WelcomeWelcome | FAQFAQ | DownloadsDownloads | WikiWiki

Author Topic: SSHD needs keygen and restart everytime after reboot  (Read 4555 times)

Offline tohox

  • Newbie
  • *
  • Posts: 25
SSHD needs keygen and restart everytime after reboot
« on: October 13, 2016, 01:56:11 PM »
Hi,

I'm not sure what caused this but every time I reboot PiCore 8.0 I now have to regenerate my sshd keys and restart the daemon in order to connect via SSH.

/opt/.filetool.lst contains the following:

Code: [Select]
opt
home
etc/passwd
etc/shadow
etc/group
etc/gshadow
usr/local/etc/ssh/sshd_config
usr/local/etc/ssh/ssh_host_dsa_key
usr/local/etc/ssh/ssh_host_dsa_key.pub
usr/local/etc/ssh/ssh_host_ecdsa_key
usr/local/etc/ssh/ssh_host_ecdsa_key.pub
usr/local/etc/ssh/ssh_host_ed25519_key
usr/local/etc/ssh/ssh_host_ed25519_key.pub
usr/local/etc/ssh/ssh_host_rsa_key
usr/local/etc/ssh/ssh_host_rsa_key.pub
usr/local/lib/python3.5/site-packages/

Even though I do a filetool.sh -b after generating and overwriting the keys I can't reconnect after a reboot...

Any ideas?

Thanks!

Offline polikuo

  • Hero Member
  • *****
  • Posts: 714
Re: SSHD needs keygen and restart everytime after reboot
« Reply #1 on: October 14, 2016, 12:09:27 AM »
I now have to regenerate my sshd keys and restart the daemon in order to connect via SSH.
You said you need to restart the daemon.
Do you have this line in your /opt/bootlocal.sh ?
Code: [Select]
/usr/local/etc/init.d/openssh start
Or perhaps somehow you didn't backup successfully ?
Do you have to reset your password after a reboot ?

Offline archieb0ld

  • Newbie
  • *
  • Posts: 20
Re: SSHD needs keygen and restart everytime after reboot
« Reply #2 on: November 04, 2016, 12:19:52 AM »
I have to admit I'm running into the same problem. During boot, right after "Executing startup scripts", the system starts generating the keys.

My setup is as follows (it worked on piCore 6):
I have the keys copied to a USB drive and I edit /opt/bootlocal.sh and create all the symlinks before starting the ssh daemon.

Now, to solve the issue, I have tried moving the symlink creation to bootsync.sh, thinking that it could help, but the keys were still being generated, regardless of the fact that the files were created before starting openssh.tcz (I removed openssh.tcz from onboot.lst to check if the keys were copied over to /usr/local/etc/ssh/, and they were)
As the last option, I used "filetool.sh -b" option, but the restoration process takes place after the extensions are loaded, so that doesn't help much, as the boot process is seriously slowed down.

I took a quick look at tce.installed script for openssh, but couldn't find any errors.

As a side note: I didn't use the openssh.tcz that is bundled with the RPi image. I manually installed it with tce-load -wi instead. Maybe the problem is there...

Offline bmarkus

  • Administrator
  • Hero Member
  • *****
  • Posts: 7183
    • My Community Forum
Re: SSHD needs keygen and restart everytime after reboot
« Reply #3 on: November 04, 2016, 02:36:04 AM »
My setup is as follows (it worked on piCore 6):

Try piCore-8.0 After first run, make a backup typing in terminal

Code: [Select]
filetool.sh -b
Reboot

Béla
Ham Radio callsign: HA5DI

"Amateur Radio: The First Technology-Based Social Network."

Offline archieb0ld

  • Newbie
  • *
  • Posts: 20
Re: SSHD needs keygen and restart everytime after reboot
« Reply #4 on: November 04, 2016, 05:57:15 AM »
I was trying this on 8.0, my whole story is about 8.0 not working. In 6.0, everything worked out of the box, just by modifying bootlocal.sh

Offline Paul_123

  • Administrator
  • Hero Member
  • *****
  • Posts: 1154
Re: SSHD needs keygen and restart everytime after reboot
« Reply #5 on: November 04, 2016, 09:21:55 AM »
Everything works out of the box, I probably have 10 pi's running piCore 8.  They all backup and restore keys appropriately.   Why are you trying to install keys from a usb stick?    If you are trying to do things non-standard, then you need to manually do things.

You will need to install your keys in bootlocal. then load openssh.tcz with tce-load -i openssh.tcz.

Just make sure that you are installing all key types.  If a keytype is missing then it will be automatically generated.
« Last Edit: November 04, 2016, 09:27:51 AM by Paul_123 »

Offline archieb0ld

  • Newbie
  • *
  • Posts: 20
Re: SSHD needs keygen and restart everytime after reboot
« Reply #6 on: November 04, 2016, 01:16:52 PM »
I have tried doing things the "standard" way (backing up using filetool.sh ???), but as I mentioned, it doesn't work either.
In piCore 6 both ways worked. It seems to me that in version 6 the keys were checked during the start of the openssh daemon, however, in version 8 they are checked during openssh.tcz loading. In any case, even if backed up, openssh doesn't see the keys, because it starts before the keys are restored from backup

Offline gavinmc42

  • Sr. Member
  • ****
  • Posts: 301
Re: SSHD needs keygen and restart everytime after reboot
« Reply #7 on: November 04, 2016, 10:15:40 PM »
Very weird.

You tried using standard piCore8 and not touching anything except filetool.sh -b ?
It just works for me, using openssh every day on lots of Pi's.

Why use USB key?
Did you add a wait time in cmdline.txt for the USB to come up?


Offline Paul_123

  • Administrator
  • Hero Member
  • *****
  • Posts: 1154
Re: SSHD needs keygen and restart everytime after reboot
« Reply #8 on: November 04, 2016, 11:09:21 PM »
Bela,

I did some looking into this.   I'm tending to agree that keys get generated during every boot.  They are just overwritten by the restore of mydata.

During boot, extensions are loaded first, and after that is complete then mydata is restored.   Since /usr/local/tce.installed/openssh gets executed immediately after the extensions are mounted, it has to start generating keys before the restore of mydata occurs.   mydata then gets restored overwriting any keys that were generated.

You can for sure see this happen if you enable showapps on the command line. 

Offline bmarkus

  • Administrator
  • Hero Member
  • *****
  • Posts: 7183
    • My Community Forum
Re: SSHD needs keygen and restart everytime after reboot
« Reply #9 on: November 05, 2016, 02:49:32 PM »
openssh.tcz updated, key generation moved from tce.installed to /etc/profile.d where it is executed after backup restored. Please try.
Béla
Ham Radio callsign: HA5DI

"Amateur Radio: The First Technology-Based Social Network."

Offline Paul_123

  • Administrator
  • Hero Member
  • *****
  • Posts: 1154
Re: SSHD needs keygen and restart everytime after reboot
« Reply #10 on: November 05, 2016, 04:55:13 PM »
Not that anyone would run remotely this way, but if you have the command line option "pause" set, that prevents the profile.d script from running.

Also, when you distribute the image, you do not distribute keys with the image.  Keys will get generated on first boot, however bootlocal.sh has already tried to start the openssh daemon and failed, since there were no keys present.  So there will be no way to login remotely to backup the keys and reboot.

Offline bmarkus

  • Administrator
  • Hero Member
  • *****
  • Posts: 7183
    • My Community Forum
Re: SSHD needs keygen and restart everytime after reboot
« Reply #11 on: November 05, 2016, 05:05:31 PM »
@Paul_123

You are right
Béla
Ham Radio callsign: HA5DI

"Amateur Radio: The First Technology-Based Social Network."

Offline Paul_123

  • Administrator
  • Hero Member
  • *****
  • Posts: 1154
Re: SSHD needs keygen and restart everytime after reboot
« Reply #12 on: November 07, 2016, 10:04:43 PM »
Why not just check as a part of the init.d script and generate if needed?

Offline bmarkus

  • Administrator
  • Hero Member
  • *****
  • Posts: 7183
    • My Community Forum
Re: SSHD needs keygen and restart everytime after reboot
« Reply #13 on: November 08, 2016, 07:57:10 AM »
Why not just check as a part of the init.d script and generate if needed?

Yes, I will do that.
Béla
Ham Radio callsign: HA5DI

"Amateur Radio: The First Technology-Based Social Network."

Offline archieb0ld

  • Newbie
  • *
  • Posts: 20
Re: SSHD needs keygen and restart everytime after reboot
« Reply #14 on: November 10, 2016, 06:54:51 PM »
openssh.tcz updated, key generation moved from tce.installed to /etc/profile.d where it is executed after backup restored. Please try.
Thanks for updating openssh.tcz
If "pause" bootcode is used, the error message is displayed: /usr/local/etc/ssh/sshd_config: No such file or directory
Otherwise, everything works and the keys are generated just once, indeed
« Last Edit: November 10, 2016, 06:57:27 PM by archieb0ld »