gnu/packages/ssh.scm

   1 ;;; GNU Guix --- Functional package management for GNU
   2 ;;; Copyright © 2012-2022 Ludovic Courtès <ludo@gnu.org>
   3 ;;; Copyright © 2013, 2014 Andreas Enge <andreas@enge.fr>
   4 ;;; Copyright © 2014, 2015, 2016 Mark H Weaver <mhw@netris.org>
   5 ;;; Copyright © 2015, 2016, 2018, 2019, 2020, 2021, 2022 Efraim Flashner <efraim@flashner.co.il>
   6 ;;; Copyright © 2016, 2019 Leo Famulari <leo@famulari.name>
   7 ;;; Copyright © 2016, 2021 Nicolas Goaziou <mail@nicolasgoaziou.fr>
   8 ;;; Copyright © 2016 Christine Lemmer-Webber <cwebber@dustycloud.org>
   9 ;;; Copyright © 2017–2021 Tobias Geerinckx-Rice <me@tobias.gr>
  10 ;;; Copyright © 2017 Stefan Reichör <stefan@xsteve.at>
  11 ;;; Copyright © 2017 Ricardo Wurmus <rekado@elephly.net>
  12 ;;; Copyright © 2017 Nikita <nikita@n0.is>
  13 ;;; Copyright © 2018 Manuel Graf <graf@init.at>
  14 ;;; Copyright © 2019 Gábor Boskovits <boskovits@gmail.com>
  15 ;;; Copyright © 2019, 2020 Mathieu Othacehe <m.othacehe@gmail.com>
  16 ;;; Copyright © 2020 Jan (janneke) Nieuwenhuizen <janneke@gnu.org>
  17 ;;; Copyright © 2020 Oleg Pykhalov <go.wigust@gmail.com>
  18 ;;; Copyright © 2020, 2021 Maxim Cournoyer <maxim.cournoyer@gmail.com>
  19 ;;; Copyright © 2021 Brice Waegeneire <brice@waegenei.re>
  20 ;;;
  21 ;;; This file is part of GNU Guix.
  22 ;;;
  23 ;;; GNU Guix is free software; you can redistribute it and/or modify it
  24 ;;; under the terms of the GNU General Public License as published by
  25 ;;; the Free Software Foundation; either version 3 of the License, or (at
  26 ;;; your option) any later version.
  27 ;;;
  28 ;;; GNU Guix is distributed in the hope that it will be useful, but
  29 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
  30 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  31 ;;; GNU General Public License for more details.
  32 ;;;
  33 ;;; You should have received a copy of the GNU General Public License
  34 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
  35
  36 (define-module (gnu packages ssh)
  37   #:use-module (gnu packages)
  38   #:use-module (gnu packages autotools)
  39   #:use-module (gnu packages base)
  40   #:use-module (gnu packages boost)
  41   #:use-module (gnu packages compression)
  42   #:use-module (gnu packages crypto)
  43   #:use-module (gnu packages elf)
  44   #:use-module (gnu packages gnupg)
  45   #:use-module (gnu packages gperf)
  46   #:use-module (gnu packages groff)
  47   #:use-module (gnu packages guile)
  48   #:use-module (gnu packages hurd)
  49   #:use-module (gnu packages libedit)
  50   #:use-module (gnu packages linux)
  51   #:use-module (gnu packages logging)
  52   #:use-module (gnu packages m4)
  53   #:use-module (gnu packages multiprecision)
  54   #:use-module (gnu packages ncurses)
  55   #:use-module (gnu packages nettle)
  56   #:use-module (gnu packages kerberos)
  57   #:use-module (gnu packages perl)
  58   #:use-module (gnu packages pkg-config)
  59   #:use-module (gnu packages popt)
  60   #:use-module (gnu packages protobuf)
  61   #:use-module (gnu packages python)
  62   #:use-module (gnu packages python-crypto)
  63   #:use-module (gnu packages python-web)
  64   #:use-module (gnu packages python-xyz)
  65   #:use-module (gnu packages readline)
  66   #:use-module (gnu packages security-token)
  67   #:use-module (gnu packages texinfo)
  68   #:use-module (gnu packages tls)
  69   #:use-module (gnu packages xorg)
  70   #:use-module (guix build-system cmake)
  71   #:use-module (guix build-system gnu)
  72   #:use-module (guix build-system python)
  73   #:use-module (guix download)
  74   #:use-module (guix git-download)
  75   #:use-module ((guix licenses) #:prefix license:)
  76   #:use-module (guix packages)
  77   #:use-module (guix utils)
  78   #:use-module (srfi srfi-1))
  79
  80 (define-public hss
  81   (package
  82     (name "hss")
  83     (version "1.8")
  84     (source (origin
  85               (method git-fetch)
  86               (uri (git-reference
  87                     (url "https://github.com/six-ddc/hss")
  88                     (commit (string-append "v" version))))
  89               (file-name (git-file-name name version))
  90               (sha256
  91                (base32
  92                 "1rpysj65j9ls30bf2c5k5hykzzjfknrihs58imp178bx1wqzw4jl"))))
  93     (inputs
  94      (list readline))
  95     (arguments
  96      `(#:make-flags
  97        (list ,(string-append "CC=" (cc-for-target))
  98              (string-append "INSTALL_BIN=" (assoc-ref %outputs "out") "/bin"))
  99        #:tests? #f                      ; no tests
 100        #:phases
 101        (modify-phases %standard-phases
 102          (add-after 'unpack 'patch-file-names
 103            (lambda* (#:key inputs outputs #:allow-other-keys)
 104              (substitute* "Makefile"
 105                (("/usr/local/opt/readline")
 106                 (assoc-ref inputs "readline")))
 107              #t))
 108          (delete 'configure))))         ; no configure script
 109     (build-system gnu-build-system)
 110     (home-page "https://github.com/six-ddc/hss/")
 111     (synopsis "Interactive SSH client for multiple servers")
 112     (description
 113      "@command{hss} is an interactive SSH client for multiple servers.  Commands
 114 are executed on all servers in parallel.  Execution on one server does not need
 115 to wait for that on another server to finish before starting.  One can run a
 116 command on hundreds of servers at the same time, with almost the same experience
 117 as a local Bash shell.
