sudo (1.9.16p2-2) unstable; urgency=medium

  === sudo-ldap is going away ===

  sudo-ldap has become a burden to maintain. This is mainly due to the fact
  that the sudo team has neither the manpower nor the know-how to maintain
  sudo-ldap adequately.

  In practice, there are few installations that use sudo-ldap. Most
  installations that use LDAP as a directory service and sudo have now opted
  for sssd, sssd-ldap and libsss-sudo.

  The Debian sudo team recommends the use of libsss-sudo for new
  installations and the migration of existing installations from sudo-ldap
   to libsss-sudo and sssd.

  The combination of sudo and sssd is automatically tested in autopkgtest
  of sudo.

  sudo-ldap removal is also being discussed in #1033728 in the Debian BTS.

  Debian 13, "trixie", will be the last version of Debian that supports
  sudo-ldap. Please use the bookworm and trixie release cycles to migrate
  your installation away from sudo-ldap.

  Please make sure that you do not upgrade from Debian 13 to Debian 14
  while you're still using sudo-ldap. This is not going to work and
  will probably leave you without intended privilege escalation.

  === sudo_logsrvd is going away if no one is willing to help ===

  Similar reasoning applies to input/output logging and sudo_logsrvd,
  a feature that is also seldomly used in the Debian context. The sudo
  maintainer team plans to remove this to avoid additional dependencies
  in the basic sudo package.

  Should you be willing to maintain sudo_logsrvd as part of the sudo team,
  please get in touch with us. Please note that this is a long-term
  commitment.

  The removal of the input/output plugins and sudo_logsrvd are discussed
  in #1101451 in the Debian BTS.

  Upgrading from Debian 13 to Debian 14 will most likely leave you without
  sudo logging.

 -- Marc Haber <mh+debian-packages@zugschlus.de>  Sun, 04 May 2025 17:48:00 +0200

sudo (1.9.5p2-3) unstable; urgency=medium

  We have added "Defaults use_pty" to the default configuration. This fixes
  CVE-2005-4890 which has been lingering around for more then a decade.
  If you would like the old behavior back, please remove the respective line
  from /etc/sudoers.

 -- Marc Haber <mh+debian-packages@zugschlus.de>  Wed, 24 Feb 2021 17:59:22 +0100
