net-misc/openssh/openssh-8.2_p1-r6.ebuild

   1 # Copyright 1999-2020 Gentoo Authors
   2 # Distributed under the terms of the GNU General Public License v2
   3
   4 EAPI=7
   5
   6 inherit user-info flag-o-matic multilib autotools pam systemd toolchain-funcs
   7
   8 # Make it more portable between straight releases
   9 # and _p? releases.
  10 PARCH=${P/_}
  11 HPN_PV="8.1_P1"
  12
  13 HPN_VER="14.20"
  14 HPN_PATCHES=(
  15         ${PN}-${HPN_PV/./_}-hpn-DynWinNoneSwitch-${HPN_VER}.diff
  16         ${PN}-${HPN_PV/./_}-hpn-AES-CTR-${HPN_VER}.diff
  17         ${PN}-${HPN_PV/./_}-hpn-PeakTput-${HPN_VER}.diff
  18 )
  19
  20 SCTP_VER="1.2" SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
  21 X509_VER="12.4.3" X509_PATCH="${PARCH}+x509-${X509_VER}.diff.gz"
  22
  23 DESCRIPTION="Port of OpenBSD's free SSH release"
  24 HOMEPAGE="https://www.openssh.com/"
  25 SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
  26         ${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~chutzpah/dist/openssh/${SCTP_PATCH} )}
  27         ${HPN_VER:+hpn? ( $(printf "mirror://sourceforge/hpnssh/HPN-SSH%%20${HPN_VER/./v}%%20${HPN_PV/_P/p}/%s\n" "${HPN_PATCHES[@]}") )}
  28         ${X509_PATCH:+X509? ( https://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
  29 "
  30 S="${WORKDIR}/${PARCH}"
  31
  32 LICENSE="BSD GPL-2"
  33 SLOT="0"
  34 KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
  35 # Probably want to drop ssl defaulting to on in a future version.
  36 IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
  37
  38 RESTRICT="!test? ( test )"
  39
  40 REQUIRED_USE="
  41         ldns? ( ssl )
  42         pie? ( !static )
  43         static? ( !kerberos !pam )
  44         X509? ( !sctp !security-key ssl !xmss )
  45         xmss? ( || ( ssl libressl ) )
  46         test? ( ssl )
  47 "
  48
  49 LIB_DEPEND="
  50         audit? ( sys-process/audit[static-libs(+)] )
  51         ldns? (
  52                 net-libs/ldns[static-libs(+)]
  53                 !bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
  54                 bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
  55         )
  56         libedit? ( dev-libs/libedit:=[static-libs(+)] )
  57         sctp? ( net-misc/lksctp-tools[static-libs(+)] )
  58         security-key? ( dev-libs/libfido2:=[static-libs(+)] )
  59         selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
  60         ssl? (
  61                 !libressl? (
  62                         || (
  63                                 (
  64                                         >=dev-libs/openssl-1.0.1:0[bindist=]
  65                                         <dev-libs/openssl-1.1.0:0[bindist=]
  66                                 )
  67                                 >=dev-libs/openssl-1.1.0g:0[bindist=]
  68                         )
  69                         dev-libs/openssl:0=[static-libs(+)]
  70                 )
  71                 libressl? ( dev-libs/libressl:0=[static-libs(+)] )
  72         )
  73         virtual/libcrypt:=[static-libs(+)]
  74         >=sys-libs/zlib-1.2.3:=[static-libs(+)]
  75 "
  76 RDEPEND="
  77         acct-group/sshd
  78         acct-user/sshd
  79         !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
  80         pam? ( sys-libs/pam )
  81         kerberos? ( virtual/krb5 )
  82 "
  83 DEPEND="${RDEPEND}
  84         static? ( ${LIB_DEPEND} )
  85         virtual/os-headers
  86 "
  87 RDEPEND="${RDEPEND}
  88         pam? ( >=sys-auth/pambase-20081028 )
  89         userland_GNU? ( !prefix? ( sys-apps/shadow ) )
  90         X? ( x11-apps/xauth )
  91 "
  92 BDEPEND="
  93         virtual/pkgconfig
  94         sys-devel/autoconf
  95 "
  96
  97 pkg_pretend() {
  98         # this sucks, but i'd rather have people unable to `emerge -u openssh`
  99         # than not be able to log in to their server any more
 100         maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
 101         local fail="
 102                 $(use hpn && maybe_fail hpn HPN_VER)
 103                 $(use sctp && maybe_fail sctp SCTP_PATCH)
 104                 $(use X509 && maybe_fail X509 X509_PATCH)
 105         "
 106         fail=$(echo ${fail})
 107         if [[ -n ${fail} ]] ; then
 108                 eerror "Sorry, but this version does not yet support features"
 109                 eerror "that you requested:      ${fail}"
 110                 eerror "Please mask ${PF} for now and check back later:"
 111                 eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
 112                 die "booooo"
 113         fi
 114
 115         # Make sure people who are using tcp wrappers are notified of its removal. #531156
 116         if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
 117                 ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
 118                 ewarn "you're trying to use it.  Update your ${EROOT}/etc/hosts.{allow,deny} please."
