# Do we want SELinux & Audit

%define WITH_SELINUX 1

# OpenSSH privilege separation requires a user & group ID

%define sshd_uid    74

%define sshd_gid    74

# Do we want to disable building of gnome-askpass? (1=yes 0=no)

%define no_gnome_askpass 0

# Do we want to link against a static libcrypto? (1=yes 0=no)

%define static_libcrypto 0

# Do we want smartcard support (1=yes 0=no)

#Smartcard support is broken from 5.4p1

%define scard 0

# Use GTK2 instead of GNOME in gnome-ssh-askpass

%define gtk2 1

# Build position-independent executables (requires toolchain support)?

%define pie 1

# Do we want kerberos5 support (1=yes 0=no)

%define kerberos5 1

# Do we want libedit support

%define libedit 1

# Do we want LDAP support

%define ldap 1

# Do we want NSS tokens support

# NSS support is broken from 5.4p1

%define nss 0

# Whether or not /sbin/nologin exists.

%define nologin 1

# Whether to build pam_ssh_agent_auth

%define pam_ssh_agent 1

# Reserve options to override askpass settings with:

# rpm -ba|--rebuild --define 'skip_xxx 1'

%{?skip_gnome_askpass:%global no_gnome_askpass 1}

# Add option to build without GTK2 for older platforms with only GTK+.

# Red Hat Linux <= 7.2 and Red Hat Advanced Server 2.1 are examples.

# rpm -ba|--rebuild --define 'no_gtk2 1'

%{?no_gtk2:%global gtk2 0}

# Options for static OpenSSL link:

# rpm -ba|--rebuild --define "static_openssl 1"

%{?static_openssl:%global static_libcrypto 1}

# Options for Smartcard support: (needs libsectok and openssl-engine)

# rpm -ba|--rebuild --define "smartcard 1"

%{?smartcard:%global scard 1}

# Is this a build for the rescue CD (without PAM, with MD5)? (1=yes 0=no)

%define rescue 0

%{?build_rescue:%global rescue 1}

%{?build_rescue:%global rescue_rel rescue}

# Turn off some stuff for resuce builds

%if %{rescue}

%define kerberos5 0

%define libedit 0

%define pam_ssh_agent 0

%endif

# Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1

%define openssh_ver 5.8p1

%define openssh_rel 28

%define pam_ssh_agent_ver 0.9.2

%define pam_ssh_agent_rel 30

Summary: An open source implementation of SSH protocol versions 1 and 2

Name: openssh

Version: %{openssh_ver}

Release: %{openssh_rel}%{?dist}%{?rescue_rel}.1

URL: http://www.openssh.com/portable.html

#URL1: http://pamsshagentauth.sourceforge.net

#Source0: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz

#Source1: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz.asc

# This package differs from the upstream OpenSSH tarball in that

# the ACSS cipher is removed by running openssh-nukeacss.sh in

# the unpacked source directory.

Source0: openssh-%{version}-noacss.tar.bz2

Source1: openssh-nukeacss.sh

Source2: sshd.pam

Source3: sshd.init

Source4: http://prdownloads.sourceforge.net/pamsshagentauth/pam_ssh_agent_auth/pam_ssh_agent_auth-%{pam_ssh_agent_ver}.tar.bz2

Source5: pam_ssh_agent-rmheaders

Source6: ssh-keycat.pam

Source7: sshd.sysconfig

Patch99: openssh-5.8p1-wIm.patch

#https://bugzilla.mindrot.org/show_bug.cgi?id=1635 (WONTFIX)

Patch0: openssh-5.6p1-redhat.patch

#https://bugzilla.mindrot.org/show_bug.cgi?id=1872

Patch100: openssh-5.8p1-fingerprint.patch

#https://bugzilla.mindrot.org/show_bug.cgi?id=1879

Patch200: openssh-5.8p1-exit.patch

#https://bugzilla.mindrot.org/show_bug.cgi?id=1402

Patch8: openssh-5.8p1-audit0.patch

Patch1: openssh-5.8p1-audit1.patch

Patch2: openssh-5.8p1-audit2.patch

Patch3: openssh-5.8p1-audit3.patch

Patch4: openssh-5.8p1-audit4.patch

Patch5: openssh-5.8p1-audit5.patch

#https://bugzilla.mindrot.org/show_bug.cgi?id=1889

Patch6: openssh-5.8p1-packet.patch

#https://bugzilla.mindrot.org/show_bug.cgi?id=1890

Patch7: openssh-5.8p1-entropy.patch

#https://bugzilla.mindrot.org/show_bug.cgi?id=1640 (WONTFIX)

Patch9: openssh-5.8p1-vendor.patch

# --- pam_ssh-agent ---

Patch10: pam_ssh_agent_auth-0.9-build.patch

Patch11: pam_ssh_agent_auth-0.9.2-seteuid.patch

#https://bugzilla.mindrot.org/show_bug.cgi?id=1663

Patch20: openssh-5.8p1-authorized-keys-command.patch

#?-- unwanted child :(

Patch21: openssh-5.8p1-ldap.patch

#-mail-conf

Patch22: openssh-5.8p1-selinux.patch

#https://bugzilla.mindrot.org/show_bug.cgi?id=1641 (WONTFIX)

Patch23: openssh-5.8p1-selinux-role.patch

#?

Patch24: openssh-5.8p1-mls.patch

# #https://bugzilla.mindrot.org/show_bug.cgi?id=1614

# Patch25: openssh-5.6p1-selabel.patch

#was https://bugzilla.mindrot.org/show_bug.cgi?id=1637

#?

Patch26: openssh-5.8p1-sftpcontext.patch

#https://bugzilla.mindrot.org/show_bug.cgi?id=1668

Patch30: openssh-5.6p1-keygen.patch

#https://bugzilla.mindrot.org/show_bug.cgi?id=1644

Patch31: openssh-5.2p1-allow-ip-opts.patch

#https://bugzilla.mindrot.org/show_bug.cgi?id=1701

Patch32: openssh-5.8p1-randclean.patch

# #https://bugzilla.mindrot.org/show_bug.cgi?id=1636

# Patch33: openssh-5.1p1-log-in-chroot.patch

#https://bugzilla.mindrot.org/show_bug.cgi?id=1780

Patch34: openssh-5.8p1-kuserok.patch

#http://cvsweb.netbsd.org/cgi-bin/cvsweb.cgi/src/crypto/dist/ssh/Attic/sftp-glob.c.diff?r1=1.13&r2=1.13.12.1&f=h

Patch35: openssh-5.8p1-glob.patch

#https://bugzilla.mindrot.org/show_bug.cgi?id=1891

Patch36: openssh-5.8p1-pwchange.patch

#https://bugzilla.mindrot.org/show_bug.cgi?id=1893

Patch37: openssh-5.8p1-keyperm.patch

#?

Patch50: openssh-5.8p1-fips.patch

#https://bugzilla.mindrot.org/show_bug.cgi?id=1789

Patch51: openssh-5.5p1-x11.patch

#?

Patch52: openssh-5.6p1-exit-deadlock.patch

#?

Patch53: openssh-5.1p1-askpass-progress.patch

#?

Patch54: openssh-4.3p2-askpass-grab-info.patch

#?

Patch56: openssh-5.2p1-edns.patch

#?

Patch57: openssh-5.1p1-scp-manpage.patch

#?

Patch58: openssh-5.8p1-keycat.patch

#http://www.sxw.org.uk/computing/patches/openssh.html

Patch60: openssh-5.8p1-gsskex.patch

#?

Patch61: openssh-5.8p1-gssapi-canohost.patch

#?

Patch62: openssh-5.8p1-localdomain.patch

#---

#https://bugzilla.mindrot.org/show_bug.cgi?id=1604

# sctp

#https://bugzilla.mindrot.org/show_bug.cgi?id=1873 => https://bugzilla.redhat.com/show_bug.cgi?id=668993

License: BSD

Group: Applications/Internet

BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)

