/*********************************************************************/
/* OpenSSH/Security/2 installation script                            */
/*********************************************************************/
/* Place the following files in this directory:                      */
/* 1. OpenSSH distribution file, rename it to openssh.zip            */
/* 2. Vioroute package, rename it to vioroute.zip                    */
/* 3. Install.exe from the Security/2 distribution zip               */
/*********************************************************************/

'@cls'
Say
Say ' This script will install OpenSSH and Security/2 on your computer.'
Say
Say ' You need to put the following files in this directory:'
Say ' OpenSSH.Zip, VioRoute.Zip and Install.Exe from the Security/2 zip'
Say
Say ' You must also have a working EMX (run-time) installation, otherwise'
Say ' this installation script will fail.'
Say
Say ' Press ENTER to continue or CTRL-C + ENTER to abort.'
'@pause >nul'

/* check files */
Say
Say ' Checking files...'
call check_file 'openssh.zip'
call check_file 'vioroute.zip'
call check_file 'install.exe'

/* check emx */
Say
Say ' Checking EMX...'
trace off
'@call emxrev >nul 2>>&1'
rcode = rc
trace on
if rcode <> 0 then do
	Say ' -> EmxRev.CMD has returned 'rc
	Say ' -> EMX might not be installed'
	Say ' Press ENTER to continue or CTRL-C + ENTER to abort.'
	'@pause >nul'
end
else do
	Say ' -> EmxRev.Cmd has returned 'rc
	Say ' -> EMX seems to be installed'
end

/* things we need to know */
parse upper value value('PATH',,'OS2ENVIRONMENT') with ':\OS2\SYSTEM' -1 target +2
product_log = target'\os2\install\instossh.log'
inst_dir    = '.'
cfgsys      = target'\CONFIG.SYS'
etc         = value('ETC',,'os2environment')
mptnbin     = translate(value('PATH',,'os2environment'))
mptnbin     = substr(mptnbin, pos(':\MPTN\BIN',mptnbin)-1, 11)
mptndll     = substr(mptnbin, 1, 8)'DLL'
mptndoc     = substr(mptnbin, 1, 8)'DOC'
'@mkdir 'mptndoc' >nul 2>>&1'

/* check environment */
user = space(value('USER',,'os2environment'))
if user = '' then do
	Say
	Say ' Your username is unknown.'
	Say ' Please type in your username and press ENTER.'
	Say
	parse pull user
	if user = '' then do
		Say 'No username specified, exiting...'
		exit
	end
	user = space(user)
	call value 'USER',user,'os2environment'
	Say
	Say ' Adding SET USER='user' to your Config.Sys...'
	'@echo SET USER='user' >> 'cfgsys
end
hostname = space(value('HOSTNAME',,'os2environment'))
if hostname = '' then do
	Say
	Say ' The hostname of this machine is unknown.'
	Say ' Please type in a hostname and press ENTER.'
	Say
	parse pull hostname
	if hostname = '' then do
		Say 'No hostname specified, exiting...'
		exit
	end
	hostname = space(hostname)
	call value 'HOSTNAME',hostname,'os2environment'
	Say
	Say ' Adding SET HOSTNAME='hostname' to your Config.Sys...'
	'@echo SET HOSTNAME='hostname' >> 'cfgsys
end
home = space(value('HOME',,'os2environment'))
if home = '' then do
	Say
	Say ' Your homedir is unknown.'
	home = target'\home\'user
	'@mkdir 'target'\home >nul 2>>&1'
	'@mkdir 'target'\home\'user' >nul 2>>&1'
	Say
	Say ' 'home' will be used as your home directory.'
	call value 'HOME',home,'os2environment'
	Say ' Adding SET HOME='home' to your Config.Sys...'
	'@echo SET HOME='home' >> 'cfgsys
end

