1 files changed, 16 insertions, 179 deletions

diff --git a/debian/openssh-server.postinst b/debian/openssh-server.postinst
index 5635a60a6..391efc43b 100644
--- a/debian/openssh-server.postinst
+++ b/debian/openssh-server.postinst
@@ -23,56 +23,6 @@ get_config_option() {
 }
 
 
-set_config_option() {
-        option="$1"
-        value="$2"
-
-        perl -le '
-                $option = $ARGV[0]; $value = $ARGV[1]; $done = 0;
-                while (<STDIN>) {
-                        chomp;
-                        (my $match = $_) =~ s/\s+/ /g;
-                        if ($match =~ s/^\s*\Q$option\E\s+.*/$option $value/) {
-                                $_ = $match;
-                                $done = 1;
-                        }
-                        print;
-                }
-                print "$option $value" unless $done;' \
-                "$option" "$value" \
-                < /etc/ssh/sshd_config > /etc/ssh/sshd_config.dpkg-new
-        chown --reference /etc/ssh/sshd_config /etc/ssh/sshd_config.dpkg-new
-        chmod --reference /etc/ssh/sshd_config /etc/ssh/sshd_config.dpkg-new
-        mv /etc/ssh/sshd_config.dpkg-new /etc/ssh/sshd_config
-}
-
-
-rename_config_option() {
-        oldoption="$1"
-        newoption="$2"
-
-        value="$(get_config_option "$oldoption")"
-        [ "$value" ] || return 0
-
-        perl -le '
-                $oldoption = $ARGV[0]; $newoption = $ARGV[1];
-                while (<STDIN>) {
-                        chomp;
-                        (my $match = $_) =~ s/\s+/ /g;
-                        # TODO: actually only one "=" allowed after option
-                        if ($match =~ s/^(\s*)\Q$oldoption\E([[:space:]=]+)/$1$newoption$2/i) {
-                                $_ = $match;
-                        }
-                        print;
-                }' \
-                "$oldoption" "$newoption" \
-                < /etc/ssh/sshd_config > /etc/ssh/sshd_config.dpkg-new
-        chown --reference /etc/ssh/sshd_config /etc/ssh/sshd_config.dpkg-new
-        chmod --reference /etc/ssh/sshd_config /etc/ssh/sshd_config.dpkg-new
-        mv /etc/ssh/sshd_config.dpkg-new /etc/ssh/sshd_config
-}
-
-
 host_keys_required() {
         hostkeys="$(get_config_option HostKey)"
         if [ "$hostkeys" ]; then
@@ -122,137 +72,24 @@ create_keys() {
 }
 
 
-fix_loglevel_silent() {
-        if [ "$(get_config_option LogLevel)" = SILENT ]; then
-                set_config_option LogLevel QUIET
-        fi
-}
-
-
-update_server_key_bits() {
-        if [ "$(get_config_option ServerKeyBits)" = 768 ]; then
-                set_config_option ServerKeyBits 1024
-        fi
-}
-
-
 create_sshdconfig() {
-        if [ -e /etc/ssh/sshd_config ] ; then
-            # Upgrade an existing sshd configuration.
-
-            # This option was renamed in 3.8p1, but we never took care
-            # of adjusting the configuration file until now.
-            if dpkg --compare-versions "$oldversion" lt 1:4.7p1-8; then
-                rename_config_option KeepAlive TCPKeepAlive
-            fi
-
-            # 'LogLevel SILENT' is now equivalent to QUIET.
-            if dpkg --compare-versions "$oldversion" lt 1:5.4p1-1; then
-                fix_loglevel_silent
-            fi
-
-            # Changed upstream in 5.1p1, but we forgot to update the
-            # package-generated configuration file until now.
-            if dpkg --compare-versions "$oldversion" lt 1:6.4p1-2; then
-                update_server_key_bits
-            fi
-
-            if dpkg --compare-versions "$2" lt-nl 1:6.6p1-1 && \
-               [ "$(get_config_option PermitRootLogin)" = yes ] &&
-               db_get openssh-server/permit-root-login && [ "$RET" = true ]; then
-                set_config_option PermitRootLogin prohibit-password
-            fi
-
-            if dpkg --compare-versions "$2" lt-nl 1:7.1p1-1 && \
-               [ "$(get_config_option PermitRootLogin)" = without-password ]; then
-                set_config_option PermitRootLogin prohibit-password
-            fi
-
-            return 0
+        # XXX cjwatson 2016-12-24: This debconf template is very confusingly
+        # named; its description is "Disable SSH password authentication for
+        # root?", so true -> prohibit-password (the upstream default),
+        # false -> yes.
+        db_get openssh-server/permit-root-login
+        permit_root_login="$RET"
+
+        new_config="$(tempfile)"
+        cp -a /usr/share/openssh/sshd_config "$new_config"
+        if [ "$permit_root_login" != true ]; then
+                sed -i 's/^#*PermitRootLogin .*/PermitRootLogin yes/' \
+                        "$new_config"
         fi
-
-        cat <<EOF > /etc/ssh/sshd_config
-# Package generated configuration file
-# See the sshd_config(5) manpage for details
-
-# What ports, IPs and protocols we listen for
-Port 22
-# Use these options to restrict which interfaces/protocols sshd will bind to
-#ListenAddress ::
-#ListenAddress 0.0.0.0
-Protocol 2
-# HostKeys for protocol version 2
-HostKey /etc/ssh/ssh_host_rsa_key
-HostKey /etc/ssh/ssh_host_ecdsa_key
-HostKey /etc/ssh/ssh_host_ed25519_key
-#Privilege Separation is turned on for security
-UsePrivilegeSeparation yes
-
-# Logging
-SyslogFacility AUTH
-LogLevel INFO
-
-# Authentication:
-LoginGraceTime 120
-PermitRootLogin prohibit-password
-StrictModes yes
-
-PubkeyAuthentication yes
-#AuthorizedKeysFile     %h/.ssh/authorized_keys
-
-# Don't read the user's ~/.rhosts and ~/.shosts files
-IgnoreRhosts yes
-# For this to work you will also need host keys in /etc/ssh_known_hosts
-HostbasedAuthentication no
-# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
-#IgnoreUserKnownHosts yes
-
-# To enable empty passwords, change to yes (NOT RECOMMENDED)
-PermitEmptyPasswords no
-
-# Change to yes to enable challenge-response passwords (beware issues with
-# some PAM modules and threads)
-ChallengeResponseAuthentication no
-
-# Change to no to disable tunnelled clear text passwords
-#PasswordAuthentication yes
-
-# Kerberos options
-#KerberosAuthentication no
-#KerberosGetAFSToken no
-#KerberosOrLocalPasswd yes
-#KerberosTicketCleanup yes
-
-# GSSAPI options
-#GSSAPIAuthentication no
-#GSSAPICleanupCredentials yes
-
-X11Forwarding yes
-X11DisplayOffset 10
-PrintMotd no
-PrintLastLog yes
-TCPKeepAlive yes
-#UseLogin no
-
-#MaxStartups 10:30:60
-#Banner /etc/issue.net
-
-# Allow client to pass locale environment variables
-AcceptEnv LANG LC_*
-
-Subsystem sftp /usr/lib/openssh/sftp-server
-
-# Set this to 'yes' to enable PAM authentication, account processing,
-# and session processing. If this is enabled, PAM authentication will
-# be allowed through the ChallengeResponseAuthentication and
-# PasswordAuthentication.  Depending on your PAM configuration,
-# PAM authentication via ChallengeResponseAuthentication may bypass
-# the setting of "PermitRootLogin without-password".
-# If you just want the PAM account and session checks to run without
-# PAM authentication, then enable this but set PasswordAuthentication
-# and ChallengeResponseAuthentication to 'no'.
-UsePAM yes
-EOF
+        ucf --three-way --debconf-ok \
+                --sum-file /usr/share/openssh/sshd_config.md5sum \
+                "$new_config" /etc/ssh/sshd_config
+        ucfr openssh-server /etc/ssh/sshd_config
 }
 
 fix_statoverride() {