mirror/freebsd-ports
1
0
Fork 0
mirror of https://git.FreeBSD.org/ports.git synced 2024-11-04 22:33:27 +00:00
Code Issues Releases Activity
7fbdf514d9
freebsd-ports/security/openssh/files/patch-ao

21 lines
584 B
Plaintext
Raw Normal View History

Update to a more current OpenSSH, including... IPv6 support!! Thank you very much, Sumikawa san. Submitted by: Munechika SUMIKAWA <sumikawa@ebina.hitachi.co.jp>
2000-01-13 23:22:17 +00:00
--- sshd_config.orig Fri Jan 7 01:27:30 2000
+++ sshd_config Fri Jan 7 01:31:01 2000
@@ -3,12 +3,13 @@
Update the CVS_DATE. This brings in support for TIS authentication, obsoleting a couple patches (it's the same code, though, except for additions). This also brings in KNFization of everything (please hold the cheering down :) and made me reroll all my patches. My patches have been almost entirely rewritten. The places are the same, but the code's rewritten. It fits with the style (KNF) now, and looks better. I've also added strlcat.c to the build, which, just like strlcpy.c, is necessary for compatibility with older libcs. After strlcat() snuck into the OpenSSH code recently, this would prevent OpenSSH from building on (e.g.) FreeBSD 3.2. Adding it to ssh/lib/ makes it work yet again :)
1999-11-24 03:36:23 +00:00
Port 22
Update to a more current OpenSSH, including... IPv6 support!! Thank you very much, Sumikawa san. Submitted by: Munechika SUMIKAWA <sumikawa@ebina.hitachi.co.jp>
2000-01-13 23:22:17 +00:00
#ListenAddress 0.0.0.0
#ListenAddress ::
Update the CVS_DATE. This brings in support for TIS authentication, obsoleting a couple patches (it's the same code, though, except for additions). This also brings in KNFization of everything (please hold the cheering down :) and made me reroll all my patches. My patches have been almost entirely rewritten. The places are the same, but the code's rewritten. It fits with the style (KNF) now, and looks better. I've also added strlcat.c to the build, which, just like strlcpy.c, is necessary for compatibility with older libcs. After strlcat() snuck into the OpenSSH code recently, this would prevent OpenSSH from building on (e.g.) FreeBSD 3.2. Adding it to ssh/lib/ makes it work yet again :)
1999-11-24 03:36:23 +00:00
-HostKey /etc/ssh_host_key
+HostKey __PREFIX__/etc/ssh_host_key
ServerKeyBits 768
Reduce LoginGraceTime from 10 minutes (!!!) to 30 seconds. More to come, soon.
1999-12-04 12:40:39 +00:00
-LoginGraceTime 600
In the meantime (while things are being worked and decided on on the OpenBSD OpenSSH front), add ConnectionsPerPeriod to prevent DoS via running the system out of resources. In reality, this wouldn't be a full DoS, but would make a system slower, but this is a better thing to do than let the system get loaded down. So here we are, rate-limiting. The default settings are now: Five connections are allowed to authenticate (and not be rejected) in a period of ten seconds. One minute is given for login grace time. More work in this area is being done by alfred@FreeBSD.org and markus@OpenBSD.org, at the very least. This is, essentially, a stopgap solution; however, it is a properly implemented and documented one, and has an easily modifiable framework.
1999-12-06 06:32:22 +00:00
+LoginGraceTime 60
Update the CVS_DATE. This brings in support for TIS authentication, obsoleting a couple patches (it's the same code, though, except for additions). This also brings in KNFization of everything (please hold the cheering down :) and made me reroll all my patches. My patches have been almost entirely rewritten. The places are the same, but the code's rewritten. It fits with the style (KNF) now, and looks better. I've also added strlcat.c to the build, which, just like strlcpy.c, is necessary for compatibility with older libcs. After strlcat() snuck into the OpenSSH code recently, this would prevent OpenSSH from building on (e.g.) FreeBSD 3.2. Adding it to ssh/lib/ makes it work yet again :)
1999-11-24 03:36:23 +00:00
KeyRegenerationInterval 3600
-PermitRootLogin yes
In the meantime (while things are being worked and decided on on the OpenBSD OpenSSH front), add ConnectionsPerPeriod to prevent DoS via running the system out of resources. In reality, this wouldn't be a full DoS, but would make a system slower, but this is a better thing to do than let the system get loaded down. So here we are, rate-limiting. The default settings are now: Five connections are allowed to authenticate (and not be rejected) in a period of ten seconds. One minute is given for login grace time. More work in this area is being done by alfred@FreeBSD.org and markus@OpenBSD.org, at the very least. This is, essentially, a stopgap solution; however, it is a properly implemented and documented one, and has an easily modifiable framework.
1999-12-06 06:32:22 +00:00
-#
+PermitRootLogin no
+# Rate-limit sshd connections to 5 connections per 10 seconds
+ConnectionsPerPeriod 5/10
Update the CVS_DATE. This brings in support for TIS authentication, obsoleting a couple patches (it's the same code, though, except for additions). This also brings in KNFization of everything (please hold the cheering down :) and made me reroll all my patches. My patches have been almost entirely rewritten. The places are the same, but the code's rewritten. It fits with the style (KNF) now, and looks better. I've also added strlcat.c to the build, which, just like strlcpy.c, is necessary for compatibility with older libcs. After strlcat() snuck into the OpenSSH code recently, this would prevent OpenSSH from building on (e.g.) FreeBSD 3.2. Adding it to ssh/lib/ makes it work yet again :)
1999-11-24 03:36:23 +00:00
# Don't read ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
In the meantime (while things are being worked and decided on on the OpenBSD OpenSSH front), add ConnectionsPerPeriod to prevent DoS via running the system out of resources. In reality, this wouldn't be a full DoS, but would make a system slower, but this is a better thing to do than let the system get loaded down. So here we are, rate-limiting. The default settings are now: Five connections are allowed to authenticate (and not be rejected) in a period of ten seconds. One minute is given for login grace time. More work in this area is being done by alfred@FreeBSD.org and markus@OpenBSD.org, at the very least. This is, essentially, a stopgap solution; however, it is a properly implemented and documented one, and has an easily modifiable framework.
1999-12-06 06:32:22 +00:00
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
Reference in New Issue Copy Permalink