/* ask port */
Say
Say ' On which port would you like to run SSHD? (press ENTER for default 22)'
Say
parse pull product_port
if product_port = '' then 
	product_port = 22
else if datatype(product_port) <> 'NUM' then do
	Say ' Incorrect port number: 'product_port' Exiting...'
	exit
end

/* ask keyphrase */
Say
Say ' Please type in a passphrase for the current user ('user').'
Say ' The passphrase must be longer than 4 characters.'
Say ' Press ENTER for no passphrase.'
Say
parse pull product_string
product_string = space(product_string)
if product_string <> '' & length(product_string) <= 4 then do
	Say ' Passphrase is to short. Exiting...'
	Exit
end

/* create config */
Say
Say ' Creating SSHD configuration in 'etc'\SSH...'
'@mkdir 'etc'\SSH >nul 2>>&1'
'@unzip -ojC 'inst_dir'\openssh.zip etc\ssh\* -d 'etc'\ssh\. >> 'product_log
'@unzip -ojC 'inst_dir'\vioroute.zip term.cfg -d 'etc'\.     >> 'product_log
sshdcfg = etc'\ssh\sshd_config' 
'@copy 'sshdcfg' 'etc'\ssh\sshd_config.org >> 'product_log
'@echo port 'product_port' > 'sshdcfg
'@echo Protocol 2  >> 'sshdcfg
'@echo HostKey 'etc'\ssh\ssh_host_dsa_key >> 'sshdcfg
'@echo LoginGraceTime 300  >> 'sshdcfg
'@echo Banner 'etc'\ssh_banner.txt  >> 'sshdcfg
'@echo IgnoreUserKnownHosts yes  >> 'sshdcfg
'@echo PasswordAuthentication yes  >> 'sshdcfg
'@echo SyslogFacility AUTH >> 'sshdcfg
'@echo LogLevel INFO >> 'sshdcfg
'@echo PermitRootLogin yes >> 'sshdcfg
'@echo StrictModes yes >> 'sshdcfg
'@echo RSAAuthentication no >> 'sshdcfg
'@echo PubkeyAuthentication yes >> 'sshdcfg
'@echo AuthorizedKeysFile .ssh/authorized_keys >> 'sshdcfg
'@echo IgnoreRhosts yes >> 'sshdcfg
'@echo RhostsRSAAuthentication no >> 'sshdcfg
'@echo HostbasedAuthentication no >> 'sshdcfg
'@echo PermitEmptyPasswords no >> 'sshdcfg
'@echo ChallengeResponseAuthentication no >> 'sshdcfg
'@echo MaxStartups 10 >> 'sshdcfg
'@echo ClientAliveInterval 600 >> 'sshdcfg
'@echo ClientAliveCountMax 3 >> 'sshdcfg
'@echo Subsystem sftp 'mptnbin'\sftp-server.exe >> 'sshdcfg

/* create banner */
banner = etc'\ssh_banner.txt'
'@echo+ > 'banner
'@echo                             ****USAGE WARNING**** >> 'banner
'@echo+ >> 'banner
'@echo This is a private computer system. This computer system, including all >> 'banner
'@echo related equipment, networks, and network devices (specifically including >> 'banner
'@echo Internet access) are provided only for authorized use. This computer system >> 'banner
'@echo may be monitored for all lawful purposes, including to ensure that its use >> 'banner
'@echo is authorized, for management of the system, to facilitate protection against >> 'banner
'@echo unauthorized access, and to verify security procedures, survivability, and >> 'banner
'@echo operational security. Monitoring includes active attacks by authorized entities >> 'banner
'@echo to test or verify the security of this system. During monitoring, information >> 'banner
'@echo may be examined, recorded, copied and used for authorized purposes. All >> 'banner
'@echo information, including personal information, placed or sent over this system >> 'banner
'@echo may be monitored. >> 'banner
'@echo+ >> 'banner
'@echo Use of this computer system, authorized or unauthorized, constitutes consent >> 'banner
'@echo to monitoring of this system. Unauthorized use may subject you to criminal >> 'banner
'@echo prosecution. Evidence of unauthorized use collected during monitoring may be >> 'banner
'@echo used for administrative, criminal, or other adverse action. Use of this system >> 'banner
'@echo constitutes consent to monitoring for these purposes. >> 'banner
'@echo+ >> 'banner

