|
 |
c36ff1 |
From ce346f6057377c7bb9b89703fb8855ccf4947a61 Mon Sep 17 00:00:00 2001
|
|
|
c36ff1 |
From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
|
|
|
c36ff1 |
Date: Wed, 8 Sep 2021 16:08:12 +0200
|
|
|
c36ff1 |
Subject: [PATCH] ssh_utils.py: ignore when sshd_config options are not
|
|
|
c36ff1 |
key/value pairs
|
|
|
c36ff1 |
|
|
|
c36ff1 |
RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
|
|
|
c36ff1 |
RH-MergeRequest: 10: ssh_utils.py: ignore when sshd_config options are not key/value pairs
|
|
|
c36ff1 |
RH-Commit: [1/1] 546081571e8b6b1415aae1a04660137070532fae (eesposit/cloud-init-centos-)
|
|
|
c36ff1 |
RH-Bugzilla: 2002302
|
|
|
c36ff1 |
RH-Acked-by: Eduardo Otubo <otubo@redhat.com>
|
|
|
c36ff1 |
RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
|
|
|
c36ff1 |
RH-Acked-by: Mohamed Gamal Morsy <mmorsy@redhat.com>
|
|
|
c36ff1 |
|
|
|
c36ff1 |
TESTED: by me
|
|
|
c36ff1 |
BREW: 39622506
|
|
|
c36ff1 |
|
|
|
c36ff1 |
commit 2ce857248162957a785af61c135ca8433fdbbcde
|
|
|
c36ff1 |
Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
|
|
|
c36ff1 |
Date: Wed Sep 8 02:08:36 2021 +0200
|
|
|
c36ff1 |
|
|
|
c36ff1 |
ssh_utils.py: ignore when sshd_config options are not key/value pairs (#1007)
|
|
|
c36ff1 |
|
|
|
c36ff1 |
As specified in #LP 1845552,
|
|
|
c36ff1 |
In cloudinit/ssh_util.py, in parse_ssh_config_lines(), we attempt to
|
|
|
c36ff1 |
parse each line of sshd_config. This function expects each line to
|
|
|
c36ff1 |
be one of the following forms:
|
|
|
c36ff1 |
|
|
|
c36ff1 |
\# comment
|
|
|
c36ff1 |
key value
|
|
|
c36ff1 |
key=value
|
|
|
c36ff1 |
|
|
|
c36ff1 |
However, options like DenyGroups and DenyUsers are specified to
|
|
|
c36ff1 |
*optionally* accepts values in sshd_config.
|
|
|
c36ff1 |
Cloud-init should comply to this and skip the option if a value
|
|
|
c36ff1 |
is not provided.
|
|
|
c36ff1 |
|
|
|
c36ff1 |
Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
|
|
|
c36ff1 |
|
|
|
c36ff1 |
Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
|
|
|
c36ff1 |
---
|
|
|
c36ff1 |
cloudinit/ssh_util.py | 8 +++++++-
|
|
|
c36ff1 |
tests/unittests/test_sshutil.py | 8 ++++++++
|
|
|
c36ff1 |
2 files changed, 15 insertions(+), 1 deletion(-)
|
|
|
c36ff1 |
|
|
|
c36ff1 |
diff --git a/cloudinit/ssh_util.py b/cloudinit/ssh_util.py
|
|
|
c36ff1 |
index 9ccadf09..33679dcc 100644
|
|
|
c36ff1 |
--- a/cloudinit/ssh_util.py
|
|
|
c36ff1 |
+++ b/cloudinit/ssh_util.py
|
|
|
c36ff1 |
@@ -484,7 +484,13 @@ def parse_ssh_config_lines(lines):
|
|
|
c36ff1 |
try:
|
|
|
c36ff1 |
key, val = line.split(None, 1)
|
|
|
c36ff1 |
except ValueError:
|
|
|
c36ff1 |
- key, val = line.split('=', 1)
|
|
|
c36ff1 |
+ try:
|
|
|
c36ff1 |
+ key, val = line.split('=', 1)
|
|
|
c36ff1 |
+ except ValueError:
|
|
|
c36ff1 |
+ LOG.debug(
|
|
|
c36ff1 |
+ "sshd_config: option \"%s\" has no key/value pair,"
|
|
|
c36ff1 |
+ " skipping it", line)
|
|
|
c36ff1 |
+ continue
|
|
|
c36ff1 |
ret.append(SshdConfigLine(line, key, val))
|
|
|
c36ff1 |
return ret
|
|
|
c36ff1 |
|
|
|
c36ff1 |
diff --git a/tests/unittests/test_sshutil.py b/tests/unittests/test_sshutil.py
|
|
|
c36ff1 |
index a66788bf..08e20050 100644
|
|
|
c36ff1 |
--- a/tests/unittests/test_sshutil.py
|
|
|
c36ff1 |
+++ b/tests/unittests/test_sshutil.py
|
|
|
c36ff1 |
@@ -525,6 +525,14 @@ class TestUpdateSshConfigLines(test_helpers.CiTestCase):
|
|
|
c36ff1 |
self.assertEqual([self.pwauth], result)
|
|
|
c36ff1 |
self.check_line(lines[-1], self.pwauth, "no")
|
|
|
c36ff1 |
|
|
|
c36ff1 |
+ def test_option_without_value(self):
|
|
|
c36ff1 |
+ """Implementation only accepts key-value pairs."""
|
|
|
c36ff1 |
+ extended_exlines = self.exlines.copy()
|
|
|
c36ff1 |
+ denyusers_opt = "DenyUsers"
|
|
|
c36ff1 |
+ extended_exlines.append(denyusers_opt)
|
|
|
c36ff1 |
+ lines = ssh_util.parse_ssh_config_lines(list(extended_exlines))
|
|
|
c36ff1 |
+ self.assertNotIn(denyusers_opt, str(lines))
|
|
|
c36ff1 |
+
|
|
|
c36ff1 |
def test_single_option_updated(self):
|
|
|
c36ff1 |
"""A single update should have change made and line updated."""
|
|
|
c36ff1 |
opt, val = ("UsePAM", "no")
|
|
|
c36ff1 |
--
|
|
|
c36ff1 |
2.27.0
|
|
|
c36ff1 |
|