pkgsrc/security/openssh/Makefile

143 lines
4 KiB
Makefile
Raw Normal View History

# $NetBSD: Makefile,v 1.83 2002/06/28 18:00:45 jlam Exp $
upgrade to 3.4p1 (openssh-3.4.0.1). 20020626 - (stevesk) [monitor.c] remove duplicate proto15 dispatch entry for PAM - (bal) OpenBSD CVS Sync - markus@cvs.openbsd.org 2002/06/23 21:34:07 [channels.c] tcode is u_int - markus@cvs.openbsd.org 2002/06/24 13:12:23 [ssh-agent.1] the socket name contains ssh-agent's ppid; via mpech@ from form@ - markus@cvs.openbsd.org 2002/06/24 14:33:27 [channels.c channels.h clientloop.c serverloop.c] move channel counter to u_int - markus@cvs.openbsd.org 2002/06/24 14:55:38 [authfile.c kex.c ssh-agent.c] cat to (void) when output from buffer_get_X is ignored - itojun@cvs.openbsd.org 2002/06/24 15:49:22 [msg.c] printf type pedant - deraadt@cvs.openbsd.org 2002/06/24 17:57:20 [sftp-server.c sshpty.c] explicit (u_int) for uid and gid - markus@cvs.openbsd.org 2002/06/25 16:22:42 [authfd.c] unnecessary cast - markus@cvs.openbsd.org 2002/06/25 18:51:04 [sshd.c] lightweight do_setusercontext after chroot() - (bal) Updated AIX package build. Patch by dtucker@zip.com.au - (tim) [Makefile.in] fix test on installing ssh-rand-helper.8 - (bal) added back in error check for mmap(). I screwed up, Pointed out by stevesk@ - (tim) [README.privsep] UnixWare tip no longer needed. - (bal) fixed NeXTStep missing munmap() issue. It defines HAVE_MMAP, but it all damned lies. - (stevesk) [README.privsep] more for sshd pseudo-account. - (tim) [contrib/caldera/openssh.spec] add support for privsep - (djm) setlogin needs pgid==pid on BSD/OS; from itojun@ - (djm) OpenBSD CVS Sync - markus@cvs.openbsd.org 2002/06/26 08:53:12 [bufaux.c] limit size of BNs to 8KB; ok provos/deraadt - markus@cvs.openbsd.org 2002/06/26 08:54:18 [buffer.c] limit append to 1MB and buffers to 10MB - markus@cvs.openbsd.org 2002/06/26 08:55:02 [channels.c] limit # of channels to 10000 - markus@cvs.openbsd.org 2002/06/26 08:58:26 [session.c] limit # of env vars to 1000; ok deraadt/djm - deraadt@cvs.openbsd.org 2002/06/26 13:20:57 [monitor.c] be careful in mm_zalloc - deraadt@cvs.openbsd.org 2002/06/26 13:49:26 [session.c] disclose less information from environment files; based on input from djm, and dschultz@uclink.Berkeley.EDU - markus@cvs.openbsd.org 2002/06/26 13:55:37 [auth2-chall.c] make sure # of response matches # of queries, fixes int overflow; from ISS - markus@cvs.openbsd.org 2002/06/26 13:56:27 [version.h] 3.4 - (djm) Require krb5 devel for RPM build w/ KrbV - (djm) Improve PAMAuthenticationViaKbdInt text from Nalin Dahyabhai <nalin@redhat.com> - (djm) Update spec files for release - (djm) Fix int overflow in auth2-pam.c, similar to one discovered by ISS - (djm) Release 3.4p1 20020625 - (stevesk) [INSTALL acconfig.h configure.ac defines.h] remove --with-rsh - (stevesk) [README.privsep] minor updates - (djm) Create privsep directory and warn if privsep user is missing during make install - (bal) Started list of PrivSep issues in TODO - (bal) if mmap() is substandard, don't allow compression on server side. Post 'event' we will add more options. - (tim) [contrib/caldera/openssh.spec] Sync with Caldera - (bal) moved aix_usrinfo() and noted not setting real TTY. Patch by dtucker@zip.com.au - (tim) [acconfig.h configure.ac sshd.c] BROKEN_FD_PASSING fix from Markus for Cygwin, Cray, & SCO 20020624 - OpenBSD CVS Sync - deraadt@cvs.openbsd.org 2002/06/23 03:25:50 [tildexpand.c] KNF - deraadt@cvs.openbsd.org 2002/06/23 03:26:19 [cipher.c key.c] KNF - deraadt@cvs.openbsd.org 2002/06/23 03:30:58 [scard.c ssh-dss.c ssh-rsa.c sshconnect.c sshconnect2.c sshd.c sshlogin.c sshpty.c] various KNF and %d for unsigned - deraadt@cvs.openbsd.org 2002/06/23 09:30:14 [sftp-client.c sftp-client.h sftp-common.c sftp-int.c sftp-server.c sftp.c] bunch of u_int vs int stuff - deraadt@cvs.openbsd.org 2002/06/23 09:39:55 [ssh-keygen.c] u_int stuff - deraadt@cvs.openbsd.org 2002/06/23 09:46:51 [bufaux.c servconf.c] minor KNF. things the fingers do while you read - deraadt@cvs.openbsd.org 2002/06/23 10:29:52 [ssh-agent.c sshd.c] some minor KNF and %u - deraadt@cvs.openbsd.org 2002/06/23 20:39:45 [session.c] compression_level is u_int - deraadt@cvs.openbsd.org 2002/06/23 21:06:13 [sshpty.c] KNF - deraadt@cvs.openbsd.org 2002/06/23 21:06:41 [channels.c channels.h session.c session.h] display, screen, row, col, xpixel, ypixel are u_int; markus ok - deraadt@cvs.openbsd.org 2002/06/23 21:10:02 [packet.c] packet_get_int() returns unsigned for reason & seqnr - (bal) Also fixed IPADDR_IN_DISPLAY case where display, screen, row, col, xpixel are u_int. 20020623 - (stevesk) [configure.ac] bug #255 LOGIN_NEEDS_UTMPX for AIX. - (bal) removed GNUism for getops in ssh-agent since glibc lacks optreset. - (bal) add extern char *getopt. Based on report by dtucker@zip.com.au - OpenBSD CVS Sync - stevesk@cvs.openbsd.org 2002/06/22 02:00:29 [ssh.h] correct comment - stevesk@cvs.openbsd.org 2002/06/22 02:40:23 [ssh.1] section 5 not 4 for ssh_config - naddy@cvs.openbsd.org 2002/06/22 11:51:39 [ssh.1] typo - stevesk@cvs.openbsd.org 2002/06/22 16:32:54 [sshd.8] add /var/empty in FILES section - stevesk@cvs.openbsd.org 2002/06/22 16:40:19 [sshd.c] check /var/empty owner mode; ok provos@ - stevesk@cvs.openbsd.org 2002/06/22 16:41:57 [scp.1] typo - stevesk@cvs.openbsd.org 2002/06/22 16:45:29 [ssh-agent.1 sshd.8 sshd_config.5] use process ID vs. pid/PID/process identifier - stevesk@cvs.openbsd.org 2002/06/22 20:05:27 [sshd.c] don't call setsid() if debugging or run from inetd; no "Operation not permitted" errors now; ok millert@ markus@ - stevesk@cvs.openbsd.org 2002/06/22 23:09:51 [monitor.c] save auth method before monitor_reset_key_state(); bugzilla bug #284; ok provos@
2002-06-26 16:33:29 +02:00
DISTNAME= openssh-3.4p1
PKGNAME= openssh-3.4.0.1
SVR4_PKGNAME= ossh
CATEGORIES= security
MASTER_SITES= ftp://gd.tuwien.ac.at/opsys/OpenBSD/OpenSSH/portable/ \
ftp://ftp.openssh.com/pub/OpenBSD/OpenSSH/portable/ \
ftp://ftp.openssh.com/pub/OpenBSD/OpenSSH/portable/old/
# Don't delete the last entry -- it's there if the pkgsrc version is not
# up-to-date and the mirrors already removed the old distfile.
MAINTAINER= packages@netbsd.org
HOMEPAGE= http://www.openssh.com/
COMMENT= Open Source Secure shell client and server (remote login program)
CONFLICTS= sftp-[0-9]*
CONFLICTS+= ssh-[0-9]* ssh6-[0-9]*
BUILD_DEPENDS+= perl>=${PERL5_REQD}:../../lang/perl5
# 0.9.5a can be used, with blowfish support broken. so require 0.9.6.
USE_OPENSSL_VERSION= ${OPENSSL_VERSION_096}
CRYPTO= yes
# retain the following line, for IPv6-ready pkgsrc webpage
BUILD_DEFS+= USE_INET6
#BUILD_DEFS+= KERBEROS
.include "../../mk/bsd.prefs.mk"
INSTALL_TARGET= install-nokeys
PLIST_SRC= # empty
MESSAGE_SRC= ${.CURDIR}/MESSAGE
SSH_PID_DIR= /var/run # default directory for PID files
SSH_PID_DIR.SunOS= /etc # Solaris doesn't have a /var/run
.if defined(SSH_PID_DIR.${OPSYS})
SSH_PID_DIR= ${SSH_PID_DIR.${OPSYS}}
.endif
PKG_SYSCONFSUBDIR= ssh
MANDIR= man
RCD_SCRIPTS_EGDIR= etc/rc.d
PLIST_SUBST+= MANDIR=${MANDIR}
PLIST_SUBST+= RCD_SCRIPTS_EGDIR=${RCD_SCRIPTS_EGDIR}
USE_BUILDLINK_ONLY= yes
GNU_CONFIGURE= yes
CONFIGURE_ARGS+= --sysconfdir=${PKG_SYSCONFDIR}
CONFIGURE_ARGS+= --mandir=${PREFIX}/${MANDIR}
CONFIGURE_ARGS+= --with-pid-dir=${SSH_PID_DIR}
CONFIGURE_ARGS+= --with-ssl-dir=${BUILDLINK_DIR}
CONFIGURE_ARGS+= --with-tcp-wrappers=${BUILDLINK_DIR}
upgrade to 3.3p1, with privilege separation enabled. (the following change may include pre-3.2.3p1 change) 20020622 - (djm) Update README.privsep; spotted by fries@ - (djm) Release 3.3p1 20020621 - (djm) Sync: - djm@cvs.openbsd.org 2002/06/21 05:50:51 [monitor.c] Don't initialise compression buffers when compression=no in sshd_config; ok Niels@ - ID sync for auth-passwd.c - (djm) Warn and disable compression on platforms which can't handle both useprivilegeseparation=yes and compression=yes - (djm) contrib/redhat/openssh.spec hacking: - Merge in spec changes from seba@iq.pl (Sebastian Pachuta) - Add new {ssh,sshd}_config.5 manpages - Add new ssh-keysign program and remove setuid from ssh client 20020620 - (bal) Fixed AIX environment handling, use setpcred() instead of existing code. (Bugzilla Bug 261) - (bal) OpenBSD CVS Sync - todd@cvs.openbsd.org 2002/06/14 21:35:00 [monitor_wrap.c] spelling; from Brian Poole <raj@cerias.purdue.edu> - markus@cvs.openbsd.org 2002/06/15 00:01:36 [authfd.c authfd.h ssh-add.c ssh-agent.c] break agent key lifetime protocol and allow other contraints for key usage. - markus@cvs.openbsd.org 2002/06/15 00:07:38 [authfd.c authfd.h ssh-add.c ssh-agent.c] fix stupid typo - markus@cvs.openbsd.org 2002/06/15 01:27:48 [authfd.c authfd.h ssh-add.c ssh-agent.c] remove the CONSTRAIN_IDENTITY messages and introduce a new ADD_ID message with contraints instead. contraints can be only added together with the private key. - itojun@cvs.openbsd.org 2002/06/16 21:30:58 [ssh-keyscan.c] use TAILQ_xx macro. from lukem@netbsd. markus ok - deraadt@cvs.openbsd.org 2002/06/17 06:05:56 [scp.c] make usage like man page - deraadt@cvs.openbsd.org 2002/06/19 00:27:55 [auth-bsdauth.c auth-skey.c auth1.c auth2-chall.c auth2-none.c authfd.c authfd.h monitor_wrap.c msg.c nchan.c radix.c readconf.c scp.c sftp.1 ssh-add.1 ssh-add.c ssh-agent.1 ssh-agent.c ssh-keygen.1 ssh-keygen.c ssh-keysign.c ssh.1 sshconnect.c sshconnect.h sshconnect2.c ttymodes.c xmalloc.h] KNF done automatically while reading.... - markus@cvs.openbsd.org 2002/06/19 18:01:00 [cipher.c monitor.c monitor_wrap.c packet.c packet.h] make the monitor sync the transfer ssh1 session key; transfer keycontext only for RC4 (this is still depends on EVP implementation details and is broken). - stevesk@cvs.openbsd.org 2002/06/20 19:56:07 [ssh.1 sshd.8] move configuration file options from ssh.1/sshd.8 to ssh_config.5/sshd_config.5; ok deraadt@ millert@ - stevesk@cvs.openbsd.org 2002/06/20 20:00:05 [scp.1 sftp.1] ssh_config(5) - stevesk@cvs.openbsd.org 2002/06/20 20:03:34 [ssh_config sshd_config] refer to config file man page - markus@cvs.openbsd.org 2002/06/20 23:05:56 [servconf.c servconf.h session.c sshd.c] allow Compression=yes/no in sshd_config - markus@cvs.openbsd.org 2002/06/20 23:37:12 [sshd_config] add Compression - stevesk@cvs.openbsd.org 2002/05/25 20:40:08 [LICENCE] missed Per Allansson (auth2-chall.c) - (bal) Cygwin special handling of empty passwords wrong. Patch by vinschen@redhat.com - (bal) Missed integrating ssh_config.5 and sshd_config.5 - (bal) Still more Makefile.in updates for ssh{d}_config.5 20020613 - (bal) typo of setgroup for cygwin. Patch by vinschen@redhat.com 20020612 - (bal) OpenBSD CVS Sync - markus@cvs.openbsd.org 2002/06/11 23:03:54 [ssh.c] remove unused cruft. - markus@cvs.openbsd.org 2002/06/12 01:09:52 [ssh.c] ssh_connect returns 0 on success - (bal) Build noop setgroups() for cygwin to clean up code (For other platforms without the setgroups() requirement, you MUST define SETGROUPS_NOOP in the configure.ac) Based on patch by vinschen@redhat.com - (bal) Some platforms don't have ONLCR (Notable Mint) 20020611 - (bal) ssh-agent.c RCSD fix (|unexpand already done) - (bal) OpenBSD CVS Sync - stevesk@cvs.openbsd.org 2002/06/09 22:15:15 [ssh.1] update for no setuid root and ssh-keysign; ok deraadt@ - itojun@cvs.openbsd.org 2002/06/09 22:17:21 [sshconnect.c] pass salen to sockaddr_ntop so that we are happy on linux/solaris - stevesk@cvs.openbsd.org 2002/06/10 16:53:06 [auth-rsa.c ssh-rsa.c] display minimum RSA modulus in error(); ok markus@ - stevesk@cvs.openbsd.org 2002/06/10 16:56:30 [ssh-keysign.8] merge in stuff from my man page; ok markus@ - stevesk@cvs.openbsd.org 2002/06/10 17:36:23 [ssh-add.1 ssh-add.c] use convtime() to parse and validate key lifetime. can now use '-t 2h' etc. ok markus@ provos@ - stevesk@cvs.openbsd.org 2002/06/10 17:45:20 [readconf.c ssh.1] change RhostsRSAAuthentication and RhostsAuthentication default to no since ssh is no longer setuid root by default; ok markus@ - stevesk@cvs.openbsd.org 2002/06/10 21:21:10 [ssh_config] update defaults for RhostsRSAAuthentication and RhostsAuthentication here too (all options commented out with default value). - markus@cvs.openbsd.org 2002/06/10 22:28:41 [channels.c channels.h session.c] move creation of agent socket to session.c; no need for uidswapping in channel.c. - markus@cvs.openbsd.org 2002/06/11 04:14:26 [ssh.c sshconnect.c sshconnect.h] no longer use uidswap.[ch] from the ssh client run less code with euid==0 if ssh is installed setuid root just switch the euid, don't switch the complete set of groups (this is only needed by sshd). ok provos@ - mpech@cvs.openbsd.org 2002/06/11 05:46:20 [auth-krb4.c monitor.h serverloop.c session.c ssh-agent.c sshd.c] pid_t cleanup. Markus need this now to keep hacking. markus@, millert@ ok - itojun@cvs.openbsd.org 2002/06/11 08:11:45 [canohost.c] use "ntop" only after initialized - (bal) Cygwin fix up from swap uid clean up in ssh.c patch by vinschen@redhat.com 20020609 - (bal) OpenBSD CVS Sync - markus@cvs.openbsd.org 2002/06/08 05:07:56 [ssh.c] nuke ptrace comment - markus@cvs.openbsd.org 2002/06/08 05:07:09 [ssh-keysign.c] only accept 20 byte session ids - markus@cvs.openbsd.org 2002/06/08 05:17:01 [readconf.c readconf.h ssh.1 ssh.c] deprecate FallBackToRsh and UseRsh; patch from djm@ - markus@cvs.openbsd.org 2002/06/08 05:40:01 [readconf.c] just warn about Deprecated options for now - markus@cvs.openbsd.org 2002/06/08 05:41:18 [ssh_config] remove FallBackToRsh/UseRsh - markus@cvs.openbsd.org 2002/06/08 12:36:53 [scp.c] remove FallBackToRsh - markus@cvs.openbsd.org 2002/06/08 12:46:14 [readconf.c] silently ignore deprecated options, since FallBackToRsh might be passed by remote scp commands. - itojun@cvs.openbsd.org 2002/06/08 21:15:27 [sshconnect.c] always use getnameinfo. (diag message only) - markus@cvs.openbsd.org 2002/06/09 04:33:27 [sshconnect.c] abort() - > fatal() - (bal) RCSID tag updates on channels.c, clientloop.c, nchan.c, sftp-client.c, ssh-agenet.c, ssh-keygen.c and connect.h (we did unexpand independant of them) 20020607 - (bal) Removed --{enable/disable}-suid-ssh - (bal) Missed __progname in ssh-keysign.c patch by dtucker@zip.com.au - (bal) use 'LOGIN_PROGRAM' not '/usr/bin/login' in session.c patch by Bertrand.Velle@apogee-com.fr 20020606 - (bal) OpenBSD CVS Sync - markus@cvs.openbsd.org 2002/05/15 21:56:38 [servconf.c sshd.8 sshd_config] re-enable privsep and disable setuid for post-3.2.2 - markus@cvs.openbsd.org 2002/05/16 22:02:50 [cipher.c kex.h mac.c] fix warnings (openssl 0.9.7 requires const) - stevesk@cvs.openbsd.org 2002/05/16 22:09:59 [session.c ssh.c] don't limit xauth pathlen on client side and longer print length on server when debug; ok markus@ - deraadt@cvs.openbsd.org 2002/05/19 20:54:52 [log.h] extra commas in enum not 100% portable - deraadt@cvs.openbsd.org 2002/05/22 23:18:25 [ssh.c sshd.c] spelling; abishoff@arc.nasa.gov - markus@cvs.openbsd.org 2002/05/23 19:24:30 [authfile.c authfile.h pathnames.h ssh.c sshconnect.c sshconnect.h sshconnect1.c sshconnect2.c ssh-keysign.8 ssh-keysign.c Makefile.in] add /usr/libexec/ssh-keysign: a setuid helper program for hostbased authentication in protocol v2 (needs to access the hostkeys). - markus@cvs.openbsd.org 2002/05/23 19:39:34 [ssh.c] add comment about ssh-keysign - markus@cvs.openbsd.org 2002/05/24 08:45:14 [sshconnect2.c] stat ssh-keysign first, print error if stat fails; some debug->error; fix comment - markus@cvs.openbsd.org 2002/05/25 08:50:39 [sshconnect2.c] execlp->execl; from stevesk - markus@cvs.openbsd.org 2002/05/25 18:51:07 [auth.h auth2.c auth2-hostbased.c auth2-kbdint.c auth2-none.c auth2-passwd.c auth2-pubkey.c Makefile.in] split auth2.c into one file per method; ok provos@/deraadt@ - stevesk@cvs.openbsd.org 2002/05/26 20:35:10 [ssh.1] sort ChallengeResponseAuthentication; ok markus@ - stevesk@cvs.openbsd.org 2002/05/28 16:45:27 [monitor_mm.c] print strerror(errno) on mmap/munmap error; ok markus@ - stevesk@cvs.openbsd.org 2002/05/28 17:28:02 [uidswap.c] format spec change/casts and some KNF; ok markus@ - stevesk@cvs.openbsd.org 2002/05/28 21:24:00 [uidswap.c] use correct function name in fatal() - stevesk@cvs.openbsd.org 2002/05/29 03:06:30 [ssh.1 sshd.8] spelling - markus@cvs.openbsd.org 2002/05/29 11:21:57 [sshd.c] don't start if privsep is enabled and SSH_PRIVSEP_USER or _PATH_PRIVSEP_CHROOT_DIR are missing; ok deraadt@ - markus@cvs.openbsd.org 2002/05/30 08:07:31 [cipher.c] use rijndael/aes from libcrypto (openssl >= 0.9.7) instead of our own implementation. allow use of AES hardware via libcrypto, ok deraadt@ - markus@cvs.openbsd.org 2002/05/31 10:30:33 [sshconnect2.c] extent ssh-keysign protocol: pass # of socket-fd to ssh-keysign, keysign verfies locally used ip-address using this socket-fd, restricts fake local hostnames to actual local hostnames; ok stevesk@ - markus@cvs.openbsd.org 2002/05/31 11:35:15 [auth.h auth2.c] move Authmethod definitons to per-method file. - markus@cvs.openbsd.org 2002/05/31 13:16:48 [key.c] add comment: key_verify returns 1 for a correct signature, 0 for an incorrect signature and -1 on error. - markus@cvs.openbsd.org 2002/05/31 13:20:50 [ssh-rsa.c] pad received signature with leading zeros, because RSA_verify expects a signature of RSA_size. the drafts says the signature is transmitted unpadded (e.g. putty does not pad), reported by anakin@pobox.com - deraadt@cvs.openbsd.org 2002/06/03 12:04:07 [ssh.h] compatiblity -> compatibility decriptor -> descriptor authentciated -> authenticated transmition -> transmission - markus@cvs.openbsd.org 2002/06/04 19:42:35 [monitor.c] only allow enabled authentication methods; ok provos@ - markus@cvs.openbsd.org 2002/06/04 19:53:40 [monitor.c] save the session id (hash) for ssh2 (it will be passed with the initial sign request) and verify that this value is used during authentication; ok provos@ - markus@cvs.openbsd.org 2002/06/04 23:02:06 [packet.c] remove __FUNCTION__ - markus@cvs.openbsd.org 2002/06/04 23:05:49 [cipher.c monitor.c monitor_fdpass.c monitor_mm.c monitor_wrap.c] __FUNCTION__ -> __func__ - markus@cvs.openbsd.org 2002/06/05 16:08:07 [ssh-agent.1 ssh-agent.c] '-a bind_address' binds the agent to user-specified unix-domain socket instead of /tmp/ssh-XXXXXXXX/agent.