From 59d4175c87b86dcee461ba4b67dba2b546d65728 Mon Sep 17 00:00:00 2001 From: Scott Moser Date: Tue, 20 Dec 2011 00:13:07 -0500 Subject: output public ssh host keys to console on boot (LP: #893400) Currently cloud-init writes something like this to console output: ec2: ############################################################# ec2: -----BEGIN SSH HOST KEY FINGERPRINTS----- ec2: 2048 78:ae:f3:91:04:6f:8d:ee:ef:e1:2d:72:83:6a:d0:82 root@h (RSA) ec2: 1024 d3:b6:32:64:22:d4:43:05:f9:25:b4:f3:65:4e:e2:51 root@h (DSA) ec2: -----END SSH HOST KEY FINGERPRINTS----- ec2: ############################################################# the key fingerprints are useful for humans to read, but not so useful for machines, as you cannot populate a KnownHostsFile (~/.ssh/known_hosts) from the data there. This change adds output like: -----BEGIN SSH HOST KEY KEYS----- ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdH......STI= root@h ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDYRIQe6m......tWF3 root@h -----END SSH HOST KEY KEYS----- Those lines can easily be grabbed and appended to a known_hosts file. --- cloudinit/CloudConfig/cc_keys_to_console.py | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) (limited to 'cloudinit/CloudConfig/cc_keys_to_console.py') diff --git a/cloudinit/CloudConfig/cc_keys_to_console.py b/cloudinit/CloudConfig/cc_keys_to_console.py index 47227b76..79dd2ea9 100644 --- a/cloudinit/CloudConfig/cc_keys_to_console.py +++ b/cloudinit/CloudConfig/cc_keys_to_console.py @@ -16,15 +16,20 @@ # You should have received a copy of the GNU General Public License # along with this program. If not, see . from cloudinit.CloudConfig import per_instance +import cloudinit.util as util import subprocess frequency = per_instance def handle(name,cfg,cloud,log,args): - write_ssh_prog='/usr/lib/cloud-init/write-ssh-key-fingerprints' + cmd = [ '/usr/lib/cloud-init/write-ssh-key-fingerprints' ] + fp_blacklist = util.get_cfg_option_list_or_str(cfg, "ssh_fp_console_blacklist", []) + key_blacklist = util.get_cfg_option_list_or_str(cfg, "ssh_key_console_blacklist", ["ssh-dss"]) try: confp = open('/dev/console',"wb") - subprocess.call(write_ssh_prog,stdout=confp) + cmd.append(','.join(fp_blacklist)) + cmd.append(','.join(key_blacklist)) + subprocess.call(cmd, stdout=confp) confp.close() except: log.warn("writing keys to console value") -- cgit v1.2.3