apache/cloudstack
1
0
Fork 0
mirror of https://github.com/apache/cloudstack.git synced 2025-10-26 08:42:29 +01:00
Code Issues Packages Projects Releases Wiki Activity

CLOUDSTACK-10283: Sudo to setup agent keystore, fail on host add failure

Browse Source 
This would make keystore utility scripts being executed as sudoer
in case the process uid/owner is not root but still a sudoer user.

Also fails addHost while securing a KVM host and if keystore fails to be
setup for any reason.

Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
This commit is contained in:
Rohit Yadav 2018-02-14 13:08:20 +01:00
parent 3109c590e3
commit f1cf5f97e9
2 changed files with 9 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
agent/src/com/cloud/agent/Agent.java
View File

@ -647,7 +647,7 @@ public class Agent implements HandlerFactory, IAgentControl {
_shell.setPersistentProperty(null, KeyStoreUtils.passphrasePropertyName, storedPassword); _shell.setPersistentProperty(null, KeyStoreUtils.passphrasePropertyName, storedPassword);
} }
Script script = new Script(_keystoreSetupPath, 60000, s_logger); Script script = new Script(true, _keystoreSetupPath, 60000, s_logger);
script.add(agentFile.getAbsolutePath()); script.add(agentFile.getAbsolutePath());
script.add(keyStoreFile); script.add(keyStoreFile);
script.add(storedPassword); script.add(storedPassword);
@ -691,7 +691,7 @@ public class Agent implements HandlerFactory, IAgentControl {
throw new CloudRuntimeException("Unable to save received agent client and ca certificates", e); throw new CloudRuntimeException("Unable to save received agent client and ca certificates", e);
} }
Script script = new Script(_keystoreCertImportPath, 60000, s_logger); Script script = new Script(true, _keystoreCertImportPath, 60000, s_logger);
script.add(agentFile.getAbsolutePath()); script.add(agentFile.getAbsolutePath());
script.add(keyStoreFile); script.add(keyStoreFile);
script.add(KeyStoreUtils.agentMode); script.add(KeyStoreUtils.agentMode);

17
server/src/com/cloud/hypervisor/kvm/discoverer/LibvirtServerDiscoverer.java
View File

@ -62,6 +62,7 @@ import com.cloud.resource.ServerResource;
import com.cloud.resource.UnableDeleteHostException; import com.cloud.resource.UnableDeleteHostException;
import com.cloud.utils.PasswordGenerator; import com.cloud.utils.PasswordGenerator;
import com.cloud.utils.StringUtils; import com.cloud.utils.StringUtils;
import com.cloud.utils.exception.CloudRuntimeException;
import com.cloud.utils.ssh.SSHCmdHelper; import com.cloud.utils.ssh.SSHCmdHelper;
import com.trilead.ssh2.Connection; import com.trilead.ssh2.Connection;
@ -144,8 +145,7 @@ public abstract class LibvirtServerDiscoverer extends DiscovererBase implements
} }
if (sshConnection == null) { if (sshConnection == null) {
s_logger.warn("Cannot secure agent communication because ssh connection is invalid for host ip=" + agentIp); throw new CloudRuntimeException("Cannot secure agent communication because ssh connection is invalid for host ip=" + agentIp);
return;
} }
Integer validityPeriod = CAManager.CertValidityPeriod.value(); Integer validityPeriod = CAManager.CertValidityPeriod.value();
@ -154,7 +154,7 @@ public abstract class LibvirtServerDiscoverer extends DiscovererBase implements
} }
final SSHCmdHelper.SSHCmdResult keystoreSetupResult = SSHCmdHelper.sshExecuteCmdWithResult(sshConnection, final SSHCmdHelper.SSHCmdResult keystoreSetupResult = SSHCmdHelper.sshExecuteCmdWithResult(sshConnection,
String.format("/usr/share/cloudstack-common/scripts/util/%s " + String.format("sudo /usr/share/cloudstack-common/scripts/util/%s " +
"/etc/cloudstack/agent/agent.properties " + "/etc/cloudstack/agent/agent.properties " +
"/etc/cloudstack/agent/%s " + "/etc/cloudstack/agent/%s " +
"%s %d " + "%s %d " +
@ -166,19 +166,17 @@ public abstract class LibvirtServerDiscoverer extends DiscovererBase implements
KeyStoreUtils.defaultCsrFile)); KeyStoreUtils.defaultCsrFile));
if (!keystoreSetupResult.isSuccess()) { if (!keystoreSetupResult.isSuccess()) {
s_logger.error("Failing, the keystore setup script failed execution on the KVM host: " + agentIp); throw new CloudRuntimeException("Failed to setup keystore on the KVM host: " + agentIp);
return;
} }
final Certificate certificate = caManager.issueCertificate(keystoreSetupResult.getStdOut(), Collections.singletonList(agentHostname), Collections.singletonList(agentIp), null, null); final Certificate certificate = caManager.issueCertificate(keystoreSetupResult.getStdOut(), Collections.singletonList(agentHostname), Collections.singletonList(agentIp), null, null);
if (certificate == null || certificate.getClientCertificate() == null) { if (certificate == null || certificate.getClientCertificate() == null) {
s_logger.error("Failing, the configured CA plugin failed to issue certificates for KVM host agent: " + agentIp); throw new CloudRuntimeException("Failed to issue certificates for KVM host agent: " + agentIp);
return;
} }
final SetupCertificateCommand certificateCommand = new SetupCertificateCommand(certificate); final SetupCertificateCommand certificateCommand = new SetupCertificateCommand(certificate);
final SSHCmdHelper.SSHCmdResult setupCertResult = SSHCmdHelper.sshExecuteCmdWithResult(sshConnection, final SSHCmdHelper.SSHCmdResult setupCertResult = SSHCmdHelper.sshExecuteCmdWithResult(sshConnection,
String.format("/usr/share/cloudstack-common/scripts/util/%s " + String.format("sudo /usr/share/cloudstack-common/scripts/util/%s " +
"/etc/cloudstack/agent/agent.properties " + "/etc/cloudstack/agent/agent.properties " +
"/etc/cloudstack/agent/%s %s " + "/etc/cloudstack/agent/%s %s " +
"/etc/cloudstack/agent/%s \"%s\" " + "/etc/cloudstack/agent/%s \"%s\" " +
@ -195,8 +193,7 @@ public abstract class LibvirtServerDiscoverer extends DiscovererBase implements
certificateCommand.getEncodedPrivateKey())); certificateCommand.getEncodedPrivateKey()));
if (setupCertResult != null && !setupCertResult.isSuccess()) { if (setupCertResult != null && !setupCertResult.isSuccess()) {
s_logger.error("Failed to setup certificate in the KVM agent's keystore file, please configure manually!"); throw new CloudRuntimeException("Failed to setup certificate in the KVM agent's keystore file, please see logs and configure manually!");
return;
} }
if (s_logger.isDebugEnabled()) { if (s_logger.isDebugEnabled()) {