Replacing the Red Hat-supplied OpenSSH package with a newer version built from source Edit

didn’t

#!/bin/sh -e
# vhost-jail
# Copyright 2006-2008 Wincent Colaiuta
# Version 1.0 (20 January 2006): RHEL 3
# Version 2.0 (27 February 2008): RHEL 5.1

#
# Constants
#

# tools/executables:
RSSHHELPER=/usr/local/libexec/rssh_chroot_helper
SFTPSERVER=/usr/libexec/openssh/sftp-server

# support files:
LDCACHE=/etc/ld.so.cache
LDCONF=/etc/ld.so.conf
PASSWD=/etc/passwd
RSSHCONF=/usr/local/etc/rssh.conf

#
# Functions
#

die()
{
  SCRIPT=$(basename $0)
  echo "$SCRIPT: error: $1" >&2
  exit 1
}

# Returns the true name of a regular file or symlink (not a directory).
# For example, given a symbolic link like this:
#  /lib/libresolv.so.2 -> libresolv-2.5.so
# Then:
#   truename /lib/libresolv.so.2
# Returns:
#   /lib/libresolv-2.5.so
truename()
{
  FILE=$1
  DIR=$(dirname $FILE)
  NAME=$(basename $FILE)
  if [ ! -f $FILE ]; then
    die "truename(): $FILE is not a regular file"
  fi
  if [ -L $FILE ]; then
    TARGET=$(find $DIR -maxdepth 1 -name $NAME -printf "%l\n")
    TRUENAME="$DIR/$TARGET"
  else
    TRUENAME=$FILE
  fi
  echo $TRUENAME
}

lib_list()
{
  # Will process output from ldd that looks like this:
  #   linux-gate.so.1 =>  (0x00a5c000)
  #   libc.so.6 => /lib/libc.so.6 (0x00318000)
  #   /lib/ld-linux.so.2 (0x002fb000)
  # grep filters out lines which don't contain an absolute path
  # perl then strips off everything except the (space-delimited) path
  ldd $1 | grep / | perl -pe "s/.*?(\/[^ ]+).*/\1/"
}

createdir()
{
  if [ $# -ne 1 ]; then
    die "createdir() requires exactly one argument"
  fi
  if [ ! -d "$1" ]; then
   if [ -e "$1" ]; then
     die "createdir(): $1 already exists and is not a directory"
   else
    mkdir -p -v "$1" || die "createdir() failed for path: $1"
   fi
  fi
}

checkbase()
{
  if [ $# -ne 1 ]; then
    die "checkbase() requires exactly one argument"
  fi
  BASE="$1"
  COUNT=`echo "${BASE}" | egrep -c "\/$"`
  if [ $COUNT -ne 0 ]; then
    die "checkbase() requires base directory to have no trailing slash"
  fi
}

# Previously this method set up hard links and symbolic links.
# On this RHEL 5.1 install most hard links won't work (because they'd be cross-device links);
# so we copy instead of hard-linking (uses about 5MB per jail).
link()
{
  if [ $# -ne 2 ]; then
    die "link() requires exactly two arguments"
  fi
  FILE="$1"
  BASE="$2"
  DIR=$(dirname "$FILE")
  checkbase "${BASE}"
  createdir "${BASE}${DIR}"
  if [ ! -f "${FILE}" ]; then
    die "link(): ${FILE} is not a regular file"
  fi
  if [ -L "$1" ]; then
    NAME=$(basename "${FILE}")
    TARGET=$(find "$DIR" -maxdepth 1 -name "${NAME}" -printf "%l\n")
    TRUENAME="${DIR}/${TARGET}"
    echo "${FILE} is a symbolic link with target ${TRUENAME}"
    cp -v -f "$TRUENAME" "$BASE$TRUENAME" || die "cp failed for file: $TRUENAME"
    pushd "${BASE}${DIR}"
    ln -v -f -s "${TARGET}" "${NAME}" || die "link() (symbolic) failed for file: ${BASE}${FILE}"
    popd
  else
    cp -v -f "$FILE" "$BASE/$FILE" || die "cp failed for file: $FILE"
  fi
}

#
# Main
#

if [ $(whoami) != "root" ]; then
  die "this tool must be run as root"
fi

if [ $# -ne 2 ]; then
  die "exactly two arguments required ('path to chroot' and 'username')"
fi

BASE="$1"
USER="$2"
checkbase "${BASE}"

# create relevant /etc/passwd entry
DIR=$(dirname "$PASSWD")
createdir "${BASE}${DIR}"
cat "$PASSWD" | egrep "^${USER}:" > "$BASE$PASSWD"
COUNT=$(wc -l "$BASE$PASSWD" | awk '{print $1}')
if [ $COUNT -ne 1 ]; then
  die "error creating $BASE$PASSWD from $PASSWD"
fi

# Get an up-to-date list of libraries linked to by sftp-server:
LIBS=$(lib_list $SFTPSERVER)
for LIB in ${LIBS}; do
  link "${LIB}" "${BASE}"
done

LIBS=$(lib_list $RSSHHELPER)
for LIB in ${LIBS}; do
  link "${LIB}" "${BASE}"
done

# copy/link support files
link "${LDCACHE}" "${BASE}"
link "${LDCONF}" "${BASE}"

# copy/link tools
link "${RSSHHELPER}" "${BASE}"
link "${SFTPSERVER}" "${BASE}"

# set up /dev/null if required
test -d "$BASE/dev" || mkdir "$BASE/dev"
test -e "$BASE/dev/null" || cp -a /dev/null "$BASE/dev/null"

# append to rssh config
CONFIG="user=${USER}:022:00010:\"${BASE}\""
COUNT=$(cat "${RSSHCONF}" | egrep -c "${CONFIG}")
if [ $COUNT -eq 0 ]; then
  echo "Appending line to ${RSSHCONF}"
  echo "${CONFIG}"
  echo "${CONFIG}" >> "${RSSHCONF}"
fi

# tighten ownership on chroot jail dir
chown -v root:root "${BASE}"

exit 0

Replacing the Red Hat-supplied OpenSSH package with a newer version built from source Edit

Background

The decision to update

Making the transition

Follow-ups

`git push`

SSH `PATH`

Replacing the Red Hat-supplied OpenSSH package with a newer version built from sourceEdit

Background

The decision to update

Making the transition

Follow-ups

git push

SSH PATH

Replacing the Red Hat-supplied OpenSSH package with a newer version built from source Edit

`git push`

SSH `PATH`