diff --git a/nixos/doc/manual/release-notes/rl-2411.section.md b/nixos/doc/manual/release-notes/rl-2411.section.md index e4b366b70528..357678db60bd 100644 --- a/nixos/doc/manual/release-notes/rl-2411.section.md +++ b/nixos/doc/manual/release-notes/rl-2411.section.md @@ -324,6 +324,8 @@ - The `services.trust-dns` module has been renamed to `services.hickory-dns`. +- The `lsh` package and the `services.lshd` module have been removed as they had no maintainer in Nixpkgs and hadn’t seen an upstream release in over a decade. It is recommended to migrate to `openssh` and `services.openssh`. + ## Other Notable Changes {#sec-release-24.11-notable-changes} diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index 9b8c627d4e1d..1c3e47f0bdd9 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -1209,7 +1209,6 @@ ./services/networking/spacecookie.nix ./services/networking/spiped.nix ./services/networking/squid.nix - ./services/networking/ssh/lshd.nix ./services/networking/ssh/sshd.nix ./services/networking/sslh.nix ./services/networking/strongswan-swanctl/module.nix diff --git a/nixos/modules/rename.nix b/nixos/modules/rename.nix index df6090e41d7d..374d127198d0 100644 --- a/nixos/modules/rename.nix +++ b/nixos/modules/rename.nix @@ -70,6 +70,7 @@ in (mkRemovedOptionModule [ "services" "hydron" ] "The `services.hydron` module has been removed as the project has been archived upstream since 2022 and is affected by a severe remote code execution vulnerability.") (mkRemovedOptionModule [ "services" "ihatemoney" ] "The ihatemoney module has been removed for lack of downstream maintainer") (mkRemovedOptionModule [ "services" "kippo" ] "The corresponding package was removed from nixpkgs.") + (mkRemovedOptionModule [ "services" "lshd" ] "The corresponding package was removed from nixpkgs as it had no maintainer in Nixpkgs and hasn't seen an upstream release in over a decades.") (mkRemovedOptionModule [ "services" "mailpile" ] "The corresponding package was removed from nixpkgs.") (mkRemovedOptionModule [ "services" "marathon" ] "The corresponding package was removed from nixpkgs.") (mkRemovedOptionModule [ "services" "mathics" ] "The Mathics module has been removed") diff --git a/nixos/modules/services/networking/ssh/lshd.nix b/nixos/modules/services/networking/ssh/lshd.nix deleted file mode 100644 index a833d738f885..000000000000 --- a/nixos/modules/services/networking/ssh/lshd.nix +++ /dev/null @@ -1,187 +0,0 @@ -{ config, lib, pkgs, ... }: - -with lib; - -let - - inherit (pkgs) lsh; - - cfg = config.services.lshd; - -in - -{ - - ###### interface - - options = { - - services.lshd = { - - enable = mkOption { - type = types.bool; - default = false; - description = '' - Whether to enable the GNU lshd SSH2 daemon, which allows - secure remote login. - ''; - }; - - portNumber = mkOption { - default = 22; - type = types.port; - description = '' - The port on which to listen for connections. - ''; - }; - - interfaces = mkOption { - default = []; - type = types.listOf types.str; - description = '' - List of network interfaces where listening for connections. - When providing the empty list, `[]`, lshd listens on all - network interfaces. - ''; - example = [ "localhost" "1.2.3.4:443" ]; - }; - - hostKey = mkOption { - default = "/etc/lsh/host-key"; - type = types.str; - description = '' - Path to the server's private key. Note that this key must - have been created, e.g., using "lsh-keygen --server | - lsh-writekey --server", so that you can run lshd. - ''; - }; - - syslog = mkOption { - type = types.bool; - default = true; - description = "Whether to enable syslog output."; - }; - - passwordAuthentication = mkOption { - type = types.bool; - default = true; - description = "Whether to enable password authentication."; - }; - - publicKeyAuthentication = mkOption { - type = types.bool; - default = true; - description = "Whether to enable public key authentication."; - }; - - rootLogin = mkOption { - type = types.bool; - default = false; - description = "Whether to enable remote root login."; - }; - - loginShell = mkOption { - default = null; - type = types.nullOr types.str; - description = '' - If non-null, override the default login shell with the - specified value. - ''; - example = "/nix/store/xyz-bash-10.0/bin/bash10"; - }; - - srpKeyExchange = mkOption { - default = false; - type = types.bool; - description = '' - Whether to enable SRP key exchange and user authentication. - ''; - }; - - tcpForwarding = mkOption { - type = types.bool; - default = true; - description = "Whether to enable TCP/IP forwarding."; - }; - - x11Forwarding = mkOption { - type = types.bool; - default = true; - description = "Whether to enable X11 forwarding."; - }; - - subsystems = mkOption { - type = types.listOf types.path; - description = '' - List of subsystem-path pairs, where the head of the pair - denotes the subsystem name, and the tail denotes the path to - an executable implementing it. - ''; - }; - - }; - - }; - - - ###### implementation - - config = mkIf cfg.enable { - - services.lshd.subsystems = [ ["sftp" "${pkgs.lsh}/sbin/sftp-server"] ]; - - systemd.services.lshd = { - description = "GNU lshd SSH2 daemon"; - - after = [ "network.target" ]; - - wantedBy = [ "multi-user.target" ]; - - environment = { - LD_LIBRARY_PATH = config.system.nssModules.path; - }; - - preStart = '' - test -d /etc/lsh || mkdir -m 0755 -p /etc/lsh - test -d /var/spool/lsh || mkdir -m 0755 -p /var/spool/lsh - - if ! test -f /var/spool/lsh/yarrow-seed-file - then - # XXX: It would be nice to provide feedback to the - # user when this fails, so that they can retry it - # manually. - ${lsh}/bin/lsh-make-seed --sloppy \ - -o /var/spool/lsh/yarrow-seed-file - fi - - if ! test -f "${cfg.hostKey}" - then - ${lsh}/bin/lsh-keygen --server | \ - ${lsh}/bin/lsh-writekey --server -o "${cfg.hostKey}" - fi - ''; - - script = with cfg; '' - ${lsh}/sbin/lshd --daemonic \ - --password-helper="${lsh}/sbin/lsh-pam-checkpw" \ - -p ${toString portNumber} \ - ${optionalString (interfaces != []) (concatStrings (map (i: "--interface=\"${i}\"") interfaces))} \ - -h "${hostKey}" \ - ${optionalString (!syslog) "--no-syslog" } \ - ${if passwordAuthentication then "--password" else "--no-password" } \ - ${if publicKeyAuthentication then "--publickey" else "--no-publickey" } \ - ${if rootLogin then "--root-login" else "--no-root-login" } \ - ${optionalString (loginShell != null) "--login-shell=\"${loginShell}\"" } \ - ${if srpKeyExchange then "--srp-keyexchange" else "--no-srp-keyexchange" } \ - ${if !tcpForwarding then "--no-tcpip-forward" else "--tcpip-forward"} \ - ${if x11Forwarding then "--x11-forward" else "--no-x11-forward" } \ - --subsystems=${concatStringsSep "," - (map (pair: (head pair) + "=" + - (head (tail pair))) - subsystems)} - ''; - }; - - security.pam.services.lshd = {}; - }; -} diff --git a/pkgs/development/libraries/liboop/default.nix b/pkgs/development/libraries/liboop/default.nix deleted file mode 100644 index 7a5d38db0d36..000000000000 --- a/pkgs/development/libraries/liboop/default.nix +++ /dev/null @@ -1,18 +0,0 @@ -{lib, stdenv, fetchurl}: - -stdenv.mkDerivation { - pname = "liboop"; - version = "1.0"; - - src = fetchurl { - url = "http://download.ofb.net/liboop/liboop.tar.gz"; - sha256 = "34d83c6e0f09ee15cb2bc3131e219747c3b612bb57cf7d25318ab90da9a2d97c"; - }; - - meta = { - description = "Event loop library"; - homepage = "http://liboop.ofb.net/"; - license = "LGPL"; - platforms = lib.platforms.linux; - }; -} diff --git a/pkgs/tools/networking/lsh/default.nix b/pkgs/tools/networking/lsh/default.nix deleted file mode 100644 index f5fc34487aa1..000000000000 --- a/pkgs/tools/networking/lsh/default.nix +++ /dev/null @@ -1,58 +0,0 @@ -{ lib, stdenv, fetchurl, gperf, guile, gmp, zlib, liboop, readline, gnum4, pam -, nettools, lsof, procps, libxcrypt }: - -stdenv.mkDerivation rec { - pname = "lsh"; - version = "2.0.4"; - - src = fetchurl { - url = "mirror://gnu/lsh/lsh-${version}.tar.gz"; - sha256 = "614b9d63e13ad3e162c82b6405d1f67713fc622a8bc11337e72949d613713091"; - }; - - patches = [ ./pam-service-name.patch ./lshd-no-root-login.patch ]; - - preConfigure = '' - # Patch `lsh-make-seed' so that it can gather enough entropy. - sed -i "src/lsh-make-seed.c" \ - -e "s|/usr/sbin/arp|${nettools}/sbin/arp|g ; - s|/usr/bin/netstat|${nettools}/bin/netstat|g ; - s|/usr/local/bin/lsof|${lsof}/bin/lsof|g ; - s|/bin/vmstat|${procps}/bin/vmstat|g ; - s|/bin/ps|${procps}/bin/sp|g ; - s|/usr/bin/w|${procps}/bin/w|g ; - s|/usr/bin/df|$(type -P df)|g ; - s|/usr/bin/ipcs|$(type -P ipcs)|g ; - s|/usr/bin/uptime|$(type -P uptime)|g" - - # Skip the `configure' script that checks whether /dev/ptmx & co. work as - # expected, because it relies on impurities (for instance, /dev/pts may - # be unavailable in chroots.) - export lsh_cv_sys_unix98_ptys=yes - ''; - - # -fcommon: workaround build failure on -fno-common toolchains like upstream - # gcc-10. Otherwise build fails as: - # ld: liblsh.a(unix_user.o):/build/lsh-2.0.4/src/server_userauth.h:108: multiple definition of - # `server_userauth_none_preauth'; lshd.o:/build/lsh-2.0.4/src/server_userauth.h:108: first defined here - # Should be present in upcoming 2.1 release. - env.NIX_CFLAGS_COMPILE = "-std=gnu90 -fcommon"; - - buildInputs = [ gperf guile gmp zlib liboop readline gnum4 pam libxcrypt ]; - - meta = { - description = "GPL'd implementation of the SSH protocol"; - - longDescription = '' - lsh is a free implementation (in the GNU sense) of the ssh - version 2 protocol, currently being standardised by the IETF - SECSH working group. - ''; - - homepage = "http://www.lysator.liu.se/~nisse/lsh/"; - license = lib.licenses.gpl2Plus; - - maintainers = [ ]; - platforms = [ "x86_64-linux" ]; - }; -} diff --git a/pkgs/tools/networking/lsh/lshd-no-root-login.patch b/pkgs/tools/networking/lsh/lshd-no-root-login.patch deleted file mode 100644 index 9dd81de3fbc1..000000000000 --- a/pkgs/tools/networking/lsh/lshd-no-root-login.patch +++ /dev/null @@ -1,16 +0,0 @@ -Correctly handle the `--no-root-login' option. - ---- lsh-2.0.4/src/lshd.c 2006-05-01 13:47:44.000000000 +0200 -+++ lsh-2.0.4/src/lshd.c 2009-09-08 12:20:36.000000000 +0200 -@@ -758,6 +758,10 @@ main_argp_parser(int key, char *arg, str - self->allow_root = 1; - break; - -+ case OPT_NO_ROOT_LOGIN: -+ self->allow_root = 0; -+ break; -+ - case OPT_KERBEROS_PASSWD: - self->pw_helper = PATH_KERBEROS_HELPER; - break; - diff --git a/pkgs/tools/networking/lsh/pam-service-name.patch b/pkgs/tools/networking/lsh/pam-service-name.patch deleted file mode 100644 index 6a6156855c51..000000000000 --- a/pkgs/tools/networking/lsh/pam-service-name.patch +++ /dev/null @@ -1,14 +0,0 @@ -Tell `lsh-pam-checkpw', the PAM password helper program, to use a more -descriptive service name. - ---- lsh-2.0.4/src/lsh-pam-checkpw.c 2003-02-16 22:30:10.000000000 +0100 -+++ lsh-2.0.4/src/lsh-pam-checkpw.c 2008-11-28 16:16:58.000000000 +0100 -@@ -38,7 +38,7 @@ - #include - - #define PWD_MAXLEN 1024 --#define SERVICE_NAME "other" -+#define SERVICE_NAME "lshd" - #define TIMEOUT 600 - - static int diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix index bcbb1f2e7b94..502ba2156d20 100644 --- a/pkgs/top-level/aliases.nix +++ b/pkgs/top-level/aliases.nix @@ -766,6 +766,7 @@ mapAliases ({ libjpeg_drop = libjpeg_original; # Added 2020-06-05 liblastfm = libsForQt5.liblastfm; # Added 2020-06-14 libmongo-client = throw "'libmongo-client' has been removed, upstream gone"; # Added 2023-06-22 + liboop = throw "liboop has been removed as it is unmaintained upstream."; # Added 2024-08-14 libpulseaudio-vanilla = libpulseaudio; # Added 2022-04-20 libquotient = libsForQt5.libquotient; # Added 2023-11-11 librarian-puppet-go = throw "'librarian-puppet-go' has been removed, as it's upstream is unmaintained"; # Added 2024-06-10 @@ -911,6 +912,7 @@ mapAliases ({ llvm_11 = throw "llvm_11 has been removed from nixpkgs"; # Added 2024-01-24 lobster-two = google-fonts; # Added 2021-07-22 + lsh = throw "lsh has been removed as it had no maintainer in Nixpkgs and hasn't seen an upstream release in over a decade"; # Added 2024-08-14 luxcorerender = throw "'luxcorerender' has been removed as it's unmaintained and broken in nixpkgs since a while ago"; # Added 2023-06-07 lv_img_conv = throw "'lv_img_conv' has been removed from nixpkgs as it is broken"; # Added 2024-06-18 lxd = lib.warn "lxd has been renamed to lxd-lts" lxd-lts; # Added 2024-04-01 diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 3212fea5c7fc..c6d1116db509 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -10140,10 +10140,6 @@ with pkgs; lsb-release = callPackage ../os-specific/linux/lsb-release { }; - # lsh installs `bin/nettle-lfib-stream' and so does Nettle. Give the - # former a lower priority than Nettle. - lsh = lowPrio (callPackage ../tools/networking/lsh { }); - lunatic = callPackage ../development/interpreters/lunatic { }; lux = callPackage ../tools/video/lux { }; @@ -22068,8 +22064,6 @@ with pkgs; libomxil-bellagio = callPackage ../development/libraries/libomxil-bellagio { }; - liboop = callPackage ../development/libraries/liboop { }; - libopenaptx = callPackage ../development/libraries/libopenaptx { }; libopenglrecorder = callPackage ../development/libraries/libopenglrecorder { }; diff --git a/pkgs/top-level/release-small.nix b/pkgs/top-level/release-small.nix index 0212464acb62..57c07c1bde4c 100644 --- a/pkgs/top-level/release-small.nix +++ b/pkgs/top-level/release-small.nix @@ -82,7 +82,6 @@ in libxml2 = all; libxslt = all; lout = linux; - lsh = linux; lsof = linux; ltrace = linux; lvm2 = linux;