openssh: allow to override OpenSSL HostKeys when read-only-rootfs
With these changes it is possible to have a .bbappend that - sets SYSCONFDIR to some persistent storage - modifies SYSCONFDIR/sshd_config to use ssh host keys from the (writable) sysconfdir (From OE-Core rev: 79c7c8342859306750f0af17210a183fdc543caf) Signed-off-by: André Draszik <adraszik@tycoint.com> Reviewed-by: Stephane Ayotte <sayotte@tycoint.com> Signed-off-by: Ross Burton <ross.burton@intel.com> (cherry picked from commit 106b59d9f96f70d133fa1421091ad280d27a5b6a) Signed-off-by: André Draszik <adraszik@tycoint.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
parent
cd28daadfd
commit
28b8850356
|
@ -91,10 +91,10 @@ read_only_rootfs_hook () {
|
||||||
# and the keys under /var/run/ssh.
|
# and the keys under /var/run/ssh.
|
||||||
if [ -d ${IMAGE_ROOTFS}/etc/ssh ]; then
|
if [ -d ${IMAGE_ROOTFS}/etc/ssh ]; then
|
||||||
if [ -e ${IMAGE_ROOTFS}/etc/ssh/ssh_host_rsa_key ]; then
|
if [ -e ${IMAGE_ROOTFS}/etc/ssh/ssh_host_rsa_key ]; then
|
||||||
echo "SYSCONFDIR=/etc/ssh" >> ${IMAGE_ROOTFS}/etc/default/ssh
|
echo "SYSCONFDIR=\${SYSCONFDIR:-/etc/ssh}" >> ${IMAGE_ROOTFS}/etc/default/ssh
|
||||||
echo "SSHD_OPTS=" >> ${IMAGE_ROOTFS}/etc/default/ssh
|
echo "SSHD_OPTS=" >> ${IMAGE_ROOTFS}/etc/default/ssh
|
||||||
else
|
else
|
||||||
echo "SYSCONFDIR=/var/run/ssh" >> ${IMAGE_ROOTFS}/etc/default/ssh
|
echo "SYSCONFDIR=\${SYSCONFDIR:-/var/run/ssh}" >> ${IMAGE_ROOTFS}/etc/default/ssh
|
||||||
echo "SSHD_OPTS='-f /etc/ssh/sshd_config_readonly'" >> ${IMAGE_ROOTFS}/etc/default/ssh
|
echo "SSHD_OPTS='-f /etc/ssh/sshd_config_readonly'" >> ${IMAGE_ROOTFS}/etc/default/ssh
|
||||||
fi
|
fi
|
||||||
fi
|
fi
|
||||||
|
|
|
@ -19,10 +19,24 @@ fi
|
||||||
[ -z "$SYSCONFDIR" ] && SYSCONFDIR=/etc/ssh
|
[ -z "$SYSCONFDIR" ] && SYSCONFDIR=/etc/ssh
|
||||||
mkdir -p $SYSCONFDIR
|
mkdir -p $SYSCONFDIR
|
||||||
|
|
||||||
HOST_KEY_RSA=$SYSCONFDIR/ssh_host_rsa_key
|
parse_sshd_opts() {
|
||||||
HOST_KEY_DSA=$SYSCONFDIR/ssh_host_dsa_key
|
set -- ${SSHD_OPTS} --
|
||||||
HOST_KEY_ECDSA=$SYSCONFDIR/ssh_host_ecdsa_key
|
sshd_config=/etc/ssh/sshd_config
|
||||||
HOST_KEY_ED25519=$SYSCONFDIR/ssh_host_ed25519_key
|
while true ; do
|
||||||
|
case "$1" in
|
||||||
|
-f*) if [ "$1" = "-f" ] ; then
|
||||||
|
sshd_config="$2"
|
||||||
|
shift
|
||||||
|
else
|
||||||
|
sshd_config="${1#-f}"
|
||||||
|
fi
|
||||||
|
shift
|
||||||
|
;;
|
||||||
|
--) shift; break;;
|
||||||
|
*) shift;;
|
||||||
|
esac
|
||||||
|
done
|
||||||
|
}
|
||||||
|
|
||||||
check_for_no_start() {
|
check_for_no_start() {
|
||||||
# forget it if we're trying to start, and /etc/ssh/sshd_not_to_be_run exists
|
# forget it if we're trying to start, and /etc/ssh/sshd_not_to_be_run exists
|
||||||
|
@ -45,21 +59,45 @@ check_config() {
|
||||||
}
|
}
|
||||||
|
|
||||||
check_keys() {
|
check_keys() {
|
||||||
|
# parse location of keys
|
||||||
|
