| Commit message (Collapse) | Author | Age | Files | Lines | |
|---|---|---|---|---|---|
| * | remove ssh1 server code; ok djm@ |   markus | 2016-08-13 | 1 | -342/+0 |
| | | |||||
| * | update to new API (key_fingerprint => sshkey_fingerprint) |   djm | 2015-01-28 | 1 | -3/+4 |
| | | | | | | check sshkey_fingerprint return values; ok markus | ||||
| * | Add FingerprintHash option to control algorithm used for key | djm | 2014-12-21 | 1 | -2/+3 |
| | | | | | | | | fingerprints. Default changes from MD5 to SHA256 and format from hex to base64. Feedback and ok naddy@ markus@ | ||||
| * | Add support for Unix domain socket forwarding. A remote TCP port |   millert | 2014-07-15 | 1 | -2/+2 |
| | | | | | | | | | may be forwarded to a local Unix domain socket and vice versa or both ends may be a Unix domain socket. This is a reimplementation of the streamlocal patches by William Ahern from: http://www.25thandclement.com/~william/projects/streamlocal.html OK djm@ markus@ | ||||
| * | New key API: refactor key-related functions to be more library-like, | djm | 2014-06-24 | 1 | -2/+3 |
| | | | | | | | | | | existing API is offered as a set of wrappers. with and ok markus@ Thanks also to Ben Hawkes, David Tomaschik, Ivan Fratric, Matthew Dempsky and Ron Bowes for a detailed review a few months ago. | ||||
| * | replace openssl MD5 with our ssh_digest_*; ok djm@ | markus | 2014-01-27 | 1 | -9/+13 |
| | | |||||
| * | fix pointer-signedness warnings from clang/llvm-3.3; "seems nice" deraadt@ | djm | 2013-07-12 | 1 | -4/+3 |
| | | |||||
| * | for hostbased authentication, print the client host and user on | djm | 2013-06-21 | 1 | -2/+2 |
| | | | | | the auth success/failure line; bz#2064, ok dtucker@ | ||||
| * | Standardise logging of supplemental information during userauth. Keys | djm | 2013-05-19 | 1 | -8/+8 |
| | | | | | | | | | | | and ruser is now logged in the auth success/failure message alongside the local username, remote host/port and protocol in use. Certificates contents and CA are logged too. Pushing all logging onto a single line simplifies log analysis as it is no longer necessary to relate information scattered across multiple log entries. "I like it" markus@ | ||||
| * | bye, bye xfree(); ok markus@ | djm | 2013-05-17 | 1 | -3/+3 |
| | | |||||
| * | new sshd_config option AuthorizedKeysCommand to support fetching | djm | 2012-10-30 | 1 | -1/+3 |
| | | | | | | | | | | authorized_keys from a command in addition to (or instead of) from the filesystem. The command is run as the target server user unless another specified via a new AuthorizedKeysCommandUser option. patch originally by jchadima AT redhat.com, reworked by me; feedback and ok markus@ | ||||
| * | allow AuthorizedKeysFile to specify multiple files, separated by spaces. | djm | 2011-05-23 | 1 | -31/+39 |
| | | | | | | | | | | Bring back authorized_keys2 as a default search path (to avoid breaking existing users of this file), but override this in sshd_config so it will be no longer used on fresh installs. Maybe in 2015 we can remove it entierly :) feedback and ok markus@ dtucker@ | ||||
| * | move check for revoked keys to run earlier (in auth_rsa_key_allowed) | djm | 2010-12-03 | 1 | -4/+5 |
| | | | | | bz#1829; patch from ldv AT altlinux.org; ok markus@ | ||||
| * | s/timing_safe_cmp/timingsafe_bcmp/g | djm | 2010-07-13 | 1 | -2/+2 |
| | | |||||
| * | implement a timing_safe_cmp() function to compare memory without leaking | djm | 2010-07-13 | 1 | -2/+2 |
| | | | | | | | timing information by short-circuiting like memcmp() and use it for some of the more sensitive comparisons (though nothing high-value was readily attackable anyway); "looks ok" markus@ | ||||
| * | don't accept certificates marked as "cert-authority" here; ok markus@ | djm | 2010-05-11 | 1 | -2/+3 |
| | | |||||
| * | revised certificate format ssh-{dss,rsa}-cert-v01@openssh.com with the | djm | 2010-04-16 | 1 | -2/+2 |
| | | | | | | | | | | | | | | | | | | | following changes: move the nonce field to the beginning of the certificate where it can better protect against chosen-prefix attacks on the signature hash Rename "constraints" field to "critical options" Add a new non-critical "extensions" field Add a serial number The older format is still support for authentication and cert generation (use "ssh-keygen -t v00 -s ca_key ..." to generate a v00 certificate) ok markus@ | ||||
| * | Add a TrustedUserCAKeys option to sshd_config to specify CA keys that | djm | 2010-03-04 | 1 | -1/+4 |
| | | | | | | | | | | | | are trusted to authenticate users (in addition than doing it per-user in authorized_keys). Add a RevokedKeys option to sshd_config and a @revoked marker to known_hosts to allow keys to me revoked and banned for user or host authentication. feedback and ok markus@ | ||||
| * | Merge duplicate host key file checks, based in part on a patch from Rob |   dtucker | 2008-07-02 | 1 | -21/+2 |
| | | | | | | Holland via bz #1348 . Also checks for non-regular files during protocol 1 RSA auth. ok djm@ | ||||
| * | add missing checks for openssl return codes; with & ok djm@ | markus | 2006-11-06 | 1 | -4/+6 |
| | | |||||
| * | almost entirely get rid of the culture of ".h files that include .h files" |   deraadt | 2006-08-03 | 1 | -5/+8 |
| | | | | | | ok djm, sort of ok stevesk makes the pain stop in one easy step | ||||
| * | move #include <stdio.h> out of includes.h |   stevesk | 2006-08-01 | 1 | -1/+2 |
| | | |||||
| * | move #include <string.h> out of includes.h | stevesk | 2006-07-22 | 1 | -1/+2 |
| | | |||||
| * | move #include <pwd.h> out of includes.h; ok markus@ | stevesk | 2006-07-06 | 1 | -1/+3 |
| | | |||||
| * | needed casts (always will be needed) | deraadt | 2006-03-25 | 1 | -2/+2 |
| | | |||||
| * | Put $OpenBSD$ tags back (as comments) to replace the RCSID()s that | djm | 2006-03-25 | 1 | -0/+1 |
| | | | | | Theo nuked - our scripts to sync -portable need them in the files | ||||
| * | RCSID() can die | deraadt | 2006-03-19 | 1 | -1/+0 |
| | | |||||
| * | move #include <sys/stat.h> out of includes.h; ok markus@ | stevesk | 2006-02-20 | 1 | -1/+4 |
| | | |||||
| * | make this -Wsign-compare clean; ok avsm@ markus@ | djm | 2005-06-17 | 1 | -2/+4 |
| | | |||||
| * | Fix debug call in error path of authorized_keys processing and fix related | dtucker | 2004-12-11 | 1 | -1/+2 |
| | | | | | warnings; ok djm@ | ||||
| * | Discard over-length authorized_keys entries rather than complaining when | dtucker | 2004-12-06 | 1 | -6/+4 |
| | | | | | they don't decode. bz #884, with & ok djm@ | ||||
| * | make ssh -Wshadow clean, no functional changes |   avsm | 2004-06-21 | 1 | -5/+5 |
| | | | | | markus@ ok | ||||
| * | kill some more tiny files; ok deraadt@ | djm | 2004-05-09 | 1 | -2/+1 |
| | | |||||
| * | standardise arguments to auth methods - they should all take authctxt. | djm | 2003-11-04 | 1 | -3/+4 |
| | | | | | check authctxt->valid rather then pw != NULL; ok markus@ | ||||
| * | rename log() into logit() to avoid name conflict. markus ok, from netbsd |   itojun | 2003-04-08 | 1 | -3/+3 |
| | | |||||
| * | display minimum RSA modulus in error(); ok markus@ | stevesk | 2002-06-10 | 1 | -3/+3 |
| | | |||||
| * | make RSA modulus minimum #define; ok markus@ | stevesk | 2002-03-29 | 1 | -2/+3 |
| | | |||||
| * | disallow RSA keys < 768 for protocol 1, too (rhosts-rsa and rsa auth) | markus | 2002-03-26 | 1 | -1/+8 |
| | | |||||
| * | return 0 (not NULL); tomh@po.crl.go.jp | markus | 2002-03-25 | 1 | -4/+4 |
| | | |||||
| * | integrate privilege separated openssh; its turned off by default for now. |   provos | 2002-03-18 | 1 | -8/+9 |
| | | | | | work done by me and markus@ | ||||
| * | split auth_rsa() for better readability and privsep; ok provos@ | markus | 2002-03-14 | 1 | -85/+117 |
| | | |||||
| * | packet_read* no longer return the packet length, since it's not used. | markus | 2001-12-28 | 1 | -3/+3 |
| | | |||||
| * | s/packet_done/packet_check_eom/ (end-of-message); ok djm@ | markus | 2001-12-28 | 1 | -2/+2 |
| | | |||||
| * | get rid of packet_integrity_check, use packet_done() instead. | markus | 2001-12-27 | 1 | -2/+2 |
| | | |||||
| * | call fatal() for openssl allocation failures | markus | 2001-12-27 | 1 | -4/+7 |
| | | |||||
| * | log fingerprint on successful public key authentication, simplify usage of key structs; ok markus@ |   jakob | 2001-12-18 | 1 | -11/+17 |
| | | |||||
| * | fix protocol error: send 'failed' message instead of a 2nd challenge | markus | 2001-11-29 | 1 | -2/+6 |
| | | | | | | (happens if the same key is in authorized_keys twice). reported Ralf_Meister@genua.de; ok djm@ | ||||
| * | use %lu; ok markus@ | stevesk | 2001-07-23 | 1 | -2/+2 |
| | | |||||
| * | terminate secure_filename checking after checking homedir. that way it | provos | 2001-06-25 | 1 | -2/+2 |
| | | | | | works on AFS. okay markus@ | ||||
| * | merge authorized_keys2 into authorized_keys. | markus | 2001-06-22 | 1 | -4/+2 |
| | | | | | | authorized_keys2 is used for backward compat. (just append authorized_keys2 to authorized_keys). | ||||
 |
index : wireguard-openbsd | |
| WireGuard implementation for the OpenBSD kernel | Matt Dunwoodie |
| summaryrefslogtreecommitdiffstats |