summaryrefslogtreecommitdiffstats
path: root/meta/recipes-connectivity/openssh
Commit message (Collapse)AuthorAgeFilesLines
* openssh: upgrade 9.7p1 -> 9.8p1Jose Quaresma2024-07-267-261/+73
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - drop the CVE-2024-6387 [backported patch] - drop systemd notify [backported patch] - fix musl build [backported patch] - fix ptest regression [submited patch] - sshd now had the sshd-session Release notes at https://www.openssh.com/txt/release-9.8 Security ======== This release contains fixes for two security problems, one critical and one minor. 1) Race condition in sshd(8) A critical vulnerability in sshd(8) was present in Portable OpenSSH versions between 8.5p1 and 9.7p1 (inclusive) that may allow arbitrary code execution with root privileges. Successful exploitation has been demonstrated on 32-bit Linux/glibc systems with ASLR. Under lab conditions, the attack requires on average 6-8 hours of continuous connections up to the maximum the server will accept. Exploitation on 64-bit systems is believed to be possible but has not been demonstrated at this time. It's likely that these attacks will be improved upon. Exploitation on non-glibc systems is conceivable but has not been examined. Systems that lack ASLR or users of downstream Linux distributions that have modified OpenSSH to disable per-connection ASLR re-randomisation (yes - this is a thing, no - we don't understand why) may potentially have an easier path to exploitation. OpenBSD is not vulnerable. We thank the Qualys Security Advisory Team for discovering, reporting and demonstrating exploitability of this problem, and for providing detailed feedback on additional mitigation measures. 2) Logic error in ssh(1) ObscureKeystrokeTiming In OpenSSH version 9.5 through 9.7 (inclusive), when connected to an OpenSSH server version 9.5 or later, a logic error in the ssh(1) ObscureKeystrokeTiming feature (on by default) rendered this feature ineffective - a passive observer could still detect which network packets contained real keystrokes when the countermeasure was active because both fake and real keystroke packets were being sent unconditionally. This bug was found by Philippos Giavridis and also independently by Jacky Wei En Kung, Daniel Hugenroth and Alastair Beresford of the University of Cambridge Computer Lab. Worse, the unconditional sending of both fake and real keystroke packets broke another long-standing timing attack mitigation. Since OpenSSH 2.9.9 sshd(8) has sent fake keystoke echo packets for traffic received on TTYs in echo-off mode, such as when entering a password into su(8) or sudo(8). This bug rendered these fake keystroke echoes ineffective and could allow a passive observer of a SSH session to once again detect when echo was off and obtain fairly limited timing information about keystrokes in this situation (20ms granularity by default). This additional implication of the bug was identified by Jacky Wei En Kung, Daniel Hugenroth and Alastair Beresford and we thank them for their detailed analysis. This bug does not affect connections when ObscureKeystrokeTiming was disabled or sessions where no TTY was requested. Future deprecation notice ========================= OpenSSH plans to remove support for the DSA signature algorithm in early 2025. This release disables DSA by default at compile time. DSA, as specified in the SSHv2 protocol, is inherently weak - being limited to a 160 bit private key and use of the SHA1 digest. Its estimated security level is only 80 bits symmetric equivalent. OpenSSH has disabled DSA keys by default since 2015 but has retained run-time optional support for them. DSA was the only mandatory-to- implement algorithm in the SSHv2 RFCs, mostly because alternative algorithms were encumbered by patents when the SSHv2 protocol was specified. This has not been the case for decades at this point and better algorithms are well supported by all actively-maintained SSH implementations. We do not consider the costs of maintaining DSA in OpenSSH to be justified and hope that removing it from OpenSSH can accelerate its wider deprecation in supporting cryptography libraries. This release, and its deactivation of DSA by default at compile-time, marks the second step in our timeline to finally deprecate DSA. The final step of removing DSA support entirely is planned for the first OpenSSH release of 2025. DSA support may be re-enabled in OpenBSD by setting "DSAKEY=yes" in Makefile.inc. To enable DSA support in portable OpenSSH, pass the "--enable-dsa-keys" option to configure. Potentially-incompatible changes -------------------------------- * all: as mentioned above, the DSA signature algorithm is now disabled at compile time. * sshd(8): the server will now block client addresses that repeatedly fail authentication, repeatedly connect without ever completing authentication or that crash the server. See the discussion of PerSourcePenalties below for more information. Operators of servers that accept connections from many users, or servers that accept connections from addresses behind NAT or proxies may need to consider these settings. * sshd(8): the server has been split into a listener binary, sshd(8), and a per-session binary "sshd-session". This allows for a much smaller listener binary, as it no longer needs to support the SSH protocol. As part of this work, support for disabling privilege separation (which previously required code changes to disable) and disabling re-execution of sshd(8) has been removed. Further separation of sshd-session into additional, minimal binaries is planned for the future. * sshd(8): several log messages have changed. In particular, some log messages will be tagged with as originating from a process named "sshd-session" rather than "sshd". * ssh-keyscan(1): this tool previously emitted comment lines containing the hostname and SSH protocol banner to standard error. This release now emits them to standard output, but adds a new "-q" flag to silence them altogether. * sshd(8): (portable OpenSSH only) sshd will no longer use argv[0] as the PAM service name. A new "PAMServiceName" sshd_config(5) directive allows selecting the service name at runtime. This defaults to "sshd". bz2101 * (portable OpenSSH only) Automatically-generated files, such as configure, config.h.in, etc will now be checked in to the portable OpenSSH git release branch (e.g. V_9_8). This should ensure that the contents of the signed release branch exactly match the contents of the signed release tarball. Changes since OpenSSH 9.7 ========================= This release contains mostly bugfixes. New features ------------ * sshd(8): as described above, sshd(8) will now penalise client addresses that, for various reasons, do not successfully complete authentication. This feature is controlled by a new sshd_config(5) PerSourcePenalties option and is on by default. sshd(8) will now identify situations where the session did not authenticate as expected. These conditions include when the client repeatedly attempted authentication unsucessfully (possibly indicating an attack against one or more accounts, e.g. password guessing), or when client behaviour caused sshd to crash (possibly indicating attempts to exploit bugs in sshd). When such a condition is observed, sshd will record a penalty of some duration (e.g. 30 seconds) against the client's address. If this time is above a minimum configurable threshold, then all connections from the client address will be refused (along with any others in the same PerSourceNetBlockSize CIDR range) until the penalty expire. Repeated offenses by the same client address will accrue greater penalties, up to a configurable maximum. Address ranges may be fully exempted from penalties, e.g. to guarantee access from a set of trusted management addresses, using the new sshd_config(5) PerSourcePenaltyExemptList option. We hope these options will make it significantly more difficult for attackers to find accounts with weak/guessable passwords or exploit bugs in sshd(8) itself. This option is enabled by default. * ssh(8): allow the HostkeyAlgorithms directive to disable the implicit fallback from certificate host key to plain host keys. Bugfixes -------- * misc: fix a number of inaccuracies in the PROTOCOL.* documentation files. GHPR430 GHPR487 * all: switch to strtonum(3) for more robust integer parsing in most places. * ssh(1), sshd(8): correctly restore sigprocmask around ppoll() * ssh-keysign(8): stricter validation of messaging socket fd GHPR492 * sftp(1): flush stdout after writing "sftp>" prompt when not using editline. GHPR480 * sftp-server(8): fix home-directory extension implementation, it previously always returned the current user's home directory contrary to the spec. GHPR477 * ssh-keyscan(1): do not close stdin to prevent error messages when stdin is read multiple times. E.g. echo localhost | ssh-keyscan -f - -f - * regression tests: fix rekey test that was testing the same KEX algorithm repeatedly instead of testing all of them. bz3692 * ssh_config(5), sshd_config(5): clarify the KEXAlgorithms directive documentation, especially around what is supported vs available. bz3701. Portability ----------- * sshd(8): expose SSH_AUTH_INFO_0 always to PAM auth modules unconditionally. The previous behaviour was to expose it only when particular authentication methods were in use. * build: fix OpenSSL ED25519 support detection. An incorrect function signature in configure.ac previously prevented enabling the recently added support for ED25519 private keys in PEM PKCS8 format. * ssh(1), ssh-agent(8): allow the presence of the WAYLAND_DISPLAY environment variable to enable SSH_ASKPASS, similarly to the X11 DISPLAY environment variable. GHPR479 * build: improve detection of the -fzero-call-used-regs compiler flag. bz3673. * build: relax OpenSSL version check to accept all OpenSSL 3.x versions. * sshd(8): add support for notifying systemd on server listen and reload, using a standalone implementation that doesn't depend on libsystemd. bz2641 (From OE-Core rev: 4e2834f67d32894d1cac5fc9ac5234816765245e) Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: systemd notification was implemented upstreamJose Quaresma2024-07-264-100/+227
| | | | | | | | | | Drop our sd-notify patch and switch to the upstream standalone implementation that does not depend on libsystemd. (From OE-Core rev: 07522f85a987b673b0a3c98690c3c17ab0c4b608) Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: systemd sd-notify patch was rejected upstreamJose Quaresma2024-07-181-1/+1
| | | | | | | | | | | | | | | | | Still side effects of the XZ backdoor. Racional [1]: License incompatibility and library bloatedness were the reasons. Given recent events we're never going to take a dependency on libsystemd, though we might implement the notification protocol ourselves if it isn't too much work. [1] https://github.com/openssh/openssh-portable/pull/375#issuecomment-2027749729 (From OE-Core rev: c3403bb6254d027356b25ce3f00786e2c4545207) Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: drop rejected patch fixed in 8.6p1 releaseJose Quaresma2024-07-182-112/+0
| | | | | | | | | | | | | | | | | | | | | | The rationale [1] is that C11 6.5.6.9 says: """ When two pointers are subtracted, both shall point to elements of the same array object, or one past the last element of the array object; the result is the difference of the subscripts of the two array elements. """ In these cases the objects are arrays of char so the result is defined, and we believe that the compiler incorrectly trapping on defined behaviour. I also found https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63303 ("Pointer subtraction is broken when using -fsanitize=undefined") which seems to support this position. [1] https://bugzilla.mindrot.org/show_bug.cgi?id=2608 (From OE-Core rev: cf193ea67ca852e76b19a7997b62f043b1bca8a1) Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: factor out sshd hostkey setup to separate functionRasmus Villemoes2024-07-131-22/+26
| | | | | | | | | | | | | | | | | | | | | | | | | Commit 0827c29566 (openssh: allow configuration of hostkey type) broke our setup. We make use of the 'Include /etc/ssh/sshd_config.d/*.conf' and put a hostkeys.conf file in there, configuring the types and locations of the sshd host keys. With that commit, we now get an extra "HostKey /etc/ssh/ssh_host_ecdsa_key" line in the sshd_config. And while we could avoid that by removing all hostkey-* items from PACKAGECONFIG, other people providing their own sshd_config via a .bbappend now have their HostKey settings unconditionally removed by the 'sed' invocations, regardless of PACKAGECONFIG. To make it easier for downstream layers and BSPs to define (and preserve) their own logic for placement and type of sshd host keys, factor out the new logic to a separate shell function. Downstream layers can then simply override that by an empty function and keep the behaviour they used to have. (From OE-Core rev: 09dd5cceecfaa2046f7ed070690b000181723fd2) Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: fix CVE-2024-6387Jose Quaresma2024-07-042-0/+28
| | | | | | | | | | | | | | | | | | | | | sshd(8) in Portable OpenSSH versions 8.5p1 to 9.7p1 (inclusive). Race condition resulting in potential remote code execution. A race condition in sshd(8) could allow remote code execution as root on non-OpenBSD systems. This attack could be prevented by disabling the login grace timeout (LoginGraceTime=0 in sshd_config) though this makes denial-of service against sshd(8) considerably easier. For more information, please refer to the release notes [1] and the report from the Qualys Security Advisory Team [2] who discovered the bug. [1] https://www.openssh.com/txt/release-9.8 [2] https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt References: https://www.openssh.com/security.html (From OE-Core rev: 7ba7c96f31bd81c5d1352136e405e99c3df29ea7) Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: allow configuration of hostkey typeMatthew Bullock2024-07-021-4/+25
| | | | | | | | | | | | | | | | | Allow selection of host key types used by openssh via PACKAGECONFIG. Any combination of hostkey-rsa, hostkey-ecdsa and hostkey-ed25519 can be specified. Default to just generating ecdsa keys. The current default generates all three keys. This can take a significant amount of time on first boot. Having all three keys does not significantly increase compatability. Also RSA keys are being deprecated as they are no longer considered secure. Using just an ecdsa key reduces key generation time by roughly 75%. (From OE-Core rev: 0827c29566f3ea63715a9f9e4ee2639f4eabe0bd) Signed-off-by: Matthew Bullock <mbullock@thegoodpenguin.co.uk> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: drop add-test-support-for-busybox.patchAlexander Kanavin2024-06-242-48/+0
| | | | | | | | | | | The ptest package is nowadays depending on coreutils so busybox tweaks are both incomplete and unneeded. (From OE-Core rev: 2408b0b5ea3090fd151de22c91420210fd7ff48f) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* recipes: Start WORKDIR -> UNPACKDIR transitionRichard Purdie2024-05-211-8/+8
| | | | | | | | | Replace references of WORKDIR with UNPACKDIR where it makes sense to do so in preparation for changing the default value of UNPACKDIR. (From OE-Core rev: 1f18b9a512800860d5153d89eb82b56388efad6f) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* recipes: Update WORKDIR references to UNPACKDIRRichard Purdie2024-05-021-2/+2
| | | | | | | | | | Since we want to be able to stop unpacking to WORKDIR, correct the WORKDIR references in recipe do_compile/do_install tasks to use UNPACKDIR in the appropraite places instead. (From OE-Core rev: d73595df69667fe9d12ecd407b77a0b8dae2109c) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: add After dependencies on nss-user-lookup.targetRasmus Villemoes2024-04-252-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | Quoting 'man systemd.special': nss-user-lookup.target A target that should be used as synchronization point for all regular UNIX user/group name service lookups. [...] All services for which the availability of the full user/group database is essential should be ordered after this target, but not pull it in. All services which provide parts of the user/group database should be ordered before this target, and pull it in. When no service providing parts of the user/group database exists and thus pulls in the nss-user-lookup.target, this added dependency is a no-op. However, when such a service does exist, and e.g. modifies /etc/shadow to change password or enable/disable certain accounts, it is essential that no ssh connections are accepted until those changes are made. (From OE-Core rev: 365b5490f3b12772ed57a6bcfd1e0e8a91185afc) Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: upgrade 9.6p1 -> 9.7p1Wang Mingyu2024-04-162-11/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 0001-systemd-Add-optional-support-for-systemd-sd_notify.patch refresh for 9.7p1 Changelog: ============ New features ------------ * ssh(1), sshd(8): add a "global" ChannelTimeout type that watches all open channels and will close all open channels if there is no traffic on any of them for the specified interval. This is in addition to the existing per-channel timeouts added recently. * All: make DSA key support compile-time optional, defaulting to on. Bugfixes -------- * sshd(8): don't append an unnecessary space to the end of subsystem arguments * ssh(1): fix the multiplexing "channel proxy" mode, broken when keystroke timing obfuscation was added. * ssh(1), sshd(8): fix spurious configuration parsing errors when options that accept array arguments are overridden * ssh-agent(1): fix potential spin in signal handler * Many fixes to manual pages and other documentation * Greatly improve interop testing against PuTTY. (From OE-Core rev: e409b8ceb514d67d6472b4433cc9869c43401b94) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: add fido2 supportDan McGregor2024-04-141-0/+1
| | | | | | | | | | | | OpenSSH supports FIDO security keys in both the client and server. Add an option to support them in oe. This change requires a new recipe that I've submitted to meta-openembedded that has not merged yet. (From OE-Core rev: 74451a65f29b16f78b008b3ac70c99c2d61a7cad) Signed-off-by: Dan McGregor <dan.mcgregor@usask.ca> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: Add a workaround for ICE on powerpc64le5.0_M3William Lyu2024-03-081-0/+3
| | | | | | | | | | | | | | | | | | | Fixes [YOCTO #15415] The new openssh version has an ICE on powerpc64le similar to the one on mips/mips64[1]. By adding flag "--without-hardening" to "./configure", compiler option "-fzero-call-used-regs" will be removed when compiling. This prevents certain functions from triggering the following ICE: unimplemented: argument 'used' is not supported for '-fzero-call-used-regs' on this target References [1] https://git.openembedded.org/openembedded-core/commit/?id=5b290566519a87c563945a033cb49863317ad63d (From OE-Core rev: bc793fa9d1fe24c102d91e97b7002b6e637cbfa5) Signed-off-by: William Lyu <William.Lyu@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: Add a work around for ICE on mips/mips64Richard Purdie2024-02-161-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Unfortunately the new openssh version has an ICE on mips. This looks similar to: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104817 https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104820 Given how long these have been open, workaround the issue by disabling the compiler hardening options on mips. It is likely better to do this than have the open CVEs for everyone as we can't upgrade. An example: | during RTL pass: zero_call_used_regs | clientloop.c: In function 'client_loop': | clientloop.c:1699:1: internal compiler error: in int_mode_for_mode, at stor-layout.cc:407 | 1699 | } | | ^ | 0x14d0acc internal_error(char const*, ...) | ???:0 | 0x5cf765 fancy_abort(char const*, int, char const*) | ???:0 | 0x826f1f emit_move_insn_1(rtx_def*, rtx_def*) | ???:0 | 0x8270c5 emit_move_insn(rtx_def*, rtx_def*) | ???:0 | 0xb7b994 default_zero_call_used_regs(HARD_REG_SET) | ???:0 | Please submit a full bug report, with preprocessed source (by using -freport-bug). | Please include the complete backtrace with any bug report. (From OE-Core rev: 5b290566519a87c563945a033cb49863317ad63d) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: upgrade 9.5p1 -> 9.6p1Tim Orling2024-02-162-3/+3
| | | | | | | | | | | | | | | | | | | | | * Relocate Upstream-Status in 0001-regress-banner.sh-log-input-and-output-files-on-erro.patch so it will not throw an error in AUH https://www.openssh.com/txt/release-9.6 https://github.com/openssh/openssh-portable/compare/V_9_5_P1...V_9_6_P1 https://nvd.nist.gov/vuln/detail/CVE-2023-48795 https://nvd.nist.gov/vuln/detail/CVE-2023-51384 https://nvd.nist.gov/vuln/detail/CVE-2023-51385 CVE: CVE-2023-48795 CVE: CVE-2023-51384 CVE: CVE-2023-51385 (From OE-Core rev: 8416c8d1b57dd6c9c7890aac962feb63bac6429b) Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: Add PACKAGECONFIG option to customize sshd modeMingli Yu2024-01-071-6/+19
| | | | | | | | | | | | | | | | Add systemd-sshd-socket-mode PACKAGECONFIG option to choose installing sshd.socket and systemd-sshd-service-mode PACKAGECONFIG option to choose installing sshd.service. The systemd-sshd-socket-mode PACKAGECONFIG option is enabled by default and user can choose the above two PACKAGECONFIG option to customize the sshd mode. (From OE-Core rev: bc830ad3c6a11af1a350dca7f33f0682aeee0d21) Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: add systemd readiness notification supportXiangyu Chen2023-11-202-1/+103
| | | | | | | | | | | | | | | | | | | | | | | | The sshd keeps on terminating and restarting in servel minutes, we can observe log from journalctl that the sshd was killed by systemd with signal 15: systemd[1]: sshd.service start operation timed out. Terminating. sshd[374]: Received signal 15; terminating. When the sshd as a systemd service, it need to tell systemd with a "READY" status, and when it is restarted, it need to tell systemd with a "RELOADING" status, otherwise, systemd would treat it as failing service and restart it again. Taken a patch from openssh upstream PR[1], that after using a signal to tell systemd it is ready or reload now. Ref: [1] https://github.com/openssh/openssh-portable/pull/375/commits/be187435911cde6cc3cef6982a508261074f1e56 (From OE-Core rev: 4090dca8e44ec79ccb9a674db31e835d20b51888) Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: Don't hardcode the dir in sshd.serviceMingli Yu2023-10-271-1/+1
| | | | | | | | | | Don't hardcode the directory of the binary in sshd.service. (From OE-Core rev: 977820725c39736061b649389864a53e112e213d) Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: Add sshd.serviceMingli Yu2023-10-192-1/+20
| | | | | | | | | | | | | | | | For systems with a large amount of SSH traffic, it shoule be better to run a single SSH server for all incoming connections. And both sshd.socket and sshd.service are deployed on other distros like ubuntu, fedora and etc. So add sshd.service to make it possible to run a standalone SSH server. (From OE-Core rev: 3ecebc70f957e53e3dcf1cc835ff359115db6e56) Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: upgrade 9.4p1 -> 9.5p1Wang Mingyu2023-10-141-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changelog: =========== Potentially incompatible changes -------------------------------- * ssh-keygen(1): generate Ed25519 keys by default. Ed25519 public keys are very convenient due to their small size. Ed25519 keys are specified in RFC 8709 and OpenSSH has supported them since version 6.5 (January 2014). * sshd(8): the Subsystem directive now accurately preserves quoting of subsystem commands and arguments. This may change behaviour for exotic configurations, but the most common subsystem configuration (sftp-server) is unlikely to be affected. New features ------------ * ssh(1): add keystroke timing obfuscation to the client. This attempts to hide inter-keystroke timings by sending interactive traffic at fixed intervals (default: every 20ms) when there is only a small amount of data being sent. It also sends fake "chaff" keystrokes for a random interval after the last real keystroke. These are controlled by a new ssh_config ObscureKeystrokeTiming keyword. * ssh(1), sshd(8): Introduce a transport-level ping facility. This adds a pair of SSH transport protocol messages SSH2_MSG_PING/PONG to implement a ping capability. These messages use numbers in the "local extensions" number space and are advertised using a "ping@openssh.com" ext-info message with a string version number of "0". * sshd(8): allow override of Subsystem directives in sshd Match blocks. Bugfixes -------- * scp(1): fix scp in SFTP mode recursive upload and download of directories that contain symlinks to other directories. In scp mode, the links would be followed, but in SFTP mode they were not. bz3611 * ssh-keygen(1): handle cr+lf (instead of just cr) line endings in sshsig signature files. * ssh(1): interactive mode for ControlPersist sessions if they originally requested a tty. * sshd(8): make PerSourceMaxStartups first-match-wins * sshd(8): limit artificial login delay to a reasonable maximum (5s) and don't delay at all for the "none" authentication mechanism.cw bz3602 * sshd(8): Log errors in kex_exchange_identification() with level verbose instead of error to reduce preauth log spam. All of those get logged with a more generic error message by sshpkt_fatal(). * sshd(8): correct math for ClientAliveInterval that caused the probes to be sent less frequently than configured. * ssh(1): fix regression in OpenSSH 9.4 (mux.c r1.99) that caused multiplexed sessions to ignore SIGINT under some circumstances. Portability ----------- * Avoid clang zero-call-used-regs=all bug on Apple compilers, which for some reason have version numbers that do not match the upstream clang version numbers. bz#3584 * Fix configure test for zlib 1.3 and later/development versions. bz3604 (From OE-Core rev: 1f7a8aedecae81339d71c40f4cf7f6d1e5e4286c) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: drop sudo from ptest dependenciesMikko Rapeli2023-10-092-2/+2
| | | | | | | | | | | | | | The tests don't actually need sudo on core-image-ptest-openssh. Based on logs seen in https://bugzilla.yoctoproject.org/show_bug.cgi?id=15178 it seems that socket errors from sudo are creeping into stderr which are failing the banner ptest from openssh. Removing sudo should help removing the stderr messages and possibly cure the banner test failures. (From OE-Core rev: 47e754f483b674b207bfddcc8d4c5d9a3008e102) Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: update sshd_check_keys script to make use of 'sshd -G'Rasmus Villemoes2023-10-041-2/+1
| | | | | | | | | | | | | | | | | | | | | | | Parsing sshd's config file with 'sed' does not work in for example the case where somebody has made use of the new ability to add a config fragment in /etc/ssh/sshd_config.d/ with one or more HostKey stanzas. Also, sshd_config keywords are case-insensitive, but the current sed pattern only matches the CamelCase spelling of HostKey. In openssh 9.3, sshd learnt a new command line flag '-G', which causes sshd to parse the given configuration file and print the resulting effective configuration on stdout. So use that instead. Furthermore, since that "effective configuration" includes the default set of host keys if the configuration file has no HostKey stanzas, we also avoid the script needing to know what sshd's default is - that could plausibly change with some future release. (From OE-Core rev: dd27f9d869b8aa28dfb18de037a24ab0ec735718) Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: capture logs in run-ptestMikko Rapeli2023-09-143-35/+14
| | | | | | | | | | | | Drop patch to improve logging since upstream rejected it but capture failure logs in run-ptests with similar code as what upstream uses when running the tests via https://github.com/openssh/openssh-portable/blob/master/.github/run_test.sh#L23 (From OE-Core rev: 5f817f5a3897bca39eb832bb910b032632f275b8) Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: improve banner ptest failure loggingMikko Rapeli2023-09-122-0/+62
| | | | | | | | | | | | | | | | | | | Log the input and output banner files. Output seems to contain more lines than input which fails the test but it's not clear what is in there from the ssh command stderr. So print them out to dig deeper into the root cause. Upstream rejected previous logging patch so they will likely do the same for this: https://github.com/openssh/openssh-portable/pull/437 Reference: https://bugzilla.yoctoproject.org/show_bug.cgi?id=15178 (From OE-Core rev: 3230378d651ecc53ff5cac1aaa24f35d5cea8665) Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: update Upstream-Status to Denied in test logging patchMikko Rapeli2023-09-121-1/+1
| | | | | | | | | | Upstream rejected the change: https://github.com/openssh/openssh-portable/pull/437 (From OE-Core rev: 46c5f3b7a57442b9979ad36b679900cf0b8f74d5) Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: capture ptest regression test failure logsMikko Rapeli2023-09-072-0/+35
| | | | | | | | | | | | | When tests fail, capture the sshd and ssh client logs from the failing test run. These are needed to investigate the root cause. Reference: https://bugzilla.yoctoproject.org/show_bug.cgi?id=15178 (From OE-Core rev: 7c6a0ee7961dc976dddbfd1615f90c2306970626) Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: upgrade to v9.4p1Sudip Mukherjee2023-09-032-996/+1
| | | | | | | | | | | Changes: Update sha256sum Remove backported patch (From OE-Core rev: 51a6e56fcb28ec97ba3a4b40bbcd3d64e6d390d5) Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: sync with upstream's defaultChen Qi2023-08-101-5/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This change sync the contents of this file with upstream's ssh_config except for the locally added line 'Include /etc/ssh/ssh_config.d/*.conf'. More specifically the ForwardXXX options are disabled by default, this sync with what ssh_config(5) says about these two items. In addition, the RSAAuthentication items are removed as they are v1 protocol. See the contents of Changelog file in openssh project as below: """ commit bfe19197a92b7916f64a121fbd3c179abf15e218 Author: Darren Tucker <dtucker@dtucker.net> Date: Fri Jul 2 15:43:28 2021 +1000 Remove now-unused SSHv1 enums. sRhostsRSAAuthentication and sRSAAuthentication are protocol 1 options and are no longer used. """ (From OE-Core rev: 01174262c6cb8f6d7b9dbe5292d0f93f72a15691) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: upgrade to 9.3p2Ross Burton2023-08-091-1/+1
