
	* Release 0.9.1.


	* appl/ftp/ftpd/ftpcmd.y: s/timeout/ftpd_timeout/

	* appl/kstring2key/kstring2key.c: `usage' changed to void.

	* lib/krb/mk_req.c: `build_request' changed to void.

	* appl/ftp/ftp/ftp_locl.h: Changed order of includes.

	* appl/bsd/login.c, appl/ftp/ftpd/*: s/timeout/login_timeout/

	* lib/kafs/afssysdefs.h: undef AFS_SYSCALL if we are defining it.


	* lib/kafs/afssys.c: AIX systems will now correctly (I hope)
 	detect whether AFS is loaded or not. This is currently a bit
 	kludgy, and involves loading an external shared library,
 	afslib.so, which can be put in athena/lib or pointed to with
 	environment variable AFSLIBPATH.  This is only tested on AIX 4
 	(due to lack of an AIX 3 system).


	* lib/krb/getrealm.c: Range-check the result from the DNS.

	* lib/krb/get_krbrlm.c: Try to use the DNS to find out which realm
 	this host belongs to.

	* kadmin/ksrvutil_get.c: Fixed error message.


	* lib/kafs/*: Fix aix/afs brokenness.

	* lib/kadm/kadm_stream.c (stv_string): Range check.


	* appl/ftp/common/{ftp,ruserpass}.c: Less bogus domain name
 	handling.


	* lib/krb/mk_req.c: Use encrypt_ktext()

	* configure.in, lib/kafs/afssys.c: Add option to exclude AFS
 	support (this is useful only on AIX systems that doesn't have
 	AFS).

	* configure.in: Removed configuration from subdirectories.


	* appl/ftp/ftp/extern.h, appl/ftp/ftp/ftp.c: Substitute `struct
 	fd_set' with `fd_set'.


	* Makefile.in: install should depend on all.


	* appl/bsd/su.c: Allow root to set the uid without entering a
 	password.


	* lib/krb/getrealm.c: Add automatic dns realm search.


	* lib/krb/log.c (krb_log): Renamed k_log(...) to krb_log(...) for
 	compatibility with CNS. There is still a #define k_log krb_log.

	* util/et/et_list.c: Hack to resolve _et_list in shared libraries.


	* appl/bsd/rlogin.c (reader): If after a select rlogin fails to
 	read expected OOB data try to read ordinary data before	continuing.

	* appl/bsd/rlogin.c (oob_real): SunOS5 tty race kludge.

	* appl/bsd/rlogind.c: Cleanup oobdata stuff.


	* appl/bsd/login.c (main): Also check for complete tty name with
 	`rootterm'.

	* lib/krb/check_time.c: New function `krb_check_tm'.

	* lib/roken/tm2time.c: New function `tm2time', mktime generalized
	to local timezone and UTC.

	* kadmin, admin: Use `tm2time' and `krb_check_time' instead of
 	`maketime'.


	* lib/krb/mk_priv.c (krb_mk_priv): Send correct address.

	* appl/kauth/kauthd.c: Set ticket file to some sane default, and
 	add -i debugging switch.


	* appl/xnlock, appl/kauth, appl/telnet/telnetd: Use BINDIR and not
	`/usr/athena/bin'.


	* appl/bsd/rlogin.c: consistent usage of oob_real.

	* appl/bsd/rlogind.c: Do not send oob garbage when running
 	solaris?  Seems that linux is unable to handle the duplicate
 	urgent data that is the result.
	
	* appl/bsd/rlogind.c: Fix usage.

	* appl/bsd/kcmd.c: Don't F_SETOWN.


	* lib/krb/rw.c: Add get_address() and put_address().


	* appl/telnet/telnetd/telnetd.c: updated usage

	* appl/bsd/su.c: Replaced getpass by des_read_pw_string

	* appl/bsd/forkpty.c (ptym_open): Removed unused `ptr2'.

	* appl/bsd/rlogind.c: Removed unused functions and made others
 	static.


	* Release 0.9.
	

	* appl/ftp/ftpd/ftpd.c: Don't just send data in plain when doing
 	NLST.


	* configure.in: test for setresgid.

	* kadmin/ksrvutil_get.c: Fixed byte manipulations of keys.


	* lib/des/rnd_keys.c (des_rand_data): At least `srandom'.

	* appl/ftp/ftp/cmds.c: Support longer passwords when retrying
 	login.

	* kadmin/admin_server.c, man/kadmind.8, kth-krb.texi: Reading key
 	file from file is now the default.  Use `-m' to enter it manually.
  	`-n' is currently a no-op.

	* appl/ftp/ftpd/ftpd.c: Add S/Key support.

	* appl/ftp/ftpd/Makefile.in: Link with S/Key.

	* appl/ftp/configure.in: Test for S/key.
	
	* configure.in, aclocal.m4: Moved skey test
	to aclocal.m4.

	* appl/bsd/login.c: Correct argument to `skeyaccess'.


	* lib/krb/verify_user.c: New parameter to specify service key
	instance, NULL means "rcmd".

	* lots of files: All ticket filenames uses `TKT_ROOT'.

	* appl/bsd/rlogind.c: Check for uid == 0 and user != "root".


	* appl/kpopper/pop_init.c(pop_init): Got rid of some old ifdef'ed
	code.

	* lib/kdb/krb_dbm.c: Add macro for `dbm_delete' for the people
 	that are ndbm challenged.


	* lib/krb/kname_parse.c: Got rid of duplicate defintions.

	* appl/ftp/ftp/ruserpass.c: Get hostname even if user has no
 	'.netrc' file.


	* lib/kadm, lib/kdb, kadmin: Add database delete operation.

	* lib/krb/kname_parse.c: Allow dots in instances.


	* appl/bsd/rlogind.c (logwtmp): Only define `logwtmp' if it does
	not exist.  Log more garbage.


	* appl/telnet/configure.in: Check for `logwtmp'.

	* appl/ftp/configure.in: Use `AC_FUNC_MMAP'


	* appl/bsd/forkpty.c: Removed all ugly pty search stuff from
 	ptym_open().

	* configure.in: Modified the creation of version.h, now actually
 	shows up with ident.It is now also slightly more keen on creating
 	a new version.h.


	* lib/roken/verify.c: <stdio.h> for NULL.

	* appl/xnlock/xnlock.c (leave): Call XCloseDisplay, otherwise
 	screen saver changes are not updated before closing the X
 	connection.


	* appl/bsd/utmp_login.c: Remove tty-prefix from ut_id; this field
 	is usually very short.


	* slave/kpropd.c: Add option -m to merge rather then load
 	database.


	* admin/kdb_util.c: Add a merge operation.  (One day it might be
 	used to propagate only patches to the database)


	* appl/kpopper: Support both POP3 and KPOP3.

	* appl/xnlock/xnlock.c: Use `verify_unix_user'

	* lib/roken/verify.c: verify_unix_user: New function from xnlock
 	for checking passwd in `/etc/passwd'.

	* appl/telnet/telnetd/sys_term.c: gettimeofday buglet


	* slave/kpropd.c: Rewrite of kpropd.

	* admin/kdb_util.c: Sanity check on input to load_db.

	* slave/kpropd.c: Use default value for fname.

	* slave/kprop.c: Use some sane default values for data_file and
 	slaves_file.

	* admin/kdb_util.c: If there isn't any database when loading,
 	create an empty one.


	* appl/telnet/telnetd/sys_term.c: Somewhat changed the way utmpx
 	entries are created. It should now work on both Solaris and IRIX,
 	without stale login information.


	* lib/krb/k_gethostname.c (k_gethostname): Fallback.

	* lib/krb/send_to_kdc.c (send_to_kdc),
	  kadmin/kadm_ser_wrap.c (kadm_ser_init),
	  slave/kprop.c (prop_to_slaves),
	  slave/kpropd.c (main): Use `k_getportbyname'.


	* Lots of files: more #includes ifdefad and cleaned up.


	* Lots of files: Replaced bcopy/bzero/bcmp with
 	memcpy/memset/memcmp.


	* lib/krb/get_default_principal.c: Use getlogin() if it is the BSD
 	variant that actually gives some information.

	* lib/krb/create_ticket.c: Write correct address byteorder.

	* lib/kadm/kadm_stream.c,kadm_cli_wrap.c: Don't assume int32_t is
 	four bytes.

	* kadmin/kpasswd.c: Allow principal without -n.

	* kadmin/kadmin.c: Use krb_get_default_principal.

	* appl/ftp/ftpd/ftpd.c: Fix bare newline bug.

	* appl/bsd/rlogind.c: Add -i and -p options to start rlogind from
 	command line (for debugging).

	* INSTALL: Rewritten.


	* appl/ftp/ftp/krb4.c: Handle different sizes of returned
 	checksum.


	* appl/bsd/Makefile.in: Don't install login setuid.


	* appl/bsd/rsh.c: Don't run away yelling if someone calls you
 	`remsh'.


	* lib/krb/kdc_reply.c: Remove unused function decrypt_tkt. Sanity
 	check on decrypted ticket.


	* server/kerberos.c: Should work with the new libkrb

	* appl/kip: Support more than one tunnel device.


	* lib/krb/*.c: All functions that create or decode kerberos
 	packets have been rewritten.  Hopefully, everything still
 	works. This is to eliminate problems with wierd systems, like
 	Crays, that doesn't have any two or four byte integers. Some of
 	these changes could be a lot more pretty, and *many* assumptions
 	that sizeof(int32) == 4 still exist in the rest of the code,
 	though.

	As a side effect, all packets sent are now in network byte order.


	* configure.in: Shared libraries for Irix


	* Several fixes for UNICOS.

	* appl/ftp/ftp/krb4.c: Allow default data protection level through
 	a "prot level" in .netrc. This really should be done in a more
 	useful manner.


	* appl/xnlock/xnlock.c: Cleaned up user verification code. Now
 	uses new function krb_verify_user.  Also fixed a few problems with
 	the password prompt box.

	* lib/krb/verify_user.c: New function krb_verify_user to verify a
 	user with kerberos.


	* appl/kip: New program for forwarding IP packets over kerberised
	connections using tunnel devices.

	* appl/kauth/kauth.c, kadmin/ksrvutil.c: Use
 	krb_get_default_principal

	* appl/bsd/rlogind.c: Do not change portnumber to host order if
 	using kerberos.  This will cause the magic
 	`reverse-time-if-port-is-less-than' to fail.

	* lib/des/GNUmakefile: Removed file.  This file causes problem
	when building in the source directory and when using GNU make
	which prefers this file to the generated Makefile.

	* appl/bsd/login.c: More careful when handling returned value from
 	`getspnam'.


	* lib/krb/realm_parse.c: New function to expand a non-complete
 	realm to its official name, e.g nada -> NADA.KTH.SE.

	* lib/krb/get_default_principal.c: New function to guess the
 	default principal to use. Looks at any existing ticket file first,
 	then at uid/logname etc.


	* kadmin/kadmin.c: Use kname_parse and allow different instances
 	and realms.

	* lib/roken/k_getpwnam.c: New function k_getpwnam that should work
 	with and without shadow passwords.

	* Lots of files: s/getpwnam/k_&/g.


	* lib/des/des_locl.h: DES library updated to version 3.23,
 	des_locl.h now includes configure.h to get HAVE_TERMIOS etc.

	* lib/des/des.h: On the alpha define DES_LONG to unsigned int.
	

	* kuser/kinit.c: Handle passwords longer than 16 characters.

	* appl/xnlock/xnlock.c (GetPasswd): Handle longer passwords than
	16 characters.


	* Release 0.8.


	* appl/ftp/ftpd/kauth.c: Klist command.


	* appl/ftp/ftpd: Removed `-g' from calls to ls.

	* appl/ftp/ftp/cmds.c (setpeer): Fix so that opening a second
	connection to a specified port works.

	* appl/telnet/telnet: Default is binary.

	* appl: Now build under Ultrix.

	* appl/kx: Now even builds on AIX.


	* lib/des: Now merged in libdes 3.21 on main branch.


	* appl/ftp/ftpd/logwtmp.c: Slightly different functionality. Works
 	on systems that has more fields in struct utmp such as OSF/1.
  	Still some questions about Solaris.

	* lib/krb/lsb_addr_comp.c: Now byteorder independent.


	* appl/kx: Rewrote kx & kxd to share more code.  They are also now
 	able to talk both ways.

	* lib/kdb/krb_dbm.c (kerb_db_rename): Now works properly when
	using berkeley DB.


	* lib/krb/get_krbrlm.c (krb_get_default_realm): New function for
 	SunOS5 compat.

	* When building shared libraries link libkrb with libdes to be
 	compatible with SunOS5.

	* Move lib/krb/krb_err.et to lib/kadm since it is only used there,
 	no longer need to link libkrb against libcom_err.
	

	* lib/krb/lsb_addr_comp.h: Renamed ugly lsb_addr_comp.

	* Some porting to UNICOS.


	* Moved some junk from appl/bsd to libroken.
	
	* lib/roken/Makefile.in (LIBNAME): Added header file roken.h for
 	library libroken.a.


	* Add kerberized ftp.

	* Add libroken.


	* appl/kauth/kauth.c: When commands are given to kauth, a new
 	ticket file is used.


	* appl/xnlock/xnlock.c: Fixed a potential overwrite bug. Also
 	works with more than one screen, only fancy stuff on screen 0,
 	though.


	* appl/bsd/login.c, su.c, rshd.c, rlogind.c: Syslog and abort when
 	getpwnam returns uid == 0 but user is not root. This is usually
 	the result of an attack on NIS (former YP).


	* kadmin/ksrvutil.c (get_key_from_password): Support for
 	generating AFS keys.  From <flag@it.kth.se>


	* appl/kx: New program for forwarding a X connection.


	* appl/bsd/rsh.c (get_shell_port): Default port number for ekshell
 	changed from 2106 to 545.

	* appl/bsd/login.c (doremotelogin): Remove terminal speed from the
 	value of $TERM in the case of an ancient rlogind being used.


	* lib/kafs/afssys.c (k_afsklog): Try to read from
	/usr/vice/etc/TheseCells for list of cells we should try to obtain
	tokens for.

	* appl/kauth/kauth.c (renew): Use cell even when renewing.
	
	* appl/kauth/kauth.c, appl/xnlock/xnlock.c: Always call k_afsklog
 	with realm == NULL.


	* lib/kafs/afssys.c: More thorough guessing of what realm a cell
 	belongs to.


	* appl/bsd/login.c: If setuid() failes and not logging in as root,
 	exit.


	* server/kerberos.c: Set name, inst, and realm to NULL in
 	APPL_REQUEST, error replies tend to look a bit funny otherwise.


	* appl/bsd/iruserok.c (iruserok): Imported iruserok() FreeBSD.


	* lib/des/Makefile.in: Removed enc_read.c enc_writ.c.
	
	* appl/bsd/Makefile.in: New file with the old functions from
 	libdes.


	* appl/bsd/utmp_login.c: Fixed (hopefully) double utmp-entries in
 	Solaris. Only put entries in one of utmp/utmpx, since they both
 	get updated by putut*ent() anyway.


	* kuser/klist.c (main): Use verbose option (-v) to list key
 	version numbers.


	* Release 0.7.


	* appl/bsd/rlogin.c (doit): Moved signal junk (as far as possible)
        to doit().


	* configure.in: Check for getmsg with AC_TRY_RUN instead.
	Otherwise it fails under AIx 3.2.  Now rlogind works on this
	so-called OS.  Also cache value of berkeley db check.


	* lib/kdb/krb_kdb_utils.c: New experimental masterkey generation,
 	enabled with --enable-random-mkey. This makes kdb_init et al
 	generate random master keys, based on random input from the
 	user. This comes in a package with auto-kstash, and possibility to
 	enter lost master keys as base64.

	Moved default master key file from /.k to
 	/var/kerberos/master-key, override with --with-mkey=file.


	* kadmin/kadmin.c (do_init): Handle the `-t' option to kadmin,
	meaning do not get a new ticket file.  (From CNS).


	* appl/xnlock/xnlock.c: Removed some dead code, and a few unused
 	header files.


	* kadmin/pw_check.c (kadm_pw_check): If kadm_pw_check()
 	fails *pw_msg can't be 0! At the very least use the
	empty string but a descriptive error-message is preferred.

	* libtelnet: add nonbroken signal() function.


	* appl/kpopper/pop_pass.c (pop_pass): Use kuserok to determine if
	user is allowed to fetch mail.

	* appl/kpopper/*. Got rid of some ugly codes and some warnings.

	* appl/bsd/Makefile.in: signal.o was not included in OBJECTS,
	which made strange makes not doing what they should.

	* configure.in, appl/kpopper/popper.h, appl/bsd/pathnames.h: Now
 	should work on systems that do not have mail spool files in
 	/var/spool/mail.  Looks for MAILDIR or _PATH_MAILDIR, usually from
 	<paths.h> or <maillock.h>.  Defaults to /var/spool/mail.


	* appl/bsd/bsd_locl.h: TIOCPKT for those systems missing it.


	* lib/kafs/kafs.h: Use <sys/ioctl.h> instead of <sys/ioccom.h>

	* appl/bsd/rshd.c (doit): Don't set environ, send it as an
 	argument to execle instead.

	* lib/kafs/kafs.h: Find definition of _IOW.

	* configure.in: Check for random.

	* appl/bsd/bsd_locl.h: Including <crypt.h> gives too many conflicts.

	* appl/afsutil/pagsh.c: Check for random.


	* appl/bsd/bsd_locl.h, appl/telnet/telnetd/defs.h: Default values
	of `TIOCPKT_FLUSHWRITE' & c:o.

	* appl/telnet/telnet{,d}/Makefile.in (telnetd): Change order of
	linking in libraries.

	* configure.in: Check for interesting functions in libsocket and
	libnsl and not strange soriasis inventions.


	* appl/bsd/bsd_locl.h (fatal): Only use prototype or iruserok if
	the function does not exist.


	* lib/krb/krb_err_txt.c (krb_get_err_text): Changed name of
 	krb_err_msg to krb_get_err_text(int) to be compatible with the CNS
 	distribution. This function is used for instance by CVS-1.7.


	* configure.in, appl/Makefile.in: removed rkinit

	* etc/inetd.conf.changes, etc/services.append: Added kauth.

	* appl/kauth: Integrated rkinit into kauth.
	
	* appl/kauth/kauth.c (main): Only look for principal name if no -p
	has been given.

	* lots of files: prototypes and other small fixes.
	
	* appl/bsd/sysv_shadow.h: spwd multiple defined.

	* appl/bsd/bsd_locl.h: include <crypt.h>

	* configure.in: Added afsutil and rkinit.

	* */Makefile.in: Do cd $$i && $(MAKE).  Otherwise, if cd fails you
	end up with an infinite recursion.

	* kuser/klist.c (display_tktfile): Another warning removed.


	* appl/bsd/forkpty.c (forkpty): Kludge for Ultrix, rlogind now
 	works properly also under this system.


	* appl/afsutil: New aklog and pagsh


	* lib/krb/krb_equiv.c (krb_equiv): Fix bugs with '\\'.

	* lib/des/rnd_keys.c: Include <sys/time.h>.


	* appl/kauth/kauth.c (main): Handle name when given after options.


	* appl/rkinit/rkinit.c (getalladdrs): Check for herror.  Solaris
	apparently does not have any.
	(main): Use memset instead of bzero.

	* appl/rkinit/rkinitd.c (decrypt_remote_tkt): bcopy -> memcpy.

	* kuser/kinit.c (main): Corrected lifetime.

	* lib/krb/krb_equiv.c (krb_equiv): Now handles longer lines,
	continuation lines and addresses of the form 193.10.156.0/24.


	* kuser/Makefile.in (kdestroy): Link kdestroy with libkafs.


	* Replaced all occurencies of krb_err_txt[] with new function
 	krb_err_msg(), that does some sanity checks before indexing
 	krb_err_txt.


	* appl/telnet/telnetd: Added flags -z to have telnetd log
 	unauthenticated logins, such as when using an old telnet
 	client. Unfortunately in most of these cases, the user name is not
 	known.
	
	There should also be a way to tell the difference between bad
 	authentication (such as with expired tickets) and no attempt to
 	provide authentication (such as with an old client).


	* kuser/kdestroy.c: Remove afs-tokens as well as tickets, -t flags
 	added to prevent this.


	* appl/rkinit/rkinitd.c (doit): Use k_getsockinst to make it work
	correctly for multi-homed hosts.

	* appl/rkinit: New program with rkinit functionality.

	* lib/krb/k_getport.c: Function for finding port in /etc/services
	with fallback.

	* lib/krb/netread.c,netwrite.c (krb_net_{read,write}): Now correct
	prototype with void * and size_t.


	* kadmin/new_pwd.c (get_pw_new_pwd): Moved get_pw_new_pwd to
	seperate file.  Now called both from kadmin and kpasswd.

	* kadmin/pw_check.c (kadm_pw_check): Handle the case of no
	password provided.  This is really a policy decision.  The server
	should be able to say `use a client that sends the password'.

	* appl/bsd/rlogind.c (local_domain): MAXHOSTNAMELEN -> MaxHostNameLen.


	* appl/bsd/rcp.c (answer_auth): Made rcp multihome aware.

	* appl/bsd/rlogind.c (do_krb_login): Made rlogind multihome aware.

	* appl/bsd/rshd.c (doit): Made rshd multihome aware.

	* lib/krb/k_getsockinst.c (k_getsockinst): New function to figure
        out the instance name of interfaces on multihomed hosts. Use this
        function when making daemons multihome aware.

	* appl/telnet/libtelnet/kerberos.c (kerberos4_is): Made telnetd
        multihome aware.


	* Release 0.6.


	* lots of files: hacks to make it all compile.

	* configure.in, appl/telnet/configure.in: More broken AIX.


	* appl/bsd/bsd_locl.h: Fix for old syslogs (as in Ultrix).


	* appl/telnet/libtelnet/encrypt.c: encrypt_verbose by default.


	* appl/telnet/libtelnet/kerberos.c: Show difference between
 	MUTUAL and ONE_WAY KERBEROS4.

	* appl/telnet/libtelnet/encrypt.c:
	Print message about not encrypting when receiving WONT or DONT encrypt.


	* configure.in: Automatic check for HAVE_NEW_DB.


	* lib/krb/getaddrs.c (k_get_all_addrs): Fixed for systems with
        SOCKADDR_HAS_SA_LEN, aka 4.4BSD-based.

	* appl/telnet/telnetd/global.c: Removed some multiple defined
        variables.

	* appl/bsd/rlogind.c (cleanup): ifndef HAVE_VHANGUP.

	* appl/bsd/sysv_shadow.h: Add DAY and DAY_NOW ifndef.

	* configure.in: Check if `struct sockaddr' has `sa_len'.


	* appl/telnet/telnetd/telnetd.c (recv_ayt): pty -> ourpty.

	* appl/bsd/bsd_locl.h: More include-files: <sys/uio.h> and <userpw.h>

	* appl/kpopper/popper.c (catchSIGHUP): Got rid of some warnings.

	* lib/krb/log.c (new_log): Yet another year 2000.

	* appl/bsd/sysv_environ.c (read_etc_environment): Support setting
	environment variables from /etc/environment.

	* appl/bsd/bsd_locl.h: <usersec.h>

	* configure.in: check for setpcred, libs.a and <usersec.h>.

	* appl/bsd/login.c (main): setpcred is used on AIX.

	* appl/bsd/rshd.c (doit): Added setpcred for AIX.

	* lib/krb/getaddrs.c: <sys/sockio.h> is sometimes needed.

	* admin/kdb_init.c (main): Now verifies master key.

	* lib/kdb/krb_kdb_utils.c (kdb_get_master_key): Added possibility
	of asking for verfication.

	* appl/bsd/bsd_locl.h: Try to include <sys/stream.h>

	* appl/telnet/telnetd/utility.c (printsub): Mismatch arguments.

	* lib/krb/send_to_kdc.c (send_to_kdc): Send to all A records and
	accept an answer from anything we have sent to.

	* appl/kauth/kauth.c (renew): Use strange return types for strange
	OSes.
	(doexec): Remove tokens.

	* server/kerberos.c (main): Uses k_get_all_addrs and binds to each
	of these addresses.

	* kadmin/ksrvutil_get.c (ksrvutil_get): Added support for
	specifying key to create on command line to get.


	* lib/krb/log.c (k_log): Now using YYYY for years.

	* lib/krb/klog.c (klog): Preparing for the year 2000.

	* kuser/kinit.c (main): Added option -p to get changepw-tickets.

	* lib/krb/getaddrs.c: New file to get all the addresses of all the
	interfaces on this machine.


	* configure.in: Support for S/Key in login.c. Use --with-skeylib
        switch to configure. The code assumes that the skeylib.a comes
        from logdaemon.

	* General support for shadow password files if there is an
        shadow.h.

	* appl/bsd/su.c: Arrange so that it supports shadow passords.


	* appl/telnet/*: Hacks to make it work on strange OSes.

	* appl/bsd/bsd_locl.h: Check for sys/ptyvar.h

	* appl/telnet/configure.in (telnet_msg): sys/str_tty.h, sys/uio.h

	* configure.in: test for crypt.h and sys/ptyvar.h

	* appl/telnet/telnetd/*.c: pty -> ourpty.


	* telnetd: Changes to make more systems work better, specifically
 	AIX 4. Hopefully this will work on both STREAM and BSD
 	systems. Not tested on some systems, like CRAY and Linux.


	* util/ss/mk_cmds.c: Generating cleaner code.

	* lib/krb/krb_err_txt.c (krb_err_txt): Clarification.

	* kadmin/admin_server.c: Less varnings.

	* appl/xnlock/xnlock.c: Changed some types and added some casts.

	* appl/movemail/movemail.c: Not using syswait.h anymore.

	* appl/xnlock/xnlock.c: God rid of some warnings.

	* util/ss/*.[ch]: cleanup

	* util/et/*.[ch]: cleanup

	* appl/bsd/rcp.c: Less warnings.

	* kadmin/admin_server.c (kadm_listen): Get rid of another warning.

	* kadmin/pw_check.c (kadm_pw_check): Support for letting cracklib
	check the quality of the password.

	* kadmin/pw_check.h (kadm_pw_check): New argument to
	kadm_pw_check: list of useful strings to check for.

	* kadmin/kadm_server.c (kadm_ser_cpw): Send a few `useful' strings
	to kadm_pw_check (name, instance, and realm).

	* kadmin/Makefile.in (kadmind): Linking with -lcrack.

	* configure.in: Support for --with-cracklib and --with-dictpath.

	* kadmin/ksrvutil_get.c: Now seems to be working.

	* kadmin/ksrvutil.h: Some new parameters.

	* kadmin/ksrvutil.c: Some reorganisation and uses a working
	ksrvutil_get.

	* appl/movemail/movemail.c: Some more include-files.

	* appl/bsd/rlogind.c: Testing for the existence of vhangup.


	* configure.in: Massaged the configure files so that we can build
        under NEXTSTEP 3.3. Some kludges to prevent cpp bugs and link
        errors where also neccessary.


        * appl/xnlock/xnlock.c (main): Improved user feedback on password
        input.

	* appl/xnlock/xnlock.c: Applied patch made by flag@it.kth.se that
        enables C-u to erase the password field.

	* lib/krb/lifetime.c: configure now creates a version string which
        is referenced here. Use what and grep version to figure out where,
        when and by whom binaries where created.

	* appl/bsd/forkpty.c (ptys_open): Call revoke before pty slave is
        opened. Add revoke using vhangup for those system lacking revoke.
        Also call vhangup when rlogind exits.


	* lib/krb/send_to_kdc.c (send_to_kdc): Removed kludge for SunOS
        3.2 and Ultrix 2.2 that prevented multihomed kerberos servers to
        operate correctly.

	* kadmin/kadmin.c (change_key): Add new subcommand change_key so
        that it is possible to enter keys in the DB on binary form. Most
        usefull for sites running AFS.


	* appl/bsd/su.c (koktologin): New option -i root-instance. If you
        want a user.afs ticket in a root shell and user.afs is on root's
        ACL then do a "su -i afs".

	* Makefile.in: Rearrange the order of object files to make shared
        libraries slightly more efficient.

	* appl/kauth/kauth.c (main): Always up case realm. Better error
        messages on failed exec.


	* appl/bsd/rshd.c (main): New option -P to prevent rshd from using
        a new PAG. Expert use only!

	* appl/bsd/rlogind.c (doit): Avoid race when setting tty size.

	* appl/bsd/rlogin.c (reader): Use select rather than horrible
        signal hacks to handle OOB data.

	* appl/bsd/login.c (main) sysv_environ.c (sysv_newenv): Login does
        now honor the -p switch when invoked by root. This is used by
        telnetd to export environment variables.


	* appl/bsd/signal.c (signal): New BSD compatible signal
        function. Most r* applications assume reliable signals.


	* appl/bsd/login.c (main): Check HAVE_ULIMIT.

	* appl/bsd/bsd_locl.h: Include sys/ioctl.h.

	* configure.in: Check for ulimit.

	* admin/kdb_edit.c: Flush stdout after printing prompts.

	* appl/kpopper/pop_xmit.c: Remember to include config.h.


	* appl/bsd/login.c (main): New function stty_default to setup
        default tty settings.


	* appl/kstring2key/kstring2key.c (main): New program that converts
        passwords to DES keys, either using des_string_to_key or
        afs_string_to_key.

	* server/kerberos.c: Kerberos server now listen on 2 ports,
        kerberos/udp and kerberos-sec/udp.


	* appl/bsd/rcp.c (main): Integrated -x option to rcp. This
        required some real horrible hacks in lib/des/enc_{read,write}.c

	* acconfig.h: Enabled MULTIHOMED_KADMIN in acconfig.h.

	* Add RCSID stuff to telnet files.


	* appl/bsd/login.c (main): The login program does now by default
	read /etc/default/login, even on non Psoriasis systems. Unifdef
	SYSV4, this was essentially only for prompting.


	* appl/kpopper/popper.c (main): Integrate default timeout of 120
        seconds from Qualcomm popper. Timeout is also set able with -T
        seconds.


	* lib/kadm/kadm_cli_wrap.c (kadm_change_pw_plain): If there's no
	password, don't even send the empty string.


	* lots of files: all debug messages now printed to stderr (from
 	<lama@pdc.kth.se>)

	* lib/krb/tf_util.c (tf_create): New method for creating a new
 	ticket file.  Remove the old old and then open with O_CREAT and
 	O_EXCL.

	* server/kerberos.c, slave/kpropd.c: Some casts to get rid of warnings.

	* configure.in: Added checks for unistd.h, memmove and const.

	* appl/telnet/telnet/commands.c: Changed types of functions to
	confirm with struct Command.

	* appl/telnet/configure.in: Check for setpgid.

	* appl/bsd/rlogin.c: Get rid of another warning.

	* appl/bsd/bsd_locl.h, appl/telnet/acconfig.h: New synonym for
 	solaris.


	* (movemail): Now from emacs-19.30. If you have a newish emacs
 	there is no reason to use this movemail.

	* (kadm): Added support for server side password checks. Hopefully
 	this is compatible with kerberos 4.10. Old kpasswd:s will give
 	funny error messages. For examples of checks, see
 	kadmin/pw_check.c. Since this is mostly political matters,
 	kadm_pw_check() should probably return KADM_SUCCESS by default.


	* appl/telnet/telnetd/telnetd.c (main): Kludge to fix encryption
        problem with Mac NCSA telnet 2.6.


	* lib/krb/stime.c: Now using YYYY for years.  (2000 is soon here).

	* appl/bsd/rsh.c, rcp.c, rlogin.c: Fixed fallback for port number
 	(added missing ntohs).


	* (many files): More ANSI/ISO 9899-1990 to the people!  
	Now actually builds (not including util) with DEC "cc -std1" and
 	Sun "acc -Xc".  There are still major prototype conflicts, but
 	there isn't much to do about this.


	* lib/kadm/kadm_cli_wrap.c: Fallback for kerberos and
 	kerberos_master services.


	* Released version 0.5


	* lib/des/read_pwd.c: Redifine TIOCGETP and TIOCSETP so that the
        same code is used both for posix termios and others.

	* rsh, rlogin: Add environment variable RSTAR_NO_WARN which when
	set to "yes" make warnings about "rlogin: warning, using standard
	rlogin: remote host doesn't support Kerberos." go away.


	* admin/kdb_util.c (load_db) lib/kdb/krb_dbm.c (kerb_db_update):
        Optimized so that it can handle large databases, previously a
        10000 entry DB would take *many* minutes, this can now be done in
        under a minute.


	* Changes in server/kerberos.c, kadmin/*.c slave/*.c to support 64
        bit machines. Source should now be free of 64 bit assumptions.

	* admin/copykey.c (copy_from_key): New functions for copying to
        and from keys. Neccessary to solve som problems with longs on 64
        bit machines in kdb_init, kdb_edit, kdb_util and ext_srvtab.

	* lib/kdb/krb_kdb_utils.c (kdb_verify_master_key): More problems
        with longs on 64 bit machines.


	* appl/bsd/login.c (main): Lots of stuff to support Psoriasis
        login. Courtesy of gertz@lysator.liu.se.

	* configure.in, all Makefile.in's: Support for Linux shared
        libraries. Courtesy of svedja@lysator.liu.se.

	* lib/krb/cr_err_reply.c server/kerberos.c: Moved int req_act_vno
	= KRB_PROT_VERSION; from server kode to libkrb where it really
	belongs.

        * appl/bsd/forkpty.c (forkpty): New function that allocates master
        and slave ptys in a portable way. Used by rlogind.

	* appl/telnet/telnetd/sys_term.c (start_login): Under SunOS5 the
	same utmpx slot got used by sevral sessions. Courtesy of
	gertz@lysator.liu.se.


	* util/{ss, et}/Makefile.in (LEX): Use flex or lex. Courtesy of
        svedja@lysator.liu.se.

	* Fix the above Makefiles to work around bugs in Solaris and OSF/1
        make rules that was triggered by VPATH functionality in the yacc
        and lex rules.


	* appl/kpopper/pop_log.c (pop_log) appl/kpopper/pop_msg.c (pop_msg):
	Use stdarg instead of varargs. The code is still broken though,
	you'll realize	that on a machine with 64 bit pointers and 32 bit 
	int:s and no vsprintf, let's hope there will be no such beasts ;-).

	* appl/telnet/telnetd/sys_term.c (getptyslave): Not all systems
	 have (or need) modules ttcompat and pckt so don't flag it as a
	 fatal error if they don't exist.


	* kadmin/admin_server.c (kadm_listen) kadmind/kadm_ser_wrap.c
	(kadm_listen): Add kludge for kadmind running on a multihomed
	server. #ifdef:ed under MULTIHOMED_KADMIN. Change in acconfig.h
	if you need this feature.

	* appl/Makefile.in (SUBDIRS): Add applications movemail kpopper
        and xnlock.


	* appl/bsd/rlogin.c (main): New rlogind.c, forkpty() is not
        implemented yet though.


	* appl/xnlock/Makefile.in: Some stubs for X11 programs in
        configure.in as well as a kerberized version of xnlock.

	* appl/bsd/{rlogin.c, rsh.c, rcp.c}: Add code to support fallback
        port numbers if they can not be found using getservbyname.


	* appl/bsd/klogin.c (klogin): Use differnet ticket files for each
        login so that a malicous user won't be able to destroy our tickets
        with a failed login attempt.

	* lib/kafs/afssys.c (k_afsklog): First we try afs.cell@REALM, if
	there is no such thing try afs@CELL instead. There is now two
	arguments to k_afslog(char *cell, char *realm).


	* kadmin/admin_server.c (kadm_listen): If we are multihomed we
        need to figure out which local address that is used this time
        since it is used in "direction" comparison.


	* kadmin/kadm_ser_wrap.c (kadm_ser_init): Fallback to use default
        port number.

	* lib/krb/send_to_kdc.c (send_to_kdc): Default port number
        (KRB_PORT) was not in network byte order.


	* lib/krb/send_to_kdc.c (send_recv): Linux clears timeout struct
        when selecting.



	* appl/bsd/rcp.c, appl/bsd/rlogin.c, appl/bsd/rsh.c:
	Now does fallback if there isn't any entries in /etc/services for
	klogin/kshell. This also made the code a bit more pretty.


	* appl/bsd/login.c: Added support for lots of more struct utmp fields.
	If there is no ttyslot() use setutent and friends.

	* appl/bsd/Makefile.in, appl/bsd/rlogind.c, appl/bsd/rshd.c:
	Added extern iruserok().

	* appl/bsd/iruserok.c: Initial revision

	* appl/bsd/bsd_locl.h: Must include sys/filio.h on Psoriasis.

	* appl/bsd/Makefile.in: New install

	* appl/bsd/pathnames.h: Fix default path, rsh and rlogin.

	* appl/bsd/rshd.c: Extend default PATH with bindir to find rcp.


	* appl/bsd/login.c (login): If there is no ttyslot use setutent
	and friends. Added support for lots of more struct utmp fields.

	* server/kerberos.c (main) lib/kafs/afssys.c appl/bsd/bsd_locl.h:
        Must include sys/filio.h on Psoriasis to find _IOW and FIO* macros.

	* appl/bsd/rlogind.c (doit): Use _PATH_DEFPATH rather than
        _PATH_DEF.

	* appl/bsd/login.c, su.c (main): Use fallback to bourne shell if
        running as root.

	* appl/bsd/su.c (main): Update usage message to reflect that '-'
	option must come after the ordinary options and before login-id.


	* appl/telnet/telnetd/telnetd.c (doit): If remote host name is to
	long to fit into utmp try to remove domain part if it does match
	our local domain.

	(main): Add new option -L /bin/login so that it is possible to 
	specify an alternate login program.

	* appl/telnet/telnet/commands.c (env_init): When exporting
	variable DISPLAY and if hostname is not the full name, try to get
	the full name from DNS.

	* appl/telnet/telnet/main.c (main): Option -k realm was broken due
        to a bogous external declaration.


	* kadmin/kadmin.c (add_new_key): Kadmin now properly sets
	lifetime, expiration date and attributes in add_new_key command.


	* appl/bsd/su.c (main): Don't handle '-' option with getopt.

	* appl/telnet/telnet/externs.h: Removed protection for multiple
	inclusions of termio(s).h since it broke definition of termio
	macro on POSIX systems.


	* lib/krb/lifetime.c (krb_life_to_time): If you want to disable
	AFS compatible long lifetimes set krb_no_long_lifetimes = 1.
	
	Please note that the long lifetimes are 100% compatible up to
	10h so this should rarely be necessary.

	* lib/krb/krb_equiv.c (krb_equiv): If you don't want to use
	ipaddress protection of tickets set krb_ignore_ip_address. This
	makes it possible for an intruder to steal a ticket and then use
	it from som other machine anywhere on the net.


	* kadmin/kadm_ser_wrap.c (kadm_ser_init): Don't bind to only one
        local address. Accept request on all interfaces.

	* admin/kdb_edit.c (change_principal): Don't accept illegal
        dates. Courtesy of gertz@lysator.liu.se.


	* configure.in: AIX specific libraries needed when using standard
        libc routine getttyent, IBM should be ashamed!

	* lib/krb/recvauth.c (krb_recvauth): Long that should be int32_t
        problem.

	* Added strdup for su and rlogin.

	* Fix for old syslog macros in appl/bsd/bsd_locl.


	* lib/kdb/krb_dbm.c (kerb_db_rename) admin/kdb_destroy.c: New
        ifdef HAVE_NEW_DB for new databases residing in one file only.

	* appl/bsd/rlogin.c (oob): Add workaround for Linux.


	* appl/bsd/getpass.c: New routine that reads up to 127 char
        passwords. Used in su.c and login.c.


	* appl/telnet/telnetd/sys_term.c (login_tty): Ioctl TIOCSCTTY
        should not be used on HP-UX.


	* appl/bsd/rlogin.c (main): Added dummy rlogind that tells user to
        rather use telnet.


	* lib/krb/ krb.h, decomp_ticket.c, getrealm.c, get_krbhst.c,
	get_krbrlm.c, get_admhst.c: 

	Use multiple configuration directories for krb.conf and
	krb.realms, KRB_CONF and KRB_REALM_TRANS macros substituted with
	KRB_CNF_FILES and KRB_RLM_FILES. Currently /etc and
	/etc/kerberosIV are searched. Directory specified by envioronment
	variable KRBCONFDIR is searched first if set. No hardcoded
	realmname or kerberos server. Instead use domainname for deafult
	realm and kerberos.domain as kerberos server if they are not
	listed in krb.conf and/or krb.realms. In the normal case there
	should be no need for configuration files if administrators add a
	CNAME pointing to the kerberos server.

	* appl/bsd/Makefile.in and friends: GNU make should no longer be
        neccessary unless building with VPATH.


	* appl/bsd/klogin.c (klogin): Old ticket file need to be removed
	before we call krb_get_pw_in_tkt or we might get a Kerberos intkt
	error because the wrong user owns the file.


	* configure.in : Telnet.beta2 is now official and has been moved
        to appl/telnet.

	* appl/bsd/su.c (main): Reenable -K flag, won't work if not
        PASSWD_FALLBACK is enabled. Cosmetics for Password prompt.


	* appl/bsd/su.c (kerberos): Don't allow su from possibly bogous
        kerberos server. Controlled by #ifdef KLOGIN_PARANOID.

	* lib/kafs/afssys.c (SIGSYS_handler): Need to reinstall handler on
        SYSV.


	* lib/kafs/afssys.c (k_afsklog): Use default realm on null argument.

	* appl/bsd/rlogin.c, login.c: New programs.


	* appl/bsd/kcmd.c rsh.c rlogin.c: Use POSIX signals.

	* appl/telnet.95.05.31.NE/telnetd/sys_term.c, telnetd.c: Port to
        IRIX.


	* admin/kdb_init.c (main): Use new random generator.  Dito in
	admin/kdb_edit.c. Use master key to initialize random sequence.


	* kadmin/kadmin.c (get_password): Fix for random passwords.
	Dito for admin/kdb_edit.c

	* appl/kauth/kauth.c (main): Updated for krb distribution, now
        uses new library libkafs.

	* appl/telnet.beta/telnet/main.c (main): New telnet with
        encryption hacks from ftp.funet.fi:/pub/unix/security/esrasrc-1.0.
        Encryption does not currently work though.


	* New library to support AFS. Routines:

	  int k_hasafs(void);
	  int k_afsklog(...);
	  int k_setpag(void);
	  int k_unlog(void);
	  int k_pioctl(char *, int, struct ViceIoctl *, int);

	  Modified it to support more than one single entry point AFS
	  syscalls (needed by HPUX and OSF/1 when running DFS). Don't rely
	  on transarc headers or library code.

	  This has not been tested and will most probably need some
	  serious violence to get working under AIX. (AIX has since been
	  fixed to. /bg)


	* lib/krb/krb_equiv.c (krb_equiv): Compare IP adresses using
        krb_equiv() to allow for hosts with more than one address in files
        rd_priv.c rd_req.c and rd_safe.c.

	* slave/kpropd.c (main): Fix uninitialized variables and rewind
        file in kprop.c.


	* appl/bsd/rcp.c (allocbuf): Fix various bugs.

	* slave/kpropd.c (main): Responder uses
        KPROP_SERVICE_NAME.'hostname' and requestor always uses
        KPROP_SERVICE_NAME.KRB_MASTER, i.e rcmd.kerberos in kprop/kpropd
        protocol.


	* appl/bsd/rshd.c (doit): Encryption should now work both ways.


	* appl/bsd/pathnames.h: Fixup paths.

	* server/Makefile.in and friends (install): Install daemons in in
	libexec and administrator programs in sbin.


	* Makefile.in: Joda (d91-jda) added install target


	* lib/krb/k_strerror.c: New function k_strerror() to use instead
        of the non portable sys_errlist[].
