Start handling /etc/ssh/sshd_config using ucf.

* Start handling /etc/ssh/sshd_config using ucf.  The immediate motivation
  for this is to deal with deprecations of options related to protocol 1,
  but something like this has been needed for a long time (closes:
  #419574, #848089):
  - sshd_config is now a slightly-patched version of upstream's, and only
    contains non-default settings (closes: #147201).
  - I've included as many historical md5sums of default versions of
    sshd_config as I could reconstruct from version control, but I'm sure
    I've missed some.
  - Explicitly synchronise the debconf database with the current
    configuration file state in openssh-server.config, to ensure that the
    PermitRootLogin setting is properly preserved.
  - UsePrivilegeSeparation now defaults to the stronger "sandbox" rather
    than "yes", per upstream.

1 files changed, 12 insertions, 1 deletions

diff --git a/debian/openssh-server.config b/debian/openssh-server.config
index dbde2cbb0..67a074ec2 100644
--- a/debian/openssh-server.config
+++ b/debian/openssh-server.config
@@ -16,8 +16,19 @@ get_config_option() {
            /etc/ssh/sshd_config 2>/dev/null
 }
 
+permit_root_login="$(get_config_option PermitRootLogin)"
+if [ -f /etc/ssh/sshd_config ]; then
+        # Make sure the debconf database is in sync with the current state
+        # of the system.
+        if [ "$permit_root_login" = yes ]; then
+                db_set openssh-server/permit-root-login false
+        else
+                db_set openssh-server/permit-root-login true
+        fi
+fi
+
 if dpkg --compare-versions "$2" lt-nl 1:6.6p1-1 && \
-   [ "$(get_config_option PermitRootLogin)" = yes ]; then
+   [ "$permit_root_login" = yes ]; then
         if [ "$(getent shadow root | cut -d: -f2)" = "!" ]; then
                 db_set openssh-server/permit-root-login true
         else