dropbear: change start-up script to honour pre-existing keys

Quoted 1 line

Quoted 1 line

Quoted 1 line

Quoted 1 line

"Markus" == Markus Mayer <[email protected]> writes:

From: Markus Mayer <[email protected]>
Rather than starting dropbear with option -R at all times, we only do so if no existing key file is found. This lets dropbear honour pre-existing key files, including keys copied into the root file system at build time.

From: Markus Mayer <[email protected]>

Rather than starting dropbear with option -R at all times, we only do so if no existing key file is found. This lets dropbear honour pre-existing key files, including keys copied into the root file system at build time.

Signed-off-by Markus Mayer <[email protected]>

---
 package/dropbear/S50dropbear | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

package/dropbear/S50dropbear +9 -2

index 9474eaa..8eea9ae 100644
@@ -7,7 +7,7 @@
 test -r /etc/default/dropbear && . /etc/default/dropbear
 
 start() {
-	DROPBEAR_ARGS="$DROPBEAR_ARGS -R"
+	msg=' '
 
 	# If /etc/dropbear is a symlink to /var/run/dropbear, and
 	#   - the filesystem is RO (i.e. we can not rm the symlink),

@@ -26,7 +26,14 @@ start() {
 		fi
 	fi
 
-	printf "Starting dropbear sshd: "
+	ls /etc/dropbear/*host_key >/dev/null 2>&1
+	if [ $? != 0 ]; then
+		# No key files found. We need to generate a key.
+		DROPBEAR_ARGS="$DROPBEAR_ARGS -R"
+		msg='(with new key) '
+	fi
+
+	printf "Starting dropbear sshd: $msg"
 	umask 077
 
 	start-stop-daemon -S -q -p /var/run/dropbear.pid \

Quoted 5 lines · Arnout Vandecappelle

Quoted 2 lines · Markus Mayer

From: Markus Mayer <[email protected]>

Quoted 7 lines

Quoted 4 lines

Rather than starting dropbear with option -R at all times, we only do so if no existing key file is found. This lets dropbear honour pre-existing key files, including keys copied into the root file system at build time.

That's exactly what the -R option does, no? It creates host keys if they don't
exist yet. Cfr. svr_ensure_hostkey in svr-kex.c.

That's what I expected, too, but it doesn't work that way for me.

I am not entirely sure why. I do see dropbear using a different SSH key every time the system is booted, even if a key file already exists whenever it is started using -R. It is trying to use ECDSA keys. The pre-generated key I am copying into the rootfs is an RSA key. I am running with initrd, so the ECDSA key disappears upon reboot. Fact remains that it is ignoring the existing RSA key.

Here's an example of what I see:

# ssh localhost
Host 'localhost' is not in the trusted hosts file.
(ssh-rsa fingerprint md5 3c:62:78:a7:4a:4e:c5:69:cb:57:06:c6:b1:20:2e:9a)
Do you want to continue connecting? (y/n) ^C

Using the RSA key, as it is supposed to. But only because it was started without -R.

# ps aux|grep drop
 1471 root     /usr/sbin/dropbear
 1506 root     grep drop

Re-starting with -R.

# kill 1471
# /usr/sbin/dropbear -R

And trying it again.

# ssh localhost
Host 'localhost' is not in the trusted hosts file.
(ecdsa-sha2-nistp521 fingerprint md5
f4:c8:5a:37:ac:20:80:96:9f:2b:72:1b:ee:7d:c1:1e)
Do you want to continue connecting? (y/n) ^C

Promptly using an ECDSA key now. Freshly generated.

# date
Thu Jan  1 00:03:12 UTC 1970

# ls -l /etc/dropbear/
total 8

(quoted diff) +0 -2

-rw-------    1 root     root           243 Jan  1 00:01 dropbear_ecdsa_host_key
-rw-------    1 root     root          1573 Nov  1  2017 dropbear_rsa_host_key

dropbear_ecdsa_host_key is does not exist in the initrd. dropbear_rsa_host_key does.

Regards,
-Markus

Quoted 47 lines

Regards,
Arnout

Quoted 26 lines

Signed-off-by Markus Mayer <[email protected]>

---
 package/dropbear/S50dropbear | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

package/dropbear/S50dropbear +2 -2

index 9474eaa..8eea9ae 100644
@@ -7,7 +7,7 @@
 test -r /etc/default/dropbear && . /etc/default/dropbear
 
 start() {
-     DROPBEAR_ARGS="$DROPBEAR_ARGS -R"
+     msg=' '
 
      # If /etc/dropbear is a symlink to /var/run/dropbear, and
      #   - the filesystem is RO (i.e. we can not rm the symlink),

@@ -26,7 +26,14 @@ start() {
              fi
      fi
 
-     printf "Starting dropbear sshd: "
+     ls /etc/dropbear/*host_key >/dev/null 2>&1

package/dropbear/S50dropbear start() { · line 39

Quoted 10 lines

package/dropbear/S50dropbear +7 -0

+     if [ $? != 0 ]; then
+             # No key files found. We need to generate a key.
+             DROPBEAR_ARGS="$DROPBEAR_ARGS -R"
+             msg='(with new key) '
+     fi
+
+     printf "Starting dropbear sshd: $msg"
      umask 077
 
      start-stop-daemon -S -q -p /var/run/dropbear.pid \

--

Arnout Vandecappelle                          arnout at mind be
Senior Embedded Software Architect            +32-16-286500
Essensium/Mind                                http://www.mind.be
G.Geenslaan 9, 3001 Leuven, Belgium           BE 872 984 063 RPR Leuven
LinkedIn profile: http://www.linkedin.com/in/arnoutvandecappelle
GPG fingerprint:  7493 020B C7E3 8618 8DEC 222C 82EB F404 F9AC 0DDF

Quoted 1 line

Quoted 1 line

Quoted 1 line

Quoted 1 line

"Arnout" == Arnout Vandecappelle <[email protected]> writes:

I still don't think that your solution in the init script is very elegant. I
think it's rather exceptional that you want only an RSA host key in your rootfs and not an ECDSA and/or DSS key. If you really want that, you can put a custom init script in your fs overlay that removes -R completely. Or you can add a DROPBEAR_POST_EXTRACT_HOOK in your local.mk that removes DROPBEAR_ECDSA from options.h.

Quoted 1 line

Quoted 1 line

Quoted 1 line

Quoted 1 line

Quoted 1 line

"Arnout" == Arnout Vandecappelle <[email protected]> writes:

Hi,

Quoted 6 lines

I still don't think that your solution in the init script is very elegant. I
think it's rather exceptional that you want only an RSA host key in your rootfs and not an ECDSA and/or DSS key. If you really want that, you can put a custom init script in your fs overlay that removes -R completely. Or you can add a DROPBEAR_POST_EXTRACT_HOOK in your local.mk that removes DROPBEAR_ECDSA from options.h.

Agreed, don't enable ecdsa support (in your client and in dropbear) if you don't want it.