root / snf-image-helper / tasks / 40DeleteSSHKeys.in @ de7269cd
History | View | Annotate | Download (2.7 kB)
1 |
#! /bin/bash |
---|---|
2 |
|
3 |
### BEGIN TASK INFO |
4 |
# Provides: DeleteSSHKeys |
5 |
# RunBefore: UmountImage |
6 |
# RunAfter: MountImage |
7 |
# Short-Description: Remove ssh keys and in some cases recreate them |
8 |
### END TASK INFO |
9 |
|
10 |
set -e |
11 |
. "@commondir@/common.sh" |
12 |
|
13 |
if [ ! -d "$SNF_IMAGE_TARGET" ]; then |
14 |
log_error "Target dir: \`$SNF_IMAGE_TARGET' is missing." |
15 |
fi |
16 |
|
17 |
if [ "$SNF_IMAGE_PROPERTY_OSFAMILY" != "linux" ]; then |
18 |
exit 0 |
19 |
fi |
20 |
|
21 |
distro=$(get_base_distro "$SNF_IMAGE_TARGET") |
22 |
|
23 |
HOST_KEY="/etc/ssh/ssh_host_key" |
24 |
RSA_KEY="/etc/ssh/ssh_host_rsa_key" |
25 |
DSA_KEY="/etc/ssh/ssh_host_dsa_key" |
26 |
ECDSA_KEY="/etc/ssh/ssh_host_ecdsa_key" |
27 |
|
28 |
target="$SNF_IMAGE_TARGET" |
29 |
|
30 |
#Remove the default keys |
31 |
for pair in "$HOST_KEY@rsa1" "$RSA_KEY@rsa" "$DSA_KEY@dsa" "$ECDSA_KEY@ecdsa"; do |
32 |
key=$(echo $pair | cut -d@ -f1) |
33 |
key_type=$(echo $pair | cut -d@ -f2) |
34 |
if [ -e "$target/$key" ]; then |
35 |
rm -f "$target/$key"{,.pub} |
36 |
if [ "x$distro" = "xdebian" ]; then |
37 |
chroot "$target" \ |
38 |
env PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin \ |
39 |
ssh-keygen -t $key_type -q -N '' -f "$key" |
40 |
fi |
41 |
fi |
42 |
done |
43 |
|
44 |
config="$target/etc/ssh/sshd_config" |
45 |
if [ ! -e "$config" ]; then |
46 |
echo "Warning: Config file: \`$config' is missing." |
47 |
echo "Warning: Can't check for non-default keys." |
48 |
exit 0 |
49 |
fi |
50 |
|
51 |
# Remove non-default keys... |
52 |
grep ^HostKey "$config" | while read key_line; do |
53 |
key=$(echo $key_line | cut -d" " -f2) |
54 |
if [ "$key" = $HOST_KEY -o "$key" = $RSA_KEY -o \ |
55 |
"$key" = $DSA_KEY -o "$key" = $ECDSA_KEY ]; then |
56 |
continue; |
57 |
fi |
58 |
|
59 |
if [ "x$distro" = "xdebian" ]; then |
60 |
# Most distros recreate missing keys...debian complains |
61 |
type="" |
62 |
if [ -e "$target/$key" ]; then |
63 |
if grep -e "-----BEGIN DSA PRIVATE KEY-----" "$target/$key"; then |
64 |
type=dsa |
65 |
elif grep -e "-----BEGIN EC PRIVATE KEY-----" "$target/$key"; then |
66 |
type=ecdsa |
67 |
elif grep -e "-----BEGIN RSA PRIVATE KEY-----" "$target/$key"; then |
68 |
type=rsa |
69 |
elif grep -e "SSH PRIVATE KEY FILE FORMAT" "$target/$key"; then |
70 |
type=rsa1 |
71 |
fi |
72 |
else # do some guessing... |
73 |
for i in rsa dsa ecdsa; do |
74 |
echo "$key" | grep _${i}_ && { type="$i"; break; } |
75 |
done |
76 |
fi |
77 |
if [ -z "$type" ]; then |
78 |
echo "Warning: Unknown key type. I'll use \`rsa1'"; |
79 |
type=rsa1 |
80 |
fi |
81 |
|
82 |
rm -f "$target/$key"{,.pub} |
83 |
chroot "$target" \ |
84 |
env PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin \ |
85 |
ssh-keygen -t $type -q -N '' -f "$key" |
86 |
else |
87 |
rm -f "$target/$key"{,.pub} |
88 |
fi |
89 |
done |
90 |
|
91 |
exit 0 |
92 |
|
93 |
# vim: set sta sts=4 shiftwidth=4 sw=4 et ai : |