@@ -178,18 +178,28 @@ into the image. However, there are two problems with this:
178
178
format.
179
179
180
180
To create dedicated host keys in the proper format, decide on a location, for example ``/etc/dropbear ``, and create the
181
- new keys::
181
+ new keys:
182
182
183
- mkdir -p /etc/dropbear
184
- for keytype in rsa ecdsa ed25519; do
185
- dropbearkey -t "${keytype}" -f "/etc/dropbear/dropbear_${keytype}_host_key"
186
- done
183
+ .. tabs ::
187
184
188
- .. note ::
189
- The dracut module expects to install RSA and ECDSA keys, so at minimum those keys should be created.
190
- The mkinitcpio module supports RSA, ECDSA, and ED25519 keys.
185
+ .. group-tab :: Dracut
186
+
187
+ The dracut module expects to install RSA and ECDSA keys, so at minimum those keys should be created
188
+ We're making keys in PEM format because the dracut module insists on converting keys each time and doesn't accept keys in dropbear format::
189
+
190
+ mkdir -p /etc/dropbear
191
+ for keytype in rsa ecdsa ed25519; do
192
+ ssh-keygen -g -N "" -m PEM -t "${keytype}" -f "/etc/dropbear/ssh_dracut_host_${keytype}_key"
193
+ done
194
+
195
+ .. group-tab :: mkinitcpio
191
196
192
- Not all versions of ``dropbear `` support ED25519 keys, so it is fine if the ED25519 key fails to generate.
197
+ The mkinitcpio module supports RSA, ECDSA, and ED25519 keys::
198
+
199
+ mkdir -p /etc/dropbear
200
+ for keytype in rsa ecdsa ed25519; do
201
+ dropbearkey -t "${keytype}" -f "/etc/dropbear/dropbear_${keytype}_host_key"
202
+ done
193
203
194
204
The Dracut and mkinitcpio dropbear modules do not allow for password authentication over SSH; instead key-based
195
205
authentication is forced. The authorized keys for dropbear can be configured by putting an `authorized_keys file
@@ -208,9 +218,9 @@ realized by symlinking your user's ``authorized_keys`` file::
208
218
# Enable dropbear ssh server and pull in network configuration args
209
219
add_dracutmodules+=" crypt-ssh "
210
220
install_optional_items+=" /etc/cmdline.d/dracut-network.conf "
211
- # Copy system keys for consistent access
212
- dropbear_rsa_key=/etc/dropbear/ssh_host_rsa_key
213
- dropbear_ecdsa_key=/etc/dropbear/ssh_host_ecdsa_key
221
+ # Point to host keys made earlier
222
+ dropbear_rsa_key=/etc/dropbear/ssh_dracut_host_rsa_key
223
+ dropbear_ecdsa_key=/etc/dropbear/ssh_dracut_host_ecdsa_key
214
224
dropbear_acl=/etc/dropbear/root_key
215
225
216
226
.. note ::
@@ -309,4 +319,4 @@ local instance to show the interactive menu immediately.
309
319
310
320
rm /zfsbootmenu/active
311
321
312
- to eliminate the indicator of the other running instance. You may then run ``zfsbootmenu `` again to launch the menu.
322
+ to eliminate the indicator of the other running instance. You may then run ``zfsbootmenu `` again to launch the menu.
0 commit comments