# Do we want SELinux & Audit

%if 0%{?!noselinux:1}

%define WITH_SELINUX 1

%else

%define WITH_SELINUX 0

%endif

%global _hardened_build 1

# OpenSSH privilege separation requires a user & group ID

%define sshd_uid    74

%define sshd_gid    74

# Do we want to disable building of gnome-askpass? (1=yes 0=no)

%define no_gnome_askpass 0

# Do we want to link against a static libcrypto? (1=yes 0=no)

%define static_libcrypto 0

# Use GTK2 instead of GNOME in gnome-ssh-askpass

%define gtk2 1

# Build position-independent executables (requires toolchain support)?

%define pie 1

# Do we want kerberos5 support (1=yes 0=no)

%define kerberos5 1

# Do we want libedit support

%define libedit 1

# Do we want LDAP support

%define ldap 1

# Whether to build pam_ssh_agent_auth

%if 0%{?!nopam:1}

%define pam_ssh_agent 1

%else

%define pam_ssh_agent 0

%endif

# Reserve options to override askpass settings with:

# rpm -ba|--rebuild --define 'skip_xxx 1'

%{?skip_gnome_askpass:%global no_gnome_askpass 1}

# Add option to build without GTK2 for older platforms with only GTK+.

# Red Hat Linux <= 7.2 and Red Hat Advanced Server 2.1 are examples.

# rpm -ba|--rebuild --define 'no_gtk2 1'

%{?no_gtk2:%global gtk2 0}

# Options for static OpenSSL link:

# rpm -ba|--rebuild --define "static_openssl 1"

%{?static_openssl:%global static_libcrypto 1}

# Is this a build for the rescue CD (without PAM, with MD5)? (1=yes 0=no)

%define rescue 0

%{?build_rescue:%global rescue 1}

%{?build_rescue:%global rescue_rel rescue}

# Turn off some stuff for resuce builds

%if %{rescue}

%define kerberos5 0

%define libedit 0

%define pam_ssh_agent 0

%endif

# Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1

%define openssh_ver 6.8p1

%define openssh_rel 1

%define pam_ssh_agent_ver 0.9.3

%define pam_ssh_agent_rel 5

Summary: An open source implementation of SSH protocol versions 1 and 2

Name: openssh

Version: %{openssh_ver}

Release: %{openssh_rel}%{?dist}%{?rescue_rel}

URL: http://www.openssh.com/portable.html

#URL1: http://pamsshagentauth.sourceforge.net

Source0: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz

#Source1: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz.asc

Source2: sshd.pam

Source3: sshd.init

Source4: http://prdownloads.sourceforge.net/pamsshagentauth/pam_ssh_agent_auth/pam_ssh_agent_auth-%{pam_ssh_agent_ver}.tar.bz2

Source5: pam_ssh_agent-rmheaders

Source6: ssh-keycat.pam

Source7: sshd.sysconfig

Source9: sshd@.service

Source10: sshd.socket

Source11: sshd.service

Source12: sshd-keygen.service

Source13: sshd-keygen

Source14: sshd.tmpfiles

# Internal debug

Patch0: openssh-5.9p1-wIm.patch

#?

Patch100: openssh-6.7p1-coverity.patch

#https://bugzilla.mindrot.org/show_bug.cgi?id=1894

#https://bugzilla.redhat.com/show_bug.cgi?id=735889

Patch102: openssh-5.8p1-getaddrinfo.patch

#https://bugzilla.mindrot.org/show_bug.cgi?id=1889

Patch103: openssh-5.8p1-packet.patch

#https://bugzilla.mindrot.org/show_bug.cgi?id=1402

# https://bugzilla.redhat.com/show_bug.cgi?id=1171248

# record pfs= field in CRYPTO_SESSION audit event

Patch200: openssh-6.7p1-audit.patch

# --- pam_ssh-agent ---

# make it build reusing the openssh sources

Patch300: pam_ssh_agent_auth-0.9.3-build.patch

# check return value of seteuid()

Patch301: pam_ssh_agent_auth-0.9.2-seteuid.patch

# explicitly make pam callbacks visible

Patch302: pam_ssh_agent_auth-0.9.2-visibility.patch

# don't use xfree (#1024965)

Patch303: pam_ssh_agent_auth-0.9.3-no-xfree.patch

# use SSH_DIGEST_* for fingerprint hashes

Patch304: pam_ssh_agent_auth-0.9.3-fingerprint-hash.patch

#https://bugzilla.mindrot.org/show_bug.cgi?id=1641 (WONTFIX)

Patch400: openssh-6.6p1-role-mls.patch

#https://bugzilla.redhat.com/show_bug.cgi?id=781634

Patch404: openssh-6.6p1-privsep-selinux.patch

#?-- unwanted child :(

Patch501: openssh-6.7p1-ldap.patch

#?

