3 # Copyright (C) 2011 GRNET S.A.
5 # This program is free software; you can redistribute it and/or modify
6 # it under the terms of the GNU General Public License as published by
7 # the Free Software Foundation; either version 2 of the License, or
8 # (at your option) any later version.
10 # This program is distributed in the hope that it will be useful, but
11 # WITHOUT ANY WARRANTY; without even the implied warranty of
12 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
13 # General Public License for more details.
15 # You should have received a copy of the GNU General Public License
16 # along with this program; if not, write to the Free Software
17 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
21 # Provides: DeleteSSHKeys
22 # RunBefore: EnforcePersonality
23 # RunAfter: MountImage
24 # Short-Description: Remove ssh keys and in some cases recreate them
28 . "@commondir@/common.sh"
30 trap task_cleanup EXIT
33 # Check if the task should be prevented from running.
36 if [ ! -d "$SNF_IMAGE_TARGET" ]; then
37 log_error "Target dir: \`$SNF_IMAGE_TARGET' is missing."
40 if [ "$SNF_IMAGE_PROPERTY_OSFAMILY" = "windows" ]; then
44 distro=$(get_base_distro "$SNF_IMAGE_TARGET")
46 HOST_KEY="/etc/ssh/ssh_host_key"
47 RSA_KEY="/etc/ssh/ssh_host_rsa_key"
48 DSA_KEY="/etc/ssh/ssh_host_dsa_key"
49 ECDSA_KEY="/etc/ssh/ssh_host_ecdsa_key"
51 target="$SNF_IMAGE_TARGET"
53 mount -o bind /proc "$target/proc"
54 add_cleanup umount "$target/proc"
55 mount -o bind /dev "$target/dev"
56 add_cleanup umount "$target/dev"
58 #Remove the default keys
59 for pair in "$HOST_KEY@rsa1" "$RSA_KEY@rsa" "$DSA_KEY@dsa" "$ECDSA_KEY@ecdsa"; do
60 key=$(echo $pair | cut -d@ -f1)
61 key_type=$(echo $pair | cut -d@ -f2)
62 if [ -e "$target/$key" ]; then
63 rm -f "$target/$key"{,.pub}
64 if [ "x$distro" = "xdebian" ]; then
66 env PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin \
67 ssh-keygen -t $key_type -q -N '' -f "$key"
72 config="$target/etc/ssh/sshd_config"
73 if [ ! -e "$config" ]; then
74 warn "Config file: \`$config' is missing."
75 warn "Can't check for non-default keys."
79 # Remove non-default keys...
80 { grep ^HostKey "$config" || true; } | while read key_line; do
81 key=$(echo $key_line | cut -d" " -f2)
82 if [ "$key" = $HOST_KEY -o "$key" = $RSA_KEY -o \
83 "$key" = $DSA_KEY -o "$key" = $ECDSA_KEY ]; then
87 if [ "x$distro" = "xdebian" ]; then
88 # Most distros recreate missing keys...debian complains
90 if [ -e "$target/$key" ]; then
91 if grep -e "-----BEGIN DSA PRIVATE KEY-----" "$target/$key" > /dev/null; then
93 elif grep -e "-----BEGIN EC PRIVATE KEY-----" "$target/$key" > /dev/null; then
95 elif grep -e "-----BEGIN RSA PRIVATE KEY-----" "$target/$key" > /dev/null; then
97 elif grep -e "SSH PRIVATE KEY FILE FORMAT" "$target/$key" > /dev/null; then
100 else # do some guessing...
101 for i in rsa dsa ecdsa; do
102 if echo "$key" | grep _${i}_ > /dev/null; then
108 if [ -z "$type" ]; then
109 echo "Warning: Unknown key type. I'll use \`rsa1'";
113 rm -f "$target/$key"{,.pub}
115 env PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin \
116 ssh-keygen -t $type -q -N '' -f "$key"
118 rm -f "$target/$key"{,.pub}
124 # vim: set sta sts=4 shiftwidth=4 sw=4 et ai :