Statistics
| Branch: | Tag: | Revision:

root / snf-image-helper / tasks / 40DeleteSSHKeys.in @ fe816d8b

History | View | Annotate | Download (3.6 kB)

1
#! /bin/bash
2

    
3
# Copyright (C) 2011 GRNET S.A. 
4
#
5
# This program is free software; you can redistribute it and/or modify
6
# it under the terms of the GNU General Public License as published by
7
# the Free Software Foundation; either version 2 of the License, or
8
# (at your option) any later version.
9
#
10
# This program is distributed in the hope that it will be useful, but
11
# WITHOUT ANY WARRANTY; without even the implied warranty of
12
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
13
# General Public License for more details.
14
#
15
# You should have received a copy of the GNU General Public License
16
# along with this program; if not, write to the Free Software
17
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
18
# 02110-1301, USA.
19

    
20
### BEGIN TASK INFO
21
# Provides:		DeleteSSHKeys
22
# RunBefore:            UmountImage
23
# RunAfter:             MountImage
24
# Short-Description:	Remove ssh keys and in some cases recreate them
25
### END TASK INFO
26

    
27
set -e
28
. "@commondir@/common.sh"
29

    
30
# Check if the task should be prevented from running.
31
check_if_excluded
32

    
33
if [ ! -d "$SNF_IMAGE_TARGET" ]; then
34
    log_error "Target dir: \`$SNF_IMAGE_TARGET' is missing."
35
fi
36

    
37
if [ "$SNF_IMAGE_PROPERTY_OSFAMILY" != "linux" ]; then
38
    exit 0
39
fi
40

    
41
distro=$(get_base_distro "$SNF_IMAGE_TARGET")
42

    
43
HOST_KEY="/etc/ssh/ssh_host_key"
44
RSA_KEY="/etc/ssh/ssh_host_rsa_key"
45
DSA_KEY="/etc/ssh/ssh_host_dsa_key"
46
ECDSA_KEY="/etc/ssh/ssh_host_ecdsa_key"
47

    
48
target="$SNF_IMAGE_TARGET"
49

    
50
#Remove the default keys
51
for pair in "$HOST_KEY@rsa1" "$RSA_KEY@rsa" "$DSA_KEY@dsa" "$ECDSA_KEY@ecdsa"; do
52
    key=$(echo $pair | cut -d@ -f1)
53
    key_type=$(echo $pair | cut -d@ -f2)
54
    if [ -e "$target/$key" ]; then
55
        rm -f "$target/$key"{,.pub}
56
        if [ "x$distro" = "xdebian" ]; then
57
            chroot "$target" \
58
                env PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin \
59
                ssh-keygen -t $key_type -q -N '' -f "$key"
60
        fi
61
    fi
62
done
63

    
64
config="$target/etc/ssh/sshd_config"
65
if [ ! -e "$config" ]; then
66
    warn "Config file: \`$config' is missing."
67
    warn "Can't check for non-default keys."
68
    exit 0
69
fi
70

    
71
# Remove non-default keys...
72
grep ^HostKey "$config" || true | while read key_line; do
73
    key=$(echo $key_line | cut -d" " -f2)
74
    if [ "$key" = $HOST_KEY -o "$key" = $RSA_KEY -o \
75
            "$key" = $DSA_KEY -o "$key" = $ECDSA_KEY ]; then
76
        continue;
77
    fi
78

    
79
    if [ "x$distro" = "xdebian" ]; then
80
        # Most distros recreate missing keys...debian complains
81
        type=""
82
        if [ -e "$target/$key" ]; then
83
            if grep -e "-----BEGIN DSA PRIVATE KEY-----" "$target/$key"; then
84
                type=dsa
85
            elif grep -e "-----BEGIN EC PRIVATE KEY-----" "$target/$key"; then
86
                type=ecdsa
87
            elif grep -e "-----BEGIN RSA PRIVATE KEY-----" "$target/$key"; then
88
                type=rsa
89
            elif grep -e "SSH PRIVATE KEY FILE FORMAT" "$target/$key"; then
90
                type=rsa1
91
            fi
92
        else # do some guessing...
93
            for i in rsa dsa ecdsa; do
94
                if echo "$key" | grep _${i}_ > /dev/null; then
95
                    type="$i";
96
                    break;
97
                fi
98
            done
99
        fi
100
        if [ -z "$type" ]; then
101
            echo "Warning: Unknown key type. I'll use \`rsa1'";
102
            type=rsa1
103
        fi
104

    
105
        rm -f "$target/$key"{,.pub}
106
        chroot "$target" \
107
            env PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin \
108
            ssh-keygen -t $type -q -N '' -f "$key"
109
    else
110
        rm -f "$target/$key"{,.pub}
111
    fi
112
done
113

    
114
exit 0
115

    
116
# vim: set sta sts=4 shiftwidth=4 sw=4 et ai :