mirror of
https://github.com/xcat2/confluent.git
synced 2026-09-09 22:46:45 +00:00
Markus Hilger
737c761be2
prechroot.sh had setupssh.sh commented out and copied only the keys inline, so nodes came up without shosts.equiv, without the CA in ssh_known_hosts and without a setuid ssh-keysign.
45 lines
1.8 KiB
Bash
45 lines
1.8 KiB
Bash
#!/bin/bash
|
|
# Carry over install-time ssh material into installed system
|
|
|
|
mkdir -p /mnt/root/.ssh/
|
|
chmod 700 /mnt/root/.ssh/
|
|
cp /root/.ssh/authorized_keys /mnt/root/.ssh/
|
|
chmod 600 /mnt/root/.ssh/authorized_keys
|
|
cp /etc/ssh/ssh*key* /mnt/etc/ssh/
|
|
mkdir -p /mnt/etc/ssh/sshd_config.d/
|
|
# pre.sh put the host certificates confluent signed into this drop-in
|
|
cp /etc/ssh/sshd_config.d/20_hostkeys.conf /mnt/etc/ssh/sshd_config.d/
|
|
# the initramfs wrote the confluent CA into the installer's known hosts
|
|
cp /etc/ssh/ssh_known_hosts /mnt/etc/ssh/
|
|
|
|
# Enable ~/.shosts, for the sake of root user, who is forbidden from using shosts.equiv
|
|
cat >> /mnt/etc/ssh/sshd_config.d/90-confluent.conf << EOF
|
|
IgnoreRhosts no
|
|
HostbasedAuthentication yes
|
|
HostbasedUsesNameFromPacketOnly yes
|
|
EOF
|
|
|
|
sshconf=/mnt/etc/ssh/ssh_config
|
|
if [ -d /mnt/etc/ssh/ssh_config.d/ ]; then
|
|
sshconf=/mnt/etc/ssh/ssh_config.d/01-confluent.conf
|
|
fi
|
|
echo Host '*' >> $sshconf
|
|
echo " HostbasedAuthentication yes" >> $sshconf
|
|
echo " EnableSSHKeysign yes" >> $sshconf
|
|
# Limit the attempts of using host key. This prevents client from using 3 or 4
|
|
# authentication attempts through host based attempts
|
|
echo " HostbasedKeyTypes *ed25519*" >> $sshconf
|
|
|
|
# In SUSE platform, setuid for ssh-keysign is required for host based,
|
|
# and also must be opted into. 16 moved the helper to libexec.
|
|
keysign=/usr/libexec/ssh/ssh-keysign
|
|
if [ ! -e /mnt$keysign ]; then
|
|
keysign=/usr/lib/ssh/ssh-keysign
|
|
fi
|
|
echo $keysign root:root 4711 >> /mnt/etc/permissions.local
|
|
chmod 4711 /mnt$keysign
|
|
|
|
# Download list of nodes from confluent, and put it into shosts.equiv (for most users) and .shosts (for root)
|
|
python3 /opt/confluent/bin/apiclient /confluent-api/self/nodelist | sed -e 's/^- //' > /mnt/etc/ssh/shosts.equiv
|
|
cp /mnt/etc/ssh/shosts.equiv /mnt/root/.shosts
|