mirror of
git://anongit.mindrot.org/openssh.git
synced 2024-12-27 12:22:09 +00:00
e541aaaf0f
Cygwin-specific service installer script ssh-host-config. The actual functionality is the same, the revisited version is just more exact when it comes to check for problems which disallow to run certain aspects of the script. So, part of this script and the also rearranged service helper script library "csih" is to check if all the tools required to run the script are available on the system. The new script also is more thorough to inform the user why the script failed. Patch from vinschen at redhat com.
758 lines
24 KiB
Bash
758 lines
24 KiB
Bash
#!/bin/bash
|
|
#
|
|
# ssh-host-config, Copyright 2000-2011 Red Hat Inc.
|
|
#
|
|
# This file is part of the Cygwin port of OpenSSH.
|
|
#
|
|
# Permission to use, copy, modify, and distribute this software for any
|
|
# purpose with or without fee is hereby granted, provided that the above
|
|
# copyright notice and this permission notice appear in all copies.
|
|
#
|
|
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
|
|
# OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
|
# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
|
|
# IN NO EVENT SHALL THE ABOVE COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
|
|
# DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
|
|
# OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR
|
|
# THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
|
|
|
# ======================================================================
|
|
# Initialization
|
|
# ======================================================================
|
|
|
|
CSIH_SCRIPT=/usr/share/csih/cygwin-service-installation-helper.sh
|
|
|
|
# List of apps used. This is checkad for existance in csih_sanity_check
|
|
# Don't use *any* transient commands before sourcing the csih helper script,
|
|
# otherwise the sanity checks are short-circuited.
|
|
declare -a csih_required_commands=(
|
|
/usr/bin/basename coreutils
|
|
/usr/bin/cat coreutils
|
|
/usr/bin/chmod coreutils
|
|
/usr/bin/dirname coreutils
|
|
/usr/bin/id coreutils
|
|
/usr/bin/mv coreutils
|
|
/usr/bin/rm coreutils
|
|
/usr/bin/cygpath cygwin
|
|
/usr/bin/mount cygwin
|
|
/usr/bin/ps cygwin
|
|
/usr/bin/setfacl cygwin
|
|
/usr/bin/umount cygwin
|
|
/usr/bin/cmp diffutils
|
|
/usr/bin/grep grep
|
|
/usr/bin/awk gawk
|
|
/usr/bin/ssh-keygen openssh
|
|
/usr/sbin/sshd openssh
|
|
/usr/bin/sed sed
|
|
)
|
|
csih_sanity_check_server=yes
|
|
source ${CSIH_SCRIPT}
|
|
|
|
PROGNAME=$(/usr/bin/basename $0)
|
|
_tdir=$(/usr/bin/dirname $0)
|
|
PROGDIR=$(cd $_tdir && pwd)
|
|
|
|
# Subdirectory where the new package is being installed
|
|
PREFIX=/usr
|
|
|
|
# Directory where the config files are stored
|
|
SYSCONFDIR=/etc
|
|
LOCALSTATEDIR=/var
|
|
|
|
port_number=22
|
|
privsep_configured=no
|
|
privsep_used=yes
|
|
cygwin_value=""
|
|
user_account=
|
|
password_value=
|
|
opt_force=no
|
|
|
|
# ======================================================================
|
|
# Routine: create_host_keys
|
|
# ======================================================================
|
|
create_host_keys() {
|
|
local ret=0
|
|
|
|
if [ ! -f "${SYSCONFDIR}/ssh_host_key" ]
|
|
then
|
|
csih_inform "Generating ${SYSCONFDIR}/ssh_host_key"
|
|
if ! /usr/bin/ssh-keygen -t rsa1 -f ${SYSCONFDIR}/ssh_host_key -N '' > /dev/null
|
|
then
|
|
csih_warning "Generating ${SYSCONFDIR}/ssh_host_key failed!"
|
|
let ++ret
|
|
fi
|
|
fi
|
|
|
|
if [ ! -f "${SYSCONFDIR}/ssh_host_rsa_key" ]
|
|
then
|
|
csih_inform "Generating ${SYSCONFDIR}/ssh_host_rsa_key"
|
|
if ! /usr/bin/ssh-keygen -t rsa -f ${SYSCONFDIR}/ssh_host_rsa_key -N '' > /dev/null
|
|
then
|
|
csih_warning "Generating ${SYSCONFDIR}/ssh_host_key failed!"
|
|
let ++ret
|
|
fi
|
|
fi
|
|
|
|
if [ ! -f "${SYSCONFDIR}/ssh_host_dsa_key" ]
|
|
then
|
|
csih_inform "Generating ${SYSCONFDIR}/ssh_host_dsa_key"
|
|
if ! /usr/bin/ssh-keygen -t dsa -f ${SYSCONFDIR}/ssh_host_dsa_key -N '' > /dev/null
|
|
then
|
|
csih_warning "Generating ${SYSCONFDIR}/ssh_host_key failed!"
|
|
let ++ret
|
|
fi
|
|
fi
|
|
|
|
if [ ! -f "${SYSCONFDIR}/ssh_host_ecdsa_key" ]
|
|
then
|
|
csih_inform "Generating ${SYSCONFDIR}/ssh_host_ecdsa_key"
|
|
if ! /usr/bin/ssh-keygen -t ecdsa -f ${SYSCONFDIR}/ssh_host_ecdsa_key -N '' > /dev/null
|
|
then
|
|
csih_warning "Generating ${SYSCONFDIR}/ssh_host_key failed!"
|
|
let ++ret
|
|
fi
|
|
fi
|
|
return $ret
|
|
} # --- End of create_host_keys --- #
|
|
|
|
# ======================================================================
|
|
# Routine: update_services_file
|
|
# ======================================================================
|
|
update_services_file() {
|
|
local _my_etcdir="/ssh-host-config.$$"
|
|
local _win_etcdir
|
|
local _services
|
|
local _spaces
|
|
local _serv_tmp
|
|
local _wservices
|
|
local ret=0
|
|
|
|
_win_etcdir="${SYSTEMROOT}\\system32\\drivers\\etc"
|
|
_services="${_my_etcdir}/services"
|
|
_spaces=" #"
|
|
_serv_tmp="${_my_etcdir}/srv.out.$$"
|
|
|
|
/usr/bin/mount -o text,posix=0,noacl -f "${_win_etcdir}" "${_my_etcdir}"
|
|
|
|
# Depends on the above mount
|
|
_wservices=`cygpath -w "${_services}"`
|
|
|
|
# Remove sshd 22/port from services
|
|
if [ `/usr/bin/grep -q 'sshd[ \t][ \t]*22' "${_services}"; echo $?` -eq 0 ]
|
|
then
|
|
/usr/bin/grep -v 'sshd[ \t][ \t]*22' "${_services}" > "${_serv_tmp}"
|
|
if [ -f "${_serv_tmp}" ]
|
|
then
|
|
if /usr/bin/mv "${_serv_tmp}" "${_services}"
|
|
then
|
|
csih_inform "Removing sshd from ${_wservices}"
|
|
else
|
|
csih_warning "Removing sshd from ${_wservices} failed!"
|
|
let ++ret
|
|
fi
|
|
/usr/bin/rm -f "${_serv_tmp}"
|
|
else
|
|
csih_warning "Removing sshd from ${_wservices} failed!"
|
|
let ++ret
|
|
fi
|
|
fi
|
|
|
|
# Add ssh 22/tcp and ssh 22/udp to services
|
|
if [ `/usr/bin/grep -q 'ssh[ \t][ \t]*22' "${_services}"; echo $?` -ne 0 ]
|
|
then
|
|
if /usr/bin/awk '{ if ( $2 ~ /^23\/tcp/ ) print "ssh 22/tcp'"${_spaces}"'SSH Remote Login Protocol\nssh 22/udp'"${_spaces}"'SSH Remote Login Protocol"; print $0; }' < "${_services}" > "${_serv_tmp}"
|
|
then
|
|
if /usr/bin/mv "${_serv_tmp}" "${_services}"
|
|
then
|
|
csih_inform "Added ssh to ${_wservices}"
|
|
else
|
|
csih_warning "Adding ssh to ${_wservices} failed!"
|
|
let ++ret
|
|
fi
|
|
/usr/bin/rm -f "${_serv_tmp}"
|
|
else
|
|
csih_warning "Adding ssh to ${_wservices} failed!"
|
|
let ++ret
|
|
fi
|
|
fi
|
|
/usr/bin/umount "${_my_etcdir}"
|
|
return $ret
|
|
} # --- End of update_services_file --- #
|
|
|
|
# ======================================================================
|
|
# Routine: sshd_privsep
|
|
# MODIFIES: privsep_configured privsep_used
|
|
# ======================================================================
|
|
sshd_privsep() {
|
|
local sshdconfig_tmp
|
|
local ret=0
|
|
|
|
if [ "${privsep_configured}" != "yes" ]
|
|
then
|
|
csih_inform "Privilege separation is set to yes by default since OpenSSH 3.3."
|
|
csih_inform "However, this requires a non-privileged account called 'sshd'."
|
|
csih_inform "For more info on privilege separation read /usr/share/doc/openssh/README.privsep."
|
|
if csih_request "Should privilege separation be used?"
|
|
then
|
|
privsep_used=yes
|
|
if ! csih_create_unprivileged_user sshd
|
|
then
|
|
csih_error_recoverable "Couldn't create user 'sshd'!"
|
|
csih_error_recoverable "Privilege separation set to 'no' again!"
|
|
csih_error_recoverable "Check your ${SYSCONFDIR}/sshd_config file!"
|
|
let ++ret
|
|
privsep_used=no
|
|
fi
|
|
else
|
|
privsep_used=no
|
|
fi
|
|
fi
|
|
|
|
# Create default sshd_config from skeleton files in /etc/defaults/etc or
|
|
# modify to add the missing privsep configuration option
|
|
if /usr/bin/cmp "${SYSCONFDIR}/sshd_config" "${SYSCONFDIR}/defaults/${SYSCONFDIR}/sshd_config" >/dev/null 2>&1
|
|
then
|
|
csih_inform "Updating ${SYSCONFDIR}/sshd_config file"
|
|
sshdconfig_tmp=${SYSCONFDIR}/sshd_config.$$
|
|
/usr/bin/sed -e "s/^#UsePrivilegeSeparation yes/UsePrivilegeSeparation ${privsep_used}/
|
|
s/^#Port 22/Port ${port_number}/
|
|
s/^#StrictModes yes/StrictModes no/" \
|
|
< ${SYSCONFDIR}/sshd_config \
|
|
> "${sshdconfig_tmp}"
|
|
if ! /usr/bin/mv "${sshdconfig_tmp}" ${SYSCONFDIR}/sshd_config
|
|
then
|
|
csih_warning "Setting privilege separation to 'yes' failed!"
|
|
csih_warning "Check your ${SYSCONFDIR}/sshd_config file!"
|
|
let ++ret
|
|
fi
|
|
elif [ "${privsep_configured}" != "yes" ]
|
|
then
|
|
echo >> ${SYSCONFDIR}/sshd_config
|
|
if ! echo "UsePrivilegeSeparation ${privsep_used}" >> ${SYSCONFDIR}/sshd_config
|
|
then
|
|
csih_warning "Setting privilege separation to 'yes' failed!"
|
|
csih_warning "Check your ${SYSCONFDIR}/sshd_config file!"
|
|
let ++ret
|
|
fi
|
|
fi
|
|
return $ret
|
|
} # --- End of sshd_privsep --- #
|
|
|
|
# ======================================================================
|
|
# Routine: update_inetd_conf
|
|
# ======================================================================
|
|
update_inetd_conf() {
|
|
local _inetcnf="${SYSCONFDIR}/inetd.conf"
|
|
local _inetcnf_tmp="${SYSCONFDIR}/inetd.conf.$$"
|
|
local _inetcnf_dir="${SYSCONFDIR}/inetd.d"
|
|
local _sshd_inetd_conf="${_inetcnf_dir}/sshd-inetd"
|
|
local _sshd_inetd_conf_tmp="${_inetcnf_dir}/sshd-inetd.$$"
|
|
local _with_comment=1
|
|
local ret=0
|
|
|
|
if [ -d "${_inetcnf_dir}" ]
|
|
then
|
|
# we have inetutils-1.5 inetd.d support
|
|
if [ -f "${_inetcnf}" ]
|
|
then
|
|
/usr/bin/grep -q '^[ \t]*ssh' "${_inetcnf}" && _with_comment=0
|
|
|
|
# check for sshd OR ssh in top-level inetd.conf file, and remove
|
|
# will be replaced by a file in inetd.d/
|
|
if [ `/usr/bin/grep -q '^[# \t]*ssh' "${_inetcnf}"; echo $?` -eq 0 ]
|
|
then
|
|
/usr/bin/grep -v '^[# \t]*ssh' "${_inetcnf}" >> "${_inetcnf_tmp}"
|
|
if [ -f "${_inetcnf_tmp}" ]
|
|
then
|
|
if /usr/bin/mv "${_inetcnf_tmp}" "${_inetcnf}"
|
|
then
|
|
csih_inform "Removed ssh[d] from ${_inetcnf}"
|
|
else
|
|
csih_warning "Removing ssh[d] from ${_inetcnf} failed!"
