net-misc/openssh/openssh-7.9_p1-r4.ebuild

   1 # Copyright 1999-2019 Gentoo Authors
   2 # Distributed under the terms of the GNU General Public License v2
   3
   4 EAPI=6
   5
   6 inherit user flag-o-matic multilib autotools pam systemd
   7
   8 # Make it more portable between straight releases
   9 # and _p? releases.
  10 PARCH=${P/_}
  11 #HPN_PV="${PV^^}"
  12 HPN_PV="7.8_P1"
  13
  14 HPN_VER="14.16"
  15 HPN_PATCHES=(
  16         ${PN}-${HPN_PV/./_}-hpn-DynWinNoneSwitch-${HPN_VER}.diff
  17         ${PN}-${HPN_PV/./_}-hpn-AES-CTR-${HPN_VER}.diff
  18 )
  19
  20 SCTP_VER="1.2" SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
  21 X509_VER="11.6" X509_PATCH="${PARCH}+x509-${X509_VER}.diff.gz"
  22
  23 PATCH_SET="openssh-7.9p1-patches-1.0"
  24
  25 DESCRIPTION="Port of OpenBSD's free SSH release"
  26 HOMEPAGE="https://www.openssh.com/"
  27 SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
  28         https://dev.gentoo.org/~whissi/dist/${PN}/${PATCH_SET}.tar.xz
  29         ${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~whissi/dist/openssh/${SCTP_PATCH} )}
  30         ${HPN_VER:+hpn? ( $(printf "mirror://sourceforge/hpnssh/HPN-SSH%%20${HPN_VER/./v}%%20${HPN_PV/_P/p}/%s\n" "${HPN_PATCHES[@]}") )}
  31         ${X509_PATCH:+X509? ( https://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
  32         "
  33
  34 LICENSE="BSD GPL-2"
  35 SLOT="0"
  36 KEYWORDS="alpha amd64 arm arm64 hppa ia64 m68k ~mips ppc ppc64 s390 sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
  37 # Probably want to drop ssl defaulting to on in a future version.
  38 IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509"
  39 RESTRICT="!test? ( test )"
  40 REQUIRED_USE="ldns? ( ssl )
  41         pie? ( !static )
  42         static? ( !kerberos !pam )
  43         X509? ( !sctp ssl )
  44         test? ( ssl )"
  45
  46 LIB_DEPEND="
  47         audit? ( sys-process/audit[static-libs(+)] )
  48         ldns? (
  49                 net-libs/ldns[static-libs(+)]
  50                 !bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
  51                 bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
  52         )
  53         libedit? ( dev-libs/libedit:=[static-libs(+)] )
  54         sctp? ( net-misc/lksctp-tools[static-libs(+)] )
  55         selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
  56         ssl? (
  57                 !libressl? (
  58                         || (
  59                                 (
  60                                         >=dev-libs/openssl-1.0.1:0[bindist=]
  61                                         <dev-libs/openssl-1.1.0:0[bindist=]
  62                                 )
  63                                 >=dev-libs/openssl-1.1.0g:0[bindist=]
  64                         )
  65                         dev-libs/openssl:0=[static-libs(+)]
  66                 )
  67                 libressl? ( dev-libs/libressl:0=[static-libs(+)] )
  68         )
  69         >=sys-libs/zlib-1.2.3:=[static-libs(+)]"
  70 RDEPEND="
  71         !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
  72         pam? ( sys-libs/pam )
  73         kerberos? ( virtual/krb5 )"
  74 DEPEND="${RDEPEND}
  75         static? ( ${LIB_DEPEND} )
  76         virtual/pkgconfig
  77         virtual/os-headers
  78         sys-devel/autoconf"
  79 RDEPEND="${RDEPEND}
  80         pam? ( >=sys-auth/pambase-20081028 )
  81         userland_GNU? ( virtual/shadow )
  82         X? ( x11-apps/xauth )"
  83
  84 S="${WORKDIR}/${PARCH}"
  85
  86 pkg_pretend() {
  87         # this sucks, but i'd rather have people unable to `emerge -u openssh`
  88         # than not be able to log in to their server any more
  89         maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
  90         local fail="
  91                 $(use hpn && maybe_fail hpn HPN_VER)
  92                 $(use sctp && maybe_fail sctp SCTP_PATCH)
  93                 $(use X509 && maybe_fail X509 X509_PATCH)
  94         "
  95         fail=$(echo ${fail})
  96         if [[ -n ${fail} ]] ; then
  97                 eerror "Sorry, but this version does not yet support features"
  98                 eerror "that you requested:      ${fail}"
  99                 eerror "Please mask ${PF} for now and check back later:"
 100                 eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
 101                 die "booooo"
 102         fi
 103
 104         # Make sure people who are using tcp wrappers are notified of its removal. #531156
 105         if grep -qs '^ *sshd *:' "${EROOT%/}"/etc/hosts.{allow,deny} ; then
 106                 ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
 107                 ewarn "you're trying to use it.  Update your ${EROOT}etc/hosts.{allow,deny} please."
