YunoHost/yunohost
1
0
Fork 0
mirror of https://github.com/YunoHost/yunohost.git synced 2024-09-03 20:06:10 +02:00
Code Issues Projects Releases Packages Wiki Activity

Use templating for more robustness about which SSH keys are enabled

Browse source
This commit is contained in:
Alexandre Aubin 2018-11-28 00:26:25 +01:00
parent 23893c43b3
commit fad4ff090a
2 changed files with 9 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
data/hooks/conf_regen/03-ssh
View file

@ -2,6 +2,8 @@
set -e set -e
. /usr/share/yunohost/helpers.d/utils
do_pre_regen() { do_pre_regen() {
pending_dir=$1 pending_dir=$1
@ -14,11 +16,13 @@ do_pre_regen() {
|| sed -i "s/ListenAddress ::/#ListenAddress ::/g" sshd_config || sed -i "s/ListenAddress ::/#ListenAddress ::/g" sshd_config
# Support legacy setting (this setting might be disabled by a user during a migration) # Support legacy setting (this setting might be disabled by a user during a migration)
ssh_keys=$(ls /etc/ssh/ssh_host_{rsa,ecdsa,ed25519}_key 2>/dev/null)
if [[ "$(yunohost settings get 'service.ssh.allow_deprecated_dsa_hostkey')" == "True" ]]; then if [[ "$(yunohost settings get 'service.ssh.allow_deprecated_dsa_hostkey')" == "True" ]]; then
sed -i '/HostKey \/etc\/ssh\/ssh_host_rsa_key/a HostKey /etc/ssh/ssh_host_dsa_key' sshd_config ssh_keys="$ssh_keys $(ls /etc/ssh/ssh_host_dsa_key 2>/dev/null)"
fi fi
install -D -m 644 sshd_config "${pending_dir}/etc/ssh/sshd_config" export $ssh_keys
ynh_render_template "sshd_config" "${pending_dir}/etc/ssh/sshd_config"
fi fi
} }

6
data/templates/ssh/sshd_config
View file

@ -8,9 +8,9 @@ ListenAddress ::
ListenAddress 0.0.0.0 ListenAddress 0.0.0.0
Protocol 2 Protocol 2
# HostKeys for protocol version 2 # HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key {% for key in ssh_keys %}
HostKey /etc/ssh/ssh_host_ecdsa_key HostKey {{ key }}
HostKey /etc/ssh/ssh_host_ed25519_key {% endfor %}
#Privilege Separation is turned on for security #Privilege Separation is turned on for security
UsePrivilegeSeparation yes UsePrivilegeSeparation yes