From b6c76f26664f40a017b6edfcfe3126febdac08c8 Mon Sep 17 00:00:00 2001 From: macmpi Date: Fri, 12 May 2023 19:10:20 +0200 Subject: [PATCH] trigger new keys generation if supplied key file is empty --- README.md | 2 +- headless.apkovl.tar.gz | Bin 4923 -> 5024 bytes overlay/etc/local.d/headless.start | 18 ++++++++++++++---- 3 files changed, 15 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index 23476e0..2da52eb 100644 --- a/README.md +++ b/README.md @@ -22,7 +22,7 @@ From there, system install can be performed as usual with `setup-alpine` for ins Add-on files may be added next to `headless.apkovl.tar.gz` to customise boostrapping configuration (sample files are provided): - `wpa_supplicant.conf`[^2] (*mandatory for wifi usecase*): define wifi SSID & password. - `interfaces`[^2] (*optional*): define network interfaces at will, if defaults DCHP-based are not suitable. -- `ssh_host_*_key*` (*optional*): provide custom ssh keys to be injected (may be stored), instead of using bundled ones[^1] (not stored). +- `ssh_host_*_key*` (*optional*): provide custom ssh keys to be injected (may be stored), instead of using bundled ones[^1] (not stored). Providing an empty key file will trigger new keys generation (ssh server may take longer to start). - `unattended.sh`[^2] (*optional*): create custom automated deployment script to further tune & extend actual setup (backgrounded). diff --git a/headless.apkovl.tar.gz b/headless.apkovl.tar.gz index 802c8a823e0bb149568c55d08124d8a270b3dfe3..c2a2dfd0f147b3f8521dc1f78a64db6b43c03c11 100644 GIT binary patch literal 5024 zcmV;R6JP8fiwFP!000001ME6!v!h0m{%U>&Zujhr&Ai8bt;dc*2oO3D0(8LagoFD& z#3}Ilzb{gEd)hs=J9f9-yA#nF@m>L$RA%K}sQlK2Kl_~lnSmzB$2h~g@$%3y#>2N*R*yGf}ho8+5Q&Y`|$sw;LrAd_WZ!^vi5stUgP(TU-z-= zHy@72-M|z<{5R}RP&ED-hM>lKeRcXUiCsS7c#P4MR8~JCnO;> z5;~kRGmP}mR8u`L)}7AptTb_Ho?Wa?Fz>C|UF3-JKHRUPR7-D#&c~YDVLaBsJIZaA z&}l_0>@A_U=k|8$JL=esCk7n|Z>!1OhU3R(aMFmM&k%casghiuH?e?8l?