Changelog for openssh-clients-8.3p1-2.523.x86_64.rpm :

* Thu Oct 08 2020 Hans Petter Jansson - Work around %service_add_post disabling sshd on upgrade with package name change (bsc#1177039).
* Fri Sep 25 2020 Dominique Leuenberger - Fix fillup-template usage: + %post server needs to reference ssh (not sshd), which matches the sysconfig.ssh file name the package ships. + %post client does not need any fillup_ calls, as there is no client-relevant sysconfig file present. The naming of the sysconfig file (ssh instead of sshd) is unfortunate.
* Fri Sep 25 2020 Franck Bui - Use of DISABLE_RESTART_ON_UPDATE is deprecated. Replace it with %service_del_postun_without_restart
* Thu Sep 17 2020 Jan Engelhardt - Move some Requires to the right subpackage.- Avoid \">&\" bashism in %post.- Upgrade some old specfile constructs/macros and drop unnecessary %{?systemd_
*}.- Trim descriptions and straighten out the grammar.
* Thu Sep 10 2020 Hans Petter Jansson - Split openssh package into openssh, openssh-common, openssh-server and openssh-clients. This allows for the ssh clients to be installed without the server component (bsc#1176434).
* Sat Jun 13 2020 Arachnos- Added openssh-8.3p1-obfuscated.patch for handshake obfuscation.
* Fri Jun 05 2020 Hans Petter Jansson - Version update to 8.3p1: = Potentially-incompatible changes
* sftp(1): reject an argument of \"-1\" in the same way as ssh(1) and scp(1) do instead of accepting and silently ignoring it. = New features
* sshd(8): make IgnoreRhosts a tri-state option: \"yes\" to ignore rhosts/shosts, \"no\" allow rhosts/shosts or (new) \"shosts-only\" to allow .shosts files but not .rhosts.
* sshd(8): allow the IgnoreRhosts directive to appear anywhere in a sshd_config, not just before any Match blocks.
* ssh(1): add %TOKEN percent expansion for the LocalFoward and RemoteForward keywords when used for Unix domain socket forwarding.
* all: allow loading public keys from the unencrypted envelope of a private key file if no corresponding public key file is present.
* ssh(1), sshd(8): prefer to use chacha20 from libcrypto where possible instead of the (slower) portable C implementation included in OpenSSH.
* ssh-keygen(1): add ability to dump the contents of a binary key revocation list via \"ssh-keygen -lQf /path\".- Additional changes from 8.2p1 release: = Potentially-incompatible changes
* ssh(1), sshd(8), ssh-keygen(1): this release removes the \"ssh-rsa\" (RSA/SHA1) algorithm from those accepted for certificate signatures (i.e. the client and server CASignatureAlgorithms option) and will use the rsa-sha2-512 signature algorithm by default when the ssh-keygen(1) CA signs new certificates.
* ssh(1), sshd(8): this release removes diffie-hellman-group14-sha1 from the default key exchange proposal for both the client and server.
* ssh-keygen(1): the command-line options related to the generation and screening of safe prime numbers used by the diffie-hellman-group-exchange-
* key exchange algorithms have changed. Most options have been folded under the -O flag.
* sshd(8): the sshd listener process title visible to ps(1) has changed to include information about the number of connections that are currently attempting authentication and the limits configured by MaxStartups.
* ssh-sk-helper(8): this is a new binary. It is used by the FIDO/U2F support to provide address-space isolation for token middleware libraries (including the internal one). It needs to be installed in the expected path, typically under /usr/libexec or similar. = New features
* This release adds support for FIDO/U2F hardware authenticators to OpenSSH. U2F/FIDO are open standards for inexpensive two-factor authentication hardware that are widely used for website authentication. In OpenSSH FIDO devices are supported by new public key types \"ecdsa-sk\" and \"ed25519-sk\", along with corresponding certificate types.
* sshd(8): add an Include sshd_config keyword that allows including additional configuration files via glob(3) patterns.
* ssh(1)/sshd(8): make the LE (low effort) DSCP code point available via the IPQoS directive.
* ssh(1): when AddKeysToAgent=yes is set and the key contains no comment, add the key to the agent with the key\'s path as the comment.
* ssh-keygen(1), ssh-agent(1): expose PKCS#11 key labels and X.509 subjects as key comments, rather than simply listing the PKCS#11 provider library path.
* ssh-keygen(1): allow PEM export of DSA and ECDSA keys.
* ssh(1), sshd(8): make zlib compile-time optional, available via the Makefile.inc ZLIB flag on OpenBSD or via the --with-zlib configure option for OpenSSH portable.
* sshd(8): when clients get denied by MaxStartups, send a notification prior to the SSH2 protocol banner according to RFC4253 section 4.2.
* ssh(1), ssh-agent(1): when invoking the $SSH_ASKPASS prompt program, pass a hint to the program to describe the type of desired prompt. The possible values are \"confirm\" (indicating that a yes/no confirmation dialog with no text entry should be shown), \"none\" (to indicate an informational message only), or blank for the original ssh-askpass behaviour of requesting a password/phrase.
* ssh(1): allow forwarding a different agent socket to the path specified by $SSH_AUTH_SOCK, by extending the existing ForwardAgent option to accepting an explicit path or the name of an environment variable in addition to yes/no.
* ssh-keygen(1): add a new signature operations \"find-principals\" to look up the principal associated with a signature from an allowed- signers file.
* sshd(8): expose the number of currently-authenticating connections along with the MaxStartups limit in the process title visible to \"ps\".- Rebased patches:
* openssh-7.7p1-cavstest-ctr.patch
* openssh-7.7p1-cavstest-kdf.patch
* openssh-7.7p1-fips.patch
* openssh-7.7p1-fips_checks.patch
* openssh-7.7p1-ldap.patch
* openssh-7.7p1-no_fork-no_pid_file.patch
* openssh-7.7p1-sftp_print_diagnostic_messages.patch
* openssh-8.0p1-gssapi-keyex.patch
* openssh-8.1p1-audit.patch
* openssh-8.1p1-seccomp-clock_nanosleep.patch- Removed openssh-7.7p1-seed-prng.patch (bsc#1165158).
* Sun May 31 2020 Andreas Stieger - add upstream signing key to actually verify source signature
* Fri Feb 28 2020 Ludwig Nussel - Don\'t recommend xauth to avoid pulling in X.
* Tue Feb 18 2020 Fabian Vogt - Add patches to fix the sandbox blocking glibc on 32bit platforms (boo#1164061):
* openssh-8.1p1-seccomp-clock_nanosleep_time64.patch
* openssh-8.1p1-seccomp-clock_gettime64.patch
* Tue Feb 11 2020 Hans Petter Jansson - Add openssh-8.1p1-use-openssl-kdf.patch (jsc#SLE-9443). This performs key derivation using OpenSSL\'s SSHKDF facility, which allows OpenSSH to benefit from the former\'s FIPS certification status.
* Thu Nov 21 2019 Hans Petter Jansson - Make sure ssh-keygen runs if SSHD_AUTO_KEYGEN variable is unset or contains an unrecognized value (bsc#1157176).
* Fri Nov 08 2019 Cristian Rodríguez - Add openssh-8.1p1-seccomp-clock_nanosleep.patch, allow clock_nanosleep glibc master implements multiple functions using that syscall making the privsep sandbox kill the preauth process.
* Thu Oct 17 2019 Hans Petter Jansson - Update openssh-7.7p1-audit.patch to fix crash (bsc#1152730). Fix by Enzo Matsumiya (ematsumiyaAATTsuse.com). This was integrated in a separate code stream merged with the Oct. 10 update; the patch was also rebased and renamed to openssh-8.1p1-audit.patch.
* Mon Oct 14 2019 Hans Petter Jansson - Add openssh-7.9p1-keygen-preserve-perms.patch (bsc#1150574). This attempts to preserve the permissions of any existing known_hosts file when modified by ssh-keygen (for instance, with -R).- Added openssh-7.9p1-revert-new-qos-defaults.patch, which reverts an upstream commit that caused compatibility issues with other software (bsc#1136402).
* Mon Oct 14 2019 Hans Petter Jansson - Run \'ssh-keygen -A\' on startup only if SSHD_AUTO_KEYGEN=\"yes\" in /etc/sysconfig/ssh. This is set to \"yes\" by default, but can be changed by the system administrator (bsc#1139089).
* Mon Oct 14 2019 Hans Petter Jansson - Add openssh-7.9p1-keygen-preserve-perms.patch (bsc#1150574). This attempts to preserve the permissions of any existing known_hosts file when modified by ssh-keygen (for instance, with -R).
* Thu Oct 10 2019 Hans Petter Jansson - Version update to 8.1p1:
* ssh-keygen(1): when acting as a CA and signing certificates with an RSA key, default to using the rsa-sha2-512 signature algorithm. Certificates signed by RSA keys will therefore be incompatible with OpenSSH versions prior to 7.2 unless the default is overridden (using \"ssh-keygen -t ssh-rsa -s ...\").
* ssh(1): Allow %n to be expanded in ProxyCommand strings
* ssh(1), sshd(8): Allow prepending a list of algorithms to the default set by starting the list with the \'^\' character, E.g. \"HostKeyAlgorithms ^ssh-ed25519\"
* ssh-keygen(1): add an experimental lightweight signature and verification ability. Signatures may be made using regular ssh keys held on disk or stored in a ssh-agent and verified against an authorized_keys-like list of allowed keys. Signatures embed a namespace that prevents confusion and attacks between different usage domains (e.g. files vs email).
* ssh-keygen(1): print key comment when extracting public key from a private key.
* ssh-keygen(1): accept the verbose flag when searching for host keys in known hosts (i.e. \"ssh-keygen -vF host\") to print the matching host\'s random-art signature too.
* All: support PKCS8 as an optional format for storage of private keys to disk. The OpenSSH native key format remains the default, but PKCS8 is a superior format to PEM if interoperability with non-OpenSSH software is required, as it may use a less insecure key derivation function than PEM\'s.- Additional changes from 8.0p1 release:
* scp(1): Add \"-T\" flag to disable client-side filtering of server file list.
* sshd(8): Remove support for obsolete \"host/port\" syntax.
* ssh(1), ssh-agent(1), ssh-add(1): Add support for ECDSA keys in PKCS#11 tokens.
* ssh(1), sshd(8): Add experimental quantum-computing resistant key exchange method, based on a combination of Streamlined NTRU Prime 4591^761 and X25519.
* ssh-keygen(1): Increase the default RSA key size to 3072 bits, following NIST Special Publication 800-57\'s guidance for a 128-bit equivalent symmetric security level.
* ssh(1): Allow \"PKCS11Provider=none\" to override later instances of the PKCS11Provider directive in ssh_config,
* sshd(8): Add a log message for situations where a connection is dropped for attempting to run a command but a sshd_config ForceCommand=internal-sftp restriction is in effect.
* ssh(1): When prompting whether to record a new host key, accept the key fingerprint as a synonym for \"yes\". This allows the user to paste a fingerprint obtained out of band at the prompt and have the client do the comparison for you.
* ssh-keygen(1): When signing multiple certificates on a single command-line invocation, allow automatically incrementing the certificate serial number.
* scp(1), sftp(1): Accept -J option as an alias to ProxyJump on the scp and sftp command-lines.
