Re: [PATCH v3] sshd-regen-keys: Fix sshd deadlock on boot

[Henning Schild <henning.schild@siemens.com>]

Am Tue, 28 May 2019 20:25:11 +0200
schrieb "[ext] Henning Schild" <henning.schild@siemens.com>:

> Looking at the recent rootfs postprocessing scripts and how we stop
> putting magic into install hooks i thought about this one again.
> 
> This is all nice but it does not solve the real problem. You have to
> be aware that you get the ssh key problem when building and later
> deploying a debian like we do. Once you are aware you might discover
> this handy package.
> 
> I think we should have bitbake magic that installs this package as
> soon as sshd gets installed. Which could be tricky if sshd gets
> pulled as dep ...

The probably most lighweight way will be to bbwarn in a postprocess if
sshd installed and sshd-regen-keys is not. I will send a patch.

Henning

> Henning
> 
> Am Wed, 19 Dec 2018 14:54:04 +0100
> schrieb Harald Seiler <hws@denx.de>:
> 
> > Currently, when sshd-regen-keys runs dpkg-reconfigure, this
> > will lead to a call to `systemctl restart ssh`.  This call blocks
> > forever because of course the sshd-regen-keys unit, which is a
> > dependency of sshd, hasn't finished at this point and can't do so
> > because it is waiting as well.
> > 
> > To circumvent this deadlock, this commit changes sshd-regen-keys'
> > behavior so sshd is first disabled and only reenabled after the
> > job is done.
> > 
> > Signed-off-by: Harald Seiler <hws@denx.de>
> > ---
> > Changes for v2:
> >   - Remove `systemctl start --no-block ssh` call as it looks like
> >     this is not needed.
> > 
> > Changes for v3:
> >   - Bump version number to 0.2
> > 
> >  .../sshd-regen-keys/files/sshd-regen-keys.service      |  2 +-
> >  .../sshd-regen-keys/files/sshd-regen-keys.sh           | 18
> > ++++++++++++++++++ .../{sshd-regen-keys_0.1.bb =>
> > sshd-regen-keys_0.2.bb} |  7 +++++-- 3 files changed, 24
> > insertions(+), 3 deletions(-) create mode 100644
> > meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.sh rename
> > meta/recipes-support/sshd-regen-keys/{sshd-regen-keys_0.1.bb =>
> > sshd-regen-keys_0.2.bb} (58%)
> > 
> > diff --git
> > a/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service
> > b/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service
> > index 3b8231f..a05e1a9 100644 ---
> > a/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service
> > +++
> > b/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service
> > @@ -10,7 +10,7 @@ ConditionPathIsReadWrite=/etc Type=oneshot
> > RemainAfterExit=yes Environment=DEBIAN_FRONTEND=noninteractive
> > -ExecStart=/bin/sh -c "rm -v /etc/ssh/ssh_host_*_key*;
> > dpkg-reconfigure openssh-server"
> > +ExecStart=/usr/sbin/sshd-regen-keys.sh
> > ExecStartPost=-/bin/systemctl disable sshd-regen-keys.service
> > StandardOutput=syslog StandardError=syslog diff --git
> > a/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.sh
> > b/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.sh new
> > file mode 100644 index 0000000..11fca3b --- /dev/null
> > +++ b/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.sh
> > @@ -0,0 +1,18 @@
> > +#!/usr/bin/env sh
> > +
> > +echo -n "SSH server is "
> > +if systemctl is-enabled ssh; then
> > +    SSHD_ENABLED="true"
> > +    systemctl disable --no-reload ssh
> > +fi
> > +
> > +echo "Removing keys ..."
> > +rm -v /etc/ssh/ssh_host_*_key*
> > +
> > +echo "Regenerating keys ..."
> > +dpkg-reconfigure openssh-server
> > +
> > +if test -n $SSHD_ENABLED; then
> > +    echo "Reenabling ssh server ..."
> > +    systemctl enable --no-reload ssh
> > +fi
> > diff --git
> > a/meta/recipes-support/sshd-regen-keys/sshd-regen-keys_0.1.bb
> > b/meta/recipes-support/sshd-regen-keys/sshd-regen-keys_0.2.bb
> > similarity index 58% rename from
> > meta/recipes-support/sshd-regen-keys/sshd-regen-keys_0.1.bb rename
> > to meta/recipes-support/sshd-regen-keys/sshd-regen-keys_0.2.bb index
> > 02e9e25..6f12414 100644 ---
> > a/meta/recipes-support/sshd-regen-keys/sshd-regen-keys_0.1.bb +++
> > b/meta/recipes-support/sshd-regen-keys/sshd-regen-keys_0.2.bb @@
> > -6,9 +6,12 @@ MAINTAINER = "isar-users
> > <isar-users@googlegroups.com>" DEBIAN_DEPENDS = "openssh-server,
> > systemd" SRC_URI = "file://postinst \
> > -           file://sshd-regen-keys.service"
> > +           file://sshd-regen-keys.service \
> > +           file://sshd-regen-keys.sh"
> >  
> > +do_install[cleandirs] = "${D}/lib/systemd/system \
> > +                         ${D}/usr/sbin"
> >  do_install() {
> > -    install -v -d -m 755 "${D}/lib/systemd/system"
> >      install -v -m 644 "${WORKDIR}/sshd-regen-keys.service"
> > "${D}/lib/systemd/system/sshd-regen-keys.service"
> > +    install -v -m 755 "${WORKDIR}/sshd-regen-keys.sh"
> > "${D}/usr/sbin/sshd-regen-keys.sh" }
> >   
>