+
    i+              
         a  R  t-0 t R t^ RIt^ RIt^ RIt^ RIt^ RIt^ RIHtH	t	H
t
 ^ RIHtHtHtHt ^ RIHt ^ RIHt ^ RIHt ^ RIHtHt ^ RIHt R	R
R].R]R. /t] ^ k ]P8                  ! ]4      t. R!OtR.t Rt!Rt". t#] ^k / t$/ t%] FO  t&]$PO                  ]& R2]!]&,          R3]& R2]!]&,           R2R3]& R2]!]&,           R2R3/4       ]& R2]%]& R2&   KQ  	  Rt(R R lt)R R lt*R t+R"R R llt,R# )#zSSH: Configure SSH and SSH keysN)ListOptionalSequence)	lifecyclessh_utilsubputil)Cloud)Config)
MetaSchema)ALL_DISTROSug_util)PER_INSTANCEidcc_sshdistros	frequencyactivate_by_schema_keysed25519z/etc/ssh/ssh_host_%s_keyT_private  _public.pub  _certificatez	-cert.pubz;o=$(ssh-keygen -yf "%s") && echo "$o" root@localhost > "%s"c                (    V ^8  d   QhR\         RR/# )   keyfilereturnN)str)formats   "9/usr/lib/python3/dist-packages/cloudinit/config/cc_ssh.py__annotate__r"   =   s     !3 !3c !3d !3    c                P   Rp\         P                  ! 4       pV'       d    V\        P                  ! ^	^ 4      8  d   RpMRp\        P
                  ! R4      pVR8w  d   \        P                  ! V RV4       \        P                  ! W4       \        P                  ! V  R2V4       R# )a  
For fedora 37, centos 9 stream and below:
 - sshd version is earlier than version 9.
 - 'ssh_keys' group is present and owns the private keys.
 - private keys have permission 0o640.
For fedora 38, centos 10 stream and above:
 - ssh version is at least version 9.
 - 'ssh_keys' group is absent. 'root' group owns the keys.
 - private keys have permission 0o600, same as upstream.
Public keys in all cases have permission 0o644.
r   i  r   ssh_keysr   N)	r   get_opensshd_upstream_versionr   Versionr   get_group_idoschownchmod)r   permissions_publicssh_versionpermissions_privategids   &    r!   set_redhat_keyfile_permsr1   =   s     88:K{Y%6%6q!%<<
 $ $


J
'C
by
 	"c"HHW*HHy12r#   c          
      L    V ^8  d   QhR\         R\        R\        R\        RR/# )r   namecfgcloudargsr   N)r   r
   r	   list)r    s   "r!   r"   r"   a   s6     ]= ]= ]=6 ]=% ]=t ]= ]=r#   c           
      f   VP                  R R4      '       dU   \        P                  P                  RR4      p\        P                  ! V4       F  p \
        P                  ! V4       K  	  RV9   Ed   . pVR,          P                  4        F  w  rxV\        9  d;   \        P                  ! RV4      '       d   Rp	MRp	\        P                  R	W4       KJ  \        V,          ^ ,          p
\        V,          ^,          p\
        P                  ! WV4       R
V9   g   K  VP!                  R\#        V
4      34       K  	  V'       d   \$        P&                  ! V4       \(        P                  4        F  w  rWR,          9   g   WR,          9  d   K!  \        V,          ^ ,          \        V,          ^ ,          rRR\*        W3,          .p \
        P,                  ! RRR7      ;_uu_ 4        \.        P.                  ! VRR7       RRR4       \        P1                  RW4       K  	  EM\
        P2                  ! VR\4        4      p\
        P6                  ! 4       '       g   TMV Uu. uF  pV\8        9  g   K  VNK  	  upp\;        V4      P=                  V4      pV'       d&   \        P1                  RRP                  V4      4       V EF3  p\>        V,          p\        P                  PA                  V4      '       d   K8  \
        PB                  ! \        P                  PE                  V4      4       RRVRRRV.p\
        P,                  ! RRR7      ;_uu_ 4         \.        P.                  ! VRRR/R 7      w  pp\
        PF                  ! VR!R4      '       g4   \H        PJ                  PM                  \
        PN                  ! V4      4       VPP                  PR                  R"8X  d   \U        V4       RRR4       EK6  	  R&V9   dH   \
        P2                  ! VR&,          R'\`        4      p\
        PF                  ! VR&,          R(\b        4      pM\`        p\b        pV'       d)   \e        VR)7      p VPf                  Pi                  V4        \j        Pl                  ! WPP                  4      w  pp\j        Pn                  ! V4      w  pp \
        PF                  ! VR+R4      p!\
        Pp                  ! VR,\$        Pr                  4      p". p#\
        PF                  ! VR-R4      '       d   VPu                  4       ;'       g    . p#M\        P1                  R.4       R/V9   d   VR/,          p$V#Pw                  V$4       \y        V#VV!V"4       R#   \         d"    \
        P                  ! \        RT4        EKd  i ; i  + '       g   i     EL; i  \         d'    \
        P                  ! \        RT RT 24        EK  i ; iu upi   \.        PV                   d   p\
        PN                  ! TPX                  4      P[                  4       pTP\                  ^8X  dB   TP[                  4       P_                  R#4      '       d   \        P1                  R$T4        Rp?EL\
        P                  ! \        R%TT4        Rp?ELRp?ii ; i  + '       g   i     EK  ; i  \         d     \
        P                  ! \        R*4        ELvi ; i  \         d     \
        P                  ! \        R04        R# i ; i)1ssh_deletekeysTz	/etc/ssh/zssh_host_*key*zFailed deleting key file %sr%   z4^(ecdsa-sk|ed25519-sk)_(private|public|certificate)$unsupportedunrecognizedz Skipping %s ssh_keys entry: "%s"r   HostCertificateshz-xcz/etc/ssh)	recursiveF)captureNzGenerated a key for %s from %szFailed generating a key for z from ssh_genkeytypesz5skipping keys that are not supported in fips mode: %s,z
ssh-keygenz-tz-N z-fLANGC)r?   
update_envssh_quiet_keygenredhatzunknown keyz!ssh-keygen: unknown key type '%s'z(Failed generating key type %s to file %sssh_publish_hostkeys	blacklistenabled)rI   zPublishing host keys failed!disable_rootdisable_root_optsallow_public_ssh_keyszSSkipping import of publish SSH keys per config setting: allow_public_ssh_keys=Falsessh_authorized_keysz Applying SSH credentials failed!)=getr*   pathjoinglobr   del_file	ExceptionlogexcLOGitemsCONFIG_KEY_TO_FILErematchwarning
write_fileappendr   r   append_ssh_configPRIV_TO_PUBKEY_GEN_TPLSeLinuxGuardr   debugget_cfg_option_listGENERATE_KEY_NAMESfips_enabledFIPS_UNSUPPORTED_KEY_NAMESset
differenceKEY_FILE_TPLexists
ensure_dirdirnameget_cfg_option_boolsysstdoutwritedecode_binarydistroosfamilyr1   ProcessExecutionErrorstderrlower	exit_code
startswithHOST_KEY_PUBLISH_BLACKLISTPUBLISH_HOST_KEYSget_public_host_keys
datasourcepublish_host_keysr   normalize_users_groupsextract_defaultget_cfg_option_strDISABLE_USER_OPTSget_public_ssh_keysextendapply_credentials)%r3   r4   r5   r6   key_pthfcert_configkeyvalreasontgt_fn	tgt_permsprivate_typepublic_typeprivate_filepublic_filecmdgenkeysnames	key_namesskipped_keyskeytyper   outerrehost_key_blacklistpublish_hostkeyshostkeysusers_groupsuser_user_configrK   rL   keyscfgkeyss%   &&&&                                 r!   handler   a   s    ww&&'',,{,<=7#ACa  $ SJ--/HC,,88JC  +F+F>L',Q/F*3/2IOOF3$""$5s6{#CD 0" &&{3)4):):)<%L:.:6"<03";/2 & |.I IJC&&zTBBIIc51 C		4k *=4 **"$6
 $$&&  %$E :: $ 	 7|..y9IIG&
 !G"g.Gww~~g&&OOBGGOOG45wb$HC "":>>#yyTvsm HC  33/  

((););C)@A||,,809 ?> !D $!55&'&

  33&'4E
 8,'2DE	=..x8="99#||L&66u=|//^TJ 33$h&@&@
 ##C)@$GG,,.44"DII>
 !C'/0GKK $l4EFg  CC!>BBCN CBB
  2"m6,9 B 11 ,,QXX6<<>C{{a'CIIK,B,B%- - 		"EwOOF##	  ?>>V  	=KK;<	=2  =C;<=s   V W,V7W&W?8W?[ BX1[ B0\ >A\ 'V43V47W	W,W<;W<[	A#Z<	=Z<	[Z<	6[<[	[[&\\&\0/\0c                     \        V 4      p V'       d   \        P                  ! W4       V'       d0   V'       g   R pVP                  RV4      pVP                  RR4      pMRp\        P                  ! V RVR7       R# )NONEz$USERz$DISABLE_USERrootrB   )optionsN)rg   r   setup_user_keysreplace)r   r   rK   rL   
key_prefixs   &&&& r!   r   r     sb    t9D  ,D&..w=
''@

T6:>r#   c                P    V ^8  d   QhR\         \        \        ,          ,          /# )r   rI   )r   r   r   )r    s   "r!   r"   r"     s      HXc]$; r#   c                   \         : R2p. p. pV '       d   V  Uu. uF  qAV3,          NK  	  pp\        P                  ! VR,          4       Uu. uF  pWS9  g   K  VNK  	  ppV Ff  p\        P                  ! V4      pVP	                  4       p	V	'       g   K3  \        V	4      ^8  g   KE  VP                  \        V	R,          4      4       Kh  	  V# u upi u upi )a  Read host keys from /etc/ssh/*.pub files and return them as a list.

@param blacklist: List of key types to ignore. e.g. ['rsa']
@returns: List of keys, each formatted as a two-element tuple.
    e.g. [('ssh-rsa', 'AAAAB3Nz...'), ('ssh-ed25519', 'AAAAC3Nx...')]
r   :Nr   N)*)ri   rR   r   load_text_filesplitlenr]   tuple)
rI   public_key_file_tmplkey_listblacklist_fileskey_typehostfile	file_list	file_namefile_contentskey_datas
   &         r!   r{   r{     s     (45HO @I
?H8H;..y 	 
 		"6"?@@H* 	@   	++I6 &&(8H)OOE(2,/0	 
 O#
s   CCCc                ~    V ^8  d   Qh/ ^ \         9   d
   \        ;R&   ^\         9   d   \        \        ,          ;R&   # )r   metary   )__conditional_annotations__r   r   r   )r    s   "r!   r"   r"      s6     % %* j + &H + *DI *I &r#   )rsaecdsar   )N).r   __doc__rR   loggingr*   rY   rn   typingr   r   r   	cloudinitr   r   r   r   cloudinit.cloudr	   cloudinit.configr
   cloudinit.config.schemar   cloudinit.distrosr   r   cloudinit.settingsr   r   	getLogger__name__rV   rd   rf   ri   rz   ry   rX   r_   kupdater`   r1   r   r   r{   r"   )r   s   @r!   <module>r      sA   &   	 	 
 + + 5 5 ! # . 2 + 	(}r	  !0 '[ ) (*  * 	AcN\A-u5cM|a/05u=cL1$4#5Y!? G	
 &'Cw-K1#X 
 L!3H]=@?" r#   