options. While this sounds useless, it is actually handy for working with unqualified hostnames: Host *.* Hostname %h Host * Hostname %h.example.org * Allow ssh-keygen(1) to import (-i) and export (-e) of PEM and PKCS#8 keys in addition to RFC4716 (SSH.COM) encodings via a new -m option (bz#1749) * sshd(8) will now queue debug messages for bad ownership or permissions on the user's keyfiles encountered during authentication and will send them after authentication has successfully completed. These messages may be viewed in ssh(1) at LogLevel=debug or higher. * ssh(1) connection multiplexing now supports remote forwarding with dynamic port allocation and can report the allocated port back to the user: LPORT=`ssh -S muxsocket -R0:localhost:25 -O forward somehost` * sshd(8) now supports indirection in matching of principal names listed in certificates. By default, if a certificate has an embedded principals list then the username on the server must match one of the names in the list for it to be accepted for authentication. sshd(8) now has a new AuthorizedPrincipalsFile option to specify a file containing a list of names that may be accepted in place of the username when authorizing a certificate trusted via the sshd_config(5) TrustedCAKeys option. Similarly, authentication using a CA trusted in ~/.ssh/authorized_keys now accepts a principals="name1[,name2,...]" to specify a list of permitted names. If either option is absent, the current behaviour of requiring the username to appear in principals continues to apply. These options are useful for role accounts, disjoint account namespaces and "user at realm"-style naming policies in certificates. * Additional sshd_config(5) options are now valid inside Match blocks: AuthorizedKeysFile AuthorizedPrincipalsFile HostbasedUsesNameFromPacketOnly PermitTunnel * Revised the format of certificate keys. The new format, identified as ssh-{dss,rsa}-cert-v01 at openssh.com includes the following changes: - Adding a serial number field. This may be specified by the CA at the time of certificate signing. - Moving the nonce field to the beginning of the certificate where it can better protect against chosen-prefix attacks on the signature hash (currently infeasible against the SHA1 hash used) - Renaming the "constraints" field to "critical options" - Addng a new non-critical "extensions" field. The "permit-*" options are now extensions, rather than critical options to permit non-OpenSSH implementation of this key format to degrade gracefully when encountering keys with options they do not recognize. The older format is still supported for authentication and may still be used when signing certificates (use "ssh-keygen -t v00 ..."). The v00 format, introduced in OpenSSH 5.4, will be supported for at least one year from this release, after which it will be deprecated and removed. BugFixes: * The PKCS#11 code now retries a lookup for a private key if there is no matching key with CKA_SIGN attribute enabled; this fixes fixes MuscleCard support (bz#1736) * Unbreak strdelim() skipping past quoted strings (bz#1757). For example, the following directive was not parsed correctly: AllowUsers "blah blah" blah * sftp(1): fix swapped args in upload_dir_internal(), breaking recursive upload depth checks and causing verbose printing of transfers to always be turned on (bz#1797) * Fix a longstanding problem where if you suspend scp(1) at the password/passphrase prompt the terminal mode is not restored. * Fix a PKCS#11 crash on some smartcards by validating the length returned for C_GetAttributValue (bz#1773) * sftp(1): fix ls in working directories that contain globbing characters in their pathnames (bz#1655) * Print warning for missing home directory when ChrootDirectory=none (bz#1564) * sftp(1): fix a memory leak in do_realpath() error path (bz#1771) * ssk-keygen(1): Standardise error messages when attempting to open private key files to include "progname: filename: error reason" (bz#1783) * Replace verbose and overflow-prone Linebuf code with read_keyfile_line() (bz#1565) * Include the user name on "subsystem request for ..." log messages * ssh(1) and sshd(8): remove hardcoded limit of 100 permitopen clauses and port forwards per direction (bz#1327) * sshd(8): ignore stderr output from subsystems to avoid hangs if a subsystem or shell initialisation writes to stderr (bz#1750) * Skip the initial check for access with an empty password when PermitEmptyPasswords=no (bz#1638) * sshd(8): fix logspam when key options (from="..." especially) deny non-matching keys (bz#1765) * ssh-keygen(1): display a more helpful error message when $HOME is inaccessible while trying to create .ssh directory (bz#1740) * ssh(1): fix hang when terminating a mux slave using ~. (bz#1758) * ssh-keygen(1): refuse to generate keys longer than OPENSSL_[RD]SA_MAX_MODULUS_BITS, since we would refuse to use them anyway (bz#1516) * Suppress spurious tty warning when using -O and stdin is not a tty (bz#1746) * Kill channel when pty allocation requests fail. Fixed stuck client if the server refuses pty allocation (bz#1698) Portable OpenSSH Bugfixes: * sshd(8): increase the maximum username length for login recording to 512 characters (bz#1579) * Initialize the values to be returned from PAM to sane values in case the PAM method doesn't write to them. (bz#1795) * Let configure find OpenSSL libraries in a lib64 subdirectory. (bz#1756) Checksums: ========== - SHA1 (openssh-5.6.tar.gz) = fa5ac394b874d6709031306b6ac5c48399697f7f - SHA1 (openssh-5.6p1.tar.gz) = 347dd39c91c3529f41dae63714d452fb95efea1e Reporting Bugs: =============== - Please read http://www.openssh.com/report.html Security bugs should be reported directly to openssh at openssh.com OpenSSH is brought to you by Markus Friedl, Niels Provos, Theo de Raadt, Kevin Steves, Damien Miller, Darren Tucker, Jason McIntyre, Tim Rice and Ben Lindstrom. From 1.41421 at gmail.com Wed Aug 25 09:50:01 2010 From: 1.41421 at gmail.com (JCA) Date: Tue, 24 Aug 2010 17:50:01 -0600 Subject: The length of an RSA signature sent during the handshake Message-ID: I have noticed that OpenSSH clients (at least version 5.1p1) occasionally send an RSA signature during the handshake phase such that if the RSA key pair used to generate it happens to be associated to an N-byte long modulus, the signature is N - 1 bytes long. My question is, Is this behavior correct? I mean, an RSA signature is an unstructured byte string, and therefore any leading zeros should be considered part of the signature, and a signature created with an RSA key pair such that its associated modulus is N bytes long ought to be N bytes long as well. From bert.wesarg at googlemail.com Wed Aug 25 17:50:35 2010 From: bert.wesarg at googlemail.com (Bert Wesarg) Date: Wed, 25 Aug 2010 09:50:35 +0200 Subject: Announce: OpenSSH 5.6 released In-Reply-To: <201008231132.o7NBWPLa009096@cvs.openbsd.org> References: <201008231132.o7NBWPLa009096@cvs.openbsd.org> Message-ID: Hi, thank you very much for this release. On Mon, Aug 23, 2010 at 13:32, Damien Miller wrote: > OpenSSH 5.6 has just been released. It will be available from the > mirrors listed at http://www.openssh.com/ shortly. > > OpenSSH is a 100% complete SSH protocol version 1.3, 1.5 and 2.0 > implementation and includes sftp client and server support. > > Once again, we would like to thank the OpenSSH community for their > continued support of the project, especially those who contributed > code or patches, reported bugs, tested snapshots or donated to the > project. More information on donations may be found at: > http://www.openssh.com/donations.html > > Changes since OpenSSH 5.5 > ========================= > > Features: > > ?* Added a ControlPersist option to ssh_config(5) that automatically > ? starts a background ssh(1) multiplex master when connecting. This > ? connection can stay alive indefinitely, or can be set to > ? automatically close after a user-specified duration of inactivity. Particular for this new feature. But I miss an important feature. I need a LocalCommand equivalent, which is only executed once per session (i.e. by the multiplex master). I use this to mount file systems from the remote per sshfs. My ControlCommand patch [1] does have allow this. I could rework this path, so that it only has this feature. Opinions? Bert From bert.wesarg at googlemail.com Wed Aug 25 17:51:19 2010 From: bert.wesarg at googlemail.com (Bert Wesarg) Date: Wed, 25 Aug 2010 09:51:19 +0200 Subject: Announce: OpenSSH 5.6 released In-Reply-To: References: <201008231132.o7NBWPLa009096@cvs.openbsd.org> Message-ID: On Wed, Aug 25, 2010 at 09:50, Bert Wesarg wrote: > Hi, > > thank you very much for this release. > > On Mon, Aug 23, 2010 at 13:32, Damien Miller wrote: >> OpenSSH 5.6 has just been released. It will be available from the >> mirrors listed at http://www.openssh.com/ shortly. >> >> OpenSSH is a 100% complete SSH protocol version 1.3, 1.5 and 2.0 >> implementation and includes sftp client and server support. >> >> Once again, we would like to thank the OpenSSH community for their >> continued support of the project, especially those who contributed >> code or patches, reported bugs, tested snapshots or donated to the >> project. More information on donations may be found at: >> http://www.openssh.com/donations.html >> >> Changes since OpenSSH 5.5 >> ========================= >> >> Features: >> >> ?* Added a ControlPersist option to ssh_config(5) that automatically >> ? starts a background ssh(1) multiplex master when connecting. This >> ? connection can stay alive indefinitely, or can be set to >> ? automatically close after a user-specified duration of inactivity. > > Particular for this new feature. But I miss an important feature. I > need a LocalCommand equivalent, which is only executed once per > session (i.e. by the multiplex master). I use this to mount file > systems from the remote per sshfs. My ControlCommand patch [1] does > have allow this. I could rework this path, so that it only has this > feature. > > Opinions? > > Bert > Missing link: http://article.gmane.org/gmane.network.openssh.devel/16018 From djm at mindrot.org Wed Aug 25 18:17:51 2010 From: djm at mindrot.org (Damien Miller) Date: Wed, 25 Aug 2010 18:17:51 +1000 (EST) Subject: The length of an RSA signature sent during the handshake In-Reply-To: References: Message-ID: On Tue, 24 Aug 2010, JCA wrote: > I have noticed that OpenSSH clients (at least version 5.1p1) > occasionally send an RSA signature during the handshake phase such > that if the RSA key pair used to generate it happens to be associated > to an N-byte long modulus, the signature is N - 1 bytes long. My > question is, Is this behavior correct? I mean, an RSA signature is an > unstructured byte string, and therefore any leading zeros should be > considered part of the signature, and a signature created with an RSA > key pair such that its associated modulus is N bytes long ought to be > N bytes long as well. How are you measuring length? The size of the signature blob is always the same length as rsa->n (search for "memmove" in ssh-rsa.c), but if you are decoding the blob to a bignum then its length will occasionally be shorter. If you consider RSA signing to function as a random mapping into integers of log2(n)/8 bytes, then the first byte will be zero with probability roughly equal to 1/256. -d From djm at mindrot.org Wed Aug 25 18:19:06 2010 From: djm at mindrot.org (Damien Miller) Date: Wed, 25 Aug 2010 18:19:06 +1000 (EST) Subject: Announce: OpenSSH 5.6 released In-Reply-To: References: <201008231132.o7NBWPLa009096@cvs.openbsd.org> Message-ID: On Wed, 25 Aug 2010, Bert Wesarg wrote: > Particular for this new feature. But I miss an important feature. I > need a LocalCommand equivalent, which is only executed once per > session (i.e. by the multiplex master). I use this to mount file > systems from the remote per sshfs. My ControlCommand patch [1] does > have allow this. I could rework this path, so that it only has this > feature. > > Opinions? If you want to execute a command after the session is brought up then you can use the existing LocalCommand. If you want it before the connection is made then you can wrap ssh(1) in a shell script or function. -d From bert.wesarg at googlemail.com Wed Aug 25 20:29:38 2010 From: bert.wesarg at googlemail.com (Bert Wesarg) Date: Wed, 25 Aug 2010 12:29:38 +0200 Subject: Announce: OpenSSH 5.6 released In-Reply-To: References: <201008231132.o7NBWPLa009096@cvs.openbsd.org> Message-ID: On Wed, Aug 25, 2010 at 10:19, Damien Miller wrote: > On Wed, 25 Aug 2010, Bert Wesarg wrote: > >> Particular for this new feature. But I miss an important feature. I >> need a LocalCommand equivalent, which is only executed once per >> session (i.e. by the multiplex master). I use this to mount file >> systems from the remote per sshfs. My ControlCommand patch [1] does >> have allow this. I could rework this path, so that it only has this >> feature. >> >> Opinions? > > If you want to execute a command after the session is brought up then > you can use the existing LocalCommand. If you want it before the > connection is made then you can wrap ssh(1) in a shell script or function. Thanks for the clarification. I have actually never tried it, because my understanding from reading the documentation of LocalCommand suggests that the command will be executed for each 'ssh' invocation. Be it a mux master or a mux client. I can try to bring up a patch which clarifies this in the documentation. Bert > > -d > From apb at cequrux.com Thu Aug 26 01:22:11 2010 From: apb at cequrux.com (Alan Barrett) Date: Wed, 25 Aug 2010 17:22:11 +0200 Subject: Announce: OpenSSH 5.6 released In-Reply-To: References: <201008231132.o7NBWPLa009096@cvs.openbsd.org> Message-ID: <20100825152211.GA2734@apb-laptoy.apb.alt.za> On Wed, 25 Aug 2010, Bert Wesarg wrote: > Particular for this new feature. But I miss an important feature. I > need a LocalCommand equivalent, which is only executed once per > session (i.e. by the multiplex master). I use this to mount file > systems from the remote per sshfs. My ControlCommand patch [1] does > have allow this. I could rework this path, so that it only has this > feature. In the introduction to your patch, at , you say: " I don't want my interactive ssh shell session or git/svn sessions " to act as master processes, so that they may hang after I started a " second session. So I would need to start a master process with 'ssh " -nNfM' first and than my interactive session. And I would like to " automate this. Older versions of the ControlMaster patch (back when it was unofficial) did have that problem, but openssh-5.6 puts the master process into the background, so you should no longer hve any need to run "ssh -nNfM" first. --apb (Alan Barrett) From 1.41421 at gmail.com Wed Aug 25 23:29:16 2010 From: 1.41421 at gmail.com (1.41421 at gmail.com) Date: Wed, 25 Aug 2010 13:29:16 +0000 Subject: The length of an RSA signature sent during the handshake In-Reply-To: Message-ID: <005045015aec46ba1f048ea5de1b@google.com> On Aug 25, 2010 2:17am, Damien Miller wrote: > On Tue, 24 Aug 2010, JCA wrote: > > I have noticed that OpenSSH clients (at least version 