[git.ipfire.org] IPFire 3.x development tree branch, master, updated. ba1319f415e5483dc2ba4806b3608e43b49707bc

[git@ipfire.org]

[-- Attachment #1: Type: text/plain, Size: 5296 bytes --]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 3.x development tree".

The branch, master has been updated
       via  ba1319f415e5483dc2ba4806b3608e43b49707bc (commit)
      from  aafa4eb8c69af8fbb560955d16fa1cb32fba4877 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit ba1319f415e5483dc2ba4806b3608e43b49707bc
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date:   Sun Sep 6 14:49:30 2015 +0100

    openssh: Rewrite sshd-keygen
    
    This script has been rewritten and simplified and extended to
    create keys for elliptic curve cryptography.
    
    Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>

-----------------------------------------------------------------------

Summary of changes:
 openssh/openssh.nm  |  2 +-
 openssh/sshd-keygen | 98 +++++++++++++++++++++++------------------------------
 2 files changed, 43 insertions(+), 57 deletions(-)

Difference in files:
diff --git a/openssh/openssh.nm b/openssh/openssh.nm
index 59491fd..8489438 100644
--- a/openssh/openssh.nm
+++ b/openssh/openssh.nm
@@ -5,7 +5,7 @@
 
 name       = openssh
 version    = 6.8p1
-release    = 1
+release    = 2
 
 groups     = Application/Internet
 url        = http://www.openssh.com/portable.html
diff --git a/openssh/sshd-keygen b/openssh/sshd-keygen
index 619e839..987afd4 100644
--- a/openssh/sshd-keygen
+++ b/openssh/sshd-keygen
@@ -1,63 +1,49 @@
 #!/bin/bash
+###############################################################################
+#                                                                             #
+# IPFire.org - A linux based firewall                                         #
+# Copyright (C) 2015  Michael Tremer                                          #
+#                                                                             #
+# This program is free software: you can redistribute it and/or modify        #
+# it under the terms of the GNU General Public License as published by        #
+# the Free Software Foundation, either version 3 of the License, or           #
+# (at your option) any later version.                                         #
+#                                                                             #
+# This program is distributed in the hope that it will be useful,             #
+# but WITHOUT ANY WARRANTY; without even the implied warranty of              #
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
+# GNU General Public License for more details.                                #
+#                                                                             #
+# You should have received a copy of the GNU General Public License           #
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
+#                                                                             #
+###############################################################################
 
-# Create the host keys for the OpenSSH server.
-#
-
-# Some functions to make the below more readable
-KEYGEN=/usr/bin/ssh-keygen
-RSA1_KEY=/etc/ssh/ssh_host_key
-RSA_KEY=/etc/ssh/ssh_host_rsa_key
-DSA_KEY=/etc/ssh/ssh_host_dsa_key
-
-do_rsa1_keygen() {
-	if [ ! -s $RSA1_KEY ]; then
-		rm -f $RSA1_KEY
-		if test ! -f $RSA1_KEY && $KEYGEN -q -t rsa1 -f $RSA1_KEY -C '' -N '' >&/dev/null; then
-			chgrp ssh_keys $RSA1_KEY
-			chmod 600 $RSA1_KEY
-			chmod 644 $RSA1_KEY.pub
-			if [ -x /sbin/restorecon ]; then
-			    /sbin/restorecon $RSA1_KEY.pub
-			fi
-		else
-			exit 1
-		fi
-	fi
-}
+ALGOS="rsa ecdsa ed25519"
 
-do_rsa_keygen() {
-	if [ ! -s $RSA_KEY ]; then
-		rm -f $RSA_KEY
-		if test ! -f $RSA_KEY && $KEYGEN -q -t rsa -f $RSA_KEY -C '' -N '' >&/dev/null; then
-			chgrp ssh_keys $RSA_KEY
-			chmod 600 $RSA_KEY
-			chmod 644 $RSA_KEY.pub
-			if [ -x /sbin/restorecon ]; then
-			    /sbin/restorecon $RSA_KEY.pub
-			fi
-		else
-			exit 1
-		fi
-	fi
-}
+main() {
+	local ret=0
 
-do_dsa_keygen() {
-	if [ ! -s $DSA_KEY ]; then
-		rm -f $DSA_KEY
-		if test ! -f $DSA_KEY && $KEYGEN -q -t dsa -f $DSA_KEY -C '' -N '' >&/dev/null; then
-			chgrp ssh_keys $DSA_KEY
-			chmod 600 $DSA_KEY
-			chmod 644 $DSA_KEY.pub
-			if [ -x /sbin/restorecon ]; then
-			    /sbin/restorecon $DSA_KEY.pub
-			fi
-		else
-			exit 1
+	local algo
+	for algo in ${ALGOS}; do
+		local keyfile="/etc/ssh/ssh_host_${algo}_key"
+
+		# If the key already exists, there is nothing to do
+		[ -e "${keyfile}" ] && continue
+
+		# Generate a new key
+		if ! ssh-keygen -qf "${keyfile}" -N '' -t "${algo}"; then
+			ret=1
+			continue
 		fi
-	fi
+
+		# Fix permissions
+		chgrp ssh_keys "${keyfile}"
+		chmod 600 "${keyfile}"
+		chmod 644 "${keyfile}.pub"
+	done
+
+	return ${ret}
 }
 
-# Create keys
-do_rsa_keygen
-do_rsa1_keygen
-do_dsa_keygen
+main; exit $?


hooks/post-receive
--
IPFire 3.x development tree