Re: bin/60512: sshd: hosts.deny and hosts.allow for NetBSD 10 not working for 11

["Martin Husemann via gnats" <gnats-admin%NetBSD.org@localhost>]

The following reply was made to PR bin/60512; it has been noted by GNATS.

From: Martin Husemann <martin%duskware.de@localhost>
To: gnats-bugs%netbsd.org@localhost
Cc: 
Subject: Re: bin/60512: sshd: hosts.deny and hosts.allow for NetBSD 10 not
 working for 11
Date: Tue, 28 Jul 2026 12:20:15 +0200

 On Tue, Jul 28, 2026 at 08:40:00AM +0000, rokuyama.rk%gmail.com@localhost via gnats wrote:
 > >Fix:
 > If compatibility with NetBSD 10 and prior is important, stop checking
 > hosts_access(3) for __progname == "sshd-session". However, I'm not
 > 100% sure whether this is a safe option...
 
 If that change is not acceptable, this needs to be checked by
 postinstall(8). "postinstall check" could just fail with a message
 pointing the admin at what manual fix would work.
 
 Something like (totally untested):
 
 Index: postinstall.in
 ===================================================================
 RCS file: /cvsroot/src/usr.sbin/postinstall/postinstall.in,v
 retrieving revision 1.72
 diff -u -p -r1.72 postinstall.in
 --- postinstall.in	4 Jun 2025 06:01:59 -0000	1.72
 +++ postinstall.in	28 Jul 2026 10:19:11 -0000
 @@ -2780,6 +2780,36 @@ do_obsolete()
  }
  
  
 +additem sshdhosts "/etc/hosts.* using the right names for sshd"
 +
 +do_sshd_hosts_srrvname()
 +{
 +	local file="$1"
 +
 +	if ! [ -r "$file" ]; then
 +		return 0
 +	fi
 +
 +	${GREP} -q "sshd" "$file"
 +	have_sshd=$?
 +	${GREP} -q "sshd-session" "$file"
 +	have_sshd_session=$?
 +
 +	if ${GREP} -q "sshd" "$file" && ! ${GREP} -q "sshd-session" "$file" then
 +		msg "sshd found in $file, but no sshd-session"
 +		msg "consider copying the former to the latter"
 +		return 1
 +	fi
 +
 +	return 0
 +}
 +
 +do_sshdhosts_allow()
 +{
 +	do_sshd_hosts_srrvname "/etc/hosts.allow"
 +	do_sshd_hosts_srrvname "/etc/hosts.deny"
 +}
 +
  #
  #	end of items
  #	------------
 
 
 
 Martin