cloud-init in impish makes /home/ubuntu/.ssh root.root
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
cloud-init |
Fix Released
|
Critical
|
Unassigned | ||
cloud-init (Ubuntu) |
Fix Released
|
Critical
|
Unassigned | ||
Bionic |
Invalid
|
Undecided
|
Unassigned | ||
Focal |
Invalid
|
Undecided
|
Unassigned | ||
Hirsute |
Invalid
|
Undecided
|
Unassigned | ||
Impish |
Fix Released
|
Critical
|
Unassigned |
Bug Description
Hi,
I got to this by my systems complaining to be unable to do ssh-keygen
after deployment. Example:
$ uvt-kvm ssh --insecure impish-kvm 'ssh-keygen -b 2048 -t rsa -f ~/.ssh/id_rsa -q -N '\'''\'''
Saving key "/home/
I found that is due to permissions after guest spawning:
/home/ubuntu/.ssh changed
Old:
drwx------ 2 ubuntu ubuntu 4096 Aug 17 08:20 .ssh/
New:
drwxr-xr-x 2 root root 4096 Aug 17 08:17 .ssh/
That beaks later things like ssh-keygen.
uvt-kvm only does instruct cloud-init to place a key.
This uses ssh_authorized_keys from
https:/
Checked a few guests:
I've seen this on
- impish x86
- impish s390x
I've not seen this on
- bionic
- focal
- impish
You might say - wait a minute impish in both lists.
But it is the date:
Bad
com.ubuntu.
cloud-init 21.2-69-
Good
com.ubuntu.
cloud-init 21.2-3-
And either this cloud-init version is broken or the underlying new impish image.
I mounted the underlying cloud-image (without customization by cloud-init)
and found that /home is empty (true for all those images).
So to me that seems to be an issue in the new cloud-init that now is in
those images.
Steps to reproduce
# if your host has no keys to push to the guest run ssh-keygen
# sync the latest broken images
$ uvt-simplestrea
# spawn guest
$ uvt-kvm create --password=ubuntu i release=impish arch=amd64 label=daily
# wait for it and check the permissions
$ uvt-kvm wait i
$ uvt-kvm ssh i "ls -laF /home/ubuntu/"
drwxr-xr-x 2 root root 4096 Aug 17 08:17 .ssh/
description: | updated |
Changed in cloud-init (Ubuntu): | |
importance: | Undecided → Critical |
tags: | added: rls-ii-incoming |
Changed in cloud-init (Ubuntu): | |
status: | New → Triaged |
Changed in cloud-init: | |
status: | New → Triaged |
importance: | Undecided → Critical |
Collected logs according to https:/ /cloudinit. readthedocs. io/en/latest/ topics/ bugs.html
(automatic collection seems broken - see 1940235)