gnu/packages/ssh.scm

   1 ;;; GNU Guix --- Functional package management for GNU
   2 ;;; Copyright © 2012, 2013, 2014, 2015, 2016, 2017, 2018, 2019, 2020 Ludovic Courtès <ludo@gnu.org>
   3 ;;; Copyright © 2013, 2014 Andreas Enge <andreas@enge.fr>
   4 ;;; Copyright © 2014, 2015, 2016 Mark H Weaver <mhw@netris.org>
   5 ;;; Copyright © 2015, 2016, 2018, 2019 Efraim Flashner <efraim@flashner.co.il>
   6 ;;; Copyright © 2016, 2019 Leo Famulari <leo@famulari.name>
   7 ;;; Copyright © 2016 Nicolas Goaziou <mail@nicolasgoaziou.fr>
   8 ;;; Copyright © 2016 Christopher Allan Webber <cwebber@dustycloud.org>
   9 ;;; Copyright © 2017, 2018, 2019, 2020 Tobias Geerinckx-Rice <me@tobias.gr>
  10 ;;; Copyright © 2017 Stefan Reichör <stefan@xsteve.at>
  11 ;;; Copyright © 2017 Ricardo Wurmus <rekado@elephly.net>
  12 ;;; Copyright © 2017 ng0 <ng0@n0.is>
  13 ;;; Copyright © 2018 Manuel Graf <graf@init.at>
  14 ;;; Copyright © 2019 Gábor Boskovits <boskovits@gmail.com>
  15 ;;; Copyright © 2020 Mathieu Othacehe <m.othacehe@gmail.com>
  16 ;;;
  17 ;;; This file is part of GNU Guix.
  18 ;;;
  19 ;;; GNU Guix is free software; you can redistribute it and/or modify it
  20 ;;; under the terms of the GNU General Public License as published by
  21 ;;; the Free Software Foundation; either version 3 of the License, or (at
  22 ;;; your option) any later version.
  23 ;;;
  24 ;;; GNU Guix is distributed in the hope that it will be useful, but
  25 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
  26 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  27 ;;; GNU General Public License for more details.
  28 ;;;
  29 ;;; You should have received a copy of the GNU General Public License
  30 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
  31
  32 (define-module (gnu packages ssh)
  33   #:use-module (gnu packages)
  34   #:use-module (gnu packages autotools)
  35   #:use-module (gnu packages base)
  36   #:use-module (gnu packages boost)
  37   #:use-module (gnu packages compression)
  38   #:use-module (gnu packages crypto)
  39   #:use-module (gnu packages elf)
  40   #:use-module (gnu packages gnupg)
  41   #:use-module (gnu packages gperf)
  42   #:use-module (gnu packages groff)
  43   #:use-module (gnu packages guile)
  44   #:use-module (gnu packages libedit)
  45   #:use-module (gnu packages linux)
  46   #:use-module (gnu packages logging)
  47   #:use-module (gnu packages m4)
  48   #:use-module (gnu packages multiprecision)
  49   #:use-module (gnu packages ncurses)
  50   #:use-module (gnu packages nettle)
  51   #:use-module (gnu packages kerberos)
  52   #:use-module (gnu packages perl)
  53   #:use-module (gnu packages pkg-config)
  54   #:use-module (gnu packages popt)
  55   #:use-module (gnu packages protobuf)
  56   #:use-module (gnu packages python)
  57   #:use-module (gnu packages python-xyz)
  58   #:use-module (gnu packages readline)
  59   #:use-module (gnu packages texinfo)
  60   #:use-module (gnu packages tls)
  61   #:use-module (gnu packages xorg)
  62   #:use-module (guix build-system cmake)
  63   #:use-module (guix build-system gnu)
  64   #:use-module (guix build-system python)
  65   #:use-module (guix download)
  66   #:use-module (guix git-download)
  67   #:use-module ((guix licenses) #:prefix license:)
  68   #:use-module (guix packages)
  69   #:use-module (guix utils)
  70   #:use-module (srfi srfi-1))
  71
  72 (define-public libssh
  73   (package
  74     (name "libssh")
  75     (version "0.9.4")
  76     (source (origin
  77               (method git-fetch)
  78               (uri (git-reference
  79                      (url "https://git.libssh.org/projects/libssh.git")
  80                      (commit (string-append "libssh-" version))))
  81               (sha256
  82                (base32
  83                 "0qr4vi3k1wv69c95d9j26fiv78pzyksaq8ccd76b8nxar5z1fbj6"))
  84               (file-name (git-file-name name version))))
  85     (build-system cmake-build-system)
  86     (outputs '("out" "debug"))
  87     (arguments
  88      '(#:configure-flags '("-DWITH_GCRYPT=ON")
  89
  90        ;; TODO: Add 'CMockery' and '-DWITH_TESTING=ON' for the test suite.
  91        #:tests? #f))
  92     (inputs `(("zlib" ,zlib)
  93               ("libgcrypt" ,libgcrypt)
  94               ("mit-krb5" ,mit-krb5)))
  95     (synopsis "SSH client library")
  96     (description
  97      "libssh is a C library implementing the SSHv2 and SSHv1 protocol for client
  98 and server implementations.  With libssh, you can remotely execute programs,
  99 transfer files, and use a secure and transparent tunnel for your remote
 100 applications.")
 101     (home-page "https://www.libssh.org")
 102     (license license:lgpl2.1+)))
 103
 104 (define-public libssh2
 105   (package
 106    (name "libssh2")
 107    (version "1.9.0")
 108    (source (origin
 109             (method url-fetch)
 110             (uri (string-append
 111                    "https://www.libssh2.org/download/libssh2-"
 112                    version ".tar.gz"))
 113             (sha256
 114              (base32
 115               "1zfsz9nldakfz61d2j70pk29zlmj7w2vv46s9l3x2prhcgaqpyym"))))
 116    (build-system gnu-build-system)
 117    ;; The installed libssh2.pc file does not include paths to libgcrypt and
 118    ;; zlib libraries, so we need to propagate the inputs.
 119    (propagated-inputs `(("libgcrypt" ,libgcrypt)
 120                         ("zlib" ,zlib)))
 121    (arguments `(#:configure-flags `("--with-libgcrypt")))
 122    (synopsis "Client-side C library implementing the SSH2 protocol")
 123    (description
 124     "libssh2 is a library intended to allow software developers access to
 125 the SSH-2 protocol in an easy-to-use self-contained package.  It can be built
 126 into an application to perform many different tasks when communicating with
 127 a server that supports the SSH-2 protocol.")
 128    (license license:bsd-3)
 129    (home-page "https://www.libssh2.org/")))
 130
 131 (define-public openssh
 132   (package
 133    (name "openssh")
 134    (version "8.2p1")
 135    (source (origin
 136              (method url-fetch)
 137              (uri (string-append "mirror://openbsd/OpenSSH/portable/"
 138                                  "openssh-" version ".tar.gz"))
 139              (sha256
 140               (base32
 141                "0wg6ckzvvklbzznijxkk28fb8dnwyjd0w30ra0afwv6gwr8m34j3"))))
 142    (build-system gnu-build-system)
 143    (native-inputs `(("groff" ,groff)
 144                     ("pkg-config" ,pkg-config)))
 145    (inputs `(("libedit" ,libedit)
 146              ("openssl" ,openssl)
 147              ("pam" ,linux-pam)
 148              ("mit-krb5" ,mit-krb5)
 149              ("zlib" ,zlib)
 150              ("xauth" ,xauth)))         ; for 'ssh -X' and 'ssh -Y'
 151    (arguments
 152     `(#:test-target "tests"
 153       ;; Otherwise, the test scripts try to use a nonexistent directory and
 154       ;; fail.
 155       #:make-flags '("REGRESSTMP=\"$${BUILDDIR}/regress\"")
 156       #:configure-flags  `("--sysconfdir=/etc/ssh"
 157
 158                            ;; Default value of 'PATH' used by sshd.
 159                           "--with-default-path=/run/current-system/profile/bin"
 160
 161                           ;; configure needs to find krb5-config.
 162                           ,(string-append "--with-kerberos5="
 163                                           (assoc-ref %build-inputs "mit-krb5")
 164                                           "/bin")
 165
 166                           ;; libedit is needed for sftp completion.
 167                           "--with-libedit"
 168
 169                           ;; Enable PAM support in sshd.
 170                           "--with-pam")
 171
 172       #:phases
 173       (modify-phases %standard-phases
 174         (add-after 'configure 'reset-/var/empty
 175          (lambda* (#:key outputs #:allow-other-keys)
 176            (let ((out (assoc-ref outputs "out")))
 177              (substitute* "Makefile"
 178                (("PRIVSEP_PATH=/var/empty")
 179                 (string-append "PRIVSEP_PATH=" out "/var/empty")))
 180              #t)))
 181         (add-before 'check 'patch-tests
 182          (lambda _
 183            (substitute* "regress/test-exec.sh"
 184              (("/bin/sh") (which "sh")))
 185
 186            ;; Remove 't-exec' regress target which requires user 'sshd'.
