+$sysconfdir = "$prefix/etc/ssh";
+$localsshdir = "/etc/ssh";
+$setupdir = "$prefix/setup/gsi_openssh_setup";
+
+#
+# standard key types and their root file name mappings
+#
+
+my $keyfiles = {
+ "dsa" => "ssh_host_dsa_key",
+ "rsa" => "ssh_host_rsa_key",
+ "rsa1" => "ssh_host_key",
+ };
+
+#
+# argument specification. we offload some processing work from later functions
+# to verify correct args by using anon subs in various places.
+#
+
+my($interactive, $force, $verbose);
+
+GetOptions(
+ 'interactive!' => \$interactive,
+ 'force' => \$force,
+ 'verbose' => \$verbose,
+ ) or pod2usage(2);
+
+#
+# miscellaneous initialization functions
+#
+
+setPrivilegeSeparation(0);
+
+#
+# main execution. This should find its way into a subroutine at some future
+# point.
+#
+
+print "$myname: Configuring package 'gsi_openssh'...\n";
+print "---------------------------------------------------------------------\n";
+print "Hi, I'm the setup script for the gsi_openssh package! I will create\n";
+print "a number of configuration files based on your local system setup. I\n";
+print "will also attempt to copy or create a number of SSH key pairs for\n";
+print "this machine. (Loosely, if I find a pair of host keys in /etc/ssh,\n";
+print "I will copy them into \$GLOBUS_LOCATION/etc/ssh. Otherwise, I will\n";
+print "generate them for you.)\n";
+print "\n";
+print " Jacobim Mugatu says,\n";
+print " \"Utopian Prime Minister Bad! GSI-OpenSSH Good!\"\n";
+print "\n";
+
+if ( isForced() )
+{
+ print "WARNING:\n";
+ print "\n";
+ print " Using the '-force' flag will cause all gsi_openssh_setup files to\n";
+ print " be removed and replaced by new versions! Backup any critical\n";
+ print " SSH configuration files before you choose to continue!\n";
+ print "\n";
+}
+
+$response = query_boolean("Do you wish to continue with the setup package?","y");
+if ($response eq "n")
+{
+ print "\n";
+ print "Exiting gsi_openssh setup.\n";
+
+ exit 0;
+}
+
+print "\n";
+
+makeConfDir();
+copyPRNGFile();
+$keyhash = determineKeys();
+runKeyGen($keyhash->{gen});
+copyKeyFiles($keyhash->{copy});
+copyConfigFiles();
+
+my $metadata = new Grid::GPT::Setup(package_name => "gsi_openssh_setup");
+
+$metadata->finish();
+
+print "\n";
+print "Additional Notes:\n";
+print "\n";
+print " o I see that you have your GLOBUS_LOCATION environmental variable\n";
+print " set to:\n";
+print "\n";
+print " \"$gpath\"\n";
+print "\n";
+print " Remember to keep this variable set (correctly) when you want to\n";
+print " use the executables that came with this package.\n";
+print "\n";
+print " After that you may execute, for example:\n";
+print "\n";
+print " \$ . \$GLOBUS_LOCATION/etc/globus-user-env.sh\n";
+print "\n";
+print " to prepare your environment for running the gsi_openssh\n";
+print " executables.\n";
+
+if ( !getPrivilegeSeparation() )
+{
+ print "\n";
+ print " o For System Administrators:\n";
+ print "\n";
+ print " If you are going to run the GSI-OpenSSH server, we recommend\n";
+ print " enabling privilege separation. Although this package supports\n";
+ print " this feature, your system appears to require some additional\n";
+ print " configuration.\n";
+ print "\n";
+ print " From the file README.privsep, included as a part of the OpenSSH\n";
+ print " distribution:\n";
+ print "\n";
+ print " When privsep is enabled, during the pre-authentication\n";
+ print " phase sshd will chroot(2) to \"/var/empty\" and change its\n";
+ print " privileges to the \"sshd\" user and its primary group. sshd\n";
+ print " is a pseudo-account that should not be used by other\n";
+ print " daemons, and must be locked and should contain a \"nologin\"\n";
+ print " or invalid shell.\n";
+ print "\n";
+ print " You should do something like the following to prepare the\n";
+ print " privsep preauth environment:\n";
+ print "\n";
+ print " \# mkdir /var/empty\n";
+ print " \# chown root:sys /var/empty\n";
+ print " \# chmod 755 /var/empty\n";
+ print " \# groupadd sshd\n";
+ print " \# useradd -g sshd -c 'sshd privsep' -d /var/empty \\\n";
+ print " -s /bin/false sshd\n";
+ print "\n";
+ print " /var/empty should not contain any files.\n";
+}
+
+print "\n";
+print " o For more information about GSI-Enabled OpenSSH, visit:\n";
+print " <http://www.ncsa.uiuc.edu/Divisions/ACES/GSI/openssh/>\n";
+
+#
+# give the user a chance to read all of this output
+#
+
+print "\n";
+print "Press <return> to continue... ";
+$trash = <STDIN>;
+
+print "---------------------------------------------------------------------\n";
+print "$myname: Finished configuring package 'gsi_openssh'.\n";
+
+exit;
+
+#
+# subroutines
+#
+
+### initPRNGHash( )
+#
+# initialize the PRNG pathname hash
+#
+
+sub initPRNGHash( )
+{
+ #
+ # standard prng to executable conversion names
+ #
+
+ addPRNGCommand("\@PROG_LS\@", "ls");
+ addPRNGCommand("\@PROG_NETSTAT\@", "netstat");
+ addPRNGCommand("\@PROG_ARP\@", "arp");
+ addPRNGCommand("\@PROG_IFCONFIG\@", "ifconfig");
+ addPRNGCommand("\@PROG_PS\@", "ps");
+ addPRNGCommand("\@PROG_JSTAT\@", "jstat");
+ addPRNGCommand("\@PROG_W\@", "w");
+ addPRNGCommand("\@PROG_WHO\@", "who");
+ addPRNGCommand("\@PROG_LAST\@", "last");
+ addPRNGCommand("\@PROG_LASTLOG\@", "lastlog");
+ addPRNGCommand("\@PROG_DF\@", "df");
+ addPRNGCommand("\@PROG_SAR\@", "sar");
+ addPRNGCommand("\@PROG_VMSTAT\@", "vmstat");
+ addPRNGCommand("\@PROG_UPTIME\@", "uptime");
+ addPRNGCommand("\@PROG_IPCS\@", "ipcs");
+ addPRNGCommand("\@PROG_TAIL\@", "tail");
+
+ print "Determining paths for PRNG commands...\n";
+
+ $paths = determinePRNGPaths();
+
+ return;
+}
+
+### getDirectoryPaths( )
+#
+# return an array ref containing all of the directories in which we should search
+# for our listing of executable names.
+#
+
+sub getDirectoryPaths( )
+{
+ #
+ # read in the PATH environmental variable and prepend a set of 'safe'
+ # directories from which to test PRNG commands.
+ #
+
+ $path = $ENV{PATH};
+ $path = "/bin:/usr/bin:/sbin:/usr/sbin:/etc:" . $path;
+ @dirs = split(/:/, $path);
+
+ #
+ # sanitize each directory listed in the array.
+ #
+
+ @dirs = map {
+ $tmp = $_;
+ $tmp =~ s:/+:/:g;
+ $tmp =~ s:^\s+|\s+$::g;
+ $tmp;
+ } @dirs;