Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sources.redhat.com/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sources.redhat.com/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com
Date: Thu, 30 Oct 2003 18:10:56 +0100
From: Corinna Vinschen <corinna-cygwin AT cygwin DOT com>
To: cygwin AT cygwin DOT com
Subject: Testers for new ssh-*-config scripts wanted!
Message-ID: <20031030171056.GB5249@cygbert.vinschen.de>
Reply-To: cygwin AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="UlVJffcvxoiEqYs2"
Content-Disposition: inline
User-Agent: Mutt/1.4.1i

--UlVJffcvxoiEqYs2
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

Hi,

is anybody here willing to give my new ssh-host-config and ssh-user-config
shell scripts a thorough test?  I tested them by myself but I have this
nagging feeling I missed something important.

The important changes:

- On NT, try to set permissions on files and directories to a useful value.
- On NT, try to set ownership on files and directories to a useful value.

Only in ssh-host-config:

- Write the /etc/services entries for ssh now with CRLF lineendings.
- Remove the code to accomplish old style installations, with "old
  being older than roughly 3 years.
- /etc/ssh_config and /etc/sshd_config are not hardcoded here-scripts
  in the ssh-host-config script anymore, but they are copied and
  modified from ssh_config and sshd_config files in /etc/defaults/etc.
  This allows to accomodate changes in the vanilla scripts without
  having to change the shh-host-config script.
- On NT, always set ownership of various files to SYSTEM, if sshd
  has been installed as service.

Both scripts are attached.  When testing the new "copy config files
from /etc/defaults/etc" functionality, please think of copying the
ssh_config and sshd_config files (if possible the vanilla versions)
to /etc/defaults/etc first.

Feedback and patches welcome and thanks in advance,
Corinna

-- 
Corinna Vinschen                  Please, send mails regarding Cygwin to
Cygwin Developer                                mailto:cygwin AT cygwin DOT com
Red Hat, Inc.

--UlVJffcvxoiEqYs2
Content-Type: text/plain; charset=us-ascii
Content-Disposition: attachment; filename=ssh-host-config

#!/bin/sh
#
# ssh-host-config, Copyright 2000, 2001, 2002, 2003 Red Hat Inc.
#
# This file is part of the Cygwin port of OpenSSH.

# Subdirectory where the new package is being installed
PREFIX=/usr

# Directory where the config files are stored
SYSCONFDIR=/etc
LOCALSTATEDIR=/var

progname=$0
auto_answer=""
port_number=22

privsep_configured=no
privsep_used=yes
sshd_in_passwd=no
sshd_in_sam=no

request()
{
  if [ "${auto_answer}" = "yes" ]
  then
    return 0
  elif [ "${auto_answer}" = "no" ]
  then
    return 1
  fi

  answer=""
  while [ "X${answer}" != "Xyes" -a "X${answer}" != "Xno" ]
  do
    echo -n "$1 (yes/no) "
    read answer
  done
  if [ "X${answer}" = "Xyes" ]
  then
    return 0
  else
    return 1
  fi
}

# Check options

while :
do
  case $# in
  0)
    break
    ;;
  esac

  option=$1
  shift

  case "$option" in
  -d | --debug )
    set -x
    ;;

  -y | --yes )
    auto_answer=yes
    ;;

  -n | --no )
    auto_answer=no
    ;;

  -p | --port )
    port_number=$1
    shift
    ;;

  *)
    echo "usage: ${progname} [OPTION]..."
    echo
    echo "This script creates an OpenSSH host configuration."
    echo
    echo "Options:"
    echo "    --debug  -d     Enable shell's debug output."
    echo "    --yes    -y     Answer all questions with \"yes\" automatically."
    echo "    --no     -n     Answer all questions with \"no\" automatically."
    echo "    --port   -p <n> sshd listens on port n."
    echo
    exit 1
    ;;

  esac
done

# Check if running on NT
_sys="`uname -a`"
_nt=`expr "$_sys" : "CYGWIN_NT"`

# Check for running ssh/sshd processes first. Refuse to do anything while
# some ssh processes are still running

if ps -ef | grep -v grep | grep -q ssh
then
  echo
  echo "There are still ssh processes running. Please shut them down first."
  echo
  exit 1
fi

