# ChangeLog for net-misc/openssh
# Copyright 2002-2004 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/net-misc/openssh/ChangeLog,v 1.103 2004/11/16 05:11:12 vapier Exp $
+# $Header: /var/cvsroot/gentoo-x86/net-misc/openssh/ChangeLog,v 1.104 2004/12/29 01:49:29 vapier Exp $
+
+*openssh-3.9_p1-r1 (28 Dec 2004)
+
+ 28 Dec 2004; Mike Frysinger <vapier@gentoo.org>
+ files/openssh-3.9_p1-chroot.patch, +openssh-3.9_p1-r1.ebuild,
+ +files/openssh-3.9_p1-infoleak.patch:
+ Add infoleak fix #59361 and allow the chroot patch to support PAM auth #72987.
16 Nov 2004; Mike Frysinger <vapier@gentoo.org> openssh-3.9_p1.ebuild:
If USE=pam, then disable PasswordAuthentication since PAM overrides it #71233.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
-MD5 4c036ee248fdf0dd7157545e36a83003 ChangeLog 17347
+MD5 ffa4eedc7f2626b98a413094b49ebe8d ChangeLog 17618
MD5 0feff9b09e482567359625301bddce1c metadata.xml 1329
MD5 aec43e5b3a4401a4acb51363c755a729 openssh-3.7.1_p2-r1.ebuild 4113
+MD5 3df710faa1358d8329631085ecfa0d30 openssh-3.9_p1-r1.ebuild 4488
+MD5 6cbb30e34e71177ff3c5058b21308e63 openssh-3.9_p1.ebuild 4421
MD5 5f87f18a24efe616d1dfcc5e9848946b openssh-3.8.1_p1-r1.ebuild 4241
MD5 b4353850fbc9705f26093f98055cfc69 openssh-3.8.1_p1-r2.ebuild 4266
-MD5 e9523dae352f6d0b78f1574f05df7f74 openssh-3.9_p1.ebuild 4425
+MD5 2cce94a742ab0721d87b1ff63c32d0f9 files/digest-openssh-3.9_p1-r1 136
MD5 2f8fc1bd837220c9708d9d8b0730fe2c files/digest-openssh-3.7.1_p2-r1 142
MD5 7880e18b2a91e5927810dddc7bda270f files/openssh-3.7.1_p1-selinux.diff.bz2 1353
MD5 b912e51afc37c43afef30d1f4aaee55a files/openssh-skeychallenge-args.diff.bz2 424
MD5 857f14fd111169d8838d07fb46769938 files/openssh-3.8_p1-kerberos.patch.bz2 465
MD5 a26faff36f0ec463cb4ef7366bfdc1e1 files/openssh-3.8_p1-resolv_functions.patch.bz2 315
MD5 465aab818202ddb010f0bfca738e902a files/openssh-3.8_p1-skey.patch.bz2 270
+MD5 ba87dbfc3be0ab9d70fe24278d9deb02 files/openssh-3.9_p1-infoleak.patch 2496
MD5 857f14fd111169d8838d07fb46769938 files/openssh-3.8.1_p1-kerberos.patch.bz2 465
MD5 a26faff36f0ec463cb4ef7366bfdc1e1 files/openssh-3.8.1_p1-resolv_functions.patch.bz2 315
MD5 465aab818202ddb010f0bfca738e902a files/openssh-3.8.1_p1-skey.patch.bz2 270
MD5 7c16095191b5dc9d653dcb658650c88c files/digest-openssh-3.8.1_p1-r1 141
MD5 7c16095191b5dc9d653dcb658650c88c files/digest-openssh-3.8.1_p1-r2 141
MD5 328a5f063659ddb400d21201feb92170 files/openssh-3.8.1_p1-opensc.patch.bz2 1381
+MD5 87593c73e26e1a3825fcb51f2270b694 files/openssh-3.9_p1-chroot.patch 3027
MD5 2cce94a742ab0721d87b1ff63c32d0f9 files/digest-openssh-3.9_p1 136
-MD5 6d3c9b201c2e89b7156b2fc37ade9721 files/openssh-3.9_p1-chroot.patch.bz2 1119
MD5 265e0566d8f9408f1f89cfa2bf2a5105 files/openssh-3.9_p1-fix_suid.patch.bz2 304
MD5 f08e067b7000e994a23291e15c9e53f3 files/openssh-3.9_p1-largekey.patch.bz2 1352
MD5 0bc069a375ecec2d469b74a3a9a7d647 files/openssh-3.9_p1-sftplogging-1.2-gentoo.patch.bz2 6225
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.9.10 (GNU/Linux)
-iD8DBQFB0gYaroRuSHgZdywRAmq/AJ9OvivN/Mzd2eeY+2ynKXK3EQva+gCfc9Im
-bEYuUfprH+7N/wBqoIQXVXg=
-=RQ3O
+iD8DBQFB0g0/roRuSHgZdywRAoILAJ9c+zAp4ngmtw3CuYL7roZ6I4itfACfQmjW
+uJfyi24Og9vJoVF12mCCqGs=
+=82hD
-----END PGP SIGNATURE-----
--- /dev/null
+MD5 8e1774d0b52aff08f817f3987442a16e openssh-3.9p1.tar.gz 854027
+MD5 eedb263c96a1d7bf208eb2ba70c2e238 openssh-3.9p1+x509h.diff.gz 98011
--- /dev/null
+################################################################################
+################################################################################
+# #
+# Original patch by Ricardo Cerqueira <rmcc@clix.pt> #
+# #
+# Updated by James Dennis <james@firstaidmusic.com> for openssh-3.7.1p2 #
+# #
+# A patch to cause sshd to chroot when it encounters the magic token #
+# '/./' in a users home directory. The directory portion before the #
+# token is the directory to chroot() to, the portion after the #
+# token is the user's home directory relative to the new root. #
+# #
+# Patch source using: patch -p0 < /path/to/patch #
+# #
+# Systems with a bad diff (doesn't understand -u or -N) should use gnu diff. #
+# Solaris may store this as gdiff under /opt/sfw/bin. I can't say much about #
+# other systems (unless you email me your experiences!). #
+# #
+################################################################################
+################################################################################
+
+diff -uNr openssh-3.7.1p2/session.c openssh-3.7.1p2-chroot/session.c
+--- openssh-3.7.1p2/session.c Tue Sep 23 04:59:08 2003
++++ openssh-3.7.1p2-chroot/session.c Fri Sep 26 13:42:52 2003
+@@ -58,6 +58,8 @@
+ #include "session.h"
+ #include "monitor_wrap.h"
+
++#define CHROOT
++
+ #ifdef GSSAPI
+ #include "ssh-gss.h"
+ #endif
+@@ -1231,6 +1233,12 @@
+ void
+ do_setusercontext(struct passwd *pw)
+ {
++
++#ifdef CHROOT
++ char *user_dir;
++ char *new_root;
++#endif /* CHROOT */
++
+ #ifndef HAVE_CYGWIN
+ if (getuid() == 0 || geteuid() == 0)
+ #endif /* HAVE_CYGWIN */
+@@ -1268,6 +1276,27 @@
+ do_pam_setcred(0);
+ }
+ # endif /* USE_PAM */
++
++#ifdef CHROOT
++ user_dir = xstrdup(pw->pw_dir);
++ new_root = user_dir + 1;
++
++ while((new_root = strchr(new_root, '.')) != NULL) {
++ new_root--;
++ if(strncmp(new_root, "/./", 3) == 0) {
++ *new_root = '\0';
++ new_root += 2;
++
++ if(chroot(user_dir) != 0)
++ fatal("Couldn't chroot to user directory % s", user_dir);
++ pw->pw_dir = new_root;
++ break;
++ }
++ new_root += 2;
++ }
++#endif /* CHROOT */
++
++
+ # if defined(WITH_IRIX_PROJECT) || defined(WITH_IRIX_JOBS) || defined(WITH_IRIX_ARRAY)
+ irix_setusercontext(pw);
+ # endif /* defined(WITH_IRIX_PROJECT) || defined(WITH_IRIX_JOBS) || defined(WITH_IRIX_ARRAY) */
