Re: git: 1c7000b1d4b8 - main - security/openssh-portable: Disable X11Forwarding by default.

I have a bunch of openssh commits that will each bump PORTREVISION.

The justification is that I think smaller revertible clear commits are 
better on a security-related port that contains so many feature patches.

Bryan

On 4/25/26 3:26 PM, Bryan Drewery wrote:
> The branch main has been updated by bdrewery:
>
> URL: https://cgit.FreeBSD.org/ports/commit/?id=1c7000b1d4b8cc460d939bfd567ab3ec6e40bdcc
>
> commit 1c7000b1d4b8cc460d939bfd567ab3ec6e40bdcc
> Author:     Bryan Drewery <bdrewery@FreeBSD.org>
> AuthorDate: 2026-04-25 22:16:18 +0000
> Commit:     Bryan Drewery <bdrewery@FreeBSD.org>
> CommitDate: 2026-04-25 22:26:11 +0000
>
>      security/openssh-portable: Disable X11Forwarding by default.
>      
>      This syncs with src and upstream.
>      
>      Submitted by:   jlduran
>      Differential Revision:  https://reviews.freebsd.org/D53268
> ---
>   UPDATING                                            | 7 +++++++
>   security/openssh-portable/Makefile                  | 2 +-
>   security/openssh-portable/files/patch-servconf.c    | 9 ---------
>   security/openssh-portable/files/patch-sshd_config   | 9 ---------
>   security/openssh-portable/files/patch-sshd_config.5 | 9 ---------
>   5 files changed, 8 insertions(+), 28 deletions(-)
>
> diff --git a/UPDATING b/UPDATING
> index 10a1febfb914..fd9e6bbe40ee 100644
> --- a/UPDATING
> +++ b/UPDATING
> @@ -5,6 +5,13 @@ they are unavoidable.
>   You should get into the habit of checking this file for changes each time
>   you update your ports collection, before attempting any port upgrades.
>   
> +20260425:
> +  AFFECTS: Users of security/openssh-portable
> +  AUTHOR: bdrewery@FreeBSD.org
> +
> +  X11Forwarding default has changed from "yes" to "no" to match src
> +  and upstream.
> +
>   20260418:
>     AFFECTS: Users of net/rsync and net/rsync@python
>     AUTHOR: rodrigo@FreeBSD.org
> diff --git a/security/openssh-portable/Makefile b/security/openssh-portable/Makefile
> index 85c317597ae4..979f9cdd3da9 100644
> --- a/security/openssh-portable/Makefile
> +++ b/security/openssh-portable/Makefile
> @@ -1,6 +1,6 @@
>   PORTNAME=	openssh
>   DISTVERSION=	10.2p1
> -PORTREVISION=	3
> +PORTREVISION=	4
>   PORTEPOCH=	1
>   CATEGORIES=	security
>   MASTER_SITES=	OPENBSD/OpenSSH/portable
> diff --git a/security/openssh-portable/files/patch-servconf.c b/security/openssh-portable/files/patch-servconf.c
> index 33ead18621bb..2dddc7e5c286 100644
> --- a/security/openssh-portable/files/patch-servconf.c
> +++ b/security/openssh-portable/files/patch-servconf.c
> @@ -29,15 +29,6 @@ Apply FreeBSD's configuration defaults.
>    	if (options->pam_service_name == NULL)
>    		options->pam_service_name = xstrdup(SSHD_PAM_SERVICE);
>    
> -@@ -339,7 +344,7 @@ fill_default_server_options(ServerOptions *options)
> - 	if (options->print_lastlog == -1)
> - 		options->print_lastlog = 1;
> - 	if (options->x11_forwarding == -1)
> --		options->x11_forwarding = 0;
> -+		options->x11_forwarding = 1;
> - 	if (options->x11_display_offset == -1)
> - 		options->x11_display_offset = 10;
> - 	if (options->x11_use_localhost == -1)
>   @@ -381,7 +386,11 @@ fill_default_server_options(ServerOptions *options)
>    	if (options->gss_strict_acceptor == -1)
>    		options->gss_strict_acceptor = 1;
> diff --git a/security/openssh-portable/files/patch-sshd_config b/security/openssh-portable/files/patch-sshd_config
> index 7b6bc14977c7..6d14dd3a1335 100644
> --- a/security/openssh-portable/files/patch-sshd_config
> +++ b/security/openssh-portable/files/patch-sshd_config
> @@ -22,12 +22,3 @@
>    
>    #AuthorizedPrincipalsFile none
>    
> -@@ -84,7 +88,7 @@ AuthorizedKeysFile	.ssh/authorized_keys
> - #AllowAgentForwarding yes
> - #AllowTcpForwarding yes
> - #GatewayPorts no
> --#X11Forwarding no
> -+#X11Forwarding yes
> - #X11DisplayOffset 10
> - #X11UseLocalhost yes
> - #PermitTTY yes
> diff --git a/security/openssh-portable/files/patch-sshd_config.5 b/security/openssh-portable/files/patch-sshd_config.5
> index f5297c2a42c2..e671f178e399 100644
> --- a/security/openssh-portable/files/patch-sshd_config.5
> +++ b/security/openssh-portable/files/patch-sshd_config.5
> @@ -48,12 +48,3 @@
>    .It Cm X11DisplayOffset
>    Specifies the first display number available for
>    .Xr sshd 8 Ns 's
> -@@ -1793,7 +1827,7 @@
> - or
> - .Cm no .
> - The default is
> --.Cm no .
> -+.Cm yes .
> - .Pp
> - When X11 forwarding is enabled, there may be additional exposure to
> - the server and to client displays if the
>