[ptxdist] [PATCH 1/1] openssh/rc-once: build all supported hostkeys, simplify

[Christian Hermann <christian.hermann@hytera.de>]

1. Ensure all supported hostkeys are generated, even if not configured
explicitly.
Parsing /etc/sshd_config is insufficient for determining which types of
hostkeys are actually supported by the running instance of sshd.
Ask `sshd -T` instead, as openssh uses sensible defaults if no custom
'HostKey' lines are present in /etc/ssh/sshd_config.

2. Simplify key generation logic

Signed-off-by: Christian Hermann <christian.hermann@hytera.de>
---
 projectroot/etc/rc.once.d/openssh | 57 ++++++++++++++-----------------
 1 file changed, 25 insertions(+), 32 deletions(-)

diff --git a/projectroot/etc/rc.once.d/openssh b/projectroot/etc/rc.once.d/openssh
index 66cfa06df..bc3634958 100644
--- a/projectroot/etc/rc.once.d/openssh
+++ b/projectroot/etc/rc.once.d/openssh
@@ -3,47 +3,40 @@
 PATH=/sbin:/bin:/usr/sbin:/usr/bin
 
 get_hostkeys() {
-	[ -f /etc/ssh/sshd_config ] || return
-	sed -n 's/^HostKey[ \t][ \t]*\(.*\)/\1/p' /etc/ssh/sshd_config
-}
-
-host_keys_required() {
-	hostkeys="$(get_hostkeys)"
-	if [ "$hostkeys" ]; then
-		echo "$hostkeys"
-	else
-		# No HostKey directives found, so we pick secure defaults
-		echo /etc/ssh/ssh_host_ed25519_key
-	fi
+	sshd -T | sed -E -n -e 's/^hostkey[[:space:]]+(.*)/\1/p'
 }
 
 create_key() {
-	keytype="$1"
-	prettykeytype="$(echo $_type | tr a-z A-Z)"
-	shift
-	hostkeys="$1"
-	shift
-
-	file="/etc/ssh/ssh_host_${keytype}_key"
-
-	if echo "$hostkeys" | grep -x -F "$file" >/dev/null; then
-		echo "Create $prettykeytype key; this may take some time ..."
-		rm -f $file &&
-		ssh-keygen -q -f "$file" -N '' -t "$keytype" "$@" || return
-		echo "Created $prettykeytype key."
-	fi
+	keyfile="$1"
+	keytype="$(echo "$keyfile" | sed -E -e 's/.*ssh_host_(.*)_key$/\1/')"
+	prettykeytype="$(echo "$keytype" | tr '[:lower:]' '[:upper:]')"
+
+	keygen_args=
+	case "$keytype" in
+		rsa) keygen_args="-b 4096" ;;
+	esac
+
+	echo "Creating $prettykeytype key"
+	rm -f "$keyfile"
+	ssh-keygen -q -f "$keyfile" -N "" -t "$keytype" $keygen_args
 }
 
 create_keys() {
-	hostkeys="$(host_keys_required)"
+	hostkeys="$(get_hostkeys)"
+
+	# no hostkeys reported by sshd.  Try to provide a fallback
+	#FIXME: if `sshd -T` fails, we very likely have bigger problems. shout to stderr and exit instead?
+	if [ -z "$hostkeys" ]; then
+		fallback="/etc/ssh/ssh_host_ed25519_key"
+		echo "HostKey $fallback" >>/etc/ssh/sshd_config
+	fi
 
-	create_key "dsa" "$hostkeys" &&
-	create_key "ecdsa" "$hostkeys" &&
-	create_key "ed25519" "$hostkeys" &&
-	create_key "rsa" "$hostkeys" -b 4096
+	for keyfile in $hostkeys; do
+		create_key "$keyfile"
+	done
 }
 
 if ! create_keys; then
-	echo "Generating SSH keys failed!"
+	echo "Generating SSH keys failed!" >&2
 	exit 1
 fi
-- 
2.28.0


_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de