gnu/packages/ssh.scm

   1 ;;; GNU Guix --- Functional package management for GNU
   2 ;;; Copyright © 2012, 2013, 2014, 2015, 2016, 2017, 2018, 2019, 2020 Ludovic Courtès <ludo@gnu.org>
   3 ;;; Copyright © 2013, 2014 Andreas Enge <andreas@enge.fr>
   4 ;;; Copyright © 2014, 2015, 2016 Mark H Weaver <mhw@netris.org>
   5 ;;; Copyright © 2015, 2016, 2018, 2019, 2020 Efraim Flashner <efraim@flashner.co.il>
   6 ;;; Copyright © 2016, 2019 Leo Famulari <leo@famulari.name>
   7 ;;; Copyright © 2016 Nicolas Goaziou <mail@nicolasgoaziou.fr>
   8 ;;; Copyright © 2016 Christopher Allan Webber <cwebber@dustycloud.org>
   9 ;;; Copyright © 2017, 2018, 2019, 2020 Tobias Geerinckx-Rice <me@tobias.gr>
  10 ;;; Copyright © 2017 Stefan Reichör <stefan@xsteve.at>
  11 ;;; Copyright © 2017 Ricardo Wurmus <rekado@elephly.net>
  12 ;;; Copyright © 2017 Nikita <nikita@n0.is>
  13 ;;; Copyright © 2018 Manuel Graf <graf@init.at>
  14 ;;; Copyright © 2019 Gábor Boskovits <boskovits@gmail.com>
  15 ;;; Copyright © 2019, 2020 Mathieu Othacehe <m.othacehe@gmail.com>
  16 ;;; Copyright © 2020 Jan (janneke) Nieuwenhuizen <janneke@gnu.org>
  17 ;;; Copyright © 2020 Oleg Pykhalov <go.wigust@gmail.com>
  18 ;;; Copyright © 2020 Maxim Cournoyer <maxim.cournoyer@gmail.com>
  19 ;;;
  20 ;;; This file is part of GNU Guix.
  21 ;;;
  22 ;;; GNU Guix is free software; you can redistribute it and/or modify it
  23 ;;; under the terms of the GNU General Public License as published by
  24 ;;; the Free Software Foundation; either version 3 of the License, or (at
  25 ;;; your option) any later version.
  26 ;;;
  27 ;;; GNU Guix is distributed in the hope that it will be useful, but
  28 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
  29 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  30 ;;; GNU General Public License for more details.
  31 ;;;
  32 ;;; You should have received a copy of the GNU General Public License
  33 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
  34
  35 (define-module (gnu packages ssh)
  36   #:use-module (gnu packages)
  37   #:use-module (gnu packages autotools)
  38   #:use-module (gnu packages base)
  39   #:use-module (gnu packages boost)
  40   #:use-module (gnu packages compression)
  41   #:use-module (gnu packages crypto)
  42   #:use-module (gnu packages elf)
  43   #:use-module (gnu packages gnupg)
  44   #:use-module (gnu packages gperf)
  45   #:use-module (gnu packages groff)
  46   #:use-module (gnu packages guile)
  47   #:use-module (gnu packages libedit)
  48   #:use-module (gnu packages linux)
  49   #:use-module (gnu packages logging)
  50   #:use-module (gnu packages m4)
  51   #:use-module (gnu packages multiprecision)
  52   #:use-module (gnu packages ncurses)
  53   #:use-module (gnu packages nettle)
  54   #:use-module (gnu packages kerberos)
  55   #:use-module (gnu packages perl)
  56   #:use-module (gnu packages pkg-config)
  57   #:use-module (gnu packages popt)
  58   #:use-module (gnu packages protobuf)
  59   #:use-module (gnu packages python)
  60   #:use-module (gnu packages python-crypto)
  61   #:use-module (gnu packages python-web)
  62   #:use-module (gnu packages python-xyz)
  63   #:use-module (gnu packages readline)
  64   #:use-module (gnu packages texinfo)
  65   #:use-module (gnu packages tls)
  66   #:use-module (gnu packages xorg)
  67   #:use-module (guix build-system cmake)
  68   #:use-module (guix build-system gnu)
  69   #:use-module (guix build-system python)
  70   #:use-module (guix download)
  71   #:use-module (guix git-download)
  72   #:use-module ((guix licenses) #:prefix license:)
  73   #:use-module (guix packages)
  74   #:use-module (guix utils)
  75   #:use-module (srfi srfi-1))
  76
  77 (define-public hss
  78   (package
  79     (name "hss")
  80     (version "1.8")
  81     (source (origin
  82               (method git-fetch)
  83               (uri (git-reference
  84                     (url "https://github.com/six-ddc/hss")
  85                     (commit (string-append "v" version))))
  86               (file-name (git-file-name name version))
  87               (sha256
  88                (base32
  89                 "1rpysj65j9ls30bf2c5k5hykzzjfknrihs58imp178bx1wqzw4jl"))))
  90     (inputs
  91      `(("readline" ,readline)))
  92     (arguments
  93      `(#:make-flags
  94        (list ,(string-append "CC=" (cc-for-target))
  95              (string-append "INSTALL_BIN=" (assoc-ref %outputs "out") "/bin"))
  96        #:tests? #f                      ; no tests
  97        #:phases
  98        (modify-phases %standard-phases
  99          (add-after 'unpack 'patch-file-names
 100            (lambda* (#:key inputs outputs #:allow-other-keys)
 101              (substitute* "Makefile"
 102                (("/usr/local/opt/readline")
 103                 (assoc-ref inputs "readline")))
 104              #t))
 105          (delete 'configure))))         ; no configure script
 106     (build-system gnu-build-system)
 107     (home-page "https://github.com/six-ddc/hss/")
 108     (synopsis "Interactive SSH client for multiple servers")
 109     (description
 110      "@command{hss} is an interactive SSH client for multiple servers.  Commands
 111 are executed on all servers in parallel.  Execution on one server does not need
 112 to wait for that on another server to finish before starting.  One can run a
 113 command on hundreds of servers at the same time, with almost the same experience
 114 as a local Bash shell.
 115
 116 It supports:
 117 @itemize @bullet
 118 @item interactive input: based on GNU readline.
 119 @item history: responding to the @kbd{C-r} key.
 120 @item auto-completion: @key{TAB}-completion from remote servers for commands and
 121 file names.
 122 @end itemize\n")
 123     (license license:expat)))
 124
 125 (define-public libssh
 126   (package
 127     (name "libssh")
 128     (version "0.9.5")
 129     (source (origin
 130               (method git-fetch)
 131               (uri (git-reference
 132                      (url "https://git.libssh.org/projects/libssh.git")
 133                      (commit (string-append "libssh-" version))))
 134               (sha256
 135                (base32
 136                 "1b2klflmn0mdkcyjl4dqfg116bf9nhmqm4qla5cqa9xis89a5bn6"))
 137               (file-name (git-file-name name version))))
 138     (build-system cmake-build-system)
 139     (outputs '("out" "debug"))
 140     (arguments
 141      '(#:configure-flags '("-DWITH_GCRYPT=ON")
 142
 143        ;; TODO: Add 'CMockery' and '-DWITH_TESTING=ON' for the test suite.
 144        #:tests? #f))
 145     (inputs `(("zlib" ,zlib)
 146               ("libgcrypt" ,libgcrypt)
 147               ("mit-krb5" ,mit-krb5)))
 148     (synopsis "SSH client library")
 149     (description
 150      "libssh is a C library implementing the SSHv2 and SSHv1 protocol for client
 151 and server implementations.  With libssh, you can remotely execute programs,
 152 transfer files, and use a secure and transparent tunnel for your remote
 153 applications.")
 154     (home-page "https://www.libssh.org")
 155     (license license:lgpl2.1+)))
 156
 157 (define-public libssh2
 158   (package
 159    (name "libssh2")
 160    (version "1.9.0")
 161    (source (origin
 162             (method url-fetch)
 163             (uri (string-append
 164                    "https://www.libssh2.org/download/libssh2-"
 165                    version ".tar.gz"))
 166             (sha256
 167              (base32
 168               "1zfsz9nldakfz61d2j70pk29zlmj7w2vv46s9l3x2prhcgaqpyym"))
 169             (patches (search-patches "libssh2-CVE-2019-17498.patch"))))
 170    (build-system gnu-build-system)
 171    ;; The installed libssh2.pc file does not include paths to libgcrypt and
 172    ;; zlib libraries, so we need to propagate the inputs.
 173    (propagated-inputs `(("libgcrypt" ,libgcrypt)
 174                         ("zlib" ,zlib)))
 175    (arguments `(#:configure-flags `("--with-libgcrypt")))
 176    (synopsis "Client-side C library implementing the SSH2 protocol")
 177    (description
 178     "libssh2 is a library intended to allow software developers access to
 179 the SSH-2 protocol in an easy-to-use self-contained package.  It can be built
 180 into an application to perform many different tasks when communicating with
 181 a server that supports the SSH-2 protocol.")
 182    (license license:bsd-3)
 183    (home-page "https://www.libssh2.org/")))
 184
 185 (define-public openssh
 186   (package
 187    (name "openssh")
 188    (version "8.4p1")
 189    (source (origin
 190              (method url-fetch)
 191              (uri (string-append "mirror://openbsd/OpenSSH/portable/"
 192                                  "openssh-" version ".tar.gz"))
 193              (patches (search-patches "openssh-hurd.patch"
 194                                       "openssh-fix-ssh-copy-id.patch"))
 195              (sha256
 196               (base32
 197                "091b3pxdlj47scxx6kkf4agkx8c8sdacdxx8m1dw1cby80pd40as"))))
 198    (build-system gnu-build-system)
 199    (native-inputs `(("groff" ,groff)
 200                     ("pkg-config" ,pkg-config)))
 201    (inputs `(("libedit" ,libedit)
 202              ("openssl" ,openssl)
 203              ("pam" ,linux-pam)
 204              ("mit-krb5" ,mit-krb5)
 205              ("zlib" ,zlib)
 206              ("xauth" ,xauth)))        ; for 'ssh -X' and 'ssh -Y'
 207    (arguments
 208     `(#:test-target "tests"
 209       ;; Otherwise, the test scripts try to use a nonexistent directory and
 210       ;; fail.
 211       #:make-flags '("REGRESSTMP=\"$${BUILDDIR}/regress\"")
 212       #:configure-flags  `("--sysconfdir=/etc/ssh"
 213
 214                            ;; Default value of 'PATH' used by sshd.
