5542N/A#!/usr/sbin/sh
5542N/A#
5542N/A# Copyright (c) 2001, 2016, Oracle and/or its affiliates. All rights reserved.
5542N/A#
5542N/A
5542N/A. /lib/svc/share/smf_include.sh
5542N/A
5542N/ASSHDIR=/etc/ssh
5542N/AKEYGEN="/usr/bin/ssh-keygen -q"
5542N/APIDFILE=$SMF_SYSVOL_FS/sshd.pid
5542N/A
5542N/A# Checks to see if RSA, and DSA host keys are available
5542N/A# if any of these keys are not present, the respective keys are created.
5542N/Acreate_key()
5542N/A{
5542N/A keypath=$1
5542N/A keytype=$2
5542N/A
5542N/A if [ ! -f $keypath ]; then
5542N/A #
5542N/A # HostKey keywords in sshd_config may be preceded or
5542N/A # followed by a mix of any number of space or tabs,
5542N/A # and optionally have an = between keyword and
5542N/A # argument. We use two grep invocations such that we
5542N/A # can match HostKey case insensitively but still have
5542N/A # the case of the path name be significant, keeping
5542N/A # the pattern somewhat more readable.
5542N/A #
5542N/A # The character classes below contain one literal
5542N/A # space and one literal tab.
5542N/A #
5542N/A grep -i "^[ ]*HostKey[ ]*=\{0,1\}[ ]*$keypath" \
5542N/A $SSHDIR/sshd_config | grep "$keypath" > /dev/null 2>&1
5542N/A
5542N/A if [ $? -eq 0 ]; then
5542N/A echo Creating new $keytype public/private host key pair
5542N/A $KEYGEN -f $keypath -t $keytype -N ''
5542N/A if [ $? -ne 0 ]; then
5542N/A echo "Could not create $keytype key: $keypath"
5542N/A exit $SMF_EXIT_ERR_CONFIG
5542N/A fi
5542N/A fi
5542N/A fi
5542N/A}
5542N/A
5542N/Aremove_key()
5542N/A{
5542N/A keypath=$1
5542N/A if [ -f $keypath ]; then
5542N/A grep -i "^[ ]*HostKey[ ]*=\{0,1\}[ ]*$keypath" \
5542N/A $SSHDIR/sshd_config | grep "$keypath" > /dev/null 2>&1
5542N/A if [ $? -eq 0 ]; then
5542N/A rm -f ${keypath} ${keypath}.pub
5542N/A fi
5542N/A fi
5542N/A}
5542N/A
5542N/A#
5542N/A# Makes sure, that /etc/ssh/sshd_config does not contain single line
5542N/A# 'ListenAddress ::'.
5542N/A#
5542N/A# This used to be part of default SunSSH sshd_config and instructed SunSSH
5542N/A# to listen on all interfaces. For OpenSSH, the same line means listen on all
5542N/A# IPv6 interfaces.
5542N/A#
5542N/Afix_listenaddress()
5542N/A{
5542N/A fbackup="$SSHDIR/sshd_config.pre_listenaddress_fix"
5542N/A reason4change="#\n\
5542N/A# Historically default sshd_config was shipped with 'ListenAddress ::',\n\
5542N/A# which means 'listen on all interfaces' in SunSSH.\n\
5542N/A# In OpenSSH this setting means 'listen on all IPv6 interfaces'.\n\
5542N/A# To avoid loss of service after transitioning to OpenSSH, the following\n\
5542N/A# line was commented out by the network/ssh service method script on\n\
5542N/A# $(date).\n\
5542N/A# Original file was backed up to $fbackup\n\
5542N/A#\n\
5542N/A# "
5542N/A expl4log="Historically default sshd_config was shipped with \
5542N/A'ListenAddress ::', which means 'listen on all interfaces' in SunSSH. \
5542N/AIn OpenSSH this setting means 'listen on all IPv6 interfaces'. \
5542N/AFor both SunSSH and OpenSSH the default behavior when no ListenAddress \
5542N/Ais specified is to listen on all interfaces (both IPv4 and IPv6)."
