ssh-agent regression test case should be run by non-root user,
but non-root user will has issue to run other testcase, so
rewrite it on run-ptest
(From OE-Core rev: 5ca6bb9b73bf09c1847ec3e5a7477829bd3d77b5)
Signed-off-by: Roy Li <rongqing.li@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
When distro feature x11 is set, it is better enable X11Forwarding for
ssh daemon. For contrast, dropbear enable X11 forward by default.
It does NOT need to modify ${WORKDIR}/sshd_config, so drop the modification.
(From OE-Core rev: 0dc68d745f97753fc9fde896f6ee1943c1e071b3)
Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
ptests were failing and many more were being silently skipped because
required binaries were not being built.
Build the binaries in regress/ and set SUDO environment variable in
run-ptests: after this all tests in regress/ are now run. Continue to
skip building binaries in regress/unittests/: unittest runtime is
excessive.
On a NUC running intel-corei7-64 core-image-sato, new results are:
PASS: 55, SKIP: 3, FAIL: 0
[YOCTO #8153]
(From OE-Core rev: 1f7aaf76f4aa7875f05f4b838a5ec4594a4c35dc)
Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The patch fixes the login fails for ssh -o Batchmode=yes when passwords is
empty and without authorized_keys file even if set "PermitEmptyPasswords yes"
in sshd_config file.
Here, to fix this issue, we remove the file auth2-none.c-avoid-authenticate-
empty-passwords-to-m.patch, that fixed broken pipe while sshd with pam,
but it isn't needed any more now, because we make it has gone by change
ChallengeResponseAuthentication value in sshd_config file.
(From OE-Core rev: f879a7406d8fce37e8baf5fe724d7ed0042d57f8)
Signed-off-by: Wenlin Kang <wenlin.kang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Its a major releaseof openssh, should be fully
compatible with 6.7 additionally works with musl
Change-Id: I903d31247b8a318b9be1c21f764ffe56b5971ca9
(From OE-Core rev: 4ac2974f463f8e2970d9e44e3b273c672a3cab8c)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
If maillock.h is found, a dependency on liblockfile will be created.
liblockfile is in meta-oe, so we don't want that in an oe-core recipe.
(From OE-Core rev: b2cee9b9f08dff41e46e227b1ffa5e46e98faa89)
Signed-off-by: Dan McGregor <dan.mcgregor@usask.ca>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Rebase sshd_config and ssh_config with openssh upstream.
Check for the ed25519 key in the systemd keygen service.
(From OE-Core rev: 046dd5567d9de0596023846e7f0c6df7f01a9f5b)
Signed-off-by: Dan McGregor <dan.mcgregor@usask.ca>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Deliver script ssh-copy-id from openssh which is useful to add an
authorized ssh key.
(From OE-Core rev: 16562034a2c28cbfc6c90f9324c42c08e0655b7d)
Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* Drop two CVE patches already handled upstream.
* Drop nostrip.patch which no longer applies and use the existing
--disable-strip configure option instead.
* OpenSSH 6.7+ no longer supports tcp wrappers. We could apply the
Debian patch to add support back in, but it seems best to follow
upstream here unless we have a good reason to do otherwise.
(From OE-Core rev: 59e0833e24e4945569d36928dc0f231e822670ba)
Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Using the export LD in the recipe does not allow for secodnary toolchain
overriding LD later, by setting it in the do_configure_append the export
is used by autotools setting LD based on the env, but would allow for
override later.
[YOCTO #6997]
(From OE-Core rev: 9b37e630f5f6e37e928f825c4f67481cf58c98a1)
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Currently, we install our own ssh_config and sshd_config into ${S} in
do_compile_append() task. So when finishing compiling, their .out files
are generated by the original files, rather than by our own files.
In most cases, installing "$(CONFIGFILES)" in Makefile will generate .out
files again, and then installing "install-sysconf", which will install
these two files into $(DESTDIR), thus we get what we expect.
However, when parallel installing, "install-sysconf" may be installed
before "$(CONFIGFILES)" sometimes. In this rare case, the .out files
generated in the first time rather than those in the second time will be
installed into $(DESTDIR), and thus we get an unexpect result.
This patch fixes this bug through transfering the installing of our own
files from do_compile_append() into do_configure_prepend().
(From OE-Core rev: 6a60a4ba8d8e529882daa33140c9a2fc08714fb2)
Signed-off-by: Zheng Junling <zhengjunling@huawei.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Tell systemd just to kill the sshd process when the ssh connection drops
instead of the entire cgroup for sshd, so that any screen sessions (and
more to the point, processes within them) do not get killed.
