From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Fri, 26 Nov 2021 15:35:41 +0100 Received: from metis.ext.pengutronix.de ([2001:67c:670:201:290:27ff:fe1d:cc33]) by lore.white.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1mqcKD-0004Bi-Kp for lore@lore.pengutronix.de; Fri, 26 Nov 2021 15:35:41 +0100 Received: from localhost ([127.0.0.1] helo=metis.ext.pengutronix.de) by metis.ext.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1mqcKD-0006ST-8z; Fri, 26 Nov 2021 15:35:41 +0100 Received: from drehscheibe.grey.stw.pengutronix.de ([2a0a:edc0:0:c01:1d::a2]) by metis.ext.pengutronix.de with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1mqcJh-0005Hq-1J; Fri, 26 Nov 2021 15:35:09 +0100 Received: from [2a0a:edc0:0:1101:1d::39] (helo=dude03.red.stw.pengutronix.de) by drehscheibe.grey.stw.pengutronix.de with esmtp (Exim 4.94.2) (envelope-from ) id 1mqcJg-001Bv1-IQ; Fri, 26 Nov 2021 15:35:07 +0100 Received: from mol by dude03.red.stw.pengutronix.de with local (Exim 4.94.2) (envelope-from ) id 1mqcJf-0054Eq-5f; Fri, 26 Nov 2021 15:35:07 +0100 From: Michael Olbrich To: ptxdist@pengutronix.de Date: Fri, 26 Nov 2021 15:35:07 +0100 Message-Id: <20211126143507.1207733-1-m.olbrich@pengutronix.de> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20211105154734.19983-9-ada@thorsis.com> References: <20211105154734.19983-9-ada@thorsis.com> MIME-Version: 1.0 Subject: Re: [ptxdist] [APPLIED] openssh: rc-once: Do not overwrite existing keys X-BeenThere: ptxdist@pengutronix.de X-Mailman-Version: 2.1.29 Precedence: list List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de Cc: Alexander Dahl Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "ptxdist" X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: ptxdist-bounces@pengutronix.de X-SA-Exim-Scanned: No (on metis.ext.pengutronix.de); SAEximRunCond expanded to false Thanks, applied as ac33521e077e313ad9c67a4ca2c8bf44de34cbc2. Michael [sent from post-receive hook] On Fri, 26 Nov 2021 15:35:06 +0100, Alexander Dahl wrote: > When storing your keys not in rootfs but on a separate data partition > (using symbolic links or overlay fs), keys are overwritten on each > firmware upgrade which lets rc-once run again (which happens when using > opkg upgrade/update or RAUC in an A/B scheme for example). > > Changing keys are at best annoying, but may be interpreted as an attack > as well. > > Note: if an empty or invalid key is found, the key is still regenerated. > > Signed-off-by: Alexander Dahl > Message-Id: <20211105154734.19983-9-ada@thorsis.com> > Signed-off-by: Michael Olbrich > > diff --git a/projectroot/etc/rc.once.d/openssh b/projectroot/etc/rc.once.d/openssh > index 545586f07629..717d6457eeb3 100644 > --- a/projectroot/etc/rc.once.d/openssh > +++ b/projectroot/etc/rc.once.d/openssh > @@ -27,6 +27,7 @@ create_keys() { > hostkeys="$(get_hostkeys)" || return > > for keyfile in $hostkeys; do > + [ -s "$keyfile" ] && ssh-keygen -l -f "${keyfile}.pub" > /dev/null && continue > create_key "$keyfile" || return > done > } _______________________________________________ ptxdist mailing list ptxdist@pengutronix.de To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de