Skip to content

O
OpnSense
Commit 948b5bcc authored by Franco Fichtner's avatar Franco Fichtner
Browse files
Options

system: flip ssh settings for clarity

parent e2a82d38
Hide whitespace changes
Inline Side-by-side
Showing with 58 additions and 41 deletions
src/etc/config.xml
View file @ 948b5bcc
......@@ -202,9 +202,6 @@
<interval>monthly</interval>
</bogons>
<kill_states/>
<ssh>
<sshdkeyonly/>
</ssh>
</system>
<interfaces>
<wan>
......
src/etc/inc/config.console.inc
View file @ 948b5bcc
......@@ -145,7 +145,7 @@ EOD;
return;
} while (!isset($wanif));
$config['system']['enablesshd'] = 'enabled';
$config['system']['ssh']['enabled'] = 'enabled';
$key = 'y';
} else { //Manually assign interfaces
......
src/etc/inc/filter.inc
View file @ 948b5bcc
......@@ -3562,8 +3562,9 @@ function filter_get_antilockout_ports($wantarray = false) {
if (($config['system']['webgui']['protocol'] == "https") && !isset($config['system']['webgui']['disablehttpredirect']) && ($guiport != "80"))
$lockoutports[] = "80";
if (isset($config['system']['enablesshd']))
if (isset($config['system']['ssh']['enabled'])) {
$lockoutports[] = empty($config['system']['ssh']['port']) ? "22" : $config['system']['ssh']['port'];
}
if ($wantarray)
return $lockoutports;
......
src/etc/inc/globals.inc
View file @ 948b5bcc
......@@ -48,7 +48,7 @@ $g = array(
"product_copyright_owner" => "Deciso B.V.",
"product_copyright_years" => "2014 - 2015",
"product_copyright_url" => "https://www.deciso.com/",
"latest_config" => "11.1",
"latest_config" => "11.2",
"wireless_regex" => "/^(ndis|wi|ath|an|ral|ural|iwi|wlan|rum|run|bwn|zyd|mwl|bwi|ipw|iwn|malo|uath|upgt|urtw|wpi)/",
);
......
src/etc/inc/service-utils.inc
View file @ 948b5bcc
......@@ -147,10 +147,10 @@ if (!function_exists('get_services')) {
$services[] = $pconfig;
}
if (isset($config['system']['enablesshd'])) {
if (isset($config['system']['ssh']['enabled'])) {
$pconfig = array();
$pconfig['name'] = "sshd";
$pconfig['description'] = gettext("Secure Shell Daemon");
$pconfig['name'] = 'sshd';
$pconfig['description'] = gettext('Secure Shell Daemon');
$services[] = $pconfig;
}
......
src/etc/inc/upgrade_config.inc
View file @ 948b5bcc
......@@ -3245,12 +3245,10 @@ function upgrade_109_to_110() {
}
}
function upgrade_110_to_111() {
function upgrade_110_to_111()
{
global $config;
/* OPNsense modifications on top of this version */
$config['theme'] = 'opnsense';
/* Make sure unbound user exist */
mwexec('/usr/sbin/pw groupadd -n unbound -g 59', true);
mwexec('/usr/sbin/pw useradd -n unbound -c "Unbound DNS Resolver" -d /var/unbound -s /usr/sbin/nologin -u 59 -g 59', true);
......@@ -3372,3 +3370,21 @@ function upgrade_110_to_111() {
unset($pkg, $new);
}
function upgrade_111_to_112()
{
global $config;
$config['theme'] = 'opnsense';
if (isset($config['system']['ssh']['sshdkeyonly'])) {
unset($config['system']['ssh']['sshdkeyonly']);
} else {
$config['system']['ssh']['passwordauth'] = true;
}
if (isset($config['system']['sshdenable'])) {
$config['system']['ssh']['enabled'] = true;
unset($config['system']['sshdenable']);
}
}
src/etc/rc.sshd
View file @ 948b5bcc
......@@ -36,7 +36,7 @@ require_once('shaper.inc');
killbyname('sshd');
if (!isset($config['system']['enablesshd'])) {
if (!isset($config['system']['ssh']['enabled'])) {
return;
}
......@@ -103,12 +103,12 @@ $sshconf .= "Subsystem\tsftp\tinternal-sftp\n";
if (isset($config['system']['ssh']['permitrootlogin'])) {
$sshconf .= "PermitRootLogin yes\n";
}
if (isset($config['system']['ssh']['sshdkeyonly'])) {
$sshconf .= "PasswordAuthentication no\n";
$sshconf .= "ChallengeResponseAuthentication no\n";
} else {
$sshconf .= "PasswordAuthentication yes\n";
if (isset($config['system']['ssh']['passwordauth'])) {
$sshconf .= "ChallengeResponseAuthentication yes\n";
$sshconf .= "PasswordAuthentication yes\n";
} else {
$sshconf .= "ChallengeResponseAuthentication no\n";
$sshconf .= "PasswordAuthentication no\n";
}
/* Write the new sshd config file */
......
src/www/system_advanced_admin.php
View file @ 948b5bcc
......@@ -49,9 +49,9 @@ $pconfig['althostnames'] = $config['system']['webgui']['althostnames'];
$pconfig['enableserial'] = $config['system']['enableserial'];
