etc - zygaena/hammerhead

root / base / usr / src / cmd / ssh / etc
etc Plain Text 435 lines 10.4 KB
#
# CDDL HEADER START
#
# The contents of this file are subject to the terms of the
# Common Development and Distribution License (the "License").
# You may not use this file except in compliance with the License.
#
# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
# or http://www.opensolaris.org/os/licensing.
# See the License for the specific language governing permissions
# and limitations under the License.
#
# When distributing Covered Code, include this CDDL HEADER in each
# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
# If applicable, add the following below this CDDL HEADER, with the
# fields enclosed by brackets "[]" replaced with your own identifying
# information: Portions Copyright [yyyy] [name of copyright owner]
#
# CDDL HEADER END
#
# Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
# Use is subject to license terms.
#
# Copyright (c) 2018, Joyent, Inc.

MANIFEST = ssh.xml
SVCMETHOD = sshd

include ../../Makefile.cmd

ETCSSHDIR=	$(ROOTETC)/ssh
DIRS=		$(ETCSSHDIR)

FILES= sshd_config ssh_config

ETCSSHFILES=	$(FILES:%=$(ETCSSHDIR)/%)

$(ETCSSHFILES) : FILEMODE=	644

ROOTMANIFESTDIR = $(ROOTSVCNETWORK)

$(ETCSSHDIR)/% : %
	$(INS.file)

$(DIRS):
	$(INS.dir)

$(POFILE):

SMOFF += signed

all lint clean clobber _msg:

install: all $(DIRS) $(ETCSSHFILES) $(ROOTMANIFEST) $(ROOTSVCMETHOD)

check: $(CHKMANIFEST)

include ../../Makefile.targ
<?xml version="1.0"?>
<!DOCTYPE service_bundle SYSTEM "/usr/share/lib/xml/dtd/service_bundle.dtd.1">
<!--
	CDDL HEADER START

	The contents of this file are subject to the terms of the
	Common Development and Distribution License (the "License").
	You may not use this file except in compliance with the License.

	You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	or http://www.opensolaris.org/os/licensing.
	See the License for the specific language governing permissions
	and limitations under the License.

	When distributing Covered Code, include this CDDL HEADER in each
	file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	If applicable, add the following below this CDDL HEADER, with the
	fields enclosed by brackets "[]" replaced with your own identifying
	information: Portions Copyright [yyyy] [name of copyright owner]

	CDDL HEADER END

	Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
	Use is subject to license terms.

	Copyright 2016 Hans Rosenfeld <rosenfeld@grumpf.hope-2000.org>

	NOTE:  This service manifest is not editable; its contents will
	be overwritten by package or patch operations, including
	operating system upgrade.  Make customizations in a different
	file.
-->

<service_bundle type='manifest' name='SUNWsshdr:ssh'>

<service
	name='network/ssh'
	type='service'
	version='1'>

	<create_default_instance enabled='false' />

	<single_instance />

	<dependency name='fs-local'
		grouping='require_all'
		restart_on='none'
		type='service'>
		<service_fmri
			value='svc:/system/filesystem/local' />
	</dependency>

	<dependency name='fs-autofs'
		grouping='optional_all'
		restart_on='none'
		type='service'>
		<service_fmri value='svc:/system/filesystem/autofs' />
	</dependency>

	<dependency name='net-loopback'
		grouping='require_all'
		restart_on='none'
		type='service'>
		<service_fmri value='svc:/network/loopback' />
	</dependency>

	<dependency name='net-physical'
		grouping='require_all'
		restart_on='none'
		type='service'>
		<service_fmri value='svc:/network/physical' />
	</dependency>

	<dependency name='cryptosvc'
		grouping='require_all'
		restart_on='none'
		type='service'>
		<service_fmri value='svc:/system/cryptosvc' />
	</dependency>

	<dependency name='utmp'
		grouping='require_all'
		restart_on='none'
		type='service'>
		<service_fmri value='svc:/system/utmp' />
	</dependency>

