gnu/packages/ssh.scm

   1 ;;; GNU Guix --- Functional package management for GNU
   2 ;;; Copyright © 2012, 2013, 2014, 2015, 2016, 2017, 2018, 2019, 2020 Ludovic Courtès <ludo@gnu.org>
   3 ;;; Copyright © 2013, 2014 Andreas Enge <andreas@enge.fr>
   4 ;;; Copyright © 2014, 2015, 2016 Mark H Weaver <mhw@netris.org>
   5 ;;; Copyright © 2015, 2016, 2018, 2019 Efraim Flashner <efraim@flashner.co.il>
   6 ;;; Copyright © 2016, 2019 Leo Famulari <leo@famulari.name>
   7 ;;; Copyright © 2016 Nicolas Goaziou <mail@nicolasgoaziou.fr>
   8 ;;; Copyright © 2016 Christopher Allan Webber <cwebber@dustycloud.org>
   9 ;;; Copyright © 2017, 2018, 2019, 2020 Tobias Geerinckx-Rice <me@tobias.gr>
  10 ;;; Copyright © 2017 Stefan Reichör <stefan@xsteve.at>
  11 ;;; Copyright © 2017 Ricardo Wurmus <rekado@elephly.net>
  12 ;;; Copyright © 2017 ng0 <ng0@n0.is>
  13 ;;; Copyright © 2018 Manuel Graf <graf@init.at>
  14 ;;; Copyright © 2019 Gábor Boskovits <boskovits@gmail.com>
  15 ;;;
  16 ;;; This file is part of GNU Guix.
  17 ;;;
  18 ;;; GNU Guix is free software; you can redistribute it and/or modify it
  19 ;;; under the terms of the GNU General Public License as published by
  20 ;;; the Free Software Foundation; either version 3 of the License, or (at
  21 ;;; your option) any later version.
  22 ;;;
  23 ;;; GNU Guix is distributed in the hope that it will be useful, but
  24 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
  25 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  26 ;;; GNU General Public License for more details.
  27 ;;;
  28 ;;; You should have received a copy of the GNU General Public License
  29 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
  30
  31 (define-module (gnu packages ssh)
  32   #:use-module (gnu packages)
  33   #:use-module (gnu packages autotools)
  34   #:use-module (gnu packages base)
  35   #:use-module (gnu packages boost)
  36   #:use-module (gnu packages compression)
  37   #:use-module (gnu packages crypto)
  38   #:use-module (gnu packages elf)
  39   #:use-module (gnu packages gnupg)
  40   #:use-module (gnu packages gperf)
  41   #:use-module (gnu packages groff)
  42   #:use-module (gnu packages guile)
  43   #:use-module (gnu packages libedit)
  44   #:use-module (gnu packages linux)
  45   #:use-module (gnu packages logging)
  46   #:use-module (gnu packages m4)
  47   #:use-module (gnu packages multiprecision)
  48   #:use-module (gnu packages ncurses)
  49   #:use-module (gnu packages nettle)
  50   #:use-module (gnu packages kerberos)
  51   #:use-module (gnu packages perl)
  52   #:use-module (gnu packages pkg-config)
  53   #:use-module (gnu packages popt)
  54   #:use-module (gnu packages protobuf)
  55   #:use-module (gnu packages python)
  56   #:use-module (gnu packages python-xyz)
  57   #:use-module (gnu packages readline)
  58   #:use-module (gnu packages texinfo)
  59   #:use-module (gnu packages tls)
  60   #:use-module (gnu packages xorg)
  61   #:use-module (guix build-system cmake)
  62   #:use-module (guix build-system gnu)
  63   #:use-module (guix build-system python)
  64   #:use-module (guix download)
  65   #:use-module (guix git-download)
  66   #:use-module ((guix licenses) #:prefix license:)
  67   #:use-module (guix packages)
  68   #:use-module (guix utils)
  69   #:use-module (srfi srfi-1))
  70
  71 (define-public libssh
  72   (package
  73     (name "libssh")
  74     (version "0.9.3")
  75     (source (origin
  76               (method git-fetch)
  77               (uri (git-reference
  78                      (url "https://git.libssh.org/projects/libssh.git")
  79                      (commit (string-append "libssh-" version))))
  80               (sha256
  81                (base32
  82                 "175i3xybg69d5lb078334v6dd3njm743kww8f67ix9w33969rmzf"))
  83               (file-name (git-file-name name version))))
  84     (build-system cmake-build-system)
  85     (outputs '("out" "debug"))
  86     (arguments
  87      '(#:configure-flags '("-DWITH_GCRYPT=ON")
  88
  89        ;; TODO: Add 'CMockery' and '-DWITH_TESTING=ON' for the test suite.
  90        #:tests? #f))
  91     (inputs `(("zlib" ,zlib)
  92               ("libgcrypt" ,libgcrypt)))
  93     (synopsis "SSH client library")
  94     (description
  95      "libssh is a C library implementing the SSHv2 and SSHv1 protocol for client
  96 and server implementations.  With libssh, you can remotely execute programs,
  97 transfer files, and use a secure and transparent tunnel for your remote
  98 applications.")
  99     (home-page "https://www.libssh.org")
 100     (license license:lgpl2.1+)))
 101
 102 (define-public libssh2
 103   (package
 104    (name "libssh2")
 105    (version "1.9.0")
 106    (source (origin
 107             (method url-fetch)
 108             (uri (string-append
 109                    "https://www.libssh2.org/download/libssh2-"
 110                    version ".tar.gz"))
 111             (sha256
 112              (base32
 113               "1zfsz9nldakfz61d2j70pk29zlmj7w2vv46s9l3x2prhcgaqpyym"))))
 114    (build-system gnu-build-system)
 115    ;; The installed libssh2.pc file does not include paths to libgcrypt and
 116    ;; zlib libraries, so we need to propagate the inputs.
 117    (propagated-inputs `(("libgcrypt" ,libgcrypt)
 118                         ("zlib" ,zlib)))
 119    (arguments `(#:configure-flags `("--with-libgcrypt")))
 120    (synopsis "Client-side C library implementing the SSH2 protocol")
 121    (description
 122     "libssh2 is a library intended to allow software developers access to
 123 the SSH-2 protocol in an easy-to-use self-contained package.  It can be built
 124 into an application to perform many different tasks when communicating with
 125 a server that supports the SSH-2 protocol.")
 126    (license license:bsd-3)
 127    (home-page "https://www.libssh2.org/")))
 128
 129 (define-public openssh
 130   (package
 131    (name "openssh")
 132    (version "8.2p1")
 133    (source (origin
 134              (method url-fetch)
 135              (uri (string-append "mirror://openbsd/OpenSSH/portable/"
 136                                  "openssh-" version ".tar.gz"))
 137              (sha256
 138               (base32
 139                "0wg6ckzvvklbzznijxkk28fb8dnwyjd0w30ra0afwv6gwr8m34j3"))))
 140    (build-system gnu-build-system)
 141    (native-inputs `(("groff" ,groff)
 142                     ("pkg-config" ,pkg-config)))
 143    (inputs `(("libedit" ,libedit)
 144              ("openssl" ,openssl)
 145              ("pam" ,linux-pam)
 146              ("mit-krb5" ,mit-krb5)
 147              ("zlib" ,zlib)
 148              ("xauth" ,xauth)))         ; for 'ssh -X' and 'ssh -Y'
 149    (arguments
 150     `(#:test-target "tests"
 151       ;; Otherwise, the test scripts try to use a nonexistent directory and
 152       ;; fail.
 153       #:make-flags '("REGRESSTMP=\"$${BUILDDIR}/regress\"")
 154       #:configure-flags  `("--sysconfdir=/etc/ssh"
 155
 156                            ;; Default value of 'PATH' used by sshd.
 157                           "--with-default-path=/run/current-system/profile/bin"
 158
 159                           ;; configure needs to find krb5-config.
 160                           ,(string-append "--with-kerberos5="
 161                                           (assoc-ref %build-inputs "mit-krb5")
 162                                           "/bin")
 163
 164                           ;; libedit is needed for sftp completion.
 165                           "--with-libedit"
 166
 167                           ;; Enable PAM support in sshd.
 168                           "--with-pam")
 169
 170       #:phases
 171       (modify-phases %standard-phases
 172         (add-after 'configure 'reset-/var/empty
 173          (lambda* (#:key outputs #:allow-other-keys)
 174            (let ((out (assoc-ref outputs "out")))
 175              (substitute* "Makefile"
 176                (("PRIVSEP_PATH=/var/empty")
 177                 (string-append "PRIVSEP_PATH=" out "/var/empty")))
 178              #t)))
 179         (add-before 'check 'patch-tests
 180          (lambda _
 181            (substitute* "regress/test-exec.sh"
 182              (("/bin/sh") (which "sh")))
 183
 184            ;; Remove 't-exec' regress target which requires user 'sshd'.
 185            (substitute* (list "Makefile"
 186                               "regress/Makefile")
 187              (("^(tests:.*) t-exec(.*)" all pre post)
 188               (string-append pre post)))
 189            #t))
 190         (replace 'install
 191          (lambda* (#:key outputs (make-flags '()) #:allow-other-keys)
 192            ;; Install without host keys and system configuration files.
