Unable to delete SSH keys

Bug #1780411 reported by Jimmy Merrild Krag on 2018-07-06
256
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Canonical SSO provider
Undecided
Maximiliano Bertacchini
Launchpad itself
High
Colin Watson

Bug Description

I cannot delete my SSH keys.
I have marked this a security vulnerability because of the poential inability to delete a compromized SSH key.

Got no OOPS ID, but got a Sentry ID: 32a232dcb50c420cb17e2de793c7968e

Related branches

Daniel Manrique (roadmr) wrote :

UnknownLaunchpadError: <UnknownLaunchpadError code: 400 message: 'key_text: ssh-dss AAAAB3NzaC1kc3MAAACBAJle69Pl5apCOWyy/IWxOXLC7aLPRTdziK56cPNeJJ8AKPcv3cncU1lqBVqub94URnWVuTobx00wlhBPzG+y4jEWe5Q/uFu0EgUV/uZ+csoNoaMxjZNGKS5HAeJBlkTJTtlRjwTviFNJzRsHQB8kK6EqKzlCVo5ppCAGQn2wOCS/AAAAFQDKTifx6yiHMEV0Bncrv57cgA11aQAAAIA1jl3JuRNEpKafZT2LBSMvebCTjAJiX06XzaGLN5azsNMSUQQhLszQW2pU+GQ9iJ5C7nqtNeUtJyUw2oWCDyWpp7gGKoYrO9+5WU+eFamTlfff2ilJ093sKqjTx8AiSKY/VJagKpqQd+qSLv8JN9NgYXiIz0uWUtIXlslHj8juNQAAAIBDnrlBOT1pUUr3dvdyjxAbw93spWEiAuHtQSA9kKpJEbuL1LxESjcGI1Tvo83mG5BHDE2Cmmm7oZLC+PedkqUD7m7iUG6PWZbAbTKFpTNt0yGQoZOQJnw6xRwtUFKerA+zx4q3YQaIHXVUP2JCD7v++alYvF87FlNrGG2fGSXlaQ== beruic@beruic-laptop
'>

This is what SSO said. I wonder why Launchpad 400d on us? could someone with access to Launchpad logs please have a look?

Here's the timestamp from the Sentry event.
Jul 6, 2018 9:52:55 AM UTC

Changed in canonical-identity-provider:
status: New → Confirmed
Colin Watson (cjwatson) wrote :

Launchpad is just rejecting this because of parameter formatting: the key_text parameter is declared as a TextLine, so it isn't allowed to have a trailing newline.

Changed in launchpad:
status: New → Invalid
Colin Watson (cjwatson) wrote :

16:16 <cjwatson> roadmr: easy to test - while you can't actually use that method for real without SSO's privileges, you can get far enough to see parameter validation happening. try 'lp-shell production devel' and then do lp.people.addSSHKeyFromSSO(openid_identifier='test', key_text='ssh-dss\n', dry_run=True) vs. same without the \n
16:20 <cjwatson> roadmr: so I think somebody needs to look into why ClaimSSHKeyForm.clean_ssh_key's .strip() and re.sub apparently isn't happening or not being saved into the form data or whatever (maybe something needs to call .clean() on the form and isn't?)
16:20 <cjwatson> roadmr: should be easy to exercise in the test suite anyway

Note that `ClaimSSHKeyForm` is used when adding keys, while this is an issue with deletion. That said, `DeleteSSHKeyForm` gets its choices directly from LP (`get_lp_ssh_keys()`). So, I believe LP itself might have "invalid" ssh keys in its storage. Is that possible?

OTOH, I've proposed a branch with an improved cleanup for *new* ssh keys.

Changed in launchpad:
status: Invalid → New
Colin Watson (cjwatson) on 2018-08-02
Changed in launchpad:
assignee: nobody → Colin Watson (cjwatson)
importance: Undecided → High
status: New → In Progress
tags: added: api lp-registry ssh trivial
Launchpad QA Bot (lpqabot) wrote :
tags: added: qa-needstesting
Changed in launchpad:
status: In Progress → Fix Committed
Changed in canonical-identity-provider:
status: Confirmed → Fix Committed
assignee: nobody → Maximiliano Bertacchini (maxiberta)
Changed in canonical-identity-provider:
status: Fix Committed → Fix Released
Jimmy Merrild Krag (beruic) wrote :

I have just tried to delete a key on https://login.launchpad.net/ssh-keys, but still get an error.

Colin Watson (cjwatson) wrote :

Jimmy, we haven't deployed the Launchpad side of this fix yet. You'll see the Launchpad bug task change to "Fix Released" once we have.

tags: added: qa-ok
removed: qa-needstesting
Jimmy Merrild Krag (beruic) wrote :

Sorry. Misread that one :)

Colin Watson (cjwatson) wrote :

This should work now. Please test and let us know either way; if it still doesn't work, we'll need to investigate further.

Changed in launchpad:
status: Fix Committed → Fix Released
Jimmy Merrild Krag (beruic) wrote :

Sorry it took so long, but the result is that it worked! I could finally delete my old unsafe public key :)

Colin Watson (cjwatson) on 2018-08-24
information type: Private Security → Public Security
To post a comment you must log in.
This report contains Public Security information  Edit
Everyone can see this security related information.

Other bug subscribers