search for: close_listen_sock

...I've included the most obvious patch, but making sure that the full pathname is in saved_argv[0] just might be more secure. Cheers, Han Holl --- sshd.c.orig Mon Feb 19 10:55:54 2001 +++ sshd.c Mon Feb 19 10:56:15 2001 @@ -208,7 +208,7 @@ { log("Received SIGHUP; restarting."); close_listen_socks(); - execv(saved_argv[0], saved_argv); + execvp(saved_argv[0], saved_argv); log("RESTART FAILED: av0='%s', error: %s.", av0, strerror(errno)); exit(1); }

...================================================================ RCS file: /cvs/openssh/sshd.c,v retrieving revision 1.345 diff -u -r1.345 sshd.c --- sshd.c 24 Jul 2006 04:51:01 -0000 1.345 +++ sshd.c 3 Aug 2006 06:13:53 -0000 @@ -291,6 +291,7 @@ logit("Received SIGHUP; restarting."); close_listen_socks(); close_startup_pipes(); + alarm(0); /* alarm timer persists across exec */ execv(saved_argv[0], saved_argv); logit("RESTART FAILED: av[0]='%.100s', error: %.100s.", saved_argv[0], strerror(errno));

...======================================== RCS file: /cvs/openssh/sshd.c,v retrieving revision 1.361 diff -u -p -r1.361 sshd.c --- sshd.c 7 Nov 2006 12:14:42 -0000 1.361 +++ sshd.c 21 Feb 2007 06:37:18 -0000 @@ -305,6 +305,7 @@ sighup_restart(void) logit("Received SIGHUP; restarting."); close_listen_socks(); close_startup_pipes(); + alarm(0); /* alarm timer persists across exec */ execv(saved_argv[0], saved_argv); logit("RESTART FAILED: av[0]='%.100s', error: %.100s.", saved_argv[0], strerror(errno));

...Relevant source code looks like: ============================================================================= /* * Called from the main program after receiving SIGHUP. * Restarts the server. */ static void sighup_restart(void) { logit("Received SIGHUP; restarting."); close_listen_socks(); close_startup_pipes(); execv(saved_argv[0], saved_argv); logit("RESTART FAILED: av[0]='%.100s', error: %.100s.", saved_argv[0], strerror(errno)); exit(1); } ============================================================================...

I've searched the archive for this mailing list and the bug list for OpenSSH for this, and I'm finding nothing. I'd appreciate it if somoene could point me to an existing thread about this. (I know that other people are aware of the problem, though, so I'm a bit surprised to find nothing.) We're running OpenSSH under Solaris 10 using SMF instead of a legacy init script. SMF

...ause of the fork above). */ - log_init(__progname, options.log_level, options.log_facility, log_stderr); + log_init(__progname, options.log_level, options.log_facility, log_stderr, options.log_file); /* Initialize the random number generator. */ arc4random_stir(); @@ -1352,7 +1352,7 @@ close_listen_socks(); sock_in = newsock; sock_out = newsock; - log_init(__progname, options.log_level, options.log_facility, log_stderr); + log_init(__progname, options.log_level, options.log_facility, log_stderr, options.log_file); break; } }

Hi, I am happy to (re)send a set of patches for compiling OpenSSH 4.7p1 with FIPS 140-2 OpenSSL. These are based on previously reported patches by Steve Marquess <marquess at ieee.org> and Ben Laurie <ben at algroup.co.uk>, for ver. OpenSSH 3.8. Note that these patches are NOT OFFICIAL, and MAY be used freely by anyone. Issues [partially] handled: SSL FIPS Self test. RC4,