diff --git a/ChangeLog b/ChangeLog
index 2bf6d6d6b..669e20098 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+20071202
+ - (dtucker) [configure.ac] Enable -fstack-protector-all on systems where
+   gcc supports it.  ok djm@
+
 20071030
  - (djm) OpenBSD CVS Sync
    - djm@cvs.openbsd.org 2007/10/29 23:49:41
@@ -3414,4 +3418,4 @@
    OpenServer 6 and add osr5bigcrypt support so when someone migrates
    passwords between UnixWare and OpenServer they will still work. OK dtucker@
 
-$Id: ChangeLog,v 1.4794 2007/10/29 23:52:44 djm Exp $
+$Id: ChangeLog,v 1.4795 2007/12/02 10:02:22 dtucker Exp $
diff --git a/configure.ac b/configure.ac
index e9402a735..c9bce0199 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1,4 +1,4 @@
-# $Id: configure.ac,v 1.386 2007/09/26 21:03:20 dtucker Exp $
+# $Id: configure.ac,v 1.387 2007/12/02 10:02:22 dtucker Exp $
 #
 # Copyright (c) 1999-2004 Damien Miller
 #
@@ -15,7 +15,7 @@
 # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
 AC_INIT(OpenSSH, Portable, openssh-unix-dev@mindrot.org)
-AC_REVISION($Revision: 1.386 $)
+AC_REVISION($Revision: 1.387 $)
 AC_CONFIG_SRCDIR([ssh.c])
 
 AC_CONFIG_HEADER(config.h)
@@ -105,6 +105,15 @@ if test "$GCC" = "yes" || test "$GCC" = "egcs"; then
 		*) ;;
 	esac
 
+	AC_MSG_CHECKING(if $GCC understands -fstack-protector-all)
+	saved_CFLAGS="$CFLAGS"
+	CFLAGS="$CFLAGS -fstack-protector-all"
+	AC_TRY_COMPILE([], [ int main(void){return 0;} ],
+	    [ AC_MSG_RESULT(yes) ],
+	    [ AC_MSG_RESULT(no)
+	      CFLAGS="$saved_CFLAGS" ]
+	)
+
 	if test -z "$have_llong_max"; then
 		# retry LLONG_MAX with -std=gnu99, needed on some Linuxes
 		unset ac_cv_have_decl_LLONG_MAX