 119         fi
 120 }
 121
 122 src_prepare() {
 123         sed -i \
 124                 -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
 125                 pathnames.h || die
 126
 127         # don't break .ssh/authorized_keys2 for fun
 128         sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
 129
 130         eapply "${FILESDIR}"/${PN}-7.9_p1-include-stdlib.patch
 131         eapply "${FILESDIR}"/${PN}-8.2_p1-GSSAPI-dns.patch #165444 integrated into gsskex
 132         eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
 133         eapply "${FILESDIR}"/${PN}-7.5_p1-disable-conch-interop-tests.patch
 134         eapply "${FILESDIR}"/${PN}-8.0_p1-fix-putty-tests.patch
 135         eapply "${FILESDIR}"/${PN}-8.0_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch
 136
 137         [[ -d ${WORKDIR}/patches ]] && eapply "${WORKDIR}"/patches
 138
 139         local PATCHSET_VERSION_MACROS=()
 140
 141         if use X509 ; then
 142                 pushd "${WORKDIR}" &>/dev/null || die
 143                 eapply "${FILESDIR}/${P}-X509-glue-"${X509_VER}".patch"
 144                 popd &>/dev/null || die
 145
 146                 eapply "${WORKDIR}"/${X509_PATCH%.*}
 147                 eapply "${FILESDIR}"/${P}-X509-${X509_VER}-tests.patch
 148
 149                 # We need to patch package version or any X.509 sshd will reject our ssh client
 150                 # with "userauth_pubkey: could not parse key: string is too large [preauth]"
 151                 # error
 152                 einfo "Patching package version for X.509 patch set ..."
 153                 sed -i \
 154                         -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
 155                         "${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
 156
 157                 einfo "Patching version.h to expose X.509 patch set ..."
 158                 sed -i \
 159                         -e "/^#define SSH_PORTABLE.*/a #define SSH_X509               \"-PKIXSSH-${X509_VER}\"" \
 160                         "${S}"/version.h || die "Failed to sed-in X.509 patch version"
 161                 PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
 162         fi
 163
 164         if use sctp ; then
 165                 eapply "${WORKDIR}"/${SCTP_PATCH%.*}
 166
 167                 einfo "Patching version.h to expose SCTP patch set ..."
 168                 sed -i \
 169                         -e "/^#define SSH_PORTABLE/a #define SSH_SCTP        \"-sctp-${SCTP_VER}\"" \
 170                         "${S}"/version.h || die "Failed to sed-in SCTP patch version"
 171                 PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' )
 172
 173                 einfo "Disabling know failing test (cfgparse) caused by SCTP patch ..."
 174                 sed -i \
 175                         -e "/\t\tcfgparse \\\/d" \
 176                         "${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch"
 177         fi
 178
 179         if use hpn ; then
 180                 local hpn_patchdir="${T}/${P}-hpn${HPN_VER}"
 181                 mkdir "${hpn_patchdir}" || die
 182                 cp $(printf -- "${DISTDIR}/%s\n" "${HPN_PATCHES[@]}") "${hpn_patchdir}" || die
 183                 pushd "${hpn_patchdir}" &>/dev/null || die
 184                 eapply "${FILESDIR}"/${P}-hpn-${HPN_VER}-glue.patch
 185                 eapply "${FILESDIR}"/${P}-hpn-${HPN_VER}-libressl.patch
 186                 if use X509; then
 187                 #       einfo "Will disable MT AES cipher due to incompatbility caused by X509 patch set"
 188                 #       # X509 and AES-CTR-MT don't get along, let's just drop it
 189                 #       rm openssh-${HPN_PV//./_}-hpn-AES-CTR-${HPN_VER}.diff || die
 190                         eapply "${FILESDIR}"/${P}-hpn-${HPN_VER}-X509-glue.patch
 191                 fi
 192                 use sctp && eapply "${FILESDIR}"/${P}-hpn-${HPN_VER}-sctp-glue.patch
 193                 popd &>/dev/null || die
 194
 195                 eapply "${hpn_patchdir}"
 196
 197                 use X509 || eapply "${FILESDIR}/openssh-8.0_p1-hpn-version.patch"
 198
 199                 einfo "Patching Makefile.in for HPN patch set ..."
 200                 sed -i \
 201                         -e "/^LIBS=/ s/\$/ -lpthread/" \
 202                         "${S}"/Makefile.in || die "Failed to patch Makefile.in"
 203
 204                 einfo "Patching version.h to expose HPN patch set ..."
 205                 sed -i \
 206                         -e "/^#define SSH_PORTABLE/a #define SSH_HPN         \"-hpn${HPN_VER//./v}\"" \
 207                         "${S}"/version.h || die "Failed to sed-in HPN patch version"
 208                 PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
 209
 210                 if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
 211                         einfo "Disabling known non-working MT AES cipher per default ..."
 212
 213                         cat > "${T}"/disable_mtaes.conf <<- EOF
 214
 215                         # HPN's Multi-Threaded AES CTR cipher is currently known to be broken
 216                         # and therefore disabled per default.
 217                         DisableMTAES yes
 218                         EOF
 219                         sed -i \
 220                                 -e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \
 221                                 "${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config"
 222
 223                         sed -i \
 224                                 -e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \
 225                                 "${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config"
 226                 fi
 227         fi
 228
 229         if use X509 || use sctp || use hpn ; then
 230                 einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
 231                 sed -i \
 232                         -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
 233                         "${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)"
 234
 235                 einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..."
 236                 sed -i \
 237                         -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
 238                         "${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)"
 239
 240                 einfo "Patching version.h to add our patch sets to SSH_RELEASE ..."
 241                 sed -i \
 242                         -e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE     SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \
 243                         "${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
 244         fi
 245
 246         sed -i \
 247                 -e "/#UseLogin no/d" \
 248                 "${S}"/sshd_config || die "Failed to remove removed UseLogin option (sshd_config)"
 249
 250         eapply_user #473004
 251
 252         tc-export PKG_CONFIG
 253         local sed_args=(
 254                 -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
 255                 # Disable PATH reset, trust what portage gives us #254615
 256                 -e 's:^PATH=/:#PATH=/:'
 257                 # Disable fortify flags ... our gcc does this for us
 258                 -e 's:-D_FORTIFY_SOURCE=2::'
 259         )
 260
 261         # The -ftrapv flag ICEs on hppa #505182
 262         use hppa && sed_args+=(
 263                 -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
 264                 -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
 265         )
 266         # _XOPEN_SOURCE causes header conflicts on Solaris
 267         [[ ${CHOST} == *-solaris* ]] && sed_args+=(
 268                 -e 's/-D_XOPEN_SOURCE//'
 269         )
 270         sed -i "${sed_args[@]}" configure{.ac,} || die
 271
 272         eautoreconf
 273 }
 274
 275 src_configure() {
 276         addwrite /dev/ptmx
 277
 278         use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
 279         use static && append-ldflags -static
 280         use xmss && append-cflags -DWITH_XMSS
 281
 282         local myconf=(
 283                 --with-ldflags="${LDFLAGS}"
 284                 --disable-strip
 285                 --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
 286                 --sysconfdir="${EPREFIX}"/etc/ssh
 287                 --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
 288                 --datadir="${EPREFIX}"/usr/share/openssh
 289                 --with-privsep-path="${EPREFIX}"/var/empty
 290                 --with-privsep-user=sshd
 291                 $(use_with audit audit linux)
 292                 $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
 293                 # We apply the sctp patch conditionally, so can't pass --without-sctp
 294                 # unconditionally else we get unknown flag warnings.
 295                 $(use sctp && use_with sctp)
 296                 $(use_with ldns ldns "${EPREFIX}"/usr)
 297                 $(use_with libedit)
 298                 $(use_with pam)
 299                 $(use_with pie)
 300                 $(use_with selinux)
 301                 $(use_with security-key security-key-builtin)
 302                 $(use_with ssl openssl)
 303                 $(use_with ssl md5-passwords)
 304                 $(use_with ssl ssl-engine)
 305                 $(use_with !elibc_Cygwin hardening) #659210
 306         )
 307
 308         # stackprotect is broken on musl x86 and ppc
 309         use elibc_musl && ( use x86 || use ppc ) && myconf+=( --without-stackprotect )
 310
 311         # The seccomp sandbox is broken on x32, so use the older method for now. #553748
 312         use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
 313
 314         econf "${myconf[@]}"
 315 }
 316
 317 src_test() {
 318         local t skipped=() failed=() passed=()
 319         local tests=( interop-tests compat-tests )
 320
 321         local shell=$(egetshell "${UID}")
 322         if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
 323                 elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
 324                 elog "user, so we will run a subset only."
 325                 skipped+=( tests )
 326         else
 327                 tests+=( tests )
 328         fi
 329
 330         # It will also attempt to write to the homedir .ssh.
 331         local sshhome=${T}/homedir
 332         mkdir -p "${sshhome}"/.ssh
 333         for t in "${tests[@]}" ; do
 334                 # Some tests read from stdin ...
 335                 HOMEDIR="${sshhome}" HOME="${sshhome}" SUDO="" \
 336                 emake -k -j1 ${t} </dev/null \
 337                         && passed+=( "${t}" ) \
 338                         || failed+=( "${t}" )
 339         done
 340
 341         einfo "Passed tests: ${passed[*]}"
 342         [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
 343         [[ ${#failed[@]}  -gt 0 ]] && die "Some tests failed: ${failed[*]}"
 344 }
 345
 346 # Gentoo tweaks to default config files.
 347 tweak_ssh_configs() {
 348         local locale_vars=(
 349                 # These are language variables that POSIX defines.
 350                 # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
 351                 LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
 352
 353                 # These are the GNU extensions.
 354                 # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
 355                 LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
 356         )
 357
 358         # First the server config.
 359         cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
 360
 361         # Allow client to pass locale environment variables. #367017
 362         AcceptEnv ${locale_vars[*]}
 363
 364         # Allow client to pass COLORTERM to match TERM. #658540
 365         AcceptEnv COLORTERM
 366         EOF
 367
 368         # Then the client config.
 369         cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
 370
 371         # Send locale environment variables. #367017
 372         SendEnv ${locale_vars[*]}
 373
 374         # Send COLORTERM to match TERM. #658540
 375         SendEnv COLORTERM
 376         EOF
 377
 378         if use pam ; then
 379                 sed -i \
 380                         -e "/^#UsePAM /s:.*:UsePAM yes:" \
 381                         -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
 382                         -e "/^#PrintMotd /s:.*:PrintMotd no:" \
 383                         -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
 384                         "${ED}"/etc/ssh/sshd_config || die
 385         fi
 386
 387         if use livecd ; then
 388                 sed -i \
 389                         -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
 390                         "${ED}"/etc/ssh/sshd_config || die
 391         fi
 392 }
 393
 394 src_install() {
 395         emake install-nokeys DESTDIR="${D}"
 396         fperms 600 /etc/ssh/sshd_config
 397         dobin contrib/ssh-copy-id
 398         newinitd "${FILESDIR}"/sshd-r1.initd sshd
 399         newconfd "${FILESDIR}"/sshd-r1.confd sshd
 400
 401         newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
 402
 403         tweak_ssh_configs
 404
 405         doman contrib/ssh-copy-id.1
 406         dodoc CREDITS OVERVIEW README* TODO sshd_config
 407         use hpn && dodoc HPN-README
 408         use X509 || dodoc ChangeLog
 409
 410         diropts -m 0700
 411         dodir /etc/skel/.ssh
 412
 413         keepdir /var/empty
 414
 415         systemd_dounit "${FILESDIR}"/sshd.{service,socket}
 416         systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
 417 }
 418
 419 pkg_preinst() {
 420         if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]"; then
 421                 show_ssl_warning=1
 422         fi
 423 }
 424
 425 pkg_postinst() {
 426         local old_ver
 427         for old_ver in ${REPLACING_VERSIONS}; do
 428                 if ver_test "${old_ver}" -lt "5.8_p1"; then
 429                         elog "Starting with openssh-5.8p1, the server will default to a newer key"
 430                         elog "algorithm (ECDSA).  You are encouraged to manually update your stored"
 431                         elog "keys list as servers update theirs.  See ssh-keyscan(1) for more info."
 432                 fi
 433                 if ver_test "${old_ver}" -lt "7.0_p1"; then
 434                         elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
 435                         elog "Make sure to update any configs that you might have.  Note that xinetd might"
 436                         elog "be an alternative for you as it supports USE=tcpd."
 437                 fi
 438                 if ver_test "${old_ver}" -lt "7.1_p1"; then #557388 #555518
 439                         elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
 440                         elog "weak sizes.  If you rely on these key types, you can re-enable the key types by"
 441                         elog "adding to your sshd_config or ~/.ssh/config files:"
 442                         elog "  PubkeyAcceptedKeyTypes=+ssh-dss"
 443                         elog "You should however generate new keys using rsa or ed25519."
 444
 445                         elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
 446                         elog "to 'prohibit-password'.  That means password auth for root users no longer works"
 447                         elog "out of the box.  If you need this, please update your sshd_config explicitly."
 448                 fi
 449                 if ver_test "${old_ver}" -lt "7.6_p1"; then
 450                         elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
 451                         elog "Furthermore, rsa keys with less than 1024 bits will be refused."
 452                 fi
 453                 if ver_test "${old_ver}" -lt "7.7_p1"; then
 454                         elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
 455                         elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
 456                         elog "if you need to authenticate against LDAP."
 457                         elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
 458                 fi
 459                 if ver_test "${old_ver}" -lt "8.2_p1"; then
 460                         ewarn "After upgrading to openssh-8.2p1 please restart sshd, otherwise you"
 461                         ewarn "will not be able to establish new sessions. Restarting sshd over a ssh"
 462                         ewarn "connection is generally safe."
 463                 fi
 464         done
 465
 466         if [[ -n ${show_ssl_warning} ]]; then
 467                 elog "Be aware that by disabling openssl support in openssh, the server and clients"
 468                 elog "no longer support dss/rsa/ecdsa keys.  You will need to generate ed25519 keys"
 469                 elog "and update all clients/servers that utilize them."
 470         fi
 471
 472         if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
 473                 elog ""
 474                 elog "HPN's multi-threaded AES CTR cipher is currently known to be broken"
 475                 elog "and therefore disabled at runtime per default."
 476                 elog "Make sure your sshd_config is up to date and contains"
 477                 elog ""
 478                 elog "  DisableMTAES yes"
 479                 elog ""
 480                 elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
 481                 elog ""
 482         fi
 483 }