hi!
Jérémy Bobbio wrote:
When dropbear is used for remote unlocking of an encrypted partition, it
currently unconditionnaly overwrite `/root/.ssh/authorized_keys` in the
initrd with `/etc/initramfs-tools/root/.ssh/id_rsa.pub`.
actually, the initrd is always newly created (i.e. also if you issue an
'update-initramfs', the old one will not be modified but replaced by a newly
created one).
Otherwise, it would be nice to support an
`/etc/initramfs-tools/root/.ssh/authorized_keys` file in which
`/etc/initramfs-tools/root/.ssh/id_rsa.pub` could be copied during
the package installation.
yes, /usr/share/initramfs-tools/hooks/dropbear currently always creates an
authorized_keys file with the id_rsa.pub.
i guess you're right, 'the right way [tm]' would be - just as you described -
to use a template authorized_keys file from /etc... . consequently only a
missing authorized_keys should trigger automatic generation of an authorized
key (which in turn should then also add the generated key to the
authorized_keys file).
that means:
- if there is no authorized_keys file in the template dir (/etc...), and if
there is also no id_rsa.pub, a key is generated and an authorized_keys file is
created holding this public key.
- if there is no authorized_keys file, but there is an id_rsa.pub, an
authorized_keys file is created holding this public key.
- if there is an authorized_keys file, nothing is changed and it is used as is
for the initrd.
this way it works automatically as it does now, but with the option of full control over the authorized_keys file. this ofc also means you can effectively break your authorized keys
setup, like making authorized_keys empty, or holding bogus entries. but you will have to actively do that, so i think that's totally ok. :)
if you like you can directly patch your installed initramfs-tools (as root).
if you do, you should first create a backup of the file that will be changed:
cp /usr/share/initramfs-tools/hooks/dropbear
/usr/share/initramfs-tools/hooks/dropbear.orig
then (see the attached file):
patch -p0 < dropbear-0.52-2-x.diff
NOTE TO THE PACKAGE-OWNER: please give me a short notice in case you add this
patch (or plan to), because then i'd like to take care of updating the
respective documentation.
regards,
Chris
--- /usr/share/initramfs-tools/hooks/dropbear.orig 2009-06-29 15:34:28.000000000 +0200
+++ /usr/share/initramfs-tools/hooks/dropbear 2009-09-29 13:51:18.000000000 +0200
@@ -36,14 +36,17 @@ if [ "${DROPBEAR}" = "y" ] || ( [ "${DRO
fi
done
cp -R /etc/initramfs-tools/etc/dropbear "${DESTDIR}/etc/"
- if [ ! -f "/etc/initramfs-tools/root/.ssh/id_rsa.pub" ]; then
+ if [ ! -f "/etc/initramfs-tools/root/.ssh/authorized_keys" ]; then
mkdir -p "/etc/initramfs-tools/root/.ssh"
- dropbearkey -t rsa -f /etc/initramfs-tools/root/.ssh/id_rsa.dropbear
- /usr/lib/dropbear/dropbearconvert dropbear openssh /etc/initramfs-tools/root/.ssh/id_rsa.dropbear /etc/initramfs-tools/root/.ssh/id_rsa
- dropbearkey -y -f /etc/initramfs-tools/root/.ssh/id_rsa.dropbear | grep "^ssh-rsa " > /etc/initramfs-tools/root/.ssh/id_rsa.pub
+ if [ ! -f "/etc/initramfs-tools/root/.ssh/id_rsa.pub" ]; then
+ dropbearkey -t rsa -f /etc/initramfs-tools/root/.ssh/id_rsa.dropbear
+ /usr/lib/dropbear/dropbearconvert dropbear openssh /etc/initramfs-tools/root/.ssh/id_rsa.dropbear /etc/initramfs-tools/root/.ssh/id_rsa
+ dropbearkey -y -f /etc/initramfs-tools/root/.ssh/id_rsa.dropbear | grep "^ssh-rsa " > /etc/initramfs-tools/root/.ssh/id_rsa.pub
+ fi
+ cat /etc/initramfs-tools/root/.ssh/id_rsa.pub >> /etc/initramfs-tools/root/.ssh/authorized_keys"
fi
mkdir -p "${DESTDIR}/root/.ssh"
- cp /etc/initramfs-tools/root/.ssh/id_rsa.pub "${DESTDIR}/root/.ssh/authorized_keys"
+ cp /etc/initramfs-tools/root/.ssh/authorized_keys "${DESTDIR}/root/.ssh/"
fi
fi
