mirror of
https://github.com/apache/cloudstack.git
synced 2025-10-26 08:42:29 +01:00
daa183d9fd
* Add sshkey and password manager script that works with userdata server and configdrive * fix duplicated sshkey insertion * Add Alpine support * Force curl to fail on server errors * Keep user defined ssh-keys only
509 lines
15 KiB
Bash
509 lines
15 KiB
Bash
#!/usr/bin/env bash
|
|
|
|
# Licensed to the Apache Software Foundation (ASF) under one
|
|
# or more contributor license agreements. See the NOTICE file
|
|
# distributed with this work for additional information
|
|
# regarding copyright ownership. The ASF licenses this file
|
|
# to you under the Apache License, Version 2.0 (the
|
|
# "License"); you may not use this file except in compliance
|
|
# with the License. You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing,
|
|
# software distributed under the License is distributed on an
|
|
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
|
# KIND, either express or implied. See the License for the
|
|
# specific language governing permissions and limitations
|
|
# under the License.
|
|
|
|
username=root
|
|
userDataServerPort=8080
|
|
configDriveLabel=config-2
|
|
|
|
function findPrimaryNetwork(){
|
|
outputLog "Detecting primary network"
|
|
if command -v ip &> /dev/null
|
|
then
|
|
primaryNet=$(ip -o -4 route show to default | awk '{print $5}')
|
|
elif command -v netstat &> /dev/null
|
|
then
|
|
primaryNet=$(netstat -r4 | grep default | awk '{print $(NF)}')
|
|
elif command -v route &> /dev/null
|
|
then
|
|
primaryNet=$(route -4 2> /dev/null | grep default | awk '{print $(NF)}')
|
|
if [ -z "$primaryNet" ]
|
|
then
|
|
primaryNet=$(route get default 2> /dev/null | grep interface | tr -d ' ' | awk '{split($0,a,":"); print a[2]}')
|
|
fi
|
|
fi
|
|
if [ -z "$primaryNet" ]
|
|
then
|
|
outputLog "Could not find primary network"
|
|
return 1
|
|
fi
|
|
echo "$primaryNet"
|
|
return 0
|
|
}
|
|
|
|
function findUserDataServer(){
|
|
primaryNet=$1
|
|
outputLog "Trying to find userdata server"
|
|
if [ -z "$primaryNet" ]
|
|
then
|
|
outputLog "Unable to determine the userdata server, falling back to data-server"
|
|
echo "data-server"
|
|
return 0
|
|
fi
|
|
|
|
if command -v netplan &> /dev/null
|
|
then
|
|
outputLog "Operating System is using netplan"
|
|
|
|
userDataServer=$(netplan ip leases "$primaryNet" | grep SERVER_ADDRESS | awk '{split($0,a,"="); print a[2]}')
|
|
|
|
if [ -n "$userDataServer" ]
|
|
then
|
|
outputLog "Found userdata server IP $userDataServer in netplan config"
|
|
echo "$userDataServer"
|
|
return 0
|
|
fi
|
|
fi
|
|
|
|
if command -v nmcli &> /dev/null
|
|
then
|
|
outputLog "Operating System is using NetworkManager"
|
|
|
|
userDataServer=$(nmcli -t connection show "$(nmcli -t -f UUID,DEVICE connection | grep "$primaryNet" | awk '{split($0,a,":"); print a[1]}')" | grep next_server | tr -d ' ' |awk '{split($0,a,"="); print a[2]}')
|
|
|
|
if [ -n "$userDataServer" ]
|
|
