Bug 1968572 - Assisted Service does not escape backslash characters on public SSH keys
Summary: Assisted Service does not escape backslash characters on public SSH keys
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: assisted-installer
Version: 4.8
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
: 4.9.0
Assignee: Sagi Dayan
QA Contact: Yuri Obshansky
URL:
Whiteboard: AI-Team-Core
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2021-06-07 15:11 UTC by Osher De Paz
Modified: 2021-10-18 17:33 UTC (History)
1 user (show)

Fixed In Version: OCP-Metal-v1.0.23.1
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-10-18 17:32:56 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github openshift assisted-service pull 2060 0 None open Bug 1968572: Assisted Service does not escape backslash characters on public SSH keys 2021-06-23 10:40:58 UTC
Red Hat Product Errata RHSA-2021:3759 0 None None None 2021-10-18 17:33:23 UTC

Description Osher De Paz 2021-06-07 15:11:41 UTC
Description of problem:

Having backslash in the supplied SSH public key, leaves ignition with an invalid JSON:

  "passwd": {
    "users": [
      {
        "name": "core",
        "passwordHash": "!",
        "sshAuthorizedKeys": [
        "ssh-rsa ... gmx\024358758@ALEX-P50"],
        "groups": [ "sudo" ]}
    ]
  },

How reproducible: 100%

Actual results:
Host cannot proceed to discovery. RHCOS tries to load the ignition and fails to continue.

Expected results:
We should escape any public SSH key, or deny it from being accepted on UI+API.

Comment 1 Osher De Paz 2021-06-16 14:29:21 UTC
From Moran:

that’s the key i’m seeing - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCyC2quOGfz9JFNtIvp4jX2acQVPGBneZHmrBYE439lRIXKURob3o20haJeKB/iu691qWBZJSPvl+wNnWZ3zylRqrFMwDZ6500fnNtE8CoCcvCugggIl5QMQ49U4FiEp2Ax1uvh5R1Y8dYb71riQo+1CCMp59UOZkhVr5auAXzldPmjlMcCzo2GzvYIqhy35dbFwyegioEkUaXNo8KnBQqPIVqTyjC6nYkyvEAS/NRxmjwpi12qdmWtgV2G7AHNVodrGFNYwI9HH+kn9YAj1gOFzmNg2a2nQBvZzs8PyboKh7D+A04uL1o/zh5C3Nm2kRMSwtdyBMH35quRok9h8RZ/ gmx\024358758@ALEX-P50

Comment 4 Yuri Obshansky 2021-08-04 14:55:57 UTC
Verified on Staging v1.0.24.1

 "passwd": {
    "users": [
      {"groups":["sudo"],"name":"core","passwordHash":"!","sshAuthorizedKeys":["ssh-rsa 
*************************** /s5mL7IZ16qHmH8VSjLKUBw5t5352qgR foo\\bar"]}
    ]
  },

Comment 8 errata-xmlrpc 2021-10-18 17:32:56 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: OpenShift Container Platform 4.9.0 bug fix and security update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2021:3759


Note You need to log in before you can comment on or make changes to this bug.