gnu/packages/ssh.scm

   1 ;;; GNU Guix --- Functional package management for GNU
   2 ;;; Copyright © 2012, 2013, 2014, 2015, 2016, 2017, 2018, 2019, 2020 Ludovic Courtès <ludo@gnu.org>
   3 ;;; Copyright © 2013, 2014 Andreas Enge <andreas@enge.fr>
   4 ;;; Copyright © 2014, 2015, 2016 Mark H Weaver <mhw@netris.org>
   5 ;;; Copyright © 2015, 2016, 2018, 2019 Efraim Flashner <efraim@flashner.co.il>
   6 ;;; Copyright © 2016, 2019 Leo Famulari <leo@famulari.name>
   7 ;;; Copyright © 2016 Nicolas Goaziou <mail@nicolasgoaziou.fr>
   8 ;;; Copyright © 2016 Christopher Allan Webber <cwebber@dustycloud.org>
   9 ;;; Copyright © 2017, 2018, 2019, 2020 Tobias Geerinckx-Rice <me@tobias.gr>
  10 ;;; Copyright © 2017 Stefan Reichör <stefan@xsteve.at>
  11 ;;; Copyright © 2017 Ricardo Wurmus <rekado@elephly.net>
  12 ;;; Copyright © 2017 ng0 <ng0@n0.is>
  13 ;;; Copyright © 2018 Manuel Graf <graf@init.at>
  14 ;;; Copyright © 2019 Gábor Boskovits <boskovits@gmail.com>
  15 ;;; Copyright © 2019, 2020 Mathieu Othacehe <m.othacehe@gmail.com>
  16 ;;; Copyright © 2020 Jan (janneke) Nieuwenhuizen <janneke@gnu.org>
  17 ;;;
  18 ;;; This file is part of GNU Guix.
  19 ;;;
  20 ;;; GNU Guix is free software; you can redistribute it and/or modify it
  21 ;;; under the terms of the GNU General Public License as published by
  22 ;;; the Free Software Foundation; either version 3 of the License, or (at
  23 ;;; your option) any later version.
  24 ;;;
  25 ;;; GNU Guix is distributed in the hope that it will be useful, but
  26 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
  27 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  28 ;;; GNU General Public License for more details.
  29 ;;;
  30 ;;; You should have received a copy of the GNU General Public License
  31 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
  32
  33 (define-module (gnu packages ssh)
  34   #:use-module (gnu packages)
  35   #:use-module (gnu packages autotools)
  36   #:use-module (gnu packages base)
  37   #:use-module (gnu packages boost)
  38   #:use-module (gnu packages compression)
  39   #:use-module (gnu packages crypto)
  40   #:use-module (gnu packages elf)
  41   #:use-module (gnu packages gnupg)
  42   #:use-module (gnu packages gperf)
  43   #:use-module (gnu packages groff)
  44   #:use-module (gnu packages guile)
  45   #:use-module (gnu packages libedit)
  46   #:use-module (gnu packages hurd)
  47   #:use-module (gnu packages linux)
  48   #:use-module (gnu packages logging)
  49   #:use-module (gnu packages m4)
  50   #:use-module (gnu packages multiprecision)
  51   #:use-module (gnu packages ncurses)
  52   #:use-module (gnu packages nettle)
  53   #:use-module (gnu packages kerberos)
  54   #:use-module (gnu packages perl)
  55   #:use-module (gnu packages pkg-config)
  56   #:use-module (gnu packages popt)
  57   #:use-module (gnu packages protobuf)
  58   #:use-module (gnu packages python)
  59   #:use-module (gnu packages python-xyz)
  60   #:use-module (gnu packages readline)
  61   #:use-module (gnu packages texinfo)
  62   #:use-module (gnu packages tls)
  63   #:use-module (gnu packages xorg)
  64   #:use-module (guix build-system cmake)
  65   #:use-module (guix build-system gnu)
  66   #:use-module (guix build-system python)
  67   #:use-module (guix download)
  68   #:use-module (guix git-download)
  69   #:use-module ((guix licenses) #:prefix license:)
  70   #:use-module (guix packages)
  71   #:use-module (guix utils)
  72   #:use-module (srfi srfi-1))
  73
  74 (define-public libssh
  75   (package
  76     (name "libssh")
  77     (version "0.9.4")
  78     (source (origin
  79               (method git-fetch)
  80               (uri (git-reference
  81                      (url "https://git.libssh.org/projects/libssh.git")
  82                      (commit (string-append "libssh-" version))))
  83               (sha256
  84                (base32
  85                 "0qr4vi3k1wv69c95d9j26fiv78pzyksaq8ccd76b8nxar5z1fbj6"))
  86               (file-name (git-file-name name version))))
  87     (build-system cmake-build-system)
  88     (outputs '("out" "debug"))
  89     (arguments
  90      '(#:configure-flags '("-DWITH_GCRYPT=ON")
  91
  92        ;; TODO: Add 'CMockery' and '-DWITH_TESTING=ON' for the test suite.