 193            (apply invoke "make" "install-nosysconf" make-flags)
 194            (install-file "contrib/ssh-copy-id"
 195                          (string-append (assoc-ref outputs "out")
 196                                         "/bin/"))
 197            (chmod (string-append (assoc-ref outputs "out")
 198                                  "/bin/ssh-copy-id") #o555)
 199            (install-file "contrib/ssh-copy-id.1"
 200                          (string-append (assoc-ref outputs "out")
 201                                         "/share/man/man1/"))
 202            #t)))))
 203    (synopsis "Client and server for the secure shell (ssh) protocol")
 204    (description
 205     "The SSH2 protocol implemented in OpenSSH is standardised by the
 206 IETF secsh working group and is specified in several RFCs and drafts.
 207 It is composed of three layered components:
 208
 209 The transport layer provides algorithm negotiation and a key exchange.
 210 The key exchange includes server authentication and results in a
 211 cryptographically secured connection: it provides integrity, confidentiality
 212 and optional compression.
 213
 214 The user authentication layer uses the established connection and relies on
 215 the services provided by the transport layer.  It provides several mechanisms
 216 for user authentication.  These include traditional password authentication
 217 as well as public-key or host-based authentication mechanisms.
 218
 219 The connection layer multiplexes many different concurrent channels over the
 220 authenticated connection and allows tunneling of login sessions and
 221 TCP-forwarding.  It provides a flow control service for these channels.
 222 Additionally, various channel-specific options can be negotiated.")
 223    (license (license:non-copyleft "file://LICENSE"
 224                                "See LICENSE in the distribution."))
 225    (home-page "https://www.openssh.com/")))
 226
 227 (define-public guile-ssh
 228   (package
 229     (name "guile-ssh")
 230     (version "0.11.3")
 231     (home-page "https://github.com/artyom-poptsov/guile-ssh")
 232     (source (origin
 233               (method git-fetch)
 234               (uri (git-reference
 235                     (url home-page)
 236                     (commit (string-append "v" version))))
 237               (file-name (string-append name "-" version ".tar.gz"))
 238               (sha256
 239                (base32
 240                 "03bv3hwp2s8f0bqgfjaan9jx4dyab0abv27n2zn2g0izlidv0vl6"))
 241               (modules '((guix build utils)))
 242               (snippet
 243                '(begin
 244                   ;; libssh >= 0.8.0 no longer provides libssh_threads: see
 245                   ;; <https://github.com/artyom-poptsov/guile-ssh/issues/9>.
 246                   (substitute* "libguile-ssh/Makefile.am"
 247                     (("-lssh_threads") ""))
 248
 249                   ;; This test would wrongfully pick DSS keys when running on
 250                   ;; libssh >= 0.8.0, which fails:
 251                   ;; <https://github.com/artyom-poptsov/guile-ssh/issues/10>.
 252                   (substitute* "tests/server.scm"
 253                     (("= %libssh-minor-version 7")
 254                      ">= %libssh-minor-version 7"))
 255
 256                   ;; Allow builds with Guile 3.0.
 257                   (substitute* "configure.ac"
 258                     (("^GUILE_PKG.*$")
 259                      "GUILE_PKG([3.0 2.2 2.0])\n"))
 260                   #t))))
 261     (build-system gnu-build-system)
 262     (outputs '("out" "debug"))
 263     (arguments
 264      '(;; It makes no sense to build libguile-ssh.a.
 265        #:configure-flags '("--disable-static")
 266
 267        #:phases (modify-phases %standard-phases
 268                   (add-before 'build 'fix-libguile-ssh-file-name
 269                     (lambda* (#:key outputs #:allow-other-keys)
 270                       ;; Build and install libguile-ssh.so so that we can use
 271                       ;; its absolute file name in .scm files, before we build
 272                       ;; the .go files.
 273                       (let* ((out (assoc-ref outputs "out"))
 274                              (lib (string-append out "/lib")))
 275                         (invoke "make" "install"
 276                                 "-C" "libguile-ssh"
 277                                 "-j" (number->string
 278                                       (parallel-job-count)))
 279                         (substitute* (find-files "." "\\.scm$")
 280                           (("\"libguile-ssh\"")
 281                            (string-append "\"" lib "/libguile-ssh\"")))
 282                         #t)))
 283                   (add-after 'install 'remove-bin-directory
 284                     (lambda* (#:key outputs #:allow-other-keys)
 285                       (let* ((out (assoc-ref outputs "out"))
 286                              (bin (string-append out "/bin"))
 287                              (examples (string-append
 288                                         out "/share/guile-ssh/examples")))
 289                         (mkdir-p examples)
 290                         (rename-file (string-append bin "/ssshd.scm")
 291                                      (string-append examples "/ssshd.scm"))
 292                         (rename-file (string-append bin "/sssh.scm")
 293                                      (string-append examples "/sssh.scm"))
 294                         (delete-file-recursively bin)
 295                         #t))))
 296        ;; Tests are not parallel-safe.
 297        #:parallel-tests? #f))
 298     (native-inputs `(("autoconf" ,autoconf)
 299                      ("automake" ,automake)
 300                      ("libtool" ,libtool)
 301                      ("texinfo" ,texinfo)
 302                      ("pkg-config" ,pkg-config)
 303                      ("which" ,which)
 304                      ("guile" ,guile-2.2)))
 305     (inputs `(("guile" ,guile-2.2)
 306               ("libssh" ,libssh)
 307               ("libgcrypt" ,libgcrypt)))
 308     (synopsis "Guile bindings to libssh")
 309     (description
 310      "Guile-SSH is a library that provides access to the SSH protocol for
 311 programs written in GNU Guile interpreter.  It is a wrapper to the underlying
 312 libssh library.")
 313     (license license:gpl3+)))
 314
 315 (define-public guile2.0-ssh
 316   (package
 317     (inherit guile-ssh)
 318     (name "guile2.0-ssh")
 319     (inputs `(("guile" ,guile-2.0)
 320               ,@(alist-delete "guile" (package-inputs guile-ssh))))))
 321
 322 (define-public guile3.0-ssh
 323   (package
 324     (inherit guile-ssh)
 325     (name "guile3.0-ssh")
 326     (arguments
 327      (substitute-keyword-arguments (package-arguments guile-ssh)
 328        ((#:phases phases)
 329         `(modify-phases ,phases
 330            (add-before 'bootstrap 'delete-old-guile-m4
 331              (lambda _
 332                ;; The old 'guile.m4' that's shipped would fail to recognize
 333                ;; Guile 2.9 as "3.0".
 334                (delete-file "m4/guile.m4")
 335                #t))
 336            (add-before 'build 'adjust-for-guile3
 337              (lambda _
 338                ;; Adjust for things that are deprecated in 2.2 and removed in
 339                ;; 3.0.
 340                (substitute* "tests/common.scm"
 341                  (("define-module \\(tests common\\)")
 342                   "define-module (tests common)
 343   #:use-module (ice-9 threads)\n"))
 344                (substitute* "modules/ssh/tunnel.scm"
 345                  (("define-module \\(ssh tunnel\\)")
 346                   "define-module (ssh tunnel)
 347   #:use-module (ice-9 threads)"))
 348                (substitute* "modules/srfi/srfi-64.upstream.scm"
 349                  (("_IOLBF")
 350                   "'line"))
 351                #t))))))
 352     (inputs `(("guile" ,guile-next)
 353               ,@(alist-delete "guile" (package-inputs guile-ssh))))))
 354
 355 (define-public corkscrew
 356   (package
 357     (name "corkscrew")
 358     (version "2.0")
 359     (source
 360      (origin
 361        (method url-fetch)
 362        ;; The agroman.net domain name expired on 2017-03-23, and the original
 363        ;; "http://www.agroman.net/corkscrew/corkscrew-2.0.tar.gz" now returns
 364        ;; bogus HTML.  Perhaps it will yet return.  Until then, use a mirror.
 365        (uri (string-append "https://downloads.openwrt.org/sources/"
 366                            "corkscrew-" version ".tar.gz"))
 367        (sha256 (base32
 368                 "1gmhas4va6gd70i2x2mpxpwpgww6413mji29mg282jms3jscn3qd"))))
 369     (build-system gnu-build-system)
 370     (arguments
 371      `(#:phases
 372        (modify-phases %standard-phases
 373          (replace 'configure
 374            ;; Replace configure phase as the ./configure script does not like
 375            ;; CONFIG_SHELL and SHELL passed as parameters
 376            (lambda* (#:key outputs build target #:allow-other-keys)
 377              (let* ((out   (assoc-ref outputs "out"))
 378                     (bash  (which "bash"))
 379                     ;; Set --build and --host flags as the provided config.guess
 380                     ;; is not able to detect them
 381                     (flags `(,(string-append "--prefix=" out)
 382                              ,(string-append "--build=" build)
 383                              ,(string-append "--host=" (or target build)))))
 384                (setenv "CONFIG_SHELL" bash)
 385                (apply invoke bash "./configure" flags))))
 386          (add-after 'install 'install-documentation
 387            (lambda* (#:key outputs #:allow-other-keys)
 388              (let* ((out (assoc-ref outputs "out"))
 389                     (doc (string-append out "/share/doc/" ,name "-" ,version)))
 390                (install-file "README" doc)
 391                #t))))))
 392     (home-page "http://www.agroman.net/corkscrew")
 393     (synopsis "SSH tunneling through HTTP(S) proxies")
 394     (description
 395      "Corkscrew tunnels SSH connections through most HTTP and HTTPS proxies.
 396 Proxy authentication is only supported through the plain-text HTTP basic
 397 authentication scheme.")
 398     (license license:gpl2+)))
 399
 400 (define-public mosh
 401   (package
 402     (name "mosh")
 403     (version "1.3.2")
 404     (source (origin
 405               (method url-fetch)
 406               (uri (string-append "https://mosh.org/mosh-" version ".tar.gz"))
 407               (sha256
 408                (base32
 409                 "05hjhlp6lk8yjcy59zywpf0r6s0h0b9zxq0lw66dh9x8vxrhaq6s"))))
 410     (build-system gnu-build-system)
 411     (arguments
 412      '(#:phases
 413        (modify-phases %standard-phases
 414          (add-after 'install 'wrap
 415            (lambda* (#:key outputs #:allow-other-keys)
 416              ;; Make sure 'mosh' can find 'mosh-client' and
 417              ;; 'mosh-server'.
 418              (let* ((out (assoc-ref outputs "out"))
 419                     (bin (string-append out "/bin")))
 420                (wrap-program (string-append bin "/mosh")
 421                              `("PATH" ":" prefix (,bin)))))))))
 422     (native-inputs
 423      `(("pkg-config" ,pkg-config)))
 424     (inputs
 425      `(("openssl" ,openssl)
 426        ("perl" ,perl)
 427        ("perl-io-tty" ,perl-io-tty)
 428        ("zlib" ,zlib)
 429        ("ncurses" ,ncurses)
 430        ("protobuf" ,protobuf)
 431        ("boost-headers" ,boost)))
 432     (home-page "https://mosh.org/")
 433     (synopsis "Remote shell tolerant to intermittent connectivity")
 434     (description
 435      "Remote terminal application that allows roaming, supports intermittent
 436 connectivity, and provides intelligent local echo and line editing of user
 437 keystrokes.  Mosh is a replacement for SSH.  It's more robust and responsive,
 438 especially over Wi-Fi, cellular, and long-distance links.")
 439     (license license:gpl3+)))
 440
 441 (define-public et
 442   (package
 443     (name "et")
 444     (version "3.1.0")
 445     (source
 446      (origin
 447        (method git-fetch)
 448        (uri (git-reference
 449              (url "https://github.com/MisterTea/EternalTCP.git")
 450              (commit (string-append "et-v" version))))
 451        (file-name (git-file-name name version))
 452        (sha256
 453         (base32 "1m5caxckn2ihwp9s2pbyh5amxlpwr7yc54q8s0kb10fr52w2vfnm"))))
 454     (build-system cmake-build-system)
 455     (arguments `(#:tests? #f))
 456     (native-inputs
 457      `(("pkg-config" ,pkg-config)))
 458     (inputs `(("glog" ,glog)
 459               ("gflags" ,gflags)
 460               ("libsodium" ,libsodium)
 461               ("protobuf" ,protobuf)))
 462     (synopsis "Remote shell that automatically reconnects")
 463     (description
 464      "Eternal Terminal (ET) is a remote shell that automatically reconnects
 465 without interrupting the session.  Unlike SSH sessions, ET sessions will
 466 survive even network outages and IP changes.  ET uses a custom protocol over
 467 TCP, not the SSH protocol.")
 468     (home-page "https://mistertea.github.io/EternalTCP/")
 469     (license license:asl2.0)))
 470
 471 (define-public dropbear
 472   (package
 473     (name "dropbear")
 474     (version "2019.78")
 475     (source
 476      (origin
 477        (method url-fetch)
 478        (uri (string-append
 479              "https://matt.ucc.asn.au/dropbear/releases/"
 480              "dropbear-" version ".tar.bz2"))
 481        (sha256
 482         (base32 "19242qlr40pbqfqd0gg6h8qpj38q6lgv03ja6sahj9vj2abnanaj"))))
 483     (build-system gnu-build-system)
 484     (arguments `(#:tests? #f))  ; there is no "make check" or anything similar
 485     ;; TODO: Investigate unbundling libtommath and libtomcrypt or at least
 486     ;; cherry-picking important bug fixes from them. See <bugs.gnu.org/24674>
 487     ;; for more information.
 488     (inputs `(("zlib" ,zlib)))
 489     (synopsis "Small SSH server and client")
 490     (description "Dropbear is a relatively small SSH server and
 491 client.  It runs on a variety of POSIX-based platforms.  Dropbear is
 492 particularly useful for embedded systems, such as wireless routers.")
 493     (home-page "https://matt.ucc.asn.au/dropbear/dropbear.html")
 494     (license (license:x11-style "" "See file LICENSE."))))
 495
 496 (define-public liboop
 497   (package
 498     (name "liboop")
 499     (version "1.0.1")
 500     (source
 501      (origin
 502       (method url-fetch)
 503       (uri (string-append "http://ftp.lysator.liu.se/pub/liboop/"
 504                           name "-" version ".tar.gz"))
 505       (sha256
 506        (base32
 507         "1q0p1l72pq9k3bi7a366j2rishv7dzzkg3i6r2npsfg7cnnidbsn"))))
 508     (build-system gnu-build-system)
 509     (home-page "http://www.lysator.liu.se/liboop/")
 510     (synopsis "Event loop library")
 511     (description "Liboop is a low-level event loop management library for
 512 POSIX-based operating systems.  It supports the development of modular,
 513 multiplexed applications which may respond to events from several sources.  It
 514 replaces the \"select() loop\" and allows the registration of event handlers
 515 for file and network I/O, timers and signals.  Since processes use these
 516 mechanisms for almost all external communication, liboop can be used as the
 517 basis for almost any application.")
 518     (license license:lgpl2.1+)))
 519
 520 (define-public lsh
 521   (package
 522     (name "lsh")
 523     (version "2.1")
 524     (source (origin
 525               (method url-fetch)
 526               (uri (string-append "mirror://gnu/lsh/lsh-"
 527                                   version ".tar.gz"))
 528               (sha256
 529                (base32
 530                 "1qqjy9zfzgny0rkb27c8c7dfsylvb6n0ld8h3an2r83pmaqr9gwb"))
 531               (modules '((guix build utils)))
 532               (snippet
 533                '(begin
 534                   (substitute* "src/testsuite/functions.sh"
 535                     (("localhost")
 536                      ;; Avoid host name lookups since they don't work in
 537                      ;; chroot builds.
 538                      "127.0.0.1")
 539                     (("set -e")
 540                      ;; Make tests more verbose.
 541                      "set -e\nset -x"))
 542
 543                   (substitute* (find-files "src/testsuite" "-test$")
 544                     (("localhost") "127.0.0.1"))
 545
 546                   (substitute* "src/testsuite/login-auth-test"
 547                     (("/bin/cat") "cat"))
 548                   #t))))
 549     (build-system gnu-build-system)
 550     (native-inputs
 551      `(("m4" ,m4)
 552        ("guile" ,guile-2.0)
 553        ("gperf" ,gperf)
 554        ("psmisc" ,psmisc)))                       ; for `killall'
 555     (inputs
 556      `(("nettle" ,nettle-2)
 557        ("linux-pam" ,linux-pam)
 558
 559        ;; 'rl.c' uses the 'CPPFunction' type, which is no longer in
 560        ;; Readline 6.3.
 561        ("readline" ,readline-6.2)
 562
 563        ("liboop" ,liboop)
 564        ("zlib" ,zlib)
 565        ("gmp" ,gmp)
 566
 567        ;; The server (lshd) invokes xauth when X11 forwarding is requested.
 568        ;; This adds 24 MiB (or 27%) to the closure of lsh.
 569        ("xauth" ,xauth)))
 570     (arguments
 571      '(;; Skip the `configure' test that checks whether /dev/ptmx &
 572        ;; co. work as expected, because it relies on impurities (for
 573        ;; instance, /dev/pts may be unavailable in chroots.)
 574        #:configure-flags '("lsh_cv_sys_unix98_ptys=yes"
 575
 576                            ;; Use glibc's argp rather than the bundled one.
 577                            "--with-system-argp"
 578
 579                            ;; 'lsh_argp.h' checks HAVE_ARGP_PARSE but nothing
 580                            ;; defines it.
 581                            "CPPFLAGS=-DHAVE_ARGP_PARSE")
 582
 583        ;; FIXME: Tests won't run in a chroot, presumably because
 584        ;; /etc/profile is missing, and thus clients get an empty $PATH
 585        ;; and nothing works.
 586        #:tests? #f
 587
 588        #:phases
 589        (modify-phases %standard-phases
 590          (add-before 'configure 'pre-configure
 591            (lambda* (#:key inputs #:allow-other-keys)
 592              (let* ((nettle    (assoc-ref inputs "nettle"))
 593                     (sexp-conv (string-append nettle "/bin/sexp-conv")))
 594                ;; Remove argp from the list of sub-directories; we don't want
 595                ;; to build it, really.
 596                (substitute* "src/Makefile.in"
 597                  (("^SUBDIRS = argp")
 598                   "SUBDIRS ="))
 599
 600                ;; Make sure 'lsh' and 'lshd' pick 'sexp-conv' in the right place
 601                ;; by default.
 602                (substitute* "src/environ.h.in"
 603                  (("^#define PATH_SEXP_CONV.*")
 604                   (string-append "#define PATH_SEXP_CONV \""
 605                                  sexp-conv "\"\n")))
 606
 607                ;; Same for the 'lsh-authorize' script.
 608                (substitute* "src/lsh-authorize"
 609                  (("=sexp-conv")
 610                   (string-append "=" sexp-conv)))
 611
 612                ;; Tell lshd where 'xauth' lives.  Another option would be to
 613                ;; hardcode "/run/current-system/profile/bin/xauth", thereby
 614                ;; reducing the closure size, but that wouldn't work on foreign
 615                ;; distros.
 616                (with-fluids ((%default-port-encoding "ISO-8859-1"))
 617                  (substitute* "src/server_x11.c"
 618                    (("define XAUTH_PROGRAM.*")
 619                     (string-append "define XAUTH_PROGRAM \""
 620                                    (assoc-ref inputs "xauth")
 621                                    "/bin/xauth\"\n")))))
 622
 623              ;; Tests rely on $USER being set.
 624              (setenv "USER" "guix"))))))
 625     (home-page "https://www.lysator.liu.se/~nisse/lsh/")
 626     (synopsis "GNU implementation of the Secure Shell (ssh) protocols")
 627     (description
 628      "GNU lsh is a free implementation of the SSH version 2 protocol.  It is
 629 used to create a secure line of communication between two computers,
 630 providing shell access to the server system from the client.  It provides
 631 both the server daemon and the client application, as well as tools for
 632 manipulating key files.")
 633     (license license:gpl2+)))
 634
 635 (define-public sshpass
 636   (package
 637     (name "sshpass")
 638     (version "1.06")
 639     (synopsis "Non-interactive password authentication with SSH")
 640     (home-page "https://sourceforge.net/projects/sshpass/")
 641     (source
 642      (origin
 643        (method url-fetch)
 644        (uri (string-append "mirror://sourceforge/sshpass/sshpass/"
 645                            version "/sshpass-" version ".tar.gz"))
 646        (sha256
 647         (base32
 648          "0q7fblaczb7kwbsz0gdy9267z0sllzgmf0c7z5c9mf88wv74ycn6"))))
 649     (build-system gnu-build-system)
 650     (description "sshpass is a tool for non-interactivly performing password
 651 authentication with SSH's so-called @dfn{interactive keyboard password
 652 authentication}.")
 653     (license license:gpl2+)))
 654
 655 (define-public autossh
 656   (package
 657     (name "autossh")
 658     (version "1.4g")
 659     (source
 660      (origin
 661        (method url-fetch)
 662        (uri (string-append
 663              "https://www.harding.motd.ca/autossh/autossh-"
 664              version ".tgz"))
 665        (sha256
 666         (base32 "0xqjw8df68f4kzkns5gcah61s5wk0m44qdk2z1d6388w6viwxhsz"))))
 667     (build-system gnu-build-system)
 668     (arguments `(#:tests? #f)) ; There is no "make check" or anything similar
 669     (inputs `(("openssh" ,openssh)))
 670     (synopsis "Automatically restart SSH sessions and tunnels")
 671     (description "autossh is a program to start a copy of @command{ssh} and
 672 monitor it, restarting it as necessary should it die or stop passing traffic.")
 673     (home-page "https://www.harding.motd.ca/autossh/")
 674     (license
 675      ;; Why point to a source file?  Well, all the individual files have a
 676      ;; copy of this license in their headers, but there's no separate file
 677      ;; with that information.
 678      (license:non-copyleft "file://autossh.c"))))
 679
 680 (define-public pdsh
 681   (package
 682     (name "pdsh")
 683     (version "2.34")
 684     (source
 685      (origin
 686        (method url-fetch)
 687        (uri (string-append "https://github.com/chaos/pdsh/"
 688                            "releases/download/pdsh-" version
 689                            "/pdsh-" version ".tar.gz"))
 690        (sha256
 691         (base32 "1s91hmhrz7rfb6h3l5k97s393rcm1ww3svp8dx5z8vkkc933wyxl"))))
 692     (build-system gnu-build-system)
 693     (arguments
 694      `(#:configure-flags
 695        (list "--with-ssh")
 696        #:phases
 697        (modify-phases %standard-phases
 698          (add-after 'unpack 'patch-/bin/sh
 699            (lambda _
 700              (substitute* '("tests/t0006-pdcp.sh"
 701                             "tests/t0004-module-loading.sh"
 702                             "tests/t2001-ssh.sh"
 703                             "tests/t1003-slurm.sh"
 704                             "tests/t6036-long-output-lines.sh"
 705                             "tests/aggregate-results.sh"
 706                             "tests/t2000-exec.sh"
 707                             "tests/t0002-internal.sh"
 708                             "tests/t1002-dshgroup.sh"
 709                             "tests/t5000-dshbak.sh"
 710                             "tests/t0001-basic.sh"
 711                             "tests/t0005-rcmd_type-and-user.sh"
 712                             "tests/test-lib.sh"
 713                             "tests/t2002-mrsh.sh"
 714                             "tests/t0003-wcoll.sh"
 715                             "tests/test-modules/pcptest.c")
 716                (("/bin/sh") (which "bash")))
 717              #t))
 718          (add-after 'unpack 'patch-tests
 719            (lambda _
 720              (substitute* "tests/t6036-long-output-lines.sh"
 721                (("which") (which "which")))
 722              #t)))))
 723     (inputs
 724      `(("openssh" ,openssh)
 725        ("mit-krb5" ,mit-krb5)
 726        ("perl" ,perl)))
 727     (native-inputs
 728      `(("which" ,which)))
 729     (home-page "https://github.com/chaos/pdsh")
 730     (synopsis "Parallel distributed shell")
 731     (description "Pdsh is a an efficient, multithreaded remote shell client
 732 which executes commands on multiple remote hosts in parallel.  Pdsh implements
 733 dynamically loadable modules for extended functionality such as new remote
 734 shell services and remote host selection.")
