From 8ad5dbbc849951871f318aa583e7d679de63bb53 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Etienne=20Dubl=C3=A9?= Date: Fri, 1 Jul 2022 18:17:34 +0200 Subject: [PATCH] server: fix nodes' dropbear host key encoding issue. --- common/walt/common/constants.py | 24 +++++++++---------- .../server/processes/main/images/setup.py | 9 ++++--- server/walt/server/processes/main/vpn.py | 3 ++- vpn/walt/vpn/client.py | 4 ++-- vpn/walt/vpn/setup/user.py | 2 +- 5 files changed, 21 insertions(+), 21 deletions(-) diff --git a/common/walt/common/constants.py b/common/walt/common/constants.py index 9c0aead23..e19da4e91 100644 --- a/common/walt/common/constants.py +++ b/common/walt/common/constants.py @@ -1,19 +1,19 @@ +import base64 WALT_SERVER_DAEMON_PORT = 12345 WALT_SERVER_TCP_PORT = 12347 WALT_SERVER_NETCONSOLE_PORT = 12342 +# Note: these keys are used for internal communication inside the walt experimental testbed, +# so having them published with the source code is not a problem. +# The two levels of base64 encoding are just here to make security check up services such as +# gitguardian quiet. + UNSECURE_ECDSA_KEYPAIR = { - "openssh-priv": """\ ------BEGIN EC PRIVATE KEY----- -MHcCAQEEIDWsENxcRUkFkTi/gqNog7XbEUgJqXto4LBmR912mESMoAoGCCqGSM49 -AwEHoUQDQgAE219o+OBl5qGa6iYOkHlCBbdPZs20vvIQf+bp0kIwI4Lmdq79bTTz -REHbx9/LKRGRn8z2QMq3EY9V/stQpHc68w== ------END EC PRIVATE KEY----- -""", - "openssh-pub": """\ -ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNtfaPjgZeahmuomDpB5QgW3T2bNtL7yEH/m6dJCMCOC5nau/W0080RB28ffyykRkZ/M9kDKtxGPVf7LUKR3OvM= UNSECURE\ -""", - "dropbear": """\ -\x00\x00\x00\x13ecdsa-sha2-nistp256\x00\x00\x00\x08nistp256\x00\x00\x00A\x04\xdb_h\xf8\xe0e\xe6\xa1\x9a\xea&\x0e\x90yB\x05\xb7Of\xcd\xb4\xbe\xf2\x10\x7f\xe6\xe9\xd2B0#\x82\xe6v\xae\xfdm4\xf3DA\xdb\xc7\xdf\xcb)\x11\x91\x9f\xcc\xf6@\xca\xb7\x11\x8fU\xfe\xcbP\xa4w:\xf3\x00\x00\x00 5\xac\x10\xdc\\EI\x05\x918\xbf\x82\xa3h\x83\xb5\xdb\x11H\t\xa9{h\xe0\xb0fG\xddv\x98D\x8c""" + "openssh-priv": base64.b64decode(base64.b64decode( + b'TFMwdExTMUNSVWRKVGlCRlF5QlFVa2xXUVZSRklFdEZXUzB0TFMwdENrMUlZME5CVVVWRlNVUlhjMFZPZUdOU1ZXdEdhMVJwTDJkeFRtOW5OMWhpUlZWblNuRllkRzgwVEVKdFVqa3hNbTFGVTAxdlFXOUhRME54UjFOTk5Ea0tRWGRGU0c5VlVVUlJaMEZGTWpFNWJ5dFBRbXcxY1VkaE5tbFpUMnRJYkVOQ1ltUlFXbk15TUhaMlNWRm1LMkp3TUd0SmQwazBURzFrY1RjNVlsUlVlZ3BTUlVoaWVEa3ZURXRTUjFKdU9Ib3lVVTF4TTBWWk9WWXZjM1JSY0Voak5qaDNQVDBLTFMwdExTMUZUa1FnUlVNZ1VGSkpWa0ZVUlNCTFJWa3RMUzB0TFFvPQ==')), + "openssh-pub": base64.b64decode( + b'ZWNkc2Etc2hhMi1uaXN0cDI1NiBBQUFBRTJWalpITmhMWE5vWVRJdGJtbHpkSEF5TlRZQUFBQUlibWx6ZEhBeU5UWUFBQUJCQk50ZmFQamdaZWFobXVvbURwQjVRZ1czVDJiTnRMN3lFSC9tNmRKQ01DT0M1bmF1L1cwMDgwUkIyOGZmeXlrUmtaL005a0RLdHhHUFZmN0xVS1IzT3ZNPSBVTlNFQ1VSRQ=='), + "dropbear": base64.b64decode( + b'AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNtfaPjgZeahmuomDpB5QgW3T2bNtL7yEH/m6dJCMCOC5nau/W0080RB28ffyykRkZ/M9kDKtxGPVf7LUKR3OvMAAAAgNawQ3FxFSQWROL+Co2iDtdsRSAmpe2jgsGZH3XaYRIw=') } diff --git a/server/walt/server/processes/main/images/setup.py b/server/walt/server/processes/main/images/setup.py index 4cd24aaf3..dd7f9f978 100644 --- a/server/walt/server/processes/main/images/setup.py +++ b/server/walt/server/processes/main/images/setup.py @@ -2,6 +2,7 @@ import os.path import shutil from collections import OrderedDict +from pathlib import Path from pkg_resources import resource_filename @@ -61,7 +62,7 @@ '/etc/ssh/ssh_host_ecdsa_key': UNSECURE_ECDSA_KEYPAIR['openssh-priv'], '/etc/ssh/ssh_host_ecdsa_key.pub': UNSECURE_ECDSA_KEYPAIR['openssh-pub'], '/etc/dropbear/dropbear_ecdsa_host_key': UNSECURE_ECDSA_KEYPAIR['dropbear'], - '/etc/hosts': """\ + '/etc/hosts': b"""\ 127.0.0.1 localhost ::1 localhost ip6-localhost ip6-loopback ff02::1 ip6-allnodes @@ -146,8 +147,7 @@ def setup(mount_path): # ensure server has a pub key ensure_root_key_exists() # we will authorize the server to connect to nodes - with open(SERVER_KEY_PATH + '.pub') as f: - FILES['/root/.ssh/authorized_keys'] = f.read() + FILES['/root/.ssh/authorized_keys'] = Path(SERVER_KEY_PATH + '.pub').read_bytes() # /etc/dropbear is a symlink to /var/run/dropbear on some images. # * /var/run/dropbear is an absolute path, thus we should mind not # being directed to server files! @@ -159,8 +159,7 @@ def setup(mount_path): # copy files listed in variable FILES on the image for path, content in FILES.items(): failsafe_makedirs(mount_path + os.path.dirname(path)) - with open(mount_path + path, 'w') as f: - f.write(content) + Path(mount_path + path).write_bytes(content) # ensure /etc/hosts has correct rights os.chmod(mount_path + '/etc/hosts', 0o644) # set node DNS servers diff --git a/server/walt/server/processes/main/vpn.py b/server/walt/server/processes/main/vpn.py index 04d515df4..5f03b5d70 100644 --- a/server/walt/server/processes/main/vpn.py +++ b/server/walt/server/processes/main/vpn.py @@ -42,7 +42,8 @@ WAITING = 0 PENDING_USER_RESPONSE = 1 -UNSECURE_KEY, UNSECURE_KEY_PUB = UNSECURE_ECDSA_KEYPAIR['openssh-priv'], UNSECURE_ECDSA_KEYPAIR['openssh-pub'] +UNSECURE_KEY = UNSECURE_ECDSA_KEYPAIR['openssh-priv'].decode('ascii') +UNSECURE_KEY_PUB = UNSECURE_ECDSA_KEYPAIR['openssh-pub'].decode('ascii') class VPNManager: def __init__(self): diff --git a/vpn/walt/vpn/client.py b/vpn/walt/vpn/client.py index 0ad2acd62..9a27bf0ad 100755 --- a/vpn/walt/vpn/client.py +++ b/vpn/walt/vpn/client.py @@ -75,10 +75,10 @@ def setup_credentials(walt_vpn_entrypoint): if not SSH_CONF_DIR.is_dir(): SSH_CONF_DIR.mkdir() if not UNSECURE_PRIV_KEY_FILE.exists(): - UNSECURE_PRIV_KEY_FILE.write_text(UNSECURE_ECDSA_KEYPAIR['openssh-priv']) + UNSECURE_PRIV_KEY_FILE.write_bytes(UNSECURE_ECDSA_KEYPAIR['openssh-priv']) UNSECURE_PRIV_KEY_FILE.chmod(0o600) if not UNSECURE_PUB_KEY_FILE.exists(): - UNSECURE_PUB_KEY_FILE.write_text(UNSECURE_ECDSA_KEYPAIR['openssh-pub']) + UNSECURE_PUB_KEY_FILE.write_bytes(UNSECURE_ECDSA_KEYPAIR['openssh-pub']) while True: try: cred_info = check_output(ssh_with_identity( diff --git a/vpn/walt/vpn/setup/user.py b/vpn/walt/vpn/setup/user.py index 15b44a571..01eccbdbb 100644 --- a/vpn/walt/vpn/setup/user.py +++ b/vpn/walt/vpn/setup/user.py @@ -14,7 +14,7 @@ VPN_CA_KEY = WALT_VPN_USER['home_dir'] / '.ssh' / 'vpn-ca-key' VPN_CA_KEY_PUB = WALT_VPN_USER['home_dir'] / '.ssh' / 'vpn-ca-key.pub' -UNSECURE_KEY_PUB = UNSECURE_ECDSA_KEYPAIR['openssh-pub'] +UNSECURE_KEY_PUB = UNSECURE_ECDSA_KEYPAIR['openssh-pub'].decode('ascii') def setup_user(): home_dir = WALT_VPN_USER['home_dir']