net-misc/openssh/openssh-8.1_p1-r3.ebuild

   1 # Copyright 1999-2020 Gentoo Authors
   2 # Distributed under the terms of the GNU General Public License v2
   3
   4 EAPI=7
   5
   6 inherit user-info flag-o-matic multilib autotools pam systemd toolchain-funcs
   7
   8 # Make it more portable between straight releases
   9 # and _p? releases.
  10 PARCH=${P/_}
  11 HPN_PV="${PV^^}"
  12
  13 HPN_VER="14.20"
  14 HPN_PATCHES=(
  15         ${PN}-${HPN_PV/./_}-hpn-DynWinNoneSwitch-${HPN_VER}.diff
  16         ${PN}-${HPN_PV/./_}-hpn-AES-CTR-${HPN_VER}.diff
  17         ${PN}-${HPN_PV/./_}-hpn-PeakTput-${HPN_VER}.diff
  18 )
  19
  20 SCTP_VER="1.2" SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
  21 X509_VER="12.3" X509_PATCH="${PARCH}+x509-${X509_VER}.diff.gz"
  22
  23 PATCH_SET="openssh-7.9p1-patches-1.0"
  24
  25 DESCRIPTION="Port of OpenBSD's free SSH release"
  26 HOMEPAGE="https://www.openssh.com/"
  27 SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
  28         https://dev.gentoo.org/~chutzpah/dist/openssh/${P}-glibc-2.31-patches.tar.xz
  29         ${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~chutzpah/dist/openssh/${SCTP_PATCH} )}
  30         ${HPN_VER:+hpn? ( $(printf "mirror://sourceforge/hpnssh/HPN-SSH%%20${HPN_VER/./v}%%20${HPN_PV/_P/p}/%s\n" "${HPN_PATCHES[@]}") )}
  31         ${X509_PATCH:+X509? ( https://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
  32 "
  33 S="${WORKDIR}/${PARCH}"
  34
  35 LICENSE="BSD GPL-2"
  36 SLOT="0"
  37 KEYWORDS="~alpha amd64 arm ~arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv s390 sparc x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
  38 # Probably want to drop ssl defaulting to on in a future version.
  39 IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509 xmss"
  40
  41 RESTRICT="!test? ( test )"
  42
  43 REQUIRED_USE="
  44         ldns? ( ssl )
  45         pie? ( !static )
  46         static? ( !kerberos !pam )
  47         X509? ( !sctp ssl )
  48         test? ( ssl )
  49 "
  50
  51 LIB_DEPEND="
  52         audit? ( sys-process/audit[static-libs(+)] )
  53         ldns? (
  54                 net-libs/ldns[static-libs(+)]
  55                 !bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
  56                 bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
  57         )
  58         libedit? ( dev-libs/libedit:=[static-libs(+)] )
  59         sctp? ( net-misc/lksctp-tools[static-libs(+)] )
  60         selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
  61         ssl? (
  62                 !libressl? (
  63                         || (
  64                                 (
  65                                         >=dev-libs/openssl-1.0.1:0[bindist=]
  66                                         <dev-libs/openssl-1.1.0:0[bindist=]
  67                                 )
  68                                 >=dev-libs/openssl-1.1.0g:0[bindist=]
  69                         )
  70                         dev-libs/openssl:0=[static-libs(+)]
  71                 )
  72                 libressl? ( dev-libs/libressl:0=[static-libs(+)] )
  73         )
  74         virtual/libcrypt:=[static-libs(+)]
  75         >=sys-libs/zlib-1.2.3:=[static-libs(+)]
  76 "
  77 RDEPEND="
  78         acct-group/sshd
  79         acct-user/sshd
  80         !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
  81         pam? ( sys-libs/pam )
  82         kerberos? ( virtual/krb5 )
  83 "
  84 DEPEND="${RDEPEND}
  85         static? ( ${LIB_DEPEND} )
  86         virtual/os-headers
  87 "
  88 RDEPEND="${RDEPEND}
  89         pam? ( >=sys-auth/pambase-20081028 )
  90         userland_GNU? ( !prefix? ( sys-apps/shadow ) )
  91         X? ( x11-apps/xauth )
  92 "
  93 BDEPEND="
  94         virtual/pkgconfig
  95         sys-devel/autoconf
  96 "
  97
  98 pkg_pretend() {
  99         # this sucks, but i'd rather have people unable to `emerge -u openssh`
 100         # than not be able to log in to their server any more
 101         maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
 102         local fail="
 103                 $(use hpn && maybe_fail hpn HPN_VER)
 104                 $(use sctp && maybe_fail sctp SCTP_PATCH)
 105                 $(use X509 && maybe_fail X509 X509_PATCH)
 106         "
 107         fail=$(echo ${fail})
 108         if [[ -n ${fail} ]] ; then
 109                 eerror "Sorry, but this version does not yet support features"
 110                 eerror "that you requested:      ${fail}"
 111                 eerror "Please mask ${PF} for now and check back later:"
 112                 eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
 113                 die "booooo"
 114         fi
 115
 116         # Make sure people who are using tcp wrappers are notified of its removal. #531156
 117         if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
 118                 ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
 119                 ewarn "you're trying to use it.  Update your ${EROOT}/etc/hosts.{allow,deny} please."
 120         fi
 121 }
 122
 123 src_prepare() {
 124         sed -i \
 125                 -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
 126                 pathnames.h || die
 127
 128         # don't break .ssh/authorized_keys2 for fun
 129         sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
 130
 131         eapply "${FILESDIR}"/${PN}-7.9_p1-include-stdlib.patch
 132         eapply "${FILESDIR}"/${PN}-8.1_p1-GSSAPI-dns.patch #165444 integrated into gsskex
 133         eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
 134         eapply "${FILESDIR}"/${PN}-7.5_p1-disable-conch-interop-tests.patch
 135         eapply "${FILESDIR}"/${PN}-8.0_p1-fix-putty-tests.patch
 136         eapply "${FILESDIR}"/${PN}-8.0_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch
 137         eapply "${FILESDIR}"/${PN}-8.1_p1-tests-2020.patch
 138
 139         [[ -d ${WORKDIR}/patches ]] && eapply "${WORKDIR}"/patches
 140
 141         local PATCHSET_VERSION_MACROS=()
 142
 143         if use X509 ; then
 144                 pushd "${WORKDIR}" &>/dev/null || die
 145                 eapply "${FILESDIR}/${P}-X509-glue-"${X509_VER}".patch"
 146                 popd &>/dev/null || die
 147
 148                 eapply "${WORKDIR}"/${X509_PATCH%.*}
 149                 eapply "${FILESDIR}"/${P}-X509-$(ver_cut 1-2 ${X509_VER})-tests.patch
 150
 151                 # We need to patch package version or any X.509 sshd will reject our ssh client
 152                 # with "userauth_pubkey: could not parse key: string is too large [preauth]"
 153                 # error
 154                 einfo "Patching package version for X.509 patch set ..."
 155                 sed -i \
 156                         -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
 157                         "${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
 158
 159                 einfo "Patching version.h to expose X.509 patch set ..."
 160                 sed -i \
 161                         -e "/^#define SSH_PORTABLE.*/a #define SSH_X509               \"-PKIXSSH-${X509_VER}\"" \
 162                         "${S}"/version.h || die "Failed to sed-in X.509 patch version"
 163                 PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
 164         fi
 165
 166         if use sctp ; then
 167                 eapply "${WORKDIR}"/${SCTP_PATCH%.*}
 168
 169                 einfo "Patching version.h to expose SCTP patch set ..."
