From 2b513ae1e3131cdf385eb147c1046b283529dd9d Mon Sep 17 00:00:00 2001 From: Daniel Ahlberg Date: Wed, 21 Apr 2004 11:46:05 +0000 Subject: Closing #48465. --- net-misc/openssh/ChangeLog | 7 +- net-misc/openssh/Manifest | 2 + net-misc/openssh/files/digest-openssh-3.8.1_p1 | 2 + .../openssh/files/openssh-3.8.1_p1-chroot.patch | 74 ++++++++++++ .../openssh/files/openssh-3.8.1_p1-kerberos.patch | 19 +++ .../files/openssh-3.8.1_p1-resolv_functions.patch | 12 ++ net-misc/openssh/files/openssh-3.8.1_p1-skey.patch | 11 ++ net-misc/openssh/openssh-3.8.1_p1.ebuild | 130 +++++++++++++++++++++ 8 files changed, 256 insertions(+), 1 deletion(-) create mode 100644 net-misc/openssh/files/digest-openssh-3.8.1_p1 create mode 100644 net-misc/openssh/files/openssh-3.8.1_p1-chroot.patch create mode 100644 net-misc/openssh/files/openssh-3.8.1_p1-kerberos.patch create mode 100644 net-misc/openssh/files/openssh-3.8.1_p1-resolv_functions.patch create mode 100644 net-misc/openssh/files/openssh-3.8.1_p1-skey.patch create mode 100644 net-misc/openssh/openssh-3.8.1_p1.ebuild (limited to 'net-misc') diff --git a/net-misc/openssh/ChangeLog b/net-misc/openssh/ChangeLog index 099fa3c875be..2abb75864c72 100644 --- a/net-misc/openssh/ChangeLog +++ b/net-misc/openssh/ChangeLog @@ -1,6 +1,11 @@ # ChangeLog for net-misc/openssh # Copyright 2002-2004 Gentoo Technologies, Inc.; Distributed under the GPL v2 -# $Header: /var/cvsroot/gentoo-x86/net-misc/openssh/ChangeLog,v 1.77 2004/04/13 12:39:42 aliz Exp $ +# $Header: /var/cvsroot/gentoo-x86/net-misc/openssh/ChangeLog,v 1.78 2004/04/21 11:46:05 aliz Exp $ + +*openssh-3.8.1_p1 (21 Apr 2004) + + 21 Apr 2004; Daniel Ahlberg openssh-3.8.1_p1.ebuild: + Version bump. Found by Daniel Webert in #48465. 13 Apr 2004; Daniel Ahlberg openssh-3.7.1_p2-r2.ebuild, openssh-3.8_p1.ebuild: diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest index 21e2e3fd5ca2..f292d22d7281 100644 --- a/net-misc/openssh/Manifest +++ b/net-misc/openssh/Manifest @@ -1,4 +1,5 @@ MD5 390005dbb08f77ebbacd2371466609db openssh-3.7.1_p2-r1.ebuild 4108 +MD5 14a1d898442c82de87c6740bb396a4d0 openssh-3.8.1_p1.ebuild 4218 MD5 2ad4dcf698a176e6ff1f94c9e5816882 openssh-3.7.1_p2-r2.ebuild 4618 MD5 1acfc14089fb63782fb38965af6ee2c0 ChangeLog 12043 MD5 0feff9b09e482567359625301bddce1c metadata.xml 1329 @@ -9,6 +10,7 @@ MD5 2cb187d8f60994c5e1b5fef2bcb6e85d files/openssh-3.5_p1-gentoo-sshd-gcc3.patch MD5 e62c6cfae268e95fb406080c91713c1a files/digest-openssh-3.8_p1 138 MD5 9e179b1c0e3a139a5a9067c6e5bd6595 files/openssh-3.7.1_p1-selinux.diff 3389 MD5 8f72054fc8c55107b5bf7ce13a8ad083 files/openssh-3.8_p1-chroot.patch 2884 +MD5 ee5b02cd561b09529e452aaf55ddbad7 files/digest-openssh-3.8.1_p1 140 MD5 8f72054fc8c55107b5bf7ce13a8ad083 files/openssh-3.7.1_p2-chroot.patch 2884 MD5 b31110303673214476c57e1bed28e1ce files/openssh-skeychallenge-args.diff 925 MD5 9b53f18685eeb54c381c9bd11b9b80cc files/openssh-3.7.1_p2-skey.patch 326 diff --git a/net-misc/openssh/files/digest-openssh-3.8.1_p1 b/net-misc/openssh/files/digest-openssh-3.8.1_p1 new file mode 100644 index 