<pid>; ok djm@ (some time ago). - markus@cvs.openbsd.org 2002/06/05 16:08:07 [ssh-agent.1 ssh-agent.c] '-a bind_address' binds the agent to user-specified unix-domain socket instead of /tmp/ssh-XXXXXXXX/agent.<pid>; ok djm@ (some time ago). - markus@cvs.openbsd.org 2002/06/05 16:48:54 [ssh-agent.c] copy current request into an extra buffer and just flush this request on errors, ok provos@ - markus@cvs.openbsd.org 2002/06/05 19:57:12 [authfd.c authfd.h ssh-add.1 ssh-add.c ssh-agent.c] ssh-add -x for lock and -X for unlocking the agent. todo: encrypt private keys with locked... - markus@cvs.openbsd.org 2002/06/05 20:56:39 [ssh-add.c] add -x/-X to usage - markus@cvs.openbsd.org 2002/06/05 21:55:44 [authfd.c authfd.h ssh-add.1 ssh-add.c ssh-agent.c] ssh-add -t life, Set lifetime (in seconds) when adding identities; ok provos@ - stevesk@cvs.openbsd.org 2002/06/06 01:09:41 [monitor.h] no trailing comma in enum; china@thewrittenword.com - markus@cvs.openbsd.org 2002/06/06 17:12:44 [sftp-server.c] discard remaining bytes of current request; ok provos@ - markus@cvs.openbsd.org 2002/06/06 17:30:11 [sftp-server.c] use get_int() macro (hide iqueue) - (bal) Missed msg.[ch] in merge. Required for ssh-keysign. - (bal) Forgot to add msg.c Makefile.in. - (bal) monitor_mm.c typos. - (bal) Refixed auth2.c. It was never fully commited while spliting out authentication to different files. - (bal) ssh-keysign should build and install correctly now. Phase two would be to clean out any dead wood and disable ssh setuid on install. - (bal) Reverse logic, use __func__ first since it's C99 20020604 - (stevesk) [channels.c] bug #164 patch from YOSHIFUJI Hideaki (changed setsockopt from debug to error for now). 20020527 - (tim) [configure.ac.orig monitor_fdpass.c] Enahnce msghdr tests to address build problem on Irix reported by Dave Love <d.love@dl.ac.uk>. Back out last monitor_fdpass.c changes that are no longer needed with new tests. Patch tested on Irix by Jan-Frode Myklebust <janfrode@parallab.uib.no> 20020522 - (djm) Fix spelling mistakes, spotted by Solar Designer i <solar@openwall.com> - Sync scard/ (not sure when it drifted) - (djm) OpenBSD CVS Sync: [auth.c] Fix typo/thinko. Pass in as to auth_approval(), not NULL. Closes PR 2659. - Crank version - Crank RPM spec versions 20020521 - (stevesk) [sshd.c] bug 245; disable setsid() for now - (stevesk) [sshd.c] #ifndef HAVE_CYGWIN for setgroups() 20020517 - (tim) [configure.ac] remove extra MD5_MSG="no" line. 20020515 - (bal) CVS ID fix up on auth-passwd.c - (bal) OpenBSD CVS Sync - deraadt@cvs.openbsd.org 2002/05/07 19:54:36 [ssh.h] use ssh uid - deraadt@cvs.openbsd.org 2002/05/08 21:06:34 [ssh.h] move to sshd.sshd instead - stevesk@cvs.openbsd.org 2002/05/11 20:24:48 [ssh.h] typo in comment - itojun@cvs.openbsd.org 2002/05/13 02:37:39 [auth-skey.c auth2.c] less warnings. skey_{respond,query} are public (in auth.h) - markus@cvs.openbsd.org 2002/05/13 20:44:58 [auth-options.c auth.c auth.h] move the packet_send_debug handling from auth-options.c to auth.c; ok provos@ - millert@cvs.openbsd.org 2002/05/13 15:53:19 [sshd.c] Call setsid() in the child after sshd accepts the connection and forks. This is needed for privsep which calls setlogin() when it changes uids. Without this, there is a race where the login name of an existing connection, as returned by getlogin(), may be changed to the privsep user (sshd). markus@ OK - markus@cvs.openbsd.org 2002/05/13 21:26:49 [auth-rhosts.c] handle debug messages during rhosts-rsa and hostbased authentication; ok provos@ - mouring@cvs.openbsd.org 2002/05/15 15:47:49 [kex.c monitor.c monitor_wrap.c sshd.c] 'monitor' variable clashes with at least one lame platform (NeXT). i Renamed to 'pmonitor'. provos@ - deraadt@cvs.openbsd.org 2002/05/04 02:39:35 [servconf.c sshd.8 sshd_config] enable privsep by default; provos ok - millert@cvs.openbsd.org 2002/05/06 23:34:33 [ssh.1 sshd.8] Kill/adjust r(login|exec)d? references now that those are no longer in the tree. - markus@cvs.openbsd.org 2002/05/15 21:02:53 [servconf.c sshd.8 sshd_config] disable privsep and enable setuid for the 3.2.2 release - (bal) Fixed up PAM case. I think. - (bal) Clarified openbsd-compat/*-cray.* Licence provided by Wendy - (bal) OpenBSD CVS Sync - markus@cvs.openbsd.org 2002/05/15 21:05:29 [version.h] enter OpenSSH_3.2.2 - (bal) Caldara, Suse, and Redhat openssh.specs updated.
2002-06-25 04:13:11 +02:00
CONFIGURE_ARGS+= --with-privsep-path=/var/chroot/sshd
# XXX: PAM authentication causes memory faults, and I haven't tracked down
# XXX: why yet. For the moment, disable PAM authentication.
#
#.if defined(USE_PAM)
#.include "../../security/PAM/buildlink.mk"
#CONFIGURE_ARGS+= --with-pam
#PLIST_SRC+= ${.CURDIR}/PLIST.pam
#MESSAGE_SRC+= ${.CURDIR}/MESSAGE.pam
#.endif
Clean this up, sync with the ssh package, and update to 1.2.2 (fixing PR 9304 by David Rankin <drankin@bohemians.lexington.ky.us>. Changes: 20000125 - Fix NULL pointer dereference in login.c. Fix from Andre Lucas <andre.lucas@dial.pipex.com> - Reorder PAM initialisation so it does not mess up lastlog. Reported by Andre Lucas <andre.lucas@dial.pipex.com> - Use preformatted manpages on SCO, report from Gary E. Miller <gem@rellim.com> - New URL for x11-ssh-askpass. - Fixpaths was missing /etc/ssh_known_hosts. Report from Jim Knoble <jmknoble@pobox.com> - Added 'DESTDIR' option to Makefile to ease package building. Patch from Jim Knoble <jmknoble@pobox.com> - Updated RPM spec files to use DESTDIR 20000124 - Pick up version 1.2.2 from OpenBSD CVS (no changes, just version number increment) 20000123 - OpenBSD CVS: - [packet.c] getsockname() requires initialized tolen; andy@guildsoftware.com - AIX patch from Matt Richards <v2matt@btv.ibm.com> and David Rankin <drankin@bohemians.lexington.ky.us> - Fix lastlog support, patch from Andre Lucas <andre.lucas@dial.pipex.com> 20000122 - Fix compilation of bsd-snprintf.c on Solaris, fix from Ben Taylor <bent@clark.net> - Merge preformatted manpage patch from Andre Lucas <andre.lucas@dial.pipex.com> - Make IPv4 use the default in RPM packages - Irix uses preformatted manpages - Missing htons() in bsd-bindresvport.c, fix from Holger Trapp <Holger.Trapp@Informatik.TU-Chemnitz.DE> - OpenBSD CVS updates: - [packet.c] use getpeername() in packet_connection_is_on_socket(), fixes sshd -i; from Holger.Trapp@Informatik.TU-Chemnitz.DE - [sshd.c] log with level log() not fatal() if peer behaves badly. - [readpass.c] instead of blocking SIGINT, catch it ourselves, so that we can clean the tty modes up and kill ourselves -- instead of our process group leader (scp, cvs, ...) going away and leaving us in noecho mode. people with cbreak shells never even noticed.. - [ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh.1 sshd.8] ie. -> i.e., 20000120 - Don't use getaddrinfo on AIX - Update to latest OpenBSD CVS: - [auth-rsa.c] - fix user/1056, sshd keeps restrictions; dbt@meat.net - [sshconnect.c] - disable agent fwding for proto 1.3, remove abuse of auth-rsa flags. - destroy keys earlier - split key exchange (kex) and user authentication (user-auth), ok: provos@ - [sshd.c] - no need for poll.h; from bright@wintelcom.net - disable agent fwding for proto 1.3, remove abuse of auth-rsa flags. - split key exchange (kex) and user authentication (user-auth), ok: provos@ - [sshd.c] - no need for poll.h; from bright@wintelcom.net - disable agent fwding for proto 1.3, remove abuse of auth-rsa flags. - split key exchange (kex) and user authentication (user-auth), ok: provos@ - Big manpage and config file cleanup from Andre Lucas <andre.lucas@dial.pipex.com> - Re-added latest (unmodified) OpenBSD manpages - Doc updates - NetBSD patch from David Rankin <drankin@bohemians.lexington.ky.us> and Christos Zoulas <christos@netbsd.org> 20000119 - SCO compile fixes from Gary E. Miller <gem@rellim.com> - Compile fix from Darren_Hall@progressive.com - Linux/glibc-2.1.2 takes a *long* time to look up names for AF_UNSPEC addresses using getaddrinfo(). Added a configure switch to make the default lookup mode AF_INET 20000118 - Fixed --with-pid-dir option - Makefile fix from Gary E. Miller <gem@rellim.com> - Compile fix for HPUX and Solaris from Andre Lucas <andre.lucas@dial.pipex.com>
2000-01-27 18:12:02 +01:00
# XXX: we have 4 args (4: sslen) to skeychallenge instead of 3
#.if ${OPSYS} == "NetBSD"
#CONFIGURE_ARGS+= --with-skey=/usr
#.endif
# XXX: <krb.h>
#.if defined(KERBEROS)
