Raspi2-3_GenImage Commit - r447:0958808353fc · Collaboration Tremplin des Sciences

add dropbear

Unknown -

r447:0958808353fc

parent child

Context file:

r447:0958808353fc

Collapse all files

files/initramfs/crypt_unlock.sh created 644 +45 0

@@ -0,0 +1,45
	1	#!/bin/sh
	2
	3	PREREQ="dropbear"
	4
	5	prereqs() {
	6	echo "$PREREQ"
	7	}
	8
	9	case "$1" in
	10	prereqs)
	11	prereqs
	12	exit 0
	13	;;
	14	esac
	15
	16	. "${CONFDIR}/initramfs.conf"
	17	. /usr/share/initramfs-tools/hook-functions
	18
	19	if [ "${DROPBEAR}" != "n" ] && [ -r "/etc/crypttab" ] ; then
	20	cat > "${DESTDIR}/bin/unlock" << EOF
	21	#!/bin/sh
	22	if PATH=/lib/unlock:/bin:/sbin /scripts/local-top/cryptroot; then
	23	kill \`ps \| grep cryptroot \| grep -v "grep" \| awk '{print \$1}'\`
	24	# following line kill the remote shell right after the passphrase has
	25	# been entered.
	26	kill -9 \`ps \| grep "\-sh" \| grep -v "grep" \| awk '{print \$1}'\`
	27	exit 0
	28	fi
	29	exit 1
	30	EOF
	31
	32	chmod 755 "${DESTDIR}/bin/unlock"
	33
	34	mkdir -p "${DESTDIR}/lib/unlock"
	35	cat > "${DESTDIR}/lib/unlock/plymouth" << EOF
	36	#!/bin/sh
	37	[ "\$1" == "--ping" ] && exit 1
	38	/bin/plymouth "\$@"
	39	EOF
	40
	41	chmod 755 "${DESTDIR}/lib/unlock/plymouth"
	42
	43	echo To unlock root-partition run "unlock" >> ${DESTDIR}/etc/motd
	44
	45	fi No newline at end of file

README.md +13 -7

             ##### `RPI_MODEL`=2
             Specifiy the target Raspberry Pi hardware model. The script at this time supports the following Raspberry Pi models:
-            `0`  = Used for Raspberry Pi 0 and Raspberry Pi 0 W
+            - `0`  = Used for Raspberry Pi 0 and Raspberry Pi 0 W
-            `1`  = Used for Pi 1 model A and B
+            - `1`  = Used for Pi 1 model A and B
-            `1P` = Used for Pi 1 model B+ and A+
+            - `1P` = Used for Pi 1 model B+ and A+
-            `2`  = Used for Pi 2 model B
+            - `2`  = Used for Pi 2 model B
-            `3`  = Used for Pi 3 model B
+            - `3`  = Used for Pi 3 model B
-            `3P` = Used for Pi 3 model B+
+            - `3P` = Used for Pi 3 model B+
-            `BUILD_KERNEL`=true will automatically be set if the Raspberry Pi model `3` or `3P` is used.
+            - `BUILD_KERNEL`=true will automatically be set if the Raspberry Pi model `3` or `3P` is used.
             ##### `RELEASE`="buster"
             Set the desired Debian release name. The script at this time supports the bootstrapping of the Debian releases `stretch` and `buster`.
             ##### `CRYPTFS_XTSKEYSIZE`=512
             Sets key size in bits. The argument has to be a multiple of 8.
+            ##### `CRYPTFS_DROPBEAR`=false
+            Enable Dropbear Initramfs support
+            ##### `CRYPTFS_DROPBEAR_PUBKEY`=""
+            Provide path to dropbear Public RSA-OpenSSH Key
             ---
             #### Build settings:

