mirror/freebsd-ports
1
0
Fork 0
mirror of https://git.FreeBSD.org/ports.git synced 2024-12-28 05:29:48 +00:00
Code Issues Releases Activity
c5bb7f1b1a
freebsd-ports/security/ssh/Makefile

148 lines
4.9 KiB
Makefile
Raw Normal View History

Ssh is a secure rlogin/rsh/rcp replacement with strong authentication (.rhosts together with RSA based host authentication, and pure RSA authentication) and improved privacy (all communications are automatically and transparently encrypted).
1995-10-07 01:19:27 +00:00
# New ports collection makefile for: ssh
1.2.22 -> 1.2.25 Somebody needs to go through patch-af to check it, since I'm not sure about some of the stuff. This version fixes a security flaw in previous version.
1998-06-12 07:55:14 +00:00
# Version required: 1.2.25
Ssh is a secure rlogin/rsh/rcp replacement with strong authentication (.rhosts together with RSA based host authentication, and pure RSA authentication) and improved privacy (all communications are automatically and transparently encrypted).
1995-10-07 01:19:27 +00:00
# Date created: 30 Jul 1995
# Whom: torstenb@FreeBSD.ORG
#
detect/use -current libwrap
1999-04-03 03:35:50 +00:00
# $Id: Makefile,v 1.73 1999/03/13 18:51:11 billf Exp $
Move perl depends under USE_PERL
1996-03-23 23:36:32 +00:00
#
# Maximal ssh package requires YES values for
Update ssh-1.2.13 -> ssh-1.2.14 ssh-askpass no longer uses wish, so chop the make rules that attempt to locate it. Go further to try and protect the ssh_host_key, since it's critical to the operation and security of the machine.
1996-06-07 04:33:33 +00:00
# USE_PERL, USE_TCPWRAP
Ssh is a secure rlogin/rsh/rcp replacement with strong authentication (.rhosts together with RSA based host authentication, and pure RSA authentication) and improved privacy (all communications are automatically and transparently encrypted).
1995-10-07 01:19:27 +00:00
#
upgrade to 1.2.26 for security improvements
1998-07-11 23:10:54 +00:00
DISTNAME= ssh-1.2.26
Update from ssh-1.2.19 to ssh-1.2.20. All patches applied still, I just regenerated them to fix the line numbers. Also, I added two commented out options in Makefile, one to tell sshd that a group writeable homedir is OK because all users are in their own group, and the other is to allow an unencrypted connection (which is dangerous since it can lead to compromise of keys), but on a secure network it's damn useful for backups etc.
1997-04-25 05:01:06 +00:00
CATEGORIES= security net
(1) Add a new MASTER_SITE (2) Reorganize MASTER_SITEs (3) Remove reference to Phil Karn's ssh speedups, it is now distributed as a full source package, and not a patch kit. If we want to use it, we will have to make a new port for it. (4) Use ${ECHO} instead of echo, ${RM} instead of rm, ${LN} instead of ln (5) Use ${FALSE} instead of false (6) Remove multiple blank lines in Makefile (7) Remove trailing blank lines in pkg/DESCR Submitted by: Alex Perel <veers@disturbed.net> (1, 2, 4, 6) Bill Fumerola <billf@FreeBSD.org> (3, 5, 7)
1999-03-13 18:51:11 +00:00
MASTER_SITES= ftp://ftp.funet.fi/pub/unix/security/login/ssh/
Ssh is a secure rlogin/rsh/rcp replacement with strong authentication (.rhosts together with RSA based host authentication, and pure RSA authentication) and improved privacy (all communications are automatically and transparently encrypted).
1995-10-07 01:19:27 +00:00
Add torstenb as maintainer.
1995-11-09 05:58:00 +00:00
MAINTAINER= torstenb@FreeBSD.ORG
Update ssh-1.2.13 -> ssh-1.2.14 ssh-askpass no longer uses wish, so chop the make rules that attempt to locate it. Go further to try and protect the ssh_host_key, since it's critical to the operation and security of the machine.
1996-06-07 04:33:33 +00:00
# You can set USA_RESIDENT appropriately in /etc/make.conf if this bugs you..
Ssh is a secure rlogin/rsh/rcp replacement with strong authentication (.rhosts together with RSA based host authentication, and pure RSA authentication) and improved privacy (all communications are automatically and transparently encrypted).
1995-10-07 01:19:27 +00:00
.if defined(USA_RESIDENT) && ${USA_RESIDENT} == YES
(1) Add a new MASTER_SITE (2) Reorganize MASTER_SITEs (3) Remove reference to Phil Karn's ssh speedups, it is now distributed as a full source package, and not a patch kit. If we want to use it, we will have to make a new port for it. (4) Use ${ECHO} instead of echo, ${RM} instead of rm, ${LN} instead of ln (5) Use ${FALSE} instead of false (6) Remove multiple blank lines in Makefile (7) Remove trailing blank lines in pkg/DESCR Submitted by: Alex Perel <veers@disturbed.net> (1, 2, 4, 6) Bill Fumerola <billf@FreeBSD.org> (3, 5, 7)
1999-03-13 18:51:11 +00:00
MASTER_SITES+= \
ftp://ftp.replay.com/pub/replay/crypto/SSH/ \
Ssh is a secure rlogin/rsh/rcp replacement with strong authentication (.rhosts together with RSA based host authentication, and pure RSA authentication) and improved privacy (all communications are automatically and transparently encrypted).
1995-10-07 01:19:27 +00:00
ftp://nic.funet.fi/pub/crypt/mirrors/ftp.dsi.unimi.it/applied-crypto/ \
ftp://rzsun2.informatik.uni-hamburg.de/pub/virus/crypt/ripem/ \
ftp.dsi.unimi.it -> idea.sec.dsi.unimi.it
1997-11-10 22:04:42 +00:00
ftp://idea.sec.dsi.unimi.it/pub/security/crypt/math/ \
Ssh is a secure rlogin/rsh/rcp replacement with strong authentication (.rhosts together with RSA based host authentication, and pure RSA authentication) and improved privacy (all communications are automatically and transparently encrypted).
1995-10-07 01:19:27 +00:00
ftp://ftp.univie.ac.at/security/crypt/cryptography/asymmetric/rsa/ \
ftp://isdec.vc.cvut.cz/pub/security/unimi/crypt/applied-crypto/
Clean this file up a bit. Suggested by: asami
1998-10-08 06:16:18 +00:00
CONFIGURE_ARGS+= --with-rsaref
Better depends. Also Suggested by: asami
1998-10-08 06:17:56 +00:00
LIB_DEPENDS+= rsaref.2:${PORTSDIR}/security/rsaref
BUILD_DEPENDS+= /nonexistent:${PORTSDIR}/security/rsaref:extract
Ssh is a secure rlogin/rsh/rcp replacement with strong authentication (.rhosts together with RSA based host authentication, and pure RSA authentication) and improved privacy (all communications are automatically and transparently encrypted).
1995-10-07 01:19:27 +00:00
.endif
Clean this file up a bit. Suggested by: asami
1998-10-08 06:16:18 +00:00
Change NO_PACKAGE to RESTRICTED.
1996-04-17 01:07:04 +00:00
RESTRICTED= "Crypto; export-controlled"
Ssh is a secure rlogin/rsh/rcp replacement with strong authentication (.rhosts together with RSA based host authentication, and pure RSA authentication) and improved privacy (all communications are automatically and transparently encrypted).
1995-10-07 01:19:27 +00:00
IS_INTERACTIVE= YES
GNU_CONFIGURE= YES
Um, be careful when you copy stuff around -- change the second CONFIGURE_ARGS defintion to use "+=" so it won't override the first. While I'm here, GNU_CONFIGURE implies --prefix=${PREFIX} so take it out.
1998-10-08 13:11:52 +00:00
CONFIGURE_ARGS+= --with-etcdir=${PREFIX}/etc
Ssh is a secure rlogin/rsh/rcp replacement with strong authentication (.rhosts together with RSA based host authentication, and pure RSA authentication) and improved privacy (all communications are automatically and transparently encrypted).
1995-10-07 01:19:27 +00:00
Update from ssh-1.2.19 to ssh-1.2.20. All patches applied still, I just regenerated them to fix the line numbers. Also, I added two commented out options in Makefile, one to tell sshd that a group writeable homedir is OK because all users are in their own group, and the other is to allow an unencrypted connection (which is dangerous since it can lead to compromise of keys), but on a secure network it's damn useful for backups etc.
