diff options
| author |   Sam James <sam@gentoo.org> | 2023-03-24 07:22:07 +0000 |
|---|---|---|
| committer | Sam James <sam@gentoo.org> | 2023-05-11 21:03:45 +0100 |
| commit | 5985af22c9feaa90943cd4cdc96bfe4da7ac2de5 (patch) | |
| tree | 3106432a2b57933e74d7133d12cf6c7c10b3dc1a /net-misc/openssh | |
| parent | net-misc/openssh-contrib: use /etc/ssh/ssh_config.d and /etc/ssh/sshd_config.... (diff) | |
| download | gentoo-5985af22c9feaa90943cd4cdc96bfe4da7ac2de5.tar.gz gentoo-5985af22c9feaa90943cd4cdc96bfe4da7ac2de5.tar.bz2 gentoo-5985af22c9feaa90943cd4cdc96bfe4da7ac2de5.zip | |
net-misc/openssh: revoke github.com's compromised RSA host key
See https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/.
It's necessary for the old github.com key to be explicitly removed (or revoked)
rather than just selecting a new key, i.e. it's possible for users to be silently
affected but not see the error because github.com may not serve them an RSA key.
Revoke the old github.com key as part of the ebuild to help users out.
Signed-off-by: Sam James <sam@gentoo.org>
Closes: https://github.com/gentoo/gentoo/pull/30327
Signed-off-by: Sam James <sam@gentoo.org>
Diffstat (limited to 'net-misc/openssh')
| -rw-r--r-- | net-misc/openssh/openssh-9.3_p1-r1.ebuild | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/net-misc/openssh/openssh-9.3_p1-r1.ebuild b/net-misc/openssh/openssh-9.3_p1-r1.ebuild index 83c262f034f8..95ec07b27720 100644 --- a/net-misc/openssh/openssh-9.3_p1-r1.ebuild +++ b/net-misc/openssh/openssh-9.3_p1-r1.ebuild @@ -257,6 +257,15 @@ tweak_ssh_configs() { SendEnv COLORTERM EOF + cat <<-EOF >> "${ED}"/etc/ssh/ssh_config.d/91gentoo-security.conf || die + RevokedHostKeys "${EPREFIX}/etc/ssh/ssh_revoked_hosts" + EOF + + cat <<-EOF >> "${ED}"/etc/ssh/ssh_revoked_hosts || die + # https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/ + ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ== + EOF + cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/90gentoo.conf || die # Allow client to pass locale environment variables (bug #367017) AcceptEnv ${locale_vars[*]} |