persistent ssh host keys, ipv6 ssh, whitespace

diff --git a/wrt-setup b/wrt-setup
index 96a25647ae7eaee8c64b611db7bcf9c1bdcbf684..9ac518afca061bf9f20a3928eb4c557f26f2e25e 100755 (executable)
--- a/wrt-setup
+++ b/wrt-setup
@@ -49,7 +49,7 @@ echo "$0: host=$h"
 cat ~/.ssh/home.pub | ssh $h dd of=/etc/dropbear/authorized_keys 2>/dev/null
 scp /a/work/libremanage/libremanage /a/bin/fai/wrt-setup-local /a/bin/cedit/cedit $h:/usr/bin
 # relay is built for openwrt 18.06.2, r7676-cddd7b4c77
-sudo scp /q/root/shadow/router \
+sudo scp /q/root/shadow/router /p/c/machine_specific/wrt/etc/dropbear/dropbear_rsa_host_key \
      /a/opt/openwrt/source/bin/packages/mips_24kc/mypackages/relay_1.0-1_mips_24kc.ipk $h:
 ssh $h <<EOF
 set -x

diff --git a/wrt-setup-local b/wrt-setup-local
index 8b7e4c98bcce3e4092f8ae247e8bc0e4555692a5..b0635a1856ac2f58bb3a84500f0092d1a04f288c 100755 (executable)
--- a/wrt-setup-local
+++ b/wrt-setup-local
@@ -256,6 +256,10 @@ EOF
 uset dropbear.@dropbear[0].PasswordAuth 0
 uset dropbear.@dropbear[0].RootPasswordAuth 0
 uset dropbear.@dropbear[0].Port 2220
+if ! cmp -s /root/dropbear_rsa_host_key /etc/dropbear/dropbear_rsa_host_key; then
+  cp /root/dropbear_rsa_host_key /etc/dropbear/dropbear_rsa_host_key
+  dropbear_restart=true
+fi
 
 wireless_restart=false
 key=pictionary49
@@ -312,84 +316,103 @@ v cedit /etc/config/firewall <<EOF || firewall_restart=true
 
 
 config redirect
-    option name ssh
-    option src              wan
-    option src_dport        22
-    option dest_ip          $l.8
-    option dest             lan
+ option name ssh
+ option src              wan
+ option src_dport        22
+ option dest_ip          $l.8
+ option dest             lan
 config rule
-    option src              wan
-    option target           ACCEPT
-    option dest_port        22
+ option src              wan
+ option target           ACCEPT
+ option dest_port        22
 
 config redirect
-    option name sshalt
-    option src              wan
-    option src_dport        2222
-    option dest_port        22
-    option dest_ip          $l.3
-    option dest             lan
+ option name sshalt
+ option src              wan
+ option src_dport        2222
+ option dest_port        22
+ option dest_ip          $l.3
+ option dest             lan
 config rule
-    option src              wan
-    option target           ACCEPT
-    option dest_port        2222
+ option src              wan
+ option target           ACCEPT
+ option dest_port        2222
 
 config rule
-    option src              wan
-    option target           ACCEPT
-    option dest_port        2220
+ option src              wan
+ option target           ACCEPT
+ option dest_port        2220
 
 
 config redirect
-    option src              wan
-    option src_dport        443
-    option dest             lan
-    option dest_ip          $l.8
-    option proto            tcp
+ option src              wan
+ option src_dport        443
+ option dest             lan
+ option dest_ip          $l.8
+ option proto            tcp
 config rule
-    option src              wan
-    option target           ACCEPT
-    option dest_port        443
-    option proto            tcp
+ option src              wan
+ option target           ACCEPT
+ option dest_port        443
+ option proto            tcp
 
 config redirect
-    option src              wan
-    option src_dport        1196
-    option dest             lan
-    option dest_ip          $l.8
-    option proto            udp
+ option src              wan
+ option src_dport        1196
+ option dest             lan
+ option dest_ip          $l.8
+ option proto            udp
 config rule
-    option src              wan
-    option target           ACCEPT
-    option dest_port        1196
-    option proto            udp
+ option src              wan
+ option target           ACCEPT
+ option dest_port        1196
+ option proto            udp
 
 
 config redirect
-    option src              wan
-    option src_dport        80
-    option dest             lan
-    option dest_ip          $l.8
-    option proto            tcp
+ option src              wan
+ option src_dport        80
+ option dest             lan
+ option dest_ip          $l.8
+ option proto            tcp
 config rule
-    option src              wan
-    option target           ACCEPT
-    option dest_port        80
-    option proto            tcp
+ option src              wan
+ option target           ACCEPT
+ option dest_port        80
+ option proto            tcp
 
 config redirect
-    option name syncthing
-    option src              wan
-    option src_dport        22001
-    option dest_ip          $l.8
-    option dest             lan
+ option name syncthing
+ option src              wan
+ option src_dport        22001
+ option dest_ip          $l.8
+ option dest             lan
 config rule
-    option src              wan
-    option target           ACCEPT
-    option dest_port        22001
+ option src              wan
+ option target           ACCEPT
+ option dest_port        22001
+
 
+config rule
+ option name ssh-ipv6
+ option src wan
+ option dest lan
+ # note, using mac transform, we could allow all traffic to a host like this,
+ # replacing 1 as appropriate
+ #option dest_ip ::111:11ff:fe11:1111/::ffff:ffff:ffff:ffff
+ option dest_port 22
+ option target ACCEPT
+ option family ipv6
 
 
+config rule
+ option name mail-ipv6
+ option src wan
+ option dest lan
+ option dest_port 25
+ option target ACCEPT
+ option family ipv6
+
 EOF
 
 
@@ -524,6 +547,7 @@ EOF
 uset network.lan.ipaddr $l.$lanip
 uset network.lan.netmask $mask
 uset dhcp.wan.ignore $dev2 # default is false
+uset dhcp.lan.ignore $dev2 # default is false
 if $dev2; then
   uset network.lan.gateway $l.1
   uset network.wan.proto none