[PATCH] introduce vendordir for easier config file update

[Thorsten Kukuk]

Hi,

Distributors have one common problem: configuration files and updates.

If a configuration file is modified by an user and the distributor mades
changes to it, the package manager needs to decide which version of the
configuration file should be used: the one of the admin or the one from
the distributor. Independent of the decission, in worst case the service
is broken until the admin merges the changes manually. Which is not that
problem with a single system, but could be a lot of work for big clusters.

There is now the include statement, which solves already many cases as
the admin could put his changes in an extra file, but there are still
some bigger issues.

As an example for sshd_config: most Linux distributions added meanwhile an
include statement to read at first files from /etc/ssh/sshd_config.d/*
This works fine for directives like 'PermitRootLogin', where the first entry
found wins. But you can have multiple AcceptEnv directives. And there is no
way for an admin to change the distributor default without editing the
config file itself, which again leads to update problems in the future.

With ssh_config it's even more complicated: You can have multiple SendEnv
directives, and you can change them later. This leads now to the situation,
that you need two include directives: one on the beginning of the 
configuration file, which sets variables which could only be set once,
and at the end, to remove and modify SendEnv. I don't know currently if
there are more directives you cannot modify, so that the admin still has
to modify the original file.

I made a relativ small patch, which tries to follow the "systemd" behavior,
which is meanwhile used by many more projects:

- There is a distributor/vendor default configuration file in /usr/share/ssh
- The admin can create his own configuration file in /etc/ssh
- There is still the possibility to use the include statement to only override
  single directives.

So if there is no admin provided configuration file, the vendor file from
/usr/share/ssh is used. If there is an admin provided configuration file
in /etc/ssh, this one will be used by default.

Includes are only used from the configuration file which is really read.
And if a distribution does not like this, it can still only ship the 
configuration files in /etc/ssh and there is no change in behavior.

Attached is a patch which I'm using currently. I would like to see if
upstream openssh would support this.

  Thorsten

-- 
Thorsten Kukuk, Distinguished Engineer, Senior Architect SLES & MicroOS
SUSE Software Solutions Germany GmbH, Maxfeldstr. 5, 90409 Nuernberg, Germany
Managing Director: Felix Imendoerffer (HRB 36809, AG Nürnberg)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: openssh-8.4p1-vendordir.patch
Type: text/x-patch
Size: 5970 bytes
Desc: not available
URL: <http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20210129/02cf31bf/attachment.bin>