Fix SSH hostkey generation and verification

This change addresses a problem accessing Infix over SSH.  The root cause
turned out to be the hostkeys, which live in /var/lib/ssh and not in /etc
on Infix, were corrupt.

The corruption was interesting in that they all existed, but had size 0.
This state was not caught by our ssh-genhostkeys script and that is what
this change attempts to fix.

As before this change, the script starts by calling `sshd -t` to verify
they hostkeys.  Unlike before we now check for 'invalid format' in the
output of that command.  If any file with invalid format is found, we
remove them and regenerate the hostkeys.

In this investigation it was found that the 'ssh-keygen -A' command that
generates hostkeys does not use the directories specified for the given
files in sshd_config, instead it always saves the files to /etc/ssh.

Also, since there is no panic in getting the hostkeys generated we can
allow the script to wait for syslogd to start before we run, even though
it all happens in runlevel S.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>

package/skeleton-init-finit/skeleton/etc/finit.d/available/sshd.conf

@@ -1,2 +1,2 @@
-task [S] /usr/bin/ssh-genhostkeys --
+task    [S]       <pid/syslogd> /usr/bin/ssh-genhostkeys -- Verifying SSH host keys
 service [2345789] <usr/ssh-hostkeys> env:-/etc/default/sshd /usr/sbin/sshd -D $SSHD_OPTS -- OpenSSH daemon

package/skeleton-init-finit/skeleton/usr/bin/ssh-genhostkeys

@@ -1,15 +1,47 @@
 #!/bin/sh
+tmp=$(mktemp)
+dir=$(dirname $(grep -r '^HostKey' /etc/ssh/* |tail -1 | awk '{print $2}'))
 
-if sshd -t; then
+log()
+{
+    logger -sik -p security.notice -t sshd "$@"
+}
+warn()
+{
+    logger -sik -p security.warning -t sshd "$@"
+}
+err()
+{
+    logger -sik -p security.err -t sshd "$@"
+}
+
+check()
+{
+    if sshd -t >$tmp 2>&1; then
+	log "SSH hostkeys OK, setting ssh-hostkeys condition"
 	initctl cond set ssh-hostkeys
-	exit 0
+	return 0
+    fi
+    return 1
+}
+
+rc=0
+if ! check; then
+    files=$(awk '/invalid format/{print $6}' "$tmp" | sed 's/.*"\(.*\)".*/\1/')
+    for file in $files; do
+	warn "Removing $file: invalid format"
+	rm "$file"
+    done
+
+    log "Generating SSH hostkeys ..."
+    if ssh-keygen -A; then
+	mv /etc/ssh/ssh_host_* "$dir/"
+    fi
+    if ! check; then
+	err "Failed generating SSH hostkeys!"
+	rc=1
+    fi
 fi
 
-if sshd -t 2>&1 |grep hostkeys; then
-	ssh-keygen -A
-	initctl cond set ssh-hostkeys
-else
-	logger -t sshd "invadlid sshd_config, check with: sshd -t"
-fi
-
-exit 0
+rm "$tmp"
+exit $rc