JDM170/build
1
0
Fork 0
mirror of https://github.com/armbian/build synced 2025-09-24 19:47:06 +07:00
Code Issues Packages Projects Releases Wiki Activity

improve(lvm,cryptroot): export private key with a structurally equal naming scheme; cleanup

Browse Source
This commit is contained in:
M.Schmidt
2024-12-05 20:01:07 +01:00
committed by Igor
parent 590b75fd6f
commit 6607728e24
5 changed files with 39 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
extensions/fs-cryptroot-support.sh
View File

@@ -45,39 +45,44 @@ function pre_install_kernel_debs__adjust_dropbear_configuration() {
dropbear_config="dropbear.conf"
fi
# make it publicly available to export the private.key with proper naming
declare -g DROPBEAR_DIR=$dropbear_dir
# Set the port of the dropbear ssh daemon in the initramfs to a different one if configured
# this avoids the typical 'host key changed warning' - `WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!`
[[ -f "${dropbear_dir}/${dropbear_config}" ]] &&
[[ -f "${DROPBEAR_DIR}/${dropbear_config}" ]] &&
sed -i "s/^#DROPBEAR_OPTIONS=.*/DROPBEAR_OPTIONS=\"-I 100 -j -k -p "${CRYPTROOT_SSH_UNLOCK_PORT}" -s -c cryptroot-unlock\"/" \
"${dropbear_dir}/${dropbear_config}"
"${DROPBEAR_DIR}/${dropbear_config}"
# setup dropbear authorized_keys, either provided by userpatches or generated
if [[ -f $USERPATCHES_PATH/dropbear_authorized_keys ]]; then
cp "$USERPATCHES_PATH"/dropbear_authorized_keys "${dropbear_dir}"/authorized_keys
cp "$USERPATCHES_PATH"/dropbear_authorized_keys "${DROPBEAR_DIR}"/authorized_keys
else
# generate a default ssh key for login on dropbear in initramfs
# this key should be changed by the user on first login
display_alert "Extension: ${EXTENSION}: Generating a new SSH key pair for dropbear (initramfs)" "" ""
# Generate the SSH keys
ssh-keygen -t ecdsa -f "${dropbear_dir}"/id_ecdsa \
ssh-keygen -t ecdsa -f "${DROPBEAR_DIR}"/id_ecdsa \
-N '' -O force-command=cryptroot-unlock -C 'AUTOGENERATED_BY_ARMBIAN_BUILD' 2>&1
# /usr/share/initramfs-tools/hooks/dropbear will automatically add 'id_ecdsa.pub' to authorized_keys file
# during mkinitramfs of update-initramfs
#cat "${dropbear_dir}"/id_ecdsa.pub > "${SDCARD}"/etc/dropbear-initramfs/authorized_keys
# copy it a) later via hook to make use of a proper naming / structural equal -> "${DESTIMG}/${version}.img"
CRYPTROOT_SSH_UNLOCK_KEY_NAME="${VENDOR}_${REVISION}_${BOARD^}_${RELEASE}_${BRANCH}_${DESKTOP_ENVIRONMENT}".key
# copy dropbear ssh key to image output dir for convenience
cp "${dropbear_dir}"/id_ecdsa "${DEST}/images/${CRYPTROOT_SSH_UNLOCK_KEY_NAME}"
display_alert "Extension: ${EXTENSION}: SSH private key for dropbear (initramfs) has been copied to:" \
"$DEST/images/$CRYPTROOT_SSH_UNLOCK_KEY_NAME" "info"
# cat "${DROPBEAR_DIR}"/id_ecdsa.pub > "${SDCARD}"/etc/dropbear-initramfs/authorized_keys
fi
fi
}
function post_umount_final_image__export_private_key(){
if [[ $CRYPTROOT_SSH_UNLOCK == yes ]]; then
CRYPTROOT_SSH_UNLOCK_KEY_PATH="${DESTIMG}/${version}.key"
# copy dropbear ssh key to image output dir for convenience
cp "${DROPBEAR_DIR}"/id_ecdsa "${CRYPTROOT_SSH_UNLOCK_KEY_PATH}"
display_alert "Extension: ${EXTENSION}: SSH private key for dropbear (initramfs) has been copied to:" \
"$CRYPTROOT_SSH_UNLOCK_KEY_PATH" "info"
fi
}
function post_umount_final_image__750_cryptroot_cleanup(){
execute_and_remove_cleanup_handler cleanup_cryptroot
}

30
extensions/lvm.sh
View File

@@ -41,10 +41,9 @@ function post_create_partitions__setup_lvm() {
function prepare_root_device__create_volume_group() {
# the partition to setup LVM on is defined as rootpart
local lvmdev=$rootdevice
display_alert "LVM will be on Partition ${rootpart}, thats ${lvmdev}" "${EXTENSION}" "info"
display_alert "LVM will be on ${rootdevice}" "${EXTENSION}" "info"
# Caculate the required volume size
# Calculate the required volume size
declare -g -i rootfs_size
rootfs_size=$(du --apparent-size -sm "${SDCARD}"/ | cut -f1) # MiB
display_alert "Current rootfs size" "$rootfs_size MiB" "info"
@@ -52,25 +51,20 @@ function prepare_root_device__create_volume_group() {
display_alert "Root volume size" "$volsize MiB" "info"
# Create the PV VG and VOL
display_alert "LVM Creating VG" "${lvmdev}" "info"
check_loop_device ${lvmdev}
pvcreate ${lvmdev}
vgcreate ${LVM_VG_NAME} ${lvmdev}
wait_for_disk_sync "wait for VG to sync"
display_alert "LVM Creating VG" "${rootdevice}" "info"
check_loop_device ${rootdevice}
pvcreate ${rootdevice}
wait_for_disk_sync "wait for pvcreate to sync"
vgcreate ${LVM_VG_NAME} ${rootdevice}
add_cleanup_handler cleanup_lvm
wait_for_disk_sync "wait for vgcreate to sync"
# Note that devices wont come up automatically inside docker
lvcreate -Zn --name root --size ${volsize}M ${LVM_VG_NAME}
vgmknodes
lvs >> "${DEST}"/${LOG_SUBPATH}/lvm.log 2>&1
# TODO [ms] check if disable-scan-enable is necessary
vgchange -a n ${LVM_VG_NAME}
display_alert "LVM created volume group" "${EXTENSION}" "info"
display_alert "Using LVM root" "${EXTENSION}" "info"
vgscan
vgchange -a y ${LVM_VG_NAME}
rootdevice=/dev/mapper/${LVM_VG_NAME}-root
display_alert "Root device is ${rootdevice}" "${EXTENSION}" "info"
display_alert "LVM created volume group - root device ${rootdevice}" "${EXTENSION}" "info"
}
function format_partitions__format_lvm() {
@@ -80,7 +74,7 @@ function format_partitions__format_lvm() {
display_alert "LVM labeled partitions" "${EXTENSION}" "info"
}
function post_umount_final_image__lvm_cleanup(){
function post_umount_final_image__cleanup_lvm(){
execute_and_remove_cleanup_handler cleanup_lvm
}