Subject: OpenSSH installation from package source
To: packages@netbsd.org, tech-security <tech-security@netbsd.org>
From: Ing.,BcA. Ivan Dolezal <ivan.dolezal@vsb.cz>
List: tech-security
Date: 07/01/2002 13:36:07
Hello,

    I don't know whether you take this for a bug or a feature, but...

I was running OpenSSH since 1.5.2 installation. This was running from 
/usr/sbin/sshd , which is OpenSSH_2.5.1

After reinstalling the package I found out that the new version 
installed itself into /usr/pkg/sbin/sshd, not replacing the one in 
/usr/sbin/sshd. It didn't change the /etc/rc.d/sshd. It didn't adopt the 
old configuration file and keys. In other words: it was just a dead 
installation.

Unfortunately, it didn't even bother to give any warning that simple 
restarting with the /etc/rc.d/sshd definitely is not a sufficient action 
and that very explicit manual changes are required in order to switch to 
the new version.

IMHO: what if `make install' of this package just renamed the old files 
to some sshd.original, sshd_config.original etc. and softlinked into 
/usr/pkg/sbin, /usr/pkg/etc ... ?