rewrite ssh-config script and updated go to v1.12.1

build-go.sh

@@ -13,7 +13,7 @@ V14="go1.4.3"
 bootstrap="${INSTALL}/bootstrap-${V14}"
 TGZ14="${V14}.tar.gz"
 
-Vnew="go1.12"
+Vnew="go1.12.1"
 TGZnew="${Vnew}.tar.gz"
 
 rm -rf ${INSTALL}/go*

ssh-config.sh

@@ -1,28 +1,13 @@
 #!/bin/sh
 
 UNAME=$(uname)
-case ${UNAME} in
+[ $(id -u) -ne 0 ] && { echo "error: this script must be run as root" 1>&2; exit 1; }
-  Linux)
-    if [ ${EUID} -ne 0 ]; then
-      echo "error: this script must be run as root" 1>&2
-      exit 1
-    fi
-    ;;
-  OpenBSD|FreeBSD)
-    if [ $(id -u) -ne 0 ]; then
-      echo "error: this script must be run as root" 1>&2
-      exit 1
-    fi
-    ;;
-esac
 
 echo "warning: this script will disable ssh password authentication"
 echo -n "continue? [y/N] "
 read answer
 
-if [ "${answer}" != "y" ]; then
+[ "${answer}" != "y" ] && exit 0
-  exit 0
-fi
 
 ssh_moduli="/etc/ssh/moduli"
 moduli="/etc/moduli"
@@ -42,94 +27,75 @@ else
   if [ "${answer}" == "n" ]; then
     exit 0
   fi
-  ssh-keygen -G /etc/ssh/moduli.all -b 4096 > /dev/null
+  ssh-keygen -G ${ssh_moduli}.all -b 4096 > /dev/null
-  ssh-keygen -T /etc/ssh/moduli.safe -f /etc/ssh/moduli.all > /dev/null
+  ssh-keygen -T ${ssh_moduli}.safe -f ${ssh_moduli}.all > /dev/null
-  mv /etc/ssh/moduli.safe /etc/ssh/moduli
+  mv ${ssh_moduli}.safe ${ssh_moduli}
-  rm /etc/ssh/moduli.all
+  rm ${ssh_moduli}.all
 fi
 
 echo "cleaning ssh host keys"
-rm /etc/ssh/ssh_host_*key*
+rm /etc/ssh/ssh_host_{ecdsa,dsa,dss}_key* 2>/dev/null
-ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N "" > /dev/null
+[ ! -f /etc/ssh/ssh_host_ed25519_key ] && ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N "" > /dev/null
-ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -N "" > /dev/null
+[ ! -f /etc/ssh/ssh_host_rsa_key ] && ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -N "" > /dev/null
 
+ssh_config="/etc/ssh/sshd_config"
 echo "writing ssh config"
-if [ -f /etc/ssh/sshd_config ]; then
+[ -f ${ssh_config} ] && mv ${ssh_config} ${ssh_config}.bak
-  mv /etc/ssh/sshd_config /etc/ssh/sshd_config.bak
-fi
 
-cat <<EOF> /etc/ssh/sshd_config
+cat <<EOF> ${ssh_config}
-Port 22
-Protocol 2
 HostKey /etc/ssh/ssh_host_ed25519_key
 HostKey /etc/ssh/ssh_host_rsa_key
 KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256
 Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr
 MACs umac-128-etm@openssh.com,umac-64-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
-UsePrivilegeSeparation sandbox
 PermitRootLogin no
-RSAAuthentication no
-PubkeyAuthentication yes
 ChallengeResponseAuthentication no
 PasswordAuthentication no
+Subsystem sftp internal-sftp
 PrintMotd no
 EOF
 
-if [ "${UNAME}" = "OpenBSD" ]; then
+[ "${UNAME}" = "Linux" ] && cat <<EOF>> ${ssh_config}
-  sed -i '/UsePrivilegeSeparation/d' /etc/ssh/sshd_config
+UsePrivilegeSeparation sandbox
-  sed -i '/RSAAuthentication/d' /etc/ssh/sshd_config
-fi
-
-case ${UNAME} in
-  Linux)
-    cat <<EOF>> /etc/ssh/sshd_config
-AuthorizedKeysFile %h/.ssh/authorized_keys
-Subsystem sftp /usr/lib/openssh/sftp-server
 UsePAM yes
 EOF
-    ;;
-  OpenBSD|FreeBSD)
-    cat <<EOF>> /etc/ssh/sshd_config
-Subsystem sftp /usr/libexec/sftp-server
-AuthorizedKeysFile .ssh/authorized_keys
-EOF
-    ;;
-esac
 
 echo -n "enter your username "
 read user
 
 if [ -z "${user}" ]; then
   echo "error: no user submitted" 1>&2
-  mv /etc/ssh/sshd_config.bak /etc/ssh/sshd_config
+  mv ${ssh_config}.bak ${ssh_config}
   exit 1
 fi
 
-if [ ! -d /home/${user}/.ssh ]; then
+user_ssh="/home/${user}/.ssh"
-  mkdir /home/${user}/.ssh
+user_auth_keys="${user_ssh}/authorized_keys"
-fi
+[ ! -d ${user_ssh} ] && mkdir ${user_ssh}
-chmod 700 /home/${user}/.ssh
+chmod 700 ${user_ssh}
-chown ${user}: /home/${user}/.ssh
+chown ${user}: ${user_ssh}
 
-echo "paste your ssh public key "
+echo "paste your full ssh public key "
 read sshkey
 
 if [ -z "${sshkey}" ]; then
   echo "error: no ssh key submitted" 1>&2
-  mv /etc/ssh/sshd_config.bak /etc/ssh/sshd_config
+  mv ${ssh_config}.bak ${ssh_config}
   exit 1
 fi
 
-echo "${sshkey}" > /home/${user}/.ssh/authorized_keys
+echo "${sshkey}" > ${user_auth_keys}
-chmod 600 /home/${user}/.ssh/authorized_keys
+chmod 600 ${user_auth_keys}
+chown ${user}: ${user_auth_keys}
 
 case ${UNAME} in
   Linux)
-    chown ${user}:root /home/${user}/.ssh/authorized_keys
     service ssh restart
   ;;
-  OpenBSD|FreeBSD)
+  OpenBSD)
-    chown ${user}:wheel /home/${user}/.ssh/authorized_keys
+    rcctl restart sshd
+  ;;
+  FreeBSD)
     /etc/rc.d/sshd restart
   ;;
 esac