local HOST_KEY_RSA
|
||||||
|
local HOST_KEY_DSA
|
||||||
|
local HOST_KEY_ECDSA
|
||||||
|
local HOST_KEY_ED25519
|
||||||
|
|
||||||
|
parse_sshd_opts
|
||||||
|
HOST_KEY_RSA=$(grep ^HostKey "${sshd_config}" | grep _rsa_ | tail -1 | awk ' { print $2 } ')
|
||||||
|
[ -z "${HOST_KEY_RSA}" ] && HOST_KEY_RSA=$(grep HostKey "${sshd_config}" | grep _rsa_ | tail -1 | awk ' { print $2 } ')
|
||||||
|
[ -z "${HOST_KEY_RSA}" ] && HOST_KEY_RSA=$SYSCONFDIR/ssh_host_rsa_key
|
||||||
|
HOST_KEY_DSA=$(grep ^HostKey "${sshd_config}" | grep _dsa_ | tail -1 | awk ' { print $2 } ')
|
||||||
|
[ -z "${HOST_KEY_DSA}" ] && HOST_KEY_DSA=$(grep HostKey "${sshd_config}" | grep _dsa_ | tail -1 | awk ' { print $2 } ')
|
||||||
|
[ -z "${HOST_KEY_DSA}" ] && HOST_KEY_DSA=$SYSCONFDIR/ssh_host_dsa_key
|
||||||
|
HOST_KEY_ECDSA=$(grep ^HostKey "${sshd_config}" | grep _ecdsa_ | tail -1 | awk ' { print $2 } ')
|
||||||
|
[ -z "${HOST_KEY_ECDSA}" ] && HOST_KEY_ECDSA=$(grep HostKey "${sshd_config}" | grep _ecdsa_ | tail -1 | awk ' { print $2 } ')
|
||||||
|
[ -z "${HOST_KEY_ECDSA}" ] && HOST_KEY_ECDSA=$SYSCONFDIR/ssh_host_ecdsa_key
|
||||||
|
HOST_KEY_ED25519=$(grep ^HostKey "${sshd_config}" | grep _ed25519_ | tail -1 | awk ' { print $2 } ')
|
||||||
|
[ -z "${HOST_KEY_ED25519}" ] && HOST_KEY_ED25519=$(grep HostKey "${sshd_config}" | grep _ed25519_ | tail -1 | awk ' { print $2 } ')
|
||||||
|
[ -z "${HOST_KEY_ED25519}" ] && HOST_KEY_ED25519=$SYSCONFDIR/ssh_host_ed25519_key
|
||||||
|
|
||||||
# create keys if necessary
|
# create keys if necessary
|
||||||
if [ ! -f $HOST_KEY_RSA ]; then
|
if [ ! -f $HOST_KEY_RSA ]; then
|
||||||
echo " generating ssh RSA key..."
|
echo " generating ssh RSA key..."
|
||||||
|
mkdir -p $(dirname $HOST_KEY_RSA)
|
||||||
ssh-keygen -q -f $HOST_KEY_RSA -N '' -t rsa
|
ssh-keygen -q -f $HOST_KEY_RSA -N '' -t rsa
|
||||||
fi
|
fi
|
||||||
if [ ! -f $HOST_KEY_ECDSA ]; then
|
if [ ! -f $HOST_KEY_ECDSA ]; then
|
||||||
echo " generating ssh ECDSA key..."
|
echo " generating ssh ECDSA key..."
|
||||||
|
mkdir -p $(dirname $HOST_KEY_ECDSA)
|
||||||
ssh-keygen -q -f $HOST_KEY_ECDSA -N '' -t ecdsa
|
ssh-keygen -q -f $HOST_KEY_ECDSA -N '' -t ecdsa
|
||||||
fi
|
fi
|
||||||
if [ ! -f $HOST_KEY_DSA ]; then
|
if [ ! -f $HOST_KEY_DSA ]; then
|
||||||
echo " generating ssh DSA key..."
|
echo " generating ssh DSA key..."
|
||||||
|
mkdir -p $(dirname $HOST_KEY_DSA)
|
||||||
ssh-keygen -q -f $HOST_KEY_DSA -N '' -t dsa
|
ssh-keygen -q -f $HOST_KEY_DSA -N '' -t dsa
|
||||||
fi
|
fi
|
||||||
if [ ! -f $HOST_KEY_ED25519 ]; then
|
if [ ! -f $HOST_KEY_ED25519 ]; then
|
||||||
echo " generating ssh ED25519 key..."
|
echo " generating ssh ED25519 key..."
|
||||||
|
mkdir -p $(dirname $HOST_KEY_ED25519)
|
||||||
ssh-keygen -q -f $HOST_KEY_ED25519 -N '' -t ed25519
|
ssh-keygen -q -f $HOST_KEY_ED25519 -N '' -t ed25519
|
||||||
fi
|
fi
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in New Issue