then
|
|
outputLog "Found userdata server IP $userDataServer in NetworkManager config"
|
|
echo "$userDataServer"
|
|
return 0
|
|
fi
|
|
fi
|
|
|
|
if command -v wicked &> /dev/null
|
|
then
|
|
outputLog "Operating System is using wicked"
|
|
|
|
userDataServer=$(grep SERVERID /run/wicked/leaseinfo."$primaryNet"* | tr -d "'" | awk '{split($0,a,"="); print a[2]}')
|
|
|
|
if [ -n "$userDataServer" ]
|
|
then
|
|
outputLog "Found userdata server IP $userDataServer in wicked config"
|
|
echo "$userDataServer"
|
|
return 0
|
|
fi
|
|
fi
|
|
|
|
if command -v udhcpc &> /dev/null
|
|
then
|
|
outputLog "Operating System is using udhcpc"
|
|
|
|
userDataServer=$(< /run/dhcp-server-ip."$primaryNet")
|
|
|
|
if [ -n "$userDataServer" ]
|
|
then
|
|
outputLog "Found userdata server IP $userDataServer in udhcpc"
|
|
echo "$userDataServer"
|
|
return 0
|
|
fi
|
|
fi
|
|
|
|
outputLog "Searching for DHCP server in lease files"
|
|
|
|
primaryLease=$(
|
|
dhcpFolders="/var/lib/dhclient/* /var/lib/dhcp3/* /var/lib/dhcp/* /var/lib/NetworkManager/* /var/db/dhclient*"
|
|
for files in $dhcpFolders
|
|
do
|
|
if [ -e "$files" ]
|
|
then
|
|
< "$files" tr -d '\n' | sed 's/ //g ; s/lease {//g ; s/}/\n/g' | grep 'option routers'
|
|
fi
|
|
done
|
|
)
|
|
|
|
serverList=$(
|
|
IFS=$'\n'
|
|
for line in $(echo -e "$primaryLease")
|
|
do
|
|
splitLine=$(echo "$line" | sed -e 's/;/\n/g')
|
|
if date -j &> /dev/null
|
|
then
|
|
timestamp=$(date -j -f "%Y/%m/%d %H:%M:%S" "$(echo "$splitLine" | grep 'expire' | sed -r 's/.*expire [0-9]+ (.*)/\1/')" +"%s")
|
|
else
|
|
timestamp=$(date -d "$(echo "$splitLine" | grep 'expire' | sed -e 's/.*expire [0-9]\+ \(.*\)/\1/')" +"%s")
|
|
fi
|
|
interface=$(echo "$splitLine" | grep 'interface' | sed -e 's/.*interface "\(.*\)"/\1/')
|
|
server=$(echo "$splitLine" | grep 'dhcp-server-identifier' | sed -e 's/.*dhcp-server-identifier \(.*\)/\1/')
|
|
echo "$timestamp","$interface","$server"
|
|
done
|
|
)
|
|
|
|
userDataServer=$(echo "$serverList" | grep "$primaryNet" | sort -n | tail -1 | awk '{split($0,a,","); print a[3]}')
|
|
|
|
if [ -n "$userDataServer" ]
|
|
then
|
|
outputLog "Userdata server found: $userDataServer"
|
|
echo "$userDataServer"
|
|
return 0
|
|
fi
|
|
|
|
outputLog "Unable to determine the userdata server, falling back to data-server"
|
|
echo "data-server"
|
|
return 0
|
|
}
|
|
|
|
function getPasswordFromUserDataServer(){
|
|
userDataServer=$1
|
|
userDataServerPort=$2
|
|
outputLog "Sending request to userdata server at $userDataServer to get the password"
|
|
if ! response=$(curl --fail --silent --connect-timeout 20 --retry 3 --header "DomU_Request: send_my_password" http://"$userDataServer":"$userDataServerPort")
|
|
then
|
|
outputLog "Failed to send request to userdata server at $userDataServer"
|
|
return 4
|
|
fi
|
|
outputLog "Got response from userdata server at $userDataServer"
|
|
response=$(echo "$response" | tr -d '\r')
|
|
case $response in
|
|
"")
|
|
