gnu/packages/ssh.scm

   1 ;;; GNU Guix --- Functional package management for GNU
   2 ;;; Copyright © 2012, 2013, 2014, 2015, 2016, 2017, 2018, 2019, 2020 Ludovic Courtès <ludo@gnu.org>
   3 ;;; Copyright © 2013, 2014 Andreas Enge <andreas@enge.fr>
   4 ;;; Copyright © 2014, 2015, 2016 Mark H Weaver <mhw@netris.org>
   5 ;;; Copyright © 2015, 2016, 2018, 2019, 2020, 2021 Efraim Flashner <efraim@flashner.co.il>
   6 ;;; Copyright © 2016, 2019 Leo Famulari <leo@famulari.name>
   7 ;;; Copyright © 2016, 2021 Nicolas Goaziou <mail@nicolasgoaziou.fr>
   8 ;;; Copyright © 2016 Christopher Allan Webber <cwebber@dustycloud.org>
   9 ;;; Copyright © 2017–2021 Tobias Geerinckx-Rice <me@tobias.gr>
  10 ;;; Copyright © 2017 Stefan Reichör <stefan@xsteve.at>
  11 ;;; Copyright © 2017 Ricardo Wurmus <rekado@elephly.net>
  12 ;;; Copyright © 2017 Nikita <nikita@n0.is>
  13 ;;; Copyright © 2018 Manuel Graf <graf@init.at>
  14 ;;; Copyright © 2019 Gábor Boskovits <boskovits@gmail.com>
  15 ;;; Copyright © 2019, 2020 Mathieu Othacehe <m.othacehe@gmail.com>
  16 ;;; Copyright © 2020 Jan (janneke) Nieuwenhuizen <janneke@gnu.org>
  17 ;;; Copyright © 2020 Oleg Pykhalov <go.wigust@gmail.com>
  18 ;;; Copyright © 2020 Maxim Cournoyer <maxim.cournoyer@gmail.com>
  19 ;;;
  20 ;;; This file is part of GNU Guix.
  21 ;;;
  22 ;;; GNU Guix is free software; you can redistribute it and/or modify it
  23 ;;; under the terms of the GNU General Public License as published by
  24 ;;; the Free Software Foundation; either version 3 of the License, or (at
  25 ;;; your option) any later version.
  26 ;;;
  27 ;;; GNU Guix is distributed in the hope that it will be useful, but
  28 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
  29 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  30 ;;; GNU General Public License for more details.
  31 ;;;
  32 ;;; You should have received a copy of the GNU General Public License
  33 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
  34
  35 (define-module (gnu packages ssh)
  36   #:use-module (gnu packages)
  37   #:use-module (gnu packages autotools)
  38   #:use-module (gnu packages base)
  39   #:use-module (gnu packages boost)
  40   #:use-module (gnu packages compression)
  41   #:use-module (gnu packages crypto)
  42   #:use-module (gnu packages elf)
  43   #:use-module (gnu packages gnupg)
  44   #:use-module (gnu packages gperf)
  45   #:use-module (gnu packages groff)
  46   #:use-module (gnu packages guile)
  47   #:use-module (gnu packages hurd)
  48   #:use-module (gnu packages libedit)
  49   #:use-module (gnu packages linux)
  50   #:use-module (gnu packages logging)
  51   #:use-module (gnu packages m4)
  52   #:use-module (gnu packages multiprecision)
  53   #:use-module (gnu packages ncurses)
  54   #:use-module (gnu packages nettle)
  55   #:use-module (gnu packages kerberos)
  56   #:use-module (gnu packages perl)
  57   #:use-module (gnu packages pkg-config)
  58   #:use-module (gnu packages popt)
  59   #:use-module (gnu packages protobuf)
  60   #:use-module (gnu packages python)
  61   #:use-module (gnu packages python-crypto)
  62   #:use-module (gnu packages python-web)
  63   #:use-module (gnu packages python-xyz)
  64   #:use-module (gnu packages readline)
  65   #:use-module (gnu packages texinfo)
  66   #:use-module (gnu packages tls)
  67   #:use-module (gnu packages xorg)
  68   #:use-module (guix build-system cmake)
  69   #:use-module (guix build-system gnu)
  70   #:use-module (guix build-system python)
  71   #:use-module (guix download)
  72   #:use-module (guix git-download)
  73   #:use-module ((guix licenses) #:prefix license:)
  74   #:use-module (guix packages)
  75   #:use-module (guix utils)
  76   #:use-module (srfi srfi-1))
  77
  78 (define-public hss
  79   (package
  80     (name "hss")
  81     (version "1.8")
  82     (source (origin
  83               (method git-fetch)
  84               (uri (git-reference
  85                     (url "https://github.com/six-ddc/hss")
  86                     (commit (string-append "v" version))))
  87               (file-name (git-file-name name version))
  88               (sha256
  89                (base32
  90                 "1rpysj65j9ls30bf2c5k5hykzzjfknrihs58imp178bx1wqzw4jl"))))
  91     (inputs
  92      `(("readline" ,readline)))
  93     (arguments
  94      `(#:make-flags
  95        (list ,(string-append "CC=" (cc-for-target))
  96              (string-append "INSTALL_BIN=" (assoc-ref %outputs "out") "/bin"))
  97        #:tests? #f                      ; no tests
  98        #:phases
  99        (modify-phases %standard-phases
 100          (add-after 'unpack 'patch-file-names
 101            (lambda* (#:key inputs outputs #:allow-other-keys)
 102              (substitute* "Makefile"
 103                (("/usr/local/opt/readline")
 104                 (assoc-ref inputs "readline")))
 105              #t))
 106          (delete 'configure))))         ; no configure script
 107     (build-system gnu-build-system)
 108     (home-page "https://github.com/six-ddc/hss/")
 109     (synopsis "Interactive SSH client for multiple servers")
 110     (description
 111      "@command{hss} is an interactive SSH client for multiple servers.  Commands
 112 are executed on all servers in parallel.  Execution on one server does not need
 113 to wait for that on another server to finish before starting.  One can run a
 114 command on hundreds of servers at the same time, with almost the same experience
 115 as a local Bash shell.
 116
 117 It supports:
 118 @itemize @bullet
 119 @item interactive input: based on GNU readline.
 120 @item history: responding to the @kbd{C-r} key.
 121 @item auto-completion: @key{TAB}-completion from remote servers for commands and
 122 file names.
 123 @end itemize\n")
 124     (license license:expat)))
 125
 126 (define-public libssh
 127   (package
 128     (name "libssh")
 129     (version "0.9.5")
 130     (source (origin
 131               (method git-fetch)
 132               (uri (git-reference
 133                      (url "https://git.libssh.org/projects/libssh.git")
 134                      (commit (string-append "libssh-" version))))
 135               (sha256
 136                (base32
 137                 "1b2klflmn0mdkcyjl4dqfg116bf9nhmqm4qla5cqa9xis89a5bn6"))
 138               (file-name (git-file-name name version))))
 139     (build-system cmake-build-system)
 140     (outputs '("out" "debug"))
 141     (arguments
 142      '(#:configure-flags '("-DWITH_GCRYPT=ON")
 143
 144        ;; TODO: Add 'CMockery' and '-DWITH_TESTING=ON' for the test suite.
 145        #:tests? #f))
 146     (inputs `(("zlib" ,zlib)
 147               ("libgcrypt" ,libgcrypt)
 148               ("mit-krb5" ,mit-krb5)))
 149     (synopsis "SSH client library")
 150     (description
 151      "libssh is a C library implementing the SSHv2 and SSHv1 protocol for client
 152 and server implementations.  With libssh, you can remotely execute programs,
 153 transfer files, and use a secure and transparent tunnel for your remote
 154 applications.")
 155     (home-page "https://www.libssh.org")
 156     (license license:lgpl2.1+)))
 157
 158 (define-public libssh2
 159   (package
 160    (name "libssh2")
 161    (version "1.9.0")
 162    (source (origin
 163             (method url-fetch)
 164             (uri (string-append
 165                    "https://www.libssh2.org/download/libssh2-"
 166                    version ".tar.gz"))
 167             (sha256
 168              (base32
 169               "1zfsz9nldakfz61d2j70pk29zlmj7w2vv46s9l3x2prhcgaqpyym"))
 170             (patches (search-patches "libssh2-CVE-2019-17498.patch"))))
 171    (build-system gnu-build-system)
 172    ;; The installed libssh2.pc file does not include paths to libgcrypt and
 173    ;; zlib libraries, so we need to propagate the inputs.
 174    (propagated-inputs `(("libgcrypt" ,libgcrypt)
 175                         ("zlib" ,zlib)))
 176    (arguments `(#:configure-flags `("--with-libgcrypt")))
 177    (synopsis "Client-side C library implementing the SSH2 protocol")
 178    (description
 179     "libssh2 is a library intended to allow software developers access to
 180 the SSH-2 protocol in an easy-to-use self-contained package.  It can be built
 181 into an application to perform many different tasks when communicating with
 182 a server that supports the SSH-2 protocol.")
 183    (license license:bsd-3)
 184    (home-page "https://www.libssh2.org/")))
 185
 186 (define-public openssh
 187   (package
 188    (name "openssh")
 189    (version "8.6p1")
 190    (source (origin
 191              (method url-fetch)
 192              (uri (string-append "mirror://openbsd/OpenSSH/portable/"
 193                                  "openssh-" version ".tar.gz"))
 194              (patches (search-patches "openssh-hurd.patch"))
 195              (sha256
 196               (base32
 197                "1bnpivgk98h2f9afpp88jv6g9ps83vnpxd031n2jqxi12vdf9rn3"))))
 198    (build-system gnu-build-system)
 199    (native-inputs `(("groff" ,groff)
 200                     ("pkg-config" ,pkg-config)))
 201    (inputs `(("libedit" ,libedit)
 202              ("openssl" ,openssl)
 203              ,@(if (hurd-target?)
 204                  '()
 205                  `(("pam" ,linux-pam)))
 206              ("mit-krb5" ,mit-krb5)
 207              ("zlib" ,zlib)
 208              ("xauth" ,xauth)))        ; for 'ssh -X' and 'ssh -Y'
 209    (arguments
 210     `(#:test-target "tests"
 211       ;; Otherwise, the test scripts try to use a nonexistent directory and
 212       ;; fail.
 213       #:make-flags '("REGRESSTMP=\"$${BUILDDIR}/regress\"")
 214       #:configure-flags  `("--sysconfdir=/etc/ssh"
 215
 216                            ;; Default value of 'PATH' used by sshd.
 217                           "--with-default-path=/run/current-system/profile/bin"
 218
 219                           ;; configure needs to find krb5-config.
 220                           ,(string-append "--with-kerberos5="
 221                                           (assoc-ref %build-inputs "mit-krb5")
 222                                           "/bin")
 223
 224                           ;; libedit is needed for sftp completion.
 225                           "--with-libedit"
 226
 227                           ;; Enable PAM support in sshd.
 228                           ,,@(if (hurd-target?)
 229                                '()
 230                                '("--with-pam"))
 231
 232                           ;; "make install" runs "install -s" by default,
 233                           ;; which doesn't work for cross-compiled binaries
 234                           ;; because it invokes 'strip' instead of
 235                           ;; 'TRIPLET-strip'.  Work around this.
 236                           ,,@(if (%current-target-system)
 237                                  '("--disable-strip")
 238                                  '()))
 239
 240       #:phases
 241       (modify-phases %standard-phases
 242         (add-after 'configure 'reset-/var/empty
 243          (lambda* (#:key outputs #:allow-other-keys)
 244            (let ((out (assoc-ref outputs "out")))
 245              (substitute* "Makefile"
 246                (("PRIVSEP_PATH=/var/empty")
 247                 (string-append "PRIVSEP_PATH=" out "/var/empty")))
 248              #t)))
 249         (add-before 'check 'patch-tests
 250          (lambda _
 251            (substitute* "regress/test-exec.sh"
 252              (("/bin/sh") (which "sh")))
 253
 254            ;; Remove 't-exec' regress target which requires user 'sshd'.
 255            (substitute* (list "Makefile"
 256                               "regress/Makefile")
 257              (("^(tests:.*) t-exec(.*)" all pre post)
 258               (string-append pre post)))
 259            #t))
 260         (replace 'install
 261          (lambda* (#:key outputs (make-flags '()) #:allow-other-keys)
 262            ;; Install without host keys and system configuration files.
 263            (apply invoke "make" "install-nosysconf" make-flags)
 264            (install-file "contrib/ssh-copy-id"
 265                          (string-append (assoc-ref outputs "out")
 266                                         "/bin/"))
 267            (chmod (string-append (assoc-ref outputs "out")
 268                                  "/bin/ssh-copy-id") #o555)
 269            (install-file "contrib/ssh-copy-id.1"
 270                          (string-append (assoc-ref outputs "out")
 271                                         "/share/man/man1/"))
 272            #t)))))
 273    (synopsis "Client and server for the secure shell (ssh) protocol")
 274    (description
 275     "The SSH2 protocol implemented in OpenSSH is standardised by the
 276 IETF secsh working group and is specified in several RFCs and drafts.
 277 It is composed of three layered components:
 278
 279 The transport layer provides algorithm negotiation and a key exchange.
 280 The key exchange includes server authentication and results in a
 281 cryptographically secured connection: it provides integrity, confidentiality
 282 and optional compression.
 283
 284 The user authentication layer uses the established connection and relies on
 285 the services provided by the transport layer.  It provides several mechanisms
 286 for user authentication.  These include traditional password authentication
 287 as well as public-key or host-based authentication mechanisms.
 288
 289 The connection layer multiplexes many different concurrent channels over the
 290 authenticated connection and allows tunneling of login sessions and
 291 TCP-forwarding.  It provides a flow control service for these channels.
 292 Additionally, various channel-specific options can be negotiated.")
 293    (license (license:non-copyleft "file://LICENSE"
 294                                "See LICENSE in the distribution."))
 295    (home-page "https://www.openssh.com/")))
 296
 297 ;; OpenSSH without X support. This allows to use OpenSSH without dragging X
 298 ;; libraries to the closure.
 299 (define-public openssh-sans-x
 300   (package
 301     (inherit openssh)
 302     (name "openssh-sans-x")
 303     (inputs (alist-delete "xauth" (package-inputs openssh)))
 304     (synopsis "OpenSSH client and server without X11 support")))
 305
 306 (define-public guile-ssh
 307   (package
 308     (name "guile-ssh")
 309     (version "0.13.1")
 310     (home-page "https://github.com/artyom-poptsov/guile-ssh")
 311     (source (origin
 312               (method git-fetch)
 313               (uri (git-reference
 314                     (url home-page)
 315                     (commit (string-append "v" version))))
 316               (file-name (string-append name "-" version ".tar.gz"))
 317               (sha256
 318                (base32
 319                 "1xpxkvgj7wgcl450djkcrmrf957mcy2f36hfs5g6kpla1gax2d1g"))
 320               (modules '((guix build utils)))))
 321     (build-system gnu-build-system)
 322     (outputs '("out" "debug"))
 323     (arguments
 324      `(;; It makes no sense to build libguile-ssh.a.
 325        #:configure-flags '("--disable-static")
 326
 327        #:phases (modify-phases %standard-phases
 328                   (add-before 'build 'fix-libguile-ssh-file-name
 329                     (lambda* (#:key outputs #:allow-other-keys)
 330                       ;; Build and install libguile-ssh.so so that we can use
 331                       ;; its absolute file name in .scm files, before we build
 332                       ;; the .go files.
 333                       (let* ((out (assoc-ref outputs "out"))
 334                              (lib (string-append out "/lib")))
 335                         (invoke "make" "install"
 336                                 "-C" "libguile-ssh"
 337                                 "-j" (number->string
 338                                       (parallel-job-count)))
 339                         (substitute* (find-files "." "\\.scm$")
 340                           (("\"libguile-ssh\"")
 341                            (string-append "\"" lib "/libguile-ssh\"")))
 342                         #t)))
 343                   ,@(if (%current-target-system)
 344                         '()
 345                         '((add-before 'check 'fix-guile-path
 346                              (lambda* (#:key inputs #:allow-other-keys)
 347                                (let ((guile (assoc-ref inputs "guile")))
 348                                  (substitute* "tests/common.scm"
 349                                    (("/usr/bin/guile")
 350                                     (string-append guile "/bin/guile")))
 351                                  #t)))))
 352                   (add-after 'install 'remove-bin-directory
 353                     (lambda* (#:key outputs #:allow-other-keys)
 354                       (let* ((out (assoc-ref outputs "out"))
 355                              (bin (string-append out "/bin"))
 356                              (examples (string-append
 357                                         out "/share/guile-ssh/examples")))
 358                         (mkdir-p examples)
 359                         (rename-file (string-append bin "/ssshd.scm")
 360                                      (string-append examples "/ssshd.scm"))
 361                         (rename-file (string-append bin "/sssh.scm")
 362                                      (string-append examples "/sssh.scm"))
 363                         (delete-file-recursively bin)
 364                         #t))))))
 365     (native-inputs `(("autoconf" ,autoconf)
 366                      ("automake" ,automake)
 367                      ("libtool" ,libtool)
 368                      ("texinfo" ,texinfo)
 369                      ("pkg-config" ,pkg-config)
 370                      ("which" ,which)
 371                      ("guile" ,guile-3.0))) ;needed when cross-compiling.
 372     (inputs `(("guile" ,guile-3.0)
 373               ("libssh" ,libssh)
 374               ("libgcrypt" ,libgcrypt)))
 375     (synopsis "Guile bindings to libssh")
 376     (description
 377      "Guile-SSH is a library that provides access to the SSH protocol for
 378 programs written in GNU Guile interpreter.  It is a wrapper to the underlying
 379 libssh library.")
 380     (license license:gpl3+)))
 381
 382 (define-public guile2.0-ssh
 383   (package
 384     (inherit guile-ssh)
 385     (name "guile2.0-ssh")
 386     (native-inputs
 387      `(("guile" ,guile-2.0) ;needed when cross-compiling.
 388        ,@(alist-delete "guile" (package-native-inputs guile-ssh))))
 389     (inputs `(("guile" ,guile-2.0)
 390               ,@(alist-delete "guile" (package-inputs guile-ssh))))))
 391
 392 (define-public guile2.2-ssh
 393   (package
 394     (inherit guile-ssh)
 395     (name "guile2.2-ssh")
 396     (native-inputs
 397      `(("guile" ,guile-2.2) ;needed when cross-compiling.
 398        ,@(alist-delete "guile" (package-native-inputs guile-ssh))))
 399     (inputs `(("guile" ,guile-2.2)
 400               ,@(alist-delete "guile" (package-inputs guile-ssh))))))
 401
 402 (define-public guile3.0-ssh
 403   (deprecated-package "guile3.0-ssh" guile-ssh))
 404
 405 (define-public corkscrew
 406   ;; The last 2.0 release hails from 2009.  Use a fork (submitted upstream as
 407   ;; <https://github.com/patpadgett/corkscrew/pull/5>) that adds now-essential
 408   ;; IPv6 and TLS support.
 409   (let ((revision "0")
 410         (commit "268b71e88ee51fddceab96d665b327394f1feb12"))
 411     (package
 412       (name "corkscrew")
 413       (version (git-version "2.0" revision commit))
 414       (source
 415        (origin
 416          (method git-fetch)
 417          (uri (git-reference
 418                (url "https://github.com/rtgill82/corkscrew")
 419                (commit commit)))
 420          (sha256
 421           (base32 "1rylbimlfig3ii4bqr4r058lkc43pqkxnxqpqdpm31blh3xs0dcw"))
 422          (file-name (git-file-name name version))))
 423       (build-system gnu-build-system)
 424       (arguments
 425        `(#:configure-flags
 426          (list "--enable-ssl")
 427          #:phases
 428          (modify-phases %standard-phases
 429            (add-after 'unpack 'update-metadata
 430              (lambda _
 431                (substitute* "configure.ac"
 432                  ;; Our version differs significantly.
 433                  (("2.0") (string-append ,version " (Guix)")))
 434                (substitute* "corkscrew.c"
 435                  ;; This domain's since been squat.
 436                  (("\\(agroman@agroman\\.net\\)")
 437                   (format #f "<~a>" ,(package-home-page this-package))))))
 438            (add-after 'install 'install-documentation
 439              (lambda* (#:key outputs #:allow-other-keys)
 440                (let* ((out (assoc-ref outputs "out"))
 441                       (doc (string-append out "/share/doc/" ,name "-" ,version)))
 442                  (install-file "README.md" doc)
 443                  #t))))))
 444       (native-inputs
 445        `(("autoconf" ,autoconf)
 446          ("automake" ,automake)
 447          ("pkg-config" ,pkg-config)))
 448       (inputs
 449        `(("openssl" ,openssl)))
 450       (home-page "https://github.com/patpadgett/corkscrew")
 451       (synopsis "SSH tunneling through HTTP(S) proxies")
 452       (description
 453        "Corkscrew tunnels SSH connections through most HTTP and HTTPS proxies.
 454 It supports proxy authentication through the HTTP basic authentication scheme
 455 with optional @acronym{TLS, Transport-Level Security} to protect credentials.")
