package/openssh: Add option to populate keys on build
PATCH 1/1 package/openssh: Add option to populate keys on build
During development phase and on targets with read-only file systems, generating SSH keys on boot is not an option.
Add option to generate and populate SSH keys during build.
--- package/openssh/Config.in | 12 ++++++++++++ package/openssh/openssh.mk | 11 +++++++++++ 2 files changed, 23 insertions(+)
package/openssh/Config.in +12 -0
@@ -9,3 +9,15 @@ config BR2_PACKAGE_OPENSSH friends. http://www.openssh.com/ + +if BR2_PACKAGE_OPENSSH + +config BR2_PACKAGE_OPENSSH_POPULATE_KEYS + bool "Populate device keys" + help + Populate the image with device keys instead + of generating them on each boot. + This option has security implications, and + should be only used in development or on target + with read-only root file-system. +endif
package/openssh/openssh.mk +11 -0
@@ -86,6 +86,17 @@ define OPENSSH_INSTALL_SSH_COPY_ID $(INSTALL) -D -m 755 $(@D)/contrib/ssh-copy-id $(TARGET_DIR)/usr/bin/ssh-copy-id endef +define OPENSSH_POPULATE_KEYS + ssh-keygen -q -f ${TARGET_DIR}/etc/ssh/ssh_host_rsa_key -N '' -t rsa + ssh-keygen -q -f ${TARGET_DIR}/etc/ssh/ssh_host_ecdsa_key -N '' -t ecdsa + ssh-keygen -q -f ${TARGET_DIR}/etc/ssh/ssh_host_dsa_key -N '' -t dsa + ssh-keygen -q -f ${TARGET_DIR}/etc/ssh/ssh_host_ed25519_key -N '' -t ed25519 +endef + +ifeq ($(BR2_PACKAGE_OPENSSH_POPULATE_KEYS),y) +OPENSSH_POST_INSTALL_TARGET_HOOKS += OPENSSH_POPULATE_KEYS +endif + OPENSSH_POST_INSTALL_TARGET_HOOKS += OPENSSH_INSTALL_SSH_COPY_ID $(eval $(autotools-package))
Signature · 1 line
2.26.2
PATCH 1/1 package/openssh: Add option to populate keys on build
Hello,
Quoted 6 lines · On Wed, 29 Apr 2020 15:41:38 +0300 Ramon Fried <[email protected]> wrote:
During development phase and on targets with read-only file systems, generating SSH keys on boot is not an option.
Add option to generate and populate SSH keys during build.
Signed-off-by Ramon Fried <[email protected]>
I don't really have a very well formed opinion on whether we want this or not. Feedback from other developers/contributors might be useful.
package/openssh/Config.in config BR2_PACKAGE_OPENSSH · line 16
Quoted 4 lines
package/openssh/Config.in +4
-0+if BR2_PACKAGE_OPENSSH + +config BR2_PACKAGE_OPENSSH_POPULATE_KEYS + bool "Populate device keys"
bool "Generate host keys during build"
Perhaps.
package/openssh/Config.in config BR2_PACKAGE_OPENSSH · line 22
Quoted 6 lines
package/openssh/Config.in +6
-0+ help + Populate the image with device keys instead + of generating them on each boot. + This option has security implications, and + should be only used in development or on target + with read-only root file-system.
Please fix the indentation: it should be one tab + two spaces, and the line should try to use the 72-characters width as much as possible. Run "make check-package" to check for such coding style issues.
package/openssh/openssh.mk define OPENSSH_INSTALL_SSH_COPY_ID · line 89
Quoted 10 lines
(quoted diff) +1
-0+endifpackage/openssh/openssh.mk +1
-0@@ -86,6 +86,17 @@ define OPENSSH_INSTALL_SSH_COPY_ID $(INSTALL) -D -m 755 $(@D)/contrib/ssh-copy-id $(TARGET_DIR)/usr/bin/ssh-copy-id endef +define OPENSSH_POPULATE_KEYS
Should be defined within the ifeq ($(BR2_PACKAGE_OPENSSH_POPULATE_KEYS),y) condition.
