[git.ipfire.org] IPFire 2.x development tree branch, next, updated. ea0033d96214b74ea69983d09214fe637f00eae8

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. ea0033d96214b74ea69983d09214fe637f00eae8

[git]

[-- Attachment #1: Type: text/plain, Size: 3332 bytes --]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".

The branch, next has been updated
       via  ea0033d96214b74ea69983d09214fe637f00eae8 (commit)
       via  04da8aa70acfa411ee124669a11e5b8a1eaf2921 (commit)
      from  cec620efdf2d0ab2c55b015ca7b8d6ca2a667e72 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit ea0033d96214b74ea69983d09214fe637f00eae8
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date:   Thu Aug 20 23:26:49 2015 +0100

    SSH: Replace old RSA keys with a new set
    
    Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>

commit 04da8aa70acfa411ee124669a11e5b8a1eaf2921
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date:   Thu Aug 20 23:20:44 2015 +0100

    Do not create any DSA keys any more
    
    DSA is considered weak cryptography
    
    Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>

-----------------------------------------------------------------------

Summary of changes:
 config/rootfiles/core/94/filelists/files |  1 +
 config/rootfiles/core/94/update.sh       |  6 ++++++
 src/initscripts/init.d/sshd              | 14 +-------------
 3 files changed, 8 insertions(+), 13 deletions(-)

Difference in files:
diff --git a/config/rootfiles/core/94/filelists/files b/config/rootfiles/core/94/filelists/files
index 168c7d1..2dce10a 100644
--- a/config/rootfiles/core/94/filelists/files
+++ b/config/rootfiles/core/94/filelists/files
@@ -1,3 +1,4 @@
 etc/system-release
 etc/issue
+etc/rc.d/init.d/sshd
 var/ipfire/langs
diff --git a/config/rootfiles/core/94/update.sh b/config/rootfiles/core/94/update.sh
index d92ef91..99c5e4f 100644
--- a/config/rootfiles/core/94/update.sh
+++ b/config/rootfiles/core/94/update.sh
@@ -45,6 +45,12 @@ extract_files
 sed -i /etc/ssh/sshd_config \
 	-e 's/^#\?PermitRootLogin .*$$/PermitRootLogin yes/'
 
+# Move away old and unsupported keys
+mv -f /etc/ssh/ssh_host_dsa_key{,.old}
+# Regenerating weak RSA keys
+mv -f /etc/ssh/ssh_host_key{,.old}
+mv -f /etc/ssh/ssh_host_rsa_key{,.old}
+
 # Start services
 /etc/init.d/dnsmasq start
 /etc/init.d/sshd start
diff --git a/src/initscripts/init.d/sshd b/src/initscripts/init.d/sshd
index 0ed8661..7b4092d 100644
--- a/src/initscripts/init.d/sshd
+++ b/src/initscripts/init.d/sshd
@@ -12,24 +12,12 @@
 
 case "$1" in
     start)
-	if [ ! -e "/etc/ssh/ssh_host_key" ]; then
-		boot_mesg "Generating SSH host key..."
-		ssh-keygen -qf /etc/ssh/ssh_host_key -N '' -t rsa1
-		evaluate_retval
-	fi
-
-	for algo in rsa dsa ecdsa ed25519; do
+	for algo in rsa ecdsa ed25519; do
 		keyfile="/etc/ssh/ssh_host_${algo}_key"
 
 		# If the key already exists, there is nothing to do.
 		[ -e "${keyfile}" ] && continue
 
-		case "${algo}" in
-			rsa)
-				algo="rsa1"
-				;;
-		esac
-
 		boot_mesg "Generating SSH key (${algo})..."
 		ssh-keygen -qf "${keyfile}" -N '' -t ${algo}
 		evaluate_retval


hooks/post-receive
--
IPFire 2.x development tree