__ssh_authorized_keys overwrites existing keys #147

New Issue

ungleich-gitea · 2021-11-20T15:20:13Z

ungleich-gitea commented

2021-11-20 15:20:13 +00:00

Created by: pcoder

If a given key is not a valid public key or if it contains some whitespaces at the end, __ssh_authorized_keys seems to overwrite the existing authorized keys.

Here are the two cases that I found erroneous.

Invalid public key

__ssh_authorized_keys root \
  --key "testtesttestsetestststestsetest" --state present

Valid public key with trailing whitespaces

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC+sx1TKzHf+yWpMKsB9NE+w1nYxzun1njbzNL4XwmAavcmjTPhRhImD13R/Hg+zyrvPt3/GsNAsbo02QAGhVh7HWduPgAkAUq0Hm3+t0Moi4PmBMRpwZsWq9ot3d6FJUZz5nwx9g/mjsFEg5FqdtMOClcmpSTq14oGovBLjqGA/oCb7cw57hE1S+VLnl0yhF4ppyuvSbTfs9fPdFp2Uk7LjNywcJXXBudbDOerFAPi4X9dE/lH2yJoEyZMsIf9dfoanbROE/kd0wsTNH/+srbI8VSN1xk3FQJNX6EgqvUOBe+lGa7YQV3ifqobOmflUMQ7Fg4vcIiGxc8t/7QjYVel test@archlinux

*Created by: pcoder* If a given key is not a valid public key or if it contains some whitespaces at the end, `__ssh_authorized_keys` seems to overwrite the existing authorized keys. Here are the two cases that I found erroneous. 1. Invalid public key ``` __ssh_authorized_keys root \ --key "testtesttestsetestststestsetest" --state present ``` 2. Valid public key with trailing whitespaces ``` ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC+sx1TKzHf+yWpMKsB9NE+w1nYxzun1njbzNL4XwmAavcmjTPhRhImD13R/Hg+zyrvPt3/GsNAsbo02QAGhVh7HWduPgAkAUq0Hm3+t0Moi4PmBMRpwZsWq9ot3d6FJUZz5nwx9g/mjsFEg5FqdtMOClcmpSTq14oGovBLjqGA/oCb7cw57hE1S+VLnl0yhF4ppyuvSbTfs9fPdFp2Uk7LjNywcJXXBudbDOerFAPi4X9dE/lH2yJoEyZMsIf9dfoanbROE/kd0wsTNH/+srbI8VSN1xk3FQJNX6EgqvUOBe+lGa7YQV3ifqobOmflUMQ7Fg4vcIiGxc8t/7QjYVel test@archlinux ```

ungleich-gitea closed this issue

2021-11-20 15:20:13 +00:00

ungleich-gitea commented

2021-11-20 15:43:18 +00:00

Created by: darko-poljak

@pcoder Ok, I will prepare a fix for an invalid key case.

*Created by: darko-poljak* @pcoder Ok, I will prepare a fix for an invalid key case.

ungleich-gitea commented

2021-11-20 15:43:19 +00:00

Created by: pcoder

I think you are right there @darko-poljak I may have overlooked this.

*Created by: pcoder* I think you are right there @darko-poljak I may have overlooked this.

ungleich-gitea commented

2021-11-20 15:43:21 +00:00

Created by: darko-poljak

@pcoder Nope, it works with this key. Are you sure you have only this in your manifest and that it clears existing file?