%if %{nologin}

Requires: /sbin/nologin

%endif

Requires: initscripts >= 5.20

%if ! %{no_gnome_askpass}

%if %{gtk2}

BuildRequires: gtk2-devel

BuildRequires: libX11-devel

%else

BuildRequires: gnome-libs-devel

%endif

%endif

%if %{scard}

BuildRequires: sharutils

%endif

%if %{ldap}

BuildRequires: openldap-devel

%endif

BuildRequires: autoconf, automake, perl, zlib-devel

BuildRequires: audit-libs-devel >= 2.0.5

BuildRequires: util-linux, groff

BuildRequires: pam-devel

BuildRequires: tcp_wrappers-devel

BuildRequires: fipscheck-devel >= 1.3.0

BuildRequires: openssl-devel >= 0.9.8j

%if %{kerberos5}

BuildRequires: krb5-devel

%endif

%if %{libedit}

BuildRequires: libedit-devel ncurses-devel

%endif

%if %{nss}

BuildRequires: nss-devel

%endif

%if %{WITH_SELINUX}

Requires: libselinux >= 1.27.7

BuildRequires: libselinux-devel >= 1.27.7

Requires: audit-libs >= 1.0.8

BuildRequires: audit-libs >= 1.0.8

%endif

BuildRequires: xauth

%package clients

Summary: An open source SSH client applications

Group: Applications/Internet

Requires: openssh = %{version}-%{release}

Requires: fipscheck-lib%{_isa} >= 1.3.0

%package server

Summary: An open source SSH server daemon

Group: System Environment/Daemons

Requires: openssh = %{version}-%{release}

Requires(post): chkconfig >= 0.9, /sbin/service

Requires(pre): /usr/sbin/useradd

Requires: pam >= 1.0.1-3

Requires: fipscheck-lib%{_isa} >= 1.3.0

%if %{ldap}

%package ldap

Summary: A LDAP support for open source SSH server daemon

Requires: openssh = %{version}-%{release}

Group: System Environment/Daemons

%endif

%package keycat

Summary: A mls keycat backend for openssh

Requires: openssh = %{version}-%{release}

Group: System Environment/Daemons

%package askpass

Summary: A passphrase dialog for OpenSSH and X

Group: Applications/Internet

Requires: openssh = %{version}-%{release}

Obsoletes: openssh-askpass-gnome

Provides: openssh-askpass-gnome

%package -n pam_ssh_agent_auth

Summary: PAM module for authentication with ssh-agent

Group: System Environment/Base

Version: %{pam_ssh_agent_ver}

Release: %{pam_ssh_agent_rel}.%{openssh_rel}%{?dist}%{?rescue_rel}

License: BSD

%description

SSH (Secure SHell) is a program for logging into and executing

commands on a remote machine. SSH is intended to replace rlogin and

rsh, and to provide secure encrypted communications between two

untrusted hosts over an insecure network. X11 connections and

arbitrary TCP/IP ports can also be forwarded over the secure channel.

OpenSSH is OpenBSD's version of the last free version of SSH, bringing

it up to date in terms of security and features.

This package includes the core files necessary for both the OpenSSH

client and server. To make this package useful, you should also

install openssh-clients, openssh-server, or both.

%description clients

OpenSSH is a free version of SSH (Secure SHell), a program for logging

into and executing commands on a remote machine. This package includes

the clients necessary to make encrypted connections to SSH servers.

%description server

OpenSSH is a free version of SSH (Secure SHell), a program for logging

into and executing commands on a remote machine. This package contains

the secure shell daemon (sshd). The sshd daemon allows SSH clients to

securely connect to your SSH server.

%if %{ldap}

%description ldap

OpenSSH LDAP backend is a way how to distribute the authorized tokens

among the servers in the network.

%endif

%description keycat

OpenSSH mls keycat is backend for using the authorized keys in the

openssh in the mls mode.

%description askpass

OpenSSH is a free version of SSH (Secure SHell), a program for logging

into and executing commands on a remote machine. This package contains

an X11 passphrase dialog for OpenSSH.

%description -n pam_ssh_agent_auth

This package contains a PAM module which can be used to authenticate

users using ssh keys stored in a ssh-agent. Through the use of the

forwarding of ssh-agent connection it also allows to authenticate with

remote ssh-agent instance.

The module is most useful for su and sudo service stacks.

%prep

%setup -q -a 4

#Do not enable by default

###%patch99 -p1 -b .wIm

%patch0 -p1 -b .redhat

%patch100 -p1 -b .fingerprint

%patch200 -p1 -b .exit

%patch8 -p1 -b .audit0

%patch1 -p1 -b .audit1

%patch2 -p1 -b .audit2

%patch3 -p1 -b .audit3

%patch4 -p1 -b .audit4

%patch5 -p1 -b .audit5

%patch6 -p1 -b .packet

%patch7 -p1 -b .entropy

%patch9 -p1 -b .vendor

%if %{pam_ssh_agent}

pushd pam_ssh_agent_auth-%{pam_ssh_agent_ver}

%patch10 -p1 -b .psaa-build

%patch11 -p1 -b .psaa-seteuid

# Remove duplicate headers

rm -f $(cat %{SOURCE5})

