* [PATCH 1/4] openssh: Package server configuration
2017-01-23 14:55 [PATCH 0/4] openssh: Make sshd-config a package David Vincent
@ 2017-01-23 14:55 ` David Vincent
2017-01-23 14:55 ` [PATCH 2/4] core-image: Set default sshd configuration David Vincent
` (5 subsequent siblings)
6 siblings, 0 replies; 24+ messages in thread
From: David Vincent @ 2017-01-23 14:55 UTC (permalink / raw)
To: openembedded-core
Split sshd configuration for read-write/read-only rootfs in two distinct
packages. Also, add a package dependency between openssh-sshd package
and a provider of sshd-config.
Signed-off-by: David Vincent <freesilicon@gmail.com>
---
meta/recipes-connectivity/openssh/openssh_7.3p1.bb | 47 ++++++++++++++++++----
1 file changed, 40 insertions(+), 7 deletions(-)
diff --git a/meta/recipes-connectivity/openssh/openssh_7.3p1.bb b/meta/recipes-connectivity/openssh/openssh_7.3p1.bb
index 94eb0ed208..c02bb7d450 100644
--- a/meta/recipes-connectivity/openssh/openssh_7.3p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_7.3p1.bb
@@ -92,13 +92,17 @@ do_compile_ptest() {
}
do_install_append () {
+ # Create default config files
+ install -m 0644 ${D}${sysconfdir}/ssh/sshd_config ${D}${sysconfdir}/ssh/sshd_config_default
+ rm -f ${D}${sysconfdir}/ssh/sshd_config
+
if [ "${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'pam', '', d)}" = "pam" ]; then
install -D -m 0644 ${WORKDIR}/sshd ${D}${sysconfdir}/pam.d/sshd
- sed -i -e 's:#UsePAM no:UsePAM yes:' ${D}${sysconfdir}/ssh/sshd_config
+ sed -i -e 's:#UsePAM no:UsePAM yes:' ${D}${sysconfdir}/ssh/sshd_config_default
fi
if [ "${@bb.utils.contains('DISTRO_FEATURES', 'x11', 'x11', '', d)}" = "x11" ]; then
- sed -i -e 's:#X11Forwarding no:X11Forwarding yes:' ${D}${sysconfdir}/ssh/sshd_config
+ sed -i -e 's:#X11Forwarding no:X11Forwarding yes:' ${D}${sysconfdir}/ssh/sshd_config_default
fi
install -d ${D}${sysconfdir}/init.d
@@ -111,7 +115,7 @@ do_install_append () {
# Create config files for read-only rootfs
install -d ${D}${sysconfdir}/ssh
- install -m 644 ${D}${sysconfdir}/ssh/sshd_config ${D}${sysconfdir}/ssh/sshd_config_readonly
+ install -m 644 ${D}${sysconfdir}/ssh/sshd_config_default ${D}${sysconfdir}/ssh/sshd_config_readonly
sed -i '/HostKey/d' ${D}${sysconfdir}/ssh/sshd_config_readonly
echo "HostKey /var/run/ssh/ssh_host_rsa_key" >> ${D}${sysconfdir}/ssh/sshd_config_readonly
echo "HostKey /var/run/ssh/ssh_host_dsa_key" >> ${D}${sysconfdir}/ssh/sshd_config_readonly
@@ -135,30 +139,59 @@ do_install_ptest () {
ALLOW_EMPTY_${PN} = "1"
-PACKAGES =+ "${PN}-keygen ${PN}-scp ${PN}-ssh ${PN}-sshd ${PN}-sftp ${PN}-misc ${PN}-sftp-server"
+PACKAGES =+ "${PN}-keygen ${PN}-scp ${PN}-ssh ${PN}-sshd-config ${PN}-sshd-config-readonly ${PN}-sshd ${PN}-sftp ${PN}-misc ${PN}-sftp-server"
FILES_${PN}-scp = "${bindir}/scp.${BPN}"
FILES_${PN}-ssh = "${bindir}/ssh.${BPN} ${sysconfdir}/ssh/ssh_config"
+FILES_${PN}-sshd-config = "${sysconfdir}/ssh/sshd_config_default"
+FILES_${PN}-sshd-config-readonly = "${sysconfdir}/ssh/sshd_config_readonly"
FILES_${PN}-sshd = "${sbindir}/sshd ${sysconfdir}/init.d/sshd ${systemd_unitdir}/system"
-FILES_${PN}-sshd += "${sysconfdir}/ssh/moduli ${sysconfdir}/ssh/sshd_config ${sysconfdir}/ssh/sshd_config_readonly ${sysconfdir}/default/volatiles/99_sshd ${sysconfdir}/pam.d/sshd"
+FILES_${PN}-sshd += "${sysconfdir}/ssh/moduli ${sysconfdir}/default/volatiles/99_sshd ${sysconfdir}/pam.d/sshd"
FILES_${PN}-sftp = "${bindir}/sftp"
FILES_${PN}-sftp-server = "${libexecdir}/sftp-server"
FILES_${PN}-misc = "${bindir}/ssh* ${libexecdir}/ssh*"
FILES_${PN}-keygen = "${bindir}/ssh-keygen"
RDEPENDS_${PN} += "${PN}-scp ${PN}-ssh ${PN}-sshd ${PN}-keygen"
-RDEPENDS_${PN}-sshd += "${PN}-keygen ${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'pam-plugin-keyinit pam-plugin-loginuid', '', d)}"
+RDEPENDS_${PN}-sshd += "${PN}-keygen sshd-config ${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'pam-plugin-keyinit pam-plugin-loginuid', '', d)}"
RDEPENDS_${PN}-ptest += "${PN}-sftp ${PN}-misc ${PN}-sftp-server make"
RPROVIDES_${PN}-ssh = "ssh"
+RPROVIDES_${PN}-sshd-config = "sshd-config"
+RPROVIDES_${PN}-sshd-config-readonly = "sshd-config"
RPROVIDES_${PN}-sshd = "sshd"
RCONFLICTS_${PN} = "dropbear"
+RCONFLICTS_${PN}-sshd-config = "${PN}-sshd-config-readonly"
+RCONFLICTS_${PN}-sshd-config-readonly = "${PN}-sshd-config"
RCONFLICTS_${PN}-sshd = "dropbear"
RCONFLICTS_${PN}-keygen = "ssh-keygen"
-CONFFILES_${PN}-sshd = "${sysconfdir}/ssh/sshd_config"
+CONFFILES_${PN}-sshd-config = "${sysconfdir}/ssh/sshd_config_default"
+CONFFILES_${PN}-sshd-config-readonly = "${sysconfdir}/ssh/sshd_config_readonly"
CONFFILES_${PN}-ssh = "${sysconfdir}/ssh/ssh_config"
+pkg_postinst_${PN}-sshd-config () {
+#!/bin/sh
+if [ -e $D${sysconfdir}/ssh/sshd_config ]; then
+ rm $D${sysconfdir}/ssh/sshd_config
+fi
+
+# Make sure destination directory exists, before creating the symlink
+mkdir -p $D${sysconfdir}/ssh
+ln -s sshd_config_default $D${sysconfdir}/ssh/sshd_config
+}
+
+pkg_postinst_${PN}-sshd-config-readonly () {
+#!/bin/sh
+if [ -e $D${sysconfdir}/ssh/sshd_config ]; then
+ rm $D${sysconfdir}/ssh/sshd_config
+fi
+
+# Make sure destination directory exists, before creating the symlink
+mkdir -p $D${sysconfdir}/ssh
+ln -s sshd_config_readonly $D${sysconfdir}/ssh/sshd_config
+}
+
ALTERNATIVE_PRIORITY = "90"
ALTERNATIVE_${PN}-scp = "scp"
ALTERNATIVE_${PN}-ssh = "ssh"
--
2.11.0
^ permalink raw reply related [flat|nested] 24+ messages in thread* [PATCH 2/4] core-image: Set default sshd configuration
2017-01-23 14:55 [PATCH 0/4] openssh: Make sshd-config a package David Vincent
2017-01-23 14:55 ` [PATCH 1/4] openssh: Package server configuration David Vincent
@ 2017-01-23 14:55 ` David Vincent
2017-01-23 14:55 ` [PATCH 3/4] rootfs-postcommands: Modify ssh-related commands David Vincent
` (4 subsequent siblings)
6 siblings, 0 replies; 24+ messages in thread
From: David Vincent @ 2017-01-23 14:55 UTC (permalink / raw)
To: openembedded-core
When selecting OpenSSH as ssh server provider instead of dropbear, also
install the correct configuration depending on whether the final rootfs
is read-only or not.
Signed-off-by: David Vincent <freesilicon@gmail.com>
---
meta/classes/core-image.bbclass | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/meta/classes/core-image.bbclass b/meta/classes/core-image.bbclass
index 8431440db4..d1f643d920 100644
--- a/meta/classes/core-image.bbclass
+++ b/meta/classes/core-image.bbclass
@@ -41,7 +41,7 @@ FEATURE_PACKAGES_tools-sdk = "packagegroup-core-sdk packagegroup-core-standalone
FEATURE_PACKAGES_nfs-server = "packagegroup-core-nfs-server"
FEATURE_PACKAGES_nfs-client = "packagegroup-core-nfs-client"
FEATURE_PACKAGES_ssh-server-dropbear = "packagegroup-core-ssh-dropbear"
-FEATURE_PACKAGES_ssh-server-openssh = "packagegroup-core-ssh-openssh"
+FEATURE_PACKAGES_ssh-server-openssh = "packagegroup-core-ssh-openssh ${SSHD_CONFIG}"
FEATURE_PACKAGES_hwcodecs = "${MACHINE_HWCODECS}"
@@ -52,6 +52,7 @@ IMAGE_FEATURES_REPLACES_ssh-server-openssh = "ssh-server-dropbear"
# IMAGE_FEATURES_CONFLICTS_foo = 'bar1 bar2'
# An error exception would be raised if both image features foo and bar1(or bar2) are included
+SSHD_CONFIG ??= "${@bb.utils.contains('IMAGE_FEATURES','read-only-rootfs','openssh-sshd-config-readonly','openssh-sshd-config',d)}"
MACHINE_HWCODECS ??= ""
CORE_IMAGE_BASE_INSTALL = '\
--
2.11.0
^ permalink raw reply related [flat|nested] 24+ messages in thread* [PATCH 3/4] rootfs-postcommands: Modify ssh-related commands
2017-01-23 14:55 [PATCH 0/4] openssh: Make sshd-config a package David Vincent
2017-01-23 14:55 ` [PATCH 1/4] openssh: Package server configuration David Vincent
2017-01-23 14:55 ` [PATCH 2/4] core-image: Set default sshd configuration David Vincent
@ 2017-01-23 14:55 ` David Vincent
2017-01-23 14:55 ` [PATCH 4/4] ref-manual: Add SSHD_CONFIG David Vincent
` (3 subsequent siblings)
6 siblings, 0 replies; 24+ messages in thread
From: David Vincent @ 2017-01-23 14:55 UTC (permalink / raw)
To: openembedded-core
OpenSSH configuration is now a symlink which points to the desired
configuration, so the functions that modified it must be updated to
modify the target and not override it.
