diff options
Diffstat (limited to 'debian/openssh-server.preinst')
-rw-r--r-- | debian/openssh-server.preinst | 122 |
1 files changed, 122 insertions, 0 deletions
diff --git a/debian/openssh-server.preinst b/debian/openssh-server.preinst new file mode 100644 index 000000000..866cf8b1a --- /dev/null +++ b/debian/openssh-server.preinst | |||
@@ -0,0 +1,122 @@ | |||
1 | #!/bin/sh -e | ||
2 | |||
3 | ETC_DEFAULT_SSH=@ETC_DEFAULT_SSH@ | ||
4 | |||
5 | ETC_INIT_D_SSH=@ETC_INIT_D_SSH@ | ||
6 | |||
7 | ETC_PAM_D_SSH=@ETC_PAM_D_SSH@ | ||
8 | |||
9 | action=$1 | ||
10 | version=$2 | ||
11 | |||
12 | prepare_transfer_conffile () { | ||
13 | CONFFILE="$1" | ||
14 | TEXT="$2" | ||
15 | MODE="$3" | ||
16 | [ "$CONFFILES" ] || return 0 | ||
17 | [ -e "$CONFFILE" ] || return 0 | ||
18 | |||
19 | md5sum="$(md5sum "$CONFFILE" |sed -e 's/ .*//')" | ||
20 | old_md5sum="$(echo "$CONFFILES" | awk '$1 == "'"$CONFFILE"'" { print $2 }')" | ||
21 | if [ "$md5sum" = "$old_md5sum" ]; then | ||
22 | echo >&2 "Transferring ownership of conffile $CONFFILE ..." | ||
23 | # We have to write out the desired new text of the conffile, | ||
24 | # which is tricky in the preinst, hence the nasty way we | ||
25 | # have to hardcode the text here. Fortunately, this is only | ||
26 | # necessary with sarge's dpkg and older. | ||
27 | if echo "$TEXT" | head -n1 | grep -q '^@.*@$'; then | ||
28 | echo >&2 'Unsubstituted conffile text! Please report this bug.' | ||
29 | exit 1 | ||
30 | fi | ||
31 | printf '%s' "$TEXT" >"$CONFFILE.dpkg-new" | ||
32 | chmod "$MODE" "$CONFFILE.dpkg-new" | ||
33 | mv -f "$CONFFILE" "$CONFFILE.moved-by-preinst" | ||
34 | mv -f "$CONFFILE.dpkg-new" "$CONFFILE" | ||
35 | return 0 | ||
36 | fi | ||
37 | } | ||
38 | |||
39 | if [ -d /etc/ssh-nonfree ] && [ ! -d /etc/ssh ]; then | ||
40 | version=1.2.27 | ||
41 | fi | ||
42 | |||
43 | if [ "$action" = upgrade ] || [ "$action" = install ] | ||
44 | then | ||
45 | # check if debconf is missing | ||
46 | if ! test -f /usr/share/debconf/confmodule | ||
47 | then | ||
48 | cat <<EOF | ||
49 | |||
50 | WARNING: ssh's pre-configuration script relies on debconf to tell you | ||
51 | about some problems that might prevent you from logging in if you are | ||
52 | upgrading from the old, Non-free version of ssh. | ||
53 | |||
54 | If this is a new installation, you don't need to worry about this. | ||
55 | Just go ahead and install ssh (make sure to read .../ssh/README.Debian). | ||
56 | |||
57 | If you are upgrading, but you have alternative ways of logging into | ||
58 | the machine (i.e. you're sitting in front of it, or you have telnetd | ||
59 | running), then you also don't need to worry too much, because you can | ||
60 | fix it up afterwards if there's a problem. | ||
61 | |||
62 | If you're upgrading from an older (non-free) version of ssh, and ssh | ||
63 | is the only way you have to access this machine, then you should | ||
64 | probably abort the installation of ssh, install debconf, and then | ||
65 | retry the installation of ssh. | ||
66 | |||
67 | EOF | ||
68 | echo -n "Do you want to install SSH anyway [yN]: " | ||
69 | read input | ||
70 | expr "$input" : '[Yy]' >/dev/null || exit 1 | ||
71 | |||
72 | # work around for missing debconf | ||
73 | db_get() { : ; } | ||
74 | RET=true | ||
75 | if [ -d /etc/ssh-nonfree ] && [ ! -d /etc/ssh ]; then | ||
76 | cp -a /etc/ssh-nonfree /etc/ssh | ||
77 | fi | ||
78 | else | ||
79 | # Source debconf library. | ||
80 | . /usr/share/debconf/confmodule | ||
81 | db_version 2.0 | ||
82 | fi | ||
83 | |||
84 | db_get ssh/use_old_init_script | ||
85 | if [ "$RET" = "false" ]; then | ||
86 | echo "ssh config: Aborting because ssh/use_old_init_script = false" >&2 | ||
87 | exit 1 | ||
88 | fi | ||
89 | |||
90 | # deal with upgrading from pre-OpenSSH versions | ||
91 | key=/etc/ssh/ssh_host_key | ||
92 | export key | ||
93 | if [ -n "$version" ] && [ -x /usr/bin/ssh-keygen ] && [ -f $key ] && | ||
94 | dpkg --compare-versions "$version" lt 1.2.28 | ||
95 | then | ||
96 | # make sure that keys get updated to get rid of IDEA | ||
97 | # | ||
98 | # N.B. this only works because we've still got the old | ||
99 | # nonfree ssh-keygen at this point | ||
100 | # | ||
101 | # First, check if we need to bother | ||
102 | echo -en '\0\0' | 3<&0 sh -c \ | ||
103 | 'dd if=$key bs=1 skip=32 count=2 2>/dev/null | cmp -s - /dev/fd/3' || { | ||
104 | # this means that bytes 32&33 of the key were not both zero, in which | ||
105 | # case the key is encrypted, which we need to fix | ||
106 | chmod 600 $key | ||
107 | ssh-keygen -u -f $key >/dev/null | ||
108 | if type restorecon >/dev/null 2>&1; then | ||
109 | restorecon "$key.pub" | ||
110 | fi | ||
111 | } | ||
112 | fi | ||
113 | |||
114 | if dpkg --compare-versions "$version" lt 0; then | ||
115 | CONFFILES="$(dpkg-query -W -f '${Conffiles}\n' ssh | sed 's/^ *//')" | ||
116 | prepare_transfer_conffile /etc/default/ssh "$ETC_DEFAULT_SSH" 0644 | ||
117 | prepare_transfer_conffile /etc/init.d/ssh "$ETC_INIT_D_SSH" 0755 | ||
118 | prepare_transfer_conffile /etc/pam.d/ssh "$ETC_PAM_D_SSH" 0644 | ||
119 | fi | ||
120 | fi | ||
121 | |||
122 | #DEBHELPER# | ||