security/openssh-portable: Update to 9.3p1. Changes: https://www.openssh.com/txt/release-9.3700625bcd8
OpenSSH -- Multiple vulnerabilitiesentered 2026-10-08
no CVE referenced
The portable version of OpenBSD's OpenSSH
# pkg install openssh-portable# pkg install openssh-portable-gssapi# pkg install openssh-portable-hpninstalls openssh-portable 10.6.p1,1, openssh-portable-gssapi 10.6.p1,1, openssh-portable-hpn 10.6.p1,1 from latest; from quarterly (2026Q4) openssh-portable 10.6.p1,1, openssh-portable-hpn 10.6.p1,1# cd /usr/ports/security/openssh-portable && make install clean# make -C /usr/ports/security/openssh-portable config # change options first
To enable this port, add openssh_enable="YES" in your rc.conf. To prevent conflict with openssh in the base system add sshd_enable="NO" in your rc.conf. Also you can configure openssh at another TCP port (via sshd_config 'Port' and 'Listen' options or via 'openssh_flags' variable in rc.conf) and run it in same time with base sshd. 'PermitRootLogin no' is the default for the OpenSSH port. This now matches the PermitRootLogin configuration of OpenSSH in the base system. Please be aware of this when upgrading your OpenSSH port, and if truly necessary, re-enable remote root login by readjusting this option in your sshd_config. Users are encouraged to create single-purpose users with ssh keys, disable Password authentication by setting 'PasswordAuthentication no' and 'ChallengeResponseAuthentication no', and to define very narrow sudo privileges instead of using root for automated tasks.
| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 16 | 10.6.p1,1 | 10.6.p1,1 | – |
| FreeBSD 15 | 10.6.p1,1 | 10.6.p1,1 | – |
| FreeBSD 14 | 10.6.p1,1 | 10.6.p1,1 | 10.6.p1,1 |
| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 15 | 10.6.p1,1 | 10.6.p1,1 | – |
| FreeBSD 14 | 10.6.p1,1 | 10.6.p1,1 | 10.6.p1,1 |
version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.
pkg audit for the packaged version 10.6.p1,1.| CVE | CVSS | Published | Description |
|---|---|---|---|
| CVE-2026-106585 | 6.5 | 2026-10-06 | In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data. |
| CVE-2026-106552 | 4.2 | 2026-10-06 | In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation. |
| CVE-2026-106582 | 3.7 | 2026-10-06 | In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Crossing the Streams" findings. |
| CVE-2026-106587 | 3.6 | 2026-10-06 | In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled. |
| CVE-2026-106588 | 3.1 | 2026-10-06 | In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing, which is potentially unexpected. |
| CVE-2026-106589 | 2.9 | 2026-10-06 | In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can unexpectedly have root privileges. This is related to the G… |
| CVE-2026-106583 | 2.5 | 2026-10-07 | In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection. |
| CVE-2026-106584 | 2.5 | 2026-10-06 | In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effe… |
| CVE-2026-106586 | 2.5 | 2026-10-06 | In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than … |
| CVE-2026-106553 | 2.2 | 2026-10-06 | In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt. |
| CVE-2026-106555 | 2.2 | 2026-10-06 | In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts. |
no CVE referenced
no CVE referenced
no CVE referenced
no CVE referenced
| PR | Summary | Status | Changed |
|---|---|---|---|
