1#!/bin/bash 2# 3# ssh-host-config, Copyright 2000-2014 Red Hat Inc. 4# 5# This file is part of the Cygwin port of OpenSSH. 6# 7# Permission to use, copy, modify, and distribute this software for any 8# purpose with or without fee is hereby granted, provided that the above 9# copyright notice and this permission notice appear in all copies. 10# 11# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 12# OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF 13# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. 14# IN NO EVENT SHALL THE ABOVE COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, 15# DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR 16# OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR 17# THE USE OR OTHER DEALINGS IN THE SOFTWARE. 18 19# ====================================================================== 20# Initialization 21# ====================================================================== 22 23CSIH_SCRIPT=/usr/share/csih/cygwin-service-installation-helper.sh 24 25# List of apps used. This is checkad for existance in csih_sanity_check 26# Don't use *any* transient commands before sourcing the csih helper script, 27# otherwise the sanity checks are short-circuited. 28declare -a csih_required_commands=( 29 /usr/bin/basename coreutils 30 /usr/bin/cat coreutils 31 /usr/bin/chmod coreutils 32 /usr/bin/dirname coreutils 33 /usr/bin/id coreutils 34 /usr/bin/mv coreutils 35 /usr/bin/rm coreutils 36 /usr/bin/cygpath cygwin 37 /usr/bin/mkpasswd cygwin 38 /usr/bin/mount cygwin 39 /usr/bin/ps cygwin 40 /usr/bin/umount cygwin 41 /usr/bin/cmp diffutils 42 /usr/bin/grep grep 43 /usr/bin/awk gawk 44 /usr/bin/ssh-keygen openssh 45 /usr/sbin/sshd openssh 46 /usr/bin/sed sed 47) 48csih_sanity_check_server=yes 49source ${CSIH_SCRIPT} 50 51PROGNAME=$(/usr/bin/basename $0) 52_tdir=$(/usr/bin/dirname $0) 53PROGDIR=$(cd $_tdir && pwd) 54 55# Subdirectory where the new package is being installed 56PREFIX=/usr 57 58# Directory where the config files are stored 59SYSCONFDIR=/etc 60LOCALSTATEDIR=/var 61 62sshd_config_configured=no 63port_number=22 64service_name=sshd 65strictmodes=yes 66privsep_used=yes 67cygwin_value="" 68user_account= 69password_value= 70opt_force=no 71 72# ====================================================================== 73# Routine: update_services_file 74# ====================================================================== 75update_services_file() { 76 local _my_etcdir="/ssh-host-config.$$" 77 local _win_etcdir 78 local _services 79 local _spaces 80 local _serv_tmp 81 local _wservices 82 local ret=0 83 84 _win_etcdir="${SYSTEMROOT}\\system32\\drivers\\etc" 85 _services="${_my_etcdir}/services" 86 _spaces=" #" 87 _serv_tmp="${_my_etcdir}/srv.out.$$" 88 89 /usr/bin/mount -o text,posix=0,noacl -f "${_win_etcdir}" "${_my_etcdir}" 90 91 # Depends on the above mount 92 _wservices=`cygpath -w "${_services}"` 93 94 # Add ssh 22/tcp and ssh 22/udp to services 95 if [ `/usr/bin/grep -q 'ssh[[:space:]][[:space:]]*22' "${_services}"; echo $?` -ne 0 ] 96 then 97 if /usr/bin/awk '{ if ( $2 ~ /^23\/tcp/ ) print "ssh 22/tcp'"${_spaces}"'SSH Remote Login Protocol\nssh 22/udp'"${_spaces}"'SSH Remote Login Protocol"; print $0; }' < "${_services}" > "${_serv_tmp}" 98 then 99 if /usr/bin/mv "${_serv_tmp}" "${_services}" 100 then 101 csih_inform "Added ssh to ${_wservices}" 102 else 103 csih_warning "Adding ssh to ${_wservices} failed!" 