linux-image-manager 2.3.0__tar.gz → 2.4.0__tar.gz

{linux_image_manager-2.3.0 → linux_image_manager-2.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: linux-image-manager
-Version: 2.3.0
+Version: 2.4.0
 Summary: CLI (`lim`) for downloading, verifying and flashing Linux images, LUKS/Btrfs encrypted storage (single drive and RAID1), image backups and chroot maintenance
 Author-email: Kevin Veen-Birkenbach <kevin@veen.world>
 Maintainer-email: Kevin Veen-Birkenbach <kevin@veen.world>

{linux_image_manager-2.3.0 → linux_image_manager-2.4.0}/lim/configuration/packages/server/luks.txt

@@ -6,3 +6,4 @@ dropbear
 mkinitcpio-utils
 mkinitcpio-netconf
 mkinitcpio-dropbear
+openssh

linux_image_manager-2.4.0/lim/image/hostkeys.py

@@ -0,0 +1,77 @@
+import os
+import pwd
+import re
+from pathlib import Path
+
+KNOWN_HOSTS_SUBPATH = ".config/lim/known_hosts"
+SSH_CONFIG_SUBPATH = ".ssh/config"
+
+
+def host_key_alias(name: str) -> str:
+    return f"boot.{name}"
+
+
+def known_hosts_path(home: Path) -> Path:
+    return home / KNOWN_HOSTS_SUBPATH
+
+
+def replace_known_hosts(text: str, alias: str, public_keys: list[str]) -> str:
+    kept = [line for line in text.splitlines() if line.split(" ", 1)[0] != alias]
+    pinned = [f"{alias} {' '.join(key.split()[:2])}" for key in public_keys]
+    return "\n".join([*kept, *pinned]) + "\n"
+
+
+def replace_config_block(text: str, alias: str, block: str) -> str:
+    begin, end = f"# lim:{alias}:begin", f"# lim:{alias}:end"
+    pattern = rf"^{re.escape(begin)}\n.*?^{re.escape(end)}\n?"
+    kept = re.sub(pattern, "", text, flags=re.MULTILINE | re.DOTALL)
+    if kept and not kept.endswith("\n"):
+        kept += "\n"
+    return f"{kept}{begin}\n{block}{end}\n"
+
+
+def config_block(alias: str, target: str, identity_file: str, known_hosts: Path) -> str:
+    lines = [
+        f"Host {alias}",
+        f"  HostName {target}",
+        "  User root",
+        f"  HostKeyAlias {alias}",
+        f"  UserKnownHostsFile {known_hosts}",
+        "  StrictHostKeyChecking yes",
+    ]
+    if identity_file:
+        lines.append(f"  IdentityFile {identity_file}")
+    return "\n".join(lines) + "\n"
+
+
+def _write_owned(path: Path, text: str, owner: pwd.struct_passwd) -> None:
+    path.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
+    path.write_text(text)
+    path.chmod(0o600)
+    for entry in (path, path.parent):
+        os.chown(entry, owner.pw_uid, owner.pw_gid)
+
+
+def pin(
+    owner: pwd.struct_passwd, name: str, target: str, identity_file: str, public_keys: list[str]
+) -> str:
+    """Write the pinned keys and a ``Host boot.<name>`` ssh config block; return the alias.
+
+    Args:
+        owner: passwd entry of the operator whose home receives the files.
+        name: unlock record name; the alias becomes ``boot.<name>``.
+        target: onion address or host/IP the initramfs answers on.
+        identity_file: private key path for the unlock, empty for ssh defaults.
+        public_keys: OpenSSH ``type base64 [comment]`` lines the initramfs serves.
+
+    """
+    home = Path(owner.pw_dir)
+    alias = host_key_alias(name)
+    known_hosts = known_hosts_path(home)
+    current = known_hosts.read_text() if known_hosts.is_file() else ""
+    _write_owned(known_hosts, replace_known_hosts(current, alias, public_keys), owner)
+    ssh_config = home / SSH_CONFIG_SUBPATH
+    current = ssh_config.read_text() if ssh_config.is_file() else ""
+    block = config_block(alias, target, identity_file, known_hosts)
+    _write_owned(ssh_config, replace_config_block(current, alias, block), owner)
+    return alias

{linux_image_manager-2.3.0 → linux_image_manager-2.4.0}/lim/image/initramfs/base.py

@@ -40,3 +40,7 @@ class InitramfsBackend(ABC):
     @abstractmethod
     def configure_bootloader(self, plan: ImagePlan, session: ImageSession, root: Path) -> None:
         """Point the bootloader at the encrypted root with early networking."""
+
+    @abstractmethod
+    def host_public_keys(self, root: Path) -> list[str]:
+        """OpenSSH public key lines of the host keys baked into the initramfs."""

{linux_image_manager-2.3.0 → linux_image_manager-2.4.0}/lim/image/initramfs/initramfs_tools.py

@@ -22,6 +22,7 @@ from lim.image.session import ImageSession, chroot_bash, install_packages
 
 # Numeric IP, not a hostname: the initramfs has no DNS resolver.
 _DEFAULT_NTP = "162.159.200.123"
+_DROPBEAR_KEY_DIRS = ("etc/dropbear/initramfs", "etc/dropbear-initramfs")
 
 
 class InitramfsToolsBackend(InitramfsBackend):
@@ -115,3 +116,21 @@ class InitramfsToolsBackend(InitramfsBackend):
             text = f"{text} tor_ntp={_DEFAULT_NTP}"
         cmdline_txt.write_text(text + "\n")
         ui.info(f"Content of {cmdline_txt}:{cmdline_txt.read_text()}")
+
+    def host_public_keys(self, root: Path) -> list[str]:
+        key_paths = [
+            f"{key_dir}/dropbear_{kind}_host_key"
+            for key_dir in _DROPBEAR_KEY_DIRS
+            for kind in ("ed25519", "ecdsa", "rsa")
+        ]
+        printed = [
+            runner.output(["chroot", str(root), "dropbearkey", "-y", "-f", f"/{path}"], sudo=True)
+            for path in key_paths
+            if (root / path).is_file()
+        ]
+        return [
+            line
+            for text in printed
+            for line in text.splitlines()
+            if line.startswith(("ssh-", "ecdsa-"))
+        ]

{linux_image_manager-2.3.0 → linux_image_manager-2.4.0}/lim/image/initramfs/mkinitcpio.py

@@ -16,6 +16,7 @@ MKINITCPIO_HOOKS_PREFIX = (
     "base udev autodetect microcode modconf kms keyboard keymap consolefont block"
 )
 MKINITCPIO_HOOKS_SUFFIX = "filesystems fsck"
+DROPBEAR_KEY_TYPES = ("ecdsa", "rsa")
 
 
 class MkinitcpioBackend(InitramfsBackend):
@@ -80,7 +81,11 @@ class MkinitcpioBackend(InitramfsBackend):
         )
         ui.info(f"Content of {mkinitcpio_path}:{mkinitcpio_path.read_text()}")
         ui.info("Generating mkinitcpio...")
-        chroot_bash(root, "mkinitcpio -vP")
+        chroot_bash(root, "ssh-keygen -A\nmkinitcpio -vP")
+
+    def host_public_keys(self, root: Path) -> list[str]:
+        paths = (root / f"etc/ssh/ssh_host_{kind}_key.pub" for kind in DROPBEAR_KEY_TYPES)
+        return [path.read_text().strip() for path in paths if path.is_file()]
 
     def configure_bootloader(self, plan: ImagePlan, session: ImageSession, root: Path) -> None:
         cryptdevice = (

{linux_image_manager-2.3.0 → linux_image_manager-2.4.0}/lim/image/unlock.py

@@ -11,6 +11,7 @@ from pathlib import Path
 
 from lim import runner, ui
 from lim.errors import LimError
+from lim.image import hostkeys
 
 RECORDS_SUBPATH = ".config/lim/unlocks"
 
@@ -19,13 +20,17 @@ def records_dir(home: Path | None = None) -> Path:
     return (home or Path.home()) / RECORDS_SUBPATH
 
 
-def build_unlock_argv(target: str, key: str, unlock_command: str) -> list[str]:
-    """SSH invocation for the unlock; torsocks-wrapped for .onion targets.
-
-    The initramfs dropbear key differs from the booted host key, so host-key
-    checking is disabled; a v3 onion address authenticates the endpoint itself.
-    """
-    ssh = ["ssh", "-o", "StrictHostKeyChecking=no", "-o", "UserKnownHostsFile=/dev/null"]
+def build_unlock_argv(target: str, key: str, unlock_command: str, alias: str) -> list[str]:
+    """SSH invocation for the unlock; torsocks-wrapped for .onion targets."""
+    ssh = [
+        "ssh",
+        "-o",
+        f"HostKeyAlias={alias}",
+        "-o",
+        f"UserKnownHostsFile={hostkeys.known_hosts_path(Path.home())}",
+        "-o",
+        "StrictHostKeyChecking=ask",
+    ]
     if key:
         ssh += ["-i", str(Path(key).expanduser())]
     if unlock_command:
@@ -66,7 +71,7 @@ def _load_records() -> list[tuple[str, dict]]:
     return [(name, record) for name, record in loaded if record is not None]
 
 
-def _select_record() -> dict | None:
+def _select_record() -> tuple[str, dict] | None:
     records = _load_records()
     if not records:
         return None
@@ -75,13 +80,14 @@ def _select_record() -> dict | None:
         ui.info(f"  {index}) {name} -> {record.get('target')}")
     answer = ui.ask("Pick a number, or Enter for manual entry:")
     if answer.isdigit() and 1 <= int(answer) <= len(records):
-        return records[int(answer) - 1][1]
+        return records[int(answer) - 1]
     return None
 
 
 def remote_unlock() -> None:
-    record = _select_record()
-    if record:
+    selected = _select_record()
+    if selected:
+        name, record = selected
         target = record["target"]
         key = record.get("key", "")
         unlock_command = record.get("unlock_command", "")
@@ -89,6 +95,7 @@ def remote_unlock() -> None:
         target = ui.ask("Onion address or host/IP to unlock:")
         if not target:
             raise LimError("No target given.")
+        name = target
         key = ui.ask("Path to the SSH private key (empty for ssh defaults):")
         unlock_command = (
             "cryptroot-unlock"
@@ -97,4 +104,6 @@ def remote_unlock() -> None:
         )
     if target.endswith(".onion"):
         ui.info("Routing through Tor (torsocks); a local tor must be running.")
-    runner.run(build_unlock_argv(target, key, unlock_command), check=False)
+    alias = hostkeys.host_key_alias(name)
+    hostkeys.known_hosts_path(Path.home()).parent.mkdir(mode=0o700, parents=True, exist_ok=True)
+    runner.run(build_unlock_argv(target, key, unlock_command, alias), check=False)

{linux_image_manager-2.3.0 → linux_image_manager-2.4.0}/lim/image/wizard.py

@@ -17,8 +17,9 @@ from pathlib import Path
 from lim import device as device_module
 from lim import ui
 from lim.errors import LimError
-from lim.image import choosers, crossarch, transfer, unlock
+from lim.image import choosers, crossarch, hostkeys, transfer, unlock
 from lim.image.encryption import configure_encryption
+from lim.image.initramfs import get_backend
 from lim.image.plan import ImagePlan
 from lim.image.session import ImageSession, chroot_bash
 
@@ -140,12 +141,31 @@ chown -R "$target:$target" "/home/$target/.ssh"
     chroot_bash(session.root_mount_path, script)
 
 
+def _record_name(hostname: str) -> str:
+    return hostname or "device"
+
+
+def _pin_host_keys(
+    entry: pwd.struct_passwd, name: str, target: str, private_key: str, host_keys: list[str]
+) -> None:
+    if not host_keys:
+        ui.warning("No initramfs host key found; the first unlock asks to confirm it.")
+        return
+    try:
+        alias = hostkeys.pin(entry, name, target, private_key, host_keys)
+    except OSError as exc:
+        ui.warning(f"Could not pin the initramfs host key: {exc}")
+        return
+    ui.info(f"Pinned the initramfs host key as {alias} in ~/{hostkeys.SSH_CONFIG_SUBPATH}.")
+
+
 def _save_unlock_record(
-    plan: ImagePlan, host_user: str, hostname: str, onion: str | None, pubkey: Path
+    plan: ImagePlan, answers: _Answers, hostname: str, onion: str | None, host_keys: list[str]
 ) -> None:
     if not onion:
         return
-    private_key = str(pubkey).removesuffix(".pub")
+    name = _record_name(hostname)
+    private_key = str(answers.pubkey).removesuffix(".pub")
     unlock_command = "" if plan.distribution in ("arch", "manjaro") else "cryptroot-unlock"
     record = {
         "target": onion,
@@ -153,22 +173,22 @@ def _save_unlock_record(
         "unlock_command": unlock_command,
         "hostname": hostname,
     }
-    entry = pwd.getpwnam(host_user)
+    entry = pwd.getpwnam(answers.host_user)
     try:
-        unlock.save_record(
-            Path(entry.pw_dir), entry.pw_uid, entry.pw_gid, hostname or "device", record
-        )
+        unlock.save_record(Path(entry.pw_dir), entry.pw_uid, entry.pw_gid, name, record)
         ui.info("Saved unlock target; run later with: lim --type remote-unlock")
     except OSError as exc:
         ui.warning(f"Could not save unlock record: {exc}")
+    _pin_host_keys(entry, name, onion, private_key, host_keys)
 
 
 def _print_summary(answers: _Answers, hostname: str, onion: str | None) -> None:
     ui.success("Encrypted Linux image is ready.")
     ui.info(f"Target device : {answers.device.path}  (hostname: {hostname})")
     if onion:
+        alias = hostkeys.host_key_alias(_record_name(hostname))
         ui.info(f"Onion address : {onion}")
-        ui.info(f"Unlock later  : lim --type remote-unlock   (or: torsocks ssh root@{onion})")
+        ui.info(f"Unlock later  : lim --type remote-unlock   (or: torsocks ssh {alias})")
     ui.info(f"After unlock, log in: ssh {answers.login_user}@<the box>")
     ui.info("Golden image? Clone this device onto the SSD, then grow it:")
     ui.info("  parted <ssd> resizepart 2 100% && cryptsetup resize <mapper> && resize2fs <mapper>")
@@ -187,8 +207,9 @@ def _execute(plan: ImagePlan, answers: _Answers) -> None:
         session.mount_chroot_binds()
         session.copy_resolv_conf()
         onion = configure_encryption(plan, session, authorized_keys)
+        host_keys = get_backend(plan.distribution).host_public_keys(session.root_mount_path)
         _configure_login_user(session, answers.login_user, answers.login_password, answers.pubkey)
-        _save_unlock_record(plan, answers.host_user, hostname, onion, answers.pubkey)
+        _save_unlock_record(plan, answers, hostname, onion, host_keys)
         _print_summary(answers, hostname, onion)
     finally:
         if authorized_keys is not None:

{linux_image_manager-2.3.0 → linux_image_manager-2.4.0}/linux_image_manager.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: linux-image-manager
-Version: 2.3.0
+Version: 2.4.0
 Summary: CLI (`lim`) for downloading, verifying and flashing Linux images, LUKS/Btrfs encrypted storage (single drive and RAID1), image backups and chroot maintenance
 Author-email: Kevin Veen-Birkenbach <kevin@veen.world>
 Maintainer-email: Kevin Veen-Birkenbach <kevin@veen.world>

{linux_image_manager-2.3.0 → linux_image_manager-2.4.0}/linux_image_manager.egg-info/SOURCES.txt

@@ -35,6 +35,7 @@ lim/image/choosers.py
 lim/image/chroot.py
 lim/image/crossarch.py
 lim/image/encryption.py
+lim/image/hostkeys.py
 lim/image/loopimg.py
 lim/image/plan.py
 lim/image/raspberry.py

{linux_image_manager-2.3.0 → linux_image_manager-2.4.0}/pyproject.toml

@@ -5,7 +5,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "linux-image-manager"
-version = "2.3.0"
+version = "2.4.0"
 description = "CLI (`lim`) for downloading, verifying and flashing Linux images, LUKS/Btrfs encrypted storage (single drive and RAID1), image backups and chroot maintenance"
 readme = "README.md"
 requires-python = ">=3.10"