移植sshd到JK2410開發板

移植sshd到JK2410開發板

1.      引言

SSH是由芬蘭的一家公司開發出來的，但是由於著作權和密碼編譯演算法的限制，openssh作為一種安全的網路服務應用程式在業界被廣泛應用。Openssh是ssh的代替軟體而且免費。在上篇文檔《移植OProfile到JK2410開發板》中有提到，Montavista公司提供的應用程式開發和系統分析工具devrocket在調試和分析效能時需要在開發板和主機之間建立一條串連，通過ssh協議通訊。由於JK2410開發板上沒有配置sshd伺服程式，所以需要將sshd移植到JK2410開發板上。

2.      環境

硬體環境：

Host：

       X86PC

Target：

JK2410開發板

 

軟體環境：

Host：

       VMware6

       OS：CentOS 5

       Strace調試工具

Target：

       OS： linux-2.6.18 pro500

       RootFS:initrd-edwin-25M.img

Strace 調試工具

3.      移植步驟

源碼包：

openssh-4.6p1.tar.gz   http://www.openssh.com/portable.html

openssl-0.9.8e.tar.gz      http://www.openssl.org/source

zlib-1.2.3.tar.tar            http://www.zlib.net/

 

編譯工具

       arm-9tdmi-linux-gnu-gcc 

   arm-9tdmi-linux-gnu-g++

 

3.1.   交叉編譯

在/work目下面建立ssh目錄

# mkdir /work/lib            ----〉共用庫目錄，通過nfs掛載

# mkdir /work/ssh           -----〉工作目錄

# cd /work/ssh

# mkdir compressed install source  -----〉compressed 用於存放源碼包

                                                               Install    軟體安裝目錄

                                                               Source    源碼包解壓目錄

#mv tarpakgs/openssh-4.6p1.tar.gz  /work/ssh/compressed

#mv tarpakgs/openssl-0.9.8e.tar.gz  /work/ssh/compressed

#mv tarpakgs/zlib-1.2.3.tar.tar       /work/ssh/compressed

 

交叉編譯 zlib

# cd /work/ssh/compressed/

# tar xvf zlib-1.2.3.tar.tar  -C ../source

# cd ../source/zlib-1.2.3

# ./configure--prefix=/work/ssh/install/zlib-1.2.3

# vim Makefile

CC=arm-9tdmi-linux-gnu-gcc

AR=arm-9tdmi-linux-gnu-ar rc

CPP =arm-9tdmi-linux-gnu-gcc -E

LDSHARED=arm-9tdmi-linux-gnu-gcc

 

# make

# make install

 

交叉編譯openssl

# cd /work/ssh/compressed/

# tar zxvf openssl-0.9.8e.tar.gz  -C ../source

# cd ../source/openssl-0.9.8e

# ./Configure--prefix=/work/ssh/install/openssl-0.9.8e os/compiler:arm-9tdmi-linux-gnu-gcc

 

# make

# make install

 

交叉編譯openssh

# cd /work/ssh/compressed

# tar zxvf openssh-4.6p1.tar.gz  –C ../source

# cd ../source/ openssh-4.6p1

#./configure --host=arm-9tdmi-linux-gnu--with-libs --with-zlib=/work/ssh/install/zlib-1.2.3--with-ssl-dir=/work/ssh/install/openssl-0.9.8e --disable-etc-default-loginCC=arm-9tdmi-linux-gnu-gcc AR=arm-9tdmi-linux-gnu-ar

 

 

列印出如下資訊：

OpenSSH has been configured with thefollowing options:

User binaries: /usr/local/bin

System binaries: /usr/local/sbin

Configuration files: /usr/local/etc

Askpass program:/usr/local/libexec/ssh-askpass

Manual pages: /usr/local/share/man/manX

PID file: /var/run

Privilege separation chroot path:/var/empty

sshd default user PATH:/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin

Manpage format: doc

PAM support: no

OSF SIA support: no

KerberosV support: no

SELinux support: no

Smartcard support: no

S/KEY support: no

TCP Wrappers support: no

MD5 password support: no

libedit support: no

Solaris process contract support: no

IP address in $DISPLAY hack: no

Translate v4 in v6 hack: yes

BSD Auth support: no

Random number source: OpenSSL internal ONLY

 

Host: arm-9tdmi-linux-gnu

Compiler: arm-9tdmi-linux-gnu-gcc

Compiler flags: -g -O2 -Wall-Wpointer-arith -Wuninitialized -Wsign-compare -std=gnu99

Preprocessor flags:-I/work/ssh/install/openssl-0.9.8e/include

                            -I/work/ssh/install/zlib-1.2.3/include

Linker flags: -L/work/ssh/install/openssl-0.9.8e/lib

                   -L/work/ssh/install/zlib-1.2.3/lib

Libraries:  -lresolv -lcrypto -lutil -lz -lnsl -lcrypt

 

3.2.   安裝sshd

按照上面列印出的資訊在根檔案系統中建立相應的目錄並把相應的檔案拷貝進去。

我的根檔案系統鏡像為/tftpboot/initrd-edwin-25M.img.

# cd /tftpboot/

# mkdir 25 && mount –oloopinitrd-edwin-25M.img  25

#cd 25/usr/local  && mkdir bin etc libexec sbin share

#cd /work/ssh/source/openssh-4.6p1

#cp scp sftp  ssh  ssh-add ssh-agent  ssh-keygen  ssh-keyscan /tftpboot/25/usr/local/bin

#cp moduli ssh_config  sshd_config  ssh_host_dsa_key  ssh_host_dsa_key.pub  ssh_host_key ssh_host_key.pub ssh_host_rsa_key ssh_host_rsa_key.pub /tftpboot/25/usr/local/etc

# cp sftp-server  ssh-keysign  /tftpboot/25/usr/local/libexec

# cp sshd  /tftpboot/25/usr/local/sbin

 

3.3.   搭建調試軟體環境

a)      u-boot參數設定

bootargs=root=/dev/ram0 rwconsole=ttySAC0,115200 mem=64Mramdisk=32768 initrd=0x30800000,25Minit=/linuxrc

 bootcmd=tftpboot 0x33000000 uImage;tftpboot 0x30800000 initrd-edwin-25M.img;bootm 33000000

 

b)     將kernel鏡像uImage和根檔案系統鏡像initrd-edwin-25M.img 拷貝到/tftpboot/目錄下

c)      設定系統啟動後將host機上/work目錄掛載到target機上/edwin

Target:

vim/etc/init.d/rcS

echo "mount/work to /edwin .....";

mount -t nfs192.168.167.131:/work /edwin -o nolock,rsize=1024,wsize=1024,timeo=15

d)     指定共用庫搜尋目錄

Target：

vim /etc/profile

 

# Set searchlibrary path

echo "Setsearch library path in /etc/profile"

exportLD_LIBRARY_PATH=/edwin/lib

 

#Set user path

echo "Setuser path in /etc/profile"

PATH=/bin:/sbin:/usr/bin:/usr/sbin

export PATH

e)      啟動sshd deamon程式

/usr/local/sbin/sshd

顯示缺少的庫檔案，將其拷貝到host主機上的/work/lib目錄下。

d)       用strace跟蹤sshd，查詢缺少的目錄和檔案，給與相應的添補。

strace –f  –F /usr/local/sbin/sshd

 

e)        調試成功後將sshd加入自啟動

Target：

vim /etc/profile

 

echo"start  sshd deamon routine....."

/usr/local/sbin/sshd

f)         

 

4.      問題及解決方案

[問題1]

# /usr/local/sbin/sshd

/usr/local/sbin/sshd: error while loadingshared libraries: libnsl.so.1: cannot open shared object file: No such file ordirectory

#

[分析與解決]

[root@localhost lib]# cp libnsl* /work/lib/

 

[問題2] 

# /usr/local/sbin/sshd

Privilege separation user sshd does notexist

#

[分析與解決]

沒有sshd使用者

sshd:x:74:74:Privilege-separatedSSH:/var/empty/sshd:/sbin/nologin

 

Host:

[root@localhost etc]# cp  /etc/passwd  shadow group   /work

 

Target:

mv /edwin/passwd   /etc

mv /edwin/group    /etc

mv /edwin/shadow  /etc

 

註：將root:x:0:0:root:/root:/bin/bash改為root:x:0:0:root:/root:/bin/sh

 

 [問題3]

# /usr/local/sbin/sshd

Missing privilege separation directory:/var/empty

#

 

 

[分析與解決]

# mkdir /var/empty

# /usr/local/sbin/sshd

#

 

 [問題4]

[root@localhost.ssh]# ssh -l root 192.168.167.132

root@192.168.167.132's password:

Permission denied, please try again.

 

[分析與解決]

按照下面列印的訊息，添補相應的檔案或者目錄，主要是使用者帳戶和密鑰相關的檔案。

Strace 分析如下：

 

stat64("/root/.ssh",{st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0

open("/etc/passwd", O_RDONLY)= 4

fcntl64(4, F_GETFD)= 0

fcntl64(4, F_SETFD, FD_CLOEXEC)= 0

fstat64(4, {st_mode=S_IFREG|0644,st_size=1908, ...}) = 0

mmap2(NULL, 4096, PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f13000

read(4,"root:x:0:0:root:/root:/bin/bash\n"..., 4096) = 1908

close(4)= 0

munmap(0xb7f13000, 4096)= 0

open("/root/.ssh/identity",O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or directory)

open("/root/.ssh/identity",O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or directory)

open("/root/.ssh/identity",O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or d = 0

fcntl64(4, F_SETFD, FD_CLOEXEC)= 0

fstat64(4, {st_mode=S_IFREG|0644,st_size=1908, ...}) = 0

mmap2(NULL, 4096, PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f13000

read(4,"root:x:0:0:root:/root:/bin/bash\n"..., 4096) = 1908

close(4) irectory)

open("/root/.ssh/identity.pub",O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or directory)

open("/etc/passwd", O_RDONLY)= 4

fcntl64(4, F_GETFD)= 0

munmap(0xb7f13000, 4096)= 0

open("/root/.ssh/id_rsa",O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or directory)

open("/root/.ssh/id_rsa",O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or directory)

open("/root/.ssh/id_rsa",O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or directory)

open("/root/.ssh/id_rsa.pub",O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or directory)

open("/etc/passwd", O_RDONLY)= 4

fcntl64(4, F_GETFD)= 0

fcntl64(4, F_SETFD, FD_CLOEXEC)= 0

fstat64(4, {st_mode=S_IFREG|0644,st_size=1908, ...}) = 0

mmap2(NULL, 4096, PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f13000

read(4,"root:x:0:0:root:/root:/bin/bash\n"..., 4096) = 1908

close(4)= 0

munmap(0xb7f13000, 4096)= 0

open("/root/.ssh/id_dsa",O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or directory)

open("/root/.ssh/id_dsa",O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or directory)

open("/root/.ssh/id_dsa",O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or directory)

open("/root/.ssh/id_dsa.pub",O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or directory)

open("/etc/passwd", O_RDONLY)= 4

fcntl64(4, F_GETFD)= 0

fcntl64(4, F_SETFD, FD_CLOEXEC)= 0

fstat64(4, {st_mode=S_IFREG|0644,st_size=1908, ...}) = 0

mmap2(NULL, 4096, PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f13000

read(4,"root:x:0:0:root:/root:/bin/bash\n"..., 4096) = 1908

close(4)= 0

munmap(0xb7f13000, 4096)= 0

open("/etc/passwd", O_RDONLY)= 4

fcntl64(4, F_GETFD)= 0

fcntl64(4, F_SETFD, FD_CLOEXEC)= 0

fstat64(4, {st_mode=S_IFREG|0644,st_size=1908, ...}) = 0

mmap2(NULL, 4096, PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f13000

read(4,"root:x:0:0:root:/root:/bin/bash\n"..., 4096) = 1908

 

[問題5]

# ./ssh-keygen

Generating public/private rsa key pair.

Enter file in which to save the key(/root/.ssh/id_rsa):

Could not create directory '/root/.ssh'.

 

[分析與解決]

# ls /

bin etc linuxrc nfs sys var dev jffs2lost+found  proc tmpfs yaffs2 edwin libmnt sbin usr

# cd /root

-sh: cd: can't cd to /root

# mkdir root

# cd /root

# mkdir .ssh

# ls -a

. .. .ssh

 

# ./ssh-keygen

Generating public/private rsa key pair.

Enter file in which to save the key(/root/.ssh/id_rsa):

Enter passphrase (empty for no passphrase):

Enter same passphrase again:

Your identification has been saved in/root/.ssh/id_rsa.

Your public key has been saved in/root/.ssh/id_rsa.pub.

The key fingerprint is:

76:dd:b7:c4:35:41:ce:35:97:5d:4e:36:54:fe:67:08root@(none)

 

# ./ssh-keygen -d

Generating public/private dsa key pair.

Enter file in which to save the key(/root/.ssh/id_dsa):

Enter passphrase (empty for no passphrase):

Enter same passphrase again:

Your identification has been saved in/root/.ssh/id_dsa.

Your public key has been saved in/root/.ssh/id_dsa.pub.

The key fingerprint is:

7a:96:b7:05:cf:d2:d1:e2:16:70:0a:6f:b2:62:12:d8root@(none)

 

[問題6]

# /usr/local/sbin/sshd

Missing privilege separation directory:/var/empty

 

[分析與解決]

# ls /var

# mkdir /var/empty

# /usr/local/sbin/sshd

#

 

 

[問題7]

[root@localhost ~]# ssh 192.168.167.132

ssh: connect to host 192.168.167.132 port22: Connection refused     

 

[分析與解決]

Target端sshd deamon程式沒有啟動。

 

/usr/local/sbin/sshd

[問題8]

Target 端sshd使用者的建立？

 

[分析與解決]

用busybox製作的根檔案系統提供的adduser和passwd命令和PC機上的使用方法不同。

PC機上建立帳戶：

[root@localhost 25]#adduser  test

[root@localhost 25]# passwd test

[root@localhost 25]# passwd test

Changing password for user test.

New UNIX password:

 

Target上建立帳戶：

首先要用-D選項設定不設定密碼，否則會提示：unknown  uid

# adduser –h /test  -s /bin/sh  -D  test

# passwd test

 

[問題9]

在用戶端ssh到target板後，使用者帳戶和密碼驗證通過，但是沒有啟動shell？

 

[分析與解決]

Step1:用strace跟蹤，沒有發現任何有價值的資訊。

Step2:修改openssh源碼使其列印出儘可能多的debug資訊。

       log.c檔案注釋掉以下兩行就可以列印所有的調試資訊了。

       //if(level > log_level)

              //return;

Step3:重新編譯openssh並按照3.2重新安裝sshd

Step4：target端建立/var/log目錄

Step5：啟動syslogd服務

Step6：啟動sshd，並且在host端ssh到target端

       Host:  /usr/local/sbin/sshd

       Target：ssh –l root  192.168.167.132

觀察var/log/messagesdebug資訊：

 

Jan 1 01:27:03 (none) auth.debug sshd[436]: debug1: session_by_channel:session 0 channel 0

Jan 1 01:27:03 (none) auth.debug sshd[436]: debug1:session_input_channel_req: session 0 req pty-req

Jan 1 01:27:03 (none) auth.debug sshd[436]: debug1: Allocating pty.

Jan  1 01:27:03 (none) auth.err sshd[436]: error: openpty: No such file or directory

Jan  1 01:27:03 (none) auth.err sshd[436]: error: session_pty_req: session 0 alloc failed

Jan 1 01:27:03 (none) auth.debug sshd[436]: debug1:server_input_channel_req: channel 0 request env reply 0

Jan 1 01:27:03 (none) auth.debug sshd[436]: debug1: session_by_channel:session 0 channel 0

Jan 1 01:27:03 (none) auth.debug sshd[436]: debug1:session_input_channel_req: session 0 req env

Jan 1 01:27:03 (none) auth.debug sshd[436]: debug2: Ignoring env requestLANG: disallowed name

Jan 1 01:27:03 (none) auth.debug sshd[436]: debug1:server_input_channel_req: channel 0 request shell reply 0

Jan 1 01:27:03 (none) auth.debug sshd[436]: debug1: session_by_channel:session 0 channel 0

Jan 1 01:27:03 (none) auth.debug sshd[436]: debug1:session_input_channel_req: session 0 req shell

Jan  1 01:27:03 (none) auth.err sshd[440]: error: setlogin failed: Illegal seek

Jan 1 01:27:03 (none) auth.debug sshd[436]: debug2: fd 3 setting TCP_NODELAY

Jan 1 01:27:03 (none) auth.debug sshd[436]: debug2: fd 7 setting O_NONBLOCK

 

在openssh源碼中搜尋openpty，發現在openpty函數中需要開啟許多裝置檔案，如: /dev/ptmx, pt, /dev/ptc等，意識到是不是缺少了相應的裝置檔案，因為製作根檔案系統時根據需要選擇部分的裝置檔案，並沒有添加完全。於是將所有的裝置檔案都添加進去

#cp –avf /dev/*   /tftpboot/25/dev/

重新啟動，還是不可以。

 

在網上搜尋openpty，找到解決方案解決“sshd makes error 'openpty:No such file or directory”

- mknod /dev/ptmx c 5 2

     chmod 666 /dev/ptmx

     mkdir /dev/pts

 

- Add to /etc/fstab:

      none            /dev/pts        devpts        gid=5,mode=620    0 0

      

(Note:  gid=5 is applicable for RedHat systems forwhich group "tty" has gid 5. Adjust according to your distribution. Use mode=600 if you want "mesg n" to be default.

 

- Mount /dev/pts

 

原貼在：http://www.patoche.org/LTT/kernel/00000172.html

 

按照上面的操作，從host端ssh到target端，ok。

 

5.      小結

Sshd總算移植成功了，很大一點感觸是：強烈建議製作根檔案系統時，把所有的裝置檔案添加上。Strace是個很好的跟蹤調試工具。