Patch502: openssh-6.6p1-keycat.patch

#http6://bugzilla.mindrot.org/show_bug.cgi?id=1644

Patch601: openssh-6.6p1-allow-ip-opts.patch

#http://cvsweb.netbsd.org/cgi-bin/cvsweb.cgi/src/crypto/dist/ssh/Attic/sftp-glob.c.diff?r1=1.13&r2=1.13.12.1&f=h

Patch603: openssh-5.8p1-glob.patch

#https://bugzilla.mindrot.org/show_bug.cgi?id=1893

Patch604: openssh-6.6p1-keyperm.patch

#https://bugzilla.mindrot.org/show_bug.cgi?id=1925

Patch606: openssh-5.9p1-ipv6man.patch

#?

Patch607: openssh-5.8p2-sigpipe.patch

#https://bugzilla.mindrot.org/show_bug.cgi?id=1789

Patch609: openssh-5.5p1-x11.patch

#?

Patch700: openssh-6.7p1-fips.patch

#?

Patch702: openssh-5.1p1-askpass-progress.patch

#?

Patch703: openssh-4.3p2-askpass-grab-info.patch

#?

Patch706: openssh-6.6.1p1-localdomain.patch

#https://bugzilla.mindrot.org/show_bug.cgi?id=1635 (WONTFIX)

Patch707: openssh-6.6p1-redhat.patch

#https://bugzilla.mindrot.org/show_bug.cgi?id=1890 (WONTFIX) need integration to prng helper which is discontinued :)

Patch708: openssh-6.6p1-entropy.patch

#https://bugzilla.mindrot.org/show_bug.cgi?id=1640 (WONTFIX)

Patch709: openssh-6.2p1-vendor.patch

# warn users for unsupported UsePAM=no (#757545)

Patch711: openssh-6.6p1-log-usepam-no.patch

# make aes-ctr ciphers use EVP engines such as AES-NI from OpenSSL

Patch712: openssh-6.3p1-ctr-evp-fast.patch

# add cavs test binary for the aes-ctr

Patch713: openssh-6.6p1-ctr-cavstest.patch

# add SSH KDF CAVS test driver

Patch714: openssh-6.7p1-kdf-cavs.patch

#http://www.sxw.org.uk/computing/patches/openssh.html

#changed cache storage type - #848228

Patch800: openssh-6.6p1-gsskex.patch

#http://www.mail-archive.com/kerberos@mit.edu/msg17591.html

Patch801: openssh-6.6p1-force_krb.patch

# add new option GSSAPIEnablek5users and disable using ~/.k5users by default (#1169843)

# CVE-2014-9278

Patch802: openssh-6.6p1-GSSAPIEnablek5users.patch

Patch900: openssh-6.1p1-gssapi-canohost.patch

#https://bugzilla.mindrot.org/show_bug.cgi?id=1780

Patch901: openssh-6.6p1-kuserok.patch

# use default_ccache_name from /etc/krb5.conf (#991186)

Patch902: openssh-6.3p1-krb5-use-default_ccache_name.patch

# Run ssh-copy-id in the legacy mode when SSH_COPY_ID_LEGACY variable is set (#969375

Patch905: openssh-6.4p1-legacy-ssh-copy-id.patch

# Use tty allocation for a remote scp (#985650)

Patch906: openssh-6.4p1-fromto-remote.patch

# set a client's address right after a connection is set

# http://bugzilla.mindrot.org/show_bug.cgi?id=2257

Patch911: openssh-6.6p1-set_remote_ipaddr.patch

# apply RFC3454 stringprep to banners when possible

# https://bugzilla.mindrot.org/show_bug.cgi?id=2058

# slightly changed patch from comment 10

Patch912: openssh-6.6.1p1-utf8-banner.patch

# fix parsing of empty options in sshd_conf

# https://bugzilla.mindrot.org/show_bug.cgi?id=2281

Patch914: openssh-6.6.1p1-servconf-parser.patch

# privsep_preauth: use SELinux context from selinux-policy (#1008580)

Patch916: openssh-6.6.1p1-selinux-contexts.patch

# use different values for DH for Cisco servers (#1026430)

Patch917: openssh-6.6.1p1-cisco-dh-keys.patch

# log via monitor in chroots without /dev/log

Patch918: openssh-6.6.1p1-log-in-chroot.patch

# scp file into non-existing directory (#1142223)

Patch919: openssh-6.6.1p1-scp-non-existing-directory.patch

# Config parser shouldn't accept ip/port syntax (#1130733)

Patch920: openssh-6.6.1p1-ip-port-config-parser.patch

# restore tcp wrappers support, based on Debian patch

# https://lists.mindrot.org/pipermail/openssh-unix-dev/2014-April/032497.html

Patch921: openssh-6.7p1-debian-restore-tcp-wrappers.patch

# apply upstream patch and make sshd -T more consistent (#1187521)

Patch922: openssh-6.7p1-sshdT-output.patch

# fix ssh-copy-id on non-sh shells (#1045191)

Patch923: openssh-6.7p1-fix-ssh-copy-id-on-non-sh-shell.patch

# AArch64 has seccomp support since 3.19 kernel (#1195065)

Patch924: openssh-6.7p1-seccomp-aarch64.patch

# Solve issue with ssh-copy-id and keys without trailing newline (#1093168)

Patch925: openssh-6.7p1-ssh-copy-id-truncated-keys.patch

# Add sftp option to force mode of created files (#1191055)

Patch926: openssh-6.7p1-sftp-force-permission.patch

# Workaround krb5-config bug #1204646

Patch927: openssh-6.8p1-workaround-krb5-config-bug.patch

License: BSD

Group: Applications/Internet

BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)

Requires: /sbin/nologin

Obsoletes: openssh-clients-fips, openssh-server-fips

Obsoletes: openssh-server-sysvinit

%if ! %{no_gnome_askpass}

%if %{gtk2}

BuildRequires: gtk2-devel

BuildRequires: libX11-devel

%else

BuildRequires: gnome-libs-devel

%endif

%endif

%if %{ldap}

BuildRequires: openldap-devel

%endif

BuildRequires: autoconf, automake, perl, zlib-devel

BuildRequires: audit-libs-devel >= 2.0.5

BuildRequires: util-linux, groff

BuildRequires: pam-devel

BuildRequires: tcp_wrappers-devel

BuildRequires: fipscheck-devel >= 1.3.0

BuildRequires: openssl-devel >= 0.9.8j

BuildRequires: perl-podlators

%if %{kerberos5}

BuildRequires: krb5-devel

%endif

%if %{libedit}

BuildRequires: libedit-devel ncurses-devel

%endif

%if %{WITH_SELINUX}

Requires: libselinux >= 2.3-5

BuildRequires: libselinux-devel >= 2.3-5

Requires: audit-libs >= 1.0.8

BuildRequires: audit-libs >= 1.0.8

%endif

BuildRequires: xauth

%package clients

Summary: An open source SSH client applications

Group: Applications/Internet

Requires: openssh = %{version}-%{release}

Requires: fipscheck-lib%{_isa} >= 1.3.0

%package server

Summary: An open source SSH server daemon

Group: System Environment/Daemons

Requires: openssh = %{version}-%{release}

Requires(pre): /usr/sbin/useradd

Requires: pam >= 1.0.1-3

Requires: fipscheck-lib%{_isa} >= 1.3.0

Requires(post): systemd-units

Requires(preun): systemd-units

Requires(postun): systemd-units

%if %{ldap}

%package ldap

Summary: A LDAP support for open source SSH server daemon

Requires: openssh = %{version}-%{release}

Group: System Environment/Daemons

%endif

%package keycat

Summary: A mls keycat backend for openssh

Requires: openssh = %{version}-%{release}

Group: System Environment/Daemons

%package askpass

Summary: A passphrase dialog for OpenSSH and X

Group: Applications/Internet

Requires: openssh = %{version}-%{release}

Obsoletes: openssh-askpass-gnome

Provides: openssh-askpass-gnome

%package cavs

Summary: CAVS tests for FIPS validation

Group: Applications/Internet

Requires: openssh = %{version}-%{release}

%package -n pam_ssh_agent_auth

Summary: PAM module for authentication with ssh-agent

Group: System Environment/Base

Version: %{pam_ssh_agent_ver}

Release: %{pam_ssh_agent_rel}.%{openssh_rel}%{?dist}%{?rescue_rel}.1

License: BSD

%description

SSH (Secure SHell) is a program for logging into and executing

commands on a remote machine. SSH is intended to replace rlogin and

rsh, and to provide secure encrypted communications between two

untrusted hosts over an insecure network. X11 connections and

arbitrary TCP/IP ports can also be forwarded over the secure channel.

OpenSSH is OpenBSD's version of the last free version of SSH, bringing

it up to date in terms of security and features.

This package includes the core files necessary for both the OpenSSH

client and server. To make this package useful, you should also

install openssh-clients, openssh-server, or both.

%description clients

OpenSSH is a free version of SSH (Secure SHell), a program for logging

into and executing commands on a remote machine. This package includes

the clients necessary to make encrypted connections to SSH servers.

%description server

OpenSSH is a free version of SSH (Secure SHell), a program for logging

into and executing commands on a remote machine. This package contains

the secure shell daemon (sshd). The sshd daemon allows SSH clients to

securely connect to your SSH server.

%if %{ldap}

%description ldap

OpenSSH LDAP backend is a way how to distribute the authorized tokens

among the servers in the network.

%endif

%description keycat

OpenSSH mls keycat is backend for using the authorized keys in the

openssh in the mls mode.

%description askpass

OpenSSH is a free version of SSH (Secure SHell), a program for logging

into and executing commands on a remote machine. This package contains

an X11 passphrase dialog for OpenSSH.

%description cavs

This package contains test binaries and scripts to make FIPS validation

easier. Now contains CTR and KDF CAVS test driver.

%description -n pam_ssh_agent_auth

This package contains a PAM module which can be used to authenticate

users using ssh keys stored in a ssh-agent. Through the use of the

forwarding of ssh-agent connection it also allows to authenticate with

remote ssh-agent instance.

The module is most useful for su and sudo service stacks.

%prep

%setup -q -a 4

#Do not enable by default

%if 0

%patch0 -p1 -b .wIm

%endif

# investigate %patch102 -p1 -b .getaddrinfo

%patch103 -p1 -b .packet

%if %{pam_ssh_agent}

pushd pam_ssh_agent_auth-%{pam_ssh_agent_ver}

%patch300 -p1 -b .psaa-build

%patch301 -p1 -b .psaa-seteuid

%patch302 -p1 -b .psaa-visibility

%patch303 -p1 -b .psaa-xfree

%patch304 -p2 -b .psaa-fingerprint

# Remove duplicate headers

rm -f $(cat %{SOURCE5})

popd

%endif

%if %{WITH_SELINUX}

%patch400 -p1 -b .role-mls

%patch404 -p1 -b .privsep-selinux

%endif

%if %{ldap}

%patch501 -p1 -b .ldap

%endif

%patch502 -p1 -b .keycat

%patch601 -p1 -b .ip-opts

%patch603 -p1 -b .glob

%patch604 -p1 -b .keyperm

%patch606 -p1 -b .ipv6man

%patch607 -p1 -b .sigpipe

%patch609 -p1 -b .x11

%patch702 -p1 -b .progress

%patch703 -p1 -b .grab-info

%patch706 -p1 -b .localdomain

%patch707 -p1 -b .redhat

%patch708 -p1 -b .entropy

%patch709 -p1 -b .vendor

%patch711 -p1 -b .log-usepam-no

%patch712 -p1 -b .evp-ctr

%patch713 -p1 -b .ctr-cavs

%patch714 -p1 -b .kdf-cavs

# 

%patch800 -p1 -b .gsskex

%patch801 -p1 -b .force_krb

# 

%patch900 -p1 -b .canohost

%patch901 -p1 -b .kuserok

%patch902 -p1 -b .ccache_name

%patch905 -p1 -b .legacy-ssh-copy-id

%patch906 -p1 -b .fromto-remote

%patch911 -p1 -b .set_remote_ipaddr

%patch912 -p1 -b .utf8-banner

%patch914 -p1 -b .servconf

%patch916 -p1 -b .contexts

%patch917 -p1 -b .cisco-dh

%patch918 -p1 -b .log-in-chroot

%patch919 -p1 -b .scp

%patch920 -p1 -b .config

%patch802 -p1 -b .GSSAPIEnablek5users

%patch921 -p1 -b .tcp_wrappers

%patch922 -p1 -b .sshdt

%patch923 -p1 -b .ssh-copy-id

%patch924 -p1 -b .seccomp

%patch925 -p1 -b .newline

%patch926 -p1 -b .sftp-force-mode

%patch927 -p1 -b .bz1204646

# audit patch needs more care

#%patch200 -p1 -b .audit

%patch700 -p1 -b .fips

%patch100 -p1 -b .coverity

%if 0

# Nothing here yet

%endif

autoreconf

pushd pam_ssh_agent_auth-%{pam_ssh_agent_ver}

autoreconf

popd

%build

# the -fvisibility=hidden is needed for clean build of the pam_ssh_agent_auth

# and it makes the ssh build more clean and even optimized better

CFLAGS="$RPM_OPT_FLAGS -fvisibility=hidden"; export CFLAGS

%if %{rescue}

CFLAGS="$CFLAGS -Os"

%endif

%if %{pie}

%ifarch s390 s390x sparc sparcv9 sparc64

CFLAGS="$CFLAGS -fPIC"

%else

CFLAGS="$CFLAGS -fpic"

%endif

SAVE_LDFLAGS="$LDFLAGS"

LDFLAGS="$LDFLAGS -pie -z relro -z now"

export CFLAGS

export LDFLAGS

%endif

%if %{kerberos5}

if test -r /etc/profile.d/krb5-devel.sh ; then

	source /etc/profile.d/krb5-devel.sh

fi

krb5_prefix=`krb5-config --prefix`

if test "$krb5_prefix" != "%{_prefix}" ; then

	CPPFLAGS="$CPPFLAGS -I${krb5_prefix}/include -I${krb5_prefix}/include/gssapi"; export CPPFLAGS

	CFLAGS="$CFLAGS -I${krb5_prefix}/include -I${krb5_prefix}/include/gssapi"

	LDFLAGS="$LDFLAGS -L${krb5_prefix}/%{_lib}"; export LDFLAGS

else

	krb5_prefix=

	CPPFLAGS="-I%{_includedir}/gssapi"; export CPPFLAGS

	CFLAGS="$CFLAGS -I%{_includedir}/gssapi"

fi

%endif

%configure \

	--sysconfdir=%{_sysconfdir}/ssh \

	--libexecdir=%{_libexecdir}/openssh \

	--datadir=%{_datadir}/openssh \

	--with-tcp-wrappers \

	--with-default-path=/usr/local/bin:/usr/bin \

	--with-superuser-path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin \

	--with-privsep-path=%{_var}/empty/sshd \

	--enable-vendor-patchlevel="FC-%{openssh_ver}-%{openssh_rel}" \

	--disable-strip \

	--without-zlib-version-check \

	--with-ssl-engine \

	--with-ipaddr-display \

	--with-pie=no \

%if %{ldap}

	--with-ldap \

%endif

%if %{rescue}

	--without-pam \

%else

	--with-pam \

%endif

%if %{WITH_SELINUX}

	--with-selinux --with-audit=linux \

%ifarch %{ix86} x86_64 %{arm} aarch64

	--with-sandbox=seccomp_filter \

%else

	--with-sandbox=rlimit \

%endif

%endif

%if %{kerberos5}

	--with-kerberos5${krb5_prefix:+=${krb5_prefix}} \

%else

	--without-kerberos5 \

%endif

%if %{libedit}

	--with-libedit

%else

	--without-libedit

%endif

%if %{static_libcrypto}

perl -pi -e "s|-lcrypto|%{_libdir}/libcrypto.a|g" Makefile

%endif

make

# Define a variable to toggle gnome1/gtk2 building.  This is necessary

# because RPM doesn't handle nested %if statements.

%if %{gtk2}

	gtk2=yes

%else

	gtk2=no

%endif

%if ! %{no_gnome_askpass}

pushd contrib

if [ $gtk2 = yes ] ; then

	make gnome-ssh-askpass2

	mv gnome-ssh-askpass2 gnome-ssh-askpass

else

	make gnome-ssh-askpass1

	mv gnome-ssh-askpass1 gnome-ssh-askpass

fi

popd

%endif

%if %{pam_ssh_agent}

pushd pam_ssh_agent_auth-%{pam_ssh_agent_ver}

LDFLAGS="$SAVE_LDFLAGS"

%configure --with-selinux --libexecdir=/%{_libdir}/security --with-mantype=man

make

popd

%endif

# Add generation of HMAC checksums of the final stripped binaries

%define __spec_install_post \

    %{?__debug_package:%{__debug_install_post}} \

    %{__arch_install_post} \

    %{__os_install_post} \

    fipshmac -d $RPM_BUILD_ROOT%{_libdir}/fipscheck $RPM_BUILD_ROOT%{_bindir}/ssh $RPM_BUILD_ROOT%{_sbindir}/sshd \

%{nil}

%check

#to run tests use "--with check"

%if %{?_with_check:1}%{!?_with_check:0}

make tests

%endif

%install

rm -rf $RPM_BUILD_ROOT

mkdir -p -m755 $RPM_BUILD_ROOT%{_sysconfdir}/ssh

mkdir -p -m755 $RPM_BUILD_ROOT%{_libexecdir}/openssh

mkdir -p -m755 $RPM_BUILD_ROOT%{_var}/empty/sshd

make install DESTDIR=$RPM_BUILD_ROOT

rm -f $RPM_BUILD_ROOT%{_sysconfdir}/ssh/ldap.conf

install -d $RPM_BUILD_ROOT/etc/pam.d/

install -d $RPM_BUILD_ROOT/etc/sysconfig/

install -d $RPM_BUILD_ROOT%{_libexecdir}/openssh

install -d $RPM_BUILD_ROOT%{_libdir}/fipscheck

install -m644 %{SOURCE2} $RPM_BUILD_ROOT/etc/pam.d/sshd

install -m644 %{SOURCE6} $RPM_BUILD_ROOT/etc/pam.d/ssh-keycat

install -m644 %{SOURCE7} $RPM_BUILD_ROOT/etc/sysconfig/sshd

install -m755 %{SOURCE13} $RPM_BUILD_ROOT/%{_sbindir}/sshd-keygen

install -d -m755 $RPM_BUILD_ROOT/%{_unitdir}

install -m644 %{SOURCE9} $RPM_BUILD_ROOT/%{_unitdir}/sshd@.service

install -m644 %{SOURCE10} $RPM_BUILD_ROOT/%{_unitdir}/sshd.socket

install -m644 %{SOURCE11} $RPM_BUILD_ROOT/%{_unitdir}/sshd.service

install -m644 %{SOURCE12} $RPM_BUILD_ROOT/%{_unitdir}/sshd-keygen.service

install -m755 contrib/ssh-copy-id $RPM_BUILD_ROOT%{_bindir}/

install contrib/ssh-copy-id.1 $RPM_BUILD_ROOT%{_mandir}/man1/

install -m644 -D %{SOURCE14} $RPM_BUILD_ROOT%{_tmpfilesdir}/%{name}.conf

%if ! %{no_gnome_askpass}

install contrib/gnome-ssh-askpass $RPM_BUILD_ROOT%{_libexecdir}/openssh/gnome-ssh-askpass

%endif

%if ! %{no_gnome_askpass}

ln -s gnome-ssh-askpass $RPM_BUILD_ROOT%{_libexecdir}/openssh/ssh-askpass

install -m 755 -d $RPM_BUILD_ROOT%{_sysconfdir}/profile.d/

install -m 755 contrib/redhat/gnome-ssh-askpass.csh $RPM_BUILD_ROOT%{_sysconfdir}/profile.d/

install -m 755 contrib/redhat/gnome-ssh-askpass.sh $RPM_BUILD_ROOT%{_sysconfdir}/profile.d/

%endif

%if %{no_gnome_askpass}

rm -f $RPM_BUILD_ROOT/etc/profile.d/gnome-ssh-askpass.*

%endif

perl -pi -e "s|$RPM_BUILD_ROOT||g" $RPM_BUILD_ROOT%{_mandir}/man*/*

%if %{pam_ssh_agent}

pushd pam_ssh_agent_auth-%{pam_ssh_agent_ver}

make install DESTDIR=$RPM_BUILD_ROOT

popd

%endif

%clean

rm -rf $RPM_BUILD_ROOT

%pre

getent group ssh_keys >/dev/null || groupadd -r ssh_keys || :

%pre server

getent group sshd >/dev/null || groupadd -g %{sshd_uid} -r sshd || :

getent passwd sshd >/dev/null || \

  useradd -c "Privilege-separated SSH" -u %{sshd_uid} -g sshd \

  -s /sbin/nologin -r -d /var/empty/sshd sshd 2> /dev/null || :

%post server

%systemd_post sshd.service sshd.socket

%preun server

%systemd_preun sshd.service sshd.socket

%postun server

%systemd_postun_with_restart sshd.service

%triggerun -n openssh-server -- openssh-server < 5.8p2-12

/usr/bin/systemd-sysv-convert --save sshd >/dev/null 2>&1 || :

/bin/systemctl enable sshd.service >/dev/null 2>&1

/sbin/chkconfig --del sshd >/dev/null 2>&1 || :

/bin/systemctl try-restart sshd.service >/dev/null 2>&1 || :

%triggerun -n openssh-server -- openssh-server < 5.9p1-22

/bin/systemctl --no-reload disable sshd-keygen.service >/dev/null 2>&1 || :

%files

%defattr(-,root,root)

%{!?_licensedir:%global license %%doc}

%license LICENCE

%doc CREDITS ChangeLog INSTALL OVERVIEW PROTOCOL* README README.platform README.privsep README.tun README.dns TODO

%attr(0755,root,root) %dir %{_sysconfdir}/ssh

%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ssh/moduli

%if ! %{rescue}

%attr(0755,root,root) %{_bindir}/ssh-keygen

%attr(0644,root,root) %{_mandir}/man1/ssh-keygen.1*

%attr(0755,root,root) %dir %{_libexecdir}/openssh

%attr(2111,root,ssh_keys) %{_libexecdir}/openssh/ssh-keysign

%attr(0644,root,root) %{_mandir}/man8/ssh-keysign.8*

%endif

%files clients

%defattr(-,root,root)

%attr(0755,root,root) %{_bindir}/ssh

%attr(0644,root,root) %{_libdir}/fipscheck/ssh.hmac

%attr(0644,root,root) %{_mandir}/man1/ssh.1*

%attr(0755,root,root) %{_bindir}/scp

%attr(0644,root,root) %{_mandir}/man1/scp.1*

%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ssh/ssh_config

%attr(0755,root,root) %{_bindir}/slogin

%attr(0644,root,root) %{_mandir}/man1/slogin.1*

%attr(0644,root,root) %{_mandir}/man5/ssh_config.5*

%if ! %{rescue}

%attr(2111,root,nobody) %{_bindir}/ssh-agent

%attr(0755,root,root) %{_bindir}/ssh-add

%attr(0755,root,root) %{_bindir}/ssh-keyscan

%attr(0755,root,root) %{_bindir}/sftp

%attr(0755,root,root) %{_bindir}/ssh-copy-id

%attr(0755,root,root) %{_libexecdir}/openssh/ssh-pkcs11-helper

%attr(0644,root,root) %{_mandir}/man1/ssh-agent.1*

%attr(0644,root,root) %{_mandir}/man1/ssh-add.1*

%attr(0644,root,root) %{_mandir}/man1/ssh-keyscan.1*

%attr(0644,root,root) %{_mandir}/man1/sftp.1*

%attr(0644,root,root) %{_mandir}/man1/ssh-copy-id.1*

%attr(0644,root,root) %{_mandir}/man8/ssh-pkcs11-helper.8*

%endif

%if ! %{rescue}

%files server

%defattr(-,root,root)

%dir %attr(0711,root,root) %{_var}/empty/sshd

%attr(0755,root,root) %{_sbindir}/sshd

%attr(0755,root,root) %{_sbindir}/sshd-keygen

%attr(0644,root,root) %{_libdir}/fipscheck/sshd.hmac

%attr(0755,root,root) %{_libexecdir}/openssh/sftp-server

%attr(0644,root,root) %{_mandir}/man5/sshd_config.5*

%attr(0644,root,root) %{_mandir}/man5/moduli.5*

%attr(0644,root,root) %{_mandir}/man8/sshd.8*

%attr(0644,root,root) %{_mandir}/man8/sftp-server.8*

%attr(0600,root,root) %config(noreplace) %{_sysconfdir}/ssh/sshd_config

%attr(0644,root,root) %config(noreplace) /etc/pam.d/sshd

%attr(0640,root,root) %config(noreplace) /etc/sysconfig/sshd

%attr(0644,root,root) %{_unitdir}/sshd.service

%attr(0644,root,root) %{_unitdir}/sshd@.service

%attr(0644,root,root) %{_unitdir}/sshd.socket

%attr(0644,root,root) %{_unitdir}/sshd-keygen.service

%attr(0644,root,root) %{_tmpfilesdir}/openssh.conf

%endif

%if %{ldap}

%files ldap

%defattr(-,root,root)

%doc HOWTO.ldap-keys openssh-lpk-openldap.schema openssh-lpk-sun.schema ldap.conf

%attr(0755,root,root) %{_libexecdir}/openssh/ssh-ldap-helper

%attr(0755,root,root) %{_libexecdir}/openssh/ssh-ldap-wrapper

%attr(0644,root,root) %{_mandir}/man8/ssh-ldap-helper.8*

%attr(0644,root,root) %{_mandir}/man5/ssh-ldap.conf.5*

%endif

%files keycat

%defattr(-,root,root)

%doc HOWTO.ssh-keycat

%attr(0755,root,root) %{_libexecdir}/openssh/ssh-keycat

%attr(0644,root,root) %config(noreplace) /etc/pam.d/ssh-keycat

%if ! %{no_gnome_askpass}

%files askpass

%defattr(-,root,root)

%attr(0644,root,root) %{_sysconfdir}/profile.d/gnome-ssh-askpass.*

%attr(0755,root,root) %{_libexecdir}/openssh/gnome-ssh-askpass

%attr(0755,root,root) %{_libexecdir}/openssh/ssh-askpass

%endif

%files cavs

%attr(0755,root,root) %{_libexecdir}/openssh/ctr-cavstest

%attr(0755,root,root) %{_libexecdir}/openssh/ssh-cavs

%attr(0755,root,root) %{_libexecdir}/openssh/ssh-cavs_driver.pl

%if %{pam_ssh_agent}

%files -n pam_ssh_agent_auth

%defattr(-,root,root)

%{!?_licensedir:%global license %%doc}

%license pam_ssh_agent_auth-%{pam_ssh_agent_ver}/OPENSSH_LICENSE

%attr(0755,root,root) %{_libdir}/security/pam_ssh_agent_auth.so

%attr(0644,root,root) %{_mandir}/man8/pam_ssh_agent_auth.8*

%endif

%changelog

* Tue Mar 24 2015 Jakub Jelen <jjelen@redhat.com> 6.8p1-1 + 0.9.3-5

- new upstream release openssh-6.8p1 (#1203245)

- Resolve segfault with auditing commands (#1203900)

- Workaround krb5-config bug (#1204646)

* Thu Mar 12 2015 Jakub Jelen <jjelen@redhat.com> 6.7p1-11 + 0.9.3-4

- Ability to specify LDAP filter in ldap.conf for ssh-ldap-helper

- Fix auditing when using combination of ForceCommand and PTY

- Add sftp option to force mode of created files (from rhel)

- Fix tmpfiles.d entries to be more consistent (#1196807)

* Mon Mar 02 2015 Jakub Jelen <jjelen@redhat.com> 6.7p1-10 + 0.9.3-4

- Add tmpfiles.d entries (#1196807)

* Fri Feb 27 2015 Jakub Jelen <jjelen@redhat.com> 6.7p1-9 + 0.9.3-4

- Adjust seccomp filter for primary architectures and solve aarch64 issue (#1197051)

- Solve issue with ssh-copy-id and keys without trailing newline (#1093168)

* Tue Feb 24 2015 Jakub Jelen <jjelen@redhat.com> 6.7p1-8 + 0.9.3-4

- Add AArch64 support for seccomp_filter sandbox (#1195065)

* Mon Feb 23 2015 Jakub Jelen <jjelen@redhat.com> 6.7p1-7 + 0.9.3-4

- Fix seccomp filter on architectures without getuid32

* Mon Feb 23 2015 Jakub Jelen <jjelen@redhat.com> 6.7p1-6 + 0.9.3-4

- Update seccomp filter to work on i686 architectures (#1194401)

- Fix previous failing build (#1195065)

* Sun Feb 22 2015 Peter Robinson <pbrobinson@fedoraproject.org> 6.7p1-5 + 0.9.3-4

- Only use seccomp for sandboxing on supported platforms

* Fri Feb 20 2015 Jakub Jelen <jjelen@redhat.com> 6.7p1-4 + 0.9.3-4

- Move cavs tests into subpackage -cavs (#1194320)

* Wed Feb 18 2015 Jakub Jelen <jjelen@redhat.com> 6.7p1-3 + 0.9.3-4

- update coverity patch

- make output of sshd -T more consistent (#1187521)

- enable seccomp for sandboxing instead of rlimit (#1062953)

- update hardening to compile on gcc5

- Add SSH KDF CAVS test driver (#1193045)

- Fix ssh-copy-id on non-sh remote shells (#1045191)

* Tue Jan 27 2015 Jakub Jelen <jjelen@redhat.com> 6.7p1-2 + 0.9.3-4

- fixed audit patch after rebase

* Tue Jan 20 2015 Petr Lautrbach <plautrba@redhat.com> 6.7p1-1 + 0.9.3-4

- new upstream release openssh-6.7p1

* Thu Jan 15 2015 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-11.1 + 0.9.3-3

- error message if scp when directory doesn't exist (#1142223)

- parsing configuration file values (#1130733)

- documentation in service and socket files for systemd (#1181593)

- updated ldap patch (#981058)

- fixed vendor-patchlevel

- add new option GSSAPIEnablek5users and disable using ~/.k5users by default CVE-2014-9278 (#1170745)

* Fri Dec 19 2014 Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-10 + 0.9.3-3

- log via monitor in chroots without /dev/log

* Wed Dec 03 2014 Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-9 + 0.9.3-3

- the .local domain example should be in ssh_config, not in sshd_config

- use different values for DH for Cisco servers (#1026430)

* Thu Nov 13 2014 Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-8 + 0.9.3-3

- fix gsskex patch to correctly handle MONITOR_REQ_GSSSIGN request (#1118005)

* Fri Nov 07 2014 Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-7 + 0.9.3-3

- correct the calculation of bytes for authctxt->krb5_ccname <ams@corefiling.com> (#1161073)

* Tue Nov 04 2014 Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-6 + 0.9.3-3

- privsep_preauth: use SELinux context from selinux-policy (#1008580)

- change audit trail for unknown users (mindrot#2245)

- fix kuserok patch which checked for the existence of .k5login

  unconditionally and hence prevented other mechanisms to be used properly

- revert the default of KerberosUseKuserok back to yes (#1153076)

- ignore SIGXFSZ in postauth monitor (mindrot#2263)

- sshd-keygen - don't generate DSA and ED25519 host keys in FIPS mode

* Mon Sep 08 2014 Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-5 + 0.9.3-3

- set a client's address right after a connection is set (mindrot#2257)

- apply RFC3454 stringprep to banners when possible (mindrot#2058)

- don't consider a partial success as a failure (mindrot#2270)

* Sun Aug 17 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 6.6.1p1-4.1

- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild

* Fri Jul 18 2014 Tom Callaway <spot@fedoraproject.org> 6.6.1p1-4 + 0.9.3-3

- fix license handling (both)

* Fri Jul 18 2014 Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-3 + 0.9.3-2

- standardise on NI_MAXHOST for gethostname() string lengths (#1051490)

* Mon Jul 14 2014 Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-2 + 0.9.3-2

- add pam_reauthorize.so to sshd.pam (#1115977)

- spec file and patches clenup

* Sat Jun 07 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 6.6.1p1-1.1

- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild

* Tue Jun 03 2014 Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-1 + 0.9.3-2

- disable the curve25519 KEX when speaking to OpenSSH 6.5 or 6.6

- add support for ED25519 keys to sshd-keygen and sshd.sysconfig

- drop openssh-server-sysvinit subpackage

- slightly change systemd units logic - use sshd-keygen.service (#1066615)

* Tue Jun 03 2014 Petr Lautrbach <plautrba@redhat.com> 6.6p1-1 + 0.9.3-2

- new upstream release openssh-6.6p1

* Thu May 15 2014 Petr Lautrbach <plautrba@redhat.com> 6.4p1-4 + 0.9.3-1

- use SSH_COPY_ID_LEGACY variable to run ssh-copy-id in the legacy mode

- make /etc/ssh/moduli file public (#1043661)

- test existence of /etc/ssh/ssh_host_ecdsa_key in sshd-keygen.service

- don't clean up gssapi credentials by default (#1055016)

- ssh-agent - try CLOCK_BOOTTIME with fallback (#1091992)

- prevent a server from skipping SSHFP lookup - CVE-2014-2653 (#1081338)

- ignore environment variables with embedded '=' or '\0' characters - CVE-2014-2532

  (#1077843)