Re: [PATCH v4] meta: Add recipe to regenerate ssh host keys

["Maxim Yu. Osipov" <mosipov@ilbers.de>]

On 10/9/18 3:13 PM, Harald Seiler wrote:
> sshd-regen-keys is a systemd unit that will run
> at first boot and force sshd to generate new
> host keys.
> 
> This prevents all devices using the same keys.
> 
> Also adds sshd-regen-keys to qemuamd64-buster.conf
> to ensure CI coverage.

Applied to the 'next',

Thanks,
Maixm.

> Signed-off-by: Harald Seiler <hws@denx.de>
> ---
> This version removes an unnecessary sudo in do_install
> 
>   meta-isar/conf/multiconfig/qemuamd64-buster.conf      |  2 ++
>   meta/recipes-support/sshd-regen-keys/files/postinst   |  4 ++++
>   .../sshd-regen-keys/files/sshd-regen-keys.service     | 19 +++++++++++++++++++
>   .../sshd-regen-keys/sshd-regen-keys_0.1.bb            | 14 ++++++++++++++
>   4 files changed, 39 insertions(+)
>   create mode 100644 meta/recipes-support/sshd-regen-keys/files/postinst
>   create mode 100644 meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service
>   create mode 100644 meta/recipes-support/sshd-regen-keys/sshd-regen-keys_0.1.bb
> 
> diff --git a/meta-isar/conf/multiconfig/qemuamd64-buster.conf b/meta-isar/conf/multiconfig/qemuamd64-buster.conf
> index 059ea00..bd18fcc 100644
> --- a/meta-isar/conf/multiconfig/qemuamd64-buster.conf
> +++ b/meta-isar/conf/multiconfig/qemuamd64-buster.conf
> @@ -11,6 +11,8 @@ IMAGE_TYPE ?= "wic-img"
>   WKS_FILE ?= "sdimage-efi"
>   IMAGER_INSTALL += "${GRUB_BOOTLOADER_INSTALL}"
>   
> +IMAGE_INSTALL += "sshd-regen-keys"
> +
>   QEMU_ARCH ?= "x86_64"
>   QEMU_MACHINE ?= "q35"
>   QEMU_CPU ?= ""
> diff --git a/meta/recipes-support/sshd-regen-keys/files/postinst b/meta/recipes-support/sshd-regen-keys/files/postinst
> new file mode 100644
> index 0000000..ae722a7
> --- /dev/null
> +++ b/meta/recipes-support/sshd-regen-keys/files/postinst
> @@ -0,0 +1,4 @@
> +#!/bin/sh
> +set -e
> +
> +systemctl enable sshd-regen-keys.service
> diff --git a/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service b/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service
> new file mode 100644
> index 0000000..3b8231f
> --- /dev/null
> +++ b/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service
> @@ -0,0 +1,19 @@
> +[Unit]
> +Description=Regenerate sshd host keys
> +DefaultDependencies=no
> +Conflicts=shutdown.target
> +After=systemd-remount-fs.service
> +Before=shutdown.target sshd.service
> +ConditionPathIsReadWrite=/etc
> +
> +[Service]
> +Type=oneshot
> +RemainAfterExit=yes
> +Environment=DEBIAN_FRONTEND=noninteractive
> +ExecStart=/bin/sh -c "rm -v /etc/ssh/ssh_host_*_key*; dpkg-reconfigure openssh-server"
> +ExecStartPost=-/bin/systemctl disable sshd-regen-keys.service
> +StandardOutput=syslog
> +StandardError=syslog
> +
> +[Install]
> +WantedBy=sysinit.target
> diff --git a/meta/recipes-support/sshd-regen-keys/sshd-regen-keys_0.1.bb b/meta/recipes-support/sshd-regen-keys/sshd-regen-keys_0.1.bb
> new file mode 100644
> index 0000000..02e9e25
> --- /dev/null
> +++ b/meta/recipes-support/sshd-regen-keys/sshd-regen-keys_0.1.bb
> @@ -0,0 +1,14 @@
> +# This software is a part of ISAR.
> +inherit dpkg-raw
> +
> +DESCRIPTION = "Systemd service to regenerate sshd keys"
> +MAINTAINER = "isar-users <isar-users@googlegroups.com>"
> +DEBIAN_DEPENDS = "openssh-server, systemd"
> +
> +SRC_URI = "file://postinst \
> +           file://sshd-regen-keys.service"
> +
> +do_install() {
> +    install -v -d -m 755 "${D}/lib/systemd/system"
> +    install -v -m 644 "${WORKDIR}/sshd-regen-keys.service" "${D}/lib/systemd/system/sshd-regen-keys.service"
> +}
> 


-- 
Maxim Osipov
ilbers GmbH
Maria-Merian-Str. 8
85521 Ottobrunn
Germany
+49 (151) 6517 6917
mosipov@ilbers.de
http://ilbers.de/
Commercial register Munich, HRB 214197
General Manager: Baurzhan Ismagulov