3

��b7�@s�dZd
dl
Z
d
dlZd
dlZd
dlmZmZmZ
d
dlm	Z	
ddddgZ
d	Zd
Zdg
Z
iZiZxre
D]jZejdeeedfi
�

ejd
eeeddfi
�

ejdeeeddfi
�

d
eede<qdWdZdd�Zdd�Zddd�
ZdS)a�
SSH
---
**Summary:** configure SSH and SSH keys (host and authorized)

This module handles most configuration for SSH and both host and authorized SSH
keys.

Authorized Keys
^^^^^^^^^^^^^^^

Authorized keys are a list of public SSH keys that are allowed to connect to
a user account on a system. They are stored in `.ssh/authorized_keys` in that
account's home directory. Authorized keys for the default user defined in
``users`` can be specified using ``ssh_authorized_keys``. Keys
should be specified as a list of public keys.

.. note::
    see the ``cc_set_passwords`` module documentation to enable/disable SSH
    password authentication

Root login can be enabled/disabled using the ``disable_root`` config key. Root
login options can be manually specified with ``disable_root_opts``. If
``disable_root_opts`` is specified and contains the string ``$USER``,
it will be replaced with the username of the default user. By default,
root login is disabled, and root login opts are set to::

    no-port-forwarding,no-agent-forwarding,no-X11-forwarding

Supported public key types for the ``ssh_authorized_keys`` are:

    - dsa
    - rsa
    - ecdsa
    - ed25519
    - ecdsa-sha2-nistp256-cert-v01@openssh.com
    - ecdsa-sha2-nistp256
    - ecdsa-sha2-nistp384-cert-v01@openssh.com
    - ecdsa-sha2-nistp384
    - ecdsa-sha2-nistp521-cert-v01@openssh.com
    - ecdsa-sha2-nistp521
    - sk-ecdsa-sha2-nistp256-cert-v01@openssh.com
    - sk-ecdsa-sha2-nistp256@openssh.com
    - sk-ssh-ed25519-cert-v01@openssh.com
    - sk-ssh-ed25519@openssh.com
    - ssh-dss-cert-v01@openssh.com
    - ssh-dss
    - ssh-ed25519-cert-v01@openssh.com
    - ssh-ed25519
    - ssh-rsa-cert-v01@openssh.com
    - ssh-rsa
    - ssh-xmss-cert-v01@openssh.com
    - ssh-xmss@openssh.com

.. note::
    this list has been filtered out from the supported keytypes of
    `OpenSSH`_ source, where the sigonly keys are removed. Please see
    ``ssh_util`` for more information.

    ``dsa``, ``rsa``, ``ecdsa`` and ``ed25519`` are added for legacy,
    as they are valid public keys in some old distros. They can possibly
    be removed in the future when support for the older distros are dropped

.. _OpenSSH: https://github.com/openssh/openssh-portable/blob/master/sshkey.c

Host Keys
^^^^^^^^^

Host keys are for authenticating a specific instance. Many images have default
host SSH keys, which can be removed using ``ssh_deletekeys``. This prevents
re-use of a private host key from an image on multiple machines. Since
removing default host keys is usually the desired behavior this option is
enabled by default.

Host keys can be added using the ``ssh_keys`` configuration key. The argument
to this config key should be a dictionary entries for the public and private
keys of each desired key type. Entries in the ``ssh_keys`` config dict should
have keys in the format ``<key type>_private``, ``<key type>_public``, and,
optionally, ``<key type>_certificate``, e.g. ``rsa_private: <key>``,
``rsa_public: <key>``, and ``rsa_certificate: <key>``. See below for supported
key types. Not all key types have to be specified, ones left unspecified will
not be used. If this config option is used, then no keys will be generated.

When host keys are generated the output of the ssh-keygen command(s) can be
displayed on the console using the ``ssh_quiet_keygen`` configuration key.
This settings defaults to False which displays the keygen output.

.. note::
    when specifying private host keys in cloud-config, care should be taken to
    ensure that the communication between the data source and the instance is
    secure

.. note::
    to specify multiline private host keys and certificates, use yaml
    multiline syntax

If no host keys are specified using ``ssh_keys``, then keys will be generated
using ``ssh-keygen``. By default one public/private pair of each supported
host key type will be generated. The key types to generate can be specified
using the ``ssh_genkeytypes`` config flag, which accepts a list of host key
types to use. For each host key type for which this module has been instructed
to create a keypair, if a key of the same type is already present on the
system (i.e. if ``ssh_deletekeys`` was false), no key will be generated.

Supported host key types for the ``ssh_keys`` and the ``ssh_genkeytypes``
config flags are:

    - rsa
    - dsa
    - ecdsa
    - ed25519

**Internal name:** ``cc_ssh``

**Module frequency:** per instance

**Supported distros:** all

**Config keys**::

    ssh_deletekeys: <true/false>
    ssh_keys:
        rsa_private: |
            -----BEGIN RSA PRIVATE KEY-----
            MIIBxwIBAAJhAKD0YSHy73nUgysO13XsJmd4fHiFyQ+00R7VVu2iV9Qco
            ...
            -----END RSA PRIVATE KEY-----
        rsa_public: ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAGEAoPRhIfLvedSDKw7Xd ...
        rsa_certificate: |
            ssh-rsa-cert-v01@openssh.com AAAAIHNzaC1lZDI1NTE5LWNlcnQt ...
        dsa_private: |
            -----BEGIN DSA PRIVATE KEY-----
            MIIBxwIBAAJhAKD0YSHy73nUgysO13XsJmd4fHiFyQ+00R7VVu2iV9Qco
            ...
            -----END DSA PRIVATE KEY-----
        dsa_public: ssh-dsa AAAAB3NzaC1yc2EAAAABIwAAAGEAoPRhIfLvedSDKw7Xd ...
        dsa_certificate: |
            ssh-dsa-cert-v01@openssh.com AAAAIHNzaC1lZDI1NTE5LWNlcnQt ...

    ssh_genkeytypes: <key type>
    disable_root: <true/false>
    disable_root_opts: <disable root options string>
    ssh_authorized_keys:
        - ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAGEA3FSyQwBI6Z+nCSjUU ...
        - ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA3I7VUf2l5gSn5uavROsc5HRDpZ ...
    allow_public_ssh_keys: <true/false>
    ssh_publish_hostkeys:
        enabled: <true/false> (Defaults to true)
        blacklist: <list of key types> (Defaults to [dsa])
    ssh_quiet_keygen: <true/false>
�N)�ssh_util�subp�util)
�ug_utilZrsaZdsaZecdsaZed25519z/etc/ssh/ssh_host_%s_keyTz
%s_privatei�
z	%s_publicz.pubz%s_certificatez	-cert.pubz;o=$(ssh-keygen -yf "%s") && echo "$o" root@localhost > "%s"c$CsT|
jd
d�r`t
jjdd�}xDtj|�
D]6}ytj|�

Wq&tk
rZ


tj|d|�
Yq&Xq&Wd|
k�
r�xb|
dj	�D]R\}}|t
kr�qxt
|d}	t
|d}
tj|	||
�
d	|krxd
|	i
}tj
|�

qxWx�tj	�D]�\}}
|
|
dks�||
dkr�q�t
|dt
|
d}}ddt||fg}yBtjd
dd��
tj|dd�
WdQRX|jd|�d|���

Wq�tk
�
r�


tj|d|�d|���
Yq�Xq�W�
nvtj|
dt�}t
jj�}d|d<�
xR|D�
]H}t|}t
jj|�
�
r�
q�tjt
jj|�
�

dd|ddd|g}tjd
dd���
yxtj|d|d�\}}tj|
dd��sTtjjtj|�
�

tj d�
}|d/k�r�t
j!|d0|�
t
j"|d�
t
j"|dd �
Wnptj#k
�r
}
zPtj|j$�
j%�}|j&dk�r�|j%�j'd!�
�r�|jd"|�
ntj|d#||�
WYdd}~XnXWdQRX�
q�Wd$|
k�rFtj|
d$d%t(�}tj|
d$d&t)�}nt(}t)}|�r�t*|d'�
}y|j+j,|�

