| Message ID | 20240418101529.124290-1-romain.naour@smile.fr |
|---|---|
| State | Accepted |
| Headers | show |
| Series | package/openssh: add libxcrypt optional dependency for sshd | expand |
Le 18/04/2024 à 12:15, Romain Naour a écrit : > When glibc was bumped to version 2.39 in commit > b5680f53d60acf8ff6010082f873438a39bd5d97 it removed the deprecated > libcrypt support. > > As glibc's libcrypt was providing sshd's libcrypt dependency this broke > the sshd password authentification at runtime using glibc version 2.39. > > # sshpass -p testpwd ssh -oStrictHostKeyChecking=no localhost /bin/true > Permission denied, please try again. > > Without libcrypt, OpenSSH >= 6.2 fall back to using openssl's DES_crypt > function on platorms that don't have a native crypt() function [1]. > > Note that DES_crypt is deprecated since openssl 3.0 [2] [3]. > > "Use of the low level DES functions has been informally discouraged for a > long time. We now formally deprecate them. > > Applications should instead use the EVP APIs, e.g. EVP_EncryptInit_ex, > EVP_EncryptUpdate, EVP_EncryptFinal_ex, and the equivalently named decrypt > functions." > > Also DES_crypt is provided by openssl only if > BR2_PACKAGE_LIBOPENSSL_ENABLE_DES is enabled. Otherwise crypt() is > never defined: > > sd-compat.a(xcrypt.o): in function `xcrypt': > xcrypt.c:(.text+0x48): undefined reference to `crypt' > > It's not clear why the password authentification fail with openssl's > DES_crypt but since it's deprecated we use libxcrypt to provide > a working crypt() function for glibc based toolchains. > > [1] https://github.com/openssh/openssh-portable/blob/V_9_7/openbsd-compat/xcrypt.c#L57 > [2] https://github.com/openssl/openssl/commit/c6fec81b88131d08c1022504ccf6effa95497afb > [3] https://www.openssl.org/docs/man3.2/man3/DES_crypt.html > > Fixes: > https://gitlab.com/buildroot.org/buildroot/-/jobs/6623402147 > > Signed-off-by: Romain Naour <romain.naour@smile.fr> > --- > package/openssh/Config.in | 1 + > package/openssh/openssh.mk | 5 +++++ > 2 files changed, 6 insertions(+) > > diff --git a/package/openssh/Config.in b/package/openssh/Config.in > index 08d3c7d391..25843447a7 100644 > --- a/package/openssh/Config.in > +++ b/package/openssh/Config.in > @@ -22,6 +22,7 @@ config BR2_PACKAGE_OPENSSH_CLIENT > config BR2_PACKAGE_OPENSSH_SERVER > bool "server" > default y > + select BR2_PACKAGE_LIBXCRYPT if BR2_TOOLCHAIN_USES_GLIBC > help > Server programs: sshd, sftp-server > > diff --git a/package/openssh/openssh.mk b/package/openssh/openssh.mk > index f0b499590a..d7f4db59ca 100644 > --- a/package/openssh/openssh.mk > +++ b/package/openssh/openssh.mk > @@ -45,6 +45,11 @@ endif > > OPENSSH_DEPENDENCIES = host-pkgconf zlib openssl > > +# crypt() in libcrypt only required for sshd. > +ifeq ($(BR2_PACKAGE_OPENSSH_SERVER)$(BR2_PACKAGE_LIBXCRYPT),yy) > +OPENSSH_DEPENDENCIES += libxcrypt > +endif > + > ifeq ($(BR2_PACKAGE_CRYPTODEV_LINUX),y) > OPENSSH_DEPENDENCIES += cryptodev-linux > OPENSSH_CONF_OPTS += --with-ssl-engine Applied to master, thanks. Best regards, Romain
diff --git a/package/openssh/Config.in b/package/openssh/Config.in index 08d3c7d391..25843447a7 100644 --- a/package/openssh/Config.in +++ b/package/openssh/Config.in @@ -22,6 +22,7 @@ config BR2_PACKAGE_OPENSSH_CLIENT config BR2_PACKAGE_OPENSSH_SERVER bool "server" default y + select BR2_PACKAGE_LIBXCRYPT if BR2_TOOLCHAIN_USES_GLIBC help Server programs: sshd, sftp-server diff --git a/package/openssh/openssh.mk b/package/openssh/openssh.mk index f0b499590a..d7f4db59ca 100644 --- a/package/openssh/openssh.mk +++ b/package/openssh/openssh.mk @@ -45,6 +45,11 @@ endif OPENSSH_DEPENDENCIES = host-pkgconf zlib openssl +# crypt() in libcrypt only required for sshd. +ifeq ($(BR2_PACKAGE_OPENSSH_SERVER)$(BR2_PACKAGE_LIBXCRYPT),yy) +OPENSSH_DEPENDENCIES += libxcrypt +endif + ifeq ($(BR2_PACKAGE_CRYPTODEV_LINUX),y) OPENSSH_DEPENDENCIES += cryptodev-linux OPENSSH_CONF_OPTS += --with-ssl-engine
When glibc was bumped to version 2.39 in commit b5680f53d60acf8ff6010082f873438a39bd5d97 it removed the deprecated libcrypt support. As glibc's libcrypt was providing sshd's libcrypt dependency this broke the sshd password authentification at runtime using glibc version 2.39. # sshpass -p testpwd ssh -oStrictHostKeyChecking=no localhost /bin/true Permission denied, please try again. Without libcrypt, OpenSSH >= 6.2 fall back to using openssl's DES_crypt function on platorms that don't have a native crypt() function [1]. Note that DES_crypt is deprecated since openssl 3.0 [2] [3]. "Use of the low level DES functions has been informally discouraged for a long time. We now formally deprecate them. Applications should instead use the EVP APIs, e.g. EVP_EncryptInit_ex, EVP_EncryptUpdate, EVP_EncryptFinal_ex, and the equivalently named decrypt functions." Also DES_crypt is provided by openssl only if BR2_PACKAGE_LIBOPENSSL_ENABLE_DES is enabled. Otherwise crypt() is never defined: sd-compat.a(xcrypt.o): in function `xcrypt': xcrypt.c:(.text+0x48): undefined reference to `crypt' It's not clear why the password authentification fail with openssl's DES_crypt but since it's deprecated we use libxcrypt to provide a working crypt() function for glibc based toolchains. [1] https://github.com/openssh/openssh-portable/blob/V_9_7/openbsd-compat/xcrypt.c#L57 [2] https://github.com/openssl/openssl/commit/c6fec81b88131d08c1022504ccf6effa95497afb [3] https://www.openssl.org/docs/man3.2/man3/DES_crypt.html Fixes: https://gitlab.com/buildroot.org/buildroot/-/jobs/6623402147 Signed-off-by: Romain Naour <romain.naour@smile.fr> --- package/openssh/Config.in | 1 + package/openssh/openssh.mk | 5 +++++ 2 files changed, 6 insertions(+)