Merge lp:~tribaal/livecd-rootfs/add-vagrant-user into lp:livecd-rootfs

[Chris Glass]

This branch changes the behavior for default users on the vagrant image, according to much of https://www.vagrantup.com/docs/boxes/base.html

Specifically, this adds a new "vagrant" user with a know password on top of the already existing ubuntu user.

This conforms to the expectations of the Vagrant community, despite some security concerns. Vagrant images are not used for production systems but for development environments, and the absence of the "standard" vagrant user has been hurting ubuntu adoption on that platform.

[Chris Glass (tribaal)]

A vagrant image with this patch applied can be found here:

https://launchpad.net/~cloudware/+livefs/ubuntu/artful/cpc-development/+build/107944/+files/livecd.ubuntu-cpc.vagrant.box

[Chris Glass (tribaal)]

New image with the latest changes (not requiring password entry on "vagrant ssh"): https://launchpad.net/~cloudware/+livefs/ubuntu/artful/cpc-development/+build/108198/+files/livecd.ubuntu-cpc.vagrant.box

[Philip Roche (philroche)]

Works as expected. +1

-------------------------
(scratch) philroche@bomek:~/Working/scratch/vagrant-scratch$ vagrant box add --name cpc-ubuntu-vagrant livecd.ubuntu-cpc.vagrant-rev2.box
==> box: Box file was not detected as metadata. Adding it directly...
==> box: Adding box 'cpc-ubuntu-vagrant' (v0) for provider:
    box: Unpacking necessary files from: file:///home/philroche/Working/scratch/vagrant-scratch/livecd.ubuntu-cpc.vagrant-rev2.box
==> box: Successfully added box 'cpc-ubuntu-vagrant' (v0) for 'virtualbox'!
(scratch) philroche@bomek:~/Working/scratch/vagrant-scratch$ vagrant up
Bringing machine 'default' up with 'virtualbox' provider...
==> default: Importing base box 'cpc-ubuntu-vagrant'...
==> default: Matching MAC address for NAT networking...
==> default: Setting the name of the VM: vagrant-scratch_default_1503908977046_11325
==> default: Clearing any previously set network interfaces...
==> default: Preparing network interfaces based on configuration...
    default: Adapter 1: nat
==> default: Forwarding ports...
    default: 22 (guest) => 2222 (host) (adapter 1)
==> default: Running 'pre-boot' VM customizations...
==> default: Booting VM...
==> default: Waiting for machine to boot. This may take a few minutes...
    default: SSH address: 127.0.0.1:2222
    default: SSH username: vagrant
    default: SSH auth method: private key
    default: Warning: Remote connection disconnect. Retrying...
    default: Warning: Connection reset. Retrying...
    default: Warning: Remote connection disconnect. Retrying...
    default: Warning: Connection reset. Retrying...
    default: Warning: Remote connection disconnect. Retrying...
    default: Warning: Connection reset. Retrying...
    default: Warning: Remote connection disconnect. Retrying...
    default: Warning: Connection reset. Retrying...
    default:
    default: Vagrant insecure key detected. Vagrant will automatically replace
    default: this with a newly generated keypair for better security.
    default:
    default: Inserting generated public key within guest...
==> default: Machine booted and ready!
==> default: Checking for guest additions in VM...
==> default: Mounting shared folders...
    default: /vagrant => /home/philroche/Working/scratch/vagrant-scratch
(scratch) philroche@bomek:~/Working/scratch/vagrant-scratch$ vagrant ssh
Welcome to Ubuntu Artful Aardvark (development branch) (GNU/Linux 4.12.0-11-generic x86_64)

 * Documentation: https://help.ubuntu.com
 * Management: https://landscape.canonical.com
 * Support: https://ubuntu.com/advantage

  Get cloud support with Ubuntu Advantage Cloud Guest:
    http://www.ubuntu.com/business/services/cloud

0 packages can be updated.
0 updates are security updates.

vagrant@ubuntu-artful:~$

review: Approve

[Francis Ginther (fginther)]

What restricts this change to artful? My understanding is that we're only introducing the vagrant:vagrant setup for artful and newer releases.

There is a comment on line 105 of this file:
# Vagrant needs a base user. We either inject the well-known SSH key
# or use password authentication. Both are ugly. So we'll use a password
# and make it random. This obviously is insecure...but at least its
# better than the alternatives.

This is no longer true now that we are adding the well-known SSH key.

review: Needs Information

[Chris Glass (tribaal)]

> What restricts this change to artful? My understanding is that we're only
> introducing the vagrant:vagrant setup for artful and newer releases.

Nothing in code - landing this in trunk only means that it will be part of the artful branch and the next ones as well.

> There is a comment on line 105 of this file:
> # Vagrant needs a base user. We either inject the well-known SSH key
> # or use password authentication. Both are ugly. So we'll use a password
> # and make it random. This obviously is insecure...but at least its
> # better than the alternatives.
>
> This is no longer true now that we are adding the well-known SSH key.

Good point! Fixed.

[lp:~tribaal/livecd-rootfs/add-vagrant-user]

1502. By Chris Glass on 2017-08-29

Remove ubuntu user customisations.

Let's just do the absolute minimum here, the default is what people expect.

[Chris Glass (tribaal)]

Updated the code again. I removed the build-time generation of a password for the ubuntu user altogether, along with password ssh connections.

Vagrant replaces the found insecure key with a per-instance key at "up" time, allowing vagrant users to login securely, while users of this image as a "local cloud image" will have a working use-case as well.

[Chris Glass (tribaal)]

(a box generated with the latest version of the code can be found here: https://launchpad.net/~cloudware/+livefs/ubuntu/artful/cpc-development/+build/108301/+files/livecd.ubuntu-cpc.vagrant.box )

[Chris Glass (tribaal)]

Francis,

I removed the setting of a hard-coded ubuntu password from this entirely, leaving using/setting the ubuntu user as an excercise for the end-user's cloud-init (or other provisionning method).

Vagrant users on the other hand can login automagically with "vagrant ssh".

[Francis Ginther (fginther)]

Thanks for solving the 'how does this restricted to artful' question over IRC. While testing, I found one file ownership problem, otherwise, this looks good.

review: Needs Fixing

[lp:~tribaal/livecd-rootfs/add-vagrant-user]

1503. By Chris Glass on 2017-08-29

Fix file permission problem - the authorized_keys file was still owned by root since the chown call came before its creation.

[Chris Glass (tribaal)]

All comments should be fixed.

Thanks for the catch!

[Francis Ginther (fginther)]

Cool, thanks!

review: Approve

[lp:~tribaal/livecd-rootfs/add-vagrant-user]

1504. By Chris Glass on 2017-09-01

Fixed review comments by Adam.

- use adduser instead of useradd.

1505. By Chris Glass on 2017-09-01

Make sure the .ssh directory has the right permissions.

[Adam Conrad (adconrad)]

LGTM after the live review this morning. Will merge shortly. Please remember to follow-up with the discussed MOTD snippet.

review: Approve

=== modified file 'live-build/ubuntu-cpc/hooks/042-vagrant.binary'
--- live-build/ubuntu-cpc/hooks/042-vagrant.binary	2017-06-14 16:25:11 +0000
+++ live-build/ubuntu-cpc/hooks/042-vagrant.binary	2017-09-01 16:26:23 +0000
@@ -67,6 +67,29 @@
 # avoid pulling into a cloud image.
 chroot ${mount_d} apt-get install --no-install-recommends -y virtualbox-guest-utils
 chroot ${mount_d} apt-get clean
+
+# Create and setup users inside the image.
+# Vagrant users expect a "vagrant" user with a "vagrant" username.
+# See https://www.vagrantup.com/docs/boxes/base.html
+# Note: We decided NOT to allow root login with a default password.
+chroot ${mount_d} adduser vagrant
+echo "vagrant:vagrant" | chroot ${mount_d} chpasswd
+
+# The vagrant user should have passwordless sudo.
+cat << EOF > ${mount_d}/etc/sudoers.d/vagrant
+vagrant ALL=(ALL) NOPASSWD:ALL
+EOF
+
+# Add the insecure vagrant pubkey to the vagrant user, as is expected by the
+# vagrant ecosystem (https://www.vagrantup.com/docs/boxes/base.html)
+chroot ${mount_d} chmod 0440 /etc/sudoers.d/vagrant
+chroot ${mount_d} mkdir -p /home/vagrant/.ssh
+cat << EOF > ${mount_d}/home/vagrant/.ssh/authorized_keys
+ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA6NF8iallvQVp22WDkTkyrtvp9eWW6A8YVr+kz4TjGYe7gHzIw+niNltGEFHzD8+v1I2YJ6oXevct1YeS0o9HZyN1Q9qgCgzUFtdOKLv6IedplqoPkcmF0aYet2PkEDo3MlTBckFXPITAMzF8dJSIFo9D8HfdOV0IAdx4O7PtixWKn5y2hMNG0zQPyUecp4pzC6kivAIhyfHilFR61RGL+GPXQ2MWZWFYbAGjyiYJnAmCP3NOTd0jMZEnDkbUvxhMmBYSdETk1rRgm+R4LOzFUGaHqHDLKLX+FIPKcF96hrucXzcWyLbIbEgE98OHlnVYCzRdK8jlqm8tehUc9c9WhQ== vagrant insecure public key
+EOF
+chroot ${mount_d} chown -R vagrant:vagrant /home/vagrant/.ssh
+chroot ${mount_d} chmod 700 /home/vagrant/.ssh
+
 umount_disk_image "$mount_d"
 rmdir "$mount_d"
 
@@ -80,12 +103,6 @@
 vmdk_f="${box_d}/${prefix}.vmdk"
 create_vmdk ${derivative_img} ${vmdk_f}
 
-# Vagrant needs a base user. We either inject the well-known SSH key
-# or use password authentication. Both are ugly. So we'll use a password
-# and make it random. This obviously is insecure...but at least its
-# better than the alternatives.
-ubuntu_user_pass=$(openssl rand -hex 12)
-
 ####################################
 # Create the ConfigDrive
 # This is a cloud-init piece that instructs cloud-init to configure
@@ -98,9 +115,6 @@
 # except via local host.
 cat > ${seed_d}/user-data <<END
 #cloud-config
-password: ${ubuntu_user_pass}
-chpasswd: { expire: False }
-ssh_pwauth: True
 manage_etc_hosts: localhost
 END
 
@@ -141,8 +155,6 @@
 
 Vagrant.configure("2") do |config|
   config.vm.base_mac = "${macaddr}"
-  config.ssh.username = "ubuntu"
-  config.ssh.password = "${ubuntu_user_pass}"
 
   config.vm.provider "virtualbox" do |vb|
      vb.customize [ "modifyvm", :id, "--uart1", "0x3F8", "4" ]