If maillock.h is found, a dependency on liblockfile will be created.
liblockfile is in meta-oe, so we don't want that in an oe-core recipe.

Signed-off-by: Dan McGregor <dan.mcgregor@usask.ca>
Signed-off-by: Ross Burton <ross.burton@intel.com>

Rebase sshd_config and ssh_config with openssh upstream.
Check for the ed25519 key in the systemd keygen service.

Signed-off-by: Dan McGregor <dan.mcgregor@usask.ca>
Signed-off-by: Ross Burton <ross.burton@intel.com>

Deliver script ssh-copy-id from openssh which is useful to add an
authorized ssh key.

Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>

* Drop two CVE patches already handled upstream.
* Drop nostrip.patch which no longer applies and use the existing
  --disable-strip configure option instead.
* OpenSSH 6.7+ no longer supports tcp wrappers. We could apply the
  Debian patch to add support back in, but it seems best to follow
  upstream here unless we have a good reason to do otherwise.

Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>

Using the export LD in the recipe does not allow for secodnary toolchain
overriding LD later, by setting it in the do_configure_append the export
is used by autotools setting LD based on the env, but would allow for
override later.

[YOCTO #6997]

Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>

Currently, we install our own ssh_config and sshd_config into ${S} in
do_compile_append() task. So when finishing compiling, their .out files
are generated by the original files, rather than by our own files.

In most cases, installing "$(CONFIGFILES)" in Makefile will generate .out
files again, and then installing "install-sysconf", which will install
these two files into $(DESTDIR), thus we get what we expect.

However, when parallel installing, "install-sysconf" may be installed
before "$(CONFIGFILES)" sometimes. In this rare case, the .out files
generated in the first time rather than those in the second time will be
installed into $(DESTDIR), and thus we get an unexpect result.

This patch fixes this bug through transfering the installing of our own
files from do_compile_append() into do_configure_prepend().

Signed-off-by: Zheng Junling <zhengjunling@huawei.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>

This patch was part of the 6.6p1 release.

Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>

Tell systemd just to kill the sshd process when the ssh connection drops
instead of the entire cgroup for sshd, so that any screen sessions (and
more to the point, processes within them) do not get killed.

(This is what the Fedora sshd service file does, and what we're already
doing in the dropbear service file).

Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>

Stopping sshd must only kill the listening (top-level) daemon; it must
not stop any other sshd process, because those are forked ssh
connections which may include e.g. the connection that called
/etc/init.d/sshd stop.

This initscript uses "start-stop-daemon -x <exe>" for starting/stopping.
When that is provided by busybox, this behavior is broken:
`/etc/init.d/sshd stop` stops *all* sshd processes. This was caused by a
fix to busybox 1.20: 17eedcad9406c43beddab3906c8c693626c351fb
"ssd: compat: match -x EXECUTABLE by /proc/pid/exe too".

The fix is to use a pidfile. All initscripts in upstream openssh do this,
as does dropbear.

Acked-by: Gratian Crisan <gratian.crisan@ni.com>
Acked-by: Ken Sharp <ken.sharp@ni.com>
Signed-off-by: Richard Tollerton <rich.tollerton@ni.com>
Signed-off-by: Ben Shelton <ben.shelton@ni.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>

Previously, even if PAM is enabled for ssh, the daemon still tries to
authenticate an empty password. This leads to authentication failure
which would mess up with PAM modules.

As a result, if 'UsePAM', 'PermitEmptyPasswords' and 'PasswordAuthentication'
are enabled, no user can login correctly. We would meet the following error
message at the client side.

	Write failed: Broken Pipe

This patch fixes the above problem by checking whether PAM is enabled before
authenticating an empty password. After all, if PAM is enabled, the task of
authenticating passwords should be handled to PAM modules.

[YOCTO #6466]

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>