kevinheyer/bootstrap-vz
1
0
Fork 0
mirror of https://github.com/kevingruesser/bootstrap-vz.git synced 2025-08-22 09:50:37 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge pull request #426 from octivi/remove_ssh_host_ed25519_key

Browse source 
Remove ED25519 ssh host key pair from image
This commit is contained in:
Anders Ingemann 2018-01-14 17:22:06 +01:00 • committed by GitHub
commit fe0f8eba5b
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
4 changed files with 90 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
bootstrapvz/common/assets/init.d/generate-ssh-hostkeys
View file

@ -5,7 +5,7 @@
# Required-Stop:
# Should-Start:
# Should-Stop:
# Default-Start: S
# Default-Start: 2 3 4 5
# Default-Stop:
# Description: Generate ssh host keys if they do not exist
### END INIT INFO
@ -14,23 +14,23 @@ prog=$(basename $0)
logger="logger -t $prog"
rsa_key="/etc/ssh/ssh_host_rsa_key"
dsa_key="/etc/ssh/ssh_host_dsa_key"
ecdsa_key="/etc/ssh/ssh_host_ecdsa_key"
ed25519_key="/etc/ssh/ssh_host_ed25519_key"
# Exit if the hostkeys already exist
if [ -f $rsa_key -a -f $dsa_key -a -f $ecdsa_key ]; then
if [ -f $rsa_key -a -f $ecdsa_key -a -f $ed25519_key ]; then
exit
fi
# Generate the ssh host keys
[ -f $rsa_key ] || ssh-keygen -f $rsa_key -t rsa -C 'host' -N ''
[ -f $dsa_key ] || ssh-keygen -f $dsa_key -t dsa -C 'host' -N ''
[ -f $ecdsa_key ] || ssh-keygen -f $ecdsa_key -t ecdsa -C 'host' -N ''
[ -f $ed25519_key ] || ssh-keygen -f $ed25519_key -t ed25519 -C 'host' -N ''
# Output the public keys to the console
# This allows user to get host keys securely through console log
echo "-----BEGIN SSH HOST KEY FINGERPRINTS-----" | $logger
ssh-keygen -l -f $rsa_key.pub | $logger
ssh-keygen -l -f $dsa_key.pub | $logger
ssh-keygen -l -f $ecdsa_key.pub | $logger
ssh-keygen -l -f $ed25519_key.pub | $logger
echo "------END SSH HOST KEY FINGERPRINTS------" | $logger

39
bootstrapvz/common/assets/init.d/jessie/generate-ssh-hostkeys Normal file
View file

@ -0,0 +1,39 @@
#!/bin/sh
### BEGIN INIT INFO
# Provides: generate-ssh-hostkeys
# Required-Start: $local_fs
# Required-Stop:
# Should-Start:
# Should-Stop:
# Default-Start: S
# Default-Stop:
# Description: Generate ssh host keys if they do not exist
### END INIT INFO
prog=$(basename $0)
logger="logger -t $prog"
rsa_key="/etc/ssh/ssh_host_rsa_key"
dsa_key="/etc/ssh/ssh_host_dsa_key"
ecdsa_key="/etc/ssh/ssh_host_ecdsa_key"
ed25519_key="/etc/ssh/ssh_host_ed25519_key"
# Exit if the hostkeys already exist
if [ -f $rsa_key -a -f $dsa_key -a -f $ecdsa_key -a -f $ed25519_key ]; then
exit
fi
# Generate the ssh host keys
[ -f $rsa_key ] || ssh-keygen -f $rsa_key -t rsa -C 'host' -N ''
[ -f $dsa_key ] || ssh-keygen -f $dsa_key -t dsa -C 'host' -N ''
[ -f $ecdsa_key ] || ssh-keygen -f $ecdsa_key -t ecdsa -C 'host' -N ''
[ -f $ed25519_key ] || ssh-keygen -f $ed25519_key -t ed25519 -C 'host' -N ''
# Output the public keys to the console
# This allows user to get host keys securely through console log
echo "-----BEGIN SSH HOST KEY FINGERPRINTS-----" | $logger
ssh-keygen -l -f $rsa_key.pub | $logger
ssh-keygen -l -f $dsa_key.pub | $logger
ssh-keygen -l -f $ecdsa_key.pub | $logger
ssh-keygen -l -f $ed25519_key.pub | $logger
echo "------END SSH HOST KEY FINGERPRINTS------" | $logger

36
bootstrapvz/common/assets/init.d/wheezy/generate-ssh-hostkeys Normal file
View file

@ -0,0 +1,36 @@
#!/bin/sh
### BEGIN INIT INFO
# Provides: generate-ssh-hostkeys
# Required-Start: $local_fs
# Required-Stop:
# Should-Start:
# Should-Stop:
# Default-Start: S
# Default-Stop:
# Description: Generate ssh host keys if they do not exist
### END INIT INFO
prog=$(basename $0)
logger="logger -t $prog"
rsa_key="/etc/ssh/ssh_host_rsa_key"
dsa_key="/etc/ssh/ssh_host_dsa_key"
ecdsa_key="/etc/ssh/ssh_host_ecdsa_key"
# Exit if the hostkeys already exist
if [ -f $rsa_key -a -f $dsa_key -a -f $ecdsa_key ]; then
exit
fi
# Generate the ssh host keys
[ -f $rsa_key ] || ssh-keygen -f $rsa_key -t rsa -C 'host' -N ''
[ -f $dsa_key ] || ssh-keygen -f $dsa_key -t dsa -C 'host' -N ''
[ -f $ecdsa_key ] || ssh-keygen -f $ecdsa_key -t ecdsa -C 'host' -N ''
# Output the public keys to the console
# This allows user to get host keys securely through console log
echo "-----BEGIN SSH HOST KEY FINGERPRINTS-----" | $logger
ssh-keygen -l -f $rsa_key.pub | $logger
ssh-keygen -l -f $dsa_key.pub | $logger
ssh-keygen -l -f $ecdsa_key.pub | $logger
echo "------END SSH HOST KEY FINGERPRINTS------" | $logger

10
bootstrapvz/common/tasks/ssh.py
View file

@ -29,8 +29,14 @@ class AddSSHKeyGeneration(Task):
log_check_call(['chroot', info.root,
'dpkg-query', '-W', 'openssh-server'])
from bootstrapvz.common.releases import squeeze
from bootstrapvz.common.releases import wheezy
from bootstrapvz.common.releases import jessie
if info.manifest.release == squeeze:
install['generate-ssh-hostkeys'] = os.path.join(init_scripts_dir, 'squeeze/generate-ssh-hostkeys')
elif info.manifest.release == wheezy:
install['generate-ssh-hostkeys'] = os.path.join(init_scripts_dir, 'wheezy/generate-ssh-hostkeys')
elif info.manifest.release == jessie:
install['generate-ssh-hostkeys'] = os.path.join(init_scripts_dir, 'jessie/generate-ssh-hostkeys')
else:
install['generate-ssh-hostkeys'] = os.path.join(init_scripts_dir, 'generate-ssh-hostkeys')
except CalledProcessError:
@ -106,6 +112,10 @@ class ShredHostkeys(Task):
if info.manifest.release >= wheezy:
ssh_hostkeys.append('ssh_host_ecdsa_key')
from bootstrapvz.common.releases import jessie
if info.manifest.release >= jessie:
ssh_hostkeys.append('ssh_host_ed25519_key')
private = [os.path.join(info.root, 'etc/ssh', name) for name in ssh_hostkeys]
public = [path + '.pub' for path in private]