 118
 119 It supports:
 120 @itemize @bullet
 121 @item interactive input: based on GNU readline.
 122 @item history: responding to the @kbd{C-r} key.
 123 @item auto-completion: @key{TAB}-completion from remote servers for commands and
 124 file names.
 125 @end itemize\n")
 126     (license license:expat)))
 127
 128 (define-public libssh
 129   (package
 130     (name "libssh")
 131     (version "0.9.6")
 132     (source (origin
 133               (method url-fetch)
 134               (uri (string-append "https://www.libssh.org/files/"
 135                                   (version-major+minor version)
 136                                   "/libssh-" version ".tar.xz"))
 137               (sha256
 138                (base32
 139                 "16w2mc7pyv9mijjlgacbz8dgczc7ig2m6m70w1pld04vpn2zig46"))))
 140     (build-system cmake-build-system)
 141     (outputs '("out" "debug"))
 142     (arguments
 143      '(#:configure-flags '("-DWITH_GCRYPT=ON")
 144
 145        ;; TODO: Add 'CMockery' and '-DWITH_TESTING=ON' for the test suite.
 146        #:tests? #f))
 147     (inputs (list zlib libgcrypt mit-krb5))
 148     (synopsis "SSH client library")
 149     (description
 150      "libssh is a C library implementing the SSHv2 and SSHv1 protocol for client
 151 and server implementations.  With libssh, you can remotely execute programs,
 152 transfer files, and use a secure and transparent tunnel for your remote
 153 applications.")
 154     (home-page "https://www.libssh.org")
 155     (license license:lgpl2.1+)))
 156
 157 (define-public libssh2
 158   (package
 159    (name "libssh2")
 160    (version "1.9.0")
 161    (source (origin
 162             (method url-fetch)
 163             (uri (string-append
 164                    "https://www.libssh2.org/download/libssh2-"
 165                    version ".tar.gz"))
 166             (sha256
 167              (base32
 168               "1zfsz9nldakfz61d2j70pk29zlmj7w2vv46s9l3x2prhcgaqpyym"))
 169             (patches (search-patches "libssh2-CVE-2019-17498.patch"))))
 170    (build-system gnu-build-system)
 171    ;; The installed libssh2.pc file does not include paths to libgcrypt and
 172    ;; zlib libraries, so we need to propagate the inputs.
 173    (propagated-inputs (list libgcrypt zlib))
 174    (arguments `(#:configure-flags `("--with-libgcrypt")))
 175    (synopsis "Client-side C library implementing the SSH2 protocol")
 176    (description
 177     "libssh2 is a library intended to allow software developers access to
 178 the SSH-2 protocol in an easy-to-use self-contained package.  It can be built
 179 into an application to perform many different tasks when communicating with
 180 a server that supports the SSH-2 protocol.")
 181    (license license:bsd-3)
 182    (home-page "https://www.libssh2.org/")))
 183
 184 (define-public openssh
 185   (package
 186    (name "openssh")
 187    (version "8.9p1")
 188    (source (origin
 189              (method url-fetch)
 190              (uri (string-append "mirror://openbsd/OpenSSH/portable/"
 191                                  "openssh-" version ".tar.gz"))
 192              (patches (search-patches "openssh-hurd.patch"
 193                                       "openssh-trust-guix-store-directory.patch"))
 194              (sha256
 195               (base32
 196                "1ry5prcax0134v6srkgznpl9ch5snkgq7yvjqvd8c5mbnxa7cjgx"))))
 197    (build-system gnu-build-system)
 198    (native-inputs (list groff pkg-config))
 199    (inputs `(("libedit" ,libedit)
 200              ("openssl" ,openssl)
 201              ,@(if (hurd-target?)
 202                    '()
 203                    `(("pam" ,linux-pam)
 204                      ("libfido2" ,libfido2)))     ;fails to build on GNU/Hurd
 205              ("mit-krb5" ,mit-krb5)
 206              ("zlib" ,zlib)
 207              ("xauth" ,xauth)))        ; for 'ssh -X' and 'ssh -Y'
 208    (arguments
 209     `(#:test-target "tests"
 210       ;; Otherwise, the test scripts try to use a nonexistent directory and
 211       ;; fail.
 212       #:make-flags '("REGRESSTMP=\"$${BUILDDIR}/regress\"")
 213       #:configure-flags  `("--sysconfdir=/etc/ssh"
 214
 215                            ;; Default value of 'PATH' used by sshd.
 216                           "--with-default-path=/run/current-system/profile/bin"
 217
 218                           ;; configure needs to find krb5-config.
 219                           ,(string-append "--with-kerberos5="
 220                                           (assoc-ref %build-inputs "mit-krb5")
 221                                           "/bin")
 222
 223                           ;; libedit is needed for sftp completion.
 224                           "--with-libedit"
 225
 226                           ;; Enable PAM support in sshd.
 227                           ,,@(if (hurd-target?)
 228                                '()
 229                                '("--with-pam"
 230
 231                                  ;; Support creation and use of ecdsa-sk,
 232                                  ;; ed25519-sk keys.
 233                                  "--with-security-key-builtin"))
 234
 235
 236
 237                           ;; "make install" runs "install -s" by default,
 238                           ;; which doesn't work for cross-compiled binaries
 239                           ;; because it invokes 'strip' instead of
 240                           ;; 'TRIPLET-strip'.  Work around this.
 241                           ,,@(if (%current-target-system)
 242                                  '("--disable-strip")
 243                                  '()))
 244
 245       #:phases
 246       (modify-phases %standard-phases
 247         (add-after 'configure 'reset-/var/empty
 248          (lambda* (#:key outputs #:allow-other-keys)
 249            (let ((out (assoc-ref outputs "out")))
 250              (substitute* "Makefile"
 251                (("PRIVSEP_PATH=/var/empty")
 252                 (string-append "PRIVSEP_PATH=" out "/var/empty"))))))
 253         (add-after 'configure 'set-store-location
 254           (lambda* _
 255             (substitute* "misc.c"
 256               (("@STORE_DIRECTORY@")
 257                (string-append "\"" (%store-directory) "\"")))))
 258         (add-before 'check 'patch-tests
 259          (lambda _
 260            (substitute* "regress/test-exec.sh"
 261              (("/bin/sh") (which "sh")))
 262
 263            ;; Remove 't-exec' regress target which requires user 'sshd'.
 264            (substitute* (list "Makefile"
 265                               "regress/Makefile")
 266              (("^(tests:.*) t-exec(.*)" all pre post)
 267               (string-append pre post)))))
 268         (replace 'install
 269           (lambda* (#:key outputs (make-flags '()) #:allow-other-keys)
 270             (let ((out (assoc-ref outputs "out")))
 271               ;; Install without host keys and system configuration files.
 272               ;; This will install /var/empty to the store, which is needed
 273               ;; by the system openssh-service-type.
 274               (apply invoke "make" "install-nosysconf" make-flags)
 275               (with-directory-excursion "contrib"
 276                 (chmod "ssh-copy-id" #o555)
 277                 (install-file "ssh-copy-id"
 278                               (string-append out "/bin/"))
 279                 (install-file "ssh-copy-id.1"
 280                               (string-append out "/share/man/man1/")))))))))
 281    (synopsis "Client and server for the secure shell (ssh) protocol")
 282    (description
 283     "The SSH2 protocol implemented in OpenSSH is standardised by the
 284 IETF secsh working group and is specified in several RFCs and drafts.
 285 It is composed of three layered components:
 286
 287 The transport layer provides algorithm negotiation and a key exchange.
 288 The key exchange includes server authentication and results in a
 289 cryptographically secured connection: it provides integrity, confidentiality
 290 and optional compression.
 291
 292 The user authentication layer uses the established connection and relies on
 293 the services provided by the transport layer.  It provides several mechanisms
 294 for user authentication.  These include traditional password authentication
 295 as well as public-key or host-based authentication mechanisms.
 296
 297 The connection layer multiplexes many different concurrent channels over the
 298 authenticated connection and allows tunneling of login sessions and
 299 TCP-forwarding.  It provides a flow control service for these channels.
 300 Additionally, various channel-specific options can be negotiated.")
 301    (license (license:non-copyleft "file://LICENSE"
 302                                "See LICENSE in the distribution."))
 303    (properties
 304     '((release-monitoring-url . "https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/")))
 305    (home-page "https://www.openssh.com/")))
 306
 307 ;; OpenSSH without X support. This allows to use OpenSSH without dragging X
 308 ;; libraries to the closure.
 309 (define-public openssh-sans-x
 310   (package
 311     (inherit openssh)
 312     (name "openssh-sans-x")
 313     (inputs (alist-delete "xauth" (package-inputs openssh)))
 314     (synopsis "OpenSSH client and server without X11 support")))
 315
 316 (define-public guile-ssh
 317   (package
 318     (name "guile-ssh")
 319     (version "0.15.1")
 320     (home-page "https://github.com/artyom-poptsov/guile-ssh")
 321     (source (origin
 322               (method git-fetch)
 323               (uri (git-reference
 324                     (url home-page)
 325                     (commit (string-append "v" version))))
 326               (file-name (git-file-name name version))
 327               (sha256
 328                (base32
 329                 "0zzn5hsf97b35gixyg4z14sspl15qwnp52y4h89wra4y31l7467q"))))
 330     (build-system gnu-build-system)
 331     (outputs '("out" "debug"))
 332     (arguments
 333      `(;; It makes no sense to build libguile-ssh.a.
 334        #:configure-flags '("--disable-static")
 335
 336        #:phases (modify-phases %standard-phases
 337                   (add-before 'bootstrap 'support-cross-compilation
 338                     (lambda _
 339                       ;; Support cross-compilation:
 340                       ;; <https://github.com/artyom-poptsov/guile-ssh/issues/30>.
 341                       (substitute* "libguile-ssh/Makefile.am"
 342                         (("\\$\\(guile_snarf\\)")
 343                          "CPP=\"$(CPP)\" $(guile_snarf)"))))
 344                   (add-before 'build 'fix-libguile-ssh-file-name
 345                     (lambda* (#:key outputs #:allow-other-keys)
 346                       ;; Build and install libguile-ssh.so so that we can use
 347                       ;; its absolute file name in .scm files, before we build
 348                       ;; the .go files.
 349                       (let* ((out (assoc-ref outputs "out"))
 350                              (lib (string-append out "/lib")))
 351                         (invoke "make" "install"
 352                                 "-C" "libguile-ssh"
 353                                 "-j" (number->string
 354                                       (parallel-job-count)))
 355                         (substitute* (find-files "." "\\.scm$")
 356                           (("\"libguile-ssh\"")
 357                            (string-append "\"" lib "/libguile-ssh\"")))
 358                         #t)))
 359                   ,@(if (%current-target-system)
 360                         '()
 361                         '((add-before 'check 'fix-guile-path
 362                              (lambda* (#:key inputs #:allow-other-keys)
 363                                (let ((guile (assoc-ref inputs "guile")))
 364                                  (substitute* "tests/common.scm"
 365                                    (("/usr/bin/guile")
 366                                     (string-append guile "/bin/guile")))
 367                                  #t)))))
 368                   (add-after 'install 'remove-bin-directory
 369                     (lambda* (#:key outputs #:allow-other-keys)
 370                       (let* ((out (assoc-ref outputs "out"))
 371                              (bin (string-append out "/bin"))
 372                              (examples (string-append
 373                                         out "/share/guile-ssh/examples")))
 374                         (mkdir-p examples)
 375                         (rename-file (string-append bin "/ssshd.scm")
 376                                      (string-append examples "/ssshd.scm"))
 377                         (rename-file (string-append bin "/sssh.scm")
 378                                      (string-append examples "/sssh.scm"))
 379                         (delete-file-recursively bin)
 380                         #t))))))
 381     (native-inputs (list autoconf
 382                          automake
 383                          libtool
 384                          texinfo
 385                          pkg-config
 386                          which
 387                          guile-3.0)) ;needed when cross-compiling.
 388     (inputs (list guile-3.0 libssh libgcrypt))
 389     (synopsis "Guile bindings to libssh")
 390     (description
 391      "Guile-SSH is a library that provides access to the SSH protocol for
 392 programs written in GNU Guile interpreter.  It is a wrapper to the underlying
 393 libssh library.")
 394     (license license:gpl3+)))
 395
 396 (define-public guile2.2-ssh
 397   (package
 398     (inherit guile-ssh)
 399     (name "guile2.2-ssh")
 400     (native-inputs
 401      (modify-inputs (package-native-inputs guile-ssh)
 402        (delete "guile")
 403        (prepend guile-2.2 ;needed when cross-compiling.
 404                 )))
 405     (inputs (modify-inputs (package-inputs guile-ssh)
 406               (replace "guile" guile-2.2)))))
 407
 408 (define-public corkscrew
 409   ;; The last 2.0 release hails from 2009.  Use a fork (submitted upstream as
 410   ;; <https://github.com/patpadgett/corkscrew/pull/5>) that adds now-essential
 411   ;; IPv6 and TLS support.
 412   (let ((revision "0")
 413         (commit "268b71e88ee51fddceab96d665b327394f1feb12"))
 414     (package
 415       (name "corkscrew")
 416       (version (git-version "2.0" revision commit))
 417       (source
 418        (origin
 419          (method git-fetch)
 420          (uri (git-reference
 421                (url "https://github.com/rtgill82/corkscrew")
 422                (commit commit)))
 423          (sha256
 424           (base32 "1rylbimlfig3ii4bqr4r058lkc43pqkxnxqpqdpm31blh3xs0dcw"))
 425          (file-name (git-file-name name version))))
 426       (build-system gnu-build-system)
 427       (arguments
 428        `(#:configure-flags
 429          (list "--enable-ssl")
 430          #:phases
 431          (modify-phases %standard-phases
 432            (add-after 'unpack 'update-metadata
 433              (lambda _
 434                (substitute* "configure.ac"
 435                  ;; Our version differs significantly.
 436                  (("2.0") (string-append ,version " (Guix)")))
 437                (substitute* "corkscrew.c"
 438                  ;; This domain's since been squat.
 439                  (("\\(agroman@agroman\\.net\\)")
 440                   (format #f "<~a>" ,(package-home-page this-package))))))
 441            (add-after 'install 'install-documentation
 442              (lambda* (#:key outputs #:allow-other-keys)
 443                (let* ((out (assoc-ref outputs "out"))
 444                       (doc (string-append out "/share/doc/" ,name "-" ,version)))
 445                  (install-file "README.md" doc)
 446                  #t))))))
 447       (native-inputs
 448        (list autoconf automake pkg-config))
 449       (inputs
 450        (list openssl))
 451       (home-page "https://github.com/patpadgett/corkscrew")
 452       (synopsis "SSH tunneling through HTTP(S) proxies")
 453       (description
 454        "Corkscrew tunnels SSH connections through most HTTP and HTTPS proxies.
