Mercurial > dropbear

annotate debian/dropbear.postinst @ 1715:3974f087d9c0

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Disallow leading lines before the ident for server (#102) Per RFC4253 4.2 clients must be able to process other lines of data before the version string, server behavior is not defined neither with MUST/SHOULD nor with MAY. If server process up to 50 lines too - it may cause too long hanging session with invalid/evil client that consume host resources and potentially may lead to DDoS on poor embedded boxes. Let's require first line from client to be version string and fail early if it's not - matches both RFC and real OpenSSH behavior.
author Vladislav Grishenko <themiron@users.noreply.github.com>
date Mon, 15 Jun 2020 18:22:18 +0500
parents 7fc4ba3c1cbb
children
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
70
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
1 #!/bin/sh
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
2 set -e
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
3
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
4 test "$1" = 'configure' || exit 0
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
5
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
6 if test ! -e /etc/dropbear/dropbear_rsa_host_key; then
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
7 if test -f /etc/ssh/ssh_host_rsa_key; then
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
8 echo "Converting existing OpenSSH RSA host key to Dropbear format."
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
9 /usr/lib/dropbear/dropbearconvert openssh dropbear \
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
10 /etc/ssh/ssh_host_rsa_key /etc/dropbear/dropbear_rsa_host_key
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
11 else
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
12 echo "Generating Dropbear RSA key. Please wait."
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
13 dropbearkey -t rsa -f /etc/dropbear/dropbear_rsa_host_key
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
14 fi
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
15 fi
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
16 if test ! -e /etc/dropbear/dropbear_dss_host_key; then
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
17 if test -f /etc/ssh/ssh_host_dsa_key; then
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
18 echo "Converting existing OpenSSH RSA host key to Dropbear format."
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
19 /usr/lib/dropbear/dropbearconvert openssh dropbear \
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
20 /etc/ssh/ssh_host_dsa_key /etc/dropbear/dropbear_dss_host_key
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
21 else
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
22 echo "Generating Dropbear DSS key. Please wait."
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
23 dropbearkey -t dss -f /etc/dropbear/dropbear_dss_host_key
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
24 fi
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
25 fi
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
26 if test ! -s /etc/default/dropbear; then
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
27 # check whether OpenSSH seems to be installed.
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
28 if test -x /usr/sbin/sshd; then
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
29 cat <<EOT
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
30 OpenSSH appears to be installed. Setting /etc/default/dropbear so that
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
31 Dropbear will not start by default. Edit this file to change this behaviour.
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
32
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
33 EOT
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
34 cat >>/etc/default/dropbear <<EOT
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
35 # disabled because OpenSSH is installed
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
36 # change to NO_START=0 to enable Dropbear
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
37 NO_START=1
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
38
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
39 EOT
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
40 fi
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
41 cat >>/etc/default/dropbear <<EOT
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
42 # the TCP port that Dropbear listens on
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
43 DROPBEAR_PORT=22
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
44
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
45 # any additional arguments for Dropbear
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
46 DROPBEAR_EXTRA_ARGS=
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
47
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
48 # specify an optional banner file containing a message to be
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
49 # sent to clients before they connect, such as "/etc/issue.net"
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
50 DROPBEAR_BANNER=""
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
51
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
52 # RSA hostkey file (default: /etc/dropbear/dropbear_rsa_host_key)
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
53 #DROPBEAR_RSAKEY="/etc/dropbear/dropbear_rsa_host_key"
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
54
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
55 # DSS hostkey file (default: /etc/dropbear/dropbear_dss_host_key)
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
56 #DROPBEAR_DSSKEY="/etc/dropbear/dropbear_dss_host_key"
450
c23c7f0f594c Use the -W <windowsize> argument in startup scripts, with a default of 64kB
Matt Johnston <matt@ucc.asn.au>
parents: 219
diff changeset
57
c23c7f0f594c Use the -W <windowsize> argument in startup scripts, with a default of 64kB
Matt Johnston <matt@ucc.asn.au>
parents: 219
diff changeset
58 # Receive window size - this is a tradeoff between memory and
c23c7f0f594c Use the -W <windowsize> argument in startup scripts, with a default of 64kB
Matt Johnston <matt@ucc.asn.au>
parents: 219
diff changeset
59 # network performance
c23c7f0f594c Use the -W <windowsize> argument in startup scripts, with a default of 64kB
Matt Johnston <matt@ucc.asn.au>
parents: 219
diff changeset
60 DROPBEAR_RECEIVE_WINDOW=65536
70
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
61 EOT
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
62 fi
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
63
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
64 if test -x /etc/init.d/dropbear; then
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
65 update-rc.d dropbear defaults >/dev/null
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
66 if test -x /usr/sbin/invoke-rc.d; then
218
3ee0c2f85e1e * patch up to date with debian 0.45-3 diff
Matt Johnston <matt@ucc.asn.au>
parents: 70
diff changeset
67 invoke-rc.d dropbear restart
70
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
68 else
218
3ee0c2f85e1e * patch up to date with debian 0.45-3 diff
Matt Johnston <matt@ucc.asn.au>
parents: 70
diff changeset
69 /etc/init.d/dropbear restart
70
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
70 fi
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
71 fi
469
8c2d2edadf2a Update to debian 0.50-4 diff
Matt Johnston <matt@ucc.asn.au>
parents: 450
diff changeset
72
8c2d2edadf2a Update to debian 0.50-4 diff
Matt Johnston <matt@ucc.asn.au>
parents: 450
diff changeset
73 if test -n "$2" && dpkg --compare-versions "$2" lt '0.50-4' &&
516
7fc4ba3c1cbb - Bump to 0.52
Matt Johnston <matt@ucc.asn.au>
parents: 469
diff changeset
74 update-service --check dropbear 2>/dev/null; then
469
8c2d2edadf2a Update to debian 0.50-4 diff
Matt Johnston <matt@ucc.asn.au>
parents: 450
diff changeset
75 update-service --remove /etc/dropbear 2>/dev/null || :
8c2d2edadf2a Update to debian 0.50-4 diff
Matt Johnston <matt@ucc.asn.au>
parents: 450
diff changeset
76 sleep 6
8c2d2edadf2a Update to debian 0.50-4 diff
Matt Johnston <matt@ucc.asn.au>
parents: 450
diff changeset
77 rm -rf /var/run/dropbear /var/run/dropbear.log
8c2d2edadf2a Update to debian 0.50-4 diff
Matt Johnston <matt@ucc.asn.au>
parents: 450
diff changeset
78 update-service --add /etc/dropbear || :
8c2d2edadf2a Update to debian 0.50-4 diff
Matt Johnston <matt@ucc.asn.au>
parents: 450
diff changeset
79 fi