13 files changed, 583 insertions, 0 deletions
diff --git a/meta/recipes-connectivity/openssh/files/add-test-support-for-busybox.patch b/meta/recipes-connectivity/openssh/files/add-test-support-for-busybox.patch
new file mode 100644
index 0000000000..5913597dfd
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/files/add-test-support-for-busybox.patch
@@ -0,0 +1,61 @@
+Adjust test cases to work with busybox.
+- Replace dd parameter "obs" with "bs".
+- Replace "head -<num>" with "head -n <num>".
+Signed-off-by: Björn Stenberg <bjst@enea.com>
+Upstream-status: Pending
+--- a/regress/cipher-speed.sh   2012-06-30 07:08:53.000000000 +0200
+++ b/regress/cipher-speed.sh   2013-02-15 11:30:20.670022055 +0100
+@@ -26,7 +26,7 @@
+                echon "$c/$m:\t"
+                ( ${SSH} -o 'compression no' \
+                        -F $OBJ/ssh_proxy -2 -m $m -c $c somehost \
+-                       exec sh -c \'"dd of=/dev/null obs=32k"\' \
+                       exec sh -c \'"dd of=/dev/null bs=32k"\' \
+                < ${DATA} ) 2>&1 | getbytes
+ 
+                if [ $? -ne 0 ]; then
+@@ -42,7 +42,7 @@
+                echon "$c:\t"
+                ( ${SSH} -o 'compression no' \
+                        -F $OBJ/ssh_proxy -1 -c $c somehost \
+-                       exec sh -c \'"dd of=/dev/null obs=32k"\' \
+                       exec sh -c \'"dd of=/dev/null bs=32k"\' \
+                < ${DATA} ) 2>&1 | getbytes
+                if [ $? -ne 0 ]; then
+                        fail "ssh -1 failed with cipher $c"
+--- a/regress/transfer.sh       2003-09-04 06:54:40.000000000 +0200
+++ b/regress/transfer.sh       2013-02-15 11:25:34.666411185 +0100
+@@ -18,7 +18,7 @@
+        for s in 10 100 1k 32k 64k 128k 256k; do
+                trace "proto $p dd-size ${s}"
+                rm -f ${COPY}
+-               dd if=$DATA obs=${s} 2> /dev/null | \
+               dd if=$DATA bs=${s} 2> /dev/null | \
+                        ${SSH} -q -$p -F $OBJ/ssh_proxy somehost "cat > ${COPY}"
+                if [ $? -ne 0 ]; then
+                        fail "ssh cat $DATA failed"
+--- a/regress/yes-head.sh       2005-11-28 06:41:03.000000000 +0100
+++ b/regress/yes-head.sh       2013-02-15 11:55:11.413715068 +0100
+@@ -4,7 +4,7 @@
+ tid="yes pipe head"
+ 
+ for p in 1 2; do
+-       lines=`${SSH} -$p -F $OBJ/ssh_proxy thishost 'sh -c "while true;do echo yes;done | _POSIX2_VERSION=199209 head -2000"' | (sleep 3 ; wc -l)`
+       lines=`${SSH} -$p -F $OBJ/ssh_proxy thishost 'sh -c "while true;do echo yes;done | _POSIX2_VERSION=199209 head -n 2000"' | (sleep 3 ; wc -l)`
+        if [ $? -ne 0 ]; then
+                fail "yes|head test failed"
+                lines = 0;
+--- a/regress/key-options.sh    2008-07-04 09:08:58.000000000 +0200
+++ b/regress/key-options.sh    2013-02-15 12:06:05.109486098 +0100
+@@ -54,7 +54,7 @@
+        fi
+ 
+        sed 's/.*/from="'"$f"'" &/' $origkeys >$authkeys
+-       from=`head -1 $authkeys | cut -f1 -d ' '`
+       from=`head -n 1 $authkeys | cut -f1 -d ' '`
+        verbose "key option proto $p $from"
+        r=`${SSH} -$p -q -F $OBJ/ssh_proxy somehost 'echo true'`
+        if [ "$r" = "true" ]; then
diff --git a/meta/recipes-connectivity/openssh/files/run-ptest b/meta/recipes-connectivity/openssh/files/run-ptest
new file mode 100755
index 0000000000..3e725cf282
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/files/run-ptest
@@ -0,0 +1,7 @@
+#!/bin/sh
+export TEST_SHELL=sh
+cd regress
+make -k .OBJDIR=`pwd` .CURDIR=`pwd` tests \
+        | sed -e 's/^skipped/SKIP: /g' -e 's/^ok /PASS: /g' -e 's/^failed/FAIL: /g'
diff --git a/meta/recipes-connectivity/openssh/openssh/init b/meta/recipes-connectivity/openssh/openssh/init
new file mode 100644
index 0000000000..37c8e7b907
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/init
@@ -0,0 +1,113 @@
+#! /bin/sh
+set -e
+# source function library
+. /etc/init.d/functions
+# /etc/init.d/ssh: start and stop the OpenBSD "secure shell" daemon
+test -x /usr/sbin/sshd || exit 0
+( /usr/sbin/sshd -\? 2>&1 | grep -q OpenSSH ) 2>/dev/null || exit 0
+# /etc/default/ssh may set SYSCONFDIR and SSHD_OPTS
+if test -f /etc/default/ssh; then
+    . /etc/default/ssh
+fi
+[ -z "$SYSCONFDIR" ] && SYSCONFDIR=/etc/ssh
+mkdir -p $SYSCONFDIR
+HOST_KEY_RSA=$SYSCONFDIR/ssh_host_rsa_key
+HOST_KEY_DSA=$SYSCONFDIR/ssh_host_dsa_key
+HOST_KEY_ECDSA=$SYSCONFDIR/ssh_host_ecdsa_key
+HOST_KEY_ED25519=$SYSCONFDIR/ssh_host_ed25519_key
+check_for_no_start() {
+    # forget it if we're trying to start, and /etc/ssh/sshd_not_to_be_run exists
+    if [ -e $SYSCONFDIR/sshd_not_to_be_run ]; then
+        echo "OpenBSD Secure Shell server not in use ($SYSCONFDIR/sshd_not_to_be_run)"
+        exit 0
+    fi
+}
+check_privsep_dir() {
+    # Create the PrivSep empty dir if necessary
+    if [ ! -d /var/run/sshd ]; then
+        mkdir /var/run/sshd
+        chmod 0755 /var/run/sshd
+    fi
+}
+check_config() {
+        /usr/sbin/sshd -t || exit 1
+}
+check_keys() {
+        # create keys if necessary
+        if [ ! -f $HOST_KEY_RSA ]; then
+                echo "  generating ssh RSA key..."
+                ssh-keygen -q -f $HOST_KEY_RSA -N '' -t rsa
+        fi
+        if [ ! -f $HOST_KEY_ECDSA ]; then
+                echo "  generating ssh ECDSA key..."
+                ssh-keygen -q -f $HOST_KEY_ECDSA -N '' -t ecdsa
+        fi
+        if [ ! -f $HOST_KEY_DSA ]; then
+                echo "  generating ssh DSA key..."
+                ssh-keygen -q -f $HOST_KEY_DSA -N '' -t dsa
+        fi
+        if [ ! -f $HOST_KEY_ED25519 ]; then
+                echo "  generating ssh ED25519 key..."
+                ssh-keygen -q -f $HOST_KEY_ED25519 -N '' -t ed25519
+        fi
+}
+export PATH="${PATH:+$PATH:}/usr/sbin:/sbin"
+case "$1" in
+  start)
+        check_for_no_start
+        echo "Starting OpenBSD Secure Shell server: sshd"
+        check_keys
+        check_privsep_dir
+        start-stop-daemon -S -x /usr/sbin/sshd -- $SSHD_OPTS
+        echo "done."
+        ;;
+  stop)
+        echo -n "Stopping OpenBSD Secure Shell server: sshd"
+        start-stop-daemon -K -x /usr/sbin/sshd
+        echo "."
+        ;;
+  reload|force-reload)
+        check_for_no_start
+        check_keys
+        check_config
+        echo -n "Reloading OpenBSD Secure Shell server's configuration"
+        start-stop-daemon -K -s 1 -x /usr/sbin/sshd
+        echo "."
+        ;;
+  restart)
+        check_keys
+        check_config
+        echo -n "Restarting OpenBSD Secure Shell server: sshd"
+        start-stop-daemon -K --oknodo -x /usr/sbin/sshd
+        check_for_no_start
+        check_privsep_dir
+        sleep 2
+        start-stop-daemon -S -x /usr/sbin/sshd -- $SSHD_OPTS
+        echo "."
+        ;;
+  status)
+        status /usr/sbin/sshd
+        exit $?
+  ;;
+  *)
+        echo "Usage: /etc/init.d/ssh {start|stop|status|reload|force-reload|restart}"
+        exit 1
+esac
+exit 0
diff --git a/meta/recipes-connectivity/openssh/openssh/nostrip.patch b/meta/recipes-connectivity/openssh/openssh/nostrip.patch
new file mode 100644
index 0000000000..33111f5494
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/nostrip.patch
@@ -0,0 +1,20 @@
+Disable stripping binaries during make install.
+Upstream-Status: Inappropriate [configuration]
+Build system specific.
+Signed-off-by: Scott Garman <scott.a.garman@intel.com>
+diff -ur openssh-5.6p1.orig/Makefile.in openssh-5.6p1/Makefile.in
+--- openssh-5.6p1.orig/Makefile.in      2010-05-11 23:51:39.000000000 -0700
+++ openssh-5.6p1/Makefile.in   2010-08-30 16:49:54.000000000 -0700
+@@ -29,7 +29,7 @@
+ RAND_HELPER=$(libexecdir)/ssh-rand-helper
+ PRIVSEP_PATH=@PRIVSEP_PATH@
+ SSH_PRIVSEP_USER=@SSH_PRIVSEP_USER@
+-STRIP_OPT=@STRIP_OPT@
+STRIP_OPT=
+ 
+ PATHS= -DSSHDIR=\"$(sysconfdir)\" \
+        -D_PATH_SSH_PROGRAM=\"$(SSH_PROGRAM)\" \
diff --git a/meta/recipes-connectivity/openssh/openssh/openssh-CVE-2011-4327.patch b/meta/recipes-connectivity/openssh/openssh/openssh-CVE-2011-4327.patch
new file mode 100644
index 0000000000..30c11cf432
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/openssh-CVE-2011-4327.patch
@@ -0,0 +1,29 @@
+openssh-CVE-2011-4327
+A security flaw was found in the way ssh-keysign,
+a ssh helper program for host based authentication,
+attempted to retrieve enough entropy information on configurations that
+lacked a built-in entropy pool in OpenSSL (a ssh-rand-helper program would
+be executed to retrieve the entropy from the system environment).
+A local attacker could use this flaw to obtain unauthorized access to host keys
+via ptrace(2) process trace attached to the 'ssh-rand-helper' program.
+https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-4327
+http://www.openssh.com/txt/portable-keysign-rand-helper.adv
+Upstream-Status: Pending
+Signed-off-by: Li Wang <li.wang@windriver.com>
+--- a/ssh-keysign.c
+++ b/ssh-keysign.c
+@@ -170,6 +170,10 @@
+        key_fd[i++] = open(_PATH_HOST_DSA_KEY_FILE, O_RDONLY);
+        key_fd[i++] = open(_PATH_HOST_ECDSA_KEY_FILE, O_RDONLY);
+        key_fd[i++] = open(_PATH_HOST_RSA_KEY_FILE, O_RDONLY);
+       if (fcntl(key_fd[0], F_SETFD, FD_CLOEXEC) != 0 ||
+           fcntl(key_fd[1], F_SETFD, FD_CLOEXEC) != 0 ||
+           fcntl(key_fd[2], F_SETFD, FD_CLOEXEC) != 0)
+               fatal("fcntl failed");
+ 
+        original_real_uid = getuid();   /* XXX readconf.c needs this */
+        if ((pw = getpwuid(original_real_uid)) == NULL)
diff --git a/meta/recipes-connectivity/openssh/openssh/ssh_config b/meta/recipes-connectivity/openssh/openssh/ssh_config
new file mode 100644
index 0000000000..4a4a649ba8
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/ssh_config
@@ -0,0 +1,46 @@
+#       $OpenBSD: ssh_config,v 1.25 2009/02/17 01:28:32 djm Exp $
+# This is the ssh client system-wide configuration file.  See
+# ssh_config(5) for more information.  This file provides defaults for
+# users, and the values can be changed in per-user configuration files
+# or on the command line.
+# Configuration data is parsed as follows:
+#  1. command line options
+#  2. user-specific file
+#  3. system-wide file
+# Any configuration value is only changed the first time it is set.
