When storing your keys not in rootfs but on a separate data partition
(using symbolic links or overlay fs), keys are overwritten on each
firmware upgrade which lets rc-once run again (which happens when using
opkg upgrade/update or RAUC in an A/B scheme for example).
Changing keys are at best annoying, but may be interpreted as an attack
as well.
For dropbear the same behaviour was implemented with ac97e77eedf7
("[dropbear] rc.once: only generate keys if they aren't present yet").
Signed-off-by: Alexander Dahl <[email protected]>
---
projectroot/etc/rc.once.d/openssh | 1 +
1 file changed, 1 insertion(+)
diff --git a/projectroot/etc/rc.once.d/openssh
b/projectroot/etc/rc.once.d/openssh
index 545586f07..595e28477 100644
--- a/projectroot/etc/rc.once.d/openssh
+++ b/projectroot/etc/rc.once.d/openssh
@@ -27,6 +27,7 @@ create_keys() {
hostkeys="$(get_hostkeys)" || return
for keyfile in $hostkeys; do
+ [ -e "$keyfile" ] && continue
create_key "$keyfile" || return
done
}
base-commit: 51994d1b518323d2975491090a2452d34b1a39f9
--
2.30.2
_______________________________________________
ptxdist mailing list
[email protected]
To unsubscribe, send a mail with subject "unsubscribe" to
[email protected]
