openssh 10.4p1在openeuler系统进行RPM包构建

[micoder]

OpenSSH 10.4p1 - openEuler RPM Packaging Project

---

RPM Package Download Links:

AtomGit - 全球开发者的开源社区,开源代码托管平台

or

Index of /repositories/gitcode:openEuler-22.03-LTS-SP4:x86_64:MiCoder/

---

Overview

This project packages the OpenSSH 10.4p1 source code into RPM format under the openEuler system environment. It supports openEuler 22.03 LTS and 24.03 LTS.

Project Structure

openssh/
├── openssh-10.4p1.tar.gz          # OpenSSH 10.4p1 source archive
├── openssh-10.4p1.spec            # RPM spec file
├── build.sh                       # Automated build script
├── sshd.pam                       # PAM configuration
├── sshd.service                   # Systemd service unit
├── sshd.sysconfig                 # Service environment variables
├── sshd_config                    # Custom SSH server configuration
└── README.md                      # This document

Build Artifacts

After successful build, the following RPM sub-packages are generated:

RPM Package Name	Description	Contents
openssh	Core package	ssh-keygen, ssh-keysign, moduli
openssh-clients	Client package	ssh, scp, sftp, ssh-agent, ssh-add, ssh-keyscan, ssh-copy-id, ssh-pkcs11-helper, ssh-sk-helper
openssh-server	Server package	sshd, sshd-auth, sshd-session, sftp-server, Systemd service, PAM configuration
openssh-askpass	GUI password dialog	gnome-ssh-askpass, profile.d script
openssh-help	Documentation and man pages	All man pages and documentation

Environment Requirements

Supported Operating Systems

OS	Version	Architecture
openEuler	22.03 LTS	x86_64, aarch64
openEuler	24.03 LTS	x86_64, aarch64
openEuler	24.09	x86_64, aarch64

Full Dependency List

Build Dependencies (BuildRequires)

Package Name	Version Requirement	Purpose
autoconf	-	Regenerate configure script
automake	-	Generate Makefiles automatically
gcc	-	C compiler
make	-	Build tool
dos2unix	-	Convert line endings
groff	-	Format man pages
util-linux	-	Core utilities
perl-interpreter	-	Perl interpreter (build script helper)
perl-generators	-	Perl dependency generator
perl-podlators	-	Convert POD format
zlib-devel	-	Compression library
openssl-devel	>= 1.1.1	SSL/TLS encryption library
pam-devel	-	PAM authentication framework
libselinux-devel	>= 2.3-5	SELinux security policy
audit-libs-devel	>= 2.0.5	Linux audit system
krb5-devel	-	Kerberos 5 authentication
systemd-devel	-	Systemd service integration
p11-kit-devel	-	PKCS#11 smart card support
openldap-devel	-	LDAP support
gtk2-devel	-	GTK2 GUI library (askpass)
libX11-devel	-	X11 GUI library (askpass)
libedit-devel	-	Line editing and history (sftp)
ncurses-devel	-	Terminal control library
xauth	-	X11 authentication tool
gnupg2	-	GPG signature verification
crypto-policies	-	Cryptographic policies

Runtime Dependencies (Requires)

Package Name	Version Requirement	Belongs to
/sbin/nologin	-	openssh
libselinux	>= 2.3-5	openssh
audit-libs	>= 1.0.8	openssh
openssh-server = %{version}-%{release}	-	openssh
crypto-policies	>= 20180306-1	clients, server
pam	>= 1.0.1-3	server
shadow	-	server (pre)
systemd	-	server

Recommended Packages (Recommends)

Package Name	Purpose
p11-kit	PKCS#11 smart card middleware

Quick Build

Method 1: Using the Build Script (Recommended)

# Run as root
sudo bash build.sh

The script automatically performs:

1. Install all build dependencies
2. Set up RPM build environment
3. Generate SRPM source package
4. Build binary RPM packages
5. Output build results

Method 2: Manual Build

# 1. Install build dependencies
sudo dnf install -y rpm-build autoconf automake make gcc gcc-c++ \
    dos2unix groff util-linux perl-interpreter perl-generators \
    perl-podlators zlib-devel openssl-devel pam-devel \
    libselinux-devel audit-libs-devel krb5-devel systemd-devel \
    p11-kit-devel openldap-devel gtk2-devel libX11-devel \
    libedit-devel ncurses-devel xauth gnupg2

# 2. Set up RPM build directories
mkdir -p ~/rpmbuild/{SOURCES,SPECS,SRPMS,RPMS,BUILD,BUILDROOT}

# 3. Copy source and auxiliary files
cp openssh-10.4p1.tar.gz ~/rpmbuild/SOURCES/
cp sshd.pam sshd.sysconfig sshd.service sshd_config ~/rpmbuild/SOURCES/
cp openssh-10.4p1.spec ~/rpmbuild/SPECS/

# 4. Build
rpmbuild -ba ~/rpmbuild/SPECS/openssh-10.4p1.spec

Installation

# Install all packages
sudo rpm -Uvh ~/rpmbuild/RPMS/*/openssh-*.rpm

# Or use dnf
sudo dnf localinstall ~/rpmbuild/RPMS/*/openssh-*.rpm

Configuration Guide

Server Configuration

• Main config file: /etc/ssh/sshd_config
• Additional config directory: /etc/ssh/sshd_config.d/
• PAM configuration: /etc/pam.d/sshd
• Service environment variables: /etc/sysconfig/sshd

Client Configuration

• Global config: /etc/ssh/ssh_config
• Additional config directory: /etc/ssh/ssh_config.d/

Service Management

# Start the service
sudo systemctl start sshd

# Enable auto-start on boot
sudo systemctl enable sshd

# Check status
sudo systemctl status sshd

# Restart (reload config)
sudo systemctl restart sshd

Enabled Features

Feature	Description
PAM Authentication	Pluggable Authentication Modules support
SELinux Support	Security-Enhanced Linux policy
Kerberos 5	Enterprise-grade Kerberos authentication
Linux Audit	System audit logging
PKCS#11	Smart card / U2F hardware keys
Systemd	Modern service management
X11 Forwarding	GUI forwarding support
ssh-copy-id	Convenient key distribution
seccomp_filter	Sandboxing isolation (x86_64/aarch64)
PIE Security Hardening	Address Space Layout Randomization
RELRO/BIND_NOW	Read-only relocation protection
libedit	sftp line editing and history

Notes

1. FIDO/U2F Testing: Test suite is disabled during build due to potential issues with FIDO key emulators in container/virtual machine environments.
2. seccomp Sandbox: Automatically disabled on riscv64, loongarch64, and sw_64 architectures (incomplete kernel support).
3. Signature Files: No longer required for Source1 (.asc); related checks have been removed from the build process.
4. Self-Test: To run tests, uncomment the %%check section in the spec file and execute make tests.

Version History

Version	Date	Description
10.4p1-1	2026-07-20	First openEuler-compatible OpenSSH 10.4p1 RPM packaging
10.3p1-1	2026-06-01	OpenSSH 10.3p1 packaging based on openEuler

---

Spec File Review Report

This section documents the comprehensive review of openssh-10.4p1.spec, including functional validation and issue fixes.

Functional Validation

Feature	Review Result	Verification Basis
X11 Forwarding	Fully supported	BuildRequires: libX11-devel gtk2-devel xauth + --with-xauth=/usr/bin/xauth + sshd_config enables X11Forwarding by default + gnome-ssh-askpass built and installed
ssh-copy-id	Fully supported	contrib/ssh-copy-id installed to %{_bindir} + man page to man1 + declared in %files clients
PAM Authentication	Enabled	--with-pam + custom /etc/pam.d/sshd configuration
SELinux	Enabled	--with-selinux + libselinux-devel build dependency
Kerberos 5	Enabled	--with-kerberos5 + krb5-devel build dependency
Linux Audit	Enabled	--with-audit=linux + audit-libs-devel build dependency
PKCS#11	Auto-detected	p11-kit-devel build dependency; configure enables automatically
Systemd	Fully integrated	%systemd_post / %systemd_preun / %systemd_postun_with_restart + sshd.service unit
seccomp Sandbox	Conditionally enabled	--with-sandbox=seccomp_filter (x86_64/aarch64); disabled automatically on riscv64/loongarch64/sw_64
PIE Security Hardening	Enabled	LDFLAGS="$LDFLAGS -pie -z relro -z now"
libedit	Enabled	libedit-devel build dependency; configure detects automatically
askpass GUI Dialog	Fully supported	GTK2-based gnome-ssh-askpass built + ssh-askpass symlink + profile.d script

Issues Found & Fixes

#	Issue Description	Severity	Fix Method
1	Incorrect runtime library audit-libs >= 1.0.8 used in BuildRequires (should be audit-libs-devel; already present at line 31)	Medium	Removed redundant entry
2	%install creates ssh_config.d directory but not declared in %files clients, causing unpackaged files error during rpmbuild	High	Added %dir %attr(0755,root,root) %{_sysconfdir}/ssh/ssh_config.d in %files clients
3	Missing --with-xauth option may cause xauth path detection failure, affecting X11 forwarding	Medium	Added --with-xauth=/usr/bin/xauth
4	openEuler 2403 build failure: brp-digest-list script fails SELinux path check with Path is outside buildroot	High	Added BuildRequires: systemd-rpm-macros + %undefine __brp_digest_list

Syntax Structure Validation

Check Item	Result
%if / %endif balance (2 conditional blocks)	Fully closed
%package and %files correspondence (5 sub-packages)	Fully matched
Source declarations and %install references (4 Sources)	Fully referenced
Build script build.sh shell syntax check	Passed (bash -n)