meta-starlingx/meta-stx-integ/recipes-connectivity/openssh/files/stx/sshd-keygen

   1 #!/bin/bash
   2
   3 # Create the host keys for the OpenSSH server.
   4 #
   5 # The creation is controlled by the $AUTOCREATE_SERVER_KEYS environment
   6 # variable.
   7 AUTOCREATE_SERVER_KEYS="RSA ECDSA ED25519"
   8
   9 # source function library
  10 . /etc/init.d/functions
  11
  12 # Some functions to make the below more readable
  13 KEYGEN=/usr/bin/ssh-keygen
  14 RSA1_KEY=/etc/ssh/ssh_host_key
  15 RSA_KEY=/etc/ssh/ssh_host_rsa_key
  16 DSA_KEY=/etc/ssh/ssh_host_dsa_key
  17 ECDSA_KEY=/etc/ssh/ssh_host_ecdsa_key
  18 ED25519_KEY=/etc/ssh/ssh_host_ed25519_key
  19
  20 # pull in sysconfig settings
  21 [ -f /etc/sysconfig/sshd ] && . /etc/sysconfig/sshd
  22
  23 fips_enabled() {
  24         if [ -r /proc/sys/crypto/fips_enabled ]; then
  25                 cat /proc/sys/crypto/fips_enabled
  26         else
  27                 echo 0
  28         fi
  29 }
  30
  31 do_rsa1_keygen() {
  32         if [ ! -s $RSA1_KEY -a `fips_enabled` -eq 0 ]; then
  33                 echo -n $"Generating SSH1 RSA host key: "
  34                 rm -f $RSA1_KEY
  35                 if test ! -f $RSA1_KEY && $KEYGEN -q -t rsa1 -f $RSA1_KEY -C '' -N '' >&/dev/null; then
  36                         chgrp ssh_keys $RSA1_KEY
  37                         chmod 600 $RSA1_KEY
  38                         chmod 644 $RSA1_KEY.pub
  39                         if [ -x /sbin/restorecon ]; then
  40                             /sbin/restorecon $RSA1_KEY{,.pub}
  41                         fi
  42                         success $"RSA1 key generation"
  43                         echo
  44                 else
  45                         failure $"RSA1 key generation"
  46                         echo
  47                         exit 1
  48                 fi
  49         fi
  50 }
  51
  52 do_rsa_keygen() {
  53         if [ ! -s $RSA_KEY ]; then
  54                 echo -n $"Generating SSH2 RSA host key: "
  55                 rm -f $RSA_KEY
  56                 if test ! -f $RSA_KEY && $KEYGEN -q -t rsa -f $RSA_KEY -C '' -N '' >&/dev/null; then
  57                         chgrp ssh_keys $RSA_KEY
  58                         chmod 600 $RSA_KEY
  59                         chmod 644 $RSA_KEY.pub
  60                         if [ -x /sbin/restorecon ]; then
  61                             /sbin/restorecon $RSA_KEY{,.pub}
  62                         fi
  63                         success $"RSA key generation"
  64                         echo
  65                 else
  66                         failure $"RSA key generation"
  67                         echo
  68                         exit 1
  69                 fi
  70         fi
  71 }
  72
  73 do_dsa_keygen() {
  74         if [ ! -s $DSA_KEY -a `fips_enabled` -eq 0 ]; then
  75                 echo -n $"Generating SSH2 DSA host key: "
  76                 rm -f $DSA_KEY
  77                 if test ! -f $DSA_KEY && $KEYGEN -q -t dsa -f $DSA_KEY -C '' -N '' >&/dev/null; then
  78                         chgrp ssh_keys $DSA_KEY
  79                         chmod 600 $DSA_KEY
  80                         chmod 644 $DSA_KEY.pub
  81                         if [ -x /sbin/restorecon ]; then
  82                             /sbin/restorecon $DSA_KEY{,.pub}
  83                         fi
  84                         success $"DSA key generation"
  85                         echo
  86                 else
  87                         failure $"DSA key generation"
  88                         echo
  89                         exit 1
  90                 fi
  91         fi
  92 }
  93
  94 do_ecdsa_keygen() {
  95         if [ ! -s $ECDSA_KEY ]; then
  96                 echo -n $"Generating SSH2 ECDSA host key: "
  97                 rm -f $ECDSA_KEY
  98                 if test ! -f $ECDSA_KEY && $KEYGEN -q -t ecdsa -f $ECDSA_KEY -C '' -N '' >&/dev/null; then
  99                         chgrp ssh_keys $ECDSA_KEY
 100                         chmod 600 $ECDSA_KEY
 101                         chmod 644 $ECDSA_KEY.pub
 102                         if [ -x /sbin/restorecon ]; then
 103                             /sbin/restorecon $ECDSA_KEY{,.pub}
 104                         fi
 105                         success $"ECDSA key generation"
 106                         echo
 107                 else
 108                         failure $"ECDSA key generation"
 109                         echo
 110                         exit 1
 111                 fi
 112         fi
 113 }
 114
 115 do_ed25519_keygen() {
 116         if [ ! -s $ED25519_KEY -a `fips_enabled` -eq 0 ]; then
 117                 echo -n $"Generating SSH2 ED25519 host key: "
 118                 rm -f $ED25519_KEY
 119                 if test ! -f $ED25519_KEY && $KEYGEN -q -t ed25519 -f $ED25519_KEY -C '' -N '' >&/dev/null; then
 120                         chgrp ssh_keys $ED25519_KEY
 121                         chmod 600 $ED25519_KEY
 122                         chmod 644 $ED25519_KEY.pub
 123                         if [ -x /sbin/restorecon ]; then
 124                             /sbin/restorecon $ED25519_KEY{,.pub}
 125                         fi
 126                         success $"ED25519 key generation"
 127                         echo
 128                 else
 129                         failure $"ED25519 key generation"
 130                         echo
 131                         exit 1
 132                 fi
 133         fi
 134 }
 135
 136 if [ "x${AUTOCREATE_SERVER_KEYS}" == "xNO" ]; then
 137         exit 0
 138 fi
 139
 140 # legacy options
 141 case $AUTOCREATE_SERVER_KEYS in
 142         NODSA) AUTOCREATE_SERVER_KEYS="RSA ECDSA ED25519";;
 143         RSAONLY) AUTOCREATE_SERVER_KEYS="RSA";;
 144         YES) AUTOCREATE_SERVER_KEYS="DSA RSA ECDSA ED25519";;
 145 esac
 146
 147 for KEY in $AUTOCREATE_SERVER_KEYS; do
 148         case $KEY in
 149                 DSA) do_dsa_keygen;;
 150                 RSA) do_rsa_keygen;;
 151                 ECDSA) do_ecdsa_keygen;;
 152                 ED25519) do_ed25519_keygen;;
 153         esac
 154 done