FREEBSD-upgrade revision 294666 
1
2
3	    FreeBSD maintainer's guide to OpenSSH-portable
4	    ==============================================
5
600) Make sure your mail spool has plenty of free space.  It'll fill up
7    pretty fast once you're done with this checklist.
8
901) Download the latest OpenSSH-portable tarball and signature from
10    OpenBSD (ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/).
11
1202) Verify the signature:
13
14    $ gpg --verify openssh-X.YpZ.tar.gz.asc
15
1603) Unpack the tarball in a suitable directory:
17
18    $ tar xf openssh-X.YpZ.tar.gz
19
2004) Copy to the vendor directory:
21
22    $ svn co svn+ssh://svn.freebsd.org/base/vendor-crypto/openssh/dist
23    $ rsync --archive --delete openssh-X.YpZ/ dist/
24
2505) Take care of added / deleted files:
26
27    $ svn rm $(svn stat dist | awk '$1 == "!" { print $2 }')
28    $ svn add --no-auto-props $(svn stat dist | awk '$1 == "?" { print $2 }')
29
3006) Commit:
31
32    $ svn commit -m "Vendor import of OpenSSH X.YpZ." dist
33
3407) Tag:
35
36    $ svn copy -m "Tag OpenSSH X.YpZ." \
37        svn+ssh://svn.freebsd.org/base/vendor-crypto/openssh/dist \
38        svn+ssh://svn.freebsd.org/base/vendor-crypto/openssh/X.YpZ
39
4008) Check out head and run the pre-merge script:
41
42    $ svn co svn+ssh://svn.freebsd.org/base/head
43    $ cd head/crypto/openssh
44    $ sh freebsd-pre-merge.sh
45
4609) Merge from the vendor branch:
47
48    $ svn merge -cNNNNNN \^/vendor-crypto/openssh/dist .
49
500A) Resolve conflicts.  Remember to bump the version addendum in
51    version.h, and update the default value in ssh{,d}_config and
52    ssh{,d}_config.5.
53
540B) Diff against the vendor branch:
55
56    $ svn diff \^/vendor-crypto/openssh/dist .
57
58    Files that have modifications relative to the vendor code, and
59    only those files, must have the svn:keywords property set to
60    FreeBSD=%H and be listed in the 'keywords' file created by the
61    pre-merge script.
62
630C) Run the post-merge script:
64
65    $ sh freebsd-post-merge.sh
66
670D) Run the configure script:
68
69    $ sh freebsd-configure.sh
70
710E) Check config.h very carefully.
72
730F) If source files have been added or removed, update the appropriate
74    makefiles to reflect changes in the vendor's Makefile.in.
75
7610) Build libssh:
77
78    $ cd ../../secure/lib/libssh && make obj && make depend && make
79
8011) Follow the instructions in ssh_namespace.h to get a list of new
81    symbols, and them to ssh_namespace.h.  Keep it sorted!
82
8312) Build and install world, reboot, test.  Pay particular attention
84    to pam_ssh(8), which gropes inside libssh and will break if
85    something significant changes or if ssh_namespace.h is out of
86    whack.
87
8813) Commit, and hunker down for the inevitable storm of complaints.
89
90
91
92	  An overview of FreeBSD changes to OpenSSH-portable
93	  ==================================================
94
95XXX This section is out of date
96
970) VersionAddendum
98
99   The SSH protocol allows for a human-readable version string of up
100   to 40 characters to be appended to the protocol version string.
101   FreeBSD takes advantage of this to include a date indicating the
102   "patch level", so people can easily determine whether their system
103   is vulnerable when an OpenSSH advisory goes out.  Some people,
104   however, dislike advertising their patch level in the protocol
105   handshake, so we've added a VersionAddendum configuration variable
106   to allow them to change or disable it.
107
1081) Modified server-side defaults
109
110   We've modified some configuration defaults in sshd:
111
112      - PasswordAuthentication defaults to "no".
113
114      - LoginGraceTime defaults to 120 seconds instead of 600.
115
116      - PermitRootLogin defaults to "no".
117
118      - X11Forwarding defaults to "yes" (it's a threat to the client,
119        not to the server.)
120
1212) Modified client-side defaults
122
123   We've modified some configuration defaults in ssh:
124
125      - CheckHostIP defaults to "no".
126
1273) Canonic host names
128
129   We've added code to ssh.c to canonicize the target host name after
130   reading options but before trying to connect.  This eliminates the
131   usual problem with duplicate known_hosts entries.
132
1334) setusercontext() environment
134
135   Our setusercontext(3) can set environment variables, which we must
136   take care to transfer to the child's environment.
137
138
139
140This port was brought to you by (in no particular order) DARPA, NAI
141Labs, ThinkSec, Nescaf��, the Aberlour Glenlivet Distillery Co.,
142Suzanne Vega, and a Sanford's #69 Deluxe Marker.
143
144					-- des@FreeBSD.org
145
146$FreeBSD: stable/10/crypto/openssh/FREEBSD-upgrade 294666 2016-01-24 15:44:57Z des $
147