[OE-core] [PATCH v2] openssh: Fix key generation with systemd
Joshua Watt
jpewhacker at gmail.com
Wed Sep 6 13:21:39 UTC 2017
On Tue, 2017-08-01 at 12:07 +0100, Burton, Ross wrote:
> Sorry didn't notice the v2. In staging now.
I noticed this hasn't been merged yet, is there something holding it
up?
>
> Ross
>
> On 25 July 2017 at 03:23, Joshua Watt <jpewhacker at gmail.com> wrote:
> > On Mon, 2017-07-03 at 20:18 -0500, Joshua Watt wrote:
> > > 106b59d9 broke SSH host key generation when systemd and a read-
> > only
> > > root file
> > > system are in use because there isn't a way for systemd to get
> > the
> > > optional
> > > weak assigment of SYSCONFDIR from /etc/default/sshd and still
> > provide
> > > a default
> > > value if it is not specified. Instead, move the logic for
> > determining
> > > if keys
> > > need to be created to a helper script that both the SysV init
> > script
> > > and the
> > > systemd unit file can reference.
> > >
> > > This does mean that the systemd unit file can't check for file
> > > existence to
> > > know if it should start the service, but it wasn't able to do
> > that
> > > correctly
> > > anyway anymore. This should be a problem since the serivce is
> > only
> > > run once per
> > > power cycle by systemd, and should exit quickly if the keys
> > already
> > > exist
> > >
> > > Signed-off-by: Joshua Watt <JPEWhacker at gmail.com>
> > > ---
> > > meta/recipes-connectivity/openssh/openssh/init | 69 +-------
> > ----
> > > ----------
> > > .../openssh/openssh/sshd_check_keys | 64
> > > ++++++++++++++++++++
> > > .../openssh/openssh/sshdgenkeys.service | 16 +----
> > > meta/recipes-connectivity/openssh/openssh_7.5p1.bb | 8 +++
> > > 4 files changed, 76 insertions(+), 81 deletions(-)
> > > create mode 100644 meta/recipes-
> > > connectivity/openssh/openssh/sshd_check_keys
> > >
> > > diff --git a/meta/recipes-connectivity/openssh/openssh/init
> > > b/meta/recipes-connectivity/openssh/openssh/init
> > > index 386628a..34ba0f8 100644
> > > --- a/meta/recipes-connectivity/openssh/openssh/init
> > > +++ b/meta/recipes-connectivity/openssh/openssh/init
> > > @@ -19,25 +19,6 @@ fi
> > > [ -z "$SYSCONFDIR" ] && SYSCONFDIR=/etc/ssh
> > > mkdir -p $SYSCONFDIR
> > >
> > > -parse_sshd_opts() {
> > > - set -- ${SSHD_OPTS} --
> > > - sshd_config=/etc/ssh/sshd_config
> > > - while true ; do
> > > - case "$1" in
> > > - -f*) if [ "$1" = "-f" ] ; then
> > > - sshd_config="$2"
> > > - shift
> > > - else
> > > - sshd_config="${1#-f}"
> > > - fi
> > > - shift
> > > - ;;
> > > - --) shift; break;;
> > > - *) shift;;
> > > - esac
> > > - done
> > > -}
> > > -
> > > check_for_no_start() {
> > > # forget it if we're trying to start, and
> > > /etc/ssh/sshd_not_to_be_run exists
> > > if [ -e $SYSCONFDIR/sshd_not_to_be_run ]; then
> > > @@ -58,57 +39,13 @@ check_config() {
