Stuff that has not yet gone into the official build.
Post a reply

ssh settings in jessie

Tue Oct 21, 2014 3:03 pm

I know I discussed this last time I made changes, but it's buried in a long thread. This will be easier to find later.

New setting in jessie for PermitRootLogin is "without-password" which doesn't mean what you think it means. Root can only log in with auth keys. Also changed was PasswordAuthentication, which is now set to "no". Actually, I can't remember if that was the default debian setting or if it came from live-config, which does change it to "no" in /lib/live/config/1160-openssh-server.

For the installer, this code should work:
Code:
# Allow users to login to ssh with passwords if desired.
# Allow root login only with auth keys.
# or do nothing.
if [[ $ssh_pass = "yes" ]] ; then
   sed -i~ 's/PasswordAuthentication no/PasswordAuthentication yes/' /target(*/*)etc/ssh/sshd_config
   sed -i 's/PermitRootLogin yes/PermitRootLogin without-password/' /target(*/*)etc/ssh/sshd_config
elif [[ $ssh_pass = "no" ]] ; then
   sed -i~ 's/ PasswordAuthentication yes/PasswordAuthentication no/' /target(*/*)etc/ssh/sshd_config
   sed -i 's/PermitRootLogin yes/PermitRootLogin without-password/' /target(*/*)etc/ssh/sshd_config
elif [[ -n "$ssh_pass" ]] ; then   
   echo "WARNING: ssh_pass value not recognized. No changes were made to (*/*)etc/ssh/sshd_config"
fi


Here's the config file entry:
Code:
# SSH Settings
# The default setup in debian has password authentication turned off,
# and root can only log in with authentication keys.
# If ssh_pass="yes", then PasswordAuthentication will be set to "yes"
# If ssh_pass="no", then PasswordAuthentication will be set to "no"
# In either of the above cases, if PermitRootLogin was set to "yes",
# it will be changed to "without-password" (meaning with auth keys only)
# If ssh_pass is null or set to anything other than "yes" or "no", then
# (*/*)etc/ssh/sshd_config will not be altered.

ssh_pass=""


For refractasnapshot, I'm thinking maybe we need 1161-openssh-server to reverse that change, along with an option in refractasnapshot to insert that file or not. dzz, does that make sense or do you have a better suggestion? The script would just need to check for the state file and run one sed command.

Re: ssh settings in jessie

Wed Dec 24, 2014 3:32 pm

live/config/1160-openssh-server disables password authentication in ssh with this line.
Code:
sed -i -e 's|#\(PasswordAuthentication\) yes|\1 no|' (/)etc/ssh/sshd_config


In refractasnapshot 9.1.3, if ssh_pass is set to "yes", then 1161-openssh-server re-enables password authentication with the same line. I just reversed "yes" and "no".
Code:
sed -i -e 's|#\(PasswordAuthentication\) no|\1 yes|' (/)etc/ssh/sshd_confi


I noticed an inconsistency - some snapshots allowed ssh login with passwords and some did not. The difference is in sshd_config. The default line is
Code:
#PasswordAuthentication yes
If you remove the comment mark, 1160-openssh-server does not change the line.

I tried the following, and it works whether or not the line starts with #.
Code:
sed -i -e 's|.*PasswordAuthentication.*no|#PasswordAuthentication yes|' (/)etc/ssh/sshd_config

And there probably needs to be a similar line that does the opposite, so that if the user chooses ssh_pass=no in refractasnapshot.conf, that's what they'll get, regardless of which way they have it set in their installation.

Edit/Update: ssh-keygen works in 1160-openssh-server now. Instead of 1161-openssh-server, it makes sense to edit the rsync copy of sshd_config in $work_dir.
Post a reply