package/openssh/openssh.mk define OPENSSH_INSTALL_SSH_COPY_ID · line 93
Quoted 4 lines
package/openssh/openssh.mk +4
-0+ ssh-keygen -q -f ${TARGET_DIR}/etc/ssh/ssh_host_rsa_key -N '' -t rsa + ssh-keygen -q -f ${TARGET_DIR}/etc/ssh/ssh_host_ecdsa_key -N '' -t ecdsa + ssh-keygen -q -f ${TARGET_DIR}/etc/ssh/ssh_host_dsa_key -N '' -t dsa + ssh-keygen -q -f ${TARGET_DIR}/etc/ssh/ssh_host_ed25519_key -N '' -t ed25519
Use $(...) to reference make variable instead of ${...}. Also, perhaps a small loop makes sense:
$(foreach type,rsa ecdsa dsa ed25519,\ ssh-keygen -q -f $(TARGET_DIR)/etc/ssh/ssh_host_$(type)_key -N '' -t $(type) )
But wait: where is ssh-keygen coming from? We're not building it, so you're relying on the one available on your build machine. This is not acceptable for Buildroot, as we don't expect ssh-keygen to be available on the host machine. So if we want to do what you propose, we would need to build ssh-keygen for the host machine, using a host-openssh package.
package/openssh/openssh.mk define OPENSSH_INSTALL_SSH_COPY_ID · line 100
Quoted 7 lines
package/openssh/openssh.mk +6
-0+endef + +ifeq ($(BR2_PACKAGE_OPENSSH_POPULATE_KEYS),y) +OPENSSH_POST_INSTALL_TARGET_HOOKS += OPENSSH_POPULATE_KEYS +endif + OPENSSH_POST_INSTALL_TARGET_HOOKS += OPENSSH_INSTALL_SSH_COPY_ID
Please keep this hook registration next to its definition.
Thanks!
Thomas
Signature · 3 lines
Thomas Petazzoni, CTO, Bootlin Embedded Linux and Kernel engineering https://bootlin.com
PATCH 1/1 package/openssh: Add option to populate keys on build
Quoted 9 lines · Thomas Petazzoni
Hello,
Quoted 3 lines · On Wed, 29 Apr 2020 15:41:38 +0300 Ramon Fried <[email protected]> wrote:
During development phase and on targets with read-only file systems, generating SSH keys on boot is not an option.
Quoted 6 lines
Quoted 3 lines
Add option to generate and populate SSH keys during build.
Signed-off-by Ramon Fried <[email protected]>I don't really have a very well formed opinion on whether we want this or not. Feedback from other developers/contributors might be useful.
This is a real world scenario, I can understand if it doesn't fit upstream. But I saw several projects during the years that generated keys in the build time
either by this method, or just by putting them in fs-overlay.
Quoted 7 lines
package/openssh/Config.in config BR2_PACKAGE_OPENSSH · line 16
Quoted 5 lines
package/openssh/Config.in +4
-0+if BR2_PACKAGE_OPENSSH + +config BR2_PACKAGE_OPENSSH_POPULATE_KEYS + bool "Populate device keys"bool "Generate host keys during build"
ok.
Quoted 10 lines
Perhaps.
package/openssh/Config.in config BR2_PACKAGE_OPENSSH · line 22
Quoted 6 lines
package/openssh/Config.in +6
-0+ help + Populate the image with device keys instead + of generating them on each boot. + This option has security implications, and + should be only used in development or on target + with read-only root file-system.
Quoted 3 lines
Please fix the indentation: it should be one tab + two spaces, and the line should try to use the 72-characters width as much as possible. Run "make check-package" to check for such coding style issues.
Sure
Quoted 10 lines
Quoted 10 lines
(quoted diff) +1
-0+endifpackage/openssh/openssh.mk +0
-0@@ -86,6 +86,17 @@ define OPENSSH_INSTALL_SSH_COPY_ID $(INSTALL) -D -m 755 $(@D)/contrib/ssh-copy-id $(TARGET_DIR)/usr/bin/ssh-copy-id endef
Quoted 10 lines
package/openssh/openssh.mk define OPENSSH_INSTALL_SSH_COPY_ID · line 89
Quoted 1 line
package/openssh/openssh.mk +1
-0+define OPENSSH_POPULATE_KEYSShould be defined within the ifeq ($(BR2_PACKAGE_OPENSSH_POPULATE_KEYS),y) condition.
Quoted 4 lines
package/openssh/openssh.mk +4
-0+ ssh-keygen -q -f ${TARGET_DIR}/etc/ssh/ssh_host_rsa_key -N '' -t rsa + ssh-keygen -q -f ${TARGET_DIR}/etc/ssh/ssh_host_ecdsa_key -N '' -t ecdsa + ssh-keygen -q -f ${TARGET_DIR}/etc/ssh/ssh_host_dsa_key -N '' -t dsa + ssh-keygen -q -f ${TARGET_DIR}/etc/ssh/ssh_host_ed25519_key -N '' -t ed25519
ok.
Quoted 7 lines
Use $(...) to reference make variable instead of ${...}. Also, perhaps a small loop makes sense:
$(foreach type,rsa ecdsa dsa ed25519,\ ssh-keygen -q -f $(TARGET_DIR)/etc/ssh/ssh_host_$(type)_key -N '' -t $(type) )
Sure.
Quoted 6 lines
But wait: where is ssh-keygen coming from? We're not building it, so you're relying on the one available on your build machine. This is not acceptable for Buildroot, as we don't expect ssh-keygen to be available on the host machine. So if we want to do what you propose, we would need to build ssh-keygen for the host machine, using a host-openssh package.
I was wondering this myself as well, I think it's huge overhead to compile the entire openssh
just to generate keys. Most linux distros have it already installed, nevertheless, we can document that under
https://buildroot.org/downloads/manual/manual.html#requirement-optional
Right ?
Quoted 10 lines
package/openssh/openssh.mk define OPENSSH_INSTALL_SSH_COPY_ID · line 100
Quoted 8 lines
package/openssh/openssh.mk +6
-0+endef + +ifeq ($(BR2_PACKAGE_OPENSSH_POPULATE_KEYS),y) +OPENSSH_POST_INSTALL_TARGET_HOOKS += OPENSSH_POPULATE_KEYS +endif + OPENSSH_POST_INSTALL_TARGET_HOOKS += OPENSSH_INSTALL_SSH_COPY_IDPlease keep this hook registration next to its definition.
ok.
Quoted 8 lines
Thanks!
Thomas
--
Thomas Petazzoni, CTO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com
PATCH 1/1 package/openssh: Add option to populate keys on build
In reply to Thomas PetazzoniThomas, Ramon, All,
On 2020-04-29 22:19 +0200, Thomas Petazzoni spake thusly:
Quoted 6 lines
Quoted 3 lines · On Wed, 29 Apr 2020 15:41:38 +0300 Ramon Fried <[email protected]> wrote:
During development phase and on targets with read-only file systems, generating SSH keys on boot is not an option.
Quoted 6 lines
Quoted 3 lines
Add option to generate and populate SSH keys during build.
Signed-off-by Ramon Fried <[email protected]>I don't really have a very well formed opinion on whether we want this or not. Feedback from other developers/contributors might be useful.
I would be relatively opposed to that. If we want to generate keys at build time, then it means we do not really care about the content of said keys.
In that case, I would prefer we do for openssh like we do for dropbear:
generate the keys at boot, and if the filesystem ir R/O, redirect the keys to /var/run. See:
package/dropbear/S50dropbear package/dropbear/dropbear.service
If however the content of the keys are important, then they should not be generated, but installed (e.g. by a package or by an overlay).
In either case, I'm not too much in favour for that patch.
