]>
Commit | Line | Data |
---|---|---|
2e437378 | 1 | %define ver 4.5p1 |
2980ea68 | 2 | %define rel 1 |
3 | ||
4 | # OpenSSH privilege separation requires a user & group ID | |
5 | %define sshd_uid 74 | |
6 | %define sshd_gid 74 | |
3c0ef626 | 7 | |
8 | # Version of ssh-askpass | |
9 | %define aversion 1.2.4.1 | |
10 | ||
11 | # Do we want to disable building of x11-askpass? (1=yes 0=no) | |
12 | %define no_x11_askpass 0 | |
13 | ||
14 | # Do we want to disable building of gnome-askpass? (1=yes 0=no) | |
15 | %define no_gnome_askpass 0 | |
16 | ||
17 | # Do we want to link against a static libcrypto? (1=yes 0=no) | |
18 | %define static_libcrypto 0 | |
19 | ||
20 | # Do we want smartcard support (1=yes 0=no) | |
21 | %define scard 0 | |
22 | ||
e54b3d7c | 23 | # Use GTK2 instead of GNOME in gnome-ssh-askpass |
1c14df9e | 24 | %define gtk2 1 |
e54b3d7c | 25 | |
2980ea68 | 26 | # Is this build for RHL 6.x? |
27 | %define build6x 0 | |
3c0ef626 | 28 | |
ff2d7a98 | 29 | # Do we want kerberos5 support (1=yes 0=no) |
30 | %define kerberos5 1 | |
31 | ||
3c0ef626 | 32 | # Reserve options to override askpass settings with: |
33 | # rpm -ba|--rebuild --define 'skip_xxx 1' | |
34 | %{?skip_x11_askpass:%define no_x11_askpass 1} | |
35 | %{?skip_gnome_askpass:%define no_gnome_askpass 1} | |
36 | ||
416fd2a8 | 37 | # Add option to build without GTK2 for older platforms with only GTK+. |
38 | # RedHat <= 7.2 and Red Hat Advanced Server 2.1 are examples. | |
39 | # rpm -ba|--rebuild --define 'no_gtk2 1' | |
40 | %{?no_gtk2:%define gtk2 0} | |
41 | ||
2980ea68 | 42 | # Is this a build for RHL 6.x or earlier? |
43 | %{?build_6x:%define build6x 1} | |
44 | ||
45 | # If this is RHL 6.x, the default configuration has sysconfdir in /usr/etc. | |
46 | %if %{build6x} | |
47 | %define _sysconfdir /etc | |
2980ea68 | 48 | %endif |
3c0ef626 | 49 | |
50 | # Options for static OpenSSL link: | |
51 | # rpm -ba|--rebuild --define "static_openssl 1" | |
52 | %{?static_openssl:%define static_libcrypto 1} | |
53 | ||
54 | # Options for Smartcard support: (needs libsectok and openssl-engine) | |
55 | # rpm -ba|--rebuild --define "smartcard 1" | |
56 | %{?smartcard:%define scard 1} | |
57 | ||
2980ea68 | 58 | # Is this a build for the rescue CD (without PAM, with MD5)? (1=yes 0=no) |
59 | %define rescue 0 | |
60 | %{?build_rescue:%define rescue 1} | |
3c0ef626 | 61 | |
ff2d7a98 | 62 | # Turn off some stuff for resuce builds |
63 | %if %{rescue} | |
64 | %define kerberos5 0 | |
65 | %endif | |
66 | ||
2980ea68 | 67 | Summary: The OpenSSH implementation of SSH protocol versions 1 and 2. |
3c0ef626 | 68 | Name: openssh |
2980ea68 | 69 | Version: %{ver} |
70 | %if %{rescue} | |
71 | Release: %{rel}rescue | |
72 | %else | |
73 | Release: %{rel} | |
74 | %endif | |
3c0ef626 | 75 | URL: http://www.openssh.com/portable.html |
2980ea68 | 76 | Source0: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz |
1b56ff3d | 77 | Source1: http://www.jmknoble.net/software/x11-ssh-askpass/x11-ssh-askpass-%{aversion}.tar.gz |
3c0ef626 | 78 | License: BSD |
79 | Group: Applications/Internet | |
80 | BuildRoot: %{_tmppath}/%{name}-%{version}-buildroot | |
81 | Obsoletes: ssh | |
2980ea68 | 82 | %if %{build6x} |
83 | PreReq: initscripts >= 5.00 | |
84 | %else | |
85 | PreReq: initscripts >= 5.20 | |
86 | %endif | |
70791e56 | 87 | BuildPreReq: perl, openssl-devel, tcp_wrappers |
2980ea68 | 88 | BuildPreReq: /bin/login |
e54b3d7c | 89 | %if ! %{build6x} |
2980ea68 | 90 | BuildPreReq: glibc-devel, pam |
91 | %else | |
70791e56 | 92 | BuildPreReq: /usr/include/security/pam_appl.h |
2980ea68 | 93 | %endif |
3c0ef626 | 94 | %if ! %{no_x11_askpass} |
95 | BuildPreReq: XFree86-devel | |
96 | %endif | |
97 | %if ! %{no_gnome_askpass} | |
e54b3d7c | 98 | BuildPreReq: pkgconfig |
3c0ef626 | 99 | %endif |
ff2d7a98 | 100 | %if %{kerberos5} |
101 | BuildPreReq: krb5-devel | |
102 | BuildPreReq: krb5-libs | |
103 | %endif | |
3c0ef626 | 104 | |
105 | %package clients | |
106 | Summary: OpenSSH clients. | |
107 | Requires: openssh = %{version}-%{release} | |
108 | Group: Applications/Internet | |
109 | Obsoletes: ssh-clients | |
110 | ||
111 | %package server | |
112 | Summary: The OpenSSH server daemon. | |
113 | Group: System Environment/Daemons | |
114 | Obsoletes: ssh-server | |
115 | PreReq: openssh = %{version}-%{release}, chkconfig >= 0.9 | |
2980ea68 | 116 | %if ! %{build6x} |
3c0ef626 | 117 | Requires: /etc/pam.d/system-auth |
118 | %endif | |
119 | ||
120 | %package askpass | |
121 | Summary: A passphrase dialog for OpenSSH and X. | |
122 | Group: Applications/Internet | |
123 | Requires: openssh = %{version}-%{release} | |
124 | Obsoletes: ssh-extras | |
125 | ||
126 | %package askpass-gnome | |
127 | Summary: A passphrase dialog for OpenSSH, X, and GNOME. | |
128 | Group: Applications/Internet | |
129 | Requires: openssh = %{version}-%{release} | |
130 | Obsoletes: ssh-extras | |
131 | ||
132 | %description | |
2980ea68 | 133 | SSH (Secure SHell) is a program for logging into and executing |
134 | commands on a remote machine. SSH is intended to replace rlogin and | |
135 | rsh, and to provide secure encrypted communications between two | |
136 | untrusted hosts over an insecure network. X11 connections and | |
137 | arbitrary TCP/IP ports can also be forwarded over the secure channel. | |
138 | ||
139 | OpenSSH is OpenBSD's version of the last free version of SSH, bringing | |
140 | it up to date in terms of security and features, as well as removing | |
141 | all patented algorithms to separate libraries. | |
3c0ef626 | 142 | |
143 | This package includes the core files necessary for both the OpenSSH | |
144 | client and server. To make this package useful, you should also | |
145 | install openssh-clients, openssh-server, or both. | |
146 | ||
147 | %description clients | |
2980ea68 | 148 | OpenSSH is a free version of SSH (Secure SHell), a program for logging |
149 | into and executing commands on a remote machine. This package includes | |
150 | the clients necessary to make encrypted connections to SSH servers. | |
151 | You'll also need to install the openssh package on OpenSSH clients. | |
3c0ef626 | 152 | |
153 | %description server | |
2980ea68 | 154 | OpenSSH is a free version of SSH (Secure SHell), a program for logging |
155 | into and executing commands on a remote machine. This package contains | |
156 | the secure shell daemon (sshd). The sshd daemon allows SSH clients to | |
157 | securely connect to your SSH server. You also need to have the openssh | |
158 | package installed. | |
3c0ef626 | 159 | |
160 | %description askpass | |
2980ea68 | 161 | OpenSSH is a free version of SSH (Secure SHell), a program for logging |
162 | into and executing commands on a remote machine. This package contains | |
163 | an X11 passphrase dialog for OpenSSH. | |
3c0ef626 | 164 | |
165 | %description askpass-gnome | |
2980ea68 | 166 | OpenSSH is a free version of SSH (Secure SHell), a program for logging |
167 | into and executing commands on a remote machine. This package contains | |
168 | an X11 passphrase dialog for OpenSSH and the GNOME GUI desktop | |
169 | environment. | |
3c0ef626 | 170 | |
171 | %prep | |
172 | ||
173 | %if ! %{no_x11_askpass} | |
174 | %setup -q -a 1 | |
175 | %else | |
176 | %setup -q | |
177 | %endif | |
178 | ||
179 | %build | |
2980ea68 | 180 | %if %{rescue} |
181 | CFLAGS="$RPM_OPT_FLAGS -Os"; export CFLAGS | |
3c0ef626 | 182 | %endif |
183 | ||
416fd2a8 | 184 | %if %{kerberos5} |
185 | K5DIR=`rpm -ql krb5-devel | grep include/krb5.h | sed 's,\/include\/krb5.h,,'` | |
186 | echo K5DIR=$K5DIR | |
187 | %endif | |
188 | ||
3c0ef626 | 189 | %configure \ |
2980ea68 | 190 | --sysconfdir=%{_sysconfdir}/ssh \ |
3c0ef626 | 191 | --libexecdir=%{_libexecdir}/openssh \ |
192 | --datadir=%{_datadir}/openssh \ | |
3c0ef626 | 193 | --with-tcp-wrappers \ |
2980ea68 | 194 | --with-rsh=%{_bindir}/rsh \ |
195 | --with-default-path=/usr/local/bin:/bin:/usr/bin \ | |
196 | --with-superuser-path=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin \ | |
197 | --with-privsep-path=%{_var}/empty/sshd \ | |
416fd2a8 | 198 | --with-md5-passwords \ |
2980ea68 | 199 | %if %{scard} |
200 | --with-smartcard \ | |
201 | %endif | |
2980ea68 | 202 | %if %{rescue} |
416fd2a8 | 203 | --without-pam \ |
2980ea68 | 204 | %else |
ff2d7a98 | 205 | --with-pam \ |
206 | %endif | |
207 | %if %{kerberos5} | |
416fd2a8 | 208 | --with-kerberos5=$K5DIR \ |
2980ea68 | 209 | %endif |
210 | ||
3c0ef626 | 211 | |
212 | %if %{static_libcrypto} | |
2980ea68 | 213 | perl -pi -e "s|-lcrypto|%{_libdir}/libcrypto.a|g" Makefile |
3c0ef626 | 214 | %endif |
215 | ||
216 | make | |
217 | ||
218 | %if ! %{no_x11_askpass} | |
219 | pushd x11-ssh-askpass-%{aversion} | |
2980ea68 | 220 | %configure --libexecdir=%{_libexecdir}/openssh |
3c0ef626 | 221 | xmkmf -a |
222 | make | |
223 | popd | |
224 | %endif | |
225 | ||
e54b3d7c | 226 | # Define a variable to toggle gnome1/gtk2 building. This is necessary |
227 | # because RPM doesn't handle nested %if statements. | |
228 | %if %{gtk2} | |
229 | gtk2=yes | |
230 | %else | |
231 | gtk2=no | |
232 | %endif | |
233 | ||
3c0ef626 | 234 | %if ! %{no_gnome_askpass} |
235 | pushd contrib | |
e54b3d7c | 236 | if [ $gtk2 = yes ] ; then |
237 | make gnome-ssh-askpass2 | |
238 | mv gnome-ssh-askpass2 gnome-ssh-askpass | |
