Skip to content

Commit abd8422

Browse files
committed
hiba: Add initial recipe for hiba
The initial set of reviews can be found in https://gbmc-review.googlesource.com/c/meta-gbmc-staging/+/2001 HIBA is a system built on top of regular OpenSSH certificate-based authentication that allows to manage flexible authorization of principals on pools of target hosts without the need to push customized authorized_users files periodically. This recipe allow us to manage SSH to production machines easily and not rely on authorized keys. Tested: Ran the local-setup.sh and works fine on a BMC. ``` $ ssh -F /tmp/tmp.w8itTW/ssh_config -p 2201 root@localhost ##################################################### # setup-local.sh # # Host Identity Based Authorization SSHD example. # ##################################################### prodHost: limited access Connection to localhost closed. $ ssh -F /tmp/tmp.w8itTW/ssh_config -p 2202 root@localhost ##################################################### # setup-local.sh # # Host Identity Based Authorization SSHD example. # ##################################################### Last login: Thu Jan 1 00:47:28 1970 from ::1 ``` Signed-off-by: Willy Tu <wltu@google.com>
1 parent f6eb4c8 commit abd8422

1 file changed

Lines changed: 38 additions & 0 deletions

File tree

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
SUMMARY = "Google Host Identity Based Authorization"
2+
DESCRIPTION = "HIBA is a system built on top of regular OpenSSH \
3+
certificate-based authentication that allows to manage flexible \
4+
authorization of principals on pools of target hosts without the need to \
5+
push customized authorized_users files periodically."
6+
7+
S = "${WORKDIR}/git"
8+
9+
LICENSE = "BSD-3-Clause"
10+
LIC_FILES_CHKSUM = "file://${S}/LICENSE;md5=7e161abe9a4585310725dd86c28d1ae2"
11+
12+
SRC_URI = "git://github.com/google/hiba;protocol=https;branch=main"
13+
SRCREV = "3199239c6a0a89dbd8f155204f44798c78195ab0"
14+
15+
PV = "1.0+git${SRCPV}"
16+
17+
inherit autotools
18+
19+
DEPENDS = "openssl openssh zlib"
20+
21+
EXTRA_OECONF = " \
22+
--with-opensshdir=${PKG_CONFIG_SYSROOT_DIR}/usr/include/ssh \
23+
--prefix=/usr/ \
24+
"
25+
26+
# Make sure that MACHINE_FEATURES includes hiba before continuing
27+
do_configure:prepend(){
28+
if ${@bb.utils.contains("DISTRO_FEATURES", "hiba", "false", "true", d)} ; then
29+
echo "DISTRO_FEATURES does not support hiba. Skip the configuration"
30+
exit 1
31+
fi
32+
}
33+
34+
PACKAGES =+ "${PN}-tools"
35+
36+
FILES:${PN}-tools = "${sbindir}/hiba-ca.sh ${sbindir}/hiba-grl ${sbindir}/hiba-gen"
37+
38+
RDEPENDS:${PN}-tools = "${PN} bash"

0 commit comments

Comments
 (0)