Support setting both password and ssh key on user

[labrown]

I need to set both a password and ssh key on a user to meet security requirements in my environment.

[dpb587-pivotal]

This seems like a very odd security requirement. Out of curiosity, can you explain more the rationale behind the requirement?

Technically it should be possible. Feel free to make a pull request and we can give it a look.

[jhunt]

Just ran into this bug.

My use case is to add a failsafe user for troubleshooting the IaaS layer. Sometimes, BOSH spins up a VM that cannot talk back to the director via the agent, either because of poor configuration, an intervening firewall, the will of the gods, etc. When that happens, you've got ten minutes before BOSH times out waiting and terminates the VM.

In some IaaS cloud providers, every instance is provided with an SSH key, and if you can't get there via networking, there's no recourse. Normally, however, those IaaSes provide you with the ability to manage firewalls, so any network SSH connectivity problems are yours to own.

On vSphere, however, it's quite common to have network issues because of a team that isn't you. I've often had access to the vCenter VM virtual console, to login with a username / password, but been unable to SSH over the network. In these cases, an SSH key does me no good.

Ideally, with both SSH and password auth, the password would only be used on local TTY login, not over SSH; the key would be the only way "in" from the network. If that can't / shouldn't happen automatically, I'd be fine with a mode setting for manually enforcing that behavior.

I'd be happy to work up a PR for this if the behavior is acceptable to the maintainers.

[jhunt]

Any update on this?

[dpb587-pivotal]

Revisiting from PR #40 which looks like it will solve the original description.

@jhunt sorry we dropped the conversation here. One thing to keep in mind is that this is a release so it will only ever be effective assuming the VM has successfully been talking to director such that director is able to give it the job and configuration. This doesn't help in the scenarios you mention around VM's initial startup and firewall issues. For that sort of debugging, the env.bosh.authorized_keys setting can be helpful which gets added to vcap's authorized_keys file.

[jhunt]

It doesn't help with initial connectivity problems, but it does help when your security teams unilaterally start blocking traffic to "non-standard ports" like the ones BOSH and its agents use to communicate.

[jaresty]

@jhunt The next release of os-conf-release should support this use case.

[jhunt]

@jhunt The next release of os-conf-release should support this use case.

Glad to hear it!