WebSVN - Diff - Rev 74 and 75 - /trunk/debian/lsh-server.postinst


#!/bin/sh
# postinst script for lsh-server
#
# see: dh_installdeb(1)

set -e

# summary of how this script can be called:
#        * <postinst> `configure' <most-recently-configured-version>
#        * <old-postinst> `abort-upgrade' <new version>
#        * <conflictor's-postinst> `abort-remove' `in-favour' <package>
#          <new-version>
#        * <deconfigured's-postinst> `abort-deconfigure' `in-favour'
#          <failed-install-package> <version> `removing'
#          <conflicting-package> <version>
# for details, see http://www.debian.org/doc/debian-policy/ or
# the debian-policy package
#
# quoting from the policy:
#     Any necessary prompting should almost always be confined to the
#     post-installation script, and should be protected with a conditional
#     so that unnecessary prompting doesn't happen if a package's
#     installation fails and the `postinst' is called with `abort-upgrade',
#     `abort-remove' or `abort-deconfigure'.

create_seed_and_key() {
    RANDOM_SEED="/var/spool/lsh/yarrow-seed-file"
    HOST_KEY="/etc/lsh_host_key"
    OPENSSH_HOST_KEY="/etc/ssh/ssh_host_rsa_key"

    if [ ! -f "$RANDOM_SEED" ]; then
	echo -n "Creating lsh random seed file (this may take a while) ..."
	DIR=$(dirname "$RANDOM_SEED")
	if install -d -m 700 "$DIR" &&
	    dd if=/dev/random "of=$RANDOM_SEED" bs=1 count=32 2>/dev/null &&
	    chmod 600 "$RANDOM_SEED"; then
	    echo " done."
	else
	    echo " failed!"
	    return 1
	fi
    fi

    if [ ! -f "$HOST_KEY" ]; then
	if [ -r "$OPENSSH_HOST_KEY" ]; then
	    echo -n "Converting existing OpenSSH RSA host key ... "
	    if pkcs1-conv < "$OPENSSH_HOST_KEY" | lsh-writekey --server &&
		[ -f "$HOST_KEY" -a -f "$HOST_KEY.pub" ]; then
		chmod +r "$HOST_KEY.pub"
		echo "done."
		return 0
	    fi
	    rm -f "$HOST_KEY" "$HOST_KEY.pub"
	    echo "failed. Will generate a new key instead."
	fi
	echo -n "Creating lsh host key ... "
	if lsh-keygen --server | lsh-writekey --server &&
	    [ -f "$HOST_KEY" -a -f "$HOST_KEY.pub" ]; then
	    chmod +r "$HOST_KEY.pub"
	    echo "done."
	else
	    echo "failed!"
	    return 1
	fi
    fi
    return 0
}

LSHD_DEFAULTS=/etc/default/lsh-server

case "$1" in
    configure)

	# This needs to be fixed. If we do stuff this way, strange things will
	# happen ... the user can specify stuff to debconf and old options can
	# still be written to the config file :-(
	# First, get default options
	#[ -e "$LSHD_DEFAULTS" ] && . "$LSHD_DEFAULTS"

	# Fall back to default options if necessary
	LSHD_PORT=${LSHD_PORT:-2222}
	ENABLE_SFTP=${ENABLE_SFTP:-false}

	# Make sure ENABLE_SFTP is either "true" or "false", set up option
	case "$ENABLE_SFTP" in
	    true|TRUE|y*|Y*)
		ENABLE_SFTP=true
		;;
	    *)
		ENABLE_SFTP=false
		;;
	esac
	
	. /usr/share/debconf/confmodule
   
	db_get "lsh-server/lshd_port"; LSHD_PORT="$RET"
	db_get "lsh-server/sftp"; ENABLE_SFTP="$RET"
	exec 3>&-

	# OK, now make the config file

	cat <<"EOF" >"$LSHD_DEFAULTS"
# Configuration file generated by lsh-server.postinst.
# You can change the lsh-server configuration either by editing
# this file, or by running dpkg-reconfigure lsh-server.
#
EOF

	echo "LSHD_PORT=\"$LSHD_PORT\"" >>"$LSHD_DEFAULTS"
	echo "ENABLE_SFTP=\"$ENABLE_SFTP\"" >> "$LSHD_DEFAULTS"

	# Versions before 2.0.1cdbs-4 have a security issue, therefore
	# have the random seed regenerated.
	if [ "$2" ] && [ -e "/var/spool/lsh/yarrow-seed-file" ] \
		&& dpkg --compare-versions "$2" lt "2.0.1cdbs-4"; then
		echo " Removing /var/spool/lsh/yarrow-seed-file, because of you are upgrading from a"
		echo " version with a known security bug, so we can't trust the seed any more."
		echo " It will be automatically regenerated from /dev/random."
		rm /var/spool/lsh/yarrow-seed-file
	fi

	# Disable ssh if needed
	if [ "$LSHD_PORT" -eq 22 ] ; then
	    if [ ! -d /etc/ssh ] ; then
		mkdir -p /etc/ssh
	    fi

	    file=/etc/ssh/sshd_not_to_be_run
	    if [ ! -f "$file" ] ; then
# stop ssh from starting at bootup
		cat  <<"EOF" >"$file"
LSH_SERVER_CONFIG_GENERATED
# Generated by lsh-server.postinst
# Please don't remove this file unless you have first disabled lsh, and don't
# change the first line ... otherwise lsh-server won't recognise it!!!
EOF

		if [ -x "/etc/init.d/ssh" ]; then
		    if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
			invoke-rc.d ssh stop || true
		    else
			/etc/init.d/ssh stop || true
		    fi
		fi
	    fi
	fi

	create_seed_and_key
    ;;

    abort-upgrade|abort-remove|abort-deconfigure)

    ;;

    *)
        echo "postinst called with unknown argument \`$1'" >&2
        exit 1
    ;;
esac

# dh_installdeb will replace this with shell code automatically
# generated by other debhelper scripts

#DEBHELPER#

exit 0

Subversion Repositories

(root)/trunk/debian/lsh-server.postinst - Rev 74 → 75

Rev 74		Rev 75
1	#!/bin/sh	1	#!/bin/sh
2	# postinst script for lsh-server	2	# postinst script for lsh-server
3	#	3	#
4	# see: dh_installdeb(1)	4	# see: dh_installdeb(1)
5		5
6	set -e	6	set -e
7		7
8	# summary of how this script can be called:	8	# summary of how this script can be called:
9	# * <postinst> `configure' <most-recently-configured-version>	9	# * <postinst> `configure' <most-recently-configured-version>
10	# * <old-postinst> `abort-upgrade' <new version>	10	# * <old-postinst> `abort-upgrade' <new version>
11	# * <conflictor's-postinst> `abort-remove' `in-favour' <package>	11	# * <conflictor's-postinst> `abort-remove' `in-favour' <package>
12	# <new-version>	12	# <new-version>
13	# * <deconfigured's-postinst> `abort-deconfigure' `in-favour'	13	# * <deconfigured's-postinst> `abort-deconfigure' `in-favour'
14	# <failed-install-package> <version> `removing'	14	# <failed-install-package> <version> `removing'
15	# <conflicting-package> <version>	15	# <conflicting-package> <version>
16	# for details, see http://www.debian.org/doc/debian-policy/ or	16	# for details, see http://www.debian.org/doc/debian-policy/ or
17	# the debian-policy package	17	# the debian-policy package
18	#	18	#
19	# quoting from the policy:	19	# quoting from the policy:
20	# Any necessary prompting should almost always be confined to the	20	# Any necessary prompting should almost always be confined to the
21	# post-installation script, and should be protected with a conditional	21	# post-installation script, and should be protected with a conditional
22	# so that unnecessary prompting doesn't happen if a package's	22	# so that unnecessary prompting doesn't happen if a package's
23	# installation fails and the `postinst' is called with `abort-upgrade',	23	# installation fails and the `postinst' is called with `abort-upgrade',
24	# `abort-remove' or `abort-deconfigure'.	24	# `abort-remove' or `abort-deconfigure'.
25		25
26	create_seed_and_key() {	26	create_seed_and_key() {
27	RANDOM_SEED="/var/spool/lsh/yarrow-seed-file"	27	RANDOM_SEED="/var/spool/lsh/yarrow-seed-file"
28	HOST_KEY="/etc/lsh_host_key"	28	HOST_KEY="/etc/lsh_host_key"
29	OPENSSH_HOST_KEY="/etc/ssh/ssh_host_rsa_key"	29	OPENSSH_HOST_KEY="/etc/ssh/ssh_host_rsa_key"
30		30
31	if [ ! -f "$RANDOM_SEED" ]; then	31	if [ ! -f "$RANDOM_SEED" ]; then
32	echo -n "Creating lsh random seed file (this may take a while) ..."	32	echo -n "Creating lsh random seed file (this may take a while) ..."
33	DIR=$(dirname "$RANDOM_SEED")	33	DIR=$(dirname "$RANDOM_SEED")
34	if install -d -m 700 "$DIR" &&	34	if install -d -m 700 "$DIR" &&
35	dd if=/dev/random "of=$RANDOM_SEED" bs=1 count=32 2>/dev/null &&	35	dd if=/dev/random "of=$RANDOM_SEED" bs=1 count=32 2>/dev/null &&
36	chmod 600 "$RANDOM_SEED"; then	36	chmod 600 "$RANDOM_SEED"; then
37	echo " done."	37	echo " done."
38	else	38	else
39	echo " failed!"	39	echo " failed!"
40	return 1	40	return 1
41	fi	41	fi
42	fi	42	fi
43		43
44	if [ ! -f "$HOST_KEY" ]; then	44	if [ ! -f "$HOST_KEY" ]; then
45	if [ -r "$OPENSSH_HOST_KEY" ]; then	45	if [ -r "$OPENSSH_HOST_KEY" ]; then
46	echo -n "Converting existing OpenSSH RSA host key ... "	46	echo -n "Converting existing OpenSSH RSA host key ... "
47	if pkcs1-conv < "$OPENSSH_HOST_KEY" \| lsh-writekey --server &&	47	if pkcs1-conv < "$OPENSSH_HOST_KEY" \| lsh-writekey --server &&
48	[ -f "$HOST_KEY" -a -f "$HOST_KEY.pub" ]; then	48	[ -f "$HOST_KEY" -a -f "$HOST_KEY.pub" ]; then
49	chmod +r "$HOST_KEY.pub"	49	chmod +r "$HOST_KEY.pub"
50	echo "done."	50	echo "done."
51	return 0	51	return 0
52	fi	52	fi
53	rm -f "$HOST_KEY" "$HOST_KEY.pub"	53	rm -f "$HOST_KEY" "$HOST_KEY.pub"
54	echo "failed. Will generate a new key instead."	54	echo "failed. Will generate a new key instead."
55	fi	55	fi
56	echo -n "Creating lsh host key ... "	56	echo -n "Creating lsh host key ... "
57	if lsh-keygen --server \| lsh-writekey --server &&	57	if lsh-keygen --server \| lsh-writekey --server &&
58	[ -f "$HOST_KEY" -a -f "$HOST_KEY.pub" ]; then	58	[ -f "$HOST_KEY" -a -f "$HOST_KEY.pub" ]; then
59	chmod +r "$HOST_KEY.pub"	59	chmod +r "$HOST_KEY.pub"
60	echo "done."	60	echo "done."
61	else	61	else
62	echo "failed!"	62	echo "failed!"
63	return 1	63	return 1
64	fi	64	fi
65	fi	65	fi
66	return 0	66	return 0
67	}	67	}
68		68
69	LSHD_DEFAULTS=/etc/default/lsh-server	69	LSHD_DEFAULTS=/etc/default/lsh-server
70		70
71	case "$1" in	71	case "$1" in
72	configure)	72	configure)
73		73
74	# This needs to be fixed. If we do stuff this way, strange things will	74	# This needs to be fixed. If we do stuff this way, strange things will
75	# happen ... the user can specify stuff to debconf and old options can	75	# happen ... the user can specify stuff to debconf and old options can
76	# still be written to the config file :-(	76	# still be written to the config file :-(
77	# First, get default options	77	# First, get default options
78	#[ -e "$LSHD_DEFAULTS" ] && . "$LSHD_DEFAULTS"	78	#[ -e "$LSHD_DEFAULTS" ] && . "$LSHD_DEFAULTS"
79		79
80	# Fall back to default options if necessary	80	# Fall back to default options if necessary
81	LSHD_PORT=${LSHD_PORT:-2222}	81	LSHD_PORT=${LSHD_PORT:-2222}
82	ENABLE_SFTP=${ENABLE_SFTP:-false}	82	ENABLE_SFTP=${ENABLE_SFTP:-false}
83		83
84	# Make sure ENABLE_SFTP is either "true" or "false", set up option	84	# Make sure ENABLE_SFTP is either "true" or "false", set up option
85	case "$ENABLE_SFTP" in	85	case "$ENABLE_SFTP" in
86	true\|TRUE\|y\|Y)	86	true\|TRUE\|y\|Y)
87	ENABLE_SFTP=true	87	ENABLE_SFTP=true
88	;;	88	;;
89	*)	89	*)
90	ENABLE_SFTP=false	90	ENABLE_SFTP=false
91	;;	91	;;
92	esac	92	esac
93		93
94	. /usr/share/debconf/confmodule	94	. /usr/share/debconf/confmodule
95		95
96	db_get "lsh-server/lshd_port"; LSHD_PORT="$RET"	96	db_get "lsh-server/lshd_port"; LSHD_PORT="$RET"
97	db_get "lsh-server/sftp"; ENABLE_SFTP="$RET"	97	db_get "lsh-server/sftp"; ENABLE_SFTP="$RET"
-		98	exec 3>&-
98		99
99	# OK, now make the config file	100	# OK, now make the config file
100		101
101	cat <<"EOF" >"$LSHD_DEFAULTS"	102	cat <<"EOF" >"$LSHD_DEFAULTS"
102	# Configuration file generated by lsh-server.postinst.	103	# Configuration file generated by lsh-server.postinst.
103	# You can change the lsh-server configuration either by editing	104	# You can change the lsh-server configuration either by editing
104	# this file, or by running dpkg-reconfigure lsh-server.	105	# this file, or by running dpkg-reconfigure lsh-server.
105	#	106	#
106	EOF	107	EOF
107		108
108	echo "LSHD_PORT=\"$LSHD_PORT\"" >>"$LSHD_DEFAULTS"	109	echo "LSHD_PORT=\"$LSHD_PORT\"" >>"$LSHD_DEFAULTS"
109	echo "ENABLE_SFTP=\"$ENABLE_SFTP\"" >> "$LSHD_DEFAULTS"	110	echo "ENABLE_SFTP=\"$ENABLE_SFTP\"" >> "$LSHD_DEFAULTS"
110		111
111	# Versions before 2.0.1cdbs-4 have a security issue, therefore	112	# Versions before 2.0.1cdbs-4 have a security issue, therefore
112	# have the random seed regenerated.	113	# have the random seed regenerated.
113	if [ "$2" ] && [ -e "/var/spool/lsh/yarrow-seed-file" ] \	114	if [ "$2" ] && [ -e "/var/spool/lsh/yarrow-seed-file" ] \
114	&& dpkg --compare-versions "$2" lt "2.0.1cdbs-4"; then	115	&& dpkg --compare-versions "$2" lt "2.0.1cdbs-4"; then
115	echo " Removing /var/spool/lsh/yarrow-seed-file, because of you are upgrading from a"	116	echo " Removing /var/spool/lsh/yarrow-seed-file, because of you are upgrading from a"
116	echo " version with a known security bug, so we can't trust the seed any more."	117	echo " version with a known security bug, so we can't trust the seed any more."
117	echo " It will be automatically regenerated from /dev/random."	118	echo " It will be automatically regenerated from /dev/random."
118	rm /var/spool/lsh/yarrow-seed-file	119	rm /var/spool/lsh/yarrow-seed-file
119	fi	120	fi
120		121
121	# Disable ssh if needed	122	# Disable ssh if needed
122	if [ "$LSHD_PORT" -eq 22 ] ; then	123	if [ "$LSHD_PORT" -eq 22 ] ; then
123	if [ ! -d /etc/ssh ] ; then	124	if [ ! -d /etc/ssh ] ; then
124	mkdir -p /etc/ssh	125	mkdir -p /etc/ssh
125	fi	126	fi
126		127
127	file=/etc/ssh/sshd_not_to_be_run	128	file=/etc/ssh/sshd_not_to_be_run
128	if [ ! -f "$file" ] ; then	129	if [ ! -f "$file" ] ; then
129	# stop ssh from starting at bootup	130	# stop ssh from starting at bootup
130	cat <<"EOF" >"$file"	131	cat <<"EOF" >"$file"
131	LSH_SERVER_CONFIG_GENERATED	132	LSH_SERVER_CONFIG_GENERATED
132	# Generated by lsh-server.postinst	133	# Generated by lsh-server.postinst
133	# Please don't remove this file unless you have first disabled lsh, and don't	134	# Please don't remove this file unless you have first disabled lsh, and don't
134	# change the first line ... otherwise lsh-server won't recognise it!!!	135	# change the first line ... otherwise lsh-server won't recognise it!!!
135	EOF	136	EOF
136		137
137	if [ -x "/etc/init.d/ssh" ]; then	138	if [ -x "/etc/init.d/ssh" ]; then
138	if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then	139	if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
139	invoke-rc.d ssh stop \|\| true	140	invoke-rc.d ssh stop \|\| true
140	else	141	else
141	/etc/init.d/ssh stop \|\| true	142	/etc/init.d/ssh stop \|\| true
142	fi	143	fi
143	fi	144	fi
144	fi	145	fi
145	fi	146	fi
146		147
147	create_seed_and_key	148	create_seed_and_key
148	;;	149	;;
149		150
150	abort-upgrade\|abort-remove\|abort-deconfigure)	151	abort-upgrade\|abort-remove\|abort-deconfigure)
151		152
152	;;	153	;;
153		154
154	*)	155	*)
155	echo "postinst called with unknown argument \`$1'" >&2	156	echo "postinst called with unknown argument \`$1'" >&2
156	exit 1	157	exit 1
157	;;	158	;;
158	esac	159	esac
159		160
160	# dh_installdeb will replace this with shell code automatically	161	# dh_installdeb will replace this with shell code automatically
161	# generated by other debhelper scripts	162	# generated by other debhelper scripts
162		163
163	#DEBHELPER#	164	#DEBHELPER#
164		165
165	exit 0	166	exit 0