| | | | | | | | | | | | | | | 9795c401 (tag: V_9_3_P2) OpenSSH 9.3p2 bde3635f update version in README f673f2f3 update RPM spec versions d7790cdc disallow remote addition of FIDO/PKCS11 keys b23fe83f terminate pkcs11 process for bad libraries This includes the fix for CVE-2023-38408. (From OE-Core rev: 7ae89bdeaa97c8d6a0b63e92da31290548f03168) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve_check: convert CVE_CHECK_IGNORE to CVE_STATUSAndrej Valek2023-07-211-5/+4
| | | | | | | | | | | | | - Try to add convert and apply statuses for old CVEs - Drop some obsolete ignores, while they are not relevant for current version (From OE-Core rev: 1634ed4048cf56788cd5c2c1bdc979b70afcdcd7) Signed-off-by: Andrej Valek <andrej.valek@siemens.com> Reviewed-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: Remove BSD-4-clause contents completely from codebaseRiyaz Khan2023-06-072-0/+995
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Below upstream commit removed BSD-4-Clause from the LICENSE variable, Link: https://git.yoctoproject.org/poky/commit/?id=2c86f586d55d0f6b99053e3e4d14c9ee36fa8aa8 But actually if we check from the source code of the openssh for this version (8.9p1), there are some files (openbsd-compat/libressl-api-compat.c) still affected. As upstream removed this BSD-4-clause license, there are still some files has this license. Below file is affected by this BSD-4-clause contents when the below command is executed grep -rl "All advertising materials mentioning features or use of this software" *|grep -v \.1|grep -v \.5|grep -v \.8 | sort openbsd-compat/libressl-api-compat.c All advertising materials mentioning features or use of this software Reason for backporting is some of the product restrict the BSD-4-Clause usage and the purpose of this commit is to completely remove the BSD-4-Clause license from the openssh. When checked in the master branch, openssh upstream removes the bsd-4 license compeletely from this commit https://github.com/openssh/openssh-portable/commit/7280401bdd77ca54be6867a154cc01e0d72612e0 Hence Backport this commit completely to remove license of BSD-4-clause contents from code. Hunks are refreshed. (From OE-Core rev: d9045a7bc6d9acc137c292b60a8ce4d24f359a19) Signed-off-by: Riyaz Khan <Riyaz.Khan@kpit.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: upgrade 9.2p1 -> 9.3p1Siddharth Doshi2023-03-271-1/+1
| | | | | | | | | | | | | | | OpenSSH 9.3p1 fixes 1 HIGH level security vulnerability. Upgrade the recipe to point to 9.3p1. CVEs Fixed: 1) CVE-2023-28531 - ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. (From OE-Core rev: ca4b4165f388a8b8bb80c120a2baef00e7e3bcac) Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssl: Add missing ptest dependency on openssl-binRichard Purdie2023-03-121-1/+1
| | | | | | | | | One of the openssl ptests needs the openssl binary so fails on a minimal image without this. Add the missing dependency. (From OE-Core rev: c29276b467ae10027f38cb403a2089b3558fc639) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: upgrade 9.1p1 -> 9.2p1Wang Mingyu2023-02-151-1/+1
| | | | | | | | (From OE-Core rev: 845334cb22708e7a88701aa0a1bc496a67f2b5d5) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: remove RRECOMMENDS to rng-tools for sshd packageXiangyu Chen2022-12-091-8/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It appears that rngd is not needed as of linux-5.6 and later[1] and should not be installed by default since the purpose of rngd is to provide additional trusted sources of entropy. We did some testing on real hardware, the result seems to support that we no longer need rngd by default on kernel v5.6 and later. Testing result as below: 1. observing the crng init stage. the "random: crng init done" always available before fs being mounted. 2. generating random number without rngd. testing command: dd if=/dev/random of=/dev/null status=progress on Marvell CN96xx RDB board, speed almost 20.4 MB/s without block on NXP i.mx6q board, speed almost 31.9 MB/s without block on qemu x86-64, speed almost 2.6MB/s without block 3. using rngtest command without rngd testing command: rngtest -c 1000 </dev/random on Marvell CN96xx RDB board: rngtest: input channel speed: (min=4.340; avg=135.364; max=146.719)Mibits/s rngtest: FIPS tests speed: (min=8.197; avg=69.020; max=72.800)Mibits/s rngtest: Program run time: 418771 microseconds on NXP i.mx6q board: rngtest: input channel speed: (min=96.820; avg=326.769; max=340.598)Mibits/s rngtest: FIPS tests speed: (min=15.090; avg=37.543; max=40.324)Mibits/s rngtest: Program run time: 570229 microseconds on qemu x86-64: rngtest: input channel speed: (min=37.769; avg=101.136; max=136.239)Mibits/s rngtest: FIPS tests speed: (min=10.288; avg=30.682; max=40.155)Mibits/s rngtest: Program run time: 836800 microseconds 4. observing sshd service. using "systemctl disable rng-tools" disable service and reboot system. system boot up normal, sshd service also start in normal time without block. Reference: [1] https://github.com/torvalds/linux/commit/30c08efec8884fb106b8e57094baa51bb4c44e32 (From OE-Core rev: 868dfb46d96a27ec9041cb902fb769330277257d) Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: upgrade 9.0p1 -> 9.1p1wangmy2022-10-261-2/+2
| | | | | | | | | | License-Update: add Kungliga Tekniska Högskolan to copyright holders (From OE-Core rev: c80a3a7a4a9dc40cbb675777a1ba1481532ecb05) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: add support for config snippet includes to ssh and sshdJan Luebbe2022-08-212-0/+4
| | | | | | | | | | | | | | | | | This makes it simpler to set specific ssh/sshd config options by adding snippet files to /etc/ssh/ssh_config.d/ or /etc/ssh/sshd_config.d/ instead of modifying a copy of the full configuration file. As new snippets can be added from separate recipes, targeted changes can be done in multiple layers. These specific directories are also used in Debian's default configuration. (From OE-Core rev: 70447c1680672bb4741a9e1c98aadc274e1ed5a0) Signed-off-by: Jan Luebbe <jlu@pengutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: sync local ssh_config + sshd_config files with upstream 8.7p1Jan Luebbe2022-08-212-10/+9
| | | | | | | | | | | | | | Changes are caused by the removal of deprecated options. ChallengeResponseAuthentication was replaced by KbdInteractiveAuthentication in the SSHv2 protocol, see https://www.openssh.com/txt/release-8.7 (From OE-Core rev: 3a66dd6e05a65446a43cba2bf6972e78b2b13c31) Signed-off-by: Jan Luebbe <jlu@pengutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: Add openssh-sftp-server to openssh RDEPENDSAlex Kiernan2022-05-081-1/+1
| | | | | | | | | | | | OpenSSH 9.0 uses sftp by default as the transport for scp, add in sftp-server so that this works as expected for users, rather than being left with a confusing "scp: Connection closed" message. (From OE-Core rev: be61b9dac78f0d85c870a0d8304fb4b536ec4bc8) Signed-off-by: Alex Kiernan <alexk@zuma.ai> Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: upgrade 8.9p1 -> 9.0p1zhengruoqin2022-04-193-71/+1
| | | | | | | (From OE-Core rev: ee2b6da307512beecebc468194d614ba5de33d01) Signed-off-by: Zheng Ruoqin <zhengrq.fnst@fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: Default to not using sandbox when cross compilingKhem Raj2022-03-202-3/+34
| | | | | | | | | | | | | backport a patch to fix sandboxing issues seen on ppc32 and also on riscv32 [1] [1] https://bugzilla.mindrot.org/show_bug.cgi?id=3398 (From OE-Core rev: 90895a627be5e8a4e4943fa9195b5553416086d3) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: update 8.8 -> 8.9Alexander Kanavin2022-03-093-8/+45
| | | | | | | | | | | | | | License-Update: blowfish relicensed under 3-BSD. Fix up ptests; listing the helper binaries one by one is not necessary. Unittests are skipped explicitly in run-ptest, no need to avoid building them. They still take long, but they can be executed on target if wanted. (From OE-Core rev: 9f031d936edb69c038639656288c84564434b906) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* meta/scripts: Automated conversion of OE renamed variablesRichard Purdie2022-02-211-3/+3
| | | | | | (From OE-Core rev: aa52af4518604b5bf13f3c5e885113bf868d6c81) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: upgrade 8.7p1 -> 8.8p1Alexander Kanavin2021-10-231-1/+1
| | | | | | | | (From OE-Core rev: 15ae6c75ed201d1f16c5cc1494314cb49968370c) Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* systemd: '${systemd_unitdir}/system' => '${systemd_system_unitdir}'Robert P. J. Day2021-09-071-6/+6
| | | | | | | | | | | Repo-wide replacement to use newer variable to represent systemd system unitdir directory. (From OE-Core rev: 5ace3ada5c54500c71becc8e0c6eddeb8bc053e3) Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: remove redundant BSD licenseRoss Burton2021-09-031-1/+1
| | | | | | | | | | The license statement already includes BSD-2-Clause and BSD-3-Clause, so remove the redundant and ambiguous BSD license. (From OE-Core rev: 5c0b03cda19bcebfc71e1e601a4336fcda4bfc2b) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: upgrade 8.6p1 -> 8.7p1Alexander Kanavin2021-08-261-1/+1
| | | | | | | (From OE-Core rev: e744b59d6ba40ba1b810d8912ea65778655103bc) Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* Convert to new override syntaxRichard Purdie2021-08-021-30/+30
| | | | | | | | | | | | This is the result of automated script conversion: scripts/contrib/convert-overrides.py <oe-core directory> converting the metadata to use ":" as the override character instead of "_". (From OE-Core rev: 42344347be29f0997cc2f7636d9603b1fe1875ae) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: Remove temporary keys before generating new onesAsfak Rahman2021-07-021-0/+1
| | | | | | | | | | | | Key generation may wait for user input, due to the existence of temporary keys resulting from power interruption in the first boot. This prevents users from login via ssh. (From OE-Core rev: 3196249a6917a32491be56e70bbf26d3b9818e0e) Signed-off-by: Asfak Rahman <asfakr@outlook.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-01-08 16:31:12 +0000