vyos-cloud-init.git/cloudinit/config/cc_ssh.py, branch circinus-public-unmaintained

update ssh logs to show ssh private key gens pub and simplify code (#1221)

2022-01-28T18:24:55+00:00

Adopt Black and isort (SC-700) (#1157)

2021-12-16T02:16:38+00:00

Applied Black and isort, fixed any linting issues, updated tox.ini and CI.

cc_ssh.py: Add configuration for controlling ssh-keygen output (#1083)

2021-10-27T19:39:05+00:00

When ssh host keys are generated during initial boot the full output of ssh-keygen, including the randomart for the key, is displayed on the console for each of the generated key types, which takes up a large amount of screen output (17 lines per key type). With this change ssh-keygen output is still displayed by default. Setting ssh_quiet_keygen to True will prevent ssh-keygen output from appearing. If only the fingerprints of the host keys should be displayed then this can be achieved using the existing emit_keys_to_console and/or ssh_fp_console_blacklist settings.

cc_ssh.py: fix private key group owner and permissions (#1070)

2021-10-19T19:32:10+00:00

When default host keys are created by sshd-keygen (/etc/ssh/ssh_host_*_key) in RHEL/CentOS/Fedora, openssh it performs the following: # create new keys if ! $KEYGEN -q -t $KEYTYPE -f $KEY -C '' -N '' >&/dev/null; then exit 1 fi # sanitize permissions /usr/bin/chgrp ssh_keys $KEY /usr/bin/chmod 640 $KEY /usr/bin/chmod 644 $KEY.pub Note that the group ssh_keys exists only in RHEL/CentOS/Fedora. Now that we disable sshd-keygen to allow only cloud-init to create them, we miss the "sanitize permissions" part, where we set the group owner as ssh_keys and the private key mode to 640. According to https://bugzilla.redhat.com/show_bug.cgi?id=2013644#c8, failing to set group ownership and permissions like openssh does makes the RHEL openscap tool generate an error. Signed-off-by: Emanuele Giuseppe Esposito eesposit@redhat.com RHBZ: 2013644

docs: fix typo and include sudo for report bugs commands (#1022)

2021-09-17T13:06:49+00:00

Remove a duplicate "a" in the docs, and change the bug reporting documentation to tell users to run the commands with sudo. LP: #1940236

Support configuring SSH host certificates. (#660)

2020-11-20T20:59:51+00:00

Existing config writes keys to /etc/ssh after deleting files matching a glob that includes certificate files. Since sshd looks for certificates in the same directory as the keys, a host certificate must be placed in this directory. This update enables the certificate's contents to be specified along with the keys. Co-authored-by: jonathan lung Co-authored-by: jonathan lung

Update the list of valid ssh keys. (#487)

2020-08-21T16:23:24+00:00

Update ssh_util.py with latest list of keys (from openssh-8.3p1/sshkey.c), Added keys: sk-ecdsa-sha2-nistp256-cert-v01@openssh.com sk-ecdsa-sha2-nistp256@openssh.com sk-ssh-ed25519-cert-v01@openssh.com sk-ssh-ed25519@openssh.com ssh-xmss-cert-v01@openssh.com ssh-xmss@openssh.com LP: #1877869

Move subp into its own module. (#416)

2020-06-08T16:49:12+00:00

This was painful, but it finishes a TODO from cloudinit/subp.py. It moves the following from util to subp: ProcessExecutionError subp which target_path I moved subp_blob_in_tempfile into cc_chef, which is its only caller. That saved us from having to deal with it using write_file and temp_utils from subp (which does not import any cloudinit things now). It is arguable that 'target_path' could be moved to a 'path_utils' or something, but in order to use it from subp and also from utils, we had to get it out of utils.

cloud-init: fix capitalisation of SSH (#126)

2019-12-18T21:22:02+00:00

* cc_ssh: fix capitalisation of SSH * doc: fix capitalisation of SSH * cc_keys_to_console: fix capitalisation of SSH * ssh_util: fix capitalisation of SSH * DataSourceIBMCloud: fix capitalisation of SSH * DataSourceAzure: fix capitalisation of SSH * cs_utils: fix capitalisation of SSH * distros/__init__: fix capitalisation of SSH * cc_set_passwords: fix capitalisation of SSH * cc_ssh_import_id: fix capitalisation of SSH * cc_users_groups: fix capitalisation of SSH * cc_ssh_authkey_fingerprints: fix capitalisation of SSH

doc: update cc_ssh clarify host and auth keys

2019-12-18T20:58:25+00:00

* Add headers for Authorized and Host key sections, move the authorized section up as it is probably more relevant. LP: #1827021