File dropbear.changes of Package dropbear

-------------------------------------------------------------------
Mon Nov  2 10:31:35 UTC 2020 - Tim Hardeck <thardeck@suse.com>

- update to upstream version 2020.81
  * Fix regression in 2020.79 which prevented connecting with some SSH
    implementations. Increase MAX_PROPOSED_ALGO to 50, and print a log
    message if the limit is hit. This fixes interoperability with sshj
    library (used by PyCharm), and GoAnywhere.
    Reported by Pirmin Walthert and Piotr Jurkiewicz
  * Fix building with non-GCC compilers, reported by Kazuo Kuroi
  * Fix potential long delay in dbclient, found by OSS Fuzz
  * Fix null pointer dereference crash, found by OSS Fuzz
  * libtommath now uses the same random source as Dropbear (in 2020.79
    and 2020.80 used getrandom() separately)
  * Some fuzzing improvements, start of a dbclient fuzzer

-------------------------------------------------------------------
Mon Jun 29 07:59:00 UTC 2020 - Tim Hardeck <thardeck@suse.com>

- update to upstream version 2020.80
  * Don't block authorized_keys logins with no-X11-forwarding or no-agent-forwarding
    restrictions when X11 or agent forwarding are disabled at compile time.
    This is more of a problem now X11 is disabled by default, reported by Guilhem Moulin
  * Reduce binary size by 4kB (x64) when using bundled libtommath
  * Define GNU_SOURCE for getrandom() on uclibc, reported by Laurent Bercot and
    Fabrice Fontaine
  * Improve checking libtomcrypt version compatibility
  * Add some style notes to DEVELOPING.md

-------------------------------------------------------------------
Tue Jun 16 11:38:05 UTC 2020 - Tim Hardeck <thardeck@suse.com>

- update to upstream version 2020.79
  * Support ed25519 hostkeys and authorized_keys, many thanks to Vladislav Grishenko.
    This also replaces curve25519 with a TweetNaCl implementation that reduces code size.
  * Add chacha20-poly1305 authenticated cipher. This will perform faster than AES
    on many platforms. Thanks to Vladislav Grishenko
  * Support using rsa-sha2 signatures. No changes are needed to hostkeys/authorized_keys
    entries, existing RSA keys can be used with the new signature format (signatures
    are ephemeral within a session). Old ssh-rsa signatures will no longer
    be supported by OpenSSH in future so upgrading is recommended.
  * Use getrandom() call on Linux to ensure sufficient entropy has been gathered at startup.
    Dropbear now avoids reading from the random source at startup, instead waiting until
    the first connection. It is possible that some platforms were running without enough 
    entropy previously, those could potentially block at first boot generating host keys.
    The dropbear "-R" option is one way to avoid that.
  * Upgrade libtomcrypt to 1.18.2 and libtommath to 1.2.0, many thanks to Steffen Jaeckel for
    updating Dropbear to use the current API. Dropbear's configure script will check 
    for sufficient system library versions, otherwise using the bundled versions.
  * CBC ciphers, 3DES, hmac-sha1-96, and x11 forwarding are now disabled by default.
    They can be set in localoptions.h if required.
    Blowfish has been removed.
  * Support AES GCM, patch from Vladislav Grishenko. This is disabled by default,
    Dropbear doesn't currently use hardware accelerated AES.
  * Added an API for specifying user public keys as an authorized_keys replacement.
    See pubkeyapi.h for details, thanks to Fabrizio Bertocci
  * Fix idle detection clashing with keepalives, thanks to jcmathews
  * Include IP addresses in more early exit messages making it easier for fail2ban
    processing. Patch from Kevin Darbyshire-Bryant
  * scp fix for CVE-2018-20685 where a server could modify name of output files
  * SSH_ORIGINAL_COMMAND is set for "dropbear -c" forced command too
  * Fix writing key files on systems without hard links, from Matt Robinson
  * Compatibility fixes for IRIX from Kazuo Kuroi
  * Re-enable printing MOTD by default, was lost moving from options.h. Thanks to zciendor
  * Call fsync() is called on parent directory when writing key files to ensure they are flushed
  * Fix "make install" for manpages in out-of-tree builds, from Gabor Z. Papp
  * Some notes are added in DEVELOPER.md 

