You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cloudstack.apache.org by GitBox <gi...@apache.org> on 2021/04/04 19:20:33 UTC
[GitHub] [cloudstack] aleskxyz opened a new pull request #4890: Universal sshkey and password manager script
aleskxyz opened a new pull request #4890:
URL: https://github.com/apache/cloudstack/pull/4890
### Description
This PR adds a bash script file that manages sshkey and password from userdata server and configdrive sources
<!--- Describe your changes in DETAIL - And how has behaviour functionally changed. -->
<!-- For new features, provide link to FS, dev ML discussion etc. -->
<!-- In case of bug fix, the expected and actual behaviours, steps to reproduce. -->
<!-- When "Fixes: #<id>" is specified, the issue/PR will automatically be closed when this PR gets merged -->
<!-- For addressing multiple issues/PRs, use multiple "Fixes: #<id>" -->
<!-- Fixes: # -->
<!--- ********************************************************************************* -->
<!--- NOTE: AUTOMATATION USES THE DESCRIPTIONS TO SET LABELS AND PRODUCE DOCUMENTATION. -->
<!--- PLEASE PUT AN 'X' in only **ONE** box -->
<!--- ********************************************************************************* -->
### Types of changes
- [ ] Breaking change (fix or feature that would cause existing functionality to change)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Bug fix (non-breaking change which fixes an issue)
- [X] Enhancement (improves an existing feature and functionality)
- [ ] Cleanup (Code refactoring and cleanup, that may add test cases)
### Feature/Enhancement Scale or Bug Severity
#### Feature/Enhancement Scale
- [ ] Major
- [X] Minor
### How Has This Been Tested?
<!-- Please describe in detail how you tested your changes. -->
<!-- Include details of your testing environment, and the tests you ran to -->
<!-- see how your change affects other areas of the code, etc. -->
Tested on these operating systems:
CentOS 7
CentOS 8
Ubuntu 20.04
Ubuntu 18.04
Ubuntu 14.04
FreeBSD 12.2
openSuse 15.2
Tested for Userdata server and ConfigDrive separately and simultaneously
Tested for multihomed VM with DHCP enabled networks
Tested with cloud-init as a per-boot script
<!-- Please read the [CONTRIBUTING](https://github.com/apache/cloudstack/blob/master/CONTRIBUTING.md) document -->
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [cloudstack] aleskxyz commented on pull request #4890: Universal sshkey and password manager script
Posted by GitBox <gi...@apache.org>.
aleskxyz commented on pull request #4890:
URL: https://github.com/apache/cloudstack/pull/4890#issuecomment-868776749
I think we can remove these files because the script can be replaced with them:
```
cloud-set-guest-password-configdrive.in
cloud-set-guest-password.in
cloud-set-guest-sshkey-configdrive.in
cloud-set-guest-sshkey.in
```
If you are agree, I can remove them in the next commit on this PR
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [cloudstack] aleskxyz commented on a change in pull request #4890: Universal sshkey and password manager script
Posted by GitBox <gi...@apache.org>.
aleskxyz commented on a change in pull request #4890:
URL: https://github.com/apache/cloudstack/pull/4890#discussion_r712333915
##########
File path: setup/bindir/cloud-set-guest-sshkey-password-userdata-configdrive.in
##########
@@ -0,0 +1,507 @@
+#!/usr/bin/env bash
+
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+username=root
+userDataServerPort=8080
+configDriveLabel=config-2
+
+function findPrimaryNetwork(){
+ outputLog "Detecting primary network"
+ if command -v ip &> /dev/null
+ then
+ primaryNet=$(ip -o -4 route show to default | awk '{print $5}')
+ elif command -v netstat &> /dev/null
+ then
+ primaryNet=$(netstat -r4 | grep default | awk '{print $(NF)}')
+ elif command -v route &> /dev/null
+ then
+ primaryNet=$(route -4 2> /dev/null | grep default | awk '{print $(NF)}')
+ if [ -z "$primaryNet" ]
+ then
+ primaryNet=$(route get default 2> /dev/null | grep interface | tr -d ' ' | awk '{split($0,a,":"); print a[2]}')
+ fi
+ fi
+ if [ -z "$primaryNet" ]
+ then
+ outputLog "Could not find primary network"
+ return 1
+ fi
+ echo "$primaryNet"
+ return 0
+}
+
+function findUserDataServer(){
+ primaryNet=$1
+ outputLog "Trying to find userdata server"
+ if [ -z "$primaryNet" ]
+ then
+ outputLog "Unable to determine the userdata server, falling back to data-server"
+ echo "data-server"
+ return 0
+ fi
+
+ if command -v netplan &> /dev/null
+ then
+ outputLog "Operating System is using netplan"
+
+ userDataServer=$(netplan ip leases "$primaryNet" | grep SERVER_ADDRESS | awk '{split($0,a,"="); print a[2]}')
+
+ if [ -n "$userDataServer" ]
+ then
+ outputLog "Found userdata server IP $userDataServer in netplan config"
+ echo "$userDataServer"
+ return 0
+ fi
+ fi
+
+ if command -v nmcli &> /dev/null
+ then
+ outputLog "Operating System is using NetworkManager"
+
+ userDataServer=$(nmcli -t connection show "$(nmcli -t -f UUID,DEVICE connection | grep "$primaryNet" | awk '{split($0,a,":"); print a[1]}')" | grep next_server | tr -d ' ' |awk '{split($0,a,"="); print a[2]}')
+
+ if [ -n "$userDataServer" ]
+ then
+ outputLog "Found userdata server IP $userDataServer in NetworkManager config"
+ echo "$userDataServer"
+ return 0
+ fi
+ fi
+
+ if command -v wicked &> /dev/null
+ then
+ outputLog "Operating System is using wicked"
+
+ userDataServer=$(grep SERVERID /run/wicked/leaseinfo."$primaryNet"* | tr -d "'" | awk '{split($0,a,"="); print a[2]}')
+
+ if [ -n "$userDataServer" ]
+ then
+ outputLog "Found userdata server IP $userDataServer in wicked config"
+ echo "$userDataServer"
+ return 0
+ fi
+ fi
+
+ if command -v udhcpc &> /dev/null
+ then
+ outputLog "Operating System is using udhcpc"
+
+ userDataServer=$(< /run/dhcp-server-ip."$primaryNet")
+
+ if [ -n "$userDataServer" ]
+ then
+ outputLog "Found userdata server IP $userDataServer in udhcpc"
+ echo "$userDataServer"
+ return 0
+ fi
+ fi
+
+ outputLog "Searching for DHCP server in lease files"
+
+ primaryLease=$(
+ dhcpFolders="/var/lib/dhclient/* /var/lib/dhcp3/* /var/lib/dhcp/* /var/lib/NetworkManager/* /var/db/dhclient*"
+ for files in $dhcpFolders
+ do
+ if [ -e "$files" ]
+ then
+ < "$files" tr -d '\n' | sed 's/ //g ; s/lease {//g ; s/}/\n/g' | grep 'option routers'
+ fi
+ done
+ )
+
+ serverList=$(
+ IFS=$'\n'
+ for line in $(echo -e "$primaryLease")
+ do
+ splitLine=$(echo "$line" | sed -e 's/;/\n/g')
+ if date -j &> /dev/null
+ then
+ timestamp=$(date -j -f "%Y/%m/%d %H:%M:%S" "$(echo "$splitLine" | grep 'expire' | sed -r 's/.*expire [0-9]+ (.*)/\1/')" +"%s")
+ else
+ timestamp=$(date -d "$(echo "$splitLine" | grep 'expire' | sed -e 's/.*expire [0-9]\+ \(.*\)/\1/')" +"%s")
+ fi
+ interface=$(echo "$splitLine" | grep 'interface' | sed -e 's/.*interface "\(.*\)"/\1/')
+ server=$(echo "$splitLine" | grep 'dhcp-server-identifier' | sed -e 's/.*dhcp-server-identifier \(.*\)/\1/')
+ echo "$timestamp","$interface","$server"
+ done
+ )
+
+ userDataServer=$(echo "$serverList" | grep "$primaryNet" | sort -n | tail -1 | awk '{split($0,a,","); print a[3]}')
+
+ if [ -n "$userDataServer" ]
+ then
+ outputLog "Userdata server found: $userDataServer"
+ echo "$userDataServer"
+ return 0
+ fi
+
+ outputLog "Unable to determine the userdata server, falling back to data-server"
+ echo "data-server"
+ return 0
+}
+
+function getPasswordFromUserDataServer(){
+ userDataServer=$1
+ userDataServerPort=$2
+ outputLog "Sending request to userdata server at $userDataServer to get the password"
+ if ! response=$(curl --silent --connect-timeout 20 --retry 3 --header "DomU_Request: send_my_password" http://"$userDataServer":"$userDataServerPort")
+ then
+ outputLog "Failed to send request to userdata server at $userDataServer"
+ return 4
+ fi
+ outputLog "Got response from userdata server at $userDataServer"
+ response=$(echo "$response" | tr -d '\r')
+ case $response in
+ "")
+ outputLog "Userdata server at $userDataServer did not have any password for the VM"
+ return 2
+ ;;
+ "bad_request")
+ outputLog "VM sent an invalid request to userdata server at $userDataServer"
+ return 3
+ ;;
+ "saved_password")
+ outputLog "VM has already saved a password from the userdata server at $userDataServer"
+ return 1
+ ;;
+ *)
+ outputLog "VM got a valid password from server at $userDataServer"
+ echo "$response"
+ return 0
+ esac
+}
+
+function findHomeDirectory(){
+ username=$1
+ getent passwd "$username"|awk -F ":" '{print $6}'
+}
+
+function setPassword(){
+ username=$1
+ homeDir=$2
+ password=$3
+ if command -v md5sum &> /dev/null
+ then
+ newMd5=$(echo "$password" | md5sum | awk '{print $1}')
+ elif command -v md5 &> /dev/null
+ then
+ newMd5=$(echo "$password" | md5)
+ else
+ newMd5='N/A'
+ fi
+ if [ $newMd5 != 'N/A' ]
+ then
+ if [ -f "$homeDir"/.password.md5 ]
+ then
+ oldMd5=$(cat "$homeDir"/.password.md5)
+ fi
+ if [ "$newMd5" == "$oldMd5" ]
+ then
+ outputLog "There is no update of VM password"
+ return 0
+ fi
+ else
+ outputLog "Cannot determine change of password"
+ fi
+ outputLog "Changing password for user $username"
+ if command -v chpasswd &> /dev/null
+ then
+ echo "$username":"$password" | chpasswd
+ elif command -v usermod &> /dev/null && command -v mkpasswd &> /dev/null
+ then
+ usermod -p "$(mkpasswd -m SHA-512 "$password")" "$username"
+ elif command -v pw &> /dev/null
+ then
+ echo "$password" | pw mod user "$username" -h 0
+ else
+ outputLog "Failed to change password for user $username"
+ return 1
+ fi
+ outputLog "Successfully changed password for user $username"
+ if [ $newMd5 != 'N/A' ]
+ then
+ echo "$newMd5" > "$homeDir"/.password.md5
+ chmod 600 "$homeDir"/.password.md5
+ chown "$username": "$homeDir"/.password.md5
+ fi
+ return 0
+}
+
+function sendAckToUserDataServer(){
+ userDataServer=$1
+ userDataServerPort=$2
+ outputLog "Sending acknowledgment to userdata server at $userDataServer"
+ if ! curl --silent --connect-timeout 20 --retry 3 --header "DomU_Request: saved_password" "$userDataServer":"$userDataServerPort" &> /dev/null
+ then
+ outputLog "Failed to sent acknowledgment to userdata server at $userDataServer"
+ return 1
+ fi
+ outputLog "Successfully sent acknowledgment to userdata server at $userDataServer"
+ return 0
+}
+
+function getPublicKeyFromUserDataServer(){
+ userDataServer=$1
+ outputLog "Sending request to userdata server at $userDataServer to get public key"
+ if ! reponse=$(curl --silent --connect-timeout 20 --retry 3 http://"$userDataServer"/latest/public-keys)
Review comment:
Thank you for comment. It seems curl always return 0 in case of server error. I add --fail option to handle server errors.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [cloudstack] rhtyd commented on pull request #4890: Universal sshkey and password manager script
Posted by GitBox <gi...@apache.org>.
rhtyd commented on pull request #4890:
URL: https://github.com/apache/cloudstack/pull/4890#issuecomment-837028422
@aleskxyz how do we test it? And how it compare against cloud-init which supposedly works with CloudStack for most distros?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [cloudstack] weizhouapache commented on pull request #4890: Universal sshkey and password manager script
Posted by GitBox <gi...@apache.org>.
weizhouapache commented on pull request #4890:
URL: https://github.com/apache/cloudstack/pull/4890#issuecomment-910030112
@aleskxyz @nvazquez
I have tested the scripts, it works well in most test cases.
