Increase ServerKeyBits value in package-generated sshd_config to 1024

(closes: #727622, LP: #1244272).

1 files changed, 14 insertions, 1 deletions

diff --git a/debian/openssh-server.postinst b/debian/openssh-server.postinst
index 24d9a2c93..54dbe13a2 100644
--- a/debian/openssh-server.postinst
+++ b/debian/openssh-server.postinst
@@ -131,6 +131,13 @@ fix_loglevel_silent() {
 }
 
 
+update_server_key_bits() {
+        if [ "$(get_config_option ServerKeyBits)" = 768 ]; then
+                set_config_option ServerKeyBits 1024
+        fi
+}
+
+
 create_sshdconfig() {
         if [ -e /etc/ssh/sshd_config ] ; then
             # Upgrade an existing sshd configuration.
@@ -146,6 +153,12 @@ create_sshdconfig() {
                 fix_loglevel_silent
             fi
 
+            # Changed upstream in 5.1p1, but we forgot to update the
+            # package-generated configuration file until now.
+            if dpkg --compare-versions "$oldversion" lt 1:6.4p1-2; then
+                update_server_key_bits
+            fi
+
             return 0
         fi
 
@@ -168,7 +181,7 @@ UsePrivilegeSeparation yes
 
 # Lifetime and size of ephemeral version 1 server key
 KeyRegenerationInterval 3600
-ServerKeyBits 768
+ServerKeyBits 1024
 
 # Logging
 SyslogFacility AUTH