[gsi-openssh/f17] Based on openssh-5.9p1-29.fc17

[Mattias Ellert]

commit cf02f6597dfd60e99a2050dbc79a12a1d961a5d4
Author: Mattias Ellert <mattias.ellert at fysast.uu.se>
Date:   Tue Feb 26 13:47:48 2013 +0100

    Based on openssh-5.9p1-29.fc17

 gsi-openssh.spec                        |    8 +++++-
 openssh-5.9p1-change-max-startups.patch |   42 +++++++++++++++++++++++++++++++
 2 files changed, 49 insertions(+), 1 deletions(-)
---
diff --git a/gsi-openssh.spec b/gsi-openssh.spec
index 37adeb6..5f769ba 100644
--- a/gsi-openssh.spec
+++ b/gsi-openssh.spec
@@ -32,7 +32,7 @@
 %global nologin 1
 
 %global openssh_ver 5.9p1
-%global openssh_rel 9
+%global openssh_rel 10
 
 Summary: An implementation of the SSH protocol with GSI authentication
 Name: gsi-openssh
@@ -161,6 +161,8 @@ Patch901: openssh-5.9p1-kuserok.patch
 Patch902: openssh-5.9p1-man-moduli.patch
 #https://bugzilla.redhat.com/show_bug.cgi?id=861818
 Patch903: openssh-5.9p1-ipqos.patch
+# change default value of MaxStartups - CVE-2010-5107 - #908707
+Patch904: openssh-5.9p1-change-max-startups.patch
 
 # This is the patch that adds GSI support
 # Based on http://grid.ncsa.illinois.edu/ssh/dl/patch/openssh-5.9p1.patch
@@ -329,6 +331,7 @@ This version of OpenSSH has been modified to support GSI authentication.
 %patch901 -p1 -b .kuserok
 %patch902 -p1 -b .man-moduli
 %patch903 -p1 -b .ipqos
+%patch904 -p1 -b .max-startups
 
 %patch98 -p1 -b .gsi
 
@@ -552,6 +555,9 @@ fi
 %attr(0644,root,root) %{_unitdir}/gsisshd.service
 
 %changelog
+* Tue Feb 26 2013 Mattias Ellert <mattias.ellert at fysast.uu.se> - 5.9p1-10
+- Based on openssh-5.9p1-29.fc17
+
 * Tue Dec 11 2012 Mattias Ellert <mattias.ellert at fysast.uu.se> - 5.9p1-9
 - Based on openssh-5.9p1-28.fc17
 
diff --git a/openssh-5.9p1-change-max-startups.patch b/openssh-5.9p1-change-max-startups.patch
new file mode 100644
index 0000000..2055e77
--- /dev/null
+++ b/openssh-5.9p1-change-max-startups.patch
@@ -0,0 +1,42 @@
+diff -up openssh-5.9p1/servconf.c.max-startups openssh-5.9p1/servconf.c
+--- openssh-5.9p1/servconf.c.max-startups	2013-02-08 15:59:09.785709477 +0100
++++ openssh-5.9p1/servconf.c	2013-02-08 15:59:09.792709448 +0100
+@@ -265,11 +265,11 @@ fill_default_server_options(ServerOption
+ 	if (options->gateway_ports == -1)
+ 		options->gateway_ports = 0;
+ 	if (options->max_startups == -1)
+-		options->max_startups = 10;
++		options->max_startups = 100;
+ 	if (options->max_startups_rate == -1)
+-		options->max_startups_rate = 100;		/* 100% */
++		options->max_startups_rate = 30;		/* 30% */
+ 	if (options->max_startups_begin == -1)
+-		options->max_startups_begin = options->max_startups;
++		options->max_startups_begin = 10;
+ 	if (options->max_authtries == -1)
+ 		options->max_authtries = DEFAULT_AUTH_FAIL_MAX;
+ 	if (options->max_sessions == -1)
+diff -up openssh-5.9p1/sshd_config.5.max-startups openssh-5.9p1/sshd_config.5
+--- openssh-5.9p1/sshd_config.5.max-startups	2013-02-08 15:59:09.786709473 +0100
++++ openssh-5.9p1/sshd_config.5	2013-02-08 15:59:09.793709444 +0100
+@@ -796,7 +796,7 @@ SSH daemon.
+ Additional connections will be dropped until authentication succeeds or the
+ .Cm LoginGraceTime
+ expires for a connection.
+-The default is 10.
++The default is 10:30:100.
+ .Pp
+ Alternatively, random early drop can be enabled by specifying
+ the three colon separated values
+diff -up openssh-5.9p1/sshd_config.max-startups openssh-5.9p1/sshd_config
+--- openssh-5.9p1/sshd_config.max-startups	2013-02-08 15:59:09.000000000 +0100
++++ openssh-5.9p1/sshd_config	2013-02-08 16:00:03.784485797 +0100
+@@ -120,7 +120,7 @@ X11Forwarding yes
+ #ShowPatchLevel no
+ #UseDNS yes
+ #PidFile /var/run/sshd.pid
+-#MaxStartups 10
++#MaxStartups 10:30:100
+ #PermitTunnel no
+ #ChrootDirectory none
+