From a720ad9d4f8de0f82fc9de93736981ff5802a0b7 Mon Sep 17 00:00:00 2001 From: chrisfu Date: Fri, 30 Jan 2026 23:40:34 -0800 Subject: [PATCH] Enable fallback to RSA for SSH key generation and streamline keypair handling. - Add a fallback mechanism to RSA when ed25519 key generation fails in `install.py`. - Update SSH key generation logic to avoid ed25519-specific messaging. - Simplify comments and logic in `init_openbao.sh` by removing ed25519 assumptions. - Compact XML formatting for port-mappings. --- conf/port-mappings.properties | 69 +++-------------------------------- etc/init_openbao.sh | 14 ++++--- install.py | 22 ++++++++++- 3 files changed, 35 insertions(+), 70 deletions(-) diff --git a/conf/port-mappings.properties b/conf/port-mappings.properties index eac7641..5f63340 100644 --- a/conf/port-mappings.properties +++ b/conf/port-mappings.properties @@ -1,64 +1,7 @@ - - - - - - - - - - - - - - - - - - + + + + + + \ No newline at end of file diff --git a/etc/init_openbao.sh b/etc/init_openbao.sh index c90047f..e33c402 100755 --- a/etc/init_openbao.sh +++ b/etc/init_openbao.sh @@ -4,7 +4,7 @@ set -euo pipefail # init_openbao.sh # Purpose: -# - Deploy OpenBao to Kubernetes (dev mode) and store admin ed25519 key pair +# - Deploy OpenBao to Kubernetes (dev mode) and store admin key pair # Generate and apply a Kerberos krb5.conf ConfigMap for an external realm # - Local Docker helpers for OpenBao (optional) @@ -81,11 +81,15 @@ ensure_docker() { } ensure_admin_keypair() { - # Ensure admin ed25519 keypair exists and a root token is available + # Ensure admin keypair exists and a root token is available mkdir -p "$SECRETS_DIR" if [[ ! -f "$admin_key_priv" || ! -f "$admin_key_pub" ]]; then - echo "Generating admin ed25519 keypair in $SECRETS_DIR ..." - openssl genpkey -algorithm ED25519 -out "$admin_key_priv" + echo "Generating admin keypair in $SECRETS_DIR ..." + # Attempt ed25519, fallback to rsa if not available + if ! openssl genpkey -algorithm ED25519 -out "$admin_key_priv" 2>/dev/null; then + echo "ED25519 not supported by openssl, falling back to RSA 4096..." + openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:4096 -out "$admin_key_priv" + fi openssl pkey -in "$admin_key_priv" -pubout -out "$admin_key_pub" chmod 0600 "$admin_key_priv" fi @@ -429,7 +433,7 @@ cmd_status() { # Secrets and tokens if [[ -f "$admin_key_priv" && -f "$admin_key_pub" ]]; then - echo "[OK] Admin ed25519 keypair present in $SECRETS_DIR" + echo "[OK] Admin keypair present in $SECRETS_DIR" else echo "[MISSING] Admin keypair files in $SECRETS_DIR" ok=1 diff --git a/install.py b/install.py index 81d0ed4..c21bf53 100755 --- a/install.py +++ b/install.py @@ -1252,6 +1252,7 @@ class ProleInstaller: def worker(): self.safe_after(lambda: self._db_set_buttons_state('disabled')) self.safe_after(lambda: self._db_set_status(f"Recreating SSH key for {ns}...", '#1d1d1f')) + # We prefer ed25519, but fallback to rsa if not available key_path = Path.home() / ".ssh" / "id_prole_ed25519" pub_path = Path.home() / ".ssh" / "id_prole_ed25519.pub" try: @@ -1264,6 +1265,11 @@ class ProleInstaller: cmd = ["ssh-keygen", "-t", "ed25519", "-N", "", "-f", str(key_path), "-C", self.db_username.get().strip()] rc, out = self._run_cmd_capture(cmd) + if rc != 0: + self._db_log(f"ed25519 generation failed, falling back to rsa: {out}") + cmd = ["ssh-keygen", "-t", "rsa", "-b", "4096", "-N", "", "-f", str(key_path), "-C", self.db_username.get().strip()] + rc, out = self._run_cmd_capture(cmd) + self._db_log(out) if rc != 0: self.safe_after(lambda: self._db_set_status("Failed to recreate SSH key. See logs/db-actions.log.", '#ff3b30')) @@ -2224,7 +2230,7 @@ class ProleInstaller: # ---------------- Initialize Screen Handlers ---------------- def _generate_ssh_key_with_overlay(self): - """Generate ed25519 SSH key pair using a standard screen layout.""" + """Generate SSH key pair using a standard screen layout.""" self._clear_canvas_page() # Letterhead at top right @@ -2236,7 +2242,7 @@ class ProleInstaller: font=('SF Pro Text', 18), anchor='ne') self._render_title('Generate SSH Key', y=150) - self._render_paragraph('Generating ed25519 SSH key pair for secure database access.', y=200) + self._render_paragraph('Generating SSH key pair for secure database access.', y=200) # Output Console - standardized to match Docker Build screen console = self._create_console_output(y=260, title="SSH Output", width=900, height=520) @@ -2266,6 +2272,18 @@ class ProleInstaller: if line: console.write(line) + if proc.returncode != 0: + console.write(f"\ned25519 generation failed, falling back to rsa (code {proc.returncode})\n") + cmd = ["ssh-keygen", "-t", "rsa", "-b", "4096", "-N", "", "-f", str(key_path), "-C", self.db_username.get()] + console.write(f"Running: {' '.join(cmd)}\n\n") + proc = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True) + while True: + line = proc.stdout.readline() + if not line and proc.poll() is not None: + break + if line: + console.write(line) + if proc.returncode == 0: console.write("\nSSH key generated successfully.\n") self.safe_after(lambda: self.bg_canvas.itemconfig(status_label, text="SSH key generated successfully.", fill='#34c759') if self.bg_canvas.winfo_exists() else None)