← Back
Editing: cc_ssh.cpython-38.pyc
U Ӈg, � @ s� U d Z ddlZddlZddlZddlZddlZddlmZmZm Z ddl m Z m Z m Z mZ ddlmZ ddlmZ ddlmZ ddlmZmZ dd lmZ d egeg d �Zeed < e� e �Z d ddgZ dgZ e�!d�Z"dZ#dZ$g Z%ee& ed< i Z'i Z(e D ]dZ)e'�*e)� d�e#e) dfe)� d�e#e) � d�dfe)� d�e#e) � d�dfi� e)� d�e(e)� d�< q�dZ+e&dd �d d �Z,e&eee-dd �d d!�Z.d"d#� Z/d'ee e& d$�d%d&�Z0dS )(z SSH: Configure SSH and SSH keys� N)�List�Optional�Sequence)� lifecycle�ssh_util�subp�util)�Cloud)�Config)� MetaSchema)� ALL_DISTROS�ug_util)� PER_INSTANCEZcc_ssh)�idZdistrosZ frequencyZactivate_by_schema_keys�metaZrsaZecdsaZed25519z4^(ecdsa-sk|ed25519-sk)_(private|public|certificate)$z/etc/ssh/ssh_host_%s_keyT�HOST_KEY_PUBLISH_BLACKLISTZ_private� Z_public�.pub� � _certificatez -cert.pubz;o=$(ssh-keygen -yf "%s") && echo "$o" root@localhost > "%s")�keyfile�returnc C sl d}t �� }|r&|t�dd�k r&d}nd}t�d�}|dkrJt�| d|� t�| |� t�| � d�|� d S ) a� For fedora 37, centos 9 stream and below: - sshd version is earlier than version 9. - 'ssh_keys' group is present and owns the private keys. - private keys have permission 0o640. For fedora 38, centos 10 stream and above: - ssh version is atleast version 9. - 'ssh_keys' group is absent. 'root' group owns the keys. - private keys have permission 0o600, same as upstream. Public keys in all cases have permission 0o644. r � r i� r �ssh_keys���r N) r Z get_opensshd_upstream_versionr ZVersionr Z get_group_id�os�chown�chmod)r Zpermissions_publicZ ssh_versionZpermissions_private�gid� r �9/usr/lib/python3/dist-packages/cloudinit/config/cc_ssh.py�set_redhat_keyfile_perms@ s r! )�name�cfg�cloud�argsr c $ C s� |� dd�r\tj�dd�}t�|�D ]6}zt�|� W q$ tk rX t�t d|� Y q$X q$d|k�r�g }|d � � D ]t\}}|t kr�t � |�r�d} nd} t �d | |� qvt | d } t | d } t�| || � d |krv|�d t| �f� qv|r�t�|� t� � D ]�\} } | |d k�s| |d k�r*�qt | d t | d }}ddt||f g}z:tjddd�� tj|dd� W 5 Q R X t �d||� W n. tk �r� t�t d|� d|� �� Y nX �q�n|t�|dt�}t�� �s�|n dd� |D �}t |�� |�}|�rt �dd�|�� |D �]$}t | }tj� |��r<�q t� tj�!|�� d d |d d d |g}tjddd��� zTtj|dd!d"id#�\}}t�"|d$d��s�t#j$�%t�&|�� |j'j(d%k�r�t)|� W np tj*k �r4 } zNt�&|j+��,� }|j-d k�r|�,� �.d&��rt �d'|� nt�t d(||� W 5 d }~X Y nX W 5 Q R X �q d)|k�rtt�|d) d*t/�}t�"|d) d+t0�}nt/}t0}|�r�t1|d,�}z|j2�3|� W n" tk �r� t�t d-� Y nX z�t4�5||j'�\} } t4�6| �\} } t�"|d.d�} t�7|d/tj8�}!g }"t�"|d0d��r$|�9� �p g }"n t �d1� d2|k�rJ|d2 }#|"�:|#� t;|"| | |!� W n" tk �r| t�t d3� Y nX d S )4NZssh_deletekeysTz /etc/ssh/zssh_host_*key*zFailed deleting key file %sr Z unsupportedZ unrecognizedz Skipping %s ssh_keys entry: "%s"r � r ZHostCertificateZshz-xcz/etc/ssh)� recursiveF)�capturez Generated a key for %s from %sz Failed generating a key for z from Zssh_genkeytypesc S s g | ]}|t kr|�qS r )�FIPS_UNSUPPORTED_KEY_NAMES)�.0�namesr r r � <listcomp>� s �zhandle.<locals>.<listcomp>z5skipping keys that are not supported in fips mode: %s�,z ssh-keygenz-tz-N� z-fZLANG�C)r( Z update_envZssh_quiet_keygenZredhatz unknown keyz!ssh-keygen: unknown key type '%s'z(Failed generating key type %s to file %sZssh_publish_hostkeys� blacklist�enabled�r0 z Publishing host keys failed!� disable_root�disable_root_optsZallow_public_ssh_keyszSSkipping import of publish SSH keys per config setting: allow_public_ssh_keys=FalseZssh_authorized_keysz Applying SSH credentials failed!)<�getr �path�join�globr Zdel_file� ExceptionZlogexc�LOG�items�CONFIG_KEY_TO_FILE� pattern_unsupported_config_keys�matchZwarningZ write_file�append�strr Zappend_ssh_config� PRIV_TO_PUB� KEY_GEN_TPLZ SeLinuxGuardr �debugZget_cfg_option_list�GENERATE_KEY_NAMESZ fips_enabled�set� difference� KEY_FILE_TPL�existsZ ensure_dir�dirnameZget_cfg_option_bool�sys�stdout�writeZ decode_binaryZdistroZosfamilyr! ZProcessExecutionError�stderr�lowerZ exit_code� startswithr �PUBLISH_HOST_KEYS�get_public_host_keysZ datasourceZpublish_host_keysr Znormalize_users_groupsZextract_defaultZget_cfg_option_strZDISABLE_USER_OPTSZget_public_ssh_keys�extend�apply_credentials)$r" r# r$ r% Zkey_pth�fZ cert_config�key�val�reasonZtgt_fnZ tgt_permsZ private_typeZ public_typeZ private_fileZ public_file�cmdZgenkeysZ key_namesZ skipped_keysZkeytyper �out�err�eZhost_key_blacklistZpublish_hostkeysZhostkeysZusersZ_groups�userZ _user_configr3 r4 �keysZcfgkeysr r r �handled s � � � �� ���� � � � ��$ � � �� r^ c C sV t | �} |rt�| |� |r>|s$d}|�d|�}|�dd�}nd}tj| d|d� d S )NZNONEz$USERz $DISABLE_USER�rootr. )Zoptions)rE r Zsetup_user_keys�replace)r] r\ r3 r4 Z key_prefixr r r rS s rS r2 c s� dt f �g }g � | r(�fdd�| D �� � fdd�t��d �D �}|D ]<}t�|�}|�� }|rHt|�dkrH|�t|dd� �� qH|S ) a Read host keys from /etc/ssh/*.pub files and return them as a list. @param blacklist: List of key types to ignore. e.g. ['rsa'] @returns: List of keys, each formatted as a two-element tuple. e.g. [('ssh-rsa', 'AAAAB3Nz...'), ('ssh-ed25519', 'AAAAC3Nx...')] z%s.pubc s g | ]}� |f �qS r r )r* Zkey_type)�public_key_file_tmplr r r, s z(get_public_host_keys.<locals>.<listcomp>c s g | ]}|� kr|�qS r r )r* Zhostfile)�blacklist_filesr r r, $ s �)�*r& N� )rG r8 r Zload_text_file�split�lenr? �tuple)r0 Zkey_listZ file_list� file_nameZ file_contentsZkey_datar )rb ra r rQ s � � rQ )N)1�__doc__r8 Zloggingr �rerJ �typingr r r Z cloudinitr r r r Zcloudinit.cloudr Zcloudinit.configr Zcloudinit.config.schemar Zcloudinit.distrosr r Zcloudinit.settingsr r �__annotations__Z getLogger�__name__r: rD r) �compiler= rG rP r r@ r< rA �k�updaterB r! �listr^ rS rQ r r r r �<module> sZ � � ��$
Save File
Cancel