Forward-port from HEAD:

  * If PasswordAuthentication is disabled, then offer to disable
    ChallengeResponseAuthentication too. The current PAM code will attempt
    password-style authentication if ChallengeResponseAuthentication is
    enabled (closes: #250369).
  * This will ask a question of anyone who installed fresh with 1:3.8p1-2 or
    later and then upgraded. Sorry about that ... for this reason, the
    default answer is to leave ChallengeResponseAuthentication enabled.

1 files changed, 63 insertions, 19 deletions

diff --git a/debian/openssh-server.postinst b/debian/openssh-server.postinst
index 28af3f490..dab8c94fd 100644
--- a/debian/openssh-server.postinst
+++ b/debian/openssh-server.postinst
@@ -29,12 +29,33 @@ check_idea_key() {
 get_config_option() {
         option="$1"
 
+        [ -f /etc/ssh/sshd_config ] || return
+
         # TODO: actually only one '=' allowed after option
         perl -ne 'print if s/^[[:space:]]*'"$option"'[[:space:]=]+//i' \
            /etc/ssh/sshd_config
 }
 
 
+set_config_option() {
+        option="$1"
+        value="$2"
+
+        perl -e '
+                $option = $ARGV[0]; $value = $ARGV[1]; $done = 0;
+                while (<STDIN>) {
+                        if (s/^\s*\Q$option\E\s+.*/$option $value/) {
+                                $done = 1;
+                        }
+                        print;
+                }
+                print "\n$option $value\n" unless $done;' \
+                "$option" "$value" \
+                < /etc/ssh/sshd_config > /etc/ssh/sshd_config.dpkg-new
+        mv /etc/ssh/sshd_config.dpkg-new /etc/ssh/sshd_config
+}
+
+
 host_keys_required() {
         hostkeys="$(get_config_option HostKey)"
         if [ "$hostkeys" ]; then
@@ -85,31 +106,54 @@ create_keys() {
 }
 
 
+check_password_auth() {
+        passwordauth="$(get_config_option PasswordAuthentication)"
+        crauth="$(get_config_option ChallengeResponseAuthentication)"
+        if [ "$passwordauth" = no ] && \
+           ([ -z "$crauth" ] || [ "$crauth" = yes ]); then
+                db_get ssh/disable_cr_auth
+                if [ "$RET" = true ]; then
+                        set_config_option ChallengeResponseAuthentication no
+                fi
+        fi
+}
+
+
 create_sshdconfig() {
         if [ -e /etc/ssh/sshd_config ] ; then
             if dpkg --compare-versions "$oldversion" lt-nl 1:1.3 ; then
                 db_get ssh/new_config
                 if [ "$RET" = "false" ] ; then return 0; fi
-            elif (dpkg --compare-versions "$oldversion" lt-nl 1:3.8p1-1 && \
-                  ! grep -iq ^UsePAM /etc/ssh/sshd_config) || \
-                 grep -Eiq '^(PAMAuthenticationViaKbdInt|RhostsAuthentication)' \
-                   /etc/ssh/sshd_config ; then
-                # Upgrade from pre-3.7: UsePAM needed to maintain standard
-                # Debian configuration.
-                # Note that --compare-versions is sadly not reliable enough
-                # here due to the package split of ssh into openssh-client
-                # and openssh-server. The extra grep for some deprecated
-                # options should with any luck be a good enough heuristic.
-                echo -n 'Upgrading sshd_config (old version in .dpkg-old) ...'
-                cp -a /etc/ssh/sshd_config /etc/ssh/sshd_config.dpkg-old
-                perl -pe 's/^(PAMAuthenticationViaKbdInt|RhostsAuthentication)\b/#$1/i' \
-                    /etc/ssh/sshd_config > /etc/ssh/sshd_config.dpkg-new
-                echo >> /etc/ssh/sshd_config.dpkg-new
-                echo 'UsePAM yes' >> /etc/ssh/sshd_config.dpkg-new
-                mv /etc/ssh/sshd_config.dpkg-new /etc/ssh/sshd_config
-                echo
+            else
+                # Upgrade sshd configuration from a sane version.
+
+                if (dpkg --compare-versions "$oldversion" lt-nl 1:3.8p1-1 && \
+                    ! grep -iq ^UsePAM /etc/ssh/sshd_config) || \
+                   grep -Eiq '^(PAMAuthenticationViaKbdInt|RhostsAuthentication)' \
+                     /etc/ssh/sshd_config ; then
+                    # Upgrade from pre-3.7: UsePAM needed to maintain standard
+                    # Debian configuration.
+                    # Note that --compare-versions is sadly not reliable enough
+                    # here due to the package split of ssh into openssh-client
+                    # and openssh-server. The extra grep for some deprecated
+                    # options should with any luck be a good enough heuristic.
+                    echo -n 'Upgrading sshd_config (old version in .dpkg-old) ...'
+                    cp -a /etc/ssh/sshd_config /etc/ssh/sshd_config.dpkg-old
+                    perl -pe 's/^(PAMAuthenticationViaKbdInt|RhostsAuthentication)\b/#$1/i' \
+                        /etc/ssh/sshd_config > /etc/ssh/sshd_config.dpkg-new
+                    echo >> /etc/ssh/sshd_config.dpkg-new
+                    echo 'UsePAM yes' >> /etc/ssh/sshd_config.dpkg-new
+                    mv /etc/ssh/sshd_config.dpkg-new /etc/ssh/sshd_config
+                    echo
+                fi
+
+                # An empty version means we're upgrading from before the
+                # package split, so check.
+                if dpkg --compare-versions "$oldversion" lt 1:3.8.1p1-11; then
+                    check_password_auth
+                fi
+
                 return 0
-            else return 0
             fi
         fi