slaprunner: uses sshkeys_authority recipe to manage openssh keys, otherwise...

slaprunner: uses sshkeys_authority recipe to manage openssh keys, otherwise they may change at any slapos run

software/slaprunner/common.cfg

@@ -86,7 +86,7 @@ mode = 0644
 recipe = slapos.recipe.template
 url = ${:_profile_base_location_}/instance-runner-export.cfg.in
 output = ${buildout:directory}/instance-runner-export.cfg
-md5sum = 2a962c3256d7d5ba31a4ffe7650a80f5
+md5sum = a898117fe5b001747ef6a273fd03b42c
 mode = 0644
 
 [template-resilient]

software/slaprunner/instance-runner-export.cfg.in

@@ -16,6 +16,8 @@ parts +=
   runner-sshd-add-authorized-key
   runner-sshd-graceful
   runner-sshd-promise
+  runner-sshkeys-authority
+  runner-sshkeys-sshd
   runtestsuite
   symlinks
   shellinabox
@@ -29,7 +31,6 @@ parts +=
   supervisord-wrapper
   supervisord-promise
   httpd-graceful-wrapper
-  runner-sshd
 ## Monitoring part
 ## Monitor for runner
   monitor-base

software/slaprunner/instance-runner-import.cfg.in

@@ -11,10 +11,11 @@ parts +=
   gunicorn-graceful
   slaprunner-promise
   slaprunner-supervisord-wrapper
-  runner-sshd
   runner-sshd-add-authorized-key
   runner-sshd-graceful
   runner-sshd-promise
+  runner-sshkeys-authority
+  runner-sshkeys-sshd
   runtestsuite
   shellinabox
   symlinks

software/slaprunner/instance-runner.cfg

@@ -10,10 +10,11 @@ parts =
   slaprunner-promise
   apache-httpd-promise
   slaprunner-supervisord-wrapper
-  runner-sshd
   runner-sshd-add-authorized-key
   runner-sshd-graceful
   runner-sshd-promise
+  runner-sshkeys-authority
+  runner-sshkeys-sshd
   runtestsuite
   symlinks
   shellinabox
@@ -134,8 +135,8 @@ project-directory = $${runnerdirectory:project}
 instance_root = $${runnerdirectory:instance-root}
 software_root = $${runnerdirectory:software-root}
 ssh_client = ${openssh:location}/bin/ssh
-public_key = $${runner-sshd-key-authority:location}.pub
-private_key = $${runner-sshd-key-authority:location}
+public_key = $${runner-sshd-raw-server:rsa-keyfile}.pub
+private_key = $${runner-sshd-raw-server:rsa-keyfile}
 instance-monitor-url = https://[$${:ipv6}]:$${monitor-parameters:port}
 etc_dir = $${directory:etc}
 log_dir =  $${directory:log}
@@ -199,11 +200,6 @@ wrapper-path = $${directory:bin}/runTestSuite
 environment = RUNNER_CONFIG=$${slapos-cfg:rendered}
 
 # Deploy openssh-server
-[runner-sshd-key-authority]
-recipe = plone.recipe.command
-location = $${directory:sshkeys}/ssh_host_rsa_key
-command = if [ ! -f "$${:location}" ]; then ${openssh:location}/bin/ssh-keygen -t rsa -b 4096 -f "$${:location}" -N '' -C ''; fi
-
 [runner-sshd-port]
 recipe = slapos.cookbook:free_port
 minimum = 22222
@@ -220,22 +216,61 @@ template = inline:
   ListenAddress $${slap-network-information:global-ipv6}
   Protocol 2
   UsePrivilegeSeparation no
-  HostKey $${runner-sshd-key-authority:location}
+  HostKey $${directory:ssh}/server_key.rsa
   PasswordAuthentication no
   PubkeyAuthentication yes
   AuthorizedKeysFile $${buildout:directory}/.ssh/authorized_keys
   ForceCommand if [ -z "$SSH_ORIGINAL_COMMAND" ]; then ${bash:location}/bin/bash -l; else $SSH_ORIGINAL_COMMAND; fi
 
-[runner-sshd]
+[runner-sshd-raw-server]
 recipe = slapos.cookbook:wrapper
+host = $${slap-network-information:global-ipv6}
+rsa-keyfile = $${directory:ssh}/server_key.rsa
+home = $${directory:ssh}
 command-line = ${openssh:location}/sbin/sshd -D -e -f $${runner-sshd-config:rendered}
-wrapper-path = $${directory:services}/runner-sshd
+wrapper-path = $${directory:bin}/runner_raw_sshd
+
+[runner-sshd-authorized-key]
+<= runner-sshd-raw-server
+recipe = slapos.cookbook:dropbear.add_authorized_key
+key = $${slap-parameter:user-authorized-key}
+
+[runner-sshd-server]
+recipe = collective.recipe.template
+log = $${basedirectory:log}/runner-sshd.log
+input = inline:#!/bin/sh
+    exec $${runner-sshd-raw-server:wrapper-path} >> $${:log} 2>&1
+
+output = $${rootdirectory:bin}/runner_raw_sshd_log
+mode = 700
 
 [runner-sshd-graceful]
 recipe = slapos.cookbook:wrapper
 command-line = $${directory:bin}/killpidfromfile $${runner-sshd-config:path_pid} SIGHUP
 wrapper-path = $${directory:scripts}/runner-sshd-graceful
 
+[sshkeys-directory]
+recipe = slapos.cookbook:mkdirectory
+requests = $${directory:sshkeys}/requests/
+keys = $${directory:sshkeys}/keys/
+
+[runner-sshkeys-authority]
+recipe = slapos.cookbook:sshkeys_authority
+request-directory = $${sshkeys-directory:requests}
+keys-directory = $${sshkeys-directory:keys}
+wrapper = $${directory:services}/sshkeys_authority
+keygen-binary = ${openssh:location}/bin/ssh-keygen
+
+[runner-sshkeys-sshd]
+<= runner-sshkeys-authority
+recipe = slapos.cookbook:sshkeys_authority.request
+name = dropbear
+type = rsa
+executable = $${runner-sshd-server:output}
+public-key = $${runner-sshd-raw-server:rsa-keyfile}.pub
+private-key = $${runner-sshd-raw-server:rsa-keyfile}
+wrapper = $${directory:services}/runner-sshd
+
 [runner-sshd-add-authorized-key]
 recipe = slapos.cookbook:dropbear.add_authorized_key
 home = $${buildout:directory}