console-server: T2490: add SSH support

A user can define a port under the SSH node per device. WHen connecting to that
port and authenticating using regular credentials we will immediately drop to
the serial console. This is the same as executing "connect serial-proxy <name>".

3 files changed, 37 insertions, 5 deletions

diff --git a/src/conf_mode/service_serial-proxy.py b/src/conf_mode/service_serial-proxy.py
index 0dd1cfc6d..5f510d311 100755
--- a/src/conf_mode/service_serial-proxy.py
+++ b/src/conf_mode/service_serial-proxy.py
@@ -65,11 +65,11 @@ def verify(proxy):
     for tmp in proxy['device']:
         device = proxy['device'][tmp]
         if not device['speed']:
-            raise ConfigError(f'Speed must be defined!')
+            raise ConfigError(f'Serial port speed must be defined for "{tmp}"!')
 
-        if device['ssh']:
-            if not device['ssh']['port']:
-                raise ConfigError(f'SSH port must be defined!')
+        if 'ssh' in device.keys():
+            if 'port' not in device['ssh'].keys():
+                raise ConfigError(f'SSH port must be defined for "{tmp}"!')
 
     return None
 
@@ -81,13 +81,20 @@ def generate(proxy):
     return None
 
 def apply(proxy):
+    call('systemctl stop conserver-server.service')
+    call('systemctl stop dropbear@*.service')
+
     if not proxy:
-        call('systemctl stop conserver-server.service')
         if os.path.isfile(config_file):
             os.unlink(config_file)
         return None
 
     call('systemctl restart conserver-server.service')
+
+    for device in proxy['device']:
+        if 'ssh' in proxy['device'][device].keys():
+            call('systemctl restart dropbear@{device}.service')
+
     return None
 
 if __name__ == '__main__':
diff --git a/src/systemd/dropbear@.service b/src/systemd/dropbear@.service
new file mode 100644
index 000000000..a4df6ad41
--- /dev/null
+++ b/src/systemd/dropbear@.service
@@ -0,0 +1,14 @@
+[Unit]
+Description=Dropbear SSH per-connection server
+Requires=dropbearkey.service
+Wants=conserver-server.service
+After=mongodb.service
+After=dropbearkey.service vyos-router.service conserver-server.service
+
+[Service]
+Type=forking
+ExecStartPre=/usr/bin/bash -c '/usr/bin/systemctl set-environment PORT=$(cli-shell-api returnValue service serial-proxy device "%I" ssh port)'
+ExecStart=-/usr/sbin/dropbear -w -j -k -r /etc/dropbear/dropbear_rsa_host_key -c "/usr/bin/console %I" -P /run/conserver/dropbear.%I.pid -p ${PORT}
+PIDFile=/run/conserver/dropbear.%I.pid
+KillMode=process
+
diff --git a/src/systemd/dropbearkey.service b/src/systemd/dropbearkey.service
new file mode 100644
index 000000000..770641c8b
--- /dev/null
+++ b/src/systemd/dropbearkey.service
@@ -0,0 +1,11 @@
+[Unit]
+Description=Dropbear SSH Key Generation
+ConditionPathExists=|!/etc/dropbear/dropbear_rsa_host_key
+
+[Service]
+ExecStart=/usr/bin/dropbearkey -t rsa -f /etc/dropbear/dropbear_rsa_host_key
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target
+