Skip to content

Commit

Permalink
hiba: Add initial recipe for hiba
Browse files Browse the repository at this point in the history
The initial set of reviews can be found in
https://gbmc-review.googlesource.com/c/meta-gbmc-staging/+/2001

HIBA is a system built on top of regular OpenSSH certificate-based
authentication that allows to manage flexible authorization of
principals on pools of target hosts without the need to push customized
authorized_users files periodically.

This recipe allow us to manage SSH to production machines easily and not
rely on authorized keys.

Tested:
Ran the local-setup.sh and works fine on a BMC.
```
$ ssh -F /tmp/tmp.w8itTW/ssh_config -p 2201 root@localhost
 #####################################################
 #                 setup-local.sh                    #
 # Host Identity Based Authorization SSHD example.   #
 #####################################################
prodHost: limited access
Connection to localhost closed.
$ ssh -F /tmp/tmp.w8itTW/ssh_config -p 2202 root@localhost
 #####################################################
 #                 setup-local.sh                    #
 # Host Identity Based Authorization SSHD example.   #
 #####################################################
Last login: Thu Jan  1 00:47:28 1970 from ::1
```

Signed-off-by: Willy Tu <wltu@google.com>
  • Loading branch information
wltu committed Aug 27, 2022
1 parent f6eb4c8 commit abd8422
Showing 1 changed file with 38 additions and 0 deletions.
38 changes: 38 additions & 0 deletions meta-oe/recipes-connectivity/hiba/hiba_git.bb
@@ -0,0 +1,38 @@
SUMMARY = "Google Host Identity Based Authorization"
DESCRIPTION = "HIBA is a system built on top of regular OpenSSH \
certificate-based authentication that allows to manage flexible \
authorization of principals on pools of target hosts without the need to \
push customized authorized_users files periodically."

S = "${WORKDIR}/git"

LICENSE = "BSD-3-Clause"
LIC_FILES_CHKSUM = "file://${S}/LICENSE;md5=7e161abe9a4585310725dd86c28d1ae2"

SRC_URI = "git://github.com/google/hiba;protocol=https;branch=main"
SRCREV = "3199239c6a0a89dbd8f155204f44798c78195ab0"

PV = "1.0+git${SRCPV}"

inherit autotools

DEPENDS = "openssl openssh zlib"

EXTRA_OECONF = " \
--with-opensshdir=${PKG_CONFIG_SYSROOT_DIR}/usr/include/ssh \
--prefix=/usr/ \
"

# Make sure that MACHINE_FEATURES includes hiba before continuing
do_configure:prepend(){
if ${@bb.utils.contains("DISTRO_FEATURES", "hiba", "false", "true", d)} ; then
echo "DISTRO_FEATURES does not support hiba. Skip the configuration"
exit 1
fi
}

PACKAGES =+ "${PN}-tools"

FILES:${PN}-tools = "${sbindir}/hiba-ca.sh ${sbindir}/hiba-grl ${sbindir}/hiba-gen"

RDEPENDS:${PN}-tools = "${PN} bash"

0 comments on commit abd8422

Please sign in to comment.