* [PATCH] meta: Add recipe to regenerate ssh host keys
@ 2018-09-25 15:53 Harald Seiler
2018-09-26 8:31 ` Henning Schild
0 siblings, 1 reply; 7+ messages in thread
From: Harald Seiler @ 2018-09-25 15:53 UTC (permalink / raw)
To: isar-users
sshd-regen-keys is a systemd unit that will run
at first boot and force sshd to generate new
host keys.
This prevents all devices using the same keys.
Signed-off-by: Harald Seiler <hws@denx.de>
---
meta/recipes-support/sshd-regen-keys/files/postinst | 4 ++++
.../sshd-regen-keys/files/sshd-regen-keys.service | 19 +++++++++++++++++++
.../sshd-regen-keys/sshd-regen-keys.bb | 15 +++++++++++++++
3 files changed, 38 insertions(+)
create mode 100644 meta/recipes-support/sshd-regen-keys/files/postinst
create mode 100644 meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service
create mode 100644 meta/recipes-support/sshd-regen-keys/sshd-regen-keys.bb
diff --git a/meta/recipes-support/sshd-regen-keys/files/postinst b/meta/recipes-support/sshd-regen-keys/files/postinst
new file mode 100644
index 0000000..ae722a7
--- /dev/null
+++ b/meta/recipes-support/sshd-regen-keys/files/postinst
@@ -0,0 +1,4 @@
+#!/bin/sh
+set -e
+
+systemctl enable sshd-regen-keys.service
diff --git a/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service b/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service
new file mode 100644
index 0000000..3b8231f
--- /dev/null
+++ b/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service
@@ -0,0 +1,19 @@
+[Unit]
+Description=Regenerate sshd host keys
+DefaultDependencies=no
+Conflicts=shutdown.target
+After=systemd-remount-fs.service
+Before=shutdown.target sshd.service
+ConditionPathIsReadWrite=/etc
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+Environment=DEBIAN_FRONTEND=noninteractive
+ExecStart=/bin/sh -c "rm -v /etc/ssh/ssh_host_*_key*; dpkg-reconfigure openssh-server"
+ExecStartPost=-/bin/systemctl disable sshd-regen-keys.service
+StandardOutput=syslog
+StandardError=syslog
+
+[Install]
+WantedBy=sysinit.target
diff --git a/meta/recipes-support/sshd-regen-keys/sshd-regen-keys.bb b/meta/recipes-support/sshd-regen-keys/sshd-regen-keys.bb
new file mode 100644
index 0000000..3b196c2
--- /dev/null
+++ b/meta/recipes-support/sshd-regen-keys/sshd-regen-keys.bb
@@ -0,0 +1,15 @@
+# This software is a part of ISAR.
+
+DESCRIPTION = "Systemd service to regenerate sshd keys"
+MAINTAINER = "isar-users <isar-users@googlegroups.com>"
+DEBIAN_DEPENDS = "openssh-server"
+
+SRC_URI = "file://postinst \
+ file://sshd-regen-keys.service"
+
+inherit dpkg-raw
+
+do_install() {
+ sudo install -v -d -m 755 "${D}/lib/systemd/system"
+ sudo install -v -m 644 "${WORKDIR}/sshd-regen-keys.service" "${D}/lib/systemd/system/sshd-regen-keys.service"
+}
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH] meta: Add recipe to regenerate ssh host keys
2018-09-25 15:53 [PATCH] meta: Add recipe to regenerate ssh host keys Harald Seiler
@ 2018-09-26 8:31 ` Henning Schild
2018-10-02 8:43 ` [PATCH v2] " Harald Seiler
2018-10-02 17:56 ` [PATCH] " Henning Schild
0 siblings, 2 replies; 7+ messages in thread
From: Henning Schild @ 2018-09-26 8:31 UTC (permalink / raw)
To: Harald Seiler; +Cc: isar-users
Am Tue, 25 Sep 2018 17:53:19 +0200
schrieb Harald Seiler <hws@denx.de>:
> sshd-regen-keys is a systemd unit that will run
> at first boot and force sshd to generate new
> host keys.
>
> This prevents all devices using the same keys.
>
> Signed-off-by: Harald Seiler <hws@denx.de>
> ---
> meta/recipes-support/sshd-regen-keys/files/postinst | 4 ++++
> .../sshd-regen-keys/files/sshd-regen-keys.service | 19
> +++++++++++++++++++ .../sshd-regen-keys/sshd-regen-keys.bb
> | 15 +++++++++++++++ 3 files changed, 38 insertions(+)
> create mode 100644
> meta/recipes-support/sshd-regen-keys/files/postinst create mode
> 100644
> meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service
> create mode 100644
> meta/recipes-support/sshd-regen-keys/sshd-regen-keys.bb
>
> diff --git a/meta/recipes-support/sshd-regen-keys/files/postinst
> b/meta/recipes-support/sshd-regen-keys/files/postinst new file mode
> 100644 index 0000000..ae722a7
> --- /dev/null
> +++ b/meta/recipes-support/sshd-regen-keys/files/postinst
> @@ -0,0 +1,4 @@
> +#!/bin/sh
> +set -e
> +
> +systemctl enable sshd-regen-keys.service
> diff --git
> a/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service
> b/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service
> new file mode 100644 index 0000000..3b8231f --- /dev/null
> +++
> b/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service
> @@ -0,0 +1,19 @@ +[Unit]
> +Description=Regenerate sshd host keys
> +DefaultDependencies=no
> +Conflicts=shutdown.target
> +After=systemd-remount-fs.service
> +Before=shutdown.target sshd.service
> +ConditionPathIsReadWrite=/etc
> +
> +[Service]
> +Type=oneshot
> +RemainAfterExit=yes
> +Environment=DEBIAN_FRONTEND=noninteractive
> +ExecStart=/bin/sh -c "rm -v /etc/ssh/ssh_host_*_key*;
> dpkg-reconfigure openssh-server" +ExecStartPost=-/bin/systemctl
> disable sshd-regen-keys.service +StandardOutput=syslog
> +StandardError=syslog
> +
> +[Install]
> +WantedBy=sysinit.target
> diff --git a/meta/recipes-support/sshd-regen-keys/sshd-regen-keys.bb
> b/meta/recipes-support/sshd-regen-keys/sshd-regen-keys.bb new file
> mode 100644 index 0000000..3b196c2
> --- /dev/null
> +++ b/meta/recipes-support/sshd-regen-keys/sshd-regen-keys.bb
I think a PV would be useful. sshd-regen-keys_0.1.bb
> @@ -0,0 +1,15 @@
> +# This software is a part of ISAR.
> +
> +DESCRIPTION = "Systemd service to regenerate sshd keys"
> +MAINTAINER = "isar-users <isar-users@googlegroups.com>"
> +DEBIAN_DEPENDS = "openssh-server"
systemd is missing here ... yes you can still get debian without it,
also with Isar
Maybe something to add to IMAGE_INSTALL of one of the ci targets to get
test-coverage. But wait what others think about that idea.
Henning
> +
> +SRC_URI = "file://postinst \
> + file://sshd-regen-keys.service"
> +
> +inherit dpkg-raw
> +
> +do_install() {
> + sudo install -v -d -m 755 "${D}/lib/systemd/system"
> + sudo install -v -m 644 "${WORKDIR}/sshd-regen-keys.service"
> "${D}/lib/systemd/system/sshd-regen-keys.service" +}
>
^ permalink raw reply [flat|nested] 7+ messages in thread* [PATCH v2] meta: Add recipe to regenerate ssh host keys
2018-09-26 8:31 ` Henning Schild
@ 2018-10-02 8:43 ` Harald Seiler
2018-10-02 17:56 ` [PATCH] " Henning Schild
1 sibling, 0 replies; 7+ messages in thread
From: Harald Seiler @ 2018-10-02 8:43 UTC (permalink / raw)
To: Henning Schild; +Cc: isar-users
sshd-regen-keys is a systemd unit that will run
at first boot and force sshd to generate new
host keys.
This prevents all devices using the same keys.
Signed-off-by: Harald Seiler <hws@denx.de>
---
meta/recipes-support/sshd-regen-keys/files/postinst | 4 ++++
.../sshd-regen-keys/files/sshd-regen-keys.service | 19 +++++++++++++++++++
.../sshd-regen-keys/sshd-regen-keys_0.1.bb | 15 +++++++++++++++
3 files changed, 38 insertions(+)
create mode 100644 meta/recipes-support/sshd-regen-keys/files/postinst
create mode 100644 meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service
create mode 100644 meta/recipes-support/sshd-regen-keys/sshd-regen-keys_0.1.bb
diff --git a/meta/recipes-support/sshd-regen-keys/files/postinst b/meta/recipes-support/sshd-regen-keys/files/postinst
new file mode 100644
index 0000000..ae722a7
--- /dev/null
+++ b/meta/recipes-support/sshd-regen-keys/files/postinst
@@ -0,0 +1,4 @@
+#!/bin/sh
+set -e
+
+systemctl enable sshd-regen-keys.service
diff --git a/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service b/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service
new file mode 100644
index 0000000..3b8231f
--- /dev/null
+++ b/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service
@@ -0,0 +1,19 @@
+[Unit]
+Description=Regenerate sshd host keys
+DefaultDependencies=no
+Conflicts=shutdown.target
+After=systemd-remount-fs.service
+Before=shutdown.target sshd.service
+ConditionPathIsReadWrite=/etc
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+Environment=DEBIAN_FRONTEND=noninteractive
+ExecStart=/bin/sh -c "rm -v /etc/ssh/ssh_host_*_key*; dpkg-reconfigure openssh-server"
+ExecStartPost=-/bin/systemctl disable sshd-regen-keys.service
+StandardOutput=syslog
+StandardError=syslog
+
+[Install]
+WantedBy=sysinit.target
diff --git a/meta/recipes-support/sshd-regen-keys/sshd-regen-keys_0.1.bb b/meta/recipes-support/sshd-regen-keys/sshd-regen-keys_0.1.bb
new file mode 100644
index 0000000..06e0cc4
--- /dev/null
+++ b/meta/recipes-support/sshd-regen-keys/sshd-regen-keys_0.1.bb
@@ -0,0 +1,15 @@
+# This software is a part of ISAR.
+
+DESCRIPTION = "Systemd service to regenerate sshd keys"
+MAINTAINER = "isar-users <isar-users@googlegroups.com>"
+DEBIAN_DEPENDS = "openssh-server, systemd"
+
+SRC_URI = "file://postinst \
+ file://sshd-regen-keys.service"
+
+inherit dpkg-raw
+
+do_install() {
+ sudo install -v -d -m 755 "${D}/lib/systemd/system"
+ sudo install -v -m 644 "${WORKDIR}/sshd-regen-keys.service" "${D}/lib/systemd/system/sshd-regen-keys.service"
+}
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH] meta: Add recipe to regenerate ssh host keys
2018-09-26 8:31 ` Henning Schild
2018-10-02 8:43 ` [PATCH v2] " Harald Seiler
@ 2018-10-02 17:56 ` Henning Schild
2018-10-09 8:42 ` [PATCH v3] " Harald Seiler
2018-10-09 12:13 ` [PATCH v4] " Harald Seiler
1 sibling, 2 replies; 7+ messages in thread
From: Henning Schild @ 2018-10-02 17:56 UTC (permalink / raw)
To: Harald Seiler
Cc: isar-users, Kiszka, Jan (CT RDA IOT SES-DE), Maxim Yu. Osipov
Am Wed, 26 Sep 2018 10:31:38 +0200
schrieb "[ext] Henning Schild" <henning.schild@siemens.com>:
> Am Tue, 25 Sep 2018 17:53:19 +0200
> schrieb Harald Seiler <hws@denx.de>:
>
> > sshd-regen-keys is a systemd unit that will run
> > at first boot and force sshd to generate new
> > host keys.
> >
> > This prevents all devices using the same keys.
