Snappy should enable SSH when credentials are provided

Bug #1494816 reported by Ben Howard
10
This bug affects 1 person
Affects Status Importance Assigned to Milestone
cloud-init (Ubuntu)
Fix Released
Critical
Unassigned
Vivid
Fix Released
High
Unassigned

Bug Description

[IMPACT] Ubuntu Snappy 15.04 disables SSH unless a user provides explicit user-data to turn SSH on. This happens regardless of a user providing authentication tokens. This prevents Ubuntu Snappy from being added to various Cloud WebUI's, Marketplaces and confuses many users.

[FIX] Enable SSH when a user or the fabric provides authentication tokens unless the user explicitly disables SSH via user-data.

[REGRESSION POTENTIAL] Low. This change only affects Ubuntu Snappy and is scoped to Snappy instances only.

[TEST]:
1. Build Ubuntu Snappy 15.04-edge w/ cloud-init from proposed
2. Boot instance w/ out user-data on EC2, confirm user can SSH in
3. Boot instance w/ user-data below, confirm SSH is disabled
    #cloud-config:
    snappy:
       ssh_enabled: False
4. Boot instance w/ user-data below, confirm SSH is enabled
    #cluod-config:
    snappy:
       ssh_enabled: True

[ORIGINAL REPORT]

For Snappy, SSH is turned off by default.

Cloud-init should default to SSH being off by default, BUT if the datasource provides credentials, then SSH should be turned on.

Related branches

Changed in cloud-init (Ubuntu):
assignee: nobody → Ben Howard (utlemming)
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package cloud-init - 0.7.7~bzr1144-0ubuntu1

---------------
cloud-init (0.7.7~bzr1144-0ubuntu1) wily; urgency=medium

  * New upstream snapshot.
    [ Ben Howard ]
    * snappy: enable ssh on snappy if ssh keys are provided or
      password authentication is requested (LP: #1494816)

 -- Scott Moser <email address hidden> Fri, 11 Sep 2015 17:00:16 -0400

Changed in cloud-init (Ubuntu):
status: Confirmed → Fix Released
Revision history for this message
Ben Howard (darkmuggle-deactivatedaccount) wrote :

On Azure, this fails:
Sep 15 16:59:19 localhost [CLOUDINIT] util.py[DEBUG]: Running command ['snappy', 'list'] with allowed return codes [0] (shell=False, ca
pture=True)
Sep 15 16:59:19 localhost [CLOUDINIT] cc_snappy.py[DEBUG]: setting enablement of ssh to: False
Sep 15 16:59:19 localhost [CLOUDINIT] util.py[DEBUG]: Running command ['systemctl', 'stop', 'ssh'] with allowed return codes [0] (shell
=False, capture=True)
Sep 15 16:59:19 localhost [CLOUDINIT] util.py[DEBUG]: Writing to /etc/ssh/sshd_not_to_be_run - wb: [420] 11 bytes
Sep 15 16:59:19 localhost [CLOUDINIT] handlers.py[DEBUG]: finish: modules-config/config-snappy: SUCCESS: config-snappy ran successfully
Sep 15 16:59:19 localhost [CLOUDINIT] stages.py[DEBUG]: Running module grub-dpkg (<module 'cloudinit.config.cc_grub_dpkg' from '/usr/lib/python3/dist-packages/cloudinit/config/cc_grub_dpkg.py'>) with frequency once-per-instance
Sep 15 16:59:19 localhost [CLOUDINIT] handlers.py[DEBUG]: start: modules-config/config-grub-dpk

And then on EC2:
Sep 15 17:28:13 localhost [CLOUDINIT] util.py[DEBUG]: Writing to /var/lib/cloud/instances/i-8cd9432f/sem/config_snappy - wb: [420] 24 bytes
Sep 15 17:28:13 localhost [CLOUDINIT] helpers.py[DEBUG]: Running config-snappy using lock (<FileLock using file '/var/lib/cloud/instances/i-8cd9432f/sem/config_snappy'>)
Sep 15 17:28:13 localhost [CLOUDINIT] util.py[DEBUG]: Reading from /etc/system-image/channel.ini (quiet=True)
Sep 15 17:28:13 localhost [CLOUDINIT] util.py[DEBUG]: Read 212 bytes from /etc/system-image/channel.ini
Sep 15 17:28:13 localhost [CLOUDINIT] cc_snappy.py[DEBUG]: snappy command is 'snappy'
Sep 15 17:28:13 localhost [CLOUDINIT] util.py[DEBUG]: Running command ['snappy', 'list'] with allowed return codes [0] (shell=False, capture=True)
Sep 15 17:28:13 localhost [CLOUDINIT] cc_snappy.py[DEBUG]: setting enablement of ssh to: False
Sep 15 17:28:13 localhost [CLOUDINIT] util.py[DEBUG]: Running command ['systemctl', 'stop', 'ssh'] with allowed return codes [0] (shell=False, capture=True)
Sep 15 17:28:13 localhost [CLOUDINIT] util.py[DEBUG]: Writing to /etc/ssh/sshd_not_to_be_run - wb: [420] 11 bytes

But interestingly enough, SSH is still running and I am able to login.

It looks like this is a problem:
=== modified file 'cloudinit/config/cc_snappy.py'
--- cloudinit/config/cc_snappy.py 2015-09-11 20:52:26 +0000
+++ cloudinit/config/cc_snappy.py 2015-09-15 17:36:18 +0000
@@ -280,7 +280,7 @@
                      pkg_op['op'], pkg_op['name'], e)

     # Default to disabling SSH
- ssh_enabled = mycfg.get('ssh_enabled', "auto")
+ ssh_enabled = cfgin.get('ssh_enabled', "auto")

     # If the user has not explicitly enabled or disabled SSH, then enable it
     # when password SSH authentication is requested or there are SSH keys

Changed in cloud-init (Ubuntu):
status: Fix Released → Confirmed
Revision history for this message
Ben Howard (darkmuggle-deactivatedaccount) wrote :

Ah, nevermind, I was able to get in before Snappy turned off SSH. So the code path is definately not working.

Revision history for this message
Ben Howard (darkmuggle-deactivatedaccount) wrote :

Okay, culprit found:

=== modified file 'cloudinit/config/cc_snappy.py'
--- cloudinit/config/cc_snappy.py 2015-09-11 20:52:26 +0000
+++ cloudinit/config/cc_snappy.py 2015-09-15 17:52:52 +0000
@@ -63,7 +63,7 @@
 BUILTIN_CFG = {
     'packages': [],
     'packages_dir': '/writable/user-data/cloud-init/snaps',
- 'ssh_enabled': False,
+ 'ssh_enabled': "auto",
     'system_snappy': "auto",
     'config': {},
 }

Revision history for this message
Ben Howard (darkmuggle-deactivatedaccount) wrote :

Confirmed in the latest update.

Changed in cloud-init (Ubuntu):
status: Confirmed → Fix Released
description: updated
Revision history for this message
Ben Howard (darkmuggle-deactivatedaccount) wrote :

Tested against Ubuntu Snappy Rolling-edge. Works on AWS and Azure as expected. Submitting for SRU.

Changed in cloud-init (Ubuntu Vivid):
importance: Undecided → High
assignee: nobody → Ben Howard (utlemming)
Revision history for this message
Chris J Arges (arges) wrote : Please test proposed package

Hello Ben, or anyone else affected,

Accepted cloud-init into vivid-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/cloud-init/0.7.7~bzr1091-0ubuntu8 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Changed in cloud-init (Ubuntu Vivid):
status: New → Fix Committed
tags: added: verification-needed
Revision history for this message
Ben Howard (darkmuggle-deactivatedaccount) wrote :

Confirmed that new version of cloud-init works on Snappy by enabling SSH.

tags: added: verification-done
removed: verification-needed
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package cloud-init - 0.7.7~bzr1091-0ubuntu8

---------------
cloud-init (0.7.7~bzr1091-0ubuntu8) vivid; urgency=medium

  * d/patches/lp-1494816-snappy-ssh-enabled_with_auth.patch:
      - Enable SSH on Ubuntu Snappy when the Cloud Fabric/user provides user
        authentication tokens (LP: #1494816).

 -- Ben Howard <email address hidden> Tue, 15 Sep 2015 17:30:35 -0600

Changed in cloud-init (Ubuntu Vivid):
status: Fix Committed → Fix Released
Revision history for this message
Stéphane Graber (stgraber) wrote : Update Released

The verification of the Stable Release Update for cloud-init has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.