efda2350a9
Currently cloud-init writes something like this to console output: ec2: ############################################################# ec2: -----BEGIN SSH HOST KEY FINGERPRINTS----- ec2: 2048 78:ae:f3:91:04:6f:8d:ee:ef:e1:2d:72:83:6a:d0:82 root@h (RSA) ec2: 1024 d3:b6:32:64:22:d4:43:05:f9:25:b4:f3:65:4e:e2:51 root@h (DSA) ec2: -----END SSH HOST KEY FINGERPRINTS----- ec2: ############################################################# the key fingerprints are useful for humans to read, but not so useful for machines, as you cannot populate a KnownHostsFile (~/.ssh/known_hosts) from the data there. This change adds output like: -----BEGIN SSH HOST KEY KEYS----- ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdH......STI= root@h ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDYRIQe6m......tWF3 root@h -----END SSH HOST KEY KEYS----- Those lines can easily be grabbed and appended to a known_hosts file.
37 lines
1.4 KiB
Python
37 lines
1.4 KiB
Python
# vi: ts=4 expandtab
|
|
#
|
|
# Copyright (C) 2011 Canonical Ltd.
|
|
#
|
|
# Author: Scott Moser <scott.moser@canonical.com>
|
|
#
|
|
# This program is free software: you can redistribute it and/or modify
|
|
# it under the terms of the GNU General Public License version 3, as
|
|
# published by the Free Software Foundation.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
from cloudinit.CloudConfig import per_instance
|
|
import cloudinit.util as util
|
|
import subprocess
|
|
|
|
frequency = per_instance
|
|
|
|
def handle(name,cfg,cloud,log,args):
|
|
cmd = [ '/usr/lib/cloud-init/write-ssh-key-fingerprints' ]
|
|
fp_blacklist = util.get_cfg_option_list_or_str(cfg, "ssh_fp_console_blacklist", [])
|
|
key_blacklist = util.get_cfg_option_list_or_str(cfg, "ssh_key_console_blacklist", ["ssh-dss"])
|
|
try:
|
|
confp = open('/dev/console',"wb")
|
|
cmd.append(','.join(fp_blacklist))
|
|
cmd.append(','.join(key_blacklist))
|
|
subprocess.call(cmd, stdout=confp)
|
|
confp.close()
|
|
except:
|
|
log.warn("writing keys to console value")
|
|
raise
|