dropbear: allow configuring blank password option at runtime

PATCH Superseded Paul Eggleton 3 participants 8 messages Jan 16, 2013

lore

Share & tools

lore

Paul Eggleton

author

2013-01-16 15:53 UTC #0 lore raw

v2 cover dropbear: allow configuring blank password option at runtime

The following changes since commit 4b63e73422ea25aba1bde0beddb02bc04948e13c:

update-rc.d: check also that symlinks are valid (2013-01-16 12:07:55 +0000)

are available in the git repository at:

git://git.openembedded.org/openembedded-core-contrib paule/ssh-nopw
http://cgit.openembedded.org/cgit.cgi/openembedded-core-contrib/log/?h=paule/ssh-nopw

Paul Eggleton (2):
dropbear: allow configuring blank password option at runtime classes/image: improve debug-tweaks ssh server configuration

 meta/classes/core-image.bbclass                    |    3 -
 meta/classes/image.bbclass                         |   10 +-
 meta/recipes-core/dropbear/dropbear.inc            |    6 +-
 .../dropbear/dropbear/allow-nopw.patch             |   19 ----
 .../dropbear/dropbear/nopw-option.patch            |  106 ++++++++++++++++++++
 5 files changed, 116 insertions(+), 28 deletions(-)
 delete mode 100644 meta/recipes-core/dropbear/dropbear/allow-nopw.patch
 create mode 100644 meta/recipes-core/dropbear/dropbear/nopw-option.patch

Signature · 1 line

1.7.10.4

Paul Eggleton

author

2013-01-16 15:54 UTC #1 lore raw

PATCH v2 1/2 dropbear: allow configuring blank password option at runtime

Instead of using IMAGE_FEATURES to control something within a recipe, allow this to be set at runtime, avoiding the need to rebuild dropbear when we want to change this option.

First half of the fix for [YOCTO #2578].

Signed-off-by Paul Eggleton <[email protected]>

---
 meta/recipes-core/dropbear/dropbear.inc            |    6 +-
 .../dropbear/dropbear/allow-nopw.patch             |   19 ----
 .../dropbear/dropbear/nopw-option.patch            |  106 ++++++++++++++++++++
 3 files changed, 108 insertions(+), 23 deletions(-)
 delete mode 100644 meta/recipes-core/dropbear/dropbear/allow-nopw.patch
 create mode 100644 meta/recipes-core/dropbear/dropbear/nopw-option.patch

meta/recipes-core/dropbear/dropbear.inc +2 -4

index aa313df..3e430f2 100644
@@ -2,7 +2,7 @@ DESCRIPTION = "Dropbear is a lightweight SSH and SCP implementation"
 HOMEPAGE = "http://matt.ucc.asn.au/dropbear/dropbear.html"
 SECTION = "console/network"
 
-INC_PR = "r0"
+INC_PR = "r1"
 
 # some files are from other projects and have others license terms:
 #   public domain, OpenSSH 3.5p1, OpenSSH3.6.1p2, PuTTY

@@ -18,7 +18,7 @@ SRC_URI = "http://matt.ucc.asn.au/dropbear/releases/dropbear-${PV}.tar.gz \
 		 file://dropbear-0.53.1-static_build_fix.patch \
 	         file://configure.patch \
 	         file://fix-2kb-keys.patch \
-	         ${@base_contains("DISTRO_TYPE", "debug", "file://allow-nopw.patch", "",d)} \
+	         file://nopw-option.patch \
 	         file://init \
                  ${@base_contains('DISTRO_FEATURES', 'pam', '${PAM_SRC_URI}', '', d)} "

@@ -40,8 +40,6 @@ EXTRA_OEMAKE = 'MULTI=1 SCPPROGRESS=1 PROGRAMS="${SBINCOMMANDS} ${BINCOMMANDS}"'
 EXTRA_OECONF += "\
  ${@base_contains('DISTRO_FEATURES', 'pam', '--enable-pam', '--disable-pam', d)}"
 
-DISTRO_TYPE ?= "${@base_contains("IMAGE_FEATURES", "debug-tweaks", "debug", "",d)}"
-
 do_install() {
 	install -d ${D}${sysconfdir} \
 		   ${D}${sysconfdir}/init.d \

meta/recipes-core/dropbear/dropbear/allow-nopw.patch deleted +0 ~~-19~~

deleted file mode 100644
index a175ee1..0000000
@@ -1,19 +0,0 @@
-Enable blank password login function for new release dropbear.
-
-Upstream-Status: Inappropriate [configuration]
-
-Signed-off-by: Mei Lei <[email protected]>
-
-diff --git a/options.h b/options.h
-index 73689ad..041ddaa 100644
---- a/options.h
-+++ b/options.h
-@@ -180,7 +180,7 @@ much traffic. */
-  * Public key logins are allowed for blank-password accounts regardless of this
-  * setting.  PAM is not affected by this setting, it uses the normal pam.d
-  * settings ('nullok' option) */
--/* #define ALLOW_BLANK_PASSWORD */
-+#define ALLOW_BLANK_PASSWORD
- 
- #define ENABLE_CLI_PASSWORD_AUTH
- #define ENABLE_CLI_PUBKEY_AUTH

meta/recipes-core/dropbear/dropbear/nopw-option.patch new file +106 -0

106 lines not on this page · raw message

Signature · 1 line

1.7.10.4

Paul Eggleton

author

2013-01-16 15:54 UTC #2 lore raw

PATCH v2 2/2 classes/image: improve debug-tweaks ssh server configuration

In reply to Paul Eggleton

Create a single postprocessing function that enables no-password logins for both openssh and dropbear when debug-tweaks is in IMAGE_FEATURES, changing its behaviour slightly:
* Run it regardless of whether ssh-server-* are in IMAGE_FEATURES so that it still takes effect if these are installed by adding dropbear/openssh to IMAGE_INSTALL.
* Enable it to be run from image.bbclass rather than core-image.bbclass so that it works for images that are using the former.

Second half of the fix for [YOCTO #2578].

Signed-off-by Paul Eggleton <[email protected]>

---
 meta/classes/core-image.bbclass |    3 ---
 meta/classes/image.bbclass      |   10 ++++++++--
 2 files changed, 8 insertions(+), 5 deletions(-)

meta/classes/core-image.bbclass +0 -3

index 2e67018..e0f6dbb 100644
@@ -76,6 +76,3 @@ ROOTFS_POSTPROCESS_COMMAND += "rootfs_update_timestamp ; "
 
 # Zap the root password if debug-tweaks feature is not enabled
 ROOTFS_POSTPROCESS_COMMAND += '${@base_contains("IMAGE_FEATURES", "debug-tweaks", "", "zap_root_password ; ",d)}'
-# Allow openssh accept empty password login if both debug-tweaks and ssh-server-openssh are enabled
-ROOTFS_POSTPROCESS_COMMAND += '${@base_contains("IMAGE_FEATURES", "debug-tweaks ssh-server-openssh", "openssh_allow_empty_password; ", "",d)}'
-

meta/classes/image.bbclass +8 -2

index e494689..131958d 100644
@@ -167,6 +167,8 @@ inherit ${IMAGE_CLASSES}
 IMAGE_POSTPROCESS_COMMAND ?= ""
 MACHINE_POSTPROCESS_COMMAND ?= ""
 ROOTFS_POSTPROCESS_COMMAND_prepend = "run_intercept_scriptlets; "
+# Allow dropbear/openssh to accept logins from accounts with an empty password string if debug-tweaks is enabled
+ROOTFS_POSTPROCESS_COMMAND += '${@base_contains("IMAGE_FEATURES", "debug-tweaks", "ssh_allow_empty_password; ", "",d)}'
 
 # some default locales
 IMAGE_LINGUAS ?= "de-de fr-fr en-gb"

@@ -396,12 +398,16 @@ zap_root_password () {
 	mv ${IMAGE_ROOTFS}/etc/passwd.new ${IMAGE_ROOTFS}/etc/passwd
 } 
 
-# allow openssh accept login with empty password string
-openssh_allow_empty_password () {
+# allow dropbear/openssh to accept root logins and logins from accounts with an empty password string
+ssh_allow_empty_password () {
 	if [ -e ${IMAGE_ROOTFS}${sysconfdir}/ssh/sshd_config ]; then
 		sed -i 's#.*PermitRootLogin.*#PermitRootLogin yes#' ${IMAGE_ROOTFS}${sysconfdir}/ssh/sshd_config
 		sed -i 's#.*PermitEmptyPasswords.*#PermitEmptyPasswords yes#' ${IMAGE_ROOTFS}${sysconfdir}/ssh/sshd_config
 	fi
+
+	if [ -e ${IMAGE_ROOTFS}${sbindir}/dropbear ] ; then
+		echo 'DROPBEAR_EXTRA_ARGS="-B"' > ${IMAGE_ROOTFS}${sysconfdir}/default/dropbear
+	fi
 }
 
 # Turn any symbolic /sbin/init link into a file

Signature · 1 line

1.7.10.4

Chris Larson

2013-01-16 16:03 UTC #3 lore raw

Re: [PATCH v2 2/2] classes/image: improve debug-tweaks ssh server configuration

Quoted 7 lines · Paul Eggleton

meta/classes/image.bbclass +3 -0
+
+       if [ -e ${IMAGE_ROOTFS}${sbindir}/dropbear ] ; then
+               echo 'DROPBEAR_EXTRA_ARGS="-B"' >
${IMAGE_ROOTFS}${sysconfdir}/default/dropbear
+ fi
}

Slightly concerned with this, in the potential case where a layer provides its own /etc/default/dropbear, this will blow it away entirely.

Signature · 1 line

Christopher Larson

Paul Eggleton

author

2013-01-16 16:07 UTC #4 lore raw

Re: [PATCH v2 2/2] classes/image: improve debug-tweaks ssh server configuration

Quoted 9 lines · On Wednesday 16 January 2013 08:48:05 Chris Larson wrote:

On Wed, Jan 16, 2013 at 8:38 AM, Paul Eggleton <
Quoted 6 lines · [email protected]> wrote:
meta/classes/image.bbclass +3 -0
+
+       if [ -e ${IMAGE_ROOTFS}${sbindir}/dropbear ] ; then
+               echo 'DROPBEAR_EXTRA_ARGS="-B"' >
${IMAGE_ROOTFS}${sysconfdir}/default/dropbear
+ fi

Quoted 4 lines

Quoted 1 line
}
Slightly concerned with this, in the potential case where a layer provides its own /etc/default/dropbear, this will blow it away entirely.

I already considered this, but interacting nicely with that situation given that the provided /etc/default/dropbear would likely be setting its own value of DROPBEAR_EXTRA_ARGS isn't going to be straightforward from a shell script...

Cheers,
Paul

Signature · 2 lines

Paul Eggleton
Intel Open Source Technology Centre

Paul Eggleton

author

2013-01-16 16:55 UTC #5 lore raw

Re: [PATCH v2 2/2] classes/image: improve debug-tweaks ssh server configuration

Quoted 12 lines · On Wednesday 16 January 2013 15:51:59 Paul Eggleton wrote:

Quoted 11 lines · On Wednesday 16 January 2013 08:48:05 Chris Larson wrote:
On Wed, Jan 16, 2013 at 8:38 AM, Paul Eggleton <
Quoted 7 lines · [email protected]> wrote:
meta/classes/image.bbclass +3 -0
+
+       if [ -e ${IMAGE_ROOTFS}${sbindir}/dropbear ] ; then
+               echo 'DROPBEAR_EXTRA_ARGS="-B"' >
${IMAGE_ROOTFS}${sysconfdir}/default/dropbear
+ fi
}

Quoted 7 lines

Quoted 2 lines
Slightly concerned with this, in the potential case where a layer provides its own /etc/default/dropbear, this will blow it away entirely.
I already considered this, but interacting nicely with that situation given that the provided /etc/default/dropbear would likely be setting its own value of DROPBEAR_EXTRA_ARGS isn't going to be straightforward from a shell script...

Scratch that, it's not too difficult. v3 on the way.

Cheers,
Paul

Signature · 2 lines

Paul Eggleton
Intel Open Source Technology Centre

Martin Jansa

2013-01-16 16:56 UTC #6 lore raw

Re: [PATCH v2 2/2] classes/image: improve debug-tweaks ssh server configuration

In reply to Paul Eggleton

Quoted 47 lines · Paul Eggleton

Second half of the fix for [YOCTO #2578].

Signed-off-by Paul Eggleton <[email protected]>

---
 meta/classes/core-image.bbclass |    3 ---
 meta/classes/image.bbclass      |   10 ++++++++--
 2 files changed, 8 insertions(+), 5 deletions(-)

meta/classes/core-image.bbclass +0 -3

index 2e67018..e0f6dbb 100644
@@ -76,6 +76,3 @@ ROOTFS_POSTPROCESS_COMMAND += "rootfs_update_timestamp ; "
 
 # Zap the root password if debug-tweaks feature is not enabled
 ROOTFS_POSTPROCESS_COMMAND += '${@base_contains("IMAGE_FEATURES", "debug-tweaks", "", "zap_root_password ; ",d)}'
-# Allow openssh accept empty password login if both debug-tweaks and ssh-server-openssh are enabled
-ROOTFS_POSTPROCESS_COMMAND += '${@base_contains("IMAGE_FEATURES", "debug-tweaks ssh-server-openssh", "openssh_allow_empty_password; ", "",d)}'
-

meta/classes/image.bbclass +2 -2

index e494689..131958d 100644
@@ -167,6 +167,8 @@ inherit ${IMAGE_CLASSES}
 IMAGE_POSTPROCESS_COMMAND ?= ""
 MACHINE_POSTPROCESS_COMMAND ?= ""
 ROOTFS_POSTPROCESS_COMMAND_prepend = "run_intercept_scriptlets; "
+# Allow dropbear/openssh to accept logins from accounts with an empty password string if debug-tweaks is enabled
+ROOTFS_POSTPROCESS_COMMAND += '${@base_contains("IMAGE_FEATURES", "debug-tweaks", "ssh_allow_empty_password; ", "",d)}'
 
 # some default locales
 IMAGE_LINGUAS ?= "de-de fr-fr en-gb"

@@ -396,12 +398,16 @@ zap_root_password () {
 	mv ${IMAGE_ROOTFS}/etc/passwd.new ${IMAGE_ROOTFS}/etc/passwd
 } 
 
-# allow openssh accept login with empty password string
-openssh_allow_empty_password () {

meta/classes/image.bbclass zap_root_password () { · line 410

Quoted 10 lines

meta/classes/image.bbclass +6 -0

+# allow dropbear/openssh to accept root logins and logins from accounts with an empty password string
+ssh_allow_empty_password () {
 	if [ -e ${IMAGE_ROOTFS}${sysconfdir}/ssh/sshd_config ]; then
 		sed -i 's#.*PermitRootLogin.*#PermitRootLogin yes#' ${IMAGE_ROOTFS}${sysconfdir}/ssh/sshd_config
 		sed -i 's#.*PermitEmptyPasswords.*#PermitEmptyPasswords yes#' ${IMAGE_ROOTFS}${sysconfdir}/ssh/sshd_config
 	fi
+
+	if [ -e ${IMAGE_ROOTFS}${sbindir}/dropbear ] ; then
+		echo 'DROPBEAR_EXTRA_ARGS="-B"' > ${IMAGE_ROOTFS}${sysconfdir}/default/dropbear
+	fi

Can we use >> here? In case some distro layer provides own default/dropbear already?

Or grep + >> if you fear of duplication of that line, probably should be using sed to add -B if DROPBEAR_EXTRA_ARGS line is already there without -B.

Cheers,

Signature · 1 line

Martin 'JaMa' Jansa     jabber: [email protected]

Paul Eggleton

author

2013-01-16 17:12 UTC #7 lore raw

Re: [PATCH v2 2/2] classes/image: improve debug-tweaks ssh server configuration

Quoted 79 lines · On Wednesday 16 January 2013 17:40:38 Martin Jansa wrote:

Quoted 73 lines · Paul Eggleton
Create a single postprocessing function that enables no-password logins for both openssh and dropbear when debug-tweaks is in IMAGE_FEATURES, changing its behaviour slightly:
* Run it regardless of whether ssh-server-* are in IMAGE_FEATURES so
that it still takes effect if these are installed by adding dropbear/openssh to IMAGE_INSTALL.
* Enable it to be run from image.bbclass rather than core-image.bbclass
so that it works for images that are using the former.
Second half of the fix for [YOCTO #2578].
Signed-off-by Paul Eggleton <[email protected]>
---
 meta/classes/core-image.bbclass |    3 ---
 meta/classes/image.bbclass      |   10 ++++++++--
 2 files changed, 8 insertions(+), 5 deletions(-)
(quoted diff) +0 -0
b/meta/classes/core-image.bbclass index 2e67018..e0f6dbb 100644
meta/classes/core-image.bbclass +0 -0
@@ -76,6 +76,3 @@ ROOTFS_POSTPROCESS_COMMAND += "rootfs_update_timestamp ;
">
# Zap the root password if debug-tweaks feature is not enabled ROOTFS_POSTPROCESS_COMMAND += '${@base_contains("IMAGE_FEATURES", "debug-tweaks", "", "zap_root_password ; ",d)}'>
-# Allow openssh accept empty password login if both debug-tweaks and ssh-server-openssh are enabled -ROOTFS_POSTPROCESS_COMMAND += '${@base_contains("IMAGE_FEATURES", "debug-tweaks ssh-server-openssh", "openssh_allow_empty_password; ", "",d)}' -
meta/classes/image.bbclass +1 -0
index e494689..131958d 100644
@@ -167,6 +167,8 @@ inherit ${IMAGE_CLASSES}
 
 IMAGE_POSTPROCESS_COMMAND ?= ""
 MACHINE_POSTPROCESS_COMMAND ?= ""
 ROOTFS_POSTPROCESS_COMMAND_prepend = "run_intercept_scriptlets; "
 
+# Allow dropbear/openssh to accept logins from accounts with an empty
password string if debug-tweaks is enabled +ROOTFS_POSTPROCESS_COMMAND += '${@base_contains("IMAGE_FEATURES", "debug-tweaks", "ssh_allow_empty_password; ", "",d)}'>
 # some default locales
 IMAGE_LINGUAS ?= "de-de fr-fr en-gb"
meta/classes/image.bbclass +4 -2
@@ -396,12 +398,16 @@ zap_root_password () {
 
 	mv ${IMAGE_ROOTFS}/etc/passwd.new ${IMAGE_ROOTFS}/etc/passwd
 
 }
 
-# allow openssh accept login with empty password string
-openssh_allow_empty_password () {
+# allow dropbear/openssh to accept root logins and logins from accounts
 with an empty password string +ssh_allow_empty_password () {
 
 	if [ -e ${IMAGE_ROOTFS}${sysconfdir}/ssh/sshd_config ]; then
 
 		sed -i 's#.*PermitRootLogin.*#PermitRootLogin yes#'
 		${IMAGE_ROOTFS}${sysconfdir}/ssh/sshd_config sed -i
 		's#.*PermitEmptyPasswords.*#PermitEmptyPasswords yes#'
 		${IMAGE_ROOTFS}${sysconfdir}/ssh/sshd_config>  	
 	fi
 
+
+	if [ -e ${IMAGE_ROOTFS}${sbindir}/dropbear ] ; then
+		echo 'DROPBEAR_EXTRA_ARGS="-B"' >
Quoted 1 line
${IMAGE_ROOTFS}${sysconfdir}/default/dropbear + fi
Can we use >> here? In case some distro layer provides own default/dropbear already?

Quoted 3 lines

Or grep + >> if you fear of duplication of that line, probably should be using sed to add -B if DROPBEAR_EXTRA_ARGS line is already there without -B.

Slightly ahead of you :) see discussion with Chris.

Cheers,
Paul

Signature · 2 lines

Paul Eggleton
Intel Open Source Technology Centre