linux/poky.git/meta/recipes-connectivity/openssh, branch dizzy

openssh: CVE-2015-6563 CVE-2015-6564 CVE-2015-6565

2016-01-30T12:03:13+00:00

three security fixes. CVE-2015-6563 (Low) openssh: Privilege separation weakness related to PAM support CVE-2015-6564 (medium) openssh: Use-after-free bug related to PAM support CVE-2015-6565 (High) openssh: Incorrectly set TTYs to be world-writable (From OE-Core rev: 259df232b513367a0a18b17e3e377260a770288f) (From OE-Core rev: ddfe191355a042e6995f7b4b725b108c5bb4d36e) Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Conflicts: meta/recipes-connectivity/openssh/openssh_6.6p1.bb Signed-off-by: Richard Purdie

openssh: deliver ssh-copy-id

2015-02-11T17:40:05+00:00

Deliver script ssh-copy-id from openssh which is useful to add an authorized ssh key. (From OE-Core rev: 16562034a2c28cbfc6c90f9324c42c08e0655b7d) (From OE-Core rev: 00638cc0ca8213f6aac154eccf29ee0213c0a7e9) Signed-off-by: Kai Kang Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

openssh: move setting LD to allow for correct override

2014-12-31T10:19:04+00:00

Using the export LD in the recipe does not allow for secodnary toolchain overriding LD later, by setting it in the do_configure_append the export is used by autotools setting LD based on the env, but would allow for override later. [YOCTO #6997] (From OE-Core rev: 9b37e630f5f6e37e928f825c4f67481cf58c98a1) (From OE-Core rev: 9dd9d23096e73fa7b6f865241cdd9eff77e5b208) Signed-off-by: Saul Wold Signed-off-by: Ross Burton Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

openssh: fix using the original config files in srcdir

2014-12-31T10:18:58+00:00

Currently, we install our own ssh_config and sshd_config into ${S} in do_compile_append() task. So when finishing compiling, their .out files are generated by the original files, rather than by our own files. In most cases, installing "$(CONFIGFILES)" in Makefile will generate .out files again, and then installing "install-sysconf", which will install these two files into $(DESTDIR), thus we get what we expect. However, when parallel installing, "install-sysconf" may be installed before "$(CONFIGFILES)" sometimes. In this rare case, the .out files generated in the first time rather than those in the second time will be installed into $(DESTDIR), and thus we get an unexpect result. This patch fixes this bug through transfering the installing of our own files from do_compile_append() into do_configure_prepend(). (From OE-Core rev: 6a60a4ba8d8e529882daa33140c9a2fc08714fb2) (From OE-Core rev: af1096b7e1e9c15d83fb44739d449fcbaf70c220) Signed-off-by: Zheng Junling Signed-off-by: Ross Burton Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

openssh: avoid screen sessions being killed on disconnect with systemd

2014-10-18T14:14:03+00:00

Tell systemd just to kill the sshd process when the ssh connection drops instead of the entire cgroup for sshd, so that any screen sessions (and more to the point, processes within them) do not get killed. (This is what the Fedora sshd service file does, and what we're already doing in the dropbear service file). (From OE-Core rev: 3c238dff41fbd3687457989c7b17d22b2cc844be) Signed-off-by: Paul Eggleton Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

openssh: use pidfile in initscript

2014-07-18T23:09:01+00:00

Stopping sshd must only kill the listening (top-level) daemon; it must not stop any other sshd process, because those are forked ssh connections which may include e.g. the connection that called /etc/init.d/sshd stop. This initscript uses "start-stop-daemon -x " for starting/stopping. When that is provided by busybox, this behavior is broken: `/etc/init.d/sshd stop` stops *all* sshd processes. This was caused by a fix to busybox 1.20: 17eedcad9406c43beddab3906c8c693626c351fb "ssd: compat: match -x EXECUTABLE by /proc/pid/exe too". The fix is to use a pidfile. All initscripts in upstream openssh do this, as does dropbear. Acked-by: Gratian Crisan Acked-by: Ken Sharp (From OE-Core rev: 993405285e547403d5c753adfa91c26c43be13f6) Signed-off-by: Richard Tollerton Signed-off-by: Ben Shelton Signed-off-by: Richard Purdie

openssh: avoid checking empty passwords to mess up with PAM modules

2014-07-03T16:41:18+00:00

Previously, even if PAM is enabled for ssh, the daemon still tries to authenticate an empty password. This leads to authentication failure which would mess up with PAM modules. As a result, if 'UsePAM', 'PermitEmptyPasswords' and 'PasswordAuthentication' are enabled, no user can login correctly. We would meet the following error message at the client side. Write failed: Broken Pipe This patch fixes the above problem by checking whether PAM is enabled before authenticating an empty password. After all, if PAM is enabled, the task of authenticating passwords should be handled to PAM modules. [YOCTO #6466] (From OE-Core rev: e017ae71dad4837b0d22f291b0b0e0949075f822) Signed-off-by: Chen Qi Signed-off-by: Richard Purdie

openssh: move packaging definitions to the end

2014-05-15T22:24:43+00:00

(From OE-Core rev: 19efeb598c5fb527bd5bc473d7a7d78242ec05a0) Signed-off-by: Paul Eggleton Signed-off-by: Saul Wold Signed-off-by: Richard Purdie

openssh: update to 6.6p1

2014-05-15T22:24:43+00:00

(From OE-Core rev: f091dbd6324a89682d29cac0bd0ba40899c8bdd5) Signed-off-by: Paul Eggleton Signed-off-by: Saul Wold Signed-off-by: Richard Purdie

openssh: fix for CVE-2014-2653

2014-05-13T18:32:06+00:00

The verify_host_key function in sshconnect.c in the client in OpenSSH 6.6 and earlier allows remote servers to trigger the skipping of SSHFP DNS RR checking by presenting an unacceptable HostCertificate. (From OE-Core rev: 7b2fff61b3d1c0566429793ee348fa8978ef0cba) Signed-off-by: Chen Qi Signed-off-by: Richard Purdie