From 3529bdf5b65016cea331f8ba6e7293c7eea9e6ce Mon Sep 17 00:00:00 2001
From: An-Cheng Huang <ancheng@vyatta.com>
Date: Mon, 13 Oct 2008 15:31:26 -0700
Subject: add ssh key blacklists

---
 debian/vyatta-cfg-system.postinst.in | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

(limited to 'debian/vyatta-cfg-system.postinst.in')

diff --git a/debian/vyatta-cfg-system.postinst.in b/debian/vyatta-cfg-system.postinst.in
index 0dd6248f..fe50fa79 100644
--- a/debian/vyatta-cfg-system.postinst.in
+++ b/debian/vyatta-cfg-system.postinst.in
@@ -66,6 +66,20 @@ EOF
 %users ALL=NOPASSWD: ${bindir}/sudo-users/
 ### END VYATTA
 EOF
+
+    # set up blacklists
+    for f in blacklist.DSA-1024 blacklist.RSA-2048; do
+        if [ -r "/etc/ssh/$f" ]; then
+            l=$(head -1 $sysconfdir/$f)
+            if ! grep -q "$l" /etc/ssh/$f; then
+                tmp=$(mktemp /tmp/bl.XXXXXXXXXX)
+                cat /etc/ssh/$f $sysconfdir/$f | sort >$tmp
+                mv $tmp /etc/ssh/$f
+            fi
+        else
+            cp $sysconfdir/$f /etc/ssh/$f
+        fi
+    done
 fi
 
 # update crontab for logrotate
@@ -87,6 +101,8 @@ fi
 
 sed -i 's/^set /builtin set /' /etc/bash_completion
 
+/usr/sbin/dpkg-reconfigure -f noninteractive openssh-server
+
 # Local Variables:
 # mode: shell-script
 # sh-indentation: 4
-- 
cgit v1.2.3