# Check for ${SYSCONFDIR} directory

if [ -e "${SYSCONFDIR}" -a ! -d "${SYSCONFDIR}" ]
then
  echo
  echo "${SYSCONFDIR} is existant but not a directory."
  echo "Cannot create global configuration files."
  echo
  exit 1
fi

# Create it if necessary

if [ ! -e "${SYSCONFDIR}" ]
then
  mkdir "${SYSCONFDIR}"
  if [ ! -e "${SYSCONFDIR}" ]
  then
    echo
    echo "Creating ${SYSCONFDIR} directory failed"
    echo
    exit 1
  fi
fi

# Create /var/log and /var/log/lastlog if not already existing

if [ -f ${LOCALSTATEDIR}/log ]
then
  echo "Creating ${LOCALSTATEDIR}/log failed\!"
else
  if [ ! -d ${LOCALSTATEDIR}/log ]
  then
    mkdir -p ${LOCALSTATEDIR}/log
  fi
  if [ -d ${LOCALSTATEDIR}/log/lastlog ]
  then
    echo "Creating ${LOCALSTATEDIR}/log/lastlog failed\!"
  elif [ ! -f ${LOCALSTATEDIR}/log/lastlog ]
  then
    cat /dev/null > ${LOCALSTATEDIR}/log/lastlog
    chmod 666 ${LOCALSTATEDIR}/log/lastlog
  fi
fi

# Create /var/empty file used as chroot jail for privilege separation
if [ -f ${LOCALSTATEDIR}/empty ]
then
  echo "Creating ${LOCALSTATEDIR}/empty failed\!"
else
  mkdir -p ${LOCALSTATEDIR}/empty
  if [ $_nt -gt 0 ]
  then
    chmod 755 ${LOCALSTATEDIR}/empty
  fi
fi

# First generate host keys if not already existing

if [ ! -f "${SYSCONFDIR}/ssh_host_key" ]
then
  echo "Generating ${SYSCONFDIR}/ssh_host_key"
  ssh-keygen -t rsa1 -f ${SYSCONFDIR}/ssh_host_key -N '' > /dev/null
fi

if [ ! -f "${SYSCONFDIR}/ssh_host_rsa_key" ]
then
  echo "Generating ${SYSCONFDIR}/ssh_host_rsa_key"
  ssh-keygen -t rsa -f ${SYSCONFDIR}/ssh_host_rsa_key -N '' > /dev/null
fi

if [ ! -f "${SYSCONFDIR}/ssh_host_dsa_key" ]
then
  echo "Generating ${SYSCONFDIR}/ssh_host_dsa_key"
  ssh-keygen -t dsa -f ${SYSCONFDIR}/ssh_host_dsa_key -N '' > /dev/null
fi

# Check if ssh_config exists. If yes, ask for overwriting

if [ -f "${SYSCONFDIR}/ssh_config" ]
then
  if request "Overwrite existing ${SYSCONFDIR}/ssh_config file?"
  then
    rm -f "${SYSCONFDIR}/ssh_config"
    if [ -f "${SYSCONFDIR}/ssh_config" ]
    then
      echo "Can't overwrite. ${SYSCONFDIR}/ssh_config is write protected."
    fi
  fi
fi

# Create default ssh_config from skeleton file in /etc/defaults/etc

if [ ! -f "${SYSCONFDIR}/ssh_config" ]
then
  echo "Generating ${SYSCONFDIR}/ssh_config file"
  cp ${SYSCONFDIR}/defaults/etc/ssh_config ${SYSCONFDIR}/ssh_config
  if [ "$port_number" != "22" ]
  then
    echo "Host localhost" >> ${SYSCONFDIR}/ssh_config
    echo "    Port $port_number" >> ${SYSCONFDIR}/ssh_config
  fi
fi

# Check if sshd_config exists. If yes, ask for overwriting

if [ -f "${SYSCONFDIR}/sshd_config" ]
then
  if request "Overwrite existing ${SYSCONFDIR}/sshd_config file?"
  then
    rm -f "${SYSCONFDIR}/sshd_config"
    if [ -f "${SYSCONFDIR}/sshd_config" ]
    then
      echo "Can't overwrite. ${SYSCONFDIR}/sshd_config is write protected."
    fi
  else
    grep -q UsePrivilegeSeparation ${SYSCONFDIR}/sshd_config && privsep_configured=yes
  fi
fi

# Prior to creating or modifying sshd_config, care for privilege separation

if [ "$privsep_configured" != "yes" ]
then
  if [ $_nt -gt 0 ]
  then
    echo "Privilege separation is set to yes by default since OpenSSH 3.3."
    echo "However, this requires a non-privileged account called 'sshd'."
    echo "For more info on privilege separation read /usr/doc/openssh/README.privsep."
    echo
    if request "Shall privilege separation be used?"
    then
      privsep_used=yes
      grep -q '^sshd:' ${SYSCONFDIR}/passwd && sshd_in_passwd=yes
      net user sshd >/dev/null 2>&1 && sshd_in_sam=yes
      if [ "$sshd_in_passwd" != "yes" ]
      then
        if [ "$sshd_in_sam" != "yes" ]
	then
	  echo "Warning: The following function requires administrator privileges!"
	  if request "Shall this script create a local user 'sshd' on this machine?"
	  then
	    dos_var_empty=`cygpath -w ${LOCALSTATEDIR}/empty`
	    net user sshd /add /fullname:"sshd privsep" "/homedir:$dos_var_empty" /active:no > /dev/null 2>&1 && sshd_in_sam=yes
	    if [ "$sshd_in_sam" != "yes" ]
	    then
	      echo "Warning: Creating the user 'sshd' failed!"
	    fi
	  fi
	fi
	if [ "$sshd_in_sam" != "yes" ]
	then
	  echo "Warning: Can't create user 'sshd' in ${SYSCONFDIR}/passwd!"
	  echo "         Privilege separation set to 'no' again!"
	  echo "         Check your ${SYSCONFDIR}/sshd_config file!"
	  privsep_used=no
	else
	  mkpasswd -l -u sshd | sed -e 's/bash$/false/' >> ${SYSCONFDIR}/passwd
	fi
      fi
    else
      privsep_used=no
    fi
  else
    # On 9x don't use privilege separation.  Since security isn't
    # available it just adds useless additional processes.
    privsep_used=no
  fi
fi

# Create default sshd_config from skeleton files in /etc/defaults/etc or
# modify to add the missing privsep configuration option

if [ ! -f "${SYSCONFDIR}/sshd_config" ]
then
  echo "Generating ${SYSCONFDIR}/sshd_config file"
  sed -e "s/^#UsePrivilegeSeparation yes/UsePrivilegeSeparation $privsep_used/
	  s/^#Port 22/Port $port_number/
	  s/^#StrictModes yes/StrictModes no/" \
      < ${SYSCONFDIR}/defaults/etc/sshd_config \
      > ${SYSCONFDIR}/sshd_config
elif [ "$privsep_configured" != "yes" ]
then
  echo >> ${SYSCONFDIR}/sshd_config
  echo "UsePrivilegeSeparation $privsep_used" >> ${SYSCONFDIR}/sshd_config
fi

# Care for services file
_my_etcdir="/ssh-host-config.$$"
if [ $_nt -gt 0 ]
then
  _win_etcdir="${SYSTEMROOT}\\system32\\drivers\\etc"
  _services="${_my_etcdir}/services"
else
  _win_etcdir="${WINDIR}"
  _services="${_my_etcdir}/SERVICES"
fi
_serv_tmp="${_my_etcdir}/srv.out.$$"

mount -t -f "${_win_etcdir}" "${_my_etcdir}"

# Depends on the above mount
_wservices=`cygpath -w "${_services}"`

# Remove sshd 22/port from services
if [ `grep -q 'sshd[ \t][ \t]*22' "${_services}"; echo $?` -eq 0 ]
then
  grep -v 'sshd[ \t][ \t]*22' "${_services}" > "${_serv_tmp}"
  if [ -f "${_serv_tmp}" ]
  then 
    if mv "${_serv_tmp}" "${_services}"
    then
      echo "Removing sshd from ${_wservices}"
    else
      echo "Removing sshd from ${_wservices} failed\!"
    fi 
    rm -f "${_serv_tmp}"
  else
    echo "Removing sshd from ${_wservices} failed\!"
  fi
fi

# Add ssh 22/tcp  and ssh 22/udp to services
if [ `grep -q 'ssh[ \t][ \t]*22' "${_services}"; echo $?` -ne 0 ]
then
  awk '{ if ( $2 ~ /^23\/tcp/ ) print "ssh                22/tcp                           #SSH Remote Login Protocol\nssh                22/udp                           #SSH Remote Login Protocol"; print $0; }' < "${_services}" > "${_serv_tmp}"
  if [ -f "${_serv_tmp}" ]
  then
    if mv "${_serv_tmp}" "${_services}"
    then
      echo "Added ssh to ${_wservices}"
    else
      echo "Adding ssh to ${_wservices} failed\!"
    fi
    rm -f "${_serv_tmp}"
  else
    echo "Adding ssh to ${_wservices} failed\!"
  fi
fi

umount "${_my_etcdir}"

# Care for inetd.conf file
_inetcnf="${SYSCONFDIR}/inetd.conf"
_inetcnf_tmp="${SYSCONFDIR}/inetd.conf.$$"

if [ -f "${_inetcnf}" ]
then
  # Check if ssh service is already in use as sshd
  with_comment=1
  grep -q '^[ \t]*sshd' "${_inetcnf}" && with_comment=0
  # Remove sshd line from inetd.conf
  if [ `grep -q '^[# \t]*sshd' "${_inetcnf}"; echo $?` -eq 0 ]
  then
    grep -v '^[# \t]*sshd' "${_inetcnf}" >> "${_inetcnf_tmp}"
    if [ -f "${_inetcnf_tmp}" ]
    then
      if mv "${_inetcnf_tmp}" "${_inetcnf}"
      then
        echo "Removed sshd from ${_inetcnf}"
      else
        echo "Removing sshd from ${_inetcnf} failed\!"
      fi
      rm -f "${_inetcnf_tmp}"
    else
      echo "Removing sshd from ${_inetcnf} failed\!"
    fi
  fi

  # Add ssh line to inetd.conf
  if [ `grep -q '^[# \t]*ssh' "${_inetcnf}"; echo $?` -ne 0 ]
  then
    if [ "${with_comment}" -eq 0 ]
    then
      echo 'ssh  stream  tcp     nowait  root    /usr/sbin/sshd sshd -i' >> "${_inetcnf}"
    else
      echo '# ssh  stream  tcp     nowait  root    /usr/sbin/sshd sshd -i' >> "${_inetcnf}"
    fi
    echo "Added ssh to ${_inetcnf}"
  fi
fi

# On NT ask if sshd should be installed as service
if [ $_nt -gt 0 ]
then
  echo
  echo "Do you want to install sshd as service?"
  if request "(Say \"no\" if it's already installed as service)"
  then
    echo
    echo "Which value should the environment variable CYGWIN have when"
    echo "sshd starts? It's recommended to set at least \"ntsec\" to be"
    echo "able to change user context without password."
    echo -n "Default is \"ntsec\".  CYGWIN="
    read _cygwin
    [ -z "${_cygwin}" ] && _cygwin="ntsec"
    if cygrunsrv -I sshd -d "CYGWIN sshd" -p /usr/sbin/sshd -a -D -e "CYGWIN=${_cygwin}"
    then
      echo
      echo "The service has been installed under LocalSystem account."
    fi
  fi
  # Now check if sshd has been installed as service.  This allows to
  # set the ownership of the affected files correctly.
  #
  # NOTE: This doesn't work flawlessly so far on Windows 2003 Server.
  # The SYSTEM account on 2003 has not the appropriate privileges to allow 
  # passwordless logon (pubkey authentication).  This requires to run the
  # service under a special account, which has administrator privileges
  # plus (at least, AFAIK) the SeCreateTokenPrivilege.
  # The next step will be, to extend this script to create an approriate
  # account for that, using the new editrights tool.
  if cygrunsrv -Q sshd > /dev/null 2>&1
  then
    chown system ${SYSCONFDIR}/ssh*
    chown system.system ${LOCALSTATEDIR}/empty
    if [ -f ${LOCALSTATEDIR}/log/sshd.log ]
    then
      chown system.system ${LOCALSTATEDIR}/log/sshd.log
    fi
  fi
fi

echo
echo "Host configuration finished. Have fun!"

--UlVJffcvxoiEqYs2
Content-Type: text/plain; charset=us-ascii
Content-Disposition: attachment; filename=ssh-user-config

#!/bin/sh
#
# ssh-user-config, Copyright 2000, 2001, 2002, 2003, Red Hat Inc.
#
# This file is part of the Cygwin port of OpenSSH.

progname=$0
auto_answer=""
auto_passphrase="no"
passphrase=""

request()
{
  if [ "${auto_answer}" = "yes" ]
  then
    return 0
  elif [ "${auto_answer}" = "no" ]
  then
    return 1
  fi

  answer=""
  while [ "X${answer}" != "Xyes" -a "X${answer}" != "Xno" ]
  do
    echo -n "$1 (yes/no) "
    read answer
  done
  if [ "X${answer}" = "Xyes" ]
  then
    return 0
  else
    return 1
  fi
}

# Check if running on NT
_sys="`uname -a`"
_nt=`expr "$_sys" : "CYGWIN_NT"`

# Check options

while :
do
  case $# in
  0)
    break
    ;;
  esac

  option=$1
  shift

  case "$option" in
  -d | --debug )
    set -x
    ;;

  -y | --yes )
    auto_answer=yes
    ;;

  -n | --no )
    auto_answer=no
    ;;

  -p | --passphrase )
    with_passphrase="yes"
    passphrase=$1
    shift
    ;;

  *)
    echo "usage: ${progname} [OPTION]..."
    echo
    echo "This script creates an OpenSSH user configuration."
    echo
    echo "Options:"
    echo "    --debug      -d        Enable shell's debug output."
    echo "    --yes        -y        Answer all questions with \"yes\" automatically."
    echo "    --no         -n        Answer all questions with \"no\" automatically."
    echo "    --passphrase -p word   Use \"word\" as passphrase automatically."
    echo
    exit 1
    ;;

  esac
done

# Ask user if user identity should be generated

if [ ! -f /etc/passwd ]
then
  echo '/etc/passwd is nonexistant. Please generate an /etc/passwd file'
  echo 'first using mkpasswd. Check if it contains an entry for you and'
  echo 'please care for the home directory in your entry as well.'
  exit 1
fi

uid=`id -u`
pwdhome=`awk -F: '{ if ( $3 == '${uid}' ) print $6; }' < /etc/passwd`

if [ "X${pwdhome}" = "X" ]
then
  echo 'There is no home directory set for you in /etc/passwd.'
  echo 'Setting $HOME is not sufficient!'
  exit 1
fi

if [ ! -d "${pwdhome}" ]
then
  echo "${pwdhome} is set in /etc/passwd as your home directory"
  echo 'but it is not a valid directory. Cannot create user identity files.'
  exit 1
fi