| 298530 | maintainer-feedback? security/openssh-portable: new GSSAPIKeyExchange patch | New | 2026-10-22 |
| 297915 | maintainer-feedback? security/openssh-portable: Catch up with base patches | New | 2026-08-25 |
| 282222 | maintainer-feedback? security/openssh-portable: Add option to build without OpenSSL | New | 2026-08-11 |
| 297078 | maintainer-feedback? security/openssh-portable: pre-key-exchange crash | New | 2026-07-30 |
| 289965 | maintainer-feedback? security/openssh-portable: doesn't appear to depend on ports openssl | New | 2026-04-26 |
| PR | Summary | Status | Changed |
|---|---|---|---|
| 292248 | maintainer-feedback? security/openssh-portable: sshd-session crash on FreeBSD 15.0-RELEASE on arm64 | New | 2026-01-14 |
| 276410 | maintainer-feedback? security/openssh-portable: SSHFP/known_hosts issues when HPN is enabled (9.9.p1_1,1) | New | 2025-01-15 |
| 282966 | maintainer-feedback? security/openssh-portable: Tiny error in sshd_config(5) | New | 2024-11-25 |
| 272065 | maintainer-feedback? security/openssh-portable: Add patch for different interpretation of BADUSER | New | 2023-11-28 |
security/openssh-portable: Update to 9.3p1. Changes: https://www.openssh.com/txt/release-9.3700625bcd8
security/openssh-portable: Upgrade to 9.2p1 Changes: https://www.openssh.com/txt/release-9.210491773d8
security/openssh-portable: Fix GSSAPI build for 9.1c56b161c93
security/openssh-portable: Fix BLACKLISTD patch Reported by: Chad J. Milios810702f666
security/openssh-portable: Update to 9.1p1 Changes: https://www.openssh.com/txt/release-9.1162c735b34
Remove WWW entries moved into port Makefiles Commit b7f05445c00f has added WWW entries to port Makefiles based on WWW: lines in pkg-descr files. This commit removes the WWW: lines of moved-over URLs from these pkg-descr files. Approved by: portmgr (tcberner)fb16dfecae
Add WWW entries to port Makefiles It has been common practice to have one or more URLs at the end of the ports' pkg-descr files, one per line and prefixed with "WWW:". These URLs should point at a project website or other relevant resources. Access to these URLs required processing of the pkg-descr files, and they have often become stale over time. If more than one such URL was present in a pkg-descr file, only the first one was tarnsfered into the port INDEX, but for many ports only the last line did contain the port specific URL to further information. There have been several proposals to make a project URL available as a macro in the ports' Makefiles, over time. This commit implements such a proposal and moves one of the WWW: entries of each pkg-descr file into the respective port's Makefile. A heuristic attempts to identify the most relevant URL in case there is more than one WWW: entry in some pkg-descr file. URLs that are not moved into the Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr files in order to preserve them. There are 1256 ports that had no WWW: entries in pkg-descr files. These ports will not be touched in this commit. The portlint port has been adjusted to expect a WWW entry in each port Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as deprecated. Approved by: portmgr (tcberner)b7f05445c0
