import openssh-4.6p1-gsskex-20070312.patch

7 files changed, 81 insertions, 44 deletions

diff --git a/contrib/aix/buildbff.sh b/contrib/aix/buildbff.sh
index 09b9c118c..97a7cbbba 100755
--- a/contrib/aix/buildbff.sh
+++ b/contrib/aix/buildbff.sh
@@ -1,7 +1,7 @@
 #!/bin/sh
 #
 # buildbff.sh: Create AIX SMIT-installable OpenSSH packages
-# $Id: buildbff.sh,v 1.8 2005/03/29 13:24:12 dtucker Exp $
+# $Id: buildbff.sh,v 1.10 2006/09/10 03:24:19 dtucker Exp $
 #
 # Author: Darren Tucker (dtucker at zip dot com dot au)
 # This file is placed in the public domain and comes with absolutely
@@ -23,6 +23,8 @@ umask 022
 
 startdir=`pwd`
 
+perl -v >/dev/null || (echo perl required; exit 1)
+
 # Path to inventory.sh: same place as buildbff.sh
 if  echo $0 | egrep '^/'
 then
@@ -200,33 +202,29 @@ do
 done
 echo
 
-# Create PrivSep user if PrivSep not disabled in config
-echo Creating PrivSep prereqs if required.
-if egrep '^[ \t]*UsePrivilegeSeparation[ \t]+no' $sysconfdir/sshd_config >/dev/null
+# Create PrivilegeSeparation user and group if not present
+echo Checking for PrivilegeSeparation user and group.
+if cut -f1 -d: /etc/group | egrep '^'$SSH_PRIVSEP_USER'\$' >/dev/null
 then
-        echo "UsePrivilegeSeparation disabled in config, not creating PrivSep user,"
-        echo "group or chroot directory."
+        echo "PrivSep group $SSH_PRIVSEP_USER already exists."
 else
-        echo "UsePrivilegeSeparation enabled in config (or defaulting to on)."
-
-        # create group if required
-        if cut -f1 -d: /etc/group | egrep '^'$SSH_PRIVSEP_USER'\$' >/dev/null
-        then
-                echo "PrivSep group $SSH_PRIVSEP_USER already exists."
-        else
-                echo "Creating PrivSep group $SSH_PRIVSEP_USER."
-                mkgroup -A $SSH_PRIVSEP_USER
-        fi
+        echo "Creating PrivSep group $SSH_PRIVSEP_USER."
+        mkgroup -A $SSH_PRIVSEP_USER
+fi
 
-        # Create user if required
-        if lsuser "$SSH_PRIVSEP_USER" >/dev/null
-        then
-                echo "PrivSep user $SSH_PRIVSEP_USER already exists."
-        else
-                echo "Creating PrivSep user $SSH_PRIVSEP_USER."
-                mkuser gecos='SSHD PrivSep User' login=false rlogin=false account_locked=true pgrp=$SSH_PRIVSEP_USER $SSH_PRIVSEP_USER
-        fi
+# Create user if required
+if lsuser "$SSH_PRIVSEP_USER" >/dev/null
+then
+        echo "PrivSep user $SSH_PRIVSEP_USER already exists."
+else
+        echo "Creating PrivSep user $SSH_PRIVSEP_USER."
+        mkuser gecos='SSHD PrivSep User' login=false rlogin=false account_locked=true pgrp=$SSH_PRIVSEP_USER $SSH_PRIVSEP_USER
+fi
 
+if egrep '^[ \t]*UsePrivilegeSeparation[ \t]+no' $sysconfdir/sshd_config >/dev/null
+then
+        echo UsePrivilegeSeparation not enabled, privsep directory not required.
+else
         # create chroot directory if required
         if [ -d $PRIVSEP_PATH ]
         then
diff --git a/contrib/caldera/openssh.spec b/contrib/caldera/openssh.spec
index 09c08f194..3d756eb7f 100644
--- a/contrib/caldera/openssh.spec
+++ b/contrib/caldera/openssh.spec
@@ -17,7 +17,7 @@
 #old cvs stuff.  please update before use.  may be deprecated.
 %define use_stable      1
 %if %{use_stable}
-  %define version       4.3p2
+  %define version       4.6p1
   %define cvs           %{nil}
   %define release       1
 %else
@@ -357,4 +357,4 @@ fi
 * Mon Jan 01 1998 ...
 Template Version: 1.31
 
-$Id: openssh.spec,v 1.56.2.1 2006/02/11 00:00:45 djm Exp $
+$Id: openssh.spec,v 1.60 2007/03/06 10:23:27 djm Exp $
diff --git a/contrib/cygwin/ssh-host-config b/contrib/cygwin/ssh-host-config
index 0540890e6..e2ad69f19 100644
--- a/contrib/cygwin/ssh-host-config
+++ b/contrib/cygwin/ssh-host-config
@@ -153,22 +153,31 @@ fi
 
 # Create /var/log and /var/log/lastlog if not already existing
 
-if [ -f ${LOCALSTATEDIR}/log ]
+if [ -e ${LOCALSTATEDIR}/log -a ! -d ${LOCALSTATEDIR}/log ]
 then
-  echo "Creating ${LOCALSTATEDIR}/log failed!"
-else
-  if [ ! -d ${LOCALSTATEDIR}/log ]
-  then
-    mkdir -p ${LOCALSTATEDIR}/log
-  fi
-  if [ -d ${LOCALSTATEDIR}/log/lastlog ]
-  then
-    chmod 777 ${LOCALSTATEDIR}/log/lastlog
-  elif [ ! -f ${LOCALSTATEDIR}/log/lastlog ]
-  then
-    cat /dev/null > ${LOCALSTATEDIR}/log/lastlog
-    chmod 666 ${LOCALSTATEDIR}/log/lastlog
-  fi
+  echo
+  echo "${LOCALSTATEDIR}/log is existant but not a directory."
+  echo "Cannot create ssh host configuration."
+  echo
+  exit 1
+fi
+if [ ! -e ${LOCALSTATEDIR}/log ]
+then
+  mkdir -p ${LOCALSTATEDIR}/log
+fi
+
+if [ -e ${LOCALSTATEDIR}/log/lastlog -a ! -f ${LOCALSTATEDIR}/log/lastlog ]
+then
+  echo 
+  echo "${LOCALSTATEDIR}/log/lastlog exists, but is not a file."
+  echo "Cannot create ssh host configuration."
+  echo 
+  exit 1
+fi
+if [ ! -e ${LOCALSTATEDIR}/log/lastlog ]
+then
+  cat /dev/null > ${LOCALSTATEDIR}/log/lastlog
+  chmod 644 ${LOCALSTATEDIR}/log/lastlog
 fi
 
 # Create /var/empty file used as chroot jail for privilege separation
@@ -507,6 +516,7 @@ then
             fi
             editrights -a SeAssignPrimaryTokenPrivilege -u sshd_server &&
             editrights -a SeCreateTokenPrivilege -u sshd_server &&
+            editrights -a SeTcbPrivilege -u sshd_server &&
             editrights -a SeDenyInteractiveLogonRight -u sshd_server &&
             editrights -a SeDenyNetworkLogonRight -u sshd_server &&
             editrights -a SeDenyRemoteInteractiveLogonRight -u sshd_server &&
@@ -578,6 +588,7 @@ then
       fi
       chown "${_user}" ${SYSCONFDIR}/ssh*
       chown "${_user}".544 ${LOCALSTATEDIR}/empty
+      chown "${_user}".544 ${LOCALSTATEDIR}/log/lastlog
       if [ -f ${LOCALSTATEDIR}/log/sshd.log ]
       then
         chown "${_user}".544 ${LOCALSTATEDIR}/log/sshd.log
diff --git a/contrib/findssl.sh b/contrib/findssl.sh
index 716abced5..263fd2644 100644
--- a/contrib/findssl.sh
+++ b/contrib/findssl.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# $Id: findssl.sh,v 1.3 2004/12/13 07:08:33 dtucker Exp $
+# $Id: findssl.sh,v 1.4 2007/02/19 11:44:25 dtucker Exp $
 #
 # findssl.sh
 #       Search for all instances of OpenSSL headers and libraries
@@ -89,6 +89,25 @@ LD_LIBRARY_PATH=${LD_LIBRARY_PATH:=$DEFAULT_LIBPATH}
 LIBRARY_PATH=${LIBRARY_PATH:=$DEFAULT_LIBPATH}
 export LIBPATH LD_LIBRARY_PATH LIBRARY_PATH
 
+# not all platforms have a 'which' command
+if which ls >/dev/null 2>/dev/null; then
+    : which is defined
+else
+    which () {
+        saveIFS="$IFS"
+        IFS=:
+        for p in $PATH; do
+            if test -x "$p/$1" -a -f "$p/$1"; then
+                IFS="$saveIFS"
+                echo "$p/$1"
+                return 0
+            fi
+        done
+        IFS="$saveIFS"
+        return 1
+    }
+fi
+
 #
 # Search for OpenSSL headers and print versions
 #
diff --git a/contrib/redhat/openssh.spec b/contrib/redhat/openssh.spec
index cbdf7bbc7..08515d2b0 100644
--- a/contrib/redhat/openssh.spec
+++ b/contrib/redhat/openssh.spec
@@ -1,4 +1,4 @@
-%define ver 4.3p2
+%define ver 4.6p1
 %define rel 1
 
 # OpenSSH privilege separation requires a user & group ID
diff --git a/contrib/redhat/sshd.init b/contrib/redhat/sshd.init
index 4ee8630c3..e5d837cbc 100755
--- a/contrib/redhat/sshd.init
+++ b/contrib/redhat/sshd.init
@@ -35,6 +35,9 @@ do_rsa1_keygen() {
                 if $KEYGEN -q -t rsa1 -f $RSA1_KEY -C '' -N '' >&/dev/null; then
                         chmod 600 $RSA1_KEY
                         chmod 644 $RSA1_KEY.pub
+                        if [ -x /sbin/restorecon ]; then
+                            /sbin/restorecon $RSA1_KEY.pub
+                        fi
                         success $"RSA1 key generation"
                         echo
                 else
@@ -51,6 +54,9 @@ do_rsa_keygen() {
                 if $KEYGEN -q -t rsa -f $RSA_KEY -C '' -N '' >&/dev/null; then
                         chmod 600 $RSA_KEY
                         chmod 644 $RSA_KEY.pub
+                        if [ -x /sbin/restorecon ]; then
+                            /sbin/restorecon $RSA_KEY.pub
+                        fi
                         success $"RSA key generation"
                         echo
                 else
@@ -67,6 +73,9 @@ do_dsa_keygen() {
                 if $KEYGEN -q -t dsa -f $DSA_KEY -C '' -N '' >&/dev/null; then
                         chmod 600 $DSA_KEY
                         chmod 644 $DSA_KEY.pub
+                        if [ -x /sbin/restorecon ]; then
+                            /sbin/restorecon $DSA_KEY.pub
+                        fi
                         success $"DSA key generation"
                         echo
                 else
diff --git a/contrib/suse/openssh.spec b/contrib/suse/openssh.spec
index b49e78c65..95b394f18 100644
--- a/contrib/suse/openssh.spec
+++ b/contrib/suse/openssh.spec
@@ -13,7 +13,7 @@
 
 Summary:        OpenSSH, a free Secure Shell (SSH) protocol implementation
 Name:           openssh
-Version:        4.3p2
+Version:        4.6p1
 URL:            http://www.openssh.com/
 Release:        1
 Source0:        openssh-%{version}.tar.gz