1 0 #ˆl–ß=¿J µ2ÛR‚œP-\lò˜´oà ƒtM=ÂÁÀPa '¡Dg,ã @s¬UdZddlZddlZddlZddlZddlZddlmZmZm Z ddl m Z m Z m Z mZddlmZddlmZddlmZddlmZmZdd lmZd egegd œZeed <e e¡Zgd ¢ZdgZ e !d¡Z"dZ#dZ$gZ%ee&ed<iZ'iZ(eD]dZ)e' *e)›d�e#e)dfe)›d�e#e)›d�dfe)›d�e#e)›d�dfi¡e)›d�e(e)›d�<qødZ+e&ddœdd„Z,e&eee-ddœdd „Z.d!d"„Z/d&ee e&d#œd$d%„Z0dS)'zSSH: Configure SSH and SSH keyséN)ÚListÚOptionalÚSequence)Ú lifecycleÚssh_utilÚsubpÚutil)ÚCloud)ÚConfig)Ú MetaSchema)Ú ALL_DISTROSÚug_util)Ú PER_INSTANCEZcc_ssh)ÚidZdistrosZ frequencyZactivate_by_schema_keysÚmeta)ZrsaZecdsaÚed25519rz4^(ecdsa-sk|ed25519-sk)_(private|public|certificate)$z/etc/ssh/ssh_host_%s_keyTÚHOST_KEY_PUBLISH_BLACKLISTZ_privateé€Z_publicú.pubé¤Ú _certificatez -cert.pubz;o=$(ssh-keygen -yf "%s") && echo "$o" root@localhost > "%s")ÚkeyfileÚreturncCsld}t ¡}|r&|t dd¡kr&d}nd}t d¡}|dkrJt |d|¡t ||¡t |›d�|¡d S) aÓ For fedora 37, centos 9 stream and below: - sshd version is earlier than version 9. - 'ssh_keys' group is present and owns the private keys. - private keys have permission 0o640. For fedora 38, centos 10 stream and above: - ssh version is atleast version 9. - 'ssh_keys' group is absent. 'root' group owns the keys. - private keys have permission 0o600, same as upstream. Public keys in all cases have permission 0o644. ré ri rÚssh_keyséÿÿÿÿrN) rZget_opensshd_upstream_versionrZVersionrZ get_group_idÚosÚchownÚchmod)rZpermissions_publicZ ssh_versionZpermissions_privateÚgid©r ú;/usr/lib/python3.9/site-packages/cloudinit/config/cc_ssh.pyÚset_redhat_keyfile_perms@s   r")ÚnameÚcfgÚcloudÚargsrc$ Cs¨| dd¡rZtj dd¡}t |¡D]4}zt |¡Wq$tyVt t d|¡Yq$0q$d|v�rÚg}|d  ¡D]t\}}|t vr¨t   |¡r”d} nd} t  d | |¡qtt |d } t |d } t | || ¡d |vrt| d t| ƒf¡qt|røt |¡t  ¡D]Ô\} } | |dv�s| |dv�r(�qt | d t | d }}ddt||fg}zPtjddd��tj|dd�Wdƒn1�sŠ0Yt  d||¡Wn,t�yÐt t d|›d|›�¡Yn0�q�n”t |dt¡}t ¡�sö|n dd„|Dƒ}t|ƒ |¡}|�r*t  dd |¡¡|D�]<}t|}tj |¡�rN�q.t  tj !|¡¡dd|ddd |g}tjddd��ØzTtj|dd!d"id#�\}}t "|d$d¡�s¾t#j$ %t &|¡¡|j'j(d%k�rÔt)|ƒWnrtj*�yH}zVt &|j+¡ ,¡}|j-d k�r$| ,¡ .d&¡�r$t  d'|¡nt t d(||¡WYd}~n d}~00Wdƒn1�s`0Y�q.d)|v�ržt |d)d*t/¡}t "|d)d+t0¡}nt/}t0}|�rèt1|d,�}z|j2 3|¡Wn t�yæt t d-¡Yn0zšt4 5||j'¡\}}t4 6|¡\}}t "|d.d¡} t 7|d/tj8¡}!g}"t "|d0d¡�rL| 9¡�pHg}"n t  d1¡d2|v�rr|d2}#|" :|#¡t;|"|| |!ƒWn t�y¢t t d3¡Yn0dS)4NZssh_deletekeysTz /etc/ssh/zssh_host_*key*zFailed deleting key file %srZ unsupportedZ unrecognizedz Skipping %s ssh_keys entry: "%s"rérZHostCertificateÚshz-xcz/etc/ssh)Ú recursiveF)ÚcapturezGenerated a key for %s from %szFailed generating a key for z from Zssh_genkeytypescSsg|]}|tvr|‘qSr )ÚFIPS_UNSUPPORTED_KEY_NAMES)Ú.0Únamesr r r!Ú ¥sþzhandle..z5skipping keys that are not supported in fips mode: %sú,z ssh-keygenz-tz-NÚz-fÚLANGÚC)r*Z update_envZssh_quiet_keygenZredhatz unknown keyz!ssh-keygen: unknown key type '%s'z(Failed generating key type %s to file %sZssh_publish_hostkeysÚ blacklistZenabled©r3zPublishing host keys failed!Ú disable_rootÚdisable_root_optsZallow_public_ssh_keyszSS