Change default authorizedkeys file #586
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The following commit merged all ssh keys into a default user file "~/.ssh/authorized_keys" in sshd_config had multiple files configured for AuthorizedKeysFile: commit f1094b1 Author: Eduardo Otubo <otubo@redhat.com> Date: Thu Dec 5 17:37:35 2019 +0100 Multiple file fix for AuthorizedKeysFile config (canonical#60) This commit ignored the case when sshd_config would have a single file for AuthorizedKeysFile, but a non default configuration, for example "~/.ssh/authorized_keys_foobar". In this case cloud-init would grab all keys from this file and write a new one, the default "~/.ssh/authorized_keys" causing the bug. rhbz: #1862967 Signed-off-by: Eduardo Otubo <otubo@redhat.com>
|
The commit that adapts the test cases also fixes the second test case |
igalic
approved these changes
Oct 6, 2020
| @@ -593,7 +593,7 @@ def test_multiple_authorizedkeys_file_order1(self, m_getpwnam): | |||
| fpw.pw_name, sshd_config) | |||
| content = ssh_util.update_authorized_keys(auth_key_entries, []) | |||
|
|
|||
| self.assertEqual("%s/.ssh/authorized_keys" % fpw.pw_dir, auth_key_fn) | |||
| self.assertEqual(authorized_keys, auth_key_fn) | |||
| self.assertTrue(VALID_CONTENT['rsa'] in content) | |||
| self.assertTrue(VALID_CONTENT['dsa'] in content) | |||
There was a problem hiding this comment.
unrelatedly, it's probably high time to retire DSA
OddBloke
approved these changes
Oct 15, 2020
TheRealFalcon
added a commit
to TheRealFalcon/cloud-init
that referenced
this pull request
Dec 2, 2020
If a non-default AuthorizedKeysFile is specified in /etc/ssh/sshd_config, ensure we can still ssh as expected
TheRealFalcon
added a commit
to TheRealFalcon/cloud-init
that referenced
this pull request
Dec 2, 2020
If a non-default AuthorizedKeysFile is specified in /etc/ssh/sshd_config, ensure we can still ssh as expected
TheRealFalcon
added a commit
to TheRealFalcon/cloud-init
that referenced
this pull request
Dec 2, 2020
If a non-default AuthorizedKeysFile is specified in /etc/ssh/sshd_config, ensure we can still ssh as expected
3 tasks
OddBloke
pushed a commit
that referenced
this pull request
Dec 3, 2020
blackboxsw
added a commit
to blackboxsw/cloud-init
that referenced
this pull request
Jan 14, 2021
…cal#586) Revert PR canonical#586 related to where cloud-init writes authorized keys. Avoid storing all the ssh keys for all users into the default ssh config AuthorizedKeysFiles. LP: #1839061
OddBloke
added a commit
that referenced
this pull request
Jan 19, 2021
andrewbogott
pushed a commit
to andrewbogott/cloud-init
that referenced
this pull request
Jan 21, 2021
…ical#586)" (canonical#775) This reverts commit b0e7381.
TheRealFalcon
added a commit
to TheRealFalcon/cloud-init
that referenced
this pull request
Jan 22, 2021
3 tasks
TheRealFalcon
added a commit
that referenced
this pull request
Jan 26, 2021
This was referenced May 12, 2023
Closed
Closed
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Proposed Commit Message
The following commit merged all ssh keys into a default user file
~/.ssh/authorized_keysin sshd_config had multiple files configured forAuthorizedKeysFile:
commit f1094b1
Author: Eduardo Otubo otubo@redhat.com
Date: Thu Dec 5 17:37:35 2019 +0100
This commit ignored the case when sshd_config would have a single file for
AuthorizedKeysFile, but a non default configuration, for example
~/.ssh/authorized_keys_foobar. In this case cloud-init would grab all keysfrom this file and write a new one, the default
~/.ssh/authorized_keyscausing the bug.
rhbz: #1862967
Signed-off-by: Eduardo Otubo otubo@redhat.com
Additional Context
None
Test Steps
/etc/ssh/sshd_configto remove default.ssh/authorized_keysand change to another file e.g.:Actual results:
Cannot login:
Permission denied (publickey,gssapi-keyex,gssapi-with-mic)The public key is written into
.ssh/authorized_keysbut not.ssh/authorized_keys2Expected results:
Can login successfully. The public key is written into
.ssh/authorized_keys2Checklist: