diff options
Diffstat (limited to 'src')
| -rwxr-xr-x | src/conf_mode/service_ssh.py | 6 | ||||
| -rw-r--r-- | src/migration-scripts/ssh/2-to-3 | 39 |
2 files changed, 45 insertions, 0 deletions
diff --git a/src/conf_mode/service_ssh.py b/src/conf_mode/service_ssh.py index dca021d02..d67c1fa3f 100755 --- a/src/conf_mode/service_ssh.py +++ b/src/conf_mode/service_ssh.py @@ -29,6 +29,7 @@ from vyos.configverify import verify_pki_openssh_key from vyos.defaults import config_files from vyos.defaults import SSH_DSA_DEPRECATION_WARNING from vyos.utils.process import call +from vyos.utils.process import rc_cmd from vyos.template import render from vyos import ConfigError from vyos import airbag @@ -173,6 +174,11 @@ def apply(ssh): call(f'systemctl stop {systemd_service_sshguard}') return None + # Verify generated sshd configuration is correct + rc, out = rc_cmd(f'/usr/sbin/sshd -t -f {config_file}') + if rc: + raise ConfigError(f'Unexpected error with SSH configuration! {out}') + if 'dynamic_protection' not in ssh: call(f'systemctl stop {systemd_service_sshguard}') else: diff --git a/src/migration-scripts/ssh/2-to-3 b/src/migration-scripts/ssh/2-to-3 new file mode 100644 index 000000000..ac9f7156c --- /dev/null +++ b/src/migration-scripts/ssh/2-to-3 @@ -0,0 +1,39 @@ +# Copyright VyOS maintainers and contributors <maintainers@vyos.io> +# +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. +# +# This library is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# Lesser General Public License for more details. +# +# You should have received a copy of the GNU Lesser General Public License +# along with this library. If not, see <http://www.gnu.org/licenses/>. + +# T8098: rijndael-cbc@lysator.liu.se was removed in OpenSSH 6.7 which is used +# starting with VyOS 1.4. Also rename "ciphers" -> "cipher" to follow our +# CLI guidelines to use singular when possible + +from vyos.configtree import ConfigTree + +base = ['service', 'ssh'] + +old_path = base + ['ciphers'] +new_path = base + ['cipher'] + +def migrate(config: ConfigTree) -> None: + if not config.exists(base): + # Nothing to do + return + + if config.exists(old_path): + config.rename(old_path, new_path[-1]) + + if config.exists(new_path): + deprecated_cipher = 'rijndael-cbc@lysator.liu.se' + for cipher in config.return_values(new_path): + if cipher == deprecated_cipher: + config.delete_value(new_path, value=deprecated_cipher) |