From: David Vincent <freesilicon@gmail.com>
To: openembedded-core@lists.openembedded.org
Subject: [PATCH 3/3] rootfs-postcommands: Modify ssh-related commands
Date: Tue, 24 Jan 2017 10:07:15 +0100 [thread overview]
Message-ID: <20170124090715.11646-4-freesilicon@gmail.com> (raw)
In-Reply-To: <20170124090715.11646-1-freesilicon@gmail.com>
OpenSSH configuration is now a symlink which points to the desired
configuration, so the functions that modified it must be updated to
modify the target and not override it.
Signed-off-by: David Vincent <freesilicon@gmail.com>
---
meta/classes/rootfs-postcommands.bbclass | 28 +++++++---------------------
1 file changed, 7 insertions(+), 21 deletions(-)
diff --git a/meta/classes/rootfs-postcommands.bbclass b/meta/classes/rootfs-postcommands.bbclass
index c8f18c6702..2d862b0b2e 100644
--- a/meta/classes/rootfs-postcommands.bbclass
+++ b/meta/classes/rootfs-postcommands.bbclass
@@ -86,20 +86,8 @@ read_only_rootfs_hook () {
# Tweak the mount option and fs_passno for rootfs in fstab
sed -i -e '/^[#[:space:]]*\/dev\/root/{s/defaults/ro/;s/\([[:space:]]*[[:digit:]]\)\([[:space:]]*\)[[:digit:]]$/\1\20/}' ${IMAGE_ROOTFS}/etc/fstab
- # If we're using openssh and the /etc/ssh directory has no pre-generated keys,
- # we should configure openssh to use the configuration file /etc/ssh/sshd_config_readonly
- # and the keys under /var/run/ssh.
- if [ -d ${IMAGE_ROOTFS}/etc/ssh ]; then
- if [ -e ${IMAGE_ROOTFS}/etc/ssh/ssh_host_rsa_key ]; then
- echo "SYSCONFDIR=/etc/ssh" >> ${IMAGE_ROOTFS}/etc/default/ssh
- echo "SSHD_OPTS=" >> ${IMAGE_ROOTFS}/etc/default/ssh
- else
- echo "SYSCONFDIR=/var/run/ssh" >> ${IMAGE_ROOTFS}/etc/default/ssh
- echo "SSHD_OPTS='-f /etc/ssh/sshd_config_readonly'" >> ${IMAGE_ROOTFS}/etc/default/ssh
- fi
- fi
-
- # Also tweak the key location for dropbear in the same way.
+ # If we're using dropbear and the /etc/dropbear directory has no pre-generated keys,
+ # we should configure dropbear to use the keys under /var/lib/dropbear.
if [ -d ${IMAGE_ROOTFS}/etc/dropbear ]; then
if [ -e ${IMAGE_ROOTFS}/etc/dropbear/dropbear_rsa_host_key ]; then
echo "DROPBEAR_RSAKEY_DIR=/etc/dropbear" >> ${IMAGE_ROOTFS}/etc/default/dropbear
@@ -138,12 +126,10 @@ zap_empty_root_password () {
# allow dropbear/openssh to accept root logins and logins from accounts with an empty password string
#
ssh_allow_empty_password () {
- for config in sshd_config sshd_config_readonly; do
- if [ -e ${IMAGE_ROOTFS}${sysconfdir}/ssh/$config ]; then
- sed -i 's/^[#[:space:]]*PermitRootLogin.*/PermitRootLogin yes/' ${IMAGE_ROOTFS}${sysconfdir}/ssh/$config
- sed -i 's/^[#[:space:]]*PermitEmptyPasswords.*/PermitEmptyPasswords yes/' ${IMAGE_ROOTFS}${sysconfdir}/ssh/$config
- fi
- done
+ if [ -e ${IMAGE_ROOTFS}${sysconfdir}/ssh/sshd_config ]; then
+ sed -i --follow-symlinks 's/^[#[:space:]]*PermitRootLogin.*/PermitRootLogin yes/' ${IMAGE_ROOTFS}${sysconfdir}/ssh/sshd_config
+ sed -i --follow-symlinks 's/^[#[:space:]]*PermitEmptyPasswords.*/PermitEmptyPasswords yes/' ${IMAGE_ROOTFS}${sysconfdir}/ssh/sshd_config
+ fi
if [ -e ${IMAGE_ROOTFS}${sbindir}/dropbear ] ; then
if grep -q DROPBEAR_EXTRA_ARGS ${IMAGE_ROOTFS}${sysconfdir}/default/dropbear 2>/dev/null ; then
@@ -162,7 +148,7 @@ ssh_allow_empty_password () {
ssh_disable_dns_lookup () {
if [ -e ${IMAGE_ROOTFS}${sysconfdir}/ssh/sshd_config ]; then
- sed -i -e 's:#UseDNS yes:UseDNS no:' ${IMAGE_ROOTFS}${sysconfdir}/ssh/sshd_config
+ sed -i --follow-symlinks -e 's:#UseDNS yes:UseDNS no:' ${IMAGE_ROOTFS}${sysconfdir}/ssh/sshd_config
fi
}
--
2.11.0
next prev parent reply other threads:[~2017-01-24 9:08 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-01-23 14:55 [PATCH 0/4] openssh: Make sshd-config a package David Vincent
2017-01-23 14:55 ` [PATCH 1/4] openssh: Package server configuration David Vincent
2017-01-23 14:55 ` [PATCH 2/4] core-image: Set default sshd configuration David Vincent
2017-01-23 14:55 ` [PATCH 3/4] rootfs-postcommands: Modify ssh-related commands David Vincent
2017-01-23 14:55 ` [PATCH 4/4] ref-manual: Add SSHD_CONFIG David Vincent
2017-01-23 15:23 ` ✗ patchtest: failure for openssh: Make sshd-config a package Patchwork
2017-01-23 15:45 ` David Vincent
2017-01-23 16:08 ` Leonardo Sandoval
2017-01-23 16:39 ` David Vincent
2017-01-23 17:56 ` Leonardo Sandoval
2017-01-24 8:43 ` [PATCH 0/3] " David Vincent
2017-01-24 8:43 ` [PATCH 1/3] openssh: Package server configuration David Vincent
2017-01-24 8:43 ` [PATCH 2/3] core-image: Set default sshd configuration David Vincent
2017-01-24 8:43 ` [PATCH 3/3] rootfs-postcommands: Modify ssh-related commands David Vincent
2017-01-24 9:07 ` [PATCH v2 0/3] openssh: Make sshd-config a package David Vincent
2017-01-24 9:07 ` [PATCH 1/3] openssh: Package server configuration David Vincent
2017-01-24 9:07 ` [PATCH 2/3] core-image: Set default sshd configuration David Vincent
2017-01-24 9:07 ` David Vincent [this message]
2017-01-24 19:07 ` [PATCH v2 0/3] openssh: Make sshd-config a package Khem Raj
2017-01-25 7:58 ` David Vincent
2017-02-02 10:30 ` [PATCH v3 " David Vincent
2017-02-02 10:30 ` [PATCH v3 1/3] openssh: Package server configuration David Vincent
2017-02-02 10:30 ` [PATCH v3 2/3] core-image: Set default sshd configuration David Vincent
2017-02-02 10:30 ` [PATCH v3 3/3] rootfs-postcommands: Modify ssh-related commands David Vincent
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170124090715.11646-4-freesilicon@gmail.com \
--to=freesilicon@gmail.com \
--cc=openembedded-core@lists.openembedded.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox