Hi,
OpenSSH 5.1 is almost ready for release, so we would appreciate testing
on as many platforms and systems as possible. This release is one of
the biggest in recent years, with two hackathons' worth of improvements
and fixes for some of our most recalcitrant bugs.
Snapshot releases for portable OpenSSH are available from
http://www.mindrot.org/openssh_snap/
The OpenBSD version is available in CVS HEAD:
http://www.openbsd.org/anoncvs.html
Portable OpenSSH is also available via anonymous CVS using the
instructions at http://www.openssh.com/portable.html#cvs
Running the regression tests supplied with Portable OpenSSH does not
require installation and is a simply:
$ ./configure && make tests
Live testing on suitable non-production systems is also appreciated.
Please send reports of success or failure to
openssh-unix-dev at mindrot.org.
Below is a summary of changes. More detail may be found in the
ChangeLog in the portable OpenSSH tarballs.
Thanks to the many people who contributed to this release.
New features:
* Introduce experimental SSH Fingerprint ASCII Visualisation to ssh(1)
and ssh-keygen(1). Visual fingerprinnt display is controlled by a new
ssh_config(5) option "VisualHostKey". The intent is to render
SSH host keys in a visual form that is amenable to easy recall and
rejection of changed host keys. This technique inspired by the
graphical hash visualisation schemes known as "random art[*]", and
by Dan Kaminsky's musings at 23C3 in Berlin.
Fingerprint visualisation in is currently disabled by default, as the
algorithm used to generate the random art is still subject to change.
[*] "Hash Visualization: a New Technique to improve Real-World
Security", Perrig A. and Song D., 1999, International Workshop on
Cryptographic Techniques and E-Commerce (CrypTEC '99)
http://sparrow.ece.cmu.edu/~adrian/projects/validation/validation.pdf
* sshd_config(5) now supports CIDR address/masklen matching in "Match
address" blocks, with a fallback to classic wildcard matching. For
example:
Match address 192.0.2.0/24,3ffe:ffff::/32,!10.*
PasswordAuthentication yes
* sshd(8) now supports CIDR matching in ~/.ssh/authorized_keys
from="..." restrictions, also with a fallback to classic wildcard
matching.
* Added an extended test mode (-T) to sshd(8) to request that it write
its effective configuration to stdout and exit. Extended test mode
also supports the specification of connection parameters (username,
source address and hostname) to test the application of
sshd_config(5) Match rules.
* sftp-server(8) now supports extension methods statvfs at openssh.com and
fstatvfs at openssh.com that implement statvfs(2)-like operations.
* sftp(1) now has a "df" command to the sftp client that uses the
statvfs at openssh.com to produce a df(1)-like display of filesystem
space and inode utilisation (requires statvfs at openssh.com support on
the server)
* Added a MaxSessions option to sshd_config(5) to allow control of the
number of multiplexed sessions supported over a single TCP connection.
This allows increasing the number of allowed sessions above the
previous default of 10, disabling connection multiplexing
(MaxSessions=1) or disallowing login/shell/subsystem sessions
entirely (MaxSessions=0).
* Added a no-more-sessions at openssh.com global request extension that is
sent from ssh(1) to sshd(8) when the client knows that it will never
request another session (i.e. when session multiplexing is disabled).
This allows a server to disallow further session requests and
terminate the session in cases where the client has been hijacked.
* ssh-keygen(1) now supports the use of the -l option in combination
with -F to search for a host in ~/.ssh/known_hosts and display its
fingerprint.
* ssh-keyscan(1) now defaults to "rsa" (protocol 2) keys, instead of
"rsa1".
* Added an AllowAgentForwarding option to sshd_config(8) to control
whether authentication agent forwarding is permitted. Note that this
is a loose control, as a client may install their own unofficial
forwarder.
* Avoid unnecessary malloc/copy/free when receiving network data,
resulting in a ~10% speedup
* ssh(1) and sshd(8) will now try additional addresses when connecting
to a port forward destination whose DNS name resolves to more than
one address. The previous behaviour was to try the only first address
and give up if that failed.
* ssh(1) and sshd(8) now support signalling that channels are
half-closed for writing, through a channel protocol extension
notification "eow at openssh.com". This allows propagation of
closed
file descriptors, so that commands such as:
"ssh -2 localhost od /bin/ls | true"
do not send unnecessary data over the wire. (bz#85)
* sshd(8): increased the default size of ssh protocol 1 ephemeral keys
from 768 to 1024 bits.
* When ssh(1) has been requested to fork after authentication
("ssh -f") with ExitOnForwardFailure enabled, delay the fork until
after replies for any -R forwards have been seen. Allows for robust
detection of -R forward failure when using -f.
* "Match group" blocks in sshd_config(5) now support negation of
groups. E.g. "Match group staff,!guests"
* sftp(1) and sftp-server(8) now allow chmod-like operations to set
set[ug]id/sticky bits.
* The MaxAuthTries option is now permitted in sshd_config(5) match
blocks.
* Multiplexed ssh(1) sessions now support a subset of the ~ escapes
that are available to a primary connection.
* ssh(1) connection multiplexing will now fall back to creating a new
connection in most error cases.
* Added some basic interoperability tests against Twisted Conch.
* Documented OpenSSH's extensions to and deviations from the published
SSH protocols (the PROTOCOL file in the distribution)
* Documented OpenSSH's ssh-agent protocol (PROTOCOL.agent).
Bugfixes
* Make ssh(1) deal more gracefully with channel requests that fail.
Previously it would optimistically assume that requests would always
succeed, which could cause hangs if they did not (e.g. when the
server runs out of file descriptors).
* ssh(1) now reports multiplexing errors via the multiplex slave's
stderr where possible (subject to LogLevel in the mux master).
* ssh(1) and sshd(8) now send terminate protocol banners with CR+LF for
protocol 2 to comply with RFC 4253. Previously they were terminated
with CR alone. Protocol 1 banners remain CR terminated.
* Merged duplicate authentication file checks in sshd(8) and refuse to
read authorised_keys and .shosts from non-regular files.
* Ensure that sshd(8)'s umask disallows at least group and world write,
even if a more permissive one has been inherited.
* Suppress the warning message from sshd(8) when changing to a
non-existent user home directory after chrooting.
* Mention that scp(1) follows symlinks when performing recursive
copies.
* Prevent sshd(8) from erroneously applying public key restrictions
leaned from ~/.ssh/authorized_keys to other authentication methods
when public key authentication subsequently fails.
* Fix protocol keepalive timeouts - in some cases, keepalive packets
were being sent, but the connection was not being closed when the
limit for missing replies was exceeded.
* Fix ssh(1) sending invalid TTY modes when a TTY was forced (ssh -tt)
but stdin was not a TTY.
* ssh(1) will now exit with a non-zero exit status if
ExitOnForwardFailure was set and forwardings were disabled due to a
failed host key check.
* Fix MaxAuthTries tests to disallow a free authentication try to
clients that skipped the protocol 2 "none" authentication method.
* bz#1363: Make keepalive timeouts apply while synchronously waiting
for a packet, particularly during key renegotiation.
* sshd(8) has been audited to eliminate fd leaks and calls to fatal()
in conditions of file descriptor exhaustion.
Portable OpenSSH-specific bugfixes
* Avoid a sshd(8) hang-on-exit on Solaris caused by depending on the
success of isatty() on a PTY master (undefined behaviour). Probably
affected other platforms too.
* bz#1083: Fixed test for locked accounts on HP/UX with shadowed
passwords disabled.
* bz#1386: Disable poll() fallback in atomiciov for Tru64. readv
doesn't seem to be a comparable object there, which lead to
compilation errors.
* bz#1447: Fall back to racy rename if link returns EXDEV.
* bz#1467: Explicitly handle EWOULDBLOCK wherever we handle EAGAIN, on
some platforms (HP nonstop) it is a distinct errno.
* bz#1240: Avoid NULL dereferences in ancient sigaction replacement
code.
* bz#1276: Avoid linking against libgssapi, which despite its name
doesn't seem to implement all of GSSAPI.
* bz#1112: Use explicit noreturn attribute instead of __dead, fixing
compilation problems on Interix.
* bz#1241: Support password expiry on Tru64 SIA systems.
* bz#1462: Fix an UMAC alignment problem that manifested on Itanium
platforms.
Damien Miller
Tested successfully on the following platforms:
Solaris 8 (sparc), gcc 3.4.2
Fedora 7 (x86), gcc 4.1.2
Ubuntu 8.04 (x86), gcc 4.2.3
Bill Knox
Lead Infosec Engineer/Scientist
The MITRE Corporation
-----Original Message-----
From: openssh-unix-dev-bounces+wknox=mitre.org at mindrot.org
[mailto:openssh-unix-dev-bounces+wknox=mitre.org at mindrot.org] On Behalf
Of Damien Miller
Sent: Sunday, July 06, 2008 7:31 PM
To: openssh-unix-dev at mindrot.org
Subject: OpenSSH 5.1: call for testing
Hi,
OpenSSH 5.1 is almost ready for release, so we would appreciate testing
on as many platforms and systems as possible. This release is one of
the biggest in recent years, with two hackathons' worth of improvements
and fixes for some of our most recalcitrant bugs.
Snapshot releases for portable OpenSSH are available from
http://www.mindrot.org/openssh_snap/
The OpenBSD version is available in CVS HEAD:
http://www.openbsd.org/anoncvs.html
Portable OpenSSH is also available via anonymous CVS using the
instructions at http://www.openssh.com/portable.html#cvs
Running the regression tests supplied with Portable OpenSSH does not
require installation and is a simply:
$ ./configure && make tests
Live testing on suitable non-production systems is also appreciated.
Please send reports of success or failure to
openssh-unix-dev at mindrot.org.
Below is a summary of changes. More detail may be found in the
ChangeLog in the portable OpenSSH tarballs.
Thanks to the many people who contributed to this release.
New features:
* Introduce experimental SSH Fingerprint ASCII Visualisation to ssh(1)
and ssh-keygen(1). Visual fingerprinnt display is controlled by a
new
ssh_config(5) option "VisualHostKey". The intent is to render
SSH host keys in a visual form that is amenable to easy recall and
rejection of changed host keys. This technique inspired by the
graphical hash visualisation schemes known as "random art[*]", and
by Dan Kaminsky's musings at 23C3 in Berlin.
Fingerprint visualisation in is currently disabled by default, as
the
algorithm used to generate the random art is still subject to
change.
[*] "Hash Visualization: a New Technique to improve Real-World
Security", Perrig A. and Song D., 1999, International Workshop
on
Cryptographic Techniques and E-Commerce (CrypTEC '99)
http://sparrow.ece.cmu.edu/~adrian/projects/validation/validation.pdf
* sshd_config(5) now supports CIDR address/masklen matching in "Match
address" blocks, with a fallback to classic wildcard matching. For
example:
Match address 192.0.2.0/24,3ffe:ffff::/32,!10.*
PasswordAuthentication yes
* sshd(8) now supports CIDR matching in ~/.ssh/authorized_keys
from="..." restrictions, also with a fallback to classic wildcard
matching.
* Added an extended test mode (-T) to sshd(8) to request that it write
its effective configuration to stdout and exit. Extended test mode
also supports the specification of connection parameters (username,
source address and hostname) to test the application of
sshd_config(5) Match rules.
* sftp-server(8) now supports extension methods statvfs at openssh.com
and
fstatvfs at openssh.com that implement statvfs(2)-like operations.
* sftp(1) now has a "df" command to the sftp client that uses the
statvfs at openssh.com to produce a df(1)-like display of filesystem
space and inode utilisation (requires statvfs at openssh.com support on
the server)
* Added a MaxSessions option to sshd_config(5) to allow control of the
number of multiplexed sessions supported over a single TCP
connection.
This allows increasing the number of allowed sessions above the
previous default of 10, disabling connection multiplexing
(MaxSessions=1) or disallowing login/shell/subsystem sessions
entirely (MaxSessions=0).
* Added a no-more-sessions at openssh.com global request extension that
is
sent from ssh(1) to sshd(8) when the client knows that it will never
request another session (i.e. when session multiplexing is
disabled).
This allows a server to disallow further session requests and
terminate the session in cases where the client has been hijacked.
* ssh-keygen(1) now supports the use of the -l option in combination
with -F to search for a host in ~/.ssh/known_hosts and display its
fingerprint.
* ssh-keyscan(1) now defaults to "rsa" (protocol 2) keys, instead of
"rsa1".
* Added an AllowAgentForwarding option to sshd_config(8) to control
whether authentication agent forwarding is permitted. Note that this
is a loose control, as a client may install their own unofficial
forwarder.
* Avoid unnecessary malloc/copy/free when receiving network data,
resulting in a ~10% speedup
* ssh(1) and sshd(8) will now try additional addresses when connecting
to a port forward destination whose DNS name resolves to more than
one address. The previous behaviour was to try the only first
address
and give up if that failed.
* ssh(1) and sshd(8) now support signalling that channels are
half-closed for writing, through a channel protocol extension
notification "eow at openssh.com". This allows propagation of
closed
file descriptors, so that commands such as:
"ssh -2 localhost od /bin/ls | true"
do not send unnecessary data over the wire. (bz#85)
* sshd(8): increased the default size of ssh protocol 1 ephemeral keys
from 768 to 1024 bits.
* When ssh(1) has been requested to fork after authentication
("ssh -f") with ExitOnForwardFailure enabled, delay the fork until
after replies for any -R forwards have been seen. Allows for robust
detection of -R forward failure when using -f.
* "Match group" blocks in sshd_config(5) now support negation of
groups. E.g. "Match group staff,!guests"
* sftp(1) and sftp-server(8) now allow chmod-like operations to set
set[ug]id/sticky bits.
* The MaxAuthTries option is now permitted in sshd_config(5) match
blocks.
* Multiplexed ssh(1) sessions now support a subset of the ~ escapes
that are available to a primary connection.
* ssh(1) connection multiplexing will now fall back to creating a new
connection in most error cases.
* Added some basic interoperability tests against Twisted Conch.
* Documented OpenSSH's extensions to and deviations from the published
SSH protocols (the PROTOCOL file in the distribution)
* Documented OpenSSH's ssh-agent protocol (PROTOCOL.agent).
Bugfixes
* Make ssh(1) deal more gracefully with channel requests that fail.
Previously it would optimistically assume that requests would always
succeed, which could cause hangs if they did not (e.g. when the
server runs out of file descriptors).
* ssh(1) now reports multiplexing errors via the multiplex slave's
stderr where possible (subject to LogLevel in the mux master).
* ssh(1) and sshd(8) now send terminate protocol banners with CR+LF
for
protocol 2 to comply with RFC 4253. Previously they were terminated
with CR alone. Protocol 1 banners remain CR terminated.
* Merged duplicate authentication file checks in sshd(8) and refuse to
read authorised_keys and .shosts from non-regular files.
* Ensure that sshd(8)'s umask disallows at least group and world
write,
even if a more permissive one has been inherited.
* Suppress the warning message from sshd(8) when changing to a
non-existent user home directory after chrooting.
* Mention that scp(1) follows symlinks when performing recursive
copies.
* Prevent sshd(8) from erroneously applying public key restrictions
leaned from ~/.ssh/authorized_keys to other authentication methods
when public key authentication subsequently fails.
* Fix protocol keepalive timeouts - in some cases, keepalive packets
were being sent, but the connection was not being closed when the
limit for missing replies was exceeded.
* Fix ssh(1) sending invalid TTY modes when a TTY was forced (ssh -tt)
but stdin was not a TTY.
* ssh(1) will now exit with a non-zero exit status if
ExitOnForwardFailure was set and forwardings were disabled due to a
failed host key check.
* Fix MaxAuthTries tests to disallow a free authentication try to
clients that skipped the protocol 2 "none" authentication method.
* bz#1363: Make keepalive timeouts apply while synchronously waiting
for a packet, particularly during key renegotiation.
* sshd(8) has been audited to eliminate fd leaks and calls to fatal()
in conditions of file descriptor exhaustion.
Portable OpenSSH-specific bugfixes
* Avoid a sshd(8) hang-on-exit on Solaris caused by depending on the
success of isatty() on a PTY master (undefined behaviour). Probably
affected other platforms too.
* bz#1083: Fixed test for locked accounts on HP/UX with shadowed
passwords disabled.
* bz#1386: Disable poll() fallback in atomiciov for Tru64. readv
doesn't seem to be a comparable object there, which lead to
compilation errors.
* bz#1447: Fall back to racy rename if link returns EXDEV.
* bz#1467: Explicitly handle EWOULDBLOCK wherever we handle EAGAIN, on
some platforms (HP nonstop) it is a distinct errno.
* bz#1240: Avoid NULL dereferences in ancient sigaction replacement
code.
* bz#1276: Avoid linking against libgssapi, which despite its name
doesn't seem to implement all of GSSAPI.
* bz#1112: Use explicit noreturn attribute instead of __dead, fixing
compilation problems on Interix.
* bz#1241: Support password expiry on Tru64 SIA systems.
* bz#1462: Fix an UMAC alignment problem that manifested on Itanium
platforms.
Damien Miller
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev at mindrot.org
https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
2008/7/7 Damien Miller <djm at mindrot.org>:> Please send reports of success or failure to > openssh-unix-dev at mindrot.org.Success on SUSE 10.3 (x86_64, 2.6.22.18-0.2, gcc 4.2.1) and Ubuntu (i386, 2.6.15-52, 4.0.3) Best Martin
On Mon, 7 Jul 2008, Damien Miller wrote:> Portable OpenSSH is also available via anonymous CVS using the > instructions at http://www.openssh.com/portable.html#cvs > > Running the regression tests supplied with Portable OpenSSH does not > require installation and is a simply: > > $ ./configure && make testsRun on FC6 i386, I think it worked, the output is: ok localcommand run test forcecommand.sh ... ok forced command make[1]: Leaving directory `/tmp/openssh/regress' Perhaps it would help if the test ended with a single line that said PASS or FAIL? Cheers, Chris. -- _____ __ _ \ __/ / ,__(_)_ | Chris Wilson <0000 at qwirx.com> - Cambs UK | / (_/ ,\/ _/ /_ \ | Security/C/C++/Java/Ruby/Perl/SQL Developer | \ _/_/_/_//_/___/ | We are GNU : free your mind & your software |
On Mon, Jul 7, 2008 at 00:30, Damien Miller <djm at mindrot.org> wrote:> Hi, > > OpenSSH 5.1 is almost ready for release, so we would appreciate testing > on as many platforms and systems as possible. This release is one of > the biggest in recent years, with two hackathons' worth of improvements > and fixes for some of our most recalcitrant bugs. > > Snapshot releases for portable OpenSSH are available from > http://www.mindrot.org/openssh_snap/ > > The OpenBSD version is available in CVS HEAD: > http://www.openbsd.org/anoncvs.html > > Portable OpenSSH is also available via anonymous CVS using the > instructions at http://www.openssh.com/portable.html#cvs > > Running the regression tests supplied with Portable OpenSSH does not > require installation and is a simply: > > $ ./configure && make testsSuccess on : Fedora9 (x86_64, 2.6.25, gcc 4.3.0) Ubuntu 8.04 (i386, 2.6.24, gcc 4.2.3) On Ubuntu 6.06 (i386, 2.6.16-xen, gcc 4.0.3) I get the following: run test login-timeout.sh ... ssh: connect to host 127.0.0.1 port 4242: Connection refused ssh connect after login grace timeout failed without privsep failed connect after login grace timeout make[1]: *** [t-exec] Error 1 make[1]: Leaving directory `/tmp/openssh/regress' make: *** [tests] Error 2 - Niall
Hi, On Mon, Jul 07, 2008 at 09:30:55AM +1000, Damien Miller wrote:> OpenSSH 5.1 is almost ready for release, so we would appreciate testing > on as many platforms and systems as possible. This release is one of > the biggest in recent years, with two hackathons' worth of improvements > and fixes for some of our most recalcitrant bugs.NetBSD 3.1 on Sparc64, CVS snapshot from "earlier today", has some funnies in the test suite. This test was run as non-root, but root makes no difference, the errors are the same. Here's the output of "make test" from the point where the errors start: (cd openbsd-compat && make) ... run test forwarding.sh ... ok local and remote forwarding run test multiplex.sh ... test connection multiplexing: envpass mm_send_fd: sendmsg(0): Invalid argument muxclient: send fds failed Falling back to non-multiplexed connection mm_receive_fd: recvmsg: expected received 1 got 0 muxserver_accept_control: failed to receive fd 0 from slave ssh: Could not resolve hostname otherhost: No address associated with hostname environment not found test connection multiplexing: transfer mm_send_fd: sendmsg(0): Invalid argument muxclient: send fds failed Falling back to non-multiplexed connection mm_receive_fd: recvmsg: expected received 1 got 0 muxserver_accept_control: failed to receive fd 0 from slave ssh: Could not resolve hostname otherhost: No address associated with hostname cmp: EOF on /home/gert/src/openssh_cvs/regress/ls.copy ssh -Sctl: corrupted copy of /bin/ls mm_send_fd: sendmsg(0): Invalid argument muxclient: send fds failed Falling back to non-multiplexed connection mm_receive_fd: recvmsg: expected received 1 got 0 muxserver_accept_control: failed to receive fd 0 from slave ssh: Could not resolve hostname otherhost: No address associated with hostname cmp: EOF on /home/gert/src/openssh_cvs/regress/ls.copy ssh -S ctl: corrupted copy of /bin/ls mm_receive_fd: recvmsg: expected received 1 got 0 muxserver_accept_control: failed to receive fd 0 from slave sftp: failed copy /bin/ls cmp: /home/gert/src/openssh_cvs/regress/ls.copy: No such file or directory sftp: corrupted copy of /bin/ls mm_receive_fd: recvmsg: expected received 1 got 0 muxserver_accept_control: failed to receive fd 0 from slave scp: failed copy /bin/ls cmp: /home/gert/src/openssh_cvs/regress/ls.copy: No such file or directory scp: corrupted copy of /bin/ls test connection multiplexing: status 0 mm_send_fd: sendmsg(0): Invalid argument muxclient: send fds failed Falling back to non-multiplexed connection mm_receive_fd: recvmsg: expected received 1 got 0 muxserver_accept_control: failed to receive fd 0 from slave ssh: Could not resolve hostname otherhost: No address associated with hostname exit code mismatch for protocol : 255 != 0 mm_send_fd: sendmsg(0): Invalid argument muxclient: send fds failed Falling back to non-multiplexed connection mm_receive_fd: recvmsg: expected received 1 got 0 muxserver_accept_control: failed to receive fd 0 from slave ssh: Could not resolve hostname otherhost: No address associated with hostname exit code (with sleep) mismatch for protocol : 255 != 0 test connection multiplexing: status 1 mm_send_fd: sendmsg(0): Invalid argument muxclient: send fds failed Falling back to non-multiplexed connection mm_receive_fd: recvmsg: expected received 1 got 0 muxserver_accept_control: failed to receive fd 0 from slave ssh: Could not resolve hostname otherhost: No address associated with hostname exit code mismatch for protocol : 255 != 1 mm_send_fd: sendmsg(0): Invalid argument muxclient: send fds failed Falling back to non-multiplexed connection mm_receive_fd: recvmsg: expected received 1 got 0 muxserver_accept_control: failed to receive fd 0 from slave ssh: Could not resolve hostname otherhost: No address associated with hostname exit code (with sleep) mismatch for protocol : 255 != 1 test connection multiplexing: status 4 mm_send_fd: sendmsg(0): Invalid argument muxclient: send fds failed Falling back to non-multiplexed connection mm_receive_fd: recvmsg: expected received 1 got 0 muxserver_accept_control: failed to receive fd 0 from slave ssh: Could not resolve hostname otherhost: No address associated with hostname exit code mismatch for protocol : 255 != 4 mm_send_fd: sendmsg(0): Invalid argument muxclient: send fds failed Falling back to non-multiplexed connection