[ptxdist] [RFC PATCH] rc-once: openssh: Do not overwrite existing keys

[Alexander Dahl <ada@thorsis.com>]

When storing your keys not in rootfs but on a separate data partition
(using symbolic links or overlay fs), keys are overwritten on each
firmware upgrade which lets rc-once run again (which happens when using
opkg upgrade/update or RAUC in an A/B scheme for example).

Changing keys are at best annoying, but may be interpreted as an attack
as well.

For dropbear the same behaviour was implemented with ac97e77eedf7
("[dropbear] rc.once: only generate keys if they aren't present yet").

Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 projectroot/etc/rc.once.d/openssh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/projectroot/etc/rc.once.d/openssh b/projectroot/etc/rc.once.d/openssh
index 545586f07..595e28477 100644
--- a/projectroot/etc/rc.once.d/openssh
+++ b/projectroot/etc/rc.once.d/openssh
@@ -27,6 +27,7 @@ create_keys() {
 	hostkeys="$(get_hostkeys)" || return
 
 	for keyfile in $hostkeys; do
+		[ -e "$keyfile" ] && continue
 		create_key "$keyfile" || return
 	done
 }

base-commit: 51994d1b518323d2975491090a2452d34b1a39f9
-- 
2.30.2


_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de