Slashdot Mirror
OpenSSH 4.0 & Portable OpenSSH 4.0p1 Released
UnderScan writes "As seen on openssh-unix-announce: 'OpenSSH 4.0 has just been released. It will be available from the
mirrors listed at http://www.openssh.com/ shortly. OpenSSH is a 100% complete SSH protocol version 1.3, 1.5 and 2.0 implementation and includes sftp client and server support. We would like to thank the OpenSSH community for their continued support to the project, especially those who contributed source and bought T-shirts or posters.' See the changelog or the freshmeat.net changes summary for more details."
Hasn't hit ports. :\
Karma: Chameleon (mostly due to the fact that you come and go).
MD5 (openssh-4.0p1.tar.gz) = 7b36f28fc16e1b7f4ba3c1dca191ac92
Source: http://www.undeadly.org/cgi?action=article&sid=200 50309172736
I'm sick of following my dreams - I'm just going to ask them where they're going and hook up with them later.
There is a SourceForge project at http://chrootssh.sourceforge.net/index.php that provides chroot patches for all OpenSSH versions. I believe the official developer's opinion on this is that it doesn't belong in OpenSSH which is why, well, it still isn't there.
As I'm sure you know, chroot is not necessarily a simple feature due to the fact that if you need a full environment to use commands (which aside from forwarding ports is the only thing ssh actually lets you do -- even sftp has a "server" command that gets run by the sftp client), so you can't just automatically have sshd know what library files and binaries are necessary for a user to have certain access.
/home, say, and then jail each user account in /home/user/ with only access to sash, busybox or some similar staticlly compiled multi-command utility.
What you ought to do instead is set up your users with ssh using rssh as a shell. rssh can give you a restricted environment without necessarily having to chroot (if you trust rssh, anyway), but if you really want to deal with the setup and maintenance overhead of a real chroot environment for a shell, rssh can do that too -- every user can have their own jail or they can share a jail and you can use permissions to restrict them.
I can't understand if this is your intent or you'd like sshd to run in a jail -- if that is the case, it's definately not a simple 'switch it on' feature either. The same rules apply except that your user accounts will be futher restricted to the root that sshd is running in. For the ultra paranoid you could jail sshd in
Remember, use hardlinks on all your bins and libs in your chroot jails otherwise you'll forget to update the files!
I use rssh on all of my servers, and it works quite well. Now days with rsync support I am one happy camper. BUT:
No support for FreeBSD 4x (no wordexp() function)
FreeBSD 5.2.x Functional, but due to a typo in wordexp.h you have to correct a line in the system header file to get it to compile - works fine after that.
Also the guy who came up with rssh has pretty much abandoned the project for his own reasons. One of the gentoo people discovered a vulerability which was fixed and eventually made its way back to the ports tree, but I'm not sure how well maintained such a port will be concerning security - although it's supposed to be pretty good code and considered feature complete.
It got a whole-digit bump because we ran out of minor digits and don't want double-digit minor version numbers (or hex :-).
$ find
That would be hpn-ssh. No, it's not in 4.0. Will it be included in future releases? Maybe, it needs to be looked at more closely.
$ find
Does ./configure handle cross-compile situations correctly yet?
... test.
For example, I want to build OpenSSH on an i386 Linux for an embedded MIPS Linux. Configure will detect that it is cross-compiling, but will still insist on performing its compile-and-run tests, either by erroring when it tries to run the MIPS binary on i386, or by saying it won't proceed any further because I'm cross-compiling which means it can't do its
I had to tediously hand-edit the configure script to shut off those errors (I lost count of how many instances) -- after which everything worked fine. But with each new release, I will need to edit that script again, which I don't enjoy.
An application I've used which does what you want is called scponly.
Features include chrooting to home directory, and full sftp, unison, and optional rsync compatibility.