bootstrap.d/14-fstab.sh +33 -2

@@ -42,9 +42,40 if [ "$BUILD_KERNEL" = true ] && [ "$ENABLE_INITRAMFS" = true ] ; then
42	install_exec files/initramfs/expand-premount "${ETC_DIR}/initramfs-tools/scripts/local-premount/expand-premount"	42	install_exec files/initramfs/expand-premount "${ETC_DIR}/initramfs-tools/scripts/local-premount/expand-premount"
43	install_exec files/initramfs/expand-tools "${ETC_DIR}/initramfs-tools/hooks/expand-tools"	43	install_exec files/initramfs/expand-tools "${ETC_DIR}/initramfs-tools/hooks/expand-tools"
44	fi	44	fi
		45
		46	if [ "$CRYPTFS_DROPBEAR" = true ]; then
		47	if [ -n "$CRYPTFS_DROPBEAR_PUBKEY" ] && [ -f "$CRYPTFS_DROPBEAR_PUBKEY" ] ; then
		48	install_readonly "${CRYPTFS_DROPBEAR_PUBKEY}" "${ETC_DIR}/dropbear-initramfs/id_rsa.pub"
		49	cat /etc/dropbear-initramfs/id_rsa.pub >> /etc/dropbear-initramfs/authorized_keys
		50	else
		51	# Create key
		52	chroot_exec /usr/bin/dropbearkey -t rsa -f /etc/dropbear-initramfs/id_rsa.dropbear
		53
		54	# Convert dropbear key to openssh key
		55	chroot_exec /usr/lib/dropbear/dropbearconvert dropbear openssh /etc/dropbear-initramfs/id_rsa.dropbear /etc/dropbear-initramfs/id_rsa
		56
		57	# Get Public Key Part
		58	touch /etc/dropbear-initramfs/id_rsa.pub
		59	chroot_exec /usr/bin/dropbearkey -y -f /etc/dropbear-initramfs/id_rsa.dropbear \| chroot_exec tee /etc/dropbear-initramfs/id_rsa.pub
		60
		61	# Delete unwanted lines
		62	sed -i '/Public/d' "${ETC_DIR}"/dropbear-initramfs/id_rsa.pub
		63	sed -i '/Fingerprint/d' "${ETC_DIR}"/dropbear-initramfs/id_rsa.pub
		64
		65	# Trust the new key
		66	touch "${ETC_DIR}"/dropbear-initramfs/authorized_keys
		67	cat "${ETC_DIR}"/dropbear-initramfs/id_rsa.pub \| chroot_exec tee -a "${ETC_DIR}"/dropbear-initramfs/authorized_keys
45		68
46	# Disable SSHD inside initramfs	69	# Save Keys - convert with putty from rsa/openssh to puttkey
47	printf "#\n# DROPBEAR: [ y \| n ]\n#\n\nDROPBEAR=n\n" >> "${ETC_DIR}/initramfs-tools/initramfs.conf"	70	cp -f "${ETC_DIR}"/dropbear-initramfs/id_rsa "${BASEDIR}"/dropbear_initramfs_key.rsa
		71
		72	#Get unlock script
		73	install_exec files/initramfs/crypt_unlock.sh "${ETC_DIR}/initramfs-tools/hooks/crypt_unlock.sh"
		74	fi
		75	else
		76	# Disable SSHD inside initramfs
		77	printf "#\n# DROPBEAR: [ y \| n ]\n#\n\nDROPBEAR=n\n" >> "${ETC_DIR}/initramfs-tools/initramfs.conf"
		78	fi
48		79
49	# Add cryptsetup modules to initramfs	80	# Add cryptsetup modules to initramfs
50	printf "#\n# CRYPTSETUP: [ y \| n ]\n#\n\nCRYPTSETUP=y\n" >> "${ETC_DIR}/initramfs-tools/conf-hook"	81	printf "#\n# CRYPTSETUP: [ y \| n ]\n#\n\nCRYPTSETUP=y\n" >> "${ETC_DIR}/initramfs-tools/conf-hook"

rpi23-gen-image.sh +10 -1

             CRYPTFS_MAPPING=${CRYPTFS_MAPPING:="secure"}
             CRYPTFS_CIPHER=${CRYPTFS_CIPHER:="aes-xts-plain64:sha512"}
             CRYPTFS_XTSKEYSIZE=${CRYPTFS_XTSKEYSIZE:=512}
+            #Dropbear-initramfs supports unlocking encrypted filesystem via SSH on bootup
+            CRYPTFS_DROPBEAR=${CRYPTFS_DROPBEAR:=true}
+            #Provide your own Dropbear Public RSA-OpenSSH Key otherwise it will be generated
+            CRYPTFS_DROPBEAR_PUBKEY=${CRYPTFS_DROPBEAR_PUBKEY:=""}
             # Chroot scripts directory
             CHROOT_SCRIPTS=${CHROOT_SCRIPTS:=""}
               REQUIRED_PACKAGES="${REQUIRED_PACKAGES} cryptsetup"
               APT_INCLUDES="${APT_INCLUDES},cryptsetup,busybox,console-setup"
+              #If cryptfs,dropbear and initramfs are enabled include dropbear-initramfs package
+              if [ "$CRYPTFS_DROPBEAR" = true ] && [ "$ENABLE_INITRAMFS" = true ]; then
+                APT_INCLUDES="${APT_INCLUDES},dropbear-initramfs"
+              fi
               if [ -z "$CRYPTFS_PASSWORD" ] ; then
                 echo "error: no password defined (CRYPTFS_PASSWORD)!"
                 exit 1
               exit 1
             fi
-            # Check if specified FBTURBOSRC_DIR directory exists
+            # Check if specified NEXMON_DIR directory exists
             if [ -n "$NEXMON_DIR" ] && [ ! -d "$NEXMON_DIR" ] ; then
               echo "error: '${NEXMON_DIR}' specified directory not found (NEXMON_DIR)!"
               exit 1

General Comments 0

Écrire
Preview

Vous devez vous connecter pour laisser un commentaire. Se connecter maintenant

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Dépôts
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages