openssh: allow to override OpenSSL HostKeys when read-only-rootfs

PATCH In review André Draszik 2 participants 2 messages Jun 13, 2017 – Jun 30, 2017

lore

Share & tools

lore

André Draszik

author

2017-06-13 08:27 UTC #0 lore raw

PATCH 1/1 openssh: allow to override OpenSSL HostKeys when read-only-rootfs

From: André Draszik <[email protected]>

With these changes it is possible to have a .bbappend that
- sets SYSCONFDIR to some persistent storage
- modifies SYSCONFDIR/sshd_config to use ssh host keys from the (writable) sysconfdir

Signed-off-by André Draszik <[email protected]>

Reviewed-by Stephane Ayotte <[email protected]>

Signed-off-by Ross Burton <[email protected]>

(cherry picked from commit 106b59d9f96f70d133fa1421091ad280d27a5b6a)

---
 meta/classes/rootfs-postcommands.bbclass       |  4 +--
 meta/recipes-connectivity/openssh/openssh/init | 46 +++++++++++++++++++++++---
 2 files changed, 44 insertions(+), 6 deletions(-)

meta/classes/rootfs-postcommands.bbclass +2 -2

index 498174a664..abf4e14f4c 100644
@@ -91,10 +91,10 @@ read_only_rootfs_hook () {
 	# and the keys under /var/run/ssh.
 	if [ -d ${IMAGE_ROOTFS}/etc/ssh ]; then
 		if [ -e ${IMAGE_ROOTFS}/etc/ssh/ssh_host_rsa_key ]; then
-			echo "SYSCONFDIR=/etc/ssh" >> ${IMAGE_ROOTFS}/etc/default/ssh
+			echo "SYSCONFDIR=\${SYSCONFDIR:-/etc/ssh}" >> ${IMAGE_ROOTFS}/etc/default/ssh
 			echo "SSHD_OPTS=" >> ${IMAGE_ROOTFS}/etc/default/ssh
 		else
-			echo "SYSCONFDIR=/var/run/ssh" >> ${IMAGE_ROOTFS}/etc/default/ssh
+			echo "SYSCONFDIR=\${SYSCONFDIR:-/var/run/ssh}" >> ${IMAGE_ROOTFS}/etc/default/ssh
 			echo "SSHD_OPTS='-f /etc/ssh/sshd_config_readonly'" >> ${IMAGE_ROOTFS}/etc/default/ssh
 		fi
 	fi

meta/recipes-connectivity/openssh/openssh/init +42 -4

73 lines not on this page · raw message

Signature · 1 line

2.11.0

Joshua Watt

2017-06-30 13:52 UTC #1 lore raw

Quoted 133 lines · André Draszik

From: André Draszik <[email protected]>
With these changes it is possible to have a .bbappend that
- sets SYSCONFDIR to some persistent storage
- modifies SYSCONFDIR/sshd_config to use ssh host keys from the (writable) sysconfdir
Signed-off-by André Draszik <[email protected]>
Reviewed-by Stephane Ayotte <[email protected]>
Signed-off-by Ross Burton <[email protected]>
(cherry picked from commit 106b59d9f96f70d133fa1421091ad280d27a5b6a)
---
meta/classes/rootfs-postcommands.bbclass | 4 +-- meta/recipes-connectivity/openssh/openssh/init | 46
+++++++++++++++++++++++---
 2 files changed, 44 insertions(+), 6 deletions(-)
meta/classes/rootfs-postcommands.bbclass +0 -0
index 498174a664..abf4e14f4c 100644
@@ -91,10 +91,10 @@ read_only_rootfs_hook () {
  	# and the keys under /var/run/ssh.
if [ -d ${IMAGE_ROOTFS}/etc/ssh ]; then
if [ -e ${IMAGE_ROOTFS}/etc/ssh/ssh_host_rsa_key ]; then
meta/classes/rootfs-postcommands.bbclass +0 -1
-			echo "SYSCONFDIR=/etc/ssh" >>
${IMAGE_ROOTFS}/etc/default/ssh
meta/classes/rootfs-postcommands.bbclass +1 -0
+			echo "SYSCONFDIR=\${SYSCONFDIR:-/etc/ssh}"
Quoted 1 line
Quoted 1 line
${IMAGE_ROOTFS}/etc/default/ssh
echo "SSHD_OPTS=" >> ${IMAGE_ROOTFS}/etc/default/ssh
else
meta/classes/rootfs-postcommands.bbclass +0 -1
-			echo "SYSCONFDIR=/var/run/ssh" >>
${IMAGE_ROOTFS}/etc/default/ssh
meta/classes/rootfs-postcommands.bbclass +1 -0
+			echo "SYSCONFDIR=\${SYSCONFDIR:-
/var/run/ssh}" >> ${IMAGE_ROOTFS}/etc/default/ssh
echo "SSHD_OPTS='-f /etc/ssh/sshd_config_readonly'" >> ${IMAGE_ROOTFS}/etc/default/ssh fi
fi
meta/recipes-connectivity/openssh/openssh/init +0 -0
index 1f63725cc0..386628afc8 100644
@@ -19,10 +19,24 @@ fi
[ -z "$SYSCONFDIR" ] && SYSCONFDIR=/etc/ssh mkdir -p $SYSCONFDIR
meta/recipes-connectivity/openssh/openssh/init +18 -4
-HOST_KEY_RSA=$SYSCONFDIR/ssh_host_rsa_key
-HOST_KEY_DSA=$SYSCONFDIR/ssh_host_dsa_key
-HOST_KEY_ECDSA=$SYSCONFDIR/ssh_host_ecdsa_key
-HOST_KEY_ED25519=$SYSCONFDIR/ssh_host_ed25519_key
+parse_sshd_opts() {
+    set -- ${SSHD_OPTS} --
+    sshd_config=/etc/ssh/sshd_config
+    while true ; do
+        case "$1" in
+        -f*) if [ "$1" = "-f" ] ; then
+                 sshd_config="$2"
+                 shift
+             else
+                 sshd_config="${1#-f}"
+             fi
+             shift
+             ;;
+        --) shift; break;;
+        *) shift;;
+        esac
+    done
+}
check_for_no_start() {
     # forget it if we're trying to start, and
/etc/ssh/sshd_not_to_be_run exists
meta/recipes-connectivity/openssh/openssh/init +0 -0
@@ -45,21 +59,45 @@ check_config() {
  }
check_keys() {
meta/recipes-connectivity/openssh/openssh/init +8 -0
+	# parse location of keys
+	local HOST_KEY_RSA
+	local HOST_KEY_DSA
+	local HOST_KEY_ECDSA
+	local HOST_KEY_ED25519
+
+	parse_sshd_opts
+	HOST_KEY_RSA=$(grep ^HostKey "${sshd_config}" | grep _rsa_ |
tail -1 | awk ' { print $2 } ')
meta/recipes-connectivity/openssh/openssh/init +1 -0
+	[ -z "${HOST_KEY_RSA}" ] && HOST_KEY_RSA=$(grep HostKey
"${sshd_config}" | grep _rsa_ | tail -1 | awk ' { print $2 } ')
meta/recipes-connectivity/openssh/openssh/init +1 -0
+	[ -z "${HOST_KEY_RSA}" ] &&
HOST_KEY_RSA=$SYSCONFDIR/ssh_host_rsa_key
meta/recipes-connectivity/openssh/openssh/init +1 -0
+	HOST_KEY_DSA=$(grep ^HostKey "${sshd_config}" | grep _dsa_ |
tail -1 | awk ' { print $2 } ')
meta/recipes-connectivity/openssh/openssh/init +1 -0
+	[ -z "${HOST_KEY_DSA}" ] && HOST_KEY_DSA=$(grep HostKey
"${sshd_config}" | grep _dsa_ | tail -1 | awk ' { print $2 } ')
meta/recipes-connectivity/openssh/openssh/init +1 -0
+	[ -z "${HOST_KEY_DSA}" ] &&
HOST_KEY_DSA=$SYSCONFDIR/ssh_host_dsa_key
meta/recipes-connectivity/openssh/openssh/init +1 -0
+	HOST_KEY_ECDSA=$(grep ^HostKey "${sshd_config}" | grep
_ecdsa_ | tail -1 | awk ' { print $2 } ')
meta/recipes-connectivity/openssh/openssh/init +1 -0
+	[ -z "${HOST_KEY_ECDSA}" ] && HOST_KEY_ECDSA=$(grep HostKey
"${sshd_config}" | grep _ecdsa_ | tail -1 | awk ' { print $2 } ')
meta/recipes-connectivity/openssh/openssh/init +1 -0
+	[ -z "${HOST_KEY_ECDSA}" ] &&
HOST_KEY_ECDSA=$SYSCONFDIR/ssh_host_ecdsa_key
meta/recipes-connectivity/openssh/openssh/init +1 -0
+	HOST_KEY_ED25519=$(grep ^HostKey "${sshd_config}" | grep
_ed25519_ | tail -1 | awk ' { print $2 } ')
meta/recipes-connectivity/openssh/openssh/init +1 -0
+	[ -z "${HOST_KEY_ED25519}" ] && HOST_KEY_ED25519=$(grep
HostKey "${sshd_config}" | grep _ed25519_ | tail -1 | awk ' { print $2 } ')
meta/recipes-connectivity/openssh/openssh/init +1 -0
+	[ -z "${HOST_KEY_ED25519}" ] &&
HOST_KEY_ED25519=$SYSCONFDIR/ssh_host_ed25519_key +
 	# create keys if necessary
 	if [ ! -f $HOST_KEY_RSA ]; then
 		echo "  generating ssh RSA key..."
meta/recipes-connectivity/openssh/openssh/init +1 -0
+		mkdir -p $(dirname $HOST_KEY_RSA)
ssh-keygen -q -f $HOST_KEY_RSA -N '' -t rsa fi
if [ ! -f $HOST_KEY_ECDSA ]; then
echo " generating ssh ECDSA key..."
meta/recipes-connectivity/openssh/openssh/init +1 -0
+		mkdir -p $(dirname $HOST_KEY_ECDSA)
ssh-keygen -q -f $HOST_KEY_ECDSA -N '' -t ecdsa fi
if [ ! -f $HOST_KEY_DSA ]; then
echo " generating ssh DSA key..."
meta/recipes-connectivity/openssh/openssh/init +1 -0
+		mkdir -p $(dirname $HOST_KEY_DSA)
ssh-keygen -q -f $HOST_KEY_DSA -N '' -t dsa fi
if [ ! -f $HOST_KEY_ED25519 ]; then
echo " generating ssh ED25519 key..."
meta/recipes-connectivity/openssh/openssh/init +1 -0
+		mkdir -p $(dirname $HOST_KEY_ED25519)

Quoted 6 lines

ssh-keygen -q -f $HOST_KEY_ED25519 -N '' -t ed25519 fi
}
--
2.11.0

This patch breaks read-only-rootfs + systemd + openssh (see http://list
s.openembedded.org/pipermail/openembedded-core/2017-June/138883.html). This should probably be fixed before backporting.