File 0002-upstream-disable-UpdateHostkeys-by-default-if.patch of Package openssh.33331
From e79957e877db42c4c68fabcf6ecff2268e53acb5 Mon Sep 17 00:00:00 2001
From: "djm@openbsd.org" <djm@openbsd.org>
Date: Wed, 7 Oct 2020 02:18:45 +0000
Subject: [PATCH] upstream: disable UpdateHostkeys by default if
VerifyHostKeyDNS is
enabled; suggested by Mark D. Baushke
OpenBSD-Commit-ID: 85a1b88592c81bc85df7ee7787dbbe721a0542bf
---
readconf.c | 7 ++++---
ssh_config.5 | 8 +++++---
2 files changed, 9 insertions(+), 6 deletions(-)
diff --git a/readconf.c b/readconf.c
index a4f6cba0519..8655646b47f 100644
--- a/readconf.c
+++ b/readconf.c
#@@ -1,4 +1,4 @@
#-/* $OpenBSD: readconf.c,v 1.337 2020/10/03 09:22:26 djm Exp $ */
#+/* $OpenBSD: readconf.c,v 1.338 2020/10/07 02:18:45 djm Exp $ */
# /*
# * Author: Tatu Ylonen <ylo@cs.hut.fi>
# * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -2168,9 +2168,10 @@ fill_default_options(Options * options)
xstrdup(_PATH_SSH_SYSTEM_HOSTFILE2);
}
if (options->update_hostkeys == -1) {
- if (options->num_user_hostfiles == 0 ||
+ if (options->verify_host_key_dns <= 0 &&
+ (options->num_user_hostfiles == 0 ||
(options->num_user_hostfiles == 1 && strcmp(options->
- user_hostfiles[0], _PATH_SSH_USER_HOSTFILE) == 0))
+ user_hostfiles[0], _PATH_SSH_USER_HOSTFILE) == 0)))
options->update_hostkeys = SSH_UPDATE_HOSTKEYS_YES;
else
options->update_hostkeys = SSH_UPDATE_HOSTKEYS_NO;
diff --git a/ssh_config.5 b/ssh_config.5
index e085efffce7..2f1886a1b07 100644
--- a/ssh_config.5
+++ b/ssh_config.5
#@@ -33,8 +33,8 @@
# .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
# .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
# .\"
#-.\" $OpenBSD: ssh_config.5,v 1.334 2020/10/03 08:30:47 djm Exp $
#-.Dd $Mdocdate: October 3 2020 $
#+.\" $OpenBSD: ssh_config.5,v 1.335 2020/10/07 02:18:45 djm Exp $
#+.Dd $Mdocdate: October 7 2020 $
# .Dt SSH_CONFIG 5
# .Os
# .Sh NAME
@@ -1723,7 +1723,9 @@ host was already trusted or explicitly accepted by the user.
.Cm UpdateHostKeys
is enabled by default if the user has not overridden the default
.Cm UserKnownHostsFile
-setting, otherwise
+setting and has not enabled
+.Cm VerifyHostKeyDNS ,
+otherwise
.Cm UpdateHostKeys
will be set to
.Cm no .