commit: ea14a9d9fdb0bba0389580525358512d102a1bd7 Author: Patrick McLean <chutzpah <AT> gentoo <DOT> org> AuthorDate: Fri Sep 5 20:09:46 2025 +0000 Commit: Patrick McLean <chutzpah <AT> gentoo <DOT> org> CommitDate: Fri Sep 5 20:10:25 2025 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=ea14a9d9
net-misc/pkixssh: new package, add 17.0 Signed-off-by: Patrick McLean <chutzpah <AT> gentoo.org> net-misc/pkixssh/Manifest | 1 + ..._NORESERVE-in-sandbox-seccomp-filter-maps.patch | 44 +++ .../files/openssh-9.6_p1-fix-xmss-c99.patch | 20 ++ .../files/openssh-9.7_p1-config-tweaks.patch | 27 ++ .../pkixssh/files/pkixssh-17.0-no-rundir.patch | 12 + net-misc/pkixssh/files/ssh-agent.initd | 7 + net-misc/pkixssh/files/sshd-r1.confd | 33 ++ net-misc/pkixssh/files/sshd-r1.initd | 87 +++++ net-misc/pkixssh/files/sshd.pam_include.2 | 4 + net-misc/pkixssh/files/sshd.service.2 | 15 + net-misc/pkixssh/files/sshd.socket | 10 + net-misc/pkixssh/files/sshd_at.service.1 | 8 + net-misc/pkixssh/metadata.xml | 16 + net-misc/pkixssh/pkixssh-17.0.ebuild | 390 +++++++++++++++++++++ 14 files changed, 674 insertions(+) diff --git a/net-misc/pkixssh/Manifest b/net-misc/pkixssh/Manifest new file mode 100644 index 000000000000..72d513808722 --- /dev/null +++ b/net-misc/pkixssh/Manifest @@ -0,0 +1 @@ +DIST pkixssh-17.0.tar.xz 1278364 BLAKE2B 3d960862f12de6f01cc31d405f86414887e67dfe20398b0694f0df9f206a1194ee00426279f903bdcccf0c104b3225feb6e74e812548c2a9b8e64b43a85b6c86 SHA512 a933ce926d8953e2848a7b1e81326c7dea2ddaf3569c026ef8bb58164d4a420f8e5d271c84ec65ebc3d306e6b59e421235823577f84c18a2252fa8be855b00ac diff --git a/net-misc/pkixssh/files/openssh-9.4_p1-Allow-MAP_NORESERVE-in-sandbox-seccomp-filter-maps.patch b/net-misc/pkixssh/files/openssh-9.4_p1-Allow-MAP_NORESERVE-in-sandbox-seccomp-filter-maps.patch new file mode 100644 index 000000000000..379a3981d7ea --- /dev/null +++ b/net-misc/pkixssh/files/openssh-9.4_p1-Allow-MAP_NORESERVE-in-sandbox-seccomp-filter-maps.patch @@ -0,0 +1,44 @@ +From 45b491ce13fcf7dbc0b3bd6df986c9cf59190721 Mon Sep 17 00:00:00 2001 +From: Jordan R Abrahams-Whitehead <[email protected]> +Date: Tue, 12 Dec 2023 22:54:02 +0000 +Subject: [PATCH] Allow MAP_NORESERVE in sandbox seccomp filter maps + +While debugging Scudo on ChromeOS, we found that the no reserve mode +immediately crashed `sshd`. We tracked it down to the +sandbox-seccomp-filter. + +Being able to mmap with MAP_NORESERVE is useful (if not necessary) for +some overcommitting allocators. + +During mmap calls, the flag MAP_NORESERVE is used by some allocators +such as LLVM's Scudo for layout optimisation. This causes the sandbox +seccomp filter for the client subprocess to die with some Scudo +configurations. + +Upstream patch submission: +https://lists.mindrot.org/pipermail/openssh-unix-dev/2023-December/041095.html +--- + sandbox-seccomp-filter.