]>
Commit | Line | Data |
---|---|---|
0855868a | 1 | %define ver 3.5p1 |
3ef3d901 | 2 | %define rel 1 |
3 | ||
4 | # OpenSSH privilege separation requires a user & group ID | |
5 | %define sshd_uid 74 | |
6 | %define sshd_gid 74 | |
bc7ea646 | 7 | |
8 | # Version of ssh-askpass | |
e3d5570b | 9 | %define aversion 1.2.4.1 |
bc7ea646 | 10 | |
1e970014 | 11 | # Do we want to disable building of x11-askpass? (1=yes 0=no) |
12 | %define no_x11_askpass 0 | |
13 | ||
14 | # Do we want to disable building of gnome-askpass? (1=yes 0=no) | |
15 | %define no_gnome_askpass 0 | |
16 | ||
94dd09e3 | 17 | # Do we want to link against a static libcrypto? (1=yes 0=no) |
18 | %define static_libcrypto 0 | |
19 | ||
69c94072 | 20 | # Do we want smartcard support (1=yes 0=no) |
21 | %define scard 0 | |
22 | ||
3c1dff28 | 23 | # Use GTK2 instead of GNOME in gnome-ssh-askpass |
24 | %define gtk2 0 | |
25 | ||
3ef3d901 | 26 | # Is this build for RHL 6.x? |
27 | %define build6x 0 | |
894a4851 | 28 | |
b013a983 | 29 | # Disable IPv6 (avoids DNS hangs on some glibc versions) |
30 | %define noip6 0 | |
31 | ||
9f182968 | 32 | # Do we want kerberos5 support (1=yes 0=no) |
33 | %define kerberos5 1 | |
34 | ||
894a4851 | 35 | # Reserve options to override askpass settings with: |
36 | # rpm -ba|--rebuild --define 'skip_xxx 1' | |
37 | %{?skip_x11_askpass:%define no_x11_askpass 1} | |
38 | %{?skip_gnome_askpass:%define no_gnome_askpass 1} | |
39 | ||
3ef3d901 | 40 | # Is this a build for RHL 6.x or earlier? |
41 | %{?build_6x:%define build6x 1} | |
42 | ||
43 | # If this is RHL 6.x, the default configuration has sysconfdir in /usr/etc. | |
44 | %if %{build6x} | |
45 | %define _sysconfdir /etc | |
46 | %define noip6 1 | |
47 | %endif | |
894a4851 | 48 | |
94dd09e3 | 49 | # Options for static OpenSSL link: |
50 | # rpm -ba|--rebuild --define "static_openssl 1" | |
51 | %{?static_openssl:%define static_libcrypto 1} | |
52 | ||
69c94072 | 53 | # Options for Smartcard support: (needs libsectok and openssl-engine) |
54 | # rpm -ba|--rebuild --define "smartcard 1" | |
55 | %{?smartcard:%define scard 1} | |
56 | ||
b013a983 | 57 | # Option to disable ipv6 |
58 | # rpm -ba|--rebuild --define "noipv6 1" | |
59 | %{?noipv6:%define noip6 1} | |
60 | ||
3ef3d901 | 61 | # Is this a build for the rescue CD (without PAM, with MD5)? (1=yes 0=no) |
62 | %define rescue 0 | |
63 | %{?build_rescue:%define rescue 1} | |
cb291102 | 64 | |
34b4d38c | 65 | # Turn off some stuff for resuce builds |
66 | %if %{rescue} | |
67 | %define kerberos5 0 | |
68 | %endif | |
69 | ||
3ef3d901 | 70 | Summary: The OpenSSH implementation of SSH protocol versions 1 and 2. |
8efc0c15 | 71 | Name: openssh |
3ef3d901 | 72 | Version: %{ver} |
73 | %if %{rescue} | |
74 | Release: %{rel}rescue | |
75 | %else | |
76 | Release: %{rel} | |
77 | %endif | |
23c098ba | 78 | URL: http://www.openssh.com/portable.html |
3ef3d901 | 79 | Source0: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz |
23c098ba | 80 | Source1: http://www.pobox.com/~jmknoble/software/x11-ssh-askpass/x11-ssh-askpass-%{aversion}.tar.gz |
23c098ba | 81 | License: BSD |
8efc0c15 | 82 | Group: Applications/Internet |
8fd97cc4 | 83 | BuildRoot: %{_tmppath}/%{name}-%{version}-buildroot |
e9c75a39 | 84 | Obsoletes: ssh |
3ef3d901 | 85 | %if %{build6x} |
86 | PreReq: initscripts >= 5.00 | |
87 | %else | |
88 | PreReq: initscripts >= 5.20 | |
89 | %endif | |
90 | BuildPreReq: perl, openssl-devel, sharutils, tcp_wrappers | |
91 | BuildPreReq: /bin/login | |
e18b7d35 | 92 | %if ! %{build6x} |
3ef3d901 | 93 | BuildPreReq: glibc-devel, pam |
94 | %else | |
95 | BuildPreReq: db1-devel, /usr/include/security/pam_appl.h | |
96 | %endif | |
23c098ba | 97 | %if ! %{no_x11_askpass} |
98 | BuildPreReq: XFree86-devel | |
99 | %endif | |
71d43804 | 100 | %if ! %{no_gnome_askpass} |
cf6713a2 | 101 | BuildPreReq: pkgconfig |
1e970014 | 102 | %endif |
9c696d0d | 103 | %if %{kerberos5} |
104 | BuildPreReq: krb5-devel | |
105 | BuildPreReq: krb5-libs | |
106 | %endif | |
8c119fd0 | 107 | |
108 | %package clients | |
23c098ba | 109 | Summary: OpenSSH clients. |
aa0289fe | 110 | Requires: openssh = %{version}-%{release} |
71d43804 | 111 | Group: Applications/Internet |
e9c75a39 | 112 | Obsoletes: ssh-clients |
8efc0c15 | 113 | |
d397b172 | 114 | %package server |
23c098ba | 115 | Summary: The OpenSSH server daemon. |
d397b172 | 116 | Group: System Environment/Daemons |
e9c75a39 | 117 | Obsoletes: ssh-server |
aa0289fe | 118 | PreReq: openssh = %{version}-%{release}, chkconfig >= 0.9 |
3ef3d901 | 119 | %if ! %{build6x} |
8fd97cc4 | 120 | Requires: /etc/pam.d/system-auth |
121 | %endif | |
d397b172 | 122 | |
123 | %package askpass | |
23c098ba | 124 | Summary: A passphrase dialog for OpenSSH and X. |
bc7ea646 | 125 | Group: Applications/Internet |
aa0289fe | 126 | Requires: openssh = %{version}-%{release} |
bc7ea646 | 127 | Obsoletes: ssh-extras |
bc7ea646 | 128 | |
bc7ea646 | 129 | %package askpass-gnome |
23c098ba | 130 | Summary: A passphrase dialog for OpenSSH, X, and GNOME. |
d397b172 | 131 | Group: Applications/Internet |
aa0289fe | 132 | Requires: openssh = %{version}-%{release} |
8c119fd0 | 133 | Obsoletes: ssh-extras |
d397b172 | 134 | |
8efc0c15 | 135 | %description |
3ef3d901 | 136 | SSH (Secure SHell) is a program for logging into and executing |
137 | commands on a remote machine. SSH is intended to replace rlogin and | |
138 | rsh, and to provide secure encrypted communications between two | |
139 | untrusted hosts over an insecure network. X11 connections and | |
140 | arbitrary TCP/IP ports can also be forwarded over the secure channel. | |
141 | ||
142 | OpenSSH is OpenBSD's version of the last free version of SSH, bringing | |
143 | it up to date in terms of security and features, as well as removing | |
144 | all patented algorithms to separate libraries. | |
8efc0c15 | 145 | |
8c119fd0 | 146 | This package includes the core files necessary for both the OpenSSH |
23c098ba | 147 | client and server. To make this package useful, you should also |
8c119fd0 | 148 | install openssh-clients, openssh-server, or both. |
149 | ||
150 | %description clients | |
3ef3d901 | 151 | OpenSSH is a free version of SSH (Secure SHell), a program for logging |
152 | into and executing commands on a remote machine. This package includes | |
153 | the clients necessary to make encrypted connections to SSH servers. | |
154 | You'll also need to install the openssh package on OpenSSH clients. | |
d397b172 | 155 | |
156 | %description server | |
3ef3d901 | 157 | OpenSSH is a free version of SSH (Secure SHell), a program for logging |
158 | into and executing commands on a remote machine. This package contains | |
159 | the secure shell daemon (sshd). The sshd daemon allows SSH clients to | |
160 | securely connect to your SSH server. You also need to have the openssh | |
161 | package installed. | |
d397b172 | 162 | |
bc7ea646 | 163 | %description askpass |
3ef3d901 | 164 | OpenSSH is a free version of SSH (Secure SHell), a program for logging |
165 | into and executing commands on a remote machine. This package contains | |
166 | an X11 passphrase dialog for OpenSSH. | |
bc7ea646 | 167 | |
8a4958eb | 168 | %description askpass-gnome |
3ef3d901 | 169 | OpenSSH is a free version of SSH (Secure SHell), a program for logging |
170 | into and executing commands on a remote machine. This package contains | |
171 | an X11 passphrase dialog for OpenSSH and the GNOME GUI desktop | |
172 | environment. | |
d397b172 | 173 | |
8efc0c15 | 174 | %prep |
175 | ||
73bd30fe | 176 | %if ! %{no_x11_askpass} |
feab8600 | 177 | %setup -q -a 1 |
73bd30fe | 178 | %else |
179 | %setup -q | |
180 | %endif | |
8efc0c15 | 181 | |
182 | %build | |
3ef3d901 | 183 | %if %{rescue} |
184 | CFLAGS="$RPM_OPT_FLAGS -Os"; export CFLAGS | |
b013a983 | 185 | %endif |
186 | ||
aa0289fe | 187 | %configure \ |
3ef3d901 | 188 | --sysconfdir=%{_sysconfdir}/ssh \ |
aa0289fe | 189 | --libexecdir=%{_libexecdir}/openssh \ |
4b255446 | 190 | --datadir=%{_datadir}/openssh \ |
aa0289fe | 191 | --with-tcp-wrappers \ |
3ef3d901 | 192 | --with-rsh=%{_bindir}/rsh \ |
80e92e5d | 193 | --with-default-path=/usr/local/bin:/bin:/usr/bin \ |
194 | --with-superuser-path=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin \ | |
7295c001 | 195 | --with-privsep-path=%{_var}/empty/sshd \ |
3ef3d901 | 196 | %if %{scard} |
197 | --with-smartcard \ | |
198 | %endif | |
199 | %if %{noip6} | |
200 | --with-ipv4-default \ | |
201 | %endif | |
202 | %if %{rescue} | |
9f182968 | 203 | --without-pam --with-md5-passwords \ |
3ef3d901 | 204 | %else |
9f182968 | 205 | --with-pam \ |
3ef3d901 | 206 | %endif |
9f182968 | 207 | %if %{kerberos5} |
208 | --with-kerberos5=/usr/kerberos \ | |
65017cbd | 209 | %endif |
bc7ea646 | 210 | |
80e92e5d | 211 | |
94dd09e3 | 212 | %if %{static_libcrypto} |
3ef3d901 | 213 | perl -pi -e "s|-lcrypto|%{_libdir}/libcrypto.a|g" Makefile |
94dd09e3 | 214 | %endif |
215 | ||
bc7ea646 | 216 | make |
8efc0c15 | 217 | |
1e970014 | 218 | %if ! %{no_x11_askpass} |
aa0289fe | 219 | pushd x11-ssh-askpass-%{aversion} |
3ef3d901 | 220 | %configure --libexecdir=%{_libexecdir}/openssh |
d31a32a4 | 221 | xmkmf -a |
df16c1f2 | 222 | make |
aa0289fe | 223 | popd |
1e970014 | 224 | %endif |
df16c1f2 | 225 | |
3c1dff28 | 226 | # Define a variable to toggle gnome1/gtk2 building. This is necessary |
227 | # because RPM doesn't handle nested %if statements. | |
228 | %if %{gtk2} | |
229 | gtk2=yes | |
230 | %else | |
231 | gtk2=no | |
232 | %endif | |
233 | ||
234 | %if ! %{no_gnome_askpass} | |
235 | pushd contrib | |
236 | if [ $gtk2 = yes ] ; then | |
cf6713a2 | 237 | make gnome-ssh-askpass2 |
238 | mv gnome-ssh-askpass2 gnome-ssh-askpass | |
3c1dff28 | 239 | else |
cf6713a2 | 240 | make gnome-ssh-askpass1 |
241 | mv gnome-ssh-askpass1 gnome-ssh-askpass | |
3c1dff28 | 242 | fi |
243 | popd | |
244 | %endif | |
245 | ||
8efc0c15 | 246 | %install |
247 | rm -rf $RPM_BUILD_ROOT | |
3ef3d901 | 248 | mkdir -p -m755 $RPM_BUILD_ROOT%{_sysconfdir}/ssh |
249 | mkdir -p -m755 $RPM_BUILD_ROOT%{_libexecdir}/openssh | |
80e92e5d | 250 | mkdir -p -m755 $RPM_BUILD_ROOT%{_var}/empty/sshd |
aa0289fe | 251 | |
3ef3d901 | 252 | make install DESTDIR=$RPM_BUILD_ROOT |
8efc0c15 | 253 | |
22574738 | 254 | install -d $RPM_BUILD_ROOT/etc/pam.d/ |
255 | install -d $RPM_BUILD_ROOT/etc/rc.d/init.d | |
aa0289fe | 256 | install -d $RPM_BUILD_ROOT%{_libexecdir}/openssh |
3ef3d901 | 257 | %if %{build6x} |
258 | install -m644 contrib/redhat/sshd.pam.old $RPM_BUILD_ROOT/etc/pam.d/sshd | |
14a49e44 | 259 | %else |
3ef3d901 | 260 | install -m644 contrib/redhat/sshd.pam $RPM_BUILD_ROOT/etc/pam.d/sshd |
894a4851 | 261 | %endif |
5cc53885 | 262 | install -m755 contrib/redhat/sshd.init $RPM_BUILD_ROOT/etc/rc.d/init.d/sshd |
f1bcacf9 | 263 | |
1e970014 | 264 | %if ! %{no_x11_askpass} |
1eb4ec64 | 265 | install -s x11-ssh-askpass-%{aversion}/x11-ssh-askpass $RPM_BUILD_ROOT%{_libexecdir}/openssh/x11-ssh-askpass |
3ef3d901 | 266 | ln -s x11-ssh-askpass $RPM_BUILD_ROOT%{_libexecdir}/openssh/ssh-askpass |
1e970014 | 267 | %endif |
bc7ea646 | 268 | |
1e970014 | 269 | %if ! %{no_gnome_askpass} |
1eb4ec64 | 270 | install -s contrib/gnome-ssh-askpass $RPM_BUILD_ROOT%{_libexecdir}/openssh/gnome-ssh-askpass |
1e970014 | 271 | %endif |
5cc53885 | 272 | |
4d43d1ca | 273 | %if ! %{scard} |
274 | rm -f $RPM_BUILD_ROOT/usr/share/openssh/Ssh.bin | |
275 | %endif | |
276 | ||
3ef3d901 | 277 | install -m 755 -d $RPM_BUILD_ROOT%{_sysconfdir}/profile.d/ |
278 | install -m 755 contrib/redhat/gnome-ssh-askpass.csh $RPM_BUILD_ROOT%{_sysconfdir}/profile.d/ | |
279 | install -m 755 contrib/redhat/gnome-ssh-askpass.sh $RPM_BUILD_ROOT%{_sysconfdir}/profile.d/ | |
280 | ||
aa0289fe | 281 | perl -pi -e "s|$RPM_BUILD_ROOT||g" $RPM_BUILD_ROOT%{_mandir}/man*/* |
282 | ||
8efc0c15 | 283 | %clean |
284 | rm -rf $RPM_BUILD_ROOT | |
285 | ||
3ef3d901 | 286 | %triggerun server -- ssh-server |
287 | if [ "$1" != 0 -a -r /var/run/sshd.pid ] ; then | |
288 | touch /var/run/sshd.restart | |
289 | fi | |
290 | ||
291 | %triggerun server -- openssh-server < 2.5.0p1 | |
292 | # Count the number of HostKey and HostDsaKey statements we have. | |
293 | gawk 'BEGIN {IGNORECASE=1} | |
294 | /^hostkey/ || /^hostdsakey/ {sawhostkey = sawhostkey + 1} | |
295 | END {exit sawhostkey}' /etc/ssh/sshd_config | |
296 | # And if we only found one, we know the client was relying on the old default | |
297 | # behavior, which loaded the the SSH2 DSA host key when HostDsaKey wasn't | |
298 | # specified. Now that HostKey is used for both SSH1 and SSH2 keys, specifying | |
299 | # one nullifies the default, which would have loaded both. | |
300 | if [ $? -eq 1 ] ; then | |
301 | echo HostKey /etc/ssh/ssh_host_rsa_key >> /etc/ssh/sshd_config | |
302 | echo HostKey /etc/ssh/ssh_host_dsa_key >> /etc/ssh/sshd_config | |
303 | fi | |
304 | ||
305 | %triggerpostun server -- ssh-server | |
306 | if [ "$1" != 0 ] ; then | |
307 | /sbin/chkconfig --add sshd | |
308 | if test -f /var/run/sshd.restart ; then | |
309 | rm -f /var/run/sshd.restart | |
310 | /sbin/service sshd start > /dev/null 2>&1 || : | |
311 | fi | |
312 | fi | |
313 | ||
314 | %pre server | |
315 | %{_sbindir}/groupadd -r -g %{sshd_gid} sshd 2>/dev/null || : | |
80e92e5d | 316 | %{_sbindir}/useradd -d /var/empty/sshd -s /bin/false -u %{sshd_uid} \ |
3ef3d901 | 317 | -g sshd -M -r sshd 2>/dev/null || : |
318 | ||
d397b172 | 319 | %post server |
f1bcacf9 | 320 | /sbin/chkconfig --add sshd |
3ef3d901 | 321 | |
322 | %postun server | |
323 | /sbin/service sshd condrestart > /dev/null 2>&1 || : | |
8efc0c15 | 324 | |
d397b172 | 325 | %preun server |
3ef3d901 | 326 | if [ "$1" = 0 ] |
327 | then | |
328 | /sbin/service sshd stop > /dev/null 2>&1 || : | |
f1bcacf9 | 329 | /sbin/chkconfig --del sshd |
8efc0c15 | 330 | fi |
331 | ||
332 | %files | |
333 | %defattr(-,root,root) | |
23c098ba | 334 | %doc CREDITS ChangeLog INSTALL LICENCE OVERVIEW README* RFC* TODO WARNING* |
aa0289fe | 335 | %attr(0755,root,root) %{_bindir}/scp |
777319db | 336 | %attr(0644,root,root) %{_mandir}/man1/scp.1* |
3ef3d901 | 337 | %attr(0755,root,root) %dir %{_sysconfdir}/ssh |
338 | %attr(0600,root,root) %config(noreplace) %{_sysconfdir}/ssh/moduli | |
339 | %if ! %{rescue} | |
340 | %attr(0755,root,root) %{_bindir}/ssh-keygen | |
341 | %attr(0644,root,root) %{_mandir}/man1/ssh-keygen.1* | |
aa0289fe | 342 | %attr(0755,root,root) %dir %{_libexecdir}/openssh |
9f182968 | 343 | %attr(4711,root,root) %{_libexecdir}/openssh/ssh-keysign |
344 | %attr(0644,root,root) %{_mandir}/man8/ssh-keysign.8* | |
3ef3d901 | 345 | %endif |
6fc63fcb | 346 | %if %{scard} |
4b255446 | 347 | %attr(0755,root,root) %dir %{_datadir}/openssh |
348 | %attr(0644,root,root) %{_datadir}/openssh/Ssh.bin | |
69c94072 | 349 | %endif |
8c119fd0 | 350 | |
351 | %files clients | |
352 | %defattr(-,root,root) | |
9f182968 | 353 | %attr(0755,root,root) %{_bindir}/ssh |
3ef3d901 | 354 | %attr(0644,root,root) %{_mandir}/man1/ssh.1* |
9f182968 | 355 | %attr(0644,root,root) %{_mandir}/man5/ssh_config.5* |
3ef3d901 | 356 | %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ssh/ssh_config |
357 | %attr(-,root,root) %{_bindir}/slogin | |
358 | %attr(-,root,root) %{_mandir}/man1/slogin.1* | |
359 | %if ! %{rescue} | |
aa0289fe | 360 | %attr(0755,root,root) %{_bindir}/ssh-agent |
361 | %attr(0755,root,root) %{_bindir}/ssh-add | |
61e96248 | 362 | %attr(0755,root,root) %{_bindir}/ssh-keyscan |
363 | %attr(0755,root,root) %{_bindir}/sftp | |
777319db | 364 | %attr(0644,root,root) %{_mandir}/man1/ssh-agent.1* |
365 | %attr(0644,root,root) %{_mandir}/man1/ssh-add.1* | |
61e96248 | 366 | %attr(0644,root,root) %{_mandir}/man1/ssh-keyscan.1* |
367 | %attr(0644,root,root) %{_mandir}/man1/sftp.1* | |
3ef3d901 | 368 | %endif |
f1bcacf9 | 369 | |
3ef3d901 | 370 | %if ! %{rescue} |
d397b172 | 371 | %files server |
372 | %defattr(-,root,root) | |
80e92e5d | 373 | %dir %attr(0111,root,root) %{_var}/empty/sshd |
aa0289fe | 374 | %attr(0755,root,root) %{_sbindir}/sshd |
375 | %attr(0755,root,root) %{_libexecdir}/openssh/sftp-server | |
777319db | 376 | %attr(0644,root,root) %{_mandir}/man8/sshd.8* |
9f182968 | 377 | %attr(0644,root,root) %{_mandir}/man5/sshd_config.5* |
777319db | 378 | %attr(0644,root,root) %{_mandir}/man8/sftp-server.8* |
3ef3d901 | 379 | %attr(0755,root,root) %dir %{_sysconfdir}/ssh |
380 | %attr(0600,root,root) %config(noreplace) %{_sysconfdir}/ssh/sshd_config | |
548fd014 | 381 | %attr(0600,root,root) %config(noreplace) /etc/pam.d/sshd |
f1bcacf9 | 382 | %attr(0755,root,root) %config /etc/rc.d/init.d/sshd |
3ef3d901 | 383 | %endif |
8efc0c15 | 384 | |
1e970014 | 385 | %if ! %{no_x11_askpass} |
d397b172 | 386 | %files askpass |
387 | %defattr(-,root,root) | |
f28583d0 | 388 | %doc x11-ssh-askpass-%{aversion}/README |
389 | %doc x11-ssh-askpass-%{aversion}/ChangeLog | |
390 | %doc x11-ssh-askpass-%{aversion}/SshAskpass*.ad | |
aa0289fe | 391 | %attr(0755,root,root) %{_libexecdir}/openssh/ssh-askpass |
392 | %attr(0755,root,root) %{_libexecdir}/openssh/x11-ssh-askpass | |
1e970014 | 393 | %endif |
8c119fd0 | 394 | |
1e970014 | 395 | %if ! %{no_gnome_askpass} |
bc7ea646 | 396 | %files askpass-gnome |
397 | %defattr(-,root,root) | |
3ef3d901 | 398 | %attr(0755,root,root) %config %{_sysconfdir}/profile.d/gnome-ssh-askpass.* |
aa0289fe | 399 | %attr(0755,root,root) %{_libexecdir}/openssh/gnome-ssh-askpass |
1e970014 | 400 | %endif |
aa0289fe | 401 | |
402 | %changelog | |
cf6713a2 | 403 | * Mon Sep 30 2002 Damien Miller <djm@mindrot.org> |
404 | - Use contrib/ Makefile for building askpass programs | |
405 | ||
9f182968 | 406 | * Fri Jun 21 2002 Damien Miller <djm@mindrot.org> |
407 | - Merge in spec changes from seba@iq.pl (Sebastian Pachuta) | |
408 | - Add new {ssh,sshd}_config.5 manpages | |
409 | - Add new ssh-keysign program and remove setuid from ssh client | |
410 | ||
3ef3d901 | 411 | * Fri May 10 2002 Damien Miller <djm@mindrot.org> |
412 | - Merge in spec changes from RedHat, reorgansie a little | |
413 | - Add Privsep user, group and directory | |
414 | ||
415 | * Thu Mar 7 2002 Nalin Dahyabhai <nalin@redhat.com> 3.1p1-2 | |
416 | - bump and grind (through the build system) | |
417 | ||
418 | * Thu Mar 7 2002 Nalin Dahyabhai <nalin@redhat.com> 3.1p1-1 | |
419 | - require sharutils for building (mindrot #137) | |
420 | - require db1-devel only when building for 6.x (#55105), which probably won't | |
421 | work anyway (3.1 requires OpenSSL 0.9.6 to build), but what the heck | |
422 | - require pam-devel by file (not by package name) again | |
423 | - add Markus's patch to compile with OpenSSL 0.9.5a (from | |
424 | http://bugzilla.mindrot.org/show_bug.cgi?id=141) and apply it if we're | |
425 | building for 6.x | |
426 | ||
427 | * Thu Mar 7 2002 Nalin Dahyabhai <nalin@redhat.com> 3.1p1-0 | |
428 | - update to 3.1p1 | |
429 | ||
430 | * Tue Mar 5 2002 Nalin Dahyabhai <nalin@redhat.com> SNAP-20020305 | |
431 | - update to SNAP-20020305 | |
432 | - drop debug patch, fixed upstream | |
433 | ||
434 | * Wed Feb 20 2002 Nalin Dahyabhai <nalin@redhat.com> SNAP-20020220 | |
435 | - update to SNAP-20020220 for testing purposes (you've been warned, if there's | |
436 | anything to be warned about, gss patches won't apply, I don't mind) | |
437 | ||
438 | * Wed Feb 13 2002 Nalin Dahyabhai <nalin@redhat.com> 3.0.2p1-3 | |
439 | - add patches from Simon Wilkinson and Nicolas Williams for GSSAPI key | |
440 | exchange, authentication, and named key support | |
441 | ||
442 | * Wed Jan 23 2002 Nalin Dahyabhai <nalin@redhat.com> 3.0.2p1-2 | |
443 | - remove dependency on db1-devel, which has just been swallowed up whole | |
444 | by gnome-libs-devel | |
445 | ||
446 | * Sun Dec 29 2001 Nalin Dahyabhai <nalin@redhat.com> | |
447 | - adjust build dependencies so that build6x actually works right (fix | |
448 | from Hugo van der Kooij) | |
449 | ||
450 | * Tue Dec 4 2001 Nalin Dahyabhai <nalin@redhat.com> 3.0.2p1-1 | |
451 | - update to 3.0.2p1 | |
452 | ||
453 | * Fri Nov 16 2001 Nalin Dahyabhai <nalin@redhat.com> 3.0.1p1-1 | |
454 | - update to 3.0.1p1 | |
455 | ||
456 | * Tue Nov 13 2001 Nalin Dahyabhai <nalin@redhat.com> | |
457 | - update to current CVS (not for use in distribution) | |
458 | ||
459 | * Thu Nov 8 2001 Nalin Dahyabhai <nalin@redhat.com> 3.0p1-1 | |
460 | - merge some of Damien Miller <djm@mindrot.org> changes from the upstream | |
461 | 3.0p1 spec file and init script | |
462 | ||
463 | * Wed Nov 7 2001 Nalin Dahyabhai <nalin@redhat.com> | |
464 | - update to 3.0p1 | |
465 | - update to x11-ssh-askpass 1.2.4.1 | |
466 | - change build dependency on a file from pam-devel to the pam-devel package | |
467 | - replace primes with moduli | |
468 | ||
469 | * Thu Sep 27 2001 Nalin Dahyabhai <nalin@redhat.com> 2.9p2-9 | |
470 | - incorporate fix from Markus Friedl's advisory for IP-based authorization bugs | |
471 | ||
472 | * Thu Sep 13 2001 Bernhard Rosenkraenzer <bero@redhat.com> 2.9p2-8 | |
473 | - Merge changes to rescue build from current sysadmin survival cd | |
474 | ||
475 | * Thu Sep 6 2001 Nalin Dahyabhai <nalin@redhat.com> 2.9p2-7 | |
476 | - fix scp's server's reporting of file sizes, and build with the proper | |
477 | preprocessor define to get large-file capable open(), stat(), etc. | |
478 | (sftp has been doing this correctly all along) (#51827) | |
479 | - configure without --with-ipv4-default on RHL 7.x and newer (#45987,#52247) | |
480 | - pull cvs patch to fix support for /etc/nologin for non-PAM logins (#47298) | |
481 | - mark profile.d scriptlets as config files (#42337) | |
482 | - refer to Jason Stone's mail for zsh workaround for exit-hanging quasi-bug | |
483 | - change a couple of log() statements to debug() statements (#50751) | |
484 | - pull cvs patch to add -t flag to sshd (#28611) | |
485 | - clear fd_sets correctly (one bit per FD, not one byte per FD) (#43221) | |
486 | ||
487 | * Mon Aug 20 2001 Nalin Dahyabhai <nalin@redhat.com> 2.9p2-6 | |
488 | - add db1-devel as a BuildPrerequisite (noted by Hans Ecke) | |
489 | ||
490 | * Thu Aug 16 2001 Nalin Dahyabhai <nalin@redhat.com> | |
491 | - pull cvs patch to fix remote port forwarding with protocol 2 | |
492 | ||
493 | * Thu Aug 9 2001 Nalin Dahyabhai <nalin@redhat.com> | |
494 | - pull cvs patch to add session initialization to no-pty sessions | |
495 | - pull cvs patch to not cut off challengeresponse auth needlessly | |
496 | - refuse to do X11 forwarding if xauth isn't there, handy if you enable | |
497 | it by default on a system that doesn't have X installed (#49263) | |
498 | ||
499 | * Wed Aug 8 2001 Nalin Dahyabhai <nalin@redhat.com> | |
500 | - don't apply patches to code we don't intend to build (spotted by Matt Galgoci) | |
501 | ||
502 | * Mon Aug 6 2001 Nalin Dahyabhai <nalin@redhat.com> | |
503 | - pass OPTIONS correctly to initlog (#50151) | |
504 | ||
505 | * Wed Jul 25 2001 Nalin Dahyabhai <nalin@redhat.com> | |
506 | - switch to x11-ssh-askpass 1.2.2 | |
507 | ||
508 | * Wed Jul 11 2001 Nalin Dahyabhai <nalin@redhat.com> | |
509 | - rebuild in new environment | |
510 | ||
511 | * Mon Jun 25 2001 Nalin Dahyabhai <nalin@redhat.com> | |
512 | - disable the gssapi patch | |
513 | ||
514 | * Mon Jun 18 2001 Nalin Dahyabhai <nalin@redhat.com> | |
515 | - update to 2.9p2 | |
516 | - refresh to a new version of the gssapi patch | |
517 | ||
518 | * Thu Jun 7 2001 Nalin Dahyabhai <nalin@redhat.com> | |
519 | - change Copyright: BSD to License: BSD | |
520 | - add Markus Friedl's unverified patch for the cookie file deletion problem | |
521 | so that we can verify it | |
522 | - drop patch to check if xauth is present (was folded into cookie patch) | |
523 | - don't apply gssapi patches for the errata candidate | |
524 | - clear supplemental groups list at startup | |
525 | ||
526 | * Fri May 25 2001 Nalin Dahyabhai <nalin@redhat.com> | |
527 | - fix an error parsing the new default sshd_config | |
528 | - add a fix from Markus Friedl (via openssh-unix-dev) for ssh-keygen not | |
529 | dealing with comments right | |
530 | ||
531 | * Thu May 24 2001 Nalin Dahyabhai <nalin@redhat.com> | |
532 | - add in Simon Wilkinson's GSSAPI patch to give it some testing in-house, | |
533 | to be removed before the next beta cycle because it's a big departure | |
534 | from the upstream version | |
535 | ||
536 | * Thu May 3 2001 Nalin Dahyabhai <nalin@redhat.com> | |
537 | - finish marking strings in the init script for translation | |
538 | - modify init script to source /etc/sysconfig/sshd and pass $OPTIONS to sshd | |
539 | at startup (change merged from openssh.com init script, originally by | |
540 | Pekka Savola) | |
541 | - refuse to do X11 forwarding if xauth isn't there, handy if you enable | |
542 | it by default on a system that doesn't have X installed | |
543 | ||
544 | * Wed May 2 2001 Nalin Dahyabhai <nalin@redhat.com> | |
545 | - update to 2.9 | |
546 | - drop various patches that came from or went upstream or to or from CVS | |
547 | ||
548 | * Wed Apr 18 2001 Nalin Dahyabhai <nalin@redhat.com> | |
549 | - only require initscripts 5.00 on 6.2 (reported by Peter Bieringer) | |
550 | ||
551 | * Sun Apr 8 2001 Preston Brown <pbrown@redhat.com> | |
552 | - remove explicit openssl requirement, fixes builddistro issue | |
553 | - make initscript stop() function wait until sshd really dead to avoid | |
554 | races in condrestart | |
555 | ||
556 | * Mon Apr 2 2001 Nalin Dahyabhai <nalin@redhat.com> | |
557 | - mention that challengereponse supports PAM, so disabling password doesn't | |
558 | limit users to pubkey and rsa auth (#34378) | |
559 | - bypass the daemon() function in the init script and call initlog directly, | |
560 | because daemon() won't start a daemon it detects is already running (like | |
561 | open connections) | |
562 | - require the version of openssl we had when we were built | |
563 | ||
564 | * Fri Mar 23 2001 Nalin Dahyabhai <nalin@redhat.com> | |
565 | - make do_pam_setcred() smart enough to know when to establish creds and | |
566 | when to reinitialize them | |
567 | - add in a couple of other fixes from Damien for inclusion in the errata | |
568 | ||
569 | * Thu Mar 22 2001 Nalin Dahyabhai <nalin@redhat.com> | |
570 | - update to 2.5.2p2 | |
571 | - call setcred() again after initgroups, because the "creds" could actually | |
572 | be group memberships | |
573 | ||
574 | * Tue Mar 20 2001 Nalin Dahyabhai <nalin@redhat.com> | |
575 | - update to 2.5.2p1 (includes endianness fixes in the rijndael implementation) | |
576 | - don't enable challenge-response by default until we find a way to not | |
577 | have too many userauth requests (we may make up to six pubkey and up to | |
578 | three password attempts as it is) | |
579 | - remove build dependency on rsh to match openssh.com's packages more closely | |
580 | ||
581 | * Sat Mar 3 2001 Nalin Dahyabhai <nalin@redhat.com> | |
582 | - remove dependency on openssl -- would need to be too precise | |
583 | ||
584 | * Fri Mar 2 2001 Nalin Dahyabhai <nalin@redhat.com> | |
585 | - rebuild in new environment | |
586 | ||
587 | * Mon Feb 26 2001 Nalin Dahyabhai <nalin@redhat.com> | |
588 | - Revert the patch to move pam_open_session. | |
589 | - Init script and spec file changes from Pekka Savola. (#28750) | |
590 | - Patch sftp to recognize '-o protocol' arguments. (#29540) | |
591 | ||
592 | * Thu Feb 22 2001 Nalin Dahyabhai <nalin@redhat.com> | |
593 | - Chuck the closing patch. | |
594 | - Add a trigger to add host keys for protocol 2 to the config file, now that | |
595 | configuration file syntax requires us to specify it with HostKey if we | |
596 | specify any other HostKey values, which we do. | |
597 | ||
598 | * Tue Feb 20 2001 Nalin Dahyabhai <nalin@redhat.com> | |
599 | - Redo patch to move pam_open_session after the server setuid()s to the user. | |
600 | - Rework the nopam patch to use be picked up by autoconf. | |
601 | ||
602 | * Mon Feb 19 2001 Nalin Dahyabhai <nalin@redhat.com> | |
603 | - Update for 2.5.1p1. | |
604 | - Add init script mods from Pekka Savola. | |
605 | - Tweak the init script to match the CVS contrib script more closely. | |
606 | - Redo patch to ssh-add to try to adding both identity and id_dsa to also try | |
607 | adding id_rsa. | |
608 | ||
609 | * Fri Feb 16 2001 Nalin Dahyabhai <nalin@redhat.com> | |
610 | - Update for 2.5.0p1. | |
611 | - Use $RPM_OPT_FLAGS instead of -O when building gnome-ssh-askpass | |
612 | - Resync with parts of Damien Miller's openssh.spec from CVS, including | |
613 | update of x11 askpass to 1.2.0. | |
614 | - Only require openssl (don't prereq) because we generate keys in the init | |
615 | script now. | |
616 | ||
617 | * Tue Feb 13 2001 Nalin Dahyabhai <nalin@redhat.com> | |
618 | - Don't open a PAM session until we've forked and become the user (#25690). | |
619 | - Apply Andrew Bartlett's patch for letting pam_authenticate() know which | |
620 | host the user is attempting a login from. | |
621 | - Resync with parts of Damien Miller's openssh.spec from CVS. | |
622 | - Don't expose KbdInt responses in debug messages (from CVS). | |
623 | - Detect and handle errors in rsa_{public,private}_decrypt (from CVS). | |
624 | ||
625 | * Wed Feb 7 2001 Trond Eivind Glomsrxd <teg@redhat.com> | |
626 | - i18n-tweak to initscript. | |
627 | ||
628 | * Tue Jan 23 2001 Nalin Dahyabhai <nalin@redhat.com> | |
629 | - More gettextizing. | |
630 | - Close all files after going into daemon mode (needs more testing). | |
631 | - Extract patch from CVS to handle auth banners (in the client). | |
632 | - Extract patch from CVS to handle compat weirdness. | |
633 | ||
634 | * Fri Jan 19 2001 Nalin Dahyabhai <nalin@redhat.com> | |
635 | - Finish with the gettextizing. | |
636 | ||
637 | * Thu Jan 18 2001 Nalin Dahyabhai <nalin@redhat.com> | |
638 | - Fix a bug in auth2-pam.c (#23877) | |
639 | - Gettextize the init script. | |
640 | ||
641 | * Wed Dec 20 2000 Nalin Dahyabhai <nalin@redhat.com> | |
642 | - Incorporate a switch for using PAM configs for 6.x, just in case. | |
643 | ||
644 | * Tue Dec 5 2000 Nalin Dahyabhai <nalin@redhat.com> | |
645 | - Incorporate Bero's changes for a build specifically for rescue CDs. | |
646 | ||
647 | * Wed Nov 29 2000 Nalin Dahyabhai <nalin@redhat.com> | |
648 | - Don't treat pam_setcred() failure as fatal unless pam_authenticate() has | |
649 | succeeded, to allow public-key authentication after a failure with "none" | |
650 | authentication. (#21268) | |
651 | ||
652 | * Tue Nov 28 2000 Nalin Dahyabhai <nalin@redhat.com> | |
653 | - Update to x11-askpass 1.1.1. (#21301) | |
654 | - Don't second-guess fixpaths, which causes paths to get fixed twice. (#21290) | |
655 | ||
656 | * Mon Nov 27 2000 Nalin Dahyabhai <nalin@redhat.com> | |
657 | - Merge multiple PAM text messages into subsequent prompts when possible when | |
658 | doing keyboard-interactive authentication. | |
659 | ||
660 | * Sun Nov 26 2000 Nalin Dahyabhai <nalin@redhat.com> | |
661 | - Disable the built-in MD5 password support. We're using PAM. | |
662 | - Take a crack at doing keyboard-interactive authentication with PAM, and | |
663 | enable use of it in the default client configuration so that the client | |
664 | will try it when the server disallows password authentication. | |
665 | - Build with debugging flags. Build root policies strip all binaries anyway. | |
666 | ||
667 | * Tue Nov 21 2000 Nalin Dahyabhai <nalin@redhat.com> | |
668 | - Use DESTDIR instead of %%makeinstall. | |
669 | - Remove /usr/X11R6/bin from the path-fixing patch. | |
670 | ||
671 | * Mon Nov 20 2000 Nalin Dahyabhai <nalin@redhat.com> | |
672 | - Add the primes file from the latest snapshot to the main package (#20884). | |
673 | - Add the dev package to the prereq list (#19984). | |
674 | - Remove the default path and mimic login's behavior in the server itself. | |
675 | ||
676 | * Fri Nov 17 2000 Nalin Dahyabhai <nalin@redhat.com> | |
677 | - Resync with conditional options in Damien Miller's .spec file for an errata. | |
678 | - Change libexecdir from %%{_libexecdir}/ssh to %%{_libexecdir}/openssh. | |
679 | ||
680 | * Tue Nov 7 2000 Nalin Dahyabhai <nalin@redhat.com> | |
681 | - Update to OpenSSH 2.3.0p1. | |
682 | - Update to x11-askpass 1.1.0. | |
683 | - Enable keyboard-interactive authentication. | |
684 | ||
685 | * Mon Oct 30 2000 Nalin Dahyabhai <nalin@redhat.com> | |
686 | - Update to ssh-askpass-x11 1.0.3. | |
687 | - Change authentication related messages to be private (#19966). | |
688 | ||
689 | * Tue Oct 10 2000 Nalin Dahyabhai <nalin@redhat.com> | |
690 | - Patch ssh-keygen to be able to list signatures for DSA public key files | |
691 | it generates. | |
692 | ||
693 | * Thu Oct 5 2000 Nalin Dahyabhai <nalin@redhat.com> | |
694 | - Add BuildPreReq on /usr/include/security/pam_appl.h to be sure we always | |
695 | build PAM authentication in. | |
696 | - Try setting SSH_ASKPASS if gnome-ssh-askpass is installed. | |
697 | - Clean out no-longer-used patches. | |
698 | - Patch ssh-add to try to add both identity and id_dsa, and to error only | |
699 | when neither exists. | |
700 | ||
701 | * Mon Oct 2 2000 Nalin Dahyabhai <nalin@redhat.com> | |
702 | - Update x11-askpass to 1.0.2. (#17835) | |
703 | - Add BuildPreReqs for /bin/login and /usr/bin/rsh so that configure will | |
704 | always find them in the right place. (#17909) | |
705 | - Set the default path to be the same as the one supplied by /bin/login, but | |
706 | add /usr/X11R6/bin. (#17909) | |
707 | - Try to handle obsoletion of ssh-server more cleanly. Package names | |
708 | are different, but init script name isn't. (#17865) | |
709 | ||
710 | * Wed Sep 6 2000 Nalin Dahyabhai <nalin@redhat.com> | |
711 | - Update to 2.2.0p1. (#17835) | |
712 | - Tweak the init script to allow proper restarting. (#18023) | |
713 | ||
714 | * Wed Aug 23 2000 Nalin Dahyabhai <nalin@redhat.com> | |
715 | - Update to 20000823 snapshot. | |
716 | - Change subpackage requirements from %%{version} to %%{version}-%%{release} | |
717 | - Back out the pipe patch. | |
718 | ||
719 | * Mon Jul 17 2000 Nalin Dahyabhai <nalin@redhat.com> | |
720 | - Update to 2.1.1p4, which includes fixes for config file parsing problems. | |
721 | - Move the init script back. | |
722 | - Add Damien's quick fix for wackiness. | |
723 | ||
724 | * Wed Jul 12 2000 Nalin Dahyabhai <nalin@redhat.com> | |
725 | - Update to 2.1.1p3, which includes fixes for X11 forwarding and strtok(). | |
726 | ||
727 | * Thu Jul 6 2000 Nalin Dahyabhai <nalin@redhat.com> | |
728 | - Move condrestart to server postun. | |
729 | - Move key generation to init script. | |
730 | - Actually use the right patch for moving the key generation to the init script. | |
731 | - Clean up the init script a bit. | |
732 | ||
733 | * Wed Jul 5 2000 Nalin Dahyabhai <nalin@redhat.com> | |
734 | - Fix X11 forwarding, from mail post by Chan Shih-Ping Richard. | |
735 | ||
736 | * Sun Jul 2 2000 Nalin Dahyabhai <nalin@redhat.com> | |
737 | - Update to 2.1.1p2. | |
738 | - Use of strtok() considered harmful. | |
739 | ||
740 | * Sat Jul 1 2000 Nalin Dahyabhai <nalin@redhat.com> | |
741 | - Get the build root out of the man pages. | |
742 | ||
743 | * Thu Jun 29 2000 Nalin Dahyabhai <nalin@redhat.com> | |
744 | - Add and use condrestart support in the init script. | |
745 | - Add newer initscripts as a prereq. | |
746 | ||
747 | * Tue Jun 27 2000 Nalin Dahyabhai <nalin@redhat.com> | |
748 | - Build in new environment (release 2) | |
749 | - Move -clients subpackage to Applications/Internet group | |
750 | ||
751 | * Fri Jun 9 2000 Nalin Dahyabhai <nalin@redhat.com> | |
752 | - Update to 2.2.1p1 | |
753 | ||
754 | * Sat Jun 3 2000 Nalin Dahyabhai <nalin@redhat.com> | |
755 | - Patch to build with neither RSA nor RSAref. | |
756 | - Miscellaneous FHS-compliance tweaks. | |
757 | - Fix for possibly-compressed man pages. | |
758 | ||
aa0289fe | 759 | * Wed Mar 15 2000 Damien Miller <djm@ibs.com.au> |
760 | - Updated for new location | |
761 | - Updated for new gnome-ssh-askpass build | |
3ef3d901 | 762 | |
aa0289fe | 763 | * Sun Dec 26 1999 Damien Miller <djm@mindrot.org> |
764 | - Added Jim Knoble's <jmknoble@pobox.com> askpass | |
3ef3d901 | 765 | |
aa0289fe | 766 | * Mon Nov 15 1999 Damien Miller <djm@mindrot.org> |
767 | - Split subpackages further based on patch from jim knoble <jmknoble@pobox.com> | |
3ef3d901 | 768 | |
aa0289fe | 769 | * Sat Nov 13 1999 Damien Miller <djm@mindrot.org> |
770 | - Added 'Obsoletes' directives | |
3ef3d901 | 771 | |
aa0289fe | 772 | * Tue Nov 09 1999 Damien Miller <djm@ibs.com.au> |
773 | - Use make install | |
774 | - Subpackages | |
3ef3d901 | 775 | |
aa0289fe | 776 | * Mon Nov 08 1999 Damien Miller <djm@ibs.com.au> |
777 | - Added links for slogin | |
778 | - Fixed perms on manpages | |
3ef3d901 | 779 | |
aa0289fe | 780 | * Sat Oct 30 1999 Damien Miller <djm@ibs.com.au> |
781 | - Renamed init script | |
3ef3d901 | 782 | |
aa0289fe | 783 | * Fri Oct 29 1999 Damien Miller <djm@ibs.com.au> |
784 | - Back to old binary names | |
3ef3d901 | 785 | |
aa0289fe | 786 | * Thu Oct 28 1999 Damien Miller <djm@ibs.com.au> |
787 | - Use autoconf | |
788 | - New binary names | |
3ef3d901 | 789 | |
aa0289fe | 790 | * Wed Oct 27 1999 Damien Miller <djm@ibs.com.au> |
791 | - Initial RPMification, based on Jan "Yenya" Kasprzak's <kas@fi.muni.cz> spec. |