1#!/bin/bash
2#
3# ssh-host-config, Copyright 2000-2011 Red Hat Inc.
4#
5# This file is part of the Cygwin port of OpenSSH.
6#
7# Permission to use, copy, modify, and distribute this software for any
8# purpose with or without fee is hereby granted, provided that the above
9# copyright notice and this permission notice appear in all copies.
10#
11# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS  
12# OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF               
13# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.   
14# IN NO EVENT SHALL THE ABOVE COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,   
15# DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR    
16# OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR    
17# THE USE OR OTHER DEALINGS IN THE SOFTWARE.                               
18
19# ======================================================================
20# Initialization
21# ======================================================================
22
23CSIH_SCRIPT=/usr/share/csih/cygwin-service-installation-helper.sh
24
25# List of apps used.  This is checkad for existance in csih_sanity_check
26# Don't use *any* transient commands before sourcing the csih helper script,
27# otherwise the sanity checks are short-circuited.
28declare -a csih_required_commands=(
29  /usr/bin/basename coreutils
30  /usr/bin/cat coreutils
31  /usr/bin/chmod coreutils
32  /usr/bin/dirname coreutils
33  /usr/bin/id coreutils
34  /usr/bin/mv coreutils
35  /usr/bin/rm coreutils
36  /usr/bin/cygpath cygwin
37  /usr/bin/mount cygwin
38  /usr/bin/ps cygwin
39  /usr/bin/setfacl cygwin
40  /usr/bin/umount cygwin
41  /usr/bin/cmp diffutils
42  /usr/bin/grep grep
43  /usr/bin/awk gawk
44  /usr/bin/ssh-keygen openssh
45  /usr/sbin/sshd openssh
46  /usr/bin/sed sed
47)
48csih_sanity_check_server=yes
49source ${CSIH_SCRIPT}
50
51PROGNAME=$(/usr/bin/basename $0)
52_tdir=$(/usr/bin/dirname $0)
53PROGDIR=$(cd $_tdir && pwd)
54
55# Subdirectory where the new package is being installed
56PREFIX=/usr
57
58# Directory where the config files are stored
59SYSCONFDIR=/etc
60LOCALSTATEDIR=/var
61
62port_number=22
63privsep_configured=no
64privsep_used=yes
65cygwin_value=""
66user_account=
67password_value=
68opt_force=no
69
70# ======================================================================
71# Routine: create_host_keys
72# ======================================================================
73create_host_keys() {
74  local ret=0
75
76  if [ ! -f "${SYSCONFDIR}/ssh_host_key" ]
77  then
78    csih_inform "Generating ${SYSCONFDIR}/ssh_host_key"
79    if ! /usr/bin/ssh-keygen -t rsa1 -f ${SYSCONFDIR}/ssh_host_key -N '' > /dev/null
80    then
81    	csih_warning "Generating ${SYSCONFDIR}/ssh_host_key failed!"
82	let ++ret
83    fi
84  fi
85
86  if [ ! -f "${SYSCONFDIR}/ssh_host_rsa_key" ]
87  then
88    csih_inform "Generating ${SYSCONFDIR}/ssh_host_rsa_key"
89    if ! /usr/bin/ssh-keygen -t rsa -f ${SYSCONFDIR}/ssh_host_rsa_key -N '' > /dev/null
90    then
91    	csih_warning "Generating ${SYSCONFDIR}/ssh_host_key failed!"
92	let ++ret
93    fi
94  fi
95
96  if [ ! -f "${SYSCONFDIR}/ssh_host_dsa_key" ]
97  then
98    csih_inform "Generating ${SYSCONFDIR}/ssh_host_dsa_key"
99    if ! /usr/bin/ssh-keygen -t dsa -f ${SYSCONFDIR}/ssh_host_dsa_key -N '' > /dev/null
100    then
101    	csih_warning "Generating ${SYSCONFDIR}/ssh_host_key failed!"
