summaryrefslogtreecommitdiff
path: root/debian/openssh-server.postinst
diff options
context:
space:
mode:
Diffstat (limited to 'debian/openssh-server.postinst')
-rw-r--r--debian/openssh-server.postinst157
1 files changed, 157 insertions, 0 deletions
diff --git a/debian/openssh-server.postinst b/debian/openssh-server.postinst
new file mode 100644
index 000000000..ae273e9c8
--- /dev/null
+++ b/debian/openssh-server.postinst
@@ -0,0 +1,157 @@
1#!/bin/sh
2set -e
3
4. /usr/share/debconf/confmodule
5db_version 2.0
6
7action="$1"
8oldversion="$2"
9
10umask 022
11
12
13get_config_option() {
14 option="$1"
15
16 [ -f /etc/ssh/sshd_config ] || return
17
18 # TODO: actually only one '=' allowed after option
19 perl -lne '
20 s/[[:space:]]+/ /g; s/[[:space:]]+$//;
21 print if s/^[[:space:]]*'"$option"'[[:space:]=]+//i' \
22 /etc/ssh/sshd_config
23}
24
25
26host_keys_required() {
27 hostkeys="$(get_config_option HostKey)"
28 if [ "$hostkeys" ]; then
29 echo "$hostkeys"
30 else
31 # No HostKey directives at all, so the server picks some
32 # defaults.
33 echo /etc/ssh/ssh_host_rsa_key
34 echo /etc/ssh/ssh_host_ecdsa_key
35 echo /etc/ssh/ssh_host_ed25519_key
36 fi
37}
38
39
40create_key() {
41 msg="$1"
42 shift
43 hostkeys="$1"
44 shift
45 file="$1"
46 shift
47
48 if echo "$hostkeys" | grep -x "$file" >/dev/null && \
49 [ ! -f "$file" ] ; then
50 echo -n $msg
51 ssh-keygen -q -f "$file" -N '' "$@"
52 echo
53 if which restorecon >/dev/null 2>&1; then
54 restorecon "$file" "$file.pub"
55 fi
56 ssh-keygen -l -f "$file.pub"
57 fi
58}
59
60
61create_keys() {
62 hostkeys="$(host_keys_required)"
63
64 create_key "Creating SSH2 RSA key; this may take some time ..." \
65 "$hostkeys" /etc/ssh/ssh_host_rsa_key -t rsa
66 create_key "Creating SSH2 DSA key; this may take some time ..." \
67 "$hostkeys" /etc/ssh/ssh_host_dsa_key -t dsa
68 create_key "Creating SSH2 ECDSA key; this may take some time ..." \
69 "$hostkeys" /etc/ssh/ssh_host_ecdsa_key -t ecdsa
70 create_key "Creating SSH2 ED25519 key; this may take some time ..." \
71 "$hostkeys" /etc/ssh/ssh_host_ed25519_key -t ed25519
72}
73
74
75new_config=
76
77cleanup() {
78 if [ "$new_config" ]; then
79 rm -f "$new_config"
80 fi
81}
82
83
84create_sshdconfig() {
85 # XXX cjwatson 2016-12-24: This debconf template is very confusingly
86 # named; its description is "Disable SSH password authentication for
87 # root?", so true -> prohibit-password (the upstream default),
88 # false -> yes.
89 db_get openssh-server/permit-root-login
90 permit_root_login="$RET"
91 db_get openssh-server/password-authentication
92 password_authentication="$RET"
93
94 trap cleanup EXIT
95 new_config="$(tempfile)"
96 cp -a /usr/share/openssh/sshd_config "$new_config"
97 if [ "$permit_root_login" != true ]; then
98 sed -i 's/^#*PermitRootLogin .*/PermitRootLogin yes/' \
99 "$new_config"
100 fi
101 if [ "$password_authentication" != true ]; then
102 sed -i 's/^#PasswordAuthentication .*/PasswordAuthentication no/' \
103 "$new_config"
104 fi
105 mkdir -p /etc/ssh
106 ucf --three-way --debconf-ok \
107 --sum-file /usr/share/openssh/sshd_config.md5sum \
108 "$new_config" /etc/ssh/sshd_config
109 ucfr openssh-server /etc/ssh/sshd_config
110}
111
112fix_statoverride() {
113# Remove an erronous override for sshd (we should have overridden ssh)
114 if dpkg-statoverride --list /usr/sbin/sshd >/dev/null; then
115 dpkg-statoverride --remove /usr/sbin/sshd
116 fi
117}
118
119setup_sshd_user() {
120 if ! getent passwd sshd >/dev/null; then
121 adduser --quiet --system --no-create-home --home /run/sshd --shell /usr/sbin/nologin sshd
122 fi
123}
124
125if [ "$action" = configure ]; then
126 create_sshdconfig
127 create_keys
128 fix_statoverride
129 setup_sshd_user
130 # Renamed to /etc/ssh/moduli in 2.9.9 (!)
131 if dpkg --compare-versions "$2" lt-nl 1:4.7p1-1; then
132 rm -f /etc/ssh/primes
133 fi
134 if dpkg --compare-versions "$2" lt-nl 1:5.5p1-6; then
135 rm -f /run/sshd/.placeholder
136 fi
137 if dpkg --compare-versions "$2" lt-nl 1:6.5p1-2 && \
138 deb-systemd-helper debian-installed ssh.socket && \
139 deb-systemd-helper --quiet was-enabled ssh.service && \
140 deb-systemd-helper --quiet was-enabled ssh.socket; then
141 # 1:6.5p1-1 mistakenly left both ssh.service and ssh.socket
142 # enabled.
143 deb-systemd-helper disable ssh.socket >/dev/null || true
144 fi
145 if dpkg --compare-versions "$2" lt-nl 1:6.5p1-3 && \
146 [ -d /run/systemd/system ]; then
147 # We must stop the sysvinit-controlled sshd before we can
148 # restart it under systemd.
149 start-stop-daemon --stop --quiet --oknodo --pidfile /run/sshd.pid --exec /usr/sbin/sshd || true
150 fi
151fi
152
153#DEBHELPER#
154
155db_stop
156
157exit 0