 735     (license license:gpl2+)))
 736
 737 (define-public clustershell
 738   (package
 739     (name "clustershell")
 740     (version "1.8.3")
 741     (source
 742      (origin
 743        (method url-fetch)
 744        (uri (string-append "https://github.com/cea-hpc/clustershell/releases"
 745                            "/download/v" version
 746                            "/ClusterShell-" version ".tar.gz"))
 747        (sha256
 748         (base32 "1qdcgh733szwj9r1gambrgfkizvbjci0bnnkds9a8mnyb3sasnan"))))
 749     (build-system python-build-system)
 750     (inputs `(("openssh" ,openssh)))
 751     (propagated-inputs `(("python-pyyaml" ,python-pyyaml)))
 752     (arguments
 753      `(#:phases (modify-phases %standard-phases
 754                   (add-before 'build 'record-openssh-file-name
 755                     (lambda* (#:key inputs #:allow-other-keys)
 756                       (let ((ssh (assoc-ref inputs "openssh")))
 757                         (substitute* "lib/ClusterShell/Worker/Ssh.py"
 758                           (("info\\(\"ssh_path\"\\) or \"ssh\"")
 759                            (string-append "info(\"ssh_path\") or \""
 760                                           ssh "/bin/ssh\"")))
 761                         #t))))))
 762     (home-page "https://cea-hpc.github.io/clustershell/")
 763     (synopsis "Scalable event-driven Python framework for cluster administration")
 764     (description
 765      "ClusterShell is an event-driven Python framework, designed to run local
 766 or distant commands in parallel on server farms or on large GNU/Linux
 767 clusters.  It will take care of common issues encountered on HPC clusters,
 768 such as operating on groups of nodes, running distributed commands using
 769 optimized execution algorithms, as well as gathering results and merging
 770 identical outputs, or retrieving return codes.  ClusterShell takes advantage
 771 of existing remote shell facilities such as SSH.")
 772     (license license:lgpl2.1+)))
 773
 774 (define-public endlessh
 775   (package
 776     (name "endlessh")
 777     (version "1.1")
 778     (source
 779       (origin
 780         (method git-fetch)
 781         (uri (git-reference
 782               (url "https://github.com/skeeto/endlessh.git")
 783               (commit version)))
 784         (file-name (git-file-name name version))
 785         (sha256
 786          (base32 "0ziwr8j1frsp3dajr8h5glkm1dn5cci404kazz5w1jfrp0736x68"))))
 787     (build-system gnu-build-system)
 788     (arguments
 789      '(#:make-flags (list (string-append "PREFIX=" (assoc-ref %outputs "out"))
 790                           "CC=gcc")
 791        #:tests? #f                      ; no test target
 792        #:phases
 793        (modify-phases %standard-phases
 794          (delete 'configure))))         ; no configure script
 795     (home-page "https://github.com/skeeto/endlessh")
 796     (synopsis "SSH tarpit that slowly sends an endless banner")
 797     (description
 798      "Endlessh is an SSH tarpit that very slowly sends an endless, random SSH
 799 banner.  It keeps SSH clients locked up for hours or even days at a time.  The
 800 purpose is to put your real SSH server on another port and then let the script
 801 kiddies get stuck in this tarpit instead of bothering a real server.
 802
 803 Since the tarpit is in the banner before any cryptographic exchange occurs, this
 804 program doesn't depend on any cryptographic libraries.  It's a simple,
 805 single-threaded, standalone C program.  It uses @code{poll()} to trap multiple
 806 clients at a time.")
 807     (license license:unlicense)))