Wn"tk
�r�


tj|d(�
YnXy�t-j.|
|j/�\}}t-j0|�
\}}tj|
d)d�} tj1|
d*tj2�}!g}"tj|
d+d��r�|j3��p�g}"n
|jd,�

d-|
k�r|
d-}#|"j4|#�

t5|"|| |!�
Wn"tk
�rN


tj|d.�
YnXdS)1NZssh_deletekeysTz	/etc/ssh/zssh_host_*key*zFailed deleting key file %sZssh_keysr
�
Z_certificateZHostCertificateZshz-xcz/etc/ssh)
�	recursiveF)
�capturezGenerated a key for z from zFailed generating a key for Zssh_genkeytypes�
CZLANGz
ssh-keygenz-tz-N�z-f)r�envZssh_quiet_keygeni�
z.pubi�
zunknown keyz!ssh-keygen: unknown key type '%s'z(Failed generating key type %s to file %sZssh_publish_hostkeys�	blacklistZenabled)
rzPublishing host keys failed!�disable_root�disable_root_optsZallow_public_ssh_keyszSSkipping import of publish SSH keys per config setting: allow_public_ssh_keys=FalseZssh_authorized_keysz Applying SSH credentials failed!���r)6�get�os�path�join�globrZdel_file�	ExceptionZlogexc�items�CONFIG_KEY_TO_FILEZ
write_filerZupdate_ssh_config�PRIV_TO_PUB�KEY_GEN_TPLZSeLinuxGuardr�debugZget_cfg_option_list�GENERATE_KEY_NAMES�environ�copy�KEY_FILE_TPL�existsZ
ensure_dir�dirnameZget_cfg_option_bool�sys�stdout�writeZ
decode_binaryZget_group_id�chown�chmodZProcessExecutionError�stderr�lowerZ	exit_code�
startswith�HOST_KEY_PUBLISH_BLACKLIST�PUBLISH_HOST_KEYS�get_public_host_keysZ
datasourceZpublish_host_keysrZnormalize_users_groupsZdistroZextract_defaultZget_cfg_option_strZDISABLE_USER_OPTSZget_public_ssh_keys�extend�apply_credentials)$�_nameZcfgZcloud�logZ_argsZkey_pth�
f�key�valZtgt_fnZ	tgt_permsZcert_configZprivate_typeZpublic_typeZprivate_fileZpublic_file�cmdZgenkeysZlang_cZkeytypeZkeyfile�out�err�gid�
eZhost_key_blacklistZpublish_hostkeysZhostkeysZusersZ_groups�userZ_user_configr
r�keysZcfgkeys�r:�/usr/lib/python3.6/cc_ssh.py�handle�s�






















 


























(


























r<cCsVt|�
}|
rt
j||
�
|r>|
s$d
}
|jd|
�}|jdd�}nd}t
j|d|d�
dS)NZNONEz$USERz
$DISABLE_USER�rootr
)
Zoptions)�setrZsetup_user_keys�replace)r9r8r
rZ
key_prefixr:r:r;r-H
s





r-c
s�d
tf
�
g}
g�|r(�
f
dd�|D�
��f
dd�t
j
�
d	�
D�
}xD|D]<}tj|�
}|j�}|rJt|�
dkrJ|
jt|dd��
�

qJW|
S)
a
Read host keys from /etc/ssh/*.pub files and return them as a list.

    @param blacklist: List of key types to ignore. e.g. ['dsa', 'rsa']
    @returns: List of keys, each formatted as a two-element tuple.
        e.g. [('ssh-rsa', 'AAAAB3Nz...'), ('ssh-ed25519', 'AAAAC3Nx...')]
    z%s.pubc
sg|]}
�|
f
�qSr:r:)�.0Zkey_type)
�public_key_file_tmplr:r;�
<listcomp>g
sz(get_public_host_keys.<locals>.<listcomp>c
sg|]}
|
�kr|
�qSr:r:)r@Zhostfile)
�blacklist_filesr:r;rBk
s

�
*rN�)
rD)rrrZ	load_file�split�len�append�tuple)rZkey_listZ	file_list�	file_nameZ
file_contentsZkey_datar:)rCrAr;r+Y
s












r+)
N)�__doc__rrr!Z	cloudinitrrrZcloudinit.distrosrrrr*r)rr�
k�updaterr<r-r+r:r:r:r;�<module>�s.