|ASir+> zW;p)hT2k zj6~y;tCUG?kKHM2p;ca?&2sGuV=Rol*Wwdv3&x~5wsFE2hQ#}Yv>T@586W-3aj;3> z>?YdseXsY7(vh=s6P^MQ3e*4b+g=n+RpR zbMr%a6Z7PfSudSjPtNHT4sf^6&kSNFmRjFZ1i4w|keQqG6m_^Gw9LxcZpWlC@a9|a z?*D(avnnq9r^vUx%x@at|Jr*$!T%QiDgXN(Mv^FduK^#5$0Ps$bKd`{{!=*qPW~q- z4EdD*KL$MAVIfGe0`65o(e)LmYVwIQ1aKpm4=mu|i_9q=wV}2yY3n7A`oJwDvUl?1 z{ZeppwzCf08@SgEZa3Wjx08#7t#t+tqhcIy`#TZ8IFQSzmnMe8P4%?GP)6fTuWu&G zthsu5b2M)U9m)`L{rep2c&As2p9oh2xP))d`ahi%xC_naUAAy{ff(MBV=c#>TI>@c z9Tay}v5>NF!*Gh*p700}U8Z}9anxbyh3qkKE;nHvVGuB>Row86Dz+jrk$k))Z^T_b zakcIpT;t61ZLrT|wmnCgdDa^1qDuUcf_W!N;|4=>P`}TixxWC)~ z5h(E~{yzrX`@h#FfAoO-s~#}3mNKds0(pNXi@)srzvTO$`h8?>;EEq)PL_$soerlq6cc2U%nHX0yi9!!LCe&C-%xHj*wY+1I|Pa zv$a}slU6s0(-ru837>aqXDW7lp zvRuZdC0IKP3Cr}dZNs+ir+u;I;7o(20B}ucL~Hlt&|S9OWr5=ES306^x0)(L{kF3cc`A#)&(muu9fw7$OS zo>_V_8L6X2b%)E!SvthFzbV8v&RJbalT?~oy&QpMM&WTi@P%DLDjptnhlV1Wt5m`& zuPZ&Xqk^)w;W06cOg(Bh)Kt~B^UUnBv}Fow>dbP22q3SX!;P24u8ejy?syD*jsyld zV=3wl$6Hubw`8|N#g-|mGsZSZoa`X%QWOq;q@;0us%7zV1A=0ry=B)PbZ@mdLI`K% zuw`ywwr*D&_lnZ#P;{9dhPU@_ZR~2be!#WLl!trpH+v*pgYVNHS(njHM{M zv%OoN`ARgM7Q1bO1vZXMNee7}Z_K943@MJtB~3CUPu{G>kv6wB%}muesN^wda9mR7EP;z>hz2TsT3@EiGD2D* zCQ6RWchR(7bDm4c+rGu1uCYv6bE{(t!G^x0cC=X%TdtlYa-U0q3LMTW!tC?i zUKFX)vGz#p9*gs4rSDCHN&Pw%Z`goAJk1zBPgMOev1D@5(8ud8B>k4SGF*jSfgoWC zQOF^<^oNZBN%kf}s&i>UxlV}koLdc4aJ}<#qMhQrJ`GsBZ|es_O?fR`sN=d9DK5Oq+f*G=rL#7Qt=BB}Q5 z-YzWNLcn-k+Y)PUAm19Lk;fC4SRR7R;kn-tfjYN9nB5hwW+lDw2i zNEzMI^2#U;K<9XyONDz|PCiQeVj$d*B;CArVG5|C>3iiBy5p>k%@{;Wschv zKJ}vO=^DOspC*%N!P$hC4%~|Le1P_bf=vjP5oO#-+b+~ZYhX0ll#<$FNf%v> zY|>4OYPD13Ij3DFOXBzl3NB*Y>kV}UBqgFOVOR=_X1mOf+slYHmIEIK8xAHbnJgJy z)FFNBkwfU4fkiLZ7YypNWVx&$JPdT}?i4_e`uX`(1*nP9!a|S{TaOW$Sl(oJoQjQs zrQV8E3EK(Wo2CZ*b>y8B=D<TlSbhD;#riy~KK9 zXGl7$FHh2{CsFfo?GcHfuJ)>ARHm`6#R4DA^FB^JV12Y4=zMc@5~DGtl4RSb+_JOE zrLoWAuH8oY+K4-3u{}j0Pvp6VgodA%MySbUZn12#Vp<>IRHV;6$*f2McIXv*Eji+} zfFq-~Lyn;q-kQ5@t8njTyR<7G1@^FH`;~DxZz8s?mBCo$1R&|fAqWM$Zcff3=l7?h zqM$qY;6tq`*U$|*L)AQwypv^h!P3}8@KIt*ZUrrD59bKtF6)FO0NSxH0mQAZFXuB|C!`o_I73vOH zdGJ)lgFRJ7u{ta_rFktIa%dRND5ili$i`h#xdt@}svQa;PdN_5hMG9@`B~=9*X6}x z5*eu0_*&+|i%cIWriRzr+|lSPZJe&nhGMbSUIp}`(oDM-Lbhpk-d1Il%a~=%igdJU zZj31Lhy#aFSRV>1z}N7-+gfO&gR#g#5*t^_I!i}O>nx^@bei1Z|Ig=$PwWg z*Up~3-|aWx$M3)IJ^w*qG(n^HgC7WrQsk%eA0GwYw*Q;YHP3gIe89#2w*65Ar|5s! zA0_Vle-i(6{^O&-mtVk6T)<5P0AGT9S&elZMlFaT7zRGw2mH@qZo7FE&v;#3UY@qG z>lcmxBzu0*#zE}Y{|@eC0{~8frptTf+ZV_)_2NFA=6iANyDiwXUfH#vU3j2h*Ja&+ zZ3((%(Uh4F+6`E{&kr92z0z;MqHMve3}^DOjp8B%{G0EB=y$N^_wbvyu z^lR{`X~CC2AYXp@HT)y^f_r>?1h;X~-M}|K4c^Z-HEnHIVE^*9q@XjtUfV2gp3cI8 zaGO`~^Gr4?r0lcGZliBs{s|1?S#&s`*JFcExqb8es*S)|L+x1kpa(wP3Bf;p4L^VV z$N8r2X8up*YjglU6?X1}Uq9PbI#2pMJKS?PflrTh&0HVYAASV?;~Vfl9|D6_2=ac;@I6ue9P>+rfS)z~ z`^CGv*iRw`F>u$w7vNhW5ya0#`iHJwOH#a2;#-I}n)&k10(^a}GWMyrKzqSsge0$o*i?6icdw&LH~!3WCj7%6{)RlUfB*W&`HdMdi}clf zxRbQtU;gqW>_zaq?|w}yuSo4~j`x@IWUp@H$BJLRlES|Sds#WQn*y)U^Ng=9zWL_A z+PSjcwv8a%SMgVD?ZP=)DI%#OA>fCkNs*!rAf(7!3xgt85*vzSct{b@AD?e_c^|Ue zDnfy90mIUsvoo{be6yrYzj?el`-=9)3ffoOyQY^eCyvC4e#ib|H#h7O0w&S&?COBq z$Brf27z)m7NO+@;M-y!{9%;|CNzuACW4<>Jd8=9yv?-Ys4Ac4UP99Owg)mQI7J|(4 z(QH1_G>v|`o5%FisuUiX7CElR#bM^w#%EU_B02^u-*x>xeexQ(XIv>HX_w~Gd1}wH zuCguB(-IO>$v&{*FSQnB9rAz;Kd~!vt4`=3*Lk?Jm7u;B6C~o7+S4VSA{rFoAm-Zu zXcHb7Wqqm69~0Z5AnbTQ0kv2Fc)$$y6B@VYECD)1h)IAO4_dJqK*bMY$M;P4z=F`< zIW}rP@`DKV=FWF)w&orWP3pv;bpdoDdYL=UVh8HVLWLiIU?2cnfz(L)e9FF~%{%MX z%8?J^l8>M|5L#+)RLGu6%jv02sSI8wgy}dMLh5%wBHt!{0zVrpc(`@qH`^dSEK==6 z>_7)jw!FvwekTRW%2%d`-Iw{rv!$p~M+lgylqS>WydR?7Vtc7a1~1#`^> ze9{Q&Ri1IxTr(5qD9e$!lBtlmmk?qVLL4YfM%h!mYw#9p{|3#L_uBRz#(iDWN481| zi!E!H+#kJ!6t)wYOPA9?nB-PCsTeOA)HOxrkAiV>@^RW^W^ic>I`y!wkz16J!G$iM zc)_l~@>VH#&NNV>&uWbyKdRXSOj<7e56f_Llv!pFZaaNP8FcYKxIsl&LOc>!+DvZz zn9=i%R|np&@gpjiHbdB=$W^BAgk1%9UyugK8c-+PKfrc}mdi~q38yAU*cwWe+-cfqQr4CS@4RN~+X>Kh==!D&dDeG`13XN*OsNyX-jX*vSkRD7 z9!JuqX|Ckv#pw1M7)6|)MrM|HW*l=50d^E^N;z36rJ7Ht$A$>2SL!gjS;?9yH@oRN zAuYorD|7O^k0X6J<>LWs!wSm6b zkDt5!SLD{6t^H+oR%*WcRn|D|?