diff options
Diffstat (limited to 'contrib/cygwin/ssh-host-config')
-rw-r--r-- | contrib/cygwin/ssh-host-config | 222 |
1 files changed, 157 insertions, 65 deletions
diff --git a/contrib/cygwin/ssh-host-config b/contrib/cygwin/ssh-host-config index da6011267..4df5aa969 100644 --- a/contrib/cygwin/ssh-host-config +++ b/contrib/cygwin/ssh-host-config | |||
@@ -18,6 +18,11 @@ progname=$0 | |||
18 | auto_answer="" | 18 | auto_answer="" |
19 | port_number=22 | 19 | port_number=22 |
20 | 20 | ||
21 | privsep_configured=no | ||
22 | privsep_used=yes | ||
23 | sshd_in_passwd=no | ||
24 | sshd_in_sam=no | ||
25 | |||
21 | request() | 26 | request() |
22 | { | 27 | { |
23 | if [ "${auto_answer}" = "yes" ] | 28 | if [ "${auto_answer}" = "yes" ] |
@@ -90,6 +95,10 @@ do | |||
90 | esac | 95 | esac |
91 | done | 96 | done |
92 | 97 | ||
98 | # Check if running on NT | ||
99 | _sys="`uname -a`" | ||
100 | _nt=`expr "$_sys" : "CYGWIN_NT"` | ||
101 | |||
93 | # Check for running ssh/sshd processes first. Refuse to do anything while | 102 | # Check for running ssh/sshd processes first. Refuse to do anything while |
94 | # some ssh processes are still running | 103 | # some ssh processes are still running |
95 | 104 | ||
@@ -98,7 +107,7 @@ then | |||
98 | echo | 107 | echo |
99 | echo "There are still ssh processes running. Please shut them down first." | 108 | echo "There are still ssh processes running. Please shut them down first." |
100 | echo | 109 | echo |
101 | #exit 1 | 110 | exit 1 |
102 | fi | 111 | fi |
103 | 112 | ||
104 | # Check for ${SYSCONFDIR} directory | 113 | # Check for ${SYSCONFDIR} directory |
@@ -126,6 +135,39 @@ then | |||
126 | fi | 135 | fi |
127 | fi | 136 | fi |
128 | 137 | ||
138 | # Create /var/log and /var/log/lastlog if not already existing | ||
139 | |||
140 | if [ -f /var/log ] | ||
141 | then | ||
142 | echo "Creating /var/log failed\!" | ||
143 | else | ||
144 | if [ ! -d /var/log ] | ||
145 | then | ||
146 | mkdir -p /var/log | ||
147 | fi | ||
148 | if [ -d /var/log/lastlog ] | ||
149 | then | ||
150 | echo "Creating /var/log/lastlog failed\!" | ||
151 | elif [ ! -f /var/log/lastlog ] | ||
152 | then | ||
153 | cat /dev/null > /var/log/lastlog | ||
154 | fi | ||
155 | fi | ||
156 | |||
157 | # Create /var/empty file used as chroot jail for privilege separation | ||
158 | if [ -f /var/empty ] | ||
159 | then | ||
160 | echo "Creating /var/empty failed\!" | ||
161 | else | ||
162 | mkdir -p /var/empty | ||
163 | # On NT change ownership of that dir to user "system" | ||
164 | if [ $_nt -gt 0 ] | ||
165 | then | ||
166 | chmod 755 /var/empty | ||
167 | chown system.system /var/empty | ||
168 | fi | ||
169 | fi | ||
170 | |||
129 | # Check for an old installation in ${OLDPREFIX} unless ${OLDPREFIX} isn't | 171 | # Check for an old installation in ${OLDPREFIX} unless ${OLDPREFIX} isn't |
130 | # the same as ${PREFIX} | 172 | # the same as ${PREFIX} |
131 | 173 | ||
@@ -219,9 +261,10 @@ if [ ! -f "${SYSCONFDIR}/ssh_config" ] | |||
219 | then | 261 | then |
220 | echo "Generating ${SYSCONFDIR}/ssh_config file" | 262 | echo "Generating ${SYSCONFDIR}/ssh_config file" |
221 | cat > ${SYSCONFDIR}/ssh_config << EOF | 263 | cat > ${SYSCONFDIR}/ssh_config << EOF |
222 | # This is ssh client systemwide configuration file. This file provides | 264 | # This is the ssh client system-wide configuration file. See |
223 | # defaults for users, and the values can be changed in per-user configuration | 265 | # ssh_config(5) for more information. This file provides defaults for |
224 | # files or on the command line. | 266 | # users, and the values can be changed in per-user configuration files |
267 | # or on the command line. | ||
225 | 268 | ||
226 | # Configuration data is parsed as follows: | 269 | # Configuration data is parsed as follows: |
227 | # 1. command line options | 270 | # 1. command line options |
@@ -237,20 +280,19 @@ then | |||
237 | # ForwardAgent no | 280 | # ForwardAgent no |
238 | # ForwardX11 no | 281 | # ForwardX11 no |
239 | # RhostsAuthentication no | 282 | # RhostsAuthentication no |
240 | # RhostsRSAAuthentication yes | 283 | # RhostsRSAAuthentication no |
241 | # RSAAuthentication yes | 284 | # RSAAuthentication yes |
242 | # PasswordAuthentication yes | 285 | # PasswordAuthentication yes |
243 | # FallBackToRsh no | ||
244 | # UseRsh no | ||
245 | # BatchMode no | 286 | # BatchMode no |
246 | # CheckHostIP yes | 287 | # CheckHostIP yes |
247 | # StrictHostKeyChecking yes | 288 | # StrictHostKeyChecking ask |
248 | # IdentityFile ~/.ssh/identity | 289 | # IdentityFile ~/.ssh/identity |
249 | # IdentityFile ~/.ssh/id_dsa | 290 | # IdentityFile ~/.ssh/id_dsa |
250 | # IdentityFile ~/.ssh/id_rsa | 291 | # IdentityFile ~/.ssh/id_rsa |
251 | # Port 22 | 292 | # Port 22 |
252 | # Protocol 2,1 | 293 | # Protocol 2,1 |
253 | # Cipher blowfish | 294 | # Cipher 3des |
295 | # Ciphers aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc | ||
254 | # EscapeChar ~ | 296 | # EscapeChar ~ |
255 | EOF | 297 | EOF |
256 | if [ "$port_number" != "22" ] | 298 | if [ "$port_number" != "22" ] |
@@ -271,17 +313,75 @@ then | |||
271 | then | 313 | then |
272 | echo "Can't overwrite. ${SYSCONFDIR}/sshd_config is write protected." | 314 | echo "Can't overwrite. ${SYSCONFDIR}/sshd_config is write protected." |
273 | fi | 315 | fi |
316 | else | ||
317 | grep -q UsePrivilegeSeparation ${SYSCONFDIR}/sshd_config && privsep_configured=yes | ||
274 | fi | 318 | fi |
275 | fi | 319 | fi |
276 | 320 | ||
277 | # Create default sshd_config from here script | 321 | # Prior to creating or modifying sshd_config, care for privilege separation |
322 | |||
323 | if [ "$privsep_configured" != "yes" ] | ||
324 | then | ||
325 | if [ $_nt -gt 0 ] | ||
326 | then | ||
327 | echo "Privilege separation is set to yes by default since OpenSSH 3.3." | ||
328 | echo "However, this requires a non-privileged account called 'sshd'." | ||
329 | echo "For more info on privilege separation read /usr/doc/openssh/README.privsep." | ||
330 | echo | ||
331 | if request "Shall privilege separation be used?" | ||
332 | then | ||
333 | privsep_used=yes | ||
334 | grep -q '^sshd:' ${SYSCONFDIR}/passwd && sshd_in_passwd=yes | ||
335 | net user sshd >/dev/null 2>&1 && sshd_in_sam=yes | ||
336 | if [ "$sshd_in_passwd" != "yes" ] | ||
337 | then | ||
338 | if [ "$sshd_in_sam" != "yes" ] | ||
339 | then | ||
340 | echo "Warning: The following function requires administrator privileges!" | ||
341 | if request "Shall this script create a local user 'sshd' on this machine?" | ||
342 | then | ||
343 | dos_var_empty=`cygpath -w /var/empty` | ||
344 | net user sshd /add /fullname:"sshd privsep" "/homedir:$dos_var_empty" /active:no > /dev/null 2>&1 && sshd_in_sam=yes | ||
345 | if [ "$sshd_in_sam" != "yes" ] | ||
346 | then | ||
347 | echo "Warning: Creating the user 'sshd' failed!" | ||
348 | fi | ||
349 | fi | ||
350 | fi | ||
351 | if [ "$sshd_in_sam" != "yes" ] | ||
352 | then | ||
353 | echo "Warning: Can't create user 'sshd' in ${SYSCONFDIR}/passwd!" | ||
354 | echo " Privilege separation set to 'no' again!" | ||
355 | echo " Check your ${SYSCONFDIR}/sshd_config file!" | ||
356 | privsep_used=no | ||
357 | else | ||
358 | mkpasswd -l -u sshd | sed -e 's/bash$/false/' >> ${SYSCONFDIR}/passwd | ||
359 | fi | ||
360 | fi | ||
361 | else | ||
362 | privsep_used=no | ||
363 | fi | ||
364 | else | ||
365 | # On 9x don't use privilege separation. Since security isn't | ||
366 | # available it just adds useless addtional processes. | ||
367 | privsep_used=no | ||
368 | fi | ||
369 | fi | ||
370 | |||
371 | # Create default sshd_config from here script or modify to add the | ||
372 | # missing privsep configuration option | ||
278 | 373 | ||
279 | if [ ! -f "${SYSCONFDIR}/sshd_config" ] | 374 | if [ ! -f "${SYSCONFDIR}/sshd_config" ] |
280 | then | 375 | then |
281 | echo "Generating ${SYSCONFDIR}/sshd_config file" | 376 | echo "Generating ${SYSCONFDIR}/sshd_config file" |
282 | cat > ${SYSCONFDIR}/sshd_config << EOF | 377 | cat > ${SYSCONFDIR}/sshd_config << EOF |
283 | # This is the sshd server system-wide configuration file. See sshd(8) | 378 | # This is the sshd server system-wide configuration file. See |
284 | # for more information. | 379 | # sshd_config(5) for more information. |
380 | |||
381 | # The strategy used for options in the default sshd_config shipped with | ||
382 | # OpenSSH is to specify options with their default value where | ||
383 | # possible, but leave them commented. Uncommented options change a | ||
384 | # default value. | ||
285 | 385 | ||
286 | Port $port_number | 386 | Port $port_number |
287 | #Protocol 2,1 | 387 | #Protocol 2,1 |
@@ -289,66 +389,77 @@ Port $port_number | |||
289 | #ListenAddress :: | 389 | #ListenAddress :: |
290 | 390 | ||
291 | # HostKey for protocol version 1 | 391 | # HostKey for protocol version 1 |
292 | HostKey /etc/ssh_host_key | 392 | #HostKey ${SYSCONFDIR}/ssh_host_key |
293 | # HostKeys for protocol version 2 | 393 | # HostKeys for protocol version 2 |
294 | HostKey /etc/ssh_host_rsa_key | 394 | #HostKey ${SYSCONFDIR}/ssh_host_rsa_key |
295 | HostKey /etc/ssh_host_dsa_key | 395 | #HostKey ${SYSCONFDIR}/ssh_host_dsa_key |
296 | 396 | ||
297 | # Lifetime and size of ephemeral version 1 server ke | 397 | # Lifetime and size of ephemeral version 1 server ke |
298 | KeyRegenerationInterval 3600 | 398 | #KeyRegenerationInterval 3600 |
299 | ServerKeyBits 768 | 399 | #ServerKeyBits 768 |
300 | 400 | ||
301 | # Logging | 401 | # Logging |
302 | SyslogFacility AUTH | ||
303 | LogLevel INFO | ||
304 | #obsoletes QuietMode and FascistLogging | 402 | #obsoletes QuietMode and FascistLogging |
403 | #SyslogFacility AUTH | ||
404 | #LogLevel INFO | ||
305 | 405 | ||
306 | # Authentication: | 406 | # Authentication: |
307 | 407 | ||
308 | LoginGraceTime 600 | 408 | #LoginGraceTime 600 |
309 | PermitRootLogin yes | 409 | #PermitRootLogin yes |
310 | # The following setting overrides permission checks on host key files | 410 | # The following setting overrides permission checks on host key files |
311 | # and directories. For security reasons set this to "yes" when running | 411 | # and directories. For security reasons set this to "yes" when running |
312 | # NT/W2K, NTFS and CYGWIN=ntsec. | 412 | # NT/W2K, NTFS and CYGWIN=ntsec. |
313 | StrictModes no | 413 | StrictModes no |
314 | 414 | ||
315 | RSAAuthentication yes | 415 | #RSAAuthentication yes |
316 | PubkeyAuthentication yes | 416 | #PubkeyAuthentication yes |
317 | #AuthorizedKeysFile %h/.ssh/authorized_keys | 417 | #AuthorizedKeysFile %h/.ssh/authorized_keys |
318 | 418 | ||
319 | # rhosts authentication should not be used | 419 | # rhosts authentication should not be used |
320 | RhostsAuthentication no | 420 | #RhostsAuthentication no |
321 | # Don't read ~/.rhosts and ~/.shosts files | 421 | # Don't read ~/.rhosts and ~/.shosts files |
322 | IgnoreRhosts yes | 422 | #IgnoreRhosts yes |
323 | # For this to work you will also need host keys in /etc/ssh_known_hosts | 423 | # For this to work you will also need host keys in ${SYSCONFDIR}/ssh_known_hosts |
324 | RhostsRSAAuthentication no | 424 | #RhostsRSAAuthentication no |
325 | # similar for protocol version 2 | 425 | # similar for protocol version 2 |
326 | HostbasedAuthentication no | 426 | #HostbasedAuthentication no |
327 | # Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication | 427 | # Change to yes if you don't trust ~/.ssh/known_hosts for |
328 | #IgnoreUserKnownHosts yes | 428 | # RhostsRSAAuthentication and HostbasedAuthentication |
429 | #IgnoreUserKnownHosts no | ||
329 | 430 | ||
330 | # To disable tunneled clear text passwords, change to no here! | 431 | # To disable tunneled clear text passwords, change to no here! |
331 | PasswordAuthentication yes | 432 | #PasswordAuthentication yes |
332 | PermitEmptyPasswords no | 433 | #PermitEmptyPasswords no |
333 | 434 | ||
334 | X11Forwarding no | 435 | # Change to no to disable s/key passwords |
335 | X11DisplayOffset 10 | 436 | #ChallengeResponseAuthentication yes |
336 | PrintMotd yes | 437 | |
337 | #PrintLastLog no | 438 | #X11Forwarding no |
338 | KeepAlive yes | 439 | #X11DisplayOffset 10 |
440 | #X11UseLocalhost yes | ||
441 | #PrintMotd yes | ||
442 | #PrintLastLog yes | ||
443 | #KeepAlive yes | ||
339 | #UseLogin no | 444 | #UseLogin no |
445 | UsePrivilegeSeparation $privsep_used | ||
446 | #Compression yes | ||
340 | 447 | ||
341 | #MaxStartups 10:30:60 | 448 | #MaxStartups 10 |
342 | #Banner /etc/issue.net | 449 | # no default banner path |
343 | #ReverseMappingCheck yes | 450 | #Banner /some/path |
451 | #VerifyReverseMapping no | ||
344 | 452 | ||
453 | # override default of no subsystems | ||
345 | Subsystem sftp /usr/sbin/sftp-server | 454 | Subsystem sftp /usr/sbin/sftp-server |
346 | EOF | 455 | EOF |
456 | elif [ "$privsep_configured" != "yes" ] | ||
457 | then | ||
458 | echo >> ${SYSCONFDIR}/sshd_config | ||
459 | echo "UsePrivilegeSeparation $privsep_used" >> ${SYSCONFDIR}/sshd_config | ||
347 | fi | 460 | fi |
348 | 461 | ||
349 | # Care for services file | 462 | # Care for services file |
350 | _sys="`uname -a`" | ||
351 | _nt=`expr "$_sys" : "CYGWIN_NT"` | ||
352 | if [ $_nt -gt 0 ] | 463 | if [ $_nt -gt 0 ] |
353 | then | 464 | then |
354 | _wservices="${SYSTEMROOT}\\system32\\drivers\\etc\\services" | 465 | _wservices="${SYSTEMROOT}\\system32\\drivers\\etc\\services" |
@@ -403,8 +514,8 @@ umount "${_services}" | |||
403 | umount "${_serv_tmp}" | 514 | umount "${_serv_tmp}" |
404 | 515 | ||
405 | # Care for inetd.conf file | 516 | # Care for inetd.conf file |
406 | _inetcnf="/etc/inetd.conf" | 517 | _inetcnf="${SYSCONFDIR}/inetd.conf" |
407 | _inetcnf_tmp="/etc/inetd.conf.$$" | 518 | _inetcnf_tmp="${SYSCONFDIR}/inetd.conf.$$" |
408 | 519 | ||
409 | if [ -f "${_inetcnf}" ] | 520 | if [ -f "${_inetcnf}" ] |
410 | then | 521 | then |
@@ -442,25 +553,6 @@ then | |||
442 | fi | 553 | fi |
443 | fi | 554 | fi |
444 | 555 | ||
445 | # Create /var/log and /var/log/lastlog if not already existing | ||
446 | |||
447 | if [ -f /var/log ] | ||
448 | then | ||
449 | echo "Creating /var/log failed\!" | ||
450 | else | ||
451 | if [ ! -d /var/log ] | ||
452 | then | ||
453 | mkdir /var/log | ||
454 | fi | ||
455 | if [ -d /var/log/lastlog ] | ||
456 | then | ||
457 | echo "Creating /var/log/lastlog failed\!" | ||
458 | elif [ ! -f /var/log/lastlog ] | ||
459 | then | ||
460 | cat /dev/null > /var/log/lastlog | ||
461 | fi | ||
462 | fi | ||
463 | |||
464 | # On NT ask if sshd should be installed as service | 556 | # On NT ask if sshd should be installed as service |
465 | if [ $_nt -gt 0 ] | 557 | if [ $_nt -gt 0 ] |
466 | then | 558 | then |
@@ -477,7 +569,7 @@ then | |||
477 | [ -z "${_cygwin}" ] && _cygwin="binmode ntsec tty" | 569 | [ -z "${_cygwin}" ] && _cygwin="binmode ntsec tty" |
478 | if cygrunsrv -I sshd -d "CYGWIN sshd" -p /usr/sbin/sshd -a -D -e "CYGWIN=${_cygwin}" | 570 | if cygrunsrv -I sshd -d "CYGWIN sshd" -p /usr/sbin/sshd -a -D -e "CYGWIN=${_cygwin}" |
479 | then | 571 | then |
480 | chown system /etc/ssh* | 572 | chown system ${SYSCONFDIR}/ssh* |
481 | echo | 573 | echo |
482 | echo "The service has been installed under LocalSystem account." | 574 | echo "The service has been installed under LocalSystem account." |
483 | fi | 575 | fi |