obel1x/fedora-OEMDRV
0
0
Fork 1
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

0060_ssh_key: relocate ~/.ssh into encrypted data dir, generate non-interactively

Browse Source 
Symlinks ~/.ssh to ${DECRYPTEDDATADIR}/ssh_keys (migrating any existing
content once) so the key lives in the gocryptfs-encrypted area instead
of the plain home directory. Also passes -N "" to ssh-keygen so key
generation no longer prompts for a passphrase.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Daniel unbrot Pätzold
2026-06-17 13:49:33 +02:00
parent a708e4fa6e
commit 6fe96f82fd
2 changed files with 30 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client_software/0060_ssh_key/user_run.sh
+25 -3
View File
@@ -11,15 +11,37 @@ if [ "${DAVTOKEN_USER}." == "." ]; then
exit 1
fi
KEYFILE="${HOME}/.ssh/id_ed25519"
SSHDIR="${HOME}/.ssh"
SSHDIR_REAL="${DECRYPTEDDATADIR}/ssh_keys"
KEYFILE="${SSHDIR}/id_ed25519"
SSHVAULTNAME="SSH_PRIV_KEY"
#Relocate ~/.ssh into the encrypted data directory, migrating any existing content once
if [ ! -L "${SSHDIR}" ]; then
mkdir -p "${SSHDIR_REAL}"
chmod 0700 "${SSHDIR_REAL}"
if [ -d "${SSHDIR}" ]; then
echo "Migrating existing ${SSHDIR} contents to ${SSHDIR_REAL}."
cp -a "${SSHDIR}/." "${SSHDIR_REAL}/"
if [ $? -ne 0 ]; then
echo "Error migrating ${SSHDIR} contents to ${SSHDIR_REAL}. Aborting, please check."
exit 1
fi
rm -rf "${SSHDIR}"
fi
ln -s "${SSHDIR_REAL}" "${SSHDIR}"
if [ $? -ne 0 ]; then
echo "Error creating symlink ${SSHDIR} -> ${SSHDIR_REAL}. Aborting, please check."
exit 1
fi
fi
if [ ${IPAVAULTUSE} = "false" ]; then
echo "No IPA- KRA service configured, SSH Key provisioning to and from IPA is not available."
else
if [ -f ${KEYFILE} ]; then
echo "SSH Key already present at ${KEYFILE}. Leaving it untouched."
else
mkdir -p "${HOME}/.ssh"
echo "SSH Key ${KEYFILE} not found. Getting Key from IPA- Vault"
ipa vault-retrieve "${SSHVAULTNAME}" --out ${KEYFILE}
if [ $? -ne 0 ]; then
@@ -29,7 +51,7 @@ else
echo "Error creating the new Vault named ${SSHVAULTNAME} on IPA. This should not happen, aborting. Please check."
exit 1
else
ssh-keygen -t ed25519 -C "$(whoami)" -f ${KEYFILE}
ssh-keygen -t ed25519 -C "$(whoami)" -N "" -f ${KEYFILE}
if [ $? -ne 0 ]; then
echo "Error generating the new SSH key at ${KEYFILE}. Aborting without touching the Vault. Please check."
exit 1