Add usb rsa key #13509
Add usb rsa key #13509
Conversation
There was a problem hiding this comment.
Can we bind this to a route somewhere, like POST /server/ssh_keys/from_local or something in the update server? That way it's easy to make a button that does it in the ui and we can still get people to curl it. We don't need to limit where they can curl from because it will only handle things from devices physically plugged in to the machine.
Also, let's refactor this so that it raises exceptions or returns a string status or something rather than printing - when it prints like this we can't really reuse it in other code.
Codecov Report
Additional details and impacted files@@ Coverage Diff @@
## edge #13509 +/- ##
=======================================
Coverage 71.37% 71.37%
=======================================
Files 2433 2433
Lines 68066 68066
Branches 7919 7919
=======================================
Hits 48581 48581
Misses 17626 17626
Partials 1859 1859
Flags with carried forward coverage won't be shown. Click here to find out more. |
This is the way |
…led from new /server/ssh_keys/from_local endpoint
Overview
The Flex does not use a link-local connection to the host computer so we cannot use
curlto add a public SSH rsa key via the/server/ssh_keysendpoint like we do for the OT-2. Ideally, we have a mechanism that will formulate an add-key request and send it to the Flex via the usb-bridge connection, handling it as a standard HTTP request. However, we don't yet have that feature set up and need to disable root password logins for the Yocto builds. So let's add an alternative way to securely add SSH-RSA keys that still require local access to the robot in order to add an SSH key.This PR accomplishes this by adding a new
/server/ssh_keys/from_localendpoint to the update-server that, scans for USB thumb drives on the Flex, finds any .pub files, validates, and then adds them to the~/.ssh/authorized_keysfile.Instructions for adding your SSH key to the Flex
/server/ssh_keys/from_localendpoint/server/ssh_keys/from_localendpoint, see belowcurl --location --request POST 'http://10.13.11.96:31950/server/ssh_keys/from_local' --header 'opentrons-version: 3'201and the message will tell you how many keys were added{ "message": "Added 1 new keys", "key_md5": [ "0ca9f47168c05f6675fe1806f9063084" ] }404{ "error": "no-key", "message": "No valid keys found" }Test Plan
curlpost to the/server/ssh_keys/from_localendpoint, and make sure the pub key is added to the~/.ssh/authorized_keysfile.curlpost to the/server/ssh_keys/from_localendpoint, no keys should be added to the~/.ssh/authorized_keysfile.DROPBEAR_EXTRA_ARGSand make sure we can't SSH without first adding a valid public key by hitting the/server/ssh_keys/from_localendpoint.Changelog
/server/ssh_keys/from_localendpoint to the update-server which searches .pub keys in thumb drives mounted to/media.Review requests
Risk assessment
Low