 108         fi
 109 }
 110
 111 src_prepare() {
 112         sed -i \
 113                 -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX%/}/usr/bin/xauth:" \
 114                 pathnames.h || die
 115
 116         # don't break .ssh/authorized_keys2 for fun
 117         sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
 118
 119         eapply "${FILESDIR}"/${PN}-7.9_p1-openssl-1.0.2-compat.patch
 120         eapply "${FILESDIR}"/${PN}-7.9_p1-include-stdlib.patch
 121         eapply "${FILESDIR}"/${PN}-7.8_p1-GSSAPI-dns.patch #165444 integrated into gsskex
 122         eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
 123         eapply "${FILESDIR}"/${PN}-7.5_p1-disable-conch-interop-tests.patch
 124
 125         if use X509 ; then
 126                 # patch doesn't apply due to X509 modifications
 127                 rm \
 128                         "${WORKDIR}"/patches/0001-fix-key-type-check.patch \
 129                         "${WORKDIR}"/patches/0002-request-rsa-sha2-cert-signatures.patch \
 130                         || die
 131         else
 132                 eapply "${FILESDIR}"/${PN}-7.9_p1-CVE-2018-20685.patch # X509 patch set includes this patch
 133         fi
 134
 135         [[ -d ${WORKDIR}/patches ]] && eapply "${WORKDIR}"/patches
 136
 137         local PATCHSET_VERSION_MACROS=()
 138
 139         if use X509 ; then
 140                 pushd "${WORKDIR}" || die
 141                 eapply "${FILESDIR}/${P}-X509-glue-${X509_VER}.patch"
 142                 eapply "${FILESDIR}/${P}-X509-dont-make-piddir-${X509_VER}.patch"
 143                 popd || die
 144
 145                 if use hpn ; then
 146                         einfo "Will disable MT AES cipher due to incompatbility caused by X509 patch set"
 147                         HPN_DISABLE_MTAES=1
 148                 fi
 149
 150                 eapply "${WORKDIR}"/${X509_PATCH%.*}
 151                 eapply "${FILESDIR}"/${P}-X509-${X509_VER}-tests.patch
 152
 153                 # We need to patch package version or any X.509 sshd will reject our ssh client
 154                 # with "userauth_pubkey: could not parse key: string is too large [preauth]"
 155                 # error
 156                 einfo "Patching package version for X.509 patch set ..."
 157                 sed -i \
 158                         -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
 159                         "${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
 160
 161                 einfo "Patching version.h to expose X.509 patch set ..."
 162                 sed -i \
 163                         -e "/^#define SSH_PORTABLE.*/a #define SSH_X509               \"-PKIXSSH-${X509_VER}\"" \
 164                         "${S}"/version.h || die "Failed to sed-in X.509 patch version"
 165                 PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
 166         fi
 167
 168         if use sctp ; then
 169                 eapply "${WORKDIR}"/${SCTP_PATCH%.*}
 170
 171                 einfo "Patching version.h to expose SCTP patch set ..."