#PKG_USE_KERBEROS= yes
#CONFIGURE_ARGS+= --with-kerberos4=/usr
#.endif
# The ssh-askpass program is in ${X11BASE}/bin or ${X11PREFIX}/bin depending
# on if it's part of the X11 distribution, or if it's installed from pkgsrc
# (security/ssh-askpass).
#
.if exists(${X11BASE}/bin/ssh-askpass)
ASKPASS_PROGRAM= ${X11BASE}/bin/ssh-askpass
.else
ASKPASS_PROGRAM= ${X11PREFIX}/bin/ssh-askpass
.endif
CONFIGURE_ENV+= ASKPASS_PROGRAM=${ASKPASS_PROGRAM}
MAKE_ENV+= ASKPASS_PROGRAM=${ASKPASS_PROGRAM}
CONFS= ssh_config sshd_config
SUPPS= moduli
.if exists(/dev/urandom)
MESSAGE_SRC+= ${.CURDIR}/MESSAGE.urandom
.else
CONFIGURE_ARGS+= --without-random
CONFS+= ssh_prng_cmds
PLIST_SRC+= ${.CURDIR}/PLIST.prng
2001-01-10 17:05:52 +01:00
.endif
EGDIR= ${PREFIX}/share/examples/${PKGBASE}
CONF_FILES= # empty
.for FILE in ${CONFS}
CONF_FILES+= ${EGDIR}/${FILE} ${PKG_SYSCONFDIR}/${FILE}
.endfor
SUPPORT_FILES= # empty
.for FILE in ${SUPPS}
SUPPORT_FILES+= ${EGDIR}/${FILE} ${PKG_SYSCONFDIR}/${FILE}
.endfor
OWN_DIRS= /var/chroot/sshd
RCD_SCRIPTS= sshd
PLIST_SRC+= ${.CURDIR}/PLIST
FILES_SUBST+= SSH_PID_DIR=${SSH_PID_DIR}
MESSAGE_SUBST+= EGDIR=${EGDIR}
INSTALL_EXTRA_TMPL= ${.CURDIR}/INSTALL
.if defined(UPDATE_INTREE_OPENSSH)
. include "Makefile.intree"
.endif
Clean this up, sync with the ssh package, and update to 1.2.2 (fixing PR 9304 by David Rankin <drankin@bohemians.lexington.ky.us>. Changes: 20000125 - Fix NULL pointer dereference in login.c. Fix from Andre Lucas <andre.lucas@dial.pipex.com> - Reorder PAM initialisation so it does not mess up lastlog. Reported by Andre Lucas <andre.lucas@dial.pipex.com> - Use preformatted manpages on SCO, report from Gary E. Miller <gem@rellim.com> - New URL for x11-ssh-askpass. - Fixpaths was missing /etc/ssh_known_hosts. Report from Jim Knoble <jmknoble@pobox.com> - Added 'DESTDIR' option to Makefile to ease package building. Patch from Jim Knoble <jmknoble@pobox.com> - Updated RPM spec files to use DESTDIR 20000124 - Pick up version 1.2.2 from OpenBSD CVS (no changes, just version number increment) 20000123 - OpenBSD CVS: - [packet.c] getsockname() requires initialized tolen; andy@guildsoftware.com - AIX patch from Matt Richards <v2matt@btv.ibm.com> and David Rankin <drankin@bohemians.lexington.ky.us> - Fix lastlog support, patch from Andre Lucas <andre.lucas@dial.pipex.com> 20000122 - Fix compilation of bsd-snprintf.c on Solaris, fix from Ben Taylor <bent@clark.net> - Merge preformatted manpage patch from Andre Lucas <andre.lucas@dial.pipex.com> - Make IPv4 use the default in RPM packages - Irix uses preformatted manpages - Missing htons() in bsd-bindresvport.c, fix from Holger Trapp <Holger.Trapp@Informatik.TU-Chemnitz.DE> - OpenBSD CVS updates: - [packet.c] use getpeername() in packet_connection_is_on_socket(), fixes sshd -i; from Holger.Trapp@Informatik.TU-Chemnitz.DE - [sshd.c] log with level log() not fatal() if peer behaves badly. - [readpass.c] instead of blocking SIGINT, catch it ourselves, so that we can clean the tty modes up and kill ourselves -- instead of our process group leader (scp, cvs, ...) going away and leaving us in noecho mode. people with cbreak shells never even noticed.. - [ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh.1 sshd.8] ie. -> i.e., 20000120 - Don't use getaddrinfo on AIX - Update to latest OpenBSD CVS: - [auth-rsa.c] - fix user/1056, sshd keeps restrictions; dbt@meat.net - [sshconnect.c] - disable agent fwding for proto 1.3, remove abuse of auth-rsa flags. - destroy keys earlier - split key exchange (kex) and user authentication (user-auth), ok: provos@ - [sshd.c] - no need for poll.h; from bright@wintelcom.net - disable agent fwding for proto 1.3, remove abuse of auth-rsa flags. - split key exchange (kex) and user authentication (user-auth), ok: provos@ - [sshd.c] - no need for poll.h; from bright@wintelcom.net - disable agent fwding for proto 1.3, remove abuse of auth-rsa flags. - split key exchange (kex) and user authentication (user-auth), ok: provos@ - Big manpage and config file cleanup from Andre Lucas <andre.lucas@dial.pipex.com> - Re-added latest (unmodified) OpenBSD manpages - Doc updates - NetBSD patch from David Rankin <drankin@bohemians.lexington.ky.us> and Christos Zoulas <christos@netbsd.org> 20000119 - SCO compile fixes from Gary E. Miller <gem@rellim.com> - Compile fix from Darren_Hall@progressive.com - Linux/glibc-2.1.2 takes a *long* time to look up names for AF_UNSPEC addresses using getaddrinfo(). Added a configure switch to make the default lookup mode AF_INET 20000118 - Fixed --with-pid-dir option - Makefile fix from Gary E. Miller <gem@rellim.com> - Compile fix for HPUX and Solaris from Andre Lucas <andre.lucas@dial.pipex.com>
