juju add-unit fails relation-joined hook due to permissions issues

[Paul Gear]

On adding a new juju unit, the www-sync user's ssh directory is created with apparently wrong permissions:

# ls -la /home/www-sync/.ssh/
total 24
drwxr-xr-x 2 www-sync root 4096 May 9 04:34 .
drwxr-xr-x 3 www-sync www-data 4096 May 9 04:34 ..
-rw-r--r-- 1 root root 396 May 9 04:34 authorized_keys
-rw------- 1 www-sync root 1679 May 9 04:34 id_rsa
-rw-r--r-- 1 www-sync root 396 May 9 04:34 id_rsa.pub
-rw-r--r-- 1 root root 659 May 9 04:34 known_hosts

This causes the initial sync of metadata to fail, preventing the relation hook from completing: https://pastebin.canonical.com/p/pQp4zb9HCp/

Workaround: chown -R www-sync /home/www-sync/.ssh/

[Paul Gear (paulgear)]

This is related to, but not the same as, lp:1680860

[Barry Price (barryprice)]

There's a little more to this - charmhelpers.contrib.unison does the initial setup which drops (root-owned) authorized_keys and known_hosts onto each unit.

Those files are *supposed* to already contain the appropriate values, the root ownership may even be an intentional security measure to avoid the 'www-sync' user from connecting to anywhere it's not supposed to.

Retargetting to charm-helpers for clarity, but that probably needs a Github issue...

https://github.com/juju/charm-helpers/blob/master/charmhelpers/contrib/unison/__init__.py

[Paul Collins (pjdc)]

I ran into this today adding a unit to aws ap-southeast-2. The IP being ssh'd to was not mentioned in known_hosts, so if the idea is that Juju maintains the file correctly, it's failing to do so here.

[Haw Loeung (hloeung)]

https://github.com/juju/charm-helpers/issues/487

[Haw Loeung (hloeung)]

Released in charm-helpers 0.20.18