On Monday, November 16, 2020 10:36 CET, Michael Olbrich <[email protected]> wrote: > On Sun, Nov 15, 2020 at 06:08:56PM +0100, Roland Hieber wrote: > > On Sun, Nov 15, 2020 at 11:06:12AM +0100, Ladislav Michl wrote: > > > On Sat, Nov 14, 2020 at 09:34:47PM +0100, Roland Hieber wrote: > > > > On Fri, Nov 13, 2020 at 06:46:48PM +0100, Ladislav Michl wrote: > > > > > On Fri, Nov 13, 2020 at 03:19:55PM +0100, Artur Wiebe wrote: > > > > > > How can openssh.postinst be disabled from within the rule files? > > > > > > > > > > The very same could be achieved with symlink in your BSP: > > > > > projectroot/etc/rc.once.d/openssh -> /dev/null > > > > > > > > I don't understand why you want to disable this. The SSH server will not > > > > start without host keys. Or do you want to install a static version of > > > > the host keys generated at build time? > > > > > > Yes, keys are static, generated at build time. Root filesystem is > > > read-only. > > > > > > > If so, there should be an option for this. But for now, in my opinion, > > > > disabling OPENSSH_SSHD_GENKEYS will just lead to a broken SSH server. > > > > > > As this is easy to solve at BSP level I never thought it could > > > be a thing :) > > > > OK, but at least I would mention it in the kconfig help text. The > > Ack. > > > openssh recipe could also just pick up /etc/ssh/ssh_host_*_key via > > install_alternative if this option is disabled. > > No. Shared ssh server keys are a bad idea. That's not something I want to > merge upstream.
This was also my concern... > > But there are other use-cases to not use rc-once, e.g. if the server keys > are generated during provisioning. And not selecting rc-once in this case > makes sense, so this is acceptable im general. I still need a way to disable openssh.postinst if OPENSSH_SSHD_GENKEYS is not set. > > Michael > > > _______________________________________________ > ptxdist mailing list > [email protected] > To unsubscribe, send a mail with subject "unsubscribe" to > [email protected] _______________________________________________ ptxdist mailing list [email protected] To unsubscribe, send a mail with subject "unsubscribe" to [email protected]
