Changeset 2045 in ProjectBuilder for devel/pb

Timestamp:

Feb 19, 2016, 2:52:23 AM (8 years ago)

Author:

Bruno Cornec

Message:

• pb now scans VM or RM to detect whether they support ECDSA. If yes, then use the pb_ecdsa key file, if not, back to DSA. But that forces also to change the cleanup of the authorized_keys file on the VM|RM to be done once the VM is launched to have the scan working.

File:

• devel/pb/bin/pb (modified) (6 diffs)

devel/pb/bin/pb

@@ -2538 +2538 @@
         $cptarget = "CPAN";
     } else {
-        my $keyfile = pb_ssh_get(0);
+        my $keyfile = pb_ssh_get(0,$mac,$nport);
         my $keyopt = "";
         $keyopt = "-i $keyfile" if ((defined $keyfile) && ($cmt !~ /Packages/));
@@ -3569 +3569 @@
         print SCRIPT "pb_system('rm -f /dev/null; mknod /dev/null c 1 3; chmod 777 /dev/null');\n" unless (($pbos->{'name'} =~ /^redhat/) && ($pbos->{'version'} =~ /^6/));
     } elsif ($vtype =~ /(v|r)m/) {
-        my $keyfile;
-        my ($zero0,$zero1,$zero2);
-    
-        # Prepare the key to be used and transfered remotely
-        $keyfile = pb_ssh_get(1);
-    
-        # Store the pub key part in a variable
-        open(FILE,"$keyfile.pub") || die "Unable to open $keyfile.pub";
-        ($zero0,$zero1,$zero2) = split(/ /,<FILE>);
-        close(FILE);
-    
-        $key = "\Q$zero1";
+        # Nothing to do now.
+        my $useless = 0;
     } else {
         die "Unknown virtual type $vtype";
     }
 
-    if ($vtype =~ /(v|r)m/) {
-        print SCRIPT << 'EOF';
-# Removes duplicate in .ssh/authorized_keys of our key if needed
-#
-my $file1="$ENV{'HOME'}/.ssh/authorized_keys";
-open(PBFILE,$file1) || die "Unable to open $file1";
-open(PBOUT,"> $file1.new") || die "Unable to open $file1.new";
-my $count = 0;
-while (<PBFILE>) {
-
-EOF
-        print SCRIPT << "EOF";
-    if (/ $key /) {
-        \$count++;
-    }
-print PBOUT \$_ if ((\$count <= 1) || (\$_ !~ / $key /));
-}
-close(PBFILE);
-close(PBOUT);
-rename("\$file1.new",\$file1);
-chmod 0600,\$file1;
-
-EOF
-    }
     print SCRIPT << 'EOF';
 
@@ -4508 +4474 @@
 
 my $create = shift || 0;    # Do not create keys by default
+my $target = shift || "localhost";
+my $nport = shift || "22";
 
 my ($pbagent) = pb_conf_get_if("pbusesshagent");
@@ -4515 +4483 @@
 # Check the SSH environment
 my $keyfile = undef;
+
+# Check whether ecdsa is accepted by the remote host
+my $ecdsa = 0;
+open(SCAN,"ssh-keyscan -p $nport -t ecdsa $target|") || pb_log(0,"Unable to check ECDSA support for $target");
+while(<SCAN>) {
+    $ecdsa = 1 if ($_ =~ /ecdsa-/);
+}
+close(SCAN);
 
 # We have specific keys by default
@@ -4530 +4506 @@
 $keyfile = "$ENV{'HOME'}/.ssh/id_dsa" if (-s "$ENV{'HOME'}/.ssh/id_dsa");
 $keyfile = "$ENV{'HOME'}/.ssh/pb_dsa" if (-s "$ENV{'HOME'}/.ssh/pb_dsa");
-$keyfile = "$ENV{'HOME'}/.ssh/pb_ecdsa" if (-s "$ENV{'HOME'}/.ssh/pb_ecdsa");
+$keyfile = "$ENV{'HOME'}/.ssh/pb_ecdsa" if ((-s "$ENV{'HOME'}/.ssh/pb_ecdsa") && ($ecdsa != 0));
 die "Unable to find your public ssh key under $ENV{'HOME'}/.ssh" if (not defined $keyfile);
 return($keyfile);
@@ -4947 +4923 @@
 ($vmhost) = pb_conf_get($vtype."host");
 # Prepare the key to be used and transfered remotely
-$keyfile = pb_ssh_get(1);
+$keyfile = pb_ssh_get(1,$vmhost->{$ENV{'PBPROJ'}},$nport);
 
 # We call true to avoid problems if SELinux is not activated, but chcon is present and returns in that case 1
 pb_system("cat $keyfile.pub | ssh -q -o UserKnownHostsFile=/dev/null -p $nport -i $keyfile root\@$vmhost->{$ENV{'PBPROJ'}} \"mkdir -p .ssh ; chmod 700 .ssh ; cat >> .ssh/authorized_keys ; chmod 600 .ssh/authorized_keys ; if [ -x /usr/bin/chcon ]; then /usr/bin/chcon -Rt home_ssh_t .ssh 2> /dev/null; /bin/true; fi\"","Copying local keys to $vtype. This may require the root password");
 # once this is done, we can do what we need on the VM/RM remotely
+
+# in particular we can remove duplicate in .ssh/authorized_keys of our key if needed
+# Store the pub key part in a variable
+open(FILE,"$keyfile.pub") || die "Unable to open $keyfile.pub";
+my ($zero0,$zero1,$zero2) = split(/ /,<FILE>);
+close(FILE);
+my $key = "\Q$zero1";
+my $perls = "$ENV{'PBTMP'}/perls.$$";
+        
+open(FILE,"> $perls") || die "Unable to open $perls";
+print FILE << 'EOF';
+my $file1="$ENV{'HOME'}/.ssh/authorized_keys";
+open(PBFILE,$file1) || die "Unable to open $file1";
+open(PBOUT,"> $file1.new") || die "Unable to open $file1.new";
+my $count = 0;
+while (<PBFILE>) {
+EOF
+print FILE << "EOF";
+    if (/ $key /) {
+        \$count++;
+    }
+    print PBOUT \$_ if ((\$count <= 1) || (\$_ !~ / $key /));
+}
+close(PBFILE);
+close(PBOUT);
+rename("\$file1.new",\$file1);
+chmod 0600,\$file1;
+EOF
+close(FILE);
+pb_system("cat $perls | ssh -q -o UserKnownHostsFile=/dev/null -p $nport -i $keyfile root\@$vmhost->{$ENV{'PBPROJ'}} perl","","quiet");
 return;
 }