 170                 sed -i \
 171                         -e "/^#define SSH_PORTABLE/a #define SSH_SCTP        \"-sctp-${SCTP_VER}\"" \
 172                         "${S}"/version.h || die "Failed to sed-in SCTP patch version"
 173                 PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' )
 174
 175                 einfo "Disabling know failing test (cfgparse) caused by SCTP patch ..."
 176                 sed -i \
 177                         -e "/\t\tcfgparse \\\/d" \
 178                         "${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch"
 179         fi
 180
 181         if use hpn ; then
 182                 local hpn_patchdir="${T}/${P}-hpn${HPN_VER}"
 183                 mkdir "${hpn_patchdir}" || die
 184                 cp $(printf -- "${DISTDIR}/%s\n" "${HPN_PATCHES[@]}") "${hpn_patchdir}" || die
 185                 pushd "${hpn_patchdir}" &>/dev/null || die
 186                 eapply "${FILESDIR}"/${PN}-8.1_p1-hpn-${HPN_VER}-glue.patch
 187                 if use X509; then
 188                 #       einfo "Will disable MT AES cipher due to incompatbility caused by X509 patch set"
 189                 #       # X509 and AES-CTR-MT don't get along, let's just drop it
 190                 #       rm openssh-${HPN_PV//./_}-hpn-AES-CTR-${HPN_VER}.diff || die
 191                         eapply "${FILESDIR}"/${PN}-8.0_p1-hpn-${HPN_VER}-X509-glue.patch
 192                 fi
 193                 use sctp && eapply "${FILESDIR}"/${PN}-8.1_p1-hpn-${HPN_VER}-sctp-glue.patch
 194                 popd &>/dev/null || die
 195
 196                 eapply "${hpn_patchdir}"
 197
 198                 use X509 || eapply "${FILESDIR}/openssh-8.0_p1-hpn-version.patch"
 199
 200                 einfo "Patching Makefile.in for HPN patch set ..."
 201                 sed -i \
 202                         -e "/^LIBS=/ s/\$/ -lpthread/" \
 203                         "${S}"/Makefile.in || die "Failed to patch Makefile.in"
 204
 205                 einfo "Patching version.h to expose HPN patch set ..."
 206                 sed -i \
 207                         -e "/^#define SSH_PORTABLE/a #define SSH_HPN         \"-hpn${HPN_VER//./v}\"" \
 208                         "${S}"/version.h || die "Failed to sed-in HPN patch version"
 209                 PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
 210
 211                 if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
 212                         einfo "Disabling known non-working MT AES cipher per default ..."
 213
 214                         cat > "${T}"/disable_mtaes.conf <<- EOF
 215
 216                         # HPN's Multi-Threaded AES CTR cipher is currently known to be broken
 217                         # and therefore disabled per default.
 218                         DisableMTAES yes
 219                         EOF
 220                         sed -i \
 221                                 -e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \
 222                                 "${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config"
 223
 224                         sed -i \
 225                                 -e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \
 226                                 "${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config"
 227                 fi
 228         fi
 229
 230         if use X509 || use sctp || use hpn ; then
 231                 einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
 232                 sed -i \
 233                         -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
 234                         "${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)"
 235
 236                 einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..."
 237                 sed -i \
 238                         -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
 239                         "${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)"
 240
 241                 einfo "Patching version.h to add our patch sets to SSH_RELEASE ..."
