From 43fcfaa6bcf02035141025b12a408a5ef10833f3 Mon Sep 17 00:00:00 2001
From: Ian Kelling <iank@fsf.org>
Date: Wed, 15 May 2019 18:15:40 -0400
Subject: [PATCH] persistent ssh host keys, ipv6 ssh, whitespace

---
 wrt-setup       |   2 +-
 wrt-setup-local | 134 ++++++++++++++++++++++++++++--------------------
 2 files changed, 80 insertions(+), 56 deletions(-)

diff --git a/wrt-setup b/wrt-setup
index 96a2564..9ac518a 100755
--- a/wrt-setup
+++ b/wrt-setup
@@ -49,7 +49,7 @@ echo "$0: host=$h"
 cat ~/.ssh/home.pub | ssh $h dd of=/etc/dropbear/authorized_keys 2>/dev/null
 scp /a/work/libremanage/libremanage /a/bin/fai/wrt-setup-local /a/bin/cedit/cedit $h:/usr/bin
 # relay is built for openwrt 18.06.2, r7676-cddd7b4c77
-sudo scp /q/root/shadow/router \
+sudo scp /q/root/shadow/router /p/c/machine_specific/wrt/etc/dropbear/dropbear_rsa_host_key \
      /a/opt/openwrt/source/bin/packages/mips_24kc/mypackages/relay_1.0-1_mips_24kc.ipk $h:
 ssh $h <<EOF
 set -x
diff --git a/wrt-setup-local b/wrt-setup-local
index 8b7e4c9..b0635a1 100755
--- a/wrt-setup-local
+++ b/wrt-setup-local
@@ -256,6 +256,10 @@ EOF
 uset dropbear.@dropbear[0].PasswordAuth 0
 uset dropbear.@dropbear[0].RootPasswordAuth 0
 uset dropbear.@dropbear[0].Port 2220
+if ! cmp -s /root/dropbear_rsa_host_key /etc/dropbear/dropbear_rsa_host_key; then
+  cp /root/dropbear_rsa_host_key /etc/dropbear/dropbear_rsa_host_key
+  dropbear_restart=true
+fi
 
 wireless_restart=false
 key=pictionary49
@@ -312,84 +316,103 @@ v cedit /etc/config/firewall <<EOF || firewall_restart=true
 
 
 config redirect
-    option name ssh
-    option src              wan
-    option src_dport        22
-    option dest_ip          $l.8
-    option dest             lan
+ option name ssh
+ option src              wan
+ option src_dport        22
+ option dest_ip          $l.8
+ option dest             lan
 config rule
-    option src              wan
-    option target           ACCEPT
-    option dest_port        22
+ option src              wan
+ option target           ACCEPT
+ option dest_port        22
 
 config redirect
-    option name sshalt
-    option src              wan
-    option src_dport        2222
-    option dest_port        22
-    option dest_ip          $l.3
-    option dest             lan
+ option name sshalt
+ option src              wan
+ option src_dport        2222
+ option dest_port        22
+ option dest_ip          $l.3
+ option dest             lan
 config rule
-    option src              wan
-    option target           ACCEPT
-    option dest_port        2222
+ option src              wan
+ option target           ACCEPT
+ option dest_port        2222
 
 config rule
-    option src              wan
-    option target           ACCEPT
-    option dest_port        2220
+ option src              wan
+ option target           ACCEPT
+ option dest_port        2220
 
 
 config redirect
-    option src              wan
-    option src_dport        443
-    option dest             lan
-    option dest_ip          $l.8
-    option proto            tcp
+ option src              wan
+ option src_dport        443
+ option dest             lan
+ option dest_ip          $l.8
+ option proto            tcp
 config rule
-    option src              wan
-    option target           ACCEPT
-    option dest_port        443
-    option proto            tcp
+ option src              wan
+ option target           ACCEPT
+ option dest_port        443
+ option proto            tcp
 
 config redirect
-    option src              wan
-    option src_dport        1196
-    option dest             lan
-    option dest_ip          $l.8
-    option proto            udp
+ option src              wan
+ option src_dport        1196
+ option dest             lan
+ option dest_ip          $l.8
+ option proto            udp
 config rule
-    option src              wan
-    option target           ACCEPT
-    option dest_port        1196
-    option proto            udp
+ option src              wan
+ option target           ACCEPT
+ option dest_port        1196
+ option proto            udp
 
 
 config redirect
-    option src              wan
-    option src_dport        80
-    option dest             lan
-    option dest_ip          $l.8
-    option proto            tcp
+ option src              wan
+ option src_dport        80
+ option dest             lan
+ option dest_ip          $l.8
+ option proto            tcp
 config rule
-    option src              wan
-    option target           ACCEPT
-    option dest_port        80
-    option proto            tcp
+ option src              wan
+ option target           ACCEPT
+ option dest_port        80
+ option proto            tcp
 
 config redirect
-    option name syncthing
-    option src              wan
-    option src_dport        22001
-    option dest_ip          $l.8
-    option dest             lan
+ option name syncthing
+ option src              wan
+ option src_dport        22001
+ option dest_ip          $l.8
+ option dest             lan
 config rule
-    option src              wan
-    option target           ACCEPT
-    option dest_port        22001
+ option src              wan
+ option target           ACCEPT
+ option dest_port        22001
+
 
+config rule
+ option name ssh-ipv6
+ option src wan
+ option dest lan
+ # note, using mac transform, we could allow all traffic to a host like this,
+ # replacing 1 as appropriate
+ #option dest_ip ::111:11ff:fe11:1111/::ffff:ffff:ffff:ffff
+ option dest_port 22
+ option target ACCEPT
+ option family ipv6
 
 
+config rule
+ option name mail-ipv6
+ option src wan
+ option dest lan
+ option dest_port 25
+ option target ACCEPT
+ option family ipv6
+
 EOF
 
 
@@ -524,6 +547,7 @@ EOF
 uset network.lan.ipaddr $l.$lanip
 uset network.lan.netmask $mask
 uset dhcp.wan.ignore $dev2 # default is false
+uset dhcp.lan.ignore $dev2 # default is false
 if $dev2; then
   uset network.lan.gateway $l.1
   uset network.wan.proto none
-- 
2.30.2