From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Fri, 05 Nov 2021 16:48:56 +0100 Received: from metis.ext.pengutronix.de ([2001:67c:670:201:290:27ff:fe1d:cc33]) by lore.white.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1mj1Sa-0001Iu-1D for lore@lore.pengutronix.de; Fri, 05 Nov 2021 16:48:56 +0100 Received: from localhost ([127.0.0.1] helo=metis.ext.pengutronix.de) by metis.ext.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1mj1SZ-0000AD-Nd; Fri, 05 Nov 2021 16:48:55 +0100 Received: from mail.thorsis.com ([92.198.35.195]) by metis.ext.pengutronix.de with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1mj1Rf-0007c5-ND; Fri, 05 Nov 2021 16:48:00 +0100 Received: from localhost (localhost [127.0.0.1]) by mail.thorsis.com (Postfix) with ESMTP id F33181C86; Fri, 5 Nov 2021 16:47:58 +0100 (CET) X-Virus-Scanned: Debian amavisd-new at mail.thorsis.com Received: from mail.thorsis.com ([127.0.0.1]) by localhost (mail.thorsis.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YNt4Ft9Sw1KF; Fri, 5 Nov 2021 16:47:58 +0100 (CET) Received: by mail.thorsis.com (Postfix, from userid 109) id 7A07F1A24; Fri, 5 Nov 2021 16:47:58 +0100 (CET) Received: from adahl by ada.ifak-system.com with local (Exim 4.92) (envelope-from ) id 1mj1RG-0005DZ-VI; Fri, 05 Nov 2021 16:47:34 +0100 From: Alexander Dahl To: ptxdist@pengutronix.de Date: Fri, 5 Nov 2021 16:47:34 +0100 Message-Id: <20211105154734.19983-9-ada@thorsis.com> In-Reply-To: <20211105154734.19983-1-ada@thorsis.com> References: <20211105154734.19983-1-ada@thorsis.com> X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on metis.ext.pengutronix.de X-Spam-Level: X-Spam-Status: No, score=-2.6 required=4.0 tests=AWL,BAYES_00,SPF_HELO_NONE, SPF_PASS autolearn=ham autolearn_force=no version=3.4.2 Subject: [ptxdist] [PATCH v3 8/8] openssh: rc-once: Do not overwrite existing keys X-BeenThere: ptxdist@pengutronix.de X-Mailman-Version: 2.1.29 Precedence: list List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de Cc: Denis Osterland-Heim , Michael Olbrich , Bruno Thomsen , Alexander Stein MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "ptxdist" X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: ptxdist-bounces@pengutronix.de X-SA-Exim-Scanned: No (on metis.ext.pengutronix.de); SAEximRunCond expanded to false When storing your keys not in rootfs but on a separate data partition (using symbolic links or overlay fs), keys are overwritten on each firmware upgrade which lets rc-once run again (which happens when using opkg upgrade/update or RAUC in an A/B scheme for example). Changing keys are at best annoying, but may be interpreted as an attack as well. Note: if an empty or invalid key is found, the key is still regenerated. Signed-off-by: Alexander Dahl --- Notes: v1 (RFC) --> v2 --------------- - Improve check and look at size and if it's a valid key (Michael Olbrich) - Reword commit message (swap prefix, adapt reasoning) projectroot/etc/rc.once.d/openssh | 1 + 1 file changed, 1 insertion(+) diff --git a/projectroot/etc/rc.once.d/openssh b/projectroot/etc/rc.once.d/openssh index 545586f07..717d6457e 100644 --- a/projectroot/etc/rc.once.d/openssh +++ b/projectroot/etc/rc.once.d/openssh @@ -27,6 +27,7 @@ create_keys() { hostkeys="$(get_hostkeys)" || return for keyfile in $hostkeys; do + [ -s "$keyfile" ] && ssh-keygen -l -f "${keyfile}.pub" > /dev/null && continue create_key "$keyfile" || return done } -- 2.30.2 _______________________________________________ ptxdist mailing list ptxdist@pengutronix.de To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de