about summary refs log tree commit diff
path: root/pkgs/tools/networking/openssh
AgeCommit message (Collapse)AuthorFilesLines
2016-09-14openssh: update gssapi patch, fix the buildBenjamin Staffin1-2/+3
2016-08-12Merge remote-tracking branch 'upstream/master' into hardened-stdenvRobin Gloster2-31/+3
2016-08-07openssh: 7.2p2 -> 7.3p1 (#17493)Aneesh Agrawal2-31/+3
Also remove patch for CVE-2015-8325 that has been fixed upstream.
2016-07-19Merge remote-tracking branch 'upstream/master' into hardened-stdenvRobin Gloster2-5/+14
2016-07-16openssh: Use the default privilege separation dir (/var/empty)Rickard Nilsson2-5/+14
(This is a rewritten version of the reverted commit a927709a35cee56f878f0f57a932e1a6e2ebe23b, that disables the creation of /var/empty during build so that sandboxed builds also works. For more context, see https://github.com/NixOS/nixpkgs/pull/16966) If running NixOS inside a container where the host's root-owned files and directories have been mapped to some other uid (like nobody), the ssh daemon fails to start, producing this error message: fatal: /nix/store/...-openssh-7.2p2/empty must be owned by root and not group or world-writable. The reason for this is that when openssh is built, we explicitly set `--with-privsep-path=$out/empty`. This commit removes that flag which causes the default directory /var/empty to be used instead. Since NixOS' activation script correctly sets up that directory, the ssh daemon now also works within containers that have a non-root-owned nix store.
2016-07-15Revert "openssh: Use the default privilege separation dir (/var/empty)"Bjørn Forsman1-0/+5
This reverts commit a927709a35cee56f878f0f57a932e1a6e2ebe23b because it doesn't build: $ nix-build -A openssh ... mkdir /nix/store/yl2xap8n1by3dqxgc4rmrc4s753676a3-openssh-7.2p2/libexec (umask 022 ; ./mkinstalldirs /var/empty) mkdir /var mkdir: cannot create directory '/var': Permission denied mkdir /var/empty mkdir: cannot create directory '/var/empty': No such file or directory make: *** [Makefile:304: install-files] Error 1 builder for ‘/nix/store/ifygp4mqpv7l8cgp0njp8w7lmrl6brpp-openssh-7.2p2.drv’ failed with exit code 2
2016-07-14openssh: Use the default privilege separation dir (/var/empty)Rickard Nilsson1-5/+0
If running NixOS inside a container where the host's root-owned files and directories have been mapped to some other uid (like nobody), the ssh daemon fails to start, producing this error message: fatal: /nix/store/...-openssh-7.2p2/empty must be owned by root and not group or world-writable. The reason for this is that when openssh is built, we explicitly set `--with-privsep-path=$out/empty`. This commit removes that flag which causes the default directory /var/empty to be used instead. Since NixOS' activation script correctly sets up that directory, the ssh daemon now also works within containers that have a non-root-owned nix store.
2016-04-18Merge remote-tracking branch 'upstream/master' into hardened-stdenvRobin Gloster2-1/+31
2016-04-15openssh: fix CVE-2015-8325Aneesh Agrawal2-1/+31
Debian Security Advisory: https://www.debian.org/security/2016/dsa-3550 Upstream commit: https://anongit.mindrot.org/openssh.git/commit/?id=85bdcd7c92fe7ff133bbc4e10a65c91810f88755
2016-04-03Merge remote-tracking branch 'upstream/master' into hardened-stdenvRobin Gloster2-1/+55
2016-04-01ssh: Fix support for ssh-dss host keysEelco Dolstra2-1/+55
2016-03-15Merge remote-tracking branch 'upstream/master' into hardened-stdenvRobin Gloster1-6/+9
2016-03-10openssh: update homepage linkAneesh Agrawal1-1/+1
Unfortunately, the site is not available over HTTPS.
2016-03-10openssh: 7.2p1 -> 7.2p2 for OSA x11fwd.advAneesh Agrawal1-2/+2
Fixes OpenSSH Security Advisory x11fwd.adv, which is available at http://www.openssh.com/txt/x11fwd.adv.
2016-03-08openssh: update GSSAPI patch to openssh 7.2Aneesh Agrawal1-2/+2
2016-03-08openssh: decouple gssapi patch from kerberosAneesh Agrawal1-1/+4
The GSSAPI patch is useful but maintained by Debian, not upstream, and can be slow to update. To avoid breaking openssh_with_kerberos when the openssh version is bumped but the GSSAPI patch has not been updated, don't enable the GSSAPI patch implicitly but require it to be explicitly enabled.
2016-03-07Merge remote-tracking branch 'origin/master' into hardened-stdenvFranz Pletz1-1/+4
2016-03-07Merge pull request #13705 from aneeshusa/use-bin-instead-of-sbin-for-opensshjoachifm1-0/+1
openssh: use bin instead of sbin folder
2016-03-06openssh: allow building without linking opensslAneesh Agrawal1-1/+3
http://undeadly.org/cgi?action=article&sid=20140430045723 has the original announcement of this option. Note, openssl headers are still required at build time, see this comment: http://www.gossamer-threads.com/lists/openssh/dev/61125#61125
2016-03-05openssh: use bin instead of sbin folderAneesh Agrawal1-0/+1
References #11939.
2016-03-05Use general hardening flag toggle listsFranz Pletz1-1/+1
The following parameters are now available: * hardeningDisable To disable specific hardening flags * hardeningEnable To enable specific hardening flags Only the cc-wrapper supports this right now, but these may be reused by other wrappers, builders or setup hooks. cc-wrapper supports the following flags: * fortify * stackprotector * pie (disabled by default) * pic * strictoverflow * format * relro * bindnow
2016-03-01Merge remote-tracking branch 'upstream/master' into hardened-stdenvRobin Gloster1-11/+3
2016-03-01openssh: Fix buildEelco Dolstra1-9/+1
2016-03-01openssh: 7.1p2 -> 7.2p1Aneesh Agrawal1-2/+2
2016-02-26openssh: enable pie hardeningRobin Gloster1-0/+2
2016-02-20openssh: update gssapi patch to match openssh versionBenjamin Staffin1-2/+2
Should fix the openssh_with_kerberos build. Fixes #13140 (cherry picked from commit 3dae6c7e1e1eb64b3ceb2796eea1ad0ae1596688)
2016-02-01openssh: Enable DSA host/client keysEelco Dolstra1-1/+10
This applies a patch from Fedora to make HostKeyAlgorithms do the right thing, fixing the issue described in 401782cb678d2e28c0f7f2d40c6421624f410148.
2016-02-01openssh: 6.9p1 -> 7.1p2koral3-119/+3
2016-01-14openssh: Disable roaming (security fix)Franz Pletz2-1/+52
Fixes CVE-2016-0777 and CVE-0216-0778. Closes #12385.
2016-01-05openssh: Add gssapi patch used by other major distrosBenjamin Staffin1-2/+9
This patch is borrowed verbatim from Debian, where it is actively maintained for each openssh update. It's also included in Fedora's openssh package, in Arch linux as openssh-gssapi in the AUR, in MacOS X, and presumably various other platforms and linux distros. The main relevant parts of this patch: - Adds several ssh_config options: GSSAPIKeyExchange, GSSAPITrustDNS, GSSAPIClientIdentity, GSSAPIServerIdentity GSSAPIRenewalForcesRekey - Optionally use an in-memory credentials cache api for security My primary motivation for wanting the patch is the GSSAPIKeyExchange and GSSAPITrustDNS features. My user ssh_config is shared across several OSes, and it's a lot easier to manage if they all support the same options.
2015-12-28openssh: Compile with '--with-pid-dir' to improve build purityTuomas Tynkkynen1-0/+2
The configure script tries to probe whether /var/run exists when determining the location for the pid file, which is not very nice when doing chroot builds. Just set it explicitly to avoid the problem. For reference, the culprit in configure.ac: ```` piddir=/var/run if test ! -d $piddir ; then piddir=`eval echo ${sysconfdir}` case $piddir in NONE/*) piddir=`echo $piddir | sed "s~NONE~$ac_default_prefix~"` ;; esac fi AC_ARG_WITH([pid-dir], [ --with-pid-dir=PATH Specify location of ssh.pid file], ... ```` Also, use the `install-nokeys` target in installPhase so we avoid installing useless host keys into $out/etc/ssh and improve built purity as well.
2015-08-20openssh: Apply some Fedora security backportsEelco Dolstra2-1/+66
2015-08-20Revert "openssh: 6.9p1 -> 7.0p1"Eelco Dolstra1-2/+2
This reverts commit a8eb2a6a81524f3be0c8886f6d06090b50b0a513. OpenSSH 7.0 is causing too many interoperability problems so soon before the 15.08 release. For instance, it causes NixOps EC2 initial deployments to fail with "REMOTE HOST IDENTIFICATION HAS CHANGED". This is because the client knows the server's ssh-dss host key, but this key is no longer accepted by default. Setting "HostKeyAlgorithms" to "+ssh-dss" does not work because it causes ssh-dss to be ordered after "ecdsa-sha2-nistp521", which the server also offers. (Normally, ssh prioritizes host key algorithms for which the client has a known host key, but not if you set HostKeyAlgorithms.)
2015-08-11openssh: 6.9p1 -> 7.0p1William A. Kennington III1-2/+2
2015-07-06openssh: 6.8p1 -> 6.9p1William A. Kennington III1-2/+2
2015-07-06openssh: Refactor and install sample config filesWilliam A. Kennington III1-32/+27
2015-03-20openssh: 6.7p1 -> 6.8p1William A. Kennington III1-2/+2
2015-02-18This doesn't hurt the current darwin stdenv and doesn't affect anything ↵Dan Peebles1-0/+1
else, but is needed for the upcoming pure darwin stdenv
2015-01-20fetchurl: add mirrors for OpenBSD (close #5551)Franz Pletz1-1/+1
This changes source URLs for openssh and libressl accordingly.
2014-11-27restund, openssh_hpn: mark as brokenVladimír Čunát1-0/+1
2014-11-20openssh: Update to 6.7p1Eelco Dolstra1-13/+5
2014-11-06Turn more licenses into lib.licenses styleMateusz Kowalczyk1-1/+1
Should eval cleanly, as far as -A tarball tells me. Relevant: issue #2999, issue #739
2014-09-11update hpn patch version to match openssh versionJB Giraudeau1-3/+2
so that hpn_openssh is not boken anymore
2014-07-28Turn some license strings into lib.licenses valuesMateusz Kowalczyk1-1/+1
2014-05-22openssh: Fix broken URLEelco Dolstra1-1/+1
2014-03-29openssh: fix CVE-2014-2653 by a Debian patchVladimír Čunát1-1/+11
2014-03-20openssh: Update to 6.6p1Eelco Dolstra1-2/+2
CVE-2014-2532 Note that this CVE only affects people who use AcceptEnv with wildcards.
2014-02-01openssh_hpn: mark as broken ATM, cf. #1640Vladimír Čunát1-0/+1
2014-01-31openssh: Upgrade from 6.4p1 -> 6.5p1William A. Kennington III1-11/+11
2013-12-30openssh: Update from 6.2p2 -> 6.4p1William A. Kennington III2-23/+5
This patch also bumps up the HPN version of openssh so that it compiles on top of 6.4. Along with the bump, a package was added for the high performance networking version. The gcmrekey patch was removed as this vulnerability is fixed in version 6.4 onward. http://www.openssh.org/txt/gcmrekey.adv
generated by cgit-pink 1.4.1 (git 2.36.1) at 2024-08-21 15:54:26 +0000