o Update version number of the package to 1.1.

[gssapi-openssh.git] / setup / setup-openssh.pl

diff --git a/setup/setup-openssh.pl b/setup/setup-openssh.pl
index 4e4d1ef288abab889b0f36efc488c2656663407c..8ffc2d05d89e96557af052f7f957ebe40f066d6e 100644 (file)
--- a/setup/setup-openssh.pl
+++ b/setup/setup-openssh.pl
@@ -105,6 +105,12 @@ GetOptions(
             'verbose' => \$verbose,
           ) or pod2usage(2);
 
+#
+# miscellaneous initialization functions
+#
+
+setPrivilegeSeparation(0);
+
 #
 # main execution.  This should find its way into a subroutine at some future
 # point.
@@ -120,7 +126,7 @@ print "I will copy them into \$GLOBUS_LOCATION/etc/ssh.  Otherwise, I will\n";
 print "generate them for you.)\n";
 print "\n";
 print "    Jacobim Mugatu says,\n";
-print "    \t\"Utopian Prime Minister Bad!  GSI-OpenSSH Good!\"\n";
+print "        \"Utopian Prime Minister Bad!  GSI-OpenSSH Good!\"\n";
 print "\n";
 
 if ( isForced() )
@@ -161,14 +167,14 @@ print "\n";
 print "  o I see that you have your GLOBUS_LOCATION environmental variable\n";
 print "    set to:\n";
 print "\n";
-print "    \t\"$gpath\"\n";
+print "        \"$gpath\"\n";
 print "\n";
 print "    Remember to keep this variable set (correctly) when you want to\n";
 print "    use the executables that came with this package.\n";
 print "\n";
 print "    After that you may execute, for example:\n";
 print "\n";
-print "    \t\$ . \$GLOBUS_LOCATION/etc/globus-user-env.sh\n";
+print "        \$ . \$GLOBUS_LOCATION/etc/globus-user-env.sh\n";
 print "\n";
 print "    to prepare your environment for running the gsi_openssh\n";
 print "    executables.\n";
@@ -183,16 +189,27 @@ if ( !getPrivilegeSeparation() )
     print "    this feature, your system appears to require some additional\n";
     print "    configuration.\n";
     print "\n";
-    print "    Perform the following steps to enable privilege separation:\n";
+    print "    From the file README.privsep, included as a part of the OpenSSH\n";
+    print "    distribution:\n";
     print "\n";
-    print "    \t1) If the system user 'sshd' does not already exist, add a\n";
-    print "    \t   user with that username.\n";
+    print "        When privsep is enabled, during the pre-authentication\n";
+    print "        phase sshd will chroot(2) to \"/var/empty\" and change its\n";
+    print "        privileges to the \"sshd\" user and its primary group.  sshd\n";
+    print "        is a pseudo-account that should not be used by other\n";
+    print "        daemons, and must be locked and should contain a \"nologin\"\n";
+    print "        or invalid shell.\n";
     print "\n";
-    print "    \t2) Verify that /var/empty exists, is owned by root, and has\n";
-    print "    \t   a mode of 0700.\n";
+    print "        You should do something like the following to prepare the\n";
+    print "        privsep preauth environment:\n";
     print "\n";
-    print "    \t3) Enable the feature UsePrivilegeSeparation in\n";
-    print "    \t   \$GLOBUS_LOCATION/etc/ssh/sshd_config.\n";
+    print "            \# mkdir /var/empty\n";
+    print "            \# chown root:sys /var/empty\n";
+    print "            \# chmod 755 /var/empty\n";
+    print "            \# groupadd sshd\n";
+    print "            \# useradd -g sshd -c 'sshd privsep' -d /var/empty \\\n";
+    print "            -s /bin/false sshd\n";
+    print "\n";
+    print "        /var/empty should not contain any files.\n";
 }
 
 print "\n";
@@ -207,7 +224,6 @@ print "\n";
 print "Press <return> to continue... ";
 $trash = <STDIN>;
 
-print "\n";
 print "---------------------------------------------------------------------\n";
 print "$myname: Finished configuring package 'gsi_openssh'.\n";
 
@@ -308,9 +324,9 @@ sub copyPRNGFile
     my($mode, $uid, $gid);
     my($data);
 
-    if ( isPresent("/dev/random") && !isForced() )
+    if ( isPresent("$sysconfdir/ssh_prng_cmds") && !isForced() )
     {
-        printf("/dev/random found and not forced.  Not installing ssh_prng_cmds...\n");
+        printf("ssh_prng_cmds found and not forced.  Not installing ssh_prng_cmds...\n");
         return;
     }
 
@@ -788,7 +804,7 @@ sub copySSHDConfigFile
     # check to see whether we should enable privilege separation
     #
 
-    if ( userExists("sshd") && ( -d "/var/empty" ) && ( getMode("/var/empty") eq "0700" ) )
+    if ( userExists("sshd") && ( -d "/var/empty" ) && ( getOwnerID("/var/empty") eq 0 ) )
     {
         setPrivilegeSeparation(1);
     }
@@ -831,7 +847,7 @@ sub copySSHDConfigFile
     # set the sftp directive
     #
 
-    $text = "Subsystem\tsftp\t$gpath/libxec/sftp-server";
+    $text = "Subsystem\tsftp\t$gpath/libexec/sftp-server";
     $data =~ s:^[\s|#]*Subsystem\s+sftp\s+.*$:$text:gm;
 
     #
@@ -981,6 +997,7 @@ sub copyFile
 sub copySXXScript
 {
     my($in, $out) = @_;
+    my($tmpgpath);
 
     if ( !isReadable($in) )
     {
@@ -993,8 +1010,20 @@ sub copySXXScript
         return;
     }
 
+    #
+    # clean up any junk in the globus path variable
+    #
+
+    $tmpgpath = $gpath;
+    $tmpgpath =~ s:/+:/:g;
+    $tmpgpath =~ s:([^/]+)/$:\1:g;
+
+    #
+    # read in the script, substitute globus location, then write it back out
+    #
+
     $data = readFile($in);
-    $data =~ s|\@GLOBUS_LOCATION\@|$gpath|g;
+    $data =~ s|\@GLOBUS_LOCATION\@|$tmpgpath|g;
     writeFile($out, $data);
     action("chmod 755 $out");
 }
@@ -1143,6 +1172,25 @@ sub absolutePath
     return $file;
 }
 
+### getOwnerID( $file )
+#
+# return the uid containing the owner ID of the given file.
+#
+
+sub getOwnerID
+{
+    my($file) = @_;
+    my($uid);
+
+    #
+    # call stat() to get the mode of the file
+    #
+
+    $uid = (stat($file))[4];
+
+    return $uid;
+}
+
 ### getMode( $file )
 #
 # return a string containing the mode of the given file.