Raspi2-3_GenImage Commit - r126:1dfbb1fcf201 · Collaboration Tremplin des Sciences

Fixed: Remove SSH_*_AUTHORIZED_KEYS, works with SSH_*_PUB_KEY only

drtyhlpr -

r126:1dfbb1fcf201

parent child

Context file:

r126:1dfbb1fcf201

Collapse all files

README.md +2 -8

             ##### `SSH_LIMIT_USERS`=false
             Limit the users that are allowed to login via SSH. Only allow user `USER_NAME`=pi and root if `SSH_ENABLE_ROOT`=true to login.
-            ##### `SSH_ROOT_AUTHORIZED_KEYS`=""
-            Add specified SSH `authorized_keys` file that contains keys for public key based SSH (v2) authentication of user `root`. SSH protocol version 1 is not supported. `ENABLE_ROOT` **and** `SSH_ENABLE_ROOT` must be set to `true`.
             ##### `SSH_ROOT_PUB_KEY`=""
-            Add specified SSH (v2) public key file to `authorized_keys` file to enable public key based SSH (v2) authentication of user `root`. SSH protocol version 1 is not supported. `ENABLE_ROOT` **and** `SSH_ENABLE_ROOT` must be set to `true`.
+            Add specified SSH (v2) public key from file to `authorized_keys` file to enable public key based SSH (v2) authentication of user `root`. The specified file can also contain multiple SSH (v2) public keys. SSH protocol version 1 is not supported. `ENABLE_ROOT` **and** `SSH_ENABLE_ROOT` must be set to `true`.
-            ##### `SSH_USER_AUTHORIZED_KEYS`=""
-            Add specified SSH `authorized_keys` file that contains keys for public key based SSH (v2) authentication of user `USER_NAME`=pi. SSH protocol version 1 is not supported.
             ##### `SSH_USER_PUB_KEY`=""
-            Add specified SSH (v2) public key file to `authorized_keys` file to enable public key based SSH (v2) authentication of user `USER_NAME`=pi. SSH protocol version 1 is not supported.
+            Add specified SSH (v2) public key from file to `authorized_keys` file to enable public key based SSH (v2) authentication of user `USER_NAME`=pi. The specified file can also contain multiple SSH (v2) public keys. SSH protocol version 1 is not supported.
             #### Kernel compilation:
             ##### `BUILD_KERNEL`=false

bootstrap.d/32-sshd.sh +8 -20

                 # Permit SSH root login
                 sed -i "s|[#]*PermitRootLogin.*|PermitRootLogin yes|g" "${ETC_DIR}/ssh/sshd_config"
+                # Add SSH (v2) public key for user root
+                if [ ! -z "$SSH_ROOT_PUB_KEY" ] ; then
                   # Create root SSH config directory
                   mkdir -p "${R}/root/.ssh"
                   chroot_exec chmod 700 "/root/.ssh"
                   chroot_exec chown root:root "/root/.ssh"
-                # Install SSH (v2) authorized keys file for user root
+                  # Add SSH (v2) public key(s) to authorized_keys file
-                if [ ! -z "$SSH_ROOT_AUTHORIZED_KEYS" ] ; then
-                  install_readonly "$SSH_ROOT_AUTHORIZED_KEYS" "${R}/root/.ssh/authorized_keys"
-                fi
-                # Add SSH (v2) public key for user root
-                if [ ! -z "$SSH_ROOT_PUB_KEY" ] ; then
                   cat "$SSH_ROOT_PUB_KEY" >> "${R}/root/.ssh/authorized_keys"
-                fi
-                # Set permissions of root SSH authorized keys file
+                  # Set permissions of root SSH authorized_keys file
-                if [ -f "${R}/root/.ssh/authorized_keys" ] ; then
                   chroot_exec chmod 600 "/root/.ssh/authorized_keys"
                   chroot_exec chown root:root "/root/.ssh/authorized_keys"
               fi
               if [ "$ENABLE_USER" = true ] ; then
+                # Add SSH (v2) public key for user $USER_NAME
+                if [ ! -z "$SSH_USER_PUB_KEY" ] ; then
                   # Create $USER_NAME SSH config directory
                   mkdir -p "${R}/home/${USER_NAME}/.ssh"
                   chroot_exec chmod 700 "/home/${USER_NAME}/.ssh"
                   chroot_exec chown ${USER_NAME}:${USER_NAME} "/home/${USER_NAME}/.ssh"
-                # Install SSH (v2) authorized keys file for user $USER_NAME
+                  # Add SSH (v2) public key(s) to authorized_keys file
-                if [ ! -z "$SSH_USER_AUTHORIZED_KEYS" ] ; then
-                  install_readonly "$SSH_USER_AUTHORIZED_KEYS" "${R}/home/${USER_NAME}/.ssh/authorized_keys"
-                fi
-                # Add SSH (v2) public key for user $USER_NAME
-                if [ ! -z "$SSH_USER_PUB_KEY" ] ; then
                   cat "$SSH_USER_PUB_KEY" >> "${R}/home/${USER_NAME}/.ssh/authorized_keys"
-                fi
-                # Set permissions of $USER_NAME SSH authorized keys file
+                  # Set permissions of $USER_NAME SSH config directory
-                if [ -f  "${R}/home/${USER_NAME}/.ssh/authorized_keys" ] ; then
                   chroot_exec chmod 600 "/home/${USER_NAME}/.ssh/authorized_keys"
                   chroot_exec chown ${USER_NAME}:${USER_NAME} "/home/${USER_NAME}/.ssh/authorized_keys"

