output public ssh host keys to console on boot (LP: #893400)

Currently cloud-init writes something like this to console output:
  ec2: #############################################################
  ec2: -----BEGIN SSH HOST KEY FINGERPRINTS-----
  ec2: 2048 78:ae:f3:91:04:6f:8d:ee:ef:e1:2d:72:83:6a:d0:82  root@h (RSA)
  ec2: 1024 d3:b6:32:64:22:d4:43:05:f9:25:b4:f3:65:4e:e2:51  root@h (DSA)
  ec2: -----END SSH HOST KEY FINGERPRINTS-----
  ec2: #############################################################

the key fingerprints are useful for humans to read, but not so useful
for machines, as you cannot populate a KnownHostsFile (~/.ssh/known_hosts)
from the data there.

This change adds output like:
  -----BEGIN SSH HOST KEY KEYS-----
  ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdH......STI= root@h
  ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDYRIQe6m......tWF3 root@h
  -----END SSH HOST KEY KEYS-----

Those lines can easily be grabbed and appended to a known_hosts file.

1 files changed, 7 insertions, 2 deletions

diff --git a/cloudinit/CloudConfig/cc_keys_to_console.py b/cloudinit/CloudConfig/cc_keys_to_console.py
index 47227b76..79dd2ea9 100644
--- a/cloudinit/CloudConfig/cc_keys_to_console.py
+++ b/cloudinit/CloudConfig/cc_keys_to_console.py
@@ -16,15 +16,20 @@
 #    You should have received a copy of the GNU General Public License
 #    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 from cloudinit.CloudConfig import per_instance
+import cloudinit.util as util
 import subprocess
 
 frequency = per_instance
 
 def handle(name,cfg,cloud,log,args):
-    write_ssh_prog='/usr/lib/cloud-init/write-ssh-key-fingerprints'
+    cmd = [ '/usr/lib/cloud-init/write-ssh-key-fingerprints' ]
+    fp_blacklist = util.get_cfg_option_list_or_str(cfg, "ssh_fp_console_blacklist", [])
+    key_blacklist = util.get_cfg_option_list_or_str(cfg, "ssh_key_console_blacklist", ["ssh-dss"])
     try:
         confp = open('/dev/console',"wb")
-        subprocess.call(write_ssh_prog,stdout=confp)
+        cmd.append(','.join(fp_blacklist))
+        cmd.append(','.join(key_blacklist))
+        subprocess.call(cmd, stdout=confp)
         confp.close()
     except:
         log.warn("writing keys to console value")