From 165d6d34a370d3948160732e8136ec08084edf2f Mon Sep 17 00:00:00 2001 From: cproudlock Date: Mon, 5 Oct 2026 12:42:10 -0400 Subject: [PATCH] blancco-init: debug boots open SSH for root With blancco.debug=1 the init now also creates /etc/debug.environment in the new root (Blancco's isDebugMode, so 2_sshd starts sshd) and installs root's authorized_keys from http:///blancco/debug_authorized_keys. Root is locked and sshd is key-only, so normal boots stay closed and a debug boot without that file on the server stays closed too. Used to find where Albus keeps the finished report in process=auto, which never auto-backs-up to the share. Live GetPxeScript.aspx has a matching "Blancco Drive Eraser (debug / SSH)" item (UEFI, 7.0 kernel, verbose); not in the playbook menu. --- playbook/blancco-init.sh | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/playbook/blancco-init.sh b/playbook/blancco-init.sh index 662986f..6fe2e35 100644 --- a/playbook/blancco-init.sh +++ b/playbook/blancco-init.sh @@ -271,6 +271,22 @@ XEOF chmod +x /run/newroot/etc/X11/xinit/xinitrc.d/00-no-screen-blank.sh mkdir -p /run/newroot/proc /run/newroot/sys /run/newroot/dev /run/newroot/run /run/newroot/tmp +# Debug boots only: Blancco's own debug mode (/etc/debug.environment makes +# isDebugMode true, so 2_sshd starts sshd) plus an SSH key for root. +# Root is locked and sshd is key-only, so without the key there is no way +# in. The key is served from the PXE server and never baked in here. +if [ -n "$DEBUG" ]; then + touch /run/newroot/etc/debug.environment + mkdir -p /run/newroot/root/.ssh + if wget -q -T 10 -O /run/newroot/root/.ssh/authorized_keys "http://$SERVER/blancco/debug_authorized_keys"; then + chmod 700 /run/newroot/root/.ssh + chmod 600 /run/newroot/root/.ssh/authorized_keys + echo " debug: sshd on, root key installed" + else + echo " debug: no debug_authorized_keys on server, SSH stays closed" + fi +fi + mount --move /proc /run/newroot/proc mount --move /sys /run/newroot/sys mount --move /dev /run/newroot/dev