Page MenuHomeFreeBSD
Files F115568249

D37411.diff
No OneTemporary
Actions

D37411.diff
View Options

diff --git a/UPDATING b/UPDATING
--- a/UPDATING
+++ b/UPDATING
@@ -27,6 +27,11 @@
world, or to merely disable the most expensive debugging functionality
at runtime, run "ln -s 'abort:false,junk:false' /etc/malloc.conf".)
+20230206:
+ sshd now defaults to having X11Forwarding disabled, following upstream.
+ Administrators who wish to enable X11Forwarding should add
+ `X11Forwarding yes` to /etc/ssh/sshd_config.
+
20230130:
As of commit 7c40e2d5f685, the dependency on netlink(4) has been added
to the linux_common(4) module. Users relying on linux_common may need
diff --git a/crypto/openssh/FREEBSD-upgrade b/crypto/openssh/FREEBSD-upgrade
--- a/crypto/openssh/FREEBSD-upgrade
+++ b/crypto/openssh/FREEBSD-upgrade
@@ -113,7 +113,6 @@
- UsePAM defaults to "yes".
- PermitRootLogin defaults to "no".
- - X11Forwarding defaults to "yes".
- PasswordAuthentication defaults to "no".
- VersionAddendum defaults to "FreeBSD-YYYYMMDD".
- UseDNS defaults to "yes".
diff --git a/crypto/openssh/servconf.c b/crypto/openssh/servconf.c
--- a/crypto/openssh/servconf.c
+++ b/crypto/openssh/servconf.c
@@ -331,7 +331,7 @@
if (options->print_lastlog == -1)
options->print_lastlog = 1;
if (options->x11_forwarding == -1)
- options->x11_forwarding = 1;
+ options->x11_forwarding = 0;
if (options->x11_display_offset == -1)
options->x11_display_offset = 10;
if (options->x11_use_localhost == -1)
diff --git a/crypto/openssh/sshd_config b/crypto/openssh/sshd_config
--- a/crypto/openssh/sshd_config
+++ b/crypto/openssh/sshd_config
@@ -88,7 +88,7 @@
#AllowAgentForwarding yes
#AllowTcpForwarding yes
#GatewayPorts no
-#X11Forwarding yes
+#X11Forwarding no
#X11DisplayOffset 10
#X11UseLocalhost yes
#PermitTTY yes
diff --git a/crypto/openssh/sshd_config.5 b/crypto/openssh/sshd_config.5
--- a/crypto/openssh/sshd_config.5
+++ b/crypto/openssh/sshd_config.5
@@ -1932,7 +1932,7 @@
or
.Cm no .
The default is
-.Cm yes .
+.Cm no .
.Pp
When X11 forwarding is enabled, there may be additional exposure to
the server and to client displays if the

File Metadata

Mime Type
text/plain
Expires
Sat, Apr 26, 11:03 AM (17 h, 44 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
17789676
Default Alt Text
D37411.diff (2 KB)

Event Timeline