# If home is the root dir, set home to empty string to avoid error messages
# in subsequent parts of that script.
if [ "X${pwdhome}" = "X/" ]
then
  # But first raise a warning!
  echo 'Your home directory in /etc/passwd is set to root (/). This is not recommended!'
  if request "Would you like to proceed anyway?"
  then
    pwdhome=''
  else
    exit 1
  fi
fi

if [ -d "${pwdhome}" -a $_nt -gt 0 -a -n "`chmod -c g-w,o-w "${pwdhome}"`" ]
then
  echo
  echo 'WARNING: group and other have been revoked write permission to your home'
  echo "         directory ${pwdhome}."
  echo '         This is required by OpenSSH to allow public key authentication using'
  echo '         the key files stored in your .ssh subdirectory.'
  echo '         Revert this change ONLY if you know what you are doing!'
  echo
fi

if [ -e "${pwdhome}/.ssh" -a ! -d "${pwdhome}/.ssh" ]
then
  echo "${pwdhome}/.ssh is existant but not a directory. Cannot create user identity files."
  exit 1
fi

if [ ! -e "${pwdhome}/.ssh" ]
then
  mkdir "${pwdhome}/.ssh"
  if [ ! -e "${pwdhome}/.ssh" ]
  then
    echo "Creating users ${pwdhome}/.ssh directory failed"
    exit 1
  fi
fi

if [ $_nt -gt 0 ]
then
  if ! setfacl -m 'u::rwx,u:system:r--,g::---,o::---' "${pwdhome}/.ssh"
  then
    echo "${pwdhome}/.ssh couldn't be given the correct permissions."
    echo "Please try to solve this problem first."
    exit 1
  fi
fi

if [ ! -f "${pwdhome}/.ssh/identity" ]
then
  if request "Shall I create an SSH1 RSA identity file for you?"
  then
    echo "Generating ${pwdhome}/.ssh/identity"
    if [ "${with_passphrase}" = "yes" ]
    then
      ssh-keygen -t rsa1 -N "${passphrase}" -f "${pwdhome}/.ssh/identity" > /dev/null
    else
      ssh-keygen -t rsa1 -f "${pwdhome}/.ssh/identity" > /dev/null
    fi
    if request "Do you want to use this identity to login to this machine?"
    then
      echo "Adding to ${pwdhome}/.ssh/authorized_keys"
      cat "${pwdhome}/.ssh/identity.pub" >> "${pwdhome}/.ssh/authorized_keys"
    fi
  fi
fi

if [ ! -f "${pwdhome}/.ssh/id_rsa" ]
then
  if request "Shall I create an SSH2 RSA identity file for you? (yes/no) "
  then
    echo "Generating ${pwdhome}/.ssh/id_rsa"
    if [ "${with_passphrase}" = "yes" ]
    then
      ssh-keygen -t rsa -N "${passphrase}" -f "${pwdhome}/.ssh/id_rsa" > /dev/null
    else
      ssh-keygen -t rsa -f "${pwdhome}/.ssh/id_rsa" > /dev/null
    fi
    if request "Do you want to use this identity to login to this machine?"
    then
      echo "Adding to ${pwdhome}/.ssh/authorized_keys"
      cat "${pwdhome}/.ssh/id_rsa.pub" >> "${pwdhome}/.ssh/authorized_keys"
    fi
  fi
fi

if [ ! -f "${pwdhome}/.ssh/id_dsa" ]
then
  if request "Shall I create an SSH2 DSA identity file for you? (yes/no) "
  then
    echo "Generating ${pwdhome}/.ssh/id_dsa"
    if [ "${with_passphrase}" = "yes" ]
    then
      ssh-keygen -t dsa -N "${passphrase}" -f "${pwdhome}/.ssh/id_dsa" > /dev/null
    else
      ssh-keygen -t dsa -f "${pwdhome}/.ssh/id_dsa" > /dev/null
    fi
    if request "Do you want to use this identity to login to this machine?"
    then
      echo "Adding to ${pwdhome}/.ssh/authorized_keys"
      cat "${pwdhome}/.ssh/id_dsa.pub" >> "${pwdhome}/.ssh/authorized_keys"
    fi
  fi
fi

if [ $_nt -gt 0 -a -e "${pwdhome}/.ssh/authorized_keys" ]
then
  chmod u-x,g-wx,o-wx "${pwdhome}/.ssh/authorized_keys"
fi

echo
echo "Configuration finished. Have fun!"


--UlVJffcvxoiEqYs2
Content-Type: text/plain; charset=us-ascii

--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Problem reports:       http://cygwin.com/problems.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/
--UlVJffcvxoiEqYs2--