On Mon, Nov 16, 2020 at 10:45:07AM +0100, Artur Wiebe wrote:
> On Monday, November 16, 2020 10:36 CET, Michael Olbrich
> <[email protected]> wrote:
> > On Sun, Nov 15, 2020 at 06:08:56PM +0100, Roland Hieber wrote:
> > > On Sun, Nov 15, 2020 at 11:06:12AM +0100, Ladislav Michl wrote:
> > > > On Sat, Nov 14, 2020 at 09:34:47PM +0100, Roland Hieber wrote:
> > > > > On Fri, Nov 13, 2020 at 06:46:48PM +0100, Ladislav Michl wrote:
> > > > > > On Fri, Nov 13, 2020 at 03:19:55PM +0100, Artur Wiebe wrote:
> > > > > > > How can openssh.postinst be disabled from within the rule files?
> > > > > >
> > > > > > The very same could be achieved with symlink in your BSP:
> > > > > > projectroot/etc/rc.once.d/openssh -> /dev/null
> > > > >
> > > > > I don't understand why you want to disable this. The SSH server will
> > > > > not
> > > > > start without host keys. Or do you want to install a static version of
> > > > > the host keys generated at build time?
> > > >
> > > > Yes, keys are static, generated at build time. Root filesystem is
> > > > read-only.
> > > >
> > > > > If so, there should be an option for this. But for now, in my opinion,
> > > > > disabling OPENSSH_SSHD_GENKEYS will just lead to a broken SSH server.
> > > >
> > > > As this is easy to solve at BSP level I never thought it could
> > > > be a thing :)
> > >
> > > OK, but at least I would mention it in the kconfig help text. The
> >
> > Ack.
> >
> > > openssh recipe could also just pick up /etc/ssh/ssh_host_*_key via
> > > install_alternative if this option is disabled.
> >
> > No. Shared ssh server keys are a bad idea. That's not something I want to
> > merge upstream.
>
> This was also my concern...
>
> >
> > But there are other use-cases to not use rc-once, e.g. if the server keys
> > are generated during provisioning. And not selecting rc-once in this case
> > makes sense, so this is acceptable im general.
>
> I still need a way to disable openssh.postinst if OPENSSH_SSHD_GENKEYS is not
> set.
Hmmm, right. In the BSP, a /dev/null symlinks works for this as well, but
we currently don't have a way to not install the postinst script. We could
do something like this (untested):
$(call install_script_replace, openssh, postinst, @RC_ONCE@, \
$(call ptx/ifdef, PTXCONF_OPENSSH_SSHD_GENKEYS,,#))
And in rules/openssh.postinst:
#!/bin/sh
@RC_ONCE@$DESTDIR/usr/sbin/enable-rc-once openssh
This way the script may be installed, but it will do nothing. If
PTXCONF_OPENSSH_SSHD_GENKEYS is disabled.
Michael
--
Pengutronix e.K. | |
Steuerwalder Str. 21 | http://www.pengutronix.de/ |
31137 Hildesheim, Germany | Phone: +49-5121-206917-0 |
Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
_______________________________________________
ptxdist mailing list
[email protected]
To unsubscribe, send a mail with subject "unsubscribe" to
[email protected]
