security/openssh-portable: Disable X11Forwarding by default.

This syncs with src and upstream.

Submitted by:	jlduran
Differential Revision:	https://reviews.freebsd.org/D53268

5 files changed, 8 insertions, 28 deletions

diff --git a/UPDATING b/UPDATING
index 10a1febfb914..fd9e6bbe40ee 100644
--- a/UPDATING
+++ b/UPDATING
@@ -5,6 +5,13 @@ they are unavoidable.
 You should get into the habit of checking this file for changes each time
 you update your ports collection, before attempting any port upgrades.
 
+20260425:
+  AFFECTS: Users of security/openssh-portable
+  AUTHOR: bdrewery@FreeBSD.org
+
+  X11Forwarding default has changed from "yes" to "no" to match src
+  and upstream.
+
 20260418:
   AFFECTS: Users of net/rsync and net/rsync@python
   AUTHOR: rodrigo@FreeBSD.org
diff --git a/security/openssh-portable/Makefile b/security/openssh-portable/Makefile
index 85c317597ae4..979f9cdd3da9 100644
--- a/security/openssh-portable/Makefile
+++ b/security/openssh-portable/Makefile
@@ -1,6 +1,6 @@
 PORTNAME=	openssh
 DISTVERSION=	10.2p1
-PORTREVISION=	3
+PORTREVISION=	4
 PORTEPOCH=	1
 CATEGORIES=	security
 MASTER_SITES=	OPENBSD/OpenSSH/portable
diff --git a/security/openssh-portable/files/patch-servconf.c b/security/openssh-portable/files/patch-servconf.c
index 33ead18621bb..2dddc7e5c286 100644
--- a/security/openssh-portable/files/patch-servconf.c
+++ b/security/openssh-portable/files/patch-servconf.c
@@ -29,15 +29,6 @@ Apply FreeBSD's configuration defaults.
  	if (options->pam_service_name == NULL)
  		options->pam_service_name = xstrdup(SSHD_PAM_SERVICE);
  
-@@ -339,7 +344,7 @@ fill_default_server_options(ServerOptions *options)
- 	if (options->print_lastlog == -1)
- 		options->print_lastlog = 1;
- 	if (options->x11_forwarding == -1)
--		options->x11_forwarding = 0;
-+		options->x11_forwarding = 1;
- 	if (options->x11_display_offset == -1)
- 		options->x11_display_offset = 10;
- 	if (options->x11_use_localhost == -1)
 @@ -381,7 +386,11 @@ fill_default_server_options(ServerOptions *options)
  	if (options->gss_strict_acceptor == -1)
  		options->gss_strict_acceptor = 1;
diff --git a/security/openssh-portable/files/patch-sshd_config b/security/openssh-portable/files/patch-sshd_config
index 7b6bc14977c7..6d14dd3a1335 100644
--- a/security/openssh-portable/files/patch-sshd_config
+++ b/security/openssh-portable/files/patch-sshd_config
@@ -22,12 +22,3 @@
  
  #AuthorizedPrincipalsFile none
  
-@@ -84,7 +88,7 @@ AuthorizedKeysFile	.ssh/authorized_keys
- #AllowAgentForwarding yes
- #AllowTcpForwarding yes
- #GatewayPorts no
--#X11Forwarding no
-+#X11Forwarding yes
- #X11DisplayOffset 10
- #X11UseLocalhost yes
- #PermitTTY yes
diff --git a/security/openssh-portable/files/patch-sshd_config.5 b/security/openssh-portable/files/patch-sshd_config.5
index f5297c2a42c2..e671f178e399 100644
--- a/security/openssh-portable/files/patch-sshd_config.5
+++ b/security/openssh-portable/files/patch-sshd_config.5
@@ -48,12 +48,3 @@
  .It Cm X11DisplayOffset
  Specifies the first display number available for
  .Xr sshd 8 Ns 's
-@@ -1793,7 +1827,7 @@
- or
- .Cm no .
- The default is
--.Cm no .
-+.Cm yes .
- .Pp
- When X11 forwarding is enabled, there may be additional exposure to
- the server and to client displays if the