mm_receive_fd: recvmsg: expected received 1 got 0 muxserver_accept_control: failed to receive fd 0 from slave ssh: Could not resolve hostname otherhost: No address associated with hostname exit code (with sleep) mismatch for protocol : 255 != 4 test connection multiplexing: status 5 mm_send_fd: sendmsg(0): Invalid argument muxclient: send fds failed Falling back to non-multiplexed connection mm_receive_fd: recvmsg: expected received 1 got 0 muxserver_accept_control: failed to receive fd 0 from slave ssh: Could not resolve hostname otherhost: No address associated with hostname exit code mismatch for protocol : 255 != 5 mm_send_fd: sendmsg(0): Invalid argument muxclient: send fds failed Falling back to non-multiplexed connection mm_receive_fd: recvmsg: expected received 1 got 0 muxserver_accept_control: failed to receive fd 0 from slave ssh: Could not resolve hostname otherhost: No address associated with hostname exit code (with sleep) mismatch for protocol : 255 != 5 test connection multiplexing: status 44 mm_send_fd: sendmsg(0): Invalid argument muxclient: send fds failed Falling back to non-multiplexed connection mm_receive_fd: recvmsg: expected received 1 got 0 muxserver_accept_control: failed to receive fd 0 from slave ssh: Could not resolve hostname otherhost: No address associated with hostname exit code mismatch for protocol : 255 != 44 mm_send_fd: sendmsg(0): Invalid argument muxclient: send fds failed Falling back to non-multiplexed connection mm_receive_fd: recvmsg: expected received 1 got 0 muxserver_accept_control: failed to receive fd 0 from slave ssh: Could not resolve hostname otherhost: No address associated with hostname exit code (with sleep) mismatch for protocol : 255 != 44 Master running (pid=16839) Exit request sent. failed connection multiplexing *** Error code 1 Stop. make: stopped in /home/gert/src/openssh_cvs/regress *** Error code 1 Stop. make: stopped in /home/gert/src/openssh_cvs gert -- USENET is *not* the non-clickable part of WWW! //www.muc.de/~gert/ Gert Doering - Munich, Germany gert at greenie.muc.de fax: +49-89-35655025 gert at net.informatik.tu-muenchen.de
On Jul 7 09:30, Damien Miller wrote:> Hi, > > OpenSSH 5.1 is almost ready for release, so we would appreciate testing > on as many platforms and systems as possible. This release is one ofRuns basically fine on Cygwin 1.5.25. I have a bit of trouble under Cygwin 1.7.0 related to IPv6 (which is new in 1.7.0) which requires some debugging. I can't connect to the 5.1 sshd using IPv6. With full debugging on, the connection stops at debug1: Server will not fork when running in debugging mode. on the server side and debug1: identity file /home/corinna/.ssh/id_rsa type 1 on the client side. IPv6 connections works fine with ssh and sshd from 5.0p1. Does anybody have an idea what could have changed so that the identification string exchange just hangs with v6? I'm not quite sure yet how to debug this... Other than that: - session.c, line 427: #define USE_PIPES Is that planned or just left over fomr some test? - The following testcases fail on Cygwin 1.5.25: - addrmatch.sh tries to run IPv6 tests even though IPv6 is not available. - sftp-glob.sh tries to match filenames with characters not allowed in filenames on Windows filesystems ("*", "\\"). Corinna -- Corinna Vinschen Cygwin Project Co-Leader Red Hat
Compiled and tested successfully on Slackware-12.0, GCC-4.1.2 Regards, Andy On Mon, 7 Jul 2008, Damien Miller wrote:> Hi, > > OpenSSH 5.1 is almost ready for release, so we would appreciate testing > on as many platforms and systems as possible. This release is one of > the biggest in recent years, with two hackathons' worth of improvements > and fixes for some of our most recalcitrant bugs. > > Snapshot releases for portable OpenSSH are available from > http://www.mindrot.org/openssh_snap/ > > The OpenBSD version is available in CVS HEAD: > http://www.openbsd.org/anoncvs.html > > Portable OpenSSH is also available via anonymous CVS using the > instructions at http://www.openssh.com/portable.html#cvs > > Running the regression tests supplied with Portable OpenSSH does not > require installation and is a simply: > > $ ./configure && make tests > > Live testing on suitable non-production systems is also appreciated. > Please send reports of success or failure to > openssh-unix-dev at mindrot.org. > > Below is a summary of changes. More detail may be found in the > ChangeLog in the portable OpenSSH tarballs. > > Thanks to the many people who contributed to this release. > > > New features: > > * Introduce experimental SSH Fingerprint ASCII Visualisation to ssh(1) > and ssh-keygen(1). Visual fingerprinnt display is controlled by a new > ssh_config(5) option "VisualHostKey". The intent is to render > SSH host keys in a visual form that is amenable to easy recall and > rejection of changed host keys. This technique inspired by the > graphical hash visualisation schemes known as "random art[*]", and > by Dan Kaminsky's musings at 23C3 in Berlin. > Fingerprint visualisation in is currently disabled by default, as the > algorithm used to generate the random art is still subject to change. > [*] "Hash Visualization: a New Technique to improve Real-World > Security", Perrig A. and Song D., 1999, International Workshop on > Cryptographic Techniques and E-Commerce (CrypTEC '99) > http://sparrow.ece.cmu.edu/~adrian/projects/validation/validation.pdf > > * sshd_config(5) now supports CIDR address/masklen matching in "Match > address" blocks, with a fallback to classic wildcard matching. For > example: > Match address 192.0.2.0/24,3ffe:ffff::/32,!10.* > PasswordAuthentication yes > > * sshd(8) now supports CIDR matching in ~/.ssh/authorized_keys > from="..." restrictions, also with a fallback to classic wildcard > matching. > > * Added an extended test mode (-T) to sshd(8) to request that it write > its effective configuration to stdout and exit. Extended test mode > also supports the specification of connection parameters (username, > source address and hostname) to test the application of > sshd_config(5) Match rules. > > * sftp-server(8) now supports extension methods statvfs at openssh.com and > fstatvfs at openssh.com that implement statvfs(2)-like operations. > > * sftp(1) now has a "df" command to the sftp client that uses the > statvfs at openssh.com to produce a df(1)-like display of filesystem > space and inode utilisation (requires statvfs at openssh.com support on > the server) > > * Added a MaxSessions option to sshd_config(5) to allow control of the > number of multiplexed sessions supported over a single TCP connection. > This allows increasing the number of allowed sessions above the > previous default of 10, disabling connection multiplexing > (MaxSessions=1) or disallowing login/shell/subsystem sessions > entirely (MaxSessions=0). > > * Added a no-more-sessions at openssh.com global request extension that is > sent from ssh(1) to sshd(8) when the client knows that it will never > request another session (i.e. when session multiplexing is disabled). > This allows a server to disallow further session requests and > terminate the session in cases where the client has been hijacked. > > * ssh-keygen(1) now supports the use of the -l option in combination > with -F to search for a host in ~/.ssh/known_hosts and display its > fingerprint. > > * ssh-keyscan(1) now defaults to "rsa" (protocol 2) keys, instead of > "rsa1". > > * Added an AllowAgentForwarding option to sshd_config(8) to control > whether authentication agent forwarding is permitted. Note that this > is a loose control, as a client may install their own unofficial > forwarder. > > * Avoid unnecessary malloc/copy/free when receiving network data, > resulting in a ~10% speedup > > * ssh(1) and sshd(8) will now try additional addresses when connecting > to a port forward destination whose DNS name resolves to more than > one address. The previous behaviour was to try the only first address > and give up if that failed. > > * ssh(1) and sshd(8) now support signalling that channels are > half-closed for writing, through a channel protocol extension > notification "eow at openssh.com". This allows propagation of closed > file descriptors, so that commands such as: > "ssh -2 localhost od /bin/ls | true" > do not send unnecessary data over the wire. (bz#85) > > * sshd(8): increased the default size of ssh protocol 1 ephemeral keys > from 768 to 1024 bits. > > * When ssh(1) has been requested to fork after authentication > ("ssh -f") with ExitOnForwardFailure enabled, delay the fork until > after replies for any -R forwards have been seen. Allows for robust > detection of -R forward failure when using -f. > > * "Match group" blocks in sshd_config(5) now support negation of > groups. E.g. "Match group staff,!guests" > > * sftp(1) and sftp-server(8) now allow chmod-like operations to set > set[ug]id/sticky bits. > > * The MaxAuthTries option is now permitted in sshd_config(5) match > blocks. > > * Multiplexed ssh(1) sessions now support a subset of the ~ escapes > that are available to a primary connection. > > * ssh(1) connection multiplexing will now fall back to creating a new > connection in most error cases. > > * Added some basic interoperability tests against Twisted Conch. > > * Documented OpenSSH's extensions to and deviations from the published > SSH protocols (the PROTOCOL file in the distribution) > > * Documented OpenSSH's ssh-agent protocol (PROTOCOL.agent). > > Bugfixes > > * Make ssh(1) deal more gracefully with channel requests that fail. > Previously it would optimistically assume that requests would always > succeed, which could cause hangs if they did not (e.g. when the > server runs out of file descriptors). > > * ssh(1) now reports multiplexing errors via the multiplex slave's > stderr where possible (subject to LogLevel in the mux master). > > * ssh(1) and sshd(8) now send terminate protocol banners with CR+LF for > protocol 2 to comply with RFC 4253. Previously they were terminated > with CR alone. Protocol 1 banners remain CR terminated. > > * Merged duplicate authentication file checks in sshd(8) and refuse to > read authorised_keys and .shosts from non-regular files. > > * Ensure that sshd(8)'s umask disallows at least group and world write, > even if a more permissive one has been inherited. > > * Suppress the warning message from sshd(8) when changing to a > non-existent user home directory after chrooting. > > * Mention that scp(1) follows symlinks when performing recursive > copies. > > * Prevent sshd(8) from erroneously applying public key restrictions > leaned from ~/.ssh/authorized_keys to other authentication methods > when public key authentication subsequently fails. > > * Fix protocol keepalive timeouts - in some cases, keepalive packets > were being sent, but the connection was not being closed when the > limit for missing replies was exceeded. > > * Fix ssh(1) sending invalid TTY modes when a TTY was forced (ssh -tt) > but stdin was not a TTY. > > * ssh(1) will now exit with a non-zero exit status if > ExitOnForwardFailure was set and forwardings were disabled due to a > failed host key check. > > * Fix MaxAuthTries tests to disallow a free authentication try to > clients that skipped the protocol 2 "none" authentication method. > > * bz#1363: Make keepalive timeouts apply while synchronously waiting > for a packet, particularly during key renegotiation. > > * sshd(8) has been audited to eliminate fd leaks and calls to fatal() > in conditions of file descriptor exhaustion. > > Portable OpenSSH-specific bugfixes > > * Avoid a sshd(8) hang-on-exit on Solaris caused by depending on the > success of isatty() on a PTY master (undefined behaviour). Probably > affected other platforms too. > > * bz#1083: Fixed test for locked accounts on HP/UX with shadowed > passwords disabled. > > * bz#1386: Disable poll() fallback in atomiciov for Tru64. readv > doesn't seem to be a comparable object there, which lead to > compilation errors. > > * bz#1447: Fall back to racy rename if link returns EXDEV. > > * bz#1467: Explicitly handle EWOULDBLOCK wherever we handle EAGAIN, on > some platforms (HP nonstop) it is a distinct errno. > > * bz#1240: Avoid NULL dereferences in ancient sigaction replacement > code. > > * bz#1276: Avoid linking against libgssapi, which despite its name > doesn't seem to implement all of GSSAPI. > > * bz#1112: Use explicit noreturn attribute instead of __dead, fixing > compilation problems on Interix. > > * bz#1241: Support password expiry on Tru64 SIA systems. > > * bz#1462: Fix an UMAC alignment problem that manifested on Itanium > platforms. > > > Damien Miller > _______________________________________________ > openssh-unix-dev mailing list > openssh-unix-dev at mindrot.org > https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev >Dr Andy Tsouladze Sr Unix SysAdmin/System Architect
