HOME

Mini Shell 1.0
DIR:/lib/python2.7/site-packages/cloudinit/config/
Current File : //lib/python2.7/site-packages/cloudinit/config/cc_ssh.pyo
�
oB�]c@s dZddlZddlZddlZddlmZddlmZddlmZdddd	gZ	d
Z
eZdgZ
iZiZxhe	D]`Zejie
edfde6�ejie
ed
dfde6�deede<q�WdZd�Zd�Zdd�ZdS(s�
SSH
---
**Summary:** configure ssh and ssh keys

This module handles most configuration for ssh and ssh keys. Many images have
default ssh keys, which can be removed using ``ssh_deletekeys``. Since removing
default keys is usually the desired behavior this option is enabled by default.

Keys can be added using the ``ssh_keys`` configuration key. The argument to
this config key should be a dictionary entries for the public and private keys
of each desired key type. Entries in the ``ssh_keys`` config dict should
have keys in the format ``<key type>_private`` and ``<key type>_public``, e.g.
``rsa_private: <key>`` and ``rsa_public: <key>``. See below for supported key
types. Not all key types have to be specified, ones left unspecified will not
be used. If this config option is used, then no keys will be generated.

.. note::
    when specifying private keys in cloud-config, care should be taken to
    ensure that the communication between the data source and the instance is
    secure

.. note::
    to specify multiline private keys, use yaml multiline syntax

If no keys are specified using ``ssh_keys``, then keys will be generated using
``ssh-keygen``. By default one public/private pair of each supported key type
will be generated. The key types to generate can be specified using the
``ssh_genkeytypes`` config flag, which accepts a list of key types to use. For
each key type for which this module has been instructed to create a keypair, if
a key of the same type is already present on the system (i.e. if
``ssh_deletekeys`` was false), no key will be generated.

Supported key types for the ``ssh_keys`` and the ``ssh_genkeytypes`` config
flags are:

    - rsa
    - dsa
    - ecdsa
    - ed25519

Root login can be enabled/disabled using the ``disable_root`` config key. Root
login options can be manually specified with ``disable_root_opts``. If
``disable_root_opts`` is specified and contains the string ``$USER``,
it will be replaced with the username of the default user. By default,
root login is disabled, and root login opts are set to::

    no-port-forwarding,no-agent-forwarding,no-X11-forwarding

Authorized keys for the default user/first user defined in ``users`` can be
specified using ``ssh_authorized_keys``. Keys should be specified as a list of
public keys.

Importing ssh public keys for the default user (defined in ``users``)) is
enabled by default.  This feature may be disabled by setting
``allow_publish_ssh_keys: false``.

.. note::
    see the ``cc_set_passwords`` module documentation to enable/disable ssh
    password authentication

**Internal name:** ``cc_ssh``

**Module frequency:** per instance

**Supported distros:** all

**Config keys**::

    ssh_deletekeys: <true/false>
    ssh_keys:
        rsa_private: |
            -----BEGIN RSA PRIVATE KEY-----
            MIIBxwIBAAJhAKD0YSHy73nUgysO13XsJmd4fHiFyQ+00R7VVu2iV9Qco
            ...
            -----END RSA PRIVATE KEY-----
        rsa_public: ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAGEAoPRhIfLvedSDKw7Xd ...
        dsa_private: |
            -----BEGIN DSA PRIVATE KEY-----
            MIIBxwIBAAJhAKD0YSHy73nUgysO13XsJmd4fHiFyQ+00R7VVu2iV9Qco
            ...
            -----END DSA PRIVATE KEY-----
        dsa_public: ssh-dsa AAAAB3NzaC1yc2EAAAABIwAAAGEAoPRhIfLvedSDKw7Xd ...
    ssh_genkeytypes: <key type>
    disable_root: <true/false>
    disable_root_opts: <disable root options string>
    ssh_authorized_keys:
        - ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAGEA3FSyQwBI6Z+nCSjUU ...
        - ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA3I7VUf2l5gSn5uavROsc5HRDpZ ...
    allow_public_ssh_keys: <true/false>
    ssh_publish_hostkeys:
        enabled: <true/false> (Defaults to true)
        blacklist: <list of key types> (Defaults to [dsa])
i����N(tug_util(tssh_util(tutiltrsatdsatecdsated25519s/etc/ssh/ssh_host_%s_keyi�s
%s_privates.pubs	%s_publics;o=$(ssh-keygen -yf "%s") && echo "$o" root@localhost > "%s"c!Cs�|jdt�r|tjjdd�}xRtj|�D]>}ytj|�Wq7tk
rttj	|d|�q7Xq7Wnd|kr�x\|dj
�D]J\}}|tkr�t|d}	t|d}
tj|	||
�q�q�Wx_t
j
�D]�\}}||dks�||dkr&q�nt|dt|df}
dd	t|
g}yNtjd
dt��tj|dt�WdQX|jd
|
d|
d�Wq�tk
r�tj	|d|
d|
d�q�Xq�Wnmtj|dt�}tjj�}d|d<x<|D]4}t|}tjj|�r9qntjtjj|��dd|ddd|g}tjd
dt���y>tj|dtd|�\}}tjjtj|��Wn{tjk
r>}tj|j �j!�}|j"dkr%|j!�j#d�r%|jd|�q?tj	|d||�nXWdQXqWd|kr�tj|ddt$�}tj%|ddt&�}nt$}t&}|r�t'd|�}y|j(j)|�Wq�tk
r�tj	|d�q�Xny�t*j+||j,�\}}t*j-|�\}}tj%|dt�}tj.|d t/j0�}g}tj%|d!t�rv|j1�ppg}n
|jd"�d#|kr�|d#} |j2| �nt3||||�Wn!tk
r�tj	|d$�nXdS(%Ntssh_deletekeyss	/etc/ssh/sssh_host_*key*sFailed deleting key file %stssh_keysiitshs-xcs/etc/ssht	recursivetcapturesGenerated a key for %s from %ss%Failed generated a key for %s from %stssh_genkeytypestCtLANGs
ssh-keygens-ts-Nts-ftenvsunknown keys!ssh-keygen: unknown key type '%s's(Failed generating key type %s to file %stssh_publish_hostkeyst	blacklisttenabledsPublishing host keys failed!tdisable_roottdisable_root_optstallow_public_ssh_keyssSSkipping import of publish ssh keys per config setting: allow_public_ssh_keys=Falsetssh_authorized_keyss Applying ssh credentials failed!(4tgettTruetostpathtjointglobRtdel_filet	ExceptiontlogexctitemstCONFIG_KEY_TO_FILEt
write_filetPRIV_TO_PUBtKEY_GEN_TPLtSeLinuxGuardtsubptFalsetdebugtget_cfg_option_listtGENERATE_KEY_NAMEStenvirontcopytKEY_FILE_TPLtexistst
ensure_dirtdirnametsyststdouttwritet
decode_binarytProcessExecutionErrortstderrtlowert	exit_codet
startswithtHOST_KEY_PUBLISH_BLACKLISTtget_cfg_option_booltPUBLISH_HOST_KEYStget_public_host_keyst
datasourcetpublish_host_keysRtnormalize_users_groupstdistrotextract_defaulttget_cfg_option_strRtDISABLE_USER_OPTStget_public_ssh_keystextendtapply_credentials(!t_nametcfgtcloudtlogt_argstkey_pthtftkeytvalttgt_fnt	tgt_permstprivtpubtpairtcmdtgenkeystlang_ctkeytypetkeyfiletoutterrtethost_key_blacklisttpublish_hostkeysthostkeystuserst_groupstusert_user_configRRtkeystcfgkeys((s;/usr/lib/python2.7/site-packages/cloudinit/config/cc_ssh.pythandle�s�
 
		

!
	



cCs�t|�}|r%tj||�n|ra|s:d}n|jd|�}|jdd�}nd}tj|dd|�dS(NtNONEs$USERs
$DISABLE_USERtrootRtoptions(tsetRtsetup_user_keystreplace(RfRdRRt
key_prefix((s;/usr/lib/python2.7/site-packages/cloudinit/config/cc_ssh.pyRH�s	c
Cs�dtf}g}g}|rBg|D]}||f^q&}ngtj|d�D]}||krV|^qV}x[|D]S}tj|�}|j�}	|	r{t|	�dkr{|jt|	d ��q{q{W|S(sRead host keys from /etc/ssh/*.pub files and return them as a list.

    @param blacklist: List of key types to ignore. e.g. ['dsa', 'rsa']
    @returns: List of keys, each formatted as a two-element tuple.
        e.g. [('ssh-rsa', 'AAAAB3Nz...'), ('ssh-ed25519', 'AAAAC3Nx...')]
    s%s.pubt*ii(Rp(R.RRt	load_filetsplittlentappendttuple(
Rtpublic_key_file_tmpltkey_listtblacklist_filestkey_typethostfilet	file_listt	file_namet
file_contentstkey_data((s;/usr/lib/python2.7/site-packages/cloudinit/config/cc_ssh.pyR>�s
 
(t__doc__RRR2tcloudinit.distrosRt	cloudinitRRR+R.RR=R;R"R$tktupdateR%RhRHtNoneR>(((s;/usr/lib/python2.7/site-packages/cloudinit/config/cc_ssh.pyt<module>fs*	
" 	d