From mboxrd@z Thu Jan 1 00:00:00 1970 Return-path: Received: from [2a0a:edc0:0:1101:1d::39] (helo=dude03.red.stw.pengutronix.de) by metis.ext.pengutronix.de with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1keavZ-0005Hw-5z for ptxdist@pengutronix.de; Mon, 16 Nov 2020 10:36:01 +0100 Received: from mol by dude03.red.stw.pengutronix.de with local (Exim 4.92) (envelope-from ) id 1keavY-00Are7-KE for ptxdist@pengutronix.de; Mon, 16 Nov 2020 10:36:00 +0100 Date: Mon, 16 Nov 2020 10:36:00 +0100 From: Michael Olbrich Message-ID: <20201116093600.GB16869@pengutronix.de> References: <20201113141955.3477005-1-artur@4wiebe.de> <20201113174648.GA292963@lenoch> <20201114203447.y34nu2vjtlekvzc2@pengutronix.de> <20201115100612.GA346376@lenoch> <20201115170856.jks4rspmj6cf66dv@pengutronix.de> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20201115170856.jks4rspmj6cf66dv@pengutronix.de> Subject: Re: [ptxdist] [PATCH] DRAFT: openssh: make host key generation optional List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ptxdist-bounces@pengutronix.de Sender: "ptxdist" To: ptxdist@pengutronix.de On Sun, Nov 15, 2020 at 06:08:56PM +0100, Roland Hieber wrote: > On Sun, Nov 15, 2020 at 11:06:12AM +0100, Ladislav Michl wrote: > > On Sat, Nov 14, 2020 at 09:34:47PM +0100, Roland Hieber wrote: > > > On Fri, Nov 13, 2020 at 06:46:48PM +0100, Ladislav Michl wrote: > > > > On Fri, Nov 13, 2020 at 03:19:55PM +0100, Artur Wiebe wrote: > > > > > How can openssh.postinst be disabled from within the rule files? > > > > > > > > The very same could be achieved with symlink in your BSP: > > > > projectroot/etc/rc.once.d/openssh -> /dev/null > > > > > > I don't understand why you want to disable this. The SSH server will not > > > start without host keys. Or do you want to install a static version of > > > the host keys generated at build time? > > > > Yes, keys are static, generated at build time. Root filesystem is > > read-only. > > > > > If so, there should be an option for this. But for now, in my opinion, > > > disabling OPENSSH_SSHD_GENKEYS will just lead to a broken SSH server. > > > > As this is easy to solve at BSP level I never thought it could > > be a thing :) > > OK, but at least I would mention it in the kconfig help text. The Ack. > openssh recipe could also just pick up /etc/ssh/ssh_host_*_key via > install_alternative if this option is disabled. No. Shared ssh server keys are a bad idea. That's not something I want to merge upstream. But there are other use-cases to not use rc-once, e.g. if the server keys are generated during provisioning. And not selecting rc-once in this case makes sense, so this is acceptable im general. Michael _______________________________________________ ptxdist mailing list ptxdist@pengutronix.de To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de