-------------------------------------------------------------------
Mon Apr 29 11:45:07 UTC 2019 - Tim Hardeck <thardeck@suse.com>

- add dropbear.keyring for source verification 

-------------------------------------------------------------------
Fri Mar 29 15:55:48 UTC 2019 - Tim Hardeck <thardeck@suse.com>

- update to upstream version 2019.78
  * Fix dbclient regression in 2019.77. After exiting the terminal would be left
    in a bad state. Reported by Ryan Woodsmall

-------------------------------------------------------------------
Tue Mar 26 15:27:13 UTC 2019 - Tim Hardeck <thardeck@suse.com>

- remove support for non-systemd systems from spec file 
- update to upstream version 2019.77
  * Fix server -R option with ECDSA - only advertise one key size which will be accepted.
    Reported by Peter Krefting, 2018.76 regression.
  * Fix server regression in 2018.76 where multiple client -R forwards were all forwarded
    to the first destination. Reported by Iddo Samet.
  * Make failure delay more consistent to avoid revealing valid usernames, set server password
    limit of 100 characters. Problem reported by usd responsible disclosure team
  * Change handling of failed authentication to avoid disclosing valid usernames,
    CVE-2018-15599.
  * Fix dbclient to reliably return the exit code from the remote server.
    Reported by W. Mike Petullo
  * Fix export of 521-bit ECDSA keys, from Christian Hohnstädt
  * Add -o Port=xxx option to work with sshfs, from xcko
  * Merged fuzzing code, see FUZZER-NOTES.md
  * Add a DROPBEAR_SVR_MULTIUSER=0 compile option to run on
    single-user Linux kernels (CONFIG_MULTIUSER disabled). From Patrick Stewart
  * Increase allowed username to 100 characters, reported by W. Mike Petullo
  * Update config.sub and config.guess, should now work with RISC-V
  * Cygwin compile fix from karel-m
  * Don't require GNU sed (accidentally in 2018.76), reported by Samuel Hsu
  * Fix for IRIX and writev(), reported by Kazuo Kuroi
  * Other fixes and cleanups from François Perrad, Andre McCurdy, Konstantin Demin,
    Michael Jones, Pawel Rapkiewicz

-------------------------------------------------------------------
Thu Mar  8 12:58:39 UTC 2018 - thardeck@suse.com

- fix building on openSUSE Leap 15 

-------------------------------------------------------------------
Thu Mar  8 09:24:38 UTC 2018 - thardeck@suse.com

- update to upstream version 2018.76
  * "configure --enable-static" should now be used instead of "make STATIC=1"
    This will avoid 'hardened build' flags that conflict with static binaries
  * Set 'hardened build' flags by default if supported by the compiler.
    These can be disabled with configure --disable-harden if needed.
    -Wl,-pie
    -Wl,-z,now -Wl,-z,relro
    -fstack-protector-strong
    -D_FORTIFY_SOURCE=2
    # spectre v2 mitigation
    -mfunction-return=thunk
    -mindirect-branch=thunk
    Spectre patch from Loganaden Velvindron
  * "dropbear -r" option for hostkeys no longer attempts to load the default
    hostkey paths as well. If desired these can be specified manually.
    Patch from CamVan Nguyen
  * group1-sha1 key exchange is disabled in the server by default since
    the fixed 1024-bit group may be susceptible to attacks
  * twofish ciphers are now disabled in the default configuration
  * Default generated ECDSA key size is now 256 (rather than 521)
    for better interoperability
  * Minimum RSA key length has been increased to 1024 bits
  * Add runtime -T max_auth_tries option from Kevin Darbyshire-Bryant
  * Add 'dbclient -J &fd' to allow dbclient to connect over an existing socket.
    See dbclient manpage for a socat example. Patch from Harald Becker
  * Add "-c forced_command" option. Patch from Jeremy Kerr
  * Restricted group -G option added with patch from stellarpower
  * Support server-chosen TCP forwarding ports, patch from houseofkodai
  * Allow choosing outgoing address for dbclient with -b [bind_address][:bind_port]
    Patch from houseofkodai
  * Makefile will now rebuild object files when header files are modified
  * Add group14-256 and group16 key exchange options
  * curve25519-sha256 also supported without @libssh.org suffix
  * Update bundled libtomcrypt to 1.18.1, libtommath to 1.0.1
    This fixes building with some recent versions of clang
  * Set PAM_RHOST which is needed by modules such as pam_abl
  * Improvements to DSS and RSA public key validation, found by OSS-Fuzz.
  * Don't exit when an authorized_keys file has malformed entries. Found by OSS-Fuzz
  * Fix null-pointer crash with malformed ECDSA or DSS keys. Found by OSS-Fuzz
  * Numerous code cleanups and small issues fixed by Francois Perrad
  * Test for pkt_sched.h rather than SO_PRIORITY which was problematic with some musl
    platforms. Reported by Oliver Schneider and Andrew Bainbridge
  * Fix some platform portability problems, from Ben Gardner
  * Add EXEEXT filename suffix for building dropbearmulti, from William Foster
  * Support --enable-<option> properly for configure, from Stefan Hauser
  * configure have_openpty result can be cached, from Eric Bénard
  * handle platforms that return close() < -1 on failure, from Marco Wenzel
  * Build and configuration cleanups from Michael Witten
  * Fix libtomcrypt/libtommath linking order, from Andre McCurdy
  * Fix old Linux platforms that have SYS_clock_gettime but not CLOCK_MONOTONIC
  * Update curve25519-donna implementation to current version