 455 It supports proxy authentication through the HTTP basic authentication scheme
 456 with optional @acronym{TLS, Transport-Level Security} to protect credentials.")
 457       (license license:gpl2+))))
 458
 459 (define-public mosh
 460   (package
 461     (name "mosh")
 462     (version "1.3.2")
 463     (source (origin
 464               (method url-fetch)
 465               (uri (string-append "https://mosh.org/mosh-" version ".tar.gz"))
 466               (sha256
 467                (base32
 468                 "05hjhlp6lk8yjcy59zywpf0r6s0h0b9zxq0lw66dh9x8vxrhaq6s"))))
 469     (build-system gnu-build-system)
 470     (arguments
 471      '(#:phases
 472        (modify-phases %standard-phases
 473          (add-after 'unpack 'patch-FHS-file-names
 474            (lambda _
 475              (substitute* "scripts/mosh.pl"
 476                (("/bin/sh")
 477                 (which "sh")))
 478              #t))
 479          (add-after 'install 'wrap
 480            (lambda* (#:key outputs #:allow-other-keys)
 481              ;; Make sure 'mosh' can find 'mosh-client' and
 482              ;; 'mosh-server'.
 483              (let* ((out (assoc-ref outputs "out"))
 484                     (bin (string-append out "/bin")))
 485                (wrap-program (string-append bin "/mosh")
 486                              `("PATH" ":" prefix (,bin)))))))))
 487     (native-inputs
 488      (list pkg-config))
 489     (inputs
 490      `(("openssl" ,openssl)
 491        ("perl" ,perl)
 492        ("perl-io-tty" ,perl-io-tty)
 493        ("zlib" ,zlib)
 494        ("ncurses" ,ncurses)
 495        ("protobuf" ,protobuf)
 496        ("boost-headers" ,boost)))
 497     (home-page "https://mosh.org/")
 498     (synopsis "Remote shell tolerant to intermittent connectivity")
 499     (description
 500      "Mosh is a remote terminal application that allows client roaming, supports
 501 intermittent connectivity, and provides intelligent local echo and line editing
 502 of user keystrokes.  It's a replacement for SSH that's more robust and
 503 responsive, especially over Wi-Fi, cellular, and long-distance links.")
 504     (license license:gpl3+)))
 505
 506 (define-public dropbear
 507   (package
 508     (name "dropbear")
 509     (version "2020.81")
 510     (source
 511      (origin
 512        (method url-fetch)
 513        (uri (string-append
 514              "https://matt.ucc.asn.au/dropbear/releases/"
 515              "dropbear-" version ".tar.bz2"))
 516        (sha256
 517         (base32 "0fy5ma4cfc2pk25mcccc67b2mf1rnb2c06ilb7ddnxbpnc85s8s8"))
 518        (modules '((guix build utils)))
 519        (snippet
 520         '(begin
 521            (delete-file-recursively "libtommath")
 522            (delete-file-recursively "libtomcrypt")
 523            (substitute* "configure"
 524              (("-ltomcrypt") "-ltomcrypt -ltommath"))
 525            #t))))
 526     (build-system gnu-build-system)
 527     (arguments
 528      `(#:configure-flags '("--disable-bundled-libtom")
 529        #:tests? #f))    ; there is no "make check" or anything similar
 530     (inputs
 531      (list libtomcrypt libtommath zlib))
 532     (synopsis "Small SSH server and client")
 533     (description "Dropbear is a relatively small SSH server and
 534 client.  It runs on a variety of POSIX-based platforms.  Dropbear is
 535 particularly useful for embedded systems, such as wireless routers.")
 536     (home-page "https://matt.ucc.asn.au/dropbear/dropbear.html")
 537     (license (license:x11-style "" "See file LICENSE."))))
 538
 539 (define-public liboop
 540   (package
 541     (name "liboop")
 542     (version "1.0.1")
 543     (source
 544      (origin
 545       (method url-fetch)
 546       (uri (string-append "http://ftp.lysator.liu.se/pub/liboop/"
 547                           name "-" version ".tar.gz"))
 548       (sha256
 549        (base32
 550         "1q0p1l72pq9k3bi7a366j2rishv7dzzkg3i6r2npsfg7cnnidbsn"))))
 551     (build-system gnu-build-system)
 552     (home-page "https://www.lysator.liu.se/liboop/")
 553     (synopsis "Event loop library")
 554     (description "Liboop is a low-level event loop management library for
 555 POSIX-based operating systems.  It supports the development of modular,
 556 multiplexed applications which may respond to events from several sources.  It
 557 replaces the \"select() loop\" and allows the registration of event handlers
 558 for file and network I/O, timers and signals.  Since processes use these
 559 mechanisms for almost all external communication, liboop can be used as the
 560 basis for almost any application.")
 561     (license license:lgpl2.1+)))
 562
 563 (define-public lsh
 564   (package
 565     (name "lsh")
 566     (version "2.1")
 567     (source (origin
 568               (method url-fetch)
 569               (uri (string-append "mirror://gnu/lsh/lsh-"
 570                                   version ".tar.gz"))
 571               (sha256
 572                (base32
 573                 "1qqjy9zfzgny0rkb27c8c7dfsylvb6n0ld8h3an2r83pmaqr9gwb"))
 574               (modules '((guix build utils)))
 575               (snippet
 576                '(begin
 577                   (substitute* "src/testsuite/functions.sh"
 578                     (("localhost")
 579                      ;; Avoid host name lookups since they don't work in
 580                      ;; chroot builds.
 581                      "127.0.0.1")
 582                     (("set -e")
 583                      ;; Make tests more verbose.
 584                      "set -e\nset -x"))
 585
 586                   (substitute* (find-files "src/testsuite" "-test$")
 587                     (("localhost") "127.0.0.1"))
 588
 589                   (substitute* "src/testsuite/login-auth-test"
 590                     (("/bin/cat") "cat"))))
 591               (patches (search-patches "lsh-fix-x11-forwarding.patch"))))
 592     (build-system gnu-build-system)
 593     (native-inputs
 594      (list autoconf
 595            automake
 596            m4
 597            guile-2.0
 598            gperf
 599            psmisc))                       ; for `killall'
 600     (inputs
 601      (list nettle-2
 602            linux-pam
 603            ;; 'rl.c' uses the 'CPPFunction' type, which is no longer in
 604            ;; Readline 6.3.
 605            readline-6.2
 606            liboop
 607            zlib
 608            gmp
 609            ;; The server (lshd) invokes xauth when X11 forwarding is requested.
 610            ;; This adds 24 MiB (or 27%) to the closure of lsh.
 611            xauth
 612            libxau))             ;also required for x11-forwarding
 613     (arguments
 614      '(;; Skip the `configure' test that checks whether /dev/ptmx &
 615        ;; co. work as expected, because it relies on impurities (for
 616        ;; instance, /dev/pts may be unavailable in chroots.)
 617        #:configure-flags '("lsh_cv_sys_unix98_ptys=yes"
 618
 619                            ;; Use glibc's argp rather than the bundled one.
 620                            "--with-system-argp"
 621
 622                            ;; 'lsh_argp.h' checks HAVE_ARGP_PARSE but nothing
 623                            ;; defines it.
 624                            "CPPFLAGS=-DHAVE_ARGP_PARSE"
 625
 626                            ;; Fix the build of lsh@2.1 with GCC 10.
 627                            "CFLAGS=-O2 -g -fcommon")
 628        #:phases
 629        (modify-phases %standard-phases
 630          (add-after 'unpack 'disable-failing-tests
 631            (lambda _
 632              ;; FIXME: Most tests won't run in a chroot, presumably because
 633              ;; /etc/profile is missing, and thus clients get an empty $PATH
 634              ;; and nothing works.  Run only the subset that passes.
 635              (delete-file "configure")  ;force rebootstrap
 636              (substitute* "src/testsuite/Makefile.am"
 637                (("seed-test \\\\")        ;prevent trailing slash
 638                 "seed-test")
 639                (("^\t(lsh|daemon|tcpip|socks|lshg|lcp|rapid7|lshd).*test.*")
 640                 ""))))
 641          (add-before 'configure 'pre-configure
 642            (lambda* (#:key inputs #:allow-other-keys)
 643              (let* ((nettle    (assoc-ref inputs "nettle"))
 644                     (sexp-conv (string-append nettle "/bin/sexp-conv")))
 645                ;; Remove argp from the list of sub-directories; we don't want
 646                ;; to build it, really.
 647                (substitute* "src/Makefile.in"
 648                  (("^SUBDIRS = argp")
 649                   "SUBDIRS ="))
 650
 651                ;; Make sure 'lsh' and 'lshd' pick 'sexp-conv' in the right place
 652                ;; by default.
 653                (substitute* "src/environ.h.in"
 654                  (("^#define PATH_SEXP_CONV.*")
 655                   (string-append "#define PATH_SEXP_CONV \""
 656                                  sexp-conv "\"\n")))
 657
 658                ;; Same for the 'lsh-authorize' script.
 659                (substitute* "src/lsh-authorize"
 660                  (("=sexp-conv")
 661                   (string-append "=" sexp-conv)))
 662
 663                ;; Tell lshd where 'xauth' lives.  Another option would be to
 664                ;; hardcode "/run/current-system/profile/bin/xauth", thereby
 665                ;; reducing the closure size, but that wouldn't work on foreign
 666                ;; distros.
 667                (with-fluids ((%default-port-encoding "ISO-8859-1"))
 668                  (substitute* "src/server_x11.c"
 669                    (("define XAUTH_PROGRAM.*")
 670                     (string-append "define XAUTH_PROGRAM \""
 671                                    (assoc-ref inputs "xauth")
 672                                    "/bin/xauth\"\n")))))
 673
 674              ;; Tests rely on $USER being set.
 675              (setenv "USER" "guix"))))))
 676     (home-page "https://www.lysator.liu.se/~nisse/lsh/")
 677     (synopsis "GNU implementation of the Secure Shell (ssh) protocols")
 678     (description
 679      "GNU lsh is a free implementation of the SSH version 2 protocol.  It is
 680 used to create a secure line of communication between two computers,
 681 providing shell access to the server system from the client.  It provides
 682 both the server daemon and the client application, as well as tools for
 683 manipulating key files.")