102	let ++ret
103    fi
104  fi
105
106  if [ ! -f "${SYSCONFDIR}/ssh_host_ecdsa_key" ]
107  then
108    csih_inform "Generating ${SYSCONFDIR}/ssh_host_ecdsa_key"
109    if ! /usr/bin/ssh-keygen -t ecdsa -f ${SYSCONFDIR}/ssh_host_ecdsa_key -N '' > /dev/null
110    then
111    	csih_warning "Generating ${SYSCONFDIR}/ssh_host_key failed!"
112	let ++ret
113    fi
114  fi
115  return $ret
116} # --- End of create_host_keys --- #
117
118# ======================================================================
119# Routine: update_services_file
120# ======================================================================
121update_services_file() {
122  local _my_etcdir="/ssh-host-config.$$"
123  local _win_etcdir
124  local _services
125  local _spaces
126  local _serv_tmp
127  local _wservices
128  local ret=0
129
130  _win_etcdir="${SYSTEMROOT}\\system32\\drivers\\etc"
131  _services="${_my_etcdir}/services"
132  _spaces="                           #"
133  _serv_tmp="${_my_etcdir}/srv.out.$$"
134
135  /usr/bin/mount -o text,posix=0,noacl -f "${_win_etcdir}" "${_my_etcdir}"
136
137  # Depends on the above mount
138  _wservices=`cygpath -w "${_services}"`
139
140  # Remove sshd 22/port from services
141  if [ `/usr/bin/grep -q 'sshd[ \t][ \t]*22' "${_services}"; echo $?` -eq 0 ]
142  then
143    /usr/bin/grep -v 'sshd[ \t][ \t]*22' "${_services}" > "${_serv_tmp}"
144    if [ -f "${_serv_tmp}" ]
145    then
146      if /usr/bin/mv "${_serv_tmp}" "${_services}"
147      then
148	csih_inform "Removing sshd from ${_wservices}"
149      else
150	csih_warning "Removing sshd from ${_wservices} failed!"
151	let ++ret
152      fi
153      /usr/bin/rm -f "${_serv_tmp}"
154    else
155      csih_warning "Removing sshd from ${_wservices} failed!"
156      let ++ret
157    fi
158  fi
159
160  # Add ssh 22/tcp  and ssh 22/udp to services
161  if [ `/usr/bin/grep -q 'ssh[ \t][ \t]*22' "${_services}"; echo $?` -ne 0 ]
162  then
163    if /usr/bin/awk '{ if ( $2 ~ /^23\/tcp/ ) print "ssh                22/tcp'"${_spaces}"'SSH Remote Login Protocol\nssh                22/udp'"${_spaces}"'SSH Remote Login Protocol"; print $0; }' < "${_services}" > "${_serv_tmp}"
164    then
165      if /usr/bin/mv "${_serv_tmp}" "${_services}"
166      then
167	csih_inform "Added ssh to ${_wservices}"
168      else
169	csih_warning "Adding ssh to ${_wservices} failed!"
170	let ++ret
171      fi
172      /usr/bin/rm -f "${_serv_tmp}"
173    else
174      csih_warning "Adding ssh to ${_wservices} failed!"
175      let ++ret
176    fi
177  fi
178  /usr/bin/umount "${_my_etcdir}"
179  return $ret
180} # --- End of update_services_file --- #
181
182# ======================================================================
183# Routine: sshd_privsep
184#  MODIFIES: privsep_configured  privsep_used
185# ======================================================================
186sshd_privsep() {
187  local sshdconfig_tmp
188  local ret=0
189
190  if [ "${privsep_configured}" != "yes" ]
191  then
192    csih_inform "Privilege separation is set to yes by default since OpenSSH 3.3."
193    csih_inform "However, this requires a non-privileged account called 'sshd'."
194    csih_inform "For more info on privilege separation read /usr/share/doc/openssh/README.privsep."
195    if csih_request "Should privilege separation be used?"
196    then
197      privsep_used=yes
198      if ! csih_create_unprivileged_user sshd
199      then
200	csih_error_recoverable "Couldn't create user 'sshd'!"
201	csih_error_recoverable "Privilege separation set to 'no' again!"
202	csih_error_recoverable "Check your ${SYSCONFDIR}/sshd_config file!"
203	let ++ret
204	privsep_used=no
205      fi
206    else
207      privsep_used=no
208    fi
209  fi
210
211  # Create default sshd_config from skeleton files in /etc/defaults/etc or
212  # modify to add the missing privsep configuration option
213  if /usr/bin/cmp "${SYSCONFDIR}/sshd_config" "${SYSCONFDIR}/defaults/${SYSCONFDIR}/sshd_config" >/dev/null 2>&1
214  then
215    csih_inform "Updating ${SYSCONFDIR}/sshd_config file"
216    sshdconfig_tmp=${SYSCONFDIR}/sshd_config.$$
217    /usr/bin/sed -e "s/^#UsePrivilegeSeparation yes/UsePrivilegeSeparation ${privsep_used}/
218  	  s/^#Port 22/Port ${port_number}/
219  	  s/^#StrictModes yes/StrictModes no/" \
220	< ${SYSCONFDIR}/sshd_config \
221	> "${sshdconfig_tmp}"
222    if ! /usr/bin/mv "${sshdconfig_tmp}" ${SYSCONFDIR}/sshd_config
223    then
224	csih_warning "Setting privilege separation to 'yes' failed!"
225	csih_warning "Check your ${SYSCONFDIR}/sshd_config file!"
226	let ++ret
227    fi
228  elif [ "${privsep_configured}" != "yes" ]
229  then
230    echo >> ${SYSCONFDIR}/sshd_config
231    if ! echo "UsePrivilegeSeparation ${privsep_used}" >> ${SYSCONFDIR}/sshd_config
232    then
233	csih_warning "Setting privilege separation to 'yes' failed!"
234	csih_warning "Check your ${SYSCONFDIR}/sshd_config file!"
235	let ++ret
236    fi
237  fi
238  return $ret
239} # --- End of sshd_privsep --- #
240
241# ======================================================================
242# Routine: update_inetd_conf
243# ======================================================================
244update_inetd_conf() {
245  local _inetcnf="${SYSCONFDIR}/inetd.conf"
246  local _inetcnf_tmp="${SYSCONFDIR}/inetd.conf.$$"
247  local _inetcnf_dir="${SYSCONFDIR}/inetd.d"
248  local _sshd_inetd_conf="${_inetcnf_dir}/sshd-inetd"
249  local _sshd_inetd_conf_tmp="${_inetcnf_dir}/sshd-inetd.$$"
250  local _with_comment=1
251  local ret=0
252
253  if [ -d "${_inetcnf_dir}" ]
254  then
255    # we have inetutils-1.5 inetd.d support
256    if [ -f "${_inetcnf}" ]
257    then
258      /usr/bin/grep -q '^[ \t]*ssh' "${_inetcnf}" && _with_comment=0
259
260      # check for sshd OR ssh in top-level inetd.conf file, and remove
261      # will be replaced by a file in inetd.d/
262      if [ `/usr/bin/grep -q '^[# \t]*ssh' "${_inetcnf}"; echo $?` -eq 0 ]
263      then
264	/usr/bin/grep -v '^[# \t]*ssh' "${_inetcnf}" >> "${_inetcnf_tmp}"
265	if [ -f "${_inetcnf_tmp}" ]
266	then
267	  if /usr/bin/mv "${_inetcnf_tmp}" "${_inetcnf}"
268	  then
269  	    csih_inform "Removed ssh[d] from ${_inetcnf}"
270	  else
271  	    csih_warning "Removing ssh[d] from ${_inetcnf} failed!"
272	    let ++ret
273	  fi
274	  /usr/bin/rm -f "${_inetcnf_tmp}"
275	else
276	  csih_warning "Removing ssh[d] from ${_inetcnf} failed!"
277	  let ++ret
278	fi
279      fi
280    fi
281
282    csih_install_config "${_sshd_inetd_conf}"   "${SYSCONFDIR}/defaults"
283    if /usr/bin/cmp "${SYSCONFDIR}/defaults${_sshd_inetd_conf}" "${_sshd_inetd_conf}" >/dev/null 2>&1
284    then
285      if [ "${_with_comment}" -eq 0 ]
286      then
287	/usr/bin/sed -e 's/@COMMENT@[ \t]*//' < "${_sshd_inetd_conf}" > "${_sshd_inetd_conf_tmp}"
288      else
289	/usr/bin/sed -e 's/@COMMENT@[ \t]*/# /' < "${_sshd_inetd_conf}" > "${_sshd_inetd_conf_tmp}"
290      fi
291      if /usr/bin/mv "${_sshd_inetd_conf_tmp}" "${_sshd_inetd_conf}"
292      then
293	csih_inform "Updated ${_sshd_inetd_conf}"
294      else
295	csih_warning "Updating ${_sshd_inetd_conf} failed!"
296	let ++ret
297      fi
298    fi
299
300  elif [ -f "${_inetcnf}" ]
301  then
302    /usr/bin/grep -q '^[ \t]*sshd' "${_inetcnf}" && _with_comment=0
303
304    # check for sshd in top-level inetd.conf file, and remove
305    # will be replaced by a file in inetd.d/
306    if [ `/usr/bin/grep -q '^[# \t]*sshd' "${_inetcnf}"; echo $?` -eq 0 ]
307    then
308      /usr/bin/grep -v '^[# \t]*sshd' "${_inetcnf}" >> "${_inetcnf_tmp}"
309      if [ -f "${_inetcnf_tmp}" ]
310      then
311	if /usr/bin/mv "${_inetcnf_tmp}" "${_inetcnf}"
312	then
313	    csih_inform "Removed sshd from ${_inetcnf}"
314	else
315	    csih_warning "Removing sshd from ${_inetcnf} failed!"
316	    let ++ret
317	fi
318	/usr/bin/rm -f "${_inetcnf_tmp}"
319      else
320	csih_warning "Removing sshd from ${_inetcnf} failed!"
321	let ++ret
322      fi
323    fi
324
325    # Add ssh line to inetd.conf
326    if [ `/usr/bin/grep -q '^[# \t]*ssh' "${_inetcnf}"; echo $?` -ne 0 ]
327    then
328      if [ "${_with_comment}" -eq 0 ]
329      then
330	echo 'ssh  stream  tcp     nowait  root    /usr/sbin/sshd sshd -i' >> "${_inetcnf}"
331      else
332	echo '# ssh  stream  tcp     nowait  root    /usr/sbin/sshd sshd -i' >> "${_inetcnf}"
333      fi
334      if [ $? -eq 0 ]
335      then
336	csih_inform "Added ssh to ${_inetcnf}"
337      else
338	csih_warning "Adding ssh to ${_inetcnf} failed!"
339	let ++ret
340      fi
341    fi
342  fi
343  return $ret
344} # --- End of update_inetd_conf --- #
345
346# ======================================================================
347# Routine: check_service_files_ownership
348#   Checks that the files in /etc and /var belong to the right owner
349# ======================================================================
350check_service_files_ownership() {
351  local run_service_as=$1
352  local ret=0
353
354  if [ -z "${run_service_as}" ]
355  then
356    accnt_name=$(/usr/bin/cygrunsrv -VQ sshd | /usr/bin/sed -ne 's/^Account *: *//gp')
357    if [ "${accnt_name}" = "LocalSystem" ]
358    then
359      # Convert "LocalSystem" to "SYSTEM" as is the correct account name
360      accnt_name="SYSTEM:"
361    elif [[ "${accnt_name}" =~ ^\.\\ ]]
362    then
363      # Convert "." domain to local machine name
364      accnt_name="U-${COMPUTERNAME}${accnt_name#.},"
365    fi
366    run_service_as=$(/usr/bin/grep -Fi "${accnt_name}" /etc/passwd | /usr/bin/awk -F: '{print $1;}')
367    if [ -z "${run_service_as}" ]
368    then
369      csih_warning "Couldn't determine name of user running sshd service from /etc/passwd!"