Regards,
Yann E. MORIN.
Quoted 74 lines
package/openssh/Config.in config BR2_PACKAGE_OPENSSH · line 16
Quoted 4 lines
package/openssh/Config.in +4
-0+if BR2_PACKAGE_OPENSSH + +config BR2_PACKAGE_OPENSSH_POPULATE_KEYS + bool "Populate device keys"bool "Generate host keys during build"
Perhaps.
package/openssh/Config.in config BR2_PACKAGE_OPENSSH · line 22
Quoted 6 lines
package/openssh/Config.in +6
-0+ help + Populate the image with device keys instead + of generating them on each boot. + This option has security implications, and + should be only used in development or on target + with read-only root file-system.Please fix the indentation: it should be one tab + two spaces, and the line should try to use the 72-characters width as much as possible. Run "make check-package" to check for such coding style issues.
package/openssh/openssh.mk define OPENSSH_INSTALL_SSH_COPY_ID · line 89
Quoted 10 lines
(quoted diff) +1
-0+endifpackage/openssh/openssh.mk +1
-0@@ -86,6 +86,17 @@ define OPENSSH_INSTALL_SSH_COPY_ID $(INSTALL) -D -m 755 $(@D)/contrib/ssh-copy-id $(TARGET_DIR)/usr/bin/ssh-copy-id endef +define OPENSSH_POPULATE_KEYSShould be defined within the ifeq ($(BR2_PACKAGE_OPENSSH_POPULATE_KEYS),y) condition.
package/openssh/openssh.mk define OPENSSH_INSTALL_SSH_COPY_ID · line 93
Quoted 4 lines
package/openssh/openssh.mk +4
-0+ ssh-keygen -q -f ${TARGET_DIR}/etc/ssh/ssh_host_rsa_key -N '' -t rsa + ssh-keygen -q -f ${TARGET_DIR}/etc/ssh/ssh_host_ecdsa_key -N '' -t ecdsa + ssh-keygen -q -f ${TARGET_DIR}/etc/ssh/ssh_host_dsa_key -N '' -t dsa + ssh-keygen -q -f ${TARGET_DIR}/etc/ssh/ssh_host_ed25519_key -N '' -t ed25519Use $(...) to reference make variable instead of ${...}. Also, perhaps a small loop makes sense:
$(foreach type,rsa ecdsa dsa ed25519,\ ssh-keygen -q -f $(TARGET_DIR)/etc/ssh/ssh_host_$(type)_key -N '' -t $(type) )But wait: where is ssh-keygen coming from? We're not building it, so you're relying on the one available on your build machine. This is not acceptable for Buildroot, as we don't expect ssh-keygen to be available on the host machine. So if we want to do what you propose, we would need to build ssh-keygen for the host machine, using a host-openssh package.
package/openssh/openssh.mk define OPENSSH_INSTALL_SSH_COPY_ID · line 100
Quoted 7 lines
package/openssh/openssh.mk +6
-0+endef + +ifeq ($(BR2_PACKAGE_OPENSSH_POPULATE_KEYS),y) +OPENSSH_POST_INSTALL_TARGET_HOOKS += OPENSSH_POPULATE_KEYS +endif + OPENSSH_POST_INSTALL_TARGET_HOOKS += OPENSSH_INSTALL_SSH_COPY_IDPlease keep this hook registration next to its definition.
Thanks!
Thomas
Signature · 7 lines
Thomas Petazzoni, CTO, Bootlin Embedded Linux and Kernel engineering https://bootlin.com _______________________________________________ buildroot mailing list buildroot at busybox.net http://lists.busybox.net/mailman/listinfo/buildroot
Signature · 6 lines
.-----------------.--------------------.------------------.--------------------. | Yann E. MORIN | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: | | +33 662 376 056 | Software Designer | \ / CAMPAIGN | ___ | | +33 561 099 427 `------------.-------: X AGAINST | \e/ There is no | | http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL | v conspiracy. | '------------------------------^-------^------------------^--------------------'