Re: [ptxdist] [PATCH] openssh: improve rc.once.d script and harden sshd_config

[Clemens Gruber <clemens.gruber@pqgruber.com>]

Hi Michael,

On Fri, Aug 07, 2015 at 12:45:48PM +0200, Michael Olbrich wrote:
> Forgot the attachment...
> 
> Michael
> 
> -- 
> Pengutronix e.K.                           |                             |
> Industrial Linux Solutions                 | http://www.pengutronix.de/  |
> Peiner Str. 6-8, 31137 Hildesheim, Germany | Phone: +49-5121-206917-0    |
> Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

> #!/bin/sh
> 
> PATH=/sbin:/bin:/usr/sbin:/usr/bin
> 
> get_hostkeys() {
> 	[ -f /etc/ssh/sshd_config ] || return
> 	sed -n 's/^HostKey[ \t][ \t]*\(.*\)/\1/p' /etc/ssh/sshd_config
> }
> 
> host_keys_required() {
> 	hostkeys="$(get_hostkeys)"
> 	if [ "$hostkeys" ]; then
> 		echo "$hostkeys"
> 	else
> 		# No HostKey directives found, so we pick some defaults
> 		echo /etc/ssh/ssh_host_ed25519_key
> 		echo /etc/ssh/ssh_host_rsa_key
> 	fi
> }
> 
> create_key() {
> 	msg="$1"
> 	shift
> 	hostkeys="$1"
> 	shift
> 	file="$1"
> 	shift
> 
> 	if echo "$hostkeys" | grep -x "$file" >/dev/null; then
> 		echo "$msg; this may take some time ..."
> 		rm -f $file &&
> 		ssh-keygen -q -f "$file" -N '' "$@" || return
> 		echo "$msg; done."
> 	fi
> }
> 
> create_keys() {
> 	hostkeys="$(host_keys_required)"
> 
> 	create_key "Creating DSA key" \
> 		"$hostkeys" /etc/ssh/ssh_host_dsa_key -t dsa &&
> 	create_key "Creating ECDSA key" \
> 		"$hostkeys" /etc/ssh/ssh_host_ecdsa_key -t ecdsa &&
> 	create_key "Creating ED25519 key" \
> 		"$hostkeys" /etc/ssh/ssh_host_ed25519_key -t ed25519 &&
> 	create_key "Creating RSA key" \
> 		"$hostkeys" /etc/ssh/ssh_host_rsa_key -t rsa -b 4096
> }
> 
> if ! create_keys; then
> 	echo "Generating SSH keys failed!"
> 	exit 1
> fi

Looks good to me. I'll rebase my changes on the new sshd_config, include your
rc.once.d changes and send a new patch!

Would you like the users of ptxdist master to test this in the meantime or do
you prefer merging it after your vacation?

Happy holidays! 

Clemens

-- 
ptxdist mailing list
ptxdist@pengutronix.de