* ssh-agent(1), ssh-pkcs11-helper(8), ssh-add(1): Accept \"-v\" command-line flags to increase the verbosity of output; pass verbose flags though to subprocesses, such as ssh-pkcs11-helper started from ssh-agent.
* ssh-add(1): Add a \"-T\" option to allowing testing whether keys in an agent are usable by performing a signature and a verification.
* sftp-server(8): Add a \"lsetstatAATTopenssh.com\" protocol extension that replicates the functionality of the existing SSH2_FXP_SETSTAT operation but does not follow symlinks.
* sftp(1): Add \"-h\" flag to chown/chgrp/chmod commands to request they do not follow symlinks.
* sshd(8): Expose $SSH_CONNECTION in the PAM environment. This makes the connection 4-tuple available to PAM modules that wish to use it in decision-making.
* sshd(8): Add a ssh_config \"Match final\" predicate Matches in same pass as \"Match canonical\" but doesn\'t require hostname canonicalisation be enabled.
* sftp(1): Support a prefix of \'AATT\' to suppress echo of sftp batch commands.
* ssh-keygen(1): When printing certificate contents using \"ssh-keygen -Lf /path/certificate\", include the algorithm that the CA used to sign the cert.- Rebased patches:
* openssh-7.7p1-IPv6_X_forwarding.patch
* openssh-7.7p1-X_forward_with_disabled_ipv6.patch
* openssh-7.7p1-cavstest-ctr.patch
* openssh-7.7p1-cavstest-kdf.patch
* openssh-7.7p1-disable_openssl_abi_check.patch
* openssh-7.7p1-fips.patch
* openssh-7.7p1-fips_checks.patch
* openssh-7.7p1-hostname_changes_when_forwarding_X.patch
* openssh-7.7p1-ldap.patch
* openssh-7.7p1-seed-prng.patch
* openssh-7.7p1-sftp_force_permissions.patch
* openssh-7.7p1-sftp_print_diagnostic_messages.patch
* openssh-8.0p1-gssapi-keyex.patch (formerly openssh-7.7p1-gssapi_key_exchange.patch)
* openssh-8.1p1-audit.patch (formerly openssh-7.7p1-audit.patch)- Removed patches (integrated upstream):
* 0001-upstream-Fix-two-race-conditions-in-sshd-relating-to.patch
* openssh-7.7p1-seccomp_ioctl_s390_EP11.patch
* openssh-7.9p1-CVE-2018-20685.patch
* openssh-7.9p1-brace-expansion.patch
* openssh-CVE-2019-6109-force-progressmeter-update.patch
* openssh-CVE-2019-6109-sanitize-scp-filenames.patch
* openssh-CVE-2019-6111-scp-client-wildcard.patch- Removed patches (obsolete):
* openssh-openssl-1_0_0-compatibility.patch
* Mon Aug 19 2019 kukukAATTsuse.de- don\'t install SuSEfirewall2 service on Factory, since SuSEfirewall2 has been replaced by firewalld, see [1]. [1]: https://lists.opensuse.org/opensuse-factory/2019-01/msg00490.html
* Mon Jul 22 2019 Fabian Vogt - ssh-askpass: Try a fallback if the other option is not available
* Fri May 31 2019 Vítězslav Čížek - Fix a crash with GSSAPI key exchange (bsc#1136104)
* modify openssh-7.7p1-gssapi_key_exchange.patch
* Thu Mar 28 2019 Vítězslav Čížek - Fix a double free() in the KDF CAVS testing tool (bsc#1065237)
* modify openssh-7.7p1-cavstest-kdf.patch
* Tue Mar 12 2019 Vítězslav Čížek - Minor clean-up of the fips patches, modified openssh-7.7p1-fips.patch openssh-7.7p1-fips_checks.patch
* Mon Mar 11 2019 Vítězslav Čížek - Fix two race conditions in sshd relating to SIGHUP (bsc#1119183)
* 0001-upstream-Fix-two-race-conditions-in-sshd-relating-to.patch
