#! /bin/sh
set -e

# /etc/init.d/ssh: start and stop the OpenBSD "secure shell(tm)" daemon

test -x /usr/sbin/sshd || exit 0
( /usr/sbin/sshd -\? 2>&1 | grep -q OpenSSH ) 2>/dev/null || exit 0

if test -f /etc/default/ssh; then
    . /etc/default/ssh
fi

check_for_no_start() {
    # forget it if we're trying to start, and /etc/ssh/sshd_not_to_be_run exists
    if [ -e /etc/ssh/sshd_not_to_be_run ]; then 
	echo "OpenBSD Secure Shell server not in use (/etc/ssh/sshd_not_to_be_run)"
	exit 0
    fi
}

check_privsep_dir() {
    # Create the PrivSep empty dir if necessary
    if [ ! -d /var/run/sshd ]; then
	mkdir /var/run/sshd
	chmod 0755 /var/run/sshd
    fi
}

check_config() {
    if [ ! -e /etc/ssh/sshd_not_to_be_run ]; then
	/usr/sbin/sshd -t || exit 1
    fi
}

check_keys(){
	export OPENSSL_FIPS=1
	if [ ! -f "/etc/ssh/ssh_host_rsa_key" ]
	then
#		echo "SSH Host Key file ssh_host_rsa_key don't exist. Creating..."
		/usr/bin/ssh-keygen -q -t rsa -f /etc/ssh/ssh_host_rsa_key -N ""

# Copy the keys over to the /mnt/logs
		touch /mnt/logs/etc/copyStart
		cp -fp /etc/ssh/ssh_host_rsa_key /mnt/logs/etc/ssh/.
		cp -fp /etc/ssh/ssh_host_rsa_key.pub /mnt/logs/etc/ssh/.
		rm -f /mnt/logs/etc/copyStart

		#Renaming newly generated Host RSA keys if FIPS is enabled so as to avoid compatibility issues with OpenSSH 8.7P1
		if [ -f "/mnt/logs/etc/rlm_config_from_filer" ]
		then
			fips_mode=$(grep ^fipsenabled /mnt/logs/etc/rlm_config_from_filer | cut -d" " -f2)
			if [ "$fips_mode" == "yes" ]
			then
				echo "FIPS is enabled, so disabling Host RSA keys"
				mv /etc/ssh/ssh_host_rsa_key /etc/ssh/ssh_host_rsa_key_bak
				mv /etc/ssh/ssh_host_rsa_key.pub /etc/ssh/ssh_host_rsa_key.pub_bak  	
			fi
		fi
	fi

	if [ ! -f "/etc/ssh/ssh_host_dsa_key" ]
	then
		/usr/bin/ssh-keygen -q -t dsa -f /etc/ssh/ssh_host_dsa_key -N ""

# Copy the keys over to the /mnt/logs
		touch /mnt/logs/etc/copy_dsa_key_Start
		cp -fp /etc/ssh/ssh_host_dsa_key /mnt/logs/etc/ssh/.
		cp -fp /etc/ssh/ssh_host_dsa_key.pub /mnt/logs/etc/ssh/.
		rm -f /mnt/logs/etc/copy_dsa_key_Start
	fi

	if [ ! -f "/etc/ssh/ssh_host_ecdsa_key" ]
	then
		/usr/bin/ssh-keygen -q -t ecdsa -f /etc/ssh/ssh_host_ecdsa_key -N  ""

		# Copy the keys over to the /mnt/logs
		touch /mnt/logs/etc/copy_ssh_host_ecdsa_Start
		cp -fp /etc/ssh/ssh_host_ecdsa_key /mnt/logs/etc/ssh/.
		cp -fp /etc/ssh/ssh_host_ecdsa_key.pub /mnt/logs/etc/ssh/.
		rm -f /mnt/logs/etc/copy_ssh_host_ecdsa_Start
	fi

	if [ ! -f "/etc/ssh/ssh_host_ed25519_key" ]
	then
		/usr/bin/ssh-keygen -q -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N  ""

		# Copy the keys over to the /mnt/logs
		touch /mnt/logs/etc/copy_ssh_host_ed25519_Start
		cp -fp /etc/ssh/ssh_host_ed25519_key /mnt/logs/etc/ssh/.
		cp -fp /etc/ssh/ssh_host_ed25519_key.pub /mnt/logs/etc/ssh/.
		rm -f /mnt/logs/etc/copy_ssh_host_ed25519_Start
	fi
}

export PATH="${PATH:+$PATH:}/usr/sbin:/sbin"

case "$1" in
  start)
	check_for_no_start
	check_privsep_dir
	check_keys
        echo -n "Starting OpenBSD Secure Shell server: sshd"
	start-stop-daemon --start --quiet --pidfile /var/run/sshd.pid --exec /usr/sbin/sshd -- $SSHD_OPTS
        echo "."
	;;
  stop)
        echo -n "Stopping OpenBSD Secure Shell server: sshd"
	start-stop-daemon --stop --quiet --oknodo --pidfile /var/run/sshd.pid
        echo "."
	;;

  reload|force-reload)
	check_for_no_start
	check_config
        echo -n "Reloading OpenBSD Secure Shell server's configuration"
	start-stop-daemon --stop --signal 1 --quiet --oknodo --pidfile /var/run/sshd.pid --exec /usr/sbin/sshd
	echo "."
	;;

  restart)
	check_config
        echo -n "Restarting OpenBSD Secure Shell server: sshd"
	start-stop-daemon --stop --quiet --oknodo --retry 30 --pidfile /var/run/sshd.pid
	check_for_no_start
	check_privsep_dir
	start-stop-daemon --start --quiet --pidfile /var/run/sshd.pid --exec /usr/sbin/sshd -- $SSHD_OPTS
	echo "."
	;;

  *)
	echo "Usage: /etc/init.d/ssh {start|stop|reload|force-reload|restart}"
	exit 1
esac

exit 0
