Re: [gentoo-dev] openssh exploit

[Mishael A Sibiryakov]

I've been download this file:
ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-3.7p1.tar.gz
and building openssh without any patch. Gcc version is "gcc version
3.3.1 20030904 (Gentoo Linux 3.3.1-r1, propolice)"


>>> net-misc/openssh-3.7_p1 merged.
>>> clean: No packages selected for removal.
>>> Regenerating /etc/ld.so.cache...
>>> Auto-cleaning packages ...
>>> No outdated packages were found on your system.
 * GNU info directory index is up-to-date.
 * IMPORTANT: 2 config files in /etc need updating.
 * Type emerge --help config to learn how to update config files.


This ebuild is working perfectly :)

junki openssh # cat openssh-3.7_p1.ebuild
inherit eutils
IUSE="ipv6 static pam tcpd kerberos selinux"
PARCH=${P/_/}
S=${WORKDIR}/${PARCH}
DESCRIPTION="Port of OpenBSD's free SSH release"
HOMEPAGE="http://www.openssh.com/"
SRC_URI="ftp://ftp.openbsd.org/pub/unix/OpenBSD/OpenSSH/portable/${PARCH}.tar.gz"

RDEPEND="virtual/glibc
        pam? ( >=sys-libs/pam-0.73 >=sys-apps/shadow-4.0.2-r2 )
        kerberos? ( app-crypt/mit-krb5 )
        selinux? ( sys-apps/selinux-small )
        >=dev-libs/openssl-0.9.6d
        sys-libs/zlib"

DEPEND="${RDEPEND}
        dev-lang/perl
        sys-apps/groff
        tcpd? ( >=sys-apps/tcp-wrappers-7.6 )"


SLOT="0"
LICENSE="as-is"
KEYWORDS="x86 ppc sparc alpha mips hppa arm amd64"

src_unpack() {
        unpack ${PARCH}.tar.gz
        cd ${S}
}

src_compile() {
        local myconf
        use tcpd || myconf="${myconf} --without-tcp-wrappers"
        use tcpd && myconf="${myconf} --with-tcp-wrappers"
        use pam  || myconf="${myconf} --without-pam"
        use pam  && myconf="${myconf} --with-pam"
        use ipv6 || myconf="${myconf} --with-ipv4-default"

        use kerberos && myconf="${myconf} --with-kerberos5"

        if [ ! -z $KTH_KRB ]; then
                myconf="${myconf} --with-kerberos4=/usr/athena"
        fi

        use selinux && CFLAGS="${CFLAGS} -DWITH_SELINUX"

        ./configure \
                --prefix=/usr \
                --sysconfdir=/etc/ssh \
                --mandir=/usr/share/man \
                --libexecdir=/usr/lib/misc \
                --datadir=/usr/share/openssh \
                --disable-suid-ssh \
                --with-privsep-path=/var/empty \
                --with-privsep-user=sshd \
                --with-md5-passwords \
                --host=${CHOST} ${myconf} || die "bad configure"

        if [ "`use static`" ]
        then
                # statically link to libcrypto -- good for the boot cd
                perl -pi -e "s|-lcrypto|/usr/lib/libcrypto.a|g" Makefile
        fi

        if [ "`use selinux`" ]
        then
                #add -lsecure
                sed "s:LIBS=\(.*\):LIBS=\1 -lsecure:" < Makefile >
Makefile.new
                mv Makefile.new Makefile
        fi

        emake || die "compile problem"
}

src_install() {
        make install-files DESTDIR=${D} || die
        chmod 600 ${D}/etc/ssh/sshd_config
        dodoc ChangeLog CREDITS OVERVIEW README* TODO sshd_config
        insinto /etc/pam.d  ; newins ${FILESDIR}/sshd.pam sshd
        exeinto /etc/init.d ; newexe ${FILESDIR}/sshd.rc6 sshd
        touch ${D}/var/empty/.keep
}

pkg_preinst() {

        userdel sshd 2> /dev/null
        if ! groupmod sshd; then
                groupadd -g 90 sshd 2> /dev/null || \
                        die "Failed to create sshd group"
        fi
        useradd -u 22 -g sshd -s /dev/null -d /var/empty -c "sshd" sshd
|| \
                die "Failed to create sshd user"

}

pkg_postinst() {

        install -d -m0755 -o root -g root ${ROOT}/var/empty

        if use pam >/dev/null 2>&1; then
                einfo "Please be aware users need a valid shell in
/etc/passwd"
                einfo "in order to be allowed to login."
                einfo
        fi
}
junki openssh #

--
Time    : 20:07:41-16:09:2003
NP      : Enigma (Radio Edit) - Principles Of Lust
SysStat : 20:07:41 up 14 days, 11:49, 2 users, load average: 2.82, 2.07,
1.20


--
gentoo-dev@g.o mailing list