104 let ++ret 105 fi 106 /usr/bin/rm -f "${_serv_tmp}" 107 else 108 csih_warning "Adding ssh to ${_wservices} failed!" 109 let ++ret 110 fi 111 fi 112 /usr/bin/umount "${_my_etcdir}" 113 return $ret 114} # --- End of update_services_file --- # 115 116# ====================================================================== 117# Routine: sshd_strictmodes 118# MODIFIES: strictmodes 119# ====================================================================== 120sshd_strictmodes() { 121 if [ "${sshd_config_configured}" != "yes" ] 122 then 123 echo 124 csih_inform "StrictModes is set to 'yes' by default." 125 csih_inform "This is the recommended setting, but it requires that the POSIX" 126 csih_inform "permissions of the user's home directory, the user's .ssh" 127 csih_inform "directory, and the user's ssh key files are tight so that" 128 csih_inform "only the user has write permissions." 129 csih_inform "On the other hand, StrictModes don't work well with default" 130 csih_inform "Windows permissions of a home directory mounted with the" 131 csih_inform "'noacl' option, and they don't work at all if the home" 132 csih_inform "directory is on a FAT or FAT32 partition." 133 if ! csih_request "Should StrictModes be used?" 134 then 135 strictmodes=no 136 fi 137 fi 138 return 0 139} 140 141# ====================================================================== 142# Routine: sshd_privsep 143# MODIFIES: privsep_used 144# ====================================================================== 145sshd_privsep() { 146 local ret=0 147 148 if [ "${sshd_config_configured}" != "yes" ] 149 then 150 echo 151 csih_inform "Privilege separation is set to 'sandbox' by default since" 152 csih_inform "OpenSSH 6.1. This is unsupported by Cygwin and has to be set" 153 csih_inform "to 'yes' or 'no'." 154 csih_inform "However, using privilege separation requires a non-privileged account" 155 csih_inform "called 'sshd'." 156 csih_inform "For more info on privilege separation read /usr/share/doc/openssh/README.privsep." 157 if csih_request "Should privilege separation be used?" 158 then 159 privsep_used=yes 160 if ! csih_create_unprivileged_user sshd 161 then 162 csih_error_recoverable "Couldn't create user 'sshd'!" 163 csih_error_recoverable "Privilege separation set to 'no' again!" 164 csih_error_recoverable "Check your ${SYSCONFDIR}/sshd_config file!" 165 let ++ret 166 privsep_used=no 167 fi 168 else 169 privsep_used=no 170 fi 171 fi 172 return $ret 173} # --- End of sshd_privsep --- # 174 175# ====================================================================== 176# Routine: sshd_config_tweak 177# ====================================================================== 178sshd_config_tweak() { 179 local ret=0 180 181 # Modify sshd_config 182 csih_inform "Updating ${SYSCONFDIR}/sshd_config file" 183 if [ "${port_number}" -ne 22 ] 184 then 185 /usr/bin/sed -i -e "s/^#\?[[:space:]]*Port[[:space:]].*/Port ${port_number}/" \ 186 ${SYSCONFDIR}/sshd_config 187 if [ $? -ne 0 ] 188 then 189 csih_warning "Setting listening port to ${port_number} failed!" 190 csih_warning "Check your ${SYSCONFDIR}/sshd_config file!" 191 let ++ret 192 fi 193 fi 194 if [ "${strictmodes}" = "no" ] 195 then 196 /usr/bin/sed -i -e "s/^#\?[[:space:]]*StrictModes[[:space:]].*/StrictModes no/" \ 197 ${SYSCONFDIR}/sshd_config 198 if [ $? -ne 0 ] 199 then 200 csih_warning "Setting StrictModes to 'no' failed!" 201 csih_warning "Check your ${SYSCONFDIR}/sshd_config file!" 202 let ++ret 203 fi 204 fi 205 if [ "${sshd_config_configured}" != "yes" ] 206 then 207 /usr/bin/sed -i -e " 208 s/^#\?UsePrivilegeSeparation .*/UsePrivilegeSeparation ${privsep_used}/" \ 209 ${SYSCONFDIR}/sshd_config 210 if [ $? -ne 0 ] 211 then 212 csih_warning "Setting privilege separation failed!" 213 csih_warning "Check your ${SYSCONFDIR}/sshd_config file!" 214 let ++ret 215 fi 216 fi 217 return $ret 218} # --- End of sshd_config_tweak --- # 219 220# ====================================================================== 221# Routine: update_inetd_conf 222# ====================================================================== 223update_inetd_conf() { 224 local _inetcnf="${SYSCONFDIR}/inetd.conf" 225 local _inetcnf_tmp="${SYSCONFDIR}/inetd.conf.$$" 226 local _inetcnf_dir="${SYSCONFDIR}/inetd.d" 227 local _sshd_inetd_conf="${_inetcnf_dir}/sshd-inetd" 228 local _sshd_inetd_conf_tmp="${_inetcnf_dir}/sshd-inetd.$$" 229 local _with_comment=1 230 local ret=0 231 232 if [ -d "${_inetcnf_dir}" ] 233 then 234 # we have inetutils-1.5 inetd.d support 235 if [ -f "${_inetcnf}" ] 236 then 237 /usr/bin/grep -q '^[[:space:]]*ssh' "${_inetcnf}" && _with_comment=0 238 239 # check for sshd OR ssh in top-level inetd.conf file, and remove 240 # will be replaced by a file in inetd.d/ 241 if [ $(/usr/bin/grep -q '^[# \t]*ssh' "${_inetcnf}"; echo $?) -eq 0 ] 242 then 243 /usr/bin/grep -v '^[# \t]*ssh' "${_inetcnf}" >> "${_inetcnf_tmp}" 244 if [ -f "${_inetcnf_tmp}" ] 245 then 246 if /usr/bin/mv "${_inetcnf_tmp}" "${_inetcnf}" 247 then 248 csih_inform "Removed ssh[d] from ${_inetcnf}" 249 else 250 csih_warning "Removing ssh[d] from ${_inetcnf} failed!" 251 let ++ret 252 fi 253 /usr/bin/rm -f "${_inetcnf_tmp}" 254 else 255 csih_warning "Removing ssh[d] from ${_inetcnf} failed!" 256 let ++ret 257 fi 258 fi 259 fi 260 261 csih_install_config "${_sshd_inetd_conf}" "${SYSCONFDIR}/defaults" 262 if /usr/bin/cmp "${SYSCONFDIR}/defaults${_sshd_inetd_conf}" "${_sshd_inetd_conf}" >/dev/null 2>&1 263 then 264 if [ "${_with_comment}" -eq 0 ] 265 then 266 /usr/bin/sed -e 's/@COMMENT@[[:space:]]*//' < "${_sshd_inetd_conf}" > "${_sshd_inetd_conf_tmp}" 267 else 268 /usr/bin/sed -e 's/@COMMENT@[[:space:]]*/# /' < "${_sshd_inetd_conf}" > "${_sshd_inetd_conf_tmp}" 269 fi 270 if /usr/bin/mv "${_sshd_inetd_conf_tmp}" "${_sshd_inetd_conf}" 271 then 272 csih_inform "Updated ${_sshd_inetd_conf}" 273 else 274 csih_warning "Updating ${_sshd_inetd_conf} failed!" 275 let ++ret 276 fi 277 fi 278 279 elif [ -f "${_inetcnf}" ] 280 then 281 /usr/bin/grep -q '^[[:space:]]*sshd' "${_inetcnf}" && _with_comment=0 282 283 # check for sshd in top-level inetd.conf file, and remove 284 # will be replaced by a file in inetd.d/ 285 if [ `/usr/bin/grep -q '^#\?[[:space:]]*sshd' "${_inetcnf}"; echo $?` -eq 0 ] 286 then 287 /usr/bin/grep -v '^#\?[[:space:]]*sshd' "${_inetcnf}" >> "${_inetcnf_tmp}" 288 if [ -f "${_inetcnf_tmp}" ] 289 then 290 if /usr/bin/mv "${_inetcnf_tmp}" "${_inetcnf}" 291 then 292 csih_inform "Removed sshd from ${_inetcnf}" 293 else 294 csih_warning "Removing sshd from ${_inetcnf} failed!" 295 let ++ret 296 fi 297 /usr/bin/rm -f "${_inetcnf_tmp}" 298 else 299 csih_warning "Removing sshd from ${_inetcnf} failed!" 300 let ++ret 301 fi 302 fi 303 304 # Add ssh line to inetd.conf 305 if [ `/usr/bin/grep -q '^[# \t]*ssh' "${_inetcnf}"; echo $?` -ne 0 ] 306 then 307 if [ "${_with_comment}" -eq 0 ] 308 then 309 echo 'ssh stream tcp nowait root /usr/sbin/sshd sshd -i' >> "${_inetcnf}" 310 else 311 echo '# ssh stream tcp nowait root /usr/sbin/sshd sshd -i' >> "${_inetcnf}" 312 fi 313 if [ $? -eq 0 ] 314 then 315 csih_inform "Added ssh to ${_inetcnf}" 316 else 317 csih_warning "Adding ssh to ${_inetcnf} failed!" 318 let ++ret 319 fi 320 fi 321 fi 322 return $ret 323} # --- End of update_inetd_conf --- # 324 325# ====================================================================== 326# Routine: check_service_files_ownership 327# Checks that the files in /etc and /var belong to the right owner 328# ====================================================================== 329check_service_files_ownership() { 330 local run_service_as=$1 331 local ret=0 332 333 if [ -z "${run_service_as}" ] 334 then 335 accnt_name=$(/usr/bin/cygrunsrv -VQ sshd | 336 /usr/bin/sed -ne 's/^Account *: *//gp') 337 if [ "${accnt_name}" = "LocalSystem" ] 338 then 339 # Convert "LocalSystem" to "SYSTEM" as is the correct account name 340 run_service_as="SYSTEM" 341 else 342 dom="${accnt_name%%\\*}" 343 accnt_name="${accnt_name#*\\}" 344 if [ "${dom}" = '.' ] 345 then 346 # Check local account 347 run_service_as=$(/usr/bin/mkpasswd -l -u "${accnt_name}" | 348 /usr/bin/awk -F: '{print $1;}') 349 else 350 # Check domain 351 run_service_as=$(/usr/bin/mkpasswd -d "${dom}" -u "${accnt_name}" | 352 /usr/bin/awk -F: '{print $1;}') 353 fi 354 fi 355 if [ -z "${run_service_as}" ] 356 then 357 csih_warning "Couldn't determine name of user running sshd service from account database!" 358 csih_warning "As a result, this script cannot make sure that the files used" 359 csih_warning "by the sshd service belong to the user running the service." 360 return 1 361 fi 362 fi 363 for i in "${SYSCONFDIR}"/ssh_config "${SYSCONFDIR}"/sshd_config "${SYSCONFDIR}"/ssh_host_*key "${SYSCONFDIR}"/ssh_host_*key.pub 364 do 365 if [ -f "$i" ] 366 then 367 if ! chown "${run_service_as}".544 "$i" >/dev/null 2>&1 368 then 369 csih_warning "Couldn't change owner of $i!" 370 let ++ret 371 fi 372 fi 373 done 374 if ! chown "${run_service_as}".544 ${LOCALSTATEDIR}/empty >/dev/null 2>&1 375 then 376 csih_warning "Couldn't change owner of ${LOCALSTATEDIR}/empty!" 377 let ++ret 378 fi 379 if ! chown "${run_service_as}".544 ${LOCALSTATEDIR}/log/lastlog >/dev/null 2>&1 380 then 381 csih_warning "Couldn't change owner of ${LOCALSTATEDIR}/log/lastlog!" 382 let ++ret 383 fi 384 if [ -f ${LOCALSTATEDIR}/log/sshd.log ] 385 then 386 if ! chown "${run_service_as}".544 ${LOCALSTATEDIR}/log/sshd.log >/dev/null 2>&1 387 then 388 csih_warning "Couldn't change owner of ${LOCALSTATEDIR}/log/sshd.log!" 389 let ++ret 390 fi 391 fi 392 if [ $ret -ne 0 ] 393 then 394 csih_warning "Couldn't change owner of important files to ${run_service_as}!" 395 csih_warning "This may cause the sshd service to fail! Please make sure that" 396 csih_warning "you have suufficient permissions to change the ownership of files" 397 csih_warning "and try to run the ssh-host-config script again." 398 fi 399 return $ret 400} # --- End of check_service_files_ownership --- # 401 402# ====================================================================== 403# Routine: install_service 404# Install sshd as a service 405# ====================================================================== 406install_service() { 407 local run_service_as 408 local password 409 local ret=0 410 411 echo 412 if /usr/bin/cygrunsrv -Q ${service_name} >/dev/null 2>&1 413 then 414 csih_inform "Sshd service is already installed." 