-------------------------------------------------------------------
Tue Feb 20 11:00:15 UTC 2018 - thardeck@suse.com

- fix fillupdir usage on Tumbleweed 

-------------------------------------------------------------------
Fri May 19 09:17:27 UTC 2017 - thardeck@suse.de

- update to upstream version 2017.75
  * Security: Fix double-free in server TCP listener cleanup
    A double-free in the server could be triggered by an authenticated user if
    dropbear is running with -a (Allow connections to forwarded ports from any host)
    This could potentially allow arbitrary code execution as root by an authenticated user.
    Affects versions 2013.56 to 2016.74. Thanks to Mark Shepard for reporting the crash.
  * Security: Fix information disclosure with ~/.ssh/authorized_keys symlink.
    Dropbear parsed authorized_keys as root, even if it were a symlink. The fix
    is to switch to user permissions when opening authorized_keys
    A user could symlink their ~/.ssh/authorized_keys to a root-owned file they
    couldn't normally read. If they managed to get that file to contain valid
    authorized_keys with command= options it might be possible to read other
    contents of that file.
    This information disclosure is to an already authenticated user.
    Thanks to Jann Horn of Google Project Zero for reporting this.
  * Generate hostkeys with dropbearkey atomically and flush to disk with fsync
    Thanks to Andrei Gherzan for a patch
  * Fix out of tree builds with bundled libtom
    Thanks to Henrik Nordström and Peter Krefting for patches.

-------------------------------------------------------------------
Thu Jul 21 16:13:41 UTC 2016 - thardeck@suse.com

- update to upstream version 2016.74
  * Security: Message printout was vulnerable to format string injection.
    If specific usernames including "%" symbols can be created on a system
    (validated by getpwnam()) then an attacker could run arbitrary code as root
    when connecting to Dropbear server.
    A dbclient user who can control username or host arguments could potentially
    run arbitrary code as the dbclient user. This could be a problem if scripts
    or webpages pass untrusted input to the dbclient program.
  * Security: dropbearconvert import of OpenSSH keys could run arbitrary code as
    the local dropbearconvert user when parsing malicious key files
  * Security: dbclient could run arbitrary code as the local dbclient user if
    particular -m or -c arguments are provided. This could be an issue where
    dbclient is used in scripts.
  * Security: dbclient or dropbear server could expose process memory to the
    running user if compiled with DEBUG_TRACE and running with -v
    The security issues were reported by an anonymous researcher working with
    Beyond Security's SecuriTeam Secure Disclosure www.beyondsecurity.com/ssd.html
  * Fix port forwarding failure when connecting to domains that have both
    IPv4 and IPv6 addresses. The bug was introduced in 2015.68
  * Fix 100% CPU use while waiting for rekey to complete. Thanks to Zhang Hui P
    for the patch

-------------------------------------------------------------------
Mon Mar 21 08:38:43 UTC 2016 - thardeck@suse.com

- updated to upstream version 2016.73
  * Support syslog in dbclient, option -o usesyslog=yes. Patch from Konstantin Tokarev
  * Kill a proxycommand when dbclient exits, patch from Konstantin Tokarev
  * Option to exit when a TCP forward fails, patch from Konstantin Tokarev
  * New "-o" option parsing from Konstantin Tokarev. This allows handling some extra options
    in the style of OpenSSH, though implementing all OpenSSH options is not planned.
  * Fix crash when fallback initshells() is used, reported by Michael Nowak and Mike Tzou
  * Allow specifying commands eg "dropbearmulti dbclient ..." instead of symlinks
  * Various cleanups for issues found by a lint tool, patch from Francois Perrad
  * Fix tab indent consistency, patch from Francois Perrad
  * Fix issues found by cppcheck, reported by Mike Tzou
  * Use system memset_s() or explicit_bzero() if available to clear memory. Also make
    libtomcrypt/libtommath routines use that (or Dropbear's own m_burn()).
  * Prevent scp failing when the local user doesn't exist. Based on patch from Michael Witten.
  * Improved Travis CI test running, thanks to Mike Tzou
  * Improve some code that was flagged by Coverity and Fortify Static Code Analyzer

-------------------------------------------------------------------
Fri Mar 11 16:00:23 UTC 2016 - thardeck@suse.com

- updated to upstream version 2016.72
  * Validate X11 forwarding input. Could allow bypass of authorized_keys command= restrictions,
    found by github.com/tintinweb. Thanks for Damien Miller for a patch.
- used as bug fix release for bnc#970633 - VUL-0: CVE-2016-3116

-------------------------------------------------------------------
Fri Dec  4 15:39:10 UTC 2015 - thardeck@suse.com

- updated to upstream version 2015.71
  * Fix "bad buf_incrpos" when data is transferred, broke in 2015.69
  * Fix crash on exit when -p address:port is used, broke in 2015.68
  * Fix building with only ENABLE_CLI_REMOTETCPFWD given, patch from Konstantin Tokarev
  * Fix bad configure script test which didn't work with dash shell, patch from Juergen Daubert,
    broke in 2015.70
  * Fix server race condition that could cause sessions to hang on exit,
    https://github.com/robotframework/SSHLibrary/issues/128

-------------------------------------------------------------------
Thu Nov 26 15:40:52 UTC 2015 - thardeck@suse.com

- updated to upstream version 2015.70
  * Fix server password authentication on Linux, broke in 2015.69
  * Fix crash when forwarded TCP connections fail to connect (bug introduced in 2015.68)
  * Avoid hang on session close when multiple sessions are started, affects Qt Creator
    Patch from Andrzej Szombierski
  * Reduce per-channel memory consumption in common case, increase default
    channel limit from 100 to 1000 which should improve SOCKS forwarding for modern
    webpages
  * Handle multiple command line arguments in a single flag, thanks to Guilhem Moulin
  * Manpage improvements from Guilhem Moulin
  * Build fixes for Android from Mike Frysinger
  * Don't display the MOTD when an explicit command is run from Guilhem Moulin
  * Check curve25519 shared secret isn't zero

-------------------------------------------------------------------
Mon Aug 10 08:13:56 UTC 2015 - thardeck@suse.com

