Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cirrus: Authorize rootless user self-ssh #12139

Merged
merged 1 commit into from
Nov 1, 2021
Merged

Cirrus: Authorize rootless user self-ssh #12139

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 14 additions & 11 deletions contrib/cirrus/lib.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -143,6 +143,8 @@ setup_rootless() {
local rootless_uid
local rootless_gid
local env_var_val
local akfilepath
local sshcmd

# Only do this once; established by setup_environment.sh
# shellcheck disable=SC2154
Expand All @@ -169,24 +171,25 @@ setup_rootless() {
ssh-keygen -P "" -f "$HOME/.ssh/id_rsa"

msg "Allowing ssh key for $ROOTLESS_USER"
akfilepath="/home/$ROOTLESS_USER/.ssh/authorized_keys"
(umask 077 && mkdir "/home/$ROOTLESS_USER/.ssh")
chown -R $ROOTLESS_USER:$ROOTLESS_USER "/home/$ROOTLESS_USER/.ssh"
install -o $ROOTLESS_USER -g $ROOTLESS_USER -m 0600 \
"$HOME/.ssh/id_rsa.pub" "/home/$ROOTLESS_USER/.ssh/authorized_keys"
"$HOME/.ssh/id_rsa.pub" "$akfilepath"
# Makes debugging easier
cat /root/.ssh/authorized_keys >> "/home/$ROOTLESS_USER/.ssh/authorized_keys"

msg "Configuring subuid and subgid"
grep -q "${ROOTLESS_USER}" /etc/subuid || \
echo "${ROOTLESS_USER}:$[rootless_uid * 100]:65536" | \
tee -a /etc/subuid >> /etc/subgid
cat /root/.ssh/authorized_keys >> "$akfilepath"

msg "Ensure the ssh daemon is up and running within 5 minutes"
systemctl start sshd
lilto ssh $ROOTLESS_USER@localhost \
-o UserKnownHostsFile=/dev/null \
-o StrictHostKeyChecking=no \
-o CheckHostIP=no true
sshcmd="ssh $ROOTLESS_USER@localhost
-o UserKnownHostsFile=/dev/null
-o StrictHostKeyChecking=no
-o CheckHostIP=no"
lilto $sshcmd true # retry until sshd is up

msg "Configuring rootless user self-access to ssh to localhost"
$sshcmd ssh-keygen -P '""' -f "/home/$ROOTLESS_USER/.ssh/id_rsa"
cat "/home/$ROOTLESS_USER/.ssh/id_rsa" >> "$akfilepath"
}

install_test_configs() {
Expand Down