prior to passing it to libfido2, which does expect a hash.
There is no effect for users who are simply generating FIDO keys using
ssh-keygen - by default we generate a random 256 bit challenge, but
people building attestation workflows around our tools should now have
a more consistent experience (esp. fewer failures when they fail to
guess the magic 32-byte challenge length requirement).
ok markus@
OpenBSD-Commit-ID: b8d5363a6a7ca3b23dc28f3ca69470472959f2b5
when the update removed more host keys than remain present. Fix tested by
reporter James Cook, via bugs@
OpenBSD-Commit-ID: 44f641f6ee02bb957f0c1d150495b60cf7b869d3
"hostbasedacceptedalgorithms"
This fixes a mistake that slipped in when "HostbasedKeyTypes" was
renamed to "HostbasedAcceptedAlgorithms".
Bug report by zack@philomathiclife.com
OpenBSD-Commit-ID: d745a7e8e50b2589fc56877f322ea204bc784f38
The original intent was to provide a status page for the CIs configured
in that directory, but it had the side effect of replacing the top-level
README.md.
ssh(1) needs to set file descriptors to non-blocking mode to operate
but it was not restoring the original state on exit. This could cause
problems with fds shared with other programs via the shell, e.g.
> $ cat > test.sh << _EOF
> #!/bin/sh
> {
> ssh -Fnone -oLogLevel=verbose ::1 hostname
> cat /usr/share/dict/words
> } | sleep 10
> _EOF
> $ ./test.sh
> Authenticated to ::1 ([::1]:22).
> Transferred: sent 2352, received 2928 bytes, in 0.1 seconds
> Bytes per second: sent 44338.9, received 55197.4
> cat: stdout: Resource temporarily unavailable
This restores the blocking status for fds 0,1,2 (stdio) before ssh(1)
abandons/closes them.
This was reported as bz3280 and GHPR246; ok dtucker@
OpenBSD-Commit-ID: 8cc67346f05aa85a598bddf2383fcfcc3aae61ce
shell when the -N (no shell) option was specified. bz3290 reported by Richard
Schwab; patch from markus@ ok me
OpenBSD-Commit-ID: ea1ea4af16a95687302f7690bdbe36a6aabf87e1
connection do need to use the same parameters (ie groups), the DH-GEX
protocol takes care of that and both ends do not need the same contents in
the moduli file, which is what the previous text suggested. ok djm@ jmc@
OpenBSD-Commit-ID: f0c18cc8e79c2fbf537a432a9070ed94e96a622a
Check out specified OpenSSL version. Install custom libcrypto where
configure expects to find it. Remove unneeded OpenSSL config time
options. Older OpenSSL versions were not make -j safe so remove it.
djm@openbsd.org
Darren Tucker
naddy@openbsd.org
dtucker@openbsd.org
Damien Miller