Commit 8012250b authored by Yann E. MORIN's avatar Yann E. MORIN Committed by Peter Korsgaard
Browse files

package/dropbear: add warning about volatile keys 



When the rootfs is read-only, keys will be generated in a volatile
location, which is inherently bad as host keys will change on each boot,
rendering them virtually useless.

Add a warning so the user is at least aware of the issue.

Hide the rm output to avoid noisy output, now that we have a proper warning.

Move the starting message after the symlink-block, to avoid messages
collision. Move the umask as well, since /etc/dropbear/ may be world
readable; just the private host keys should be ?00 (and dropbear handles
that by itself).

[Peter: minor tweaks to commit message]
Signed-off-by: default avatar"Yann E. MORIN" <yann.morin.1998@free.fr>
Cc: Peter Korsgaard <jacmet@uclibc.org>
Signed-off-by: default avatarPeter Korsgaard <peter@korsgaard.com>
parent aca921d2

package/dropbear/S50dropbear

+7 −5
Original line number Diff line number Diff line
@@ -9,9 +9,6 @@ test -r /etc/default/dropbear && . /etc/default/dropbear 
start() {

	DROPBEAR_ARGS="$DROPBEAR_ARGS -R"



	echo -n "Starting dropbear sshd: "

	umask 077



	# If /etc/dropbear is a symlink to /var/run/dropbear, and

	#   - the filesystem is RO (i.e. we can not rm the symlink),

	#     create the directory pointed to by the symlink.
@@ -20,13 +17,18 @@ start() { 
	if [ -L /etc/dropbear \

	     -a "$(readlink /etc/dropbear)" = "/var/run/dropbear" ]

	then

		if rm -f /etc/dropbear; then

		if rm -f /etc/dropbear >/dev/null 2>&1; then

			mkdir -p /etc/dropbear

		else

			mkdir -p $(readlink /etc/dropbear)

			echo "No persistent location to store SSH host keys. New keys will be"

			echo "generated at each boot. Are you sure this is what you want to do?"

			mkdir -p "$(readlink /etc/dropbear)"

		fi

	fi



	echo -n "Starting dropbear sshd: "

	umask 077



	start-stop-daemon -S -q -p /var/run/dropbear.pid \

		--exec /usr/sbin/dropbear -- $DROPBEAR_ARGS

	[ $? = 0 ] && echo "OK" || echo "FAIL"

package/dropbear/dropbear.service

+4 −2
Original line number Diff line number Diff line
@@ -11,10 +11,12 @@ After=syslog.target network.target auditd.service 
ExecStartPre=/bin/sh -c '\

if [ -L /etc/dropbear \

     -a "$(readlink /etc/dropbear)" = "/var/run/dropbear" ]; then \

    if rm -f /etc/dropbear; then \

    if rm -f /etc/dropbear >/dev/null 2>&1; then \

        mkdir -p /etc/dropbear; \

    else \

        mkdir -p $(readlink /etc/dropbear); \

        echo "No persistent location to store SSH host keys. New keys will be"; \

        echo "generated at each boot. Are you sure this is what you want to do?"; \

        mkdir -p "$(readlink /etc/dropbear)"; \

    fi; \

fi'

ExecStart=/usr/sbin/dropbear -F -R