From mboxrd@z Thu Jan  1 00:00:00 1970
From: Adolf Belka <adolf.belka@ipfire.org>
To: development@lists.ipfire.org
Subject: Re: [PATCH] OpenSSH: do not ship ssh-keysign anymore
Date: Mon, 17 May 2021 12:58:35 +0200
Message-ID: <1f9af340-c59b-58f3-8308-5ccb5301634f@ipfire.org>
In-Reply-To: <cdbc59f1-e0d3-3bf6-400e-04fc8fd8ca48@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============3859194013799673609=="
List-Id: <development.lists.ipfire.org>

--===============3859194013799673609==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Reviewed-by: Adolf Belka <adolf.belka(a)ipfire.org>

On 16/05/2021 22:48, Peter M=C3=BCller wrote:
> To my surprise, this binary comes with suid flag set, and since we do
> not have SSH key signing enabled, there is no need to ship it with
> IPFire.
>
> Signed-off-by: Peter M=C3=BCller <peter.mueller(a)ipfire.org>
> ---
>   config/rootfiles/common/openssh | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/config/rootfiles/common/openssh b/config/rootfiles/common/open=
ssh
> index f2f8ea6c5..c3666d914 100644
> --- a/config/rootfiles/common/openssh
> +++ b/config/rootfiles/common/openssh
> @@ -19,7 +19,7 @@ usr/bin/ssh-keygen
>   usr/bin/ssh-keyscan
>   #usr/lib/openssh
>   usr/lib/openssh/sftp-server
> -usr/lib/openssh/ssh-keysign
> +#usr/lib/openssh/ssh-keysign
>   usr/lib/openssh/ssh-pkcs11-helper
>   usr/lib/openssh/ssh-sk-helper
>   usr/sbin/sshd

--===============3859194013799673609==--