rewrite ssh-config script and updated go to v1.12.1

ssh-config.sh

@@ -1,28 +1,13 @@
 #!/bin/sh
 
 UNAME=$(uname)
-case ${UNAME} in
-  Linux)
-    if [ ${EUID} -ne 0 ]; then
-      echo "error: this script must be run as root" 1>&2
-      exit 1
-    fi
-    ;;
-  OpenBSD|FreeBSD)
-    if [ $(id -u) -ne 0 ]; then
-      echo "error: this script must be run as root" 1>&2
-      exit 1
-    fi
-    ;;
-esac
+[ $(id -u) -ne 0 ] && { echo "error: this script must be run as root" 1>&2; exit 1; }
 
 echo "warning: this script will disable ssh password authentication"
 echo -n "continue? [y/N] "
 read answer
 
-if [ "${answer}" != "y" ]; then
-  exit 0
-fi
+[ "${answer}" != "y" ] && exit 0
 
 ssh_moduli="/etc/ssh/moduli"
 moduli="/etc/moduli"
@@ -42,96 +27,77 @@ else
   if [ "${answer}" == "n" ]; then
     exit 0
   fi
-  ssh-keygen -G /etc/ssh/moduli.all -b 4096 > /dev/null
-  ssh-keygen -T /etc/ssh/moduli.safe -f /etc/ssh/moduli.all > /dev/null
-  mv /etc/ssh/moduli.safe /etc/ssh/moduli
-  rm /etc/ssh/moduli.all
+  ssh-keygen -G ${ssh_moduli}.all -b 4096 > /dev/null
+  ssh-keygen -T ${ssh_moduli}.safe -f ${ssh_moduli}.all > /dev/null
+  mv ${ssh_moduli}.safe ${ssh_moduli}
+  rm ${ssh_moduli}.all
 fi
 
 echo "cleaning ssh host keys"
-rm /etc/ssh/ssh_host_*key*
-ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N "" > /dev/null
-ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -N "" > /dev/null
+rm /etc/ssh/ssh_host_{ecdsa,dsa,dss}_key* 2>/dev/null
+[ ! -f /etc/ssh/ssh_host_ed25519_key ] && ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N "" > /dev/null
+[ ! -f /etc/ssh/ssh_host_rsa_key ] && ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -N "" > /dev/null
 
+ssh_config="/etc/ssh/sshd_config"
 echo "writing ssh config"
-if [ -f /etc/ssh/sshd_config ]; then
-  mv /etc/ssh/sshd_config /etc/ssh/sshd_config.bak
-fi
+[ -f ${ssh_config} ] && mv ${ssh_config} ${ssh_config}.bak
 
-cat <<EOF> /etc/ssh/sshd_config
-Port 22
-Protocol 2
+cat <<EOF> ${ssh_config}
 HostKey /etc/ssh/ssh_host_ed25519_key
 HostKey /etc/ssh/ssh_host_rsa_key
 KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256
 Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr
 MACs umac-128-etm@openssh.com,umac-64-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
-UsePrivilegeSeparation sandbox
 PermitRootLogin no
-RSAAuthentication no
-PubkeyAuthentication yes
 ChallengeResponseAuthentication no
 PasswordAuthentication no
+Subsystem sftp internal-sftp
 PrintMotd no
 EOF
 
-if [ "${UNAME}" = "OpenBSD" ]; then
-  sed -i '/UsePrivilegeSeparation/d' /etc/ssh/sshd_config
-  sed -i '/RSAAuthentication/d' /etc/ssh/sshd_config
-fi
-
-case ${UNAME} in
-  Linux)
-    cat <<EOF>> /etc/ssh/sshd_config
-AuthorizedKeysFile %h/.ssh/authorized_keys
-Subsystem sftp /usr/lib/openssh/sftp-server
+[ "${UNAME}" = "Linux" ] && cat <<EOF>> ${ssh_config}
+UsePrivilegeSeparation sandbox
 UsePAM yes
 EOF
-    ;;
-  OpenBSD|FreeBSD)
-    cat <<EOF>> /etc/ssh/sshd_config
-Subsystem sftp /usr/libexec/sftp-server
-AuthorizedKeysFile .ssh/authorized_keys
-EOF
-    ;;
-esac
 
 echo -n "enter your username "
 read user
 
 if [ -z "${user}" ]; then
   echo "error: no user submitted" 1>&2
-  mv /etc/ssh/sshd_config.bak /etc/ssh/sshd_config
+  mv ${ssh_config}.bak ${ssh_config}
   exit 1
 fi
 
-if [ ! -d /home/${user}/.ssh ]; then
-  mkdir /home/${user}/.ssh
-fi
-chmod 700 /home/${user}/.ssh
-chown ${user}: /home/${user}/.ssh
+user_ssh="/home/${user}/.ssh"
+user_auth_keys="${user_ssh}/authorized_keys"
+[ ! -d ${user_ssh} ] && mkdir ${user_ssh}
+chmod 700 ${user_ssh}
+chown ${user}: ${user_ssh}
 
-echo "paste your ssh public key "
+echo "paste your full ssh public key "
 read sshkey
 
 if [ -z "${sshkey}" ]; then
   echo "error: no ssh key submitted" 1>&2
-  mv /etc/ssh/sshd_config.bak /etc/ssh/sshd_config
+  mv ${ssh_config}.bak ${ssh_config}
   exit 1
 fi
 
-echo "${sshkey}" > /home/${user}/.ssh/authorized_keys
-chmod 600 /home/${user}/.ssh/authorized_keys
+echo "${sshkey}" > ${user_auth_keys}
+chmod 600 ${user_auth_keys}
+chown ${user}: ${user_auth_keys}
 
 case ${UNAME} in
   Linux)
-    chown ${user}:root /home/${user}/.ssh/authorized_keys
     service ssh restart
-    ;;
-  OpenBSD|FreeBSD)
-    chown ${user}:wheel /home/${user}/.ssh/authorized_keys
+  ;;
+  OpenBSD)
+    rcctl restart sshd
+  ;;
+  FreeBSD)
     /etc/rc.d/sshd restart
-    ;;
+  ;;
 esac
 
 if [ -z "$(ps aux -w | awk '/\/usr\/s?bin\/sshd/')" ]; then