 215                           "--with-default-path=/run/current-system/profile/bin"
 216
 217                           ;; configure needs to find krb5-config.
 218                           ,(string-append "--with-kerberos5="
 219                                           (assoc-ref %build-inputs "mit-krb5")
 220                                           "/bin")
 221
 222                           ;; libedit is needed for sftp completion.
 223                           "--with-libedit"
 224
 225                           ;; Enable PAM support in sshd.
 226                           "--with-pam"
 227
 228                           ;; "make install" runs "install -s" by default,
 229                           ;; which doesn't work for cross-compiled binaries
 230                           ;; because it invokes 'strip' instead of
 231                           ;; 'TRIPLET-strip'.  Work around this.
 232                           ,,@(if (%current-target-system)
 233                                  '("--disable-strip")
 234                                  '()))
 235
 236       #:phases
 237       (modify-phases %standard-phases
 238         (add-after 'configure 'reset-/var/empty
 239          (lambda* (#:key outputs #:allow-other-keys)
 240            (let ((out (assoc-ref outputs "out")))
 241              (substitute* "Makefile"
 242                (("PRIVSEP_PATH=/var/empty")
 243                 (string-append "PRIVSEP_PATH=" out "/var/empty")))
 244              #t)))
 245         (add-before 'check 'patch-tests
 246          (lambda _
 247            (substitute* "regress/test-exec.sh"
 248              (("/bin/sh") (which "sh")))
 249
 250            ;; Remove 't-exec' regress target which requires user 'sshd'.
 251            (substitute* (list "Makefile"
 252                               "regress/Makefile")
 253              (("^(tests:.*) t-exec(.*)" all pre post)
 254               (string-append pre post)))
 255            #t))
 256         (replace 'install
 257          (lambda* (#:key outputs (make-flags '()) #:allow-other-keys)
 258            ;; Install without host keys and system configuration files.
 259            (apply invoke "make" "install-nosysconf" make-flags)
 260            (install-file "contrib/ssh-copy-id"
 261                          (string-append (assoc-ref outputs "out")
 262                                         "/bin/"))
 263            (chmod (string-append (assoc-ref outputs "out")
 264                                  "/bin/ssh-copy-id") #o555)
 265            (install-file "contrib/ssh-copy-id.1"
 266                          (string-append (assoc-ref outputs "out")
 267                                         "/share/man/man1/"))
 268            #t)))))
 269    (synopsis "Client and server for the secure shell (ssh) protocol")
 270    (description
 271     "The SSH2 protocol implemented in OpenSSH is standardised by the
 272 IETF secsh working group and is specified in several RFCs and drafts.
 273 It is composed of three layered components:
 274
 275 The transport layer provides algorithm negotiation and a key exchange.
 276 The key exchange includes server authentication and results in a
 277 cryptographically secured connection: it provides integrity, confidentiality
 278 and optional compression.
 279
 280 The user authentication layer uses the established connection and relies on
 281 the services provided by the transport layer.  It provides several mechanisms
 282 for user authentication.  These include traditional password authentication
 283 as well as public-key or host-based authentication mechanisms.
 284
 285 The connection layer multiplexes many different concurrent channels over the
 286 authenticated connection and allows tunneling of login sessions and
 287 TCP-forwarding.  It provides a flow control service for these channels.
 288 Additionally, various channel-specific options can be negotiated.")
 289    (license (license:non-copyleft "file://LICENSE"
 290                                "See LICENSE in the distribution."))
 291    (home-page "https://www.openssh.com/")))
 292
 293 ;; OpenSSH without X support. This allows to use OpenSSH without dragging X
 294 ;; libraries to the closure.
 295 (define-public openssh-sans-x
 296   (package
 297     (inherit openssh)
 298     (name "openssh-sans-x")
 299     (inputs (alist-delete "xauth" (package-inputs openssh)))
 300     (synopsis "OpenSSH client and server without X11 support")))
 301
 302 (define-public guile-ssh
 303   (package
 304     (name "guile-ssh")
 305     (version "0.13.1")
 306     (home-page "https://github.com/artyom-poptsov/guile-ssh")
 307     (source (origin
 308               (method git-fetch)
 309               (uri (git-reference
 310                     (url home-page)
 311                     (commit (string-append "v" version))))
 312               (file-name (string-append name "-" version ".tar.gz"))
 313               (sha256
 314                (base32
 315                 "1xpxkvgj7wgcl450djkcrmrf957mcy2f36hfs5g6kpla1gax2d1g"))
 316               (modules '((guix build utils)))))
 317     (build-system gnu-build-system)
 318     (outputs '("out" "debug"))
 319     (arguments
 320      `(;; It makes no sense to build libguile-ssh.a.
 321        #:configure-flags '("--disable-static")
 322
 323        #:phases (modify-phases %standard-phases
 324                   (add-before 'build 'fix-libguile-ssh-file-name
 325                     (lambda* (#:key outputs #:allow-other-keys)
 326                       ;; Build and install libguile-ssh.so so that we can use
 327                       ;; its absolute file name in .scm files, before we build
 328                       ;; the .go files.
 329                       (let* ((out (assoc-ref outputs "out"))
 330                              (lib (string-append out "/lib")))
 331                         (invoke "make" "install"
 332                                 "-C" "libguile-ssh"
 333                                 "-j" (number->string
 334                                       (parallel-job-count)))
 335                         (substitute* (find-files "." "\\.scm$")
 336                           (("\"libguile-ssh\"")
 337                            (string-append "\"" lib "/libguile-ssh\"")))
 338                         #t)))
 339                   ,@(if (%current-target-system)
 340                         '()
 341                         '((add-before 'check 'fix-guile-path
 342                              (lambda* (#:key inputs #:allow-other-keys)
 343                                (let ((guile (assoc-ref inputs "guile")))
 344                                  (substitute* "tests/common.scm"
 345                                    (("/usr/bin/guile")
 346                                     (string-append guile "/bin/guile")))
 347                                  #t)))))
 348                   (add-after 'install 'remove-bin-directory
 349                     (lambda* (#:key outputs #:allow-other-keys)
 350                       (let* ((out (assoc-ref outputs "out"))
 351                              (bin (string-append out "/bin"))
 352                              (examples (string-append
 353                                         out "/share/guile-ssh/examples")))
 354                         (mkdir-p examples)
 355                         (rename-file (string-append bin "/ssshd.scm")
 356                                      (string-append examples "/ssshd.scm"))
 357                         (rename-file (string-append bin "/sssh.scm")
 358                                      (string-append examples "/sssh.scm"))
 359                         (delete-file-recursively bin)
 360                         #t))))))
 361     (native-inputs `(("autoconf" ,autoconf)
 362                      ("automake" ,automake)
 363                      ("libtool" ,libtool)
 364                      ("texinfo" ,texinfo)
 365                      ("pkg-config" ,pkg-config)
 366                      ("which" ,which)
 367                      ("guile" ,guile-3.0))) ;needed when cross-compiling.
 368     (inputs `(("guile" ,guile-3.0)
 369               ("libssh" ,libssh)
 370               ("libgcrypt" ,libgcrypt)))
 371     (synopsis "Guile bindings to libssh")
 372     (description
 373      "Guile-SSH is a library that provides access to the SSH protocol for
 374 programs written in GNU Guile interpreter.  It is a wrapper to the underlying
 375 libssh library.")
 376     (license license:gpl3+)))
 377
 378 (define-public guile2.0-ssh
 379   (package
 380     (inherit guile-ssh)
 381     (name "guile2.0-ssh")
 382     (native-inputs
 383      `(("guile" ,guile-2.0) ;needed when cross-compiling.
 384        ,@(alist-delete "guile" (package-native-inputs guile-ssh))))
 385     (inputs `(("guile" ,guile-2.0)
 386               ,@(alist-delete "guile" (package-inputs guile-ssh))))))
 387
 388 (define-public guile2.2-ssh
 389   (package
 390     (inherit guile-ssh)
 391     (name "guile2.2-ssh")
 392     (native-inputs
 393      `(("guile" ,guile-2.2) ;needed when cross-compiling.
 394        ,@(alist-delete "guile" (package-native-inputs guile-ssh))))
 395     (inputs `(("guile" ,guile-2.2)
 396               ,@(alist-delete "guile" (package-inputs guile-ssh))))))
 397
 398 (define-public guile3.0-ssh
 399   (deprecated-package "guile3.0-ssh" guile-ssh))
 400
 401 (define-public corkscrew
 402   (package
 403     (name "corkscrew")
 404     (version "2.0")
 405     (source
 406      (origin
 407        (method git-fetch)
 408        (uri (git-reference
 409              (url "https://github.com/patpadgett/corkscrew")
 410              (commit (string-append "v" version))))
 411        (sha256
 412         (base32 "0g4pkczrc1zqpnxyyjwcjmyzdj5qqcpzwf1bm3965zdwp94bpppf"))
 413        (file-name (git-file-name name version))))
 414     (build-system gnu-build-system)
 415     (arguments
 416      `(#:phases
 417        (modify-phases %standard-phases
 418          (replace 'configure
 419            ;; Replace configure phase as the ./configure script does not like
 420            ;; CONFIG_SHELL and SHELL passed as parameters.
 421            (lambda* (#:key outputs build target #:allow-other-keys)
 422              (let* ((out   (assoc-ref outputs "out"))
 423                     (bash  (which "bash"))
 424                     ;; Set --build and --host flags as the provided config.guess
 425                     ;; is not able to detect them.
 426                     (flags `(,(string-append "--prefix=" out)
 427                              ,(string-append "--build=" build)
 428                              ,(string-append "--host=" (or target build)))))
 429                (setenv "CONFIG_SHELL" bash)
 430                (apply invoke bash "./configure" flags))))
 431          (add-after 'install 'install-documentation
 432            (lambda* (#:key outputs #:allow-other-keys)
 433              (let* ((out (assoc-ref outputs "out"))
 434                     (doc (string-append out "/share/doc/" ,name "-" ,version)))
 435                (install-file "README.markdown" doc)
 436                #t))))))
 437     (home-page "https://github.com/patpadgett/corkscrew")
 438     (synopsis "SSH tunneling through HTTP(S) proxies")
 439     (description
 440      "Corkscrew tunnels SSH connections through most HTTP and HTTPS proxies.
 441 Proxy authentication is only supported through the plain-text HTTP basic
 442 authentication scheme.")
