summary refs log tree commit diff
path: root/pkgs/tools/networking/openssh
Commit message (Collapse)AuthorAge
...
* openssh: 7.7p1 -> 7.9p1 (#48784)zimbatm2018-10-26
| | | | | | | | | | added openssh_gssapi to make it easier to test the patched version the HPN edition isn't available on top of 7.9p1 yet fix-host-key-algorithms-plus.patch didn't apply anymore, assuming it's fixed. release notes: https://www.openssh.com/txt/release-7.9
* openssh: fix tunnel forwarding (upstream patch)Vladimír Čunát2018-10-08
| | | | | Close #48031, fixes #48016. I didn't use the PR commit because I think it's better to fetch the patch.
* pkgs/*: remove unreferenced function argumentsvolth2018-07-21
|
* openssh: 7.6p1 -> 7.7p1Aneesh Agrawal2018-05-23
| | | | | | | | | Release notes at https://www.openssh.com/txt/release-7.7; primarily bugfixes. Update ssh-hpn as well. Switch to salsa.debian.org (from anonscm.debian.org).
* openssh_hpn: 7.5p1 -> 7.6p1Silvan Mosberger2018-04-07
|
* openssh: Build with Kerberos by defaultGraham Christensen2018-01-28
| | | | | | This reverts commit 09696e32c390c232ec7ac506df6457fb93c1f536. which reverted f596aa0f4a35f613422f85a4486e32ea20ca7739 to move it to staging
* Revert "openssh: Build with Kerberos by default"Graham Christensen2018-01-28
| | | | | | This reverts commit a232dd66ee0b390dc4d82858af7e15713bd60327. Moving to staging
* openssh: Build with Kerberos by defaultAneesh Agrawal2018-01-28
| | | | | | | | | | | | This can be disabled with the `withKerberos` flag if desired. Make the relevant assertions lazy, so that if an overlay is used to set kerberos to null, a later override can explicitly set `withKerberos` to false. Don't build with GSSAPI by default; the patchset is large and a bit hairy, and it is reasonable to follow upstream who has not merged it in not enabling it by default.
* Merge pull request #30137 from aneeshusa/update-openssh-to-7.6p1Orivej Desh2017-11-11
|\ | | | | openssh: 7.5p1 -> 7.6p1
| * openssh: 7.5p1 -> 7.6p1Aneesh Agrawal2017-10-06
| | | | | | | | | | Release notes are available at https://www.openssh.com/txt/release-7.6. Mostly a bugfix release, no major backwards-incompatible changes.
* | misc pkgs: Basic sed to get fix `pkgconfig` and `autoreconfHook` `buildInputs`John Ericson2017-09-21
|/ | | | Only acts on one-line dependency lists.
* openssh: update gssapi patchJörg Thalheim2017-09-12
|
* pkgs: refactor needless quoting of homepage meta attribute (#27809)Silvan Mosberger2017-08-01
| | | | | | | | | | | | * pkgs: refactor needless quoting of homepage meta attribute A lot of packages are needlessly quoting the homepage meta attribute (about 1400, 22%), this commit refactors all of those instances. * pkgs: Fixing some links that were wrongfully unquoted in the previous commit * Fixed some instances
* openssh: unset LDThomas Tuegel2017-07-21
| | | | | | Commit 093cc00cdd9d8cf31ecce5bc1dd3645c460a1b98, sets the LD environment variable by default, but this confuses the openssh Makefile because `configure' does not respect it.
* openssh: fixup build on HydraVladimír Čunát2017-06-07
| | | | http://hydra.nixos.org/build/53993444
* openssh_hpn: use new sources and version (7_5_P1)Tristan Helmich2017-04-14
| | | | Close #23990.
* openssh: 7.4p1 -> 7.5p1Aneesh Agrawal2017-04-10
| | | | | | | | Release notes are available at https://www.openssh.com/txt/release-7.5. Mostly a bugfix release, no major backwards-incompatible changes. Remove deprecated `UsePrivilegeSeparation` option, which is now mandatory.
* openssh: update the gssapi patchVladimír Čunát2016-12-29
| | | | Only building was tested.
* Revert "Revert "openssh: security 7.3p1 -> 7.4p1""Graham Christensen2016-12-29
| | | | This reverts commit 661b5a9875cbc37310da5ee53b47a1d121bb5660.
* Revert "openssh: security 7.3p1 -> 7.4p1"Vladimír Čunát2016-12-25
| | | | | | | | This reverts commit 277080fea0d2cf5017e4179a23e370307502c677. I had tested the server on my physical machine before pushing, but the openssh test got broken so something is clearly wrong. http://hydra.nixos.org/build/45500080
* openssh: security 7.3p1 -> 7.4p1Vladimír Čunát2016-12-25
| | | | | | The two removed patches were for issues that should've been fixed. Minor vulnerabilities addressed: CVE-2016-{10009,10010,10011,10012}. https://www.openssh.com/txt/release-7.4
* openssh: Patch CVE-2016-8858Aneesh Agrawal2016-10-20
| | | | Also add myself as a maintainer.
* openssh: apply patch to fix https://bugzilla.redhat.com/show_bug.cgi?id=1380296Graham Christensen2016-10-06
|
* treewide: Fix 'lib.optional' misusesTuomas Tynkkynen2016-10-01
| | | | These add a singleton list of a package to buildInputs.
* openssh: update gssapi patch, fix the buildBenjamin Staffin2016-09-14
|
* Merge remote-tracking branch 'upstream/master' into hardened-stdenvRobin Gloster2016-08-12
|\
| * openssh: 7.2p2 -> 7.3p1 (#17493)Aneesh Agrawal2016-08-07
| | | | | | Also remove patch for CVE-2015-8325 that has been fixed upstream.
* | Merge remote-tracking branch 'upstream/master' into hardened-stdenvRobin Gloster2016-07-19
|\|
| * openssh: Use the default privilege separation dir (/var/empty)Rickard Nilsson2016-07-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (This is a rewritten version of the reverted commit a927709a35cee56f878f0f57a932e1a6e2ebe23b, that disables the creation of /var/empty during build so that sandboxed builds also works. For more context, see https://github.com/NixOS/nixpkgs/pull/16966) If running NixOS inside a container where the host's root-owned files and directories have been mapped to some other uid (like nobody), the ssh daemon fails to start, producing this error message: fatal: /nix/store/...-openssh-7.2p2/empty must be owned by root and not group or world-writable. The reason for this is that when openssh is built, we explicitly set `--with-privsep-path=$out/empty`. This commit removes that flag which causes the default directory /var/empty to be used instead. Since NixOS' activation script correctly sets up that directory, the ssh daemon now also works within containers that have a non-root-owned nix store.
| * Revert "openssh: Use the default privilege separation dir (/var/empty)"Bjørn Forsman2016-07-15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit a927709a35cee56f878f0f57a932e1a6e2ebe23b because it doesn't build: $ nix-build -A openssh ... mkdir /nix/store/yl2xap8n1by3dqxgc4rmrc4s753676a3-openssh-7.2p2/libexec (umask 022 ; ./mkinstalldirs /var/empty) mkdir /var mkdir: cannot create directory '/var': Permission denied mkdir /var/empty mkdir: cannot create directory '/var/empty': No such file or directory make: *** [Makefile:304: install-files] Error 1 builder for ‘/nix/store/ifygp4mqpv7l8cgp0njp8w7lmrl6brpp-openssh-7.2p2.drv’ failed with exit code 2
| * openssh: Use the default privilege separation dir (/var/empty)Rickard Nilsson2016-07-14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | If running NixOS inside a container where the host's root-owned files and directories have been mapped to some other uid (like nobody), the ssh daemon fails to start, producing this error message: fatal: /nix/store/...-openssh-7.2p2/empty must be owned by root and not group or world-writable. The reason for this is that when openssh is built, we explicitly set `--with-privsep-path=$out/empty`. This commit removes that flag which causes the default directory /var/empty to be used instead. Since NixOS' activation script correctly sets up that directory, the ssh daemon now also works within containers that have a non-root-owned nix store.
* | Merge remote-tracking branch 'upstream/master' into hardened-stdenvRobin Gloster2016-04-18
|\|
| * openssh: fix CVE-2015-8325Aneesh Agrawal2016-04-15
| | | | | | | | | | Debian Security Advisory: https://www.debian.org/security/2016/dsa-3550 Upstream commit: https://anongit.mindrot.org/openssh.git/commit/?id=85bdcd7c92fe7ff133bbc4e10a65c91810f88755
* | Merge remote-tracking branch 'upstream/master' into hardened-stdenvRobin Gloster2016-04-03
|\|
| * ssh: Fix support for ssh-dss host keysEelco Dolstra2016-04-01
| |
* | Merge remote-tracking branch 'upstream/master' into hardened-stdenvRobin Gloster2016-03-15
|\|
| * openssh: update homepage linkAneesh Agrawal2016-03-10
| | | | | | | | Unfortunately, the site is not available over HTTPS.
| * openssh: 7.2p1 -> 7.2p2 for OSA x11fwd.advAneesh Agrawal2016-03-10
| | | | | | | | | | Fixes OpenSSH Security Advisory x11fwd.adv, which is available at http://www.openssh.com/txt/x11fwd.adv.
| * openssh: update GSSAPI patch to openssh 7.2Aneesh Agrawal2016-03-08
| |
| * openssh: decouple gssapi patch from kerberosAneesh Agrawal2016-03-08
| | | | | | | | | | | | | | | | The GSSAPI patch is useful but maintained by Debian, not upstream, and can be slow to update. To avoid breaking openssh_with_kerberos when the openssh version is bumped but the GSSAPI patch has not been updated, don't enable the GSSAPI patch implicitly but require it to be explicitly enabled.
* | Merge remote-tracking branch 'origin/master' into hardened-stdenvFranz Pletz2016-03-07
|\|
| * Merge pull request #13705 from aneeshusa/use-bin-instead-of-sbin-for-opensshjoachifm2016-03-07
| |\ | | | | | | openssh: use bin instead of sbin folder
| | * openssh: use bin instead of sbin folderAneesh Agrawal2016-03-05
| | | | | | | | | | | | References #11939.
| * | openssh: allow building without linking opensslAneesh Agrawal2016-03-06
| |/ | | | | | | | | | | | | http://undeadly.org/cgi?action=article&sid=20140430045723 has the original announcement of this option. Note, openssl headers are still required at build time, see this comment: http://www.gossamer-threads.com/lists/openssh/dev/61125#61125
* | Use general hardening flag toggle listsFranz Pletz2016-03-05
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The following parameters are now available: * hardeningDisable To disable specific hardening flags * hardeningEnable To enable specific hardening flags Only the cc-wrapper supports this right now, but these may be reused by other wrappers, builders or setup hooks. cc-wrapper supports the following flags: * fortify * stackprotector * pie (disabled by default) * pic * strictoverflow * format * relro * bindnow
* | Merge remote-tracking branch 'upstream/master' into hardened-stdenvRobin Gloster2016-03-01
|\|
| * openssh: Fix buildEelco Dolstra2016-03-01
| |
| * openssh: 7.1p2 -> 7.2p1Aneesh Agrawal2016-03-01
| |
* | openssh: enable pie hardeningRobin Gloster2016-02-26
|/
* openssh: update gssapi patch to match openssh versionBenjamin Staffin2016-02-20
| | | | | | | | Should fix the openssh_with_kerberos build. Fixes #13140 (cherry picked from commit 3dae6c7e1e1eb64b3ceb2796eea1ad0ae1596688)
generated by cgit-pink 1.4.1 (git 2.36.1) at 2024-06-25 16:59:50 +0000