Merge lp:~hughsaunders/cirros/dropbearkey into lp:cirros

[Scott Moser]

[Scott Moser (smoser)]

using cirros-per is desirable here, we do want to re-generate keys for a new instance and you're dropping that here.

maybe something like:

how_often="instance"
# -f = file, -t = type (rsa or dss), -y = print public key (and check)
if [ -e "$file" ] && ! dropbearkey -f "$file" -y; then
  how_often="always"
  rm -f "$file"
  echo "WARN: removing invalid $file"
fi
cirros-per "$how_often" ...

[Scott Moser (smoser)]

this looks good, i just need to pull it.

review: Approve

[Scott Moser (smoser)]

rejected in favor of the Hugh's now-merged branch at lp:~hughsaunders/cirros/dropbearinit
https://code.launchpad.net/~hughsaunders/cirros/dropbearinit/+merge/291895

Unmerged revisions

364. By <email address hidden> on 2016-04-06

Replace invalid keys on dropbear init.

=== modified file 'patches-buildroot/dropbear-init-generate-keys.patch'
--- patches-buildroot/dropbear-init-generate-keys.patch	2015-05-28 01:28:20 +0000
+++ patches-buildroot/dropbear-init-generate-keys.patch	2016-04-06 20:39:02 +0000
@@ -5,23 +5,35 @@
 generated ahead of time so that we can log them.
 Index: buildroot/package/dropbear/S50dropbear
 ===================================================================
---- buildroot.orig/package/dropbear/S50dropbear	2014-09-01 11:20:56.000000000 +0000
-+++ buildroot/package/dropbear/S50dropbear	2014-09-16 19:29:54.320096000 +0000
-@@ -6,9 +6,17 @@
- # Allow a few customizations from a config file
- test -r /etc/default/dropbear && . /etc/default/dropbear
- 
-+DROPBEAR_KEYTYPES="rsa dss ecc"
- start() {
- 	DROPBEAR_ARGS="$DROPBEAR_ARGS -R"
- 
+--- buildroot.orig/package/dropbear/S50dropbear	2016-04-06 20:25:27.751836649 +0100
++++ buildroot/package/dropbear/S50dropbear	2016-04-06 21:30:16.771836649 +0100
+@@ -11,6 +11,29 @@
+ 
+ 	echo -n "Starting dropbear sshd: "
+ 	umask 077
++	# Ensure host keys are changed when instance ID changes
++	cirros-per instance remove-dropbear-host-keys -- rm -rf /etc/dropbear
++	
++	# Make sure dropbear directory exists
++	if [ ! -d /etc/dropbear ]; then
++		mkdir -p /etc/dropbear
++	fi
++
++	# Regenerate invalid or missing keys
 +	local ktype file
 +	for ktype in rsa dss ecdsa; do
 +		file="/etc/dropbear/dropbear_${ktype}_host_key"
-+		cirros-per instance dropbear-keygen-$ktype -- \
++		# -f = input file, -y = validate and print pubkey info
++		if ! dropbearkey -f "$file" -y &>/dev/null; then
++			if [ -e "$file" ]; then
++				echo "Removing invalid key: $file"
++				rm -f "$file"
++			fi
++			# -t = type (dss, rsa, ecdsa), -f = output file
 +			dropbearkey -t "$ktype" -f "$file" >/dev/null 2>&1 ||
 +		echo "WARN: generating key of type $ktype failed!"
++		fi
 +	done
- 	echo -n "Starting dropbear sshd: "
- 	umask 077
  	start-stop-daemon -S -q -p /var/run/dropbear.pid \
+ 		--exec /usr/sbin/dropbear -- $DROPBEAR_ARGS
+ 	[ $? = 0 ] && echo "OK" || echo "FAIL"