2000-01-27 18:12:02 +01:00
post-build:
@${SED} ${FILES_SUBST_SED} ${FILESDIR}/sshd.sh > ${WRKDIR}/sshd
2000-12-08 09:52:35 +01:00
Clean this up, sync with the ssh package, and update to 1.2.2 (fixing PR 9304 by David Rankin <drankin@bohemians.lexington.ky.us>. Changes: 20000125 - Fix NULL pointer dereference in login.c. Fix from Andre Lucas <andre.lucas@dial.pipex.com> - Reorder PAM initialisation so it does not mess up lastlog. Reported by Andre Lucas <andre.lucas@dial.pipex.com> - Use preformatted manpages on SCO, report from Gary E. Miller <gem@rellim.com> - New URL for x11-ssh-askpass. - Fixpaths was missing /etc/ssh_known_hosts. Report from Jim Knoble <jmknoble@pobox.com> - Added 'DESTDIR' option to Makefile to ease package building. Patch from Jim Knoble <jmknoble@pobox.com> - Updated RPM spec files to use DESTDIR 20000124 - Pick up version 1.2.2 from OpenBSD CVS (no changes, just version number increment) 20000123 - OpenBSD CVS: - [packet.c] getsockname() requires initialized tolen; andy@guildsoftware.com - AIX patch from Matt Richards <v2matt@btv.ibm.com> and David Rankin <drankin@bohemians.lexington.ky.us> - Fix lastlog support, patch from Andre Lucas <andre.lucas@dial.pipex.com> 20000122 - Fix compilation of bsd-snprintf.c on Solaris, fix from Ben Taylor <bent@clark.net> - Merge preformatted manpage patch from Andre Lucas <andre.lucas@dial.pipex.com> - Make IPv4 use the default in RPM packages - Irix uses preformatted manpages - Missing htons() in bsd-bindresvport.c, fix from Holger Trapp <Holger.Trapp@Informatik.TU-Chemnitz.DE> - OpenBSD CVS updates: - [packet.c] use getpeername() in packet_connection_is_on_socket(), fixes sshd -i; from Holger.Trapp@Informatik.TU-Chemnitz.DE - [sshd.c] log with level log() not fatal() if peer behaves badly. - [readpass.c] instead of blocking SIGINT, catch it ourselves, so that we can clean the tty modes up and kill ourselves -- instead of our process group leader (scp, cvs, ...) going away and leaving us in noecho mode. people with cbreak shells never even noticed.. - [ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh.1 sshd.8] ie. -> i.e., 20000120 - Don't use getaddrinfo on AIX - Update to latest OpenBSD CVS: - [auth-rsa.c] - fix user/1056, sshd keeps restrictions; dbt@meat.net - [sshconnect.c] - disable agent fwding for proto 1.3, remove abuse of auth-rsa flags. - destroy keys earlier - split key exchange (kex) and user authentication (user-auth), ok: provos@ - [sshd.c] - no need for poll.h; from bright@wintelcom.net - disable agent fwding for proto 1.3, remove abuse of auth-rsa flags. - split key exchange (kex) and user authentication (user-auth), ok: provos@ - [sshd.c] - no need for poll.h; from bright@wintelcom.net - disable agent fwding for proto 1.3, remove abuse of auth-rsa flags. - split key exchange (kex) and user authentication (user-auth), ok: provos@ - Big manpage and config file cleanup from Andre Lucas <andre.lucas@dial.pipex.com> - Re-added latest (unmodified) OpenBSD manpages - Doc updates - NetBSD patch from David Rankin <drankin@bohemians.lexington.ky.us> and Christos Zoulas <christos@netbsd.org> 20000119 - SCO compile fixes from Gary E. Miller <gem@rellim.com> - Compile fix from Darren_Hall@progressive.com - Linux/glibc-2.1.2 takes a *long* time to look up names for AF_UNSPEC addresses using getaddrinfo(). Added a configure switch to make the default lookup mode AF_INET 20000118 - Fixed --with-pid-dir option - Makefile fix from Gary E. Miller <gem@rellim.com> - Compile fix for HPUX and Solaris from Andre Lucas <andre.lucas@dial.pipex.com>
2000-01-27 18:12:02 +01:00
post-install:
${INSTALL_DATA_DIR} ${EGDIR}
cd ${WRKSRC}; for file in ${CONFS} ${SUPPS}; do \
${INSTALL_DATA} $${file}.out ${EGDIR}/$${file}; \
done
#.if defined(USE_PAM)
# ${INSTALL_DATA} ${WRKSRC}/contrib/sshd.pam.freebsd ${EGDIR}/sshd.pam
#.endif
${INSTALL_SCRIPT} ${WRKDIR}/sshd ${PREFIX}/${RCD_SCRIPTS_EGDIR}/sshd
.include "../../devel/zlib/buildlink.mk"
.include "../../security/openssl/buildlink.mk"
.include "../../security/tcp_wrappers/buildlink.mk"
.include "../../mk/bsd.pkg.install.mk"
.include "../../mk/bsd.pkg.mk"