Merge lp:~harlowja/cloud-init/ssh-auth-keys into lp:~cloud-init-dev/cloud-init/trunk

[Joshua Harlow]

Adds a new module for bug @ https://bugs.launchpad.net/cloud-init/+bug/1010582

The output from this new module being ran is the following (for an example, ignore the no datasource...)

http://pastebin.ubuntu.com/1154749/

[Scott Moser (smoser)]

This looks fine. Ideally there'd be some tests...
The only other comment is that it seems like '_gen_fingerprint' as well be part of ssh_util, and even have 'fingerprint' be returned by AuthKeyLineParser:parse, but nothing else uses that now, so that seems not necessary.

review: Approve

[lp:~harlowja/cloud-init/ssh-auth-keys]

622. By Joshua Harlow on 2012-08-20

Fixup the columns and add a check to make
sure that a key given is one that we actually
want to print out. Also add in a config option
which lets people select a different hashing
method (not md5 if they want).

=== added file 'cloudinit/config/cc_ssh_authkey_fingerprints.py'
--- cloudinit/config/cc_ssh_authkey_fingerprints.py	1970-01-01 00:00:00 +0000
+++ cloudinit/config/cc_ssh_authkey_fingerprints.py	2012-08-20 19:10:39 +0000
@@ -0,0 +1,91 @@
+# vi: ts=4 expandtab
+#
+#    Copyright (C) 2012 Yahoo! Inc.
+#
+#    Author: Joshua Harlow <[e-mail]>
+#
+#    This program is free software: you can redistribute it and/or modify
+#    it under the terms of the GNU General Public License version 3, as
+#    published by the Free Software Foundation.
+#
+#    This program is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU General Public License for more details.
+#
+#    You should have received a copy of the GNU General Public License
+#    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import base64
+import glob
+import hashlib
+import os
+
+from prettytable import PrettyTable
+
+from cloudinit import util
+from cloudinit import ssh_util
+
+
+def _split_hash(bin_hash):
+    split_up = []
+    for i in xrange(0, len(bin_hash), 2):
+        split_up.append(bin_hash[i:i+2])
+    return split_up
+
+
+def _gen_fingerprint(b64_text, hash_meth='md5'):
+    if not b64_text:
+        return ''
+    # TBD(harlowja): Maybe we should feed this into 'ssh -lf'?
+    try:
+        hasher = hashlib.new(hash_meth)
+        hasher.update(base64.b64decode(b64_text))
+        return ":".join(_split_hash(hasher.hexdigest()))
+    except TypeError:
+        # Raised when b64 not really b64...
+        return '?'
+
+
+def _is_printable_key(entry):
+    if any([entry.keytype, entry.base64, entry.comment, entry.options]):
+        if entry.keytype and entry.keytype.lower().strip() in ['ssh-dss', 'ssh-rsa']:
+            return True
+    return False
+
+
+def _pprint_key_entries(user, key_fn, key_entries, hash_meth='md5', prefix='ci-info: '):
+    if not key_entries:
+        message = "%sno authorized ssh keys fingerprints found for user %s." % (prefix, user)
+        util.multi_log(message)
+        return
+    tbl_fields = ['Keytype', 'Fingerprint (%s)' % (hash_meth), 'Options', 'Comment']
+    tbl = PrettyTable(tbl_fields)
+    for entry in key_entries:
+        if _is_printable_key(entry):
+            row = []
+            row.append(entry.keytype or '-')
+            row.append(_gen_fingerprint(entry.base64, hash_meth) or '-')
+            row.append(entry.options or '-')
+            row.append(entry.comment or '-')
+            tbl.add_row(row)
+    authtbl_s = tbl.get_string()
+    authtbl_lines = authtbl_s.splitlines()
+    max_len = len(max(authtbl_lines, key=len))
+    lines = [
+        util.center("Authorized keys fingerprints from %s for user %s" % (key_fn, user), "+", max_len),
+    ]
+    lines.extend(authtbl_lines)
+    for line in lines:
+        util.multi_log(text="%s%s\n" % (prefix, line))
+
+
+def handle(name, cfg, cloud, log, _args):
+    if 'no_ssh_fingerprints' in cfg:
+        log.debug(("Skipping module named %s, "
+                   "logging of ssh fingerprints disabled"), name)
+
+    user_name = util.get_cfg_option_str(cfg, "user", "ubuntu")
+    hash_meth = util.get_cfg_option_str(cfg, "authkey_hash", "md5")
+    (auth_key_fn, auth_key_entries) = ssh_util.extract_authorized_keys(user_name, cloud.paths)
+    _pprint_key_entries(user_name, auth_key_fn, auth_key_entries, hash_meth)
 
=== modified file 'cloudinit/ssh_util.py'
--- cloudinit/ssh_util.py	2012-06-29 20:46:19 +0000
+++ cloudinit/ssh_util.py	2012-08-20 19:10:39 +0000
@@ -181,12 +181,11 @@
     return contents
 
 
-def update_authorized_keys(fname, keys):
-    entries = parse_authorized_keys(fname)
+def update_authorized_keys(old_entries, keys):
     to_add = list(keys)
 
-    for i in range(0, len(entries)):
-        ent = entries[i]
+    for i in range(0, len(old_entries)):
+        ent = old_entries[i]
         if ent.empty() or not ent.base64:
             continue
         # Replace those with the same base64
@@ -199,66 +198,81 @@
                 # Don't add it later
                 if k in to_add:
                     to_add.remove(k)
-        entries[i] = ent
+        old_entries[i] = ent
 
     # Now append any entries we did not match above
     for key in to_add:
-        entries.append(key)
+        old_entries.append(key)
 
     # Now format them back to strings...
-    lines = [str(b) for b in entries]
+    lines = [str(b) for b in old_entries]
 
     # Ensure it ends with a newline
     lines.append('')
     return '\n'.join(lines)
 
 
-def setup_user_keys(keys, user, key_prefix, paths):
-    # Make sure the users .ssh dir is setup accordingly
-    pwent = pwd.getpwnam(user)
-    ssh_dir = os.path.join(pwent.pw_dir, '.ssh')
-    ssh_dir = paths.join(False, ssh_dir)
-    if not os.path.exists(ssh_dir):
-        util.ensure_dir(ssh_dir, mode=0700)
-        util.chownbyid(ssh_dir, pwent.pw_uid, pwent.pw_gid)
-
-    # Turn the keys given into actual entries
-    parser = AuthKeyLineParser()
-    key_entries = []
-    for k in keys:
-        key_entries.append(parser.parse(str(k), def_opt=key_prefix))
-
+def users_ssh_info(username, paths):
+    pw_ent = pwd.getpwnam(username)
+    if not pw_ent:
+        raise RuntimeError("Unable to get ssh info for user %r" % (username))
+    ssh_dir = paths.join(False, os.path.join(pw_ent.pw_dir, '.ssh'))
+    return (ssh_dir, pw_ent)
+
+
+def extract_authorized_keys(username, paths):
+    (ssh_dir, pw_ent) = users_ssh_info(username, paths)
     sshd_conf_fn = paths.join(True, DEF_SSHD_CFG)
+    auth_key_fn = None
     with util.SeLinuxGuard(ssh_dir, recursive=True):
         try:
-            # AuthorizedKeysFile may contain tokens
+            # The 'AuthorizedKeysFile' may contain tokens
             # of the form %T which are substituted during connection set-up.
             # The following tokens are defined: %% is replaced by a literal
             # '%', %h is replaced by the home directory of the user being
             # authenticated and %u is replaced by the username of that user.
             ssh_cfg = parse_ssh_config_map(sshd_conf_fn)
-            akeys = ssh_cfg.get("authorizedkeysfile", '')
-            akeys = akeys.strip()
-            if not akeys:
-                akeys = "%h/.ssh/authorized_keys"
-            akeys = akeys.replace("%h", pwent.pw_dir)
-            akeys = akeys.replace("%u", user)
-            akeys = akeys.replace("%%", '%')
-            if not akeys.startswith('/'):
-                akeys = os.path.join(pwent.pw_dir, akeys)
-            authorized_keys = paths.join(False, akeys)
+            auth_key_fn = ssh_cfg.get("authorizedkeysfile", '').strip()
+            if not auth_key_fn:
+                auth_key_fn = "%h/.ssh/authorized_keys"
+            auth_key_fn = auth_key_fn.replace("%h", pw_ent.pw_dir)
+            auth_key_fn = auth_key_fn.replace("%u", username)
+            auth_key_fn = auth_key_fn.replace("%%", '%')
+            if not auth_key_fn.startswith('/'):
+                auth_key_fn = os.path.join(pw_ent.pw_dir, auth_key_fn)
+            auth_key_fn = paths.join(False, auth_key_fn)
         except (IOError, OSError):
-            authorized_keys = os.path.join(ssh_dir, 'authorized_keys')
+            # Give up and use a default key filename
+            auth_key_fn = os.path.join(ssh_dir, 'authorized_keys')
             util.logexc(LOG, ("Failed extracting 'AuthorizedKeysFile'"
                               " in ssh config"
-                              " from %s, using 'AuthorizedKeysFile' file"
-                              " %s instead"),
-                        sshd_conf_fn, authorized_keys)
-
-        content = update_authorized_keys(authorized_keys, key_entries)
-        util.ensure_dir(os.path.dirname(authorized_keys), mode=0700)
-        util.write_file(authorized_keys, content, mode=0600)
-        util.chownbyid(authorized_keys, pwent.pw_uid, pwent.pw_gid)
+                              " from %r, using 'AuthorizedKeysFile' file"
+                              " %r instead"),
+                        sshd_conf_fn, auth_key_fn)
+    auth_key_entries = parse_authorized_keys(auth_key_fn)
+    return (auth_key_fn, auth_key_entries)
+
+
+def setup_user_keys(keys, username, key_prefix, paths):
+    # Make sure the users .ssh dir is setup accordingly
+    (ssh_dir, pwent) = users_ssh_info(username, paths)
+    if not os.path.isdir(ssh_dir):
+        util.ensure_dir(ssh_dir, mode=0700)
+        util.chownbyid(ssh_dir, pwent.pw_uid, pwent.pw_gid)
+
+    # Turn the 'update' keys given into actual entries
+    parser = AuthKeyLineParser()
+    key_entries = []
+    for k in keys:
+        key_entries.append(parser.parse(str(k), def_opt=key_prefix))
+
+    # Extract the old and make the new
+    (auth_key_fn, auth_key_entries) = extract_authorized_keys(username, paths)
+    with util.SeLinuxGuard(ssh_dir, recursive=True):
+        content = update_authorized_keys(auth_key_entries, key_entries)
+        util.ensure_dir(os.path.dirname(auth_key_fn), mode=0700)
+        util.write_file(auth_key_fn, content, mode=0600)
+        util.chownbyid(auth_key_fn, pwent.pw_uid, pwent.pw_gid)
 
 
 class SshdConfigLine(object):