Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem:
cloud-init (precisely 'ssh_util.py') doesn't correctly handle the case when multiple files are given for 'AuthorizedKeysFile' option in sshd_config.
How reproducible: Always
Steps to Reproduce:
1. Create a custom AMI with AuthorizedKeysFile in /etc/ssh/sshd_config set to something like this:
AuthorizedKeysFile .ssh/authorized_keys /etc/ssh/userkeys/%u
The important point here is, that there are at least 2 files listed, separated by space, as documented in the man page (see also Additional info).
2. Start it and let cloud-init populate the authorized_keys.
3. Check ~ec2-user/.ssh/ - it looks like this:
ec2-user@ip-xx-xx-xx-xx:~$ sudo find /home/ec2-user/.ssh -ls
25165888 0 drwx------ 3 ec2-user ec2-user 53 Oct 22 08:33 /home/ec2-user/.ssh
25165889 4 -rw------- 1 ec2-user ec2-user 393 Jun 28 13:09 /home/ec2-user/.ssh/authorized_keys
2340 0 drwxr-xr-x 3 root root 17 Oct 22 08:33 /home/ec2-user/.ssh/authorized_keys\
8390840 0 drwxr-xr-x 3 root root 17 Oct 22 08:33 /home/ec2-user/.ssh/authorized_keys\ /etc
16799997 0 drwxr-xr-x 3 root root 22 Oct 22 08:33 /home/ec2-user/.ssh/authorized_keys\ /etc/ssh
25168288 0 drwx------ 2 root root 22 Oct 22 08:33 /home/ec2-user/.ssh/authorized_keys\ /etc/ssh/userkeys
25168289 4 -rw------- 1 ec2-user ec2-user 393 Oct 22 08:33 /home/ec2-user/.ssh/authorized_keys\ /etc/ssh/userkeys/ec2-user
Actual results:
Login with new additional key pair not possible, since not correctly set up.
Expected results:
~ec2-user/.ssh/authorized_keys is modified and no additional directory in ~ec2-user/.ssh is created
Additional info:
Having listed multiple files in AuthorizedKeysFile is allowed according to the sshd_config man page (man 5 sshd_config):
AuthorizedKeysFile
Specifies the file that contains the public keys used for user
authentication. The format is described in the AUTHORIZED_KEYS
FILE FORMAT section of sshd(8). Arguments to AuthorizedKeysFile
accept the tokens described in the TOKENS section. After expanâ
sion, AuthorizedKeysFile is taken to be an absolute path or one
relative to the user's home directory. Multiple files may be
listed, separated by whitespace. Alternately this option may be
set to none to skip checking for user keys in files. The default
is ".ssh/authorized_keys .ssh/authorized_keys2".
Description of problem: cloud-init (precisely 'ssh_util.py') doesn't correctly handle the case when multiple files are given for 'AuthorizedKeysFile' option in sshd_config. How reproducible: Always Steps to Reproduce: 1. Create a custom AMI with AuthorizedKeysFile in /etc/ssh/sshd_config set to something like this: AuthorizedKeysFile .ssh/authorized_keys /etc/ssh/userkeys/%u The important point here is, that there are at least 2 files listed, separated by space, as documented in the man page (see also Additional info). 2. Start it and let cloud-init populate the authorized_keys. 3. Check ~ec2-user/.ssh/ - it looks like this: ec2-user@ip-xx-xx-xx-xx:~$ sudo find /home/ec2-user/.ssh -ls 25165888 0 drwx------ 3 ec2-user ec2-user 53 Oct 22 08:33 /home/ec2-user/.ssh 25165889 4 -rw------- 1 ec2-user ec2-user 393 Jun 28 13:09 /home/ec2-user/.ssh/authorized_keys 2340 0 drwxr-xr-x 3 root root 17 Oct 22 08:33 /home/ec2-user/.ssh/authorized_keys\ 8390840 0 drwxr-xr-x 3 root root 17 Oct 22 08:33 /home/ec2-user/.ssh/authorized_keys\ /etc 16799997 0 drwxr-xr-x 3 root root 22 Oct 22 08:33 /home/ec2-user/.ssh/authorized_keys\ /etc/ssh 25168288 0 drwx------ 2 root root 22 Oct 22 08:33 /home/ec2-user/.ssh/authorized_keys\ /etc/ssh/userkeys 25168289 4 -rw------- 1 ec2-user ec2-user 393 Oct 22 08:33 /home/ec2-user/.ssh/authorized_keys\ /etc/ssh/userkeys/ec2-user Actual results: Login with new additional key pair not possible, since not correctly set up. Expected results: ~ec2-user/.ssh/authorized_keys is modified and no additional directory in ~ec2-user/.ssh is created Additional info: Having listed multiple files in AuthorizedKeysFile is allowed according to the sshd_config man page (man 5 sshd_config): AuthorizedKeysFile Specifies the file that contains the public keys used for user authentication. The format is described in the AUTHORIZED_KEYS FILE FORMAT section of sshd(8). Arguments to AuthorizedKeysFile accept the tokens described in the TOKENS section. After expanâ sion, AuthorizedKeysFile is taken to be an absolute path or one relative to the user's home directory. Multiple files may be listed, separated by whitespace. Alternately this option may be set to none to skip checking for user keys in files. The default is ".ssh/authorized_keys .ssh/authorized_keys2".