path: root/debian/postinst

#!/bin/sh -e

action="$1"
oldversion="$2"

. /usr/share/debconf/confmodule
db_version 2.0

umask 022

if [ "$action" != configure ]
  then
  exit 0
fi



check_idea_key() {
    #check for old host_key files using IDEA, which openssh does not support
	if [ -f /etc/ssh/ssh_host_key ] ; then
		if ssh-keygen -p -N '' -f /etc/ssh/ssh_host_key 2>&1 | \
				grep -q 'unknown cipher' 2>/dev/null ; then
      mv /etc/ssh/ssh_host_key /etc/ssh/ssh_host_key.old
      mv /etc/ssh/ssh_host_key.pub /etc/ssh/ssh_host_key.pub.old
  fi
	fi
}


get_config_option() {
	option="$1"

	[ -f /etc/ssh/sshd_config ] || return

	# TODO: actually only one '=' allowed after option
	perl -ne 'print if s/^[[:space:]]*'"$option"'[[:space:]=]+//i' \
	   /etc/ssh/sshd_config
}


set_config_option() {
	option="$1"
	value="$2"

	perl -e '
		$option = $ARGV[0]; $value = $ARGV[1]; $done = 0;
		while (<STDIN>) {
			if (s/^\s*\Q$option\E\s+.*/$option $value/) {
				$done = 1;
			}
			print;
		}
		print "\n$option $value\n" unless $done;' \
		"$option" "$value" \
		< /etc/ssh/sshd_config > /etc/ssh/sshd_config.dpkg-new
	mv /etc/ssh/sshd_config.dpkg-new /etc/ssh/sshd_config
}


host_keys_required() {
	hostkeys="$(get_config_option HostKey)"
	if [ "$hostkeys" ]; then
		echo "$hostkeys"
	else
		# No HostKey directives at all, so the server picks some
		# defaults depending on the setting of Protocol.
		protocol="$(get_config_option Protocol)"
		[ "$protocol" ] || protocol=1,2
		if echo "$protocol" | grep 1 >/dev/null; then
			echo /etc/ssh/ssh_host_key
		fi
		if echo "$protocol" | grep 2 >/dev/null; then
			echo /etc/ssh/ssh_host_rsa_key
			echo /etc/ssh/ssh_host_dsa_key
		fi
	fi
}


create_key() {
	msg="$1"
	shift
	hostkeys="$1"
	shift
	file="$1"
	shift

	if echo "$hostkeys" | grep -x "$file" >/dev/null && \
	   [ ! -f "$file" ] ; then
		echo -n $msg
		ssh-keygen -q -f "$file" -N '' "$@"
		echo
	fi
}


create_keys() {
	hostkeys="$(host_keys_required)"

	create_key "Creating SSH1 key; this may take some time ..." \
		"$hostkeys" /etc/ssh/ssh_host_key -t rsa1

	create_key "Creating SSH2 RSA key; this may take some time ..." \
		"$hostkeys" /etc/ssh/ssh_host_rsa_key -t rsa
	create_key "Creating SSH2 DSA key; this may take some time ..." \
		"$hostkeys" /etc/ssh/ssh_host_dsa_key -t dsa
}


check_password_auth() {
	passwordauth="$(get_config_option PasswordAuthentication)"
	crauth="$(get_config_option ChallengeResponseAuthentication)"
	if [ "$passwordauth" = no ] && \
	   ([ -z "$crauth" ] || [ "$crauth" = yes ]); then
		db_get ssh/disable_cr_auth
		if [ "$RET" = true ]; then
			set_config_option ChallengeResponseAuthentication no
		fi
	fi
}

create_sshdconfig() {
	if [ -e /etc/ssh/sshd_config ] ; then
	    if dpkg --compare-versions "$oldversion" lt-nl 1:1.3 ; then
		db_get ssh/new_config
		if [ "$RET" = "false" ] ; then return 0; fi
	    else
		# Upgrade sshd configuration from a sane version.

		if dpkg --compare-versions "$oldversion" lt-nl 1:3.8p1-1 && \
		     ! grep -iq ^UsePAM /etc/ssh/sshd_config ; then
		    # Upgrade from pre-3.7: UsePAM needed to maintain standard
		    # Debian configuration.
		    echo -n 'Upgrading sshd_config (old version in .dpkg-old) ...'
		    cp -a /etc/ssh/sshd_config /etc/ssh/sshd_config.dpkg-old
		    perl -pe 's/^(PAMAuthenticationViaKbdInt|RhostsAuthentication)\b/#$1/i' \
			/etc/ssh/sshd_config > /etc/ssh/sshd_config.dpkg-new
		    echo >> /etc/ssh/sshd_config.dpkg-new
		    echo 'UsePAM yes' >> /etc/ssh/sshd_config.dpkg-new
		    mv /etc/ssh/sshd_config.dpkg-new /etc/ssh/sshd_config
		    echo
		fi

		if dpkg --compare-versions "$oldversion" lt-nl 1:3.8.1p1-8.sarge.1; then
		    check_password_auth
		fi

		return 0
	    fi
	fi

	#Preserve old sshd_config before generating a new one
	if [ -e /etc/ssh/sshd_config ] ; then 
	    mv /etc/ssh/sshd_config /etc/ssh/sshd_config.dpkg-old
	fi

	cat <<EOF > /etc/ssh/sshd_config
# Package generated configuration file
# See the sshd(8) manpage for details

# What ports, IPs and protocols we listen for
Port 22
# Use these options to restrict which interfaces/protocols sshd will bind to
#ListenAddress ::
#ListenAddress 0.0.0.0
EOF
	db_get ssh/protocol2_only
if [ "$RET" = "false" ]; then
		cat <<EOF >> /etc/ssh/sshd_config
Protocol 2,1
# HostKeys for protocol version 1
HostKey /etc/ssh/ssh_host_key
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
EOF
else
	cat <<EOF >> /etc/ssh/sshd_config
Protocol 2
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
EOF
fi

	cat <<EOF >> /etc/ssh/sshd_config
#Privilege Separation is turned on for security
UsePrivilegeSeparation yes

# Lifetime and size of ephemeral version 1 server key
KeyRegenerationInterval 3600
ServerKeyBits 768

# Logging
SyslogFacility AUTH
LogLevel INFO

# Authentication:
LoginGraceTime 600
PermitRootLogin yes
StrictModes yes

RSAAuthentication yes
PubkeyAuthentication yes
#AuthorizedKeysFile	%h/.ssh/authorized_keys

# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh_known_hosts
RhostsRSAAuthentication no
# similar for protocol version 2
HostbasedAuthentication no
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
#IgnoreUserKnownHosts yes

# To enable empty passwords, change to yes (NOT RECOMMENDED)
PermitEmptyPasswords no

# Change to no to disable s/key passwords
#ChallengeResponseAuthentication yes

# Change to yes to enable tunnelled clear text passwords
PasswordAuthentication no


# To change Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#AFSTokenPassing no
#KerberosTicketCleanup no

# Kerberos TGT Passing does only work with the AFS kaserver
#KerberosTgtPassing yes

X11Forwarding no
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
KeepAlive yes
#UseLogin no

#MaxStartups 10:30:60
#Banner /etc/issue.net

Subsystem	sftp	/usr/lib/sftp-server

UsePAM yes
EOF
}


fix_rsh_diversion() {
# get rid of mistaken rsh diversion (circa 1.2.27-1)

	if [ -L /usr/bin/rsh ] &&
		dpkg-divert --list '/usr/bin/rsh.real/rsh' | grep -q ' ssh$' ; then
		for cmd in rlogin  rsh rcp ; do
			[ -L /usr/bin/$cmd ] && rm /usr/bin/$cmd
			dpkg-divert --package ssh --remove --rename \
				--divert /usr/bin/rsh.real/$cmd /usr/bin/$cmd

