ungleich-public/cdist
ungleich-public/cdist
7
4
Fork 10
Code Issues 58 Pull requests 15 Projects Releases Wiki Activity

__ssh_authorized_keys overwrites existing keys #147

New issue
Closed
opened 2021-11-20 15:20:13 +00:00 by ungleich-gitea · 9 comments
ungleich-gitea commented 2021-11-20 15:20:13 +00:00
Owner
Copy link

Created by: pcoder

If a given key is not a valid public key or if it contains some whitespaces at the end, __ssh_authorized_keys seems to overwrite the existing authorized keys.

Here are the two cases that I found erroneous.

  1. Invalid public key
__ssh_authorized_keys root \
  --key "testtesttestsetestststestsetest" --state present
  1. Valid public key with trailing whitespaces
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC+sx1TKzHf+yWpMKsB9NE+w1nYxzun1njbzNL4XwmAavcmjTPhRhImD13R/Hg+zyrvPt3/GsNAsbo02QAGhVh7HWduPgAkAUq0Hm3+t0Moi4PmBMRpwZsWq9ot3d6FJUZz5nwx9g/mjsFEg5FqdtMOClcmpSTq14oGovBLjqGA/oCb7cw57hE1S+VLnl0yhF4ppyuvSbTfs9fPdFp2Uk7LjNywcJXXBudbDOerFAPi4X9dE/lH2yJoEyZMsIf9dfoanbROE/kd0wsTNH/+srbI8VSN1xk3FQJNX6EgqvUOBe+lGa7YQV3ifqobOmflUMQ7Fg4vcIiGxc8t/7QjYVel test@archlinux
*Created by: pcoder* If a given key is not a valid public key or if it contains some whitespaces at the end, `__ssh_authorized_keys` seems to overwrite the existing authorized keys. Here are the two cases that I found erroneous. 1. Invalid public key ``` __ssh_authorized_keys root \ --key "testtesttestsetestststestsetest" --state present ``` 2. Valid public key with trailing whitespaces ``` ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC+sx1TKzHf+yWpMKsB9NE+w1nYxzun1njbzNL4XwmAavcmjTPhRhImD13R/Hg+zyrvPt3/GsNAsbo02QAGhVh7HWduPgAkAUq0Hm3+t0Moi4PmBMRpwZsWq9ot3d6FJUZz5nwx9g/mjsFEg5FqdtMOClcmpSTq14oGovBLjqGA/oCb7cw57hE1S+VLnl0yhF4ppyuvSbTfs9fPdFp2Uk7LjNywcJXXBudbDOerFAPi4X9dE/lH2yJoEyZMsIf9dfoanbROE/kd0wsTNH/+srbI8VSN1xk3FQJNX6EgqvUOBe+lGa7YQV3ifqobOmflUMQ7Fg4vcIiGxc8t/7QjYVel test@archlinux ```
ungleich-gitea commented 2021-11-20 15:43:18 +00:00
Author
Owner
Copy link

Created by: darko-poljak

@pcoder Ok, I will prepare a fix for an invalid key case.

*Created by: darko-poljak* @pcoder Ok, I will prepare a fix for an invalid key case.
ungleich-gitea commented 2021-11-20 15:43:19 +00:00
Author
Owner
Copy link

Created by: pcoder

I think you are right there @darko-poljak I may have overlooked this.

*Created by: pcoder* I think you are right there @darko-poljak I may have overlooked this.
ungleich-gitea commented 2021-11-20 15:43:21 +00:00
Author
Owner
Copy link

Created by: darko-poljak

@pcoder Nope, it works with this key. Are you sure you have only this in your manifest and that it clears existing file?

*Created by: darko-poljak* @pcoder Nope, it works with this key. Are you sure you have only this in your manifest and that it clears existing file?
ungleich-gitea commented 2021-11-20 15:43:22 +00:00
Author
Owner
Copy link

