3

I'm starting dropbear ssh server in initramfs to be able to unlock a crypted partition over SSH*.

In Debian Jessie, it was all fine but in Buster, dropbear doesn't seem to stop after switch_root, which prevents OpenBSD ssh server from starting up.

apt-get purge dropbear does not help and which dropbear prints /usr/bin/dropbear and ps -ef | grep dropbear prints /sbin/dropbear; which tells that this process is the one which started at initramfs stage and it didn't stop.

As a workaround, I'm doing killall dropbear in SSH service script but it would be more appropriate to kill it right before switching the root partition.

How can I run the script at that point?

Improve this question

2 Answers 2

Reset to default
3

Create the cleanup script as /etc/initramfs-tools/scripts/init-bottom/cleanup.sh:

#!/bin/sh
echo "Killing dropbear"
killall dropbear
exit 0

...and make it executable:

chmod +x /etc/initramfs-tools/scripts/init-bottom/cleanup.sh

Update initramfs as usual:

update-initramfs -u
Improve this answer
1

You already have a script that calls switch_root, so just insert a line there to stop dropbear.

You can also stop it from within your ssh connection. As soon as you log in, there are two dropbear processes. The first is the process that accepts new connections, the secons is the process serving your connection. At this point you can kill the first process, as you don't want more than one connection. The second process will terminate once you disconnect.

At this early stage in the boot process, you can be sure that the process accepting new connections has the lower process number, although there are other ways to identify it.

Improve this answer
2
  • 1. If user mistakenly forgets to kill dropbear, the target machine will boot up correctly but since dropbear isn't killed, ssh won't start, so user will never reach the target machine. 2. I don't have an access to the script that contains switch_root, I know that function from Gentoo. Commented Aug 3, 2018 at 9:25
  • 1. If you stop the listener process, another process will be able to listen on the port. 2. You already modified the startup process to start dropbear. 3. There is nothing wrong with killing dropbear later. 4. You can have dropbear listen on another port. Commented Aug 6, 2018 at 5:37

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.