diff options
Diffstat (limited to 'recipes-connectivity/openssh/openssh')
13 files changed, 619 insertions, 0 deletions
diff --git a/recipes-connectivity/openssh/openssh/0001-upstream-fix-integer-overflow-in-XMSS-private-key-pa.patch b/recipes-connectivity/openssh/openssh/0001-upstream-fix-integer-overflow-in-XMSS-private-key-pa.patch new file mode 100644 index 0000000..3265be3 --- /dev/null +++ b/recipes-connectivity/openssh/openssh/0001-upstream-fix-integer-overflow-in-XMSS-private-key-pa.patch @@ -0,0 +1,40 @@ +From 2014fad3d28090b59d2f8a0971166c06e5fa6da6 Mon Sep 17 00:00:00 2001 +From: Hongxu Jia <hongxu.jia@windriver.com> +Date: Fri, 18 Oct 2019 14:56:58 +0800 +Subject: [PATCH] upstream: fix integer overflow in XMSS private key parsing. + +Reported by Adam Zabrocki via SecuriTeam's SSH program. + +Note that this code is experimental and not compiled by default. + +ok markus@ + +OpenBSD-Commit-ID: cd0361896d15e8a1bac495ac583ff065ffca2be1 + +Signed-off-by: "djm@openbsd.org" <djm@openbsd.org> + +Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/a546b17bbaeb12beac4c9aeed56f74a42b18a93a] +CVE: CVE-2019-16905 + +Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> +--- + sshkey-xmss.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/sshkey-xmss.c b/sshkey-xmss.c +index aaae702..c57681a 100644 +--- a/sshkey-xmss.c ++++ b/sshkey-xmss.c +@@ -977,7 +977,8 @@ sshkey_xmss_decrypt_state(const struct sshkey *k, struct sshbuf *encoded, + goto out; + } + /* check that an appropriate amount of auth data is present */ +- if (sshbuf_len(encoded) < encrypted_len + authlen) { ++ if (sshbuf_len(encoded) < authlen || ++ sshbuf_len(encoded) - authlen < encrypted_len) { + r = SSH_ERR_INVALID_FORMAT; + goto out; + } +-- +2.7.4 + diff --git a/recipes-connectivity/openssh/openssh/add-test-support-for-busybox.patch b/recipes-connectivity/openssh/openssh/add-test-support-for-busybox.patch new file mode 100644 index 0000000..b8402a4 --- /dev/null +++ b/recipes-connectivity/openssh/openssh/add-test-support-for-busybox.patch @@ -0,0 +1,47 @@ +Adjust test cases to work with busybox. + +- Replace dd parameter "obs" with "bs". +- Replace "head -<num>" with "head -n <num>". + +Signed-off-by: Maxin B. John <maxin.john@enea.com> +Upstream-Status: Pending + +Index: openssh-7.6p1/regress/cipher-speed.sh +=================================================================== +--- openssh-7.6p1.orig/regress/cipher-speed.sh ++++ openssh-7.6p1/regress/cipher-speed.sh +@@ -17,7 +17,7 @@ for c in `${SSH} -Q cipher`; do n=0; for + printf "%-60s" "$c/$m:" + ( ${SSH} -o 'compression no' \ + -F $OBJ/ssh_proxy -m $m -c $c somehost \ +- exec sh -c \'"dd of=/dev/null obs=32k"\' \ ++ exec sh -c \'"dd of=/dev/null bs=32k"\' \ + < ${DATA} ) 2>&1 | getbytes + + if [ $? -ne 0 ]; then +Index: openssh-7.6p1/regress/transfer.sh +=================================================================== +--- openssh-7.6p1.orig/regress/transfer.sh ++++ openssh-7.6p1/regress/transfer.sh +@@ -13,7 +13,7 @@ cmp ${DATA} ${COPY} || fail "corrupted + for s in 10 100 1k 32k 64k 128k 256k; do + trace "dd-size ${s}" + rm -f ${COPY} +- dd if=$DATA obs=${s} 2> /dev/null | \ ++ dd if=$DATA bs=${s} 2> /dev/null | \ + ${SSH} -q -F $OBJ/ssh_proxy somehost "cat > ${COPY}" + if [ $? -ne 0 ]; then + fail "ssh cat $DATA failed" +Index: openssh-7.6p1/regress/key-options.sh +=================================================================== +--- openssh-7.6p1.orig/regress/key-options.sh ++++ openssh-7.6p1/regress/key-options.sh +@@ -47,7 +47,7 @@ for f in 127.0.0.1 '127.0.0.0\/8'; do + fi + + sed 's/.*/from="'"$f"'" &/' $origkeys >$authkeys +- from=`head -1 $authkeys | cut -f1 -d ' '` ++ from=`head -n 1 $authkeys | cut -f1 -d ' '` + verbose "key option $from" + r=`${SSH} -q -F $OBJ/ssh_proxy somehost 'echo true'` + if [ "$r" = "true" ]; then diff --git a/recipes-connectivity/openssh/openssh/fix-potential-signed-overflow-in-pointer-arithmatic.patch b/recipes-connectivity/openssh/openssh/fix-potential-signed-overflow-in-pointer-arithmatic.patch new file mode 100644 index 0000000..20036da --- /dev/null +++ b/recipes-connectivity/openssh/openssh/fix-potential-signed-overflow-in-pointer-arithmatic.patch @@ -0,0 +1,111 @@ +From 3328e98bcbf2930cd7eea3e6c92ad5dcbdf4794f Mon Sep 17 00:00:00 2001 +From: Yuanjie Huang <yuanjie.huang@windriver.com> +Date: Wed, 24 Aug 2016 03:15:43 +0000 +Subject: [PATCH] Fix potential signed overflow in pointer arithmatic + +Pointer arithmatic results in implementation defined signed integer +type, so that 's - src' in strlcpy and others may trigger signed overflow. +In case of compilation by gcc or clang with -ftrapv option, the overflow +would lead to program abort. + +Upstream-Status: Submitted [http://bugzilla.mindrot.org/show_bug.cgi?id=2608] + +Signed-off-by: Yuanjie Huang <yuanjie.huang@windriver.com> + +Complete the fix +Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> +--- + openbsd-compat/strlcat.c | 10 +++++++--- + openbsd-compat/strlcpy.c | 8 ++++++-- + openbsd-compat/strnlen.c | 8 ++++++-- + 3 files changed, 19 insertions(+), 7 deletions(-) + +diff --git a/openbsd-compat/strlcat.c b/openbsd-compat/strlcat.c +index bcc1b61..124e1e3 100644 +--- a/openbsd-compat/strlcat.c ++++ b/openbsd-compat/strlcat.c +@@ -23,6 +23,7 @@ + + #include <sys/types.h> + #include <string.h> ++#include <stdint.h> + + /* + * Appends src to string dst of size siz (unlike strncat, siz is the +@@ -42,7 +43,7 @@ strlcat(char *dst, const char *src, size_t siz) + /* Find the end of dst and adjust bytes left but don't go past end */ + while (n-- != 0 && *d != '\0') + d++; +- dlen = d - dst; ++ dlen = (uintptr_t)d - (uintptr_t)dst; + n = siz - dlen; + + if (n == 0) +@@ -55,8 +56,11 @@ strlcat(char *dst, const char *src, size_t siz) + s++; + } + *d = '\0'; +- +- return(dlen + (s - src)); /* count does not include NUL */ ++ /* ++ * Cast pointers to unsigned type before calculation, to avoid signed ++ * overflow when the string ends where the MSB has changed. ++ */ ++ return (dlen + ((uintptr_t)s - (uintptr_t)src)); /* count does not include NUL */ + } + + #endif /* !HAVE_STRLCAT */ +diff --git a/openbsd-compat/strlcpy.c b/openbsd-compat/strlcpy.c +index b4b1b60..b06f374 100644 +--- a/openbsd-compat/strlcpy.c ++++ b/openbsd-compat/strlcpy.c +@@ -23,6 +23,7 @@ + + #include <sys/types.h> + #include <string.h> ++#include <stdint.h> + + /* + * Copy src to string dst of size siz. At most siz-1 characters +@@ -51,8 +52,11 @@ strlcpy(char *dst, const char *src, size_t siz) + while (*s++) + ; + } +- +- return(s - src - 1); /* count does not include NUL */ ++ /* ++ * Cast pointers to unsigned type before calculation, to avoid signed ++ * overflow when the string ends where the MSB has changed. ++ */ ++ return ((uintptr_t)s - (uintptr_t)src - 1); /* count does not include NUL */ + } + + #endif /* !HAVE_STRLCPY */ +diff --git a/openbsd-compat/strnlen.c b/openbsd-compat/strnlen.c +index 7ad3573..7040f1f 100644 +--- a/openbsd-compat/strnlen.c ++++ b/openbsd-compat/strnlen.c +@@ -23,6 +23,7 @@ + #include <sys/types.h> + + #include <string.h> ++#include <stdint.h> + + size_t + strnlen(const char *str, size_t maxlen) +@@ -31,7 +32,10 @@ strnlen(const char *str, size_t maxlen) + + for (cp = str; maxlen != 0 && *cp != '\0'; cp++, maxlen--) + ; +- +- return (size_t)(cp - str); ++ /* ++ * Cast pointers to unsigned type before calculation, to avoid signed ++ * overflow when the string ends where the MSB has changed. ++ */ ++ return (size_t)((uintptr_t)cp - (uintptr_t)str); + } + #endif +-- +2.17.1 + diff --git a/recipes-connectivity/openssh/openssh/init b/recipes-connectivity/openssh/openssh/init new file mode 100644 index 0000000..8887e3a --- /dev/null +++ b/recipes-connectivity/openssh/openssh/init @@ -0,0 +1,90 @@ +#! /bin/sh +set -e + +PIDFILE=/var/run/sshd.pid + +# source function library +. /etc/init.d/functions + +# /etc/init.d/ssh: start and stop the OpenBSD "secure shell" daemon + +test -x /usr/sbin/sshd || exit 0 +( /usr/sbin/sshd -\? 2>&1 | grep -q OpenSSH ) 2>/dev/null || exit 0 + +# /etc/default/ssh may set SYSCONFDIR and SSHD_OPTS +if test -f /etc/default/ssh; then + . /etc/default/ssh +fi + +[ -z "$SYSCONFDIR" ] && SYSCONFDIR=/etc/ssh +mkdir -p $SYSCONFDIR + +check_for_no_start() { + # forget it if we're trying to start, and /etc/ssh/sshd_not_to_be_run exists + if [ -e $SYSCONFDIR/sshd_not_to_be_run ]; then + echo "OpenBSD Secure Shell server not in use ($SYSCONFDIR/sshd_not_to_be_run)" + exit 0 + fi +} + +check_privsep_dir() { + # Create the PrivSep empty dir if necessary + if [ ! -d /var/run/sshd ]; then + mkdir /var/run/sshd + chmod 0755 /var/run/sshd + fi +} + +check_config() { + /usr/sbin/sshd $SSHD_OPTS -t || exit 1 +} + +export PATH="${PATH:+$PATH:}/usr/sbin:/sbin" + +case "$1" in + start) + check_for_no_start + echo "Starting OpenBSD Secure Shell server: sshd" + @LIBEXECDIR@/sshd_check_keys + check_privsep_dir + start-stop-daemon -S -p $PIDFILE -x /usr/sbin/sshd -- $SSHD_OPTS + echo "done." + ;; + stop) + echo -n "Stopping OpenBSD Secure Shell server: sshd" + start-stop-daemon -K -p $PIDFILE -x /usr/sbin/sshd + echo "." + ;; + + reload|force-reload) + check_for_no_start + @LIBEXECDIR@/sshd_check_keys + check_config + echo -n "Reloading OpenBSD Secure Shell server's configuration" + start-stop-daemon -K -p $PIDFILE -s 1 -x /usr/sbin/sshd + echo "." + ;; + + restart) + @LIBEXECDIR@/sshd_check_keys + check_config + echo -n "Restarting OpenBSD Secure Shell server: sshd" + start-stop-daemon -K -p $PIDFILE --oknodo -x /usr/sbin/sshd + check_for_no_start + check_privsep_dir + sleep 2 + start-stop-daemon -S -p $PIDFILE -x /usr/sbin/sshd -- $SSHD_OPTS + echo "." + ;; + + status) + status /usr/sbin/sshd + exit $? + ;; + + *) + echo "Usage: /etc/init.d/ssh {start|stop|status|reload|force-reload|restart}" + exit 1 +esac + +exit 0 diff --git a/recipes-connectivity/openssh/openssh/run-ptest b/recipes-connectivity/openssh/openssh/run-ptest new file mode 100755 index 0000000..daf62cc --- /dev/null +++ b/recipes-connectivity/openssh/openssh/run-ptest @@ -0,0 +1,44 @@ +#!/bin/sh + +export TEST_SHELL=sh + +cd regress +sed -i "/\t\tagent-ptrace /d" Makefile +make -k .OBJDIR=`pwd` .CURDIR=`pwd` SUDO="sudo" tests \ + | sed -u -e 's/^skipped/SKIP: /g' -e 's/^ok /PASS: /g' -e 's/^failed/FAIL: /g' + +SSHAGENT=`which ssh-agent` +GDB=`which gdb` + +if [ -z "${SSHAGENT}" -o -z "${GDB}" ]; then + echo "SKIP: agent-ptrace" + exit +fi + +useradd openssh-test + +eval `su -c "${SSHAGENT} -s" openssh-test` > /dev/null +r=$? +if [ $r -ne 0 ]; then + echo "FAIL: could not start ssh-agent: exit code $r" +else + su -c "gdb -p ${SSH_AGENT_PID}" openssh-test > /tmp/gdb.out 2>&1 << EOF + quit +EOF + r=$? + if [ $r -ne 0 ]; then + echo "gdb failed: exit code $r" + fi + egrep 'ptrace: Operation not permitted.|procfs:.*Permission denied.|ttrace.*Permission denied.|procfs:.*: Invalid argument.|Unable to access task ' >/dev/null /tmp/gdb.out + r=$? + rm -f /tmp/gdb.out + if [ $r -ne 0 ]; then + echo "FAIL: ptrace agent" + else + echo "PASS: ptrace agent" + fi + + ${SSHAGENT} -k > /dev/null +fi +userdel openssh-test + diff --git a/recipes-connectivity/openssh/openssh/ssh_config b/recipes-connectivity/openssh/openssh/ssh_config new file mode 100644 index 0000000..e0d0238 --- /dev/null +++ b/recipes-connectivity/openssh/openssh/ssh_config @@ -0,0 +1,48 @@ +# $OpenBSD: ssh_config,v 1.33 2017/05/07 23:12:57 djm Exp $ + +# This is the ssh client system-wide configuration file. See +# ssh_config(5) for more information. This file provides defaults for +# users, and the values can be changed in per-user configuration files +# or on the command line. + +# Configuration data is parsed as follows: +# 1. command line options +# 2. user-specific file +# 3. system-wide file +# Any configuration value is only changed the first time it is set. +# Thus, host-specific definitions should be at the beginning of the +# configuration file, and defaults at the end. + +# Site-wide defaults for some commonly used options. For a comprehensive +# list of available options, their meanings and defaults, please see the +# ssh_config(5) man page. + +Host * + ForwardAgent yes + ForwardX11 yes +# RhostsRSAAuthentication no +# RSAAuthentication yes +# PasswordAuthentication yes +# HostbasedAuthentication no +# GSSAPIAuthentication no +# GSSAPIDelegateCredentials no +# BatchMode no +# CheckHostIP yes +# AddressFamily any +# ConnectTimeout 0 +# StrictHostKeyChecking ask +# IdentityFile ~/.ssh/id_rsa +# IdentityFile ~/.ssh/id_dsa +# IdentityFile ~/.ssh/id_ecdsa +# IdentityFile ~/.ssh/id_ed25519 +# Port 22 +# Protocol 2 +# Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc +# MACs hmac-md5,hmac-sha1,umac-64@openssh.com +# EscapeChar ~ +# Tunnel no +# TunnelDevice any:any +# PermitLocalCommand no +# VisualHostKey no +# ProxyCommand ssh -q -W %h:%p gateway.example.com +# RekeyLimit 1G 1h diff --git a/recipes-connectivity/openssh/openssh/sshd b/recipes-connectivity/openssh/openssh/sshd new file mode 100644 index 0000000..4882e58 --- /dev/null +++ b/recipes-connectivity/openssh/openssh/sshd @@ -0,0 +1,10 @@ +#%PAM-1.0 + +auth include common-auth +account required pam_nologin.so +account include common-account +password include common-password +session optional pam_keyinit.so force revoke +session include common-session +session required pam_loginuid.so + diff --git a/recipes-connectivity/openssh/openssh/sshd.socket b/recipes-connectivity/openssh/openssh/sshd.socket new file mode 100644 index 0000000..12c39b2 --- /dev/null +++ b/recipes-connectivity/openssh/openssh/sshd.socket @@ -0,0 +1,10 @@ +[Unit] +Conflicts=sshd.service + +[Socket] +ExecStartPre=@BASE_BINDIR@/mkdir -p /var/run/sshd +ListenStream=22 +Accept=yes + +[Install] +WantedBy=sockets.target diff --git a/recipes-connectivity/openssh/openssh/sshd@.service b/recipes-connectivity/openssh/openssh/sshd@.service new file mode 100644 index 0000000..9d83dfb --- /dev/null +++ b/recipes-connectivity/openssh/openssh/sshd@.service @@ -0,0 +1,13 @@ +[Unit] +Description=OpenSSH Per-Connection Daemon +Wants=sshdgenkeys.service +After=sshdgenkeys.service + +[Service] +Environment="SSHD_OPTS=" +EnvironmentFile=-/etc/default/ssh +ExecStart=-@SBINDIR@/sshd -i $SSHD_OPTS +ExecReload=@BASE_BINDIR@/kill -HUP $MAINPID +StandardInput=socket +StandardError=syslog +KillMode=process diff --git a/recipes-connectivity/openssh/openssh/sshd_check_keys b/recipes-connectivity/openssh/openssh/sshd_check_keys new file mode 100644 index 0000000..1931dc7 --- /dev/null +++ b/recipes-connectivity/openssh/openssh/sshd_check_keys @@ -0,0 +1,78 @@ +#! /bin/sh + +generate_key() { + local FILE=$1 + local TYPE=$2 + local DIR="$(dirname "$FILE")" + + mkdir -p "$DIR" + ssh-keygen -q -f "${FILE}.tmp" -N '' -t $TYPE + + # Atomically rename file public key + mv -f "${FILE}.tmp.pub" "${FILE}.pub" + + # This sync does double duty: Ensuring that the data in the temporary + # private key file is on disk before the rename, and ensuring that the + # public key rename is completed before the private key rename, since we + # switch on the existence of the private key to trigger key generation. + # This does mean it is possible for the public key to exist, but be garbage + # but this is OK because in that case the private key won't exist and the + # keys will be regenerated. + # + # In the event that sync understands arguments that limit what it tries to + # fsync(), we provided them. If it does not, it will simply call sync() + # which is just as well + sync "${FILE}.pub" "$DIR" "${FILE}.tmp" + + mv "${FILE}.tmp" "$FILE" + + # sync to ensure the atomic rename is committed + sync "$DIR" +} + +# /etc/default/ssh may set SYSCONFDIR and SSHD_OPTS +if test -f /etc/default/ssh; then + . /etc/default/ssh +fi + +[ -z "$SYSCONFDIR" ] && SYSCONFDIR=/etc/ssh +mkdir -p $SYSCONFDIR + +# parse sshd options +set -- ${SSHD_OPTS} -- +sshd_config=/etc/ssh/sshd_config +while true ; do + case "$1" in + -f*) if [ "$1" = "-f" ] ; then + sshd_config="$2" + shift + else + sshd_config="${1#-f}" + fi + shift + ;; + --) shift; break;; + *) shift;; + esac +done + +HOST_KEYS=$(sed -n 's/^[ \t]*HostKey[ \t]\+\(.*\)/\1/p' "${sshd_config}") +[ -z "${HOST_KEYS}" ] && HOST_KEYS="$SYSCONFDIR/ssh_host_rsa_key $SYSCONFDIR/ssh_host_ecdsa_key $SYSCONFDIR/ssh_host_ed25519_key" + +for key in ${HOST_KEYS} ; do + [ -f $key ] && continue + case $key in + *_rsa_key) + echo " generating ssh RSA host key..." + generate_key $key rsa + ;; + *_ecdsa_key) + echo " generating ssh ECDSA host key..." + generate_key $key ecdsa + ;; + *_ed25519_key) + echo " generating ssh ED25519 host key..." + generate_key $key ed25519 + ;; + esac +done diff --git a/recipes-connectivity/openssh/openssh/sshd_config b/recipes-connectivity/openssh/openssh/sshd_config new file mode 100644 index 0000000..15f061b --- /dev/null +++ b/recipes-connectivity/openssh/openssh/sshd_config @@ -0,0 +1,118 @@ +# $OpenBSD: sshd_config,v 1.102 2018/02/16 02:32:40 djm Exp $ + +# This is the sshd server system-wide configuration file. See +# sshd_config(5) for more information. + +# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin + +# The strategy used for options in the default sshd_config shipped with +# OpenSSH is to specify options with their default value where +# possible, but leave them commented. Uncommented options override the +# default value. + +#Port 22 +#AddressFamily any +#ListenAddress 0.0.0.0 +#ListenAddress :: + +#HostKey /etc/ssh/ssh_host_rsa_key +#HostKey /etc/ssh/ssh_host_ecdsa_key +#HostKey /etc/ssh/ssh_host_ed25519_key + +# Ciphers and keying +#RekeyLimit default none + +# Logging +#SyslogFacility AUTH +#LogLevel INFO + +# Authentication: + +#LoginGraceTime 2m +#PermitRootLogin prohibit-password +#StrictModes yes +#MaxAuthTries 6 +#MaxSessions 10 + +#PubkeyAuthentication yes + +# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2 +# but this is overridden so installations will only check .ssh/authorized_keys +AuthorizedKeysFile .ssh/authorized_keys + +#AuthorizedPrincipalsFile none + +#AuthorizedKeysCommand none +#AuthorizedKeysCommandUser nobody + +# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts +#HostbasedAuthentication no +# Change to yes if you don't trust ~/.ssh/known_hosts for +# HostbasedAuthentication +#IgnoreUserKnownHosts no +# Don't read the user's ~/.rhosts and ~/.shosts files +#IgnoreRhosts yes + +# To disable tunneled clear text passwords, change to no here! +#PasswordAuthentication yes +#PermitEmptyPasswords no + +# Change to yes to enable challenge-response passwords (beware issues with +# some PAM modules and threads) +ChallengeResponseAuthentication no + +# Kerberos options +#KerberosAuthentication no +#KerberosOrLocalPasswd yes +#KerberosTicketCleanup yes +#KerberosGetAFSToken no + +# GSSAPI options +#GSSAPIAuthentication no +#GSSAPICleanupCredentials yes + +# Set this to 'yes' to enable PAM authentication, account processing, +# and session processing. If this is enabled, PAM authentication will +# be allowed through the ChallengeResponseAuthentication and +# PasswordAuthentication. Depending on your PAM configuration, +# PAM authentication via ChallengeResponseAuthentication may bypass +# the setting of "PermitRootLogin without-password". +# If you just want the PAM account and session checks to run without +# PAM authentication, then enable this but set PasswordAuthentication +# and ChallengeResponseAuthentication to 'no'. +#UsePAM no + +#AllowAgentForwarding yes +#AllowTcpForwarding yes +#GatewayPorts no +#X11Forwarding no +#X11DisplayOffset 10 +#X11UseLocalhost yes +#PermitTTY yes +#PrintMotd yes +#PrintLastLog yes +#TCPKeepAlive yes +#UseLogin no +#PermitUserEnvironment no +Compression no +ClientAliveInterval 15 +ClientAliveCountMax 4 +#UseDNS no +#PidFile /var/run/sshd.pid +#MaxStartups 10:30:100 +#PermitTunnel no +#ChrootDirectory none +#VersionAddendum none + +# no default banner path +#Banner none + +# override default of no subsystems +Subsystem sftp /usr/libexec/sftp-server + +# Example of overriding settings on a per-user basis +#Match User anoncvs +# X11Forwarding no +# AllowTcpForwarding no +# PermitTTY no +# ForceCommand cvs server diff --git a/recipes-connectivity/openssh/openssh/sshdgenkeys.service b/recipes-connectivity/openssh/openssh/sshdgenkeys.service new file mode 100644 index 0000000..603c337 --- /dev/null +++ b/recipes-connectivity/openssh/openssh/sshdgenkeys.service @@ -0,0 +1,8 @@ +[Unit] +Description=OpenSSH Key Generation +RequiresMountsFor=/var /run + +[Service] +ExecStart=@LIBEXECDIR@/sshd_check_keys +Type=oneshot +RemainAfterExit=yes diff --git a/recipes-connectivity/openssh/openssh/volatiles.99_sshd b/recipes-connectivity/openssh/openssh/volatiles.99_sshd new file mode 100644 index 0000000..a0d2af3 --- /dev/null +++ b/recipes-connectivity/openssh/openssh/volatiles.99_sshd @@ -0,0 +1,2 @@ +d root root 0755 /var/run/sshd none +f root root 0644 /var/log/lastlog none |