 187            (substitute* (list "Makefile"
 188                               "regress/Makefile")
 189              (("^(tests:.*) t-exec(.*)" all pre post)
 190               (string-append pre post)))
 191            #t))
 192         (replace 'install
 193          (lambda* (#:key outputs (make-flags '()) #:allow-other-keys)
 194            ;; Install without host keys and system configuration files.
 195            (apply invoke "make" "install-nosysconf" make-flags)
 196            (install-file "contrib/ssh-copy-id"
 197                          (string-append (assoc-ref outputs "out")
 198                                         "/bin/"))
 199            (chmod (string-append (assoc-ref outputs "out")
 200                                  "/bin/ssh-copy-id") #o555)
 201            (install-file "contrib/ssh-copy-id.1"
 202                          (string-append (assoc-ref outputs "out")
 203                                         "/share/man/man1/"))
 204            #t)))))
 205    (synopsis "Client and server for the secure shell (ssh) protocol")
 206    (description
 207     "The SSH2 protocol implemented in OpenSSH is standardised by the
 208 IETF secsh working group and is specified in several RFCs and drafts.
 209 It is composed of three layered components:
 210
 211 The transport layer provides algorithm negotiation and a key exchange.
 212 The key exchange includes server authentication and results in a
 213 cryptographically secured connection: it provides integrity, confidentiality
 214 and optional compression.
 215
 216 The user authentication layer uses the established connection and relies on
 217 the services provided by the transport layer.  It provides several mechanisms
 218 for user authentication.  These include traditional password authentication
 219 as well as public-key or host-based authentication mechanisms.
 220
 221 The connection layer multiplexes many different concurrent channels over the
 222 authenticated connection and allows tunneling of login sessions and
 223 TCP-forwarding.  It provides a flow control service for these channels.
 224 Additionally, various channel-specific options can be negotiated.")
 225    (license (license:non-copyleft "file://LICENSE"
 226                                "See LICENSE in the distribution."))
 227    (home-page "https://www.openssh.com/")))
 228
 229 (define-public guile-ssh
 230   (package
 231     (name "guile-ssh")
 232     (version "0.12.0")
 233     (home-page "https://github.com/artyom-poptsov/guile-ssh")
 234     (source (origin
 235               (method git-fetch)
 236               (uri (git-reference
 237                     (url home-page)
 238                     (commit (string-append "v" version))))
 239               (file-name (string-append name "-" version ".tar.gz"))
 240               (sha256
 241                (base32
 242                 "054hd9rzfhb48gc1hw3rphhp0cnnd4bs5qmidy5ygsyvy9ravlad"))
 243               (modules '((guix build utils)))))
 244     (build-system gnu-build-system)
 245     (outputs '("out" "debug"))
 246     (arguments
 247      `(;; It makes no sense to build libguile-ssh.a.
 248        #:configure-flags '("--disable-static")
 249
 250        #:phases (modify-phases %standard-phases
 251                   (add-before 'build 'fix-libguile-ssh-file-name
 252                     (lambda* (#:key outputs #:allow-other-keys)
 253                       ;; Build and install libguile-ssh.so so that we can use
 254                       ;; its absolute file name in .scm files, before we build
 255                       ;; the .go files.
 256                       (let* ((out (assoc-ref outputs "out"))
 257                              (lib (string-append out "/lib")))
 258                         (invoke "make" "install"
 259                                 "-C" "libguile-ssh"
 260                                 "-j" (number->string
 261                                       (parallel-job-count)))
 262                         (substitute* (find-files "." "\\.scm$")
 263                           (("\"libguile-ssh\"")
 264                            (string-append "\"" lib "/libguile-ssh\"")))
 265                         #t)))
 266                   ,@(if (%current-target-system)
 267                         '()
 268                         '((add-before 'check 'fix-guile-path
 269                              (lambda* (#:key inputs #:allow-other-keys)
 270                                (let ((guile (assoc-ref inputs "guile")))
 271                                  (substitute* "tests/common.scm"
 272                                    (("/usr/bin/guile")
 273                                     (string-append guile "/bin/guile")))
 274                                  #t)))))
 275                   (add-after 'install 'remove-bin-directory
 276                     (lambda* (#:key outputs #:allow-other-keys)
 277                       (let* ((out (assoc-ref outputs "out"))
 278                              (bin (string-append out "/bin"))
 279                              (examples (string-append
 280                                         out "/share/guile-ssh/examples")))
 281                         (mkdir-p examples)
 282                         (rename-file (string-append bin "/ssshd.scm")
 283                                      (string-append examples "/ssshd.scm"))
 284                         (rename-file (string-append bin "/sssh.scm")
 285                                      (string-append examples "/sssh.scm"))
 286                         (delete-file-recursively bin)
 287                         #t))))
 288        ;; Tests are not parallel-safe.
 289        #:parallel-tests? #f))
 290     (native-inputs `(("autoconf" ,autoconf)
 291                      ("automake" ,automake)
 292                      ("libtool" ,libtool)
 293                      ("texinfo" ,texinfo)
 294                      ("pkg-config" ,pkg-config)
 295                      ("which" ,which)
 296                      ("guile" ,guile-2.2))) ;needed when cross-compiling.
 297     (inputs `(("guile" ,guile-2.2)
 298               ("libssh" ,libssh)
 299               ("libgcrypt" ,libgcrypt)))
 300     (synopsis "Guile bindings to libssh")
 301     (description
 302      "Guile-SSH is a library that provides access to the SSH protocol for
 303 programs written in GNU Guile interpreter.  It is a wrapper to the underlying
 304 libssh library.")
 305     (license license:gpl3+)))
 306
 307 (define-public guile2.0-ssh
 308   (package
 309     (inherit guile-ssh)
 310     (name "guile2.0-ssh")
 311     (native-inputs
 312      `(("guile" ,guile-2.0) ;needed when cross-compiling.
 313        ,@(alist-delete "guile" (package-native-inputs guile-ssh))))
 314     (inputs `(("guile" ,guile-2.0)
 315               ,@(alist-delete "guile" (package-inputs guile-ssh))))))
 316
 317 (define-public guile3.0-ssh
 318   (package
 319     (inherit guile-ssh)
 320     (name "guile3.0-ssh")
 321     (native-inputs
 322      `(("guile" ,guile-next) ;needed when cross-compiling.
 323        ,@(alist-delete "guile" (package-native-inputs guile-ssh))))
 324     (inputs `(("guile" ,guile-next)
 325               ,@(alist-delete "guile" (package-inputs guile-ssh))))))
 326
 327 (define-public corkscrew
 328   (package
 329     (name "corkscrew")
 330     (version "2.0")
 331     (source
 332      (origin
 333        (method url-fetch)
 334        ;; The agroman.net domain name expired on 2017-03-23, and the original
 335        ;; "http://www.agroman.net/corkscrew/corkscrew-2.0.tar.gz" now returns
 336        ;; bogus HTML.  Perhaps it will yet return.  Until then, use a mirror.
 337        (uri (string-append "https://downloads.openwrt.org/sources/"
 338                            "corkscrew-" version ".tar.gz"))
 339        (sha256 (base32
 340                 "1gmhas4va6gd70i2x2mpxpwpgww6413mji29mg282jms3jscn3qd"))))
 341     (build-system gnu-build-system)
 342     (arguments
 343      `(#:phases
 344        (modify-phases %standard-phases
 345          (replace 'configure
 346            ;; Replace configure phase as the ./configure script does not like
 347            ;; CONFIG_SHELL and SHELL passed as parameters
 348            (lambda* (#:key outputs build target #:allow-other-keys)
 349              (let* ((out   (assoc-ref outputs "out"))
 350                     (bash  (which "bash"))
 351                     ;; Set --build and --host flags as the provided config.guess
 352                     ;; is not able to detect them
 353                     (flags `(,(string-append "--prefix=" out)
 354                              ,(string-append "--build=" build)
 355                              ,(string-append "--host=" (or target build)))))
 356                (setenv "CONFIG_SHELL" bash)
 357                (apply invoke bash "./configure" flags))))
 358          (add-after 'install 'install-documentation
 359            (lambda* (#:key outputs #:allow-other-keys)
 360              (let* ((out (assoc-ref outputs "out"))
 361                     (doc (string-append out "/share/doc/" ,name "-" ,version)))
 362                (install-file "README" doc)
 363                #t))))))
 364     (home-page "http://www.agroman.net/corkscrew")
 365     (synopsis "SSH tunneling through HTTP(S) proxies")
 366     (description
 367      "Corkscrew tunnels SSH connections through most HTTP and HTTPS proxies.
 368 Proxy authentication is only supported through the plain-text HTTP basic
 369 authentication scheme.")
