<div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">On 23 October 2015 at 10:34, <span dir="ltr"><<a href="mailto:wenzong.fan@windriver.com" target="_blank">wenzong.fan@windriver.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">From: Wenzong Fan <<a href="mailto:wenzong.fan@windriver.com">wenzong.fan@windriver.com</a>><br>
<br>
The /etc/hosts.deny doesn't work for sshd without tcp-wrappers support,<br>
apply below patch from Debian to fix it:<br></blockquote><div><br></div><div>I get that hosts.deny not doing anything after updating is a nasty surprise (mentioning this in the release notes certainly makes sense) but ... is bringing tcp-wrappers-support back (especially as default) the correct solution here?</div><div><br></div><div>The dependencies for this feature have been described as 'poor quality abandonware' years ago already, and there are certainly other ways to limit access.... Is there a use case where ssh+tcpwrappers is so crucial that it warrants going against upstream opinion on security?</div><div><br></div><div> - Jussi</div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
From 1850a2c93f3dcfa3d682eaa85d1593c01d170429 Mon Sep 17 00:00:00 2001<br>
From: Colin Watson <<a href="mailto:cjwatson@debian.org">cjwatson@debian.org</a>><br>
Date: Tue, 7 Oct 2014 13:22:41 +0100<br>
Subject: Restore TCP wrappers support<br>
<br>
Support for TCP wrappers was dropped in OpenSSH 6.7. See this message<br>
and thread:<br>
<br>
<a href="https://lists.mindrot.org/pipermail/openssh-unix-dev/2014-April/032497.html" rel="noreferrer" target="_blank">https://lists.mindrot.org/pipermail/openssh-unix-dev/2014-April/032497.html</a><br>
<br>
It is true that this reduces preauth attack surface in sshd. On the<br>
other hand, this support seems to be quite widely used, and abruptly<br>
dropping it (from the perspective of users who don't read<br>
openssh-unix-dev) could easily cause more serious problems in practice.<br>
Link to patch file:<br>
<a href="http://anonscm.debian.org/cgit/pkg-ssh/openssh.git/tree/debian/" rel="noreferrer" target="_blank">http://anonscm.debian.org/cgit/pkg-ssh/openssh.git/tree/debian/</a> \<br>
patches/restore-tcp-wrappers.patch<br>
<br>
Signed-off-by: Wenzong Fan <<a href="mailto:wenzong.fan@windriver.com">wenzong.fan@windriver.com</a>><br>
---<br>
.../openssh/openssh/restore-tcp-wrappers.patch | 174 +++++++++++++++++++++<br>
meta/recipes-connectivity/openssh/<a href="http://openssh_7.1p1.bb" rel="noreferrer" target="_blank">openssh_7.1p1.bb</a> | 4 +<br>
2 files changed, 178 insertions(+)<br>
create mode 100644 meta/recipes-connectivity/openssh/openssh/restore-tcp-wrappers.patch<br>
<br>
diff --git a/meta/recipes-connectivity/openssh/openssh/restore-tcp-wrappers.patch b/meta/recipes-connectivity/openssh/openssh/restore-tcp-wrappers.patch<br>
new file mode 100644<br>
index 0000000..1d819fa<br>
--- /dev/null<br>
+++ b/meta/recipes-connectivity/openssh/openssh/restore-tcp-wrappers.patch<br>
@@ -0,0 +1,174 @@<br>
+From 1850a2c93f3dcfa3d682eaa85d1593c01d170429 Mon Sep 17 00:00:00 2001<br>
+From: Colin Watson <<a href="mailto:cjwatson@debian.org">cjwatson@debian.org</a>><br>
+Date: Tue, 7 Oct 2014 13:22:41 +0100<br>
+Subject: Restore TCP wrappers support<br>
+<br>
+Support for TCP wrappers was dropped in OpenSSH 6.7. See this message<br>
+and thread:<br>
+<br>
+ <a href="https://lists.mindrot.org/pipermail/openssh-unix-dev/2014-April/032497.html" rel="noreferrer" target="_blank">https://lists.mindrot.org/pipermail/openssh-unix-dev/2014-April/032497.html</a><br>
+<br>
+It is true that this reduces preauth attack surface in sshd. On the<br>
+other hand, this support seems to be quite widely used, and abruptly<br>
+dropping it (from the perspective of users who don't read<br>
+openssh-unix-dev) could easily cause more serious problems in practice.<br>
+<br>
+It's not entirely clear what the right long-term answer for Debian is,<br>
+but it at least probably doesn't involve dropping this feature shortly<br>
+before a freeze.<br>
+<br>
+Forwarded: not-needed<br>
+Last-Update: 2014-10-07<br>
+<br>
+Upstream-Status: Inappropriate<br>
+<br>
+Patch-Name: restore-tcp-wrappers.patch<br>
+---<br>
+ <a href="http://configure.ac" rel="noreferrer" target="_blank">configure.ac</a> | 57 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++<br>
+ sshd.8 | 7 +++++++<br>
+ sshd.c | 25 +++++++++++++++++++++++++<br>
+ 3 files changed, 89 insertions(+)<br>
+<br>
+diff --git a/<a href="http://configure.ac" rel="noreferrer" target="_blank">configure.ac</a> b/<a href="http://configure.ac" rel="noreferrer" target="_blank">configure.ac</a><br>
+index df21693..4d55c46 100644<br>
+--- a/<a href="http://configure.ac" rel="noreferrer" target="_blank">configure.ac</a><br>
++++ b/<a href="http://configure.ac" rel="noreferrer" target="_blank">configure.ac</a><br>
+@@ -1448,6 +1448,62 @@ AC_ARG_WITH([skey],<br>
+ ]<br>
+ )<br>
+<br>
++# Check whether user wants TCP wrappers support<br>
++TCPW_MSG="no"<br>
++AC_ARG_WITH([tcp-wrappers],<br>
++ [ --with-tcp-wrappers[[=PATH]] Enable tcpwrappers support (optionally in PATH)],<br>
++ [<br>
++ if test "x$withval" != "xno" ; then<br>
++ saved_LIBS="$LIBS"<br>
++ saved_LDFLAGS="$LDFLAGS"<br>
++ saved_CPPFLAGS="$CPPFLAGS"<br>
++ if test -n "${withval}" && \<br>
++ test "x${withval}" != "xyes"; then<br>
++ if test -d "${withval}/lib"; then<br>
++ if test -n "${need_dash_r}"; then<br>
++ LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"<br>
++ else<br>
++ LDFLAGS="-L${withval}/lib ${LDFLAGS}"<br>
++ fi<br>
++ else<br>
++ if test -n "${need_dash_r}"; then<br>
++ LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}"<br>
++ else<br>
++ LDFLAGS="-L${withval} ${LDFLAGS}"<br>
++ fi<br>
++ fi<br>
++ if test -d "${withval}/include"; then<br>
++ CPPFLAGS="-I${withval}/include ${CPPFLAGS}"<br>
++ else<br>
++ CPPFLAGS="-I${withval} ${CPPFLAGS}"<br>
++ fi<br>
++ fi<br>
++ LIBS="-lwrap $LIBS"<br>
++ AC_MSG_CHECKING([for libwrap])<br>
++ AC_LINK_IFELSE([AC_LANG_PROGRAM([[<br>
++#include <sys/types.h><br>
++#include <sys/socket.h><br>
++#include <netinet/in.h><br>
++#include <tcpd.h><br>
++int deny_severity = 0, allow_severity = 0;<br>
++ ]], [[<br>
++ hosts_access(0);<br>
++ ]])], [<br>
++ AC_MSG_RESULT([yes])<br>
++ AC_DEFINE([LIBWRAP], [1],<br>
++ [Define if you want<br>
++ TCP Wrappers support])<br>
++ SSHDLIBS="$SSHDLIBS -lwrap"<br>
++ TCPW_MSG="yes"<br>
++ ], [<br>
++ AC_MSG_ERROR([*** libwrap missing])<br>
++<br>
++ ])<br>
++ LIBS="$saved_LIBS"<br>
++ fi<br>
++ ]<br>
++)<br>
++<br>
+ # Check whether user wants to use ldns<br>
+ LDNS_MSG="no"<br>
+ AC_ARG_WITH(ldns,<br>
+@@ -4928,6 +4984,7 @@ echo " KerberosV support: $KRB5_MSG"<br>
+ echo " SELinux support: $SELINUX_MSG"<br>
+ echo " Smartcard support: $SCARD_MSG"<br>
+ echo " S/KEY support: $SKEY_MSG"<br>
++echo " TCP Wrappers support: $TCPW_MSG"<br>
+ echo " MD5 password support: $MD5_MSG"<br>
+ echo " libedit support: $LIBEDIT_MSG"<br>
+ echo " Solaris process contract support: $SPC_MSG"<br>
+diff --git a/sshd.8 b/sshd.8<br>
+index dcf20f0..5afd10f 100644<br>
+--- a/sshd.8<br>
++++ b/sshd.8<br>
+@@ -853,6 +853,12 @@ the user's home directory becomes accessible.<br>
+ This file should be writable only by the user, and need not be<br>
+ readable by anyone else.<br>
+ .Pp<br>
++.It Pa /etc/hosts.allow<br>
++.It Pa /etc/hosts.deny<br>
++Access controls that should be enforced by tcp-wrappers are defined here.<br>
++Further details are described in<br>
++.Xr hosts_access 5 .<br>
++.Pp<br>
+ .It Pa /etc/hosts.equiv<br>
+ This file is for host-based authentication (see<br>
+ .Xr ssh 1 ) .<br>
+@@ -956,6 +962,7 @@ The content of this file is not sensitive; it can be world-readable.<br>
+ .Xr ssh-keygen 1 ,<br>
+ .Xr ssh-keyscan 1 ,<br>
+ .Xr chroot 2 ,<br>
++.Xr hosts_access 5 ,<br>
+ .Xr login.conf 5 ,<br>
+ .Xr moduli 5 ,<br>
+ .Xr sshd_config 5 ,<br>
+diff --git a/sshd.c b/sshd.c<br>
+index 6b85e6c..186ad55 100644<br>
+--- a/sshd.c<br>
++++ b/sshd.c<br>
+@@ -129,6 +129,13 @@<br>
+ #include <Security/AuthSession.h><br>
+ #endif<br>
+<br>
++#ifdef LIBWRAP<br>
++#include <tcpd.h><br>
++#include <syslog.h><br>
++int allow_severity;<br>
++int deny_severity;<br>
++#endif /* LIBWRAP */<br>
++<br>
+ #ifndef O_NOCTTY<br>
+ #define O_NOCTTY 0<br>
+ #endif<br>
+@@ -2141,6 +2148,24 @@ main(int ac, char **av)<br>
+ #ifdef SSH_AUDIT_EVENTS<br>
+ audit_connection_from(remote_ip, remote_port);<br>
+ #endif<br>
++#ifdef LIBWRAP<br>
++ allow_severity = options.log_facility|LOG_INFO;<br>
++ deny_severity = options.log_facility|LOG_WARNING;<br>
++ /* Check whether logins are denied from this host. */<br>
++ if (packet_connection_is_on_socket()) {<br>
++ struct request_info req;<br>
++<br>
++ request_init(&req, RQ_DAEMON, __progname, RQ_FILE, sock_in, 0);<br>
++ fromhost(&req);<br>
++<br>
++ if (!hosts_access(&req)) {<br>
++ debug("Connection refused by tcp wrapper");<br>
++ refuse(&req);<br>
++ /* NOTREACHED */<br>
++ fatal("libwrap refuse returns");<br>
++ }<br>
++ }<br>
++#endif /* LIBWRAP */<br>
+<br>
+ /* Log the connection. */<br>
+ laddr = get_local_ipaddr(sock_in);<br>
diff --git a/meta/recipes-connectivity/openssh/<a href="http://openssh_7.1p1.bb" rel="noreferrer" target="_blank">openssh_7.1p1.bb</a> b/meta/recipes-connectivity/openssh/<a href="http://openssh_7.1p1.bb" rel="noreferrer" target="_blank">openssh_7.1p1.bb</a><br>
index 40938cc..b621f62 100644<br>
--- a/meta/recipes-connectivity/openssh/<a href="http://openssh_7.1p1.bb" rel="noreferrer" target="_blank">openssh_7.1p1.bb</a><br>
+++ b/meta/recipes-connectivity/openssh/<a href="http://openssh_7.1p1.bb" rel="noreferrer" target="_blank">openssh_7.1p1.bb</a><br>
@@ -20,6 +20,7 @@ SRC_URI = "<a href="ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar" rel="noreferrer" target="_blank">ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar</a>.<br>
file://sshdgenkeys.service \<br>
file://volatiles.99_sshd \<br>
file://add-test-support-for-busybox.patch \<br>
+ file://restore-tcp-wrappers.patch \<br>
file://run-ptest"<br>
<br>
PAM_SRC_URI = "file://sshd"<br>
@@ -53,6 +54,9 @@ EXTRA_OECONF = "'LOGIN_PROGRAM=${base_bindir}/login' \<br>
--disable-strip \<br>
"<br>
<br>
+PACKAGECONFIG ??= "tcp-wrappers"<br>
+PACKAGECONFIG[tcp-wrappers] = "--with-tcp-wrappers,,tcp-wrappers"<br>
+<br>
# Since we do not depend on libbsd, we do not want configure to use it<br>
# just because it finds libutil.h. But, specifying --disable-libutil<br>
# causes compile errors, so...<br>
<span class=""><font color="#888888">--<br>
1.9.1<br>
<br>
--<br>
_______________________________________________<br>
Openembedded-core mailing list<br>
<a href="mailto:Openembedded-core@lists.openembedded.org">Openembedded-core@lists.openembedded.org</a><br>
<a href="http://lists.openembedded.org/mailman/listinfo/openembedded-core" rel="noreferrer" target="_blank">http://lists.openembedded.org/mailman/listinfo/openembedded-core</a><br>
</font></span></blockquote></div><br></div></div>