ssh key generation delays booting

JonnyE · Feb 11th 2014

Hallo,

we purchased the armStoneA5 starter kit. Using buildroot I created a new root filesystem.
In the config menu I chose remount root filesystem read-write during boot

At the end of the boot process the system tries to generate ssh dsa and rsa keys which delays booting up to nearly 1 minute.

Code

Starting network...
Generating DSA Key...
THIS CAN TAKE A MINUTE OR TWO DEPENDING ON YOUR PROCESSOR!
Generating public/private dsa key pair.
open /etc/ssh_host_dsa_key failed: Read-only file system.
Saving the key failed: /etc/ssh_host_dsa_key.
Generating ECDSA Key...
THIS CAN TAKE A MINUTE OR TWO DEPENDING ON YOUR PROCESSOR!
Generating public/private ecdsa key pair.
open /etc/ssh_host_ecdsa_key failed: Read-only file system.
Saving the key failed: /etc/ssh_host_ecdsa_key.
Starting sshd: Could not load host key: /etc/ssh_host_rsa_key
Could not load host key: /etc/ssh_host_dsa_key
Could not load host key: /etc/ssh_host_ecdsa_key
Disabling protocol version 2. Could not load host key
sshd: no hostkeys available -- exiting.
OK
Starting input-event-daemon: done
Welcome to F+S-Vybrid
fsvybrid login:

Display More

We tried to remount the filesystem rw and generate these keys manually using

Code

fsvybrid login: root
# mount -o remount,rw /
UBIFS: completing deferred recovery
UBIFS: deferred recovery completed
# ssh-keygen -t dsa
Generating public/private dsa key pair.
Enter file in which to save the key (/root/.ssh/id_dsa): /etc/ssh_host_dsa_key
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /etc/ssh_host_dsa_key.
Your public key has been saved in /etc/ssh_host_dsa_key.pub.
The key fingerprint is:
c1:c5:99:ea:dc:1f:bf:9f:52:1b:44:07:04:8f:4c:19 root@fsvybrid
The key's randomart image is:
+--[ DSA 1024]----+
| ..oE=o. |
| . .+o.o ..|
| o. o o .|
| .. . |
| oS. . |
| o . . o |
| . o. o|
| .....|
| o+.|
+-----------------+
# ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa): /etc/ssh_host_rsa_key
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /etc/ssh_host_rsa_key.
Your public key has been saved in /etc/ssh_host_rsa_key.pub.
The key fingerprint is:
b1:b1:4f:25:80:df:5b:37:e2:c9:1f:69:00:54:bb:2d root@fsvybrid
The key's randomart image is:
+--[ RSA 2048]----+
| ...... |
| . .. . |
| .o...o |
| .=.o+oo |
| S .=E=.o |
| o. +.+ |
| . o . |
| . |
| |
+-----------------+
# ssh-keygen -t ecdsa
Generating public/private ecdsa key pair.
Enter file in which to save the key (/root/.ssh/id_ecdsa): /etc/ssh_host_ecdsa_key
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /etc/ssh_host_ecdsa_key.
Your public key has been saved in /etc/ssh_host_ecdsa_key.pub.
The key fingerprint is:
6c:23:e7:eb:fd:3b:96:91:e2:32:32:a3:83:c7:71:e0 root@fsvybrid
The key's randomart image is:
+--[ECDSA 256]---+
| |
| |
| |
| . . |
| . .. S . |
| E .= .. o |
| o o .. . o |
| . + + oo. + |
| ..o =oo.ooo |
+-----------------+
#

Display More

But we didn't have success. I've also tried restoring the root filesystem using rootfs_std-fsvybrid-V1.0.ubifs from the fsvybrid-V1.0.tar.bz2 archive.
What do I have to do to generate these keys and save them permanently in order to make the boot up delay disappear?
Why is my root filesystem not mounted rw although I've chosen it in buildroot?

Thank you very much!

armStoneA5_20140121 · Feb 12th 2014

I dont't know if it is the right solution, but I did the following to fix this problem. After boot I logged in as root and entered the following commands. First I mounted the filesystem read-write to enable storage of generated keys

Code

mount -o remount,rw /

Then I executed the following commands from the startup script file /etc/S50sshd to generate the keys:

Code

/usr/bin/ssh-keygen -t rsa1 -f /etc/ssh_host_key -C '' -N ''
/usr/bin/ssh-keygen -t rsa -f /etc/ssh_host_rsa_key -C '' -N ''
/usr/bin/ssh-keygen -t dsa -f /etc/ssh_host_dsa_key -C '' -N ''
/usr/bin/ssh-keygen -t ecdsa -f /etc/ssh_host_ecdsa_key -C '' -N ''

This fixed the problem for me.

fs-support_HK · Feb 13th 2014

Yes, the easiest way is to remount rootfs as rw and restart the S50 script:

Code

mount -o remount,rw /
/etc/init.d/S50sshd restart
mount -o remount,ro /

The next version will skip the key generation if the filesystem is read-only. Then booting will not be delayed and you can create the keys in the above way whenever you have time.

Your F&S Support Team

Share