1 2 3 FreeBSD maintainer's guide to OpenSSH-portable 4 ============================================== 5 6XXX 7XXX this needs a complete rewrite 8XXX svn merge from vendor branch, resolve conflicts manually 9XXX (see FREEBSD-tricks for tips on how to reduce conflicts) 10XXX run freebsd-configure.sh to generate config.h and krb5_config.h 11XXX svn diff Makefile.in to see if the Makefiles need adjusting 12XXX 13 140) Make sure your mail spool has plenty of free space. It'll fill up 15 pretty fast once you're done with this checklist. 16 171) Grab the latest OpenSSH-portable tarball from the OpenBSD FTP 18 site (ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/) 19 202) Unpack the tarball in a suitable directory. 21 22 $ tar xf openssh-X.YpZ.tar.gz \ 23 -X /usr/src/crypto/openssh/FREEBSD-Xlist 24 253) Remove trash: 26 27 Make sure -X took care of everything, and if it didn't, make sure 28 to update FREEBSD-Xlist so you won't miss it the next time. A good 29 way to do this is to run a test import and see if any new files 30 show up: 31 32 $ cvs -n import src/crypto/openssh OPENSSH x | grep \^N 33 344) Import the sources: 35 36 $ cvs import src/crypto/openssh OPENSSH OpenSSH_X_YpZ 37 385) Resolve conflicts. Remember to bump the version number and 39 addendum in version.h, and update the default value in 40 ssh{,d}_config and ssh{,d}_config.5. 41 426) Generate configure and config.h.in: 43 44 $ autoconf 45 $ autoheader 46 47 Note: this requires a recent version of autoconf, not autoconf213. 48 497) Run configure with the appropriate arguments: 50 51 $ ./configure --prefix=/usr --sysconfdir=/etc/ssh \ 52 --with-pam --with-tcp-wrappers --with-libedit \ 53 --with-ssl-engine 54 55 This will regenerate config.h, which must be committed along with 56 the rest. 57 58 Note that we don't want to configure OpenSSH for Kerberos using 59 configure since we have to be able to turn it on or off depending 60 on the value of MK_KERBEROS. Our Makefiles take care of this. 61 628) If source files have been added or removed, update the appropriate 63 makefiles to reflect changes in the vendor's Makefile.in. 64 659) Build libssh. Follow the instructions in ssh_namespace.h to get a 66 list of new symbols. Update ssh_namespace.h, build everything, 67 install and test. 68 69A) Build and test the pam_ssh PAM module. It gropes around libssh's 70 internals and will break if something significant changes or if 71 ssh_namespace.h is out of whack. 72 73B) Re-commit everything on repoman (you *did* use a test repo for 74 this, didn't you?) 75 76 77 78 An overview of FreeBSD changes to OpenSSH-portable 79 ================================================== 80 810) VersionAddendum 82 83 The SSH protocol allows for a human-readable version string of up 84 to 40 characters to be appended to the protocol version string. 85 FreeBSD takes advantage of this to include a date indicating the 86 "patch level", so people can easily determine whether their system 87 is vulnerable when an OpenSSH advisory goes out. Some people, 88 however, dislike advertising their patch level in the protocol 89 handshake, so we've added a VersionAddendum configuration variable 90 to allow them to change or disable it. 91 921) Modified server-side defaults 93 94 We've modified some configuration defaults in sshd: 95 96 - PasswordAuthentication defaults to "no". 97 98 - LoginGraceTime defaults to 120 seconds instead of 600. 99 100 - PermitRootLogin defaults to "no". 101 102 - X11Forwarding defaults to "yes" (it's a threat to the client, 103 not to the server.) 104 1052) Modified client-side defaults 106 107 We've modified some configuration defaults in ssh: 108 109 - CheckHostIP defaults to "no". 110 1113) Canonic host names 112 113 We've added code to ssh.c to canonicize the target host name after 114 reading options but before trying to connect. This eliminates the 115 usual problem with duplicate known_hosts entries. 116 1174) setusercontext() environment 118 119 Our setusercontext(3) can set environment variables, which we must 120 take care to transfer to the child's environment. 121 122 123 124This port was brought to you by (in no particular order) DARPA, NAI 125Labs, ThinkSec, Nescafé, the Aberlour Glenlivet Distillery Co., 126Suzanne Vega, and a Sanford's #69 Deluxe Marker. 127 128 -- des@FreeBSD.org 129 130$FreeBSD$ 131