$pconfig['serialspeed'] = $config['system']['serialspeed'];
$pconfig['primaryconsole'] = $config['system']['primaryconsole'];
$pconfig['enablesshd'] = $config['system']['enablesshd'];
$pconfig['enablesshd'] = $config['system']['ssh']['enabled'];
$pconfig['sshport'] = $config['system']['ssh']['port'];
$pconfig['sshdkeyonly'] = isset($config['system']['ssh']['sshdkeyonly']);
$pconfig['passwordauth'] = isset($config['system']['ssh']['passwordauth']);
$pconfig['sshdpermitrootlogin'] = isset($config['system']['ssh']['permitrootlogin']);
$pconfig['quietlogin'] = isset($config['system']['webgui']['quietlogin']);
......@@ -89,10 +89,11 @@ if ($_POST) {
if(!is_port($_POST['sshport']))
$input_errors[] = gettext("You must specify a valid port number");
if($_POST['sshdkeyonly'] == "yes")
$config['system']['ssh']['sshdkeyonly'] = "enabled";
else if (isset($config['system']['ssh']['sshdkeyonly']))
unset($config['system']['ssh']['sshdkeyonly']);
if ($_POST['passwordauth'] == 'yes') {
$config['system']['ssh']['passwordauth'] = 'enabled';
} elseif (isset($config['system']['ssh']['passwordauth'])) {
unset($config['system']['ssh']['passwordauth']);
}
if($_POST['sshdpermitrootlogin'] == "yes")
$config['system']['ssh']['permitrootlogin'] = "enabled";
......@@ -176,17 +177,19 @@ if ($_POST) {
else
unset($config['system']['webgui']['althostnames']);
$sshd_enabled = $config['system']['enablesshd'];
if($_POST['enablesshd'])
$config['system']['enablesshd'] = "enabled";
else
unset($config['system']['enablesshd']);
$sshd_enabled = $config['system']['ssh']['enabled'];
if ($_POST['enablesshd']) {
$config['system']['ssh']['enabled'] = 'enabled';
} else {
unset($config['system']['ssh']['enabled']);
}
$sshd_keyonly = isset($config['system']['ssh']['sshdkeyonly']);
if ($_POST['sshdkeyonly'])
$config['system']['ssh']['sshdkeyonly'] = true;
else if (isset($config['system']['ssh']['sshdkeyonly']))
unset($config['system']['ssh']['sshdkeyonly']);
$sshd_passwordauth = isset($config['system']['ssh']['passwordauth']);
if ($_POST['passwordauth']) {
$config['system']['ssh']['passwordauth'] = true;
} else if (isset($config['system']['ssh']['passwordauth'])) {
unset($config['system']['ssh']['passwordauth']);
}
$sshd_port = $config['system']['ssh']['port'];
if ($_POST['sshport'])
......@@ -197,8 +200,8 @@ if ($_POST) {
if (!isset($_POST['sshdpermitrootlogin']) && isset($config['system']['ssh']['permitrootlogin']))
unset($config['system']['ssh']['permitrootlogin']);
if (($sshd_enabled != $config['system']['enablesshd']) ||
($sshd_keyonly != $config['system']['ssh']['sshdkeyonly']) ||
if (($sshd_enabled != $config['system']['ssh']['enabled']) ||
($sshd_passwordauth != $config['system']['ssh']['passwordauth']) ||
($sshd_port != $config['system']['ssh']['port']) ||
($pconfig['system']['ssh']['permitrootlogin'] != isset($config['system']['ssh']['permitrootlogin'])) ) {
$restart_sshd = true;
......@@ -501,10 +504,10 @@ include("head.inc");
<tr>
<td width="22%" valign="top" class="vncell"><?=gettext("Authentication Method"); ?></td>
<td width="78%" class="vtable">
<input name="sshdkeyonly" type="checkbox" id="sshdkeyonly" value="yes" <?php if ($pconfig['sshdkeyonly']) echo "checked=\"checked\""; ?> />
<strong><?=gettext("Disable password login for Secure Shell (RSA/DSA key only)"); ?></strong>
<input name="passwordauth" type="checkbox" id="passwordauth" value="yes" <?php if ($pconfig['passwordauth']) echo "checked=\"checked\""; ?> />
<strong><?=gettext("Enable password login for Secure Shell"); ?></strong>
<br />
<?=gettext("When enabled, authorized keys need to be configured for each"); ?>
<?=gettext("When disabled, authorized keys need to be configured for each"); ?>
<a href="system_usermanager.php"><?=gettext("user"); ?></a>
<?=gettext("that has been granted secure shell access."); ?>
</td>
......@@ -603,7 +606,7 @@ if ($restart_sshd) {
killbyname("sshd");
log_error(gettext("secure shell configuration has changed. Stopping sshd."));
if ($config['system']['enablesshd']) {
if ($config['system']['ssh']['enabled']) {
log_error(gettext("secure shell configuration has changed. Restarting sshd."));
send_event("service restart sshd");
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment

Technounit-GROUP 2023