diff options
Diffstat (limited to 'crypto/openssh/FREEBSD-upgrade')
| -rw-r--r-- | crypto/openssh/FREEBSD-upgrade | 130 |
1 files changed, 0 insertions, 130 deletions
diff --git a/crypto/openssh/FREEBSD-upgrade b/crypto/openssh/FREEBSD-upgrade deleted file mode 100644 index edc200809c73..000000000000 --- a/crypto/openssh/FREEBSD-upgrade +++ /dev/null @@ -1,130 +0,0 @@ - - - FreeBSD maintainer's guide to OpenSSH-portable - ============================================== - - -0) Make sure your mail spool has plenty of free space. It'll fill up - pretty fast once you're done with this checklist. - -1) Grab the latest OpenSSH-portable tarball from the OpenBSD FTP - site (ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/) - -2) Unpack the tarball in a suitable directory. - -3) Remove trash: - - $ eval "rm -rvf $(tr '[:space:]' ' ' </usr/src/crypto/openssh/FREEBSD-Xlist)" - - Make sure that took care of everything, and if it didn't, make sure - to update FREEBSD-Xlist so you won't miss it the next time. - -4) Import the sources: - - $ cvs import src/crypto/openssh OPENSSH OpenSSH_X_YpZ - -5) Resolve conflicts. Remember to bump the version number and - addendum in version.h. - -6) Generate configure and config.h.in: - - $ autoconf - $ autoheader - - Note: this requires a recent version of autoconf, not autoconf213. - -7) Run configure with the appropriate arguments: - - $ ./configure --prefix=/usr --sysconfdir=/etc/ssh \ - --with-pam --with-tcp-wrappers - - Note that we don't want to configure OpenSSH for Kerberos using - configure since we have to be able to turn it on or off depending - on the value of MAKE_KERBEROS[45]. Our Makefiles take care of - this. - -8) Commit the resulting config.h. Make sure you don't accidentally - commit any other files created by autoconf, autoheader or - configure; they'll just clutter up the repo and cause trouble at - the next upgrade. - -9) Build and test. - -A) Re-commit everything on freefall (you *did* use a test repo for - this, didn't you?) - - - - An overview of FreeBSD changes to OpenSSH-portable - ================================================== - -0) VersionAddendum - - The SSH protocol allows for a human-readable version string of up - to 40 characters to be appended to the protocol version string. - FreeBSD takes advantage of this to include a date indicating the - "patch level", so people can easily determine whether their system - is vulnerable when an OpenSSH advisory goes out. Some people, - however, dislike advertising their patch level in the protocol - handshake, so we've added a VersionAddendum configuration variable - to allow them to change or disable it. - -1) Modified server-side defaults - - We've modified some configuration defaults in sshd: - - - For protocol version 2, we don't load RSA host keys by - default. If both RSA and DSA keys are present, we prefer DSA - to RSA. - - - LoginGraceTime defaults to 120 seconds instead of 600. - - - PermitRootLogin defaults to "no". - - - X11Forwarding defaults to "yes" (it's a threat to the client, - not to the server.) - - - Unless the config file says otherwise, we automatically enable - Kerberos support if an appropriate keytab is present. - - - PAMAuthenticationViaKbdInt defaults to "yes". - -2) Modified client-side defaults - - We've modified some configuration defaults in ssh: - - - For protocol version 2, if both RSA and DSA keys are present, - we prefer DSA to RSA. - - - CheckHostIP defaults to "no". - -3) Canonic host names - - We've added code to ssh.c to canonicize the target host name after - reading options but before trying to connect. This eliminates the - usual problem with duplicate known_hosts entries. - -4) OPIE - - We've added support for using OPIE as a drop-in replacement for - S/Key. - -5) PAM - - We use our own PAM code, which wraps PAM in a KbdintDevice and - works with privsep, instead of OpenSSH's own PAM code. - -6) setusercontext() environment - - Our setusercontext(3) can set environment variables, which we must - take care to transfer to the child's environment. - - - -This port was brought to you by (in no particular order) DARPA, NAI -Labs, ThinkSec, Nescafé, the Aberlour Glenlivet Distillery Co., -Suzanne Vega, and a Sanford's #69 Deluxe Marker. - - -- des@FreeBSD.org - -$FreeBSD$ |