From 5b02ff8c98be1f3f3a5140da705a4206321de8bc Mon Sep 17 00:00:00 2001 From: Sayan Chowdhury Date: Tue, 12 Oct 2021 11:56:41 +0530 Subject: [PATCH] net-misc/openssh: Apply Flatcar patches - Drop the init.d files. - Remove the socket unit's rate limiting. Instead of dropping bindist, enable it with the profiles now so it doesn't need to be modified on future updates. Signed-off-by: Sayan Chowdhury Signed-off-by: Dongsu Park --- net-misc/openssh/files/sshd-r1.confd | 33 --------- net-misc/openssh/files/sshd-r1.initd | 87 ----------------------- net-misc/openssh/files/sshd.socket | 1 + net-misc/openssh/openssh-8.8_p1-r3.ebuild | 2 - 4 files changed, 1 insertion(+), 122 deletions(-) delete mode 100644 net-misc/openssh/files/sshd-r1.confd delete mode 100644 net-misc/openssh/files/sshd-r1.initd diff --git a/net-misc/openssh/files/sshd-r1.confd b/net-misc/openssh/files/sshd-r1.confd deleted file mode 100644 index cf430371bf0..00000000000 --- a/net-misc/openssh/files/sshd-r1.confd +++ /dev/null @@ -1,33 +0,0 @@ -# /etc/conf.d/sshd: config file for /etc/init.d/sshd - -# Where is your sshd_config file stored? - -SSHD_CONFDIR="${RC_PREFIX%/}/etc/ssh" - - -# Any random options you want to pass to sshd. -# See the sshd(8) manpage for more info. - -SSHD_OPTS="" - - -# Wait one second (length chosen arbitrarily) to see if sshd actually -# creates a PID file, or if it crashes for some reason like not being -# able to bind to the address in ListenAddress. - -#SSHD_SSD_OPTS="--wait 1000" - - -# Pid file to use (needs to be absolute path). - -#SSHD_PIDFILE="${RC_PREFIX%/}/run/sshd.pid" - - -# Path to the sshd binary (needs to be absolute path). - -#SSHD_BINARY="${RC_PREFIX%/}/usr/sbin/sshd" - - -# Path to the ssh-keygen binary (needs to be absolute path). - -#SSHD_KEYGEN_BINARY="${RC_PREFIX%/}/usr/bin/ssh-keygen" diff --git a/net-misc/openssh/files/sshd-r1.initd b/net-misc/openssh/files/sshd-r1.initd deleted file mode 100644 index e91cd0116cd..00000000000 --- a/net-misc/openssh/files/sshd-r1.initd +++ /dev/null @@ -1,87 +0,0 @@ -#!/sbin/openrc-run -# Copyright 1999-2019 Gentoo Authors -# Distributed under the terms of the GNU General Public License v2 - -extra_commands="checkconfig" -extra_started_commands="reload" - -: ${SSHD_CONFDIR:=${RC_PREFIX%/}/etc/ssh} -: ${SSHD_CONFIG:=${SSHD_CONFDIR}/sshd_config} -: ${SSHD_PIDFILE:=${RC_PREFIX%/}/run/${SVCNAME}.pid} -: ${SSHD_BINARY:=${RC_PREFIX%/}/usr/sbin/sshd} -: ${SSHD_KEYGEN_BINARY:=${RC_PREFIX%/}/usr/bin/ssh-keygen} - -command="${SSHD_BINARY}" -pidfile="${SSHD_PIDFILE}" -command_args="${SSHD_OPTS} -o PidFile=${pidfile} -f ${SSHD_CONFIG}" - -# Wait one second (length chosen arbitrarily) to see if sshd actually -# creates a PID file, or if it crashes for some reason like not being -# able to bind to the address in ListenAddress (bug 617596). -: ${SSHD_SSD_OPTS:=--wait 1000} -start_stop_daemon_args="${SSHD_SSD_OPTS}" - -depend() { - # Entropy can be used by ssh-keygen, among other things, but - # is not strictly required (bug 470020). - use logger dns entropy - if [ "${rc_need+set}" = "set" ] ; then - : # Do nothing, the user has explicitly set rc_need - else - local x warn_addr - for x in $(awk '/^ListenAddress/{ print $2 }' "$SSHD_CONFIG" 2>/dev/null) ; do - case "${x}" in - 0.0.0.0|0.0.0.0:*) ;; - ::|\[::\]*) ;; - *) warn_addr="${warn_addr} ${x}" ;; - esac - done - if [ -n "${warn_addr}" ] ; then - need net - ewarn "You are binding an interface in ListenAddress statement in your sshd_config!" - ewarn "You must add rc_need=\"net.FOO\" to your ${RC_PREFIX%/}/etc/conf.d/sshd" - ewarn "where FOO is the interface(s) providing the following address(es):" - ewarn "${warn_addr}" - fi - fi -} - -checkconfig() { - checkpath --mode 0755 --directory "${RC_PREFIX%/}/var/empty" - - if [ ! -e "${SSHD_CONFIG}" ] ; then - eerror "You need an ${SSHD_CONFIG} file to run sshd" - eerror "There is a sample file in /usr/share/doc/openssh" - return 1 - fi - - ${SSHD_KEYGEN_BINARY} -A || return 2 - - "${command}" -t ${command_args} || return 3 -} - -start_pre() { - # Make sure that the user's config isn't busted before we try - # to start the daemon (this will produce better error messages - # than if we just try to start it blindly). - # - # We always need to call checkconfig because this function will - # also generate any missing host key and you can start a - # non-running service with "restart" argument. - checkconfig || return $? -} - -stop_pre() { - # If this is a restart, check to make sure the user's config - # isn't busted before we stop the running daemon. - if [ "${RC_CMD}" = "restart" ] ; then - checkconfig || return $? - fi -} - -reload() { - checkconfig || return $? - ebegin "Reloading ${SVCNAME}" - start-stop-daemon --signal HUP --pidfile "${pidfile}" - eend $? -} diff --git a/net-misc/openssh/files/sshd.socket b/net-misc/openssh/files/sshd.socket index 94b9533180d..d19f34be865 100644 --- a/net-misc/openssh/files/sshd.socket +++ b/net-misc/openssh/files/sshd.socket @@ -5,6 +5,7 @@ Conflicts=sshd.service [Socket] ListenStream=22 Accept=yes +TriggerLimitBurst=0 [Install] WantedBy=sockets.target diff --git a/net-misc/openssh/openssh-8.8_p1-r3.ebuild b/net-misc/openssh/openssh-8.8_p1-r3.ebuild index 1c106887871..49d9f7b6e12 100644 --- a/net-misc/openssh/openssh-8.8_p1-r3.ebuild +++ b/net-misc/openssh/openssh-8.8_p1-r3.ebuild @@ -402,8 +402,6 @@ src_install() { emake install-nokeys DESTDIR="${D}" fperms 600 /etc/ssh/sshd_config dobin contrib/ssh-copy-id - newinitd "${FILESDIR}"/sshd-r1.initd sshd - newconfd "${FILESDIR}"/sshd-r1.confd sshd if use pam; then newpamd "${FILESDIR}"/sshd.pam_include.2 sshd