Re: [yocto] [meta-selinux][PATCH] openssh: don't overwrite sshd_config unconditionally

["Joe MacDonald" <joe@deserted.net>]

[-- Attachment #1: Type: text/plain, Size: 9690 bytes --]

Hi Purushottam,

[Re: [yocto] [meta-selinux][PATCH] openssh: don't overwrite sshd_config unconditionally] On 21.03.12 (Fri 12:05) Purushottam choudhary wrote:

> Hi,
> 
> Please let me know if there any update on this change
> & the tentative week when this change is going to merge in the code.

Sorry about that, I haven't merged it for a couple of reasons, but I
should have followed up before now on it.  It doesn't appear to be against
the currnet head of tree, so I'd suggest a quick rebase on your part and
resend if you think it is still relevant.

At a more basic level, though, I don't know who or how many projects are
intending to use meta-selinux without PAM.  The layer documentation does
make it clear we expect PAM to always be present:

 45 1.2 - How does this layer do to enable SELinux features?
 46
 47 To enable SELinux features, this layers has done these works:
 48
 49    * new DISTRO_FEATURES "selinux" defined
 50    * new DISTRO "poky-selinux" defined, with DISTRO_FEATURES += "pam selinux"
 51    * config file for Linux kernel to enable SELinux
 52    * recipes for SELinux userland libraries and tools
 53    * package group (packagegroup-core-selinux) for SELinux userland packages
 54    * bbappends for SELinux related recipes to build with SELinux enabled
 55    * recipes for SELinux policy modified from refpolicy
 
The documentation is certainly in need of some updating, but I think the
majority of our users (if not all) are including PAM in their projects.  I
would be interested to hear about your PAM-less meta-selinux project if
you can share some details.

It is certainly arguable whether the config file should be dumped in place
as it is being today, but I do think it's functioning as intended right
now.  Shifting the PAM sshd configuration to a different directory is fine
with me, I don't have any particular love of everything in one files/
directory, but I also don't have any strong aversion to it until it
becomes an obvious problem (eg. two separate files that should have the
same name and different purposes, such as something to be installed in
/etc/defaults/ and /etc/X11/, maybe).

I hope that clears things up a bit.  Thanks.

-Joe.

