gnu/packages/ssh.scm

   1 ;;; GNU Guix --- Functional package management for GNU
   2 ;;; Copyright © 2012, 2013, 2014, 2015, 2016, 2017, 2018, 2019 Ludovic Courtès <ludo@gnu.org>
   3 ;;; Copyright © 2013, 2014 Andreas Enge <andreas@enge.fr>
   4 ;;; Copyright © 2014, 2015, 2016 Mark H Weaver <mhw@netris.org>
   5 ;;; Copyright © 2015, 2016, 2018, 2019 Efraim Flashner <efraim@flashner.co.il>
   6 ;;; Copyright © 2016, 2019 Leo Famulari <leo@famulari.name>
   7 ;;; Copyright © 2016 Nicolas Goaziou <mail@nicolasgoaziou.fr>
   8 ;;; Copyright © 2016 Christopher Allan Webber <cwebber@dustycloud.org>
   9 ;;; Copyright © 2017, 2018, 2019 Tobias Geerinckx-Rice <me@tobias.gr>
  10 ;;; Copyright © 2017 Stefan Reichör <stefan@xsteve.at>
  11 ;;; Copyright © 2017 Ricardo Wurmus <rekado@elephly.net>
  12 ;;; Copyright © 2017 ng0 <ng0@n0.is>
  13 ;;; Copyright © 2018 Manuel Graf <graf@init.at>
  14 ;;; Copyright © 2019 Gábor Boskovits <boskovits@gmail.com>
  15 ;;;
  16 ;;; This file is part of GNU Guix.
  17 ;;;
  18 ;;; GNU Guix is free software; you can redistribute it and/or modify it
  19 ;;; under the terms of the GNU General Public License as published by
  20 ;;; the Free Software Foundation; either version 3 of the License, or (at
  21 ;;; your option) any later version.
  22 ;;;
  23 ;;; GNU Guix is distributed in the hope that it will be useful, but
  24 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
  25 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  26 ;;; GNU General Public License for more details.
  27 ;;;
  28 ;;; You should have received a copy of the GNU General Public License
  29 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
  30
  31 (define-module (gnu packages ssh)
  32   #:use-module (gnu packages)
  33   #:use-module (gnu packages autotools)
  34   #:use-module (gnu packages base)
  35   #:autoload   (gnu packages boost) (boost)
  36   #:use-module (gnu packages compression)
  37   #:use-module (gnu packages crypto)
  38   #:use-module (gnu packages elf)
  39   #:use-module (gnu packages gnupg)
  40   #:use-module (gnu packages gperf)
  41   #:use-module (gnu packages groff)
  42   #:use-module (gnu packages guile)
  43   #:use-module (gnu packages libedit)
  44   #:use-module (gnu packages linux)
  45   #:use-module (gnu packages logging)
  46   #:use-module (gnu packages m4)
  47   #:use-module (gnu packages multiprecision)
  48   #:use-module (gnu packages ncurses)
  49   #:use-module (gnu packages nettle)
  50   #:use-module (gnu packages kerberos)
  51   #:use-module (gnu packages perl)
  52   #:use-module (gnu packages pkg-config)
  53   #:use-module (gnu packages popt)
  54   #:autoload   (gnu packages protobuf) (protobuf)
  55   #:use-module (gnu packages python)
  56   #:use-module (gnu packages python-xyz)
  57   #:use-module (gnu packages readline)
  58   #:use-module (gnu packages texinfo)
  59   #:use-module (gnu packages tls)
  60   #:use-module (gnu packages xorg)
  61   #:use-module (guix build-system cmake)
  62   #:use-module (guix build-system gnu)
  63   #:use-module (guix build-system python)
  64   #:use-module (guix download)
  65   #:use-module (guix git-download)
  66   #:use-module ((guix licenses) #:prefix license:)
  67   #:use-module (guix packages)
  68   #:use-module (srfi srfi-1))
  69
  70 (define-public libssh
  71   (package
  72     (name "libssh")
  73     (version "0.9.2")
  74     (source (origin
  75               (method git-fetch)
  76               (uri (git-reference
  77                      (url "https://git.libssh.org/projects/libssh.git")
  78                      (commit (string-append "libssh-" version))))
  79               (sha256
  80                (base32
  81                 "14g4rvp91skn2hlsjyhkv58vhng65xrf34cfqffixa4al869hzgj"))
  82               (file-name (git-file-name name version))))
  83     (build-system cmake-build-system)
  84     (outputs '("out" "debug"))
  85     (arguments
  86      '(#:configure-flags '("-DWITH_GCRYPT=ON")
  87
  88        #:phases (modify-phases %standard-phases
  89                   (add-before 'configure 'avoid-werror
  90                     (lambda _
  91                       ;; Avoid '-Werror'.  Presumably this works fine with
  92                       ;; gcc@8 on x86_64 but leads to errors with our older
  93                       ;; compiler.
  94                       (substitute* "CompilerChecks.cmake"
  95                         (("-Werror=") "-W"))
  96                       #t)))
  97
  98        ;; TODO: Add 'CMockery' and '-DWITH_TESTING=ON' for the test suite.
  99        #:tests? #f))
 100     (inputs `(("zlib" ,zlib)
 101               ("libgcrypt" ,libgcrypt)))
 102     (synopsis "SSH client library")
 103     (description
 104      "libssh is a C library implementing the SSHv2 and SSHv1 protocol for client
 105 and server implementations.  With libssh, you can remotely execute programs,
 106 transfer files, and use a secure and transparent tunnel for your remote
 107 applications.")
 108     (home-page "https://www.libssh.org")
 109     (license license:lgpl2.1+)))
 110
 111 (define-public libssh2
 112   (package
 113    (name "libssh2")
 114    (version "1.9.0")
 115    (source (origin
 116             (method url-fetch)
 117             (uri (string-append
 118                    "https://www.libssh2.org/download/libssh2-"
 119                    version ".tar.gz"))
 120             (sha256
 121              (base32
 122               "1zfsz9nldakfz61d2j70pk29zlmj7w2vv46s9l3x2prhcgaqpyym"))))
 123    (build-system gnu-build-system)
 124    ;; The installed libssh2.pc file does not include paths to libgcrypt and
 125    ;; zlib libraries, so we need to propagate the inputs.
 126    (propagated-inputs `(("libgcrypt" ,libgcrypt)
 127                         ("zlib" ,zlib)))
 128    (arguments `(#:configure-flags `("--with-libgcrypt")))
 129    (synopsis "Client-side C library implementing the SSH2 protocol")
 130    (description
 131     "libssh2 is a library intended to allow software developers access to
 132 the SSH-2 protocol in an easy-to-use self-contained package.  It can be built
 133 into an application to perform many different tasks when communicating with
 134 a server that supports the SSH-2 protocol.")
 135    (license license:bsd-3)
 136    (home-page "https://www.libssh2.org/")))
 137
 138 (define-public openssh
 139   (package
 140    (name "openssh")
 141    (version "8.0p1")
 142    (source (origin
 143              (method url-fetch)
 144              (uri (string-append "mirror://openbsd/OpenSSH/portable/"
 145                                  name "-" version ".tar.gz"))
 146              (sha256
 147               (base32
 148                "0s7xh4s0qcipnjh9ls5blxcpvhyd116z9dxn3q1yi64lwrwki55x"))))
 149    (build-system gnu-build-system)
 150    (native-inputs `(("groff" ,groff)
 151                     ("pkg-config" ,pkg-config)))
 152    (inputs `(("libedit" ,libedit)
 153              ("openssl" ,openssl)
 154              ("pam" ,linux-pam)
 155              ("mit-krb5" ,mit-krb5)
 156              ("zlib" ,zlib)
 157              ("xauth" ,xauth)))                   ;for 'ssh -X' and 'ssh -Y'
 158    (arguments
 159     `(#:test-target "tests"
 160       ;; Otherwise, the test scripts try to use a nonexistent directory and
 161       ;; fail.
 162       #:make-flags '("REGRESSTMP=\"$${BUILDDIR}/regress\"")
 163       #:configure-flags  `("--sysconfdir=/etc/ssh"
 164
 165                            ;; Default value of 'PATH' used by sshd.
 166                           "--with-default-path=/run/current-system/profile/bin"
 167
 168                           ;; configure needs to find krb5-config
 169                           ,(string-append "--with-kerberos5="
 170                                           (assoc-ref %build-inputs "mit-krb5")
 171                                           "/bin")
 172
 173                           ;; libedit needed for sftp completion
 174                           "--with-libedit"
 175
 176                           ;; Enable PAM support in sshd.
