diff options
| -rw-r--r-- | ChangeLog | 1 | ||||
| -rw-r--r-- | cloudinit/CloudConfig/cc_keys_to_console.py | 9 | ||||
| -rw-r--r-- | doc/examples/cloud-config.txt | 7 | ||||
| -rwxr-xr-x | tools/write-ssh-key-fingerprints | 16 |
4 files changed, 31 insertions, 2 deletions
@@ -10,6 +10,7 @@ - config change: 'retries' dropped, 'max_wait' added, timeout increased - close stdin in all cloud-init programs that are launched at boot (LP: #903993) - revert management of /etc/hosts to 0.6.1 style (LP: #890501, LP: #871966) + - write full ssh keys to console for easy machine consumption (LP: #893400) 0.6.2: - fix bug where update was not done unless update was explicitly set. It would not be run if 'upgrade' or packages were set to be installed diff --git a/cloudinit/CloudConfig/cc_keys_to_console.py b/cloudinit/CloudConfig/cc_keys_to_console.py index 47227b76..79dd2ea9 100644 --- a/cloudinit/CloudConfig/cc_keys_to_console.py +++ b/cloudinit/CloudConfig/cc_keys_to_console.py @@ -16,15 +16,20 @@ # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. from cloudinit.CloudConfig import per_instance +import cloudinit.util as util import subprocess frequency = per_instance def handle(name,cfg,cloud,log,args): - write_ssh_prog='/usr/lib/cloud-init/write-ssh-key-fingerprints' + cmd = [ '/usr/lib/cloud-init/write-ssh-key-fingerprints' ] + fp_blacklist = util.get_cfg_option_list_or_str(cfg, "ssh_fp_console_blacklist", []) + key_blacklist = util.get_cfg_option_list_or_str(cfg, "ssh_key_console_blacklist", ["ssh-dss"]) try: confp = open('/dev/console',"wb") - subprocess.call(write_ssh_prog,stdout=confp) + cmd.append(','.join(fp_blacklist)) + cmd.append(','.join(key_blacklist)) + subprocess.call(cmd, stdout=confp) confp.close() except: log.warn("writing keys to console value") diff --git a/doc/examples/cloud-config.txt b/doc/examples/cloud-config.txt index 3c9e4b2e..d67b572c 100644 --- a/doc/examples/cloud-config.txt +++ b/doc/examples/cloud-config.txt @@ -546,3 +546,10 @@ manual_cache_clean: False # ssh_genkeytypes: ['rsa', 'dsa', 'ecdsa'] # a list of the ssh key types that should be generated # These are passed to 'ssh-keygen -t' + +## configuration of ssh keys output to console +# ssh_fp_console_blacklist: [] +# ssh_key_console_blacklist: [ssh-dss] +# A list of key types (first token of a /etc/ssh/ssh_key_*.pub file) +# that should be skipped when outputting key fingerprints and keys +# to the console respectively. diff --git a/tools/write-ssh-key-fingerprints b/tools/write-ssh-key-fingerprints index 7b2fc62c..5723c989 100755 --- a/tools/write-ssh-key-fingerprints +++ b/tools/write-ssh-key-fingerprints @@ -1,12 +1,28 @@ #!/bin/sh +fp_blist=",${1}," +key_blist=",${2}," { echo echo "#############################################################" echo "-----BEGIN SSH HOST KEY FINGERPRINTS-----" for f in /etc/ssh/ssh_host_*key.pub; do [ -f "$f" ] || continue + read ktype line < "$f" + # skip the key if its type is in the blacklist + [ "${fp_blist#*,$ktype,}" = "${fp_blist}" ] || continue ssh-keygen -l -f "$f" done echo "-----END SSH HOST KEY FINGERPRINTS-----" echo "#############################################################" + } | logger -p user.info -s -t "ec2" + +echo -----BEGIN SSH HOST KEY KEYS----- +for f in /etc/ssh/ssh_host_*key.pub; do + [ -f "$f" ] || continue + read ktype line < "$f" + # skip the key if its type is in the blacklist + [ "${key_blist#*,$ktype,}" = "${key_blist}" ] || continue + cat $f +done +echo -----END SSH HOST KEY KEYS----- |