5.1p1) > > occasionally send an RSA signature during the handshake phase such > > that if the RSA key pair used to generate it happens to be associated > > to an N-byte long modulus, the signature is N - 1 bytes long. My > > question is, Is this behavior correct? I mean, an RSA signature is an > > unstructured byte string, and therefore any leading zeros should be > > considered part of the signature, and a signature created with an RSA > > key pair such that its associated modulus is N bytes long ought to be > > N bytes long as well. > How are you measuring length? The size of the signature blob is always > the same length as rsa->n (search for "memmove" in ssh-rsa.c), but if > you are decoding the blob to a bignum then its length will occasionally > be shorter. Well, what I am observing is the following: During the authentication phase the client sends two SSH_MSG_AUTH_REQUEST messages. Occasionally the second one is such that the second one is such that the RSA modulus is 257 bytes long (correct, for it is encoded as an mpint) whereas the RSA signature blob is 255 bytes long. This is all information contained in the different fields of the SSH_MSG_AUTH_REQUEST message itself. Now the truth is that looking into the code that you mention it would seem to be impossible for the client to generate a 255 byte signature with such an RSA modulus. I'll try and see if I can get client-side traces that illustrate the issue. > If you consider RSA signing to function as a random mapping into > integers of log2(n)/8 bytes, then the first byte will be zero with > probability roughly equal to 1/256. > -d From dkg at fifthhorseman.net Thu Aug 26 02:46:49 2010 From: dkg at fifthhorseman.net (Daniel Kahn Gillmor) Date: Wed, 25 Aug 2010 12:46:49 -0400 Subject: run-once LocalCommand [was: Re: Announce: OpenSSH 5.6 released] In-Reply-To: References: <201008231132.o7NBWPLa009096@cvs.openbsd.org> Message-ID: <4C7548F9.1060309@fifthhorseman.net> On 08/25/2010 06:29 AM, Bert Wesarg wrote: > Thanks for the clarification. I have actually never tried it, because > my understanding from reading the documentation of LocalCommand > suggests that the command will be executed for each 'ssh' invocation. > Be it a mux master or a mux client. I can try to bring up a patch > which clarifies this in the documentation. could you just make your LocalCommand test to see if it needs to be run? e.g. if [ grep -qv "^${MOUNTPOINT}" /proc/mounts ] ; then mount "${MOUNTPOINT}" fi in that case, it could run at each invocation and just do nothing if it wasn't needed. --dkg -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 892 bytes Desc: OpenPGP digital signature URL: From bert.wesarg at googlemail.com Thu Aug 26 07:12:03 2010 From: bert.wesarg at googlemail.com (Bert Wesarg) Date: Wed, 25 Aug 2010 23:12:03 +0200 Subject: run-once LocalCommand [was: Re: Announce: OpenSSH 5.6 released] In-Reply-To: <4C7548F9.1060309@fifthhorseman.net> References: <201008231132.o7NBWPLa009096@cvs.openbsd.org> <4C7548F9.1060309@fifthhorseman.net> Message-ID: On Wed, Aug 25, 2010 at 18:46, Daniel Kahn Gillmor wrote: > On 08/25/2010 06:29 AM, Bert Wesarg wrote: >> Thanks for the clarification. I have actually never tried it, because >> my understanding from reading the documentation of LocalCommand >> suggests that the command will be executed for each 'ssh' invocation. >> Be it a mux master or a mux client. I can try to bring up a patch >> which clarifies this in the documentation. > > could you just make your LocalCommand test to see if it needs to be run? > > e.g. > > if [ grep -qv "^${MOUNTPOINT}" /proc/mounts ] ; then > ? ?mount "${MOUNTPOINT}" > fi > > in that case, it could run at each invocation and just do nothing if it > wasn't needed. But LocalCommand does run only once, so I don't need to this test. Yes, and I like it that way. Hope that this will not change. Bert > > ? ? ? ?--dkg > > From djm at mindrot.org Thu Aug 26 15:03:12 2010 From: djm at mindrot.org (Damien Miller) Date: Thu, 26 Aug 2010 15:03:12 +1000 (EST) Subject: Announce: OpenSSH 5.6 released In-Reply-To: <20100825152211.GA2734@apb-laptoy.apb.alt.za> References: <201008231132.o7NBWPLa009096@cvs.openbsd.org> <20100825152211.GA2734@apb-laptoy.apb.alt.za> Message-ID: On Wed, 25 Aug 2010, Alan Barrett wrote: > On Wed, 25 Aug 2010, Bert Wesarg wrote: > > Particular for this new feature. But I miss an important feature. I > > need a LocalCommand equivalent, which is only executed once per > > session (i.e. by the multiplex master). I use this to mount file > > systems from the remote per sshfs. My ControlCommand patch [1] does > > have allow this. I could rework this path, so that it only has this > > feature. > > In the introduction to your patch, at > , you say: > > " I don't want my interactive ssh shell session or git/svn sessions > " to act as master processes, so that they may hang after I started a > " second session. So I would need to start a master process with 'ssh > " -nNfM' first and than my interactive session. And I would like to > " automate this. > > Older