Created by: pcoder

@darko-poljak check this out

__ssh_authorized_keys root \
  --key "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC+sx1TKzHf+yWpMKsB9NE+w1nYxzun1njbzNL4XwmAavcmjTPhRhImD13R/Hg+zyrvPt3/GsNAsbo02QAGhVh7HWduPgAkAUq0Hm3+t0Moi4PmBMRpwZsWq9ot3d6FJUZz5nwx9g/mjsFEg5FqdtMOClcmpSTq14oGovBLjqGA/oCb7cw57hE1S+VLnl0yhF4ppyuvSbTfs9fPdFp2Uk7LjNywcJXXBudbDOerFAPi4X9dE/lH2yJoEyZMsIf9dfoanbROE/kd0wsTNH/+srbI8VSN1xk3FQJNX6EgqvUOBe+lGa7YQV3ifqobOmflUMQ7Fg4vcIiGxc8t/7QjYVel test@archlinux

" --state present
*Created by: pcoder* @darko-poljak check this out ``` __ssh_authorized_keys root \ --key "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC+sx1TKzHf+yWpMKsB9NE+w1nYxzun1njbzNL4XwmAavcmjTPhRhImD13R/Hg+zyrvPt3/GsNAsbo02QAGhVh7HWduPgAkAUq0Hm3+t0Moi4PmBMRpwZsWq9ot3d6FJUZz5nwx9g/mjsFEg5FqdtMOClcmpSTq14oGovBLjqGA/oCb7cw57hE1S+VLnl0yhF4ppyuvSbTfs9fPdFp2Uk7LjNywcJXXBudbDOerFAPi4X9dE/lH2yJoEyZMsIf9dfoanbROE/kd0wsTNH/+srbI8VSN1xk3FQJNX6EgqvUOBe+lGa7YQV3ifqobOmflUMQ7Fg4vcIiGxc8t/7QjYVel test@archlinux " --state present ```
ungleich-gitea commented 2021-11-20 15:43:23 +00:00
Author
Owner
Copy link

Created by: darko-poljak

@pcoder I cannot reproduce a case where key is valid but has trailing whitespace. Do you have an example?
I have reproduced a case where key is invalid. Here the problem is in explorer/entry.

*Created by: darko-poljak* @pcoder I cannot reproduce a case where key is valid but has trailing whitespace. Do you have an example? I have reproduced a case where key is invalid. Here the problem is in explorer/entry.
ungleich-gitea commented 2021-11-20 15:43:25 +00:00
Author
Owner
Copy link

Created by: pcoder

Whats worse is that if we have many keys in authorized_keys file, all of them are overwritten with only testtesttestsetestststestsetest

*Created by: pcoder* Whats worse is that if we have many keys in authorized_keys file, all of them are overwritten with only `testtesttestsetestststestsetest`
ungleich-gitea commented 2021-11-20 15:43:26 +00:00
Author
Owner
Copy link

Created by: pcoder

@darko-poljak

  1. authorized_keys file content could be containing any number of keys. For instance lets take this, a randomly chosen public key
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC16O/IbyOrF3y6c8j2zwj7yAVwYn6p8C/2pnw1rKehHHRJGS5PTENVmVZCHrpAGFAPzGOr4BuZ7DACN/qgKWpTcVcXy+I98BK8A9BDpCXU5QPVkSVndTUGPLBUuy/NmN54aisCRcQ1I1OZ9QTd5qutx7cbcwUK00mdzFPhQFVFZrz8LsBmuUahbPri9FMyOv4HxPr6LdonvGNgkD63DcCmXO1BastMQ6M7tOPymQuvuPlVqTcsWtD2Xz/eXWCE2uYXJRPwR3hBG3Gd5Wz1EOvZrlKFjRIPr/YfwitrnQbI/cA8RYH48R4oxwDFkuZLSLhEvHqvG090M24vQwTEczsh
  1. init manifest content
__file /etc/cdist-configured
__cdistmarker

case "$__target_host" in
   my_ip_address)
      __ssh_authorized_keys root \
         --key "testtesttestsetestststestsetest" --state present
   ;;
esac
  1. authorized_keys file content after running cdist
testtesttestsetestststestsetest
  1. expected authorized_keys file
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC16O/IbyOrF3y6c8j2zwj7yAVwYn6p8C/2pnw1rKehHHRJGS5PTENVmVZCHrpAGFAPzGOr4BuZ7DACN/qgKWpTcVcXy+I98BK8A9BDpCXU5QPVkSVndTUGPLBUuy/NmN54aisCRcQ1I1OZ9QTd5qutx7cbcwUK00mdzFPhQFVFZrz8LsBmuUahbPri9FMyOv4HxPr6LdonvGNgkD63DcCmXO1BastMQ6M7tOPymQuvuPlVqTcsWtD2Xz/eXWCE2uYXJRPwR3hBG3Gd5Wz1EOvZrlKFjRIPr/YfwitrnQbI/cA8RYH48R4oxwDFkuZLSLhEvHqvG090M24vQwTEczsh
testtesttestsetestststestsetest

or at least if the public ssh key is not a valid format, the original key should not to be overwritten

*Created by: pcoder* @darko-poljak 1. authorized_keys file content could be containing any number of keys. For instance lets take this, a randomly chosen public key ``` ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC16O/IbyOrF3y6c8j2zwj7yAVwYn6p8C/2pnw1rKehHHRJGS5PTENVmVZCHrpAGFAPzGOr4BuZ7DACN/qgKWpTcVcXy+I98BK8A9BDpCXU5QPVkSVndTUGPLBUuy/NmN54aisCRcQ1I1OZ9QTd5qutx7cbcwUK00mdzFPhQFVFZrz8LsBmuUahbPri9FMyOv4HxPr6LdonvGNgkD63DcCmXO1BastMQ6M7tOPymQuvuPlVqTcsWtD2Xz/eXWCE2uYXJRPwR3hBG3Gd5Wz1EOvZrlKFjRIPr/YfwitrnQbI/cA8RYH48R4oxwDFkuZLSLhEvHqvG090M24vQwTEczsh ``` 2. init manifest content ``` __file /etc/cdist-configured __cdistmarker case "$__target_host" in my_ip_address) __ssh_authorized_keys root \ --key "testtesttestsetestststestsetest" --state present ;; esac ``` 3. authorized_keys file content after running cdist ``` testtesttestsetestststestsetest ``` 4. expected authorized_keys file ``` ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC16O/IbyOrF3y6c8j2zwj7yAVwYn6p8C/2pnw1rKehHHRJGS5PTENVmVZCHrpAGFAPzGOr4BuZ7DACN/qgKWpTcVcXy+I98BK8A9BDpCXU5QPVkSVndTUGPLBUuy/NmN54aisCRcQ1I1OZ9QTd5qutx7cbcwUK00mdzFPhQFVFZrz8LsBmuUahbPri9FMyOv4HxPr6LdonvGNgkD63DcCmXO1BastMQ6M7tOPymQuvuPlVqTcsWtD2Xz/eXWCE2uYXJRPwR3hBG3Gd5Wz1EOvZrlKFjRIPr/YfwitrnQbI/cA8RYH48R4oxwDFkuZLSLhEvHqvG090M24vQwTEczsh testtesttestsetestststestsetest ``` or at least if the public ssh key is not a valid format, the original key *should not* to be overwritten
ungleich-gitea commented 2021-11-20 15:43:27 +00:00
Author
Owner
Copy link

Created by: darko-poljak

@pcoder Can you give an example?

  1. authorized_keys file content before running cdist
  2. init manifest content
  3. authroized_keys file content after running cdist
  4. expected authorized_keys file content after step 3.

So that I know what to reproduce.

*Created by: darko-poljak* @pcoder Can you give an example? 1. authorized_keys file content before running cdist 2. init manifest content 3. authroized_keys file content after running cdist 4. expected authorized_keys file content after step 3. So that I know what to reproduce.
ungleich-gitea commented 2021-11-20 15:43:29 +00:00
Author
Owner
Copy link

Created by: darko-poljak

@pcoder I will take a look soon.