239 | else | |
240 | make gnome-ssh-askpass1 | |
241 | mv gnome-ssh-askpass1 gnome-ssh-askpass | |
242 | fi | |
3c0ef626 | 243 | popd |
244 | %endif | |
245 | ||
246 | %install | |
247 | rm -rf $RPM_BUILD_ROOT | |
2980ea68 | 248 | mkdir -p -m755 $RPM_BUILD_ROOT%{_sysconfdir}/ssh |
249 | mkdir -p -m755 $RPM_BUILD_ROOT%{_libexecdir}/openssh | |
250 | mkdir -p -m755 $RPM_BUILD_ROOT%{_var}/empty/sshd | |
3c0ef626 | 251 | |
2980ea68 | 252 | make install DESTDIR=$RPM_BUILD_ROOT |
3c0ef626 | 253 | |
254 | install -d $RPM_BUILD_ROOT/etc/pam.d/ | |
255 | install -d $RPM_BUILD_ROOT/etc/rc.d/init.d | |
256 | install -d $RPM_BUILD_ROOT%{_libexecdir}/openssh | |
2980ea68 | 257 | %if %{build6x} |
258 | install -m644 contrib/redhat/sshd.pam.old $RPM_BUILD_ROOT/etc/pam.d/sshd | |
3c0ef626 | 259 | %else |
2980ea68 | 260 | install -m644 contrib/redhat/sshd.pam $RPM_BUILD_ROOT/etc/pam.d/sshd |
3c0ef626 | 261 | %endif |
262 | install -m755 contrib/redhat/sshd.init $RPM_BUILD_ROOT/etc/rc.d/init.d/sshd | |
263 | ||
264 | %if ! %{no_x11_askpass} | |
265 | install -s x11-ssh-askpass-%{aversion}/x11-ssh-askpass $RPM_BUILD_ROOT%{_libexecdir}/openssh/x11-ssh-askpass | |
2980ea68 | 266 | ln -s x11-ssh-askpass $RPM_BUILD_ROOT%{_libexecdir}/openssh/ssh-askpass |
3c0ef626 | 267 | %endif |
268 | ||
269 | %if ! %{no_gnome_askpass} | |
270 | install -s contrib/gnome-ssh-askpass $RPM_BUILD_ROOT%{_libexecdir}/openssh/gnome-ssh-askpass | |
271 | %endif | |
272 | ||
e54b3d7c | 273 | %if ! %{scard} |
274 | rm -f $RPM_BUILD_ROOT/usr/share/openssh/Ssh.bin | |
275 | %endif | |
276 | ||
70791e56 | 277 | %if ! %{no_gnome_askpass} |
2980ea68 | 278 | install -m 755 -d $RPM_BUILD_ROOT%{_sysconfdir}/profile.d/ |
279 | install -m 755 contrib/redhat/gnome-ssh-askpass.csh $RPM_BUILD_ROOT%{_sysconfdir}/profile.d/ | |
280 | install -m 755 contrib/redhat/gnome-ssh-askpass.sh $RPM_BUILD_ROOT%{_sysconfdir}/profile.d/ | |
70791e56 | 281 | %endif |
2980ea68 | 282 | |
3c0ef626 | 283 | perl -pi -e "s|$RPM_BUILD_ROOT||g" $RPM_BUILD_ROOT%{_mandir}/man*/* |
284 | ||
285 | %clean | |
286 | rm -rf $RPM_BUILD_ROOT | |
287 | ||
2980ea68 | 288 | %triggerun server -- ssh-server |
289 | if [ "$1" != 0 -a -r /var/run/sshd.pid ] ; then | |
290 | touch /var/run/sshd.restart | |
291 | fi | |
292 | ||
293 | %triggerun server -- openssh-server < 2.5.0p1 | |
294 | # Count the number of HostKey and HostDsaKey statements we have. | |
295 | gawk 'BEGIN {IGNORECASE=1} | |
296 | /^hostkey/ || /^hostdsakey/ {sawhostkey = sawhostkey + 1} | |
297 | END {exit sawhostkey}' /etc/ssh/sshd_config | |
298 | # And if we only found one, we know the client was relying on the old default | |
299 | # behavior, which loaded the the SSH2 DSA host key when HostDsaKey wasn't | |
300 | # specified. Now that HostKey is used for both SSH1 and SSH2 keys, specifying | |
301 | # one nullifies the default, which would have loaded both. | |
302 | if [ $? -eq 1 ] ; then | |
303 | echo HostKey /etc/ssh/ssh_host_rsa_key >> /etc/ssh/sshd_config | |
304 | echo HostKey /etc/ssh/ssh_host_dsa_key >> /etc/ssh/sshd_config | |
305 | fi | |
306 | ||
307 | %triggerpostun server -- ssh-server | |
308 | if [ "$1" != 0 ] ; then | |
309 | /sbin/chkconfig --add sshd | |
310 | if test -f /var/run/sshd.restart ; then | |
311 | rm -f /var/run/sshd.restart | |
312 | /sbin/service sshd start > /dev/null 2>&1 || : | |
313 | fi | |
314 | fi | |
315 | ||
316 | %pre server | |
317 | %{_sbindir}/groupadd -r -g %{sshd_gid} sshd 2>/dev/null || : | |
318 | %{_sbindir}/useradd -d /var/empty/sshd -s /bin/false -u %{sshd_uid} \ | |
319 | -g sshd -M -r sshd 2>/dev/null || : | |
320 | ||
3c0ef626 | 321 | %post server |
322 | /sbin/chkconfig --add sshd | |
2980ea68 | 323 | |
324 | %postun server | |
325 | /sbin/service sshd condrestart > /dev/null 2>&1 || : | |
3c0ef626 | 326 | |
327 | %preun server | |
2980ea68 | 328 | if [ "$1" = 0 ] |
329 | then | |
330 | /sbin/service sshd stop > /dev/null 2>&1 || : | |
3c0ef626 | 331 | /sbin/chkconfig --del sshd |
332 | fi | |
333 | ||
334 | %files | |
335 | %defattr(-,root,root) | |
336 | %doc CREDITS ChangeLog INSTALL LICENCE OVERVIEW README* RFC* TODO WARNING* | |
3c0ef626 | 337 | %attr(0755,root,root) %{_bindir}/scp |
3c0ef626 | 338 | %attr(0644,root,root) %{_mandir}/man1/scp.1* |
2980ea68 | 339 | %attr(0755,root,root) %dir %{_sysconfdir}/ssh |
340 | %attr(0600,root,root) %config(noreplace) %{_sysconfdir}/ssh/moduli | |
341 | %if ! %{rescue} | |
342 | %attr(0755,root,root) %{_bindir}/ssh-keygen | |
343 | %attr(0644,root,root) %{_mandir}/man1/ssh-keygen.1* | |
3c0ef626 | 344 | %attr(0755,root,root) %dir %{_libexecdir}/openssh |
