3
\men @ s U d Z ddlZddlZddlmZ ddlmZmZ ddlm Z ddl
m Z ddl m
Z
mZ ddlmZ d Zd
gZd d d
deedededgeg dZe
eeZ ejeZdd Zee e eddddZdS )zFKeys to Console: Control which SSH host keys may be written to console N)dedent)subputil)Cloud)Config)
MetaSchema get_meta_doc) PER_INSTANCEz(%s/cloud-init/write-ssh-key-fingerprintsallZcc_keys_to_consolezKeys to Consolez5Control which SSH host keys may be written to consoleas For security reasons it may be desirable not to write SSH host keys and their fingerprints to the console. To avoid either being written to the console the ``emit_keys_to_console`` config key under the main ``ssh`` config key can be used. To avoid the fingerprint of types of SSH host keys being written to console the ``ssh_fp_console_blacklist`` config key can be used. By default, all types of keys will have their fingerprints written to console. To avoid host keys of a key type being written to console the``ssh_key_console_blacklist`` config key can be used. By default, ``ssh-dss`` host keys are not written to console.z # Do not print any SSH keys to system console
ssh:
emit_keys_to_console: false
z~ # Do not print certain ssh key types to console
ssh_key_console_blacklist: [dsa, ssh-dss]
z # Do not print specific ssh key fingerprints to console
ssh_fp_console_blacklist:
- E25451E0221B5773DEBFF178ECDACB160995AA89
- FE76292D55E8B28EE6DB2B34B2D8A784F8C0AAB0
)idnametitle descriptiondistrosZexamplesZ frequencyZactivate_by_schema_keysc C s, y
| j }W n tk
r" d}Y nX t| S )Nz/usr/lib)Z usr_lib_execAttributeErrorHELPER_TOOL_TPL)distroZbase_lib r (/usr/lib/python3.6/cc_keys_to_console.py_get_helper_tool_pathJ s
r )r cfgcloudargsreturnc
C s t j|jdi jddr*tjd| d S t|j}tjj |sRtj
d| | d S t j |dg }t j |ddg}y@|d j |d j |g}t
j
|\}} t jd
|j d dd W n tk
r tj
d
Y nX d S )NZsshZemit_keys_to_consoleTz;Skipping module named %s, logging of SSH host keys disabledz9Unable to activate module %s, helper tool not found at %sZssh_fp_console_blacklistZssh_key_console_blacklistzssh-dss,z%s
F)stderrZconsolez*Writing keys to the system console failed!)r Zis_falsegetLOGdebugr r ospathexistsZwarningZget_cfg_option_listjoinr Z multi_logstrip Exception)
r r r r Z helper_pathZ fp_blacklistZ
key_blacklistcmdstdoutZ_stderrr r r handleR s,
r' )__doc__Zloggingr textwrapr Z cloudinitr r Zcloudinit.cloudr Zcloudinit.configr Zcloudinit.config.schemar r Zcloudinit.settingsr r r metaZ getLogger__name__r r strlistr' r r r r s6