FREEBSD-upgrade revision 181111 
1
2
3	    FreeBSD maintainer's guide to OpenSSH-portable
4	    ==============================================
5
6[needs rewriting for svn]
7
80) Make sure your mail spool has plenty of free space.  It'll fill up
9   pretty fast once you're done with this checklist.
10
111) Grab the latest OpenSSH-portable tarball from the OpenBSD FTP
12   site (ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/)
13
142) Unpack the tarball in a suitable directory.
15
16	$ tar xf openssh-X.YpZ.tar.gz \
17		-X /usr/src/crypto/openssh/FREEBSD-Xlist
18
193) Remove trash:
20
21   Make sure -X took care of everything, and if it didn't, make sure
22   to update FREEBSD-Xlist so you won't miss it the next time.  A good
23   way to do this is to run a test import and see if any new files
24   show up:
25
26	$ cvs -n import src/crypto/openssh OPENSSH x | grep \^N
27
284) Import the sources:
29
30	$ cvs import src/crypto/openssh OPENSSH OpenSSH_X_YpZ
31
325) Resolve conflicts.  Remember to bump the version number and
33   addendum in version.h, and update the default value in
34   ssh{,d}_config and ssh{,d}_config.5.
35
366) Generate configure and config.h.in:
37
38	$ autoconf
39	$ autoheader
40
41   Note: this requires a recent version of autoconf, not autoconf213.
42
437) Run configure with the appropriate arguments:
44
45	$ ./configure --prefix=/usr --sysconfdir=/etc/ssh \
46		--with-pam --with-tcp-wrappers --with-libedit \
47		--with-ssl-engine
48
49   This will regenerate config.h, which must be committed along with
50   the rest.
51
52   Note that we don't want to configure OpenSSH for Kerberos using
53   configure since we have to be able to turn it on or off depending
54   on the value of MK_KERBEROS.  Our Makefiles take care of this.
55
568) If source files have been added or removed, update the appropriate
57   makefiles to reflect changes in the vendor's Makefile.in.
58
599) Build libssh.  Follow the instructions in ssh_namespace.h to get a
60   list of new symbols.  Update ssh_namespace.h, build everything,
61   install and test.
62
63A) Build and test the pam_ssh PAM module.  It gropes around libssh's
64   internals and will break if something significant changes or if
65   ssh_namespace.h is out of whack.
66
67B) Re-commit everything on repoman (you *did* use a test repo for
68   this, didn't you?)
69
70
71
72	  An overview of FreeBSD changes to OpenSSH-portable
73	  ==================================================
74
750) VersionAddendum
76
77   The SSH protocol allows for a human-readable version string of up
78   to 40 characters to be appended to the protocol version string.
79   FreeBSD takes advantage of this to include a date indicating the
80   "patch level", so people can easily determine whether their system
81   is vulnerable when an OpenSSH advisory goes out.  Some people,
82   however, dislike advertising their patch level in the protocol
83   handshake, so we've added a VersionAddendum configuration variable
84   to allow them to change or disable it.
85
861) Modified server-side defaults
87
88   We've modified some configuration defaults in sshd:
89
90      - PasswordAuthentication defaults to "no".
91
92      - LoginGraceTime defaults to 120 seconds instead of 600.
93
94      - PermitRootLogin defaults to "no".
95
96      - X11Forwarding defaults to "yes" (it's a threat to the client,
97        not to the server.)
98
992) Modified client-side defaults
100
101   We've modified some configuration defaults in ssh:
102
103      - CheckHostIP defaults to "no".
104
1053) Canonic host names
106
107   We've added code to ssh.c to canonicize the target host name after
108   reading options but before trying to connect.  This eliminates the
109   usual problem with duplicate known_hosts entries.
110
1114) setusercontext() environment
112
113   Our setusercontext(3) can set environment variables, which we must
114   take care to transfer to the child's environment.
115
116
117
118This port was brought to you by (in no particular order) DARPA, NAI
119Labs, ThinkSec, Nescaf�, the Aberlour Glenlivet Distillery Co.,
120Suzanne Vega, and a Sanford's #69 Deluxe Marker.
121
122					-- des@FreeBSD.org
123
124$FreeBSD: head/crypto/openssh/FREEBSD-upgrade 181111 2008-08-01 02:48:36Z des $
125