From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Fri, 15 Oct 2021 14:53:27 +0200 Received: from metis.ext.pengutronix.de ([2001:67c:670:201:290:27ff:fe1d:cc33]) by lore.white.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1mbMiF-0006AD-MW for lore@lore.pengutronix.de; Fri, 15 Oct 2021 14:53:27 +0200 Received: from localhost ([127.0.0.1] helo=metis.ext.pengutronix.de) by metis.ext.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1mbMiF-0001Cw-59; Fri, 15 Oct 2021 14:53:27 +0200 Received: from drehscheibe.grey.stw.pengutronix.de ([2a0a:edc0:0:c01:1d::a2]) by metis.ext.pengutronix.de with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1mbMhb-0001Bw-2r; Fri, 15 Oct 2021 14:52:47 +0200 Received: from [2a0a:edc0:0:1101:1d::39] (helo=dude03.red.stw.pengutronix.de) by drehscheibe.grey.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1mbMha-00010L-0v; Fri, 15 Oct 2021 14:52:46 +0200 Received: from mol by dude03.red.stw.pengutronix.de with local (Exim 4.92) (envelope-from ) id 1mbMhZ-009Ksm-W2; Fri, 15 Oct 2021 14:52:46 +0200 Date: Fri, 15 Oct 2021 14:52:45 +0200 From: Michael Olbrich To: Alexander Dahl Message-ID: <20211015125245.GD2239952@pengutronix.de> Mail-Followup-To: Alexander Dahl , ptxdist@pengutronix.de, Marc Kleine-Budde , Alexander Stein References: <20211011125401.30402-1-ada@thorsis.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20211011125401.30402-1-ada@thorsis.com> X-Sent-From: Pengutronix Hildesheim X-URL: http://www.pengutronix.de/ X-IRC: #ptxdist @freenode X-Accept-Language: de,en X-Accept-Content-Type: text/plain User-Agent: Mutt/1.10.1 (2018-07-13) Subject: Re: [ptxdist] [RFC PATCH] rc-once: openssh: Do not overwrite existing keys X-BeenThere: ptxdist@pengutronix.de X-Mailman-Version: 2.1.29 Precedence: list List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de Cc: Marc Kleine-Budde , ptxdist@pengutronix.de, Alexander Stein Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "ptxdist" X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: ptxdist-bounces@pengutronix.de X-SA-Exim-Scanned: No (on metis.ext.pengutronix.de); SAEximRunCond expanded to false On Mon, Oct 11, 2021 at 02:54:01PM +0200, Alexander Dahl wrote: > When storing your keys not in rootfs but on a separate data partition > (using symbolic links or overlay fs), keys are overwritten on each > firmware upgrade which lets rc-once run again (which happens when using > opkg upgrade/update or RAUC in an A/B scheme for example). > > Changing keys are at best annoying, but may be interpreted as an attack > as well. This has come up before (I'm not sure if it was on this list or some other channel). I'm not quite certain how to handle this. Someone may depend on the current behavior. I think it's rather unlikely so I'll probably ignore that but we should keep it in mind. I'm more concerned with broken keys caused by power failures or things like that while the keys are created. So maybe a better check than just file existence? > For dropbear the same behaviour was implemented with ac97e77eedf7 > ("[dropbear] rc.once: only generate keys if they aren't present yet"). Marc applied that patch. I'm probably a bit more pedantic about stuff like that :-). > Signed-off-by: Alexander Dahl > --- > projectroot/etc/rc.once.d/openssh | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/projectroot/etc/rc.once.d/openssh b/projectroot/etc/rc.once.d/openssh > index 545586f07..595e28477 100644 > --- a/projectroot/etc/rc.once.d/openssh > +++ b/projectroot/etc/rc.once.d/openssh > @@ -27,6 +27,7 @@ create_keys() { > hostkeys="$(get_hostkeys)" || return > > for keyfile in $hostkeys; do > + [ -e "$keyfile" ] && continue Maybe: [ -s "$keyfile" ] && ssh-keygen -l -f "$keyfile.pub" > /dev/null && continue A non-empty private key file and a probably valid public key should be sufficient to prevent issues with power failures, I think. Michael > create_key "$keyfile" || return > done > } > > base-commit: 51994d1b518323d2975491090a2452d34b1a39f9 > -- > 2.30.2 > > > _______________________________________________ > ptxdist mailing list > ptxdist@pengutronix.de > To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de > -- Pengutronix e.K. | | Steuerwalder Str. 21 | http://www.pengutronix.de/ | 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 | _______________________________________________ ptxdist mailing list ptxdist@pengutronix.de To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de