commit: 5985af22c9feaa90943cd4cdc96bfe4da7ac2de5 Author: Sam James <sam <AT> gentoo <DOT> org> AuthorDate: Fri Mar 24 07:22:07 2023 +0000 Commit: Sam James <sam <AT> gentoo <DOT> org> CommitDate: Thu May 11 20:03:45 2023 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5985af22
net-misc/openssh: revoke github.com's compromised RSA host key See https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/. It's necessary for the old github.com key to be explicitly removed (or revoked) rather than just selecting a new key, i.e. it's possible for users to be silently affected but not see the error because github.com may not serve them an RSA key. Revoke the old github.com key as part of the ebuild to help users out. Signed-off-by: Sam James <sam <AT> gentoo.org> Closes: https://github.com/gentoo/gentoo/pull/30327 Signed-off-by: Sam James <sam <AT> gentoo.org> net-misc/openssh/openssh-9.3_p1-r1.ebuild | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/net-misc/openssh/openssh-9.3_p1-r1.ebuild b/net-misc/openssh/openssh-9.3_p1-r1.ebuild index 83c262f034f8..95ec07b27720 100644 --- a/net-misc/openssh/openssh-9.3_p1-r1.ebuild +++ b/net-misc/openssh/openssh-9.3_p1-r1.ebuild @@ -257,6 +257,15 @@ tweak_ssh_configs() { SendEnv COLORTERM EOF + cat <<-EOF >> "${ED}"/etc/ssh/ssh_config.d/91gentoo-security.conf || die + RevokedHostKeys "${EPREFIX}/etc/ssh/ssh_revoked_hosts" + EOF + + cat <<-EOF >> "${ED}"/etc/ssh/ssh_revoked_hosts || die + # https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/ + ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ== + EOF + cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/90gentoo.conf || die # Allow client to pass locale environment variables (bug #367017) AcceptEnv ${locale_vars[*]}
