jonathan/openssh
1
0
Fork 0
forked from rpms/openssh
Code Pull Requests Activity
An open source implementation of SSH protocol versions 1 and 2
1,157 Commits 9 Branches 48 Tags 7.1 MiB
Shell 100%
08d842d5e8
Go to file
Dusty Mabe 08d842d5e8
Use a service unit to strip ssh_keys group from host keys (rhbz#2172956) 
Use a systemd service unit to strip the ssh_keys group and change the
mode for host keys. This ensure that this migration is done right before
the openssh server startup on all kind of systems, either RPM or
rpm-ostree based.

Use a marker file to only do this once. We need to keep this service
unit for two Fedora releases so we will be able to remove it in Fedora
40.

See: https://fedoraproject.org/wiki/Changes/SSHKeySignSuidBit
Fixes: 7a21555 Get rid of ssh_keys group for new installations
Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2172956

Co-authored-by: Timothée Ravier <tim@siosm.fr>
2023-03-03 09:56:51 -05:00
tests tests: Make sure the user gets removed and the test pass 2019-06-17 13:31:57 +02:00
.gitignore OpenSSH Rebase to 9.0p1 2022-08-15 09:28:25 +02:00
openssh-4.3p2-askpass-grab-info.patch OpenSSH release update 2021-04-29 16:37:35 +02:00
openssh-5.1p1-askpass-progress.patch OpenSSH release update 2021-04-29 16:37:35 +02:00
openssh-5.8p2-sigpipe.patch OpenSSH Rebase to 9.0p1 2022-08-15 09:28:25 +02:00
openssh-5.9p1-ipv6man.patch ignore SIGPIPE in ssh keyscan 2011-09-07 15:12:54 +02:00
openssh-6.3p1-ctr-evp-fast.patch rebase for openssh-6.3p1, remove unused patches (#1007769) 2013-10-14 15:54:41 +02:00
openssh-6.4p1-fromto-remote.patch use tty allocation for a remote scp 2014-01-23 18:30:39 +01:00
openssh-6.6.1p1-log-in-chroot.patch OpenSSH Rebase to 9.0p1 2022-08-15 09:28:25 +02:00
openssh-6.6.1p1-scp-non-existing-directory.patch openssh-8.1p1-1 + 0.10.3-8 2019-10-09 10:24:21 +02:00
openssh-6.6.1p1-selinux-contexts.patch openssh-8.5p1-1 + 0.10.4-2 2021-03-03 11:08:52 +01:00
openssh-6.6p1-allow-ip-opts.patch Check IP opts length 2022-10-21 17:53:00 +02:00
openssh-6.6p1-force_krb.patch rebase patches to openssh-7.9p1 2018-10-19 11:41:07 +02:00
openssh-6.6p1-GSSAPIEnablek5users.patch OpenSSH 8.7p1 patches rebase 2021-09-01 16:35:39 +02:00
openssh-6.6p1-keycat.patch openssh-8.5p1-1 + 0.10.4-2 2021-03-03 11:08:52 +01:00
openssh-6.6p1-kuserok.patch OpenSSH 8.8p1 rebase 2021-11-29 14:37:28 +01:00
openssh-6.6p1-privsep-selinux.patch openssh-8.5p1-1 + 0.10.4-2 2021-03-03 11:08:52 +01:00
openssh-6.7p1-coverity.patch OpenSSH Rebase to 9.0p1 2022-08-15 09:28:25 +02:00
openssh-6.7p1-sftp-force-permission.patch 8.4p1-1 + 0.10.4-1 2020-09-29 14:53:14 +02:00
openssh-6.8p1-sshdT-output.patch openssh-8.2p1-1 + 0.10.3-9 2020-02-17 14:34:41 +01:00
openssh-7.1p2-audit-race-condition.patch openssh-8.5p1-1 + 0.10.4-2 2021-03-03 11:08:52 +01:00
openssh-7.2p2-k5login_directory.patch openssh-8.5p1-1 + 0.10.4-2 2021-03-03 11:08:52 +01:00
