Skip to content

Commit 9afaac4

Browse files
simonwalzsimonwalz
committed
feat: Enable ssh server and root login on demand
1 parent 64a8500 commit 9afaac4

4 files changed

Lines changed: 124 additions & 61 deletions

File tree

‎system/Dockerfile‎

Lines changed: 15 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -71,25 +71,22 @@ RUN apt-get update && apt-get install --no-install-recommends -y \
7171
vim \
7272
&& apt-get clean && rm -rf /var/lib/apt/lists/* \
7373
&& systemctl enable systemd-timesyncd.service \
74-
&& echo "net.ipv4.ip_forward=1" >>/etc/sysctl.conf
75-
76-
# Ensure persistence
77-
RUN mkdir -p /data && \
78-
rm -f /etc/machine-id && ln -sf /data/machine-id /etc/machine-id && \
79-
rm -Rf /var/log && ln -sf /data/log /var/log && \
80-
rm -Rf /var/lib/dhcp && ln -sf /data/dhcp /var/lib/dhcp && \
81-
rm -Rf /var/lib/docker && mkdir -p /data/docker && ln -sf /data/docker /var/lib/docker && \
82-
rm -Rf /var/lib/containerd && mkdir -p /data/containerd && ln -sf /data/containerd /var/lib/containerd && \
83-
rm -Rf /root/.docker && mkdir -p /data/.docker && ln -sf /data/.docker /root/.docker && \
84-
echo "[Journal]\nStorage=persistent\nSystemMaxUse=1G\nRuntimeMaxUse=50M\nCompress=yes\nSeal=yes\nSplitMode=uid\nSyncIntervalSec=5m\nRateLimitInterval=30s\nRateLimitBurst=1000" >/etc/systemd/journald.conf && \
85-
rm /etc/network/interfaces && \
86-
rm -f /etc/ssh/ssh_host_*
74+
&& systemctl disable ssh \
75+
&& echo "Port 4222\nPermitRootLogin yes" >/etc/ssh/sshd_config.d/cuos.conf \
76+
&& rm -f /etc/ssh/ssh_host_* \
77+
&& echo "net.ipv4.ip_forward=1" >>/etc/sysctl.conf \
78+
## Ensure persistence in /data \
79+
&& mkdir -p /data \
80+
&& rm -f /etc/machine-id && ln -sf /data/machine-id /etc/machine-id \
81+
&& rm -Rf /var/log && ln -sf /data/log /var/log \
82+
&& rm -Rf /var/lib/dhcp && ln -sf /data/dhcp /var/lib/dhcp \
83+
&& rm -Rf /var/lib/docker && ln -sf /data/docker /var/lib/docker \
84+
&& rm -Rf /var/lib/containerd && ln -sf /data/containerd /var/lib/containerd \
85+
&& rm -Rf /root/.docker && ln -sf /data/.docker /root/.docker \
86+
&& rm -Rf /root && && ln -sf /data/root /root \
87+
&& echo "[Journal]\nStorage=persistent\nSystemMaxUse=1G\nRuntimeMaxUse=50M\nCompress=yes\nSeal=yes\nSplitMode=uid\nSyncIntervalSec=5m\nRateLimitInterval=30s\nRateLimitBurst=1000" >/etc/systemd/journald.conf \
88+
&& rm /etc/network/interfaces
8789

8890
# Install CuOS scripts (systemd required)
8991
COPY cuos/ /usr/local/cuos/
9092
RUN /usr/local/cuos/install.sh
91-
92-
# Set up SSH
93-
RUN echo 'root:root' | chpasswd && \
94-
sed -i 's/#PermitRootLogin prohibit-password/PermitRootLogin yes/' /etc/ssh/sshd_config
95-

‎system/Dockerfile.lxc‎

Lines changed: 18 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -49,26 +49,25 @@ RUN apt-get update && apt-get install --no-install-recommends -y \
4949
openssh-server \
5050
vim \
5151
&& apt-get clean && rm -rf /var/lib/apt/lists/* \
52-
&& echo "net.ipv4.ip_forward=1" >>/etc/sysctl.conf
53-
54-
# Put logs in /data/logs
55-
RUN mkdir -p /data && \
56-
rm -f /etc/machine-id && ln -sf /data/machine-id /etc/machine-id && \
57-
rm -Rf /var/log && ln -sf /data/log /var/log && \
58-
rm -Rf /var/lib/dhcp && ln -sf /data/dhcp /var/lib/dhcp && \
59-
rm -Rf /var/lib/docker && mkdir -p /data/docker && ln -sf /data/docker /var/lib/docker && \
60-
rm -Rf /var/lib/containerd && mkdir -p /data/containerd && ln -sf /data/containerd /var/lib/containerd && \
61-
rm -Rf /root/.docker && mkdir -p /data/.docker && ln -sf /data/.docker /root/.docker && \
62-
echo "[Journal]\nStorage=persistent\nSystemMaxUse=1G\nRuntimeMaxUse=50M\nCompress=yes\nSeal=yes\nSplitMode=uid\nSyncIntervalSec=5m\nRateLimitInterval=30s\nRateLimitBurst=1000" >/etc/systemd/journald.conf && \
63-
rm /etc/network/interfaces && \
64-
rm -f /etc/ssh/ssh_host_* && \
65-
systemctl mask cgroupfs-mount.service sys-kernel-debug.mount
52+
# No timesyncd for LXC \
53+
&& systemctl disable ssh \
54+
&& echo "Port 4222\nPermitRootLogin yes" >/etc/ssh/sshd_config.d/cuos.conf \
55+
&& rm -f /etc/ssh/ssh_host_* \
56+
&& echo "net.ipv4.ip_forward=1" >>/etc/sysctl.conf \
57+
## Ensure persistence \
58+
&& mkdir -p /data \
59+
&& rm -f /etc/machine-id && ln -sf /data/machine-id /etc/machine-id \
60+
&& rm -Rf /var/log && ln -sf /data/log /var/log \
61+
&& rm -Rf /var/lib/dhcp && ln -sf /data/dhcp /var/lib/dhcp \
62+
&& rm -Rf /var/lib/docker && ln -sf /data/docker /var/lib/docker \
63+
&& rm -Rf /var/lib/containerd && ln -sf /data/containerd /var/lib/containerd \
64+
&& rm -Rf /root/.docker && ln -sf /data/.docker /root/.docker \
65+
&& rm -Rf /root && && ln -sf /data/root /root \
66+
&& echo "[Journal]\nStorage=persistent\nSystemMaxUse=1G\nRuntimeMaxUse=50M\nCompress=yes\nSeal=yes\nSplitMode=uid\nSyncIntervalSec=5m\nRateLimitInterval=30s\nRateLimitBurst=1000" >/etc/systemd/journald.conf \
67+
&& rm /etc/network/interfaces \
68+
## LXC \
69+
&& systemctl mask cgroupfs-mount.service sys-kernel-debug.mount
6670

6771
# Install CuOS scripts (systemd required)
6872
COPY cuos/ /usr/local/cuos/
6973
RUN /usr/local/cuos/install.sh
70-
71-
# Set up SSH
72-
RUN echo 'root:root' | chpasswd && \
73-
sed -i 's/#PermitRootLogin prohibit-password/PermitRootLogin yes/' /etc/ssh/sshd_config
74-

‎system/Dockerfile.rpi-arm64‎

Lines changed: 17 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -125,26 +125,25 @@ RUN apt-get update && apt-get install --no-install-recommends -y \
125125
vim \
126126
&& apt-get clean && rm -rf /var/lib/apt/lists/* \
127127
&& systemctl enable systemd-timesyncd.service \
128-
&& echo "net.ipv4.ip_forward=1" >>/etc/sysctl.conf
128+
&& systemctl disable ssh \
129+
&& echo "Port 4222\nPermitRootLogin yes" >/etc/ssh/sshd_config.d/cuos.conf \
130+
&& rm -f /etc/ssh/ssh_host_* \
131+
&& echo "net.ipv4.ip_forward=1" >>/etc/sysctl.conf \
132+
## Ensure persistence \
133+
&& mkdir -p /data \
134+
&& rm -f /etc/machine-id && ln -sf /data/machine-id /etc/machine-id \
135+
&& rm -Rf /var/log && ln -sf /data/log /var/log \
136+
&& rm -Rf /var/lib/dhcp && ln -sf /data/dhcp /var/lib/dhcp \
137+
&& rm -Rf /var/lib/docker && ln -sf /data/docker /var/lib/docker \
138+
&& rm -Rf /var/lib/containerd && ln -sf /data/containerd /var/lib/containerd \
139+
&& rm -Rf /root/.docker && ln -sf /data/.docker /root/.docker \
140+
&& rm -Rf /root && && ln -sf /data/root /root \
141+
&& echo "[Journal]\nStorage=persistent\nSystemMaxUse=1G\nRuntimeMaxUse=50M\nCompress=yes\nSeal=yes\nSplitMode=uid\nSyncIntervalSec=5m\nRateLimitInterval=30s\nRateLimitBurst=1000" >/etc/systemd/journald.conf \
142+
&& rm /etc/network/interfaces \
143+
## RPI \
144+
&& rm -f /usr/lib/systemd/journald.conf.d/70-rpi-volatile-storage.conf && \
129145

130-
# Ensure persistence
131-
RUN mkdir -p /data && \
132-
rm -f /etc/machine-id && ln -sf /data/machine-id /etc/machine-id && \
133-
rm -Rf /var/log && ln -sf /data/log /var/log && \
134-
rm -Rf /var/lib/dhcp && ln -sf /data/dhcp /var/lib/dhcp && \
135-
rm -Rf /var/lib/docker && mkdir -p /data/docker && ln -sf /data/docker /var/lib/docker && \
136-
rm -Rf /var/lib/containerd && mkdir -p /data/containerd && ln -sf /data/containerd /var/lib/containerd && \
137-
rm -Rf /root/.docker && mkdir -p /data/.docker && ln -sf /data/.docker /root/.docker && \
138-
echo "[Journal]\nStorage=persistent\nSystemMaxUse=1G\nRuntimeMaxUse=50M\nCompress=yes\nSeal=yes\nSplitMode=uid\nSyncIntervalSec=5m\nRateLimitInterval=30s\nRateLimitBurst=1000" >/etc/systemd/journald.conf && \
139-
rm -f /usr/lib/systemd/journald.conf.d/70-rpi-volatile-storage.conf && \
140-
rm /etc/network/interfaces && \
141-
rm -f /etc/ssh/ssh_host_*
142146

143147
# Install CuOS scripts (systemd required)
144148
COPY cuos/ /usr/local/cuos/
145149
RUN /usr/local/cuos/install.sh
146-
147-
# Set up SSH
148-
RUN echo 'root:root' | chpasswd && \
149-
sed -i 's/#PermitRootLogin prohibit-password/PermitRootLogin yes/' /etc/ssh/sshd_config
150-

‎system/cuos/init.sh‎

Lines changed: 74 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,12 @@ VIRT_TYPE="$(systemd-detect-virt)"
1111
source "${SCRIPT_DIR}/utils.sh"
1212

1313
ensure_docker_config_json() {
14-
mkdir -p /root/.docker
14+
mkdir -p /data/root/
15+
rm -Rf /root
16+
ln -sf /data/root /root
17+
18+
mkdir -p /data/.docker
19+
ln -sf /data/.docker /root/.docker
1520
rmdir /root/.docker/config.json 2>/dev/null && \
1621
echo "Warning: deleted config.json as dir"
1722
if [[ ! -f "/root/.docker/config.json" ]]; then
@@ -349,14 +354,73 @@ EOF
349354
setupcon || true
350355
}
351356

357+
set_root_password() {
358+
local root_password
359+
root_password="$(jq_config -r '.os_root_password // empty')"
360+
361+
if [[ -z "${root_password}" ]]; then
362+
usermod -L root
363+
return
364+
fi
365+
366+
# Check if password looks like a hash (contains typical hash delimiters or is too long for a plain password)
367+
# Common hash formats: $1$ (MD5), $2a/$2y/$2b (bcrypt), $5$ (SHA-256), $6$ (SHA-512)
368+
if [[ "${root_password}" =~ ^\$[0-9a-z]+\$ ]] || [[ ${#root_password} -gt 50 ]]; then
369+
# Treat as hash - use chpasswd with -e flag for encrypted passwords
370+
echo "root:${root_password}" | chpasswd -e
371+
else
372+
# Treat as plain password - use chpasswd without -e flag
373+
echo "root:${root_password}" | chpasswd
374+
fi
375+
376+
usermod -U root
377+
378+
report_info "cuos:init:root_access" "Root access is enabled"
379+
}
380+
352381
create_ssh_hostkey() {
382+
local SSH_PERSIST_DIR="/data/ssh-hostkeys"
383+
local SSH_CONFIG_DIR="/etc/ssh"
384+
353385
shopt -s nullglob
354-
hostkeys=(/etc/ssh/ssh_host_*_key)
355-
if [ ${#hostkeys[@]} -eq 0 ]; then
356-
echo "Generating SSH host keys"
357-
mkdir -p /etc/ssh
358-
chmod 700 /etc/ssh
386+
hostkeys=("${SSH_CONFIG_DIR}"/ssh_host_*_key)
387+
if [ ${#hostkeys[@]} -gt 0 ]; then
388+
return
389+
fi
390+
391+
mkdir -p "${SSH_PERSIST_DIR}"
392+
mkdir -p "${SSH_CONFIG_DIR}"
393+
chmod 700 "${SSH_CONFIG_DIR}"
394+
395+
local persisted_keys=("${SSH_PERSIST_DIR}"/ssh_host_*_key)
396+
if [ ${#persisted_keys[@]} -gt 0 ]; then
397+
# Restore keys from persistent storage
398+
report_info "cuos:init:ssh_hostkeys" "Restoring SSH host keys from ${SSH_PERSIST_DIR}"
399+
cp "${SSH_PERSIST_DIR}"/ssh_host_*_key "${SSH_CONFIG_DIR}/" 2>/dev/null || true
400+
cp "${SSH_PERSIST_DIR}"/ssh_host_*_key.pub "${SSH_CONFIG_DIR}/" 2>/dev/null || true
401+
chmod 600 "${SSH_CONFIG_DIR}"/ssh_host_*_key
402+
chmod 644 "${SSH_CONFIG_DIR}"/ssh_host_*_key.pub
403+
else
404+
# Generate new keys
405+
report_info "cuos:init:ssh_hostkeys" "Generating SSH host keys"
359406
ssh-keygen -A
407+
408+
# Persist the newly generated keys
409+
report_info "cuos:init:ssh_hostkeys" "Persisting SSH host keys to ${SSH_PERSIST_DIR}"
410+
cp "${SSH_CONFIG_DIR}"/ssh_host_*_key "${SSH_PERSIST_DIR}/" 2>/dev/null || true
411+
cp "${SSH_CONFIG_DIR}"/ssh_host_*_key.pub "${SSH_PERSIST_DIR}/" 2>/dev/null || true
412+
chmod 600 "${SSH_PERSIST_DIR}"/ssh_host_*_key
413+
chmod 644 "${SSH_PERSIST_DIR}"/ssh_host_*_key.pub
414+
fi
415+
}
416+
417+
configure_ssh_server() {
418+
local ssh_enabled
419+
ssh_enabled="$(jq_config -r '.os_ssh_server // false')"
420+
421+
if [[ "${ssh_enabled}" == "true" ]]; then
422+
report_info "cuos:init:ssh_server" "Start SSH server"
423+
systemctl start ssh
360424
fi
361425
}
362426

@@ -550,8 +614,12 @@ import_custom_ca_certs
550614

551615
configure_keyboard
552616

617+
set_root_password
618+
553619
create_ssh_hostkey
554620

621+
configure_ssh_server
622+
555623
configure_docker
556624

557625
create_swap_and_resize_fs

0 commit comments

Comments
 (0)