--- /dev/null
+openssh has an information leak related to timing under some conditions
+
+nothing special
+
+http://bugs.gentoo.org/show_bug.cgi?id=59361
+
+Index: auth2-chall.c
+===================================================================
+RCS file: /cvs/src/usr.bin/ssh/auth2-chall.c,v
+retrieving revision 1.21
+diff -u -p -r1.21 auth2-chall.c
+--- auth2-chall.c 1 Jun 2004 14:20:45 -0000 1.21
++++ auth2-chall.c 6 Jul 2004 12:13:10 -0000
+@@ -268,12 +268,9 @@ input_userauth_info_response(int type, u
+ }
+ packet_check_eom();
+
+- if (authctxt->valid) {
+- res = kbdintctxt->device->respond(kbdintctxt->ctxt,
+- nresp, response);
+- } else {
+- res = -1;
+- }
++ res = kbdintctxt->device->respond(kbdintctxt->ctxt, nresp, response);
++ if (!authctxt->valid)
++ res = 1; /* keep going if login invalid */
+
+ for (i = 0; i < nresp; i++) {
+ memset(response[i], 'r', strlen(response[i]));
+@@ -285,7 +282,7 @@ input_userauth_info_response(int type, u
+ switch (res) {
+ case 0:
+ /* Success! */
+- authenticated = 1;
++ authenticated = authctxt->valid ? 1 : 0;
+ break;
+ case 1:
+ /* Authentication needs further interaction */
+Index: auth-pam.c
+===================================================================
+RCS file: /usr/local/src/security/openssh/cvs/openssh_cvs/auth-pam.c,v
+retrieving revision 1.118
+diff -u -p -r1.118 auth-pam.c
+--- auth-pam.c 16 Oct 2004 08:52:44 -0000 1.118
++++ auth-pam.c 20 Nov 2004 02:40:58 -0000
+@@ -186,6 +186,7 @@ static int sshpam_account_status = -1;
+ static char **sshpam_env = NULL;
+ static Authctxt *sshpam_authctxt = NULL;
+ static const char *sshpam_password = NULL;
++static char badpw[] = "\b\n\r\177INCORRECT";
+
+ /* Some PAM implementations don't implement this */
+ #ifndef HAVE_PAM_GETENVLIST
+@@ -746,7 +747,12 @@ sshpam_respond(void *ctx, u_int num, cha
+ return (-1);
+ }
+ buffer_init(&buffer);
+- buffer_put_cstring(&buffer, *resp);
++ if (sshpam_authctxt->valid &&
++ (sshpam_authctxt->pw->pw_uid != 0 ||
++ options.permit_root_login == PERMIT_YES))
++ buffer_put_cstring(&buffer, *resp);
++ else
++ buffer_put_cstring(&buffer, badpw);
+ if (ssh_msg_send(ctxt->pam_psock, PAM_AUTHTOK, &buffer) == -1) {
+ buffer_free(&buffer);
+ return (-1);
+@@ -1093,7 +1097,6 @@ sshpam_auth_passwd(Authctxt *authctxt, c
+ {
+ int flags = (options.permit_empty_passwd == 0 ?
+ PAM_DISALLOW_NULL_AUTHTOK : 0);
+- static char badpw[] = "\b\n\r\177INCORRECT";
+
+ if (!options.use_pam || sshpam_handle == NULL)
+ fatal("PAM: %s called when PAM disabled or failed to "
--- /dev/null
+# Copyright 1999-2004 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/net-misc/openssh/openssh-3.9_p1-r1.ebuild,v 1.1 2004/12/29 01:49:29 vapier Exp $
+
+inherit eutils flag-o-matic ccc gnuconfig
+
+# Make it more portable between straight releases
+# and _p? releases.