*Created by: darko-poljak* @pcoder Nope, it works with this key. Are you sure you have only this in your manifest and that it clears existing file?

ungleich-gitea commented

2021-11-20 15:43:22 +00:00

Created by: pcoder

@darko-poljak check this out

__ssh_authorized_keys root \
  --key "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC+sx1TKzHf+yWpMKsB9NE+w1nYxzun1njbzNL4XwmAavcmjTPhRhImD13R/Hg+zyrvPt3/GsNAsbo02QAGhVh7HWduPgAkAUq0Hm3+t0Moi4PmBMRpwZsWq9ot3d6FJUZz5nwx9g/mjsFEg5FqdtMOClcmpSTq14oGovBLjqGA/oCb7cw57hE1S+VLnl0yhF4ppyuvSbTfs9fPdFp2Uk7LjNywcJXXBudbDOerFAPi4X9dE/lH2yJoEyZMsIf9dfoanbROE/kd0wsTNH/+srbI8VSN1xk3FQJNX6EgqvUOBe+lGa7YQV3ifqobOmflUMQ7Fg4vcIiGxc8t/7QjYVel test@archlinux

" --state present

*Created by: pcoder* @darko-poljak check this out ``` __ssh_authorized_keys root \ --key "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC+sx1TKzHf+yWpMKsB9NE+w1nYxzun1njbzNL4XwmAavcmjTPhRhImD13R/Hg+zyrvPt3/GsNAsbo02QAGhVh7HWduPgAkAUq0Hm3+t0Moi4PmBMRpwZsWq9ot3d6FJUZz5nwx9g/mjsFEg5FqdtMOClcmpSTq14oGovBLjqGA/oCb7cw57hE1S+VLnl0yhF4ppyuvSbTfs9fPdFp2Uk7LjNywcJXXBudbDOerFAPi4X9dE/lH2yJoEyZMsIf9dfoanbROE/kd0wsTNH/+srbI8VSN1xk3FQJNX6EgqvUOBe+lGa7YQV3ifqobOmflUMQ7Fg4vcIiGxc8t/7QjYVel test@archlinux " --state present ```

ungleich-gitea commented

2021-11-20 15:43:23 +00:00

Created by: darko-poljak

@pcoder I cannot reproduce a case where key is valid but has trailing whitespace. Do you have an example?
I have reproduced a case where key is invalid. Here the problem is in explorer/entry.

*Created by: darko-poljak* @pcoder I cannot reproduce a case where key is valid but has trailing whitespace. Do you have an example? I have reproduced a case where key is invalid. Here the problem is in explorer/entry.

ungleich-gitea commented

2021-11-20 15:43:25 +00:00

Created by: pcoder

Whats worse is that if we have many keys in authorized_keys file, all of them are overwritten with only testtesttestsetestststestsetest

*Created by: pcoder* Whats worse is that if we have many keys in authorized_keys file, all of them are overwritten with only `testtesttestsetestststestsetest`

ungleich-gitea commented

2021-11-20 15:43:26 +00:00

Created by: pcoder

@darko-poljak

authorized_keys file content could be containing any number of keys. For instance lets take this, a randomly chosen public key

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC16O/IbyOrF3y6c8j2zwj7yAVwYn6p8C/2pnw1rKehHHRJGS5PTENVmVZCHrpAGFAPzGOr4BuZ7DACN/qgKWpTcVcXy+I98BK8A9BDpCXU5QPVkSVndTUGPLBUuy/NmN54aisCRcQ1I1OZ9QTd5qutx7cbcwUK00mdzFPhQFVFZrz8LsBmuUahbPri9FMyOv4HxPr6LdonvGNgkD63DcCmXO1BastMQ6M7tOPymQuvuPlVqTcsWtD2Xz/eXWCE2uYXJRPwR3hBG3Gd5Wz1EOvZrlKFjRIPr/YfwitrnQbI/cA8RYH48R4oxwDFkuZLSLhEvHqvG090M24vQwTEczsh

init manifest content

__file /etc/cdist-configured
__cdistmarker

case "$__target_host" in
   my_ip_address)
      __ssh_authorized_keys root \
         --key "testtesttestsetestststestsetest" --state present
   ;;
esac

authorized_keys file content after running cdist

testtesttestsetestststestsetest

expected authorized_keys file

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC16O/IbyOrF3y6c8j2zwj7yAVwYn6p8C/2pnw1rKehHHRJGS5PTENVmVZCHrpAGFAPzGOr4BuZ7DACN/qgKWpTcVcXy+I98BK8A9BDpCXU5QPVkSVndTUGPLBUuy/NmN54aisCRcQ1I1OZ9QTd5qutx7cbcwUK00mdzFPhQFVFZrz8LsBmuUahbPri9FMyOv4HxPr6LdonvGNgkD63DcCmXO1BastMQ6M7tOPymQuvuPlVqTcsWtD2Xz/eXWCE2uYXJRPwR3hBG3Gd5Wz1EOvZrlKFjRIPr/YfwitrnQbI/cA8RYH48R4oxwDFkuZLSLhEvHqvG090M24vQwTEczsh
testtesttestsetestststestsetest

or at least if the public ssh key is not a valid format, the original key should not to be overwritten

*Created by: pcoder* @darko-poljak 1. authorized_keys file content could be containing any number of keys. For instance lets take this, a randomly chosen public key ``` ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC16O/IbyOrF3y6c8j2zwj7yAVwYn6p8C/2pnw1rKehHHRJGS5PTENVmVZCHrpAGFAPzGOr4BuZ7DACN/qgKWpTcVcXy+I98BK8A9BDpCXU5QPVkSVndTUGPLBUuy/NmN54aisCRcQ1I1OZ9QTd5qutx7cbcwUK00mdzFPhQFVFZrz8LsBmuUahbPri9FMyOv4HxPr6LdonvGNgkD63DcCmXO1BastMQ6M7tOPymQuvuPlVqTcsWtD2Xz/eXWCE2uYXJRPwR3hBG3Gd5Wz1EOvZrlKFjRIPr/YfwitrnQbI/cA8RYH48R4oxwDFkuZLSLhEvHqvG090M24vQwTEczsh ``` 2. init manifest content ``` __file /etc/cdist-configured __cdistmarker case "$__target_host" in my_ip_address) __ssh_authorized_keys root \ --key "testtesttestsetestststestsetest" --state present ;; esac ``` 3. authorized_keys file content after running cdist ``` testtesttestsetestststestsetest ``` 4. expected authorized_keys file ``` ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC16O/IbyOrF3y6c8j2zwj7yAVwYn6p8C/2pnw1rKehHHRJGS5PTENVmVZCHrpAGFAPzGOr4BuZ7DACN/qgKWpTcVcXy+I98BK8A9BDpCXU5QPVkSVndTUGPLBUuy/NmN54aisCRcQ1I1OZ9QTd5qutx7cbcwUK00mdzFPhQFVFZrz8LsBmuUahbPri9FMyOv4HxPr6LdonvGNgkD63DcCmXO1BastMQ6M7tOPymQuvuPlVqTcsWtD2Xz/eXWCE2uYXJRPwR3hBG3Gd5Wz1EOvZrlKFjRIPr/YfwitrnQbI/cA8RYH48R4oxwDFkuZLSLhEvHqvG090M24vQwTEczsh testtesttestsetestststestsetest ``` or at least if the public ssh key is not a valid format, the original key *should not* to be overwritten

ungleich-gitea commented

2021-11-20 15:43:27 +00:00

Created by: darko-poljak

@pcoder Can you give an example?

authorized_keys file content before running cdist
init manifest content
authroized_keys file content after running cdist
expected authorized_keys file content after step 3.

So that I know what to reproduce.

*Created by: darko-poljak* @pcoder Can you give an example? 1. authorized_keys file content before running cdist 2. init manifest content 3. authroized_keys file content after running cdist 4. expected authorized_keys file content after step 3. So that I know what to reproduce.

ungleich-gitea commented

2021-11-20 15:43:29 +00:00

Created by: darko-poljak

@pcoder I will take a look soon.

*Created by: darko-poljak* @pcoder I will take a look soon.

Sign in to join this conversation.