415 check_service_files_ownership "" || let ret+=$? 416 else 417 echo -e "${_csih_QUERY_STR} Do you want to install sshd as a service?" 418 if csih_request "(Say \"no\" if it is already installed as a service)" 419 then 420 csih_get_cygenv "${cygwin_value}" 421 422 if ( csih_is_nt2003 || [ "$csih_FORCE_PRIVILEGED_USER" = "yes" ] ) 423 then 424 csih_inform "On Windows Server 2003, Windows Vista, and above, the" 425 csih_inform "SYSTEM account cannot setuid to other users -- a capability" 426 csih_inform "sshd requires. You need to have or to create a privileged" 427 csih_inform "account. This script will help you do so." 428 echo 429 430 [ "${opt_force}" = "yes" ] && opt_f=-f 431 [ -n "${user_account}" ] && opt_u="-u ""${user_account}""" 432 csih_select_privileged_username ${opt_f} ${opt_u} sshd 433 434 if ! csih_create_privileged_user "${password_value}" 435 then 436 csih_error_recoverable "There was a serious problem creating a privileged user." 437 csih_request "Do you want to proceed anyway?" || exit 1 438 let ++ret 439 fi 440 fi 441 442 # Never returns empty if NT or above 443 run_service_as=$(csih_service_should_run_as) 444 445 if [ "${run_service_as}" = "${csih_PRIVILEGED_USERNAME}" ] 446 then 447 password="${csih_PRIVILEGED_PASSWORD}" 448 if [ -z "${password}" ] 449 then 450 csih_get_value "Please enter the password for user '${run_service_as}':" "-s" 451 password="${csih_value}" 452 fi 453 fi 454 455 # At this point, we either have $run_service_as = "system" and 456 # $password is empty, or $run_service_as is some privileged user and 457 # (hopefully) $password contains the correct password. So, from here 458 # out, we use '-z "${password}"' to discriminate the two cases. 459 460 csih_check_user "${run_service_as}" 461 462 if [ -n "${csih_cygenv}" ] 463 then 464 cygwin_env=( -e "CYGWIN=${csih_cygenv}" ) 465 fi 466 if [ -z "${password}" ] 467 then 468 if /usr/bin/cygrunsrv -I ${service_name} -d "CYGWIN ${service_name}" -p /usr/sbin/sshd \ 469 -a "-D" -y tcpip "${cygwin_env[@]}" 470 then 471 echo 472 csih_inform "The sshd service has been installed under the LocalSystem" 473 csih_inform "account (also known as SYSTEM). To start the service now, call" 474 csih_inform "\`net start sshd' or \`cygrunsrv -S sshd'. Otherwise, it" 475 csih_inform "will start automatically after the next reboot." 476 fi 477 else 478 if /usr/bin/cygrunsrv -I ${service_name} -d "CYGWIN ${service_name}" -p /usr/sbin/sshd \ 479 -a "-D" -y tcpip "${cygwin_env[@]}" \ 480 -u "${run_service_as}" -w "${password}" 481 then 482 /usr/bin/editrights -u "${run_service_as}" -a SeServiceLogonRight 483 echo 484 csih_inform "The sshd service has been installed under the '${run_service_as}'" 485 csih_inform "account. To start the service now, call \`net start ${service_name}' or" 486 csih_inform "\`cygrunsrv -S ${service_name}'. Otherwise, it will start automatically" 487 csih_inform "after the next reboot." 488 fi 489 fi 490 491 if /usr/bin/cygrunsrv -Q ${service_name} >/dev/null 2>&1 492 then 493 check_service_files_ownership "${run_service_as}" || let ret+=$? 494 else 495 csih_error_recoverable "Installing sshd as a service failed!" 