
    x[h+              
          U d Z ddlZddlZddlZddlZddlZddlmZmZm	Z	 ddl
mZmZmZmZ ddlmZ ddlmZ ddlmZ ddlmZmZ dd	lmZ d
egeg dZeed<    ej8                  e      Zg dZdgZ dZ!dZ"g Z#ee$   ed<   i Z%i Z&eD ]B  Z'e%jQ                  e' de!e'z  dfe' de!e'z   ddfe' de!e'z   ddfi       e' de&e' d<   D dZ)de$ddfdZ*de$deded e+ddf
d!Z,d" Z-d%d#ee	e$      fd$Z.y)&zSSH: Configure SSH and SSH keys    N)ListOptionalSequence)	lifecyclessh_utilsubputil)Cloud)Config)
MetaSchema)ALL_DISTROSug_util)PER_INSTANCEcc_ssh)iddistros	frequencyactivate_by_schema_keysmeta)rsaecdsaed25519r   z/etc/ssh/ssh_host_%s_keyTHOST_KEY_PUBLISH_BLACKLIST_private  _public.pub  _certificatez	-cert.pubz;o=$(ssh-keygen -yf "%s") && echo "$o" root@localhost > "%s"keyfilereturnc                 0   d}t        j                         }|r|t        j                  dd      k  rd}nd}t	        j
                  d      }|dk7  rt        j                  | d|       t        j                  | |       t        j                  |  d|       y	)
a  
    For fedora 37, centos 9 stream and below:
     - sshd version is earlier than version 9.
     - 'ssh_keys' group is present and owns the private keys.
     - private keys have permission 0o640.
    For fedora 38, centos 10 stream and above:
     - ssh version is atleast version 9.
     - 'ssh_keys' group is absent. 'root' group owns the keys.
     - private keys have permission 0o600, same as upstream.
    Public keys in all cases have permission 0o644.
    r   	   r   i  r   ssh_keysr   N)	r   get_opensshd_upstream_versionr   Versionr	   get_group_idoschownchmod)r    permissions_publicssh_versionpermissions_privategids        9/usr/lib/python3/dist-packages/cloudinit/config/cc_ssh.pyset_redhat_keyfile_permsr1   =   s     88:K{Y%6%6q!%<<
 $ $


J
'C
by
 	"c"HHW)*HHy12    namecfgcloudargsc           	         |j                  dd      rPt        j                  j                  dd      }t	        j                  |      D ]  }	 t        j                  |        d|v rag }|d   j                         D ]  \  }}|t        vr3t        j                  d|      rd}	nd	}	t        j                  d
|	|       At        |   d   }
t        |   d   }t        j                  |
||       d|v su|j!                  dt#        |
      f        |rt%        j&                  |       t(        j                         D ]  \  }}||d   v s||d   vrt        |   d   t        |   d   }}ddt*        ||fz  g}	 t        j,                  dd      5  t/        j.                  |d       d d d        t        j1                  d||        nt        j2                  |dt4              }t        j6                         s|n|D cg c]  }|t8        vr| c}}t;        |      j=                  |      }|r%t        j1                  ddj                  |             |D ]  }t>        |z  }t        j                  jA                  |      r-t        jB                  t        j                  jE                  |             dd|ddd|g}t        j,                  dd      5  	 t/        j.                  |dd d!i"      \  }}t        jF                  |d#d      s2tH        jJ                  jM                  t        jN                  |             |jP                  jR                  d$k(  rtU        |       d d d         d(|v r=t        j2                  |d(   d)t`              }t        jF                  |d(   d*tb              }nt`        }tb        }|r(te        |+      }	 |jf                  ji                  |       	 tk        jl                  ||jP                        \  }}tk        jn                  |      \  }} t        jF                  |d-d      }!t        jp                  |d.t$        jr                        }"g }#t        jF                  |d/d      r|ju                         xs g }#nt        j1                  d0       d1|v r|d1   }$|#jw                  |$       ty        |#||!|"       y # t        $ r t        j                  t        d|       Y w xY w# 1 sw Y   MxY w# t        $ r$ t        j                  t        d| d|        Y w xY wc c}w # t.        jV                  $ r}t        jN                  |jX                        j[                         }|j\                  dk(  r6|j[                         j_                  d%      rt        j1                  d&|       nt        j                  t        d'||       Y d }~zd }~ww xY w# 1 sw Y   xY w# t        $ r t        j                  t        d,       Y 3w xY w# t        $ r t        j                  t        d2       Y y w xY w)3Nssh_deletekeysTz	/etc/ssh/zssh_host_*key*zFailed deleting key file %sr$   z4^(ecdsa-sk|ed25519-sk)_(private|public|certificate)$unsupportedunrecognizedz Skipping %s ssh_keys entry: "%s"r      r   HostCertificateshz-xcz/etc/ssh)	recursiveF)capturezGenerated a key for %s from %szFailed generating a key for z from ssh_genkeytypesz5skipping keys that are not supported in fips mode: %s,z
ssh-keygenz-tz-N z-fLANGC)r?   
update_envssh_quiet_keygenredhatzunknown keyz!ssh-keygen: unknown key type '%s'z(Failed generating key type %s to file %sssh_publish_hostkeys	blacklistenabled)rI   zPublishing host keys failed!disable_rootdisable_root_optsallow_public_ssh_keyszSSkipping import of publish SSH keys per config setting: allow_public_ssh_keys=Falsessh_authorized_keysz Applying SSH credentials failed!)=getr)   pathjoinglobr	   del_file	ExceptionlogexcLOGitemsCONFIG_KEY_TO_FILErematchwarning
write_fileappendstrr   append_ssh_configPRIV_TO_PUBKEY_GEN_TPLSeLinuxGuardr   debugget_cfg_option_listGENERATE_KEY_NAMESfips_enabledFIPS_UNSUPPORTED_KEY_NAMESset
differenceKEY_FILE_TPLexists
ensure_dirdirnameget_cfg_option_boolsysstdoutwritedecode_binarydistroosfamilyr1   ProcessExecutionErrorstderrlower	exit_code
startswithr   PUBLISH_HOST_KEYSget_public_host_keys
datasourcepublish_host_keysr   normalize_users_groupsextract_defaultget_cfg_option_strDISABLE_USER_OPTSget_public_ssh_keysextendapply_credentials)%r3   r4   r5   r6   key_pthfcert_configkeyvalreasontgt_fn	tgt_permsprivate_typepublic_typeprivate_filepublic_filecmdgenkeysnames	key_namesskipped_keyskeytyper    outerrehost_key_blacklistpublish_hostkeyshostkeysusers_groupsuser_user_configrK   rL   keyscfgkeyss%                                        r0   handler   a   s    ww&'',,{,<=7# 	CACa 	C SJ--/ 	EHC,,88JC +F+F>L',Q/F*3/2IOOFC3$""$5s6{#CD	E" &&{3)4):):)< 	%L+s:.s:6"<03";/2 &L |[.I IJC&&zTB 2IIc512		4k<	4 **"$6
 $$&  % ::  	 7|..y9IIG&
 !  	G"g.Gww~~g&OOBGGOOG45wb$HC "":> #yyTvsm HC  33/ 

((););C)@A||,,809  	D $!55&'&

  33&'4E
 8,'2DE	=..x8="99#u||L&66u=|//^TJ 33$h&@&@
 ##C)@$G,,.4"DII>
 !C'/0GKK $l4EFg  CC!>BCN2 2
  2"m6,9B 11 ,,QXX6<<>C{{a'CIIK,B,B%- 		"EwOF##	 V  	=KK;<	=2  =C;<=s   S7S>S1&S>>T.W"B
T3W/ #C"X $S.-S.1S;	6S>>)T+*T+3WBWW"WW""W,	/#XX#X?>X?c                     t        |       } |rt        j                  | |       |r)|sd}|j                  d|      }|j                  dd      }nd}t        j                  | d|       y )NNONEz$USERz$DISABLE_USERrootrB   )options)rh   r   setup_user_keysreplace)r   r   rK   rL   
key_prefixs        r0   r   r     sd    t9D  t,D&..w=
''@

T6:>r2   rI   c                 f   t         d}g }g }| r| D cg c]  }||fz  
 }}t        j                  |dz        D cg c]  }||vr|
 }}|D ]V  }t        j                  |      }|j	                         }	|	s+t        |	      dkD  s:|j                  t        |	dd              X |S c c}w c c}w )a  Read host keys from /etc/ssh/*.pub files and return them as a list.

    @param blacklist: List of key types to ignore. e.g. ['rsa']
    @returns: List of keys, each formatted as a two-element tuple.
        e.g. [('ssh-rsa', 'AAAAB3Nz...'), ('ssh-ed25519', 'AAAAC3Nx...')]
    r   )*r;   N   )rj   rR   r	   load_text_filesplitlenr]   tuple)
rI   public_key_file_tmplkey_listblacklist_fileskey_typehostfile	file_list	file_namefile_contentskey_datas
             r0   r{   r{     s     (45HO @I
3; H;.
 
 		"6"?@?* 	I   1	++I6 &&(H)OOE(2A,/0	1
 O#
s
   B)B.)N)/__doc__rR   loggingr)   rY   ro   typingr   r   r   	cloudinitr   r   r   r	   cloudinit.cloudr
   cloudinit.configr   cloudinit.config.schemar   cloudinit.distrosr   r   cloudinit.settingsr   r   __annotations__	getLogger__name__rV   re   rg   rj   rz   r   r^   rX   r`   kupdatera   r1   listr   r   r{    r2   r0   <module>r      s   &   	 	 
 + + 5 5 ! # . 2 + }!	j  g!0 '[ ) (* DI * 	 0AcN\A-u5cM|a/05u=cL1$4#5Y!? G	
 &'Cw-K1#X0 L!3c !3d !3H]= ]=6 ]=% ]=t ]= ]=@?"HXc]$; r2   