
    x[h+              
          % S r SSKrSSKrSSKrSSKrSSKrSSKJrJrJ	r	  SSK
JrJrJrJr  SSKJr  SSKJr  SSKJr  SSKJrJr  SS	KJr  S
\/\/ S.r\\S'   \R8                  " \5      r/ SQrS/r Sr!Sr"/ r#\\$   \S'   0 r%0 r&\ HC  r'\%RQ                  \' S3\!\'-  S4\' S3\!\'-   S3S4\' S3\!\'-   S3S405        \' S3\&\' S3'   ME     Sr)S\$SS4S jr*S\$S\S\S \+SS4
S! jr,S" r-S%S#\\	\$      4S$ jjr.g)&zSSH: Configure SSH and SSH keys    N)ListOptionalSequence)	lifecyclessh_utilsubputil)Cloud)Config)
MetaSchema)ALL_DISTROSug_util)PER_INSTANCEcc_ssh)iddistros	frequencyactivate_by_schema_keysmeta)rsaecdsaed25519r   z/etc/ssh/ssh_host_%s_keyTHOST_KEY_PUBLISH_BLACKLIST_private  _public.pub  _certificatez	-cert.pubz;o=$(ssh-keygen -yf "%s") && echo "$o" root@localhost > "%s"keyfilereturnc                 H   Sn[         R                  " 5       nU(       a  U[        R                  " SS5      :  a  SnOSn[        R
                  " S5      nUS:w  a  [        R                  " U SU5        [        R                  " X5        [        R                  " U  S3U5        g	)
a  
For fedora 37, centos 9 stream and below:
 - sshd version is earlier than version 9.
 - 'ssh_keys' group is present and owns the private keys.
 - private keys have permission 0o640.
For fedora 38, centos 10 stream and above:
 - ssh version is atleast version 9.
 - 'ssh_keys' group is absent. 'root' group owns the keys.
 - private keys have permission 0o600, same as upstream.
Public keys in all cases have permission 0o644.
r   	   r   i  r   ssh_keysr   N)	r   get_opensshd_upstream_versionr   Versionr	   get_group_idoschownchmod)r    permissions_publicssh_versionpermissions_privategids        9/usr/lib/python3/dist-packages/cloudinit/config/cc_ssh.pyset_redhat_keyfile_permsr1   =   s     88:K{Y%6%6q!%<<
 $ $


J
'C
by
 	"c"HHW*HHy12    namecfgcloudargsc           	      j   UR                  SS5      (       aT  [        R                  R                  SS5      n[        R                  " U5       H  n [
        R                  " U5        M     SU;   Gap  / nUS   R                  5        H  u  pxU[        ;  a9  [        R                  " SU5      (       a  Sn	OS	n	[        R                  S
X5        MH  [        U   S   n
[        U   S   n[
        R                  " XU5        SU;   d  M  UR!                  S[#        U
5      45        M     U(       a  [$        R&                  " U5        [(        R                  5        H  u  pXS   ;   d  XS   ;  a  M  [        U   S   [        U   S   pSS[*        X4-  /n [
        R,                  " SSS9   [.        R.                  " USS9  S S S 5        [        R1                  SX5        M     GO[
        R2                  " US[4        5      n[
        R6                  " 5       (       d  UOU Vs/ s H  nU[8        ;  d  M  UPM     snn[;        U5      R=                  U5      nU(       a%  [        R1                  SSR                  U5      5        U GH  n[>        U-  n[        R                  RA                  U5      (       a  M3  [
        RB                  " [        R                  RE                  U5      5        SSUSSSU/n[
        R,                  " SSS9    [.        R.                  " USS S!0S"9u  nn[
        RF                  " US#S5      (       d3  [H        RJ                  RM                  [
        RN                  " U5      5        URP                  RR                  S$:X  a  [U        U5        S S S 5        GM!     S(U;   a?  [
        R2                  " US(   S)[`        5      n[
        RF                  " US(   S*[b        5      nO[`        n[b        nU(       a%  [e        US+9n URf                  Ri                  U5         [j        Rl                  " XRP                  5      u  nn[j        Rn                  " U5      u  nn [
        RF                  " US-S5      n![
        Rp                  " US.[$        Rr                  5      n"/ n#[
        RF                  " US/S5      (       a  URu                  5       =(       d    / n#O[        R1                  S05        S1U;   a  US1   n$U#Rw                  U$5        [y        U#UU!U"5        g ! [         a!    [
        R                  " [        SU5         GM  f = f! , (       d  f       GN= f! [         a&    [
        R                  " [        SU SU 35         GM-  f = fs  snf ! [.        RV                   a  n[
        RN                  " URX                  5      R[                  5       nUR\                  S:X  a@  UR[                  5       R_                  S%5      (       a  [        R1                  S&U5         S nAGN[
        R                  " [        S'UU5         S nAGNS nAff = f! , (       d  f       GM  = f! [         a    [
        R                  " [        S,5         GNdf = f! [         a    [
        R                  " [        S25         g f = f)3Nssh_deletekeysTz	/etc/ssh/zssh_host_*key*zFailed deleting key file %sr$   z4^(ecdsa-sk|ed25519-sk)_(private|public|certificate)$unsupportedunrecognizedz Skipping %s ssh_keys entry: "%s"r      r   HostCertificateshz-xcz/etc/ssh)	recursiveF)capturezGenerated a key for %s from %szFailed generating a key for z from ssh_genkeytypesz5skipping keys that are not supported in fips mode: %s,z
ssh-keygenz-tz-N z-fLANGC)r?   
update_envssh_quiet_keygenredhatzunknown keyz!ssh-keygen: unknown key type '%s'z(Failed generating key type %s to file %sssh_publish_hostkeys	blacklistenabled)rI   zPublishing host keys failed!disable_rootdisable_root_optsallow_public_ssh_keyszSSkipping import of publish SSH keys per config setting: allow_public_ssh_keys=Falsessh_authorized_keysz Applying SSH credentials failed!)=getr)   pathjoinglobr	   del_file	ExceptionlogexcLOGitemsCONFIG_KEY_TO_FILErematchwarning
write_fileappendstrr   append_ssh_configPRIV_TO_PUBKEY_GEN_TPLSeLinuxGuardr   debugget_cfg_option_listGENERATE_KEY_NAMESfips_enabledFIPS_UNSUPPORTED_KEY_NAMESset
differenceKEY_FILE_TPLexists
ensure_dirdirnameget_cfg_option_boolsysstdoutwritedecode_binarydistroosfamilyr1   ProcessExecutionErrorstderrlower	exit_code
startswithr   PUBLISH_HOST_KEYSget_public_host_keys
datasourcepublish_host_keysr   normalize_users_groupsextract_defaultget_cfg_option_strDISABLE_USER_OPTSget_public_ssh_keysextendapply_credentials)%r3   r4   r5   r6   key_pthfcert_configkeyvalreasontgt_fn	tgt_permsprivate_typepublic_typeprivate_filepublic_filecmdgenkeysnames	key_namesskipped_keyskeytyper    outerrehost_key_blacklistpublish_hostkeyshostkeysusers_groupsuser_user_configrK   rL   keyscfgkeyss%                                        r0   handler   a   s    ww&&'',,{,<=7#ACa  $ SJ--/HC,,88JC  +F+F>L',Q/F*3/2IOOF3$""$5s6{#CD 0" &&{3)4):):)<%L:.:6"<03";/2 & |.I IJC&&zTBIIc51 C		4k *=4 **"$6
 $$&&  %$E :: $ 	 7|..y9IIG&
 !G"g.Gww~~g&&OOBGGOOG45wb$HC "":>#yyTvsm HC  33/  

