<div dir="ltr">Sorry didn't notice the v2. In staging now.<div><br></div><div>Ross</div></div><div class="gmail_extra"><br><div class="gmail_quote">On 25 July 2017 at 03:23, Joshua Watt <span dir="ltr"><<a href="mailto:jpewhacker@gmail.com" target="_blank">jpewhacker@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5">On Mon, 2017-07-03 at 20:18 -0500, Joshua Watt wrote:<br>
> 106b59d9 broke SSH host key generation when systemd and a read-only<br>
> root file<br>
> system are in use because there isn't a way for systemd to get the<br>
> optional<br>
> weak assigment of SYSCONFDIR from /etc/default/sshd and still provide<br>
> a default<br>
> value if it is not specified. Instead, move the logic for determining<br>
> if keys<br>
> need to be created to a helper script that both the SysV init script<br>
> and the<br>
> systemd unit file can reference.<br>
><br>
> This does mean that the systemd unit file can't check for file<br>
> existence to<br>
> know if it should start the service, but it wasn't able to do that<br>
> correctly<br>
> anyway anymore. This should be a problem since the serivce is only<br>
> run once per<br>
> power cycle by systemd, and should exit quickly if the keys already<br>
> exist<br>
><br>
> Signed-off-by: Joshua Watt <<a href="mailto:JPEWhacker@gmail.com">JPEWhacker@gmail.com</a>><br>
> ---<br>
> meta/recipes-connectivity/<wbr>openssh/openssh/init | 69 +-----------<br>
> ----------<br>
> .../openssh/openssh/sshd_<wbr>check_keys | 64<br>
> ++++++++++++++++++++<br>
> .../openssh/openssh/<wbr>sshdgenkeys.service | 16 +----<br>
> meta/recipes-connectivity/<wbr>openssh/<a href="http://openssh_7.5p1.bb" rel="noreferrer" target="_blank">openssh_7.5p1.bb</a> | 8 +++<br>
> 4 files changed, 76 insertions(+), 81 deletions(-)<br>
> create mode 100644 meta/recipes-<br>
> connectivity/openssh/openssh/<wbr>sshd_check_keys<br>
><br>
> diff --git a/meta/recipes-connectivity/<wbr>openssh/openssh/init<br>
> b/meta/recipes-connectivity/<wbr>openssh/openssh/init<br>
> index 386628a..34ba0f8 100644<br>
> --- a/meta/recipes-connectivity/<wbr>openssh/openssh/init<br>
> +++ b/meta/recipes-connectivity/<wbr>openssh/openssh/init<br>
> @@ -19,25 +19,6 @@ fi<br>
> [ -z "$SYSCONFDIR" ] && SYSCONFDIR=/etc/ssh<br>
> mkdir -p $SYSCONFDIR<br>
><br>
> -parse_sshd_opts() {<br>
> - set -- ${SSHD_OPTS} --<br>
> - sshd_config=/etc/ssh/sshd_<wbr>config<br>
> - while true ; do<br>
> - case "$1" in<br>
> - -f*) if [ "$1" = "-f" ] ; then<br>
> - sshd_config="$2"<br>
> - shift<br>
> - else<br>
> - sshd_config="${1#-f}"<br>
> - fi<br>
> - shift<br>
> - ;;<br>
> - --) shift; break;;<br>
> - *) shift;;<br>
> - esac<br>
> - done<br>
> -}<br>
> -<br>
> check_for_no_start() {<br>
> # forget it if we're trying to start, and<br>
> /etc/ssh/sshd_not_to_be_run exists<br>
