Use openssh to provide sftp-server service

PATCH Superseded Lianhao Lu 4 participants 9 messages Jun 11, 2012

Share & tools

Lianhao Lu

author

2012-06-11 09:13 UTC #0 lore raw

cover Use openssh to provide sftp-server service

This patch set changes dropbear to openssh in the referenced core sato-sdk image to provide the sftp-server service which is required by some other tools, e.g. the Eclipse Remote System Explorer.

The following changes since commit 75a973328d50ef3c007edb7a471ea77fb97911ea:
Bruce Ashfield (1):
kern-tools: anchor KMACHINE test

are available in the git repository at:

git://git.yoctoproject.org/poky-contrib llu/ssh
http://git.yoctoproject.org/cgit.cgi/poky-contrib/log/?h=llu/ssh

Lianhao Lu (3):
openssh: Allow empty passwords login.
task-core-ssh-openssh: Added openssh-sftp-server.
core-image-sato-sdk: Replace dropbear by openssh.

 .../openssh/openssh-6.0p1/sshd_config              |    2 +-
 meta/recipes-connectivity/openssh/openssh_6.0p1.bb |    2 +-
 meta/recipes-core/tasks/task-core-ssh-openssh.bb   |    2 +-
 meta/recipes-sato/images/core-image-sato-sdk.bb    |    4 +++-
 4 files changed, 6 insertions(+), 4 deletions(-)

Lianhao Lu

author

2012-06-11 09:13 UTC #1 lore raw

PATCH 1/3 openssh: Allow empty passwords login.

Allow empty passwords login so that the default root user can login in through openssh.

Signed-off-by Lianhao Lu <[email protected]>

---
 .../openssh/openssh-6.0p1/sshd_config              |    2 +-
 meta/recipes-connectivity/openssh/openssh_6.0p1.bb |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

meta/recipes-connectivity/openssh/openssh-6.0p1/sshd_config +1 -1

index 4f9b626..175e8f3 100644
@@ -59,7 +59,7 @@ Protocol 2
 
 # To disable tunneled clear text passwords, change to no here!
 #PasswordAuthentication yes
-#PermitEmptyPasswords no
+PermitEmptyPasswords yes
 
 # Change to no to disable s/key passwords
 #ChallengeResponseAuthentication yes

meta/recipes-connectivity/openssh/openssh_6.0p1.bb +1 -1

index 04fd6a9..ad62511 100644
@@ -7,7 +7,7 @@ SECTION = "console/network"
 LICENSE = "BSD"
 LIC_FILES_CHKSUM = "file://LICENCE;md5=e326045657e842541d3f35aada442507"
 
-PR = "r1"
+PR = "r2"
 
 DEPENDS = "zlib openssl"
 DEPENDS += "${@base_contains('DISTRO_FEATURES', 'pam', 'libpam', '', d)}"

Signature · 1 line

1.7.0.4

Lianhao Lu

author

2012-06-11 09:14 UTC #2 lore raw

PATCH 2/3 task-core-ssh-openssh: Added openssh-sftp-server.

Added openssh-sftp-server as the default.

Signed-off-by Lianhao Lu <[email protected]>

---
 meta/recipes-core/tasks/task-core-ssh-openssh.bb |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

meta/recipes-core/tasks/task-core-ssh-openssh.bb +1 -1

index 794399a..2e22d38 100644
@@ -12,6 +12,6 @@ PACKAGES = "\
 
 ALLOW_EMPTY = "1"
 
-RDEPENDS_task-core-ssh-openssh = "openssh"
+RDEPENDS_task-core-ssh-openssh = "openssh openssh-sftp-server"
 RDEPENDS_task-core-ssh-openssh-dbg = "openssh-dbg"
 RDEPENDS_task-core-ssh-openssh-dev = "openssh-dev"

Signature · 1 line

1.7.0.4

Lianhao Lu

author

2012-06-11 09:14 UTC #3 lore raw

PATCH 3/3 core-image-sato-sdk: Replace dropbear by openssh.

In reply to Lianhao Lu

Use openssh in core-image-sato-sdk to provide sftp-server service.

Signed-off-by Lianhao Lu <[email protected]>

---
 meta/recipes-sato/images/core-image-sato-sdk.bb |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)

meta/recipes-sato/images/core-image-sato-sdk.bb +3 -1

index eed1698..7f05332 100644
@@ -5,7 +5,9 @@ DESCRIPTION = "Image with Sato support that includes everything within \
 core-image-sato plus meta-toolchain, development headers and libraries to \
 form a standalone SDK."
 
-IMAGE_FEATURES += "apps-console-core ${SATO_IMAGE_FEATURES} dev-pkgs tools-sdk qt4-pkgs"
+SATO_SDK_IMAGE_FEATURES = "${@oe_filter_out('ssh-server-dropbear', '${SATO_IMAGE_FEATURES}', d)} ssh-server-openssh"
+
+IMAGE_FEATURES += "apps-console-core ${SATO_SDK_IMAGE_FEATURES} dev-pkgs tools-sdk qt4-pkgs"
 EXTRA_IMAGE_FEATURES += "tools-debug tools-profile tools-testapps debug-tweaks"
 
 LICENSE = "MIT"

Signature · 1 line

1.7.0.4

Anders Darander

NAK

2012-06-11 09:57 UTC #4 lore raw

Re: [PATCH 1/3] openssh: Allow empty passwords login.

In reply to Lianhao Lu

Quoted 2 lines · Lianhao Lu

Allow empty passwords login so that the default root user can login in through openssh.

NAK, this isn't a sane default for a OpenSSH-recipe...

What's your use-case? Is it for automatic testing/development? If so, can't you either set the password, or change the config using some other means, e.g. a post rootfs installation script? (And make sure that this is only run for the image in question, _not_ for all images).

/Anders

Signature · 2 lines

Anders Darander
ChargeStorm AB / eStorm AB

Paul Eggleton

2012-06-11 10:35 UTC #5 lore raw

Re: [PATCH 1/3] openssh: Allow empty passwords login.

Quoted 5 lines · On Monday 11 June 2012 11:45:49 Anders Darander wrote:

Quoted 2 lines · Lianhao Lu
Allow empty passwords login so that the default root user can login in through openssh.
NAK, this isn't a sane default for a OpenSSH-recipe...

I agree, however more below...

Quoted 4 lines

What's your use-case? Is it for automatic testing/development? If so, can't you either set the password, or change the config using some other means, e.g. a post rootfs installation script? (And make sure that this is only run for the image in question, _not_ for all images).

I don't think we want this to be image-specific. FWIW, we do already have a mechanism to handle this for the dropbear recipe - debug-tweaks in IMAGE_FEATURES. I don't particularly like it however since IMAGE_FEATURES should not be influencing non-image recipes. This has bothered me for a while and I think we ought to change to some other mechanism (perhaps make it a separate variable) and then make the OpenSSH recipe use that.

Cheers,
Paul

Signature · 2 lines

Paul Eggleton
Intel Open Source Technology Centre

Phil Blundell

2012-06-11 10:38 UTC #6 lore raw

Re: [PATCH 1/3] openssh: Allow empty passwords login.

Quoted 6 lines · Paul Eggleton

I don't think we want this to be image-specific. FWIW, we do already have a mechanism to handle this for the dropbear recipe - debug-tweaks in IMAGE_FEATURES. I don't particularly like it however since IMAGE_FEATURES should not be influencing non-image recipes. This has bothered me for a while and I think we ought to change to some other mechanism (perhaps make it a separate variable) and then make the OpenSSH recipe use that.

In the particular case of OpenSSH, it's just a configuration file setting, rather than a compile-time #ifdef, so doing it with IMAGE_FEATURES and a rootfs postprocess step sounds like a perfectly wholesome approach.

I agree that the current mechanism used by dropbear (applying patches based on IMAGE_FEATURES) is full of suck and should be changed, perhaps to something more akin to what openssh does.

Paul Eggleton

2012-06-11 11:23 UTC #7 lore raw

Re: [PATCH 1/3] openssh: Allow empty passwords login.

Quoted 9 lines · On Monday 11 June 2012 11:27:48 Phil Blundell wrote:

Quoted 7 lines · Paul Eggleton
I don't think we want this to be image-specific. FWIW, we do already have a
mechanism to handle this for the dropbear recipe - debug-tweaks in IMAGE_FEATURES. I don't particularly like it however since IMAGE_FEATURES should not be influencing non-image recipes. This has bothered me for a while and I think we ought to change to some other mechanism (perhaps make it a separate variable) and then make the OpenSSH recipe use that.

Quoted 8 lines

In the particular case of OpenSSH, it's just a configuration file setting, rather than a compile-time #ifdef, so doing it with IMAGE_FEATURES and a rootfs postprocess step sounds like a perfectly wholesome approach.
I agree that the current mechanism used by dropbear (applying patches based on IMAGE_FEATURES) is full of suck and should be changed, perhaps to something more akin to what openssh does.

Sounds good. I've created Yocto bug #2578 to look at fixing this in the manner you described.

Cheers,
Paul

Signature · 2 lines

Paul Eggleton
Intel Open Source Technology Centre

Anders Darander

2012-06-11 10:48 UTC #8 lore raw

Re: [PATCH 1/3] openssh: Allow empty passwords login.

In reply to Paul Eggleton

Quoted 8 lines · Paul Eggleton

Quoted 5 lines · On Monday 11 June 2012 11:45:49 Anders Darander wrote:
Quoted 2 lines · Lianhao Lu
Allow empty passwords login so that the default root user can login in through openssh.
NAK, this isn't a sane default for a OpenSSH-recipe...
I agree, however more below...

Good.

Quoted 11 lines

Quoted 4 lines
What's your use-case? Is it for automatic testing/development? If so, can't you either set the password, or change the config using some other means, e.g. a post rootfs installation script? (And make sure that this is only run for the image in question, _not_ for all images).
I don't think we want this to be image-specific. FWIW, we do already have a mechanism to handle this for the dropbear recipe - debug-tweaks in IMAGE_FEATURES. I don't particularly like it however since IMAGE_FEATURES should not be influencing non-image recipes. This has bothered me for a while and I think we ought to change to some other mechanism (perhaps make it a separate variable) and then make the OpenSSH recipe use that.

That's right, the image shouldn't affect compile-time options. However, in this particular case, as it is a configuration file, it should be fine.

The variable idea is also fine with me, as long as we keep sensible defaults, i.e. no empty password logins etc.

Cheers,
Anders

Signature · 2 lines

Anders Darander
ChargeStorm AB / eStorm AB