mirror of
https://github.com/archlinuxarm/PKGBUILDs.git
synced 2024-11-08 22:45:43 +00:00
added core/openssh
This commit is contained in:
Kevin Mihelich
parent
3b4e1f5584
commit
42531e0a79
8 changed files with 282 additions and 0 deletions
|
|
@ -0,0 +1,34 @@
|
|||
From 3ef92a657444f172b61f92d5da66d94fa8265602 Mon Sep 17 00:00:00 2001
|
||||
From: Lonnie Abelbeck <lonnie@abelbeck.com>
|
||||
Date: Tue, 1 Oct 2019 09:05:09 -0500
|
||||
Subject: [PATCH] Deny (non-fatal) shmget/shmat/shmdt in preauth privsep child.
|
||||
|
||||
New wait_random_seeded() function on OpenSSL 1.1.1d uses shmget, shmat, and shmdt
|
||||
in the preauth codepath, deny (non-fatal) in seccomp_filter sandbox.
|
||||
---
|
||||
sandbox-seccomp-filter.c | 9 +++++++++
|
||||
1 file changed, 9 insertions(+)
|
||||
|
||||
diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
|
||||
index 840c5232..39dc289e 100644
|
||||
--- a/sandbox-seccomp-filter.c
|
||||
+++ b/sandbox-seccomp-filter.c
|
||||
@@ -168,6 +168,15 @@ static const struct sock_filter preauth_insns[] = {
|
||||
#ifdef __NR_stat64
|
||||
SC_DENY(__NR_stat64, EACCES),
|
||||
#endif
|
||||
+#ifdef __NR_shmget
|
||||
+ SC_DENY(__NR_shmget, EACCES),
|
||||
+#endif
|
||||
+#ifdef __NR_shmat
|
||||
+ SC_DENY(__NR_shmat, EACCES),
|
||||
+#endif
|
||||
+#ifdef __NR_shmdt
|
||||
+ SC_DENY(__NR_shmdt, EACCES),
|
||||
+#endif
|
||||
|
||||
/* Syscalls to permit */
|
||||
#ifdef __NR_brk
|
||||
--
|
||||
2.23.0
|
||||
|
||||
99
core/openssh/PKGBUILD
Normal file
99
core/openssh/PKGBUILD
Normal file
|
|
@ -0,0 +1,99 @@
|
|||
# Maintainer: Gaetan Bisson <bisson@archlinux.org>
|
||||
# Contributor: Aaron Griffin <aaron@archlinux.org>
|
||||
# Contributor: judd <jvinet@zeroflux.org>
|
||||
|
||||
# ALARM: Kevin Mihelich <kevin@archlinuxarm.org>
|
||||
# - upstream patch for older kernels
|
||||
|
||||
pkgname=openssh
|
||||
pkgver=8.0p1
|
||||
pkgrel=3.1
|
||||
pkgdesc='Premier connectivity tool for remote login with the SSH protocol'
|
||||
url='https://www.openssh.com/portable.html'
|
||||
license=('custom:BSD')
|
||||
arch=('x86_64')
|
||||
makedepends=('linux-headers')
|
||||
depends=('krb5' 'openssl' 'libedit' 'ldns')
|
||||
optdepends=('xorg-xauth: X11 forwarding'
|
||||
'x11-ssh-askpass: input passphrase in X')
|
||||
validpgpkeys=('59C2118ED206D927E667EBE3D3E5F56B6D920D30')
|
||||
source=("https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/${pkgname}-${pkgver}.tar.gz"{,.asc}
|
||||
'0001-Deny-non-fatal-shmget-shmat-shmdt-in-preauth-privsep.patch'
|
||||
'sshdgenkeys.service'
|
||||
'sshd.service'
|
||||
'sshd.conf'
|
||||
'sshd.pam')
|
||||
sha256sums=('bd943879e69498e8031eb6b7f44d08cdc37d59a7ab689aa0b437320c3481fd68'
|
||||
'SKIP'
|
||||
'7db444c72d91563996f4afaa69a52c6380bdaa6f7f159fb2de6138cc1451645d'
|
||||
'4031577db6416fcbaacf8a26a024ecd3939e5c10fe6a86ee3f0eea5093d533b7'
|
||||
'e40f8b7c8e5e2ecf3084b3511a6c36d5b5c9f9e61f2bb13e3726c71dc7d4fbc7'
|
||||
'4effac1186cc62617f44385415103021f72f674f8b8e26447fc1139c670090f6'
|
||||
'64576021515c0a98b0aaf0a0ae02e0f5ebe8ee525b1e647ab68f369f81ecd846')
|
||||
|
||||
backup=('etc/ssh/ssh_config' 'etc/ssh/sshd_config' 'etc/pam.d/sshd')
|
||||
|
||||
install=install
|
||||
|
||||
prepare() {
|
||||
cd "${srcdir}/${pkgname}-${pkgver}"
|
||||
patch -p1 -i ../0001-Deny-non-fatal-shmget-shmat-shmdt-in-preauth-privsep.patch
|
||||
}
|
||||
|
||||
build() {
|
||||
cd "${srcdir}/${pkgname}-${pkgver}"
|
||||
|
||||
./configure \
|
||||
--prefix=/usr \
|
||||
--sbindir=/usr/bin \
|
||||
--libexecdir=/usr/lib/ssh \
|
||||
--sysconfdir=/etc/ssh \
|
||||
--with-ldns \
|
||||
--with-libedit \
|
||||
--with-ssl-engine \
|
||||
--with-pam \
|
||||
--with-privsep-user=nobody \
|
||||
--with-kerberos5=/usr \
|
||||
--with-xauth=/usr/bin/xauth \
|
||||
--with-md5-passwords \
|
||||
--with-pid-dir=/run \
|
||||
--with-default-path='/usr/local/sbin:/usr/local/bin:/usr/bin' \
|
||||
|
||||
make
|
||||
}
|
||||
|
||||
check() {
|
||||
cd "${srcdir}/${pkgname}-${pkgver}"
|
||||
|
||||
# Tests require openssh to be already installed system-wide,
|
||||
# also connectivity tests will fail under makechrootpkg since
|
||||
# it runs as nobody which has /bin/false as login shell.
|
||||
|
||||
if [[ -e /usr/bin/scp && ! -e /.arch-chroot ]]; then
|
||||
make tests
|
||||
fi
|
||||
}
|
||||
|
||||
package() {
|
||||
cd "${srcdir}/${pkgname}-${pkgver}"
|
||||
|
||||
make DESTDIR="${pkgdir}" install
|
||||
|
||||
ln -sf ssh.1.gz "${pkgdir}"/usr/share/man/man1/slogin.1.gz
|
||||
install -Dm644 LICENCE "${pkgdir}/usr/share/licenses/${pkgname}/LICENCE"
|
||||
|
||||
install -Dm644 ../sshdgenkeys.service "${pkgdir}"/usr/lib/systemd/system/sshdgenkeys.service
|
||||
install -Dm644 ../sshd.service "${pkgdir}"/usr/lib/systemd/system/sshd.service
|
||||
install -Dm644 ../sshd.conf "${pkgdir}"/usr/lib/tmpfiles.d/sshd.conf
|
||||
install -Dm644 ../sshd.pam "${pkgdir}"/etc/pam.d/sshd
|
||||
|
||||
install -Dm755 contrib/findssl.sh "${pkgdir}"/usr/bin/findssl.sh
|
||||
install -Dm755 contrib/ssh-copy-id "${pkgdir}"/usr/bin/ssh-copy-id
|
||||
install -Dm644 contrib/ssh-copy-id.1 "${pkgdir}"/usr/share/man/man1/ssh-copy-id.1
|
||||
|
||||
sed \
|
||||
