auto generate additional ssh keys #33974
Conversation
this allows storing different keys
GiteaBot
added
the
lgtm/need 2
pull-request-size
bot
added
the
size/L
rework keygen to guess the keysize from extension
make key generation happen in generation module
github-actions
bot
added
the
modifies/cli
| if err != nil { | ||
| return err | ||
| } | ||
| f, err := os.OpenFile(file, os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0o600) |
There was a problem hiding this comment.
Should it avoid overwriting existing file?
/tmp$ ssh-keygen -t ecdsa -f a
Generating public/private ecdsa key pair.
a already exists.
Overwrite (y/n)?
There was a problem hiding this comment.
It would be a good idea, I'll try to figure out how to do it.
Would comments also be a good idea to include?
| @@ -400,12 +406,21 @@ func Listen(host string, port int, ciphers, keyExchanges, macs []string) { | |||
| // Public key is encoded in the format for inclusion in an OpenSSH authorized_keys file. | |||
| // Private Key generated is PEM encoded | |||
| func GenKeyPair(keyPath string) error { | |||
| privateKey, err := rsa.GenerateKey(rand.Reader, 4096) | |||
| bits := 4096 | |||
| keytype := filepath.Ext(keyPath) | |||
There was a problem hiding this comment.
It doesn't seem right to guess the content by file extension.
(oudated)
The key itself has the correct information.
$ ssh-keygen -t ecdsa -f a
...
$ ssh-keygen -lf a
256 SHA256:NS1YmfwZDYoEgtS3Ne0wRuDvGFFWyQfc1QB8ZT2SGeA xiaoguang@Xiaoguangs-MacBook-Pro.local (ECDSA)
Hmm, it is not for "parsing" but for "creating", but it still seems strange to guess the key type by file extension.
There was a problem hiding this comment.
Fully agreed it's a bad design. The default was []string{"ssh/gitea.rsa", "ssh/gogs.rsa"} so I figured []string{"ssh/gitea.rsa", "ssh/gitea.ed25519", "ssh/gitea.ecdsa", "ssh/gogs.rsa"} would be an acceptable workaround. I don't like it either but I had no better ideas to date.
| err := GenKeyPair(setting.SSH.ServerHostKeys[0]) | ||
| if err != nil { | ||
| log.Fatal("Failed to generate private key: %v", err) | ||
| for i := range 3 { |
There was a problem hiding this comment.
Why 3? Why generates all files?
There was a problem hiding this comment.
For new default settings and parity with default (rootful) container keys. I'd like to drop it for something better though.
TheFox0x7
force-pushed
the
generate-additional-ssh-keys
branch
from
0372c4b to
61f4962
Compare
adds capabilities for gitea to generate ecdsa and ed25519 keys by default
adds cli for built-in ssh keygen
closes: #33783
Since we already generate RSA key in rootless by default, I see no reason to add keygen in there. Instead we can add more keygen capabilities to internal ssh server.
The only remaining question is how to expose this to end user?
One option I see is to extend ServerHostKeys to
["gitea.rsa","gitea.ecdsa","gitea.ed25519","gogs.rsa"]but I'm not sure if it's a correct way.