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c +index 23b40b643..a49c5ca99 100644 +--- a/sandbox-seccomp-filter.c ++++ b/sandbox-seccomp-filter.c +@@ -190,9 +190,11 @@ + + #if defined(__NR_mmap) || defined(__NR_mmap2) + # ifdef MAP_FIXED_NOREPLACE +-# define SC_MMAP_FLAGS MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED|MAP_FIXED_NOREPLACE ++# define SC_MMAP_FLAGS MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED \ ++ |MAP_NORESERVE|MAP_FIXED_NOREPLACE + # else +-# define SC_MMAP_FLAGS MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED ++# define SC_MMAP_FLAGS MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED \ ++ |MAP_NORESERVE + # endif /* MAP_FIXED_NOREPLACE */ + /* Use this for both __NR_mmap and __NR_mmap2 variants */ + # define SC_MMAP(_nr) \ +-- +2.43.0.472.g3155946c3a-goog + diff --git a/net-misc/pkixssh/files/openssh-9.6_p1-fix-xmss-c99.patch b/net-misc/pkixssh/files/openssh-9.6_p1-fix-xmss-c99.patch new file mode 100644 index 000000000000..cf06b80cd5fa --- /dev/null +++ b/net-misc/pkixssh/files/openssh-9.6_p1-fix-xmss-c99.patch @@ -0,0 +1,20 @@ +xmss_hash.c: In function ‘core_hash_SHA2’: +xmss_hash.c:56:5: error: implicit declaration of function ‘SHA256’ [-Wimplicit-function-declaration] + 56 | SHA256(buf, inlen + keylen + n, out); + | ^~~~~~ +xmss_hash.c:61:7: error: implicit declaration of function ‘SHA512’ [-Wimplicit-function-declaration] + 61 | SHA512(buf, inlen + keylen + n, out); + | ^~~~~~ + +diff --git a/xmss_hash.c b/xmss_hash.c +index 70c126ae2..cb17de2af 100644 +--- a/xmss_hash.c ++++ b/xmss_hash.c +@@ -12,6 +12,7 @@ Public domain. + #include "xmss_hash_address.h" + #include "xmss_commons.h" + #include "xmss_hash.h" ++#include <openssl/sha.h> + + #include <stddef.h> + #ifdef HAVE_STDINT_H diff --git a/net-misc/pkixssh/files/openssh-9.7_p1-config-tweaks.patch b/net-misc/pkixssh/files/openssh-9.7_p1-config-tweaks.patch new file mode 100644 index 000000000000..229f7484cff5 --- /dev/null +++ b/net-misc/pkixssh/files/openssh-9.7_p1-config-tweaks.patch @@ -0,0 +1,27 @@ +diff -Naur a/ssh_config b/ssh_config +--- a/ssh_config 2024-03-11 05:20:49.000000000 +0000 ++++ b/ssh_config 2024-06-10 16:30:15.863023773 +0100 +@@ -13,6 +13,9 @@ + # Thus, host-specific definitions should be at the beginning of the + # configuration file, and defaults at the end. + ++# Make sure that all Host and Match options are below this Include! ++Include "/etc/ssh/ssh_config.d/*.conf" ++ + # Site-wide defaults for some commonly used options. For a comprehensive + # list of available options, their meanings and defaults, please see the + # ssh_config(5) man page. +diff -Naur a/sshd_config b/sshd_config +--- a/sshd_config 2024-06-10 16:19:01.530491925 +0100 ++++ b/sshd_config 2024-06-10 16:32:49.766386759 +0100 +@@ -105,8 +105,8 @@ + # no default banner path + #Banner none + +-# override default of no subsystems +-Subsystem sftp /usr/libexec/sftp-server ++# Make sure that all Match options are below this Include! ++Include "/etc/ssh/sshd_config.d/*.conf" + + # Example of overriding settings on a per-user basis + #Match User anoncvs diff --git a/net-misc/pkixssh/files/pkixssh-17.0-no-rundir.patch b/net-misc/pkixssh/files/pkixssh-17.0-no-rundir.patch new file mode 100644 index 000000000000..addfacf858f4 --- /dev/null +++ b/net-misc/pkixssh/files/pkixssh-17.0-no-rundir.patch @@ -0,0 +1,12 @@ +diff --git a/Makefile.in b/Makefile.in +index 850bcf00..6bbb16bc 100644 +--- a/Makefile.in ++++ b/Makefile.in +@@ -390,7 +390,6 @@ install-files: + $(MKDIR_P) $(DESTDIR)$(mandir)/$(mansubdir)8 + $(MKDIR_P) $(DESTDIR)$(libexecdir) + $(MKDIR_P) $(DESTDIR)$(sshcadir) +- $(MKDIR_P) $(DESTDIR)$(piddir) + $(MKDIR_P) -m 0755 $(DESTDIR)$(PRIVSEP_PATH) + $(INSTALL) -m 0755 $(STRIP_OPT) ssh$(EXEEXT) $(DESTDIR)$(bindir)/ssh$(EXEEXT) + $(INSTALL) -m 0755 $(STRIP_OPT) scp$(EXEEXT) $(DESTDIR)$(bindir)/scp$(EXEEXT) diff --git a/net-misc/pkixssh/files/ssh-agent.initd b/net-misc/pkixssh/files/ssh-agent.initd new file mode 100644 index 000000000000..49d3b125b83f --- /dev/null +++ b/net-misc/pkixssh/files/ssh-agent.initd @@ -0,0 +1,7 @@ +#!/sbin/openrc-run +# Copyright 1999-2025 Gentoo Authors +# Distributed under the terms of the GNU General Public License, v2 or later + +supervisor=supervise-daemon +command="/usr/bin/ssh-agent" +command_args="-D -a ${XDG_RUNTIME_DIR}/ssh-agent.sock" diff --git a/net-misc/pkixssh/files/sshd-r1.confd b/net-misc/pkixssh/files/sshd-r1.confd new file mode 100644 index 000000000000..cf430371bf0f --- /dev/null +++ b/net-misc/pkixssh/files/sshd-r1.confd @@ -0,0 +1,33 @@ +# /etc/conf.d/sshd: config file for /etc/init.d/sshd + +# Where is your sshd_config file stored? + +SSHD_CONFDIR="${RC_PREFIX%/}/etc/ssh" + + +# Any random options you want to pass to sshd. +# See the sshd(8) manpage for more info. + +SSHD_OPTS="" + + +# Wait one second (length chosen arbitrarily) to see if sshd actually +# creates a PID file, or if it crashes for some reason like not being +# able to bind to the address in ListenAddress. + +#SSHD_SSD_OPTS="--wait 1000" + + +# Pid file to use (needs to be absolute path). + +#SSHD_PIDFILE="${RC_PREFIX%/}/run/sshd.pid" + + +# Path to the sshd binary (needs to be absolute path). + +#SSHD_BINARY="${RC_PREFIX%/}/usr/sbin/sshd" + + +# Path to the ssh-keygen binary (needs to be absolute path). + +#SSHD_KEYGEN_BINARY="${RC_PREFIX%/}/usr/bin/ssh-keygen" diff --git a/net-misc/pkixssh/files/sshd-r1.initd b/net-misc/pkixssh/files/sshd-r1.initd new file mode 100644 index 000000000000..e91cd0116cd4 --- /dev/null +++ b/net-misc/pkixssh/files/sshd-r1.initd @@ -0,0 +1,87 @@ +#!/sbin/openrc-run +# Copyright 1999-2019 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +extra_commands="checkconfig" +extra_started_commands="reload" + +: ${SSHD_CONFDIR:=${RC_PREFIX%/}/etc/ssh} +: ${SSHD_CONFIG:=${SSHD_CONFDIR}/sshd_config} +: ${SSHD_PIDFILE:=${RC_PREFIX%/}/run/${SVCNAME}.pid} +: ${SSHD_BINARY:=${RC_PREFIX%/}/usr/sbin/sshd} +: ${SSHD_KEYGEN_BINARY:=${RC_PREFIX%/}/usr/bin/ssh-keygen} + +command="${SSHD_BINARY}" +pidfile="${SSHD_PIDFILE}" +command_args="${SSHD_OPTS} -o PidFile=${pidfile} -f ${SSHD_CONFIG}" + +# Wait one second (length chosen arbitrarily) to see if sshd actually +# creates a PID file, or if it crashes for some reason like not being +# able to bind to the address in ListenAddress (bug 617596). +: ${SSHD_SSD_OPTS:=--wait 1000} +start_stop_daemon_args="${SSHD_SSD_OPTS}" + +depend() { + # Entropy can be used by ssh-keygen, among other things, but + # is not strictly required (bug 470020). + use logger dns entropy + if [ "${rc_need+set}" = "set" ] ; then + : # Do nothing, the user has explicitly set rc_need + else + local x warn_addr + for x in $(awk '/^ListenAddress/{ print $2 }' "$SSHD_CONFIG" 2>/dev/null) ; do + case "${x}" in + 0.0.0.0|0.0.0.0:*) ;; + ::|\[::\]*) ;; + *) warn_addr="${warn_addr} ${x}" ;; + esac + done + if [ -n "${warn_addr}" ] ; then + need net + ewarn "You are binding an interface in ListenAddress statement in your sshd_config!" + ewarn "You must add rc_need=\"net.FOO\" to your ${RC_PREFIX%/}/etc/conf.d/sshd" + ewarn "where FOO is the interface(s) providing the following address(es):" + ewarn "${warn_addr}" + fi + fi +} + +checkconfig() { + checkpath --mode 0755 --directory "${RC_PREFIX%/}/var/empty" + + if [ ! -e "${SSHD_CONFIG}" ] ; then + eerror "You need an ${SSHD_CONFIG} file to run sshd" + eerror "There is a sample file in /usr/share/doc/openssh" + return 1 + fi + + ${SSHD_KEYGEN_BINARY} -A || return 2 + + "${command}" -t ${command_args} || return 3 +} + +start_pre() { + # Make sure that the user's config isn't busted before we try + # to start the daemon (this will produce better error messages + # than if we just try to start it blindly). + # + # We always need to call checkconfig because this function will + # also generate any missing host key and you can start a + # non-running service with "restart" argument. + checkconfig || return $? +} + +stop_pre() { + # If this is a restart, check to make sure the user's config + # isn't busted before we stop the running daemon. + if [ "${RC_CMD}" = "restart" ] ; then + checkconfig || return $? + fi +} + +reload() { + checkconfig || return $? + ebegin "Reloading ${SVCNAME}" + start-stop-daemon --signal HUP --pidfile "${pidfile}" + eend $? +} diff --git a/net-misc/pkixssh/files/sshd.pam_include.2 b/net-misc/pkixssh/files/sshd.pam_include.2 new file mode 100644 index 000000000000..b801aaafa0f9 --- /dev/null +++ b/net-misc/pkixssh/files/sshd.pam_include.2 @@ -0,0 +1,4 @@ +auth include system-remote-login +account include system-remote-login +password include system-remote-login +session include system-remote-login diff --git a/net-misc/pkixssh/files/sshd.service.2 b/net-misc/pkixssh/files/sshd.service.2 new file mode 100644 index 000000000000..d935ea763f0d --- /dev/null +++ b/net-misc/pkixssh/files/sshd.service.2 @@ -0,0 +1,15 @@ +[Unit] +Description=OpenSSH server daemon +After=network.target auditd.service + +[Service] +Type=notify-reload +ExecStartPre=/usr/bin/ssh-keygen -A +ExecStart=/usr/sbin/sshd -D -e +KillMode=process +OOMPolicy=continue +Restart=on-failure +RestartSec=42s + +[Install] +WantedBy=multi-user.target diff --git a/net-misc/pkixssh/files/sshd.socket b/net-misc/pkixssh/files/sshd.socket new file mode 100644 index 000000000000..94b9533180da --- /dev/null +++ b/net-misc/pkixssh/files/sshd.socket @@ -0,0 +1,10 @@ +[Unit] +Description=OpenSSH Server Socket +Conflicts=sshd.service + +[Socket] +ListenStream=22 +Accept=yes + +[Install] +WantedBy=sockets.target diff --git a/net-misc/pkixssh/files/sshd_at.service.1 b/net-misc/pkixssh/files/sshd_at.service.1 new file mode 100644 index 000000000000..e43a457994f4 --- /dev/null +++ b/net-misc/pkixssh/files/sshd_at.service.1 @@ -0,0 +1,8 @@ +[Unit] +Description=OpenSSH per-connection server daemon +After=auditd.service + +[Service] +ExecStart=-/usr/sbin/sshd -i -e +StandardInput=socket +StandardError=journal diff --git a/net-misc/pkixssh/metadata.xml b/net-misc/pkixssh/metadata.xml new file mode 100644 index 000000000000..96a22d0ca35b --- /dev/null +++ b/net-misc/pkixssh/metadata.xml @@ -0,0 +1,16 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd";> +<pkgmetadata> + <maintainer type="person"> + <email>[email protected]</email> + <name>Patrick McLean</name> + </maintainer> + <use> + <flag name="ldns">Use LDNS for DNSSEC/SSHFP validation.</flag> + <flag name="ssl-engine">Enable OpenSSL (hardware) ENGINE support</flag> + <flag name="xmss">Enable XMSS post-quantum authentication algorithm</flag> + </use> + <upstream> + <remote-id type="gitlab">secsh/pkixssh</remote-id> + </upstream> +</pkgmetadata> diff --git a/net-misc/pkixssh/pkixssh-17.0.ebuild b/net-misc/pkixssh/pkixssh-17.0.ebuild new file mode 100644 index 000000000000..4e6878e43ff2 --- /dev/null +++ b/net-misc/pkixssh/pkixssh-17.0.ebuild @@ -0,0 +1,390 @@ +# Copyright 1999-2025 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=8 + +# not sure how to get the signing keys for this yet, but upstream provides a signature +#VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/pkixssh.org.asc +#inherit user-info flag-o-matic autotools optfeature pam systemd toolchain-funcs verify-sig eapi9-ver +inherit user-info flag-o-matic autotools optfeature pam systemd toolchain-funcs eapi9-ver + +DESCRIPTION="OpenSSH fork with X.509 v3 certificate support" +HOMEPAGE="https://roumenpetrov.info/secsh/"; +SRC_URI=" + https://roumenpetrov.info/secsh/src/${P}.tar.xz +" +# verify-sig? ( https://roumenpetrov.info/secsh/src/${P}.tar.sig ) + +LICENSE="BSD GPL-2" +SLOT="0" +KEYWORDS="~amd64" +IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie selinux +ssl-engine static test xmss" + +RESTRICT="!test? ( test )" + +REQUIRED_USE=" + pie? ( !static ) + static? ( !kerberos !pam ) + test? ( ssl-engine ) +" + +# tests currently fail with XMSS +REQUIRED_USE+="test? ( !xmss )" + +LIB_DEPEND=" + audit? ( sys-process/audit[static-libs(+)] ) + ldns? ( + net-libs/ldns[static-libs(+)] + net-libs/ldns[ecdsa(+),ssl(+)] + ) + libedit? ( dev-libs/libedit:=[static-libs(+)] ) + selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] ) + >=dev-libs/openssl-1.1.1l-r1:0=[static-libs(+)] + virtual/libcrypt:=[static-libs(+)] + >=sys-libs/zlib-1.2.3:=[static-libs(+)] +" +RDEPEND=" + acct-group/sshd + acct-user/sshd + !static? ( ${LIB_DEPEND//\[static-libs(+)]} ) + pam? ( sys-libs/pam ) + kerberos? ( virtual/krb5 ) + !net-misc/openssh + !net-misc/openssh-contrib +" +DEPEND=" + ${RDEPEND} + virtual/os-headers + kernel_linux? ( !prefix-guest? ( >=sys-kernel/linux-headers-5.1 ) ) + static? ( ${LIB_DEPEND} ) +" +RDEPEND=" + ${RDEPEND} + !net-misc/openssh-contrib + pam? ( >=sys-auth/pambase-20081028 ) + !prefix? ( sys-apps/shadow ) +" +BDEPEND=" + dev-build/autoconf + virtual/pkgconfig +" +# verify-sig? ( sec-keys/openpgp-keys-pkixssh ) + +PATCHES=( + "${FILESDIR}/pkixssh-17.0-no-rundir.patch" + "${FILESDIR}/openssh-9.6_p1-fix-xmss-c99.patch" + "${FILESDIR}/openssh-9.7_p1-config-tweaks.patch" + # Backports from upstream release branch + #"${FILESDIR}/${PV}" + # Our own backports +) + +src_prepare() { + # don't break .ssh/authorized_keys2 for fun + sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die + + [[ -d ${WORKDIR}/patches ]] && PATCHES+=( "${WORKDIR}"/patches ) + + default + + # These tests are currently incompatible with PORTAGE_TMPDIR/sandbox + sed -e '/\t\tpercent \\/ d' \ + -i regress/Makefile || die + + tc-export PKG_CONFIG + local sed_args=( + -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):" + # Disable fortify flags ... our gcc does this for us + -e 's:-D_FORTIFY_SOURCE=2::' + ) + + # _XOPEN_SOURCE causes header conflicts on Solaris + [[ ${CHOST} == *-solaris* ]] && sed_args+=( + -e 's/-D_XOPEN_SOURCE//' + ) + sed -i "${sed_args[@]}" configure{.ac,} || die + + eautoreconf +} + +src_configure() { + addwrite /dev/ptmx + + use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG + use static && append-ldflags -static + use xmss && append-cflags -DWITH_XMSS + + if [[ ${CHOST} == *-solaris* ]] ; then + # Solaris' glob.h doesn't have things like GLOB_TILDE, configure + # doesn't check for this, so force the replacement to be put in + # place + append-cppflags -DBROKEN_GLOB + fi + + # use replacement, RPF_ECHO_ON doesn't exist here + [[ ${CHOST} == *-darwin* ]] && export ac_cv_func_readpassphrase=no + + local myconf=( + --with-ldflags="${LDFLAGS}" + --disable-strip + --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run + --sysconfdir="${EPREFIX}"/etc/ssh + --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc + --datadir="${EPREFIX}"/usr/share/openssh + --with-privsep-path="${EPREFIX}"/var/empty + --with-privsep-user=sshd + # optional at runtime; guarantee a known path + --with-xauth="${EPREFIX}"/usr/bin/xauth + + # --with-hardening adds the following in addition to flags we + # already set in our toolchain: + # * -ftrapv (which is broken with GCC anyway), + # * -ftrivial-auto-var-init=zero (which is nice, but not the end of + # the world to not have) + # * -fzero-call-used-regs=used (history of miscompilations with + # Clang (bug #872548), ICEs on m68k (bug #920350, gcc PR113086, + # gcc PR104820, gcc PR104817, gcc PR110934)). + # + # Furthermore, OSSH_CHECK_CFLAG_COMPILE does not use AC_CACHE_CHECK, + # so we cannot just disable -fzero-call-used-regs=used. + # + # Therefore, just pass --without-hardening, given it doesn't negate + # our already hardened toolchain defaults, and avoids adding flags + # which are known-broken in both Clang and GCC and haven't been + # proven reliable. + --without-hardening + + # wtmpdb not yet packaged + --without-wtmpdb + + $(use_with audit audit linux) + $(use_with kerberos kerberos5 "${EPREFIX}"/usr) + $(use_with ldns) + $(use_with libedit) + $(use_with pam) + $(use_with pie) + $(use_with selinux) + $(use_with ssl-engine ssl-engine) + ) + + if use elibc_musl; then + # musl defines bogus values for UTMP_FILE and WTMP_FILE (bug #753230) + myconf+=( --disable-utmp --disable-wtmp ) + fi + + econf "${myconf[@]}" +} + +create_config_dropins() { + local locale_vars=( + # These are language variables that POSIX defines. + # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02 + LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME + + # These are the GNU extensions. + # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html + LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE + ) + + mkdir -p "${WORKDIR}"/etc/ssh/ssh{,d}_config.d || die + + cat <<-EOF > "${WORKDIR}"/etc/ssh/ssh_config.d/9999999gentoo.conf || die + # Send locale environment variables (bug #367017) + SendEnv ${locale_vars[*]} + + # Send COLORTERM to match TERM (bug #658540) + SendEnv COLORTERM + EOF + + cat <<-EOF > "${WORKDIR}"/etc/ssh/ssh_config.d/9999999gentoo-security.conf || die + RevokedHostKeys "${EPREFIX}/etc/ssh/ssh_revoked_hosts" + EOF + + cat <<-EOF > "${WORKDIR}"/etc/ssh/ssh_revoked_hosts || die + # https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/ + ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ== + EOF + + cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo.conf || die + # Allow client to pass locale environment variables (bug #367017) + AcceptEnv ${locale_vars[*]} + + # Allow client to pass COLORTERM to match TERM (bug #658540) + AcceptEnv COLORTERM + EOF + + cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo-subsystem.conf || die + # override default of no subsystems + Subsystem sftp ${EPREFIX}/usr/$(get_libdir)/misc/sftp-server + EOF + + if use pam ; then + cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo-pam.conf || die + UsePAM yes + # This interferes with PAM. + PasswordAuthentication no + # PAM can do its own handling of MOTD. + PrintMotd no + PrintLastLog no + EOF + fi + + if use livecd ; then + cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo-livecd.conf || die + # Allow root login with password on livecds. + PermitRootLogin Yes + EOF + fi +} + +src_compile() { + default + create_config_dropins +} + +src_test() { + local tests=( compat-tests ) + local shell=$(egetshell "${UID}") + if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then + ewarn "Running the pkixssh testsuite requires a usable shell for the 'portage'" + ewarn "user, so we will skip testing" + return 0 + else + tests+=( tests ) + fi + + local -x SUDO= SSH_SK_PROVIDER= TEST_SSH_UNSAFE_PERMISSIONS=1 + mkdir -p "${HOME}"/.ssh || die + emake -j1 TEST_SHELL=/bin/bash "${tests[@]}" </dev/null +} + +src_install() { + emake install-nokeys DESTDIR="${D}" + fperms 600 /etc/ssh/sshd_config + dobin contrib/ssh-copy-id + newinitd "${FILESDIR}"/sshd-r1.initd sshd + newconfd "${FILESDIR}"/sshd-r1.confd sshd + exeinto /etc/user/init.d + newexe "${FILESDIR}"/ssh-agent.initd ssh-agent + + if use pam; then + newpamd "${FILESDIR}"/sshd.pam_include.2 sshd + fi + + doman contrib/ssh-copy-id.1 + dodoc CREDITS OVERVIEW README* TODO sshd_config + + rmdir "${ED}"/var/empty || die + + systemd_dounit "${FILESDIR}"/sshd.socket + systemd_newunit "${FILESDIR}"/sshd.service.2 sshd.service + systemd_newunit "${FILESDIR}"/sshd_at.service.1 '[email protected]' + + # Install dropins with explicit mode, bug 906638, 915840 + diropts -m0755 + insopts -m0644 + insinto /etc/ssh + doins -r "${WORKDIR}"/etc/ssh/ssh_config.d + doins "${WORKDIR}"/etc/ssh/ssh_revoked_hosts + diropts -m0700 + insopts -m0600 + doins -r "${WORKDIR}"/etc/ssh/sshd_config.d +} + +pkg_preinst() { + if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]"; then + show_ssl_warning=1 + fi +} + +pkg_postinst() { + # bug #139235 + optfeature "x11 forwarding" x11-apps/xauth + + if ver_replacing -lt "5.8_p1"; then + elog "Starting with openssh-5.8p1, the server will default to a newer key" + elog "algorithm (ECDSA). You are encouraged to manually update your stored" + elog "keys list as servers update theirs. See ssh-keyscan(1) for more info." + fi + if ver_replacing -lt "7.0_p1"; then + elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream." + elog "Make sure to update any configs that you might have. Note that xinetd might" + elog "be an alternative for you as it supports USE=tcpd." + fi + if ver_replacing -lt "7.1_p1"; then #557388 #555518 + elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their" + elog "weak sizes. If you rely on these key types, you can re-enable the key types by" + elog "adding to your sshd_config or ~/.ssh/config files:" + elog " PubkeyAcceptedKeyTypes=+ssh-dss" + elog "You should however generate new keys using rsa or ed25519." + + elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'" + elog "to 'prohibit-password'. That means password auth for root users no longer works" + elog "out of the box. If you need this, please update your sshd_config explicitly." + fi + if ver_replacing -lt "7.6_p1"; then + elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely." + elog "Furthermore, rsa keys with less than 1024 bits will be refused." + fi + if ver_replacing -lt "7.7_p1"; then + elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality." + elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option" + elog "if you need to authenticate against LDAP." + elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details." + fi + if ver_replacing -lt "8.2_p1"; then + ewarn "After upgrading to openssh-8.2p1 please restart sshd, otherwise you" + ewarn "will not be able to establish new sessions. Restarting sshd over a ssh" + ewarn "connection is generally safe." + fi + if ver_replacing -lt "9.2_p1-r1" && systemd_is_booted; then + ewarn "From openssh-9.2_p1-r1 the supplied systemd unit file defaults to" + ewarn "'Restart=on-failure', which causes the service to automatically restart if it" + ewarn "terminates with an unclean exit code or signal. This feature is useful for most users," + ewarn "but it can increase the vulnerability of the system in the event of a future exploit." + ewarn "If you have a web-facing setup or are concerned about security, it is recommended to" + ewarn "set 'Restart=no' in your sshd unit file." + fi + + if [[ -n ${show_ssl_warning} ]]; then + elog "Be aware that by disabling openssl support in openssh, the server and clients" + elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys" + elog "and update all clients/servers that utilize them." + fi + + openssh_maybe_restart +} + +openssh_maybe_restart() { + local ver + declare -a versions + read -ra versions <<<"${REPLACING_VERSIONS}" + for ver in "${versions[@]}"; do + # Exclude 9.8_p1 because it didn't have the safety check + [[ ${ver} == 9.8_p1 ]] && break + + if [[ ${ver%_*} == "${PV%_*}" ]]; then + # No major version change has occurred + return + fi + done + + if [[ ${ROOT} ]]; then + return + elif [[ -d /run/systemd/system ]] && sshd -t >/dev/null 2>&1; then + ewarn "The ebuild will now attempt to restart OpenSSH to avoid" + ewarn "bricking the running instance. See bug #709748." + ebegin "Attempting to restart openssh via 'systemctl try-restart sshd'" + systemctl try-restart sshd + eend $? + elif [[ -d /run/openrc ]]; then + # We don't check for sshd -t here because the OpenRC init script + # has a stop_pre() which does checkconfig, i.e. we defer to it + # to give nicer output for a failed sanity check. + ewarn "The ebuild will now attempt to restart OpenSSH to avoid" + ewarn "bricking the running instance. See bug #709748." + ebegin "Attempting to restart openssh via 'rc-service -q --ifstarted --nodeps sshd restart'" + rc-service -q --ifstarted --nodeps sshd restart + eend $? + fi +}