 242                 sed -i \
 243                         -e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE     SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \
 244                         "${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
 245         fi
 246
 247         sed -i \
 248                 -e "/#UseLogin no/d" \
 249                 "${S}"/sshd_config || die "Failed to remove removed UseLogin option (sshd_config)"
 250
 251         eapply_user #473004
 252
 253         tc-export PKG_CONFIG
 254         local sed_args=(
 255                 -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
 256                 # Disable PATH reset, trust what portage gives us #254615
 257                 -e 's:^PATH=/:#PATH=/:'
 258                 # Disable fortify flags ... our gcc does this for us
 259                 -e 's:-D_FORTIFY_SOURCE=2::'
 260         )
 261
 262         # The -ftrapv flag ICEs on hppa #505182
 263         use hppa && sed_args+=(
 264                 -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
 265                 -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
 266         )
 267         # _XOPEN_SOURCE causes header conflicts on Solaris
 268         [[ ${CHOST} == *-solaris* ]] && sed_args+=(
 269                 -e 's/-D_XOPEN_SOURCE//'
 270         )
 271         sed -i "${sed_args[@]}" configure{.ac,} || die
 272
 273         eautoreconf
 274 }
 275
 276 src_configure() {
 277         addwrite /dev/ptmx
 278
 279         use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
 280         use static && append-ldflags -static
 281         use xmss && append-cflags -DWITH_XMSS
 282
 283         local myconf=(
 284                 --with-ldflags="${LDFLAGS}"
 285                 --disable-strip
 286                 --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
 287                 --sysconfdir="${EPREFIX}"/etc/ssh
 288                 --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
 289                 --datadir="${EPREFIX}"/usr/share/openssh
 290                 --with-privsep-path="${EPREFIX}"/var/empty
 291                 --with-privsep-user=sshd
 292                 $(use_with audit audit linux)
 293                 $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
 294                 # We apply the sctp patch conditionally, so can't pass --without-sctp
 295                 # unconditionally else we get unknown flag warnings.
 296                 $(use sctp && use_with sctp)
 297                 $(use_with ldns ldns "${EPREFIX}"/usr)
 298                 $(use_with libedit)
 299                 $(use_with pam)
 300                 $(use_with pie)
 301                 $(use_with selinux)
 302                 $(use_with ssl openssl)
 303                 $(use_with ssl md5-passwords)
 304                 $(use_with ssl ssl-engine)
 305                 $(use_with !elibc_Cygwin hardening) #659210
 306         )
 307
 308         # stackprotect is broken on musl x86 and ppc
 309         use elibc_musl && ( use x86 || use ppc ) && myconf+=( --without-stackprotect )
 310
 311         # The seccomp sandbox is broken on x32, so use the older method for now. #553748
 312         use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
 313
 314         econf "${myconf[@]}"
 315 }
 316
 317 src_test() {
 318         local t skipped=() failed=() passed=()
 319         local tests=( interop-tests compat-tests )
 320
 321         local shell=$(egetshell "${UID}")
 322         if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
 323                 elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
 324                 elog "user, so we will run a subset only."
 325                 skipped+=( tests )
 326         else
 327                 tests+=( tests )
 328         fi
 329
 330         # It will also attempt to write to the homedir .ssh.
 331         local sshhome=${T}/homedir
 332         mkdir -p "${sshhome}"/.ssh
 333         for t in "${tests[@]}" ; do
 334                 # Some tests read from stdin ...
 335                 HOMEDIR="${sshhome}" HOME="${sshhome}" SUDO="" \
 336                 emake -k -j1 ${t} </dev/null \
 337                         && passed+=( "${t}" ) \
 338                         || failed+=( "${t}" )
 339         done
 340
 341         einfo "Passed tests: ${passed[*]}"
 342         [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
 343         [[ ${#failed[@]}  -gt 0 ]] && die "Some tests failed: ${failed[*]}"
 344 }
 345
 346 # Gentoo tweaks to default config files.
 347 tweak_ssh_configs() {
 348         local locale_vars=(
 349                 # These are language variables that POSIX defines.
 350                 # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
 351                 LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
 352
 353                 # These are the GNU extensions.
 354                 # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
 355                 LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
 356         )
 357
 358         # First the server config.
 359         cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
 360
 361         # Allow client to pass locale environment variables. #367017
 362         AcceptEnv ${locale_vars[*]}
 363
 364         # Allow client to pass COLORTERM to match TERM. #658540
 365         AcceptEnv COLORTERM
 366         EOF
 367
 368         # Then the client config.
 369         cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
 370
 371         # Send locale environment variables. #367017
 372         SendEnv ${locale_vars[*]}
 373
 374         # Send COLORTERM to match TERM. #658540
 375         SendEnv COLORTERM
 376         EOF
 377
 378         if use pam ; then
 379                 sed -i \
 380                         -e "/^#UsePAM /s:.*:UsePAM yes:" \
 381                         -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
 382                         -e "/^#PrintMotd /s:.*:PrintMotd no:" \
 383                         -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
 384                         "${ED}"/etc/ssh/sshd_config || die
 385         fi
 386
 387         if use livecd ; then
 388                 sed -i \
 389                         -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
 390                         "${ED}"/etc/ssh/sshd_config || die
 391         fi
 392 }
 393
 394 src_install() {
 395         emake install-nokeys DESTDIR="${D}"
 396         fperms 600 /etc/ssh/sshd_config
 397         dobin contrib/ssh-copy-id
 398         newinitd "${FILESDIR}"/sshd-r1.initd sshd
 399         newconfd "${FILESDIR}"/sshd-r1.confd sshd
 400
 401         newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
 402
 403         tweak_ssh_configs
 404
 405         doman contrib/ssh-copy-id.1
 406         dodoc CREDITS OVERVIEW README* TODO sshd_config
 407         use hpn && dodoc HPN-README
 408         use X509 || dodoc ChangeLog
 409
 410         diropts -m 0700
 411         dodir /etc/skel/.ssh
 412
 413         keepdir /var/empty
 414
 415         systemd_dounit "${FILESDIR}"/sshd.{service,socket}
 416         systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
 417 }
 418
 419 pkg_postinst() {
 420         if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
 421                 elog "Starting with openssh-5.8p1, the server will default to a newer key"
 422                 elog "algorithm (ECDSA).  You are encouraged to manually update your stored"
 423                 elog "keys list as servers update theirs.  See ssh-keyscan(1) for more info."
 424         fi
 425         if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
 426                 elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
 427                 elog "Make sure to update any configs that you might have.  Note that xinetd might"
 428                 elog "be an alternative for you as it supports USE=tcpd."
 429         fi
 430         if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
 431                 elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
 432                 elog "weak sizes.  If you rely on these key types, you can re-enable the key types by"
 433                 elog "adding to your sshd_config or ~/.ssh/config files:"
 434                 elog "  PubkeyAcceptedKeyTypes=+ssh-dss"
 435                 elog "You should however generate new keys using rsa or ed25519."
 436
 437                 elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
 438                 elog "to 'prohibit-password'.  That means password auth for root users no longer works"
 439                 elog "out of the box.  If you need this, please update your sshd_config explicitly."
 440         fi
 441         if has_version "<${CATEGORY}/${PN}-7.6_p1" ; then
 442                 elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
 443                 elog "Furthermore, rsa keys with less than 1024 bits will be refused."
 444         fi
 445         if has_version "<${CATEGORY}/${PN}-7.7_p1" ; then
 446                 elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
 447                 elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
 448                 elog "if you need to authenticate against LDAP."
 449                 elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
 450         fi
 451         if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
 452                 elog "Be aware that by disabling openssl support in openssh, the server and clients"
 453                 elog "no longer support dss/rsa/ecdsa keys.  You will need to generate ed25519 keys"
 454                 elog "and update all clients/servers that utilize them."
 455         fi
 456
 457         if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
 458                 elog ""
 459                 elog "HPN's multi-threaded AES CTR cipher is currently known to be broken"
 460                 elog "and therefore disabled at runtime per default."
 461                 elog "Make sure your sshd_config is up to date and contains"
 462                 elog ""
 463                 elog "  DisableMTAES yes"
 464                 elog ""
 465                 elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
 466                 elog ""
 467         fi
 468 }