Skip to content

Commit 6b24aab

Browse files
committed
docs: dracut-crypt-ssh keys name and format fix
1 parent 54bbde2 commit 6b24aab

File tree

1 file changed

+23
-13
lines changed

1 file changed

+23
-13
lines changed

docs/general/remote-access.rst

Lines changed: 23 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -178,18 +178,28 @@ into the image. However, there are two problems with this:
178178
format.
179179

180180
To create dedicated host keys in the proper format, decide on a location, for example ``/etc/dropbear``, and create the
181-
new keys::
181+
new keys:
182182

183-
mkdir -p /etc/dropbear
184-
for keytype in rsa ecdsa ed25519; do
185-
dropbearkey -t "${keytype}" -f "/etc/dropbear/dropbear_${keytype}_host_key"
186-
done
183+
.. tabs::
187184

188-
.. note::
189-
The dracut module expects to install RSA and ECDSA keys, so at minimum those keys should be created.
190-
The mkinitcpio module supports RSA, ECDSA, and ED25519 keys.
185+
.. group-tab:: Dracut
186+
187+
The dracut module expects to install RSA and ECDSA keys, so at minimum those keys should be created
188+
We're making keys in PEM format because the dracut module insists on converting keys each time and doesn't accept keys in dropbear format::
189+
190+
mkdir -p /etc/dropbear
191+
for keytype in rsa ecdsa ed25519; do
192+
ssh-keygen -g -N "" -m PEM -t "${keytype}" -f "/etc/dropbear/ssh_dracut_host_${keytype}_key"
193+
done
194+
195+
.. group-tab:: mkinitcpio
191196

192-
Not all versions of ``dropbear`` support ED25519 keys, so it is fine if the ED25519 key fails to generate.
197+
The mkinitcpio module supports RSA, ECDSA, and ED25519 keys::
198+
199+
mkdir -p /etc/dropbear
200+
for keytype in rsa ecdsa ed25519; do
201+
dropbearkey -t "${keytype}" -f "/etc/dropbear/dropbear_${keytype}_host_key"
202+
done
193203

194204
The Dracut and mkinitcpio dropbear modules do not allow for password authentication over SSH; instead key-based
195205
authentication is forced. The authorized keys for dropbear can be configured by putting an `authorized_keys file
@@ -208,9 +218,9 @@ realized by symlinking your user's ``authorized_keys`` file::
208218
# Enable dropbear ssh server and pull in network configuration args
209219
add_dracutmodules+=" crypt-ssh "
210220
install_optional_items+=" /etc/cmdline.d/dracut-network.conf "
211-
# Copy system keys for consistent access
212-
dropbear_rsa_key=/etc/dropbear/ssh_host_rsa_key
213-
dropbear_ecdsa_key=/etc/dropbear/ssh_host_ecdsa_key
221+
# Point to host keys made earlier
222+
dropbear_rsa_key=/etc/dropbear/ssh_dracut_host_rsa_key
223+
dropbear_ecdsa_key=/etc/dropbear/ssh_dracut_host_ecdsa_key
214224
dropbear_acl=/etc/dropbear/root_key
215225

216226
.. note::
@@ -309,4 +319,4 @@ local instance to show the interactive menu immediately.
309319

310320
rm /zfsbootmenu/active
311321

312-
to eliminate the indicator of the other running instance. You may then run ``zfsbootmenu`` again to launch the menu.
322+
to eliminate the indicator of the other running instance. You may then run ``zfsbootmenu`` again to launch the menu.

0 commit comments

Comments
 (0)