openssh/ssh-host-keys-migration.service

[Unit]
Description=Update OpenSSH host key permissions
Documentation=https://fedoraproject.org/wiki/Changes/SSHKeySignSuidBit
Before=sshd.service
After=ssh-keygen.target
ConditionPathExists=!/var/lib/.ssh-host-keys-migration

[Service]
Type=oneshot
ExecStart=-/usr/libexec/openssh/ssh-host-keys-migration.sh
ExecStart=touch /var/lib/.ssh-host-keys-migration
RemainAfterExit=yes

[Install]
WantedBy=sshd.service
Use a service unit to strip ssh_keys group from host keys (rhbz#2172956) Use a systemd service unit to strip the ssh_keys group and change the mode for host keys. This ensure that this migration is done right before the openssh server startup on all kind of systems, either RPM or rpm-ostree based. Use a marker file to only do this once. We need to keep this service unit for two Fedora releases so we will be able to remove it in Fedora 40. See: https://fedoraproject.org/wiki/Changes/SSHKeySignSuidBit Fixes: 7a21555 Get rid of ssh_keys group for new installations Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2172956 Co-authored-by: Timothée Ravier <tim@siosm.fr> 2023-01-30 15:01:17 +00:00			`[Unit]`
			`Description=Update OpenSSH host key permissions`
			`Documentation=https://fedoraproject.org/wiki/Changes/SSHKeySignSuidBit`
			`Before=sshd.service`
			`After=ssh-keygen.target`
			`ConditionPathExists=!/var/lib/.ssh-host-keys-migration`

			`[Service]`
			`Type=oneshot`
			`ExecStart=-/usr/libexec/openssh/ssh-host-keys-migration.sh`
			`ExecStart=touch /var/lib/.ssh-host-keys-migration`
			`RemainAfterExit=yes`

			`[Install]`
			`WantedBy=sshd.service`