1997-04-25 05:01:06 +00:00
#Uncomment if all your users are in their own group and their homedir
#is writeable by that group. Beware the security implications!
#CONFIGURE_ARGS+= --enable-group-writeability
#Uncomment if you want to allow ssh to emulate an unencrypted rsh connection
#over a secure medium. This is normally dangerous since it can lead to the
#disclosure keys and passwords.
#CONFIGURE_ARGS+= --with-none
If KRB5_HOME is defined, compile ssh with krb5 support.
1998-08-01 22:24:55 +00:00
.if defined(KRB5_HOME) && exists(${KRB5_HOME})
CONFIGURE_ARGS+=--with-kerberos5=${KRB5_HOME} --enable-kerberos-tgt-passing
.endif
Ssh is a secure rlogin/rsh/rcp replacement with strong authentication (.rhosts together with RSA based host authentication, and pure RSA authentication) and improved privacy (all communications are automatically and transparently encrypted).
1995-10-07 01:19:27 +00:00
# Include support for the SecureID card
# Warning: untested !
.if defined(USE_SECUREID) && ${USE_SECUREID} == YES
CONFIGURE_ARGS+= --with-secureid
.endif
# Don't use IDEA. IDEA can be freely used for non-commercial use. However,
typo in comment
1997-07-01 02:39:26 +00:00
# commercial use may require a licence in a number of countries
Ssh is a secure rlogin/rsh/rcp replacement with strong authentication (.rhosts together with RSA based host authentication, and pure RSA authentication) and improved privacy (all communications are automatically and transparently encrypted).
1995-10-07 01:19:27 +00:00
# Warning: untested !
.if defined(DONT_USE_IDEA) && ${DONT_USE_IDEA} == YES
CONFIGURE_ARGS+= --without-idea
.endif
configure with "--without-x" if X11BASE/bin/xauth is missing. Requested by: Studded@gorean.org
1998-10-30 06:15:18 +00:00
.if !exists(${X11BASE}/bin/xauth)
CONFIGURE_ARGS+= --without-x
.endif
1.2.22 -> 1.2.25 Somebody needs to go through patch-af to check it, since I'm not sure about some of the stuff. This version fixes a security flaw in previous version.
1998-06-12 07:55:14 +00:00
MAN1= scp1.1 ssh-add1.1 ssh-agent1.1 ssh-keygen1.1 ssh1.1 \
make-ssh-known-hosts1.1
MAN8= sshd1.8
Use MAN? macros. CATEGORIES+= -> CATEGORIES.
1996-11-18 11:44:27 +00:00
Ssh is a secure rlogin/rsh/rcp replacement with strong authentication (.rhosts together with RSA based host authentication, and pure RSA authentication) and improved privacy (all communications are automatically and transparently encrypted).
1995-10-07 01:19:27 +00:00
pre-patch:
mv -> ${MV}.
1997-09-11 18:31:52 +00:00
@${MV} -f ${WRKSRC}/make-ssh-known-hosts.pl \
Ssh is a secure rlogin/rsh/rcp replacement with strong authentication (.rhosts together with RSA based host authentication, and pure RSA authentication) and improved privacy (all communications are automatically and transparently encrypted).
1995-10-07 01:19:27 +00:00
${WRKSRC}/make-ssh-known-hosts.pl.in
fetch-depends:
.if !defined(USA_RESIDENT) || ${USA_RESIDENT} != YES && ${USA_RESIDENT} != NO
(1) Add a new MASTER_SITE (2) Reorganize MASTER_SITEs (3) Remove reference to Phil Karn's ssh speedups, it is now distributed as a full source package, and not a patch kit. If we want to use it, we will have to make a new port for it. (4) Use ${ECHO} instead of echo, ${RM} instead of rm, ${LN} instead of ln (5) Use ${FALSE} instead of false (6) Remove multiple blank lines in Makefile (7) Remove trailing blank lines in pkg/DESCR Submitted by: Alex Perel <veers@disturbed.net> (1, 2, 4, 6) Bill Fumerola <billf@FreeBSD.org> (3, 5, 7)
1999-03-13 18:51:11 +00:00
@ ${ECHO}
@ ${ECHO} You must set the variable USA_RESIDENT to YES if you are a
@ ${ECHO} United States resident, otherwise NO.
@ ${ECHO} If you are a US resident then this port must also fetch
@ ${ECHO} the RSAREF2 library from sources abroad \(RSA Inc. holds a
@ ${ECHO} patent on RSA and public key crypto in general in the United
@ ${ECHO} States so using RSA implementations other than RSAREF there
@ ${ECHO} may violate US patent law\).
@ ${FALSE}
Ssh is a secure rlogin/rsh/rcp replacement with strong authentication (.rhosts together with RSA based host authentication, and pure RSA authentication) and improved privacy (all communications are automatically and transparently encrypted).
1995-10-07 01:19:27 +00:00
.endif
post-install:
Several fixes/improvements :- - protect the secret RSA etc/ssh_host_key. It is now generated on install (either by pkg_add or make install) if not already present and is not ever added to a package since it's your host's credentials. It should not be removed on pkg_delete, since you are in big trouble if you did this (for example) pkg_delete ssh-1.2.14; pkg_add ssh-1.2.15.tgz. - fix the broken manpage symlink when compressing man pages (slogin.1 has been causing /etc/weekly to generate cron messages) - zlib 1.0.4 is now "blessed" again, the ssh working sources now use this instead of v0.95. The decompression problem was fixed in either 1.0.3 or 1.0.4. Also, the current version of cvs uses zlib 1.0.4 as well.. - perl5.002 -> perl5.003 Reviewed by: torstenb
1996-08-08 13:57:02 +00:00
@if [ ! -f ${PREFIX}/etc/ssh_host_key ]; then \
(1) Add a new MASTER_SITE (2) Reorganize MASTER_SITEs (3) Remove reference to Phil Karn's ssh speedups, it is now distributed as a full source package, and not a patch kit. If we want to use it, we will have to make a new port for it. (4) Use ${ECHO} instead of echo, ${RM} instead of rm, ${LN} instead of ln (5) Use ${FALSE} instead of false (6) Remove multiple blank lines in Makefile (7) Remove trailing blank lines in pkg/DESCR Submitted by: Alex Perel <veers@disturbed.net> (1, 2, 4, 6) Bill Fumerola <billf@FreeBSD.org> (3, 5, 7)
1999-03-13 18:51:11 +00:00
${ECHO} "Generating a secret host key..."; \
Several fixes/improvements :- - protect the secret RSA etc/ssh_host_key. It is now generated on install (either by pkg_add or make install) if not already present and is not ever added to a package since it's your host's credentials. It should not be removed on pkg_delete, since you are in big trouble if you did this (for example) pkg_delete ssh-1.2.14; pkg_add ssh-1.2.15.tgz. - fix the broken manpage symlink when compressing man pages (slogin.1 has been causing /etc/weekly to generate cron messages) - zlib 1.0.4 is now "blessed" again, the ssh working sources now use this instead of v0.95. The decompression problem was fixed in either 1.0.3 or 1.0.4. Also, the current version of cvs uses zlib 1.0.4 as well.. - perl5.002 -> perl5.003 Reviewed by: torstenb
1996-08-08 13:57:02 +00:00
${PREFIX}/bin/ssh-keygen -f ${PREFIX}/etc/ssh_host_key -N ""; \
fi
.if !defined(NOMANCOMPRESS)
1.2.22 -> 1.2.25 Somebody needs to go through patch-af to check it, since I'm not sure about some of the stuff. This version fixes a security flaw in previous version.
1998-06-12 07:55:14 +00:00
for file in make-ssh-known-hosts scp ssh-add ssh-agent \
ssh-keygen ssh; do \
(1) Add a new MASTER_SITE (2) Reorganize MASTER_SITEs (3) Remove reference to Phil Karn's ssh speedups, it is now distributed as a full source package, and not a patch kit. If we want to use it, we will have to make a new port for it. (4) Use ${ECHO} instead of echo, ${RM} instead of rm, ${LN} instead of ln (5) Use ${FALSE} instead of false (6) Remove multiple blank lines in Makefile (7) Remove trailing blank lines in pkg/DESCR Submitted by: Alex Perel <veers@disturbed.net> (1, 2, 4, 6) Bill Fumerola <billf@FreeBSD.org> (3, 5, 7)
1999-03-13 18:51:11 +00:00
${RM} -f ${PREFIX}/man/man1/$${file}.1; \
${LN} -sf $${file}1.1.gz ${PREFIX}/man/man1/$${file}.1.gz; \
1.2.22 -> 1.2.25 Somebody needs to go through patch-af to check it, since I'm not sure about some of the stuff. This version fixes a security flaw in previous version.
