Updated changelog

Specify timeout for ipconfig so that we can still boot while network is done.
Otherwise ipconfig remains stuck (until IP can be configured). If not given
we default to 10s.

Minor code refactoring.

Moved configuration file from /etc/dropbear/initrd.env to /etc/initcpio/sshcs_env since
it now contains options for ipconfig and not only dropbear. Package installation script
move legacy file to new path if present.

v0.3-1

ChangeLog

@@ -1,3 +1,17 @@
+2015-11-22 Julien Coloos <julien.coloos [at] gmail [dot] com>
+
+	* v0.3-1
+	Added configurable timeout for ipconfig
+        Moved configuration file from /etc/dropbear/initrd.env to /etc/initcpio/sshcs_env
+
+
+2014-05-20 Julien Coloos <julien.coloos [at] gmail [dot] com>
+
+	* v0.2-1
+	Removed unnecessary dependency: psmisc
+	Added configurable timeout to unlock devices before automatic poweroff
+
+
 2014-05-19 Julien Coloos <julien.coloos [at] gmail [dot] com>
 
 	* v0.1-1

PKGBUILD

@@ -1,17 +1,17 @@
 # Maintainer: Julien Coloos <julien.coloos [at] gmail [dot] com>
 pkgname=initrd-ssh-cryptsetup
-pkgver=0.1
+pkgver=0.3
 pkgrel=1
 pkgdesc="Allows for LUKS-encrypted devices to be unlocked remotely over SSH"
 arch=('any')
 url="https://github.com/suiryc/archlinux-$pkgname"
 license=('GPL3')
-depends=('dropbear' 'cryptsetup' 'mkinitcpio-nfs-utils' 'psmisc' 'iproute2')
+depends=('dropbear' 'cryptsetup' 'mkinitcpio-nfs-utils' 'iproute2')
 install=$pkgname.install
 changelog='ChangeLog'
 source=("http://julien.coloos.free.fr/archlinux/$pkgname-$pkgver.tar.xz" "$pkgname.install")
-md5sums=('cd16f62be49eef3fa178ce292de64f48'
+md5sums=('a25dbbac5cd82a8d87932e646e38d9c4'
-         'a703663472bbd50882a11f6b2cfccbf0')
+         'ac60109d80e7bb2af0d66e69aaf178a6')
 
 package() {
   install -Dm644 "$srcdir/src/install/ssh-cryptsetup" "$pkgdir/usr/lib/initcpio/install/ssh-cryptsetup"

README.md

@@ -14,8 +14,19 @@ As explained upon installation, the following things need to be done:
 
 The LUKS-encrypted devices to unlock are derived from `/etc/crypttab`.
 
-The SSH listening port (22 by default) can be changed by setting the `sshcs_opt_listen` option in `/etc/dropbear/initrd.env` (file is sourced in initrd shell).
+
+Some options can be set in `/etc/initcpio/sshcs_env` (file is sourced in initrd shell):
+  * `sshcs_opt_timeout_ipconfig`: time (in seconds) to configure IP
+    - default: 10 seconds
+  * `sshcs_opt_listen`: SSH listening port
+    - default: 22
+  * `sshcs_opt_timeout_poweroff`: time (in seconds) to unlock devices before automatic powering off
+    - default (and minimum value): 2 minutes
+    - negative value to deactivate
+
 For example:
 
+    sshcs_opt_timeout_ipconfig=30
     sshcs_opt_listen=2222
+    sshcs_opt_timeout_poweroff=-1
 

initrd-ssh-cryptsetup.install

@@ -1,8 +1,17 @@
 #!/bin/bash
 
 post_install() {
+    local sshcs_env="/etc/initcpio/sshcs_env"
+    local sshcs_env_old="/etc/dropbear/initrd.env"
     local dropbear_authorized_keys="/etc/dropbear/initrd.authorized_keys"
     local etc_dropbear=$(dirname "${dropbear_authorized_keys}")
+    [ ! -e "${sshcs_env}" ] && [ -e "${sshcs_env_old}" ] && {
+        [ -d $(dirname "${sshcs_env}") ] || mkdir -p $(dirname "${sshcs_env}")
+        mv "${sshcs_env_old}" "${sshcs_env}"
+    cat <<EOF
+    Moved legacy file ${sshcs_env_old} to new path ${sshcs_env}"
+EOF
+    }
     [ -d "${etc_dropbear}" ] || mkdir -p "${etc_dropbear}"
     [ -e "${dropbear_authorized_keys}" ] || touch "${dropbear_authorized_keys}"
     chmod 600 "${dropbear_authorized_keys}"

src/hooks/ssh-cryptsetup

@@ -1,5 +1,16 @@
 #!/usr/bin/ash
 
+sshcs_env_load() {
+    local timeout_ipconfig_default=10
+    local timeout_poweroff_min=120
+
+    [ -e "${sshcs_env}" ] && . "${sshcs_env}"
+    [ -z "${sshcs_opt_timeout_ipconfig}" ] && sshcs_opt_timeout_ipconfig=${timeout_ipconfig_default}
+    [ -n "${sshcs_opt_listen}" ] && sshcs_opt_listen="-p ${sshcs_opt_listen}"
+    [ -z "${sshcs_opt_timeout_poweroff}" ] && sshcs_opt_timeout_poweroff=${timeout_poweroff_min}
+    [ ${sshcs_opt_timeout_poweroff} -ge 0 ] && [ ${sshcs_opt_timeout_poweroff} -lt ${timeout_poweroff_min} ] && sshcs_opt_timeout_poweroff=${timeout_poweroff_min}
+}
+
 sshcs_net_start() {
     # we must have an 'ip' setting, and a device in it
     [ -z "${ip}" ] && [ -n "${nfsaddrs}" ] && ip="${nfsaddrs}"
@@ -14,7 +25,16 @@ sshcs_net_start() {
     # temporary file and 'source' it since '... | while read ...' spawns a
     # subshell from which outer variables cannot be altered.
     : > "${net_env}"
-    ipconfig "ip=${ip}" | while read line; do
+
+    echo ""
+    echo "Configuring IP (timeout = ${sshcs_opt_timeout_ipconfig}s) ..."
+    ipconfig_out=$(ipconfig -t "${sshcs_opt_timeout_ipconfig}" "ip=${ip}")
+    if [ $? -ne 0 ]; then
+        err "IP configuration timeout!"
+        return 1
+    fi
+
+    echo -n "${ipconfig_out}" | while read line; do
         [ "${line#"IP-Config:"}" != "${line}" ] && continue
 
         line="$(echo "${line}" | sed -e 's/ :/:/g;s/: /=/g')"
@@ -36,7 +56,57 @@ sshcs_net_start() {
     [ -n "${net_address}" ]
 }
 
+sshcs_net_done() {
+    # we are done with the network
+    if [ -n "${net_device}" ]; then
+        ip addr flush dev "${net_device}"
+        ip link set dev "${net_device}" down
+    fi
+}
+
+sshcs_trapped_timeout() {
+    err "Timeout reached! Powering off."
+    poweroff -f
+    exit
+}
+
+sshcs_trap_timeout() {
+    local pid_init=$$
+
+    if [ ${sshcs_opt_timeout_poweroff} -gt 0 ]; then
+        echo ""
+        echo "WARNING! Automatic poweroff will be triggered in ${sshcs_opt_timeout_poweroff}s"
+        echo "To deactivate, please unlock devices"
+        echo ""
+        trap sshcs_trapped_timeout SIGALRM
+        (
+            sleep ${sshcs_opt_timeout_poweroff}
+            kill -SIGALRM ${pid_init}
+            # Signal is not processed if cryptsetup is waiting for the password
+            killall cryptsetup > /dev/null 2>&1
+        ) &
+        pid_timeout=$!
+    fi
+}
+
+sshcs_untrap_timeout() {
+    [ -z "${pid_timeout}" ] && return 0
+    kill ${pid_timeout}
+    trap - SIGALRM
+    msg "Timeout cleared."
+}
+
+sshcs_unlock() {
+    sshcs_trap_timeout
+
+    # actual script (shared with SSH login) unlocking encrypted devices
+    . "${sshcs_cryptsetup_script}"
+
+    sshcs_untrap_timeout
+}
+
 sshcs_dropbear_unlock() {
+    local pid_timeout=
     local dev_pts_mounted=0
     local listen=
 
@@ -57,14 +127,14 @@ sshcs_dropbear_unlock() {
 
 . "/init_functions"
 
-if [ ! -f "${dropbear_cryptsetup_script}" ]; then
+if [ ! -f "${sshcs_cryptsetup_script}" ]; then
     err "No cryptsetup script present! Please retry."
     exit 0
 fi
 
 if [ -c "/dev/mapper/control" ]; then
     CSQUIET=
-    . "${dropbear_cryptsetup_script}"
+    . "${sshcs_cryptsetup_script}"
 
     echo ""
     echo "cryptsetup succeeded! Boot sequence should go on."
@@ -79,15 +149,11 @@ EOF
     [ ! -d "/var/log" ] && mkdir -p "/var/log"
     touch "/var/log/lastlog"
 
-    [ -e "${dropbear_env}" ] && . "${dropbear_env}"
-    [ -n "${sshcs_opt_listen}" ] && sshcs_opt_listen="-p ${sshcs_opt_listen}"
-
-
     msg "Starting dropbear ..."
     dropbear -Emsgjk -P "${path_dropbear_pid}" ${sshcs_opt_listen}
 
-    # actual script (shared with SSH login) unlocking encrypted devices
+    # Actual unlocking
-    . "${dropbear_cryptsetup_script}"
+    sshcs_unlock
 
     # cleanup dropbear
     if [ -f "${path_dropbear_pid}" ]; then
@@ -95,7 +161,7 @@ EOF
         kill $(cat "${path_dropbear_pid}")
         rm -f "${path_dropbear_pid}"
     fi
-    rm -f "${dropbear_cryptsetup_script}" "${dropbear_login_shell}" "/etc/passwd" "/etc/shells" "/var/log/lastlog"
+    rm -f "${sshcs_cryptsetup_script}" "${dropbear_login_shell}" "/etc/passwd" "/etc/shells" "/var/log/lastlog"
 
     # cleanup /dev/pts if necessary
     if [ ${dev_pts_mounted} -ne 0 ]; then
@@ -104,14 +170,6 @@ EOF
     fi
 }
 
-sshcs_net_done() {
-    # we are done with the network
-    if [ -n "${net_device}" ]; then
-        ip addr flush dev "${net_device}"
-        ip link set dev "${net_device}" down
-    fi
-}
-
 sshcs_cryptpart_process() {
     # ensure there is a device (handle 'UUID=' format)
     [ -z "${cryptdev}" ] && return 0
@@ -140,7 +198,7 @@ sshcs_cryptpart_process() {
         if cryptsetup isLuks "${cryptdev}" >/dev/null 2>&1; then
 
             # update script used to unlock device either in console or SSH
-            [ -s "${dropbear_cryptsetup_script}" ] || cat <<EOF > "${dropbear_cryptsetup_script}"
+            [ -s "${sshcs_cryptsetup_script}" ] || cat <<EOF > "${sshcs_cryptsetup_script}"
 cycle_or_retry() {
     local res
 
@@ -154,7 +212,7 @@ cycle_or_retry() {
 }
 EOF
 
-            cat <<EOF >> "${dropbear_cryptsetup_script}"
+            cat <<EOF >> "${sshcs_cryptsetup_script}"
 # loop until device is available
 while [ ! -e "/dev/mapper/${cryptname}" ]; do
     if cryptsetup open --type "${crypttype}" "${cryptdev}" "${cryptname}" "${cryptargs}" "\${CSQUIET}"; then
@@ -178,17 +236,19 @@ EOF
     fi
 }
 
-
 run_hook() {
     local etc_crypttab="/etc/crypttab"
-    local dropbear_env="/etc/dropbear/initrd.env"
+    local sshcs_env="/etc/initcpio/sshcs_env"
     local path_dropbear_pid="/.dropbear.pid"
     local dropbear_login_shell="/.cryptsetup_shell.sh"
-    local dropbear_cryptsetup_script="/.cryptsetup_script.sh"
+    local sshcs_cryptsetup_script="/.cryptsetup_script.sh"
     local net_env="/.net_env.sh"
-    local line iparg net_address net_netmask net_gateway net_dns0 net_dns1
+    local line iparg net_address net_device ipconfig_out net_netmask net_gateway net_dns0 net_dns1
     local cryptdev cryptdev_orig crypttype cryptname cryptpass cryptoptions cryptopt cryptargs CSQUIET
 
+    # Load our options
+    sshcs_env_load
+
     # sanity check: crypttab should be present
     [ ! -e "${etc_crypttab}" ] && return 0
 
@@ -197,14 +257,6 @@ run_hook() {
 
     umask 0022
 
-    # start and check network
-    if ! sshcs_net_start; then
-        err "Net interface not available! Skipping crypt remote unlocking."
-        # stop the network if possible
-        sshcs_net_done
-        return 0
-    fi
-
     # check encrypted devices to handle
     cryptdev=
     crypttype=luks
@@ -217,9 +269,17 @@ run_hook() {
         sshcs_cryptpart_process
     done < "${etc_crypttab}"
 
-    if [ ! -e "${dropbear_cryptsetup_script}" ]; then
+    if [ ! -e "${sshcs_cryptsetup_script}" ]; then
         err "No encrypted device found! Skipping crypt remote unlocking."
-        # don't forget to stop the network
+        return 0
+    fi
+
+    # start and check network
+    if ! sshcs_net_start; then
+        err "Net interface not available! Skipping crypt remote unlocking."
+        # We still allow to unlock locally with timeout
+        sshcs_unlock
+        # stop the network if possible
         sshcs_net_done
         return 0
     fi

src/install/ssh-cryptsetup

@@ -31,7 +31,7 @@ sshcs_check_keys() {
 build() {
     local etc_crypttab="/etc/crypttab"
     local dropbear_authorized_keys="/etc/dropbear/initrd.authorized_keys"
-    local dropbear_env="/etc/dropbear/initrd.env"
+    local sshcs_env="/etc/initcpio/sshcs_env"
     local dropbear_key_types=( "dss" "rsa" "ecdsa" )
     local dropbear_keyfile_prefix="/etc/dropbear/dropbear_"
     local dropbear_keyfile_suffix="_host_key"
@@ -70,14 +70,15 @@ build() {
     add_binary "dropbear"
     add_binary "ip"
     add_binary "/usr/lib/initcpio/ipconfig" "/sbin/ipconfig"
-    add_binary "killall"
+
+    # Our hook files
+    [ -e "${sshcs_env}" ] && add_file "${sshcs_env}"
 
     # auth-related files
     add_file "/lib/libnss_files.so"
 
     # SSH-related files
     add_file "${dropbear_authorized_keys}" "/root/.ssh/authorized_keys"
-    [ -e "${dropbear_env}" ] && add_file "${dropbear_env}"
     add_file "/etc/dropbear/dropbear_rsa_host_key"
     add_file "/etc/dropbear/dropbear_dss_host_key"
     add_file "/etc/dropbear/dropbear_ecdsa_host_key"
@@ -102,8 +103,15 @@ Network is configured with 'ip=' kernel parameter (see 'mkinitcpio-nfs-utils').
 Authorized SSH key(s) must be present in '/etc/dropbear/initrd.authorized_keys'.
 LUKS encrypted devices to unlock are derived from '/etc/crypttab', which must
 be present.
-Listening port (if not 22) can be set with the option 'sshcs_opt_listen' in
+Some options can be set in '/etc/initcpio/sshcs_env' (file is sourced in
-'/etc/dropbear/initrd.env' (file is sourced in initrd shell).
+initrd shell):
+ * 'sshcs_opt_timeout_ipconfig': time (s) to configure IP
+   - default: 10 seconds
+ * 'sshcs_opt_listen': listening port (22 by default)
+ * 'sshcs_opt_timeout_poweroff': time (s) to unlock devices before automatic
+   powering off
+   - default (and minimum value): 2 minutes
+   - negative value to deactivate
 
 Each SSH server key ('dropbear_rsa_host_key', 'dropbear_dss_host_key' and
 'dropbear_ecdsa_host_key' in '/etc/dropbear' folder) is imported from OpenSSH