view debian/README.runit @ 1930:299f4f19ba19

Add /usr/sbin and /sbin to default root PATH When dropbear is used in a very restricted environment (such as in a initrd), the default user shell is often also very restricted and doesn't take care of setting the PATH so the user ends up with the PATH set by dropbear. Unfortunately, dropbear always sets "/usr/bin:/bin" as default PATH even for the root user which should have /usr/sbin and /sbin too. For a concrete instance of this problem, see the "Remote Unlocking" section in this tutorial: https://paxswill.com/blog/2013/11/04/encrypted-raspberry-pi/ It speaks of a bug in the initramfs script because it's written "blkid" instead of "/sbin/blkid"... this is just because the scripts from the initramfs do not expect to have a PATH without the sbin directories and because dropbear is not setting the PATH appropriately for the root user. I'm thus suggesting to use the attached patch to fix this misbehaviour (I did not test it, but it's easy enough). It might seem anecdotic but multiple Kali users have been bitten by this. From https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=903403
author Raphael Hertzog <hertzog@debian.org>
date Mon, 09 Jul 2018 16:27:53 +0200
parents 8c2d2edadf2a
children
line wrap: on
line source

Using the dropbear SSH server with runit's services supervision
---------------------------------------------------------------

The dropbear SSH server is perfectly suited to be run under runit's
service supervision, and this package already has prepared an adequate
service directory.  Follow these steps to enable the dropbear service
using the runit package.

If not yet installed on your system, install the runit package, and make
sure its service supervision is enabled (it's by default)

 # apt-get install runit

Make sure the dropbear service normally handled through the sysv init
script is stopped

 # /etc/init.d/dropbear stop

Create the system user ``dropbearlog'' which will run the logger service,
and own the logs

 # adduser --system --home /var/log/dropbear --no-create-home dropbearlog

Create the log directory and make the newly created system user the owner
of this directory

 # mkdir -p /var/log/dropbear && chown dropbearlog /var/log/dropbear

Optionally adjust the configuration of the dropbear service by editing the
run script

 # vi /etc/dropbear/run

Finally enable the service through runit's update-service(8) program, the
service will be started within five seconds, and automatically at boot
time, and the sysv init script will automatically be disabled; see the
sv(8) program for information on how to control services handled by runit.
See the svlogd(8) program on how to configure the log service.

 # update-service --add /etc/dropbear

Optionally check the status of the service a few seconds later

 # sv status dropbear

 -- Gerrit Pape <[email protected]>, Fri, 02 Mar 2007 20:41:08 +0000