1998-06-12 07:55:14 +00:00
done
(1) Add a new MASTER_SITE (2) Reorganize MASTER_SITEs (3) Remove reference to Phil Karn's ssh speedups, it is now distributed as a full source package, and not a patch kit. If we want to use it, we will have to make a new port for it. (4) Use ${ECHO} instead of echo, ${RM} instead of rm, ${LN} instead of ln (5) Use ${FALSE} instead of false (6) Remove multiple blank lines in Makefile (7) Remove trailing blank lines in pkg/DESCR Submitted by: Alex Perel <veers@disturbed.net> (1, 2, 4, 6) Bill Fumerola <billf@FreeBSD.org> (3, 5, 7)
1999-03-13 18:51:11 +00:00
${RM} -f ${PREFIX}/man/man1/slogin.1
${RM} -f ${PREFIX}/man/man1/slogin1.1
${RM} -f ${PREFIX}/man/man8/sshd.8
${LN} -sf ssh.1.gz ${PREFIX}/man/man1/slogin.1.gz
${LN} -sf ssh1.1.gz ${PREFIX}/man/man1/slogin1.1.gz
${LN} -sf sshd1.8.gz ${PREFIX}/man/man8/sshd.8.gz
The pkg_create(1) handles symlinks correctly. Delist manpages.
1998-08-19 19:51:10 +00:00
.else
${ECHO} Warning---some manpages not installed. See port Makefile
Several fixes/improvements :- - protect the secret RSA etc/ssh_host_key. It is now generated on install (either by pkg_add or make install) if not already present and is not ever added to a package since it's your host's credentials. It should not be removed on pkg_delete, since you are in big trouble if you did this (for example) pkg_delete ssh-1.2.14; pkg_add ssh-1.2.15.tgz. - fix the broken manpage symlink when compressing man pages (slogin.1 has been causing /etc/weekly to generate cron messages) - zlib 1.0.4 is now "blessed" again, the ssh working sources now use this instead of v0.95. The decompression problem was fixed in either 1.0.3 or 1.0.4. Also, the current version of cvs uses zlib 1.0.4 as well.. - perl5.002 -> perl5.003 Reviewed by: torstenb
1996-08-08 13:57:02 +00:00
.endif
Install an sshd.sh startup file.
1996-06-15 17:50:18 +00:00
@if [ ! -f ${PREFIX}/etc/rc.d/sshd.sh ]; then \
(1) Add a new MASTER_SITE (2) Reorganize MASTER_SITEs (3) Remove reference to Phil Karn's ssh speedups, it is now distributed as a full source package, and not a patch kit. If we want to use it, we will have to make a new port for it. (4) Use ${ECHO} instead of echo, ${RM} instead of rm, ${LN} instead of ln (5) Use ${FALSE} instead of false (6) Remove multiple blank lines in Makefile (7) Remove trailing blank lines in pkg/DESCR Submitted by: Alex Perel <veers@disturbed.net> (1, 2, 4, 6) Bill Fumerola <billf@FreeBSD.org> (3, 5, 7)
1999-03-13 18:51:11 +00:00
${ECHO} "Installing ${PREFIX}/etc/rc.d/sshd.sh startup file."; \
${ECHO} "#!/bin/sh" > ${PREFIX}/etc/rc.d/sshd.sh; \
${ECHO} "[ -x ${PREFIX}/sbin/sshd ] && ${PREFIX}/sbin/sshd && ${ECHO} -n ' sshd'" >> ${PREFIX}/etc/rc.d/sshd.sh; \
/bin/chmod 751 ${PREFIX}/etc/rc.d/sshd.sh; \
Install an sshd.sh startup file.
1996-06-15 17:50:18 +00:00
fi
Ssh is a secure rlogin/rsh/rcp replacement with strong authentication (.rhosts together with RSA based host authentication, and pure RSA authentication) and improved privacy (all communications are automatically and transparently encrypted).
