CVE only applies to some distributed RHEL binaries so irrelavent to us.
(From OE-Core rev: 5d8b3ddf91050f6745a99a8abb1c3b03c35247af)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
We don't build/use the OPIE PAM module, exclude the CVE from this recipe.
(From OE-Core rev: 3670be602f2ace24dc49e196407efec577164050)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Update LICENSE to show that BSD-2-Clause, BSD-3-Clause and BSD-4-Clause
are all present.
(From OE-Core rev: d17938953fc2524bc5f04db4409a47aa400e756a)
Signed-off-by: Wang Mingyu <wangmy@cn.fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
0f90440ca70abab947acbd77795e9f130967956c.patch
removed since it is included in 8.5p1
License Updated :
2-clause BSD license and 4-clause BSD license added
(From OE-Core rev: 60ab470f8759539547a96f1b47299b7b16d6a630)
Signed-off-by: Wang Mingyu <wangmy@cn.fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This fixes openssh failing to work on qemux86 with glibc 2.33 due to
seccomp and the fact new syscalls are used. Also likely fixes issues
on other platforms.
(From OE-Core rev: 22f8ce6e6d998c0539a40b2776b1a2abb4f44bb3)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The OpenSSH server, as used in Fedora and Red Hat Enterprise
Linux 7 and when running in a Kerberos environment, allows remote
authenticated users to log in as another user when they are listed
in the .k5users file of that user, which might bypass intended
authentication requirements that would force a local login.
Whitelist the CVE since this issue is Redhat specific.
(From OE-Core rev: 309132e50d23b1e3f15ef8db1a101166b35f7ca4)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
We are adding a new PACKAGECONFIG option ('rng-tools') to control if we
wish the openssh-sshd to RRECOMMENDS the 'rng-tools' package. We are
enabling it by default so there is no behavior change.
(From OE-Core rev: fe99349c1bd72b69d22ab0dc52b8825d3157b8e7)
Signed-off-by: Otavio Salvador <otavio@ossystems.com.br>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Where we have images with PAM+systemd, serial login can be extremely
slow. The load generated by key generation does slow down the rest
of the boot process.
Lower the priority level of these systemd services, since we'd
prefer to have the rest of the system boot more effectively.
This doesn't "solve" the slow systemd boot issues but does help.
(From OE-Core rev: 087700665284c08ba846e52b6b86276629f5f1cd)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
With systemd v246 the syslog target now generates a warning (and has
been deprecated for some time). Drop the target and allow the default to
take effect.
(From OE-Core rev: 2ba088d8373d9d54930bc3f5ec1799ea1a6ffafc)
Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
sshd.socket launches the templated sshd@.service, so by moving the
sshdgenkeys.service to sshd.socket, key generation can start in advance
of a connection.
(From OE-Core rev: af38a39b4bed9e43c5075008be47ca72191a489e)
Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Drop backports from upstream:
0001-Manually-applied-upstream-fix-for-openssh-test.patch
0001-seccomp-Allow-clock_gettime64-in-sandbox.patch
openssh-8.1p1-seccomp-nanosleep.patch
(From OE-Core rev: c9b5802bbe1de609450f509edf4721ab0a7a70aa)
Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
These tests are already implicitly excluded by not being built.
This change avoids a confusing failure-but-not-really printed by
run-ptest.
(From OE-Core rev: f3e27d8e23df37fb06f77af1583021f471dede51)
Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Fixes connection denials with these syscalls being there on upcoming glibc 2.31 release
(From OE-Core rev: 557d464de217cdf959aa275d20e7b155e4130ec7)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Drop upstream backport of integer overflow in XMSS private key parsing.
Add PACKAGECONFIG for kerberos, libedit and ldns. If api-documentation
is enabled then install man(7) manpages rather than catman pages.
License-Update: convert to UTF-8
(From OE-Core rev: b084fa095800c090389b9c00d66f109d7cd11455)
Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The LICENSE file states that some code is licensed under BSD, some under
ISC, and some under MIT. The LICENSE field should reflect all of these.
