security/openssh-portable: Fix PermitRootLogin default to "no"

This matches what is reported in pkg-message.

PR:		267170
Reported by:	SimpleRezo

4 files changed, 33 insertions, 13 deletions

diff --git a/UPDATING b/UPDATING
index fd9e6bbe40ee..49585198f210 100644
--- a/UPDATING
+++ b/UPDATING
@@ -9,8 +9,10 @@ you update your ports collection, before attempting any port upgrades.
   AFFECTS: Users of security/openssh-portable
   AUTHOR: bdrewery@FreeBSD.org
 
-  X11Forwarding default has changed from "yes" to "no" to match src
-  and upstream.
+  Some defaults have changed to match src.
+
+  - X11Forwarding default has changed from "yes" to "no".
+  - PermitRootLogin default has changed from "prohibit-password" to "no".
 
 20260418:
   AFFECTS: Users of net/rsync and net/rsync@python
diff --git a/security/openssh-portable/Makefile b/security/openssh-portable/Makefile
index 5855a233fbc2..cb44c111823a 100644
--- a/security/openssh-portable/Makefile
+++ b/security/openssh-portable/Makefile
@@ -1,6 +1,6 @@
 PORTNAME=	openssh
 DISTVERSION=	10.2p1
-PORTREVISION=	5
+PORTREVISION=	6
 PORTEPOCH=	1
 CATEGORIES=	security
 MASTER_SITES=	OPENBSD/OpenSSH/portable
diff --git a/security/openssh-portable/files/patch-servconf.c b/security/openssh-portable/files/patch-servconf.c
index 2dddc7e5c286..8061e4c76386 100644
--- a/security/openssh-portable/files/patch-servconf.c
+++ b/security/openssh-portable/files/patch-servconf.c
@@ -6,9 +6,9 @@ Changed paths:
 
 Apply FreeBSD's configuration defaults.
 
---- servconf.c.orig	2024-07-01 13:30:30.284417000 -0700
-+++ servconf.c	2024-07-01 13:31:20.040132000 -0700
-@@ -46,6 +46,7 @@
+--- servconf.c.orig	2026-04-25 16:05:26.936844000 -0700
++++ servconf.c	2026-04-25 16:18:06.486288000 -0700
+@@ -44,6 +44,7 @@
  # include "openbsd-compat/glob.h"
  #endif
  
@@ -16,7 +16,7 @@ Apply FreeBSD's configuration defaults.
  #include "openbsd-compat/sys-queue.h"
  #include "xmalloc.h"
  #include "ssh.h"
-@@ -295,7 +296,11 @@ fill_default_server_options(ServerOptions *options)
+@@ -298,7 +299,11 @@ fill_default_server_options(ServerOptions *options)
  
  	/* Portable-specific options */
  	if (options->use_pam == -1)
@@ -29,7 +29,16 @@ Apply FreeBSD's configuration defaults.
  	if (options->pam_service_name == NULL)
  		options->pam_service_name = xstrdup(SSHD_PAM_SERVICE);
  
-@@ -381,7 +386,11 @@ fill_default_server_options(ServerOptions *options)
+@@ -328,7 +333,7 @@ fill_default_server_options(ServerOptions *options)
+ 	if (options->login_grace_time == -1)
+ 		options->login_grace_time = 120;
+ 	if (options->permit_root_login == PERMIT_NOT_SET)
+-		options->permit_root_login = PERMIT_NO_PASSWD;
++		options->permit_root_login = PERMIT_NO;
+ 	if (options->ignore_rhosts == -1)
+ 		options->ignore_rhosts = 1;
+ 	if (options->ignore_user_known_hosts == -1)
+@@ -380,7 +385,11 @@ fill_default_server_options(ServerOptions *options)
  	if (options->gss_strict_acceptor == -1)
  		options->gss_strict_acceptor = 1;
  	if (options->password_authentication == -1)
diff --git a/security/openssh-portable/files/patch-sshd_config.5 b/security/openssh-portable/files/patch-sshd_config.5
index e671f178e399..05a62be8dd54 100644
--- a/security/openssh-portable/files/patch-sshd_config.5
+++ b/security/openssh-portable/files/patch-sshd_config.5
@@ -1,6 +1,6 @@
---- sshd_config.5.orig	2022-02-11 18:50:00.822679000 +0000
-+++ sshd_config.5	2022-02-11 19:09:05.162504000 +0000
-@@ -701,7 +701,9 @@
+--- sshd_config.5.orig	2026-04-25 16:05:26.905238000 -0700
++++ sshd_config.5	2026-04-25 16:16:59.050604000 -0700
+@@ -789,7 +789,9 @@ This was formerly named HostbasedAcceptedKeyTypes.
  .Qq ssh -Q HostbasedAcceptedAlgorithms .
  This was formerly named HostbasedAcceptedKeyTypes.
  .It Cm HostbasedAuthentication
@@ -11,7 +11,16 @@
  with successful public key client host authentication is allowed
  (host-based authentication).
  The default is
-@@ -1416,6 +1434,15 @@
+@@ -1489,7 +1491,7 @@ The default is
+ or
+ .Cm no .
+ The default is
+-.Cm prohibit-password .
++.Cm no .
+ .Pp
+ If this option is set to
+ .Cm prohibit-password
+@@ -1535,6 +1537,15 @@ The default is
  .Cm ethernet .
  The default is
  .Cm no .
@@ -27,7 +36,7 @@
  .Pp
  Independent of this setting, the permissions of the selected
  .Xr tun 4
-@@ -1774,12 +1801,19 @@
+@@ -2062,12 +2073,19 @@ The default is
  .Xr sshd 8
  as a non-root user.
  The default is