|&xRT%S*7WAsxseLm~&e=kvvVAt8!5buA@y5IlQ zRlQ_?UA+H2o%Z*?mni@B()XG&HcBOYaS7#zG5hextKl2+BDz{woAw&N;9@+_`iRCX z9J+;aM4l~4eZ*4dqlP=Wg1F_TF`F3L%HYop^@Z_b!UW9|ZL66vn;RB4mbzh$4Q}?B z{%=YP!8!XH55j*9^{TE;)gJ#ZQSKqQXIbN3{MY7%{Z;w?|D=Ea|03mofd81njeHjJ zPl*#ETeV|<$3xdV+}e9fV@^~oksv#^R_jsxIi@SeG{eLbgC@Ke>p@`NVVi zj=RxUdIRLN_dm-2|3TAx{J%`8+CRORII|x--2OVzh2H)bDDCza_fcnCL-N1*>Gs#g q+;i^P?}ecC;4gk>KxUvx@-fcv{`j~?35>!} z6sIWc3j{@Q9Qy(!e{aF=&^4`7gWwl+S+@U(?nC&0QV3@IKl?%GbXoh_o!9uf3FBW|E@XU5&!gu;vXk)97i#Pn(dFG82LH= zKLxzA|NQqlE}Qms-8iq)V0^AR_ha$+K>VW!O}%G-@;-cy|4#t3-JfQYgX|1TT%8;a z9X*V{|6H+qc6q-Y?N>`fTVAsW*+v8|pSNV<3vD1r3bBm>PggJk`P-0h*chPPgr+RuT3@*{V4&$&6Rw%Do zK}U&J7q<(&J+-%E-%*EVJTmA&_*-4>HY~fo$lhq|rSp#CXxi`VT0C+5d2?KAJ%U_z zmmRj*al?kWb!HV8*ooNd6C%WrxFs*ESP!luX0~!6tkEP!E;$dcr7OAg{6_7g4(9Qw z+qkHV8N0o^LpK+Bcdmm?&u;u{LBPRMU-vyFHCzhEc~bhD<5di+v|Adgx;rd%NjgRh zgpp`+^wjcFJ7aguT1d((v{|h^eoXkW_gj2gIJ`OOu45kYr73bjAu7XkIN@WExh^&t z8)c&HAn<$NEL}M}HPJB?pipa(9fdB}h$oozez|iO_bAoQ}(2zkwR^dJ~|G zb8kT;ZxW7NG3%9^8<$ghg+tuy^Am$u7h9`uDT3VWa>%SrdW<{VNHF*k}9<`yi&uQyl9`%7;ie&HR zhx;Y(=8MkWv+v+uH&|u3|8FM`i(2~x>_^o++;(>&Zn-B{aW75`i(A@J!ca!%EWd9i z%BtCVb#rxJf%attdBJ^-b)p!R8eI6R37n&!&-y=|6u1k`0$V76bKSYN$mfR;{RjyfFIib&Efuj z|3{$2=lK5=aPR-#n*7lNa&LOT%wEZ;YVzd$o-F*j^Z%Off9@0hx!||_2kJkG zkl6e6pFrr(@&75{cdY-*>{0*yN2T@(K#d=$VSe~dXz}cDxC~BZsT{FWM`47l!XI!Z zcA2f+lAE-;iL9Y=H^Qn@8uev}55g1>?2{}XN^wQ<1v0v6bP;VC-wpj%{$Z?Uw(IDxEzIGnF>o6^Sm zX82a=%VeyLI@RsZlDl$=ZGTgVZIUkxHNB+b)EeaotTGBu>VYeq3excCV7N3C(`=;? zc6pVI%!v!i-bROuX=d6%zoC|6^<8#6FO@P@YTWf1_!RRD za>7#79}c&usBRZUL4}qnsuQ+okmRC3*tsZN{6LB0`dG`t`38i=MEk3*-5b8NJU|F* z=5XL0^zBXK&Yay5j+AnJy>l8ptoAu`E;+7@x;@P8F)}UDYSZHj9N3asuZl8eQjD#t z%E?jIC$17Kx5aMTaEXm0Q_}o`zPC$>svQPMGEqf~e|Z)G+?`EavWg%x;`OxJcdLsR z&pX#O?y0bRf;r3$jB4ZQ5r5e?fw&=ei?gA{Qb8_H$Al9$%Lvke^+L%>S-$0lIyGB_ z_s`54nLS8o4iUu?xu}b#=*ye6Fw)l6p_!