|
|
let ++ret
|
|
fi
|
|
/usr/bin/rm -f "${_inetcnf_tmp}"
|
|
else
|
|
csih_warning "Removing ssh[d] from ${_inetcnf} failed!"
|
|
let ++ret
|
|
fi
|
|
fi
|
|
fi
|
|
|
|
csih_install_config "${_sshd_inetd_conf}" "${SYSCONFDIR}/defaults"
|
|
if /usr/bin/cmp "${SYSCONFDIR}/defaults${_sshd_inetd_conf}" "${_sshd_inetd_conf}" >/dev/null 2>&1
|
|
then
|
|
if [ "${_with_comment}" -eq 0 ]
|
|
then
|
|
/usr/bin/sed -e 's/@COMMENT@[ \t]*//' < "${_sshd_inetd_conf}" > "${_sshd_inetd_conf_tmp}"
|
|
else
|
|
/usr/bin/sed -e 's/@COMMENT@[ \t]*/# /' < "${_sshd_inetd_conf}" > "${_sshd_inetd_conf_tmp}"
|
|
fi
|
|
if /usr/bin/mv "${_sshd_inetd_conf_tmp}" "${_sshd_inetd_conf}"
|
|
then
|
|
csih_inform "Updated ${_sshd_inetd_conf}"
|
|
else
|
|
csih_warning "Updating ${_sshd_inetd_conf} failed!"
|
|
let ++ret
|
|
fi
|
|
fi
|
|
|
|
elif [ -f "${_inetcnf}" ]
|
|
then
|
|
/usr/bin/grep -q '^[ \t]*sshd' "${_inetcnf}" && _with_comment=0
|
|
|
|
# check for sshd in top-level inetd.conf file, and remove
|
|
# will be replaced by a file in inetd.d/
|
|
if [ `/usr/bin/grep -q '^[# \t]*sshd' "${_inetcnf}"; echo $?` -eq 0 ]
|
|
then
|
|
/usr/bin/grep -v '^[# \t]*sshd' "${_inetcnf}" >> "${_inetcnf_tmp}"
|
|
if [ -f "${_inetcnf_tmp}" ]
|
|
then
|
|
if /usr/bin/mv "${_inetcnf_tmp}" "${_inetcnf}"
|
|
then
|
|
csih_inform "Removed sshd from ${_inetcnf}"
|
|
else
|
|
csih_warning "Removing sshd from ${_inetcnf} failed!"
|
|
let ++ret
|
|
fi
|
|
/usr/bin/rm -f "${_inetcnf_tmp}"
|
|
else
|
|
csih_warning "Removing sshd from ${_inetcnf} failed!"
|
|
let ++ret
|
|
fi
|
|
fi
|
|
|
|
# Add ssh line to inetd.conf
|
|
if [ `/usr/bin/grep -q '^[# \t]*ssh' "${_inetcnf}"; echo $?` -ne 0 ]
|
|
then
|
|
if [ "${_with_comment}" -eq 0 ]
|
|
then
|
|
echo 'ssh stream tcp nowait root /usr/sbin/sshd sshd -i' >> "${_inetcnf}"
|
|
else
|
|
echo '# ssh stream tcp nowait root /usr/sbin/sshd sshd -i' >> "${_inetcnf}"
|
|
fi
|
|
if [ $? -eq 0 ]
|
|
then
|
|
csih_inform "Added ssh to ${_inetcnf}"
|
|
else
|
|
csih_warning "Adding ssh to ${_inetcnf} failed!"
|
|
let ++ret
|
|
fi
|
|
fi
|
|
fi
|
|
return $ret
|
|
} # --- End of update_inetd_conf --- #
|
|
|
|
# ======================================================================
|
|
# Routine: check_service_files_ownership
|
|
# Checks that the files in /etc and /var belong to the right owner
|
|
# ======================================================================
|
|
check_service_files_ownership() {
|
|
local run_service_as=$1
|
|
local ret=0
|
|
|
|
if [ -z "${run_service_as}" ]
|
|
then
|
|
accnt_name=$(/usr/bin/cygrunsrv -VQ sshd | /usr/bin/sed -ne 's/^Account *: *//gp')
|
|
if [ "${accnt_name}" = "LocalSystem" ]
|
|
then
|
|
# Convert "LocalSystem" to "SYSTEM" as is the correct account name
|
|
accnt_name="SYSTEM:"
|
|
elif [[ "${accnt_name}" =~ ^\.\\ ]]
|
|
then
|
|
# Convert "." domain to local machine name
|
|
accnt_name="U-${COMPUTERNAME}${accnt_name#.},"
|
|
fi
|
|
run_service_as=$(/usr/bin/grep -Fi "${accnt_name}" /etc/passwd | /usr/bin/awk -F: '{print $1;}')
|
|
if [ -z "${run_service_as}" ]
|
|
then
|
|
csih_warning "Couldn't determine name of user running sshd service from /etc/passwd!"
