1 2 3 FreeBSD maintainer's guide to OpenSSH-portable 4 ============================================== 5 6 70) Make sure your mail spool has plenty of free space. It'll fill up 8 pretty fast once you're done with this checklist. 9 101) Grab the latest OpenSSH-portable tarball from the OpenBSD FTP 11 site (ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/) 12 132) Unpack the tarball in a suitable directory. 14 153) Remove trash: 16 17 $ sh -c 'while read glob ; do rm -rvf $glob ; done' \ 18 </usr/src/crypto/openssh/FREEBSD-Xlist 19 20 Make sure that took care of everything, and if it didn't, make sure 21 to update FREEBSD-Xlist so you won't miss it the next time. A good 22 way to do this is to run a test import and see if any new files 23 show up: 24 25 $ cvs -n import src/crypto/openssh OPENSSH x | grep \^N 26 274) Import the sources: 28 29 $ cvs import src/crypto/openssh OPENSSH OpenSSH_X_YpZ 30 315) Resolve conflicts. Remember to bump the version number and 32 addendum in version.h, and update the default value in 33 ssh{,d}_config and ssh{,d}_config.5. 34 356) Generate configure and config.h.in: 36 37 $ autoconf 38 $ autoheader 39 40 Note: this requires a recent version of autoconf, not autoconf213. 41 427) Run configure with the appropriate arguments: 43 44 $ ./configure --prefix=/usr --sysconfdir=/etc/ssh \ 45 --with-pam --with-tcp-wrappers --with-libedit \ 46 --with-ssl-engine 47 48 This will regenerate config.h, which must be committed along with 49 the rest. 50 51 Note that we don't want to configure OpenSSH for Kerberos using 52 configure since we have to be able to turn it on or off depending 53 on the value of MK_KERBEROS. Our Makefiles take care of this. 54 558) If source files have been added or removed, update the appropriate 56 makefiles to reflect changes in the vendor's Makefile.in. 57 589) Build libssh. Follow the instructions in ssh_namespace.h to get a 59 list of new symbols. Update ssh_namespace.h, build everything, 60 install and test. 61 62A) Build and test the pam_ssh PAM module. It gropes around libssh's 63 internals and will break if something significant changes or if 64 ssh_namespace.h is out of whack. 65 66B) Re-commit everything on repoman (you *did* use a test repo for 67 this, didn't you?) 68 69 70 71 An overview of FreeBSD changes to OpenSSH-portable 72 ================================================== 73 740) VersionAddendum 75 76 The SSH protocol allows for a human-readable version string of up 77 to 40 characters to be appended to the protocol version string. 78 FreeBSD takes advantage of this to include a date indicating the 79 "patch level", so people can easily determine whether their system 80 is vulnerable when an OpenSSH advisory goes out. Some people, 81 however, dislike advertising their patch level in the protocol 82 handshake, so we've added a VersionAddendum configuration variable 83 to allow them to change or disable it. 84 851) Modified server-side defaults 86 87 We've modified some configuration defaults in sshd: 88 89 - Protocol defaults to "2". 90 91 - PasswordAuthentication defaults to "no" when PAM is enabled. 92 93 - For protocol version 2, we don't load RSA host keys by 94 default. If both RSA and DSA keys are present, we prefer DSA 95 to RSA. 96 97 - LoginGraceTime defaults to 120 seconds instead of 600. 98 99 - PermitRootLogin defaults to "no". 100 101 - X11Forwarding defaults to "yes" (it's a threat to the client, 102 not to the server.) 103 1042) Modified client-side defaults 105 106 We've modified some configuration defaults in ssh: 107 108 - For protocol version 2, if both RSA and DSA keys are present, 109 we prefer DSA to RSA. 110 111 - CheckHostIP defaults to "no". 112 1133) Canonic host names 114 115 We've added code to ssh.c to canonicize the target host name after 116 reading options but before trying to connect. This eliminates the 117 usual problem with duplicate known_hosts entries. 118 1194) OPIE 120 121 We've added support for using OPIE as a drop-in replacement for 122 S/Key. 123 1245) setusercontext() environment 125 126 Our setusercontext(3) can set environment variables, which we must 127 take care to transfer to the child's environment. 128 129 130 131This port was brought to you by (in no particular order) DARPA, NAI 132Labs, ThinkSec, Nescaf�, the Aberlour Glenlivet Distillery Co., 133Suzanne Vega, and a Sanford's #69 Deluxe Marker. 134 135 -- des@FreeBSD.org 136 137$FreeBSD$ 138