move #include <paths.h> out of includes.h; ok markus@

make this -Wsign-compare clean; ok avsm@ markus@

introduce a generic %foo expansion function. replace existing % expansion and
add expansion to ControlPath; ok markus@

Populate host for log message for logins denied by AllowUsers and DenyUsers.
(bz #999); ok markus@

Log source of connections denied by AllowUsers, DenyUsers, AllowGroups and
DenyGroups. bz #909, ok djm@

more s/illegal/invalid/

s/Illegal user/Invalid user/; many requests; ok djm, millert, niklas, miod, ...

Add MaxAuthTries sshd config option; ok markus@

improve some code lint did not like; djm millert ok

make two tiny header files go away; djm ok

unexpand and delete whitespace at EOL; ok markus@

replace fatal_cleanup() and linked list of fatal callbacks with static
cleanup_exit() function. re-refine cleanup_exit() where appropriate,
allocate sshd's authctxt eary to allow simpler cleanup in

replace fatal_cleanup() and linked list of fatal callbacks with static
cleanup_exit() function. re-refine cleanup_exit() where appropriate,
allocate sshd's authctxt eary to allow simpler cleanup in sshd.
tested by many, ok deraadt@

show more ...

fix passwd auth for 'username leaks via timing'; with djm@, original patches from solar

deprecate VerifyReverseMapping since it's dangerous if combined
with IP based access control as noted by Mike Harding; replace with
a UseDNS option, UseDNS is on by default and includes the
VerifyRev

deprecate VerifyReverseMapping since it's dangerous if combined
with IP based access control as noted by Mike Harding; replace with
a UseDNS option, UseDNS is on by default and includes the
VerifyReverseMapping check; with itojun@, provos@, jakob@ and deraadt@
ok deraadt@, djm@

show more ...

rename log() into logit() to avoid name conflict. markus ok, from netbsd

don't compare against pw_home if realpath fails for pw_home (seen on AFS); ok djm@

log illegal user here for missing privsep case (ssh2).
this is executed in the monitor. ok markus@

typo in comment

Fix typo/thinko. Pass in as to auth_approval(), not NULL.
Closes PR 2659.

move the packet_send_debug handling from auth-options.c to auth.c; ok provos@

check for NULL; from provos@

make getpwnamallow() allways call pwcopy()

KNF whitespace

move auth_approval into getpwnamallow with help from millert@

getpwnamallow returns struct passwd * only if user valid; okay markus@