WebSVN - Diff - Rev 120 and 152 - /trunk/debian/lsh-server.postinst


#!/bin/sh
# postinst script for lsh-server
#
# see: dh_installdeb(1)

set -e

# summary of how this script can be called:
#        * <postinst> `configure' <most-recently-configured-version>
#        * <old-postinst> `abort-upgrade' <new version>
#        * <conflictor's-postinst> `abort-remove' `in-favour' <package>
#          <new-version>
#        * <deconfigured's-postinst> `abort-deconfigure' `in-favour'
#          <failed-install-package> <version> `removing'
#          <conflicting-package> <version>
# for details, see http://www.debian.org/doc/debian-policy/ or
# the debian-policy package
#
# quoting from the policy:
#     Any necessary prompting should almost always be confined to the
#     post-installation script, and should be protected with a conditional
#     so that unnecessary prompting doesn't happen if a package's
#     installation fails and the `postinst' is called with `abort-upgrade',
#     `abort-remove' or `abort-deconfigure'.

create_seed_and_key() {
    RANDOM_SEED="/var/spool/lsh/yarrow-seed-file"
    HOST_KEY="/etc/lsh_host_key"
    OPENSSH_HOST_KEY="/etc/ssh/ssh_host_rsa_key"

    if [ ! -f "$RANDOM_SEED" ]; then
	echo -n "Creating lsh random seed file (this may take a while) ..."
	DIR=$(dirname "$RANDOM_SEED")
	if install -d -m 700 "$DIR" &&
	    dd if=/dev/random "of=$RANDOM_SEED" bs=1 count=32 2>/dev/null &&
	    chmod 600 "$RANDOM_SEED"; then
	    echo " done."
	else
	    echo " failed!"
	    return 1
	fi
    fi

    if [ ! -f "$HOST_KEY" ]; then
	if [ -r "$OPENSSH_HOST_KEY" ]; then
	    echo -n "Converting existing OpenSSH RSA host key ... "
	    if pkcs1-conv < "$OPENSSH_HOST_KEY" | lsh-writekey --server &&
		[ -f "$HOST_KEY" -a -f "$HOST_KEY.pub" ]; then
		chmod +r "$HOST_KEY.pub"
		echo "done."
		return 0
	    fi
	    rm -f "$HOST_KEY" "$HOST_KEY.pub"
	    echo "failed. Will generate a new key instead."
	fi
	echo -n "Creating lsh host key ... "
	if lsh-keygen --server | lsh-writekey --server &&
	    [ -f "$HOST_KEY" -a -f "$HOST_KEY.pub" ]; then
	    chmod +r "$HOST_KEY.pub"
	    echo "done."
	else
	    echo "failed!"
	    return 1
	fi
    fi
    return 0
}

LSHD_DEFAULTS=/etc/default/lsh-server

case "$1" in
    configure)

	# This needs to be fixed. If we do stuff this way, strange things will
	# happen ... the user can specify stuff to debconf and old options can
	# still be written to the config file :-(
	# First, get default options
	#[ -e "$LSHD_DEFAULTS" ] && . "$LSHD_DEFAULTS"

	# Fall back to default options if necessary
	LSHD_PORT=${LSHD_PORT:-2222}
	ENABLE_SFTP=${ENABLE_SFTP:-false}

	# Make sure ENABLE_SFTP is either "true" or "false", set up option
	case "$ENABLE_SFTP" in
	    true|TRUE|y*|Y*)
		ENABLE_SFTP=true
		;;
	    *)
		ENABLE_SFTP=false
		;;
	esac
	
	. /usr/share/debconf/confmodule
   
	db_get "lsh-server/lshd_port"; LSHD_PORT="$RET"
	db_get "lsh-server/sftp"; ENABLE_SFTP="$RET"
	db_get "lsh-server/extra_args"; EXTRA_ARGS="$RET"
	exec 3>&-

	# OK, now make the config file

	cat <<"EOF" >"$LSHD_DEFAULTS"
# Configuration file generated by lsh-server.postinst.
# You can change the lsh-server configuration either by editing
# this file, or by running dpkg-reconfigure lsh-server.
#
# If systemd is used, this file is read as an environment file and can
# only contain environment variable assignments.
EOF

	echo "LSHD_PORT=\"$LSHD_PORT\"" >>"$LSHD_DEFAULTS"
	echo "ENABLE_SFTP=\"$ENABLE_SFTP\"" >> "$LSHD_DEFAULTS"
	echo "EXTRA_ARGS=\"$EXTRA_ARGS\"" >> "$LSHD_DEFAULTS"

	# Versions before 2.0.1cdbs-4 have a security issue, therefore
	# have the random seed regenerated.
	if [ "$2" ] && [ -e "/var/spool/lsh/yarrow-seed-file" ] \
		&& dpkg --compare-versions "$2" lt "2.0.1cdbs-4"; then
		echo " Removing /var/spool/lsh/yarrow-seed-file, because of you are upgrading from a"
		echo " version with a known security bug, so we can't trust the seed any more."
		echo " It will be automatically regenerated from /dev/random."
		rm /var/spool/lsh/yarrow-seed-file
	fi

	# Disable ssh if needed
	if [ "$LSHD_PORT" -eq 22 ] ; then
	    if [ ! -d /etc/ssh ] ; then
		mkdir -p /etc/ssh
	    fi

	    file=/etc/ssh/sshd_not_to_be_run
	    if [ ! -f "$file" ] ; then
# stop ssh from starting at bootup
		cat  <<"EOF" >"$file"
LSH_SERVER_CONFIG_GENERATED
# Generated by lsh-server.postinst
# Please don't remove this file unless you have first disabled lsh, and don't
# change the first line ... otherwise lsh-server won't recognise it!!!
EOF

		if [ -x "/etc/init.d/ssh" ]; then
 
		    invoke-rc.d ssh stop || true
 
 
 
		fi
	    fi
	fi

	create_seed_and_key
    ;;

    abort-upgrade|abort-remove|abort-deconfigure)

    ;;

    *)
        echo "postinst called with unknown argument \`$1'" >&2
        exit 1
    ;;
esac

# dh_installdeb will replace this with shell code automatically
# generated by other debhelper scripts

#DEBHELPER#

exit 0

Subversion Repositories

(root)/trunk/debian/lsh-server.postinst - Rev 120 → 152

Rev 120		Rev 152
1	#!/bin/sh	1	#!/bin/sh
2	# postinst script for lsh-server	2	# postinst script for lsh-server
3	#	3	#
4	# see: dh_installdeb(1)	4	# see: dh_installdeb(1)
5		5
6	set -e	6	set -e
7		7
8	# summary of how this script can be called:	8	# summary of how this script can be called:
9	# * <postinst> `configure' <most-recently-configured-version>	9	# * <postinst> `configure' <most-recently-configured-version>
10	# * <old-postinst> `abort-upgrade' <new version>	10	# * <old-postinst> `abort-upgrade' <new version>
11	# * <conflictor's-postinst> `abort-remove' `in-favour' <package>	11	# * <conflictor's-postinst> `abort-remove' `in-favour' <package>
12	# <new-version>	12	# <new-version>
13	# * <deconfigured's-postinst> `abort-deconfigure' `in-favour'	13	# * <deconfigured's-postinst> `abort-deconfigure' `in-favour'
14	# <failed-install-package> <version> `removing'	14	# <failed-install-package> <version> `removing'
15	# <conflicting-package> <version>	15	# <conflicting-package> <version>
16	# for details, see http://www.debian.org/doc/debian-policy/ or	16	# for details, see http://www.debian.org/doc/debian-policy/ or
17	# the debian-policy package	17	# the debian-policy package
18	#	18	#
19	# quoting from the policy:	19	# quoting from the policy:
20	# Any necessary prompting should almost always be confined to the	20	# Any necessary prompting should almost always be confined to the
21	# post-installation script, and should be protected with a conditional	21	# post-installation script, and should be protected with a conditional
22	# so that unnecessary prompting doesn't happen if a package's	22	# so that unnecessary prompting doesn't happen if a package's
23	# installation fails and the `postinst' is called with `abort-upgrade',	23	# installation fails and the `postinst' is called with `abort-upgrade',
24	# `abort-remove' or `abort-deconfigure'.	24	# `abort-remove' or `abort-deconfigure'.
25		25
26	create_seed_and_key() {	26	create_seed_and_key() {
27	RANDOM_SEED="/var/spool/lsh/yarrow-seed-file"	27	RANDOM_SEED="/var/spool/lsh/yarrow-seed-file"
28	HOST_KEY="/etc/lsh_host_key"	28	HOST_KEY="/etc/lsh_host_key"
29	OPENSSH_HOST_KEY="/etc/ssh/ssh_host_rsa_key"	29	OPENSSH_HOST_KEY="/etc/ssh/ssh_host_rsa_key"
30		30
31	if [ ! -f "$RANDOM_SEED" ]; then	31	if [ ! -f "$RANDOM_SEED" ]; then
32	echo -n "Creating lsh random seed file (this may take a while) ..."	32	echo -n "Creating lsh random seed file (this may take a while) ..."
33	DIR=$(dirname "$RANDOM_SEED")	33	DIR=$(dirname "$RANDOM_SEED")
34	if install -d -m 700 "$DIR" &&	34	if install -d -m 700 "$DIR" &&
35	dd if=/dev/random "of=$RANDOM_SEED" bs=1 count=32 2>/dev/null &&	35	dd if=/dev/random "of=$RANDOM_SEED" bs=1 count=32 2>/dev/null &&
36	chmod 600 "$RANDOM_SEED"; then	36	chmod 600 "$RANDOM_SEED"; then
37	echo " done."	37	echo " done."
38	else	38	else
39	echo " failed!"	39	echo " failed!"
40	return 1	40	return 1
41	fi	41	fi
42	fi	42	fi
43		43
44	if [ ! -f "$HOST_KEY" ]; then	44	if [ ! -f "$HOST_KEY" ]; then
45	if [ -r "$OPENSSH_HOST_KEY" ]; then	45	if [ -r "$OPENSSH_HOST_KEY" ]; then
46	echo -n "Converting existing OpenSSH RSA host key ... "	46	echo -n "Converting existing OpenSSH RSA host key ... "
47	if pkcs1-conv < "$OPENSSH_HOST_KEY" \| lsh-writekey --server &&	47	if pkcs1-conv < "$OPENSSH_HOST_KEY" \| lsh-writekey --server &&
48	[ -f "$HOST_KEY" -a -f "$HOST_KEY.pub" ]; then	48	[ -f "$HOST_KEY" -a -f "$HOST_KEY.pub" ]; then
49	chmod +r "$HOST_KEY.pub"	49	chmod +r "$HOST_KEY.pub"
50	echo "done."	50	echo "done."
51	return 0	51	return 0
52	fi	52	fi
53	rm -f "$HOST_KEY" "$HOST_KEY.pub"	53	rm -f "$HOST_KEY" "$HOST_KEY.pub"
54	echo "failed. Will generate a new key instead."	54	echo "failed. Will generate a new key instead."
55	fi	55	fi
56	echo -n "Creating lsh host key ... "	56	echo -n "Creating lsh host key ... "
57	if lsh-keygen --server \| lsh-writekey --server &&	57	if lsh-keygen --server \| lsh-writekey --server &&
58	[ -f "$HOST_KEY" -a -f "$HOST_KEY.pub" ]; then	58	[ -f "$HOST_KEY" -a -f "$HOST_KEY.pub" ]; then
59	chmod +r "$HOST_KEY.pub"	59	chmod +r "$HOST_KEY.pub"
60	echo "done."	60	echo "done."
61	else	61	else
62	echo "failed!"	62	echo "failed!"
63	return 1	63	return 1
64	fi	64	fi
65	fi	65	fi
66	return 0	66	return 0
67	}	67	}
68		68
69	LSHD_DEFAULTS=/etc/default/lsh-server	69	LSHD_DEFAULTS=/etc/default/lsh-server
70		70
71	case "$1" in	71	case "$1" in
72	configure)	72	configure)
73		73
74	# This needs to be fixed. If we do stuff this way, strange things will	74	# This needs to be fixed. If we do stuff this way, strange things will
75	# happen ... the user can specify stuff to debconf and old options can	75	# happen ... the user can specify stuff to debconf and old options can
76	# still be written to the config file :-(	76	# still be written to the config file :-(
77	# First, get default options	77	# First, get default options
78	#[ -e "$LSHD_DEFAULTS" ] && . "$LSHD_DEFAULTS"	78	#[ -e "$LSHD_DEFAULTS" ] && . "$LSHD_DEFAULTS"
79		79
80	# Fall back to default options if necessary	80	# Fall back to default options if necessary
81	LSHD_PORT=${LSHD_PORT:-2222}	81	LSHD_PORT=${LSHD_PORT:-2222}
82	ENABLE_SFTP=${ENABLE_SFTP:-false}	82	ENABLE_SFTP=${ENABLE_SFTP:-false}
83		83
84	# Make sure ENABLE_SFTP is either "true" or "false", set up option	84	# Make sure ENABLE_SFTP is either "true" or "false", set up option
85	case "$ENABLE_SFTP" in	85	case "$ENABLE_SFTP" in
86	true\|TRUE\|y\|Y)	86	true\|TRUE\|y\|Y)
87	ENABLE_SFTP=true	87	ENABLE_SFTP=true
88	;;	88	;;
89	*)	89	*)
90	ENABLE_SFTP=false	90	ENABLE_SFTP=false
91	;;	91	;;
92	esac	92	esac
93		93
94	. /usr/share/debconf/confmodule	94	. /usr/share/debconf/confmodule
95		95
96	db_get "lsh-server/lshd_port"; LSHD_PORT="$RET"	96	db_get "lsh-server/lshd_port"; LSHD_PORT="$RET"
97	db_get "lsh-server/sftp"; ENABLE_SFTP="$RET"	97	db_get "lsh-server/sftp"; ENABLE_SFTP="$RET"
98	db_get "lsh-server/extra_args"; EXTRA_ARGS="$RET"	98	db_get "lsh-server/extra_args"; EXTRA_ARGS="$RET"
99	exec 3>&-	99	exec 3>&-
100		100
101	# OK, now make the config file	101	# OK, now make the config file
102		102
103	cat <<"EOF" >"$LSHD_DEFAULTS"	103	cat <<"EOF" >"$LSHD_DEFAULTS"
104	# Configuration file generated by lsh-server.postinst.	104	# Configuration file generated by lsh-server.postinst.
105	# You can change the lsh-server configuration either by editing	105	# You can change the lsh-server configuration either by editing
106	# this file, or by running dpkg-reconfigure lsh-server.	106	# this file, or by running dpkg-reconfigure lsh-server.
107	#	107	#
108	# If systemd is used, this file is read as an environment file and can	108	# If systemd is used, this file is read as an environment file and can
109	# only contain environment variable assignments.	109	# only contain environment variable assignments.
110	EOF	110	EOF
111		111
112	echo "LSHD_PORT=\"$LSHD_PORT\"" >>"$LSHD_DEFAULTS"	112	echo "LSHD_PORT=\"$LSHD_PORT\"" >>"$LSHD_DEFAULTS"
113	echo "ENABLE_SFTP=\"$ENABLE_SFTP\"" >> "$LSHD_DEFAULTS"	113	echo "ENABLE_SFTP=\"$ENABLE_SFTP\"" >> "$LSHD_DEFAULTS"
114	echo "EXTRA_ARGS=\"$EXTRA_ARGS\"" >> "$LSHD_DEFAULTS"	114	echo "EXTRA_ARGS=\"$EXTRA_ARGS\"" >> "$LSHD_DEFAULTS"
115		115
116	# Versions before 2.0.1cdbs-4 have a security issue, therefore	116	# Versions before 2.0.1cdbs-4 have a security issue, therefore
117	# have the random seed regenerated.	117	# have the random seed regenerated.
118	if [ "$2" ] && [ -e "/var/spool/lsh/yarrow-seed-file" ] \	118	if [ "$2" ] && [ -e "/var/spool/lsh/yarrow-seed-file" ] \
119	&& dpkg --compare-versions "$2" lt "2.0.1cdbs-4"; then	119	&& dpkg --compare-versions "$2" lt "2.0.1cdbs-4"; then
120	echo " Removing /var/spool/lsh/yarrow-seed-file, because of you are upgrading from a"	120	echo " Removing /var/spool/lsh/yarrow-seed-file, because of you are upgrading from a"
121	echo " version with a known security bug, so we can't trust the seed any more."	121	echo " version with a known security bug, so we can't trust the seed any more."
122	echo " It will be automatically regenerated from /dev/random."	122	echo " It will be automatically regenerated from /dev/random."
123	rm /var/spool/lsh/yarrow-seed-file	123	rm /var/spool/lsh/yarrow-seed-file
124	fi	124	fi
125		125
126	# Disable ssh if needed	126	# Disable ssh if needed
127	if [ "$LSHD_PORT" -eq 22 ] ; then	127	if [ "$LSHD_PORT" -eq 22 ] ; then
128	if [ ! -d /etc/ssh ] ; then	128	if [ ! -d /etc/ssh ] ; then
129	mkdir -p /etc/ssh	129	mkdir -p /etc/ssh
130	fi	130	fi
131		131
132	file=/etc/ssh/sshd_not_to_be_run	132	file=/etc/ssh/sshd_not_to_be_run
133	if [ ! -f "$file" ] ; then	133	if [ ! -f "$file" ] ; then
134	# stop ssh from starting at bootup	134	# stop ssh from starting at bootup
135	cat <<"EOF" >"$file"	135	cat <<"EOF" >"$file"
136	LSH_SERVER_CONFIG_GENERATED	136	LSH_SERVER_CONFIG_GENERATED
137	# Generated by lsh-server.postinst	137	# Generated by lsh-server.postinst
138	# Please don't remove this file unless you have first disabled lsh, and don't	138	# Please don't remove this file unless you have first disabled lsh, and don't
139	# change the first line ... otherwise lsh-server won't recognise it!!!	139	# change the first line ... otherwise lsh-server won't recognise it!!!
140	EOF	140	EOF
141		141
142	if [ -x "/etc/init.d/ssh" ]; then	142	if [ -x "/etc/init.d/ssh" ]; then
143	if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then	-
144	invoke-rc.d ssh stop \|\| true	143	invoke-rc.d ssh stop \|\| true
145	else	-
146	/etc/init.d/ssh stop \|\| true	-
147	fi	-
148	fi	144	fi
149	fi	145	fi
150	fi	146	fi
151		147
152	create_seed_and_key	148	create_seed_and_key
153	;;	149	;;
154		150
155	abort-upgrade\|abort-remove\|abort-deconfigure)	151	abort-upgrade\|abort-remove\|abort-deconfigure)
156		152
157	;;	153	;;
158		154
159	*)	155	*)
160	echo "postinst called with unknown argument \`$1'" >&2	156	echo "postinst called with unknown argument \`$1'" >&2
161	exit 1	157	exit 1
162	;;	158	;;
163	esac	159	esac
164		160
165	# dh_installdeb will replace this with shell code automatically	161	# dh_installdeb will replace this with shell code automatically
166	# generated by other debhelper scripts	162	# generated by other debhelper scripts
167		163
168	#DEBHELPER#	164	#DEBHELPER#
169		165
170	exit 0	166	exit 0