similar to: Potential problem in derelativise_path

https://bugzilla.mindrot.org/show_bug.cgi?id=1748 Summary: getcwd being called with invalid argument in servconf.c Product: Portable OpenSSH Version: 5.4p1 Platform: Sparc OS/Version: Solaris Status: NEW Severity: critical Priority: P2 Component: sshd AssignedTo: unassigned-bugs

https://bugzilla.mindrot.org/show_bug.cgi?id=1739 Summary: getcwd does not support size zero argument on Solaris Product: Portable OpenSSH Version: 5.4p1 Platform: Sparc OS/Version: Solaris Status: NEW Severity: normal Priority: P2 Component: sshd AssignedTo: unassigned-bugs at mindrot.org

Hi, in configure.in the patch for `setvbuf' is missing while in sftp-int.c the HAVE_SETVBUF define is used: Index: configure.in =================================================================== RCS file: /cvs/openssh_cvs/configure.in,v retrieving revision 1.286 diff -u -p -r1.286 configure.in --- configure.in 2001/05/17 03:32:51 1.286 +++ configure.in 2001/05/22 11:59:54 @@ -460,7 +460,7

On Feb 22 16:02, Darren Tucker wrote: > On Fri, Feb 22, 2019 at 03:32:43PM +1100, Darren Tucker wrote: > > On Wed, 20 Feb 2019 at 23:54, Corinna Vinschen <vinschen at redhat.com> wrote: > > > The previous revert enabled case-insensitive user names again. This > > > patch implements the case-insensitive user and group name matching. > > > To allow Unicode

Windows usernames are case-insensitive and almost any Unicode character is allowed in a username. The user should be able to login with her username given in any case and not be refused. However, this opens up a security problem in terms of the sshd_config Match rules. The match rules for user and group names have to operate case-insensitive as well, otherwise the user can override her settings

Hi, I just tried to build the latest portable code from CVS on Cygwin. I stumbled over a problem with the definitions of gai_strerror and ssh_gai_strerror. On systems not having gai_strerror, the fake-rfc2553.c file defines its own version of gai_strerror, and fake-rfc2553.h additionally has this definition of gai_strerror: #define gai_strerror(a) (ssh_gai_strerror(a)) OTOH, misc.c

Hi, I've just trieed to build OpenSSH on Cygwin with Kerberos support enabled, and while doing that I stumbled over a problem: The openbsd-compat/bsd-cygwin_util.h header include a Windows header, and depending on which Win32 header files are included (Mingw32/Mingw64) that can result in a `#define _WIN32'. This in turn can break linking against some packages. In my case it's

The 2.1.1p3 release of portable OpenSSH has been uploaded to the OpenBSD ftp master site. In a few hours it will be available from one of the many mirrors listed at: http://www.openssh.com/portable.html This release fixes several bugs reported since the previous release and extends portability to NeXT and Reliant Unix. As usual, the OpenBSD team has been hard at work further polishing and

The 2.1.1p3 release of portable OpenSSH has been uploaded to the OpenBSD ftp master site. In a few hours it will be available from one of the many mirrors listed at: http://www.openssh.com/portable.html This release fixes several bugs reported since the previous release and extends portability to NeXT and Reliant Unix. As usual, the OpenBSD team has been hard at work further polishing and

Hi, the following patch fixes a potential security hole in the Cygwin version of sshd. If you're logging in to a Cygwin sshd with version 2 protocol using an arbitrary user name which is not in /etc/passwd, the forked sshd which is handling this connection crashes with a segmentation violation. The client side encounters an immediate disconnect ("Connection reset by peer").

Can interested users please test the latest snapshot at http://www.mindrot.org/misc/junk/openssh-SNAP-2000071102.tar.gz It contains quite a few fixes for small problems that have been reported in the last few weeks. Pending feedback it is going to become 2.1.1p3 Regards, Damien Miller --------------- Changelog: 20000711 - (djm) Fixup for AIX getuserattr() support from Tom Bertelson

Hi, I'm wondering if that's planned or just occuring accidentally. With OpenSSH 4.0 and the upcoming 4.1, I'm getting two entries in syslog when a pubkey authentication logon was successful: Apr 7 13:19:10 cathi sshd : PID 66116 : Accepted publickey for corinna from 192.168.129.6 port 40207 ssh2 Apr 7 13:19:10 cathi sshd : PID 67060 : Accepted publickey for corinna from

On Jan 26 22:00, Nico Kadel-Garcia wrote: > On Sat, Jan 26, 2019 at 6:30 PM Corinna Vinschen <vinschen at redhat.com> wrote: > > > > On Jan 26 18:12, Nico Kadel-Garcia wrote: > > > On Sat, Jan 26, 2019 at 5:07 PM Corinna Vinschen <vinschen at redhat.com> wrote: > > > > > > > > Microsoft hijacked the sshd service name without asking. >

Hi, the below patch solves the same problem for gids as has already been solved for uids. Windows has no concept of permanently changing the identity. It's always possible to revert to the original identity. Thanks, Corinna Index: uidswap.c =================================================================== RCS file: /cvs/openssh_cvs/uidswap.c,v retrieving revision 1.44 diff -p -u -r1.44

This issue has been discussed here and elsewhere a fair bit in the past year or so, but to re-address the issue... As of OpenSSH 2.9.something the ability to have an Xauthority located in /tmp was removed, with the following description in the ChangeLog : - markus at cvs.openbsd.org 2001/06/12 21:21:29 [session.c] remove xauth-cookie-in-tmp handling. use default $XAUTHORITY, since

On Mar 13 10:53, Darren Tucker wrote: > On Wed, 13 Mar 2019 at 00:59, Corinna Vinschen <vinschen at redhat.com> wrote: > [...] > > Great idea. I just built and tested it. Please go ahead. > > Applied, thanks. > > > What about my other patch to contrib/cygwin/ssh-host-config? > > The last message I have said "The commit message isn't quite right,

Hi, attached a total revamp of the ssh-host-config and ssh-user-config scripts. The underlying idea is that one of our maintainers has contributed a unified configuration script environment for Cygwin, called csih. This is now used by the below ssh config scripts as well. There's also an additional file called sshd-inetd, which is a service configuration file for inetutils. The Makefile

On Wed, 20 Feb 2019 at 23:54, Corinna Vinschen <vinschen at redhat.com> wrote: > The previous revert enabled case-insensitive user names again. This > patch implements the case-insensitive user and group name matching. > To allow Unicode chars, implement the matcher using wchar_t chars in > Cygwin-specific code. Keep the generic code changes as small as possible. > Cygwin:

On Aug 13 13:19, Corinna Vinschen wrote: > On Aug 10 11:16, Damien Miller wrote: > > Hi, > > > > OpenSSH 7.8p1 is almost ready for release, so we would appreciate testing > > on as many platforms and systems as possible. This is a bugfix release. > > Problems building on Cygwin, partially a result of a new GCC version. > I'm still collecting and fixing. I

Hi, could somebody apply the below patch, please? It removes a couple of environment variables which are propagated to the child process so far, but which not really necessary to keep child processes running. What's left now is the bare minimum which is requested by scripts, typically. Thanks, Corinna Index: openbsd-compat/bsd-cygwin_util.c