|
|
csih_warning "As a result, this script cannot make sure that the files used"
|
|
csih_warning "by the sshd service belong to the user running the service."
|
|
csih_warning "Please re-run the mkpasswd tool to make sure the /etc/passwd"
|
|
csih_warning "file is in a good shape."
|
|
return 1
|
|
fi
|
|
fi
|
|
for i in "${SYSCONFDIR}"/ssh_config "${SYSCONFDIR}"/sshd_config "${SYSCONFDIR}"/ssh_host_*key "${SYSCONFDIR}"/ssh_host_*key.pub
|
|
do
|
|
if [ -f "$i" ]
|
|
then
|
|
if ! chown "${run_service_as}".544 "$i" >/dev/null 2>&1
|
|
then
|
|
csih_warning "Couldn't change owner of $i!"
|
|
let ++ret
|
|
fi
|
|
fi
|
|
done
|
|
if ! chown "${run_service_as}".544 ${LOCALSTATEDIR}/empty >/dev/null 2>&1
|
|
then
|
|
csih_warning "Couldn't change owner of ${LOCALSTATEDIR}/empty!"
|
|
let ++ret
|
|
fi
|
|
if ! chown "${run_service_as}".544 ${LOCALSTATEDIR}/log/lastlog >/dev/null 2>&1
|
|
then
|
|
csih_warning "Couldn't change owner of ${LOCALSTATEDIR}/log/lastlog!"
|
|
let ++ret
|
|
fi
|
|
if [ -f ${LOCALSTATEDIR}/log/sshd.log ]
|
|
then
|
|
if ! chown "${run_service_as}".544 ${LOCALSTATEDIR}/log/sshd.log >/dev/null 2>&1
|
|
then
|
|
csih_warning "Couldn't change owner of ${LOCALSTATEDIR}/log/sshd.log!"
|
|
let ++ret
|
|
fi
|
|
fi
|
|
if [ $ret -ne 0 ]
|
|
then
|
|
csih_warning "Couldn't change owner of important files to ${run_service_as}!"
|
|
csih_warning "This may cause the sshd service to fail! Please make sure that"
|
|
csih_warning "you have suufficient permissions to change the ownership of files"
|
|
csih_warning "and try to run the ssh-host-config script again."
|
|
fi
|
|
return $ret
|
|
} # --- End of check_service_files_ownership --- #
|
|
|
|
# ======================================================================
|
|
# Routine: install_service
|
|
# Install sshd as a service
|
|
# ======================================================================
|
|
install_service() {
|
|
local run_service_as
|
|
local password
|
|
local ret=0
|
|
|
|
echo
|
|
if /usr/bin/cygrunsrv -Q sshd >/dev/null 2>&1
|
|
then
|
|
csih_inform "Sshd service is already installed."
|
|
check_service_files_ownership "" || let ret+=$?
|
|
else
|
|
echo -e "${_csih_QUERY_STR} Do you want to install sshd as a service?"
|
|
if csih_request "(Say \"no\" if it is already installed as a service)"
|
|
then
|
|
csih_get_cygenv "${cygwin_value}"
|
|
|
|
if ( csih_is_nt2003 || [ "$csih_FORCE_PRIVILEGED_USER" = "yes" ] )
|
|
then
|
|
csih_inform "On Windows Server 2003, Windows Vista, and above, the"
|
|
csih_inform "SYSTEM account cannot setuid to other users -- a capability"
|
|
csih_inform "sshd requires. You need to have or to create a privileged"
|
|
csih_inform "account. This script will help you do so."
|
|
echo
|
|
|
|
[ "${opt_force}" = "yes" ] && opt_f=-f
|
|
[ -n "${user_account}" ] && opt_u="-u ""${user_account}"""
|
|
csih_select_privileged_username ${opt_f} ${opt_u} sshd
|
|
|
|
if ! csih_create_privileged_user "${password_value}"
|
|
then
|
|
csih_error_recoverable "There was a serious problem creating a privileged user."
|
|
csih_request "Do you want to proceed anyway?" || exit 1
|
|
let ++ret
|
|
fi
|
|
fi
|
|
|
|
# Never returns empty if NT or above
|
|
run_service_as=$(csih_service_should_run_as)
|
|
|
|
if [ "${run_service_as}" = "${csih_PRIVILEGED_USERNAME}" ]
|
|
then
|
|
password="${csih_PRIVILEGED_PASSWORD}"
|
|
if [ -z "${password}" ]
|
|
then
|
|
csih_get_value "Please enter the password for user '${run_service_as}':" "-s"
|
|
password="${csih_value}"
|
|
fi
|
|
fi
|
|
|
|
# At this point, we either have $run_service_as = "system" and
|
|
# $password is empty, or $run_service_as is some privileged user and
|
|
# (hopefully) $password contains the correct password. So, from here
|
|
# out, we use '-z "${password}"' to discriminate the two cases.
|
|
|
|
csih_check_user "${run_service_as}"
|
|
|
|
if [ -n "${csih_cygenv}" ]
|
|
then
|
|
cygwin_env=( -e "CYGWIN=${csih_cygenv}" )
|
|
fi
|
|
if [ -z "${password}" ]
|
|
then
|
|
if /usr/bin/cygrunsrv -I sshd -d "CYGWIN sshd" -p /usr/sbin/sshd \
|
|
-a "-D" -y tcpip "${cygwin_env[@]}"
|
|
then
|
|
echo
|
|
csih_inform "The sshd service has been installed under the LocalSystem"
|
|
csih_inform "account (also known as SYSTEM). To start the service now, call"
|
|
csih_inform "\`net start sshd' or \`cygrunsrv -S sshd'. Otherwise, it"
|
|
csih_inform "will start automatically after the next reboot."
|
|
fi
|
|
else
|
|
if /usr/bin/cygrunsrv -I sshd -d "CYGWIN sshd" -p /usr/sbin/sshd \
|
|
-a "-D" -y tcpip "${cygwin_env[@]}" \
|
|
-u "${run_service_as}" -w "${password}"
|
|
then
|
|
echo
|
|
csih_inform "The sshd service has been installed under the '${run_service_as}'"
|
|
csih_inform "account. To start the service now, call \`net start sshd' or"
|
|
csih_inform "\`cygrunsrv -S sshd'. Otherwise, it will start automatically"
|
|
csih_inform "after the next reboot."
|
|
fi
|
|
fi
|
|
|
|
if /usr/bin/cygrunsrv -Q sshd >/dev/null 2>&1
|
|
then
|
|
check_service_files_ownership "${run_service_as}" || let ret+=$?
|
|
else
|
|
csih_error_recoverable "Installing sshd as a service failed!"
|
|
let ++ret
|
|
fi
|
|
fi # user allowed us to install as service
|
|
fi # service not yet installed
|
|
return $ret
|
|
} # --- End of install_service --- #
|
|
|
|
# ======================================================================
|
|
# Main Entry Point
|
|
# ======================================================================
|
|
|
|
# Check how the script has been started. If
|
|
# (1) it has been started by giving the full path and
|
|
# that path is /etc/postinstall, OR
|
|
# (2) Otherwise, if the environment variable
|
|
# SSH_HOST_CONFIG_AUTO_ANSWER_NO is set
|
|
# then set auto_answer to "no". This allows automatic
|
|
# creation of the config files in /etc w/o overwriting
|
|
# them if they already exist. In both cases, color
|
|
# escape sequences are suppressed, so as to prevent
|
|
# cluttering setup's logfiles.
|
|
if [ "$PROGDIR" = "/etc/postinstall" ]
|
|
then
|
|
csih_auto_answer="no"
|
|
csih_disable_color
|
|
opt_force=yes
|
|
fi
|
|
if [ -n "${SSH_HOST_CONFIG_AUTO_ANSWER_NO}" ]
|
|
then
|
|
csih_auto_answer="no"
|
|
csih_disable_color
|
|
opt_force=yes
|
|
fi
|
|
|
|
# ======================================================================
|
|
# Parse options
|
|
# ======================================================================
|
|
while :
|
|
do
|
|
case $# in
|
|
0)
|
|
break
|
|
;;
|
|
esac
|
|
|
|
option=$1
|
|
shift
|
|
|
|
case "${option}" in
|
|
-d | --debug )
|
|
set -x
|
|
csih_trace_on
|
|
;;
|
|
|
|
-y | --yes )
|
|
csih_auto_answer=yes
|
|
opt_force=yes
|
|
;;
|
|
|
|
-n | --no )
|
|
csih_auto_answer=no
|
|
opt_force=yes
|
|
;;
|
|
|
|
-c | --cygwin )
|
|
cygwin_value="$1"
|
|
shift
|
|
;;
|
|
|
|
-p | --port )
|
|
port_number=$1
|
|
shift
|
|
;;
|
|
|
|
-u | --user )
|
|
user_account="$1"
|
|
shift
|
|
;;
|
|
|
|
-w | --pwd )
|
|
password_value="$1"
|
|
shift
|
|
;;
|
|
|
|
--privileged )
|
|
csih_FORCE_PRIVILEGED_USER=yes
|
|
;;
|
|
|
|
*)
|
|
echo "usage: ${progname} [OPTION]..."
|
|
echo
|
|
echo "This script creates an OpenSSH host configuration."
|
|
echo
|
|
echo "Options:"
|
|
echo " --debug -d Enable shell's debug output."
|
|
echo " --yes -y Answer all questions with \"yes\" automatically."
|
|
echo " --no -n Answer all questions with \"no\" automatically."
|
|
echo " --cygwin -c <options> Use \"options\" as value for CYGWIN environment var."
|
|
echo " --port -p <n> sshd listens on port n."
|
|
echo " --user -u <account> privileged user for service."
|
|
echo " --pwd -w <passwd> Use \"pwd\" as password for privileged user."
|
|
echo " --privileged On Windows NT/2k/XP, require privileged user"
|
|
echo " instead of LocalSystem for sshd service."
|
|
echo
|
|
exit 1
|
|
;;
|
|
|
|
esac
|
|
done
|
|
|
|
# ======================================================================
|
|
# Action!
|
|
# ======================================================================
|
|
|
|
# Check for running ssh/sshd processes first. Refuse to do anything while
|
|
# some ssh processes are still running
|
|
if /usr/bin/ps -ef | /usr/bin/grep -q '/sshd\?$'
|
|
then
|
|
echo
|
|
csih_error "There are still ssh processes running. Please shut them down first."
|
|
fi
|
|
|
|
# Make sure the user is running in an administrative context
|
|
admin=$(/usr/bin/id -G | /usr/bin/grep -Eq '\<544\>' && echo yes || echo no)
|
|
if [ "${admin}" != "yes" ]
|
|
then
|
|
echo
|
|
csih_warning "Running this script typically requires administrator privileges!"
|
|
csih_warning "However, it seems your account does not have these privileges."
|
|
csih_warning "Here's the list of groups in your user token:"
|
|
echo
|
|
for i in $(/usr/bin/id -G)
|
|
do
|
|
/usr/bin/awk -F: "/[^:]*:[^:]*:$i:/{ print \" \" \$1; }" /etc/group
|
|
done
|
|
echo
|
|
csih_warning "This usually means you're running this script from a non-admin"
|
|
csih_warning "desktop session, or in a non-elevated shell under UAC control."
|
|
echo
|
|
csih_warning "Make sure you have the appropriate privileges right now,"
|
|
csih_warning "otherwise parts of this script will probably fail!"
|
|
echo
|
|
echo -e "${_csih_QUERY_STR} Are you sure you want to continue? (Say \"no\" if you're not sure"
|
|
if ! csih_request "you have the required privileges)"
|
|
then
|
|
echo
|
|
csih_inform "Ok. Exiting. Make sure to switch to an administrative account"
|
|
csih_inform "or to start this script from an elevated shell."
|
|
exit 1
|
|
fi
|
|
fi
|
|
|
|
echo
|
|
|
|
warning_cnt=0
|
|
|
|
# Check for ${SYSCONFDIR} directory
|
|
csih_make_dir "${SYSCONFDIR}" "Cannot create global configuration files."
|
|
if ! /usr/bin/chmod 775 "${SYSCONFDIR}" >/dev/null 2>&1
|
|
then
|
|
csih_warning "Can't set permissions on ${SYSCONFDIR}!"
|
|
let ++warning_cnt
|
|
fi
|
|
if ! /usr/bin/setfacl -m u:system:rwx "${SYSCONFDIR}" >/dev/null 2>&1
|
|
then
|
|
csih_warning "Can't set extended permissions on ${SYSCONFDIR}!"
|
|
let ++warning_cnt
|
|
fi
|
|
|
|
# Check for /var/log directory
|
|
csih_make_dir "${LOCALSTATEDIR}/log" "Cannot create log directory."
|
|
if ! /usr/bin/chmod 775 "${LOCALSTATEDIR}/log" >/dev/null 2>&1
|
|
then
|
|
csih_warning "Can't set permissions on ${LOCALSTATEDIR}/log!"
|
|
let ++warning_cnt
|
|
fi
|
|
if ! /usr/bin/setfacl -m u:system:rwx "${LOCALSTATEDIR}/log" >/dev/null 2>&1
|
|
then
|
|
csih_warning "Can't set extended permissions on ${LOCALSTATEDIR}/log!"
|
|
let ++warning_cnt
|
|
fi
|
|
|
|
# Create /var/log/lastlog if not already exists
|
|
if [ -e ${LOCALSTATEDIR}/log/lastlog -a ! -f ${LOCALSTATEDIR}/log/lastlog ]
|
|
then
|
|
echo
|
|
csih_error_multi "${LOCALSTATEDIR}/log/lastlog exists, but is not a file." \
|
|
"Cannot create ssh host configuration."
|
|
fi
|
|
if [ ! -e ${LOCALSTATEDIR}/log/lastlog ]
|
|
then
|
|
/usr/bin/cat /dev/null > ${LOCALSTATEDIR}/log/lastlog
|
|
if ! /usr/bin/chmod 644 ${LOCALSTATEDIR}/log/lastlog >/dev/null 2>&1
|
|
then
|
|
csih_warning "Can't set permissions on ${LOCALSTATEDIR}/log/lastlog!"
|
|
let ++warning_cnt
|
|
fi
|
|
fi
|
|
|
|
# Create /var/empty file used as chroot jail for privilege separation
|
|
csih_make_dir "${LOCALSTATEDIR}/empty" "Cannot create ${LOCALSTATEDIR}/empty directory."
|
|
if ! /usr/bin/chmod 755 "${LOCALSTATEDIR}/empty" >/dev/null 2>&1
|
|
then
|
|
csih_warning "Can't set permissions on ${LOCALSTATEDIR}/empty!"
|
|
let ++warning_cnt
|
|
fi
|
|
if ! /usr/bin/setfacl -m u:system:rwx "${LOCALSTATEDIR}/empty" >/dev/null 2>&1
|
|
then
|
|
csih_warning "Can't set extended permissions on ${LOCALSTATEDIR}/empty!"
|
|
let ++warning_cnt
|
|
fi
|
|
|
|
# host keys
|
|
create_host_keys || let warning_cnt+=$?
|
|
|
|
# handle ssh_config
|
|
csih_install_config "${SYSCONFDIR}/ssh_config" "${SYSCONFDIR}/defaults" || let ++warning_cnt
|
|
if /usr/bin/cmp "${SYSCONFDIR}/ssh_config" "${SYSCONFDIR}/defaults/${SYSCONFDIR}/ssh_config" >/dev/null 2>&1
|
|
then
|
|
if [ "${port_number}" != "22" ]
|
|
then
|
|
csih_inform "Updating ${SYSCONFDIR}/ssh_config file with requested port"
|
|
echo "Host localhost" >> ${SYSCONFDIR}/ssh_config
|
|
echo " Port ${port_number}" >> ${SYSCONFDIR}/ssh_config
|
|
fi
|
|
fi
|
|
|
|
# handle sshd_config (and privsep)
|
|
csih_install_config "${SYSCONFDIR}/sshd_config" "${SYSCONFDIR}/defaults" || let ++warning_cnt
|
|
if ! /usr/bin/cmp "${SYSCONFDIR}/sshd_config" "${SYSCONFDIR}/defaults/${SYSCONFDIR}/sshd_config" >/dev/null 2>&1
|
|
then
|
|
/usr/bin/grep -q UsePrivilegeSeparation ${SYSCONFDIR}/sshd_config && privsep_configured=yes
|
|
fi
|
|
sshd_privsep || let warning_cnt+=$?
|
|
|
|
update_services_file || let warning_cnt+=$?
|
|
update_inetd_conf || let warning_cnt+=$?
|
|
install_service || let warning_cnt+=$?
|
|
|
|
echo
|
|
if [ $warning_cnt -eq 0 ]
|
|
then
|
|
csih_inform "Host configuration finished. Have fun!"
|
|
else
|
|
csih_warning "Host configuration exited with ${warning_cnt} errors or warnings!"
|
|
csih_warning "Make sure that all problems reported are fixed,"
|
|
csih_warning "then re-run ssh-host-config."
|
|
fi
|
|
exit $warning_cnt
|