[git.ipfire.org] IPFire 2.x development tree branch, master, updated. 804ac341a18718e5593ef8d77670d28018515aa7

[git.ipfire.org] IPFire 2.x development tree branch, master, updated. 804ac341a18718e5593ef8d77670d28018515aa7

[Michael Tremer]

[-- Attachment #1: Type: text/plain, Size: 5324 bytes --]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".

The branch, master has been updated
       via  804ac341a18718e5593ef8d77670d28018515aa7 (commit)
       via  0712a67744c6da9f0e4ddb3510af7b42d5a6c223 (commit)
       via  955f8b14571d56cfd132710cdd29db30645aba67 (commit)
       via  1a4d5cfd92bb1f52e6670399ef94a36fe97cdf6a (commit)
      from  38067c08c727086c92899042ef40e2f7e17115e7 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 804ac341a18718e5593ef8d77670d28018515aa7
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date:   Mon Dec 9 11:37:11 2024 +0000

    core190: Load SSH RSA key on legacy systems
    
    Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>

commit 0712a67744c6da9f0e4ddb3510af7b42d5a6c223
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date:   Mon Dec 9 11:37:10 2024 +0000

    OpenSSH: No longer try to load the RSA key
    
    This key has been removed on new installations.
    
    Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>

commit 955f8b14571d56cfd132710cdd29db30645aba67
Author: Stefan Schantl <stefan.schantl(a)ipfire.org>
Date:   Sat Dec 7 16:04:00 2024 +0100

    backup: Add /etc/ssh/sshd_config.d
    
    Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
    Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>

commit 1a4d5cfd92bb1f52e6670399ef94a36fe97cdf6a
Author: Stefan Schantl <stefan.schantl(a)ipfire.org>
Date:   Sat Dec 7 16:03:59 2024 +0100

    openssh: Introduce include directory for additional sshd config files
    
    This patch adds the prosibility to place additional *.config files in /etc/ssh/sshd_config.d/
    which will be included and loaded during the daemon startup process.
    
    Because this files will not be overwritten by any update, they can be used to place custom
    or other persistent settings.
    
    Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
    Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>

-----------------------------------------------------------------------

Summary of changes:
 config/backup/include               | 1 +
 config/rootfiles/common/openssh     | 1 +
 config/rootfiles/core/190/update.sh | 8 ++++++++
 config/ssh/sshd_config              | 4 +++-
 lfs/openssh                         | 4 ++++
 5 files changed, 17 insertions(+), 1 deletion(-)

Difference in files:
diff --git a/config/backup/include b/config/backup/include
index f0708c87f..0bf9440d3 100644
--- a/config/backup/include
+++ b/config/backup/include
@@ -10,6 +10,7 @@ etc/logrotate.d
 etc/passwd
 etc/shadow
 etc/ssh/sshd_config
+etc/ssh/sshd_config.d
 etc/ssh/ssh_host*
 etc/squid/squid.conf.local
 etc/squid/squid.conf.pre.local
diff --git a/config/rootfiles/common/openssh b/config/rootfiles/common/openssh
index f7b479f55..d25651348 100644
--- a/config/rootfiles/common/openssh
+++ b/config/rootfiles/common/openssh
@@ -8,6 +8,7 @@ etc/ssh/ssh_config
 #etc/ssh/ssh_host_rsa_key
 #etc/ssh/ssh_host_rsa_key.pub
 etc/ssh/sshd_config
+etc/ssh/sshd_config.d
 usr/bin/scp
 usr/bin/sftp
 usr/bin/ssh
diff --git a/config/rootfiles/core/190/update.sh b/config/rootfiles/core/190/update.sh
index 16ef608e2..3950ba903 100644
--- a/config/rootfiles/core/190/update.sh
+++ b/config/rootfiles/core/190/update.sh
@@ -104,6 +104,14 @@ ldconfig
 # Filesytem cleanup
 /usr/local/bin/filesystem-cleanup
 
+# Load the RSA key on systems that still have one
+if [ -e "/etc/ssh/ssh_host_rsa_key" ]; then
+	(
+		echo "# Load the legacy RSA key - Deprecated in Core Update 190"
+		echo "HostKey /etc/ssh/ssh_host_rsa_key"
+	) > /etc/ssh/sshd_config.d/rsa.conf
+fi
+
 # Apply local configuration to sshd_config
 /usr/local/bin/sshctrl
 
diff --git a/config/ssh/sshd_config b/config/ssh/sshd_config
index e338f8cef..7b687457c 100644
--- a/config/ssh/sshd_config
+++ b/config/ssh/sshd_config
@@ -27,7 +27,6 @@ MACs hmac-sha2-512-etm(a)openssh.com,hmac-sha2-256-etm(a)openssh.com,umac-128-etm(a)op
 # Only allow cryptographically safe SSH host keys (adjust paths if needed)
 HostKey /etc/ssh/ssh_host_ed25519_key
 HostKey /etc/ssh/ssh_host_ecdsa_key
-HostKey /etc/ssh/ssh_host_rsa_key
 
 # Only allow login via public key by default
 PubkeyAuthentication yes
@@ -57,4 +56,7 @@ TCPKeepAlive no
 # Add support for SFTP
 Subsystem	sftp	/usr/lib/openssh/sftp-server
 
+# Include additional sshd config files.
+Include /etc/ssh/sshd_config.d/*.conf
+
 # EOF
diff --git a/lfs/openssh b/lfs/openssh
index c14c8267c..b1c9a1635 100644
--- a/lfs/openssh
+++ b/lfs/openssh
@@ -91,5 +91,9 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	install -v -m 644 $(DIR_SRC)/config/ssh/ssh_config \
 		/etc/ssh/ssh_config
 
+	# Create directory for additional config
+	# config files.
+	mkdir -pv /etc/ssh/sshd_config.d/
+
 	@rm -rf $(DIR_APP)
 	@$(POSTBUILD)


hooks/post-receive
--
IPFire 2.x development tree