Implement New World Order for PAM configuration, including

/etc/pam.d/common-* from /etc/pam.d/ssh (closes: #212959).
Add more commentary to /etc/pam.d/ssh.

5 files changed, 70 insertions, 16 deletions

diff --git a/debian/README.Debian b/debian/README.Debian
index ca928f9f0..bb1f7cf48 100644
--- a/debian/README.Debian
+++ b/debian/README.Debian
@@ -16,6 +16,15 @@ Debian don't ship it.
 
 =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
 
+BUILD ISSUES
+============
+
+To build the openssh package for woody, set DEB_BUILD_SSH_WOODY=1 in
+your environment. This is necessary due to non-backward-compatible
+changes in PAM support.
+
+=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
+
 UPGRADE ISSUES
 ==============
 
@@ -87,7 +96,10 @@ Protocol 2,1
 Also add the line:
 HostKey /etc/ssh/ssh_host_key
 
-(you may need to generate a host key if you do not already have one)
+If you do not already have an RSA1 host key in /etc/ssh/ssh_host_key,
+you will need to generate one. To do so, run this command as root:
+
+  ssh-keygen -f /etc/ssh/ssh_host_key -N '' -t rsa1
 
 X11 Forwarding
 --------------
diff --git a/debian/changelog b/debian/changelog
index 70523aeb9..05fc0c9c0 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -10,6 +10,11 @@ openssh (1:3.6.1p2-10) UNRELEASED; urgency=low
     closes: #215372).
   * Update config.guess and config.sub from autotools-dev 20031007.1
     (closes: #217696).
+  * Implement New World Order for PAM configuration, including
+    /etc/pam.d/common-* from /etc/pam.d/ssh (closes: #212959).
+    - To backport this release to woody, you need to set DEB_BUILD_SSH_WOODY
+      in your environment. See README.Debian.
+  * Add more commentary to /etc/pam.d/ssh.
 
  -- Colin Watson <cjwatson@debian.org>  Sat, 15 Nov 2003 14:07:29 +0000
 
diff --git a/debian/control b/debian/control
index 046f157e4..d7dc3a533 100644
--- a/debian/control
+++ b/debian/control
@@ -8,7 +8,7 @@ Uploaders: Colin Watson <cjwatson@debian.org>
 
 Package: ssh
 Architecture: any
-Depends: ${shlibs:Depends}, ${debconf-depends}, libpam-modules (>= 0.72-9), adduser (>= 3.9)
+Depends: ${shlibs:Depends}, ${debconf-depends}, ${pam-depends}, libpam-modules (>= 0.72-9), adduser (>= 3.9)
 Conflicts: ssh-nonfree (<<2), ssh-socks, ssh2, sftp, rsh-client (<<0.16.1-1)
 Suggests: ssh-askpass, xbase-clients, dpkg (>=1.8.3.1), dnsutils
 Provides: rsh-client
diff --git a/debian/rules b/debian/rules
index ec594ecb0..0bb40da4e 100755
--- a/debian/rules
+++ b/debian/rules
@@ -25,6 +25,20 @@ PO2DEBCONF := yes
 MINDEBCONFVER := 1.2.0
 endif
 
+# We need a new libpam-runtime for sane PAM handling
+# (http://lists.debian.org/debian-devel-announce-0308/msg00012.html).
+# Unfortunately it's hard to detect during the build whether this is
+# appropriate, so woody-compatibility is a pain. I've had to punt and go for
+# a DEB_BUILD_SSH_WOODY environment variable. We can remove this hack once
+# we no longer care about woody.
+ifeq ($(DEB_BUILD_SSH_WOODY),)
+PAMSUBST := no
+PAMDEP := libpam-runtime (>= 0.76-14)
+else
+PAMSUBST := yes
+PAMDEP := libpam-runtime
+endif
+
 # Change the version string to include the Debian version
 SSH_VERSION := $(shell sed -e '/define/!d; s/.*\"\(.*\)\".*/\1/; q' <version.h) Debian $(shell dpkg-parsechangelog | sed -n -e '/^Version:/s/Version: //p')
 
@@ -61,6 +75,11 @@ ifeq ($(PO2DEBCONF),yes)
         po2debconf debian/templates.master > debian/templates
         rm -f debian/po/output
 endif
+ifeq ($(PAMSUBST),yes)
+        if [ -f debian/ssh.pam.new-style ]; then \
+                mv debian/ssh.pam.new-style debian/ssh.pam; \
+        fi
+endif
         dh_clean
 
 install: DH_OPTIONS=
@@ -113,6 +132,15 @@ endif
         nroff RFC.nroff > debian/tmp/usr/share/doc/ssh/RFC
         gzip -9 debian/tmp/usr/share/doc/ssh/RFC
         rm -rf debian/tmp/usr/share/doc/ssh/RFC.nroff.gz
+ifeq ($(PAMSUBST),yes)
+        cp -a debian/ssh.pam debian/ssh.pam.new-style
+        trailer='required     pam_unix.so' \
+        sed -e "s/@include common-auth/auth       $$trailer" \
+            -e "s/@include common-account/account    $$trailer" \
+            -e "s/@include common-session/session    $$trailer" \
+            -e "s/@include common-password/password   $$trailer" \
+            debian/ssh.pam.new-style > debian/ssh.pam
+endif
         dh_installpam
         dh_installchangelogs ChangeLog
         dh_strip
@@ -122,7 +150,8 @@ endif
         test ! -e debian/tmp/etc/ssh/ssh_prng_cmds \
           || echo "/etc/ssh/ssh_prng_cmds" >> debian/tmp/DEBIAN/conffiles
         dh_shlibdeps
-        dh_gencontrol -- -V'debconf-depends=debconf (>= $(MINDEBCONFVER))'
+        dh_gencontrol -- -V'debconf-depends=debconf (>= $(MINDEBCONFVER))' \
+                         -V'pam-depends=$(PAMDEP)'
         dh_md5sums
         dh_builddeb
 
diff --git a/debian/ssh.pam b/debian/ssh.pam
index f6fbd3ebc..8882053df 100644
--- a/debian/ssh.pam
+++ b/debian/ssh.pam
@@ -1,21 +1,29 @@
-#%PAM-1.0
+# PAM configuration for the Secure Shell service
+
+# Disallow non-root logins when /etc/nologin exists.
 auth       required     pam_nologin.so
-auth       required     pam_unix.so
+
+# Read environment variables from /etc/environment and
+# /etc/security/pam_env.conf.
 auth       required     pam_env.so # [1]
 
-account    required     pam_unix.so
+# Standard Un*x authentication.
+@include common-auth
+
+# Standard Un*x authorization.
+@include common-account
+
+# Standard Un*x session setup and teardown.
+@include common-session
 
-session    required     pam_unix.so
+# Print the message of the day upon successful login.
 session    optional     pam_motd.so # [1]
+
+# Print the status of the user's mailbox upon successful login.
 session    optional     pam_mail.so standard noenv # [1]
-session    required     pam_limits.so
 
-password   required     pam_unix.so
+# Set up user limits from /etc/security/limits.conf.
+session    required     pam_limits.so
 
-# Alternate strength checking for password. Note that this
-# requires the libpam-cracklib package to be installed.
-# You will need to comment out the password line above and
-# uncomment the next two in order to use this.
-#
-# password required       pam_cracklib.so retry=3 minlen=6 difok=3
-# password required       pam_unix.so use_authtok nullok md5
+# Standard Un*x password updating.
+@include common-password