Skip rewriting any SSH host keys that are actively marked as ignored by
the container template.
This is done for consistency with remove_existing_ssh_host_keys(), which
skips removing any ignored SSH host keys as well.
Signed-off-by: Daniel Kral <d.k...@proxmox.com>
---
Because of the HA Rules stuff, I unfortunately didn't get the time to
properly test these with any container images, but wanted to send them
anyway.
src/PVE/LXC/Setup.pm | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
diff --git a/src/PVE/LXC/Setup.pm b/src/PVE/LXC/Setup.pm
index 02aefc6..db5d181 100644
--- a/src/PVE/LXC/Setup.pm
+++ b/src/PVE/LXC/Setup.pm
@@ -276,12 +276,22 @@ sub rewrite_ssh_host_keys {
my $keyfiles = [];
for my $keytype (keys $keynames->%*) {
my $basename = $keynames->{$keytype};
+ my $private_basename = "/etc/ssh/$basename";
+ my $public_basename = "/etc/ssh/$basename.pub";
+
+ if (
+ $self->ct_is_file_ignored($private_basename)
+ || $self->ct_is_file_ignored($public_basename)
+ ) {
+ print "Skip generating SSH host key '$basename', because it is
ignored.\n";
+ next;
+ }
+
print "Creating SSH host key '$basename' - this may take some time
...\n";
my ($id, $private, $public) = generate_ssh_key($keytype,
"root\@$hostname");
print "done: $id\n";
- push $keyfiles->@*, ["/etc/ssh/$basename", $private, 0600],
- ["/etc/ssh/$basename.pub", $public, 0644];
+ push $keyfiles->@*, [$private_basename, $private, 0600],
[$public_basename, $public, 0644];
}
$self->protected_call(sub { # write them now all to the CTs rootfs at once
--
2.39.5
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