=~2aP<04UUW2oF#DK1kpfcOzZP>Ud2eu zCq&7zxe`z7HS2qXyzN^I>KfaUb+0<45NsL>rO;MMY}tAe$z3jnwi_=c4cMO~!s>Hn zCkRyO+B+oi4#jCB89U2l(x6U-8#Z7NM>A%?5mkS<*fP0n=)+Zs$e<;z3|nDWAiOLH zfzKhh42F#fiOwcQs#9r0xj_i>oLfzl_x#gpqTS-OJ`Py2YwHbpI^jg%6sJMS26H0= z=4OH6p@x>arV4GPo;^Xa)|6*WD^+*HHFa!zSCz|2YcrC>7U(W+lA|*&kIb25Abd~P z2fhIG;i$DNPxg2r@CIWJ*^s-P7?W&GO?l0qsl&P#C^ovv+f*A;wX-*>W7G@SA0gYF z^h8ae9uQ5_6!HsqjIR1gr2WRg2fu0h&F-cJkDQ{+`Q_mj?8(PZL>fv&haFOkS>>VQ z-OdZTg@Ez8cEp9VfdYFJM-HDjn?LkN^*qI>Xsk9%K^?{ZWKnFFY8SoniR6+`5y^=c z5h>$aT3#8o0q7iWbFuJlt0_R~KnVF8a@lvCYWXrcM(GmoSW3g1GYQ*dP-KGYP?_sB z1-YxPG=*&V$%$iN$7qXjoKj_joO?tb5Mj5?Yh%L-D2kR^E6aS_FBNh->^xJ_u3Lr} zG3J^~%w%+;)*J*aM@>mUyY{1?i#E zxVUuFvXT^4o^#rHvPG7Qq3|puz0putKvZMO=7$x(Y__ZXusx4xW4rKvaNuyVFOw~! z%Q~VDJ+hAiE41m=`iwz+c3G_|2#-R;zB>ibqd|T;Rv~I(G{59!#4!>?CRR7u8>eDp zVyQ2Y8sWI1chj|yyN;ZD#9TNodWxb15uH3jRe=>Po*}HDO1PdFf4ewbAPL7j+$gc0 zS4`1Z7^|Zw^(1QTuRS6X)YXwnMq?WLS}gI=I_;9w2i6DMg-$ouATb(KD^Yd=$}2m& zT$#Hp>Dq0aug#=GmfK?-aYUZ$NMr_SX-2wS=JsN7k(f3BSPkiOU$iQcfL&TzTuYWX zF5%ehorq{`2Z!hBDQ%R4vIdcdi=_TN7iM)OPpRwZh*U3ZF_?^;Q9}%3ACe zQ|g*cvwj>Q$nGamQ1wAlz55CFTs0KV+38*C=tY*0RSmltA&_FUK*gy%G3N`61CfqS z!noiUmz2-1R&b`>eM92cWdNx#l~?_unm9ft1J^%>Rb|<;hXzw>H@XtVi|8h;t3p!% z$%m&Z8Jwvy3u(XFl-9Lu$f03avzP|PBpYu<zUdCIaFHq^w4%TF?Ux~|SP zbCH2+jjv@kI?MEdVrqD;&mE1ipv~j8*-#6tb)=A9R=VZ%e6(m9#oua-dLFZkkw{ms z=EjH;4mhwM`Sre_LVOM1yRD@@y4V8Qi$ddxS!Ww)X`h7D6_1lQ{Qo(Q_za&I?)$&2 z^qlP3|J~jJKi>a-@cRz}qX~?}vB&#giX=Y2|NRv3bNjzLu6e$zKTGv3fv=cjGr1w|7) z$$n6@Ntgunzk-Tv0>F{i4SA=2_Y!%gUf!qE13#$)uLYadFS{0W3LgyWx~v|ec=6m-Y8Yn#Q*(^*&$Zu1I$ zp2=o~lzmn?ZT#JK@9FLLTl1a3uZswL1oJ%EY`&oF zDo_pDp{!FdDcYc(cS}J7Bq8`$@F@gezWU+qqJM;c$>(|2d-xLk+qYmF2L}GWM%C{zqJmv{Q0zx2j6HR@c#_DU6T28(EN%7&(F`ZJ?=g<2hw~W zeD$ZS0pVtBU@vo;=Dw(}ffs%Wym;X`O)#^Z3IFhizameIzkT!L{KSlyMf&6HC$NQ^!vNu1I$BJLQks`PUds(@TmjZ9l^NepUzWw$-2JL^g zZ*4tl8&SBg_*YCxwN29EfXzZ;X&-W{Qnis#s=T#Y4fbHBH6F(o2>(9cnK9Ua*^5fh zM)8r*vU5Fi=A7?*GdA;+<@8q09TIo+JN6H|xM1f{u*jw-HwWB4m%gcE z5X5Urcr)nRL&xsh&NF9N)rLG5E56>=4r+=XYGxF}a4K4w5Y#3xBRy_hUw3FjG;aR`e}Cz&)>Pk*3EiSB|syEUUX&5$W9$5E&#LQqi8(6#HcQ_*! zc7KXwRa2FFUU`n*XPyeSP)k%`%^zOA*E7RQC@-$rO2t28(}m7$BET>!N$id#uojPD zWmfKP1bBf5#$tthh~QXBq-5F$>RtMffF~}NJG*9{UOpw;Jl$Eejk#p}FY(Zgi!vXq zUoDK@kFl$8=Y{6ITLqsSP=Z~S(mkAWqs)yQ$)M84gv8vm60;QQz-T5%-^DjO?=bft zuxx#;O>c4B*0g-!YZ*`_{H&8milB-?P6*G4L4Xj$j0yVp{7CS)NT`~=g4~0+Zw!Yu zCdlj{Gnol?k>@Z#cHBpI#_UwblV)?iriK`>S0u)CdtR{v4@WGy>9UUz4N*u46^Lky zP}_oicAG9(FKq;LU3WBDZ|b%wWLvUOL4hdkMT!T|C%gt4iL}h9wMGEnsW@!l!$JW9 zM{8RiwhTk8dNc2Sv>DT*QERJDb-|1~p=jGyhFp^seueq4!}SJ3RQY3#-%Y z4-MTjKa~lR882dgZqNyuG9sK|s?Pv~L~Qc=8}|24bYh_pXde9y0EzubZ4745VQ==! z=i~mXPk2XbAHtRDp4WVpIrJsZt-t>mI%9V{9QDy|;JD*ad;fP1xdAm!Hiv%yXLS7i zKX>5P_TSa-|6X3U_kZV*|9k28h!{JOL8UJtRGPDof4%CxB`>0*WypgNf8b(b%le5x zOeEbxNPW&Sv@Bz#^HIe$9YL=I_eMj{nR(*5H+bQ_7&6URblq&^jmDlYys7K?eNXU* zfTrJ`G*F9^&v7sOcThfX2bY5u|IZ<}P|K6daV!2i<7)p0=Kb&X`OkUe0pLG|h%&`e z@u`q0&WS;;mLiS#`YKrY4wG3mMS*jvKMU>rb52)I<=GDZSr)amO4of5%=+69eK}ji zkywf-`$}&B-0k^){rCTl+v5LuWOx6|D}fXH!TtB&CA!e={~4rt|MgAK$>uQpZ+!Rt tcl!OI`vY_It(1&q4pwqnl`8qp_rH}^T4|+~R$BS~TcL^=Ra000nD&d~q> diff --git a/overlay/etc/local.d/headless.start b/overlay/etc/local.d/headless.start index e7c783e..9ca648b 100755 --- a/overlay/etc/local.d/headless.start +++ b/overlay/etc/local.d/headless.start @@ -94,10 +94,6 @@ cat <<-EOF >> /etc/ssh/sshd_config Banner /tmp/.trash/banner EOF -cat <<-EOF >> /etc/conf.d/sshd - sshd_disable_keygen=yes - EOF - # banner file cat <<-EOF > /tmp/.trash/banner @@ -115,6 +111,20 @@ if ! install -m600 "${ovlpath}"/ssh_host_*_key* /etc/ssh/; then HostKey /tmp/.trash/ssh_host_ed25519_key HostKey /tmp/.trash/ssh_host_rsa_key EOF + cat <<-EOF >> /etc/conf.d/sshd + sshd_disable_keygen=yes + EOF +else + # look for empty key within injected ones: generate new keys if found + if find /etc/ssh/ -maxdepth 1 -type f -name 'ssh_host_*_key*' -empty | grep -q .; then + rm /etc/ssh/ssh_host_*_key* + logger -st ${0##*/} "Will generate new SSH keys..." + else + logger -st ${0##*/} "Using injected SSH keys..." + cat <<-EOF >> /etc/conf.d/sshd + sshd_disable_keygen=yes + EOF + fi fi rc-service sshd start