From 528ea613024a939d1e11ebc43132b4f41c668bf2 Mon Sep 17 00:00:00 2001 From: Joachim Wiberg Date: Thu, 6 Jul 2023 02:06:24 +0200 Subject: [PATCH] confd: set up compat authorized_keys symlink for netopeer2-server Apparently netopeer2-server expects public keys for users to be in the canonical place (~/.ssh/authorized_keys). Infix use a custom location in /var/run, maintained by the ietf-system plugin, which OpenSSH knows but netopeer2-server doesn't. It seems to be possible to add some sort of "pattern" to netopeer2 to indicate where to look for public keys. This is added when building it but Buildroot does not expose this as a setting. So for now, this seem to be the least intrusive way of handling it. The owner is root, so a malicious user cannot change the link or contents without some other form of privilege escalation first. Signed-off-by: Joachim Wiberg --- src/confd/src/confd/ietf-system.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/src/confd/src/confd/ietf-system.c b/src/confd/src/confd/ietf-system.c index 62b72fe6..dcecbb50 100644 --- a/src/confd/src/confd/ietf-system.c +++ b/src/confd/src/confd/ietf-system.c @@ -334,7 +334,7 @@ static int change_clock(sr_session_ctx_t *session, uint32_t sub_id, const char * } remove("/etc/localtime+"); - if (systemf("ln -s /usr/share/zoneinfo/%s /etc/localtime+", timezone)) { + if (systemf("ln -sf /usr/share/zoneinfo/%s /etc/localtime+", timezone)) { ERROR("No such timezone %s", timezone); return SR_ERR_VALIDATION_FAILED; } @@ -636,6 +636,15 @@ static int sys_add_new_user(char *name) } DEBUG("New user \"%s\" created\n", name); + /* + * OpenSSH in Infix has been set up to use /var/run/sshd/%s.keys + * but libSSH used by netopeer2-server still reads the classic + * /home/%s/.ssh/authorized_keys file. This creates a both the + * directory and the symlink owned by root to prevent tampering. + */ + fmkpath(0750, "/home/%s/.ssh", name); + systemf("ln -sf /var/run/sshd/%s.keys /home/%s/.ssh/authorized_keys", name, name); + return SR_ERR_OK; }