 172                 sed -i \
 173                         -e "/^#define SSH_PORTABLE/a #define SSH_SCTP        \"-sctp-${SCTP_VER}\"" \
 174                         "${S}"/version.h || die "Failed to sed-in SCTP patch version"
 175                 PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' )
 176
 177                 einfo "Disabling know failing test (cfgparse) caused by SCTP patch ..."
 178                 sed -i \
 179                         -e "/\t\tcfgparse \\\/d" \
 180                         "${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch"
 181         fi
 182
 183         if use hpn ; then
 184                 local hpn_patchdir="${T}/${P}-hpn${HPN_VER}"
 185                 mkdir "${hpn_patchdir}"
 186                 cp $(printf -- "${DISTDIR}/%s\n" "${HPN_PATCHES[@]}") "${hpn_patchdir}"
 187                 pushd "${hpn_patchdir}"
 188                 eapply "${FILESDIR}"/${P}-hpn-glue.patch
 189                 use X509 && eapply "${FILESDIR}"/${P}-hpn-X509-glue.patch
 190                 use sctp && eapply "${FILESDIR}"/${P}-hpn-sctp-glue.patch
 191                 popd
 192
 193                 eapply "${hpn_patchdir}"
 194                 eapply "${FILESDIR}/openssh-7.9_p1-hpn-openssl-1.1.patch"
 195
 196                 einfo "Patching Makefile.in for HPN patch set ..."
 197                 sed -i \
 198                         -e "/^LIBS=/ s/\$/ -lpthread/" \
 199                         "${S}"/Makefile.in || die "Failed to patch Makefile.in"
 200
 201                 einfo "Patching version.h to expose HPN patch set ..."
 202                 sed -i \
 203                         -e "/^#define SSH_PORTABLE/a #define SSH_HPN         \"-hpn${HPN_VER//./v}\"" \
 204                         "${S}"/version.h || die "Failed to sed-in HPN patch version"
 205                 PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
 206
 207                 if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
 208                         einfo "Disabling known non-working MT AES cipher per default ..."
 209
 210                         cat > "${T}"/disable_mtaes.conf <<- EOF
 211
 212                         # HPN's Multi-Threaded AES CTR cipher is currently known to be broken
 213                         # and therefore disabled per default.
 214                         DisableMTAES yes
 215                         EOF
 216                         sed -i \
 217                                 -e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \
 218                                 "${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config"
 219
 220                         sed -i \
 221                                 -e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \
 222                                 "${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config"
 223                 fi
 224         fi
 225
 226         if use X509 || use sctp || use hpn ; then
 227                 einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
 228                 sed -i \
 229                         -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
 230                         "${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)"
 231
 232                 einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..."
 233                 sed -i \
 234                         -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
 235                         "${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)"
 236
 237                 einfo "Patching version.h to add our patch sets to SSH_RELEASE ..."
 238                 sed -i \
 239                         -e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE     SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \
 240                         "${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
 241         fi
 242
 243         sed -i \
 244                 -e "/#UseLogin no/d" \
 245                 "${S}"/sshd_config || die "Failed to remove removed UseLogin option (sshd_config)"
 246
 247         eapply_user #473004
 248
 249         tc-export PKG_CONFIG
 250         local sed_args=(
 251                 -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
 252                 # Disable PATH reset, trust what portage gives us #254615
 253                 -e 's:^PATH=/:#PATH=/:'
 254                 # Disable fortify flags ... our gcc does this for us
 255                 -e 's:-D_FORTIFY_SOURCE=2::'
 256         )
 257
 258         # The -ftrapv flag ICEs on hppa #505182
 259         use hppa && sed_args+=(
 260                 -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
 261                 -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
 262         )
 263         # _XOPEN_SOURCE causes header conflicts on Solaris
 264         [[ ${CHOST} == *-solaris* ]] && sed_args+=(
 265                 -e 's/-D_XOPEN_SOURCE//'
 266         )
 267         sed -i "${sed_args[@]}" configure{.ac,} || die
 268
 269         eautoreconf
 270 }
 271
 272 src_configure() {
 273         addwrite /dev/ptmx
 274
 275         use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
 276         use static && append-ldflags -static
 277
 278         local myconf=(
 279                 --with-ldflags="${LDFLAGS}"
 280                 --disable-strip
 281                 --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
 282                 --sysconfdir="${EPREFIX%/}"/etc/ssh
 283                 --libexecdir="${EPREFIX%/}"/usr/$(get_libdir)/misc
 284                 --datadir="${EPREFIX%/}"/usr/share/openssh
 285                 --with-privsep-path="${EPREFIX%/}"/var/empty
 286                 --with-privsep-user=sshd
 287                 $(use_with audit audit linux)
 288                 $(use_with kerberos kerberos5 "${EPREFIX%/}"/usr)
 289                 # We apply the sctp patch conditionally, so can't pass --without-sctp
 290                 # unconditionally else we get unknown flag warnings.
 291                 $(use sctp && use_with sctp)
 292                 $(use_with ldns ldns "${EPREFIX%/}"/usr)
 293                 $(use_with libedit)
 294                 $(use_with pam)
 295                 $(use_with pie)
 296                 $(use_with selinux)
 297                 $(use_with ssl openssl)
 298                 $(use_with ssl md5-passwords)
 299                 $(use_with ssl ssl-engine)
 300                 $(use_with !elibc_Cygwin hardening) #659210
 301         )
 302
 303         # stackprotect is broken on musl x86 and ppc
 304         use elibc_musl && ( use x86 || use ppc ) && myconf+=( --without-stackprotect )
 305
 306         # The seccomp sandbox is broken on x32, so use the older method for now. #553748
 307         use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
 308
 309         econf "${myconf[@]}"
 310 }
 311
 312 src_test() {
 313         local t skipped=() failed=() passed=()
 314         local tests=( interop-tests compat-tests )
 315
 316         local shell=$(egetshell "${UID}")
 317         if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
 318                 elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
 319                 elog "user, so we will run a subset only."
 320                 skipped+=( tests )
 321         else
 322                 tests+=( tests )
 323         fi
 324
 325         # It will also attempt to write to the homedir .ssh.
 326         local sshhome=${T}/homedir
 327         mkdir -p "${sshhome}"/.ssh
 328         for t in "${tests[@]}" ; do
 329                 # Some tests read from stdin ...
 330                 HOMEDIR="${sshhome}" HOME="${sshhome}" \
 331                 emake -k -j1 ${t} </dev/null \
 332                         && passed+=( "${t}" ) \
 333                         || failed+=( "${t}" )
 334         done
 335
 336         einfo "Passed tests: ${passed[*]}"
 337         [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
 338         [[ ${#failed[@]}  -gt 0 ]] && die "Some tests failed: ${failed[*]}"
 339 }
 340
 341 # Gentoo tweaks to default config files.
 342 tweak_ssh_configs() {
 343         local locale_vars=(
 344                 # These are language variables that POSIX defines.
 345                 # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
 346                 LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
 347
 348                 # These are the GNU extensions.
 349                 # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
 350                 LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
 351         )
 352
 353         # First the server config.
 354         cat <<-EOF >> "${ED%/}"/etc/ssh/sshd_config
 355
 356         # Allow client to pass locale environment variables. #367017
 357         AcceptEnv ${locale_vars[*]}
 358
 359         # Allow client to pass COLORTERM to match TERM. #658540
 360         AcceptEnv COLORTERM
 361         EOF
 362
 363         # Then the client config.
 364         cat <<-EOF >> "${ED%/}"/etc/ssh/ssh_config
 365
 366         # Send locale environment variables. #367017
 367         SendEnv ${locale_vars[*]}
 368
 369         # Send COLORTERM to match TERM. #658540
 370         SendEnv COLORTERM
 371         EOF
 372
 373         if use pam ; then
 374                 sed -i \
 375                         -e "/^#UsePAM /s:.*:UsePAM yes:" \
 376                         -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
 377                         -e "/^#PrintMotd /s:.*:PrintMotd no:" \
 378                         -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
 379                         "${ED%/}"/etc/ssh/sshd_config || die
 380         fi
 381
 382         if use livecd ; then
 383                 sed -i \
 384                         -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
 385                         "${ED%/}"/etc/ssh/sshd_config || die
 386         fi
 387 }
 388
 389 src_install() {
 390         emake install-nokeys DESTDIR="${D}"
 391         fperms 600 /etc/ssh/sshd_config
 392         dobin contrib/ssh-copy-id
 393         newinitd "${FILESDIR}"/sshd-r1.initd sshd
 394         newconfd "${FILESDIR}"/sshd-r1.confd sshd
 395
 396         newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
 397
 398         tweak_ssh_configs
 399
 400         doman contrib/ssh-copy-id.1
 401         dodoc CREDITS OVERVIEW README* TODO sshd_config
 402         use hpn && dodoc HPN-README
 403         use X509 || dodoc ChangeLog
 404
 405         diropts -m 0700
 406         dodir /etc/skel/.ssh
 407
 408         keepdir /var/empty
 409
 410         systemd_dounit "${FILESDIR}"/sshd.{service,socket}
 411         systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
 412 }
 413
 414 pkg_preinst() {
 415         enewgroup sshd 22
 416         enewuser sshd 22 -1 /var/empty sshd
 417 }
 418
 419 pkg_postinst() {
 420         if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
 421                 elog "Starting with openssh-5.8p1, the server will default to a newer key"
 422                 elog "algorithm (ECDSA).  You are encouraged to manually update your stored"
 423                 elog "keys list as servers update theirs.  See ssh-keyscan(1) for more info."
 424         fi
 425         if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
 426                 elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
 427                 elog "Make sure to update any configs that you might have.  Note that xinetd might"
 428                 elog "be an alternative for you as it supports USE=tcpd."
 429         fi
 430         if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
 431                 elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
 432                 elog "weak sizes.  If you rely on these key types, you can re-enable the key types by"
 433                 elog "adding to your sshd_config or ~/.ssh/config files:"
 434                 elog "  PubkeyAcceptedKeyTypes=+ssh-dss"
 435                 elog "You should however generate new keys using rsa or ed25519."
 436
 437                 elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
 438                 elog "to 'prohibit-password'.  That means password auth for root users no longer works"
 439                 elog "out of the box.  If you need this, please update your sshd_config explicitly."
 440         fi
 441         if has_version "<${CATEGORY}/${PN}-7.6_p1" ; then
 442                 elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
 443                 elog "Furthermore, rsa keys with less than 1024 bits will be refused."
 444         fi
 445         if has_version "<${CATEGORY}/${PN}-7.7_p1" ; then
 446                 elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
 447                 elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
 448                 elog "if you need to authenticate against LDAP."
 449                 elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
 450         fi
 451         if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
 452                 elog "Be aware that by disabling openssl support in openssh, the server and clients"
 453                 elog "no longer support dss/rsa/ecdsa keys.  You will need to generate ed25519 keys"
 454                 elog "and update all clients/servers that utilize them."
 455         fi
 456
 457         if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
 458                 elog ""
 459                 elog "HPN's multi-threaded AES CTR cipher is currently known to be broken"
 460                 elog "and therefore disabled at runtime per default."
 461                 elog "Make sure your sshd_config is up to date and contains"
 462                 elog ""
 463                 elog "  DisableMTAES yes"
 464                 elog ""
 465                 elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
 466                 elog ""
 467         fi
 468 }