pam_ssh_agent_auth-0.10.4-5.43.el9.alma.2 RPM for x86_64

From AlmaLinux 9.5 AppStream for x86_64

This package contains a PAM module which can be used to authenticate
users using ssh keys stored in a ssh-agent. Through the use of the
forwarding of ssh-agent connection it also allows to authenticate with
remote ssh-agent instance.

The module is most useful for su and sudo service stacks.

Provides

• pam_ssh_agent_auth
• pam_ssh_agent_auth(x86-64)

Requires

• libc.so.6()(64bit)
• libc.so.6(GLIBC_2.14)(64bit)
• libc.so.6(GLIBC_2.2.5)(64bit)
• libc.so.6(GLIBC_2.25)(64bit)
• libc.so.6(GLIBC_2.26)(64bit)
• libc.so.6(GLIBC_2.3)(64bit)
• libc.so.6(GLIBC_2.3.4)(64bit)
• libc.so.6(GLIBC_2.33)(64bit)
• libc.so.6(GLIBC_2.34)(64bit)
• libc.so.6(GLIBC_2.4)(64bit)
• libc.so.6(GLIBC_2.8)(64bit)
• libcrypto.so.3()(64bit)
• libcrypto.so.3(OPENSSL_3.0.0)(64bit)
• libpam.so.0()(64bit)
• libpam.so.0(LIBPAM_1.0)(64bit)
• libselinux.so.1()(64bit)
• rpmlib(CompressedFileNames) <= 3.0.4-1
• rpmlib(FileDigests) <= 4.6.0-1
• rpmlib(PayloadFilesHavePrefix) <= 4.0-1
• rpmlib(PayloadIsZstd) <= 5.4.18-1
• rtld(GNU_HASH)

License

BSD

Changelog

* Sat Mar 01 2025 Andrew Lukoshko <alukoshko@almalinux.org> - 8.7p1-43.alma.2
  - Backport from CentOS Stream 9 to fix missing error codes set and invalid error
    code checks in OpenSSH. It prevents memory exhaustion attack and a MITM
    attack when VerifyHostKeyDNS is on (CVE-2025-26465).
    Resolves: RHEL-78700
* Tue Jul 09 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-43
  - Possible remote code execution due to a race condition (CVE-2024-6409)
    Resolves: RHEL-45741
* Thu Jul 04 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-42
  - Possible remote code execution due to a race condition (CVE-2024-6387)
    Resolves: RHEL-45348
* Mon Jun 03 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-41
  - Fix ssh multiplexing connect timeout processing
    Resolves: RHEL-37748
* Thu May 02 2024 Zoltan Fridrich <zfridric@redhat.com> - 8.7p1-40
  - Correctly audit hostname and IP address
    Resolves: RHEL-22316
  - Make default key sizes configurable in sshd-keygen
    Resolves: RHEL-26454
* Wed Apr 24 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-39
  - Use FIPS-compatible API for key derivation
    Resolves: RHEL-32809
* Fri Jan 05 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-38
  - Fix Terrapin attack
    Resolves: CVE-2023-48795
* Fri Jan 05 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-37
  - Fix Terrapin attack
    Resolves: CVE-2023-48795
* Wed Dec 20 2023 Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-36
  - Fix Terrapin attack
    Resolves: CVE-2023-48795
  - Relax OpenSSH build-time checks for OpenSSL version
    Related: RHEL-4734
  - Forbid shell metasymbols in username/hostname
    Resolves: CVE-2023-51385
* Mon Oct 23 2023 Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-35
  - Relax OpenSSH checks for OpenSSL version
    Resolves: RHEL-4734
  - Limit artificial delays in sshd while login using AD user
    Resolves: RHEL-2469
  - Move users/groups creation logic to sysusers.d fragments
    Resolves: RHEL-5222
* Thu Jul 20 2023 Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-34
  - Avoid remote code execution in ssh-agent PKCS#11 support
    Resolves: CVE-2023-38408
* Tue Jun 13 2023 Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-33
  - Allow specifying validity interval in UTC
    Resolves: rhbz#2115043
* Wed May 24 2023 Norbert Pocs <npocs@redhat.com> - 8.7p1-32
  - Fix pkcs11 issue with the recent changes
  - Delete unnecessary log messages from previous compl-dh patch
  - Add ssh_config man page explanation on rhbz#2068423
  - Resolves: rhbz#2207793, rhbz#2209096
* Tue May 16 2023 Norbert Pocs <npocs@redhat.com> - 8.7p1-31
  - Fix minor issues with openssh-8.7p1-evp-fips-compl-dh.patch:
  - Check return values
  - Use EVP API to get the size of DH
  - Add some log debug lines
  - Related: rhbz#2091694
* Thu Apr 20 2023 Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-30
  - Some non-terminating processes were listening on ports.
    Resolves: rhbz#2177768
  - On sshd startup, we check whether signing using the SHA1 for signing is
    available and don't use it when it isn't.
  - On ssh private key conversion we explicitly use SHA2 for testing RSA keys.
  - In sshd, when SHA1 signatures are unavailable, we fallback (fall forward :) )
    to SHA2 on host keys proof confirmation.
  - On a client side we permit SHA2-based proofs from server when requested SHA1
    proof (or didn't specify the hash algorithm that implies SHA1 on the client
    side). It is aligned with already present exception for RSA certificates.
  - We fallback to SHA2 if SHA1 signatures is not available on the client side
    (file sshconnect2.c).
  - We skip dss-related tests (they don't work without SHA1).
    Resolves: rhbz#2070163
  - FIPS compliance efforts for dh, ecdh and signing
    Resolves: rhbz#2091694
* Thu Apr 06 2023 Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-29
  - Resolve possible self-DoS with some clients
    Resolves: rhbz#2186473

Files

/usr/lib/.build-id
/usr/lib/.build-id/cd
/usr/lib/.build-id/cd/915b1e41fb5421d63fcd6b13ccaf94cf4df211
/usr/lib64/security/pam_ssh_agent_auth.so
/usr/share/licenses/pam_ssh_agent_auth
/usr/share/licenses/pam_ssh_agent_auth/OPENSSH_LICENSE
/usr/share/man/man8/pam_ssh_agent_auth.8.gz

Generated by rpm2html 1.8.1

Fabrice Bellet, Thu Mar 13 04:31:44 2025