Merge ~otubo/cloud-init:multiple-ssh-keys into cloud-init:master

[Eduardo Otubo]

Multiple file fix for AuthorizedKeysFile config

Currently cloud-init does not know how to handle multiple file
configuration on section AuthorizedKeysFile of ssh configuration.
cloud-init will mess up the home user directory by creating bogus
folders inside it.

This patch provides a fix for this erroneous behavior. It gathers all
keys from all the files listed on the section AuthorizedKeysFile of ssh
configuration and merge all of them inside home user
~/.ssh/authorized_keys of the vm deployed.

[Eduardo Otubo (otubo)]

https://bugzilla.redhat.com/show_bug.cgi?id=1642008

[Server Team CI bot (server-team-bot)]

FAILED: Continuous integration, rev:c422c91cbb4bf8ffdad89081221f7b7e83584c79
https://jenkins.ubuntu.com/server/job/cloud-init-ci/1166/
Executed test runs:
    SUCCESS: Checkout
    FAILED: Unit & Style Tests

Click here to trigger a rebuild:
https://jenkins.ubuntu.com/server/job/cloud-init-ci/1166//rebuild

review: Needs Fixing (continuous-integration)

1ac3ad4... by Eduardo Otubo on 2019-09-24

Fixing coding style

[Server Team CI bot (server-team-bot)]

FAILED: Continuous integration, rev:1ac3ad42e7d9d8de851e7399920e6214d7961696
https://jenkins.ubuntu.com/server/job/cloud-init-ci/1168/
Executed test runs:
    SUCCESS: Checkout
    FAILED: Unit & Style Tests

Click here to trigger a rebuild:
https://jenkins.ubuntu.com/server/job/cloud-init-ci/1168//rebuild

review: Needs Fixing (continuous-integration)

[Eduardo Otubo (otubo)]

Hey guys, I already fixed the style issues and tox returns:
  pycodestyle: commands succeeded
  congratulations :)
Anyone can help to push here?

review: Needs Information (review)

[Dan Watkins (oddbloke)]

Just kicked off a new CI run. :)

[Server Team CI bot (server-team-bot)]

FAILED: Continuous integration, rev:1ac3ad42e7d9d8de851e7399920e6214d7961696
https://jenkins.ubuntu.com/server/job/cloud-init-ci/1217/
Executed test runs:
    SUCCESS: Checkout
    FAILED: Unit & Style Tests

Click here to trigger a rebuild:
https://jenkins.ubuntu.com/server/job/cloud-init-ci/1217//rebuild

review: Needs Fixing (continuous-integration)

[Dan Watkins (oddbloke)]

Those CI failures have been fixed in master, so you'll need to rebase onto master and then re-request a CI run.

[Scott Moser (smoser)]

over all this looks fine. one question in line.

It would be nice if you could add some tests.

I'm always hesitant to request someone add tests to code they're fixing when the original code (probably that I wrote) had no tests... but it ensures that stuff works later.

[Eduardo Otubo (otubo)]

For the record, pull request handled on github:
https://github.com/canonical/cloud-init/pull/60#pullrequestreview-321631059

Unmerged commits

1ac3ad4... by Eduardo Otubo on 2019-09-24

Fixing coding style

c422c91... by Eduardo Otubo on 2019-06-28

Multiple file fix for AuthorizedKeysFile config

Currently cloud-init does not know how to handle multiple file
configuration on section AuthorizedKeysFile of ssh configuration.
cloud-init will mess up the home user directory by creating bogus
folders inside it.

This patch provides a fix for this erroneous behavior. It gathers all
keys from all the files listed on the section AuthorizedKeysFile of ssh
configuration and merge all of them inside home user
~/.ssh/authorized_keys of the vm deployed.

Signed-off-by: Eduardo Otubo <email address hidden>

diff --git a/cloudinit/ssh_util.py b/cloudinit/ssh_util.py
index 3f99b58..3e931e3 100644
--- a/cloudinit/ssh_util.py
+++ b/cloudinit/ssh_util.py
@@ -160,14 +160,15 @@ class AuthKeyLineParser(object):
                            comment=comment, options=options)
 
 
-def parse_authorized_keys(fname):
+def parse_authorized_keys(fnames):
     lines = []
-    try:
-        if os.path.isfile(fname):
-            lines = util.load_file(fname).splitlines()
-    except (IOError, OSError):
-        util.logexc(LOG, "Error reading lines from %s", fname)
-        lines = []
+    for fname in fnames:
+        try:
+            if os.path.isfile(fname):
+                lines = util.load_file(fname).splitlines()
+        except (IOError, OSError):
+            util.logexc(LOG, "Error reading lines from %s", fname)
+            lines = []
 
     parser = AuthKeyLineParser()
     contents = []
@@ -213,7 +214,7 @@ def users_ssh_info(username):
 
 def extract_authorized_keys(username):
     (ssh_dir, pw_ent) = users_ssh_info(username)
-    auth_key_fn = None
+    auth_key_fns = []
     with util.SeLinuxGuard(ssh_dir, recursive=True):
         try:
             # The 'AuthorizedKeysFile' may contain tokens
@@ -222,21 +223,25 @@ def extract_authorized_keys(username):
             # '%', %h is replaced by the home directory of the user being
             # authenticated and %u is replaced by the username of that user.
             ssh_cfg = parse_ssh_config_map(DEF_SSHD_CFG)
-            auth_key_fn = ssh_cfg.get("authorizedkeysfile", '').strip()
-            if not auth_key_fn:
-                auth_key_fn = "%h/.ssh/authorized_keys"
-            auth_key_fn = auth_key_fn.replace("%h", pw_ent.pw_dir)
-            auth_key_fn = auth_key_fn.replace("%u", username)
-            auth_key_fn = auth_key_fn.replace("%%", '%')
-            if not auth_key_fn.startswith('/'):
-                auth_key_fn = os.path.join(pw_ent.pw_dir, auth_key_fn)
+            auth_key_fns = ssh_cfg.get(
+                "authorizedkeysfile", '').strip().split()
+            if not auth_key_fns:
+                auth_key_fns[0] = "%h/.ssh/authorized_keys"
+            i = 0
+            for i in range(len(auth_key_fns)):
+                auth_key_fns[i] = auth_key_fns[i].replace("%h", pw_ent.pw_dir)
+                auth_key_fns[i] = auth_key_fns[i].replace("%u", username)
+                auth_key_fns[i] = auth_key_fns[i].replace("%%", '%')
+                if not auth_key_fns[i].startswith('/'):
+                    auth_key_fns[i] = os.path.join(
+                        pw_ent.pw_dir, auth_key_fns[i])
         except (IOError, OSError):
             # Give up and use a default key filename
-            auth_key_fn = os.path.join(ssh_dir, 'authorized_keys')
+            auth_key_fns[0] = os.path.join(ssh_dir, 'authorized_keys')
             util.logexc(LOG, "Failed extracting 'AuthorizedKeysFile' in ssh "
                         "config from %r, using 'AuthorizedKeysFile' file "
-                        "%r instead", DEF_SSHD_CFG, auth_key_fn)
-    return (auth_key_fn, parse_authorized_keys(auth_key_fn))
+                        "%r instead", DEF_SSHD_CFG, auth_key_fns[0])
+    return (auth_key_fns[0], parse_authorized_keys(auth_key_fns))
 
 
 def setup_user_keys(keys, username, options=None):