[email protected] (Jérémie Courrèges-Anglas) writes:
> Hi,
>
> some time ago sshd(8) got its list of kex/macs/ciphers shrunk. This
> breaks py-paramiko both on the kex and macs POV.
>
> From transport.py:
> _preferred_ciphers = ( 'aes128-ctr', 'aes256-ctr', 'aes128-cbc',
> 'blowfish-cbc', 'aes256-cbc', '3des-cbc',
> 'arcfour128', 'arcfour256' )
> _preferred_macs = ( 'hmac-sha1', 'hmac-md5', 'hmac-sha1-96',
> 'hmac-md5-96' )
> _preferred_keys = ( 'ssh-rsa', 'ssh-dss', 'ecdsa-sha2-nistp256' )
> _preferred_kex = ( 'diffie-hellman-group1-sha1',
> 'diffie-hellman-group-exchange-sha1' )
> _preferred_compression = ( 'none', )
>
> You can match this against sshd_config(8).
>
> Some upstream tickets:
> https://github.com/paramiko/paramiko/issues/242
> https://github.com/paramiko/paramiko/issues/161
>
> If you have a github account, please ping them. :)
>
> Meanwhile, consumers should be fixed, this includes duplicity for which
> I have a patch (for another mail).
- change the default from paramiko to pexpect
- document it
- remove dep on paramiko
ok?
Index: Makefile
===================================================================
RCS file: /cvs/ports/sysutils/duplicity/Makefile,v
retrieving revision 1.28
diff -u -p -r1.28 Makefile
--- Makefile 7 Apr 2014 06:24:08 -0000 1.28
+++ Makefile 14 Apr 2014 14:40:33 -0000
@@ -4,7 +4,7 @@ COMMENT = encrypted backup using rsync a
MODPY_EGG_VERSION = 0.6.23
DISTNAME = duplicity-${MODPY_EGG_VERSION}
-REVISION = 0
+REVISION = 1
CATEGORIES = sysutils
@@ -26,7 +26,6 @@ LIB_DEPENDS += net/librsync \
RUN_DEPENDS += net/py-boto \
net/ncftp \
security/py-gnupg \
- security/py-paramiko \
sysutils/py-lockfile
MAKE_ENV += LIBRSYNC_DIR=${LOCALBASE}
Index: patches/patch-bin_duplicity_1
===================================================================
RCS file: patches/patch-bin_duplicity_1
diff -N patches/patch-bin_duplicity_1
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ patches/patch-bin_duplicity_1 14 Apr 2014 13:17:14 -0000
@@ -0,0 +1,52 @@
+$OpenBSD$
+Document the ssh backend change from paramiko to pexpect.
+--- bin/duplicity.1.orig Mon Apr 14 11:44:24 2014
++++ bin/duplicity.1 Mon Apr 14 15:16:56 2014
+@@ -104,7 +104,7 @@ There are two
+ for scp/sftp/ssh access (also see
+ .BR "A NOTE ON SSH BACKENDS" ).
+ .TP
+-.BR "ssh paramiko backend" " (enabled by default)"
++.B "ssh paramiko backend"
+ .B paramiko
+ (SSH2 for python)
+ - http://pypi.python.org/pypi/paramiko (downloads);
http://github.com/paramiko/paramiko (project page)
+@@ -113,7 +113,7 @@ for scp/sftp/ssh access (also see
+ (Python Cryptography Toolkit)
+ - http://www.dlitz.net/software/pycrypto/
+ .TP
+-.B ssh pexpect backend
++.BR "ssh pexpect backend" " (default on OpenBSD)"
+ .B sftp/scp client binaries
+ OpenSSH - http://www.openssh.com/
+ .TP
+@@ -823,9 +823,9 @@ This password is also used for passphrase-protected ss
+ .TP
+ .BI "--ssh-backend " backend
+ Allows the explicit selection of a ssh backend. Defaults to
+-.BR paramiko .
++.BR "pexpect on OpenBSD" .
+ Alternatively you might choose
+-.BR pexpect .
++.BR paramiko .
+ .br
+ See also
+ .BR "A NOTE ON SSH BACKENDS" .
+@@ -1511,7 +1511,7 @@ backend allows to define
+ .BR --scp-command " and"
+ .BR --sftp-command .
+ .PP
+-.BR "SSH paramiko backend " "(selected by default)"
++.B "SSH paramiko backend"
+ is a complete reimplementation of ssh protocols natively in python. Advantages
+ are speed and maintainability. Minor disadvantage is that extra packages are
+ needed as listed in
+@@ -1524,7 +1524,7 @@ mode (
+ .I --use-scp
+ ) though scp access is used for put/get operations but listing is done via
ssh remote shell.
+ .PP
+-.B SSH pexpect backend
++.BR "SSH pexpect backend" " (selected by default on OpenBSD)"
+ is the legacy ssh backend using the command line ssh binaries via pexpect.
+ Older versions used
+ .I scp
Index: patches/patch-duplicity_globals_py
===================================================================
RCS file: patches/patch-duplicity_globals_py
diff -N patches/patch-duplicity_globals_py
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ patches/patch-duplicity_globals_py 14 Apr 2014 10:22:38 -0000
@@ -0,0 +1,15 @@
+$OpenBSD$
+Switch the default ssh backend from paramiko to pexpect.
+--- duplicity/globals.py.orig Mon Apr 14 00:01:15 2014
++++ duplicity/globals.py Mon Apr 14 00:02:16 2014
+@@ -213,8 +213,8 @@ sftp_command = None
+ # default to batch mode using public-key encryption
+ ssh_askpass = False
+
+-# default ssh backend is paramiko
+-ssh_backend = "paramiko"
++# default ssh backend is pexpect
++ssh_backend = "pexpect"
+
+ # user added ssh options
+ ssh_options = ""
--
jca | PGP : 0x1524E7EE / 5135 92C1 AD36 5293 2BDF DDCC 0DFA 74AE 1524 E7EE
