#!/bin/sh
#
#    Copyright (c) 1996-2004 Brocade Communications Systems, Inc.
#    All rights reserved.
#
#    Initialization script to start/stop sshd.
#

# Source common library
. /etc/init.d/functions

SSHD=/usr/sbin/sshd
CIPHERS="Ciphers=3des-cbc,aes128-cbc,aes192-cbc,aes256-cbc"
MACS="Macs=hmac-sha1"
IPTABLES="/sbin/iptables"
IP6TABLES="/sbin/ip6tables"
AWK="/bin/awk"
GREP="/bin/grep"
SSHUTIL=/fabos/sbin/sshutil
WC="/usr/bin/wc"
CAT="/bin/cat"
CUT="/usr/bin/cut"
SED="/bin/sed"
RM="/bin/rm"
HOST_KEY_DIR=/etc
HOST_DSA_KEY=ssh_host_dsa_key
SSHD_CONFIG=/etc/sshd_config
TMP_SSHD_CONFIG_FILE=$SSHD_CONFIG.tmp
CONFIG=/fabos/cliexec/config

#Check for FIPS mode
checkFipsMode() {
    	# "config get" for fips mode returns value only if called from
   	# default VF. So, temporarily set FABOS_SWITCHNO to 0 and then
    	# revert it back to its original value after "config get"
    	FABOS_SWITCHNO_TEMP=$FABOS_SWITCHNO
    	FABOS_SWITCHNO=0
    	retVal1=`/fabos/cliexec/config get fips.mode 2`
    	retVal2=`/fabos/cliexec/config get fips.simulate 2`
    	FABOS_SWITCHNO=$FABOS_SWITCHNO_TEMP
	retVal=0

	if [ $retVal1 -eq 1 ]; then
		return $retVal1
	elif [ $retVal2 -eq 1 ];  then
		return $retVal2
	else 
		return $retVal
	fi

}
case "$1" in

'start')
    $ECHO "Secure shell daemon:\c"
	config_change=0
	if $CHECK sshd; then
	    ${KILLALL} sshd
	    if test -x $SSHD; then
			checkFipsMode
			fipsmode=$?
			#if [ "$fipsmode" == "1" ]; then
			#	$SSHD -o $CIPHERS -o $MACS `cat ${CONFIGDIR}/sshd.options 2> ${NULL}`
			#else
				# If no host key present on switch and Telnet is blocked, generate 
				# a rsa host key
			totalhostkeys=`$SSHUTIL showhostkey | $WC -l`
			if [ $totalhostkeys -eq 0 ]; then
				ruleAct=`$IPTABLES -L telnet0 | $GREP dpt:telnet | $AWK 'NR==1{print $1}'`
				if [ "$ruleAct" != "ACCEPT" ]; then
					$SSHUTIL genhostkey -rsa
				else
					ruleAct=`$IP6TABLES -L telnet0 | $GREP dpt:telnet | $AWK 'NR==1{print $1}'`
					if [ "$ruleAct" != "ACCEPT" ]; then
						$SSHUTIL genhostkey -rsa
					fi
				fi
			fi

			# 9.2.0: Check for DSA key since we no longer auto-generate this key
			HOST="HostKey /etc/ssh_host_dsa_key"
			if [ -e $HOST_KEY_DIR/$HOST_DSA_KEY ]; then
				if ! $GREP $HOST_DSA_KEY $SSHD_CONFIG |$GREP -v "#" >/dev/null; then
					#"DSA key is missing from config file"
					$SED -e "s+#$HOST+$HOST+" $SSHD_CONFIG > $TMP_SSHD_CONFIG_FILE
					$CAT $TMP_SSHD_CONFIG_FILE > $SSHD_CONFIG
					config_change=1
				fi	
			elif $GREP "$HOST" $SSHD_CONFIG |$GREP -v "#" >/dev/null; then 
				        #"DSA key need to be deleted from ssh config file"
				        HOST="HostKey /etc/ssh_host_dsa_key"
				        $SED -e "s+$HOST+#$HOST+" $SSHD_CONFIG > $TMP_SSHD_CONFIG_FILE
				        $CAT $TMP_SSHD_CONFIG_FILE > $SSHD_CONFIG
					config_change=1
					
			fi

			if [[ $config_change == 1 ]];then
				$RM $TMP_SSHD_CONFIG_FILE
				$CONFIG save $SSHD_CONFIG
			fi

			$SSHD `$CAT ${CONFIGDIR}/sshd.options 2> ${NULL}`
			/bin/echo "*** SSH START/RESTART FROM SYSINT ***" >> /var/log/user.log
			/bin/echo "SYS_INIT_SSHD_PS : $(/bin/ps -eaf | /bin/grep "sbin\/sshd")" >>  /var/log/user.log
			/bin/echo "SSHD.PID VAL: $(/bin/cat  /var/run/sshd.pid 2>/dev/null)"  >>  /var/log/user.log
			/bin/echo "SSHD.PID TIMESTAMP: $(/bin/ls -l /var/run/sshd.pid 2>/dev/null)"  >>  /var/log/user.log
			/bin/echo "***END ****" >> /var/log/user.log
			#fi
			$ECHO " sshd\c"
	    fi
	fi

    $ECHO "."
    ;;

'stop')
    ${KILLALL} sshd
    ;;    

*)
    echo "usage: $0 {start | stop}"
    ;;

esac
