Merge pull request #426 from octivi/remove_ssh_host_ed25519_key

Remove ED25519 ssh host key pair from image

bootstrapvz/common/assets/init.d/generate-ssh-hostkeys

@@ -5,7 +5,7 @@
 # Required-Stop:  
 # Should-Start:   
 # Should-Stop:    
-# Default-Start:  S
+# Default-Start:  2 3 4 5
 # Default-Stop:   
 # Description:    Generate ssh host keys if they do not exist
 ### END INIT INFO
@@ -14,23 +14,23 @@ prog=$(basename $0)
 logger="logger -t $prog"
 
 rsa_key="/etc/ssh/ssh_host_rsa_key"
-dsa_key="/etc/ssh/ssh_host_dsa_key"
 ecdsa_key="/etc/ssh/ssh_host_ecdsa_key"
+ed25519_key="/etc/ssh/ssh_host_ed25519_key"
 
 # Exit if the hostkeys already exist
-if [ -f $rsa_key -a -f $dsa_key -a -f $ecdsa_key ]; then
+if [ -f $rsa_key -a -f $ecdsa_key -a -f $ed25519_key ]; then
 	exit
 fi
 
 # Generate the ssh host keys
 [ -f $rsa_key ] || ssh-keygen -f $rsa_key -t rsa -C 'host' -N ''
-[ -f $dsa_key ] || ssh-keygen -f $dsa_key -t dsa -C 'host' -N ''
 [ -f $ecdsa_key ] || ssh-keygen -f $ecdsa_key -t ecdsa -C 'host' -N ''
+[ -f $ed25519_key ] || ssh-keygen -f $ed25519_key -t ed25519 -C 'host' -N ''
 
 # Output the public keys to the console
 # This allows user to get host keys securely through console log
 echo "-----BEGIN SSH HOST KEY FINGERPRINTS-----" | $logger
 ssh-keygen -l -f $rsa_key.pub | $logger
-ssh-keygen -l -f $dsa_key.pub | $logger
 ssh-keygen -l -f $ecdsa_key.pub | $logger
+ssh-keygen -l -f $ed25519_key.pub | $logger
 echo "------END SSH HOST KEY FINGERPRINTS------" | $logger

bootstrapvz/common/assets/init.d/jessie/generate-ssh-hostkeys

@@ -0,0 +1,39 @@
+#!/bin/sh
+### BEGIN INIT INFO
+# Provides:       generate-ssh-hostkeys
+# Required-Start: $local_fs
+# Required-Stop:  
+# Should-Start:   
+# Should-Stop:    
+# Default-Start:  S
+# Default-Stop:   
+# Description:    Generate ssh host keys if they do not exist
+### END INIT INFO
+
+prog=$(basename $0)
+logger="logger -t $prog"
+
+rsa_key="/etc/ssh/ssh_host_rsa_key"
+dsa_key="/etc/ssh/ssh_host_dsa_key"
+ecdsa_key="/etc/ssh/ssh_host_ecdsa_key"
+ed25519_key="/etc/ssh/ssh_host_ed25519_key"
+
+# Exit if the hostkeys already exist
+if [ -f $rsa_key -a -f $dsa_key -a -f $ecdsa_key -a -f $ed25519_key ]; then
+	exit
+fi
+
+# Generate the ssh host keys
+[ -f $rsa_key ] || ssh-keygen -f $rsa_key -t rsa -C 'host' -N ''
+[ -f $dsa_key ] || ssh-keygen -f $dsa_key -t dsa -C 'host' -N ''
+[ -f $ecdsa_key ] || ssh-keygen -f $ecdsa_key -t ecdsa -C 'host' -N ''
+[ -f $ed25519_key ] || ssh-keygen -f $ed25519_key -t ed25519 -C 'host' -N ''
+
+# Output the public keys to the console
+# This allows user to get host keys securely through console log
+echo "-----BEGIN SSH HOST KEY FINGERPRINTS-----" | $logger
+ssh-keygen -l -f $rsa_key.pub | $logger
+ssh-keygen -l -f $dsa_key.pub | $logger
+ssh-keygen -l -f $ecdsa_key.pub | $logger
+ssh-keygen -l -f $ed25519_key.pub | $logger
+echo "------END SSH HOST KEY FINGERPRINTS------" | $logger

bootstrapvz/common/assets/init.d/wheezy/generate-ssh-hostkeys

@@ -0,0 +1,36 @@
+#!/bin/sh
+### BEGIN INIT INFO
+# Provides:       generate-ssh-hostkeys
+# Required-Start: $local_fs
+# Required-Stop:  
+# Should-Start:   
+# Should-Stop:    
+# Default-Start:  S
+# Default-Stop:   
+# Description:    Generate ssh host keys if they do not exist
+### END INIT INFO
+
+prog=$(basename $0)
+logger="logger -t $prog"
+
+rsa_key="/etc/ssh/ssh_host_rsa_key"
+dsa_key="/etc/ssh/ssh_host_dsa_key"
+ecdsa_key="/etc/ssh/ssh_host_ecdsa_key"
+
+# Exit if the hostkeys already exist
+if [ -f $rsa_key -a -f $dsa_key -a -f $ecdsa_key ]; then
+	exit
+fi
+
+# Generate the ssh host keys
+[ -f $rsa_key ] || ssh-keygen -f $rsa_key -t rsa -C 'host' -N ''
+[ -f $dsa_key ] || ssh-keygen -f $dsa_key -t dsa -C 'host' -N ''
+[ -f $ecdsa_key ] || ssh-keygen -f $ecdsa_key -t ecdsa -C 'host' -N ''
+
+# Output the public keys to the console
+# This allows user to get host keys securely through console log
+echo "-----BEGIN SSH HOST KEY FINGERPRINTS-----" | $logger
+ssh-keygen -l -f $rsa_key.pub | $logger
+ssh-keygen -l -f $dsa_key.pub | $logger
+ssh-keygen -l -f $ecdsa_key.pub | $logger
+echo "------END SSH HOST KEY FINGERPRINTS------" | $logger

bootstrapvz/common/tasks/ssh.py

@@ -29,8 +29,14 @@ class AddSSHKeyGeneration(Task):
             log_check_call(['chroot', info.root,
                             'dpkg-query', '-W', 'openssh-server'])
             from bootstrapvz.common.releases import squeeze
+            from bootstrapvz.common.releases import wheezy
+            from bootstrapvz.common.releases import jessie
             if info.manifest.release == squeeze:
                 install['generate-ssh-hostkeys'] = os.path.join(init_scripts_dir, 'squeeze/generate-ssh-hostkeys')
+            elif info.manifest.release == wheezy:
+                install['generate-ssh-hostkeys'] = os.path.join(init_scripts_dir, 'wheezy/generate-ssh-hostkeys')
+            elif info.manifest.release == jessie:
+                install['generate-ssh-hostkeys'] = os.path.join(init_scripts_dir, 'jessie/generate-ssh-hostkeys')
             else:
                 install['generate-ssh-hostkeys'] = os.path.join(init_scripts_dir, 'generate-ssh-hostkeys')
         except CalledProcessError:
@@ -106,6 +112,10 @@ class ShredHostkeys(Task):
         if info.manifest.release >= wheezy:
             ssh_hostkeys.append('ssh_host_ecdsa_key')
 
+        from bootstrapvz.common.releases import jessie
+        if info.manifest.release >= jessie:
+            ssh_hostkeys.append('ssh_host_ed25519_key')
+
         private = [os.path.join(info.root, 'etc/ssh', name) for name in ssh_hostkeys]
         public = [path + '.pub' for path in private]