security: remove 'Created by' lines A big Thank You to the original contributors of these ports: * <ports@c0decafe.net> * Aaron Dalton <aaron@FreeBSD.org> * Adam Weinberger <adamw@FreeBSD.org> * Ade Lovett <ade@FreeBSD.org> * Aldis Berjoza <aldis@bsdroot.lv> * Alex Dupre <ale@FreeBSD.org> * Alex Kapranoff <kappa@rambler-co.ru> * Alex Samorukov <samm@freebsd.org> * Alexander Botero-Lowry <alex@foxybanana.com> * Alexander Kriventsov <avk@vl.ru> * Alexander Leidinger <netchild@FreeBSD.org> * Alexander Logvinov <ports@logvinov.com> * Alexander Y. Grigoryev <alexander.4mail@gmail.com> * Alexey Dokuchaev <danfe@FreeBSD.org> * Alfred Perlstein * Alfred Perlstein <alfred@FreeBSD.org> * Anders Nordby <anders@FreeBSD.org> * Anders Nordby <anders@fix.no> * Andreas Klemm <andreas@klemm.gtn.com> * Andrew Lewis <freeghb@gmail.com> * Andrew Pantyukhin <infofarmer@FreeBSD.org> * Andrew St. Jean <andrew@arda.homeunix.net> * Anes Mukhametov <anes@anes.su> * Antoine Brodin <antoine@FreeBSD.org> * Anton Berezin <tobez@FreeBSD.org> * Antonio Carlos Venancio Junior (<antonio@inf.ufsc.br>) * Antonio Carlos Venancio Junior <antonio@inf.ufsc.br> * Ashish SHUKLA <ashish@FreeBSD.org> * Attila Nagy <bra@fsn.hu> * Autrijus Tang <autrijus@autrijus.org> * Axel Rau <axel.rau@chaos1.de> * Babak Farrokhi <farrokhi@FreeBSD.org> * Ben Woods <woodsb02@FreeBSD.org> * Bernard Spil <brnrd@FreeBSD.org> * Bernard Spil <brnrd@freebsd.org> * Blaz Zupan <blaz@si.FreeBSD.org> * Bob Hockney <zeus@ix.netcom.com> * Boris Kochergin <spawk@acm.poly.edu> * Brendan Molloy <brendan+freebsd@bbqsrc.net> * Bruce M Simpson * Bruce M Simpson <bms@FreeBSD.org> * Bruce M. Simpson <bms@FreeBSD.org> * Carlo Strub * Carlo Strub <cs@FreeBSD.org> * Carlos J Puga Medina <cpm@FreeBSD.org> * Carlos J Puga Medina <cpm@fbsd.es> * Charlie Root <se@FreeBSD.org> * Cheng-Lung Sung <clsung@FreeBSD.org> * Cheng-Lung Sung <clsung@dragon2.net> * Chie Taguchi <taguchi.ch@gmail.com> * Chris Cowart <ccowart@rescomp.berkeley.edu> * Chris D. Faulhaber <jedgar@FreeBSD.org> * Christer Edwards <christer.edwards@gmail.com> * Christian Lackas * Christopher Hall <hsw@bitmark.com> * Clement Laforet <sheepkiller@cultdeadsheep.org> * Clive Lin <clive@CirX.ORG> * Colin Percival * Cory McIntire (loon@noncensored.com) * Craig Leres <leres@FreeBSD.org> * Cristiano Deana <cris@gufi.org> * Cy Schubert (Cy.Schubert@uumail.gov.bc.ca) * Cy Schubert <Cy.Schubert@uumail.gov.bc.ca> * Cy Schubert <cy@FreeBSD.org> * Damian Gerow <dgerow@afflictions.org> * Damien Bobillot * Dan Langille * Dan Langille <dan@freebsddiary.org> * Dan Langille <dvl@FreeBSD.org> * Dan Langille <dvl@freebsd.org> * Dan Langille <dvl@sourcefire.com> * Daniel Kahn Gillmor <dkg@fifthhorseman.net> * Daniel Roethlisberger <daniel@roe.ch> * Danilo Egea Gondolfo <danilo@FreeBSD.org> * Danton Dorati <urisso@bsd.com.br> * Dave McKay <dave@mu.org> * David E. Thiel <lx@FreeBSD.org> * David O'Brien (obrien@NUXI.com) * David O'Brien <obrien@FreeBSD.org> * David Thiel <lx@redundancy.redundancy.org> * Dean Hollister <dean@odyssey.apana.org.au> * Denis Shaposhnikov <dsh@vlink.ru> * Dereckson <dereckson@gmail.com> * Dirk Froemberg <dirk@FreeBSD.org> * Ditesh Shashikant Gathani <ditesh@gathani.org> * Dom Mitchell <dom@happygiraffe.net> * Dominic Marks <dominic.marks@btinternet.com> * Don Croyle <croyle@gelemna.org> * Douglas Thrift <douglas@douglasthrift.net> * Edson Brandi <ebrandi@fugspbr.org> * Edwin Groothuis <edwin@mavetju.org> * Ekkehard 'Ekki' Gehm <gehm@physik.tu-berlin.de> * Emanuel Haupt <ehaupt@FreeBSD.org> * Emanuel Haupt <ehaupt@critical.ch> * Eric Crist <ecrist@secure-computing.net> * Erwin Lansing <erwin@FreeBSD.org> * Eugene Grosbein <eugen@FreeBSD.org> * Fabian Keil <fk@fabiankeil.de> * Felix Palmen <felix@palmen-it.de> * Florent Thoumie <flz@xbsd.org> * Foxfair Hu <foxfair@FreeBSD.org> * Frank Laszlo <laszlof@vonostingroup.com> * Frank Wall <fw@moov.de> * Franz Bettag <franz@bett.ag> * Gabor Kovesdan * Gabor Kovesdan <gabor@FreeBSD.org> * Gabriel M. Dutra <0xdutra@gmail.com> * Gary Hayers <Gary@Hayers.net> * Gasol Wu <gasol.wu@gmail.com> * Gea-Suan Lin <gslin@gslin.org> * George Reid <greid@ukug.uk.freebsd.org> * George Reid <services@nevernet.net> * Greg Larkin <glarkin@FreeBSD.org> * Greg V <greg@unrelenting.technology> * Gregory Neil Shapiro <gshapiro@FreeBSD.org> * Grzegorz Blach <gblach@FreeBSD.org> * Guangyuan Yang <ygy@FreeBSD.org> * Hakisho Nukama <nukama@gmail.com> * Hammurabi Mendes <hmendes@brturbo.com> * Henk van Oers <hvo.pm@xs4all.nl> * Horia Racoviceanu <horia@racoviceanu.com> * Hung-Yi Chen <gaod@hychen.org> * Jaap Akkerhuis <jaap@NLnetLabs.nl> * Jaap Boender <jaapb@kerguelen.org> * Jacek Serwatynski <tutus@trynet.eu.org> * James FitzGibbon <jfitz@FreeBSD.org> * James Thomason <james@divide.org> * Jan-Peter Koopmann <Jan-Peter.Koopmann@seceidos.de> * Janky Jay <ek@purplehat.org> * Janos Mohacsi * Janos Mohacsi <janos.mohacsi@bsd.hu> * Jean-Yves Lefort <jylefort@brutele.be> * Jim Geovedi <jim@corebsd.or.id> * Jim Ohlstein <jim@ohlste.in> * Joe Clarke <marcus@marcuscom.com> * Joe Marcus Clarke <marcus@FreeBSD.org> * Johann Visagie <johann@egenetics.com> * Johann Visagie <wjv@FreeBSD.org> * John Ferrell <jdferrell3@yahoo.com> * John Hixson <jhixson@gmail.com> * John Polstra <jdp@polstra.com> * John W. O'Brien <john@saltant.com> * John-Mark Gurney <jmg@FreeBSD.org> * Jose Alonso Cardenas Marquez <acardenas@bsd.org.pe> * Joseph Benden <joe@thrallingpenguin.com> * Joshua D. Abraham <jabra@ccs.neu.edu> * Jov <amutu@amutu.com> * Jui-Nan Lin <jnlin@freebsd.cs.nctu.edu.tw> * Ka Ho Ng <khng300@gmail.com> * Kay Lehmann <kay_lehmann@web.de> * Keith J. Jones <kjones@antihackertoolkit.com> * Kevin Zheng <kevinz5000@gmail.com> * Kimura Fuyuki <fuyuki@hadaly.org> * Kimura Fuyuki <fuyuki@mj.0038.net> * Klayton Monroe <klm@uidzero.org> * Konstantin Menshikov <kostjnspb@yandex.ru> * Koop Mast <kwm@FreeBSD.org> * Kris Kennaway <kris@FreeBSD.org> * Kubilay Kocak <koobs@FreeBSD.org> * Kurt Jaeger <fbsd-ports@opsec.eu> * LEVAI Daniel <leva@ecentrum.hu> * Lars Engels <lme@FreeBSD.org> * Lars Thegler <lth@FreeBSD.org> * Laurent LEVIER <llevier@argosnet.com> * Luiz Eduardo R. Cordeiro * Lukas Slebodnik <lukas.slebodnik@intrak.sk> * Lukasz Komsta * Mageirias Anastasios <anastmag@gmail.com> * Marcel Prisi <marcel.prisi@virtua.ch> * Marcello Coutinho * Mario Sergio Fujikawa Ferreira <lioux@FreeBSD.org> * Mark Felder <feld@FreeBSD.org> * Mark Hannon <markhannon@optusnet.com.au> * Mark Murray <markm@FreeBSD.org> * Mark Pulford <mark@kyne.com.au> * Marko Njezic <sf@maxempire.com> * Martin Matuska <martin@tradex.sk> * Martin Matuska <mm@FreeBSD.org> * Martin Mersberger * Martin Wilke <miwi@FreeBSD.org> * Martti Kuparinen <martti.kuparinen@ericsson.com> * Mateusz Piotrowski <0mp@FreeBSD.org> * Matt <matt@xtaz.net> * Matt Behrens <matt@zigg.com> * Matthias Andree <mandree@FreeBSD.org> * Matthias Fechner <mfechner@FreeBSD.org> * Matthieu BOUTHORS <matthieu@labs.fr> * Maxim Sobolev <sobomax@FreeBSD.org> * Meno Abels <meno.abels@adviser.com> * Michael Haro <mharo@FreeBSD.org> * Michael Johnson <ahze@FreeBSD.org> * Michael Nottebrock <lofi@FreeBSD.org> * Michael Reifenberger <mr@FreeBSD.org> * Michael Schout <mschout@gkg.net> * Michal Bielicki <m.bielicki@llizardfs.com> * Michiel van Baak <michiel@vanbaak.eu * Mij <mij@bitchx.it> * Mike Heffner <mheffner@vt.edu> * Mikhail T. <m.tsatsenko@gmail.com> * Mikhail Teterin <mi@aldan.algebra.com> * Milan Obuch * Mosconi <mosconi.rmg@gmail.com> * Muhammad Moinur Rahman <5u623l20@gmail.com> * Mustafa Arif <ma499@doc.ic.ac.uk> * Neil Booth * Neil Booth <kyuupichan@gmail.com> * Nick Barkas <snb@threerings.net> * Nicola Vitale <nivit@FreeBSD.org> * Niels Heinen * Nikola Kolev <koue@chaosophia.net> * Nobutaka Mantani <nobutaka@FreeBSD.org> * Oliver Lehmann * Oliver Lehmann <oliver@FreeBSD.org> * Olivier Duchateau * Olivier Duchateau <duchateau.olivier@gmail.com> * Olli Hauer * Patrick Li <pat@databits.net> * Paul Chvostek <paul@it.ca> * Paul Schmehl <pauls@utdallas.edu> * Pavel I Volkov <pavelivolkov@googlemail.com> * Pete Fritchman <petef@databits.net> * Peter Ankerstal <peter@pean.org> * Peter Haight <peterh@sapros.com> * Peter Johnson <johnson.peter@gmail.com> * Peter Pentchev <roam@FreeBSD.org> * Petr Rehor <rx@rx.cz> * Philippe Audeoud <jadawin@tuxaco.net> * Philippe Rocques <phil@teaser.fr> * Piotr Kubaj <pkubaj@FreeBSD.org> * Piotr Kubaj <pkubaj@anongoth.pl> * Po-Chuan Hsieh <sunpoet@FreeBSD.org> * RaRa Rasputin <rasputin@submonkey.net> * Radim Kolar * Ralf Meister * Remington Lang <MrL0Lz@gmail.com> * Renaud Chaput <renchap@cocoa-x.com> * Roderick van Domburg <r.s.a.vandomburg@student.utwente.nl> * Roland van Laar <roland@micite.net> * Romain Tartiere <romain@blogreen.org> * Roman Bogorodskiy * Roman Bogorodskiy <novel@FreeBSD.org> * Roman Shterenzon <roman@xpert.com> * Rong-En Fan <rafan@FreeBSD.org> * Ryan Steinmetz <zi@FreeBSD.org> * Sahil Tandon <sahil@tandon.net> * Sascha Holzleiter <sascha@root-login.org> * SeaD * Seamus Venasse <svenasse@polaris.ca> * Sean Greven <sean.greven@gmail.com> * Sebastian Schuetz <sschuetz@fhm.edu> * Sergei Kolobov <sergei@FreeBSD.org> * Sergei Kolobov <sergei@kolobov.com> * Sergei Vyshenski * Sergei Vyshenski <svysh.fbsd@gmail.com> * Sergey Skvortsov <skv@protey.ru> * Seth Kingsley <sethk@meowfishies.com> * Shaun Amott <shaun@inerd.com> * Simeon Simeonov <sgs@pichove.org> * Simon Dick <simond@irrelevant.org> * Sofian Brabez <sbrabez@gmail.com> * Stanislav Sedov <ssedov@mbsd.msk.ru> * Stefan Esser <se@FreeBSD.org> * Stefan Grundmann * Stefan Walter <sw@gegenunendlich.de> * Stephon Chen <stephon@gmail.com> * Steve Wills <steve@mouf.net> * Steve Wills <swills@FreeBSD.org> * Steven Kreuzer * Steven Kreuzer <skreuzer@exit2shell.com> * Sunpoet Po-Chuan Hsieh <sunpoet@FreeBSD.org> * TAKAHASHI Kaoru <kaoru@kaisei.org> * TAKATSU Tomonari <tota@FreeBSD.org> * Tatsuki Makino <tatsuki_makino@hotmail.com> * Thibault Payet <monwarez@mailoo.org> * Thierry Thomas (<thierry@pompo.net>) * Thierry Thomas <thierry@pompo.net> * Thomas Hurst <tom@hur.st> * Thomas Quinot <thomas@cuivre.fr.eu.org> * Thomas Zander <riggs@FreeBSD.org> * Thomas von Dein <freebsd@daemon.de> * Tilman Linneweh <arved@FreeBSD.org> * Tim Bishop <tim@bishnet.net> * Tom Judge <tom@tomjudge.com> * Tomoyuki Sakurai <cherry@trombik.org> * Toni Viemerö <toni.viemero@iki.fi> * Tony Maher * Torsten Zuhlsdorff <ports@toco-domains.de> * Travis Campbell <hcoyote@ghostar.org> * Tsung-Han Yeh <snowfly@yuntech.edu.tw> * Ulf Lilleengen * Vaida Bogdan <vaida.bogdan@gmail.com> * Valentin Zahariev <curly@e-card.bg> * Valerio Daelli <valerio.daelli@gmail.com> * Veniamin Gvozdikov <vg@FreeBSD.org> * Victor Popov * Victor Popov <v.a.popov@gmail.com> * Vsevolod Stakhov * Vsevolod Stakhov <vsevolod@FreeBSD.org> * Wen Heping <wen@FreeBSD.org> * Wen Heping <wenheping@gmail.com> * Yarodin <yarodin@gmail.com> * Yen-Ming Lee <leeym@FreeBSD.org> * Yen-Ming Lee <leeym@cae.ce.ntu.edu.tw> * Yen-Ming Lee <leeym@leeym.com> * Ying-Chieh Liao <ijliao@FreeBSD.org> * Yonatan <Yonatan@Xpert.com> * Yonatan <onatan@gmail.com> * Yoshisato YANAGISAWA * Yuri Victorovich * Yuri Victorovich <yuri@rawbw.com> * Zach Thompson <hideo@lastamericanempire.com> * Zane C. Bowers <vvelox@vvelox.net> * Zeus Panchenko <zeus@gnu.org.ua> * ache * adamw * ajk@iu.edu * alex@FreeBSD.org * allan@saddi.com * alm * andrej@ebert.su * andrew@scoop.co.nz * andy@fud.org.nz * antoine@FreeBSD.org * arved * barner * brix@FreeBSD.org * buganini@gmail.com * chinsan * chris@still.whet.org * clement * clsung * crow * cy@FreeBSD.org * dominik karczmarski <dominik@karczmarski.com> * dwcjr@inethouston.net * eivind * erich@rrnet.com * erwin@FreeBSD.org * girgen@FreeBSD.org * glen.j.barber@gmail.com * hbo@egbok.com * ijliao * jesper * jfitz * johans * joris * kftseng@iyard.org * kris@FreeBSD.org * lx * markm * mharo@FreeBSD.org * michaelnottebrock@gmx.net * mnag@FreeBSD.org * mp39590@gmail.com * nbm * nectar@FreeBSD.org * nork@FreeBSD.org * nork@cityfujisawa.ne.jp * nsayer@FreeBSD.org * nsayer@quack.kfu.com * ntarmos@cs.uoi.gr * oly * onatan@gmail.com * pandzilla * patrick@mindstep.com * pauls * perl@FreeBSD.org * petef@FreeBSD.org * peter.thoenen@yahoo.com * ports@c0decafe.net * ports@rbt.ca * roam@FreeBSD.org * rokaz * sada@FreeBSD.org * scrappy * se * shane@freebsdhackers.net aka modsix@gmail.com * snb@threerings.net * sumikawa * sviat * teramoto@comm.eng.osaka-u.ac.jp * thierry@pompo.net * tobez@FreeBSD.org * torstenb@FreeBSD.org * trasz <trasz@pin.if.uz.zgora.pl> * trevor * truckman * vanhu * vanilla@ * wen@FreeBSD.org * will With hat: portmgr857c05f867
security/openssh-portable: Update to 9.0p1 Changes: https://www.openssh.com/txt/release-9.0 PR: 264211ca9ce6929f
security/openssh-portable: Fix some capsicum issues - Brings in latest changes from base. See patches for details. - Version 9.0 is being worked on but I wanted to fix this issue before proceeding with bigger changes. PR: 263753272dd07a30
security/openssh-portable: Add comment in openssh.in about host keys Commit ae66cffc19f added some rc vars to allow disabling host keys. The naming caused some confusion. Attempt to address that with a comment since these are not documented anywhere else. PR: 20216921cedc6ee5
security/openssh-portable: Again fix procctl(2) usage The 8.9p1 update was supposed to have a fix for incorrect use of procctl(2) but was left out for some reason. A wrong assumption missed keeping it in ae66cffc19f357cbd5. PR: 262352a12058fae3
security/openssh-portable: Fix fetching gssapi patch - Mirror it - Update to latest Debian locationdf3a937145
