andsens / bootstrap-vz

Bootstrap Debian images for virtualized environments
http://bootstrap-vz.readthedocs.io/
Other
263 stars 143 forks source link

Remove ED25519 ssh host key pair from image #426

Closed mengelmann closed 6 years ago

mengelmann commented 6 years ago

ED25519 ssh host key pair is not removed from /etc/ssh:

$ ls -l /etc/ssh/ssh_host_*
-rw------- 1 root root 399 Jan  8 16:39 etc/ssh/ssh_host_ed25519_key
-rw-r--r-- 1 root root  94 Jan  8 16:39 etc/ssh/ssh_host_ed25519_key.pub

ED25519 ssh key pair is created since OpenSSH 6.5 (6.7 in Debian jessie) https://wiki.debian.org/SSH#Installation_of_the_server

mengelmann commented 6 years ago

Note to me: Need to check backward compatibility with wheezy - check if keygen supports ed25519, as @andsens noted in #431.

Wheezy benefits from Long Term Support (LTS) until the end of May 2018 https://www.debian.org/releases/wheezy/index.en.html

mengelmann commented 6 years ago

The more you get into it, the more complicated it becomes:

oppenssh-server from wheezy-backports supports ED25519 keys, so 'generate-ssh-hostkeys' script would have to check at runtime if ED25519 is supported or not. My suggestion is to leave wheezy as is right now in bootstrap-vz (supports RSA, DSA and ECDSA) and just support ED25519 for jessie and newer.

I added changes in the code to reflect the above. PR is also a workaround for #432 (changes LSB header in sysv init script for stretch, see mentioned issue for details).

Please review.

andsens commented 6 years ago

Oh wow. Yeah, that's far from simple. Good job on getting through this! Merging...