Subversion Repositories

#!/bin/sh

# postinst script for lsh-server

#

# see: dh_installdeb(1)

set -e

# summary of how this script can be called:

#        * <postinst> `configure' <most-recently-configured-version>

#        * <old-postinst> `abort-upgrade' <new version>

#        * <conflictor's-postinst> `abort-remove' `in-favour' <package>

#          <new-version>

#        * <deconfigured's-postinst> `abort-deconfigure' `in-favour'

#          <failed-install-package> <version> `removing'

#          <conflicting-package> <version>

# for details, see http://www.debian.org/doc/debian-policy/ or

# the debian-policy package

#

# quoting from the policy:

#     Any necessary prompting should almost always be confined to the

#     post-installation script, and should be protected with a conditional

#     so that unnecessary prompting doesn't happen if a package's

#     installation fails and the `postinst' is called with `abort-upgrade',

#     `abort-remove' or `abort-deconfigure'.

create_seed_and_key() {

    RANDOM_SEED="/var/spool/lsh/yarrow-seed-file"

    HOST_KEY="/etc/lsh_host_key"

    OPENSSH_HOST_KEY="/etc/ssh/ssh_host_rsa_key"

    if [ ! -f "$RANDOM_SEED" ]; then

	echo -n "Creating lsh random seed file (this may take a while) ..."

	DIR=$(dirname "$RANDOM_SEED")

	if install -d -m 700 "$DIR" &&

	    dd if=/dev/random "of=$RANDOM_SEED" bs=1 count=32 2>/dev/null &&

	    chmod 600 "$RANDOM_SEED"; then

	    echo " done."

	else

	    echo " failed!"

	    return 1

	fi

    fi

    if [ ! -f "$HOST_KEY" ]; then

	if [ -r "$OPENSSH_HOST_KEY" ]; then

	    echo -n "Converting existing OpenSSH RSA host key ... "

	    if pkcs1-conv < "$OPENSSH_HOST_KEY" | lsh-writekey --server &&

		[ -f "$HOST_KEY" -a -f "$HOST_KEY.pub" ]; then

		chmod +r "$HOST_KEY.pub"

		echo "done."

		return 0

	    fi

	    rm -f "$HOST_KEY" "$HOST_KEY.pub"

	    echo "failed. Will generate a new key instead."

	fi

	echo -n "Creating lsh host key ... "

	if lsh-keygen --server | lsh-writekey --server &&

	    [ -f "$HOST_KEY" -a -f "$HOST_KEY.pub" ]; then

	    chmod +r "$HOST_KEY.pub"

	    echo "done."

	else

	    echo "failed!"

	    return 1

	fi

    fi

    return 0

}

LSHD_DEFAULTS=/etc/default/lsh-server

case "$1" in

    configure)

	# This needs to be fixed. If we do stuff this way, strange things will

	# happen ... the user can specify stuff to debconf and old options can

	# still be written to the config file :-(

	# First, get default options

	#[ -e "$LSHD_DEFAULTS" ] && . "$LSHD_DEFAULTS"

	# Fall back to default options if necessary

	LSHD_PORT=${LSHD_PORT:-2222}

	ENABLE_SFTP=${ENABLE_SFTP:-false}

	# Make sure ENABLE_SFTP is either "true" or "false", set up option

	case "$ENABLE_SFTP" in

	    true|TRUE|y*|Y*)

		ENABLE_SFTP=true

		;;

	    *)

		ENABLE_SFTP=false

		;;

	esac

	. /usr/share/debconf/confmodule

	db_get "lsh-server/lshd_port"; LSHD_PORT="$RET"

	db_get "lsh-server/sftp"; ENABLE_SFTP="$RET"

	db_get "lsh-server/extra_args"; EXTRA_ARGS="$RET"

	exec 3>&-

	# OK, now make the config file

	cat <<"EOF" >"$LSHD_DEFAULTS"

# Configuration file generated by lsh-server.postinst.

# You can change the lsh-server configuration either by editing

# this file, or by running dpkg-reconfigure lsh-server.

#

# If systemd is used, this file is read as an environment file and can

# only contain environment variable assignments.

EOF

	echo "LSHD_PORT=\"$LSHD_PORT\"" >>"$LSHD_DEFAULTS"

	echo "ENABLE_SFTP=\"$ENABLE_SFTP\"" >> "$LSHD_DEFAULTS"

	echo "EXTRA_ARGS=\"$EXTRA_ARGS\"" >> "$LSHD_DEFAULTS"

	# Versions before 2.0.1cdbs-4 have a security issue, therefore

	# have the random seed regenerated.

	if [ "$2" ] && [ -e "/var/spool/lsh/yarrow-seed-file" ] \

		&& dpkg --compare-versions "$2" lt "2.0.1cdbs-4"; then

		echo " Removing /var/spool/lsh/yarrow-seed-file, because of you are upgrading from a"

		echo " version with a known security bug, so we can't trust the seed any more."

		echo " It will be automatically regenerated from /dev/random."

		rm /var/spool/lsh/yarrow-seed-file

	fi

	# Disable ssh if needed

	if [ "$LSHD_PORT" -eq 22 ] ; then

	    if [ ! -d /etc/ssh ] ; then

		mkdir -p /etc/ssh

	    fi

	    file=/etc/ssh/sshd_not_to_be_run

	    if [ ! -f "$file" ] ; then

# stop ssh from starting at bootup

		cat  <<"EOF" >"$file"

LSH_SERVER_CONFIG_GENERATED

# Generated by lsh-server.postinst

# Please don't remove this file unless you have first disabled lsh, and don't

# change the first line ... otherwise lsh-server won't recognise it!!!

EOF

		if [ -x "/etc/init.d/ssh" ]; then

		    if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then

			invoke-rc.d ssh stop || true

		    else

			/etc/init.d/ssh stop || true

		    fi

		fi

	    fi

	fi

	create_seed_and_key

    ;;

    abort-upgrade|abort-remove|abort-deconfigure)

    ;;

    *)

        echo "postinst called with unknown argument \`$1'" >&2

        exit 1

    ;;

esac

# dh_installdeb will replace this with shell code automatically

# generated by other debhelper scripts

#DEBHELPER#

exit 0