code.grnet.gr Git - snf-image/blob - snf-image-helper/tasks/40DeleteSSHKeys.in

   1 #! /bin/bash
   2
   3 # Copyright (C) 2011 GRNET S.A.
   4 #
   5 # This program is free software; you can redistribute it and/or modify
   6 # it under the terms of the GNU General Public License as published by
   7 # the Free Software Foundation; either version 2 of the License, or
   8 # (at your option) any later version.
   9 #
  10 # This program is distributed in the hope that it will be useful, but
  11 # WITHOUT ANY WARRANTY; without even the implied warranty of
  12 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  13 # General Public License for more details.
  14 #
  15 # You should have received a copy of the GNU General Public License
  16 # along with this program; if not, write to the Free Software
  17 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
  18 # 02110-1301, USA.
  19
  20 ### BEGIN TASK INFO
  21 # Provides:             DeleteSSHKeys
  22 # RunBefore:            EnforcePersonality
  23 # RunAfter:             MountImage
  24 # Short-Description:    Remove ssh keys and in some cases recreate them
  25 ### END TASK INFO
  26
  27 set -e
  28 . "@commondir@/common.sh"
  29
  30 trap task_cleanup EXIT
  31 report_task_start
  32
  33 # Check if the task should be prevented from running.
  34 check_if_excluded
  35
  36 if [ ! -d "$SNF_IMAGE_TARGET" ]; then
  37     log_error "Target dir: \`$SNF_IMAGE_TARGET' is missing."
  38 fi
  39
  40 if [ "$SNF_IMAGE_PROPERTY_OSFAMILY" = "windows" ]; then
  41     exit 0
  42 fi
  43
  44 distro=$(get_base_distro "$SNF_IMAGE_TARGET")
  45
  46 HOST_KEY="/etc/ssh/ssh_host_key"
  47 RSA_KEY="/etc/ssh/ssh_host_rsa_key"
  48 DSA_KEY="/etc/ssh/ssh_host_dsa_key"
  49 ECDSA_KEY="/etc/ssh/ssh_host_ecdsa_key"
  50
  51 target="$SNF_IMAGE_TARGET"
  52
  53 mount -o bind /proc "$target/proc"
  54 add_cleanup umount "$target/proc"
  55 mount -o bind /dev "$target/dev"
  56 add_cleanup umount "$target/dev"
  57
  58 #Remove the default keys
  59 for pair in "$HOST_KEY@rsa1" "$RSA_KEY@rsa" "$DSA_KEY@dsa" "$ECDSA_KEY@ecdsa"; do
  60     key=$(echo $pair | cut -d@ -f1)
  61     key_type=$(echo $pair | cut -d@ -f2)
  62     if [ -e "$target/$key" ]; then
  63         rm -f "$target/$key"{,.pub}
  64         if [ "x$distro" = "xdebian" ]; then
  65             chroot "$target" \
  66                 env PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin \
  67                 ssh-keygen -t $key_type -q -N '' -f "$key"
  68         fi
  69     fi
  70 done
  71
  72 config="$target/etc/ssh/sshd_config"
  73 if [ ! -e "$config" ]; then
  74     warn "Config file: \`$config' is missing."
  75     warn "Can't check for non-default keys."
  76     exit 0
  77 fi
  78
  79 # Remove non-default keys...
  80 { grep ^HostKey "$config" || true; } | while read key_line; do
  81     key=$(echo $key_line | cut -d" " -f2)
  82     if [ "$key" = $HOST_KEY -o "$key" = $RSA_KEY -o \
  83             "$key" = $DSA_KEY -o "$key" = $ECDSA_KEY ]; then
  84         continue
  85     fi
  86
  87     if [ "x$distro" = "xdebian" ]; then
  88         # Most distros recreate missing keys...debian complains
  89         type=""
  90         if [ -e "$target/$key" ]; then
  91             if grep -e "-----BEGIN DSA PRIVATE KEY-----" "$target/$key" > /dev/null; then
  92                 type=dsa
  93             elif grep -e "-----BEGIN EC PRIVATE KEY-----" "$target/$key" > /dev/null; then
  94                 type=ecdsa
  95             elif grep -e "-----BEGIN RSA PRIVATE KEY-----" "$target/$key" > /dev/null; then
  96                 type=rsa
  97             elif grep -e "SSH PRIVATE KEY FILE FORMAT" "$target/$key" > /dev/null; then
  98                 type=rsa1
  99             fi
 100         else # do some guessing...
 101             for i in rsa dsa ecdsa; do
 102                 if echo "$key" | grep _${i}_ > /dev/null; then
 103                     type="$i";
 104                     break;
 105                 fi
 106             done
 107         fi
 108         if [ -z "$type" ]; then
 109             echo "Warning: Unknown key type. I'll use \`rsa1'";
 110             type=rsa1
 111         fi
 112
 113         rm -f "$target/$key"{,.pub}
 114         chroot "$target" \
 115             env PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin \
 116             ssh-keygen -t $type -q -N '' -f "$key"
 117     else
 118         rm -f "$target/$key"{,.pub}
 119     fi
 120 done
 121
 122 exit 0
 123
 124 # vim: set sta sts=4 shiftwidth=4 sw=4 et ai :