From 737c761be2fd7181a7fd4d383b29c46ef7dd1594 Mon Sep 17 00:00:00 2001
From: Markus Hilger <markus.hilger@megware.com>
Date: Mon, 7 Sep 2026 02:39:30 +0200
Subject: [PATCH] Set up hostbased ssh on installed SUSE 16 systems

prechroot.sh had setupssh.sh commented out and copied only the keys
inline, so nodes came up without shosts.equiv, without the CA in
ssh_known_hosts and without a setuid ssh-keysign.
---
 .../profiles/server/scripts/prechroot.sh      |  7 +--
 .../profiles/server/scripts/setupssh.sh       | 44 +++++++++++++++++++
 2 files changed, 45 insertions(+), 6 deletions(-)
 create mode 100644 confluent_osdeploy/suse16/profiles/server/scripts/setupssh.sh

diff --git a/confluent_osdeploy/suse16/profiles/server/scripts/prechroot.sh b/confluent_osdeploy/suse16/profiles/server/scripts/prechroot.sh
index f6e28b37..9cbfac66 100644
--- a/confluent_osdeploy/suse16/profiles/server/scripts/prechroot.sh
+++ b/confluent_osdeploy/suse16/profiles/server/scripts/prechroot.sh
@@ -26,12 +26,7 @@ if [ -e "$instnmcfg" ]; then
 	cp $instnmcfg /mnt/etc/NetworkManager/system-connections/
 fi
 
-#run_remote setupssh.sh
-cp /etc/ssh/ssh*key* /mnt/etc/ssh/
-mkdir -p /mnt/etc/ssh/sshd_config.d/
-cp /etc/ssh/sshd_config.d/20_hostkeys.conf /mnt/etc/ssh/sshd_config.d/
-mkdir -p /mnt/root/.ssh/
-cp /root/.ssh/authorized_keys /mnt/root/.ssh/
+run_remote setupssh.sh
 
 echo Port 22 >> /etc/ssh/sshd_config.d/00-chroot.conf
 echo Port 2222 >> /etc/ssh/sshd_config.d/00-chroot.conf
diff --git a/confluent_osdeploy/suse16/profiles/server/scripts/setupssh.sh b/confluent_osdeploy/suse16/profiles/server/scripts/setupssh.sh
new file mode 100644
index 00000000..ad4c1bde
--- /dev/null
+++ b/confluent_osdeploy/suse16/profiles/server/scripts/setupssh.sh
@@ -0,0 +1,44 @@
+#!/bin/bash
+# Carry over install-time ssh material into installed system
+
+mkdir -p /mnt/root/.ssh/
+chmod 700 /mnt/root/.ssh/
+cp /root/.ssh/authorized_keys /mnt/root/.ssh/
+chmod 600 /mnt/root/.ssh/authorized_keys
+cp /etc/ssh/ssh*key* /mnt/etc/ssh/
+mkdir -p /mnt/etc/ssh/sshd_config.d/
+# pre.sh put the host certificates confluent signed into this drop-in
+cp /etc/ssh/sshd_config.d/20_hostkeys.conf /mnt/etc/ssh/sshd_config.d/
+# the initramfs wrote the confluent CA into the installer's known hosts
+cp /etc/ssh/ssh_known_hosts /mnt/etc/ssh/
+
+# Enable ~/.shosts, for the sake of root user, who is forbidden from using shosts.equiv
+cat >> /mnt/etc/ssh/sshd_config.d/90-confluent.conf << EOF
+IgnoreRhosts no
+HostbasedAuthentication yes
+HostbasedUsesNameFromPacketOnly yes
+EOF
+
+sshconf=/mnt/etc/ssh/ssh_config
+if [ -d /mnt/etc/ssh/ssh_config.d/ ]; then
+    sshconf=/mnt/etc/ssh/ssh_config.d/01-confluent.conf
+fi
+echo Host '*' >> $sshconf
+echo "    HostbasedAuthentication yes" >> $sshconf
+echo "    EnableSSHKeysign yes" >> $sshconf
+# Limit the attempts of using host key. This prevents client from using 3 or 4
+# authentication attempts through host based attempts
+echo "    HostbasedKeyTypes *ed25519*" >> $sshconf
+
+# In SUSE platform, setuid for ssh-keysign is required for host based,
+# and also must be opted into. 16 moved the helper to libexec.
+keysign=/usr/libexec/ssh/ssh-keysign
+if [ ! -e /mnt$keysign ]; then
+    keysign=/usr/lib/ssh/ssh-keysign
+fi
+echo $keysign root:root 4711 >> /mnt/etc/permissions.local
+chmod 4711 /mnt$keysign
+
+# Download list of nodes from confluent, and put it into shosts.equiv (for most users) and .shosts (for root)
+python3 /opt/confluent/bin/apiclient /confluent-api/self/nodelist | sed -e 's/^- //' > /mnt/etc/ssh/shosts.equiv
+cp /mnt/etc/ssh/shosts.equiv /mnt/root/.shosts