| 9 | ) |
| 10 | |
| 11 | func cmdAlignSSHD() { |
| 12 | fs := flag.NewFlagSet("sshd-align", flag.ExitOnError) |
| 13 | host := fs.String("host", "", "target host") |
| 14 | sudo := fs.Bool("sudo", false, "use sudo on remote") |
| 15 | fs.Parse(os.Args[2:]) |
| 16 | if *host == "" { fatal(errors.New("host is required")) } |
| 17 | s := "" |
| 18 | if *sudo { s = "sudo " } |
| 19 | script := `set -e |
| 20 | CFG=/etc/ssh/sshd_config |
| 21 | TS=$(date +%s) |
| 22 | ` + s + `cp "$CFG" "$CFG.bak.$TS" || cp "$CFG" "$CFG.bak.$TS" |
| 23 | ` + s + `grep -qi '^PubkeyAuthentication' "$CFG" && ` + s + `sed -i -E 's/^#?PubkeyAuthentication.*/PubkeyAuthentication yes/i' "$CFG" || echo 'PubkeyAuthentication yes' | ` + s + `tee -a "$CFG" >/dev/null |
| 24 | ` + s + `grep -qi '^PubkeyAcceptedAlgorithms' "$CFG" && ` + s + `sed -i -E 's/^#?PubkeyAcceptedAlgorithms.*/PubkeyAcceptedAlgorithms +rsa-sha2-512,rsa-sha2-256/i' "$CFG" || echo 'PubkeyAcceptedAlgorithms +rsa-sha2-512,rsa-sha2-256' | ` + s + `tee -a "$CFG" >/dev/null |
| 25 | ` + s + `grep -qi '^PubkeyAcceptedKeyTypes' "$CFG" && ` + s + `sed -i -E 's/^#?PubkeyAcceptedKeyTypes.*/PubkeyAcceptedKeyTypes +rsa-sha2-512,rsa-sha2-256/i' "$CFG" || echo 'PubkeyAcceptedKeyTypes +rsa-sha2-512,rsa-sha2-256' | ` + s + `tee -a "$CFG" >/dev/null |
| 26 | ` + s + `systemctl reload sshd || ` + s + `systemctl reload ssh || ` + s + `service ssh reload || ` + s + `service sshd reload || kill -HUP $(pidof sshd) || true |
| 27 | ` |
| 28 | cmd := exec.Command("ssh", *host, "bash", "-s") |
| 29 | cmd.Stdin = strings.NewReader(script) |
| 30 | cmd.Stdout = os.Stdout |
| 31 | cmd.Stderr = os.Stderr |
| 32 | if err := cmd.Run(); err != nil { fatal(err) } |
| 33 | } |