Description of problem:
cloud-init (precisely 'ssh_util.py') doesn't correctly handle the case when multiple files are given for 'AuthorizedKeysFile' option in sshd_config.
How reproducible: Always
Steps to Reproduce:
1. Create a custom AMI with AuthorizedKeysFile in /etc/ssh/sshd_config set to something like this:
AuthorizedKeysFile .ssh/authorized_keys /etc/ssh/userkeys/%u
The important point here is, that there are at least 2 files listed, separated by space, as documented in the man page (see also Additional info).
2. Start it and let cloud-init populate the authorized_keys.
3. Check ~ec2-user/.ssh/ - it looks like this:
ec2-user@ip-xx-xx-xx-xx:~$ sudo find /home/ec2-user/.ssh -ls
25165888 0 drwx------ 3 ec2-user ec2-user 53 Oct 22 08:33 /home/ec2-user/.ssh
25165889 4 -rw------- 1 ec2-user ec2-user 393 Jun 28 13:09 /home/ec2-user/.ssh/authorized_keys
2340 0 drwxr-xr-x 3 root root 17 Oct 22 08:33 /home/ec2-user/.ssh/authorized_keys\
8390840 0 drwxr-xr-x 3 root root 17 Oct 22 08:33 /home/ec2-user/.ssh/authorized_keys\ /etc
16799997 0 drwxr-xr-x 3 root root 22 Oct 22 08:33 /home/ec2-user/.ssh/authorized_keys\ /etc/ssh
25168288 0 drwx------ 2 root root 22 Oct 22 08:33 /home/ec2-user/.ssh/authorized_keys\ /etc/ssh/userkeys
25168289 4 -rw------- 1 ec2-user ec2-user 393 Oct 22 08:33 /home/ec2-user/.ssh/authorized_keys\ /etc/ssh/userkeys/ec2-user
Actual results:
Login with new additional key pair not possible, since not correctly set up.
Expected results:
~ec2-user/.ssh/authorized_keys is modified and no additional directory in ~ec2-user/.ssh is created
Additional info:
Having listed multiple files in AuthorizedKeysFile is allowed according to the sshd_config man page (man 5 sshd_config):
AuthorizedKeysFile
Specifies the file that contains the public keys used for user
authentication. The format is described in the AUTHORIZED_KEYS
FILE FORMAT section of sshd(8). Arguments to AuthorizedKeysFile
accept the tokens described in the TOKENS section. After expanâ
sion, AuthorizedKeysFile is taken to be an absolute path or one
relative to the user's home directory. Multiple files may be
listed, separated by whitespace. Alternately this option may be
set to none to skip checking for user keys in files. The default
is ".ssh/authorized_keys .ssh/authorized_keys2".
Description of problem: cloud-init (precisely 'ssh_util.py') doesn't correctly handle the case when multiple files are given for 'AuthorizedKeysFile' option in sshd_config. How reproducible: Always Steps to Reproduce: 1. Create a custom AMI with AuthorizedKeysFile in /etc/ssh/sshd_config set to something like this: AuthorizedKeysFile .ssh/authorized_keys /etc/ssh/userkeys/%u The important point here is, that there are at least 2 files listed, separated by space, as documented in the man page (see also Additional info). 2. Start it and let cloud-init populate the authorized_keys. 3. Check ~ec2-user/.ssh/ - it looks like this: ec2-user@ip-xx-xx-xx-xx:~$ sudo find /home/ec2-user/.ssh -ls 25165888 0 drwx------ 3 ec2-user ec2-user 53 Oct 22 08:33 /home/ec2-user/.ssh 25165889 4 -rw------- 1 ec2-user ec2-user 393 Jun 28 13:09 /home/ec2-user/.ssh/authorized_keys 2340 0 drwxr-xr-x 3 root root 17 Oct 22 08:33 /home/ec2-user/.ssh/authorized_keys\ 8390840 0 drwxr-xr-x 3 root root 17 Oct 22 08:33 /home/ec2-user/.ssh/authorized_keys\ /etc 16799997 0 drwxr-xr-x 3 root root 22 Oct 22 08:33 /home/ec2-user/.ssh/authorized_keys\ /etc/ssh 25168288 0 drwx------ 2 root root 22 Oct 22 08:33 /home/ec2-user/.ssh/authorized_keys\ /etc/ssh/userkeys 25168289 4 -rw------- 1 ec2-user ec2-user 393 Oct 22 08:33 /home/ec2-user/.ssh/authorized_keys\ /etc/ssh/userkeys/ec2-user Actual results: Login with new additional key pair not possible, since not correctly set up. Expected results: ~ec2-user/.ssh/authorized_keys is modified and no additional directory in ~ec2-user/.ssh is created Additional info: Having listed multiple files in AuthorizedKeysFile is allowed according to the sshd_config man page (man 5 sshd_config): AuthorizedKeysFile Specifies the file that contains the public keys used for user authentication. The format is described in the AUTHORIZED_KEYS FILE FORMAT section of sshd(8). Arguments to AuthorizedKeysFile accept the tokens described in the TOKENS section. After expanâ sion, AuthorizedKeysFile is taken to be an absolute path or one relative to the user's home directory. Multiple files may be listed, separated by whitespace. Alternately this option may be set to none to skip checking for user keys in files. The default is ".ssh/authorized_keys .ssh/authorized_keys2".