[PATCHv2 1/2] meta/classes/image: Introduce sshd host key assertion

[PATCHv2 1/2] meta/classes/image: Introduce sshd host key assertion

[Henning Schild]

From: Henning Schild <henning.schild@siemens.com>

Images containing ssh host keys without some way of dealing with the
fact that those have to be generate at run-time not install-time are
invalid!

Introduce a check that our own package "sshd-regen-keys" is installed
when such keys are present (when an ssh daemon is installed).

Suggest to install that package or find some other way of dealing with
the problem. But fail by default, since such an image is most likely
broken.

Signed-off-by: Henning Schild <henning.schild@siemens.com>
---
 meta/classes/image-postproc-extension.bbclass | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/meta/classes/image-postproc-extension.bbclass b/meta/classes/image-postproc-extension.bbclass
index 625ba7d..f6ed793 100644
--- a/meta/classes/image-postproc-extension.bbclass
+++ b/meta/classes/image-postproc-extension.bbclass
@@ -44,3 +44,16 @@ image_postprocess_mark() {
     update_etc_os_release \
         --build-id "${BUILD_ID}" --variant "${DESCRIPTION}"
 }
+
+ROOTFS_POSTPROCESS_COMMAND =+ "image_postprocess_sshd_key_regen"
+
+image_postprocess_sshd_key_regen() {
+    nhkeys=$( find ${IMAGE_ROOTFS}/etc/ssh/ -iname "ssh_host_*key*" -printf '.' | wc -c )
+    if [ $nhkeys -ne 0 -a ! -d ${IMAGE_ROOTFS}/usr/share/doc/sshd-regen-keys ]; then
+       bbwarn "Looks like you have ssh host keys in the image but did "\
+              "not install \"sshd-regen-keys\". This image should not be "\
+              "deployed more than once."
+       bberror "Install the package or forcefully remove this check!"
+       exit 1
+    fi
+}
-- 
2.21.0

[PATCHv2 2/2] rpi-stretch: install sshd-regen-keys since openssh-server is inside

[Henning Schild]

From: Henning Schild <henning.schild@siemens.com>

A previous commit introduced a sanity check and this configuration did
not pass it.

Signed-off-by: Henning Schild <henning.schild@siemens.com>
---
 meta-isar/conf/multiconfig/rpi-stretch.conf | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/meta-isar/conf/multiconfig/rpi-stretch.conf b/meta-isar/conf/multiconfig/rpi-stretch.conf
index f3fac38..5a008b2 100644
--- a/meta-isar/conf/multiconfig/rpi-stretch.conf
+++ b/meta-isar/conf/multiconfig/rpi-stretch.conf
@@ -33,3 +33,5 @@ IMAGE_PREINSTALL += " \
     traceroute \
     vim \
     "
+
+IMAGE_INSTALL += "sshd-regen-keys"
-- 
2.21.0

Re: [PATCHv2 1/2] meta/classes/image: Introduce sshd host key assertion

[Henning Schild]

Change to v1:
  - use find instead of "ls *" to detect if there are any keys
  - reduce to just one if statement

Henning

Am Mon, 3 Jun 2019 13:10:59 +0200
schrieb Henning Schild <henning.schild@siemens.com>:

> From: Henning Schild <henning.schild@siemens.com>
> 
> Images containing ssh host keys without some way of dealing with the
> fact that those have to be generate at run-time not install-time are
> invalid!
> 
> Introduce a check that our own package "sshd-regen-keys" is installed
> when such keys are present (when an ssh daemon is installed).
> 
> Suggest to install that package or find some other way of dealing with
> the problem. But fail by default, since such an image is most likely
> broken.
> 
> Signed-off-by: Henning Schild <henning.schild@siemens.com>
> ---
>  meta/classes/image-postproc-extension.bbclass | 13 +++++++++++++
>  1 file changed, 13 insertions(+)
> 
> diff --git a/meta/classes/image-postproc-extension.bbclass
> b/meta/classes/image-postproc-extension.bbclass index
> 625ba7d..f6ed793 100644 ---
> a/meta/classes/image-postproc-extension.bbclass +++
> b/meta/classes/image-postproc-extension.bbclass @@ -44,3 +44,16 @@
> image_postprocess_mark() { update_etc_os_release \
>          --build-id "${BUILD_ID}" --variant "${DESCRIPTION}"
>  }
> +
> +ROOTFS_POSTPROCESS_COMMAND =+ "image_postprocess_sshd_key_regen"
> +
> +image_postprocess_sshd_key_regen() {
> +    nhkeys=$( find ${IMAGE_ROOTFS}/etc/ssh/ -iname "ssh_host_*key*"
> -printf '.' | wc -c )
> +    if [ $nhkeys -ne 0 -a ! -d
> ${IMAGE_ROOTFS}/usr/share/doc/sshd-regen-keys ]; then
> +       bbwarn "Looks like you have ssh host keys in the image but
> did "\
> +              "not install \"sshd-regen-keys\". This image should
> not be "\
> +              "deployed more than once."
> +       bberror "Install the package or forcefully remove this check!"
> +       exit 1
> +    fi
> +}

Re: [PATCHv2 1/2] meta/classes/image: Introduce sshd host key assertion

[Maxim Yu. Osipov]

On 6/3/19 1:12 PM, Henning Schild wrote:
> Change to v1:
>    - use find instead of "ls *" to detect if there are any keys
>    - reduce to just one if statement
> 
> Henning

Rebased and applied to the 'next'.

Regards,
Maxim.

> Am Mon, 3 Jun 2019 13:10:59 +0200
> schrieb Henning Schild <henning.schild@siemens.com>:
> 
>> From: Henning Schild <henning.schild@siemens.com>
>>
>> Images containing ssh host keys without some way of dealing with the
>> fact that those have to be generate at run-time not install-time are
>> invalid!
>>
>> Introduce a check that our own package "sshd-regen-keys" is installed
>> when such keys are present (when an ssh daemon is installed).
>>
>> Suggest to install that package or find some other way of dealing with
>> the problem. But fail by default, since such an image is most likely
>> broken.
>>
>> Signed-off-by: Henning Schild <henning.schild@siemens.com>
>> ---
>>   meta/classes/image-postproc-extension.bbclass | 13 +++++++++++++
>>   1 file changed, 13 insertions(+)
>>
>> diff --git a/meta/classes/image-postproc-extension.bbclass
>> b/meta/classes/image-postproc-extension.bbclass index
>> 625ba7d..f6ed793 100644 ---
>> a/meta/classes/image-postproc-extension.bbclass +++
>> b/meta/classes/image-postproc-extension.bbclass @@ -44,3 +44,16 @@
>> image_postprocess_mark() { update_etc_os_release \
>>           --build-id "${BUILD_ID}" --variant "${DESCRIPTION}"
>>   }
>> +
>> +ROOTFS_POSTPROCESS_COMMAND =+ "image_postprocess_sshd_key_regen"
>> +
>> +image_postprocess_sshd_key_regen() {
>> +    nhkeys=$( find ${IMAGE_ROOTFS}/etc/ssh/ -iname "ssh_host_*key*"
>> -printf '.' | wc -c )
>> +    if [ $nhkeys -ne 0 -a ! -d
>> ${IMAGE_ROOTFS}/usr/share/doc/sshd-regen-keys ]; then
>> +       bbwarn "Looks like you have ssh host keys in the image but
>> did "\
>> +              "not install \"sshd-regen-keys\". This image should
>> not be "\
>> +              "deployed more than once."
>> +       bberror "Install the package or forcefully remove this check!"
>> +       exit 1
>> +    fi
>> +}
>