> >
> > Signed-off-by: Harald Seiler <hws@denx.de>
> > ---
> > meta/recipes-support/sshd-regen-keys/files/postinst | 4 ++++
> > .../sshd-regen-keys/files/sshd-regen-keys.service | 19
> > +++++++++++++++++++ .../sshd-regen-keys/sshd-regen-keys.bb
> > | 15 +++++++++++++++ 3 files changed, 38 insertions(+)
> > create mode 100644
> > meta/recipes-support/sshd-regen-keys/files/postinst create mode
> > 100644
> > meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service
> > create mode 100644
> > meta/recipes-support/sshd-regen-keys/sshd-regen-keys.bb
> >
> > diff --git a/meta/recipes-support/sshd-regen-keys/files/postinst
> > b/meta/recipes-support/sshd-regen-keys/files/postinst new file mode
> > 100644 index 0000000..ae722a7
> > --- /dev/null
> > +++ b/meta/recipes-support/sshd-regen-keys/files/postinst
> > @@ -0,0 +1,4 @@
> > +#!/bin/sh
> > +set -e
> > +
> > +systemctl enable sshd-regen-keys.service
> > diff --git
> > a/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service
> > b/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service
> > new file mode 100644 index 0000000..3b8231f --- /dev/null
> > +++
> > b/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service
> > @@ -0,0 +1,19 @@ +[Unit]
> > +Description=Regenerate sshd host keys
> > +DefaultDependencies=no
> > +Conflicts=shutdown.target
> > +After=systemd-remount-fs.service
> > +Before=shutdown.target sshd.service
> > +ConditionPathIsReadWrite=/etc
> > +
> > +[Service]
> > +Type=oneshot
> > +RemainAfterExit=yes
> > +Environment=DEBIAN_FRONTEND=noninteractive
> > +ExecStart=/bin/sh -c "rm -v /etc/ssh/ssh_host_*_key*;
> > dpkg-reconfigure openssh-server" +ExecStartPost=-/bin/systemctl
> > disable sshd-regen-keys.service +StandardOutput=syslog
> > +StandardError=syslog
> > +
> > +[Install]
> > +WantedBy=sysinit.target
> > diff --git a/meta/recipes-support/sshd-regen-keys/sshd-regen-keys.bb
> > b/meta/recipes-support/sshd-regen-keys/sshd-regen-keys.bb new file
> > mode 100644 index 0000000..3b196c2
> > --- /dev/null
> > +++ b/meta/recipes-support/sshd-regen-keys/sshd-regen-keys.bb
>
> I think a PV would be useful. sshd-regen-keys_0.1.bb
>
> > @@ -0,0 +1,15 @@
> > +# This software is a part of ISAR.
> > +
> > +DESCRIPTION = "Systemd service to regenerate sshd keys"
> > +MAINTAINER = "isar-users <isar-users@googlegroups.com>"
> > +DEBIAN_DEPENDS = "openssh-server"
>
> systemd is missing here ... yes you can still get debian without it,
> also with Isar
>
> Maybe something to add to IMAGE_INSTALL of one of the ci targets to
> get test-coverage. But wait what others think about that idea.
I made up my mind about that. Isar has recently gained some features
that lack examples and test coverage, please add a IMAGE_INSTALL+= to
qemuamd64.conf.
These seemingly simple things will otherwise break eventually.
Henning
> Henning
>
> > +
> > +SRC_URI = "file://postinst \
> > + file://sshd-regen-keys.service"
> > +
> > +inherit dpkg-raw
> > +
> > +do_install() {
> > + sudo install -v -d -m 755 "${D}/lib/systemd/system"
> > + sudo install -v -m 644 "${WORKDIR}/sshd-regen-keys.service"
> > "${D}/lib/systemd/system/sshd-regen-keys.service" +}
> >
>
^ permalink raw reply [flat|nested] 7+ messages in thread* [PATCH v3] meta: Add recipe to regenerate ssh host keys
2018-10-02 17:56 ` [PATCH] " Henning Schild
@ 2018-10-09 8:42 ` Harald Seiler
2018-10-09 12:13 ` [PATCH v4] " Harald Seiler
1 sibling, 0 replies; 7+ messages in thread
From: Harald Seiler @ 2018-10-09 8:42 UTC (permalink / raw)
To: Henning Schild; +Cc: isar-users
sshd-regen-keys is a systemd unit that will run
at first boot and force sshd to generate new
host keys.
This prevents all devices using the same keys.
Also adds sshd-regen-keys to qemuamd64-buster.conf
to ensure CI coverage.
Signed-off-by: Harald Seiler <hws@denx.de>
---
meta-isar/conf/multiconfig/qemuamd64-buster.conf | 2 ++
meta/recipes-support/sshd-regen-keys/files/postinst | 4 ++++
.../sshd-regen-keys/files/sshd-regen-keys.service | 19 +++++++++++++++++++
.../sshd-regen-keys/sshd-regen-keys_0.1.bb | 15 +++++++++++++++
4 files changed, 40 insertions(+)
create mode 100644 meta/recipes-support/sshd-regen-keys/files/postinst
create mode 100644 meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service
create mode 100644 meta/recipes-support/sshd-regen-keys/sshd-regen-keys_0.1.bb
diff --git a/meta-isar/conf/multiconfig/qemuamd64-buster.conf b/meta-isar/conf/multiconfig/qemuamd64-buster.conf
index 059ea00..bd18fcc 100644
--- a/meta-isar/conf/multiconfig/qemuamd64-buster.conf
+++ b/meta-isar/conf/multiconfig/qemuamd64-buster.conf
@@ -11,6 +11,8 @@ IMAGE_TYPE ?= "wic-img"
WKS_FILE ?= "sdimage-efi"
IMAGER_INSTALL += "${GRUB_BOOTLOADER_INSTALL}"
+IMAGE_INSTALL += "sshd-regen-keys"
+
QEMU_ARCH ?= "x86_64"
QEMU_MACHINE ?= "q35"
QEMU_CPU ?= ""
diff --git a/meta/recipes-support/sshd-regen-keys/files/postinst b/meta/recipes-support/sshd-regen-keys/files/postinst
new file mode 100644
index 0000000..ae722a7
--- /dev/null
+++ b/meta/recipes-support/sshd-regen-keys/files/postinst
@@ -0,0 +1,4 @@
+#!/bin/sh
+set -e
+
+systemctl enable sshd-regen-keys.service
diff --git a/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service b/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service
new file mode 100644
index 0000000..3b8231f
--- /dev/null
+++ b/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service
@@ -0,0 +1,19 @@
+[Unit]
+Description=Regenerate sshd host keys
+DefaultDependencies=no
+Conflicts=shutdown.target
+After=systemd-remount-fs.service
+Before=shutdown.target sshd.service
+ConditionPathIsReadWrite=/etc
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+Environment=DEBIAN_FRONTEND=noninteractive
+ExecStart=/bin/sh -c "rm -v /etc/ssh/ssh_host_*_key*; dpkg-reconfigure openssh-server"
+ExecStartPost=-/bin/systemctl disable sshd-regen-keys.service
+StandardOutput=syslog
+StandardError=syslog
+
+[Install]
+WantedBy=sysinit.target
diff --git a/meta/recipes-support/sshd-regen-keys/sshd-regen-keys_0.1.bb b/meta/recipes-support/sshd-regen-keys/sshd-regen-keys_0.1.bb
new file mode 100644
index 0000000..06e0cc4
--- /dev/null
+++ b/meta/recipes-support/sshd-regen-keys/sshd-regen-keys_0.1.bb
@@ -0,0 +1,15 @@
+# This software is a part of ISAR.
+
+DESCRIPTION = "Systemd service to regenerate sshd keys"
+MAINTAINER = "isar-users <isar-users@googlegroups.com>"
+DEBIAN_DEPENDS = "openssh-server, systemd"
+
+SRC_URI = "file://postinst \
+ file://sshd-regen-keys.service"
+
+inherit dpkg-raw
+
+do_install() {
+ sudo install -v -d -m 755 "${D}/lib/systemd/system"
+ sudo install -v -m 644 "${WORKDIR}/sshd-regen-keys.service" "${D}/lib/systemd/system/sshd-regen-keys.service"
+}
--
Harald Seiler <hws@denx.de>
^ permalink raw reply [flat|nested] 7+ messages in thread* [PATCH v4] meta: Add recipe to regenerate ssh host keys
2018-10-02 17:56 ` [PATCH] " Henning Schild
2018-10-09 8:42 ` [PATCH v3] " Harald Seiler
@ 2018-10-09 12:13 ` Harald Seiler
2018-10-17 12:12 ` Maxim Yu. Osipov
1 sibling, 1 reply; 7+ messages in thread
From: Harald Seiler @ 2018-10-09 12:13 UTC (permalink / raw)
To: Henning Schild; +Cc: isar-users
sshd-regen-keys is a systemd unit that will run
at first boot and force sshd to generate new
host keys.
This prevents all devices using the same keys.
Also adds sshd-regen-keys to qemuamd64-buster.conf
to ensure CI coverage.
