mirror of
https://github.com/openglow-org/forgefirm.git
synced 2026-09-27 08:41:13 -07:00
ScottW514
97287aa6a9
meta-forgefirm: the forgefirm-users init replays the account at boot; sshd refuses root and empty passwords and runs only while the panel turns it on; the release image keeps an empty root password for the console; the console banner; avahi announces forgefirm.local; https in libmicrohttpd and ulfius; the panel on 80 and 443; the license bundle on the rootfs; release.sh checks the root policy on the built rootfs. forgetest: the commission suites (commission, commission_dark, commission_sheet: 23 cases); the runner turns cloud mode on with the typed phrase for a test that declares it; the baseline's motor_lock is 0; the log-export test checks the bundle for the camera key; the record helpers write bytes as given and join the daemon's paths as POSIX. The stream harness gains rule 24: a hold verdict is held again after a resume. Bench drills: lens_travel.py and lens_stop_accel.py. Docs: BRINGUP carries the present state; CAMPAIGN-LOG carries the dated record.
40 lines
1.9 KiB
Plaintext
40 lines
1.9 KiB
Plaintext
# ForgeFIRM SSH policy, set in the installed files so the release image
|
|
# carries it as built:
|
|
# PermitRootLogin no root logs in at the serial console only
|
|
# PermitEmptyPasswords no an account without a password cannot log in
|
|
# PasswordAuthentication yes operator accounts log in with a password
|
|
# The dev image's debug-tweaks turns PermitRootLogin and
|
|
# PermitEmptyPasswords back to yes at rootfs time (ssh_allow_root_login
|
|
# and ssh_allow_empty_password in rootfs-postcommands.bbclass match the
|
|
# active lines too), so the bench keeps root over SSH.
|
|
#
|
|
# The init script starts sshd only when the control panel has turned it
|
|
# on (/run/forgefirm/ssh-enabled, tmpfs, gone at reboot) or on the dev
|
|
# image (/etc/forgefirm-dev). The guard sits in check_for_no_start, which
|
|
# start, reload and restart call; stop is never gated.
|
|
|
|
do_install:append() {
|
|
for config in sshd_config sshd_config_readonly; do
|
|
f=${D}${sysconfdir}/ssh/$config
|
|
[ -e "$f" ] || continue
|
|
sed -i \
|
|
-e 's/^[#[:space:]]*PermitRootLogin .*/PermitRootLogin no/' \
|
|
-e 's/^[#[:space:]]*PermitEmptyPasswords .*/PermitEmptyPasswords no/' \
|
|
-e 's/^[#[:space:]]*PasswordAuthentication .*/PasswordAuthentication yes/' \
|
|
"$f"
|
|
grep -q '^PermitRootLogin no$' "$f" \
|
|
&& grep -q '^PermitEmptyPasswords no$' "$f" \
|
|
&& grep -q '^PasswordAuthentication yes$' "$f" \
|
|
|| bbfatal "$config: the ForgeFIRM policy lines did not land"
|
|
done
|
|
|
|
init=${D}${sysconfdir}/init.d/sshd
|
|
sed -i '/^check_for_no_start() {$/a\
|
|
[ -e /run/forgefirm/ssh-enabled ] || [ -e /etc/forgefirm-dev ] || {\
|
|
echo "sshd: not enabled (turn it on from the ForgeFIRM control panel)"\
|
|
exit 0\
|
|
}' "$init"
|
|
grep -q 'forgefirm/ssh-enabled' "$init" \
|
|
|| bbfatal "init.d/sshd: the check_for_no_start anchor was not found"
|
|
}
|