auto generate additional ssh keys #33974
Conversation
this allows storing different keys
GiteaBot
added
the
lgtm/need 2
rework keygen to guess the keysize from extension
make key generation happen in generation module
github-actions
bot
added
the
modifies/cli
| if err != nil { | ||
| return err | ||
| } | ||
| f, err := os.OpenFile(file, os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0o600) |
There was a problem hiding this comment.
Should it avoid overwriting existing file?
/tmp$ ssh-keygen -t ecdsa -f a
Generating public/private ecdsa key pair.
a already exists.
Overwrite (y/n)?
There was a problem hiding this comment.
It would be a good idea, I'll try to figure out how to do it.
Would comments also be a good idea to include?
modules/ssh/ssh.go
Outdated
| err := GenKeyPair(setting.SSH.ServerHostKeys[0]) | ||
| if err != nil { | ||
| log.Fatal("Failed to generate private key: %v", err) | ||
| for i := range 3 { |
There was a problem hiding this comment.
Why 3? Why generates all files?
There was a problem hiding this comment.
For new default settings and parity with default (rootful) container keys. I'd like to drop it for something better though.
There was a problem hiding this comment.
Swapped it for mirroring ssh-keygen -A behavior to a degree. If no keys were added we generate all 3 and load them instead.
I think it would be better to move it out of if so it always runs as it is a noop if all 6 files exist - only downside is that it sources the default directory from config so if a user for some reason restarts the server with ssh1/gitea.rsa new keys would be generated which is not ideal.
TheFox0x7
force-pushed
the
generate-additional-ssh-keys
branch
from
0372c4b to
61f4962
Compare
adds capabilities for gitea to generate ecdsa and ed25519 keys by default
adds cli for built-in ssh keygen
closes: #33783
Since we already generate RSA key in rootless by default, I see no reason to add keygen in there. Instead we can add more keygen capabilities to internal ssh server.
The only remaining question is how to expose this to end user?
One option I see is to extend ServerHostKeys to
["gitea.rsa","gitea.ecdsa","gitea.ed25519","gogs.rsa"]but I'm not sure if it's a correct way.