Re: Is there a new ssh somewhere? (was Re: Use opie on Debian central servers to prevent password sniffing?)
On Sat, Dec 20, 2003 at 03:58:52PM -0700, Tim Freeman wrote:
> From: Tim Freeman <tim@fungible.com>
> Date: Wed, 10 Dec 2003 14:20:03 -0700
> >Yes, using opie and pam and sshd all at once requires turning off
> >privilege separation for sshd.
>
> According to the changelog entries, this is fixed in 3.7p1 of openssh,
> which came out on September 19, 2003.
>
> As of December 17, the version of ssh in Debian unstable was 3.6.1p2.
>
> Any plans to have a new version of ssh out in unstable any time soon?
> Is there an experimental openssh package with 3.7p1 or better?
No, not yet. Experimentation with 3.7 back when it came out revealed
that it was going to be quite hard work to get the new PAM code working
acceptably for Debian, and the new PAM code is a significant change that
affects a number of other packages. The plan is to ship sarge with
security-patched 3.6.1p2.
Cheers,
--
Colin Watson [cjwatson@flatline.org.uk]
Reply to: