Re: [PATCH] meta: Add recipe to regenerate ssh host keys

[Henning Schild <henning.schild@siemens.com>]

Am Tue, 25 Sep 2018 17:53:19 +0200
schrieb Harald Seiler <hws@denx.de>:

> sshd-regen-keys is a systemd unit that will run
> at first boot and force sshd to generate new
> host keys.
> 
> This prevents all devices using the same keys.
> 
> Signed-off-by: Harald Seiler <hws@denx.de>
> ---
>  meta/recipes-support/sshd-regen-keys/files/postinst   |  4 ++++
>  .../sshd-regen-keys/files/sshd-regen-keys.service     | 19
> +++++++++++++++++++ .../sshd-regen-keys/sshd-regen-keys.bb
> | 15 +++++++++++++++ 3 files changed, 38 insertions(+)
>  create mode 100644
> meta/recipes-support/sshd-regen-keys/files/postinst create mode
> 100644
> meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service
> create mode 100644
> meta/recipes-support/sshd-regen-keys/sshd-regen-keys.bb
> 
> diff --git a/meta/recipes-support/sshd-regen-keys/files/postinst
> b/meta/recipes-support/sshd-regen-keys/files/postinst new file mode
> 100644 index 0000000..ae722a7
> --- /dev/null
> +++ b/meta/recipes-support/sshd-regen-keys/files/postinst
> @@ -0,0 +1,4 @@
> +#!/bin/sh
> +set -e
> +
> +systemctl enable sshd-regen-keys.service
> diff --git
> a/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service
> b/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service
> new file mode 100644 index 0000000..3b8231f --- /dev/null
> +++
> b/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service
> @@ -0,0 +1,19 @@ +[Unit]
> +Description=Regenerate sshd host keys
> +DefaultDependencies=no
> +Conflicts=shutdown.target
> +After=systemd-remount-fs.service
> +Before=shutdown.target sshd.service
> +ConditionPathIsReadWrite=/etc
> +
> +[Service]
> +Type=oneshot
> +RemainAfterExit=yes
> +Environment=DEBIAN_FRONTEND=noninteractive
> +ExecStart=/bin/sh -c "rm -v /etc/ssh/ssh_host_*_key*;
> dpkg-reconfigure openssh-server" +ExecStartPost=-/bin/systemctl
> disable sshd-regen-keys.service +StandardOutput=syslog
> +StandardError=syslog
> +
> +[Install]
> +WantedBy=sysinit.target
> diff --git a/meta/recipes-support/sshd-regen-keys/sshd-regen-keys.bb
> b/meta/recipes-support/sshd-regen-keys/sshd-regen-keys.bb new file
> mode 100644 index 0000000..3b196c2
> --- /dev/null
> +++ b/meta/recipes-support/sshd-regen-keys/sshd-regen-keys.bb

I think a PV would be useful. sshd-regen-keys_0.1.bb

> @@ -0,0 +1,15 @@
> +# This software is a part of ISAR.
> +
> +DESCRIPTION = "Systemd service to regenerate sshd keys"
> +MAINTAINER = "isar-users <isar-users@googlegroups.com>"
> +DEBIAN_DEPENDS = "openssh-server"

systemd is missing here ... yes you can still get debian without it,
also with Isar

Maybe something to add to IMAGE_INSTALL of one of the ci targets to get
test-coverage. But wait what others think about that idea.

Henning

> +
> +SRC_URI = "file://postinst \
> +           file://sshd-regen-keys.service"
> +
> +inherit dpkg-raw
> +
> +do_install() {
> +    sudo install -v -d -m 755 "${D}/lib/systemd/system"
> +    sudo install -v -m 644 "${WORKDIR}/sshd-regen-keys.service"
> "${D}/lib/systemd/system/sshd-regen-keys.service" +}
>