outputLog "Userdata server at $userDataServer did not have any password for the VM"
|
|
return 2
|
|
;;
|
|
"bad_request")
|
|
outputLog "VM sent an invalid request to userdata server at $userDataServer"
|
|
return 3
|
|
;;
|
|
"saved_password")
|
|
outputLog "VM has already saved a password from the userdata server at $userDataServer"
|
|
return 1
|
|
;;
|
|
*)
|
|
outputLog "VM got a valid password from server at $userDataServer"
|
|
echo "$response"
|
|
return 0
|
|
esac
|
|
}
|
|
|
|
function findHomeDirectory(){
|
|
username=$1
|
|
getent passwd "$username"|awk -F ":" '{print $6}'
|
|
}
|
|
|
|
function setPassword(){
|
|
username=$1
|
|
homeDir=$2
|
|
password=$3
|
|
if command -v md5sum &> /dev/null
|
|
then
|
|
newMd5=$(echo "$password" | md5sum | awk '{print $1}')
|
|
elif command -v md5 &> /dev/null
|
|
then
|
|
newMd5=$(echo "$password" | md5)
|
|
else
|
|
newMd5='N/A'
|
|
fi
|
|
if [ $newMd5 != 'N/A' ]
|
|
then
|
|
if [ -f "$homeDir"/.password.md5 ]
|
|
then
|
|
oldMd5=$(cat "$homeDir"/.password.md5)
|
|
fi
|
|
if [ "$newMd5" == "$oldMd5" ]
|
|
then
|
|
outputLog "There is no update of VM password"
|
|
return 0
|
|
fi
|
|
else
|
|
outputLog "Cannot determine change of password"
|
|
fi
|
|
outputLog "Changing password for user $username"
|
|
if command -v chpasswd &> /dev/null
|
|
then
|
|
echo "$username":"$password" | chpasswd
|
|
elif command -v usermod &> /dev/null && command -v mkpasswd &> /dev/null
|
|
then
|
|
usermod -p "$(mkpasswd -m SHA-512 "$password")" "$username"
|
|
elif command -v pw &> /dev/null
|
|
then
|
|
echo "$password" | pw mod user "$username" -h 0
|
|
else
|
|
outputLog "Failed to change password for user $username"
|
|
return 1
|
|
fi
|
|
outputLog "Successfully changed password for user $username"
|
|
if [ $newMd5 != 'N/A' ]
|
|
then
|
|
echo "$newMd5" > "$homeDir"/.password.md5
|
|
chmod 600 "$homeDir"/.password.md5
|
|
chown "$username": "$homeDir"/.password.md5
|
|
fi
|
|
return 0
|
|
}
|
|
|
|
function sendAckToUserDataServer(){
|
|
userDataServer=$1
|
|
userDataServerPort=$2
|
|
outputLog "Sending acknowledgment to userdata server at $userDataServer"
|
|
if ! curl --fail --silent --connect-timeout 20 --retry 3 --header "DomU_Request: saved_password" "$userDataServer":"$userDataServerPort" &> /dev/null
|
|
then
|
|
outputLog "Failed to sent acknowledgment to userdata server at $userDataServer"
|
|
return 1
|
|
fi
|
|
outputLog "Successfully sent acknowledgment to userdata server at $userDataServer"
|
|
return 0
|
|
}
|
|
|
|
function getPublicKeyFromUserDataServer(){
|
|
userDataServer=$1
|
|
outputLog "Sending request to userdata server at $userDataServer to get public key"
|
|
if ! reponse=$(curl --fail --silent --connect-timeout 20 --retry 3 http://"$userDataServer"/latest/public-keys)
|
|
then
|
|
outputLog "Failed to get public key from userdata server"
|
|
return 2
|
|
fi
|
|
outputLog "Got response from userdata server at $userDataServer"
|
|
if [ -z "$reponse" ]
|
|
then
|
|
outputLog "Did not receive any public keys from userdata server"
|
|
return 1
|
|
fi
|
|
outputLog "Successfully get public key from userdata server"
|
|
echo "$reponse"
|
|
return 0
|
|
}
|
|
|
|
function setPublicKey(){
|
|
username=$1
|
|
homeDir=$2
|
|
publicKey=$3
|
|
outputLog "Applying public key for $username"
|
|
sshDir=$homeDir/.ssh
|
|
authorizedKeysFile=$sshDir/authorized_keys
|
|
|
|
if [ ! -d "$sshDir" ]
|
|
then
|
|
outputLog ".ssh directory for $username not found, creating .ssh directory"
|
|
mkdir "$sshDir"
|
|
fi
|
|
|
|
if [ ! -f "$authorizedKeysFile" ]
|
|
then
|
|
outputLog "authorized_keys file for $username not found, creating authorized_keys file"
|
|
touch "$authorizedKeysFile"
|
|
fi
|
|
if grep "$(echo "$publicKey" | awk '{print $2}')" "$authorizedKeysFile" > /dev/null
|
|
then
|
|
outputLog "No need to update authorized_keys file"
|
|
return 0
|
|
fi
|
|
outputLog "Writing public key in authorized_keys file"
|
|
sed -i "/ cloudstack@apache.org$/d" "$authorizedKeysFile"
|
|
echo "$publicKey cloudstack@apache.org" >> "$authorizedKeysFile"
|
|
chmod 600 "$authorizedKeysFile"
|
|
chmod 700 "$sshDir"
|
|
chown -R "$username": "$sshDir"
|
|
which restorecon &> /dev/null && restorecon -R -v "$sshDir"
|
|
return 0
|
|
}
|
|
|
|
function findConfigDrive(){
|
|
configDriveLabel=$1
|
|
outputLog "Searching for ConfigDrive"
|
|
|
|
if [ -e /dev/disk/by-label/"$configDriveLabel" ]
|
|
then
|
|
outputLog "ConfigDrive found at /dev/disk/by-label/$configDriveLabel"
|
|
echo "/dev/disk/by-label/$configDriveLabel"
|
|
return 0
|
|
fi
|
|
|
|
if [ -e /dev/iso9660/"$configDriveLabel" ]
|
|
then
|
|
outputLog "ConfigDrive found at /dev/iso9660/$configDriveLabel"
|
|
echo "/dev/iso9660/$configDriveLabel"
|
|
return 0
|
|
fi
|
|
|
|
blockDevice=$(blkid -t LABEL="$configDriveLabel" /dev/hd? /dev/sd? /dev/xvd? /dev/vd? /dev/sr? -o device 2> /dev/null)
|
|
if [ -n "$blockDevice" ]
|
|
then
|
|
outputLog "ConfigDrive found at $blockDevice"
|
|
echo "$blockDevice"
|
|
return 0
|
|
fi
|
|
outputLog "ConfigDrive not found"
|
|
return 1
|
|
}
|
|
|
|
function mountConfigDrive(){
|
|
disk=$1
|
|
outputLog "Mounting ConfigDrive"
|
|
mountDir=$(mktemp -d)
|
|
if [ ! -e "$mountDir" ]
|
|
then
|
|
mkdir "$mountDir"
|
|
chmod 700 "$mountDir"
|
|
fi
|
|
|
|
mounted=0
|
|
if [ $mounted == 0 ] && mount -r "$disk" "$mountDir" &> /dev/null
|
|
then
|
|
mounted=1
|
|
fi
|
|
if [ $mounted == 0 ] && mount -r -t cd9660 "$disk" "$mountDir" &> /dev/null
|
|
then
|
|
mounted=1
|
|
fi
|
|
if [ $mounted == 0 ] && mount -r -t iso9660 "$disk" "$mountDir" &> /dev/null
|
|
then
|
|
mounted=1
|
|
fi
|
|
|
|
if [ $mounted == 1 ]
|
|
then
|
|
outputLog "$disk successfully mounted on $mountDir"
|
|
echo "$mountDir"
|
|
return 0
|
|
fi
|
|
|
|
outputLog "Failed mounting $disk on $mountDir"
|
|
rm -rf "$mountDir"
|
|
return 1
|
|
}
|
|
|
|
function unmountConfigDrive(){
|
|
mountDir=$1
|
|
outputLog "Unmounting ConfigDrive"
|
|
if ! umount "$mountDir"
|
|
then