/* unzip/copy binaries */
Say
Say ' Copying OpenSSH files...'
'@unzip -ojC 'inst_dir'\vioroute.zip *.exe       -d 'mptnbin'\.         >> 'product_log
'@unzip -ojC 'inst_dir'\vioroute.zip *.dll       -d 'mptndll'\.         >> 'product_log
'@unzip -ojC 'inst_dir'\openssh.zip  *.exe       -d 'mptnbin'\.         >> 'product_log
'@unzip -ojC 'inst_dir'\openssh.zip  *.dll       -d 'mptndll'\.         >> 'product_log
'@unzip -ojC 'inst_dir'\openssh.zip  *.inf       -d 'mptndoc'\.         >> 'product_log
'@unzip -ojC 'inst_dir'\openssh.zip  readme.eng  -d 'mptndoc'\.         >> 'product_log
'@unzip -ojC 'inst_dir'\openssh.zip  docs\*      -d 'mptndoc'\.         >> 'product_log
'@unzip -ojC 'inst_dir'\openssh.zip  OpenSSH.ICO -d 'target'\os2\.      >> 'product_log

/* copy/create/install sec/2 files */
Say
Say ' Installing Security/2 files...'
aclcfg = target'\security\etc\acls' 
pwdcfg = target'\security\etc\passwd'
'@'inst_dir'\install.exe -i >> 'product_log

/* tune Config.Sys */
i = 1
do while lines(cfgsys)
	l.i = linein(cfgsys)
	if translate(substr(l.i,1,16)) = 'BASEDEV=SSES.SYS' & pos('/SUANYUSER', translate(l.i)) = 0 then 
		l.i = 'BASEDEV=SSES.SYS /suanyuser'
	i=i+1
end
call lineout cfgsys
l.0=i-1
'@copy 'cfgsys' 'target'\Config.SSH >> 'product_log' 2>>&1'
'@del 'cfgsys' >> 'product_log' 2>>&1'
do i=1 to l.0
	call lineout cfgsys, l.i
end
call lineout cfgsys

/* add user to pwd file */
i=1
root_pwd = ''
do while lines(pwdcfg)
	l.i = linein(pwdcfg)
	parse value l.i with usr ':' pwd ':' uid ':' .
	if translate(usr) = 'ROOT' then root_pwd = pwd
	i=i+1
end
l.0=i-1
call lineout pwdcfg
call lineout pwdcfg, user':'root_pwd':'uid+1':0::$'space(translate(home,'',':'),0)':$'space(translate(target,'',':'),0)'\OS2\CMD.EXE:$'space(translate(mptnbin,'',':'),0)'\VIOSTART.EXE'
call lineout pwdcfg

