[PATCH v3] meta: Add recipe to regenerate ssh host keys

[Harald Seiler <hws@denx.de>]

sshd-regen-keys is a systemd unit that will run
at first boot and force sshd to generate new
host keys.

This prevents all devices using the same keys.

Also adds sshd-regen-keys to qemuamd64-buster.conf
to ensure CI coverage.

Signed-off-by: Harald Seiler <hws@denx.de>
---
 meta-isar/conf/multiconfig/qemuamd64-buster.conf      |  2 ++
 meta/recipes-support/sshd-regen-keys/files/postinst   |  4 ++++
 .../sshd-regen-keys/files/sshd-regen-keys.service     | 19 +++++++++++++++++++
 .../sshd-regen-keys/sshd-regen-keys_0.1.bb            | 15 +++++++++++++++
 4 files changed, 40 insertions(+)
 create mode 100644 meta/recipes-support/sshd-regen-keys/files/postinst
 create mode 100644 meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service
 create mode 100644 meta/recipes-support/sshd-regen-keys/sshd-regen-keys_0.1.bb

diff --git a/meta-isar/conf/multiconfig/qemuamd64-buster.conf b/meta-isar/conf/multiconfig/qemuamd64-buster.conf
index 059ea00..bd18fcc 100644
--- a/meta-isar/conf/multiconfig/qemuamd64-buster.conf
+++ b/meta-isar/conf/multiconfig/qemuamd64-buster.conf
@@ -11,6 +11,8 @@ IMAGE_TYPE ?= "wic-img"
 WKS_FILE ?= "sdimage-efi"
 IMAGER_INSTALL += "${GRUB_BOOTLOADER_INSTALL}"
 
+IMAGE_INSTALL += "sshd-regen-keys"
+
 QEMU_ARCH ?= "x86_64"
 QEMU_MACHINE ?= "q35"
 QEMU_CPU ?= ""
diff --git a/meta/recipes-support/sshd-regen-keys/files/postinst b/meta/recipes-support/sshd-regen-keys/files/postinst
new file mode 100644
index 0000000..ae722a7
--- /dev/null
+++ b/meta/recipes-support/sshd-regen-keys/files/postinst
@@ -0,0 +1,4 @@
+#!/bin/sh
+set -e
+
+systemctl enable sshd-regen-keys.service
diff --git a/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service b/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service
new file mode 100644
index 0000000..3b8231f
--- /dev/null
+++ b/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service
@@ -0,0 +1,19 @@
+[Unit]
+Description=Regenerate sshd host keys
+DefaultDependencies=no
+Conflicts=shutdown.target
+After=systemd-remount-fs.service
+Before=shutdown.target sshd.service
+ConditionPathIsReadWrite=/etc
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+Environment=DEBIAN_FRONTEND=noninteractive
+ExecStart=/bin/sh -c "rm -v /etc/ssh/ssh_host_*_key*; dpkg-reconfigure openssh-server"
+ExecStartPost=-/bin/systemctl disable sshd-regen-keys.service
+StandardOutput=syslog
+StandardError=syslog
+
+[Install]
+WantedBy=sysinit.target
diff --git a/meta/recipes-support/sshd-regen-keys/sshd-regen-keys_0.1.bb b/meta/recipes-support/sshd-regen-keys/sshd-regen-keys_0.1.bb
new file mode 100644
index 0000000..06e0cc4
--- /dev/null
+++ b/meta/recipes-support/sshd-regen-keys/sshd-regen-keys_0.1.bb
@@ -0,0 +1,15 @@
+# This software is a part of ISAR.
+
+DESCRIPTION = "Systemd service to regenerate sshd keys"
+MAINTAINER = "isar-users <isar-users@googlegroups.com>"
+DEBIAN_DEPENDS = "openssh-server, systemd"
+
+SRC_URI = "file://postinst \
+           file://sshd-regen-keys.service"
+
+inherit dpkg-raw
+
+do_install() {
+    sudo install -v -d -m 755 "${D}/lib/systemd/system"
+    sudo install -v -m 644 "${WORKDIR}/sshd-regen-keys.service" "${D}/lib/systemd/system/sshd-regen-keys.service"
+}
-- 
Harald Seiler <hws@denx.de>