Differential D530

remote_exec: make keys from ~/.ssh work automatically
ClosedPublic
Actions

Authored by kparal on Aug 25 2015, 3:14 PM.

Details

Reviewers
lbrabec
tflink
mkrizek
jskladan
Commits
rLTRNf54966c27352: remote_exec: make keys from ~/.ssh work automatically
Summary

If we hardcode some file name in our config file as ssh_privkey, it
crashes hard when the file does not exist, and also it precludes
paramiko's automatic ssh key lookup to kick in. We should use empty path
by default, so that users can store their keys in ~/.ssh as they are
used to and everything just work automatically. If they need to store
the key elsewere, they can use --ssh-privkey on CLI or ssh_privkey in
config.

This resolves audit
https://phab.qadevel.cloud.fedoraproject.org/rLTRN82d0e32a8d69d561e78c5da65c14cc7f74814626
.

Test Plan

Tested manually, keys in ~/.ssh work perfectly now. You can also specify an external key, works.

Diff Detail

Repository
rLTRN libtaskotron
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.
kparal retitled this revision from to remote_exec: make keys from ~/.ssh work automatically.Aug 25 2015, 3:14 PM
kparal updated this object.
kparal edited the test plan for this revision. (Show Details)
kparal added reviewers: tflink, lbrabec, jskladan, mkrizek.
tflink accepted this revision.Aug 25 2015, 3:36 PM
This revision is now accepted and ready to land.Aug 25 2015, 3:36 PM
Closed by commit rLTRNf54966c27352: remote_exec: make keys from ~/.ssh work automatically (authored by kparal). · Explain WhyAug 26 2015, 8:15 AM
This revision was automatically updated to reflect the committed changes.

Revision Contents

Diff 1392

View Options

libtaskotron/config_defaults.py

Show First 20 Lines • Show All 81 Lines • ▼ Show 20 Line(s)31class Config(object):
82 82​
83 log_level_stream = 'INFO' #: 83​ log_level_stream = 'INFO' #:
84 log_level_file = 'DEBUG' #: 84​ log_level_file = 'DEBUG' #:
85 85​
86 log_file_enabled = False #: 86​ log_file_enabled = False #:
87 87​
88 fas_username = 'taskotron' #: 88​ fas_username = 'taskotron' #:
89 fas_password = 'password' #: 89​ fas_password = 'password' #:
90 ssh_privkey = 'conf/id_taskotron' #: 90​ ssh_privkey = '' #:
91 91​
92 def __str__(self): 92​ def __str__(self):
93 ''' Make this object more readable when printing ''' 93​ ''' Make this object more readable when printing '''
94 return '<%s: %s>' % (self.__class__.__name__, 94​ return '<%s: %s>' % (self.__class__.__name__,
95 pprint.pformat(vars(self))) 95​ pprint.pformat(vars(self)))
96 96​
97 97​
98class ProductionConfig(Config): 98​class ProductionConfig(Config):
Show All 30 Lines
View Options

libtaskotron/remote_exec.py

Show First 20 Lines • Show All 63 Lines • ▼ Show 20 Line(s)47class RemoteExec(object):
64 def __exit__(self, type, value, traceback): 64​ def __exit__(self, type, value, traceback):
65 self.close() 65​ self.close()
66 66​
67 def __str__(self): 67​ def __str__(self):
68 return '<%s: %s@%s:%s>' % (self.__class__.__name__, self.username, self.hostname, self.port) 68​ return '<%s: %s@%s:%s>' % (self.__class__.__name__, self.username, self.hostname, self.port)
69 69​
70 def connect(self): 70​ def connect(self):
71 '''Connect to a machine over ssh. Open sftp channel and, if applicable, file that 71​ '''Connect to a machine over ssh. Open sftp channel and, if applicable, file that
72 stdout/err from the machine will be saved to.''' 72​ stdout/err from the machine will be saved to.
73​
74​ :raise TaskotronRemoteError: when the connection does not succeed'''
73 75​
74 self.ssh = paramiko.SSHClient() 76​ self.ssh = paramiko.SSHClient()
75 # accept unknown hosts 77​ # accept unknown hosts
76 self.ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy()) 78​ self.ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
77 79​
78 log.debug('Connecting to remote host: %s:%s as %s', self.hostname, self.port, self.username) 80​ log.debug('Connecting to remote host: %s:%s as %s', self.hostname, self.port, self.username)
79 81​
80 try: 82​ try:
81 self.ssh.connect(self.hostname, 83​ self.ssh.connect(self.hostname,
82 port=self.port, 84​ port=self.port,
83 username=self.username, 85​ username=self.username,
84 key_filename=self.key_filename) 86​ # we use empty string by default (no special key), but paramiko
87​ # requires receiving None in that case
88​ key_filename=self.key_filename or None)
85 89​
86 self.sftp = self.ssh.open_sftp() 90​ self.sftp = self.ssh.open_sftp()
87 91​
88 if self.stdio_filename is not None: 92​ if self.stdio_filename is not None:
89 try: 93​ try:
90 f = open(self.stdio_filename, 'w') 94​ f = open(self.stdio_filename, 'w')
91 self.outstream.add(f) 95​ self.outstream.add(f)
92 except IOError, e: 96​ except IOError, e:
93 log.warning('Could not open %s. Falling back to writing vm\'s output to stdout only.', 97​ log.warning('Could not open %s. Falling back to writing vm\'s output to stdout only.',
94 self.stdio_filename) 98​ self.stdio_filename)
95 99​
96 except paramiko.BadHostKeyException, e: 100​ except paramiko.BadHostKeyException, e:
97 raise exc.TaskotronRemoteError('Server\'s (%s@%s:%s) hostkey could not be verified: %s' % 101​ raise exc.TaskotronRemoteError('Server\'s (%s@%s:%s) hostkey could not be verified: %s' %
98 (self.username, self.hostname, self.port, str(e))) 102​ (self.username, self.hostname, self.port, str(e)))
99 except paramiko.AuthenticationException, e: 103​ except paramiko.AuthenticationException, e:
100 raise exc.TaskotronRemoteError('Authentication to %s@%s:%s failed: %s' % 104​ raise exc.TaskotronRemoteError('Authentication to %s@%s:%s failed: %s' %
101 (self.username, self.hostname, self.port, str(e))) 105​ (self.username, self.hostname, self.port, str(e)))
102 except (paramiko.SSHException, socket.error), e: 106​ except (paramiko.SSHException, socket.error), e:
103 raise exc.TaskotronRemoteError('Could not connect to %s@%s:%s: %s' % 107​ raise exc.TaskotronRemoteError('Could not connect to %s@%s:%s: %s' %
104 (self.username, self.hostname, self.port, str(e))) 108​ (self.username, self.hostname, self.port, str(e)))
109​ except IOError as e:
110​ # let's hope this does not occur in more situations
111​ raise exc.TaskotronRemoteError("The private key '%s' could not be read: %s" %
112​ (self.key_filename, str(e)))
105 113​
106 def close(self): 114​ def close(self):
107 '''Close open connections and files.''' 115​ '''Close open connections and files.'''
108 116​
109 self.outstream.close() 117​ self.outstream.close()
110 self.sftp.close() 118​ self.sftp.close()
111 self.ssh.close() 119​ self.ssh.close()
112 120​
▲ Show 20 Lines • Show All 189 Lines • Show Last 20 Lines