ff2d7a98 | 345 | %attr(4711,root,root) %{_libexecdir}/openssh/ssh-keysign |
346 | %attr(0644,root,root) %{_mandir}/man8/ssh-keysign.8* | |
2980ea68 | 347 | %endif |
3c0ef626 | 348 | %if %{scard} |
349 | %attr(0755,root,root) %dir %{_datadir}/openssh | |
350 | %attr(0644,root,root) %{_datadir}/openssh/Ssh.bin | |
351 | %endif | |
352 | ||
353 | %files clients | |
354 | %defattr(-,root,root) | |
ff2d7a98 | 355 | %attr(0755,root,root) %{_bindir}/ssh |
2980ea68 | 356 | %attr(0644,root,root) %{_mandir}/man1/ssh.1* |
ff2d7a98 | 357 | %attr(0644,root,root) %{_mandir}/man5/ssh_config.5* |
2980ea68 | 358 | %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ssh/ssh_config |
359 | %attr(-,root,root) %{_bindir}/slogin | |
360 | %attr(-,root,root) %{_mandir}/man1/slogin.1* | |
361 | %if ! %{rescue} | |
e54b3d7c | 362 | %attr(2755,root,nobody) %{_bindir}/ssh-agent |
3c0ef626 | 363 | %attr(0755,root,root) %{_bindir}/ssh-add |
364 | %attr(0755,root,root) %{_bindir}/ssh-keyscan | |
365 | %attr(0755,root,root) %{_bindir}/sftp | |
3c0ef626 | 366 | %attr(0644,root,root) %{_mandir}/man1/ssh-agent.1* |
367 | %attr(0644,root,root) %{_mandir}/man1/ssh-add.1* | |
368 | %attr(0644,root,root) %{_mandir}/man1/ssh-keyscan.1* | |
369 | %attr(0644,root,root) %{_mandir}/man1/sftp.1* | |
2980ea68 | 370 | %endif |
3c0ef626 | 371 | |
2980ea68 | 372 | %if ! %{rescue} |
3c0ef626 | 373 | %files server |
374 | %defattr(-,root,root) | |
2980ea68 | 375 | %dir %attr(0111,root,root) %{_var}/empty/sshd |
3c0ef626 | 376 | %attr(0755,root,root) %{_sbindir}/sshd |
377 | %attr(0755,root,root) %{_libexecdir}/openssh/sftp-server | |
378 | %attr(0644,root,root) %{_mandir}/man8/sshd.8* | |
ff2d7a98 | 379 | %attr(0644,root,root) %{_mandir}/man5/sshd_config.5* |
3c0ef626 | 380 | %attr(0644,root,root) %{_mandir}/man8/sftp-server.8* |
2980ea68 | 381 | %attr(0755,root,root) %dir %{_sysconfdir}/ssh |
382 | %attr(0600,root,root) %config(noreplace) %{_sysconfdir}/ssh/sshd_config | |
3c0ef626 | 383 | %attr(0600,root,root) %config(noreplace) /etc/pam.d/sshd |
384 | %attr(0755,root,root) %config /etc/rc.d/init.d/sshd | |
2980ea68 | 385 | %endif |
3c0ef626 | 386 | |
387 | %if ! %{no_x11_askpass} | |
388 | %files askpass | |
389 | %defattr(-,root,root) | |
390 | %doc x11-ssh-askpass-%{aversion}/README | |
391 | %doc x11-ssh-askpass-%{aversion}/ChangeLog | |
392 | %doc x11-ssh-askpass-%{aversion}/SshAskpass*.ad | |
393 | %attr(0755,root,root) %{_libexecdir}/openssh/ssh-askpass | |
394 | %attr(0755,root,root) %{_libexecdir}/openssh/x11-ssh-askpass | |
395 | %endif | |
396 | ||
397 | %if ! %{no_gnome_askpass} | |
398 | %files askpass-gnome | |
399 | %defattr(-,root,root) | |
2980ea68 | 400 | %attr(0755,root,root) %config %{_sysconfdir}/profile.d/gnome-ssh-askpass.* |
3c0ef626 | 401 | %attr(0755,root,root) %{_libexecdir}/openssh/gnome-ssh-askpass |
402 | %endif | |
403 | ||
404 | %changelog | |
70791e56 | 405 | * Mon Jun 2 2003 Damien Miller <djm@mindrot.org> |
416fd2a8 | 406 | - Remove noip6 option. This may be controlled at run-time in client config |
70791e56 | 407 | file using new AddressFamily directive |
408 | ||
409 | * Mon May 12 2003 Damien Miller <djm@mindrot.org> | |
410 | - Don't install profile.d scripts when not building with GNOME/GTK askpass | |
411 | (patch from bet@rahul.net) | |
412 | ||
e54b3d7c | 413 | * Wed Oct 01 2002 Damien Miller <djm@mindrot.org> |
414 | - Install ssh-agent setgid nobody to prevent ptrace() key theft attacks | |
415 | ||
416 | * Mon Sep 30 2002 Damien Miller <djm@mindrot.org> | |
417 | - Use contrib/ Makefile for building askpass programs | |
418 | ||
ff2d7a98 | 419 | * Fri Jun 21 2002 Damien Miller <djm@mindrot.org> |
420 | - Merge in spec changes from seba@iq.pl (Sebastian Pachuta) | |
421 | - Add new {ssh,sshd}_config.5 manpages | |
422 | - Add new ssh-keysign program and remove setuid from ssh client | |
423 | ||
2980ea68 | 424 | * Fri May 10 2002 Damien Miller <djm@mindrot.org> |
425 | - Merge in spec changes from RedHat, reorgansie a little | |
426 | - Add Privsep user, group and directory | |
427 | ||
428 | * Thu Mar 7 2002 Nalin Dahyabhai <nalin@redhat.com> 3.1p1-2 | |
429 | - bump and grind (through the build system) | |
430 | ||
431 | * Thu Mar 7 2002 Nalin Dahyabhai <nalin@redhat.com> 3.1p1-1 | |
432 | - require sharutils for building (mindrot #137) | |
433 | - require db1-devel only when building for 6.x (#55105), which probably won't | |
434 | work anyway (3.1 requires OpenSSL 0.9.6 to build), but what the heck | |
435 | - require pam-devel by file (not by package name) again | |
436 | - add Markus's patch to compile with OpenSSL 0.9.5a (from | |
437 | http://bugzilla.mindrot.org/show_bug.cgi?id=141) and apply it if we're | |
438 | building for 6.x | |
439 | ||
440 | * Thu Mar 7 2002 Nalin Dahyabhai <nalin@redhat.com> 3.1p1-0 | |
441 | - update to 3.1p1 | |
442 | ||
443 | * Tue Mar 5 2002 Nalin Dahyabhai <nalin@redhat.com> SNAP-20020305 | |
444 | - update to SNAP-20020305 | |
445 | - drop debug patch, fixed upstream | |
446 | ||
447 | * Wed Feb 20 2002 Nalin Dahyabhai <nalin@redhat.com> SNAP-20020220 | |
448 | - update to SNAP-20020220 for testing purposes (you've been warned, if there's | |
449 | anything to be warned about, gss patches won't apply, I don't mind) | |
450 | ||
451 | * Wed Feb 13 2002 Nalin Dahyabhai <nalin@redhat.com> 3.0.2p1-3 | |
452 | - add patches from Simon Wilkinson and Nicolas Williams for GSSAPI key | |
453 | exchange, authentication, and named key support | |
454 | ||
455 | * Wed Jan 23 2002 Nalin Dahyabhai <nalin@redhat.com> 3.0.2p1-2 | |
456 | - remove dependency on db1-devel, which has just been swallowed up whole | |
457 | by gnome-libs-devel | |
458 | ||
459 | * Sun Dec 29 2001 Nalin Dahyabhai <nalin@redhat.com> | |
460 | - adjust build dependencies so that build6x actually works right (fix | |
461 | from Hugo van der Kooij) | |
462 | ||
463 | * Tue Dec 4 2001 Nalin Dahyabhai <nalin@redhat.com> 3.0.2p1-1 | |
464 | - update to 3.0.2p1 | |
465 | ||
466 | * Fri Nov 16 2001 Nalin Dahyabhai <nalin@redhat.com> 3.0.1p1-1 | |
467 | - update to 3.0.1p1 | |
468 | ||
469 | * Tue Nov 13 2001 Nalin Dahyabhai <nalin@redhat.com> | |
470 | - update to current CVS (not for use in distribution) | |
471 | ||
472 | * Thu Nov 8 2001 Nalin Dahyabhai <nalin@redhat.com> 3.0p1-1 | |
473 | - merge some of Damien Miller <djm@mindrot.org> changes from the upstream | |
474 | 3.0p1 spec file and init script | |
475 | ||
476 | * Wed Nov 7 2001 Nalin Dahyabhai <nalin@redhat.com> | |
477 | - update to 3.0p1 | |
478 | - update to x11-ssh-askpass 1.2.4.1 | |
479 | - change build dependency on a file from pam-devel to the pam-devel package | |
480 | - replace primes with moduli | |
481 | ||
482 | * Thu Sep 27 2001 Nalin Dahyabhai <nalin@redhat.com> 2.9p2-9 | |
483 | - incorporate fix from Markus Friedl's advisory for IP-based authorization bugs | |
484 | ||
485 | * Thu Sep 13 2001 Bernhard Rosenkraenzer <bero@redhat.com> 2.9p2-8 | |
486 | - Merge changes to rescue build from current sysadmin survival cd | |
487 | ||
488 | * Thu Sep 6 2001 Nalin Dahyabhai <nalin@redhat.com> 2.9p2-7 | |
489 | - fix scp's server's reporting of file sizes, and build with the proper | |
490 | preprocessor define to get large-file capable open(), stat(), etc. | |
491 | (sftp has been doing this correctly all along) (#51827) | |
492 | - configure without --with-ipv4-default on RHL 7.x and newer (#45987,#52247) | |
493 | - pull cvs patch to fix support for /etc/nologin for non-PAM logins (#47298) | |
494 | - mark profile.d scriptlets as config files (#42337) | |
495 | - refer to Jason Stone's mail for zsh workaround for exit-hanging quasi-bug | |
496 | - change a couple of log() statements to debug() statements (#50751) | |
497 | - pull cvs patch to add -t flag to sshd (#28611) | |
498 | - clear fd_sets correctly (one bit per FD, not one byte per FD) (#43221) | |
499 | ||
500 | * Mon Aug 20 2001 Nalin Dahyabhai <nalin@redhat.com> 2.9p2-6 | |
501 | - add db1-devel as a BuildPrerequisite (noted by Hans Ecke) | |
502 | ||
503 | * Thu Aug 16 2001 Nalin Dahyabhai <nalin@redhat.com> | |
504 | - pull cvs patch to fix remote port forwarding with protocol 2 | |
505 | ||
506 | * Thu Aug 9 2001 Nalin Dahyabhai <nalin@redhat.com> | |
507 | - pull cvs patch to add session initialization to no-pty sessions | |
508 | - pull cvs patch to not cut off challengeresponse auth needlessly | |
509 | - refuse to do X11 forwarding if xauth isn't there, handy if you enable | |
510 | it by default on a system that doesn't have X installed (#49263) | |
511 | ||
512 | * Wed Aug 8 2001 Nalin Dahyabhai <nalin@redhat.com> | |
513 | - don't apply patches to code we don't intend to build (spotted by Matt Galgoci) | |
514 | ||
515 | * Mon Aug 6 2001 Nalin Dahyabhai <nalin@redhat.com> | |
516 | - pass OPTIONS correctly to initlog (#50151) | |
517 | ||
518 | * Wed Jul 25 2001 Nalin Dahyabhai <nalin@redhat.com> | |
519 | - switch to x11-ssh-askpass 1.2.2 | |
520 | ||
521 | * Wed Jul 11 2001 Nalin Dahyabhai <nalin@redhat.com> | |
522 | - rebuild in new environment | |
523 | ||
524 | * Mon Jun 25 2001 Nalin Dahyabhai <nalin@redhat.com> | |
525 | - disable the gssapi patch | |
526 | ||
527 | * Mon Jun 18 2001 Nalin Dahyabhai <nalin@redhat.com> | |
528 | - update to 2.9p2 | |
529 | - refresh to a new version of the gssapi patch | |
530 | ||
531 | * Thu Jun 7 2001 Nalin Dahyabhai <nalin@redhat.com> | |
532 | - change Copyright: BSD to License: BSD | |
533 | - add Markus Friedl's unverified patch for the cookie file deletion problem | |
534 | so that we can verify it | |
535 | - drop patch to check if xauth is present (was folded into cookie patch) | |
536 | - don't apply gssapi patches for the errata candidate | |
537 | - clear supplemental groups list at startup | |
538 | ||
539 | * Fri May 25 2001 Nalin Dahyabhai <nalin@redhat.com> | |
540 | - fix an error parsing the new default sshd_config | |
541 | - add a fix from Markus Friedl (via openssh-unix-dev) for ssh-keygen not | |
542 | dealing with comments right | |
543 | ||
544 | * Thu May 24 2001 Nalin Dahyabhai <nalin@redhat.com> | |
545 | - add in Simon Wilkinson's GSSAPI patch to give it some testing in-house, | |
546 | to be removed before the next beta cycle because it's a big departure | |
547 | from the upstream version | |
548 | ||
549 | * Thu May 3 2001 Nalin Dahyabhai <nalin@redhat.com> | |
550 | - finish marking strings in the init script for translation | |
551 | - modify init script to source /etc/sysconfig/sshd and pass $OPTIONS to sshd | |
552 | at startup (change merged from openssh.com init script, originally by | |
553 | Pekka Savola) | |
554 | - refuse to do X11 forwarding if xauth isn't there, handy if you enable | |
555 | it by default on a system that doesn't have X installed | |
556 | ||
557 | * Wed May 2 2001 Nalin Dahyabhai <nalin@redhat.com> | |
558 | - update to 2.9 | |
559 | - drop various patches that came from or went upstream or to or from CVS | |
560 | ||
561 | * Wed Apr 18 2001 Nalin Dahyabhai <nalin@redhat.com> | |
562 | - only require initscripts 5.00 on 6.2 (reported by Peter Bieringer) | |
563 | ||
564 | * Sun Apr 8 2001 Preston Brown <pbrown@redhat.com> | |
565 | - remove explicit openssl requirement, fixes builddistro issue | |
416fd2a8 | 566 | - make initscript stop() function wait until sshd really dead to avoid |
2980ea68 | 567 | races in condrestart |
568 | ||
569 | * Mon Apr 2 2001 Nalin Dahyabhai <nalin@redhat.com> | |
570 | - mention that challengereponse supports PAM, so disabling password doesn't | |
571 | limit users to pubkey and rsa auth (#34378) | |
572 | - bypass the daemon() function in the init script and call initlog directly, | |
573 | because daemon() won't start a daemon it detects is already running (like | |
574 | open connections) | |
575 | - require the version of openssl we had when we were built | |
576 | ||
577 | * Fri Mar 23 2001 Nalin Dahyabhai <nalin@redhat.com> | |
578 | - make do_pam_setcred() smart enough to know when to establish creds and | |
579 | when to reinitialize them | |
580 | - add in a couple of other fixes from Damien for inclusion in the errata | |
581 | ||
582 | * Thu Mar 22 2001 Nalin Dahyabhai <nalin@redhat.com> | |
583 | - update to 2.5.2p2 | |
584 | - call setcred() again after initgroups, because the "creds" could actually | |
585 | be group memberships | |
586 | ||
587 | * Tue Mar 20 2001 Nalin Dahyabhai <nalin@redhat.com> | |
588 | - update to 2.5.2p1 (includes endianness fixes in the rijndael implementation) | |
589 | - don't enable challenge-response by default until we find a way to not | |
590 | have too many userauth requests (we may make up to six pubkey and up to | |
591 | three password attempts as it is) | |
592 | - remove build dependency on rsh to match openssh.com's packages more closely | |
593 | ||
594 | * Sat Mar 3 2001 Nalin Dahyabhai <nalin@redhat.com> | |
595 | - remove dependency on openssl -- would need to be too precise | |
596 | ||
597 | * Fri Mar 2 2001 Nalin Dahyabhai <nalin@redhat.com> | |
598 | - rebuild in new environment | |
599 | ||
600 | * Mon Feb 26 2001 Nalin Dahyabhai <nalin@redhat.com> | |
601 | - Revert the patch to move pam_open_session. | |
602 | - Init script and spec file changes from Pekka Savola. (#28750) | |
603 | - Patch sftp to recognize '-o protocol' arguments. (#29540) | |
604 | ||
605 | * Thu Feb 22 2001 Nalin Dahyabhai <nalin@redhat.com> | |
606 | - Chuck the closing patch. | |
607 | - Add a trigger to add host keys for protocol 2 to the config file, now that | |
608 | configuration file syntax requires us to specify it with HostKey if we | |
609 | specify any other HostKey values, which we do. | |
610 | ||
611 | * Tue Feb 20 2001 Nalin Dahyabhai <nalin@redhat.com> | |
612 | - Redo patch to move pam_open_session after the server setuid()s to the user. | |
613 | - Rework the nopam patch to use be picked up by autoconf. | |
614 | ||
615 | * Mon Feb 19 2001 Nalin Dahyabhai <nalin@redhat.com> | |
616 | - Update for 2.5.1p1. | |
617 | - Add init script mods from Pekka Savola. | |
618 | - Tweak the init script to match the CVS contrib script more closely. | |
619 | - Redo patch to ssh-add to try to adding both identity and id_dsa to also try | |
620 | adding id_rsa. | |
621 | ||
622 | * Fri Feb 16 2001 Nalin Dahyabhai <nalin@redhat.com> | |
623 | - Update for 2.5.0p1. | |
624 | - Use $RPM_OPT_FLAGS instead of -O when building gnome-ssh-askpass | |
625 | - Resync with parts of Damien Miller's openssh.spec from CVS, including | |
626 | update of x11 askpass to 1.2.0. | |
627 | - Only require openssl (don't prereq) because we generate keys in the init | |
628 | script now. | |
629 | ||
630 | * Tue Feb 13 2001 Nalin Dahyabhai <nalin@redhat.com> | |
631 | - Don't open a PAM session until we've forked and become the user (#25690). | |
632 | - Apply Andrew Bartlett's patch for letting pam_authenticate() know which | |
633 | host the user is attempting a login from. | |
634 | - Resync with parts of Damien Miller's openssh.spec from CVS. | |
635 | - Don't expose KbdInt responses in debug messages (from CVS). | |
636 | - Detect and handle errors in rsa_{public,private}_decrypt (from CVS). | |
637 | ||
638 | * Wed Feb 7 2001 Trond Eivind Glomsrxd <teg@redhat.com> | |
639 | - i18n-tweak to initscript. | |
640 | ||
641 | * Tue Jan 23 2001 Nalin Dahyabhai <nalin@redhat.com> | |
642 | - More gettextizing. | |
643 | - Close all files after going into daemon mode (needs more testing). | |
644 | - Extract patch from CVS to handle auth banners (in the client). | |
645 | - Extract patch from CVS to handle compat weirdness. | |
646 | ||
647 | * Fri Jan 19 2001 Nalin Dahyabhai <nalin@redhat.com> | |
648 | - Finish with the gettextizing. | |
649 | ||
650 | * Thu Jan 18 2001 Nalin Dahyabhai <nalin@redhat.com> | |
651 | - Fix a bug in auth2-pam.c (#23877) | |
652 | - Gettextize the init script. | |
653 | ||
654 | * Wed Dec 20 2000 Nalin Dahyabhai <nalin@redhat.com> | |
655 | - Incorporate a switch for using PAM configs for 6.x, just in case. | |
656 | ||
657 | * Tue Dec 5 2000 Nalin Dahyabhai <nalin@redhat.com> | |
658 | - Incorporate Bero's changes for a build specifically for rescue CDs. | |
659 | ||
660 | * Wed Nov 29 2000 Nalin Dahyabhai <nalin@redhat.com> | |
661 | - Don't treat pam_setcred() failure as fatal unless pam_authenticate() has | |
662 | succeeded, to allow public-key authentication after a failure with "none" | |
663 | authentication. (#21268) | |
664 | ||
665 | * Tue Nov 28 2000 Nalin Dahyabhai <nalin@redhat.com> | |
666 | - Update to x11-askpass 1.1.1. (#21301) | |
667 | - Don't second-guess fixpaths, which causes paths to get fixed twice. (#21290) | |
668 | ||
669 | * Mon Nov 27 2000 Nalin Dahyabhai <nalin@redhat.com> | |
670 | - Merge multiple PAM text messages into subsequent prompts when possible when | |
671 | doing keyboard-interactive authentication. | |
672 | ||
673 | * Sun Nov 26 2000 Nalin Dahyabhai <nalin@redhat.com> | |
674 | - Disable the built-in MD5 password support. We're using PAM. | |
675 | - Take a crack at doing keyboard-interactive authentication with PAM, and | |
676 | enable use of it in the default client configuration so that the client | |
677 | will try it when the server disallows password authentication. | |
678 | - Build with debugging flags. Build root policies strip all binaries anyway. | |
679 | ||
680 | * Tue Nov 21 2000 Nalin Dahyabhai <nalin@redhat.com> | |
681 | - Use DESTDIR instead of %%makeinstall. | |
682 | - Remove /usr/X11R6/bin from the path-fixing patch. | |
683 | ||
684 | * Mon Nov 20 2000 Nalin Dahyabhai <nalin@redhat.com> | |
685 | - Add the primes file from the latest snapshot to the main package (#20884). | |
686 | - Add the dev package to the prereq list (#19984). | |
687 | - Remove the default path and mimic login's behavior in the server itself. | |
688 | ||
689 | * Fri Nov 17 2000 Nalin Dahyabhai <nalin@redhat.com> | |
690 | - Resync with conditional options in Damien Miller's .spec file for an errata. | |
691 | - Change libexecdir from %%{_libexecdir}/ssh to %%{_libexecdir}/openssh. | |
692 | ||
693 | * Tue Nov 7 2000 Nalin Dahyabhai <nalin@redhat.com> | |
694 | - Update to OpenSSH 2.3.0p1. | |
695 | - Update to x11-askpass 1.1.0. | |
696 | - Enable keyboard-interactive authentication. | |
697 | ||
698 | * Mon Oct 30 2000 Nalin Dahyabhai <nalin@redhat.com> | |
699 | - Update to ssh-askpass-x11 1.0.3. | |
700 | - Change authentication related messages to be private (#19966). | |
701 | ||
702 | * Tue Oct 10 2000 Nalin Dahyabhai <nalin@redhat.com> | |
703 | - Patch ssh-keygen to be able to list signatures for DSA public key files | |
704 | it generates. | |
705 | ||
706 | * Thu Oct 5 2000 Nalin Dahyabhai <nalin@redhat.com> | |
707 | - Add BuildPreReq on /usr/include/security/pam_appl.h to be sure we always | |
708 | build PAM authentication in. | |
709 | - Try setting SSH_ASKPASS if gnome-ssh-askpass is installed. | |
710 | - Clean out no-longer-used patches. | |
711 | - Patch ssh-add to try to add both identity and id_dsa, and to error only | |
712 | when neither exists. | |
713 | ||
714 | * Mon Oct 2 2000 Nalin Dahyabhai <nalin@redhat.com> | |
715 | - Update x11-askpass to 1.0.2. (#17835) | |
716 | - Add BuildPreReqs for /bin/login and /usr/bin/rsh so that configure will | |
717 | always find them in the right place. (#17909) | |
718 | - Set the default path to be the same as the one supplied by /bin/login, but | |
719 | add /usr/X11R6/bin. (#17909) | |
720 | - Try to handle obsoletion of ssh-server more cleanly. Package names | |
721 | are different, but init script name isn't. (#17865) | |
722 | ||
723 | * Wed Sep 6 2000 Nalin Dahyabhai <nalin@redhat.com> | |
724 | - Update to 2.2.0p1. (#17835) | |
725 | - Tweak the init script to allow proper restarting. (#18023) | |
726 | ||
727 | * Wed Aug 23 2000 Nalin Dahyabhai <nalin@redhat.com> | |
728 | - Update to 20000823 snapshot. | |
729 | - Change subpackage requirements from %%{version} to %%{version}-%%{release} | |
730 | - Back out the pipe patch. | |
731 | ||
732 | * Mon Jul 17 2000 Nalin Dahyabhai <nalin@redhat.com> | |
733 | - Update to 2.1.1p4, which includes fixes for config file parsing problems. | |
734 | - Move the init script back. | |
735 | - Add Damien's quick fix for wackiness. | |
736 | ||
737 | * Wed Jul 12 2000 Nalin Dahyabhai <nalin@redhat.com> | |
738 | - Update to 2.1.1p3, which includes fixes for X11 forwarding and strtok(). | |
739 | ||
740 | * Thu Jul 6 2000 Nalin Dahyabhai <nalin@redhat.com> | |
741 | - Move condrestart to server postun. | |
742 | - Move key generation to init script. | |
743 | - Actually use the right patch for moving the key generation to the init script. | |
744 | - Clean up the init script a bit. | |
745 | ||
746 | * Wed Jul 5 2000 Nalin Dahyabhai <nalin@redhat.com> | |
747 | - Fix X11 forwarding, from mail post by Chan Shih-Ping Richard. | |
748 | ||
749 | * Sun Jul 2 2000 Nalin Dahyabhai <nalin@redhat.com> | |
750 | - Update to 2.1.1p2. | |
751 | - Use of strtok() considered harmful. | |
752 | ||
753 | * Sat Jul 1 2000 Nalin Dahyabhai <nalin@redhat.com> | |
754 | - Get the build root out of the man pages. | |
755 | ||
756 | * Thu Jun 29 2000 Nalin Dahyabhai <nalin@redhat.com> | |
757 | - Add and use condrestart support in the init script. | |
758 | - Add newer initscripts as a prereq. | |
759 | ||
760 | * Tue Jun 27 2000 Nalin Dahyabhai <nalin@redhat.com> | |
761 | - Build in new environment (release 2) | |
762 | - Move -clients subpackage to Applications/Internet group | |
763 | ||
764 | * Fri Jun 9 2000 Nalin Dahyabhai <nalin@redhat.com> | |
765 | - Update to 2.2.1p1 | |
766 | ||
767 | * Sat Jun 3 2000 Nalin Dahyabhai <nalin@redhat.com> | |
768 | - Patch to build with neither RSA nor RSAref. | |
769 | - Miscellaneous FHS-compliance tweaks. | |
770 | - Fix for possibly-compressed man pages. | |
771 | ||
3c0ef626 | 772 | * Wed Mar 15 2000 Damien Miller <djm@ibs.com.au> |
773 | - Updated for new location | |
774 | - Updated for new gnome-ssh-askpass build | |
2980ea68 | 775 | |
3c0ef626 | 776 | * Sun Dec 26 1999 Damien Miller <djm@mindrot.org> |
777 | - Added Jim Knoble's <jmknoble@pobox.com> askpass | |
2980ea68 | 778 | |
3c0ef626 | 779 | * Mon Nov 15 1999 Damien Miller <djm@mindrot.org> |
780 | - Split subpackages further based on patch from jim knoble <jmknoble@pobox.com> | |
2980ea68 | 781 | |
3c0ef626 | 782 | * Sat Nov 13 1999 Damien Miller <djm@mindrot.org> |
783 | - Added 'Obsoletes' directives | |
2980ea68 | 784 | |
3c0ef626 | 785 | * Tue Nov 09 1999 Damien Miller <djm@ibs.com.au> |
786 | - Use make install | |
787 | - Subpackages | |
2980ea68 | 788 | |
3c0ef626 | 789 | * Mon Nov 08 1999 Damien Miller <djm@ibs.com.au> |
790 | - Added links for slogin | |
791 | - Fixed perms on manpages | |
2980ea68 | 792 | |
3c0ef626 | 793 | * Sat Oct 30 1999 Damien Miller <djm@ibs.com.au> |
794 | - Renamed init script | |
2980ea68 | 795 | |
3c0ef626 | 796 | * Fri Oct 29 1999 Damien Miller <djm@ibs.com.au> |
797 | - Back to old binary names | |
2980ea68 | 798 | |
3c0ef626 | 799 | * Thu Oct 28 1999 Damien Miller <djm@ibs.com.au> |
800 | - Use autoconf | |
801 | - New binary names | |
2980ea68 | 802 | |
3c0ef626 | 803 | * Wed Oct 27 1999 Damien Miller <djm@ibs.com.au> |
804 | - Initial RPMification, based on Jan "Yenya" Kasprzak's <kas@fi.muni.cz> spec. |