openssh-7.2p2-s390-closefrom.patch openssh-8.1p1-1 + 0.10.3-8 2019-10-09 10:24:21 +02:00
openssh-7.2p2-x11.patch openssh-8.1p1-1 + 0.10.3-8 2019-10-09 10:24:21 +02:00
openssh-7.3p1-x11-max-displays.patch OpenSSH Rebase to 9.0p1 2022-08-15 09:28:25 +02:00
openssh-7.4p1-systemd.patch Avoid sending SD_NOTIFY from wrong processes (#1427526) 2017-02-28 15:13:24 +01:00
openssh-7.5p1-sandbox.patch openssh-8.1p1-1 + 0.10.3-8 2019-10-09 10:24:21 +02:00
openssh-7.6p1-audit.patch OpenSSH Rebase to 9.0p1 2022-08-15 09:28:25 +02:00
openssh-7.6p1-cleanup-selinux.patch openssh-8.5p1-1 + 0.10.4-2 2021-03-03 11:08:52 +01:00
openssh-7.7p1-fips.patch Fix build against updated OpenSSL 2023-01-09 12:48:20 +01:00
openssh-7.7p1-gssapi-new-unique.patch OpenSSH 8.8p1 rebase 2021-11-29 14:37:28 +01:00
openssh-7.7p1-redhat.patch Disable locale forwarding in OpenSSH 2022-04-29 11:43:53 +02:00
openssh-7.8p1-role-mls.patch OpenSSH Rebase to 9.0p1 2022-08-15 09:28:25 +02:00
openssh-7.8p1-scp-ipv6.patch Unbreak scp between two IPv6 hosts (#1620333) 2018-08-31 13:26:44 +02:00
openssh-7.8p1-UsePAM-warning.patch OpenSSH Rebase to 9.0p1 2022-08-15 09:28:25 +02:00
openssh-8.0p1-crypto-policies.patch Mark HostbasedAcceptedAlgorithms as governed by crypto-policies 2022-08-24 13:11:22 +02:00
openssh-8.0p1-gssapi-keyex.patch OpenSSH Rebase to 9.0p1 2022-08-15 09:28:25 +02:00
openssh-8.0p1-keygen-strip-doseol.patch Fixes from RHEL 8.5.0 2021-04-29 16:37:35 +02:00
openssh-8.0p1-openssl-evp.patch Use OpenSSL high-level API to produce and verify signatures 2019-05-14 13:32:04 +02:00
openssh-8.0p1-openssl-kdf.patch openssh-8.5p1-1 + 0.10.4-2 2021-03-03 11:08:52 +01:00
openssh-8.0p1-pkcs11-uri.patch OpenSSH Rebase to 9.0p1 2022-08-15 09:28:25 +02:00
openssh-8.0p1-preserve-pam-errors.patch Fixes from RHEL 8.5.0 2021-04-29 16:37:35 +02:00
openssh-8.2p1-visibility.patch 8.3p1-1 + 0.10.3-10 2020-05-27 09:57:29 +02:00
openssh-8.2p1-x11-without-ipv6.patch openssh-8.5p1-1 + 0.10.4-2 2021-03-03 11:08:52 +01:00
openssh-8.7p1-evpgenkey.patch Add patches from CentOS/RHEL9.1 2022-08-10 19:58:47 +02:00
openssh-8.7p1-gssapi-auth.patch Add patches from CentOS/RHEL9.1 2022-08-10 19:58:47 +02:00
openssh-8.7p1-ibmca.patch OpenSSH Rebase to 9.0p1 2022-08-15 09:28:25 +02:00
openssh-8.7p1-mem-leak.patch Add patches from CentOS/RHEL9.1 2022-08-10 19:58:47 +02:00
openssh-8.7p1-minrsabits.patch RSAMinSize => RequiredRSASize 2022-09-29 15:42:34 +02:00
openssh-8.7p1-negotiate-supported-algs.patch OpenSSH Rebase to 9.0p1 2022-08-15 09:28:25 +02:00
openssh-8.7p1-recursive-scp.patch OpenSSH Rebase to 9.0p1 2022-08-15 09:28:25 +02:00
openssh-8.7p1-scp-clears-file.patch OpenSSH Rebase to 9.0p1 2022-08-15 09:28:25 +02:00
openssh-8.7p1-scp-kill-switch.patch fixup! OpenSSH 8.7p1 patches rebase 2021-09-16 16:13:20 +02:00
openssh-8.7p1-ssh-manpage.patch RSAMinSize => RequiredRSASize 2022-09-29 15:42:34 +02:00
