- Set up and run tests with SUDO.
- Set random password to use for password & kbdint auth tests.
- Only run t-exec when re-testing with PAM, don't rerun unit tests.
- When testing PAM builds, test with and without UsePAM.
Add missing SSHD_CONFOPTS="UsePam yes" to the solaris PAM test
step so it actually tests PAM functionality instead of re-running
the default tests with a PAM-enabled binary.
On sparc64 ssh/unittests/kex fails to build with:
usr.bin/ssh/libcrux_mlkem768_sha3.h:8196: warning: inlining failed
in call to 'libcrux_ml_kem_polynomial_ZERO_89_ea':
--param max-inline-insns-single limit reached
OK djm@ (long time ago) reminded by tb@
OpenBSD-Regress-ID: c32094e3436536474039a4aeefabdbf0bd826554
Recently Cygwin imported changes from Fedora which disable SHA1
signatures by default. This breaks the unit tests (and a couple of
regression tests), so set rh-allow-sha1-signatures=yes in the OpenSSL
config to re-enable them.
OpenSSL 4 removes support for ENGINE, but it provides no-op stubs
for the ENGINE functions in addition to setting OPENSSL_NO_ENGINE.
The presence of the stubs fooled the old configure test, so if someone
tried --with-ssl-engine with OpenSSL 4.0.0 it'd try but fail at build
time. Explicitly check for OPENSSL_NO_ENGINE. before trying to enable
ENGINE support. bz#3952.
the commandline to earlier in main(), specifically before some contexts where
a username with shell characters might be expanded by a %u directive in
ssh_config.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
We continue to recommend against using untrusted input on
the SSH commandline. Mitigations like this are not 100%
guarantees of safety because we can't control every
combination of user shell and configuration where they are
used.
Reported by Florian Kohnhäuser
OpenBSD-Commit-ID: 25ef72223f5ccf1c38d307ae77c23c03f59acc55
algorithm allowlists: HostKeyAlgorithms, PubkeyAcceptedAlgorithms and
HostbasedAcceptedAlgorithms.
Previously, if any ECDSA type (say "ecdsa-sha2-nistp521") was
present in one of these lists, then all ECDSA algorithms would
be permitted.
Reported by Christos Papakonstantinou of Cantina and Spearbit.
OpenBSD-Commit-ID: c790e2687c35989ae34a00e709be935c55b16a86
without the -p (preserve modes) flag set, clear setuid/setgid bits from
downloaded files as one might expect.
AFAIK this bug dates back to the original Berkeley rcp program.
Reported by Christos Papakonstantinou of Cantina and Spearbit.
OpenBSD-Commit-ID: 49e902fca8dd933a92a9b547ab31f63e86729fa1
to a value <10 using the single-argument form of MaxStartups (e.g.
MaxStartups=3). This doesn't affect the three-argument form of the directive
(e.g. MaxStartups 3:20:5).
Patch from Peter Kaestle via bz3941
OpenBSD-Commit-ID: 1ad093cae69f55ebfdea1ab24318aefd593d63b8
OpenSSH doesn't support PAM changing its conception of the
username via a module calling pam_set_item(h, PAM_USER, ...).
We were supposed to bail out here, but I messed up while "fixing"
this last time and dropped a return statement.
Reported by Mike Damm
Not all dd implementations support this. POSIX only specifies
suffixes for block size operands.
Instead, just use 1024k to avoid the special case. This also removes
an incorrect redirection operator that appeared in the 1m case.
Darafei Praliaskouski