Re: [ptxdist] [RFC PATCH] rc-once: openssh: Do not overwrite existing keys

[Michael Olbrich <m.olbrich@pengutronix.de>]

On Mon, Oct 11, 2021 at 02:54:01PM +0200, Alexander Dahl wrote:
> When storing your keys not in rootfs but on a separate data partition
> (using symbolic links or overlay fs), keys are overwritten on each
> firmware upgrade which lets rc-once run again (which happens when using
> opkg upgrade/update or RAUC in an A/B scheme for example).
> 
> Changing keys are at best annoying, but may be interpreted as an attack
> as well.

This has come up before (I'm not sure if it was on this list or some other
channel). I'm not quite certain how to handle this.

Someone may depend on the current behavior. I think it's rather unlikely so
I'll probably ignore that but we should keep it in mind.

I'm more concerned with broken keys caused by power failures or things like
that while the keys are created. So maybe a better check than just file
existence?

> For dropbear the same behaviour was implemented with ac97e77eedf7
> ("[dropbear] rc.once: only generate keys if they aren't present yet").

Marc applied that patch. I'm probably a bit more pedantic about stuff like
that :-).

> Signed-off-by: Alexander Dahl <ada@thorsis.com>
> ---
>  projectroot/etc/rc.once.d/openssh | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/projectroot/etc/rc.once.d/openssh b/projectroot/etc/rc.once.d/openssh
> index 545586f07..595e28477 100644
> --- a/projectroot/etc/rc.once.d/openssh
> +++ b/projectroot/etc/rc.once.d/openssh
> @@ -27,6 +27,7 @@ create_keys() {
>  	hostkeys="$(get_hostkeys)" || return
>  
>  	for keyfile in $hostkeys; do
> +		[ -e "$keyfile" ] && continue

Maybe:

		[ -s "$keyfile" ] && ssh-keygen -l -f "$keyfile.pub" > /dev/null && continue

A non-empty private key file and a probably valid public key should be
sufficient to prevent issues with power failures, I think.

Michael

>  		create_key "$keyfile" || return
>  	done
>  }
> 
> base-commit: 51994d1b518323d2975491090a2452d34b1a39f9
> -- 
> 2.30.2
> 
> 
> _______________________________________________
> ptxdist mailing list
> ptxdist@pengutronix.de
> To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de
> 

-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de