370      csih_warning "As a result, this script cannot make sure that the files used"
371      csih_warning "by the sshd service belong to the user running the service."
372      csih_warning "Please re-run the mkpasswd tool to make sure the /etc/passwd"
373      csih_warning "file is in a good shape."
374      return 1
375    fi
376  fi
377  for i in "${SYSCONFDIR}"/ssh_config "${SYSCONFDIR}"/sshd_config "${SYSCONFDIR}"/ssh_host_*key "${SYSCONFDIR}"/ssh_host_*key.pub
378  do
379    if [ -f "$i" ]
380    then
381      if ! chown "${run_service_as}".544 "$i" >/dev/null 2>&1
382      then
383	csih_warning "Couldn't change owner of $i!"
384	let ++ret
385      fi
386    fi
387  done
388  if ! chown "${run_service_as}".544 ${LOCALSTATEDIR}/empty >/dev/null 2>&1
389  then
390    csih_warning "Couldn't change owner of ${LOCALSTATEDIR}/empty!"
391    let ++ret
392  fi
393  if ! chown "${run_service_as}".544 ${LOCALSTATEDIR}/log/lastlog >/dev/null 2>&1
394  then
395    csih_warning "Couldn't change owner of ${LOCALSTATEDIR}/log/lastlog!"
396    let ++ret
397  fi
398  if [ -f ${LOCALSTATEDIR}/log/sshd.log ]
399  then
400    if ! chown "${run_service_as}".544 ${LOCALSTATEDIR}/log/sshd.log >/dev/null 2>&1
401    then
402      csih_warning "Couldn't change owner of ${LOCALSTATEDIR}/log/sshd.log!"
403      let ++ret
404    fi
405  fi
406  if [ $ret -ne 0 ]
407  then
408    csih_warning "Couldn't change owner of important files to ${run_service_as}!"
409    csih_warning "This may cause the sshd service to fail!  Please make sure that"
410    csih_warning "you have suufficient permissions to change the ownership of files"
411    csih_warning "and try to run the ssh-host-config script again."
412  fi
413  return $ret
414} # --- End of check_service_files_ownership --- #
415
416# ======================================================================
417# Routine: install_service
418#   Install sshd as a service
419# ======================================================================
420install_service() {
421  local run_service_as
422  local password
423  local ret=0
424
425  echo
426  if /usr/bin/cygrunsrv -Q sshd >/dev/null 2>&1
427  then
428    csih_inform "Sshd service is already installed."
429    check_service_files_ownership "" || let ret+=$?
430  else
431    echo -e "${_csih_QUERY_STR} Do you want to install sshd as a service?"
432    if csih_request "(Say \"no\" if it is already installed as a service)"
433    then
434      csih_get_cygenv "${cygwin_value}"
435
436      if ( csih_is_nt2003 || [ "$csih_FORCE_PRIVILEGED_USER" = "yes" ] )
437      then
438	csih_inform "On Windows Server 2003, Windows Vista, and above, the"
439	csih_inform "SYSTEM account cannot setuid to other users -- a capability"
440	csih_inform "sshd requires.  You need to have or to create a privileged"
441	csih_inform "account.  This script will help you do so."
442	echo
443
444	[ "${opt_force}" = "yes" ] && opt_f=-f
445	[ -n "${user_account}" ] && opt_u="-u ""${user_account}"""
446	csih_select_privileged_username ${opt_f} ${opt_u} sshd
447
448	if ! csih_create_privileged_user "${password_value}"
449	then
450	  csih_error_recoverable "There was a serious problem creating a privileged user."