(This is what the Fedora sshd service file does, and what we're already
doing in the dropbear service file).
(From OE-Core rev: 3c238dff41fbd3687457989c7b17d22b2cc844be)
Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Stopping sshd must only kill the listening (top-level) daemon; it must
not stop any other sshd process, because those are forked ssh
connections which may include e.g. the connection that called
/etc/init.d/sshd stop.
This initscript uses "start-stop-daemon -x <exe>" for starting/stopping.
When that is provided by busybox, this behavior is broken:
`/etc/init.d/sshd stop` stops *all* sshd processes. This was caused by a
fix to busybox 1.20: 17eedcad9406c43beddab3906c8c693626c351fb
"ssd: compat: match -x EXECUTABLE by /proc/pid/exe too".
The fix is to use a pidfile. All initscripts in upstream openssh do this,
as does dropbear.
Acked-by: Gratian Crisan <gratian.crisan@ni.com>
Acked-by: Ken Sharp <ken.sharp@ni.com>
(From OE-Core rev: 993405285e547403d5c753adfa91c26c43be13f6)
Signed-off-by: Richard Tollerton <rich.tollerton@ni.com>
Signed-off-by: Ben Shelton <ben.shelton@ni.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Previously, even if PAM is enabled for ssh, the daemon still tries to
authenticate an empty password. This leads to authentication failure
which would mess up with PAM modules.
As a result, if 'UsePAM', 'PermitEmptyPasswords' and 'PasswordAuthentication'
are enabled, no user can login correctly. We would meet the following error
message at the client side.
Write failed: Broken Pipe
This patch fixes the above problem by checking whether PAM is enabled before
authenticating an empty password. After all, if PAM is enabled, the task of
authenticating passwords should be handled to PAM modules.
[YOCTO #6466]
(From OE-Core rev: e017ae71dad4837b0d22f291b0b0e0949075f822)
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The verify_host_key function in sshconnect.c in the client in OpenSSH 6.6 and
earlier allows remote servers to trigger the skipping of SSHFP DNS RR checking
by presenting an unacceptable HostCertificate.
(From OE-Core rev: 7b2fff61b3d1c0566429793ee348fa8978ef0cba)
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
sshd in OpenSSH before 6.6 does not properly support wildcards on
AcceptEnv lines in sshd_config, which allows remote attackers to
bypass intended environment restrictions by using a substring located
before a wildcard character.
(From OE-Core rev: a8d3b8979c27a8dc87971b66a1d9d9282f660596)
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The /var/log/messages reports /var/log/lastlog as missing, since openssh
needs this file, create it as a volatile.
[YOCTO #6172]
(From OE-Core rev: a29af8c20187a65fbdbbedd0b7158c07d3e713cf)
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The base_contains is kept as a compatibility method and we ought to
not use it in OE-Core so we can remove it from base metadata in
future.
(From OE-Core rev: d83b16dbf0862be387f84228710cb165c6d2b03b)
Signed-off-by: Otavio Salvador <otavio@ossystems.com.br>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Install openssh test-suite and run it as ptest.
(From OE-Core rev: 4d0ecccae671bffb40c870a6e33d20be869b89bc)
Signed-off-by: Maxin B. John <maxin.john@enea.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
If you do a readelf -x .rodata /path/.../to/openssh/6.5p1-r0/packages-split/openssh-sshd/usr/sbin/sshd
You'll see two references to OE's sysroots/${BUILD_SYS} login and passwd binaries.
First one can be overridden with LOGIN_PROGRAM environment variable (see configure.ac),
second needs a cached variable definition.
(From OE-Core rev: 2127c80d0cc2a3a4d676bd3c0890454a175fba8e)
Signed-off-by: Matthieu Crapet <Matthieu.Crapet@ingenico.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The readonly sshd config sshd_config_readonly needs to be created from
the installed sshd_config as make install will adjust the paths in
the config file. This fixes the path for sftp-server being correct
in sshd_config but incorrect in sshd_config_readonly.
(From OE-Core rev: 400b4bce34ffb76e500e2195104cc200218aa4c3)
Signed-off-by: Jonathan Liu <net147@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
We do not DEPEND on libbsd, so we do not want to
build with it just because libutil.h is found by configure.
As noted in the patch, specifying --disable-libutil to
configure does not work, so we provide "cached" configure
variables.
(From OE-Core rev: 103ef2295c728e427acc27bb071e786946c459f2)
Signed-off-by: Joe Slater <jslater@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This patch goes through the OE-Core recipes and marks those which use autotools
but don't support a separate build directory (${S} != ${B}). A new class,
autotools-brokensep is used for this purpose.
This doesn't introduce any change in behaviour in its own right.
(From OE-Core rev: 006b8a7808a58713af16c326dc37d07765334b12)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Everything is setup to use PAM except for the server config. If 'pam' is
in DISTRO_FEATURES the configs will be changed to enable it.
Syslog will now show:
Feb 19 09:28:36 beast sshd[2980]: pam_unix(sshd:session): session opened for user koen by (uid=0)
And more importantly:
koen@beast:~$ loginctl
SESSION UID USER SEAT
c1 1000 koen seat0
c3 1000 koen seat0
c13 1000 koen
3 sessions listed.
Systemd now registers the session properly so it won't kill things like 'screen'
and 'tmux' when disconnecting the ssh session.
(From OE-Core rev: 08c523daec0f5161803d2a6704402490c18ff6ca)
Signed-off-by: Koen Kooi <koen.kooi@linaro.org>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
/etc/pam.d/opensshd lists keyinit and uid as required, so add them to
RDEPENDS when PAM is enabled.
(From OE-Core rev: b2f49f9d2d8cd033611108c2bfe4871d02df0887)
Signed-off-by: Koen Kooi <koen@dominion.thruhere.net>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Instead of manually adding initscripts to RDEPENDS of each package,
we should make it automatically handled by the update-rc.d.bbclass.
This solution would have the benefit of backward compatibility. In
other words, users need not modify their recipes.
This reverts commit 16080a3485.
(From OE-Core rev: f9f193219bd510160b6b09bae652a9dc8ea01e7b)
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This patch contains a few fixes for the systemd unit files of openssh.
The fixes use the same unit files in Fedora 20 as a reference.
1) Remove sshdgenkeys.service and sshd@.service from SYSTEMD_SERVICE.
2) Fix the dependency and logic of sshdgenkeys.service.
(From OE-Core rev: 4379e6f3096c893db5fa6a0b4569a0440e4494fe)
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Now that the initscripts-functions has been packaged separately,
packages which may use the functions script should have a runtime
dependency on it.
(From OE-Core rev: 6690c12cb1977f6bf93f3eb6d471dbd7db81bf28)
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
ssh-rand-helper was removed in OpenSSH 6.0 according to the upstream
changelog, so the configure option to enable/disable it was removed.
Fixes the following warning:
WARNING: QA Issue: openssh: configure was passed unrecognised options: --with-rand-helper
(From OE-Core rev: 77d0e383303e9209ea2cd74f2eb98e3ed516b67c)
Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Using the contains function results in more optimal sstate checksums
resulting in better cache reuse as we as more consistent code.
(From OE-Core rev: 9c93526756e7cbbff027c88eb972f877bcb1f057)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
sshd status command results in error prompt:
root@qemu0:~# /etc/init.d/sshd status
/usr/sbin/sshd (pid 1199) is running...
/etc/init.d/sshd: line 100: return: can only `return' from a
function or sourced script
"service --status-all" command also display wrong status for sshd.
This commit fix this error prompt and make service command display
right status for sshd.
(From OE-Core rev: e7cf83ec3f39a7c41e38c6030b0d903fa7d37b2a)
Signed-off-by: Qiang Chen <qiang.chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
It fixes the following failure:
"fatal: Missing privilege separation directory: /var/run/sshd"
when sshd is started through xinetd.
(From OE-Core rev: a343c32891aa46a7f7d5f0cc6d1266a387900dad)
Signed-off-by: Ming Liu <ming.liu@windriver.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
If the rootfs is read-only and the ssh keys are not available at system
start-up, the init script will generate ssh keys into /etc/ssh, thus
causing a 'read-only file system' error.
In order for Yocto based image to work correctly for read-only rootfs,
we use the following logic for openssh.
If the rootfs is read-only and there are pre-generated keys under /etc/ssh,
we use the pre-generated keys. Note the pre-generated keys are mainly for
debugging or development purpose.
If the rootfs is read-only and there are no pre-generated keys under
/etc/ssh, we use /var/run/ssh as the location for ssh keys. That is, at
system boot-up, the generated ssh keys will put into /var/run/ssh.
[YOCTO #4887]
(From OE-Core rev: 2ed44745024f04aa4e00ddba3009153c6b47c8e9)
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