496 let ++ret 497 fi 498 fi # user allowed us to install as service 499 fi # service not yet installed 500 return $ret 501} # --- End of install_service --- # 502 503# ====================================================================== 504# Main Entry Point 505# ====================================================================== 506 507# Check how the script has been started. If 508# (1) it has been started by giving the full path and 509# that path is /etc/postinstall, OR 510# (2) Otherwise, if the environment variable 511# SSH_HOST_CONFIG_AUTO_ANSWER_NO is set 512# then set auto_answer to "no". This allows automatic 513# creation of the config files in /etc w/o overwriting 514# them if they already exist. In both cases, color 515# escape sequences are suppressed, so as to prevent 516# cluttering setup's logfiles. 517if [ "$PROGDIR" = "/etc/postinstall" ] 518then 519 csih_auto_answer="no" 520 csih_disable_color 521 opt_force=yes 522fi 523if [ -n "${SSH_HOST_CONFIG_AUTO_ANSWER_NO}" ] 524then 525 csih_auto_answer="no" 526 csih_disable_color 527 opt_force=yes 528fi 529 530# ====================================================================== 531# Parse options 532# ====================================================================== 533while : 534do 535 case $# in 536 0) 537 break 538 ;; 539 esac 540 541 option=$1 542 shift 543 544 case "${option}" in 545 -d | --debug ) 546 set -x 547 csih_trace_on 548 ;; 549 550 -y | --yes ) 551 csih_auto_answer=yes 552 opt_force=yes 553 ;; 554 555 -n | --no ) 556 csih_auto_answer=no 557 opt_force=yes 558 ;; 559 560 -c | --cygwin ) 561 cygwin_value="$1" 562 shift 563 ;; 564 565 -N | --name ) 566 service_name=$1 567 shift 568 ;; 569 570 -p | --port ) 571 port_number=$1 572 shift 573 ;; 574 575 -u | --user ) 576 user_account="$1" 577 shift 578 ;; 579 580 -w | --pwd ) 581 password_value="$1" 582 shift 583 ;; 584 585 --privileged ) 586 csih_FORCE_PRIVILEGED_USER=yes 587 ;; 588 589 *) 590 echo "usage: ${progname} [OPTION]..." 591 echo 592 echo "This script creates an OpenSSH host configuration." 593 echo 594 echo "Options:" 595 echo " --debug -d Enable shell's debug output." 596 echo " --yes -y Answer all questions with \"yes\" automatically." 597 echo " --no -n Answer all questions with \"no\" automatically." 598 echo " --cygwin -c <options> Use \"options\" as value for CYGWIN environment var." 599 echo " --name -N <name> sshd windows service name." 600 echo " --port -p <n> sshd listens on port n." 601 echo " --user -u <account> privileged user for service, default 'cyg_server'." 602 echo " --pwd -w <passwd> Use \"pwd\" as password for privileged user." 603 echo " --privileged On Windows XP, require privileged user" 604 echo " instead of LocalSystem for sshd service." 605 echo 606 exit 1 607 ;; 608 609 esac 610done 611 612# ====================================================================== 613# Action! 614# ====================================================================== 615 616# Check for running ssh/sshd processes first. Refuse to do anything while 617# some ssh processes are still running 618if /usr/bin/ps -ef | /usr/bin/grep -q '/sshd\?$' 619then 620 echo 621 csih_error "There are still ssh processes running. Please shut them down first." 622fi 623 624# Make sure the user is running in an administrative context 625admin=$(/usr/bin/id -G | /usr/bin/grep -Eq '\<544\>' && echo yes || echo no) 626if [ "${admin}" != "yes" ] 627then 628 echo 629 csih_warning "Running this script typically requires administrator privileges!" 