openssh unix dev - Jun 2002 - AIX Package build update.

Hello All,
	I've updated the AIX package builder (contrib/aix/buildbff.sh). The
changes are below. Please review and commit if OK.

	First, a question: Does anyone want SRC (System Resource Controller)
support in the packages? I don't use it but I've been sent an example of
how do do it without modifying sshd itself.

	Onto the changes:

* Supports PrivSep. Postinstall will create privsep user, group and
directory if necessary. NOTE: 3.3p1 has a problem with PrivSep on AIX
(bugids 270 & 283). Until this is fixed I recommend you add
"UsePrivilegeSeparation no" to $srcdir/sshd_config before creating
packages and to any systems you upgrade.

* Supports config.local settings (based on Solaris buildpkg).

* Now runs in build dir, same as buildpkg. Running in contrib/aix still
works.

* Prints a pointer to LICENCE rather than entire text during install.
Includes LICENCE & README's in package.

* Package version generation now handles missing "p" (ie
"3.3").

* Minor fixes (typos, comments).

The patch (against 3.3p1) can be had from:
http://www.zip.com.au/~dtucker/openssh/openssh-3.3p1-aixbff.patch

It has been tested on AIX 4.2.1 and 4.3.3.

		-Daz.
-- 
Darren Tucker (dtucker at zip.com.au)
GPG Fingerprint D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.

I sent the first one privately to Darren, but I think everyone with AIX
(and those WORKING for IBM) should comment on this...

First off I noticed LOGIN= is stated as it should be set, but is not.  Not
an issue for Privsep... but either the manpage needs to be clarified, or
we should add it.


Second, what happens if TTY is always set to null?  Reason being is
privsep occurs long before Session *s; even has a hint of knowing the
current TTY from the looks of it.  And by than we are too late.

Can someone from IBM tell me what ramification setting TTY=null for
userinfo(SETUINFO,..) if the process has a tty?

If there is none worth speaking of we can easily fix privsep for that
platform and have yet another working platform.

PLEASE.. *ASAP* .=)  Clock is ticking. <smile>

- Ben

Ben Lindstrom wrote:
> You do realize that in non-privsep mode that the second call to
> aix_usrinfo() will blow away the tty entry.
Not when I posted it :-).  The second patch does away with the original
call entirely.

		-Daz.