 684     (license license:gpl2+)))
 685
 686 (define-public sshpass
 687   (package
 688     (name "sshpass")
 689     (version "1.09")
 690     (source
 691      (origin
 692        (method url-fetch)
 693        (uri (string-append "mirror://sourceforge/sshpass/sshpass/"
 694                            version "/sshpass-" version ".tar.gz"))
 695        (sha256
 696         (base32 "1dwzqknpswa8vjlbwsx9rcq1j2a7px9h9i2anh09pzkz0mg6wx3i"))))
 697     (build-system gnu-build-system)
 698     (home-page "https://sourceforge.net/projects/sshpass/")
 699     (synopsis "Non-interactive password authentication with SSH")
 700     (description "sshpass is a tool for non-interactively performing password
 701 authentication with SSH's so-called @dfn{interactive keyboard password
 702 authentication}.")
 703     (license license:gpl2+)))
 704
 705 (define-public autossh
 706   (package
 707     (name "autossh")
 708     (version "1.4g")
 709     (source
 710      (origin
 711        (method url-fetch)
 712        (uri (string-append
 713              "https://www.harding.motd.ca/autossh/autossh-"
 714              version ".tgz"))
 715        (sha256
 716         (base32 "0xqjw8df68f4kzkns5gcah61s5wk0m44qdk2z1d6388w6viwxhsz"))))
 717     (build-system gnu-build-system)
 718     (arguments `(#:tests? #f)) ; There is no "make check" or anything similar
 719     (inputs (list openssh))
 720     (synopsis "Automatically restart SSH sessions and tunnels")
 721     (description "autossh is a program to start a copy of @command{ssh} and
 722 monitor it, restarting it as necessary should it die or stop passing traffic.")
 723     (home-page "https://www.harding.motd.ca/autossh/")
 724     (license
 725      ;; Why point to a source file?  Well, all the individual files have a
 726      ;; copy of this license in their headers, but there's no separate file
 727      ;; with that information.
 728      (license:non-copyleft "file://autossh.c"))))
 729
 730 (define-public pdsh
 731   (package
 732     (name "pdsh")
 733     (version "2.34")
 734     (source
 735      (origin
 736        (method url-fetch)
 737        (uri (string-append "https://github.com/chaos/pdsh/"
 738                            "releases/download/pdsh-" version
 739                            "/pdsh-" version ".tar.gz"))
 740        (sha256
 741         (base32 "1s91hmhrz7rfb6h3l5k97s393rcm1ww3svp8dx5z8vkkc933wyxl"))))
 742     (build-system gnu-build-system)
 743     (arguments
 744      `(#:configure-flags
 745        (list "--with-ssh")
 746        #:phases
 747        (modify-phases %standard-phases
 748          (add-after 'unpack 'patch-/bin/sh
 749            (lambda _
 750              (substitute* '("tests/t0006-pdcp.sh"
 751                             "tests/t0004-module-loading.sh"
 752                             "tests/t2001-ssh.sh"
 753                             "tests/t1003-slurm.sh"
 754                             "tests/t6036-long-output-lines.sh"
 755                             "tests/aggregate-results.sh"
 756                             "tests/t2000-exec.sh"
 757                             "tests/t0002-internal.sh"
 758                             "tests/t1002-dshgroup.sh"
 759                             "tests/t5000-dshbak.sh"
 760                             "tests/t0001-basic.sh"
 761                             "tests/t0005-rcmd_type-and-user.sh"
 762                             "tests/test-lib.sh"
 763                             "tests/t2002-mrsh.sh"
 764                             "tests/t0003-wcoll.sh"
 765                             "tests/test-modules/pcptest.c")
 766                (("/bin/sh") (which "bash")))
 767              #t))
 768          (add-after 'unpack 'patch-tests
 769            (lambda _
 770              (substitute* "tests/t6036-long-output-lines.sh"
 771                (("which") (which "which")))
 772              #t)))))
 773     (inputs
 774      (list openssh mit-krb5 perl))
 775     (native-inputs
 776      (list which))
 777     (home-page "https://github.com/chaos/pdsh")
 778     (synopsis "Parallel distributed shell")
 779     (description "Pdsh is a an efficient, multithreaded remote shell client
 780 which executes commands on multiple remote hosts in parallel.  Pdsh implements
 781 dynamically loadable modules for extended functionality such as new remote
 782 shell services and remote host selection.")
 783     (license license:gpl2+)))
 784
 785 (define-public python-asyncssh
 786   (package
 787     (name "python-asyncssh")
 788     (version "2.7.1")
 789     (source
 790      (origin
 791        (method url-fetch)
 792        (uri (pypi-uri "asyncssh" version))
 793        (sha256
 794         (base32
 795          "0lnhh2h1mj79j66ni883s9f3xldnbjb10vh80g24b7m003mm524c"))))
 796     (build-system python-build-system)
 797     (propagated-inputs
 798      (list python-cryptography python-pyopenssl python-gssapi
 799            python-bcrypt))
 800     (native-inputs
 801      (list openssh openssl))
 802     (arguments
 803      `(#:phases
 804        (modify-phases %standard-phases
 805          (add-after 'unpack 'disable-tests
 806            (lambda* _
 807              (substitute* "tests/test_agent.py"
 808                ;; TODO Test fails for unknown reason
 809                (("(.+)async def test_confirm" all indent)
 810                 (string-append indent "@unittest.skip('disabled by guix')\n"
 811                                indent "async def test_confirm")))
 812              #t)))))
 813     (home-page "https://asyncssh.readthedocs.io/")
 814     (synopsis "Asynchronous SSHv2 client and server library for Python")
 815     (description
 816      "AsyncSSH is a Python package which provides an asynchronous client and
 817 server implementation of the SSHv2 protocol on top of the Python 3.6+ asyncio
 818 framework.")
