Add a heuristic to try to make sure the sshd_config upgrade to >= 3.7

happens even though we don't know what version we're upgrading from.

1 files changed, 8 insertions, 2 deletions

diff --git a/debian/openssh-server.postinst b/debian/openssh-server.postinst
index 64f9985a8..28af3f490 100644
--- a/debian/openssh-server.postinst
+++ b/debian/openssh-server.postinst
@@ -90,10 +90,16 @@ create_sshdconfig() {
             if dpkg --compare-versions "$oldversion" lt-nl 1:1.3 ; then
                 db_get ssh/new_config
                 if [ "$RET" = "false" ] ; then return 0; fi
-            elif dpkg --compare-versions "$oldversion" lt-nl 1:3.8p1-1 && \
-                 ! grep -iq ^UsePAM /etc/ssh/sshd_config ; then
+            elif (dpkg --compare-versions "$oldversion" lt-nl 1:3.8p1-1 && \
+                  ! grep -iq ^UsePAM /etc/ssh/sshd_config) || \
+                 grep -Eiq '^(PAMAuthenticationViaKbdInt|RhostsAuthentication)' \
+                   /etc/ssh/sshd_config ; then
                 # Upgrade from pre-3.7: UsePAM needed to maintain standard
                 # Debian configuration.
+                # Note that --compare-versions is sadly not reliable enough
+                # here due to the package split of ssh into openssh-client
+                # and openssh-server. The extra grep for some deprecated
+                # options should with any luck be a good enough heuristic.
                 echo -n 'Upgrading sshd_config (old version in .dpkg-old) ...'
                 cp -a /etc/ssh/sshd_config /etc/ssh/sshd_config.dpkg-old
                 perl -pe 's/^(PAMAuthenticationViaKbdInt|RhostsAuthentication)\b/#$1/i' \