* Thu Feb 28 2019 Vítězslav Čížek - Correctly filter out non-compliant algorithms when in FIPS mode (bsc#1126397)
* A hunk was applied to a wrong place due to a patch fuzz when the fips patch was being ported to openssh 7.9p1- update openssh-7.7p1-fips.patch
* Wed Feb 27 2019 Vítězslav Čížek - Remove the \"KexDHMin\" config keyword (bsc#1127180) It used to allow lowering of the minimal allowed DH group size, which was increased to 2048 by upstream in the light of the Logjam attack. The code was broken since the upgrade to 7.6p1, but nobody noticed. As apparently no one needs the functionality any more, let\'s drop the patch. It\'s still possible to use the fixed 1024-bit diffie-hellman-group1-sha1 key exchange method when working with legacy systems.- drop openssh-7.7p1-disable_short_DH_parameters.patch- updated patches: openssh-7.7p1-fips.patch openssh-7.7p1-fips_checks.patch openssh-7.7p1-gssapi_key_exchange.patch
* Mon Feb 18 2019 Pedro Monreal Gonzalez - Handle brace expansion in scp when checking that filenames sent by the server side match what the client requested [bsc#1125687]
* openssh-7.9p1-brace-expansion.patch
* Thu Feb 14 2019 Pedro Monreal Gonzalez - Updated security fixes:
* [bsc#1121816, CVE-2019-6109] Sanitize scp filenames via snmprintf and have progressmeter force an update at the beginning and end of each transfer. Added patches: - openssh-CVE-2019-6109-sanitize-scp-filenames.patch - openssh-CVE-2019-6109-force-progressmeter-update.patch
* [bsc#1121821, CVE-2019-6111] Check in scp client that filenames sent during remote->local directory copies satisfy the wildcard specified by the user. Added patch: - openssh-CVE-2019-6111-scp-client-wildcard.patch
* Removed openssh-7.9p1-scp-name-validator.patch
* Thu Feb 14 2019 Tomáš Chvátal - Change the askpass wrapper to not use x11 interface:
* by default we use the -gnome UI (which is gtk3 only, no gnome dep)
* if desktop is KDE/LxQt we use ksshaskpass
* Mon Jan 28 2019 Pedro Monreal Gonzalez - Remove old conditionals
* Fri Jan 25 2019 Pedro Monreal Gonzalez - Move ssh-ldap
* man pages into openssh-helpers [bsc#1051531]
* Thu Jan 24 2019 Pedro Monreal Gonzalez - Allow root login by default [bsc#1118114, bsc#1121196]
* Added/updated previous patch openssh-7.7p1-allow_root_password_login.patch
* Mention the change in README.SUSE
* Thu Jan 24 2019 Pedro Monreal Gonzalez - Added SLE conditionals in the spec files:
* Keep gtk2-devel in openssh-askpass-gnome in SLE
* Keep krb5-mini-devel in SLE- Removed obsolete configure options:
* SSH protocol 1 --with-ssh1
* Smart card --with-opensc- Cleaned spec file with spec-cleaner
* Wed Jan 16 2019 Pedro Monreal Gonzalez - Security fix:
* [bsc#1121816, CVE-2019-6109] scp client spoofing via object name
* [bsc#1121818, CVE-2019-6110] scp client spoofing via stderr
* [bsc#1121821, CVE-2019-6111] scp client missing received object name validation
* Added patch openssh-7.9p1-scp-name-validator.patch
* Fri Jan 11 2019 Pedro Monreal Gonzalez - Security fix: [bsc#1121571, CVE-2018-20685]
* The scp client allows remote SSH servers to bypass intended access restrictions
* Added patch openssh-7.9p1-CVE-2018-20685.patch
* Thu Jan 03 2019 Pedro Monreal Gonzalez - Added compatibility with SuSEfirewall2 [bsc#1118044]