security/openssh-portable: fix docs when built without PAM support The defaults documented in sshd_config and sshd_config.5 are incorrect if OpenSSH was built without PAM support and can be misleading to the user whether or not password authentication is enabled. - Moved PAM specific changes out of patch-sshd_config and into extra-patch-pam-sshd_config - sshd_config.5 PasswordAuthentication: added a new line before the note to make it easier to read. - sshd_config.5 UsePAM: noted the default value depends on whether sshd was built with or without PAM support. PR: 261342418bb1fbd2
security/openssh-portable: Tweak new rc var names Commit ae66cffc19f357cbd5 added new rc vars to control generating of host keys [1]. Rename these to more closely match the base version before it becomes widely adopted. PR: 202169 [1] PR: 209948 [FYI]1249b096fa
security/openssh-portable: Update to 8.9p1 - Unbreak GSSAPI [1] - rc.d/openssh: Allow modifying host key generation [2] Changes: https://www.openssh.com/txt/release-8.9 PR: 259909 [1] PR: 202169 [2] Submitted by: Rick Miller [1] Submitted by: Chad Jacob Milios [2]ae66cffc19
security/openssh-portable: Fix subtle rc script problem. Invoking 'run_rc_command' taints '$rc_var' with 'keygen' which blocks further processing for something like openssh_oomprotect. Note that openssh_oomprotect is broken in rc.subr until it learns to read a pidfile.ad60ad3528
*/*: Remove redundant '-*' from CONFLICTS definitions The conflict checks compare the patterns first against the package names without version (as reported by "pkg query "%n"), then - if there was no match - agsinst the full package names including the version (as reported by "pkg query "%n-%v"). Approved by: portmgr (blanket)04b9da4140
security/openssh-portable: libfido fix went in 50537324302dbfbc676
security/openssh-portable: Fix sftp crash This fixes an error trying to disabling process tracing. It has been sent upstream. PR: 259174 Submitted by: mike at sentex dot netf4a5ae5fd8
security/openssh-portable: Fix build without LIBEDIT This removes a patch that is no longer needed with 8.8p1. Reported by: leres8d40d32ae3
security/openssh-portable: Update to 8.8p1 Changelog: https://www.openssh.com/txt/release-8.8 Security: CVE-2021-416173849667982
security/openssh-portable: Fix default ssh-askpass path Reported by: Piotr Smyrakfd74bc8eb2
security/openssh-portable: Add CPE information Approved by: portmgr (blanket)44052bec2c
security/openssh-portable: Various build fixes - Fix build with WITH_BLACKLISTD [1] - Fix build with WITHOUT_LIBEDIT due to upstream bug [2] Reported by: emaste [1] Reported by: Ivan Rozhuk [2] PR: 258402 [2]d27003d564
security/openssh-portable: Update to 8.7p1. Changes: https://www.openssh.com/txt/release-8.7a981593ecc
security/openssh-portable: Update to 8.6p1 - gssapi is disabled for now. Changes: - https://www.openssh.com/txt/release-8.5 - https://www.openssh.com/txt/release-8.6 Submitted by: Yasuhiro Kimura [earlier version][1] PR: 254389 [1]de9fffcec8
all: Remove all other $FreeBSD keywords.135fdeebb9
Remove # $FreeBSD$ from Makefiles.305f148f48
Add limited patch for CVE-2021-28041 from upstream.655d7a8ba0
security/openssh-portable@gssapi: fix build on GCC architectures
gss-genr.c: In function 'ssh_gssapi_kex_mechs':
gss-genr.c:175:9: error: 'strncpy' specified bound depends on the length of the source argument [-Werror=stringop-overflow=]
175 | cp = strncpy(s, kex, strlen(kex));
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
