linux/poky.git/meta/recipes-connectivity/openssh, branch mickledore

openssh: upgrade to 9.3p2

2023-08-18T13:57:05+00:00

9795c401 (tag: V_9_3_P2) OpenSSH 9.3p2 bde3635f update version in README f673f2f3 update RPM spec versions d7790cdc disallow remote addition of FIDO/PKCS11 keys b23fe83f terminate pkcs11 process for bad libraries This includes the fix for CVE-2023-38408. (From OE-Core rev: b76fb3ee4b339cfbbb332ed239826b3efcdb6f1e) Signed-off-by: Ross Burton (cherry picked from commit 7ae89bdeaa97c8d6a0b63e92da31290548f03168) Signed-off-by: Steve Sakoman

openssh: Remove BSD-4-clause contents completely from codebase

2023-06-30T14:07:59+00:00

Below upstream commit removed BSD-4-Clause from the LICENSE variable, Link: https://git.yoctoproject.org/poky/commit/?id=2c86f586d55d0f6b99053e3e4d14c9ee36fa8aa8 But actually if we check from the source code of the openssh for this version (8.9p1), there are some files (openbsd-compat/libressl-api-compat.c) still affected. As upstream removed this BSD-4-clause license, there are still some files has this license. Below file is affected by this BSD-4-clause contents when the below command is executed grep -rl "All advertising materials mentioning features or use of this software" *|grep -v \.1|grep -v \.5|grep -v \.8 | sort openbsd-compat/libressl-api-compat.c All advertising materials mentioning features or use of this software Reason for backporting is some of the product restrict the BSD-4-Clause usage and the purpose of this commit is to completely remove the BSD-4-Clause license from the openssh. When checked in the master branch, openssh upstream removes the bsd-4 license compeletely from this commit https://github.com/openssh/openssh-portable/commit/7280401bdd77ca54be6867a154cc01e0d72612e0 Hence Backport this commit completely to remove license of BSD-4-clause contents from code. Hunks are refreshed. (From OE-Core rev: 859f00732c3b123aa4adb911371f1d9cf02c85fb) Signed-off-by: Riyaz Khan Signed-off-by: Alexandre Belloni (cherry picked from commit d9045a7bc6d9acc137c292b60a8ce4d24f359a19) Signed-off-by: Steve Sakoman

openssh: upgrade 9.2p1 -> 9.3p1

2023-03-27T14:44:02+00:00

OpenSSH 9.3p1 fixes 1 HIGH level security vulnerability. Upgrade the recipe to point to 9.3p1. CVEs Fixed: 1) CVE-2023-28531 - ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. (From OE-Core rev: ca4b4165f388a8b8bb80c120a2baef00e7e3bcac) Signed-off-by: Siddharth Doshi Signed-off-by: Richard Purdie

openssl: Add missing ptest dependency on openssl-bin

2023-03-12T23:39:13+00:00

One of the openssl ptests needs the openssl binary so fails on a minimal image without this. Add the missing dependency. (From OE-Core rev: c29276b467ae10027f38cb403a2089b3558fc639) Signed-off-by: Richard Purdie

openssh: upgrade 9.1p1 -> 9.2p1

2023-02-15T10:21:35+00:00

(From OE-Core rev: 845334cb22708e7a88701aa0a1bc496a67f2b5d5) Signed-off-by: Wang Mingyu Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

openssh: remove RRECOMMENDS to rng-tools for sshd package

2022-12-09T13:18:41+00:00

It appears that rngd is not needed as of linux-5.6 and later[1] and should not be installed by default since the purpose of rngd is to provide additional trusted sources of entropy. We did some testing on real hardware, the result seems to support that we no longer need rngd by default on kernel v5.6 and later. Testing result as below: 1. observing the crng init stage. the "random: crng init done" always available before fs being mounted. 2. generating random number without rngd. testing command: dd if=/dev/random of=/dev/null status=progress on Marvell CN96xx RDB board, speed almost 20.4 MB/s without block on NXP i.mx6q board, speed almost 31.9 MB/s without block on qemu x86-64, speed almost 2.6MB/s without block 3. using rngtest command without rngd testing command: rngtest -c 1000 Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

openssh: upgrade 9.0p1 -> 9.1p1

2022-10-26T11:28:38+00:00

License-Update: add Kungliga Tekniska Högskolan to copyright holders (From OE-Core rev: c80a3a7a4a9dc40cbb675777a1ba1481532ecb05) Signed-off-by: Wang Mingyu Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

openssh: add support for config snippet includes to ssh and sshd

2022-08-21T21:51:41+00:00

This makes it simpler to set specific ssh/sshd config options by adding snippet files to /etc/ssh/ssh_config.d/ or /etc/ssh/sshd_config.d/ instead of modifying a copy of the full configuration file. As new snippets can be added from separate recipes, targeted changes can be done in multiple layers. These specific directories are also used in Debian's default configuration. (From OE-Core rev: 70447c1680672bb4741a9e1c98aadc274e1ed5a0) Signed-off-by: Jan Luebbe Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

openssh: sync local ssh_config + sshd_config files with upstream 8.7p1

2022-08-21T21:51:41+00:00

Changes are caused by the removal of deprecated options. ChallengeResponseAuthentication was replaced by KbdInteractiveAuthentication in the SSHv2 protocol, see https://www.openssh.com/txt/release-8.7 (From OE-Core rev: 3a66dd6e05a65446a43cba2bf6972e78b2b13c31) Signed-off-by: Jan Luebbe Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

openssh: Add openssh-sftp-server to openssh RDEPENDS

2022-05-08T22:50:34+00:00

OpenSSH 9.0 uses sftp by default as the transport for scp, add in sftp-server so that this works as expected for users, rather than being left with a confusing "scp: Connection closed" message. (From OE-Core rev: be61b9dac78f0d85c870a0d8304fb4b536ec4bc8) Signed-off-by: Alex Kiernan Signed-off-by: Alex Kiernan Signed-off-by: Richard Purdie