[PATCH] openssh: configuration updates

[PATCH] openssh: configuration updates

[Dan McGregor]

From: Dan McGregor <dan.mcgregor@usask.ca>

Rebase sshd_config and ssh_config with openssh upstream.
Check for the ed25519 key in the systemd keygen service.

Signed-off-by: Dan McGregor <dan.mcgregor@usask.ca>
---
 .../openssh/openssh/ssh_config                     |  4 ++-
 .../openssh/openssh/sshd_config                    | 30 ++++++++++++++++------
 .../openssh/openssh/sshdgenkeys.service            |  1 +
 3 files changed, 26 insertions(+), 9 deletions(-)

diff --git a/meta/recipes-connectivity/openssh/openssh/ssh_config
b/meta/recipes-connectivity/openssh/openssh/ssh_config
index 4a4a649..9e91915 100644
--- a/meta/recipes-connectivity/openssh/openssh/ssh_config
+++ b/meta/recipes-connectivity/openssh/openssh/ssh_config
@@ -1,4 +1,4 @@
-# $OpenBSD: ssh_config,v 1.25 2009/02/17 01:28:32 djm Exp $
+# $OpenBSD: ssh_config,v 1.28 2013/09/16 11:35:43 sthen Exp $

 # This is the ssh client system-wide configuration file.  See
 # ssh_config(5) for more information.  This file provides defaults for
@@ -44,3 +44,5 @@ Host *
 #   TunnelDevice any:any
 #   PermitLocalCommand no
 #   VisualHostKey no
+#   ProxyCommand ssh -q -W %h:%p gateway.example.com
+#   RekeyLimit 1G 1h
diff --git a/meta/recipes-connectivity/openssh/openssh/sshd_config
b/meta/recipes-connectivity/openssh/openssh/sshd_config
index 4f9b626..2a45c2b 100644
--- a/meta/recipes-connectivity/openssh/openssh/sshd_config
+++ b/meta/recipes-connectivity/openssh/openssh/sshd_config
@@ -15,9 +15,7 @@
 #ListenAddress 0.0.0.0
 #ListenAddress ::

-# Disable legacy (protocol version 1) support in the server for new
-# installations. In future the default will change to require explicit
-# activation of protocol 1
+# The default requires explicit activation of protocol 1
 Protocol 2

 # HostKey for protocol version 1
@@ -25,11 +23,16 @@ Protocol 2
 # HostKeys for protocol version 2
 #HostKey /etc/ssh/ssh_host_rsa_key
 #HostKey /etc/ssh/ssh_host_dsa_key
+#HostKey /etc/ssh/ssh_host_ecdsa_key
+#HostKey /etc/ssh/ssh_host_ed25519_key

 # Lifetime and size of ephemeral version 1 server key
 #KeyRegenerationInterval 1h
 #ServerKeyBits 1024

+# Ciphers and keying
+#RekeyLimit default none
+
 # Logging
 # obsoletes QuietMode and FascistLogging
 #SyslogFacility AUTH
@@ -45,7 +48,15 @@ Protocol 2

 #RSAAuthentication yes
 #PubkeyAuthentication yes
-#AuthorizedKeysFile .ssh/authorized_keys
+
+# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
+# but this is overridden so installations will only check .ssh/authorized_keys
+AuthorizedKeysFile .ssh/authorized_keys
+
+#AuthorizedPrincipalsFile none
+
+#AuthorizedKeysCommand none
+#AuthorizedKeysCommandUser nobody

 # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
 #RhostsRSAAuthentication no
@@ -74,8 +85,8 @@ Protocol 2
 #GSSAPIAuthentication no
 #GSSAPICleanupCredentials yes

-# Set this to 'yes' to enable PAM authentication, account processing,
-# and session processing. If this is enabled, PAM authentication will
+# Set this to 'yes' to enable PAM authentication, account processing,
+# and session processing. If this is enabled, PAM authentication will
 # be allowed through the ChallengeResponseAuthentication and
 # PasswordAuthentication.  Depending on your PAM configuration,
 # PAM authentication via ChallengeResponseAuthentication may bypass
@@ -91,20 +102,22 @@ Protocol 2
 #X11Forwarding no
 #X11DisplayOffset 10
 #X11UseLocalhost yes
+#PermitTTY yes
 #PrintMotd yes
 #PrintLastLog yes
 #TCPKeepAlive yes
 #UseLogin no
-UsePrivilegeSeparation yes
+UsePrivilegeSeparation sandbox # Default for new installations.
 #PermitUserEnvironment no
 Compression no
 ClientAliveInterval 15
 ClientAliveCountMax 4
 #UseDNS yes
 #PidFile /var/run/sshd.pid
-#MaxStartups 10
+#MaxStartups 10:30:100
 #PermitTunnel no
 #ChrootDirectory none
+#VersionAddendum none

 # no default banner path
 #Banner none
@@ -116,4 +129,5 @@ Subsystem sftp /usr/libexec/sftp-server
 #Match User anoncvs
 # X11Forwarding no
 # AllowTcpForwarding no
+# PermitTTY no
 # ForceCommand cvs server
diff --git a/meta/recipes-connectivity/openssh/openssh/sshdgenkeys.service
b/meta/recipes-connectivity/openssh/openssh/sshdgenkeys.service
index c21d70b..d65086f 100644
--- a/meta/recipes-connectivity/openssh/openssh/sshdgenkeys.service
+++ b/meta/recipes-connectivity/openssh/openssh/sshdgenkeys.service
@@ -3,6 +3,7 @@ Description=OpenSSH Key Generation
 ConditionPathExists=|!/etc/ssh/ssh_host_rsa_key
 ConditionPathExists=|!/etc/ssh/ssh_host_dsa_key
 ConditionPathExists=|!/etc/ssh/ssh_host_ecdsa_key
+ConditionPathExists=|!/etc/ssh/ssh_host_ed25519_key

 [Service]
 ExecStart=@BINDIR@/ssh-keygen -A
-- 
2.1.0

Re: [PATCH] openssh: configuration updates

[Burton, Ross]

[-- Attachment #1: Type: text/plain, Size: 315 bytes --]

On 15 January 2015 at 21:11, Dan McGregor <danismostlikely@gmail.com> wrote:

> Rebase sshd_config and ssh_config with openssh upstream.
> Check for the ed25519 key in the systemd keygen service.
>

Since you sent this master has moved on and this doesn't apply anymore. :(
Can you rebase?

Cheers,
Ross

[-- Attachment #2: Type: text/html, Size: 761 bytes --]

Re: [PATCH] openssh: configuration updates

[Dan McGregor]

On 27 January 2015 at 07:23, Burton, Ross <ross.burton@intel.com> wrote:
>
> On 15 January 2015 at 21:11, Dan McGregor <danismostlikely@gmail.com> wrote:
>>
>> Rebase sshd_config and ssh_config with openssh upstream.
>> Check for the ed25519 key in the systemd keygen service.
>
>
> Since you sent this master has moved on and this doesn't apply anymore. :(
> Can you rebase?

I rebased and sent again; part of me wonders if Gmail broke the patch;
the new version was sent without the help of Gmail's web interface.

Re: [PATCH] openssh: configuration updates

[Burton, Ross]

[-- Attachment #1: Type: text/plain, Size: 409 bytes --]

On 27 January 2015 at 17:16, Dan McGregor <danismostlikely@gmail.com> wrote:

> I rebased and sent again; part of me wonders if Gmail broke the patch;
> the new version was sent without the help of Gmail's web interface.
>

Oh that's entirely possible.  Personally I've got my git-send-email using
Google's SMTP servers, which neatly means my patches correctly appear in my
Sent Mail folder.

Ross

[-- Attachment #2: Type: text/html, Size: 834 bytes --]