  93        #:tests? #f))
  94     (inputs `(("zlib" ,zlib)
  95               ("libgcrypt" ,libgcrypt)
  96               ("mit-krb5" ,mit-krb5)))
  97     (synopsis "SSH client library")
  98     (description
  99      "libssh is a C library implementing the SSHv2 and SSHv1 protocol for client
 100 and server implementations.  With libssh, you can remotely execute programs,
 101 transfer files, and use a secure and transparent tunnel for your remote
 102 applications.")
 103     (home-page "https://www.libssh.org")
 104     (license license:lgpl2.1+)))
 105
 106 (define-public libssh2
 107   (package
 108    (name "libssh2")
 109    (version "1.9.0")
 110    (source (origin
 111             (method url-fetch)
 112             (uri (string-append
 113                    "https://www.libssh2.org/download/libssh2-"
 114                    version ".tar.gz"))
 115             (sha256
 116              (base32
 117               "1zfsz9nldakfz61d2j70pk29zlmj7w2vv46s9l3x2prhcgaqpyym"))))
 118    (build-system gnu-build-system)
 119    ;; The installed libssh2.pc file does not include paths to libgcrypt and
 120    ;; zlib libraries, so we need to propagate the inputs.
 121    (propagated-inputs `(("libgcrypt" ,libgcrypt)
 122                         ("zlib" ,zlib)))
 123    (arguments `(#:configure-flags `("--with-libgcrypt")))
 124    (synopsis "Client-side C library implementing the SSH2 protocol")
 125    (description
 126     "libssh2 is a library intended to allow software developers access to
 127 the SSH-2 protocol in an easy-to-use self-contained package.  It can be built
 128 into an application to perform many different tasks when communicating with
 129 a server that supports the SSH-2 protocol.")
 130    (license license:bsd-3)
 131    (home-page "https://www.libssh2.org/")))
 132
 133 (define-public openssh
 134   (package
 135    (name "openssh")
 136    (version "8.2p1")
 137    (source (origin
 138              (method url-fetch)
 139              (uri (string-append "mirror://openbsd/OpenSSH/portable/"
 140                                  "openssh-" version ".tar.gz"))
 141              (patches (search-patches "openssh-hurd.patch"))
 142              (sha256
 143               (base32
 144                "0wg6ckzvvklbzznijxkk28fb8dnwyjd0w30ra0afwv6gwr8m34j3"))))
 145    (build-system gnu-build-system)
 146    (native-inputs `(("groff" ,groff)
 147                     ("pkg-config" ,pkg-config)))
 148    (inputs `(("libedit" ,libedit)
 149              ("openssl" ,openssl)
 150              ("pam" ,linux-pam)
 151              ("mit-krb5" ,mit-krb5)
 152              ("zlib" ,zlib)
 153              ,@(if (hurd-target?)
 154                    '()
 155                    `(("xauth" ,xauth)))))         ; for 'ssh -X' and 'ssh -Y'
 156    (arguments
 157     `(#:test-target "tests"
 158       ;; Otherwise, the test scripts try to use a nonexistent directory and
 159       ;; fail.
 160       #:make-flags '("REGRESSTMP=\"$${BUILDDIR}/regress\"")
 161       #:configure-flags  `("--sysconfdir=/etc/ssh"
 162
 163                            ;; Default value of 'PATH' used by sshd.
 164                           "--with-default-path=/run/current-system/profile/bin"
 165
 166                           ;; configure needs to find krb5-config.
 167                           ,(string-append "--with-kerberos5="
 168                                           (assoc-ref %build-inputs "mit-krb5")
 169                                           "/bin")
 170
 171                           ;; libedit is needed for sftp completion.
 172                           "--with-libedit"
 173
 174                           ;; Enable PAM support in sshd.
 175                           "--with-pam"
 176
 177                           ;; "make install" runs "install -s" by default,
 178                           ;; which doesn't work for cross-compiled binaries
 179                           ;; because it invokes 'strip' instead of
 180                           ;; 'TRIPLET-strip'.  Work around this.
 181                           ,,@(if (%current-target-system)
 182                                  '("--disable-strip")
 183                                  '()))
 184
 185       #:phases
 186       (modify-phases %standard-phases
 187         (add-after 'configure 'reset-/var/empty
 188          (lambda* (#:key outputs #:allow-other-keys)
 189            (let ((out (assoc-ref outputs "out")))
 190              (substitute* "Makefile"
 191                (("PRIVSEP_PATH=/var/empty")
 192                 (string-append "PRIVSEP_PATH=" out "/var/empty")))
 193              #t)))
 194         (add-before 'check 'patch-tests
 195          (lambda _
 196            (substitute* "regress/test-exec.sh"
 197              (("/bin/sh") (which "sh")))
 198
 199            ;; Remove 't-exec' regress target which requires user 'sshd'.
 200            (substitute* (list "Makefile"
 201                               "regress/Makefile")
 202              (("^(tests:.*) t-exec(.*)" all pre post)
 203               (string-append pre post)))
 204            #t))
 205         (replace 'install
 206          (lambda* (#:key outputs (make-flags '()) #:allow-other-keys)
 207            ;; Install without host keys and system configuration files.
 208            (apply invoke "make" "install-nosysconf" make-flags)
 209            (install-file "contrib/ssh-copy-id"
 210                          (string-append (assoc-ref outputs "out")
 211                                         "/bin/"))
 212            (chmod (string-append (assoc-ref outputs "out")
 213                                  "/bin/ssh-copy-id") #o555)
 214            (install-file "contrib/ssh-copy-id.1"
 215                          (string-append (assoc-ref outputs "out")
 216                                         "/share/man/man1/"))
 217            #t)))))
 218    (synopsis "Client and server for the secure shell (ssh) protocol")
 219    (description
 220     "The SSH2 protocol implemented in OpenSSH is standardised by the
 221 IETF secsh working group and is specified in several RFCs and drafts.
 222 It is composed of three layered components:
 223
 224 The transport layer provides algorithm negotiation and a key exchange.
 225 The key exchange includes server authentication and results in a
 226 cryptographically secured connection: it provides integrity, confidentiality
 227 and optional compression.
 228
 229 The user authentication layer uses the established connection and relies on
 230 the services provided by the transport layer.  It provides several mechanisms
 231 for user authentication.  These include traditional password authentication
 232 as well as public-key or host-based authentication mechanisms.
 233
 234 The connection layer multiplexes many different concurrent channels over the
 235 authenticated connection and allows tunneling of login sessions and
 236 TCP-forwarding.  It provides a flow control service for these channels.
 237 Additionally, various channel-specific options can be negotiated.")
 238    (license (license:non-copyleft "file://LICENSE"
 239                                "See LICENSE in the distribution."))
 240    (home-page "https://www.openssh.com/")))
 241
 242 (define-public guile-ssh
 243   (package
 244     (name "guile-ssh")
 245     (version "0.12.0")
 246     (home-page "https://github.com/artyom-poptsov/guile-ssh")
 247     (source (origin
 248               (method git-fetch)
 249               (uri (git-reference
 250                     (url home-page)
 251                     (commit (string-append "v" version))))
 252               (file-name (string-append name "-" version ".tar.gz"))
 253               (sha256
 254                (base32
 255                 "054hd9rzfhb48gc1hw3rphhp0cnnd4bs5qmidy5ygsyvy9ravlad"))
 256               (modules '((guix build utils)))))
 257     (build-system gnu-build-system)
 258     (outputs '("out" "debug"))
 259     (arguments
 260      `(;; It makes no sense to build libguile-ssh.a.
 261        #:configure-flags '("--disable-static")
 262
 263        #:phases (modify-phases %standard-phases
 264                   (add-before 'build 'fix-libguile-ssh-file-name
 265                     (lambda* (#:key outputs #:allow-other-keys)
 266                       ;; Build and install libguile-ssh.so so that we can use
 267                       ;; its absolute file name in .scm files, before we build
 268                       ;; the .go files.
 269                       (let* ((out (assoc-ref outputs "out"))
 270                              (lib (string-append out "/lib")))
 271                         (invoke "make" "install"
 272                                 "-C" "libguile-ssh"
 273                                 "-j" (number->string
 274                                       (parallel-job-count)))
 275                         (substitute* (find-files "." "\\.scm$")
 276                           (("\"libguile-ssh\"")
 277                            (string-append "\"" lib "/libguile-ssh\"")))
 278                         #t)))
 279                   ,@(if (%current-target-system)
 280                         '()
 281                         '((add-before 'check 'fix-guile-path
 282                              (lambda* (#:key inputs #:allow-other-keys)
 283                                (let ((guile (assoc-ref inputs "guile")))
 284                                  (substitute* "tests/common.scm"
 285                                    (("/usr/bin/guile")
 286                                     (string-append guile "/bin/guile")))
 287                                  #t)))))
 288                   (add-after 'install 'remove-bin-directory
 289                     (lambda* (#:key outputs #:allow-other-keys)
 290                       (let* ((out (assoc-ref outputs "out"))
 291                              (bin (string-append out "/bin"))
 292                              (examples (string-append
 293                                         out "/share/guile-ssh/examples")))
 294                         (mkdir-p examples)
 295                         (rename-file (string-append bin "/ssshd.scm")
 296                                      (string-append examples "/ssshd.scm"))
 297                         (rename-file (string-append bin "/sssh.scm")
 298                                      (string-append examples "/sssh.scm"))
 299                         (delete-file-recursively bin)
 300                         #t))))
 301        ;; Tests are not parallel-safe.
 302        #:parallel-tests? #f))
 303     (native-inputs `(("autoconf" ,autoconf)
 304                      ("automake" ,automake)
 305                      ("libtool" ,libtool)
 306                      ("texinfo" ,texinfo)
 307                      ("pkg-config" ,pkg-config)
 308                      ("which" ,which)
 309                      ("guile" ,guile-3.0))) ;needed when cross-compiling.
 310     (inputs `(("guile" ,guile-3.0)
 311               ("libssh" ,libssh)
 312               ("libgcrypt" ,libgcrypt)))
 313     (synopsis "Guile bindings to libssh")
 314     (description
 315      "Guile-SSH is a library that provides access to the SSH protocol for
 316 programs written in GNU Guile interpreter.  It is a wrapper to the underlying
 317 libssh library.")
 318     (license license:gpl3+)))
 319
 320 (define-public guile2.0-ssh
 321   (package
 322     (inherit guile-ssh)
 323     (name "guile2.0-ssh")
 324     (native-inputs
 325      `(("guile" ,guile-2.0) ;needed when cross-compiling.
 326        ,@(alist-delete "guile" (package-native-inputs guile-ssh))))
 327     (inputs `(("guile" ,guile-2.0)
 328               ,@(alist-delete "guile" (package-inputs guile-ssh))))))
 329
 330 (define-public guile2.2-ssh
 331   (package
 332     (inherit guile-ssh)
 333     (name "guile2.2-ssh")
 334     (native-inputs
 335      `(("guile" ,guile-2.2) ;needed when cross-compiling.
 336        ,@(alist-delete "guile" (package-native-inputs guile-ssh))))
 337     (inputs `(("guile" ,guile-2.2)
 338               ,@(alist-delete "guile" (package-inputs guile-ssh))))))
 339
 340 (define-public guile3.0-ssh
 341   (deprecated-package "guile3.0-ssh" guile-ssh))
 342
 343 (define-public corkscrew
 344   (package
 345     (name "corkscrew")
 346     (version "2.0")
 347     (source
 348      (origin
 349        (method url-fetch)
 350        ;; The agroman.net domain name expired on 2017-03-23, and the original
 351        ;; "http://www.agroman.net/corkscrew/corkscrew-2.0.tar.gz" now returns
 352        ;; bogus HTML.  Perhaps it will yet return.  Until then, use a mirror.
 353        (uri (string-append "https://downloads.openwrt.org/sources/"
 354                            "corkscrew-" version ".tar.gz"))
 355        (sha256 (base32
 356                 "1gmhas4va6gd70i2x2mpxpwpgww6413mji29mg282jms3jscn3qd"))))
 357     (build-system gnu-build-system)
 358     (arguments
 359      `(#:phases
 360        (modify-phases %standard-phases
 361          (replace 'configure
 362            ;; Replace configure phase as the ./configure script does not like
 363            ;; CONFIG_SHELL and SHELL passed as parameters
 364            (lambda* (#:key outputs build target #:allow-other-keys)
 365              (let* ((out   (assoc-ref outputs "out"))
 366                     (bash  (which "bash"))
 367                     ;; Set --build and --host flags as the provided config.guess
 368                     ;; is not able to detect them
 369                     (flags `(,(string-append "--prefix=" out)
 370                              ,(string-append "--build=" build)
 371                              ,(string-append "--host=" (or target build)))))
 372                (setenv "CONFIG_SHELL" bash)
 373                (apply invoke bash "./configure" flags))))
 374          (add-after 'install 'install-documentation
 375            (lambda* (#:key outputs #:allow-other-keys)
 376              (let* ((out (assoc-ref outputs "out"))
 377                     (doc (string-append out "/share/doc/" ,name "-" ,version)))
 378                (install-file "README" doc)
 379                #t))))))
 380     (home-page "http://www.agroman.net/corkscrew")
 381     (synopsis "SSH tunneling through HTTP(S) proxies")
 382     (description
 383      "Corkscrew tunnels SSH connections through most HTTP and HTTPS proxies.
 384 Proxy authentication is only supported through the plain-text HTTP basic
 385 authentication scheme.")
 386     (license license:gpl2+)))
 387
 388 (define-public mosh
 389   (package
 390     (name "mosh")
 391     (version "1.3.2")
 392     (source (origin
 393               (method url-fetch)
 394               (uri (string-append "https://mosh.org/mosh-" version ".tar.gz"))
 395               (sha256
 396                (base32
 397                 "05hjhlp6lk8yjcy59zywpf0r6s0h0b9zxq0lw66dh9x8vxrhaq6s"))))
 398     (build-system gnu-build-system)
 399     (arguments
 400      '(#:phases
 401        (modify-phases %standard-phases
 402          (add-after 'install 'wrap
 403            (lambda* (#:key outputs #:allow-other-keys)
 404              ;; Make sure 'mosh' can find 'mosh-client' and
 405              ;; 'mosh-server'.
 406              (let* ((out (assoc-ref outputs "out"))
 407                     (bin (string-append out "/bin")))
 408                (wrap-program (string-append bin "/mosh")
 409                              `("PATH" ":" prefix (,bin)))))))))
 410     (native-inputs
 411      `(("pkg-config" ,pkg-config)))
 412     (inputs
 413      `(("openssl" ,openssl)
 414        ("perl" ,perl)
 415        ("perl-io-tty" ,perl-io-tty)
 416        ("zlib" ,zlib)
 417        ("ncurses" ,ncurses)
 418        ("protobuf" ,protobuf)
 419        ("boost-headers" ,boost)))
 420     (home-page "https://mosh.org/")
 421     (synopsis "Remote shell tolerant to intermittent connectivity")
 422     (description
 423      "Mosh is a remote terminal application that allows client roaming, supports
 424 intermittent connectivity, and provides intelligent local echo and line editing
 425 of user keystrokes.  It's a replacement for SSH that's more robust and
 426 responsive, especially over Wi-Fi, cellular, and long-distance links.")
 427     (license license:gpl3+)))
 428
 429 (define-public et
 430   (package
 431     (name "et")
 432     (version "3.1.0")
 433     (source
 434      (origin
 435        (method git-fetch)
 436        (uri (git-reference
 437              (url "https://github.com/MisterTea/EternalTCP.git")
 438              (commit (string-append "et-v" version))))
 439        (file-name (git-file-name name version))
 440        (sha256
 441         (base32 "1m5caxckn2ihwp9s2pbyh5amxlpwr7yc54q8s0kb10fr52w2vfnm"))))
 442     (build-system cmake-build-system)
 443     (arguments `(#:tests? #f))
 444     (native-inputs
 445      `(("pkg-config" ,pkg-config)))
 446     (inputs `(("glog" ,glog)
 447               ("gflags" ,gflags)
 448               ("libsodium" ,libsodium)
 449               ("protobuf" ,protobuf)))
 450     (synopsis "Remote shell that automatically reconnects")
 451     (description
 452      "Eternal Terminal (ET) is a remote shell that automatically reconnects
 453 without interrupting the session.  Unlike SSH sessions, ET sessions will
 454 survive even network outages and IP changes.  ET uses a custom protocol over
 455 TCP, not the SSH protocol.")
 456     (home-page "https://eternalterminal.dev/")
 457     (license license:asl2.0)))
 458
 459 (define-public dropbear
 460   (package
 461     (name "dropbear")
 462     (version "2019.78")
 463     (source
 464      (origin
 465        (method url-fetch)
 466        (uri (string-append
 467              "https://matt.ucc.asn.au/dropbear/releases/"
 468              "dropbear-" version ".tar.bz2"))
 469        (sha256
 470         (base32 "19242qlr40pbqfqd0gg6h8qpj38q6lgv03ja6sahj9vj2abnanaj"))))
 471     (build-system gnu-build-system)
 472     (arguments `(#:tests? #f))  ; there is no "make check" or anything similar
 473     ;; TODO: Investigate unbundling libtommath and libtomcrypt or at least
 474     ;; cherry-picking important bug fixes from them. See <bugs.gnu.org/24674>
 475     ;; for more information.
 476     (inputs `(("zlib" ,zlib)))
 477     (synopsis "Small SSH server and client")
 478     (description "Dropbear is a relatively small SSH server and
 479 client.  It runs on a variety of POSIX-based platforms.  Dropbear is
 480 particularly useful for embedded systems, such as wireless routers.")
 481     (home-page "https://matt.ucc.asn.au/dropbear/dropbear.html")
 482     (license (license:x11-style "" "See file LICENSE."))))
 483
 484 (define-public liboop
 485   (package
 486     (name "liboop")
 487     (version "1.0.1")
 488     (source
 489      (origin
 490       (method url-fetch)
 491       (uri (string-append "http://ftp.lysator.liu.se/pub/liboop/"
 492                           name "-" version ".tar.gz"))
 493       (sha256
 494        (base32
 495         "1q0p1l72pq9k3bi7a366j2rishv7dzzkg3i6r2npsfg7cnnidbsn"))))
 496     (build-system gnu-build-system)
 497     (home-page "https://www.lysator.liu.se/liboop/")
 498     (synopsis "Event loop library")
 499     (description "Liboop is a low-level event loop management library for
 500 POSIX-based operating systems.  It supports the development of modular,
 501 multiplexed applications which may respond to events from several sources.  It
 502 replaces the \"select() loop\" and allows the registration of event handlers
 503 for file and network I/O, timers and signals.  Since processes use these
 504 mechanisms for almost all external communication, liboop can be used as the
 505 basis for almost any application.")
 506     (license license:lgpl2.1+)))
 507
 508 (define-public lsh
 509   (package
 510     (name "lsh")
 511     (version "2.1")
 512     (source (origin
 513               (method url-fetch)
 514               (uri (string-append "mirror://gnu/lsh/lsh-"
 515                                   version ".tar.gz"))
 516               (sha256
 517                (base32
 518                 "1qqjy9zfzgny0rkb27c8c7dfsylvb6n0ld8h3an2r83pmaqr9gwb"))
 519               (modules '((guix build utils)))
 520               (snippet
 521                '(begin
 522                   (substitute* "src/testsuite/functions.sh"
 523                     (("localhost")
 524                      ;; Avoid host name lookups since they don't work in
 525                      ;; chroot builds.
 526                      "127.0.0.1")
 527                     (("set -e")
 528                      ;; Make tests more verbose.
 529                      "set -e\nset -x"))
 530
 531                   (substitute* (find-files "src/testsuite" "-test$")
 532                     (("localhost") "127.0.0.1"))
 533
 534                   (substitute* "src/testsuite/login-auth-test"
 535                     (("/bin/cat") "cat"))
 536                   #t))))
 537     (build-system gnu-build-system)
 538     (native-inputs
 539      `(("m4" ,m4)
 540        ("guile" ,guile-2.0)
 541        ("gperf" ,gperf)
 542        ("psmisc" ,psmisc)))                       ; for `killall'
 543     (inputs
 544      `(("nettle" ,nettle-2)
 545        ("linux-pam" ,linux-pam)
 546
 547        ;; 'rl.c' uses the 'CPPFunction' type, which is no longer in
 548        ;; Readline 6.3.
 549        ("readline" ,readline-6.2)
 550
 551        ("liboop" ,liboop)
 552        ("zlib" ,zlib)
 553        ("gmp" ,gmp)
 554
 555        ;; The server (lshd) invokes xauth when X11 forwarding is requested.
 556        ;; This adds 24 MiB (or 27%) to the closure of lsh.
 557        ("xauth" ,xauth)))
 558     (arguments
 559      '(;; Skip the `configure' test that checks whether /dev/ptmx &
 560        ;; co. work as expected, because it relies on impurities (for
 561        ;; instance, /dev/pts may be unavailable in chroots.)
 562        #:configure-flags '("lsh_cv_sys_unix98_ptys=yes"
 563
 564                            ;; Use glibc's argp rather than the bundled one.
 565                            "--with-system-argp"
 566
 567                            ;; 'lsh_argp.h' checks HAVE_ARGP_PARSE but nothing
 568                            ;; defines it.
 569                            "CPPFLAGS=-DHAVE_ARGP_PARSE")
 570
 571        ;; FIXME: Tests won't run in a chroot, presumably because
 572        ;; /etc/profile is missing, and thus clients get an empty $PATH
 573        ;; and nothing works.
 574        #:tests? #f
 575
 576        #:phases
 577        (modify-phases %standard-phases
 578          (add-before 'configure 'pre-configure
 579            (lambda* (#:key inputs #:allow-other-keys)
 580              (let* ((nettle    (assoc-ref inputs "nettle"))
 581                     (sexp-conv (string-append nettle "/bin/sexp-conv")))
 582                ;; Remove argp from the list of sub-directories; we don't want
 583                ;; to build it, really.
 584                (substitute* "src/Makefile.in"
 585                  (("^SUBDIRS = argp")
 586                   "SUBDIRS ="))
 587
 588                ;; Make sure 'lsh' and 'lshd' pick 'sexp-conv' in the right place
 589                ;; by default.
 590                (substitute* "src/environ.h.in"
 591                  (("^#define PATH_SEXP_CONV.*")
 592                   (string-append "#define PATH_SEXP_CONV \""
 593                                  sexp-conv "\"\n")))
 594
 595                ;; Same for the 'lsh-authorize' script.
 596                (substitute* "src/lsh-authorize"
 597                  (("=sexp-conv")
 598                   (string-append "=" sexp-conv)))
 599
 600                ;; Tell lshd where 'xauth' lives.  Another option would be to
 601                ;; hardcode "/run/current-system/profile/bin/xauth", thereby
 602                ;; reducing the closure size, but that wouldn't work on foreign
 603                ;; distros.
 604                (with-fluids ((%default-port-encoding "ISO-8859-1"))
 605                  (substitute* "src/server_x11.c"
 606                    (("define XAUTH_PROGRAM.*")
 607                     (string-append "define XAUTH_PROGRAM \""
 608                                    (assoc-ref inputs "xauth")
 609                                    "/bin/xauth\"\n")))))
 610
 611              ;; Tests rely on $USER being set.
 612              (setenv "USER" "guix"))))))
 613     (home-page "https://www.lysator.liu.se/~nisse/lsh/")
 614     (synopsis "GNU implementation of the Secure Shell (ssh) protocols")
 615     (description
 616      "GNU lsh is a free implementation of the SSH version 2 protocol.  It is
 617 used to create a secure line of communication between two computers,
 618 providing shell access to the server system from the client.  It provides
 619 both the server daemon and the client application, as well as tools for
 620 manipulating key files.")
 621     (license license:gpl2+)))
 622
 623 (define-public sshpass
 624   (package
 625     (name "sshpass")
 626     (version "1.06")
 627     (synopsis "Non-interactive password authentication with SSH")
 628     (home-page "https://sourceforge.net/projects/sshpass/")
 629     (source
 630      (origin
 631        (method url-fetch)
 632        (uri (string-append "mirror://sourceforge/sshpass/sshpass/"
 633                            version "/sshpass-" version ".tar.gz"))
 634        (sha256
 635         (base32
 636          "0q7fblaczb7kwbsz0gdy9267z0sllzgmf0c7z5c9mf88wv74ycn6"))))
 637     (build-system gnu-build-system)
 638     (description "sshpass is a tool for non-interactivly performing password
 639 authentication with SSH's so-called @dfn{interactive keyboard password
 640 authentication}.")
 641     (license license:gpl2+)))
 642
 643 (define-public autossh
 644   (package
 645     (name "autossh")
 646     (version "1.4g")
 647     (source
 648      (origin
 649        (method url-fetch)
 650        (uri (string-append
 651              "https://www.harding.motd.ca/autossh/autossh-"
 652              version ".tgz"))
 653        (sha256
 654         (base32 "0xqjw8df68f4kzkns5gcah61s5wk0m44qdk2z1d6388w6viwxhsz"))))
 655     (build-system gnu-build-system)
 656     (arguments `(#:tests? #f)) ; There is no "make check" or anything similar
 657     (inputs `(("openssh" ,openssh)))
 658     (synopsis "Automatically restart SSH sessions and tunnels")
 659     (description "autossh is a program to start a copy of @command{ssh} and
 660 monitor it, restarting it as necessary should it die or stop passing traffic.")
 661     (home-page "https://www.harding.motd.ca/autossh/")
 662     (license
 663      ;; Why point to a source file?  Well, all the individual files have a
 664      ;; copy of this license in their headers, but there's no separate file
 665      ;; with that information.
 666      (license:non-copyleft "file://autossh.c"))))
 667
 668 (define-public pdsh
 669   (package
 670     (name "pdsh")
 671     (version "2.34")
 672     (source
 673      (origin
 674        (method url-fetch)
 675        (uri (string-append "https://github.com/chaos/pdsh/"
 676                            "releases/download/pdsh-" version
 677                            "/pdsh-" version ".tar.gz"))
 678        (sha256
 679         (base32 "1s91hmhrz7rfb6h3l5k97s393rcm1ww3svp8dx5z8vkkc933wyxl"))))
 680     (build-system gnu-build-system)
 681     (arguments
 682      `(#:configure-flags
 683        (list "--with-ssh")
 684        #:phases
 685        (modify-phases %standard-phases
 686          (add-after 'unpack 'patch-/bin/sh
 687            (lambda _
 688              (substitute* '("tests/t0006-pdcp.sh"
 689                             "tests/t0004-module-loading.sh"
 690                             "tests/t2001-ssh.sh"
 691                             "tests/t1003-slurm.sh"
 692                             "tests/t6036-long-output-lines.sh"
 693                             "tests/aggregate-results.sh"
 694                             "tests/t2000-exec.sh"
 695                             "tests/t0002-internal.sh"
 696                             "tests/t1002-dshgroup.sh"
 697                             "tests/t5000-dshbak.sh"
 698                             "tests/t0001-basic.sh"
 699                             "tests/t0005-rcmd_type-and-user.sh"
 700                             "tests/test-lib.sh"
 701                             "tests/t2002-mrsh.sh"
 702                             "tests/t0003-wcoll.sh"
 703                             "tests/test-modules/pcptest.c")
 704                (("/bin/sh") (which "bash")))
 705              #t))
 706          (add-after 'unpack 'patch-tests
 707            (lambda _
 708              (substitute* "tests/t6036-long-output-lines.sh"
 709                (("which") (which "which")))
 710              #t)))))
 711     (inputs
 712      `(("openssh" ,openssh)
 713        ("mit-krb5" ,mit-krb5)
 714        ("perl" ,perl)))
 715     (native-inputs
 716      `(("which" ,which)))
 717     (home-page "https://github.com/chaos/pdsh")
 718     (synopsis "Parallel distributed shell")
 719     (description "Pdsh is a an efficient, multithreaded remote shell client
 720 which executes commands on multiple remote hosts in parallel.  Pdsh implements
 721 dynamically loadable modules for extended functionality such as new remote
 722 shell services and remote host selection.")
 723     (license license:gpl2+)))
 724
 725 (define-public clustershell
 726   (package
 727     (name "clustershell")
 728     (version "1.8.3")
 729     (source
 730      (origin
 731        (method url-fetch)
 732        (uri (string-append "https://github.com/cea-hpc/clustershell/releases"
 733                            "/download/v" version
 734                            "/ClusterShell-" version ".tar.gz"))
 735        (sha256
 736         (base32 "1qdcgh733szwj9r1gambrgfkizvbjci0bnnkds9a8mnyb3sasnan"))))
 737     (build-system python-build-system)
 738     (inputs `(("openssh" ,openssh)))
 739     (propagated-inputs `(("python-pyyaml" ,python-pyyaml)))
 740     (arguments
 741      `(#:phases (modify-phases %standard-phases
 742                   (add-before 'build 'record-openssh-file-name
 743                     (lambda* (#:key inputs #:allow-other-keys)
 744                       (let ((ssh (assoc-ref inputs "openssh")))
 745                         (substitute* "lib/ClusterShell/Worker/Ssh.py"
 746                           (("info\\(\"ssh_path\"\\) or \"ssh\"")
 747                            (string-append "info(\"ssh_path\") or \""
 748                                           ssh "/bin/ssh\"")))
 749                         #t))))))
 750     (home-page "https://cea-hpc.github.io/clustershell/")
 751     (synopsis "Scalable event-driven Python framework for cluster administration")
 752     (description
 753      "ClusterShell is an event-driven Python framework, designed to run local
 754 or distant commands in parallel on server farms or on large GNU/Linux
 755 clusters.  It will take care of common issues encountered on HPC clusters,
 756 such as operating on groups of nodes, running distributed commands using
 757 optimized execution algorithms, as well as gathering results and merging
 758 identical outputs, or retrieving return codes.  ClusterShell takes advantage
 759 of existing remote shell facilities such as SSH.")
 760     (license license:lgpl2.1+)))
 761
 762 (define-public endlessh
 763   (package
 764     (name "endlessh")
 765     (version "1.1")
 766     (source
 767       (origin
 768         (method git-fetch)
 769         (uri (git-reference
 770               (url "https://github.com/skeeto/endlessh.git")
 771               (commit version)))
 772         (file-name (git-file-name name version))
 773         (sha256
 774          (base32 "0ziwr8j1frsp3dajr8h5glkm1dn5cci404kazz5w1jfrp0736x68"))))
 775     (build-system gnu-build-system)
 776     (arguments
 777      '(#:make-flags (list (string-append "PREFIX=" (assoc-ref %outputs "out"))
 778                           "CC=gcc")
 779        #:tests? #f                      ; no test target
 780        #:phases
 781        (modify-phases %standard-phases
 782          (delete 'configure))))         ; no configure script
 783     (home-page "https://github.com/skeeto/endlessh")
 784     (synopsis "SSH tarpit that slowly sends an endless banner")
 785     (description
 786      "Endlessh is an SSH tarpit that very slowly sends an endless, random SSH
 787 banner.  It keeps SSH clients locked up for hours or even days at a time.  The
 788 purpose is to put your real SSH server on another port and then let the script
 789 kiddies get stuck in this tarpit instead of bothering a real server.
 790
 791 Since the tarpit is in the banner before any cryptographic exchange occurs, this
 792 program doesn't depend on any cryptographic libraries.  It's a simple,
 793 single-threaded, standalone C program.  It uses @code{poll()} to trap multiple
 794 clients at a time.")
 795     (license license:unlicense)))