 456       (license license:gpl2+))))
 457
 458 (define-public mosh
 459   (package
 460     (name "mosh")
 461     (version "1.3.2")
 462     (source (origin
 463               (method url-fetch)
 464               (uri (string-append "https://mosh.org/mosh-" version ".tar.gz"))
 465               (sha256
 466                (base32
 467                 "05hjhlp6lk8yjcy59zywpf0r6s0h0b9zxq0lw66dh9x8vxrhaq6s"))))
 468     (build-system gnu-build-system)
 469     (arguments
 470      '(#:phases
 471        (modify-phases %standard-phases
 472          (add-after 'unpack 'patch-FHS-file-names
 473            (lambda _
 474              (substitute* "scripts/mosh.pl"
 475                (("/bin/sh")
 476                 (which "sh")))
 477              #t))
 478          (add-after 'install 'wrap
 479            (lambda* (#:key outputs #:allow-other-keys)
 480              ;; Make sure 'mosh' can find 'mosh-client' and
 481              ;; 'mosh-server'.
 482              (let* ((out (assoc-ref outputs "out"))
 483                     (bin (string-append out "/bin")))
 484                (wrap-program (string-append bin "/mosh")
 485                              `("PATH" ":" prefix (,bin)))))))))
 486     (native-inputs
 487      `(("pkg-config" ,pkg-config)))
 488     (inputs
 489      `(("openssl" ,openssl)
 490        ("perl" ,perl)
 491        ("perl-io-tty" ,perl-io-tty)
 492        ("zlib" ,zlib)
 493        ("ncurses" ,ncurses)
 494        ("protobuf" ,protobuf)
 495        ("boost-headers" ,boost)))
 496     (home-page "https://mosh.org/")
 497     (synopsis "Remote shell tolerant to intermittent connectivity")
 498     (description
 499      "Mosh is a remote terminal application that allows client roaming, supports
 500 intermittent connectivity, and provides intelligent local echo and line editing
 501 of user keystrokes.  It's a replacement for SSH that's more robust and
 502 responsive, especially over Wi-Fi, cellular, and long-distance links.")
 503     (license license:gpl3+)))
 504
 505 (define-public dropbear
 506   (package
 507     (name "dropbear")
 508     (version "2020.81")
 509     (source
 510      (origin
 511        (method url-fetch)
 512        (uri (string-append
 513              "https://matt.ucc.asn.au/dropbear/releases/"
 514              "dropbear-" version ".tar.bz2"))
 515        (sha256
 516         (base32 "0fy5ma4cfc2pk25mcccc67b2mf1rnb2c06ilb7ddnxbpnc85s8s8"))
 517        (modules '((guix build utils)))
 518        (snippet
 519         '(begin
 520            (delete-file-recursively "libtommath")
 521            (delete-file-recursively "libtomcrypt")
 522            (substitute* "configure"
 523              (("-ltomcrypt") "-ltomcrypt -ltommath"))
 524            #t))))
 525     (build-system gnu-build-system)
 526     (arguments
 527      `(#:configure-flags '("--disable-bundled-libtom")
 528        #:tests? #f))    ; there is no "make check" or anything similar
 529     (inputs
 530      `(("libtomcrypt" ,libtomcrypt)
 531        ("libtommath" ,libtommath)
 532        ("zlib" ,zlib)))
 533     (synopsis "Small SSH server and client")
 534     (description "Dropbear is a relatively small SSH server and
 535 client.  It runs on a variety of POSIX-based platforms.  Dropbear is
 536 particularly useful for embedded systems, such as wireless routers.")
 537     (home-page "https://matt.ucc.asn.au/dropbear/dropbear.html")
 538     (license (license:x11-style "" "See file LICENSE."))))
 539
 540 (define-public liboop
 541   (package
 542     (name "liboop")
 543     (version "1.0.1")
 544     (source
 545      (origin
 546       (method url-fetch)
 547       (uri (string-append "http://ftp.lysator.liu.se/pub/liboop/"
 548                           name "-" version ".tar.gz"))
 549       (sha256
 550        (base32
 551         "1q0p1l72pq9k3bi7a366j2rishv7dzzkg3i6r2npsfg7cnnidbsn"))))
 552     (build-system gnu-build-system)
 553     (home-page "https://www.lysator.liu.se/liboop/")
 554     (synopsis "Event loop library")
 555     (description "Liboop is a low-level event loop management library for
 556 POSIX-based operating systems.  It supports the development of modular,
 557 multiplexed applications which may respond to events from several sources.  It
 558 replaces the \"select() loop\" and allows the registration of event handlers
 559 for file and network I/O, timers and signals.  Since processes use these
 560 mechanisms for almost all external communication, liboop can be used as the
 561 basis for almost any application.")
 562     (license license:lgpl2.1+)))
 563
 564 (define-public lsh
 565   (package
 566     (name "lsh")
 567     (version "2.1")
 568     (source (origin
 569               (method url-fetch)
 570               (uri (string-append "mirror://gnu/lsh/lsh-"
 571                                   version ".tar.gz"))
 572               (sha256
 573                (base32
 574                 "1qqjy9zfzgny0rkb27c8c7dfsylvb6n0ld8h3an2r83pmaqr9gwb"))
 575               (modules '((guix build utils)))
 576               (snippet
 577                '(begin
 578                   (substitute* "src/testsuite/functions.sh"
 579                     (("localhost")
 580                      ;; Avoid host name lookups since they don't work in
 581                      ;; chroot builds.
 582                      "127.0.0.1")
 583                     (("set -e")
 584                      ;; Make tests more verbose.
 585                      "set -e\nset -x"))
 586
 587                   (substitute* (find-files "src/testsuite" "-test$")
 588                     (("localhost") "127.0.0.1"))
 589
 590                   (substitute* "src/testsuite/login-auth-test"
 591                     (("/bin/cat") "cat"))
 592                   #t))
 593               (patches (search-patches "lsh-fix-x11-forwarding.patch"))))
 594     (build-system gnu-build-system)
 595     (native-inputs
 596      `(("autoconf" ,autoconf)
 597        ("automake" ,automake)
 598        ("m4" ,m4)
 599        ("guile" ,guile-2.0)
 600        ("gperf" ,gperf)
 601        ("psmisc" ,psmisc)))                       ; for `killall'
 602     (inputs
 603      `(("nettle" ,nettle-2)
 604        ("linux-pam" ,linux-pam)
 605
 606        ;; 'rl.c' uses the 'CPPFunction' type, which is no longer in
 607        ;; Readline 6.3.
 608        ("readline" ,readline-6.2)
 609
 610        ("liboop" ,liboop)
 611        ("zlib" ,zlib)
 612        ("gmp" ,gmp)
 613
 614        ;; The server (lshd) invokes xauth when X11 forwarding is requested.
 615        ;; This adds 24 MiB (or 27%) to the closure of lsh.
 616        ("xauth" ,xauth)
 617        ("libxau" ,libxau)))             ;also required for x11-forwarding
 618     (arguments
 619      '(;; Skip the `configure' test that checks whether /dev/ptmx &
 620        ;; co. work as expected, because it relies on impurities (for
 621        ;; instance, /dev/pts may be unavailable in chroots.)
 622        #:configure-flags '("lsh_cv_sys_unix98_ptys=yes"
 623
 624                            ;; Use glibc's argp rather than the bundled one.
 625                            "--with-system-argp"
 626
 627                            ;; 'lsh_argp.h' checks HAVE_ARGP_PARSE but nothing
 628                            ;; defines it.
 629                            "CPPFLAGS=-DHAVE_ARGP_PARSE")
 630        #:phases
 631        (modify-phases %standard-phases
 632          (add-after 'unpack 'disable-failing-tests
 633            (lambda _
 634              ;; FIXME: Most tests won't run in a chroot, presumably because
 635              ;; /etc/profile is missing, and thus clients get an empty $PATH
 636              ;; and nothing works.  Run only the subset that passes.
 637              (delete-file "configure")  ;force rebootstrap
 638              (substitute* "src/testsuite/Makefile.am"
 639                (("seed-test \\\\")        ;prevent trailing slash
 640                 "seed-test")
 641                (("^\t(lsh|daemon|tcpip|socks|lshg|lcp|rapid7|lshd).*test.*")
 642                 ""))
 643              #t))
 644          (add-before 'configure 'pre-configure
 645            (lambda* (#:key inputs #:allow-other-keys)
 646              (let* ((nettle    (assoc-ref inputs "nettle"))
 647                     (sexp-conv (string-append nettle "/bin/sexp-conv")))
 648                ;; Remove argp from the list of sub-directories; we don't want
 649                ;; to build it, really.
 650                (substitute* "src/Makefile.in"
 651                  (("^SUBDIRS = argp")
 652                   "SUBDIRS ="))
 653
 654                ;; Make sure 'lsh' and 'lshd' pick 'sexp-conv' in the right place
 655                ;; by default.
 656                (substitute* "src/environ.h.in"
 657                  (("^#define PATH_SEXP_CONV.*")
 658                   (string-append "#define PATH_SEXP_CONV \""
 659                                  sexp-conv "\"\n")))
 660
 661                ;; Same for the 'lsh-authorize' script.
 662                (substitute* "src/lsh-authorize"
 663                  (("=sexp-conv")
 664                   (string-append "=" sexp-conv)))
 665
 666                ;; Tell lshd where 'xauth' lives.  Another option would be to
 667                ;; hardcode "/run/current-system/profile/bin/xauth", thereby
 668                ;; reducing the closure size, but that wouldn't work on foreign
 669                ;; distros.
 670                (with-fluids ((%default-port-encoding "ISO-8859-1"))
 671                  (substitute* "src/server_x11.c"
 672                    (("define XAUTH_PROGRAM.*")
 673                     (string-append "define XAUTH_PROGRAM \""
 674                                    (assoc-ref inputs "xauth")
 675                                    "/bin/xauth\"\n")))))
 676
 677              ;; Tests rely on $USER being set.
 678              (setenv "USER" "guix"))))))
 679     (home-page "https://www.lysator.liu.se/~nisse/lsh/")
 680     (synopsis "GNU implementation of the Secure Shell (ssh) protocols")
 681     (description
 682      "GNU lsh is a free implementation of the SSH version 2 protocol.  It is
 683 used to create a secure line of communication between two computers,
 684 providing shell access to the server system from the client.  It provides
 685 both the server daemon and the client application, as well as tools for
 686 manipulating key files.")
 687     (license license:gpl2+)))
 688
 689 (define-public sshpass
 690   (package
 691     (name "sshpass")
 692     (version "1.09")
 693     (source
 694      (origin
 695        (method url-fetch)
 696        (uri (string-append "mirror://sourceforge/sshpass/sshpass/"
 697                            version "/sshpass-" version ".tar.gz"))
 698        (sha256
 699         (base32 "1dwzqknpswa8vjlbwsx9rcq1j2a7px9h9i2anh09pzkz0mg6wx3i"))))
 700     (build-system gnu-build-system)
 701     (home-page "https://sourceforge.net/projects/sshpass/")
 702     (synopsis "Non-interactive password authentication with SSH")
 703     (description "sshpass is a tool for non-interactively performing password
 704 authentication with SSH's so-called @dfn{interactive keyboard password
 705 authentication}.")
 706     (license license:gpl2+)))
 707
 708 (define-public autossh
 709   (package
 710     (name "autossh")
 711     (version "1.4g")
 712     (source
 713      (origin
 714        (method url-fetch)
 715        (uri (string-append
 716              "https://www.harding.motd.ca/autossh/autossh-"
 717              version ".tgz"))
 718        (sha256
 719         (base32 "0xqjw8df68f4kzkns5gcah61s5wk0m44qdk2z1d6388w6viwxhsz"))))
 720     (build-system gnu-build-system)
 721     (arguments `(#:tests? #f)) ; There is no "make check" or anything similar
 722     (inputs `(("openssh" ,openssh)))
 723     (synopsis "Automatically restart SSH sessions and tunnels")
 724     (description "autossh is a program to start a copy of @command{ssh} and
 725 monitor it, restarting it as necessary should it die or stop passing traffic.")
 726     (home-page "https://www.harding.motd.ca/autossh/")
 727     (license
 728      ;; Why point to a source file?  Well, all the individual files have a
 729      ;; copy of this license in their headers, but there's no separate file
 730      ;; with that information.
 731      (license:non-copyleft "file://autossh.c"))))
 732
 733 (define-public pdsh
 734   (package
 735     (name "pdsh")
 736     (version "2.34")
 737     (source
 738      (origin
 739        (method url-fetch)
 740        (uri (string-append "https://github.com/chaos/pdsh/"
 741                            "releases/download/pdsh-" version
 742                            "/pdsh-" version ".tar.gz"))
 743        (sha256
 744         (base32 "1s91hmhrz7rfb6h3l5k97s393rcm1ww3svp8dx5z8vkkc933wyxl"))))
 745     (build-system gnu-build-system)
 746     (arguments
 747      `(#:configure-flags
 748        (list "--with-ssh")
 749        #:phases
 750        (modify-phases %standard-phases
 751          (add-after 'unpack 'patch-/bin/sh
 752            (lambda _
 753              (substitute* '("tests/t0006-pdcp.sh"
 754                             "tests/t0004-module-loading.sh"
 755                             "tests/t2001-ssh.sh"
 756                             "tests/t1003-slurm.sh"
 757                             "tests/t6036-long-output-lines.sh"
 758                             "tests/aggregate-results.sh"
 759                             "tests/t2000-exec.sh"
 760                             "tests/t0002-internal.sh"
 761                             "tests/t1002-dshgroup.sh"
 762                             "tests/t5000-dshbak.sh"
 763                             "tests/t0001-basic.sh"
 764                             "tests/t0005-rcmd_type-and-user.sh"
 765                             "tests/test-lib.sh"
 766                             "tests/t2002-mrsh.sh"
 767                             "tests/t0003-wcoll.sh"
 768                             "tests/test-modules/pcptest.c")
 769                (("/bin/sh") (which "bash")))
 770              #t))
 771          (add-after 'unpack 'patch-tests
 772            (lambda _
 773              (substitute* "tests/t6036-long-output-lines.sh"
 774                (("which") (which "which")))
 775              #t)))))
 776     (inputs
 777      `(("openssh" ,openssh)
 778        ("mit-krb5" ,mit-krb5)
 779        ("perl" ,perl)))
 780     (native-inputs
 781      `(("which" ,which)))
 782     (home-page "https://github.com/chaos/pdsh")
 783     (synopsis "Parallel distributed shell")
 784     (description "Pdsh is a an efficient, multithreaded remote shell client
 785 which executes commands on multiple remote hosts in parallel.  Pdsh implements
 786 dynamically loadable modules for extended functionality such as new remote
 787 shell services and remote host selection.")
 788     (license license:gpl2+)))
 789
 790 (define-public python-asyncssh
 791   (package
 792     (name "python-asyncssh")
 793     (version "2.5.0")
 794     (source
 795      (origin
 796        (method url-fetch)
 797        (uri (pypi-uri "asyncssh" version))
 798        (sha256
 799         (base32
 800          "02xpzir9rmw7b7k07m3f912h6jvy9yzan9yn3ckrmqx2ffpy4r8b"))))
 801     (build-system python-build-system)
 802     (propagated-inputs
 803      `(("python-cryptography" ,python-cryptography)
 804        ("python-pyopenssl" ,python-pyopenssl)
 805        ("python-gssapi" ,python-gssapi)
 806        ("python-bcrypt" ,python-bcrypt)))
 807     (native-inputs
 808      `(("openssh" ,openssh)
 809        ("openssl" ,openssl)))
 810     (arguments
 811      `(#:phases
 812        (modify-phases %standard-phases
 813          (add-after 'unpack 'disable-tests
 814            (lambda* _
 815              (substitute* "tests/test_agent.py"
 816                ;; TODO Test fails for unknown reason
 817                (("(.+)async def test_confirm" all indent)
 818                 (string-append indent "@unittest.skip('disabled by guix')\n"
 819                                indent "async def test_confirm")))
 820              #t)))))
 821     (home-page "https://asyncssh.readthedocs.io/")
 822     (synopsis "Asynchronous SSHv2 client and server library for Python")
 823     (description
 824      "AsyncSSH is a Python package which provides an asynchronous client and
 825 server implementation of the SSHv2 protocol on top of the Python 3.6+ asyncio
 826 framework.")
 827     (license license:epl2.0)))
 828
 829 (define-public clustershell
 830   (package
 831     (name "clustershell")
 832     (version "1.8.3")
 833     (source
 834      (origin
 835        (method url-fetch)
 836        (uri (string-append "https://github.com/cea-hpc/clustershell/releases"
 837                            "/download/v" version
 838                            "/ClusterShell-" version ".tar.gz"))
 839        (sha256
 840         (base32 "1qdcgh733szwj9r1gambrgfkizvbjci0bnnkds9a8mnyb3sasnan"))))
 841     (build-system python-build-system)
 842     (inputs `(("openssh" ,openssh)))
 843     (propagated-inputs `(("python-pyyaml" ,python-pyyaml)))
 844     (arguments
 845      `(#:phases (modify-phases %standard-phases
 846                   (add-before 'build 'record-openssh-file-name
 847                     (lambda* (#:key inputs #:allow-other-keys)
 848                       (let ((ssh (assoc-ref inputs "openssh")))
 849                         (substitute* "lib/ClusterShell/Worker/Ssh.py"
 850                           (("info\\(\"ssh_path\"\\) or \"ssh\"")
 851                            (string-append "info(\"ssh_path\") or \""
 852                                           ssh "/bin/ssh\"")))
 853                         #t))))))
 854     (home-page "https://cea-hpc.github.io/clustershell/")
 855     (synopsis "Scalable event-driven Python framework for cluster administration")
 856     (description
 857      "ClusterShell is an event-driven Python framework, designed to run local
 858 or distant commands in parallel on server farms or on large GNU/Linux
 859 clusters.  It will take care of common issues encountered on HPC clusters,
 860 such as operating on groups of nodes, running distributed commands using
 861 optimized execution algorithms, as well as gathering results and merging
 862 identical outputs, or retrieving return codes.  ClusterShell takes advantage
 863 of existing remote shell facilities such as SSH.")
 864     (license license:lgpl2.1+)))
 865
 866 (define-public endlessh
 867   (package
 868     (name "endlessh")
 869     (version "1.1")
 870     (source
 871       (origin
 872         (method git-fetch)
 873         (uri (git-reference
 874               (url "https://github.com/skeeto/endlessh")
 875               (commit version)))
 876         (file-name (git-file-name name version))
 877         (sha256
 878          (base32 "0ziwr8j1frsp3dajr8h5glkm1dn5cci404kazz5w1jfrp0736x68"))))
 879     (build-system gnu-build-system)
 880     (arguments
 881      '(#:make-flags (list (string-append "PREFIX=" (assoc-ref %outputs "out"))
 882                           "CC=gcc")
 883        #:tests? #f                      ; no test target
 884        #:phases
 885        (modify-phases %standard-phases
 886          (delete 'configure))))         ; no configure script
 887     (home-page "https://github.com/skeeto/endlessh")
 888     (synopsis "SSH tarpit that slowly sends an endless banner")
 889     (description
 890      "Endlessh is an SSH tarpit that very slowly sends an endless, random SSH
 891 banner.  It keeps SSH clients locked up for hours or even days at a time.  The
 892 purpose is to put your real SSH server on another port and then let the script
 893 kiddies get stuck in this tarpit instead of bothering a real server.
 894
 895 Since the tarpit is in the banner before any cryptographic exchange occurs, this
 896 program doesn't depend on any cryptographic libraries.  It's a simple,
 897 single-threaded, standalone C program.  It uses @code{poll()} to trap multiple
 898 clients at a time.")
 899     (license license:unlicense)))
 900
 901 (define-public webssh
 902   (package
 903     (name "webssh")
 904     (version "1.5.3")
 905     (source (origin
 906               (method git-fetch)
 907               (uri (git-reference
 908                     (url "https://github.com/huashengdun/webssh")
 909                     (commit (string-append "v" version))))
 910               (file-name (git-file-name name version))
 911               (sha256
 912                (base32
 913                 "1bcy9flrzbvams5p77swwiygv54ac58ia7hpic1bvg30b3wpvv7b"))))
 914     (build-system python-build-system)
 915     (propagated-inputs
 916      `(("python-paramiko" ,python-paramiko)
 917        ("python-tornado" ,python-tornado)))
 918     (home-page "https://webssh.huashengdun.org/")
 919     (synopsis "Web application to be used as an SSH client")
 920     (description "This package provides a web application to be used as an SSH
 921 client.
 922
 923 Features:
 924 @itemize @bullet
 925 @item SSH password authentication supported, including empty password.
 926 @item SSH public-key authentication supported, including DSA RSA ECDSA
 927 Ed25519 keys.
 928 @item Encrypted keys supported.
 929 @item Two-Factor Authentication (time-based one-time password) supported.
 930 @item Fullscreen terminal supported.
 931 @item Terminal window resizable.
 932 @item Auto detect the ssh server's default encoding.
 933 @item Modern browsers are supported.
 934 @end itemize")
 935     (license license:expat)))