+# Thus, host-specific definitions should be at the beginning of the
+# configuration file, and defaults at the end.
+# Site-wide defaults for some commonly used options.  For a comprehensive
+# list of available options, their meanings and defaults, please see the
+# ssh_config(5) man page.
+Host *
+  ForwardAgent yes
+  ForwardX11 yes
+#   RhostsRSAAuthentication no
+#   RSAAuthentication yes
+#   PasswordAuthentication yes
+#   HostbasedAuthentication no
+#   GSSAPIAuthentication no
+#   GSSAPIDelegateCredentials no
+#   BatchMode no
+#   CheckHostIP yes
+#   AddressFamily any
+#   ConnectTimeout 0
+#   StrictHostKeyChecking ask
+#   IdentityFile ~/.ssh/identity
+#   IdentityFile ~/.ssh/id_rsa
+#   IdentityFile ~/.ssh/id_dsa
+#   Port 22
+#   Protocol 2,1
+#   Cipher 3des
+#   Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc
+#   MACs hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160
+#   EscapeChar ~
+#   Tunnel no
+#   TunnelDevice any:any
+#   PermitLocalCommand no
+#   VisualHostKey no
diff --git a/meta/recipes-connectivity/openssh/openssh/sshd b/meta/recipes-connectivity/openssh/openssh/sshd
new file mode 100644
index 0000000000..4882e58b48
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/sshd
@@ -0,0 +1,10 @@
+#%PAM-1.0
+auth       include      common-auth
+account    required     pam_nologin.so
+account    include      common-account
+password   include      common-password
+session    optional     pam_keyinit.so force revoke
+session    include      common-session
+session    required     pam_loginuid.so
diff --git a/meta/recipes-connectivity/openssh/openssh/sshd.socket b/meta/recipes-connectivity/openssh/openssh/sshd.socket
new file mode 100644
index 0000000000..12c39b26b5
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/sshd.socket
@@ -0,0 +1,10 @@
+[Unit]
+Conflicts=sshd.service
+[Socket]
+ExecStartPre=@BASE_BINDIR@/mkdir -p /var/run/sshd
+ListenStream=22
+Accept=yes
+[Install]
+WantedBy=sockets.target
diff --git a/meta/recipes-connectivity/openssh/openssh/sshd@.service b/meta/recipes-connectivity/openssh/openssh/sshd@.service
new file mode 100644
index 0000000000..4eda6592f5
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/sshd@.service
@@ -0,0 +1,10 @@
+[Unit]
+Description=OpenSSH Per-Connection Daemon
+Wants=sshdgenkeys.service
+After=sshdgenkeys.service
+[Service]
+ExecStart=-@SBINDIR@/sshd -i
+ExecReload=@BASE_BINDIR@/kill -HUP $MAINPID
+StandardInput=socket
+StandardError=syslog
diff --git a/meta/recipes-connectivity/openssh/openssh/sshd_config b/meta/recipes-connectivity/openssh/openssh/sshd_config
new file mode 100644
index 0000000000..4f9b626fbd
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/sshd_config
@@ -0,0 +1,119 @@
+#       $OpenBSD: sshd_config,v 1.80 2008/07/02 02:24:18 djm Exp $
+# This is the sshd server system-wide configuration file.  See
+# sshd_config(5) for more information.
+# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin
+# The strategy used for options in the default sshd_config shipped with
+# OpenSSH is to specify options with their default value where
+# possible, but leave them commented.  Uncommented options change a
+# default value.
+#Port 22
+#AddressFamily any
+#ListenAddress 0.0.0.0
+#ListenAddress ::
+# Disable legacy (protocol version 1) support in the server for new
+# installations. In future the default will change to require explicit
+# activation of protocol 1
+Protocol 2
+# HostKey for protocol version 1
+#HostKey /etc/ssh/ssh_host_key
+# HostKeys for protocol version 2
+#HostKey /etc/ssh/ssh_host_rsa_key
+#HostKey /etc/ssh/ssh_host_dsa_key
+# Lifetime and size of ephemeral version 1 server key
+#KeyRegenerationInterval 1h
+#ServerKeyBits 1024
+# Logging
+# obsoletes QuietMode and FascistLogging
+#SyslogFacility AUTH
+#LogLevel INFO
+# Authentication:
+#LoginGraceTime 2m
+#PermitRootLogin yes
+#StrictModes yes
+#MaxAuthTries 6
+#MaxSessions 10
+#RSAAuthentication yes
+#PubkeyAuthentication yes
+#AuthorizedKeysFile     .ssh/authorized_keys
+# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
+#RhostsRSAAuthentication no
+# similar for protocol version 2
+#HostbasedAuthentication no
+# Change to yes if you don't trust ~/.ssh/known_hosts for
+# RhostsRSAAuthentication and HostbasedAuthentication
+#IgnoreUserKnownHosts no
+# Don't read the user's ~/.rhosts and ~/.shosts files
+#IgnoreRhosts yes
+# To disable tunneled clear text passwords, change to no here!
+#PasswordAuthentication yes
+#PermitEmptyPasswords no
+# Change to no to disable s/key passwords
+#ChallengeResponseAuthentication yes
+# Kerberos options
+#KerberosAuthentication no
+#KerberosOrLocalPasswd yes
+#KerberosTicketCleanup yes
+#KerberosGetAFSToken no
+# GSSAPI options
+#GSSAPIAuthentication no
+#GSSAPICleanupCredentials yes
+# Set this to 'yes' to enable PAM authentication, account processing, 
+# and session processing. If this is enabled, PAM authentication will 
+# be allowed through the ChallengeResponseAuthentication and
+# PasswordAuthentication.  Depending on your PAM configuration,
+# PAM authentication via ChallengeResponseAuthentication may bypass
+# the setting of "PermitRootLogin without-password".
+# If you just want the PAM account and session checks to run without
+# PAM authentication, then enable this but set PasswordAuthentication
+# and ChallengeResponseAuthentication to 'no'.
+#UsePAM no
+#AllowAgentForwarding yes
+#AllowTcpForwarding yes
+#GatewayPorts no
+#X11Forwarding no
+#X11DisplayOffset 10
+#X11UseLocalhost yes
+#PrintMotd yes
+#PrintLastLog yes
+#TCPKeepAlive yes
+#UseLogin no
+UsePrivilegeSeparation yes
+#PermitUserEnvironment no
+Compression no
+ClientAliveInterval 15
+ClientAliveCountMax 4
+#UseDNS yes
+#PidFile /var/run/sshd.pid
+#MaxStartups 10
+#PermitTunnel no
+#ChrootDirectory none
+# no default banner path
+#Banner none
+# override default of no subsystems
+Subsystem       sftp    /usr/libexec/sftp-server
+# Example of overriding settings on a per-user basis
+#Match User anoncvs
+#       X11Forwarding no
+#       AllowTcpForwarding no
+#       ForceCommand cvs server
diff --git a/meta/recipes-connectivity/openssh/openssh/sshdgenkeys.service b/meta/recipes-connectivity/openssh/openssh/sshdgenkeys.service
new file mode 100644
index 0000000000..c21d70baf0
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/sshdgenkeys.service
@@ -0,0 +1,10 @@
+[Unit]
+Description=OpenSSH Key Generation
+ConditionPathExists=|!/etc/ssh/ssh_host_rsa_key
+ConditionPathExists=|!/etc/ssh/ssh_host_dsa_key
+ConditionPathExists=|!/etc/ssh/ssh_host_ecdsa_key
+[Service]
+ExecStart=@BINDIR@/ssh-keygen -A
+Type=oneshot
+RemainAfterExit=yes
diff --git a/meta/recipes-connectivity/openssh/openssh/volatiles.99_sshd b/meta/recipes-connectivity/openssh/openssh/volatiles.99_sshd
new file mode 100644
index 0000000000..122320a719
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/volatiles.99_sshd
@@ -0,0 +1 @@
+d root root 0755 /var/run/sshd none
diff --git a/meta/recipes-connectivity/openssh/openssh_6.5p1.bb b/meta/recipes-connectivity/openssh/openssh_6.5p1.bb
new file mode 100644
index 0000000000..a1a2503843
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh_6.5p1.bb
@@ -0,0 +1,147 @@
+SUMMARY = "Secure rlogin/rsh/rcp/telnet replacement"
+DESCRIPTION = "Secure rlogin/rsh/rcp/telnet replacement (OpenSSH) \
+Ssh (Secure Shell) is a program for logging into a remote machine \
+and for executing commands on a remote machine."
