Slashdot is powered by your submissions, so send in your scoop

 


Forgot your password?
Close
typodupeerror
×
Security Networking Operating Systems BSD

OpenSSH 4.0 & Portable OpenSSH 4.0p1 Released 73

Posted by timothy from the even-quieter-now dept.
UnderScan writes "As seen on openssh-unix-announce: 'OpenSSH 4.0 has just been released. It will be available from the mirrors listed at http://www.openssh.com/ shortly. OpenSSH is a 100% complete SSH protocol version 1.3, 1.5 and 2.0 implementation and includes sftp client and server support. We would like to thank the OpenSSH community for their continued support to the project, especially those who contributed source and bought T-shirts or posters.' See the changelog or the freshmeat.net changes summary for more details."
This discussion has been archived. No new comments can be posted.

OpenSSH 4.0 & Portable OpenSSH 4.0p1 Released More

OpenSSH 4.0 & Portable OpenSSH 4.0p1 Released

Comments Filter:

  • FreeBSD (Score:3, Informative)

    by numbski ( 515011 ) * <[numbski] [at] [hksilver.net]> on Wednesday March 09, 2005 @03:05PM (#11891633) Homepage Journal
    Hasn't hit ports. :\ [freshports.org]
    • Hasn't hit ports. :\

      What makes you think that there should be a port available on Freshports.org at the same time as the release of OpenSSH?

      • Re:FreeBSD (Score:3, Funny)

        by robbkidd ( 154298 )

        What makes you think that there should be a port available on Freshports.org at the same time as the release of OpenSSH?

        The new hacker/cracker challenge: zero day ports!

        • Re:FreeBSD (Score:3, Insightful)

          by ignorant_newbie ( 104175 )
          > The new hacker/cracker challenge: zero day ports!

          well, given where most of the good ports come from these days, the quickest route is to just install OpenBSD

  • Donations (Score:5, Informative)

    by Noksagt ( 69097 ) on Wednesday March 09, 2005 @03:29PM (#11891936) Homepage
    We would like to thank the OpenSSH community for their continued support to the project, especially those who contributed source and bought T-shirts or posters.
    You can also do what I plan to do: donate surplus hardware to OpenBSD, which runs the project. OpenBSD accepts other donations [openbsd.org] too:checks, credit cards, paypal.

  • Grrr.... (Score:3, Interesting)

    by stevew ( 4845 ) on Wednesday March 09, 2005 @03:29PM (#11891943) Journal
    I just updated to something like 3.95pl1 last weekend.

    Now I get to do it again....

    There sure is a lot to timing isn't there.

  • MD5 Incorrect (Score:4, Informative)

    by Nimrangul ( 599578 ) on Wednesday March 09, 2005 @04:07PM (#11892498) Journal
    Damien Miller: I botched the MD5 sum for the portable tarball in the release announcement. The correct one is:

    MD5 (openssh-4.0p1.tar.gz) = 7b36f28fc16e1b7f4ba3c1dca191ac92

    Source: http://www.undeadly.org/cgi?action=article&sid=200 50309172736 [undeadly.org]

  • On Freshmeat, 3.6.1p2, 3.7.1, and 3.7.1p2 are all listed as Major Security Fixes, and 3.9p1 is listed as Major Feature Enhancements. They are all point level or even less, patch level releases.

    Does anyone else find it a bit odd that 4.0p1 is listed as Minor Feature Enhancements, yet it gets a whole-digit version bump?

  • One feature I have been waiting for is the ability to chroot my users when they log in, even if just for file transfers. This would ensure that users would not be able to wander the entire directory tree of the server. I have had some success (on FreeBSD) with creating single jail for all client logins, and then applying some clever directory permissions for the higher directories (usualy o-x for directories). There was a commercial version of SSH that had a chroot feature, but I would prefer to stick with openssh. IMHO, this is the one area that FTP outdoes SFTP (but not enough for me to dumb my security down and allow FTP!!).

    Any other ideas?

    • Re:Any news on chroot support? (Score:1, Informative)

      by Anonymous Coward
      There is a SourceForge project at http://chrootssh.sourceforge.net/index.php that provides chroot patches for all OpenSSH versions. I believe the official developer's opinion on this is that it doesn't belong in OpenSSH which is why, well, it still isn't there.

    • Re:Any news on chroot support? (Score:5, Funny)

      by agent dero ( 680753 ) on Wednesday March 09, 2005 @04:55PM (#11893191) Homepage
      my personal policy is not to let anybody on my machines that I don't know personally.

      that way, when somebody messes something up or does something nasty, i'll know about them and promptly punch them in the face

      %cat /etc/motd
      FreeBSD 5.3-STABLE (BRIDGING) #3: Thu Feb 10 11:13:42 UTC 2005

      Welcome to FreeBSD!

      FreeBSD interactive server, do something nasty, and I will punch you in the face.

      • Sure, if you have a good punch. This is slashdot we are talking about though. Most of us are letting others on our machine because we will get punched outwise. Threats to punch someone who does something nasty will be met with laughs at best.

