Re: [ptxdist] [PATCH v2 5/8] dropbear: Refactor rc-once and init to use KEYTYPES

[Alexander Dahl <ada@thorsis.com>]

Hello Michael,

Am Freitag, 22. Oktober 2021, 10:44:05 CEST schrieb Michael Olbrich:
> On Mon, Oct 18, 2021 at 04:35:51PM +0200, Alexander Dahl wrote:
> > Previously DSS and RSA keys were always generated, regardless if
> > dropbear was built with support for that host key or not, which somehow
> > contradicts what commit message of 01ac7cc409b5 ("dropbear: Remove
> > deprecated options") promised.
> > 
> > No other things changed here, just considering that KEYTYPES list for
> > 'rsa' and 'dss' for now.
> > 
> > Signed-off-by: Alexander Dahl <ada@thorsis.com>
> > ---
> > 
> >  projectroot/etc/init.d/dropbear    | 17 ++++++++++++++---
> >  projectroot/etc/rc.once.d/dropbear | 26 +++++++++++++++++++++++---
> >  2 files changed, 37 insertions(+), 6 deletions(-)
> > 
> > diff --git a/projectroot/etc/init.d/dropbear
> > b/projectroot/etc/init.d/dropbear index 342565f93..88ef5aa71 100644
> > --- a/projectroot/etc/init.d/dropbear
> > +++ b/projectroot/etc/init.d/dropbear
> > @@ -15,10 +15,21 @@ test -z "$DROPBEAR_BANNER" || \
> > 
> >    DROPBEAR_EXTRA_ARGS="$DROPBEAR_EXTRA_ARGS -b $DROPBEAR_BANNER"
> >  
> >  dropbear_start() {
> > 
> > -
> > 
> >      KEY_ARGS=""
> > 
> > -    test -f $DROPBEAR_DSSKEY && KEY_ARGS="$KEY_ARGS -d $DROPBEAR_DSSKEY"
> > -    test -f $DROPBEAR_RSAKEY && KEY_ARGS="$KEY_ARGS -r $DROPBEAR_RSAKEY"
> > +    for keytype in $DROPBEAR_KEYTYPES
> > +    do
> > +        case "$keytype" in
> > +            dss)
> > +                test -f $DROPBEAR_DSSKEY && KEY_ARGS="$KEY_ARGS -d
> > $DROPBEAR_DSSKEY" +                ;;
> 
> Isn't dss disabled completely? So do we actually need this?

Depends where you look. :-/

The option was removed from ptxdist menu, yes. It is discouraged to use, yes.

For the patch I did not want to refactor and change behaviour at the same 
time, so I would propose another patch for removing dss key support from the 
init and rc-once scripts. Should that come before or after the other changes?

>From dropbear point of view I'm not 100% sure, but I think it's still possible 
to built with dss support. ptxdist does not make an explicit decision on that 
and relies on dropbear internal defaults. Maybe we should disable that 
explicitly? dropbear build is different from standard ways, so it's a little 
harder to pin down all the options.

Greets
Alex

> 
> Michael
> 
> > +            rsa)
> > +                test -f $DROPBEAR_RSAKEY && KEY_ARGS="$KEY_ARGS -r
> > $DROPBEAR_RSAKEY" +                ;;
> > +            *)
> > +                echo "Key type '$keytype' not supported"
> > +                ;;
> > +        esac
> > +    done
> > 
> >      echo -n "starting dropbear..."
> > 
> > diff --git a/projectroot/etc/rc.once.d/dropbear
> > b/projectroot/etc/rc.once.d/dropbear index dd922d727..a9a1d475c 100644
> > --- a/projectroot/etc/rc.once.d/dropbear
> > +++ b/projectroot/etc/rc.once.d/dropbear
> > @@ -5,10 +5,11 @@
> > PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin> 
> >  . /usr/lib/init/dropbear.sh
> >  
> >  gen_key() {
> > 
> > -
> > 
> >  	key_type=$1
> >  	key_file=$2
> > 
> > +	[ -e "$key_file" ] && return
> > +
> > 
> >  	rm -f $key_file > /dev/null 2>&1
> >  	
> >  	echo -n "generating $key_type key..."
> > 
> > @@ -22,6 +23,25 @@ gen_key() {
> > 
> >  	fi
> >  
> >  }
> > 
> > -[ -e "$DROPBEAR_RSAKEY" ] || gen_key rsa "$DROPBEAR_RSAKEY"
> > -[ -e "$DROPBEAR_DSSKEY" ] || gen_key dss "$DROPBEAR_DSSKEY"
> > +gen_keys() {
> > +	for keytype in $DROPBEAR_KEYTYPES
> > +	do
> > +		case "$keytype" in
> > +			dss)
> > +				gen_key dss "$DROPBEAR_DSSKEY"
> > +				;;
> > +			rsa)
> > +				gen_key rsa "$DROPBEAR_RSAKEY"
> > +				;;
> > +			*)
> > +				echo "Key type '$keytype' not supported"
> > +				;;
> > +		esac
> > +	done
> > +}
> > 
> > +if ! gen_keys
> > +then
> > +	echo "Generating SSH keys failed!"
> > +	exit 1
> > +fi


-- 
Alexander Dahl           Thorsis Technologies GmbH   T +49 391 544 563 1000
Industrieautomation      Oststr. 18                  F +49 391 544 563 9099
T +49 391 544 563 3036   39114 Magdeburg             https://www.thorsis.com/

Sitz der Gesellschaft: Magdeburg
Amtsgericht Stendal HRB 110339
Geschäftsführer: Dipl.-Ing. Thorsten Szczepanski




_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de