-e '/^#ChallengeResponseAuthentication yes$/c ChallengeResponseAuthentication no' \
|
||||
-e '/^#PrintMotd yes$/c PrintMotd no # pam does that' \
|
||||
-e '/^#UsePAM no$/c UsePAM yes' \
|
||||
-i "${pkgdir}"/etc/ssh/sshd_config
|
||||
}
|
||||
93
core/openssh/PKGBUILD.snap
Normal file
93
core/openssh/PKGBUILD.snap
Normal file
|
|
@ -0,0 +1,93 @@
|
|||
# Maintainer: Gaetan Bisson <bisson@archlinux.org>
|
||||
# Contributor: Aaron Griffin <aaron@archlinux.org>
|
||||
# Contributor: judd <jvinet@zeroflux.org>
|
||||
|
||||
pkgname=openssh
|
||||
_YMD=20190414
|
||||
pkgver=8.0snap$_YMD
|
||||
pkgrel=1
|
||||
pkgdesc='Premier connectivity tool for remote login with the SSH protocol'
|
||||
url='https://www.openssh.com/portable.html'
|
||||
license=('custom:BSD')
|
||||
arch=('x86_64')
|
||||
makedepends=('linux-headers')
|
||||
depends=('krb5' 'openssl' 'libedit' 'ldns')
|
||||
optdepends=('xorg-xauth: X11 forwarding'
|
||||
'x11-ssh-askpass: input passphrase in X')
|
||||
validpgpkeys=('59C2118ED206D927E667EBE3D3E5F56B6D920D30')
|
||||
#source=("https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/${pkgname}-${pkgver}.tar.gz"{,.asc}
|
||||
source=("http://www.mindrot.org/openssh_snap/openssh-SNAP-$_YMD.tar.gz"
|
||||
'sshdgenkeys.service'
|
||||
'sshd.service'
|
||||
'sshd.conf'
|
||||
'sshd.pam')
|
||||
#sha256sums=('6b4b3ba2253d84ed3771c8050728d597c91cfce898713beb7b64a305b6f11aad3'
|
||||
# 'SKIP'
|
||||
sha256sums=('6b4b3ba2253d84ed3771c8050728d597c91cfce898713beb7b64a305b6f11aad'
|
||||
'4031577db6416fcbaacf8a26a024ecd3939e5c10fe6a86ee3f0eea5093d533b7'
|
||||
'e40f8b7c8e5e2ecf3084b3511a6c36d5b5c9f9e61f2bb13e3726c71dc7d4fbc7'
|
||||
'4effac1186cc62617f44385415103021f72f674f8b8e26447fc1139c670090f6'
|
||||
'64576021515c0a98b0aaf0a0ae02e0f5ebe8ee525b1e647ab68f369f81ecd846')
|
||||
|
||||
backup=('etc/ssh/ssh_config' 'etc/ssh/sshd_config' 'etc/pam.d/sshd')
|
||||
|
||||
build() {
|
||||
# cd "${srcdir}/${pkgname}-${pkgver}"
|
||||
cd "${srcdir}/${pkgname}"
|
||||
|
||||
./configure \
|
||||
--prefix=/usr \
|
||||
--sbindir=/usr/bin \
|
||||
--libexecdir=/usr/lib/ssh \
|
||||
--sysconfdir=/etc/ssh \
|
||||
--with-ldns \
|
||||
--with-libedit \
|
||||
--with-ssl-engine \
|
||||
--with-pam \
|
||||
--with-privsep-user=nobody \
|
||||
--with-kerberos5=/usr \
|
||||
--with-xauth=/usr/bin/xauth \
|
||||
--with-md5-passwords \
|
||||
--with-pid-dir=/run \
|
||||
--with-default-path='/usr/local/sbin:/usr/local/bin:/usr/bin' \
|
||||
|
||||
make
|
||||
}
|
||||
|
||||
check() {
|
||||
# cd "${srcdir}/${pkgname}-${pkgver}"
|
||||
cd "${srcdir}/${pkgname}"
|
||||
|
||||
# Tests require openssh to be already installed system-wide,
|
||||
# also connectivity tests will fail under makechrootpkg since
|
||||
# it runs as nobody which has /bin/false as login shell.
|
||||
|
||||
if [[ -e /usr/bin/scp && ! -e /.arch-chroot ]]; then
|
||||
make tests
|
||||
fi
|
||||
}
|
||||
|
||||
package() {
|
||||
# cd "${srcdir}/${pkgname}-${pkgver}"
|
||||
cd "${srcdir}/${pkgname}"
|
||||
|
||||
make DESTDIR="${pkgdir}" install
|
||||
|
||||
ln -sf ssh.1.gz "${pkgdir}"/usr/share/man/man1/slogin.1.gz
|
||||
install -Dm644 LICENCE "${pkgdir}/usr/share/licenses/${pkgname}/LICENCE"
|
||||
|
||||
install -Dm644 ../sshdgenkeys.service "${pkgdir}"/usr/lib/systemd/system/sshdgenkeys.service
|
||||
install -Dm644 ../sshd.service "${pkgdir}"/usr/lib/systemd/system/sshd.service
|
||||
install -Dm644 ../sshd.conf "${pkgdir}"/usr/lib/tmpfiles.d/sshd.conf
|
||||
install -Dm644 ../sshd.pam "${pkgdir}"/etc/pam.d/sshd
|
||||
|
||||
install -Dm755 contrib/findssl.sh "${pkgdir}"/usr/bin/findssl.sh
|
||||
install -Dm755 contrib/ssh-copy-id "${pkgdir}"/usr/bin/ssh-copy-id
|
||||
install -Dm644 contrib/ssh-copy-id.1 "${pkgdir}"/usr/share/man/man1/ssh-copy-id.1
|
||||
|
||||
sed \
|
||||
-e '/^#ChallengeResponseAuthentication yes$/c ChallengeResponseAuthentication no' \
|
||||
-e '/^#PrintMotd yes$/c PrintMotd no # pam does that' \
|
||||
-e '/^#UsePAM no$/c UsePAM yes' \
|
||||
-i "${pkgdir}"/etc/ssh/sshd_config
|
||||
}
|
||||
20
core/openssh/install
Normal file
20
core/openssh/install
Normal file
|
|
@ -0,0 +1,20 @@
|
|||
pre_upgrade() {
|
||||
# Remove socket activation. See: https://bugs.archlinux.org/task/62248
|
||||
if (( $(vercmp $2 8.0p1-3) < 0 )); then
|
||||
if systemctl is-enabled -q sshd.socket; then
|
||||
cat <<EOF
|
||||
==> This package no longer provides sshd.socket and sshd@.service;
|
||||
==> copies of those files will be placed under /etc/systemd/system
|
||||
==> but please migrate to sshd.service whenever possible.
|
||||
EOF
|
||||
src=/usr/lib/systemd/system
|
||||
dst=/etc/systemd/system
|
||||
for i in sshd.socket sshd\@.service; do
|
||||
if [[ ! -e "$dst/$i" ]]; then
|
||||
cp -v "$src/$i" "$dst/$i"
|
||||
fi
|
||||
done
|
||||
systemctl reenable sshd.socket
|
||||
fi
|
||||
fi
|
||||
}
|
||||
1
core/openssh/sshd.conf
Normal file
1
core/openssh/sshd.conf
Normal file
|
|
@ -0,0 +1 @@
|
|||
d /var/empty 0755 root root
|
||||
6
core/openssh/sshd.pam
Normal file
6
core/openssh/sshd.pam
Normal file
|
|
@ -0,0 +1,6 @@
|
|||
#%PAM-1.0
|
||||
#auth required pam_securetty.so #disable remote root
|
||||
auth include system-remote-login
|
||||
account include system-remote-login
|
||||
password include system-remote-login
|
||||
session include system-remote-login
|
||||
14
core/openssh/sshd.service
Normal file
14
core/openssh/sshd.service
Normal file
|
|
@ -0,0 +1,14 @@
|
|||
[Unit]
|
||||
Description=OpenSSH Daemon
|
||||
Wants=sshdgenkeys.service
|
||||
After=sshdgenkeys.service
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
ExecStart=/usr/bin/sshd -D
|
||||
ExecReload=/bin/kill -HUP $MAINPID
|
||||
KillMode=process
|
||||
Restart=always
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
15
core/openssh/sshdgenkeys.service
Normal file
15
core/openssh/sshdgenkeys.service
Normal file
|
|
@ -0,0 +1,15 @@
|
|||
[Unit]
|
||||
Description=SSH Key Generation
|
||||
ConditionPathExists=|!/etc/ssh/ssh_host_dsa_key
|
||||
ConditionPathExists=|!/etc/ssh/ssh_host_dsa_key.pub
|
||||
ConditionPathExists=|!/etc/ssh/ssh_host_ecdsa_key
|
||||
ConditionPathExists=|!/etc/ssh/ssh_host_ecdsa_key.pub
|
||||
ConditionPathExists=|!/etc/ssh/ssh_host_ed25519_key
|
||||
ConditionPathExists=|!/etc/ssh/ssh_host_ed25519_key.pub
|
||||
ConditionPathExists=|!/etc/ssh/ssh_host_rsa_key
|
||||
ConditionPathExists=|!/etc/ssh/ssh_host_rsa_key.pub
|
||||
|
||||
[Service]
|
||||
ExecStart=/usr/bin/ssh-keygen -A
|
||||
Type=oneshot
|
||||
RemainAfterExit=yes
|
||||
Loading…
Reference in a new issue