Re: [ptxdist] [RFC PATCH] rc-once: openssh: Do not overwrite existing keys

[Alexander Dahl <ada@thorsis.com>]

Hello Michael,

Am Freitag, 15. Oktober 2021, 14:52:45 CEST schrieb Michael Olbrich:
> On Mon, Oct 11, 2021 at 02:54:01PM +0200, Alexander Dahl wrote:
> > When storing your keys not in rootfs but on a separate data partition
> > (using symbolic links or overlay fs), keys are overwritten on each
> > firmware upgrade which lets rc-once run again (which happens when using
> > opkg upgrade/update or RAUC in an A/B scheme for example).
> > 
> > Changing keys are at best annoying, but may be interpreted as an attack
> > as well.
> 
> This has come up before (I'm not sure if it was on this list or some other
> channel). I'm not quite certain how to handle this.
> 
> Someone may depend on the current behavior. I think it's rather unlikely so
> I'll probably ignore that but we should keep it in mind.

Yes, I thought about that. That's why I wanted to discuss it first.

> I'm more concerned with broken keys caused by power failures or things like
> that while the keys are created. So maybe a better check than just file
> existence?
> 
> > For dropbear the same behaviour was implemented with ac97e77eedf7
> > ("[dropbear] rc.once: only generate keys if they aren't present yet").
> 
> Marc applied that patch. I'm probably a bit more pedantic about stuff like
> that :-).
> 
> > Signed-off-by: Alexander Dahl <ada@thorsis.com>
> > ---
> > 
> >  projectroot/etc/rc.once.d/openssh | 1 +
> >  1 file changed, 1 insertion(+)
> > 
> > diff --git a/projectroot/etc/rc.once.d/openssh
> > b/projectroot/etc/rc.once.d/openssh index 545586f07..595e28477 100644
> > --- a/projectroot/etc/rc.once.d/openssh
> > +++ b/projectroot/etc/rc.once.d/openssh
> > @@ -27,6 +27,7 @@ create_keys() {
> > 
> >  	hostkeys="$(get_hostkeys)" || return
> >  	
> >  	for keyfile in $hostkeys; do
> > 
> > +		[ -e "$keyfile" ] && continue
> 
> Maybe:
> 
> 		[ -s "$keyfile" ] && ssh-keygen -l -f "$keyfile.pub" > /dev/null &&
> continue
> 
> A non-empty private key file and a probably valid public key should be
> sufficient to prevent issues with power failures, I think.

It's a good idea to have a better check than just for file existence!

We already had that empty file problem in the past. That would also be nice to 
have for the dropbear package. 

Not sure yet about that public key check, but I'll have a look into it.

Thanks for your feedback, I'll send a v2 with improved checks later.

Greets
Alex

> 
> Michael
> 
> >  		create_key "$keyfile" || return
> >  	
> >  	done
> >  
> >  }
> > 
> > base-commit: 51994d1b518323d2975491090a2452d34b1a39f9


-- 




_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de