Initial Commit

pkg.info

@@ -0,0 +1,8 @@
+name: openssh
+description: The premier connectivity tool for remote login with the SSH protocol
+version: 9.6p1
+url: https://www.openssh.com/
+license: BSD-2-Clause,BSD-3-Clause,ISC,LicenseRef-Public-Domain,MIT
+architecture: any
+type: source
+keep: etc/sshd/

source-files/sshd-keygen.service

@@ -0,0 +1,12 @@
+[Unit]
+Description=Generate sshd keys
+Before=ssh.server
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/ssh-keygen -A
+RemainAfterExit=true
+StandardOutput=journal
+
+[Install]
+WantedBy=multi-user.target

source-files/sshd-pam

@@ -0,0 +1,38 @@
+# Set failure delay before next prompt to 3 seconds
+auth      optional    pam_faildelay.so  delay=3000000
+
+# Check to make sure that the user is allowed to login
+auth      requisite   pam_nologin.so
+
+# Check to make sure that root is allowed to login
+# Disabled by default. You will need to create /etc/securetty
+# file for this module to function. See man 5 securetty.
+#auth      required    pam_securetty.so
+
+# Additional group memberships - disabled by default
+#auth      optional    pam_group.so
+
+# include system auth settings
+auth      include     system-auth
+
+# check access for the user
+account   required    pam_access.so
+
+# include system account settings
+account   include     system-account
+
+# Set default environment variables for the user
+session   required    pam_env.so
+
+# Set resource limits for the user
+session   required    pam_limits.so
+
+# Display the message of the day - Disabled by default
+#session   optional    pam_motd.so
+
+# Check user's mail - Disabled by default
+#session   optional    pam_mail.so      standard quiet
+
+# include system session and password settings
+session   include     system-session
+password  include     system-password

source-files/sshd.service

@@ -0,0 +1,11 @@
+[Unit]
+Description=OpenSSH Daemon
+
+[Service]
+ExecStart=/usr/sbin/sshd -D
+ExecReload=/bin/kill -HUP $MAINPID
+KillMode=process
+Restart=always
+
+[Install]
+WantedBy=multi-user.target

source-files/sshd_config

@@ -0,0 +1,116 @@
+#	$OpenBSD: sshd_config,v 1.104 2021/07/02 05:11:21 dtucker Exp $
+
+# This is the sshd server system-wide configuration file.  See
+# sshd_config(5) for more information.
+
+# This sshd was compiled with PATH=/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin
+
+# The strategy used for options in the default sshd_config shipped with
+# OpenSSH is to specify options with their default value where
+# possible, but leave them commented.  Uncommented options override the
+# default value.
+
+#Port 22
+#AddressFamily any
+#ListenAddress 0.0.0.0
+#ListenAddress ::
+
+#HostKey /etc/ssh/ssh_host_rsa_key
+#HostKey /etc/ssh/ssh_host_ecdsa_key
+#HostKey /etc/ssh/ssh_host_ed25519_key
+
+# Ciphers and keying
+#RekeyLimit default none
+
+# Logging
+#SyslogFacility AUTH
+#LogLevel INFO
+
+# Authentication:
+
+#LoginGraceTime 2m
+#PermitRootLogin prohibit-password
+#StrictModes yes
+#MaxAuthTries 6
+#MaxSessions 10
+
+#PubkeyAuthentication yes
+
+# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
+# but this is overridden so installations will only check .ssh/authorized_keys
+AuthorizedKeysFile	.ssh/authorized_keys
+
+#AuthorizedPrincipalsFile none
+
+#AuthorizedKeysCommand none
+#AuthorizedKeysCommandUser nobody
+
+# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
+#HostbasedAuthentication no
+# Change to yes if you don't trust ~/.ssh/known_hosts for
+# HostbasedAuthentication
+#IgnoreUserKnownHosts no
+# Don't read the user's ~/.rhosts and ~/.shosts files
+#IgnoreRhosts yes
+
+# To disable tunneled clear text passwords, change to no here!
+#PasswordAuthentication yes
+#PermitEmptyPasswords no
+
+# Change to no to disable s/key passwords
+#KbdInteractiveAuthentication yes
+
+# Kerberos options
+#KerberosAuthentication no
+#KerberosOrLocalPasswd yes
+#KerberosTicketCleanup yes
+#KerberosGetAFSToken no
+
+# GSSAPI options
+#GSSAPIAuthentication no
+#GSSAPICleanupCredentials yes
+
+# Set this to 'yes' to enable PAM authentication, account processing,
+# and session processing. If this is enabled, PAM authentication will
+# be allowed through the KbdInteractiveAuthentication and
+# PasswordAuthentication.  Depending on your PAM configuration,
+# PAM authentication via KbdInteractiveAuthentication may bypass
+# the setting of "PermitRootLogin prohibit-password".
+# If you just want the PAM account and session checks to run without
+# PAM authentication, then enable this but set PasswordAuthentication
+# and KbdInteractiveAuthentication to 'no'.
+UsePAM yes
+
+#AllowAgentForwarding yes
+#AllowTcpForwarding yes
+#GatewayPorts no
+#X11Forwarding no
+#X11DisplayOffset 10
+#X11UseLocalhost yes
+#PermitTTY yes
+#PrintMotd yes
+#PrintLastLog yes
+#TCPKeepAlive yes
+#PermitUserEnvironment no
+#Compression delayed
+#ClientAliveInterval 0
+#ClientAliveCountMax 3
+#UseDNS no
+#PidFile /run/sshd.pid
+#MaxStartups 10:30:100
+#PermitTunnel no
+#ChrootDirectory none
+#VersionAddendum none
+
+# no default banner path
+#Banner none
+
+# override default of no subsystems
+Subsystem	sftp	/usr/libexec/sftp-server
+
+# Example of overriding settings on a per-user basis
+#Match User anoncvs
+#	X11Forwarding no
+#	AllowTcpForwarding no
+#	PermitTTY no
+#	ForceCommand cvs server

source.sh

@@ -0,0 +1,50 @@
+# This is the source.sh script. It is executed by BPM in a temporary directory when compiling a source package
+# BPM Expects the source code to be extracted into the automatically created 'source' directory which can be accessed using $BPM_SOURCE
+# BPM Expects the output files to be present in the automatically created 'output' directory which can be accessed using $BPM_OUTPUT
+
+DOWNLOAD="https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${BPM_PKG_VERSION}.tar.gz"
+FILENAME="${DOWNLOAD##*/}"
+
+# The prepare function is executed in the root of the temp directory
+# This function is used for downloading files and putting them into the correct location
+prepare() {
+  wget "$DOWNLOAD"
+  tar -xvf "$FILENAME" --strip-components=1 -C "$BPM_SOURCE"
+}
+
+# The build function is executed in the source directory
+# This function is used to compile the source code
+build() {
+  ./configure --prefix=/usr                                                         \
+              --sysconfdir=/etc/ssh                                                 \
+              --with-privsep-user=nobody                                            \
+              --with-default-path=/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin \
+              --with-superuser-path=/usr/sbin:/usr/bin                              \
+              --with-pid-dir=/run                                                   \
+              --with-pam
+  make
+}
+
+# The check function is executed in the source directory
+# This function is used to run tests to verify the package has been compiled correctly
+check() {
+  make -j1 tests
+}
+
+# The package function is executed in the source directory
+# This function is used to move the compiled files into the output directory
+package() {
+  make DESTDIR="$BPM_OUTPUT" install
+  install -v -m755 contrib/ssh-copy-id "$BPM_OUTPUT"/usr/bin
+  install -v -m644 contrib/ssh-copy-id.1 "$BPM_OUTPUT"/usr/share/man/man1
+  mkdir -p "$BPM_OUTPUT"/etc/pam.d
+  cp ../sshd-pam "$BPM_OUTPUT"/etc/pam.d/sshd
+  cp ../sshd_config "$BPM_OUTPUT"/etc/ssh/sshd_config
+  mkdir -p "$BPM_OUTPUT"/usr/lib/systemd/system/
+  cp ../sshd.service "$BPM_OUTPUT"/usr/lib/systemd/system/sshd.service
+  cp ../sshd-keygen.service "$BPM_OUTPUT"/usr/lib/systemd/system/sshd-keygen.service
+  install -v -m755 -d "$BPM_OUTPUT"/usr/share/doc/openssh
+  install -v -m644 INSTALL LICENCE OVERVIEW README* "$BPM_OUTPUT"/usr/share/doc/openssh
+  mkdir -p "$BPM_OUTPUT"/usr/share/licenses/openssh
+  cp LICENCE "$BPM_OUTPUT"/usr/share/licenses/openssh/LICENSE
+}