Browse Source

Fix ssh configuration

Bob Mottram 7 years ago
parent
commit
b4a038b8c4
2 changed files with 12 additions and 0 deletions
  1. 2
    0
      src/freedombone-image-customise
  2. 10
    0
      src/freedombone-utils-ssh

+ 2
- 0
src/freedombone-image-customise View File

279
     fi
279
     fi
280
 
280
 
281
     sed -i "s/Port .*/Port ${SSH_PORT}/g" $rootdir/etc/ssh/sshd_config
281
     sed -i "s/Port .*/Port ${SSH_PORT}/g" $rootdir/etc/ssh/sshd_config
282
+    sed -i "s/#Port ${SSH_PORT}/Port ${SSH_PORT}/g" $rootdir/etc/ssh/sshd_config
282
 
283
 
283
     if [[ "$SSH_PUBKEY" != "no" ]]; then
284
     if [[ "$SSH_PUBKEY" != "no" ]]; then
284
         if [ ! -d $rootdir/home/$MY_USERNAME/.ssh ]; then
285
         if [ ! -d $rootdir/home/$MY_USERNAME/.ssh ]; then
287
         echo "$SSH_PUBKEY" > $rootdir/home/$MY_USERNAME/.ssh/authorized_keys
288
         echo "$SSH_PUBKEY" > $rootdir/home/$MY_USERNAME/.ssh/authorized_keys
288
         chroot $rootdir /bin/chown -R $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.ssh
289
         chroot $rootdir /bin/chown -R $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.ssh
289
         sed -i 's|PasswordAuthentication.*|PasswordAuthentication no|g' $rootdir/etc/ssh/sshd_config
290
         sed -i 's|PasswordAuthentication.*|PasswordAuthentication no|g' $rootdir/etc/ssh/sshd_config
291
+        sed -i 's|#PasswordAuthentication no|PasswordAuthentication no|g' $rootdir/etc/ssh/sshd_config
290
         echo $"Using ssh public key:"
292
         echo $"Using ssh public key:"
291
         echo $SSH_PUBKEY
293
         echo $SSH_PUBKEY
292
         echo $'Password ssh authentication turned off'
294
         echo $'Password ssh authentication turned off'

+ 10
- 0
src/freedombone-utils-ssh View File

41
         return
41
         return
42
     fi
42
     fi
43
     sed -i "s/Port .*/Port $SSH_PORT/g" /etc/ssh/sshd_config
43
     sed -i "s/Port .*/Port $SSH_PORT/g" /etc/ssh/sshd_config
44
+    sed -i "s/#Port ${SSH_PORT}/Port ${SSH_PORT}/g" /etc/ssh/sshd_config
44
     sed -i 's/PermitRootLogin.*/PermitRootLogin no/g' /etc/ssh/sshd_config
45
     sed -i 's/PermitRootLogin.*/PermitRootLogin no/g' /etc/ssh/sshd_config
46
+    sed -i 's/#PermitRootLogin no/PermitRootLogin no/g' /etc/ssh/sshd_config
45
     sed -i 's/X11Forwarding.*/X11Forwarding no/g' /etc/ssh/sshd_config
47
     sed -i 's/X11Forwarding.*/X11Forwarding no/g' /etc/ssh/sshd_config
48
+    sed -i 's/#X11Forwarding no/X11Forwarding no/g' /etc/ssh/sshd_config
46
     sed -i 's/ServerKeyBits.*/ServerKeyBits 4096/g' /etc/ssh/sshd_config
49
     sed -i 's/ServerKeyBits.*/ServerKeyBits 4096/g' /etc/ssh/sshd_config
50
+    sed -i 's/#ServerKeyBits 4096/ServerKeyBits 4096/g' /etc/ssh/sshd_config
47
     sed -i 's/TCPKeepAlive.*/TCPKeepAlive no/g' /etc/ssh/sshd_config
51
     sed -i 's/TCPKeepAlive.*/TCPKeepAlive no/g' /etc/ssh/sshd_config
52
+    sed -i 's/#TCPKeepAlive no/TCPKeepAlive no/g' /etc/ssh/sshd_config
48
     sed -i 's|HostKey /etc/ssh/ssh_host_dsa_key|#HostKey /etc/ssh/ssh_host_dsa_key|g' /etc/ssh/sshd_config
53
     sed -i 's|HostKey /etc/ssh/ssh_host_dsa_key|#HostKey /etc/ssh/ssh_host_dsa_key|g' /etc/ssh/sshd_config
49
     sed -i 's|HostKey /etc/ssh/ssh_host_ecdsa_key|#HostKey /etc/ssh/ssh_host_ecdsa_key|g' /etc/ssh/sshd_config
54
     sed -i 's|HostKey /etc/ssh/ssh_host_ecdsa_key|#HostKey /etc/ssh/ssh_host_ecdsa_key|g' /etc/ssh/sshd_config
50
     if ! grep -q 'DebianBanner' /etc/ssh/sshd_config; then
55
     if ! grep -q 'DebianBanner' /etc/ssh/sshd_config; then
57
     else
62
     else
58
         echo 'ClientAliveInterval 60' >> /etc/ssh/sshd_config
63
         echo 'ClientAliveInterval 60' >> /etc/ssh/sshd_config
59
     fi
64
     fi
65
+    sed -i 's/#ClientAliveInterval 60/ClientAliveInterval 60/g' /etc/ssh/sshd_config
60
     if grep -q 'ClientAliveCountMax' /etc/ssh/sshd_config; then
66
     if grep -q 'ClientAliveCountMax' /etc/ssh/sshd_config; then
61
         sed -i 's/ClientAliveCountMax.*/ClientAliveCountMax 3/g' /etc/ssh/sshd_config
67
         sed -i 's/ClientAliveCountMax.*/ClientAliveCountMax 3/g' /etc/ssh/sshd_config
62
     else
68
     else
63
         echo 'ClientAliveCountMax 3' >> /etc/ssh/sshd_config
69
         echo 'ClientAliveCountMax 3' >> /etc/ssh/sshd_config
64
     fi
70
     fi
71
+    sed -i 's/#ClientAliveCountMax 3/ClientAliveCountMax 3/g' /etc/ssh/sshd_config
65
     if grep -q 'Ciphers' /etc/ssh/sshd_config; then
72
     if grep -q 'Ciphers' /etc/ssh/sshd_config; then
66
         sed -i "s|Ciphers.*|Ciphers $SSH_CIPHERS|g" /etc/ssh/sshd_config
73
         sed -i "s|Ciphers.*|Ciphers $SSH_CIPHERS|g" /etc/ssh/sshd_config
67
     else
74
     else
68
         echo "Ciphers $SSH_CIPHERS" >> /etc/ssh/sshd_config
75
         echo "Ciphers $SSH_CIPHERS" >> /etc/ssh/sshd_config
69
     fi
76
     fi
77
+    sed -i "s|#Ciphers $SSH_CIPHERS|Ciphers $SSH_CIPHERS|g" /etc/ssh/sshd_config
70
     if grep -q 'MACs' /etc/ssh/sshd_config; then
78
     if grep -q 'MACs' /etc/ssh/sshd_config; then
71
         sed -i "s|MACs.*|MACs $SSH_MACS|g" /etc/ssh/sshd_config
79
         sed -i "s|MACs.*|MACs $SSH_MACS|g" /etc/ssh/sshd_config
72
     else
80
     else
73
         echo "MACs $SSH_MACS" >> /etc/ssh/sshd_config
81
         echo "MACs $SSH_MACS" >> /etc/ssh/sshd_config
74
     fi
82
     fi
83
+    sed -i "s|#MACs $SSH_MACS|MACs $SSH_MACS|g" /etc/ssh/sshd_config
75
     if grep -q 'KexAlgorithms' /etc/ssh/sshd_config; then
84
     if grep -q 'KexAlgorithms' /etc/ssh/sshd_config; then
76
         sed -i "s|KexAlgorithms.*|KexAlgorithms $SSH_KEX|g" /etc/ssh/sshd_config
85
         sed -i "s|KexAlgorithms.*|KexAlgorithms $SSH_KEX|g" /etc/ssh/sshd_config
77
     else
86
     else
78
         echo "KexAlgorithms $SSH_KEX" >> /etc/ssh/sshd_config
87
         echo "KexAlgorithms $SSH_KEX" >> /etc/ssh/sshd_config
79
     fi
88
     fi
89
+    sed -i "s|#KexAlgorithms $SSH_KEX|KexAlgorithms $SSH_KEX|g" /etc/ssh/sshd_config
80
 
90
 
81
     apt-get -yq install fail2ban vim-common
91
     apt-get -yq install fail2ban vim-common
82
 
92