From 44b6004ee17cd2ae5930c7d8fd3ecafd7485a4d6 Mon Sep 17 00:00:00 2001 From: Eduardo Otubo Date: Mon, 17 Aug 2020 11:14:47 +0200 Subject: [PATCH 2/2] ssh exit with non-zero status on disabled user (#472) RH-Author: Eduardo Otubo Message-id: <20200729074459.16096-1-otubo@redhat.com> Patchwork-id: 98071 O-Subject: [RHEL-8.3.0 cloud-init PATCH] ssh exit with non-zero status on disabled user (#472) Bugzilla: 1833874 RH-Acked-by: Mohammed Gamal RH-Acked-by: Vitaly Kuznetsov commit e161059a18173e2b61c54dba9eab774401fb5f1f Author: Eduardo Otubo Date: Wed Jul 15 20:21:02 2020 +0200 ssh exit with non-zero status on disabled user (#472) It is confusing for scripts, where a disabled user has been specified, that ssh exits with a zero status by default without indication anything failed. I think exitting with a non-zero status would make more clear in scripts and automated setups where things failed, thus making noticing the issue and debugging easier. Signed-off-by: Eduardo Otubo Signed-off-by: Aleksandar Kostadinov LP: #1170059 Signed-off-by: Eduardo Otubo Signed-off-by: Miroslav Rezanina --- cloudinit/ssh_util.py | 4 +++- doc/examples/cloud-config.txt | 2 +- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/cloudinit/ssh_util.py b/cloudinit/ssh_util.py index bcb23a5..8ff61a2 100644 --- a/cloudinit/ssh_util.py +++ b/cloudinit/ssh_util.py @@ -40,11 +40,13 @@ VALID_KEY_TYPES = ( "ssh-rsa-cert-v01@openssh.com", ) +_DISABLE_USER_SSH_EXIT = 142 DISABLE_USER_OPTS = ( "no-port-forwarding,no-agent-forwarding," "no-X11-forwarding,command=\"echo \'Please login as the user \\\"$USER\\\"" - " rather than the user \\\"$DISABLE_USER\\\".\';echo;sleep 10\"") + " rather than the user \\\"$DISABLE_USER\\\".\';echo;sleep 10;" + "exit " + str(_DISABLE_USER_SSH_EXIT) + "\"") class AuthKeyLine(object): diff --git a/doc/examples/cloud-config.txt b/doc/examples/cloud-config.txt index 0e82b83..f00db68 100644 --- a/doc/examples/cloud-config.txt +++ b/doc/examples/cloud-config.txt @@ -235,7 +235,7 @@ disable_root: false # The string '$USER' will be replaced with the username of the default user. # The string '$DISABLE_USER' will be replaced with the username to disable. # -# disable_root_opts: no-port-forwarding,no-agent-forwarding,no-X11-forwarding,command="echo 'Please login as the user \"$USER\" rather than the user \"$DISABLE_USER\".';echo;sleep 10" +# disable_root_opts: no-port-forwarding,no-agent-forwarding,no-X11-forwarding,command="echo 'Please login as the user \"$USER\" rather than the user \"$DISABLE_USER\".';echo;sleep 10;exit 142" # disable ssh access for non-root-users # To disable ssh access for non-root users, ssh_redirect_user: true can be -- 1.8.3.1