net-misc/openssh/openssh-8.2_p1-r6.ebuild

   1 # Copyright 1999-2020 Gentoo Authors
   2 # Distributed under the terms of the GNU General Public License v2
   3
   4 EAPI=7
   5
   6 inherit user-info flag-o-matic multilib autotools pam systemd toolchain-funcs
   7
   8 # Make it more portable between straight releases
   9 # and _p? releases.
  10 PARCH=${P/_}
  11 HPN_PV="8.1_P1"
  12
  13 HPN_VER="14.20"
  14 HPN_PATCHES=(
  15         ${PN}-${HPN_PV/./_}-hpn-DynWinNoneSwitch-${HPN_VER}.diff
  16         ${PN}-${HPN_PV/./_}-hpn-AES-CTR-${HPN_VER}.diff
  17         ${PN}-${HPN_PV/./_}-hpn-PeakTput-${HPN_VER}.diff
  18 )
  19
  20 SCTP_VER="1.2" SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
  21 X509_VER="12.4.3" X509_PATCH="${PARCH}+x509-${X509_VER}.diff.gz"
  22
  23 DESCRIPTION="Port of OpenBSD's free SSH release"
  24 HOMEPAGE="https://www.openssh.com/"
  25 SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
  26         ${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~chutzpah/dist/openssh/${SCTP_PATCH} )}
  27         ${HPN_VER:+hpn? ( $(printf "mirror://sourceforge/hpnssh/HPN-SSH%%20${HPN_VER/./v}%%20${HPN_PV/_P/p}/%s\n" "${HPN_PATCHES[@]}") )}
  28         ${X509_PATCH:+X509? ( https://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
  29 "
  30 S="${WORKDIR}/${PARCH}"
  31
  32 LICENSE="BSD GPL-2"
  33 SLOT="0"
  34 KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
  35 # Probably want to drop ssl defaulting to on in a future version.
  36 IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
  37
  38 RESTRICT="!test? ( test )"
  39
  40 REQUIRED_USE="
  41         ldns? ( ssl )
  42         pie? ( !static )
  43         static? ( !kerberos !pam )
  44         X509? ( !sctp !security-key ssl !xmss )
  45         xmss? ( || ( ssl libressl ) )
  46         test? ( ssl )
  47 "
  48
  49 LIB_DEPEND="
  50         audit? ( sys-process/audit[static-libs(+)] )
  51         ldns? (
  52                 net-libs/ldns[static-libs(+)]
  53                 !bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
  54                 bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
  55         )
  56         libedit? ( dev-libs/libedit:=[static-libs(+)] )
  57         sctp? ( net-misc/lksctp-tools[static-libs(+)] )
  58         security-key? ( dev-libs/libfido2:=[static-libs(+)] )
  59         selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
  60         ssl? (
  61                 !libressl? (
  62                         || (
  63                                 (
  64                                         >=dev-libs/openssl-1.0.1:0[bindist=]
  65                                         <dev-libs/openssl-1.1.0:0[bindist=]
  66                                 )
  67                                 >=dev-libs/openssl-1.1.0g:0[bindist=]
  68                         )
  69                         dev-libs/openssl:0=[static-libs(+)]
  70                 )
  71                 libressl? ( dev-libs/libressl:0=[static-libs(+)] )
  72         )
  73         virtual/libcrypt:=[static-libs(+)]
  74         >=sys-libs/zlib-1.2.3:=[static-libs(+)]
  75 "
  76 RDEPEND="
  77         acct-group/sshd
  78         acct-user/sshd
  79         !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
  80         pam? ( sys-libs/pam )
  81         kerberos? ( virtual/krb5 )
  82 "
  83 DEPEND="${RDEPEND}
  84         static? ( ${LIB_DEPEND} )
  85         virtual/os-headers
  86 "
  87 RDEPEND="${RDEPEND}
  88         pam? ( >=sys-auth/pambase-20081028 )
  89         userland_GNU? ( !prefix? ( sys-apps/shadow ) )
  90         X? ( x11-apps/xauth )
  91 "
  92 BDEPEND="
  93         virtual/pkgconfig
  94         sys-devel/autoconf
  95 "
  96
  97 pkg_pretend() {
  98         # this sucks, but i'd rather have people unable to `emerge -u openssh`
  99         # than not be able to log in to their server any more
 100         maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
 101         local fail="
 102                 $(use hpn && maybe_fail hpn HPN_VER)
 103                 $(use sctp && maybe_fail sctp SCTP_PATCH)
 104                 $(use X509 && maybe_fail X509 X509_PATCH)
 105         "
 106         fail=$(echo ${fail})
 107         if [[ -n ${fail} ]] ; then
 108                 eerror "Sorry, but this version does not yet support features"
 109                 eerror "that you requested:      ${fail}"
 110                 eerror "Please mask ${PF} for now and check back later:"
 111                 eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
 112                 die "booooo"
 113         fi
 114
 115         # Make sure people who are using tcp wrappers are notified of its removal. #531156
 116         if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
 117                 ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
 118                 ewarn "you're trying to use it.  Update your ${EROOT}/etc/hosts.{allow,deny} please."
 119         fi
 120 }
 121
 122 src_prepare() {
 123         sed -i \
 124                 -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
 125                 pathnames.h || die
 126
 127         # don't break .ssh/authorized_keys2 for fun
 128         sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
 129
 130         eapply "${FILESDIR}"/${PN}-7.9_p1-include-stdlib.patch
 131         eapply "${FILESDIR}"/${PN}-8.2_p1-GSSAPI-dns.patch #165444 integrated into gsskex
 132         eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
 133         eapply "${FILESDIR}"/${PN}-7.5_p1-disable-conch-interop-tests.patch
 134         eapply "${FILESDIR}"/${PN}-8.0_p1-fix-putty-tests.patch
 135         eapply "${FILESDIR}"/${PN}-8.0_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch
 136
 137         [[ -d ${WORKDIR}/patches ]] && eapply "${WORKDIR}"/patches
 138
 139         local PATCHSET_VERSION_MACROS=()
 140
 141         if use X509 ; then
 142                 pushd "${WORKDIR}" &>/dev/null || die
 143                 eapply "${FILESDIR}/${P}-X509-glue-"${X509_VER}".patch"
 144                 popd &>/dev/null || die
 145
 146                 eapply "${WORKDIR}"/${X509_PATCH%.*}
 147                 eapply "${FILESDIR}"/${P}-X509-${X509_VER}-tests.patch
 148
 149                 # We need to patch package version or any X.509 sshd will reject our ssh client
 150                 # with "userauth_pubkey: could not parse key: string is too large [preauth]"
 151                 # error
 152                 einfo "Patching package version for X.509 patch set ..."
 153                 sed -i \
 154                         -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
 155                         "${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
 156
 157                 einfo "Patching version.h to expose X.509 patch set ..."
 158                 sed -i \
 159                         -e "/^#define SSH_PORTABLE.*/a #define SSH_X509               \"-PKIXSSH-${X509_VER}\"" \
 160                         "${S}"/version.h || die "Failed to sed-in X.509 patch version"
 161                 PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
 162         fi
 163
 164         if use sctp ; then
 165                 eapply "${WORKDIR}"/${SCTP_PATCH%.*}
 166
 167                 einfo "Patching version.h to expose SCTP patch set ..."
 168                 sed -i \
 169                         -e "/^#define SSH_PORTABLE/a #define SSH_SCTP        \"-sctp-${SCTP_VER}\"" \
 170                         "${S}"/version.h || die "Failed to sed-in SCTP patch version"
 171                 PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' )
 172
 173                 einfo "Disabling know failing test (cfgparse) caused by SCTP patch ..."
 174                 sed -i \
 175                         -e "/\t\tcfgparse \\\/d" \
 176                         "${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch"
 177         fi
 178
 179         if use hpn ; then
 180                 local hpn_patchdir="${T}/${P}-hpn${HPN_VER}"
 181                 mkdir "${hpn_patchdir}" || die
 182                 cp $(printf -- "${DISTDIR}/%s\n" "${HPN_PATCHES[@]}") "${hpn_patchdir}" || die
 183                 pushd "${hpn_patchdir}" &>/dev/null || die
 184                 eapply "${FILESDIR}"/${P}-hpn-${HPN_VER}-glue.patch
 185                 if use X509; then
 186                 #       einfo "Will disable MT AES cipher due to incompatbility caused by X509 patch set"
 187                 #       # X509 and AES-CTR-MT don't get along, let's just drop it
 188                 #       rm openssh-${HPN_PV//./_}-hpn-AES-CTR-${HPN_VER}.diff || die
 189                         eapply "${FILESDIR}"/${P}-hpn-${HPN_VER}-X509-glue.patch
 190                 fi
 191                 use sctp && eapply "${FILESDIR}"/${P}-hpn-${HPN_VER}-sctp-glue.patch
 192                 popd &>/dev/null || die
 193
 194                 eapply "${hpn_patchdir}"
 195
 196                 use X509 || eapply "${FILESDIR}/openssh-8.0_p1-hpn-version.patch"
 197
 198                 einfo "Patching Makefile.in for HPN patch set ..."
 199                 sed -i \
 200                         -e "/^LIBS=/ s/\$/ -lpthread/" \
 201                         "${S}"/Makefile.in || die "Failed to patch Makefile.in"
 202
 203                 einfo "Patching version.h to expose HPN patch set ..."
 204                 sed -i \
 205                         -e "/^#define SSH_PORTABLE/a #define SSH_HPN         \"-hpn${HPN_VER//./v}\"" \
 206                         "${S}"/version.h || die "Failed to sed-in HPN patch version"
 207                 PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
 208
 209                 if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
 210                         einfo "Disabling known non-working MT AES cipher per default ..."
 211
 212                         cat > "${T}"/disable_mtaes.conf <<- EOF
 213
 214                         # HPN's Multi-Threaded AES CTR cipher is currently known to be broken
 215                         # and therefore disabled per default.
 216                         DisableMTAES yes
 217                         EOF
 218                         sed -i \
 219                                 -e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \
 220                                 "${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config"
 221
 222                         sed -i \
 223                                 -e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \
 224                                 "${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config"
 225                 fi
 226         fi
 227
 228         if use X509 || use sctp || use hpn ; then
 229                 einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
 230                 sed -i \
 231                         -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
 232                         "${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)"
 233
 234                 einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..."
 235                 sed -i \
 236                         -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
 237                         "${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)"
 238
 239                 einfo "Patching version.h to add our patch sets to SSH_RELEASE ..."
 240                 sed -i \
 241                         -e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE     SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \
 242                         "${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
 243         fi
 244
 245         sed -i \
 246                 -e "/#UseLogin no/d" \
 247                 "${S}"/sshd_config || die "Failed to remove removed UseLogin option (sshd_config)"
 248
 249         eapply_user #473004
 250
 251         tc-export PKG_CONFIG
 252         local sed_args=(
 253                 -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
 254                 # Disable PATH reset, trust what portage gives us #254615
 255                 -e 's:^PATH=/:#PATH=/:'
 256                 # Disable fortify flags ... our gcc does this for us
 257                 -e 's:-D_FORTIFY_SOURCE=2::'
 258         )
 259
 260         # The -ftrapv flag ICEs on hppa #505182
 261         use hppa && sed_args+=(
 262                 -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
 263                 -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
 264         )
 265         # _XOPEN_SOURCE causes header conflicts on Solaris
 266         [[ ${CHOST} == *-solaris* ]] && sed_args+=(
 267                 -e 's/-D_XOPEN_SOURCE//'
 268         )
 269         sed -i "${sed_args[@]}" configure{.ac,} || die
 270
 271         eautoreconf
 272 }
 273
 274 src_configure() {
 275         addwrite /dev/ptmx
 276
 277         use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
 278         use static && append-ldflags -static
 279         use xmss && append-cflags -DWITH_XMSS
 280
 281         local myconf=(
 282                 --with-ldflags="${LDFLAGS}"
 283                 --disable-strip
 284                 --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
 285                 --sysconfdir="${EPREFIX}"/etc/ssh
 286                 --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
 287                 --datadir="${EPREFIX}"/usr/share/openssh
 288                 --with-privsep-path="${EPREFIX}"/var/empty
 289                 --with-privsep-user=sshd
 290                 $(use_with audit audit linux)
 291                 $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
 292                 # We apply the sctp patch conditionally, so can't pass --without-sctp
 293                 # unconditionally else we get unknown flag warnings.
 294                 $(use sctp && use_with sctp)
 295                 $(use_with ldns ldns "${EPREFIX}"/usr)
 296                 $(use_with libedit)
 297                 $(use_with pam)
 298                 $(use_with pie)
 299                 $(use_with selinux)
 300                 $(use_with security-key security-key-builtin)
 301                 $(use_with ssl openssl)
 302                 $(use_with ssl md5-passwords)
 303                 $(use_with ssl ssl-engine)
 304                 $(use_with !elibc_Cygwin hardening) #659210
 305         )
 306
 307         # stackprotect is broken on musl x86 and ppc
 308         use elibc_musl && ( use x86 || use ppc ) && myconf+=( --without-stackprotect )
 309
 310         # The seccomp sandbox is broken on x32, so use the older method for now. #553748
 311         use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
 312
 313         econf "${myconf[@]}"
 314 }
 315
 316 src_test() {
 317         local t skipped=() failed=() passed=()
 318         local tests=( interop-tests compat-tests )
 319
 320         local shell=$(egetshell "${UID}")
 321         if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
 322                 elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
 323                 elog "user, so we will run a subset only."
 324                 skipped+=( tests )
 325         else
 326                 tests+=( tests )
 327         fi
 328
 329         # It will also attempt to write to the homedir .ssh.
 330         local sshhome=${T}/homedir
 331         mkdir -p "${sshhome}"/.ssh
 332         for t in "${tests[@]}" ; do
 333                 # Some tests read from stdin ...
 334                 HOMEDIR="${sshhome}" HOME="${sshhome}" SUDO="" \
 335                 emake -k -j1 ${t} </dev/null \
 336                         && passed+=( "${t}" ) \
 337                         || failed+=( "${t}" )
 338         done
 339
 340         einfo "Passed tests: ${passed[*]}"
 341         [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
 342         [[ ${#failed[@]}  -gt 0 ]] && die "Some tests failed: ${failed[*]}"
 343 }
 344
 345 # Gentoo tweaks to default config files.
 346 tweak_ssh_configs() {
 347         local locale_vars=(
 348                 # These are language variables that POSIX defines.
 349                 # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
 350                 LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
 351
 352                 # These are the GNU extensions.
 353                 # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
 354                 LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
 355         )
 356
 357         # First the server config.
 358         cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
 359
 360         # Allow client to pass locale environment variables. #367017
 361         AcceptEnv ${locale_vars[*]}
 362
 363         # Allow client to pass COLORTERM to match TERM. #658540
 364         AcceptEnv COLORTERM
 365         EOF
 366
 367         # Then the client config.
 368         cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
 369
 370         # Send locale environment variables. #367017
 371         SendEnv ${locale_vars[*]}
 372
 373         # Send COLORTERM to match TERM. #658540
 374         SendEnv COLORTERM
 375         EOF
 376
 377         if use pam ; then
 378                 sed -i \
 379                         -e "/^#UsePAM /s:.*:UsePAM yes:" \
 380                         -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
 381                         -e "/^#PrintMotd /s:.*:PrintMotd no:" \
 382                         -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
 383                         "${ED}"/etc/ssh/sshd_config || die
 384         fi
 385
 386         if use livecd ; then
 387                 sed -i \
 388                         -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
 389                         "${ED}"/etc/ssh/sshd_config || die
 390         fi
 391 }
 392
 393 src_install() {
 394         emake install-nokeys DESTDIR="${D}"
 395         fperms 600 /etc/ssh/sshd_config
 396         dobin contrib/ssh-copy-id
 397         newinitd "${FILESDIR}"/sshd-r1.initd sshd
 398         newconfd "${FILESDIR}"/sshd-r1.confd sshd
 399
 400         newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
 401
 402         tweak_ssh_configs
 403
 404         doman contrib/ssh-copy-id.1
 405         dodoc CREDITS OVERVIEW README* TODO sshd_config
 406         use hpn && dodoc HPN-README
 407         use X509 || dodoc ChangeLog
 408
 409         diropts -m 0700
 410         dodir /etc/skel/.ssh
 411
 412         keepdir /var/empty
 413
 414         systemd_dounit "${FILESDIR}"/sshd.{service,socket}
 415         systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
 416 }
 417
 418 pkg_preinst() {
 419         if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]"; then
 420                 show_ssl_warning=1
 421         fi
 422 }
 423
 424 pkg_postinst() {
 425         local old_ver
 426         for old_ver in ${REPLACING_VERSIONS}; do
 427                 if ver_test "${old_ver}" -lt "5.8_p1"; then
 428                         elog "Starting with openssh-5.8p1, the server will default to a newer key"
 429                         elog "algorithm (ECDSA).  You are encouraged to manually update your stored"
 430                         elog "keys list as servers update theirs.  See ssh-keyscan(1) for more info."
 431                 fi
 432                 if ver_test "${old_ver}" -lt "7.0_p1"; then
 433                         elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
 434                         elog "Make sure to update any configs that you might have.  Note that xinetd might"
 435                         elog "be an alternative for you as it supports USE=tcpd."
 436                 fi
 437                 if ver_test "${old_ver}" -lt "7.1_p1"; then #557388 #555518
 438                         elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
 439                         elog "weak sizes.  If you rely on these key types, you can re-enable the key types by"
 440                         elog "adding to your sshd_config or ~/.ssh/config files:"
 441                         elog "  PubkeyAcceptedKeyTypes=+ssh-dss"
 442                         elog "You should however generate new keys using rsa or ed25519."
 443
 444                         elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
 445                         elog "to 'prohibit-password'.  That means password auth for root users no longer works"
 446                         elog "out of the box.  If you need this, please update your sshd_config explicitly."
 447                 fi
 448                 if ver_test "${old_ver}" -lt "7.6_p1"; then
 449                         elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
 450                         elog "Furthermore, rsa keys with less than 1024 bits will be refused."
 451                 fi
 452                 if ver_test "${old_ver}" -lt "7.7_p1"; then
 453                         elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
 454                         elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
 455                         elog "if you need to authenticate against LDAP."
 456                         elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
 457                 fi
 458                 if ver_test "${old_ver}" -lt "8.2_p1"; then
 459                         ewarn "After upgrading to openssh-8.2p1 please restart sshd, otherwise you"
 460                         ewarn "will not be able to establish new sessions. Restarting sshd over a ssh"
 461                         ewarn "connection is generally safe."
 462                 fi
 463         done
 464
 465         if [[ -n ${show_ssl_warning} ]]; then
 466                 elog "Be aware that by disabling openssl support in openssh, the server and clients"
 467                 elog "no longer support dss/rsa/ecdsa keys.  You will need to generate ed25519 keys"
 468                 elog "and update all clients/servers that utilize them."
 469         fi
 470
 471         if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
 472                 elog ""
 473                 elog "HPN's multi-threaded AES CTR cipher is currently known to be broken"
 474                 elog "and therefore disabled at runtime per default."
 475                 elog "Make sure your sshd_config is up to date and contains"
 476                 elog ""
 477                 elog "  DisableMTAES yes"
 478                 elog ""
 479                 elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
 480                 elog ""
 481         fi
 482 }