    • Re:Any news on chroot support? (Score:5, Informative)

      by GoRK ( 10018 ) on Wednesday March 09, 2005 @05:17PM (#11893441) Homepage Journal
      As I'm sure you know, chroot is not necessarily a simple feature due to the fact that if you need a full environment to use commands (which aside from forwarding ports is the only thing ssh actually lets you do -- even sftp has a "server" command that gets run by the sftp client), so you can't just automatically have sshd know what library files and binaries are necessary for a user to have certain access.

      What you ought to do instead is set up your users with ssh using rssh as a shell. rssh can give you a restricted environment without necessarily having to chroot (if you trust rssh, anyway), but if you really want to deal with the setup and maintenance overhead of a real chroot environment for a shell, rssh can do that too -- every user can have their own jail or they can share a jail and you can use permissions to restrict them.

      I can't understand if this is your intent or you'd like sshd to run in a jail -- if that is the case, it's definately not a simple 'switch it on' feature either. The same rules apply except that your user accounts will be futher restricted to the root that sshd is running in. For the ultra paranoid you could jail sshd in /home, say, and then jail each user account in /home/user/ with only access to sash, busybox or some similar staticlly compiled multi-command utility.

      Remember, use hardlinks on all your bins and libs in your chroot jails otherwise you'll forget to update the files!
      • I use rssh on all of my servers, and it works quite well. Now days with rsync support I am one happy camper. BUT:

        No support for FreeBSD 4x (no wordexp() function)
        FreeBSD 5.2.x Functional, but due to a typo in wordexp.h you have to correct a line in the system header file to get it to compile - works fine after that.

        Also the guy who came up with rssh has pretty much abandoned the project for his own reasons. One of the gentoo people discovered a vulerability which was fixed and eventually made its way b

      • I am aware that there are difficulties in implementing this, although I must admit I do not fully understand what they are (I am not a system level programmer). I have several web servers, that host up to 100 web sites each. I insist that my clients use SFTP to maintain their site-- I do not support (or even have installed) FTP. While an unpopular choice a few years ago when I set this up, now that DreamWeaver, BBEdit, and many other WSIWYG editors support SFTP directly this is an easy rule to impose.

        One

        • I think you may be confusing an application presenting limited access to a user vs the application itself actually having limited access.

          Chroot can be used to do either; however the implemetations are wildly different. The former can often be accomplished by an application forking a child process to handle a connection and calling a chroot before accepting the connection. The user will have a subset of the system files to access, but an exploit launched against the server process itself could give an attac

        • An application I've used which does what you want is called scponly [sublimation.org].

          Features include chrooting to home directory, and full sftp, unison, and optional rsync compatibility.

    • Have you ever thought about stunnel?

      Sure it's not as widely available as SSH, but you could wrap FTP in a SSL tunnel. I've been using stunnel for my VNC connection.

      You then get the ability to trap the user session in a chroot jail.

      LK
    • What's wrong with using FTPS (ftp over ssl) for encrypted FTP sessions?
    • I believe if you use SSH with pam you might be able to use pam to do chrooting, but I've never actually tried it.
    • I've heard that the OpenSSH guys don't want to do this for various reasons. Nonetheless, there is a chroot patch you can apply (http://chrootssh.sourceforge.net) that works pretty well. There are also pointers on how to set up the jail so it will actually work- finding library dependencies and all that.

  • I think I speak for everyone when I request: (Score:4, Insightful)

    by mscnln ( 785138 ) on Wednesday March 09, 2005 @06:44PM (#11894411)
    Tab completion in sftp!

    I don't use sftp nearly as much as I would if I could actually navigate and download files with any efficiency instead of copying and pasting...

    This is 2005, come on.

  • Not front page material? (Score:5, Insightful)

    by MetalliQaZ ( 539913 ) on Wednesday March 09, 2005 @09:35PM (#11895715)
    A new release of Gnome got the front page, but a new release of OpenSSH doesn't? Someone's priorities are out of wack.

    -d

    • Re:Not front page material? (Score:3, Insightful)

      by Anonymous Coward
      I was thinking the same thing. OpenSSH is one of the most widely used open source applications but on Slashdot its a minor footnote when a major release is annouced. Hmm...could it be because its a BSD related project and not Linux? It wouldnt be the first and im sure it wont be the last time.
    • "A new release of Gnome got the front page, but a new release of OpenSSH doesn't? Someone's priorities are out of wack."

      Gnome doesn't make the internet work, SSH does.

      That is it's a significant tool for operations. Gnome is the moral equivalent of windows (for unix).

      If there was no gnome, life would move on. If there was no SSH the net would break very quickly.

      gname is a wonderfull thing, don't get me wrong. But ssh is important.
    • At least the release of a new iPod iSock protective film isn't on the front page.

