mirror of
https://github.com/lucaspalomodevelop/core.git
synced 2026-03-16 01:24:38 +00:00
955b73fdd7
It only makes debugging harder as our translations are being completed one after the other. Also has the positive side- effect of freeing a few hard-to-do translations in the process.
152 lines
4.7 KiB
PHP
Executable File
152 lines
4.7 KiB
PHP
Executable File
#!/usr/local/bin/php
|
|
<?php
|
|
|
|
/*
|
|
Copyright (C) 2004 Scott K Ullrich
|
|
Copyright (C) 2004 Fred Mol <fredmol@xs4all.nl>.
|
|
Copyright (C) 2015 Franco Fichtner <franco@opnsense.org>
|
|
All rights reserved.
|
|
|
|
Redistribution and use in source and binary forms, with or without
|
|
modification, are permitted provided that the following conditions are met:
|
|
|
|
1. Redistributions of source code must retain the above copyright notice,
|
|
this list of conditions and the following disclaimer.
|
|
|
|
2. Redistributions in binary form must reproduce the above copyright
|
|
notice, this list of conditions and the following disclaimer in the
|
|
documentation and/or other materials provided with the distribution.
|
|
|
|
THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
|
|
INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
|
|
AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
|
|
AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
|
|
OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
|
|
SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
|
|
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
|
|
CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
|
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
|
POSSIBILITY OF SUCH DAMAGE.
|
|
*/
|
|
|
|
require_once('config.inc');
|
|
require_once("util.inc");
|
|
|
|
$bin_ssh_keygen = '/usr/local/bin/ssh-keygen';
|
|
$sbin_sshd = '/usr/local/sbin/sshd';
|
|
$etc_ssh = '/usr/local/etc/ssh';
|
|
|
|
/* if run from a shell session, `-af' and the full path is needed */
|
|
mwexecf('/bin/pkill -af %s', $sbin_sshd);
|
|
|
|
if (!isset($config['system']['ssh']['enabled'])) {
|
|
return;
|
|
}
|
|
|
|
/* reinstall the backup if it is available */
|
|
if (file_exists('/conf/sshd/ssh_host_rsa_key') && !file_exists("{$etc_ssh}/ssh_host_rsa_key")) {
|
|
mwexec("/bin/cp -p /conf/sshd/* {$etc_ssh}/");
|
|
}
|
|
|
|
$keys = array(
|
|
/* .pub files are implied */
|
|
'rsa' => 'ssh_host_rsa_key',
|
|
'dsa' => 'ssh_host_dsa_key',
|
|
'ecdsa' => 'ssh_host_ecdsa_key',
|
|
'ed25519' => 'ssh_host_ed25519_key',
|
|
);
|
|
|
|
foreach($keys as $name) {
|
|
$file = "{$etc_ssh}/etc/ssh/{$name}";
|
|
if (file_exists($file) && filesize($file) == 0) {
|
|
unlink($file);
|
|
}
|
|
$file = "{$file}.pub";
|
|
if (file_exists($file) && filesize($file) == 0) {
|
|
unlink($file);
|
|
}
|
|
}
|
|
|
|
/* make ssh home directory */
|
|
@mkdir("/var/empty", 0555, true);
|
|
|
|
/* Login related files. */
|
|
touch("/var/log/lastlog");
|
|
|
|
if (isset($config['system']['ssh']['port'])) {
|
|
$sshport = $config['system']['ssh']['port'];
|
|
} else {
|
|
$sshport = 22;
|
|
}
|
|
|
|
/*
|
|
* XXX ZOMG sshd_config BOOTSTRAPPING ACTION
|
|
*
|
|
* We can't just ditch the system file by default and roll
|
|
* our own. Instead, use the current file to find the actual
|
|
* settings that need toggling, then toggle them!
|
|
*/
|
|
|
|
/* Include default configuration for OPNsense */
|
|
$sshconf = "# This file was automatically generated by /usr/local/etc/rc.sshd\n";
|
|
$sshconf .= "Port {$sshport}\n";
|
|
$sshconf .= "Protocol 2\n";
|
|
/* XXX a couple of those need moar cleanups: */
|
|
$sshconf .= "Compression yes\n";
|
|
$sshconf .= "ClientAliveInterval 30\n";
|
|
$sshconf .= "UseDNS no\n";
|
|
$sshconf .= "X11Forwarding no\n";
|
|
$sshconf .= "PubkeyAuthentication yes\n";
|
|
$sshconf .= "Subsystem\tsftp\tinternal-sftp\n";
|
|
if (isset($config['system']['ssh']['permitrootlogin'])) {
|
|
$sshconf .= "PermitRootLogin yes\n";
|
|
}
|
|
if (isset($config['system']['ssh']['passwordauth'])) {
|
|
$sshconf .= "ChallengeResponseAuthentication yes\n";
|
|
$sshconf .= "PasswordAuthentication yes\n";
|
|
} else {
|
|
$sshconf .= "ChallengeResponseAuthentication no\n";
|
|
$sshconf .= "PasswordAuthentication no\n";
|
|
}
|
|
|
|
/* Write the new sshd config file */
|
|
file_put_contents("{$etc_ssh}/sshd_config", $sshconf);
|
|
|
|
/* are we already running? if so exit */
|
|
if (is_subsystem_dirty('sshdkeys')) {
|
|
return;
|
|
}
|
|
|
|
// Check for all needed key files. If any are missing, the keys need to be regenerated.
|
|
$generate_keys = false;
|
|
foreach ($keys as $name) {
|
|
$file = "{$etc_ssh}/{$name}";
|
|
if (!file_exists($file) || !file_exists("{$file}.pub")) {
|
|
$generate_keys = true;
|
|
break;
|
|
}
|
|
}
|
|
|
|
if ($generate_keys) {
|
|
log_error('Started creating your SSH keys. SSH startup is being delayed a wee bit.');
|
|
mark_subsystem_dirty('sshdkeys');
|
|
mwexec("/bin/rm -f {$etc_ssh}/ssh_host_*");
|
|
foreach ($keys as $type => $name) {
|
|
mwexec(sprintf('%s -t %s -N "" -f %s/%s', $bin_ssh_keygen, $type, $etc_ssh, $name));
|
|
}
|
|
clear_subsystem_dirty('sshdkeys');
|
|
log_error('Completed creating your SSH keys. SSH will now be started.');
|
|
}
|
|
|
|
/* Launch new server process */
|
|
echo "Reloading sshd...";
|
|
if (mwexecf('/usr/bin/protect -i %s', $sbin_sshd)) {
|
|
echo "failed.\n";
|
|
} else {
|
|
echo "done.\n";
|
|
}
|
|
|
|
/* back up files in case they are useful ;) */
|
|
@mkdir('/conf/sshd', 0777, true);
|
|
mwexec("/bin/cp -p ${etc_ssh}/ssh_host_* /conf/sshd/");
|