On Mon, 7 Jul 2008, Damien Miller wrote:> > Please send reports of success or failure to > openssh-unix-dev at mindrot.org.Cross-builds for cris arch. Quickly tested sftp-server; successfuly. OpenSSH has been configured with the following options: User binaries: /usr/bin System binaries: /usr/sbin Configuration files: /etc/ssh Askpass program: /usr/libexec/ssh-askpass Manual pages: .../target/cris-axis-linux-gnuuclibc/usr/share/man/manX PID file: /var/run Privilege separation chroot path: /var/empty sshd default user PATH: /usr/bin:/bin:/usr/sbin:/sbin Manpage format: doc PAM support: no OSF SIA support: no KerberosV support: no SELinux support: no Smartcard support: no S/KEY support: no TCP Wrappers support: no MD5 password support: yes libedit support: no Solaris process contract support: no IP address in $DISPLAY hack: no Translate v4 in v6 hack: yes BSD Auth support: no Random number source: OpenSSL internal ONLY Host: cris-axis-linux-gnuuclibc Compiler: gcc_cris -mlinux -mno-mul-bug-workaround -muclibc=.../target/cris-axis-linux-gnuuclibc Compiler flags: -Wall -Wshadow -O2 -g -Wall -Wpointer-arith -Wuninitialized -Wsign-compare -fno-builtin-memset -std=gnu99 Preprocessor flags: -I.../target/cris-axis-linux-gnuuclibc/lib Linker flags: -L.../target/cris-axis-linux-gnuuclibc/lib Libraries: -lcrypto -lutil -lz -lcrypt -lresolv -lresolv Warnings: xmalloc.h:26: warning: `__nonnull__' attribute directive ignored bindresvport.c: In function `bindresvport_sa': bindresvport.c:57: warning: declaration of `sin' shadows a global declaration <built-in>:0: warning: shadowed declaration is here rresvport.c: In function `rresvport_af': rresvport.c:92: warning: implicit declaration of function `close' umac.c:187: warning: declaration of `buffer_ptr' shadows a global declaration buffer.h:31: warning: shadowed declaration is here auth.c: In function `auth_openkeyfile': auth.c:489: warning: implicit declaration of function `close' I also get this warning from the linker: /usr/local/cris/r64/lib/gcc-lib/cris-axis-linux-gnu/3.2.1/../../../../cris-axis-linux-gnu/bin/ld: warning: type and size of dynamic symbol `AES_encrypt' are not defined which goes away if I build with: CFLAGS += -DUSE_BUILTIN_RIJNDAEL -- Cristian
On Mon, 7 Jul 2008, Damien Miller wrote:> OpenSSH 5.1 is almost ready for release, so we would appreciate testing > on as many platforms and systems as possible. This release is one of > the biggest in recent years, with two hackathons' worth of improvements > and fixes for some of our most recalcitrant bugs.Does this version have the clear-text-after-authentication patch in it? The amateur radio people still need this tweak in order to use OpenSSH over ham radio data links. The FCC does not allow encryption of data on our frequencies, but does allow encryption for authentication purposes. We don't much care if it requires some new oddball command line options, as long as it's supported in the base OpenSSH code and generally compiled in. We'd like it to eventually be available on most Linux distributions ready-to-go for us. In other words, compiling in the patch from the HPN mods is beyond a lot of hams. -- Curt, WE7U. archer at eskimo dot com http://www.eskimo.com/~archer Lotto: A tax on people who are bad at math. - unknown Windows: Microsoft's tax on computer illiterates. - WE7U. The world DOES revolve around me: I picked the coordinate system!"
All tests okay on Leopard 10.5.4 $ uname -a Darwin syd.local 9.4.0 Darwin Kernel Version 9.4.0: Mon Jun 9 19:30:53 PDT 2008; root:xnu-1228.5.20~1/RELEASE_I386 i386 $ cc --version i686-apple-darwin9-gcc-4.0.1 (GCC) 4.0.1 (Apple Inc. build 5465) Copyright (C) 2005 Free Software Foundation, Inc. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. $ ./ssh -V OpenSSH_5.0p1-snap20080709, OpenSSL 0.9.7l 28 Sep 2006 On Jul 6, 2008, at 7:30 PM, Damien Miller wrote:> Hi, > > OpenSSH 5.1 is almost ready for release, so we would appreciate > testing > on as many platforms and systems as possible. This release is one of > the biggest in recent years, with two hackathons' worth of > improvements > and fixes for some of our most recalcitrant bugs. > > Snapshot releases for portable OpenSSH are available from > http://www.mindrot.org/openssh_snap/ > > The OpenBSD version is available in CVS HEAD: > http://www.openbsd.org/anoncvs.html > > Portable OpenSSH is also available via anonymous CVS using the > instructions at http://www.openssh.com/portable.html#cvs > > Running the regression tests supplied with Portable OpenSSH does not > require installation and is a simply: > > $ ./configure && make tests > > Live testing on suitable non-production systems is also appreciated. > Please send reports of success or failure to > openssh-unix-dev at mindrot.org. > > Below is a summary of changes. More detail may be found in the > ChangeLog in the portable OpenSSH tarballs. > > Thanks to the many people who contributed to this release. > > > New features: > > * Introduce experimental SSH Fingerprint ASCII Visualisation to ssh(1) > and ssh-keygen(1). Visual fingerprinnt display is controlled by a > new > ssh_config(5) option "VisualHostKey". The intent is to render > SSH host keys in a visual form that is amenable to easy recall and > rejection of changed host keys. This technique inspired by the > graphical hash visualisation schemes known as "random art[*]", and > by Dan Kaminsky's musings at 23C3 in Berlin. > Fingerprint visualisation in is currently disabled by default, as > the > algorithm used to generate the random art is still subject to > change. > [*] "Hash Visualization: a New Technique to improve Real-World > Security", Perrig A. and Song D., 1999, International Workshop > on > Cryptographic Techniques and E-Commerce (CrypTEC '99) > http://sparrow.ece.cmu.edu/~adrian/projects/validation/ > validation.pdf > > * sshd_config(5) now supports CIDR address/masklen matching in "Match > address" blocks, with a fallback to classic wildcard matching. For > example: > Match address 192.0.2.0/24,3ffe:ffff::/32,!10.* > PasswordAuthentication yes > > * sshd(8) now supports CIDR matching in ~/.ssh/authorized_keys > from="..." restrictions, also with a fallback to classic wildcard > matching. > > * Added an extended test mode (-T) to sshd(8) to request that it write > its effective configuration to stdout and exit. Extended test mode > also supports the specification of connection parameters (username, > source address and hostname) to test the application of > sshd_config(5) Match rules. > > * sftp-server(8) now supports extension methods statvfs at openssh.com > and > fstatvfs at openssh.com that implement statvfs(2)-like operations. > > * sftp(1) now has a "df" command to the sftp client that uses the > statvfs at openssh.com to produce a df(1)-like display of filesystem > space and inode utilisation (requires statvfs at openssh.com support on > the server) > > * Added a MaxSessions option to sshd_config(5) to allow control of the > number of multiplexed sessions supported over a single TCP > connection. > This allows increasing the number of allowed sessions above the > previous default of 10, disabling connection multiplexing > (MaxSessions=1) or disallowing login/shell/subsystem sessions > entirely (MaxSessions=0). > > * Added a no-more-sessions at openssh.com global request extension that > is > sent from ssh(1) to sshd(8) when the client knows that it will never > request another session (i.e. when session multiplexing is > disabled). > This allows a server to disallow further session requests and > terminate the session in cases where the client has been hijacked. > > * ssh-keygen(1) now supports the use of the -l option in combination > with -F to search for a host in ~/.ssh/known_hosts and display its > fingerprint. > > * ssh-keyscan(1) now defaults to "rsa" (protocol 2) keys, instead of > "rsa1". > > * Added an AllowAgentForwarding option to sshd_config(8) to control > whether authentication agent forwarding is permitted. Note that this > is a loose control, as a client may install their own unofficial > forwarder. > > * Avoid unnecessary malloc/copy/free when receiving network data, > resulting in a ~10% speedup > > * ssh(1) and sshd(8) will now try additional addresses when connecting > to a port forward destination whose DNS name resolves to more than > one address. The previous behaviour was to try the only first > address > and give up if that failed. > > * ssh(1) and sshd(8) now support signalling that channels are > half-closed for writing, through a channel protocol extension > notification "eow at openssh.com". This allows propagation of closed > file descriptors, so that commands such as: > "ssh -2 localhost od /bin/ls | true" > do not send unnecessary data over the wire. (bz#85) > > * sshd(8): increased the default size of ssh protocol 1 ephemeral keys > from 768 to 1024 bits. > > * When ssh(1) has been requested to fork after authentication > ("ssh -f") with ExitOnForwardFailure enabled, delay the fork until > after replies for any -R forwards have been seen. Allows for robust > detection of -R forward failure when using -f. > > * "Match group" blocks in sshd_config(5) now support negation of > groups. E.g. "Match group staff,!guests" > > * sftp(1) and sftp-server(8) now allow chmod-like operations to set > set[ug]id/sticky bits. > > * The MaxAuthTries option is now permitted in sshd_config(5) match > blocks. > > * Multiplexed ssh(1) sessions now support a subset of the ~ escapes > that are available to a primary connection. > > * ssh(1) connection multiplexing will now fall back to creating a new > connection in most error cases. > > * Added some basic interoperability tests against Twisted Conch. > > * Documented OpenSSH's extensions to and deviations from the published > SSH protocols (the PROTOCOL file in the distribution) > > * Documented OpenSSH's ssh-agent protocol (PROTOCOL.agent). > > Bugfixes > > * Make ssh(1) deal more gracefully with channel requests that fail. > Previously it would optimistically assume that requests would always > succeed, which could cause hangs if they did not (e.g. when the > server runs out of file descriptors). > > * ssh(1) now reports multiplexing errors via the multiplex slave's > stderr where possible (subject to LogLevel in the mux master). > > * ssh(1) and sshd(8) now send terminate protocol banners with CR+LF > for > protocol 2 to comply with RFC 4253. Previously they were terminated > with CR alone. Protocol 1 banners remain CR terminated. > > * Merged duplicate authentication file checks in sshd(8) and refuse to > read authorised_keys and .shosts from non-regular files. > > * Ensure that sshd(8)'s umask disallows at least group and world > write, > even if a more permissive one has been inherited. > > * Suppress the warning message from sshd(8) when changing to a > non-existent user home directory after chrooting. > > * Mention that scp(1) follows symlinks when performing recursive > copies. > > * Prevent sshd(8) from erroneously applying public key restrictions > leaned from ~/.ssh/authorized_keys to other authentication methods > when public key authentication subsequently fails. > > * Fix protocol keepalive timeouts - in some cases, keepalive packets > were being sent, but the connection was not being closed when the > limit for missing replies was exceeded. > > * Fix ssh(1) sending invalid TTY modes when a TTY was forced (ssh -tt) > but stdin was not a TTY. > > * ssh(1) will now exit with a non-zero exit status if > ExitOnForwardFailure was set and forwardings were disabled due to a > failed host key check. > > * Fix MaxAuthTries tests to disallow a free authentication try to > clients that skipped the protocol 2 "none" authentication method. > > * bz#1363: Make keepalive timeouts apply while synchronously waiting > for a packet, particularly during key renegotiation. > > * sshd(8) has been audited to eliminate fd leaks and calls to fatal() > in conditions of file descriptor exhaustion. > > Portable OpenSSH-specific bugfixes > > * Avoid a sshd(8) hang-on-exit on Solaris caused by depending on the > success of isatty() on a PTY master (undefined behaviour). Probably > affected other platforms too. > > * bz#1083: Fixed test for locked accounts on HP/UX with shadowed > passwords disabled. > > * bz#1386: Disable poll() fallback in atomiciov for Tru64. readv > doesn't seem to be a comparable object there, which lead to > compilation errors. > > * bz#1447: Fall back to racy rename if link returns EXDEV. > > * bz#1467: Explicitly handle EWOULDBLOCK wherever we handle EAGAIN, on > some platforms (HP nonstop) it is a distinct errno. > > * bz#1240: Avoid NULL dereferences in ancient sigaction replacement > code. > > * bz#1276: Avoid linking against libgssapi, which despite its name > doesn't seem to implement all of GSSAPI. > > * bz#1112: Use explicit noreturn attribute instead of __dead, fixing > compilation problems on Interix. > > * bz#1241: Support password expiry on Tru64 SIA systems. > > * bz#1462: Fix an UMAC alignment problem that manifested on Itanium > platforms. > > > Damien Miller > _______________________________________________ > openssh-unix-dev mailing list > openssh-unix-dev at mindrot.org > https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev-------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/pkcs7-signature Size: 2274 bytes Desc: not available Url : http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20080708/11e26fc5/attachment.bin
On Mon, Jul 07, 2008 at 09:30:55 +1000, Damien Miller wrote:> OpenSSH 5.1 is almost ready for release, so we would appreciate testing > on as many platforms and systems as possible. This release is one of > the biggest in recent years, with two hackathons' worth of improvements > and fixes for some of our most recalcitrant bugs. >The following platforms passwd all tests using the 20080715 snapshot: Red Hat Enterprise Linux 4 (amd64) Red Hat Enterprise Linux 5 (amd64) Solaris 9 (SPARC) Mac OS X 10.4 (PPC) SuSE Linux Enterprise Server 10 (x86_64) SuSE Linux Enterprise Server 10 (IA64) AIX 5.3 -- Iain Morgan