Re: [PATCH 05/11] image-account-extension: Add copy-ci-key flag for user

[Uladzimir Bely <ubely@ilbers.de>]

In mail from вторник, 24 января 2023 г. 10:18:28 +03 user Henning Schild 
wrote:
> Am Tue, 24 Jan 2023 08:09:24 +0100
> 
> schrieb Henning Schild <henning.schild@siemens.com>:
> > Am Fri, 13 Jan 2023 08:19:36 +0100
> > 
> > schrieb Uladzimir Bely <ubely@ilbers.de>:
> > > If the flag enabled, CI ssh public key is copied `authorized_keys`
> > > in `$USER/.ssh/` directory.
> > > 
> > > This allows non-interactive SSH access to the machine with executing
> > > custom commands on the guest VM.
> > 
> > I would suggest to make that a debian raw package, examples on how to
> > do that can be found in many public layers.
> > 
> > You could i.e. drop an authorized-keys file into /etc/ssh/ and using
> > postinst append/change the AuthorizedKeysFile line in the global ssh
> > config
> 
> Create the user ci like we create the user isar in example-raw, and
> drop that file into HOME/.ssh/, maybe depend on sudo and make sure that
> user can run any command without password.
> We could also use a trivial password and not have a key at all.
> 
> And when it is a package we can depend on regen-keys.
> 
> Henning
> 

Yes, it sounds reasonable. I't should be easier to manage everything in one 
recipe, instead of specific image and image extensions.

I'm just not sure we can avoid using keys - I didn't manage to execute 
commands (by running `ssh <options> <cmd>` ) in non-interactive way with only 
user passwords.

> > That way we know which package owned that file and if we have a prerm
> > we can even remove everything with apt.
> > 
> > Henning
> > 
> > > Signed-off-by: Uladzimir Bely <ubely@ilbers.de>
> > > ---
> > > 
> > >  meta/classes/image-account-extension.bbclass | 14 +++++++++++++-
> > >  1 file changed, 13 insertions(+), 1 deletion(-)
> > > 
> > > diff --git a/meta/classes/image-account-extension.bbclass
> > > b/meta/classes/image-account-extension.bbclass index
> > > 70950a7b..c9b86250 100644 ---
> > > a/meta/classes/image-account-extension.bbclass +++
> > > b/meta/classes/image-account-extension.bbclass @@ -17,7 +17,7 @@
> > > USERS ??= "" #USER_root[home] = "/home/root"
> > > 
> > >  #USER_root[shell] = "/bin/sh"
> > >  #USER_root[groups] = "audio video"
> > > 
> > > -#USER_root[flags] = "no-create-home create-home system
> > > allow-empty-password clear-text-password force-passwd-change"
> > > +#USER_root[flags] = "no-create-home create-home system
> > > allow-empty-password clear-text-password force-passwd-change
> > > copy-ci-key" GROUPS ??= ""
> > > @@ -263,5 +263,17 @@ image_postprocess_accounts() {
> > > 
> > >              sudo -E chroot '${ROOTFSDIR}' \
> > >              
> > >                  /usr/bin/passwd --expire "$name"
> > >          
> > >          fi
> > > 
> > > +
> > > +        # Add CI ssh key for noninteractive login
> > > +        if [ "${flags}" != "${flags%*,copy-ci-key,*}" ]; then
> > > +            echo "Add CI ssh key for \"$name\""
> > > +            sudo sh -c " \
> > > +                mkdir -p ${ROOTFSDIR}/${home}/.ssh && \
> > > +                cat ${TESTSUITEDIR}/keys/ssh/id_rsa.pub >
> > > ${ROOTFSDIR}/${home}/.ssh/authorized_keys && \
> > > +                chmod -R go-rwx ${ROOTFSDIR}/${home}/.ssh
> > > +            "
> > > +            sudo -E chroot '${ROOTFSDIR}' \
> > > +                chown -R ${name}:${gid} ${home}/.ssh
> > > +        fi
> > > 
> > >      done
> > >  
> > >  }