451	  csih_request "Do you want to proceed anyway?" || exit 1
452	  let ++ret
453	fi
454      fi
455
456      # Never returns empty if NT or above
457      run_service_as=$(csih_service_should_run_as)
458
459      if [ "${run_service_as}" = "${csih_PRIVILEGED_USERNAME}" ]
460      then
461	password="${csih_PRIVILEGED_PASSWORD}"
462	if [ -z "${password}" ]
463	then
464	  csih_get_value "Please enter the password for user '${run_service_as}':" "-s"
465	  password="${csih_value}"
466	fi
467      fi
468
469      # At this point, we either have $run_service_as = "system" and
470      # $password is empty, or $run_service_as is some privileged user and
471      # (hopefully) $password contains the correct password.  So, from here
472      # out, we use '-z "${password}"' to discriminate the two cases.
473
474      csih_check_user "${run_service_as}"
475
476      if [ -n "${csih_cygenv}" ]
477      then
478	cygwin_env=( -e "CYGWIN=${csih_cygenv}" )
479      fi
480      if [ -z "${password}" ]
481      then
482	if /usr/bin/cygrunsrv -I sshd -d "CYGWIN sshd" -p /usr/sbin/sshd \
483			      -a "-D" -y tcpip "${cygwin_env[@]}"
484	then
485	  echo
486	  csih_inform "The sshd service has been installed under the LocalSystem"
487	  csih_inform "account (also known as SYSTEM). To start the service now, call"
488	  csih_inform "\`net start sshd' or \`cygrunsrv -S sshd'.  Otherwise, it"
489	  csih_inform "will start automatically after the next reboot."
490	fi
491      else
492	if /usr/bin/cygrunsrv -I sshd -d "CYGWIN sshd" -p /usr/sbin/sshd \
493			      -a "-D" -y tcpip "${cygwin_env[@]}" \
494			      -u "${run_service_as}" -w "${password}"
495	then
496	  /usr/bin/editrights -u "${run_service_as}" -a SeServiceLogonRight
497	  echo
498	  csih_inform "The sshd service has been installed under the '${run_service_as}'"
499	  csih_inform "account.  To start the service now, call \`net start sshd' or"
500	  csih_inform "\`cygrunsrv -S sshd'.  Otherwise, it will start automatically"
501	  csih_inform "after the next reboot."
502	fi
503      fi
504
505      if /usr/bin/cygrunsrv -Q sshd >/dev/null 2>&1
506      then
507	check_service_files_ownership "${run_service_as}" || let ret+=$?
508      else
509	csih_error_recoverable "Installing sshd as a service failed!"
510	let ++ret
511      fi
512    fi # user allowed us to install as service
513  fi # service not yet installed
514  return $ret
515} # --- End of install_service --- #
516
517# ======================================================================
518# Main Entry Point
519# ======================================================================
520
521# Check how the script has been started.  If
522#   (1) it has been started by giving the full path and
523#       that path is /etc/postinstall, OR
524#   (2) Otherwise, if the environment variable
525#       SSH_HOST_CONFIG_AUTO_ANSWER_NO is set
526# then set auto_answer to "no".  This allows automatic
527# creation of the config files in /etc w/o overwriting
528# them if they already exist.  In both cases, color
529# escape sequences are suppressed, so as to prevent
530# cluttering setup's logfiles.
531if [ "$PROGDIR" = "/etc/postinstall" ]
532then
533  csih_auto_answer="no"
534  csih_disable_color
535  opt_force=yes
536fi
537if [ -n "${SSH_HOST_CONFIG_AUTO_ANSWER_NO}" ]
538then
539  csih_auto_answer="no"
540  csih_disable_color
541  opt_force=yes
542fi
543
544# ======================================================================
545# Parse options
546# ======================================================================
547while :
548do
549  case $# in
550  0)
551    break
552    ;;
553  esac
554
555  option=$1
556  shift
557
558  case "${option}" in
559  -d | --debug )
560    set -x
561    csih_trace_on
562    ;;
563
564  -y | --yes )
565    csih_auto_answer=yes
566    opt_force=yes
567    ;;
568
569  -n | --no )
570    csih_auto_answer=no
571    opt_force=yes
572    ;;
573
574  -c | --cygwin )
575    cygwin_value="$1"
576    shift
577    ;;
578
579  -p | --port )
580    port_number=$1
581    shift
582    ;;
583
584  -u | --user )
585    user_account="$1"
586    shift
587    ;;
588    
589  -w | --pwd )
590    password_value="$1"
591    shift
592    ;;
593
594  --privileged )
595    csih_FORCE_PRIVILEGED_USER=yes
596    ;;
597
598  *)
599    echo "usage: ${progname} [OPTION]..."
600    echo
601    echo "This script creates an OpenSSH host configuration."
602    echo
603    echo "Options:"
604    echo "  --debug  -d            Enable shell's debug output."
605    echo "  --yes    -y            Answer all questions with \"yes\" automatically."
606    echo "  --no     -n            Answer all questions with \"no\" automatically."
607    echo "  --cygwin -c <options>  Use \"options\" as value for CYGWIN environment var."
608    echo "  --port   -p <n>        sshd listens on port n."
609    echo "  --user   -u <account>  privileged user for service."
610    echo "  --pwd    -w <passwd>   Use \"pwd\" as password for privileged user."
611    echo "  --privileged           On Windows NT/2k/XP, require privileged user"
612    echo "                         instead of LocalSystem for sshd service."
613    echo
614    exit 1
615    ;;
616
617  esac
618done
619
620# ======================================================================
621# Action!
622# ======================================================================
623
624# Check for running ssh/sshd processes first. Refuse to do anything while
625# some ssh processes are still running
626if /usr/bin/ps -ef | /usr/bin/grep -q '/sshd\?$'
627then
628  echo
629  csih_error "There are still ssh processes running. Please shut them down first."
630fi
631
632# Make sure the user is running in an administrative context
633admin=$(/usr/bin/id -G | /usr/bin/grep -Eq '\<544\>' && echo yes || echo no)
634if [ "${admin}" != "yes" ]
635then
636  echo
637  csih_warning "Running this script typically requires administrator privileges!"
638  csih_warning "However, it seems your account does not have these privileges."
639  csih_warning "Here's the list of groups in your user token:"
640  echo
641  for i in $(/usr/bin/id -G)
642  do
643    /usr/bin/awk -F: "/[^:]*:[^:]*:$i:/{ print \"    \" \$1; }" /etc/group
644  done
645  echo
646  csih_warning "This usually means you're running this script from a non-admin"
647  csih_warning "desktop session, or in a non-elevated shell under UAC control."
648  echo
649  csih_warning "Make sure you have the appropriate privileges right now,"
650  csih_warning "otherwise parts of this script will probably fail!"
651  echo
652  echo -e "${_csih_QUERY_STR} Are you sure you want to continue?  (Say \"no\" if you're not sure"
653  if ! csih_request "you have the required privileges)"
654  then
655    echo
656    csih_inform "Ok.  Exiting.  Make sure to switch to an administrative account"
657    csih_inform "or to start this script from an elevated shell."
658    exit 1
659  fi
660fi
661
662echo
663
664warning_cnt=0
665
666# Check for ${SYSCONFDIR} directory
667csih_make_dir "${SYSCONFDIR}" "Cannot create global configuration files."
668if ! /usr/bin/chmod 775 "${SYSCONFDIR}" >/dev/null 2>&1
669then
670  csih_warning "Can't set permissions on ${SYSCONFDIR}!"
671  let ++warning_cnt
672fi
673if ! /usr/bin/setfacl -m u:system:rwx "${SYSCONFDIR}" >/dev/null 2>&1
674then
675  csih_warning "Can't set extended permissions on ${SYSCONFDIR}!"
676  let ++warning_cnt
677fi
678
679# Check for /var/log directory
680csih_make_dir "${LOCALSTATEDIR}/log" "Cannot create log directory."
681if ! /usr/bin/chmod 775 "${LOCALSTATEDIR}/log" >/dev/null 2>&1
682then
683  csih_warning "Can't set permissions on ${LOCALSTATEDIR}/log!"
684  let ++warning_cnt
685fi
686if ! /usr/bin/setfacl -m u:system:rwx "${LOCALSTATEDIR}/log" >/dev/null 2>&1
687then
688  csih_warning "Can't set extended permissions on ${LOCALSTATEDIR}/log!"
689  let ++warning_cnt
690fi
691
692# Create /var/log/lastlog if not already exists
693if [ -e ${LOCALSTATEDIR}/log/lastlog -a ! -f ${LOCALSTATEDIR}/log/lastlog ]
694then
695  echo
696  csih_error_multi "${LOCALSTATEDIR}/log/lastlog exists, but is not a file." \
697		   "Cannot create ssh host configuration."
698fi
699if [ ! -e ${LOCALSTATEDIR}/log/lastlog ]
700then
701  /usr/bin/cat /dev/null > ${LOCALSTATEDIR}/log/lastlog
702  if ! /usr/bin/chmod 644 ${LOCALSTATEDIR}/log/lastlog >/dev/null 2>&1
703  then
704    csih_warning "Can't set permissions on ${LOCALSTATEDIR}/log/lastlog!"
705    let ++warning_cnt
706  fi
707fi
708
709# Create /var/empty file used as chroot jail for privilege separation
710csih_make_dir "${LOCALSTATEDIR}/empty" "Cannot create ${LOCALSTATEDIR}/empty directory."
711if ! /usr/bin/chmod 755 "${LOCALSTATEDIR}/empty" >/dev/null 2>&1
712then
713  csih_warning "Can't set permissions on ${LOCALSTATEDIR}/empty!"
714  let ++warning_cnt
715fi
716if ! /usr/bin/setfacl -m u:system:rwx "${LOCALSTATEDIR}/empty" >/dev/null 2>&1
717then
718  csih_warning "Can't set extended permissions on ${LOCALSTATEDIR}/empty!"
719  let ++warning_cnt
720fi
721
722# host keys
723create_host_keys || let warning_cnt+=$?
724
725# handle ssh_config
726csih_install_config "${SYSCONFDIR}/ssh_config" "${SYSCONFDIR}/defaults" || let ++warning_cnt
727if /usr/bin/cmp "${SYSCONFDIR}/ssh_config" "${SYSCONFDIR}/defaults/${SYSCONFDIR}/ssh_config" >/dev/null 2>&1
728then
729  if [ "${port_number}" != "22" ]
730  then
731    csih_inform "Updating ${SYSCONFDIR}/ssh_config file with requested port"
732    echo "Host localhost" >> ${SYSCONFDIR}/ssh_config
733    echo "    Port ${port_number}" >> ${SYSCONFDIR}/ssh_config
734  fi
735fi
736
737# handle sshd_config (and privsep)
738csih_install_config "${SYSCONFDIR}/sshd_config" "${SYSCONFDIR}/defaults" || let ++warning_cnt
739if ! /usr/bin/cmp "${SYSCONFDIR}/sshd_config" "${SYSCONFDIR}/defaults/${SYSCONFDIR}/sshd_config" >/dev/null 2>&1
740then
741  /usr/bin/grep -q UsePrivilegeSeparation ${SYSCONFDIR}/sshd_config && privsep_configured=yes
742fi
743sshd_privsep || let warning_cnt+=$?
744
745update_services_file || let warning_cnt+=$?
746update_inetd_conf || let warning_cnt+=$?
747install_service || let warning_cnt+=$?
748
749echo
750if [ $warning_cnt -eq 0 ]
751then
752  csih_inform "Host configuration finished. Have fun!"
753else
754  csih_warning "Host configuration exited with ${warning_cnt} errors or warnings!"
755  csih_warning "Make sure that all problems reported are fixed,"
756  csih_warning "then re-run ssh-host-config."
757fi
758exit $warning_cnt
759