From d4820b598b072ceed34a4ee944b75c2d44ac6911 Mon Sep 17 00:00:00 2001
From: Joachim Wiberg <troglobit@gmail.com>
Date: Tue, 3 Oct 2023 13:54:44 +0200
Subject: [PATCH] Fix SSH hostkey generation and verification

This change addresses a problem accessing Infix over SSH.  The root cause
turned out to be the hostkeys, which live in /var/lib/ssh and not in /etc
on Infix, were corrupt.

The corruption was interesting in that they all existed, but had size 0.
This state was not caught by our ssh-genhostkeys script and that is what
this change attempts to fix.

As before this change, the script starts by calling `sshd -t` to verify
they hostkeys.  Unlike before we now check for 'invalid format' in the
output of that command.  If any file with invalid format is found, we
remove them and regenerate the hostkeys.

In this investigation it was found that the 'ssh-keygen -A' command that
generates hostkeys does not use the directories specified for the given
files in sshd_config, instead it always saves the files to /etc/ssh.

Also, since there is no panic in getting the hostkeys generated we can
allow the script to wait for syslogd to start before we run, even though
it all happens in runlevel S.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
---
 .../skeleton/etc/finit.d/available/sshd.conf  |  2 +-
 .../skeleton/usr/bin/ssh-genhostkeys          | 52 +++++++++++++++----
 2 files changed, 43 insertions(+), 11 deletions(-)

diff --git a/package/skeleton-init-finit/skeleton/etc/finit.d/available/sshd.conf b/package/skeleton-init-finit/skeleton/etc/finit.d/available/sshd.conf
index 588f3da3..1af2c8a9 100644
--- a/package/skeleton-init-finit/skeleton/etc/finit.d/available/sshd.conf
+++ b/package/skeleton-init-finit/skeleton/etc/finit.d/available/sshd.conf
@@ -1,2 +1,2 @@
-task [S] /usr/bin/ssh-genhostkeys --
+task    [S]       <pid/syslogd> /usr/bin/ssh-genhostkeys -- Verifying SSH host keys
 service [2345789] <usr/ssh-hostkeys> env:-/etc/default/sshd /usr/sbin/sshd -D $SSHD_OPTS -- OpenSSH daemon
diff --git a/package/skeleton-init-finit/skeleton/usr/bin/ssh-genhostkeys b/package/skeleton-init-finit/skeleton/usr/bin/ssh-genhostkeys
index fb4fa906..ca73075b 100755
--- a/package/skeleton-init-finit/skeleton/usr/bin/ssh-genhostkeys
+++ b/package/skeleton-init-finit/skeleton/usr/bin/ssh-genhostkeys
@@ -1,15 +1,47 @@
 #!/bin/sh
+tmp=$(mktemp)
+dir=$(dirname $(grep -r '^HostKey' /etc/ssh/* |tail -1 | awk '{print $2}'))
 
-if sshd -t; then
+log()
+{
+    logger -sik -p security.notice -t sshd "$@"
+}
+warn()
+{
+    logger -sik -p security.warning -t sshd "$@"
+}
+err()
+{
+    logger -sik -p security.err -t sshd "$@"
+}
+
+check()
+{
+    if sshd -t >$tmp 2>&1; then
+	log "SSH hostkeys OK, setting ssh-hostkeys condition"
 	initctl cond set ssh-hostkeys
-	exit 0
+	return 0
+    fi
+    return 1
+}
+
+rc=0
+if ! check; then
+    files=$(awk '/invalid format/{print $6}' "$tmp" | sed 's/.*"\(.*\)".*/\1/')
+    for file in $files; do
+	warn "Removing $file: invalid format"
+	rm "$file"
+    done
+
+    log "Generating SSH hostkeys ..."
+    if ssh-keygen -A; then
+	mv /etc/ssh/ssh_host_* "$dir/"
+    fi
+    if ! check; then
+	err "Failed generating SSH hostkeys!"
+	rc=1
+    fi
 fi
 
-if sshd -t 2>&1 |grep hostkeys; then
-	ssh-keygen -A
-	initctl cond set ssh-hostkeys
-else
-	logger -t sshd "invadlid sshd_config, check with: sshd -t"
-fi
-
-exit 0
+rm "$tmp"
+exit $rc