> if [ -e $SYSCONFDIR/sshd_not_to_be_run ]; then<br>
> @@ -58,57 +39,13 @@ check_config() {<br>
> /usr/sbin/sshd -t $SSHD_OPTS || exit 1<br>
> }<br>
><br>
> -check_keys() {<br>
> - # parse location of keys<br>
> - local HOST_KEY_RSA<br>
> - local HOST_KEY_DSA<br>
> - local HOST_KEY_ECDSA<br>
> - local HOST_KEY_ED25519<br>
> -<br>
> - parse_sshd_opts<br>
> - HOST_KEY_RSA=$(grep ^HostKey "${sshd_config}" | grep _rsa_ |<br>
> tail -1 | awk ' { print $2 } ')<br>
> - [ -z "${HOST_KEY_RSA}" ] && HOST_KEY_RSA=$(grep HostKey<br>
> "${sshd_config}" | grep _rsa_ | tail -1 | awk ' { print $2 } ')<br>
> - [ -z "${HOST_KEY_RSA}" ] &&<br>
> HOST_KEY_RSA=$SYSCONFDIR/ssh_<wbr>host_rsa_key<br>
> - HOST_KEY_DSA=$(grep ^HostKey "${sshd_config}" | grep _dsa_ |<br>
> tail -1 | awk ' { print $2 } ')<br>
> - [ -z "${HOST_KEY_DSA}" ] && HOST_KEY_DSA=$(grep HostKey<br>
> "${sshd_config}" | grep _dsa_ | tail -1 | awk ' { print $2 } ')<br>
> - [ -z "${HOST_KEY_DSA}" ] &&<br>
> HOST_KEY_DSA=$SYSCONFDIR/ssh_<wbr>host_dsa_key<br>
> - HOST_KEY_ECDSA=$(grep ^HostKey "${sshd_config}" | grep<br>
> _ecdsa_ | tail -1 | awk ' { print $2 } ')<br>
> - [ -z "${HOST_KEY_ECDSA}" ] && HOST_KEY_ECDSA=$(grep HostKey<br>
> "${sshd_config}" | grep _ecdsa_ | tail -1 | awk ' { print $2 } ')<br>
> - [ -z "${HOST_KEY_ECDSA}" ] &&<br>
> HOST_KEY_ECDSA=$SYSCONFDIR/<wbr>ssh_host_ecdsa_key<br>
> - HOST_KEY_ED25519=$(grep ^HostKey "${sshd_config}" | grep<br>
> _ed25519_ | tail -1 | awk ' { print $2 } ')<br>
> - [ -z "${HOST_KEY_ED25519}" ] && HOST_KEY_ED25519=$(grep<br>
> HostKey "${sshd_config}" | grep _ed25519_ | tail -1 | awk ' { print<br>
> $2 } ')<br>
> - [ -z "${HOST_KEY_ED25519}" ] &&<br>
> HOST_KEY_ED25519=$SYSCONFDIR/<wbr>ssh_host_ed25519_key<br>
> -<br>
> - # create keys if necessary<br>
> - if [ ! -f $HOST_KEY_RSA ]; then<br>
> - echo " generating ssh RSA key..."<br>
> - mkdir -p $(dirname $HOST_KEY_RSA)<br>
> - ssh-keygen -q -f $HOST_KEY_RSA -N '' -t rsa<br>
> - fi<br>
> - if [ ! -f $HOST_KEY_ECDSA ]; then<br>
> - echo " generating ssh ECDSA key..."<br>
> - mkdir -p $(dirname $HOST_KEY_ECDSA)<br>
> - ssh-keygen -q -f $HOST_KEY_ECDSA -N '' -t ecdsa<br>
> - fi<br>
> - if [ ! -f $HOST_KEY_DSA ]; then<br>
> - echo " generating ssh DSA key..."<br>
> - mkdir -p $(dirname $HOST_KEY_DSA)<br>
> - ssh-keygen -q -f $HOST_KEY_DSA -N '' -t dsa<br>
> - fi<br>
> - if [ ! -f $HOST_KEY_ED25519 ]; then<br>
> - echo " generating ssh ED25519 key..."<br>
> - mkdir -p $(dirname $HOST_KEY_ED25519)<br>
> - ssh-keygen -q -f $HOST_KEY_ED25519 -N '' -t ed25519<br>
> - fi<br>
> -}<br>
> -<br>
> export PATH="${PATH:+$PATH:}/usr/<wbr>sbin:/sbin"<br>
><br>
> case "$1" in<br>
> start)<br>
> check_for_no_start<br>
> echo "Starting OpenBSD Secure Shell server: sshd"<br>
> - check_keys<br>
> + @LIBEXECDIR@/sshd_check_keys<br>
> check_privsep_dir<br>
> start-stop-daemon -S -p $PIDFILE -x /usr/sbin/sshd --<br>
> $SSHD_OPTS<br>
> echo "done."<br>
> @@ -121,7 +58,7 @@ case "$1" in<br>
><br>
> reload|force-reload)<br>
> check_for_no_start<br>
> - check_keys<br>
> + @LIBEXECDIR@/sshd_check_keys<br>
> check_config<br>
> echo -n "Reloading OpenBSD Secure Shell server's<br>
> configuration"<br>
> start-stop-daemon -K -p $PIDFILE -s 1 -x /usr/sbin/sshd<br>
> @@ -129,7 +66,7 @@ case "$1" in<br>
> ;;<br>
><br>
> restart)<br>
> - check_keys<br>
> + @LIBEXECDIR@/sshd_check_keys<br>
> check_config<br>
> echo -n "Restarting OpenBSD Secure Shell server: sshd"<br>
> start-stop-daemon -K -p $PIDFILE --oknodo -x /usr/sbin/sshd<br>
> diff --git a/meta/recipes-<br>
> connectivity/openssh/openssh/<wbr>sshd_check_keys b/meta/recipes-<br>
> connectivity/openssh/openssh/<wbr>sshd_check_keys<br>
> new file mode 100644<br>
> index 0000000..f5bba53<br>
> --- /dev/null<br>
> +++ b/meta/recipes-connectivity/<wbr>openssh/openssh/sshd_check_<wbr>keys<br>
> @@ -0,0 +1,64 @@<br>
> +#! /bin/sh<br>
> +<br>
> +# /etc/default/ssh may set SYSCONFDIR and SSHD_OPTS<br>
> +if test -f /etc/default/ssh; then<br>
> + . /etc/default/ssh<br>
> +fi<br>
> +<br>
> +[ -z "$SYSCONFDIR" ] && SYSCONFDIR=/etc/ssh<br>
> +mkdir -p $SYSCONFDIR<br>
> +<br>
> +# parse sshd options<br>
> +set -- ${SSHD_OPTS} --<br>
> +sshd_config=/etc/ssh/sshd_<wbr>config<br>
> +while true ; do<br>
> + case "$1" in<br>
> + -f*) if [ "$1" = "-f" ] ; then<br>
> + sshd_config="$2"<br>
> + shift<br>
> + else<br>
> + sshd_config="${1#-f}"<br>
> + fi<br>
> + shift<br>
> + ;;<br>
> + --) shift; break;;<br>
> + *) shift;;<br>
> + esac<br>
> +done<br>
> +<br>
> +# parse location of keys<br>
> +HOST_KEY_RSA=$(grep ^HostKey "${sshd_config}" | grep _rsa_ | tail -1<br>
> | awk ' { print $2 } ')<br>
> +[ -z "${HOST_KEY_RSA}" ] && HOST_KEY_RSA=$(grep HostKey<br>
> "${sshd_config}" | grep _rsa_ | tail -1 | awk ' { print $2 } ')<br>
> +[ -z "${HOST_KEY_RSA}" ] &&<br>
> HOST_KEY_RSA=$SYSCONFDIR/ssh_<wbr>host_rsa_key<br>
> +HOST_KEY_DSA=$(grep ^HostKey "${sshd_config}" | grep _dsa_ | tail -1<br>
> | awk ' { print $2 } ')<br>
> +[ -z "${HOST_KEY_DSA}" ] && HOST_KEY_DSA=$(grep HostKey<br>
> "${sshd_config}" | grep _dsa_ | tail -1 | awk ' { print $2 } ')<br>
> +[ -z "${HOST_KEY_DSA}" ] &&<br>
> HOST_KEY_DSA=$SYSCONFDIR/ssh_<wbr>host_dsa_key<br>
> +HOST_KEY_ECDSA=$(grep ^HostKey "${sshd_config}" | grep _ecdsa_ |<br>
> tail -1 | awk ' { print $2 } ')<br>
> +[ -z "${HOST_KEY_ECDSA}" ] && HOST_KEY_ECDSA=$(grep HostKey<br>
> "${sshd_config}" | grep _ecdsa_ | tail -1 | awk ' { print $2 } ')<br>
> +[ -z "${HOST_KEY_ECDSA}" ] &&<br>
> HOST_KEY_ECDSA=$SYSCONFDIR/<wbr>ssh_host_ecdsa_key<br>
> +HOST_KEY_ED25519=$(grep ^HostKey "${sshd_config}" | grep _ed25519_ |<br>
> tail -1 | awk ' { print $2 } ')<br>
> +[ -z "${HOST_KEY_ED25519}" ] && HOST_KEY_ED25519=$(grep HostKey<br>
> "${sshd_config}" | grep _ed25519_ | tail -1 | awk ' { print $2 } ')<br>
> +[ -z "${HOST_KEY_ED25519}" ] &&<br>
> HOST_KEY_ED25519=$SYSCONFDIR/<wbr>ssh_host_ed25519_key<br>
> +<br>
> +# create keys if necessary<br>
> +if [ ! -f $HOST_KEY_RSA ]; then<br>
> + echo " generating ssh RSA key..."<br>
> + mkdir -p $(dirname $HOST_KEY_RSA)<br>
> + ssh-keygen -q -f $HOST_KEY_RSA -N '' -t rsa<br>
> +fi<br>
> +if [ ! -f $HOST_KEY_ECDSA ]; then<br>
> + echo " generating ssh ECDSA key..."<br>
> + mkdir -p $(dirname $HOST_KEY_ECDSA)<br>
> + ssh-keygen -q -f $HOST_KEY_ECDSA -N '' -t ecdsa<br>
> +fi<br>
> +if [ ! -f $HOST_KEY_DSA ]; then<br>
> + echo " generating ssh DSA key..."<br>
> + mkdir -p $(dirname $HOST_KEY_DSA)<br>
> + ssh-keygen -q -f $HOST_KEY_DSA -N '' -t dsa<br>
> +fi<br>
> +if [ ! -f $HOST_KEY_ED25519 ]; then<br>
> + echo " generating ssh ED25519 key..."<br>
> + mkdir -p $(dirname $HOST_KEY_ED25519)<br>
> + ssh-keygen -q -f $HOST_KEY_ED25519 -N '' -t ed25519<br>
> +fi<br>
> +<br>
> diff --git a/meta/recipes-<br>
> connectivity/openssh/openssh/<wbr>sshdgenkeys.service b/meta/recipes-<br>
> connectivity/openssh/openssh/<wbr>sshdgenkeys.service<br>
> index 148e6ad..603c337 100644<br>
> --- a/meta/recipes-connectivity/<wbr>openssh/openssh/sshdgenkeys.<wbr>service<br>
> +++ b/meta/recipes-connectivity/<wbr>openssh/openssh/sshdgenkeys.<wbr>service<br>
> @@ -1,22 +1,8 @@<br>
> [Unit]<br>
> Description=OpenSSH Key Generation<br>
> RequiresMountsFor=/var /run<br>
> -ConditionPathExists=!/var/<wbr>run/ssh/ssh_host_rsa_key<br>
> -ConditionPathExists=!/var/<wbr>run/ssh/ssh_host_dsa_key<br>
> -ConditionPathExists=!/var/<wbr>run/ssh/ssh_host_ecdsa_key<br>
> -ConditionPathExists=!/var/<wbr>run/ssh/ssh_host_ed25519_key<br>
> -ConditionPathExists=!/etc/<wbr>ssh/ssh_host_rsa_key<br>
> -ConditionPathExists=!/etc/<wbr>ssh/ssh_host_dsa_key<br>
> -ConditionPathExists=!/etc/<wbr>ssh/ssh_host_ecdsa_key<br>
> -ConditionPathExists=!/etc/<wbr>ssh/ssh_host_ed25519_key<br>
><br>
> [Service]<br>
> -Environment="SYSCONFDIR=/etc/<wbr>ssh"<br>
> -EnvironmentFile=-/etc/<wbr>default/ssh<br>
> -ExecStart=@BASE_BINDIR@/mkdir -p $SYSCONFDIR<br>
> -ExecStart=@BINDIR@/ssh-keygen -q -f ${SYSCONFDIR}/ssh_host_rsa_key<br>
> -N '' -t rsa<br>
> -ExecStart=@BINDIR@/ssh-keygen -q -f ${SYSCONFDIR}/ssh_host_dsa_key<br>
> -N '' -t dsa<br>
> -ExecStart=@BINDIR@/ssh-keygen -q -f ${SYSCONFDIR}/ssh_host_ecdsa_<wbr>key<br>
> -N '' -t ecdsa<br>
> -ExecStart=@BINDIR@/ssh-keygen -q -f<br>
> ${SYSCONFDIR}/ssh_host_<wbr>ed25519_key -N '' -t ed25519<br>
> +ExecStart=@LIBEXECDIR@/sshd_<wbr>check_keys<br>
> Type=oneshot<br>
> RemainAfterExit=yes<br>
> diff --git a/meta/recipes-connectivity/<wbr>openssh/<a href="http://openssh_7.5p1.bb" rel="noreferrer" target="_blank">openssh_7.5p1.bb</a><br>
> b/meta/recipes-connectivity/<wbr>openssh/<a href="http://openssh_7.5p1.bb" rel="noreferrer" target="_blank">openssh_7.5p1.bb</a><br>
> index 7bd313b..fdbee85 100644<br>
> --- a/meta/recipes-connectivity/<wbr>openssh/<a href="http://openssh_7.5p1.bb" rel="noreferrer" target="_blank">openssh_7.5p1.bb</a><br>
> +++ b/meta/recipes-connectivity/<wbr>openssh/<a href="http://openssh_7.5p1.bb" rel="noreferrer" target="_blank">openssh_7.5p1.bb</a><br>
> @@ -25,6 +25,7 @@ SRC_URI = "<a href="http://ftp.openbsd.org/pub/OpenBSD/OpenS" rel="noreferrer" target="_blank">http://ftp.openbsd.org/pub/<wbr>OpenBSD/OpenS</a><br>
> SH/portable/openssh-${PV}.tar<br>
> file://openssh-7.1p1-<wbr>conditional-compile-des-in-<br>
> cipher.patch \<br>
> file://openssh-7.1p1-<wbr>conditional-compile-des-in-<br>
> pkcs11.patch \<br>
> file://fix-potential-signed-<wbr>overflow-in-pointer-<br>
> arithmatic.patch \<br>
> + file://sshd_check_keys \<br>
> "<br>
><br>
> PAM_SRC_URI = "file://sshd"<br>
> @@ -118,7 +119,13 @@ do_install_append () {<br>
> sed -i -e 's,@BASE_BINDIR@,${base_<wbr>bindir},g' \<br>
> -e 's,@SBINDIR@,${sbindir},g' \<br>
> -e 's,@BINDIR@,${bindir},g' \<br>
> + -e 's,@LIBEXECDIR@,${libexecdir}/<wbr>${BPN},g' \<br>
> ${D}${systemd_unitdir}/system/<wbr>sshd.socket<br>
> ${D}${systemd_unitdir}/system/<wbr>*.service<br>
> +<br>
> + sed -i -e 's,@LIBEXECDIR@,${libexecdir}/<wbr>${BPN},g' \<br>
> + ${D}${sysconfdir}/init.d/sshd<br>
> +<br>
> + install -D -m 0755 ${WORKDIR}/sshd_check_keys<br>
> ${D}${libexecdir}/${BPN}/sshd_<wbr>check_keys<br>
> }<br>
><br>
> do_install_ptest () {<br>
> @@ -133,6 +140,7 @@ FILES_${PN}-scp = "${bindir}/scp.${BPN}"<br>
> FILES_${PN}-ssh = "${bindir}/ssh.${BPN}<br>
> ${sysconfdir}/ssh/ssh_config"<br>
> FILES_${PN}-sshd = "${sbindir}/sshd ${sysconfdir}/init.d/sshd<br>
> ${systemd_unitdir}/system"<br>
> FILES_${PN}-sshd += "${sysconfdir}/ssh/moduli<br>
> ${sysconfdir}/ssh/sshd_config ${sysconfdir}/ssh/sshd_config_<wbr>readonly<br>
> ${sysconfdir}/default/<wbr>volatiles/99_sshd ${sysconfdir}/pam.d/sshd"<br>
> +FILES_${PN}-sshd += "${libexecdir}/${BPN}/sshd_<wbr>check_keys"<br>
> FILES_${PN}-sftp = "${bindir}/sftp"<br>
> FILES_${PN}-sftp-server = "${libexecdir}/sftp-server"<br>
> FILES_${PN}-misc = "${bindir}/ssh* ${libexecdir}/ssh*"<br>
<br>
</div></div>Ping?<br>
<div class="HOEnZb"><div class="h5">--<br>
______________________________<wbr>_________________<br>
Openembedded-core mailing list<br>
<a href="mailto:Openembedded-core@lists.openembedded.org">Openembedded-core@lists.<wbr>openembedded.org</a><br>
<a href="http://lists.openembedded.org/mailman/listinfo/openembedded-core" rel="noreferrer" target="_blank">http://lists.openembedded.org/<wbr>mailman/listinfo/openembedded-<wbr>core</a><br>
</div></div></blockquote></div><br></div>