Re: [PATCH 05/11] image-account-extension: Add copy-ci-key flag for user

[Henning Schild <henning.schild@siemens.com>]

Am Tue, 24 Jan 2023 08:09:24 +0100
schrieb Henning Schild <henning.schild@siemens.com>:

> Am Fri, 13 Jan 2023 08:19:36 +0100
> schrieb Uladzimir Bely <ubely@ilbers.de>:
> 
> > If the flag enabled, CI ssh public key is copied `authorized_keys`
> > in `$USER/.ssh/` directory.
> > 
> > This allows non-interactive SSH access to the machine with executing
> > custom commands on the guest VM.  
> 
> I would suggest to make that a debian raw package, examples on how to
> do that can be found in many public layers.
> 
> You could i.e. drop an authorized-keys file into /etc/ssh/ and using
> postinst append/change the AuthorizedKeysFile line in the global ssh
> config

Create the user ci like we create the user isar in example-raw, and
drop that file into HOME/.ssh/, maybe depend on sudo and make sure that
user can run any command without password.
We could also use a trivial password and not have a key at all.

And when it is a package we can depend on regen-keys.

Henning

> That way we know which package owned that file and if we have a prerm
> we can even remove everything with apt.
> 
> Henning
> 
> > Signed-off-by: Uladzimir Bely <ubely@ilbers.de>
> > ---
> >  meta/classes/image-account-extension.bbclass | 14 +++++++++++++-
> >  1 file changed, 13 insertions(+), 1 deletion(-)
> > 
> > diff --git a/meta/classes/image-account-extension.bbclass
> > b/meta/classes/image-account-extension.bbclass index
> > 70950a7b..c9b86250 100644 ---
> > a/meta/classes/image-account-extension.bbclass +++
> > b/meta/classes/image-account-extension.bbclass @@ -17,7 +17,7 @@
> > USERS ??= "" #USER_root[home] = "/home/root"
> >  #USER_root[shell] = "/bin/sh"
> >  #USER_root[groups] = "audio video"
> > -#USER_root[flags] = "no-create-home create-home system
> > allow-empty-password clear-text-password force-passwd-change"
> > +#USER_root[flags] = "no-create-home create-home system
> > allow-empty-password clear-text-password force-passwd-change
> > copy-ci-key" GROUPS ??= "" 
> > @@ -263,5 +263,17 @@ image_postprocess_accounts() {
> >              sudo -E chroot '${ROOTFSDIR}' \
> >                  /usr/bin/passwd --expire "$name"
> >          fi
> > +
> > +        # Add CI ssh key for noninteractive login
> > +        if [ "${flags}" != "${flags%*,copy-ci-key,*}" ]; then
> > +            echo "Add CI ssh key for \"$name\""
> > +            sudo sh -c " \
> > +                mkdir -p ${ROOTFSDIR}/${home}/.ssh && \
> > +                cat ${TESTSUITEDIR}/keys/ssh/id_rsa.pub >
> > ${ROOTFSDIR}/${home}/.ssh/authorized_keys && \
> > +                chmod -R go-rwx ${ROOTFSDIR}/${home}/.ssh
> > +            "
> > +            sudo -E chroot '${ROOTFSDIR}' \
> > +                chown -R ${name}:${gid} ${home}/.ssh
> > +        fi  
> 
> 
> 
> >      done
> >  }  
>