versions of the ControlMaster patch (back when it was unofficial) > did have that problem, but openssh-5.6 puts the master process into the > background, so you should no longer hve any need to run "ssh -nNfM" > first. Yes, ssh in 5.6 also closes any lingering fds inherited from the parent process. This should let a mux master started by ControlPersist linger safely. -d From Phillip.Wu at lpma.nsw.gov.au Fri Aug 27 09:36:53 2010 From: Phillip.Wu at lpma.nsw.gov.au (Phillip Wu) Date: Fri, 27 Aug 2010 09:36:53 +1000 Subject: openssh - run as another user Message-ID: <137CA4FE5CCDB7449ED3CD4445077AC304FFF94EC6@SRV-QS-MAIL6.lands.nsw> For security, many systems are configured so you cannot log directly as root via the initial authentication in openssh. What is usually done is that you log onto as your normal login and once you get a interactive shell you su to root to run the command that requires root. Does openssh have a more elegant way of exec'ing a command as root so I can run the command non-interactively? I know: Normal userid Normal userid password Root's password *************************************************************** This message is intended for the addressee named and may contain confidential information. If you are not the intended recipient, please delete it and notify the sender. Views expressed in this message are those of the individual sender, and are not necessarily the views of the Land and Property Management Authority. This email message has been swept by MIMEsweeper for the presence of computer viruses. *************************************************************** Please consider the environment before printing this email. From imorgan at nas.nasa.gov Fri Aug 27 11:30:01 2010 From: imorgan at nas.nasa.gov (Iain Morgan) Date: Thu, 26 Aug 2010 18:30:01 -0700 Subject: openssh - run as another user In-Reply-To: <137CA4FE5CCDB7449ED3CD4445077AC304FFF94EC6@SRV-QS-MAIL6.lands.nsw> References: <137CA4FE5CCDB7449ED3CD4445077AC304FFF94EC6@SRV-QS-MAIL6.lands.nsw> Message-ID: <20100827013001.GP23900@linux55.nas.nasa.gov> On Thu, Aug 26, 2010 at 18:36:53 -0500, Phillip Wu wrote: > For security, many systems are configured so you cannot log directly as root via the initial authentication in openssh. > > What is usually done is that you log onto as your normal login and once you get a interactive shell you su to root to > run the command that requires root. > > Does openssh have a more elegant way of exec'ing a command as root so I can run the command > non-interactively? I know: > Normal userid > Normal userid password > Root's password > If your site's policy allows setting "PermitRootLogin forced-commands-only" (see sshd_config(5)), then you could use a command-restricted public-key to execute a command as root. However, if you need to execute arbitrary commands then your current approach is the only real option. But I would suggest using sudo rather than su. -- Iain Morgan From Coy.Hile at COYHILE.COM Fri Aug 27 12:39:05 2010 From: Coy.Hile at COYHILE.COM (Coy Hile) Date: Fri, 27 Aug 2010 02:39:05 +0000 Subject: openssh - run as another user In-Reply-To: <137CA4FE5CCDB7449ED3CD4445077AC304FFF94EC6@SRV-QS-MAIL6.lands.nsw> References: <137CA4FE5CCDB7449ED3CD4445077AC304FFF94EC6@SRV-QS-MAIL6.lands.nsw> Message-ID: <8BF1A686A4943A4BB60A42B82FFFD31C054F9F30@EXCHANGE01.VAS.COYHILE.COM> Use sudo a la ssh desthost sudo /some/command -----Original Message----- From: openssh-unix-dev-bounces+coy.hile=coyhile.com at mindrot.org [mailto:openssh-unix-dev-bounces+coy.hile=coyhile.com at mindrot.org] On Behalf Of Phillip Wu Sent: Thursday, August 26, 2010 7:37 PM To: openssh-unix-dev at mindrot.org Subject: openssh - run as another user For security, many systems are configured so you cannot log directly as root via the initial authentication in openssh. What is usually done is that you log onto as your normal login and once you get a interactive shell you su to root to run the command that requires root. Does openssh have a more elegant way of exec'ing a command as root so I can run the command non-interactively? I know: Normal userid Normal userid password Root's password *************************************************************** This message is intended for the addressee named and may contain confidential information. If you are not the intended recipient, please delete it and notify the sender. Views expressed in this message are those of the individual sender, and are not necessarily the views of the Land and Property Management Authority. This email message has been swept by MIMEsweeper for the presence of computer viruses. *************************************************************** Please consider the environment before printing this email. _______________________________________________ openssh-unix-dev mailing list openssh-unix-dev at mindrot.org https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev From danm at prime.gushi.org Fri Aug 27 12:17:40 2010 From: danm at prime.gushi.org (Dan Mahoney, System Admin) Date: Thu, 26 Aug 2010 22:17:40 -0400 (EDT) Subject: openssh - run as another user In-Reply-To: <137CA4FE5CCDB7449ED3CD4445077AC304FFF94EC6@SRV-QS-MAIL6.lands.nsw> References: <137CA4FE5CCDB7449ED3CD4445077AC304FFF94EC6@SRV-QS-MAIL6.lands.nsw> Message-ID: On Fri, 27 Aug 2010, Phillip Wu wrote: > For security, many systems are configured so you cannot log directly as root via the initial authentication in openssh. > > What is usually done is that you log onto as your normal login and once you get a interactive shell you su to root to > run the command that requires root. > > Does openssh have a more elegant way of exec'ing a command as root so I can run the command > non-interactively? I know: > Normal userid > Normal userid password > Root's password I'm not sure why you're sending this to the "dev" list, it's hardly a development matter. However, typically, if you're root on the system, and you need to run root commands remotely, you would change the default authorization. You can for example set "permitrootlogin yes" in your config file, but that's dangerous. What perhaps makes more sense is to set "permitrootlogin without-password" (and use pubkey auth) or even forced-commands-only. Try reading the man page for sshd_config, look specifically for the PermitRootLogin option. -Dan > *************************************************************** This > message is intended for the addressee named and may contain confidential > information. If you are not the intended recipient, please delete it and > notify the sender. Views expressed in this message are those of the > individual sender, and are not necessarily the views of the Land and > Property Management Authority. This email message has been swept by > MIMEsweeper for the presence of computer viruses. > *************************************************************** The addressee is a public mailing list. > Please consider the environment before printing this email. What is the increased carbon footprint of every message you/your company send including the above two pieces of advice? -- --------Dan Mahoney-------- Techie, Sysadmin, WebGeek Gushi on efnet/undernet IRC ICQ: 13735144 AIM: LarpGM Site: http://www.gushi.org --------------------------- From dgbaley27 at verizon.net Fri Aug 27 12:23:36 2010 From: dgbaley27 at verizon.net (Matthew Monaco) Date: Thu, 26 Aug 2010 22:23:36 -0400 Subject: openssh - run as another user In-Reply-To: <8BF1A686A4943A4BB60A42B82FFFD31C054F9F30@EXCHANGE01.VAS.COYHILE.COM> References: <137CA4FE5CCDB7449ED3CD4445077AC304FFF94EC6@SRV-QS-MAIL6.lands.nsw> <8BF1A686A4943A4BB60A42B82FFFD31C054F9F30@EXCHANGE01.VAS.COYHILE.COM> Message-ID: <4C7721A8.1090007@verizon.net> On 08/26/2010 10:39 PM, Coy Hile wrote: > Use sudo a la > > ssh desthost sudo /some/command > ssh desthost -t sudo /some/command > -----Original Message----- > From: openssh-unix-dev-bounces+coy.hile=coyhile.com at mindrot.org [mailto:openssh-unix-dev-bounces+coy.hile=coyhile.com at mindrot.org] On Behalf Of Phillip Wu > Sent: Thursday, August 26, 2010 7:37 PM > To: openssh-unix-dev at mindrot.org > Subject: openssh - run as another user > > For security, many systems are configured so you cannot log directly as root via the initial authentication in openssh. > > What is usually done is that you log onto as your normal login and once you get a interactive shell you su to root to > run the command that requires root. > > Does openssh have a more elegant way of exec'ing a command as root so I can run the command > non-interactively? I know: > Normal userid > Normal userid password > Root's password > > *************************************************************** > This message is intended for the addressee named and may contain confidential information. If you are not the intended recipient, please delete it and notify the sender. Views expressed in this message are those of the individual sender, and are not necessarily the views of the Land and Property Management Authority. This email message has been swept by MIMEsweeper for the presence of computer viruses. > *************************************************************** > Please consider the environment before printing this email. > _______________________________________________ > openssh-unix-dev mailing list > openssh-unix-dev at mindrot.org > https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev > _______________________________________________ > openssh-unix-dev mailing list > openssh-unix-dev at mindrot.org > https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev > From jeremy at nickurak.ca Sat Aug 28 00:13:43 2010 From: jeremy at nickurak.ca (Jeremy Nickurak) Date: Fri, 27 Aug 2010 08:13:43 -0600 Subject: openssh - run as another user In-Reply-To: <4C7721A8.1090007@verizon.net> References: <137CA4FE5CCDB7449ED3CD4445077AC304FFF94EC6@SRV-QS-MAIL6.lands.nsw> <8BF1A686A4943A4BB60A42B82FFFD31C054F9F30@EXCHANGE01.VAS.COYHILE.COM> <4C7721A8.1090007@verizon.net> Message-ID: Any thoughts on how to get away with doing this with scp, in particular? On Thu, Aug 26, 2010 at 20:23, Matthew Monaco wrote: > On 08/26/2010 10:39 PM, Coy Hile wrote: > >> Use sudo a la >> >> ssh desthost sudo /some/command >> >> > > ssh desthost -t sudo /some/command > > > > -----Original Message----- >> From: openssh-unix-dev-bounces+coy.hile=coyhile.com at mindrot.org [mailto: >> openssh-unix-dev-bounces+coy.hile = >> coyhile.com at mindrot.org] On Behalf Of Phillip Wu >> Sent: Thursday, August 26, 2010 7:37 PM >> To: openssh-unix-dev at mindrot.org >> Subject: openssh - run as another user >> >> For security, many systems are configured so you cannot log directly as >> root via the initial authentication in openssh. >> >> What is usually done is that you log onto as your normal login and once >> you get a interactive shell you su to root to >> run the command that requires root. >> >> Does openssh have a more elegant way of exec'ing a command as root so I >> can run the command >> non-interactively? I know: >> Normal userid >> Normal userid password >> Root's password >> >> *************************************************************** >> This message is intended for the addressee named and may contain >> confidential information. If you are not the intended recipient, please >> delete it and notify the sender. Views expressed in this message are those >> of the individual sender, and are not necessarily the views of the Land and >> Property Management Authority. This email message has been swept by >> MIMEsweeper for the presence of computer viruses. >> *************************************************************** >> Please consider the environment before printing this email. >> _______________________________________________ >> openssh-unix-dev mailing list >> openssh-unix-dev at mindrot.org >> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev >> _______________________________________________ >> openssh-unix-dev mailing list >> openssh-unix-dev at mindrot.org >> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev >> >> > _______________________________________________ > openssh-unix-dev mailing list > openssh-unix-dev at mindrot.org > https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev > -- Jeremy Nickurak -= Email/XMPP: -= jeremy at nickurak.ca =- From wmertens at cisco.com Sat Aug 28 00:36:34 2010 From: wmertens at cisco.com (Wout Mertens) Date: Fri, 27 Aug 2010 16:36:34 +0200 Subject: openssh - run as another user In-Reply-To: References: <137CA4FE5CCDB7449ED3CD4445077AC304FFF94EC6@SRV-QS-MAIL6.lands.nsw> <8BF1A686A4943A4BB60A42B82FFFD31C054F9F30@EXCHANGE01.VAS.COYHILE.COM> <4C7721A8.1090007@verizon.net> Message-ID: <00D5ACE4-C146-48DC-8F30-F151BF1307BF@cisco.com> If you use tar instead it's reasonably easy: ssh desthost -t sudo tar cf - srcfile | tar xvf - untested. Wout. On Aug 27, 2010, at 16:13 , Jeremy Nickurak wrote: > Any thoughts on how to get away with doing this with scp, in particular? > > On Thu, Aug 26, 2010 at 20:23, Matthew Monaco wrote: > >> On 08/26/2010 10:39 PM, Coy Hile wrote: >> >>> Use sudo a la >>> >>> ssh desthost sudo /some/command >>> >>> >> >> ssh desthost -t sudo /some/command >> >> >> >> -----Original Message----- >>> From: openssh-unix-dev-bounces+coy.hile=coyhile.com at mindrot.org [mailto: >>> openssh-unix-dev-bounces+coy.hile = >>> coyhile.com at mindrot.org] On Behalf Of Phillip Wu >>> Sent: Thursday, August 26, 2010 7:37 PM >>> To: openssh-unix-dev at mindrot.org >>> Subject: openssh - run as another user >>> >>> For security, many systems are configured so you cannot log directly as >>> root via the initial authentication in openssh. >>> >>> What is usually done is that you log onto as your normal login and once >>> you get a interactive shell you su to root to >>> run the command that requires root. >>> >>> Does openssh have a more elegant way of exec'ing a command as root so I >>> can run the command >>> non-interactively? I know: >>> Normal userid >>> Normal userid password >>> Root's password >>> >>> *************************************************************** >>> This message is intended for the addressee named and may contain >>> confidential information. If you are not the intended recipient, please >>> delete it and notify the sender. Views expressed in this message are those >>> of the individual sender, and are not necessarily the views of the Land and >>> Property Management Authority. This email message has been swept by >>> MIMEsweeper for the presence of computer viruses. >>> *************************************************************** >>> Please consider the environment before printing this email. >>> _______________________________________________ >>> openssh-unix-dev mailing list >>> openssh-unix-dev at mindrot.org >>> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev >>> _______________________________________________ >>> openssh-unix-dev mailing list >>> openssh-unix-dev at mindrot.org >>> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev >>> >>> >> _______________________________________________ >> openssh-unix-dev mailing list >> openssh-unix-dev at mindrot.org >> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev >> > > > > -- > Jeremy Nickurak -= Email/XMPP: -= jeremy at nickurak.ca =- > _______________________________________________ > openssh-unix-dev mailing list > openssh-unix-dev at mindrot.org > https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev From jmknoble at pobox.com Sat Aug 28 02:03:14 2010 From: jmknoble at pobox.com (Jim Knoble) Date: Fri, 27 Aug 2010 09:03:14 -0700 Subject: openssh - run as another user In-Reply-To: <00D5ACE4-C146-48DC-8F30-F151BF1307BF@cisco.com> References: <137CA4FE5CCDB7449ED3CD4445077AC304FFF94EC6@SRV-QS-MAIL6.lands.nsw> <8BF1A686A4943A4BB60A42B82FFFD31C054F9F30@EXCHANGE01.VAS.COYHILE.COM> <4C7721A8.1090007@verizon.net> <00D5ACE4-C146-48DC-8F30-F151BF1307BF@cisco.com> Message-ID: <4C77E1C2.10300@pobox.com> [Continuing top-posting started by others in the conversation]. Depending on what you need to do, named pipes (a.k.a. fifos) can come in handy. I've used them before when i need to do an exact directory tree transfer between systems where i only have sudo access, and the remote end ('ssh -t remotehost sudo tar -xvf -') doesn't work, because the tarball coming in on stdin keeps ssh from allocating a pty, which keeps sudo from being able to prompt for a password. Using a fifo looks something like this: Process #1 (read from named pipe on remote host): ssh -t remotehost.example.com ' cd /tmp && umask 077 && mkdir somedir && cd somedir && mkfifo mypipe && cd /path/to/targetdir && sudo tar -xvf /tmp/somedir/mypipe rm -rf /tmp/somedir ' Process #2 (tar up directory tree and send it over): cd /path/to/sourcedir && tar -cf - topoftree \ |ssh remotehost.example.com 'cat >/tmp/somedir/mypipe' You can script most of the bits of Process #1 to make it simpler and more reliable (e.g., using the 'trap' shell builtin to remove the pipe and directory when done) and slightly more secure (using 'mktemp -d' to create the temporary directory instead of using 'mkdir', which fails if /tmp/somedir already exists. -- jim knoble | jmknoble at pobox.com | http://www.pobox.com/~jmknoble/ On 2010-08-27 07:36, Wout Mertens wrote: > If you use tar instead it's reasonably easy: > > ssh desthost -t sudo tar cf - srcfile | tar xvf - > > untested. > > Wout. > > On Aug 27, 2010, at 16:13 , Jeremy Nickurak wrote: > >> Any thoughts on how to get away with doing this with scp, in particular? >> >> On Thu, Aug 26, 2010 at 20:23, Matthew Monaco wrote: >> >>> On 08/26/2010 10:39 PM, Coy Hile wrote: >>> >>>> Use sudo a la >>>> >>>> ssh desthost sudo /some/command >>>> >>>> >>> >>> ssh desthost -t sudo /some/command >>> >>> >>> >>> -----Original Message----- >>>> From: openssh-unix-dev-bounces+coy.hile=coyhile.com at mindrot.org [mailto: >>>> openssh-unix-dev-bounces+coy.hile= >>>> coyhile.com at mindrot.org] On Behalf Of Phillip Wu >>>> Sent: Thursday, August 26, 2010 7:37 PM >>>> To: openssh-unix-dev at mindrot.org >>>> Subject: openssh - run as another user >>>> >>>> For security, many systems are configured so you cannot log directly as >>>> root via the initial authentication in openssh. >>>> >>>> What is usually done is that you log onto as your normal login and once >>>> you get a interactive shell you su to root to >>>> run the command that requires root. >>>> >>>> Does openssh have a more elegant way of exec'ing a command as root so I >>>> can run the command >>>> non-interactively? I know: >>>> Normal userid >>>> Normal userid password >>>> Root's password >>>> >>>> *************************************************************** >>>> This message is intended for the addressee named and may contain >>>> confidential information. If you are not the intended recipient, please >>>> delete it and notify the sender. Views expressed in this message are those >>>> of the individual sender, and are not necessarily the views of the Land and >>>> Property Management Authority. This email message has been swept by >>>> MIMEsweeper for the presence of computer viruses. >>>> *************************************************************** >>>> Please consider the environment before printing this email. >>>> _______________________________________________ >>>> openssh-unix-dev mailing list >>>> openssh-unix-dev at mindrot.org >>>> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev >>>> _______________________________________________ >>>> openssh-unix-dev mailing list >>>> openssh-unix-dev at mindrot.org >>>> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev >>>> >>>> >>> _______________________________________________ >>> openssh-unix-dev mailing list >>> openssh-unix-dev at mindrot.org >>> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev >>> >> >> >> >> -- >> Jeremy Nickurak -= Email/XMPP: -= jeremy at nickurak.ca =- >> _______________________________________________ >> openssh-unix-dev mailing list >> openssh-unix-dev at mindrot.org >> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev > > _______________________________________________ > openssh-unix-dev mailing list > openssh-unix-dev at mindrot.org > https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev >