Skip to content

Commit

Permalink
hiba: Add initial recipe for hiba
Browse files Browse the repository at this point in the history
Discussion to install the HIBA Internal OpenSSH to fetch dependencies
can be found in
https://lists.openembedded.org/g/openembedded-core/topic/94475279#172977

HIBA is a system built on top of regular OpenSSH certificate-based
authentication that allows to manage flexible authorization of
principals on pools of target hosts without the need to push customized
authorized_users files periodically.

This recipe allow us to manage SSH to production machines easily and not
rely on authorized keys.

Tested:
Ran the local-setup.sh and works fine on a BMC.
```
$ ssh -F /tmp/tmp.w8itTW/ssh_config -p 2201 root@localhost
 #####################################################
 #                 setup-local.sh                    #
 # Host Identity Based Authorization SSHD example.   #
 #####################################################
prodHost: limited access
Connection to localhost closed.
$ ssh -F /tmp/tmp.w8itTW/ssh_config -p 2202 root@localhost
 #####################################################
 #                 setup-local.sh                    #
 # Host Identity Based Authorization SSHD example.   #
 #####################################################
Last login: Thu Jan  1 00:47:28 1970 from ::1
```

Signed-off-by: Willy Tu <wltu@google.com>
  • Loading branch information
wltu committed Nov 29, 2022
1 parent c4829fa commit 706db84
Showing 1 changed file with 42 additions and 0 deletions.
42 changes: 42 additions & 0 deletions meta-oe/recipes-connectivity/hiba/hiba_git.bb
Original file line number Diff line number Diff line change
@@ -0,0 +1,42 @@
SUMMARY = "Google Host Identity Based Authorization"
DESCRIPTION = "HIBA is a system built on top of regular OpenSSH \
certificate-based authentication that allows to manage flexible \
authorization of principals on pools of target hosts without the need to \
push customized authorized_users files periodically."

S = "${WORKDIR}/git/hiba"
LICENSE = "BSD-3-Clause"
LIC_FILES_CHKSUM = "file://${S}/LICENSE;md5=7e161abe9a4585310725dd86c28d1ae2"

PV = "1.0+git${SRCPV}"

inherit autotools

DEPENDS = "openssl openssh zlib"

SRC_URI = " \
git://github.com/google/hiba;protocol=https;branch=main;destsuffix=git/hiba;name=hiba \
git://github.com/openssh/openssh-portable.git;protocol=https;branch=master;destsuffix=git/openssh-portable;name=openssh \
"
SRCREV_hiba = "98b551e2a0297b1872851bb81b6d3a2b682778ee"

# Internal OpenSSH version for HIBA to link against (the version doesn't have
# to match the actual installed version).
# Discussion in
# https://lists.openembedded.org/g/openembedded-core/topic/94475279#172977
SRCREV_openssh = "15a01cf15f396f87c6d221c5a6af98331c818962"
SRCREV_FORMAT = "hiba"

EXTRA_OECONF = " \
--with-opensshdir=${S}/../openssh-portable \
--prefix=/usr/ \
"

do_configure:prepend(){
curr="$(pwd)"
cd "${S}/../openssh-portable"
autoreconf
./configure "${CONFIGUREOPTS}"
oe_runmake
cd "${curr}"
}

0 comments on commit 706db84

Please sign in to comment.