Skip to content

Commit 12629d7

Browse files
committed
hiba: Add initial recipe for hiba
Discussion to install the HIBA Internal OpenSSH to fetch dependencies can be found in https://lists.openembedded.org/g/openembedded-core/topic/94475279#172977 HIBA is a system built on top of regular OpenSSH certificate-based authentication that allows to manage flexible authorization of principals on pools of target hosts without the need to push customized authorized_users files periodically. This recipe allow us to manage SSH to production machines easily and not rely on authorized keys. Tested: Ran the local-setup.sh and works fine on a BMC. ``` $ ssh -F /tmp/tmp.w8itTW/ssh_config -p 2201 root@localhost ##################################################### # setup-local.sh # # Host Identity Based Authorization SSHD example. # ##################################################### prodHost: limited access Connection to localhost closed. $ ssh -F /tmp/tmp.w8itTW/ssh_config -p 2202 root@localhost ##################################################### # setup-local.sh # # Host Identity Based Authorization SSHD example. # ##################################################### Last login: Thu Jan 1 00:47:28 1970 from ::1 ``` Signed-off-by: Willy Tu <wltu@google.com>
1 parent c4829fa commit 12629d7

1 file changed

Lines changed: 42 additions & 0 deletions

File tree

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
SUMMARY = "Google Host Identity Based Authorization"
2+
DESCRIPTION = "HIBA is a system built on top of regular OpenSSH \
3+
certificate-based authentication that allows to manage flexible \
4+
authorization of principals on pools of target hosts without the need to \
5+
push customized authorized_users files periodically."
6+
7+
S = "${WORKDIR}/git/hiba"
8+
LICENSE = "BSD-3-Clause"
9+
LIC_FILES_CHKSUM = "file://${S}/LICENSE;md5=7e161abe9a4585310725dd86c28d1ae2"
10+
11+
PV = "1.0+git${SRCPV}"
12+
13+
inherit autotools
14+
15+
DEPENDS = "openssl openssh zlib"
16+
17+
SRC_URI = " \
18+
git://github.com/google/hiba;protocol=https;branch=main;destsuffix=git/hiba;name=hiba \
19+
git://github.com/openssh/openssh-portable.git;protocol=https;branch=master;destsuffix=git/openssh-portable;name=openssh \
20+
"
21+
SRCREV_hiba = "98b551e2a0297b1872851bb81b6d3a2b682778ee"
22+
23+
# Internal OpenSSH version for HIBA to link against (the version doesn't have
24+
# to match the actual installed version).
25+
# Discussion in
26+
# https://lists.openembedded.org/g/openembedded-core/topic/94475279#172977
27+
SRCREV_openssh = "15a01cf15f396f87c6d221c5a6af98331c818962"
28+
SRCREV_FORMAT = "hiba"
29+
30+
EXTRA_OECONF = " \
31+
--with-opensshdir=${S}/../openssh-portable \
32+
--prefix=/usr/ \
33+
"
34+
35+
do_configure:prepend(){
36+
curr=$(pwd)
37+
cd ${S}/../openssh-portable
38+
autoreconf
39+
./configure ${CONFIGUREOPTS}
40+
oe_runmake
41+
cd ${curr}
42+
}

0 commit comments

Comments
 (0)