+HOMEPAGE = "http://openssh.org"
+SECTION = "console/network"
+LICENSE = "BSD"
+LIC_FILES_CHKSUM = "file://LICENCE;md5=e326045657e842541d3f35aada442507"
+DEPENDS = "zlib openssl"
+DEPENDS += "${@base_contains('DISTRO_FEATURES', 'pam', 'libpam', '', d)}"
+RPROVIDES_${PN}-ssh = "ssh"
+RPROVIDES_${PN}-sshd = "sshd"
+RCONFLICTS_${PN} = "dropbear"
+RCONFLICTS_${PN}-sshd = "dropbear"
+RCONFLICTS_${PN}-keygen = "ssh-keygen"
+SRC_URI = "ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar.gz \
+           file://nostrip.patch \
+           file://sshd_config \
+           file://ssh_config \
+           file://init \
+           file://openssh-CVE-2011-4327.patch \
+           file://add-test-support-for-busybox.patch \
+           file://run-ptest \
+           ${@base_contains('DISTRO_FEATURES', 'pam', '${PAM_SRC_URI}', '', d)} \
+           file://sshd.socket \
+           file://sshd@.service \
+           file://sshdgenkeys.service \
+           file://volatiles.99_sshd "
+PAM_SRC_URI = "file://sshd"
+SRC_URI[md5sum] = "a084e7272b8cbd25afe0f5dce4802fef"
+SRC_URI[sha256sum] = "a1195ed55db945252d5a1730d4a2a2a5c1c9a6aa01ef2e5af750a962623d9027"
+inherit useradd update-rc.d update-alternatives systemd ptest
+USERADD_PACKAGES = "${PN}-sshd"
+USERADD_PARAM_${PN}-sshd = "--system --no-create-home --home-dir /var/run/sshd --shell /bin/false --user-group sshd"
+INITSCRIPT_PACKAGES = "${PN}-sshd"
+INITSCRIPT_NAME_${PN}-sshd = "sshd"
+INITSCRIPT_PARAMS_${PN}-sshd = "defaults 9"
+SYSTEMD_PACKAGES = "${PN}-sshd"
+SYSTEMD_SERVICE_${PN}-sshd = "sshd.socket"
+PACKAGECONFIG ??= "tcp-wrappers"
+PACKAGECONFIG[tcp-wrappers] = "--with-tcp-wrappers,,tcp-wrappers"
+inherit autotools-brokensep
+# LFS support:
+CFLAGS += "-D__FILE_OFFSET_BITS=64"
+export LD = "${CC}"
+EXTRA_OECONF = "${@base_contains('DISTRO_FEATURES', 'pam', '--with-pam', '--without-pam', d)} \
+                --without-zlib-version-check \
+                --with-privsep-path=/var/run/sshd \
+                --sysconfdir=${sysconfdir}/ssh \
+                --with-xauth=/usr/bin/xauth"
+# Since we do not depend on libbsd, we do not want configure to use it
+# just because it finds libutil.h.  But, specifying --disable-libutil
+# causes compile errors, so...
+#
+CACHED_CONFIGUREVARS += "ac_cv_header_bsd_libutil_h=no ac_cv_header_libutil_h=no"
+# This is a workaround for uclibc because including stdio.h
+# pulls in pthreads.h and causes conflicts in function prototypes.
+# This results in compilation failure, so unless this is fixed,
+# disable pam for uclibc.
