New cloud-config uses only bash, no python.

2018-01-21 15:02:05 -06:00 · 2018-01-21 15:02:05 -06:00 · 0d456cc116
commit 0d456cc116
parent 326f0590ae
1 changed files with 71 additions and 0 deletions
--- a/files/user-cloud-config2
+++ b/files/user-cloud-config2
@ -0,0 +1,71 @@
+#cloud-config
+mounts:
+  - [ /dev/disk/by-label/config-2, /mnt/config ]
+write_files:
+  - path: /root/tatu-setup-ssh.sh
+    permissions: '0700'
+    owner: root:root
+    content: |
+        #!/bin/bash
+        # Name: tatu-setup-ssh.sh
+        #
+        # Purpose: Fetch a SSH host cert from Tatu and configure SSH to use certs.
+        metadata=$(cat /mnt/config/openstack/latest/meta_data.json)
+        auth_id=$(echo $metadata | grep -Po 'project_id": "\K[^"]*')
+        echo auth_id=$auth_id
+        host_id=$(echo $metadata | grep -Po 'uuid": "\K[^"]*')
+        echo host_id=$host_id
+        vendordata=$(cat /mnt/config/openstack/latest/vendor_data2.json)
+        token=$(echo $vendordata | grep -Po 'token": "\K[^"]*')
+        echo token=$token
+        ca_user=$(echo $vendordata | grep -Po 'auth_pub_key_user": "\K[^"]*')
+        echo ca_user=$ca_user
+        echo $ca_user > /etc/ssh/ca_user.pub
+        principals=$(echo $vendordata | grep -Po 'principals": "\K[^"]*')
+        echo principals=$principals
+        host_pub_key=$(cat /etc/ssh/ssh_host_rsa_key.pub)
+        echo host public key is $host_pub_key
+        data=$(echo {\"token_id\": \"$token\", \"host_id\": \"$host_id\", \"key.pub\": \"$host_pub_key\"})
+        echo $data > /tmp/tatu_cert_request.json
+        url=http://172.24.4.1:18322/noauth/hostcerts
+        echo url=$url
+        echo Posting Host Certificate request to Tatu API
+        response=$(curl -d "@/tmp/tatu_cert_request.json" -X POST $url)
+        echo Tatu response is $response
+        cert=$(echo $metadata | grep -Po 'key-cert.pub": "\K[^"]*')
+        echo $cert > /etc/ssh/ssh_host_rsa_key-cert.pub
+        mkdir -p /etc/ssh/ssh_host_rsa_key-cert.pub
+        mkdir -p /etc/ssh/auth_principals
+        principals_file=/etc/ssh/auth_principals/root
+        > $principals_file
+        for i in ${principals//,/ }
+        do
+            echo $i >> $principals_file
+        done
+        > /etc/ssh/revoked-keys
+        sed -i -e '$aTrustedUserCAKeys /etc/ssh/ca_user.pub' /etc/ssh/sshd_config
+        sed -i -e '$aAuthorizedPrincipalsFile /etc/ssh/auth_principals/%u' /etc/ssh/sshd_config
+        sed -i -e '$aHostCertificate /etc/ssh/ssh_host_rsa_key-cert.pub' /etc/ssh/sshd_config
+        sed -i -e '$aRevokedKeys /etc/ssh/revoked-keys' /etc/ssh/sshd_config
+        systemctl restart sshd
+  - path: /root/tatu-manage-revoked-keys.sh
+    permissions: '0700'
+    owner: root:root
+    content: |
+        #!/bin/bash
+        # Name: tatu-manage-revoked-keys.sh
+        #
+        # Purpose: Fetch the revoked keys data from Tatu and write it to /etc/ssh
+        # !/usr/bin/env python
+        metadata=$(cat /mnt/config/openstack/latest/meta_data.json)
+        auth_id=$(echo $metadata | grep -Po 'project_id": "\K[^"]*')
+        echo auth_id=$auth_id
+        url=http://172.24.4.1:18322/noauth/revokeduserkeys/$auth_id
+        response=$(curl $url)
+        echo Tatu response is $response
+        b64revoked=$(echo $response | grep -Po 'revoked_keys_data": "\K[^"]*')
+        echo $b64revoked | base64 -d > /etc/ssh/revoked-keys
+runcmd:
+  - /root/tatu-setup-ssh.sh > /var/log/tatu-setup-ssh.log 2>&1
+  - /root/tatu-manage-revoked-keys.sh > /var/log/tatu-revoked-keys.log
+  - crontab -l | { cat; echo "* * * * * /root/tatu-manage-revoked-keys.sh >> /var/log/tatu-revoked-keys.log"; } | crontab -