debos: install and enable openssh-server for SSH access by vemana1niranjan · Pull Request #348 · qualcomm-linux/qcom-deb-images

vemana1niranjan · 2026-04-03T05:36:44Z

Install openssh-server and enable the ssh service during image build so SSH access is available immediately after first boot.

github-actions · 2026-04-03T06:37:52Z

Test jobs for commit `1b5bee5`

github-actions · 2026-04-03T06:46:26Z

Test jobs for commit `3b83f17`

gagath

Makes sense to me, this avoids using the serial port to install a ssh server. This will also be useful when we move our qemu tests from expect to something a bit more robust.

github-actions · 2026-04-03T06:58:03Z

Test Results

2 files ±0 6 suites ±0 3m 42s ⏱️ ±0s
20 tests ±0 20 ✅ ±0 0 💤 ±0 0 ❌ ±0
64 runs ±0 64 ✅ ±0 0 💤 ±0 0 ❌ ±0

Results for commit c03842e. ± Comparison against base commit 874cb4c.

♻️ This comment has been updated with latest results.

github-actions · 2026-04-03T06:58:04Z

Test jobs for commit `523ff2c`

lool · 2026-04-03T08:55:48Z

While I would like to see SSH supported and that might be useful for testing as well, this doesn't combine well with our default password. Could we compile what our other images do by default?

If we had something like cloud-init, we could install but disable SSH and turn it on through c-i. Or we could leave it on but have no password to login, and let people set that up through c-i.

It would also be nice to have a simple check to ensure we don't include SSH keys in the resulting images.

github-actions · 2026-04-06T06:27:09Z

Test jobs for commit `e0b53da`

github-actions · 2026-04-06T07:53:43Z

Test jobs for commit `72ef751`

vemana1niranjan · 2026-04-07T05:20:05Z

While I would like to see SSH supported and that might be useful for testing as well, this doesn't combine well with our default password. Could we compile what our other images do by default?

If we had something like cloud-init, we could install but disable SSH and turn it on through c-i. Or we could leave it on but have no password to login, and let people set that up through c-i.

It would also be nice to have a simple check to ensure we don't include SSH keys in the resulting images.

recent update to PR making this .is this good

lool

Left various proposed improvements; coud you also add a commit message and fixed your signed-off-by to use your full name?

github-actions · 2026-04-08T10:37:18Z

Test jobs for commit `457a580`

github-actions · 2026-04-09T06:22:35Z

Test jobs for commit `4919cb4`

lool · 2026-04-09T09:00:21Z

      # convenience networking commands (arp, ifconfig, route etc.)
      - net-tools
      - openssh-client
+      # A SSH server is installed but disabled by default; enable with sudo systemctl enable ssh.


There's a comment only when the package name doesn't make it obvious; here, an insightful comment would be "disabled by default after install"

Could you also cover that in a README update? "A SSH server is installed but disabled by default; enable with `sudo systemctl enable "

lool

I'm not sure why my review wasn't fully sent

github-actions · 2026-04-16T07:19:38Z

Test jobs for commit `36db5d4`

github-actions · 2026-04-17T08:16:16Z

Test jobs for commit `c44e994`

lool · 2026-04-17T10:22:37Z

      # convenience networking commands (arp, ifconfig, route etc.)
      - net-tools
      - openssh-client
+      # OPENSSH is installed but disabled by default.


this is a weird way to write that name; either OpenSSH or openssh

or just write "disabled by default" since that's the only interesting part

changed to "disabled by default"

lool · 2026-04-17T10:24:11Z

+    command: |
+      set -eux
+      rm -f /etc/ssh/ssh_host_*
+      rm -rf /root/.ssh /home/*/.ssh


Drop the root/.ssh part, there is no chance this will be generated

removed root/.ssh part kept the /home/*/.ssh

lool · 2026-04-17T10:24:40Z

      - wget

+  - action: run
+    description: Sanitize SSH keys


This action is about disabling SSH by default; update the description to match

changed description to "Disable ssh by default and sanitize ssh keys"

lool · 2026-04-17T10:25:29Z

+    chroot: true
+    command: |
+      set -eux
+      rm -f /etc/ssh/ssh_host_*


Change this to check if the keys are present and fail if so; we don't want a silent removal, we want to escalate the issue if these keys were somehow generated.

Also, move this logic to AFTER disabling and potentially stopping the service.

made change logic starts after disabling if found printing error mesg in rootfs generation part and forcely exiting rootfs generation

lool · 2026-04-17T10:26:41Z

+      set -eux
+      rm -f /etc/ssh/ssh_host_*
+      rm -rf /root/.ssh /home/*/.ssh
+      systemctl disable ssh 2>/dev/null || true


Try to pass --now as well as that seems stricter.

Don't ignore failure, or explain why we want to run it if it's expected to fail.

tried to add --now but
flag fails because systemd is not running in the chroot build environment

lool · 2026-04-17T10:27:28Z

  `qcs9100-ride-r3`, `qrb2210-rb1`.

 Note: Boards whose required device tree (.dtb) is not present in `dtbs.tar.gz` are automatically skipped during flash asset generation.
+Note: "A SSH server is installed but disabled by default; enable with sudo systemctl enable ssh".


This is the wrong place to add this change; look at the whole README and find the place which makes the most sense. I would place it near the login instructions since this is a note about usage.

adding at login instructions

github-actions · 2026-04-22T11:16:52Z

Test jobs for commit `b66dbf7`

github-actions · 2026-04-27T06:59:24Z

Test jobs for commit `6067689`

github-actions · 2026-04-28T06:56:21Z

Test jobs for commit `fd8d793`

github-actions · 2026-04-28T07:03:29Z

Test jobs for commit `c03842e`

lool

Hi, some shell syntax issues

Please update the commit message to reflect the latest changes

lool · 2026-04-28T08:57:36Z

+        echo "ERROR: SSH host keys were unexpectedly generated" >&2
+        exit 1
+      fi
+      rm -rf /home/*/.ssh


Please drop this rm, no chance of being created during build (otherwise it should be a check as above)

lool · 2026-04-28T08:58:06Z

+    command: |
+      set -eux
+      systemctl disable ssh
+      if [ -f /etc/ssh/ssh_host_* ]; then


if this expands to multiple files, the test command will be incorrect

lool · 2026-04-28T08:58:17Z

+    chroot: true
+    command: |
+      set -eux
+      systemctl disable ssh


please add --now

lool · 2026-04-28T11:20:45Z

+    chroot: true
+    command: |
+      set -eux
+      systemctl disable ssh --now


This might work, but it's an unusual position for flags; disable --now ssh instead

even this "systemctl disable --now ssh" local build failing with this error message
msg : --now cannot be used when systemd is not running.

There is interesting observation below in trixie build fails with same error and in forky build this error was not found

so shall i remove --now?

There seems to be conflicting situations in your attempts; you report commands fail because systemd is not running (and indeed, then --now makes no sense, I can see why systemd would reject it, and we should drop it), but some recent failures also show that --now is accepted, and that the SSH keys were generated, which suggest that we're in the opposite situation:

2026/04/29 10:53:34 ==== Disable ssh by default and sanitize ssh keys ==== 2026/04/29 10:53:34 set -eux... | + systemctl disable --now ssh 2026/04/29 10:53:34 set -eux... | Removed '/etc/systemd/system/multi-user.target.wants/ssh.service'. 2026/04/29 10:53:34 set -eux... | Removed '/etc/systemd/system/sshd.service'. 2026/04/29 10:53:34 set -eux... | + [ -f /etc/ssh/ssh_host_ecdsa_key ] 2026/04/29 10:53:34 set -eux... | + basename /etc/ssh/ssh_host_ecdsa_key 2026/04/29 10:53:34 set -eux... | + echo ERROR: SSH host key (ssh_host_ecdsa_key) was unexpectedly generated

I'm not clear on when/how debos is preventing systemd from running, I would expect most image generation tools to work in chroots and disable system services entirely though some kind of policy files or replacing the binaries.

It's risky for us to run daemons such as SSH during image generation because we might end up with keys or ids that were generated once and are distributed everywhere, when they are supposed to be private or unique and generated on the first boot after flashing.

lool · 2026-04-28T11:21:07Z

+    command: |
+      set -eux
+      systemctl disable ssh --now
+      if [ -f /etc/ssh/ssh_host_rsa_key ] || [ -f /etc/ssh/ssh_host_ecdsa_key ] || [ -f /etc/ssh/ssh_host_ed25519_key ]; then


This is not robust against addition of key types in the future...

tried to add a generic loop over ssh_host_*_key

but observations are host keys are always copied in initial ssh-server package during debos install
so, removing them forcefully might be needed with (rm)

else build will always fail
is there any alternative way?

tried to add a generic loop over ssh_host_*_key

but observations are host keys are always copied in initial ssh-server package during debos install so, removing them forcefully might be needed with (rm)

else build will always fail is there any alternative way?

this requires researching why in debos openssh is being started and generates keys; I believe it shouldn't

Add the openssh server to support external ssh connections, disable it by default, and add a sanity check to error out if ssh host keys are generated during build or install, preventing unintended remote access and shipping pre-generated ssh identities. Signed-off-by: Niranjan Vemana <nvemana@qti.qualcomm.com>

lool · 2026-04-29T11:18:24Z

+      set -eux
+      systemctl disable --now ssh
+      for keyfile in /etc/ssh/ssh_host_*_key; do
+        if [ -f ${keyfile} ]; then


This shell snippet is slightly broken, on some shells it will result in an error if the files are missing; on bash, it will expand to run the loop once with keyfile=/etc/ssh/ssh_host_*_key. Then the [ -f test call will try the same missing expansion again. It's very confusion and an unorthodox way of testing for the presence of a pattern of files.

Instead, I'd recommend using "find".

Add quotes around the keyfile use, it shouldn't be wildcard-expanded again.

vemana1niranjan force-pushed the feature/add_packages_openssh_server branch 2 times, most recently from 3b83f17 to 523ff2c Compare April 3, 2026 05:53

gagath approved these changes Apr 3, 2026

View reviewed changes

vemana1niranjan force-pushed the feature/add_packages_openssh_server branch from 523ff2c to e0b53da Compare April 6, 2026 05:25

vemana1niranjan force-pushed the feature/add_packages_openssh_server branch from e0b53da to 72ef751 Compare April 6, 2026 06:49

lool requested changes Apr 7, 2026

View reviewed changes

Comment thread debos-recipes/qualcomm-linux-debian-rootfs.yaml Outdated

Comment thread debos-recipes/qualcomm-linux-debian-rootfs.yaml Outdated

Comment thread debos-recipes/qualcomm-linux-debian-rootfs.yaml Outdated

Comment thread debos-recipes/qualcomm-linux-debian-rootfs.yaml Outdated

vemana1niranjan force-pushed the feature/add_packages_openssh_server branch from 72ef751 to 457a580 Compare April 8, 2026 09:31

vemana1niranjan requested a review from lool April 9, 2026 05:10

vemana1niranjan force-pushed the feature/add_packages_openssh_server branch from 457a580 to 4919cb4 Compare April 9, 2026 05:23

lool reviewed Apr 9, 2026

View reviewed changes

vemana1niranjan force-pushed the feature/add_packages_openssh_server branch from 36db5d4 to 6a31c3a Compare April 17, 2026 06:33

lool requested changes Apr 17, 2026

View reviewed changes

vemana1niranjan force-pushed the feature/add_packages_openssh_server branch from c44e994 to b66dbf7 Compare April 22, 2026 10:10

vemana1niranjan requested a review from lool April 27, 2026 09:11

vemana1niranjan force-pushed the feature/add_packages_openssh_server branch from 6067689 to fd8d793 Compare April 28, 2026 05:47

vemana1niranjan force-pushed the feature/add_packages_openssh_server branch from fd8d793 to c03842e Compare April 28, 2026 05:58

lool requested changes Apr 28, 2026

View reviewed changes

vemana1niranjan force-pushed the feature/add_packages_openssh_server branch from c03842e to 728ad14 Compare April 28, 2026 11:05

lool reviewed Apr 28, 2026

View reviewed changes

lool requested changes Apr 28, 2026

View reviewed changes

vemana1niranjan force-pushed the feature/add_packages_openssh_server branch from 728ad14 to 7e9bb29 Compare April 29, 2026 10:47

lool requested changes Apr 29, 2026

View reviewed changes

Conversation

vemana1niranjan commented Apr 3, 2026

Uh oh!

github-actions Bot commented Apr 3, 2026

Test jobs for commit 1b5bee5

Uh oh!

github-actions Bot commented Apr 3, 2026

Test jobs for commit 3b83f17

Uh oh!

gagath left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Apr 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test Results

Uh oh!

github-actions Bot commented Apr 3, 2026

Test jobs for commit 523ff2c

Uh oh!

lool commented Apr 3, 2026

Uh oh!

github-actions Bot commented Apr 6, 2026

Test jobs for commit e0b53da

Uh oh!

github-actions Bot commented Apr 6, 2026

Test jobs for commit 72ef751

Uh oh!

vemana1niranjan commented Apr 7, 2026

Uh oh!

lool left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Apr 8, 2026

Test jobs for commit 457a580

Uh oh!

github-actions Bot commented Apr 9, 2026

Test jobs for commit 4919cb4

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lool left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Apr 16, 2026

Test jobs for commit 36db5d4

Uh oh!

github-actions Bot commented Apr 17, 2026

Test jobs for commit c44e994

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Apr 22, 2026

Test jobs for commit b66dbf7

Uh oh!

Test jobs for commit `1b5bee5`

Test jobs for commit `3b83f17`

github-actions Bot commented Apr 3, 2026 •

edited

Loading

Test jobs for commit `523ff2c`

Test jobs for commit `e0b53da`

Test jobs for commit `72ef751`

Test jobs for commit `457a580`

Test jobs for commit `4919cb4`

Test jobs for commit `36db5d4`

Test jobs for commit `c44e994`

Test jobs for commit `b66dbf7`

Test jobs for commit `6067689`

Test jobs for commit `fd8d793`

Test jobs for commit `c03842e`