# Init script for the SSH daemon
# Revised tburt 11-07-2001

# SSH now offers two versions. Version 1 has been suspected of having a remote vulnerability
# and is being phased out, in favor of Version 2.  We will support both.

# The SSH daemon first needs a host key.  It is OK to regenerate a new host key with every boot
# but if you are using an openssh client with "strict hostkey checking" (enabled by default)
# then you will be forced to manually remove the old key from your "known_hosts" file after each
# Trinux reboot.

# The solution is to generate the host keys once, and then restore them each time you reboot.
# The host keys can be located on the boot floppy, on the CD-ROM, or via an http server of 
# your choice.  Since the private key is part of this package, the http server is a poor choice.
# It is best to save the generated keys with the updated save-sshkeys command, although
# several Legacy methods are also supported.
# Note that CD-ROM users will want to copy the -.tgz files to /trinux/tux/config/ 

# Since Trinux has no password file, we must use key pairs to facilitate logins.
# We will support two complimentary methods for installing authorized keys.
# First is the "tarfile stored on disk" method.  Second is the http key server.
# Because only public keys are required here, it is OK to use the http key server.

# The openssh package is a pre-requisite, because it contains the much needed ssh-keygen

if ps | grep sshd > /dev/null
then
	echo "Stopping sshd"
	killall -9 sshd
fi


if [ ! -r /etc/init.d/openssh ]
then
  echo "** Missing required package"
  echo "** Please install openssh first"
  exit 1
fi

# First make sure we have folders ready to accept our files.
if [ ! -d /.ssh ]
then
  mkdir /.ssh 2> /dev/null
fi

if [ ! -d /usr/local/etc ]
then
  mkdir -p /usr/local/etc 2> /dev/null
fi

# Create the (required) config file.  Empty is OK for our purposes.
touch /usr/local/etc/sshd_config

# Kill off old daemons, in case this is a re-initialization
ps | grep sshd > /dev/null
if [ $? != 0 ]
then
	echo '-- Terminating existing ssh sessions'
	killall sshd 2> /dev/null
fi

# Install host keys from gzip file or create new ones.
if [ -f /usr/local/etc/ssh_host_key ]
then
	echo '-- Found existing ssh host keys'
else
  if [ -r /etc/tux/pkg/opensshd/sshhost.tgz ]
  then
	cd /
	tar xzf /etc/tux/pkg/opensshd/sshhost.tgz
        echo "Host keys installed"
  elif [ -r /etc/sshhost.tgz ]
  then
	# Legacy support for old config
	cd /
	tar xzf /etc/sshhost.tgz
        echo "Legacy Host keys installed"
        echo "Please adjust your config and run save-sshkeys again"
  else
	cd /usr/local/etc/
	echo '-- Generating public/private keypair(s) for this host'
	echo
	/usr/local/bin/ssh-keygen -b 1024 -f ssh_host_key -N "" 2> /tmp/rsakeytrace
	/usr/local/bin/ssh-keygen -d -f ssh_host_dsa_key -N "" 2> /tmp/dsakeytrace
	echo
	echo '*** Be sure to run save-sshkeys so they will get copied to the '
	echo '*** boot floppy, otherwise new keys to be generated each time.'
	echo
  fi
fi


### These were moved to to the openssh init script

##if [ -r /etc/tux/pkg/opensshd/sshroot.tgz ]
##then
## cd /
##  tar xzf /etc/tux/pkg/opensshd/sshroot.tgz
## echo "Root keys installed"
##elif [ -r /etc/sshroot.tgz ]
##then
  # Legacy support for old config
 ##cd /
  ##tar xzf /etc/sshroot.tgz
  ##echo "Legacy Root keys installed"
  ##echo "Please adjust your config and run save-sshkeys again"
##fi

# Now we want to see if a keyserver has authorized keys for us.
# Add these keys to what is already there.

if [ -f /etc/tux/pkg/opensshd/kserver ]
then
	KEYSERVER=`cat /etc/tux/pkg/opensshd/kserver` 
	echo "-- Retrieving SSH1 authorized_keys from $KEYSERVER"
	cd /.ssh
	snarf $KEYSERVER - >> authorized_keys
	if [ $? != 0 ]
	then
	  echo "Failed to retrieve SSH1 keys from keyserver"
	fi
	cd /
fi

if [ -f /etc/tux/pkg/opensshd/kserver2 ]
then
	KEYSERVER=`cat /etc/tux/pkg/opensshd/kserver2` 
	echo "-- Retrieving SSH2 authorized_keys from $KEYSERVER"
	cd /.ssh
	snarf $KEYSERVER - >> authorized_keys2
	if [ $? != 0 ]
	then
	  echo "Failed to retrieve SSH2 keys from keyserver"
	fi
	cd /
fi

# Another Legacy to be supported...
if [ -r /etc/tux/pkg/opensshd/keys ]
then
  cat /etc/tux/pkg/opensshd/keys >> /.ssh/authorized_keys 2> /dev/null
  cat /etc/tux/pkg/opensshd/keys2 >> /.ssh/authorized_keys2 2> /dev/null
fi

# Confirm required permissions on some files

[ -d /.ssh ]                  && chmod 755 /.ssh
[ -d /.ssh/authorized_keys ]  && chmod 744 /.ssh/authorized_keys
[ -d /.ssh/authorized_keys2 ] && chmod 744 /.ssh/authorized_keys2

echo '-- Starting sshd'
sleep 1
/usr/local/sbin/sshd 
sleep 1

cd /