@aleskxyz I left two comments, please have a look.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [cloudstack] aleskxyz commented on pull request #4890: Universal sshkey and password manager script
Posted by GitBox <gi...@apache.org>.
aleskxyz commented on pull request #4890:
URL: https://github.com/apache/cloudstack/pull/4890#issuecomment-854551529
> Thanks, we need some manual test/confirmation and a doc PR to https://github.com/apache/cloudstack-documentation explaining how to use this.
@rhtyd
I'm working on it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [cloudstack] rhtyd commented on pull request #4890: Universal sshkey and password manager script
Posted by GitBox <gi...@apache.org>.
rhtyd commented on pull request #4890:
URL: https://github.com/apache/cloudstack/pull/4890#issuecomment-918838470
Ping @aleskxyz
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [cloudstack] aleskxyz commented on pull request #4890: Universal sshkey and password manager script
Posted by GitBox <gi...@apache.org>.
aleskxyz commented on pull request #4890:
URL: https://github.com/apache/cloudstack/pull/4890#issuecomment-923091804
@rhtyd @weizhouapache
Sorry for late reply and thank you for reviewing.
I have committed new changes.
Regards
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [cloudstack] weizhouapache commented on a change in pull request #4890: Universal sshkey and password manager script
Posted by GitBox <gi...@apache.org>.
weizhouapache commented on a change in pull request #4890:
URL: https://github.com/apache/cloudstack/pull/4890#discussion_r699963659
##########
File path: setup/bindir/cloud-set-guest-sshkey-password-userdata-configdrive.in
##########
@@ -0,0 +1,507 @@
+#!/usr/bin/env bash
+
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+username=root
+userDataServerPort=8080
+configDriveLabel=config-2
+
+function findPrimaryNetwork(){
+ outputLog "Detecting primary network"
+ if command -v ip &> /dev/null
+ then
+ primaryNet=$(ip -o -4 route show to default | awk '{print $5}')
+ elif command -v netstat &> /dev/null
+ then
+ primaryNet=$(netstat -r4 | grep default | awk '{print $(NF)}')
+ elif command -v route &> /dev/null
+ then
+ primaryNet=$(route -4 2> /dev/null | grep default | awk '{print $(NF)}')
+ if [ -z "$primaryNet" ]
+ then
+ primaryNet=$(route get default 2> /dev/null | grep interface | tr -d ' ' | awk '{split($0,a,":"); print a[2]}')
+ fi
+ fi
+ if [ -z "$primaryNet" ]
+ then
+ outputLog "Could not find primary network"
+ return 1
+ fi
+ echo "$primaryNet"
+ return 0
+}
+
+function findUserDataServer(){
+ primaryNet=$1
+ outputLog "Trying to find userdata server"
+ if [ -z "$primaryNet" ]
+ then
+ outputLog "Unable to determine the userdata server, falling back to data-server"
+ echo "data-server"
+ return 0
+ fi
+
+ if command -v netplan &> /dev/null
+ then
+ outputLog "Operating System is using netplan"
+
+ userDataServer=$(netplan ip leases "$primaryNet" | grep SERVER_ADDRESS | awk '{split($0,a,"="); print a[2]}')
+
+ if [ -n "$userDataServer" ]
+ then
+ outputLog "Found userdata server IP $userDataServer in netplan config"
+ echo "$userDataServer"
+ return 0
+ fi
+ fi
+
+ if command -v nmcli &> /dev/null
+ then
+ outputLog "Operating System is using NetworkManager"
+
+ userDataServer=$(nmcli -t connection show "$(nmcli -t -f UUID,DEVICE connection | grep "$primaryNet" | awk '{split($0,a,":"); print a[1]}')" | grep next_server | tr -d ' ' |awk '{split($0,a,"="); print a[2]}')
+
+ if [ -n "$userDataServer" ]
+ then
+ outputLog "Found userdata server IP $userDataServer in NetworkManager config"
+ echo "$userDataServer"
+ return 0
+ fi
+ fi
+
+ if command -v wicked &> /dev/null
+ then
+ outputLog "Operating System is using wicked"
+
+ userDataServer=$(grep SERVERID /run/wicked/leaseinfo."$primaryNet"* | tr -d "'" | awk '{split($0,a,"="); print a[2]}')
+
+ if [ -n "$userDataServer" ]
+ then
+ outputLog "Found userdata server IP $userDataServer in wicked config"
+ echo "$userDataServer"
+ return 0
+ fi
+ fi
+
+ if command -v udhcpc &> /dev/null
+ then
+ outputLog "Operating System is using udhcpc"
+
+ userDataServer=$(< /run/dhcp-server-ip."$primaryNet")
+
+ if [ -n "$userDataServer" ]
+ then
+ outputLog "Found userdata server IP $userDataServer in udhcpc"
+ echo "$userDataServer"
+ return 0
+ fi
+ fi
+
+ outputLog "Searching for DHCP server in lease files"
+
+ primaryLease=$(
+ dhcpFolders="/var/lib/dhclient/* /var/lib/dhcp3/* /var/lib/dhcp/* /var/lib/NetworkManager/* /var/db/dhclient*"
+ for files in $dhcpFolders
+ do
+ if [ -e "$files" ]
+ then
+ < "$files" tr -d '\n' | sed 's/ //g ; s/lease {//g ; s/}/\n/g' | grep 'option routers'
+ fi
+ done
+ )
+
+ serverList=$(
+ IFS=$'\n'
+ for line in $(echo -e "$primaryLease")
+ do
+ splitLine=$(echo "$line" | sed -e 's/;/\n/g')
+ if date -j &> /dev/null
+ then
+ timestamp=$(date -j -f "%Y/%m/%d %H:%M:%S" "$(echo "$splitLine" | grep 'expire' | sed -r 's/.*expire [0-9]+ (.*)/\1/')" +"%s")
+ else
+ timestamp=$(date -d "$(echo "$splitLine" | grep 'expire' | sed -e 's/.*expire [0-9]\+ \(.*\)/\1/')" +"%s")
+ fi
+ interface=$(echo "$splitLine" | grep 'interface' | sed -e 's/.*interface "\(.*\)"/\1/')
+ server=$(echo "$splitLine" | grep 'dhcp-server-identifier' | sed -e 's/.*dhcp-server-identifier \(.*\)/\1/')
+ echo "$timestamp","$interface","$server"
+ done
+ )
+
+ userDataServer=$(echo "$serverList" | grep "$primaryNet" | sort -n | tail -1 | awk '{split($0,a,","); print a[3]}')
+
+ if [ -n "$userDataServer" ]
+ then
+ outputLog "Userdata server found: $userDataServer"
+ echo "$userDataServer"
+ return 0
+ fi
+
+ outputLog "Unable to determine the userdata server, falling back to data-server"
+ echo "data-server"
+ return 0
+}
+
+function getPasswordFromUserDataServer(){
+ userDataServer=$1
+ userDataServerPort=$2
+ outputLog "Sending request to userdata server at $userDataServer to get the password"
+ if ! response=$(curl --silent --connect-timeout 20 --retry 3 --header "DomU_Request: send_my_password" http://"$userDataServer":"$userDataServerPort")
+ then
+ outputLog "Failed to send request to userdata server at $userDataServer"
+ return 4
+ fi
+ outputLog "Got response from userdata server at $userDataServer"
+ response=$(echo "$response" | tr -d '\r')
+ case $response in
+ "")
+ outputLog "Userdata server at $userDataServer did not have any password for the VM"
+ return 2
+ ;;
+ "bad_request")
+ outputLog "VM sent an invalid request to userdata server at $userDataServer"
+ return 3
+ ;;
+ "saved_password")
+ outputLog "VM has already saved a password from the userdata server at $userDataServer"
+ return 1
+ ;;
+ *)
+ outputLog "VM got a valid password from server at $userDataServer"
+ echo "$response"
+ return 0
+ esac
+}
+
+function findHomeDirectory(){
+ username=$1
+ getent passwd "$username"|awk -F ":" '{print $6}'
+}
+
+function setPassword(){
+ username=$1
+ homeDir=$2
+ password=$3
+ if command -v md5sum &> /dev/null
+ then
+ newMd5=$(echo "$password" | md5sum | awk '{print $1}')
+ elif command -v md5 &> /dev/null
+ then
+ newMd5=$(echo "$password" | md5)
+ else
+ newMd5='N/A'
+ fi
+ if [ $newMd5 != 'N/A' ]
+ then
+ if [ -f "$homeDir"/.password.md5 ]
+ then
+ oldMd5=$(cat "$homeDir"/.password.md5)
+ fi
+ if [ "$newMd5" == "$oldMd5" ]
+ then
+ outputLog "There is no update of VM password"
+ return 0
+ fi
+ else
+ outputLog "Cannot determine change of password"
+ fi
+ outputLog "Changing password for user $username"
+ if command -v chpasswd &> /dev/null
+ then
+ echo "$username":"$password" | chpasswd
+ elif command -v usermod &> /dev/null && command -v mkpasswd &> /dev/null
+ then
+ usermod -p "$(mkpasswd -m SHA-512 "$password")" "$username"
+ elif command -v pw &> /dev/null
+ then
+ echo "$password" | pw mod user "$username" -h 0
+ else
+ outputLog "Failed to change password for user $username"
+ return 1
+ fi
+ outputLog "Successfully changed password for user $username"
+ if [ $newMd5 != 'N/A' ]
+ then
+ echo "$newMd5" > "$homeDir"/.password.md5
+ chmod 600 "$homeDir"/.password.md5
+ chown "$username": "$homeDir"/.password.md5
+ fi
+ return 0
+}
+
+function sendAckToUserDataServer(){
+ userDataServer=$1
+ userDataServerPort=$2
+ outputLog "Sending acknowledgment to userdata server at $userDataServer"
+ if ! curl --silent --connect-timeout 20 --retry 3 --header "DomU_Request: saved_password" "$userDataServer":"$userDataServerPort" &> /dev/null
+ then
+ outputLog "Failed to sent acknowledgment to userdata server at $userDataServer"
+ return 1
+ fi
+ outputLog "Successfully sent acknowledgment to userdata server at $userDataServer"
+ return 0
+}
+
+function getPublicKeyFromUserDataServer(){
+ userDataServer=$1
+ outputLog "Sending request to userdata server at $userDataServer to get public key"
+ if ! reponse=$(curl --silent --connect-timeout 20 --retry 3 http://"$userDataServer"/latest/public-keys)
Review comment:
@aleskxyz
for vms with configdrive, the url `http://"$userDataServer"/latest/public-keys` returns 404, so if there is no public key in configdrive ISO, the the authorized_keys in vm is
```
[root@configdrive-001 ~]# cat .ssh/authorized_keys
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>404 Not Found</title>
</head><body>
<h1>Not Found</h1>
<p>The requested URL was not found on this server.</p>
</body></html>
```
it would be better to check the return code.
##########
File path: setup/bindir/cloud-set-guest-sshkey-password-userdata-configdrive.in
##########
@@ -0,0 +1,507 @@
+#!/usr/bin/env bash
+
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+username=root
+userDataServerPort=8080
+configDriveLabel=config-2
+
+function findPrimaryNetwork(){
+ outputLog "Detecting primary network"
+ if command -v ip &> /dev/null
+ then
+ primaryNet=$(ip -o -4 route show to default | awk '{print $5}')
+ elif command -v netstat &> /dev/null
+ then
+ primaryNet=$(netstat -r4 | grep default | awk '{print $(NF)}')
+ elif command -v route &> /dev/null
+ then
+ primaryNet=$(route -4 2> /dev/null | grep default | awk '{print $(NF)}')
+ if [ -z "$primaryNet" ]
+ then
+ primaryNet=$(route get default 2> /dev/null | grep interface | tr -d ' ' | awk '{split($0,a,":"); print a[2]}')
+ fi
+ fi
+ if [ -z "$primaryNet" ]
+ then
+ outputLog "Could not find primary network"
+ return 1
+ fi
+ echo "$primaryNet"
+ return 0
+}
+
+function findUserDataServer(){
+ primaryNet=$1
+ outputLog "Trying to find userdata server"
+ if [ -z "$primaryNet" ]
+ then
+ outputLog "Unable to determine the userdata server, falling back to data-server"
+ echo "data-server"
+ return 0
+ fi
+
+ if command -v netplan &> /dev/null
+ then
+ outputLog "Operating System is using netplan"
+
+ userDataServer=$(netplan ip leases "$primaryNet" | grep SERVER_ADDRESS | awk '{split($0,a,"="); print a[2]}')
+
+ if [ -n "$userDataServer" ]
+ then
+ outputLog "Found userdata server IP $userDataServer in netplan config"
+ echo "$userDataServer"
+ return 0
+ fi
+ fi
+
+ if command -v nmcli &> /dev/null
+ then
+ outputLog "Operating System is using NetworkManager"
+
+ userDataServer=$(nmcli -t connection show "$(nmcli -t -f UUID,DEVICE connection | grep "$primaryNet" | awk '{split($0,a,":"); print a[1]}')" | grep next_server | tr -d ' ' |awk '{split($0,a,"="); print a[2]}')
+
+ if [ -n "$userDataServer" ]
+ then
+ outputLog "Found userdata server IP $userDataServer in NetworkManager config"
+ echo "$userDataServer"
+ return 0
+ fi
+ fi
+
+ if command -v wicked &> /dev/null
+ then
+ outputLog "Operating System is using wicked"
+
+ userDataServer=$(grep SERVERID /run/wicked/leaseinfo."$primaryNet"* | tr -d "'" | awk '{split($0,a,"="); print a[2]}')
+
+ if [ -n "$userDataServer" ]
+ then
+ outputLog "Found userdata server IP $userDataServer in wicked config"
+ echo "$userDataServer"
+ return 0
+ fi
+ fi
+
+ if command -v udhcpc &> /dev/null
+ then
+ outputLog "Operating System is using udhcpc"
+
+ userDataServer=$(< /run/dhcp-server-ip."$primaryNet")
+
+ if [ -n "$userDataServer" ]
+ then
+ outputLog "Found userdata server IP $userDataServer in udhcpc"
+ echo "$userDataServer"
+ return 0
+ fi
+ fi
+
+ outputLog "Searching for DHCP server in lease files"
+
+ primaryLease=$(
+ dhcpFolders="/var/lib/dhclient/* /var/lib/dhcp3/* /var/lib/dhcp/* /var/lib/NetworkManager/* /var/db/dhclient*"
+ for files in $dhcpFolders
+ do
+ if [ -e "$files" ]
+ then
+ < "$files" tr -d '\n' | sed 's/ //g ; s/lease {//g ; s/}/\n/g' | grep 'option routers'
+ fi
+ done
+ )
+
+ serverList=$(
+ IFS=$'\n'
+ for line in $(echo -e "$primaryLease")
+ do
+ splitLine=$(echo "$line" | sed -e 's/;/\n/g')
+ if date -j &> /dev/null
+ then
+ timestamp=$(date -j -f "%Y/%m/%d %H:%M:%S" "$(echo "$splitLine" | grep 'expire' | sed -r 's/.*expire [0-9]+ (.*)/\1/')" +"%s")
+ else
+ timestamp=$(date -d "$(echo "$splitLine" | grep 'expire' | sed -e 's/.*expire [0-9]\+ \(.*\)/\1/')" +"%s")
+ fi
+ interface=$(echo "$splitLine" | grep 'interface' | sed -e 's/.*interface "\(.*\)"/\1/')
+ server=$(echo "$splitLine" | grep 'dhcp-server-identifier' | sed -e 's/.*dhcp-server-identifier \(.*\)/\1/')
+ echo "$timestamp","$interface","$server"
+ done
+ )
+
+ userDataServer=$(echo "$serverList" | grep "$primaryNet" | sort -n | tail -1 | awk '{split($0,a,","); print a[3]}')
+
+ if [ -n "$userDataServer" ]
+ then
+ outputLog "Userdata server found: $userDataServer"
+ echo "$userDataServer"
+ return 0
+ fi
+
+ outputLog "Unable to determine the userdata server, falling back to data-server"
+ echo "data-server"
+ return 0
+}
+
+function getPasswordFromUserDataServer(){
+ userDataServer=$1
+ userDataServerPort=$2
+ outputLog "Sending request to userdata server at $userDataServer to get the password"
+ if ! response=$(curl --silent --connect-timeout 20 --retry 3 --header "DomU_Request: send_my_password" http://"$userDataServer":"$userDataServerPort")
+ then
+ outputLog "Failed to send request to userdata server at $userDataServer"
+ return 4
+ fi
+ outputLog "Got response from userdata server at $userDataServer"
+ response=$(echo "$response" | tr -d '\r')
+ case $response in
+ "")
+ outputLog "Userdata server at $userDataServer did not have any password for the VM"
+ return 2
+ ;;
+ "bad_request")
+ outputLog "VM sent an invalid request to userdata server at $userDataServer"
+ return 3
+ ;;
+ "saved_password")
+ outputLog "VM has already saved a password from the userdata server at $userDataServer"
+ return 1
+ ;;
+ *)
+ outputLog "VM got a valid password from server at $userDataServer"
+ echo "$response"
+ return 0
+ esac
+}
+
+function findHomeDirectory(){
+ username=$1
+ getent passwd "$username"|awk -F ":" '{print $6}'
+}
+
+function setPassword(){
+ username=$1
+ homeDir=$2
+ password=$3
+ if command -v md5sum &> /dev/null
+ then
+ newMd5=$(echo "$password" | md5sum | awk '{print $1}')
+ elif command -v md5 &> /dev/null
+ then
+ newMd5=$(echo "$password" | md5)
+ else
+ newMd5='N/A'
+ fi
+ if [ $newMd5 != 'N/A' ]
+ then
+ if [ -f "$homeDir"/.password.md5 ]
+ then
+ oldMd5=$(cat "$homeDir"/.password.md5)
+ fi
+ if [ "$newMd5" == "$oldMd5" ]
+ then
+ outputLog "There is no update of VM password"
+ return 0
+ fi
+ else
+ outputLog "Cannot determine change of password"
+ fi
+ outputLog "Changing password for user $username"
+ if command -v chpasswd &> /dev/null
+ then
+ echo "$username":"$password" | chpasswd
+ elif command -v usermod &> /dev/null && command -v mkpasswd &> /dev/null
+ then
+ usermod -p "$(mkpasswd -m SHA-512 "$password")" "$username"
+ elif command -v pw &> /dev/null
+ then
+ echo "$password" | pw mod user "$username" -h 0
+ else
+ outputLog "Failed to change password for user $username"
+ return 1
+ fi
+ outputLog "Successfully changed password for user $username"
+ if [ $newMd5 != 'N/A' ]
+ then
+ echo "$newMd5" > "$homeDir"/.password.md5
+ chmod 600 "$homeDir"/.password.md5
+ chown "$username": "$homeDir"/.password.md5
+ fi
+ return 0
+}
+
+function sendAckToUserDataServer(){
+ userDataServer=$1
+ userDataServerPort=$2
+ outputLog "Sending acknowledgment to userdata server at $userDataServer"
+ if ! curl --silent --connect-timeout 20 --retry 3 --header "DomU_Request: saved_password" "$userDataServer":"$userDataServerPort" &> /dev/null
+ then
+ outputLog "Failed to sent acknowledgment to userdata server at $userDataServer"
+ return 1
+ fi
+ outputLog "Successfully sent acknowledgment to userdata server at $userDataServer"
+ return 0
+}
+
+function getPublicKeyFromUserDataServer(){
+ userDataServer=$1
+ outputLog "Sending request to userdata server at $userDataServer to get public key"
+ if ! reponse=$(curl --silent --connect-timeout 20 --retry 3 http://"$userDataServer"/latest/public-keys)
+ then
+ outputLog "Failed to get public key from userdata server"
+ return 2
+ fi
+ outputLog "Got response from userdata server at $userDataServer"
+ if [ -z "$reponse" ]
+ then
+ outputLog "Did not receive any public keys from userdata server"
+ return 1
+ fi
+ outputLog "Successfully get public key from userdata server"
+ echo "$reponse"
+ return 0
+}
+
+function setPublicKey(){
+ username=$1
+ homeDir=$2
+ publicKey=$3
+ outputLog "Applying public key for $username"
+ sshDir=$homeDir/.ssh
+ authorizedKeysFile=$sshDir/authorized_keys
+
+ if [ ! -d "$sshDir" ]
+ then
+ outputLog ".ssh directory for $username not found, creating .ssh directory"
+ mkdir "$sshDir"
+ fi
+
+ if [ ! -f "$authorizedKeysFile" ]
+ then
+ outputLog "authorized_keys file for $username not found, creating authorized_keys file"
+ touch "$authorizedKeysFile"
+ fi
+ if grep "$(echo "$publicKey" | awk '{print $2}')" "$authorizedKeysFile" > /dev/null
+ then
+ outputLog "No need to update authorized_keys file"
+ return 0
+ fi
+ outputLog "Writing public key in authorized_keys file"
+ echo "$publicKey" >> "$authorizedKeysFile"
Review comment:
if use ">>", old ssh key will not be removed
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [cloudstack] DaanHoogland commented on pull request #4890: Universal sshkey and password manager script
Posted by GitBox <gi...@apache.org>.
DaanHoogland commented on pull request #4890:
URL: https://github.com/apache/cloudstack/pull/4890#issuecomment-813937377
thanks for this @aleskxyz . looks ok.
Have you no non-linux clients to test? ;)
And can you please add an Issue or add more functional description to the PR?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [cloudstack] weizhouapache commented on pull request #4890: Universal sshkey and password manager script
Posted by GitBox <gi...@apache.org>.
weizhouapache commented on pull request #4890:
URL: https://github.com/apache/cloudstack/pull/4890#issuecomment-910030112
@aleskxyz @nvazquez
I have tested the scripts, it works well in most test cases.
@aleskxyz I left two comments, please have a look.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [cloudstack] weizhouapache commented on a change in pull request #4890: Universal sshkey and password manager script
Posted by GitBox <gi...@apache.org>.
weizhouapache commented on a change in pull request #4890:
URL: https://github.com/apache/cloudstack/pull/4890#discussion_r699963659
##########
File path: setup/bindir/cloud-set-guest-sshkey-password-userdata-configdrive.in
##########
@@ -0,0 +1,507 @@
+#!/usr/bin/env bash
+
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+username=root
+userDataServerPort=8080
+configDriveLabel=config-2
+
+function findPrimaryNetwork(){
+ outputLog "Detecting primary network"
+ if command -v ip &> /dev/null
+ then
+ primaryNet=$(ip -o -4 route show to default | awk '{print $5}')
+ elif command -v netstat &> /dev/null
+ then
+ primaryNet=$(netstat -r4 | grep default | awk '{print $(NF)}')
+ elif command -v route &> /dev/null
+ then
+ primaryNet=$(route -4 2> /dev/null | grep default | awk '{print $(NF)}')
+ if [ -z "$primaryNet" ]
+ then
+ primaryNet=$(route get default 2> /dev/null | grep interface | tr -d ' ' | awk '{split($0,a,":"); print a[2]}')
+ fi
+ fi
+ if [ -z "$primaryNet" ]
+ then
+ outputLog "Could not find primary network"
+ return 1
+ fi
+ echo "$primaryNet"
+ return 0
+}
+
+function findUserDataServer(){
+ primaryNet=$1
+ outputLog "Trying to find userdata server"
+ if [ -z "$primaryNet" ]
+ then
+ outputLog "Unable to determine the userdata server, falling back to data-server"
+ echo "data-server"
+ return 0
+ fi
+
+ if command -v netplan &> /dev/null
+ then
+ outputLog "Operating System is using netplan"
+
+ userDataServer=$(netplan ip leases "$primaryNet" | grep SERVER_ADDRESS | awk '{split($0,a,"="); print a[2]}')
+
+ if [ -n "$userDataServer" ]
+ then
+ outputLog "Found userdata server IP $userDataServer in netplan config"
+ echo "$userDataServer"
+ return 0
+ fi
+ fi
+
+ if command -v nmcli &> /dev/null
+ then
+ outputLog "Operating System is using NetworkManager"
+
+ userDataServer=$(nmcli -t connection show "$(nmcli -t -f UUID,DEVICE connection | grep "$primaryNet" | awk '{split($0,a,":"); print a[1]}')" | grep next_server | tr -d ' ' |awk '{split($0,a,"="); print a[2]}')
+
+ if [ -n "$userDataServer" ]
+ then
+ outputLog "Found userdata server IP $userDataServer in NetworkManager config"
+ echo "$userDataServer"
+ return 0
+ fi
+ fi
+
+ if command -v wicked &> /dev/null
+ then
+ outputLog "Operating System is using wicked"
+
+ userDataServer=$(grep SERVERID /run/wicked/leaseinfo."$primaryNet"* | tr -d "'" | awk '{split($0,a,"="); print a[2]}')
+
+ if [ -n "$userDataServer" ]
+ then
+ outputLog "Found userdata server IP $userDataServer in wicked config"
+ echo "$userDataServer"
+ return 0
+ fi
+ fi
+
+ if command -v udhcpc &> /dev/null
+ then
+ outputLog "Operating System is using udhcpc"
+
+ userDataServer=$(< /run/dhcp-server-ip."$primaryNet")
+
+ if [ -n "$userDataServer" ]
+ then
+ outputLog "Found userdata server IP $userDataServer in udhcpc"
+ echo "$userDataServer"
+ return 0
+ fi
+ fi
+
+ outputLog "Searching for DHCP server in lease files"
+
+ primaryLease=$(
+ dhcpFolders="/var/lib/dhclient/* /var/lib/dhcp3/* /var/lib/dhcp/* /var/lib/NetworkManager/* /var/db/dhclient*"
+ for files in $dhcpFolders
+ do
+ if [ -e "$files" ]
+ then
+ < "$files" tr -d '\n' | sed 's/ //g ; s/lease {//g ; s/}/\n/g' | grep 'option routers'
+ fi
+ done
+ )
+
+ serverList=$(
+ IFS=$'\n'
+ for line in $(echo -e "$primaryLease")
+ do
+ splitLine=$(echo "$line" | sed -e 's/;/\n/g')
+ if date -j &> /dev/null
+ then
+ timestamp=$(date -j -f "%Y/%m/%d %H:%M:%S" "$(echo "$splitLine" | grep 'expire' | sed -r 's/.*expire [0-9]+ (.*)/\1/')" +"%s")
+ else
+ timestamp=$(date -d "$(echo "$splitLine" | grep 'expire' | sed -e 's/.*expire [0-9]\+ \(.*\)/\1/')" +"%s")
+ fi
+ interface=$(echo "$splitLine" | grep 'interface' | sed -e 's/.*interface "\(.*\)"/\1/')
+ server=$(echo "$splitLine" | grep 'dhcp-server-identifier' | sed -e 's/.*dhcp-server-identifier \(.*\)/\1/')
+ echo "$timestamp","$interface","$server"
+ done
+ )
+
+ userDataServer=$(echo "$serverList" | grep "$primaryNet" | sort -n | tail -1 | awk '{split($0,a,","); print a[3]}')
+
+ if [ -n "$userDataServer" ]
+ then
+ outputLog "Userdata server found: $userDataServer"
+ echo "$userDataServer"
+ return 0
+ fi
+
+ outputLog "Unable to determine the userdata server, falling back to data-server"
+ echo "data-server"
+ return 0
+}
+
+function getPasswordFromUserDataServer(){
+ userDataServer=$1
+ userDataServerPort=$2
+ outputLog "Sending request to userdata server at $userDataServer to get the password"
+ if ! response=$(curl --silent --connect-timeout 20 --retry 3 --header "DomU_Request: send_my_password" http://"$userDataServer":"$userDataServerPort")
+ then
+ outputLog "Failed to send request to userdata server at $userDataServer"
+ return 4
+ fi
+ outputLog "Got response from userdata server at $userDataServer"
+ response=$(echo "$response" | tr -d '\r')
+ case $response in
+ "")
+ outputLog "Userdata server at $userDataServer did not have any password for the VM"
+ return 2
+ ;;
+ "bad_request")
+ outputLog "VM sent an invalid request to userdata server at $userDataServer"
+ return 3
+ ;;
+ "saved_password")
+ outputLog "VM has already saved a password from the userdata server at $userDataServer"
+ return 1
+ ;;
+ *)
+ outputLog "VM got a valid password from server at $userDataServer"
+ echo "$response"
+ return 0
+ esac
+}
+
+function findHomeDirectory(){
+ username=$1
+ getent passwd "$username"|awk -F ":" '{print $6}'
+}
+
+function setPassword(){
+ username=$1
+ homeDir=$2
+ password=$3
+ if command -v md5sum &> /dev/null
+ then
+ newMd5=$(echo "$password" | md5sum | awk '{print $1}')
+ elif command -v md5 &> /dev/null
+ then
+ newMd5=$(echo "$password" | md5)
+ else
+ newMd5='N/A'
+ fi
+ if [ $newMd5 != 'N/A' ]
+ then
+ if [ -f "$homeDir"/.password.md5 ]
+ then
+ oldMd5=$(cat "$homeDir"/.password.md5)
+ fi
+ if [ "$newMd5" == "$oldMd5" ]
+ then
+ outputLog "There is no update of VM password"
+ return 0
+ fi
+ else
+ outputLog "Cannot determine change of password"
+ fi
+ outputLog "Changing password for user $username"
+ if command -v chpasswd &> /dev/null
+ then
+ echo "$username":"$password" | chpasswd
+ elif command -v usermod &> /dev/null && command -v mkpasswd &> /dev/null
+ then
+ usermod -p "$(mkpasswd -m SHA-512 "$password")" "$username"
+ elif command -v pw &> /dev/null
+ then
+ echo "$password" | pw mod user "$username" -h 0
+ else
+ outputLog "Failed to change password for user $username"
+ return 1
+ fi
+ outputLog "Successfully changed password for user $username"
+ if [ $newMd5 != 'N/A' ]
+ then
+ echo "$newMd5" > "$homeDir"/.password.md5
+ chmod 600 "$homeDir"/.password.md5
+ chown "$username": "$homeDir"/.password.md5
+ fi
+ return 0
+}
+
+function sendAckToUserDataServer(){
+ userDataServer=$1
+ userDataServerPort=$2
+ outputLog "Sending acknowledgment to userdata server at $userDataServer"
+ if ! curl --silent --connect-timeout 20 --retry 3 --header "DomU_Request: saved_password" "$userDataServer":"$userDataServerPort" &> /dev/null
+ then
+ outputLog "Failed to sent acknowledgment to userdata server at $userDataServer"
+ return 1
+ fi
+ outputLog "Successfully sent acknowledgment to userdata server at $userDataServer"
+ return 0
+}
+
+function getPublicKeyFromUserDataServer(){
+ userDataServer=$1
+ outputLog "Sending request to userdata server at $userDataServer to get public key"
+ if ! reponse=$(curl --silent --connect-timeout 20 --retry 3 http://"$userDataServer"/latest/public-keys)
Review comment:
@aleskxyz
for vms with configdrive, the url `http://"$userDataServer"/latest/public-keys` returns 404, so if there is no public key in configdrive ISO, the the authorized_keys in vm is
```
[root@configdrive-001 ~]# cat .ssh/authorized_keys
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>404 Not Found</title>
</head><body>
<h1>Not Found</h1>
<p>The requested URL was not found on this server.</p>
</body></html>
```
it would be better to check the return code.
##########
File path: setup/bindir/cloud-set-guest-sshkey-password-userdata-configdrive.in
##########
@@ -0,0 +1,507 @@
+#!/usr/bin/env bash
+
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+username=root
+userDataServerPort=8080
+configDriveLabel=config-2
+
+function findPrimaryNetwork(){
+ outputLog "Detecting primary network"
+ if command -v ip &> /dev/null
+ then
+ primaryNet=$(ip -o -4 route show to default | awk '{print $5}')
+ elif command -v netstat &> /dev/null
+ then
+ primaryNet=$(netstat -r4 | grep default | awk '{print $(NF)}')
+ elif command -v route &> /dev/null
+ then
+ primaryNet=$(route -4 2> /dev/null | grep default | awk '{print $(NF)}')
+ if [ -z "$primaryNet" ]
+ then
+ primaryNet=$(route get default 2> /dev/null | grep interface | tr -d ' ' | awk '{split($0,a,":"); print a[2]}')
+ fi
+ fi
+ if [ -z "$primaryNet" ]
+ then
+ outputLog "Could not find primary network"
+ return 1
+ fi
+ echo "$primaryNet"
+ return 0
+}
+
+function findUserDataServer(){
+ primaryNet=$1
+ outputLog "Trying to find userdata server"
+ if [ -z "$primaryNet" ]
+ then
+ outputLog "Unable to determine the userdata server, falling back to data-server"
+ echo "data-server"
+ return 0
+ fi
+
+ if command -v netplan &> /dev/null
+ then
+ outputLog "Operating System is using netplan"
+
+ userDataServer=$(netplan ip leases "$primaryNet" | grep SERVER_ADDRESS | awk '{split($0,a,"="); print a[2]}')
+
+ if [ -n "$userDataServer" ]
+ then
+ outputLog "Found userdata server IP $userDataServer in netplan config"
+ echo "$userDataServer"
+ return 0
+ fi
+ fi
+
+ if command -v nmcli &> /dev/null
+ then
+ outputLog "Operating System is using NetworkManager"
+
+ userDataServer=$(nmcli -t connection show "$(nmcli -t -f UUID,DEVICE connection | grep "$primaryNet" | awk '{split($0,a,":"); print a[1]}')" | grep next_server | tr -d ' ' |awk '{split($0,a,"="); print a[2]}')
+
+ if [ -n "$userDataServer" ]
+ then
+ outputLog "Found userdata server IP $userDataServer in NetworkManager config"
+ echo "$userDataServer"
+ return 0
+ fi
+ fi
+
+ if command -v wicked &> /dev/null
+ then
+ outputLog "Operating System is using wicked"
+
+ userDataServer=$(grep SERVERID /run/wicked/leaseinfo."$primaryNet"* | tr -d "'" | awk '{split($0,a,"="); print a[2]}')
+
+ if [ -n "$userDataServer" ]
+ then
+ outputLog "Found userdata server IP $userDataServer in wicked config"
+ echo "$userDataServer"
+ return 0
+ fi
+ fi
+
+ if command -v udhcpc &> /dev/null
+ then
+ outputLog "Operating System is using udhcpc"
+
+ userDataServer=$(< /run/dhcp-server-ip."$primaryNet")
+
+ if [ -n "$userDataServer" ]
+ then
+ outputLog "Found userdata server IP $userDataServer in udhcpc"
+ echo "$userDataServer"
+ return 0
+ fi
+ fi
+
+ outputLog "Searching for DHCP server in lease files"
+
+ primaryLease=$(
+ dhcpFolders="/var/lib/dhclient/* /var/lib/dhcp3/* /var/lib/dhcp/* /var/lib/NetworkManager/* /var/db/dhclient*"
+ for files in $dhcpFolders
+ do
+ if [ -e "$files" ]
+ then
+ < "$files" tr -d '\n' | sed 's/ //g ; s/lease {//g ; s/}/\n/g' | grep 'option routers'
+ fi
+ done
+ )
+
+ serverList=$(
+ IFS=$'\n'
+ for line in $(echo -e "$primaryLease")
+ do
+ splitLine=$(echo "$line" | sed -e 's/;/\n/g')
+ if date -j &> /dev/null
+ then
+ timestamp=$(date -j -f "%Y/%m/%d %H:%M:%S" "$(echo "$splitLine" | grep 'expire' | sed -r 's/.*expire [0-9]+ (.*)/\1/')" +"%s")
+ else
+ timestamp=$(date -d "$(echo "$splitLine" | grep 'expire' | sed -e 's/.*expire [0-9]\+ \(.*\)/\1/')" +"%s")
+ fi
+ interface=$(echo "$splitLine" | grep 'interface' | sed -e 's/.*interface "\(.*\)"/\1/')
+ server=$(echo "$splitLine" | grep 'dhcp-server-identifier' | sed -e 's/.*dhcp-server-identifier \(.*\)/\1/')
+ echo "$timestamp","$interface","$server"
+ done
+ )
+
+ userDataServer=$(echo "$serverList" | grep "$primaryNet" | sort -n | tail -1 | awk '{split($0,a,","); print a[3]}')
+
+ if [ -n "$userDataServer" ]
+ then
+ outputLog "Userdata server found: $userDataServer"
+ echo "$userDataServer"
+ return 0
+ fi
+
+ outputLog "Unable to determine the userdata server, falling back to data-server"
+ echo "data-server"
+ return 0
+}
+
+function getPasswordFromUserDataServer(){
+ userDataServer=$1
+ userDataServerPort=$2
+ outputLog "Sending request to userdata server at $userDataServer to get the password"
+ if ! response=$(curl --silent --connect-timeout 20 --retry 3 --header "DomU_Request: send_my_password" http://"$userDataServer":"$userDataServerPort")
+ then
+ outputLog "Failed to send request to userdata server at $userDataServer"
+ return 4
+ fi
+ outputLog "Got response from userdata server at $userDataServer"
+ response=$(echo "$response" | tr -d '\r')
+ case $response in
+ "")
+ outputLog "Userdata server at $userDataServer did not have any password for the VM"
+ return 2
+ ;;
+ "bad_request")
+ outputLog "VM sent an invalid request to userdata server at $userDataServer"
+ return 3
+ ;;
+ "saved_password")
+ outputLog "VM has already saved a password from the userdata server at $userDataServer"
+ return 1
+ ;;
+ *)
+ outputLog "VM got a valid password from server at $userDataServer"
+ echo "$response"
+ return 0
+ esac
+}
+
+function findHomeDirectory(){
+ username=$1
+ getent passwd "$username"|awk -F ":" '{print $6}'
+}
+
+function setPassword(){
+ username=$1
+ homeDir=$2
+ password=$3
+ if command -v md5sum &> /dev/null
+ then
+ newMd5=$(echo "$password" | md5sum | awk '{print $1}')
+ elif command -v md5 &> /dev/null
+ then
+ newMd5=$(echo "$password" | md5)
+ else
+ newMd5='N/A'
+ fi
+ if [ $newMd5 != 'N/A' ]
+ then
+ if [ -f "$homeDir"/.password.md5 ]
+ then
+ oldMd5=$(cat "$homeDir"/.password.md5)
+ fi
+ if [ "$newMd5" == "$oldMd5" ]
+ then
+ outputLog "There is no update of VM password"
+ return 0
+ fi
+ else
+ outputLog "Cannot determine change of password"
+ fi
+ outputLog "Changing password for user $username"
+ if command -v chpasswd &> /dev/null
+ then
+ echo "$username":"$password" | chpasswd
+ elif command -v usermod &> /dev/null && command -v mkpasswd &> /dev/null
+ then
+ usermod -p "$(mkpasswd -m SHA-512 "$password")" "$username"
+ elif command -v pw &> /dev/null
+ then
+ echo "$password" | pw mod user "$username" -h 0
+ else
+ outputLog "Failed to change password for user $username"
+ return 1
+ fi
+ outputLog "Successfully changed password for user $username"
+ if [ $newMd5 != 'N/A' ]
+ then
+ echo "$newMd5" > "$homeDir"/.password.md5
+ chmod 600 "$homeDir"/.password.md5
+ chown "$username": "$homeDir"/.password.md5
+ fi
+ return 0
+}
+
+function sendAckToUserDataServer(){
+ userDataServer=$1
+ userDataServerPort=$2
+ outputLog "Sending acknowledgment to userdata server at $userDataServer"
+ if ! curl --silent --connect-timeout 20 --retry 3 --header "DomU_Request: saved_password" "$userDataServer":"$userDataServerPort" &> /dev/null
+ then
+ outputLog "Failed to sent acknowledgment to userdata server at $userDataServer"
+ return 1
+ fi
+ outputLog "Successfully sent acknowledgment to userdata server at $userDataServer"
+ return 0
+}
+
+function getPublicKeyFromUserDataServer(){
+ userDataServer=$1
+ outputLog "Sending request to userdata server at $userDataServer to get public key"
+ if ! reponse=$(curl --silent --connect-timeout 20 --retry 3 http://"$userDataServer"/latest/public-keys)
+ then
+ outputLog "Failed to get public key from userdata server"
+ return 2
+ fi
+ outputLog "Got response from userdata server at $userDataServer"
+ if [ -z "$reponse" ]
+ then
+ outputLog "Did not receive any public keys from userdata server"
+ return 1
+ fi
+ outputLog "Successfully get public key from userdata server"
+ echo "$reponse"
+ return 0
+}
+
+function setPublicKey(){
+ username=$1
+ homeDir=$2
+ publicKey=$3
+ outputLog "Applying public key for $username"
+ sshDir=$homeDir/.ssh
+ authorizedKeysFile=$sshDir/authorized_keys
+
+ if [ ! -d "$sshDir" ]
+ then
+ outputLog ".ssh directory for $username not found, creating .ssh directory"
+ mkdir "$sshDir"
+ fi
+
+ if [ ! -f "$authorizedKeysFile" ]
+ then
+ outputLog "authorized_keys file for $username not found, creating authorized_keys file"
+ touch "$authorizedKeysFile"
+ fi
+ if grep "$(echo "$publicKey" | awk '{print $2}')" "$authorizedKeysFile" > /dev/null
+ then
+ outputLog "No need to update authorized_keys file"
+ return 0
+ fi
+ outputLog "Writing public key in authorized_keys file"
+ echo "$publicKey" >> "$authorizedKeysFile"
Review comment:
if use ">>", old ssh key will not be removed
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [cloudstack] aleskxyz commented on a change in pull request #4890: Universal sshkey and password manager script
Posted by GitBox <gi...@apache.org>.
aleskxyz commented on a change in pull request #4890:
URL: https://github.com/apache/cloudstack/pull/4890#discussion_r712334712
##########
File path: setup/bindir/cloud-set-guest-sshkey-password-userdata-configdrive.in
##########
@@ -0,0 +1,507 @@
+#!/usr/bin/env bash
+
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+username=root
+userDataServerPort=8080
+configDriveLabel=config-2
+
+function findPrimaryNetwork(){
+ outputLog "Detecting primary network"
+ if command -v ip &> /dev/null
+ then
+ primaryNet=$(ip -o -4 route show to default | awk '{print $5}')
+ elif command -v netstat &> /dev/null
+ then
+ primaryNet=$(netstat -r4 | grep default | awk '{print $(NF)}')
+ elif command -v route &> /dev/null
+ then
+ primaryNet=$(route -4 2> /dev/null | grep default | awk '{print $(NF)}')
+ if [ -z "$primaryNet" ]
+ then
+ primaryNet=$(route get default 2> /dev/null | grep interface | tr -d ' ' | awk '{split($0,a,":"); print a[2]}')
+ fi
+ fi
+ if [ -z "$primaryNet" ]
+ then
+ outputLog "Could not find primary network"
+ return 1
+ fi
+ echo "$primaryNet"
+ return 0
+}
+
+function findUserDataServer(){
+ primaryNet=$1
+ outputLog "Trying to find userdata server"
+ if [ -z "$primaryNet" ]
+ then
+ outputLog "Unable to determine the userdata server, falling back to data-server"
+ echo "data-server"
+ return 0
+ fi
+
+ if command -v netplan &> /dev/null
+ then
+ outputLog "Operating System is using netplan"
+
+ userDataServer=$(netplan ip leases "$primaryNet" | grep SERVER_ADDRESS | awk '{split($0,a,"="); print a[2]}')
+
+ if [ -n "$userDataServer" ]
+ then
+ outputLog "Found userdata server IP $userDataServer in netplan config"
+ echo "$userDataServer"
+ return 0
+ fi
+ fi
+
+ if command -v nmcli &> /dev/null
+ then
+ outputLog "Operating System is using NetworkManager"
+
+ userDataServer=$(nmcli -t connection show "$(nmcli -t -f UUID,DEVICE connection | grep "$primaryNet" | awk '{split($0,a,":"); print a[1]}')" | grep next_server | tr -d ' ' |awk '{split($0,a,"="); print a[2]}')
+
+ if [ -n "$userDataServer" ]
+ then
+ outputLog "Found userdata server IP $userDataServer in NetworkManager config"
+ echo "$userDataServer"
+ return 0
+ fi
+ fi
+
+ if command -v wicked &> /dev/null
+ then
+ outputLog "Operating System is using wicked"
+
+ userDataServer=$(grep SERVERID /run/wicked/leaseinfo."$primaryNet"* | tr -d "'" | awk '{split($0,a,"="); print a[2]}')
+
+ if [ -n "$userDataServer" ]
+ then
+ outputLog "Found userdata server IP $userDataServer in wicked config"
+ echo "$userDataServer"
+ return 0
+ fi
+ fi
+
+ if command -v udhcpc &> /dev/null
+ then
+ outputLog "Operating System is using udhcpc"
+
+ userDataServer=$(< /run/dhcp-server-ip."$primaryNet")
+
+ if [ -n "$userDataServer" ]
+ then
+ outputLog "Found userdata server IP $userDataServer in udhcpc"
+ echo "$userDataServer"
+ return 0
+ fi
+ fi
+
+ outputLog "Searching for DHCP server in lease files"
+
+ primaryLease=$(
+ dhcpFolders="/var/lib/dhclient/* /var/lib/dhcp3/* /var/lib/dhcp/* /var/lib/NetworkManager/* /var/db/dhclient*"
+ for files in $dhcpFolders
+ do
+ if [ -e "$files" ]
+ then
+ < "$files" tr -d '\n' | sed 's/ //g ; s/lease {//g ; s/}/\n/g' | grep 'option routers'
+ fi
+ done
+ )
+
+ serverList=$(
+ IFS=$'\n'
+ for line in $(echo -e "$primaryLease")
+ do
+ splitLine=$(echo "$line" | sed -e 's/;/\n/g')
+ if date -j &> /dev/null
+ then
+ timestamp=$(date -j -f "%Y/%m/%d %H:%M:%S" "$(echo "$splitLine" | grep 'expire' | sed -r 's/.*expire [0-9]+ (.*)/\1/')" +"%s")
+ else
+ timestamp=$(date -d "$(echo "$splitLine" | grep 'expire' | sed -e 's/.*expire [0-9]\+ \(.*\)/\1/')" +"%s")
+ fi
+ interface=$(echo "$splitLine" | grep 'interface' | sed -e 's/.*interface "\(.*\)"/\1/')
+ server=$(echo "$splitLine" | grep 'dhcp-server-identifier' | sed -e 's/.*dhcp-server-identifier \(.*\)/\1/')
+ echo "$timestamp","$interface","$server"
+ done
+ )
+
+ userDataServer=$(echo "$serverList" | grep "$primaryNet" | sort -n | tail -1 | awk '{split($0,a,","); print a[3]}')
+
+ if [ -n "$userDataServer" ]
+ then
+ outputLog "Userdata server found: $userDataServer"
+ echo "$userDataServer"
+ return 0
+ fi
+
+ outputLog "Unable to determine the userdata server, falling back to data-server"
+ echo "data-server"
+ return 0
+}
+
+function getPasswordFromUserDataServer(){
+ userDataServer=$1
+ userDataServerPort=$2
+ outputLog "Sending request to userdata server at $userDataServer to get the password"
+ if ! response=$(curl --silent --connect-timeout 20 --retry 3 --header "DomU_Request: send_my_password" http://"$userDataServer":"$userDataServerPort")
+ then
+ outputLog "Failed to send request to userdata server at $userDataServer"
+ return 4
+ fi
+ outputLog "Got response from userdata server at $userDataServer"
+ response=$(echo "$response" | tr -d '\r')
+ case $response in
+ "")
+ outputLog "Userdata server at $userDataServer did not have any password for the VM"
+ return 2
+ ;;
+ "bad_request")
+ outputLog "VM sent an invalid request to userdata server at $userDataServer"
+ return 3
+ ;;
+ "saved_password")
+ outputLog "VM has already saved a password from the userdata server at $userDataServer"
+ return 1
+ ;;
+ *)
+ outputLog "VM got a valid password from server at $userDataServer"
+ echo "$response"
+ return 0
+ esac
+}
+
+function findHomeDirectory(){
+ username=$1
+ getent passwd "$username"|awk -F ":" '{print $6}'
+}
+
+function setPassword(){
+ username=$1
+ homeDir=$2
+ password=$3
+ if command -v md5sum &> /dev/null
+ then
+ newMd5=$(echo "$password" | md5sum | awk '{print $1}')
+ elif command -v md5 &> /dev/null
+ then
+ newMd5=$(echo "$password" | md5)
+ else
+ newMd5='N/A'
+ fi
+ if [ $newMd5 != 'N/A' ]
+ then
+ if [ -f "$homeDir"/.password.md5 ]
+ then
+ oldMd5=$(cat "$homeDir"/.password.md5)
+ fi
+ if [ "$newMd5" == "$oldMd5" ]
+ then
+ outputLog "There is no update of VM password"
+ return 0
+ fi
+ else
+ outputLog "Cannot determine change of password"
+ fi
+ outputLog "Changing password for user $username"
+ if command -v chpasswd &> /dev/null
+ then
+ echo "$username":"$password" | chpasswd
+ elif command -v usermod &> /dev/null && command -v mkpasswd &> /dev/null
+ then
+ usermod -p "$(mkpasswd -m SHA-512 "$password")" "$username"
+ elif command -v pw &> /dev/null
+ then
+ echo "$password" | pw mod user "$username" -h 0
+ else
+ outputLog "Failed to change password for user $username"
+ return 1
+ fi
+ outputLog "Successfully changed password for user $username"
+ if [ $newMd5 != 'N/A' ]
+ then
+ echo "$newMd5" > "$homeDir"/.password.md5
+ chmod 600 "$homeDir"/.password.md5
+ chown "$username": "$homeDir"/.password.md5
+ fi
+ return 0
+}
+
+function sendAckToUserDataServer(){
+ userDataServer=$1
+ userDataServerPort=$2
+ outputLog "Sending acknowledgment to userdata server at $userDataServer"
+ if ! curl --silent --connect-timeout 20 --retry 3 --header "DomU_Request: saved_password" "$userDataServer":"$userDataServerPort" &> /dev/null
+ then
+ outputLog "Failed to sent acknowledgment to userdata server at $userDataServer"
+ return 1
+ fi
+ outputLog "Successfully sent acknowledgment to userdata server at $userDataServer"
+ return 0
+}
+
+function getPublicKeyFromUserDataServer(){
+ userDataServer=$1
+ outputLog "Sending request to userdata server at $userDataServer to get public key"
+ if ! reponse=$(curl --silent --connect-timeout 20 --retry 3 http://"$userDataServer"/latest/public-keys)
+ then
+ outputLog "Failed to get public key from userdata server"
+ return 2
+ fi
+ outputLog "Got response from userdata server at $userDataServer"
+ if [ -z "$reponse" ]
+ then
+ outputLog "Did not receive any public keys from userdata server"
+ return 1
+ fi
+ outputLog "Successfully get public key from userdata server"
+ echo "$reponse"
+ return 0
+}
+
+function setPublicKey(){
+ username=$1
+ homeDir=$2
+ publicKey=$3
+ outputLog "Applying public key for $username"
+ sshDir=$homeDir/.ssh
+ authorizedKeysFile=$sshDir/authorized_keys
+
+ if [ ! -d "$sshDir" ]
+ then
+ outputLog ".ssh directory for $username not found, creating .ssh directory"
+ mkdir "$sshDir"
+ fi
+
+ if [ ! -f "$authorizedKeysFile" ]
+ then
+ outputLog "authorized_keys file for $username not found, creating authorized_keys file"
+ touch "$authorizedKeysFile"
+ fi
+ if grep "$(echo "$publicKey" | awk '{print $2}')" "$authorizedKeysFile" > /dev/null
+ then
+ outputLog "No need to update authorized_keys file"
+ return 0
+ fi
+ outputLog "Writing public key in authorized_keys file"
+ echo "$publicKey" >> "$authorizedKeysFile"
Review comment:
I think it is expected behavior as I get the logic from old script:
https://github.com/apache/cloudstack/blob/07722ce016c275ad864254db4008e1a70610596b/setup/bindir/cloud-set-guest-sshkey.in#L85
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [cloudstack] aleskxyz commented on pull request #4890: Universal sshkey and password manager script
Posted by GitBox <gi...@apache.org>.
aleskxyz commented on pull request #4890:
URL: https://github.com/apache/cloudstack/pull/4890#issuecomment-867976964
> Hi @aleskxyz is this PR ready for review/test?
Hi @nvazquez
Yes it is ready for test/review.
Support for getting userdata address from Alpine needs a script in hook directory of udhcpc.
I put the commands here but I'll open a PR in documentation repository.
```
# Create DHCP post-bound hooks directory
mkdir -p /etc/udhcpc/post-bound
# DHCP hook to export DHCP server IP
echo 'echo $serverid > /run/dhcp-server-ip.$interface' > /etc/udhcpc/post-bound/dhcp-server-ip
chmod +x /etc/udhcpc/post-bound/dhcp-server-ip
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [cloudstack] nvazquez commented on pull request #4890: Universal sshkey and password manager script
Posted by GitBox <gi...@apache.org>.
nvazquez commented on pull request #4890:
URL: https://github.com/apache/cloudstack/pull/4890#issuecomment-881507229
Thanks @aleskxyz sorry for the delayed response. I think the new script could only replace the '-configdrive' scripts but would like @weizhouapache's opinion as well. @weizhouapache can you please manually test this PR?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [cloudstack] nvazquez commented on pull request #4890: Universal sshkey and password manager script
Posted by GitBox <gi...@apache.org>.
nvazquez commented on pull request #4890:
URL: https://github.com/apache/cloudstack/pull/4890#issuecomment-866907965
Hi @aleskxyz is this PR ready for review/test?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [cloudstack] rhtyd commented on pull request #4890: Universal sshkey and password manager script
Posted by GitBox <gi...@apache.org>.
rhtyd commented on pull request #4890:
URL: https://github.com/apache/cloudstack/pull/4890#issuecomment-847892427
Thanks, we need some manual test/confirmation and a doc PR to https://github.com/apache/cloudstack-documentation explaining how to use this.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [cloudstack] aleskxyz edited a comment on pull request #4890: Universal sshkey and password manager script
Posted by GitBox <gi...@apache.org>.
aleskxyz edited a comment on pull request #4890:
URL: https://github.com/apache/cloudstack/pull/4890#issuecomment-837287935
> @aleskxyz how do we test it? And how it compare against cloud-init which supposedly works with CloudStack for most distros?
@rhtyd
Simply executing the script is enough. So you can configure the OS to execute it after boot.
Also you can copy it in "per-boot" directory of cloud-init, so it will execute it on each boot.
Cloud-init don't support setting password from ConfigDrive
Cloud-init don't support reset ssh key
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [cloudstack] aleskxyz commented on pull request #4890: Universal sshkey and password manager script
Posted by GitBox <gi...@apache.org>.
aleskxyz commented on pull request #4890:
URL: https://github.com/apache/cloudstack/pull/4890#issuecomment-894610179
> Thanks @aleskxyz sorry for the delayed response. I think the new script could only replace the '-configdrive' scripts but would like @weizhouapache's opinion as well. @weizhouapache can you please manually test this PR?
@nvazquez
If you investigate the userdata scripts you can see that they are not complete.
The cloud-set-guest-sshkey.in script only supports distributions that using dhcp lease file.
The cloud-set-guest-password.in script don't care about default network so you may don't get password in case of multi homed VM configuration.
Also they are using wget for getting data from userdata server which is not available by default in many distros.
I have addressed all of these problems in this PR
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [cloudstack] aleskxyz commented on pull request #4890: Universal sshkey and password manager script
Posted by GitBox <gi...@apache.org>.
aleskxyz commented on pull request #4890:
URL: https://github.com/apache/cloudstack/pull/4890#issuecomment-923320644
Thank you @weizhouapache for approval.
Can you leave you comment about this:
https://github.com/apache/cloudstack/pull/4890#issuecomment-868776749
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [cloudstack] weizhouapache commented on a change in pull request #4890: Universal sshkey and password manager script
Posted by GitBox <gi...@apache.org>.
weizhouapache commented on a change in pull request #4890:
URL: https://github.com/apache/cloudstack/pull/4890#discussion_r712431532
##########
File path: setup/bindir/cloud-set-guest-sshkey-password-userdata-configdrive.in
##########
@@ -0,0 +1,507 @@
+#!/usr/bin/env bash
+
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+username=root
+userDataServerPort=8080
+configDriveLabel=config-2
+
+function findPrimaryNetwork(){
+ outputLog "Detecting primary network"
+ if command -v ip &> /dev/null
+ then
+ primaryNet=$(ip -o -4 route show to default | awk '{print $5}')
+ elif command -v netstat &> /dev/null
+ then
+ primaryNet=$(netstat -r4 | grep default | awk '{print $(NF)}')
+ elif command -v route &> /dev/null
+ then
+ primaryNet=$(route -4 2> /dev/null | grep default | awk '{print $(NF)}')
+ if [ -z "$primaryNet" ]
+ then
+ primaryNet=$(route get default 2> /dev/null | grep interface | tr -d ' ' | awk '{split($0,a,":"); print a[2]}')
+ fi
+ fi
+ if [ -z "$primaryNet" ]
+ then
+ outputLog "Could not find primary network"
+ return 1
+ fi
+ echo "$primaryNet"
+ return 0
+}
+
+function findUserDataServer(){
+ primaryNet=$1
+ outputLog "Trying to find userdata server"
+ if [ -z "$primaryNet" ]
+ then
+ outputLog "Unable to determine the userdata server, falling back to data-server"
+ echo "data-server"
+ return 0
+ fi
+
+ if command -v netplan &> /dev/null
+ then
+ outputLog "Operating System is using netplan"
+
+ userDataServer=$(netplan ip leases "$primaryNet" | grep SERVER_ADDRESS | awk '{split($0,a,"="); print a[2]}')
+
+ if [ -n "$userDataServer" ]
+ then
+ outputLog "Found userdata server IP $userDataServer in netplan config"
+ echo "$userDataServer"
+ return 0
+ fi
+ fi
+
+ if command -v nmcli &> /dev/null
+ then
+ outputLog "Operating System is using NetworkManager"
+
+ userDataServer=$(nmcli -t connection show "$(nmcli -t -f UUID,DEVICE connection | grep "$primaryNet" | awk '{split($0,a,":"); print a[1]}')" | grep next_server | tr -d ' ' |awk '{split($0,a,"="); print a[2]}')
+
+ if [ -n "$userDataServer" ]
+ then
+ outputLog "Found userdata server IP $userDataServer in NetworkManager config"
+ echo "$userDataServer"
+ return 0
+ fi
+ fi
+
+ if command -v wicked &> /dev/null
+ then
+ outputLog "Operating System is using wicked"
+
+ userDataServer=$(grep SERVERID /run/wicked/leaseinfo."$primaryNet"* | tr -d "'" | awk '{split($0,a,"="); print a[2]}')
+
+ if [ -n "$userDataServer" ]
+ then
+ outputLog "Found userdata server IP $userDataServer in wicked config"
+ echo "$userDataServer"
+ return 0
+ fi
+ fi
+
+ if command -v udhcpc &> /dev/null
+ then
+ outputLog "Operating System is using udhcpc"
+
+ userDataServer=$(< /run/dhcp-server-ip."$primaryNet")
+
+ if [ -n "$userDataServer" ]
+ then
+ outputLog "Found userdata server IP $userDataServer in udhcpc"
+ echo "$userDataServer"
+ return 0
+ fi
+ fi
+
+ outputLog "Searching for DHCP server in lease files"
+
+ primaryLease=$(
+ dhcpFolders="/var/lib/dhclient/* /var/lib/dhcp3/* /var/lib/dhcp/* /var/lib/NetworkManager/* /var/db/dhclient*"
+ for files in $dhcpFolders
+ do
+ if [ -e "$files" ]
+ then
+ < "$files" tr -d '\n' | sed 's/ //g ; s/lease {//g ; s/}/\n/g' | grep 'option routers'
+ fi
+ done
+ )
+
+ serverList=$(
+ IFS=$'\n'
+ for line in $(echo -e "$primaryLease")
+ do
+ splitLine=$(echo "$line" | sed -e 's/;/\n/g')
+ if date -j &> /dev/null
+ then
+ timestamp=$(date -j -f "%Y/%m/%d %H:%M:%S" "$(echo "$splitLine" | grep 'expire' | sed -r 's/.*expire [0-9]+ (.*)/\1/')" +"%s")
+ else
+ timestamp=$(date -d "$(echo "$splitLine" | grep 'expire' | sed -e 's/.*expire [0-9]\+ \(.*\)/\1/')" +"%s")
+ fi
+ interface=$(echo "$splitLine" | grep 'interface' | sed -e 's/.*interface "\(.*\)"/\1/')
+ server=$(echo "$splitLine" | grep 'dhcp-server-identifier' | sed -e 's/.*dhcp-server-identifier \(.*\)/\1/')
+ echo "$timestamp","$interface","$server"
+ done
+ )
+
+ userDataServer=$(echo "$serverList" | grep "$primaryNet" | sort -n | tail -1 | awk '{split($0,a,","); print a[3]}')
+
+ if [ -n "$userDataServer" ]
+ then
+ outputLog "Userdata server found: $userDataServer"
+ echo "$userDataServer"
+ return 0
+ fi
+
+ outputLog "Unable to determine the userdata server, falling back to data-server"
+ echo "data-server"
+ return 0
+}
+
+function getPasswordFromUserDataServer(){
+ userDataServer=$1
+ userDataServerPort=$2
+ outputLog "Sending request to userdata server at $userDataServer to get the password"
+ if ! response=$(curl --silent --connect-timeout 20 --retry 3 --header "DomU_Request: send_my_password" http://"$userDataServer":"$userDataServerPort")
+ then
+ outputLog "Failed to send request to userdata server at $userDataServer"
+ return 4
+ fi
+ outputLog "Got response from userdata server at $userDataServer"
+ response=$(echo "$response" | tr -d '\r')
+ case $response in
+ "")
+ outputLog "Userdata server at $userDataServer did not have any password for the VM"
+ return 2
+ ;;
+ "bad_request")
+ outputLog "VM sent an invalid request to userdata server at $userDataServer"
+ return 3
+ ;;
+ "saved_password")
+ outputLog "VM has already saved a password from the userdata server at $userDataServer"
+ return 1
+ ;;
+ *)
+ outputLog "VM got a valid password from server at $userDataServer"
+ echo "$response"
+ return 0
+ esac
+}
+
+function findHomeDirectory(){
+ username=$1
+ getent passwd "$username"|awk -F ":" '{print $6}'
+}
+
+function setPassword(){
+ username=$1
+ homeDir=$2
+ password=$3
+ if command -v md5sum &> /dev/null
+ then
+ newMd5=$(echo "$password" | md5sum | awk '{print $1}')
+ elif command -v md5 &> /dev/null
+ then
+ newMd5=$(echo "$password" | md5)
+ else
+ newMd5='N/A'
+ fi
+ if [ $newMd5 != 'N/A' ]
+ then
+ if [ -f "$homeDir"/.password.md5 ]
+ then
+ oldMd5=$(cat "$homeDir"/.password.md5)
+ fi
+ if [ "$newMd5" == "$oldMd5" ]
+ then
+ outputLog "There is no update of VM password"
+ return 0
+ fi
+ else
+ outputLog "Cannot determine change of password"
+ fi
+ outputLog "Changing password for user $username"
+ if command -v chpasswd &> /dev/null
+ then
+ echo "$username":"$password" | chpasswd
+ elif command -v usermod &> /dev/null && command -v mkpasswd &> /dev/null
+ then
+ usermod -p "$(mkpasswd -m SHA-512 "$password")" "$username"
+ elif command -v pw &> /dev/null
+ then
+ echo "$password" | pw mod user "$username" -h 0
+ else
+ outputLog "Failed to change password for user $username"
+ return 1
+ fi
+ outputLog "Successfully changed password for user $username"
+ if [ $newMd5 != 'N/A' ]
+ then
+ echo "$newMd5" > "$homeDir"/.password.md5
+ chmod 600 "$homeDir"/.password.md5
+ chown "$username": "$homeDir"/.password.md5
+ fi
+ return 0
+}
+
+function sendAckToUserDataServer(){
+ userDataServer=$1
+ userDataServerPort=$2
+ outputLog "Sending acknowledgment to userdata server at $userDataServer"
+ if ! curl --silent --connect-timeout 20 --retry 3 --header "DomU_Request: saved_password" "$userDataServer":"$userDataServerPort" &> /dev/null
+ then
+ outputLog "Failed to sent acknowledgment to userdata server at $userDataServer"
+ return 1
+ fi
+ outputLog "Successfully sent acknowledgment to userdata server at $userDataServer"
+ return 0
+}
+
+function getPublicKeyFromUserDataServer(){
+ userDataServer=$1
+ outputLog "Sending request to userdata server at $userDataServer to get public key"
+ if ! reponse=$(curl --silent --connect-timeout 20 --retry 3 http://"$userDataServer"/latest/public-keys)
+ then
+ outputLog "Failed to get public key from userdata server"
+ return 2
+ fi
+ outputLog "Got response from userdata server at $userDataServer"
+ if [ -z "$reponse" ]
+ then
+ outputLog "Did not receive any public keys from userdata server"
+ return 1
+ fi
+ outputLog "Successfully get public key from userdata server"
+ echo "$reponse"
+ return 0
+}
+
+function setPublicKey(){
+ username=$1
+ homeDir=$2
+ publicKey=$3
+ outputLog "Applying public key for $username"
+ sshDir=$homeDir/.ssh
+ authorizedKeysFile=$sshDir/authorized_keys
+
+ if [ ! -d "$sshDir" ]
+ then
+ outputLog ".ssh directory for $username not found, creating .ssh directory"
+ mkdir "$sshDir"
+ fi
+
+ if [ ! -f "$authorizedKeysFile" ]
+ then
+ outputLog "authorized_keys file for $username not found, creating authorized_keys file"
+ touch "$authorizedKeysFile"
+ fi
+ if grep "$(echo "$publicKey" | awk '{print $2}')" "$authorizedKeysFile" > /dev/null
+ then
+ outputLog "No need to update authorized_keys file"
+ return 0
+ fi
+ outputLog "Writing public key in authorized_keys file"
+ echo "$publicKey" >> "$authorizedKeysFile"
Review comment:
@aleskxyz
can you use the same code ?
```
sed -i "/ cloudstack@apache.org$/d" $authorized
echo "$publickey cloudstack@apache.org" >> $authorized
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [cloudstack] aleskxyz commented on pull request #4890: Universal sshkey and password manager script
Posted by GitBox <gi...@apache.org>.
aleskxyz commented on pull request #4890:
URL: https://github.com/apache/cloudstack/pull/4890#issuecomment-837287935
> @aleskxyz how do we test it? And how it compare against cloud-init which supposedly works with CloudStack for most distros?
@rhtyd
Simply executing the script is enough. So you can configure the OS to execute it after boot.
Also you can copy it in "per-boot" directory of cloud-init, so it will execute it on each boot.
Cloud-init don't support setting password from ConfigDrive
Cloud-init don't support reset ssh key
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [cloudstack] weizhouapache merged pull request #4890: Universal sshkey and password manager script
Posted by GitBox <gi...@apache.org>.
weizhouapache merged pull request #4890:
URL: https://github.com/apache/cloudstack/pull/4890
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [cloudstack] aleskxyz commented on a change in pull request #4890: Universal sshkey and password manager script
Posted by GitBox <gi...@apache.org>.
aleskxyz commented on a change in pull request #4890:
URL: https://github.com/apache/cloudstack/pull/4890#discussion_r712459366
##########
File path: setup/bindir/cloud-set-guest-sshkey-password-userdata-configdrive.in
##########
@@ -0,0 +1,507 @@
+#!/usr/bin/env bash
+
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+username=root
+userDataServerPort=8080
+configDriveLabel=config-2
+
+function findPrimaryNetwork(){
+ outputLog "Detecting primary network"
+ if command -v ip &> /dev/null
+ then
+ primaryNet=$(ip -o -4 route show to default | awk '{print $5}')
+ elif command -v netstat &> /dev/null
+ then
+ primaryNet=$(netstat -r4 | grep default | awk '{print $(NF)}')
+ elif command -v route &> /dev/null
+ then
+ primaryNet=$(route -4 2> /dev/null | grep default | awk '{print $(NF)}')
+ if [ -z "$primaryNet" ]
+ then
+ primaryNet=$(route get default 2> /dev/null | grep interface | tr -d ' ' | awk '{split($0,a,":"); print a[2]}')
+ fi
+ fi
+ if [ -z "$primaryNet" ]
+ then
+ outputLog "Could not find primary network"
+ return 1
+ fi
+ echo "$primaryNet"
+ return 0
+}
+
+function findUserDataServer(){
+ primaryNet=$1
+ outputLog "Trying to find userdata server"
+ if [ -z "$primaryNet" ]
+ then
+ outputLog "Unable to determine the userdata server, falling back to data-server"
+ echo "data-server"
+ return 0
+ fi
+
+ if command -v netplan &> /dev/null
+ then
+ outputLog "Operating System is using netplan"
+
+ userDataServer=$(netplan ip leases "$primaryNet" | grep SERVER_ADDRESS | awk '{split($0,a,"="); print a[2]}')
+
+ if [ -n "$userDataServer" ]
+ then
+ outputLog "Found userdata server IP $userDataServer in netplan config"
+ echo "$userDataServer"
+ return 0
+ fi
+ fi
+
+ if command -v nmcli &> /dev/null
+ then
+ outputLog "Operating System is using NetworkManager"
+
+ userDataServer=$(nmcli -t connection show "$(nmcli -t -f UUID,DEVICE connection | grep "$primaryNet" | awk '{split($0,a,":"); print a[1]}')" | grep next_server | tr -d ' ' |awk '{split($0,a,"="); print a[2]}')
+
+ if [ -n "$userDataServer" ]
+ then
+ outputLog "Found userdata server IP $userDataServer in NetworkManager config"
+ echo "$userDataServer"
+ return 0
+ fi
+ fi
+
+ if command -v wicked &> /dev/null
+ then
+ outputLog "Operating System is using wicked"
+
+ userDataServer=$(grep SERVERID /run/wicked/leaseinfo."$primaryNet"* | tr -d "'" | awk '{split($0,a,"="); print a[2]}')
+
+ if [ -n "$userDataServer" ]
+ then
+ outputLog "Found userdata server IP $userDataServer in wicked config"
+ echo "$userDataServer"
+ return 0
+ fi
+ fi
+
+ if command -v udhcpc &> /dev/null
+ then
+ outputLog "Operating System is using udhcpc"
+
+ userDataServer=$(< /run/dhcp-server-ip."$primaryNet")
+
+ if [ -n "$userDataServer" ]
+ then
+ outputLog "Found userdata server IP $userDataServer in udhcpc"
+ echo "$userDataServer"
+ return 0
+ fi
+ fi
+
+ outputLog "Searching for DHCP server in lease files"
+
+ primaryLease=$(
+ dhcpFolders="/var/lib/dhclient/* /var/lib/dhcp3/* /var/lib/dhcp/* /var/lib/NetworkManager/* /var/db/dhclient*"
+ for files in $dhcpFolders
+ do
+ if [ -e "$files" ]
+ then
+ < "$files" tr -d '\n' | sed 's/ //g ; s/lease {//g ; s/}/\n/g' | grep 'option routers'
+ fi
+ done
+ )
+
+ serverList=$(
+ IFS=$'\n'
+ for line in $(echo -e "$primaryLease")
+ do
+ splitLine=$(echo "$line" | sed -e 's/;/\n/g')
+ if date -j &> /dev/null
+ then
+ timestamp=$(date -j -f "%Y/%m/%d %H:%M:%S" "$(echo "$splitLine" | grep 'expire' | sed -r 's/.*expire [0-9]+ (.*)/\1/')" +"%s")
+ else
+ timestamp=$(date -d "$(echo "$splitLine" | grep 'expire' | sed -e 's/.*expire [0-9]\+ \(.*\)/\1/')" +"%s")
+ fi
+ interface=$(echo "$splitLine" | grep 'interface' | sed -e 's/.*interface "\(.*\)"/\1/')
+ server=$(echo "$splitLine" | grep 'dhcp-server-identifier' | sed -e 's/.*dhcp-server-identifier \(.*\)/\1/')
+ echo "$timestamp","$interface","$server"
+ done
+ )
+
+ userDataServer=$(echo "$serverList" | grep "$primaryNet" | sort -n | tail -1 | awk '{split($0,a,","); print a[3]}')
+
+ if [ -n "$userDataServer" ]
+ then
+ outputLog "Userdata server found: $userDataServer"
+ echo "$userDataServer"
+ return 0
+ fi
+
+ outputLog "Unable to determine the userdata server, falling back to data-server"
+ echo "data-server"
+ return 0
+}
+
+function getPasswordFromUserDataServer(){
+ userDataServer=$1
+ userDataServerPort=$2
+ outputLog "Sending request to userdata server at $userDataServer to get the password"
+ if ! response=$(curl --silent --connect-timeout 20 --retry 3 --header "DomU_Request: send_my_password" http://"$userDataServer":"$userDataServerPort")
+ then
+ outputLog "Failed to send request to userdata server at $userDataServer"
+ return 4
+ fi
+ outputLog "Got response from userdata server at $userDataServer"
+ response=$(echo "$response" | tr -d '\r')
+ case $response in
+ "")
+ outputLog "Userdata server at $userDataServer did not have any password for the VM"
+ return 2
+ ;;
+ "bad_request")
+ outputLog "VM sent an invalid request to userdata server at $userDataServer"
+ return 3
+ ;;
+ "saved_password")
+ outputLog "VM has already saved a password from the userdata server at $userDataServer"
+ return 1
+ ;;
+ *)
+ outputLog "VM got a valid password from server at $userDataServer"
+ echo "$response"
+ return 0
+ esac
+}
+
+function findHomeDirectory(){
+ username=$1
+ getent passwd "$username"|awk -F ":" '{print $6}'
+}
+
+function setPassword(){
+ username=$1
+ homeDir=$2
+ password=$3
+ if command -v md5sum &> /dev/null
+ then
+ newMd5=$(echo "$password" | md5sum | awk '{print $1}')
+ elif command -v md5 &> /dev/null
+ then
+ newMd5=$(echo "$password" | md5)
+ else
+ newMd5='N/A'
+ fi
+ if [ $newMd5 != 'N/A' ]
+ then
+ if [ -f "$homeDir"/.password.md5 ]
+ then
+ oldMd5=$(cat "$homeDir"/.password.md5)
+ fi
+ if [ "$newMd5" == "$oldMd5" ]
+ then
+ outputLog "There is no update of VM password"
+ return 0
+ fi
+ else
+ outputLog "Cannot determine change of password"
+ fi
+ outputLog "Changing password for user $username"
+ if command -v chpasswd &> /dev/null
+ then
+ echo "$username":"$password" | chpasswd
+ elif command -v usermod &> /dev/null && command -v mkpasswd &> /dev/null
+ then
+ usermod -p "$(mkpasswd -m SHA-512 "$password")" "$username"
+ elif command -v pw &> /dev/null
+ then
+ echo "$password" | pw mod user "$username" -h 0
+ else
+ outputLog "Failed to change password for user $username"
+ return 1
+ fi
+ outputLog "Successfully changed password for user $username"
+ if [ $newMd5 != 'N/A' ]
+ then
+ echo "$newMd5" > "$homeDir"/.password.md5
+ chmod 600 "$homeDir"/.password.md5
+ chown "$username": "$homeDir"/.password.md5
+ fi
+ return 0
+}
+
+function sendAckToUserDataServer(){
+ userDataServer=$1
+ userDataServerPort=$2
+ outputLog "Sending acknowledgment to userdata server at $userDataServer"
+ if ! curl --silent --connect-timeout 20 --retry 3 --header "DomU_Request: saved_password" "$userDataServer":"$userDataServerPort" &> /dev/null
+ then
+ outputLog "Failed to sent acknowledgment to userdata server at $userDataServer"
+ return 1
+ fi
+ outputLog "Successfully sent acknowledgment to userdata server at $userDataServer"
+ return 0
+}
+
+function getPublicKeyFromUserDataServer(){
+ userDataServer=$1
+ outputLog "Sending request to userdata server at $userDataServer to get public key"
+ if ! reponse=$(curl --silent --connect-timeout 20 --retry 3 http://"$userDataServer"/latest/public-keys)
+ then
+ outputLog "Failed to get public key from userdata server"
+ return 2
+ fi
+ outputLog "Got response from userdata server at $userDataServer"
+ if [ -z "$reponse" ]
+ then
+ outputLog "Did not receive any public keys from userdata server"
+ return 1
+ fi
+ outputLog "Successfully get public key from userdata server"
+ echo "$reponse"
+ return 0
+}
+
+function setPublicKey(){
+ username=$1
+ homeDir=$2
+ publicKey=$3
+ outputLog "Applying public key for $username"
+ sshDir=$homeDir/.ssh
+ authorizedKeysFile=$sshDir/authorized_keys
+
+ if [ ! -d "$sshDir" ]
+ then
+ outputLog ".ssh directory for $username not found, creating .ssh directory"
+ mkdir "$sshDir"
+ fi
+
+ if [ ! -f "$authorizedKeysFile" ]
+ then
+ outputLog "authorized_keys file for $username not found, creating authorized_keys file"
+ touch "$authorizedKeysFile"
+ fi
+ if grep "$(echo "$publicKey" | awk '{print $2}')" "$authorizedKeysFile" > /dev/null
+ then
+ outputLog "No need to update authorized_keys file"
+ return 0
+ fi
+ outputLog "Writing public key in authorized_keys file"
+ echo "$publicKey" >> "$authorizedKeysFile"
Review comment:
Yea! Now the script overwrites ssh keys injected by CloudStack only.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [cloudstack] rhtyd commented on pull request #4890: Universal sshkey and password manager script
Posted by GitBox <gi...@apache.org>.
rhtyd commented on pull request #4890:
URL: https://github.com/apache/cloudstack/pull/4890#issuecomment-923692199
@aleskxyz If you're going to remove it, please check and fix the docs too https://github.com/apache/cloudstack-documentation
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [cloudstack] aleskxyz commented on pull request #4890: Universal sshkey and password manager script
Posted by GitBox <gi...@apache.org>.
aleskxyz commented on pull request #4890:
URL: https://github.com/apache/cloudstack/pull/4890#issuecomment-923693889
> @aleskxyz If you're going to remove it, please check and fix the docs too https://github.com/apache/cloudstack-documentation
@rhtyd Ok but I think it is better to merge this PR first. I may need to change it.
https://github.com/apache/cloudstack-documentation/pull/215
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org