 177                           "--with-pam")
 178
 179       #:phases
 180       (modify-phases %standard-phases
 181         (add-after 'configure 'reset-/var/empty
 182          (lambda* (#:key outputs #:allow-other-keys)
 183            (let ((out (assoc-ref outputs "out")))
 184              (substitute* "Makefile"
 185                (("PRIVSEP_PATH=/var/empty")
 186                 (string-append "PRIVSEP_PATH=" out "/var/empty")))
 187              #t)))
 188         (add-before 'check 'patch-tests
 189          (lambda _
 190            ;; remove 't-exec' regress target which requires user 'sshd'
 191            (substitute* "regress/Makefile"
 192              (("^(REGRESS_TARGETS=.*) t-exec(.*)" all pre post)
 193               (string-append pre post)))
 194            #t))
 195         (replace 'install
 196          (lambda* (#:key outputs (make-flags '()) #:allow-other-keys)
 197            ;; install without host keys and system configuration files
 198            (apply invoke "make" "install-nosysconf" make-flags)
 199            (install-file "contrib/ssh-copy-id"
 200                          (string-append (assoc-ref outputs "out")
 201                                         "/bin/"))
 202            (chmod (string-append (assoc-ref outputs "out")
 203                                  "/bin/ssh-copy-id") #o555)
 204            (install-file "contrib/ssh-copy-id.1"
 205                          (string-append (assoc-ref outputs "out")
 206                                         "/share/man/man1/"))
 207            #t)))))
 208    (synopsis "Client and server for the secure shell (ssh) protocol")
 209    (description
 210     "The SSH2 protocol implemented in OpenSSH is standardised by the
 211 IETF secsh working group and is specified in several RFCs and drafts.
 212 It is composed of three layered components:
 213
 214 The transport layer provides algorithm negotiation and a key exchange.
 215 The key exchange includes server authentication and results in a
 216 cryptographically secured connection: it provides integrity, confidentiality
 217 and optional compression.
 218
 219 The user authentication layer uses the established connection and relies on
 220 the services provided by the transport layer.  It provides several mechanisms
 221 for user authentication.  These include traditional password authentication
 222 as well as public-key or host-based authentication mechanisms.
 223
 224 The connection layer multiplexes many different concurrent channels over the
 225 authenticated connection and allows tunneling of login sessions and
 226 TCP-forwarding.  It provides a flow control service for these channels.
 227 Additionally, various channel-specific options can be negotiated.")
 228    (license (license:non-copyleft "file://LICENSE"
 229                                "See LICENSE in the distribution."))
 230    (home-page "https://www.openssh.com/")))
 231
 232 (define-public guile-ssh
 233   (package
 234     (name "guile-ssh")
 235     (version "0.11.3")
 236     (home-page "https://github.com/artyom-poptsov/guile-ssh")
 237     (source (origin
 238               (method git-fetch)
 239               (uri (git-reference
 240                     (url home-page)
 241                     (commit (string-append "v" version))))
 242               (file-name (string-append name "-" version ".tar.gz"))
 243               (sha256
 244                (base32
 245                 "03bv3hwp2s8f0bqgfjaan9jx4dyab0abv27n2zn2g0izlidv0vl6"))
 246               (modules '((guix build utils)))
 247               (snippet
 248                '(begin
 249                   ;; libssh >= 0.8.0 no longer provides libssh_threads: see
 250                   ;; <https://github.com/artyom-poptsov/guile-ssh/issues/9>.
 251                   (substitute* "libguile-ssh/Makefile.am"
 252                     (("-lssh_threads") ""))
 253
 254                   ;; This test would wrongfully pick DSS keys when running on
 255                   ;; libssh >= 0.8.0, which fails:
 256                   ;; <https://github.com/artyom-poptsov/guile-ssh/issues/10>.
 257                   (substitute* "tests/server.scm"
 258                     (("= %libssh-minor-version 7")
 259                      ">= %libssh-minor-version 7"))
 260                   #t))))
 261     (build-system gnu-build-system)
 262     (outputs '("out" "debug"))
 263     (arguments
 264      '(;; It makes no sense to build libguile-ssh.a.
 265        #:configure-flags '("--disable-static")
 266
 267        #:phases (modify-phases %standard-phases
 268                   (add-after 'unpack 'autoreconf
 269                     (lambda* (#:key inputs #:allow-other-keys)
 270                       (invoke "autoreconf" "-vfi")))
 271                   (add-before 'build 'fix-libguile-ssh-file-name
 272                     (lambda* (#:key outputs #:allow-other-keys)
 273                       ;; Build and install libguile-ssh.so so that we can use
 274                       ;; its absolute file name in .scm files, before we build
 275                       ;; the .go files.
 276                       (let* ((out (assoc-ref outputs "out"))
 277                              (lib (string-append out "/lib")))
 278                         (invoke "make" "install"
 279                                 "-C" "libguile-ssh"
 280                                 "-j" (number->string
 281                                       (parallel-job-count)))
 282                         (substitute* (find-files "." "\\.scm$")
 283                           (("\"libguile-ssh\"")
 284                            (string-append "\"" lib "/libguile-ssh\"")))
 285                         #t)))
 286                   (add-after 'install 'remove-bin-directory
 287                     (lambda* (#:key outputs #:allow-other-keys)
 288                       (let* ((out (assoc-ref outputs "out"))
 289                              (bin (string-append out "/bin"))
 290                              (examples (string-append
 291                                         out "/share/guile-ssh/examples")))
 292                         (mkdir-p examples)
 293                         (rename-file (string-append bin "/ssshd.scm")
 294                                      (string-append examples "/ssshd.scm"))
 295                         (rename-file (string-append bin "/sssh.scm")
 296                                      (string-append examples "/sssh.scm"))
 297                         (delete-file-recursively bin)
 298                         #t))))
 299        ;; Tests are not parallel-safe.
 300        #:parallel-tests? #f))
 301     (native-inputs `(("autoconf" ,autoconf)
 302                      ("automake" ,automake)
 303                      ("libtool" ,libtool)
 304                      ("texinfo" ,texinfo)
 305                      ("pkg-config" ,pkg-config)
 306                      ("which" ,which)))
 307     (inputs `(("guile" ,guile-2.2)
 308               ("libssh" ,libssh)
 309               ("libgcrypt" ,libgcrypt)))
 310     (synopsis "Guile bindings to libssh")
 311     (description
 312      "Guile-SSH is a library that provides access to the SSH protocol for
 313 programs written in GNU Guile interpreter.  It is a wrapper to the underlying
 314 libssh library.")
 315     (license license:gpl3+)))
 316
 317 (define-public guile2.0-ssh
 318   (package
 319     (inherit guile-ssh)
 320     (name "guile2.0-ssh")
 321     (inputs `(("guile" ,guile-2.0)
 322               ,@(alist-delete "guile" (package-inputs guile-ssh))))))
 323
 324 (define-public corkscrew
 325   (package
 326     (name "corkscrew")
 327     (version "2.0")
 328     (source
 329      (origin
 330        (method url-fetch)
 331        ;; The agroman.net domain name expired on 2017-03-23, and the original
 332        ;; "http://www.agroman.net/corkscrew/corkscrew-2.0.tar.gz" now returns
 333        ;; bogus HTML.  Perhaps it will yet return.  Until then, use a mirror.
 334        (uri (string-append "https://downloads.openwrt.org/sources/"
 335                            "corkscrew-" version ".tar.gz"))
 336        (sha256 (base32
 337                 "1gmhas4va6gd70i2x2mpxpwpgww6413mji29mg282jms3jscn3qd"))))
 338     (build-system gnu-build-system)
 339     (arguments
 340      `(#:phases
 341        (modify-phases %standard-phases
 342          (replace 'configure
 343            ;; Replace configure phase as the ./configure script does not like
 344            ;; CONFIG_SHELL and SHELL passed as parameters
 345            (lambda* (#:key outputs build target #:allow-other-keys)
 346              (let* ((out   (assoc-ref outputs "out"))
 347                     (bash  (which "bash"))
 348                     ;; Set --build and --host flags as the provided config.guess
 349                     ;; is not able to detect them
 350                     (flags `(,(string-append "--prefix=" out)
 351                              ,(string-append "--build=" build)
 352                              ,(string-append "--host=" (or target build)))))
 353                (setenv "CONFIG_SHELL" bash)
 354                (apply invoke bash "./configure" flags))))
 355          (add-after 'install 'install-documentation
 356            (lambda* (#:key outputs #:allow-other-keys)
 357              (let* ((out (assoc-ref outputs "out"))
 358                     (doc (string-append out "/share/doc/" ,name "-" ,version)))
 359                (install-file "README" doc)
 360                #t))))))
 361     (home-page "http://www.agroman.net/corkscrew")
 362     (synopsis "SSH tunneling through HTTP(S) proxies")
 363     (description
 364      "Corkscrew tunnels SSH connections through most HTTP and HTTPS proxies.
 365 Proxy authentication is only supported through the plain-text HTTP basic
 366 authentication scheme.")
 367     (license license:gpl2+)))
 368
 369 (define-public mosh
 370   (package
 371     (name "mosh")
 372     (version "1.3.2")
 373     (source (origin
 374               (method url-fetch)
 375               (uri (string-append "https://mosh.org/mosh-" version ".tar.gz"))
 376               (sha256
 377                (base32
 378                 "05hjhlp6lk8yjcy59zywpf0r6s0h0b9zxq0lw66dh9x8vxrhaq6s"))))
 379     (build-system gnu-build-system)
 380     (arguments
 381      '(#:phases
 382        (modify-phases %standard-phases
 383          (add-after 'install 'wrap
 384            (lambda* (#:key outputs #:allow-other-keys)
 385              ;; Make sure 'mosh' can find 'mosh-client' and
 386              ;; 'mosh-server'.
 387              (let* ((out (assoc-ref outputs "out"))
 388                     (bin (string-append out "/bin")))
 389                (wrap-program (string-append bin "/mosh")
 390                              `("PATH" ":" prefix (,bin)))))))))
 391     (native-inputs
 392      `(("pkg-config" ,pkg-config)))
 393     (inputs
 394      `(("openssl" ,openssl)
 395        ("perl" ,perl)
 396        ("perl-io-tty" ,perl-io-tty)
 397        ("zlib" ,zlib)
 398        ("ncurses" ,ncurses)
 399        ("protobuf" ,protobuf)
 400        ("boost-headers" ,boost)))
 401     (home-page "https://mosh.org/")
 402     (synopsis "Remote shell tolerant to intermittent connectivity")
 403     (description
 404      "Remote terminal application that allows roaming, supports intermittent
 405 connectivity, and provides intelligent local echo and line editing of user
 406 keystrokes.  Mosh is a replacement for SSH.  It's more robust and responsive,
 407 especially over Wi-Fi, cellular, and long-distance links.")
 408     (license license:gpl3+)))
 409
 410 (define-public et
 411   (package
 412     (name "et")
 413     (version "3.1.0")
 414     (source
 415      (origin
 416        (method git-fetch)
 417        (uri (git-reference
 418              (url "https://github.com/MisterTea/EternalTCP.git")
 419              (commit (string-append "et-v" version))))
 420        (file-name (git-file-name name version))
 421        (sha256
 422         (base32 "1m5caxckn2ihwp9s2pbyh5amxlpwr7yc54q8s0kb10fr52w2vfnm"))))
 423     (build-system cmake-build-system)
 424     (arguments `(#:tests? #f))
 425     (native-inputs
 426      `(("pkg-config" ,pkg-config)))
 427     (inputs `(("glog" ,glog)
 428               ("gflags" ,gflags)
 429               ("libsodium" ,libsodium)
 430               ("protobuf" ,protobuf)))
 431     (synopsis "Remote shell that automatically reconnects")
 432     (description
 433      "Eternal Terminal (ET) is a remote shell that automatically reconnects
 434 without interrupting the session.  Unlike SSH sessions, ET sessions will
 435 survive even network outages and IP changes.  ET uses a custom protocol over
 436 TCP, not the SSH protocol.")
 437     (home-page "https://mistertea.github.io/EternalTCP/")
 438     (license license:asl2.0)))
 439
 440 (define-public dropbear
 441   (package
 442     (name "dropbear")
 443     (version "2019.78")
 444     (source
 445      (origin
 446        (method url-fetch)
 447        (uri (string-append
 448              "https://matt.ucc.asn.au/dropbear/releases/"
 449              "dropbear-" version ".tar.bz2"))
 450        (sha256
 451         (base32 "19242qlr40pbqfqd0gg6h8qpj38q6lgv03ja6sahj9vj2abnanaj"))))
 452     (build-system gnu-build-system)
 453     (arguments `(#:tests? #f))  ; there is no "make check" or anything similar
 454     ;; TODO: Investigate unbundling libtommath and libtomcrypt or at least
 455     ;; cherry-picking important bug fixes from them. See <bugs.gnu.org/24674>
 456     ;; for more information.
 457     (inputs `(("zlib" ,zlib)))
 458     (synopsis "Small SSH server and client")
 459     (description "Dropbear is a relatively small SSH server and
 460 client.  It runs on a variety of POSIX-based platforms.  Dropbear is
 461 particularly useful for embedded systems, such as wireless routers.")
 462     (home-page "https://matt.ucc.asn.au/dropbear/dropbear.html")
 463     (license (license:x11-style "" "See file LICENSE."))))
 464
 465 (define-public liboop
 466   (package
 467     (name "liboop")
 468     (version "1.0.1")
 469     (source
 470      (origin
 471       (method url-fetch)
 472       (uri (string-append "http://ftp.lysator.liu.se/pub/liboop/"
 473                           name "-" version ".tar.gz"))
 474       (sha256
 475        (base32
 476         "1q0p1l72pq9k3bi7a366j2rishv7dzzkg3i6r2npsfg7cnnidbsn"))))
 477     (build-system gnu-build-system)
 478     (home-page "http://www.lysator.liu.se/liboop/")
 479     (synopsis "Event loop library")
 480     (description "Liboop is a low-level event loop management library for
 481 POSIX-based operating systems.  It supports the development of modular,
 482 multiplexed applications which may respond to events from several sources.  It
 483 replaces the \"select() loop\" and allows the registration of event handlers
 484 for file and network I/O, timers and signals.  Since processes use these
 485 mechanisms for almost all external communication, liboop can be used as the
 486 basis for almost any application.")
 487     (license license:lgpl2.1+)))
 488
 489 (define-public lsh
 490   (package
 491     (name "lsh")
 492     (version "2.1")
 493     (source (origin
 494               (method url-fetch)
 495               (uri (string-append "mirror://gnu/lsh/lsh-"
 496                                   version ".tar.gz"))
 497               (sha256
 498                (base32
 499                 "1qqjy9zfzgny0rkb27c8c7dfsylvb6n0ld8h3an2r83pmaqr9gwb"))
 500               (modules '((guix build utils)))
 501               (snippet
 502                '(begin
 503                   (substitute* "src/testsuite/functions.sh"
 504                     (("localhost")
 505                      ;; Avoid host name lookups since they don't work in
 506                      ;; chroot builds.
 507                      "127.0.0.1")
 508                     (("set -e")
 509                      ;; Make tests more verbose.
 510                      "set -e\nset -x"))
 511
 512                   (substitute* (find-files "src/testsuite" "-test$")
 513                     (("localhost") "127.0.0.1"))
 514
 515                   (substitute* "src/testsuite/login-auth-test"
 516                     (("/bin/cat") "cat"))
 517                   #t))))
 518     (build-system gnu-build-system)
 519     (native-inputs
 520      `(("m4" ,m4)
 521        ("guile" ,guile-2.0)
 522        ("gperf" ,gperf)
 523        ("psmisc" ,psmisc)))                       ; for `killall'
 524     (inputs
 525      `(("nettle" ,nettle-2)
 526        ("linux-pam" ,linux-pam)
 527
 528        ;; 'rl.c' uses the 'CPPFunction' type, which is no longer in
 529        ;; Readline 6.3.
 530        ("readline" ,readline-6.2)
 531
 532        ("liboop" ,liboop)
 533        ("zlib" ,zlib)
 534        ("gmp" ,gmp)
 535
 536        ;; The server (lshd) invokes xauth when X11 forwarding is requested.
 537        ;; This adds 24 MiB (or 27%) to the closure of lsh.
 538        ("xauth" ,xauth)))
 539     (arguments
 540      '(;; Skip the `configure' test that checks whether /dev/ptmx &
 541        ;; co. work as expected, because it relies on impurities (for
 542        ;; instance, /dev/pts may be unavailable in chroots.)
 543        #:configure-flags '("lsh_cv_sys_unix98_ptys=yes"
 544
 545                            ;; Use glibc's argp rather than the bundled one.
 546                            "--with-system-argp"
 547
 548                            ;; 'lsh_argp.h' checks HAVE_ARGP_PARSE but nothing
 549                            ;; defines it.
 550                            "CPPFLAGS=-DHAVE_ARGP_PARSE")
 551
 552        ;; FIXME: Tests won't run in a chroot, presumably because
 553        ;; /etc/profile is missing, and thus clients get an empty $PATH
 554        ;; and nothing works.
 555        #:tests? #f
 556
 557        #:phases
 558        (modify-phases %standard-phases
 559          (add-before 'configure 'pre-configure
 560            (lambda* (#:key inputs #:allow-other-keys)
 561              (let* ((nettle    (assoc-ref inputs "nettle"))
 562                     (sexp-conv (string-append nettle "/bin/sexp-conv")))
 563                ;; Remove argp from the list of sub-directories; we don't want
 564                ;; to build it, really.
 565                (substitute* "src/Makefile.in"
 566                  (("^SUBDIRS = argp")
 567                   "SUBDIRS ="))
 568
 569                ;; Make sure 'lsh' and 'lshd' pick 'sexp-conv' in the right place
 570                ;; by default.
 571                (substitute* "src/environ.h.in"
 572                  (("^#define PATH_SEXP_CONV.*")
 573                   (string-append "#define PATH_SEXP_CONV \""
 574                                  sexp-conv "\"\n")))
 575
 576                ;; Same for the 'lsh-authorize' script.
 577                (substitute* "src/lsh-authorize"
 578                  (("=sexp-conv")
 579                   (string-append "=" sexp-conv)))
 580
 581                ;; Tell lshd where 'xauth' lives.  Another option would be to
 582                ;; hardcode "/run/current-system/profile/bin/xauth", thereby
 583                ;; reducing the closure size, but that wouldn't work on foreign
 584                ;; distros.
 585                (with-fluids ((%default-port-encoding "ISO-8859-1"))
 586                  (substitute* "src/server_x11.c"
 587                    (("define XAUTH_PROGRAM.*")
 588                     (string-append "define XAUTH_PROGRAM \""
 589                                    (assoc-ref inputs "xauth")
 590                                    "/bin/xauth\"\n")))))
 591
 592              ;; Tests rely on $USER being set.
 593              (setenv "USER" "guix"))))))
 594     (home-page "http://www.lysator.liu.se/~nisse/lsh/")
 595     (synopsis "GNU implementation of the Secure Shell (ssh) protocols")
 596     (description
 597      "GNU lsh is a free implementation of the SSH version 2 protocol.  It is
 598 used to create a secure line of communication between two computers,
 599 providing shell access to the server system from the client.  It provides
 600 both the server daemon and the client application, as well as tools for
 601 manipulating key files.")
 602     (license license:gpl2+)))
 603
 604 (define-public sshpass
 605   (package
 606     (name "sshpass")
 607     (version "1.06")
 608     (synopsis "Non-interactive password authentication with SSH")
 609     (home-page "https://sourceforge.net/projects/sshpass/")
 610     (source
 611      (origin
 612        (method url-fetch)
 613        (uri (string-append "mirror://sourceforge/sshpass/sshpass/"
 614                            version "/sshpass-" version ".tar.gz"))
 615        (sha256
 616         (base32
 617          "0q7fblaczb7kwbsz0gdy9267z0sllzgmf0c7z5c9mf88wv74ycn6"))))
 618     (build-system gnu-build-system)
 619     (description "sshpass is a tool for non-interactivly performing password
 620 authentication with SSH's so-called @dfn{interactive keyboard password
 621 authentication}.")
 622     (license license:gpl2+)))
 623
 624 (define-public autossh
 625   (package
 626     (name "autossh")
 627     (version "1.4g")
 628     (source
 629      (origin
 630        (method url-fetch)
 631        (uri (string-append
 632              "https://www.harding.motd.ca/autossh/autossh-"
 633              version ".tgz"))
 634        (sha256
 635         (base32 "0xqjw8df68f4kzkns5gcah61s5wk0m44qdk2z1d6388w6viwxhsz"))))
 636     (build-system gnu-build-system)
 637     (arguments `(#:tests? #f)) ; There is no "make check" or anything similar
 638     (inputs `(("openssh" ,openssh)))
 639     (synopsis "Automatically restart SSH sessions and tunnels")
 640     (description "autossh is a program to start a copy of @command{ssh} and
 641 monitor it, restarting it as necessary should it die or stop passing traffic.")
 642     (home-page "https://www.harding.motd.ca/autossh/")
 643     (license
 644      ;; Why point to a source file?  Well, all the individual files have a
 645      ;; copy of this license in their headers, but there's no separate file
 646      ;; with that information.
 647      (license:non-copyleft "file://autossh.c"))))
 648
 649 (define-public pdsh
 650   (package
 651     (name "pdsh")
 652     (version "2.33")
 653     (source
 654      (origin
 655        (method url-fetch)
 656        (uri (string-append "https://github.com/chaos/pdsh/"
 657                            "releases/download/pdsh-" version
 658                            "/pdsh-" version ".tar.gz"))
 659        (file-name (string-append name "-" version ".tar.gz"))
 660        (sha256
 661         (base32 "0bwlkl9inj66iwvafg00pi3sk9n673phdi0kcc59y9nn55s0hs3k"))))
 662     (build-system gnu-build-system)
 663     (arguments
 664      `(#:configure-flags
 665        (list "--with-ssh")
 666        #:phases
 667        (modify-phases %standard-phases
 668          (add-after 'unpack 'patch-/bin/sh
 669            (lambda _
 670              (substitute* '("tests/t0006-pdcp.sh"
 671                             "tests/t0004-module-loading.sh"
 672                             "tests/t2001-ssh.sh"
 673                             "tests/t1003-slurm.sh"
 674                             "tests/t6036-long-output-lines.sh"
 675                             "tests/aggregate-results.sh"
 676                             "tests/t2000-exec.sh"
 677                             "tests/t0002-internal.sh"
 678                             "tests/t1002-dshgroup.sh"
 679                             "tests/t5000-dshbak.sh"
 680                             "tests/t0001-basic.sh"
 681                             "tests/t0005-rcmd_type-and-user.sh"
 682                             "tests/test-lib.sh"
 683                             "tests/t2002-mrsh.sh"
 684                             "tests/t0003-wcoll.sh"
 685                             "tests/test-modules/pcptest.c")
 686                (("/bin/sh") (which "bash")))
 687              #t))
 688          (add-after 'unpack 'patch-tests
 689            (lambda _
 690              (substitute* "tests/t6036-long-output-lines.sh"
 691                (("which") (which "which")))
 692              #t)))))
 693     (inputs
 694      `(("openssh" ,openssh)
 695        ("mit-krb5" ,mit-krb5)
 696        ("perl" ,perl)))
 697     (native-inputs
 698      `(("which" ,which)))
 699     (home-page "https://github.com/chaos/pdsh")
 700     (synopsis "Parallel distributed shell")
 701     (description "Pdsh is a an efficient, multithreaded remote shell client
 702 which executes commands on multiple remote hosts in parallel.  Pdsh implements
 703 dynamically loadable modules for extended functionality such as new remote
 704 shell services and remote host selection.")
 705     (license license:gpl2+)))
 706
 707 (define-public clustershell
 708   (package
 709     (name "clustershell")
 710     (version "1.8.2")
 711     (source
 712      (origin
 713        (method url-fetch)
 714        (uri (string-append "https://github.com/cea-hpc/clustershell/releases"
 715                            "/download/v" version
 716                            "/ClusterShell-" version ".tar.gz"))
 717        (sha256
 718         (base32 "1gz2g85wpk35n1fp31q753w01y3p8abm7dnbas28q4yjyvikqw75"))))
 719     (build-system python-build-system)
 720     (inputs `(("openssh" ,openssh)))
 721     (propagated-inputs `(("python-pyyaml" ,python-pyyaml)))
 722     (arguments
 723      `(#:phases (modify-phases %standard-phases
 724                   (add-before 'build 'record-openssh-file-name
 725                     (lambda* (#:key inputs #:allow-other-keys)
 726                       (let ((ssh (assoc-ref inputs "openssh")))
 727                         (substitute* "lib/ClusterShell/Worker/Ssh.py"
 728                           (("info\\(\"ssh_path\"\\) or \"ssh\"")
 729                            (string-append "info(\"ssh_path\") or \""
 730                                           ssh "/bin/ssh\"")))
 731                         #t))))))
 732     (home-page "https://cea-hpc.github.io/clustershell/")
 733     (synopsis "Scalable event-driven Python framework for cluster administration")
 734     (description
 735      "ClusterShell is an event-driven Python framework, designed to run local
 736 or distant commands in parallel on server farms or on large GNU/Linux
 737 clusters.  It will take care of common issues encountered on HPC clusters,
 738 such as operating on groups of nodes, running distributed commands using
 739 optimized execution algorithms, as well as gathering results and merging
 740 identical outputs, or retrieving return codes.  ClusterShell takes advantage
 741 of existing remote shell facilities such as SSH.")
 742     (license license:lgpl2.1+)))
 743
 744 (define-public endlessh
 745   (package
 746     (name "endlessh")
 747     (version "1.0")
 748     (source
 749       (origin
 750         (method url-fetch)
 751         (uri (string-append "https://github.com/skeeto/endlessh/releases/"
 752                             "download/" version "/endlessh-" version ".tar.xz"))
 753         (sha256
 754          (base32
 755           "0hhsr65hzrcb7ylskmxyr92svzndhks8hqzn8hvg7f7j89rkvq5k"))))
 756     (build-system gnu-build-system)
 757     (arguments
 758      '(#:make-flags (list (string-append "PREFIX=" (assoc-ref %outputs "out"))
 759                           "CC=gcc")
 760        #:tests? #f ; no test target
 761        #:phases
 762        (modify-phases %standard-phases
 763          (delete 'configure)))) ; no configure script
 764     (home-page "https://github.com/skeeto/endlessh")
 765     (synopsis "SSH tarpit that slowly sends an endless banner")
 766     (description
 767      "Endlessh is an SSH tarpit that very slowly sends an endless, random SSH
 768 banner.  It keeps SSH clients locked up for hours or even days at a time.  The
 769 purpose is to put your real SSH server on another port and then let the script
 770 kiddies get stuck in this tarpit instead of bothering a real server.
 771
 772 Since the tarpit is in the banner before any cryptographic exchange occurs, this
 773 program doesn't depend on any cryptographic libraries.  It's a simple,
 774 single-threaded, standalone C program.  It uses @code{poll()} to trap multiple
 775 clients at a time.")
 776     (license license:unlicense)))