5542N/A msg_not_removed="Custom ListenAddress setting detected in \
5542N/A$SSHDIR/sshd_config, the file will not be modified. Please, check your \
5542N/AListenAddress settings. $expl4log"
5542N/A msg_removed="Removing 'ListenAddress ::'. $expl4log Original file has \
5542N/Abeen backed up to $fbackup"
5542N/A
5542N/A # only modify sshd_config, if ssh implementation is OpenSSH
5542N/A if [[ "$(ssh -V 2>&1)" == Sun_SSH_* ]]; then
5542N/A return 0;
5542N/A fi
5542N/A
5542N/A # comment '# IPv4 & IPv6' indicates an old default sshd_config
5542N/A grep -q '^# IPv4 & IPv6$' $SSHDIR/sshd_config || return 0;
5542N/A
5542N/A # backup
5542N/A cp $SSHDIR/sshd_config $fbackup
5542N/A
5542N/A # if 'ListenAddress ::' is the only ListenAddress line, comment it out
5542N/A listen_address=$(grep -i '^[ \t]*ListenAddress' $SSHDIR/sshd_config)
5542N/A if [[ "$listen_address" == 'ListenAddress ::' ]]; then
5542N/A echo $msg_removed
5542N/A awk_prog="/^ListenAddress ::$/ {printf(\"$reason4change\")}\
5542N/A !/^# IPv4 & IPv6$/ {print}"
5542N/A elif [[ -z "$listen_address" ]]; then
5542N/A # no ListenAddress setting => OK, silently remove comment
5542N/A awk_prog="!/^# IPv4 & IPv6$/ {print}"
5542N/A else
5542N/A # send warning message both to log and console
5542N/A echo $msg_not_removed | smf_console
5542N/A awk_prog="!/^# IPv4 & IPv6$/ {print}"
5542N/A fi;
5542N/A
5542N/A sshd_config=$(nawk "$awk_prog" $SSHDIR/sshd_config)
5542N/A if [[ $? -ne 0 ]]; then
5542N/A echo "Update error! Check your ListenAddress settings."
5542N/A return 1;
5542N/A else
5542N/A # write the fixed content to the file
5542N/A echo "$sshd_config" > $SSHDIR/sshd_config
5542N/A return 0;
5542N/A fi
5542N/A
5542N/A}
5542N/A
5542N/A# This script is being used for two purposes: as part of an SMF
5542N/A# start/stop/refresh method, and as a sysidconfig(1M)/sys-unconfig(1M)
5542N/A# application.
5542N/A#
5542N/A# Both, the SMF methods and sysidconfig/sys-unconfig use different
5542N/A# arguments..
5542N/A
5542N/Acase $1 in
5542N/A # sysidconfig/sys-unconfig arguments (-c and -u)
5542N/A'-c')
5542N/A create_key $SSHDIR/ssh_host_rsa_key rsa
5818N/A create_key $SSHDIR/ssh_host_ed25519_key ed25519
5542N/A ;;
5542N/A
5542N/A'-u')
5542N/A # sysconfig unconfigure to remove the sshd host keys
5542N/A remove_key $SSHDIR/ssh_host_rsa_key
5818N/A remove_key $SSHDIR/ssh_host_ed25519_key
5542N/A ;;
5542N/A
5542N/A # SMF arguments (start and restart [really "refresh"])
5542N/A
5542N/A'start')
5542N/A #
5542N/A # If host keys don't exist when the service is started, create
5542N/A # them; sysidconfig is not run in every situation (such as on
5542N/A # the install media).
5542N/A #
5542N/A create_key $SSHDIR/ssh_host_rsa_key rsa
5818N/A create_key $SSHDIR/ssh_host_ed25519_key ed25519
5542N/A
5542N/A #
5542N/A # Make sure, that /etc/ssh/sshd_config does not contain single line
5542N/A # 'ListenAddress ::'.
5542N/A #
5542N/A fix_listenaddress
5542N/A
5542N/A /usr/lib/ssh/sshd
5542N/A ;;
5542N/A
5542N/A'restart')
5542N/A if [ -f "$PIDFILE" ]; then
5542N/A /usr/bin/kill -HUP `/usr/bin/cat $PIDFILE`
5542N/A fi
5542N/A ;;
5542N/A
5542N/A*)
5542N/A echo "Usage: $0 { start | restart }"
5542N/A exit 1
5542N/A ;;
5542N/Aesac
5542N/A
5542N/Aexit $?