This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree".

The branch, master has been updated via 804ac341a18718e5593ef8d77670d28018515aa7 (commit) via 0712a67744c6da9f0e4ddb3510af7b42d5a6c223 (commit) via 955f8b14571d56cfd132710cdd29db30645aba67 (commit) via 1a4d5cfd92bb1f52e6670399ef94a36fe97cdf6a (commit) from 38067c08c727086c92899042ef40e2f7e17115e7 (commit)

Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below.

- Log ----------------------------------------------------------------- commit 804ac341a18718e5593ef8d77670d28018515aa7 Author: Michael Tremer michael.tremer@ipfire.org Date: Mon Dec 9 11:37:11 2024 +0000

core190: Load SSH RSA key on legacy systems

Signed-off-by: Michael Tremer michael.tremer@ipfire.org

commit 0712a67744c6da9f0e4ddb3510af7b42d5a6c223 Author: Michael Tremer michael.tremer@ipfire.org Date: Mon Dec 9 11:37:10 2024 +0000

OpenSSH: No longer try to load the RSA key

This key has been removed on new installations.

Signed-off-by: Michael Tremer michael.tremer@ipfire.org

commit 955f8b14571d56cfd132710cdd29db30645aba67 Author: Stefan Schantl stefan.schantl@ipfire.org Date: Sat Dec 7 16:04:00 2024 +0100

backup: Add /etc/ssh/sshd_config.d

Signed-off-by: Stefan Schantl stefan.schantl@ipfire.org Signed-off-by: Michael Tremer michael.tremer@ipfire.org

commit 1a4d5cfd92bb1f52e6670399ef94a36fe97cdf6a Author: Stefan Schantl stefan.schantl@ipfire.org Date: Sat Dec 7 16:03:59 2024 +0100

openssh: Introduce include directory for additional sshd config files

This patch adds the prosibility to place additional *.config files in /etc/ssh/sshd_config.d/ which will be included and loaded during the daemon startup process.

Because this files will not be overwritten by any update, they can be used to place custom or other persistent settings.

Signed-off-by: Stefan Schantl stefan.schantl@ipfire.org Signed-off-by: Michael Tremer michael.tremer@ipfire.org

-----------------------------------------------------------------------

Summary of changes: config/backup/include | 1 + config/rootfiles/common/openssh | 1 + config/rootfiles/core/190/update.sh | 8 ++++++++ config/ssh/sshd_config | 4 +++- lfs/openssh | 4 ++++ 5 files changed, 17 insertions(+), 1 deletion(-)

Difference in files: diff --git a/config/backup/include b/config/backup/include index f0708c87f..0bf9440d3 100644 --- a/config/backup/include +++ b/config/backup/include @@ -10,6 +10,7 @@ etc/logrotate.d etc/passwd etc/shadow etc/ssh/sshd_config +etc/ssh/sshd_config.d etc/ssh/ssh_host* etc/squid/squid.conf.local etc/squid/squid.conf.pre.local diff --git a/config/rootfiles/common/openssh b/config/rootfiles/common/openssh index f7b479f55..d25651348 100644 --- a/config/rootfiles/common/openssh +++ b/config/rootfiles/common/openssh @@ -8,6 +8,7 @@ etc/ssh/ssh_config #etc/ssh/ssh_host_rsa_key #etc/ssh/ssh_host_rsa_key.pub etc/ssh/sshd_config +etc/ssh/sshd_config.d usr/bin/scp usr/bin/sftp usr/bin/ssh diff --git a/config/rootfiles/core/190/update.sh b/config/rootfiles/core/190/update.sh index 16ef608e2..3950ba903 100644 --- a/config/rootfiles/core/190/update.sh +++ b/config/rootfiles/core/190/update.sh @@ -104,6 +104,14 @@ ldconfig # Filesytem cleanup /usr/local/bin/filesystem-cleanup

+# Load the RSA key on systems that still have one +if [ -e "/etc/ssh/ssh_host_rsa_key" ]; then + ( + echo "# Load the legacy RSA key - Deprecated in Core Update 190" + echo "HostKey /etc/ssh/ssh_host_rsa_key" + ) > /etc/ssh/sshd_config.d/rsa.conf +fi + # Apply local configuration to sshd_config /usr/local/bin/sshctrl

diff --git a/config/ssh/sshd_config b/config/ssh/sshd_config index e338f8cef..7b687457c 100644 --- a/config/ssh/sshd_config +++ b/config/ssh/sshd_config @@ -27,7 +27,6 @@ MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@op # Only allow cryptographically safe SSH host keys (adjust paths if needed) HostKey /etc/ssh/ssh_host_ed25519_key HostKey /etc/ssh/ssh_host_ecdsa_key -HostKey /etc/ssh/ssh_host_rsa_key

# Only allow login via public key by default PubkeyAuthentication yes @@ -57,4 +56,7 @@ TCPKeepAlive no # Add support for SFTP Subsystem sftp /usr/lib/openssh/sftp-server

+# Include additional sshd config files. +Include /etc/ssh/sshd_config.d/*.conf + # EOF diff --git a/lfs/openssh b/lfs/openssh index c14c8267c..b1c9a1635 100644 --- a/lfs/openssh +++ b/lfs/openssh @@ -91,5 +91,9 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) install -v -m 644 $(DIR_SRC)/config/ssh/ssh_config \ /etc/ssh/ssh_config

+ # Create directory for additional config + # config files. + mkdir -pv /etc/ssh/sshd_config.d/ + @rm -rf $(DIR_APP) @$(POSTBUILD)

hooks/post-receive -- IPFire 2.x development tree