From mboxrd@z Thu Jan 1 00:00:00 1970 Return-path: Received: from mo4-p00-ob.smtp.rzone.de ([81.169.146.220]) by metis.ext.pengutronix.de with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1kejzN-0001tQ-Sk for ptxdist@pengutronix.de; Mon, 16 Nov 2020 20:16:35 +0100 Received: from home by smtp.strato.de (RZmta 47.3.4 DYNA|AUTH) with ESMTPSA id e08086wAGJGXJ6m (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256 bits)) (Client did not present a certificate) for ; Mon, 16 Nov 2020 20:16:33 +0100 (CET) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by home (Postfix) with ESMTP id E4FFF1A0248 for ; Mon, 16 Nov 2020 20:16:32 +0100 (CET) From: "Artur Wiebe" In-Reply-To: <20201116103202.GF14638@pengutronix.de> Date: Mon, 16 Nov 2020 20:16:32 +0100 MIME-Version: 1.0 Message-ID: <3a0-5fb2d000-87-46e83c80@56045893> Subject: Re: [ptxdist] =?utf-8?b?Pz09P3V0Zi04P3E/ID89PT91dGYtOD9xPyA/PSAgW1BB?= =?utf-8?b?VENIXT89PT91dGYtOD9xPyBEUkFGVDps?= List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ptxdist-bounces@pengutronix.de Sender: "ptxdist" To: ptxdist@pengutronix.de Hi Michael, I found a solution. What do you think? Artur On Monday, November 16, 2020 11:32 CET, Michael Olbrich wrote: > On Mon, Nov 16, 2020 at 10:45:07AM +0100, Artur Wiebe wrote: > > On Monday, November 16, 2020 10:36 CET, Michael Olbrich wrote: > > > On Sun, Nov 15, 2020 at 06:08:56PM +0100, Roland Hieber wrote: > > > > On Sun, Nov 15, 2020 at 11:06:12AM +0100, Ladislav Michl wrote: > > > > > On Sat, Nov 14, 2020 at 09:34:47PM +0100, Roland Hieber wrote: > > > > > > On Fri, Nov 13, 2020 at 06:46:48PM +0100, Ladislav Michl wrote: > > > > > > > On Fri, Nov 13, 2020 at 03:19:55PM +0100, Artur Wiebe wrote: > > > > > > > > How can openssh.postinst be disabled from within the rule files? > > > > > > > > > > > > > > The very same could be achieved with symlink in your BSP: > > > > > > > projectroot/etc/rc.once.d/openssh -> /dev/null > > > > > > > > > > > > I don't understand why you want to disable this. The SSH server will not > > > > > > start without host keys. Or do you want to install a static version of > > > > > > the host keys generated at build time? > > > > > > > > > > Yes, keys are static, generated at build time. Root filesystem is > > > > > read-only. > > > > > > > > > > > If so, there should be an option for this. But for now, in my opinion, > > > > > > disabling OPENSSH_SSHD_GENKEYS will just lead to a broken SSH server. > > > > > > > > > > As this is easy to solve at BSP level I never thought it could > > > > > be a thing :) > > > > > > > > OK, but at least I would mention it in the kconfig help text. The > > > > > > Ack. > > > > > > > openssh recipe could also just pick up /etc/ssh/ssh_host_*_key via > > > > install_alternative if this option is disabled. > > > > > > No. Shared ssh server keys are a bad idea. That's not something I want to > > > merge upstream. > > > > This was also my concern... > > > > > > > > But there are other use-cases to not use rc-once, e.g. if the server keys > > > are generated during provisioning. And not selecting rc-once in this case > > > makes sense, so this is acceptable im general. > > > > I still need a way to disable openssh.postinst if OPENSSH_SSHD_GENKEYS is not set. > > Hmmm, right. In the BSP, a /dev/null symlinks works for this as well, but > we currently don't have a way to not install the postinst script. We could > do something like this (untested): > > $(call install_script_replace, openssh, postinst, @RC_ONCE@, \ > $(call ptx/ifdef, PTXCONF_OPENSSH_SSHD_GENKEYS,,#)) > > And in rules/openssh.postinst: > > #!/bin/sh > @RC_ONCE@$DESTDIR/usr/sbin/enable-rc-once openssh > > This way the script may be installed, but it will do nothing. If > PTXCONF_OPENSSH_SSHD_GENKEYS is disabled. > > Michael > > -- > Pengutronix e.K. | | > Steuerwalder Str. 21 | http://www.pengutronix.de/ | > 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | > Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 | > > _______________________________________________ > ptxdist mailing list > ptxdist@pengutronix.de > To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de _______________________________________________ ptxdist mailing list ptxdist@pengutronix.de To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de