HP-UX Secure Shell A.04.70.021, A.04.70.022, and A.04.70.023 Release Notes

Table 1-2 Defects Fixed in OpenSSH4.7p1 (continued)
Defect FixDefect Identifier
Improved exit message from ControlMaster clients to provide the following error
message:
Shared connection to <hostname> closed.
Bugzilla #1262
Fixed sftp-server to prevent it from reading TCP packets when the buffer space
is full.
Bugzilla #1286
For more information on these defect fixes, see the Bugzilla Website at: http://bugzilla.mindrot.org.
Defect Fixed in HP-UX Secure Shell A.04.70.021, A.04.70.022, and
A.04.70.023
HP-UX Secure Shell versions A.04.70.021, A.04.70.022, and A.04.70.023 include the following
defect fix:
JAGag49488 Upgrading HP-UX Secure Shell from A.04.30.007 to A.04.50.010 on an HP-UX
11i v2 Itanium server can leave the system with the old binary, if there are active
ssh connections during the upgrade.
Known Problems and Workarounds
Following are the known problems and workarounds in HP-UX Secure Shell A.04.70.021,
A.04.70.022, and A.04.70.023:
• Do not specify user specific information during configuration of hostbased authentication.
Host-based authentication supports only authentication of hosts. It does not allow
user-specific authentication. When a user configures host-based authentication with the
following commands:
# cat /etc/hosts.equiv
myhost.mydomain.com specificuser
It allows the [e-mail] to login into any local account on
the remote machine.
• OpenSSH 4.7p1 base code supports logging of sftp transactions. LogFacility and
LogLevel options are added to sftp-server as command-line options to log these transactions.
As a result, the following directives are not supported in this release of HP-UX Secure Shell:
— #LogSftp no
— #SftpLogFacility AUTH
— #SftpLogLevel INFO
• JAGaf59448: The following SMSE behavior is seen in this version of HP-UX Secure Shell:
Audit log messages show repeated entries for a user. This occurs because bad login attempts
are logged in the audit file. For example, a user trying Public key authentication with bad
RSA and DSA keys results in a bad login attempt for each key type. In such a scenario, the
audit log has the following entries:
SELF-AUDITING TEXT: User= root uid=0 ssh authentication method PUBKEY - failed
SELF-AUDITING TEXT: User= root uid=0 ssh authentication success - user logged in
SELF-AUDITING TEXT: User= root uid=0 ssh session open
Defect Fixed in HP-UX Secure Shell A.04.70.021, A.04.70.022, and A.04.70.023 9