/* create keys */
Say
Say ' Starting key generation...'
'@mkdir 'home'\.ssh >nul 2>>&1'
'@mkdir 'target'\os2\.ssh >nul 2>>&1'
usr_cmd = mptnbin'\GenUsrK.Cmd'
'@del 'usr_cmd' >nul 2>>&1'
call lineout usr_cmd, "/* key generation */"
call lineout usr_cmd, "Say"
call lineout usr_cmd, "parse arg p1 p2 p3 p4 p5"
call lineout usr_cmd, "user = space(value('USER',,'OS2ENVIRONMENT'))"
call lineout usr_cmd, "home = space(value('HOME',,'OS2ENVIRONMENT'))"
call lineout usr_cmd, "if p1 <> ''& p2 <> '' & p3 <> '' & p4 <> '' then call generate"
call lineout usr_cmd, "Say ' This script will (re)generate your user keys (private/public).'"
call lineout usr_cmd, "Say ' Usage  : GenUsrK.Cmd user [type:rsa/rsa1/dsa] [length:512/1024/2048]'"
call lineout usr_cmd, "Say '          [keyfile] [passphrase (optional)]'"
call lineout usr_cmd, "Say ' Default parameters: 'user' dsa 2048 'home'\.ssh\id_dsa'"
call lineout usr_cmd, "Say"
call lineout usr_cmd, "'@pause'"
call lineout usr_cmd, "call generate"
call lineout usr_cmd, "exit"
call lineout usr_cmd, "generate:"
call lineout usr_cmd, "'@"target"'"
call lineout usr_cmd, "'@cd "mptnbin"'"
call lineout usr_cmd, "if p1 <> '' then do; user = p1; call value 'USER',user,'OS2ENVIRONMENT'; end"
call lineout usr_cmd, "if p2 <> '' then keytype = p2; else keytype = 'dsa'"
call lineout usr_cmd, "if p3 <> '' then keylength = p3; else keylength = 2048"
call lineout usr_cmd, "if p4 <> '' then keyfile = p4; else keyfile = home'\.ssh\id_dsa'"
call lineout usr_cmd, "if p5 <> '' then keyphrase = p5; else keyphrase = ''"
call lineout usr_cmd, "Say"
call lineout usr_cmd, "Say ' Generating user keys for 'user' in 'keyfile'...'"
call lineout usr_cmd, "'@del 'keyfile' >nul 2>>&1'"
call lineout usr_cmd, "trace off"
call lineout usr_cmd, "'@su -p root -c dir>nul root >nul 2>>&1'"
call lineout usr_cmd, "rcode = rc"
call lineout usr_cmd, "trace on"
call lineout usr_cmd, "if rcode = 0 then do"
call lineout usr_cmd, "	temp_cmd = '"mptnbin"\GenKTemp.Cmd'"
call lineout usr_cmd, "	'@echo @"mptnbin"\ssh-keygen.exe -q -b 'keylength' -t 'keytype' -f 'keyfile' -N ""'keyphrase'"" > 'temp_cmd"
call lineout usr_cmd, "	'@su -c 'temp_cmd' 'user"
call lineout usr_cmd, "	'@del 'temp_cmd' >nul'"
call lineout usr_cmd, "end"
call lineout usr_cmd, "else"
call lineout usr_cmd, "	'@"mptnbin"\ssh-keygen.exe -q -b 'keylength' -t 'keytype' -f 'keyfile' -N ""'keyphrase'""'"
call lineout usr_cmd, "if stream(home'\.ssh\authorized_keys','c','query exists') = '' then '@copy 'keyfile'.pub 'home'\.ssh\authorized_keys >nul'"
call lineout usr_cmd, "else '@copy 'home'\.ssh\authorized_keys+'keyfile'.pub 'home'\.ssh\authorized_keys >nul'"
call lineout usr_cmd
'@call 'usr_cmd' 'user' dsa 2048 'home'\.ssh\id_dsa 'product_string
'@call 'usr_cmd' root dsa 2048 'target'\os2\.ssh\id_dsa rootroot'

