* Fix GSSAPIKeyExchange configuration file handling logic in ssh-krb5

  (closes: #404863).

1 files changed, 37 insertions, 13 deletions

diff --git a/debian/ssh-krb5.postinst b/debian/ssh-krb5.postinst
index b1bea1e29..89ef8d86e 100644
--- a/debian/ssh-krb5.postinst
+++ b/debian/ssh-krb5.postinst
@@ -14,27 +14,51 @@ if [ "$action" = configure ] ; then
         fi
     fi
 
-    if dpkg --compare-versions "$oldversion" ge 1:4.3p2-7 || \
-       grep -qi '^[     ]*GSSAPI' /etc/ssh/sshd_config ; then
+    # Make sure that GSSAPI is enabled.  If there is no uncommented GSSAPI
+    # configuration, uncomment any commented-out configuration if present
+    # (this will catch the case of a fresh install of openssh-server).
+    # Otherwise, add configuration turning on GSSAPIAuthentication and
+    # GSSAPIKeyExchange.
+    #
+    # If there is some configuration, we may be upgrading from ssh-krb5.  It
+    # enabled GSSAPIKeyExchange without any configuration option.  Therefore,
+    # if it isn't explicitly set, always enable it for compatible behavior
+    # with ssh-krb5.
+    if dpkg --compare-versions "$oldversion" ge 1:4.3p2-9; then
         :
     else
-        if grep -qi '^#GSSAPI' /etc/ssh/sshd_config ; then
-            perl -pe 's/^\#(GSSAPI(Authentication|KeyExchange))\b/$1/i' \
-                < /etc/ssh/sshd_config > /etc/ssh/sshd_config.dpkg-new
-            chown --reference /etc/ssh/sshd_config \
-                /etc/ssh/sshd_config.dpkg-new
-            chmod --reference /etc/ssh/sshd_config \
-                /etc/ssh/sshd_config.dpkg-new
-            mv /etc/ssh/sshd_config.dpkg-new /etc/ssh/sshd_config
+        changed=
+        if grep -qi '^[         ]*GSSAPI' /etc/ssh/sshd_config ; then
+            if grep -qi '^[     ]*GSSAPIKeyExchange' /etc/ssh/sshd_config ; then
+                :
+            else
+                changed=true
+                cat >> /etc/ssh/sshd_config <<EOF
+
+# GSSAPI key exchange (added by ssh-krb5 transitional package)
+GSSAPIKeyExchange yes
+EOF
+            fi
         else
-            cat >> /etc/ssh/sshd_config <<EOF
+            changed=true
+            if grep -qi '^#GSSAPI' /etc/ssh/sshd_config ; then
+                perl -pe 's/^\#(GSSAPI(Authentication|KeyExchange))\b/$1/i' \
+                    < /etc/ssh/sshd_config > /etc/ssh/sshd_config.dpkg-new
+                chown --reference /etc/ssh/sshd_config \
+                    /etc/ssh/sshd_config.dpkg-new
+                chmod --reference /etc/ssh/sshd_config \
+                    /etc/ssh/sshd_config.dpkg-new
+                mv /etc/ssh/sshd_config.dpkg-new /etc/ssh/sshd_config
+            else
+                cat >> /etc/ssh/sshd_config <<EOF
 
-# GSSAPI authentication
+# GSSAPI authentication (added by ssh-krb5 transitional package)
 GSSAPIAuthentication yes
 GSSAPIKeyExchange yes
 EOF
+            fi
         fi
-        if [ -x /etc/init.d/ssh ] ; then
+        if [ -n "$changed" ] && [ -x /etc/init.d/ssh ] ; then
             if [ -x /usr/sbin/invoke-rc.d ] ; then
                 invoke-rc.d ssh restart
             else