 819     (license license:epl2.0)))
 820
 821 (define-public clustershell
 822   (package
 823     (name "clustershell")
 824     (version "1.8.4")
 825     (source
 826      (origin
 827        (method git-fetch)
 828        (uri (git-reference
 829              (url "https://github.com/cea-hpc/clustershell")
 830              (commit (string-append "v" version))))
 831        (file-name (git-file-name name version))
 832        (sha256
 833         (base32 "11b87vyamcw4rvgxz74jxwkr9ly0h9ldp2wqsi5wc19p0r06la5j"))))
 834     (build-system python-build-system)
 835     (inputs (list openssh))
 836     (propagated-inputs (list python-pyyaml))
 837     (arguments
 838      `(#:phases (modify-phases %standard-phases
 839                   (add-before 'build 'record-openssh-file-name
 840                     (lambda* (#:key inputs #:allow-other-keys)
 841                       (let ((ssh (assoc-ref inputs "openssh")))
 842                         (substitute* "lib/ClusterShell/Worker/Ssh.py"
 843                           (("info\\(\"ssh_path\"\\) or \"ssh\"")
 844                            (string-append "info(\"ssh_path\") or \""
 845                                           ssh "/bin/ssh\"")))))))))
 846     (home-page "https://cea-hpc.github.io/clustershell/")
 847     (synopsis "Scalable event-driven Python framework for cluster administration")
 848     (description
 849      "ClusterShell is an event-driven Python framework, designed to run local
 850 or distant commands in parallel on server farms or on large GNU/Linux
 851 clusters.  It will take care of common issues encountered on HPC clusters,
 852 such as operating on groups of nodes, running distributed commands using
 853 optimized execution algorithms, as well as gathering results and merging
 854 identical outputs, or retrieving return codes.  ClusterShell takes advantage
 855 of existing remote shell facilities such as SSH.")
 856     (license license:lgpl2.1+)))
 857
 858 (define-public endlessh
 859   (package
 860     (name "endlessh")
 861     (version "1.1")
 862     (source
 863       (origin
 864         (method git-fetch)
 865         (uri (git-reference
 866               (url "https://github.com/skeeto/endlessh")
 867               (commit version)))
 868         (file-name (git-file-name name version))
 869         (sha256
 870          (base32 "0ziwr8j1frsp3dajr8h5glkm1dn5cci404kazz5w1jfrp0736x68"))))
 871     (build-system gnu-build-system)
 872     (arguments
 873      `(#:make-flags (list (string-append "PREFIX=" (assoc-ref %outputs "out"))
 874                           ,(string-append "CC=" (cc-for-target)))
 875        #:tests? #f                      ; no test target
 876        #:phases
 877        (modify-phases %standard-phases
 878          (delete 'configure))))         ; no configure script
 879     (home-page "https://github.com/skeeto/endlessh")
 880     (synopsis "SSH tarpit that slowly sends an endless banner")
 881     (description
 882      "Endlessh is an SSH tarpit that very slowly sends an endless, random SSH
 883 banner.  It keeps SSH clients locked up for hours or even days at a time.  The
 884 purpose is to put your real SSH server on another port and then let the script
 885 kiddies get stuck in this tarpit instead of bothering a real server.
 886
 887 Since the tarpit is in the banner before any cryptographic exchange occurs, this
 888 program doesn't depend on any cryptographic libraries.  It's a simple,
 889 single-threaded, standalone C program.  It uses @code{poll()} to trap multiple
 890 clients at a time.")
 891     (license license:unlicense)))
 892
 893 (define-public webssh
 894   (package
 895     (name "webssh")
 896     (version "1.5.3")
 897     (source (origin
 898               (method git-fetch)
 899               (uri (git-reference
 900                     (url "https://github.com/huashengdun/webssh")
 901                     (commit (string-append "v" version))))
 902               (file-name (git-file-name name version))
 903               (sha256
 904                (base32
 905                 "1bcy9flrzbvams5p77swwiygv54ac58ia7hpic1bvg30b3wpvv7b"))))
 906     (build-system python-build-system)
 907     (propagated-inputs
 908      (list python-paramiko python-tornado))
 909     (home-page "https://webssh.huashengdun.org/")
 910     (synopsis "Web application to be used as an SSH client")
 911     (description "This package provides a web application to be used as an SSH
 912 client.
 913
 914 Features:
 915 @itemize @bullet
 916 @item SSH password authentication supported, including empty password.
 917 @item SSH public-key authentication supported, including DSA RSA ECDSA
 918 Ed25519 keys.
 919 @item Encrypted keys supported.
 920 @item Two-Factor Authentication (time-based one-time password) supported.
 921 @item Fullscreen terminal supported.
 922 @item Terminal window resizable.
 923 @item Auto detect the ssh server's default encoding.
 924 @item Modern browsers are supported.
 925 @end itemize")
 926     (license license:expat)))