summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAndre McCurdy <armccurdy@gmail.com>2017-03-06 17:42:25 -0800
committerRichard Purdie <richard.purdie@linuxfoundation.org>2017-03-10 14:50:10 +0000
commit5ccea3e02a3800dd0e6e41d80fb20b02035133da (patch)
tree508634c2ee4e5db066eb44b4b458f8af7e02fce2
parent3f3ced499c3be21e48abde2387d45133684702ca (diff)
downloadpoky-5ccea3e02a3800dd0e6e41d80fb20b02035133da.tar.gz
dropbear: drop support for DSA host keys in dropbear init script
Bring the dropbear init script into sync with the systemd service file (dropbearkey.service supports RSA host keys only) and with recent versions of openssh which deprecate DSA host keys. https://www.gentoo.org/support/news-items/2015-08-13-openssh-weak-keys.html (From OE-Core rev: 6bd7341a38a8bb5387ea81dbccfed327370569f3) Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
-rwxr-xr-xmeta/recipes-core/dropbear/dropbear/init36
1 files changed, 6 insertions, 30 deletions
diff --git a/meta/recipes-core/dropbear/dropbear/init b/meta/recipes-core/dropbear/dropbear/init
index 434bd6b971..f6e1c462fa 100755
--- a/meta/recipes-core/dropbear/dropbear/init
+++ b/meta/recipes-core/dropbear/dropbear/init
@@ -40,49 +40,28 @@ done
40if [ $readonly_rootfs = "1" ]; then 40if [ $readonly_rootfs = "1" ]; then
41 mkdir -p /var/lib/dropbear 41 mkdir -p /var/lib/dropbear
42 DROPBEAR_RSAKEY_DEFAULT="/var/lib/dropbear/dropbear_rsa_host_key" 42 DROPBEAR_RSAKEY_DEFAULT="/var/lib/dropbear/dropbear_rsa_host_key"
43 DROPBEAR_DSSKEY_DEFAULT="/var/lib/dropbear/dropbear_dss_host_key"
44else 43else
45 DROPBEAR_RSAKEY_DEFAULT="/etc/dropbear/dropbear_rsa_host_key" 44 DROPBEAR_RSAKEY_DEFAULT="/etc/dropbear/dropbear_rsa_host_key"
46 DROPBEAR_DSSKEY_DEFAULT="/etc/dropbear/dropbear_dss_host_key"
47fi 45fi
48 46
49test -z "$DROPBEAR_BANNER" || \ 47test -z "$DROPBEAR_BANNER" || \
50 DROPBEAR_EXTRA_ARGS="$DROPBEAR_EXTRA_ARGS -b $DROPBEAR_BANNER" 48 DROPBEAR_EXTRA_ARGS="$DROPBEAR_EXTRA_ARGS -b $DROPBEAR_BANNER"
51test -n "$DROPBEAR_RSAKEY" || \ 49test -n "$DROPBEAR_RSAKEY" || \
52 DROPBEAR_RSAKEY=$DROPBEAR_RSAKEY_DEFAULT 50 DROPBEAR_RSAKEY=$DROPBEAR_RSAKEY_DEFAULT
53test -n "$DROPBEAR_DSSKEY" || \
54 DROPBEAR_DSSKEY=$DROPBEAR_DSSKEY_DEFAULT
55test -n "$DROPBEAR_KEYTYPES" || \
56 DROPBEAR_KEYTYPES="rsa"
57 51
58gen_keys() { 52gen_keys() {
59for t in $DROPBEAR_KEYTYPES; do 53 if [ -f "$DROPBEAR_RSAKEY" -a ! -s "$DROPBEAR_RSAKEY" ]; then
60 case $t in 54 rm $DROPBEAR_RSAKEY || true
61 rsa) 55 fi
62 if [ -f "$DROPBEAR_RSAKEY" -a ! -s "$DROPBEAR_RSAKEY" ]; then 56 test -f $DROPBEAR_RSAKEY || dropbearkey -t rsa -f $DROPBEAR_RSAKEY $DROPBEAR_RSAKEY_ARGS
63 rm $DROPBEAR_RSAKEY || true
64 fi
65 test -f $DROPBEAR_RSAKEY || dropbearkey -t rsa -f $DROPBEAR_RSAKEY $DROPBEAR_RSAKEY_ARGS
66 ;;
67 dsa)
68 if [ -f "$DROPBEAR_DSSKEY" -a ! -s "$DROPBEAR_DSSKEY" ]; then
69 rm $DROPBEAR_DSSKEY || true
70 fi
71 test -f $DROPBEAR_DSSKEY || dropbearkey -t dss -f $DROPBEAR_DSSKEY $DROPBEAR_DSSKEY_ARGS
72 ;;
73 esac
74done
75} 57}
76 58
77case "$1" in 59case "$1" in
78 start) 60 start)
79 echo -n "Starting $DESC: " 61 echo -n "Starting $DESC: "
80 gen_keys 62 gen_keys
81 KEY_ARGS=""
82 test -f $DROPBEAR_DSSKEY && KEY_ARGS="$KEY_ARGS -d $DROPBEAR_DSSKEY"
83 test -f $DROPBEAR_RSAKEY && KEY_ARGS="$KEY_ARGS -r $DROPBEAR_RSAKEY"
84 start-stop-daemon -S -p $PIDFILE \ 63 start-stop-daemon -S -p $PIDFILE \
85 -x "$DAEMON" -- $KEY_ARGS \ 64 -x "$DAEMON" -- -r $DROPBEAR_RSAKEY \
86 -p "$DROPBEAR_PORT" $DROPBEAR_EXTRA_ARGS 65 -p "$DROPBEAR_PORT" $DROPBEAR_EXTRA_ARGS
87 echo "$NAME." 66 echo "$NAME."
88 ;; 67 ;;
@@ -95,11 +74,8 @@ case "$1" in
95 echo -n "Restarting $DESC: " 74 echo -n "Restarting $DESC: "
96 start-stop-daemon -K -x "$DAEMON" -p $PIDFILE 75 start-stop-daemon -K -x "$DAEMON" -p $PIDFILE
97 sleep 1 76 sleep 1
98 KEY_ARGS=""
99 test -f $DROPBEAR_DSSKEY && KEY_ARGS="$KEY_ARGS -d $DROPBEAR_DSSKEY"
100 test -f $DROPBEAR_RSAKEY && KEY_ARGS="$KEY_ARGS -r $DROPBEAR_RSAKEY"
101 start-stop-daemon -S -p $PIDFILE \ 77 start-stop-daemon -S -p $PIDFILE \
102 -x "$DAEMON" -- $KEY_ARGS \ 78 -x "$DAEMON" -- -r $DROPBEAR_RSAKEY \
103 -p "$DROPBEAR_PORT" $DROPBEAR_EXTRA_ARGS 79 -p "$DROPBEAR_PORT" $DROPBEAR_EXTRA_ARGS
104 echo "$NAME." 80 echo "$NAME."
105 ;; 81 ;;