From f7d0b31dd52b55025fa5b5965441609c1110133d Mon Sep 17 00:00:00 2001 From: Peter Sabaini Date: Mon, 19 Feb 2024 17:02:06 +0100 Subject: [PATCH] Fix ssh key for bootstrapping Create a dedicated passwordless ssh key for bootstrapping the local juju controller. The default key (id_ed25519) cannot be relied upon: it may already exist and carry a passphrase. Fixes https://bugs.launchpad.net/snap-openstack/+bug/2054328 Signed-off-by: Peter Sabaini --- sunbeam-python/sunbeam/commands/prepare_node.py | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/sunbeam-python/sunbeam/commands/prepare_node.py b/sunbeam-python/sunbeam/commands/prepare_node.py index 6009f3598..4e1773f63 100644 --- a/sunbeam-python/sunbeam/commands/prepare_node.py +++ b/sunbeam-python/sunbeam/commands/prepare_node.py @@ -59,10 +59,19 @@ # with the sunbeam clustering daemon for cluster operations. sudo usermod --append --groups snap_daemon $USER -# Generate keypair and set-up prompt-less access to local machine -[ -f $HOME/.ssh/id_ed25519 ] || ssh-keygen -f $HOME/.ssh/id_ed25519 -t ed25519 -N "" -cat $HOME/.ssh/id_ed25519.pub >> $HOME/.ssh/authorized_keys +# Generate a dedicated passwordless keypair for bootstrapping the +# local Juju controller. We cannot rely on the default key (id_ed25519) +# because it may already exist and carry a passphrase — see LP#2054328. +[ -f $HOME/.ssh/id_rsa_snap-openstack ] || \ + ssh-keygen -b 4096 -f $HOME/.ssh/id_rsa_snap-openstack -t rsa -N "" +cat $HOME/.ssh/id_rsa_snap-openstack.pub >> $HOME/.ssh/authorized_keys ssh-keyscan -H $(hostname --all-ip-addresses) >> $HOME/.ssh/known_hosts +[ -f $HOME/.ssh/config ] || \ + ( touch $HOME/.ssh/config ; chmod 0600 $HOME/.ssh/config ) +cat >> $HOME/.ssh/config < /dev/null && \ ! curl -s -m 10 -x "" api.charmhub.io &> /dev/null; then