ducoterra
bdee581480
Headless Pis lose /root/.ssh/authorized_keys to imaging, first-boot tooling, or config management, which locks out the only SSH account that can fix it. - ensure-root-ssh-key: idempotent POSIX sh installer. Appends managed public keys from /usr/local/share/root-ssh-keys/authorized_keys, never removes or rewrites foreign keys, skips lines whose first field is not a known key algorithm, and enforces 0700 / 0600 root:root on the key dir and file. - ensure-root-ssh-key.service: oneshot, ordered Before=ssh.service so the key lands before the daemon starts; ConditionPathExists skips it when the managed keys file is absent. - ensure-root-ssh-key.path: PathChanged= + PathModified= on authorized_keys so deletes, renames, and in-place edits are healed at runtime, not just at boot. Writes only when a key is missing, so the unit settles after one no-op run. - authorized_keys.example: template with commented placeholder keys only; the real file stays on the host. - root-ssh-key.md: runbook with deploy, verification, revocation steps, and the gotcha that systemd has no PathMissing= key. LLM-Generated: true
12 lines
558 B
Plaintext
12 lines
558 B
Plaintext
# Template for /usr/local/share/root-ssh-keys/authorized_keys on the host.
|
|
# Keys listed here are (re)installed into /root/.ssh/authorized_keys at boot and
|
|
# whenever that file changes. Copy to `authorized_keys`, add your public keys,
|
|
# and keep the real file on the host - do not commit it.
|
|
#
|
|
# One key per line, authorized_keys format. Blank lines and lines starting with
|
|
# '#' are ignored; a line whose first field is not a known key algorithm is
|
|
# skipped with a warning.
|
|
#
|
|
# ssh-ed25519 AAAA<base64> comment@host
|
|
# ssh-rsa AAAA<base64> comment@host
|