sshd revision ead1f93ee620d7580f7e53350fe5a884fc4f158a
395N/A#!/sbin/sh
2362N/A#
395N/A# Copyright 2010 Sun Microsystems, Inc. All rights reserved.
395N/A# Use is subject to license terms.
395N/A#
395N/A
395N/A. /lib/svc/share/ipf_include.sh
395N/A. /lib/svc/share/smf_include.sh
395N/A
395N/ASSHDIR=/etc/ssh
395N/AKEYGEN="/usr/bin/ssh-keygen -q"
395N/APIDFILE=/var/run/sshd.pid
395N/A
395N/A# Checks to see if RSA, and DSA host keys are available
395N/A# if any of these keys are not present, the respective keys are created.
395N/Acreate_key()
395N/A{
395N/A keypath=$1
2362N/A keytype=$2
2362N/A
2362N/A if [ ! -f $keypath ]; then
395N/A #
395N/A # HostKey keywords in sshd_config may be preceded or
395N/A # followed by a mix of any number of space or tabs,
395N/A # and optionally have an = between keyword and
395N/A # argument. We use two grep invocations such that we
395N/A # can match HostKey case insensitively but still have
395N/A # the case of the path name be significant, keeping
395N/A # the pattern somewhat more readable.
395N/A #
395N/A # The character classes below contain one literal
395N/A # space and one literal tab.
395N/A #
395N/A grep -i "^[ ]*HostKey[ ]*=\{0,1\}[ ]*$keypath" \
395N/A $SSHDIR/sshd_config | grep "$keypath" > /dev/null 2>&1
395N/A
395N/A if [ $? -eq 0 ]; then
395N/A echo Creating new $keytype public/private host key pair
395N/A $KEYGEN -f $keypath -t $keytype -N ''
395N/A if [ $? -ne 0 ]; then
395N/A echo "Could not create $keytype key: $keypath"
395N/A exit $SMF_EXIT_ERR_CONFIG
395N/A fi
395N/A fi
395N/A fi
395N/A}
395N/A
395N/Acreate_ipf_rules()
395N/A{
395N/A FMRI=$1
395N/A ipf_file=`fmri_to_file ${FMRI} $IPF_SUFFIX`
395N/A policy=`get_policy ${FMRI}`
395N/A
395N/A #
395N/A # Get port from /etc/ssh/sshd_config
395N/A #
395N/A tports=`grep "^Port" /etc/ssh/sshd_config 2>/dev/null | \
395N/A awk '{print $2}'`
395N/A
395N/A echo "# $FMRI" >$ipf_file
395N/A for port in $tports; do
395N/A generate_rules $FMRI $policy "tcp" "any" $port $ipf_file
395N/A done
395N/A}
395N/A
395N/A# This script is being used for two purposes: as part of an SMF
395N/A# start/stop/refresh method, and as a sysidconfig(1M)/sys-unconfig(1M)
395N/A# application.
395N/A#
395N/A# Both, the SMF methods and sysidconfig/sys-unconfig use different
395N/A# arguments..
395N/A
395N/Acase $1 in
395N/A # sysidconfig/sys-unconfig arguments (-c and -u)
395N/A'-c')
395N/A create_key $SSHDIR/ssh_host_rsa_key rsa
395N/A create_key $SSHDIR/ssh_host_dsa_key dsa
395N/A ;;
395N/A
'-u')
# sys-unconfig(1M) knows how to remove ssh host keys, so there's
# nothing to do here.
:
;;
# SMF arguments (start and restart [really "refresh"])
'ipfilter')
create_ipf_rules $2
;;
'start')
#
# If host keys don't exist when the service is started, create
# them; sysidconfig is not run in every situation (such as on
# the install media).
#
create_key $SSHDIR/ssh_host_rsa_key rsa
create_key $SSHDIR/ssh_host_dsa_key dsa
/usr/lib/ssh/sshd
;;
'restart')
if [ -f "$PIDFILE" ]; then
/usr/bin/kill -HUP `/usr/bin/cat $PIDFILE`
fi
;;
*)
echo "Usage: $0 { start | restart }"
exit 1
;;
esac
exit $?