summaryrefslogtreecommitdiffstats
path: root/.depend
AgeCommit message (Collapse)Author
10 daysupstream: Add a facility to sshd(8) to penalise particulardjm@openbsd.org
problematic client behaviours, controlled by two new sshd_config(5) options: PerSourcePenalties and PerSourcePenaltyExemptList. When PerSourcePenalties are enabled, sshd(8) will monitor the exit status of its child pre-auth session processes. Through the exit status, it can observe situations where the session did not authenticate as expected. These conditions include when the client repeatedly attempted authentication unsucessfully (possibly indicating an attack against one or more accounts, e.g. password guessing), or when client behaviour caused sshd to crash (possibly indicating attempts to exploit sshd). When such a condition is observed, sshd will record a penalty of some duration (e.g. 30 seconds) against the client's address. If this time is above a minimum threshold specified by the PerSourcePenalties, then connections from the client address will be refused (along with any others in the same PerSourceNetBlockSize CIDR range). Repeated offenses by the same client address will accrue greater penalties, up to a configurable maximum. A PerSourcePenaltyExemptList option allows certain address ranges to be exempt from all penalties. We hope these options will make it significantly more difficult for attackers to find accounts with weak/guessable passwords or exploit bugs in sshd(8) itself. PerSourcePenalties is off by default, but we expect to enable it automatically in the near future. much feedback markus@ and others, ok markus@ OpenBSD-Commit-ID: 89ded70eccb2b4926ef0366a4d58a693de366cca
2024-05-31dependDamien Miller
2024-05-17Makefile support for sshd-sessionDamien Miller
2024-04-30dependDamien Miller
2023-12-19dependDamien Miller
2023-08-10dependDamien Miller
2023-07-20dependDamien Miller
2023-03-16dependV_9_3_P1Damien Miller
2023-01-16upstream: update OpenSSH's Ed25519 code to the last version of SUPERCOPdjm@openbsd.org
(20221122) and change the import approach to the same one we use for Streamlined NTRUPrime: use a shell script to extract the bits we need from SUPERCOP, make some minor adjustments and squish them all into a single file. ok tb@ tobhe@ OpenBSD-Commit-ID: 1bc0fd624cb6af440905b8ba74ac7c03311b8e3b
2022-10-04update .dependV_9_1_P1Damien Miller
2022-07-25Remove workarounds for OpenSSL missing AES-CTR.Darren Tucker
We have some compatibility hacks that were added to support OpenSSL versions that do not support AES CTR mode. Since that time, however, the minimum OpenSSL version that we support has moved to 1.0.1 which *does* have CTR, so this is no longer needed. ok djm@
2022-03-31dependDamien Miller
2022-02-23makedependV_8_9_P1Damien Miller
2022-01-25dependDamien Miller
2022-01-07dependDamien Miller
2021-11-29dependDamien Miller
2021-11-18update dependsDamien Miller
2021-10-28dependDamien Miller
2021-08-20dependV_8_7_P1Damien Miller
2021-08-10upstream: on fatal errors, make scp wait for ssh connection beforedjm@openbsd.org
exiting avoids LogLevel=verbose (or greater) messages from ssh appearing after scp has returned exited and control has returned to the shell; ok markus@ OpenBSD-Commit-ID: ef9dab5ef5ae54a6a4c3b15d380568e94263456c
2021-08-04use openbsd-compat glob.h is requiredDamien Miller
2021-08-03upstream: support for using the SFTP protocol for file transfers indjm@openbsd.org
scp, via a new "-M sftp" option. Marked as experimental for now. Some corner-cases exist, in particular there is no attempt to provide bug-compatibility with scp's weird "double shell" quoting rules. Mostly by Jakub Jelen in GHPR#194 with some tweaks by me. ok markus@ Thanks jmc@ for improving the scp.1 bits. OpenBSD-Commit-ID: 6ce4c9157ff17b650ace571c9f7793d92874051c
2021-04-16dependV_8_6_P1V_8_6Damien Miller
2021-03-02update dependV_8_5_P1Damien Miller
2020-12-29upstream: Update/replace the experimental post-quantim hybrid keydjm@openbsd.org
exchange method based on Streamlined NTRU Prime (coupled with X25519). The previous sntrup4591761x25519-sha512@tinyssh.org method is replaced with sntrup761x25519-sha512@openssh.com. Per the authors, sntrup4591761 was replaced almost two years ago by sntrup761. The sntrup761 implementaion, like sntrup4591761 before it, is public domain code extracted from the SUPERCOP cryptography benchmark suite (https://bench.cr.yp.to/supercop.html). Thanks for Daniel J Bernstein for guidance on algorithm selection. Patch from Tobias Heider; feedback & ok markus@ and myself (note this both the updated method and the one that it replaced are disabled by default) OpenBSD-Commit-ID: 2bf582b772d81ee24e911bb6f4b2aecfd39338ae
2020-10-18upstream: use the new variant log macros instead of prependingdjm@openbsd.org
__func__ and appending ssh_err(r) manually; ok markus@ OpenBSD-Commit-ID: 1f14b80bcfa85414b2a1a6ff714fb5362687ace8
2020-09-20.dependDamien Miller
2020-05-29dependDamien Miller
2020-05-13make dependDamien Miller
2020-05-02Update .depend.Darren Tucker
2020-04-24Update .depend.Darren Tucker
2020-02-06dependDamien Miller
2020-01-26dependDamien Miller
2020-01-21dependDamien Miller
2020-01-14Update depend to remove rmd160.h.Darren Tucker
2020-01-06Remove auth-skey.c.Darren Tucker
S/Key support was removed in OpenSSH 7.8 but this file was missed.
2019-12-30refresh dependDamien Miller
2019-12-14adapt Makefile to ssh-sk-client everywhereDamien Miller
2019-12-11Sort depends.Darren Tucker
2019-12-11Update depend to include sk files.Darren Tucker
2019-11-15upstream: directly support U2F/FIDO2 security keys in OpenSSH bydjm@openbsd.org
linking against the (previously external) USB HID middleware. The dlopen() capability still exists for alternate middlewares, e.g. for Bluetooth, NFC and test/debugging. OpenBSD-Commit-ID: 14446cf170ac0351f0d4792ba0bca53024930069
2019-11-02Rebuild .depend.Darren Tucker
2019-11-01dependDamien Miller
2019-10-09dependDamien Miller
2019-09-06upstream: fixes for !WITH_OPENSSL compilation; ok dtucker@djm@openbsd.org
OpenBSD-Commit-ID: 7fd68eaa9e0f7482b5d4c7e8d740aed4770a839f
2019-07-19Revert one dependency per line change.Darren Tucker
It turns out that having such a large number of lines in the .depend file will cause the memory usage of awk during AC_SUBST to blow up on at least NetBSD's awk, causing configure to fail.
2019-07-19Force dependencies one per line.Darren Tucker
Force makedepend to output one dependency per line, which will make reading diffs against it much easier. ok djm@
2019-07-19make depend.Darren Tucker
2019-07-16dependDamien Miller
2019-07-08remove realpath() compat replacementDamien Miller
We shipped a BSD implementation of realpath() because sftp-server depended on its behaviour. OpenBSD is now moving to a more strictly POSIX-compliant realpath(2), so sftp-server now unconditionally requires its own BSD-style realpath implementation. As such, there is no need to carry another independant implementation in openbsd-compat. ok dtucker@
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-17 03:34:38 +0000