commit: c0d5daf5c2e4b927127c6e92a78e870fa6ef5d61
Author: David Seifert <soap <AT> gentoo <DOT> org>
AuthorDate: Wed Jan 3 09:22:16 2024 +0000
Commit: David Seifert <soap <AT> gentoo <DOT> org>
CommitDate: Wed Jan 3 09:22:16 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c0d5daf5
net-misc/openssh: drop 9.4_p1-r1, 9.5_p1-r2
Signed-off-by: David Seifert <soap <AT> gentoo.org>
net-misc/openssh/Manifest | 4 -
.../openssh/files/openssh-9.3_p1-GSSAPI-dns.patch | 345 -------------------
.../openssh/files/openssh-9.3_p2-zlib-1.3.patch | 21 --
net-misc/openssh/openssh-9.4_p1-r1.ebuild | 380 ---------------------
net-misc/openssh/openssh-9.5_p1-r2.ebuild | 378 --------------------
5 files changed, 1128 deletions(-)
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index a3404a654075..bbc5cf33ad57 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -1,6 +1,2 @@
-DIST openssh-9.4p1.tar.gz 1845094 BLAKE2B
d13d758129cce947d3f12edb6e88406aad10de6887b19ffa3ebd8e382b742a05f2a692a8824aec99939f6c7e13fbccc3bb14e5ee112f9a9255d4882eb87dcf53
SHA512
0aaedeced7dbc70419c7245eb0e9db4ef570e0e7739b890ebae04d56da5fe8d147e8e150f3c943f60730976569e3ac6cc8da62ec7e2a78e2ef47d295ca0b1d25
-DIST openssh-9.4p1.tar.gz.asc 833 BLAKE2B
95eedd9356766e5d0ea1261da3dc4c7869f054b418c626fb35815a0aa655b1ddbf54436b437d98c4344b05c9196c8fa1f592eac07b3ccf08bd3e980f8b6955af
SHA512
983b4ebaa3b98e70831ce686cb503270926c065163a2510eef0c5102ef50b6e665b889ee15ea8c0bd7c4bbddb19270f036e1d554a8212ef2c292f9c682c8631a
-DIST openssh-9.5p1.tar.gz 1843001 BLAKE2B
55dbb0a2792b0046c943a19ca0966660e6e378e77856e94823a1bbbafaa0da94357403765c4c028aebf6543049a0f9bbe0019629be3f92cdadfac1be56def796
SHA512
e183fdf7477fd986215b889eea4a945d71385e35305746ccb164e757ecc28166f429c70890a237d8ef4cdcae5132935ba2ecb3b2a658eb73a6afcf6f42277b9c
-DIST openssh-9.5p1.tar.gz.asc 833 BLAKE2B
abec3d14d9a880008db202be00ed446ccc0a98ce77c16a9e6d6492feac07c8f3284f9cd24f6ee1d904a55f9f23d5cce8a716916975c179a38ef6bde1d36e0acf
SHA512
2b6de653420ba02eb99c7e6fba09af3bacfe9c701f3dfc3c94f41a3539c0414954fc5c64cce63c488c5ccd5d4ddb42d3f2184ff7f323342c885c47bf7d426ca1
DIST openssh-9.6p1.tar.gz 1857862 BLAKE2B
dd7f6747fe89f7b386be4faaf7fc43398a9bf439e45608ae61c2126cf8743c64ef7b5af45c75e9007b0bda525f8809261ca0f2fc47ce60177ba769a5324719dd
SHA512
0ebf81e39914c3a90d7777a001ec7376a94b37e6024baf3e972c58f0982b7ddef942315f5e01d56c00ff95603b4a20ee561ab918ecc55511df007ac138160509
DIST openssh-9.6p1.tar.gz.asc 833 BLAKE2B
9363d02f85457aa90069020827306a2f49d8406e32f5ee1d231844648dd2ffa02fa9b7325b8677a11e46a0ba0d9ffc86d9c989435d691a02f5354a956c49f9f9
SHA512
aec5a5bd6ce480a8e5b5879dc55f8186aec90fe61f085aa92ad7d07f324574aa781be09c83b7443a32848d091fd44fb12c1842d49cee77afc351e550ffcc096d
diff --git a/net-misc/openssh/files/openssh-9.3_p1-GSSAPI-dns.patch
b/net-misc/openssh/files/openssh-9.3_p1-GSSAPI-dns.patch
deleted file mode 100644
index cbc0ec2d9c2d..000000000000
--- a/net-misc/openssh/files/openssh-9.3_p1-GSSAPI-dns.patch
+++ /dev/null
@@ -1,345 +0,0 @@
---- a/auth.c
-+++ b/auth.c
-@@ -637,118 +637,6 @@
- return (&fake);
- }
-
--/*
-- * Returns the remote DNS hostname as a string. The returned string must not
-- * be freed. NB. this will usually trigger a DNS query the first time it is
-- * called.
-- * This function does additional checks on the hostname to mitigate some
-- * attacks on based on conflation of hostnames and IP addresses.
