output public ssh host keys to console on boot (LP: #893400)

Currently cloud-init writes something like this to console output:
  ec2: #############################################################
  ec2: -----BEGIN SSH HOST KEY FINGERPRINTS-----
  ec2: 2048 78:ae:f3:91:04:6f:8d:ee:ef:e1:2d:72:83:6a:d0:82  root@h (RSA)
  ec2: 1024 d3:b6:32:64:22:d4:43:05:f9:25:b4:f3:65:4e:e2:51  root@h (DSA)
  ec2: -----END SSH HOST KEY FINGERPRINTS-----
  ec2: #############################################################

the key fingerprints are useful for humans to read, but not so useful
for machines, as you cannot populate a KnownHostsFile (~/.ssh/known_hosts)
from the data there.

This change adds output like:
  -----BEGIN SSH HOST KEY KEYS-----
  ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdH......STI= root@h
  ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDYRIQe6m......tWF3 root@h
  -----END SSH HOST KEY KEYS-----

Those lines can easily be grabbed and appended to a known_hosts file.

1 files changed, 7 insertions, 0 deletions

diff --git a/doc/examples/cloud-config.txt b/doc/examples/cloud-config.txt
index 3c9e4b2e..d67b572c 100644
--- a/doc/examples/cloud-config.txt
+++ b/doc/examples/cloud-config.txt
@@ -546,3 +546,10 @@ manual_cache_clean: False
 # ssh_genkeytypes: ['rsa', 'dsa', 'ecdsa']
 #    a list of the ssh key types that should be generated
 #    These are passed to 'ssh-keygen -t'
+
+## configuration of ssh keys output to console
+# ssh_fp_console_blacklist: []
+# ssh_key_console_blacklist: [ssh-dss]
+#   A list of key types (first token of a /etc/ssh/ssh_key_*.pub file)
+#   that should be skipped when outputting key fingerprints and keys
+#   to the console respectively.