cc1: all warnings being treated as errorsabcb0e7a59security/openssh-portable: fix build on GCC architectures loginrec.c:763:2: error: 'strncpy' output may be truncated copying 32 bytes from a string of length 511 [-Werror=stringop-truncation] strncpy(utx->ut_user, li->username, ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ MIN_SIZEOF(utx->ut_user, li->username)); ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ loginrec.c: In function 'record_failed_login': loginrec.c:1687:2: error: 'strncpy' specified bound 32 equals destination size [-Werror=stringop-truncation] strncpy(ut.ut_user, username, sizeof(ut.ut_user)); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ loginrec.c:1696:2: error: 'strncpy' specified bound 256 equals destination size [-Werror=stringop-truncation] strncpy(ut.ut_host, hostname, sizeof(ut.ut_host));ccdc8ee045
- Fix KERB_GSSAPI build; missing prototypes for DH openssl-compat. PR: 212151 (maybe)7562494439
- Add pkg-config dependency which avoids some maintainer testing errors and also removes a few unneeded library links such as -lcurses. - libfido2 package is broken with pkg-config and base ssl. Workaround this by not using pkg-config for that library for now. - Add USES=localbase to simplify some options - Make crypt(3) MD5 password support optional but still on-by-default. The default in4bc67aef47
- Add blacklistd(8) support. This differs slightly from base as it uses the current NetBSD hook points. This is off-by-default as it needs testing and has issues that may cause crashes. One such issue is the use of private bl_create() symbol from libblacklist. It is also unclear if the hook points are sufficient or proper after the libssh refactoring in 8.x. PR: 223628 (patch rewritten as it no longer applied)4cff3f057d
- Add and enable FIDO/U2F support for security keys by default. This feature came in 8.2, is enabled by default on OpenBSD, and suggested to be enabled by default for packages.7a31807051
- Slightly reduce diff with base - No functional changes. PR: 223010 Submitted by: brnrd (earlier patch)c1eea6f3b3
- bindresvport support hasn't been used since 7.8f1a66569e8
- Remove sctp patch missed in r466577121e399cae
- Update to 8.4p1 (skipped 8.3) - https://www.openssh.com/txt/release-8.3 - https://www.openssh.com/txt/release-8.4 PR: 239807, 250319 Sponsored by: Dell EMCb773b7cade
security/openssh-portable: Set LICENSE In the past, the ports framework did not support handling situations where a port contained a multitude of licenses. In case of OpenSSH the list is/was: BSD2, BSD3, MIT, public domain, BSD-Style, BEER-WARE, "any purpose with notice intact", and ISC-Style. Instead of having to keep track of all the involved licenses which all are very similar, let's use LICENSE_PERMS. I am not bumping PORTREVISION as it is not a vital change from the perspective of package users. Approved by: bdrewery (maintainer) Differential Revision: https://reviews.freebsd.org/D2713372f28ff3aa
Install the moduli file as a @sample PR: 250559 Submitted by: Michał "rysiek" Woźniak <rysiek % isnic.is> Approved by: maintainer timeouta031e3218e
Fix a typo Approved by: portmgr blanketfeec3d68bf
Update WWW Approved by: portmgr (blanket)836e80987a
- Simplify and refactor login.conf environment handling.b3f7e10993
Fix build without PAM optionf5f81bcbb6
Remove long broken X509 patch. Approved by: portmgr (implicit)a7eb97a6a3
Fix plist for 8.2p1c5cc3212e8
- Update to 8.2p1 Release notes: https://www.openssh.com/txt/release-8.2115e2b360f
Update to 8.1p1 Changes: https://www.openssh.com/txt/release-8.1 Sponsored by: Dell EMCe7d48eba9d