1 2 3 FreeBSD maintainer's guide to OpenSSH-portable 4 ============================================== 5 600) Make sure your mail spool has plenty of free space. It'll fill up 7 pretty fast once you're done with this checklist. 8 901) Download the latest OpenSSH-portable tarball and signature from 10 OpenBSD (ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/). 11 1202) Verify the signature: 13 14 $ gpg --verify openssh-X.YpZ.tar.gz.asc 15 1603) Unpack the tarball in a suitable directory: 17 18 $ tar xf openssh-X.YpZ.tar.gz 19 2004) Copy to the vendor directory: 21 22 $ svn co svn+ssh://svn.freebsd.org/base/vendor-crypto/openssh/dist 23 $ rsync --archive --delete openssh-X.YpZ/ dist/ 24 2505) Take care of added / deleted files: 26 27 $ svn rm $(svn stat dist | awk '$1 == "!" { print $2 }') 28 $ svn add --no-auto-props $(svn stat dist | awk '$1 == "?" { print $2 }') 29 3006) Commit: 31 32 $ svn commit -m "Vendor import of OpenSSH X.YpZ." dist 33 3407) Tag: 35 36 $ svn copy -m "Tag OpenSSH X.YpZ." \ 37 svn+ssh://svn.freebsd.org/base/vendor-crypto/openssh/dist \ 38 svn+ssh://svn.freebsd.org/base/vendor-crypto/openssh/X.YpZ 39 4008) Check out head and run the pre-merge script: 41 42 $ svn co svn+ssh://svn.freebsd.org/base/head 43 $ cd head/crypto/openssh 44 $ sh freebsd-pre-merge.sh 45 4609) Merge from the vendor branch: 47 48 $ svn merge -cNNNNNN \^/vendor-crypto/openssh/dist . 49 500A) Resolve conflicts. Remember to bump the version addendum in 51 version.h, and update the default value in ssh{,d}_config and 52 ssh{,d}_config.5. 53 540B) Diff against the vendor branch: 55 56 $ svn diff \^/vendor-crypto/openssh/dist . 57 58 Files that have modifications relative to the vendor code, and 59 only those files, must have the svn:keywords property set to 60 FreeBSD=%H and be listed in the 'keywords' file created by the 61 pre-merge script. 62 630C) Run the post-merge script: 64 65 $ sh freebsd-post-merge.sh 66 670D) Run the configure script: 68 69 $ sh freebsd-configure.sh 70 710E) Check config.h very carefully. 72 730F) If source files have been added or removed, update the appropriate 74 makefiles to reflect changes in the vendor's Makefile.in. 75 7610) Build libssh: 77 78 $ cd ../../secure/lib/libssh && make obj && make depend && make 79 8011) Follow the instructions in ssh_namespace.h to get a list of new 81 symbols, and them to ssh_namespace.h. Keep it sorted! 82 8312) Build and install world, reboot, test. Pay particular attention 84 to pam_ssh(8), which gropes inside libssh and will break if 85 something significant changes or if ssh_namespace.h is out of 86 whack. 87 8813) Commit, and hunker down for the inevitable storm of complaints. 89 90 91 92 An overview of FreeBSD changes to OpenSSH-portable 93 ================================================== 94 95XXX This section is out of date 96 970) VersionAddendum 98 99 The SSH protocol allows for a human-readable version string of up 100 to 40 characters to be appended to the protocol version string. 101 FreeBSD takes advantage of this to include a date indicating the 102 "patch level", so people can easily determine whether their system 103 is vulnerable when an OpenSSH advisory goes out. Some people, 104 however, dislike advertising their patch level in the protocol 105 handshake, so we've added a VersionAddendum configuration variable 106 to allow them to change or disable it. 107 1081) Modified server-side defaults 109 110 We've modified some configuration defaults in sshd: 111 112 - PasswordAuthentication defaults to "no". 113 114 - LoginGraceTime defaults to 120 seconds instead of 600. 115 116 - PermitRootLogin defaults to "no". 117 118 - X11Forwarding defaults to "yes" (it's a threat to the client, 119 not to the server.) 120 1212) Modified client-side defaults 122 123 We've modified some configuration defaults in ssh: 124 125 - CheckHostIP defaults to "no". 126 1273) Canonic host names 128 129 We've added code to ssh.c to canonicize the target host name after 130 reading options but before trying to connect. This eliminates the 131 usual problem with duplicate known_hosts entries. 132 1334) setusercontext() environment 134 135 Our setusercontext(3) can set environment variables, which we must 136 take care to transfer to the child's environment. 137 138 139 140This port was brought to you by (in no particular order) DARPA, NAI 141Labs, ThinkSec, Nescafé, the Aberlour Glenlivet Distillery Co., 142Suzanne Vega, and a Sanford's #69 Deluxe Marker. 143 144 -- des@FreeBSD.org 145 146$FreeBSD$ 147