popd

%endif

%patch20 -p1 -b .akc

%if %{ldap}

%patch21 -p1 -b .ldap

%endif

%if %{WITH_SELINUX}

#SELinux

%patch22 -p1 -b .selinux

%patch23 -p1 -b .role

%patch24 -p1 -b .mls

%patch26 -p1 -b .sftpcontext

%endif

%patch30 -p1 -b .keygen

%patch31 -p1 -b .ip-opts

%patch32 -p1 -b .randclean

%patch34 -p1 -b .kuserok

%patch35 -p1 -b .glob

%patch36 -p1 -b .pwchange

%patch37 -p1 -b .keyperm

%patch50 -p1 -b .fips

%patch51 -p1 -b .x11

%patch52 -p1 -b .exit-deadlock

%patch53 -p1 -b .progress

%patch54 -p1 -b .grab-info

%patch56 -p1 -b .edns

%patch57 -p1 -b .manpage

%patch58 -p1 -b .keycat

%patch60 -p1 -b .gsskex

%patch61 -p1 -b .canohost

%patch62 -p1 -b .localdomain

autoreconf

pushd pam_ssh_agent_auth-%{pam_ssh_agent_ver}

autoreconf

popd

%build

CFLAGS="$RPM_OPT_FLAGS"; export CFLAGS

%if %{rescue}

CFLAGS="$CFLAGS -Os"

%endif

%if %{pie}

%ifarch s390 s390x sparc sparcv9 sparc64

CFLAGS="$CFLAGS -fPIC"

%else

CFLAGS="$CFLAGS -fpic"

%endif

SAVE_LDFLAGS="$LDFLAGS"

LDFLAGS="$LDFLAGS -pie -z relro -z now"

export CFLAGS

export LDFLAGS

%endif

%if %{kerberos5}

if test -r /etc/profile.d/krb5-devel.sh ; then

        source /etc/profile.d/krb5-devel.sh

fi

krb5_prefix=`krb5-config --prefix`

if test "$krb5_prefix" != "%{_prefix}" ; then

	CPPFLAGS="$CPPFLAGS -I${krb5_prefix}/include -I${krb5_prefix}/include/gssapi"; export CPPFLAGS

	CFLAGS="$CFLAGS -I${krb5_prefix}/include -I${krb5_prefix}/include/gssapi"

	LDFLAGS="$LDFLAGS -L${krb5_prefix}/%{_lib}"; export LDFLAGS

else

	krb5_prefix=

	CPPFLAGS="-I%{_includedir}/gssapi"; export CPPFLAGS

	CFLAGS="$CFLAGS -I%{_includedir}/gssapi"

fi

%endif

%configure \

	--sysconfdir=%{_sysconfdir}/ssh \

	--libexecdir=%{_libexecdir}/openssh \

	--datadir=%{_datadir}/openssh \

	--with-tcp-wrappers \

	--with-default-path=/usr/local/bin:/bin:/usr/bin \

	--with-superuser-path=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin \

	--with-privsep-path=%{_var}/empty/sshd \

	--enable-vendor-patchlevel="FC-%{version}-%{release}" \

	--disable-strip \

	--without-zlib-version-check \

	--with-ssl-engine \

	--with-authorized-keys-command \

%if %{nss}

	--with-nss \

%endif

%if %{scard}

	--with-smartcard \

%endif

%if %{ldap}

	--with-ldap \

%endif

%if %{rescue}

	--without-pam \

%else

	--with-pam \

%endif

%if %{WITH_SELINUX}

	--with-selinux --with-audit=linux \

%endif

%if %{kerberos5}

	--with-kerberos5${krb5_prefix:+=${krb5_prefix}} \

%else

	--without-kerberos5 \

%endif

%if %{libedit}

	--with-libedit

%else

	--without-libedit

%endif

%if %{static_libcrypto}

perl -pi -e "s|-lcrypto|%{_libdir}/libcrypto.a|g" Makefile

%endif

make

# Define a variable to toggle gnome1/gtk2 building.  This is necessary

# because RPM doesn't handle nested %if statements.

%if %{gtk2}

	gtk2=yes

%else

	gtk2=no

%endif

%if ! %{no_gnome_askpass}

pushd contrib

if [ $gtk2 = yes ] ; then

	make gnome-ssh-askpass2

	mv gnome-ssh-askpass2 gnome-ssh-askpass

else

	make gnome-ssh-askpass1

	mv gnome-ssh-askpass1 gnome-ssh-askpass

fi

popd

%endif

%if %{pam_ssh_agent}

pushd pam_ssh_agent_auth-%{pam_ssh_agent_ver}

LDFLAGS="$SAVE_LDFLAGS"

%configure --with-selinux --libexecdir=/%{_lib}/security --with-mantype=man

make

popd

%endif

# Add generation of HMAC checksums of the final stripped binaries

%define __spec_install_post \

    %{?__debug_package:%{__debug_install_post}} \

    %{__arch_install_post} \

    %{__os_install_post} \

    fipshmac -d $RPM_BUILD_ROOT%{_libdir}/fipscheck $RPM_BUILD_ROOT%{_bindir}/ssh $RPM_BUILD_ROOT%{_sbindir}/sshd \

%{nil}

%install

rm -rf $RPM_BUILD_ROOT

mkdir -p -m755 $RPM_BUILD_ROOT%{_sysconfdir}/ssh

mkdir -p -m755 $RPM_BUILD_ROOT%{_libexecdir}/openssh

mkdir -p -m755 $RPM_BUILD_ROOT%{_var}/empty/sshd

make install DESTDIR=$RPM_BUILD_ROOT

rm -f $RPM_BUILD_ROOT%{_sysconfdir}/ssh/ldap.conf

install -d $RPM_BUILD_ROOT/etc/pam.d/

install -d $RPM_BUILD_ROOT/etc/sysconfig/

install -d $RPM_BUILD_ROOT/etc/rc.d/init.d

install -d $RPM_BUILD_ROOT%{_libexecdir}/openssh

install -d $RPM_BUILD_ROOT%{_libdir}/fipscheck

install -m644 %{SOURCE2} $RPM_BUILD_ROOT/etc/pam.d/sshd

install -m644 %{SOURCE6} $RPM_BUILD_ROOT/etc/pam.d/ssh-keycat

install -m755 %{SOURCE3} $RPM_BUILD_ROOT/etc/rc.d/init.d/sshd

install -m644 %{SOURCE7} $RPM_BUILD_ROOT/etc/sysconfig/sshd

install -m755 contrib/ssh-copy-id $RPM_BUILD_ROOT%{_bindir}/

install contrib/ssh-copy-id.1 $RPM_BUILD_ROOT%{_mandir}/man1/

%if ! %{no_gnome_askpass}

install -s contrib/gnome-ssh-askpass $RPM_BUILD_ROOT%{_libexecdir}/openssh/gnome-ssh-askpass

%endif

%if ! %{scard}

	rm -f $RPM_BUILD_ROOT%{_datadir}/openssh/Ssh.bin

%endif

%if ! %{no_gnome_askpass}

ln -s gnome-ssh-askpass $RPM_BUILD_ROOT%{_libexecdir}/openssh/ssh-askpass

install -m 755 -d $RPM_BUILD_ROOT%{_sysconfdir}/profile.d/

install -m 755 contrib/redhat/gnome-ssh-askpass.csh $RPM_BUILD_ROOT%{_sysconfdir}/profile.d/

install -m 755 contrib/redhat/gnome-ssh-askpass.sh $RPM_BUILD_ROOT%{_sysconfdir}/profile.d/

%endif

%if %{no_gnome_askpass}

rm -f $RPM_BUILD_ROOT/etc/profile.d/gnome-ssh-askpass.*

%endif

perl -pi -e "s|$RPM_BUILD_ROOT||g" $RPM_BUILD_ROOT%{_mandir}/man*/*

rm -f README.nss.nss-keys

%if ! %{nss}

rm -f README.nss

%endif

%if %{pam_ssh_agent}

pushd pam_ssh_agent_auth-%{pam_ssh_agent_ver}

make install DESTDIR=$RPM_BUILD_ROOT

popd

%endif

%clean

rm -rf $RPM_BUILD_ROOT

%pre

getent group ssh_keys >/dev/null || groupadd -r ssh_keys || :

%pre server

getent group sshd >/dev/null || groupadd -g %{sshd_uid} -r sshd || :

%if %{nologin}

getent passwd sshd >/dev/null || \

  useradd -c "Privilege-separated SSH" -u %{sshd_uid} -g sshd  -s /sbin/nologin \

  -s /sbin/nologin -r -d /var/empty/sshd sshd 2> /dev/null || :

