Bug 4887

Summary:	openssh not working well with read-only rootfs
Product:	[Build System, Metadata & Runtime] OE-Core	Reporter:	Chen Qi <Qi.Chen>
Component:	core	Assignee:	Chen Qi <Qi.Chen>
Status:	RESOLVED FIXED	QA Contact:
Severity:	normal
Priority:	Medium	CC:	liezhi.yang, mark.hatle, meta.mr.watcher, meta.watcher, sgw, yi.zhao
Version:	1.4
Target Milestone:	1.5 M4
Hardware:	x86
OS:	Multiple
Whiteboard:
OS type for building Yocto:	---	Type of Regression:	---
Verified:		Documentation change:	No (bug/feature does not impact docs)
Bug Depends on:	4103
Bug Blocks:

Description Chen Qi 2013-07-22 02:42:10 UTC

Error occurs at system boot time for a read-only rootfs:
'''
open /etc/ssh/ssh_host_rsa_key failed: Read-only file system
'''

And we cannot ssh to this target as the sshd on this target is not started correctly.

This should be fixed.

//Chen Qi

Comment 1 Saul Wold 2013-07-22 21:12:24 UTC

Can we pre-generate the key (if possible) at roofs creation time? So the host_rsa_key won't change, otherwise it will change each time it's generated on the fly.

Comment 2 Chen Qi 2013-07-23 01:52:31 UTC

(In reply to comment #1)
> Can we pre-generate the key (if possible) at roofs creation time? So the
> host_rsa_key won't change, otherwise it will change each time it's generated
> on the fly.

I'll explore the possibility. 

If we are going to do so, we are gonna do the same for dropbear.
Currently, dropbear stores its keys under /etc/ if rootfs is not read-only, otherwise, it stores its keys under /var/lib.

//Chen Qi

Comment 3 Chen Qi 2013-07-24 05:55:08 UTC

Hi Saul,

We can generate ssh keys at rootfs time.

Here's how I implement it.

http://git.pokylinux.org/cgit.cgi/poky-contrib/log/?h=ChenQi/read-only-rootfs-in-live-images

This link also contains patches for other related issues of read-only rootfs on live images.

This patchset has been tested with sato, sato-sdk, lsb and lsb-sdk images.

I'm now checking whether this patchset has any potential problems.

Best Regards,
Chen Qi

Comment 4 Mark Hatle 2013-07-29 18:50:13 UTC

pre-generating keys at image generation is something that we need to be careful with.  It can lead people to releasing a whole class of machines with the same key, one is compromised they all become compromised.

My suggestions is that there be some type of configuration switch that can be enabled (leading to a warning of a potential security issue) if the keys are shared between multiple devices.

Generating the key at boot time (if it can't be stored on the device) is the best default from a security point of view.

Comment 5 Chen Qi 2013-08-19 02:05:37 UTC

Commit: 2ed44745024f04aa4e00ddba3009153c6b47c8e9
URL:    http://git.openembedded.org/?p=openembedded-core.git&a=commit;h=2ed44745024f04aa4e00ddba3009153c6b47c8e9