+EXTRA_OECONF_append_libc-uclibc=" --without-pam"
+do_configure_prepend () {
+        if [ ! -e acinclude.m4 -a -e aclocal.m4 ]; then
+                cp aclocal.m4 acinclude.m4
+        fi
+}
+do_compile_append () {
+        install -m 0644 ${WORKDIR}/sshd_config ${S}/
+        install -m 0644 ${WORKDIR}/ssh_config ${S}/
+}
+do_install_append () {
+        if [ "${@base_contains('DISTRO_FEATURES', 'pam', 'pam', '', d)}" = "pam" ]; then
+                install -D -m 0755 ${WORKDIR}/sshd ${D}${sysconfdir}/pam.d/sshd
+                sed -i -e 's:#UsePAM no:UsePAM yes:' ${WORKDIR}/sshd_config ${D}${sysconfdir}/ssh/sshd_config
+        fi
+        install -d ${D}${sysconfdir}/init.d
+        install -m 0755 ${WORKDIR}/init ${D}${sysconfdir}/init.d/sshd
+        rm -f ${D}${bindir}/slogin ${D}${datadir}/Ssh.bin
+        rmdir ${D}${localstatedir}/run/sshd ${D}${localstatedir}/run ${D}${localstatedir}
+        install -d ${D}/${sysconfdir}/default/volatiles
+        install -m 644 ${WORKDIR}/volatiles.99_sshd ${D}/${sysconfdir}/default/volatiles/99_sshd
+        # Create config files for read-only rootfs
+        install -d ${D}${sysconfdir}/ssh
+        install -m 644 ${D}${sysconfdir}/ssh/sshd_config ${D}${sysconfdir}/ssh/sshd_config_readonly
+        sed -i '/HostKey/d' ${D}${sysconfdir}/ssh/sshd_config_readonly
+        echo "HostKey /var/run/ssh/ssh_host_rsa_key" >> ${D}${sysconfdir}/ssh/sshd_config_readonly
+        echo "HostKey /var/run/ssh/ssh_host_dsa_key" >> ${D}${sysconfdir}/ssh/sshd_config_readonly
+        echo "HostKey /var/run/ssh/ssh_host_ecdsa_key" >> ${D}${sysconfdir}/ssh/sshd_config_readonly
+        install -d ${D}${systemd_unitdir}/system
+        install -c -m 0644 ${WORKDIR}/sshd.socket ${D}${systemd_unitdir}/system
+        install -c -m 0644 ${WORKDIR}/sshd@.service ${D}${systemd_unitdir}/system
+        install -c -m 0644 ${WORKDIR}/sshdgenkeys.service ${D}${systemd_unitdir}/system
+        sed -i -e 's,@BASE_BINDIR@,${base_bindir},g' \
+                -e 's,@SBINDIR@,${sbindir},g' \
+                -e 's,@BINDIR@,${bindir},g' \
+                ${D}${systemd_unitdir}/system/sshd.socket ${D}${systemd_unitdir}/system/*.service
+}
+do_install_ptest () {
+        sed -i -e "s|^SFTPSERVER=.*|SFTPSERVER=${libdir}/${PN}/sftp-server|" regress/test-exec.sh
+        cp -r regress ${D}${PTEST_PATH}
+}
+ALLOW_EMPTY_${PN} = "1"
+PACKAGES =+ "${PN}-keygen ${PN}-scp ${PN}-ssh ${PN}-sshd ${PN}-sftp ${PN}-misc ${PN}-sftp-server"
+FILES_${PN}-scp = "${bindir}/scp.${BPN}"
+FILES_${PN}-ssh = "${bindir}/ssh.${BPN} ${sysconfdir}/ssh/ssh_config"
+FILES_${PN}-sshd = "${sbindir}/sshd ${sysconfdir}/init.d/sshd ${systemd_unitdir}/system"
+FILES_${PN}-sshd += "${sysconfdir}/ssh/moduli ${sysconfdir}/ssh/sshd_config ${sysconfdir}/ssh/sshd_config_readonly ${sysconfdir}/default/volatiles/99_sshd ${sysconfdir}/pam.d/sshd"
+FILES_${PN}-sftp = "${bindir}/sftp"
+FILES_${PN}-sftp-server = "${libexecdir}/sftp-server"
+FILES_${PN}-misc = "${bindir}/ssh* ${libexecdir}/ssh*"
+FILES_${PN}-keygen = "${bindir}/ssh-keygen"
+RDEPENDS_${PN} += "${PN}-scp ${PN}-ssh ${PN}-sshd ${PN}-keygen"
+RDEPENDS_${PN}-sshd += "${PN}-keygen ${@base_contains('DISTRO_FEATURES', 'pam', 'pam-plugin-keyinit pam-plugin-loginuid', '', d)}"
+RDEPENDS_${PN}-ptest += "${PN}-sftp ${PN}-misc ${PN}-sftp-server make"
+CONFFILES_${PN}-sshd = "${sysconfdir}/ssh/sshd_config"
+CONFFILES_${PN}-ssh = "${sysconfdir}/ssh/ssh_config"
+ALTERNATIVE_PRIORITY = "90"
+ALTERNATIVE_${PN}-scp = "scp"
+ALTERNATIVE_${PN}-ssh = "ssh"