%else

getent passwd sshd >/dev/null || \

  useradd -c "Privilege-separated SSH" -u %{sshd_uid} -g sshd  -s /sbin/nologin \

  -s /dev/null -r -d /var/empty/sshd sshd 2> /dev/null || :

%endif

%post server

/sbin/chkconfig --add sshd

%postun server

/sbin/service sshd condrestart > /dev/null 2>&1 || :

%preun server

if [ "$1" = 0 ]

then

	/sbin/service sshd stop > /dev/null 2>&1 || :

	/sbin/chkconfig --del sshd

fi

%files

%defattr(-,root,root)

%doc CREDITS ChangeLog INSTALL LICENCE OVERVIEW PROTOCOL* README README.platform README.privsep README.tun README.dns TODO WARNING*

%attr(0755,root,root) %dir %{_sysconfdir}/ssh

%attr(0600,root,root) %config(noreplace) %{_sysconfdir}/ssh/moduli

%if ! %{rescue}

%attr(0755,root,root) %{_bindir}/ssh-keygen

%attr(0644,root,root) %{_mandir}/man1/ssh-keygen.1*

%attr(0755,root,root) %dir %{_libexecdir}/openssh

%attr(2111,root,ssh_keys) %{_libexecdir}/openssh/ssh-keysign

%attr(0644,root,root) %{_mandir}/man8/ssh-keysign.8*

%endif

%if %{scard}

%attr(0755,root,root) %dir %{_datadir}/openssh

%attr(0644,root,root) %{_datadir}/openssh/Ssh.bin

%endif

%files clients

%defattr(-,root,root)

%attr(0755,root,root) %{_bindir}/ssh

%attr(0644,root,root) %{_libdir}/fipscheck/ssh.hmac

%attr(0644,root,root) %{_mandir}/man1/ssh.1*

%attr(0755,root,root) %{_bindir}/scp

%attr(0644,root,root) %{_mandir}/man1/scp.1*

%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ssh/ssh_config

%attr(0755,root,root) %{_bindir}/slogin

%attr(0644,root,root) %{_mandir}/man1/slogin.1*

%attr(0644,root,root) %{_mandir}/man5/ssh_config.5*

%if ! %{rescue}

%attr(2111,root,nobody) %{_bindir}/ssh-agent

%attr(0755,root,root) %{_bindir}/ssh-add

%attr(0755,root,root) %{_bindir}/ssh-keyscan

%attr(0755,root,root) %{_bindir}/sftp

%attr(0755,root,root) %{_bindir}/ssh-copy-id

%attr(0755,root,root) %{_libexecdir}/openssh/ssh-pkcs11-helper

%attr(0644,root,root) %{_mandir}/man1/ssh-agent.1*

%attr(0644,root,root) %{_mandir}/man1/ssh-add.1*

%attr(0644,root,root) %{_mandir}/man1/ssh-keyscan.1*

%attr(0644,root,root) %{_mandir}/man1/sftp.1*

%attr(0644,root,root) %{_mandir}/man1/ssh-copy-id.1*

%attr(0644,root,root) %{_mandir}/man8/ssh-pkcs11-helper.8*

%endif

%if ! %{rescue}

%files server

%defattr(-,root,root)

%dir %attr(0711,root,root) %{_var}/empty/sshd

%attr(0755,root,root) %{_sbindir}/sshd

%attr(0644,root,root) %{_libdir}/fipscheck/sshd.hmac

%attr(0755,root,root) %{_libexecdir}/openssh/sftp-server

%attr(0644,root,root) %{_mandir}/man5/sshd_config.5*

%attr(0644,root,root) %{_mandir}/man5/moduli.5*

%attr(0644,root,root) %{_mandir}/man8/sshd.8*

%attr(0644,root,root) %{_mandir}/man8/sftp-server.8*

%attr(0600,root,root) %config(noreplace) %{_sysconfdir}/ssh/sshd_config

%attr(0644,root,root) %config(noreplace) /etc/pam.d/sshd

%attr(0640,root,root) %config(noreplace) /etc/sysconfig/sshd

%attr(0755,root,root) /etc/rc.d/init.d/sshd

%endif

%if %{ldap}

%files ldap

%defattr(-,root,root)

%doc HOWTO.ldap-keys openssh-lpk-openldap.schema openssh-lpk-sun.schema ldap.conf

%attr(0755,root,root) %{_libexecdir}/openssh/ssh-ldap-helper

%attr(0755,root,root) %{_libexecdir}/openssh/ssh-ldap-wrapper

%attr(0644,root,root) %{_mandir}/man8/ssh-ldap-helper.8*

%attr(0644,root,root) %{_mandir}/man5/ssh-ldap.conf.5*

%endif

%files keycat

%defattr(-,root,root)

%doc HOWTO.ssh-keycat

%attr(0755,root,root) %{_libexecdir}/openssh/ssh-keycat

%attr(0644,root,root) %config(noreplace) /etc/pam.d/ssh-keycat

%if ! %{no_gnome_askpass}

%files askpass

%defattr(-,root,root)

%attr(0644,root,root) %{_sysconfdir}/profile.d/gnome-ssh-askpass.*

%attr(0755,root,root) %{_libexecdir}/openssh/gnome-ssh-askpass

%attr(0755,root,root) %{_libexecdir}/openssh/ssh-askpass

%endif

%if %{pam_ssh_agent}

%files -n pam_ssh_agent_auth

%defattr(-,root,root)

%doc pam_ssh_agent_auth-%{pam_ssh_agent_ver}/OPENSSH_LICENSE

%attr(0755,root,root) /%{_lib}/security/pam_ssh_agent_auth.so

%attr(0644,root,root) %{_mandir}/man8/pam_ssh_agent_auth.8*

%endif

%changelog

* Fri Apr 22 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-28 + 0.9.2-30

- improving sshd -> passwd transation

- add template for .local domain to sshd_config

* Thu Apr 21 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-27 + 0.9.2-30

- the private keys may be 640 root:ssh_keys ssh_keysign is sgid

* Wed Apr 20 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-26 + 0.9.2-30

- improving sshd -> passwd transation

* Tue Apr  5 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-25 + 0.9.2-30

- the intermediate context is set to sshd_sftpd_t

- do not crash in packet.c if no connection

* Thu Mar 31 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-24 + 0.9.2-30

- resolve warnings in port_linux.c

* Tue Mar 29 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-23 + 0.9.2-30

- add /etc/sysconfig/sshd

* Mon Mar 28 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-22 + 0.9.2-30

- improve reseeding and seed source (documentation)

* Tue Mar 22 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-20 + 0.9.2-30

- use /dev/random or /dev/urandom for seeding prng

- improve periodical reseeding of random generator

* Thu Mar 17 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-18 + 0.9.2-30

- add periodical reseeding of random generator 

- change selinux contex for internal sftp in do_usercontext

- exit(0) after sigterm

* Thu Mar 10 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-17 + 0.9.2-30

- improove ssh-ldap (documentation)

* Tue Mar  8 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-16 + 0.9.2-30

- improve session keys audit

* Mon Mar  7 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-15 + 0.9.2-30

- CVE-2010-4755

* Fri Mar  4 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-14 + 0.9.2-30

- improove ssh-keycat (documentation)

* Thu Mar  3 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-13 + 0.9.2-30

- improve audit of logins and auths

* Tue Mar  1 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-12 + 0.9.2-30

- improove ssk-keycat

* Mon Feb 28 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-11 + 0.9.2-30

- add ssk-keycat

* Fri Feb 25 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-10 + 0.9.2-30

- reenable auth-keys ldap backend

* Fri Feb 25 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-9 + 0.9.2-30

- another audit improovements

* Thu Feb 24 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-8 + 0.9.2-30

- another audit improovements

- switchable fingerprint mode

* Thu Feb 17 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-4 + 0.9.2-30

- improve audit of server key management

* Wed Feb 16 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-3 + 0.9.2-30

- improve audit of logins and auths

* Mon Feb 14 2011 Jan F. Chadima <jchadima@redhat.com> - 5.8p1-1 + 0.9.2-30

- bump openssh version to 5.8p1

* Tue Feb 08 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 5.6p1-30.1

- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild

* Mon Feb  7 2011 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-30 + 0.9.2-29

- clean the data structures in the non privileged process

- clean the data structures when roaming

* Tue Feb  2 2011 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-28 + 0.9.2-29

- clean the data structures in the privileged process

* Tue Jan 25 2011 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-25 + 0.9.2-29

- clean the data structures before exit net process

* Mon Jan 17 2011 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-24 + 0.9.2-29

- make audit compatible with the fips mode

* Fri Jan 14 2011 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-23 + 0.9.2-29

- add audit of destruction the server keys

* Wed Jan 12 2011 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-22 + 0.9.2-29

- add audit of destruction the session keys

* Fri Dec 10 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-21 + 0.9.2-29

- reenable run sshd as non root user

- renable rekeying

* Wed Nov 24 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-20 + 0.9.2-29

- reapair clientloop crash (#627332)

- properly restore euid in case connect to the ssh-agent socket fails

* Mon Nov 22 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-19 + 0.9.2-28

- striped read permissions from suid and sgid binaries

* Mon Nov 15 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-18 + 0.9.2-27

- used upstream version of the biguid patch

* Mon Nov 15 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-17 + 0.9.2-27

- improoved kuserok patch

* Fri Nov  5 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-16 + 0.9.2-27

- add auditing the host based key ussage

- repait X11 abstract layer socket (#648896)

* Wed Nov  3 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-15 + 0.9.2-27

- add auditing the kex result

* Fri Nov  2 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-14 + 0.9.2-27

- add auditing the key ussage

* Fri Oct 20 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-12 + 0.9.2-27

- update gsskex patch (#645389)

* Wed Oct 20 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-11 + 0.9.2-27

- rebase linux audit according to upstream

* Fri Oct  1 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-10 + 0.9.2-27

- add missing headers to linux audit

* Wed Sep 29 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-9 + 0.9.2-27

- audit module now uses openssh audit framevork

* Wed Sep 15 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-8 + 0.9.2-27

- Add the GSSAPI kuserok switch to the kuserok patch

* Wed Sep 15 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-7 + 0.9.2-27

- Repaired the kuserok patch

* Mon Sep 13 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-6 + 0.9.2-27

- Repaired the problem with puting entries with very big uid into lastlog

* Mon Sep 13 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-5 + 0.9.2-27

- Merging selabel patch with the upstream version. (#632914)

* Mon Sep 13 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-4 + 0.9.2-27

- Tweaking selabel patch to work properly without selinux rules loaded. (#632914)

* Wed Sep  8 2010 Tomas Mraz <tmraz@redhat.com> - 5.6p1-3 + 0.9.2-27

- Make fipscheck hmacs compliant with FHS - requires new fipscheck

* Fri Sep  3 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-2 + 0.9.2-27

- Added -z relro -z now to LDFLAGS

* Fri Sep  3 2010 Jan F. Chadima <jchadima@redhat.com> - 5.6p1-1 + 0.9.2-27

- Rebased to openssh5.6p1

* Wed Jul  7 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-18 + 0.9.2-26

- merged with newer bugzilla's version of authorized keys command patch

* Wed Jun 30 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-17 + 0.9.2-26

- improved the x11 patch according to upstream (#598671)

* Thu Jun 25 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-16 + 0.9.2-26

- improved the x11 patch (#598671)

* Thu Jun 24 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-15 + 0.9.2-26

- changed _PATH_UNIX_X to unexistent file name (#598671)

* Wed Jun 23 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-14 + 0.9.2-26

- sftp works in deviceless chroot again (broken from 5.5p1-3)

* Tue Jun  8 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-13 + 0.9.2-26

- add option to switch out krb5_kuserok

* Fri May 21 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-12 + 0.9.2-26

- synchronize uid and gid for the user sshd

* Thu May 20 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-11 + 0.9.2-26

- Typo in ssh-ldap.conf(5) and ssh-ladap-helper(8)

* Fri May 14 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-10 + 0.9.2-26

- Repair the reference in man ssh-ldap-helper(8)

- Repair the PubkeyAgent section in sshd_config(5)

- Provide example ldap.conf

* Thu May 13 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-9 + 0.9.2-26

- Make the Ldap configuration widely compatible

- create the aditional docs for LDAP support.

* Thu May  6 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-8 + 0.9.2-26

- Make LDAP config elements TLS_CACERT and TLS_REQCERT compatiple with pam_ldap (#589360)

* Thu May  6 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-7 + 0.9.2-26

- Make LDAP config element tls_checkpeer compatiple with nss_ldap (#589360)

* Tue May  4 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-6 + 0.9.2-26

- Comment spec.file

- Sync patches from upstream

* Mon May  3 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-5 + 0.9.2-26

- Create separate ldap package

- Tweak the ldap patch

- Rename stderr patch properly