openssh-8.8p1-skip-some-tests.patch OpenSSH Rebase to 9.0p1 2022-08-15 09:28:25 +02:00
openssh-9.0p1-audit-log.patch Add additional audit loggin 2022-10-24 19:22:09 +02:00
openssh-server-systemd-sysusers.conf openssh: move users/groups creation logic to sysusers.d fragments 2022-09-02 14:47:11 +00:00
openssh.rpmlintrc Use /usr/share/empty.ssh instead of /var/empty/sshd 2021-01-22 12:57:36 +01:00
openssh.spec Use a service unit to strip ssh_keys group from host keys (rhbz#2172956) 2023-03-03 09:56:51 -05:00
pam_ssh_agent_auth-0.9.2-visibility.patch Reabse to latest release of pam_ssh_agent_auth with preserving current functionality 2016-01-25 13:32:42 +01:00
pam_ssh_agent_auth-0.9.3-agent_structure.patch Address issues reported by coverity 2018-08-31 13:26:44 +02:00
pam_ssh_agent_auth-0.9.3-build.patch Rebase pam_ssh_agent_auth to 0.10.4 2020-09-29 14:53:14 +02:00
pam_ssh_agent_auth-0.10.2-compat.patch Rebase pam_ssh_agent_auth to 0.10.4 2020-09-29 14:53:14 +02:00
pam_ssh_agent_auth-0.10.2-dereference.patch openssh-7.8p1-1 + 0.10.3-5 2018-08-24 23:16:24 +02:00
pam_ssh_agent_auth-0.10.3-seteuid.patch Check seteuid return values in all cases 2017-02-22 14:56:00 +01:00
pam_ssh_agent_auth-0.10.4-rsasha2.patch Add patches from CentOS/RHEL9.1 2022-08-10 19:58:47 +02:00
pam_ssh_agent-rmheaders Rebase pam_ssh_agent_auth to 0.10.4 2020-09-29 14:53:14 +02:00
sources OpenSSH Rebase to 9.0p1 2022-08-15 09:28:25 +02:00
ssh-agent.service fix(ssh-agent): remove the socket in ExecStartPre 2022-10-05 19:58:14 -04:00
ssh-agent.socket openssh-clients: create a user socket unit for ssh-agent (rhbz#2125576) 2022-10-05 19:58:11 -04:00
ssh-host-keys-migration.service Use a service unit to strip ssh_keys group from host keys (rhbz#2172956) 2023-03-03 09:56:51 -05:00
ssh-host-keys-migration.sh Use a service unit to strip ssh_keys group from host keys (rhbz#2172956) 2023-03-03 09:56:51 -05:00
ssh-keycat.pam improove ssk-keycat (documentation) 2011-03-04 15:22:12 +01:00
sshd-keygen Get rid of ssh_keys group for new installations 2023-01-23 16:01:47 +01:00
sshd-keygen.target Add sshd-keygen.target to abstract key creation from sshd.service and sshd@.service (#1325535) 2016-04-15 17:05:32 +02:00
sshd-keygen@.service Add sshd-keygen.target to abstract key creation from sshd.service and sshd@.service (#1325535) 2016-04-15 17:05:32 +02:00
sshd.pam Add pam_motd to the PAM stack 2018-06-14 11:28:51 -04:00
sshd.service Drop loading of anaconda configuration from sysconfig including scriptlet to migrate to include drop-in directory 2020-07-31 15:26:55 +02:00
sshd.socket Add missing documentation link to systemd service files (RHBZ#1181593) 2015-01-14 16:51:44 +01:00
sshd.sysconfig Drop misleading comment about crypto policies 2020-10-06 10:01:41 +02:00
sshd@.service Drop loading of anaconda configuration from sysconfig including scriptlet to migrate to include drop-in directory 2020-07-31 15:26:55 +02:00