WebSVN - Diff - Rev 61 and 62 - /trunk/debian/lsh-server.postinst


#!/bin/sh
# postinst script for lsh-server
#
# see: dh_installdeb(1)

set -e

# summary of how this script can be called:
#        * <postinst> `configure' <most-recently-configured-version>
#        * <old-postinst> `abort-upgrade' <new version>
#        * <conflictor's-postinst> `abort-remove' `in-favour' <package>
#          <new-version>
#        * <deconfigured's-postinst> `abort-deconfigure' `in-favour'
#          <failed-install-package> <version> `removing'
#          <conflicting-package> <version>
# for details, see http://www.debian.org/doc/debian-policy/ or
# the debian-policy package
#
# quoting from the policy:
#     Any necessary prompting should almost always be confined to the
#     post-installation script, and should be protected with a conditional
#     so that unnecessary prompting doesn't happen if a package's
#     installation fails and the `postinst' is called with `abort-upgrade',
#     `abort-remove' or `abort-deconfigure'.

create_seed_and_key() {
    RANDOM_SEED="/var/spool/lsh/yarrow-seed-file"
    HOST_KEY="/etc/lsh_host_key"
    OPENSSH_HOST_KEY="/etc/ssh/ssh_host_rsa_key"

    if [ ! -f "$RANDOM_SEED" ]; then
	echo -n "Creating lsh random seed file (this may take a while) ..."
	DIR=$(dirname "$RANDOM_SEED")
	if install -d -m 700 "$DIR" &&
	    dd if=/dev/random "of=$RANDOM_SEED" bs=1 count=32 2>/dev/null &&
	    chmod 600 "$RANDOM_SEED"; then
	    echo " done."
	else
	    echo " failed!"
	    return 1
	fi
    fi

    if [ ! -f "$HOST_KEY" ]; then
	if [ -r "$OPENSSH_HOST_KEY" ]; then
	    echo -n "Converting existing OpenSSH RSA host key ... "
	    if pkcs1-conv < "$OPENSSH_HOST_KEY" | lsh-writekey --server &&
		[ -f "$HOST_KEY" -a -f "$HOST_KEY.pub" ]; then
		chmod +r "$HOST_KEY.pub"
		echo "done."
		return 0
	    fi
	    rm -f "$HOST_KEY" "$HOST_KEY.pub"
	    echo "failed. Will generate a new key instead."
	fi
	echo -n "Creating lsh host key ... "
	if lsh-keygen --server | lsh-writekey --server &&
	    [ -f "$HOST_KEY" -a -f "$HOST_KEY.pub" ]; then
	    chmod +r "$HOST_KEY.pub"
	    echo "done."
	else
	    echo "failed!"
	    return 1
	fi
    fi
    return 0
}

LSHD_DEFAULTS=/etc/default/lsh-server

case "$1" in
    configure)

	# This needs to be fixed. If we do stuff this way, strange things will
	# happen ... the user can specify stuff to debconf and old options can
	# still be written to the config file :-(
	# First, get default options
	#[ -e "$LSHD_DEFAULTS" ] && . "$LSHD_DEFAULTS"

	# Fall back to default options if necessary
	LSHD_PORT=${LSHD_PORT:-2222}
	ENABLE_SFTP=${ENABLE_SFTP:-false}

	# Make sure ENABLE_SFTP is either "true" or "false", set up option
	case "$ENABLE_SFTP" in
	    true|TRUE|y*|Y*)
		ENABLE_SFTP=true
		;;
	    *)
		ENABLE_SFTP=false
		;;
	esac
	
	. /usr/share/debconf/confmodule
   
	db_get "lsh-server/lshd_port"; LSHD_PORT="$RET"
	db_get "lsh-server/sftp"; ENABLE_SFTP="$RET"

	# OK, now make the config file

	cat <<"EOF" >"$LSHD_DEFAULTS"
# Configuration file generated by lsh-server.postinst.
# You can change the lsh-server configuration either by editing
# this file, or by running dpkg-reconfigure lsh-server.
#
EOF

	echo "LSHD_PORT=\"$LSHD_PORT\"" >>"$LSHD_DEFAULTS"
	echo "ENABLE_SFTP=\"$ENABLE_SFTP\"" >> "$LSHD_DEFAULTS"

	# Versions before 2.0.1cdbs-4 have a security issue, therefore
	# have the random seed regenerated.
	if [ "$2" ] && [ -e "/var/spool/lsh/yarrow-seed-file" ] \
		&& dpkg --compare-versions "$2" lt "2.0.1cdbs-4"; then
		echo " Removing /var/spool/lsh/yarrow-seed-file, because of you are upgrading from a"
		echo " version with a known security bug, so we can't trust the seed any more."
		echo " It will be automatically regenerated from /dev/random."
		rm /var/spool/lsh/yarrow-seed-file
	fi

	# Disable ssh if needed
	if [ "$LSHD_PORT" -eq 22 ] ; then
	    if [ ! -d /etc/ssh ] ; then
		mkdir -p /etc/ssh
	    fi

	    file=/etc/ssh/sshd_not_to_be_run
	    if [ ! -f "$file" ] ; then
# stop ssh from starting at bootup
		cat  <<"EOF" >"$file"
LSH_SERVER_CONFIG_GENERATED
# Generated by lsh-server.postinst
# Please don't remove this file unless you have first disabled lsh, and don't
# change the first line ... otherwise lsh-server won't recognise it!!!
EOF
	    fi
	fi

	create_seed_and_key
    ;;

    abort-upgrade|abort-remove|abort-deconfigure)

    ;;

    *)
        echo "postinst called with unknown argument \`$1'" >&2
        exit 1
    ;;
esac

# dh_installdeb will replace this with shell code automatically
# generated by other debhelper scripts

#DEBHELPER#

exit 0

Rev 61	Rev 62
1	#!/bin/sh	1	#!/bin/sh
2	# postinst script for lsh-server	2	# postinst script for lsh-server
3	#	3	#
4	# see: dh_installdeb(1)	4	# see: dh_installdeb(1)
5		5
6	set -e	6	set -e
7		7
8	# summary of how this script can be called:	8	# summary of how this script can be called:
9	# * <postinst> `configure' <most-recently-configured-version>	9	# * <postinst> `configure' <most-recently-configured-version>
10	# * <old-postinst> `abort-upgrade' <new version>	10	# * <old-postinst> `abort-upgrade' <new version>
11	# * <conflictor's-postinst> `abort-remove' `in-favour' <package>	11	# * <conflictor's-postinst> `abort-remove' `in-favour' <package>
12	# <new-version>	12	# <new-version>
13	# * <deconfigured's-postinst> `abort-deconfigure' `in-favour'	13	# * <deconfigured's-postinst> `abort-deconfigure' `in-favour'
14	# <failed-install-package> <version> `removing'	14	# <failed-install-package> <version> `removing'
15	# <conflicting-package> <version>	15	# <conflicting-package> <version>
16	# for details, see http://www.debian.org/doc/debian-policy/ or	16	# for details, see http://www.debian.org/doc/debian-policy/ or
17	# the debian-policy package	17	# the debian-policy package
18	#	18	#
19	# quoting from the policy:	19	# quoting from the policy:
20	# Any necessary prompting should almost always be confined to the	20	# Any necessary prompting should almost always be confined to the
21	# post-installation script, and should be protected with a conditional	21	# post-installation script, and should be protected with a conditional
22	# so that unnecessary prompting doesn't happen if a package's	22	# so that unnecessary prompting doesn't happen if a package's
23	# installation fails and the `postinst' is called with `abort-upgrade',	23	# installation fails and the `postinst' is called with `abort-upgrade',
24	# `abort-remove' or `abort-deconfigure'.	24	# `abort-remove' or `abort-deconfigure'.
25		25
26	create_seed_and_key() {	26	create_seed_and_key() {
27	RANDOM_SEED="/var/spool/lsh/yarrow-seed-file"	27	RANDOM_SEED="/var/spool/lsh/yarrow-seed-file"
28	HOST_KEY="/etc/lsh_host_key"	28	HOST_KEY="/etc/lsh_host_key"
29	OPENSSH_HOST_KEY="/etc/ssh/ssh_host_rsa_key"	29	OPENSSH_HOST_KEY="/etc/ssh/ssh_host_rsa_key"
30		30
31	if [ ! -f "$RANDOM_SEED" ]; then	31	if [ ! -f "$RANDOM_SEED" ]; then
32	echo -n "Creating lsh random seed file (this may take a while) ..."	32	echo -n "Creating lsh random seed file (this may take a while) ..."
33	DIR=$(dirname "$RANDOM_SEED")	33	DIR=$(dirname "$RANDOM_SEED")
34	if install -d -m 700 "$DIR" &&	34	if install -d -m 700 "$DIR" &&
35	dd if=/dev/random "of=$RANDOM_SEED" bs=1 count=32 2>/dev/null &&	35	dd if=/dev/random "of=$RANDOM_SEED" bs=1 count=32 2>/dev/null &&
36	chmod 600 "$RANDOM_SEED"; then	36	chmod 600 "$RANDOM_SEED"; then
37	echo " done."	37	echo " done."
38	else	38	else
39	echo " failed!"	39	echo " failed!"
40	return 1	40	return 1
41	fi	41	fi
42	fi	42	fi
43		43
44	if [ ! -f "$HOST_KEY" ]; then	44	if [ ! -f "$HOST_KEY" ]; then
45	if [ -r "$OPENSSH_HOST_KEY" ]; then	45	if [ -r "$OPENSSH_HOST_KEY" ]; then
46	echo -n "Converting existing OpenSSH RSA host key ... "	46	echo -n "Converting existing OpenSSH RSA host key ... "
47	if pkcs1-conv < "$OPENSSH_HOST_KEY" \| lsh-writekey --server &&	47	if pkcs1-conv < "$OPENSSH_HOST_KEY" \| lsh-writekey --server &&
48	[ -f "$HOST_KEY" ]; then	48	[ -f "$HOST_KEY" -a -f "$HOST_KEY.pub" ]; then
-		49	chmod +r "$HOST_KEY.pub"
49	echo -n "done."	50	echo "done."
50	return 0	51	return 0
51	fi	52	fi
-		53	rm -f "$HOST_KEY" "$HOST_KEY.pub"
52	echo "failed. Will generate a new key instead."	54	echo "failed. Will generate a new key instead."
53	fi	55	fi
54	echo -n "Creating lsh host key ... "	56	echo -n "Creating lsh host key ... "
55	if lsh-keygen --server \| lsh-writekey --server &&	57	if lsh-keygen --server \| lsh-writekey --server &&
-		58	[ -f "$HOST_KEY" -a -f "$HOST_KEY.pub" ]; then
56	[ -f "$HOST_KEY" ]; then	59	chmod +r "$HOST_KEY.pub"
57	echo " done."	60	echo "done."
58	else	61	else
59	echo " failed!"	62	echo "failed!"
60	return 1	63	return 1
61	fi	64	fi
62	fi	65	fi
63	return 0	66	return 0
64	}	67	}
65		68
66	LSHD_DEFAULTS=/etc/default/lsh-server	69	LSHD_DEFAULTS=/etc/default/lsh-server
67		70
68	case "$1" in	71	case "$1" in
69	configure)	72	configure)
70		73
71	# This needs to be fixed. If we do stuff this way, strange things will	74	# This needs to be fixed. If we do stuff this way, strange things will
72	# happen ... the user can specify stuff to debconf and old options can	75	# happen ... the user can specify stuff to debconf and old options can
73	# still be written to the config file :-(	76	# still be written to the config file :-(
74	# First, get default options	77	# First, get default options
75	#[ -e "$LSHD_DEFAULTS" ] && . "$LSHD_DEFAULTS"	78	#[ -e "$LSHD_DEFAULTS" ] && . "$LSHD_DEFAULTS"
76		79
77	# Fall back to default options if necessary	80	# Fall back to default options if necessary
78	LSHD_PORT=${LSHD_PORT:-2222}	81	LSHD_PORT=${LSHD_PORT:-2222}
79	ENABLE_SFTP=${ENABLE_SFTP:-false}	82	ENABLE_SFTP=${ENABLE_SFTP:-false}
80		83
81	# Make sure ENABLE_SFTP is either "true" or "false", set up option	84	# Make sure ENABLE_SFTP is either "true" or "false", set up option
82	case "$ENABLE_SFTP" in	85	case "$ENABLE_SFTP" in
83	true\|TRUE\|y\|Y)	86	true\|TRUE\|y\|Y)
84	ENABLE_SFTP=true	87	ENABLE_SFTP=true
85	;;	88	;;
86	*)	89	*)
87	ENABLE_SFTP=false	90	ENABLE_SFTP=false
88	;;	91	;;
89	esac	92	esac
90		93
91	. /usr/share/debconf/confmodule	94	. /usr/share/debconf/confmodule
92		95
93	db_get "lsh-server/lshd_port"; LSHD_PORT="$RET"	96	db_get "lsh-server/lshd_port"; LSHD_PORT="$RET"
94	db_get "lsh-server/sftp"; ENABLE_SFTP="$RET"	97	db_get "lsh-server/sftp"; ENABLE_SFTP="$RET"
95		98
96	# OK, now make the config file	99	# OK, now make the config file
97		100
98	cat <<"EOF" >"$LSHD_DEFAULTS"	101	cat <<"EOF" >"$LSHD_DEFAULTS"
99	# Configuration file generated by lsh-server.postinst.	102	# Configuration file generated by lsh-server.postinst.
100	# You can change the lsh-server configuration either by editing	103	# You can change the lsh-server configuration either by editing
101	# this file, or by running dpkg-reconfigure lsh-server.	104	# this file, or by running dpkg-reconfigure lsh-server.
102	#	105	#
103	EOF	106	EOF
104		107
105	echo "LSHD_PORT=\"$LSHD_PORT\"" >>"$LSHD_DEFAULTS"	108	echo "LSHD_PORT=\"$LSHD_PORT\"" >>"$LSHD_DEFAULTS"
106	echo "ENABLE_SFTP=\"$ENABLE_SFTP\"" >> "$LSHD_DEFAULTS"	109	echo "ENABLE_SFTP=\"$ENABLE_SFTP\"" >> "$LSHD_DEFAULTS"
107		110
108	# Versions before 2.0.1cdbs-4 have a security issue, therefore	111	# Versions before 2.0.1cdbs-4 have a security issue, therefore
109	# have the random seed regenerated.	112	# have the random seed regenerated.
110	if [ "$2" ] && [ -e "/var/spool/lsh/yarrow-seed-file" ] \	113	if [ "$2" ] && [ -e "/var/spool/lsh/yarrow-seed-file" ] \
111	&& dpkg --compare-versions "$2" lt "2.0.1cdbs-4"; then	114	&& dpkg --compare-versions "$2" lt "2.0.1cdbs-4"; then
112	echo " Removing /var/spool/lsh/yarrow-seed-file, because of you are upgrading from a"	115	echo " Removing /var/spool/lsh/yarrow-seed-file, because of you are upgrading from a"
113	echo " version with a known security bug, so we can't trust the seed any more."	116	echo " version with a known security bug, so we can't trust the seed any more."
114	echo " It will be automatically regenerated from /dev/random."	117	echo " It will be automatically regenerated from /dev/random."
115	rm /var/spool/lsh/yarrow-seed-file	118	rm /var/spool/lsh/yarrow-seed-file
116	fi	119	fi
117		120
118	# Disable ssh if needed	121	# Disable ssh if needed
119	if [ "$LSHD_PORT" -eq 22 ] ; then	122	if [ "$LSHD_PORT" -eq 22 ] ; then
120	if [ ! -d /etc/ssh ] ; then	123	if [ ! -d /etc/ssh ] ; then
121	mkdir -p /etc/ssh	124	mkdir -p /etc/ssh
122	fi	125	fi
123		126
124	file=/etc/ssh/sshd_not_to_be_run	127	file=/etc/ssh/sshd_not_to_be_run
125	if [ ! -f "$file" ] ; then	128	if [ ! -f "$file" ] ; then
126	# stop ssh from starting at bootup	129	# stop ssh from starting at bootup
127	cat <<"EOF" >"$file"	130	cat <<"EOF" >"$file"
128	LSH_SERVER_CONFIG_GENERATED	131	LSH_SERVER_CONFIG_GENERATED
129	# Generated by lsh-server.postinst	132	# Generated by lsh-server.postinst
130	# Please don't remove this file unless you have first disabled lsh, and don't	133	# Please don't remove this file unless you have first disabled lsh, and don't
131	# change the first line ... otherwise lsh-server won't recognise it!!!	134	# change the first line ... otherwise lsh-server won't recognise it!!!
132	EOF	135	EOF
133	fi	136	fi
134	fi	137	fi
135		138
136	create_seed_and_key	139	create_seed_and_key
137	;;	140	;;
138		141
139	abort-upgrade\|abort-remove\|abort-deconfigure)	142	abort-upgrade\|abort-remove\|abort-deconfigure)
140		143
141	;;	144	;;
142		145
143	*)	146	*)
144	echo "postinst called with unknown argument \`$1'" >&2	147	echo "postinst called with unknown argument \`$1'" >&2
145	exit 1	148	exit 1
146	;;	149	;;
147	esac	150	esac
148		151
149	# dh_installdeb will replace this with shell code automatically	152	# dh_installdeb will replace this with shell code automatically
150	# generated by other debhelper scripts	153	# generated by other debhelper scripts
151		154
152	#DEBHELPER#	155	#DEBHELPER#
153		156
154	exit 0	157	exit 0

Subversion Repositories

(root)/trunk/debian/lsh-server.postinst - Rev 61 → 62