-- */
--
--static char *
--remote_hostname(struct ssh *ssh)
--{
-- struct sockaddr_storage from;
-- socklen_t fromlen;
-- struct addrinfo hints, *ai, *aitop;
-- char name[NI_MAXHOST], ntop2[NI_MAXHOST];
-- const char *ntop = ssh_remote_ipaddr(ssh);
--
-- /* Get IP address of client. */
-- fromlen = sizeof(from);
-- memset(&from, 0, sizeof(from));
-- if (getpeername(ssh_packet_get_connection_in(ssh),
-- (struct sockaddr *)&from, &fromlen) == -1) {
-- debug("getpeername failed: %.100s", strerror(errno));
-- return xstrdup(ntop);
-- }
--
-- ipv64_normalise_mapped(&from, &fromlen);
-- if (from.ss_family == AF_INET6)
-- fromlen = sizeof(struct sockaddr_in6);
--
-- debug3("Trying to reverse map address %.100s.", ntop);
-- /* Map the IP address to a host name. */
-- if (getnameinfo((struct sockaddr *)&from, fromlen, name, sizeof(name),
-- NULL, 0, NI_NAMEREQD) != 0) {
-- /* Host name not found. Use ip address. */
-- return xstrdup(ntop);
-- }
--
-- /*
-- * if reverse lookup result looks like a numeric hostname,
-- * someone is trying to trick us by PTR record like following:
-- * 1.1.1.10.in-addr.arpa. IN PTR 2.3.4.5
-- */
-- memset(&hints, 0, sizeof(hints));
-- hints.ai_socktype = SOCK_DGRAM; /*dummy*/
-- hints.ai_flags = AI_NUMERICHOST;
-- if (getaddrinfo(name, NULL, &hints, &ai) == 0) {
-- logit("Nasty PTR record \"%s\" is set up for %s, ignoring",
-- name, ntop);
-- freeaddrinfo(ai);
-- return xstrdup(ntop);
-- }
--
-- /* Names are stored in lowercase. */
-- lowercase(name);
--
-- /*
-- * Map it back to an IP address and check that the given
-- * address actually is an address of this host. This is
-- * necessary because anyone with access to a name server can
-- * define arbitrary names for an IP address. Mapping from
-- * name to IP address can be trusted better (but can still be
-- * fooled if the intruder has access to the name server of
-- * the domain).
-- */
-- memset(&hints, 0, sizeof(hints));
-- hints.ai_family = from.ss_family;
-- hints.ai_socktype = SOCK_STREAM;
-- if (getaddrinfo(name, NULL, &hints, &aitop) != 0) {
-- logit("reverse mapping checking getaddrinfo for %.700s "
-- "[%s] failed.", name, ntop);
-- return xstrdup(ntop);
-- }
-- /* Look for the address from the list of addresses. */
-- for (ai = aitop; ai; ai = ai->ai_next) {
-- if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop2,
-- sizeof(ntop2), NULL, 0, NI_NUMERICHOST) == 0 &&
-- (strcmp(ntop, ntop2) == 0))
-- break;
-- }
-- freeaddrinfo(aitop);
-- /* If we reached the end of the list, the address was not there. */
-- if (ai == NULL) {
-- /* Address not found for the host name. */
-- logit("Address %.100s maps to %.600s, but this does not "
-- "map back to the address.", ntop, name);
-- return xstrdup(ntop);
-- }
-- return xstrdup(name);
--}
--
--/*
-- * Return the canonical name of the host in the other side of the current
-- * connection. The host name is cached, so it is efficient to call this
-- * several times.
-- */
--
--const char *
--auth_get_canonical_hostname(struct ssh *ssh, int use_dns)
--{
-- static char *dnsname;
--
-- if (!use_dns)
-- return ssh_remote_ipaddr(ssh);
-- else if (dnsname != NULL)
-- return dnsname;
-- else {
-- dnsname = remote_hostname(ssh);
-- return dnsname;
-- }
--}
--
- /* These functions link key/cert options to the auth framework */
-
- /* Log sshauthopt options locally and (optionally) for remote transmission */
---- a/canohost.c
-+++ b/canohost.c
-@@ -205,3 +205,117 @@
- {
- return get_sock_port(sock, 1);
- }
-+
-+/*
-+ * Returns the remote DNS hostname as a string. The returned string must not
-+ * be freed. NB. this will usually trigger a DNS query the first time it is
-+ * called.
-+ * This function does additional checks on the hostname to mitigate some
-+ * attacks on legacy rhosts-style authentication.
-+ * XXX is RhostsRSAAuthentication vulnerable to these?
-+ * XXX Can we remove these checks? (or if not, remove
RhostsRSAAuthentication?)
-+ */
-+
-+static char *
-+remote_hostname(struct ssh *ssh)
-+{
-+ struct sockaddr_storage from;
-+ socklen_t fromlen;
-+ struct addrinfo hints, *ai, *aitop;
-+ char name[NI_MAXHOST], ntop2[NI_MAXHOST];
-+ const char *ntop = ssh_remote_ipaddr(ssh);
-+
-+ /* Get IP address of client. */
-+ fromlen = sizeof(from);
-+ memset(&from, 0, sizeof(from));
-+ if (getpeername(ssh_packet_get_connection_in(ssh),
-+ (struct sockaddr *)&from, &fromlen) == -1) {
-+ debug("getpeername failed: %.100s", strerror(errno));
-+ return xstrdup(ntop);
-+ }
-+
-+ ipv64_normalise_mapped(&from, &fromlen);
-+ if (from.ss_family == AF_INET6)
-+ fromlen = sizeof(struct sockaddr_in6);
-+
-+ debug3("Trying to reverse map address %.100s.", ntop);
-+ /* Map the IP address to a host name. */
-+ if (getnameinfo((struct sockaddr *)&from, fromlen, name, sizeof(name),
-+ NULL, 0, NI_NAMEREQD) != 0) {
-+ /* Host name not found. Use ip address. */
-+ return xstrdup(ntop);
-+ }
-+
-+ /*
-+ * if reverse lookup result looks like a numeric hostname,
-+ * someone is trying to trick us by PTR record like following:
-+ * 1.1.1.10.in-addr.arpa. IN PTR 2.3.4.5
-+ */
-+ memset(&hints, 0, sizeof(hints));
-+ hints.ai_socktype = SOCK_DGRAM; /*dummy*/
-+ hints.ai_flags = AI_NUMERICHOST;
-+ if (getaddrinfo(name, NULL, &hints, &ai) == 0) {
-+ logit("Nasty PTR record \"%s\" is set up for %s, ignoring",
-+ name, ntop);
-+ freeaddrinfo(ai);
-+ return xstrdup(ntop);
-+ }
-+
-+ /* Names are stored in lowercase. */
-+ lowercase(name);
-+
-+ /*
-+ * Map it back to an IP address and check that the given
-+ * address actually is an address of this host. This is
-+ * necessary because anyone with access to a name server can
-+ * define arbitrary names for an IP address. Mapping from
-+ * name to IP address can be trusted better (but can still be
-+ * fooled if the intruder has access to the name server of
-+ * the domain).