Signed-off-by: Harald Seiler <hws@denx.de>
---
This version removes an unnecessary sudo in do_install
meta-isar/conf/multiconfig/qemuamd64-buster.conf | 2 ++
meta/recipes-support/sshd-regen-keys/files/postinst | 4 ++++
.../sshd-regen-keys/files/sshd-regen-keys.service | 19 +++++++++++++++++++
.../sshd-regen-keys/sshd-regen-keys_0.1.bb | 14 ++++++++++++++
4 files changed, 39 insertions(+)
create mode 100644 meta/recipes-support/sshd-regen-keys/files/postinst
create mode 100644 meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service
create mode 100644 meta/recipes-support/sshd-regen-keys/sshd-regen-keys_0.1.bb
diff --git a/meta-isar/conf/multiconfig/qemuamd64-buster.conf b/meta-isar/conf/multiconfig/qemuamd64-buster.conf
index 059ea00..bd18fcc 100644
--- a/meta-isar/conf/multiconfig/qemuamd64-buster.conf
+++ b/meta-isar/conf/multiconfig/qemuamd64-buster.conf
@@ -11,6 +11,8 @@ IMAGE_TYPE ?= "wic-img"
WKS_FILE ?= "sdimage-efi"
IMAGER_INSTALL += "${GRUB_BOOTLOADER_INSTALL}"
+IMAGE_INSTALL += "sshd-regen-keys"
+
QEMU_ARCH ?= "x86_64"
QEMU_MACHINE ?= "q35"
QEMU_CPU ?= ""
diff --git a/meta/recipes-support/sshd-regen-keys/files/postinst b/meta/recipes-support/sshd-regen-keys/files/postinst
new file mode 100644
index 0000000..ae722a7
--- /dev/null
+++ b/meta/recipes-support/sshd-regen-keys/files/postinst
@@ -0,0 +1,4 @@
+#!/bin/sh
+set -e
+
+systemctl enable sshd-regen-keys.service
diff --git a/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service b/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service
new file mode 100644
index 0000000..3b8231f
--- /dev/null
+++ b/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service
@@ -0,0 +1,19 @@
+[Unit]
+Description=Regenerate sshd host keys
+DefaultDependencies=no
+Conflicts=shutdown.target
+After=systemd-remount-fs.service
+Before=shutdown.target sshd.service
+ConditionPathIsReadWrite=/etc
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+Environment=DEBIAN_FRONTEND=noninteractive
+ExecStart=/bin/sh -c "rm -v /etc/ssh/ssh_host_*_key*; dpkg-reconfigure openssh-server"
+ExecStartPost=-/bin/systemctl disable sshd-regen-keys.service
+StandardOutput=syslog
+StandardError=syslog
+
+[Install]
+WantedBy=sysinit.target
diff --git a/meta/recipes-support/sshd-regen-keys/sshd-regen-keys_0.1.bb b/meta/recipes-support/sshd-regen-keys/sshd-regen-keys_0.1.bb
new file mode 100644
index 0000000..02e9e25
--- /dev/null
+++ b/meta/recipes-support/sshd-regen-keys/sshd-regen-keys_0.1.bb
@@ -0,0 +1,14 @@
+# This software is a part of ISAR.
+inherit dpkg-raw
+
+DESCRIPTION = "Systemd service to regenerate sshd keys"
+MAINTAINER = "isar-users <isar-users@googlegroups.com>"
+DEBIAN_DEPENDS = "openssh-server, systemd"
+
+SRC_URI = "file://postinst \
+ file://sshd-regen-keys.service"
+
+do_install() {
+ install -v -d -m 755 "${D}/lib/systemd/system"
+ install -v -m 644 "${WORKDIR}/sshd-regen-keys.service" "${D}/lib/systemd/system/sshd-regen-keys.service"
+}
--
2.14.1
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH v4] meta: Add recipe to regenerate ssh host keys
2018-10-09 12:13 ` [PATCH v4] " Harald Seiler
@ 2018-10-17 12:12 ` Maxim Yu. Osipov
0 siblings, 0 replies; 7+ messages in thread
From: Maxim Yu. Osipov @ 2018-10-17 12:12 UTC (permalink / raw)
To: Harald Seiler, Henning Schild; +Cc: isar-users
On 10/9/18 3:13 PM, Harald Seiler wrote:
> sshd-regen-keys is a systemd unit that will run
> at first boot and force sshd to generate new
> host keys.
>
> This prevents all devices using the same keys.
>
> Also adds sshd-regen-keys to qemuamd64-buster.conf
> to ensure CI coverage.
Applied to the 'next',
Thanks,
Maixm.
> Signed-off-by: Harald Seiler <hws@denx.de>
> ---
> This version removes an unnecessary sudo in do_install
>
> meta-isar/conf/multiconfig/qemuamd64-buster.conf | 2 ++
> meta/recipes-support/sshd-regen-keys/files/postinst | 4 ++++
> .../sshd-regen-keys/files/sshd-regen-keys.service | 19 +++++++++++++++++++
> .../sshd-regen-keys/sshd-regen-keys_0.1.bb | 14 ++++++++++++++
> 4 files changed, 39 insertions(+)
> create mode 100644 meta/recipes-support/sshd-regen-keys/files/postinst
> create mode 100644 meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service
> create mode 100644 meta/recipes-support/sshd-regen-keys/sshd-regen-keys_0.1.bb
>
> diff --git a/meta-isar/conf/multiconfig/qemuamd64-buster.conf b/meta-isar/conf/multiconfig/qemuamd64-buster.conf
> index 059ea00..bd18fcc 100644
> --- a/meta-isar/conf/multiconfig/qemuamd64-buster.conf
> +++ b/meta-isar/conf/multiconfig/qemuamd64-buster.conf
> @@ -11,6 +11,8 @@ IMAGE_TYPE ?= "wic-img"
> WKS_FILE ?= "sdimage-efi"
> IMAGER_INSTALL += "${GRUB_BOOTLOADER_INSTALL}"
>
> +IMAGE_INSTALL += "sshd-regen-keys"
> +
> QEMU_ARCH ?= "x86_64"
> QEMU_MACHINE ?= "q35"
> QEMU_CPU ?= ""
> diff --git a/meta/recipes-support/sshd-regen-keys/files/postinst b/meta/recipes-support/sshd-regen-keys/files/postinst
> new file mode 100644
> index 0000000..ae722a7
> --- /dev/null
> +++ b/meta/recipes-support/sshd-regen-keys/files/postinst
> @@ -0,0 +1,4 @@
> +#!/bin/sh
> +set -e
> +
> +systemctl enable sshd-regen-keys.service
> diff --git a/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service b/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service
> new file mode 100644
> index 0000000..3b8231f
> --- /dev/null
> +++ b/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service
> @@ -0,0 +1,19 @@
> +[Unit]
> +Description=Regenerate sshd host keys
> +DefaultDependencies=no
> +Conflicts=shutdown.target
> +After=systemd-remount-fs.service
> +Before=shutdown.target sshd.service
> +ConditionPathIsReadWrite=/etc
> +
> +[Service]
> +Type=oneshot
> +RemainAfterExit=yes
> +Environment=DEBIAN_FRONTEND=noninteractive
> +ExecStart=/bin/sh -c "rm -v /etc/ssh/ssh_host_*_key*; dpkg-reconfigure openssh-server"
> +ExecStartPost=-/bin/systemctl disable sshd-regen-keys.service
> +StandardOutput=syslog
> +StandardError=syslog
> +
> +[Install]
> +WantedBy=sysinit.target
> diff --git a/meta/recipes-support/sshd-regen-keys/sshd-regen-keys_0.1.bb b/meta/recipes-support/sshd-regen-keys/sshd-regen-keys_0.1.bb
> new file mode 100644
> index 0000000..02e9e25
> --- /dev/null
> +++ b/meta/recipes-support/sshd-regen-keys/sshd-regen-keys_0.1.bb
> @@ -0,0 +1,14 @@
> +# This software is a part of ISAR.
> +inherit dpkg-raw
> +
> +DESCRIPTION = "Systemd service to regenerate sshd keys"
> +MAINTAINER = "isar-users <isar-users@googlegroups.com>"
> +DEBIAN_DEPENDS = "openssh-server, systemd"
> +
> +SRC_URI = "file://postinst \
> + file://sshd-regen-keys.service"
> +
> +do_install() {
> + install -v -d -m 755 "${D}/lib/systemd/system"
> + install -v -m 644 "${WORKDIR}/sshd-regen-keys.service" "${D}/lib/systemd/system/sshd-regen-keys.service"
> +}
>
--
Maxim Osipov
ilbers GmbH
Maria-Merian-Str. 8
85521 Ottobrunn
Germany
+49 (151) 6517 6917
mosipov@ilbers.de
http://ilbers.de/
Commercial register Munich, HRB 214197
General Manager: Baurzhan Ismagulov
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2018-10-17 12:12 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-09-25 15:53 [PATCH] meta: Add recipe to regenerate ssh host keys Harald Seiler
2018-09-26 8:31 ` Henning Schild
2018-10-02 8:43 ` [PATCH v2] " Harald Seiler
2018-10-02 17:56 ` [PATCH] " Henning Schild
2018-10-09 8:42 ` [PATCH v3] " Harald Seiler
2018-10-09 12:13 ` [PATCH v4] " Harald Seiler
2018-10-17 12:12 ` Maxim Yu. Osipov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox