xCAT/xcat-core
2
0
Fork 0
mirror of https://github.com/xcat2/xcat-core.git synced 2026-10-20 22:55:40 +00:00
Code Issues Releases Wiki Activity

Merge pull request #7941 from VersatusHPC/refactor/r26-credential-reuse

Browse Source 
refactor(postscripts): share credential reply filtering and decoding
This commit is contained in:
Daniel Hilst
2026-10-16 21:25:48 -03:00
committed by GitHub
parent 43dee182ef 97fce5a590
commit 9b2c5569fd
7 changed files with 260 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/xcat_test.yml
+1 -1
View File
@@ -40,7 +40,7 @@ jobs:
sudo cp -R xCAT-test xCAT-server perl-xCAT xCAT "$workdir/"
status=0
sudo sh -c 'cd "$1" && bats xCAT-test/native/getinstdisk_selection.bats' sh "$workdir" || status=1
sudo sh -c 'cd "$1" && prove -v xCAT-test/native/getinstdisk_installer.t xCAT-test/native/enablekdump_per_node.t xCAT-test/native/sudoer_password_source.t' sh "$workdir" || status=1
sudo sh -c 'cd "$1" && prove -v xCAT-test/native/getinstdisk_installer.t xCAT-test/native/enablekdump_per_node.t xCAT-test/native/sudoer_password_source.t xCAT-test/native/remoteshell_credentials.t' sh "$workdir" || status=1
exit "$status"
- name: Prepare xCAT syslog directory
if: ${{ !cancelled() }}
xCAT-test/native/README.md
+9 -4
View File
@@ -144,8 +144,10 @@ Compressor and ctorrent fixtures record what nodes can download during the
pack, or fail on request. The image lock and the ilitefile query are test
doubles. This case does not boot the image.
The disk, kdump and sudoer cases require bats-core 1.4 or newer, Bubblewrap,
GNU timeout, diffutils, Capture::Tiny, File::Slurper and sudo's `visudo`.
The disk, kdump, sudoer and remoteshell cases require bats-core 1.4 or newer,
Bubblewrap, GNU timeout, diffutils, Capture::Tiny, File::Slurper and sudo's
`visudo`. The remoteshell case also needs `/usr/bin/openssl` and `ssh-keygen`
with DSA, RSA, ECDSA and Ed25519 support.
Sandbox commands have a 45-second limit. Enable Linux user namespaces.
Run the group as root because
the disk-selection case creates dummy block-device entries:
@@ -154,7 +156,8 @@ the disk-selection case creates dummy block-device entries:
sudo bats xCAT-test/native/getinstdisk_selection.bats
sudo prove xCAT-test/native/getinstdisk_installer.t \
xCAT-test/native/enablekdump_per_node.t \
xCAT-test/native/sudoer_password_source.t
xCAT-test/native/sudoer_password_source.t \
xCAT-test/native/remoteshell_credentials.t
```
The BATS cases source the unchanged disk selector. Partition and udev fixtures
@@ -175,7 +178,9 @@ copy for this reason.
These cases run the unchanged scripts with private filesystems and no network.
Disk discovery, NFS mounts, credentials, account commands and service commands
use fixtures. The disk case never opens its dummy devices. The sudoer case
checks generated rules with the real `visudo` parser. These tests do not perform
checks generated rules with the real `visudo` parser. The remoteshell case
generates disposable SSH keys and checks their installation through the real script.
These tests do not perform
an installation, capture a kernel crash or modify host accounts.
Check the TAP output for skipped prerequisites. A successful `prove` exit with
xCAT-test/native/remoteshell_credentials.t
+171
View File
@@ -0,0 +1,171 @@
#!/usr/bin/env perl
use strict;
use warnings;
use File::Path qw(make_path);
use File::Slurper qw(read_binary write_binary);
use FindBin;
use lib "$FindBin::Bin/../lib";
use Test::More;
use XCAT::Test::File qw(repo_path);
use XCAT::Test::Process qw(run_command);
use XCAT::Test::Sandbox qw(sandbox_root sandbox_run);
plan skip_all => 'postscript targets Linux nodes' unless $^O eq 'linux';
die 'install openssl for the remoteshell postscript' unless -x '/usr/bin/openssl';
my $postscripts = repo_path('xCAT/postscripts');
my $keys = sandbox_root();
my @types = qw(dsa rsa ecdsa ed25519);
my %public_keys;
for my $type (@types) {
my ($rc, $output) = run_command('ssh-keygen', '-q', '-t', $type,
'-f', "$keys/$type", '-N', '', '-C', '');
die "cannot generate $type fixture: $output" if $rc;
$public_keys{$type} = read_binary("$keys/$type.pub");
$public_keys{$type} =~ s/\s+\z//;
}
my $hash = '$6$saltsalt$hashhashhash';
sub write_stub {
my ($path, $body) = @_;
write_binary($path, "#!/bin/sh\n$body");
chmod 0755, $path or die "chmod $path: $!";
}
sub read_optional {
my ($path) = @_;
return -f $path ? scalar read_binary($path) : '';
}
sub reply {
my ($content) = @_;
return "<xcatresponse>\n<data>\n<content>\n$content</content>\n</data>\n</xcatresponse>\n"
. "<xcatresponse>\n<serverdone></serverdone>\n</xcatresponse>\n";
}
sub run_remoteshell {
my (%opt) = @_;
my $root = sandbox_root();
make_path(map { "$root/$_" } qw(etc/ssh etc/systemd/system root/.ssh xcatpost replies));
make_path("$root/tmp/ssh_dsa_hostkey") if $opt{blocked_staging};
my $passwd = "root:x:0:0::/root:/bin/bash\n";
$passwd .= "runner:x:$>:0::/root:/bin/bash\n" if $>;
write_binary("$root/etc/passwd", $passwd);
write_binary("$root/etc/group", "root:x:0:\n");
write_binary("$root/etc/nsswitch.conf", "passwd: files\ngroup: files\n");
write_binary("$root/etc/os-release", "ID=almalinux\n");
write_binary("$root/etc/ssh/sshd_config", "Port 22\n");
write_binary("$root/etc/ssh/ssh_config", "Host *\n");
write_binary("$root/etc/systemd/system/sshd.service", "[Service]\n");
for my $type (@types) {
write_binary("$root/replies/ssh_${type}_hostkey", reply(read_binary("$keys/$type")));
}
my $zone = $opt{zone} ? ":$opt{zone}" : '';
my $public = "$public_keys{rsa} fixture &lt;node&gt; &apos;\n";
write_binary("$root/replies/ssh_root_pub_key$zone", reply($public));
write_binary("$root/replies/ssh_root_key$zone", reply(read_binary("$keys/rsa")));
write_binary("$root/replies/xcat_secure_pw:root",
"<xcatresponse>\n<content>$hash</content>\n</xcatresponse>\n");
if ($opt{error}) {
for my $path (glob "$root/replies/*") {
next if $opt{error} eq 'root' && $path !~ /xcat_secure_pw:root$/;
write_binary($path, "<xcatresponse>\n<error>denied &lt;node&gt; &apos;</error>\n</xcatresponse>\n");
}
}
write_stub("$root/bin/getcredentials.awk", <<'SH');
echo "getcredentials $*" >> /fixture/calls
count=$(grep -c -x -F "getcredentials $*" /fixture/calls)
[ "$count" -le "$EMPTY_REPLIES" ] && exit 0
cat "/fixture/replies/$1"
SH
write_stub("$root/bin/allowcred.awk", "exec /bin/sleep 30\n");
write_stub("$root/bin/sleep", "echo \"sleep \$*\" >> /fixture/calls\n");
write_stub("$root/bin/logger", "echo \"\$*\" >> /fixture/messages\n");
write_stub("$root/bin/systemctl", "echo \"systemctl \$*\" >> /fixture/calls\n");
write_stub("$root/bin/usermod", "echo \"usermod \$*\" >> /fixture/calls\n");
write_stub("$root/xcatpost/xcatflowrequest",
"echo \"flow \$*\" >> /fixture/calls\nexit \${FLOW_STATUS:-0}\n");
my ($rc, $output) = sandbox_run($root, {
read_only => {$postscripts => '/postscripts', "$root/xcatpost" => '/xcatpost'},
writable => {"$root/root" => '/root'},
env => {MASTER => '192.0.2.1', OSVER => 'rhels8', NTYPE => 'compute',
ENABLESSHBETWEENNODES => 'YES', NODESETSTATE => 'netboot', SECUREROOT => '1',
UPDATENODE => '0', ZONENAME => $opt{zone} || '',
USEFLOWCONTROL => $opt{flow} ? 'YES' : 'NO', FLOW_STATUS => $opt{flow_status} || 0,
EMPTY_REPLIES => $opt{empty} || 0}},
'/bin/bash', '/postscripts/remoteshell');
diag($output) if $rc || $output =~ /bwrap:/;
return {root => $root, rc => $rc, output => $output,
calls => read_optional("$root/calls"), log => read_optional("$root/messages")};
}
for my $case (
['initial replies', {}],
['retried replies', {empty => 1, flow => 1, zone => 'zone-a'}],
['flow failure', {empty => 1, flow => 1, flow_status => 1}],
['unwritable staging path', {blocked_staging => 1, flow => 1}],
) {
my ($label, $options) = @$case;
subtest $label => sub {
my $r = run_remoteshell(%$options);
is($r->{rc}, 0, 'full postscript completes');
for my $type (@types) {
is(read_optional("$r->{root}/etc/ssh/ssh_host_${type}_key"),
read_binary("$keys/$type"), "$type private key is unchanged");
is(read_optional("$r->{root}/etc/ssh/ssh_host_${type}_key.pub"),
"$public_keys{$type}\n", "$type public key is derived by ssh-keygen");
is(scalar(() = $r->{calls} =~ /^getcredentials ssh_${type}_hostkey$/mg),
$options->{empty} || ($type eq 'dsa' && $options->{blocked_staging}) ? 2 : 1,
"$type request count");
}
is(read_optional("$r->{root}/root/.ssh/id_rsa"), read_binary("$keys/rsa"),
'root private key is unchanged');
my $public = "$public_keys{rsa} fixture <node> '\n";
is(read_optional("$r->{root}/root/.ssh/id_rsa.pub"), $public, 'public key comment is decoded');
is(read_optional("$r->{root}/root/.ssh/authorized_keys"), $public, 'authorized key is decoded');
my $zone = $options->{zone} ? ":$options->{zone}" : '';
is(scalar(() = $r->{calls} =~ /^getcredentials ssh_root_pub_key\Q$zone\E$/mg),
$options->{empty} ? 3 : 1, 'root public key retains its separate retry requests');
is(scalar(() = $r->{calls} =~ /^getcredentials ssh_root_key\Q$zone\E$/mg),
$options->{empty} ? 2 : 1, 'root private key request count');
is(scalar(() = $r->{calls} =~ /^getcredentials xcat_secure_pw:root$/mg),
$options->{empty} ? 2 : 1, 'secure root request count');
like($r->{calls}, qr/^usermod -p \Q$hash\E root$/m, 'root receives the password field');
unlike($r->{log} . $r->{output}, qr/\Q$hash\E/, 'password field is not logged or printed');
like($r->{calls}, qr/^systemctl restart sshd/m, 'script reaches the SSH service boundary');
my @sleeps = $r->{calls} =~ /^sleep (\d+)$/mg;
is(shift @sleeps, 1, 'credential listener startup delay is retained');
is(scalar @sleeps, $options->{flow_status} ? 7 : 0, 'only failed flow control adds retry delays');
ok(!grep($_ < 10 || $_ > 19, @sleeps), 'retry delays are in the existing range');
is(scalar(() = $r->{calls} =~ /^flow /mg),
$options->{flow_status} ? 1 : $options->{blocked_staging} ? 8 : $options->{flow} ? 14 : 0,
'remoteshell disables flow control after a failed request');
};
}
for my $case (['initial errors', 0, 'all'], ['retry error', 1, 'root'], ['exhausted retries', 20, '']) {
my ($label, $empty, $error) = @$case;
subtest $label => sub {
my $r = run_remoteshell(empty => $empty, error => $error, flow => 1);
is($r->{rc}, 0, 'caller completes after a credential failure');
unlike($r->{calls}, qr/^usermod /m, 'failed password retrieval does not change root');
is(scalar(() = $r->{calls} =~ /^getcredentials xcat_secure_pw:root$/mg),
$empty == 20 ? 10 : $empty + 1, 'root keeps its retry limit and error stop');
if ($error) {
like($r->{log}, qr/Failed to acquire secure root password: denied <node> '/,
'server error survives filtering and decoding');
} else {
like($r->{log}, qr/Too many retries/, 'retry exhaustion is logged');
}
if ($error eq 'all' || $empty == 20) {
for my $type (@types) {
ok(!-s "$r->{root}/etc/ssh/ssh_host_${type}_key", "no unusable $type key installed");
is(scalar(() = $r->{calls} =~ /^getcredentials ssh_${type}_hostkey$/mg),
$empty == 20 ? 10 : 1, "$type retry limit");
}
is(read_optional("$r->{root}/root/.ssh/authorized_keys"), '', 'no authorized key is installed');
}
};
}
done_testing();
xCAT-test/native/sudoer_password_source.t
+53 -4
View File
@@ -32,7 +32,8 @@ sub field_reply {
XML
}
my $hash_reply = field_reply('$6$saltsalt$hashhashhash');
my $hash = '$6$saltsalt$hashhashhash';
my $hash_reply = field_reply($hash);
my $locked_reply = field_reply('!');
my $error_reply = <<'XML';
@@ -82,9 +83,13 @@ sub scratch_tree {
"echo \"visudo \$*\" >> /fixture/calls\n"
. ($opt{visudo_rejects} ? "exit 1\n" : 'exec /native-visudo "$@" >> /fixture/parser.log 2>&1'));
write_stub("$root/bin/getcredentials.awk",
"echo \"getcredentials \$*\" >> /fixture/calls\ncat /fixture/reply.xml\n");
"echo \"getcredentials \$*\" >> /fixture/calls\n"
. "n=\$(grep -c '^getcredentials ' /fixture/calls)\n"
. "if [ -f /fixture/reply.\$n ]; then cat /fixture/reply.\$n; else cat /fixture/reply.xml; fi\n");
write_stub("$root/bin/allowcred.awk", "exec /bin/sleep 30\n");
write_stub("$root/bin/sleep", "exit 0\n");
write_stub("$root/bin/sleep", "echo \"sleep \$*\" >> /fixture/calls\n");
write_stub("$root/xcatpost/xcatflowrequest",
"echo \"flow \$*\" >> /fixture/calls\nexit \${FLOW_STATUS:-0}\n");
write_stub("$root/bin/logger", "echo \"\$*\" >> /fixture/messages\n");
write_stub("$root/bin/chown", "exit 0\n");
write_stub("$root/bin/systemctl", "echo \"systemctl \$*\" >> /fixture/calls\n");
@@ -110,20 +115,28 @@ sub run_sudoer {
my $user = $opt{user} || 'xcat';
my $args = defined $opt{args} ? $opt{args} : '';
for my $reply (glob "$root/reply.[0-9]*") {
unlink $reply or die "unlink $reply: $!";
}
write_binary("$root/reply.xml", defined $opt{reply} ? $opt{reply} : '');
for my $index (0 .. $#{$opt{replies} || []}) {
write_binary("$root/reply." . ($index + 1), $opt{replies}[$index]);
}
write_binary("$root/calls", '');
write_binary("$root/messages", '');
my ($rc, $output) = sandbox_run($root, {
read_only => {$postscripts => '/postscripts', $visudo => '/native-visudo',
"$root/bin" => '/usr/sbin', "$root/xcatpost" => '/xcatpost'},
writable => {"$root/home" => '/home'},
env => {MASTER => '192.0.2.1', XCATSERVER => '192.0.2.1:3001'}},
env => {MASTER => '192.0.2.1', XCATSERVER => '192.0.2.1:3001',
USEFLOWCONTROL => $opt{flow} ? 'YES' : 'NO', FLOW_STATUS => $opt{flow_status} || 0}},
'/bin/bash', '/postscripts/sudoer', shellwords($args));
diag($output) if $output =~ /bwrap:/;
return {
root => $root,
rc => $rc,
output => $output,
calls => read_file("$root/calls"),
log => read_file("$root/messages"),
sudoers => read_file("$root/etc/sudoers"),
@@ -183,6 +196,42 @@ sub leftovers {
like($r->{log}, qr{set the password of xcat}, 'the applied password is logged');
}
for my $flow (0, 1) {
my $r = run_sudoer(replies => ['', '', $hash_reply], flow => $flow, flow_status => 1);
is($r->{rc}, 0, "delayed password completes with flow control $flow");
is(scalar(() = $r->{calls} =~ /^getcredentials /mg), 3, 'third reply is used');
is_deeply([$r->{calls} =~ /^sleep (.*)$/mg], [1, 5, 10], 'retry delays stay with the caller');
is(scalar(() = $r->{calls} =~ /^flow 192\.0\.2\.1 3001$/mg), $flow ? 3 : 0,
'a failed flow request does not disable sudoer flow control');
like($r->{calls}, qr/^usermod -p \$6\$saltsalt\$hashhashhash xcat$/m, 'delayed hash is applied');
unlike($r->{log} . $r->{output}, qr/\Q$hash\E/, 'hash is not logged or printed');
}
{
my $r = run_sudoer(reply => field_reply('!'), replies => [field_reply('')]);
is($r->{rc}, 1, 'a nonempty reply without content is not retried');
is(scalar(() = $r->{calls} =~ /^getcredentials /mg), 1, 'missing content stops after one request');
is($r->{managed}, '', 'missing content grants no sudo rule');
is($r->{authorized_keys}, '', 'missing content grants no SSH key');
}
{
my $r = run_sudoer(reply => $hash_reply, replies => ['']);
is($r->{rc}, 0, 'a delayed reply can precede a second postscript run');
my $again = run_sudoer(root => $r->{root}, reply => $locked_reply);
is($again->{rc}, 0, 'the second postscript run succeeds');
is(scalar(() = $again->{calls} =~ /^getcredentials /mg), 1,
'the second run does not reuse the previous empty reply');
}
{
my $r = run_sudoer(reply => "<xcatresponse>\n<error>denied &lt;name&gt; &quot; &apos;</error>\n</xcatresponse>\n");
is($r->{rc}, 1, 'encoded server error fails');
like($r->{log}, qr/denied <name> "; '/, 'the server error uses the existing entity substitutions');
unlike($r->{calls}, qr/^usermod -p/m, 'an error is not used as a password');
is($r->{managed}, '', 'an error grants no sudo rule');
}
# --- another user name, then a rename revokes the previous account -----------
{
my $r = run_sudoer(user => 'ops', args => '-u ops', reply => $hash_reply);
xCAT/postscripts/remoteshell
+15 -15
View File
@@ -111,7 +111,7 @@ if [ $useflowcontrol = "1" ]; then
fi
getcredentials.awk ssh_dsa_hostkey | grep -E -v '</{0,1}xcatresponse>|</{0,1}serverdone>' | sed -e 's/&lt;/</' -e 's/&gt;/>/' -e 's/&amp;/&/' -e 's/&quot/"/' -e "s/&apos;/'/" > /tmp/ssh_dsa_hostkey
getcredentials.awk ssh_dsa_hostkey | xcat_filter_credentials > /tmp/ssh_dsa_hostkey
#check the message is an error or not
grep -E '<error>' /tmp/ssh_dsa_hostkey > /dev/null 2>&1
@@ -146,7 +146,7 @@ if [ $? -ne 0 ]; then
useflowcontrol=0
fi
fi
getcredentials.awk ssh_dsa_hostkey | grep -v '<'|sed -e 's/&lt;/</' -e 's/&gt;/>/' -e 's/&amp;/&/' -e 's/&quot/"/' -e "s/&apos;/'/" > /etc/ssh/ssh_host_dsa_key
getcredentials.awk ssh_dsa_hostkey | grep -v '<'|xcat_decode_credentials > /etc/ssh/ssh_host_dsa_key
MYCONT=`cat /etc/ssh/ssh_host_dsa_key`
done
set_hostkey_permissions /etc/ssh/ssh_host_dsa_key
@@ -181,7 +181,7 @@ if [ $useflowcontrol = "1" ]; then
fi
fi
getcredentials.awk ssh_rsa_hostkey | grep -E -v '</{0,1}xcatresponse>|</{0,1}serverdone>' | sed -e 's/&lt;/</' -e 's/&gt;/>/' -e 's/&amp;/&/' -e 's/&quot/"/' -e "s/&apos;/'/" > /tmp/ssh_rsa_hostkey
getcredentials.awk ssh_rsa_hostkey | xcat_filter_credentials > /tmp/ssh_rsa_hostkey
#check whether the message is an error or not
grep -E '<error>' /tmp/ssh_rsa_hostkey > /dev/null 2>&1
@@ -216,7 +216,7 @@ if [ $? -ne 0 ]; then
fi
fi
getcredentials.awk ssh_rsa_hostkey | grep -v '<'|sed -e 's/&lt;/</' -e 's/&gt;/>/' -e 's/&amp;/&/' -e 's/&quot/"/' -e "s/&apos;/'/" > /etc/ssh/ssh_host_rsa_key
getcredentials.awk ssh_rsa_hostkey | grep -v '<' | xcat_decode_credentials > /etc/ssh/ssh_host_rsa_key
MYCONT=`cat /etc/ssh/ssh_host_rsa_key`
done
set_hostkey_permissions /etc/ssh/ssh_host_rsa_key
@@ -252,7 +252,7 @@ if ssh-keygen -t ecdsa -f /tmp/ecdsa_key -P "" &>/dev/null ; then
fi
fi
getcredentials.awk ssh_ecdsa_hostkey | grep -E -v '</{0,1}xcatresponse>|</{0,1}serverdone>' | sed -e 's/&lt;/</' -e 's/&gt;/>/' -e 's/&amp;/&/' -e 's/&quot/"/' -e "s/&apos;/'/" > /tmp/ssh_ecdsa_hostkey
getcredentials.awk ssh_ecdsa_hostkey | xcat_filter_credentials > /tmp/ssh_ecdsa_hostkey
#check whether the message is an error or not
grep -E '<error>' /tmp/ssh_ecdsa_hostkey > /dev/null 2>&1
@@ -287,7 +287,7 @@ if ssh-keygen -t ecdsa -f /tmp/ecdsa_key -P "" &>/dev/null ; then
fi
fi
getcredentials.awk ssh_ecdsa_hostkey | grep -v '<'|sed -e 's/&lt;/</' -e 's/&gt;/>/' -e 's/&amp;/&/' -e 's/&quot/"/' -e "s/&apos;/'/" > /etc/ssh/ssh_host_ecdsa_key
getcredentials.awk ssh_ecdsa_hostkey | grep -v '<' | xcat_decode_credentials > /etc/ssh/ssh_host_ecdsa_key
MYCONT=`cat /etc/ssh/ssh_host_ecdsa_key`
done
set_hostkey_permissions /etc/ssh/ssh_host_ecdsa_key
@@ -332,7 +332,7 @@ if ssh-keygen -t ed25519 -f /tmp/ed25519_key -P "" &>/dev/null ; then
fi
fi
getcredentials.awk ssh_ed25519_hostkey | grep -E -v '</{0,1}xcatresponse>|</{0,1}serverdone>' | sed -e 's/&lt;/</' -e 's/&gt;/>/' -e 's/&amp;/&/' -e 's/&quot/"/' -e "s/&apos;/'/" > /tmp/ssh_ed25519_hostkey
getcredentials.awk ssh_ed25519_hostkey | xcat_filter_credentials > /tmp/ssh_ed25519_hostkey
#check whether the message is an error or not
grep -E '<error>' /tmp/ssh_ed25519_hostkey > /dev/null 2>&1
@@ -367,7 +367,7 @@ if ssh-keygen -t ed25519 -f /tmp/ed25519_key -P "" &>/dev/null ; then
fi
fi
getcredentials.awk ssh_ed25519_hostkey | grep -v '<'|sed -e 's/&lt;/</' -e 's/&gt;/>/' -e 's/&amp;/&/' -e 's/&quot/"/' -e "s/&apos;/'/" > /etc/ssh/ssh_host_ed25519_key
getcredentials.awk ssh_ed25519_hostkey | grep -v '<' | xcat_decode_credentials > /etc/ssh/ssh_host_ed25519_key
MYCONT=`cat /etc/ssh/ssh_host_ed25519_key`
done
set_hostkey_permissions /etc/ssh/ssh_host_ed25519_key
@@ -431,7 +431,7 @@ if [ $useflowcontrol = "1" ]; then
fi
fi
getcredentials.awk $rootsshpubkey | grep -E -v '</{0,1}xcatresponse>|</{0,1}serverdone>'|sed -e 's/&lt;/</' -e 's/&gt;/>/' -e 's/&amp;/&/' -e 's/&quot/"/' -e "s/&apos;/'/" > /tmp/ssh_root_pub_key
getcredentials.awk $rootsshpubkey | xcat_filter_credentials > /tmp/ssh_root_pub_key
logger -t $log_label -p local4.info "remoteshell: gathering $rootsshpubkey "
#check whether the message is an error or not
@@ -467,8 +467,8 @@ if [ $? -ne 0 ]; then
useflowcontrol=0
fi
fi
getcredentials.awk $rootsshpubkey | grep -v '<'|sed -e 's/&lt;/</' -e 's/&gt;/>/' -e 's/&amp;/&/' -e 's/&quot/"/' -e "s/&apos;/'/" > /root/.ssh/id_rsa.pub
getcredentials.awk $rootsshpubkey | grep -v '<'|sed -e 's/&lt;/</' -e 's/&gt;/>/' -e 's/&amp;/&/' -e 's/&quot/"/' -e "s/&apos;/'/" >> /root/.ssh/authorized_keys
getcredentials.awk $rootsshpubkey | grep -v '<'|xcat_decode_credentials > /root/.ssh/id_rsa.pub
getcredentials.awk $rootsshpubkey | grep -v '<'|xcat_decode_credentials >> /root/.ssh/authorized_keys
MYCONT=`cat /root/.ssh/id_rsa.pub`
done
else
@@ -493,7 +493,7 @@ then
useflowcontrol=0
fi
fi
getcredentials.awk $rootsshpvtkey | grep -E -v '</{0,1}xcatresponse>|</{0,1}serverdone>'|sed -e 's/&lt;/</' -e 's/&gt;/>/' -e 's/&amp;/&/' -e 's/&quot/"/' -e "s/&apos;/'/" > /tmp/ssh_root_key
getcredentials.awk $rootsshpvtkey | xcat_filter_credentials > /tmp/ssh_root_key
logger -t $log_label -p local4.info "remoteshell: gathering $rootsshpvtkey "
#check whether the message is an error or not
@@ -527,7 +527,7 @@ then
useflowcontrol=0
fi
fi
getcredentials.awk $rootsshpvtkey | grep -v '<'|sed -e 's/&lt;/</' -e 's/&gt;/>/' -e 's/&amp;/&/' -e 's/&quot/"/' -e "s/&apos;/'/" > /root/.ssh/id_rsa
getcredentials.awk $rootsshpvtkey | grep -v '<'|xcat_decode_credentials > /root/.ssh/id_rsa
MYCONT=`cat /root/.ssh/id_rsa`
done
else
@@ -561,7 +561,7 @@ if [ "x$SECUREROOT" = "x1" ] && [ "x$UPDATENODE" != "x1" ]; then
useflowcontrol=0
fi
fi
getcredentials.awk xcat_secure_pw:root | grep -E -v '</{0,1}xcatresponse>|</{0,1}serverdone>'|sed -e 's/&lt;/</' -e 's/&gt;/>/' -e 's/&amp;/&/' -e 's/&quot/"/' -e "s/&apos;/'/" > /tmp/secure_root_hash
getcredentials.awk xcat_secure_pw:root | xcat_filter_credentials > /tmp/secure_root_hash
logger -t $log_label -p local4.info "remoteshell: gathering password hash for root"
#check whether the message is an error or not
@@ -593,7 +593,7 @@ if [ "x$SECUREROOT" = "x1" ] && [ "x$UPDATENODE" != "x1" ]; then
useflowcontrol=0
fi
fi
getcredentials.awk xcat_secure_pw:root | grep -E -v '</{0,1}xcatresponse>|</{0,1}serverdone>'|sed -e 's/&lt;/</' -e 's/&gt;/>/' -e 's/&amp;/&/' -e 's/&quot/"/' -e "s/&apos;/'/" > /tmp/secure_root_hash
getcredentials.awk xcat_secure_pw:root | xcat_filter_credentials > /tmp/secure_root_hash
grep -E '<error>' /tmp/secure_root_hash > /dev/null
if [ $? -ne 0 ]; then
rootpwhash=`cat /tmp/secure_root_hash | grep -E '</{0,1}content>' | sed -n 's%.*<content>\(.*\)</content>.*%\1%p'`
xCAT/postscripts/sudoer
+1 -1
View File
@@ -180,7 +180,7 @@ for attempt in 1 2 3; do
log info "sending xcatflowrequest $master 3001"
/xcatpost/xcatflowrequest $master 3001
fi
response=$(getcredentials.awk xcat_secure_pw:$SUDOER | grep -E -v '</{0,1}xcatresponse>|</{0,1}serverdone>' | sed -e 's/&lt;/</' -e 's/&gt;/>/' -e 's/&amp;/&/' -e 's/&quot/"/' -e "s/&apos;/'/")
response=$(getcredentials.awk xcat_secure_pw:$SUDOER | xcat_filter_credentials)
[ -n "$response" ] && break
[ $attempt -lt 3 ] && sleep $((attempt * 5))
done
xCAT/postscripts/xcatlib.sh
+10
View File
@@ -1053,6 +1053,16 @@ function xcat_restart_sshd_after_failed_service_restart {
$sshd_cmd
}
function xcat_decode_credentials {
sed -e 's/&lt;/</' -e 's/&gt;/>/' -e 's/&amp;/&/' \
-e 's/&quot/"/' -e "s/&apos;/'/"
}
function xcat_filter_credentials {
grep -E -v '</{0,1}xcatresponse>|</{0,1}serverdone>' |
xcat_decode_credentials
}
function fetch_mypostscript {
local postroot
postroot=$1