1995-10-07 01:19:27 +00:00
Change *_DEPENDS on lang/perl5 to USE_PERL5 so we won't have any dependencies to perl5 in -current. This might cause some unwanted perl5 installations on -stable (if it was originally RUN_DEPENDS, perl5 will now be installed during build too, etc.), but its lifetime is limited anyway.
1999-01-02 00:12:21 +00:00
.include <bsd.port.pre.mk>
Autopick any wish present even wish4.0 Autopick libwrap.a
1996-01-25 02:08:25 +00:00
Auto-sense installed perl & wish
1996-03-24 23:04:17 +00:00
.if defined(USE_PERL) && ${USE_PERL} == YES || \
Use ${PERL5} wherever appropriate. Largely untested; hope my eyeball checks haven't missed anything. Submitted by: dima
1998-09-15 21:31:59 +00:00
exists(${PERL5}) && (!defined(USE_PERL) || ${USE_PERL} != NO)
Change *_DEPENDS on lang/perl5 to USE_PERL5 so we won't have any dependencies to perl5 in -current. This might cause some unwanted perl5 installations on -stable (if it was originally RUN_DEPENDS, perl5 will now be installed during build too, etc.), but its lifetime is limited anyway.
1999-01-02 00:12:21 +00:00
USE_PERL5= yes
Use ${PERL5} wherever appropriate. Largely untested; hope my eyeball checks haven't missed anything. Submitted by: dima
1998-09-15 21:31:59 +00:00
CONFIGURE_ENV+= PERL=${PERL5}
Move perl depends under USE_PERL
1996-03-23 23:36:32 +00:00
.else
CONFIGURE_ENV+= PERL=/replace_it_with_PERL_path
.endif
Autopick any wish present even wish4.0 Autopick libwrap.a
1996-01-25 02:08:25 +00:00
# Include tcp-wrapper support (call remote identd)
detect/use -current libwrap
1999-04-03 03:35:50 +00:00
.if exists(/usr/include/tcpd.h)
CONFIGURE_ARGS+= --with-libwrap
.else
Autopick any wish present even wish4.0 Autopick libwrap.a
1996-01-25 02:08:25 +00:00
.if defined(USE_TCPWRAP) && ${USE_TCPWRAP} == YES || \
exists(${PREFIX}/lib/libwrap.a) && \
(!defined(USE_TCPWRAP) || ${USE_TCPWRAP} != NO)
Understands shared libwrap now
1996-01-25 04:17:28 +00:00
CONFIGURE_ENV+= LDFLAGS=-L${PREFIX}/lib CFLAGS="${CFLAGS} -I${PREFIX}/include"
Autopick any wish present even wish4.0 Autopick libwrap.a
1996-01-25 02:08:25 +00:00
CONFIGURE_ARGS+= --with-libwrap
tcp_wrapper is now converted to ELF. While I'm here, fix smail Makefile: libwrap is a shared library so it should be LIB_DEPENDS, and delete some spaces and tab-only lines.
1998-09-17 10:53:31 +00:00
LIB_DEPENDS+= wrap.7:${PORTSDIR}/security/tcp_wrapper
Autopick any wish present even wish4.0 Autopick libwrap.a
1996-01-25 02:08:25 +00:00
.endif
detect/use -current libwrap
1999-04-03 03:35:50 +00:00
.endif
Autopick any wish present even wish4.0 Autopick libwrap.a
1996-01-25 02:08:25 +00:00
If using socks, make sure you find socks library
1996-07-22 23:06:08 +00:00
# Include SOCKS firewall support
.if defined(USE_SOCKS) && ${USE_SOCKS} == YES
Make the SOCKS support from USE_SOCKS play nicely with the socks5 port.
1997-12-24 18:46:11 +00:00
CONFIGURE_ARGS+= --with-socks="-L${PREFIX}/lib -lsocks5" --with-socks5
If using socks, make sure you find socks library
1996-07-22 23:06:08 +00:00
.endif
Change *_DEPENDS on lang/perl5 to USE_PERL5 so we won't have any dependencies to perl5 in -current. This might cause some unwanted perl5 installations on -stable (if it was originally RUN_DEPENDS, perl5 will now be installed during build too, etc.), but its lifetime is limited anyway.
1999-01-02 00:12:21 +00:00
.include <bsd.port.post.mk>
Reference in New Issue Copy Permalink