SSH: Use new banner and tempio (#1800)

* SSH: Use new banner and tempio

* fix change for tests

* Update ssh/build.json

Co-authored-by: Franck Nijhof <git@frenck.dev>

* fix build

Co-authored-by: Franck Nijhof <git@frenck.dev>

ssh/rootfs/etc/cont-init.d/keygen.sh

@@ -2,7 +2,7 @@
 # ==============================================================================
 # SSH Host keys
 # ==============================================================================
-KEYS_PATH=/data/host_keys
+readonly KEYS_PATH=/data/host_keys
 
 if ! bashio::fs.directory_exists "${KEYS_PATH}"; then
     bashio::log.info "Generating host keys..."

ssh/rootfs/etc/cont-init.d/profile.sh

@@ -2,25 +2,28 @@
 # ==============================================================================
 # Setup persistent user settings
 # ==============================================================================
-DIRECTORIES=(addons backup config share ssl)
+readonly DIRECTORIES=(addons backup config share ssl)
 
 # Persist shell history by redirecting .bash_history to /data
-touch /data/.bash_history
-chmod 600 /data/.bash_history
-ln -s -f /data/.bash_history /root/.bash_history
-
-# Make Home Assistant TOKEN available on the CLI
-echo "export SUPERVISOR_TOKEN=${SUPERVISOR_TOKEN}" >> /etc/profile.d/homeassistant.sh
-
-# Remove old HASSIO_TOKEN from bash profile (if exists)
-if bashio::fs.file_exists /data/.bash_profile; then
-  sed -i "/export HASSIO_TOKEN=.*/d" /data/.bash_profile
+if ! bashio::fs.file_exists /data/.bash_profile; then
+    touch /data/.bash_history
+    chmod 600 /data/.bash_history
 fi
 
-# Persist .bash_profile by redirecting .bash_profile to /data
-touch /data/.bash_profile
-chmod 600 /data/.bash_profile
-ln -s -f /data/.bash_profile /root/.bash_profile
+# Make Home Assistant TOKEN available on the CLI
+mkdir -p /etc/profile.d
+bashio::var.json \
+    supervisor_token "${SUPERVISOR_TOKEN}" \
+    | tempio \
+        -template /usr/share/tempio/homeassistant.profile \
+        -out /etc/profile.d/homeassistant.sh
+
+
+# Persist shell profile by redirecting .bash_profile to /data
+if ! bashio::fs.file_exists /data/.bash_profile; then
+    touch /data/.bash_profile
+    chmod 600 /data/.bash_profile
+fi
 
 # Links some common directories to the user's home folder for convenience
 for dir in "${DIRECTORIES[@]}"; do
@@ -37,4 +40,3 @@ if ! bashio::fs.directory_exists /data/.ssh; then
         || bashio::exit.nok \
             'Failed setting permissions on persistent .ssh folder'
 fi
-ln -s /data/.ssh /root/.ssh

ssh/rootfs/etc/cont-init.d/ssh.sh

@@ -13,7 +13,6 @@ if bashio::config.has_value 'authorized_keys'; then
     done <<< "$(bashio::config 'authorized_keys')"
 
     chmod 600 /data/.ssh/authorized_keys
-    sed -i s/#PasswordAuthentication.*/PasswordAuthentication\ no/ /etc/ssh/sshd_config
 
     # Unlock account
     PASSWORD="$(pwgen -s 64 1)"
@@ -23,14 +22,13 @@ elif bashio::config.has_value 'password'; then
 
     PASSWORD=$(bashio::config 'password')
     echo "root:${PASSWORD}" | chpasswd 2&> /dev/null
-
-    sed -i s/#PasswordAuthentication.*/PasswordAuthentication\ yes/ /etc/ssh/sshd_config
-    sed -i s/#PermitEmptyPasswords.*/PermitEmptyPasswords\ no/ /etc/ssh/sshd_config
 elif bashio::var.has_value "$(bashio::addon.port 22)"; then
     bashio::exit.nok "You need to setup a login!"
 fi
 
-# Allow TCP forwarding
-if bashio::config.true 'server.tcp_forwarding'; then
-    sed -i "s/AllowTcpForwarding.*/AllowTcpForwarding\\ yes/" /etc/ssh/sshd_config
-fi
+# Generate config
+mkdir -p /etc/ssh
+tempio \
+    -conf /data/options.json \
+    -template /usr/share/tempio/sshd_config \
+    -out /etc/ssh/sshd_config

ssh/rootfs/etc/motd

@@ -1,11 +0,0 @@
- _    _                                         _     _              _   
-| |  | |                          /\           (_)   | |            | |  
-| |__| | ___  _ __ ___   ___     /  \   ___ ___ _ ___| |_ __ _ _ __ | |_ 
-|  __  |/ _ \| '_ ` _ \ / _ \   / /\ \ / __/ __| / __| __/ _` | '_ \| __|
-| |  | | (_) | | | | | |  __/  / ____ \\__ \__ \ \__ \ || (_| | | | | |_ 
-|_|  |_|\___/|_| |_| |_|\___| /_/    \_\___/___/_|___/\__\__,_|_| |_|\__|
-                                                                         
-
-Our command line:
-$ ha help
-

ssh/rootfs/etc/profile.d/homeassistant.sh

@@ -1,3 +0,0 @@
-#!/usr/bin/env bash
-export PS1="\W \$ "
-cat /etc/motd

ssh/rootfs/etc/services.d/sshd/run

@@ -6,7 +6,7 @@
 # If SSH is disabled, use a fake sleep process
 if ! bashio::var.has_value "$(bashio::addon.port 22)"; then
     bashio::log.warning "SSH port is disabled. Prevent start of SSH server." 
-    exec sleep 864000
+    exec sleep infinity
 fi
 
 bashio::log.info "Starting the SSH daemon..."

ssh/rootfs/root/.bash_history

@@ -0,0 +1 @@
+/data/.bash_history

ssh/rootfs/root/.bash_profile

@@ -0,0 +1 @@
+/data/.bash_profile

ssh/rootfs/root/.ssh

@@ -0,0 +1 @@
+/data/.ssh

ssh/rootfs/usr/share/tempio/homeassistant.profile

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+export PS1="\W \$ "
+export SUPERVISOR_TOKEN={{ .supervisor_token }}
+
+ha banner

ssh/rootfs/usr/share/tempio/sshd_config

@@ -5,7 +5,7 @@
 LogLevel INFO
 
 # Default
-AllowTcpForwarding no
+AllowTcpForwarding {{ if .server.tcp_forwarding }}yes{{ else }}no{{ end }}
 GatewayPorts no
 X11Forwarding no
 
@@ -17,7 +17,10 @@ PermitRootLogin yes
 Banner none
 PrintMotd no
 
-#PasswordAuthentication no
-#PermitEmptyPasswords no
-
+{{ if .authorized_keys }}
+PasswordAuthentication no
+{{ else if .password }}
+PasswordAuthentication yes
+PermitEmptyPasswords no
+{{ end }}