[pve-devel] [RFC container v2 3/3] setup: skip rewriting ignored ssh host keys

From: Daniel Kral <d.kral@proxmox.com>
To: pve-devel@lists.proxmox.com
Subject: [pve-devel] [RFC container v2 3/3] setup: skip rewriting ignored ssh host keys
Date: Fri,  4 Jul 2025 20:23:36 +0200	[thread overview]
Message-ID: <20250704182336.469274-3-d.kral@proxmox.com> (raw)
In-Reply-To: <20250704182336.469274-1-d.kral@proxmox.com>

Skip rewriting any SSH host keys that are actively marked as ignored by
the container template.

This is done for consistency with remove_existing_ssh_host_keys(), which
skips removing any ignored SSH host keys as well.

Signed-off-by: Daniel Kral <d.kral@proxmox.com>
---
Because of the HA Rules stuff, I unfortunately didn't get the time to
properly test these with any container images, but wanted to send them
anyway.

 src/PVE/LXC/Setup.pm | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/src/PVE/LXC/Setup.pm b/src/PVE/LXC/Setup.pm
index 02aefc6..db5d181 100644
--- a/src/PVE/LXC/Setup.pm
+++ b/src/PVE/LXC/Setup.pm
@@ -276,12 +276,22 @@ sub rewrite_ssh_host_keys {
     my $keyfiles = [];
     for my $keytype (keys $keynames->%*) {
         my $basename = $keynames->{$keytype};
+        my $private_basename = "/etc/ssh/$basename";
+        my $public_basename = "/etc/ssh/$basename.pub";
+
+        if (
+            $self->ct_is_file_ignored($private_basename)
+            || $self->ct_is_file_ignored($public_basename)
+        ) {
+            print "Skip generating SSH host key '$basename', because it is ignored.\n";
+            next;
+        }
+
         print "Creating SSH host key '$basename' - this may take some time ...\n";
         my ($id, $private, $public) = generate_ssh_key($keytype, "root\@$hostname");
         print "done: $id\n";
 
-        push $keyfiles->@*, ["/etc/ssh/$basename", $private, 0600],
-            ["/etc/ssh/$basename.pub", $public, 0644];
+        push $keyfiles->@*, [$private_basename, $private, 0600], [$public_basename, $public, 0644];
     }
 
     $self->protected_call(sub { # write them now all to the CTs rootfs at once
-- 
2.39.5



_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel

