In particular, this adds in the support for ephemeral ssh keys provided
by credentials (passed from container managers or VM hypervisors). This
was introduced upstream by 071155a1fbac ("ssh-generator: support
ssh.ephemeral-key.all-users").
This change alone isn't enough to get this working. We now get this
SELinux denial:
type=AVC msg=audit(1750939616.931:111): avc: denied { read } for pid=1159 comm="sshd-session" name="ssh.ephemeral-authorized_keys-all" dev="tmpfs" ino=2 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:init_var_run_t:s0 tclass=file permissive=0
I have tested this with `setenforce 0`, however, and it works.
Resolves: rhbz#2374928
* The services are using ExecPre to start sshd-pre script
* The sshd-pre script substitutes token in standard configuration file and writes a new on in /run
* The services are using a file in /run as a sshd_config
* PartOf is needed to trigger sshd-keygen checks for sshd.service restarts
* sshd-keygen.target makes a level of abstraction to eliminate dupplicate
dependencies on both sshd and sshd@ services
Split out the host keygen into their own command, to ease future migration
to systemd. Compatitbility with the init script was kept.
Migrate the package to full native systemd unit files, according to the Fedora
packaging guidelines.
Prepate the unit files for running an ondemand server. (do not add it actually)
