dropbear: debian/dropbear.postinst annotate

annotate debian/dropbear.postinst @ 994:5c5ade336926

Prefer stronger algorithms in algorithm negotiation. Prefer diffie-hellman-group14-sha1 (2048 bit) over diffie-hellman-group1-sha1 (1024 bit). Due to meet-in-the-middle attacks the effective key length of three key 3DES is 112 bits. AES is stronger and faster then 3DES. Prefer to delay the start of compression until after authentication has completed. This avoids exposing compression code to attacks from unauthenticated users. (github pull request #9)

author	Fedor Brunner <fedor.brunner@azet.sk>
date	Fri, 23 Jan 2015 23:00:25 +0800
parents	7fc4ba3c1cbb
children

rev	line source
70 b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	1 #!/bin/sh
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	2 set -e
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	3
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	4 test "$1" = 'configure' \|\| exit 0
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	5
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	6 if test ! -e /etc/dropbear/dropbear_rsa_host_key; then
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	7 if test -f /etc/ssh/ssh_host_rsa_key; then
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	8 echo "Converting existing OpenSSH RSA host key to Dropbear format."
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	9 /usr/lib/dropbear/dropbearconvert openssh dropbear \
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	10 /etc/ssh/ssh_host_rsa_key /etc/dropbear/dropbear_rsa_host_key
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	11 else
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	12 echo "Generating Dropbear RSA key. Please wait."
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	13 dropbearkey -t rsa -f /etc/dropbear/dropbear_rsa_host_key
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	14 fi
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	15 fi
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	16 if test ! -e /etc/dropbear/dropbear_dss_host_key; then
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	17 if test -f /etc/ssh/ssh_host_dsa_key; then
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	18 echo "Converting existing OpenSSH RSA host key to Dropbear format."
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	19 /usr/lib/dropbear/dropbearconvert openssh dropbear \
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	20 /etc/ssh/ssh_host_dsa_key /etc/dropbear/dropbear_dss_host_key
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	21 else
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	22 echo "Generating Dropbear DSS key. Please wait."
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	23 dropbearkey -t dss -f /etc/dropbear/dropbear_dss_host_key
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	24 fi
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	25 fi
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	26 if test ! -s /etc/default/dropbear; then
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	27 # check whether OpenSSH seems to be installed.
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	28 if test -x /usr/sbin/sshd; then
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	29 cat <<EOT
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	30 OpenSSH appears to be installed. Setting /etc/default/dropbear so that
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	31 Dropbear will not start by default. Edit this file to change this behaviour.
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	32
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	33 EOT
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	34 cat >>/etc/default/dropbear <<EOT
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	35 # disabled because OpenSSH is installed
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	36 # change to NO_START=0 to enable Dropbear
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	37 NO_START=1
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	38
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	39 EOT
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	40 fi
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	41 cat >>/etc/default/dropbear <<EOT
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	42 # the TCP port that Dropbear listens on
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	43 DROPBEAR_PORT=22
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	44
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	45 # any additional arguments for Dropbear
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	46 DROPBEAR_EXTRA_ARGS=
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	47
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	48 # specify an optional banner file containing a message to be
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	49 # sent to clients before they connect, such as "/etc/issue.net"
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	50 DROPBEAR_BANNER=""
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	51
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	52 # RSA hostkey file (default: /etc/dropbear/dropbear_rsa_host_key)
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	53 #DROPBEAR_RSAKEY="/etc/dropbear/dropbear_rsa_host_key"
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	54
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	55 # DSS hostkey file (default: /etc/dropbear/dropbear_dss_host_key)
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	56 #DROPBEAR_DSSKEY="/etc/dropbear/dropbear_dss_host_key"
450 c23c7f0f594c Use the -W <windowsize> argument in startup scripts, with a default of 64kB Matt Johnston <matt@ucc.asn.au> parents: 219 diff changeset	57
c23c7f0f594c Use the -W <windowsize> argument in startup scripts, with a default of 64kB Matt Johnston <matt@ucc.asn.au> parents: 219 diff changeset	58 # Receive window size - this is a tradeoff between memory and
c23c7f0f594c Use the -W <windowsize> argument in startup scripts, with a default of 64kB Matt Johnston <matt@ucc.asn.au> parents: 219 diff changeset	59 # network performance
c23c7f0f594c Use the -W <windowsize> argument in startup scripts, with a default of 64kB Matt Johnston <matt@ucc.asn.au> parents: 219 diff changeset	60 DROPBEAR_RECEIVE_WINDOW=65536
70 b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	61 EOT
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	62 fi
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	63
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	64 if test -x /etc/init.d/dropbear; then
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	65 update-rc.d dropbear defaults >/dev/null
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	66 if test -x /usr/sbin/invoke-rc.d; then
218 3ee0c2f85e1e * patch up to date with debian 0.45-3 diff Matt Johnston <matt@ucc.asn.au> parents: 70 diff changeset	67 invoke-rc.d dropbear restart
70 b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	68 else
218 3ee0c2f85e1e * patch up to date with debian 0.45-3 diff Matt Johnston <matt@ucc.asn.au> parents: 70 diff changeset	69 /etc/init.d/dropbear restart
70 b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	70 fi
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: diff changeset	71 fi
469 8c2d2edadf2a Update to debian 0.50-4 diff Matt Johnston <matt@ucc.asn.au> parents: 450 diff changeset	72
8c2d2edadf2a Update to debian 0.50-4 diff Matt Johnston <matt@ucc.asn.au> parents: 450 diff changeset	73 if test -n "$2" && dpkg --compare-versions "$2" lt '0.50-4' &&
516 7fc4ba3c1cbb - Bump to 0.52 Matt Johnston <matt@ucc.asn.au> parents: 469 diff changeset	74 update-service --check dropbear 2>/dev/null; then
469 8c2d2edadf2a Update to debian 0.50-4 diff Matt Johnston <matt@ucc.asn.au> parents: 450 diff changeset	75 update-service --remove /etc/dropbear 2>/dev/null \|\| :
8c2d2edadf2a Update to debian 0.50-4 diff Matt Johnston <matt@ucc.asn.au> parents: 450 diff changeset	76 sleep 6
8c2d2edadf2a Update to debian 0.50-4 diff Matt Johnston <matt@ucc.asn.au> parents: 450 diff changeset	77 rm -rf /var/run/dropbear /var/run/dropbear.log
8c2d2edadf2a Update to debian 0.50-4 diff Matt Johnston <matt@ucc.asn.au> parents: 450 diff changeset	78 update-service --add /etc/dropbear \|\| :
8c2d2edadf2a Update to debian 0.50-4 diff Matt Johnston <matt@ucc.asn.au> parents: 450 diff changeset	79 fi

Mercurial > dropbear

annotate debian/dropbear.postinst @ 994:5c5ade336926