> 
> Thanks & Regards,
> Purushottam
> 
> ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
> From: Purushottam Choudhary <purushottam.choudhary@kpit.com>
> Sent: Friday, February 26, 2021 2:29 PM
> To: yocto@lists.yoctoproject.org <yocto@lists.yoctoproject.org>
> Cc: Nisha Parrakat <Nisha.Parrakat@kpit.com>
> Subject: [meta-selinux][PATCH] openssh: don't overwrite sshd_config
> unconditionally
>
> The current implementation was overwriting the sshd_config and sshd
> assuming PAM is needed by default.
> 
> openssh should use the default sshd_config packaged with the component
> if no distro specific needs are present and not overwrite the full
> sshd_config file.
> 
> 1. If PAM is enabled as a distro then enable the UsePAM option in sshd_config.
> 2. Moved the file sshd to pam directory so that when pam is enabled,
>    then replace the default from poky by installing the same.
> 
> Signed-off-by: Purushottam Choudhary <purushottam.choudhary@kpit.com>
> ---
>  recipes-connectivity/openssh/files/{ => pam}/sshd |   0
>  recipes-connectivity/openssh/files/sshd_config    | 118 ----------------------
>  recipes-connectivity/openssh/openssh_%.bbappend   |  14 +++
>  3 files changed, 14 insertions(+), 118 deletions(-)
>  rename recipes-connectivity/openssh/files/{ => pam}/sshd (100%)
>  delete mode 100644 recipes-connectivity/openssh/files/sshd_config
> 
> diff --git a/recipes-connectivity/openssh/files/sshd b/recipes-connectivity/
> openssh/files/pam/sshd
> similarity index 100%
> rename from recipes-connectivity/openssh/files/sshd
> rename to recipes-connectivity/openssh/files/pam/sshd
> diff --git a/recipes-connectivity/openssh/files/sshd_config b/
> recipes-connectivity/openssh/files/sshd_config
> deleted file mode 100644
> index 1c33ad0..0000000
> --- a/recipes-connectivity/openssh/files/sshd_config
> +++ /dev/null
> @@ -1,118 +0,0 @@
> -#      $OpenBSD: sshd_config,v 1.102 2018/02/16 02:32:40 djm Exp $
> -
> -# This is the sshd server system-wide configuration file.  See
> -# sshd_config(5) for more information.
> -
> -# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin
> -
> -# The strategy used for options in the default sshd_config shipped with
> -# OpenSSH is to specify options with their default value where
> -# possible, but leave them commented.  Uncommented options override the
> -# default value.
> -
> -#Port 22
> -#AddressFamily any
> -#ListenAddress 0.0.0.0
> -#ListenAddress ::
> -
> -#HostKey /etc/ssh/ssh_host_rsa_key
> -#HostKey /etc/ssh/ssh_host_ecdsa_key
> -#HostKey /etc/ssh/ssh_host_ed25519_key
> -
> -# Ciphers and keying
> -#RekeyLimit default none
> -
> -# Logging
> -#SyslogFacility AUTH
> -#LogLevel INFO
> -
> -# Authentication:
> -
> -#LoginGraceTime 2m
> -#PermitRootLogin prohibit-password
> -#StrictModes yes
> -#MaxAuthTries 6
> -#MaxSessions 10
> -
> -#PubkeyAuthentication yes
> -
> -# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
> -# but this is overridden so installations will only check .ssh/authorized_keys
> -#AuthorizedKeysFile    .ssh/authorized_keys
> -
> -#AuthorizedPrincipalsFile none
> -
> -#AuthorizedKeysCommand none
> -#AuthorizedKeysCommandUser nobody
> -
> -# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
> -#HostbasedAuthentication no
> -# Change to yes if you don't trust ~/.ssh/known_hosts for
> -# HostbasedAuthentication
> -#IgnoreUserKnownHosts no
> -# Don't read the user's ~/.rhosts and ~/.shosts files
> -#IgnoreRhosts yes
> -
> -# To disable tunneled clear text passwords, change to no here!
> -#PasswordAuthentication yes
> -#PermitEmptyPasswords no
> -
> -# Change to yes to enable challenge-response passwords (beware issues with
> -# some PAM modules and threads)
> -ChallengeResponseAuthentication no
> -
> -# Kerberos options
> -#KerberosAuthentication no
> -#KerberosOrLocalPasswd yes
> -#KerberosTicketCleanup yes
> -#KerberosGetAFSToken no
> -
> -# GSSAPI options
> -#GSSAPIAuthentication no
> -#GSSAPICleanupCredentials yes
> -
> -# Set this to 'yes' to enable PAM authentication, account processing,
> -# and session processing. If this is enabled, PAM authentication will
> -# be allowed through the ChallengeResponseAuthentication and
> -# PasswordAuthentication.  Depending on your PAM configuration,
> -# PAM authentication via ChallengeResponseAuthentication may bypass
> -# the setting of "PermitRootLogin without-password".
> -# If you just want the PAM account and session checks to run without
> -# PAM authentication, then enable this but set PasswordAuthentication
> -# and ChallengeResponseAuthentication to 'no'.
> -UsePAM yes
> -
> -#AllowAgentForwarding yes
> -#AllowTcpForwarding yes
> -#GatewayPorts no
> -#X11Forwarding no
> -#X11DisplayOffset 10
> -#X11UseLocalhost yes
> -#PermitTTY yes
> -#PrintMotd yes
> -#PrintLastLog yes
> -#TCPKeepAlive yes
> -#UseLogin no
> -#PermitUserEnvironment no
> -Compression no
> -ClientAliveInterval 15
> -ClientAliveCountMax 4
> -#UseDNS no
> -#PidFile /var/run/sshd.pid
> -#MaxStartups 10:30:100
> -#PermitTunnel no
> -#ChrootDirectory none
> -#VersionAddendum none
> -
> -# no default banner path
> -#Banner none
> -
> -# override default of no subsystems
> -Subsystem      sftp    /usr/libexec/sftp-server
> -
> -# Example of overriding settings on a per-user basis
> -#Match User anoncvs
> -#      X11Forwarding no
> -#      AllowTcpForwarding no
> -#      PermitTTY no
> -#      ForceCommand cvs server
> diff --git a/recipes-connectivity/openssh/openssh_%.bbappend b/
> recipes-connectivity/openssh/openssh_%.bbappend
> index 7719d3b..b541c3e 100644
> --- a/recipes-connectivity/openssh/openssh_%.bbappend
> +++ b/recipes-connectivity/openssh/openssh_%.bbappend
> @@ -1 +1,15 @@
>  require ${@bb.utils.contains('DISTRO_FEATURES', 'selinux', '${BPN}
> _selinux.inc', '', d)}
> +
> +# if pam feature is enabled in the distro then take sshd from the pam
> directory.
> +FILESEXTRAPATHS_prepend := "${@bb.utils.contains('DISTRO_FEATURES', 'pam', '$
> {THISDIR}/files/pam:', ' ', d)}"
> +
> +do_install_append(){
> +
> +    if [ "${@bb.utils.filter('DISTRO_FEATURES', 'pam', d)}" ]; then
> +        # Make sure UsePAM entry is in the sshd_config file.
> +        # If entry not present then append it.
> +        grep -q 'UsePAM' "${D}/etc/ssh/sshd_config" && \
> +        sed -i 's/.*UsePAM.*/UsePAM yes/' "${D}/etc/ssh/sshd_config" || \
> +        echo 'UsePAM yes' >> "${D}/etc/ssh/sshd_config"
> +    fi
> +}
> --
> 2.7.4
> 
> This message contains information that may be privileged or confidential and is
> the property of the KPIT Technologies Ltd. It is intended only for the person
> to whom it is addressed. If you are not the intended recipient, you are not
> authorized to read, print, retain copy, disseminate, distribute, or use this
> message or any part thereof. If you receive this message in error, please
> notify the sender immediately and delete all copies of this message. KPIT
> Technologies Ltd. does not accept any liability for virus infected mails.

> 
> 
> 


-- 
-Joe MacDonald.
:wq

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 201 bytes --]