Set up hostbased ssh on installed SUSE 16 systems

prechroot.sh had setupssh.sh commented out and copied only the keys
inline, so nodes came up without shosts.equiv, without the CA in
ssh_known_hosts and without a setuid ssh-keysign.

confluent_osdeploy/suse16/profiles/server/scripts/prechroot.sh

@@ -26,12 +26,7 @@ if [ -e "$instnmcfg" ]; then
 	cp $instnmcfg /mnt/etc/NetworkManager/system-connections/
 fi
 
-#run_remote setupssh.sh
-cp /etc/ssh/ssh*key* /mnt/etc/ssh/
-mkdir -p /mnt/etc/ssh/sshd_config.d/
-cp /etc/ssh/sshd_config.d/20_hostkeys.conf /mnt/etc/ssh/sshd_config.d/
-mkdir -p /mnt/root/.ssh/
-cp /root/.ssh/authorized_keys /mnt/root/.ssh/
+run_remote setupssh.sh
 
 echo Port 22 >> /etc/ssh/sshd_config.d/00-chroot.conf
 echo Port 2222 >> /etc/ssh/sshd_config.d/00-chroot.conf

confluent_osdeploy/suse16/profiles/server/scripts/setupssh.sh

@@ -0,0 +1,44 @@
+#!/bin/bash
+# Carry over install-time ssh material into installed system
+
+mkdir -p /mnt/root/.ssh/
+chmod 700 /mnt/root/.ssh/
+cp /root/.ssh/authorized_keys /mnt/root/.ssh/
+chmod 600 /mnt/root/.ssh/authorized_keys
+cp /etc/ssh/ssh*key* /mnt/etc/ssh/
+mkdir -p /mnt/etc/ssh/sshd_config.d/
+# pre.sh put the host certificates confluent signed into this drop-in
+cp /etc/ssh/sshd_config.d/20_hostkeys.conf /mnt/etc/ssh/sshd_config.d/
+# the initramfs wrote the confluent CA into the installer's known hosts
+cp /etc/ssh/ssh_known_hosts /mnt/etc/ssh/
+
+# Enable ~/.shosts, for the sake of root user, who is forbidden from using shosts.equiv
+cat >> /mnt/etc/ssh/sshd_config.d/90-confluent.conf << EOF
+IgnoreRhosts no
+HostbasedAuthentication yes
+HostbasedUsesNameFromPacketOnly yes
+EOF
+
+sshconf=/mnt/etc/ssh/ssh_config
+if [ -d /mnt/etc/ssh/ssh_config.d/ ]; then
+    sshconf=/mnt/etc/ssh/ssh_config.d/01-confluent.conf
+fi
+echo Host '*' >> $sshconf
+echo "    HostbasedAuthentication yes" >> $sshconf
+echo "    EnableSSHKeysign yes" >> $sshconf
+# Limit the attempts of using host key. This prevents client from using 3 or 4
+# authentication attempts through host based attempts
+echo "    HostbasedKeyTypes *ed25519*" >> $sshconf
+
+# In SUSE platform, setuid for ssh-keysign is required for host based,
+# and also must be opted into. 16 moved the helper to libexec.
+keysign=/usr/libexec/ssh/ssh-keysign
+if [ ! -e /mnt$keysign ]; then
+    keysign=/usr/lib/ssh/ssh-keysign
+fi
+echo $keysign root:root 4711 >> /mnt/etc/permissions.local
+chmod 4711 /mnt$keysign
+
+# Download list of nodes from confluent, and put it into shosts.equiv (for most users) and .shosts (for root)
+python3 /opt/confluent/bin/apiclient /confluent-api/self/nodelist | sed -e 's/^- //' > /mnt/etc/ssh/shosts.equiv
+cp /mnt/etc/ssh/shosts.equiv /mnt/root/.shosts