commit 708d59ea8ee20858ae3f6ca24deea539523a1d17 Author: CapCreeperGR Date: Sat Jul 6 20:36:59 2024 +0000 Initial Commit diff --git a/pkg.info b/pkg.info new file mode 100644 index 0000000..6a9aeca --- /dev/null +++ b/pkg.info @@ -0,0 +1,8 @@ +name: openssh +description: The premier connectivity tool for remote login with the SSH protocol +version: 9.6p1 +url: https://www.openssh.com/ +license: BSD-2-Clause,BSD-3-Clause,ISC,LicenseRef-Public-Domain,MIT +architecture: any +type: source +keep: etc/sshd/ diff --git a/source-files/sshd-keygen.service b/source-files/sshd-keygen.service new file mode 100644 index 0000000..00d19d9 --- /dev/null +++ b/source-files/sshd-keygen.service @@ -0,0 +1,12 @@ +[Unit] +Description=Generate sshd keys +Before=ssh.server + +[Service] +Type=oneshot +ExecStart=/usr/bin/ssh-keygen -A +RemainAfterExit=true +StandardOutput=journal + +[Install] +WantedBy=multi-user.target diff --git a/source-files/sshd-pam b/source-files/sshd-pam new file mode 100644 index 0000000..d6ad268 --- /dev/null +++ b/source-files/sshd-pam @@ -0,0 +1,38 @@ +# Set failure delay before next prompt to 3 seconds +auth optional pam_faildelay.so delay=3000000 + +# Check to make sure that the user is allowed to login +auth requisite pam_nologin.so + +# Check to make sure that root is allowed to login +# Disabled by default. You will need to create /etc/securetty +# file for this module to function. See man 5 securetty. +#auth required pam_securetty.so + +# Additional group memberships - disabled by default +#auth optional pam_group.so + +# include system auth settings +auth include system-auth + +# check access for the user +account required pam_access.so + +# include system account settings +account include system-account + +# Set default environment variables for the user +session required pam_env.so + +# Set resource limits for the user +session required pam_limits.so + +# Display the message of the day - Disabled by default +#session optional pam_motd.so + +# Check user's mail - Disabled by default +#session optional pam_mail.so standard quiet + +# include system session and password settings +session include system-session +password include system-password diff --git a/source-files/sshd.service b/source-files/sshd.service new file mode 100644 index 0000000..e4d6c4f --- /dev/null +++ b/source-files/sshd.service @@ -0,0 +1,11 @@ +[Unit] +Description=OpenSSH Daemon + +[Service] +ExecStart=/usr/sbin/sshd -D +ExecReload=/bin/kill -HUP $MAINPID +KillMode=process +Restart=always + +[Install] +WantedBy=multi-user.target diff --git a/source-files/sshd_config b/source-files/sshd_config new file mode 100644 index 0000000..d96c433 --- /dev/null +++ b/source-files/sshd_config @@ -0,0 +1,116 @@ +# $OpenBSD: sshd_config,v 1.104 2021/07/02 05:11:21 dtucker Exp $ + +# This is the sshd server system-wide configuration file. See +# sshd_config(5) for more information. + +# This sshd was compiled with PATH=/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin + +# The strategy used for options in the default sshd_config shipped with +# OpenSSH is to specify options with their default value where +# possible, but leave them commented. Uncommented options override the +# default value. + +#Port 22 +#AddressFamily any +#ListenAddress 0.0.0.0 +#ListenAddress :: + +#HostKey /etc/ssh/ssh_host_rsa_key +#HostKey /etc/ssh/ssh_host_ecdsa_key +#HostKey /etc/ssh/ssh_host_ed25519_key + +# Ciphers and keying +#RekeyLimit default none + +# Logging +#SyslogFacility AUTH +#LogLevel INFO + +# Authentication: + +#LoginGraceTime 2m +#PermitRootLogin prohibit-password +#StrictModes yes +#MaxAuthTries 6 +#MaxSessions 10 + +#PubkeyAuthentication yes + +# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2 +# but this is overridden so installations will only check .ssh/authorized_keys +AuthorizedKeysFile .ssh/authorized_keys + +#AuthorizedPrincipalsFile none + +#AuthorizedKeysCommand none +#AuthorizedKeysCommandUser nobody + +# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts +#HostbasedAuthentication no +# Change to yes if you don't trust ~/.ssh/known_hosts for +# HostbasedAuthentication +#IgnoreUserKnownHosts no +# Don't read the user's ~/.rhosts and ~/.shosts files +#IgnoreRhosts yes + +# To disable tunneled clear text passwords, change to no here! +#PasswordAuthentication yes +#PermitEmptyPasswords no + +# Change to no to disable s/key passwords +#KbdInteractiveAuthentication yes + +# Kerberos options +#KerberosAuthentication no +#KerberosOrLocalPasswd yes +#KerberosTicketCleanup yes +#KerberosGetAFSToken no + +# GSSAPI options +#GSSAPIAuthentication no +#GSSAPICleanupCredentials yes + +# Set this to 'yes' to enable PAM authentication, account processing, +# and session processing. If this is enabled, PAM authentication will +# be allowed through the KbdInteractiveAuthentication and +# PasswordAuthentication. Depending on your PAM configuration, +# PAM authentication via KbdInteractiveAuthentication may bypass +# the setting of "PermitRootLogin prohibit-password". +# If you just want the PAM account and session checks to run without +# PAM authentication, then enable this but set PasswordAuthentication +# and KbdInteractiveAuthentication to 'no'. +UsePAM yes + +#AllowAgentForwarding yes +#AllowTcpForwarding yes +#GatewayPorts no +#X11Forwarding no +#X11DisplayOffset 10 +#X11UseLocalhost yes +#PermitTTY yes +#PrintMotd yes +#PrintLastLog yes +#TCPKeepAlive yes +#PermitUserEnvironment no +#Compression delayed +#ClientAliveInterval 0 +#ClientAliveCountMax 3 +#UseDNS no +#PidFile /run/sshd.pid +#MaxStartups 10:30:100 +#PermitTunnel no +#ChrootDirectory none +#VersionAddendum none + +# no default banner path +#Banner none + +# override default of no subsystems +Subsystem sftp /usr/libexec/sftp-server + +# Example of overriding settings on a per-user basis +#Match User anoncvs +# X11Forwarding no +# AllowTcpForwarding no +# PermitTTY no +# ForceCommand cvs server diff --git a/source.sh b/source.sh new file mode 100644 index 0000000..db847a1 --- /dev/null +++ b/source.sh @@ -0,0 +1,50 @@ +# This is the source.sh script. It is executed by BPM in a temporary directory when compiling a source package +# BPM Expects the source code to be extracted into the automatically created 'source' directory which can be accessed using $BPM_SOURCE +# BPM Expects the output files to be present in the automatically created 'output' directory which can be accessed using $BPM_OUTPUT + +DOWNLOAD="https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${BPM_PKG_VERSION}.tar.gz" +FILENAME="${DOWNLOAD##*/}" + +# The prepare function is executed in the root of the temp directory +# This function is used for downloading files and putting them into the correct location +prepare() { + wget "$DOWNLOAD" + tar -xvf "$FILENAME" --strip-components=1 -C "$BPM_SOURCE" +} + +# The build function is executed in the source directory +# This function is used to compile the source code +build() { + ./configure --prefix=/usr \ + --sysconfdir=/etc/ssh \ + --with-privsep-user=nobody \ + --with-default-path=/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin \ + --with-superuser-path=/usr/sbin:/usr/bin \ + --with-pid-dir=/run \ + --with-pam + make +} + +# The check function is executed in the source directory +# This function is used to run tests to verify the package has been compiled correctly +check() { + make -j1 tests +} + +# The package function is executed in the source directory +# This function is used to move the compiled files into the output directory +package() { + make DESTDIR="$BPM_OUTPUT" install + install -v -m755 contrib/ssh-copy-id "$BPM_OUTPUT"/usr/bin + install -v -m644 contrib/ssh-copy-id.1 "$BPM_OUTPUT"/usr/share/man/man1 + mkdir -p "$BPM_OUTPUT"/etc/pam.d + cp ../sshd-pam "$BPM_OUTPUT"/etc/pam.d/sshd + cp ../sshd_config "$BPM_OUTPUT"/etc/ssh/sshd_config + mkdir -p "$BPM_OUTPUT"/usr/lib/systemd/system/ + cp ../sshd.service "$BPM_OUTPUT"/usr/lib/systemd/system/sshd.service + cp ../sshd-keygen.service "$BPM_OUTPUT"/usr/lib/systemd/system/sshd-keygen.service + install -v -m755 -d "$BPM_OUTPUT"/usr/share/doc/openssh + install -v -m644 INSTALL LICENCE OVERVIEW README* "$BPM_OUTPUT"/usr/share/doc/openssh + mkdir -p "$BPM_OUTPUT"/usr/share/licenses/openssh + cp LICENCE "$BPM_OUTPUT"/usr/share/licenses/openssh/LICENSE +}