			[ -L /usr/man/man1/$cmd.1.gz ] && rm /usr/man/man1/$$cmd.1.gz
			dpkg-divert --package ssh --remove --rename \
				--divert /usr/man/man1/$cmd.real.1.gz /usr/man/man1/$cmd.1.gz
		done

		rmdir /usr/bin/rsh.real
	fi
}


fix_statoverride() {
# Remove an erronous override for sshd (we should have overridden ssh)
	if [ -x /usr/sbin/dpkg-statoverride ]; then
		if dpkg-statoverride --list /usr/sbin/sshd >/dev/null ; then
			dpkg-statoverride --remove /usr/sbin/sshd
		fi
	fi
}


create_alternatives() {
# Create alternatives for the various r* tools.
# Make sure we don't change existing alternatives that a user might have
# changed, but clean up after some old alternatives that mistakenly pointed
# rlogin and rcp to ssh.
	update-alternatives --quiet --remove rlogin /usr/bin/ssh
	update-alternatives --quiet --remove rcp /usr/bin/ssh
	for cmd in rsh rlogin rcp; do
		scmd="s${cmd#r}"
		if ! update-alternatives --display "$cmd" | \
				grep -q "$scmd"; then
			update-alternatives --quiet --install "/usr/bin/$cmd" "$cmd" "/usr/bin/$scmd" 20 \
				--slave "/usr/share/man/man1/$cmd.1.gz" "$cmd.1.gz" "/usr/share/man/man1/$scmd.1.gz"
		fi
	done
}

setup_sshd_user() {
	if ! getent passwd sshd >/dev/null; then
		adduser --quiet --system --no-create-home --home /var/run/sshd sshd
	fi
}

set_sshd_permissions() {
	if dpkg --compare-versions "$oldversion" lt-nl 1:3.4p1-1 ; then
	    if [ -x /usr/sbin/dpkg-statoverride ] ; then
		if dpkg-statoverride --list /usr/bin/ssh >/dev/null; then
		    dpkg-statoverride --remove /usr/bin/ssh >/dev/null
		fi 
	    fi
	fi

	if [ ! -x /usr/sbin/dpkg-statoverride ] || \
	     ! dpkg-statoverride --list /usr/lib/ssh-keysign >/dev/null ; then
		db_get ssh/SUID_client
		if [ "$RET" = "false" ] ; then
			chmod 0755 /usr/lib/ssh-keysign
		elif [ "$RET" = "true" ] ; then
			chmod 4755 /usr/lib/ssh-keysign
		fi
	fi
}


fix_ssh_group() {
	# Try to remove non-system group mistakenly created by 1:3.5p1-1.
	# set_ssh_agent_permissions() below will re-create it properly.
	if getent group ssh >/dev/null; then
		delgroup --quiet ssh || true
	fi
}


set_ssh_agent_permissions() {
	if ! getent group ssh >/dev/null; then
		addgroup --system --quiet ssh
	fi
	if ! [ -x /usr/sbin/dpkg-statoverride ] || \
	    ! dpkg-statoverride --list /usr/bin/ssh-agent >/dev/null ; then
		chgrp ssh /usr/bin/ssh-agent
		chmod 2755 /usr/bin/ssh-agent
	fi
}


fix_conffile_permissions() {
	# Clean up after executable /etc/default/ssh in 1:3.5p1-5. dpkg
	# doesn't do this for us; see bug #192981.
	chmod 644 /etc/default/ssh
}

setup_startup() {
	db_get ssh/run_sshd
	if [ "$RET" = "false" ] ; then
		if [ -x /usr/sbin/invoke-rc.d ]; then
			invoke-rc.d --quiet ssh stop
		else
			/etc/init.d/ssh stop
		fi
		touch /etc/ssh/sshd_not_to_be_run
	else
		rm -f /etc/ssh/sshd_not_to_be_run 2>/dev/null
	fi
}


setup_init() {
	if [ -x /etc/init.d/ssh ]; then
		update-rc.d ssh defaults >/dev/null
		if [ -x /usr/sbin/invoke-rc.d ]; then
			invoke-rc.d ssh restart
		else
			/etc/init.d/ssh restart
		fi
	fi
}

create_sshdconfig
check_idea_key
create_keys
fix_rsh_diversion
fix_statoverride
create_alternatives
setup_sshd_user
set_sshd_permissions
if [ "$2" = "1:3.5p1-1" ]; then
    fix_ssh_group
fi
set_ssh_agent_permissions
if dpkg --compare-versions "$2" lt 1:3.6.1p2-2; then
    fix_conffile_permissions
fi
setup_startup
setup_init


db_stop

exit 0