124 lines
4.2 KiB
Diff
124 lines
4.2 KiB
Diff
diff --git a/modules.d/90crypt/cryptroot-ask.sh b/modules.d/90crypt/cryptroot-ask.sh
|
|
index 37a4deea..320eca82 100755
|
|
--- a/modules.d/90crypt/cryptroot-ask.sh
|
|
+++ b/modules.d/90crypt/cryptroot-ask.sh
|
|
@@ -174,15 +174,25 @@ fi
|
|
|
|
if [ $ask_passphrase -ne 0 ]; then
|
|
luks_open="$(command -v cryptsetup) $cryptsetupopts luksOpen"
|
|
- _timeout=$(getargs "rd.luks.timeout")
|
|
- _timeout=${_timeout:-0}
|
|
- ask_for_password --ply-tries 5 \
|
|
- --ply-cmd "$luks_open -T1 $device $luksname" \
|
|
- --ply-prompt "Password ($device)" \
|
|
- --tty-tries 1 \
|
|
- --tty-cmd "$luks_open -T5 -t $_timeout $device $luksname"
|
|
+ if getargbool 0 rd.luks.ssh; then
|
|
+ # Setup authorized_key file, inject forced cmd for each entry
|
|
+ while read key; do
|
|
+ echo "command=\"$luks_open -T5 $device $luksname && rm -f /tmp/crypt-ssh-block\" $key" >> /root/.ssh/authorized_keys
|
|
+ done < /root/.ssh/key.pub
|
|
+ rm -f /root/.ssh/key.pub
|
|
+ # Create flock to prevent initqueue from timing out waiting for someone to login
|
|
+ echo "initqueue blocked by ssh server" > /tmp/crypt-ssh-block
|
|
+ else
|
|
+ _timeout=$(getargs "rd.luks.timeout")
|
|
+ _timeout=${_timeout:-0}
|
|
+ ask_for_password --ply-tries 5 \
|
|
+ --ply-cmd "$luks_open -T1 $device $luksname" \
|
|
+ --ply-prompt "Password ($device)" \
|
|
+ --tty-tries 1 \
|
|
+ --tty-cmd "$luks_open -T5 -t $_timeout $device $luksname"
|
|
+ unset _timeout
|
|
+ fi
|
|
unset luks_open
|
|
- unset _timeout
|
|
fi
|
|
|
|
if [ "$is_keysource" -ne 0 -a "${luksname##luks-}" != "$luksname" ]; then
|
|
diff --git a/modules.d/92crypt-ssh/crypt-ssh-cleanup.sh b/modules.d/92crypt-ssh/crypt-ssh-cleanup.sh
|
|
new file mode 100755
|
|
index 00000000..03b05d84
|
|
--- /dev/null
|
|
+++ b/modules.d/92crypt-ssh/crypt-ssh-cleanup.sh
|
|
@@ -0,0 +1,7 @@
|
|
+#!/bin/sh
|
|
+
|
|
+# Stops previously started dropbear
|
|
+
|
|
+if [ -f /var/run/dropbear.pid ]; then
|
|
+ kill $(cat /var/run/dropbear.pid)
|
|
+fi
|
|
diff --git a/modules.d/92crypt-ssh/module-setup.sh b/modules.d/92crypt-ssh/module-setup.sh
|
|
new file mode 100644
|
|
index 00000000..4fd2aadf
|
|
--- /dev/null
|
|
+++ b/modules.d/92crypt-ssh/module-setup.sh
|
|
@@ -0,0 +1,33 @@
|
|
+#!/bin/bash
|
|
+
|
|
+check() {
|
|
+ require_binaries dropbear || return 1
|
|
+
|
|
+ # We need a SSH pub key, as passwords are not an option
|
|
+ # due to the initrd being unencrypted on disk
|
|
+ [ -r /root/.ssh/authorized_keys ] || {
|
|
+ echo "No /root/.ssh/authorized_keys found, needed to authenticate at boot!";
|
|
+ exit 1;
|
|
+ }
|
|
+ return 255
|
|
+}
|
|
+
|
|
+depends() {
|
|
+ echo "network crypt"
|
|
+ return 0
|
|
+}
|
|
+
|
|
+install() {
|
|
+ #Install dropbear
|
|
+ mkdir -p /etc/dropbear
|
|
+
|
|
+ # Create host keys of needed
|
|
+ [ -r /etc/dropbear/dropbear_dss_host_key ] || /usr/bin/dropbearkey -t dss -f /etc/dropbear/dropbear_dss_host_key > /dev/null
|
|
+ [ -r /etc/dropbear/dropbear_rsa_host_key ] || /usr/bin/dropbearkey -t rsa -f /etc/dropbear/dropbear_rsa_host_key > /dev/null
|
|
+
|
|
+ inst_multiple dropbear /etc/dropbear/dropbear_dss_host_key /etc/dropbear/dropbear_rsa_host_key
|
|
+ inst /root/.ssh/authorized_keys /root/.ssh/key.pub
|
|
+
|
|
+ inst_hook initqueue/online 60 "$moddir/start-ssh.sh"
|
|
+ inst_hook cleanup 99 "$moddir/crypt-ssh-cleanup.sh"
|
|
+}
|
|
diff --git a/modules.d/92crypt-ssh/start-ssh.sh b/modules.d/92crypt-ssh/start-ssh.sh
|
|
new file mode 100755
|
|
index 00000000..ac1c5ec3
|
|
--- /dev/null
|
|
+++ b/modules.d/92crypt-ssh/start-ssh.sh
|
|
@@ -0,0 +1,27 @@
|
|
+#!/bin/sh
|
|
+
|
|
+# Start dropbear server once online
|
|
+
|
|
+type get_ip >/dev/null 2>&1 || . /lib/net-lib.sh
|
|
+
|
|
+port=$(getargnum 22 1 65535 rd.luks.ssh.port)
|
|
+listen_ip=$(get_ip $1)
|
|
+pid_file="/var/run/dropbear_$listen_ip_$port.pid"
|
|
+
|
|
+[ "x$listen_ip" != "x" ] && listen_ip="$listen_ip:"
|
|
+
|
|
+if [ -x "/usr/sbin/dropbear" ]; then
|
|
+ if [ -r /root/.ssh/authorized_keys ]; then
|
|
+ touch /var/log/lastlog
|
|
+ /usr/sbin/dropbear -p $listen_ip$port -m -j -k -s -P $pid_file
|
|
+ # flock will be removed upon successful luksopen via forced_command
|
|
+ while [ -e /tmp/crypt-ssh-block ]; do
|
|
+ sleep 1
|
|
+ done
|
|
+ kill $(cat $pid_file)
|
|
+ else
|
|
+ warn "No authorized_keys files, not starting SSH server!"
|
|
+ fi
|
|
+else
|
|
+ warn "initqueue/online/start-ssh: Could not find dropbear binary!"
|
|
+fi
|