*Created by: darko-poljak* @pcoder I will take a look soon.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
master
7.0
6.9
py3.10
ander/__package_apt_update_index
haproxy-dualstack
ander/__sed
beta
ander/os_version_debian_sid
evilham-compatibility-fixes
ander/__rsync
__snakeoil_cert
ander/update_readme
__download_improvements
feature/onchange
cleanup/string-formatting
feature/type-relationship-graph
cleanup/ssh-auth-keys-types
__letsencrypt_cert-fix-hooks
bugfix/preos-debug
bugfix/in-script-import
6.8
bugfix/sphinx-docs-build
6.7
cherry-pick-2f433a14
bugfix/make-code-consistent
6.6
regain-py3.2-support
6.5
bugfix/multiple-log-lines
matterbridge
coturn
alpinefix
matrix
new-type/network-interface
feature/process
6.4
feature/info-command
feature/libexec
6.3
preos-plugins-dir-opt
gitlab-ci
6.2
order-dep-fix
6.1
6.0
build/support-pip-from-git
feature/shell-lib
5.1
feature/support-type-deprecation
5.0
feature/python-types
4.11
4.10
shellcheck
4.9
4.8
freebsd-improvements
new-prometheus
key_value-onchange
feature/output_streams
AnotherKamila-patch-1
__letsencrypt_cert-fixes
letsencrypt-cron-fix
4.7
newtype-__letsencrypt_cert
os_explorer_devuan_fix
prometheus-exporter-fixes
daemontools-for-fbsd
type-prometheus-exporter-from-master
prometheus-more-fixes
4.6
4.5
fix-j
steven-backport
4.4
prometheus-fixes
grafana_dashboard
prometheus
daemontools
consul_improvements
feature/trigger
4.3
4.0-pre-not-stable
4.2
4.1
4.0
feature_install_and_preos
3.1
no-dot-cdist
random_dot_cdist
feature_yum_url
feature_files_export
3.0
2.3
2.2
2.1
ssh_callback
2.0
archive_shell_function_approach
1.7
1.6
1.5
1.4
1.3
1.2
1.1
1.0
7.0.0
6.9.8
6.9.7
6.9.6
6.9.5
6.9.4
6.9.3
6.9.2
6.9.1
6.9.0
6.8.0
6.7.0
6.6.0
6.5.6
6.5.5
6.5.4
6.5.3
6.5.2
6.5.1
6.5.0
6.4.0
6.3.0
6.2.0
6.1.1
6.1.0
6.0.4
6.0.3
6.0.2
6.0.1
6.0.0
5.1.3
5.1.2
5.1.1
5.1.0
5.0.2
5.0.1
5.0.0
4.11.1
4.11.0
4.10.11
4.10.10
4.10.9
4.10.8
4.10.7
4.10.6
4.10.5
4.10.4
4.10.3
4.10.2
4.10.1
4.10.0
4.9.1
4.9.0
4.8.4
4.8.3
4.8.2
4.8.1
4.8.0
4.7.3
4.7.2
4.7.1
4.7.0
4.6.1
4.6.0
4.5.0
4.4.4
4.4.3
4.4.2
4.4.1
4.4.0
4.3.2
4.3.1
4.3.0
4.2.2
4.2.1
4.2.0
4.1.0
4.0.0
3.1.13
tn1
3.1.12
3.1.11
3.1.10
3.1.9
3.1.8
3.1.7
3.1.6
4.0.0pre3
3.1.5
3.1.4
3.1.3
3.1.2
3.1.1
3.1.0
4.0.0pre2
3.0.9
3.0.8
3.0.7
3.0.6
3.0.5
3.0.4
3.0.3
4.0.0pre1
3.0.2
3.0.1
3.0.0
2.3.7
2.3.6
2.3.5
2.3.4
2.3.3
2.3.2
2.3.1
2.3.0
2.2.0
2.1.2
2.1.1
2.1.0
2.1.0pre8
2.1.0pre7
2.1.0pre6
2.0.15
2.1.0pre5
2.1.0pre4
2.1.0pre3
2.1.0pre2
2.1.0pre1
2.0.14
2.0.13
2.0.12
2.0.11
2.0.10
2.0.9
2.0.8
2.0.7
2.0.6
2.0.5
2.0.4
2.0.3
2.0.2
2.0.1
2.0.0
1.7.1
1.7.0
1.6.2
1.6.1
1.6.0
1.5.0
1.4.1
1.4.0
1.3.2
1.3.1
1.3.0
1.2.0
1.1.0
1.0.4
1.0.3
1.0.2
1.0.1
1.0.0
0.9.9
0.9.8
0.9.7
0.9.6
0.9.5
0.9.4
0.9.3
0.9.2
0.9.1
0.9
0.8
0.7
0.6
0.5
0.4
0.3
0.2
0.1
Labels
Clear labels   
bugfix

   
cleanup

   
discussion

   
documentation

   
doing

   
done

   
feature

   
improvement

   
packaging

   
Stale

   
testing

   
TODO
No labels
bugfix
cleanup
discussion
documentation
doing
done
feature
improvement
packaging
Stale
testing
TODO
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: ungleich-public/cdist#147
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?