chromeos-base/chromeos-sshd-init/files/openssh-server.conf

# Copyright (c) 2012 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.

description   "Start sshd to allow remote network login"
author        "chromium-os-dev@chromium.org"

# This must start after the iptables job so that when we enable
# port 22 below, the change won't be overwritten.

start on started iptables and started ip6tables and starting failsafe
stop on stopping failsafe
respawn

pre-start script
  SSH_DIR=/mnt/stateful_partition/etc/ssh
  mkdir -p ${SSH_DIR}

  if ! sshd -t > /dev/null ; then
    # sshd will not start with current config, generate a new set of keys.
    for KEY_TYPE in rsa dsa ecdsa ed25519 ; do
      KEY_FILE=${SSH_DIR}/ssh_host_${KEY_TYPE}_key
      # If keys exist delete them because they are not valid and ssh-keygen
      # will not overwrite them.
      rm -f ${KEY_FILE} ${KEY_FILE}.pub
      ssh-keygen -q -f ${KEY_FILE} -N '' -t ${KEY_TYPE} ||
        logger -t "${UPSTART_JOB}" "Failed to generate ssh key."
    done
  fi

  for cmd in iptables ip6tables ; do
    $cmd -A INPUT -p tcp --dport 22 -j ACCEPT ||
      logger -t "${UPSTART_JOB}" "Failed to configure $cmd."
  done
end script

expect fork
script
  # sshd refuses to execute unless invoked with a full path.  Go figure.
  # For cros_embedded, sshd is in dev image so its in /usr/local/sbin.
  if [ ! -f /usr/sbin/sshd ]; then
    exec /usr/local/sbin/sshd
  else
    exec /usr/sbin/sshd
  fi
end script

post-stop script
  # For good hygiene, clean up on job stop.
  for cmd in iptables ip6tables ; do
    $cmd -D INPUT -p tcp --dport 22 -j ACCEPT || true
  done
end script