 443     (license license:gpl2+)))
 444
 445 (define-public mosh
 446   (package
 447     (name "mosh")
 448     (version "1.3.2")
 449     (source (origin
 450               (method url-fetch)
 451               (uri (string-append "https://mosh.org/mosh-" version ".tar.gz"))
 452               (sha256
 453                (base32
 454                 "05hjhlp6lk8yjcy59zywpf0r6s0h0b9zxq0lw66dh9x8vxrhaq6s"))))
 455     (build-system gnu-build-system)
 456     (arguments
 457      '(#:phases
 458        (modify-phases %standard-phases
 459          (add-after 'unpack 'patch-FHS-file-names
 460            (lambda _
 461              (substitute* "scripts/mosh.pl"
 462                (("/bin/sh")
 463                 (which "sh")))
 464              #t))
 465          (add-after 'install 'wrap
 466            (lambda* (#:key outputs #:allow-other-keys)
 467              ;; Make sure 'mosh' can find 'mosh-client' and
 468              ;; 'mosh-server'.
 469              (let* ((out (assoc-ref outputs "out"))
 470                     (bin (string-append out "/bin")))
 471                (wrap-program (string-append bin "/mosh")
 472                              `("PATH" ":" prefix (,bin)))))))))
 473     (native-inputs
 474      `(("pkg-config" ,pkg-config)))
 475     (inputs
 476      `(("openssl" ,openssl)
 477        ("perl" ,perl)
 478        ("perl-io-tty" ,perl-io-tty)
 479        ("zlib" ,zlib)
 480        ("ncurses" ,ncurses)
 481        ("protobuf" ,protobuf)
 482        ("boost-headers" ,boost)))
 483     (home-page "https://mosh.org/")
 484     (synopsis "Remote shell tolerant to intermittent connectivity")
 485     (description
 486      "Mosh is a remote terminal application that allows client roaming, supports
 487 intermittent connectivity, and provides intelligent local echo and line editing
 488 of user keystrokes.  It's a replacement for SSH that's more robust and
 489 responsive, especially over Wi-Fi, cellular, and long-distance links.")
 490     (license license:gpl3+)))
 491
 492 (define-public dropbear
 493   (package
 494     (name "dropbear")
 495     (version "2020.81")
 496     (source
 497      (origin
 498        (method url-fetch)
 499        (uri (string-append
 500              "https://matt.ucc.asn.au/dropbear/releases/"
 501              "dropbear-" version ".tar.bz2"))
 502        (sha256
 503         (base32 "0fy5ma4cfc2pk25mcccc67b2mf1rnb2c06ilb7ddnxbpnc85s8s8"))))
 504     (build-system gnu-build-system)
 505     (arguments `(#:tests? #f))  ; there is no "make check" or anything similar
 506     ;; TODO: Investigate unbundling libtommath and libtomcrypt or at least
 507     ;; cherry-picking important bug fixes from them. See <bugs.gnu.org/24674>
 508     ;; for more information.
 509     (inputs `(("zlib" ,zlib)))
 510     (synopsis "Small SSH server and client")
 511     (description "Dropbear is a relatively small SSH server and
 512 client.  It runs on a variety of POSIX-based platforms.  Dropbear is
 513 particularly useful for embedded systems, such as wireless routers.")
 514     (home-page "https://matt.ucc.asn.au/dropbear/dropbear.html")
 515     (license (license:x11-style "" "See file LICENSE."))))
 516
 517 (define-public liboop
 518   (package
 519     (name "liboop")
 520     (version "1.0.1")
 521     (source
 522      (origin
 523       (method url-fetch)
 524       (uri (string-append "http://ftp.lysator.liu.se/pub/liboop/"
 525                           name "-" version ".tar.gz"))
 526       (sha256
 527        (base32
 528         "1q0p1l72pq9k3bi7a366j2rishv7dzzkg3i6r2npsfg7cnnidbsn"))))
 529     (build-system gnu-build-system)
 530     (home-page "https://www.lysator.liu.se/liboop/")
 531     (synopsis "Event loop library")
 532     (description "Liboop is a low-level event loop management library for
 533 POSIX-based operating systems.  It supports the development of modular,
 534 multiplexed applications which may respond to events from several sources.  It
 535 replaces the \"select() loop\" and allows the registration of event handlers
 536 for file and network I/O, timers and signals.  Since processes use these
 537 mechanisms for almost all external communication, liboop can be used as the
 538 basis for almost any application.")
 539     (license license:lgpl2.1+)))
 540
 541 (define-public lsh
 542   (package
 543     (name "lsh")
 544     (version "2.1")
 545     (source (origin
 546               (method url-fetch)
 547               (uri (string-append "mirror://gnu/lsh/lsh-"
 548                                   version ".tar.gz"))
 549               (sha256
 550                (base32
 551                 "1qqjy9zfzgny0rkb27c8c7dfsylvb6n0ld8h3an2r83pmaqr9gwb"))
 552               (modules '((guix build utils)))
 553               (snippet
 554                '(begin
 555                   (substitute* "src/testsuite/functions.sh"
 556                     (("localhost")
 557                      ;; Avoid host name lookups since they don't work in
 558                      ;; chroot builds.
 559                      "127.0.0.1")
 560                     (("set -e")
 561                      ;; Make tests more verbose.
 562                      "set -e\nset -x"))
 563
 564                   (substitute* (find-files "src/testsuite" "-test$")
 565                     (("localhost") "127.0.0.1"))
 566
 567                   (substitute* "src/testsuite/login-auth-test"
 568                     (("/bin/cat") "cat"))
 569                   #t))
 570               (patches (search-patches "lsh-fix-x11-forwarding.patch"))))
 571     (build-system gnu-build-system)
 572     (native-inputs
 573      `(("autoconf" ,autoconf)
 574        ("automake" ,automake)
 575        ("m4" ,m4)
 576        ("guile" ,guile-2.0)
 577        ("gperf" ,gperf)
 578        ("psmisc" ,psmisc)))                       ; for `killall'
 579     (inputs
 580      `(("nettle" ,nettle-2)
 581        ("linux-pam" ,linux-pam)
 582
 583        ;; 'rl.c' uses the 'CPPFunction' type, which is no longer in
 584        ;; Readline 6.3.
 585        ("readline" ,readline-6.2)
 586
 587        ("liboop" ,liboop)
 588        ("zlib" ,zlib)
 589        ("gmp" ,gmp)
 590
 591        ;; The server (lshd) invokes xauth when X11 forwarding is requested.
 592        ;; This adds 24 MiB (or 27%) to the closure of lsh.
 593        ("xauth" ,xauth)
 594        ("libxau" ,libxau)))             ;also required for x11-forwarding
 595     (arguments
 596      '(;; Skip the `configure' test that checks whether /dev/ptmx &
 597        ;; co. work as expected, because it relies on impurities (for
 598        ;; instance, /dev/pts may be unavailable in chroots.)
 599        #:configure-flags '("lsh_cv_sys_unix98_ptys=yes"
 600
 601                            ;; Use glibc's argp rather than the bundled one.
 602                            "--with-system-argp"
 603
 604                            ;; 'lsh_argp.h' checks HAVE_ARGP_PARSE but nothing
 605                            ;; defines it.
 606                            "CPPFLAGS=-DHAVE_ARGP_PARSE")
 607        #:phases
 608        (modify-phases %standard-phases
 609          (add-after 'unpack 'disable-failing-tests
 610            (lambda _
 611              ;; FIXME: Most tests won't run in a chroot, presumably because
 612              ;; /etc/profile is missing, and thus clients get an empty $PATH
 613              ;; and nothing works.  Run only the subset that passes.
 614              (delete-file "configure")  ;force rebootstrap
 615              (substitute* "src/testsuite/Makefile.am"
 616                (("seed-test \\\\")        ;prevent trailing slash
 617                 "seed-test")
 618                (("^\t(lsh|daemon|tcpip|socks|lshg|lcp|rapid7|lshd).*test.*")
 619                 ""))
 620              #t))
 621          (add-before 'configure 'pre-configure
 622            (lambda* (#:key inputs #:allow-other-keys)
 623              (let* ((nettle    (assoc-ref inputs "nettle"))
 624                     (sexp-conv (string-append nettle "/bin/sexp-conv")))
 625                ;; Remove argp from the list of sub-directories; we don't want
 626                ;; to build it, really.
 627                (substitute* "src/Makefile.in"
 628                  (("^SUBDIRS = argp")
 629                   "SUBDIRS ="))
 630
 631                ;; Make sure 'lsh' and 'lshd' pick 'sexp-conv' in the right place
 632                ;; by default.
 633                (substitute* "src/environ.h.in"
 634                  (("^#define PATH_SEXP_CONV.*")
 635                   (string-append "#define PATH_SEXP_CONV \""
 636                                  sexp-conv "\"\n")))
 637
 638                ;; Same for the 'lsh-authorize' script.
 639                (substitute* "src/lsh-authorize"
 640                  (("=sexp-conv")
 641                   (string-append "=" sexp-conv)))
 642
 643                ;; Tell lshd where 'xauth' lives.  Another option would be to
 644                ;; hardcode "/run/current-system/profile/bin/xauth", thereby
 645                ;; reducing the closure size, but that wouldn't work on foreign
 646                ;; distros.
 647                (with-fluids ((%default-port-encoding "ISO-8859-1"))
 648                  (substitute* "src/server_x11.c"
 649                    (("define XAUTH_PROGRAM.*")
 650                     (string-append "define XAUTH_PROGRAM \""
 651                                    (assoc-ref inputs "xauth")
 652                                    "/bin/xauth\"\n")))))
 653
 654              ;; Tests rely on $USER being set.
 655              (setenv "USER" "guix"))))))
 656     (home-page "https://www.lysator.liu.se/~nisse/lsh/")
 657     (synopsis "GNU implementation of the Secure Shell (ssh) protocols")
 658     (description
 659      "GNU lsh is a free implementation of the SSH version 2 protocol.  It is
 660 used to create a secure line of communication between two computers,
 661 providing shell access to the server system from the client.  It provides
 662 both the server daemon and the client application, as well as tools for
 663 manipulating key files.")
 664     (license license:gpl2+)))
 665
 666 (define-public sshpass
 667   (package
 668     (name "sshpass")
 669     (version "1.06")
 670     (synopsis "Non-interactive password authentication with SSH")
 671     (home-page "https://sourceforge.net/projects/sshpass/")
 672     (source
 673      (origin
 674        (method url-fetch)
 675        (uri (string-append "mirror://sourceforge/sshpass/sshpass/"
 676                            version "/sshpass-" version ".tar.gz"))
 677        (sha256
 678         (base32
 679          "0q7fblaczb7kwbsz0gdy9267z0sllzgmf0c7z5c9mf88wv74ycn6"))))
 680     (build-system gnu-build-system)
 681     (description "sshpass is a tool for non-interactively performing password
 682 authentication with SSH's so-called @dfn{interactive keyboard password
 683 authentication}.")
 684     (license license:gpl2+)))
 685
 686 (define-public autossh
 687   (package
 688     (name "autossh")
 689     (version "1.4g")
 690     (source
 691      (origin
 692        (method url-fetch)
 693        (uri (string-append
 694              "https://www.harding.motd.ca/autossh/autossh-"
 695              version ".tgz"))
 696        (sha256
 697         (base32 "0xqjw8df68f4kzkns5gcah61s5wk0m44qdk2z1d6388w6viwxhsz"))))
 698     (build-system gnu-build-system)
 699     (arguments `(#:tests? #f)) ; There is no "make check" or anything similar
 700     (inputs `(("openssh" ,openssh)))
 701     (synopsis "Automatically restart SSH sessions and tunnels")
 702     (description "autossh is a program to start a copy of @command{ssh} and
 703 monitor it, restarting it as necessary should it die or stop passing traffic.")
 704     (home-page "https://www.harding.motd.ca/autossh/")
 705     (license
 706      ;; Why point to a source file?  Well, all the individual files have a
 707      ;; copy of this license in their headers, but there's no separate file
 708      ;; with that information.
 709      (license:non-copyleft "file://autossh.c"))))
 710
 711 (define-public pdsh
 712   (package
 713     (name "pdsh")
 714     (version "2.34")
 715     (source
 716      (origin
 717        (method url-fetch)
 718        (uri (string-append "https://github.com/chaos/pdsh/"
 719                            "releases/download/pdsh-" version
 720                            "/pdsh-" version ".tar.gz"))
 721        (sha256
 722         (base32 "1s91hmhrz7rfb6h3l5k97s393rcm1ww3svp8dx5z8vkkc933wyxl"))))
 723     (build-system gnu-build-system)
 724     (arguments
 725      `(#:configure-flags
 726        (list "--with-ssh")
 727        #:phases
 728        (modify-phases %standard-phases
 729          (add-after 'unpack 'patch-/bin/sh
 730            (lambda _
 731              (substitute* '("tests/t0006-pdcp.sh"
 732                             "tests/t0004-module-loading.sh"
 733                             "tests/t2001-ssh.sh"
 734                             "tests/t1003-slurm.sh"
 735                             "tests/t6036-long-output-lines.sh"
 736                             "tests/aggregate-results.sh"
 737                             "tests/t2000-exec.sh"
 738                             "tests/t0002-internal.sh"
 739                             "tests/t1002-dshgroup.sh"
 740                             "tests/t5000-dshbak.sh"
 741                             "tests/t0001-basic.sh"
 742                             "tests/t0005-rcmd_type-and-user.sh"
 743                             "tests/test-lib.sh"
 744                             "tests/t2002-mrsh.sh"
 745                             "tests/t0003-wcoll.sh"
 746                             "tests/test-modules/pcptest.c")
 747                (("/bin/sh") (which "bash")))
 748              #t))
 749          (add-after 'unpack 'patch-tests
 750            (lambda _
 751              (substitute* "tests/t6036-long-output-lines.sh"
 752                (("which") (which "which")))
 753              #t)))))
 754     (inputs
 755      `(("openssh" ,openssh)
 756        ("mit-krb5" ,mit-krb5)
 757        ("perl" ,perl)))
 758     (native-inputs
 759      `(("which" ,which)))
 760     (home-page "https://github.com/chaos/pdsh")
 761     (synopsis "Parallel distributed shell")
 762     (description "Pdsh is a an efficient, multithreaded remote shell client
 763 which executes commands on multiple remote hosts in parallel.  Pdsh implements
 764 dynamically loadable modules for extended functionality such as new remote
 765 shell services and remote host selection.")
 766     (license license:gpl2+)))
 767
 768 (define-public python-asyncssh
 769   (package
 770     (name "python-asyncssh")
 771     (version "2.3.0")
 772     (source
 773      (origin
 774        (method url-fetch)
 775        (uri (pypi-uri "asyncssh" version))
 776        (sha256
 777         (base32
 778          "0pi6npmsgx7l9r1qrfvg8mxx3i23ipff492xz4yhrw13f56a7ga4"))))
 779     (build-system python-build-system)
 780     (propagated-inputs
 781      `(("python-cryptography" ,python-cryptography)
 782        ("python-pyopenssl" ,python-pyopenssl)
 783        ("python-gssapi" ,python-gssapi)
 784        ("python-bcrypt" ,python-bcrypt)))
 785     (native-inputs
 786      `(("openssh" ,openssh)
 787        ("openssl" ,openssl)))
 788     (arguments
 789      `(#:phases
 790        (modify-phases %standard-phases
 791          (add-after 'unpack 'disable-tests
 792            (lambda* _
 793              (substitute* "tests/test_agent.py"
 794                ;; TODO Test fails for unknown reason
 795                (("(.+)async def test_confirm" all indent)
 796                 (string-append indent "@unittest.skip('disabled by guix')\n"
 797                                indent "async def test_confirm")))
 798              #t)))))
 799     (home-page "https://asyncssh.readthedocs.io/")
 800     (synopsis "Asynchronous SSHv2 client and server library for Python")
 801     (description
 802      "AsyncSSH is a Python package which provides an asynchronous client and
 803 server implementation of the SSHv2 protocol on top of the Python 3.6+ asyncio
 804 framework.")
 805     (license license:epl2.0)))
 806
 807 (define-public clustershell
 808   (package
 809     (name "clustershell")
 810     (version "1.8.3")
 811     (source
 812      (origin
 813        (method url-fetch)
 814        (uri (string-append "https://github.com/cea-hpc/clustershell/releases"
 815                            "/download/v" version
 816                            "/ClusterShell-" version ".tar.gz"))
 817        (sha256
 818         (base32 "1qdcgh733szwj9r1gambrgfkizvbjci0bnnkds9a8mnyb3sasnan"))))
 819     (build-system python-build-system)
 820     (inputs `(("openssh" ,openssh)))
 821     (propagated-inputs `(("python-pyyaml" ,python-pyyaml)))
 822     (arguments
 823      `(#:phases (modify-phases %standard-phases
 824                   (add-before 'build 'record-openssh-file-name
 825                     (lambda* (#:key inputs #:allow-other-keys)
 826                       (let ((ssh (assoc-ref inputs "openssh")))
 827                         (substitute* "lib/ClusterShell/Worker/Ssh.py"
 828                           (("info\\(\"ssh_path\"\\) or \"ssh\"")
 829                            (string-append "info(\"ssh_path\") or \""
 830                                           ssh "/bin/ssh\"")))
 831                         #t))))))
 832     (home-page "https://cea-hpc.github.io/clustershell/")
 833     (synopsis "Scalable event-driven Python framework for cluster administration")
 834     (description
 835      "ClusterShell is an event-driven Python framework, designed to run local
 836 or distant commands in parallel on server farms or on large GNU/Linux
 837 clusters.  It will take care of common issues encountered on HPC clusters,
 838 such as operating on groups of nodes, running distributed commands using
 839 optimized execution algorithms, as well as gathering results and merging
 840 identical outputs, or retrieving return codes.  ClusterShell takes advantage
 841 of existing remote shell facilities such as SSH.")
 842     (license license:lgpl2.1+)))
 843
 844 (define-public endlessh
 845   (package
 846     (name "endlessh")
 847     (version "1.1")
 848     (source
 849       (origin
 850         (method git-fetch)
 851         (uri (git-reference
 852               (url "https://github.com/skeeto/endlessh")
 853               (commit version)))
 854         (file-name (git-file-name name version))
 855         (sha256
 856          (base32 "0ziwr8j1frsp3dajr8h5glkm1dn5cci404kazz5w1jfrp0736x68"))))
 857     (build-system gnu-build-system)
 858     (arguments
 859      '(#:make-flags (list (string-append "PREFIX=" (assoc-ref %outputs "out"))
 860                           "CC=gcc")
 861        #:tests? #f                      ; no test target
 862        #:phases
 863        (modify-phases %standard-phases
 864          (delete 'configure))))         ; no configure script
 865     (home-page "https://github.com/skeeto/endlessh")
 866     (synopsis "SSH tarpit that slowly sends an endless banner")
 867     (description
 868      "Endlessh is an SSH tarpit that very slowly sends an endless, random SSH
 869 banner.  It keeps SSH clients locked up for hours or even days at a time.  The
 870 purpose is to put your real SSH server on another port and then let the script
 871 kiddies get stuck in this tarpit instead of bothering a real server.
 872
 873 Since the tarpit is in the banner before any cryptographic exchange occurs, this
 874 program doesn't depend on any cryptographic libraries.  It's a simple,
 875 single-threaded, standalone C program.  It uses @code{poll()} to trap multiple
 876 clients at a time.")
 877     (license license:unlicense)))
 878
 879 (define-public webssh
 880   (package
 881     (name "webssh")
 882     (version "1.5.3")
 883     (source (origin
 884               (method git-fetch)
 885               (uri (git-reference
 886                     (url "https://github.com/huashengdun/webssh")
 887                     (commit (string-append "v" version))))
 888               (file-name (git-file-name name version))
 889               (sha256
 890                (base32
 891                 "1bcy9flrzbvams5p77swwiygv54ac58ia7hpic1bvg30b3wpvv7b"))))
 892     (build-system python-build-system)
 893     (propagated-inputs
 894      `(("python-paramiko" ,python-paramiko)
 895        ("python-tornado" ,python-tornado)))
 896     (home-page "https://webssh.huashengdun.org/")
 897     (synopsis "Web application to be used as an SSH client")
 898     (description "This package provides a web application to be used as an SSH
 899 client.
 900
 901 Features:
 902 @itemize @bullet
 903 @item SSH password authentication supported, including empty password.
 904 @item SSH public-key authentication supported, including DSA RSA ECDSA
 905 Ed25519 keys.
 906 @item Encrypted keys supported.
 907 @item Two-Factor Authentication (time-based one-time password) supported.
 908 @item Fullscreen terminal supported.
 909 @item Terminal window resizable.
 910 @item Auto detect the ssh server's default encoding.
 911 @item Modern browsers are supported.
 912 @end itemize")
 913     (license license:expat)))