(From OE-Core rev: 91096392cf46cae369849723cea14a9da1f3053b)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Changes to libxcrypt revealed a missing dependency in the openssh recipe.
(From OE-Core rev: 0fd0a1b1f733a8d9978d64fa23e9d083a716de87)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Pointer arithmatic results in implementation defined signed integer
type, so that 'd - dst’ in strlcat may trigger signed overflow if
pointer ‘d’ is near 0x7fffffff in 32 bits system. In case of ompilation
by gcc or clang with -ftrapv option, the overflow would generate
program abort.
(From OE-Core rev: 1c4b8d797c76a08ebd1658066e9d32972b6abe58)
Signed-off-by: hguo3 <heng.guo@windriver.com>
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
In minimal images the agent-ptrace test is skipped unless gdb is
installed which explains the difference in test counts. We don't
want a build dependency on gdb and the test isn't critical so just
document the dependency.
(From OE-Core rev: d3f29e6e52367e124e3f543f970038c0332ad3e1)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This fixes the openssh tests in minimal images since they use options
not present in the busybox versions of the commands.
[YOCTO #13295]
(From OE-Core rev: 4059d8eedc5cf6f46a834997b7120150fcec4c0e)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Upgrade from openssh_7.9p1.bb to openssh_8.0p1.bb.
-openssh/0001-upstream-Have-progressmeter-force-an-update-at-the-b.patch
-openssh/CVE-2018-20685.patch
-openssh/CVE-2019-6109.patch
-openssh/CVE-2019-6111.patch
-Removed since these are included in 8.0p1.
(From OE-Core rev: 7e21cfec4de3d66585c92632e1503df54a89b79a)
Signed-off-by: Zang Ruochen <zangrc.fnst@cn.fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Without this we see test failures due to the sudo binary being missing.
(From OE-Core rev: b9e4db06dd95ce709a4a895014cc98fdd7df4624)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Since openssl 1.1.1 and openssh which uses it, sshd
startup is delayed. The delays range from few seconds
to minutes and even to hours. The delays are visible
in host keys generation and when sshd process is started
in response to incoming TCP connection but is failing
to provide SSH version string and clients or tests time out.
In all cases traces show that sshd is waiting for getentropy()
system call to return from Linux kernel, which returns only
after kernel side random number pool is initialized. The pool
is initialized via various entropy source which may be
missing on embedded development boards or via rngd from
rng-tools package from userspace. HW random number generation
and kernel support help but rngd is till needed to feed that data
back to the Linux kernel.
Example from an NXP imx8 board shows that kernel random number pool
initialization can take over 400 seconds without rngd,
and with rngd it is initialized at around 4 seconds after boot.
The completion of initialization is visible in kernel dmesg with line
"random: crng init done".
More details are available from:
* https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=912087
* https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=897572
* https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=43838a23a05fbd13e47d750d3dfd77001536dd33
* http://www.man7.org/linux/man-pages/man2/getrandom.2.html
(From OE-Core rev: 9b01375236e19e3366c58877c4154d7c71632984)
Signed-off-by: Mikko Rapeli <mikko.rapeli@bmw.de>
Cc: Mark Hatle <mark.hatle@windriver.com>
Cc: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
Cc: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Also backport a patch to fix issues introduced by fix for CVE-2019-6109.
(From OE-Core rev: 31b7485d8377c1c535d1878220bbc1d49dc5f13e)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
We need to run sed with the -u option to ensure the output is unbuffered else
ptest-runner may timeout thinkig things were idle. Busybox doesn't have the -u
option so we need to RDEPEND on sed (which is a good thing to do if we use it
anyway).
Alex Kanavin should get credit for discovering the problem.
(From OE-Core rev: d3ffbebf43c23faa43af81c9ecf6fcaef36d675b)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This was change to git recently to obtain openssl 1.1 compatible pre-release code
(before 7.9 was out), however tarballs are preferred, and with them upstream version
checks work (openssh uses a weird git tag scheme).
(From OE-Core rev: a921a96e84f4d0b3f3d29a571981de08eb148e15)
Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
- Convert from tarball to git repository which support
openssl 1.1.x
- There is no specific minor version that contains the
openssl fix (it was merged to master a few days agao),
rename recipe version to `7.8p1+git'
- Fix regression test binaries missing
In commit `1f7aaf7 openssh: build regression test binaries', it build
regression test binaries, since upstream add two binaries in commits
`c59aca8 Create control sockets in clean temp directories' and
`1acc058 Disable tests where fs perms are incorrect', we should update
do_compile_ptest.
[ptest log]
|/usr/lib/openssh/ptest/regress/test-exec.sh: line 330: /usr/lib/openssh/
ptest/regress/mkdtemp: No such file or directory
[ptest log]
(From OE-Core rev: 9d48cb3da696add33315cf129fe60102bd9756c9)
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Drop the disable-ciphers patch since it has been integrated:
cec33896 Omit 3des-cbc if OpenSSL built without DES.
(From OE-Core rev: 7d35f5bb7b1700ae4bb7f55af8db7357a851c15a)
Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
And use bitbake variables for install paths to fix nativesdk-openssh
compilation.
(From OE-Core rev: 70470dfa88338cae06670195bb7009cb13098ac2)
Signed-off-by: Mikko Rapeli <mikko.rapeli@bmw.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Previously sshd_check_keys would create a full set of all possible
sshd host keys, even if sshd_config has been set to only enable
certain key types.
Update sshd_check_keys to only create keys which have been enabled in
sshd_config (with a fallback to creating a full set of key types if
no HostKey options are defined, as before).
(From OE-Core rev: 2303d795ae96f1a60caf145a0ddf100e89c4b5b0)
Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Changes are mostly related to the removal of support for SSH v.1
protocol, which was dropped from openssh sshd in 7.4p1:
https://www.openssh.com/txt/release-7.4
(From OE-Core rev: b81389c50e0d191e31f71af82d86bfbb37b83acc)
Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The openssh sshd init script contains a mix of indent styles, mostly
inherited from the Debian script from which it is derived. Leave the
indent from Debian as-is, but for lines which are OE specific (e.g.
where Debian's log_daemon_msg helper has been replaced with echo)
make the indent consistent with surrounding lines.
(From OE-Core rev: 68fb7d3b06887e0db3eef0ab231ced37cfa4894c)
Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The "ssh-keygen" package no longer seems to be provided by any recipe
in oe-core or meta-oe, so there's no clear reason for the
openssh-keygen package to conflict with it.
(From OE-Core rev: 0c5567847edba6b5ab24ae505d16375397cf4b40)
Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Openssh takes care of enabling large-file support automatically via
the AC_SYS_LARGEFILE in the configure.ac, so additional help from the
recipe is not required.
Even if it were once required, defining __FILE_OFFSET_BITS (ie with
double leading underscores) looks like a typo and probably never had
any effect anyway?
(From OE-Core rev: 37b1a7bada267b89094ce0c3eb81b1de9f04df8e)
Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
While compiling openssl with option `no-des', it caused the openssh
build failure
...
cipher.c:85:41: error: 'EVP_des_ede3_cbc' undeclared here (not in a function);
...
OpenSSL configured that way defines OPENSSL_NO_DES to disable des
(From OE-Core rev: 08a5cda85594fca8b352841a26131bfac39c8417)
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
LICENSE changed do to name being added
removed patches included in some form
(From OE-Core rev: 88770be201678bf1906e27d72e840de2cd4c43f0)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Generating the host keys atomically prevents power interruptions during the
first boot from leaving the key files incomplete, which often prevents users
from being able to ssh into the device.
[YOCTO #11671]
(From OE-Core rev: 221b40f1f08ee23511ba078a1efd01686922e932)
Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
