Re: [PATCH v3] sshd-regen-keys: Fix sshd deadlock on boot

[Henning Schild <henning.schild@siemens.com>]

Looking at the recent rootfs postprocessing scripts and how we stop
putting magic into install hooks i thought about this one again.

This is all nice but it does not solve the real problem. You have to be
aware that you get the ssh key problem when building and later
deploying a debian like we do. Once you are aware you might discover
this handy package.

I think we should have bitbake magic that installs this package as soon
as sshd gets installed. Which could be tricky if sshd gets pulled as
dep ...

Henning

Am Wed, 19 Dec 2018 14:54:04 +0100
schrieb Harald Seiler <hws@denx.de>:

> Currently, when sshd-regen-keys runs dpkg-reconfigure, this
> will lead to a call to `systemctl restart ssh`.  This call blocks
> forever because of course the sshd-regen-keys unit, which is a
> dependency of sshd, hasn't finished at this point and can't do so
> because it is waiting as well.
> 
> To circumvent this deadlock, this commit changes sshd-regen-keys'
> behavior so sshd is first disabled and only reenabled after the
> job is done.
> 
> Signed-off-by: Harald Seiler <hws@denx.de>
> ---
> Changes for v2:
>   - Remove `systemctl start --no-block ssh` call as it looks like
>     this is not needed.
> 
> Changes for v3:
>   - Bump version number to 0.2
> 
>  .../sshd-regen-keys/files/sshd-regen-keys.service      |  2 +-
>  .../sshd-regen-keys/files/sshd-regen-keys.sh           | 18
> ++++++++++++++++++ .../{sshd-regen-keys_0.1.bb =>
> sshd-regen-keys_0.2.bb} |  7 +++++-- 3 files changed, 24
> insertions(+), 3 deletions(-) create mode 100644
> meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.sh rename
> meta/recipes-support/sshd-regen-keys/{sshd-regen-keys_0.1.bb =>
> sshd-regen-keys_0.2.bb} (58%)
> 
> diff --git
> a/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service
> b/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service
> index 3b8231f..a05e1a9 100644 ---
> a/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service
> +++
> b/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service
> @@ -10,7 +10,7 @@ ConditionPathIsReadWrite=/etc Type=oneshot
> RemainAfterExit=yes Environment=DEBIAN_FRONTEND=noninteractive
> -ExecStart=/bin/sh -c "rm -v /etc/ssh/ssh_host_*_key*;
> dpkg-reconfigure openssh-server"
> +ExecStart=/usr/sbin/sshd-regen-keys.sh ExecStartPost=-/bin/systemctl
> disable sshd-regen-keys.service StandardOutput=syslog
> StandardError=syslog diff --git
> a/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.sh
> b/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.sh new
> file mode 100644 index 0000000..11fca3b --- /dev/null
> +++ b/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.sh
> @@ -0,0 +1,18 @@
> +#!/usr/bin/env sh
> +
> +echo -n "SSH server is "
> +if systemctl is-enabled ssh; then
> +    SSHD_ENABLED="true"
> +    systemctl disable --no-reload ssh
> +fi
> +
> +echo "Removing keys ..."
> +rm -v /etc/ssh/ssh_host_*_key*
> +
> +echo "Regenerating keys ..."
> +dpkg-reconfigure openssh-server
> +
> +if test -n $SSHD_ENABLED; then
> +    echo "Reenabling ssh server ..."
> +    systemctl enable --no-reload ssh
> +fi
> diff --git
> a/meta/recipes-support/sshd-regen-keys/sshd-regen-keys_0.1.bb
> b/meta/recipes-support/sshd-regen-keys/sshd-regen-keys_0.2.bb
> similarity index 58% rename from
> meta/recipes-support/sshd-regen-keys/sshd-regen-keys_0.1.bb rename to
> meta/recipes-support/sshd-regen-keys/sshd-regen-keys_0.2.bb index
> 02e9e25..6f12414 100644 ---
> a/meta/recipes-support/sshd-regen-keys/sshd-regen-keys_0.1.bb +++
> b/meta/recipes-support/sshd-regen-keys/sshd-regen-keys_0.2.bb @@ -6,9
> +6,12 @@ MAINTAINER = "isar-users <isar-users@googlegroups.com>"
> DEBIAN_DEPENDS = "openssh-server, systemd" SRC_URI = "file://postinst
> \
> -           file://sshd-regen-keys.service"
> +           file://sshd-regen-keys.service \
> +           file://sshd-regen-keys.sh"
>  
> +do_install[cleandirs] = "${D}/lib/systemd/system \
> +                         ${D}/usr/sbin"
>  do_install() {
> -    install -v -d -m 755 "${D}/lib/systemd/system"
>      install -v -m 644 "${WORKDIR}/sshd-regen-keys.service"
> "${D}/lib/systemd/system/sshd-regen-keys.service"
> +    install -v -m 755 "${WORKDIR}/sshd-regen-keys.sh"
> "${D}/usr/sbin/sshd-regen-keys.sh" }
>