cf783db152
$FreeBSD$ tags and man page dates. Add a post-merge script which reapplies these changes. Run both scripts to normalize the existing code base. As a result, many files which should have had $FreeBSD$ tags but didn't now have them. Partly rewrite the upgrade instructions and remove the now outdated list of tricks.
147 lines
4.3 KiB
Plaintext
147 lines
4.3 KiB
Plaintext
|
||
|
||
FreeBSD maintainer's guide to OpenSSH-portable
|
||
==============================================
|
||
|
||
00) Make sure your mail spool has plenty of free space. It'll fill up
|
||
pretty fast once you're done with this checklist.
|
||
|
||
01) Download the latest OpenSSH-portable tarball and signature from
|
||
OpenBSD (ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/).
|
||
|
||
02) Verify the signature:
|
||
|
||
$ gpg --verify openssh-X.YpZ.tar.gz.asc
|
||
|
||
03) Unpack the tarball in a suitable directory:
|
||
|
||
$ tar xf openssh-X.YpZ.tar.gz
|
||
|
||
04) Copy to the vendor directory:
|
||
|
||
$ svn co svn+ssh://svn.freebsd.org/base/vendor-crypto/openssh/dist
|
||
$ rsync --archive --delete openssh-X.YpZ/ dist/
|
||
|
||
05) Take care of added / deleted files:
|
||
|
||
$ svn rm $(svn stat dist | awk '$1 == "!" { print $2 }')
|
||
$ svn add --no-auto-props $(svn stat dist | awk '$1 == "?" { print $2 }')
|
||
|
||
06) Commit:
|
||
|
||
$ svn commit -m "Vendor import of OpenSSH X.YpZ." dist
|
||
|
||
07) Tag:
|
||
|
||
$ svn copy -m "Tag OpenSSH X.YpZ." \
|
||
svn+ssh://svn.freebsd.org/base/vendor-crypto/openssh/dist \
|
||
svn+ssh://svn.freebsd.org/base/vendor-crypto/openssh/X.YpZ
|
||
|
||
08) Check out head and run the pre-merge script:
|
||
|
||
$ svn co svn+ssh://svn.freebsd.org/base/head
|
||
$ cd head/crypto/openssh
|
||
$ sh freebsd-pre-merge.sh
|
||
|
||
09) Merge from the vendor branch:
|
||
|
||
$ svn merge -cNNNNNN \^/vendor-crypto/openssh/dist .
|
||
|
||
0A) Resolve conflicts. Remember to bump the version addendum in
|
||
version.h, and update the default value in ssh{,d}_config and
|
||
ssh{,d}_config.5.
|
||
|
||
0B) Diff against the vendor branch:
|
||
|
||
$ svn diff \^/vendor-crypto/openssh/dist .
|
||
|
||
Files that have modifications relative to the vendor code, and
|
||
only those files, must have the svn:keywords property set to
|
||
FreeBSD=%H and be listed in the 'keywords' file created by the
|
||
pre-merge script.
|
||
|
||
0C) Run the post-merge script:
|
||
|
||
$ sh freebsd-post-merge.sh
|
||
|
||
0D) Run the configure script:
|
||
|
||
$ sh freebsd-configure.sh
|
||
|
||
0E) Check config.h very carefully.
|
||
|
||
0F) If source files have been added or removed, update the appropriate
|
||
makefiles to reflect changes in the vendor's Makefile.in.
|
||
|
||
10) Build libssh:
|
||
|
||
$ cd ../../secure/lib/libssh && make obj && make depend && make
|
||
|
||
11) Follow the instructions in ssh_namespace.h to get a list of new
|
||
symbols, and them to ssh_namespace.h. Keep it sorted!
|
||
|
||
12) Build and install world, reboot, test. Pay particular attention
|
||
to pam_ssh(8), which gropes inside libssh and will break if
|
||
something significant changes or if ssh_namespace.h is out of
|
||
whack.
|
||
|
||
13) Commit, and hunker down for the inevitable storm of complaints.
|
||
|
||
|
||
|
||
An overview of FreeBSD changes to OpenSSH-portable
|
||
==================================================
|
||
|
||
XXX This section is out of date
|
||
|
||
0) VersionAddendum
|
||
|
||
The SSH protocol allows for a human-readable version string of up
|
||
to 40 characters to be appended to the protocol version string.
|
||
FreeBSD takes advantage of this to include a date indicating the
|
||
"patch level", so people can easily determine whether their system
|
||
is vulnerable when an OpenSSH advisory goes out. Some people,
|
||
however, dislike advertising their patch level in the protocol
|
||
handshake, so we've added a VersionAddendum configuration variable
|
||
to allow them to change or disable it.
|
||
|
||
1) Modified server-side defaults
|
||
|
||
We've modified some configuration defaults in sshd:
|
||
|
||
- PasswordAuthentication defaults to "no".
|
||
|
||
- LoginGraceTime defaults to 120 seconds instead of 600.
|
||
|
||
- PermitRootLogin defaults to "no".
|
||
|
||
- X11Forwarding defaults to "yes" (it's a threat to the client,
|
||
not to the server.)
|
||
|
||
2) Modified client-side defaults
|
||
|
||
We've modified some configuration defaults in ssh:
|
||
|
||
- CheckHostIP defaults to "no".
|
||
|
||
3) Canonic host names
|
||
|
||
We've added code to ssh.c to canonicize the target host name after
|
||
reading options but before trying to connect. This eliminates the
|
||
usual problem with duplicate known_hosts entries.
|
||
|
||
4) setusercontext() environment
|
||
|
||
Our setusercontext(3) can set environment variables, which we must
|
||
take care to transfer to the child's environment.
|
||
|
||
|
||
|
||
This port was brought to you by (in no particular order) DARPA, NAI
|
||
Labs, ThinkSec, Nescafé, the Aberlour Glenlivet Distillery Co.,
|
||
Suzanne Vega, and a Sanford's #69 Deluxe Marker.
|
||
|
||
-- des@FreeBSD.org
|
||
|
||
$FreeBSD$
|