dropbear: add ed25519 for failsafe key
authorEtienne Champetier <champetier.etienne@gmail.com>
Mon, 10 Jul 2023 05:56:05 +0000 (07:56 +0200)
committerHauke Mehrtens <hauke@hauke-m.de>
Sat, 12 Aug 2023 09:46:51 +0000 (11:46 +0200)
At least Fedora and RHEL 9 set RSAMinSize=2048, so when trying to use
failsafe, we get 'Bad server host key: Invalid key length'
To workaround the issue, we can use: ssh -o RSAMinSize=1024 ...

Generating 2048 bits RSA is extremely slow, so add ed25519.
We keep RSA 1024 to be as compatible as possible.

Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
(cherry picked from commit 6ac61dead99ff6b9df00c29b7a858772449718b2)

package/network/services/dropbear/files/dropbear.failsafe

index a98ede459adf0b0cac27ee35bf7d377acb481f4c..97bd12d58a18910807892c0fa4ce5b10b43c627d 100755 (executable)
@@ -1,8 +1,9 @@
 #!/bin/sh
 
 failsafe_dropbear () {
-       dropbearkey -t rsa -s 1024 -f /tmp/dropbear_failsafe_host_key
-       dropbear -r /tmp/dropbear_failsafe_host_key <> /dev/null 2>&1
+       dropbearkey -t rsa -s 1024 -f /tmp/dropbear_rsa_failsafe_host_key
+       dropbearkey -t ed25519 -f /tmp/dropbear_ed25519_failsafe_host_key
+       dropbear -r /tmp/dropbear_rsa_failsafe_host_key -r /tmp/dropbear_ed25519_failsafe_host_key <> /dev/null 2>&1
 }
 
 boot_hook_add failsafe failsafe_dropbear