630 csih_warning "However, it seems your account does not have these privileges." 631 csih_warning "Here's the list of groups in your user token:" 632 echo 633 /usr/bin/id -Gnz | xargs -0n1 echo " " 634 echo 635 csih_warning "This usually means you're running this script from a non-admin" 636 csih_warning "desktop session, or in a non-elevated shell under UAC control." 637 echo 638 csih_warning "Make sure you have the appropriate privileges right now," 639 csih_warning "otherwise parts of this script will probably fail!" 640 echo 641 echo -e "${_csih_QUERY_STR} Are you sure you want to continue? (Say \"no\" if you're not sure" 642 if ! csih_request "you have the required privileges)" 643 then 644 echo 645 csih_inform "Ok. Exiting. Make sure to switch to an administrative account" 646 csih_inform "or to start this script from an elevated shell." 647 exit 1 648 fi 649fi 650 651echo 652 653warning_cnt=0 654 655# Create /var/log/lastlog if not already exists 656if [ -e ${LOCALSTATEDIR}/log/lastlog -a ! -f ${LOCALSTATEDIR}/log/lastlog ] 657then 658 echo 659 csih_error_multi "${LOCALSTATEDIR}/log/lastlog exists, but is not a file." \ 660 "Cannot create ssh host configuration." 661fi 662if [ ! -e ${LOCALSTATEDIR}/log/lastlog ] 663then 664 /usr/bin/cat /dev/null > ${LOCALSTATEDIR}/log/lastlog 665 if ! /usr/bin/chmod 644 ${LOCALSTATEDIR}/log/lastlog >/dev/null 2>&1 666 then 667 csih_warning "Can't set permissions on ${LOCALSTATEDIR}/log/lastlog!" 668 let ++warning_cnt 669 fi 670fi 671 672# Create /var/empty file used as chroot jail for privilege separation 673csih_make_dir "${LOCALSTATEDIR}/empty" "Cannot create ${LOCALSTATEDIR}/empty directory." 674if ! /usr/bin/chmod 755 "${LOCALSTATEDIR}/empty" >/dev/null 2>&1 675then 676 csih_warning "Can't set permissions on ${LOCALSTATEDIR}/empty!" 677 let ++warning_cnt 678fi 679 680# generate missing host keys 681csih_inform "Generating missing SSH host keys" 682/usr/bin/ssh-keygen -A || let warning_cnt+=$? 683 684# handle ssh_config 685csih_install_config "${SYSCONFDIR}/ssh_config" "${SYSCONFDIR}/defaults" || let ++warning_cnt 686if /usr/bin/cmp "${SYSCONFDIR}/ssh_config" "${SYSCONFDIR}/defaults/${SYSCONFDIR}/ssh_config" >/dev/null 2>&1 687then 688 if [ "${port_number}" != "22" ] 689 then 690 csih_inform "Updating ${SYSCONFDIR}/ssh_config file with requested port" 691 echo "Host localhost" >> ${SYSCONFDIR}/ssh_config 692 echo " Port ${port_number}" >> ${SYSCONFDIR}/ssh_config 693 fi 694fi 695 696# handle sshd_config (and privsep) 697csih_install_config "${SYSCONFDIR}/sshd_config" "${SYSCONFDIR}/defaults" || let ++warning_cnt 698if ! /usr/bin/cmp "${SYSCONFDIR}/sshd_config" "${SYSCONFDIR}/defaults/${SYSCONFDIR}/sshd_config" >/dev/null 2>&1 699then 700 sshd_config_configured=yes 701fi 702sshd_strictmodes || let warning_cnt+=$? 703sshd_privsep || let warning_cnt+=$? 704sshd_config_tweak || let warning_cnt+=$? 705update_services_file || let warning_cnt+=$? 706update_inetd_conf || let warning_cnt+=$? 707install_service || let warning_cnt+=$? 708 709echo 710if [ $warning_cnt -eq 0 ] 711then 712 csih_inform "Host configuration finished. Have fun!" 713else 714 csih_warning "Host configuration exited with ${warning_cnt} errors or warnings!" 715 csih_warning "Make sure that all problems reported are fixed," 716 csih_warning "then re-run ssh-host-config." 717fi 718exit $warning_cnt 719