Signed-off-by: David Vincent <freesilicon@gmail.com>
---
meta/classes/rootfs-postcommands.bbclass | 28 +++++++---------------------
1 file changed, 7 insertions(+), 21 deletions(-)
diff --git a/meta/classes/rootfs-postcommands.bbclass b/meta/classes/rootfs-postcommands.bbclass
index c8f18c6702..2d862b0b2e 100644
--- a/meta/classes/rootfs-postcommands.bbclass
+++ b/meta/classes/rootfs-postcommands.bbclass
@@ -86,20 +86,8 @@ read_only_rootfs_hook () {
# Tweak the mount option and fs_passno for rootfs in fstab
sed -i -e '/^[#[:space:]]*\/dev\/root/{s/defaults/ro/;s/\([[:space:]]*[[:digit:]]\)\([[:space:]]*\)[[:digit:]]$/\1\20/}' ${IMAGE_ROOTFS}/etc/fstab
- # If we're using openssh and the /etc/ssh directory has no pre-generated keys,
- # we should configure openssh to use the configuration file /etc/ssh/sshd_config_readonly
- # and the keys under /var/run/ssh.
- if [ -d ${IMAGE_ROOTFS}/etc/ssh ]; then
- if [ -e ${IMAGE_ROOTFS}/etc/ssh/ssh_host_rsa_key ]; then
- echo "SYSCONFDIR=/etc/ssh" >> ${IMAGE_ROOTFS}/etc/default/ssh
- echo "SSHD_OPTS=" >> ${IMAGE_ROOTFS}/etc/default/ssh
- else
- echo "SYSCONFDIR=/var/run/ssh" >> ${IMAGE_ROOTFS}/etc/default/ssh
- echo "SSHD_OPTS='-f /etc/ssh/sshd_config_readonly'" >> ${IMAGE_ROOTFS}/etc/default/ssh
- fi
- fi
-
- # Also tweak the key location for dropbear in the same way.
+ # If we're using dropbear and the /etc/dropbear directory has no pre-generated keys,
+ # we should configure dropbear to use the keys under /var/lib/dropbear.
if [ -d ${IMAGE_ROOTFS}/etc/dropbear ]; then
if [ -e ${IMAGE_ROOTFS}/etc/dropbear/dropbear_rsa_host_key ]; then
echo "DROPBEAR_RSAKEY_DIR=/etc/dropbear" >> ${IMAGE_ROOTFS}/etc/default/dropbear
@@ -138,12 +126,10 @@ zap_empty_root_password () {
# allow dropbear/openssh to accept root logins and logins from accounts with an empty password string
#
ssh_allow_empty_password () {
- for config in sshd_config sshd_config_readonly; do
- if [ -e ${IMAGE_ROOTFS}${sysconfdir}/ssh/$config ]; then
- sed -i 's/^[#[:space:]]*PermitRootLogin.*/PermitRootLogin yes/' ${IMAGE_ROOTFS}${sysconfdir}/ssh/$config
- sed -i 's/^[#[:space:]]*PermitEmptyPasswords.*/PermitEmptyPasswords yes/' ${IMAGE_ROOTFS}${sysconfdir}/ssh/$config
- fi
- done
+ if [ -e ${IMAGE_ROOTFS}${sysconfdir}/ssh/sshd_config ]; then
+ sed -i --follow-symlinks 's/^[#[:space:]]*PermitRootLogin.*/PermitRootLogin yes/' ${IMAGE_ROOTFS}${sysconfdir}/ssh/sshd_config
+ sed -i --follow-symlinks 's/^[#[:space:]]*PermitEmptyPasswords.*/PermitEmptyPasswords yes/' ${IMAGE_ROOTFS}${sysconfdir}/ssh/sshd_config
+ fi
if [ -e ${IMAGE_ROOTFS}${sbindir}/dropbear ] ; then
if grep -q DROPBEAR_EXTRA_ARGS ${IMAGE_ROOTFS}${sysconfdir}/default/dropbear 2>/dev/null ; then
@@ -162,7 +148,7 @@ ssh_allow_empty_password () {
ssh_disable_dns_lookup () {
if [ -e ${IMAGE_ROOTFS}${sysconfdir}/ssh/sshd_config ]; then
- sed -i -e 's:#UseDNS yes:UseDNS no:' ${IMAGE_ROOTFS}${sysconfdir}/ssh/sshd_config
+ sed -i --follow-symlinks -e 's:#UseDNS yes:UseDNS no:' ${IMAGE_ROOTFS}${sysconfdir}/ssh/sshd_config
fi
}
--
2.11.0
^ permalink raw reply related [flat|nested] 24+ messages in thread* [PATCH 4/4] ref-manual: Add SSHD_CONFIG
2017-01-23 14:55 [PATCH 0/4] openssh: Make sshd-config a package David Vincent
` (2 preceding siblings ...)
2017-01-23 14:55 ` [PATCH 3/4] rootfs-postcommands: Modify ssh-related commands David Vincent
@ 2017-01-23 14:55 ` David Vincent
2017-01-23 15:23 ` ✗ patchtest: failure for openssh: Make sshd-config a package Patchwork
` (2 subsequent siblings)
6 siblings, 0 replies; 24+ messages in thread
From: David Vincent @ 2017-01-23 14:55 UTC (permalink / raw)
To: openembedded-core
Add description for the SSHD_CONFIG variable which is used to select the
package to use as provider for sshd-config.
Signed-off-by: David Vincent <freesilicon@gmail.com>
---
documentation/ref-manual/ref-variables.xml | 21 +++++++++++++++++++++
1 file changed, 21 insertions(+)
diff --git a/documentation/ref-manual/ref-variables.xml b/documentation/ref-manual/ref-variables.xml
index 6e15e65f54..803f0da980 100644
--- a/documentation/ref-manual/ref-variables.xml
+++ b/documentation/ref-manual/ref-variables.xml
@@ -12511,6 +12511,27 @@ recipes-graphics/xorg-font/font-alias_1.0.3.bb:PR = "${INC_PR}.3"
</glossdef>
</glossentry>
+ <glossentry id='var-SSHD_CONFIG'><glossterm>SSHD_CONFIG</glossterm>
+ <info>
+ SSHD_CONFIG[doc] = "The package used to provide OpenSSH sshd configuration.
+ </info>
+ <glossdef>
+ <para role="glossdeffirst">
+ When selecting "ssh-server-openssh" in
+ <link linkend='var-IMAGE_FEATURES'><filename>IMAGE_FEATURES</filename></link>,
+ specifies which package should be used as provider for
+ <filename>sshd-config</filename>.
+ </para>
+
+ <note>
+ This defaults to <filename>openssh-sshd-config</filename>.
+ If "read-only-rootfs" is also specified in
+ <link linkend='var-IMAGE_FEATURES'><filename>IMAGE_FEATURES</filename></link>,
+ it defaults to <filename>openssh-sshd-config-readonly</filename>
+ </note>
+ </glossdef>
+ </glossentry>
+
<glossentry id='var-SSTATE_DIR'><glossterm>SSTATE_DIR</glossterm>
<info>
SSTATE_DIR[doc] = "The directory for the shared state cache."
--
2.11.0
^ permalink raw reply related [flat|nested] 24+ messages in thread* ✗ patchtest: failure for openssh: Make sshd-config a package
2017-01-23 14:55 [PATCH 0/4] openssh: Make sshd-config a package David Vincent
` (3 preceding siblings ...)
2017-01-23 14:55 ` [PATCH 4/4] ref-manual: Add SSHD_CONFIG David Vincent
@ 2017-01-23 15:23 ` Patchwork
2017-01-23 15:45 ` David Vincent
2017-01-24 8:43 ` [PATCH 0/3] " David Vincent
2017-01-24 9:07 ` [PATCH v2 0/3] openssh: Make sshd-config a package David Vincent
6 siblings, 1 reply; 24+ messages in thread
From: Patchwork @ 2017-01-23 15:23 UTC (permalink / raw)
To: David Vincent; +Cc: openembedded-core
== Series Details ==
Series: openssh: Make sshd-config a package
Revision: 1
URL : https://patchwork.openembedded.org/series/4904/
State : failure
== Summary ==
Thank you for submitting this patch series to OpenEmbedded Core. This is
an automated response. Several tests have been executed on the proposed
series by patchtest resulting in the following failures:
* Issue Series does not apply on top of target branch [test_series_merge_on_head]
Suggested fix Rebase your series on top of targeted branch
Targeted branch master (currently at 842ad404b3)
If you believe any of these test results are incorrect, please reply to the
mailing list (openembedded-core@lists.openembedded.org) raising your concerns.
Otherwise we would appreciate you correcting the issues and submitting a new
version of the patchset if applicable. Please ensure you add/increment the
version number when sending the new version (i.e. [PATCH] -> [PATCH v2] ->
[PATCH v3] -> ...).
