pfSense

#!/usr/local/bin/php-cgi -f

/*

 *

 * part of pfSense (https://www.pfsense.org)

 * Copyright (c) 2013-2016 Electric Sheep Fencing

 *

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

require_once("globals.inc");

require_once("config.inc");

require_once("functions.inc");

require_once("shaper.inc");

}

$keyfiles = array();

	$keyfiles[] = "ssh_host_{$key['suffix']}key.pub";

}

/*    if any of these files are 0 bytes then they are corrupted.

 *    remove them

 */

foreach ($keyfiles as $f2c) {

	if (!file_exists("{$sshConfigDir}/{$f2c}") || filesize("{$sshConfigDir}/{$f2c}") == 0) {

		/* Make sure we remove both files */

		unlink_if_exists($sshConfigDir . '/' . basename($f2c, ".pub"));

		unlink_if_exists($sshConfigDir . '/' . $f2c);

	}

}

if (!is_dir("/var/empty")) {

	/* make ssh home directory */

	mkdir("/var/empty", 0555);

}

if (!file_exists("/var/log/lastlog")) {

	/* Login related files. */

	@touch("/var/log/lastlog");

}

	$sshport = config_get_path('system/ssh/port');

	$sshport = 22;

}

/* Include default configuration for pfSense */

/* Taken from https://stribika.github.io/2015/01/04/secure-secure-shell.html */

$sshconf = "# This file is automatically generated at startup\n";

$sshconf .= "KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256\n";

/* Run the server on another port if we have one defined */

$sshconf .= "Port $sshport\n";

/* Only allow protocol 2, because we say so */

$sshconf .= "Protocol 2\n";

}

	$permitroot = 'no';

} else {

	$permitroot = 'yes';

}

$sshconf .= "PermitRootLogin {$permitroot}\n";

	$sshconf .= "PasswordAuthentication yes\n";

	$sshconf .= "PubkeyAuthentication yes\n";

	$sshconf .= "UsePAM yes\n";

	$sshconf .= "ChallengeResponseAuthentication no\n";

	$sshconf .= "PasswordAuthentication no\n";

	$sshconf .= "PubkeyAuthentication yes\n";

	$sshconf .= "PasswordAuthentication yes\n";

	$sshconf .= "PubkeyAuthentication yes\n";

}

$sshconf .= "UseDNS no\n";

$sshconf .= "LoginGraceTime 30s\n";

/* Hide FreeBSD version */

$sshconf .= "VersionAddendum none\n";

} else {

	$sshconf .= "AllowAgentForwarding no\n";

}

$sshconf .= "Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr\n";

$sshconf .= "Subsystem\tsftp\t/usr/libexec/sftp-server\n";

/* Apply package SSHDCond settings if config file exists */

if (file_exists("/etc/sshd_extra")) {

	$fdExtra = fopen("/etc/sshd_extra", 'r');

	$szExtra = fread($fdExtra, 1048576); // Read up to 1MB from extra file

	$sshconf .= $szExtra;

	fclose($fdExtra);

}

/* Write the new sshd config file */

@file_put_contents("{$sshConfigDir}/sshd_config", $sshconf);

/* mop up from a badly implemented ssh keys -> cf backup */

	config_del_path('ssh/dsa_key');

	config_del_path('ssh/ecdsa_key');

	config_del_path('ssh/ed25519_key');

	config_del_path('ssh/rsa_key');

	config_del_path('ssh/rsa1_key');

	config_del_path('ssh/dsa');

	config_del_path('ssh/rsa');

	config_del_path('ssh/rsa1');

	config_del_path('ssh/ak');

}

/* are we already running?  if so exit */

}

// Check for all needed key files. If any are missing, the keys need to be regenerated.

$generate_keys = array();

	    !file_exists("{$sshConfigDir}/ssh_host_{$key['suffix']}key.pub")) {

		$generate_keys[] = $key;

	}

}

if (!empty($generate_keys)) {

	/* remove previous keys and regen later */

	echo " Generating Keys:\n";

	foreach ($generate_keys as $key) {

		$_gb = exec("/usr/bin/nice -n20 /usr/bin/ssh-keygen -t {$key['type']} -b 4096 -N '' -f {$sshConfigDir}/ssh_host_{$key['suffix']}key");

	}

	clear_subsystem_dirty('sshdkeys');

if ($sshd_pid <> "") {

	echo "stopping ssh process $sshd_pid \n";

	@posix_kill($sshd_pid, SIGTERM);

}

/* Launch new server process */

$status = mwexec("/usr/sbin/sshd");

if ($status <> 0) {

	file_notice("sshd_startup", "SSHD failed to start.", "SSHD Daemon", "");

	echo "error!\n";

} else {

	echo "done.\n";

}