diff --git a/ChangeLog b/ChangeLog
index 91eb0ef70..8849616b6 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -22,6 +22,10 @@
      USE_AFS not referenced so remove #ifdef.  fixes sshd -T not printing
      kerberosgetafstoken. ok dtucker@
      (Id sync only, we still want the ifdef in portable)
+   - stevesk@cvs.openbsd.org 2008/11/11 03:55:11
+     [channels.c]
+     for sshd -T print 'permitopen any' vs. 'permitopen' for case of no
+     permitopen's; ok and input dtucker@
 
 20081105
  - OpenBSD CVS Sync
@@ -4914,4 +4918,4 @@
    OpenServer 6 and add osr5bigcrypt support so when someone migrates
    passwords between UnixWare and OpenServer they will still work. OK dtucker@
 
-$Id: ChangeLog,v 1.5138 2008/11/11 05:39:44 dtucker Exp $
+$Id: ChangeLog,v 1.5139 2008/11/11 05:40:22 dtucker Exp $
diff --git a/channels.c b/channels.c
index 4af7df5db..225551e6a 100644
--- a/channels.c
+++ b/channels.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: channels.c,v 1.287 2008/11/01 06:43:33 stevesk Exp $ */
+/* $OpenBSD: channels.c,v 1.288 2008/11/11 03:55:11 stevesk Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -2791,6 +2791,10 @@ channel_print_adm_permitted_opens(void)
 {
 	int i;
 
+	if (num_adm_permitted_opens == 0) {
+		printf(" any");
+		return;
+	}
 	for (i = 0; i < num_adm_permitted_opens; i++)
 		if (permitted_adm_opens[i].host_to_connect != NULL)
 			printf(" %s:%d", permitted_adm_opens[i].host_to_connect,