-+ */
-+ memset(&hints, 0, sizeof(hints));
-+ hints.ai_family = from.ss_family;
-+ hints.ai_socktype = SOCK_STREAM;
-+ if (getaddrinfo(name, NULL, &hints, &aitop) != 0) {
-+ logit("reverse mapping checking getaddrinfo for %.700s "
-+ "[%s] failed.", name, ntop);
-+ return xstrdup(ntop);
-+ }
-+ /* Look for the address from the list of addresses. */
-+ for (ai = aitop; ai; ai = ai->ai_next) {
-+ if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop2,
-+ sizeof(ntop2), NULL, 0, NI_NUMERICHOST) == 0 &&
-+ (strcmp(ntop, ntop2) == 0))
-+ break;
-+ }
-+ freeaddrinfo(aitop);
-+ /* If we reached the end of the list, the address was not there. */
-+ if (ai == NULL) {
-+ /* Address not found for the host name. */
-+ logit("Address %.100s maps to %.600s, but this does not "
-+ "map back to the address.", ntop, name);
-+ return xstrdup(ntop);
-+ }
-+ return xstrdup(name);
-+}
-+
-+/*
-+ * Return the canonical name of the host in the other side of the current
-+ * connection. The host name is cached, so it is efficient to call this
-+ * several times.
-+ */
-+
-+const char *
-+auth_get_canonical_hostname(struct ssh *ssh, int use_dns)
-+{
-+ static char *dnsname;
-+
-+ if (!use_dns)
-+ return ssh_remote_ipaddr(ssh);
-+ else if (dnsname != NULL)
-+ return dnsname;
-+ else {
-+ dnsname = remote_hostname(ssh);
-+ return dnsname;
-+ }
-+}
---- a/readconf.c
-+++ b/readconf.c
-@@ -160,6 +160,7 @@
- oClearAllForwardings, oNoHostAuthenticationForLocalhost,
- oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout,
- oAddressFamily, oGssAuthentication, oGssDelegateCreds,
-+ oGssTrustDns,
- oServerAliveInterval, oServerAliveCountMax, oIdentitiesOnly,
- oSendEnv, oSetEnv, oControlPath, oControlMaster, oControlPersist,
- oHashKnownHosts,
-@@ -207,9 +208,11 @@
- #if defined(GSSAPI)
- { "gssapiauthentication", oGssAuthentication },
- { "gssapidelegatecredentials", oGssDelegateCreds },
-+ { "gssapitrustdns", oGssTrustDns },
- # else
- { "gssapiauthentication", oUnsupported },
- { "gssapidelegatecredentials", oUnsupported },
-+ { "gssapitrustdns", oUnsupported },
- #endif
- #ifdef ENABLE_PKCS11
- { "pkcs11provider", oPKCS11Provider },
-@@ -1125,6 +1128,10 @@
- intptr = &options->gss_deleg_creds;
- goto parse_flag;
-
-+ case oGssTrustDns:
-+ intptr = &options->gss_trust_dns;
-+ goto parse_flag;
-+
- case oBatchMode:
- intptr = &options->batch_mode;
- goto parse_flag;
-@@ -2341,6 +2348,7 @@
- options->pubkey_authentication = -1;
- options->gss_authentication = -1;
- options->gss_deleg_creds = -1;
-+ options->gss_trust_dns = -1;
- options->password_authentication = -1;
- options->kbd_interactive_authentication = -1;
- options->kbd_interactive_devices = NULL;
-@@ -2501,6 +2509,8 @@
- options->gss_authentication = 0;
- if (options->gss_deleg_creds == -1)
- options->gss_deleg_creds = 0;
-+ if (options->gss_trust_dns == -1)
-+ options->gss_trust_dns = 0;
- if (options->password_authentication == -1)
- options->password_authentication = 1;
- if (options->kbd_interactive_authentication == -1)
---- a/readconf.h
-+++ b/readconf.h
-@@ -41,6 +41,7 @@
- int hostbased_authentication; /* ssh2's rhosts_rsa */
- int gss_authentication; /* Try GSS authentication */
- int gss_deleg_creds; /* Delegate GSS credentials */
-+ int gss_trust_dns; /* Trust DNS for GSS canonicalization */
- int password_authentication; /* Try password
- * authentication. */
- int kbd_interactive_authentication; /* Try keyboard-interactive
auth. */
---- a/ssh_config.5
-+++ b/ssh_config.5
-@@ -843,6 +843,16 @@
- Forward (delegate) credentials to the server.
- The default is
- .Cm no .
-+Note that this option applies to protocol version 2 connections using GSSAPI.
-+.It Cm GSSAPITrustDns
-+Set to
-+.Dq yes to indicate that the DNS is trusted to securely canonicalize
-+the name of the host being connected to. If
-+.Dq no, the hostname entered on the
-+command line will be passed untouched to the GSSAPI library.
-+The default is
-+.Dq no .
-+This option only applies to protocol version 2 connections using GSSAPI.
- .It Cm HashKnownHosts
- Indicates that
- .Xr ssh 1
---- a/sshconnect2.c
-+++ b/sshconnect2.c
-@@ -764,6 +764,13 @@
- OM_uint32 min;
- int r, ok = 0;
- gss_OID mech = NULL;
-+ const char *gss_host;
-+
-+ if (options.gss_trust_dns) {
-+ extern const char *auth_get_canonical_hostname(struct ssh *ssh,
int use_dns);
-+ gss_host = auth_get_canonical_hostname(ssh, 1);
-+ } else
-+ gss_host = authctxt->host;
-
- /* Try one GSSAPI method at a time, rather than sending them all at
- * once. */
-@@ -778,7 +785,7 @@
- elements[authctxt->mech_tried];
- /* My DER encoding requires length<128 */
- if (mech->length < 128 && ssh_gssapi_check_mechanism(&gssctxt,
-- mech, authctxt->host)) {
-+ mech, gss_host)) {
- ok = 1; /* Mechanism works */
- } else {
- authctxt->mech_tried++;
diff --git a/net-misc/openssh/files/openssh-9.3_p2-zlib-1.3.patch
b/net-misc/openssh/files/openssh-9.3_p2-zlib-1.3.patch
deleted file mode 100644
index f1336bbe0380..000000000000
--- a/net-misc/openssh/files/openssh-9.3_p2-zlib-1.3.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-https://bugs.gentoo.org/912766
-https://github.com/openssh/openssh-portable/commit/cb4ed12ffc332d1f72d054ed92655b5f1c38f621
-
-From cb4ed12ffc332d1f72d054ed92655b5f1c38f621 Mon Sep 17 00:00:00 2001
-From: Darren Tucker <[email protected]>
-Date: Sat, 19 Aug 2023 07:39:08 +1000
-Subject: [PATCH] Fix zlib version check for 1.3 and future version.
-
-bz#3604.
---- a/configure.ac
-+++ b/configure.ac
-@@ -1464,7 +1464,7 @@ else
- [[
- int a=0, b=0, c=0, d=0, n, v;
- n = sscanf(ZLIB_VERSION, "%d.%d.%d.%d", &a, &b, &c, &d);
-- if (n != 3 && n != 4)
-+ if (n < 1)
- exit(1);
- v = a*1000000 + b*10000 + c*100 + d;
- fprintf(stderr, "found zlib version %s (%d)\n", ZLIB_VERSION, v);
-
diff --git a/net-misc/openssh/openssh-9.4_p1-r1.ebuild
b/net-misc/openssh/openssh-9.4_p1-r1.ebuild
deleted file mode 100644
index dbfa1b7bbe14..000000000000
--- a/net-misc/openssh/openssh-9.4_p1-r1.ebuild
+++ /dev/null
@@ -1,380 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit user-info flag-o-matic autotools pam systemd toolchain-funcs verify-sig
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="https://www.openssh.com/";
-SRC_URI="
- mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- verify-sig? ( mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz.asc )"
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openssh.org.asc
-S="${WORKDIR}/${PARCH}"
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64
~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos
~x64-macos ~x64-solaris"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie
security-key selinux +ssl static test X xmss"
-
-RESTRICT="!test? ( test )"
-
-REQUIRED_USE="
- ldns? ( ssl )
- pie? ( !static )
- static? ( !kerberos !pam )
- xmss? ( ssl )
- test? ( ssl )
-"
-
-# tests currently fail with XMSS
-REQUIRED_USE+="test? ( !xmss )"
-
-LIB_DEPEND="
- audit? ( sys-process/audit[static-libs(+)] )
- ldns? (
- net-libs/ldns[static-libs(+)]
- net-libs/ldns[ecdsa(+),ssl(+)]
- )
- libedit? ( dev-libs/libedit:=[static-libs(+)] )
- security-key? ( >=dev-libs/libfido2-1.5.0:=[static-libs(+)] )
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
- ssl? ( >=dev-libs/openssl-1.1.1l-r1:0=[static-libs(+)] )
- virtual/libcrypt:=[static-libs(+)]
- >=sys-libs/zlib-1.2.3:=[static-libs(+)]
-"
-RDEPEND="
- acct-group/sshd
- acct-user/sshd
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( sys-libs/pam )
- kerberos? ( virtual/krb5 )
-"
-DEPEND="${RDEPEND}
- virtual/os-headers
- kernel_linux? ( !prefix-guest? ( >=sys-kernel/linux-headers-5.1 ) )
- static? ( ${LIB_DEPEND} )
-"
-RDEPEND="${RDEPEND}
- !net-misc/openssh-contrib
- pam? ( >=sys-auth/pambase-20081028 )
- !prefix? ( sys-apps/shadow )
- X? ( x11-apps/xauth )
-"
-# Weird dep construct for newer gcc-config for bug #872416
-BDEPEND="
- sys-devel/autoconf
- virtual/pkgconfig
- || (
- >=sys-devel/gcc-config-2.6
- >=sys-devel/clang-toolchain-symlinks-14-r1:14
- >=sys-devel/clang-toolchain-symlinks-15-r1:15
- >=sys-devel/clang-toolchain-symlinks-16-r1:*
- )
- verify-sig? ( sec-keys/openpgp-keys-openssh )
-"
-
-PATCHES=(
- "${FILESDIR}/${PN}-9.3_p1-GSSAPI-dns.patch" #165444 integrated into
gsskex
- "${FILESDIR}/${PN}-9.3_p1-disable-conch-interop-tests.patch"
- "${FILESDIR}/${PN}-9.3_p1-fix-putty-tests.patch"
-
"${FILESDIR}/${PN}-9.3_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch"
- "${FILESDIR}/${PN}-9.3_p2-zlib-1.3.patch" #912766
-)
-
-pkg_pretend() {
- local i enabled_eol_flags disabled_eol_flags
- for i in hpn sctp X509; do
- if has_version "net-misc/openssh[${i}]"; then
- enabled_eol_flags+="${i},"
- disabled_eol_flags+="-${i},"
- fi
- done
-
- if [[ -n ${enabled_eol_flags} &&
${OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING} != yes ]]; then
- # Skip for binary packages entirely because of environment
saving, bug #907892
- [[ ${MERGE_TYPE} == binary ]] && return
-
- ewarn "net-misc/openssh does not support
USE='${enabled_eol_flags%,}' anymore."
- ewarn "The Base system team *STRONGLY* recommends you not rely
on this functionality,"
- ewarn "since these USE flags required third-party patches that
often trigger bugs"
- ewarn "and are of questionable provenance."
- ewarn
- ewarn "If you must continue relying on this functionality,
switch to"
- ewarn "net-misc/openssh-contrib. You will have to remove
net-misc/openssh from your"
- ewarn "world file first: 'emerge --deselect net-misc/openssh'"
- ewarn
- ewarn "In order to prevent loss of SSH remote login access, we
will abort the build."
- ewarn "Whether you proceed with disabling the USE flags or
switch to the -contrib"
- ewarn "variant, when re-emerging you will have to set"
- ewarn
- ewarn " OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING=yes"
-
- die "Building net-misc/openssh[${disabled_eol_flags%,}] without
OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING=yes"
- fi
-
- # Make sure people who are using tcp wrappers are notified of its
removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and
it seems like"
- ewarn "you're trying to use it. Update your
${EROOT}/etc/hosts.{allow,deny} please."
- fi
-}
-
-src_prepare() {
- sed -i \
- -e
"/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
- pathnames.h || die
-
- # don't break .ssh/authorized_keys2 for fun
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
- eapply -- "${PATCHES[@]}"
-
- [[ -d ${WORKDIR}/patches ]] && eapply "${WORKDIR}"/patches
-
- eapply_user #473004
-
- # These tests are currently incompatible with PORTAGE_TMPDIR/sandbox
- sed -e '/\t\tpercent \\/ d' \
- -i regress/Makefile || die
-
- tc-export PKG_CONFIG
- local sed_args=(
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
- # Disable fortify flags ... our gcc does this for us
- -e 's:-D_FORTIFY_SOURCE=2::'
- )
-
- # _XOPEN_SOURCE causes header conflicts on Solaris
- [[ ${CHOST} == *-solaris* ]] && sed_args+=(
- -e 's/-D_XOPEN_SOURCE//'
- )
- sed -i "${sed_args[@]}" configure{.ac,} || die
-
- eautoreconf
-}
-
-src_configure() {
- addwrite /dev/ptmx
-
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
- use static && append-ldflags -static
- use xmss && append-cflags -DWITH_XMSS
-
- if [[ ${CHOST} == *-solaris* ]] ; then
- # Solaris' glob.h doesn't have things like GLOB_TILDE, configure
- # doesn't check for this, so force the replacement to be put in
- # place
- append-cppflags -DBROKEN_GLOB
- fi
-
- # use replacement, RPF_ECHO_ON doesn't exist here
- [[ ${CHOST} == *-darwin* ]] && export ac_cv_func_readpassphrase=no
-
- local myconf=(
- --with-ldflags="${LDFLAGS}"
- --disable-strip
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX}"/etc/ssh
- --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX}"/usr/share/openssh
- --with-privsep-path="${EPREFIX}"/var/empty
- --with-privsep-user=sshd
- --with-hardening
- $(use_with audit audit linux)
- $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
- $(use_with ldns)
- $(use_with libedit)
- $(use_with pam)
- $(use_with pie)
- $(use_with selinux)
- $(use_with security-key security-key-builtin)
- $(use_with ssl openssl)
- $(use_with ssl ssl-engine)
- )
-
- if use elibc_musl; then
- # musl defines bogus values for UTMP_FILE and WTMP_FILE
- # https://bugs.gentoo.org/753230
- myconf+=( --disable-utmp --disable-wtmp )
- fi
-
- # Workaround for Clang 15 miscompilation with -fzero-call-used-regs=all
- # bug #869839 (https://github.com/llvm/llvm-project/issues/57692)
- tc-is-clang && myconf+=( --without-hardening )
-
- econf "${myconf[@]}"
-}
-
-src_test() {
- local tests=( compat-tests )
- local shell=$(egetshell "${UID}")
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- ewarn "Running the full OpenSSH testsuite requires a usable
shell for the 'portage'"
- ewarn "user, so we will run a subset only."
- tests+=( interop-tests )
- else
- tests+=( tests )
- fi
-
- local -x SUDO= SSH_SK_PROVIDER= TEST_SSH_UNSAFE_PERMISSIONS=1
- mkdir -p "${HOME}"/.ssh || die
- emake -j1 "${tests[@]}" </dev/null
-}
-
-# Gentoo tweaks to default config files.
-tweak_ssh_configs() {
- local locale_vars=(
- # These are language variables that POSIX defines.
- #
http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
- LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY
LC_NUMERIC LC_TIME
-
- # These are the GNU extensions.
- #
https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
- LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME
LC_PAPER LC_TELEPHONE
- )
-
- dodir /etc/ssh/ssh_config.d /etc/ssh/sshd_config.d
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config || die
- Include "${EPREFIX}/etc/ssh/ssh_config.d/*.conf"
- EOF
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config || die
- Include "${EPREFIX}/etc/ssh/sshd_config.d/*.conf"
- EOF
-
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config.d/9999999gentoo.conf || die
- # Send locale environment variables (bug #367017)
- SendEnv ${locale_vars[*]}
-
- # Send COLORTERM to match TERM (bug #658540)
- SendEnv COLORTERM
- EOF
-
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config.d/9999999gentoo-security.conf
|| die
- RevokedHostKeys "${EPREFIX}/etc/ssh/ssh_revoked_hosts"
- EOF
-
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_revoked_hosts || die
- # https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/
- ssh-rsa
AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==
- EOF
-
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/9999999gentoo.conf || die
- # Allow client to pass locale environment variables (bug #367017)
- AcceptEnv ${locale_vars[*]}
-
- # Allow client to pass COLORTERM to match TERM (bug #658540)
- AcceptEnv COLORTERM
- EOF
-
- if use pam ; then
- cat <<-EOF >>
"${ED}"/etc/ssh/sshd_config.d/9999999gentoo-pam.conf || die
- UsePAM yes
- # This interferes with PAM.
- PasswordAuthentication no
- # PAM can do its own handling of MOTD.
- PrintMotd no
- PrintLastLog no
- EOF
- fi
-
- if use livecd ; then
- cat <<-EOF >>
"${ED}"/etc/ssh/sshd_config.d/9999999gentoo-livecd.conf || die
- # Allow root login with password on livecds.
- PermitRootLogin Yes
- EOF
- fi
-}
-
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd-r1.initd sshd
- newconfd "${FILESDIR}"/sshd-r1.confd sshd
-
- if use pam; then
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
- fi
-
- tweak_ssh_configs
-
- doman contrib/ssh-copy-id.1
- dodoc ChangeLog CREDITS OVERVIEW README* TODO sshd_config
-
- diropts -m 0700
- dodir /etc/skel/.ssh
- rmdir "${ED}"/var/empty || die
-
- systemd_dounit "${FILESDIR}"/sshd.socket
- systemd_newunit "${FILESDIR}"/sshd.service.1 sshd.service
- systemd_newunit "${FILESDIR}"/sshd_at.service.1 '[email protected]'
-}
-
-pkg_preinst() {
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]"; then
- show_ssl_warning=1
- fi
-}
-
-pkg_postinst() {
- local old_ver
- for old_ver in ${REPLACING_VERSIONS}; do
- if ver_test "${old_ver}" -lt "5.8_p1"; then
- elog "Starting with openssh-5.8p1, the server will
default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to
manually update your stored"
- elog "keys list as servers update theirs. See
ssh-keyscan(1) for more info."
- fi
- if ver_test "${old_ver}" -lt "7.0_p1"; then
- elog "Starting with openssh-6.7, support for USE=tcpd
has been dropped by upstream."
- elog "Make sure to update any configs that you might
have. Note that xinetd might"
- elog "be an alternative for you as it supports
USE=tcpd."
- fi
- if ver_test "${old_ver}" -lt "7.1_p1"; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss
keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you
can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config
files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or
ed25519."
-
- elog "Starting with openssh-7.0, the default for
PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth
for root users no longer works"
- elog "out of the box. If you need this, please update
your sshd_config explicitly."
- fi
- if ver_test "${old_ver}" -lt "7.6_p1"; then
- elog "Starting with openssh-7.6p1, openssh upstream has
removed ssh1 support entirely."
- elog "Furthermore, rsa keys with less than 1024 bits
will be refused."
- fi
- if ver_test "${old_ver}" -lt "7.7_p1"; then
- elog "Starting with openssh-7.7p1, we no longer patch
openssh to provide LDAP functionality."
- elog "Install sys-auth/ssh-ldap-pubkey and use
OpenSSH's \"AuthorizedKeysCommand\" option"
- elog "if you need to authenticate against LDAP."
- elog "See
https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
- fi
- if ver_test "${old_ver}" -lt "8.2_p1"; then
- ewarn "After upgrading to openssh-8.2p1 please restart
sshd, otherwise you"
- ewarn "will not be able to establish new sessions.
Restarting sshd over a ssh"
- ewarn "connection is generally safe."
- fi
- if ver_test "${old_ver}" -lt "9.2_p1-r1" && systemd_is_booted;
then
- ewarn "From openssh-9.2_p1-r1 the supplied systemd unit
file defaults to"
- ewarn "'Restart=on-failure', which causes the service
to automatically restart if it"
- ewarn "terminates with an unclean exit code or signal.
This feature is useful for most users,"
- ewarn "but it can increase the vulnerability of the
system in the event of a future exploit."
- ewarn "If you have a web-facing setup or are concerned
about security, it is recommended to"
- ewarn "set 'Restart=no' in your sshd unit file."
- fi
- done
-
- if [[ -n ${show_ssl_warning} ]]; then
- elog "Be aware that by disabling openssl support in openssh,
the server and clients"
- elog "no longer support dss/rsa/ecdsa keys. You will need to
generate ed25519 keys"
- elog "and update all clients/servers that utilize them."
- fi
-}
diff --git a/net-misc/openssh/openssh-9.5_p1-r2.ebuild
b/net-misc/openssh/openssh-9.5_p1-r2.ebuild
deleted file mode 100644
index 5043c36ea762..000000000000
--- a/net-misc/openssh/openssh-9.5_p1-r2.ebuild
+++ /dev/null
@@ -1,378 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit user-info flag-o-matic autotools pam systemd toolchain-funcs verify-sig
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="https://www.openssh.com/";
-SRC_URI="
- mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- verify-sig? ( mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz.asc )"
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openssh.org.asc
-S="${WORKDIR}/${PARCH}"
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64
~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos
~x64-macos ~x64-solaris"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie
security-key selinux +ssl static test X xmss"
-
-RESTRICT="!test? ( test )"
-
-REQUIRED_USE="
- ldns? ( ssl )
- pie? ( !static )
- static? ( !kerberos !pam )
- xmss? ( ssl )
- test? ( ssl )
-"
-
-# tests currently fail with XMSS
-REQUIRED_USE+="test? ( !xmss )"
-
-LIB_DEPEND="
- audit? ( sys-process/audit[static-libs(+)] )
- ldns? (
- net-libs/ldns[static-libs(+)]
- net-libs/ldns[ecdsa(+),ssl(+)]
- )
- libedit? ( dev-libs/libedit:=[static-libs(+)] )
- security-key? ( >=dev-libs/libfido2-1.5.0:=[static-libs(+)] )
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
- ssl? ( >=dev-libs/openssl-1.1.1l-r1:0=[static-libs(+)] )
- virtual/libcrypt:=[static-libs(+)]