	<dependency name='network_ipfilter'
		grouping='optional_all'
		restart_on='error'
		type='service'>
		<service_fmri value='svc:/network/ipfilter:default' />
	</dependency>

	<dependency name='config_data'
		grouping='require_all'
		restart_on='restart'
		type='path'>
		<service_fmri
		    value='file://localhost/etc/ssh/sshd_config' />
	</dependency>

	<dependent
		name='ssh_multi-user-server'
		grouping='optional_all'
		restart_on='none'>
			<service_fmri
			    value='svc:/milestone/multi-user-server' />
	</dependent>

	<exec_method
		type='method'
		name='start'
		exec='/lib/svc/method/sshd start'
		timeout_seconds='60'/>

	<exec_method
		type='method'
		name='stop'
		exec=':kill'
		timeout_seconds='60' />

	<exec_method
		type='method'
		name='refresh'
		exec='/lib/svc/method/sshd restart'
		timeout_seconds='60' />

	<property_group name='startd'
		type='framework'>
		<!-- sub-process core dumps shouldn't restart session -->
		<propval name='ignore_error'
		    type='astring' value='core,signal' />
	</property_group>

        <property_group name='general' type='framework'>
                <!-- to start stop sshd -->
                <propval name='action_authorization' type='astring'
                        value='solaris.smf.manage.ssh' />
        </property_group>

	<property_group name='firewall_context' type='com.sun,fw_definition'>
		<propval name='name' type='astring' value='ssh' />
		<propval name='ipf_method' type='astring'
		    value='/lib/svc/method/sshd ipfilter' />
	</property_group>

	<property_group name='firewall_config' type='com.sun,fw_configuration'>
		<propval name='policy' type='astring' value='use_global' />
		<propval name='block_policy' type='astring'
			value='use_global' />
		<propval name='apply_to' type='astring' value='' />
		<propval name='apply_to_6' type='astring' value='' />
		<propval name='exceptions' type='astring' value='' />
		<propval name='exceptions_6' type='astring' value='' />
		<propval name='target' type='astring' value='' />
		<propval name='target_6' type='astring' value='' />
		<propval name='value_authorization' type='astring'
			value='solaris.smf.value.firewall.config' />
	</property_group>

	<stability value='Unstable' />

	<template>
		<common_name>
			<loctext xml:lang='C'>
			SSH server
			</loctext>
		</common_name>
		<documentation>
			<manpage title='sshd' section='8' manpath='/usr/share/man' />
		</documentation>
	</template>

</service>

</service_bundle>
# Copyright (c) 2001 by Sun Microsystems, Inc.
# All rights reserved.
#
# ident	"%Z%%M%	%I%	%E% SMI"
#
# This file provides defaults for ssh(1).
# The values can be changed in per-user configuration files $HOME/.ssh/config
# or on the command line of ssh(1).

# Configuration data is parsed as follows:
#  1. command line options
#  2. user-specific file
#  3. system-wide file /etc/ssh/ssh_config
#
# Any configuration value is only changed the first time it is set.
# host-specific definitions should be at the beginning of the
# configuration file, and defaults at the end.

# Example (matches compiled in defaults):
#
# Host *
#   ForwardAgent no
#   ForwardX11 no
#   PubkeyAuthentication yes
#   PasswordAuthentication yes
#   FallBackToRsh no
#   UseRsh no
#   BatchMode no
#   CheckHostIP yes
#   StrictHostKeyChecking ask
#   EscapeChar ~
#!/sbin/sh
#
# Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
# Use is subject to license terms.
#
# Copyright 2016 Hans Rosenfeld <rosenfeld@grumpf.hope-2000.org>
#

. /lib/svc/share/ipf_include.sh
. /lib/svc/share/smf_include.sh

SSHDIR=/etc/ssh
KEYGEN="/usr/bin/ssh-keygen -q"
PIDFILE=/var/run/sshd.pid

# Checks to see if RSA, and DSA host keys are available
# if any of these keys are not present, the respective keys are created.
create_key()
{
	keypath=$1
	keytype=$2

	if [ ! -f $keypath ]; then
		# 
		# HostKey keywords in sshd_config may be preceded or
		# followed by a mix of any number of space or tabs,
		# and optionally have an = between keyword and
		# argument.  We use two grep invocations such that we
		# can match HostKey case insensitively but still have
		# the case of the path name be significant, keeping
		# the pattern somewhat more readable.
		#
		# The character classes below contain one literal
		# space and one literal tab.
		#
		grep -i "^[ 	]*HostKey[ 	]*=\{0,1\}[ 	]*$keypath" \
		    $SSHDIR/sshd_config | grep "$keypath" > /dev/null 2>&1

		if [ $? -eq 0 ]; then
			echo Creating new $keytype public/private host key pair
			$KEYGEN -f $keypath -t $keytype -N ''
			if [ $? -ne 0 ]; then
				echo "Could not create $keytype key: $keypath"
				exit $SMF_EXIT_ERR_CONFIG
			fi
		fi
	fi
}

create_ipf_rules()
{
	FMRI=$1
	ipf_file=`fmri_to_file ${FMRI} $IPF_SUFFIX`
	ipf6_file=`fmri_to_file ${FMRI} $IPF6_SUFFIX`
	policy=`get_policy ${FMRI}`

	#
	# Get port from /etc/ssh/sshd_config
	#
	tports=`grep "^Port" /etc/ssh/sshd_config 2>/dev/null | \
	    awk '{print $2}'`

	echo "# $FMRI" >$ipf_file
	echo "# $FMRI" >$ipf6_file
	for port in $tports; do
		generate_rules $FMRI $policy "tcp" $port $ipf_file
		generate_rules $FMRI $policy "tcp" $port $ipf6_file _6
	done
}

# This script is being used for two purposes: as part of an SMF
# start/stop/refresh method, and as a sysidconfig(8)/sys-unconfig(8)
# application.
#
# Both, the SMF methods and sysidconfig/sys-unconfig use different
# arguments..

case $1 in 
	# sysidconfig/sys-unconfig arguments (-c and -u)
'-c')
	/usr/bin/ssh-keygen -A
	if [ $? -ne 0 ]; then
		create_key $SSHDIR/ssh_host_rsa_key rsa
		create_key $SSHDIR/ssh_host_dsa_key dsa
	fi
	;;

'-u')
	# sys-unconfig(8) knows how to remove ssh host keys, so there's
	# nothing to do here.
	:
	;;

	# SMF arguments (start and restart [really "refresh"])

'ipfilter')
	create_ipf_rules $2
	;;

'start')
	#
	# If host keys don't exist when the service is started, create
	# them; sysidconfig is not run in every situation (such as on
	# the install media).
	# 
	/usr/bin/ssh-keygen -A
	if [ $? -ne 0 ]; then
		create_key $SSHDIR/ssh_host_rsa_key rsa
		create_key $SSHDIR/ssh_host_dsa_key dsa
	fi

	/usr/lib/ssh/sshd
	;;

'restart')
	if [ -f "$PIDFILE" ]; then
		/usr/bin/kill -HUP `/bin/cat $PIDFILE`
	fi
	;;

*)
	echo "Usage: $0 { start | restart }"
	exit 1
	;;
esac	

exit $?
#
# Hammerhead sshd_config - OpenSSH 10.2p1
#

Port 22
ListenAddress ::

# Host key files
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
HostKey /etc/ssh/ssh_host_ecdsa_key

# Logging
SyslogFacility auth
LogLevel info

# Authentication
PermitRootLogin no
PasswordAuthentication yes
PermitEmptyPasswords no
MaxAuthTries 6
StrictModes yes
LoginGraceTime 120

# PAM
UsePAM yes

# Forwarding
X11Forwarding yes
X11DisplayOffset 10
X11UseLocalhost yes
GatewayPorts no

# No MOTD (login shell handles /etc/profile)
PrintMotd no

# Keepalive
TCPKeepAlive yes

# sftp subsystem (built-in)
Subsystem	sftp	internal-sftp