Re: [PATCH] meta: Add recipe to regenerate ssh host keys

[Henning Schild <henning.schild@siemens.com>]

Am Wed, 26 Sep 2018 10:31:38 +0200
schrieb "[ext] Henning Schild" <henning.schild@siemens.com>:

> Am Tue, 25 Sep 2018 17:53:19 +0200
> schrieb Harald Seiler <hws@denx.de>:
> 
> > sshd-regen-keys is a systemd unit that will run
> > at first boot and force sshd to generate new
> > host keys.
> > 
> > This prevents all devices using the same keys.
> > 
> > Signed-off-by: Harald Seiler <hws@denx.de>
> > ---
> >  meta/recipes-support/sshd-regen-keys/files/postinst   |  4 ++++
> >  .../sshd-regen-keys/files/sshd-regen-keys.service     | 19
> > +++++++++++++++++++ .../sshd-regen-keys/sshd-regen-keys.bb
> > | 15 +++++++++++++++ 3 files changed, 38 insertions(+)
> >  create mode 100644
> > meta/recipes-support/sshd-regen-keys/files/postinst create mode
> > 100644
> > meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service
> > create mode 100644
> > meta/recipes-support/sshd-regen-keys/sshd-regen-keys.bb
> > 
> > diff --git a/meta/recipes-support/sshd-regen-keys/files/postinst
> > b/meta/recipes-support/sshd-regen-keys/files/postinst new file mode
> > 100644 index 0000000..ae722a7
> > --- /dev/null
> > +++ b/meta/recipes-support/sshd-regen-keys/files/postinst
> > @@ -0,0 +1,4 @@
> > +#!/bin/sh
> > +set -e
> > +
> > +systemctl enable sshd-regen-keys.service
> > diff --git
> > a/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service
> > b/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service
> > new file mode 100644 index 0000000..3b8231f --- /dev/null
> > +++
> > b/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service
> > @@ -0,0 +1,19 @@ +[Unit]
> > +Description=Regenerate sshd host keys
> > +DefaultDependencies=no
> > +Conflicts=shutdown.target
> > +After=systemd-remount-fs.service
> > +Before=shutdown.target sshd.service
> > +ConditionPathIsReadWrite=/etc
> > +
> > +[Service]
> > +Type=oneshot
> > +RemainAfterExit=yes
> > +Environment=DEBIAN_FRONTEND=noninteractive
> > +ExecStart=/bin/sh -c "rm -v /etc/ssh/ssh_host_*_key*;
> > dpkg-reconfigure openssh-server" +ExecStartPost=-/bin/systemctl
> > disable sshd-regen-keys.service +StandardOutput=syslog
> > +StandardError=syslog
> > +
> > +[Install]
> > +WantedBy=sysinit.target
> > diff --git a/meta/recipes-support/sshd-regen-keys/sshd-regen-keys.bb
> > b/meta/recipes-support/sshd-regen-keys/sshd-regen-keys.bb new file
> > mode 100644 index 0000000..3b196c2
> > --- /dev/null
> > +++ b/meta/recipes-support/sshd-regen-keys/sshd-regen-keys.bb  
> 
> I think a PV would be useful. sshd-regen-keys_0.1.bb
> 
> > @@ -0,0 +1,15 @@
> > +# This software is a part of ISAR.
> > +
> > +DESCRIPTION = "Systemd service to regenerate sshd keys"
> > +MAINTAINER = "isar-users <isar-users@googlegroups.com>"
> > +DEBIAN_DEPENDS = "openssh-server"  
> 
> systemd is missing here ... yes you can still get debian without it,
> also with Isar
> 
> Maybe something to add to IMAGE_INSTALL of one of the ci targets to
> get test-coverage. But wait what others think about that idea.

I made up my mind about that. Isar has recently gained some features
that lack examples and test coverage, please add a IMAGE_INSTALL+= to
qemuamd64.conf.

These seemingly simple things will otherwise break eventually.

Henning

> Henning
> 
> > +
> > +SRC_URI = "file://postinst \
> > +           file://sshd-regen-keys.service"
> > +
> > +inherit dpkg-raw
> > +
> > +do_install() {
> > +    sudo install -v -d -m 755 "${D}/lib/systemd/system"
> > +    sudo install -v -m 644 "${WORKDIR}/sshd-regen-keys.service"
> > "${D}/lib/systemd/system/sshd-regen-keys.service" +}
> >   
>