000000000000..cd617bdc86c0 --- /dev/null +++ b/net-misc/openssh/files/digest-openssh-3.8.1_p1 @@ -0,0 +1,2 @@ +MD5 1dbfd40ae683f822ae917eebf171ca42 openssh-3.8.1p1.tar.gz 817932 +MD5 de6735cdee8a0aa1eeba0960d58d0130 openssh-3.8p1+x509g4.diff.gz 130727 diff --git a/net-misc/openssh/files/openssh-3.8.1_p1-chroot.patch b/net-misc/openssh/files/openssh-3.8.1_p1-chroot.patch new file mode 100644 index 000000000000..13625995a88e --- /dev/null +++ b/net-misc/openssh/files/openssh-3.8.1_p1-chroot.patch @@ -0,0 +1,74 @@ +################################################################################ +################################################################################ +# # +# Original patch by Ricardo Cerqueira # +# # +# Updated by James Dennis for openssh-3.7.1p2 # +# # +# A patch to cause sshd to chroot when it encounters the magic token # +# '/./' in a users home directory. The directory portion before the # +# token is the directory to chroot() to, the portion after the # +# token is the user's home directory relative to the new root. # +# # +# Patch source using: patch -p0 < /path/to/patch # +# # +# Systems with a bad diff (doesn't understand -u or -N) should use gnu diff. # +# Solaris may store this as gdiff under /opt/sfw/bin. I can't say much about # +# other systems (unless you email me your experiences!). # +# # +################################################################################ +################################################################################ + +diff -uNr openssh-3.7.1p2/session.c openssh-3.7.1p2-chroot/session.c +--- openssh-3.7.1p2/session.c Tue Sep 23 04:59:08 2003 ++++ openssh-3.7.1p2-chroot/session.c Fri Sep 26 13:42:52 2003 +@@ -58,6 +58,8 @@ + #include "session.h" + #include "monitor_wrap.h" + ++#define CHROOT ++ + #ifdef GSSAPI + #include "ssh-gss.h" + #endif +@@ -1231,6 +1233,12 @@ + void + do_setusercontext(struct passwd *pw) + { ++ ++#ifdef CHROOT ++ char *user_dir; ++ char *new_root; ++#endif /* CHROOT */ ++ + #ifndef HAVE_CYGWIN + if (getuid() == 0 || geteuid() == 0) + #endif /* HAVE_CYGWIN */ +@@ -1268,6 +1276,27 @@ + exit(1); + } + endgrent(); ++ ++#ifdef CHROOT ++ user_dir = xstrdup(pw->pw_dir); ++ new_root = user_dir + 1; ++ ++ while((new_root = strchr(new_root, '.')) != NULL) { ++ new_root--; ++ if(strncmp(new_root, "/./", 3) == 0) { ++ *new_root = '\0'; ++ new_root += 2; ++ ++ if(chroot(user_dir) != 0) ++ fatal("Couldn't chroot to user directory % s", user_dir); ++ pw->pw_dir = new_root; ++ break; ++ } ++ new_root += 2; ++ } ++#endif /* CHROOT */ ++ ++ + # ifdef USE_PAM + /* + * PAM credentials may take the form of supplementary groups. diff --git a/net-misc/openssh/files/openssh-3.8.1_p1-kerberos.patch b/net-misc/openssh/files/openssh-3.8.1_p1-kerberos.patch new file mode 100644 index 000000000000..2d0694f0cc7e --- /dev/null +++ b/net-misc/openssh/files/openssh-3.8.1_p1-kerberos.patch @@ -0,0 +1,19 @@ +--- configure.ac 2004-02-24 21:05:46.781403118 +0000 ++++ configure.ac 2004-02-24 21:03:30.717786642 +0000 +@@ -2102,14 +2102,14 @@ + ) + else + AC_MSG_RESULT(no) +- CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include" ++ CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include -I/usr/include/heimdal -I/usr/include/gssapi" + LDFLAGS="$LDFLAGS -L${KRB5ROOT}/lib" + AC_MSG_CHECKING(whether we are using Heimdal) + AC_TRY_COMPILE([ #include ], + [ char *tmp = heimdal_version; ], + [ AC_MSG_RESULT(yes) + AC_DEFINE(HEIMDAL) +- K5LIBS="-lkrb5 -ldes -lcom_err -lasn1 -lroken" ++ K5LIBS="-lkrb5 -lcom_err -lasn1 -lroken -lresolv" + ], + [ AC_MSG_RESULT(no) + K5LIBS="-lkrb5 -lk5crypto -lcom_err" diff --git a/net-misc/openssh/files/openssh-3.8.1_p1-resolv_functions.patch b/net-misc/openssh/files/openssh-3.8.1_p1-resolv_functions.patch new file mode 100644 index 000000000000..2de0cca0ed96 --- /dev/null +++ b/net-misc/openssh/files/openssh-3.8.1_p1-resolv_functions.patch @@ -0,0 +1,12 @@ +--- configure.ac 2004-02-24 21:03:30.717786642 +0000 ++++ configure.ac 2004-02-24 21:33:37.936501897 +0000 +@@ -2055,7 +2055,9 @@ + [ + # Needed by our getrrsetbyname() + AC_SEARCH_LIBS(res_query, resolv) ++ AC_SEARCH_LIBS(__res_query, resolv) + AC_SEARCH_LIBS(dn_expand, resolv) ++ AC_SEARCH_LIBS(__dn_expand, resolv) + AC_CHECK_FUNCS(_getshort _getlong) + AC_CHECK_MEMBER(HEADER.ad, + [AC_DEFINE(HAVE_HEADER_AD)],, diff --git a/net-misc/openssh/files/openssh-3.8.1_p1-skey.patch b/net-misc/openssh/files/openssh-3.8.1_p1-skey.patch new file mode 100644 index 000000000000..133635574c8d --- /dev/null +++ b/net-misc/openssh/files/openssh-3.8.1_p1-skey.patch @@ -0,0 +1,11 @@ +--- configure.ac 2004-02-24 21:07:25.510177659 +0000 ++++ configure.ac 2004-02-24 21:03:30.717786642 +0000 +@@ -721,7 +721,7 @@ + [ + #include + #include +-int main() { char *ff = skey_keyinfo(""); ff=""; exit(0); } ++int main() { char *ff = "true"; ff=""; exit(0); } + ], + [AC_MSG_RESULT(yes)], + [ diff --git a/net-misc/openssh/openssh-3.8.1_p1.ebuild b/net-misc/openssh/openssh-3.8.1_p1.ebuild new file mode 100644 index 000000000000..f199b060b473 --- /dev/null +++ b/net-misc/openssh/openssh-3.8.1_p1.ebuild @@ -0,0 +1,130 @@ +# Copyright 1999-2004 Gentoo Technologies, Inc. +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/net-misc/openssh/openssh-3.8.1_p1.ebuild,v 1.1 2004/04/21 11:46:05 aliz Exp $ + +inherit eutils flag-o-matic ccc gnuconfig + +# Make it more portable between straight releases +# and _p? releases. +PARCH=${P/_/} + +X509_PATCH="${PARCH}+x509g4.diff.gz" +SELINUX_PATCH="openssh-3.7.1_p1-selinux.diff" + +S=${WORKDIR}/${PARCH} +DESCRIPTION="Port of OpenBSD's free SSH release" +HOMEPAGE="http://www.openssh.com/" +SRC_URI="mirror://openssh/${PARCH}.tar.gz" +# X509? ( http://roumenpetrov.info/openssh/x509g4/${X509_PATCH} )" + +LICENSE="as-is" +SLOT="0" +KEYWORDS="~x86 ~ppc ~sparc ~alpha ~mips ~hppa ~amd64 ~ia64 ~ppc64 ~s390" +IUSE="ipv6 static pam tcpd kerberos skey selinux chroot X509" + +# openssh recognizes when openssl has been slightly upgraded and refuses to run. +# This new rev will use the new openssl. +RDEPEND="virtual/glibc + pam? ( >=sys-libs/pam-0.73 + >=sys-apps/shadow-4.0.2-r2 ) + !mips? ( kerberos? ( virtual/krb5 ) ) + selinux? ( sys-libs/libselinux ) + !ppc64? ( skey? ( >=app-admin/skey-1.1.5-r1 ) ) + >=dev-libs/openssl-0.9.6d + >=sys-libs/zlib-1.1.4 + !ppc64? ( tcpd? ( >=sys-apps/tcp-wrappers-7.6 ) )" +DEPEND="${RDEPEND} + virtual/os-headers + dev-lang/perl + sys-apps/groff + >=sys-apps/sed-4 + sys-devel/autoconf" +PROVIDE="virtual/ssh" + +src_unpack() { + unpack ${PARCH}.tar.gz ; cd ${S} + + epatch ${FILESDIR}/${P}-kerberos.patch + epatch ${FILESDIR}/${P}-resolv_functions.patch + + use selinux && epatch ${FILESDIR}/${SELINUX_PATCH} + use alpha && epatch ${FILESDIR}/${PN}-3.5_p1-gentoo-sshd-gcc3.patch + use skey && epatch ${FILESDIR}/${P}-skey.patch + use chroot && epatch ${FILESDIR}/${P}-chroot.patch +# use X509 && epatch ${DISTDIR}/${X509_PATCH} +} + +src_compile() { + gnuconfig_update + + # make sure .sbss is large enough + use skey && use alpha && append-ldflags -mlarge-data + use ldap && filter-flags -funroll-loops + use selinux && append-flags "-DWITH_SELINUX" + use static && append-ldflags -static + export LDFLAGS + + autoconf + + local myconf="\ + $( use_with tcpd tcp-wrappers ) \ + $( use_with kerberos kerberos5 ) \ + $( use_with pam ) \ + $( use_with skey )" + + use ipv6 || myconf="${myconf} --with-ipv4-default" + + ./configure \ + --prefix=/usr \ + --sysconfdir=/etc/ssh \ + --mandir=/usr/share/man \ + --libexecdir=/usr/lib/misc \ + --datadir=/usr/share/openssh \ + --disable-suid-ssh \ + --with-privsep-path=/var/empty \ + --with-privsep-user=sshd \ + --with-md5-passwords \ + --host=${CHOST} \ + ${myconf} \ + || die "bad configure" + +# use static && { +# # statically link to libcrypto -- good for the boot cd +# sed -i "s:-lcrypto:/usr/lib/libcrypto.a:g" Makefile +# } + + emake || die "compile problem" +} + +src_install() { + make install-files DESTDIR=${D} || die + chmod 600 ${D}/etc/ssh/sshd_config + dodoc ChangeLog CREDITS OVERVIEW README* TODO sshd_config + insinto /etc/pam.d ; newins ${FILESDIR}/sshd.pam sshd + exeinto /etc/init.d ; newexe ${FILESDIR}/sshd.rc6 sshd + keepdir /var/empty + dosed "/^#Protocol /s:.*:Protocol 2:" /etc/ssh/sshd_config + use pam && dosed "/^#UsePAM /s:.*:UsePAM yes:" /etc/ssh/sshd_config +} + +pkg_postinst() { + enewgroup sshd 22 + enewuser sshd 22 /bin/false /var/empty sshd + + ewarn "Remember to merge your config files in /etc/ssh/ and then" + ewarn "restart sshd: '/etc/init.d/sshd restart'." + ewarn + einfo "As of version 3.4 the default is to enable the UsePrivelegeSeparation" + einfo "functionality, but please ensure that you do not explicitly disable" + einfo "this in your configuration as disabling it opens security holes" + einfo + einfo "This revision has removed your sshd user id and replaced it with a" + einfo "new one with UID 22. If you have any scripts or programs that" + einfo "that referenced the old UID directly, you will need to update them." + einfo + use pam >/dev/null 2>&1 && { + einfo "Please be aware users need a valid shell in /etc/passwd" + einfo "in order to be allowed to login." + einfo + } +} -- cgit v1.2.3-65-gdbad