08d842d5e8
Use a systemd service unit to strip the ssh_keys group and change the
mode for host keys. This ensure that this migration is done right before
the openssh server startup on all kind of systems, either RPM or
rpm-ostree based.
Use a marker file to only do this once. We need to keep this service
unit for two Fedora releases so we will be able to remove it in Fedora
40.
See: https://fedoraproject.org/wiki/Changes/SSHKeySignSuidBit
Fixes: 7a21555 Get rid of ssh_keys group for new installations
Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2172956
Co-authored-by: Timothée Ravier <tim@siosm.fr>
39 lines
1.8 KiB
Bash
39 lines
1.8 KiB
Bash
#!/usr/bin/bash
|
|
set -eu -o pipefail
|
|
# Detect existing non-conforming host keys and perform the permissions migration
|
|
# https://fedoraproject.org/wiki/Changes/SSHKeySignSuidBit
|
|
#
|
|
# Example output looks like:
|
|
# @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
|
|
# @ WARNING: UNPROTECTED PRIVATE KEY FILE! @
|
|
# @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
|
|
# Permissions 0640 for '/etc/ssh/ssh_host_rsa_key' are too open.
|
|
# It is required that your private key files are NOT accessible by others.
|
|
# This private key will be ignored.
|
|
# @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
|
|
# @ WARNING: UNPROTECTED PRIVATE KEY FILE! @
|
|
# @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
|
|
# Permissions 0640 for '/etc/ssh/ssh_host_ecdsa_key' are too open.
|
|
# It is required that your private key files are NOT accessible by others.
|
|
# This private key will be ignored.
|
|
# @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
|
|
# @ WARNING: UNPROTECTED PRIVATE KEY FILE! @
|
|
# @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
|
|
# Permissions 0640 for '/etc/ssh/ssh_host_ed25519_key' are too open.
|
|
# It is required that your private key files are NOT accessible by others.
|
|
# This private key will be ignored.
|
|
# sshd: no hostkeys available -- exiting.
|
|
#
|
|
output="$(sshd -T 2>&1 || true)" # expected to fail
|
|
if grep -q "sshd: no hostkeys available" <<< "$output"; then
|
|
while read line; do
|
|
if [[ $line =~ ^Permissions\ [0-9]+\ for\ \'(.*)\'\ are\ too\ open. ]]; then
|
|
keyfile=${BASH_REMATCH[1]}
|
|
echo $line
|
|
echo -e "\t-> changing permissions on $keyfile"
|
|
chmod --verbose g-r $keyfile
|
|
chown --verbose root:root $keyfile
|
|
fi
|
|
done <<< "$output"
|
|
fi
|