- >=sys-libs/zlib-1.2.3:=[static-libs(+)]
-"
-RDEPEND="
- acct-group/sshd
- acct-user/sshd
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( sys-libs/pam )
- kerberos? ( virtual/krb5 )
-"
-DEPEND="${RDEPEND}
- virtual/os-headers
- kernel_linux? ( !prefix-guest? ( >=sys-kernel/linux-headers-5.1 ) )
- static? ( ${LIB_DEPEND} )
-"
-RDEPEND="${RDEPEND}
- !net-misc/openssh-contrib
- pam? ( >=sys-auth/pambase-20081028 )
- !prefix? ( sys-apps/shadow )
- X? ( x11-apps/xauth )
-"
-# Weird dep construct for newer gcc-config for bug #872416
-BDEPEND="
- sys-devel/autoconf
- virtual/pkgconfig
- || (
- >=sys-devel/gcc-config-2.6
- >=sys-devel/clang-toolchain-symlinks-14-r1:14
- >=sys-devel/clang-toolchain-symlinks-15-r1:15
- >=sys-devel/clang-toolchain-symlinks-16-r1:*
- )
- verify-sig? ( sec-keys/openpgp-keys-openssh )
-"
-
-PATCHES=(
- "${FILESDIR}/${PN}-9.3_p1-disable-conch-interop-tests.patch"
- "${FILESDIR}/${PN}-9.3_p1-fix-putty-tests.patch"
-
"${FILESDIR}/${PN}-9.3_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch"
-)
-
-pkg_pretend() {
- local i enabled_eol_flags disabled_eol_flags
- for i in hpn sctp X509; do
- if has_version "net-misc/openssh[${i}]"; then
- enabled_eol_flags+="${i},"
- disabled_eol_flags+="-${i},"
- fi
- done
-
- if [[ -n ${enabled_eol_flags} &&
${OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING} != yes ]]; then
- # Skip for binary packages entirely because of environment
saving, bug #907892
- [[ ${MERGE_TYPE} == binary ]] && return
-
- ewarn "net-misc/openssh does not support
USE='${enabled_eol_flags%,}' anymore."
- ewarn "The Base system team *STRONGLY* recommends you not rely
on this functionality,"
- ewarn "since these USE flags required third-party patches that
often trigger bugs"
- ewarn "and are of questionable provenance."
- ewarn
- ewarn "If you must continue relying on this functionality,
switch to"
- ewarn "net-misc/openssh-contrib. You will have to remove
net-misc/openssh from your"
- ewarn "world file first: 'emerge --deselect net-misc/openssh'"
- ewarn
- ewarn "In order to prevent loss of SSH remote login access, we
will abort the build."
- ewarn "Whether you proceed with disabling the USE flags or
switch to the -contrib"
- ewarn "variant, when re-emerging you will have to set"
- ewarn
- ewarn " OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING=yes"
-
- die "Building net-misc/openssh[${disabled_eol_flags%,}] without
OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING=yes"
- fi
-
- # Make sure people who are using tcp wrappers are notified of its
removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and
it seems like"
- ewarn "you're trying to use it. Update your
${EROOT}/etc/hosts.{allow,deny} please."
- fi
-}
-
-src_prepare() {
- sed -i \
- -e
"/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
- pathnames.h || die
-
- # don't break .ssh/authorized_keys2 for fun
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
- eapply -- "${PATCHES[@]}"
-
- [[ -d ${WORKDIR}/patches ]] && eapply "${WORKDIR}"/patches
-
- eapply_user #473004
-
- # These tests are currently incompatible with PORTAGE_TMPDIR/sandbox
- sed -e '/\t\tpercent \\/ d' \
- -i regress/Makefile || die
-
- tc-export PKG_CONFIG
- local sed_args=(
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
- # Disable fortify flags ... our gcc does this for us
- -e 's:-D_FORTIFY_SOURCE=2::'
- )
-
- # _XOPEN_SOURCE causes header conflicts on Solaris
- [[ ${CHOST} == *-solaris* ]] && sed_args+=(
- -e 's/-D_XOPEN_SOURCE//'
- )
- sed -i "${sed_args[@]}" configure{.ac,} || die
-
- eautoreconf
-}
-
-src_configure() {
- addwrite /dev/ptmx
-
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
- use static && append-ldflags -static
- use xmss && append-cflags -DWITH_XMSS
-
- if [[ ${CHOST} == *-solaris* ]] ; then
- # Solaris' glob.h doesn't have things like GLOB_TILDE, configure
- # doesn't check for this, so force the replacement to be put in
- # place
- append-cppflags -DBROKEN_GLOB
- fi
-
- # use replacement, RPF_ECHO_ON doesn't exist here
- [[ ${CHOST} == *-darwin* ]] && export ac_cv_func_readpassphrase=no
-
- local myconf=(
- --with-ldflags="${LDFLAGS}"
- --disable-strip
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX}"/etc/ssh
- --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX}"/usr/share/openssh
- --with-privsep-path="${EPREFIX}"/var/empty
- --with-privsep-user=sshd
- --with-hardening
- $(use_with audit audit linux)
- $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
- $(use_with ldns)
- $(use_with libedit)
- $(use_with pam)
- $(use_with pie)
- $(use_with selinux)
- $(use_with security-key security-key-builtin)
- $(use_with ssl openssl)
- $(use_with ssl ssl-engine)
- )
-
- if use elibc_musl; then
- # musl defines bogus values for UTMP_FILE and WTMP_FILE
- # https://bugs.gentoo.org/753230
- myconf+=( --disable-utmp --disable-wtmp )
- fi
-
- # Workaround for Clang 15 miscompilation with -fzero-call-used-regs=all
- # bug #869839 (https://github.com/llvm/llvm-project/issues/57692)
- tc-is-clang && myconf+=( --without-hardening )
-
- econf "${myconf[@]}"
-}
-
-src_test() {
- local tests=( compat-tests )
- local shell=$(egetshell "${UID}")
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- ewarn "Running the full OpenSSH testsuite requires a usable
shell for the 'portage'"
- ewarn "user, so we will run a subset only."
- tests+=( interop-tests )
- else
- tests+=( tests )
- fi
-
- local -x SUDO= SSH_SK_PROVIDER= TEST_SSH_UNSAFE_PERMISSIONS=1
- mkdir -p "${HOME}"/.ssh || die
- emake -j1 "${tests[@]}" </dev/null
-}
-
-# Gentoo tweaks to default config files.
-tweak_ssh_configs() {
- local locale_vars=(
- # These are language variables that POSIX defines.
- #
http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
- LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY
LC_NUMERIC LC_TIME
-
- # These are the GNU extensions.
- #
https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
- LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME
LC_PAPER LC_TELEPHONE
- )
-
- dodir /etc/ssh/ssh_config.d /etc/ssh/sshd_config.d
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config || die
- Include "${EPREFIX}/etc/ssh/ssh_config.d/*.conf"
- EOF
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config || die
- Include "${EPREFIX}/etc/ssh/sshd_config.d/*.conf"
- EOF
-
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config.d/9999999gentoo.conf || die
- # Send locale environment variables (bug #367017)
- SendEnv ${locale_vars[*]}
-
- # Send COLORTERM to match TERM (bug #658540)
- SendEnv COLORTERM
- EOF
-
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config.d/9999999gentoo-security.conf
|| die
- RevokedHostKeys "${EPREFIX}/etc/ssh/ssh_revoked_hosts"
- EOF
-
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_revoked_hosts || die
- # https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/
- ssh-rsa
AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==
- EOF
-
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/9999999gentoo.conf || die
- # Allow client to pass locale environment variables (bug #367017)
- AcceptEnv ${locale_vars[*]}
-
- # Allow client to pass COLORTERM to match TERM (bug #658540)
- AcceptEnv COLORTERM
- EOF
-
- if use pam ; then
- cat <<-EOF >>
"${ED}"/etc/ssh/sshd_config.d/9999999gentoo-pam.conf || die
- UsePAM yes
- # This interferes with PAM.
- PasswordAuthentication no
- # PAM can do its own handling of MOTD.
- PrintMotd no
- PrintLastLog no
- EOF
- fi
-
- if use livecd ; then
- cat <<-EOF >>
"${ED}"/etc/ssh/sshd_config.d/9999999gentoo-livecd.conf || die
- # Allow root login with password on livecds.
- PermitRootLogin Yes
- EOF
- fi
-}
-
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd-r1.initd sshd
- newconfd "${FILESDIR}"/sshd-r1.confd sshd
-
- if use pam; then
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
- fi
-
- tweak_ssh_configs
-
- doman contrib/ssh-copy-id.1
- dodoc ChangeLog CREDITS OVERVIEW README* TODO sshd_config
-
- diropts -m 0700
- dodir /etc/skel/.ssh
- rmdir "${ED}"/var/empty || die
-
- systemd_dounit "${FILESDIR}"/sshd.socket
- systemd_newunit "${FILESDIR}"/sshd.service.1 sshd.service
- systemd_newunit "${FILESDIR}"/sshd_at.service.1 '[email protected]'
-}
-
-pkg_preinst() {
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]"; then
- show_ssl_warning=1
- fi
-}
-
-pkg_postinst() {
- local old_ver
- for old_ver in ${REPLACING_VERSIONS}; do
- if ver_test "${old_ver}" -lt "5.8_p1"; then
- elog "Starting with openssh-5.8p1, the server will
default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to
manually update your stored"
- elog "keys list as servers update theirs. See
ssh-keyscan(1) for more info."
- fi
- if ver_test "${old_ver}" -lt "7.0_p1"; then
- elog "Starting with openssh-6.7, support for USE=tcpd
has been dropped by upstream."
- elog "Make sure to update any configs that you might
have. Note that xinetd might"
- elog "be an alternative for you as it supports
USE=tcpd."
- fi
- if ver_test "${old_ver}" -lt "7.1_p1"; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss
keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you
can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config
files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or
ed25519."
-
- elog "Starting with openssh-7.0, the default for
PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth
for root users no longer works"
- elog "out of the box. If you need this, please update
your sshd_config explicitly."
- fi
- if ver_test "${old_ver}" -lt "7.6_p1"; then
- elog "Starting with openssh-7.6p1, openssh upstream has
removed ssh1 support entirely."
- elog "Furthermore, rsa keys with less than 1024 bits
will be refused."
- fi
- if ver_test "${old_ver}" -lt "7.7_p1"; then
- elog "Starting with openssh-7.7p1, we no longer patch
openssh to provide LDAP functionality."
- elog "Install sys-auth/ssh-ldap-pubkey and use
OpenSSH's \"AuthorizedKeysCommand\" option"
- elog "if you need to authenticate against LDAP."
- elog "See
https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
- fi
- if ver_test "${old_ver}" -lt "8.2_p1"; then
- ewarn "After upgrading to openssh-8.2p1 please restart
sshd, otherwise you"
- ewarn "will not be able to establish new sessions.
Restarting sshd over a ssh"
- ewarn "connection is generally safe."
- fi
- if ver_test "${old_ver}" -lt "9.2_p1-r1" && systemd_is_booted;
then
- ewarn "From openssh-9.2_p1-r1 the supplied systemd unit
file defaults to"
- ewarn "'Restart=on-failure', which causes the service
to automatically restart if it"
- ewarn "terminates with an unclean exit code or signal.
This feature is useful for most users,"
- ewarn "but it can increase the vulnerability of the
system in the event of a future exploit."
- ewarn "If you have a web-facing setup or are concerned
about security, it is recommended to"
- ewarn "set 'Restart=no' in your sshd unit file."
- fi
- done
-
- if [[ -n ${show_ssl_warning} ]]; then
- elog "Be aware that by disabling openssl support in openssh,
the server and clients"
- elog "no longer support dss/rsa/ecdsa keys. You will need to
generate ed25519 keys"
- elog "and update all clients/servers that utilize them."
- fi
-}