  • Any idea on these login pauses? (Score:3)

    by bconway ( 63464 ) * on Thursday March 10, 2005 @10:42AM (#11898823) Homepage
    I have OpenSSH 4.0p1 running on a variety of OSes, all built against OpenSSL 0.9.7e. They're all built with a standard ./configure and no other options, and just X11 forwarding in the ssh_config file. Whenever I connect to a system followed by another system, regardless of the SSH server version running, after I put in a password, it pauses for a full 5 seconds every time with the following (from ssh -vv):

    debug2: x11_get_proto: /usr/X11R6/bin/xauth -f /tmp/ssh-PZhTm22307/xauthfile generate unix:10.0 MIT-MAGIC-COOKIE-1 untrusted timeout 1200 2>/dev/null
    (pause 5+ seconds here)
    debug2: x11_get_proto: /usr/X11R6/bin/xauth list unix:10.0 . 2>/dev/null

    This doesn't happen on any system that I'm logged in to locally and initiate a connection, but if I jump from one machine to another with X11 forwarding turned on, the second machine is always doing this 5-second pause. This is most easily reproducible if I SSH to localhost twice in a row (one connection within another).
    • It probably pauses on non-localhost connections to make it harder to try to brute-force.
    • Is UseDNS Off? It might be trying to find a reverse-DNS for its client and be running in to trouble. I think there's some other option related to this but I haven't had that problem in too long.

      Does turning off X11 forwarding 'fix' the problem or does it still happen? I couldn't work that out just from your post.
      • UseDNS is on (default), and all forward and reverse entries are resolving correctly on the DNS server. Sorry, I meant to mention the problem "disappears" when turning off X11 forwarding in the 4.0p1 client, as well as when reverting to 3.9p1 with X11 forwarding turned on. Thanks guys.

  • configure and cross-compile (Score:3, Informative)

    by statemachine ( 840641 ) on Thursday March 10, 2005 @08:32PM (#11905714)
    Does ./configure handle cross-compile situations correctly yet?

    For example, I want to build OpenSSH on an i386 Linux for an embedded MIPS Linux. Configure will detect that it is cross-compiling, but will still insist on performing its compile-and-run tests, either by erroring when it tries to run the MIPS binary on i386, or by saying it won't proceed any further because I'm cross-compiling which means it can't do its ... test.

    I had to tediously hand-edit the configure script to shut off those errors (I lost count of how many instances) -- after which everything worked fine. But with each new release, I will need to edit that script again, which I don't enjoy.
    • Does ./configure handle cross-compile situations correctly yet?
      It handles the ones that we know about (ie the ones that have been reported, see bug #321 [mindrot.org])
      • Sorry, it still errors out. However, it does get farther this time.

        checking if openpty correctly handles controlling tty... configure: error: cannot run test program while cross compiling
        • Well, if you want it fixed then please open a bug at http://bugzilla.mindrot.org, and better yet, attach your patch.

          • Well, if you want it fixed then please open a bug at http://bugzilla.mindrot.org, and better yet, attach your patch.

            Someone already did reference this issue in the bug you referenced #321 [mindrot.org] yet the bug was labelled as "Resolved and Fixed" anyway. A simple test would have caught this issue.

            As for submitting a patch: patches took 4 years to be accepted, and then 6 months for a release after that. What makes you think I have the time to deal with that?

            • Someone already did reference this issue in the bug you referenced #321 [mindrot.org] yet the bug was labelled as "Resolved and Fixed" anyway. A simple test would have caught this issue.

              What makes you think we have a cross-compile environment to test it on?

              The reporters reported it worked for them (or that they had tested the wrong patch), so as far as I knew it worked ok.

              As for submitting a patch: patches took 4 years to be accepted, and then 6 months for a release after that. What makes you think

              • What makes you think we have a cross-compile environment to test it on?

                Simple. Just tell it to cross-compile. It's nothing more than an option. If it wants to perform those checks, then you've failed.

                As for submitting a patch: patches took 4 years to be accepted, and then 6 months for a release after that. What makes you think I have the time to deal with that?

                So you have time to "to tediously hand-edit the configure script" every release and whine about it on /. but not submit a patch of your wo

                • Simple. Just tell it to cross-compile.

                  How? "./configure --target=foo" and "./configure --host=foo --target=bar" do not seem to enable cross compiling (at least without a cross compiler and build environment for the target?)

                  apply patches

                  What patches? None of the patches addressed the issue you brought up. I asked you to provide one and you refused.

                  If you had thoroughly read through the comments you would have seen that the same person who reported the openpty failure replied to you to say that

              • And to follow up on my earlier comment, your revisionist history is easily disproven:

                The reporters reported it worked for them (or that they had tested the wrong patch), so as far as I knew it worked ok.

                Wrong! If you had thoroughly read through the comments you would have seen that the same person who reported the openpty failure replied to you to say that the patches didn't work.

                ------- Additional Comment #12 From *** 2004-09-07 21:21 [reply] ------- Daren: I ran autoconf after modifying configur

  • I expect it will compile O.K. Hope it works on 2003 server. Never gould get 3.8.1p1-1 to work right on 2003 server :-/

Slashdot Top Deals

Top Ten Things Overheard At The ANSI C Draft Committee Meetings: (5) All right, who's the wiseguy who stuck this trigraph stuff in here?

Close