- updated to upstream version 2015.68
  * Reduce local data copying for improved efficiency. Measured 30%
    increase in throughput for connections to localhost
  * Forwarded TCP ports connect asynchronously and try all available addresses
    (IPv4, IPv6, round robin DNS)
  * Fix all compile warnings, many patches from Gaël Portay
    Note that configure with -Werror may not be successful on some platforms (OS X)
    and some configuration options may still result in unused variable
    warnings.
  * Use TCP Fast Open on Linux if available. Saves a round trip at connection
    to hosts that have previously been connected.
    Needs a recent Linux kernel and possibly "sysctl -w net.ipv4.tcp_fastopen=3"
    Client side is disabled by default pending further compatibility testing
    with networks and systems.
  * Increase maximum command length to 9000 bytes
  * Free memory before exiting, patch from Thorsten Horstmann. Useful for
    Dropbear ports to embedded systems and for checking memory leaks
    with valgrind. Only partially implemented for dbclient.
    This is disabled by default, enable with DROPBEAR_CLEANUP in sysoptions.h
  * DROPBEAR_DEFAULT_CLI_AUTHKEY setting now always prepends home directory unless
    there is a leading slash (~ isn't treated specially)
  * Fix small ECC memory leaks
  * Tighten validation of Diffie-Hellman parameters, from Florent Daigniere of
    Matta Consulting. Odds of bad values are around 2**-512 -- improbable.
  * Twofish-ctr cipher is supported though disabled by default
  * Fix pre-authentication timeout when waiting for client SSH-2.0 banner, thanks
    to CL Ouyang
  * Fix null pointer crash with restrictions in authorized_keys without a command, patch from
    Guilhem Moulin
  * Ensure authentication timeout is handled while reading the initial banner,
    thanks to CL Ouyang for finding it.
  * Fix null pointer crash when handling bad ECC keys. Found by afl-fuzz

-------------------------------------------------------------------
Thu Feb  5 16:26:06 UTC 2015 - thardeck@suse.com

- fixed checksum URL

-------------------------------------------------------------------
Wed Jan 28 21:40:28 UTC 2015 - thardeck@suse.com

- updated to upstream version 2015.67
  * Call fsync() after generating private keys to ensure they aren't lost if a
    reboot occurs. Thanks to Peter Korsgaard
  * Disable non-delayed zlib compression by default on the server. Can be
    enabled if required for old clients with DROPBEAR_SERVER_DELAY_ZLIB
  * Default client key path ~/.ssh/id_dropbear
  * Prefer stronger algorithms by default, from Fedor Brunner. 
    AES256 over 3DES
    Diffie-hellman group14 over group1
  * Add option to disable CBC ciphers.
  * Disable twofish in default options.h
  * Enable sha2 HMAC algorithms by default, the code was already required
    for ECC key exchange. sha1 is the first preference still for performance. 
  * Fix installing dropbear.8 in a separate build directory, from Like Ma
  * Allow configure to succeed if libtomcrypt/libtommath are missing, from Elan Ruusamäe
  * Don't crash if ssh-agent provides an unknown type of key. From Catalin Patulea
  * Minor bug fixes, a few issues found by Coverity scan 

-------------------------------------------------------------------
Thu Dec  4 12:13:24 UTC 2014 - thardeck@suse.com

- replaced deprecated gpg-offline check by obs-service-source_validator

-------------------------------------------------------------------
Fri Oct 24 08:30:31 UTC 2014 - thardeck@suse.com

- updated to upstream version 2014.66
  * Use the same keepalive handling behaviour as OpenSSH. This will work better
    with some SSH implementations that have different behaviour with unknown
    message types.
  * Don't reply with SSH_MSG_UNIMPLEMENTED when we receive a reply to our own
    keepalive message
  * Set $SSH_CLIENT to keep bash happy, patch from Ryan Cleere
  * Fix wtmp which broke since 2013.62, patch from Whoopie

-------------------------------------------------------------------
Mon Aug 11 08:38:04 UTC 2014 - thardeck@suse.com

- updated to upstream version 2014.65
  * Fix 2014.64 regression, server session hang on exit with scp (and probably
    others), thanks to NiLuJe for tracking it down
  * Fix 2014.64 regression, clock_gettime() error handling which broke on older
    Linux kernels, reported by NiLuJe
  * Fix 2014.64 regression, writev() could occassionally fail with EAGAIN which
    wasn't caught
  * Avoid error message when trying to set QoS on proxycommand or multihop pipes
  * Use /usr/bin/xauth, thanks to Mike Frysinger
  * Don't exit the client if the local user entry can't be found, thanks to iquaba

-------------------------------------------------------------------
Mon Jul 28 09:40:02 UTC 2014 - thardeck@suse.com

- removed obsolete gpg soure code verifcation workaround
- added missing systemd entries for dropbear-keygen.service
- updated to upstream version 2014.64
  * Fix compiling with ECDSA and DSS disabled
  * Don't exit abruptly if too many outgoing packets are queued for writev(). Patch
    thanks to Ronny Meeus
  * The -K keepalive option now behaves more like OpenSSH's "ServerAliveInterval".
    If no response is received after 3 keepalives then the session is terminated. This
    will close connections faster than waiting for a TCP timeout.
  * Rework TCP priority setting. New settings are
    if (connecting || ptys || x11) tos = LOWDELAY
    else if (tcp_forwards) tos = 0
    else tos = BULK
    Thanks to Catalin Patulea for the suggestion.
  * Improve handling of many concurrent new TCP forwarded connections, should now
    be able to handle as many as MAX_CHANNELS. Thanks to Eduardo Silva for reporting
    and investigating it.
  * Make sure that exit messages from the client are printed, regression in 2013.57
  * Use monotonic clock where available, timeouts won't be affected by system time
    changes
  * Add -V for version

-------------------------------------------------------------------
Thu Feb 20 09:25:00 UTC 2014 - thardeck@suse.com

- fixed automatic tarball verfication
- updated regular init script to also create ECDSA keys

-------------------------------------------------------------------
Wed Feb 19 14:40:50 UTC 2014 - thardeck@suse.com

- update to upstream version 2014.63
  * Fix ~. to terminate a client interactive session after waking a laptop
  from sleep.
  * Changed port separator syntax again, now using host^port. This is because
  IPv6 link-local addresses use %. Reported by Gui Iribarren
  * Avoid constantly relinking dropbearmulti target, fix "make install"
  for multi target, thanks to Mike Frysinger
  * Avoid getting stuck in a loop writing huge key files, reported by Bruno
  Thomsen
  * Don't link dropbearkey or dropbearconvert to libz or libutil,
  thanks to Nicolas Boos
  * Fix linking -lcrypt on systems without /usr/lib, thanks to Nicolas Boos
  * Avoid crash on exit due to cleaned up keys before last packets are sent,
  debugged by Ronald Wahl
  * Fix a race condition in rekeying where Dropbear would exit if it received a
  still-in-flight packet after initiating rekeying. Reported by Oliver Metz.
  This is a longstanding bug but is triggered more easily since 2013.57
  * [...]
- updated service files and activated building of ecdsa keys
- only package the old init service in distributions without systemd
- adapted spec to follow systemd package guidelines
- cleaned up spec file

-------------------------------------------------------------------
Wed Dec  4 13:50:10 UTC 2013 - thardeck@suse.com

- imported upstream version 2013.62
  * Disable "interactive" QoS connection options when a connection doesn't
    have a PTY (eg scp, rsync). Thanks to Catalin Patulea for the patch.
  * Log when a hostkey is generated with -R, fix some bugs in handling server
    hostkey commandline options
  * Fix crash in Dropbearconvert and 521 bit key, reported by NiLuJe
  * Update config.guess and config.sub again
  * ECC (elliptic curve) support. Supports ECDSA hostkeys (requires new keys to
    be generated) and ECDH for setting up encryption keys (no intervention
    required). This is significantly faster.
  * curve25519-sha256@libssh.org support for setting up encryption keys. This is
    another elliptic curve mode with less potential of NSA interference in
    algorithm parameters. curve25519-donna code thanks to Adam Langley
  * -R option to automatically generate hostkeys. This is recommended for
    embedded platforms since it allows the system random number device
    /dev/urandom a longer startup time to generate a secure seed before the
    hostkey is required.
  * Compile fixes for old vendor compilers like Tru64 from Daniel Richard G.
  * Make authorized_keys handling more robust, don't exit encountering
    malformed lines. Thanks to Lorin Hochstein and Mark Stillwell

-------------------------------------------------------------------
Thu Oct 17 08:35:01 UTC 2013 - thardeck@suse.com

- imported upstream version 2013.60
  * Fix "make install" so that it doesn't always install to /bin and /sbin
  * Fix "make install MULTI=1", installing manpages failed
  * Fix "make install" when scp is included since it has no manpage
  * Make --disable-bundled-libtom work
- used as bug fix release for bnc#845306 - VUL-0: CVE-2013-4421

-------------------------------------------------------------------
Thu Oct 10 07:29:00 UTC 2013 - thardeck@suse.com

