Merge pull request #79 from andsens/ecdsa-fix

Shred ECDSA keys when bootstrapping, regenerate at 1st boot

Author: andsens

init.d/generate-ssh-hostkeys renamed to init.d/squeeze/generate-ssh-hostkeys

@@ -0,0 +1,36 @@
+#!/bin/sh
+### BEGIN INIT INFO
+# Provides:       generate-ssh-hostkeys
+# Required-Start: $local_fs
+# Required-Stop:  
+# Should-Start:   
+# Should-Stop:    
+# Default-Start:  S
+# Default-Stop:   
+# Description:    Generate ssh host keys if they do not exist
+### END INIT INFO
+
+prog=$(basename $0)
+logger="logger -t $prog"
+
+rsa_key="/etc/ssh/ssh_host_rsa_key"
+dsa_key="/etc/ssh/ssh_host_dsa_key"
+ecdsa_key="/etc/ssh/ssh_host_ecdsa_key"
+
+# Exit if the hostkeys already exist
+if [ -f $rsa_key -a -f $dsa_key -a -f $ecdsa_key ]; then
+	exit
+fi
+
+# Generate the ssh host keys
+[ -f $rsa_key ] || ssh-keygen -f $rsa_key -t rsa -C 'host' -N ''
+[ -f $dsa_key ] || ssh-keygen -f $dsa_key -t dsa -C 'host' -N ''
+[ -f $ecdsa_key ] || ssh-keygen -f $ecdsa_key -t ecdsa -C 'host' -N ''
+
+# Output the public keys to the console
+# This allows user to get host keys securely through console log
+echo "-----BEGIN SSH HOST KEY FINGERPRINTS-----" | $logger
+ssh-keygen -l -f $rsa_key.pub | $logger
+ssh-keygen -l -f $dsa_key.pub | $logger
+ssh-keygen -l -f $ecdsa_key.pub | $logger
+echo "------END SSH HOST KEY FINGERPRINTS------" | $logger

init.d/wheezy/generate-ssh-hostkeys

@@ -1,13 +1,6 @@
 #!/bin/bash
 # Clean up the image
 
-# Remove the ssh host keys, they need to be shredded
-shred --remove \
-	$imagedir/etc/ssh/ssh_host_dsa_key \
-	$imagedir/etc/ssh/ssh_host_dsa_key.pub \
-	$imagedir/etc/ssh/ssh_host_rsa_key \
-	$imagedir/etc/ssh/ssh_host_rsa_key.pub
-
 # We do the same to the bash history, there shouldn't be anything sensitive in there,
 # it's just in case plugins need to execute commands that have credentials in their parameters.
 # In fact: The standard bootstrapping process does not even create it.

tasks/60-cleanup

@@ -0,0 +1,3 @@
+#!/bin/bash
+# Add standard startup scripts to the init_scripts list
+init_scripts+=("$scriptdir/init.d/squeeze/generate-ssh-hostkeys")

tasks/squeeze/50-add-init-scripts

@@ -0,0 +1,7 @@
+#!/bin/bash
+# Remove the ssh host keys, they need to be shredded
+shred --remove \
+	$imagedir/etc/ssh/ssh_host_dsa_key \
+	$imagedir/etc/ssh/ssh_host_dsa_key.pub \
+	$imagedir/etc/ssh/ssh_host_rsa_key \
+	$imagedir/etc/ssh/ssh_host_rsa_key.pub

tasks/squeeze/62-delete-host-keys

@@ -1,3 +1,3 @@
 #!/bin/bash
 # Add standard startup scripts to the init_scripts list
-init_scripts+=("$scriptdir/init.d/generate-ssh-hostkeys")
+init_scripts+=("$scriptdir/init.d/wheezy/generate-ssh-hostkeys")

tasks/50-add-init-scripts renamed to tasks/wheezy/50-add-init-scripts

@@ -0,0 +1,9 @@
+#!/bin/bash
+# Remove the ssh host keys, they need to be shredded
+shred --remove \
+	$imagedir/etc/ssh/ssh_host_dsa_key \
+	$imagedir/etc/ssh/ssh_host_dsa_key.pub \
+	$imagedir/etc/ssh/ssh_host_rsa_key \
+	$imagedir/etc/ssh/ssh_host_rsa_key.pub \
+	$imagedir/etc/ssh/ssh_host_ecdsa_key \
+	$imagedir/etc/ssh/ssh_host_ecdsa_key.pub