dropbearkey -t <密钥类型> -f <密钥文件> [-s <密钥大小>] [-C <注释>]
dropbearkey -y -f <密钥文件>    # 显示公钥信息

# 生成 Ed25519 主机密钥
sudo dropbearkey -t ed25519 -f /etc/dropbear/dropbear_ed25519_host_key

# 生成用户密钥
dropbearkey -t ed25519 -f ~/.ssh/id_dropbear_ed25519

# 带注释
dropbearkey -t ed25519 -f ~/.ssh/id_dropbear_ed25519 -C "admin@mydevice"

# 生成 RSA 主机密钥（默认 2048-bit）
sudo dropbearkey -t rsa -s 4096 -f /etc/dropbear/dropbear_rsa_host_key

# 生成用户密钥
dropbearkey -t rsa -s 4096 -f ~/.ssh/id_dropbear_rsa

# 带注释
dropbearkey -t rsa -s 4096 -f ~/.ssh/id_dropbear_rsa -C "admin@mydevice"

# 生成 256-bit ECDSA 密钥
dropbearkey -t ecdsa -s 256 -f /etc/dropbear/dropbear_ecdsa_host_key

# 生成 384-bit ECDSA 密钥
dropbearkey -t ecdsa -s 384 -f /etc/dropbear/dropbear_ecdsa_host_key

# 生成 521-bit ECDSA 密钥
dropbearkey -t ecdsa -s 521 -f /etc/dropbear/dropbear_ecdsa_host_key

# 生成 DSS 密钥（不推荐）
dropbearkey -t dss -f /etc/dropbear/dropbear_dss_host_key

# 显示公钥信息和指纹
dropbearkey -y -f /etc/dropbear/dropbear_ed25519_host_key

# 输出示例：
# Public key portion is:
# ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGrSX5zYpE9HGMN7QjHr3Xbx8VW6R8QmY2j admin@mydevice
# Fingerprint: SHA256:xR3bP7kF9v2mL5nQ4wJ8hT6yU1iO3pA5sD7fG9hJ

# 提取公钥到单独文件
dropbearkey -y -f /etc/dropbear/dropbear_ed25519_host_key | \
    head -2 | tail -1 > /etc/dropbear/dropbear_ed25519_host_key.pub

# 验证
cat /etc/dropbear/dropbear_ed25519_host_key.pub

#!/bin/sh
# get_key_info.sh - 提取密钥信息

KEYFILE="$1"
if [ -z "$KEYFILE" ] || [ ! -f "$KEYFILE" ]; then
    echo "用法: $0 <密钥文件>"
    exit 1
fi

echo "=== 密钥信息 ==="
echo "文件: $KEYFILE"
echo "大小: $(du -h "$KEYFILE" | awk '{print $1}')"
echo ""

# 获取完整输出
OUTPUT=$(dropbearkey -y -f "$KEYFILE" 2>&1)

echo "$OUTPUT"
echo ""

# 提取指纹
FINGERPRINT=$(echo "$OUTPUT" | grep Fingerprint | awk '{print $NF}')
echo "指纹 (可复制): $FINGERPRINT"

# 提取公钥行
PUBKEY=$(echo "$OUTPUT" | grep "^ssh-")
echo "公钥 (可复制): $PUBKEY"

dropbearconvert <输入格式> <输出格式> <输入文件> <输出文件>

# RSA 私钥转换
dropbearconvert dropbear openssh ~/.ssh/id_dropbear_rsa ~/.ssh/id_rsa

# Ed25519 私钥转换
dropbearconvert dropbear openssh ~/.ssh/id_dropbear_ed25519 ~/.ssh/id_ed25519

# ECDSA 私钥转换
dropbearconvert dropbear openssh ~/.ssh/id_dropbear_ecdsa ~/.ssh/id_ecdsa

# RSA 私钥转换
dropbearconvert openssh dropbear ~/.ssh/id_rsa ~/.ssh/id_dropbear_rsa

# Ed25519 私钥转换
dropbearconvert openssh dropbear ~/.ssh/id_ed25519 ~/.ssh/id_dropbear_ed25519

# ECDSA 私钥转换
dropbearconvert openssh dropbear ~/.ssh/id_ecdsa ~/.ssh/id_dropbear_ecdsa

#!/bin/sh
# convert_keys.sh - 批量密钥格式转换

INPUT_DIR="$1"
OUTPUT_DIR="$2"
FORMAT="${3:-openssh}"  # 目标格式：openssh 或 dropbear

if [ -z "$INPUT_DIR" ] || [ -z "$OUTPUT_DIR" ]; then
    echo "用法: $0 <输入目录> <输出目录> [openssh|dropbear]"
    exit 1
fi

mkdir -p "$OUTPUT_DIR"

# 检测源格式
detect_format() {
    local file="$1"
    head -1 "$file" | grep -q "DROPBEAR" && echo "dropbear" || echo "openssh"
}

# 转换密钥
for keyfile in "$INPUT_DIR"/id_*; do
    [ -f "$keyfile" ] || continue
    [ "${keyfile%.pub}" = "$keyfile" ] || continue  # 跳过公钥
    
    SOURCE_FORMAT=$(detect_format "$keyfile")
    BASENAME=$(basename "$keyfile")
    OUTPUT_FILE="$OUTPUT_DIR/$BASENAME"
    
    echo "转换: $BASENAME ($SOURCE_FORMAT → $FORMAT)"
    dropbearconvert "$SOURCE_FORMAT" "$FORMAT" "$keyfile" "$OUTPUT_FILE"
    chmod 600 "$OUTPUT_FILE"
done

echo "转换完成"

# 生产环境：Ed25519 + RSA 双密钥
dropbearkey -t ed25519 -f /etc/dropbear/dropbear_ed25519_host_key
dropbearkey -t rsa -s 3072 -f /etc/dropbear/dropbear_rsa_host_key

# 极简环境：仅 Ed25519（最小化攻击面和存储）
dropbearkey -t ed25519 -f /etc/dropbear/dropbear_ed25519_host_key

# 主机密钥权限
sudo chmod 600 /etc/dropbear/dropbear_*_host_key
sudo chown root:root /etc/dropbear/dropbear_*_host_key

# 用户密钥权限
chmod 600 ~/.ssh/id_*

# 验证
ls -la /etc/dropbear/
ls -la ~/.ssh/

#!/bin/sh
# key_rotation.sh - 自动化密钥轮换

KEY_DIR="/etc/dropbear"
BACKUP_DIR="/etc/dropbear/archived_keys/$(date +%Y%m%d)"
LOG_FILE="/var/log/key-rotation.log"

log() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') $1" >> "$LOG_FILE"
    echo "$1"
}

# 备份现有密钥
mkdir -p "$BACKUP_DIR"
for key in "$KEY_DIR"/dropbear_*_host_key; do
    [ -f "$key" ] && cp "$key" "$BACKUP_DIR/"
done
log "密钥已备份到 $BACKUP_DIR"

# 生成新密钥
for keytype in ed25519 rsa; do
    keyfile="$KEY_DIR/dropbear_${keytype}_host_key"
    [ -f "$keyfile" ] && rm -f "$keyfile"
    dropbearkey -t "$keytype" -s 3072 -f "$keyfile" 2>/dev/null || \
    dropbearkey -t "$keytype" -f "$keyfile"
    log "已重新生成 ${keytype} 主机密钥"
done

# 显示新指纹
log "=== 新主机密钥指纹 ==="
for keyfile in "$KEY_DIR"/dropbear_*_host_key; do
    fp=$(dropbearkey -y -f "$keyfile" 2>&1 | grep Fingerprint | awk '{print $NF}')
    log "  $(basename $keyfile): $fp"
done

# 重启服务
if command -v systemctl >/dev/null 2>&1; then
    systemctl restart dropbear && log "Dropbear 已通过 systemctl 重启"
else
    kill -HUP $(cat /var/run/dropbear.pid 2>/dev/null) 2>/dev/null
    log "已发送 HUP 信号给 Dropbear"
fi

log "密钥轮换完成"

#!/bin/sh
# device_key_lifecycle.sh - 嵌入式设备密钥生命周期管理

ACTION="$1"
DEVICE="$2"
KEY_DIR="/etc/dropbear"

case "$ACTION" in
    generate)
        echo "为新设备生成密钥..."
        for keytype in ed25519 rsa; do
            dropbearkey -t "$keytype" -f "$KEY_DIR/dropbear_${keytype}_host_key"
        done
        echo "密钥已生成"
        ;;
    
    fingerprint)
        echo "设备主机密钥指纹:"
        for keyfile in "$KEY_DIR"/dropbear_*_host_key; do
            echo "  $(basename $keyfile):"
            dropbearkey -y -f "$keyfile" 2>&1 | grep -E "^(ssh-|Fingerprint)"
        done
        ;;
    
    backup)
        BACKUP="/tmp/device_keys_$(date +%Y%m%d).tar.gz"
        tar czf "$BACKUP" "$KEY_DIR"/dropbear_*_host_key
        echo "密钥已备份到 $BACKUP"
        ;;
    
    rotate)
        echo "轮换密钥..."
        for keytype in ed25519 rsa; do
            keyfile="$KEY_DIR/dropbear_${keytype}_host_key"
            [ -f "$keyfile" ] && rm -f "$keyfile"
            dropbearkey -t "$keytype" -f "$keyfile"
        done
        echo "密钥已轮换，请重启 Dropbear"
        ;;
    
    *)
        echo "用法: $0 {generate|fingerprint|backup|rotate} [device]"
        ;;
esac