 370     (license license:gpl2+)))
 371
 372 (define-public mosh
 373   (package
 374     (name "mosh")
 375     (version "1.3.2")
 376     (source (origin
 377               (method url-fetch)
 378               (uri (string-append "https://mosh.org/mosh-" version ".tar.gz"))
 379               (sha256
 380                (base32
 381                 "05hjhlp6lk8yjcy59zywpf0r6s0h0b9zxq0lw66dh9x8vxrhaq6s"))))
 382     (build-system gnu-build-system)
 383     (arguments
 384      '(#:phases
 385        (modify-phases %standard-phases
 386          (add-after 'install 'wrap
 387            (lambda* (#:key outputs #:allow-other-keys)
 388              ;; Make sure 'mosh' can find 'mosh-client' and
 389              ;; 'mosh-server'.
 390              (let* ((out (assoc-ref outputs "out"))
 391                     (bin (string-append out "/bin")))
 392                (wrap-program (string-append bin "/mosh")
 393                              `("PATH" ":" prefix (,bin)))))))))
 394     (native-inputs
 395      `(("pkg-config" ,pkg-config)))
 396     (inputs
 397      `(("openssl" ,openssl)
 398        ("perl" ,perl)
 399        ("perl-io-tty" ,perl-io-tty)
 400        ("zlib" ,zlib)
 401        ("ncurses" ,ncurses)
 402        ("protobuf" ,protobuf)
 403        ("boost-headers" ,boost)))
 404     (home-page "https://mosh.org/")
 405     (synopsis "Remote shell tolerant to intermittent connectivity")
 406     (description
 407      "Mosh is a remote terminal application that allows client roaming, supports
 408 intermittent connectivity, and provides intelligent local echo and line editing
 409 of user keystrokes.  It's a replacement for SSH that's more robust and
 410 responsive, especially over Wi-Fi, cellular, and long-distance links.")
 411     (license license:gpl3+)))
 412
 413 (define-public et
 414   (package
 415     (name "et")
 416     (version "3.1.0")
 417     (source
 418      (origin
 419        (method git-fetch)
 420        (uri (git-reference
 421              (url "https://github.com/MisterTea/EternalTCP.git")
 422              (commit (string-append "et-v" version))))
 423        (file-name (git-file-name name version))
 424        (sha256
 425         (base32 "1m5caxckn2ihwp9s2pbyh5amxlpwr7yc54q8s0kb10fr52w2vfnm"))))
 426     (build-system cmake-build-system)
 427     (arguments `(#:tests? #f))
 428     (native-inputs
 429      `(("pkg-config" ,pkg-config)))
 430     (inputs `(("glog" ,glog)
 431               ("gflags" ,gflags)
 432               ("libsodium" ,libsodium)
 433               ("protobuf" ,protobuf)))
 434     (synopsis "Remote shell that automatically reconnects")
 435     (description
 436      "Eternal Terminal (ET) is a remote shell that automatically reconnects
 437 without interrupting the session.  Unlike SSH sessions, ET sessions will
 438 survive even network outages and IP changes.  ET uses a custom protocol over
 439 TCP, not the SSH protocol.")
 440     (home-page "https://eternalterminal.dev/")
 441     (license license:asl2.0)))
 442
 443 (define-public dropbear
 444   (package
 445     (name "dropbear")
 446     (version "2019.78")
 447     (source
 448      (origin
 449        (method url-fetch)
 450        (uri (string-append
 451              "https://matt.ucc.asn.au/dropbear/releases/"
 452              "dropbear-" version ".tar.bz2"))
 453        (sha256
 454         (base32 "19242qlr40pbqfqd0gg6h8qpj38q6lgv03ja6sahj9vj2abnanaj"))))
 455     (build-system gnu-build-system)
 456     (arguments `(#:tests? #f))  ; there is no "make check" or anything similar
 457     ;; TODO: Investigate unbundling libtommath and libtomcrypt or at least
 458     ;; cherry-picking important bug fixes from them. See <bugs.gnu.org/24674>
 459     ;; for more information.
 460     (inputs `(("zlib" ,zlib)))
 461     (synopsis "Small SSH server and client")
 462     (description "Dropbear is a relatively small SSH server and
 463 client.  It runs on a variety of POSIX-based platforms.  Dropbear is
 464 particularly useful for embedded systems, such as wireless routers.")
 465     (home-page "https://matt.ucc.asn.au/dropbear/dropbear.html")
 466     (license (license:x11-style "" "See file LICENSE."))))
 467
 468 (define-public liboop
 469   (package
 470     (name "liboop")
 471     (version "1.0.1")
 472     (source
 473      (origin
 474       (method url-fetch)
 475       (uri (string-append "http://ftp.lysator.liu.se/pub/liboop/"
 476                           name "-" version ".tar.gz"))
 477       (sha256
 478        (base32
 479         "1q0p1l72pq9k3bi7a366j2rishv7dzzkg3i6r2npsfg7cnnidbsn"))))
 480     (build-system gnu-build-system)
 481     (home-page "https://www.lysator.liu.se/liboop/")
 482     (synopsis "Event loop library")
 483     (description "Liboop is a low-level event loop management library for
 484 POSIX-based operating systems.  It supports the development of modular,
 485 multiplexed applications which may respond to events from several sources.  It
 486 replaces the \"select() loop\" and allows the registration of event handlers
 487 for file and network I/O, timers and signals.  Since processes use these
 488 mechanisms for almost all external communication, liboop can be used as the
 489 basis for almost any application.")
 490     (license license:lgpl2.1+)))
 491
 492 (define-public lsh
 493   (package
 494     (name "lsh")
 495     (version "2.1")
 496     (source (origin
 497               (method url-fetch)
 498               (uri (string-append "mirror://gnu/lsh/lsh-"
 499                                   version ".tar.gz"))
 500               (sha256
 501                (base32
 502                 "1qqjy9zfzgny0rkb27c8c7dfsylvb6n0ld8h3an2r83pmaqr9gwb"))
 503               (modules '((guix build utils)))
 504               (snippet
 505                '(begin
 506                   (substitute* "src/testsuite/functions.sh"
 507                     (("localhost")
 508                      ;; Avoid host name lookups since they don't work in
 509                      ;; chroot builds.
 510                      "127.0.0.1")
 511                     (("set -e")
 512                      ;; Make tests more verbose.
 513                      "set -e\nset -x"))
 514
 515                   (substitute* (find-files "src/testsuite" "-test$")
 516                     (("localhost") "127.0.0.1"))
 517
 518                   (substitute* "src/testsuite/login-auth-test"
 519                     (("/bin/cat") "cat"))
 520                   #t))))
 521     (build-system gnu-build-system)
 522     (native-inputs
 523      `(("m4" ,m4)
 524        ("guile" ,guile-2.0)
 525        ("gperf" ,gperf)
 526        ("psmisc" ,psmisc)))                       ; for `killall'
 527     (inputs
 528      `(("nettle" ,nettle-2)
 529        ("linux-pam" ,linux-pam)
 530
 531        ;; 'rl.c' uses the 'CPPFunction' type, which is no longer in
 532        ;; Readline 6.3.
 533        ("readline" ,readline-6.2)
 534
 535        ("liboop" ,liboop)
 536        ("zlib" ,zlib)
 537        ("gmp" ,gmp)
 538
 539        ;; The server (lshd) invokes xauth when X11 forwarding is requested.
 540        ;; This adds 24 MiB (or 27%) to the closure of lsh.
 541        ("xauth" ,xauth)))
 542     (arguments
 543      '(;; Skip the `configure' test that checks whether /dev/ptmx &
 544        ;; co. work as expected, because it relies on impurities (for
 545        ;; instance, /dev/pts may be unavailable in chroots.)
 546        #:configure-flags '("lsh_cv_sys_unix98_ptys=yes"
 547
 548                            ;; Use glibc's argp rather than the bundled one.
 549                            "--with-system-argp"
 550
 551                            ;; 'lsh_argp.h' checks HAVE_ARGP_PARSE but nothing
 552                            ;; defines it.
 553                            "CPPFLAGS=-DHAVE_ARGP_PARSE")
 554
 555        ;; FIXME: Tests won't run in a chroot, presumably because
 556        ;; /etc/profile is missing, and thus clients get an empty $PATH
 557        ;; and nothing works.
 558        #:tests? #f
 559
 560        #:phases
 561        (modify-phases %standard-phases
 562          (add-before 'configure 'pre-configure
 563            (lambda* (#:key inputs #:allow-other-keys)
 564              (let* ((nettle    (assoc-ref inputs "nettle"))
 565                     (sexp-conv (string-append nettle "/bin/sexp-conv")))
 566                ;; Remove argp from the list of sub-directories; we don't want
 567                ;; to build it, really.
 568                (substitute* "src/Makefile.in"
 569                  (("^SUBDIRS = argp")
 570                   "SUBDIRS ="))
 571
 572                ;; Make sure 'lsh' and 'lshd' pick 'sexp-conv' in the right place
 573                ;; by default.
 574                (substitute* "src/environ.h.in"
 575                  (("^#define PATH_SEXP_CONV.*")
 576                   (string-append "#define PATH_SEXP_CONV \""
 577                                  sexp-conv "\"\n")))
 578
 579                ;; Same for the 'lsh-authorize' script.
 580                (substitute* "src/lsh-authorize"
 581                  (("=sexp-conv")
 582                   (string-append "=" sexp-conv)))
 583
 584                ;; Tell lshd where 'xauth' lives.  Another option would be to
 585                ;; hardcode "/run/current-system/profile/bin/xauth", thereby
 586                ;; reducing the closure size, but that wouldn't work on foreign
 587                ;; distros.
 588                (with-fluids ((%default-port-encoding "ISO-8859-1"))
 589                  (substitute* "src/server_x11.c"
 590                    (("define XAUTH_PROGRAM.*")
 591                     (string-append "define XAUTH_PROGRAM \""
 592                                    (assoc-ref inputs "xauth")
 593                                    "/bin/xauth\"\n")))))
 594
 595              ;; Tests rely on $USER being set.
 596              (setenv "USER" "guix"))))))
 597     (home-page "https://www.lysator.liu.se/~nisse/lsh/")
 598     (synopsis "GNU implementation of the Secure Shell (ssh) protocols")
 599     (description
 600      "GNU lsh is a free implementation of the SSH version 2 protocol.  It is
 601 used to create a secure line of communication between two computers,
 602 providing shell access to the server system from the client.  It provides
 603 both the server daemon and the client application, as well as tools for
 604 manipulating key files.")
 605     (license license:gpl2+)))
 606
 607 (define-public sshpass
 608   (package
 609     (name "sshpass")
 610     (version "1.06")
 611     (synopsis "Non-interactive password authentication with SSH")
 612     (home-page "https://sourceforge.net/projects/sshpass/")
 613     (source
 614      (origin
 615        (method url-fetch)
 616        (uri (string-append "mirror://sourceforge/sshpass/sshpass/"
 617                            version "/sshpass-" version ".tar.gz"))
 618        (sha256
 619         (base32
 620          "0q7fblaczb7kwbsz0gdy9267z0sllzgmf0c7z5c9mf88wv74ycn6"))))
 621     (build-system gnu-build-system)
 622     (description "sshpass is a tool for non-interactivly performing password
 623 authentication with SSH's so-called @dfn{interactive keyboard password
 624 authentication}.")
 625     (license license:gpl2+)))
 626
 627 (define-public autossh
 628   (package
 629     (name "autossh")
 630     (version "1.4g")
 631     (source
 632      (origin
 633        (method url-fetch)
 634        (uri (string-append
 635              "https://www.harding.motd.ca/autossh/autossh-"
 636              version ".tgz"))
 637        (sha256
 638         (base32 "0xqjw8df68f4kzkns5gcah61s5wk0m44qdk2z1d6388w6viwxhsz"))))
 639     (build-system gnu-build-system)
 640     (arguments `(#:tests? #f)) ; There is no "make check" or anything similar
 641     (inputs `(("openssh" ,openssh)))
 642     (synopsis "Automatically restart SSH sessions and tunnels")
 643     (description "autossh is a program to start a copy of @command{ssh} and
 644 monitor it, restarting it as necessary should it die or stop passing traffic.")
 645     (home-page "https://www.harding.motd.ca/autossh/")
 646     (license
 647      ;; Why point to a source file?  Well, all the individual files have a
 648      ;; copy of this license in their headers, but there's no separate file
 649      ;; with that information.
 650      (license:non-copyleft "file://autossh.c"))))
 651
 652 (define-public pdsh
 653   (package
 654     (name "pdsh")
 655     (version "2.34")
 656     (source
 657      (origin
 658        (method url-fetch)
 659        (uri (string-append "https://github.com/chaos/pdsh/"
 660                            "releases/download/pdsh-" version
 661                            "/pdsh-" version ".tar.gz"))
 662        (sha256
 663         (base32 "1s91hmhrz7rfb6h3l5k97s393rcm1ww3svp8dx5z8vkkc933wyxl"))))
 664     (build-system gnu-build-system)
 665     (arguments
 666      `(#:configure-flags
 667        (list "--with-ssh")
 668        #:phases
 669        (modify-phases %standard-phases
 670          (add-after 'unpack 'patch-/bin/sh
 671            (lambda _
 672              (substitute* '("tests/t0006-pdcp.sh"
 673                             "tests/t0004-module-loading.sh"
 674                             "tests/t2001-ssh.sh"
 675                             "tests/t1003-slurm.sh"
 676                             "tests/t6036-long-output-lines.sh"
 677                             "tests/aggregate-results.sh"
 678                             "tests/t2000-exec.sh"
 679                             "tests/t0002-internal.sh"
 680                             "tests/t1002-dshgroup.sh"
 681                             "tests/t5000-dshbak.sh"
 682                             "tests/t0001-basic.sh"
 683                             "tests/t0005-rcmd_type-and-user.sh"
 684                             "tests/test-lib.sh"
 685                             "tests/t2002-mrsh.sh"
 686                             "tests/t0003-wcoll.sh"
 687                             "tests/test-modules/pcptest.c")
 688                (("/bin/sh") (which "bash")))
 689              #t))
 690          (add-after 'unpack 'patch-tests
 691            (lambda _
 692              (substitute* "tests/t6036-long-output-lines.sh"
 693                (("which") (which "which")))
 694              #t)))))
 695     (inputs
 696      `(("openssh" ,openssh)
 697        ("mit-krb5" ,mit-krb5)
 698        ("perl" ,perl)))
 699     (native-inputs
 700      `(("which" ,which)))
 701     (home-page "https://github.com/chaos/pdsh")
 702     (synopsis "Parallel distributed shell")
 703     (description "Pdsh is a an efficient, multithreaded remote shell client
 704 which executes commands on multiple remote hosts in parallel.  Pdsh implements
 705 dynamically loadable modules for extended functionality such as new remote
 706 shell services and remote host selection.")
 707     (license license:gpl2+)))
 708
 709 (define-public clustershell
 710   (package
 711     (name "clustershell")
 712     (version "1.8.3")
 713     (source
 714      (origin
 715        (method url-fetch)
 716        (uri (string-append "https://github.com/cea-hpc/clustershell/releases"
 717                            "/download/v" version
 718                            "/ClusterShell-" version ".tar.gz"))
 719        (sha256
 720         (base32 "1qdcgh733szwj9r1gambrgfkizvbjci0bnnkds9a8mnyb3sasnan"))))
 721     (build-system python-build-system)
 722     (inputs `(("openssh" ,openssh)))
 723     (propagated-inputs `(("python-pyyaml" ,python-pyyaml)))
 724     (arguments
 725      `(#:phases (modify-phases %standard-phases
 726                   (add-before 'build 'record-openssh-file-name
 727                     (lambda* (#:key inputs #:allow-other-keys)
 728                       (let ((ssh (assoc-ref inputs "openssh")))
 729                         (substitute* "lib/ClusterShell/Worker/Ssh.py"
 730                           (("info\\(\"ssh_path\"\\) or \"ssh\"")
 731                            (string-append "info(\"ssh_path\") or \""
 732                                           ssh "/bin/ssh\"")))
 733                         #t))))))
 734     (home-page "https://cea-hpc.github.io/clustershell/")
 735     (synopsis "Scalable event-driven Python framework for cluster administration")
 736     (description
 737      "ClusterShell is an event-driven Python framework, designed to run local
 738 or distant commands in parallel on server farms or on large GNU/Linux
 739 clusters.  It will take care of common issues encountered on HPC clusters,
 740 such as operating on groups of nodes, running distributed commands using
 741 optimized execution algorithms, as well as gathering results and merging
 742 identical outputs, or retrieving return codes.  ClusterShell takes advantage
 743 of existing remote shell facilities such as SSH.")
 744     (license license:lgpl2.1+)))
 745
 746 (define-public endlessh
 747   (package
 748     (name "endlessh")
 749     (version "1.1")
 750     (source
 751       (origin
 752         (method git-fetch)
 753         (uri (git-reference
 754               (url "https://github.com/skeeto/endlessh.git")
 755               (commit version)))
 756         (file-name (git-file-name name version))
 757         (sha256
 758          (base32 "0ziwr8j1frsp3dajr8h5glkm1dn5cci404kazz5w1jfrp0736x68"))))
 759     (build-system gnu-build-system)
 760     (arguments
 761      '(#:make-flags (list (string-append "PREFIX=" (assoc-ref %outputs "out"))
 762                           "CC=gcc")
 763        #:tests? #f                      ; no test target
 764        #:phases
 765        (modify-phases %standard-phases
 766          (delete 'configure))))         ; no configure script
 767     (home-page "https://github.com/skeeto/endlessh")
 768     (synopsis "SSH tarpit that slowly sends an endless banner")
 769     (description
 770      "Endlessh is an SSH tarpit that very slowly sends an endless, random SSH
 771 banner.  It keeps SSH clients locked up for hours or even days at a time.  The
 772 purpose is to put your real SSH server on another port and then let the script
 773 kiddies get stuck in this tarpit instead of bothering a real server.
 774
 775 Since the tarpit is in the banner before any cryptographic exchange occurs, this
 776 program doesn't depend on any cryptographic libraries.  It's a simple,
 777 single-threaded, standalone C program.  It uses @code{poll()} to trap multiple
 778 clients at a time.")
 779     (license license:unlicense)))