> > > /usr/sbin/sshd -t $SSHD_OPTS || exit 1
> > > }
> > >
> > > -check_keys() {
> > > - # parse location of keys
> > > - local HOST_KEY_RSA
> > > - local HOST_KEY_DSA
> > > - local HOST_KEY_ECDSA
> > > - local HOST_KEY_ED25519
> > > -
> > > - parse_sshd_opts
> > > - HOST_KEY_RSA=$(grep ^HostKey "${sshd_config}" | grep _rsa_
> > |
> > > tail -1 | awk ' { print $2 } ')
> > > - [ -z "${HOST_KEY_RSA}" ] && HOST_KEY_RSA=$(grep HostKey
> > > "${sshd_config}" | grep _rsa_ | tail -1 | awk ' { print $2 } ')
> > > - [ -z "${HOST_KEY_RSA}" ] &&
> > > HOST_KEY_RSA=$SYSCONFDIR/ssh_host_rsa_key
> > > - HOST_KEY_DSA=$(grep ^HostKey "${sshd_config}" | grep _dsa_
> > |
> > > tail -1 | awk ' { print $2 } ')
> > > - [ -z "${HOST_KEY_DSA}" ] && HOST_KEY_DSA=$(grep HostKey
> > > "${sshd_config}" | grep _dsa_ | tail -1 | awk ' { print $2 } ')
> > > - [ -z "${HOST_KEY_DSA}" ] &&
> > > HOST_KEY_DSA=$SYSCONFDIR/ssh_host_dsa_key
> > > - HOST_KEY_ECDSA=$(grep ^HostKey "${sshd_config}" | grep
> > > _ecdsa_ | tail -1 | awk ' { print $2 } ')
> > > - [ -z "${HOST_KEY_ECDSA}" ] && HOST_KEY_ECDSA=$(grep HostKey
> > > "${sshd_config}" | grep _ecdsa_ | tail -1 | awk ' { print $2 } ')
> > > - [ -z "${HOST_KEY_ECDSA}" ] &&
> > > HOST_KEY_ECDSA=$SYSCONFDIR/ssh_host_ecdsa_key
> > > - HOST_KEY_ED25519=$(grep ^HostKey "${sshd_config}" | grep
> > > _ed25519_ | tail -1 | awk ' { print $2 } ')
> > > - [ -z "${HOST_KEY_ED25519}" ] && HOST_KEY_ED25519=$(grep
> > > HostKey "${sshd_config}" | grep _ed25519_ | tail -1 | awk ' {
> > print
> > > $2 } ')
> > > - [ -z "${HOST_KEY_ED25519}" ] &&
> > > HOST_KEY_ED25519=$SYSCONFDIR/ssh_host_ed25519_key
> > > -
> > > - # create keys if necessary
> > > - if [ ! -f $HOST_KEY_RSA ]; then
> > > - echo " generating ssh RSA key..."
> > > - mkdir -p $(dirname $HOST_KEY_RSA)
> > > - ssh-keygen -q -f $HOST_KEY_RSA -N '' -t rsa
> > > - fi
> > > - if [ ! -f $HOST_KEY_ECDSA ]; then
> > > - echo " generating ssh ECDSA key..."
> > > - mkdir -p $(dirname $HOST_KEY_ECDSA)
> > > - ssh-keygen -q -f $HOST_KEY_ECDSA -N '' -t ecdsa
> > > - fi
> > > - if [ ! -f $HOST_KEY_DSA ]; then
> > > - echo " generating ssh DSA key..."
> > > - mkdir -p $(dirname $HOST_KEY_DSA)
> > > - ssh-keygen -q -f $HOST_KEY_DSA -N '' -t dsa
> > > - fi
> > > - if [ ! -f $HOST_KEY_ED25519 ]; then
> > > - echo " generating ssh ED25519 key..."
> > > - mkdir -p $(dirname $HOST_KEY_ED25519)
> > > - ssh-keygen -q -f $HOST_KEY_ED25519 -N '' -t ed25519
> > > - fi
> > > -}
> > > -
> > > export PATH="${PATH:+$PATH:}/usr/sbin:/sbin"
> > >
> > > case "$1" in
> > > start)
> > > check_for_no_start
> > > echo "Starting OpenBSD Secure Shell server: sshd"
> > > - check_keys
> > > + @LIBEXECDIR@/sshd_check_keys
> > > check_privsep_dir
> > > start-stop-daemon -S -p $PIDFILE -x /usr/sbin/sshd --
> > > $SSHD_OPTS
> > > echo "done."
> > > @@ -121,7 +58,7 @@ case "$1" in
> > >
> > > reload|force-reload)
> > > check_for_no_start
> > > - check_keys
> > > + @LIBEXECDIR@/sshd_check_keys
> > > check_config
> > > echo -n "Reloading OpenBSD Secure Shell server's
> > > configuration"
> > > start-stop-daemon -K -p $PIDFILE -s 1 -x /usr/sbin/sshd
> > > @@ -129,7 +66,7 @@ case "$1" in
> > > ;;
> > >
> > > restart)
> > > - check_keys
> > > + @LIBEXECDIR@/sshd_check_keys
> > > check_config
> > > echo -n "Restarting OpenBSD Secure Shell server: sshd"
> > > start-stop-daemon -K -p $PIDFILE --oknodo -x /usr/sbin/sshd
> > > diff --git a/meta/recipes-
> > > connectivity/openssh/openssh/sshd_check_keys b/meta/recipes-
> > > connectivity/openssh/openssh/sshd_check_keys
> > > new file mode 100644
> > > index 0000000..f5bba53
> > > --- /dev/null
> > > +++ b/meta/recipes-connectivity/openssh/openssh/sshd_check_keys
> > > @@ -0,0 +1,64 @@
> > > +#! /bin/sh
> > > +
> > > +# /etc/default/ssh may set SYSCONFDIR and SSHD_OPTS
> > > +if test -f /etc/default/ssh; then
> > > + . /etc/default/ssh
> > > +fi
> > > +
> > > +[ -z "$SYSCONFDIR" ] && SYSCONFDIR=/etc/ssh
> > > +mkdir -p $SYSCONFDIR
> > > +
> > > +# parse sshd options
> > > +set -- ${SSHD_OPTS} --
> > > +sshd_config=/etc/ssh/sshd_config
> > > +while true ; do
> > > + case "$1" in
> > > + -f*) if [ "$1" = "-f" ] ; then
> > > + sshd_config="$2"
> > > + shift
> > > + else
> > > + sshd_config="${1#-f}"
> > > + fi
> > > + shift
> > > + ;;
> > > + --) shift; break;;
> > > + *) shift;;
> > > + esac
> > > +done
> > > +
> > > +# parse location of keys
> > > +HOST_KEY_RSA=$(grep ^HostKey "${sshd_config}" | grep _rsa_ |
> > tail -1
> > > | awk ' { print $2 } ')
> > > +[ -z "${HOST_KEY_RSA}" ] && HOST_KEY_RSA=$(grep HostKey
> > > "${sshd_config}" | grep _rsa_ | tail -1 | awk ' { print $2 } ')
> > > +[ -z "${HOST_KEY_RSA}" ] &&
> > > HOST_KEY_RSA=$SYSCONFDIR/ssh_host_rsa_key
> > > +HOST_KEY_DSA=$(grep ^HostKey "${sshd_config}" | grep _dsa_ |
> > tail -1
> > > | awk ' { print $2 } ')
> > > +[ -z "${HOST_KEY_DSA}" ] && HOST_KEY_DSA=$(grep HostKey
> > > "${sshd_config}" | grep _dsa_ | tail -1 | awk ' { print $2 } ')
> > > +[ -z "${HOST_KEY_DSA}" ] &&
> > > HOST_KEY_DSA=$SYSCONFDIR/ssh_host_dsa_key
> > > +HOST_KEY_ECDSA=$(grep ^HostKey "${sshd_config}" | grep _ecdsa_ |
> > > tail -1 | awk ' { print $2 } ')
> > > +[ -z "${HOST_KEY_ECDSA}" ] && HOST_KEY_ECDSA=$(grep HostKey
> > > "${sshd_config}" | grep _ecdsa_ | tail -1 | awk ' { print $2 } ')
> > > +[ -z "${HOST_KEY_ECDSA}" ] &&
> > > HOST_KEY_ECDSA=$SYSCONFDIR/ssh_host_ecdsa_key
> > > +HOST_KEY_ED25519=$(grep ^HostKey "${sshd_config}" | grep
> > _ed25519_ |
> > > tail -1 | awk ' { print $2 } ')
> > > +[ -z "${HOST_KEY_ED25519}" ] && HOST_KEY_ED25519=$(grep HostKey
> > > "${sshd_config}" | grep _ed25519_ | tail -1 | awk ' { print $2 }
> > ')
> > > +[ -z "${HOST_KEY_ED25519}" ] &&
> > > HOST_KEY_ED25519=$SYSCONFDIR/ssh_host_ed25519_key
> > > +
> > > +# create keys if necessary
> > > +if [ ! -f $HOST_KEY_RSA ]; then
> > > + echo " generating ssh RSA key..."
> > > + mkdir -p $(dirname $HOST_KEY_RSA)
> > > + ssh-keygen -q -f $HOST_KEY_RSA -N '' -t rsa
> > > +fi
> > > +if [ ! -f $HOST_KEY_ECDSA ]; then
> > > + echo " generating ssh ECDSA key..."
> > > + mkdir -p $(dirname $HOST_KEY_ECDSA)
> > > + ssh-keygen -q -f $HOST_KEY_ECDSA -N '' -t ecdsa
> > > +fi
> > > +if [ ! -f $HOST_KEY_DSA ]; then
> > > + echo " generating ssh DSA key..."
> > > + mkdir -p $(dirname $HOST_KEY_DSA)
> > > + ssh-keygen -q -f $HOST_KEY_DSA -N '' -t dsa
> > > +fi
> > > +if [ ! -f $HOST_KEY_ED25519 ]; then
> > > + echo " generating ssh ED25519 key..."
> > > + mkdir -p $(dirname $HOST_KEY_ED25519)
> > > + ssh-keygen -q -f $HOST_KEY_ED25519 -N '' -t ed25519
> > > +fi
> > > +
> > > diff --git a/meta/recipes-
> > > connectivity/openssh/openssh/sshdgenkeys.service b/meta/recipes-
> > > connectivity/openssh/openssh/sshdgenkeys.service
> > > index 148e6ad..603c337 100644
> > > --- a/meta/recipes-
> > connectivity/openssh/openssh/sshdgenkeys.service
> > > +++ b/meta/recipes-
> > connectivity/openssh/openssh/sshdgenkeys.service
> > > @@ -1,22 +1,8 @@
> > > [Unit]
> > > Description=OpenSSH Key Generation
> > > RequiresMountsFor=/var /run
> > > -ConditionPathExists=!/var/run/ssh/ssh_host_rsa_key
> > > -ConditionPathExists=!/var/run/ssh/ssh_host_dsa_key
> > > -ConditionPathExists=!/var/run/ssh/ssh_host_ecdsa_key
> > > -ConditionPathExists=!/var/run/ssh/ssh_host_ed25519_key
> > > -ConditionPathExists=!/etc/ssh/ssh_host_rsa_key
> > > -ConditionPathExists=!/etc/ssh/ssh_host_dsa_key
> > > -ConditionPathExists=!/etc/ssh/ssh_host_ecdsa_key
> > > -ConditionPathExists=!/etc/ssh/ssh_host_ed25519_key
> > >
> > > [Service]
> > > -Environment="SYSCONFDIR=/etc/ssh"
> > > -EnvironmentFile=-/etc/default/ssh
> > > -ExecStart=@BASE_BINDIR@/mkdir -p $SYSCONFDIR
> > > -ExecStart=@BINDIR@/ssh-keygen -q -f
> > ${SYSCONFDIR}/ssh_host_rsa_key
> > > -N '' -t rsa
> > > -ExecStart=@BINDIR@/ssh-keygen -q -f
> > ${SYSCONFDIR}/ssh_host_dsa_key
> > > -N '' -t dsa
> > > -ExecStart=@BINDIR@/ssh-keygen -q -f
> > ${SYSCONFDIR}/ssh_host_ecdsa_key
> > > -N '' -t ecdsa
> > > -ExecStart=@BINDIR@/ssh-keygen -q -f
> > > ${SYSCONFDIR}/ssh_host_ed25519_key -N '' -t ed25519
> > > +ExecStart=@LIBEXECDIR@/sshd_check_keys
> > > Type=oneshot
> > > RemainAfterExit=yes
> > > diff --git a/meta/recipes-connectivity/openssh/openssh_7.5p1.bb
> > > b/meta/recipes-connectivity/openssh/openssh_7.5p1.bb
> > > index 7bd313b..fdbee85 100644
> > > --- a/meta/recipes-connectivity/openssh/openssh_7.5p1.bb
> > > +++ b/meta/recipes-connectivity/openssh/openssh_7.5p1.bb
> > > @@ -25,6 +25,7 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/O
> > penS
> > > SH/portable/openssh-${PV}.tar
> > > file://openssh-7.1p1-conditional-compile-des-in-
> > > cipher.patch \
> > > file://openssh-7.1p1-conditional-compile-des-in-
> > > pkcs11.patch \
> > > file://fix-potential-signed-overflow-in-pointer-
> > > arithmatic.patch \
> > > + file://sshd_check_keys \
> > > "
> > >
> > > PAM_SRC_URI = "file://sshd"
> > > @@ -118,7 +119,13 @@ do_install_append () {
> > > sed -i -e 's, at BASE_BINDIR@,${base_bindir},g' \
> > > -e 's, at SBINDIR@,${sbindir},g' \
> > > -e 's, at BINDIR@,${bindir},g' \
> > > + -e 's, at LIBEXECDIR@,${libexecdir}/${BPN},g' \
> > > ${D}${systemd_unitdir}/system/sshd.socket
> > > ${D}${systemd_unitdir}/system/*.service
> > > +
> > > + sed -i -e 's, at LIBEXECDIR@,${libexecdir}/${BPN},g' \
> > > + ${D}${sysconfdir}/init.d/sshd
> > > +
> > > + install -D -m 0755 ${WORKDIR}/sshd_check_keys
> > > ${D}${libexecdir}/${BPN}/sshd_check_keys
> > > }
> > >
> > > do_install_ptest () {
> > > @@ -133,6 +140,7 @@ FILES_${PN}-scp = "${bindir}/scp.${BPN}"
> > > FILES_${PN}-ssh = "${bindir}/ssh.${BPN}
> > > ${sysconfdir}/ssh/ssh_config"
> > > FILES_${PN}-sshd = "${sbindir}/sshd ${sysconfdir}/init.d/sshd
> > > ${systemd_unitdir}/system"
> > > FILES_${PN}-sshd += "${sysconfdir}/ssh/moduli
> > > ${sysconfdir}/ssh/sshd_config
> > ${sysconfdir}/ssh/sshd_config_readonly
> > > ${sysconfdir}/default/volatiles/99_sshd ${sysconfdir}/pam.d/sshd"
> > > +FILES_${PN}-sshd += "${libexecdir}/${BPN}/sshd_check_keys"
> > > FILES_${PN}-sftp = "${bindir}/sftp"
> > > FILES_${PN}-sftp-server = "${libexecdir}/sftp-server"
> > > FILES_${PN}-misc = "${bindir}/ssh* ${libexecdir}/ssh*"
> >
> > Ping?
> > --
> > _______________________________________________
> > Openembedded-core mailing list
> > Openembedded-core at lists.openembedded.org
> > http://lists.openembedded.org/mailman/listinfo/openembedded-core
>
>
More information about the Openembedded-core
mailing list