From 7eff9df1678223e1a3427ba621f6c379386f9cce Mon Sep 17 00:00:00 2001 From: Colin Watson Date: Mon, 1 Sep 2003 18:26:52 +0000 Subject: Debian release 3.5p1-4. --- debian/changelog | 29 +++++++++++++++++++++++++++++ debian/config | 8 ++++++++ debian/control | 2 +- debian/copyright.head | 2 +- debian/init | 34 +++++++++++++++++++++------------- debian/postinst | 34 ++++++++++++++++++++-------------- debian/prerm | 12 ++++++------ debian/ssh.pam | 1 - 8 files changed, 86 insertions(+), 36 deletions(-) diff --git a/debian/changelog b/debian/changelog index 7fb8079be..b4d6b4258 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,32 @@ +openssh (1:3.5p1-4) unstable; urgency=low + + * Point rlogin and rcp alternatives at slogin and scp respectively rather + than ssh (closes: #121103, #151666). Fix alternative removal to match; + previously it was completely wrong anyway. + * Find out whether /etc/ssh/sshd_not_to_be_run exists and set the debconf + question's default using that information, rather than using debconf as + a registry. Other solutions may be better in the long run, but this is + at least correct (thanks, Matthew Woodcraft; closes: #84725). + * Stop using pam_lastlog, as it doesn't currently work well as a session + module when privilege separation is enabled; it can usually read + /var/log/lastlog but can't write to it. Instead, just use sshd's + built-in support, already enabled by default (closes: #151297, #169938). + * Use 'ssh-keygen -q' rather than redirecting output to /dev/null. + * Add a "this may take some time" warning when creating host keys on + installation (part of #110094). + * When restarting via the init script, check for sshd_not_to_be_run after + stopping sshd (idea from Tomas Pospisek; closes: #149850). + * Append /usr/sbin:/sbin to the init script's $PATH, just in case of + strangeness (closes: #115138). + * Fix a dpkg-statoverride call to redirect stdout to /dev/null, not + stderr. + * Correct copyright file typo: "orignal" -> "original" (closes: #176490). + * Rebuild with libssl0.9.7 (closes: #176983). + * We're up to policy version 3.5.6. DEB_BUILD_OPTIONS stuff still needs to + be looked at. + + -- Colin Watson Sat, 18 Jan 2003 01:37:23 +0000 + openssh (1:3.5p1-3) unstable; urgency=low * Happy new year! diff --git a/debian/config b/debian/config index b794276fa..7b4f85b43 100644 --- a/debian/config +++ b/debian/config @@ -52,6 +52,14 @@ fi db_input medium ssh/SUID_client || true +# To be correct during initial installation, this relies on the desired +# default for run_sshd being "true". +if [ -e /etc/ssh/sshd_not_to_be_run ] +then + db_set ssh/run_sshd false +else + db_set ssh/run_sshd true +fi db_input medium ssh/run_sshd || true if [ -x /usr/sbin/in.telnetd ] && grep -q "^telnet\b" /etc/inetd.conf diff --git a/debian/control b/debian/control index d10c59857..034286457 100644 --- a/debian/control +++ b/debian/control @@ -3,7 +3,7 @@ Section: net Priority: standard Maintainer: Matthew Vernon Build-Depends: libwrap0-dev | libwrap-dev, zlib1g-dev | libz-dev, libssl-dev, libpam0g-dev | libpam-dev, libgnome-dev, groff, debhelper (>=1.1.17), sharutils -Standards-Version: 3.5.2 +Standards-Version: 3.5.6 Uploaders: Colin Watson Package: ssh diff --git a/debian/copyright.head b/debian/copyright.head index 1e1282f98..5bd397447 100644 --- a/debian/copyright.head +++ b/debian/copyright.head @@ -30,7 +30,7 @@ X11-style license (see source file for details). make-ssh-known-hosts is Copyright Tero Kivinen , and is distributed under the GPL (see source file for details). -The copyright for the orignal SSH version follows. It has been +The copyright for the original SSH version follows. It has been modified with [comments] to reflect the changes that the OpenBSD folks have made: diff --git a/debian/init b/debian/init index fe59584e6..ea39a8bd0 100644 --- a/debian/init +++ b/debian/init @@ -5,25 +5,32 @@ test -x /usr/sbin/sshd || exit 0 ( /usr/sbin/sshd -\? 2>&1 | grep -q OpenSSH ) 2>/dev/null || exit 0 -# forget it if we're trying to start, and /etc/ssh/sshd_not_to_be_run exists -if [ -e /etc/ssh/sshd_not_to_be_run ]; then - echo "OpenBSD Secure Shell server not in use (/etc/ssh/sshd_not_to_be_run)" - exit 0 -fi +check_for_no_start() { + # forget it if we're trying to start, and /etc/ssh/sshd_not_to_be_run exists + if [ -e /etc/ssh/sshd_not_to_be_run ]; then + echo "OpenBSD Secure Shell server not in use (/etc/ssh/sshd_not_to_be_run)" + exit 0 + fi +} + +check_privsep_dir() { + # Create the PrivSep empty dir if necessary + if [ ! -d /var/run/sshd ]; then + mkdir /var/run/sshd + chmod 0755 /var/run/sshd + fi +} check_config() { /usr/sbin/sshd -t || exit 1 } -# Configurable options: +export PATH="${PATH:+$PATH:}/usr/sbin:/sbin" case "$1" in start) - test -f /etc/ssh/sshd_not_to_be_run && exit 0 -#Create the PrivSep empty dir if necessary - if [ ! -d /var/run/sshd ]; then - mkdir /var/run/sshd; chmod 0755 /var/run/sshd - fi + check_for_no_start + check_privsep_dir echo -n "Starting OpenBSD Secure Shell server: sshd" start-stop-daemon --start --quiet --pidfile /var/run/sshd.pid --exec /usr/sbin/sshd echo "." @@ -35,7 +42,7 @@ case "$1" in ;; reload|force-reload) - test -f /etc/ssh/sshd_not_to_be_run && exit 0 + check_for_no_start check_config echo -n "Reloading OpenBSD Secure Shell server's configuration" start-stop-daemon --stop --signal 1 --quiet --oknodo --pidfile /var/run/sshd.pid --exec /usr/sbin/sshd @@ -43,10 +50,11 @@ case "$1" in ;; restart) - test -f /etc/ssh/sshd_not_to_be_run && exit 0 check_config echo -n "Restarting OpenBSD Secure Shell server: sshd" start-stop-daemon --stop --quiet --oknodo --pidfile /var/run/sshd.pid + check_for_no_start + check_privsep_dir sleep 2 start-stop-daemon --start --quiet --pidfile /var/run/sshd.pid --exec /usr/sbin/sshd echo "." diff --git a/debian/postinst b/debian/postinst index bd9ebd3aa..4d3598a31 100644 --- a/debian/postinst +++ b/debian/postinst @@ -37,7 +37,7 @@ create_key() { if [ ! -f "$file" ] ; then echo -n $msg - ssh-keygen -f "$file" -N '' "$@" > /dev/null + ssh-keygen -q -f "$file" -N '' "$@" echo fi } @@ -50,11 +50,14 @@ create_keys() { } if [ "$RET" = "false" ] ; then - create_key "Creating SSH1 key" /etc/ssh/ssh_host_key -t rsa1 + create_key "Creating SSH1 key; this may take some time ..." \ + /etc/ssh/ssh_host_key -t rsa1 fi - create_key "Creating SSH2 RSA key" /etc/ssh/ssh_host_rsa_key -t rsa - create_key "Creating SSH2 DSA key" /etc/ssh/ssh_host_dsa_key -t dsa + create_key "Creating SSH2 RSA key; this may take some time ..." \ + /etc/ssh/ssh_host_rsa_key -t rsa + create_key "Creating SSH2 DSA key; this may take some time ..." \ + /etc/ssh/ssh_host_dsa_key -t dsa } @@ -182,7 +185,7 @@ PasswordAuthentication yes X11Forwarding no X11DisplayOffset 10 PrintMotd no -#PrintLastLog no +PrintLastLog yes KeepAlive yes #UseLogin no @@ -219,7 +222,7 @@ fix_rsh_diversion() { fix_statoverride() { # Remove an erronous override for sshd (we should have overridden ssh) if [ -x /usr/sbin/dpkg-statoverride ]; then - if dpkg-statoverride --list /usr/sbin/sshd 2>/dev/null ; then + if dpkg-statoverride --list /usr/sbin/sshd >/dev/null ; then dpkg-statoverride --remove /usr/sbin/sshd fi fi @@ -227,17 +230,20 @@ fix_statoverride() { create_alternatives() { -# Create alternatives for the various r* tools +# Create alternatives for the various r* tools. # Make sure we don't change existing alternatives that a user might have -# changed - for cmd in rsh rlogin rcp ; do - if ! update-alternatives --display $cmd | \ - grep -q ssh ; then - update-alternatives --quiet --install /usr/bin/$cmd $cmd /usr/bin/ssh 20 \ - --slave /usr/share/man/man1/$cmd.1.gz $cmd.1.gz /usr/share/man/man1/ssh.1.gz +# changed, but clean up after some old alternatives that mistakenly pointed +# rlogin and rcp to ssh. + update-alternatives --quiet --remove rlogin /usr/bin/ssh + update-alternatives --quiet --remove rcp /usr/bin/ssh + for cmd in rsh rlogin rcp; do + scmd="s${cmd#r}" + if ! update-alternatives --display "$cmd" | \ + grep -q "$scmd"; then + update-alternatives --quiet --install "/usr/bin/$cmd" "$cmd" "/usr/bin/$scmd" 20 \ + --slave "/usr/share/man/man1/$cmd.1.gz" "$cmd.1.gz" "/usr/share/man/man1/$scmd.1.gz" fi done - } setup_sshd_user() { diff --git a/debian/prerm b/debian/prerm index 17aa45e1f..8ed7e07ec 100644 --- a/debian/prerm +++ b/debian/prerm @@ -17,12 +17,12 @@ set -e case "$1" in remove|deconfigure) - update-alternatives --quiet --remove ssh /usr/bin/ssh - update-alternatives --quiet --remove ssh /usr/bin/slogin - update-alternatives --quiet --remove ssh /usr/bin/scp - if [ -e /etc/init.d/ssh ]; then - /etc/init.d/ssh stop - fi + update-alternatives --quiet --remove rsh /usr/bin/ssh + update-alternatives --quiet --remove rlogin /usr/bin/slogin + update-alternatives --quiet --remove rcp /usr/bin/scp + if [ -e /etc/init.d/ssh ]; then + /etc/init.d/ssh stop + fi # install-info --quiet --remove /usr/info/ssh-askpass.info.gz ;; upgrade) diff --git a/debian/ssh.pam b/debian/ssh.pam index a4478cf4a..f6fbd3ebc 100644 --- a/debian/ssh.pam +++ b/debian/ssh.pam @@ -6,7 +6,6 @@ auth required pam_env.so # [1] account required pam_unix.so session required pam_unix.so -session optional pam_lastlog.so # [1] session optional pam_motd.so # [1] session optional pam_mail.so standard noenv # [1] session required pam_limits.so -- cgit v1.2.3