2 files changed, 16 insertions, 0 deletions

diff --git a/debian/changelog b/debian/changelog
index 4572dc0bd..56f09982f 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,9 @@
+openssh (1:7.4p1-6) UNRELEASED; urgency=medium
+
+  * Remove temporary file on exit from postinst (closes: #850275).
+
+ -- Colin Watson <cjwatson@debian.org>  Fri, 06 Jan 2017 08:40:14 +0000
+
 openssh (1:7.4p1-5) unstable; urgency=medium
 
   * Create mux socket for regression tests in a temporary directory.
diff --git a/debian/openssh-server.postinst b/debian/openssh-server.postinst
index 391efc43b..90d346674 100644
--- a/debian/openssh-server.postinst
+++ b/debian/openssh-server.postinst
@@ -72,6 +72,15 @@ create_keys() {
 }
 
 
+new_config=
+
+cleanup() {
+        if [ "$new_config" ]; then
+                rm -f "$new_config"
+        fi
+}
+
+
 create_sshdconfig() {
         # XXX cjwatson 2016-12-24: This debconf template is very confusingly
         # named; its description is "Disable SSH password authentication for
@@ -80,6 +89,7 @@ create_sshdconfig() {
         db_get openssh-server/permit-root-login
         permit_root_login="$RET"
 
+        trap cleanup EXIT
         new_config="$(tempfile)"
         cp -a /usr/share/openssh/sshd_config "$new_config"
         if [ "$permit_root_login" != true ]; then