+PARCH=${P/_/}
+
+SFTPLOG_PATCH_VER="1.2"
+X509_PATCH="${PARCH}+x509h.diff.gz"
+SELINUX_PATCH="openssh-3.9_p1-selinux.diff"
+
+S=${WORKDIR}/${PARCH}
+DESCRIPTION="Port of OpenBSD's free SSH release"
+HOMEPAGE="http://www.openssh.com/"
+SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
+ X509? ( http://roumenpetrov.info/openssh/x509h/${X509_PATCH} )"
+
+LICENSE="as-is"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~mips ~ppc ~ppc64 ~s390 ~sparc ~x86"
+IUSE="ipv6 static pam tcpd kerberos skey selinux chroot X509 ldap smartcard uclibc sftplogging"
+
+RDEPEND="virtual/libc
+ pam? ( >=sys-libs/pam-0.73
+ >=sys-apps/shadow-4.0.2-r2 )
+ !mips? ( kerberos? ( virtual/krb5 ) )
+ selinux? ( sys-libs/libselinux )
+ !ppc64? ( skey? ( >=app-admin/skey-1.1.5-r1 ) )
+ >=dev-libs/openssl-0.9.6d
+ >=sys-libs/zlib-1.1.4
+ x86? ( smartcard? ( dev-libs/opensc ) )
+ !ppc64? ( tcpd? ( >=sys-apps/tcp-wrappers-7.6 ) )"
+DEPEND="${RDEPEND}
+ virtual/os-headers
+ dev-lang/perl
+ !uclibc? ( sys-apps/groff )
+ >=sys-apps/sed-4
+ sys-devel/autoconf"
+PROVIDE="virtual/ssh"
+
+src_unpack() {
+ unpack ${PARCH}.tar.gz
+ cd ${S}
+
+ epatch ${FILESDIR}/${P}-largekey.patch.bz2
+ epatch ${FILESDIR}/${P}-fix_suid.patch.bz2
+ epatch ${FILESDIR}/${P}-infoleak.patch #59361
+
+ use sftplogging && epatch ${FILESDIR}/${P}-sftplogging-1.2-gentoo.patch.bz2
+ use alpha && epatch ${FILESDIR}/${PN}-3.5_p1-gentoo-sshd-gcc3.patch.bz2
+ use skey && epatch ${FILESDIR}/${P}-skey.patch.bz2
+ use chroot && epatch ${FILESDIR}/${P}-chroot.patch
+ use X509 && epatch ${DISTDIR}/${X509_PATCH}
+ use selinux && epatch ${FILESDIR}/${SELINUX_PATCH}.bz2
+ use smartcard && epatch ${FILESDIR}/${P}-opensc.patch.bz2
+
+ autoconf || die "autoconf failed"
+}
+
+src_compile() {
+ local myconf
+
+ addwrite /dev/ptmx
+ gnuconfig_update
+
+ # make sure .sbss is large enough
+ use skey && use alpha && append-ldflags -mlarge-data
+ use ldap && filter-flags -funroll-loops
+ use selinux && append-flags "-DWITH_SELINUX"
+
+ if use static; then
+ append-ldflags -static
+ export LDFLAGS
+ if use pam; then
+ ewarn "Disabling pam support becuse of static flag."
+ myconf="${myconf} --without-pam"
+ else
+ myconf="${myconf} --without-pam"
+ fi
+ else
+ myconf="${myconf} `use_with pam`"
+ fi
+
+ use ipv6 || myconf="${myconf} --with-ipv4-default"
+
+ econf \
+ --sysconfdir=/etc/ssh \
+ --libexecdir=/usr/lib/misc \
+ --datadir=/usr/share/openssh \
+ --disable-suid-ssh \
+ --with-privsep-path=/var/empty \
+ --with-privsep-user=sshd \
+ --with-md5-passwords \
+ `use_with kerberos kerberos5 /usr` \
+ `use_with tcpd tcp-wrappers` \
+ `use_with skey` \
+ `use_with smartcard opensc` \
+ ${myconf} \
+ || die "bad configure"
+
+# use static && {
+# # statically link to libcrypto -- good for the boot cd
+# sed -i "s:-lcrypto:/usr/lib/libcrypto.a:g" Makefile
+# }
+
+ emake || die "compile problem"
+}
+
+src_install() {
+ make install-files DESTDIR=${D} || die
+ chmod 600 ${D}/etc/ssh/sshd_config
+ dodoc ChangeLog CREDITS OVERVIEW README* TODO sshd_config
+ use pam && ( insinto /etc/pam.d ; newins ${FILESDIR}/sshd.pam sshd )
+ exeinto /etc/init.d ; newexe ${FILESDIR}/sshd.rc6 sshd
+ keepdir /var/empty
+ dosed "/^#Protocol /s:.*:Protocol 2:" /etc/ssh/sshd_config
+ use pam \
+ && dosed "/^#UsePAM /s:.*:UsePAM yes:" /etc/ssh/sshd_config \
+ && dosed "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" /etc/ssh/sshd_config
+}
+
+pkg_postinst() {
+ enewgroup sshd 22
+ enewuser sshd 22 /bin/false /var/empty sshd
+
+ ewarn "Remember to merge your config files in /etc/ssh/ and then"
+ ewarn "restart sshd: '/etc/init.d/sshd restart'."
+ ewarn
+ einfo "As of version 3.4 the default is to enable the UsePrivelegeSeparation"
+ einfo "functionality, but please ensure that you do not explicitly disable"
+ einfo "this in your configuration as disabling it opens security holes"
+ einfo
+ einfo "This revision has removed your sshd user id and replaced it with a"
+ einfo "new one with UID 22. If you have any scripts or programs that"
+ einfo "that referenced the old UID directly, you will need to update them."
+ einfo
+ use pam >/dev/null 2>&1 && {
+ einfo "Please be aware users need a valid shell in /etc/passwd"
+ einfo "in order to be allowed to login."
+ einfo
+ }
+}
# Copyright 1999-2004 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/net-misc/openssh/openssh-3.9_p1.ebuild,v 1.8 2004/11/16 05:11:12 vapier Exp $
+# $Header: /var/cvsroot/gentoo-x86/net-misc/openssh/openssh-3.9_p1.ebuild,v 1.9 2004/12/29 01:49:29 vapier Exp $
inherit eutils flag-o-matic ccc gnuconfig
LICENSE="as-is"
SLOT="0"
-KEYWORDS="~x86 ~ppc ~sparc ~mips ~alpha ~arm ~hppa ~amd64 ~ia64 ~ppc64 ~s390"
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~mips ~ppc ~ppc64 ~s390 ~sparc ~x86"
IUSE="ipv6 static pam tcpd kerberos skey selinux chroot X509 ldap smartcard uclibc sftplogging"
RDEPEND="virtual/libc
use sftplogging && epatch ${FILESDIR}/${P}-sftplogging-1.2-gentoo.patch.bz2
use alpha && epatch ${FILESDIR}/${PN}-3.5_p1-gentoo-sshd-gcc3.patch.bz2
use skey && epatch ${FILESDIR}/${P}-skey.patch.bz2
- use chroot && epatch ${FILESDIR}/${P}-chroot.patch.bz2
+ use chroot && epatch ${FILESDIR}/${P}-chroot.patch
use X509 && epatch ${DISTDIR}/${X509_PATCH}
use selinux && epatch ${FILESDIR}/${SELINUX_PATCH}.bz2
use smartcard && epatch ${FILESDIR}/${P}-opensc.patch.bz2
projects / gentoo.git / commitdiff