Increase ServerKeyBits value in package-generated sshd_config to 1024

(closes: #727622, LP: #1244272).

2 files changed, 21 insertions, 1 deletions

diff --git a/debian/changelog b/debian/changelog
index 19584e315..99c395769 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+openssh (1:6.4p1-2) UNRELEASED; urgency=low
+
+  * Increase ServerKeyBits value in package-generated sshd_config to 1024
+    (closes: #727622, LP: #1244272).
+
+ -- Colin Watson <cjwatson@debian.org>  Tue, 12 Nov 2013 11:14:41 +0000
+
 openssh (1:6.4p1-1) unstable; urgency=high
 
   * New upstream release.  Important changes:
diff --git a/debian/openssh-server.postinst b/debian/openssh-server.postinst
index 24d9a2c93..54dbe13a2 100644
--- a/debian/openssh-server.postinst
+++ b/debian/openssh-server.postinst
@@ -131,6 +131,13 @@ fix_loglevel_silent() {
 }
 
 
+update_server_key_bits() {
+        if [ "$(get_config_option ServerKeyBits)" = 768 ]; then
+                set_config_option ServerKeyBits 1024
+        fi
+}
+
+
 create_sshdconfig() {
         if [ -e /etc/ssh/sshd_config ] ; then
             # Upgrade an existing sshd configuration.
@@ -146,6 +153,12 @@ create_sshdconfig() {
                 fix_loglevel_silent
             fi
 
+            # Changed upstream in 5.1p1, but we forgot to update the
+            # package-generated configuration file until now.
+            if dpkg --compare-versions "$oldversion" lt 1:6.4p1-2; then
+                update_server_key_bits
+            fi
+
             return 0
         fi
 
@@ -168,7 +181,7 @@ UsePrivilegeSeparation yes
 
 # Lifetime and size of ephemeral version 1 server key
 KeyRegenerationInterval 3600
-ServerKeyBits 768
+ServerKeyBits 1024
 
 # Logging
 SyslogFacility AUTH