sshd_config file permission changed to 644 if ssh_pwauth value is true or false
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
cloud-init |
Fix Released
|
Medium
|
Lars Kellogg-Stedman | ||
cloud-init (Ubuntu) |
Fix Released
|
Medium
|
Unassigned | ||
Xenial |
Fix Released
|
Medium
|
Unassigned | ||
Yakkety |
Fix Released
|
Medium
|
Unassigned | ||
Zesty |
Fix Released
|
Medium
|
Unassigned | ||
Artful |
Fix Released
|
Medium
|
Unassigned |
Bug Description
=== Begin SRU Template ===
[Impact]
Existing security permissions on /etc/ssh/
[Test Case]
wget https:/
chmod 755 lxc-proposed-
# create config.yaml
cat config.yaml
#cloud-config
ssh_pwauth: true
name=proposed-test
for release in xenial yakkety zesty; do \
ref=$release-
lxc-proposed-
lxc init $ref $name;
lxc file pull $name/etc/
chmod 600 sshd_config;
lxc file push sshd_config $name/etc/
lxc config set $name user.user-data - < config.yml;
lxc start;
sleep 10;
lxc exec $name ls -ltr /etc/ssh/
lxc stop $name;
lxc delete $name;
done
[Regression Potential]
Minimal as we are now honoring file permissions if an sshd_config file exists.
[Other Info]
=== End SRU Template ===
In my deploy image, the default permission of sshd_config file is 600. It always be changed to 644 after cloud-init run. After debug, it is caused by cloud-config item:
ssh_pwauth: true
The related code is:
lines = [str(l) for l in new_lines]
of file cc_set_
write_file function use default mask 644 to write sshd_config. So my file permission changed.
It shall be enhanced to read old sshd_config permission and write new sshd_config with old permission to avoid security issue.
Related branches
- Server Team CI bot: Approve (continuous-integration)
- Scott Moser: Needs Fixing
-
Diff: 122 lines (+53/-5)4 files modifiedcloudinit/atomic_helper.py (+11/-1)
cloudinit/config/cc_set_passwords.py (+2/-1)
cloudinit/util.py (+9/-1)
tests/unittests/test_util.py (+31/-2)
description: | updated |
Changed in cloud-init (Ubuntu Xenial): | |
status: | New → Confirmed |
Changed in cloud-init (Ubuntu Yakkety): | |
status: | New → Confirmed |
Changed in cloud-init (Ubuntu Zesty): | |
status: | New → Confirmed |
Changed in cloud-init (Ubuntu Xenial): | |
importance: | Undecided → Medium |
Changed in cloud-init (Ubuntu Yakkety): | |
importance: | Undecided → Medium |
Changed in cloud-init (Ubuntu Zesty): | |
importance: | Undecided → Medium |
Changed in cloud-init (Ubuntu Artful): | |
importance: | Undecided → Medium |
Fixed in 721348a622a660b 65acfdf7fdf5320 3b47f80748