Skip to content

[release-4.6] Bug 1901187: templates: Disable SSH keys lookup from authorized_keys.d on FCOS#2245

Closed
openshift-cherrypick-robot wants to merge 1 commit intoopenshift:release-4.6from
openshift-cherrypick-robot:cherry-pick-2087-to-release-4.6
Closed

[release-4.6] Bug 1901187: templates: Disable SSH keys lookup from authorized_keys.d on FCOS#2245
openshift-cherrypick-robot wants to merge 1 commit intoopenshift:release-4.6from
openshift-cherrypick-robot:cherry-pick-2087-to-release-4.6

Conversation

@openshift-cherrypick-robot
Copy link
Copy Markdown

@openshift-cherrypick-robot openshift-cherrypick-robot commented Nov 19, 2020

This is an automated cherry-pick of #2087

/assign LorbusChris

@LorbusChris
templates: Disable SSH keys lookup from authorized_keys.d
3ee1b03 
On FCOS, this sshd config dropin ensures that only SSH keys from the
`/home/core/.ssh/authorized_keys` file are picked up, and not ones
present in the `/home/core/.ssh/authorized_keys.d/` directory,
which might be written by Ignition and/or Afterburn.

On RHCOS this is a no-op, as it already looks up SSH keys from the
authorized_keys file only.
@openshift-cherrypick-robot openshift-cherrypick-robot mentioned this pull request Nov 19, 2020
Merged
@openshift-ci-robot
Copy link
Copy Markdown
Contributor

openshift-ci-robot commented Nov 19, 2020

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: openshift-cherrypick-robot
To complete the pull request process, please assign sinnykumari after the PR has been reviewed.
You can assign the PR to them by writing /assign @sinnykumari in a comment when ready.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@kikisdeliveryservice kikisdeliveryservice added the 4.6 Work targeted for 4.6 label Nov 19, 2020
@openshift-merge-robot
Copy link
Copy Markdown
Contributor

openshift-merge-robot commented Nov 19, 2020

@openshift-cherrypick-robot: The following tests failed, say /retest to rerun all failed tests:

Test name Commit Details Rerun command
ci/prow/e2e-aws-workers-rhel7 3ee1b03 link /test e2e-aws-workers-rhel7
ci/prow/okd-e2e-gcp-op 3ee1b03 link /test okd-e2e-gcp-op
ci/prow/okd-e2e-upgrade 3ee1b03 link /test okd-e2e-upgrade
ci/prow/okd-e2e-aws 3ee1b03 link /test okd-e2e-aws

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@LorbusChris
Copy link
Copy Markdown
Contributor

LorbusChris commented Nov 24, 2020

/title Bug 1901187: [release-4.6] templates: Disable SSH keys lookup from authorized_keys.d on FCOS

@LorbusChris
Copy link
Copy Markdown
Contributor

LorbusChris commented Nov 24, 2020

/retitle Bug 1901187: [release-4.6] templates: Disable SSH keys lookup from authorized_keys.d on FCOS

@openshift-ci-robot openshift-ci-robot changed the title [release-4.6] templates: Disable SSH keys lookup from authorized_keys.d on FCOS Bug 1901187: [release-4.6] templates: Disable SSH keys lookup from authorized_keys.d on FCOS Nov 24, 2020
@openshift-ci-robot openshift-ci-robot added the bugzilla/severity-unspecified Referenced Bugzilla bug's severity is unspecified for the PR. label Nov 24, 2020
@openshift-ci-robot
Copy link
Copy Markdown
Contributor

openshift-ci-robot commented Nov 24, 2020

@openshift-cherrypick-robot: This pull request references Bugzilla bug 1901187, which is invalid:

  • expected Bugzilla bug 1901187 to depend on a bug targeting a release in 4.7.0 and in one of the following states: VERIFIED, RELEASE_PENDING, CLOSED (ERRATA), but no dependents were found

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

Bug 1901187: [release-4.6] templates: Disable SSH keys lookup from authorized_keys.d on FCOS

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@openshift-ci-robot openshift-ci-robot added the bugzilla/invalid-bug Indicates that a referenced Bugzilla bug is invalid for the branch this PR is targeting. label Nov 24, 2020
@LorbusChris LorbusChris mentioned this pull request Nov 24, 2020
Closed
6 tasks
@LorbusChris
Copy link
Copy Markdown
Contributor

LorbusChris commented Nov 25, 2020

/retitle [release-4.6] Bug 1901187: templates: Disable SSH keys lookup from authorized_keys.d on FCOS

@openshift-ci-robot openshift-ci-robot changed the title Bug 1901187: [release-4.6] templates: Disable SSH keys lookup from authorized_keys.d on FCOS [release-4.6] Bug 1901187: templates: Disable SSH keys lookup from authorized_keys.d on FCOS Nov 25, 2020
@LorbusChris
Copy link
Copy Markdown
Contributor

LorbusChris commented Dec 3, 2020

/hold

@openshift-ci-robot openshift-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Dec 3, 2020
@LorbusChris
Copy link
Copy Markdown
Contributor

LorbusChris commented Dec 4, 2020

/hold cancel

@openshift-ci-robot openshift-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Dec 4, 2020
@vrutkovs
Copy link
Copy Markdown
Contributor

vrutkovs commented Jan 21, 2021

/hold

This breaks ssh attempts on 4.6:

Jan 21 10:55:36 ip-10-0-137-119 sshd[130647]: error: AuthorizedKeysCommand path is not absolute
Jan 21 10:55:36 ip-10-0-137-119 sshd[130647]: Connection closed by authenticating user core 10.0.188.12 port 41306 [preauth]

@openshift-ci-robot openshift-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jan 21, 2021
@openshift-bot
Copy link
Copy Markdown
Contributor

openshift-bot commented Apr 21, 2021

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

@openshift-ci-robot openshift-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Apr 21, 2021
@LorbusChris
Copy link
Copy Markdown
Contributor

LorbusChris commented Apr 28, 2021

/close

@openshift-ci-robot
Copy link
Copy Markdown
Contributor

openshift-ci-robot commented Apr 28, 2021

@LorbusChris: Closed this PR.

Details

In response to this:

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@openshift-ci-robot
Copy link
Copy Markdown
Contributor

openshift-ci-robot commented Apr 28, 2021

@openshift-cherrypick-robot: This pull request references Bugzilla bug 1901187. The bug has been updated to no longer refer to the pull request using the external bug tracker. All external bug links have been closed. The bug has been moved to the NEW state.

Details

In response to this:

[release-4.6] Bug 1901187: templates: Disable SSH keys lookup from authorized_keys.d on FCOS

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ashcrow ashcrow Awaiting requested review from ashcrow

@runcom runcom Awaiting requested review from runcom

Assignees

@LorbusChris LorbusChris

Labels

4.6 Work targeted for 4.6 bugzilla/invalid-bug Indicates that a referenced Bugzilla bug is invalid for the branch this PR is targeting. bugzilla/severity-unspecified Referenced Bugzilla bug's severity is unspecified for the PR. do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

7 participants

@openshift-cherrypick-robot @openshift-ci-robot @openshift-merge-robot @LorbusChris @vrutkovs @openshift-bot @kikisdeliveryservice