diff options
Diffstat (limited to 'debian/openssh-server.postinst')
-rw-r--r-- | debian/openssh-server.postinst | 166 |
1 files changed, 166 insertions, 0 deletions
diff --git a/debian/openssh-server.postinst b/debian/openssh-server.postinst new file mode 100644 index 000000000..f45f5851c --- /dev/null +++ b/debian/openssh-server.postinst | |||
@@ -0,0 +1,166 @@ | |||
1 | #!/bin/sh | ||
2 | set -e | ||
3 | |||
4 | . /usr/share/debconf/confmodule | ||
5 | db_version 2.0 | ||
6 | |||
7 | action="$1" | ||
8 | |||
9 | umask 022 | ||
10 | |||
11 | |||
12 | get_config_option() { | ||
13 | option="$1" | ||
14 | |||
15 | [ -f /etc/ssh/sshd_config ] || return | ||
16 | |||
17 | # TODO: actually only one '=' allowed after option | ||
18 | perl -lne ' | ||
19 | s/[[:space:]]+/ /g; s/[[:space:]]+$//; | ||
20 | print if s/^[[:space:]]*'"$option"'[[:space:]=]+//i' \ | ||
21 | /etc/ssh/sshd_config | ||
22 | } | ||
23 | |||
24 | |||
25 | host_keys_required() { | ||
26 | hostkeys="$(get_config_option HostKey)" | ||
27 | if [ "$hostkeys" ]; then | ||
28 | echo "$hostkeys" | ||
29 | else | ||
30 | # No HostKey directives at all, so the server picks some | ||
31 | # defaults. | ||
32 | echo /etc/ssh/ssh_host_rsa_key | ||
33 | echo /etc/ssh/ssh_host_ecdsa_key | ||
34 | echo /etc/ssh/ssh_host_ed25519_key | ||
35 | fi | ||
36 | } | ||
37 | |||
38 | |||
39 | create_key() { | ||
40 | msg="$1" | ||
41 | shift | ||
42 | hostkeys="$1" | ||
43 | shift | ||
44 | file="$1" | ||
45 | shift | ||
46 | |||
47 | if echo "$hostkeys" | grep -x "$file" >/dev/null && \ | ||
48 | [ ! -f "$file" ] ; then | ||
49 | printf %s "$msg" | ||
50 | ssh-keygen -q -f "$file" -N '' "$@" | ||
51 | echo | ||
52 | if which restorecon >/dev/null 2>&1; then | ||
53 | restorecon "$file" "$file.pub" | ||
54 | fi | ||
55 | ssh-keygen -l -f "$file.pub" | ||
56 | fi | ||
57 | } | ||
58 | |||
59 | |||
60 | create_keys() { | ||
61 | hostkeys="$(host_keys_required)" | ||
62 | |||
63 | create_key "Creating SSH2 RSA key; this may take some time ..." \ | ||
64 | "$hostkeys" /etc/ssh/ssh_host_rsa_key -t rsa | ||
65 | create_key "Creating SSH2 DSA key; this may take some time ..." \ | ||
66 | "$hostkeys" /etc/ssh/ssh_host_dsa_key -t dsa | ||
67 | create_key "Creating SSH2 ECDSA key; this may take some time ..." \ | ||
68 | "$hostkeys" /etc/ssh/ssh_host_ecdsa_key -t ecdsa | ||
69 | create_key "Creating SSH2 ED25519 key; this may take some time ..." \ | ||
70 | "$hostkeys" /etc/ssh/ssh_host_ed25519_key -t ed25519 | ||
71 | } | ||
72 | |||
73 | |||
74 | new_config= | ||
75 | |||
76 | cleanup() { | ||
77 | if [ "$new_config" ]; then | ||
78 | rm -f "$new_config" | ||
79 | fi | ||
80 | } | ||
81 | |||
82 | |||
83 | create_sshdconfig() { | ||
84 | # XXX cjwatson 2016-12-24: This debconf template is very confusingly | ||
85 | # named; its description is "Disable SSH password authentication for | ||
86 | # root?", so true -> prohibit-password (the upstream default), | ||
87 | # false -> yes. | ||
88 | db_get openssh-server/permit-root-login | ||
89 | permit_root_login="$RET" | ||
90 | db_get openssh-server/password-authentication | ||
91 | password_authentication="$RET" | ||
92 | |||
93 | trap cleanup EXIT | ||
94 | new_config="$(mktemp)" | ||
95 | cp -a /usr/share/openssh/sshd_config "$new_config" | ||
96 | if [ "$permit_root_login" != true ]; then | ||
97 | sed -i 's/^#*PermitRootLogin .*/PermitRootLogin yes/' \ | ||
98 | "$new_config" | ||
99 | fi | ||
100 | if [ "$password_authentication" != true ]; then | ||
101 | sed -i 's/^#PasswordAuthentication .*/PasswordAuthentication no/' \ | ||
102 | "$new_config" | ||
103 | fi | ||
104 | mkdir -p /etc/ssh | ||
105 | ucf --three-way --debconf-ok \ | ||
106 | --sum-file /usr/share/openssh/sshd_config.md5sum \ | ||
107 | "$new_config" /etc/ssh/sshd_config | ||
108 | ucfr openssh-server /etc/ssh/sshd_config | ||
109 | } | ||
110 | |||
111 | fix_statoverride() { | ||
112 | # Remove an erronous override for sshd (we should have overridden ssh) | ||
113 | if dpkg-statoverride --list /usr/sbin/sshd >/dev/null; then | ||
114 | dpkg-statoverride --remove /usr/sbin/sshd | ||
115 | fi | ||
116 | } | ||
117 | |||
118 | setup_sshd_user() { | ||
119 | if ! getent passwd sshd >/dev/null; then | ||
120 | adduser --quiet --system --no-create-home --home /run/sshd --shell /usr/sbin/nologin sshd | ||
121 | fi | ||
122 | } | ||
123 | |||
124 | if [ "$action" = configure ]; then | ||
125 | create_sshdconfig | ||
126 | create_keys | ||
127 | fix_statoverride | ||
128 | setup_sshd_user | ||
129 | # Renamed to /etc/ssh/moduli in 2.9.9 (!) | ||
130 | if dpkg --compare-versions "$2" lt-nl 1:4.7p1-1; then | ||
131 | rm -f /etc/ssh/primes | ||
132 | fi | ||
133 | if dpkg --compare-versions "$2" lt-nl 1:5.5p1-6; then | ||
134 | rm -f /run/sshd/.placeholder | ||
135 | fi | ||
136 | if dpkg --compare-versions "$2" lt-nl 1:6.5p1-2 && \ | ||
137 | deb-systemd-helper debian-installed ssh.socket && \ | ||
138 | deb-systemd-helper --quiet was-enabled ssh.service && \ | ||
139 | deb-systemd-helper --quiet was-enabled ssh.socket; then | ||
140 | # 1:6.5p1-1 mistakenly left both ssh.service and ssh.socket | ||
141 | # enabled. | ||
142 | deb-systemd-helper disable ssh.socket >/dev/null || true | ||
143 | fi | ||
144 | if dpkg --compare-versions "$2" lt-nl 1:6.5p1-3 && \ | ||
145 | [ -d /run/systemd/system ]; then | ||
146 | # We must stop the sysvinit-controlled sshd before we can | ||
147 | # restart it under systemd. | ||
148 | start-stop-daemon --stop --quiet --oknodo --pidfile /run/sshd.pid --exec /usr/sbin/sshd || true | ||
149 | fi | ||
150 | if dpkg --compare-versions "$2" lt-nl 1:7.9p1-5 && \ | ||
151 | [ -f /etc/ssh/moduli.dpkg-bak ]; then | ||
152 | # Handle /etc/ssh/moduli being moved from openssh-client to | ||
153 | # openssh-server. If there were no user modifications, then we | ||
154 | # don't need to do anything special here; but if there were, | ||
155 | # then the dpkg-maintscript-helper calls from openssh-client's | ||
156 | # maintainer scripts will have saved the old file as .dpkg-bak, | ||
157 | # which we now move back into place. | ||
158 | mv /etc/ssh/moduli.dpkg-bak /etc/ssh/moduli | ||
159 | fi | ||
160 | fi | ||
161 | |||
162 | #DEBHELPER# | ||
163 | |||
164 | db_stop | ||
165 | |||
166 | exit 0 | ||