- provided links for download sources
- employed gpg-offline - verify sources 

-------------------------------------------------------------------
Mon Oct  7 08:10:32 UTC 2013 - thardeck@suse.com

- imported upstream version 2013.59
  * Fix crash from -J command 
    Thanks to Lluís Batlle i Rossell and Arnaud Mouiche for patches
  * Avoid reading too much from /proc/net/rt_cache since that causes
    system slowness. 
  * Improve EOF handling for half-closed connections
    Thanks to Catalin Patulea
  * Send a banner message to report PAM error messages intended for the user
    Patch from Martin Donnelly
  * Limit the size of decompressed payloads, avoids memory exhaustion denial
    of service 
    Thanks to Logan Lamb for reporting and investigating it
  * Avoid disclosing existence of valid users through inconsistent delays
    Thanks to Logan Lamb for reporting
  * Update config.guess and config.sub for newer architectures
  * Avoid segfault in server for locked accounts
  * "make install" now installs manpages
    dropbearkey.8 has been renamed to dropbearkey.1
    manpage added for dropbearconvert
  * Get rid of one second delay when running non-interactive commands 

-------------------------------------------------------------------
Sat Apr 20 18:49:38 UTC 2013 - thardeck@suse.com

- reverted init file installation on 12.3

-------------------------------------------------------------------
Fri Apr 19 08:26:17 UTC 2013 - thardeck@suse.com

- imported upstream version 2013.58
  * Fix building with Zlib disabled, thanks to Hans Harder and cuma@freetz
  * Use % as a separator for ports, fixes scp in multihop mode, from Hans Harder
  * Reject logins for other users when running as non-root, from Hans Harder
  * Disable client immediate authentication request by default, it prevents passwordless logins from working 

-------------------------------------------------------------------
Fri Mar 22 08:48:43 UTC 2013 - thardeck@suse.com

- imported upstream version 2013.56
  * Allow specifying cipher (-c) and MAC (-m) lists for dbclient
  * Allow using 'none' cipher or MAC (off by default, use options.h). Encryption
  is used during authentication then disabled, similar to OpenSSH HPN mode
  * Allow a user in immediately if the account has a blank password and blank
  passwords are enabled
  * Include a few extra sources of entropy from /proc on Linux, hash private keys
  as well. Dropbear will also write gathered entropy back into /dev/urandom
  * Added hmac-sha2-256 and hmac-sha2-512 support (off by default, use options.h)
  * Don't sent bad address "localhost" for -R forward connections,
  reported by Denis Bider
  * Add "-B" runtime option to allow blank passwords
  * Allow using IPv6 bracket notation for addresses in server "-p" option, from Ben Jencks
  * A few improvements for Android from Reimar Döffinger
  * Fix memory leak for TCP forwarded connections to hosts that timed out,
  reported by Norbert Benczúr. Appears to be a very long-standing bug.
  * Fix "make clean" for out of tree builds
  * Fix compilation when ENABLE_{SVR,CLI}_AGENTFWD are unset

-------------------------------------------------------------------
Thu Aug  2 11:13:49 UTC 2012 - thardeck@suse.com

- removed PAM dependency since Dropbear should be usable in initrd and PAM wasn't used without an additional patch anyway https://wiki.yoctoproject.org/wiki/PAM_Integration#dropbear

-------------------------------------------------------------------
Mon Jul  9 20:11:26 UTC 2012 - thardeck@suse.com

- fixed typo in service file

-------------------------------------------------------------------
Sat Jun 30 11:49:10 UTC 2012 - thardeck@suse.com

- added systemd service files for 12.1 and later
- cleaned up sysconfig and rcdropbear files

-------------------------------------------------------------------
Tue Jun 19 12:42:00 UTC 2012 - thardeck@suse.com

- added init daemon with key generation option
- added sysconfig file with default configuration

-------------------------------------------------------------------
Fri Jun 15 09:45:36 UTC 2012 - thardeck@suse.com

- updated spec file - changed the group

-------------------------------------------------------------------
Wed Jun 13 11:50:22 UTC 2012 - thardeck@suse.com

- initial version 2012.55
openSUSE Build Service is sponsored by