Improve ssh keys security

[hvlinux.git] / stage3 / bootscripts / sshd

diff --git a/stage3/bootscripts/sshd b/stage3/bootscripts/sshd
index 026f04d..66d635c 100755 (executable)
--- a/stage3/bootscripts/sshd
+++ b/stage3/bootscripts/sshd
@@ -9,7 +9,11 @@ source /etc/sysconfig/network/network-parameters
 
 log_script_name "$0 $*"
 
-SSHD="/usr/sbin/sshd -4"
+DAEMON="/usr/sbin/sshd"
+DAEMON_DESC="SSH server"
+DAEMON_OPTS="-4"
+
+KEYLEN_BITS=4096
 
 # Check if SSH server is desired
 if [ "x${SSH_SERVER_ENA}" != "xyes" -a "x${SSH_SERVER_ENA}" != "xYes" -a "x${SSH_SERVER_ENA}" != "xYES" ]; then
@@ -17,17 +21,13 @@ if [ "x${SSH_SERVER_ENA}" != "xyes" -a "x${SSH_SERVER_ENA}" != "xYes" -a "x${SSH
 fi
 
 gen_keys() {
-    if [ ! -e /etc/ssh/ssh_host_key ] ; then
-       echo "Generating Hostkey..."
-       /usr/bin/ssh-keygen -t rsa1 -b 1024 -f /etc/ssh/ssh_host_key -N ''
-    fi
-    if [ ! -e /etc/ssh/ssh_host_dsa_key ] ; then
-       echo "Generating DSA-Hostkey..."
-       /usr/bin/ssh-keygen -d -f /etc/ssh/ssh_host_dsa_key -N ''
-    fi
     if [ ! -e /etc/ssh/ssh_host_rsa_key ] ; then
-       echo "Generating RSA-Hostkey..."
-       /usr/bin/ssh-keygen -t rsa -f /etc/ssh/ssh_host_rsa_key -N ''
+       echo "Generating RSA hostkey..."
+       /usr/bin/ssh-keygen -t rsa -b ${KEYLEN_BITS} -f /etc/ssh/ssh_host_rsa_key -N ''
+    fi
+    if [ ! -e /etc/ssh/ssh_host_ed25519_key ] ; then
+       echo "Generating Ed25519 hostkey..."
+        /usr/bin/ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N ''
     fi
 }
 
@@ -44,22 +44,22 @@ sshd_start() {
     if [ $? -ne 0 ]; then
        exit ${EXIT_CODE_FAILURE}
     else
-       loadproc ${SSHD}
+       loadproc ${DAEMON} ${DAEMON_OPTS}
     fi
 }
 
 # See how we were called
 case "$1" in
     start)
-       cmd_run_log_box_warn "Starting sshd" sshd_start
+       cmd_run_log_box_warn "${DAEMON_DESC} start" sshd_start
        ;;
 
     stop)
-       cmd_run_log_box_warn "Stopping sshd" killproc sshd
+       cmd_run_log_box_warn "${DAEMON_DESC} stop" killproc ${DAEMON}
        ;;
 
     reload)
-       reloadproc sshd
+       reloadproc ${DAEMON}
        ;;
 
     restart)
@@ -69,7 +69,7 @@ case "$1" in
        ;;
 
     status)
-       statusproc sshd
+       statusproc ${DAEMON}
        ;;
 
     *)