pub-solar/forgejo
5
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

Only offer hostcertificates if they exist (#15849)

Browse source 
A common bug report is the otherwise harmless sshd logging:

```
Could not load host certificate "/data/ssh/ssh_host_ed25519_cert": No such file or directory
```

This PR simply checks if these files exist before creation of sshd_config and if
they do not exist, doesn't add a reference to them.

Fix #14110 amongst others.

Signed-off-by: Andrew Thornton <art27@cantab.net>

Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: Lauris BH <lauris@nix.lv>
This commit is contained in:
zeripath 2021-05-13 13:11:28 +01:00 committed by GitHub
parent 52f8dcda43
commit 0ada74edbc
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 24 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
docker/root/etc/s6/openssh/setup
View file

@ -24,9 +24,29 @@ if [ ! -f /data/ssh/ssh_host_ecdsa_key ]; then
ssh-keygen -t ecdsa -b 256 -f /data/ssh/ssh_host_ecdsa_key -N "" > /dev/null ssh-keygen -t ecdsa -b 256 -f /data/ssh/ssh_host_ecdsa_key -N "" > /dev/null
fi fi
if [ -e /data/ssh/ssh_host_ed25519_cert ]; then
SSH_ED25519_CERT=${SSH_ED25519_CERT:-"/data/ssh/ssh_host_ed25519_cert"}
fi
if [ -e /data/ssh/ssh_host_rsa_cert ]; then
SSH_RSA_CERT=${SSH_RSA_CERT:-"/data/ssh/ssh_host_rsa_cert"}
fi
if [ -e /data/ssh/ssh_host_ecdsa_cert ]; then
SSH_ECDSA_CERT=${SSH_ECDSA_CERT:-"/data/ssh/ssh_host_ecdsa_cert"}
fi
if [ -e /data/ssh/ssh_host_dsa_cert ]; then
SSH_DSA_CERT=${SSH_DSA_CERT:-"/data/ssh/ssh_host_dsa_cert"}
fi
if [ -d /etc/ssh ]; then if [ -d /etc/ssh ]; then
SSH_PORT=${SSH_PORT:-"22"} \ SSH_PORT=${SSH_PORT:-"22"} \
SSH_LISTEN_PORT=${SSH_LISTEN_PORT:-"${SSH_PORT}"} \ SSH_LISTEN_PORT=${SSH_LISTEN_PORT:-"${SSH_PORT}"} \
SSH_ED25519_CERT="${SSH_ED25519_CERT:+"HostCertificate "}${SSH_ED25519_CERT}" \
SSH_RSA_CERT="${SSH_RSA_CERT:+"HostCertificate "}${SSH_RSA_CERT}" \
SSH_ECDSA_CERT="${SSH_ECDSA_CERT:+"HostCertificate "}${SSH_ECDSA_CERT}" \
SSH_DSA_CERT="${SSH_DSA_CERT:+"HostCertificate "}${SSH_DSA_CERT}" \
envsubst < /etc/templates/sshd_config > /etc/ssh/sshd_config envsubst < /etc/templates/sshd_config > /etc/ssh/sshd_config
chmod 0644 /etc/ssh/sshd_config chmod 0644 /etc/ssh/sshd_config

8
docker/root/etc/templates/sshd_config
View file

@ -8,13 +8,13 @@ ListenAddress ::
LogLevel INFO LogLevel INFO
HostKey /data/ssh/ssh_host_ed25519_key HostKey /data/ssh/ssh_host_ed25519_key
HostCertificate /data/ssh/ssh_host_ed25519_cert ${SSH_ED25519_CERT}
HostKey /data/ssh/ssh_host_rsa_key HostKey /data/ssh/ssh_host_rsa_key
HostCertificate /data/ssh/ssh_host_rsa_cert ${SSH_RSA_CERT}
HostKey /data/ssh/ssh_host_ecdsa_key HostKey /data/ssh/ssh_host_ecdsa_key
HostCertificate /data/ssh/ssh_host_ecdsa_cert ${SSH_ECDSA_CERT}
HostKey /data/ssh/ssh_host_dsa_key HostKey /data/ssh/ssh_host_dsa_key
HostCertificate /data/ssh/ssh_host_dsa_cert ${SSH_DSA_CERT}
AuthorizedKeysFile .ssh/authorized_keys AuthorizedKeysFile .ssh/authorized_keys
AuthorizedPrincipalsFile .ssh/authorized_principals AuthorizedPrincipalsFile .ssh/authorized_principals