1

I have an OPNsense 19.1 virtual firewall, which is based on FreeBSD 11.2 HBSD (HardenedBSD).

I added it to Ansible Server inventory (with the right configurations), and once copied the PK to that BSD /root/.ssh/authorized_keys, I can connect to it (yes, running commands as root, it is in an isolated training environment).

The issue is that when I reboot or turn off and on the machine, that authorized_keys file disappears.

The file permissions are 600 (-rw-------).

Do you know why this happens and how to solve it? As far as I could see, in a normal FreeBSD I think there's no problem in having authorized_keys file in the root account...

  • Could it be that a root home is mounted as tmpfs? Run mount without arguments to check. – arrowd Apr 4 at 10:08
  • I already checked that, it is not, indeed, other files I edit in /root remain there, and even the .ssh/known_hosts file – xCovelus Apr 4 at 10:54
1

To solve the issue, I'm afraid, you'll have to fight OPNsense 19.1 and find out how OPNsense handles roots authorized_keys.

The issue is that when I reboot or turn off and on the machine, that authorized_keys file disappears.

But there is an option to ssh as a non-root user and sudo su. This is a better practice especially with Ansible. Ansible needs the remote user to use /bin/sh. By default FreeBSD root uses /bin/csh. Ansible best practice is to ssh as a remote_user and escalate privilege (become: yes) to root (become_user: root).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.