Mercurial > dropbear
annotate debian/dropbear.init @ 1861:2b3a8026a6ce
Add re-exec for server
This allows ASLR to re-randomize the address
space for every connection, preventing some
vulnerabilities from being exploitable by
repeated probing.
Overhead (memory and time) is yet to be confirmed.
At present this is only enabled on Linux. Other BSD platforms
with fexecve() would probably also work though have not been tested.
| author | Matt Johnston <matt@ucc.asn.au> |
|---|---|
| date | Sun, 30 Jan 2022 10:14:56 +0800 |
| parents | 4ca2872c7d9e |
| children |
| rev | line source |
|---|---|
|
70
b0316ce64e4b
Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
4
diff
changeset
|
1 #!/bin/sh |
|
469
8c2d2edadf2a
Update to debian 0.50-4 diff
Matt Johnston <matt@ucc.asn.au>
parents:
451
diff
changeset
|
2 ### BEGIN INIT INFO |
|
8c2d2edadf2a
Update to debian 0.50-4 diff
Matt Johnston <matt@ucc.asn.au>
parents:
451
diff
changeset
|
3 # Provides: dropbear |
|
8c2d2edadf2a
Update to debian 0.50-4 diff
Matt Johnston <matt@ucc.asn.au>
parents:
451
diff
changeset
|
4 # Required-Start: $remote_fs $syslog |
|
8c2d2edadf2a
Update to debian 0.50-4 diff
Matt Johnston <matt@ucc.asn.au>
parents:
451
diff
changeset
|
5 # Required-Stop: $remote_fs $syslog |
|
8c2d2edadf2a
Update to debian 0.50-4 diff
Matt Johnston <matt@ucc.asn.au>
parents:
451
diff
changeset
|
6 # Default-Start: 2 3 4 5 |
|
8c2d2edadf2a
Update to debian 0.50-4 diff
Matt Johnston <matt@ucc.asn.au>
parents:
451
diff
changeset
|
7 # Default-Stop: 0 1 6 |
|
1222
4ca2872c7d9e
Added missing init info field to debian init script.
Nick Steel <kingosticks@gmail.com>
parents:
469
diff
changeset
|
8 # Short-Description: Dropbear SSH server |
|
469
8c2d2edadf2a
Update to debian 0.50-4 diff
Matt Johnston <matt@ucc.asn.au>
parents:
451
diff
changeset
|
9 ### END INIT INFO |
|
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
10 # |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
11 # Do not configure this file. Edit /etc/default/dropbear instead! |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
12 # |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
13 |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
14 PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
15 DAEMON=/usr/sbin/dropbear |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
16 NAME=dropbear |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
17 DESC="Dropbear SSH server" |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
18 |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
19 DROPBEAR_PORT=22 |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
20 DROPBEAR_EXTRA_ARGS= |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
21 NO_START=0 |
|
70
b0316ce64e4b
Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
4
diff
changeset
|
22 |
|
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
23 set -e |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
24 |
|
218
3ee0c2f85e1e
* patch up to date with debian 0.45-3 diff
Matt Johnston <matt@ucc.asn.au>
parents:
70
diff
changeset
|
25 cancel() { echo "$1" >&2; exit 0; }; |
|
70
b0316ce64e4b
Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
4
diff
changeset
|
26 test ! -r /etc/default/dropbear || . /etc/default/dropbear |
|
218
3ee0c2f85e1e
* patch up to date with debian 0.45-3 diff
Matt Johnston <matt@ucc.asn.au>
parents:
70
diff
changeset
|
27 test -x "$DAEMON" || cancel "$DAEMON does not exist or is not executable." |
|
469
8c2d2edadf2a
Update to debian 0.50-4 diff
Matt Johnston <matt@ucc.asn.au>
parents:
451
diff
changeset
|
28 test ! -x /usr/sbin/update-service || ! update-service --check dropbear || |
|
8c2d2edadf2a
Update to debian 0.50-4 diff
Matt Johnston <matt@ucc.asn.au>
parents:
451
diff
changeset
|
29 cancel 'The dropbear service is controlled through runit, use the sv(8) program' |
|
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
30 |
|
70
b0316ce64e4b
Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
4
diff
changeset
|
31 test -z "$DROPBEAR_BANNER" || \ |
|
b0316ce64e4b
Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
4
diff
changeset
|
32 DROPBEAR_EXTRA_ARGS="$DROPBEAR_EXTRA_ARGS -b $DROPBEAR_BANNER" |
|
b0316ce64e4b
Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
4
diff
changeset
|
33 test -n "$DROPBEAR_RSAKEY" || \ |
|
b0316ce64e4b
Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
4
diff
changeset
|
34 DROPBEAR_RSAKEY="/etc/dropbear/dropbear_rsa_host_key" |
|
b0316ce64e4b
Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
4
diff
changeset
|
35 test -n "$DROPBEAR_DSSKEY" || \ |
|
b0316ce64e4b
Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
4
diff
changeset
|
36 DROPBEAR_DSSKEY="/etc/dropbear/dropbear_dss_host_key" |
|
451
f2aa5aeea619
Add default argument for receive window
Matt Johnston <matt@ucc.asn.au>
parents:
450
diff
changeset
|
37 test -n "$DROPBEAR_RECEIVE_WINDOW" || \ |
|
f2aa5aeea619
Add default argument for receive window
Matt Johnston <matt@ucc.asn.au>
parents:
450
diff
changeset
|
38 DROPBEAR_RECEIVE_WINDOW="65536" |
|
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
39 |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
40 case "$1" in |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
41 start) |
| 263 | 42 test "$NO_START" = "0" || cancel 'NO_START is not set to zero.' |
|
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
43 echo -n "Starting $DESC: " |
|
70
b0316ce64e4b
Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
4
diff
changeset
|
44 start-stop-daemon --start --quiet --pidfile /var/run/"$NAME".pid \ |
|
b0316ce64e4b
Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
4
diff
changeset
|
45 --exec "$DAEMON" -- -d "$DROPBEAR_DSSKEY" -r "$DROPBEAR_RSAKEY" \ |
|
451
f2aa5aeea619
Add default argument for receive window
Matt Johnston <matt@ucc.asn.au>
parents:
450
diff
changeset
|
46 -p "$DROPBEAR_PORT" -W "$DROPBEAR_RECEIVE_WINDOW" $DROPBEAR_EXTRA_ARGS |
|
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
47 echo "$NAME." |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
48 ;; |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
49 stop) |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
50 echo -n "Stopping $DESC: " |
|
70
b0316ce64e4b
Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
4
diff
changeset
|
51 start-stop-daemon --stop --quiet --oknodo --pidfile /var/run/"$NAME".pid |
|
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
52 echo "$NAME." |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
53 ;; |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
54 restart|force-reload) |
| 263 | 55 test "$NO_START" = "0" || cancel 'NO_START is not set to zero.' |
|
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
56 echo -n "Restarting $DESC: " |
|
70
b0316ce64e4b
Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
4
diff
changeset
|
57 start-stop-daemon --stop --quiet --oknodo --pidfile /var/run/"$NAME".pid |
|
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
58 sleep 1 |
|
70
b0316ce64e4b
Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
4
diff
changeset
|
59 start-stop-daemon --start --quiet --pidfile /var/run/"$NAME".pid \ |
|
b0316ce64e4b
Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
4
diff
changeset
|
60 --exec "$DAEMON" -- -d "$DROPBEAR_DSSKEY" -r "$DROPBEAR_RSAKEY" \ |
|
450
c23c7f0f594c
Use the -W <windowsize> argument in startup scripts, with a default of 64kB
Matt Johnston <matt@ucc.asn.au>
parents:
263
diff
changeset
|
61 -p "$DROPBEAR_PORT" -W "$DROPBEAR_RECEIVE_WINDOW" $DROPBEAR_EXTRA_ARGS |
|
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
62 echo "$NAME." |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
63 ;; |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
64 *) |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
65 N=/etc/init.d/$NAME |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
66 echo "Usage: $N {start|stop|restart|force-reload}" >&2 |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
67 exit 1 |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
68 ;; |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
69 esac |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
70 |
|
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
71 exit 0 |