* New upstream release (http://www.openssh.org/txt/release-5.9).

  - Introduce sandboxing of the pre-auth privsep child using an optional
    sshd_config(5) "UsePrivilegeSeparation=sandbox" mode that enables
    mandatory restrictions on the syscalls the privsep child can perform.
  - Add new SHA256-based HMAC transport integrity modes from
    http://www.ietf.org/id/draft-dbider-sha2-mac-for-ssh-02.txt.
  - The pre-authentication sshd(8) privilege separation slave process now
    logs via a socket shared with the master process, avoiding the need to
    maintain /dev/log inside the chroot (closes: #75043, #429243,
    #599240).
  - ssh(1) now warns when a server refuses X11 forwarding (closes:
    #504757).
  - sshd_config(5)'s AuthorizedKeysFile now accepts multiple paths,
    separated by whitespace (closes: #76312).  The authorized_keys2
    fallback is deprecated but documented (closes: #560156).
  - ssh(1) and sshd(8): set IPv6 traffic class from IPQoS, as well as IPv4
    ToS/DSCP (closes: #498297).
  - ssh-add(1) now accepts keys piped from standard input.  E.g. "ssh-add
    - < /path/to/key" (closes: #229124).
  - Clean up lost-passphrase text in ssh-keygen(1) (closes: #444691).
  - Say "required" rather than "recommended" in unprotected-private-key
    warning (LP: #663455).

1 files changed, 7 insertions, 64 deletions

diff --git a/contrib/redhat/sshd.init b/contrib/redhat/sshd.init
index 854aff665..2334d8142 100755
--- a/contrib/redhat/sshd.init
+++ b/contrib/redhat/sshd.init
@@ -22,70 +22,9 @@ RETVAL=0
 prog="sshd"
 
 # Some functions to make the below more readable
-KEYGEN=/usr/bin/ssh-keygen
 SSHD=/usr/sbin/sshd
-RSA1_KEY=/etc/ssh/ssh_host_key
-RSA_KEY=/etc/ssh/ssh_host_rsa_key
-DSA_KEY=/etc/ssh/ssh_host_dsa_key
 PID_FILE=/var/run/sshd.pid
 
-do_rsa1_keygen() {
-        if [ ! -s $RSA1_KEY ]; then
-                echo -n $"Generating SSH1 RSA host key: "
-                if $KEYGEN -q -t rsa1 -f $RSA1_KEY -C '' -N '' >&/dev/null; then
-                        chmod 600 $RSA1_KEY
-                        chmod 644 $RSA1_KEY.pub
-                        if [ -x /sbin/restorecon ]; then
-                            /sbin/restorecon $RSA1_KEY.pub
-                        fi
-                        success $"RSA1 key generation"
-                        echo
-                else
-                        failure $"RSA1 key generation"
-                        echo
-                        exit 1
-                fi
-        fi
-}
-
-do_rsa_keygen() {
-        if [ ! -s $RSA_KEY ]; then
-                echo -n $"Generating SSH2 RSA host key: "
-                if $KEYGEN -q -t rsa -f $RSA_KEY -C '' -N '' >&/dev/null; then
-                        chmod 600 $RSA_KEY
-                        chmod 644 $RSA_KEY.pub
-                        if [ -x /sbin/restorecon ]; then
-                            /sbin/restorecon $RSA_KEY.pub
-                        fi
-                        success $"RSA key generation"
-                        echo
-                else
-                        failure $"RSA key generation"
-                        echo
-                        exit 1
-                fi
-        fi
-}
-
-do_dsa_keygen() {
-        if [ ! -s $DSA_KEY ]; then
-                echo -n $"Generating SSH2 DSA host key: "
-                if $KEYGEN -q -t dsa -f $DSA_KEY -C '' -N '' >&/dev/null; then
-                        chmod 600 $DSA_KEY
-                        chmod 644 $DSA_KEY.pub
-                        if [ -x /sbin/restorecon ]; then
-                            /sbin/restorecon $DSA_KEY.pub
-                        fi
-                        success $"DSA key generation"
-                        echo
-                else
-                        failure $"DSA key generation"
-                        echo
-                        exit 1
-                fi
-        fi
-}
-
 do_restart_sanity_check()
 {
         $SSHD -t
@@ -99,9 +38,13 @@ do_restart_sanity_check()
 start()
 {
         # Create keys if necessary
-        do_rsa1_keygen
-        do_rsa_keygen
-        do_dsa_keygen
+        /usr/bin/ssh-keygen -A
+        if [ -x /sbin/restorecon ]; then
+                /sbin/restorcon /etc/ssh/ssh_host_key.pub
+                /sbin/restorcon /etc/ssh/ssh_host_rsa_key.pub
+                /sbin/restorcon /etc/ssh/ssh_host_dsa_key.pub
+                /sbin/restorcon /etc/ssh/ssh_host_ecdsa_key.pub
+        fi
 
         echo -n $"Starting $prog:"
         $SSHD $OPTIONS && success || failure