|
|
outputLog "Failed unmounting $mountDir"
|
|
return 1
|
|
fi
|
|
rm -rf "$mountDir"
|
|
outputLog "Successfully unmount $mountDir"
|
|
return 0
|
|
}
|
|
|
|
function getPasswordFromConfigDrive(){
|
|
mountDir=$1
|
|
passwordFile=$mountDir/cloudstack/password/vm_password.txt
|
|
if [ ! -f "$passwordFile" ]
|
|
then
|
|
outputLog "Password file not found in ConfigDrivee"
|
|
return 3
|
|
fi
|
|
outputLog "Password file found in ConfigDrive"
|
|
content=$(< "$passwordFile" tr -d '\r')
|
|
|
|
case $content in
|
|
|
|
"")
|
|
outputLog "ConfigDrive did not have any password for the VM"
|
|
return 2
|
|
;;
|
|
|
|
"saved_password")
|
|
outputLog "VM has already saved a password"
|
|
return 1
|
|
;;
|
|
|
|
*)
|
|
outputLog "VM got a valid password"
|
|
echo "$content"
|
|
return 0
|
|
esac
|
|
}
|
|
|
|
function getPublicKeyFromConfigDrive() {
|
|
mountDir=$1
|
|
publicKeyFile=$mountDir/cloudstack/metadata/public-keys.txt
|
|
|
|
if [ ! -f "$publicKeyFile" ]
|
|
then
|
|
outputLog "Public key file not found in ConfigDrive"
|
|
return 2
|
|
fi
|
|
content=$(< "$publicKeyFile" tr -d '\r')
|
|
|
|
if [ -z "$content" ]
|
|
then
|
|
outputLog "Did not receive any public keys"
|
|
return 1
|
|
fi
|
|
echo "$content"
|
|
outputLog "Public key successfully received."
|
|
return 0
|
|
}
|
|
|
|
function outputLog() {
|
|
stderr=1
|
|
logger=1
|
|
message=$1
|
|
if [ $stderr == 1 ]
|
|
then
|
|
echo "Cloud Password Manager: $message" 1>&2
|
|
fi
|
|
if [ $logger == 1 ]
|
|
then
|
|
logger -t "Cloud Password Manager" "$message"
|
|
fi
|
|
}
|
|
|
|
publicKeyReceived=0
|
|
passwordReceived=0
|
|
dataSource=''
|
|
|
|
if disk=$(findConfigDrive "$configDriveLabel")
|
|
then
|
|
if mountDir=$(mountConfigDrive "$disk")
|
|
then
|
|
dataSource='ConfigDrive'
|
|
if publicKey=$(getPublicKeyFromConfigDrive "$mountDir")
|
|
then
|
|
publicKeyReceived=1
|
|
fi
|
|
if password=$(getPasswordFromConfigDrive "$mountDir")
|
|
then
|
|
passwordReceived=1
|
|
fi
|
|
unmountConfigDrive "$mountDir"
|
|
fi
|
|
fi
|
|
if [ $publicKeyReceived == 0 ] || [ $passwordReceived == 0 ]
|
|
then
|
|
primaryNet=$(findPrimaryNetwork)
|
|
userDataServer=$(findUserDataServer "$primaryNet")
|
|
if [ $publicKeyReceived == 0 ]
|
|
then
|
|
if publicKey=$(getPublicKeyFromUserDataServer "$userDataServer")
|
|
then
|
|
dataSource='UserDataServer'
|
|
publicKeyReceived=1
|
|
fi
|
|
fi
|
|
if [ $passwordReceived == 0 ]
|
|
then
|
|
if password=$(getPasswordFromUserDataServer "$userDataServer" "$userDataServerPort")
|
|
then
|
|
dataSource='UserDataServer'
|
|
passwordReceived=1
|
|
fi
|
|
fi
|
|
fi
|
|
homeDir=$(findHomeDirectory "$username")
|
|
if [ $passwordReceived == 1 ]
|
|
then
|
|
setPassword "$username" "$homeDir" "$password"
|
|
if [ $dataSource == 'UserDataServer' ]
|
|
then
|
|
sendAckToUserDataServer "$userDataServer" "$userDataServerPort"
|
|
fi
|
|
fi
|
|
if [ $publicKeyReceived == 1 ]
|
|
then
|
|
setPublicKey "$username" "$homeDir" "$publicKey"
|
|
fi
|