diff --git a/README.md b/README.md index 137493a..cdddb16 100644 --- a/README.md +++ b/README.md @@ -224,17 +224,11 @@ Disable password based SSH authentication. Only public key based SSH (v2) authen ##### `SSH_LIMIT_USERS`=false Limit the users that are allowed to login via SSH. Only allow user `USER_NAME`=pi and root if `SSH_ENABLE_ROOT`=true to login. -##### `SSH_ROOT_AUTHORIZED_KEYS`="" -Add specified SSH `authorized_keys` file that contains keys for public key based SSH (v2) authentication of user `root`. SSH protocol version 1 is not supported. `ENABLE_ROOT` **and** `SSH_ENABLE_ROOT` must be set to `true`. - ##### `SSH_ROOT_PUB_KEY`="" -Add specified SSH (v2) public key file to `authorized_keys` file to enable public key based SSH (v2) authentication of user `root`. SSH protocol version 1 is not supported. `ENABLE_ROOT` **and** `SSH_ENABLE_ROOT` must be set to `true`. - -##### `SSH_USER_AUTHORIZED_KEYS`="" -Add specified SSH `authorized_keys` file that contains keys for public key based SSH (v2) authentication of user `USER_NAME`=pi. SSH protocol version 1 is not supported. +Add specified SSH (v2) public key from file to `authorized_keys` file to enable public key based SSH (v2) authentication of user `root`. The specified file can also contain multiple SSH (v2) public keys. SSH protocol version 1 is not supported. `ENABLE_ROOT` **and** `SSH_ENABLE_ROOT` must be set to `true`. ##### `SSH_USER_PUB_KEY`="" -Add specified SSH (v2) public key file to `authorized_keys` file to enable public key based SSH (v2) authentication of user `USER_NAME`=pi. SSH protocol version 1 is not supported. +Add specified SSH (v2) public key from file to `authorized_keys` file to enable public key based SSH (v2) authentication of user `USER_NAME`=pi. The specified file can also contain multiple SSH (v2) public keys. SSH protocol version 1 is not supported. #### Kernel compilation: ##### `BUILD_KERNEL`=false diff --git a/bootstrap.d/32-sshd.sh b/bootstrap.d/32-sshd.sh index b297188..2c891d6 100644 --- a/bootstrap.d/32-sshd.sh +++ b/bootstrap.d/32-sshd.sh @@ -15,25 +15,19 @@ if [ "$ENABLE_SSHD" = true ] ; then # Permit SSH root login sed -i "s|[#]*PermitRootLogin.*|PermitRootLogin yes|g" "${ETC_DIR}/ssh/sshd_config" - # Create root SSH config directory - mkdir -p "${R}/root/.ssh" - - # Set permissions of root SSH config directory - chroot_exec chmod 700 "/root/.ssh" - chroot_exec chown root:root "/root/.ssh" - - # Install SSH (v2) authorized keys file for user root - if [ ! -z "$SSH_ROOT_AUTHORIZED_KEYS" ] ; then - install_readonly "$SSH_ROOT_AUTHORIZED_KEYS" "${R}/root/.ssh/authorized_keys" - fi - # Add SSH (v2) public key for user root if [ ! -z "$SSH_ROOT_PUB_KEY" ] ; then + # Create root SSH config directory + mkdir -p "${R}/root/.ssh" + + # Set permissions of root SSH config directory + chroot_exec chmod 700 "/root/.ssh" + chroot_exec chown root:root "/root/.ssh" + + # Add SSH (v2) public key(s) to authorized_keys file cat "$SSH_ROOT_PUB_KEY" >> "${R}/root/.ssh/authorized_keys" - fi - # Set permissions of root SSH authorized keys file - if [ -f "${R}/root/.ssh/authorized_keys" ] ; then + # Set permissions of root SSH authorized_keys file chroot_exec chmod 600 "/root/.ssh/authorized_keys" chroot_exec chown root:root "/root/.ssh/authorized_keys" @@ -43,25 +37,19 @@ if [ "$ENABLE_SSHD" = true ] ; then fi if [ "$ENABLE_USER" = true ] ; then - # Create $USER_NAME SSH config directory - mkdir -p "${R}/home/${USER_NAME}/.ssh" - - # Set permissions of $USER_NAME SSH config directory - chroot_exec chmod 700 "/home/${USER_NAME}/.ssh" - chroot_exec chown ${USER_NAME}:${USER_NAME} "/home/${USER_NAME}/.ssh" - - # Install SSH (v2) authorized keys file for user $USER_NAME - if [ ! -z "$SSH_USER_AUTHORIZED_KEYS" ] ; then - install_readonly "$SSH_USER_AUTHORIZED_KEYS" "${R}/home/${USER_NAME}/.ssh/authorized_keys" - fi - # Add SSH (v2) public key for user $USER_NAME if [ ! -z "$SSH_USER_PUB_KEY" ] ; then + # Create $USER_NAME SSH config directory + mkdir -p "${R}/home/${USER_NAME}/.ssh" + + # Set permissions of $USER_NAME SSH config directory + chroot_exec chmod 700 "/home/${USER_NAME}/.ssh" + chroot_exec chown ${USER_NAME}:${USER_NAME} "/home/${USER_NAME}/.ssh" + + # Add SSH (v2) public key(s) to authorized_keys file cat "$SSH_USER_PUB_KEY" >> "${R}/home/${USER_NAME}/.ssh/authorized_keys" - fi - # Set permissions of $USER_NAME SSH authorized keys file - if [ -f "${R}/home/${USER_NAME}/.ssh/authorized_keys" ] ; then + # Set permissions of $USER_NAME SSH config directory chroot_exec chmod 600 "/home/${USER_NAME}/.ssh/authorized_keys" chroot_exec chown ${USER_NAME}:${USER_NAME} "/home/${USER_NAME}/.ssh/authorized_keys" diff --git a/rpi23-gen-image.sh b/rpi23-gen-image.sh index 6a891cb..1f4eecd 100755 --- a/rpi23-gen-image.sh +++ b/rpi23-gen-image.sh @@ -133,8 +133,6 @@ ENABLE_ROOT=${ENABLE_ROOT:=false} SSH_ENABLE_ROOT=${SSH_ENABLE_ROOT:=false} SSH_DISABLE_PASSWORD_AUTH=${SSH_DISABLE_PASSWORD_AUTH:=false} SSH_LIMIT_USERS=${SSH_LIMIT_USERS:=false} -SSH_ROOT_AUTHORIZED_KEYS=${SSH_ROOT_AUTHORIZED_KEYS:=""} -SSH_USER_AUTHORIZED_KEYS=${SSH_USER_AUTHORIZED_KEYS:=""} SSH_ROOT_PUB_KEY=${SSH_ROOT_PUB_KEY:=""} SSH_USER_PUB_KEY=${SSH_USER_PUB_KEY:=""} @@ -263,22 +261,6 @@ if [ "$ENABLE_UBOOT" = true ] ; then APT_INCLUDES="${APT_INCLUDES},device-tree-compiler" fi -# Check if root SSH authorized keys file exists -if [ ! -z "$SSH_ROOT_AUTHORIZED_KEYS" ] ; then - if [ ! -f "$SSH_ROOT_AUTHORIZED_KEYS" ] ; then - echo "error: '$SSH_ROOT_AUTHORIZED_KEYS' specified SSH authorized keys file not found (SSH_ROOT_AUTHORIZED_KEYS)!" - exit 1 - fi -fi - -# Check if $USER_NAME SSH authorized keys file exists -if [ ! -z "$SSH_USER_AUTHORIZED_KEYS" ] ; then - if [ ! -f "$SSH_USER_AUTHORIZED_KEYS" ] ; then - echo "error: '$SSH_USER_AUTHORIZED_KEYS' specified SSH authorized keys file not found (SSH_USER_AUTHORIZED_KEYS)!" - exit 1 - fi -fi - # Check if root SSH (v2) public key file exists if [ ! -z "$SSH_ROOT_PUB_KEY" ] ; then if [ ! -f "$SSH_ROOT_PUB_KEY" ] ; then @@ -510,16 +492,6 @@ rm -f "${R}/initrd.img" rm -f "${R}/vmlinuz" rm -f "${R}${QEMU_BINARY}" -# Remove root .ssh directory if it's empty -if [ -d "${R}/root/.ssh" ] ; then - rmdir --ignore-fail-on-non-empty "${R}/root/.ssh" -fi - -# Remove $USER_NAME .ssh directory if it's empty -if [ -d "${R}/home/${USER_NAME}/.ssh" ] ; then - rmdir --ignore-fail-on-non-empty "${R}/home/${USER_NAME}/.ssh" -fi - # Calculate size of the chroot directory in KB CHROOT_SIZE=$(expr `du -s "${R}" | awk '{ print $1 }'`)