aboutsummaryrefslogtreecommitdiffstats
path: root/src/fripost-partman-udeb
diff options
context:
space:
mode:
Diffstat (limited to 'src/fripost-partman-udeb')
-rw-r--r--src/fripost-partman-udeb/base.sh30
1 files changed, 17 insertions, 13 deletions
diff --git a/src/fripost-partman-udeb/base.sh b/src/fripost-partman-udeb/base.sh
index 449d3ae..b6af4d1 100644
--- a/src/fripost-partman-udeb/base.sh
+++ b/src/fripost-partman-udeb/base.sh
@@ -35,7 +35,7 @@ fatal() {
# Ensure stdout is opened with line buffering. If some day stdbuf(1) is
# available in busybox, we should replace the LD_PRELOAD by 'stdbuf -oL -eL'.
-# XXX: see #751394
+# XXX: workaround for #751394
stdbuf() {
LD_PRELOAD=/lib/fripost-partman/stdbuf.so "$@"
}
@@ -298,12 +298,15 @@ fripost_encrypt() {
AllowAgentForwarding no
AllowTcpForwarding no
+ PermitOpen none
+ PermitTTY no
+ PermitUserRC no
ForceCommand /bin/cat >$keyfile
EOF
# Populate the authorized keys.
[ -d ~root/.ssh ] || mkdir -m0700 ~root/.ssh
- copy_authorized_keys $import/authorized_keys ~root/.ssh/authorized_keys 'no-pty'
+ copy_authorized_keys $import/authorized_keys ~root/.ssh/authorized_keys
# Start the SSH daemon
touch /var/log/lastlog
@@ -312,7 +315,7 @@ fripost_encrypt() {
# Tell the user we're ready
db_subst fripost/encryption-slurpkey_text IPv4 "$(getIPv4)"
db_subst fripost/encryption-slurpkey_text SSHFPR_SERVER \
- "$(/usr/bin/ssh-keygen -lf $sshHostKey)"
+ "$(sshfprs ${sshHostKey}.pub)"
db_subst fripost/encryption-slurpkey_text SSHFPR_AUTHORIZED \
"$(sshfprs ~root/.ssh/authorized_keys ' - ')"
@@ -379,21 +382,22 @@ fripost_encrypt() {
# Like ssh-keygen -lf, but for a file such as authorized_keys, which
-# may contain multiple keys.
+# may contain multiple keys. Also, use the comment associated with the
+# key rather than the filename.
#
-# Usage: sshfprs.sh file [prefix]
+# Usage: sshfprs file [prefix]
sshfprs() {
- local file="$1" prefix="${2:-}" pk
+ local file="$1" prefix="${2:-}" type pk comment pkf=$(mktemp)
- while read pk; do
+ sed -nr "s#^([^#]+\s)?(ssh-(dss|rsa|ed25519)|ecdsa-sha2-nistp(256|384|521))\s#\2 #p" "$file" | \
+ while read type pk comment; do
# /usr/bin/ssh-keygen can't read from STDIN, and the '<<<' is
# not POSIX, so we save each pubkey in a temporary file
- pkf=$(mktemp)
- echo "$pk" > "$pkf"
- echo "${prefix}$(/usr/bin/ssh-keygen -lf $pkf)"
- rm -f "$pkf"
- done < "$file"
+ echo "$type $pk $comment" > "$pkf"
+ echo "${prefix}$(/usr/bin/ssh-keygen -lf $pkf | sed "s#$pkf#$comment#")"
+ done
+ rm -f "$pkf"
}
# Copy an authorized_keys file, possibly adding some options. The input
@@ -403,7 +407,7 @@ sshfprs() {
copy_authorized_keys() {
local from="$1" to="$2"
if [ $# -gt 2 ]; then
- sed -r "s#^([^#]+\s)?(ssh-(dss|rsa)|ecdsa-sha2-nistp(256|384|521))\s#$3 \2 #" \
+ sed -r "s#^([^#]+\s)?(ssh-(dss|rsa|ed25519)|ecdsa-sha2-nistp(256|384|521))\s#$3 \2 #" \
"$from" > "$to"
else
cp "$from" "$to"