The host key generation for openSSH can take a significant amount of time when a product is booting up, and the current init scripts only use a file existence check to determine if the keys should be generated. This leaves a window of time where a power interruption during boot can cause the key files to be created, but corrupted (either zero length files, or bad data). If this happens, the device will not regenerate valid keys (because they exist), but login via SSH will not be possible (because the keys are corrupted).
NOTE: I have a patch series to address this already: https://patchwork.openembedded.org/series/6626/
I think the idea is good and the patch looks ok to me... except the last version is somehow malformed? Is this still on your radar Joshua? The only complaint I might have is with the sshdgenkeys.service ConditionPathExists rules... +ConditionPathExists=|!/var/run/ssh/ssh_host_rsa_key +ConditionPathExists=|!/var/run/ssh/ssh_host_dsa_key +ConditionPathExists=|!/var/run/ssh/ssh_host_ecdsa_key +ConditionPathExists=|!/var/run/ssh/ssh_host_ed25519_key +ConditionPathExists=|!/etc/ssh/ssh_host_rsa_key +ConditionPathExists=|!/etc/ssh/ssh_host_dsa_key +ConditionPathExists=|!/etc/ssh/ssh_host_ecdsa_key +ConditionPathExists=|!/etc/ssh/ssh_host_ed25519_key There does not seem to not trigger this condition -- some of those files will always be missing. If we can't make a useful condition then we should remove the conditions altogether.
Yes, this is still on my radar. I don't believe the patch is malformed, it just depends on https://patchwork.openembedded.org/series/7509/ being merged first. Would you like me to assign it to myself?
(In reply to comment #3) > I don't believe the patch is malformed, it just depends on > https://patchwork.openembedded.org/series/7509/ being merged first. Would > you like me to assign it to myself? Oh that makes sense, thanks. I'm assigning the bug to you to reflect reality.
Merged as 43fc3d8e180c168dbe5dd5faa577e69a279bd1bd