feat: add support for configuring SSH2 HostKeys

.drone.yml

@@ -30,11 +30,6 @@ services:
     volumes:
       - name: dockersock
         path: /var/run
-    command:
-    - dockerd-entrypoint.sh
-    - dockerd
-    - --host=unix:///var/run/docker.sock
-    - --mtu=1492
 
 volumes:
   - name: dockersock
@@ -73,11 +68,6 @@ services:
     volumes:
       - name: dockersock
         path: /var/run
-    command:
-    - dockerd-entrypoint.sh
-    - dockerd
-    - --host=unix:///var/run/docker.sock
-    - --mtu=1492
 
 volumes:
   - name: dockersock

Dockerfile

@@ -1,32 +1,19 @@
 FROM debian:bookworm-slim
 
-RUN set -eux && \
-    apt-get update && \
-    DEBIAN_FRONTEND=noninteractive apt-get upgrade -y && \
+RUN set -eux; \
+    apt-get update; \
+    DEBIAN_FRONTEND=noninteractive apt-get upgrade -y; \
     DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
         openssh-server \
-        sudo \
-        locales \
         curl \
         telnet \
         net-tools \
         screen \
-        vim \
-        git \
-        man \
-        less \
-        bind9-dnsutils \
-        unzip \
-        rsync \
-    && \
-    rm -rf /var/lib/apt/lists/* && \
-    rm /etc/ssh/ssh_host_*key* && \
-    echo 'en_US.UTF-8 UTF-8' >> /etc/locale.gen && \
-    /usr/sbin/locale-gen && \
-    /usr/sbin/update-locale 'LANG=en_US.UTF-8'
+    ; \
+    rm -rf /var/lib/apt/lists/* \
+    rm /etc/ssh/ssh_host_*key*
 
 ADD start.sh /
-ADD setup.sh /
 
 EXPOSE 22/tcp
 

README.md

@@ -15,8 +15,8 @@
 | Key | Format | Description |
 | --- | --- | --- |
 | `ROOT_AUTHORIZED_KEYS` | `/path/to/file` | Path to file that contains the public SSH keys that can be used for root user authentication. This file will be copied to `/root/.ssh/authorized_keys` |
-| `HOSTKEYS` | `/path/to/hostkey;...` | Specifies a (semi-colon separated list of) file(s) containing a private host key used by SSH. |
-| `USERADD` | `{username}:{uid}:{gid}:{shell};...` | Create user account(s) on startup |
+| `HOSTKEYS` | `/path/to/hostkey` | Specifies a (semi-colon separated list of) file(s) containing a private host key used by SSH. |
+| `USERADD` | `{username}:{uid}:{gid};...` | Create user account(s) on startup |
 | `GROUPADD` | `{groupname}:{gid};...` | Create group account(s) on startup |
 | `BASE_DIR` | `/home` | Basedir used for user account creation (Default: `/home`) |
 
@@ -28,7 +28,7 @@ $ docker run -it \
     -v $(pwd)/jumpbox:/var/lib/jumpbox \
     -e "ROOT_AUTHORIZED_KEYS=/var/lib/jumpbox/authorized_keys"
     -e "HOSTKEYS=/var/lib/jumpbox/ssh_host_ed25519_key;/var/lib/jumpbox/ssh_host_rsa_key"
-    -e "USERADD=jumpbox:1000:1000:/bin/bash"
+    -e "USERADD=jumpbox:1000:1000"
     -e "GROUPADD=jumpbox:1000"
     -p 1022:22 \
     pommib/jumpbox:latest
@@ -50,6 +50,6 @@ services:
     environment:
       ROOT_AUTHORIZED_KEYS: /var/lib/jumpbox/authorized_keys
       HOSTKEYS: /var/lib/jumpbox/ssh_host_ed25519_key;/var/lib/jumpbox/ssh_host_rsa_key
-      USERADD: jumpbox:1000:1000:/bin/bash
+      USERADD: jumpbox:1000:1000
       GROUPADD: jumpbox:1000
 ```

build.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 
-set -ex
+set -x
 
 IMAGE=pommib/jumpbox:latest
 docker pull $IMAGE

rebuild.sh

@@ -1,10 +1,8 @@
 #!/bin/sh
 
-set -x
-
 updates_available () {
     docker pull "$1"
-    if test "$(docker run --rm "$1" /bin/sh -c 'apt -qqq update && apt -qq list --upgradable')" != ""; then
+    if test "$(docker run -it --rm "$1" /bin/sh -c 'apt -qqq update && apt -qq list --upgradable')" != ""; then
         return 0
     else
         return 1

setup.sh

@@ -1,86 +0,0 @@
-#!/bin/sh
-set -ex
-
-if [ -n "$ROOT_AUTHORIZED_KEYS" ]; then
-    if [ -f "$ROOT_AUTHORIZED_KEYS" ]; then
-        mkdir -p /root/.ssh
-        cp "$ROOT_AUTHORIZED_KEYS" /root/.ssh/authorized_keys
-        chmod 600 /root/.ssh/authorized_keys
-    fi
-fi
-
-if [ -z "$BASE_DIR" ]; then
-    BASE_DIR="/home"
-fi
-
-if [ ! -d "$BASE_DIR" ]; then
-    echo "BASE_DIR $BASE_DIR does not exist, creating..."
-    mkdir -p $BASE_DIR
-fi
-
-# GROUPADD="group1:1000;group2:1001;group3:1002"
-i=""
-while [ "$GROUPADD" != "$i" ] ;do
-    i=${GROUPADD%%;*}
-    GROUPADD="${GROUPADD#$i;}"
-
-    GROUP_NAME=${i%%:*}
-    GROUP_GID="${i#$GROUP_NAME:}"
-
-    groupadd --gid "$GROUP_GID" "$GROUP_NAME"
-done
-
-# USERADD="user1:1000:1000:/bin/bash;user2:1001:1000:/bin/sh;user3:1002:1002:/bin/sh"
-i=""
-j=""
-while [ "$USERADD" != "$i" ] ;do
-    i=${USERADD%%;*}
-    USERADD="${USERADD#$i;}"
-
-    USER_NAME=${i%%:*}
-    j="${i#$USER_NAME:}"
-    USER_UID="${j%%:*}"
-    j="${j#$USER_UID:}"
-    USER_GID="${j%%:*}"
-    j="${j#$USER_GID:}"
-    USER_SHELL=$j
-
-    useradd --home-dir "$BASE_DIR/$USER_NAME" --shell "$USER_SHELL" --uid "$USER_UID" --gid "$USER_GID" "$USER_NAME"
-    echo "$USER_NAME ALL=(ALL) NOPASSWD:ALL" > "/etc/sudoers.d/$USER_NAME"
-done
-
-# HOSTKEYS="/var/lib/jumpbox/ssh_host_ed25519_key;/var/lib/jumpbox/ssh_host_rsa_key"
-i=""
-if [ -n "$HOSTKEYS" ]; then
-    while [ "$HOSTKEYS" != "$i" ]; do
-        i=${HOSTKEYS%%;*}
-        HOSTKEYS="${HOSTKEYS#$i;}"
-
-        if [ ! -e "$i" ]; then
-            echo "Could not read $i, file is missing"
-            continue
-        else
-            echo "Configuring HostKey $i"
-        fi
-
-        FILENAME=$(basename "$i")
-        if [ ! -e "/etc/ssh/$FILENAME" ]; then
-            install -m 0600 "$i" "/etc/ssh/$FILENAME"
-            ssh-keygen -y -f "$i" > "/etc/ssh/$FILENAME.pub"
-            ssh-keygen -l -f "/etc/ssh/$FILENAME.pub"
-        fi
-
-        if ! grep "^HostKey /etc/ssh/$FILENAME" /etc/ssh/sshd_config; then
-            echo "HostKey /etc/ssh/$FILENAME" >> /etc/ssh/sshd_config
-        fi
-    done
-fi
-
-if [ -z "$(find /etc/ssh/ -maxdepth 1 -name 'ssh_host_*_key' -print -quit)" ]; then
-    echo "Creating SSH2 ED25519 key; this may take some time ..."
-    ssh-keygen -q -f /etc/ssh/ssh_host_ed25519_key -N '' -t ed25519
-    ssh-keygen -l -f /etc/ssh/ssh_host_ed25519_key.pub
-    echo "HostKey /etc/ssh/ssh_host_ed25519_key" >> /etc/ssh/sshd_config
-fi
-
-touch /var/tmp/jumpbox.done

start.sh

@@ -1,10 +1,81 @@
 #!/bin/sh
+
 set -ex
 
 mkdir -p /run/sshd
 
-if [ ! -e "/var/tmp/jumpbox.done" ]; then
-    ./setup.sh
+if [ -n "$ROOT_AUTHORIZED_KEYS" ]; then
+    if [ -f "$ROOT_AUTHORIZED_KEYS" ]; then
+        mkdir -p /root/.ssh
+        cp "$ROOT_AUTHORIZED_KEYS" /root/.ssh/authorized_keys
+        chmod 600 /root/.ssh/authorized_keys
+    fi
+fi
+
+if [ -z "$BASE_DIR" ]; then
+    BASE_DIR="/home"
+fi
+
+if [ ! -d "$BASE_DIR" ]; then
+    echo "BASE_DIR $BASE_DIR does not exist, creating..."
+    mkdir -p $BASE_DIR
+fi
+
+# GROUPADD="group1:1000;group2:1001;group3:1002"
+while [ "$GROUPADD" != "$i" ] ;do
+    i=${GROUPADD%%;*}
+    GROUPADD="${GROUPADD#$i;}"
+
+    GROUP_NAME=${i%%:*}
+    GROUP_GID="${i#$GROUP_NAME:}"
+
+    groupadd --gid "$GROUP_GID" "$GROUP_NAME"
+done
+
+# USERADD="user1:1000:1000;user2:1001:1000;user3:1002:1002"
+while [ "$USERADD" != "$i" ] ;do
+    i=${USERADD%%;*}
+    USERADD="${USERADD#$i;}"
+
+    USER_NAME=${i%%:*}
+    UID_GID="${i#$USER_NAME:}"
+    USER_UID="${UID_GID%%:*}"
+    USER_GID="${UID_GID#$USER_UID:}"
+
+    useradd --home-dir "$BASE_DIR/$USER_NAME" --uid "$USER_UID" --gid "$USER_GID" "$USER_NAME"
+done
+
+# HOSTKEYS="/var/lib/jumpbox/ssh_host_ed25519_key;/var/lib/jumpbox/ssh_host_rsa_key"
+if [ -n "$HOSTKEYS" ]; then
+    while [ "$HOSTKEYS" != "$i" ]; do
+        i=${HOSTKEYS%%;*}
+        HOSTKEYS="${HOSTKEYS#$i;}"
+
+        if [ ! -e "$i" ]; then
+            echo "Could not read $i, file is missing"
+            continue
+        else
+            echo "Configuring HostKey $i"
+        fi
+
+        FILENAME=$(basename "$i")
+        if [ ! -e "/etc/ssh/$FILENAME" ]; then
+            install -m 0600 "$i" "/etc/ssh/$FILENAME"
+            ssh-keygen -y -f "$i" > "/etc/ssh/$FILENAME.pub"
+            ssh-keygen -l -f "/etc/ssh/$FILENAME.pub"
+        fi
+
+        if ! grep "^HostKey /etc/ssh/$FILENAME" /etc/ssh/sshd_config; then
+            echo "HostKey /etc/ssh/$FILENAME" >> /etc/ssh/sshd_config
+        fi
+    done
+fi
+
+if [ -z "$(find /etc/ssh/ -maxdepth 1 -name 'ssh_host_*_key' -print -quit)" ]; then
+    echo "Creating SSH2 ED25519 key; this may take some time ..."
+    ssh-keygen -q -f /etc/ssh/ssh_host_ed25519_key -N '' -t ed25519
+    ssh-keygen -l -f /etc/ssh/ssh_host_ed25519_key.pub
+    echo "HostKey /etc/ssh/ssh_host_ed25519_key" >> /etc/ssh/sshd_config
 fi
 
 exec /usr/sbin/sshd -D -e