sys_cmd = mptnbin'\GenSysK.Cmd'
'@del 'sys_cmd' >nul 2>>&1'
call lineout sys_cmd, "/* key generation */"
call lineout sys_cmd, "Say"
call lineout sys_cmd, "parse arg p1 p2 p3 p4"
call lineout sys_cmd, "host = space(value('HOSTNAME',,'OS2ENVIRONMENT'))"
call lineout sys_cmd, "etc  = space(value('ETC',     ,'OS2ENVIRONMENT'))"
call lineout sys_cmd, "if p1 <> ''& p2 <> '' & p3 <> '' & p4 <> '' then call generate"
call lineout sys_cmd, "Say ' This script will (re)generate your system keys (private/public).'"
call lineout sys_cmd, "Say ' Usage  : GenSysK.Cmd host [type:rsa/rsa1/dsa] [length:512/1024/2048] [keyfile]'"
call lineout sys_cmd, "Say ' Default parameters: 'host' dsa 2048 'etc'\ssh\ssh_host_dsa_key'"
call lineout sys_cmd, "Say"
call lineout sys_cmd, "'@pause'"
call lineout sys_cmd, "call generate"
call lineout sys_cmd, "exit"
call lineout sys_cmd, "generate:"
call lineout sys_cmd, "'@"target"'"
call lineout sys_cmd, "'@cd "mptnbin"'"
call lineout sys_cmd, "if p1 <> '' then do; host = p1; call value 'HOSTNAME',host,'OS2ENVIRONMENT'; end"
call lineout sys_cmd, "if p2 <> '' then keytype = p2; else keytype = 'dsa'"
call lineout sys_cmd, "if p3 <> '' then keylength = p3; else keylength = 2048"
call lineout sys_cmd, "if p4 <> '' then keyfile = p4; else keyfile = etc'\ssh\ssh_host_dsa_key'"
call lineout sys_cmd, "Say"
call lineout sys_cmd, "Say ' Generating server keys for 'host' in 'etc'\ssh...'"
call lineout sys_cmd, "'@del 'keyfile' >nul 2>>&1'"
call lineout sys_cmd, "'@"mptnbin"\ssh-keygen.exe -q -b 'keylength' -t 'keytype' -f 'keyfile' -N """"'"
call lineout sys_cmd
'@call 'sys_cmd' 'hostname' dsa 2048 'etc'\ssh\ssh_host_dsa_key'

/* inform */
Say
Say ' Creating objects...'
readme1 = home'\readme.1st'
'@del 'readme1' >nul 2>>&1'
call lineout readme1, 'Root user = root, pwd = root, keytype dsa, passphrase = rootroot'
call lineout readme1, 'Test user = test, pwd = test, no key, no passphrase'
call lineout readme1, 'Your user ID = 'user', pwd = root, keytype dsa, passphrase = 'product_string
call lineout readme1, ''
call lineout readme1, 'Start SSH  daemon with the command "start sshd"'
call lineout readme1, 'Start SSH  client with the command "ssh -l 'user' <hostname>"'
call lineout readme1, 'Start SFTP client with the command "sftp 'user'@<hostname>"'
call lineout readme1, ''
call lineout readme1, 'If you have problems, try the debug options (sshd -ddd, ssh -vv)'
call lineout readme1, 'check if you use the right user (whoami) and/or key, etc.'
call lineout readme1

/* create folders */
call RxFuncAdd 'SysCreateObject', 'RexxUtil', SysCreateObject
call SysCreateObject 'WPFolder', 'OpenSSH^Security/2', '<WP_DESKTOP>','OBJECTID=<OPENSSH>;'||'ALWAYSSORT=YES;ICONFILE='target'\OS2\OpenSSH.ICO','R'
call SysCreateObject 'WPFolder', 'OpenSSH^Security/2^Configuration', '<OPENSSH>','OBJECTID=<OPENSSH-C>;'||'ALWAYSSORT=YES;','R'
call SysCreateObject 'WPFolder', 'OpenSSH^Security/2^Documentation', '<OPENSSH>','OBJECTID=<OPENSSH-D>;'||'ALWAYSSORT=YES;','R'
call SysCreateObject 'WPFolder', 'OpenSSH^Security/2^Executables', '<OPENSSH>','OBJECTID=<OPENSSH-E>;'||'ALWAYSSORT=YES;','R'

/* create config objects */
call SysCreateObject 'WPProgram','OpenSSH^Configuration','<OPENSSH-C>','EXENAME=epm.exe;PARAMETERS='sshdcfg,'R'
call SysCreateObject 'WPProgram','OpenSSH^Banner','<OPENSSH-C>','EXENAME=epm.exe;PARAMETERS='etc'\ssh_banner.txt','R'
call SysCreateObject 'WPProgram','Security/2^ACL file','<OPENSSH-C>','EXENAME=epm.exe;PARAMETERS='aclcfg,'R'
call SysCreateObject 'WPProgram','Security/2^PWD file','<OPENSSH-C>','EXENAME=epm.exe;PARAMETERS='pwdcfg,'R'
call SysCreateObject 'WPProgram','Security/2^Config.Sys','<OPENSSH-C>','EXENAME=epm.exe;PARAMETERS='target'\config.sys','R'

/* create documentation objects */
docfile1 = target'\security\doc\readme'
docfile2 = target'\security\doc\acls.example.en'
sseslog  = target'\security\log\ssesctl.log'
if stream(docfile1, 'c', 'query exists') <> '' then call SysCreateObject 'WPProgram','Security/2^Readme','<OPENSSH-D>','EXENAME=epm.exe;PARAMETERS='docfile1,'R'
if stream(docfile2, 'c', 'query exists') <> '' then call SysCreateObject 'WPProgram','Security/2^ACL examples','<OPENSSH-D>','EXENAME=epm.exe;PARAMETERS='docfile2,'R'
call SysCreateObject 'WPProgram','OpenSSH^Readme 1st','<OPENSSH-D>','EXENAME=epm.exe;PARAMETERS='readme1';OPEN=DEFAULT;','R'
call SysCreateObject 'WPProgram','OpenSSH^4 OS/2','<OPENSSH-D>','EXENAME=VIEW.EXE;PARAMETERS='mptndoc'\OPEN-SSH_4OS2.INF','R'
call SysCreateObject 'WPProgram','OpenSSH^Readme','<OPENSSH-D>','EXENAME=epm.exe;PARAMETERS='mptndoc'\readme.eng','R'
call SysCreateObject 'WPProgram','Installation^Log File','<OPENSSH-D>','EXENAME=epm.exe;PARAMETERS='target'\os2\install\instossh.log','R'
call SysCreateObject 'WPProgram','Security/2^Log file','<OPENSSH-D>','EXENAME=epm.exe;PARAMETERS='sseslog,'R'
call RxFuncAdd 'SysCreateShadow', 'RexxUtil', SysCreateShadow
call SysCreateShadow mptndoc,'<OPENSSH-D>'

/* create executable objects */
call SysCreateObject 'WPProgram','Start SSHD','<OPENSSH-E>','EXENAME=CMD.EXE;PARAMETERS=/K SSHD.EXE','R'
call SysCreateObject 'WPProgram','Generate^User Key','<OPENSSH-E>','EXENAME=CMD.EXE;PARAMETERS=/K GenUsrK.cmd','R'
call SysCreateObject 'WPProgram','Generate^System Key','<OPENSSH-E>','EXENAME=CMD.EXE;PARAMETERS=/K GenSysK.cmd','R'
call SysCreateObject 'WPProgram','Who am I?','<OPENSSH-E>','EXENAME=whoami.exe;NOAUTOCLOSE=YES','R'
call SysCreateObject 'WPProgram','Switch User^Session to 'user,'<OPENSSH-E>','EXENAME=Su.Exe;PARAMETERS=-p root -m -s 'target'\os2\cmd.exe -c exit 'user,'R'
call SysCreateObject 'WPProgram','Open Shell for^User 'user,'<OPENSSH-E>','EXENAME=Su.Exe;PARAMETERS=-p root -s 'target'\os2\cmd.exe 'user,'R'

/* ready */
Say
Say ' Finished installation. Please reboot your system now.'

exit

/* check if file exists */
check_file: procedure

	parse arg file
	if stream(file, 'c', 'query exists') = '' then do
		Say ' -> 'file' is missing, aborting...'
		exit
	end
	Say ' -> Found 'file

return