((););C)@A||,,809 ?> !D $!55&'&

  33&'4E
 8,'2DE	=..x8="99#||L&66u=|//^TJ 33$h&@&@
 ##C)@$GG,,.4"DII>
 !C'/0GKK $l4EFg  CC!>BBCN CB
  2"m6,9 B 11 ,,QXX6<<>C{{a'CIIK,B,B%- - 		"EwOOF##	  ?>V  	=KK;<	=2  =C;<=s   TU)U?UV	1V	YBVY #C2Z
 &U U
U	U+VVY"A8YY Y=YYY
Y	%ZZ
%Z21Z2c                     [        U 5      n U(       a  [        R                  " X5        U(       a.  U(       d  SnUR                  SU5      nUR                  SS5      nOSn[        R                  " U SUS9  g )NNONEz$USERz$DISABLE_USERrootrB   )options)rh   r   setup_user_keysreplace)r   r   rK   rL   
key_prefixs        r0   r   r     sb    t9D  ,D&..w=
''@

T6:>r2   rI   c                    [         < S3n/ n/ nU (       a  U  Vs/ s H  oAU4-  PM
     nn[        R                  " US-  5       Vs/ s H  nXS;  d  M
  UPM     nnU H`  n[        R                  " U5      nUR	                  5       n	U	(       d  M2  [        U	5      S:  d  MC  UR                  [        U	SS 5      5        Mb     U$ s  snf s  snf )a  Read host keys from /etc/ssh/*.pub files and return them as a list.

@param blacklist: List of key types to ignore. e.g. ['rsa']
@returns: List of keys, each formatted as a two-element tuple.
    e.g. [('ssh-rsa', 'AAAAB3Nz...'), ('ssh-ed25519', 'AAAAC3Nx...')]
r   )*r;   N   )rj   rR   r	   load_text_filesplitlenr]   tuple)
rI   public_key_file_tmplkey_listblacklist_fileskey_typehostfile	file_list	file_namefile_contentskey_datas
             r0   r{   r{     s     (45HO @I
?H8H;.y 	 
 		"6"?@@H* 	@   	++I6 &&(8H)OOE(2A,/0	 
 O#
s   C	CC)N)/__doc__rR   loggingr)   rY   ro   typingr   r   r   	cloudinitr   r   r   r	   cloudinit.cloudr
   cloudinit.configr   cloudinit.config.schemar   cloudinit.distrosr   r   cloudinit.settingsr   r   __annotations__	getLogger__name__rV   re   rg   rj   rz   r   r^   rX   r`   kupdatera   r1   listr   r   r{    r2   r0   <module>r      s   &   	 	 
 + + 5 5 ! # . 2 + }!	j  !0 '[ ) (* DI * 	AcN\A-u5cM|a/05u=cL1$4#5Y!? G	
 &'Cw-K1#X 
 L!3c !3d !3H]= ]=6 ]=% ]=t ]= ]=@?"HXc]$; r2   