public inbox for isar-users@googlegroups.com
 help / color / mirror / Atom feed
* [PATCH v2] sshd-regen-keys: Improve service, make more robust
@ 2021-03-30 10:17 Henning Schild
  2021-04-08  8:24 ` Anton Mikanovich
                   ` (3 more replies)
  0 siblings, 4 replies; 8+ messages in thread
From: Henning Schild @ 2021-03-30 10:17 UTC (permalink / raw)
  To: isar-users; +Cc: Jan Kiszka, Harald Seiler, Henning Schild

Switch to using "/usr/bin/ssh-keygen -A" instead of dpkg-reconfigure.
With this we would generate new host keys every time the service starts
and no keys exist. Removing the keys from openssh-server in a postinst
makes it complete so that we really only generate on the first boot.

This is easier to handle that reusing the debian package hooks for key
generation.

Signed-off-by: Henning Schild <henning.schild@siemens.com>
---
 .../sshd-regen-keys/files/postinst            |  2 ++
 .../files/sshd-regen-keys.service             |  4 +---
 .../sshd-regen-keys/files/sshd-regen-keys.sh  | 20 -------------------
 .../sshd-regen-keys/sshd-regen-keys_0.3.bb    | 17 ----------------
 .../sshd-regen-keys/sshd-regen-keys_0.4.bb    | 14 +++++++++++++
 5 files changed, 17 insertions(+), 40 deletions(-)
 delete mode 100644 meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.sh
 delete mode 100644 meta/recipes-support/sshd-regen-keys/sshd-regen-keys_0.3.bb
 create mode 100644 meta/recipes-support/sshd-regen-keys/sshd-regen-keys_0.4.bb

diff --git a/meta/recipes-support/sshd-regen-keys/files/postinst b/meta/recipes-support/sshd-regen-keys/files/postinst
index ae722a7349a2..1c9b03e3e040 100644
--- a/meta/recipes-support/sshd-regen-keys/files/postinst
+++ b/meta/recipes-support/sshd-regen-keys/files/postinst
@@ -1,4 +1,6 @@
 #!/bin/sh
 set -e
 
+rm /etc/ssh/ssh_host_*_key*
+
 systemctl enable sshd-regen-keys.service
diff --git a/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service b/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service
index f50d34c820d8..af98d5e9e966 100644
--- a/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service
+++ b/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service
@@ -9,9 +9,7 @@ ConditionPathIsReadWrite=/etc
 [Service]
 Type=oneshot
 RemainAfterExit=yes
-Environment=DEBIAN_FRONTEND=noninteractive
-ExecStart=/usr/sbin/sshd-regen-keys.sh
-ExecStartPost=-/bin/systemctl disable sshd-regen-keys.service
+ExecStart=/usr/bin/ssh-keygen -A
 StandardOutput=syslog
 StandardError=syslog
 
diff --git a/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.sh b/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.sh
deleted file mode 100644
index 910d879ba51f..000000000000
--- a/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.sh
+++ /dev/null
@@ -1,20 +0,0 @@
-#!/usr/bin/env sh
-
-echo -n "SSH server is "
-if systemctl is-enabled ssh; then
-    SSHD_ENABLED="true"
-    systemctl disable --no-reload ssh
-fi
-
-echo "Removing keys ..."
-rm -v /etc/ssh/ssh_host_*_key*
-
-echo "Regenerating keys ..."
-dpkg-reconfigure openssh-server
-
-if test -n $SSHD_ENABLED; then
-    echo "Reenabling ssh server ..."
-    systemctl enable --no-reload ssh
-fi
-
-sync
diff --git a/meta/recipes-support/sshd-regen-keys/sshd-regen-keys_0.3.bb b/meta/recipes-support/sshd-regen-keys/sshd-regen-keys_0.3.bb
deleted file mode 100644
index 6f12414239a3..000000000000
--- a/meta/recipes-support/sshd-regen-keys/sshd-regen-keys_0.3.bb
+++ /dev/null
@@ -1,17 +0,0 @@
-# This software is a part of ISAR.
-inherit dpkg-raw
-
-DESCRIPTION = "Systemd service to regenerate sshd keys"
-MAINTAINER = "isar-users <isar-users@googlegroups.com>"
-DEBIAN_DEPENDS = "openssh-server, systemd"
-
-SRC_URI = "file://postinst \
-           file://sshd-regen-keys.service \
-           file://sshd-regen-keys.sh"
-
-do_install[cleandirs] = "${D}/lib/systemd/system \
-                         ${D}/usr/sbin"
-do_install() {
-    install -v -m 644 "${WORKDIR}/sshd-regen-keys.service" "${D}/lib/systemd/system/sshd-regen-keys.service"
-    install -v -m 755 "${WORKDIR}/sshd-regen-keys.sh" "${D}/usr/sbin/sshd-regen-keys.sh"
-}
diff --git a/meta/recipes-support/sshd-regen-keys/sshd-regen-keys_0.4.bb b/meta/recipes-support/sshd-regen-keys/sshd-regen-keys_0.4.bb
new file mode 100644
index 000000000000..9ce1d8d88300
--- /dev/null
+++ b/meta/recipes-support/sshd-regen-keys/sshd-regen-keys_0.4.bb
@@ -0,0 +1,14 @@
+# This software is a part of ISAR.
+inherit dpkg-raw
+
+DESCRIPTION = "Systemd service to regenerate sshd keys"
+MAINTAINER = "isar-users <isar-users@googlegroups.com>"
+DEBIAN_DEPENDS = "openssh-server, systemd"
+
+SRC_URI = "file://postinst \
+           file://sshd-regen-keys.service"
+
+do_install() {
+    install -d -m 0755 "${D}/lib/systemd/system"
+    install -m 0644 "${WORKDIR}/sshd-regen-keys.service" "${D}/lib/systemd/system/sshd-regen-keys.service"
+}
-- 
2.26.3


^ permalink raw reply	[flat|nested] 8+ messages in thread
end of thread, other threads:[~2021-11-18 12:55 UTC | newest]

Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-03-30 10:17 [PATCH v2] sshd-regen-keys: Improve service, make more robust Henning Schild
2021-04-08  8:24 ` Anton Mikanovich
2021-04-08  8:50   ` Jan Kiszka
2021-04-08 10:02 ` Anton Mikanovich
2021-04-28 12:21 ` Moessbauer, Felix
2021-04-28 17:22   ` Henning Schild
2021-11-18 11:10 ` Gylstorff Quirin
2021-11-18 12:55   ` Henning Schild

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox