#!/bin/bash

# Create the host keys for the OpenSSH server.

KEYTYPE=$1

case $KEYTYPE in

	"dsa") ;& # disabled in FIPS

	"ed25519")

		FIPS=/proc/sys/crypto/fips_enabled

		if [[ -r "$FIPS" && $(cat $FIPS) == "1" ]]; then

			exit 0

		fi ;;

	"rsa")

		if [[ ! -z $SSH_RSA_BITS  ]]; then

			SSH_KEYGEN_OPTIONS="-b $SSH_RSA_BITS"

		fi ;; # always ok

	"ecdsa") 

		if [[ ! -z $SSH_ECDSA_BITS  ]]; then

			SSH_KEYGEN_OPTIONS="-b $SSH_ECDSA_BITS"

		fi ;;

	*) # wrong argument

		exit 12 ;;

esac

KEY=/etc/ssh/ssh_host_${KEYTYPE}_key

KEYGEN=/usr/bin/ssh-keygen

if [[ ! -x $KEYGEN ]]; then

	exit 13

fi

# remove old keys

rm -f $KEY{,.pub}

# create new keys

if ! $KEYGEN -q -t $KEYTYPE $SSH_KEYGEN_OPTIONS -f $KEY -C '' -N '' >&/dev/null; then

	exit 1

fi

# sanitize permissions

/usr/bin/chgrp ssh_keys $KEY

/usr/bin/chmod 640 $KEY

/usr/bin/chmod 644 $KEY.pub

if [[ -x /usr/sbin/restorecon ]]; then

	/usr/sbin/restorecon $KEY{,.pub}

fi

exit 0