Move net-misc/openssh from overlay to portage-stable, configuration changes #945
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
krnowak
commented
Jun 22, 2023
| doins "${FILESDIR}/50-flatcar-sshd.conf" | ||
|
|
||
| # Install our socket drop-in file that disables the rate | ||
| # limitting on the sshd socket. |
There was a problem hiding this comment.
I'll fix this on the next push:
Suggested change
| # limitting on the sshd socket. | |
| # limiting on the sshd socket. |
There was a problem hiding this comment.
Will bump it to -r1 on the next push.
2 tasks
krnowak
force-pushed
the
krnowak/move-openssh
branch
from
128f1ff to
07ce61a
Compare
krnowak
force-pushed
the
krnowak/move-openssh
branch
from
07ce61a to
427c292
Compare
|
All tests failed, because both |
|
Build action triggered: https://github.com/flatcar/scripts/actions/runs/6351098280 |
krnowak
force-pushed
the
krnowak/move-openssh
branch
from
427c292 to
71bee87
Compare
krnowak
force-pushed
the
krnowak/move-openssh
branch
from
71bee87 to
a83dd42
Compare
krnowak
force-pushed
the
krnowak/move-openssh
branch
from
a83dd42 to
b820e0c
Compare
krnowak
force-pushed
the
krnowak/move-openssh
branch
from
b820e0c to
3f8d180
Compare
krnowak
force-pushed
the
krnowak/move-openssh
branch
from
3f8d180 to
764d2c7
Compare
krnowak
force-pushed
the
krnowak/move-openssh
branch
from
764d2c7 to
bba7041
Compare
It's from Gentoo commit 5b974a3c903327b37f46a0212bf397ef634a67fd.
None of these modifications are Flatcar-specific. We are trying to upstream them in gentoo/gentoo#31615. When they reach Gentoo, we can move net-misc/openssh to portage-stable.
- Import and update configs for ssh client and daemon from the flatcar/init repository. These configs have now became snippets that the main configuration file will include. - Install a drop-in file for the ssh.socket unit disabling the rate limiting. - Install compatibility symlinks in old ssh config locations that will point to respective files in /usr/share/flatcar/etc. - Make all these actions optional - openssh USE flag needs to be enabled. That way, generic images can pull those changes, while SDK can avoid doing so.
krnowak
force-pushed
the
krnowak/move-openssh
branch
from
bba7041 to
03a9b9d
Compare
|
CI passed. The only test that has failed was some nvidia stuff on azure arm64. Looks unrelated. |
pothos
approved these changes
Sep 29, 2023
|
Hm, looks like I forgot to actually paste a link to the Jenkins build: http://jenkins.infra.kinvolk.io:8080/job/container/job/packages_all_arches/2610/cldsv/ Currently I'm rerunning image changes jobs with a fix, so I can see the full report. |
|
Tests passed. The changes there are expected: -net-misc/openssh-9.3_p2-r1::coreos
+net-misc/openssh-9.4_p1::coreos
…
+/usr/lib/systemd/system/sshd.socket.d
+/usr/lib/systemd/system/sshd.socket.d/no-trigger-limit-burst.conf
…
-/usr/lib/tmpfiles.d/ssh.conf
…
/usr/share/flatcar/etc/ssh/ssh_config
+/usr/share/flatcar/etc/ssh/ssh_config.d
+/usr/share/flatcar/etc/ssh/ssh_config.d/50-flatcar-ssh.conf
+/usr/share/flatcar/etc/ssh/ssh_config.d/9999999gentoo-security.conf
+/usr/share/flatcar/etc/ssh/ssh_config.d/9999999gentoo.conf
/usr/share/flatcar/etc/ssh/ssh_revoked_hosts
/usr/share/flatcar/etc/ssh/sshd_config
+/usr/share/flatcar/etc/ssh/sshd_config.d
+/usr/share/flatcar/etc/ssh/sshd_config.d/50-flatcar-sshd.conf
+/usr/share/flatcar/etc/ssh/sshd_config.d/9999999gentoo-pam.conf
+/usr/share/flatcar/etc/ssh/sshd_config.d/9999999gentoo.conf
/usr/share/flatcar/etc/ssl |
The configs were moved to coreos-base/misc-files. In the meantime, update python compatibility and drop unused USE flag and an obsolete README file.
The sshd config provided by this package is now marked as provided for compatibility only - it will be there in case there is still a symlink in /etc pointing to it. The new config snippet will be used by the enable oslogin stuff in the updated coreos-base/oem-gce package in following commits.
This commit updates our Flatcar patch with a code that will install an sshd config snippet instead of editing the main sshd config file if snippets directory exists.
We will be installing an sshd config snippet instead of replacing the whole sshd config. In order to pull this off, we need to make sure that the snippets directory exists and the main sshd config file actually includes the snippets in the directory.
The configs provided by the openssh and Gentoo projects usually keep everything commented out, meaning that the default values will be used. On top of that, they will also include snippets in the snippet directory. As such, start installing the default configs. We only mask a snippet that defines sftp subsystem, because we provide our own config snippet from coreos-base/misc-files that defines it.
krnowak
force-pushed
the
krnowak/move-openssh
branch
from
ae65a06 to
cabc3c0
Compare
krnowak
had a problem deploying
to
development
GitHub Actions
Failure
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
CI: http://jenkins.infra.kinvolk.io:8080/job/container/job/packages_all_arches/2034/cldsv
This does mainly two changes:
/etc/ssh/ssh{,d}_config.d/. Adapt other packages that were messing with sshd config to start using snippets instead.The openssh ebuild changes are mostly dropping all the third-party high-performance patches that we weren't even using. In Gentoo, these patches were moved to a separate package,
net-misc/openssh-contrib.Fixes flatcar/Flatcar#1062.
Needs flatcar/init#98.
changelog/directory (user-facing change, bug fix, security fix, update)/bootand/usrsize, packages, list files for any missing binaries, kernel modules, config files, kernel modules, etc.