Re: [ptxdist] [APPLIED] openssh: rc-once: Do not overwrite existing keys

[Michael Olbrich <m.olbrich@pengutronix.de>]

Thanks, applied as ac33521e077e313ad9c67a4ca2c8bf44de34cbc2.

Michael

[sent from post-receive hook]

On Fri, 26 Nov 2021 15:35:06 +0100, Alexander Dahl <ada@thorsis.com> wrote:
> When storing your keys not in rootfs but on a separate data partition
> (using symbolic links or overlay fs), keys are overwritten on each
> firmware upgrade which lets rc-once run again (which happens when using
> opkg upgrade/update or RAUC in an A/B scheme for example).
> 
> Changing keys are at best annoying, but may be interpreted as an attack
> as well.
> 
> Note: if an empty or invalid key is found, the key is still regenerated.
> 
> Signed-off-by: Alexander Dahl <ada@thorsis.com>
> Message-Id: <20211105154734.19983-9-ada@thorsis.com>
> Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
> 
> diff --git a/projectroot/etc/rc.once.d/openssh b/projectroot/etc/rc.once.d/openssh
> index 545586f07629..717d6457eeb3 100644
> --- a/projectroot/etc/rc.once.d/openssh
> +++ b/projectroot/etc/rc.once.d/openssh
> @@ -27,6 +27,7 @@ create_keys() {
>  	hostkeys="$(get_hostkeys)" || return
>  
>  	for keyfile in $hostkeys; do
> +		[ -s "$keyfile" ] && ssh-keygen -l -f "${keyfile}.pub" > /dev/null && continue
>  		create_key "$keyfile" || return
>  	done
>  }

_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de