Re: [PATCH 05/11] image-account-extension: Add copy-ci-key flag for user

[Henning Schild <henning.schild@siemens.com>]

Am Fri, 13 Jan 2023 08:19:36 +0100
schrieb Uladzimir Bely <ubely@ilbers.de>:

> If the flag enabled, CI ssh public key is copied `authorized_keys`
> in `$USER/.ssh/` directory.
> 
> This allows non-interactive SSH access to the machine with executing
> custom commands on the guest VM.

I would suggest to make that a debian raw package, examples on how to
do that can be found in many public layers.

You could i.e. drop an authorized-keys file into /etc/ssh/ and using
postinst append/change the AuthorizedKeysFile line in the global ssh
config

That way we know which package owned that file and if we have a prerm
we can even remove everything with apt.

Henning

> Signed-off-by: Uladzimir Bely <ubely@ilbers.de>
> ---
>  meta/classes/image-account-extension.bbclass | 14 +++++++++++++-
>  1 file changed, 13 insertions(+), 1 deletion(-)
> 
> diff --git a/meta/classes/image-account-extension.bbclass
> b/meta/classes/image-account-extension.bbclass index
> 70950a7b..c9b86250 100644 ---
> a/meta/classes/image-account-extension.bbclass +++
> b/meta/classes/image-account-extension.bbclass @@ -17,7 +17,7 @@
> USERS ??= "" #USER_root[home] = "/home/root"
>  #USER_root[shell] = "/bin/sh"
>  #USER_root[groups] = "audio video"
> -#USER_root[flags] = "no-create-home create-home system
> allow-empty-password clear-text-password force-passwd-change"
> +#USER_root[flags] = "no-create-home create-home system
> allow-empty-password clear-text-password force-passwd-change
> copy-ci-key" GROUPS ??= "" 
> @@ -263,5 +263,17 @@ image_postprocess_accounts() {
>              sudo -E chroot '${ROOTFSDIR}' \
>                  /usr/bin/passwd --expire "$name"
>          fi
> +
> +        # Add CI ssh key for noninteractive login
> +        if [ "${flags}" != "${flags%*,copy-ci-key,*}" ]; then
> +            echo "Add CI ssh key for \"$name\""
> +            sudo sh -c " \
> +                mkdir -p ${ROOTFSDIR}/${home}/.ssh && \
> +                cat ${TESTSUITEDIR}/keys/ssh/id_rsa.pub >
> ${ROOTFSDIR}/${home}/.ssh/authorized_keys && \
> +                chmod -R go-rwx ${ROOTFSDIR}/${home}/.ssh
> +            "
> +            sudo -E chroot '${ROOTFSDIR}' \
> +                chown -R ${name}:${gid} ${home}/.ssh
> +        fi



>      done
>  }