5

This is mostly aimed at Debian/Ubuntu, but I feel savvy enough on a variety of distros to be able to adapt the solution for one distro to another.

Here's my scenario. There are a few situations when the boot process will drop you to the shell (usually busybox) of the initrd. Most notably whenever you run a hardware RAID for which drivers have to be rebuilt for each and every new kernel revision. I'd like to be able to access the rescue system the same way as I would access the fully booted system.

I reckon it'd be possible to put static builds of the shell(s) and sshd (OpenSSH or dropbear) into the initrd and have been looking for an existing solution that I can adjust to my needs.

Assuming there is no existing solution (since I have searched for quite a while) what do I need to consider aside from using static builds where possible (or supply the libs)? Is it reasonable to simply cache a static build of dropbear and use /etc/initramfs-tools/hooks to embed that along with a "converted" OpenSSH sshd_config and the original host keys?

0xC0000022L
  • 16,189
  • 24
  • 102
  • 168
  • 2
    Assuming you could get OpenSSH to work you would still need a network stack. When you are dropped into the shell of initrd, no network setup has been done yet so you wouldn't have access anyway. – mtak Apr 16 '14 at 12:44
  • 1
    This one of the reasons (remotely managed) servers typically come with out-of-band management functionality, simple IPMI based serial console access, or more advanced keyboard, video and mouse (KVM) functionality like the Dell DRAC, HP's ILO, IBM's RSA etc. Many servers and some workstation mainboards support IPMI by default or require only a cheap and simple BMC add-on. – HBruijn Apr 16 '14 at 13:34
  • 1
    Dropbear is *very* reasonable in this case. But OpenSSH could do easily as well. Your solution needn't be statically linked, though it would probably be more practical. The quickest means to arrive at a solution might be simply extracting from the compressed archive your cpio image and then dumping it into an empty test folder to have a look around - it's only a linux root image. You can put whatever you want in it. I often chroot into a similarly prepared directory just to see what I could or couldn't do in initramfs if I liked. – mikeserv Apr 16 '14 at 14:21

1 Answers1

4

Ubuntu 16.04 contains a package called dropbear-initramfs which is supposed to provide this feature.

Lightweight SSH2 server and client - initramfs integration dropbear is a SSH 2 server and client designed to be small enough to be used in small memory environments, while still being functional and secure enough for general use.

It implements most required features of the SSH 2 protocol, and other features such as X11 and authentication agent forwarding.

This package provides initramfs integration.

The only items I needed to adjust in addition to installing said package where:

  1. Uncomment the commented out DROPBEAR=y inside /etc/initramfs-tools/conf-hooks.d/dropbear
  2. Convert my existing host keys (see below)
  3. Create and populate /etc/initramfs-tools/root/.ssh/authorized_keys. For this I opted to bind-mount /root/.ssh onto /etc/initramfs-tools/root/.ssh
  4. A final update-initramfs -u -k all re-created all the initrd images

To convert the keys I ran these commands:

/usr/lib/dropbear/dropbearconvert openssh dropbear /etc/ssh/ssh_host_rsa_key /etc/initramfs-tools/etc/dropbear/dropbear_rsa_host_key
/usr/lib/dropbear/dropbearconvert openssh dropbear /etc/ssh/ssh_host_dsa_key /etc/initramfs-tools/etc/dropbear/dropbear_dss_host_key
/usr/lib/dropbear/dropbearconvert openssh dropbear /etc/ssh/ssh_host_ecdsa_key /etc/initramfs-tools/etc/dropbear/dropbear_ecdsa_host_key

Note: the source and target file names differ. So don't make assumptions here. Also, /usr/lib/dropbear isn't in my PATH, so I needed to give the full path to execute dropbearconvert.

0xC0000022L
  • 16,189
  • 24
  • 102
  • 168