aboutsummaryrefslogtreecommitdiffstats
path: root/meta/recipes-connectivity/openssh
AgeCommit message (Collapse)Author
2019-01-11openssh: use tarballs instead of gitAlexander Kanavin
This was change to git recently to obtain openssl 1.1 compatible pre-release code (before 7.9 was out), however tarballs are preferred, and with them upstream version checks work (openssh uses a weird git tag scheme). Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-11-09openssh: Update to 7.9 primarily bug fixesArmin Kuster
see: https://lwn.net/Articles/768991/ Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-09-19openssh: upgrade 7.8p1 -> 7.8p1+git to support openssl 1.1.xHongxu Jia
- Convert from tarball to git repository which support openssl 1.1.x - There is no specific minor version that contains the openssl fix (it was merged to master a few days agao), rename recipe version to `7.8p1+git' - Fix regression test binaries missing In commit `1f7aaf7 openssh: build regression test binaries', it build regression test binaries, since upstream add two binaries in commits `c59aca8 Create control sockets in clean temp directories' and `1acc058 Disable tests where fs perms are incorrect', we should update do_compile_ptest. [ptest log] |/usr/lib/openssh/ptest/regress/test-exec.sh: line 330: /usr/lib/openssh/ ptest/regress/mkdtemp: No such file or directory [ptest log] Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-09-04openssh: update from 7.7p1 to 7.8p1Randy MacLeod
Drop the disable-ciphers patch since it has been integrated: cec33896 Omit 3des-cbc if OpenSSL built without DES. Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-06-18openssh: add nativesdk supportMikko Rapeli
And use bitbake variables for install paths to fix nativesdk-openssh compilation. Signed-off-by: Mikko Rapeli <mikko.rapeli@bmw.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-06-15openssh: only create sshd host keys which have been enabledAndre McCurdy
Previously sshd_check_keys would create a full set of all possible sshd host keys, even if sshd_config has been set to only enable certain key types. Update sshd_check_keys to only create keys which have been enabled in sshd_config (with a fallback to creating a full set of key types if no HostKey options are defined, as before). Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-06-15openssh: sync local ssh_config + sshd_config files with upstream 7.7p1Andre McCurdy
Changes are mostly related to the removal of support for SSH v.1 protocol, which was dropped from openssh sshd in 7.4p1: https://www.openssh.com/txt/release-7.4 Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-06-15openssh: minor indent cleanup for sshd init scriptAndre McCurdy
The openssh sshd init script contains a mix of indent styles, mostly inherited from the Debian script from which it is derived. Leave the indent from Debian as-is, but for lines which are OE specific (e.g. where Debian's log_daemon_msg helper has been replaced with echo) make the indent consistent with surrounding lines. Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-06-15openssh: drop RCONFLICTS for openssh-keygenAndre McCurdy
The "ssh-keygen" package no longer seems to be provided by any recipe in oe-core or meta-oe, so there's no clear reason for the openssh-keygen package to conflict with it. Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-06-15openssh: stop adding -D__FILE_OFFSET_BITS=64 to CFLAGSAndre McCurdy
Openssh takes care of enabling large-file support automatically via the AC_SYS_LARGEFILE in the configure.ac, so additional help from the recipe is not required. Even if it were once required, defining __FILE_OFFSET_BITS (ie with double leading underscores) looks like a typo and probably never had any effect anyway? Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-06-07openssh: drop sshd support for DSA host keysAndre McCurdy
DSA keys have been deprecated for some time: https://www.gentoo.org/support/news-items/2015-08-13-openssh-weak-keys.html Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-05-29openssh: upgrade 7.6p1 -> 7.7p1Armin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-04-19openssh: disable ciphers not supported by OpenSSL DESHongxu Jia
While compiling openssl with option `no-des', it caused the openssh build failure ... cipher.c:85:41: error: 'EVP_des_ede3_cbc' undeclared here (not in a function); ... OpenSSL configured that way defines OPENSSL_NO_DES to disable des Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-03-03openssh: remove unused patchMaxin B. John
Remove unused patch: 0001-openssh-Fix-syntax-error-on-x32.patch Signed-off-by: Maxin B. John <maxin.john@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-01-22openssh: Disable wtmp when using musl libcPaul Barker
musl doesn't implement wtmp/utmp. Signed-off-by: Paul Barker <pbarker@toganlabs.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-12-10openssh: don't do aclocal/acinclude danceRoss Burton
Instead, just stop running aclocal. Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-11-05openssh: update to 7.6Armin Kuster
LICENSE changed do to name being added removed patches included in some form Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-10-06openssh: Atomically generate host keysJoshua Watt
Generating the host keys atomically prevents power interruptions during the first boot from leaving the key files incomplete, which often prevents users from being able to ssh into the device. [YOCTO #11671] Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-09-25openssh: Fix key generation with systemdJoshua Watt
106b59d9 broke SSH host key generation when systemd and a read-only root file system are in use because there isn't a way for systemd to get the optional weak assigment of SYSCONFDIR from /etc/default/sshd and still provide a default value if it is not specified. Instead, move the logic for determining if keys need to be created to a helper script that both the SysV init script and the systemd unit file can reference. This does mean that the systemd unit file can't check for file existence to know if it should start the service, but it wasn't able to do that correctly anyway anymore. This should be a problem since the serivce is only run once per power cycle by systemd, and should exit quickly if the keys already exist Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-08-29openssh: Fix syntax error on x32sweeaun
Fix compilation error during openssh x32 build due to syntax error. Signed-off-by: sweeaun <swee.aun.khor@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-11openssh: depend on openssl 1.0Alexander Kanavin
The proposed openssl 1.1 patches are here: https://github.com/openssh/openssh-portable/pull/48 Openssl maintainers are not in a hurry to get 1.1 support in; if it doesn't show up within reasonable time, we can take a patch from Fedora: http://lists.mindrot.org/pipermail/openssh-unix-dev/2016-November/035454.html Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-06-28openssh: Remove deprecated sshd optionGary Thomas
The UsePrivilegeSeparation is no longer supported (recent SSHD always runs with previlege separation), so remove this option from the default config file to avoid this warning: /etc/ssh/sshd_config line 110: Deprecated option UsePrivilegeSeparation Signed-off-by: Gary Thomas <gary@mlbassoc.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-06-27meta: Fix malformed Upstream-Status tagsRoss Burton
Fix a variety of spelling and format mistakes to improve the ease of reading the tags programatically. Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-06-16meta: Drop remnants of uclibc supportRichard Purdie
uclibc support was removed a while ago and musl works much better. Start to remove the various overrides and patches related to uclibc which are no longer needed. uclibc support in a layer would still be possible. I have strong reasons to believe nobody is still using uclibc since patches are missing and I doubt the metadata even parses anymore. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-06-12openssh: allow to override OpenSSL HostKeys when read-only-rootfsAndré Draszik
With these changes it is possible to have a .bbappend that - sets SYSCONFDIR to some persistent storage - modifies SYSCONFDIR/sshd_config to use ssh host keys from the (writable) sysconfdir Signed-off-by: André Draszik <adraszik@tycoint.com> Reviewed-by: Stephane Ayotte <sayotte@tycoint.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-05-12openssh: upgrade to 7.5p1Dengke Du
Signed-off-by: Dengke Du <dengke.du@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-03-01recipes: Make use of the new bb.utils.filter() functionPeter Kjellerstedt
Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-26openssh: upgrade to 7.4p1Dengke Du
1. Drop CVE patch: fix-CVE-2016-8858.patch, because the version 7.4p1 have been fixed it. 2. Rebase the remaining patchs on the version 7.4p1. Signed-off-by: Dengke Du <dengke.du@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-11-23openssh: fix CVE-2016-8858Kai Kang
Backport patch to fix CVE-2016-8858 of openssh. Ref: https://bugzilla.redhat.com/show_bug.cgi?id=1384860 Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-09-20openssh: fix potential signed overflow to enable compilation with -ftrapvYuanjie Huang
Pointer arithmatic results in implementation defined signed integer type, so that 's - src' in strlcpy and others may trigger signed overflow. In case of compilation by gcc or clang with -ftrapv option, the overflow would lead to program abort. Upstream-status: Submitted [https://bugzilla.mindrot.org/show_bug.cgi?id=2608] Signed-off-by: Yuanjie Huang <yuanjie.huang@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-08-23openssh: Upgrade 7.2p2 -> 7.3p1Jussi Kukkonen
Remove CVE-2015-8325.patch as it's included upstream. Rebase another patch. Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-08-18openssh: add ed25519 host key location to read-only sshd configAndré Draszik
It's simply been missing. Signed-off-by: André Draszik <git@andred.net> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-08-04meta: add more missing patch tagsRoss Burton
Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-07-25openssh: conditional compile DES code.mingli.yu@windriver.com
After openssl disabled DES, openssh fails to build for some DES codes are not wrapped in conditional compile statement "#ifndef OPENSSL_NO_DES" and "#endif". Signed-off-by: Haiqing Bai <Haiqing.Bai@windriver.com> Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-06-23openssh: fix init script restart with read-only-rootfsMatthew Campbell
restart in the init script uses the check_config() function which doesn't have the $SSHD_OPTS passed through. This causes it to check the wrong config (and fail when read-only-rootfs is enabled. Signed-off-by: Matthew Campbell <mcampbell@izotope.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-05-20openssh: update homepage and summaryStephano Cetola
The homepage variable is out of date and the summary does not mention ssh, making the recipe difficult to find. [ YOCTO #9610 ] Signed-off-by: Stephano Cetola <stephano.cetola@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-05-19openssh: Backport fix for CVE-2015-8325Jussi Kukkonen
PAM environment vars must be ignored when UseLogin=yes Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-19openssh: Upgrade 7.1p2 -> 7.2p2Jussi Kukkonen
Remove patches that are in the release. Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-17openssh: change URI to http:Ross Burton
The OpenBSD FTP server isn't accepting connections from wget, which breaks fetches. Luckily they also have a HTTP server on the same host. [ YOCTO #9628 ] Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-04-29openssh: Security Fix CVE-2016-3115Armin Kuster
opehssh <= 7.2 Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-11openssh: Properly skip ptrace test if tools are missingJussi Kukkonen
Without the exit there will be a SKIP and a FAIL for the same test. Also fix typo in a message. Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-02-11openssh: Fix regex that sets sftp-server path for testsJussi Kukkonen
[YOCTO #9049] Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-01-17openssh: CVE-2016-1907Armin Kuster
This issue requires three commits: https://anongit.mindrot.org/openssh.git/commit/?id=ed4ce82dbfa8a3a3c8ea6fa0db113c71e234416c https://anongit.mindrot.org/openssh.git/commit/?id=f98a09cacff7baad8748c9aa217afd155a4d493f https://anongit.mindrot.org/openssh.git/commit/?id=2fecfd486bdba9f51b3a789277bb0733ca36e1c0 Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-01-15openssh: update to 7.1p2Alexander Kanavin
This fixes a number of security issues. Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-12-01openssh: redesign ssh-agent.sh regression test caseRoy Li
ssh-agent regression test case should be run by non-root user, but non-root user will has issue to run other testcase, so rewrite it on run-ptest Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2015-11-16openssh: enable X11Forwarding if distro feature x11 is setKai Kang
When distro feature x11 is set, it is better enable X11Forwarding for ssh daemon. For contrast, dropbear enable X11 forward by default. It does NOT need to modify ${WORKDIR}/sshd_config, so drop the modification. Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2015-10-21openssh: fix file permission for /etc/pam.d/sshdChen Qi
The file permission should be 0644 instead of 0755. Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2015-10-01openssh: fix sshd key generation when systemd is in use and rootfs is readonlyAlexander Kanavin
[YOCTO #8365] Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-09-01openssh: Upgrade 7.0p1 -> 7.1p1Jussi Kukkonen
This is a bugfix release. Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-08-24openssh: build regression test binariesJussi Kukkonen
ptests were failing and many more were being silently skipped because required binaries were not being built. Build the binaries in regress/ and set SUDO environment variable in run-ptests: after this all tests in regress/ are now run. Continue to skip building binaries in regress/unittests/: unittest runtime is excessive. On a NUC running intel-corei7-64 core-image-sato, new results are: PASS: 55, SKIP: 3, FAIL: 0 [YOCTO #8153] Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-04-25 12:25:01 +0000