sig_cloud/diskimage-builder
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Don't use ssh-keygen -A for init scripts

Browse Source 
We are running into race conditions with glean, which ssh-keygen -A is
not handling properly.  So, create a new script to first check if the
file exists, then use 'yes' to disable overwriting of existing files.

Change-Id: Ie82e1e3f832fcc8f32c7e1335c5f0ee16d36f9a8
Signed-off-by: Paul Belanger <pabelanger@redhat.com>
This commit is contained in:
Paul Belanger 2016-09-28 16:03:52 -04:00
parent b0d72a3161
commit 18a664dd32
4 changed files with 32 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
elements/runtime-ssh-host-keys/element-deps
View File

@ -1 +1,2 @@
dib-init-system
install-static

13
elements/runtime-ssh-host-keys/init-scripts/systemd/ssh-keygen.service
View File

@ -2,19 +2,8 @@
Description=OpenSSH Server Key Generation
Before=ssh.service
ConditionPathExists=|!/etc/ssh/ssh_host_key
ConditionPathExists=|!/etc/ssh/ssh_host_key.pub
ConditionPathExists=|!/etc/ssh/ssh_host_rsa_key
ConditionPathExists=|!/etc/ssh/ssh_host_rsa_key.pub
ConditionPathExists=|!/etc/ssh/ssh_host_dsa_key
ConditionPathExists=|!/etc/ssh/ssh_host_dsa_key.pub
ConditionPathExists=|!/etc/ssh/ssh_host_ecdsa_key
ConditionPathExists=|!/etc/ssh/ssh_host_ecdsa_key.pub
ConditionPathExists=|!/etc/ssh/ssh_host_ed25519_key
ConditionPathExists=|!/etc/ssh/ssh_host_ed25519_key.pub
[Service]
ExecStart=/usr/bin/ssh-keygen -A
ExecStart=/usr/local/sbin/runtime-ssh-host-keys.sh
Type=oneshot
RemainAfterExit=yes

2
elements/runtime-ssh-host-keys/init-scripts/upstart/ssh-keygen.conf
View File

@ -5,4 +5,4 @@ console output
task
exec /usr/bin/ssh-keygen -A
exec /usr/local/sbin/runtime-ssh-host-keys.sh

29
elements/runtime-ssh-host-keys/static/usr/local/sbin/runtime-ssh-host-keys.sh Executable file
View File

@ -0,0 +1,29 @@
#!/bin/bash
# Copyright 2016 Red Hat, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
# dib-lint: disable=dibdebugtrace
set -exu
set -o pipefail
# We are running into race conditions with glean, which ssh-keygen -A is
# not handling properly. So, create a new script to first check if the
# file exists, then use 'yes' to disable overwriting of existing files.
for key in dsa ecdsa ed25519 rsa; do
FILE=/etc/ssh/ssh_host_${key}_key
if ! [ -e $FILE ]; then
/usr/bin/yes n | /usr/bin/ssh-keygen -f $FILE -N '' -t $key
fi
done