#
# The template
#
use strict;
use libinstall;
use installvars;

sub Install($$$)
{
    my ($server, $isupdate, $impotent) = @_;

    # Replace if this script does an update for ip/domain.
    return 0
	if ($isupdate);

    Phase "ssh", "Allowing root ssh", sub {
	Phase "sshdconfig", "Permitting root login through ssh", sub {
	    DoneIfEdited($SSHD_CONFIG);
	    # modern versions of FBSD explicitly turn off proto 1 by default
	    if ($FBSD_MAJOR > 6) {
		ExecQuietFatal("sed -i.orig -e 's/Protocol/#Protocol/' ".
			       "$SSHD_CONFIG");
	    }
	    my @strings = ("PermitRootLogin yes",
			   "Protocol 2,1");

	    # GPO wants this turned off.
	    if ($PROTOGENI_GENIRACK) {
		ExecQuietFatal("sed -i.orig ".
			       "  -e 's/PasswordAuth/#PasswordAuth/' ".
			       "  -e 's/PermitRootLogin/#PermitRootLogin/' ".
			       "  -e 's/ChallengeResponseAuthentication/".
			       "#ChallengeResponseAuthentication/' ".
			       "$SSHD_CONFIG");
		push(@strings,
		     "PasswordAuthentication no",
		     "ChallengeResponseAuthentication no",
		     "PermitRootLogin without-password");
	    }
	    AppendToFileFatal($SSHD_CONFIG, @strings);

	    # HUP the server so the changes take effect
	    if (-r "/var/run/sshd.pid") {
		my $dpid = `cat /var/run/sshd.pid`;
		chomp($dpid);
		ExecQuiet("kill -HUP $dpid");
	    }
	};
	Phase "dotssh", "Making root's .ssh directory", sub {
	    DoneIfExists("/root/.ssh");
	    mkdir("/root/.ssh",0700) or
		PhaseFail("Unable to create /root/.ssh: $!");
	};
	Phase "authkeys", "Adding stub identity to root authorized_keys", sub {
	    DoneIfEdited($AUTHKEYS);
	    my $ident = `cat $INIT_PUBKEY`;
	    PhaseFail("Could not read $INIT_PUBKEY")
		if ($?);
	    chomp($ident);
	    if (! -e $AUTHKEYS) {
		CreateFileFatal($AUTHKEYS);
	    }
	    # This does not work when ops is a vm on boss.
	    $ident = "from=\"${BOSSNODE}\" $ident"
		if (!$OPSVM_ENABLE);
	    AppendToFileFatal($AUTHKEYS, $ident);
	};
    };

    return 0;
}

# Local Variables:
# mode:perl
# End: