[Buildroot] [PATCH v2 2/3] package/openssh: seperate sd service for host key generation

Norbert Lange nolange79 at gmail.com
Thu Jun 11 09:14:05 UTC 2020


split out generation of host keys into an optional service
that can easily be removed or deactivated.

Signed-off-by: Norbert Lange <nolange79 at gmail.com>
Reviewed-by: Jérémy ROSEN <jeremy.rosen at smile.fr>
---
 package/openssh/openssh.mk               |  5 +++--
 package/openssh/sshd-host-keygen.service | 23 +++++++++++++++++++++++
 package/openssh/sshd.service             |  1 -
 3 files changed, 26 insertions(+), 3 deletions(-)
 create mode 100644 package/openssh/sshd-host-keygen.service

diff --git a/package/openssh/openssh.mk b/package/openssh/openssh.mk
index 3e0a85ae2e..1fcd957299 100644
--- a/package/openssh/openssh.mk
+++ b/package/openssh/openssh.mk
@@ -116,8 +116,9 @@ endef
 OPENSSH_POST_INSTALL_TARGET_HOOKS += OPENSSH_INSTALL_SERVER_PROGRAMS
 
 define OPENSSH_INSTALL_INIT_SYSTEMD
-	$(INSTALL) -D -m 644 package/openssh/sshd.service \
-		$(TARGET_DIR)/usr/lib/systemd/system/sshd.service
+	mkdir $(TARGET_DIR)/usr/lib/systemd/system
+	$(INSTALL) -m 644 package/openssh/sshd*.service \
+		$(TARGET_DIR)/usr/lib/systemd/system/
 	$(OPENSSH_INSTALL_SYSTEMD_SYSUSERS)
 endef
 
diff --git a/package/openssh/sshd-host-keygen.service b/package/openssh/sshd-host-keygen.service
new file mode 100644
index 0000000000..2db1be16c4
--- /dev/null
+++ b/package/openssh/sshd-host-keygen.service
@@ -0,0 +1,23 @@
+[Unit]
+Description=SSH Key Generation
+Before=sshd.service
+
+ConditionPathExists=|!/etc/ssh/ssh_host_dsa_key
+ConditionPathExists=|!/etc/ssh/ssh_host_dsa_key.pub
+ConditionPathExists=|!/etc/ssh/ssh_host_ecdsa_key
+ConditionPathExists=|!/etc/ssh/ssh_host_ecdsa_key.pub
+ConditionPathExists=|!/etc/ssh/ssh_host_ed25519_key
+ConditionPathExists=|!/etc/ssh/ssh_host_ed25519_key.pub
+ConditionPathExists=|!/etc/ssh/ssh_host_rsa_key
+ConditionPathExists=|!/etc/ssh/ssh_host_rsa_key.pub
+
+[Service]
+ExecStart=/usr/bin/ssh-keygen -A
+Type=oneshot
+# systemd changed behaviour in v245 leading to various drawbacks,
+# seems like every one-shot service should use RemainAfterExit
+# https://github.com/systemd/systemd/issues/15091
+RemainAfterExit=yes
+
+[Install]
+WantedBy=sshd.service
diff --git a/package/openssh/sshd.service b/package/openssh/sshd.service
index 715bd3f7eb..797e249d8d 100644
--- a/package/openssh/sshd.service
+++ b/package/openssh/sshd.service
@@ -4,7 +4,6 @@ Documentation=man:sshd(8) man:sshd_config(5)
 After=network.target auditd.service
 
 [Service]
-ExecStartPre=/usr/bin/ssh-keygen -A
 ExecStartPre=/usr/sbin/sshd -t
 ExecStart=/usr/sbin/sshd -D
 ExecReload=/usr/sbin/sshd -t
-- 
2.26.2



More information about the buildroot mailing list