Re: [PATCH 05/11] image-account-extension: Add copy-ci-key flag for user

[Henning Schild <henning.schild@siemens.com>]

Am Wed, 25 Jan 2023 10:36:55 +0300
schrieb Uladzimir Bely <ubely@ilbers.de>:

> In mail from вторник, 24 января 2023 г. 10:18:28 +03 user Henning
> Schild wrote:
> > Am Tue, 24 Jan 2023 08:09:24 +0100
> > 
> > schrieb Henning Schild <henning.schild@siemens.com>:  
> > > Am Fri, 13 Jan 2023 08:19:36 +0100
> > > 
> > > schrieb Uladzimir Bely <ubely@ilbers.de>:  
> > > > If the flag enabled, CI ssh public key is copied
> > > > `authorized_keys` in `$USER/.ssh/` directory.
> > > > 
> > > > This allows non-interactive SSH access to the machine with
> > > > executing custom commands on the guest VM.  
> > > 
> > > I would suggest to make that a debian raw package, examples on
> > > how to do that can be found in many public layers.
> > > 
> > > You could i.e. drop an authorized-keys file into /etc/ssh/ and
> > > using postinst append/change the AuthorizedKeysFile line in the
> > > global ssh config  
> > 
> > Create the user ci like we create the user isar in example-raw, and
> > drop that file into HOME/.ssh/, maybe depend on sudo and make sure
> > that user can run any command without password.
> > We could also use a trivial password and not have a key at all.
> > 
> > And when it is a package we can depend on regen-keys.
> > 
> > Henning
> >   
> 
> Yes, it sounds reasonable. I't should be easier to manage everything
> in one recipe, instead of specific image and image extensions.
> 
> I'm just not sure we can avoid using keys - I didn't manage to
> execute commands (by running `ssh <options> <cmd>` ) in
> non-interactive way with only user passwords.

Quick google pointed me to "sshpass -p ci ssh <options> <cmd>". The
tool would have to be installed with apt-get like we do with
qemu-system. In fact ssh will also have to be installed.

If that does not work, we use the key.

Henning

> > > That way we know which package owned that file and if we have a
> > > prerm we can even remove everything with apt.
> > > 
> > > Henning
> > >   
> > > > Signed-off-by: Uladzimir Bely <ubely@ilbers.de>
> > > > ---
> > > > 
> > > >  meta/classes/image-account-extension.bbclass | 14
> > > > +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
> > > > 
> > > > diff --git a/meta/classes/image-account-extension.bbclass
> > > > b/meta/classes/image-account-extension.bbclass index
> > > > 70950a7b..c9b86250 100644 ---
> > > > a/meta/classes/image-account-extension.bbclass +++
> > > > b/meta/classes/image-account-extension.bbclass @@ -17,7 +17,7 @@
> > > > USERS ??= "" #USER_root[home] = "/home/root"
> > > > 
> > > >  #USER_root[shell] = "/bin/sh"
> > > >  #USER_root[groups] = "audio video"
> > > > 
> > > > -#USER_root[flags] = "no-create-home create-home system
> > > > allow-empty-password clear-text-password force-passwd-change"
> > > > +#USER_root[flags] = "no-create-home create-home system
> > > > allow-empty-password clear-text-password force-passwd-change
> > > > copy-ci-key" GROUPS ??= ""
> > > > @@ -263,5 +263,17 @@ image_postprocess_accounts() {
> > > > 
> > > >              sudo -E chroot '${ROOTFSDIR}' \
> > > >              
> > > >                  /usr/bin/passwd --expire "$name"
> > > >          
> > > >          fi
> > > > 
> > > > +
> > > > +        # Add CI ssh key for noninteractive login
> > > > +        if [ "${flags}" != "${flags%*,copy-ci-key,*}" ]; then
> > > > +            echo "Add CI ssh key for \"$name\""
> > > > +            sudo sh -c " \
> > > > +                mkdir -p ${ROOTFSDIR}/${home}/.ssh && \
> > > > +                cat ${TESTSUITEDIR}/keys/ssh/id_rsa.pub >
> > > > ${ROOTFSDIR}/${home}/.ssh/authorized_keys && \
> > > > +                chmod -R go-rwx ${ROOTFSDIR}/${home}/.ssh
> > > > +            "
> > > > +            sudo -E chroot '${ROOTFSDIR}' \
> > > > +                chown -R ${name}:${gid} ${home}/.ssh
> > > > +        fi
> > > > 
> > > >      done
> > > >  
> > > >  }  
> 
> 
> 
>