Merge pull request #302 from bacongobbler/store-private-keys-in-secret

feat(pkg/sshd): Store private keys in kubernetes secret

Author: Matthew Fisher

pkg/routes.go

@@ -20,11 +20,7 @@ func routes(reg *cookoo.Registry) {
 		Help: "Boot the builder",
 		Does: []cookoo.Task{
 
-			// SSHD: Create and configure host keys.
-			cookoo.Cmd{
-				Name: "installSshHostKeys",
-				Fn:   sshd.GenSSHKeys,
-			},
+			// SSHD: Configure host keys.
 			cookoo.Cmd{
 				Name: sshd.HostKeys,
 				Fn:   sshd.ParseHostKeys,

pkg/sshd/sshd.go

@@ -3,7 +3,6 @@ package sshd
 import (
 	"fmt"
 	"io/ioutil"
-	"os/exec"
 
 	"golang.org/x/crypto/ssh"
 
@@ -31,7 +30,7 @@ const (
 func ParseHostKeys(c cookoo.Context, p *cookoo.Params) (interface{}, cookoo.Interrupt) {
 	log.Debugf(c, "Parsing ssh host keys")
 	hostKeyTypes := p.Get("keytypes", []string{"rsa", "dsa", "ecdsa"}).([]string)
-	pathTpl := p.Get("path", "/etc/ssh/ssh_host_%s_key").(string)
+	pathTpl := p.Get("path", "/var/run/secrets/deis/builder/ssh/ssh-host-%s-key").(string)
 	hostKeys := make([]ssh.Signer, 0, len(hostKeyTypes))
 	for _, t := range hostKeyTypes {
 		path := fmt.Sprintf(pathTpl, t)
@@ -45,17 +44,6 @@ func ParseHostKeys(c cookoo.Context, p *cookoo.Params) (interface{}, cookoo.Inte
 			}
 		}
 	}
-	if c.Get("enableV1", false).(bool) {
-		path := "/etc/ssh/ssh_host_key"
-		if key, err := ioutil.ReadFile(path); err != nil {
-			log.Errf(c, "Failed to read ssh_host_key")
-		} else if hk, err := ssh.ParsePrivateKey(key); err == nil {
-			log.Infof(c, "Parsed host key %s.", path)
-			hostKeys = append(hostKeys, hk)
-		} else {
-			log.Errf(c, "Failed to parse host key %s: %s", path, err)
-		}
-	}
 	return hostKeys, nil
 }
 
@@ -115,15 +103,3 @@ func Configure(c cookoo.Context, p *cookoo.Params) (interface{}, cookoo.Interrup
 
 	return cfg, nil
 }
-
-// GenSSHKeys generates the default set of SSH host keys.
-func GenSSHKeys(c cookoo.Context, p *cookoo.Params) (interface{}, cookoo.Interrupt) {
-	log.Debugf(c, "Generating ssh keys for sshd")
-	// Generate a new key
-	out, err := exec.Command("ssh-keygen", "-A").CombinedOutput()
-	if err != nil {
-		log.Infof(c, "ssh-keygen: %s", out)
-		return nil, err
-	}
-	return nil, nil
-}

rootfs/etc/ssh/sshd_config

@@ -1,8 +1,8 @@
 Port 2223
 Protocol 2
-HostKey /etc/ssh/ssh_host_rsa_key
-HostKey /etc/ssh/ssh_host_dsa_key
-HostKey /etc/ssh/ssh_host_ecdsa_key
+HostKey /var/run/secrets/deis/builder/ssh/ssh-host-rsa-key
+HostKey /var/run/secrets/deis/builder/ssh/ssh-host-dsa-key
+HostKey /var/run/secrets/deis/builder/ssh/ssh-host-ecdsa-key
 UsePrivilegeSeparation yes
 KeyRegenerationInterval 3600
 ServerKeyBits 768