rpi23-gen-image.sh 0 -28

@@ -133,8 +133,6 ENABLE_ROOT=${ENABLE_ROOT:=false}
133	SSH_ENABLE_ROOT=${SSH_ENABLE_ROOT:=false}	133	SSH_ENABLE_ROOT=${SSH_ENABLE_ROOT:=false}
134	SSH_DISABLE_PASSWORD_AUTH=${SSH_DISABLE_PASSWORD_AUTH:=false}	134	SSH_DISABLE_PASSWORD_AUTH=${SSH_DISABLE_PASSWORD_AUTH:=false}
135	SSH_LIMIT_USERS=${SSH_LIMIT_USERS:=false}	135	SSH_LIMIT_USERS=${SSH_LIMIT_USERS:=false}
136	SSH_ROOT_AUTHORIZED_KEYS=${SSH_ROOT_AUTHORIZED_KEYS:=""}
137	SSH_USER_AUTHORIZED_KEYS=${SSH_USER_AUTHORIZED_KEYS:=""}
138	SSH_ROOT_PUB_KEY=${SSH_ROOT_PUB_KEY:=""}	136	SSH_ROOT_PUB_KEY=${SSH_ROOT_PUB_KEY:=""}
139	SSH_USER_PUB_KEY=${SSH_USER_PUB_KEY:=""}	137	SSH_USER_PUB_KEY=${SSH_USER_PUB_KEY:=""}
140		138
@@ -263,22 +261,6 if [ "$ENABLE_UBOOT" = true ] ; then
263	APT_INCLUDES="${APT_INCLUDES},device-tree-compiler"	261	APT_INCLUDES="${APT_INCLUDES},device-tree-compiler"
264	fi	262	fi
265		263
266	# Check if root SSH authorized keys file exists
267	if [ ! -z "$SSH_ROOT_AUTHORIZED_KEYS" ] ; then
268	if [ ! -f "$SSH_ROOT_AUTHORIZED_KEYS" ] ; then
269	echo "error: '$SSH_ROOT_AUTHORIZED_KEYS' specified SSH authorized keys file not found (SSH_ROOT_AUTHORIZED_KEYS)!"
270	exit 1
271	fi
272	fi
273
274	# Check if $USER_NAME SSH authorized keys file exists
275	if [ ! -z "$SSH_USER_AUTHORIZED_KEYS" ] ; then
276	if [ ! -f "$SSH_USER_AUTHORIZED_KEYS" ] ; then
277	echo "error: '$SSH_USER_AUTHORIZED_KEYS' specified SSH authorized keys file not found (SSH_USER_AUTHORIZED_KEYS)!"
278	exit 1
279	fi
280	fi
281
282	# Check if root SSH (v2) public key file exists	264	# Check if root SSH (v2) public key file exists
283	if [ ! -z "$SSH_ROOT_PUB_KEY" ] ; then	265	if [ ! -z "$SSH_ROOT_PUB_KEY" ] ; then
284	if [ ! -f "$SSH_ROOT_PUB_KEY" ] ; then	266	if [ ! -f "$SSH_ROOT_PUB_KEY" ] ; then
@@ -510,16 +492,6 rm -f "${R}/initrd.img"
510	rm -f "${R}/vmlinuz"	492	rm -f "${R}/vmlinuz"
511	rm -f "${R}${QEMU_BINARY}"	493	rm -f "${R}${QEMU_BINARY}"
512		494
513	# Remove root .ssh directory if it's empty
514	if [ -d "${R}/root/.ssh" ] ; then
515	rmdir --ignore-fail-on-non-empty "${R}/root/.ssh"
516	fi
517
518	# Remove $USER_NAME .ssh directory if it's empty
519	if [ -d "${R}/home/${USER_NAME}/.ssh" ] ; then
520	rmdir --ignore-fail-on-non-empty "${R}/home/${USER_NAME}/.ssh"
521	fi
522
523	# Calculate size of the chroot directory in KB	495	# Calculate size of the chroot directory in KB
524	CHROOT_SIZE=$(expr `du -s "${R}" \| awk '{ print $1 }'`)	496	CHROOT_SIZE=$(expr `du -s "${R}" \| awk '{ print $1 }'`)
525		497

General Comments 0

Écrire
Preview

Vous devez vous connecter pour laisser un commentaire. Se connecter maintenant

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Dépôts
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages