CasperSecurity
o
쑛h�+ �
@ s� U d Z ddlZddlZddlZddlZddlZddlmZmZm Z ddl
m Z m Z m
Z
mZ ddlmZ ddlmZ ddlmZ ddlmZmZ dd lmZ d
egeg d �Zeed < e� e �Z g d
�Z dgZ dZ!dZ"g Z#ee$ ed< i Z%i Z&e D ]2Z'e%�(e'� d�e!e' dfe'� d�e!e' � d�dfe'� d�e!e' � d�dfi� e'� d�e&e'� d�< qwdZ)de$ddfd d �Z*d e$d ed ed!e+ddf
d"d#�Z,d$d%� Z-d)d&ee e$ fd'd(�Z.dS )*z SSH: Configure SSH and SSH keys� N)�List�Optional�Sequence)� lifecycle�ssh_util�subp�util)�Cloud)�Config)�
MetaSchema)� ALL_DISTROS�ug_util)� PER_INSTANCE�cc_ssh)�id�distros� frequency�activate_by_schema_keys�meta)�rsa�ecdsa�ed25519r z/etc/ssh/ssh_host_%s_keyT�HOST_KEY_PUBLISH_BLACKLIST�_private� �_public�.pub� � _certificatez -cert.pubz;o=$(ssh-keygen -yf "%s") && echo "$o" root@localhost > "%s"�keyfile�returnc C sl d}t �� }|r|t�dd�k rd}nd}t�d�}|dkr%t�| d|� t�| |� t�| � d�|� d S )
a�
For fedora 37, centos 9 stream and below:
- sshd version is earlier than version 9.
- 'ssh_keys' group is present and owns the private keys.
- private keys have permission 0o640.
For fedora 38, centos 10 stream and above:
- ssh version is atleast version 9.
- 'ssh_keys' group is absent. 'root' group owns the keys.
- private keys have permission 0o600, same as upstream.
Public keys in all cases have permission 0o644.
r � r i� r �ssh_keys���r N) r � get_opensshd_upstream_versionr �Versionr � get_group_id�os�chown�chmod)r �permissions_public� ssh_version�permissions_private�gid� r. �9/usr/lib/python3/dist-packages/cloudinit/config/cc_ssh.py�set_redhat_keyfile_perms= s
r0 �name�cfg�cloud�argsc $ C s� |� dd�r,tj�dd�}t�|�D ]}zt�|� W q ty+ t�t d|� Y qw d|v r�g }|d �
� D ];\}}|t vrSt �
d|�rId} nd } t �d
| |� q8t | d }
t | d } t�|
|| � d
|v rs|�dt|
�f� q8|r{t�|� t�
� D ]c\} }
|
|d v s�| |d vr�qt | d t |
d }}ddt||f g}z'tjddd�� tj|dd� W d � n1 s�w Y t �d||� W q ty� t�t d|� d|� �� Y qw n�t�|dt�}t�� s�|ndd� |D �}t |�� |�}|�r t �dd �|�� |D ]�}t | }tj� |��r �q
t� tj�!|�� d d |d d d!|g}tjddd��l z*tj|dd"d#id$�\}}t�"|d%d��sTt#j$�%t�&|�� |j'j(d&k�r_t)|� W n9 tj*�y� } z+t�&|j+��,� }|j-d k�r�|�,� �.d'��r�t �d(|� nt�t d)||� W Y d }~nd }~ww W d � n 1 �s�w Y �q
d*|v �r�t�|d* d+t/�}t�"|d* d,t0�}nt/}t0}|�r�t1|d-�}z|j2�3|� W n t�y� t�t d.� Y nw zNt4�5||j'�\} } t4�6| �\} } t�"|d/d�} t�7|d0tj8�}!g }"t�"|d1d��r|�9� �pg }"nt �d2� d3|v �r.|d3 }#|"�:|#� t;|"| | |!� W d S t�yH t�t d4� Y d S w )5N�ssh_deletekeysTz /etc/ssh/zssh_host_*key*zFailed deleting key file %sr" z4^(ecdsa-sk|ed25519-sk)_(private|public|certificate)$� unsupported� unrecognizedz Skipping %s ssh_keys entry: "%s"r � r �HostCertificate�shz-xcz/etc/ssh)� recursiveF)�capturez Generated a key for %s from %sz Failed generating a key for z from �ssh_genkeytypesc S s g | ]}|t vr|�qS r. )�FIPS_UNSUPPORTED_KEY_NAMES)�.0�namesr. r. r/ �
<listcomp>� �
�zhandle.<locals>.<listcomp>z5skipping keys that are not supported in fips mode: %s�,z
ssh-keygenz-tz-N� z-f�LANG�C)r< �
update_env�ssh_quiet_keygen�redhatz unknown keyz!ssh-keygen: unknown key type '%s'z(Failed generating key type %s to file %s�ssh_publish_hostkeys� blacklist�enabled)rK z Publishing host keys failed!� disable_root�disable_root_opts�allow_public_ssh_keyszSSkipping import of publish SSH keys per config setting: allow_public_ssh_keys=False�ssh_authorized_keysz Applying SSH credentials failed!)<�getr' �path�join�globr �del_file� Exception�logexc�LOG�items�CONFIG_KEY_TO_FILE�re�match�warning�
write_file�append�strr �append_ssh_config� PRIV_TO_PUB� KEY_GEN_TPL� SeLinuxGuardr �debug�get_cfg_option_list�GENERATE_KEY_NAMES� fips_enabled�set�
difference� KEY_FILE_TPL�exists�
ensure_dir�dirname�get_cfg_option_bool�sys�stdout�write�
decode_binary�distro�osfamilyr0 �ProcessExecutionError�stderr�lower� exit_code�
startswithr �PUBLISH_HOST_KEYS�get_public_host_keys�
datasource�publish_host_keysr
�normalize_users_groups�extract_default�get_cfg_option_str�DISABLE_USER_OPTS�get_public_ssh_keys�extend�apply_credentials)$r1 r2 r3 r4 �key_pth�f� cert_config�key�val�reason�tgt_fn� tgt_perms� private_type� public_type� private_file� public_file�cmd�genkeys� key_names� skipped_keys�keytyper �out�err�e�host_key_blacklist�publish_hostkeys�hostkeys�users�_groups�user� _user_configrM rN �keys�cfgkeysr. r. r/ �handlea s �� �
� �� ��������� �
�������� ��
�
�
���
�r� c C sV t | �} |r t�| |� |r |sd}|�d|�}|�dd�}nd}tj| d|d� d S )N�NONEz$USERz
$DISABLE_USER�rootrD )�options)ri r �setup_user_keys�replace)r� r� rM rN �
key_prefixr. r. r/ r� s r� rK c s� dt f �g }g � | r�fdd�| D �� � fdd�t��d �D �}|D ] }t�|�}|�� }|rBt|�dkrB|�t|dd� �� q$|S ) a Read host keys from /etc/ssh/*.pub files and return them as a list.
@param blacklist: List of key types to ignore. e.g. ['rsa']
@returns: List of keys, each formatted as a two-element tuple.
e.g. [('ssh-rsa', 'AAAAB3Nz...'), ('ssh-ed25519', 'AAAAC3Nx...')]
z%s.pubc s g | ]}� |f �qS r. r. )r? �key_type)�public_key_file_tmplr. r/ rA s
�z(get_public_host_keys.<locals>.<listcomp>c s g | ]}|� vr|�qS r. r. )r? �hostfile)�blacklist_filesr. r/ rA # rB )�*r8 N� )rk rT r �load_text_file�split�lenr_ �tuple)rK �key_list� file_list� file_name�
file_contents�key_datar. )r� r� r/ r| s"
�
�
�r| )N)/�__doc__rT �loggingr' r[ rp �typingr r r � cloudinitr r r r �cloudinit.cloudr �cloudinit.configr
�cloudinit.config.schemar �cloudinit.distrosr r
�cloudinit.settingsr r �__annotations__� getLogger�__name__rX rg r> rk r{ r r` rZ rb �k�updaterc r0 �listr� r� r| r. r. r. r/ �<module> sP �
�� $ !