1898589 – Duplicated entries in .ss/authorized_keys from remote_execution_ssh_keys snippet

Red Hat Satellite engineering is moving the tracking of its product development work on Satellite to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "Satellite project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs will be migrated starting at the end of May. If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "Satellite project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/SAT-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1898589 - Duplicated entries in .ss/authorized_keys from remote_execution_ssh_keys snippet

Summary: Duplicated entries in .ss/authorized_keys from remote_execution_ssh_keys snippet

Keywords:
Status:	CLOSED DUPLICATE of bug 1856758
Alias:	None
Product:	Red Hat Satellite
Classification:	Red Hat
Component:	Provisioning Templates
Sub Component:
Version:	6.8.0
Hardware:	Unspecified
OS:	Unspecified
Priority:	low
Severity:	low
Target Milestone:	Unspecified
Assignee:	satellite6-bugs
QA Contact:	Roman Plevka
Docs Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+	depends on / blocked

Reported:	2020-11-17 15:21 UTC by Gianfranco Sigrisi
Modified:	2020-11-20 13:48 UTC (History)
CC List:	4 users (show)
Fixed In Version:
Doc Type:	If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:	2020-11-20 13:48:51 UTC
Target Upstream Version:
Embargoed:

Attachments	(Terms of Use)
.ssh/authorized_keys duplicated entries for remote_execution user (51.16 KB, image/png) 2020-11-17 15:21 UTC, Gianfranco Sigrisi	no flags	Details
View All

Description Gianfranco Sigrisi 2020-11-17 15:21:00 UTC

Created attachment 1730174 [details]
.ssh/authorized_keys duplicated entries for remote_execution user

Description of problem:

The following part of the snippet: remote_execution_ssh_keys: 

cat << EOF >> <%= ssh_path %>/authorized_keys
<%= host_param('remote_execution_ssh_keys').is_a?(String) ? host_param('remote_execution_ssh_keys') : host_param('remote_execution_ssh_keys').join("\n") %>
EOF

Generates 3 times the entries for the foreman-proxy ssh .pub key in the remote_execution_ssh_user setup. 



Version-Release number of selected component (if applicable):


How reproducible:

Always

Steps to Reproduce:
1. Render the template and check for the kickstart config file containing the remote_execution_ssh_keys stanza
2.
3.

Actual results:



Expected results:

1 entry per key

Additional info:

Attached the output of a kickstart file rendered with the duplicated entries.

Comment 1 Patrick C. F. Ernzer 2020-11-17 15:32:25 UTC

FWIW: this also happens with 6.7.3

Comment 2 Marek Hulan 2020-11-18 07:52:53 UTC

Please provide the value of remote_execution_ssh_keys parameter, if there's no value, how many Capsules with remote execution the customer have (I assume 3)? Note that we deploy all keys from all REX Capsules. We could add unification of that array, that would be a simple fix. Given there's no harm in having duplicates in authorized_keys, I'm lowering the severity.

Comment 3 Gianfranco Sigrisi 2020-11-19 07:29:05 UTC

Hi Marek,
here we go:

1 remote execution user with 2 ssh pub keys:

foreman_users:
    rex:
      firstname: Ansible Remote Execution
      lastname: User
      mail: ''
      description: ''
      fullname: Ansible Remote Execution User
      name: rex
      ssh_authorized_keys:
      - type: ssh-ed25519
        key: AAAAC3NzaC1lZDI1NTE5AAAAIJD9OFIQFzrPXb7rBOBReH......
        comment: rex.com
      - type: ssh-rsa
        key: AAAAB3NzaC1yc2EAAAADAQABAAABAQDmOHvEA8B99PAc8X......
        comment: rex.com

1 key for the foreman-proxy user
remote_execution_ssh_keys:
  - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7QH/S8sJPExnVtvAdQEurL1.... foreman-proxy.com

1 capsule:
# hammer --output yaml capsule list
---
- Id: 1
  Name: satellite.example.com
  URL: https://satellite.example.com:9090
  Features:
  - Logs
  - Dynflow
  - SSH
  - Discovery
  - Openscap
  - Ansible
  - Templates
  - Pulp
  - TFTP
  - Puppet
  - DHCP
  - HTTPBoot
  - Puppet CA

Comment 4 Gianfranco Sigrisi 2020-11-19 07:38:08 UTC

At the moment I added .uniq.join in a cloned snippet for the remote_execution_ssh_keys:

  cat << EOF >> <%= ssh_path %>/authorized_keys
<%= host_param('remote_execution_ssh_keys').is_a?(String) ? host_param('remote_execution_ssh_keys') : host_param('remote_execution_ssh_keys').uniq.join("\n") %>
EOF

In this way it forces to remove the duplicated entries but.... there is no need to deduplicate because there is only 1 entry.

Comment 5 Marek Hulan 2020-11-19 08:52:42 UTC

Interesting, thanks for the additional data, it seems it may be related to the user keys too. Anyway, adding uniq.join is a good workaround and resolves the issue until it's fixed.

Comment 6 Gianfranco Sigrisi 2020-11-19 10:11:40 UTC

Hi Marek,
Just to be clear, the duplicated keys that are appended to the file are *only* the ones for the foreman-proxy user.

Comment 7 Brad Buckingham 2020-11-20 13:48:51 UTC

This appears to be a duplicate of bug 1856758; therefore, closing this instance.  Please feel free to re-open if it is determined to be different.

*** This bug has been marked as a duplicate of bug 1856758 ***

Note You need to log in before you can comment on or make changes to this bug.