From 61213c7c3c67552162df01681f6c12fb5b3b30a3 Mon Sep 17 00:00:00 2001
From: Tobias Waldekranz <tobias@waldekranz.com>
Date: Thu, 9 Feb 2023 00:23:49 +0100
Subject: [PATCH] sshd: Move hostkeys to /var/lib/ssh

This means keys are persistent even when /etc is not.
---
 board/common/rootfs/etc/finit.d/available/sshd.conf     | 2 ++
 board/common/rootfs/etc/finit.d/enabled/sshd.conf       | 1 +
 board/common/rootfs/etc/ssh/sshd_config                 | 1 +
 board/common/rootfs/etc/ssh/sshd_config.d/var-keys.conf | 3 +++
 board/common/rootfs/lib/infix/ssh-hostkeys              | 9 +++++++++
 board/common/rootfs/var/lib/ssh/.empty                  | 0
 6 files changed, 16 insertions(+)
 create mode 100644 board/common/rootfs/etc/finit.d/available/sshd.conf
 create mode 120000 board/common/rootfs/etc/finit.d/enabled/sshd.conf
 create mode 100644 board/common/rootfs/etc/ssh/sshd_config
 create mode 100644 board/common/rootfs/etc/ssh/sshd_config.d/var-keys.conf
 create mode 100755 board/common/rootfs/lib/infix/ssh-hostkeys
 create mode 100644 board/common/rootfs/var/lib/ssh/.empty

diff --git a/board/common/rootfs/etc/finit.d/available/sshd.conf b/board/common/rootfs/etc/finit.d/available/sshd.conf
new file mode 100644
index 00000000..9b24cd05
--- /dev/null
+++ b/board/common/rootfs/etc/finit.d/available/sshd.conf
@@ -0,0 +1,2 @@
+task [S] /lib/infix/ssh-hostkeys --
+service [2345789] <usr/ssh-hostkeys> /usr/sbin/sshd -D -- OpenSSH daemon
diff --git a/board/common/rootfs/etc/finit.d/enabled/sshd.conf b/board/common/rootfs/etc/finit.d/enabled/sshd.conf
new file mode 120000
index 00000000..a4e465f2
--- /dev/null
+++ b/board/common/rootfs/etc/finit.d/enabled/sshd.conf
@@ -0,0 +1 @@
+../available/sshd.conf
\ No newline at end of file
diff --git a/board/common/rootfs/etc/ssh/sshd_config b/board/common/rootfs/etc/ssh/sshd_config
new file mode 100644
index 00000000..cf9ac977
--- /dev/null
+++ b/board/common/rootfs/etc/ssh/sshd_config
@@ -0,0 +1 @@
+Include /etc/ssh/sshd_config.d/*.conf
diff --git a/board/common/rootfs/etc/ssh/sshd_config.d/var-keys.conf b/board/common/rootfs/etc/ssh/sshd_config.d/var-keys.conf
new file mode 100644
index 00000000..005ab1ec
--- /dev/null
+++ b/board/common/rootfs/etc/ssh/sshd_config.d/var-keys.conf
@@ -0,0 +1,3 @@
+HostKey /var/lib/ssh/ssh_host_rsa_key
+HostKey /var/lib/ssh/ssh_host_ecdsa_key
+HostKey /var/lib/ssh/ssh_host_ed25519_key
diff --git a/board/common/rootfs/lib/infix/ssh-hostkeys b/board/common/rootfs/lib/infix/ssh-hostkeys
new file mode 100755
index 00000000..bd1f5590
--- /dev/null
+++ b/board/common/rootfs/lib/infix/ssh-hostkeys
@@ -0,0 +1,9 @@
+#!/bin/sh
+
+for type in ecdsa ed25519 rsa; do
+    [ -f /var/lib/ssh/ssh_host_${type}_key ] \
+	|| ssh-keygen -N "" -t $type -f /var/lib/ssh/ssh_host_${type}_key \
+	|| exit 1
+done
+
+initctl cond set ssh-hostkeys
diff --git a/board/common/rootfs/var/lib/ssh/.empty b/board/common/rootfs/var/lib/ssh/.empty
new file mode 100644
index 00000000..e69de29b