11671 2017-06-15 16:04:02 +0000 [openssh] Interrupting host key generation can prevent SSH login 2017-10-09 14:05:24 +0000 1 1 7 Build System, Metadata & Runtime OE-Core connectivity unspecified All Multiple RESOLVED FIXED Medium normal 2.5 1 JPEWhacker JPEWhacker meta.mr.watcher meta.watcher --- --- No (bug/feature does not impact docs) oldest_to_newest 74238 0 JPEWhacker 2017-06-15 16:04:02 +0000 The host key generation for openSSH can take a significant amount of time when a product is booting up, and the current init scripts only use a file existence check to determine if the keys should be generated. This leaves a window of time where a power interruption during boot can cause the key files to be created, but corrupted (either zero length files, or bad data). If this happens, the device will not regenerate valid keys (because they exist), but login via SSH will not be possible (because the keys are corrupted). 74239 1 JPEWhacker 2017-06-15 16:07:53 +0000 NOTE: I have a patch series to address this already: https://patchwork.openembedded.org/series/6626/ 75767 2 jku 2017-08-09 11:03:39 +0000 I think the idea is good and the patch looks ok to me... except the last version is somehow malformed? Is this still on your radar Joshua? The only complaint I might have is with the sshdgenkeys.service ConditionPathExists rules... +ConditionPathExists=|!/var/run/ssh/ssh_host_rsa_key +ConditionPathExists=|!/var/run/ssh/ssh_host_dsa_key +ConditionPathExists=|!/var/run/ssh/ssh_host_ecdsa_key +ConditionPathExists=|!/var/run/ssh/ssh_host_ed25519_key +ConditionPathExists=|!/etc/ssh/ssh_host_rsa_key +ConditionPathExists=|!/etc/ssh/ssh_host_dsa_key +ConditionPathExists=|!/etc/ssh/ssh_host_ecdsa_key +ConditionPathExists=|!/etc/ssh/ssh_host_ed25519_key There does not seem to not trigger this condition -- some of those files will always be missing. If we can't make a useful condition then we should remove the conditions altogether. 75768 3 JPEWhacker 2017-08-09 13:02:25 +0000 Yes, this is still on my radar. I don't believe the patch is malformed, it just depends on https://patchwork.openembedded.org/series/7509/ being merged first. Would you like me to assign it to myself? 75770 4 jku 2017-08-09 13:20:55 +0000 (In reply to comment #3) > I don't believe the patch is malformed, it just depends on > https://patchwork.openembedded.org/series/7509/ being merged first. Would > you like me to assign it to myself? Oh that makes sense, thanks. I'm assigning the bug to you to reflect reality. 77462 5 JPEWhacker 2017-10-09 14:05:24 +0000 Merged as 43fc3d8e180c168dbe5dd5faa577e69a279bd1bd