---
Test framework: http://git.yoctoproject.org/cgit/cgit.cgi/patchtest
Test suite: http://git.yoctoproject.org/cgit/cgit.cgi/patchtest-oe
^ permalink raw reply [flat|nested] 24+ messages in thread* Re: ✗ patchtest: failure for openssh: Make sshd-config a package
2017-01-23 15:23 ` ✗ patchtest: failure for openssh: Make sshd-config a package Patchwork
@ 2017-01-23 15:45 ` David Vincent
2017-01-23 16:08 ` Leonardo Sandoval
0 siblings, 1 reply; 24+ messages in thread
From: David Vincent @ 2017-01-23 15:45 UTC (permalink / raw)
To: openembedded-core
On lundi 23 janvier 2017 15:23:36 CET Patchwork wrote:
> == Series Details ==
>
> Series: openssh: Make sshd-config a package
> Revision: 1
> URL : https://patchwork.openembedded.org/series/4904/
> State : failure
>
> == Summary ==
>
>
> Thank you for submitting this patch series to OpenEmbedded Core. This is
> an automated response. Several tests have been executed on the proposed
> series by patchtest resulting in the following failures:
>
>
>
> * Issue Series does not apply on top of target branch
> [test_series_merge_on_head] Suggested fix Rebase your series on top of
> targeted branch
> Targeted branch master (currently at 842ad404b3)
>
>
>
> If you believe any of these test results are incorrect, please reply to the
> mailing list (openembedded-core@lists.openembedded.org) raising your
> concerns. Otherwise we would appreciate you correcting the issues and
> submitting a new version of the patchset if applicable. Please ensure you
> add/increment the version number when sending the new version (i.e. [PATCH]
> -> [PATCH v2] -> [PATCH v3] -> ...).
>
> ---
> Test framework: http://git.yoctoproject.org/cgit/cgit.cgi/patchtest
> Test suite: http://git.yoctoproject.org/cgit/cgit.cgi/patchtest-oe
This result seems to be an error since I rebased my patches on top of current
HEAD before submitting it. I just checked again to see if some other patches
were left behind but my branch is currently up-to-date.
David
^ permalink raw reply [flat|nested] 24+ messages in thread
* Re: ✗ patchtest: failure for openssh: Make sshd-config a package
2017-01-23 15:45 ` David Vincent
@ 2017-01-23 16:08 ` Leonardo Sandoval
2017-01-23 16:39 ` David Vincent
0 siblings, 1 reply; 24+ messages in thread
From: Leonardo Sandoval @ 2017-01-23 16:08 UTC (permalink / raw)
To: David Vincent, openembedded-core
David, This is what I get from the command line
oe-core$ git pw mbox 4904 | git apply --check
error: documentation/ref-manual/ref-variables.xml: No such file or directory
Meaning that you have a patch on your series that is targeted for the
documentation folder, which is not part of the oe-core project. The
latter need to be sent to:
documentation:
Git repository: http://git.yoctoproject.org/cgit/cgit.cgi/yocto-docs/
Mailing list: yocto@yoctoproject.org
On 01/23/2017 09:45 AM, David Vincent wrote:
> On lundi 23 janvier 2017 15:23:36 CET Patchwork wrote:
>> == Series Details ==
>>
>> Series: openssh: Make sshd-config a package
>> Revision: 1
>> URL : https://patchwork.openembedded.org/series/4904/
>> State : failure
>>
>> == Summary ==
>>
>>
>> Thank you for submitting this patch series to OpenEmbedded Core. This is
>> an automated response. Several tests have been executed on the proposed
>> series by patchtest resulting in the following failures:
>>
>>
>>
>> * Issue Series does not apply on top of target branch
>> [test_series_merge_on_head] Suggested fix Rebase your series on top of
>> targeted branch
>> Targeted branch master (currently at 842ad404b3)
>>
>>
>>
>> If you believe any of these test results are incorrect, please reply to the
>> mailing list (openembedded-core@lists.openembedded.org) raising your
>> concerns. Otherwise we would appreciate you correcting the issues and
>> submitting a new version of the patchset if applicable. Please ensure you
>> add/increment the version number when sending the new version (i.e. [PATCH]
>> -> [PATCH v2] -> [PATCH v3] -> ...).
>>
>> ---
>> Test framework: http://git.yoctoproject.org/cgit/cgit.cgi/patchtest
>> Test suite: http://git.yoctoproject.org/cgit/cgit.cgi/patchtest-oe
> This result seems to be an error since I rebased my patches on top of current
> HEAD before submitting it. I just checked again to see if some other patches
> were left behind but my branch is currently up-to-date.
>
> David
>
^ permalink raw reply [flat|nested] 24+ messages in thread* Re: ✗ patchtest: failure for openssh: Make sshd-config a package
2017-01-23 16:08 ` Leonardo Sandoval
@ 2017-01-23 16:39 ` David Vincent
2017-01-23 17:56 ` Leonardo Sandoval
0 siblings, 1 reply; 24+ messages in thread
From: David Vincent @ 2017-01-23 16:39 UTC (permalink / raw)
To: Leonardo Sandoval; +Cc: openembedded-core
On lundi 23 janvier 2017 10:08:04 CET Leonardo Sandoval wrote:
> David, This is what I get from the command line
>
> oe-core$ git pw mbox 4904 | git apply --check
> error: documentation/ref-manual/ref-variables.xml: No such file or directory
>
> Meaning that you have a patch on your series that is targeted for the
> documentation folder, which is not part of the oe-core project. The
> latter need to be sent to:
>
> documentation:
> Git repository: http://git.yoctoproject.org/cgit/cgit.cgi/yocto-docs/
> Mailing list: yocto@yoctoproject.org
>
OK, my bad, I patched directly against my poky clone. I didn't know that
documentation was handled elsewhere. So, I will resubmit it removing the
latest patch.
But since these patches are related, is there a specific procedure to follow ?
I didn't found anything in the contribution guidelines on the wiki...
Sorry for the inconvenience,
David
^ permalink raw reply [flat|nested] 24+ messages in thread
* Re: ✗ patchtest: failure for openssh: Make sshd-config a package
2017-01-23 16:39 ` David Vincent
@ 2017-01-23 17:56 ` Leonardo Sandoval
0 siblings, 0 replies; 24+ messages in thread
From: Leonardo Sandoval @ 2017-01-23 17:56 UTC (permalink / raw)
To: David Vincent; +Cc: openembedded-core
On 01/23/2017 10:39 AM, David Vincent wrote:
> On lundi 23 janvier 2017 10:08:04 CET Leonardo Sandoval wrote:
>> David, This is what I get from the command line
>>
>> oe-core$ git pw mbox 4904 | git apply --check
>> error: documentation/ref-manual/ref-variables.xml: No such file or directory
>>
>> Meaning that you have a patch on your series that is targeted for the
>> documentation folder, which is not part of the oe-core project. The
>> latter need to be sent to:
>>
>> documentation:
>> Git repository: http://git.yoctoproject.org/cgit/cgit.cgi/yocto-docs/
>> Mailing list: yocto@yoctoproject.org
>>
> OK, my bad, I patched directly against my poky clone. I didn't know that
> documentation was handled elsewhere. So, I will resubmit it removing the
> latest patch.
>
> But since these patches are related, is there a specific procedure to follow ?
> I didn't found anything in the contribution guidelines on the wiki...
I do not think so. Go ahead and send to the patches to the correct ML
and perhaps include a cover letter indicating the patch relationship.
> Sorry for the inconvenience,
no problem.
By the way, there is enhancement (to be included during 2.3) that will
target this type of problem: patch sent to the wrong ML; once
implemented, the fail report will be more specific.
> David
>
^ permalink raw reply [flat|nested] 24+ messages in thread
* [PATCH 0/3] openssh: Make sshd-config a package
2017-01-23 14:55 [PATCH 0/4] openssh: Make sshd-config a package David Vincent
` (4 preceding siblings ...)
2017-01-23 15:23 ` ✗ patchtest: failure for openssh: Make sshd-config a package Patchwork
@ 2017-01-24 8:43 ` David Vincent
2017-01-24 8:43 ` [PATCH 1/3] openssh: Package server configuration David Vincent
` (2 more replies)
2017-01-24 9:07 ` [PATCH v2 0/3] openssh: Make sshd-config a package David Vincent
6 siblings, 3 replies; 24+ messages in thread
From: David Vincent @ 2017-01-24 8:43 UTC (permalink / raw)
To: openembedded-core
This series of patch introduces a new way of modifying OpenSSH sshd
configuration. Instead of modifying the files and launching the server with
custom options, a package which RPROVIDES sshd-config must be installed.
The package to use is selected using a new variable called SSHD_CONFIG which is
used exclusively when selecting ssh-server-openssh in IMAGE_FEATURES.
Changes since v2:
Remove documentation
David Vincent (3):
openssh: Package server configuration
core-image: Set default sshd configuration
rootfs-postcommands: Modify ssh-related commands
meta/classes/core-image.bbclass | 3 +-
meta/classes/rootfs-postcommands.bbclass | 28 ++++---------
meta/recipes-connectivity/openssh/openssh_7.3p1.bb | 47 ++++++++++++++++++----
3 files changed, 49 insertions(+), 29 deletions(-)
--
2.11.0
^ permalink raw reply [flat|nested] 24+ messages in thread* [PATCH 1/3] openssh: Package server configuration
2017-01-24 8:43 ` [PATCH 0/3] " David Vincent
@ 2017-01-24 8:43 ` David Vincent
2017-01-24 8:43 ` [PATCH 2/3] core-image: Set default sshd configuration David Vincent
2017-01-24 8:43 ` [PATCH 3/3] rootfs-postcommands: Modify ssh-related commands David Vincent
2 siblings, 0 replies; 24+ messages in thread
From: David Vincent @ 2017-01-24 8:43 UTC (permalink / raw)
To: openembedded-core
Split sshd configuration for read-write/read-only rootfs in two distinct
packages. Also, add a package dependency between openssh-sshd package
and a provider of sshd-config.
Signed-off-by: David Vincent <freesilicon@gmail.com>
---
meta/recipes-connectivity/openssh/openssh_7.3p1.bb | 47 ++++++++++++++++++----
1 file changed, 40 insertions(+), 7 deletions(-)
diff --git a/meta/recipes-connectivity/openssh/openssh_7.3p1.bb b/meta/recipes-connectivity/openssh/openssh_7.3p1.bb
index 94eb0ed208..c02bb7d450 100644
--- a/meta/recipes-connectivity/openssh/openssh_7.3p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_7.3p1.bb
@@ -92,13 +92,17 @@ do_compile_ptest() {
}
do_install_append () {
+ # Create default config files
+ install -m 0644 ${D}${sysconfdir}/ssh/sshd_config ${D}${sysconfdir}/ssh/sshd_config_default
+ rm -f ${D}${sysconfdir}/ssh/sshd_config
+
if [ "${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'pam', '', d)}" = "pam" ]; then
install -D -m 0644 ${WORKDIR}/sshd ${D}${sysconfdir}/pam.d/sshd
- sed -i -e 's:#UsePAM no:UsePAM yes:' ${D}${sysconfdir}/ssh/sshd_config
+ sed -i -e 's:#UsePAM no:UsePAM yes:' ${D}${sysconfdir}/ssh/sshd_config_default
fi
if [ "${@bb.utils.contains('DISTRO_FEATURES', 'x11', 'x11', '', d)}" = "x11" ]; then
- sed -i -e 's:#X11Forwarding no:X11Forwarding yes:' ${D}${sysconfdir}/ssh/sshd_config
+ sed -i -e 's:#X11Forwarding no:X11Forwarding yes:' ${D}${sysconfdir}/ssh/sshd_config_default
fi
install -d ${D}${sysconfdir}/init.d
@@ -111,7 +115,7 @@ do_install_append () {
# Create config files for read-only rootfs
install -d ${D}${sysconfdir}/ssh
- install -m 644 ${D}${sysconfdir}/ssh/sshd_config ${D}${sysconfdir}/ssh/sshd_config_readonly
+ install -m 644 ${D}${sysconfdir}/ssh/sshd_config_default ${D}${sysconfdir}/ssh/sshd_config_readonly
sed -i '/HostKey/d' ${D}${sysconfdir}/ssh/sshd_config_readonly
echo "HostKey /var/run/ssh/ssh_host_rsa_key" >> ${D}${sysconfdir}/ssh/sshd_config_readonly
echo "HostKey /var/run/ssh/ssh_host_dsa_key" >> ${D}${sysconfdir}/ssh/sshd_config_readonly
@@ -135,30 +139,59 @@ do_install_ptest () {
ALLOW_EMPTY_${PN} = "1"
-PACKAGES =+ "${PN}-keygen ${PN}-scp ${PN}-ssh ${PN}-sshd ${PN}-sftp ${PN}-misc ${PN}-sftp-server"
+PACKAGES =+ "${PN}-keygen ${PN}-scp ${PN}-ssh ${PN}-sshd-config ${PN}-sshd-config-readonly ${PN}-sshd ${PN}-sftp ${PN}-misc ${PN}-sftp-server"
FILES_${PN}-scp = "${bindir}/scp.${BPN}"
FILES_${PN}-ssh = "${bindir}/ssh.${BPN} ${sysconfdir}/ssh/ssh_config"
+FILES_${PN}-sshd-config = "${sysconfdir}/ssh/sshd_config_default"
+FILES_${PN}-sshd-config-readonly = "${sysconfdir}/ssh/sshd_config_readonly"
FILES_${PN}-sshd = "${sbindir}/sshd ${sysconfdir}/init.d/sshd ${systemd_unitdir}/system"
-FILES_${PN}-sshd += "${sysconfdir}/ssh/moduli ${sysconfdir}/ssh/sshd_config ${sysconfdir}/ssh/sshd_config_readonly ${sysconfdir}/default/volatiles/99_sshd ${sysconfdir}/pam.d/sshd"
+FILES_${PN}-sshd += "${sysconfdir}/ssh/moduli ${sysconfdir}/default/volatiles/99_sshd ${sysconfdir}/pam.d/sshd"
FILES_${PN}-sftp = "${bindir}/sftp"
FILES_${PN}-sftp-server = "${libexecdir}/sftp-server"
FILES_${PN}-misc = "${bindir}/ssh* ${libexecdir}/ssh*"
FILES_${PN}-keygen = "${bindir}/ssh-keygen"
RDEPENDS_${PN} += "${PN}-scp ${PN}-ssh ${PN}-sshd ${PN}-keygen"
-RDEPENDS_${PN}-sshd += "${PN}-keygen ${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'pam-plugin-keyinit pam-plugin-loginuid', '', d)}"
+RDEPENDS_${PN}-sshd += "${PN}-keygen sshd-config ${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'pam-plugin-keyinit pam-plugin-loginuid', '', d)}"
RDEPENDS_${PN}-ptest += "${PN}-sftp ${PN}-misc ${PN}-sftp-server make"
RPROVIDES_${PN}-ssh = "ssh"
+RPROVIDES_${PN}-sshd-config = "sshd-config"
+RPROVIDES_${PN}-sshd-config-readonly = "sshd-config"
RPROVIDES_${PN}-sshd = "sshd"
RCONFLICTS_${PN} = "dropbear"
+RCONFLICTS_${PN}-sshd-config = "${PN}-sshd-config-readonly"
+RCONFLICTS_${PN}-sshd-config-readonly = "${PN}-sshd-config"
RCONFLICTS_${PN}-sshd = "dropbear"
RCONFLICTS_${PN}-keygen = "ssh-keygen"
-CONFFILES_${PN}-sshd = "${sysconfdir}/ssh/sshd_config"
+CONFFILES_${PN}-sshd-config = "${sysconfdir}/ssh/sshd_config_default"
+CONFFILES_${PN}-sshd-config-readonly = "${sysconfdir}/ssh/sshd_config_readonly"
CONFFILES_${PN}-ssh = "${sysconfdir}/ssh/ssh_config"
+pkg_postinst_${PN}-sshd-config () {
+#!/bin/sh
+if [ -e $D${sysconfdir}/ssh/sshd_config ]; then
+ rm $D${sysconfdir}/ssh/sshd_config
+fi
+
+# Make sure destination directory exists, before creating the symlink
+mkdir -p $D${sysconfdir}/ssh
+ln -s sshd_config_default $D${sysconfdir}/ssh/sshd_config
+}
+
+pkg_postinst_${PN}-sshd-config-readonly () {
+#!/bin/sh
+if [ -e $D${sysconfdir}/ssh/sshd_config ]; then
+ rm $D${sysconfdir}/ssh/sshd_config
+fi
+
+# Make sure destination directory exists, before creating the symlink
+mkdir -p $D${sysconfdir}/ssh
+ln -s sshd_config_readonly $D${sysconfdir}/ssh/sshd_config
+}
+
ALTERNATIVE_PRIORITY = "90"
ALTERNATIVE_${PN}-scp = "scp"
ALTERNATIVE_${PN}-ssh = "ssh"
--
2.11.0
^ permalink raw reply related [flat|nested] 24+ messages in thread* [PATCH 2/3] core-image: Set default sshd configuration
2017-01-24 8:43 ` [PATCH 0/3] " David Vincent
2017-01-24 8:43 ` [PATCH 1/3] openssh: Package server configuration David Vincent
@ 2017-01-24 8:43 ` David Vincent
2017-01-24 8:43 ` [PATCH 3/3] rootfs-postcommands: Modify ssh-related commands David Vincent
2 siblings, 0 replies; 24+ messages in thread
From: David Vincent @ 2017-01-24 8:43 UTC (permalink / raw)
To: openembedded-core
When selecting OpenSSH as ssh server provider instead of dropbear, also
install the correct configuration depending on whether the final rootfs
is read-only or not.
Signed-off-by: David Vincent <freesilicon@gmail.com>
---
meta/classes/core-image.bbclass | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/meta/classes/core-image.bbclass b/meta/classes/core-image.bbclass
index 8431440db4..d1f643d920 100644
--- a/meta/classes/core-image.bbclass
+++ b/meta/classes/core-image.bbclass
@@ -41,7 +41,7 @@ FEATURE_PACKAGES_tools-sdk = "packagegroup-core-sdk packagegroup-core-standalone
FEATURE_PACKAGES_nfs-server = "packagegroup-core-nfs-server"
FEATURE_PACKAGES_nfs-client = "packagegroup-core-nfs-client"
FEATURE_PACKAGES_ssh-server-dropbear = "packagegroup-core-ssh-dropbear"
-FEATURE_PACKAGES_ssh-server-openssh = "packagegroup-core-ssh-openssh"
+FEATURE_PACKAGES_ssh-server-openssh = "packagegroup-core-ssh-openssh ${SSHD_CONFIG}"
FEATURE_PACKAGES_hwcodecs = "${MACHINE_HWCODECS}"
@@ -52,6 +52,7 @@ IMAGE_FEATURES_REPLACES_ssh-server-openssh = "ssh-server-dropbear"
# IMAGE_FEATURES_CONFLICTS_foo = 'bar1 bar2'
# An error exception would be raised if both image features foo and bar1(or bar2) are included
+SSHD_CONFIG ??= "${@bb.utils.contains('IMAGE_FEATURES','read-only-rootfs','openssh-sshd-config-readonly','openssh-sshd-config',d)}"
MACHINE_HWCODECS ??= ""
CORE_IMAGE_BASE_INSTALL = '\
--
2.11.0
^ permalink raw reply related [flat|nested] 24+ messages in thread* [PATCH 3/3] rootfs-postcommands: Modify ssh-related commands
2017-01-24 8:43 ` [PATCH 0/3] " David Vincent
2017-01-24 8:43 ` [PATCH 1/3] openssh: Package server configuration David Vincent
2017-01-24 8:43 ` [PATCH 2/3] core-image: Set default sshd configuration David Vincent
@ 2017-01-24 8:43 ` David Vincent
2 siblings, 0 replies; 24+ messages in thread
From: David Vincent @ 2017-01-24 8:43 UTC (permalink / raw)
To: openembedded-core
OpenSSH configuration is now a symlink which points to the desired
configuration, so the functions that modified it must be updated to
modify the target and not override it.
Signed-off-by: David Vincent <freesilicon@gmail.com>
---
meta/classes/rootfs-postcommands.bbclass | 28 +++++++---------------------
1 file changed, 7 insertions(+), 21 deletions(-)
diff --git a/meta/classes/rootfs-postcommands.bbclass b/meta/classes/rootfs-postcommands.bbclass
index c8f18c6702..2d862b0b2e 100644
--- a/meta/classes/rootfs-postcommands.bbclass
+++ b/meta/classes/rootfs-postcommands.bbclass
@@ -86,20 +86,8 @@ read_only_rootfs_hook () {
# Tweak the mount option and fs_passno for rootfs in fstab
sed -i -e '/^[#[:space:]]*\/dev\/root/{s/defaults/ro/;s/\([[:space:]]*[[:digit:]]\)\([[:space:]]*\)[[:digit:]]$/\1\20/}' ${IMAGE_ROOTFS}/etc/fstab
- # If we're using openssh and the /etc/ssh directory has no pre-generated keys,
- # we should configure openssh to use the configuration file /etc/ssh/sshd_config_readonly
- # and the keys under /var/run/ssh.
- if [ -d ${IMAGE_ROOTFS}/etc/ssh ]; then
- if [ -e ${IMAGE_ROOTFS}/etc/ssh/ssh_host_rsa_key ]; then
- echo "SYSCONFDIR=/etc/ssh" >> ${IMAGE_ROOTFS}/etc/default/ssh
- echo "SSHD_OPTS=" >> ${IMAGE_ROOTFS}/etc/default/ssh
- else
- echo "SYSCONFDIR=/var/run/ssh" >> ${IMAGE_ROOTFS}/etc/default/ssh
- echo "SSHD_OPTS='-f /etc/ssh/sshd_config_readonly'" >> ${IMAGE_ROOTFS}/etc/default/ssh
- fi
- fi
-
- # Also tweak the key location for dropbear in the same way.
+ # If we're using dropbear and the /etc/dropbear directory has no pre-generated keys,
+ # we should configure dropbear to use the keys under /var/lib/dropbear.
if [ -d ${IMAGE_ROOTFS}/etc/dropbear ]; then
if [ -e ${IMAGE_ROOTFS}/etc/dropbear/dropbear_rsa_host_key ]; then
echo "DROPBEAR_RSAKEY_DIR=/etc/dropbear" >> ${IMAGE_ROOTFS}/etc/default/dropbear
@@ -138,12 +126,10 @@ zap_empty_root_password () {
# allow dropbear/openssh to accept root logins and logins from accounts with an empty password string
#
ssh_allow_empty_password () {
- for config in sshd_config sshd_config_readonly; do
- if [ -e ${IMAGE_ROOTFS}${sysconfdir}/ssh/$config ]; then
- sed -i 's/^[#[:space:]]*PermitRootLogin.*/PermitRootLogin yes/' ${IMAGE_ROOTFS}${sysconfdir}/ssh/$config
- sed -i 's/^[#[:space:]]*PermitEmptyPasswords.*/PermitEmptyPasswords yes/' ${IMAGE_ROOTFS}${sysconfdir}/ssh/$config
- fi
- done
+ if [ -e ${IMAGE_ROOTFS}${sysconfdir}/ssh/sshd_config ]; then
+ sed -i --follow-symlinks 's/^[#[:space:]]*PermitRootLogin.*/PermitRootLogin yes/' ${IMAGE_ROOTFS}${sysconfdir}/ssh/sshd_config
+ sed -i --follow-symlinks 's/^[#[:space:]]*PermitEmptyPasswords.*/PermitEmptyPasswords yes/' ${IMAGE_ROOTFS}${sysconfdir}/ssh/sshd_config
+ fi
if [ -e ${IMAGE_ROOTFS}${sbindir}/dropbear ] ; then
if grep -q DROPBEAR_EXTRA_ARGS ${IMAGE_ROOTFS}${sysconfdir}/default/dropbear 2>/dev/null ; then
@@ -162,7 +148,7 @@ ssh_allow_empty_password () {
ssh_disable_dns_lookup () {
if [ -e ${IMAGE_ROOTFS}${sysconfdir}/ssh/sshd_config ]; then
- sed -i -e 's:#UseDNS yes:UseDNS no:' ${IMAGE_ROOTFS}${sysconfdir}/ssh/sshd_config
+ sed -i --follow-symlinks -e 's:#UseDNS yes:UseDNS no:' ${IMAGE_ROOTFS}${sysconfdir}/ssh/sshd_config
fi
}
--
2.11.0
^ permalink raw reply related [flat|nested] 24+ messages in thread
* [PATCH v2 0/3] openssh: Make sshd-config a package
2017-01-23 14:55 [PATCH 0/4] openssh: Make sshd-config a package David Vincent
` (5 preceding siblings ...)
2017-01-24 8:43 ` [PATCH 0/3] " David Vincent
@ 2017-01-24 9:07 ` David Vincent
2017-01-24 9:07 ` [PATCH 1/3] openssh: Package server configuration David Vincent
` (4 more replies)
6 siblings, 5 replies; 24+ messages in thread
From: David Vincent @ 2017-01-24 9:07 UTC (permalink / raw)
To: openembedded-core
This series of patch introduces a new way of modifying OpenSSH sshd
configuration. Instead of modifying the files and launching the server with
custom options, a package which RPROVIDES sshd-config must be installed.
The package to use is selected using a new variable called SSHD_CONFIG which is
used exclusively when selecting ssh-server-openssh in IMAGE_FEATURES.
Changes since v1:
Remove documentation
David Vincent (3):
openssh: Package server configuration
core-image: Set default sshd configuration
rootfs-postcommands: Modify ssh-related commands
meta/classes/core-image.bbclass | 3 +-
meta/classes/rootfs-postcommands.bbclass | 28 ++++---------
meta/recipes-connectivity/openssh/openssh_7.3p1.bb | 47 ++++++++++++++++++----
3 files changed, 49 insertions(+), 29 deletions(-)
--
2.11.0
^ permalink raw reply [flat|nested] 24+ messages in thread* [PATCH 1/3] openssh: Package server configuration
2017-01-24 9:07 ` [PATCH v2 0/3] openssh: Make sshd-config a package David Vincent
@ 2017-01-24 9:07 ` David Vincent
2017-01-24 9:07 ` [PATCH 2/3] core-image: Set default sshd configuration David Vincent
` (3 subsequent siblings)
4 siblings, 0 replies; 24+ messages in thread
From: David Vincent @ 2017-01-24 9:07 UTC (permalink / raw)
To: openembedded-core
Split sshd configuration for read-write/read-only rootfs in two distinct
packages. Also, add a package dependency between openssh-sshd package
and a provider of sshd-config.
Signed-off-by: David Vincent <freesilicon@gmail.com>
---
meta/recipes-connectivity/openssh/openssh_7.3p1.bb | 47 ++++++++++++++++++----
1 file changed, 40 insertions(+), 7 deletions(-)
diff --git a/meta/recipes-connectivity/openssh/openssh_7.3p1.bb b/meta/recipes-connectivity/openssh/openssh_7.3p1.bb
index 94eb0ed208..c02bb7d450 100644
--- a/meta/recipes-connectivity/openssh/openssh_7.3p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_7.3p1.bb
@@ -92,13 +92,17 @@ do_compile_ptest() {
}
do_install_append () {
+ # Create default config files
+ install -m 0644 ${D}${sysconfdir}/ssh/sshd_config ${D}${sysconfdir}/ssh/sshd_config_default
+ rm -f ${D}${sysconfdir}/ssh/sshd_config
+
if [ "${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'pam', '', d)}" = "pam" ]; then
install -D -m 0644 ${WORKDIR}/sshd ${D}${sysconfdir}/pam.d/sshd
- sed -i -e 's:#UsePAM no:UsePAM yes:' ${D}${sysconfdir}/ssh/sshd_config
+ sed -i -e 's:#UsePAM no:UsePAM yes:' ${D}${sysconfdir}/ssh/sshd_config_default
fi
if [ "${@bb.utils.contains('DISTRO_FEATURES', 'x11', 'x11', '', d)}" = "x11" ]; then
- sed -i -e 's:#X11Forwarding no:X11Forwarding yes:' ${D}${sysconfdir}/ssh/sshd_config
+ sed -i -e 's:#X11Forwarding no:X11Forwarding yes:' ${D}${sysconfdir}/ssh/sshd_config_default
fi
install -d ${D}${sysconfdir}/init.d
@@ -111,7 +115,7 @@ do_install_append () {
# Create config files for read-only rootfs
install -d ${D}${sysconfdir}/ssh
- install -m 644 ${D}${sysconfdir}/ssh/sshd_config ${D}${sysconfdir}/ssh/sshd_config_readonly
+ install -m 644 ${D}${sysconfdir}/ssh/sshd_config_default ${D}${sysconfdir}/ssh/sshd_config_readonly
sed -i '/HostKey/d' ${D}${sysconfdir}/ssh/sshd_config_readonly
echo "HostKey /var/run/ssh/ssh_host_rsa_key" >> ${D}${sysconfdir}/ssh/sshd_config_readonly
echo "HostKey /var/run/ssh/ssh_host_dsa_key" >> ${D}${sysconfdir}/ssh/sshd_config_readonly
@@ -135,30 +139,59 @@ do_install_ptest () {
ALLOW_EMPTY_${PN} = "1"
-PACKAGES =+ "${PN}-keygen ${PN}-scp ${PN}-ssh ${PN}-sshd ${PN}-sftp ${PN}-misc ${PN}-sftp-server"
+PACKAGES =+ "${PN}-keygen ${PN}-scp ${PN}-ssh ${PN}-sshd-config ${PN}-sshd-config-readonly ${PN}-sshd ${PN}-sftp ${PN}-misc ${PN}-sftp-server"
FILES_${PN}-scp = "${bindir}/scp.${BPN}"
FILES_${PN}-ssh = "${bindir}/ssh.${BPN} ${sysconfdir}/ssh/ssh_config"
+FILES_${PN}-sshd-config = "${sysconfdir}/ssh/sshd_config_default"
+FILES_${PN}-sshd-config-readonly = "${sysconfdir}/ssh/sshd_config_readonly"
FILES_${PN}-sshd = "${sbindir}/sshd ${sysconfdir}/init.d/sshd ${systemd_unitdir}/system"
-FILES_${PN}-sshd += "${sysconfdir}/ssh/moduli ${sysconfdir}/ssh/sshd_config ${sysconfdir}/ssh/sshd_config_readonly ${sysconfdir}/default/volatiles/99_sshd ${sysconfdir}/pam.d/sshd"
+FILES_${PN}-sshd += "${sysconfdir}/ssh/moduli ${sysconfdir}/default/volatiles/99_sshd ${sysconfdir}/pam.d/sshd"
FILES_${PN}-sftp = "${bindir}/sftp"
FILES_${PN}-sftp-server = "${libexecdir}/sftp-server"
FILES_${PN}-misc = "${bindir}/ssh* ${libexecdir}/ssh*"
FILES_${PN}-keygen = "${bindir}/ssh-keygen"
RDEPENDS_${PN} += "${PN}-scp ${PN}-ssh ${PN}-sshd ${PN}-keygen"
-RDEPENDS_${PN}-sshd += "${PN}-keygen ${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'pam-plugin-keyinit pam-plugin-loginuid', '', d)}"
+RDEPENDS_${PN}-sshd += "${PN}-keygen sshd-config ${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'pam-plugin-keyinit pam-plugin-loginuid', '', d)}"
RDEPENDS_${PN}-ptest += "${PN}-sftp ${PN}-misc ${PN}-sftp-server make"
RPROVIDES_${PN}-ssh = "ssh"
+RPROVIDES_${PN}-sshd-config = "sshd-config"
+RPROVIDES_${PN}-sshd-config-readonly = "sshd-config"
RPROVIDES_${PN}-sshd = "sshd"
RCONFLICTS_${PN} = "dropbear"
+RCONFLICTS_${PN}-sshd-config = "${PN}-sshd-config-readonly"
+RCONFLICTS_${PN}-sshd-config-readonly = "${PN}-sshd-config"
RCONFLICTS_${PN}-sshd = "dropbear"
RCONFLICTS_${PN}-keygen = "ssh-keygen"
-CONFFILES_${PN}-sshd = "${sysconfdir}/ssh/sshd_config"
+CONFFILES_${PN}-sshd-config = "${sysconfdir}/ssh/sshd_config_default"
+CONFFILES_${PN}-sshd-config-readonly = "${sysconfdir}/ssh/sshd_config_readonly"
CONFFILES_${PN}-ssh = "${sysconfdir}/ssh/ssh_config"
+pkg_postinst_${PN}-sshd-config () {
+#!/bin/sh
+if [ -e $D${sysconfdir}/ssh/sshd_config ]; then
+ rm $D${sysconfdir}/ssh/sshd_config
+fi
+
+# Make sure destination directory exists, before creating the symlink
+mkdir -p $D${sysconfdir}/ssh
+ln -s sshd_config_default $D${sysconfdir}/ssh/sshd_config
+}
+
+pkg_postinst_${PN}-sshd-config-readonly () {
+#!/bin/sh
+if [ -e $D${sysconfdir}/ssh/sshd_config ]; then
+ rm $D${sysconfdir}/ssh/sshd_config
+fi
+
+# Make sure destination directory exists, before creating the symlink
+mkdir -p $D${sysconfdir}/ssh
+ln -s sshd_config_readonly $D${sysconfdir}/ssh/sshd_config
+}
+
ALTERNATIVE_PRIORITY = "90"
ALTERNATIVE_${PN}-scp = "scp"
ALTERNATIVE_${PN}-ssh = "ssh"
--
2.11.0
^ permalink raw reply related [flat|nested] 24+ messages in thread* [PATCH 2/3] core-image: Set default sshd configuration
2017-01-24 9:07 ` [PATCH v2 0/3] openssh: Make sshd-config a package David Vincent
2017-01-24 9:07 ` [PATCH 1/3] openssh: Package server configuration David Vincent
@ 2017-01-24 9:07 ` David Vincent
2017-01-24 9:07 ` [PATCH 3/3] rootfs-postcommands: Modify ssh-related commands David Vincent
` (2 subsequent siblings)
4 siblings, 0 replies; 24+ messages in thread
From: David Vincent @ 2017-01-24 9:07 UTC (permalink / raw)
To: openembedded-core
When selecting OpenSSH as ssh server provider instead of dropbear, also
install the correct configuration depending on whether the final rootfs
is read-only or not.
Signed-off-by: David Vincent <freesilicon@gmail.com>
---
meta/classes/core-image.bbclass | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/meta/classes/core-image.bbclass b/meta/classes/core-image.bbclass
index 8431440db4..d1f643d920 100644
--- a/meta/classes/core-image.bbclass
+++ b/meta/classes/core-image.bbclass
@@ -41,7 +41,7 @@ FEATURE_PACKAGES_tools-sdk = "packagegroup-core-sdk packagegroup-core-standalone
FEATURE_PACKAGES_nfs-server = "packagegroup-core-nfs-server"
FEATURE_PACKAGES_nfs-client = "packagegroup-core-nfs-client"
FEATURE_PACKAGES_ssh-server-dropbear = "packagegroup-core-ssh-dropbear"
-FEATURE_PACKAGES_ssh-server-openssh = "packagegroup-core-ssh-openssh"
+FEATURE_PACKAGES_ssh-server-openssh = "packagegroup-core-ssh-openssh ${SSHD_CONFIG}"
FEATURE_PACKAGES_hwcodecs = "${MACHINE_HWCODECS}"
@@ -52,6 +52,7 @@ IMAGE_FEATURES_REPLACES_ssh-server-openssh = "ssh-server-dropbear"
# IMAGE_FEATURES_CONFLICTS_foo = 'bar1 bar2'
# An error exception would be raised if both image features foo and bar1(or bar2) are included
+SSHD_CONFIG ??= "${@bb.utils.contains('IMAGE_FEATURES','read-only-rootfs','openssh-sshd-config-readonly','openssh-sshd-config',d)}"
MACHINE_HWCODECS ??= ""
CORE_IMAGE_BASE_INSTALL = '\
--
2.11.0
^ permalink raw reply related [flat|nested] 24+ messages in thread* [PATCH 3/3] rootfs-postcommands: Modify ssh-related commands
2017-01-24 9:07 ` [PATCH v2 0/3] openssh: Make sshd-config a package David Vincent
2017-01-24 9:07 ` [PATCH 1/3] openssh: Package server configuration David Vincent
2017-01-24 9:07 ` [PATCH 2/3] core-image: Set default sshd configuration David Vincent
@ 2017-01-24 9:07 ` David Vincent
2017-01-24 19:07 ` [PATCH v2 0/3] openssh: Make sshd-config a package Khem Raj
2017-02-02 10:30 ` [PATCH v3 " David Vincent
4 siblings, 0 replies; 24+ messages in thread
From: David Vincent @ 2017-01-24 9:07 UTC (permalink / raw)
To: openembedded-core
OpenSSH configuration is now a symlink which points to the desired
configuration, so the functions that modified it must be updated to
modify the target and not override it.
Signed-off-by: David Vincent <freesilicon@gmail.com>
---
meta/classes/rootfs-postcommands.bbclass | 28 +++++++---------------------
1 file changed, 7 insertions(+), 21 deletions(-)
diff --git a/meta/classes/rootfs-postcommands.bbclass b/meta/classes/rootfs-postcommands.bbclass
index c8f18c6702..2d862b0b2e 100644
--- a/meta/classes/rootfs-postcommands.bbclass
+++ b/meta/classes/rootfs-postcommands.bbclass
@@ -86,20 +86,8 @@ read_only_rootfs_hook () {
# Tweak the mount option and fs_passno for rootfs in fstab
sed -i -e '/^[#[:space:]]*\/dev\/root/{s/defaults/ro/;s/\([[:space:]]*[[:digit:]]\)\([[:space:]]*\)[[:digit:]]$/\1\20/}' ${IMAGE_ROOTFS}/etc/fstab
- # If we're using openssh and the /etc/ssh directory has no pre-generated keys,
- # we should configure openssh to use the configuration file /etc/ssh/sshd_config_readonly
- # and the keys under /var/run/ssh.
- if [ -d ${IMAGE_ROOTFS}/etc/ssh ]; then
- if [ -e ${IMAGE_ROOTFS}/etc/ssh/ssh_host_rsa_key ]; then
- echo "SYSCONFDIR=/etc/ssh" >> ${IMAGE_ROOTFS}/etc/default/ssh
- echo "SSHD_OPTS=" >> ${IMAGE_ROOTFS}/etc/default/ssh
- else
- echo "SYSCONFDIR=/var/run/ssh" >> ${IMAGE_ROOTFS}/etc/default/ssh
- echo "SSHD_OPTS='-f /etc/ssh/sshd_config_readonly'" >> ${IMAGE_ROOTFS}/etc/default/ssh
- fi
- fi
-
- # Also tweak the key location for dropbear in the same way.
+ # If we're using dropbear and the /etc/dropbear directory has no pre-generated keys,
+ # we should configure dropbear to use the keys under /var/lib/dropbear.
if [ -d ${IMAGE_ROOTFS}/etc/dropbear ]; then
if [ -e ${IMAGE_ROOTFS}/etc/dropbear/dropbear_rsa_host_key ]; then
echo "DROPBEAR_RSAKEY_DIR=/etc/dropbear" >> ${IMAGE_ROOTFS}/etc/default/dropbear
@@ -138,12 +126,10 @@ zap_empty_root_password () {
# allow dropbear/openssh to accept root logins and logins from accounts with an empty password string
#
ssh_allow_empty_password () {
- for config in sshd_config sshd_config_readonly; do
- if [ -e ${IMAGE_ROOTFS}${sysconfdir}/ssh/$config ]; then
- sed -i 's/^[#[:space:]]*PermitRootLogin.*/PermitRootLogin yes/' ${IMAGE_ROOTFS}${sysconfdir}/ssh/$config
- sed -i 's/^[#[:space:]]*PermitEmptyPasswords.*/PermitEmptyPasswords yes/' ${IMAGE_ROOTFS}${sysconfdir}/ssh/$config
- fi
- done
+ if [ -e ${IMAGE_ROOTFS}${sysconfdir}/ssh/sshd_config ]; then
+ sed -i --follow-symlinks 's/^[#[:space:]]*PermitRootLogin.*/PermitRootLogin yes/' ${IMAGE_ROOTFS}${sysconfdir}/ssh/sshd_config
+ sed -i --follow-symlinks 's/^[#[:space:]]*PermitEmptyPasswords.*/PermitEmptyPasswords yes/' ${IMAGE_ROOTFS}${sysconfdir}/ssh/sshd_config
+ fi
if [ -e ${IMAGE_ROOTFS}${sbindir}/dropbear ] ; then
if grep -q DROPBEAR_EXTRA_ARGS ${IMAGE_ROOTFS}${sysconfdir}/default/dropbear 2>/dev/null ; then
@@ -162,7 +148,7 @@ ssh_allow_empty_password () {
ssh_disable_dns_lookup () {
if [ -e ${IMAGE_ROOTFS}${sysconfdir}/ssh/sshd_config ]; then
- sed -i -e 's:#UseDNS yes:UseDNS no:' ${IMAGE_ROOTFS}${sysconfdir}/ssh/sshd_config
+ sed -i --follow-symlinks -e 's:#UseDNS yes:UseDNS no:' ${IMAGE_ROOTFS}${sysconfdir}/ssh/sshd_config
fi
}
--
2.11.0
^ permalink raw reply related [flat|nested] 24+ messages in thread* Re: [PATCH v2 0/3] openssh: Make sshd-config a package
2017-01-24 9:07 ` [PATCH v2 0/3] openssh: Make sshd-config a package David Vincent
` (2 preceding siblings ...)
2017-01-24 9:07 ` [PATCH 3/3] rootfs-postcommands: Modify ssh-related commands David Vincent
@ 2017-01-24 19:07 ` Khem Raj
2017-01-25 7:58 ` David Vincent
2017-02-02 10:30 ` [PATCH v3 " David Vincent
4 siblings, 1 reply; 24+ messages in thread
From: Khem Raj @ 2017-01-24 19:07 UTC (permalink / raw)
To: openembedded-core
[-- Attachment #1.1: Type: text/plain, Size: 1034 bytes --]
On 1/24/17 1:07 AM, David Vincent wrote:
> This series of patch introduces a new way of modifying OpenSSH sshd
> configuration. Instead of modifying the files and launching the server with
> custom options, a package which RPROVIDES sshd-config must be installed.
>
> The package to use is selected using a new variable called SSHD_CONFIG which is
> used exclusively when selecting ssh-server-openssh in IMAGE_FEATURES.
>
How does this work with dropbear. Since we can use dropbear as a ssh
server alternative.
> Changes since v1:
> Remove documentation
>
> David Vincent (3):
> openssh: Package server configuration
> core-image: Set default sshd configuration
> rootfs-postcommands: Modify ssh-related commands
>
> meta/classes/core-image.bbclass | 3 +-
> meta/classes/rootfs-postcommands.bbclass | 28 ++++---------
> meta/recipes-connectivity/openssh/openssh_7.3p1.bb | 47 ++++++++++++++++++----
> 3 files changed, 49 insertions(+), 29 deletions(-)
>
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 211 bytes --]
^ permalink raw reply [flat|nested] 24+ messages in thread* Re: [PATCH v2 0/3] openssh: Make sshd-config a package
2017-01-24 19:07 ` [PATCH v2 0/3] openssh: Make sshd-config a package Khem Raj
@ 2017-01-25 7:58 ` David Vincent
0 siblings, 0 replies; 24+ messages in thread
From: David Vincent @ 2017-01-25 7:58 UTC (permalink / raw)
To: openembedded-core
On mardi 24 janvier 2017 11:07:18 CET Khem Raj wrote:
> How does this work with dropbear. Since we can use dropbear as a ssh
> server alternative.
Dropbear support has not been modified. SSHD_CONFIG has only been added to
FEATURE_PACKAGES_ssh-server-openssh variable and only applies to OpenSSH (I
think dropbear has no config file so I don't see the point of applying this).
On a side note, I see that this serie of patches is still marked as 'failure'
on patchwork, is that a problem or should I resubmit it as new (I may have
made some mistakes resubmitting it without marking it v2)
David
^ permalink raw reply [flat|nested] 24+ messages in thread
* [PATCH v3 0/3] openssh: Make sshd-config a package
2017-01-24 9:07 ` [PATCH v2 0/3] openssh: Make sshd-config a package David Vincent
` (3 preceding siblings ...)
2017-01-24 19:07 ` [PATCH v2 0/3] openssh: Make sshd-config a package Khem Raj
@ 2017-02-02 10:30 ` David Vincent
2017-02-02 10:30 ` [PATCH v3 1/3] openssh: Package server configuration David Vincent
` (2 more replies)
4 siblings, 3 replies; 24+ messages in thread
From: David Vincent @ 2017-02-02 10:30 UTC (permalink / raw)
To: openembedded-core
This series of patch introduces a new way of modifying OpenSSH sshd
configuration. Instead of modifying the files and launching the server with
custom options, a package which RPROVIDES sshd-config must be installed.
The package to use is selected using a new variable called SSHD_CONFIG which is
used exclusively when selecting ssh-server-openssh in IMAGE_FEATURES.
Changes since v1:
Remove documentation
Changes since v2:
Restore SYSCONFDIR in /etc/default/ssh, otherwise keys are not correctly
generated
David Vincent (3):
openssh: Package server configuration
core-image: Set default sshd configuration
rootfs-postcommands: Modify ssh-related commands
meta/classes/core-image.bbclass | 3 +-
meta/classes/rootfs-postcommands.bbclass | 17 +++-----
meta/recipes-connectivity/openssh/openssh_7.4p1.bb | 47 ++++++++++++++++++----
3 files changed, 48 insertions(+), 19 deletions(-)
--
2.11.0
^ permalink raw reply [flat|nested] 24+ messages in thread* [PATCH v3 1/3] openssh: Package server configuration
2017-02-02 10:30 ` [PATCH v3 " David Vincent
@ 2017-02-02 10:30 ` David Vincent
2017-02-02 10:30 ` [PATCH v3 2/3] core-image: Set default sshd configuration David Vincent
2017-02-02 10:30 ` [PATCH v3 3/3] rootfs-postcommands: Modify ssh-related commands David Vincent
2 siblings, 0 replies; 24+ messages in thread
From: David Vincent @ 2017-02-02 10:30 UTC (permalink / raw)
To: openembedded-core
Split sshd configuration for read-write/read-only rootfs in two distinct
packages. Also, add a package dependency between openssh-sshd package
and a provider of sshd-config.
Signed-off-by: David Vincent <freesilicon@gmail.com>
---
meta/recipes-connectivity/openssh/openssh_7.4p1.bb | 47 ++++++++++++++++++----
1 file changed, 40 insertions(+), 7 deletions(-)
diff --git a/meta/recipes-connectivity/openssh/openssh_7.4p1.bb b/meta/recipes-connectivity/openssh/openssh_7.4p1.bb
index 3b3d667a68..0afc4bd948 100644
--- a/meta/recipes-connectivity/openssh/openssh_7.4p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_7.4p1.bb
@@ -91,13 +91,17 @@ do_compile_ptest() {
}
do_install_append () {
+ # Create default config files
+ install -m 0644 ${D}${sysconfdir}/ssh/sshd_config ${D}${sysconfdir}/ssh/sshd_config_default
+ rm -f ${D}${sysconfdir}/ssh/sshd_config
+
if [ "${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'pam', '', d)}" = "pam" ]; then
install -D -m 0644 ${WORKDIR}/sshd ${D}${sysconfdir}/pam.d/sshd
- sed -i -e 's:#UsePAM no:UsePAM yes:' ${D}${sysconfdir}/ssh/sshd_config
+ sed -i -e 's:#UsePAM no:UsePAM yes:' ${D}${sysconfdir}/ssh/sshd_config_default
fi
if [ "${@bb.utils.contains('DISTRO_FEATURES', 'x11', 'x11', '', d)}" = "x11" ]; then
- sed -i -e 's:#X11Forwarding no:X11Forwarding yes:' ${D}${sysconfdir}/ssh/sshd_config
+ sed -i -e 's:#X11Forwarding no:X11Forwarding yes:' ${D}${sysconfdir}/ssh/sshd_config_default
fi
install -d ${D}${sysconfdir}/init.d
@@ -110,7 +114,7 @@ do_install_append () {
# Create config files for read-only rootfs
install -d ${D}${sysconfdir}/ssh
- install -m 644 ${D}${sysconfdir}/ssh/sshd_config ${D}${sysconfdir}/ssh/sshd_config_readonly
+ install -m 644 ${D}${sysconfdir}/ssh/sshd_config_default ${D}${sysconfdir}/ssh/sshd_config_readonly
sed -i '/HostKey/d' ${D}${sysconfdir}/ssh/sshd_config_readonly
echo "HostKey /var/run/ssh/ssh_host_rsa_key" >> ${D}${sysconfdir}/ssh/sshd_config_readonly
echo "HostKey /var/run/ssh/ssh_host_dsa_key" >> ${D}${sysconfdir}/ssh/sshd_config_readonly
@@ -134,30 +138,59 @@ do_install_ptest () {
ALLOW_EMPTY_${PN} = "1"
-PACKAGES =+ "${PN}-keygen ${PN}-scp ${PN}-ssh ${PN}-sshd ${PN}-sftp ${PN}-misc ${PN}-sftp-server"
+PACKAGES =+ "${PN}-keygen ${PN}-scp ${PN}-ssh ${PN}-sshd-config ${PN}-sshd-config-readonly ${PN}-sshd ${PN}-sftp ${PN}-misc ${PN}-sftp-server"
FILES_${PN}-scp = "${bindir}/scp.${BPN}"
FILES_${PN}-ssh = "${bindir}/ssh.${BPN} ${sysconfdir}/ssh/ssh_config"
+FILES_${PN}-sshd-config = "${sysconfdir}/ssh/sshd_config_default"
+FILES_${PN}-sshd-config-readonly = "${sysconfdir}/ssh/sshd_config_readonly"
FILES_${PN}-sshd = "${sbindir}/sshd ${sysconfdir}/init.d/sshd ${systemd_unitdir}/system"
-FILES_${PN}-sshd += "${sysconfdir}/ssh/moduli ${sysconfdir}/ssh/sshd_config ${sysconfdir}/ssh/sshd_config_readonly ${sysconfdir}/default/volatiles/99_sshd ${sysconfdir}/pam.d/sshd"
+FILES_${PN}-sshd += "${sysconfdir}/ssh/moduli ${sysconfdir}/default/volatiles/99_sshd ${sysconfdir}/pam.d/sshd"
FILES_${PN}-sftp = "${bindir}/sftp"
FILES_${PN}-sftp-server = "${libexecdir}/sftp-server"
FILES_${PN}-misc = "${bindir}/ssh* ${libexecdir}/ssh*"
FILES_${PN}-keygen = "${bindir}/ssh-keygen"
RDEPENDS_${PN} += "${PN}-scp ${PN}-ssh ${PN}-sshd ${PN}-keygen"
-RDEPENDS_${PN}-sshd += "${PN}-keygen ${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'pam-plugin-keyinit pam-plugin-loginuid', '', d)}"
+RDEPENDS_${PN}-sshd += "${PN}-keygen sshd-config ${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'pam-plugin-keyinit pam-plugin-loginuid', '', d)}"
RDEPENDS_${PN}-ptest += "${PN}-sftp ${PN}-misc ${PN}-sftp-server make"
RPROVIDES_${PN}-ssh = "ssh"
+RPROVIDES_${PN}-sshd-config = "sshd-config"
+RPROVIDES_${PN}-sshd-config-readonly = "sshd-config"
RPROVIDES_${PN}-sshd = "sshd"
RCONFLICTS_${PN} = "dropbear"
+RCONFLICTS_${PN}-sshd-config = "${PN}-sshd-config-readonly"
+RCONFLICTS_${PN}-sshd-config-readonly = "${PN}-sshd-config"
RCONFLICTS_${PN}-sshd = "dropbear"
RCONFLICTS_${PN}-keygen = "ssh-keygen"
-CONFFILES_${PN}-sshd = "${sysconfdir}/ssh/sshd_config"
+CONFFILES_${PN}-sshd-config = "${sysconfdir}/ssh/sshd_config_default"
+CONFFILES_${PN}-sshd-config-readonly = "${sysconfdir}/ssh/sshd_config_readonly"
CONFFILES_${PN}-ssh = "${sysconfdir}/ssh/ssh_config"
+pkg_postinst_${PN}-sshd-config () {
+#!/bin/sh
+if [ -e $D${sysconfdir}/ssh/sshd_config ]; then
+ rm $D${sysconfdir}/ssh/sshd_config
+fi
+
+# Make sure destination directory exists, before creating the symlink
+mkdir -p $D${sysconfdir}/ssh
+ln -s sshd_config_default $D${sysconfdir}/ssh/sshd_config
+}
+
+pkg_postinst_${PN}-sshd-config-readonly () {
+#!/bin/sh
+if [ -e $D${sysconfdir}/ssh/sshd_config ]; then
+ rm $D${sysconfdir}/ssh/sshd_config
+fi
+
+# Make sure destination directory exists, before creating the symlink
+mkdir -p $D${sysconfdir}/ssh
+ln -s sshd_config_readonly $D${sysconfdir}/ssh/sshd_config
+}
+
ALTERNATIVE_PRIORITY = "90"
ALTERNATIVE_${PN}-scp = "scp"
ALTERNATIVE_${PN}-ssh = "ssh"
--
2.11.0
^ permalink raw reply related [flat|nested] 24+ messages in thread* [PATCH v3 2/3] core-image: Set default sshd configuration
2017-02-02 10:30 ` [PATCH v3 " David Vincent
2017-02-02 10:30 ` [PATCH v3 1/3] openssh: Package server configuration David Vincent
@ 2017-02-02 10:30 ` David Vincent
2017-02-02 10:30 ` [PATCH v3 3/3] rootfs-postcommands: Modify ssh-related commands David Vincent
2 siblings, 0 replies; 24+ messages in thread
From: David Vincent @ 2017-02-02 10:30 UTC (permalink / raw)
To: openembedded-core
When selecting OpenSSH as ssh server provider instead of dropbear, also
install the correct configuration depending on whether the final rootfs
is read-only or not.
Signed-off-by: David Vincent <freesilicon@gmail.com>
---
meta/classes/core-image.bbclass | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/meta/classes/core-image.bbclass b/meta/classes/core-image.bbclass
index 8431440db4..d1f643d920 100644
--- a/meta/classes/core-image.bbclass
+++ b/meta/classes/core-image.bbclass
@@ -41,7 +41,7 @@ FEATURE_PACKAGES_tools-sdk = "packagegroup-core-sdk packagegroup-core-standalone
FEATURE_PACKAGES_nfs-server = "packagegroup-core-nfs-server"
FEATURE_PACKAGES_nfs-client = "packagegroup-core-nfs-client"
FEATURE_PACKAGES_ssh-server-dropbear = "packagegroup-core-ssh-dropbear"
-FEATURE_PACKAGES_ssh-server-openssh = "packagegroup-core-ssh-openssh"
+FEATURE_PACKAGES_ssh-server-openssh = "packagegroup-core-ssh-openssh ${SSHD_CONFIG}"
FEATURE_PACKAGES_hwcodecs = "${MACHINE_HWCODECS}"
@@ -52,6 +52,7 @@ IMAGE_FEATURES_REPLACES_ssh-server-openssh = "ssh-server-dropbear"
# IMAGE_FEATURES_CONFLICTS_foo = 'bar1 bar2'
# An error exception would be raised if both image features foo and bar1(or bar2) are included
+SSHD_CONFIG ??= "${@bb.utils.contains('IMAGE_FEATURES','read-only-rootfs','openssh-sshd-config-readonly','openssh-sshd-config',d)}"
MACHINE_HWCODECS ??= ""
CORE_IMAGE_BASE_INSTALL = '\
--
2.11.0
^ permalink raw reply related [flat|nested] 24+ messages in thread* [PATCH v3 3/3] rootfs-postcommands: Modify ssh-related commands
2017-02-02 10:30 ` [PATCH v3 " David Vincent
2017-02-02 10:30 ` [PATCH v3 1/3] openssh: Package server configuration David Vincent
2017-02-02 10:30 ` [PATCH v3 2/3] core-image: Set default sshd configuration David Vincent
@ 2017-02-02 10:30 ` David Vincent
2 siblings, 0 replies; 24+ messages in thread
From: David Vincent @ 2017-02-02 10:30 UTC (permalink / raw)
To: openembedded-core
OpenSSH configuration is now a symlink which points to the desired
configuration, so the functions that modified it must be updated to
modify the target and not override it.
Signed-off-by: David Vincent <freesilicon@gmail.com>
---
meta/classes/rootfs-postcommands.bbclass | 17 ++++++-----------
1 file changed, 6 insertions(+), 11 deletions(-)
diff --git a/meta/classes/rootfs-postcommands.bbclass b/meta/classes/rootfs-postcommands.bbclass
index c42829dd65..60cfac82c4 100644
--- a/meta/classes/rootfs-postcommands.bbclass
+++ b/meta/classes/rootfs-postcommands.bbclass
@@ -87,15 +87,12 @@ read_only_rootfs_hook () {
sed -i -e '/^[#[:space:]]*\/dev\/root/{s/defaults/ro/;s/\([[:space:]]*[[:digit:]]\)\([[:space:]]*\)[[:digit:]]$/\1\20/}' ${IMAGE_ROOTFS}/etc/fstab
# If we're using openssh and the /etc/ssh directory has no pre-generated keys,
- # we should configure openssh to use the configuration file /etc/ssh/sshd_config_readonly
- # and the keys under /var/run/ssh.
+ # we should configure openssh to use the keys under /var/run/ssh.
if [ -d ${IMAGE_ROOTFS}/etc/ssh ]; then
if [ -e ${IMAGE_ROOTFS}/etc/ssh/ssh_host_rsa_key ]; then
echo "SYSCONFDIR=/etc/ssh" >> ${IMAGE_ROOTFS}/etc/default/ssh
- echo "SSHD_OPTS=" >> ${IMAGE_ROOTFS}/etc/default/ssh
else
echo "SYSCONFDIR=/var/run/ssh" >> ${IMAGE_ROOTFS}/etc/default/ssh
- echo "SSHD_OPTS='-f /etc/ssh/sshd_config_readonly'" >> ${IMAGE_ROOTFS}/etc/default/ssh
fi
fi
@@ -138,12 +135,10 @@ zap_empty_root_password () {
# allow dropbear/openssh to accept root logins and logins from accounts with an empty password string
#
ssh_allow_empty_password () {
- for config in sshd_config sshd_config_readonly; do
- if [ -e ${IMAGE_ROOTFS}${sysconfdir}/ssh/$config ]; then
- sed -i 's/^[#[:space:]]*PermitRootLogin.*/PermitRootLogin yes/' ${IMAGE_ROOTFS}${sysconfdir}/ssh/$config
- sed -i 's/^[#[:space:]]*PermitEmptyPasswords.*/PermitEmptyPasswords yes/' ${IMAGE_ROOTFS}${sysconfdir}/ssh/$config
- fi
- done
+ if [ -e ${IMAGE_ROOTFS}${sysconfdir}/ssh/sshd_config ]; then
+ sed -i --follow-symlinks 's/^[#[:space:]]*PermitRootLogin.*/PermitRootLogin yes/' ${IMAGE_ROOTFS}${sysconfdir}/ssh/sshd_config
+ sed -i --follow-symlinks 's/^[#[:space:]]*PermitEmptyPasswords.*/PermitEmptyPasswords yes/' ${IMAGE_ROOTFS}${sysconfdir}/ssh/sshd_config
+ fi
if [ -e ${IMAGE_ROOTFS}${sbindir}/dropbear ] ; then
if grep -q DROPBEAR_EXTRA_ARGS ${IMAGE_ROOTFS}${sysconfdir}/default/dropbear 2>/dev/null ; then
@@ -162,7 +157,7 @@ ssh_allow_empty_password () {
ssh_disable_dns_lookup () {
if [ -e ${IMAGE_ROOTFS}${sysconfdir}/ssh/sshd_config ]; then
- sed -i -e 's:#UseDNS yes:UseDNS no:' ${IMAGE_ROOTFS}${sysconfdir}/ssh/sshd_config
+ sed -i --follow-symlinks -e 's:#UseDNS yes:UseDNS no:' ${IMAGE_ROOTFS}${sysconfdir}/ssh/sshd_config
fi
}
--
2.11.0
^ permalink raw reply related [flat|nested] 24+ messages in thread